xmrig | d102885669437172b7e9020ef8dad1b1de2eeea9bc0fe9fd2425dfb0828f34b7

Analysis

max time kernel
33s
max time network
30s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 19:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
Size

2.2MB
MD5

0382bc8cff270e1ad219837c17349dd4
SHA1

551d30a18d26d9d2c4aba446d992b3e4150830c0
SHA256

d102885669437172b7e9020ef8dad1b1de2eeea9bc0fe9fd2425dfb0828f34b7
SHA512

6f9d0fed5228f524e46495fd19716a053a5e123cbd2bea3bb242f3bd6fcdfd495e367d1eab094a147fcfc495f938d75b70f43d80e30ea7209dfdb657f15520b0
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDg:NABP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/3064-27-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2620-19-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/1652-18-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2260-59-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2464-62-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/2972-61-0x00000000035B0000-0x00000000039A2000-memory.dmp	xmrig
behavioral1/memory/1624-69-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/2608-64-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/1264-56-0x000000013F970000-0x000000013FD62000-memory.dmp	xmrig
behavioral1/memory/2972-1703-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1652	SFggNzh.exe
2620	asmYBqO.exe
3064	VKoONAG.exe
1264	HDAiLtK.exe
2260	xLedjIY.exe
2464	pJJNNUh.exe
2608	UqneqVC.exe
1624	wRgBvMO.exe
2944	VNrwqTb.exe
108	CbicTEi.exe
3036	oGqBwFq.exe
2680	rFKSxtb.exe
1784	NsACeTU.exe
1588	ojLveOp.exe
2508	XucHnge.exe
1756	fNvgOLR.exe
1344	szyEbPB.exe
2112	yQDQFSU.exe
2100	AEhbEbx.exe
2116	LFZCxOy.exe
1964	JJmEWlY.exe
868	IAPJwtu.exe
1112	BdFjcZL.exe
1940	EDwZQho.exe
452	DMjcYIK.exe
3040	vbCtTbW.exe
1536	qsoVZlU.exe
1556	JJiXNSK.exe
1828	FsCOdGS.exe
760	rahnjce.exe
912	BNTGlSs.exe
1404	VPMwerO.exe
2916	qyDiVGJ.exe
2252	ZeyvpkB.exe
2212	UMwqbMI.exe
1824	mxJveLQ.exe
1720	zRScWji.exe
1608	BNpaoYx.exe
1580	tQNDvVv.exe
2540	SJwXlfz.exe
2728	QXsMGWF.exe
2700	VZJTpEh.exe
2936	XMESxqO.exe
2144	SKYOJjc.exe
568	rgwgBTh.exe
2108	oJwFJQR.exe
3048	pzEaZQH.exe
1196	kvdgQGM.exe
1736	dLUpNqy.exe
2496	zMymvdU.exe
1604	EAsoApX.exe
1288	qQdrrxN.exe
1084	IVTVdRM.exe
2176	NJIIpET.exe
1244	kNRFlNQ.exe
2752	wvDJpUe.exe
1312	zZMmWDh.exe
1204	cCiKgOB.exe
2096	HwrWwEd.exe
1872	eEfRkVj.exe
2420	ndooDIr.exe
488	PTLmzvG.exe
616	nWhCMJO.exe
1040	OndrgIW.exe

Loads dropped DLL 64 IoCs

pid	Process
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe

UPX packed file 50 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2972-0-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/files/0x0038000000015d6b-8.dat	upx
behavioral1/files/0x0007000000015e32-16.dat	upx
behavioral1/files/0x0007000000015ecc-29.dat	upx
behavioral1/memory/3064-27-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2620-19-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/memory/1652-18-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/files/0x000b000000015cff-6.dat	upx
behavioral1/files/0x000e0000000054ab-34.dat	upx
behavioral1/files/0x000900000001621e-47.dat	upx
behavioral1/files/0x0007000000016d18-58.dat	upx
behavioral1/memory/2260-59-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/memory/2464-62-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/memory/1624-69-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/files/0x0006000000016d3a-86.dat	upx
behavioral1/files/0x0006000000016d3e-90.dat	upx
behavioral1/files/0x0006000000016d5f-97.dat	upx
behavioral1/files/0x0006000000016d20-72.dat	upx
behavioral1/memory/2608-64-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/1264-56-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/files/0x0008000000015fe5-42.dat	upx
behavioral1/files/0x0006000000016d8e-106.dat	upx
behavioral1/files/0x0006000000016da5-113.dat	upx
behavioral1/files/0x0006000000016db9-120.dat	upx
behavioral1/files/0x000600000001704a-127.dat	upx
behavioral1/files/0x00060000000171df-134.dat	upx
behavioral1/files/0x0006000000017437-141.dat	upx
behavioral1/files/0x00050000000186f6-155.dat	upx
behavioral1/files/0x000500000001876e-169.dat	upx
behavioral1/files/0x0006000000018b5c-178.dat	upx
behavioral1/files/0x0005000000018774-171.dat	upx
behavioral1/files/0x000500000001876a-164.dat	upx
behavioral1/files/0x00050000000186fa-157.dat	upx
behavioral1/files/0x0005000000018665-150.dat	upx
behavioral1/files/0x0015000000018644-143.dat	upx
behavioral1/files/0x00060000000173d0-136.dat	upx
behavioral1/files/0x000600000001708b-129.dat	upx
behavioral1/files/0x0006000000016dbe-122.dat	upx
behavioral1/files/0x0006000000016db1-115.dat	upx
behavioral1/files/0x0006000000016d9d-108.dat	upx
behavioral1/files/0x0006000000016d74-101.dat	upx
behavioral1/files/0x0006000000016d43-94.dat	upx
behavioral1/files/0x0035000000015d7f-87.dat	upx
behavioral1/files/0x0006000000016d34-81.dat	upx
behavioral1/memory/2944-78-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/files/0x0006000000018bb0-183.dat	upx
behavioral1/files/0x0005000000018785-176.dat	upx
behavioral1/files/0x000500000001875a-162.dat	upx
behavioral1/files/0x0031000000018649-148.dat	upx
behavioral1/memory/2972-1703-0x000000013F920000-0x000000013FD12000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pJJNNUh.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\xczmNox.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\diUzuEU.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\WyVhzaF.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\WtJVYBG.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\dMoltwe.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\nWhCMJO.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\qzGKApB.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\FEQyQEF.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\nQMLnhn.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\NsAoBRa.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\zZMmWDh.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\SAIEUkq.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\knXQqmD.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\JuQnIWP.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\dpXfxXi.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\RLMdyBV.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\FTTIPWF.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\SZRWDOv.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\RNLJDAq.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\xmyeTGW.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\pFKeTRK.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\SXemCrb.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\oSJjNge.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\qVReEty.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\CnxbMXG.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\LAZOCkN.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\AkswKDG.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\eRUIilJ.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\jMPEvTW.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\avBamSr.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\NJAIUUE.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\yssIYvn.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\dtanfrN.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\MJTVubc.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\HUzTPdC.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\OVJcEUu.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\gAtUvtt.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\JCkncvO.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\LFZCxOy.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\tQNDvVv.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\PiOvJia.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\saWGDFc.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\yAfsVXy.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\RgmrhHg.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\IlSXtve.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\ojypxDD.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\oiEfZpw.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\sMofTIV.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\lSgSZUq.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\tEJKaft.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\qSamrhQ.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\vIwZHWR.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\IyclXEL.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\iFxDyON.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\NkSsuzh.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\vpsNfOK.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\tvDRETf.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\yhyLmEQ.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\UbqaRBQ.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\kSJOWnO.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\bSGQXwV.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\mMnGOUl.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
File created	C:\Windows\System\mSqGOuK.exe	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1636	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
Token: SeDebugPrivilege	1636	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1636	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	29
PID 2972 wrote to memory of 1636	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	29
PID 2972 wrote to memory of 1636	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	29
PID 2972 wrote to memory of 1652	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	30
PID 2972 wrote to memory of 1652	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	30
PID 2972 wrote to memory of 1652	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	30
PID 2972 wrote to memory of 2620	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	31
PID 2972 wrote to memory of 2620	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	31
PID 2972 wrote to memory of 2620	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	31
PID 2972 wrote to memory of 3064	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	32
PID 2972 wrote to memory of 3064	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	32
PID 2972 wrote to memory of 3064	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	32
PID 2972 wrote to memory of 1264	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	33
PID 2972 wrote to memory of 1264	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	33
PID 2972 wrote to memory of 1264	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	33
PID 2972 wrote to memory of 2260	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	34
PID 2972 wrote to memory of 2260	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	34
PID 2972 wrote to memory of 2260	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	34
PID 2972 wrote to memory of 2464	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	35
PID 2972 wrote to memory of 2464	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	35
PID 2972 wrote to memory of 2464	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	35
PID 2972 wrote to memory of 2608	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	36
PID 2972 wrote to memory of 2608	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	36
PID 2972 wrote to memory of 2608	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	36
PID 2972 wrote to memory of 1624	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	37
PID 2972 wrote to memory of 1624	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	37
PID 2972 wrote to memory of 1624	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	37
PID 2972 wrote to memory of 2944	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	38
PID 2972 wrote to memory of 2944	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	38
PID 2972 wrote to memory of 2944	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	38
PID 2972 wrote to memory of 108	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	39
PID 2972 wrote to memory of 108	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	39
PID 2972 wrote to memory of 108	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	39
PID 2972 wrote to memory of 3036	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	40
PID 2972 wrote to memory of 3036	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	40
PID 2972 wrote to memory of 3036	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	40
PID 2972 wrote to memory of 1288	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	41
PID 2972 wrote to memory of 1288	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	41
PID 2972 wrote to memory of 1288	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	41
PID 2972 wrote to memory of 2680	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	42
PID 2972 wrote to memory of 2680	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	42
PID 2972 wrote to memory of 2680	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	42
PID 2972 wrote to memory of 1084	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	43
PID 2972 wrote to memory of 1084	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	43
PID 2972 wrote to memory of 1084	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	43
PID 2972 wrote to memory of 1784	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	44
PID 2972 wrote to memory of 1784	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	44
PID 2972 wrote to memory of 1784	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	44
PID 2972 wrote to memory of 2176	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	45
PID 2972 wrote to memory of 2176	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	45
PID 2972 wrote to memory of 2176	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	45
PID 2972 wrote to memory of 1588	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	46
PID 2972 wrote to memory of 1588	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	46
PID 2972 wrote to memory of 1588	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	46
PID 2972 wrote to memory of 1244	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	47
PID 2972 wrote to memory of 1244	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	47
PID 2972 wrote to memory of 1244	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	47
PID 2972 wrote to memory of 2508	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	48
PID 2972 wrote to memory of 2508	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	48
PID 2972 wrote to memory of 2508	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	48
PID 2972 wrote to memory of 2752	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	49
PID 2972 wrote to memory of 2752	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	49
PID 2972 wrote to memory of 2752	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	49
PID 2972 wrote to memory of 1756	2972	0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0382bc8cff270e1ad219837c17349dd4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\System\SFggNzh.exe
  C:\Windows\System\SFggNzh.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\asmYBqO.exe
  C:\Windows\System\asmYBqO.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\VKoONAG.exe
  C:\Windows\System\VKoONAG.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\HDAiLtK.exe
  C:\Windows\System\HDAiLtK.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\xLedjIY.exe
  C:\Windows\System\xLedjIY.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\pJJNNUh.exe
  C:\Windows\System\pJJNNUh.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\UqneqVC.exe
  C:\Windows\System\UqneqVC.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\wRgBvMO.exe
  C:\Windows\System\wRgBvMO.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\VNrwqTb.exe
  C:\Windows\System\VNrwqTb.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\CbicTEi.exe
  C:\Windows\System\CbicTEi.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\oGqBwFq.exe
  C:\Windows\System\oGqBwFq.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\qQdrrxN.exe
  C:\Windows\System\qQdrrxN.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\rFKSxtb.exe
  C:\Windows\System\rFKSxtb.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\IVTVdRM.exe
  C:\Windows\System\IVTVdRM.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\NsACeTU.exe
  C:\Windows\System\NsACeTU.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\NJIIpET.exe
  C:\Windows\System\NJIIpET.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\ojLveOp.exe
  C:\Windows\System\ojLveOp.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\kNRFlNQ.exe
  C:\Windows\System\kNRFlNQ.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\XucHnge.exe
  C:\Windows\System\XucHnge.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\wvDJpUe.exe
  C:\Windows\System\wvDJpUe.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\fNvgOLR.exe
  C:\Windows\System\fNvgOLR.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\zZMmWDh.exe
  C:\Windows\System\zZMmWDh.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\szyEbPB.exe
  C:\Windows\System\szyEbPB.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\cCiKgOB.exe
  C:\Windows\System\cCiKgOB.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\yQDQFSU.exe
  C:\Windows\System\yQDQFSU.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\HwrWwEd.exe
  C:\Windows\System\HwrWwEd.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\AEhbEbx.exe
  C:\Windows\System\AEhbEbx.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\eEfRkVj.exe
  C:\Windows\System\eEfRkVj.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\LFZCxOy.exe
  C:\Windows\System\LFZCxOy.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\ndooDIr.exe
  C:\Windows\System\ndooDIr.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\JJmEWlY.exe
  C:\Windows\System\JJmEWlY.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\PTLmzvG.exe
  C:\Windows\System\PTLmzvG.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\IAPJwtu.exe
  C:\Windows\System\IAPJwtu.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\nWhCMJO.exe
  C:\Windows\System\nWhCMJO.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\BdFjcZL.exe
  C:\Windows\System\BdFjcZL.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\OndrgIW.exe
  C:\Windows\System\OndrgIW.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\EDwZQho.exe
  C:\Windows\System\EDwZQho.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\bFDqiPC.exe
  C:\Windows\System\bFDqiPC.exe
  2⤵
  PID:1760
- C:\Windows\System\DMjcYIK.exe
  C:\Windows\System\DMjcYIK.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\KvPhfqd.exe
  C:\Windows\System\KvPhfqd.exe
  2⤵
  PID:3044
- C:\Windows\System\vbCtTbW.exe
  C:\Windows\System\vbCtTbW.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\JsMVsUa.exe
  C:\Windows\System\JsMVsUa.exe
  2⤵
  PID:832
- C:\Windows\System\qsoVZlU.exe
  C:\Windows\System\qsoVZlU.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\MRfjTad.exe
  C:\Windows\System\MRfjTad.exe
  2⤵
  PID:1388
- C:\Windows\System\JJiXNSK.exe
  C:\Windows\System\JJiXNSK.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\jFzHKWd.exe
  C:\Windows\System\jFzHKWd.exe
  2⤵
  PID:1324
- C:\Windows\System\FsCOdGS.exe
  C:\Windows\System\FsCOdGS.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\hqRQwJk.exe
  C:\Windows\System\hqRQwJk.exe
  2⤵
  PID:764
- C:\Windows\System\rahnjce.exe
  C:\Windows\System\rahnjce.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\KUBMxij.exe
  C:\Windows\System\KUBMxij.exe
  2⤵
  PID:292
- C:\Windows\System\BNTGlSs.exe
  C:\Windows\System\BNTGlSs.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\tdrStLY.exe
  C:\Windows\System\tdrStLY.exe
  2⤵
  PID:3060
- C:\Windows\System\VPMwerO.exe
  C:\Windows\System\VPMwerO.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\iKFjwmT.exe
  C:\Windows\System\iKFjwmT.exe
  2⤵
  PID:2968
- C:\Windows\System\qyDiVGJ.exe
  C:\Windows\System\qyDiVGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\IHOoiHD.exe
  C:\Windows\System\IHOoiHD.exe
  2⤵
  PID:1948
- C:\Windows\System\ZeyvpkB.exe
  C:\Windows\System\ZeyvpkB.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\AbraeNo.exe
  C:\Windows\System\AbraeNo.exe
  2⤵
  PID:1764
- C:\Windows\System\UMwqbMI.exe
  C:\Windows\System\UMwqbMI.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\GDYPZIF.exe
  C:\Windows\System\GDYPZIF.exe
  2⤵
  PID:1832
- C:\Windows\System\mxJveLQ.exe
  C:\Windows\System\mxJveLQ.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\KSxBztM.exe
  C:\Windows\System\KSxBztM.exe
  2⤵
  PID:2308
- C:\Windows\System\zRScWji.exe
  C:\Windows\System\zRScWji.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\PkzaGHg.exe
  C:\Windows\System\PkzaGHg.exe
  2⤵
  PID:2380
- C:\Windows\System\BNpaoYx.exe
  C:\Windows\System\BNpaoYx.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\MVTfrqN.exe
  C:\Windows\System\MVTfrqN.exe
  2⤵
  PID:1696
- C:\Windows\System\tQNDvVv.exe
  C:\Windows\System\tQNDvVv.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\clgPSsN.exe
  C:\Windows\System\clgPSsN.exe
  2⤵
  PID:2588
- C:\Windows\System\SJwXlfz.exe
  C:\Windows\System\SJwXlfz.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\MrsPbLy.exe
  C:\Windows\System\MrsPbLy.exe
  2⤵
  PID:2724
- C:\Windows\System\QXsMGWF.exe
  C:\Windows\System\QXsMGWF.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\yDcDiVd.exe
  C:\Windows\System\yDcDiVd.exe
  2⤵
  PID:2444
- C:\Windows\System\VZJTpEh.exe
  C:\Windows\System\VZJTpEh.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\OlaOCrr.exe
  C:\Windows\System\OlaOCrr.exe
  2⤵
  PID:2008
- C:\Windows\System\XMESxqO.exe
  C:\Windows\System\XMESxqO.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\ZjTqNXw.exe
  C:\Windows\System\ZjTqNXw.exe
  2⤵
  PID:1216
- C:\Windows\System\SKYOJjc.exe
  C:\Windows\System\SKYOJjc.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\PHyZXQK.exe
  C:\Windows\System\PHyZXQK.exe
  2⤵
  PID:1292
- C:\Windows\System\rgwgBTh.exe
  C:\Windows\System\rgwgBTh.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\zRpnFye.exe
  C:\Windows\System\zRpnFye.exe
  2⤵
  PID:2424
- C:\Windows\System\oJwFJQR.exe
  C:\Windows\System\oJwFJQR.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\fojzfAg.exe
  C:\Windows\System\fojzfAg.exe
  2⤵
  PID:812
- C:\Windows\System\pzEaZQH.exe
  C:\Windows\System\pzEaZQH.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\fSUlLhH.exe
  C:\Windows\System\fSUlLhH.exe
  2⤵
  PID:1096
- C:\Windows\System\kvdgQGM.exe
  C:\Windows\System\kvdgQGM.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\nKvWwny.exe
  C:\Windows\System\nKvWwny.exe
  2⤵
  PID:1192
- C:\Windows\System\dLUpNqy.exe
  C:\Windows\System\dLUpNqy.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\DBZUhWt.exe
  C:\Windows\System\DBZUhWt.exe
  2⤵
  PID:1924
- C:\Windows\System\zMymvdU.exe
  C:\Windows\System\zMymvdU.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\EsBARUT.exe
  C:\Windows\System\EsBARUT.exe
  2⤵
  PID:1160
- C:\Windows\System\EAsoApX.exe
  C:\Windows\System\EAsoApX.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\SGNWHRT.exe
  C:\Windows\System\SGNWHRT.exe
  2⤵
  PID:2596
- C:\Windows\System\qvbRicL.exe
  C:\Windows\System\qvbRicL.exe
  2⤵
  PID:1640
- C:\Windows\System\nfPVyxy.exe
  C:\Windows\System\nfPVyxy.exe
  2⤵
  PID:332
- C:\Windows\System\lbVseKs.exe
  C:\Windows\System\lbVseKs.exe
  2⤵
  PID:496
- C:\Windows\System\mnswEkY.exe
  C:\Windows\System\mnswEkY.exe
  2⤵
  PID:3364
- C:\Windows\System\CPRazzg.exe
  C:\Windows\System\CPRazzg.exe
  2⤵
  PID:3384
- C:\Windows\System\pQZaKWM.exe
  C:\Windows\System\pQZaKWM.exe
  2⤵
  PID:3400
- C:\Windows\System\NHsWvMD.exe
  C:\Windows\System\NHsWvMD.exe
  2⤵
  PID:3420
- C:\Windows\System\lwWoPPz.exe
  C:\Windows\System\lwWoPPz.exe
  2⤵
  PID:3436
- C:\Windows\System\CmiyhMc.exe
  C:\Windows\System\CmiyhMc.exe
  2⤵
  PID:3452
- C:\Windows\System\AjXNYDR.exe
  C:\Windows\System\AjXNYDR.exe
  2⤵
  PID:3468
- C:\Windows\System\QSzUeza.exe
  C:\Windows\System\QSzUeza.exe
  2⤵
  PID:3484
- C:\Windows\System\zuVYAgS.exe
  C:\Windows\System\zuVYAgS.exe
  2⤵
  PID:3500
- C:\Windows\System\cVPrlHB.exe
  C:\Windows\System\cVPrlHB.exe
  2⤵
  PID:3516
- C:\Windows\System\PIBupKk.exe
  C:\Windows\System\PIBupKk.exe
  2⤵
  PID:3532
- C:\Windows\System\SgqwdFi.exe
  C:\Windows\System\SgqwdFi.exe
  2⤵
  PID:3548
- C:\Windows\System\MlUMqbR.exe
  C:\Windows\System\MlUMqbR.exe
  2⤵
  PID:3564
- C:\Windows\System\PiOvJia.exe
  C:\Windows\System\PiOvJia.exe
  2⤵
  PID:3584
- C:\Windows\System\PtNdtXE.exe
  C:\Windows\System\PtNdtXE.exe
  2⤵
  PID:3600
- C:\Windows\System\vAmwYSY.exe
  C:\Windows\System\vAmwYSY.exe
  2⤵
  PID:3620
- C:\Windows\System\OpSGzrd.exe
  C:\Windows\System\OpSGzrd.exe
  2⤵
  PID:3636
- C:\Windows\System\eTfxqnB.exe
  C:\Windows\System\eTfxqnB.exe
  2⤵
  PID:3652
- C:\Windows\System\BvVTQDS.exe
  C:\Windows\System\BvVTQDS.exe
  2⤵
  PID:3672
- C:\Windows\System\gDJuHvf.exe
  C:\Windows\System\gDJuHvf.exe
  2⤵
  PID:3688
- C:\Windows\System\fnyGHJj.exe
  C:\Windows\System\fnyGHJj.exe
  2⤵
  PID:3704
- C:\Windows\System\gDKjHZq.exe
  C:\Windows\System\gDKjHZq.exe
  2⤵
  PID:3720
- C:\Windows\System\xLxzqCO.exe
  C:\Windows\System\xLxzqCO.exe
  2⤵
  PID:3736
- C:\Windows\System\gMsUtMi.exe
  C:\Windows\System\gMsUtMi.exe
  2⤵
  PID:3752
- C:\Windows\System\OTTCkle.exe
  C:\Windows\System\OTTCkle.exe
  2⤵
  PID:3768
- C:\Windows\System\fYnrUGh.exe
  C:\Windows\System\fYnrUGh.exe
  2⤵
  PID:3784
- C:\Windows\System\rNZMeMM.exe
  C:\Windows\System\rNZMeMM.exe
  2⤵
  PID:3804
- C:\Windows\System\aOLqmyL.exe
  C:\Windows\System\aOLqmyL.exe
  2⤵
  PID:3820
- C:\Windows\System\DzSybPZ.exe
  C:\Windows\System\DzSybPZ.exe
  2⤵
  PID:3836
- C:\Windows\System\VblTQqQ.exe
  C:\Windows\System\VblTQqQ.exe
  2⤵
  PID:3852
- C:\Windows\System\LOPRYIz.exe
  C:\Windows\System\LOPRYIz.exe
  2⤵
  PID:3868
- C:\Windows\System\ynvUmId.exe
  C:\Windows\System\ynvUmId.exe
  2⤵
  PID:3884
- C:\Windows\System\jnozCzQ.exe
  C:\Windows\System\jnozCzQ.exe
  2⤵
  PID:3900
- C:\Windows\System\yTAPuym.exe
  C:\Windows\System\yTAPuym.exe
  2⤵
  PID:3916
- C:\Windows\System\SkeMyAH.exe
  C:\Windows\System\SkeMyAH.exe
  2⤵
  PID:3932
- C:\Windows\System\EPrnvub.exe
  C:\Windows\System\EPrnvub.exe
  2⤵
  PID:3972
- C:\Windows\System\WKeUJfU.exe
  C:\Windows\System\WKeUJfU.exe
  2⤵
  PID:3988
- C:\Windows\System\KXXvsit.exe
  C:\Windows\System\KXXvsit.exe
  2⤵
  PID:4004
- C:\Windows\System\VYpyUzb.exe
  C:\Windows\System\VYpyUzb.exe
  2⤵
  PID:4024
- C:\Windows\System\CavXZwR.exe
  C:\Windows\System\CavXZwR.exe
  2⤵
  PID:4040
- C:\Windows\System\LjvXcRe.exe
  C:\Windows\System\LjvXcRe.exe
  2⤵
  PID:4060
- C:\Windows\System\fcZbhTU.exe
  C:\Windows\System\fcZbhTU.exe
  2⤵
  PID:4076
- C:\Windows\System\MksKytV.exe
  C:\Windows\System\MksKytV.exe
  2⤵
  PID:2460
- C:\Windows\System\VvGIQio.exe
  C:\Windows\System\VvGIQio.exe
  2⤵
  PID:1208
- C:\Windows\System\tQLsGyD.exe
  C:\Windows\System\tQLsGyD.exe
  2⤵
  PID:2868
- C:\Windows\System\wXqIOAn.exe
  C:\Windows\System\wXqIOAn.exe
  2⤵
  PID:3112
- C:\Windows\System\bVPFMzd.exe
  C:\Windows\System\bVPFMzd.exe
  2⤵
  PID:3172
- C:\Windows\System\UjOPYvV.exe
  C:\Windows\System\UjOPYvV.exe
  2⤵
  PID:3208
- C:\Windows\System\FKXUDTc.exe
  C:\Windows\System\FKXUDTc.exe
  2⤵
  PID:3228
- C:\Windows\System\hKvUAwd.exe
  C:\Windows\System\hKvUAwd.exe
  2⤵
  PID:3256
- C:\Windows\System\NsJEgiC.exe
  C:\Windows\System\NsJEgiC.exe
  2⤵
  PID:2240
- C:\Windows\System\MRnzAOV.exe
  C:\Windows\System\MRnzAOV.exe
  2⤵
  PID:2036
- C:\Windows\System\IcwJdoc.exe
  C:\Windows\System\IcwJdoc.exe
  2⤵
  PID:2028
- C:\Windows\System\ZFTuwXh.exe
  C:\Windows\System\ZFTuwXh.exe
  2⤵
  PID:1304
- C:\Windows\System\IKgiygv.exe
  C:\Windows\System\IKgiygv.exe
  2⤵
  PID:1528
- C:\Windows\System\EzQFmvr.exe
  C:\Windows\System\EzQFmvr.exe
  2⤵
  PID:2416
- C:\Windows\System\xShfzyD.exe
  C:\Windows\System\xShfzyD.exe
  2⤵
  PID:2456
- C:\Windows\System\aAmfoeV.exe
  C:\Windows\System\aAmfoeV.exe
  2⤵
  PID:1576
- C:\Windows\System\ltzVIvv.exe
  C:\Windows\System\ltzVIvv.exe
  2⤵
  PID:1968
- C:\Windows\System\UVLbhGk.exe
  C:\Windows\System\UVLbhGk.exe
  2⤵
  PID:2900
- C:\Windows\System\sHObvKY.exe
  C:\Windows\System\sHObvKY.exe
  2⤵
  PID:3408
- C:\Windows\System\WxlWkZn.exe
  C:\Windows\System\WxlWkZn.exe
  2⤵
  PID:3460
- C:\Windows\System\JhlExbz.exe
  C:\Windows\System\JhlExbz.exe
  2⤵
  PID:3560
- C:\Windows\System\KxvrlIl.exe
  C:\Windows\System\KxvrlIl.exe
  2⤵
  PID:3576
- C:\Windows\System\IJpPfUi.exe
  C:\Windows\System\IJpPfUi.exe
  2⤵
  PID:3580
- C:\Windows\System\pJqsZxT.exe
  C:\Windows\System\pJqsZxT.exe
  2⤵
  PID:3616
- C:\Windows\System\mDiUWaZ.exe
  C:\Windows\System\mDiUWaZ.exe
  2⤵
  PID:3764
- C:\Windows\System\nTgugfn.exe
  C:\Windows\System\nTgugfn.exe
  2⤵
  PID:3864
- C:\Windows\System\OpJRmLV.exe
  C:\Windows\System\OpJRmLV.exe
  2⤵
  PID:3924
- C:\Windows\System\xUSZrej.exe
  C:\Windows\System\xUSZrej.exe
  2⤵
  PID:3684
- C:\Windows\System\YYystAE.exe
  C:\Windows\System\YYystAE.exe
  2⤵
  PID:4020
- C:\Windows\System\WnNZDQD.exe
  C:\Windows\System\WnNZDQD.exe
  2⤵
  PID:3716
- C:\Windows\System\hyzmOST.exe
  C:\Windows\System\hyzmOST.exe
  2⤵
  PID:3780
- C:\Windows\System\jeStiIQ.exe
  C:\Windows\System\jeStiIQ.exe
  2⤵
  PID:2560
- C:\Windows\System\PNeeZoc.exe
  C:\Windows\System\PNeeZoc.exe
  2⤵
  PID:3880
- C:\Windows\System\qpYCWFS.exe
  C:\Windows\System\qpYCWFS.exe
  2⤵
  PID:4056
- C:\Windows\System\NEoMZAl.exe
  C:\Windows\System\NEoMZAl.exe
  2⤵
  PID:3948
- C:\Windows\System\lgWCXkE.exe
  C:\Windows\System\lgWCXkE.exe
  2⤵
  PID:4032
- C:\Windows\System\oAJjYVz.exe
  C:\Windows\System\oAJjYVz.exe
  2⤵
  PID:4088
- C:\Windows\System\iKKzCHE.exe
  C:\Windows\System\iKKzCHE.exe
  2⤵
  PID:3968
- C:\Windows\System\eplOMwo.exe
  C:\Windows\System\eplOMwo.exe
  2⤵
  PID:2324
- C:\Windows\System\eMUIZrb.exe
  C:\Windows\System\eMUIZrb.exe
  2⤵
  PID:2304
- C:\Windows\System\fvqpiXU.exe
  C:\Windows\System\fvqpiXU.exe
  2⤵
  PID:2616
- C:\Windows\System\VyvUDjd.exe
  C:\Windows\System\VyvUDjd.exe
  2⤵
  PID:1904
- C:\Windows\System\awjKFQv.exe
  C:\Windows\System\awjKFQv.exe
  2⤵
  PID:3132
- C:\Windows\System\rlERWud.exe
  C:\Windows\System\rlERWud.exe
  2⤵
  PID:2084
- C:\Windows\System\tuIXQMG.exe
  C:\Windows\System\tuIXQMG.exe
  2⤵
  PID:3152
- C:\Windows\System\wdHXwXc.exe
  C:\Windows\System\wdHXwXc.exe
  2⤵
  PID:2592
- C:\Windows\System\YsSbDmH.exe
  C:\Windows\System\YsSbDmH.exe
  2⤵
  PID:2532
- C:\Windows\System\HUzTPdC.exe
  C:\Windows\System\HUzTPdC.exe
  2⤵
  PID:1912
- C:\Windows\System\GdfQsvp.exe
  C:\Windows\System\GdfQsvp.exe
  2⤵
  PID:1668
- C:\Windows\System\faCgCSN.exe
  C:\Windows\System\faCgCSN.exe
  2⤵
  PID:1944
- C:\Windows\System\qSWZoDj.exe
  C:\Windows\System\qSWZoDj.exe
  2⤵
  PID:3188
- C:\Windows\System\saWGDFc.exe
  C:\Windows\System\saWGDFc.exe
  2⤵
  PID:3184
- C:\Windows\System\SkEFlks.exe
  C:\Windows\System\SkEFlks.exe
  2⤵
  PID:3220
- C:\Windows\System\RgmrhHg.exe
  C:\Windows\System\RgmrhHg.exe
  2⤵
  PID:3252
- C:\Windows\System\vaBOzjy.exe
  C:\Windows\System\vaBOzjy.exe
  2⤵
  PID:2024
- C:\Windows\System\YEvVXVP.exe
  C:\Windows\System\YEvVXVP.exe
  2⤵
  PID:880
- C:\Windows\System\PXZHuaz.exe
  C:\Windows\System\PXZHuaz.exe
  2⤵
  PID:2784
- C:\Windows\System\DHVwtiW.exe
  C:\Windows\System\DHVwtiW.exe
  2⤵
  PID:2692
- C:\Windows\System\hmzRHLE.exe
  C:\Windows\System\hmzRHLE.exe
  2⤵
  PID:1144
- C:\Windows\System\anLVxgt.exe
  C:\Windows\System\anLVxgt.exe
  2⤵
  PID:2164
- C:\Windows\System\HhpxhUV.exe
  C:\Windows\System\HhpxhUV.exe
  2⤵
  PID:2708
- C:\Windows\System\hhVNsDS.exe
  C:\Windows\System\hhVNsDS.exe
  2⤵
  PID:2872
- C:\Windows\System\IvwFyQS.exe
  C:\Windows\System\IvwFyQS.exe
  2⤵
  PID:3308
- C:\Windows\System\mrUvASU.exe
  C:\Windows\System\mrUvASU.exe
  2⤵
  PID:2184
- C:\Windows\System\zkhJYPH.exe
  C:\Windows\System\zkhJYPH.exe
  2⤵
  PID:1520
- C:\Windows\System\iTwFwpG.exe
  C:\Windows\System\iTwFwpG.exe
  2⤵
  PID:2268
- C:\Windows\System\zZiXvyc.exe
  C:\Windows\System\zZiXvyc.exe
  2⤵
  PID:2748
- C:\Windows\System\aJpfJcF.exe
  C:\Windows\System\aJpfJcF.exe
  2⤵
  PID:3376
- C:\Windows\System\eRnZZMV.exe
  C:\Windows\System\eRnZZMV.exe
  2⤵
  PID:2568
- C:\Windows\System\aJaKGRX.exe
  C:\Windows\System\aJaKGRX.exe
  2⤵
  PID:3524
- C:\Windows\System\foKvroJ.exe
  C:\Windows\System\foKvroJ.exe
  2⤵
  PID:3476
- C:\Windows\System\QOduvIf.exe
  C:\Windows\System\QOduvIf.exe
  2⤵
  PID:2104
- C:\Windows\System\klsaOYn.exe
  C:\Windows\System\klsaOYn.exe
  2⤵
  PID:3544
- C:\Windows\System\hJAGpAn.exe
  C:\Windows\System\hJAGpAn.exe
  2⤵
  PID:3632
- C:\Windows\System\adChuTr.exe
  C:\Windows\System\adChuTr.exe
  2⤵
  PID:3668
- C:\Windows\System\NFSPZoZ.exe
  C:\Windows\System\NFSPZoZ.exe
  2⤵
  PID:3732
- C:\Windows\System\TKIukDx.exe
  C:\Windows\System\TKIukDx.exe
  2⤵
  PID:2276
- C:\Windows\System\paDCDQx.exe
  C:\Windows\System\paDCDQx.exe
  2⤵
  PID:4012
- C:\Windows\System\DrFtTFH.exe
  C:\Windows\System\DrFtTFH.exe
  2⤵
  PID:3744
- C:\Windows\System\PmqZFsK.exe
  C:\Windows\System\PmqZFsK.exe
  2⤵
  PID:3908
- C:\Windows\System\ZfmQcpG.exe
  C:\Windows\System\ZfmQcpG.exe
  2⤵
  PID:1372
- C:\Windows\System\XwKMImb.exe
  C:\Windows\System\XwKMImb.exe
  2⤵
  PID:3964
- C:\Windows\System\EIOMyBS.exe
  C:\Windows\System\EIOMyBS.exe
  2⤵
  PID:932
- C:\Windows\System\hRUeEdi.exe
  C:\Windows\System\hRUeEdi.exe
  2⤵
  PID:2092
- C:\Windows\System\RFBSken.exe
  C:\Windows\System\RFBSken.exe
  2⤵
  PID:3944
- C:\Windows\System\ECjzZyb.exe
  C:\Windows\System\ECjzZyb.exe
  2⤵
  PID:1888
- C:\Windows\System\tznFfbe.exe
  C:\Windows\System\tznFfbe.exe
  2⤵
  PID:3128
- C:\Windows\System\vCOBmdm.exe
  C:\Windows\System\vCOBmdm.exe
  2⤵
  PID:3096
- C:\Windows\System\svXQXJB.exe
  C:\Windows\System\svXQXJB.exe
  2⤵
  PID:412
- C:\Windows\System\mbhtKYp.exe
  C:\Windows\System\mbhtKYp.exe
  2⤵
  PID:2572
- C:\Windows\System\IRzuskf.exe
  C:\Windows\System\IRzuskf.exe
  2⤵
  PID:784
- C:\Windows\System\PGOeCkZ.exe
  C:\Windows\System\PGOeCkZ.exe
  2⤵
  PID:3180
- C:\Windows\System\pEjLZyE.exe
  C:\Windows\System\pEjLZyE.exe
  2⤵
  PID:2292
- C:\Windows\System\iwDFwaM.exe
  C:\Windows\System\iwDFwaM.exe
  2⤵
  PID:2952
- C:\Windows\System\eHetNnC.exe
  C:\Windows\System\eHetNnC.exe
  2⤵
  PID:1620
- C:\Windows\System\jORuDGA.exe
  C:\Windows\System\jORuDGA.exe
  2⤵
  PID:1892
- C:\Windows\System\wcsjONe.exe
  C:\Windows\System\wcsjONe.exe
  2⤵
  PID:2004
- C:\Windows\System\NAHWunx.exe
  C:\Windows\System\NAHWunx.exe
  2⤵
  PID:3264
- C:\Windows\System\EjCdcLJ.exe
  C:\Windows\System\EjCdcLJ.exe
  2⤵
  PID:1524
- C:\Windows\System\PfTDTiG.exe
  C:\Windows\System\PfTDTiG.exe
  2⤵
  PID:2984
- C:\Windows\System\IyclXEL.exe
  C:\Windows\System\IyclXEL.exe
  2⤵
  PID:404
- C:\Windows\System\vAASUxT.exe
  C:\Windows\System\vAASUxT.exe
  2⤵
  PID:348
- C:\Windows\System\hNwEjPa.exe
  C:\Windows\System\hNwEjPa.exe
  2⤵
  PID:2244
- C:\Windows\System\XkHHzIb.exe
  C:\Windows\System\XkHHzIb.exe
  2⤵
  PID:1564
- C:\Windows\System\ecDgsus.exe
  C:\Windows\System\ecDgsus.exe
  2⤵
  PID:2800
- C:\Windows\System\zOyABiG.exe
  C:\Windows\System\zOyABiG.exe
  2⤵
  PID:2564
- C:\Windows\System\bFHGeVP.exe
  C:\Windows\System\bFHGeVP.exe
  2⤵
  PID:2020
- C:\Windows\System\dXjEGWy.exe
  C:\Windows\System\dXjEGWy.exe
  2⤵
  PID:3596
- C:\Windows\System\CRhPVju.exe
  C:\Windows\System\CRhPVju.exe
  2⤵
  PID:3432
- C:\Windows\System\GRNZfXm.exe
  C:\Windows\System\GRNZfXm.exe
  2⤵
  PID:3696
- C:\Windows\System\KPsWcnn.exe
  C:\Windows\System\KPsWcnn.exe
  2⤵
  PID:3000
- C:\Windows\System\JUaHWmD.exe
  C:\Windows\System\JUaHWmD.exe
  2⤵
  PID:1688
- C:\Windows\System\AlPqXRW.exe
  C:\Windows\System\AlPqXRW.exe
  2⤵
  PID:2940
- C:\Windows\System\FbrMTFd.exe
  C:\Windows\System\FbrMTFd.exe
  2⤵
  PID:2440
- C:\Windows\System\iJJAFkd.exe
  C:\Windows\System\iJJAFkd.exe
  2⤵
  PID:1540
- C:\Windows\System\zafWwqa.exe
  C:\Windows\System\zafWwqa.exe
  2⤵
  PID:696
- C:\Windows\System\mmchuet.exe
  C:\Windows\System\mmchuet.exe
  2⤵
  PID:3492
- C:\Windows\System\TxnfMeY.exe
  C:\Windows\System\TxnfMeY.exe
  2⤵
  PID:3528
- C:\Windows\System\akDuaGE.exe
  C:\Windows\System\akDuaGE.exe
  2⤵
  PID:3848
- C:\Windows\System\ktgGdxU.exe
  C:\Windows\System\ktgGdxU.exe
  2⤵
  PID:4084
- C:\Windows\System\YUsEcfm.exe
  C:\Windows\System\YUsEcfm.exe
  2⤵
  PID:3120
- C:\Windows\System\tYMccBM.exe
  C:\Windows\System\tYMccBM.exe
  2⤵
  PID:560
- C:\Windows\System\zxmGpRt.exe
  C:\Windows\System\zxmGpRt.exe
  2⤵
  PID:1240
- C:\Windows\System\ecPhHuQ.exe
  C:\Windows\System\ecPhHuQ.exe
  2⤵
  PID:3304
- C:\Windows\System\XokQJHD.exe
  C:\Windows\System\XokQJHD.exe
  2⤵
  PID:1908
- C:\Windows\System\SfekXwj.exe
  C:\Windows\System\SfekXwj.exe
  2⤵
  PID:3508
- C:\Windows\System\NgBNnDM.exe
  C:\Windows\System\NgBNnDM.exe
  2⤵
  PID:2756
- C:\Windows\System\zJNjObd.exe
  C:\Windows\System\zJNjObd.exe
  2⤵
  PID:2880
- C:\Windows\System\lZwRkPL.exe
  C:\Windows\System\lZwRkPL.exe
  2⤵
  PID:3236
- C:\Windows\System\jMPEvTW.exe
  C:\Windows\System\jMPEvTW.exe
  2⤵
  PID:3648
- C:\Windows\System\bVIygQt.exe
  C:\Windows\System\bVIygQt.exe
  2⤵
  PID:804
- C:\Windows\System\MRxhpvK.exe
  C:\Windows\System\MRxhpvK.exe
  2⤵
  PID:1684
- C:\Windows\System\WNpeWCx.exe
  C:\Windows\System\WNpeWCx.exe
  2⤵
  PID:2716
- C:\Windows\System\iCRsEwJ.exe
  C:\Windows\System\iCRsEwJ.exe
  2⤵
  PID:4072
- C:\Windows\System\okmhUbQ.exe
  C:\Windows\System\okmhUbQ.exe
  2⤵
  PID:2632
- C:\Windows\System\opWthyY.exe
  C:\Windows\System\opWthyY.exe
  2⤵
  PID:4112
- C:\Windows\System\FHEvttW.exe
  C:\Windows\System\FHEvttW.exe
  2⤵
  PID:4128
- C:\Windows\System\fdZHTZf.exe
  C:\Windows\System\fdZHTZf.exe
  2⤵
  PID:4144
- C:\Windows\System\yBspjwB.exe
  C:\Windows\System\yBspjwB.exe
  2⤵
  PID:4160
- C:\Windows\System\ZCBBAcU.exe
  C:\Windows\System\ZCBBAcU.exe
  2⤵
  PID:4176
- C:\Windows\System\DQeGNeQ.exe
  C:\Windows\System\DQeGNeQ.exe
  2⤵
  PID:4192
- C:\Windows\System\LHAOQrT.exe
  C:\Windows\System\LHAOQrT.exe
  2⤵
  PID:4208
- C:\Windows\System\lWHRZHK.exe
  C:\Windows\System\lWHRZHK.exe
  2⤵
  PID:4328
- C:\Windows\System\ZfszSTP.exe
  C:\Windows\System\ZfszSTP.exe
  2⤵
  PID:4360
- C:\Windows\System\pTVBCCg.exe
  C:\Windows\System\pTVBCCg.exe
  2⤵
  PID:4396
- C:\Windows\System\LbzswNE.exe
  C:\Windows\System\LbzswNE.exe
  2⤵
  PID:4416
- C:\Windows\System\dAAFcpA.exe
  C:\Windows\System\dAAFcpA.exe
  2⤵
  PID:4436
- C:\Windows\System\rKEHysL.exe
  C:\Windows\System\rKEHysL.exe
  2⤵
  PID:4464
- C:\Windows\System\aNUUHWN.exe
  C:\Windows\System\aNUUHWN.exe
  2⤵
  PID:4484
- C:\Windows\System\dtanfrN.exe
  C:\Windows\System\dtanfrN.exe
  2⤵
  PID:4500
- C:\Windows\System\TjSBNmc.exe
  C:\Windows\System\TjSBNmc.exe
  2⤵
  PID:4516
- C:\Windows\System\lWUrfya.exe
  C:\Windows\System\lWUrfya.exe
  2⤵
  PID:4532
- C:\Windows\System\YZAaKXb.exe
  C:\Windows\System\YZAaKXb.exe
  2⤵
  PID:4560
- C:\Windows\System\AZiOOJW.exe
  C:\Windows\System\AZiOOJW.exe
  2⤵
  PID:4576
- C:\Windows\System\BUYLGyG.exe
  C:\Windows\System\BUYLGyG.exe
  2⤵
  PID:4596
- C:\Windows\System\ptidgRF.exe
  C:\Windows\System\ptidgRF.exe
  2⤵
  PID:4612
- C:\Windows\System\ovwCNwl.exe
  C:\Windows\System\ovwCNwl.exe
  2⤵
  PID:4640
- C:\Windows\System\oLXeIdl.exe
  C:\Windows\System\oLXeIdl.exe
  2⤵
  PID:4664
- C:\Windows\System\ChpeqPU.exe
  C:\Windows\System\ChpeqPU.exe
  2⤵
  PID:4688
- C:\Windows\System\ZKVYjpV.exe
  C:\Windows\System\ZKVYjpV.exe
  2⤵
  PID:4704
- C:\Windows\System\gHvPIBE.exe
  C:\Windows\System\gHvPIBE.exe
  2⤵
  PID:4720
- C:\Windows\System\kbuDnlC.exe
  C:\Windows\System\kbuDnlC.exe
  2⤵
  PID:4736
- C:\Windows\System\JcjGzDH.exe
  C:\Windows\System\JcjGzDH.exe
  2⤵
  PID:4752
- C:\Windows\System\lDZKEPS.exe
  C:\Windows\System\lDZKEPS.exe
  2⤵
  PID:4768
- C:\Windows\System\ETKXpAw.exe
  C:\Windows\System\ETKXpAw.exe
  2⤵
  PID:4784
- C:\Windows\System\CcQReUU.exe
  C:\Windows\System\CcQReUU.exe
  2⤵
  PID:4800
- C:\Windows\System\AHXVvnm.exe
  C:\Windows\System\AHXVvnm.exe
  2⤵
  PID:4816
- C:\Windows\System\KvpNBSD.exe
  C:\Windows\System\KvpNBSD.exe
  2⤵
  PID:4832
- C:\Windows\System\PDJyxkb.exe
  C:\Windows\System\PDJyxkb.exe
  2⤵
  PID:4848
- C:\Windows\System\YTtfEUi.exe
  C:\Windows\System\YTtfEUi.exe
  2⤵
  PID:4868
- C:\Windows\System\iFxDyON.exe
  C:\Windows\System\iFxDyON.exe
  2⤵
  PID:4928
- C:\Windows\System\aLXSLqa.exe
  C:\Windows\System\aLXSLqa.exe
  2⤵
  PID:4948
- C:\Windows\System\eDwHfwT.exe
  C:\Windows\System\eDwHfwT.exe
  2⤵
  PID:4968
- C:\Windows\System\tEyElUx.exe
  C:\Windows\System\tEyElUx.exe
  2⤵
  PID:4984
- C:\Windows\System\wqsjDrl.exe
  C:\Windows\System\wqsjDrl.exe
  2⤵
  PID:5000
- C:\Windows\System\YXAXEbJ.exe
  C:\Windows\System\YXAXEbJ.exe
  2⤵
  PID:5024
- C:\Windows\System\yXWGMxl.exe
  C:\Windows\System\yXWGMxl.exe
  2⤵
  PID:5044
- C:\Windows\System\FdvjHgA.exe
  C:\Windows\System\FdvjHgA.exe
  2⤵
  PID:5064
- C:\Windows\System\EGrfVzD.exe
  C:\Windows\System\EGrfVzD.exe
  2⤵
  PID:5080
- C:\Windows\System\RMRRPrO.exe
  C:\Windows\System\RMRRPrO.exe
  2⤵
  PID:5104
- C:\Windows\System\AniyGRn.exe
  C:\Windows\System\AniyGRn.exe
  2⤵
  PID:3204
- C:\Windows\System\WkTnrjB.exe
  C:\Windows\System\WkTnrjB.exe
  2⤵
  PID:2544
- C:\Windows\System\CSGFfXo.exe
  C:\Windows\System\CSGFfXo.exe
  2⤵
  PID:4136
- C:\Windows\System\eALcyDz.exe
  C:\Windows\System\eALcyDz.exe
  2⤵
  PID:4204
- C:\Windows\System\JucfUHQ.exe
  C:\Windows\System\JucfUHQ.exe
  2⤵
  PID:3248
- C:\Windows\System\TmLyEzw.exe
  C:\Windows\System\TmLyEzw.exe
  2⤵
  PID:1772
- C:\Windows\System\CEskTAO.exe
  C:\Windows\System\CEskTAO.exe
  2⤵
  PID:3268
- C:\Windows\System\iubXvem.exe
  C:\Windows\System\iubXvem.exe
  2⤵
  PID:3028
- C:\Windows\System\ILibZqG.exe
  C:\Windows\System\ILibZqG.exe
  2⤵
  PID:3748
- C:\Windows\System\podfJlp.exe
  C:\Windows\System\podfJlp.exe
  2⤵
  PID:4120
- C:\Windows\System\BPzkFIl.exe
  C:\Windows\System\BPzkFIl.exe
  2⤵
  PID:4216
- C:\Windows\System\CppDxBe.exe
  C:\Windows\System\CppDxBe.exe
  2⤵
  PID:536
- C:\Windows\System\XLiIFvl.exe
  C:\Windows\System\XLiIFvl.exe
  2⤵
  PID:4240
- C:\Windows\System\cKLRiYh.exe
  C:\Windows\System\cKLRiYh.exe
  2⤵
  PID:4256
- C:\Windows\System\NQIdgyT.exe
  C:\Windows\System\NQIdgyT.exe
  2⤵
  PID:2956
- C:\Windows\System\heluzSl.exe
  C:\Windows\System\heluzSl.exe
  2⤵
  PID:2492
- C:\Windows\System\nUaqOAq.exe
  C:\Windows\System\nUaqOAq.exe
  2⤵
  PID:4312
- C:\Windows\System\rinTmgI.exe
  C:\Windows\System\rinTmgI.exe
  2⤵
  PID:4268
- C:\Windows\System\lQWMbqZ.exe
  C:\Windows\System\lQWMbqZ.exe
  2⤵
  PID:4284
- C:\Windows\System\eIhsrwv.exe
  C:\Windows\System\eIhsrwv.exe
  2⤵
  PID:4300
- C:\Windows\System\bGACrIF.exe
  C:\Windows\System\bGACrIF.exe
  2⤵
  PID:2924
- C:\Windows\System\AbXDEhW.exe
  C:\Windows\System\AbXDEhW.exe
  2⤵
  PID:2604
- C:\Windows\System\TAHWwmN.exe
  C:\Windows\System\TAHWwmN.exe
  2⤵
  PID:4372
- C:\Windows\System\UJZSgPJ.exe
  C:\Windows\System\UJZSgPJ.exe
  2⤵
  PID:4404
- C:\Windows\System\NRTmaDX.exe
  C:\Windows\System\NRTmaDX.exe
  2⤵
  PID:4412
- C:\Windows\System\nwgLMjW.exe
  C:\Windows\System\nwgLMjW.exe
  2⤵
  PID:4432
- C:\Windows\System\qygrgZs.exe
  C:\Windows\System\qygrgZs.exe
  2⤵
  PID:4448
- C:\Windows\System\JYJZiXy.exe
  C:\Windows\System\JYJZiXy.exe
  2⤵
  PID:4480
- C:\Windows\System\pLeByeI.exe
  C:\Windows\System\pLeByeI.exe
  2⤵
  PID:4496
- C:\Windows\System\BHstbrF.exe
  C:\Windows\System\BHstbrF.exe
  2⤵
  PID:4540
- C:\Windows\System\EDdeeav.exe
  C:\Windows\System\EDdeeav.exe
  2⤵
  PID:4568
- C:\Windows\System\lgkTGaH.exe
  C:\Windows\System\lgkTGaH.exe
  2⤵
  PID:4592
- C:\Windows\System\tfiLZjv.exe
  C:\Windows\System\tfiLZjv.exe
  2⤵
  PID:4624
- C:\Windows\System\ucrzeIc.exe
  C:\Windows\System\ucrzeIc.exe
  2⤵
  PID:4896
- C:\Windows\System\bYtHcLe.exe
  C:\Windows\System\bYtHcLe.exe
  2⤵
  PID:4844
- C:\Windows\System\ClJhgYu.exe
  C:\Windows\System\ClJhgYu.exe
  2⤵
  PID:4904
- C:\Windows\System\lnjSvlA.exe
  C:\Windows\System\lnjSvlA.exe
  2⤵
  PID:4940
- C:\Windows\System\eAopTEB.exe
  C:\Windows\System\eAopTEB.exe
  2⤵
  PID:4976
- C:\Windows\System\yiTsLZa.exe
  C:\Windows\System\yiTsLZa.exe
  2⤵
  PID:5016
- C:\Windows\System\eKPyPJg.exe
  C:\Windows\System\eKPyPJg.exe
  2⤵
  PID:5020
- C:\Windows\System\YpWVRce.exe
  C:\Windows\System\YpWVRce.exe
  2⤵
  PID:5052
- C:\Windows\System\juZGpFP.exe
  C:\Windows\System\juZGpFP.exe
  2⤵
  PID:5076
- C:\Windows\System\GgZudWo.exe
  C:\Windows\System\GgZudWo.exe
  2⤵
  PID:5092
- C:\Windows\System\EsZLruP.exe
  C:\Windows\System\EsZLruP.exe
  2⤵
  PID:3612
- C:\Windows\System\nwaFcIM.exe
  C:\Windows\System\nwaFcIM.exe
  2⤵
  PID:2628
- C:\Windows\System\vwOfpqy.exe
  C:\Windows\System\vwOfpqy.exe
  2⤵
  PID:3412
- C:\Windows\System\DxHPdRp.exe
  C:\Windows\System\DxHPdRp.exe
  2⤵
  PID:4252
- C:\Windows\System\OxnbTnk.exe
  C:\Windows\System\OxnbTnk.exe
  2⤵
  PID:4152
- C:\Windows\System\PgmWzeB.exe
  C:\Windows\System\PgmWzeB.exe
  2⤵
  PID:4228
- C:\Windows\System\GQvgrdl.exe
  C:\Windows\System\GQvgrdl.exe
  2⤵
  PID:2332
- C:\Windows\System\zeYndxV.exe
  C:\Windows\System\zeYndxV.exe
  2⤵
  PID:4108
- C:\Windows\System\nRmkjJI.exe
  C:\Windows\System\nRmkjJI.exe
  2⤵
  PID:3812
- C:\Windows\System\MTcejdI.exe
  C:\Windows\System\MTcejdI.exe
  2⤵
  PID:4280
- C:\Windows\System\pRtPpyU.exe
  C:\Windows\System\pRtPpyU.exe
  2⤵
  PID:4292
- C:\Windows\System\WYCDndy.exe
  C:\Windows\System\WYCDndy.exe
  2⤵
  PID:4384
- C:\Windows\System\rUvKDol.exe
  C:\Windows\System\rUvKDol.exe
  2⤵
  PID:4460
- C:\Windows\System\CoHzTVE.exe
  C:\Windows\System\CoHzTVE.exe
  2⤵
  PID:2068
- C:\Windows\System\NHFzXmY.exe
  C:\Windows\System\NHFzXmY.exe
  2⤵
  PID:4552
- C:\Windows\System\VqwCPZq.exe
  C:\Windows\System\VqwCPZq.exe
  2⤵
  PID:4376
- C:\Windows\System\BVEnqKI.exe
  C:\Windows\System\BVEnqKI.exe
  2⤵
  PID:4548
- C:\Windows\System\rqrxrRW.exe
  C:\Windows\System\rqrxrRW.exe
  2⤵
  PID:4656
- C:\Windows\System\msVTope.exe
  C:\Windows\System\msVTope.exe
  2⤵
  PID:4676
- C:\Windows\System\YefyJqm.exe
  C:\Windows\System\YefyJqm.exe
  2⤵
  PID:4700
- C:\Windows\System\vHMGzeJ.exe
  C:\Windows\System\vHMGzeJ.exe
  2⤵
  PID:4824
- C:\Windows\System\sQTemgF.exe
  C:\Windows\System\sQTemgF.exe
  2⤵
  PID:4864
- C:\Windows\System\ubKnBRW.exe
  C:\Windows\System\ubKnBRW.exe
  2⤵
  PID:4744
- C:\Windows\System\YBWGdgW.exe
  C:\Windows\System\YBWGdgW.exe
  2⤵
  PID:4840
- C:\Windows\System\ljNiTld.exe
  C:\Windows\System\ljNiTld.exe
  2⤵
  PID:4780
- C:\Windows\System\ZVBwCKQ.exe
  C:\Windows\System\ZVBwCKQ.exe
  2⤵
  PID:4888
- C:\Windows\System\Jqsufxy.exe
  C:\Windows\System\Jqsufxy.exe
  2⤵
  PID:4908
- C:\Windows\System\iNJBIsI.exe
  C:\Windows\System\iNJBIsI.exe
  2⤵
  PID:5036
- C:\Windows\System\pFRbhhm.exe
  C:\Windows\System\pFRbhhm.exe
  2⤵
  PID:1896
- C:\Windows\System\IlSXtve.exe
  C:\Windows\System\IlSXtve.exe
  2⤵
  PID:2516
- C:\Windows\System\BkPJrso.exe
  C:\Windows\System\BkPJrso.exe
  2⤵
  PID:4408
- C:\Windows\System\lPJZclp.exe
  C:\Windows\System\lPJZclp.exe
  2⤵
  PID:4156
- C:\Windows\System\aVsvOsQ.exe
  C:\Windows\System\aVsvOsQ.exe
  2⤵
  PID:4660
- C:\Windows\System\EzWVwyn.exe
  C:\Windows\System\EzWVwyn.exe
  2⤵
  PID:4796
- C:\Windows\System\khAcIde.exe
  C:\Windows\System\khAcIde.exe
  2⤵
  PID:4964
- C:\Windows\System\oPnQkyp.exe
  C:\Windows\System\oPnQkyp.exe
  2⤵
  PID:4320
- C:\Windows\System\icFsXHD.exe
  C:\Windows\System\icFsXHD.exe
  2⤵
  PID:4636
- C:\Windows\System\yiCvyEM.exe
  C:\Windows\System\yiCvyEM.exe
  2⤵
  PID:4860
- C:\Windows\System\KWIubpb.exe
  C:\Windows\System\KWIubpb.exe
  2⤵
  PID:4916
- C:\Windows\System\aOSGQrh.exe
  C:\Windows\System\aOSGQrh.exe
  2⤵
  PID:5060
- C:\Windows\System\yVbnRAC.exe
  C:\Windows\System\yVbnRAC.exe
  2⤵
  PID:4264
- C:\Windows\System\kSJOWnO.exe
  C:\Windows\System\kSJOWnO.exe
  2⤵
  PID:756
- C:\Windows\System\EuFIpUD.exe
  C:\Windows\System\EuFIpUD.exe
  2⤵
  PID:4716
- C:\Windows\System\qzGKApB.exe
  C:\Windows\System\qzGKApB.exe
  2⤵
  PID:2248
- C:\Windows\System\LItZqJN.exe
  C:\Windows\System\LItZqJN.exe
  2⤵
  PID:3416
- C:\Windows\System\hCXSepH.exe
  C:\Windows\System\hCXSepH.exe
  2⤵
  PID:1988
- C:\Windows\System\YAysobC.exe
  C:\Windows\System\YAysobC.exe
  2⤵
  PID:580
- C:\Windows\System\PDPLdpw.exe
  C:\Windows\System\PDPLdpw.exe
  2⤵
  PID:4168
- C:\Windows\System\PQcAyEI.exe
  C:\Windows\System\PQcAyEI.exe
  2⤵
  PID:4684
- C:\Windows\System\UFCSTCL.exe
  C:\Windows\System\UFCSTCL.exe
  2⤵
  PID:4524
- C:\Windows\System\blxtGsk.exe
  C:\Windows\System\blxtGsk.exe
  2⤵
  PID:4812
- C:\Windows\System\oBgvosq.exe
  C:\Windows\System\oBgvosq.exe
  2⤵
  PID:5124
- C:\Windows\System\PPlBPYR.exe
  C:\Windows\System\PPlBPYR.exe
  2⤵
  PID:5140
- C:\Windows\System\eJyVrVh.exe
  C:\Windows\System\eJyVrVh.exe
  2⤵
  PID:5176
- C:\Windows\System\GvQDkCg.exe
  C:\Windows\System\GvQDkCg.exe
  2⤵
  PID:5192
- C:\Windows\System\oSJjNge.exe
  C:\Windows\System\oSJjNge.exe
  2⤵
  PID:5208
- C:\Windows\System\QrUDFLo.exe
  C:\Windows\System\QrUDFLo.exe
  2⤵
  PID:5224
- C:\Windows\System\xzelRuA.exe
  C:\Windows\System\xzelRuA.exe
  2⤵
  PID:5240
- C:\Windows\System\scWOzPj.exe
  C:\Windows\System\scWOzPj.exe
  2⤵
  PID:5256
- C:\Windows\System\erFqUCK.exe
  C:\Windows\System\erFqUCK.exe
  2⤵
  PID:5276
- C:\Windows\System\rrRRXUi.exe
  C:\Windows\System\rrRRXUi.exe
  2⤵
  PID:5292
- C:\Windows\System\SmwwRuo.exe
  C:\Windows\System\SmwwRuo.exe
  2⤵
  PID:5308
- C:\Windows\System\AEybYmy.exe
  C:\Windows\System\AEybYmy.exe
  2⤵
  PID:5324
- C:\Windows\System\qcSYyQr.exe
  C:\Windows\System\qcSYyQr.exe
  2⤵
  PID:5340
- C:\Windows\System\JRzhLrd.exe
  C:\Windows\System\JRzhLrd.exe
  2⤵
  PID:5360
- C:\Windows\System\qqGNyzi.exe
  C:\Windows\System\qqGNyzi.exe
  2⤵
  PID:5376
- C:\Windows\System\dWDZdOs.exe
  C:\Windows\System\dWDZdOs.exe
  2⤵
  PID:5392
- C:\Windows\System\jpptvvz.exe
  C:\Windows\System\jpptvvz.exe
  2⤵
  PID:5408
- C:\Windows\System\ejvHPat.exe
  C:\Windows\System\ejvHPat.exe
  2⤵
  PID:5424
- C:\Windows\System\PvtQlEL.exe
  C:\Windows\System\PvtQlEL.exe
  2⤵
  PID:5444
- C:\Windows\System\UvZHorD.exe
  C:\Windows\System\UvZHorD.exe
  2⤵
  PID:5460
- C:\Windows\System\mDZAsSH.exe
  C:\Windows\System\mDZAsSH.exe
  2⤵
  PID:5476
- C:\Windows\System\CyhjVOF.exe
  C:\Windows\System\CyhjVOF.exe
  2⤵
  PID:5492
- C:\Windows\System\pXrAXuc.exe
  C:\Windows\System\pXrAXuc.exe
  2⤵
  PID:5508
- C:\Windows\System\xYKWobM.exe
  C:\Windows\System\xYKWobM.exe
  2⤵
  PID:5524
- C:\Windows\System\YtiPvMB.exe
  C:\Windows\System\YtiPvMB.exe
  2⤵
  PID:5540
- C:\Windows\System\QFAAkCa.exe
  C:\Windows\System\QFAAkCa.exe
  2⤵
  PID:5556
- C:\Windows\System\NgQLwPi.exe
  C:\Windows\System\NgQLwPi.exe
  2⤵
  PID:5572
- C:\Windows\System\coHCRes.exe
  C:\Windows\System\coHCRes.exe
  2⤵
  PID:5588
- C:\Windows\System\BIZXxLq.exe
  C:\Windows\System\BIZXxLq.exe
  2⤵
  PID:5608
- C:\Windows\System\TzjvsZv.exe
  C:\Windows\System\TzjvsZv.exe
  2⤵
  PID:5624
- C:\Windows\System\EXMVDAm.exe
  C:\Windows\System\EXMVDAm.exe
  2⤵
  PID:5640
- C:\Windows\System\qUTWaii.exe
  C:\Windows\System\qUTWaii.exe
  2⤵
  PID:5692
- C:\Windows\System\dGJBFje.exe
  C:\Windows\System\dGJBFje.exe
  2⤵
  PID:5708
- C:\Windows\System\tOPhRhD.exe
  C:\Windows\System\tOPhRhD.exe
  2⤵
  PID:5724
- C:\Windows\System\ebTrOpY.exe
  C:\Windows\System\ebTrOpY.exe
  2⤵
  PID:5740
- C:\Windows\System\VIgfzQY.exe
  C:\Windows\System\VIgfzQY.exe
  2⤵
  PID:5760
- C:\Windows\System\fSyKRAI.exe
  C:\Windows\System\fSyKRAI.exe
  2⤵
  PID:5776
- C:\Windows\System\OROUHNt.exe
  C:\Windows\System\OROUHNt.exe
  2⤵
  PID:5792
- C:\Windows\System\VFykZET.exe
  C:\Windows\System\VFykZET.exe
  2⤵
  PID:5808
- C:\Windows\System\GmAQnRM.exe
  C:\Windows\System\GmAQnRM.exe
  2⤵
  PID:5824
- C:\Windows\System\pWQnBQr.exe
  C:\Windows\System\pWQnBQr.exe
  2⤵
  PID:5840
- C:\Windows\System\kNfVMMx.exe
  C:\Windows\System\kNfVMMx.exe
  2⤵
  PID:5856
- C:\Windows\System\pqoWgpK.exe
  C:\Windows\System\pqoWgpK.exe
  2⤵
  PID:5872
- C:\Windows\System\akgoJYv.exe
  C:\Windows\System\akgoJYv.exe
  2⤵
  PID:5888
- C:\Windows\System\ZwADyIz.exe
  C:\Windows\System\ZwADyIz.exe
  2⤵
  PID:5904
- C:\Windows\System\kouIMIm.exe
  C:\Windows\System\kouIMIm.exe
  2⤵
  PID:5920
- C:\Windows\System\JruQpUK.exe
  C:\Windows\System\JruQpUK.exe
  2⤵
  PID:5940
- C:\Windows\System\MKZdboe.exe
  C:\Windows\System\MKZdboe.exe
  2⤵
  PID:5956
- C:\Windows\System\YwIMsbM.exe
  C:\Windows\System\YwIMsbM.exe
  2⤵
  PID:5972
- C:\Windows\System\nvbsYcb.exe
  C:\Windows\System\nvbsYcb.exe
  2⤵
  PID:5996
- C:\Windows\System\nDYfVSi.exe
  C:\Windows\System\nDYfVSi.exe
  2⤵
  PID:6012
- C:\Windows\System\DYjWjzT.exe
  C:\Windows\System\DYjWjzT.exe
  2⤵
  PID:6028
- C:\Windows\System\ihTGqQg.exe
  C:\Windows\System\ihTGqQg.exe
  2⤵
  PID:6044
- C:\Windows\System\vqzOChK.exe
  C:\Windows\System\vqzOChK.exe
  2⤵
  PID:6060
- C:\Windows\System\ZXqKedZ.exe
  C:\Windows\System\ZXqKedZ.exe
  2⤵
  PID:6116
- C:\Windows\System\QNkMlWj.exe
  C:\Windows\System\QNkMlWj.exe
  2⤵
  PID:4764
- C:\Windows\System\vULPUGS.exe
  C:\Windows\System\vULPUGS.exe
  2⤵
  PID:4620
- C:\Windows\System\qwvSaXv.exe
  C:\Windows\System\qwvSaXv.exe
  2⤵
  PID:4920
- C:\Windows\System\eypHLcb.exe
  C:\Windows\System\eypHLcb.exe
  2⤵
  PID:5072
- C:\Windows\System\oHTBbeC.exe
  C:\Windows\System\oHTBbeC.exe
  2⤵
  PID:4392
- C:\Windows\System\rNqCMQb.exe
  C:\Windows\System\rNqCMQb.exe
  2⤵
  PID:5316
- C:\Windows\System\qbmmROM.exe
  C:\Windows\System\qbmmROM.exe
  2⤵
  PID:5284
- C:\Windows\System\nIcOeNN.exe
  C:\Windows\System\nIcOeNN.exe
  2⤵
  PID:5216
- C:\Windows\System\FEQyQEF.exe
  C:\Windows\System\FEQyQEF.exe
  2⤵
  PID:5452
- C:\Windows\System\KGCUyTa.exe
  C:\Windows\System\KGCUyTa.exe
  2⤵
  PID:5488
- C:\Windows\System\AQiBBkO.exe
  C:\Windows\System\AQiBBkO.exe
  2⤵
  PID:5616
- C:\Windows\System\YGdgEsR.exe
  C:\Windows\System\YGdgEsR.exe
  2⤵
  PID:5656
- C:\Windows\System\bwCYWWo.exe
  C:\Windows\System\bwCYWWo.exe
  2⤵
  PID:4236
- C:\Windows\System\gdteIjI.exe
  C:\Windows\System\gdteIjI.exe
  2⤵
  PID:5352
- C:\Windows\System\EtrZJLq.exe
  C:\Windows\System\EtrZJLq.exe
  2⤵
  PID:5668
- C:\Windows\System\gvWtVxC.exe
  C:\Windows\System\gvWtVxC.exe
  2⤵
  PID:5096
- C:\Windows\System\xNWBANQ.exe
  C:\Windows\System\xNWBANQ.exe
  2⤵
  PID:2732
- C:\Windows\System\fPCPFvT.exe
  C:\Windows\System\fPCPFvT.exe
  2⤵
  PID:4184
- C:\Windows\System\gSPLRaC.exe
  C:\Windows\System\gSPLRaC.exe
  2⤵
  PID:5200
- C:\Windows\System\uvQgUsX.exe
  C:\Windows\System\uvQgUsX.exe
  2⤵
  PID:5332
- C:\Windows\System\bpGwodC.exe
  C:\Windows\System\bpGwodC.exe
  2⤵
  PID:5440
- C:\Windows\System\xWzzMNl.exe
  C:\Windows\System\xWzzMNl.exe
  2⤵
  PID:5568
- C:\Windows\System\kuEvmuf.exe
  C:\Windows\System\kuEvmuf.exe
  2⤵
  PID:5172
- C:\Windows\System\BVaDJQf.exe
  C:\Windows\System\BVaDJQf.exe
  2⤵
  PID:5268
- C:\Windows\System\HBZWblm.exe
  C:\Windows\System\HBZWblm.exe
  2⤵
  PID:5404
- C:\Windows\System\gsJKcOD.exe
  C:\Windows\System\gsJKcOD.exe
  2⤵
  PID:5468
- C:\Windows\System\fDygVMF.exe
  C:\Windows\System\fDygVMF.exe
  2⤵
  PID:5804
- C:\Windows\System\QGnnyAF.exe
  C:\Windows\System\QGnnyAF.exe
  2⤵
  PID:5868
- C:\Windows\System\YdRaRBB.exe
  C:\Windows\System\YdRaRBB.exe
  2⤵
  PID:5896
- C:\Windows\System\AkOTRSn.exe
  C:\Windows\System\AkOTRSn.exe
  2⤵
  PID:5832
- C:\Windows\System\CyKTCDT.exe
  C:\Windows\System\CyKTCDT.exe
  2⤵
  PID:6004
- C:\Windows\System\GBXEApz.exe
  C:\Windows\System\GBXEApz.exe
  2⤵
  PID:6036
- C:\Windows\System\lJvncuQ.exe
  C:\Windows\System\lJvncuQ.exe
  2⤵
  PID:5820
- C:\Windows\System\DfocqBs.exe
  C:\Windows\System\DfocqBs.exe
  2⤵
  PID:5756
- C:\Windows\System\lwBbuTC.exe
  C:\Windows\System\lwBbuTC.exe
  2⤵
  PID:5716
- C:\Windows\System\hLUgojR.exe
  C:\Windows\System\hLUgojR.exe
  2⤵
  PID:5880
- C:\Windows\System\opoFuqN.exe
  C:\Windows\System\opoFuqN.exe
  2⤵
  PID:5980
- C:\Windows\System\iDuSIMc.exe
  C:\Windows\System\iDuSIMc.exe
  2⤵
  PID:6024
- C:\Windows\System\HzccRaP.exe
  C:\Windows\System\HzccRaP.exe
  2⤵
  PID:6076
- C:\Windows\System\FApAFPN.exe
  C:\Windows\System\FApAFPN.exe
  2⤵
  PID:6128
- C:\Windows\System\GJlubex.exe
  C:\Windows\System\GJlubex.exe
  2⤵
  PID:4248
- C:\Windows\System\spnQUYu.exe
  C:\Windows\System\spnQUYu.exe
  2⤵
  PID:5356
- C:\Windows\System\qHLeozz.exe
  C:\Windows\System\qHLeozz.exe
  2⤵
  PID:5456
- C:\Windows\System\lBVABHA.exe
  C:\Windows\System\lBVABHA.exe
  2⤵
  PID:5664
- C:\Windows\System\JtwkAIH.exe
  C:\Windows\System\JtwkAIH.exe
  2⤵
  PID:788
- C:\Windows\System\BjnvGcv.exe
  C:\Windows\System\BjnvGcv.exe
  2⤵
  PID:5372
- C:\Windows\System\RaGmDaB.exe
  C:\Windows\System\RaGmDaB.exe
  2⤵
  PID:5504
- C:\Windows\System\saUlaqE.exe
  C:\Windows\System\saUlaqE.exe
  2⤵
  PID:5164
- C:\Windows\System\jIKkBQk.exe
  C:\Windows\System\jIKkBQk.exe
  2⤵
  PID:5852
- C:\Windows\System\BmuURDK.exe
  C:\Windows\System\BmuURDK.exe
  2⤵
  PID:5948
- C:\Windows\System\aSiSlpm.exe
  C:\Windows\System\aSiSlpm.exe
  2⤵
  PID:6136
- C:\Windows\System\nmKyDkb.exe
  C:\Windows\System\nmKyDkb.exe
  2⤵
  PID:5384
- C:\Windows\System\uCPEilH.exe
  C:\Windows\System\uCPEilH.exe
  2⤵
  PID:6156
- C:\Windows\System\YWnMoXE.exe
  C:\Windows\System\YWnMoXE.exe
  2⤵
  PID:6172
- C:\Windows\System\XWigtRp.exe
  C:\Windows\System\XWigtRp.exe
  2⤵
  PID:6188
- C:\Windows\System\axXVnZB.exe
  C:\Windows\System\axXVnZB.exe
  2⤵
  PID:6204
- C:\Windows\System\IIjkjLo.exe
  C:\Windows\System\IIjkjLo.exe
  2⤵
  PID:6292
- C:\Windows\System\nQMLnhn.exe
  C:\Windows\System\nQMLnhn.exe
  2⤵
  PID:6312
- C:\Windows\System\XzlXrUW.exe
  C:\Windows\System\XzlXrUW.exe
  2⤵
  PID:6328
- C:\Windows\System\KfZccot.exe
  C:\Windows\System\KfZccot.exe
  2⤵
  PID:6344
- C:\Windows\System\FyFtcCk.exe
  C:\Windows\System\FyFtcCk.exe
  2⤵
  PID:6360
- C:\Windows\System\KsRguIO.exe
  C:\Windows\System\KsRguIO.exe
  2⤵
  PID:6376
- C:\Windows\System\OGGlfHy.exe
  C:\Windows\System\OGGlfHy.exe
  2⤵
  PID:6392
- C:\Windows\System\JuQnIWP.exe
  C:\Windows\System\JuQnIWP.exe
  2⤵
  PID:6408
- C:\Windows\System\oOzCeXG.exe
  C:\Windows\System\oOzCeXG.exe
  2⤵
  PID:6424
- C:\Windows\System\JlaLLrT.exe
  C:\Windows\System\JlaLLrT.exe
  2⤵
  PID:6440
- C:\Windows\System\AugBUvh.exe
  C:\Windows\System\AugBUvh.exe
  2⤵
  PID:6456
- C:\Windows\System\hhSXCMU.exe
  C:\Windows\System\hhSXCMU.exe
  2⤵
  PID:6472
- C:\Windows\System\cOfGyND.exe
  C:\Windows\System\cOfGyND.exe
  2⤵
  PID:6488
- C:\Windows\System\HsyqAfV.exe
  C:\Windows\System\HsyqAfV.exe
  2⤵
  PID:6504
- C:\Windows\System\Pozdgew.exe
  C:\Windows\System\Pozdgew.exe
  2⤵
  PID:6520
- C:\Windows\System\inFfLWV.exe
  C:\Windows\System\inFfLWV.exe
  2⤵
  PID:6536
- C:\Windows\System\nonijkt.exe
  C:\Windows\System\nonijkt.exe
  2⤵
  PID:6552
- C:\Windows\System\GePynnr.exe
  C:\Windows\System\GePynnr.exe
  2⤵
  PID:6568
- C:\Windows\System\ZBhHKsq.exe
  C:\Windows\System\ZBhHKsq.exe
  2⤵
  PID:6584
- C:\Windows\System\MCfTtlt.exe
  C:\Windows\System\MCfTtlt.exe
  2⤵
  PID:6600
- C:\Windows\System\iwUAfyc.exe
  C:\Windows\System\iwUAfyc.exe
  2⤵
  PID:6616
- C:\Windows\System\MxemoeR.exe
  C:\Windows\System\MxemoeR.exe
  2⤵
  PID:6632
- C:\Windows\System\VtrwNQY.exe
  C:\Windows\System\VtrwNQY.exe
  2⤵
  PID:6648
- C:\Windows\System\AVKYWYa.exe
  C:\Windows\System\AVKYWYa.exe
  2⤵
  PID:6664
- C:\Windows\System\avBamSr.exe
  C:\Windows\System\avBamSr.exe
  2⤵
  PID:6680
- C:\Windows\System\KPRhJmM.exe
  C:\Windows\System\KPRhJmM.exe
  2⤵
  PID:6696
- C:\Windows\System\ICyzFrR.exe
  C:\Windows\System\ICyzFrR.exe
  2⤵
  PID:6712
- C:\Windows\System\jaGjaPi.exe
  C:\Windows\System\jaGjaPi.exe
  2⤵
  PID:6728
- C:\Windows\System\bhxmLMC.exe
  C:\Windows\System\bhxmLMC.exe
  2⤵
  PID:6744
- C:\Windows\System\AslBwGh.exe
  C:\Windows\System\AslBwGh.exe
  2⤵
  PID:6760
- C:\Windows\System\EWzWBhX.exe
  C:\Windows\System\EWzWBhX.exe
  2⤵
  PID:6776
- C:\Windows\System\EdsXCFr.exe
  C:\Windows\System\EdsXCFr.exe
  2⤵
  PID:6792
- C:\Windows\System\QlHYDHt.exe
  C:\Windows\System\QlHYDHt.exe
  2⤵
  PID:6808
- C:\Windows\System\YuJPBDW.exe
  C:\Windows\System\YuJPBDW.exe
  2⤵
  PID:6828
- C:\Windows\System\rwfwVWH.exe
  C:\Windows\System\rwfwVWH.exe
  2⤵
  PID:6844
- C:\Windows\System\wjvuPxU.exe
  C:\Windows\System\wjvuPxU.exe
  2⤵
  PID:6860
- C:\Windows\System\dqIexZI.exe
  C:\Windows\System\dqIexZI.exe
  2⤵
  PID:6876
- C:\Windows\System\BqAcsGa.exe
  C:\Windows\System\BqAcsGa.exe
  2⤵
  PID:6896
- C:\Windows\System\sBviqCu.exe
  C:\Windows\System\sBviqCu.exe
  2⤵
  PID:6912
- C:\Windows\System\ysXGnYp.exe
  C:\Windows\System\ysXGnYp.exe
  2⤵
  PID:6928
- C:\Windows\System\pixpOBZ.exe
  C:\Windows\System\pixpOBZ.exe
  2⤵
  PID:6944
- C:\Windows\System\oPNZFLg.exe
  C:\Windows\System\oPNZFLg.exe
  2⤵
  PID:6960
- C:\Windows\System\NljeSzI.exe
  C:\Windows\System\NljeSzI.exe
  2⤵
  PID:6976
- C:\Windows\System\bSGQXwV.exe
  C:\Windows\System\bSGQXwV.exe
  2⤵
  PID:6992
- C:\Windows\System\BdHgbIC.exe
  C:\Windows\System\BdHgbIC.exe
  2⤵
  PID:7008
- C:\Windows\System\FCgMltN.exe
  C:\Windows\System\FCgMltN.exe
  2⤵
  PID:7024
- C:\Windows\System\hrckGsr.exe
  C:\Windows\System\hrckGsr.exe
  2⤵
  PID:7040
- C:\Windows\System\CmAggQz.exe
  C:\Windows\System\CmAggQz.exe
  2⤵
  PID:7056
- C:\Windows\System\JIMpAZy.exe
  C:\Windows\System\JIMpAZy.exe
  2⤵
  PID:7072
- C:\Windows\System\dHvYbbP.exe
  C:\Windows\System\dHvYbbP.exe
  2⤵
  PID:7088
- C:\Windows\System\bhPxNBP.exe
  C:\Windows\System\bhPxNBP.exe
  2⤵
  PID:7104
- C:\Windows\System\NXuhMuE.exe
  C:\Windows\System\NXuhMuE.exe
  2⤵
  PID:7120
- C:\Windows\System\yRKYFlm.exe
  C:\Windows\System\yRKYFlm.exe
  2⤵
  PID:7136
- C:\Windows\System\GSkbBeW.exe
  C:\Windows\System\GSkbBeW.exe
  2⤵
  PID:7152
- C:\Windows\System\pKkBOHi.exe
  C:\Windows\System\pKkBOHi.exe
  2⤵
  PID:5768
- C:\Windows\System\bwzVoeY.exe
  C:\Windows\System\bwzVoeY.exe
  2⤵
  PID:6056
- C:\Windows\System\EfkrMPK.exe
  C:\Windows\System\EfkrMPK.exe
  2⤵
  PID:6180
- C:\Windows\System\SZHeNKC.exe
  C:\Windows\System\SZHeNKC.exe
  2⤵
  PID:6224
- C:\Windows\System\UJtBMSa.exe
  C:\Windows\System\UJtBMSa.exe
  2⤵
  PID:6236
- C:\Windows\System\zxmtKYA.exe
  C:\Windows\System\zxmtKYA.exe
  2⤵
  PID:6252
- C:\Windows\System\XcsPfbP.exe
  C:\Windows\System\XcsPfbP.exe
  2⤵
  PID:6108
- C:\Windows\System\HpXHZdE.exe
  C:\Windows\System\HpXHZdE.exe
  2⤵
  PID:5304
- C:\Windows\System\dAMpCbF.exe
  C:\Windows\System\dAMpCbF.exe
  2⤵
  PID:5932
- C:\Windows\System\WrYsrNq.exe
  C:\Windows\System\WrYsrNq.exe
  2⤵
  PID:5968
- C:\Windows\System\LeNuRpt.exe
  C:\Windows\System\LeNuRpt.exe
  2⤵
  PID:5884
- C:\Windows\System\nozrCUU.exe
  C:\Windows\System\nozrCUU.exe
  2⤵
  PID:6096
- C:\Windows\System\yAjQYns.exe
  C:\Windows\System\yAjQYns.exe
  2⤵
  PID:5552
- C:\Windows\System\ieJVrvs.exe
  C:\Windows\System\ieJVrvs.exe
  2⤵
  PID:4604
- C:\Windows\System\BqVtkeV.exe
  C:\Windows\System\BqVtkeV.exe
  2⤵
  PID:5536
- C:\Windows\System\Odksjva.exe
  C:\Windows\System\Odksjva.exe
  2⤵
  PID:5436
- C:\Windows\System\HNYZrqn.exe
  C:\Windows\System\HNYZrqn.exe
  2⤵
  PID:5684
- C:\Windows\System\hJveETE.exe
  C:\Windows\System\hJveETE.exe
  2⤵
  PID:5788
- C:\Windows\System\ggEONEL.exe
  C:\Windows\System\ggEONEL.exe
  2⤵
  PID:6020
- C:\Windows\System\REEQuat.exe
  C:\Windows\System\REEQuat.exe
  2⤵
  PID:5152
- C:\Windows\System\exTyqbQ.exe
  C:\Windows\System\exTyqbQ.exe
  2⤵
  PID:5288
- C:\Windows\System\KLqMSVO.exe
  C:\Windows\System\KLqMSVO.exe
  2⤵
  PID:6196
- C:\Windows\System\fnSXlJx.exe
  C:\Windows\System\fnSXlJx.exe
  2⤵
  PID:1616
- C:\Windows\System\jNCEudV.exe
  C:\Windows\System\jNCEudV.exe
  2⤵
  PID:5388
- C:\Windows\System\ZiObbqR.exe
  C:\Windows\System\ZiObbqR.exe
  2⤵
  PID:6284
- C:\Windows\System\wAYLNLI.exe
  C:\Windows\System\wAYLNLI.exe
  2⤵
  PID:6300
- C:\Windows\System\cVqsvKk.exe
  C:\Windows\System\cVqsvKk.exe
  2⤵
  PID:6320
- C:\Windows\System\HiqfQNQ.exe
  C:\Windows\System\HiqfQNQ.exe
  2⤵
  PID:6384
- C:\Windows\System\GMLHoWJ.exe
  C:\Windows\System\GMLHoWJ.exe
  2⤵
  PID:6404
- C:\Windows\System\dtrCqPp.exe
  C:\Windows\System\dtrCqPp.exe
  2⤵
  PID:6464
- C:\Windows\System\SAIEUkq.exe
  C:\Windows\System\SAIEUkq.exe
  2⤵
  PID:6432
- C:\Windows\System\DGIxaUJ.exe
  C:\Windows\System\DGIxaUJ.exe
  2⤵
  PID:6516
- C:\Windows\System\ohrewTb.exe
  C:\Windows\System\ohrewTb.exe
  2⤵
  PID:6576
- C:\Windows\System\SIPdaSi.exe
  C:\Windows\System\SIPdaSi.exe
  2⤵
  PID:6468
- C:\Windows\System\aPmqGHB.exe
  C:\Windows\System\aPmqGHB.exe
  2⤵
  PID:6532
- C:\Windows\System\KJPXtiv.exe
  C:\Windows\System\KJPXtiv.exe
  2⤵
  PID:6656
- C:\Windows\System\szisKPO.exe
  C:\Windows\System\szisKPO.exe
  2⤵
  PID:6624
- C:\Windows\System\mZsntUe.exe
  C:\Windows\System\mZsntUe.exe
  2⤵
  PID:6688
- C:\Windows\System\ZkirJZX.exe
  C:\Windows\System\ZkirJZX.exe
  2⤵
  PID:6752
- C:\Windows\System\vMnpttk.exe
  C:\Windows\System\vMnpttk.exe
  2⤵
  PID:6788
- C:\Windows\System\uBxAvmv.exe
  C:\Windows\System\uBxAvmv.exe
  2⤵
  PID:6736
- C:\Windows\System\SadRBoi.exe
  C:\Windows\System\SadRBoi.exe
  2⤵
  PID:6836
- C:\Windows\System\FWppQEs.exe
  C:\Windows\System\FWppQEs.exe
  2⤵
  PID:6804
- C:\Windows\System\cTLlaUD.exe
  C:\Windows\System\cTLlaUD.exe
  2⤵
  PID:6888
- C:\Windows\System\yBPamGs.exe
  C:\Windows\System\yBPamGs.exe
  2⤵
  PID:6908
- C:\Windows\System\swiFcPM.exe
  C:\Windows\System\swiFcPM.exe
  2⤵
  PID:6968
- C:\Windows\System\ziyNNaf.exe
  C:\Windows\System\ziyNNaf.exe
  2⤵
  PID:7064
- C:\Windows\System\TGbXstr.exe
  C:\Windows\System\TGbXstr.exe
  2⤵
  PID:6984
- C:\Windows\System\bIiNKRt.exe
  C:\Windows\System\bIiNKRt.exe
  2⤵
  PID:6924
- C:\Windows\System\iUMejyN.exe
  C:\Windows\System\iUMejyN.exe
  2⤵
  PID:7080
- C:\Windows\System\YVDySTO.exe
  C:\Windows\System\YVDySTO.exe
  2⤵
  PID:7132
- C:\Windows\System\jmlCwCU.exe
  C:\Windows\System\jmlCwCU.exe
  2⤵
  PID:7164
- C:\Windows\System\pSSuwSx.exe
  C:\Windows\System\pSSuwSx.exe
  2⤵
  PID:6260
- C:\Windows\System\KLHliOF.exe
  C:\Windows\System\KLHliOF.exe
  2⤵
  PID:7084
- C:\Windows\System\wgoDwnM.exe
  C:\Windows\System\wgoDwnM.exe
  2⤵
  PID:5500
- C:\Windows\System\tvjUcIl.exe
  C:\Windows\System\tvjUcIl.exe
  2⤵
  PID:6244
- C:\Windows\System\UlTBOII.exe
  C:\Windows\System\UlTBOII.exe
  2⤵
  PID:6140
- C:\Windows\System\OOPbhIL.exe
  C:\Windows\System\OOPbhIL.exe
  2⤵
  PID:6088
- C:\Windows\System\gnkikjy.exe
  C:\Windows\System\gnkikjy.exe
  2⤵
  PID:6112
- C:\Windows\System\DnVkRzt.exe
  C:\Windows\System\DnVkRzt.exe
  2⤵
  PID:5156
- C:\Windows\System\jwIqQlE.exe
  C:\Windows\System\jwIqQlE.exe
  2⤵
  PID:5988
- C:\Windows\System\gAOKmGt.exe
  C:\Windows\System\gAOKmGt.exe
  2⤵
  PID:5748
- C:\Windows\System\NcQxOzF.exe
  C:\Windows\System\NcQxOzF.exe
  2⤵
  PID:5720
- C:\Windows\System\XmOQSPf.exe
  C:\Windows\System\XmOQSPf.exe
  2⤵
  PID:6272
- C:\Windows\System\iOYntKb.exe
  C:\Windows\System\iOYntKb.exe
  2⤵
  PID:6336
- C:\Windows\System\CAWTYCr.exe
  C:\Windows\System\CAWTYCr.exe
  2⤵
  PID:1712
- C:\Windows\System\gfrDdBX.exe
  C:\Windows\System\gfrDdBX.exe
  2⤵
  PID:6352
- C:\Windows\System\trmkFCC.exe
  C:\Windows\System\trmkFCC.exe
  2⤵
  PID:6484
- C:\Windows\System\OMJJECN.exe
  C:\Windows\System\OMJJECN.exe
  2⤵
  PID:6644
- C:\Windows\System\JXAtAdD.exe
  C:\Windows\System\JXAtAdD.exe
  2⤵
  PID:6500
- C:\Windows\System\ZUxKfiI.exe
  C:\Windows\System\ZUxKfiI.exe
  2⤵
  PID:6724
- C:\Windows\System\tFIUXOS.exe
  C:\Windows\System\tFIUXOS.exe
  2⤵
  PID:6592
- C:\Windows\System\fUJROzJ.exe
  C:\Windows\System\fUJROzJ.exe
  2⤵
  PID:6596
- C:\Windows\System\WPKyEoK.exe
  C:\Windows\System\WPKyEoK.exe
  2⤵
  PID:6856
- C:\Windows\System\OWoJNat.exe
  C:\Windows\System\OWoJNat.exe
  2⤵
  PID:6936
- C:\Windows\System\YDsiAIE.exe
  C:\Windows\System\YDsiAIE.exe
  2⤵
  PID:6892
- C:\Windows\System\SXHyuRc.exe
  C:\Windows\System\SXHyuRc.exe
  2⤵
  PID:6952
- C:\Windows\System\LpnOBck.exe
  C:\Windows\System\LpnOBck.exe
  2⤵
  PID:6228
- C:\Windows\System\byUMoMD.exe
  C:\Windows\System\byUMoMD.exe
  2⤵
  PID:5596
- C:\Windows\System\xEDCiaZ.exe
  C:\Windows\System\xEDCiaZ.exe
  2⤵
  PID:5864
- C:\Windows\System\prssPrw.exe
  C:\Windows\System\prssPrw.exe
  2⤵
  PID:7052
- C:\Windows\System\tGiHJyf.exe
  C:\Windows\System\tGiHJyf.exe
  2⤵
  PID:6184
- C:\Windows\System\vUkgRXj.exe
  C:\Windows\System\vUkgRXj.exe
  2⤵
  PID:5600
- C:\Windows\System\ijhRBpw.exe
  C:\Windows\System\ijhRBpw.exe
  2⤵
  PID:6104
- C:\Windows\System\QIGFrFD.exe
  C:\Windows\System\QIGFrFD.exe
  2⤵
  PID:6356
- C:\Windows\System\QIoZxww.exe
  C:\Windows\System\QIoZxww.exe
  2⤵
  PID:6608
- C:\Windows\System\jXbJfmz.exe
  C:\Windows\System\jXbJfmz.exe
  2⤵
  PID:5936
- C:\Windows\System\nWXxmmE.exe
  C:\Windows\System\nWXxmmE.exe
  2⤵
  PID:6168
- C:\Windows\System\lSgSZUq.exe
  C:\Windows\System\lSgSZUq.exe
  2⤵
  PID:6528
- C:\Windows\System\mDbdRXJ.exe
  C:\Windows\System\mDbdRXJ.exe
  2⤵
  PID:6784
- C:\Windows\System\hHKYKka.exe
  C:\Windows\System\hHKYKka.exe
  2⤵
  PID:6768
- C:\Windows\System\qEsNYDW.exe
  C:\Windows\System\qEsNYDW.exe
  2⤵
  PID:7100
- C:\Windows\System\WzPRLMy.exe
  C:\Windows\System\WzPRLMy.exe
  2⤵
  PID:6956
- C:\Windows\System\IHWxatu.exe
  C:\Windows\System\IHWxatu.exe
  2⤵
  PID:6304
- C:\Windows\System\QKiZovg.exe
  C:\Windows\System\QKiZovg.exe
  2⤵
  PID:6480
- C:\Windows\System\mpSxhpY.exe
  C:\Windows\System\mpSxhpY.exe
  2⤵
  PID:6972
- C:\Windows\System\AgxYbuD.exe
  C:\Windows\System\AgxYbuD.exe
  2⤵
  PID:7184
- C:\Windows\System\hwkMWEk.exe
  C:\Windows\System\hwkMWEk.exe
  2⤵
  PID:7200
- C:\Windows\System\eLjXAeZ.exe
  C:\Windows\System\eLjXAeZ.exe
  2⤵
  PID:7216
- C:\Windows\System\UvcdxjB.exe
  C:\Windows\System\UvcdxjB.exe
  2⤵
  PID:7232
- C:\Windows\System\rhCwxvn.exe
  C:\Windows\System\rhCwxvn.exe
  2⤵
  PID:7248
- C:\Windows\System\TbbzHOi.exe
  C:\Windows\System\TbbzHOi.exe
  2⤵
  PID:7264
- C:\Windows\System\USGkEmI.exe
  C:\Windows\System\USGkEmI.exe
  2⤵
  PID:7280
- C:\Windows\System\BBakMMu.exe
  C:\Windows\System\BBakMMu.exe
  2⤵
  PID:7296
- C:\Windows\System\JHavKgn.exe
  C:\Windows\System\JHavKgn.exe
  2⤵
  PID:7312
- C:\Windows\System\LBsWRTr.exe
  C:\Windows\System\LBsWRTr.exe
  2⤵
  PID:7328
- C:\Windows\System\mhxjSJR.exe
  C:\Windows\System\mhxjSJR.exe
  2⤵
  PID:7344
- C:\Windows\System\DnfPOnI.exe
  C:\Windows\System\DnfPOnI.exe
  2⤵
  PID:7360
- C:\Windows\System\JERxtyo.exe
  C:\Windows\System\JERxtyo.exe
  2⤵
  PID:7376
- C:\Windows\System\TEfIwmI.exe
  C:\Windows\System\TEfIwmI.exe
  2⤵
  PID:7392
- C:\Windows\System\kOGRUQg.exe
  C:\Windows\System\kOGRUQg.exe
  2⤵
  PID:7408
- C:\Windows\System\knXQqmD.exe
  C:\Windows\System\knXQqmD.exe
  2⤵
  PID:7424
- C:\Windows\System\wlMxSyR.exe
  C:\Windows\System\wlMxSyR.exe
  2⤵
  PID:7440
- C:\Windows\System\ZKeVCDb.exe
  C:\Windows\System\ZKeVCDb.exe
  2⤵
  PID:7456
- C:\Windows\System\XxDOXoV.exe
  C:\Windows\System\XxDOXoV.exe
  2⤵
  PID:7472
- C:\Windows\System\vInXrSV.exe
  C:\Windows\System\vInXrSV.exe
  2⤵
  PID:7488
- C:\Windows\System\QAKEvct.exe
  C:\Windows\System\QAKEvct.exe
  2⤵
  PID:7508
- C:\Windows\System\jkKChIN.exe
  C:\Windows\System\jkKChIN.exe
  2⤵
  PID:7524
- C:\Windows\System\Fqlrsvm.exe
  C:\Windows\System\Fqlrsvm.exe
  2⤵
  PID:7544
- C:\Windows\System\sZyFsOv.exe
  C:\Windows\System\sZyFsOv.exe
  2⤵
  PID:7564
- C:\Windows\System\RDYeekW.exe
  C:\Windows\System\RDYeekW.exe
  2⤵
  PID:7584
- C:\Windows\System\hficMYq.exe
  C:\Windows\System\hficMYq.exe
  2⤵
  PID:7600
- C:\Windows\System\rsVNZkJ.exe
  C:\Windows\System\rsVNZkJ.exe
  2⤵
  PID:7616
- C:\Windows\System\TwjPDQr.exe
  C:\Windows\System\TwjPDQr.exe
  2⤵
  PID:7632
- C:\Windows\System\jhuBRAR.exe
  C:\Windows\System\jhuBRAR.exe
  2⤵
  PID:7652
- C:\Windows\System\YLoHEcO.exe
  C:\Windows\System\YLoHEcO.exe
  2⤵
  PID:7668
- C:\Windows\System\qyIZbmW.exe
  C:\Windows\System\qyIZbmW.exe
  2⤵
  PID:7684
- C:\Windows\System\AbIMMMn.exe
  C:\Windows\System\AbIMMMn.exe
  2⤵
  PID:7704
- C:\Windows\System\iEsewvJ.exe
  C:\Windows\System\iEsewvJ.exe
  2⤵
  PID:7720
- C:\Windows\System\woOfFAQ.exe
  C:\Windows\System\woOfFAQ.exe
  2⤵
  PID:7736
- C:\Windows\System\cgmqTir.exe
  C:\Windows\System\cgmqTir.exe
  2⤵
  PID:7756
- C:\Windows\System\awUuwgE.exe
  C:\Windows\System\awUuwgE.exe
  2⤵
  PID:7772
- C:\Windows\System\LRBMSdH.exe
  C:\Windows\System\LRBMSdH.exe
  2⤵
  PID:7788
- C:\Windows\System\EJBVJPx.exe
  C:\Windows\System\EJBVJPx.exe
  2⤵
  PID:7804
- C:\Windows\System\KAgijye.exe
  C:\Windows\System\KAgijye.exe
  2⤵
  PID:7820
- C:\Windows\System\nuaAnOH.exe
  C:\Windows\System\nuaAnOH.exe
  2⤵
  PID:7836
- C:\Windows\System\IURmiLm.exe
  C:\Windows\System\IURmiLm.exe
  2⤵
  PID:7852
- C:\Windows\System\molRTSg.exe
  C:\Windows\System\molRTSg.exe
  2⤵
  PID:7868
- C:\Windows\System\pzwHjmQ.exe
  C:\Windows\System\pzwHjmQ.exe
  2⤵
  PID:7888
- C:\Windows\System\QZwWaKS.exe
  C:\Windows\System\QZwWaKS.exe
  2⤵
  PID:7904
- C:\Windows\System\JCrzpmj.exe
  C:\Windows\System\JCrzpmj.exe
  2⤵
  PID:7920
- C:\Windows\System\jXAvPVo.exe
  C:\Windows\System\jXAvPVo.exe
  2⤵
  PID:7940
- C:\Windows\System\GxVMvLd.exe
  C:\Windows\System\GxVMvLd.exe
  2⤵
  PID:7956
- C:\Windows\System\szHGnzu.exe
  C:\Windows\System\szHGnzu.exe
  2⤵
  PID:7976
- C:\Windows\System\EgnwPQT.exe
  C:\Windows\System\EgnwPQT.exe
  2⤵
  PID:7992
- C:\Windows\System\MIirglV.exe
  C:\Windows\System\MIirglV.exe
  2⤵
  PID:8008
- C:\Windows\System\RsKMLyt.exe
  C:\Windows\System\RsKMLyt.exe
  2⤵
  PID:8024
- C:\Windows\System\SZRWDOv.exe
  C:\Windows\System\SZRWDOv.exe
  2⤵
  PID:8040
- C:\Windows\System\dBqnJHs.exe
  C:\Windows\System\dBqnJHs.exe
  2⤵
  PID:8056
- C:\Windows\System\vUhuonf.exe
  C:\Windows\System\vUhuonf.exe
  2⤵
  PID:8072
- C:\Windows\System\cbiKNRW.exe
  C:\Windows\System\cbiKNRW.exe
  2⤵
  PID:8088
- C:\Windows\System\dZNoHOt.exe
  C:\Windows\System\dZNoHOt.exe
  2⤵
  PID:8104
- C:\Windows\System\jpRZHrE.exe
  C:\Windows\System\jpRZHrE.exe
  2⤵
  PID:8120
- C:\Windows\System\DeTlyqZ.exe
  C:\Windows\System\DeTlyqZ.exe
  2⤵
  PID:8136
- C:\Windows\System\pifamJa.exe
  C:\Windows\System\pifamJa.exe
  2⤵
  PID:8152
- C:\Windows\System\LqxPsfh.exe
  C:\Windows\System\LqxPsfh.exe
  2⤵
  PID:8168
- C:\Windows\System\GovCgRl.exe
  C:\Windows\System\GovCgRl.exe
  2⤵
  PID:8184
- C:\Windows\System\NkjEOVU.exe
  C:\Windows\System\NkjEOVU.exe
  2⤵
  PID:4856
- C:\Windows\System\nMHSRTj.exe
  C:\Windows\System\nMHSRTj.exe
  2⤵
  PID:7180
- C:\Windows\System\ZUxEaVR.exe
  C:\Windows\System\ZUxEaVR.exe
  2⤵
  PID:7240
- C:\Windows\System\DehTVXX.exe
  C:\Windows\System\DehTVXX.exe
  2⤵
  PID:7308
- C:\Windows\System\ztShJAU.exe
  C:\Windows\System\ztShJAU.exe
  2⤵
  PID:7340
- C:\Windows\System\eFsHHsd.exe
  C:\Windows\System\eFsHHsd.exe
  2⤵
  PID:7144
- C:\Windows\System\LcXnEpZ.exe
  C:\Windows\System\LcXnEpZ.exe
  2⤵
  PID:7432
- C:\Windows\System\WoDOedV.exe
  C:\Windows\System\WoDOedV.exe
  2⤵
  PID:7496
- C:\Windows\System\dYinQsf.exe
  C:\Windows\System\dYinQsf.exe
  2⤵
  PID:7532
- C:\Windows\System\lPEmihS.exe
  C:\Windows\System\lPEmihS.exe
  2⤵
  PID:6416
- C:\Windows\System\fWqooCu.exe
  C:\Windows\System\fWqooCu.exe
  2⤵
  PID:7196
- C:\Windows\System\esxinno.exe
  C:\Windows\System\esxinno.exe
  2⤵
  PID:7352
- C:\Windows\System\ZojkPxi.exe
  C:\Windows\System\ZojkPxi.exe
  2⤵
  PID:7608
- C:\Windows\System\SYBoLcJ.exe
  C:\Windows\System\SYBoLcJ.exe
  2⤵
  PID:7192
- C:\Windows\System\PbexWze.exe
  C:\Windows\System\PbexWze.exe
  2⤵
  PID:7224
- C:\Windows\System\wdXfmdi.exe
  C:\Windows\System\wdXfmdi.exe
  2⤵
  PID:7228
- C:\Windows\System\LTDTAyB.exe
  C:\Windows\System\LTDTAyB.exe
  2⤵
  PID:7356
- C:\Windows\System\qUZhjzI.exe
  C:\Windows\System\qUZhjzI.exe
  2⤵
  PID:7420
- C:\Windows\System\YwTLpTW.exe
  C:\Windows\System\YwTLpTW.exe
  2⤵
  PID:7516
- C:\Windows\System\mWYMiwF.exe
  C:\Windows\System\mWYMiwF.exe
  2⤵
  PID:7592
- C:\Windows\System\gQcFxnh.exe
  C:\Windows\System\gQcFxnh.exe
  2⤵
  PID:7648
- C:\Windows\System\uiKzyQL.exe
  C:\Windows\System\uiKzyQL.exe
  2⤵
  PID:7628
- C:\Windows\System\JanIlkC.exe
  C:\Windows\System\JanIlkC.exe
  2⤵
  PID:7664
- C:\Windows\System\HIChFef.exe
  C:\Windows\System\HIChFef.exe
  2⤵
  PID:7752
- C:\Windows\System\FoRHYhq.exe
  C:\Windows\System\FoRHYhq.exe
  2⤵
  PID:7844
- C:\Windows\System\QfsGkEN.exe
  C:\Windows\System\QfsGkEN.exe
  2⤵
  PID:7692
- C:\Windows\System\PxWdaAL.exe
  C:\Windows\System\PxWdaAL.exe
  2⤵
  PID:7732
- C:\Windows\System\owQTeFB.exe
  C:\Windows\System\owQTeFB.exe
  2⤵
  PID:7800
- C:\Windows\System\wwGTkbn.exe
  C:\Windows\System\wwGTkbn.exe
  2⤵
  PID:7972
- C:\Windows\System\xiqTEZj.exe
  C:\Windows\System\xiqTEZj.exe
  2⤵
  PID:7928
- C:\Windows\System\YTCLhSK.exe
  C:\Windows\System\YTCLhSK.exe
  2⤵
  PID:7832
- C:\Windows\System\zekrXnv.exe
  C:\Windows\System\zekrXnv.exe
  2⤵
  PID:7900
- C:\Windows\System\BGdsKGQ.exe
  C:\Windows\System\BGdsKGQ.exe
  2⤵
  PID:8052
- C:\Windows\System\wEmCLfL.exe
  C:\Windows\System\wEmCLfL.exe
  2⤵
  PID:8064
- C:\Windows\System\FFgeIMl.exe
  C:\Windows\System\FFgeIMl.exe
  2⤵
  PID:8000
- C:\Windows\System\LRKkfwI.exe
  C:\Windows\System\LRKkfwI.exe
  2⤵
  PID:8116
- C:\Windows\System\aaeptCw.exe
  C:\Windows\System\aaeptCw.exe
  2⤵
  PID:8176
- C:\Windows\System\jiWDreu.exe
  C:\Windows\System\jiWDreu.exe
  2⤵
  PID:8132
- C:\Windows\System\EhcMjmF.exe
  C:\Windows\System\EhcMjmF.exe
  2⤵
  PID:8128
- C:\Windows\System\ojypxDD.exe
  C:\Windows\System\ojypxDD.exe
  2⤵
  PID:7208
- C:\Windows\System\pBVpXmh.exe
  C:\Windows\System\pBVpXmh.exe
  2⤵
  PID:6148
- C:\Windows\System\jbZlzsk.exe
  C:\Windows\System\jbZlzsk.exe
  2⤵
  PID:7540
- C:\Windows\System\pFYFUSW.exe
  C:\Windows\System\pFYFUSW.exe
  2⤵
  PID:6772
- C:\Windows\System\VesvKZv.exe
  C:\Windows\System\VesvKZv.exe
  2⤵
  PID:7400
- C:\Windows\System\RGwLQIF.exe
  C:\Windows\System\RGwLQIF.exe
  2⤵
  PID:7576
- C:\Windows\System\XZwXSVl.exe
  C:\Windows\System\XZwXSVl.exe
  2⤵
  PID:7288
- C:\Windows\System\USGGIcM.exe
  C:\Windows\System\USGGIcM.exe
  2⤵
  PID:7256
- C:\Windows\System\nrvWLah.exe
  C:\Windows\System\nrvWLah.exe
  2⤵
  PID:7556
- C:\Windows\System\wDHBNQC.exe
  C:\Windows\System\wDHBNQC.exe
  2⤵
  PID:7624
- C:\Windows\System\LfGQOuR.exe
  C:\Windows\System\LfGQOuR.exe
  2⤵
  PID:7880
- C:\Windows\System\qrjItsy.exe
  C:\Windows\System\qrjItsy.exe
  2⤵
  PID:7848
- C:\Windows\System\WoxjGzR.exe
  C:\Windows\System\WoxjGzR.exe
  2⤵
  PID:7728
- C:\Windows\System\nHbINOy.exe
  C:\Windows\System\nHbINOy.exe
  2⤵
  PID:8080
- C:\Windows\System\sCQmTcK.exe
  C:\Windows\System\sCQmTcK.exe
  2⤵
  PID:7744
- C:\Windows\System\mTPUVYj.exe
  C:\Windows\System\mTPUVYj.exe
  2⤵
  PID:8180
- C:\Windows\System\efCShQM.exe
  C:\Windows\System\efCShQM.exe
  2⤵
  PID:5912
- C:\Windows\System\NztbCkv.exe
  C:\Windows\System\NztbCkv.exe
  2⤵
  PID:7580
- C:\Windows\System\cWNYTxt.exe
  C:\Windows\System\cWNYTxt.exe
  2⤵
  PID:7784
- C:\Windows\System\cVnZKlF.exe
  C:\Windows\System\cVnZKlF.exe
  2⤵
  PID:7984
- C:\Windows\System\GbYQkTX.exe
  C:\Windows\System\GbYQkTX.exe
  2⤵
  PID:8032
- C:\Windows\System\oiEfZpw.exe
  C:\Windows\System\oiEfZpw.exe
  2⤵
  PID:8160
- C:\Windows\System\leEjjZo.exe
  C:\Windows\System\leEjjZo.exe
  2⤵
  PID:7768
- C:\Windows\System\hfgZDgA.exe
  C:\Windows\System\hfgZDgA.exe
  2⤵
  PID:8204
- C:\Windows\System\iijkvBP.exe
  C:\Windows\System\iijkvBP.exe
  2⤵
  PID:8224
- C:\Windows\System\LdfbVym.exe
  C:\Windows\System\LdfbVym.exe
  2⤵
  PID:8240
- C:\Windows\System\NhDvkIm.exe
  C:\Windows\System\NhDvkIm.exe
  2⤵
  PID:8256
- C:\Windows\System\rRoxBos.exe
  C:\Windows\System\rRoxBos.exe
  2⤵
  PID:8272
- C:\Windows\System\ajdycVk.exe
  C:\Windows\System\ajdycVk.exe
  2⤵
  PID:8288
- C:\Windows\System\tjxYFTA.exe
  C:\Windows\System\tjxYFTA.exe
  2⤵
  PID:8304
- C:\Windows\System\ZcWtECi.exe
  C:\Windows\System\ZcWtECi.exe
  2⤵
  PID:8320
- C:\Windows\System\NrNVzIB.exe
  C:\Windows\System\NrNVzIB.exe
  2⤵
  PID:8336
- C:\Windows\System\NMAiYzD.exe
  C:\Windows\System\NMAiYzD.exe
  2⤵
  PID:8352
- C:\Windows\System\JgPrpMJ.exe
  C:\Windows\System\JgPrpMJ.exe
  2⤵
  PID:8368
- C:\Windows\System\AkNAHFF.exe
  C:\Windows\System\AkNAHFF.exe
  2⤵
  PID:8384
- C:\Windows\System\oaiGXTo.exe
  C:\Windows\System\oaiGXTo.exe
  2⤵
  PID:8400
- C:\Windows\System\pQfJZQS.exe
  C:\Windows\System\pQfJZQS.exe
  2⤵
  PID:8424
- C:\Windows\System\qZuJOyR.exe
  C:\Windows\System\qZuJOyR.exe
  2⤵
  PID:8440
- C:\Windows\System\mtZPhfn.exe
  C:\Windows\System\mtZPhfn.exe
  2⤵
  PID:8456
- C:\Windows\System\IhkTdMY.exe
  C:\Windows\System\IhkTdMY.exe
  2⤵
  PID:8472
- C:\Windows\System\ziSYsKj.exe
  C:\Windows\System\ziSYsKj.exe
  2⤵
  PID:8488
- C:\Windows\System\RiiXzPD.exe
  C:\Windows\System\RiiXzPD.exe
  2⤵
  PID:8504
- C:\Windows\System\xyHVOUS.exe
  C:\Windows\System\xyHVOUS.exe
  2⤵
  PID:8520
- C:\Windows\System\IzzpTfb.exe
  C:\Windows\System\IzzpTfb.exe
  2⤵
  PID:8536
- C:\Windows\System\navYdLr.exe
  C:\Windows\System\navYdLr.exe
  2⤵
  PID:8552
- C:\Windows\System\LEnMDOU.exe
  C:\Windows\System\LEnMDOU.exe
  2⤵
  PID:8568
- C:\Windows\System\AsHCWoH.exe
  C:\Windows\System\AsHCWoH.exe
  2⤵
  PID:8584
- C:\Windows\System\djHVWOh.exe
  C:\Windows\System\djHVWOh.exe
  2⤵
  PID:8600
- C:\Windows\System\SYWrTac.exe
  C:\Windows\System\SYWrTac.exe
  2⤵
  PID:8616
- C:\Windows\System\KnFAKWo.exe
  C:\Windows\System\KnFAKWo.exe
  2⤵
  PID:8632
- C:\Windows\System\AfRGTqV.exe
  C:\Windows\System\AfRGTqV.exe
  2⤵
  PID:8648
- C:\Windows\System\VhDfSBX.exe
  C:\Windows\System\VhDfSBX.exe
  2⤵
  PID:8664
- C:\Windows\System\MMGQqMH.exe
  C:\Windows\System\MMGQqMH.exe
  2⤵
  PID:8680
- C:\Windows\System\PvbYalX.exe
  C:\Windows\System\PvbYalX.exe
  2⤵
  PID:8696
- C:\Windows\System\ThTuEYL.exe
  C:\Windows\System\ThTuEYL.exe
  2⤵
  PID:8712
- C:\Windows\System\XdtnnOG.exe
  C:\Windows\System\XdtnnOG.exe
  2⤵
  PID:8728
- C:\Windows\System\mMnGOUl.exe
  C:\Windows\System\mMnGOUl.exe
  2⤵
  PID:8744
- C:\Windows\System\UIsWfaX.exe
  C:\Windows\System\UIsWfaX.exe
  2⤵
  PID:8760
- C:\Windows\System\wMTnCxQ.exe
  C:\Windows\System\wMTnCxQ.exe
  2⤵
  PID:8776
- C:\Windows\System\ZsLiRTW.exe
  C:\Windows\System\ZsLiRTW.exe
  2⤵
  PID:8792
- C:\Windows\System\pOqHVSf.exe
  C:\Windows\System\pOqHVSf.exe
  2⤵
  PID:8808
- C:\Windows\System\IJnVxfT.exe
  C:\Windows\System\IJnVxfT.exe
  2⤵
  PID:8824
- C:\Windows\System\GNuGBtz.exe
  C:\Windows\System\GNuGBtz.exe
  2⤵
  PID:8840
- C:\Windows\System\IgrfKOw.exe
  C:\Windows\System\IgrfKOw.exe
  2⤵
  PID:8856
- C:\Windows\System\xlUouhh.exe
  C:\Windows\System\xlUouhh.exe
  2⤵
  PID:8872
- C:\Windows\System\EtUVQPF.exe
  C:\Windows\System\EtUVQPF.exe
  2⤵
  PID:8888
- C:\Windows\System\jFSZKuL.exe
  C:\Windows\System\jFSZKuL.exe
  2⤵
  PID:8904
- C:\Windows\System\GEecjkE.exe
  C:\Windows\System\GEecjkE.exe
  2⤵
  PID:8920
- C:\Windows\System\BQZIdAB.exe
  C:\Windows\System\BQZIdAB.exe
  2⤵
  PID:8936
- C:\Windows\System\IxoqWUN.exe
  C:\Windows\System\IxoqWUN.exe
  2⤵
  PID:8952
- C:\Windows\System\VIBcLbY.exe
  C:\Windows\System\VIBcLbY.exe
  2⤵
  PID:8968
- C:\Windows\System\DiIGlAq.exe
  C:\Windows\System\DiIGlAq.exe
  2⤵
  PID:8984
- C:\Windows\System\adMbCyJ.exe
  C:\Windows\System\adMbCyJ.exe
  2⤵
  PID:9000
- C:\Windows\System\mjZqmMk.exe
  C:\Windows\System\mjZqmMk.exe
  2⤵
  PID:9016
- C:\Windows\System\JFkgsPg.exe
  C:\Windows\System\JFkgsPg.exe
  2⤵
  PID:9032
- C:\Windows\System\UVIxBPB.exe
  C:\Windows\System\UVIxBPB.exe
  2⤵
  PID:9048
- C:\Windows\System\FoJDByZ.exe
  C:\Windows\System\FoJDByZ.exe
  2⤵
  PID:9064
- C:\Windows\System\ZHAsLnR.exe
  C:\Windows\System\ZHAsLnR.exe
  2⤵
  PID:9080
- C:\Windows\System\qATnIZC.exe
  C:\Windows\System\qATnIZC.exe
  2⤵
  PID:9096
- C:\Windows\System\hHYtyXT.exe
  C:\Windows\System\hHYtyXT.exe
  2⤵
  PID:9116
- C:\Windows\System\ivrMPoy.exe
  C:\Windows\System\ivrMPoy.exe
  2⤵
  PID:9132
- C:\Windows\System\oqjcAin.exe
  C:\Windows\System\oqjcAin.exe
  2⤵
  PID:9148
- C:\Windows\System\EESxwmF.exe
  C:\Windows\System\EESxwmF.exe
  2⤵
  PID:9164
- C:\Windows\System\SqaAqLI.exe
  C:\Windows\System\SqaAqLI.exe
  2⤵
  PID:9180
- C:\Windows\System\jBGXWEa.exe
  C:\Windows\System\jBGXWEa.exe
  2⤵
  PID:9196
- C:\Windows\System\VYVvWaJ.exe
  C:\Windows\System\VYVvWaJ.exe
  2⤵
  PID:9212
- C:\Windows\System\tUuNGsO.exe
  C:\Windows\System\tUuNGsO.exe
  2⤵
  PID:8048
- C:\Windows\System\xKKTjBo.exe
  C:\Windows\System\xKKTjBo.exe
  2⤵
  PID:7504
- C:\Windows\System\hhhZEUA.exe
  C:\Windows\System\hhhZEUA.exe
  2⤵
  PID:7276
- C:\Windows\System\HISDEdB.exe
  C:\Windows\System\HISDEdB.exe
  2⤵
  PID:6400
- C:\Windows\System\AJKMgqa.exe
  C:\Windows\System\AJKMgqa.exe
  2⤵
  PID:7452
- C:\Windows\System\pDxkVTH.exe
  C:\Windows\System\pDxkVTH.exe
  2⤵
  PID:7988
- C:\Windows\System\MbutCAG.exe
  C:\Windows\System\MbutCAG.exe
  2⤵
  PID:8096
- C:\Windows\System\WyVhzaF.exe
  C:\Windows\System\WyVhzaF.exe
  2⤵
  PID:7032
- C:\Windows\System\AbxNPnH.exe
  C:\Windows\System\AbxNPnH.exe
  2⤵
  PID:8312
- C:\Windows\System\kmxIVIF.exe
  C:\Windows\System\kmxIVIF.exe
  2⤵
  PID:8348
- C:\Windows\System\byusggz.exe
  C:\Windows\System\byusggz.exe
  2⤵
  PID:8408
- C:\Windows\System\CnHTOFg.exe
  C:\Windows\System\CnHTOFg.exe
  2⤵
  PID:8264
- C:\Windows\System\UAEpYaM.exe
  C:\Windows\System\UAEpYaM.exe
  2⤵
  PID:8360
- C:\Windows\System\BOrTeLe.exe
  C:\Windows\System\BOrTeLe.exe
  2⤵
  PID:8416
- C:\Windows\System\tHLseVB.exe
  C:\Windows\System\tHLseVB.exe
  2⤵
  PID:8432
- C:\Windows\System\ifKozmG.exe
  C:\Windows\System\ifKozmG.exe
  2⤵
  PID:8480
- C:\Windows\System\ufSQQdQ.exe
  C:\Windows\System\ufSQQdQ.exe
  2⤵
  PID:8544
- C:\Windows\System\gPZJsSz.exe
  C:\Windows\System\gPZJsSz.exe
  2⤵
  PID:8528
- C:\Windows\System\tkVqojL.exe
  C:\Windows\System\tkVqojL.exe
  2⤵
  PID:8564
- C:\Windows\System\IvLGqiN.exe
  C:\Windows\System\IvLGqiN.exe
  2⤵
  PID:8596
- C:\Windows\System\HTfNIhA.exe
  C:\Windows\System\HTfNIhA.exe
  2⤵
  PID:8672
- C:\Windows\System\AbNFRDb.exe
  C:\Windows\System\AbNFRDb.exe
  2⤵
  PID:8628
- C:\Windows\System\NJAIUUE.exe
  C:\Windows\System\NJAIUUE.exe
  2⤵
  PID:8688
- C:\Windows\System\pYzxSVT.exe
  C:\Windows\System\pYzxSVT.exe
  2⤵
  PID:8768
- C:\Windows\System\qbAUgqS.exe
  C:\Windows\System\qbAUgqS.exe
  2⤵
  PID:8804
- C:\Windows\System\aHBbAKP.exe
  C:\Windows\System\aHBbAKP.exe
  2⤵
  PID:8868
- C:\Windows\System\kOckzKI.exe
  C:\Windows\System\kOckzKI.exe
  2⤵
  PID:8884
- C:\Windows\System\nVdWEwX.exe
  C:\Windows\System\nVdWEwX.exe
  2⤵
  PID:8820
- C:\Windows\System\KviiiSu.exe
  C:\Windows\System\KviiiSu.exe
  2⤵
  PID:8756
- C:\Windows\System\bCMDHwt.exe
  C:\Windows\System\bCMDHwt.exe
  2⤵
  PID:8928
- C:\Windows\System\qDPNkbb.exe
  C:\Windows\System\qDPNkbb.exe
  2⤵
  PID:8960
- C:\Windows\System\urcghim.exe
  C:\Windows\System\urcghim.exe
  2⤵
  PID:9056
- C:\Windows\System\wpGcmLt.exe
  C:\Windows\System\wpGcmLt.exe
  2⤵
  PID:8980
- C:\Windows\System\oHOkwmC.exe
  C:\Windows\System\oHOkwmC.exe
  2⤵
  PID:9012
- C:\Windows\System\tAfQXpF.exe
  C:\Windows\System\tAfQXpF.exe
  2⤵
  PID:9072
- C:\Windows\System\xxKHMPi.exe
  C:\Windows\System\xxKHMPi.exe
  2⤵
  PID:9108
- C:\Windows\System\yAfsVXy.exe
  C:\Windows\System\yAfsVXy.exe
  2⤵
  PID:9156
- C:\Windows\System\NsAoBRa.exe
  C:\Windows\System\NsAoBRa.exe
  2⤵
  PID:9172
- C:\Windows\System\yOdGOmj.exe
  C:\Windows\System\yOdGOmj.exe
  2⤵
  PID:9204
- C:\Windows\System\thBwEzY.exe
  C:\Windows\System\thBwEzY.exe
  2⤵
  PID:7068
- C:\Windows\System\VCrnxrK.exe
  C:\Windows\System\VCrnxrK.exe
  2⤵
  PID:7572
- C:\Windows\System\afJJADP.exe
  C:\Windows\System\afJJADP.exe
  2⤵
  PID:8112
- C:\Windows\System\tmPytdu.exe
  C:\Windows\System\tmPytdu.exe
  2⤵
  PID:8236
- C:\Windows\System\kMdBQgN.exe
  C:\Windows\System\kMdBQgN.exe
  2⤵
  PID:8280
- C:\Windows\System\ATRpRWP.exe
  C:\Windows\System\ATRpRWP.exe
  2⤵
  PID:7048
- C:\Windows\System\DRSKwyt.exe
  C:\Windows\System\DRSKwyt.exe
  2⤵
  PID:8412
- C:\Windows\System\iBRdssA.exe
  C:\Windows\System\iBRdssA.exe
  2⤵
  PID:8512
- C:\Windows\System\SCBQKcv.exe
  C:\Windows\System\SCBQKcv.exe
  2⤵
  PID:8640
- C:\Windows\System\KJWwlxq.exe
  C:\Windows\System\KJWwlxq.exe
  2⤵
  PID:8644
- C:\Windows\System\bVzeWQq.exe
  C:\Windows\System\bVzeWQq.exe
  2⤵
  PID:8720
- C:\Windows\System\fEeTvYg.exe
  C:\Windows\System\fEeTvYg.exe
  2⤵
  PID:8784
- C:\Windows\System\WWyMvdK.exe
  C:\Windows\System\WWyMvdK.exe
  2⤵
  PID:8832
- C:\Windows\System\pJicidt.exe
  C:\Windows\System\pJicidt.exe
  2⤵
  PID:8496
- C:\Windows\System\CvWEvSm.exe
  C:\Windows\System\CvWEvSm.exe
  2⤵
  PID:8916
- C:\Windows\System\GusnwjB.exe
  C:\Windows\System\GusnwjB.exe
  2⤵
  PID:8896
- C:\Windows\System\PYmSffP.exe
  C:\Windows\System\PYmSffP.exe
  2⤵
  PID:9092
- C:\Windows\System\rcaxXRY.exe
  C:\Windows\System\rcaxXRY.exe
  2⤵
  PID:8996
- C:\Windows\System\tSvSvXY.exe
  C:\Windows\System\tSvSvXY.exe
  2⤵
  PID:9076
- C:\Windows\System\GzMcivb.exe
  C:\Windows\System\GzMcivb.exe
  2⤵
  PID:7404
- C:\Windows\System\UTDhNtY.exe
  C:\Windows\System\UTDhNtY.exe
  2⤵
  PID:9140
- C:\Windows\System\TldDxfG.exe
  C:\Windows\System\TldDxfG.exe
  2⤵
  PID:7500
- C:\Windows\System\ActNAlx.exe
  C:\Windows\System\ActNAlx.exe
  2⤵
  PID:8452
- C:\Windows\System\mSqGOuK.exe
  C:\Windows\System\mSqGOuK.exe
  2⤵
  PID:8912
- C:\Windows\System\pGyagbh.exe
  C:\Windows\System\pGyagbh.exe
  2⤵
  PID:7644
- C:\Windows\System\ofNCvOV.exe
  C:\Windows\System\ofNCvOV.exe
  2⤵
  PID:8656
- C:\Windows\System\TqOxtgg.exe
  C:\Windows\System\TqOxtgg.exe
  2⤵
  PID:9104
- C:\Windows\System\ApzEyfs.exe
  C:\Windows\System\ApzEyfs.exe
  2⤵
  PID:8560
- C:\Windows\System\NXXaPkN.exe
  C:\Windows\System\NXXaPkN.exe
  2⤵
  PID:8380
- C:\Windows\System\EQbRPBO.exe
  C:\Windows\System\EQbRPBO.exe
  2⤵
  PID:8396
- C:\Windows\System\bSJRLUA.exe
  C:\Windows\System\bSJRLUA.exe
  2⤵
  PID:8704
- C:\Windows\System\nyLYfYA.exe
  C:\Windows\System\nyLYfYA.exe
  2⤵
  PID:9144
- C:\Windows\System\rTphCMK.exe
  C:\Windows\System\rTphCMK.exe
  2⤵
  PID:8532
- C:\Windows\System\yoVLzyG.exe
  C:\Windows\System\yoVLzyG.exe
  2⤵
  PID:8692
- C:\Windows\System\AVsKLiz.exe
  C:\Windows\System\AVsKLiz.exe
  2⤵
  PID:8200
- C:\Windows\System\ZYhRuId.exe
  C:\Windows\System\ZYhRuId.exe
  2⤵
  PID:7260
- C:\Windows\System\tqNwrQK.exe
  C:\Windows\System\tqNwrQK.exe
  2⤵
  PID:9236
- C:\Windows\System\WyHHNkM.exe
  C:\Windows\System\WyHHNkM.exe
  2⤵
  PID:9256
- C:\Windows\System\qXxewKG.exe
  C:\Windows\System\qXxewKG.exe
  2⤵
  PID:9272
- C:\Windows\System\naCIrvw.exe
  C:\Windows\System\naCIrvw.exe
  2⤵
  PID:9288
- C:\Windows\System\GOfUaKt.exe
  C:\Windows\System\GOfUaKt.exe
  2⤵
  PID:9312
- C:\Windows\System\VawzBWM.exe
  C:\Windows\System\VawzBWM.exe
  2⤵
  PID:9332
- C:\Windows\System\ZYEDrCL.exe
  C:\Windows\System\ZYEDrCL.exe
  2⤵
  PID:9348
- C:\Windows\System\ywNahcR.exe
  C:\Windows\System\ywNahcR.exe
  2⤵
  PID:9364
- C:\Windows\System\JgDudFE.exe
  C:\Windows\System\JgDudFE.exe
  2⤵
  PID:9380
- C:\Windows\System\RXqZKwX.exe
  C:\Windows\System\RXqZKwX.exe
  2⤵
  PID:9396
- C:\Windows\System\MlfWeNG.exe
  C:\Windows\System\MlfWeNG.exe
  2⤵
  PID:9412
- C:\Windows\System\wrMQaFP.exe
  C:\Windows\System\wrMQaFP.exe
  2⤵
  PID:9432
- C:\Windows\System\jejcPWU.exe
  C:\Windows\System\jejcPWU.exe
  2⤵
  PID:9452
- C:\Windows\System\DDNbMsA.exe
  C:\Windows\System\DDNbMsA.exe
  2⤵
  PID:9468
- C:\Windows\System\timMJir.exe
  C:\Windows\System\timMJir.exe
  2⤵
  PID:9484
- C:\Windows\System\KFpbxFO.exe
  C:\Windows\System\KFpbxFO.exe
  2⤵
  PID:9500
- C:\Windows\System\Tyzrlca.exe
  C:\Windows\System\Tyzrlca.exe
  2⤵
  PID:9516
- C:\Windows\System\RBYqRaH.exe
  C:\Windows\System\RBYqRaH.exe
  2⤵
  PID:9532
- C:\Windows\System\hpdhaPu.exe
  C:\Windows\System\hpdhaPu.exe
  2⤵
  PID:9548
- C:\Windows\System\FtTqXcX.exe
  C:\Windows\System\FtTqXcX.exe
  2⤵
  PID:9568
- C:\Windows\System\cECBfqH.exe
  C:\Windows\System\cECBfqH.exe
  2⤵
  PID:9584
- C:\Windows\System\daBHSFG.exe
  C:\Windows\System\daBHSFG.exe
  2⤵
  PID:9600
- C:\Windows\System\GjCkoYn.exe
  C:\Windows\System\GjCkoYn.exe
  2⤵
  PID:9616
- C:\Windows\System\oZXQSNk.exe
  C:\Windows\System\oZXQSNk.exe
  2⤵
  PID:9632
- C:\Windows\System\XWilJsG.exe
  C:\Windows\System\XWilJsG.exe
  2⤵
  PID:9648
- C:\Windows\System\BCBesPB.exe
  C:\Windows\System\BCBesPB.exe
  2⤵
  PID:9664
- C:\Windows\System\wSBoBCg.exe
  C:\Windows\System\wSBoBCg.exe
  2⤵
  PID:9680
- C:\Windows\System\fFbRkrY.exe
  C:\Windows\System\fFbRkrY.exe
  2⤵
  PID:9696
- C:\Windows\System\eiHcQng.exe
  C:\Windows\System\eiHcQng.exe
  2⤵
  PID:9712
- C:\Windows\System\PzpCCBh.exe
  C:\Windows\System\PzpCCBh.exe
  2⤵
  PID:9728
- C:\Windows\System\FENTCRm.exe
  C:\Windows\System\FENTCRm.exe
  2⤵
  PID:9744
- C:\Windows\System\JjqpaZC.exe
  C:\Windows\System\JjqpaZC.exe
  2⤵
  PID:9760
- C:\Windows\System\OeIylnr.exe
  C:\Windows\System\OeIylnr.exe
  2⤵
  PID:9776
- C:\Windows\System\bjKBEbz.exe
  C:\Windows\System\bjKBEbz.exe
  2⤵
  PID:9792
- C:\Windows\System\jDCuCvM.exe
  C:\Windows\System\jDCuCvM.exe
  2⤵
  PID:9808
- C:\Windows\System\ttXzKxD.exe
  C:\Windows\System\ttXzKxD.exe
  2⤵
  PID:9824
- C:\Windows\System\UDysIvw.exe
  C:\Windows\System\UDysIvw.exe
  2⤵
  PID:9840
- C:\Windows\System\bCMjhVH.exe
  C:\Windows\System\bCMjhVH.exe
  2⤵
  PID:9856
- C:\Windows\System\VfyPrWK.exe
  C:\Windows\System\VfyPrWK.exe
  2⤵
  PID:9872
- C:\Windows\System\xkMsJCi.exe
  C:\Windows\System\xkMsJCi.exe
  2⤵
  PID:9888
- C:\Windows\System\oEtFnDh.exe
  C:\Windows\System\oEtFnDh.exe
  2⤵
  PID:9904
- C:\Windows\System\XgmkcRu.exe
  C:\Windows\System\XgmkcRu.exe
  2⤵
  PID:9920
- C:\Windows\System\vjkIGEa.exe
  C:\Windows\System\vjkIGEa.exe
  2⤵
  PID:9936
- C:\Windows\System\kAFTqhC.exe
  C:\Windows\System\kAFTqhC.exe
  2⤵
  PID:9952
- C:\Windows\System\pGRGlaz.exe
  C:\Windows\System\pGRGlaz.exe
  2⤵
  PID:9968
- C:\Windows\System\JZCuXAV.exe
  C:\Windows\System\JZCuXAV.exe
  2⤵
  PID:9984
- C:\Windows\System\OVJcEUu.exe
  C:\Windows\System\OVJcEUu.exe
  2⤵
  PID:10000
- C:\Windows\System\mULOuuW.exe
  C:\Windows\System\mULOuuW.exe
  2⤵
  PID:10016
- C:\Windows\System\nYzDeth.exe
  C:\Windows\System\nYzDeth.exe
  2⤵
  PID:10032
- C:\Windows\System\btbdhaz.exe
  C:\Windows\System\btbdhaz.exe
  2⤵
  PID:10052
- C:\Windows\System\GvBcoJp.exe
  C:\Windows\System\GvBcoJp.exe
  2⤵
  PID:10068
- C:\Windows\System\qGlKPBf.exe
  C:\Windows\System\qGlKPBf.exe
  2⤵
  PID:10084
- C:\Windows\System\BeNqYmr.exe
  C:\Windows\System\BeNqYmr.exe
  2⤵
  PID:10104
- C:\Windows\System\vOwMhnI.exe
  C:\Windows\System\vOwMhnI.exe
  2⤵
  PID:10120
- C:\Windows\System\SApgAJt.exe
  C:\Windows\System\SApgAJt.exe
  2⤵
  PID:10144
- C:\Windows\System\WbhhtMa.exe
  C:\Windows\System\WbhhtMa.exe
  2⤵
  PID:10160
- C:\Windows\System\QpvelAZ.exe
  C:\Windows\System\QpvelAZ.exe
  2⤵
  PID:10180
- C:\Windows\System\WGrmyOf.exe
  C:\Windows\System\WGrmyOf.exe
  2⤵
  PID:10196
- C:\Windows\System\oabAPBP.exe
  C:\Windows\System\oabAPBP.exe
  2⤵
  PID:10216
- C:\Windows\System\URSLQlf.exe
  C:\Windows\System\URSLQlf.exe
  2⤵
  PID:10232
- C:\Windows\System\odBqfoB.exe
  C:\Windows\System\odBqfoB.exe
  2⤵
  PID:1572
- C:\Windows\System\onJrhFX.exe
  C:\Windows\System\onJrhFX.exe
  2⤵
  PID:9228
- C:\Windows\System\CmOdFAJ.exe
  C:\Windows\System\CmOdFAJ.exe
  2⤵
  PID:9160
- C:\Windows\System\HEsjBnC.exe
  C:\Windows\System\HEsjBnC.exe
  2⤵
  PID:9280
- C:\Windows\System\CPCUzzK.exe
  C:\Windows\System\CPCUzzK.exe
  2⤵
  PID:9296
- C:\Windows\System\qsbpFko.exe
  C:\Windows\System\qsbpFko.exe
  2⤵
  PID:9340
- C:\Windows\System\TFjSfAg.exe
  C:\Windows\System\TFjSfAg.exe
  2⤵
  PID:9392
- C:\Windows\System\HjoXDzT.exe
  C:\Windows\System\HjoXDzT.exe
  2⤵
  PID:9428
- C:\Windows\System\SKJgbUX.exe
  C:\Windows\System\SKJgbUX.exe
  2⤵
  PID:9408
- C:\Windows\System\kyvQAuW.exe
  C:\Windows\System\kyvQAuW.exe
  2⤵
  PID:9444
- C:\Windows\System\HANZFqD.exe
  C:\Windows\System\HANZFqD.exe
  2⤵
  PID:9476
- C:\Windows\System\QACdFTK.exe
  C:\Windows\System\QACdFTK.exe
  2⤵
  PID:9528
- C:\Windows\System\AjueHuT.exe
  C:\Windows\System\AjueHuT.exe
  2⤵
  PID:9564
- C:\Windows\System\mazRwIi.exe
  C:\Windows\System\mazRwIi.exe
  2⤵
  PID:9628
- C:\Windows\System\bPBeAaD.exe
  C:\Windows\System\bPBeAaD.exe
  2⤵
  PID:9688
- C:\Windows\System\dMbAswq.exe
  C:\Windows\System\dMbAswq.exe
  2⤵
  PID:9644
- C:\Windows\System\xtQFNvs.exe
  C:\Windows\System\xtQFNvs.exe
  2⤵
  PID:9672
- C:\Windows\System\oFgRVhw.exe
  C:\Windows\System\oFgRVhw.exe
  2⤵
  PID:9704
- C:\Windows\System\lcBeNoP.exe
  C:\Windows\System\lcBeNoP.exe
  2⤵
  PID:9752
- C:\Windows\System\TNIQNDP.exe
  C:\Windows\System\TNIQNDP.exe
  2⤵
  PID:9816
- C:\Windows\System\cqnwuwG.exe
  C:\Windows\System\cqnwuwG.exe
  2⤵
  PID:9880
- C:\Windows\System\WjWCrgM.exe
  C:\Windows\System\WjWCrgM.exe
  2⤵
  PID:9944
- C:\Windows\System\iRMKqVV.exe
  C:\Windows\System\iRMKqVV.exe
  2⤵
  PID:9772
- C:\Windows\System\iXpUNeM.exe
  C:\Windows\System\iXpUNeM.exe
  2⤵
  PID:9900
- C:\Windows\System\efNFtVn.exe
  C:\Windows\System\efNFtVn.exe
  2⤵
  PID:9896
- C:\Windows\System\GcEBPVe.exe
  C:\Windows\System\GcEBPVe.exe
  2⤵
  PID:9932
- C:\Windows\System\CLUMoHo.exe
  C:\Windows\System\CLUMoHo.exe
  2⤵
  PID:9996
- C:\Windows\System\qfgeLsp.exe
  C:\Windows\System\qfgeLsp.exe
  2⤵
  PID:10024
- C:\Windows\System\rNiCBXL.exe
  C:\Windows\System\rNiCBXL.exe
  2⤵
  PID:10116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AEhbEbx.exe

Filesize
2.2MB

MD5
f9fa57910c72a010e3c1e6d16764d66a

SHA1
5b0cc1ed6ce0a030f3bd0070b5299c341572ab76

SHA256
aa9cacd510fe8d6b88d3e737dfb72101547b677ae2404579f1c9e62ddc192bbc

SHA512
6d815c5f4d0651b52deb1429d151f051aa8deb4f578309e0e9167e2ada24a308a217b222e3bfc997cd0033a8be11586961395cb60cf2bf0c6786418139dc0b54

Download Submit
C:\Windows\system\BdFjcZL.exe

Filesize
2.3MB

MD5
59eb5ec6eda911e4315f0f89c9168bca

SHA1
7825e6d847e7948b26671d85e78aef888c30eeeb

SHA256
c86658e8e3e514eec4fdc56ff38da3ae4ed512333a3f27ff4f628962c93ede8a

SHA512
5f6b89761132bdd2ffdf5245f04059b296bf3790d71b73178fc67aa695824021bf5db38b2cb5421621633f3ca078dfd9c099f1131edfb75a89347673f6cd2847

Download Submit
C:\Windows\system\CbicTEi.exe

Filesize
2.2MB

MD5
372b6e9e17aa2b1a82fd82f7bfcf5fe5

SHA1
872daa39ce8694fbc433e9742c03cf36f8583eac

SHA256
5bb5d2d8748953a67e03e57aa2690ac48940c8bab3ed1ae693b0130e8259c905

SHA512
818adb2ed1923a2721523902f08bc6be08f30cb9be22130bfa8343446a5fc36c30a1f33fa8816ed0c38d9d9e76e398aba82fa4eed652a8dc349d4a238dd88b45

Download Submit
C:\Windows\system\DMjcYIK.exe

Filesize
2.3MB

MD5
5e5606ff1b8a1c4c5542a2a65f78a2eb

SHA1
282ed7f21dd0ab2c863367781931cb1f7a26ada8

SHA256
a275b172a59fe90add2ce8b994294a31c094825e1a9932816d88b78699bcd242

SHA512
2670c90e36d32b3046e9e2b1bf6c0f9a0e318238d08ba0540af9c7a6b08e55f1d1b5a9e5ba12a2a2cdb9982da9e427f61b5699d02cfd961d54acd68b9c74cdee

Download Submit
C:\Windows\system\EDwZQho.exe

Filesize
2.3MB

MD5
263a165f93c115b6723f7a9741f822b6

SHA1
600cfbd54e6e0ca2d62fb31f7d9d647d0af809a9

SHA256
f5071ce74ba48fcd7697b79b788b4eb7c67635b4b6b56d68aeb9cf0ebccaaf71

SHA512
53e6f7874976d2380164177dd13f7ddb769ebf6783e32a648b8c50b4c2a7e19b9aa6fe0458351c82c69f5fd9388fdfdea1601fe0974ebd306c69164739d04683

Download Submit
C:\Windows\system\IAPJwtu.exe

Filesize
2.3MB

MD5
1449ba6474cc3efd9e4e7e61f8cf8174

SHA1
dc20850be13bcffde0d52c4e9521240d2e25a22c

SHA256
fa1aad67d40a71b5436b99564fb346545cc16546654141fc51003bbc771b1076

SHA512
cb49e43921d38add0462d66d07194d7d8e62956bac491044e4f1be0a7cbad959b158b499ed6c78ceaed6c5e5e4cd3965dffb7660be7a4eadc3054ee7bf98e7fa

Download Submit
C:\Windows\system\JJmEWlY.exe

Filesize
2.3MB

MD5
ab20ecdbca02bcf61dec0dd8b731fd08

SHA1
38e08f6c0613d52826a4b79fa557aeb282225ace

SHA256
965c827d20ba1dce4b52921086e6dfe4be568b1dc38c3a81d69252f8bc880982

SHA512
b290751411c489407afb345f1a03300dcfb03888e316a86eab15be40c26575287ce5de7e650daaaec42e9cfa570508a5a8e0949221629354cbfbb332b1a93182

Download Submit
C:\Windows\system\LFZCxOy.exe

Filesize
2.2MB

MD5
d8c43e7ffc144a5244b2ba023736d67e

SHA1
090f512bae33e1970dba571cca6f3a6faf0f7c4c

SHA256
b7008b1425067140b1261709ebfef728cb5c7a624673d5c645e8dbfb689b2034

SHA512
aed135046af8883e4f486447211a4c45188e15ce44d5732864ccc1f0718c301aa768854f3796e6412271e59475c16dc1f697eb5c56dcddc187251e805f33f873

Download Submit
C:\Windows\system\SFggNzh.exe

Filesize
2.2MB

MD5
a35db994ab3587410bb99308fd9e418f

SHA1
1bf23a67461f13000f99b096f0e2367ef7736e82

SHA256
e5e0b0a2b4e6d1ef3a9d111a78d38572cf1091a503ac532f19472e36aa024839

SHA512
943fb95f084e5ebfd0bee4038e13052e0bdd024207233358aa21a55e60831f48efc62f918f96988b454dd27092d00b36f1e19e5cd22c76aa3c6b14b4eef2f3a9

Download Submit
C:\Windows\system\UqneqVC.exe

Filesize
2.2MB

MD5
baea376f773887658668dea69d383ef8

SHA1
b25ae131d41af8500eb06b00eddc31d4c0f4db56

SHA256
64c7853ba2cddc5398036c2d1351daecc74298b0c25e5005a5c39ad552ddda42

SHA512
ffaab749fc1f83ce5e4d895e7bb66b300312aa5ccefab71ce6a94cf30bc59bfe98fbc622bde187205669788eae292d40ab0bc00bd31bf540b1863c13db805673

Download Submit
C:\Windows\system\VKoONAG.exe

Filesize
2.2MB

MD5
9ccd43525295cc252b6fb616338452fb

SHA1
c14d78f07ff8c5f3c65ff1565190116dedf5b7de

SHA256
2b5520c8f62162adafed3432b1c6ffd56013052dee4458888682310964a71e6a

SHA512
109931fdc6e41fae7b26ea46df7d1abfe070c89d1e9fe5066fcd0d78b8e9259b0a900df392270f857621568cdb6d12a3eca8dfbfc69ff73f4ff7189bee81ded0

Download Submit
C:\Windows\system\VNrwqTb.exe

Filesize
2.2MB

MD5
1f50bb210a33b75d3d13bca4ba76f7d5

SHA1
4269954f1bfdb43b7dfa502e543e36df3c095a63

SHA256
a2f81f2ab3b70222b4c03487cdbbbae25e0682cf085b5520a5a660d03da6ec52

SHA512
fd953c913e11ddfb9b20095845f1a75f7346eca7d2b350075199923be4349436b9d379995faa4a1ddc6480f395cbe49984edc9bf1ef1486c966b24e46145a6cc

Download Submit
C:\Windows\system\XucHnge.exe

Filesize
2.2MB

MD5
51acebbaf8825c4dfe790507e06298b7

SHA1
830b702f943c0456a4b0ae2c8534d98e1c38b7d6

SHA256
0486c6dd22d8e4c2955fb828e04625421d8a625376e8f9222c986d054e24630c

SHA512
dcf3b8b3fddb5714cbf7accafd8390de9711c36f25f3333760a624fd74a02a9f6fd7ebaa803bae723aed4473ef49f1f78277a3ee22563d0f1031cf05b76489b2

Download Submit
C:\Windows\system\fNvgOLR.exe

Filesize
2.2MB

MD5
c35ed69eff4bde0fdd7a3ed2e5f1928a

SHA1
63ce02f739eda4da78ab9d8495bc1e6715a682b6

SHA256
9c6d478dbdd474971f706366d7723326f08499037156d5d30e41da3cda440222

SHA512
17821759984924679b025c049b6ba4d3cbc8ed3f365961dce5df27041378b9fafdebb76ee97011c8e6bbe095c5a65d87725c4f5a687bd90bb2e7dc4cc22e0057

Download Submit
C:\Windows\system\oGqBwFq.exe

Filesize
2.2MB

MD5
86408a16dc8b9f8c6700798649291640

SHA1
170d769a486f990287fb93ebe7a965ac6a196c9b

SHA256
8400c981cad206d046ec911d94daeb9f9c0a0d565485b0b85b50e7ffcb19b1bc

SHA512
7bae94a7f03e22597e923c94b20e747f1983bb40d7bf4376276e66ca470fd9f668885236456e95cec4424952bcc2a2d1f39883f05e2c396791ed816c437cad91

Download Submit
C:\Windows\system\ojLveOp.exe

Filesize
2.2MB

MD5
205005407d7e39b6a07b5480d9fb4236

SHA1
6dee025788374532b1bd2598c2ac636413b8876f

SHA256
0ff5cb91e796baa2b3358f20c78486a64a23180eb1d090afa2fe2ff13509a2ae

SHA512
95f65548123d09e366bb0681283dd5214a221f29bc65971c9331d7c5ab7a9688524488f2df5910c6891082a865404f721f33ebc81cbd463f144d886e1431cc06

Download Submit
C:\Windows\system\pJJNNUh.exe

Filesize
2.2MB

MD5
051de0a529bb61c116c86441b4f945b2

SHA1
4ad589f95f167d20080ecff4ae2a223779d8a54c

SHA256
4aa1282abc6ea0e2fc6d0484faf752df3ea3ba230e78543eb79facf386e419b4

SHA512
20182379d06ac2fd3cf4e7478b0d6f0a7527d19b9c7b569bdcb3f6acb0606c40a79fbabe5622c8639720aec02f244a9344dc59d6aa793c74182b9ecfb4bea118

Download Submit
C:\Windows\system\szyEbPB.exe

Filesize
2.2MB

MD5
fa28209915f479648350c440f1c3dcfa

SHA1
2e99c948ea8c291d7e1809ccbd5ee7f2341bde5e

SHA256
d3567ed22e55778496b6a703c9f54d25be332eda0a3afb6953cd54dcb7749146

SHA512
4d5799dd113fc220d11b1c88817579f8b375def65f51305fc1fc2677f06efe03d8d1fcaf15d6d13154d0e7da36e6396d55d7c8d3f6a1cd229eeac6162200b823

Download Submit
C:\Windows\system\wRgBvMO.exe

Filesize
2.2MB

MD5
5c288530c761d15d63fb78f9fed60ff8

SHA1
0f14528b0c6b2745d9f035f6d06c16fe54aa1cfe

SHA256
a5fb20e0eb414d53f8daa1f1a8cb20dfd2059c501333693370f107b4a79a08b7

SHA512
18967edb9f70fd04b934aaaaf52f40517bb5b6e31d9684d239caea9833337769e65056c5cc322fbe4cb8583dd956ce6945316e9e6dcf0ed8e3361a8b2ee1f23b

Download Submit
C:\Windows\system\yQDQFSU.exe

Filesize
2.2MB

MD5
03e6b66009bd8338f27f39cda7601bfd

SHA1
fd5ec7928226d673256c1284773ca7440c349719

SHA256
18c570343f47d88ebc5abfbcc351278f95db27f7b4639cf361172239ee385da7

SHA512
8803365099084d4f1e917fa6ed1e30c2f76c23461255519f7f47ad9d66e4f7f75d1b4283707f439d826107aa2d2826816f04d321a298098b9d851e897a7b9c43

Download Submit
\Windows\system\HDAiLtK.exe

Filesize
2.2MB

MD5
6decfdc6429557fe519f08f94ed26af1

SHA1
1cc9890c0e4232c49cdc3113986a67d302867d46

SHA256
78abb23abad770fcddb009d5b64cdbb046b6c52e220b5b455f345ba39c557f17

SHA512
215c619d84ef8371b3bd612c48d438b9d0502828a2d3e73fe6dc35a1e70517a7721625418c98c12183faa38a8dd23174a7aabcca2835df81a147bae2b4a801fb

Download Submit
\Windows\system\HwrWwEd.exe

Filesize
2.2MB

MD5
4d724cf65158f5d9f8914bbf074e8346

SHA1
5170d82f7f3dc2527c1a0294b32eaf044fb3fbc2

SHA256
083c0740f51d0ff58d54dcaae00b16a6c7be3dd69ac61ab526e7e2f5aba77c17

SHA512
d172b80f58fa801a87dbc48505fe39127478f72e734c98c1981da7ef74735a52cb37775a81a2ceb440fe5f06a68b775f1b2730e7b01f6500c7508c40bc1f7b32

Download Submit
\Windows\system\IVTVdRM.exe

Filesize
2.2MB

MD5
74af2663f616aa0cd7b951a011840b36

SHA1
1f0ca68c859fa8d7a5f2a62546e3815874116e70

SHA256
d09f29845cf72ce62d6c6b276f5cd92e56388b6ba84de6e5ec9de0809dfaddbd

SHA512
2731ecf84c9b73b55dfb65086df3730daaa845ee5d64ea562b116e04e7c9dc7bfef41c73552a44c9753bd1eefe9d77e19ad798a3f7d6797850cdbd88dc922476

Download Submit
\Windows\system\NJIIpET.exe

Filesize
2.2MB

MD5
c4d72a476ce43420d7e14493214e0fcd

SHA1
d2583be4dc3699ffa5d007b997d4ebaa957e5993

SHA256
7848a20df5bd36a9010d4b663d5bd4c463481bfc17e5ca5f6d17c73a31f4c024

SHA512
3af06d51ffb1937bc806b58462ac66c5d138d19f079b5ba3f93251e68bc71fbdacfdde681002d4e7fdeb3d2f6b37080d43f35a1e24e67b6fecac1d6a83ddfbd0

Download Submit
\Windows\system\NsACeTU.exe

Filesize
2.2MB

MD5
191b6b16b308b2bc424740b4bb0614bd

SHA1
d4a1750eadc408eff16a1d817b2c2d07c9cf132e

SHA256
3e8c832c524905fc84866cccf113cc3423fc3d1266874e7137efa9bd8298f6ef

SHA512
6472ee2c7faa048c5fdea90bc481bbeca95acc69a93b7ae7660aa62153ee2d950ee6e494177e32619f23fb3c4e83ce0e1cf651cf417c555bc14f9bf21ce9801d

Download Submit
\Windows\system\OndrgIW.exe

Filesize
2.3MB

MD5
3657442d714f45fdee8973910f600001

SHA1
8324e84c1515abe80df8c531755357fb42c614a7

SHA256
71eb1283d299580270455829567d379006840d09162bfc13e766d30e5ef52ff7

SHA512
4225230a60ee8e3283c556276db936bf4eb31629c59776f7791125b4776804a7a2a632f7f6ed519715c8a7a6a209c4b42b62a23f0d89d643b00147896a5330ca

Download Submit
\Windows\system\PTLmzvG.exe

Filesize
2.3MB

MD5
18fc5c5e3d6c508f622259164afb2787

SHA1
3a402e78874bbf7e67ffe3e1b481fd1802e88de7

SHA256
169953c15f8a784d6e082f6805d2fe3c5807bd426bfb6e23f1778fe088daf9d3

SHA512
671bf2aa2acbc31fe519da6c483e46781f6bf61ff8f517e079af4b3c1d73b338a92bc103da2f97ccdbb70b1d245b580ed95e7953b522b2d7bb9c12f72743ae63

Download Submit
\Windows\system\asmYBqO.exe

Filesize
2.2MB

MD5
b0c0038829d8ffea0f3358f9212511bf

SHA1
0e7a117226a2ea6f87c0f90d79b11719e47d4e66

SHA256
a0cc00ccc2f40e531d08ee1e3b9b1419a5b8049f4395a1f227d738eb07b44960

SHA512
8321302a90d7b5c0a4cf73d04a2420cc6aca339f4c0387815f083e6b1449aa0a35b144cc4db060da64a006d2e3a6d6f8d88cc7471b1b4103b5600b2c7892345e

Download Submit
\Windows\system\bFDqiPC.exe

Filesize
2.3MB

MD5
9f5738582ac203d7f0be19111ed03143

SHA1
9fe401ed0a186aa996ec174d5e2308541655536b

SHA256
287a601ab452fc175a57d75ddbb1c279d38b3f6641e425f8443f364a857c09d6

SHA512
cfef242e63963dfb037ac460938beec3c6d2e37f2a7b603274d563b33ac6dcb7fd4cdee5ad79648822c4a8be4050d2219c5f7103ba17d4c5f5a98104dd5cd3c2

Download Submit
\Windows\system\cCiKgOB.exe

Filesize
2.2MB

MD5
58dcb98d966a9f3fa05ce131098ed879

SHA1
089c445063c9f98b1d8c74c60da858157c57b53e

SHA256
75d0bef8967cefaf9a9786c069cdd1752c1490af43b1619d094497d03d45ee34

SHA512
95d09c1eb43ebeeccec87dbe6aeb5625a2eb6ac20cb5f1fc3666e0d59458c3ceb0cc6b09aae02263d514f24f32898e36d6b8b96991a45005b1beb8cf7ab90f5b

Download Submit
\Windows\system\eEfRkVj.exe

Filesize
2.2MB

MD5
5d4b2480bf13a69cabf02725b3709fdb

SHA1
3e17644dee8a9667bbbdd7885c3f155aa2d1e39c

SHA256
0fb2babdfc73e6aa3ab61fe0ff9875ea7b2a88eb82566c9913dcf42862641cdd

SHA512
ff56d71a8eabf902139e9dbd82fbe88389c0dbda20d00eaa46fb56c76c33f3f0794451dea191a1b8286c68b08d17acf404f434dcba09be281ba3ce3c60af99f3

Download Submit
\Windows\system\kNRFlNQ.exe

Filesize
2.2MB

MD5
ac8ac981d4704c5517f82fc2188c667d

SHA1
09cdaff81b93e338f06fb5effd3608b2f87d77ba

SHA256
fbc82eda2d81ca4499bb402ed5d5cd55a87157687a38b2579e5df8b2dbfc66bb

SHA512
7974d09ff297c79e9f066c46e7c77c6fdb9b5810fff18249850817eca702097b172ed4ba0b1fc414c136fc04cf0b3a7fc2cc3600e559882f2d8af65527acb0f2

Download Submit
\Windows\system\nWhCMJO.exe

Filesize
2.3MB

MD5
0117d694ed7dfb7782742b07e79e0fbd

SHA1
83582ba243a980eff48d77a55b177cb2472fa844

SHA256
9e85d2395e0618964f1cb1ced2d319e49100ca0cfcf2a06e7504bae9f9e17dba

SHA512
daa1e80bbc8d2a84789e75c4a72c9edbb782b906667aa15ddf12867f04ced094c61d7f585104b6a8d9f25475350e184aed62031122003905cba9072a16df018f

Download Submit
\Windows\system\ndooDIr.exe

Filesize
2.3MB

MD5
46a69626e2ae156097c521b8f5e296b1

SHA1
1b5f4914145faecbdfc88c3348e1aea34faa7392

SHA256
97016d78836c0af6820a06b7bbb27d9d8067f29f9820ee1e2f5e4061d1e3dc0c

SHA512
a710a85629619f572ec1983a04230e85587d89870cf4a211ad0342bfc44a23803e2e0bb8c419dc0e971fa5886340d7f10c49805cc5f01f9eb2a888c94d370beb

Download Submit
\Windows\system\qQdrrxN.exe

Filesize
2.2MB

MD5
b798eb3d098dd6e303dceeae30feb33e

SHA1
a9378fe558033cc302fcb44f7087ca4d538e0be8

SHA256
42bbe3e2afd59ac5a84bce37b03f507fbcd36bd5396041fc52ea9c1aae39ecf1

SHA512
ef11f935efc3404f77020b05d06f64dae507c2fec9cd53015e5d111297083d28ea22bfa31bc7ddd3e122a1524638f9b8959b7bf410c8f4fa198f5949c3f381ef

Download Submit
\Windows\system\rFKSxtb.exe

Filesize
2.2MB

MD5
f7512f18125c46645e437798a4ce7042

SHA1
cad1fcaa2b7cd90c7aaeb9fe464c24945b262259

SHA256
8cf11f1926c65315a96cd15dbefa5e3db4ce6cb760db77e57da605bebcad9b1a

SHA512
b351dde37008855250b2764ab5f25bf9aecf5eae70e8a6304299ef0751e3327a7584ed779756f643a4cf2357cc968753aa53e62e3692018286c3aad6db9397ae

Download Submit
\Windows\system\wvDJpUe.exe

Filesize
2.2MB

MD5
5ee11a33b56d95b9779f59ac2364ed60

SHA1
8b56b349f8e38f100eef901c3e68b6251c2c9443

SHA256
3c2c5598780d0982cd91add4704240a756c25c1e414093b65d83f856a7b1abeb

SHA512
f6fdc26be6724213648f3b3530a4b757e11bbc20a4169a2f6918f2b39ac127e8233b699cec425c2e697509a4b09557107f9137de4a406a6898ddd8af26c434eb

Download Submit
\Windows\system\xLedjIY.exe

Filesize
2.2MB

MD5
9f61eb522d8a0e0bdf3dc155200e1736

SHA1
fa26f2036007ade8982fd84f6a5d6257ef97c750

SHA256
51d049a2177161c3d021c946fedfcb31a3227f471c334af291e30289467cacab

SHA512
a635d479d725095fad2396d81d312f54364cbc1b8ba29879ab22704d44b9a3d12e63f74f362d7d31f83203620b2adeae437fbad2e3ec06ea82b6e49710f20ae2

Download Submit
\Windows\system\zZMmWDh.exe

Filesize
2.2MB

MD5
a0807bdaa9e36d31dd8e0fb9f365711f

SHA1
b549a4285ed736b52e2de3ecb5d5f1ad21444216

SHA256
786f85194d918c327acb212f078335c9789c23cf3d18deeeca2199dbf80ed9d1

SHA512
8a1bdcc9a3a6dce34979f9a134a3d7e467162bebd7d735ca760b980331c92348bc896cce3e046c168754ec52c988c66ffd0031a650a929434741d1018e28d7b3

Download Submit
memory/1264-56-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/1624-69-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/1636-66-0x000007FEF5320000-0x000007FEF5CBD000-memory.dmp

Filesize
9.6MB

Download
memory/1636-28-0x0000000002C70000-0x0000000002CF0000-memory.dmp

Filesize
512KB

Download
memory/1636-347-0x000007FEF5320000-0x000007FEF5CBD000-memory.dmp

Filesize
9.6MB

Download
memory/1636-35-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/1636-55-0x0000000002C70000-0x0000000002CF0000-memory.dmp

Filesize
512KB

Download
memory/1636-54-0x000007FEF5320000-0x000007FEF5CBD000-memory.dmp

Filesize
9.6MB

Download
memory/1636-30-0x000000001B770000-0x000000001BA52000-memory.dmp

Filesize
2.9MB

Download
memory/1636-67-0x0000000002C70000-0x0000000002CF0000-memory.dmp

Filesize
512KB

Download
memory/1652-18-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2260-59-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-62-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2608-64-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-19-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-78-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-0-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2972-80-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-65-0x00000000035B0000-0x00000000039A2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-61-0x00000000035B0000-0x00000000039A2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-57-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-74-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-20-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/2972-15-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2972-68-0x00000000035B0000-0x00000000039A2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-26-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-3889-0x00000000035B0000-0x00000000039A2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-63-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2972-1703-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2972-3259-0x00000000035B0000-0x00000000039A2000-memory.dmp

Filesize
3.9MB

Download
memory/3064-27-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download