xmrig | e3be9b621a4c731d1479f15911b39cb5fafb5896799e3d2a999f252318f62191

Analysis

max time kernel
28s
max time network
28s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
Size

2.1MB
MD5

041d479cfd747b24ce963a07bce643b0
SHA1

6eb271f263d63b8311cb0b3d0b09b44b616caf66
SHA256

e3be9b621a4c731d1479f15911b39cb5fafb5896799e3d2a999f252318f62191
SHA512

ec2b6597f0b3ab78ba006550ea5adfbe1d54d4b075b204a130ddc79823713dbcdb804df384bd74be90b9781938c3595a62624c42a4180cd199c926d61eeef71c
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafws1PU:NABR

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2708-95-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/2436-97-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig
behavioral1/memory/2576-105-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2864-103-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2484-99-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2464-94-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/2276-1254-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2672	WlTCDWh.exe
2552	mbmKPXJ.exe
2652	GzRGqQI.exe
2576	FtIWMDa.exe
2464	MIUoSxx.exe
2708	udsEjtl.exe
2436	DGHfbio.exe
2484	QXOzOaF.exe
2864	XKGDFxz.exe
1804	dobRQgm.exe
1700	BZSfInl.exe
1464	nlkXBpu.exe
2528	mJgPhMM.exe
1744	qpsxwpi.exe
2856	SjPFaxH.exe
1884	VcYKMZc.exe
2180	ctiuYLC.exe
1244	zVyDcYc.exe
1452	ENIFcxS.exe
2064	riTlqJe.exe
2804	wHvhxsf.exe
1180	nlEhtTM.exe
2320	cufsKMQ.exe
2344	CgakwBG.exe
2808	cTQepvn.exe
856	AkTauoG.exe
700	KzvgfNN.exe
108	NHAIGBW.exe
588	iuNYvKo.exe
1120	LLCoDrv.exe
640	QKYYLRa.exe
1812	jZrgDBv.exe
1800	IMJniOr.exe
2212	YSiqFdR.exe
2408	FtyrPnJ.exe
3048	pSMhVZt.exe
2088	SzvyZJL.exe
1792	TEyhBQC.exe
1552	PBslRHr.exe
1392	iihnVtA.exe
960	ZepdWEI.exe
2836	YFOCUJl.exe
2848	HvBwebb.exe
2184	NXwGewZ.exe
556	AOWEflI.exe
3000	MvSssRJ.exe
768	UchAhMa.exe
1752	BLkYWca.exe
2792	icuYpOe.exe
2116	mEfBFCw.exe
2056	KPMadJQ.exe
2968	MmkGtxq.exe
2356	DyDQXZw.exe
1428	VvYemnq.exe
1328	ozbjVTQ.exe
2280	OSTPeAq.exe
1520	eTMuidM.exe
2128	bSxBGyv.exe
1728	eEEOVYs.exe
1768	AsXaIuR.exe
2040	sEooOVE.exe
2060	FJQXEpQ.exe
3036	oTqaKmu.exe
2724	bvxntlW.exe

Loads dropped DLL 64 IoCs

pid	Process
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2276-0-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/files/0x000c00000001443b-5.dat	upx
behavioral1/files/0x0007000000014a9a-14.dat	upx
behavioral1/files/0x00340000000146fc-13.dat	upx
behavioral1/memory/2652-23-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/memory/2552-18-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/files/0x0007000000014b18-24.dat	upx
behavioral1/memory/2672-9-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/files/0x000e0000000054ab-33.dat	upx
behavioral1/files/0x0008000000014bbc-42.dat	upx
behavioral1/files/0x0008000000015ce3-51.dat	upx
behavioral1/files/0x0006000000015cff-56.dat	upx
behavioral1/files/0x0006000000015d42-66.dat	upx
behavioral1/files/0x0006000000015d56-75.dat	upx
behavioral1/files/0x0006000000015d6b-86.dat	upx
behavioral1/memory/2708-95-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/2436-97-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/files/0x0006000000015d5f-101.dat	upx
behavioral1/memory/2576-105-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/files/0x0006000000015ecc-129.dat	upx
behavioral1/files/0x0006000000015e32-137.dat	upx
behavioral1/files/0x00060000000164aa-153.dat	upx
behavioral1/files/0x0006000000016c44-173.dat	upx
behavioral1/files/0x0006000000016adc-169.dat	upx
behavioral1/files/0x0006000000016851-165.dat	upx
behavioral1/files/0x000600000001658a-157.dat	upx
behavioral1/files/0x0006000000016616-161.dat	upx
behavioral1/files/0x000600000001630a-149.dat	upx
behavioral1/files/0x000600000001610f-141.dat	upx
behavioral1/files/0x000600000001621e-145.dat	upx
behavioral1/files/0x0006000000015f65-130.dat	upx
behavioral1/files/0x003400000001471a-117.dat	upx
behavioral1/files/0x0006000000015fe5-135.dat	upx
behavioral1/files/0x0006000000015d93-122.dat	upx
behavioral1/files/0x0006000000015d7f-109.dat	upx
behavioral1/files/0x0006000000015d87-114.dat	upx
behavioral1/memory/2864-103-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2484-99-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2464-94-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/files/0x0006000000015d4e-71.dat	upx
behavioral1/files/0x0006000000015d20-61.dat	upx
behavioral1/files/0x0009000000014fa2-47.dat	upx
behavioral1/memory/2276-1254-0x000000013F770000-0x000000013FB62000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iuNYvKo.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\uOCCEqf.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\BXcpkLW.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\IvyljzZ.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\bujiAEK.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\mbpopDq.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\VDxBZGr.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\dhUMKgk.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\tsyvmmu.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\gGcFOgc.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\oXwCcAw.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\xlJFBGr.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\LlHlUvM.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\folidqI.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\OoPZaCT.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\yeJiAFt.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\DuEBhCQ.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\YeXsGhv.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\sIEIuVY.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\WFiHFSZ.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\OQulEtv.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\IbuLnpp.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\PmVJEDk.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\Ssfhwer.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\PonfArP.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\kHAlFFk.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\zhpBVXy.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\SBIfJpX.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\mOqhySZ.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\MVvuKGf.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\LtypHkr.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\ZUHAdai.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\CkgAaeN.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\fTELIjb.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\HdLbjry.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\XdYJHsW.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\WgRQHXP.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\fJIJZVT.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\xSUNVqI.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\UYxNFSC.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\gsJdNDn.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\kWqrXNZ.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\rtyYJQn.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\KSAIsiw.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\fEPGhAp.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\EXlMfWb.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\ogRBtSu.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\fNcPeHw.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\PUhVSmp.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\QPCjzOS.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\qNuBGrq.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\hDlNnlG.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\STmqoQd.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\CgqajXE.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\FDCRkSi.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\PtSZtTt.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\WNOQmnX.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\IjaZDki.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\UlnBVga.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\EFRWSRD.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\eTMuidM.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\JOSGhEo.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\LCQkArc.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
File created	C:\Windows\System\ervpVtg.exe	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2008	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
Token: SeDebugPrivilege	2008	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2008	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	29
PID 2276 wrote to memory of 2008	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	29
PID 2276 wrote to memory of 2008	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	29
PID 2276 wrote to memory of 2672	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	30
PID 2276 wrote to memory of 2672	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	30
PID 2276 wrote to memory of 2672	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	30
PID 2276 wrote to memory of 2552	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	31
PID 2276 wrote to memory of 2552	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	31
PID 2276 wrote to memory of 2552	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	31
PID 2276 wrote to memory of 2652	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	32
PID 2276 wrote to memory of 2652	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	32
PID 2276 wrote to memory of 2652	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	32
PID 2276 wrote to memory of 2576	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	33
PID 2276 wrote to memory of 2576	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	33
PID 2276 wrote to memory of 2576	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	33
PID 2276 wrote to memory of 2464	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	34
PID 2276 wrote to memory of 2464	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	34
PID 2276 wrote to memory of 2464	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	34
PID 2276 wrote to memory of 2708	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	35
PID 2276 wrote to memory of 2708	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	35
PID 2276 wrote to memory of 2708	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	35
PID 2276 wrote to memory of 2436	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	36
PID 2276 wrote to memory of 2436	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	36
PID 2276 wrote to memory of 2436	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	36
PID 2276 wrote to memory of 2484	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	37
PID 2276 wrote to memory of 2484	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	37
PID 2276 wrote to memory of 2484	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	37
PID 2276 wrote to memory of 2864	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	38
PID 2276 wrote to memory of 2864	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	38
PID 2276 wrote to memory of 2864	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	38
PID 2276 wrote to memory of 1804	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	39
PID 2276 wrote to memory of 1804	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	39
PID 2276 wrote to memory of 1804	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	39
PID 2276 wrote to memory of 1700	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	40
PID 2276 wrote to memory of 1700	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	40
PID 2276 wrote to memory of 1700	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	40
PID 2276 wrote to memory of 1464	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	41
PID 2276 wrote to memory of 1464	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	41
PID 2276 wrote to memory of 1464	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	41
PID 2276 wrote to memory of 2528	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	42
PID 2276 wrote to memory of 2528	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	42
PID 2276 wrote to memory of 2528	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	42
PID 2276 wrote to memory of 2856	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	43
PID 2276 wrote to memory of 2856	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	43
PID 2276 wrote to memory of 2856	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	43
PID 2276 wrote to memory of 1744	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	44
PID 2276 wrote to memory of 1744	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	44
PID 2276 wrote to memory of 1744	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	44
PID 2276 wrote to memory of 1884	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	45
PID 2276 wrote to memory of 1884	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	45
PID 2276 wrote to memory of 1884	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	45
PID 2276 wrote to memory of 2180	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	46
PID 2276 wrote to memory of 2180	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	46
PID 2276 wrote to memory of 2180	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	46
PID 2276 wrote to memory of 1244	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	47
PID 2276 wrote to memory of 1244	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	47
PID 2276 wrote to memory of 1244	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	47
PID 2276 wrote to memory of 1452	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	48
PID 2276 wrote to memory of 1452	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	48
PID 2276 wrote to memory of 1452	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	48
PID 2276 wrote to memory of 1180	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	49
PID 2276 wrote to memory of 1180	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	49
PID 2276 wrote to memory of 1180	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	49
PID 2276 wrote to memory of 2064	2276	041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\041d479cfd747b24ce963a07bce643b0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2008
- C:\Windows\System\WlTCDWh.exe
  C:\Windows\System\WlTCDWh.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\mbmKPXJ.exe
  C:\Windows\System\mbmKPXJ.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\GzRGqQI.exe
  C:\Windows\System\GzRGqQI.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\FtIWMDa.exe
  C:\Windows\System\FtIWMDa.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\MIUoSxx.exe
  C:\Windows\System\MIUoSxx.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\udsEjtl.exe
  C:\Windows\System\udsEjtl.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\DGHfbio.exe
  C:\Windows\System\DGHfbio.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\QXOzOaF.exe
  C:\Windows\System\QXOzOaF.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\XKGDFxz.exe
  C:\Windows\System\XKGDFxz.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\dobRQgm.exe
  C:\Windows\System\dobRQgm.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\BZSfInl.exe
  C:\Windows\System\BZSfInl.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\nlkXBpu.exe
  C:\Windows\System\nlkXBpu.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\mJgPhMM.exe
  C:\Windows\System\mJgPhMM.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\SjPFaxH.exe
  C:\Windows\System\SjPFaxH.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\qpsxwpi.exe
  C:\Windows\System\qpsxwpi.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\VcYKMZc.exe
  C:\Windows\System\VcYKMZc.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\ctiuYLC.exe
  C:\Windows\System\ctiuYLC.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\zVyDcYc.exe
  C:\Windows\System\zVyDcYc.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\ENIFcxS.exe
  C:\Windows\System\ENIFcxS.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\nlEhtTM.exe
  C:\Windows\System\nlEhtTM.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\riTlqJe.exe
  C:\Windows\System\riTlqJe.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\cufsKMQ.exe
  C:\Windows\System\cufsKMQ.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\wHvhxsf.exe
  C:\Windows\System\wHvhxsf.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\CgakwBG.exe
  C:\Windows\System\CgakwBG.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\cTQepvn.exe
  C:\Windows\System\cTQepvn.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\AkTauoG.exe
  C:\Windows\System\AkTauoG.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\KzvgfNN.exe
  C:\Windows\System\KzvgfNN.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\NHAIGBW.exe
  C:\Windows\System\NHAIGBW.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\iuNYvKo.exe
  C:\Windows\System\iuNYvKo.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\LLCoDrv.exe
  C:\Windows\System\LLCoDrv.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\QKYYLRa.exe
  C:\Windows\System\QKYYLRa.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\jZrgDBv.exe
  C:\Windows\System\jZrgDBv.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\IMJniOr.exe
  C:\Windows\System\IMJniOr.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\YSiqFdR.exe
  C:\Windows\System\YSiqFdR.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\FtyrPnJ.exe
  C:\Windows\System\FtyrPnJ.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\pSMhVZt.exe
  C:\Windows\System\pSMhVZt.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\SzvyZJL.exe
  C:\Windows\System\SzvyZJL.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\TEyhBQC.exe
  C:\Windows\System\TEyhBQC.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\PBslRHr.exe
  C:\Windows\System\PBslRHr.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\iihnVtA.exe
  C:\Windows\System\iihnVtA.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\ZepdWEI.exe
  C:\Windows\System\ZepdWEI.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\AOWEflI.exe
  C:\Windows\System\AOWEflI.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\YFOCUJl.exe
  C:\Windows\System\YFOCUJl.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\MvSssRJ.exe
  C:\Windows\System\MvSssRJ.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\HvBwebb.exe
  C:\Windows\System\HvBwebb.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\UchAhMa.exe
  C:\Windows\System\UchAhMa.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\NXwGewZ.exe
  C:\Windows\System\NXwGewZ.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\BLkYWca.exe
  C:\Windows\System\BLkYWca.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\icuYpOe.exe
  C:\Windows\System\icuYpOe.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\mEfBFCw.exe
  C:\Windows\System\mEfBFCw.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\KPMadJQ.exe
  C:\Windows\System\KPMadJQ.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\MmkGtxq.exe
  C:\Windows\System\MmkGtxq.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\DyDQXZw.exe
  C:\Windows\System\DyDQXZw.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\VvYemnq.exe
  C:\Windows\System\VvYemnq.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\ozbjVTQ.exe
  C:\Windows\System\ozbjVTQ.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\OSTPeAq.exe
  C:\Windows\System\OSTPeAq.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\eTMuidM.exe
  C:\Windows\System\eTMuidM.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\bSxBGyv.exe
  C:\Windows\System\bSxBGyv.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\eEEOVYs.exe
  C:\Windows\System\eEEOVYs.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\AsXaIuR.exe
  C:\Windows\System\AsXaIuR.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\sEooOVE.exe
  C:\Windows\System\sEooOVE.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\FJQXEpQ.exe
  C:\Windows\System\FJQXEpQ.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\oTqaKmu.exe
  C:\Windows\System\oTqaKmu.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\MdAzwGn.exe
  C:\Windows\System\MdAzwGn.exe
  2⤵
  PID:2568
- C:\Windows\System\bvxntlW.exe
  C:\Windows\System\bvxntlW.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\WRyAmYf.exe
  C:\Windows\System\WRyAmYf.exe
  2⤵
  PID:2580
- C:\Windows\System\ZWojPaY.exe
  C:\Windows\System\ZWojPaY.exe
  2⤵
  PID:2156
- C:\Windows\System\vCLWDul.exe
  C:\Windows\System\vCLWDul.exe
  2⤵
  PID:2444
- C:\Windows\System\fpeCqIS.exe
  C:\Windows\System\fpeCqIS.exe
  2⤵
  PID:2564
- C:\Windows\System\hpKkXjH.exe
  C:\Windows\System\hpKkXjH.exe
  2⤵
  PID:1548
- C:\Windows\System\cmixWYl.exe
  C:\Windows\System\cmixWYl.exe
  2⤵
  PID:2888
- C:\Windows\System\vDKgcOH.exe
  C:\Windows\System\vDKgcOH.exe
  2⤵
  PID:2744
- C:\Windows\System\fjvKMDy.exe
  C:\Windows\System\fjvKMDy.exe
  2⤵
  PID:2748
- C:\Windows\System\pFWHlkh.exe
  C:\Windows\System\pFWHlkh.exe
  2⤵
  PID:2268
- C:\Windows\System\jJnSqfa.exe
  C:\Windows\System\jJnSqfa.exe
  2⤵
  PID:1204
- C:\Windows\System\QXdbRUe.exe
  C:\Windows\System\QXdbRUe.exe
  2⤵
  PID:1632
- C:\Windows\System\AdaodGd.exe
  C:\Windows\System\AdaodGd.exe
  2⤵
  PID:1240
- C:\Windows\System\nanGttC.exe
  C:\Windows\System\nanGttC.exe
  2⤵
  PID:2764
- C:\Windows\System\LeQXNgP.exe
  C:\Windows\System\LeQXNgP.exe
  2⤵
  PID:2288
- C:\Windows\System\CLJrJVF.exe
  C:\Windows\System\CLJrJVF.exe
  2⤵
  PID:2312
- C:\Windows\System\kIPXcGs.exe
  C:\Windows\System\kIPXcGs.exe
  2⤵
  PID:336
- C:\Windows\System\EBPZimd.exe
  C:\Windows\System\EBPZimd.exe
  2⤵
  PID:1704
- C:\Windows\System\OfipvED.exe
  C:\Windows\System\OfipvED.exe
  2⤵
  PID:1504
- C:\Windows\System\aBADLVy.exe
  C:\Windows\System\aBADLVy.exe
  2⤵
  PID:2656
- C:\Windows\System\fLhvIkm.exe
  C:\Windows\System\fLhvIkm.exe
  2⤵
  PID:448
- C:\Windows\System\uHAUTXX.exe
  C:\Windows\System\uHAUTXX.exe
  2⤵
  PID:1388
- C:\Windows\System\gtWcGHq.exe
  C:\Windows\System\gtWcGHq.exe
  2⤵
  PID:2412
- C:\Windows\System\msgVaTU.exe
  C:\Windows\System\msgVaTU.exe
  2⤵
  PID:1248
- C:\Windows\System\sRgieLh.exe
  C:\Windows\System\sRgieLh.exe
  2⤵
  PID:3040
- C:\Windows\System\qXXuHru.exe
  C:\Windows\System\qXXuHru.exe
  2⤵
  PID:1796
- C:\Windows\System\WNOQmnX.exe
  C:\Windows\System\WNOQmnX.exe
  2⤵
  PID:384
- C:\Windows\System\pyJoQHt.exe
  C:\Windows\System\pyJoQHt.exe
  2⤵
  PID:664
- C:\Windows\System\NgBoiOQ.exe
  C:\Windows\System\NgBoiOQ.exe
  2⤵
  PID:1216
- C:\Windows\System\wuKqYZk.exe
  C:\Windows\System\wuKqYZk.exe
  2⤵
  PID:2368
- C:\Windows\System\tIqmdgg.exe
  C:\Windows\System\tIqmdgg.exe
  2⤵
  PID:2828
- C:\Windows\System\EYgomFj.exe
  C:\Windows\System\EYgomFj.exe
  2⤵
  PID:3064
- C:\Windows\System\IdbRpgk.exe
  C:\Windows\System\IdbRpgk.exe
  2⤵
  PID:1732
- C:\Windows\System\cQuNtXv.exe
  C:\Windows\System\cQuNtXv.exe
  2⤵
  PID:2072
- C:\Windows\System\UMqipeC.exe
  C:\Windows\System\UMqipeC.exe
  2⤵
  PID:1736
- C:\Windows\System\DmvKVsE.exe
  C:\Windows\System\DmvKVsE.exe
  2⤵
  PID:1624
- C:\Windows\System\bmzlICT.exe
  C:\Windows\System\bmzlICT.exe
  2⤵
  PID:2660
- C:\Windows\System\xfEmdus.exe
  C:\Windows\System\xfEmdus.exe
  2⤵
  PID:2092
- C:\Windows\System\FOgiGva.exe
  C:\Windows\System\FOgiGva.exe
  2⤵
  PID:2668
- C:\Windows\System\uOCCEqf.exe
  C:\Windows\System\uOCCEqf.exe
  2⤵
  PID:2616
- C:\Windows\System\joUAPvh.exe
  C:\Windows\System\joUAPvh.exe
  2⤵
  PID:2396
- C:\Windows\System\eibqyQK.exe
  C:\Windows\System\eibqyQK.exe
  2⤵
  PID:2176
- C:\Windows\System\sDuRtUF.exe
  C:\Windows\System\sDuRtUF.exe
  2⤵
  PID:2420
- C:\Windows\System\GiFndjU.exe
  C:\Windows\System\GiFndjU.exe
  2⤵
  PID:560
- C:\Windows\System\ZkLirad.exe
  C:\Windows\System\ZkLirad.exe
  2⤵
  PID:3076
- C:\Windows\System\SQbgGKo.exe
  C:\Windows\System\SQbgGKo.exe
  2⤵
  PID:3092
- C:\Windows\System\RbniTiq.exe
  C:\Windows\System\RbniTiq.exe
  2⤵
  PID:3108
- C:\Windows\System\kXzKSHX.exe
  C:\Windows\System\kXzKSHX.exe
  2⤵
  PID:3124
- C:\Windows\System\dJHqVpQ.exe
  C:\Windows\System\dJHqVpQ.exe
  2⤵
  PID:3140
- C:\Windows\System\PrxtUxL.exe
  C:\Windows\System\PrxtUxL.exe
  2⤵
  PID:3156
- C:\Windows\System\jNbAhov.exe
  C:\Windows\System\jNbAhov.exe
  2⤵
  PID:3172
- C:\Windows\System\LlHlUvM.exe
  C:\Windows\System\LlHlUvM.exe
  2⤵
  PID:3188
- C:\Windows\System\YFDqRLP.exe
  C:\Windows\System\YFDqRLP.exe
  2⤵
  PID:3204
- C:\Windows\System\yjsPCVt.exe
  C:\Windows\System\yjsPCVt.exe
  2⤵
  PID:3220
- C:\Windows\System\KinokkN.exe
  C:\Windows\System\KinokkN.exe
  2⤵
  PID:3236
- C:\Windows\System\PSpWAzm.exe
  C:\Windows\System\PSpWAzm.exe
  2⤵
  PID:3252
- C:\Windows\System\PGGVlTw.exe
  C:\Windows\System\PGGVlTw.exe
  2⤵
  PID:3268
- C:\Windows\System\XDBZmPK.exe
  C:\Windows\System\XDBZmPK.exe
  2⤵
  PID:3284
- C:\Windows\System\IbuLnpp.exe
  C:\Windows\System\IbuLnpp.exe
  2⤵
  PID:3300
- C:\Windows\System\xUCCMVq.exe
  C:\Windows\System\xUCCMVq.exe
  2⤵
  PID:3316
- C:\Windows\System\fCEajqO.exe
  C:\Windows\System\fCEajqO.exe
  2⤵
  PID:3332
- C:\Windows\System\fyZQbFM.exe
  C:\Windows\System\fyZQbFM.exe
  2⤵
  PID:3348
- C:\Windows\System\fEERYSh.exe
  C:\Windows\System\fEERYSh.exe
  2⤵
  PID:3364
- C:\Windows\System\TdDXaoa.exe
  C:\Windows\System\TdDXaoa.exe
  2⤵
  PID:3380
- C:\Windows\System\bPqyMrX.exe
  C:\Windows\System\bPqyMrX.exe
  2⤵
  PID:3396
- C:\Windows\System\WTfaTyH.exe
  C:\Windows\System\WTfaTyH.exe
  2⤵
  PID:3412
- C:\Windows\System\vpEwqrL.exe
  C:\Windows\System\vpEwqrL.exe
  2⤵
  PID:3428
- C:\Windows\System\YFBVXVE.exe
  C:\Windows\System\YFBVXVE.exe
  2⤵
  PID:3816
- C:\Windows\System\yucigEh.exe
  C:\Windows\System\yucigEh.exe
  2⤵
  PID:3836
- C:\Windows\System\OsfGHxR.exe
  C:\Windows\System\OsfGHxR.exe
  2⤵
  PID:3852
- C:\Windows\System\vckNVZO.exe
  C:\Windows\System\vckNVZO.exe
  2⤵
  PID:3868
- C:\Windows\System\WWkBUFE.exe
  C:\Windows\System\WWkBUFE.exe
  2⤵
  PID:3884
- C:\Windows\System\KyPorYW.exe
  C:\Windows\System\KyPorYW.exe
  2⤵
  PID:3900
- C:\Windows\System\ZnxSPOX.exe
  C:\Windows\System\ZnxSPOX.exe
  2⤵
  PID:3916
- C:\Windows\System\xgtemse.exe
  C:\Windows\System\xgtemse.exe
  2⤵
  PID:3940
- C:\Windows\System\QveWQUs.exe
  C:\Windows\System\QveWQUs.exe
  2⤵
  PID:4080
- C:\Windows\System\SuFkwDB.exe
  C:\Windows\System\SuFkwDB.exe
  2⤵
  PID:1952
- C:\Windows\System\GqSWFVW.exe
  C:\Windows\System\GqSWFVW.exe
  2⤵
  PID:692
- C:\Windows\System\nyHgfed.exe
  C:\Windows\System\nyHgfed.exe
  2⤵
  PID:2908
- C:\Windows\System\rpCpTSd.exe
  C:\Windows\System\rpCpTSd.exe
  2⤵
  PID:2872
- C:\Windows\System\OkTVfKH.exe
  C:\Windows\System\OkTVfKH.exe
  2⤵
  PID:784
- C:\Windows\System\kgFXvet.exe
  C:\Windows\System\kgFXvet.exe
  2⤵
  PID:3120
- C:\Windows\System\rBqdcDo.exe
  C:\Windows\System\rBqdcDo.exe
  2⤵
  PID:2472
- C:\Windows\System\nuvTanZ.exe
  C:\Windows\System\nuvTanZ.exe
  2⤵
  PID:3248
- C:\Windows\System\ywPpZow.exe
  C:\Windows\System\ywPpZow.exe
  2⤵
  PID:3344
- C:\Windows\System\ZdQSYxT.exe
  C:\Windows\System\ZdQSYxT.exe
  2⤵
  PID:3408
- C:\Windows\System\awgNreu.exe
  C:\Windows\System\awgNreu.exe
  2⤵
  PID:3448
- C:\Windows\System\zZrDBLJ.exe
  C:\Windows\System\zZrDBLJ.exe
  2⤵
  PID:3464
- C:\Windows\System\PlkhPOP.exe
  C:\Windows\System\PlkhPOP.exe
  2⤵
  PID:3480
- C:\Windows\System\EilWiLw.exe
  C:\Windows\System\EilWiLw.exe
  2⤵
  PID:3504
- C:\Windows\System\zqLlLvc.exe
  C:\Windows\System\zqLlLvc.exe
  2⤵
  PID:3532
- C:\Windows\System\ozaINsF.exe
  C:\Windows\System\ozaINsF.exe
  2⤵
  PID:3548
- C:\Windows\System\cttBAgA.exe
  C:\Windows\System\cttBAgA.exe
  2⤵
  PID:3568
- C:\Windows\System\vMVbZTD.exe
  C:\Windows\System\vMVbZTD.exe
  2⤵
  PID:3584
- C:\Windows\System\fTELIjb.exe
  C:\Windows\System\fTELIjb.exe
  2⤵
  PID:3608
- C:\Windows\System\lqRdgXH.exe
  C:\Windows\System\lqRdgXH.exe
  2⤵
  PID:3628
- C:\Windows\System\LkwODir.exe
  C:\Windows\System\LkwODir.exe
  2⤵
  PID:3648
- C:\Windows\System\UKAOHOl.exe
  C:\Windows\System\UKAOHOl.exe
  2⤵
  PID:3664
- C:\Windows\System\TCHaiMn.exe
  C:\Windows\System\TCHaiMn.exe
  2⤵
  PID:3684
- C:\Windows\System\folidqI.exe
  C:\Windows\System\folidqI.exe
  2⤵
  PID:3704
- C:\Windows\System\NEQBWFe.exe
  C:\Windows\System\NEQBWFe.exe
  2⤵
  PID:3728
- C:\Windows\System\BcAqhAb.exe
  C:\Windows\System\BcAqhAb.exe
  2⤵
  PID:3752
- C:\Windows\System\pZsujtu.exe
  C:\Windows\System\pZsujtu.exe
  2⤵
  PID:3772
- C:\Windows\System\pFIetNK.exe
  C:\Windows\System\pFIetNK.exe
  2⤵
  PID:3792
- C:\Windows\System\HIOtYLA.exe
  C:\Windows\System\HIOtYLA.exe
  2⤵
  PID:3848
- C:\Windows\System\pVxOIFI.exe
  C:\Windows\System\pVxOIFI.exe
  2⤵
  PID:3912
- C:\Windows\System\dQbeFMB.exe
  C:\Windows\System\dQbeFMB.exe
  2⤵
  PID:2248
- C:\Windows\System\mqYSucM.exe
  C:\Windows\System\mqYSucM.exe
  2⤵
  PID:2244
- C:\Windows\System\HMDuufn.exe
  C:\Windows\System\HMDuufn.exe
  2⤵
  PID:1348
- C:\Windows\System\uxQkgwS.exe
  C:\Windows\System\uxQkgwS.exe
  2⤵
  PID:2536
- C:\Windows\System\kpCstcp.exe
  C:\Windows\System\kpCstcp.exe
  2⤵
  PID:3972
- C:\Windows\System\HTmwUuT.exe
  C:\Windows\System\HTmwUuT.exe
  2⤵
  PID:2256
- C:\Windows\System\GYmeQYQ.exe
  C:\Windows\System\GYmeQYQ.exe
  2⤵
  PID:3996
- C:\Windows\System\IWQCWxg.exe
  C:\Windows\System\IWQCWxg.exe
  2⤵
  PID:2084
- C:\Windows\System\xfHeDpG.exe
  C:\Windows\System\xfHeDpG.exe
  2⤵
  PID:4024
- C:\Windows\System\zBKqiNX.exe
  C:\Windows\System\zBKqiNX.exe
  2⤵
  PID:4040
- C:\Windows\System\dvRdNDJ.exe
  C:\Windows\System\dvRdNDJ.exe
  2⤵
  PID:412
- C:\Windows\System\pkbussy.exe
  C:\Windows\System\pkbussy.exe
  2⤵
  PID:4044
- C:\Windows\System\NDXpTlz.exe
  C:\Windows\System\NDXpTlz.exe
  2⤵
  PID:4064
- C:\Windows\System\DHgqsHY.exe
  C:\Windows\System\DHgqsHY.exe
  2⤵
  PID:3928
- C:\Windows\System\qrUSAoJ.exe
  C:\Windows\System\qrUSAoJ.exe
  2⤵
  PID:2780
- C:\Windows\System\UwNxgCh.exe
  C:\Windows\System\UwNxgCh.exe
  2⤵
  PID:2000
- C:\Windows\System\fXlcfbC.exe
  C:\Windows\System\fXlcfbC.exe
  2⤵
  PID:2784
- C:\Windows\System\hykJncc.exe
  C:\Windows\System\hykJncc.exe
  2⤵
  PID:2688
- C:\Windows\System\CflmpYr.exe
  C:\Windows\System\CflmpYr.exe
  2⤵
  PID:3100
- C:\Windows\System\XUpgKYF.exe
  C:\Windows\System\XUpgKYF.exe
  2⤵
  PID:3136
- C:\Windows\System\kWqrXNZ.exe
  C:\Windows\System\kWqrXNZ.exe
  2⤵
  PID:3200
- C:\Windows\System\CVfUXFB.exe
  C:\Windows\System\CVfUXFB.exe
  2⤵
  PID:3264
- C:\Windows\System\NsTUHZy.exe
  C:\Windows\System\NsTUHZy.exe
  2⤵
  PID:3356
- C:\Windows\System\SxtRmqy.exe
  C:\Windows\System\SxtRmqy.exe
  2⤵
  PID:3824
- C:\Windows\System\CbSfMdB.exe
  C:\Windows\System\CbSfMdB.exe
  2⤵
  PID:3896
- C:\Windows\System\jKuezDF.exe
  C:\Windows\System\jKuezDF.exe
  2⤵
  PID:2716
- C:\Windows\System\CSTeois.exe
  C:\Windows\System\CSTeois.exe
  2⤵
  PID:4088
- C:\Windows\System\OXnwPKl.exe
  C:\Windows\System\OXnwPKl.exe
  2⤵
  PID:1740
- C:\Windows\System\gsBEkBN.exe
  C:\Windows\System\gsBEkBN.exe
  2⤵
  PID:1844
- C:\Windows\System\qVqzKod.exe
  C:\Windows\System\qVqzKod.exe
  2⤵
  PID:2596
- C:\Windows\System\OqXlDCP.exe
  C:\Windows\System\OqXlDCP.exe
  2⤵
  PID:1600
- C:\Windows\System\psWqkqY.exe
  C:\Windows\System\psWqkqY.exe
  2⤵
  PID:1232
- C:\Windows\System\grYTpPi.exe
  C:\Windows\System\grYTpPi.exe
  2⤵
  PID:1356
- C:\Windows\System\pkazczu.exe
  C:\Windows\System\pkazczu.exe
  2⤵
  PID:2760
- C:\Windows\System\kypukkQ.exe
  C:\Windows\System\kypukkQ.exe
  2⤵
  PID:3088
- C:\Windows\System\wMgBcUs.exe
  C:\Windows\System\wMgBcUs.exe
  2⤵
  PID:2388
- C:\Windows\System\dmFQMAg.exe
  C:\Windows\System\dmFQMAg.exe
  2⤵
  PID:3152
- C:\Windows\System\kbMfQUl.exe
  C:\Windows\System\kbMfQUl.exe
  2⤵
  PID:3244
- C:\Windows\System\CyCvPoX.exe
  C:\Windows\System\CyCvPoX.exe
  2⤵
  PID:3404
- C:\Windows\System\JCtaBDw.exe
  C:\Windows\System\JCtaBDw.exe
  2⤵
  PID:3376
- C:\Windows\System\JWuFntY.exe
  C:\Windows\System\JWuFntY.exe
  2⤵
  PID:3564
- C:\Windows\System\vlpGloh.exe
  C:\Windows\System\vlpGloh.exe
  2⤵
  PID:676
- C:\Windows\System\pkPZInm.exe
  C:\Windows\System\pkPZInm.exe
  2⤵
  PID:3560
- C:\Windows\System\Lxnrpsk.exe
  C:\Windows\System\Lxnrpsk.exe
  2⤵
  PID:3596
- C:\Windows\System\nxkgshn.exe
  C:\Windows\System\nxkgshn.exe
  2⤵
  PID:3624
- C:\Windows\System\LkOBqYK.exe
  C:\Windows\System\LkOBqYK.exe
  2⤵
  PID:3640
- C:\Windows\System\rrYmUBH.exe
  C:\Windows\System\rrYmUBH.exe
  2⤵
  PID:3672
- C:\Windows\System\ORsGLVa.exe
  C:\Windows\System\ORsGLVa.exe
  2⤵
  PID:2880
- C:\Windows\System\DjkfuJY.exe
  C:\Windows\System\DjkfuJY.exe
  2⤵
  PID:3716
- C:\Windows\System\BJCCzRh.exe
  C:\Windows\System\BJCCzRh.exe
  2⤵
  PID:1960
- C:\Windows\System\fKDPsjH.exe
  C:\Windows\System\fKDPsjH.exe
  2⤵
  PID:1868
- C:\Windows\System\fPXLDoS.exe
  C:\Windows\System\fPXLDoS.exe
  2⤵
  PID:3740
- C:\Windows\System\nVBuSaD.exe
  C:\Windows\System\nVBuSaD.exe
  2⤵
  PID:3768
- C:\Windows\System\jDkejiN.exe
  C:\Windows\System\jDkejiN.exe
  2⤵
  PID:3800
- C:\Windows\System\Ugzxicm.exe
  C:\Windows\System\Ugzxicm.exe
  2⤵
  PID:3804
- C:\Windows\System\AYzzIfO.exe
  C:\Windows\System\AYzzIfO.exe
  2⤵
  PID:3908
- C:\Windows\System\dMJDAjP.exe
  C:\Windows\System\dMJDAjP.exe
  2⤵
  PID:1300
- C:\Windows\System\dAuIwwO.exe
  C:\Windows\System\dAuIwwO.exe
  2⤵
  PID:1576
- C:\Windows\System\WSeZpGc.exe
  C:\Windows\System\WSeZpGc.exe
  2⤵
  PID:600
- C:\Windows\System\wmskNRo.exe
  C:\Windows\System\wmskNRo.exe
  2⤵
  PID:3992
- C:\Windows\System\nqXYFQr.exe
  C:\Windows\System\nqXYFQr.exe
  2⤵
  PID:1424
- C:\Windows\System\RIfiwOQ.exe
  C:\Windows\System\RIfiwOQ.exe
  2⤵
  PID:3968
- C:\Windows\System\chfoSBM.exe
  C:\Windows\System\chfoSBM.exe
  2⤵
  PID:3296
- C:\Windows\System\fEUCbzE.exe
  C:\Windows\System\fEUCbzE.exe
  2⤵
  PID:1512
- C:\Windows\System\hNZHGyo.exe
  C:\Windows\System\hNZHGyo.exe
  2⤵
  PID:2284
- C:\Windows\System\hYuuEdt.exe
  C:\Windows\System\hYuuEdt.exe
  2⤵
  PID:3312
- C:\Windows\System\hkolsWD.exe
  C:\Windows\System\hkolsWD.exe
  2⤵
  PID:4060
- C:\Windows\System\EDAuRhK.exe
  C:\Windows\System\EDAuRhK.exe
  2⤵
  PID:2080
- C:\Windows\System\BJgdGSI.exe
  C:\Windows\System\BJgdGSI.exe
  2⤵
  PID:3460
- C:\Windows\System\LfnGUEO.exe
  C:\Windows\System\LfnGUEO.exe
  2⤵
  PID:1788
- C:\Windows\System\iVxFgPF.exe
  C:\Windows\System\iVxFgPF.exe
  2⤵
  PID:2768
- C:\Windows\System\JQgLpIl.exe
  C:\Windows\System\JQgLpIl.exe
  2⤵
  PID:3484
- C:\Windows\System\nAIxfbH.exe
  C:\Windows\System\nAIxfbH.exe
  2⤵
  PID:3476
- C:\Windows\System\uvMvRqA.exe
  C:\Windows\System\uvMvRqA.exe
  2⤵
  PID:3540
- C:\Windows\System\HmLFmgK.exe
  C:\Windows\System\HmLFmgK.exe
  2⤵
  PID:2440
- C:\Windows\System\NrOMtFQ.exe
  C:\Windows\System\NrOMtFQ.exe
  2⤵
  PID:1660
- C:\Windows\System\npxwniL.exe
  C:\Windows\System\npxwniL.exe
  2⤵
  PID:3556
- C:\Windows\System\wSNKbhC.exe
  C:\Windows\System\wSNKbhC.exe
  2⤵
  PID:3984
- C:\Windows\System\gWgPTlP.exe
  C:\Windows\System\gWgPTlP.exe
  2⤵
  PID:2548
- C:\Windows\System\UZfCgzK.exe
  C:\Windows\System\UZfCgzK.exe
  2⤵
  PID:3340
- C:\Windows\System\VZNyBYp.exe
  C:\Windows\System\VZNyBYp.exe
  2⤵
  PID:632
- C:\Windows\System\TpaqHfA.exe
  C:\Windows\System\TpaqHfA.exe
  2⤵
  PID:3660
- C:\Windows\System\yvzJyFD.exe
  C:\Windows\System\yvzJyFD.exe
  2⤵
  PID:2272
- C:\Windows\System\lcdbWzb.exe
  C:\Windows\System\lcdbWzb.exe
  2⤵
  PID:2728
- C:\Windows\System\YezAOPd.exe
  C:\Windows\System\YezAOPd.exe
  2⤵
  PID:3168
- C:\Windows\System\OkEuNyj.exe
  C:\Windows\System\OkEuNyj.exe
  2⤵
  PID:1656
- C:\Windows\System\RXiZifK.exe
  C:\Windows\System\RXiZifK.exe
  2⤵
  PID:3712
- C:\Windows\System\OzdILEl.exe
  C:\Windows\System\OzdILEl.exe
  2⤵
  PID:2788
- C:\Windows\System\pBkurNX.exe
  C:\Windows\System\pBkurNX.exe
  2⤵
  PID:1784
- C:\Windows\System\wUzSutf.exe
  C:\Windows\System\wUzSutf.exe
  2⤵
  PID:404
- C:\Windows\System\ReULzpK.exe
  C:\Windows\System\ReULzpK.exe
  2⤵
  PID:4008
- C:\Windows\System\HdLbjry.exe
  C:\Windows\System\HdLbjry.exe
  2⤵
  PID:4036
- C:\Windows\System\bytmodc.exe
  C:\Windows\System\bytmodc.exe
  2⤵
  PID:3196
- C:\Windows\System\aIeaSKc.exe
  C:\Windows\System\aIeaSKc.exe
  2⤵
  PID:2488
- C:\Windows\System\BwpoGay.exe
  C:\Windows\System\BwpoGay.exe
  2⤵
  PID:2236
- C:\Windows\System\BAEaTjc.exe
  C:\Windows\System\BAEaTjc.exe
  2⤵
  PID:2348
- C:\Windows\System\eOEAFgo.exe
  C:\Windows\System\eOEAFgo.exe
  2⤵
  PID:3232
- C:\Windows\System\hrqrvJO.exe
  C:\Windows\System\hrqrvJO.exe
  2⤵
  PID:4068
- C:\Windows\System\PWbIKoO.exe
  C:\Windows\System\PWbIKoO.exe
  2⤵
  PID:3580
- C:\Windows\System\rTCGjzG.exe
  C:\Windows\System\rTCGjzG.exe
  2⤵
  PID:2232
- C:\Windows\System\BZHWKSc.exe
  C:\Windows\System\BZHWKSc.exe
  2⤵
  PID:3744
- C:\Windows\System\GEcqzNw.exe
  C:\Windows\System\GEcqzNw.exe
  2⤵
  PID:2628
- C:\Windows\System\RyoHfbY.exe
  C:\Windows\System\RyoHfbY.exe
  2⤵
  PID:540
- C:\Windows\System\eNxRWar.exe
  C:\Windows\System\eNxRWar.exe
  2⤵
  PID:3860
- C:\Windows\System\fzUWYsv.exe
  C:\Windows\System\fzUWYsv.exe
  2⤵
  PID:3280
- C:\Windows\System\QOykMFq.exe
  C:\Windows\System\QOykMFq.exe
  2⤵
  PID:3492
- C:\Windows\System\ZEYNVLX.exe
  C:\Windows\System\ZEYNVLX.exe
  2⤵
  PID:3524
- C:\Windows\System\zvhGuty.exe
  C:\Windows\System\zvhGuty.exe
  2⤵
  PID:3980
- C:\Windows\System\BAtXmng.exe
  C:\Windows\System\BAtXmng.exe
  2⤵
  PID:2028
- C:\Windows\System\YwLnKTt.exe
  C:\Windows\System\YwLnKTt.exe
  2⤵
  PID:3576
- C:\Windows\System\xLqiqww.exe
  C:\Windows\System\xLqiqww.exe
  2⤵
  PID:4108
- C:\Windows\System\YcQkXZD.exe
  C:\Windows\System\YcQkXZD.exe
  2⤵
  PID:4128
- C:\Windows\System\UEjeLEv.exe
  C:\Windows\System\UEjeLEv.exe
  2⤵
  PID:4144
- C:\Windows\System\QldSUOv.exe
  C:\Windows\System\QldSUOv.exe
  2⤵
  PID:4160
- C:\Windows\System\mfOlVkZ.exe
  C:\Windows\System\mfOlVkZ.exe
  2⤵
  PID:4176
- C:\Windows\System\mIMdAdf.exe
  C:\Windows\System\mIMdAdf.exe
  2⤵
  PID:4192
- C:\Windows\System\GLuwpwk.exe
  C:\Windows\System\GLuwpwk.exe
  2⤵
  PID:4208
- C:\Windows\System\cwQIhGq.exe
  C:\Windows\System\cwQIhGq.exe
  2⤵
  PID:4228
- C:\Windows\System\HWmvVhL.exe
  C:\Windows\System\HWmvVhL.exe
  2⤵
  PID:4244
- C:\Windows\System\UZvVCtS.exe
  C:\Windows\System\UZvVCtS.exe
  2⤵
  PID:4260
- C:\Windows\System\QiAMRjJ.exe
  C:\Windows\System\QiAMRjJ.exe
  2⤵
  PID:4280
- C:\Windows\System\BJaiMak.exe
  C:\Windows\System\BJaiMak.exe
  2⤵
  PID:4296
- C:\Windows\System\MkVeqQe.exe
  C:\Windows\System\MkVeqQe.exe
  2⤵
  PID:4312
- C:\Windows\System\ADbZVNV.exe
  C:\Windows\System\ADbZVNV.exe
  2⤵
  PID:4328
- C:\Windows\System\PUhVSmp.exe
  C:\Windows\System\PUhVSmp.exe
  2⤵
  PID:4344
- C:\Windows\System\EOfPlwF.exe
  C:\Windows\System\EOfPlwF.exe
  2⤵
  PID:4360
- C:\Windows\System\cIrHjIR.exe
  C:\Windows\System\cIrHjIR.exe
  2⤵
  PID:4376
- C:\Windows\System\hqECNjQ.exe
  C:\Windows\System\hqECNjQ.exe
  2⤵
  PID:4396
- C:\Windows\System\KCQkalK.exe
  C:\Windows\System\KCQkalK.exe
  2⤵
  PID:4412
- C:\Windows\System\dUqBGdX.exe
  C:\Windows\System\dUqBGdX.exe
  2⤵
  PID:4428
- C:\Windows\System\EzKufCP.exe
  C:\Windows\System\EzKufCP.exe
  2⤵
  PID:4444
- C:\Windows\System\NHCiPyL.exe
  C:\Windows\System\NHCiPyL.exe
  2⤵
  PID:4460
- C:\Windows\System\cypZYDl.exe
  C:\Windows\System\cypZYDl.exe
  2⤵
  PID:4476
- C:\Windows\System\emGhyLN.exe
  C:\Windows\System\emGhyLN.exe
  2⤵
  PID:4492
- C:\Windows\System\jzqOopT.exe
  C:\Windows\System\jzqOopT.exe
  2⤵
  PID:4512
- C:\Windows\System\qftpTDt.exe
  C:\Windows\System\qftpTDt.exe
  2⤵
  PID:4528
- C:\Windows\System\ZgjoBnE.exe
  C:\Windows\System\ZgjoBnE.exe
  2⤵
  PID:4544
- C:\Windows\System\OSRVMOm.exe
  C:\Windows\System\OSRVMOm.exe
  2⤵
  PID:4560
- C:\Windows\System\YPCRmbT.exe
  C:\Windows\System\YPCRmbT.exe
  2⤵
  PID:4576
- C:\Windows\System\IgIZezH.exe
  C:\Windows\System\IgIZezH.exe
  2⤵
  PID:4592
- C:\Windows\System\OoPZaCT.exe
  C:\Windows\System\OoPZaCT.exe
  2⤵
  PID:4608
- C:\Windows\System\seevwZb.exe
  C:\Windows\System\seevwZb.exe
  2⤵
  PID:4624
- C:\Windows\System\vSwuPJP.exe
  C:\Windows\System\vSwuPJP.exe
  2⤵
  PID:4640
- C:\Windows\System\UJhcvxq.exe
  C:\Windows\System\UJhcvxq.exe
  2⤵
  PID:4656
- C:\Windows\System\YAGtdVc.exe
  C:\Windows\System\YAGtdVc.exe
  2⤵
  PID:4672
- C:\Windows\System\UuKSjRY.exe
  C:\Windows\System\UuKSjRY.exe
  2⤵
  PID:4688
- C:\Windows\System\pseutGT.exe
  C:\Windows\System\pseutGT.exe
  2⤵
  PID:4704
- C:\Windows\System\caIYlmu.exe
  C:\Windows\System\caIYlmu.exe
  2⤵
  PID:4728
- C:\Windows\System\CYCfARj.exe
  C:\Windows\System\CYCfARj.exe
  2⤵
  PID:4792
- C:\Windows\System\VbXAqao.exe
  C:\Windows\System\VbXAqao.exe
  2⤵
  PID:4808
- C:\Windows\System\mAwspQE.exe
  C:\Windows\System\mAwspQE.exe
  2⤵
  PID:4824
- C:\Windows\System\WgRQHXP.exe
  C:\Windows\System\WgRQHXP.exe
  2⤵
  PID:4844
- C:\Windows\System\UHsBFCr.exe
  C:\Windows\System\UHsBFCr.exe
  2⤵
  PID:4860
- C:\Windows\System\rYHsavC.exe
  C:\Windows\System\rYHsavC.exe
  2⤵
  PID:4884
- C:\Windows\System\dFqQfmb.exe
  C:\Windows\System\dFqQfmb.exe
  2⤵
  PID:4900
- C:\Windows\System\PgdKnDN.exe
  C:\Windows\System\PgdKnDN.exe
  2⤵
  PID:4916
- C:\Windows\System\IBpunFt.exe
  C:\Windows\System\IBpunFt.exe
  2⤵
  PID:4932
- C:\Windows\System\NqnVEpj.exe
  C:\Windows\System\NqnVEpj.exe
  2⤵
  PID:4948
- C:\Windows\System\KsjRdaJ.exe
  C:\Windows\System\KsjRdaJ.exe
  2⤵
  PID:4968
- C:\Windows\System\yFrjAJf.exe
  C:\Windows\System\yFrjAJf.exe
  2⤵
  PID:4984
- C:\Windows\System\dwqGAOe.exe
  C:\Windows\System\dwqGAOe.exe
  2⤵
  PID:5000
- C:\Windows\System\CLoujkD.exe
  C:\Windows\System\CLoujkD.exe
  2⤵
  PID:5016
- C:\Windows\System\ZBpnHdP.exe
  C:\Windows\System\ZBpnHdP.exe
  2⤵
  PID:5032
- C:\Windows\System\FkSerKW.exe
  C:\Windows\System\FkSerKW.exe
  2⤵
  PID:5048
- C:\Windows\System\DdnLsnN.exe
  C:\Windows\System\DdnLsnN.exe
  2⤵
  PID:5064
- C:\Windows\System\zhpBVXy.exe
  C:\Windows\System\zhpBVXy.exe
  2⤵
  PID:5080
- C:\Windows\System\tvVGIln.exe
  C:\Windows\System\tvVGIln.exe
  2⤵
  PID:5096
- C:\Windows\System\gCzKpHY.exe
  C:\Windows\System\gCzKpHY.exe
  2⤵
  PID:5112
- C:\Windows\System\NYjwvpC.exe
  C:\Windows\System\NYjwvpC.exe
  2⤵
  PID:2332
- C:\Windows\System\wcXUfBs.exe
  C:\Windows\System\wcXUfBs.exe
  2⤵
  PID:2696
- C:\Windows\System\NfehIEr.exe
  C:\Windows\System\NfehIEr.exe
  2⤵
  PID:888
- C:\Windows\System\NDOIAzm.exe
  C:\Windows\System\NDOIAzm.exe
  2⤵
  PID:2976
- C:\Windows\System\eVoMHpE.exe
  C:\Windows\System\eVoMHpE.exe
  2⤵
  PID:4168
- C:\Windows\System\lfZGQPf.exe
  C:\Windows\System\lfZGQPf.exe
  2⤵
  PID:4236
- C:\Windows\System\iUTMzal.exe
  C:\Windows\System\iUTMzal.exe
  2⤵
  PID:4336
- C:\Windows\System\DOdaAWP.exe
  C:\Windows\System\DOdaAWP.exe
  2⤵
  PID:4436
- C:\Windows\System\xkfFbgF.exe
  C:\Windows\System\xkfFbgF.exe
  2⤵
  PID:4540
- C:\Windows\System\RLHxueq.exe
  C:\Windows\System\RLHxueq.exe
  2⤵
  PID:2572
- C:\Windows\System\mjOIRDK.exe
  C:\Windows\System\mjOIRDK.exe
  2⤵
  PID:3472
- C:\Windows\System\DesdmeN.exe
  C:\Windows\System\DesdmeN.exe
  2⤵
  PID:4152
- C:\Windows\System\HwJlYqL.exe
  C:\Windows\System\HwJlYqL.exe
  2⤵
  PID:4520
- C:\Windows\System\GllbkxT.exe
  C:\Windows\System\GllbkxT.exe
  2⤵
  PID:4680
- C:\Windows\System\cuArRSh.exe
  C:\Windows\System\cuArRSh.exe
  2⤵
  PID:4780
- C:\Windows\System\AKkbqZy.exe
  C:\Windows\System\AKkbqZy.exe
  2⤵
  PID:4924
- C:\Windows\System\vgwGENT.exe
  C:\Windows\System\vgwGENT.exe
  2⤵
  PID:2972
- C:\Windows\System\rnZBEbQ.exe
  C:\Windows\System\rnZBEbQ.exe
  2⤵
  PID:4940
- C:\Windows\System\NKZkKMD.exe
  C:\Windows\System\NKZkKMD.exe
  2⤵
  PID:3104
- C:\Windows\System\DlNletg.exe
  C:\Windows\System\DlNletg.exe
  2⤵
  PID:4840
- C:\Windows\System\lcVZIwM.exe
  C:\Windows\System\lcVZIwM.exe
  2⤵
  PID:4880
- C:\Windows\System\cUgsMwp.exe
  C:\Windows\System\cUgsMwp.exe
  2⤵
  PID:5008
- C:\Windows\System\SMyQUeH.exe
  C:\Windows\System\SMyQUeH.exe
  2⤵
  PID:3132
- C:\Windows\System\IAinpNT.exe
  C:\Windows\System\IAinpNT.exe
  2⤵
  PID:2680
- C:\Windows\System\DmgqgWT.exe
  C:\Windows\System\DmgqgWT.exe
  2⤵
  PID:4136
- C:\Windows\System\gNmrvxW.exe
  C:\Windows\System\gNmrvxW.exe
  2⤵
  PID:4272
- C:\Windows\System\SCdXpAy.exe
  C:\Windows\System\SCdXpAy.exe
  2⤵
  PID:4472
- C:\Windows\System\ThdWYGx.exe
  C:\Windows\System\ThdWYGx.exe
  2⤵
  PID:4500
- C:\Windows\System\mhBHCIj.exe
  C:\Windows\System\mhBHCIj.exe
  2⤵
  PID:3828
- C:\Windows\System\qZFBjYO.exe
  C:\Windows\System\qZFBjYO.exe
  2⤵
  PID:4600
- C:\Windows\System\bzXmlvq.exe
  C:\Windows\System\bzXmlvq.exe
  2⤵
  PID:4392
- C:\Windows\System\TcgPjBU.exe
  C:\Windows\System\TcgPjBU.exe
  2⤵
  PID:4356
- C:\Windows\System\bBihupw.exe
  C:\Windows\System\bBihupw.exe
  2⤵
  PID:904
- C:\Windows\System\RUNDTWk.exe
  C:\Windows\System\RUNDTWk.exe
  2⤵
  PID:1628
- C:\Windows\System\CNLeIry.exe
  C:\Windows\System\CNLeIry.exe
  2⤵
  PID:2508
- C:\Windows\System\hWkYsEf.exe
  C:\Windows\System\hWkYsEf.exe
  2⤵
  PID:1696
- C:\Windows\System\kZnWOhN.exe
  C:\Windows\System\kZnWOhN.exe
  2⤵
  PID:3784
- C:\Windows\System\lNtpOmX.exe
  C:\Windows\System\lNtpOmX.exe
  2⤵
  PID:4124
- C:\Windows\System\lYfYedr.exe
  C:\Windows\System\lYfYedr.exe
  2⤵
  PID:1320
- C:\Windows\System\NVNunxO.exe
  C:\Windows\System\NVNunxO.exe
  2⤵
  PID:4424
- C:\Windows\System\DCgpnJO.exe
  C:\Windows\System\DCgpnJO.exe
  2⤵
  PID:4484
- C:\Windows\System\qNuBGrq.exe
  C:\Windows\System\qNuBGrq.exe
  2⤵
  PID:4712
- C:\Windows\System\JQTLSmJ.exe
  C:\Windows\System\JQTLSmJ.exe
  2⤵
  PID:4588
- C:\Windows\System\rtyYJQn.exe
  C:\Windows\System\rtyYJQn.exe
  2⤵
  PID:4652
- C:\Windows\System\VLpRnDf.exe
  C:\Windows\System\VLpRnDf.exe
  2⤵
  PID:4776
- C:\Windows\System\JyivRbU.exe
  C:\Windows\System\JyivRbU.exe
  2⤵
  PID:4788
- C:\Windows\System\riGlIgq.exe
  C:\Windows\System\riGlIgq.exe
  2⤵
  PID:4956
- C:\Windows\System\aonhoAL.exe
  C:\Windows\System\aonhoAL.exe
  2⤵
  PID:4772
- C:\Windows\System\TwlqxBb.exe
  C:\Windows\System\TwlqxBb.exe
  2⤵
  PID:5088
- C:\Windows\System\ZORNmMG.exe
  C:\Windows\System\ZORNmMG.exe
  2⤵
  PID:1636
- C:\Windows\System\pFJSSRg.exe
  C:\Windows\System\pFJSSRg.exe
  2⤵
  PID:5104
- C:\Windows\System\IFHvwHs.exe
  C:\Windows\System\IFHvwHs.exe
  2⤵
  PID:964
- C:\Windows\System\zBfdvxv.exe
  C:\Windows\System\zBfdvxv.exe
  2⤵
  PID:5076
- C:\Windows\System\NQAYQRh.exe
  C:\Windows\System\NQAYQRh.exe
  2⤵
  PID:5132
- C:\Windows\System\pBwWZem.exe
  C:\Windows\System\pBwWZem.exe
  2⤵
  PID:5180
- C:\Windows\System\qcjArmq.exe
  C:\Windows\System\qcjArmq.exe
  2⤵
  PID:5196
- C:\Windows\System\EqdJdqe.exe
  C:\Windows\System\EqdJdqe.exe
  2⤵
  PID:5212
- C:\Windows\System\mZtLHVR.exe
  C:\Windows\System\mZtLHVR.exe
  2⤵
  PID:5228
- C:\Windows\System\nAxmJsT.exe
  C:\Windows\System\nAxmJsT.exe
  2⤵
  PID:5248
- C:\Windows\System\IjaZDki.exe
  C:\Windows\System\IjaZDki.exe
  2⤵
  PID:5264
- C:\Windows\System\jirPajP.exe
  C:\Windows\System\jirPajP.exe
  2⤵
  PID:5280
- C:\Windows\System\pZeFkWm.exe
  C:\Windows\System\pZeFkWm.exe
  2⤵
  PID:5296
- C:\Windows\System\clxjQuj.exe
  C:\Windows\System\clxjQuj.exe
  2⤵
  PID:5312
- C:\Windows\System\poWmyZJ.exe
  C:\Windows\System\poWmyZJ.exe
  2⤵
  PID:5328
- C:\Windows\System\DcbGRvL.exe
  C:\Windows\System\DcbGRvL.exe
  2⤵
  PID:5344
- C:\Windows\System\GgubCFH.exe
  C:\Windows\System\GgubCFH.exe
  2⤵
  PID:5360
- C:\Windows\System\ofZuRfK.exe
  C:\Windows\System\ofZuRfK.exe
  2⤵
  PID:5376
- C:\Windows\System\BsGhdgG.exe
  C:\Windows\System\BsGhdgG.exe
  2⤵
  PID:5392
- C:\Windows\System\tnSXVCw.exe
  C:\Windows\System\tnSXVCw.exe
  2⤵
  PID:5408
- C:\Windows\System\yeJiAFt.exe
  C:\Windows\System\yeJiAFt.exe
  2⤵
  PID:5424
- C:\Windows\System\ESgxlAI.exe
  C:\Windows\System\ESgxlAI.exe
  2⤵
  PID:5440
- C:\Windows\System\mQAEQQf.exe
  C:\Windows\System\mQAEQQf.exe
  2⤵
  PID:5456
- C:\Windows\System\SIgZsDz.exe
  C:\Windows\System\SIgZsDz.exe
  2⤵
  PID:5472
- C:\Windows\System\dXMLMVX.exe
  C:\Windows\System\dXMLMVX.exe
  2⤵
  PID:5488
- C:\Windows\System\tvvjkPe.exe
  C:\Windows\System\tvvjkPe.exe
  2⤵
  PID:5504
- C:\Windows\System\KSAIsiw.exe
  C:\Windows\System\KSAIsiw.exe
  2⤵
  PID:5520
- C:\Windows\System\BKncvki.exe
  C:\Windows\System\BKncvki.exe
  2⤵
  PID:5536
- C:\Windows\System\jmLumNj.exe
  C:\Windows\System\jmLumNj.exe
  2⤵
  PID:5552
- C:\Windows\System\XzxKojg.exe
  C:\Windows\System\XzxKojg.exe
  2⤵
  PID:5572
- C:\Windows\System\oSSCNXo.exe
  C:\Windows\System\oSSCNXo.exe
  2⤵
  PID:5588
- C:\Windows\System\OhZoglt.exe
  C:\Windows\System\OhZoglt.exe
  2⤵
  PID:5604
- C:\Windows\System\gYfsJkE.exe
  C:\Windows\System\gYfsJkE.exe
  2⤵
  PID:5620
- C:\Windows\System\jvreHmO.exe
  C:\Windows\System\jvreHmO.exe
  2⤵
  PID:5636
- C:\Windows\System\TMKrKVI.exe
  C:\Windows\System\TMKrKVI.exe
  2⤵
  PID:5652
- C:\Windows\System\OFiLdxF.exe
  C:\Windows\System\OFiLdxF.exe
  2⤵
  PID:5668
- C:\Windows\System\AOfyhNV.exe
  C:\Windows\System\AOfyhNV.exe
  2⤵
  PID:5684
- C:\Windows\System\GeQPysS.exe
  C:\Windows\System\GeQPysS.exe
  2⤵
  PID:5700
- C:\Windows\System\CihRnEh.exe
  C:\Windows\System\CihRnEh.exe
  2⤵
  PID:5716
- C:\Windows\System\MJtdgpv.exe
  C:\Windows\System\MJtdgpv.exe
  2⤵
  PID:5732
- C:\Windows\System\NQhsJRT.exe
  C:\Windows\System\NQhsJRT.exe
  2⤵
  PID:5748
- C:\Windows\System\VFmAYIU.exe
  C:\Windows\System\VFmAYIU.exe
  2⤵
  PID:5764
- C:\Windows\System\klWgyfF.exe
  C:\Windows\System\klWgyfF.exe
  2⤵
  PID:5780
- C:\Windows\System\dhkoEhC.exe
  C:\Windows\System\dhkoEhC.exe
  2⤵
  PID:5796
- C:\Windows\System\VDxBZGr.exe
  C:\Windows\System\VDxBZGr.exe
  2⤵
  PID:5812
- C:\Windows\System\UlnBVga.exe
  C:\Windows\System\UlnBVga.exe
  2⤵
  PID:5828
- C:\Windows\System\FOvrJUO.exe
  C:\Windows\System\FOvrJUO.exe
  2⤵
  PID:5844
- C:\Windows\System\BJjBsML.exe
  C:\Windows\System\BJjBsML.exe
  2⤵
  PID:5864
- C:\Windows\System\imwDGWg.exe
  C:\Windows\System\imwDGWg.exe
  2⤵
  PID:5880
- C:\Windows\System\AxljxNd.exe
  C:\Windows\System\AxljxNd.exe
  2⤵
  PID:5896
- C:\Windows\System\VqwCtJs.exe
  C:\Windows\System\VqwCtJs.exe
  2⤵
  PID:5912
- C:\Windows\System\EUPdpkw.exe
  C:\Windows\System\EUPdpkw.exe
  2⤵
  PID:5928
- C:\Windows\System\ajdXjJu.exe
  C:\Windows\System\ajdXjJu.exe
  2⤵
  PID:5944
- C:\Windows\System\wjVQWZp.exe
  C:\Windows\System\wjVQWZp.exe
  2⤵
  PID:5960
- C:\Windows\System\ZZSNOrV.exe
  C:\Windows\System\ZZSNOrV.exe
  2⤵
  PID:5976
- C:\Windows\System\iDIxoGT.exe
  C:\Windows\System\iDIxoGT.exe
  2⤵
  PID:5992
- C:\Windows\System\WpBOypR.exe
  C:\Windows\System\WpBOypR.exe
  2⤵
  PID:6008
- C:\Windows\System\UDdxNOX.exe
  C:\Windows\System\UDdxNOX.exe
  2⤵
  PID:6024
- C:\Windows\System\fejjNao.exe
  C:\Windows\System\fejjNao.exe
  2⤵
  PID:6040
- C:\Windows\System\zQPFaJb.exe
  C:\Windows\System\zQPFaJb.exe
  2⤵
  PID:6056
- C:\Windows\System\xAjzJmT.exe
  C:\Windows\System\xAjzJmT.exe
  2⤵
  PID:6072
- C:\Windows\System\xOHSYRB.exe
  C:\Windows\System\xOHSYRB.exe
  2⤵
  PID:6088
- C:\Windows\System\jAmawzv.exe
  C:\Windows\System\jAmawzv.exe
  2⤵
  PID:6104
- C:\Windows\System\CdeOvaZ.exe
  C:\Windows\System\CdeOvaZ.exe
  2⤵
  PID:6124
- C:\Windows\System\QZXRndj.exe
  C:\Windows\System\QZXRndj.exe
  2⤵
  PID:6140
- C:\Windows\System\NkkdHez.exe
  C:\Windows\System\NkkdHez.exe
  2⤵
  PID:3516
- C:\Windows\System\YPzmMHs.exe
  C:\Windows\System\YPzmMHs.exe
  2⤵
  PID:1036
- C:\Windows\System\Jshrzoq.exe
  C:\Windows\System\Jshrzoq.exe
  2⤵
  PID:2296
- C:\Windows\System\plARzLm.exe
  C:\Windows\System\plARzLm.exe
  2⤵
  PID:1052
- C:\Windows\System\OYrtMqU.exe
  C:\Windows\System\OYrtMqU.exe
  2⤵
  PID:4820
- C:\Windows\System\HEQuIQP.exe
  C:\Windows\System\HEQuIQP.exe
  2⤵
  PID:4252
- C:\Windows\System\foAQsMK.exe
  C:\Windows\System\foAQsMK.exe
  2⤵
  PID:4408
- C:\Windows\System\QpGbjrs.exe
  C:\Windows\System\QpGbjrs.exe
  2⤵
  PID:5140
- C:\Windows\System\SuaySkP.exe
  C:\Windows\System\SuaySkP.exe
  2⤵
  PID:5156
- C:\Windows\System\KHtaXKg.exe
  C:\Windows\System\KHtaXKg.exe
  2⤵
  PID:4664
- C:\Windows\System\eBiJQIj.exe
  C:\Windows\System\eBiJQIj.exe
  2⤵
  PID:4800
- C:\Windows\System\zeheVrn.exe
  C:\Windows\System\zeheVrn.exe
  2⤵
  PID:4976
- C:\Windows\System\wOVnUsf.exe
  C:\Windows\System\wOVnUsf.exe
  2⤵
  PID:240
- C:\Windows\System\exywVpQ.exe
  C:\Windows\System\exywVpQ.exe
  2⤵
  PID:1816
- C:\Windows\System\xsEdATA.exe
  C:\Windows\System\xsEdATA.exe
  2⤵
  PID:3864
- C:\Windows\System\aeJkFNg.exe
  C:\Windows\System\aeJkFNg.exe
  2⤵
  PID:4620
- C:\Windows\System\ARhQcgQ.exe
  C:\Windows\System\ARhQcgQ.exe
  2⤵
  PID:5292
- C:\Windows\System\cWWYPUg.exe
  C:\Windows\System\cWWYPUg.exe
  2⤵
  PID:5320
- C:\Windows\System\maLarLZ.exe
  C:\Windows\System\maLarLZ.exe
  2⤵
  PID:5420
- C:\Windows\System\vEpzWVm.exe
  C:\Windows\System\vEpzWVm.exe
  2⤵
  PID:5480
- C:\Windows\System\pPHdqlJ.exe
  C:\Windows\System\pPHdqlJ.exe
  2⤵
  PID:5544
- C:\Windows\System\gZTkhld.exe
  C:\Windows\System\gZTkhld.exe
  2⤵
  PID:5208
- C:\Windows\System\LIytfLU.exe
  C:\Windows\System\LIytfLU.exe
  2⤵
  PID:5172
- C:\Windows\System\Swogqhs.exe
  C:\Windows\System\Swogqhs.exe
  2⤵
  PID:5708
- C:\Windows\System\ZqZnodh.exe
  C:\Windows\System\ZqZnodh.exe
  2⤵
  PID:5244
- C:\Windows\System\sUiihak.exe
  C:\Windows\System\sUiihak.exe
  2⤵
  PID:5772
- C:\Windows\System\CxNKCFP.exe
  C:\Windows\System\CxNKCFP.exe
  2⤵
  PID:5936
- C:\Windows\System\lCKOaCq.exe
  C:\Windows\System\lCKOaCq.exe
  2⤵
  PID:5528
- C:\Windows\System\oNOYvfw.exe
  C:\Windows\System\oNOYvfw.exe
  2⤵
  PID:6004
- C:\Windows\System\FeNiOyl.exe
  C:\Windows\System\FeNiOyl.exe
  2⤵
  PID:6068
- C:\Windows\System\aBEATnR.exe
  C:\Windows\System\aBEATnR.exe
  2⤵
  PID:5596
- C:\Windows\System\SapFhZe.exe
  C:\Windows\System\SapFhZe.exe
  2⤵
  PID:6132
- C:\Windows\System\hTFdDNR.exe
  C:\Windows\System\hTFdDNR.exe
  2⤵
  PID:5696
- C:\Windows\System\SBKcHxF.exe
  C:\Windows\System\SBKcHxF.exe
  2⤵
  PID:2712
- C:\Windows\System\kExUvuD.exe
  C:\Windows\System\kExUvuD.exe
  2⤵
  PID:5756
- C:\Windows\System\gXahhUj.exe
  C:\Windows\System\gXahhUj.exe
  2⤵
  PID:5824
- C:\Windows\System\FqVeYdj.exe
  C:\Windows\System\FqVeYdj.exe
  2⤵
  PID:5860
- C:\Windows\System\JbUUcpO.exe
  C:\Windows\System\JbUUcpO.exe
  2⤵
  PID:5924
- C:\Windows\System\BJXRytb.exe
  C:\Windows\System\BJXRytb.exe
  2⤵
  PID:5988
- C:\Windows\System\UQrnjsU.exe
  C:\Windows\System\UQrnjsU.exe
  2⤵
  PID:1064
- C:\Windows\System\sHPGGhF.exe
  C:\Windows\System\sHPGGhF.exe
  2⤵
  PID:6052
- C:\Windows\System\zaaQwGF.exe
  C:\Windows\System\zaaQwGF.exe
  2⤵
  PID:6116
- C:\Windows\System\GHDDShi.exe
  C:\Windows\System\GHDDShi.exe
  2⤵
  PID:4700
- C:\Windows\System\phbaNym.exe
  C:\Windows\System\phbaNym.exe
  2⤵
  PID:4632
- C:\Windows\System\YIaqahj.exe
  C:\Windows\System\YIaqahj.exe
  2⤵
  PID:3644
- C:\Windows\System\CXweKhn.exe
  C:\Windows\System\CXweKhn.exe
  2⤵
  PID:4368
- C:\Windows\System\zQgDxpt.exe
  C:\Windows\System\zQgDxpt.exe
  2⤵
  PID:4504
- C:\Windows\System\VDGWqyd.exe
  C:\Windows\System\VDGWqyd.exe
  2⤵
  PID:4276
- C:\Windows\System\aOfdjpO.exe
  C:\Windows\System\aOfdjpO.exe
  2⤵
  PID:4852
- C:\Windows\System\CAznzda.exe
  C:\Windows\System\CAznzda.exe
  2⤵
  PID:2800
- C:\Windows\System\Kpiqhrw.exe
  C:\Windows\System\Kpiqhrw.exe
  2⤵
  PID:5168
- C:\Windows\System\nFmauRU.exe
  C:\Windows\System\nFmauRU.exe
  2⤵
  PID:4836
- C:\Windows\System\ewaTSMc.exe
  C:\Windows\System\ewaTSMc.exe
  2⤵
  PID:4204
- C:\Windows\System\mgsNjWX.exe
  C:\Windows\System\mgsNjWX.exe
  2⤵
  PID:2492
- C:\Windows\System\RBxVTln.exe
  C:\Windows\System\RBxVTln.exe
  2⤵
  PID:5220
- C:\Windows\System\NPLGjuV.exe
  C:\Windows\System\NPLGjuV.exe
  2⤵
  PID:5256
- C:\Windows\System\gbzDztg.exe
  C:\Windows\System\gbzDztg.exe
  2⤵
  PID:5352
- C:\Windows\System\JMnoxEX.exe
  C:\Windows\System\JMnoxEX.exe
  2⤵
  PID:5616
- C:\Windows\System\DuEBhCQ.exe
  C:\Windows\System\DuEBhCQ.exe
  2⤵
  PID:5308
- C:\Windows\System\xqtPhui.exe
  C:\Windows\System\xqtPhui.exe
  2⤵
  PID:5840
- C:\Windows\System\lEXlPBa.exe
  C:\Windows\System\lEXlPBa.exe
  2⤵
  PID:5452
- C:\Windows\System\TEFwyzq.exe
  C:\Windows\System\TEFwyzq.exe
  2⤵
  PID:5368
- C:\Windows\System\lSZMTUz.exe
  C:\Windows\System\lSZMTUz.exe
  2⤵
  PID:5432
- C:\Windows\System\OeAAPlV.exe
  C:\Windows\System\OeAAPlV.exe
  2⤵
  PID:5496
- C:\Windows\System\BqqAZMV.exe
  C:\Windows\System\BqqAZMV.exe
  2⤵
  PID:5144
- C:\Windows\System\mbjdJyS.exe
  C:\Windows\System\mbjdJyS.exe
  2⤵
  PID:5628
- C:\Windows\System\wXirrfS.exe
  C:\Windows\System\wXirrfS.exe
  2⤵
  PID:4116
- C:\Windows\System\Rfwazra.exe
  C:\Windows\System\Rfwazra.exe
  2⤵
  PID:4604
- C:\Windows\System\ScyOgxf.exe
  C:\Windows\System\ScyOgxf.exe
  2⤵
  PID:5904
- C:\Windows\System\gziVzrA.exe
  C:\Windows\System\gziVzrA.exe
  2⤵
  PID:5564
- C:\Windows\System\ehVklnB.exe
  C:\Windows\System\ehVklnB.exe
  2⤵
  PID:6100
- C:\Windows\System\QKShHgc.exe
  C:\Windows\System\QKShHgc.exe
  2⤵
  PID:4992
- C:\Windows\System\llQGtSt.exe
  C:\Windows\System\llQGtSt.exe
  2⤵
  PID:4556
- C:\Windows\System\OdOOzDr.exe
  C:\Windows\System\OdOOzDr.exe
  2⤵
  PID:5820
- C:\Windows\System\iebmisT.exe
  C:\Windows\System\iebmisT.exe
  2⤵
  PID:5024
- C:\Windows\System\dFFLVWC.exe
  C:\Windows\System\dFFLVWC.exe
  2⤵
  PID:4696
- C:\Windows\System\fEPGhAp.exe
  C:\Windows\System\fEPGhAp.exe
  2⤵
  PID:4980
- C:\Windows\System\ICLyDfz.exe
  C:\Windows\System\ICLyDfz.exe
  2⤵
  PID:2252
- C:\Windows\System\fvLRyVz.exe
  C:\Windows\System\fvLRyVz.exe
  2⤵
  PID:5164
- C:\Windows\System\IVzIMgx.exe
  C:\Windows\System\IVzIMgx.exe
  2⤵
  PID:5712
- C:\Windows\System\AoPmlOt.exe
  C:\Windows\System\AoPmlOt.exe
  2⤵
  PID:5512
- C:\Windows\System\UHkKdoz.exe
  C:\Windows\System\UHkKdoz.exe
  2⤵
  PID:5448
- C:\Windows\System\dkgaZQc.exe
  C:\Windows\System\dkgaZQc.exe
  2⤵
  PID:5276
- C:\Windows\System\EuOEWSJ.exe
  C:\Windows\System\EuOEWSJ.exe
  2⤵
  PID:5404
- C:\Windows\System\MUOrEiu.exe
  C:\Windows\System\MUOrEiu.exe
  2⤵
  PID:4320
- C:\Windows\System\DWIcJjK.exe
  C:\Windows\System\DWIcJjK.exe
  2⤵
  PID:4304
- C:\Windows\System\oHFeRIr.exe
  C:\Windows\System\oHFeRIr.exe
  2⤵
  PID:5984
- C:\Windows\System\CuEXwYa.exe
  C:\Windows\System\CuEXwYa.exe
  2⤵
  PID:5956
- C:\Windows\System\dhUMKgk.exe
  C:\Windows\System\dhUMKgk.exe
  2⤵
  PID:5836
- C:\Windows\System\LzQjjZN.exe
  C:\Windows\System\LzQjjZN.exe
  2⤵
  PID:4292
- C:\Windows\System\KfGqtWN.exe
  C:\Windows\System\KfGqtWN.exe
  2⤵
  PID:5872
- C:\Windows\System\TCiScxU.exe
  C:\Windows\System\TCiScxU.exe
  2⤵
  PID:5676
- C:\Windows\System\TSpkbLR.exe
  C:\Windows\System\TSpkbLR.exe
  2⤵
  PID:5892
- C:\Windows\System\hiSuNny.exe
  C:\Windows\System\hiSuNny.exe
  2⤵
  PID:5192
- C:\Windows\System\VCrbRSs.exe
  C:\Windows\System\VCrbRSs.exe
  2⤵
  PID:6036
- C:\Windows\System\LBaxBJh.exe
  C:\Windows\System\LBaxBJh.exe
  2⤵
  PID:2228
- C:\Windows\System\PoBZlWD.exe
  C:\Windows\System\PoBZlWD.exe
  2⤵
  PID:5728
- C:\Windows\System\DAJAIEj.exe
  C:\Windows\System\DAJAIEj.exe
  2⤵
  PID:5288
- C:\Windows\System\ttDEtLh.exe
  C:\Windows\System\ttDEtLh.exe
  2⤵
  PID:4964
- C:\Windows\System\cYPUDph.exe
  C:\Windows\System\cYPUDph.exe
  2⤵
  PID:6152
- C:\Windows\System\FnOfeCg.exe
  C:\Windows\System\FnOfeCg.exe
  2⤵
  PID:6168
- C:\Windows\System\sYlvafO.exe
  C:\Windows\System\sYlvafO.exe
  2⤵
  PID:6184
- C:\Windows\System\KcfJWvl.exe
  C:\Windows\System\KcfJWvl.exe
  2⤵
  PID:6200
- C:\Windows\System\JGJdqvL.exe
  C:\Windows\System\JGJdqvL.exe
  2⤵
  PID:6216
- C:\Windows\System\WBpJCMF.exe
  C:\Windows\System\WBpJCMF.exe
  2⤵
  PID:6236
- C:\Windows\System\wIijiKH.exe
  C:\Windows\System\wIijiKH.exe
  2⤵
  PID:6252
- C:\Windows\System\CPoZksz.exe
  C:\Windows\System\CPoZksz.exe
  2⤵
  PID:6268
- C:\Windows\System\BjdIkUZ.exe
  C:\Windows\System\BjdIkUZ.exe
  2⤵
  PID:6284
- C:\Windows\System\aNIOque.exe
  C:\Windows\System\aNIOque.exe
  2⤵
  PID:6300
- C:\Windows\System\UzRjwrY.exe
  C:\Windows\System\UzRjwrY.exe
  2⤵
  PID:6316
- C:\Windows\System\aHjwnLS.exe
  C:\Windows\System\aHjwnLS.exe
  2⤵
  PID:6332
- C:\Windows\System\SBIfJpX.exe
  C:\Windows\System\SBIfJpX.exe
  2⤵
  PID:6348
- C:\Windows\System\UCXsHWj.exe
  C:\Windows\System\UCXsHWj.exe
  2⤵
  PID:6364
- C:\Windows\System\JDhOJli.exe
  C:\Windows\System\JDhOJli.exe
  2⤵
  PID:6380
- C:\Windows\System\mjUetqx.exe
  C:\Windows\System\mjUetqx.exe
  2⤵
  PID:6396
- C:\Windows\System\BXcpkLW.exe
  C:\Windows\System\BXcpkLW.exe
  2⤵
  PID:6412
- C:\Windows\System\GnTIJLn.exe
  C:\Windows\System\GnTIJLn.exe
  2⤵
  PID:6428
- C:\Windows\System\XrflaHI.exe
  C:\Windows\System\XrflaHI.exe
  2⤵
  PID:6444
- C:\Windows\System\QeGXHJH.exe
  C:\Windows\System\QeGXHJH.exe
  2⤵
  PID:6460
- C:\Windows\System\tOwgLnC.exe
  C:\Windows\System\tOwgLnC.exe
  2⤵
  PID:6476
- C:\Windows\System\AanOCJI.exe
  C:\Windows\System\AanOCJI.exe
  2⤵
  PID:6492
- C:\Windows\System\eIawJJb.exe
  C:\Windows\System\eIawJJb.exe
  2⤵
  PID:6508
- C:\Windows\System\xyBqVCq.exe
  C:\Windows\System\xyBqVCq.exe
  2⤵
  PID:6528
- C:\Windows\System\dcAAmgv.exe
  C:\Windows\System\dcAAmgv.exe
  2⤵
  PID:6544
- C:\Windows\System\DLyGDUk.exe
  C:\Windows\System\DLyGDUk.exe
  2⤵
  PID:6560
- C:\Windows\System\UcePGVE.exe
  C:\Windows\System\UcePGVE.exe
  2⤵
  PID:6576
- C:\Windows\System\JOSGhEo.exe
  C:\Windows\System\JOSGhEo.exe
  2⤵
  PID:6592
- C:\Windows\System\JAdpMJB.exe
  C:\Windows\System\JAdpMJB.exe
  2⤵
  PID:6608
- C:\Windows\System\JkMAKnH.exe
  C:\Windows\System\JkMAKnH.exe
  2⤵
  PID:6624
- C:\Windows\System\OgmNGVt.exe
  C:\Windows\System\OgmNGVt.exe
  2⤵
  PID:6640
- C:\Windows\System\KNdKzxQ.exe
  C:\Windows\System\KNdKzxQ.exe
  2⤵
  PID:6656
- C:\Windows\System\evFLGRx.exe
  C:\Windows\System\evFLGRx.exe
  2⤵
  PID:6672
- C:\Windows\System\PCIXkcz.exe
  C:\Windows\System\PCIXkcz.exe
  2⤵
  PID:6688
- C:\Windows\System\daJgMBU.exe
  C:\Windows\System\daJgMBU.exe
  2⤵
  PID:6704
- C:\Windows\System\FqTQsjv.exe
  C:\Windows\System\FqTQsjv.exe
  2⤵
  PID:6724
- C:\Windows\System\ShsKntJ.exe
  C:\Windows\System\ShsKntJ.exe
  2⤵
  PID:6740
- C:\Windows\System\YeXsGhv.exe
  C:\Windows\System\YeXsGhv.exe
  2⤵
  PID:6756
- C:\Windows\System\IgvILBz.exe
  C:\Windows\System\IgvILBz.exe
  2⤵
  PID:6772
- C:\Windows\System\VVsRQfJ.exe
  C:\Windows\System\VVsRQfJ.exe
  2⤵
  PID:6788
- C:\Windows\System\zZbJLmQ.exe
  C:\Windows\System\zZbJLmQ.exe
  2⤵
  PID:6804
- C:\Windows\System\snJzSpA.exe
  C:\Windows\System\snJzSpA.exe
  2⤵
  PID:6820
- C:\Windows\System\mOqhySZ.exe
  C:\Windows\System\mOqhySZ.exe
  2⤵
  PID:6836
- C:\Windows\System\muaZFAK.exe
  C:\Windows\System\muaZFAK.exe
  2⤵
  PID:6852
- C:\Windows\System\UikXAvg.exe
  C:\Windows\System\UikXAvg.exe
  2⤵
  PID:6868
- C:\Windows\System\kOtNJuh.exe
  C:\Windows\System\kOtNJuh.exe
  2⤵
  PID:6884
- C:\Windows\System\WxqPjwX.exe
  C:\Windows\System\WxqPjwX.exe
  2⤵
  PID:6900
- C:\Windows\System\yncWfkz.exe
  C:\Windows\System\yncWfkz.exe
  2⤵
  PID:6916
- C:\Windows\System\JctaURI.exe
  C:\Windows\System\JctaURI.exe
  2⤵
  PID:6932
- C:\Windows\System\JIAgKnE.exe
  C:\Windows\System\JIAgKnE.exe
  2⤵
  PID:6948
- C:\Windows\System\GLBsHOn.exe
  C:\Windows\System\GLBsHOn.exe
  2⤵
  PID:6964
- C:\Windows\System\dZBXRgy.exe
  C:\Windows\System\dZBXRgy.exe
  2⤵
  PID:6980
- C:\Windows\System\szWxqDK.exe
  C:\Windows\System\szWxqDK.exe
  2⤵
  PID:6996
- C:\Windows\System\VcwKXxF.exe
  C:\Windows\System\VcwKXxF.exe
  2⤵
  PID:7012
- C:\Windows\System\pglueAP.exe
  C:\Windows\System\pglueAP.exe
  2⤵
  PID:7028
- C:\Windows\System\PmVJEDk.exe
  C:\Windows\System\PmVJEDk.exe
  2⤵
  PID:7044
- C:\Windows\System\xFkDhuR.exe
  C:\Windows\System\xFkDhuR.exe
  2⤵
  PID:7060
- C:\Windows\System\tUoXfyP.exe
  C:\Windows\System\tUoXfyP.exe
  2⤵
  PID:7076
- C:\Windows\System\OlnPteK.exe
  C:\Windows\System\OlnPteK.exe
  2⤵
  PID:7096
- C:\Windows\System\tigsoKn.exe
  C:\Windows\System\tigsoKn.exe
  2⤵
  PID:7112
- C:\Windows\System\mTJrSJh.exe
  C:\Windows\System\mTJrSJh.exe
  2⤵
  PID:7128
- C:\Windows\System\ZLyxZIV.exe
  C:\Windows\System\ZLyxZIV.exe
  2⤵
  PID:7144
- C:\Windows\System\yMoelnu.exe
  C:\Windows\System\yMoelnu.exe
  2⤵
  PID:7160
- C:\Windows\System\XPVujjB.exe
  C:\Windows\System\XPVujjB.exe
  2⤵
  PID:1764
- C:\Windows\System\pRhserm.exe
  C:\Windows\System\pRhserm.exe
  2⤵
  PID:6160
- C:\Windows\System\EGWWUrf.exe
  C:\Windows\System\EGWWUrf.exe
  2⤵
  PID:6208
- C:\Windows\System\DMXuiHu.exe
  C:\Windows\System\DMXuiHu.exe
  2⤵
  PID:6196
- C:\Windows\System\zeXuMTr.exe
  C:\Windows\System\zeXuMTr.exe
  2⤵
  PID:6296
- C:\Windows\System\cWRBAOT.exe
  C:\Windows\System\cWRBAOT.exe
  2⤵
  PID:6328
- C:\Windows\System\pTBZskY.exe
  C:\Windows\System\pTBZskY.exe
  2⤵
  PID:6420
- C:\Windows\System\DVIZEFd.exe
  C:\Windows\System\DVIZEFd.exe
  2⤵
  PID:4388
- C:\Windows\System\goBurAp.exe
  C:\Windows\System\goBurAp.exe
  2⤵
  PID:6520
- C:\Windows\System\RoxeBnX.exe
  C:\Windows\System\RoxeBnX.exe
  2⤵
  PID:6484
- C:\Windows\System\afStrqF.exe
  C:\Windows\System\afStrqF.exe
  2⤵
  PID:6556
- C:\Windows\System\qfMAZrb.exe
  C:\Windows\System\qfMAZrb.exe
  2⤵
  PID:6712
- C:\Windows\System\QWjvEfK.exe
  C:\Windows\System\QWjvEfK.exe
  2⤵
  PID:6276
- C:\Windows\System\tAgLNkb.exe
  C:\Windows\System\tAgLNkb.exe
  2⤵
  PID:6340
- C:\Windows\System\qmITapX.exe
  C:\Windows\System\qmITapX.exe
  2⤵
  PID:6404
- C:\Windows\System\Toysbha.exe
  C:\Windows\System\Toysbha.exe
  2⤵
  PID:6468
- C:\Windows\System\EbaZxUX.exe
  C:\Windows\System\EbaZxUX.exe
  2⤵
  PID:6720
- C:\Windows\System\qlvNbzK.exe
  C:\Windows\System\qlvNbzK.exe
  2⤵
  PID:6568
- C:\Windows\System\MjqFRak.exe
  C:\Windows\System\MjqFRak.exe
  2⤵
  PID:6600
- C:\Windows\System\slzivhc.exe
  C:\Windows\System\slzivhc.exe
  2⤵
  PID:6664
- C:\Windows\System\fqVwirR.exe
  C:\Windows\System\fqVwirR.exe
  2⤵
  PID:6736
- C:\Windows\System\AIQdLTg.exe
  C:\Windows\System\AIQdLTg.exe
  2⤵
  PID:6816
- C:\Windows\System\cAMSsTL.exe
  C:\Windows\System\cAMSsTL.exe
  2⤵
  PID:6848
- C:\Windows\System\AqAKdOv.exe
  C:\Windows\System\AqAKdOv.exe
  2⤵
  PID:6976
- C:\Windows\System\mUMXoHa.exe
  C:\Windows\System\mUMXoHa.exe
  2⤵
  PID:7036
- C:\Windows\System\lVgFVso.exe
  C:\Windows\System\lVgFVso.exe
  2⤵
  PID:7004
- C:\Windows\System\IsAvvkL.exe
  C:\Windows\System\IsAvvkL.exe
  2⤵
  PID:7140
- C:\Windows\System\xjEqcUy.exe
  C:\Windows\System\xjEqcUy.exe
  2⤵
  PID:6064
- C:\Windows\System\YhnlBhs.exe
  C:\Windows\System\YhnlBhs.exe
  2⤵
  PID:6800
- C:\Windows\System\HAgcAFd.exe
  C:\Windows\System\HAgcAFd.exe
  2⤵
  PID:6832
- C:\Windows\System\ZmLURsQ.exe
  C:\Windows\System\ZmLURsQ.exe
  2⤵
  PID:6988
- C:\Windows\System\cvYNfMU.exe
  C:\Windows\System\cvYNfMU.exe
  2⤵
  PID:6928
- C:\Windows\System\GwwnTbC.exe
  C:\Windows\System\GwwnTbC.exe
  2⤵
  PID:6956
- C:\Windows\System\aAvqjcP.exe
  C:\Windows\System\aAvqjcP.exe
  2⤵
  PID:6992
- C:\Windows\System\bOylwqc.exe
  C:\Windows\System\bOylwqc.exe
  2⤵
  PID:7084
- C:\Windows\System\mgOgAnf.exe
  C:\Windows\System\mgOgAnf.exe
  2⤵
  PID:7052
- C:\Windows\System\UyKJuaE.exe
  C:\Windows\System\UyKJuaE.exe
  2⤵
  PID:7124
- C:\Windows\System\bFCaMBw.exe
  C:\Windows\System\bFCaMBw.exe
  2⤵
  PID:6388
- C:\Windows\System\DYDdhvg.exe
  C:\Windows\System\DYDdhvg.exe
  2⤵
  PID:6516
- C:\Windows\System\AJUhLFM.exe
  C:\Windows\System\AJUhLFM.exe
  2⤵
  PID:6244
- C:\Windows\System\SVlrHOI.exe
  C:\Windows\System\SVlrHOI.exe
  2⤵
  PID:6684
- C:\Windows\System\xAlADRh.exe
  C:\Windows\System\xAlADRh.exe
  2⤵
  PID:6752
- C:\Windows\System\DoWLWdQ.exe
  C:\Windows\System\DoWLWdQ.exe
  2⤵
  PID:6732
- C:\Windows\System\ciVscfa.exe
  C:\Windows\System\ciVscfa.exe
  2⤵
  PID:6764
- C:\Windows\System\xRfOLFs.exe
  C:\Windows\System\xRfOLFs.exe
  2⤵
  PID:6680
- C:\Windows\System\GMkUsSA.exe
  C:\Windows\System\GMkUsSA.exe
  2⤵
  PID:6796
- C:\Windows\System\BLZRSMB.exe
  C:\Windows\System\BLZRSMB.exe
  2⤵
  PID:6440
- C:\Windows\System\LknypIU.exe
  C:\Windows\System\LknypIU.exe
  2⤵
  PID:6632
- C:\Windows\System\hTiUtEU.exe
  C:\Windows\System\hTiUtEU.exe
  2⤵
  PID:6176
- C:\Windows\System\PJRAAlj.exe
  C:\Windows\System\PJRAAlj.exe
  2⤵
  PID:2904
- C:\Windows\System\olZXYvo.exe
  C:\Windows\System\olZXYvo.exe
  2⤵
  PID:1092
- C:\Windows\System\tfoVPQz.exe
  C:\Windows\System\tfoVPQz.exe
  2⤵
  PID:7020
- C:\Windows\System\eMPSvIE.exe
  C:\Windows\System\eMPSvIE.exe
  2⤵
  PID:6260
- C:\Windows\System\fJIJZVT.exe
  C:\Windows\System\fJIJZVT.exe
  2⤵
  PID:6360
- C:\Windows\System\laSLhMC.exe
  C:\Windows\System\laSLhMC.exe
  2⤵
  PID:6488
- C:\Windows\System\UfxEoXz.exe
  C:\Windows\System\UfxEoXz.exe
  2⤵
  PID:6616
- C:\Windows\System\OeczovE.exe
  C:\Windows\System\OeczovE.exe
  2⤵
  PID:6312
- C:\Windows\System\HcytrFp.exe
  C:\Windows\System\HcytrFp.exe
  2⤵
  PID:7072
- C:\Windows\System\hDlNnlG.exe
  C:\Windows\System\hDlNnlG.exe
  2⤵
  PID:6372
- C:\Windows\System\XcCEZGh.exe
  C:\Windows\System\XcCEZGh.exe
  2⤵
  PID:6780
- C:\Windows\System\QxidJAc.exe
  C:\Windows\System\QxidJAc.exe
  2⤵
  PID:7108
- C:\Windows\System\KOIAjcy.exe
  C:\Windows\System\KOIAjcy.exe
  2⤵
  PID:5792
- C:\Windows\System\obYezAJ.exe
  C:\Windows\System\obYezAJ.exe
  2⤵
  PID:5724
- C:\Windows\System\fiRzqdn.exe
  C:\Windows\System\fiRzqdn.exe
  2⤵
  PID:6716
- C:\Windows\System\UnZnqvq.exe
  C:\Windows\System\UnZnqvq.exe
  2⤵
  PID:6452
- C:\Windows\System\JpIQgva.exe
  C:\Windows\System\JpIQgva.exe
  2⤵
  PID:6536
- C:\Windows\System\kjUoejj.exe
  C:\Windows\System\kjUoejj.exe
  2⤵
  PID:6924
- C:\Windows\System\CMqTJRk.exe
  C:\Windows\System\CMqTJRk.exe
  2⤵
  PID:6584
- C:\Windows\System\xBlTpoI.exe
  C:\Windows\System\xBlTpoI.exe
  2⤵
  PID:6248
- C:\Windows\System\ujIwiEU.exe
  C:\Windows\System\ujIwiEU.exe
  2⤵
  PID:7184
- C:\Windows\System\wECRcWb.exe
  C:\Windows\System\wECRcWb.exe
  2⤵
  PID:7200
- C:\Windows\System\IvyljzZ.exe
  C:\Windows\System\IvyljzZ.exe
  2⤵
  PID:7240
- C:\Windows\System\EncVJnZ.exe
  C:\Windows\System\EncVJnZ.exe
  2⤵
  PID:7276
- C:\Windows\System\RRGFgEo.exe
  C:\Windows\System\RRGFgEo.exe
  2⤵
  PID:7332
- C:\Windows\System\MvSSEGK.exe
  C:\Windows\System\MvSSEGK.exe
  2⤵
  PID:7396
- C:\Windows\System\DnEJrdC.exe
  C:\Windows\System\DnEJrdC.exe
  2⤵
  PID:7416
- C:\Windows\System\HBcmHdi.exe
  C:\Windows\System\HBcmHdi.exe
  2⤵
  PID:7436
- C:\Windows\System\fSkaoub.exe
  C:\Windows\System\fSkaoub.exe
  2⤵
  PID:7452
- C:\Windows\System\QNXTLNi.exe
  C:\Windows\System\QNXTLNi.exe
  2⤵
  PID:7472
- C:\Windows\System\jSDIxgo.exe
  C:\Windows\System\jSDIxgo.exe
  2⤵
  PID:7488
- C:\Windows\System\tsyvmmu.exe
  C:\Windows\System\tsyvmmu.exe
  2⤵
  PID:7504
- C:\Windows\System\bujiAEK.exe
  C:\Windows\System\bujiAEK.exe
  2⤵
  PID:7520
- C:\Windows\System\MZBPSMW.exe
  C:\Windows\System\MZBPSMW.exe
  2⤵
  PID:7536
- C:\Windows\System\BXYLKJz.exe
  C:\Windows\System\BXYLKJz.exe
  2⤵
  PID:7552
- C:\Windows\System\LGBTPnH.exe
  C:\Windows\System\LGBTPnH.exe
  2⤵
  PID:7568
- C:\Windows\System\xajpEXr.exe
  C:\Windows\System\xajpEXr.exe
  2⤵
  PID:7584
- C:\Windows\System\waKmPmF.exe
  C:\Windows\System\waKmPmF.exe
  2⤵
  PID:7600
- C:\Windows\System\FaanObt.exe
  C:\Windows\System\FaanObt.exe
  2⤵
  PID:7616
- C:\Windows\System\QziKQrH.exe
  C:\Windows\System\QziKQrH.exe
  2⤵
  PID:7632
- C:\Windows\System\RStTWVo.exe
  C:\Windows\System\RStTWVo.exe
  2⤵
  PID:7648
- C:\Windows\System\vCByuaL.exe
  C:\Windows\System\vCByuaL.exe
  2⤵
  PID:7664
- C:\Windows\System\legmUBK.exe
  C:\Windows\System\legmUBK.exe
  2⤵
  PID:7680
- C:\Windows\System\QBVQQQf.exe
  C:\Windows\System\QBVQQQf.exe
  2⤵
  PID:7696
- C:\Windows\System\jqWGRYn.exe
  C:\Windows\System\jqWGRYn.exe
  2⤵
  PID:7712
- C:\Windows\System\dnMFbnY.exe
  C:\Windows\System\dnMFbnY.exe
  2⤵
  PID:7728
- C:\Windows\System\YEJHouV.exe
  C:\Windows\System\YEJHouV.exe
  2⤵
  PID:7744
- C:\Windows\System\LlXPzdW.exe
  C:\Windows\System\LlXPzdW.exe
  2⤵
  PID:7760
- C:\Windows\System\yITMOkV.exe
  C:\Windows\System\yITMOkV.exe
  2⤵
  PID:7776
- C:\Windows\System\AYmjMkf.exe
  C:\Windows\System\AYmjMkf.exe
  2⤵
  PID:7792
- C:\Windows\System\vezJqgl.exe
  C:\Windows\System\vezJqgl.exe
  2⤵
  PID:7808
- C:\Windows\System\ISHrVKZ.exe
  C:\Windows\System\ISHrVKZ.exe
  2⤵
  PID:7824
- C:\Windows\System\FznEQFj.exe
  C:\Windows\System\FznEQFj.exe
  2⤵
  PID:7840
- C:\Windows\System\qFxsSWg.exe
  C:\Windows\System\qFxsSWg.exe
  2⤵
  PID:7856
- C:\Windows\System\KwfxzmD.exe
  C:\Windows\System\KwfxzmD.exe
  2⤵
  PID:7872
- C:\Windows\System\lToAxNc.exe
  C:\Windows\System\lToAxNc.exe
  2⤵
  PID:7888
- C:\Windows\System\nbEXgYe.exe
  C:\Windows\System\nbEXgYe.exe
  2⤵
  PID:7904
- C:\Windows\System\VjeafZa.exe
  C:\Windows\System\VjeafZa.exe
  2⤵
  PID:7920
- C:\Windows\System\NGxUnZy.exe
  C:\Windows\System\NGxUnZy.exe
  2⤵
  PID:7936
- C:\Windows\System\bvAIrcl.exe
  C:\Windows\System\bvAIrcl.exe
  2⤵
  PID:7952
- C:\Windows\System\TITYjEd.exe
  C:\Windows\System\TITYjEd.exe
  2⤵
  PID:7968
- C:\Windows\System\VpGFWjP.exe
  C:\Windows\System\VpGFWjP.exe
  2⤵
  PID:7988
- C:\Windows\System\SVXkPPy.exe
  C:\Windows\System\SVXkPPy.exe
  2⤵
  PID:8004
- C:\Windows\System\XdYJHsW.exe
  C:\Windows\System\XdYJHsW.exe
  2⤵
  PID:8020
- C:\Windows\System\wienbLI.exe
  C:\Windows\System\wienbLI.exe
  2⤵
  PID:8036
- C:\Windows\System\xQdpWrE.exe
  C:\Windows\System\xQdpWrE.exe
  2⤵
  PID:8052
- C:\Windows\System\sbszazK.exe
  C:\Windows\System\sbszazK.exe
  2⤵
  PID:8068
- C:\Windows\System\AeZwzDl.exe
  C:\Windows\System\AeZwzDl.exe
  2⤵
  PID:8084
- C:\Windows\System\VcNArnZ.exe
  C:\Windows\System\VcNArnZ.exe
  2⤵
  PID:8100
- C:\Windows\System\RYhaysm.exe
  C:\Windows\System\RYhaysm.exe
  2⤵
  PID:8116
- C:\Windows\System\eLUYqtD.exe
  C:\Windows\System\eLUYqtD.exe
  2⤵
  PID:8132
- C:\Windows\System\goajvCa.exe
  C:\Windows\System\goajvCa.exe
  2⤵
  PID:8148
- C:\Windows\System\GjeXndc.exe
  C:\Windows\System\GjeXndc.exe
  2⤵
  PID:8164
- C:\Windows\System\yJuVasH.exe
  C:\Windows\System\yJuVasH.exe
  2⤵
  PID:8180
- C:\Windows\System\ojGSKIX.exe
  C:\Windows\System\ojGSKIX.exe
  2⤵
  PID:6908
- C:\Windows\System\UgdqZAZ.exe
  C:\Windows\System\UgdqZAZ.exe
  2⤵
  PID:7176
- C:\Windows\System\liekzIA.exe
  C:\Windows\System\liekzIA.exe
  2⤵
  PID:7220
- C:\Windows\System\GmXDAqs.exe
  C:\Windows\System\GmXDAqs.exe
  2⤵
  PID:7212
- C:\Windows\System\uCmeTzs.exe
  C:\Windows\System\uCmeTzs.exe
  2⤵
  PID:7232
- C:\Windows\System\bhRyMCw.exe
  C:\Windows\System\bhRyMCw.exe
  2⤵
  PID:7236
- C:\Windows\System\WZUKcAU.exe
  C:\Windows\System\WZUKcAU.exe
  2⤵
  PID:7268
- C:\Windows\System\fdmJYLE.exe
  C:\Windows\System\fdmJYLE.exe
  2⤵
  PID:7360
- C:\Windows\System\lEusqIW.exe
  C:\Windows\System\lEusqIW.exe
  2⤵
  PID:7384
- C:\Windows\System\uzoNTHo.exe
  C:\Windows\System\uzoNTHo.exe
  2⤵
  PID:7460
- C:\Windows\System\NKTipta.exe
  C:\Windows\System\NKTipta.exe
  2⤵
  PID:7644
- C:\Windows\System\YdQiWOc.exe
  C:\Windows\System\YdQiWOc.exe
  2⤵
  PID:7708
- C:\Windows\System\TiHslBm.exe
  C:\Windows\System\TiHslBm.exe
  2⤵
  PID:7768
- C:\Windows\System\CgHXMaN.exe
  C:\Windows\System\CgHXMaN.exe
  2⤵
  PID:7816
- C:\Windows\System\OdoVtSk.exe
  C:\Windows\System\OdoVtSk.exe
  2⤵
  PID:7848
- C:\Windows\System\FliytuY.exe
  C:\Windows\System\FliytuY.exe
  2⤵
  PID:7912
- C:\Windows\System\GrVAssw.exe
  C:\Windows\System\GrVAssw.exe
  2⤵
  PID:7976
- C:\Windows\System\aTfSgIs.exe
  C:\Windows\System\aTfSgIs.exe
  2⤵
  PID:8044
- C:\Windows\System\mJqbQwE.exe
  C:\Windows\System\mJqbQwE.exe
  2⤵
  PID:7868
- C:\Windows\System\fleYdvI.exe
  C:\Windows\System\fleYdvI.exe
  2⤵
  PID:7832
- C:\Windows\System\VWCjPjn.exe
  C:\Windows\System\VWCjPjn.exe
  2⤵
  PID:7964
- C:\Windows\System\TbdHWPL.exe
  C:\Windows\System\TbdHWPL.exe
  2⤵
  PID:8076
- C:\Windows\System\NOgbQfQ.exe
  C:\Windows\System\NOgbQfQ.exe
  2⤵
  PID:8140
- C:\Windows\System\jtqFOyK.exe
  C:\Windows\System\jtqFOyK.exe
  2⤵
  PID:8092
- C:\Windows\System\GRbpHHW.exe
  C:\Windows\System\GRbpHHW.exe
  2⤵
  PID:8156
- C:\Windows\System\eOOiSob.exe
  C:\Windows\System\eOOiSob.exe
  2⤵
  PID:6880
- C:\Windows\System\MTtzEvn.exe
  C:\Windows\System\MTtzEvn.exe
  2⤵
  PID:7308
- C:\Windows\System\AwJzhTr.exe
  C:\Windows\System\AwJzhTr.exe
  2⤵
  PID:7224
- C:\Windows\System\kLqTSDd.exe
  C:\Windows\System\kLqTSDd.exe
  2⤵
  PID:7260
- C:\Windows\System\lgwzTex.exe
  C:\Windows\System\lgwzTex.exe
  2⤵
  PID:7288
- C:\Windows\System\JCrOesL.exe
  C:\Windows\System\JCrOesL.exe
  2⤵
  PID:7292
- C:\Windows\System\AOJzSlA.exe
  C:\Windows\System\AOJzSlA.exe
  2⤵
  PID:7320
- C:\Windows\System\XkIOeQq.exe
  C:\Windows\System\XkIOeQq.exe
  2⤵
  PID:7256
- C:\Windows\System\cUlEsli.exe
  C:\Windows\System\cUlEsli.exe
  2⤵
  PID:6652
- C:\Windows\System\VVwXKnZ.exe
  C:\Windows\System\VVwXKnZ.exe
  2⤵
  PID:7388
- C:\Windows\System\CMZXigP.exe
  C:\Windows\System\CMZXigP.exe
  2⤵
  PID:7432
- C:\Windows\System\GjxYpsb.exe
  C:\Windows\System\GjxYpsb.exe
  2⤵
  PID:7444
- C:\Windows\System\PHMCceO.exe
  C:\Windows\System\PHMCceO.exe
  2⤵
  PID:7480
- C:\Windows\System\bnMgLXJ.exe
  C:\Windows\System\bnMgLXJ.exe
  2⤵
  PID:7564
- C:\Windows\System\AjBPxuO.exe
  C:\Windows\System\AjBPxuO.exe
  2⤵
  PID:7628
- C:\Windows\System\gwyuRuS.exe
  C:\Windows\System\gwyuRuS.exe
  2⤵
  PID:7688
- C:\Windows\System\cawxjUw.exe
  C:\Windows\System\cawxjUw.exe
  2⤵
  PID:7720
- C:\Windows\System\KLUJdJQ.exe
  C:\Windows\System\KLUJdJQ.exe
  2⤵
  PID:7640
- C:\Windows\System\tRXnROH.exe
  C:\Windows\System\tRXnROH.exe
  2⤵
  PID:7676
- C:\Windows\System\bchDUiS.exe
  C:\Windows\System\bchDUiS.exe
  2⤵
  PID:7788
- C:\Windows\System\iuSjUwJ.exe
  C:\Windows\System\iuSjUwJ.exe
  2⤵
  PID:7880
- C:\Windows\System\pFRzlhu.exe
  C:\Windows\System\pFRzlhu.exe
  2⤵
  PID:7836
- C:\Windows\System\oElnwMI.exe
  C:\Windows\System\oElnwMI.exe
  2⤵
  PID:7900
- C:\Windows\System\whLsxVa.exe
  C:\Windows\System\whLsxVa.exe
  2⤵
  PID:8060
- C:\Windows\System\eBzKpgx.exe
  C:\Windows\System\eBzKpgx.exe
  2⤵
  PID:8112
- C:\Windows\System\tWiyrGD.exe
  C:\Windows\System\tWiyrGD.exe
  2⤵
  PID:5908
- C:\Windows\System\aNrikoB.exe
  C:\Windows\System\aNrikoB.exe
  2⤵
  PID:8128
- C:\Windows\System\rgaUhKR.exe
  C:\Windows\System\rgaUhKR.exe
  2⤵
  PID:5680
- C:\Windows\System\qBlYSLN.exe
  C:\Windows\System\qBlYSLN.exe
  2⤵
  PID:7272
- C:\Windows\System\KvoXfrI.exe
  C:\Windows\System\KvoXfrI.exe
  2⤵
  PID:7428
- C:\Windows\System\VkEGEvS.exe
  C:\Windows\System\VkEGEvS.exe
  2⤵
  PID:7596
- C:\Windows\System\MGNRmPo.exe
  C:\Windows\System\MGNRmPo.exe
  2⤵
  PID:7660
- C:\Windows\System\mbpopDq.exe
  C:\Windows\System\mbpopDq.exe
  2⤵
  PID:7484
- C:\Windows\System\yttWmcr.exe
  C:\Windows\System\yttWmcr.exe
  2⤵
  PID:7404
- C:\Windows\System\xSUNVqI.exe
  C:\Windows\System\xSUNVqI.exe
  2⤵
  PID:7612
- C:\Windows\System\iJKbpLh.exe
  C:\Windows\System\iJKbpLh.exe
  2⤵
  PID:7948
- C:\Windows\System\PoYqjeQ.exe
  C:\Windows\System\PoYqjeQ.exe
  2⤵
  PID:7348
- C:\Windows\System\MVvuKGf.exe
  C:\Windows\System\MVvuKGf.exe
  2⤵
  PID:8016
- C:\Windows\System\OriMbiZ.exe
  C:\Windows\System\OriMbiZ.exe
  2⤵
  PID:7528
- C:\Windows\System\plPJNog.exe
  C:\Windows\System\plPJNog.exe
  2⤵
  PID:8208
- C:\Windows\System\IPJxTuB.exe
  C:\Windows\System\IPJxTuB.exe
  2⤵
  PID:8224
- C:\Windows\System\OMneEyb.exe
  C:\Windows\System\OMneEyb.exe
  2⤵
  PID:8240
- C:\Windows\System\pVfhGdr.exe
  C:\Windows\System\pVfhGdr.exe
  2⤵
  PID:8256
- C:\Windows\System\gHqoIRz.exe
  C:\Windows\System\gHqoIRz.exe
  2⤵
  PID:8272
- C:\Windows\System\sIEIuVY.exe
  C:\Windows\System\sIEIuVY.exe
  2⤵
  PID:8288
- C:\Windows\System\CghbmHj.exe
  C:\Windows\System\CghbmHj.exe
  2⤵
  PID:8304
- C:\Windows\System\QZbwmim.exe
  C:\Windows\System\QZbwmim.exe
  2⤵
  PID:8320
- C:\Windows\System\pAcRhdm.exe
  C:\Windows\System\pAcRhdm.exe
  2⤵
  PID:8336
- C:\Windows\System\AkoQssn.exe
  C:\Windows\System\AkoQssn.exe
  2⤵
  PID:8352
- C:\Windows\System\vTBmYfx.exe
  C:\Windows\System\vTBmYfx.exe
  2⤵
  PID:8368
- C:\Windows\System\LKfLLTl.exe
  C:\Windows\System\LKfLLTl.exe
  2⤵
  PID:8384
- C:\Windows\System\FnveYTQ.exe
  C:\Windows\System\FnveYTQ.exe
  2⤵
  PID:8400
- C:\Windows\System\yKBISoX.exe
  C:\Windows\System\yKBISoX.exe
  2⤵
  PID:8416
- C:\Windows\System\mRDVsiL.exe
  C:\Windows\System\mRDVsiL.exe
  2⤵
  PID:8432
- C:\Windows\System\jQMcGVb.exe
  C:\Windows\System\jQMcGVb.exe
  2⤵
  PID:8452
- C:\Windows\System\sGfmzJQ.exe
  C:\Windows\System\sGfmzJQ.exe
  2⤵
  PID:8468
- C:\Windows\System\ttqKTVq.exe
  C:\Windows\System\ttqKTVq.exe
  2⤵
  PID:8484
- C:\Windows\System\olkfYyr.exe
  C:\Windows\System\olkfYyr.exe
  2⤵
  PID:8500
- C:\Windows\System\ufyZWfm.exe
  C:\Windows\System\ufyZWfm.exe
  2⤵
  PID:8516
- C:\Windows\System\UYxNFSC.exe
  C:\Windows\System\UYxNFSC.exe
  2⤵
  PID:8536
- C:\Windows\System\scEVjUE.exe
  C:\Windows\System\scEVjUE.exe
  2⤵
  PID:8552
- C:\Windows\System\vrPVtve.exe
  C:\Windows\System\vrPVtve.exe
  2⤵
  PID:8568
- C:\Windows\System\janVqnu.exe
  C:\Windows\System\janVqnu.exe
  2⤵
  PID:8584
- C:\Windows\System\IKKMiXz.exe
  C:\Windows\System\IKKMiXz.exe
  2⤵
  PID:8600
- C:\Windows\System\iStWzjb.exe
  C:\Windows\System\iStWzjb.exe
  2⤵
  PID:8616
- C:\Windows\System\BFDYhuh.exe
  C:\Windows\System\BFDYhuh.exe
  2⤵
  PID:8632
- C:\Windows\System\RRKBpKT.exe
  C:\Windows\System\RRKBpKT.exe
  2⤵
  PID:8648
- C:\Windows\System\JpytXex.exe
  C:\Windows\System\JpytXex.exe
  2⤵
  PID:8664
- C:\Windows\System\fblsHZQ.exe
  C:\Windows\System\fblsHZQ.exe
  2⤵
  PID:8684
- C:\Windows\System\uiqpgoJ.exe
  C:\Windows\System\uiqpgoJ.exe
  2⤵
  PID:8700
- C:\Windows\System\KkZTvje.exe
  C:\Windows\System\KkZTvje.exe
  2⤵
  PID:8716
- C:\Windows\System\kqSbvIY.exe
  C:\Windows\System\kqSbvIY.exe
  2⤵
  PID:8736
- C:\Windows\System\YyFJLDP.exe
  C:\Windows\System\YyFJLDP.exe
  2⤵
  PID:8752
- C:\Windows\System\liQXHdt.exe
  C:\Windows\System\liQXHdt.exe
  2⤵
  PID:8772
- C:\Windows\System\bpsdLul.exe
  C:\Windows\System\bpsdLul.exe
  2⤵
  PID:8788
- C:\Windows\System\bbtLfVr.exe
  C:\Windows\System\bbtLfVr.exe
  2⤵
  PID:8804
- C:\Windows\System\qHEXwjM.exe
  C:\Windows\System\qHEXwjM.exe
  2⤵
  PID:8820
- C:\Windows\System\ALRkiXJ.exe
  C:\Windows\System\ALRkiXJ.exe
  2⤵
  PID:8836
- C:\Windows\System\SLwChnX.exe
  C:\Windows\System\SLwChnX.exe
  2⤵
  PID:8852
- C:\Windows\System\mdukvya.exe
  C:\Windows\System\mdukvya.exe
  2⤵
  PID:8868
- C:\Windows\System\zBvEDfH.exe
  C:\Windows\System\zBvEDfH.exe
  2⤵
  PID:8884
- C:\Windows\System\pxPhWsG.exe
  C:\Windows\System\pxPhWsG.exe
  2⤵
  PID:8900
- C:\Windows\System\NmbWjsJ.exe
  C:\Windows\System\NmbWjsJ.exe
  2⤵
  PID:8916
- C:\Windows\System\FObEQpb.exe
  C:\Windows\System\FObEQpb.exe
  2⤵
  PID:8932
- C:\Windows\System\ZXoRnqL.exe
  C:\Windows\System\ZXoRnqL.exe
  2⤵
  PID:9060
- C:\Windows\System\ojTHbgg.exe
  C:\Windows\System\ojTHbgg.exe
  2⤵
  PID:9080
- C:\Windows\System\BmvPhTv.exe
  C:\Windows\System\BmvPhTv.exe
  2⤵
  PID:9096
- C:\Windows\System\ysuWdTw.exe
  C:\Windows\System\ysuWdTw.exe
  2⤵
  PID:9124
- C:\Windows\System\hKzsOBM.exe
  C:\Windows\System\hKzsOBM.exe
  2⤵
  PID:9140
- C:\Windows\System\KifIDTy.exe
  C:\Windows\System\KifIDTy.exe
  2⤵
  PID:9160
- C:\Windows\System\mWKoAbu.exe
  C:\Windows\System\mWKoAbu.exe
  2⤵
  PID:9176
- C:\Windows\System\SBYDHsG.exe
  C:\Windows\System\SBYDHsG.exe
  2⤵
  PID:9196
- C:\Windows\System\wfimYOh.exe
  C:\Windows\System\wfimYOh.exe
  2⤵
  PID:9212
- C:\Windows\System\AjHzuQH.exe
  C:\Windows\System\AjHzuQH.exe
  2⤵
  PID:7756
- C:\Windows\System\uCvZjmF.exe
  C:\Windows\System\uCvZjmF.exe
  2⤵
  PID:7300
- C:\Windows\System\HRvwARZ.exe
  C:\Windows\System\HRvwARZ.exe
  2⤵
  PID:8032
- C:\Windows\System\jluctFZ.exe
  C:\Windows\System\jluctFZ.exe
  2⤵
  PID:8108
- C:\Windows\System\sQsupxQ.exe
  C:\Windows\System\sQsupxQ.exe
  2⤵
  PID:8284
- C:\Windows\System\Gbpxqly.exe
  C:\Windows\System\Gbpxqly.exe
  2⤵
  PID:8316
- C:\Windows\System\wgjZzVo.exe
  C:\Windows\System\wgjZzVo.exe
  2⤵
  PID:7376
- C:\Windows\System\NJskjxL.exe
  C:\Windows\System\NJskjxL.exe
  2⤵
  PID:8344
- C:\Windows\System\bjdqfOc.exe
  C:\Windows\System\bjdqfOc.exe
  2⤵
  PID:8396
- C:\Windows\System\cExxzgz.exe
  C:\Windows\System\cExxzgz.exe
  2⤵
  PID:8376
- C:\Windows\System\mDVYfVE.exe
  C:\Windows\System\mDVYfVE.exe
  2⤵
  PID:8204
- C:\Windows\System\IimwSVA.exe
  C:\Windows\System\IimwSVA.exe
  2⤵
  PID:8328
- C:\Windows\System\icbzhxw.exe
  C:\Windows\System\icbzhxw.exe
  2⤵
  PID:8220
- C:\Windows\System\HLMoqCc.exe
  C:\Windows\System\HLMoqCc.exe
  2⤵
  PID:8428
- C:\Windows\System\XOJhBmb.exe
  C:\Windows\System\XOJhBmb.exe
  2⤵
  PID:8476
- C:\Windows\System\QNqRtIM.exe
  C:\Windows\System\QNqRtIM.exe
  2⤵
  PID:8524
- C:\Windows\System\nnIiPEQ.exe
  C:\Windows\System\nnIiPEQ.exe
  2⤵
  PID:1588
- C:\Windows\System\HKAilVd.exe
  C:\Windows\System\HKAilVd.exe
  2⤵
  PID:8548
- C:\Windows\System\EzOLuMG.exe
  C:\Windows\System\EzOLuMG.exe
  2⤵
  PID:8612
- C:\Windows\System\KBljPWF.exe
  C:\Windows\System\KBljPWF.exe
  2⤵
  PID:8680
- C:\Windows\System\HNqRiky.exe
  C:\Windows\System\HNqRiky.exe
  2⤵
  PID:8656
- C:\Windows\System\aGTJtuR.exe
  C:\Windows\System\aGTJtuR.exe
  2⤵
  PID:8692
- C:\Windows\System\UuWKadj.exe
  C:\Windows\System\UuWKadj.exe
  2⤵
  PID:8628
- C:\Windows\System\EmuXhiK.exe
  C:\Windows\System\EmuXhiK.exe
  2⤵
  PID:8748
- C:\Windows\System\LNTNZwO.exe
  C:\Windows\System\LNTNZwO.exe
  2⤵
  PID:8812
- C:\Windows\System\LtypHkr.exe
  C:\Windows\System\LtypHkr.exe
  2⤵
  PID:8768
- C:\Windows\System\GlPCQLg.exe
  C:\Windows\System\GlPCQLg.exe
  2⤵
  PID:8844
- C:\Windows\System\kiOElUn.exe
  C:\Windows\System\kiOElUn.exe
  2⤵
  PID:8860
- C:\Windows\System\YfhdYrT.exe
  C:\Windows\System\YfhdYrT.exe
  2⤵
  PID:8828
- C:\Windows\System\sGorxge.exe
  C:\Windows\System\sGorxge.exe
  2⤵
  PID:8896
- C:\Windows\System\vDSCsgH.exe
  C:\Windows\System\vDSCsgH.exe
  2⤵
  PID:8948
- C:\Windows\System\KGCXfIv.exe
  C:\Windows\System\KGCXfIv.exe
  2⤵
  PID:8968
- C:\Windows\System\lfHolev.exe
  C:\Windows\System\lfHolev.exe
  2⤵
  PID:8976
- C:\Windows\System\KBrPPEX.exe
  C:\Windows\System\KBrPPEX.exe
  2⤵
  PID:8996
- C:\Windows\System\dDfDgPM.exe
  C:\Windows\System\dDfDgPM.exe
  2⤵
  PID:9016
- C:\Windows\System\ixQiHIm.exe
  C:\Windows\System\ixQiHIm.exe
  2⤵
  PID:9028
- C:\Windows\System\NQwruFk.exe
  C:\Windows\System\NQwruFk.exe
  2⤵
  PID:9044
- C:\Windows\System\NenPjuP.exe
  C:\Windows\System\NenPjuP.exe
  2⤵
  PID:9088
- C:\Windows\System\QNVurOi.exe
  C:\Windows\System\QNVurOi.exe
  2⤵
  PID:9136
- C:\Windows\System\gLlKXQU.exe
  C:\Windows\System\gLlKXQU.exe
  2⤵
  PID:9204
- C:\Windows\System\KKntjiy.exe
  C:\Windows\System\KKntjiy.exe
  2⤵
  PID:7560
- C:\Windows\System\MjDObBx.exe
  C:\Windows\System\MjDObBx.exe
  2⤵
  PID:7608
- C:\Windows\System\xwoxBGq.exe
  C:\Windows\System\xwoxBGq.exe
  2⤵
  PID:7408
- C:\Windows\System\sxnuMbE.exe
  C:\Windows\System\sxnuMbE.exe
  2⤵
  PID:8448
- C:\Windows\System\wZcBIYy.exe
  C:\Windows\System\wZcBIYy.exe
  2⤵
  PID:8544
- C:\Windows\System\zRUUbCm.exe
  C:\Windows\System\zRUUbCm.exe
  2⤵
  PID:8660
- C:\Windows\System\Ssfhwer.exe
  C:\Windows\System\Ssfhwer.exe
  2⤵
  PID:8764
- C:\Windows\System\WxonhnD.exe
  C:\Windows\System\WxonhnD.exe
  2⤵
  PID:8832
- C:\Windows\System\RBYZfUI.exe
  C:\Windows\System\RBYZfUI.exe
  2⤵
  PID:8988
- C:\Windows\System\ihajRMp.exe
  C:\Windows\System\ihajRMp.exe
  2⤵
  PID:9056
- C:\Windows\System\LCznHHu.exe
  C:\Windows\System\LCznHHu.exe
  2⤵
  PID:9148
- C:\Windows\System\PQWgUIl.exe
  C:\Windows\System\PQWgUIl.exe
  2⤵
  PID:8236
- C:\Windows\System\ZktfOPV.exe
  C:\Windows\System\ZktfOPV.exe
  2⤵
  PID:9192
- C:\Windows\System\wWMvycr.exe
  C:\Windows\System\wWMvycr.exe
  2⤵
  PID:8508
- C:\Windows\System\iiDAFNF.exe
  C:\Windows\System\iiDAFNF.exe
  2⤵
  PID:8724
- C:\Windows\System\yaxZekz.exe
  C:\Windows\System\yaxZekz.exe
  2⤵
  PID:8816
- C:\Windows\System\bodAzZW.exe
  C:\Windows\System\bodAzZW.exe
  2⤵
  PID:8944
- C:\Windows\System\FuFhTCM.exe
  C:\Windows\System\FuFhTCM.exe
  2⤵
  PID:9004
- C:\Windows\System\QPCjzOS.exe
  C:\Windows\System\QPCjzOS.exe
  2⤵
  PID:9132
- C:\Windows\System\MTkgcNK.exe
  C:\Windows\System\MTkgcNK.exe
  2⤵
  PID:7692
- C:\Windows\System\NfATTgm.exe
  C:\Windows\System\NfATTgm.exe
  2⤵
  PID:8408
- C:\Windows\System\XSzOSDO.exe
  C:\Windows\System\XSzOSDO.exe
  2⤵
  PID:7380
- C:\Windows\System\jjJhCqj.exe
  C:\Windows\System\jjJhCqj.exe
  2⤵
  PID:8496
- C:\Windows\System\QShjbMK.exe
  C:\Windows\System\QShjbMK.exe
  2⤵
  PID:8964
- C:\Windows\System\FbbcvXi.exe
  C:\Windows\System\FbbcvXi.exe
  2⤵
  PID:9220
- C:\Windows\System\imMzBhR.exe
  C:\Windows\System\imMzBhR.exe
  2⤵
  PID:9312
- C:\Windows\System\bAWUNNh.exe
  C:\Windows\System\bAWUNNh.exe
  2⤵
  PID:9372
- C:\Windows\System\NxUREYf.exe
  C:\Windows\System\NxUREYf.exe
  2⤵
  PID:9388
- C:\Windows\System\oNmJkCR.exe
  C:\Windows\System\oNmJkCR.exe
  2⤵
  PID:9404
- C:\Windows\System\KsPCtCI.exe
  C:\Windows\System\KsPCtCI.exe
  2⤵
  PID:9420
- C:\Windows\System\oVIRGKQ.exe
  C:\Windows\System\oVIRGKQ.exe
  2⤵
  PID:9436
- C:\Windows\System\FQfUjvE.exe
  C:\Windows\System\FQfUjvE.exe
  2⤵
  PID:9452
- C:\Windows\System\JAwCOnp.exe
  C:\Windows\System\JAwCOnp.exe
  2⤵
  PID:9468
- C:\Windows\System\AibZDhr.exe
  C:\Windows\System\AibZDhr.exe
  2⤵
  PID:9488
- C:\Windows\System\YQUIuHf.exe
  C:\Windows\System\YQUIuHf.exe
  2⤵
  PID:9504
- C:\Windows\System\MIInoOa.exe
  C:\Windows\System\MIInoOa.exe
  2⤵
  PID:9520
- C:\Windows\System\rRfKHTp.exe
  C:\Windows\System\rRfKHTp.exe
  2⤵
  PID:9536
- C:\Windows\System\eZvPVJN.exe
  C:\Windows\System\eZvPVJN.exe
  2⤵
  PID:9552
- C:\Windows\System\ZCfcDjH.exe
  C:\Windows\System\ZCfcDjH.exe
  2⤵
  PID:9568
- C:\Windows\System\tzXEsGO.exe
  C:\Windows\System\tzXEsGO.exe
  2⤵
  PID:9584
- C:\Windows\System\gCDFxvk.exe
  C:\Windows\System\gCDFxvk.exe
  2⤵
  PID:9600
- C:\Windows\System\IJDHXoJ.exe
  C:\Windows\System\IJDHXoJ.exe
  2⤵
  PID:9616
- C:\Windows\System\ENCmdwl.exe
  C:\Windows\System\ENCmdwl.exe
  2⤵
  PID:9640
- C:\Windows\System\UKrzYxK.exe
  C:\Windows\System\UKrzYxK.exe
  2⤵
  PID:9692
- C:\Windows\System\ZBimBdX.exe
  C:\Windows\System\ZBimBdX.exe
  2⤵
  PID:9724
- C:\Windows\System\uZEEGCo.exe
  C:\Windows\System\uZEEGCo.exe
  2⤵
  PID:9740
- C:\Windows\System\GHsNBWf.exe
  C:\Windows\System\GHsNBWf.exe
  2⤵
  PID:9760
- C:\Windows\System\YfnZMLG.exe
  C:\Windows\System\YfnZMLG.exe
  2⤵
  PID:9776
- C:\Windows\System\IglzlTT.exe
  C:\Windows\System\IglzlTT.exe
  2⤵
  PID:9792
- C:\Windows\System\uozJsyk.exe
  C:\Windows\System\uozJsyk.exe
  2⤵
  PID:9808
- C:\Windows\System\ovHKnIw.exe
  C:\Windows\System\ovHKnIw.exe
  2⤵
  PID:9824
- C:\Windows\System\vHQFkoz.exe
  C:\Windows\System\vHQFkoz.exe
  2⤵
  PID:9840
- C:\Windows\System\GzJKxws.exe
  C:\Windows\System\GzJKxws.exe
  2⤵
  PID:9856
- C:\Windows\System\fDLNqHa.exe
  C:\Windows\System\fDLNqHa.exe
  2⤵
  PID:9872
- C:\Windows\System\TcDdyue.exe
  C:\Windows\System\TcDdyue.exe
  2⤵
  PID:9888
- C:\Windows\System\fqrXIRr.exe
  C:\Windows\System\fqrXIRr.exe
  2⤵
  PID:9904
- C:\Windows\System\OGTvjlI.exe
  C:\Windows\System\OGTvjlI.exe
  2⤵
  PID:9920
- C:\Windows\System\KmORLha.exe
  C:\Windows\System\KmORLha.exe
  2⤵
  PID:9936
- C:\Windows\System\PYBbjCw.exe
  C:\Windows\System\PYBbjCw.exe
  2⤵
  PID:9952
- C:\Windows\System\GzwHsqg.exe
  C:\Windows\System\GzwHsqg.exe
  2⤵
  PID:9968
- C:\Windows\System\CRHKngj.exe
  C:\Windows\System\CRHKngj.exe
  2⤵
  PID:9984
- C:\Windows\System\STmqoQd.exe
  C:\Windows\System\STmqoQd.exe
  2⤵
  PID:10000
- C:\Windows\System\FXDFwhZ.exe
  C:\Windows\System\FXDFwhZ.exe
  2⤵
  PID:10016
- C:\Windows\System\DFwwTTJ.exe
  C:\Windows\System\DFwwTTJ.exe
  2⤵
  PID:10032
- C:\Windows\System\XlRFNWa.exe
  C:\Windows\System\XlRFNWa.exe
  2⤵
  PID:10048
- C:\Windows\System\LkhHruq.exe
  C:\Windows\System\LkhHruq.exe
  2⤵
  PID:10064
- C:\Windows\System\epInaxH.exe
  C:\Windows\System\epInaxH.exe
  2⤵
  PID:10080
- C:\Windows\System\YDCoLBn.exe
  C:\Windows\System\YDCoLBn.exe
  2⤵
  PID:10096
- C:\Windows\System\URTKJZd.exe
  C:\Windows\System\URTKJZd.exe
  2⤵
  PID:10112
- C:\Windows\System\ENxctXy.exe
  C:\Windows\System\ENxctXy.exe
  2⤵
  PID:10128
- C:\Windows\System\KMJuqrU.exe
  C:\Windows\System\KMJuqrU.exe
  2⤵
  PID:10144
- C:\Windows\System\wIaGCEz.exe
  C:\Windows\System\wIaGCEz.exe
  2⤵
  PID:10160
- C:\Windows\System\KcICLXa.exe
  C:\Windows\System\KcICLXa.exe
  2⤵
  PID:10176
- C:\Windows\System\otjHaRH.exe
  C:\Windows\System\otjHaRH.exe
  2⤵
  PID:10192
- C:\Windows\System\dqlaGaw.exe
  C:\Windows\System\dqlaGaw.exe
  2⤵
  PID:10208
- C:\Windows\System\rrfwAWx.exe
  C:\Windows\System\rrfwAWx.exe
  2⤵
  PID:10228
- C:\Windows\System\AcDsPll.exe
  C:\Windows\System\AcDsPll.exe
  2⤵
  PID:7352
- C:\Windows\System\oJJwsZD.exe
  C:\Windows\System\oJJwsZD.exe
  2⤵
  PID:8392
- C:\Windows\System\EvfWuQv.exe
  C:\Windows\System\EvfWuQv.exe
  2⤵
  PID:8992
- C:\Windows\System\uSwhFxj.exe
  C:\Windows\System\uSwhFxj.exe
  2⤵
  PID:8460
- C:\Windows\System\FGtCmLT.exe
  C:\Windows\System\FGtCmLT.exe
  2⤵
  PID:9120
- C:\Windows\System\jvBCgMG.exe
  C:\Windows\System\jvBCgMG.exe
  2⤵
  PID:8892
- C:\Windows\System\vVfqHzK.exe
  C:\Windows\System\vVfqHzK.exe
  2⤵
  PID:9116
- C:\Windows\System\cwSwtSA.exe
  C:\Windows\System\cwSwtSA.exe
  2⤵
  PID:8280
- C:\Windows\System\yhnaUdk.exe
  C:\Windows\System\yhnaUdk.exe
  2⤵
  PID:9156
- C:\Windows\System\oekseJt.exe
  C:\Windows\System\oekseJt.exe
  2⤵
  PID:8364
- C:\Windows\System\GOZhUfO.exe
  C:\Windows\System\GOZhUfO.exe
  2⤵
  PID:8608
- C:\Windows\System\myjOOuZ.exe
  C:\Windows\System\myjOOuZ.exe
  2⤵
  PID:9236
- C:\Windows\System\gGcFOgc.exe
  C:\Windows\System\gGcFOgc.exe
  2⤵
  PID:9252
- C:\Windows\System\PjxgMze.exe
  C:\Windows\System\PjxgMze.exe
  2⤵
  PID:9268
- C:\Windows\System\OujsUio.exe
  C:\Windows\System\OujsUio.exe
  2⤵
  PID:9284
- C:\Windows\System\XCniAxF.exe
  C:\Windows\System\XCniAxF.exe
  2⤵
  PID:9304
- C:\Windows\System\vPTanfX.exe
  C:\Windows\System\vPTanfX.exe
  2⤵
  PID:9332
- C:\Windows\System\PYOvWBQ.exe
  C:\Windows\System\PYOvWBQ.exe
  2⤵
  PID:9348
- C:\Windows\System\iErAVLV.exe
  C:\Windows\System\iErAVLV.exe
  2⤵
  PID:9308
- C:\Windows\System\rZGDTyq.exe
  C:\Windows\System\rZGDTyq.exe
  2⤵
  PID:9384
- C:\Windows\System\olIjbxp.exe
  C:\Windows\System\olIjbxp.exe
  2⤵
  PID:9448
- C:\Windows\System\LCQkArc.exe
  C:\Windows\System\LCQkArc.exe
  2⤵
  PID:9512
- C:\Windows\System\VNktQAC.exe
  C:\Windows\System\VNktQAC.exe
  2⤵
  PID:9576
- C:\Windows\System\kBIPwoI.exe
  C:\Windows\System\kBIPwoI.exe
  2⤵
  PID:9648
- C:\Windows\System\PYxIwww.exe
  C:\Windows\System\PYxIwww.exe
  2⤵
  PID:9400
- C:\Windows\System\RjuXSBx.exe
  C:\Windows\System\RjuXSBx.exe
  2⤵
  PID:9496
- C:\Windows\System\ZYIyRrt.exe
  C:\Windows\System\ZYIyRrt.exe
  2⤵
  PID:9560
- C:\Windows\System\kQbyLYk.exe
  C:\Windows\System\kQbyLYk.exe
  2⤵
  PID:9632
- C:\Windows\System\tgQwxjU.exe
  C:\Windows\System\tgQwxjU.exe
  2⤵
  PID:9656
- C:\Windows\System\rGpmGeT.exe
  C:\Windows\System\rGpmGeT.exe
  2⤵
  PID:9680
- C:\Windows\System\LsGWqCD.exe
  C:\Windows\System\LsGWqCD.exe
  2⤵
  PID:9700
- C:\Windows\System\qmmLvHH.exe
  C:\Windows\System\qmmLvHH.exe
  2⤵
  PID:9768
- C:\Windows\System\pSpvMVS.exe
  C:\Windows\System\pSpvMVS.exe
  2⤵
  PID:9720
- C:\Windows\System\SdfTZoi.exe
  C:\Windows\System\SdfTZoi.exe
  2⤵
  PID:9756
- C:\Windows\System\WdpfUiR.exe
  C:\Windows\System\WdpfUiR.exe
  2⤵
  PID:9804
- C:\Windows\System\HCKlrcX.exe
  C:\Windows\System\HCKlrcX.exe
  2⤵
  PID:9868
- C:\Windows\System\sjzRGsY.exe
  C:\Windows\System\sjzRGsY.exe
  2⤵
  PID:9820
- C:\Windows\System\vorYyse.exe
  C:\Windows\System\vorYyse.exe
  2⤵
  PID:9880
- C:\Windows\System\XRdDAZK.exe
  C:\Windows\System\XRdDAZK.exe
  2⤵
  PID:9848
- C:\Windows\System\uPDwySi.exe
  C:\Windows\System\uPDwySi.exe
  2⤵
  PID:9992
- C:\Windows\System\aVBWhsW.exe
  C:\Windows\System\aVBWhsW.exe
  2⤵
  PID:9980
- C:\Windows\System\KlGwuck.exe
  C:\Windows\System\KlGwuck.exe
  2⤵
  PID:10028
- C:\Windows\System\pSPitjB.exe
  C:\Windows\System\pSPitjB.exe
  2⤵
  PID:10092
- C:\Windows\System\ervpVtg.exe
  C:\Windows\System\ervpVtg.exe
  2⤵
  PID:10156
- C:\Windows\System\VdRnvzn.exe
  C:\Windows\System\VdRnvzn.exe
  2⤵
  PID:10220
- C:\Windows\System\hIYRohi.exe
  C:\Windows\System\hIYRohi.exe
  2⤵
  PID:10044
- C:\Windows\System\lcksJKj.exe
  C:\Windows\System\lcksJKj.exe
  2⤵
  PID:10104
- C:\Windows\System\CamlsCC.exe
  C:\Windows\System\CamlsCC.exe
  2⤵
  PID:10172
- C:\Windows\System\KUGmEmc.exe
  C:\Windows\System\KUGmEmc.exe
  2⤵
  PID:9052
- C:\Windows\System\iHJRqwX.exe
  C:\Windows\System\iHJRqwX.exe
  2⤵
  PID:9104
- C:\Windows\System\EnskRLp.exe
  C:\Windows\System\EnskRLp.exe
  2⤵
  PID:9228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AkTauoG.exe

Filesize
2.1MB

MD5
6f74d8121aa4339e2f1edc91bc3362f4

SHA1
4bf8d4409d4f13daf8d1db5285612770d1e9094f

SHA256
73e37c8a7973c15a4c08505c659503ca9c59733610707224911d21610e1ea613

SHA512
f83ed75fbdcc3874868cb7a44e6cb167802b4e8873cbb4c8cf88b4c5a8adcecd9560e73d72f438b11fb734abc223e25966b81cfadee964a17e9572b514f013f7

Download Submit
C:\Windows\system\BZSfInl.exe

Filesize
2.1MB

MD5
efc4fc7e00df2806936936019a9062dd

SHA1
d775e99fe5f3d3ee9a4fd0d9a0b3036bc8dff45f

SHA256
8b87e51d1df2b568aff617eecf6e2420a76c62d05a675ff27fd6cf9536007c9d

SHA512
3ff2291bd7d257517b8fa2963c91a54825e65853a448363f37609ec7662fcff836164358bbe601fea2e8c7aeb4a8cfff76ff04e8fce5cc3fb4f6f66c55fbae88

Download Submit
C:\Windows\system\CgakwBG.exe

Filesize
2.1MB

MD5
872e84684a6382cc029ac8443dab0300

SHA1
f8b04aa48c3caf2fffea4aad322211f5555bac82

SHA256
9dc4b8f70f0c8ac886679159b0735bcba4013cf73b8b6118c1dece2bb0dfcb8c

SHA512
b7e307d84ff1a441a3617a9905de7a5f2f7260dba2fd3480999f20a84ab05a452f9833a851baf5b04d41acc02d792c484b5529f750a0b0b049bd2fa8a4dcf0e2

Download Submit
C:\Windows\system\DGHfbio.exe

Filesize
2.1MB

MD5
d7795b1de588df455912fda2e5407ea2

SHA1
5f3be39e5ce8fd75f3b69806739c9dfd70ce1509

SHA256
0e64da713474e10482210df66f783747e3c7cf57d514b711da718b8dad14e846

SHA512
4ba54a0f27faeecba1477424b29f383d3eedb9124143cc2091cf1e8371562dcb70ffc2a5c9f6fd1cd752b86d3ec55c418060b133019276aa8cd76dee16282a55

Download Submit
C:\Windows\system\ENIFcxS.exe

Filesize
2.1MB

MD5
4f9d57c0c9a35d16be6f8d5f31454914

SHA1
1010806eb53d2db5cd335abfea8b2c78daa7bca3

SHA256
e0feb688510e5204f9283e5851e0ad22d59163b97c8f37f510149cc90c63be89

SHA512
11b5c26b8d3ce540eb676c336aa62ad4ef4d15e0f50b422fc229cd31eeccb646c18362920a197303fbadd19f68f98b18b902c2fcc2f382e031aad94912de522e

Download Submit
C:\Windows\system\KzvgfNN.exe

Filesize
2.1MB

MD5
19fbf9b89f5944478fa3ba872bef69a9

SHA1
71414d7fa2e7f1fba2c9f1e3d3a18575d3c43c55

SHA256
6e45658d2482b57e788f31cd0cc588a4eedaf2b4c7685affecea006545537b2a

SHA512
2ca1e68ad18321c64412d837f6ec4fb1e24617cf690d9b2338c6a74b3bf119dd06122974d71e5d50a5957766e6e714fa2848d12863f8a393aa7e9f6dd53bfece

Download Submit
C:\Windows\system\LLCoDrv.exe

Filesize
2.1MB

MD5
357dc292979f0c2c0030342f64070aa3

SHA1
f0e0308cb0715aa6fff9c95c833850262d72926e

SHA256
ca7f342a9996028ec5f23afbeec33a8d14dc492baef7178c6dff2f4edfb7a9c3

SHA512
664243085d3a4ee39b9ab36c7ed6e6b32bf33df2dcbeb3dd9730073f170d792493c6df1a4b743292cf7c0b8ee79ff9e32b14fb39e27a433e7815f58993428146

Download Submit
C:\Windows\system\NHAIGBW.exe

Filesize
2.1MB

MD5
29a4e67472fbc2572e6fdfa22f8ba2f6

SHA1
ca277d0a2f464eeb30ab51a4a7ab264c118a4eb7

SHA256
cde2151ff516a28d484b47f3916da6fc474022182509d2168fee787bdd1ffa01

SHA512
b20c754d3a2a176d28d7881955a189daa109c042d00074d5bc3b4a69f3fc47967d20bdbcca18e9fdd7345e89de5f5217f0e8039be7b8b21d9d49ea771e33dbde

Download Submit
C:\Windows\system\QKYYLRa.exe

Filesize
2.1MB

MD5
be6358725793d096d68d0a0b89cdda95

SHA1
6874d88a48b3626865a425b03d6ae57402bbe1d4

SHA256
da579e8bd0bd5d95a9f8ed319839d7b48925e1067a86ba12ffc6d956f461b86e

SHA512
f9744c4c60bff018f416176c498ac93ec5dc9030cdb5366a85d4b153db17268c8a2783bcc4eb804440b5a7cb6fe1522219fbc8f787b56452ede9e70dc3993277

Download Submit
C:\Windows\system\QXOzOaF.exe

Filesize
2.1MB

MD5
d4a9f35d1d21ee969867e1fba8171ed5

SHA1
c98b1d761d759a29acf381d94b1fca3530273aef

SHA256
705d6d61622fcd73e332ebe8b9ee7b32b5c172538dee6e153b241d293f8e5a8f

SHA512
cc1289506dcd58b3ec4cc3ac3e9da14c9418770d1c25871996f6775cfd6cdc051ca516fb7776be3893bd51f32b91d7ba5585d3fcd030a260c3ab0c9e39b4d31e

Download Submit
C:\Windows\system\SjPFaxH.exe

Filesize
2.1MB

MD5
01f028f7873f1dff13e463381444ebf1

SHA1
d12f80f0672ed4c9c53f4b25773449df57e50da6

SHA256
8ba678a4f2d9887a0b6e7ea5d51e26cfccf31753a7847f48d0f19d337c1f6447

SHA512
bea062650f2e5c7adc9d6211a165d3bfc1ec363880d6b8d6b174d663ee8ea8e1585fb8e3f7048e421ecb9e0aa36eee8b9cba72972089a6f8a049e669cab89842

Download Submit
C:\Windows\system\VcYKMZc.exe

Filesize
2.1MB

MD5
07b9c3675d12bda4d81a532d826b2055

SHA1
06209a295e75b28283d4fd69ca4083dd7f3a3015

SHA256
6218bad51752c584dfd9e6fb4657e0c9f984913e09d6224f937bbbbf4111fb8a

SHA512
eaf70aabbf9f4f14ade9fb7232693b549a0058e679e38c71385d2cfb0ea72d345a09dae51880a22dd8d2ff92ee670186bd0e0c947cca4907bf80a39700887e4f

Download Submit
C:\Windows\system\WlTCDWh.exe

Filesize
2.1MB

MD5
f293f18b6b069fc25645d9abd1852718

SHA1
dc2e116211e6c2af776e1fb7bdc5d7b7d37c1e26

SHA256
3b511f4d32a3e0c3594d682ab7bceae60415dde3ce28ef23d9fa5b8ff0dda10d

SHA512
a69f48705ba5e85b1c42532d799ca832921a251567373c7f1aef09d9aacbcda6857632fcc3334fb7acf41943af682a4805d18fb6dacba79c5beb0aa4720e6826

Download Submit
C:\Windows\system\XKGDFxz.exe

Filesize
2.1MB

MD5
331fea24dcc1e02c70f8c314c414a013

SHA1
429db695e7b41f33a44548a68186aea0b61edb02

SHA256
0f5ef8b527c79f0dc09d598475c043b2052fd7cb86fb9484d96a7d30696a05e2

SHA512
aeff0a9ae8b23049215d1516a9c34b0b9d699fdafff2503e0ced791aeeab8d655220f0408cde4cb2fe0cc2f913dc0ad264516002ee5bd9c2deb27cc1f7761e23

Download Submit
C:\Windows\system\cTQepvn.exe

Filesize
2.1MB

MD5
937d429e0a34705899a6ad8dfea81089

SHA1
cf41301b71ed70e8b8301fc4ec0fe987d42b993b

SHA256
45da38a7629a716bd570be34547a97a77f28b86e07327dd3a267189f09daa1ab

SHA512
50e8ce3a23449d1b13a050b448badc9677bfdc580cbca1f84ec5189e919c7419ca84fba5fc1dde1a5902b7953e384bc1ae11e1e9a2ad82bc0e33031d43cb9f6a

Download Submit
C:\Windows\system\ctiuYLC.exe

Filesize
2.1MB

MD5
82ef2fe512a48947109e1e504c5ca408

SHA1
7134b3f75e9e5bc1fcfd45b680d9651e5f6cd583

SHA256
faba684f53521794e64b7c1bf4ab9a94108c756fd037a53a2bd8da9cfeb5042e

SHA512
1c183c27586624c8d28f79953642b421b28d0c3fcb125dfc5ece6a872631942783c6e5ed853d1a2855f4054e89277c0bbb07882b7a479120f2d608fa7eab2c6c

Download Submit
C:\Windows\system\dobRQgm.exe

Filesize
2.1MB

MD5
564ceb73b14712ccfbc5bad6726a04a5

SHA1
f852950b46545ef663d64cc5386959c47bec8712

SHA256
888cf634d0857b5abf7bea46cd8be847b5918ec884034f7953bba7e453c3def2

SHA512
aa450b3047146a096d41cc65bd472392a9a7c149a2f32459b5c26de97dcf29f443a7af71c86293d562e59259e623e6d57c4f38c09bbb45d1835db602e4bdc397

Download Submit
C:\Windows\system\iuNYvKo.exe

Filesize
2.1MB

MD5
27284021521bcd48506a729a180f56c8

SHA1
8212bc58e5259b5727dfd562e044a61579f1d9c2

SHA256
610fc82b29a3e6d73556caff6e0d5d63ee2c65b8d8af0ca90abd41fcf00de649

SHA512
9f769bd984d6e3fda3b74fc81f34d04bd3230866fcc790f4fab9446a8c19a572d8e912334d15926cb5b688662e247b72d6748ab135b0180dd2a05db39807d83c

Download Submit
C:\Windows\system\jZrgDBv.exe

Filesize
2.1MB

MD5
79385e2392cbccdd8f625fdb8e7976e2

SHA1
757c0c66c029346a24d369d32237d96dde55acbf

SHA256
232818af3959bce46eaccd199ebd2c5d6d56ccc77299a7603aa56b1716cd4b21

SHA512
3bb2c69f74937a9b0640bc4615ff2670545c287c4015c00f8020740934b064c1d64a70bf5bf7485278221d8e471ef9b9e0ff7a87cd1f06841f95162c9ad72096

Download Submit
C:\Windows\system\mJgPhMM.exe

Filesize
2.1MB

MD5
92638d7e85621d29ef5a880917b4fdcb

SHA1
560a4a5abf6b836f2a17f5eb9b410d7f51651bd3

SHA256
6ec1ccaa26ee890a1e4608d53557c0e3087eb35a31969ad6e5d0de4109f6f55c

SHA512
01f0253e194b361032baf28b13d2dfcc4f7fabbcb4ab0af15ce7f6f733f7c640146e3213f6a9bdc558a44c012ca9e56cca5cfe7c3a4fe6fb15753c892f36f550

Download Submit
C:\Windows\system\mbmKPXJ.exe

Filesize
2.1MB

MD5
5310e9c2f1e071f9ddb0e4c01814c894

SHA1
5f1dcce1dfcaaf6e8751a0ac8803d1a4305b09bf

SHA256
5342678a783d91a4f1905a65a2aa3957382e8377c0a0afe771e87aaff2663d04

SHA512
27e2d77043ab8e22d65bf8c1d91b79158c7372c034f38814ffecc7147ac33c20fde6e2b893a323eebf7cb2134b9a00fbb046c8d97116f0a2bbc3695f64a2ea03

Download Submit
C:\Windows\system\nlEhtTM.exe

Filesize
2.1MB

MD5
123d909d0569a512cf3b3f09d45eba1c

SHA1
85031927450527e4a9852ee8e0418fd65732c3dc

SHA256
60be48852484fd7a51b2e601f6923f68554da0e3adb9ff8b29dc3050fc6b1a37

SHA512
b23389d47e3e358b3d5993d5b0967f85b1d8cb8fa0501db12e271d8b29c673dfee36d4f2da7c7cad4f7d2d426f50d935df7b45149b1b6215096bd8e2c6057bc3

Download Submit
C:\Windows\system\nlkXBpu.exe

Filesize
2.1MB

MD5
5c61df75d2de1f71e8b2eb1263d764e9

SHA1
38dfd25dd6378a79712a32755cdf44c33fd67bf8

SHA256
1c1e01b43f49f11737f4112526bfafd933b127ec4de17e85ef809fc201c00914

SHA512
3ced918e728058cf6416a894f5ae63b203e824896ae08b5847a6a2ba42e128df384b01dd2fba83d4874996b01f296b1508218871cdf9c3de6d179ac00418ce3b

Download Submit
C:\Windows\system\riTlqJe.exe

Filesize
2.1MB

MD5
31c0bf3432091ce523907c40e4fd3cc5

SHA1
b0e5fe00e1ce89312c8dd4a8ee3200be197d5ef8

SHA256
911041cb7ccc3ffc84bcac83be63c54f844608ef7fd851753e5a1f60857ebcaf

SHA512
f74ee3ba672507f098508e295ed466b065dc0532f22c58c02a75baf9e0b31d2382e09a15cdb355ffcf1f9a1b726cb55c8d47d7cf434fb410274329d2a8deecc3

Download Submit
C:\Windows\system\udsEjtl.exe

Filesize
2.1MB

MD5
a0784425d389a3b64729c4a624f70fe5

SHA1
fc14524f5782b553e149453bfdc7f02f0147ef71

SHA256
3c2cb8a788da626e832c0fc0f54efe98bb6b518f126ed16ae1f8e3e35410c264

SHA512
948ed76826c764ce872cb67749f897f3f51858ae15354f356f9ebbd640bcad81db5109e553faef24aa71078249b3df55e94deda4fc62dd67cfa14263ba292e18

Download Submit
C:\Windows\system\wHvhxsf.exe

Filesize
2.1MB

MD5
ccf518a09ba44b794ccbb582ae0d6a6d

SHA1
97ba584c6b4036bf7cd04d845c3b17e115fea2f6

SHA256
a67c5be2422f2f5da4fc067eae4ff39c53776b8dce83d18b1f6cb13375265b24

SHA512
5ff689efcd2fa481f304e9150ddba6dec63d8551e044adb6c69f42d1374d5944da7e900f981fea3e52049766f4b234c00afdeaec9ad2d2d4935795cfe514380d

Download Submit
C:\Windows\system\zVyDcYc.exe

Filesize
2.1MB

MD5
79057697a1eae98435cdb81df3f77466

SHA1
ada1c55c9df48795b25fadea1ef9060866ec5cf6

SHA256
c696a5d2496fad9db0b204ac79befc59e4d6dc4a825f5590752673302e687cfe

SHA512
49f1f1579c143b3be15fb91665c8c1a99e1946591d57e067a1be01d46c6d4b2bdd80adb699c72a0cc014b155a745be4a5e36d395f1d8d28edfb5d761575a6502

Download Submit
\Windows\system\FtIWMDa.exe

Filesize
2.1MB

MD5
5fe96add5ffbb4d316b891dd3ece1180

SHA1
d91efdd69c1119ba71a18425aa24027fa4b38962

SHA256
aeaea4d4bc17494a988c2166690e80c3ddbc4e170b2a309435474a6a274a7923

SHA512
4b3f45315d5d24454d9e86d37cf4b6854f941bb926dbd33dc241c6083b94b92657054075194cfd4116f86ff6e996b0e04f9a96d06b20316898b1169d7dabe9ce

Download Submit
\Windows\system\GzRGqQI.exe

Filesize
2.1MB

MD5
a2ae4e19300a6c1d520e3d5dc78dcc75

SHA1
338d9bc2318a38b930ea98ba765e1601768a1564

SHA256
b2b63d13b55ef4d3725b014759933f1b0afb27c54271fd13880b136346ba5dd7

SHA512
b100e023fb71bd400c510f73ee1bda824b760d12273e30fd535c00fb836234d0fd0fc5aec769e969a1a25c93064cb9bb86cdd50593dc25291f6e8205d122d770

Download Submit
\Windows\system\MIUoSxx.exe

Filesize
2.1MB

MD5
1ad433dc1d282ac177ba4ff2e3539929

SHA1
bbe13b6e33e02b2b85745c4d435111ae642d20e0

SHA256
3216478cd71440d142329fd49282568b9fdfce8464919a76e082dd41b21fffda

SHA512
e1b4f23f8a3bcd702c5f6bab2d1d550f70d5ee13a9a0b6fe8fbe50440110f524f27580f073bcc8a0127f787b652a86dcc830a6128440f86e824f22d4f0a8c7ed

Download Submit
\Windows\system\cufsKMQ.exe

Filesize
2.1MB

MD5
980a1931284bdd45249da06fe920b223

SHA1
b03be3488a01ec366059bd7e8240d0dcf20487d5

SHA256
f16166fffb663ecf61bdc4cedddaf4a16114b18d4061d00ff7fe8d17d92d8c0c

SHA512
2712116a34730c46f85b129f15c16b8aeeed5235e33f59d016b081abb429dd1c3cb7b6fb27951e193485a64bd972ece711589f83704f9aaca6ac14efc92cbd04

Download Submit
\Windows\system\qpsxwpi.exe

Filesize
2.1MB

MD5
1bf94ada87469c0f367becde5e8bc6e0

SHA1
993c917de9021d3976430e8710935ef9a3ea812c

SHA256
aa5155048d35f89dec47c386488d4b97ed3d07d228e4f78cbeb3aa7449ef0c50

SHA512
c27a7457830cd7dc9441cc3c4e3919f5cc6b5b90e4e7862987319f2bd8eb974d66beb33906f1401dd1305da5ed99202a8c2c9d413193a05b8b9e8ca3156c70b1

Download Submit
memory/2008-541-0x000007FEF5980000-0x000007FEF631D000-memory.dmp

Filesize
9.6MB

Download
memory/2008-79-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/2008-89-0x000007FEF5980000-0x000007FEF631D000-memory.dmp

Filesize
9.6MB

Download
memory/2008-90-0x0000000002870000-0x00000000028F0000-memory.dmp

Filesize
512KB

Download
memory/2008-80-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/2008-82-0x000007FEF5980000-0x000007FEF631D000-memory.dmp

Filesize
9.6MB

Download
memory/2008-83-0x0000000002870000-0x00000000028F0000-memory.dmp

Filesize
512KB

Download
memory/2276-7-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2276-100-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2276-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2276-1254-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2276-93-0x0000000003590000-0x0000000003982000-memory.dmp

Filesize
3.9MB

Download
memory/2276-0-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2276-21-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2276-104-0x0000000003590000-0x0000000003982000-memory.dmp

Filesize
3.9MB

Download
memory/2276-25-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2276-17-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2276-91-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2276-98-0x0000000003590000-0x0000000003982000-memory.dmp

Filesize
3.9MB

Download
memory/2276-96-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2436-97-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2464-94-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2484-99-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-18-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2576-105-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2652-23-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2672-9-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2708-95-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-103-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download