xmrig | 6d3e501fdb875b9a4a8bf1b4258989a0ebe5717ad265546686a05cf53e0fb80a

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
Size

1.8MB
MD5

06393c08557a83d13a6b9bc2f34030d1
SHA1

115abec09c319c6541f19fd324c6c1f5e4066683
SHA256

6d3e501fdb875b9a4a8bf1b4258989a0ebe5717ad265546686a05cf53e0fb80a
SHA512

cf773d7080e56e1c6bc1d7b55ef551e766fbb524788fb8f1dc7e4a5afb57741098d8e9d6e08926ee9784deb0a1e7c94733c325f4dfbc6f7ab3f822c8cdcf2a21
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl6S:NABO

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/2516-149-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2412-147-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2508-145-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/1368-144-0x0000000002D00000-0x00000000030F2000-memory.dmp	xmrig
behavioral1/memory/2872-143-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2732-141-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2908-139-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2520-136-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig
behavioral1/memory/2508-1815-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/2516-2247-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2908-2263-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2520-2252-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig
behavioral1/memory/2932-2267-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2872-2438-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2412-2437-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2732-2387-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2744-2571-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2744	oCZwolA.exe
2932	HJuzDbG.exe
2520	UayNNsI.exe
2908	KzpfITm.exe
2732	MUBFFny.exe
2872	UiYQfWv.exe
2508	WbQHVVW.exe
2412	CdZtqDa.exe
2516	GpRrudG.exe
2904	uCnlROX.exe
752	FIHvRMI.exe
1476	kZrhbTt.exe
1304	LwYSBiS.exe
1660	bkjxreH.exe
840	WMIvQIF.exe
1692	WcupcAl.exe
2464	RVZsild.exe
2600	MRJRkur.exe
1080	MWWBaKd.exe
1092	BSUBUwv.exe
1172	luchdiK.exe
1176	REfYjAF.exe
2236	IcwVsgb.exe
2216	LxMcRVR.exe
1180	ujjZHRL.exe
1764	vOOjSPA.exe
2976	NaImHJM.exe
528	BMHwzKM.exe
324	UbOPDME.exe
2928	tajiKlY.exe
628	fmNsqss.exe
2964	jmUEJor.exe
400	hTyPNPu.exe
3056	KMrbyIJ.exe
1564	JssIBYS.exe
2332	LvwLUKP.exe
340	HUSclSk.exe
1252	FNvcSIp.exe
2136	TZfJvqx.exe
2788	bTeLqSP.exe
1828	YrjEACK.exe
2868	qsplaty.exe
1676	YNhXwMp.exe
608	fBFTwCG.exe
568	BJQtOYx.exe
2116	JOKkCMO.exe
2100	uVCtctn.exe
3036	VTIdsjO.exe
1000	YLycpjA.exe
1212	BNiLcxv.exe
2032	YBKccOS.exe
1872	uFkZmbp.exe
2796	wTNnlgJ.exe
2480	FZlSrKg.exe
2684	XKzjHij.exe
1616	yuiuheB.exe
2488	onydZiu.exe
2656	HpGSjIv.exe
2548	soWBinh.exe
2420	RqUtfVH.exe
2396	PcxJlxh.exe
2408	hIGnPYY.exe
2472	tAGUYZm.exe
2348	sLnGbLW.exe

Loads dropped DLL 64 IoCs

pid	Process
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1368-0-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/files/0x000b0000000155e2-3.dat	upx
behavioral1/memory/1368-5-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/files/0x0024000000015c23-11.dat	upx
behavioral1/memory/2932-13-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/files/0x0008000000015c5d-23.dat	upx
behavioral1/files/0x000f0000000006fd-28.dat	upx
behavioral1/files/0x0007000000015c87-37.dat	upx
behavioral1/files/0x000500000001868c-47.dat	upx
behavioral1/files/0x0005000000018698-52.dat	upx
behavioral1/files/0x00050000000186a0-57.dat	upx
behavioral1/files/0x0006000000018ae2-62.dat	upx
behavioral1/files/0x0006000000018ae8-67.dat	upx
behavioral1/files/0x0006000000018b15-72.dat	upx
behavioral1/files/0x0006000000018b33-77.dat	upx
behavioral1/files/0x0006000000018b42-87.dat	upx
behavioral1/files/0x0006000000018b73-100.dat	upx
behavioral1/files/0x0006000000018b96-107.dat	upx
behavioral1/files/0x0006000000018d06-117.dat	upx
behavioral1/files/0x00050000000192f4-127.dat	upx
behavioral1/memory/2516-149-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2412-147-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/files/0x000500000001939b-170.dat	upx
behavioral1/files/0x000500000001946b-185.dat	upx
behavioral1/files/0x0005000000019410-180.dat	upx
behavioral1/files/0x00050000000193b0-175.dat	upx
behavioral1/files/0x0005000000019377-165.dat	upx
behavioral1/files/0x0005000000019368-160.dat	upx
behavioral1/files/0x0005000000019333-155.dat	upx
behavioral1/memory/2508-145-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/memory/2872-143-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2732-141-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/2908-139-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2520-136-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/files/0x000500000001931b-131.dat	upx
behavioral1/files/0x00050000000192c9-122.dat	upx
behavioral1/files/0x0006000000018ba2-112.dat	upx
behavioral1/files/0x0006000000018b6a-97.dat	upx
behavioral1/files/0x0006000000018b4a-92.dat	upx
behavioral1/files/0x0006000000018b37-82.dat	upx
behavioral1/files/0x0009000000015d88-42.dat	upx
behavioral1/files/0x0008000000015c7c-33.dat	upx
behavioral1/memory/2508-1815-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/memory/2516-2247-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2908-2263-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2520-2252-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/memory/2932-2267-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/memory/2872-2438-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2412-2437-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2732-2387-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/2744-2571-0x000000013F430000-0x000000013F822000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ukogUZm.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\HpGSjIv.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\qFiYRlb.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\nmYHJlc.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\rpzeIAc.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\GWUymgN.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\qwTPvcp.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\meHNVas.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\CXtkvlh.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\THhTQti.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\iQnZpmM.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\ymfjzhU.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\HueiVhF.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\GUazTxh.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\bKtHcrT.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\NSybNmb.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\VFiwmXJ.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\ezTcGqi.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\UpCWtHw.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\zJufvUk.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\SKNbJht.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\xmyeRUo.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\WJjrXIt.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\mISHdCY.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\sOapbyx.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\HLdLzwC.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\TiFoTXB.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\RfiAHQk.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\OKmqmAK.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\RUNyHCH.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\BXzmKwG.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\lAjcJuA.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\XCzczvM.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\TEAxIhX.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\lMZbxzl.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\bMpJkVP.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\NslJqzP.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\PgXkNuQ.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\ertrBgC.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\pxvgfqy.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\QuZkqMm.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\IaesJsi.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\zLjmWYk.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\wiDWJMp.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\IDiJIEW.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\ujpnVni.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\HJuzDbG.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\iCgIHly.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\iXkOvQc.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\nnPDIZV.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\HbbgCpa.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\uuACcOB.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\jhBshWp.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\ZHxyyoT.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\luchdiK.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\ZprjMMx.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\XYcycJT.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\klDnjWD.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\JGQORDI.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\aGUpiJx.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\OXBPspz.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\RgErEaH.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\LwYSBiS.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
File created	C:\Windows\System\gAmMgQT.exe	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2276	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
Token: SeDebugPrivilege	2276	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2276	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	29
PID 1368 wrote to memory of 2276	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	29
PID 1368 wrote to memory of 2276	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	29
PID 1368 wrote to memory of 2744	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	30
PID 1368 wrote to memory of 2744	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	30
PID 1368 wrote to memory of 2744	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	30
PID 1368 wrote to memory of 2932	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	31
PID 1368 wrote to memory of 2932	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	31
PID 1368 wrote to memory of 2932	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	31
PID 1368 wrote to memory of 2520	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	32
PID 1368 wrote to memory of 2520	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	32
PID 1368 wrote to memory of 2520	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	32
PID 1368 wrote to memory of 2908	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	33
PID 1368 wrote to memory of 2908	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	33
PID 1368 wrote to memory of 2908	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	33
PID 1368 wrote to memory of 2732	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	34
PID 1368 wrote to memory of 2732	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	34
PID 1368 wrote to memory of 2732	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	34
PID 1368 wrote to memory of 2872	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	35
PID 1368 wrote to memory of 2872	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	35
PID 1368 wrote to memory of 2872	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	35
PID 1368 wrote to memory of 2508	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	36
PID 1368 wrote to memory of 2508	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	36
PID 1368 wrote to memory of 2508	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	36
PID 1368 wrote to memory of 2412	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	37
PID 1368 wrote to memory of 2412	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	37
PID 1368 wrote to memory of 2412	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	37
PID 1368 wrote to memory of 2516	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	38
PID 1368 wrote to memory of 2516	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	38
PID 1368 wrote to memory of 2516	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	38
PID 1368 wrote to memory of 2904	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	39
PID 1368 wrote to memory of 2904	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	39
PID 1368 wrote to memory of 2904	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	39
PID 1368 wrote to memory of 752	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	40
PID 1368 wrote to memory of 752	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	40
PID 1368 wrote to memory of 752	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	40
PID 1368 wrote to memory of 1476	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	41
PID 1368 wrote to memory of 1476	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	41
PID 1368 wrote to memory of 1476	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	41
PID 1368 wrote to memory of 1304	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	42
PID 1368 wrote to memory of 1304	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	42
PID 1368 wrote to memory of 1304	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	42
PID 1368 wrote to memory of 1660	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	43
PID 1368 wrote to memory of 1660	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	43
PID 1368 wrote to memory of 1660	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	43
PID 1368 wrote to memory of 840	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	44
PID 1368 wrote to memory of 840	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	44
PID 1368 wrote to memory of 840	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	44
PID 1368 wrote to memory of 1692	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	45
PID 1368 wrote to memory of 1692	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	45
PID 1368 wrote to memory of 1692	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	45
PID 1368 wrote to memory of 2464	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	46
PID 1368 wrote to memory of 2464	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	46
PID 1368 wrote to memory of 2464	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	46
PID 1368 wrote to memory of 2600	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	47
PID 1368 wrote to memory of 2600	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	47
PID 1368 wrote to memory of 2600	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	47
PID 1368 wrote to memory of 1080	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	48
PID 1368 wrote to memory of 1080	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	48
PID 1368 wrote to memory of 1080	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	48
PID 1368 wrote to memory of 1092	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	49
PID 1368 wrote to memory of 1092	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	49
PID 1368 wrote to memory of 1092	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	49
PID 1368 wrote to memory of 1172	1368	06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06393c08557a83d13a6b9bc2f34030d1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2276
- C:\Windows\System\oCZwolA.exe
  C:\Windows\System\oCZwolA.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\HJuzDbG.exe
  C:\Windows\System\HJuzDbG.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\UayNNsI.exe
  C:\Windows\System\UayNNsI.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\KzpfITm.exe
  C:\Windows\System\KzpfITm.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\MUBFFny.exe
  C:\Windows\System\MUBFFny.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\UiYQfWv.exe
  C:\Windows\System\UiYQfWv.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\WbQHVVW.exe
  C:\Windows\System\WbQHVVW.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\CdZtqDa.exe
  C:\Windows\System\CdZtqDa.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\GpRrudG.exe
  C:\Windows\System\GpRrudG.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\uCnlROX.exe
  C:\Windows\System\uCnlROX.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\FIHvRMI.exe
  C:\Windows\System\FIHvRMI.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\kZrhbTt.exe
  C:\Windows\System\kZrhbTt.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\LwYSBiS.exe
  C:\Windows\System\LwYSBiS.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\bkjxreH.exe
  C:\Windows\System\bkjxreH.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\WMIvQIF.exe
  C:\Windows\System\WMIvQIF.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\WcupcAl.exe
  C:\Windows\System\WcupcAl.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\RVZsild.exe
  C:\Windows\System\RVZsild.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\MRJRkur.exe
  C:\Windows\System\MRJRkur.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\MWWBaKd.exe
  C:\Windows\System\MWWBaKd.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\BSUBUwv.exe
  C:\Windows\System\BSUBUwv.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\luchdiK.exe
  C:\Windows\System\luchdiK.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\REfYjAF.exe
  C:\Windows\System\REfYjAF.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\IcwVsgb.exe
  C:\Windows\System\IcwVsgb.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\LxMcRVR.exe
  C:\Windows\System\LxMcRVR.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\ujjZHRL.exe
  C:\Windows\System\ujjZHRL.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\vOOjSPA.exe
  C:\Windows\System\vOOjSPA.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\NaImHJM.exe
  C:\Windows\System\NaImHJM.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\BMHwzKM.exe
  C:\Windows\System\BMHwzKM.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\UbOPDME.exe
  C:\Windows\System\UbOPDME.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\tajiKlY.exe
  C:\Windows\System\tajiKlY.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\fmNsqss.exe
  C:\Windows\System\fmNsqss.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\jmUEJor.exe
  C:\Windows\System\jmUEJor.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\hTyPNPu.exe
  C:\Windows\System\hTyPNPu.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\KMrbyIJ.exe
  C:\Windows\System\KMrbyIJ.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\JssIBYS.exe
  C:\Windows\System\JssIBYS.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\LvwLUKP.exe
  C:\Windows\System\LvwLUKP.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\HUSclSk.exe
  C:\Windows\System\HUSclSk.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\FNvcSIp.exe
  C:\Windows\System\FNvcSIp.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\TZfJvqx.exe
  C:\Windows\System\TZfJvqx.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\bTeLqSP.exe
  C:\Windows\System\bTeLqSP.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\YrjEACK.exe
  C:\Windows\System\YrjEACK.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\qsplaty.exe
  C:\Windows\System\qsplaty.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\YNhXwMp.exe
  C:\Windows\System\YNhXwMp.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\fBFTwCG.exe
  C:\Windows\System\fBFTwCG.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\BJQtOYx.exe
  C:\Windows\System\BJQtOYx.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\JOKkCMO.exe
  C:\Windows\System\JOKkCMO.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\uVCtctn.exe
  C:\Windows\System\uVCtctn.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\VTIdsjO.exe
  C:\Windows\System\VTIdsjO.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\YLycpjA.exe
  C:\Windows\System\YLycpjA.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\BNiLcxv.exe
  C:\Windows\System\BNiLcxv.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\YBKccOS.exe
  C:\Windows\System\YBKccOS.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\uFkZmbp.exe
  C:\Windows\System\uFkZmbp.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\wTNnlgJ.exe
  C:\Windows\System\wTNnlgJ.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\FZlSrKg.exe
  C:\Windows\System\FZlSrKg.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\XKzjHij.exe
  C:\Windows\System\XKzjHij.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\yuiuheB.exe
  C:\Windows\System\yuiuheB.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\onydZiu.exe
  C:\Windows\System\onydZiu.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\HpGSjIv.exe
  C:\Windows\System\HpGSjIv.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\soWBinh.exe
  C:\Windows\System\soWBinh.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\RqUtfVH.exe
  C:\Windows\System\RqUtfVH.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\PcxJlxh.exe
  C:\Windows\System\PcxJlxh.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\hIGnPYY.exe
  C:\Windows\System\hIGnPYY.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\tAGUYZm.exe
  C:\Windows\System\tAGUYZm.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\TCWUNGh.exe
  C:\Windows\System\TCWUNGh.exe
  2⤵
  PID:556
- C:\Windows\System\sLnGbLW.exe
  C:\Windows\System\sLnGbLW.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\updQTTQ.exe
  C:\Windows\System\updQTTQ.exe
  2⤵
  PID:928
- C:\Windows\System\urJGIml.exe
  C:\Windows\System\urJGIml.exe
  2⤵
  PID:1592
- C:\Windows\System\CoLFflG.exe
  C:\Windows\System\CoLFflG.exe
  2⤵
  PID:2692
- C:\Windows\System\YkwHPVt.exe
  C:\Windows\System\YkwHPVt.exe
  2⤵
  PID:760
- C:\Windows\System\rMFxFeG.exe
  C:\Windows\System\rMFxFeG.exe
  2⤵
  PID:1936
- C:\Windows\System\BuRPvah.exe
  C:\Windows\System\BuRPvah.exe
  2⤵
  PID:2320
- C:\Windows\System\yzHehEn.exe
  C:\Windows\System\yzHehEn.exe
  2⤵
  PID:1964
- C:\Windows\System\oWRXiUA.exe
  C:\Windows\System\oWRXiUA.exe
  2⤵
  PID:2596
- C:\Windows\System\XgGkbSX.exe
  C:\Windows\System\XgGkbSX.exe
  2⤵
  PID:2816
- C:\Windows\System\dThnUAV.exe
  C:\Windows\System\dThnUAV.exe
  2⤵
  PID:2284
- C:\Windows\System\SYDuTxA.exe
  C:\Windows\System\SYDuTxA.exe
  2⤵
  PID:700
- C:\Windows\System\rjxPOAU.exe
  C:\Windows\System\rjxPOAU.exe
  2⤵
  PID:2996
- C:\Windows\System\RFVCtrU.exe
  C:\Windows\System\RFVCtrU.exe
  2⤵
  PID:1628
- C:\Windows\System\FIBPGkd.exe
  C:\Windows\System\FIBPGkd.exe
  2⤵
  PID:2988
- C:\Windows\System\JHqwGsk.exe
  C:\Windows\System\JHqwGsk.exe
  2⤵
  PID:1376
- C:\Windows\System\HbbgCpa.exe
  C:\Windows\System\HbbgCpa.exe
  2⤵
  PID:976
- C:\Windows\System\sfuZEEr.exe
  C:\Windows\System\sfuZEEr.exe
  2⤵
  PID:1624
- C:\Windows\System\piOLmZy.exe
  C:\Windows\System\piOLmZy.exe
  2⤵
  PID:1560
- C:\Windows\System\qvdgdGc.exe
  C:\Windows\System\qvdgdGc.exe
  2⤵
  PID:1620
- C:\Windows\System\EfRxJxZ.exe
  C:\Windows\System\EfRxJxZ.exe
  2⤵
  PID:2824
- C:\Windows\System\vTpvZCr.exe
  C:\Windows\System\vTpvZCr.exe
  2⤵
  PID:1544
- C:\Windows\System\NReMAvu.exe
  C:\Windows\System\NReMAvu.exe
  2⤵
  PID:972
- C:\Windows\System\EweVkkI.exe
  C:\Windows\System\EweVkkI.exe
  2⤵
  PID:2080
- C:\Windows\System\LGAAdnN.exe
  C:\Windows\System\LGAAdnN.exe
  2⤵
  PID:780
- C:\Windows\System\mDEOUCG.exe
  C:\Windows\System\mDEOUCG.exe
  2⤵
  PID:1988
- C:\Windows\System\PMaDPQs.exe
  C:\Windows\System\PMaDPQs.exe
  2⤵
  PID:2052
- C:\Windows\System\LZFoYai.exe
  C:\Windows\System\LZFoYai.exe
  2⤵
  PID:2856
- C:\Windows\System\EnFHshM.exe
  C:\Windows\System\EnFHshM.exe
  2⤵
  PID:1584
- C:\Windows\System\WJjrXIt.exe
  C:\Windows\System\WJjrXIt.exe
  2⤵
  PID:1348
- C:\Windows\System\pzSmNGn.exe
  C:\Windows\System\pzSmNGn.exe
  2⤵
  PID:2652
- C:\Windows\System\uBVVpdL.exe
  C:\Windows\System\uBVVpdL.exe
  2⤵
  PID:2484
- C:\Windows\System\LITzgnN.exe
  C:\Windows\System\LITzgnN.exe
  2⤵
  PID:2440
- C:\Windows\System\lieAnbw.exe
  C:\Windows\System\lieAnbw.exe
  2⤵
  PID:2468
- C:\Windows\System\uWgZJVV.exe
  C:\Windows\System\uWgZJVV.exe
  2⤵
  PID:2444
- C:\Windows\System\VZWoyuz.exe
  C:\Windows\System\VZWoyuz.exe
  2⤵
  PID:2604
- C:\Windows\System\ocbspUK.exe
  C:\Windows\System\ocbspUK.exe
  2⤵
  PID:1272
- C:\Windows\System\zHfzPpg.exe
  C:\Windows\System\zHfzPpg.exe
  2⤵
  PID:2188
- C:\Windows\System\DyZdGJy.exe
  C:\Windows\System\DyZdGJy.exe
  2⤵
  PID:1704
- C:\Windows\System\GahlFVy.exe
  C:\Windows\System\GahlFVy.exe
  2⤵
  PID:2148
- C:\Windows\System\jKQouIN.exe
  C:\Windows\System\jKQouIN.exe
  2⤵
  PID:2340
- C:\Windows\System\RxpSDWM.exe
  C:\Windows\System\RxpSDWM.exe
  2⤵
  PID:1088
- C:\Windows\System\BIJJywJ.exe
  C:\Windows\System\BIJJywJ.exe
  2⤵
  PID:3044
- C:\Windows\System\CyaBGfj.exe
  C:\Windows\System\CyaBGfj.exe
  2⤵
  PID:380
- C:\Windows\System\tRQWZIE.exe
  C:\Windows\System\tRQWZIE.exe
  2⤵
  PID:1052
- C:\Windows\System\PUWLGQN.exe
  C:\Windows\System\PUWLGQN.exe
  2⤵
  PID:3068
- C:\Windows\System\UtuAiKz.exe
  C:\Windows\System\UtuAiKz.exe
  2⤵
  PID:1824
- C:\Windows\System\ilSKMHg.exe
  C:\Windows\System\ilSKMHg.exe
  2⤵
  PID:1792
- C:\Windows\System\ZprjMMx.exe
  C:\Windows\System\ZprjMMx.exe
  2⤵
  PID:2808
- C:\Windows\System\FsbLIGp.exe
  C:\Windows\System\FsbLIGp.exe
  2⤵
  PID:1224
- C:\Windows\System\YuWlUrM.exe
  C:\Windows\System\YuWlUrM.exe
  2⤵
  PID:1508
- C:\Windows\System\NOkmDrO.exe
  C:\Windows\System\NOkmDrO.exe
  2⤵
  PID:1344
- C:\Windows\System\pEIJPoX.exe
  C:\Windows\System\pEIJPoX.exe
  2⤵
  PID:2248
- C:\Windows\System\RkiMdtm.exe
  C:\Windows\System\RkiMdtm.exe
  2⤵
  PID:2040
- C:\Windows\System\itGLdhg.exe
  C:\Windows\System\itGLdhg.exe
  2⤵
  PID:2784
- C:\Windows\System\KjwusvR.exe
  C:\Windows\System\KjwusvR.exe
  2⤵
  PID:1756
- C:\Windows\System\WIERdkl.exe
  C:\Windows\System\WIERdkl.exe
  2⤵
  PID:1512
- C:\Windows\System\zJufvUk.exe
  C:\Windows\System\zJufvUk.exe
  2⤵
  PID:1612
- C:\Windows\System\TNeTgSw.exe
  C:\Windows\System\TNeTgSw.exe
  2⤵
  PID:2556
- C:\Windows\System\XxjeKhU.exe
  C:\Windows\System\XxjeKhU.exe
  2⤵
  PID:2612
- C:\Windows\System\vRtdHwe.exe
  C:\Windows\System\vRtdHwe.exe
  2⤵
  PID:1748
- C:\Windows\System\jVnINTr.exe
  C:\Windows\System\jVnINTr.exe
  2⤵
  PID:2460
- C:\Windows\System\BhiFSwS.exe
  C:\Windows\System\BhiFSwS.exe
  2⤵
  PID:800
- C:\Windows\System\spdPzvN.exe
  C:\Windows\System\spdPzvN.exe
  2⤵
  PID:1116
- C:\Windows\System\kBDehIZ.exe
  C:\Windows\System\kBDehIZ.exe
  2⤵
  PID:2688
- C:\Windows\System\cEYVpYB.exe
  C:\Windows\System\cEYVpYB.exe
  2⤵
  PID:1712
- C:\Windows\System\LKJOcld.exe
  C:\Windows\System\LKJOcld.exe
  2⤵
  PID:2004
- C:\Windows\System\LPocorC.exe
  C:\Windows\System\LPocorC.exe
  2⤵
  PID:1700
- C:\Windows\System\KzKNJLj.exe
  C:\Windows\System\KzKNJLj.exe
  2⤵
  PID:2676
- C:\Windows\System\snhrBhF.exe
  C:\Windows\System\snhrBhF.exe
  2⤵
  PID:1012
- C:\Windows\System\pVAgUpc.exe
  C:\Windows\System\pVAgUpc.exe
  2⤵
  PID:2924
- C:\Windows\System\dfGbeJr.exe
  C:\Windows\System\dfGbeJr.exe
  2⤵
  PID:912
- C:\Windows\System\XvPADSu.exe
  C:\Windows\System\XvPADSu.exe
  2⤵
  PID:2016
- C:\Windows\System\gUIbSDQ.exe
  C:\Windows\System\gUIbSDQ.exe
  2⤵
  PID:1200
- C:\Windows\System\klLDRAV.exe
  C:\Windows\System\klLDRAV.exe
  2⤵
  PID:2616
- C:\Windows\System\SztdSNq.exe
  C:\Windows\System\SztdSNq.exe
  2⤵
  PID:2780
- C:\Windows\System\mISHdCY.exe
  C:\Windows\System\mISHdCY.exe
  2⤵
  PID:3048
- C:\Windows\System\opeNLWy.exe
  C:\Windows\System\opeNLWy.exe
  2⤵
  PID:2300
- C:\Windows\System\usdMgPp.exe
  C:\Windows\System\usdMgPp.exe
  2⤵
  PID:576
- C:\Windows\System\gwZzBlW.exe
  C:\Windows\System\gwZzBlW.exe
  2⤵
  PID:2716
- C:\Windows\System\JGQORDI.exe
  C:\Windows\System\JGQORDI.exe
  2⤵
  PID:1996
- C:\Windows\System\rAcQpbZ.exe
  C:\Windows\System\rAcQpbZ.exe
  2⤵
  PID:2580
- C:\Windows\System\ZFuIbEx.exe
  C:\Windows\System\ZFuIbEx.exe
  2⤵
  PID:2228
- C:\Windows\System\zsFvanp.exe
  C:\Windows\System\zsFvanp.exe
  2⤵
  PID:2196
- C:\Windows\System\KbudCkj.exe
  C:\Windows\System\KbudCkj.exe
  2⤵
  PID:2708
- C:\Windows\System\LXJcTad.exe
  C:\Windows\System\LXJcTad.exe
  2⤵
  PID:3080
- C:\Windows\System\FmHQmNd.exe
  C:\Windows\System\FmHQmNd.exe
  2⤵
  PID:3096
- C:\Windows\System\IeAxLPe.exe
  C:\Windows\System\IeAxLPe.exe
  2⤵
  PID:3112
- C:\Windows\System\ihPlnkb.exe
  C:\Windows\System\ihPlnkb.exe
  2⤵
  PID:3132
- C:\Windows\System\smGBjah.exe
  C:\Windows\System\smGBjah.exe
  2⤵
  PID:3188
- C:\Windows\System\rZcGsLu.exe
  C:\Windows\System\rZcGsLu.exe
  2⤵
  PID:3204
- C:\Windows\System\SKNbJht.exe
  C:\Windows\System\SKNbJht.exe
  2⤵
  PID:3220
- C:\Windows\System\QCtPeiy.exe
  C:\Windows\System\QCtPeiy.exe
  2⤵
  PID:3236
- C:\Windows\System\EglGjmP.exe
  C:\Windows\System\EglGjmP.exe
  2⤵
  PID:3252
- C:\Windows\System\gASNDzS.exe
  C:\Windows\System\gASNDzS.exe
  2⤵
  PID:3272
- C:\Windows\System\dHvhbGG.exe
  C:\Windows\System\dHvhbGG.exe
  2⤵
  PID:3288
- C:\Windows\System\SCCGhxT.exe
  C:\Windows\System\SCCGhxT.exe
  2⤵
  PID:3304
- C:\Windows\System\HiBUdmO.exe
  C:\Windows\System\HiBUdmO.exe
  2⤵
  PID:3320
- C:\Windows\System\bWvJhSN.exe
  C:\Windows\System\bWvJhSN.exe
  2⤵
  PID:3340
- C:\Windows\System\xUiCPEH.exe
  C:\Windows\System\xUiCPEH.exe
  2⤵
  PID:3360
- C:\Windows\System\MzfMjHn.exe
  C:\Windows\System\MzfMjHn.exe
  2⤵
  PID:3376
- C:\Windows\System\XuyIEpo.exe
  C:\Windows\System\XuyIEpo.exe
  2⤵
  PID:3392
- C:\Windows\System\vrZbFcX.exe
  C:\Windows\System\vrZbFcX.exe
  2⤵
  PID:3408
- C:\Windows\System\VHLiaAT.exe
  C:\Windows\System\VHLiaAT.exe
  2⤵
  PID:3424
- C:\Windows\System\CNGjEuZ.exe
  C:\Windows\System\CNGjEuZ.exe
  2⤵
  PID:3444
- C:\Windows\System\zhhHUHN.exe
  C:\Windows\System\zhhHUHN.exe
  2⤵
  PID:3460
- C:\Windows\System\xmyeRUo.exe
  C:\Windows\System\xmyeRUo.exe
  2⤵
  PID:3476
- C:\Windows\System\CXidqDX.exe
  C:\Windows\System\CXidqDX.exe
  2⤵
  PID:3552
- C:\Windows\System\jglDsiJ.exe
  C:\Windows\System\jglDsiJ.exe
  2⤵
  PID:3568
- C:\Windows\System\uAPjard.exe
  C:\Windows\System\uAPjard.exe
  2⤵
  PID:3584
- C:\Windows\System\jOYcrCT.exe
  C:\Windows\System\jOYcrCT.exe
  2⤵
  PID:3604
- C:\Windows\System\zVHulEV.exe
  C:\Windows\System\zVHulEV.exe
  2⤵
  PID:3620
- C:\Windows\System\asaUrUr.exe
  C:\Windows\System\asaUrUr.exe
  2⤵
  PID:3652
- C:\Windows\System\rKJGmQY.exe
  C:\Windows\System\rKJGmQY.exe
  2⤵
  PID:3668
- C:\Windows\System\QaLeykN.exe
  C:\Windows\System\QaLeykN.exe
  2⤵
  PID:3684
- C:\Windows\System\lMTkmxf.exe
  C:\Windows\System\lMTkmxf.exe
  2⤵
  PID:3704
- C:\Windows\System\djzbjrA.exe
  C:\Windows\System\djzbjrA.exe
  2⤵
  PID:3744
- C:\Windows\System\zoeXWiM.exe
  C:\Windows\System\zoeXWiM.exe
  2⤵
  PID:3760
- C:\Windows\System\RYIMNGR.exe
  C:\Windows\System\RYIMNGR.exe
  2⤵
  PID:3776
- C:\Windows\System\xiuyQxz.exe
  C:\Windows\System\xiuyQxz.exe
  2⤵
  PID:3792
- C:\Windows\System\pVZmoYZ.exe
  C:\Windows\System\pVZmoYZ.exe
  2⤵
  PID:3808
- C:\Windows\System\bjzkNgC.exe
  C:\Windows\System\bjzkNgC.exe
  2⤵
  PID:3828
- C:\Windows\System\ZaqVsum.exe
  C:\Windows\System\ZaqVsum.exe
  2⤵
  PID:3848
- C:\Windows\System\rATJNfh.exe
  C:\Windows\System\rATJNfh.exe
  2⤵
  PID:3864
- C:\Windows\System\DqNsdns.exe
  C:\Windows\System\DqNsdns.exe
  2⤵
  PID:3880
- C:\Windows\System\euuEHsz.exe
  C:\Windows\System\euuEHsz.exe
  2⤵
  PID:3900
- C:\Windows\System\bTJrcyB.exe
  C:\Windows\System\bTJrcyB.exe
  2⤵
  PID:3952
- C:\Windows\System\ACJlDdG.exe
  C:\Windows\System\ACJlDdG.exe
  2⤵
  PID:3968
- C:\Windows\System\ljMjGjH.exe
  C:\Windows\System\ljMjGjH.exe
  2⤵
  PID:3984
- C:\Windows\System\RFDhHGQ.exe
  C:\Windows\System\RFDhHGQ.exe
  2⤵
  PID:4000
- C:\Windows\System\fvAGdAj.exe
  C:\Windows\System\fvAGdAj.exe
  2⤵
  PID:4016
- C:\Windows\System\tubdFuO.exe
  C:\Windows\System\tubdFuO.exe
  2⤵
  PID:4036
- C:\Windows\System\kBdvFaS.exe
  C:\Windows\System\kBdvFaS.exe
  2⤵
  PID:4052
- C:\Windows\System\mWjXtWU.exe
  C:\Windows\System\mWjXtWU.exe
  2⤵
  PID:4068
- C:\Windows\System\GNtrQPs.exe
  C:\Windows\System\GNtrQPs.exe
  2⤵
  PID:2372
- C:\Windows\System\TiFoTXB.exe
  C:\Windows\System\TiFoTXB.exe
  2⤵
  PID:2068
- C:\Windows\System\UYmXKXb.exe
  C:\Windows\System\UYmXKXb.exe
  2⤵
  PID:1588
- C:\Windows\System\zPKKaIH.exe
  C:\Windows\System\zPKKaIH.exe
  2⤵
  PID:3076
- C:\Windows\System\SKlTvpT.exe
  C:\Windows\System\SKlTvpT.exe
  2⤵
  PID:3148
- C:\Windows\System\XLtFVEF.exe
  C:\Windows\System\XLtFVEF.exe
  2⤵
  PID:1644
- C:\Windows\System\wsOcdWi.exe
  C:\Windows\System\wsOcdWi.exe
  2⤵
  PID:2720
- C:\Windows\System\AztqtUf.exe
  C:\Windows\System\AztqtUf.exe
  2⤵
  PID:3156
- C:\Windows\System\MFmDYAx.exe
  C:\Windows\System\MFmDYAx.exe
  2⤵
  PID:2224
- C:\Windows\System\KQthRyu.exe
  C:\Windows\System\KQthRyu.exe
  2⤵
  PID:1916
- C:\Windows\System\VNmRXoF.exe
  C:\Windows\System\VNmRXoF.exe
  2⤵
  PID:3164
- C:\Windows\System\RvXgXnF.exe
  C:\Windows\System\RvXgXnF.exe
  2⤵
  PID:548
- C:\Windows\System\kGXBtsP.exe
  C:\Windows\System\kGXBtsP.exe
  2⤵
  PID:2840
- C:\Windows\System\BSKxtSO.exe
  C:\Windows\System\BSKxtSO.exe
  2⤵
  PID:2696
- C:\Windows\System\wxDMQZz.exe
  C:\Windows\System\wxDMQZz.exe
  2⤵
  PID:3000
- C:\Windows\System\jjYqwxX.exe
  C:\Windows\System\jjYqwxX.exe
  2⤵
  PID:2220
- C:\Windows\System\pkqHgxM.exe
  C:\Windows\System\pkqHgxM.exe
  2⤵
  PID:3092
- C:\Windows\System\LLewnfp.exe
  C:\Windows\System\LLewnfp.exe
  2⤵
  PID:3280
- C:\Windows\System\tdIEIfM.exe
  C:\Windows\System\tdIEIfM.exe
  2⤵
  PID:3348
- C:\Windows\System\JAwLQmj.exe
  C:\Windows\System\JAwLQmj.exe
  2⤵
  PID:3388
- C:\Windows\System\XUviGnf.exe
  C:\Windows\System\XUviGnf.exe
  2⤵
  PID:3484
- C:\Windows\System\OAHGhzE.exe
  C:\Windows\System\OAHGhzE.exe
  2⤵
  PID:3504
- C:\Windows\System\HEcKJfe.exe
  C:\Windows\System\HEcKJfe.exe
  2⤵
  PID:3520
- C:\Windows\System\vXSKaXU.exe
  C:\Windows\System\vXSKaXU.exe
  2⤵
  PID:2252
- C:\Windows\System\QWQeoiu.exe
  C:\Windows\System\QWQeoiu.exe
  2⤵
  PID:3128
- C:\Windows\System\CYYiphK.exe
  C:\Windows\System\CYYiphK.exe
  2⤵
  PID:3232
- C:\Windows\System\elfuOOm.exe
  C:\Windows\System\elfuOOm.exe
  2⤵
  PID:3528
- C:\Windows\System\UNcckGO.exe
  C:\Windows\System\UNcckGO.exe
  2⤵
  PID:3328
- C:\Windows\System\HNnwTAM.exe
  C:\Windows\System\HNnwTAM.exe
  2⤵
  PID:3544
- C:\Windows\System\yPwhrFr.exe
  C:\Windows\System\yPwhrFr.exe
  2⤵
  PID:3612
- C:\Windows\System\zQcLNit.exe
  C:\Windows\System\zQcLNit.exe
  2⤵
  PID:3696
- C:\Windows\System\LiPfTgj.exe
  C:\Windows\System\LiPfTgj.exe
  2⤵
  PID:3368
- C:\Windows\System\ctvnfNN.exe
  C:\Windows\System\ctvnfNN.exe
  2⤵
  PID:3436
- C:\Windows\System\jfCyYVm.exe
  C:\Windows\System\jfCyYVm.exe
  2⤵
  PID:3564
- C:\Windows\System\zpPOdKt.exe
  C:\Windows\System\zpPOdKt.exe
  2⤵
  PID:3644
- C:\Windows\System\gHGXLAz.exe
  C:\Windows\System\gHGXLAz.exe
  2⤵
  PID:3680
- C:\Windows\System\tqeEaOl.exe
  C:\Windows\System\tqeEaOl.exe
  2⤵
  PID:3728
- C:\Windows\System\HNfKOpw.exe
  C:\Windows\System\HNfKOpw.exe
  2⤵
  PID:3740
- C:\Windows\System\xVarYPE.exe
  C:\Windows\System\xVarYPE.exe
  2⤵
  PID:3836
- C:\Windows\System\DTzIQIJ.exe
  C:\Windows\System\DTzIQIJ.exe
  2⤵
  PID:3820
- C:\Windows\System\cfRlHxI.exe
  C:\Windows\System\cfRlHxI.exe
  2⤵
  PID:3892
- C:\Windows\System\aBFXsiY.exe
  C:\Windows\System\aBFXsiY.exe
  2⤵
  PID:3924
- C:\Windows\System\wgXacOc.exe
  C:\Windows\System\wgXacOc.exe
  2⤵
  PID:3876
- C:\Windows\System\pGQhoSd.exe
  C:\Windows\System\pGQhoSd.exe
  2⤵
  PID:3940
- C:\Windows\System\SBvnRWP.exe
  C:\Windows\System\SBvnRWP.exe
  2⤵
  PID:3912
- C:\Windows\System\meHNVas.exe
  C:\Windows\System\meHNVas.exe
  2⤵
  PID:3964
- C:\Windows\System\jBaQQIv.exe
  C:\Windows\System\jBaQQIv.exe
  2⤵
  PID:3980
- C:\Windows\System\GpHFPnS.exe
  C:\Windows\System\GpHFPnS.exe
  2⤵
  PID:4060
- C:\Windows\System\KNoDxam.exe
  C:\Windows\System\KNoDxam.exe
  2⤵
  PID:4080
- C:\Windows\System\ogYtdnQ.exe
  C:\Windows\System\ogYtdnQ.exe
  2⤵
  PID:3104
- C:\Windows\System\aTvKXfp.exe
  C:\Windows\System\aTvKXfp.exe
  2⤵
  PID:672
- C:\Windows\System\yIvYItX.exe
  C:\Windows\System\yIvYItX.exe
  2⤵
  PID:3172
- C:\Windows\System\qgvasyJ.exe
  C:\Windows\System\qgvasyJ.exe
  2⤵
  PID:1572
- C:\Windows\System\vQCOGYa.exe
  C:\Windows\System\vQCOGYa.exe
  2⤵
  PID:3184
- C:\Windows\System\lFwjpft.exe
  C:\Windows\System\lFwjpft.exe
  2⤵
  PID:824
- C:\Windows\System\ZQkJTwX.exe
  C:\Windows\System\ZQkJTwX.exe
  2⤵
  PID:3384
- C:\Windows\System\WqeTFyh.exe
  C:\Windows\System\WqeTFyh.exe
  2⤵
  PID:1760
- C:\Windows\System\XmFXMQx.exe
  C:\Windows\System\XmFXMQx.exe
  2⤵
  PID:3088
- C:\Windows\System\gSguqNm.exe
  C:\Windows\System\gSguqNm.exe
  2⤵
  PID:3456
- C:\Windows\System\OxiRrod.exe
  C:\Windows\System\OxiRrod.exe
  2⤵
  PID:3032
- C:\Windows\System\iQohDlz.exe
  C:\Windows\System\iQohDlz.exe
  2⤵
  PID:2900
- C:\Windows\System\IdQXNRq.exe
  C:\Windows\System\IdQXNRq.exe
  2⤵
  PID:3300
- C:\Windows\System\wqtIOWn.exe
  C:\Windows\System\wqtIOWn.exe
  2⤵
  PID:3628
- C:\Windows\System\OGvMdKw.exe
  C:\Windows\System\OGvMdKw.exe
  2⤵
  PID:3560
- C:\Windows\System\kRUnwvL.exe
  C:\Windows\System\kRUnwvL.exe
  2⤵
  PID:1068
- C:\Windows\System\sLYAtqh.exe
  C:\Windows\System\sLYAtqh.exe
  2⤵
  PID:3540
- C:\Windows\System\JGgYMjh.exe
  C:\Windows\System\JGgYMjh.exe
  2⤵
  PID:3804
- C:\Windows\System\KVhEvWR.exe
  C:\Windows\System\KVhEvWR.exe
  2⤵
  PID:4032
- C:\Windows\System\DZoOOKj.exe
  C:\Windows\System\DZoOOKj.exe
  2⤵
  PID:1960
- C:\Windows\System\UPQDeps.exe
  C:\Windows\System\UPQDeps.exe
  2⤵
  PID:2884
- C:\Windows\System\ufvcBST.exe
  C:\Windows\System\ufvcBST.exe
  2⤵
  PID:3576
- C:\Windows\System\RdKNVRt.exe
  C:\Windows\System\RdKNVRt.exe
  2⤵
  PID:3432
- C:\Windows\System\vXpfjsC.exe
  C:\Windows\System\vXpfjsC.exe
  2⤵
  PID:2380
- C:\Windows\System\fblDeMU.exe
  C:\Windows\System\fblDeMU.exe
  2⤵
  PID:3936
- C:\Windows\System\uRaLPYn.exe
  C:\Windows\System\uRaLPYn.exe
  2⤵
  PID:3860
- C:\Windows\System\DUJiKfo.exe
  C:\Windows\System\DUJiKfo.exe
  2⤵
  PID:4024
- C:\Windows\System\SqMVZQa.exe
  C:\Windows\System\SqMVZQa.exe
  2⤵
  PID:2592
- C:\Windows\System\dttEMIT.exe
  C:\Windows\System\dttEMIT.exe
  2⤵
  PID:2204
- C:\Windows\System\wOUnDJx.exe
  C:\Windows\System\wOUnDJx.exe
  2⤵
  PID:2712
- C:\Windows\System\tEsCTHi.exe
  C:\Windows\System\tEsCTHi.exe
  2⤵
  PID:3500
- C:\Windows\System\OmvaKwT.exe
  C:\Windows\System\OmvaKwT.exe
  2⤵
  PID:3948
- C:\Windows\System\laMQlsD.exe
  C:\Windows\System\laMQlsD.exe
  2⤵
  PID:3512
- C:\Windows\System\epswUOy.exe
  C:\Windows\System\epswUOy.exe
  2⤵
  PID:1652
- C:\Windows\System\lMnFlUn.exe
  C:\Windows\System\lMnFlUn.exe
  2⤵
  PID:3580
- C:\Windows\System\iWhlaIh.exe
  C:\Windows\System\iWhlaIh.exe
  2⤵
  PID:3488
- C:\Windows\System\bWfYMTX.exe
  C:\Windows\System\bWfYMTX.exe
  2⤵
  PID:3664
- C:\Windows\System\ZIsZxhE.exe
  C:\Windows\System\ZIsZxhE.exe
  2⤵
  PID:3336
- C:\Windows\System\QkAEsSG.exe
  C:\Windows\System\QkAEsSG.exe
  2⤵
  PID:1888
- C:\Windows\System\FNIddzh.exe
  C:\Windows\System\FNIddzh.exe
  2⤵
  PID:3176
- C:\Windows\System\vPmWQQA.exe
  C:\Windows\System\vPmWQQA.exe
  2⤵
  PID:1524
- C:\Windows\System\zQSXOxU.exe
  C:\Windows\System\zQSXOxU.exe
  2⤵
  PID:3944
- C:\Windows\System\IerwIHQ.exe
  C:\Windows\System\IerwIHQ.exe
  2⤵
  PID:1604
- C:\Windows\System\uznMxyF.exe
  C:\Windows\System\uznMxyF.exe
  2⤵
  PID:2376
- C:\Windows\System\gjEPKdT.exe
  C:\Windows\System\gjEPKdT.exe
  2⤵
  PID:3248
- C:\Windows\System\dLqyECl.exe
  C:\Windows\System\dLqyECl.exe
  2⤵
  PID:4076
- C:\Windows\System\xOGTihu.exe
  C:\Windows\System\xOGTihu.exe
  2⤵
  PID:392
- C:\Windows\System\XoIwsZW.exe
  C:\Windows\System\XoIwsZW.exe
  2⤵
  PID:2768
- C:\Windows\System\UOiaDmH.exe
  C:\Windows\System\UOiaDmH.exe
  2⤵
  PID:3920
- C:\Windows\System\RVCwINZ.exe
  C:\Windows\System\RVCwINZ.exe
  2⤵
  PID:2704
- C:\Windows\System\IUOvPnM.exe
  C:\Windows\System\IUOvPnM.exe
  2⤵
  PID:1388
- C:\Windows\System\DEThHHg.exe
  C:\Windows\System\DEThHHg.exe
  2⤵
  PID:3356
- C:\Windows\System\KwDxxKh.exe
  C:\Windows\System\KwDxxKh.exe
  2⤵
  PID:3756
- C:\Windows\System\mJPqhyO.exe
  C:\Windows\System\mJPqhyO.exe
  2⤵
  PID:3228
- C:\Windows\System\REJvSYg.exe
  C:\Windows\System\REJvSYg.exe
  2⤵
  PID:3636
- C:\Windows\System\lpTQaSY.exe
  C:\Windows\System\lpTQaSY.exe
  2⤵
  PID:3888
- C:\Windows\System\ROvLoEF.exe
  C:\Windows\System\ROvLoEF.exe
  2⤵
  PID:3496
- C:\Windows\System\LgXSFzq.exe
  C:\Windows\System\LgXSFzq.exe
  2⤵
  PID:2640
- C:\Windows\System\ixOMwoR.exe
  C:\Windows\System\ixOMwoR.exe
  2⤵
  PID:4100
- C:\Windows\System\weoHZtg.exe
  C:\Windows\System\weoHZtg.exe
  2⤵
  PID:4116
- C:\Windows\System\wxtebpu.exe
  C:\Windows\System\wxtebpu.exe
  2⤵
  PID:4136
- C:\Windows\System\KJRBtVM.exe
  C:\Windows\System\KJRBtVM.exe
  2⤵
  PID:4152
- C:\Windows\System\GOPjOSl.exe
  C:\Windows\System\GOPjOSl.exe
  2⤵
  PID:4196
- C:\Windows\System\whScHUY.exe
  C:\Windows\System\whScHUY.exe
  2⤵
  PID:4212
- C:\Windows\System\WImsLGe.exe
  C:\Windows\System\WImsLGe.exe
  2⤵
  PID:4228
- C:\Windows\System\XCLHBsd.exe
  C:\Windows\System\XCLHBsd.exe
  2⤵
  PID:4244
- C:\Windows\System\MAUkoia.exe
  C:\Windows\System\MAUkoia.exe
  2⤵
  PID:4260
- C:\Windows\System\DyDzuvD.exe
  C:\Windows\System\DyDzuvD.exe
  2⤵
  PID:4280
- C:\Windows\System\ZJPQLvz.exe
  C:\Windows\System\ZJPQLvz.exe
  2⤵
  PID:4296
- C:\Windows\System\jeYqtPc.exe
  C:\Windows\System\jeYqtPc.exe
  2⤵
  PID:4312
- C:\Windows\System\CbcPTfy.exe
  C:\Windows\System\CbcPTfy.exe
  2⤵
  PID:4336
- C:\Windows\System\VBRwxNc.exe
  C:\Windows\System\VBRwxNc.exe
  2⤵
  PID:4352
- C:\Windows\System\NslJqzP.exe
  C:\Windows\System\NslJqzP.exe
  2⤵
  PID:4428
- C:\Windows\System\HueiVhF.exe
  C:\Windows\System\HueiVhF.exe
  2⤵
  PID:4444
- C:\Windows\System\BAalQPQ.exe
  C:\Windows\System\BAalQPQ.exe
  2⤵
  PID:4460
- C:\Windows\System\VaQwqBx.exe
  C:\Windows\System\VaQwqBx.exe
  2⤵
  PID:4476
- C:\Windows\System\pxvgfqy.exe
  C:\Windows\System\pxvgfqy.exe
  2⤵
  PID:4492
- C:\Windows\System\ktgxITf.exe
  C:\Windows\System\ktgxITf.exe
  2⤵
  PID:4516
- C:\Windows\System\SutLfpP.exe
  C:\Windows\System\SutLfpP.exe
  2⤵
  PID:4532
- C:\Windows\System\biKhWSO.exe
  C:\Windows\System\biKhWSO.exe
  2⤵
  PID:4584
- C:\Windows\System\FIvgspb.exe
  C:\Windows\System\FIvgspb.exe
  2⤵
  PID:4628
- C:\Windows\System\QBYemZj.exe
  C:\Windows\System\QBYemZj.exe
  2⤵
  PID:4644
- C:\Windows\System\wZbeJpk.exe
  C:\Windows\System\wZbeJpk.exe
  2⤵
  PID:4676
- C:\Windows\System\XfyRyRR.exe
  C:\Windows\System\XfyRyRR.exe
  2⤵
  PID:4692
- C:\Windows\System\TkobSGI.exe
  C:\Windows\System\TkobSGI.exe
  2⤵
  PID:4708
- C:\Windows\System\GocjzuR.exe
  C:\Windows\System\GocjzuR.exe
  2⤵
  PID:4740
- C:\Windows\System\LktRYEz.exe
  C:\Windows\System\LktRYEz.exe
  2⤵
  PID:4780
- C:\Windows\System\HRTlWDz.exe
  C:\Windows\System\HRTlWDz.exe
  2⤵
  PID:4796
- C:\Windows\System\XIJllqw.exe
  C:\Windows\System\XIJllqw.exe
  2⤵
  PID:4812
- C:\Windows\System\EKxBkGV.exe
  C:\Windows\System\EKxBkGV.exe
  2⤵
  PID:4844
- C:\Windows\System\vVzNeos.exe
  C:\Windows\System\vVzNeos.exe
  2⤵
  PID:4864
- C:\Windows\System\gdBJpBs.exe
  C:\Windows\System\gdBJpBs.exe
  2⤵
  PID:4896
- C:\Windows\System\mgbUpJd.exe
  C:\Windows\System\mgbUpJd.exe
  2⤵
  PID:4928
- C:\Windows\System\gOVaHzR.exe
  C:\Windows\System\gOVaHzR.exe
  2⤵
  PID:4948
- C:\Windows\System\XCzczvM.exe
  C:\Windows\System\XCzczvM.exe
  2⤵
  PID:4964
- C:\Windows\System\pquoWSP.exe
  C:\Windows\System\pquoWSP.exe
  2⤵
  PID:4980
- C:\Windows\System\eTufgJW.exe
  C:\Windows\System\eTufgJW.exe
  2⤵
  PID:4996
- C:\Windows\System\geqiomg.exe
  C:\Windows\System\geqiomg.exe
  2⤵
  PID:5012
- C:\Windows\System\JzdjgRB.exe
  C:\Windows\System\JzdjgRB.exe
  2⤵
  PID:5032
- C:\Windows\System\ovQkuxu.exe
  C:\Windows\System\ovQkuxu.exe
  2⤵
  PID:5048
- C:\Windows\System\hJlXDWK.exe
  C:\Windows\System\hJlXDWK.exe
  2⤵
  PID:5072
- C:\Windows\System\OvYDasY.exe
  C:\Windows\System\OvYDasY.exe
  2⤵
  PID:5088
- C:\Windows\System\FhBzNQM.exe
  C:\Windows\System\FhBzNQM.exe
  2⤵
  PID:5104
- C:\Windows\System\rFmBsYx.exe
  C:\Windows\System\rFmBsYx.exe
  2⤵
  PID:3716
- C:\Windows\System\vZQlVLp.exe
  C:\Windows\System\vZQlVLp.exe
  2⤵
  PID:4048
- C:\Windows\System\xQvqMXL.exe
  C:\Windows\System\xQvqMXL.exe
  2⤵
  PID:3592
- C:\Windows\System\ziKLSYc.exe
  C:\Windows\System\ziKLSYc.exe
  2⤵
  PID:4108
- C:\Windows\System\grbfpZw.exe
  C:\Windows\System\grbfpZw.exe
  2⤵
  PID:4164
- C:\Windows\System\XHyScTs.exe
  C:\Windows\System\XHyScTs.exe
  2⤵
  PID:1540
- C:\Windows\System\GqHFpPc.exe
  C:\Windows\System\GqHFpPc.exe
  2⤵
  PID:4304
- C:\Windows\System\AuTlEJi.exe
  C:\Windows\System\AuTlEJi.exe
  2⤵
  PID:4208
- C:\Windows\System\zjyPUff.exe
  C:\Windows\System\zjyPUff.exe
  2⤵
  PID:4324
- C:\Windows\System\cMVGXji.exe
  C:\Windows\System\cMVGXji.exe
  2⤵
  PID:4328
- C:\Windows\System\gqLvvrZ.exe
  C:\Windows\System\gqLvvrZ.exe
  2⤵
  PID:4388
- C:\Windows\System\wAHfXCC.exe
  C:\Windows\System\wAHfXCC.exe
  2⤵
  PID:4368
- C:\Windows\System\xWjJqKl.exe
  C:\Windows\System\xWjJqKl.exe
  2⤵
  PID:4436
- C:\Windows\System\NzwxnNf.exe
  C:\Windows\System\NzwxnNf.exe
  2⤵
  PID:4604
- C:\Windows\System\CEwmgxe.exe
  C:\Windows\System\CEwmgxe.exe
  2⤵
  PID:4640
- C:\Windows\System\UVqsbqs.exe
  C:\Windows\System\UVqsbqs.exe
  2⤵
  PID:4684
- C:\Windows\System\osMNgyR.exe
  C:\Windows\System\osMNgyR.exe
  2⤵
  PID:4668
- C:\Windows\System\GTFedHA.exe
  C:\Windows\System\GTFedHA.exe
  2⤵
  PID:4732
- C:\Windows\System\QJYUAPc.exe
  C:\Windows\System\QJYUAPc.exe
  2⤵
  PID:4704
- C:\Windows\System\CbsqYIH.exe
  C:\Windows\System\CbsqYIH.exe
  2⤵
  PID:4792
- C:\Windows\System\RSxDyEK.exe
  C:\Windows\System\RSxDyEK.exe
  2⤵
  PID:4776
- C:\Windows\System\XdCKVLP.exe
  C:\Windows\System\XdCKVLP.exe
  2⤵
  PID:4832
- C:\Windows\System\TpoOcbT.exe
  C:\Windows\System\TpoOcbT.exe
  2⤵
  PID:4824
- C:\Windows\System\rsRHJYz.exe
  C:\Windows\System\rsRHJYz.exe
  2⤵
  PID:4912
- C:\Windows\System\HXaiJRJ.exe
  C:\Windows\System\HXaiJRJ.exe
  2⤵
  PID:4972
- C:\Windows\System\PzQXbKb.exe
  C:\Windows\System\PzQXbKb.exe
  2⤵
  PID:5084
- C:\Windows\System\FlCdpgN.exe
  C:\Windows\System\FlCdpgN.exe
  2⤵
  PID:2636
- C:\Windows\System\hOcnZdo.exe
  C:\Windows\System\hOcnZdo.exe
  2⤵
  PID:5068
- C:\Windows\System\misvlBW.exe
  C:\Windows\System\misvlBW.exe
  2⤵
  PID:4956
- C:\Windows\System\bbjsnuM.exe
  C:\Windows\System\bbjsnuM.exe
  2⤵
  PID:5096
- C:\Windows\System\gCkQfgy.exe
  C:\Windows\System\gCkQfgy.exe
  2⤵
  PID:4128
- C:\Windows\System\QuZkqMm.exe
  C:\Windows\System\QuZkqMm.exe
  2⤵
  PID:4348
- C:\Windows\System\KBOIEDM.exe
  C:\Windows\System\KBOIEDM.exe
  2⤵
  PID:4408
- C:\Windows\System\fFdXVXL.exe
  C:\Windows\System\fFdXVXL.exe
  2⤵
  PID:5060
- C:\Windows\System\sKPEgxT.exe
  C:\Windows\System\sKPEgxT.exe
  2⤵
  PID:4192
- C:\Windows\System\kthYmil.exe
  C:\Windows\System\kthYmil.exe
  2⤵
  PID:4396
- C:\Windows\System\DcgjOnN.exe
  C:\Windows\System\DcgjOnN.exe
  2⤵
  PID:4484
- C:\Windows\System\WqIyVZP.exe
  C:\Windows\System\WqIyVZP.exe
  2⤵
  PID:4468
- C:\Windows\System\jHLNbTN.exe
  C:\Windows\System\jHLNbTN.exe
  2⤵
  PID:4508
- C:\Windows\System\UXtckyL.exe
  C:\Windows\System\UXtckyL.exe
  2⤵
  PID:4456
- C:\Windows\System\DQSJsUK.exe
  C:\Windows\System\DQSJsUK.exe
  2⤵
  PID:4384
- C:\Windows\System\UOawlEr.exe
  C:\Windows\System\UOawlEr.exe
  2⤵
  PID:4636
- C:\Windows\System\ThXeaqt.exe
  C:\Windows\System\ThXeaqt.exe
  2⤵
  PID:4724
- C:\Windows\System\FYmnBce.exe
  C:\Windows\System\FYmnBce.exe
  2⤵
  PID:4756
- C:\Windows\System\iwtzvbZ.exe
  C:\Windows\System\iwtzvbZ.exe
  2⤵
  PID:4888
- C:\Windows\System\HRTwaQT.exe
  C:\Windows\System\HRTwaQT.exe
  2⤵
  PID:4860
- C:\Windows\System\WABieca.exe
  C:\Windows\System\WABieca.exe
  2⤵
  PID:4876
- C:\Windows\System\urXOPqd.exe
  C:\Windows\System\urXOPqd.exe
  2⤵
  PID:4944
- C:\Windows\System\gAmMgQT.exe
  C:\Windows\System\gAmMgQT.exe
  2⤵
  PID:4596
- C:\Windows\System\qwtSwpu.exe
  C:\Windows\System\qwtSwpu.exe
  2⤵
  PID:4184
- C:\Windows\System\nzmqDnr.exe
  C:\Windows\System\nzmqDnr.exe
  2⤵
  PID:4992
- C:\Windows\System\bkGvTan.exe
  C:\Windows\System\bkGvTan.exe
  2⤵
  PID:4124
- C:\Windows\System\YyCpXTP.exe
  C:\Windows\System\YyCpXTP.exe
  2⤵
  PID:4400
- C:\Windows\System\ssrDGcC.exe
  C:\Windows\System\ssrDGcC.exe
  2⤵
  PID:4364
- C:\Windows\System\qFiYRlb.exe
  C:\Windows\System\qFiYRlb.exe
  2⤵
  PID:4404
- C:\Windows\System\HcAzdOr.exe
  C:\Windows\System\HcAzdOr.exe
  2⤵
  PID:5116
- C:\Windows\System\cNrfhya.exe
  C:\Windows\System\cNrfhya.exe
  2⤵
  PID:5124
- C:\Windows\System\jYRRcXs.exe
  C:\Windows\System\jYRRcXs.exe
  2⤵
  PID:5180
- C:\Windows\System\DfxlGem.exe
  C:\Windows\System\DfxlGem.exe
  2⤵
  PID:5196
- C:\Windows\System\PRAALEh.exe
  C:\Windows\System\PRAALEh.exe
  2⤵
  PID:5212
- C:\Windows\System\xifSYLp.exe
  C:\Windows\System\xifSYLp.exe
  2⤵
  PID:5228
- C:\Windows\System\kNZEIfK.exe
  C:\Windows\System\kNZEIfK.exe
  2⤵
  PID:5244
- C:\Windows\System\rUxRkQm.exe
  C:\Windows\System\rUxRkQm.exe
  2⤵
  PID:5264
- C:\Windows\System\YywYNEW.exe
  C:\Windows\System\YywYNEW.exe
  2⤵
  PID:5280
- C:\Windows\System\jRWrPeB.exe
  C:\Windows\System\jRWrPeB.exe
  2⤵
  PID:5296
- C:\Windows\System\uFSRHkE.exe
  C:\Windows\System\uFSRHkE.exe
  2⤵
  PID:5312
- C:\Windows\System\VQiDinG.exe
  C:\Windows\System\VQiDinG.exe
  2⤵
  PID:5332
- C:\Windows\System\ZRyCAOy.exe
  C:\Windows\System\ZRyCAOy.exe
  2⤵
  PID:5348
- C:\Windows\System\FmfRGRW.exe
  C:\Windows\System\FmfRGRW.exe
  2⤵
  PID:5448
- C:\Windows\System\PRqPSww.exe
  C:\Windows\System\PRqPSww.exe
  2⤵
  PID:5472
- C:\Windows\System\vzkLLoJ.exe
  C:\Windows\System\vzkLLoJ.exe
  2⤵
  PID:5488
- C:\Windows\System\owbkBYG.exe
  C:\Windows\System\owbkBYG.exe
  2⤵
  PID:5504
- C:\Windows\System\szbTTYh.exe
  C:\Windows\System\szbTTYh.exe
  2⤵
  PID:5524
- C:\Windows\System\XYcycJT.exe
  C:\Windows\System\XYcycJT.exe
  2⤵
  PID:5540
- C:\Windows\System\UkegCzZ.exe
  C:\Windows\System\UkegCzZ.exe
  2⤵
  PID:5560
- C:\Windows\System\mmMqNNz.exe
  C:\Windows\System\mmMqNNz.exe
  2⤵
  PID:5576
- C:\Windows\System\OSoWydU.exe
  C:\Windows\System\OSoWydU.exe
  2⤵
  PID:5620
- C:\Windows\System\lnwIQPI.exe
  C:\Windows\System\lnwIQPI.exe
  2⤵
  PID:5636
- C:\Windows\System\pRddLUr.exe
  C:\Windows\System\pRddLUr.exe
  2⤵
  PID:5652
- C:\Windows\System\rfYDLDs.exe
  C:\Windows\System\rfYDLDs.exe
  2⤵
  PID:5668
- C:\Windows\System\UbeHRpy.exe
  C:\Windows\System\UbeHRpy.exe
  2⤵
  PID:5684
- C:\Windows\System\HyntLyB.exe
  C:\Windows\System\HyntLyB.exe
  2⤵
  PID:5700
- C:\Windows\System\RPgzztG.exe
  C:\Windows\System\RPgzztG.exe
  2⤵
  PID:5720
- C:\Windows\System\xjTsyzy.exe
  C:\Windows\System\xjTsyzy.exe
  2⤵
  PID:5740
- C:\Windows\System\hBmmkgv.exe
  C:\Windows\System\hBmmkgv.exe
  2⤵
  PID:5756
- C:\Windows\System\XFtDBIx.exe
  C:\Windows\System\XFtDBIx.exe
  2⤵
  PID:5776
- C:\Windows\System\XiYicpE.exe
  C:\Windows\System\XiYicpE.exe
  2⤵
  PID:5792
- C:\Windows\System\WDoVvAW.exe
  C:\Windows\System\WDoVvAW.exe
  2⤵
  PID:5852
- C:\Windows\System\HxcWiRX.exe
  C:\Windows\System\HxcWiRX.exe
  2⤵
  PID:5876
- C:\Windows\System\aBzZnCG.exe
  C:\Windows\System\aBzZnCG.exe
  2⤵
  PID:5892
- C:\Windows\System\hZLdpfp.exe
  C:\Windows\System\hZLdpfp.exe
  2⤵
  PID:5908
- C:\Windows\System\tDJyTTP.exe
  C:\Windows\System\tDJyTTP.exe
  2⤵
  PID:5924
- C:\Windows\System\ZkNYJXI.exe
  C:\Windows\System\ZkNYJXI.exe
  2⤵
  PID:5940
- C:\Windows\System\jVQqiqy.exe
  C:\Windows\System\jVQqiqy.exe
  2⤵
  PID:5956
- C:\Windows\System\QhJKuKt.exe
  C:\Windows\System\QhJKuKt.exe
  2⤵
  PID:5972
- C:\Windows\System\kGVtUAW.exe
  C:\Windows\System\kGVtUAW.exe
  2⤵
  PID:6028
- C:\Windows\System\UtZgKDA.exe
  C:\Windows\System\UtZgKDA.exe
  2⤵
  PID:6044
- C:\Windows\System\jNlUmYM.exe
  C:\Windows\System\jNlUmYM.exe
  2⤵
  PID:6060
- C:\Windows\System\iDhUpqy.exe
  C:\Windows\System\iDhUpqy.exe
  2⤵
  PID:6076
- C:\Windows\System\mRxiRuE.exe
  C:\Windows\System\mRxiRuE.exe
  2⤵
  PID:6092
- C:\Windows\System\TEAxIhX.exe
  C:\Windows\System\TEAxIhX.exe
  2⤵
  PID:6112
- C:\Windows\System\xDbpuAU.exe
  C:\Windows\System\xDbpuAU.exe
  2⤵
  PID:6128
- C:\Windows\System\ZnDpcZM.exe
  C:\Windows\System\ZnDpcZM.exe
  2⤵
  PID:4660
- C:\Windows\System\KdEKtGX.exe
  C:\Windows\System\KdEKtGX.exe
  2⤵
  PID:4472
- C:\Windows\System\wiDWJMp.exe
  C:\Windows\System\wiDWJMp.exe
  2⤵
  PID:4652
- C:\Windows\System\jUaTvRF.exe
  C:\Windows\System\jUaTvRF.exe
  2⤵
  PID:4852
- C:\Windows\System\ktDgOBs.exe
  C:\Windows\System\ktDgOBs.exe
  2⤵
  PID:4008
- C:\Windows\System\RydAZYW.exe
  C:\Windows\System\RydAZYW.exe
  2⤵
  PID:5020
- C:\Windows\System\VrsJWvn.exe
  C:\Windows\System\VrsJWvn.exe
  2⤵
  PID:4380
- C:\Windows\System\cYEPheW.exe
  C:\Windows\System\cYEPheW.exe
  2⤵
  PID:4904
- C:\Windows\System\sOapbyx.exe
  C:\Windows\System\sOapbyx.exe
  2⤵
  PID:5144
- C:\Windows\System\vrGdVLP.exe
  C:\Windows\System\vrGdVLP.exe
  2⤵
  PID:5160
- C:\Windows\System\KoIuRMw.exe
  C:\Windows\System\KoIuRMw.exe
  2⤵
  PID:5204
- C:\Windows\System\RKFDtxO.exe
  C:\Windows\System\RKFDtxO.exe
  2⤵
  PID:4308
- C:\Windows\System\LRsglWR.exe
  C:\Windows\System\LRsglWR.exe
  2⤵
  PID:5416
- C:\Windows\System\NJUNuQY.exe
  C:\Windows\System\NJUNuQY.exe
  2⤵
  PID:5364
- C:\Windows\System\sGbwplJ.exe
  C:\Windows\System\sGbwplJ.exe
  2⤵
  PID:5376
- C:\Windows\System\vNdnyCk.exe
  C:\Windows\System\vNdnyCk.exe
  2⤵
  PID:5456
- C:\Windows\System\QWUSXQH.exe
  C:\Windows\System\QWUSXQH.exe
  2⤵
  PID:5252
- C:\Windows\System\cLHjeEO.exe
  C:\Windows\System\cLHjeEO.exe
  2⤵
  PID:5288
- C:\Windows\System\VmaroRy.exe
  C:\Windows\System\VmaroRy.exe
  2⤵
  PID:5328
- C:\Windows\System\eXHjBWw.exe
  C:\Windows\System\eXHjBWw.exe
  2⤵
  PID:5464
- C:\Windows\System\fCPGvYx.exe
  C:\Windows\System\fCPGvYx.exe
  2⤵
  PID:5572
- C:\Windows\System\dRjpADU.exe
  C:\Windows\System\dRjpADU.exe
  2⤵
  PID:5480
- C:\Windows\System\VshMuBx.exe
  C:\Windows\System\VshMuBx.exe
  2⤵
  PID:5628
- C:\Windows\System\EprSoHJ.exe
  C:\Windows\System\EprSoHJ.exe
  2⤵
  PID:5516
- C:\Windows\System\KkhPQke.exe
  C:\Windows\System\KkhPQke.exe
  2⤵
  PID:5608
- C:\Windows\System\AApnJDE.exe
  C:\Windows\System\AApnJDE.exe
  2⤵
  PID:5660
- C:\Windows\System\DWQbUAZ.exe
  C:\Windows\System\DWQbUAZ.exe
  2⤵
  PID:5728
- C:\Windows\System\sFQYqEp.exe
  C:\Windows\System\sFQYqEp.exe
  2⤵
  PID:5808
- C:\Windows\System\VlTiIyh.exe
  C:\Windows\System\VlTiIyh.exe
  2⤵
  PID:5716
- C:\Windows\System\rGKZAEL.exe
  C:\Windows\System\rGKZAEL.exe
  2⤵
  PID:5644
- C:\Windows\System\GPTjMGF.exe
  C:\Windows\System\GPTjMGF.exe
  2⤵
  PID:5864
- C:\Windows\System\cmoNXwl.exe
  C:\Windows\System\cmoNXwl.exe
  2⤵
  PID:5916
- C:\Windows\System\uHqlSek.exe
  C:\Windows\System\uHqlSek.exe
  2⤵
  PID:6000
- C:\Windows\System\VSEOVZG.exe
  C:\Windows\System\VSEOVZG.exe
  2⤵
  PID:5992
- C:\Windows\System\msiVFIn.exe
  C:\Windows\System\msiVFIn.exe
  2⤵
  PID:6016
- C:\Windows\System\xqAFSse.exe
  C:\Windows\System\xqAFSse.exe
  2⤵
  PID:5932
- C:\Windows\System\muIyTGJ.exe
  C:\Windows\System\muIyTGJ.exe
  2⤵
  PID:6052
- C:\Windows\System\ALthxFW.exe
  C:\Windows\System\ALthxFW.exe
  2⤵
  PID:6056
- C:\Windows\System\SERGXVS.exe
  C:\Windows\System\SERGXVS.exe
  2⤵
  PID:4528
- C:\Windows\System\zbSHwwK.exe
  C:\Windows\System\zbSHwwK.exe
  2⤵
  PID:4772
- C:\Windows\System\rkCnMsn.exe
  C:\Windows\System\rkCnMsn.exe
  2⤵
  PID:5024
- C:\Windows\System\IhcHHPQ.exe
  C:\Windows\System\IhcHHPQ.exe
  2⤵
  PID:6036
- C:\Windows\System\kTjfyCj.exe
  C:\Windows\System\kTjfyCj.exe
  2⤵
  PID:4580
- C:\Windows\System\nsFUayd.exe
  C:\Windows\System\nsFUayd.exe
  2⤵
  PID:4188
- C:\Windows\System\EtWwVeA.exe
  C:\Windows\System\EtWwVeA.exe
  2⤵
  PID:4976
- C:\Windows\System\nymVJMk.exe
  C:\Windows\System\nymVJMk.exe
  2⤵
  PID:5056
- C:\Windows\System\oWnlzdS.exe
  C:\Windows\System\oWnlzdS.exe
  2⤵
  PID:4180
- C:\Windows\System\xOqWkPP.exe
  C:\Windows\System\xOqWkPP.exe
  2⤵
  PID:5272
- C:\Windows\System\CvTetEI.exe
  C:\Windows\System\CvTetEI.exe
  2⤵
  PID:5400
- C:\Windows\System\ZKudzjx.exe
  C:\Windows\System\ZKudzjx.exe
  2⤵
  PID:5468
- C:\Windows\System\RolLSfU.exe
  C:\Windows\System\RolLSfU.exe
  2⤵
  PID:5500
- C:\Windows\System\StRXtfD.exe
  C:\Windows\System\StRXtfD.exe
  2⤵
  PID:5592
- C:\Windows\System\ZOuDAoB.exe
  C:\Windows\System\ZOuDAoB.exe
  2⤵
  PID:4820
- C:\Windows\System\smulPLE.exe
  C:\Windows\System\smulPLE.exe
  2⤵
  PID:5736
- C:\Windows\System\GFtTjSo.exe
  C:\Windows\System\GFtTjSo.exe
  2⤵
  PID:5648
- C:\Windows\System\wjnhsWz.exe
  C:\Windows\System\wjnhsWz.exe
  2⤵
  PID:5568
- C:\Windows\System\Hupzmkm.exe
  C:\Windows\System\Hupzmkm.exe
  2⤵
  PID:5752
- C:\Windows\System\syPxVHy.exe
  C:\Windows\System\syPxVHy.exe
  2⤵
  PID:5584
- C:\Windows\System\fOPHnSE.exe
  C:\Windows\System\fOPHnSE.exe
  2⤵
  PID:5692
- C:\Windows\System\TglYLRI.exe
  C:\Windows\System\TglYLRI.exe
  2⤵
  PID:5984
- C:\Windows\System\RspdSPC.exe
  C:\Windows\System\RspdSPC.exe
  2⤵
  PID:5680
- C:\Windows\System\zIdJtjK.exe
  C:\Windows\System\zIdJtjK.exe
  2⤵
  PID:6072
- C:\Windows\System\bHUHjQj.exe
  C:\Windows\System\bHUHjQj.exe
  2⤵
  PID:6088
- C:\Windows\System\lNVqrVA.exe
  C:\Windows\System\lNVqrVA.exe
  2⤵
  PID:6124
- C:\Windows\System\iOSRxLy.exe
  C:\Windows\System\iOSRxLy.exe
  2⤵
  PID:4840
- C:\Windows\System\ynACkJv.exe
  C:\Windows\System\ynACkJv.exe
  2⤵
  PID:5152
- C:\Windows\System\TRbhJTt.exe
  C:\Windows\System\TRbhJTt.exe
  2⤵
  PID:5236
- C:\Windows\System\xwxCqaS.exe
  C:\Windows\System\xwxCqaS.exe
  2⤵
  PID:4268
- C:\Windows\System\mxZDVTS.exe
  C:\Windows\System\mxZDVTS.exe
  2⤵
  PID:6108
- C:\Windows\System\QOIxTtY.exe
  C:\Windows\System\QOIxTtY.exe
  2⤵
  PID:5040
- C:\Windows\System\OBvTJTE.exe
  C:\Windows\System\OBvTJTE.exe
  2⤵
  PID:6104
- C:\Windows\System\CCjcDye.exe
  C:\Windows\System\CCjcDye.exe
  2⤵
  PID:5360
- C:\Windows\System\mrsbEUy.exe
  C:\Windows\System\mrsbEUy.exe
  2⤵
  PID:5432
- C:\Windows\System\wAUGpOd.exe
  C:\Windows\System\wAUGpOd.exe
  2⤵
  PID:5612
- C:\Windows\System\KccIxbB.exe
  C:\Windows\System\KccIxbB.exe
  2⤵
  PID:5368
- C:\Windows\System\CXtkvlh.exe
  C:\Windows\System\CXtkvlh.exe
  2⤵
  PID:5800
- C:\Windows\System\xQlEPwr.exe
  C:\Windows\System\xQlEPwr.exe
  2⤵
  PID:5388
- C:\Windows\System\jSHypPn.exe
  C:\Windows\System\jSHypPn.exe
  2⤵
  PID:5512
- C:\Windows\System\CggvhsF.exe
  C:\Windows\System\CggvhsF.exe
  2⤵
  PID:6040
- C:\Windows\System\DGdUdnm.exe
  C:\Windows\System\DGdUdnm.exe
  2⤵
  PID:5548
- C:\Windows\System\pBpErDG.exe
  C:\Windows\System\pBpErDG.exe
  2⤵
  PID:5888
- C:\Windows\System\OLAKaIw.exe
  C:\Windows\System\OLAKaIw.exe
  2⤵
  PID:4752
- C:\Windows\System\rPDutLy.exe
  C:\Windows\System\rPDutLy.exe
  2⤵
  PID:5260
- C:\Windows\System\BVyFbtW.exe
  C:\Windows\System\BVyFbtW.exe
  2⤵
  PID:5308
- C:\Windows\System\ItvVslP.exe
  C:\Windows\System\ItvVslP.exe
  2⤵
  PID:6136
- C:\Windows\System\aEaqyXQ.exe
  C:\Windows\System\aEaqyXQ.exe
  2⤵
  PID:3784
- C:\Windows\System\xAEaOhY.exe
  C:\Windows\System\xAEaOhY.exe
  2⤵
  PID:5444
- C:\Windows\System\uuACcOB.exe
  C:\Windows\System\uuACcOB.exe
  2⤵
  PID:5708
- C:\Windows\System\Vzxwdkd.exe
  C:\Windows\System\Vzxwdkd.exe
  2⤵
  PID:4828
- C:\Windows\System\ZzYLXli.exe
  C:\Windows\System\ZzYLXli.exe
  2⤵
  PID:4148
- C:\Windows\System\FnNgVwZ.exe
  C:\Windows\System\FnNgVwZ.exe
  2⤵
  PID:4292
- C:\Windows\System\ZGLqSaA.exe
  C:\Windows\System\ZGLqSaA.exe
  2⤵
  PID:240
- C:\Windows\System\nnPesIk.exe
  C:\Windows\System\nnPesIk.exe
  2⤵
  PID:5240
- C:\Windows\System\TmxjBvR.exe
  C:\Windows\System\TmxjBvR.exe
  2⤵
  PID:5256
- C:\Windows\System\BPzZzff.exe
  C:\Windows\System\BPzZzff.exe
  2⤵
  PID:5768
- C:\Windows\System\vFhRqim.exe
  C:\Windows\System\vFhRqim.exe
  2⤵
  PID:5836
- C:\Windows\System\BxoGetZ.exe
  C:\Windows\System\BxoGetZ.exe
  2⤵
  PID:5320
- C:\Windows\System\MFIAERB.exe
  C:\Windows\System\MFIAERB.exe
  2⤵
  PID:6152
- C:\Windows\System\NJHRLSc.exe
  C:\Windows\System\NJHRLSc.exe
  2⤵
  PID:6200
- C:\Windows\System\CMrQhTM.exe
  C:\Windows\System\CMrQhTM.exe
  2⤵
  PID:6264
- C:\Windows\System\ABTGPDS.exe
  C:\Windows\System\ABTGPDS.exe
  2⤵
  PID:6280
- C:\Windows\System\suGnJiz.exe
  C:\Windows\System\suGnJiz.exe
  2⤵
  PID:6296
- C:\Windows\System\dJihpdt.exe
  C:\Windows\System\dJihpdt.exe
  2⤵
  PID:6312
- C:\Windows\System\qdehwDn.exe
  C:\Windows\System\qdehwDn.exe
  2⤵
  PID:6332
- C:\Windows\System\hLMxixt.exe
  C:\Windows\System\hLMxixt.exe
  2⤵
  PID:6360
- C:\Windows\System\PgXkNuQ.exe
  C:\Windows\System\PgXkNuQ.exe
  2⤵
  PID:6380
- C:\Windows\System\KrqFNmY.exe
  C:\Windows\System\KrqFNmY.exe
  2⤵
  PID:6396
- C:\Windows\System\eQcnOvG.exe
  C:\Windows\System\eQcnOvG.exe
  2⤵
  PID:6412
- C:\Windows\System\sIaaSde.exe
  C:\Windows\System\sIaaSde.exe
  2⤵
  PID:6436
- C:\Windows\System\UwgCdVM.exe
  C:\Windows\System\UwgCdVM.exe
  2⤵
  PID:6464
- C:\Windows\System\uNMEcyP.exe
  C:\Windows\System\uNMEcyP.exe
  2⤵
  PID:6480
- C:\Windows\System\obpKHxd.exe
  C:\Windows\System\obpKHxd.exe
  2⤵
  PID:6496
- C:\Windows\System\xNjtoQR.exe
  C:\Windows\System\xNjtoQR.exe
  2⤵
  PID:6512
- C:\Windows\System\ySzKPMM.exe
  C:\Windows\System\ySzKPMM.exe
  2⤵
  PID:6528
- C:\Windows\System\vvvnxIS.exe
  C:\Windows\System\vvvnxIS.exe
  2⤵
  PID:6544
- C:\Windows\System\oUsFrAC.exe
  C:\Windows\System\oUsFrAC.exe
  2⤵
  PID:6560
- C:\Windows\System\rffvOYu.exe
  C:\Windows\System\rffvOYu.exe
  2⤵
  PID:6576
- C:\Windows\System\vxDHLXg.exe
  C:\Windows\System\vxDHLXg.exe
  2⤵
  PID:6592
- C:\Windows\System\TVKbpVu.exe
  C:\Windows\System\TVKbpVu.exe
  2⤵
  PID:6608
- C:\Windows\System\GLtKNwl.exe
  C:\Windows\System\GLtKNwl.exe
  2⤵
  PID:6624
- C:\Windows\System\duNQTLS.exe
  C:\Windows\System\duNQTLS.exe
  2⤵
  PID:6652
- C:\Windows\System\pPnyxIb.exe
  C:\Windows\System\pPnyxIb.exe
  2⤵
  PID:6688
- C:\Windows\System\wIirbnE.exe
  C:\Windows\System\wIirbnE.exe
  2⤵
  PID:6704
- C:\Windows\System\WtRhenL.exe
  C:\Windows\System\WtRhenL.exe
  2⤵
  PID:6728
- C:\Windows\System\heMIaiZ.exe
  C:\Windows\System\heMIaiZ.exe
  2⤵
  PID:6744
- C:\Windows\System\ThoPjkV.exe
  C:\Windows\System\ThoPjkV.exe
  2⤵
  PID:6764
- C:\Windows\System\uEslOLW.exe
  C:\Windows\System\uEslOLW.exe
  2⤵
  PID:6784
- C:\Windows\System\GcMxWop.exe
  C:\Windows\System\GcMxWop.exe
  2⤵
  PID:6800
- C:\Windows\System\bfKQQiS.exe
  C:\Windows\System\bfKQQiS.exe
  2⤵
  PID:6816
- C:\Windows\System\HSPgHCH.exe
  C:\Windows\System\HSPgHCH.exe
  2⤵
  PID:6920
- C:\Windows\System\nAVmXAl.exe
  C:\Windows\System\nAVmXAl.exe
  2⤵
  PID:6936
- C:\Windows\System\yehBWPw.exe
  C:\Windows\System\yehBWPw.exe
  2⤵
  PID:6952
- C:\Windows\System\RfiAHQk.exe
  C:\Windows\System\RfiAHQk.exe
  2⤵
  PID:7028
- C:\Windows\System\OBnxSmo.exe
  C:\Windows\System\OBnxSmo.exe
  2⤵
  PID:7048
- C:\Windows\System\nVSYGzG.exe
  C:\Windows\System\nVSYGzG.exe
  2⤵
  PID:7068
- C:\Windows\System\SyQeEcN.exe
  C:\Windows\System\SyQeEcN.exe
  2⤵
  PID:7084
- C:\Windows\System\HnVpKzR.exe
  C:\Windows\System\HnVpKzR.exe
  2⤵
  PID:7104
- C:\Windows\System\PBvdhLz.exe
  C:\Windows\System\PBvdhLz.exe
  2⤵
  PID:7120
- C:\Windows\System\KRKRIoO.exe
  C:\Windows\System\KRKRIoO.exe
  2⤵
  PID:7136
- C:\Windows\System\jrJwtSR.exe
  C:\Windows\System\jrJwtSR.exe
  2⤵
  PID:7156
- C:\Windows\System\LHIBnpl.exe
  C:\Windows\System\LHIBnpl.exe
  2⤵
  PID:6216
- C:\Windows\System\wpiLmaw.exe
  C:\Windows\System\wpiLmaw.exe
  2⤵
  PID:6180
- C:\Windows\System\ExZpmrH.exe
  C:\Windows\System\ExZpmrH.exe
  2⤵
  PID:6196
- C:\Windows\System\snPPjuk.exe
  C:\Windows\System\snPPjuk.exe
  2⤵
  PID:6236
- C:\Windows\System\tbrNszC.exe
  C:\Windows\System\tbrNszC.exe
  2⤵
  PID:6228
- C:\Windows\System\drvSOvY.exe
  C:\Windows\System\drvSOvY.exe
  2⤵
  PID:6320
- C:\Windows\System\WELWaHC.exe
  C:\Windows\System\WELWaHC.exe
  2⤵
  PID:6308
- C:\Windows\System\eFwjeZq.exe
  C:\Windows\System\eFwjeZq.exe
  2⤵
  PID:6356
- C:\Windows\System\GARBowG.exe
  C:\Windows\System\GARBowG.exe
  2⤵
  PID:6368
- C:\Windows\System\KJJeJbj.exe
  C:\Windows\System\KJJeJbj.exe
  2⤵
  PID:6444
- C:\Windows\System\jHsTvYt.exe
  C:\Windows\System\jHsTvYt.exe
  2⤵
  PID:6448
- C:\Windows\System\tgvoTrA.exe
  C:\Windows\System\tgvoTrA.exe
  2⤵
  PID:6520
- C:\Windows\System\vwylKOJ.exe
  C:\Windows\System\vwylKOJ.exe
  2⤵
  PID:6428
- C:\Windows\System\PDFZBeQ.exe
  C:\Windows\System\PDFZBeQ.exe
  2⤵
  PID:6504
- C:\Windows\System\sRDTZbd.exe
  C:\Windows\System\sRDTZbd.exe
  2⤵
  PID:6572
- C:\Windows\System\GfBknUh.exe
  C:\Windows\System\GfBknUh.exe
  2⤵
  PID:6668
- C:\Windows\System\BlkwDdT.exe
  C:\Windows\System\BlkwDdT.exe
  2⤵
  PID:6640
- C:\Windows\System\DdFtjHm.exe
  C:\Windows\System\DdFtjHm.exe
  2⤵
  PID:6696
- C:\Windows\System\MSfyYwa.exe
  C:\Windows\System\MSfyYwa.exe
  2⤵
  PID:6680
- C:\Windows\System\WcEWZXf.exe
  C:\Windows\System\WcEWZXf.exe
  2⤵
  PID:6752
- C:\Windows\System\HCVPvQg.exe
  C:\Windows\System\HCVPvQg.exe
  2⤵
  PID:6780
- C:\Windows\System\rARlKsS.exe
  C:\Windows\System\rARlKsS.exe
  2⤵
  PID:6756
- C:\Windows\System\BrWKvrC.exe
  C:\Windows\System\BrWKvrC.exe
  2⤵
  PID:6860
- C:\Windows\System\zIrOqrw.exe
  C:\Windows\System\zIrOqrw.exe
  2⤵
  PID:6892
- C:\Windows\System\IthgDHK.exe
  C:\Windows\System\IthgDHK.exe
  2⤵
  PID:6908
- C:\Windows\System\QxfNGIq.exe
  C:\Windows\System\QxfNGIq.exe
  2⤵
  PID:6916
- C:\Windows\System\zVLogCX.exe
  C:\Windows\System\zVLogCX.exe
  2⤵
  PID:6672
- C:\Windows\System\OmwIeVd.exe
  C:\Windows\System\OmwIeVd.exe
  2⤵
  PID:6964
- C:\Windows\System\lMZbxzl.exe
  C:\Windows\System\lMZbxzl.exe
  2⤵
  PID:6980
- C:\Windows\System\eUgMKXB.exe
  C:\Windows\System\eUgMKXB.exe
  2⤵
  PID:6988
- C:\Windows\System\qYzwAwt.exe
  C:\Windows\System\qYzwAwt.exe
  2⤵
  PID:7076
- C:\Windows\System\IDiJIEW.exe
  C:\Windows\System\IDiJIEW.exe
  2⤵
  PID:7040
- C:\Windows\System\ZkMXCXs.exe
  C:\Windows\System\ZkMXCXs.exe
  2⤵
  PID:7116
- C:\Windows\System\BEXzjPS.exe
  C:\Windows\System\BEXzjPS.exe
  2⤵
  PID:7092
- C:\Windows\System\UEWKNoy.exe
  C:\Windows\System\UEWKNoy.exe
  2⤵
  PID:7128
- C:\Windows\System\waiERlL.exe
  C:\Windows\System\waiERlL.exe
  2⤵
  PID:7132
- C:\Windows\System\OnbUvwV.exe
  C:\Windows\System\OnbUvwV.exe
  2⤵
  PID:6224
- C:\Windows\System\LatxiMz.exe
  C:\Windows\System\LatxiMz.exe
  2⤵
  PID:6492
- C:\Windows\System\mjQTsDc.exe
  C:\Windows\System\mjQTsDc.exe
  2⤵
  PID:6148
- C:\Windows\System\tqjKfqP.exe
  C:\Windows\System\tqjKfqP.exe
  2⤵
  PID:6304
- C:\Windows\System\igSgYfu.exe
  C:\Windows\System\igSgYfu.exe
  2⤵
  PID:6432
- C:\Windows\System\kdUJpPS.exe
  C:\Windows\System\kdUJpPS.exe
  2⤵
  PID:6660
- C:\Windows\System\rYQakiq.exe
  C:\Windows\System\rYQakiq.exe
  2⤵
  PID:6724
- C:\Windows\System\VPdMRYH.exe
  C:\Windows\System\VPdMRYH.exe
  2⤵
  PID:6872
- C:\Windows\System\apSpabH.exe
  C:\Windows\System\apSpabH.exe
  2⤵
  PID:6960
- C:\Windows\System\IlOBgzn.exe
  C:\Windows\System\IlOBgzn.exe
  2⤵
  PID:6808
- C:\Windows\System\tCsIffY.exe
  C:\Windows\System\tCsIffY.exe
  2⤵
  PID:6840
- C:\Windows\System\Uwaxxpz.exe
  C:\Windows\System\Uwaxxpz.exe
  2⤵
  PID:6976
- C:\Windows\System\TwEURcQ.exe
  C:\Windows\System\TwEURcQ.exe
  2⤵
  PID:6852
- C:\Windows\System\iVclxKP.exe
  C:\Windows\System\iVclxKP.exe
  2⤵
  PID:4420
- C:\Windows\System\NYEKjzP.exe
  C:\Windows\System\NYEKjzP.exe
  2⤵
  PID:7064
- C:\Windows\System\UvOpQqK.exe
  C:\Windows\System\UvOpQqK.exe
  2⤵
  PID:6856
- C:\Windows\System\GUazTxh.exe
  C:\Windows\System\GUazTxh.exe
  2⤵
  PID:7112
- C:\Windows\System\pewnNSb.exe
  C:\Windows\System\pewnNSb.exe
  2⤵
  PID:6424
- C:\Windows\System\LkpwmRB.exe
  C:\Windows\System\LkpwmRB.exe
  2⤵
  PID:6828
- C:\Windows\System\OPZHHSN.exe
  C:\Windows\System\OPZHHSN.exe
  2⤵
  PID:2500
- C:\Windows\System\ZxVWkrb.exe
  C:\Windows\System\ZxVWkrb.exe
  2⤵
  PID:6664
- C:\Windows\System\rKWJyUK.exe
  C:\Windows\System\rKWJyUK.exe
  2⤵
  PID:6736
- C:\Windows\System\bMpJkVP.exe
  C:\Windows\System\bMpJkVP.exe
  2⤵
  PID:6712
- C:\Windows\System\OiXykKd.exe
  C:\Windows\System\OiXykKd.exe
  2⤵
  PID:6720
- C:\Windows\System\nBvHKDK.exe
  C:\Windows\System\nBvHKDK.exe
  2⤵
  PID:7144
- C:\Windows\System\XDpJkwl.exe
  C:\Windows\System\XDpJkwl.exe
  2⤵
  PID:7016
- C:\Windows\System\QCafevc.exe
  C:\Windows\System\QCafevc.exe
  2⤵
  PID:6352
- C:\Windows\System\WdKMBog.exe
  C:\Windows\System\WdKMBog.exe
  2⤵
  PID:6292
- C:\Windows\System\DSGsHkv.exe
  C:\Windows\System\DSGsHkv.exe
  2⤵
  PID:6260
- C:\Windows\System\AqJTYDb.exe
  C:\Windows\System\AqJTYDb.exe
  2⤵
  PID:6344
- C:\Windows\System\BlnnYnj.exe
  C:\Windows\System\BlnnYnj.exe
  2⤵
  PID:6232
- C:\Windows\System\WyzQEIa.exe
  C:\Windows\System\WyzQEIa.exe
  2⤵
  PID:6812
- C:\Windows\System\wQdGyQV.exe
  C:\Windows\System\wQdGyQV.exe
  2⤵
  PID:6832
- C:\Windows\System\xfMbNIH.exe
  C:\Windows\System\xfMbNIH.exe
  2⤵
  PID:6172
- C:\Windows\System\yTdraGO.exe
  C:\Windows\System\yTdraGO.exe
  2⤵
  PID:7196
- C:\Windows\System\bEbYKRc.exe
  C:\Windows\System\bEbYKRc.exe
  2⤵
  PID:7272
- C:\Windows\System\GkRPTuo.exe
  C:\Windows\System\GkRPTuo.exe
  2⤵
  PID:7348
- C:\Windows\System\NlUmVYg.exe
  C:\Windows\System\NlUmVYg.exe
  2⤵
  PID:7420
- C:\Windows\System\JhHIZht.exe
  C:\Windows\System\JhHIZht.exe
  2⤵
  PID:7576
- C:\Windows\System\wanLlPk.exe
  C:\Windows\System\wanLlPk.exe
  2⤵
  PID:7592
- C:\Windows\System\jYetJUA.exe
  C:\Windows\System\jYetJUA.exe
  2⤵
  PID:7608
- C:\Windows\System\GHQpGpX.exe
  C:\Windows\System\GHQpGpX.exe
  2⤵
  PID:7624
- C:\Windows\System\IUczoAR.exe
  C:\Windows\System\IUczoAR.exe
  2⤵
  PID:7640
- C:\Windows\System\ZOgGhfY.exe
  C:\Windows\System\ZOgGhfY.exe
  2⤵
  PID:7656
- C:\Windows\System\tgcfiYP.exe
  C:\Windows\System\tgcfiYP.exe
  2⤵
  PID:7672
- C:\Windows\System\KyZCGHM.exe
  C:\Windows\System\KyZCGHM.exe
  2⤵
  PID:7688
- C:\Windows\System\BnArdmg.exe
  C:\Windows\System\BnArdmg.exe
  2⤵
  PID:7704
- C:\Windows\System\TTsmzCc.exe
  C:\Windows\System\TTsmzCc.exe
  2⤵
  PID:7720
- C:\Windows\System\kFnkljB.exe
  C:\Windows\System\kFnkljB.exe
  2⤵
  PID:7796
- C:\Windows\System\QsRzMZm.exe
  C:\Windows\System\QsRzMZm.exe
  2⤵
  PID:7896
- C:\Windows\System\ylLpnyg.exe
  C:\Windows\System\ylLpnyg.exe
  2⤵
  PID:7912
- C:\Windows\System\vGvkgsh.exe
  C:\Windows\System\vGvkgsh.exe
  2⤵
  PID:7928
- C:\Windows\System\NpVTdhL.exe
  C:\Windows\System\NpVTdhL.exe
  2⤵
  PID:7944
- C:\Windows\System\nhIjViH.exe
  C:\Windows\System\nhIjViH.exe
  2⤵
  PID:7960
- C:\Windows\System\pHofEMz.exe
  C:\Windows\System\pHofEMz.exe
  2⤵
  PID:7976
- C:\Windows\System\HpZIwSL.exe
  C:\Windows\System\HpZIwSL.exe
  2⤵
  PID:7992
- C:\Windows\System\drblZZk.exe
  C:\Windows\System\drblZZk.exe
  2⤵
  PID:8080
- C:\Windows\System\CkvJnSV.exe
  C:\Windows\System\CkvJnSV.exe
  2⤵
  PID:8096
- C:\Windows\System\mOWVuJK.exe
  C:\Windows\System\mOWVuJK.exe
  2⤵
  PID:8112
- C:\Windows\System\hRdSSKM.exe
  C:\Windows\System\hRdSSKM.exe
  2⤵
  PID:8128
- C:\Windows\System\HIEgdID.exe
  C:\Windows\System\HIEgdID.exe
  2⤵
  PID:8148
- C:\Windows\System\QjaYdpX.exe
  C:\Windows\System\QjaYdpX.exe
  2⤵
  PID:8164
- C:\Windows\System\IFPsYeD.exe
  C:\Windows\System\IFPsYeD.exe
  2⤵
  PID:8184
- C:\Windows\System\oMhnxcR.exe
  C:\Windows\System\oMhnxcR.exe
  2⤵
  PID:6552
- C:\Windows\System\rvfnEFb.exe
  C:\Windows\System\rvfnEFb.exe
  2⤵
  PID:6824
- C:\Windows\System\qvhNtHi.exe
  C:\Windows\System\qvhNtHi.exe
  2⤵
  PID:6884
- C:\Windows\System\HgWiJmm.exe
  C:\Windows\System\HgWiJmm.exe
  2⤵
  PID:7232
- C:\Windows\System\ReGPspS.exe
  C:\Windows\System\ReGPspS.exe
  2⤵
  PID:7244
- C:\Windows\System\yjLyEMj.exe
  C:\Windows\System\yjLyEMj.exe
  2⤵
  PID:7252
- C:\Windows\System\ZNurXUJ.exe
  C:\Windows\System\ZNurXUJ.exe
  2⤵
  PID:7356
- C:\Windows\System\jhBshWp.exe
  C:\Windows\System\jhBshWp.exe
  2⤵
  PID:7392
- C:\Windows\System\Sjrktbt.exe
  C:\Windows\System\Sjrktbt.exe
  2⤵
  PID:7408
- C:\Windows\System\WOHalHX.exe
  C:\Windows\System\WOHalHX.exe
  2⤵
  PID:7288
- C:\Windows\System\kPiBOaD.exe
  C:\Windows\System\kPiBOaD.exe
  2⤵
  PID:7284
- C:\Windows\System\QNPIhmY.exe
  C:\Windows\System\QNPIhmY.exe
  2⤵
  PID:952
- C:\Windows\System\tXHEewN.exe
  C:\Windows\System\tXHEewN.exe
  2⤵
  PID:7588
- C:\Windows\System\pkbPvAQ.exe
  C:\Windows\System\pkbPvAQ.exe
  2⤵
  PID:7652
- C:\Windows\System\lfEuplb.exe
  C:\Windows\System\lfEuplb.exe
  2⤵
  PID:7716
- C:\Windows\System\ujpnVni.exe
  C:\Windows\System\ujpnVni.exe
  2⤵
  PID:7316
- C:\Windows\System\fHaDGrb.exe
  C:\Windows\System\fHaDGrb.exe
  2⤵
  PID:7332
- C:\Windows\System\pHCuUyd.exe
  C:\Windows\System\pHCuUyd.exe
  2⤵
  PID:7492
- C:\Windows\System\smmsuIj.exe
  C:\Windows\System\smmsuIj.exe
  2⤵
  PID:7452
- C:\Windows\System\ppAbLDl.exe
  C:\Windows\System\ppAbLDl.exe
  2⤵
  PID:7480
- C:\Windows\System\RjFNZFs.exe
  C:\Windows\System\RjFNZFs.exe
  2⤵
  PID:7512
- C:\Windows\System\THhTQti.exe
  C:\Windows\System\THhTQti.exe
  2⤵
  PID:7636
- C:\Windows\System\AOtkriu.exe
  C:\Windows\System\AOtkriu.exe
  2⤵
  PID:7696
- C:\Windows\System\SWgOeLu.exe
  C:\Windows\System\SWgOeLu.exe
  2⤵
  PID:7544
- C:\Windows\System\svpTvVh.exe
  C:\Windows\System\svpTvVh.exe
  2⤵
  PID:7728
- C:\Windows\System\qKBwrbK.exe
  C:\Windows\System\qKBwrbK.exe
  2⤵
  PID:7836
- C:\Windows\System\YCxPvXI.exe
  C:\Windows\System\YCxPvXI.exe
  2⤵
  PID:7868
- C:\Windows\System\LEcTbeR.exe
  C:\Windows\System\LEcTbeR.exe
  2⤵
  PID:7984
- C:\Windows\System\tePTKWd.exe
  C:\Windows\System\tePTKWd.exe
  2⤵
  PID:7856
- C:\Windows\System\XXVIeyq.exe
  C:\Windows\System\XXVIeyq.exe
  2⤵
  PID:8000
- C:\Windows\System\PeoQTbp.exe
  C:\Windows\System\PeoQTbp.exe
  2⤵
  PID:6240
- C:\Windows\System\ZDYlEMe.exe
  C:\Windows\System\ZDYlEMe.exe
  2⤵
  PID:6836
- C:\Windows\System\uNFicAk.exe
  C:\Windows\System\uNFicAk.exe
  2⤵
  PID:6208
- C:\Windows\System\PYfSNJi.exe
  C:\Windows\System\PYfSNJi.exe
  2⤵
  PID:7400
- C:\Windows\System\HJwPPkS.exe
  C:\Windows\System\HJwPPkS.exe
  2⤵
  PID:2096
- C:\Windows\System\ryUSJbG.exe
  C:\Windows\System\ryUSJbG.exe
  2⤵
  PID:7188
- C:\Windows\System\zBmIoKx.exe
  C:\Windows\System\zBmIoKx.exe
  2⤵
  PID:6252
- C:\Windows\System\LRYWBHr.exe
  C:\Windows\System\LRYWBHr.exe
  2⤵
  PID:7344
- C:\Windows\System\MAgRjxH.exe
  C:\Windows\System\MAgRjxH.exe
  2⤵
  PID:7484
- C:\Windows\System\BCqYUWu.exe
  C:\Windows\System\BCqYUWu.exe
  2⤵
  PID:7280
- C:\Windows\System\BVugKpU.exe
  C:\Windows\System\BVugKpU.exe
  2⤵
  PID:7648
- C:\Windows\System\LvvSpex.exe
  C:\Windows\System\LvvSpex.exe
  2⤵
  PID:7312
- C:\Windows\System\yLuuWOh.exe
  C:\Windows\System\yLuuWOh.exe
  2⤵
  PID:7464
- C:\Windows\System\BXzmKwG.exe
  C:\Windows\System\BXzmKwG.exe
  2⤵
  PID:7632
- C:\Windows\System\oHjHkuG.exe
  C:\Windows\System\oHjHkuG.exe
  2⤵
  PID:7736
- C:\Windows\System\uMGgXla.exe
  C:\Windows\System\uMGgXla.exe
  2⤵
  PID:6272
- C:\Windows\System\QKljKQd.exe
  C:\Windows\System\QKljKQd.exe
  2⤵
  PID:8104
- C:\Windows\System\erUkrJQ.exe
  C:\Windows\System\erUkrJQ.exe
  2⤵
  PID:8172
- C:\Windows\System\oTbWABB.exe
  C:\Windows\System\oTbWABB.exe
  2⤵
  PID:6376
- C:\Windows\System\UzZxUoY.exe
  C:\Windows\System\UzZxUoY.exe
  2⤵
  PID:8028
- C:\Windows\System\RQTygEm.exe
  C:\Windows\System\RQTygEm.exe
  2⤵
  PID:8040
- C:\Windows\System\hUeCWMD.exe
  C:\Windows\System\hUeCWMD.exe
  2⤵
  PID:7216
- C:\Windows\System\tbTtGVB.exe
  C:\Windows\System\tbTtGVB.exe
  2⤵
  PID:8136
- C:\Windows\System\vSvsLrY.exe
  C:\Windows\System\vSvsLrY.exe
  2⤵
  PID:2576
- C:\Windows\System\pBSgYxD.exe
  C:\Windows\System\pBSgYxD.exe
  2⤵
  PID:7852
- C:\Windows\System\xRuNmyB.exe
  C:\Windows\System\xRuNmyB.exe
  2⤵
  PID:7880
- C:\Windows\System\BsLrxRV.exe
  C:\Windows\System\BsLrxRV.exe
  2⤵
  PID:7876
- C:\Windows\System\UCdavTs.exe
  C:\Windows\System\UCdavTs.exe
  2⤵
  PID:7776
- C:\Windows\System\kpcrPFO.exe
  C:\Windows\System\kpcrPFO.exe
  2⤵
  PID:8020
- C:\Windows\System\bZwUXNo.exe
  C:\Windows\System\bZwUXNo.exe
  2⤵
  PID:8056
- C:\Windows\System\WNssaAw.exe
  C:\Windows\System\WNssaAw.exe
  2⤵
  PID:7004
- C:\Windows\System\zsHccLB.exe
  C:\Windows\System\zsHccLB.exe
  2⤵
  PID:8036
- C:\Windows\System\DwNUcsJ.exe
  C:\Windows\System\DwNUcsJ.exe
  2⤵
  PID:7712
- C:\Windows\System\UstWIZf.exe
  C:\Windows\System\UstWIZf.exe
  2⤵
  PID:7572
- C:\Windows\System\CIHBVin.exe
  C:\Windows\System\CIHBVin.exe
  2⤵
  PID:7368
- C:\Windows\System\XKflpfH.exe
  C:\Windows\System\XKflpfH.exe
  2⤵
  PID:7524
- C:\Windows\System\uFwfqIe.exe
  C:\Windows\System\uFwfqIe.exe
  2⤵
  PID:7620
- C:\Windows\System\VJLSeCx.exe
  C:\Windows\System\VJLSeCx.exe
  2⤵
  PID:7740
- C:\Windows\System\xBRLuMY.exe
  C:\Windows\System\xBRLuMY.exe
  2⤵
  PID:6932
- C:\Windows\System\PKTHkog.exe
  C:\Windows\System\PKTHkog.exe
  2⤵
  PID:2588
- C:\Windows\System\lXzsvyj.exe
  C:\Windows\System\lXzsvyj.exe
  2⤵
  PID:7388
- C:\Windows\System\dICvjgJ.exe
  C:\Windows\System\dICvjgJ.exe
  2⤵
  PID:7924
- C:\Windows\System\nYOyzlD.exe
  C:\Windows\System\nYOyzlD.exe
  2⤵
  PID:1944
- C:\Windows\System\GWUymgN.exe
  C:\Windows\System\GWUymgN.exe
  2⤵
  PID:5712
- C:\Windows\System\hisfYrY.exe
  C:\Windows\System\hisfYrY.exe
  2⤵
  PID:8060
- C:\Windows\System\TRRFTHJ.exe
  C:\Windows\System\TRRFTHJ.exe
  2⤵
  PID:7308
- C:\Windows\System\VvrDYAh.exe
  C:\Windows\System\VvrDYAh.exe
  2⤵
  PID:7468
- C:\Windows\System\doEqAnH.exe
  C:\Windows\System\doEqAnH.exe
  2⤵
  PID:7904
- C:\Windows\System\mVpvaYd.exe
  C:\Windows\System\mVpvaYd.exe
  2⤵
  PID:7516
- C:\Windows\System\SEWfwdC.exe
  C:\Windows\System\SEWfwdC.exe
  2⤵
  PID:8144
- C:\Windows\System\rIsjXrN.exe
  C:\Windows\System\rIsjXrN.exe
  2⤵
  PID:7184
- C:\Windows\System\WEeAqmL.exe
  C:\Windows\System\WEeAqmL.exe
  2⤵
  PID:7224
- C:\Windows\System\QvUGuRf.exe
  C:\Windows\System\QvUGuRf.exe
  2⤵
  PID:7664
- C:\Windows\System\UXsZTVd.exe
  C:\Windows\System\UXsZTVd.exe
  2⤵
  PID:7020
- C:\Windows\System\rexqcEh.exe
  C:\Windows\System\rexqcEh.exe
  2⤵
  PID:6588
- C:\Windows\System\RGEcvat.exe
  C:\Windows\System\RGEcvat.exe
  2⤵
  PID:7176
- C:\Windows\System\HpFbpVR.exe
  C:\Windows\System\HpFbpVR.exe
  2⤵
  PID:8092
- C:\Windows\System\knEWKBT.exe
  C:\Windows\System\knEWKBT.exe
  2⤵
  PID:8072
- C:\Windows\System\XwYWtAd.exe
  C:\Windows\System\XwYWtAd.exe
  2⤵
  PID:7384
- C:\Windows\System\tCjZxJH.exe
  C:\Windows\System\tCjZxJH.exe
  2⤵
  PID:6644
- C:\Windows\System\eNvKoYv.exe
  C:\Windows\System\eNvKoYv.exe
  2⤵
  PID:6776
- C:\Windows\System\PLhUErP.exe
  C:\Windows\System\PLhUErP.exe
  2⤵
  PID:7260
- C:\Windows\System\nmYHJlc.exe
  C:\Windows\System\nmYHJlc.exe
  2⤵
  PID:7204
- C:\Windows\System\NUiOovt.exe
  C:\Windows\System\NUiOovt.exe
  2⤵
  PID:8176
- C:\Windows\System\VNHDrts.exe
  C:\Windows\System\VNHDrts.exe
  2⤵
  PID:7940
- C:\Windows\System\QYuiAly.exe
  C:\Windows\System\QYuiAly.exe
  2⤵
  PID:1448
- C:\Windows\System\CBuiMne.exe
  C:\Windows\System\CBuiMne.exe
  2⤵
  PID:6556
- C:\Windows\System\Ietylvx.exe
  C:\Windows\System\Ietylvx.exe
  2⤵
  PID:7296
- C:\Windows\System\VfFzLTl.exe
  C:\Windows\System\VfFzLTl.exe
  2⤵
  PID:7812
- C:\Windows\System\thWvHTO.exe
  C:\Windows\System\thWvHTO.exe
  2⤵
  PID:7432
- C:\Windows\System\KVdhGwH.exe
  C:\Windows\System\KVdhGwH.exe
  2⤵
  PID:7892
- C:\Windows\System\AuAkeaS.exe
  C:\Windows\System\AuAkeaS.exe
  2⤵
  PID:7920
- C:\Windows\System\ZZHkRzk.exe
  C:\Windows\System\ZZHkRzk.exe
  2⤵
  PID:7748
- C:\Windows\System\lVuQwgW.exe
  C:\Windows\System\lVuQwgW.exe
  2⤵
  PID:8208
- C:\Windows\System\PpTWynQ.exe
  C:\Windows\System\PpTWynQ.exe
  2⤵
  PID:8224
- C:\Windows\System\uMkxyFU.exe
  C:\Windows\System\uMkxyFU.exe
  2⤵
  PID:8244
- C:\Windows\System\PxJNpLE.exe
  C:\Windows\System\PxJNpLE.exe
  2⤵
  PID:8264
- C:\Windows\System\nfEZbbW.exe
  C:\Windows\System\nfEZbbW.exe
  2⤵
  PID:8280
- C:\Windows\System\lnBsdCB.exe
  C:\Windows\System\lnBsdCB.exe
  2⤵
  PID:8296
- C:\Windows\System\EgCKgWK.exe
  C:\Windows\System\EgCKgWK.exe
  2⤵
  PID:8320
- C:\Windows\System\JQWoclo.exe
  C:\Windows\System\JQWoclo.exe
  2⤵
  PID:8340
- C:\Windows\System\GuJMjNe.exe
  C:\Windows\System\GuJMjNe.exe
  2⤵
  PID:8356
- C:\Windows\System\nEMZxlG.exe
  C:\Windows\System\nEMZxlG.exe
  2⤵
  PID:8376
- C:\Windows\System\jQPFBFC.exe
  C:\Windows\System\jQPFBFC.exe
  2⤵
  PID:8396
- C:\Windows\System\YtvAwrz.exe
  C:\Windows\System\YtvAwrz.exe
  2⤵
  PID:8412
- C:\Windows\System\AQsMMtZ.exe
  C:\Windows\System\AQsMMtZ.exe
  2⤵
  PID:8428
- C:\Windows\System\XrzPqnv.exe
  C:\Windows\System\XrzPqnv.exe
  2⤵
  PID:8448
- C:\Windows\System\uUHfgfF.exe
  C:\Windows\System\uUHfgfF.exe
  2⤵
  PID:8468
- C:\Windows\System\WDPZBoM.exe
  C:\Windows\System\WDPZBoM.exe
  2⤵
  PID:8488
- C:\Windows\System\VUvrIhx.exe
  C:\Windows\System\VUvrIhx.exe
  2⤵
  PID:8516
- C:\Windows\System\ULEaRrP.exe
  C:\Windows\System\ULEaRrP.exe
  2⤵
  PID:8596
- C:\Windows\System\SazDFzW.exe
  C:\Windows\System\SazDFzW.exe
  2⤵
  PID:8612
- C:\Windows\System\zezMSmK.exe
  C:\Windows\System\zezMSmK.exe
  2⤵
  PID:8628
- C:\Windows\System\SMPAzjx.exe
  C:\Windows\System\SMPAzjx.exe
  2⤵
  PID:8644
- C:\Windows\System\ZsyEbAe.exe
  C:\Windows\System\ZsyEbAe.exe
  2⤵
  PID:8660
- C:\Windows\System\bmjlBJk.exe
  C:\Windows\System\bmjlBJk.exe
  2⤵
  PID:8676
- C:\Windows\System\dwhrhom.exe
  C:\Windows\System\dwhrhom.exe
  2⤵
  PID:8692
- C:\Windows\System\vHvLVhs.exe
  C:\Windows\System\vHvLVhs.exe
  2⤵
  PID:8708
- C:\Windows\System\GwuHUvd.exe
  C:\Windows\System\GwuHUvd.exe
  2⤵
  PID:8728
- C:\Windows\System\uvLTcZV.exe
  C:\Windows\System\uvLTcZV.exe
  2⤵
  PID:8748
- C:\Windows\System\nzcPfQN.exe
  C:\Windows\System\nzcPfQN.exe
  2⤵
  PID:8768
- C:\Windows\System\YfGriWj.exe
  C:\Windows\System\YfGriWj.exe
  2⤵
  PID:8784
- C:\Windows\System\ECIIdsb.exe
  C:\Windows\System\ECIIdsb.exe
  2⤵
  PID:8804
- C:\Windows\System\SWUZaTB.exe
  C:\Windows\System\SWUZaTB.exe
  2⤵
  PID:8824
- C:\Windows\System\UnZhMpT.exe
  C:\Windows\System\UnZhMpT.exe
  2⤵
  PID:8840
- C:\Windows\System\OfUAyek.exe
  C:\Windows\System\OfUAyek.exe
  2⤵
  PID:8860
- C:\Windows\System\CKhlJOB.exe
  C:\Windows\System\CKhlJOB.exe
  2⤵
  PID:8876
- C:\Windows\System\dlBBzWl.exe
  C:\Windows\System\dlBBzWl.exe
  2⤵
  PID:8892
- C:\Windows\System\iuZLZiF.exe
  C:\Windows\System\iuZLZiF.exe
  2⤵
  PID:8912
- C:\Windows\System\kNBbETm.exe
  C:\Windows\System\kNBbETm.exe
  2⤵
  PID:8928
- C:\Windows\System\JfMKjwY.exe
  C:\Windows\System\JfMKjwY.exe
  2⤵
  PID:8944
- C:\Windows\System\hEDwMRH.exe
  C:\Windows\System\hEDwMRH.exe
  2⤵
  PID:8960
- C:\Windows\System\bgxDYcJ.exe
  C:\Windows\System\bgxDYcJ.exe
  2⤵
  PID:8976
- C:\Windows\System\mgffEaa.exe
  C:\Windows\System\mgffEaa.exe
  2⤵
  PID:8992
- C:\Windows\System\tZIceBC.exe
  C:\Windows\System\tZIceBC.exe
  2⤵
  PID:9008
- C:\Windows\System\ncmalgw.exe
  C:\Windows\System\ncmalgw.exe
  2⤵
  PID:9024
- C:\Windows\System\BoPqepU.exe
  C:\Windows\System\BoPqepU.exe
  2⤵
  PID:9040
- C:\Windows\System\pNWUTxG.exe
  C:\Windows\System\pNWUTxG.exe
  2⤵
  PID:9064
- C:\Windows\System\hvZftEs.exe
  C:\Windows\System\hvZftEs.exe
  2⤵
  PID:9084
- C:\Windows\System\NyJQONU.exe
  C:\Windows\System\NyJQONU.exe
  2⤵
  PID:9112
- C:\Windows\System\uCUecRF.exe
  C:\Windows\System\uCUecRF.exe
  2⤵
  PID:9132
- C:\Windows\System\VxHGAAa.exe
  C:\Windows\System\VxHGAAa.exe
  2⤵
  PID:9152
- C:\Windows\System\eWCzHVB.exe
  C:\Windows\System\eWCzHVB.exe
  2⤵
  PID:9168
- C:\Windows\System\SAVGIqT.exe
  C:\Windows\System\SAVGIqT.exe
  2⤵
  PID:9184
- C:\Windows\System\ZhLvIZN.exe
  C:\Windows\System\ZhLvIZN.exe
  2⤵
  PID:9200
- C:\Windows\System\IqXnYSc.exe
  C:\Windows\System\IqXnYSc.exe
  2⤵
  PID:8160
- C:\Windows\System\QsEJoAJ.exe
  C:\Windows\System\QsEJoAJ.exe
  2⤵
  PID:7444
- C:\Windows\System\IOOOVmH.exe
  C:\Windows\System\IOOOVmH.exe
  2⤵
  PID:6508
- C:\Windows\System\KqWbIbm.exe
  C:\Windows\System\KqWbIbm.exe
  2⤵
  PID:8260
- C:\Windows\System\vwALyzZ.exe
  C:\Windows\System\vwALyzZ.exe
  2⤵
  PID:8292
- C:\Windows\System\INRQmRd.exe
  C:\Windows\System\INRQmRd.exe
  2⤵
  PID:368
- C:\Windows\System\dbkOOde.exe
  C:\Windows\System\dbkOOde.exe
  2⤵
  PID:8240
- C:\Windows\System\dBRmcgd.exe
  C:\Windows\System\dBRmcgd.exe
  2⤵
  PID:1488
- C:\Windows\System\NxmuZez.exe
  C:\Windows\System\NxmuZez.exe
  2⤵
  PID:8180
- C:\Windows\System\JMsYSuI.exe
  C:\Windows\System\JMsYSuI.exe
  2⤵
  PID:8204
- C:\Windows\System\zULuykJ.exe
  C:\Windows\System\zULuykJ.exe
  2⤵
  PID:8304
- C:\Windows\System\ZhDDROb.exe
  C:\Windows\System\ZhDDROb.exe
  2⤵
  PID:7380
- C:\Windows\System\oOhYyKT.exe
  C:\Windows\System\oOhYyKT.exe
  2⤵
  PID:8368
- C:\Windows\System\ixSqRCQ.exe
  C:\Windows\System\ixSqRCQ.exe
  2⤵
  PID:8436
- C:\Windows\System\BMVtsFN.exe
  C:\Windows\System\BMVtsFN.exe
  2⤵
  PID:8484
- C:\Windows\System\mznhrRP.exe
  C:\Windows\System\mznhrRP.exe
  2⤵
  PID:8352
- C:\Windows\System\GbnDYQT.exe
  C:\Windows\System\GbnDYQT.exe
  2⤵
  PID:8424
- C:\Windows\System\KuoxPvr.exe
  C:\Windows\System\KuoxPvr.exe
  2⤵
  PID:8384
- C:\Windows\System\wJIHcIO.exe
  C:\Windows\System\wJIHcIO.exe
  2⤵
  PID:8512
- C:\Windows\System\VFiwmXJ.exe
  C:\Windows\System\VFiwmXJ.exe
  2⤵
  PID:8536
- C:\Windows\System\FvKosxe.exe
  C:\Windows\System\FvKosxe.exe
  2⤵
  PID:8568
- C:\Windows\System\vmbRIJA.exe
  C:\Windows\System\vmbRIJA.exe
  2⤵
  PID:8580
- C:\Windows\System\iEekHmt.exe
  C:\Windows\System\iEekHmt.exe
  2⤵
  PID:8620
- C:\Windows\System\IfGSjMf.exe
  C:\Windows\System\IfGSjMf.exe
  2⤵
  PID:8688
- C:\Windows\System\FsHApQP.exe
  C:\Windows\System\FsHApQP.exe
  2⤵
  PID:8636
- C:\Windows\System\klvzfZX.exe
  C:\Windows\System\klvzfZX.exe
  2⤵
  PID:8720
- C:\Windows\System\qSJjkFC.exe
  C:\Windows\System\qSJjkFC.exe
  2⤵
  PID:8792
- C:\Windows\System\DfxWPEs.exe
  C:\Windows\System\DfxWPEs.exe
  2⤵
  PID:8700
- C:\Windows\System\YOJJAYv.exe
  C:\Windows\System\YOJJAYv.exe
  2⤵
  PID:8744
- C:\Windows\System\tcmsEnN.exe
  C:\Windows\System\tcmsEnN.exe
  2⤵
  PID:8852
- C:\Windows\System\bKtHcrT.exe
  C:\Windows\System\bKtHcrT.exe
  2⤵
  PID:8872
- C:\Windows\System\qAcZoND.exe
  C:\Windows\System\qAcZoND.exe
  2⤵
  PID:8820
- C:\Windows\System\ZHxyyoT.exe
  C:\Windows\System\ZHxyyoT.exe
  2⤵
  PID:8968
- C:\Windows\System\gSdltjq.exe
  C:\Windows\System\gSdltjq.exe
  2⤵
  PID:956
- C:\Windows\System\YUabaSX.exe
  C:\Windows\System\YUabaSX.exe
  2⤵
  PID:9060
- C:\Windows\System\iXkOvQc.exe
  C:\Windows\System\iXkOvQc.exe
  2⤵
  PID:9056
- C:\Windows\System\ZPRIrhY.exe
  C:\Windows\System\ZPRIrhY.exe
  2⤵
  PID:9020
- C:\Windows\System\KAQUqOg.exe
  C:\Windows\System\KAQUqOg.exe
  2⤵
  PID:9108
- C:\Windows\System\UYHMcQZ.exe
  C:\Windows\System\UYHMcQZ.exe
  2⤵
  PID:9192
- C:\Windows\System\ZyDICrh.exe
  C:\Windows\System\ZyDICrh.exe
  2⤵
  PID:9176
- C:\Windows\System\stbCoYl.exe
  C:\Windows\System\stbCoYl.exe
  2⤵
  PID:8216
- C:\Windows\System\JnPjBdp.exe
  C:\Windows\System\JnPjBdp.exe
  2⤵
  PID:8256
- C:\Windows\System\pmIMwQy.exe
  C:\Windows\System\pmIMwQy.exe
  2⤵
  PID:8328
- C:\Windows\System\WLWFuIl.exe
  C:\Windows\System\WLWFuIl.exe
  2⤵
  PID:7952
- C:\Windows\System\HsGStUg.exe
  C:\Windows\System\HsGStUg.exe
  2⤵
  PID:7172
- C:\Windows\System\ddJGedP.exe
  C:\Windows\System\ddJGedP.exe
  2⤵
  PID:7848
- C:\Windows\System\SySAmkz.exe
  C:\Windows\System\SySAmkz.exe
  2⤵
  PID:2028
- C:\Windows\System\qyMgwIu.exe
  C:\Windows\System\qyMgwIu.exe
  2⤵
  PID:8196
- C:\Windows\System\KWHfUeq.exe
  C:\Windows\System\KWHfUeq.exe
  2⤵
  PID:8364
- C:\Windows\System\LFhFvhR.exe
  C:\Windows\System\LFhFvhR.exe
  2⤵
  PID:8348
- C:\Windows\System\TZkLTtz.exe
  C:\Windows\System\TZkLTtz.exe
  2⤵
  PID:8420
- C:\Windows\System\ufdHvAH.exe
  C:\Windows\System\ufdHvAH.exe
  2⤵
  PID:8532
- C:\Windows\System\QLTrehP.exe
  C:\Windows\System\QLTrehP.exe
  2⤵
  PID:8656
- C:\Windows\System\XrCTBJU.exe
  C:\Windows\System\XrCTBJU.exe
  2⤵
  PID:8684
- C:\Windows\System\bTqzNVW.exe
  C:\Windows\System\bTqzNVW.exe
  2⤵
  PID:2648
- C:\Windows\System\gOsAsbE.exe
  C:\Windows\System\gOsAsbE.exe
  2⤵
  PID:8800
- C:\Windows\System\aTTUxEm.exe
  C:\Windows\System\aTTUxEm.exe
  2⤵
  PID:8904
- C:\Windows\System\OXBkulV.exe
  C:\Windows\System\OXBkulV.exe
  2⤵
  PID:8940
- C:\Windows\System\ZTQhzHr.exe
  C:\Windows\System\ZTQhzHr.exe
  2⤵
  PID:8764
- C:\Windows\System\MWkctFo.exe
  C:\Windows\System\MWkctFo.exe
  2⤵
  PID:8868
- C:\Windows\System\drrlqoj.exe
  C:\Windows\System\drrlqoj.exe
  2⤵
  PID:8888
- C:\Windows\System\jFptLtq.exe
  C:\Windows\System\jFptLtq.exe
  2⤵
  PID:9048
- C:\Windows\System\rpzeIAc.exe
  C:\Windows\System\rpzeIAc.exe
  2⤵
  PID:9160
- C:\Windows\System\SlhWEIg.exe
  C:\Windows\System\SlhWEIg.exe
  2⤵
  PID:9208
- C:\Windows\System\GKEwaFa.exe
  C:\Windows\System\GKEwaFa.exe
  2⤵
  PID:7844
- C:\Windows\System\RdVUQQU.exe
  C:\Windows\System\RdVUQQU.exe
  2⤵
  PID:7768
- C:\Windows\System\sQsMJcq.exe
  C:\Windows\System\sQsMJcq.exe
  2⤵
  PID:8200
- C:\Windows\System\DOGWKxR.exe
  C:\Windows\System\DOGWKxR.exe
  2⤵
  PID:2152
- C:\Windows\System\sOqwQKm.exe
  C:\Windows\System\sOqwQKm.exe
  2⤵
  PID:4892
- C:\Windows\System\PWJrUxn.exe
  C:\Windows\System\PWJrUxn.exe
  2⤵
  PID:8392
- C:\Windows\System\dSaBpoV.exe
  C:\Windows\System\dSaBpoV.exe
  2⤵
  PID:8504
- C:\Windows\System\RVreXId.exe
  C:\Windows\System\RVreXId.exe
  2⤵
  PID:8560
- C:\Windows\System\ViZmVHj.exe
  C:\Windows\System\ViZmVHj.exe
  2⤵
  PID:8588
- C:\Windows\System\iCgIHly.exe
  C:\Windows\System\iCgIHly.exe
  2⤵
  PID:8724
- C:\Windows\System\vfTDVYg.exe
  C:\Windows\System\vfTDVYg.exe
  2⤵
  PID:2184
- C:\Windows\System\FonFZKk.exe
  C:\Windows\System\FonFZKk.exe
  2⤵
  PID:8760
- C:\Windows\System\OXBPspz.exe
  C:\Windows\System\OXBPspz.exe
  2⤵
  PID:8952
- C:\Windows\System\zNgsXdh.exe
  C:\Windows\System\zNgsXdh.exe
  2⤵
  PID:9000
- C:\Windows\System\iiqMoNY.exe
  C:\Windows\System\iiqMoNY.exe
  2⤵
  PID:8984
- C:\Windows\System\qhnTILC.exe
  C:\Windows\System\qhnTILC.exe
  2⤵
  PID:9144
- C:\Windows\System\bcoSjgM.exe
  C:\Windows\System\bcoSjgM.exe
  2⤵
  PID:7564
- C:\Windows\System\isfxRca.exe
  C:\Windows\System\isfxRca.exe
  2⤵
  PID:8988
- C:\Windows\System\MeEsnie.exe
  C:\Windows\System\MeEsnie.exe
  2⤵
  PID:7192
- C:\Windows\System\khHMSWZ.exe
  C:\Windows\System\khHMSWZ.exe
  2⤵
  PID:8524
- C:\Windows\System\rnnkayY.exe
  C:\Windows\System\rnnkayY.exe
  2⤵
  PID:8500
- C:\Windows\System\tYNKurV.exe
  C:\Windows\System\tYNKurV.exe
  2⤵
  PID:2672
- C:\Windows\System\XGsfBRv.exe
  C:\Windows\System\XGsfBRv.exe
  2⤵
  PID:2660
- C:\Windows\System\tFKvdXk.exe
  C:\Windows\System\tFKvdXk.exe
  2⤵
  PID:8776
- C:\Windows\System\bZdZJKW.exe
  C:\Windows\System\bZdZJKW.exe
  2⤵
  PID:8252
- C:\Windows\System\tnPMhga.exe
  C:\Windows\System\tnPMhga.exe
  2⤵
  PID:9104
- C:\Windows\System\ztllDCH.exe
  C:\Windows\System\ztllDCH.exe
  2⤵
  PID:9016
- C:\Windows\System\OKmqmAK.exe
  C:\Windows\System\OKmqmAK.exe
  2⤵
  PID:7908
- C:\Windows\System\FXqKZkT.exe
  C:\Windows\System\FXqKZkT.exe
  2⤵
  PID:8124
- C:\Windows\System\eBrzWSX.exe
  C:\Windows\System\eBrzWSX.exe
  2⤵
  PID:8972
- C:\Windows\System\nMHrtPW.exe
  C:\Windows\System\nMHrtPW.exe
  2⤵
  PID:7540
- C:\Windows\System\XjXRJnE.exe
  C:\Windows\System\XjXRJnE.exe
  2⤵
  PID:9148
- C:\Windows\System\mDxxQwZ.exe
  C:\Windows\System\mDxxQwZ.exe
  2⤵
  PID:8936
- C:\Windows\System\yKphQYU.exe
  C:\Windows\System\yKphQYU.exe
  2⤵
  PID:8408
- C:\Windows\System\TSPYeBC.exe
  C:\Windows\System\TSPYeBC.exe
  2⤵
  PID:4288
- C:\Windows\System\OMQpqxN.exe
  C:\Windows\System\OMQpqxN.exe
  2⤵
  PID:9220
- C:\Windows\System\ezTcGqi.exe
  C:\Windows\System\ezTcGqi.exe
  2⤵
  PID:9236
- C:\Windows\System\blsGMTK.exe
  C:\Windows\System\blsGMTK.exe
  2⤵
  PID:9256
- C:\Windows\System\WuQSNnL.exe
  C:\Windows\System\WuQSNnL.exe
  2⤵
  PID:9272
- C:\Windows\System\BZoTJkk.exe
  C:\Windows\System\BZoTJkk.exe
  2⤵
  PID:9288
- C:\Windows\System\FEqfSEU.exe
  C:\Windows\System\FEqfSEU.exe
  2⤵
  PID:9304
- C:\Windows\System\iFenbql.exe
  C:\Windows\System\iFenbql.exe
  2⤵
  PID:9324
- C:\Windows\System\BrydBwf.exe
  C:\Windows\System\BrydBwf.exe
  2⤵
  PID:9340
- C:\Windows\System\nFcRusC.exe
  C:\Windows\System\nFcRusC.exe
  2⤵
  PID:9356
- C:\Windows\System\qzrjjPP.exe
  C:\Windows\System\qzrjjPP.exe
  2⤵
  PID:9376
- C:\Windows\System\esXgSeR.exe
  C:\Windows\System\esXgSeR.exe
  2⤵
  PID:9392
- C:\Windows\System\LOzLGqg.exe
  C:\Windows\System\LOzLGqg.exe
  2⤵
  PID:9412
- C:\Windows\System\KzZznVX.exe
  C:\Windows\System\KzZznVX.exe
  2⤵
  PID:9428
- C:\Windows\System\VbAtLTb.exe
  C:\Windows\System\VbAtLTb.exe
  2⤵
  PID:9444
- C:\Windows\System\lOaHprM.exe
  C:\Windows\System\lOaHprM.exe
  2⤵
  PID:9460
- C:\Windows\System\mrALuQj.exe
  C:\Windows\System\mrALuQj.exe
  2⤵
  PID:9476
- C:\Windows\System\dkeHHZH.exe
  C:\Windows\System\dkeHHZH.exe
  2⤵
  PID:9496
- C:\Windows\System\iwAqsYC.exe
  C:\Windows\System\iwAqsYC.exe
  2⤵
  PID:9512
- C:\Windows\System\TRLbfJZ.exe
  C:\Windows\System\TRLbfJZ.exe
  2⤵
  PID:9528
- C:\Windows\System\ewPkTUL.exe
  C:\Windows\System\ewPkTUL.exe
  2⤵
  PID:9548
- C:\Windows\System\bNPnqsl.exe
  C:\Windows\System\bNPnqsl.exe
  2⤵
  PID:9564
- C:\Windows\System\MWirbdv.exe
  C:\Windows\System\MWirbdv.exe
  2⤵
  PID:9584
- C:\Windows\System\VJmwRiN.exe
  C:\Windows\System\VJmwRiN.exe
  2⤵
  PID:9600
- C:\Windows\System\XIqfsHW.exe
  C:\Windows\System\XIqfsHW.exe
  2⤵
  PID:9616
- C:\Windows\System\txwCmGt.exe
  C:\Windows\System\txwCmGt.exe
  2⤵
  PID:9632
- C:\Windows\System\ojvUBAW.exe
  C:\Windows\System\ojvUBAW.exe
  2⤵
  PID:9652
- C:\Windows\System\pcbdrnW.exe
  C:\Windows\System\pcbdrnW.exe
  2⤵
  PID:9672
- C:\Windows\System\eIZWFTc.exe
  C:\Windows\System\eIZWFTc.exe
  2⤵
  PID:9688
- C:\Windows\System\XOuWOhD.exe
  C:\Windows\System\XOuWOhD.exe
  2⤵
  PID:9704
- C:\Windows\System\FfzqMuM.exe
  C:\Windows\System\FfzqMuM.exe
  2⤵
  PID:9724
- C:\Windows\System\kIzuSpq.exe
  C:\Windows\System\kIzuSpq.exe
  2⤵
  PID:9744
- C:\Windows\System\dDXPQJx.exe
  C:\Windows\System\dDXPQJx.exe
  2⤵
  PID:9760
- C:\Windows\System\vBqZKQX.exe
  C:\Windows\System\vBqZKQX.exe
  2⤵
  PID:9776
- C:\Windows\System\JToUchU.exe
  C:\Windows\System\JToUchU.exe
  2⤵
  PID:9792
- C:\Windows\System\jPYsBIW.exe
  C:\Windows\System\jPYsBIW.exe
  2⤵
  PID:9808
- C:\Windows\System\jkgQlkO.exe
  C:\Windows\System\jkgQlkO.exe
  2⤵
  PID:9828
- C:\Windows\System\PknYlHg.exe
  C:\Windows\System\PknYlHg.exe
  2⤵
  PID:9844
- C:\Windows\System\zzhTwjU.exe
  C:\Windows\System\zzhTwjU.exe
  2⤵
  PID:9860
- C:\Windows\System\beLDFcP.exe
  C:\Windows\System\beLDFcP.exe
  2⤵
  PID:9876
- C:\Windows\System\weGpIfT.exe
  C:\Windows\System\weGpIfT.exe
  2⤵
  PID:9892
- C:\Windows\System\klDnjWD.exe
  C:\Windows\System\klDnjWD.exe
  2⤵
  PID:9908
- C:\Windows\System\LFNWMEN.exe
  C:\Windows\System\LFNWMEN.exe
  2⤵
  PID:9924
- C:\Windows\System\kzzHRWx.exe
  C:\Windows\System\kzzHRWx.exe
  2⤵
  PID:9940
- C:\Windows\System\HMMzkji.exe
  C:\Windows\System\HMMzkji.exe
  2⤵
  PID:9956
- C:\Windows\System\mYZfBfp.exe
  C:\Windows\System\mYZfBfp.exe
  2⤵
  PID:9972
- C:\Windows\System\IKbiSPd.exe
  C:\Windows\System\IKbiSPd.exe
  2⤵
  PID:9988
- C:\Windows\System\iQnZpmM.exe
  C:\Windows\System\iQnZpmM.exe
  2⤵
  PID:10004
- C:\Windows\System\JITYpWm.exe
  C:\Windows\System\JITYpWm.exe
  2⤵
  PID:10020
- C:\Windows\System\GbjQWVu.exe
  C:\Windows\System\GbjQWVu.exe
  2⤵
  PID:10040
- C:\Windows\System\VFQPtPZ.exe
  C:\Windows\System\VFQPtPZ.exe
  2⤵
  PID:10056
- C:\Windows\System\TeoSMXL.exe
  C:\Windows\System\TeoSMXL.exe
  2⤵
  PID:10072
- C:\Windows\System\QCTGVcH.exe
  C:\Windows\System\QCTGVcH.exe
  2⤵
  PID:10088
- C:\Windows\System\jQwpCdR.exe
  C:\Windows\System\jQwpCdR.exe
  2⤵
  PID:10104
- C:\Windows\System\KHlQgrR.exe
  C:\Windows\System\KHlQgrR.exe
  2⤵
  PID:10124
- C:\Windows\System\cSYAlkm.exe
  C:\Windows\System\cSYAlkm.exe
  2⤵
  PID:10140
- C:\Windows\System\lAjcJuA.exe
  C:\Windows\System\lAjcJuA.exe
  2⤵
  PID:10156
- C:\Windows\System\dccaKKC.exe
  C:\Windows\System\dccaKKC.exe
  2⤵
  PID:10172
- C:\Windows\System\WLofrVF.exe
  C:\Windows\System\WLofrVF.exe
  2⤵
  PID:10188
- C:\Windows\System\lKugvQy.exe
  C:\Windows\System\lKugvQy.exe
  2⤵
  PID:10204
- C:\Windows\System\iplKDVT.exe
  C:\Windows\System\iplKDVT.exe
  2⤵
  PID:10220
- C:\Windows\System\dSReBEl.exe
  C:\Windows\System\dSReBEl.exe
  2⤵
  PID:10236
- C:\Windows\System\IgGiWGj.exe
  C:\Windows\System\IgGiWGj.exe
  2⤵
  PID:9228
- C:\Windows\System\rMEVkZF.exe
  C:\Windows\System\rMEVkZF.exe
  2⤵
  PID:9284
- C:\Windows\System\fZGJdHB.exe
  C:\Windows\System\fZGJdHB.exe
  2⤵
  PID:9232
- C:\Windows\System\BMPcSjU.exe
  C:\Windows\System\BMPcSjU.exe
  2⤵
  PID:9300
- C:\Windows\System\uFtIaPq.exe
  C:\Windows\System\uFtIaPq.exe
  2⤵
  PID:9372
- C:\Windows\System\CHmKcrB.exe
  C:\Windows\System\CHmKcrB.exe
  2⤵
  PID:9384
- C:\Windows\System\KUMyfPX.exe
  C:\Windows\System\KUMyfPX.exe
  2⤵
  PID:9408
- C:\Windows\System\ByzoXUY.exe
  C:\Windows\System\ByzoXUY.exe
  2⤵
  PID:9456
- C:\Windows\System\TwQObgL.exe
  C:\Windows\System\TwQObgL.exe
  2⤵
  PID:9440
- C:\Windows\System\qjeeBQb.exe
  C:\Windows\System\qjeeBQb.exe
  2⤵
  PID:9504
- C:\Windows\System\HIZItet.exe
  C:\Windows\System\HIZItet.exe
  2⤵
  PID:9536
- C:\Windows\System\DVihGIE.exe
  C:\Windows\System\DVihGIE.exe
  2⤵
  PID:9560
- C:\Windows\System\VxFIZLo.exe
  C:\Windows\System\VxFIZLo.exe
  2⤵
  PID:9624
- C:\Windows\System\QjYQBbU.exe
  C:\Windows\System\QjYQBbU.exe
  2⤵
  PID:9664
- C:\Windows\System\fMUCTeO.exe
  C:\Windows\System\fMUCTeO.exe
  2⤵
  PID:9700
- C:\Windows\System\vhkfJlw.exe
  C:\Windows\System\vhkfJlw.exe
  2⤵
  PID:9644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BMHwzKM.exe

Filesize
1.8MB

MD5
13c88a19550a224e4fff294d4c427975

SHA1
1ff10f344a6678329a02966eee10e25ed8929e7f

SHA256
1d31f04f3b8453daf19d54496ab395689359b7d51cb595ecf234393cf76d4a06

SHA512
76ce7779d7af6c2924deb67e9475830922620990c73cf838e63daf6df96a30ea82199f33138d4b548a851618aa30e47891e897d6535834d9f593260b5668c13e

Download Submit
C:\Windows\system\BSUBUwv.exe

Filesize
1.8MB

MD5
ce870b429459c6461924854cda06817c

SHA1
6c669a261eb42c7a421bd0b4da84ccc577038a92

SHA256
b4f1a427a21ae7a899bed470178764b002dfd01f7568e0d15497711e55cc204c

SHA512
582c46dbe86d2a42832d7d09065fb9dcd02ecfe27ae09db4388edcb88227c7a1f31c4ed774eea5658bc66b0fa784e348b6df525f676618f2fc025c9ac9b049bd

Download Submit
C:\Windows\system\CdZtqDa.exe

Filesize
1.8MB

MD5
c970dd34d2926c63600d80abc6e25af5

SHA1
4b0e47529a2a37016ac16beb4f2d05b7b11821ee

SHA256
ef41267e106296c218104859c63db109a52a2cf951fe3054320912a708e8291d

SHA512
94c24face724eef9355a50f57e11e1603a26a6b8102c13bc31afefdcfb929c91835a2c43446f5a874c2e55938705b296176fb923cb7c4b6bc3f6902db695b622

Download Submit
C:\Windows\system\FIHvRMI.exe

Filesize
1.8MB

MD5
9d09fa9b665fc7884ece429a683cbb3f

SHA1
a0aeaba6c45ee5f508ba7b8158f936f05533c125

SHA256
eb525093907d66efa95462dd994ec62a619407412a95f8ae3046cd15533110b0

SHA512
9bbc7ad2a71c196ce05ef2cfb761ac5fcbcf833e478ae3890d5665187052c9b95b331f6bbaa12e154b463834eab485ca625c296fe2fdf4940004dc7fe554ff18

Download Submit
C:\Windows\system\GpRrudG.exe

Filesize
1.8MB

MD5
0ab7018ebdf2f0ee8965d44fe2aa9578

SHA1
583e8cf0797d825ab2223211e5ce90856d4b609b

SHA256
80ad8f39aa4683540432d48be370d1f20773b6a686259240787c778292d865f6

SHA512
090b26cf3736c1cf90aeec2f5a09788b6a2bba546467d225400b725c122f3369bc3aaf60f82855a92f773bc3eca142fa4edb4625ef939b56b0dd88b9bf9be0bc

Download Submit
C:\Windows\system\HJuzDbG.exe

Filesize
1.8MB

MD5
0cf11f5e652a0b54846afc83b095925e

SHA1
454138bbe4c0d952a05360eaea5c7f55976e7bee

SHA256
910f1c2096a676f4ed8b1314a40241abab7a0512adb35769ebb89eda246e4e2d

SHA512
e7ce83c800087ffd7165646b494164c69d1f26b27171a229deb23ffe9d5c9c584592f95e5a607676b227317f8918b85fabfc4722409ed0c32c517ff6edc56c76

Download Submit
C:\Windows\system\IcwVsgb.exe

Filesize
1.8MB

MD5
be76000287aef4dedb2970505fc73e0f

SHA1
f504c792a2487bc7ae8106e5c99a71b1f4104dad

SHA256
952493e95e5ea34c41b56b86f8ff2b861979b9f110016ea6324f92eb92788541

SHA512
7dbddf7ddf7a9616fccf41f65ea5fdcc63b6015b452a75689a7ecec267835d90591b3c887203845c7e41c82af9ba51aa3d005e5595a1858fe79977262bac84cd

Download Submit
C:\Windows\system\KzpfITm.exe

Filesize
1.8MB

MD5
3b6aa646066075b21305742a2fc8b1d9

SHA1
f37b6398b54f4be8e78cf60b551c5b26edf08ad8

SHA256
71b9cc43971bcaa33cb2d989c02fde29bd3b5986d93e34965a3e38f1494d7e18

SHA512
f5c0ed1fc3c08585450d5dea909d3f776c1404ce11463f08260b70b40dfc5b2036d3f731718a8109b93647b526bc1872c02429eae5af1d3c4f49f15673ec3e26

Download Submit
C:\Windows\system\LwYSBiS.exe

Filesize
1.8MB

MD5
a75f983d82918e6e38c9c78e9e1da6b4

SHA1
0ec5880c284dacd3d178a6c13e8eea091d806580

SHA256
8850c9db30e615fe10d4ce8607cc608a4a3040f91c48887f2d7a71d48636022c

SHA512
af1cba11b15a71cdc9e5143003cae1ef817ab5ab94bfead6058823921961080b4286a83956b9e773b515831a8e5710f1ec6cb77716e460c5cf9d08e05921b2b0

Download Submit
C:\Windows\system\LxMcRVR.exe

Filesize
1.8MB

MD5
bab724a8ae44c97413de0bd34ac608f0

SHA1
4bbfa4261a118a3140017d31a44d28b2eb14f842

SHA256
b76da5b65143ebcaa4bde09b70ead9dcf4bbf8ff22e4a39001714eba1d5a303d

SHA512
728e3c01536a4253eee700b62d478d953d7c818dbdcccbae8b2fac1f1137e097c8fe2c46dfe7128fc304c3db84462a0f703c28921e089a783a7214e8ac2b9e1b

Download Submit
C:\Windows\system\MRJRkur.exe

Filesize
1.8MB

MD5
30f904b2fea656b5b1aad8efbe1b40df

SHA1
1d7a180a9265c8e579d8e6e43cca8a12b2b09cd2

SHA256
633352ac073aa8999f10ab4bcd9a8a19ca9e1cf36c7fb2e0b5640d38941a8855

SHA512
145ca4f6eb0f652512e2b47e8460df6625110ac68c575c193fecdcec9f6ebf9d89d48f0ec7d478c308c9c981b8d5ab1a4f974dd7d327ee93f3ed3ce5261c8cac

Download Submit
C:\Windows\system\MUBFFny.exe

Filesize
1.8MB

MD5
b1cbccfabae529add7a35df49a38ad9b

SHA1
e0e715a70ed88564d11795f4dd7e4a39f43a8b29

SHA256
734fb773c5fc13233b5f140f02115e6acc38fe4235b605a2d32d2d612c607924

SHA512
aa247bf98e2b561fc38a5235666163593421e7ba349e75a72b14c5592ef088f78f37d9502c8a36c6420fa345a8ab95316986566fcc01afd6da2054a3c6e42e5b

Download Submit
C:\Windows\system\NaImHJM.exe

Filesize
1.8MB

MD5
1cf35157841aa0c729103471b6887935

SHA1
0c1fd4ea92555a3c888fb6f3b6a3fb2da1e0bd02

SHA256
2b102ca552890c3e4abb988ac34a039aeced7a78492ed008137d360e9b04e6f6

SHA512
455968fec3c9fb0fc16e632d92d80178d1240e788c39114254772e3b3b7012f181dc0e2bb9751cca77bc1a37c260408536e71456a534068ac21c11a695deceff

Download Submit
C:\Windows\system\REfYjAF.exe

Filesize
1.8MB

MD5
02c5ee6ebf9f5d83754204b53bed9ee1

SHA1
76072279ee99b12a03526b1cf3ac2fac3f95a453

SHA256
e0dc0e3e56cde18c9719f2631787faf3bfcae962db2e9f85af9a81584e675645

SHA512
58ed5a47e2c37cdab42d3ab8b326f476838a41c41e5ca4d59c1f43a914c91262cf2f9a0c9c75c9c6919163224c766d91de9f2584faad24f0dd49a25d54f1a561

Download Submit
C:\Windows\system\RVZsild.exe

Filesize
1.8MB

MD5
e6e312db90ef0e6addcb3e00075a37e6

SHA1
21301318764614f33bd99bb14770193959924535

SHA256
e0c63170d53bf69e67723fd15a0600b71cef0bef5620eb4a1fe2e6c7cd0bac51

SHA512
023a331fd51897e088b3f1ad1c49a6e2889f4b35f2b06732ed06d221cba9abbf72f3ce90c5837da1de43aa620953c2a3d6b1caf8c379d11a57a571ae13aa58dd

Download Submit
C:\Windows\system\UayNNsI.exe

Filesize
1.8MB

MD5
9d41b343052b10b39bb844a8e7db83c9

SHA1
6adfc608175111ffeb616bc00f295f6a4cd2efff

SHA256
ad018a8128f3bf22477ed4d31bda96e6797623e136cff80d8a8d360fdec4817f

SHA512
9655e43d33a1966ead000842238a854dc3e3cc5c2e8016945b9443613447f840d4a3ca4a15849f3de555264c8ba76fc1be9b712801ebac46928d52cfae9603c3

Download Submit
C:\Windows\system\UbOPDME.exe

Filesize
1.8MB

MD5
25181b6caa725ffc94ea7612a355e210

SHA1
0bbc587efe8cfb6d34fe69f8941c5127c244c8da

SHA256
f5167df7776f2148d22ce7418ddad5b38ea41487d66ce5b44e336971f06f56e2

SHA512
9e10a7bd267be207d91dae6205fc08b6af6b084904bf3245d346486674a17f2d22753f59cf467e7d490e883a18ebf815064a6db598dccc40e166543e98ec8e8a

Download Submit
C:\Windows\system\UiYQfWv.exe

Filesize
1.8MB

MD5
06b764b691724312a2aa1da0a275c827

SHA1
2a9f560b5c7ed002b5a8bccb0f52982abdb4d340

SHA256
446f54662aef125c7c8970f52c9dcb3fb3a1038dff5dad57e7ac05d335b7f43b

SHA512
7c730d2f6e87b9b6b19efd069eb071e1ca3aa5ed356dd80fe686aba7bcfea66fda9919a4435690078b46289e03a9be822e75149e039eb57f1e0cdd78002177de

Download Submit
C:\Windows\system\WMIvQIF.exe

Filesize
1.8MB

MD5
8505e54e6532b86c4a1e6d258d29dc66

SHA1
4be546d7853f04162301b4e43b8fd1351c02e002

SHA256
a643fa35ce5996a95a9e1906615e0c1209084d3166eb0676d61432a6b54e6448

SHA512
5394bd7ec0a5558fdc79738a323bb890592e1ee4c97c1104f4e0426ba60401fe51ec0b7c122431b26fbe4e7e24c5d7195e2169a1555127a1748d0ee8af88e959

Download Submit
C:\Windows\system\WbQHVVW.exe

Filesize
1.8MB

MD5
1aa5cc7e1769296229cd546598a2c5e3

SHA1
9752c0527bbb29c065439e28cdbfff587c1083b7

SHA256
e920e5878e2c2d7c915c816ea88003bbd962c948368a707005a95559bc590cc3

SHA512
d2bd534cd819dcb6605008d57419d544f712a8d3a87cc4ecf508bfac2d687e89b596ed07e9010e25a4c34a4b761196e7f1e1136f0915dd118c7e579243d1a32d

Download Submit
C:\Windows\system\WcupcAl.exe

Filesize
1.8MB

MD5
3ff14d90ec4ecb22bdf32d28aab2f720

SHA1
806e62e0a8a5e5503a4237c1299b02ba3d12d91f

SHA256
1769e2dd3325ed6c272ae9bf02fcc33111a45da168a87fe8667e775abe1f975e

SHA512
c41d4334cc53538328fb889892c34a9c4f1d673f9019827929822d842f55542de6d5ba432c72ac35451494b8682989d73dbcaf5d4fc0e7ba5b505797d564e38a

Download Submit
C:\Windows\system\bkjxreH.exe

Filesize
1.8MB

MD5
1b2700a6c6aa12233a48f6c357ffc363

SHA1
541bf37a65b686b52e8d8800249dbd4f45cc082b

SHA256
e192a71a1717554b3f7a4cd94c1c8c7a7086f121f9bfc37c05fa4573a708d9a3

SHA512
52073b5734d95ccf96bf4c2db5d677d104108a28a1562930ec3901f669927690fb6ac369ed41e3de34f5e6ef84033fde0087bd0cedf702994dead81bc6594e77

Download Submit
C:\Windows\system\fmNsqss.exe

Filesize
1.8MB

MD5
2051d7941dabe0cdd31f23eb9fdb7b1a

SHA1
5e2437d38dafb3df22a53e1d7785b2c15a2d8996

SHA256
8ff8081ae89d7d70e1ad1ce5ed572b32d7255c8eb451829d6aad6d2fa68360a4

SHA512
d4d36262c441b6372d57e5c571ecdb8dba3552d9d7864ddaf8756932c5483c251223cb36ab30443a620dbe7bc99bac9bfa418572cadb28107cbd236f9d839988

Download Submit
C:\Windows\system\jmUEJor.exe

Filesize
1.8MB

MD5
d2f767d9f1b38d343ab33c665ecf4a89

SHA1
7716d5387b0a95c267f4fcd50e7b71eba657f2e4

SHA256
1a4b14a94e3f8495a38855cda01da553e37d20c0a6b89addb9f52961ac67736e

SHA512
fae67ddfce351f7d0e9413e913eea67a538f2ed31399ea13bb0bee4f800cad7bbacfbd867ba94f3be17d3eb4657ac628d875ce82209274abdfd2fdfd2d569e4a

Download Submit
C:\Windows\system\kZrhbTt.exe

Filesize
1.8MB

MD5
296c8a73f92f7bbd99974b9784ed0286

SHA1
66abf314045a75f29bc8a045ba0e403c14bb0de8

SHA256
8907549c3151464d1eff76b7ce60107747f1906b3393f87ffd764e794a8166af

SHA512
b1f18621ce8055133adea5084ab19c350dbd03f1a12736bf5beef6015d4e7d6f6d418209c1edc08bbb323ea7d4ea6d6a0c52d2db2f6aac24c844ce5e3c7763fd

Download Submit
C:\Windows\system\luchdiK.exe

Filesize
1.8MB

MD5
810a0d0b21386a35a1f36633280dbfd6

SHA1
17afe7a83e5b7696dbd903e0467b978aca602f91

SHA256
c905eabc572a103f0c7045978947faec65ab30d8209207e8b2093d49f4da8aca

SHA512
b5ca971fe732515c2c73f30a2bad038dd18b22c42cdeef181a585fca11b350b3fe4354185ef5dc7987dfd045c9cf400f2421828d0a43d50846ece9048a3b8ef6

Download Submit
C:\Windows\system\tajiKlY.exe

Filesize
1.8MB

MD5
2d6a468af73fbf148f74c5c4dc29fa7f

SHA1
b4f2d5941fd4aa31bd06a1e83c909a8b5793aa2b

SHA256
c4bd7af307aff67a5ecc8e5e7cadf67d037d6e118ab3cdfd0f0dfb5e7f9bc13d

SHA512
429957aa8bf44781c336c24d7643c1723d1cb3ff7accf46f04badd848c08e1856b00ecc9b83f9feca47a5f307fbe5cc62452aaaa5302d30bdc134933b3ffd2a3

Download Submit
C:\Windows\system\uCnlROX.exe

Filesize
1.8MB

MD5
5ef7473713ef5450a34e39d4e4af193d

SHA1
2f22af7acaf5416496bc75b1ea9896d8e23ffd05

SHA256
168f1886b370b0124b83afd871647bc195d0f8510f41407c41f24a8df779738c

SHA512
51c3c112d73d3026678983a5fe3ed44f287626400c11f16f8b2ae979b69310b42152886bad24eaec5553f31af4a815fa26e2a1e0033436cbe94a7af3fe843cfd

Download Submit
C:\Windows\system\ujjZHRL.exe

Filesize
1.8MB

MD5
fe7a3f226b2070b262b39c414b5199f4

SHA1
b42c98a28a3fb25c3564a794565e3c118b308346

SHA256
8f3d52db6b5a4dd68e5aacc2476eb3a6e7050b5d415fcdfccc351b5e24e01586

SHA512
06fbfd566076c485e0582da362e559d43b884729b6290e0cb2cd0b52acbbdb96f684420b3f340fac324e4f21d9955ca8152aa70386c0fc88ea5635bb7a0b0bd7

Download Submit
C:\Windows\system\vOOjSPA.exe

Filesize
1.8MB

MD5
6f58683886571c1862ce79fce415d0f9

SHA1
4678c5d90192ee85d768fd6524ca6d3670185141

SHA256
f47420ca5693dbce6df7ddcdb9544e9962b2246b2e94c6454560924e6a920653

SHA512
61880e9a17fce5cbe11dda4b507cb6fe1c398879fa7f9dc02027f0500fe74aa922ec0ac2216243e5da7a8b9141b98d1062d88027e4c5d2f8e913fb64532f7cd2

Download Submit
\Windows\system\MWWBaKd.exe

Filesize
1.8MB

MD5
cb262f3e7c182a2986aeb4aff37ef37c

SHA1
df410a5c14912a9f51d06910243cd47dad3b107d

SHA256
7ce0482c6c3aecd415ff0bed0d565a03aaeafc66fc3dbbb27ec516f6cda8401f

SHA512
322472e8ed1c8fcf005505fce9802f846e0badef6bb5a90f5b094868f32ed8978e498bc3ad72fc2a2220faf66a47c92ed6b3fa01ca24ebf1cde83876e9aed98d

Download Submit
\Windows\system\oCZwolA.exe

Filesize
1.8MB

MD5
2b69d696de1bb766cd67e79304450e90

SHA1
6e1d1d29d472f7c903196f4d008a230d7fd7f190

SHA256
d2ec15dd93cc10a393b64ce601b84f4274cf950d1bd4a4ed6e46dc6d548a7df0

SHA512
d9dc2842317c264803181fe26f06396fdd9add00b18ffada3b43bd6972512de4312b0df7a0dc71a567e3ee6127fe9321072be7d2094313f613a0eb7644751278

Download Submit
memory/1368-12-0x00000000029A0000-0x0000000002D92000-memory.dmp

Filesize
3.9MB

Download
memory/1368-151-0x0000000002D00000-0x00000000030F2000-memory.dmp

Filesize
3.9MB

Download
memory/1368-0-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/1368-150-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/1368-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1368-144-0x0000000002D00000-0x00000000030F2000-memory.dmp

Filesize
3.9MB

Download
memory/1368-148-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/1368-142-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/1368-5-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/1368-140-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/1368-146-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/1368-138-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2276-466-0x0000000002040000-0x0000000002048000-memory.dmp

Filesize
32KB

Download
memory/2276-135-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/2276-134-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2276-436-0x000000001B270000-0x000000001B552000-memory.dmp

Filesize
2.9MB

Download
memory/2276-3163-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2276-137-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2412-2437-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2412-147-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2508-1815-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2508-145-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2516-149-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2516-2247-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2520-136-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2520-2252-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2732-141-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2732-2387-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-2571-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2872-143-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2872-2438-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2908-2263-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2908-139-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2932-2267-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2932-13-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download