xmrig | c8340e14f81155f65573f20267435e0dcb5fc043f3e520a132b542e0ea1190d5

Analysis

max time kernel
29s
max time network
27s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
Size

1.9MB
MD5

042643b87f71c16fe01519bae725a282
SHA1

eee06b69f4faf1161cc1c55e56d385196aa4cbb2
SHA256

c8340e14f81155f65573f20267435e0dcb5fc043f3e520a132b542e0ea1190d5
SHA512

e4b6019b06ad6599a80e3a57debe951a4b55bc7ef1851d9172c3971794fc89dfe84632be51841bce5890600639456555ebe867b7c8268f4a3b9795c30add5e1c
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Ub:NAB2

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral1/memory/2624-30-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2520-66-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2428-62-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2324-55-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2560-37-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2596-29-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2872-27-0x0000000002CD0000-0x00000000030C2000-memory.dmp	xmrig
behavioral1/memory/2508-25-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/2704-20-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2872-98-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig
behavioral1/memory/2168-1209-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/2324-1207-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2704	flUIOzG.exe
2508	elDSSUA.exe
2596	BWDuDdD.exe
2624	wwALKjB.exe
2560	XzzMNAg.exe
2324	UxMzXxv.exe
2168	HUdKFQN.exe
2428	PJKuIBq.exe
2396	PlEtjAx.exe
2520	xpCtkum.exe
2384	wPwReMB.exe
328	oSHONHq.exe
108	SQPgeiS.exe
828	YcWkrHD.exe
1408	EIHkXOG.exe
872	AksoaHC.exe
2176	vfxCTRq.exe
2020	xnNBpfL.exe
2880	nJEzxIo.exe
3064	nbvEPxt.exe
2344	hDIkFqV.exe
3060	jyPdGjR.exe
1988	AiveDgJ.exe
1240	pEBqOyQ.exe
2260	veNaOdv.exe
2064	rlyVECc.exe
336	kBdaItV.exe
1396	tTDoRBJ.exe
1548	CwoyRBv.exe
1704	YJqvNHv.exe
564	yGumcCG.exe
2092	UbhVcvg.exe
612	RsZOnJK.exe
2116	crXZjxT.exe
2232	SxoZdaB.exe
696	ohbZWRo.exe
1120	EbhLUly.exe
3008	dWvwGeP.exe
3020	XHZLQjT.exe
1680	riAANvu.exe
1204	MpANLKX.exe
1868	HlAyijh.exe
1284	JdWCqIi.exe
1860	rvemmJt.exe
616	IeoIFgW.exe
332	czeblws.exe
892	NiiDMaP.exe
3048	JhKKfOb.exe
1900	MPbfGiP.exe
1608	XJXWkxB.exe
2084	DDAlRfS.exe
2480	gSPFqsK.exe
2380	lkUPiqe.exe
2088	bsWUYTP.exe
1176	QEkwSpR.exe
3036	swffGSc.exe
1184	yYXvTFV.exe
756	ivQNnXo.exe
876	WpZwidh.exe
1888	PYhJGPp.exe
2152	woodzvq.exe
2256	oXHRuSa.exe
2608	HVhHYFy.exe
1512	sVQfjRQ.exe

Loads dropped DLL 64 IoCs

pid	Process
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2872-1-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/files/0x000c000000012707-6.dat	upx
behavioral1/files/0x0007000000015662-12.dat	upx
behavioral1/files/0x002f000000014c2d-16.dat	upx
behavioral1/files/0x00080000000153ee-10.dat	upx
behavioral1/memory/2624-30-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/files/0x00070000000158d9-34.dat	upx
behavioral1/files/0x000a000000015b50-42.dat	upx
behavioral1/files/0x0006000000015d85-49.dat	upx
behavioral1/files/0x0007000000015ae3-40.dat	upx
behavioral1/files/0x0006000000015d9c-53.dat	upx
behavioral1/files/0x0006000000015f23-71.dat	upx
behavioral1/memory/2520-66-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/2396-65-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	upx
behavioral1/files/0x0009000000015c9a-63.dat	upx
behavioral1/memory/2428-62-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2168-58-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/memory/2324-55-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2560-37-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2596-29-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2508-25-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/memory/2704-20-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2384-85-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/files/0x0016000000005586-86.dat	upx
behavioral1/files/0x002f000000014f57-93.dat	upx
behavioral1/files/0x0006000000016575-119.dat	upx
behavioral1/files/0x0006000000016c30-135.dat	upx
behavioral1/files/0x0006000000016ce0-151.dat	upx
behavioral1/files/0x0006000000016cf3-159.dat	upx
behavioral1/files/0x0006000000016d10-171.dat	upx
behavioral1/files/0x0006000000016d06-167.dat	upx
behavioral1/files/0x0006000000016cfd-163.dat	upx
behavioral1/files/0x0006000000016ced-155.dat	upx
behavioral1/files/0x0006000000016cb5-147.dat	upx
behavioral1/files/0x0006000000016c84-143.dat	upx
behavioral1/files/0x0006000000016c38-139.dat	upx
behavioral1/files/0x0006000000016c1f-131.dat	upx
behavioral1/files/0x0006000000016a28-127.dat	upx
behavioral1/files/0x00060000000167bf-123.dat	upx
behavioral1/files/0x00060000000164ec-115.dat	upx
behavioral1/files/0x00060000000163eb-111.dat	upx
behavioral1/files/0x00060000000161ee-107.dat	upx
behavioral1/files/0x0007000000016013-100.dat	upx
behavioral1/files/0x0006000000016122-103.dat	upx
behavioral1/memory/2872-98-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/memory/2168-1209-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/memory/2324-1207-0x000000013F530000-0x000000013F922000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SqWczfy.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\CPNIRTI.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\RXigSJH.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\mGUJIku.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\EHOvvxL.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\hUMjuUL.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\WPtlPfW.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\hrDkeVP.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\OLkUcHO.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\jzOlkIl.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\VLqHXQJ.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\BZmPpTD.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\gejOTbQ.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\ngrOePw.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\tqpKFTV.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\vpiGarm.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\dTOUkky.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\ztOiCdZ.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\lYBgBPW.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\pEBqOyQ.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\GCWvinW.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\lhnVTXO.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\QJgOgBR.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\DARssux.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\ufngVvk.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\SJsSuBr.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\oZPzlMN.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\LZWLVUg.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\rQGfiwm.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\uhdLvnr.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\usOBGzB.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\rYZVRwu.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\QTvIwgN.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\XjVADSA.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\XVBWBYU.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\zyXniWm.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\jbaBQTR.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\deaiuZw.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\NmSfTvQ.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\iQUeFqK.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\hnkzztk.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\KqwGxFe.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\YGfdAnf.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\xnEouFd.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\UTXaniu.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\bJRhXfZ.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\GRMLyjb.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\oEKwusx.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\FJJjcba.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\eCeJnbD.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\kfrtaBg.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\OWIuYqt.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\ZLBFKON.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\nlnkHAG.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\tmtDLZb.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\joHlxGf.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\JiIIhdh.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\eExDZgh.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\gpFUNLx.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\EFJVoXL.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\ocIZldm.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\QwteUhF.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\wQiwSCn.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
File created	C:\Windows\System\weXXGbf.exe	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2796	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
Token: SeDebugPrivilege	2796	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2796	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	29
PID 2872 wrote to memory of 2796	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	29
PID 2872 wrote to memory of 2796	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	29
PID 2872 wrote to memory of 2704	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	30
PID 2872 wrote to memory of 2704	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	30
PID 2872 wrote to memory of 2704	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	30
PID 2872 wrote to memory of 2508	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	31
PID 2872 wrote to memory of 2508	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	31
PID 2872 wrote to memory of 2508	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	31
PID 2872 wrote to memory of 2596	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	32
PID 2872 wrote to memory of 2596	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	32
PID 2872 wrote to memory of 2596	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	32
PID 2872 wrote to memory of 2624	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	33
PID 2872 wrote to memory of 2624	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	33
PID 2872 wrote to memory of 2624	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	33
PID 2872 wrote to memory of 2560	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	34
PID 2872 wrote to memory of 2560	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	34
PID 2872 wrote to memory of 2560	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	34
PID 2872 wrote to memory of 2324	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	35
PID 2872 wrote to memory of 2324	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	35
PID 2872 wrote to memory of 2324	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	35
PID 2872 wrote to memory of 2168	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	36
PID 2872 wrote to memory of 2168	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	36
PID 2872 wrote to memory of 2168	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	36
PID 2872 wrote to memory of 2396	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	37
PID 2872 wrote to memory of 2396	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	37
PID 2872 wrote to memory of 2396	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	37
PID 2872 wrote to memory of 2428	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	38
PID 2872 wrote to memory of 2428	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	38
PID 2872 wrote to memory of 2428	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	38
PID 2872 wrote to memory of 2520	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	39
PID 2872 wrote to memory of 2520	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	39
PID 2872 wrote to memory of 2520	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	39
PID 2872 wrote to memory of 2384	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	40
PID 2872 wrote to memory of 2384	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	40
PID 2872 wrote to memory of 2384	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	40
PID 2872 wrote to memory of 108	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	41
PID 2872 wrote to memory of 108	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	41
PID 2872 wrote to memory of 108	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	41
PID 2872 wrote to memory of 328	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	42
PID 2872 wrote to memory of 328	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	42
PID 2872 wrote to memory of 328	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	42
PID 2872 wrote to memory of 828	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	43
PID 2872 wrote to memory of 828	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	43
PID 2872 wrote to memory of 828	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	43
PID 2872 wrote to memory of 1408	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	44
PID 2872 wrote to memory of 1408	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	44
PID 2872 wrote to memory of 1408	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	44
PID 2872 wrote to memory of 872	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	45
PID 2872 wrote to memory of 872	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	45
PID 2872 wrote to memory of 872	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	45
PID 2872 wrote to memory of 2176	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	46
PID 2872 wrote to memory of 2176	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	46
PID 2872 wrote to memory of 2176	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	46
PID 2872 wrote to memory of 2020	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	47
PID 2872 wrote to memory of 2020	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	47
PID 2872 wrote to memory of 2020	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	47
PID 2872 wrote to memory of 2880	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	48
PID 2872 wrote to memory of 2880	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	48
PID 2872 wrote to memory of 2880	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	48
PID 2872 wrote to memory of 3064	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	49
PID 2872 wrote to memory of 3064	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	49
PID 2872 wrote to memory of 3064	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	49
PID 2872 wrote to memory of 2344	2872	042643b87f71c16fe01519bae725a282_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\042643b87f71c16fe01519bae725a282_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\042643b87f71c16fe01519bae725a282_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2796
- C:\Windows\System\flUIOzG.exe
  C:\Windows\System\flUIOzG.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\elDSSUA.exe
  C:\Windows\System\elDSSUA.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\BWDuDdD.exe
  C:\Windows\System\BWDuDdD.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\wwALKjB.exe
  C:\Windows\System\wwALKjB.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\XzzMNAg.exe
  C:\Windows\System\XzzMNAg.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\UxMzXxv.exe
  C:\Windows\System\UxMzXxv.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\HUdKFQN.exe
  C:\Windows\System\HUdKFQN.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\PlEtjAx.exe
  C:\Windows\System\PlEtjAx.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\PJKuIBq.exe
  C:\Windows\System\PJKuIBq.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\xpCtkum.exe
  C:\Windows\System\xpCtkum.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\wPwReMB.exe
  C:\Windows\System\wPwReMB.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\SQPgeiS.exe
  C:\Windows\System\SQPgeiS.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\oSHONHq.exe
  C:\Windows\System\oSHONHq.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\YcWkrHD.exe
  C:\Windows\System\YcWkrHD.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\EIHkXOG.exe
  C:\Windows\System\EIHkXOG.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\AksoaHC.exe
  C:\Windows\System\AksoaHC.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\vfxCTRq.exe
  C:\Windows\System\vfxCTRq.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\xnNBpfL.exe
  C:\Windows\System\xnNBpfL.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\nJEzxIo.exe
  C:\Windows\System\nJEzxIo.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\nbvEPxt.exe
  C:\Windows\System\nbvEPxt.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\hDIkFqV.exe
  C:\Windows\System\hDIkFqV.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\jyPdGjR.exe
  C:\Windows\System\jyPdGjR.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\AiveDgJ.exe
  C:\Windows\System\AiveDgJ.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\pEBqOyQ.exe
  C:\Windows\System\pEBqOyQ.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\veNaOdv.exe
  C:\Windows\System\veNaOdv.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\rlyVECc.exe
  C:\Windows\System\rlyVECc.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\kBdaItV.exe
  C:\Windows\System\kBdaItV.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\tTDoRBJ.exe
  C:\Windows\System\tTDoRBJ.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\CwoyRBv.exe
  C:\Windows\System\CwoyRBv.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\YJqvNHv.exe
  C:\Windows\System\YJqvNHv.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\yGumcCG.exe
  C:\Windows\System\yGumcCG.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\UbhVcvg.exe
  C:\Windows\System\UbhVcvg.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\RsZOnJK.exe
  C:\Windows\System\RsZOnJK.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\crXZjxT.exe
  C:\Windows\System\crXZjxT.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\SxoZdaB.exe
  C:\Windows\System\SxoZdaB.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\ohbZWRo.exe
  C:\Windows\System\ohbZWRo.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\EbhLUly.exe
  C:\Windows\System\EbhLUly.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\dWvwGeP.exe
  C:\Windows\System\dWvwGeP.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\XHZLQjT.exe
  C:\Windows\System\XHZLQjT.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\riAANvu.exe
  C:\Windows\System\riAANvu.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\MpANLKX.exe
  C:\Windows\System\MpANLKX.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\HlAyijh.exe
  C:\Windows\System\HlAyijh.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\JdWCqIi.exe
  C:\Windows\System\JdWCqIi.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\rvemmJt.exe
  C:\Windows\System\rvemmJt.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\IeoIFgW.exe
  C:\Windows\System\IeoIFgW.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\czeblws.exe
  C:\Windows\System\czeblws.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\NiiDMaP.exe
  C:\Windows\System\NiiDMaP.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\JhKKfOb.exe
  C:\Windows\System\JhKKfOb.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\MPbfGiP.exe
  C:\Windows\System\MPbfGiP.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\XJXWkxB.exe
  C:\Windows\System\XJXWkxB.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\DDAlRfS.exe
  C:\Windows\System\DDAlRfS.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\gSPFqsK.exe
  C:\Windows\System\gSPFqsK.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\lkUPiqe.exe
  C:\Windows\System\lkUPiqe.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\bsWUYTP.exe
  C:\Windows\System\bsWUYTP.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\QEkwSpR.exe
  C:\Windows\System\QEkwSpR.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\swffGSc.exe
  C:\Windows\System\swffGSc.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\yYXvTFV.exe
  C:\Windows\System\yYXvTFV.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\WpZwidh.exe
  C:\Windows\System\WpZwidh.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\ivQNnXo.exe
  C:\Windows\System\ivQNnXo.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\PYhJGPp.exe
  C:\Windows\System\PYhJGPp.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\woodzvq.exe
  C:\Windows\System\woodzvq.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\oXHRuSa.exe
  C:\Windows\System\oXHRuSa.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\HVhHYFy.exe
  C:\Windows\System\HVhHYFy.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\sVQfjRQ.exe
  C:\Windows\System\sVQfjRQ.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\qqAyazi.exe
  C:\Windows\System\qqAyazi.exe
  2⤵
  PID:2920
- C:\Windows\System\alhxtJS.exe
  C:\Windows\System\alhxtJS.exe
  2⤵
  PID:860
- C:\Windows\System\qabJDTC.exe
  C:\Windows\System\qabJDTC.exe
  2⤵
  PID:2500
- C:\Windows\System\UpEUYDE.exe
  C:\Windows\System\UpEUYDE.exe
  2⤵
  PID:2632
- C:\Windows\System\HGbGMZn.exe
  C:\Windows\System\HGbGMZn.exe
  2⤵
  PID:2568
- C:\Windows\System\OJYZsHr.exe
  C:\Windows\System\OJYZsHr.exe
  2⤵
  PID:2892
- C:\Windows\System\xkRfRBQ.exe
  C:\Windows\System\xkRfRBQ.exe
  2⤵
  PID:1556
- C:\Windows\System\IsXqGcQ.exe
  C:\Windows\System\IsXqGcQ.exe
  2⤵
  PID:2640
- C:\Windows\System\KdqdHPm.exe
  C:\Windows\System\KdqdHPm.exe
  2⤵
  PID:2680
- C:\Windows\System\ZLBFKON.exe
  C:\Windows\System\ZLBFKON.exe
  2⤵
  PID:2600
- C:\Windows\System\IWgTFbG.exe
  C:\Windows\System\IWgTFbG.exe
  2⤵
  PID:2512
- C:\Windows\System\ihGwzVk.exe
  C:\Windows\System\ihGwzVk.exe
  2⤵
  PID:2756
- C:\Windows\System\uuyiFlK.exe
  C:\Windows\System\uuyiFlK.exe
  2⤵
  PID:980
- C:\Windows\System\xmBrzpH.exe
  C:\Windows\System\xmBrzpH.exe
  2⤵
  PID:2284
- C:\Windows\System\MJVxFjM.exe
  C:\Windows\System\MJVxFjM.exe
  2⤵
  PID:2928
- C:\Windows\System\CDFHKix.exe
  C:\Windows\System\CDFHKix.exe
  2⤵
  PID:2456
- C:\Windows\System\QQtNiFH.exe
  C:\Windows\System\QQtNiFH.exe
  2⤵
  PID:2036
- C:\Windows\System\OkVumhN.exe
  C:\Windows\System\OkVumhN.exe
  2⤵
  PID:1996
- C:\Windows\System\ZEsOppx.exe
  C:\Windows\System\ZEsOppx.exe
  2⤵
  PID:2992
- C:\Windows\System\jiYtSNL.exe
  C:\Windows\System\jiYtSNL.exe
  2⤵
  PID:2556
- C:\Windows\System\wOGnhbI.exe
  C:\Windows\System\wOGnhbI.exe
  2⤵
  PID:2052
- C:\Windows\System\SqOZiGD.exe
  C:\Windows\System\SqOZiGD.exe
  2⤵
  PID:488
- C:\Windows\System\tDouwXL.exe
  C:\Windows\System\tDouwXL.exe
  2⤵
  PID:896
- C:\Windows\System\ScKNrXM.exe
  C:\Windows\System\ScKNrXM.exe
  2⤵
  PID:1424
- C:\Windows\System\oASoqUz.exe
  C:\Windows\System\oASoqUz.exe
  2⤵
  PID:1140
- C:\Windows\System\TQoABYx.exe
  C:\Windows\System\TQoABYx.exe
  2⤵
  PID:2580
- C:\Windows\System\NOkDeyz.exe
  C:\Windows\System\NOkDeyz.exe
  2⤵
  PID:3012
- C:\Windows\System\XZrfrVn.exe
  C:\Windows\System\XZrfrVn.exe
  2⤵
  PID:1000
- C:\Windows\System\YtucMkj.exe
  C:\Windows\System\YtucMkj.exe
  2⤵
  PID:1576
- C:\Windows\System\XYhMNra.exe
  C:\Windows\System\XYhMNra.exe
  2⤵
  PID:956
- C:\Windows\System\IjTQGse.exe
  C:\Windows\System\IjTQGse.exe
  2⤵
  PID:2564
- C:\Windows\System\pSTJFiy.exe
  C:\Windows\System\pSTJFiy.exe
  2⤵
  PID:844
- C:\Windows\System\QcKRUhQ.exe
  C:\Windows\System\QcKRUhQ.exe
  2⤵
  PID:2108
- C:\Windows\System\CfgacqX.exe
  C:\Windows\System\CfgacqX.exe
  2⤵
  PID:2392
- C:\Windows\System\FgaJfcL.exe
  C:\Windows\System\FgaJfcL.exe
  2⤵
  PID:2156
- C:\Windows\System\AMEIxhA.exe
  C:\Windows\System\AMEIxhA.exe
  2⤵
  PID:2112
- C:\Windows\System\nXBEoZb.exe
  C:\Windows\System\nXBEoZb.exe
  2⤵
  PID:2096
- C:\Windows\System\QEQfZUp.exe
  C:\Windows\System\QEQfZUp.exe
  2⤵
  PID:2936
- C:\Windows\System\rQwDUmS.exe
  C:\Windows\System\rQwDUmS.exe
  2⤵
  PID:2648
- C:\Windows\System\eAtknbs.exe
  C:\Windows\System\eAtknbs.exe
  2⤵
  PID:2916
- C:\Windows\System\iCzPiwv.exe
  C:\Windows\System\iCzPiwv.exe
  2⤵
  PID:2820
- C:\Windows\System\LcHLIuV.exe
  C:\Windows\System\LcHLIuV.exe
  2⤵
  PID:1620
- C:\Windows\System\ApaPhVc.exe
  C:\Windows\System\ApaPhVc.exe
  2⤵
  PID:2612
- C:\Windows\System\pdcKatg.exe
  C:\Windows\System\pdcKatg.exe
  2⤵
  PID:2460
- C:\Windows\System\vKRuoWB.exe
  C:\Windows\System\vKRuoWB.exe
  2⤵
  PID:1564
- C:\Windows\System\oJvUsok.exe
  C:\Windows\System\oJvUsok.exe
  2⤵
  PID:2676
- C:\Windows\System\yFRhPyr.exe
  C:\Windows\System\yFRhPyr.exe
  2⤵
  PID:2424
- C:\Windows\System\TGbFzbD.exe
  C:\Windows\System\TGbFzbD.exe
  2⤵
  PID:2772
- C:\Windows\System\RDQnHuT.exe
  C:\Windows\System\RDQnHuT.exe
  2⤵
  PID:1260
- C:\Windows\System\tlKYUre.exe
  C:\Windows\System\tlKYUre.exe
  2⤵
  PID:1192
- C:\Windows\System\oBqRFpO.exe
  C:\Windows\System\oBqRFpO.exe
  2⤵
  PID:2000
- C:\Windows\System\UgKvjTr.exe
  C:\Windows\System\UgKvjTr.exe
  2⤵
  PID:2212
- C:\Windows\System\rcFpjWa.exe
  C:\Windows\System\rcFpjWa.exe
  2⤵
  PID:1628
- C:\Windows\System\zCXwaqj.exe
  C:\Windows\System\zCXwaqj.exe
  2⤵
  PID:2748
- C:\Windows\System\fqwGeCj.exe
  C:\Windows\System\fqwGeCj.exe
  2⤵
  PID:1908
- C:\Windows\System\OfaMOIX.exe
  C:\Windows\System\OfaMOIX.exe
  2⤵
  PID:672
- C:\Windows\System\OGOIDGR.exe
  C:\Windows\System\OGOIDGR.exe
  2⤵
  PID:1524
- C:\Windows\System\HmrQsuD.exe
  C:\Windows\System\HmrQsuD.exe
  2⤵
  PID:1676
- C:\Windows\System\ndvCKSD.exe
  C:\Windows\System\ndvCKSD.exe
  2⤵
  PID:2988
- C:\Windows\System\IHMLcVL.exe
  C:\Windows\System\IHMLcVL.exe
  2⤵
  PID:2268
- C:\Windows\System\QcbVsnG.exe
  C:\Windows\System\QcbVsnG.exe
  2⤵
  PID:1008
- C:\Windows\System\OjdBand.exe
  C:\Windows\System\OjdBand.exe
  2⤵
  PID:2416
- C:\Windows\System\VUvanSM.exe
  C:\Windows\System\VUvanSM.exe
  2⤵
  PID:2904
- C:\Windows\System\gmqyYqj.exe
  C:\Windows\System\gmqyYqj.exe
  2⤵
  PID:2664
- C:\Windows\System\aQqZEWK.exe
  C:\Windows\System\aQqZEWK.exe
  2⤵
  PID:2504
- C:\Windows\System\xQToJrl.exe
  C:\Windows\System\xQToJrl.exe
  2⤵
  PID:2764
- C:\Windows\System\CBHfNJf.exe
  C:\Windows\System\CBHfNJf.exe
  2⤵
  PID:2312
- C:\Windows\System\tnCMRiq.exe
  C:\Windows\System\tnCMRiq.exe
  2⤵
  PID:2768
- C:\Windows\System\ajQzwUV.exe
  C:\Windows\System\ajQzwUV.exe
  2⤵
  PID:384
- C:\Windows\System\RWeBwcE.exe
  C:\Windows\System\RWeBwcE.exe
  2⤵
  PID:1928
- C:\Windows\System\JhAPAKw.exe
  C:\Windows\System\JhAPAKw.exe
  2⤵
  PID:2876
- C:\Windows\System\gtWACth.exe
  C:\Windows\System\gtWACth.exe
  2⤵
  PID:1472
- C:\Windows\System\aegyVDT.exe
  C:\Windows\System\aegyVDT.exe
  2⤵
  PID:2484
- C:\Windows\System\sboSVTC.exe
  C:\Windows\System\sboSVTC.exe
  2⤵
  PID:2844
- C:\Windows\System\XjZIJOw.exe
  C:\Windows\System\XjZIJOw.exe
  2⤵
  PID:2620
- C:\Windows\System\ULfTjPf.exe
  C:\Windows\System\ULfTjPf.exe
  2⤵
  PID:2672
- C:\Windows\System\HNWSPfQ.exe
  C:\Windows\System\HNWSPfQ.exe
  2⤵
  PID:2476
- C:\Windows\System\kBFPVPI.exe
  C:\Windows\System\kBFPVPI.exe
  2⤵
  PID:1012
- C:\Windows\System\ayRDKzq.exe
  C:\Windows\System\ayRDKzq.exe
  2⤵
  PID:1268
- C:\Windows\System\HdGBCGJ.exe
  C:\Windows\System\HdGBCGJ.exe
  2⤵
  PID:1492
- C:\Windows\System\ZTTGwJh.exe
  C:\Windows\System\ZTTGwJh.exe
  2⤵
  PID:2700
- C:\Windows\System\NkVOMjd.exe
  C:\Windows\System\NkVOMjd.exe
  2⤵
  PID:3040
- C:\Windows\System\jpEszDp.exe
  C:\Windows\System\jpEszDp.exe
  2⤵
  PID:3084
- C:\Windows\System\vOUwRqa.exe
  C:\Windows\System\vOUwRqa.exe
  2⤵
  PID:3100
- C:\Windows\System\urveqCF.exe
  C:\Windows\System\urveqCF.exe
  2⤵
  PID:3116
- C:\Windows\System\urYySzy.exe
  C:\Windows\System\urYySzy.exe
  2⤵
  PID:3132
- C:\Windows\System\yBTwIRp.exe
  C:\Windows\System\yBTwIRp.exe
  2⤵
  PID:3168
- C:\Windows\System\lSnQilB.exe
  C:\Windows\System\lSnQilB.exe
  2⤵
  PID:3192
- C:\Windows\System\PuILRSm.exe
  C:\Windows\System\PuILRSm.exe
  2⤵
  PID:3212
- C:\Windows\System\reaHnnb.exe
  C:\Windows\System\reaHnnb.exe
  2⤵
  PID:3228
- C:\Windows\System\ElwDFnv.exe
  C:\Windows\System\ElwDFnv.exe
  2⤵
  PID:3248
- C:\Windows\System\LJgMglp.exe
  C:\Windows\System\LJgMglp.exe
  2⤵
  PID:3272
- C:\Windows\System\NBgpHHS.exe
  C:\Windows\System\NBgpHHS.exe
  2⤵
  PID:3320
- C:\Windows\System\sPOyVSN.exe
  C:\Windows\System\sPOyVSN.exe
  2⤵
  PID:3344
- C:\Windows\System\nlnkHAG.exe
  C:\Windows\System\nlnkHAG.exe
  2⤵
  PID:3372
- C:\Windows\System\RQZErqu.exe
  C:\Windows\System\RQZErqu.exe
  2⤵
  PID:3404
- C:\Windows\System\RMxJMzN.exe
  C:\Windows\System\RMxJMzN.exe
  2⤵
  PID:3588
- C:\Windows\System\LxcSvre.exe
  C:\Windows\System\LxcSvre.exe
  2⤵
  PID:3604
- C:\Windows\System\qqYezLb.exe
  C:\Windows\System\qqYezLb.exe
  2⤵
  PID:3624
- C:\Windows\System\WwHUvrF.exe
  C:\Windows\System\WwHUvrF.exe
  2⤵
  PID:3660
- C:\Windows\System\CiKaQKB.exe
  C:\Windows\System\CiKaQKB.exe
  2⤵
  PID:3696
- C:\Windows\System\vzXMToA.exe
  C:\Windows\System\vzXMToA.exe
  2⤵
  PID:3728
- C:\Windows\System\BpeFXEh.exe
  C:\Windows\System\BpeFXEh.exe
  2⤵
  PID:3748
- C:\Windows\System\PdmKpwU.exe
  C:\Windows\System\PdmKpwU.exe
  2⤵
  PID:3772
- C:\Windows\System\JXkKcyk.exe
  C:\Windows\System\JXkKcyk.exe
  2⤵
  PID:3848
- C:\Windows\System\VWOPwdU.exe
  C:\Windows\System\VWOPwdU.exe
  2⤵
  PID:3888
- C:\Windows\System\joHlxGf.exe
  C:\Windows\System\joHlxGf.exe
  2⤵
  PID:3924
- C:\Windows\System\hUMjuUL.exe
  C:\Windows\System\hUMjuUL.exe
  2⤵
  PID:3960
- C:\Windows\System\asDLcQG.exe
  C:\Windows\System\asDLcQG.exe
  2⤵
  PID:4024
- C:\Windows\System\FsTzuSB.exe
  C:\Windows\System\FsTzuSB.exe
  2⤵
  PID:4068
- C:\Windows\System\QVCkWdn.exe
  C:\Windows\System\QVCkWdn.exe
  2⤵
  PID:1588
- C:\Windows\System\vacTYJE.exe
  C:\Windows\System\vacTYJE.exe
  2⤵
  PID:3080
- C:\Windows\System\bHXwTVr.exe
  C:\Windows\System\bHXwTVr.exe
  2⤵
  PID:3140
- C:\Windows\System\CYcbQqN.exe
  C:\Windows\System\CYcbQqN.exe
  2⤵
  PID:3236
- C:\Windows\System\zawFFPl.exe
  C:\Windows\System\zawFFPl.exe
  2⤵
  PID:3260
- C:\Windows\System\NmSfTvQ.exe
  C:\Windows\System\NmSfTvQ.exe
  2⤵
  PID:3336
- C:\Windows\System\kGfsdno.exe
  C:\Windows\System\kGfsdno.exe
  2⤵
  PID:3304
- C:\Windows\System\XlVGjvo.exe
  C:\Windows\System\XlVGjvo.exe
  2⤵
  PID:3356
- C:\Windows\System\DAaOOhl.exe
  C:\Windows\System\DAaOOhl.exe
  2⤵
  PID:3368
- C:\Windows\System\rRBtXyX.exe
  C:\Windows\System\rRBtXyX.exe
  2⤵
  PID:3400
- C:\Windows\System\ggomJNs.exe
  C:\Windows\System\ggomJNs.exe
  2⤵
  PID:3432
- C:\Windows\System\uhdLvnr.exe
  C:\Windows\System\uhdLvnr.exe
  2⤵
  PID:2708
- C:\Windows\System\uRKqaCM.exe
  C:\Windows\System\uRKqaCM.exe
  2⤵
  PID:1896
- C:\Windows\System\KGojsBl.exe
  C:\Windows\System\KGojsBl.exe
  2⤵
  PID:588
- C:\Windows\System\yrHkSKT.exe
  C:\Windows\System\yrHkSKT.exe
  2⤵
  PID:2068
- C:\Windows\System\lSxzNDR.exe
  C:\Windows\System\lSxzNDR.exe
  2⤵
  PID:3460
- C:\Windows\System\pIEHNuW.exe
  C:\Windows\System\pIEHNuW.exe
  2⤵
  PID:3476
- C:\Windows\System\kZclGMo.exe
  C:\Windows\System\kZclGMo.exe
  2⤵
  PID:3512
- C:\Windows\System\kTXumjO.exe
  C:\Windows\System\kTXumjO.exe
  2⤵
  PID:3452
- C:\Windows\System\MyGCCFO.exe
  C:\Windows\System\MyGCCFO.exe
  2⤵
  PID:1228
- C:\Windows\System\xvzlPwi.exe
  C:\Windows\System\xvzlPwi.exe
  2⤵
  PID:1696
- C:\Windows\System\vBudpQt.exe
  C:\Windows\System\vBudpQt.exe
  2⤵
  PID:3500
- C:\Windows\System\UHMgpDk.exe
  C:\Windows\System\UHMgpDk.exe
  2⤵
  PID:3520
- C:\Windows\System\RfGuswp.exe
  C:\Windows\System\RfGuswp.exe
  2⤵
  PID:3544
- C:\Windows\System\tmtDLZb.exe
  C:\Windows\System\tmtDLZb.exe
  2⤵
  PID:3556
- C:\Windows\System\nGhwACU.exe
  C:\Windows\System\nGhwACU.exe
  2⤵
  PID:3596
- C:\Windows\System\MMsoOtn.exe
  C:\Windows\System\MMsoOtn.exe
  2⤵
  PID:2436
- C:\Windows\System\OxrBpse.exe
  C:\Windows\System\OxrBpse.exe
  2⤵
  PID:3632
- C:\Windows\System\lHxReKF.exe
  C:\Windows\System\lHxReKF.exe
  2⤵
  PID:3612
- C:\Windows\System\GCWvinW.exe
  C:\Windows\System\GCWvinW.exe
  2⤵
  PID:3652
- C:\Windows\System\QLhlNCY.exe
  C:\Windows\System\QLhlNCY.exe
  2⤵
  PID:3680
- C:\Windows\System\vcEpXaY.exe
  C:\Windows\System\vcEpXaY.exe
  2⤵
  PID:2224
- C:\Windows\System\xUXAilg.exe
  C:\Windows\System\xUXAilg.exe
  2⤵
  PID:2808
- C:\Windows\System\bGTDEaM.exe
  C:\Windows\System\bGTDEaM.exe
  2⤵
  PID:3688
- C:\Windows\System\EBTBmvj.exe
  C:\Windows\System\EBTBmvj.exe
  2⤵
  PID:3708
- C:\Windows\System\zWaSQiD.exe
  C:\Windows\System\zWaSQiD.exe
  2⤵
  PID:2712
- C:\Windows\System\UVkyyxS.exe
  C:\Windows\System\UVkyyxS.exe
  2⤵
  PID:3736
- C:\Windows\System\lzJdXeE.exe
  C:\Windows\System\lzJdXeE.exe
  2⤵
  PID:3768
- C:\Windows\System\nStIdVk.exe
  C:\Windows\System\nStIdVk.exe
  2⤵
  PID:1352
- C:\Windows\System\nQPdBAt.exe
  C:\Windows\System\nQPdBAt.exe
  2⤵
  PID:3860
- C:\Windows\System\VXMDriD.exe
  C:\Windows\System\VXMDriD.exe
  2⤵
  PID:2788
- C:\Windows\System\wjMrlwJ.exe
  C:\Windows\System\wjMrlwJ.exe
  2⤵
  PID:3864
- C:\Windows\System\PcxgjKq.exe
  C:\Windows\System\PcxgjKq.exe
  2⤵
  PID:3792
- C:\Windows\System\uiESLiA.exe
  C:\Windows\System\uiESLiA.exe
  2⤵
  PID:3808
- C:\Windows\System\nObDFBt.exe
  C:\Windows\System\nObDFBt.exe
  2⤵
  PID:3816
- C:\Windows\System\fcIGEfD.exe
  C:\Windows\System\fcIGEfD.exe
  2⤵
  PID:3840
- C:\Windows\System\dbdfsHm.exe
  C:\Windows\System\dbdfsHm.exe
  2⤵
  PID:3920
- C:\Windows\System\Kcdjjjt.exe
  C:\Windows\System\Kcdjjjt.exe
  2⤵
  PID:2004
- C:\Windows\System\LXAmXza.exe
  C:\Windows\System\LXAmXza.exe
  2⤵
  PID:3956
- C:\Windows\System\ApTziCp.exe
  C:\Windows\System\ApTziCp.exe
  2⤵
  PID:3980
- C:\Windows\System\bpDbXsD.exe
  C:\Windows\System\bpDbXsD.exe
  2⤵
  PID:3984
- C:\Windows\System\UGgWqim.exe
  C:\Windows\System\UGgWqim.exe
  2⤵
  PID:2404
- C:\Windows\System\vjHpIOB.exe
  C:\Windows\System\vjHpIOB.exe
  2⤵
  PID:4012
- C:\Windows\System\lVMuFkW.exe
  C:\Windows\System\lVMuFkW.exe
  2⤵
  PID:2684
- C:\Windows\System\QzWHGrq.exe
  C:\Windows\System\QzWHGrq.exe
  2⤵
  PID:2328
- C:\Windows\System\wyASXra.exe
  C:\Windows\System\wyASXra.exe
  2⤵
  PID:4076
- C:\Windows\System\sGFhBNM.exe
  C:\Windows\System\sGFhBNM.exe
  2⤵
  PID:4064
- C:\Windows\System\kcLNRKu.exe
  C:\Windows\System\kcLNRKu.exe
  2⤵
  PID:2896
- C:\Windows\System\llrXBql.exe
  C:\Windows\System\llrXBql.exe
  2⤵
  PID:800
- C:\Windows\System\fGpCwRU.exe
  C:\Windows\System\fGpCwRU.exe
  2⤵
  PID:1248
- C:\Windows\System\tVfGCVl.exe
  C:\Windows\System\tVfGCVl.exe
  2⤵
  PID:3392
- C:\Windows\System\CDGyAJm.exe
  C:\Windows\System\CDGyAJm.exe
  2⤵
  PID:2548
- C:\Windows\System\gpFUNLx.exe
  C:\Windows\System\gpFUNLx.exe
  2⤵
  PID:2372
- C:\Windows\System\zfwIYHt.exe
  C:\Windows\System\zfwIYHt.exe
  2⤵
  PID:3456
- C:\Windows\System\EFJVoXL.exe
  C:\Windows\System\EFJVoXL.exe
  2⤵
  PID:1552
- C:\Windows\System\HcxBaUc.exe
  C:\Windows\System\HcxBaUc.exe
  2⤵
  PID:3536
- C:\Windows\System\GRMLyjb.exe
  C:\Windows\System\GRMLyjb.exe
  2⤵
  PID:2228
- C:\Windows\System\Wezsuxy.exe
  C:\Windows\System\Wezsuxy.exe
  2⤵
  PID:2364
- C:\Windows\System\haDlmFu.exe
  C:\Windows\System\haDlmFu.exe
  2⤵
  PID:1924
- C:\Windows\System\rhVYvTw.exe
  C:\Windows\System\rhVYvTw.exe
  2⤵
  PID:1948
- C:\Windows\System\NnoJkgA.exe
  C:\Windows\System\NnoJkgA.exe
  2⤵
  PID:1452
- C:\Windows\System\tNKGwSY.exe
  C:\Windows\System\tNKGwSY.exe
  2⤵
  PID:2216
- C:\Windows\System\sDmEZUo.exe
  C:\Windows\System\sDmEZUo.exe
  2⤵
  PID:4016
- C:\Windows\System\IRUitxq.exe
  C:\Windows\System\IRUitxq.exe
  2⤵
  PID:4092
- C:\Windows\System\WTXRPmA.exe
  C:\Windows\System\WTXRPmA.exe
  2⤵
  PID:3516
- C:\Windows\System\ZSXdflB.exe
  C:\Windows\System\ZSXdflB.exe
  2⤵
  PID:2516
- C:\Windows\System\MsSaWKL.exe
  C:\Windows\System\MsSaWKL.exe
  2⤵
  PID:1440
- C:\Windows\System\xjPwXYX.exe
  C:\Windows\System\xjPwXYX.exe
  2⤵
  PID:3724
- C:\Windows\System\EtToKuj.exe
  C:\Windows\System\EtToKuj.exe
  2⤵
  PID:3208
- C:\Windows\System\mjbWPGk.exe
  C:\Windows\System\mjbWPGk.exe
  2⤵
  PID:3224
- C:\Windows\System\lJzNvww.exe
  C:\Windows\System\lJzNvww.exe
  2⤵
  PID:3264
- C:\Windows\System\WnGoCDH.exe
  C:\Windows\System\WnGoCDH.exe
  2⤵
  PID:3256
- C:\Windows\System\SqWczfy.exe
  C:\Windows\System\SqWczfy.exe
  2⤵
  PID:3972
- C:\Windows\System\ayovIPK.exe
  C:\Windows\System\ayovIPK.exe
  2⤵
  PID:3296
- C:\Windows\System\nvHrPkw.exe
  C:\Windows\System\nvHrPkw.exe
  2⤵
  PID:3316
- C:\Windows\System\vQUossM.exe
  C:\Windows\System\vQUossM.exe
  2⤵
  PID:1004
- C:\Windows\System\VCdhwGi.exe
  C:\Windows\System\VCdhwGi.exe
  2⤵
  PID:3148
- C:\Windows\System\rFYliyt.exe
  C:\Windows\System\rFYliyt.exe
  2⤵
  PID:3188
- C:\Windows\System\XkLVpjq.exe
  C:\Windows\System\XkLVpjq.exe
  2⤵
  PID:3112
- C:\Windows\System\tMkZmkK.exe
  C:\Windows\System\tMkZmkK.exe
  2⤵
  PID:1536
- C:\Windows\System\DOqUnfc.exe
  C:\Windows\System\DOqUnfc.exe
  2⤵
  PID:3488
- C:\Windows\System\ozWNimv.exe
  C:\Windows\System\ozWNimv.exe
  2⤵
  PID:2288
- C:\Windows\System\OCGyQzU.exe
  C:\Windows\System\OCGyQzU.exe
  2⤵
  PID:4112
- C:\Windows\System\ZejxgOp.exe
  C:\Windows\System\ZejxgOp.exe
  2⤵
  PID:4128
- C:\Windows\System\jXxYFpS.exe
  C:\Windows\System\jXxYFpS.exe
  2⤵
  PID:4144
- C:\Windows\System\QTsIABU.exe
  C:\Windows\System\QTsIABU.exe
  2⤵
  PID:4160
- C:\Windows\System\JbzheSy.exe
  C:\Windows\System\JbzheSy.exe
  2⤵
  PID:4272
- C:\Windows\System\niJILvt.exe
  C:\Windows\System\niJILvt.exe
  2⤵
  PID:4352
- C:\Windows\System\LNlBWIB.exe
  C:\Windows\System\LNlBWIB.exe
  2⤵
  PID:4392
- C:\Windows\System\ZzKewqT.exe
  C:\Windows\System\ZzKewqT.exe
  2⤵
  PID:4408
- C:\Windows\System\wcwfmMe.exe
  C:\Windows\System\wcwfmMe.exe
  2⤵
  PID:4424
- C:\Windows\System\kIlfgZf.exe
  C:\Windows\System\kIlfgZf.exe
  2⤵
  PID:4440
- C:\Windows\System\btyZlNV.exe
  C:\Windows\System\btyZlNV.exe
  2⤵
  PID:4472
- C:\Windows\System\KmRZUHr.exe
  C:\Windows\System\KmRZUHr.exe
  2⤵
  PID:4492
- C:\Windows\System\tKPzKWS.exe
  C:\Windows\System\tKPzKWS.exe
  2⤵
  PID:4508
- C:\Windows\System\mClNqLH.exe
  C:\Windows\System\mClNqLH.exe
  2⤵
  PID:4528
- C:\Windows\System\ggTOEpe.exe
  C:\Windows\System\ggTOEpe.exe
  2⤵
  PID:4544
- C:\Windows\System\FBXwrzk.exe
  C:\Windows\System\FBXwrzk.exe
  2⤵
  PID:4560
- C:\Windows\System\ZHrjmUu.exe
  C:\Windows\System\ZHrjmUu.exe
  2⤵
  PID:4576
- C:\Windows\System\NxKvfLF.exe
  C:\Windows\System\NxKvfLF.exe
  2⤵
  PID:4592
- C:\Windows\System\kUbLOcB.exe
  C:\Windows\System\kUbLOcB.exe
  2⤵
  PID:4608
- C:\Windows\System\RwbUNDE.exe
  C:\Windows\System\RwbUNDE.exe
  2⤵
  PID:4624
- C:\Windows\System\IKUVaIC.exe
  C:\Windows\System\IKUVaIC.exe
  2⤵
  PID:4640
- C:\Windows\System\usOBGzB.exe
  C:\Windows\System\usOBGzB.exe
  2⤵
  PID:4656
- C:\Windows\System\ebHuZHG.exe
  C:\Windows\System\ebHuZHG.exe
  2⤵
  PID:4672
- C:\Windows\System\LytSDlt.exe
  C:\Windows\System\LytSDlt.exe
  2⤵
  PID:4688
- C:\Windows\System\OChJyal.exe
  C:\Windows\System\OChJyal.exe
  2⤵
  PID:4704
- C:\Windows\System\xSbmmYz.exe
  C:\Windows\System\xSbmmYz.exe
  2⤵
  PID:4720
- C:\Windows\System\srfPVht.exe
  C:\Windows\System\srfPVht.exe
  2⤵
  PID:4736
- C:\Windows\System\mOfKXdR.exe
  C:\Windows\System\mOfKXdR.exe
  2⤵
  PID:4752
- C:\Windows\System\MgzayMc.exe
  C:\Windows\System\MgzayMc.exe
  2⤵
  PID:4768
- C:\Windows\System\MWwzKYf.exe
  C:\Windows\System\MWwzKYf.exe
  2⤵
  PID:4784
- C:\Windows\System\CbISFoi.exe
  C:\Windows\System\CbISFoi.exe
  2⤵
  PID:4800
- C:\Windows\System\scVFKpn.exe
  C:\Windows\System\scVFKpn.exe
  2⤵
  PID:4816
- C:\Windows\System\ZxYOxUt.exe
  C:\Windows\System\ZxYOxUt.exe
  2⤵
  PID:4832
- C:\Windows\System\crmnWtt.exe
  C:\Windows\System\crmnWtt.exe
  2⤵
  PID:4848
- C:\Windows\System\lhnVTXO.exe
  C:\Windows\System\lhnVTXO.exe
  2⤵
  PID:4864
- C:\Windows\System\KHIWZTm.exe
  C:\Windows\System\KHIWZTm.exe
  2⤵
  PID:4880
- C:\Windows\System\YSSYYLz.exe
  C:\Windows\System\YSSYYLz.exe
  2⤵
  PID:4896
- C:\Windows\System\OMiCiHC.exe
  C:\Windows\System\OMiCiHC.exe
  2⤵
  PID:4912
- C:\Windows\System\mSfEcnb.exe
  C:\Windows\System\mSfEcnb.exe
  2⤵
  PID:4928
- C:\Windows\System\BqVmGBh.exe
  C:\Windows\System\BqVmGBh.exe
  2⤵
  PID:4948
- C:\Windows\System\XsFogst.exe
  C:\Windows\System\XsFogst.exe
  2⤵
  PID:4964
- C:\Windows\System\TsCfFJR.exe
  C:\Windows\System\TsCfFJR.exe
  2⤵
  PID:4980
- C:\Windows\System\lPmLkHr.exe
  C:\Windows\System\lPmLkHr.exe
  2⤵
  PID:5076
- C:\Windows\System\RxRbIER.exe
  C:\Windows\System\RxRbIER.exe
  2⤵
  PID:5112
- C:\Windows\System\XqkongS.exe
  C:\Windows\System\XqkongS.exe
  2⤵
  PID:3184
- C:\Windows\System\HgzKkZn.exe
  C:\Windows\System\HgzKkZn.exe
  2⤵
  PID:3532
- C:\Windows\System\qThfgGk.exe
  C:\Windows\System\qThfgGk.exe
  2⤵
  PID:3684
- C:\Windows\System\ebCLEXd.exe
  C:\Windows\System\ebCLEXd.exe
  2⤵
  PID:1540
- C:\Windows\System\iWNGIbN.exe
  C:\Windows\System\iWNGIbN.exe
  2⤵
  PID:3828
- C:\Windows\System\qYALmmR.exe
  C:\Windows\System\qYALmmR.exe
  2⤵
  PID:3820
- C:\Windows\System\BFzuGLx.exe
  C:\Windows\System\BFzuGLx.exe
  2⤵
  PID:3976
- C:\Windows\System\LsHXxDY.exe
  C:\Windows\System\LsHXxDY.exe
  2⤵
  PID:1944
- C:\Windows\System\zWUZLti.exe
  C:\Windows\System\zWUZLti.exe
  2⤵
  PID:1124
- C:\Windows\System\gPdKTjl.exe
  C:\Windows\System\gPdKTjl.exe
  2⤵
  PID:4036
- C:\Windows\System\aWCVnKi.exe
  C:\Windows\System\aWCVnKi.exe
  2⤵
  PID:3412
- C:\Windows\System\jxPJgKM.exe
  C:\Windows\System\jxPJgKM.exe
  2⤵
  PID:2964
- C:\Windows\System\oOQsjwD.exe
  C:\Windows\System\oOQsjwD.exe
  2⤵
  PID:4192
- C:\Windows\System\ModoSDD.exe
  C:\Windows\System\ModoSDD.exe
  2⤵
  PID:4216
- C:\Windows\System\WPtlPfW.exe
  C:\Windows\System\WPtlPfW.exe
  2⤵
  PID:4240
- C:\Windows\System\pTEaQzW.exe
  C:\Windows\System\pTEaQzW.exe
  2⤵
  PID:4204
- C:\Windows\System\VXQBtfe.exe
  C:\Windows\System\VXQBtfe.exe
  2⤵
  PID:4256
- C:\Windows\System\fabpSjB.exe
  C:\Windows\System\fabpSjB.exe
  2⤵
  PID:4168
- C:\Windows\System\jZemaiZ.exe
  C:\Windows\System\jZemaiZ.exe
  2⤵
  PID:3448
- C:\Windows\System\YjuYcNf.exe
  C:\Windows\System\YjuYcNf.exe
  2⤵
  PID:3952
- C:\Windows\System\rHKTnIR.exe
  C:\Windows\System\rHKTnIR.exe
  2⤵
  PID:3440
- C:\Windows\System\iWvMOno.exe
  C:\Windows\System\iWvMOno.exe
  2⤵
  PID:3468
- C:\Windows\System\KiBXqlG.exe
  C:\Windows\System\KiBXqlG.exe
  2⤵
  PID:3744
- C:\Windows\System\uTPGBlF.exe
  C:\Windows\System\uTPGBlF.exe
  2⤵
  PID:1720
- C:\Windows\System\mKGxYdA.exe
  C:\Windows\System\mKGxYdA.exe
  2⤵
  PID:4044
- C:\Windows\System\dAqefZz.exe
  C:\Windows\System\dAqefZz.exe
  2⤵
  PID:3704
- C:\Windows\System\UptGWLo.exe
  C:\Windows\System\UptGWLo.exe
  2⤵
  PID:4288
- C:\Windows\System\NvrpCvB.exe
  C:\Windows\System\NvrpCvB.exe
  2⤵
  PID:4348
- C:\Windows\System\PNhkTnA.exe
  C:\Windows\System\PNhkTnA.exe
  2⤵
  PID:3092
- C:\Windows\System\wiDzgbG.exe
  C:\Windows\System\wiDzgbG.exe
  2⤵
  PID:4416
- C:\Windows\System\ylovtNB.exe
  C:\Windows\System\ylovtNB.exe
  2⤵
  PID:4448
- C:\Windows\System\VFRzlga.exe
  C:\Windows\System\VFRzlga.exe
  2⤵
  PID:4468
- C:\Windows\System\umVGDUA.exe
  C:\Windows\System\umVGDUA.exe
  2⤵
  PID:4540
- C:\Windows\System\rVWTQjL.exe
  C:\Windows\System\rVWTQjL.exe
  2⤵
  PID:4520
- C:\Windows\System\iQUeFqK.exe
  C:\Windows\System\iQUeFqK.exe
  2⤵
  PID:4764
- C:\Windows\System\urVmhzt.exe
  C:\Windows\System\urVmhzt.exe
  2⤵
  PID:4812
- C:\Windows\System\numOIPc.exe
  C:\Windows\System\numOIPc.exe
  2⤵
  PID:4584
- C:\Windows\System\gOGwFKb.exe
  C:\Windows\System\gOGwFKb.exe
  2⤵
  PID:4684
- C:\Windows\System\akxIBlu.exe
  C:\Windows\System\akxIBlu.exe
  2⤵
  PID:4748
- C:\Windows\System\FSmMuSM.exe
  C:\Windows\System\FSmMuSM.exe
  2⤵
  PID:4840
- C:\Windows\System\SmqOoUP.exe
  C:\Windows\System\SmqOoUP.exe
  2⤵
  PID:4908
- C:\Windows\System\rhcjrNb.exe
  C:\Windows\System\rhcjrNb.exe
  2⤵
  PID:4796
- C:\Windows\System\SRJfbFU.exe
  C:\Windows\System\SRJfbFU.exe
  2⤵
  PID:4956
- C:\Windows\System\RMWhJgW.exe
  C:\Windows\System\RMWhJgW.exe
  2⤵
  PID:4888
- C:\Windows\System\pgnkSbQ.exe
  C:\Windows\System\pgnkSbQ.exe
  2⤵
  PID:4992
- C:\Windows\System\qENbVys.exe
  C:\Windows\System\qENbVys.exe
  2⤵
  PID:4996
- C:\Windows\System\gycXhTB.exe
  C:\Windows\System\gycXhTB.exe
  2⤵
  PID:5028
- C:\Windows\System\hnkzztk.exe
  C:\Windows\System\hnkzztk.exe
  2⤵
  PID:5048
- C:\Windows\System\hrDkeVP.exe
  C:\Windows\System\hrDkeVP.exe
  2⤵
  PID:5072
- C:\Windows\System\XvhdZIt.exe
  C:\Windows\System\XvhdZIt.exe
  2⤵
  PID:5084
- C:\Windows\System\huEPYJz.exe
  C:\Windows\System\huEPYJz.exe
  2⤵
  PID:3244
- C:\Windows\System\YKMQFWw.exe
  C:\Windows\System\YKMQFWw.exe
  2⤵
  PID:276
- C:\Windows\System\tApvlzj.exe
  C:\Windows\System\tApvlzj.exe
  2⤵
  PID:3764
- C:\Windows\System\Trxtzkc.exe
  C:\Windows\System\Trxtzkc.exe
  2⤵
  PID:3908
- C:\Windows\System\JbdOWrC.exe
  C:\Windows\System\JbdOWrC.exe
  2⤵
  PID:4380
- C:\Windows\System\zwiiIJr.exe
  C:\Windows\System\zwiiIJr.exe
  2⤵
  PID:3992
- C:\Windows\System\CsmAQBs.exe
  C:\Windows\System\CsmAQBs.exe
  2⤵
  PID:540
- C:\Windows\System\YgwLCTK.exe
  C:\Windows\System\YgwLCTK.exe
  2⤵
  PID:1780
- C:\Windows\System\UhcjxCT.exe
  C:\Windows\System\UhcjxCT.exe
  2⤵
  PID:4136
- C:\Windows\System\DBEHqyq.exe
  C:\Windows\System\DBEHqyq.exe
  2⤵
  PID:4268
- C:\Windows\System\DUjbgUS.exe
  C:\Windows\System\DUjbgUS.exe
  2⤵
  PID:2012
- C:\Windows\System\HNVwryK.exe
  C:\Windows\System\HNVwryK.exe
  2⤵
  PID:3220
- C:\Windows\System\bhMYRlT.exe
  C:\Windows\System\bhMYRlT.exe
  2⤵
  PID:3204
- C:\Windows\System\hmFSDhe.exe
  C:\Windows\System\hmFSDhe.exe
  2⤵
  PID:1252
- C:\Windows\System\KihBwcl.exe
  C:\Windows\System\KihBwcl.exe
  2⤵
  PID:3492
- C:\Windows\System\GBmdtpa.exe
  C:\Windows\System\GBmdtpa.exe
  2⤵
  PID:4304
- C:\Windows\System\unlpklY.exe
  C:\Windows\System\unlpklY.exe
  2⤵
  PID:4420
- C:\Windows\System\fGANmaX.exe
  C:\Windows\System\fGANmaX.exe
  2⤵
  PID:4480
- C:\Windows\System\jatVLVs.exe
  C:\Windows\System\jatVLVs.exe
  2⤵
  PID:4572
- C:\Windows\System\PZXbonT.exe
  C:\Windows\System\PZXbonT.exe
  2⤵
  PID:4456
- C:\Windows\System\hUzkANE.exe
  C:\Windows\System\hUzkANE.exe
  2⤵
  PID:4504
- C:\Windows\System\OSqFNXo.exe
  C:\Windows\System\OSqFNXo.exe
  2⤵
  PID:4700
- C:\Windows\System\iMvnDYE.exe
  C:\Windows\System\iMvnDYE.exe
  2⤵
  PID:4488
- C:\Windows\System\ZyzsIHk.exe
  C:\Windows\System\ZyzsIHk.exe
  2⤵
  PID:4516
- C:\Windows\System\azVmWEr.exe
  C:\Windows\System\azVmWEr.exe
  2⤵
  PID:4680
- C:\Windows\System\bnKiAqf.exe
  C:\Windows\System\bnKiAqf.exe
  2⤵
  PID:4872
- C:\Windows\System\tHYNRNl.exe
  C:\Windows\System\tHYNRNl.exe
  2⤵
  PID:4828
- C:\Windows\System\FkjXHlC.exe
  C:\Windows\System\FkjXHlC.exe
  2⤵
  PID:5032
- C:\Windows\System\tbGVjrs.exe
  C:\Windows\System\tbGVjrs.exe
  2⤵
  PID:5068
- C:\Windows\System\UqHkYKH.exe
  C:\Windows\System\UqHkYKH.exe
  2⤵
  PID:5100
- C:\Windows\System\FqnvxmV.exe
  C:\Windows\System\FqnvxmV.exe
  2⤵
  PID:2652
- C:\Windows\System\vSWQPKK.exe
  C:\Windows\System\vSWQPKK.exe
  2⤵
  PID:4228
- C:\Windows\System\ocIZldm.exe
  C:\Windows\System\ocIZldm.exe
  2⤵
  PID:4172
- C:\Windows\System\QJJfMwJ.exe
  C:\Windows\System\QJJfMwJ.exe
  2⤵
  PID:4088
- C:\Windows\System\OLffHWY.exe
  C:\Windows\System\OLffHWY.exe
  2⤵
  PID:4336
- C:\Windows\System\LqsxOXc.exe
  C:\Windows\System\LqsxOXc.exe
  2⤵
  PID:4212
- C:\Windows\System\TPtFAaR.exe
  C:\Windows\System\TPtFAaR.exe
  2⤵
  PID:4940
- C:\Windows\System\xgMIABq.exe
  C:\Windows\System\xgMIABq.exe
  2⤵
  PID:4208
- C:\Windows\System\YKqiJbq.exe
  C:\Windows\System\YKqiJbq.exe
  2⤵
  PID:3800
- C:\Windows\System\jUQWcTw.exe
  C:\Windows\System\jUQWcTw.exe
  2⤵
  PID:2576
- C:\Windows\System\maUJplC.exe
  C:\Windows\System\maUJplC.exe
  2⤵
  PID:4264
- C:\Windows\System\VVsYpkl.exe
  C:\Windows\System\VVsYpkl.exe
  2⤵
  PID:3644
- C:\Windows\System\NBpxpbY.exe
  C:\Windows\System\NBpxpbY.exe
  2⤵
  PID:4364
- C:\Windows\System\tQvADTp.exe
  C:\Windows\System\tQvADTp.exe
  2⤵
  PID:4696
- C:\Windows\System\wtOHnii.exe
  C:\Windows\System\wtOHnii.exe
  2⤵
  PID:4972
- C:\Windows\System\WkfPhYt.exe
  C:\Windows\System\WkfPhYt.exe
  2⤵
  PID:3164
- C:\Windows\System\oWUqYUT.exe
  C:\Windows\System\oWUqYUT.exe
  2⤵
  PID:5040
- C:\Windows\System\kRHVrvN.exe
  C:\Windows\System\kRHVrvN.exe
  2⤵
  PID:3988
- C:\Windows\System\OArYonC.exe
  C:\Windows\System\OArYonC.exe
  2⤵
  PID:4648
- C:\Windows\System\GvkgjBg.exe
  C:\Windows\System\GvkgjBg.exe
  2⤵
  PID:3200
- C:\Windows\System\jbaBQTR.exe
  C:\Windows\System\jbaBQTR.exe
  2⤵
  PID:768
- C:\Windows\System\roMQyIl.exe
  C:\Windows\System\roMQyIl.exe
  2⤵
  PID:4936
- C:\Windows\System\YCzYtfB.exe
  C:\Windows\System\YCzYtfB.exe
  2⤵
  PID:3720
- C:\Windows\System\OMrNqHI.exe
  C:\Windows\System\OMrNqHI.exe
  2⤵
  PID:3508
- C:\Windows\System\KSOQRnf.exe
  C:\Windows\System\KSOQRnf.exe
  2⤵
  PID:5140
- C:\Windows\System\omzlKTU.exe
  C:\Windows\System\omzlKTU.exe
  2⤵
  PID:5156
- C:\Windows\System\TQwqrWi.exe
  C:\Windows\System\TQwqrWi.exe
  2⤵
  PID:5172
- C:\Windows\System\DZnQkNF.exe
  C:\Windows\System\DZnQkNF.exe
  2⤵
  PID:5192
- C:\Windows\System\zxmrmEl.exe
  C:\Windows\System\zxmrmEl.exe
  2⤵
  PID:5208
- C:\Windows\System\FTcioLl.exe
  C:\Windows\System\FTcioLl.exe
  2⤵
  PID:5328
- C:\Windows\System\obxTSDQ.exe
  C:\Windows\System\obxTSDQ.exe
  2⤵
  PID:5352
- C:\Windows\System\pIkqhgb.exe
  C:\Windows\System\pIkqhgb.exe
  2⤵
  PID:5376
- C:\Windows\System\onBxiZT.exe
  C:\Windows\System\onBxiZT.exe
  2⤵
  PID:5396
- C:\Windows\System\ZLaCcfh.exe
  C:\Windows\System\ZLaCcfh.exe
  2⤵
  PID:5412
- C:\Windows\System\MeJlyNw.exe
  C:\Windows\System\MeJlyNw.exe
  2⤵
  PID:5428
- C:\Windows\System\XiEzpjy.exe
  C:\Windows\System\XiEzpjy.exe
  2⤵
  PID:5444
- C:\Windows\System\BZmPpTD.exe
  C:\Windows\System\BZmPpTD.exe
  2⤵
  PID:5460
- C:\Windows\System\nMFxDBz.exe
  C:\Windows\System\nMFxDBz.exe
  2⤵
  PID:5476
- C:\Windows\System\IkjmfYj.exe
  C:\Windows\System\IkjmfYj.exe
  2⤵
  PID:5496
- C:\Windows\System\stmELSb.exe
  C:\Windows\System\stmELSb.exe
  2⤵
  PID:5512
- C:\Windows\System\gejOTbQ.exe
  C:\Windows\System\gejOTbQ.exe
  2⤵
  PID:5528
- C:\Windows\System\pWqYosI.exe
  C:\Windows\System\pWqYosI.exe
  2⤵
  PID:5544
- C:\Windows\System\KAQDibk.exe
  C:\Windows\System\KAQDibk.exe
  2⤵
  PID:5560
- C:\Windows\System\IirIvbi.exe
  C:\Windows\System\IirIvbi.exe
  2⤵
  PID:5576
- C:\Windows\System\XUKOFtZ.exe
  C:\Windows\System\XUKOFtZ.exe
  2⤵
  PID:5592
- C:\Windows\System\xFueXGH.exe
  C:\Windows\System\xFueXGH.exe
  2⤵
  PID:5608
- C:\Windows\System\hOuxnVO.exe
  C:\Windows\System\hOuxnVO.exe
  2⤵
  PID:5624
- C:\Windows\System\inceJZr.exe
  C:\Windows\System\inceJZr.exe
  2⤵
  PID:5640
- C:\Windows\System\LPjoQhH.exe
  C:\Windows\System\LPjoQhH.exe
  2⤵
  PID:5660
- C:\Windows\System\IZVBKuH.exe
  C:\Windows\System\IZVBKuH.exe
  2⤵
  PID:5676
- C:\Windows\System\YQrifrE.exe
  C:\Windows\System\YQrifrE.exe
  2⤵
  PID:5692
- C:\Windows\System\PzTKhGk.exe
  C:\Windows\System\PzTKhGk.exe
  2⤵
  PID:5708
- C:\Windows\System\fNdMTTC.exe
  C:\Windows\System\fNdMTTC.exe
  2⤵
  PID:5724
- C:\Windows\System\ZDkmQWZ.exe
  C:\Windows\System\ZDkmQWZ.exe
  2⤵
  PID:5740
- C:\Windows\System\AxzWOnX.exe
  C:\Windows\System\AxzWOnX.exe
  2⤵
  PID:5760
- C:\Windows\System\toWZRWs.exe
  C:\Windows\System\toWZRWs.exe
  2⤵
  PID:5776
- C:\Windows\System\OzUiWyv.exe
  C:\Windows\System\OzUiWyv.exe
  2⤵
  PID:5792
- C:\Windows\System\JQeuHvu.exe
  C:\Windows\System\JQeuHvu.exe
  2⤵
  PID:5808
- C:\Windows\System\EsyOEIr.exe
  C:\Windows\System\EsyOEIr.exe
  2⤵
  PID:5824
- C:\Windows\System\CrJGaXl.exe
  C:\Windows\System\CrJGaXl.exe
  2⤵
  PID:5840
- C:\Windows\System\MfxhYPI.exe
  C:\Windows\System\MfxhYPI.exe
  2⤵
  PID:5856
- C:\Windows\System\QJgOgBR.exe
  C:\Windows\System\QJgOgBR.exe
  2⤵
  PID:5876
- C:\Windows\System\AWvtxhg.exe
  C:\Windows\System\AWvtxhg.exe
  2⤵
  PID:5892
- C:\Windows\System\FurQIEk.exe
  C:\Windows\System\FurQIEk.exe
  2⤵
  PID:5908
- C:\Windows\System\iWkmwYt.exe
  C:\Windows\System\iWkmwYt.exe
  2⤵
  PID:5924
- C:\Windows\System\fhmPYKW.exe
  C:\Windows\System\fhmPYKW.exe
  2⤵
  PID:5940
- C:\Windows\System\esRafio.exe
  C:\Windows\System\esRafio.exe
  2⤵
  PID:5956
- C:\Windows\System\uPNRsAF.exe
  C:\Windows\System\uPNRsAF.exe
  2⤵
  PID:5972
- C:\Windows\System\VBoSQkx.exe
  C:\Windows\System\VBoSQkx.exe
  2⤵
  PID:5988
- C:\Windows\System\CIwoCKP.exe
  C:\Windows\System\CIwoCKP.exe
  2⤵
  PID:6004
- C:\Windows\System\AbSLrnZ.exe
  C:\Windows\System\AbSLrnZ.exe
  2⤵
  PID:6020
- C:\Windows\System\VqHdqTP.exe
  C:\Windows\System\VqHdqTP.exe
  2⤵
  PID:6132
- C:\Windows\System\LLBMKIl.exe
  C:\Windows\System\LLBMKIl.exe
  2⤵
  PID:3564
- C:\Windows\System\MYhfCis.exe
  C:\Windows\System\MYhfCis.exe
  2⤵
  PID:4400
- C:\Windows\System\NDUyXWF.exe
  C:\Windows\System\NDUyXWF.exe
  2⤵
  PID:5012
- C:\Windows\System\EWJyRpQ.exe
  C:\Windows\System\EWJyRpQ.exe
  2⤵
  PID:2716
- C:\Windows\System\egmGksP.exe
  C:\Windows\System\egmGksP.exe
  2⤵
  PID:4180
- C:\Windows\System\zoRjdac.exe
  C:\Windows\System\zoRjdac.exe
  2⤵
  PID:3548
- C:\Windows\System\KHIgqMa.exe
  C:\Windows\System\KHIgqMa.exe
  2⤵
  PID:4744
- C:\Windows\System\UMzQVnt.exe
  C:\Windows\System\UMzQVnt.exe
  2⤵
  PID:4140
- C:\Windows\System\zvKHsDu.exe
  C:\Windows\System\zvKHsDu.exe
  2⤵
  PID:3156
- C:\Windows\System\rNhCfEV.exe
  C:\Windows\System\rNhCfEV.exe
  2⤵
  PID:3152
- C:\Windows\System\qVALbJy.exe
  C:\Windows\System\qVALbJy.exe
  2⤵
  PID:4236
- C:\Windows\System\SOexfjK.exe
  C:\Windows\System\SOexfjK.exe
  2⤵
  PID:4460
- C:\Windows\System\SbqIxog.exe
  C:\Windows\System\SbqIxog.exe
  2⤵
  PID:4184
- C:\Windows\System\wzoRrgs.exe
  C:\Windows\System\wzoRrgs.exe
  2⤵
  PID:5148
- C:\Windows\System\wOGUzRy.exe
  C:\Windows\System\wOGUzRy.exe
  2⤵
  PID:5200
- C:\Windows\System\YyTUOPo.exe
  C:\Windows\System\YyTUOPo.exe
  2⤵
  PID:5248
- C:\Windows\System\SjIwVMA.exe
  C:\Windows\System\SjIwVMA.exe
  2⤵
  PID:5260
- C:\Windows\System\TZpShWS.exe
  C:\Windows\System\TZpShWS.exe
  2⤵
  PID:5284
- C:\Windows\System\JrjmPNh.exe
  C:\Windows\System\JrjmPNh.exe
  2⤵
  PID:5280
- C:\Windows\System\LZweFBW.exe
  C:\Windows\System\LZweFBW.exe
  2⤵
  PID:5300
- C:\Windows\System\okFpQST.exe
  C:\Windows\System\okFpQST.exe
  2⤵
  PID:5312
- C:\Windows\System\AGSjWiS.exe
  C:\Windows\System\AGSjWiS.exe
  2⤵
  PID:5336
- C:\Windows\System\unaecKO.exe
  C:\Windows\System\unaecKO.exe
  2⤵
  PID:5364
- C:\Windows\System\GKpfiFr.exe
  C:\Windows\System\GKpfiFr.exe
  2⤵
  PID:5384
- C:\Windows\System\rfhvEkP.exe
  C:\Windows\System\rfhvEkP.exe
  2⤵
  PID:5452
- C:\Windows\System\WxAbArs.exe
  C:\Windows\System\WxAbArs.exe
  2⤵
  PID:5520
- C:\Windows\System\tSlEHnx.exe
  C:\Windows\System\tSlEHnx.exe
  2⤵
  PID:5552
- C:\Windows\System\tMUZedH.exe
  C:\Windows\System\tMUZedH.exe
  2⤵
  PID:5616
- C:\Windows\System\jBXyLkx.exe
  C:\Windows\System\jBXyLkx.exe
  2⤵
  PID:5656
- C:\Windows\System\wpwOClH.exe
  C:\Windows\System\wpwOClH.exe
  2⤵
  PID:5720
- C:\Windows\System\nDhdMqz.exe
  C:\Windows\System\nDhdMqz.exe
  2⤵
  PID:5440
- C:\Windows\System\rXwDhBI.exe
  C:\Windows\System\rXwDhBI.exe
  2⤵
  PID:5832
- C:\Windows\System\cpHxKLx.exe
  C:\Windows\System\cpHxKLx.exe
  2⤵
  PID:5900
- C:\Windows\System\yGLsHVc.exe
  C:\Windows\System\yGLsHVc.exe
  2⤵
  PID:5968
- C:\Windows\System\CPNIRTI.exe
  C:\Windows\System\CPNIRTI.exe
  2⤵
  PID:5404
- C:\Windows\System\RXigSJH.exe
  C:\Windows\System\RXigSJH.exe
  2⤵
  PID:5572
- C:\Windows\System\WiRwjGm.exe
  C:\Windows\System\WiRwjGm.exe
  2⤵
  PID:5472
- C:\Windows\System\TDhyjAd.exe
  C:\Windows\System\TDhyjAd.exe
  2⤵
  PID:5600
- C:\Windows\System\StYFvdS.exe
  C:\Windows\System\StYFvdS.exe
  2⤵
  PID:5672
- C:\Windows\System\txKNyrF.exe
  C:\Windows\System\txKNyrF.exe
  2⤵
  PID:6036
- C:\Windows\System\IgcMjiS.exe
  C:\Windows\System\IgcMjiS.exe
  2⤵
  PID:5788
- C:\Windows\System\pgpUpnW.exe
  C:\Windows\System\pgpUpnW.exe
  2⤵
  PID:6016
- C:\Windows\System\rxnEdTx.exe
  C:\Windows\System\rxnEdTx.exe
  2⤵
  PID:5952
- C:\Windows\System\aImbySe.exe
  C:\Windows\System\aImbySe.exe
  2⤵
  PID:5888
- C:\Windows\System\WjJuEay.exe
  C:\Windows\System\WjJuEay.exe
  2⤵
  PID:6052
- C:\Windows\System\RGPmQHE.exe
  C:\Windows\System\RGPmQHE.exe
  2⤵
  PID:6072
- C:\Windows\System\qdzoCOf.exe
  C:\Windows\System\qdzoCOf.exe
  2⤵
  PID:6088
- C:\Windows\System\uHZCsDY.exe
  C:\Windows\System\uHZCsDY.exe
  2⤵
  PID:6104
- C:\Windows\System\zGvjwjB.exe
  C:\Windows\System\zGvjwjB.exe
  2⤵
  PID:6124
- C:\Windows\System\ogBXDkC.exe
  C:\Windows\System\ogBXDkC.exe
  2⤵
  PID:4652
- C:\Windows\System\nmZvZis.exe
  C:\Windows\System\nmZvZis.exe
  2⤵
  PID:3620
- C:\Windows\System\QuMzJwV.exe
  C:\Windows\System\QuMzJwV.exe
  2⤵
  PID:4536
- C:\Windows\System\LhaBUBa.exe
  C:\Windows\System\LhaBUBa.exe
  2⤵
  PID:5152
- C:\Windows\System\EPjDPbI.exe
  C:\Windows\System\EPjDPbI.exe
  2⤵
  PID:5092
- C:\Windows\System\OLkUcHO.exe
  C:\Windows\System\OLkUcHO.exe
  2⤵
  PID:5268
- C:\Windows\System\zSqujdm.exe
  C:\Windows\System\zSqujdm.exe
  2⤵
  PID:5324
- C:\Windows\System\AijDuEJ.exe
  C:\Windows\System\AijDuEJ.exe
  2⤵
  PID:5424
- C:\Windows\System\KelqvTA.exe
  C:\Windows\System\KelqvTA.exe
  2⤵
  PID:5652
- C:\Windows\System\ZdwMACl.exe
  C:\Windows\System\ZdwMACl.exe
  2⤵
  PID:4368
- C:\Windows\System\EHBvGcr.exe
  C:\Windows\System\EHBvGcr.exe
  2⤵
  PID:5436
- C:\Windows\System\nDteHbE.exe
  C:\Windows\System\nDteHbE.exe
  2⤵
  PID:4152
- C:\Windows\System\WWWQojn.exe
  C:\Windows\System\WWWQojn.exe
  2⤵
  PID:3416
- C:\Windows\System\ouyAXpI.exe
  C:\Windows\System\ouyAXpI.exe
  2⤵
  PID:5784
- C:\Windows\System\SMgjoIk.exe
  C:\Windows\System\SMgjoIk.exe
  2⤵
  PID:6048
- C:\Windows\System\okSJGnr.exe
  C:\Windows\System\okSJGnr.exe
  2⤵
  PID:4052
- C:\Windows\System\vRjjNxR.exe
  C:\Windows\System\vRjjNxR.exe
  2⤵
  PID:5096
- C:\Windows\System\xpPFQBn.exe
  C:\Windows\System\xpPFQBn.exe
  2⤵
  PID:5292
- C:\Windows\System\Olugesc.exe
  C:\Windows\System\Olugesc.exe
  2⤵
  PID:5584
- C:\Windows\System\yBbeoGv.exe
  C:\Windows\System\yBbeoGv.exe
  2⤵
  PID:5964
- C:\Windows\System\ufeMeTc.exe
  C:\Windows\System\ufeMeTc.exe
  2⤵
  PID:5252
- C:\Windows\System\yMikOqj.exe
  C:\Windows\System\yMikOqj.exe
  2⤵
  PID:5188
- C:\Windows\System\nsNrMIU.exe
  C:\Windows\System\nsNrMIU.exe
  2⤵
  PID:5736
- C:\Windows\System\fNyTzxx.exe
  C:\Windows\System\fNyTzxx.exe
  2⤵
  PID:5296
- C:\Windows\System\dbqzweT.exe
  C:\Windows\System\dbqzweT.exe
  2⤵
  PID:5372
- C:\Windows\System\MjXcwDD.exe
  C:\Windows\System\MjXcwDD.exe
  2⤵
  PID:5800
- C:\Windows\System\QwteUhF.exe
  C:\Windows\System\QwteUhF.exe
  2⤵
  PID:3856
- C:\Windows\System\deaiuZw.exe
  C:\Windows\System\deaiuZw.exe
  2⤵
  PID:3428
- C:\Windows\System\LumkWzy.exe
  C:\Windows\System\LumkWzy.exe
  2⤵
  PID:5868
- C:\Windows\System\MyQnxQN.exe
  C:\Windows\System\MyQnxQN.exe
  2⤵
  PID:5636
- C:\Windows\System\ECVEMFc.exe
  C:\Windows\System\ECVEMFc.exe
  2⤵
  PID:5348
- C:\Windows\System\IccaBQQ.exe
  C:\Windows\System\IccaBQQ.exe
  2⤵
  PID:5748
- C:\Windows\System\yuYPWuD.exe
  C:\Windows\System\yuYPWuD.exe
  2⤵
  PID:5224
- C:\Windows\System\JnHAmDL.exe
  C:\Windows\System\JnHAmDL.exe
  2⤵
  PID:6148
- C:\Windows\System\nPRYajV.exe
  C:\Windows\System\nPRYajV.exe
  2⤵
  PID:6168
- C:\Windows\System\Qysvyhc.exe
  C:\Windows\System\Qysvyhc.exe
  2⤵
  PID:6184
- C:\Windows\System\ImitjEf.exe
  C:\Windows\System\ImitjEf.exe
  2⤵
  PID:6200
- C:\Windows\System\rtXaQfN.exe
  C:\Windows\System\rtXaQfN.exe
  2⤵
  PID:6216
- C:\Windows\System\kRZVXJy.exe
  C:\Windows\System\kRZVXJy.exe
  2⤵
  PID:6232
- C:\Windows\System\IMvGOOr.exe
  C:\Windows\System\IMvGOOr.exe
  2⤵
  PID:6248
- C:\Windows\System\WFNUWkN.exe
  C:\Windows\System\WFNUWkN.exe
  2⤵
  PID:6264
- C:\Windows\System\HXiiUkH.exe
  C:\Windows\System\HXiiUkH.exe
  2⤵
  PID:6284
- C:\Windows\System\TGkHcUP.exe
  C:\Windows\System\TGkHcUP.exe
  2⤵
  PID:6304
- C:\Windows\System\ovMFSVS.exe
  C:\Windows\System\ovMFSVS.exe
  2⤵
  PID:6320
- C:\Windows\System\rYZVRwu.exe
  C:\Windows\System\rYZVRwu.exe
  2⤵
  PID:6336
- C:\Windows\System\opIILkN.exe
  C:\Windows\System\opIILkN.exe
  2⤵
  PID:6352
- C:\Windows\System\KVQsurd.exe
  C:\Windows\System\KVQsurd.exe
  2⤵
  PID:6368
- C:\Windows\System\dBFWXlJ.exe
  C:\Windows\System\dBFWXlJ.exe
  2⤵
  PID:6384
- C:\Windows\System\tNxUvOS.exe
  C:\Windows\System\tNxUvOS.exe
  2⤵
  PID:6400
- C:\Windows\System\DARssux.exe
  C:\Windows\System\DARssux.exe
  2⤵
  PID:6416
- C:\Windows\System\oRBAZcD.exe
  C:\Windows\System\oRBAZcD.exe
  2⤵
  PID:6432
- C:\Windows\System\kGoiZkl.exe
  C:\Windows\System\kGoiZkl.exe
  2⤵
  PID:6448
- C:\Windows\System\fBuAugu.exe
  C:\Windows\System\fBuAugu.exe
  2⤵
  PID:6464
- C:\Windows\System\eryVghx.exe
  C:\Windows\System\eryVghx.exe
  2⤵
  PID:6480
- C:\Windows\System\sAhICIe.exe
  C:\Windows\System\sAhICIe.exe
  2⤵
  PID:6496
- C:\Windows\System\TKzaqhl.exe
  C:\Windows\System\TKzaqhl.exe
  2⤵
  PID:6516
- C:\Windows\System\FxZqtRP.exe
  C:\Windows\System\FxZqtRP.exe
  2⤵
  PID:6532
- C:\Windows\System\HvhUKdR.exe
  C:\Windows\System\HvhUKdR.exe
  2⤵
  PID:6548
- C:\Windows\System\wOtwLXL.exe
  C:\Windows\System\wOtwLXL.exe
  2⤵
  PID:6564
- C:\Windows\System\kntMvtk.exe
  C:\Windows\System\kntMvtk.exe
  2⤵
  PID:6580
- C:\Windows\System\CttHjwD.exe
  C:\Windows\System\CttHjwD.exe
  2⤵
  PID:6684
- C:\Windows\System\rwAdvJB.exe
  C:\Windows\System\rwAdvJB.exe
  2⤵
  PID:6716
- C:\Windows\System\oLauyTg.exe
  C:\Windows\System\oLauyTg.exe
  2⤵
  PID:6732
- C:\Windows\System\plwxhyM.exe
  C:\Windows\System\plwxhyM.exe
  2⤵
  PID:6748
- C:\Windows\System\WTAYpen.exe
  C:\Windows\System\WTAYpen.exe
  2⤵
  PID:6764
- C:\Windows\System\ngrOePw.exe
  C:\Windows\System\ngrOePw.exe
  2⤵
  PID:6780
- C:\Windows\System\VnzqpeI.exe
  C:\Windows\System\VnzqpeI.exe
  2⤵
  PID:6796
- C:\Windows\System\xnLBVEO.exe
  C:\Windows\System\xnLBVEO.exe
  2⤵
  PID:6812
- C:\Windows\System\JdvOWNb.exe
  C:\Windows\System\JdvOWNb.exe
  2⤵
  PID:6828
- C:\Windows\System\uLyDImS.exe
  C:\Windows\System\uLyDImS.exe
  2⤵
  PID:6844
- C:\Windows\System\WTLdhZb.exe
  C:\Windows\System\WTLdhZb.exe
  2⤵
  PID:6860
- C:\Windows\System\bHZVjjx.exe
  C:\Windows\System\bHZVjjx.exe
  2⤵
  PID:6876
- C:\Windows\System\HqVljUY.exe
  C:\Windows\System\HqVljUY.exe
  2⤵
  PID:6892
- C:\Windows\System\mGUJIku.exe
  C:\Windows\System\mGUJIku.exe
  2⤵
  PID:6908
- C:\Windows\System\NBtkFpH.exe
  C:\Windows\System\NBtkFpH.exe
  2⤵
  PID:6924
- C:\Windows\System\jeaFSjq.exe
  C:\Windows\System\jeaFSjq.exe
  2⤵
  PID:6940
- C:\Windows\System\LotCubi.exe
  C:\Windows\System\LotCubi.exe
  2⤵
  PID:6956
- C:\Windows\System\jzOlkIl.exe
  C:\Windows\System\jzOlkIl.exe
  2⤵
  PID:6972
- C:\Windows\System\IfEeZcV.exe
  C:\Windows\System\IfEeZcV.exe
  2⤵
  PID:6988
- C:\Windows\System\tuoelNe.exe
  C:\Windows\System\tuoelNe.exe
  2⤵
  PID:7004
- C:\Windows\System\mWxXmNM.exe
  C:\Windows\System\mWxXmNM.exe
  2⤵
  PID:7020
- C:\Windows\System\SYEFIDq.exe
  C:\Windows\System\SYEFIDq.exe
  2⤵
  PID:7036
- C:\Windows\System\nTjaQPL.exe
  C:\Windows\System\nTjaQPL.exe
  2⤵
  PID:7052
- C:\Windows\System\ilMxiIN.exe
  C:\Windows\System\ilMxiIN.exe
  2⤵
  PID:7068
- C:\Windows\System\mMUGXTL.exe
  C:\Windows\System\mMUGXTL.exe
  2⤵
  PID:7084
- C:\Windows\System\eDIcfpL.exe
  C:\Windows\System\eDIcfpL.exe
  2⤵
  PID:7100
- C:\Windows\System\XpJopQP.exe
  C:\Windows\System\XpJopQP.exe
  2⤵
  PID:7116
- C:\Windows\System\lfbLNSY.exe
  C:\Windows\System\lfbLNSY.exe
  2⤵
  PID:7132
- C:\Windows\System\zfAjnAz.exe
  C:\Windows\System\zfAjnAz.exe
  2⤵
  PID:7148
- C:\Windows\System\CdhbNnz.exe
  C:\Windows\System\CdhbNnz.exe
  2⤵
  PID:7164
- C:\Windows\System\CEYeWNT.exe
  C:\Windows\System\CEYeWNT.exe
  2⤵
  PID:5264
- C:\Windows\System\PsKYVzz.exe
  C:\Windows\System\PsKYVzz.exe
  2⤵
  PID:3352
- C:\Windows\System\KxTglVN.exe
  C:\Windows\System\KxTglVN.exe
  2⤵
  PID:6180
- C:\Windows\System\HUWmpYy.exe
  C:\Windows\System\HUWmpYy.exe
  2⤵
  PID:5684
- C:\Windows\System\gScGtPQ.exe
  C:\Windows\System\gScGtPQ.exe
  2⤵
  PID:5732
- C:\Windows\System\vefVAzx.exe
  C:\Windows\System\vefVAzx.exe
  2⤵
  PID:5932
- C:\Windows\System\EyvcUeO.exe
  C:\Windows\System\EyvcUeO.exe
  2⤵
  PID:6244
- C:\Windows\System\dUVwsgi.exe
  C:\Windows\System\dUVwsgi.exe
  2⤵
  PID:4668
- C:\Windows\System\GUauIRi.exe
  C:\Windows\System\GUauIRi.exe
  2⤵
  PID:6280
- C:\Windows\System\IHHUiEv.exe
  C:\Windows\System\IHHUiEv.exe
  2⤵
  PID:5804
- C:\Windows\System\avoEAdh.exe
  C:\Windows\System\avoEAdh.exe
  2⤵
  PID:6348
- C:\Windows\System\MmQUgUy.exe
  C:\Windows\System\MmQUgUy.exe
  2⤵
  PID:6412
- C:\Windows\System\MEPdyAt.exe
  C:\Windows\System\MEPdyAt.exe
  2⤵
  PID:5004
- C:\Windows\System\udcILOP.exe
  C:\Windows\System\udcILOP.exe
  2⤵
  PID:5820
- C:\Windows\System\WwHgEOo.exe
  C:\Windows\System\WwHgEOo.exe
  2⤵
  PID:5768
- C:\Windows\System\udOhDEQ.exe
  C:\Windows\System\udOhDEQ.exe
  2⤵
  PID:6196
- C:\Windows\System\vdUAQAU.exe
  C:\Windows\System\vdUAQAU.exe
  2⤵
  PID:6256
- C:\Windows\System\tYZojLw.exe
  C:\Windows\System\tYZojLw.exe
  2⤵
  PID:6492
- C:\Windows\System\KvAWqVm.exe
  C:\Windows\System\KvAWqVm.exe
  2⤵
  PID:6300
- C:\Windows\System\JOWTfTg.exe
  C:\Windows\System\JOWTfTg.exe
  2⤵
  PID:6360
- C:\Windows\System\nwDSvQj.exe
  C:\Windows\System\nwDSvQj.exe
  2⤵
  PID:6524
- C:\Windows\System\vZVpfPC.exe
  C:\Windows\System\vZVpfPC.exe
  2⤵
  PID:6476
- C:\Windows\System\ELfDwFf.exe
  C:\Windows\System\ELfDwFf.exe
  2⤵
  PID:6588
- C:\Windows\System\pBvgtHO.exe
  C:\Windows\System\pBvgtHO.exe
  2⤵
  PID:6572
- C:\Windows\System\fDkPmnZ.exe
  C:\Windows\System\fDkPmnZ.exe
  2⤵
  PID:6600
- C:\Windows\System\RRPEFWj.exe
  C:\Windows\System\RRPEFWj.exe
  2⤵
  PID:6616
- C:\Windows\System\oUKrIIL.exe
  C:\Windows\System\oUKrIIL.exe
  2⤵
  PID:6668
- C:\Windows\System\uoINZye.exe
  C:\Windows\System\uoINZye.exe
  2⤵
  PID:6704
- C:\Windows\System\tkCCCTM.exe
  C:\Windows\System\tkCCCTM.exe
  2⤵
  PID:6740
- C:\Windows\System\HggaTfc.exe
  C:\Windows\System\HggaTfc.exe
  2⤵
  PID:6804
- C:\Windows\System\YlEgSwT.exe
  C:\Windows\System\YlEgSwT.exe
  2⤵
  PID:6868
- C:\Windows\System\VKyVWHi.exe
  C:\Windows\System\VKyVWHi.exe
  2⤵
  PID:6792
- C:\Windows\System\KoAkqJa.exe
  C:\Windows\System\KoAkqJa.exe
  2⤵
  PID:6932
- C:\Windows\System\tROOmWA.exe
  C:\Windows\System\tROOmWA.exe
  2⤵
  PID:7076
- C:\Windows\System\LdgamnZ.exe
  C:\Windows\System\LdgamnZ.exe
  2⤵
  PID:6936
- C:\Windows\System\flAyyxt.exe
  C:\Windows\System\flAyyxt.exe
  2⤵
  PID:6824
- C:\Windows\System\HjBGzFA.exe
  C:\Windows\System\HjBGzFA.exe
  2⤵
  PID:6948
- C:\Windows\System\ZigxxkD.exe
  C:\Windows\System\ZigxxkD.exe
  2⤵
  PID:6980
- C:\Windows\System\vwLIfBb.exe
  C:\Windows\System\vwLIfBb.exe
  2⤵
  PID:5916
- C:\Windows\System\QzuupvN.exe
  C:\Windows\System\QzuupvN.exe
  2⤵
  PID:7140
- C:\Windows\System\SHSCSoM.exe
  C:\Windows\System\SHSCSoM.exe
  2⤵
  PID:5492
- C:\Windows\System\SCYJYQA.exe
  C:\Windows\System\SCYJYQA.exe
  2⤵
  PID:6116
- C:\Windows\System\LAiPUhT.exe
  C:\Windows\System\LAiPUhT.exe
  2⤵
  PID:6212
- C:\Windows\System\nlzpNRN.exe
  C:\Windows\System\nlzpNRN.exe
  2⤵
  PID:7128
- C:\Windows\System\GkWuynh.exe
  C:\Windows\System\GkWuynh.exe
  2⤵
  PID:6228
- C:\Windows\System\fxMBAcl.exe
  C:\Windows\System\fxMBAcl.exe
  2⤵
  PID:6344
- C:\Windows\System\sZpzJuS.exe
  C:\Windows\System\sZpzJuS.exe
  2⤵
  PID:6408
- C:\Windows\System\TYPqXpk.exe
  C:\Windows\System\TYPqXpk.exe
  2⤵
  PID:6164
- C:\Windows\System\tqpKFTV.exe
  C:\Windows\System\tqpKFTV.exe
  2⤵
  PID:6488
- C:\Windows\System\jFMLfTJ.exe
  C:\Windows\System\jFMLfTJ.exe
  2⤵
  PID:6396
- C:\Windows\System\FrHZPau.exe
  C:\Windows\System\FrHZPau.exe
  2⤵
  PID:6540
- C:\Windows\System\NPjannM.exe
  C:\Windows\System\NPjannM.exe
  2⤵
  PID:6296
- C:\Windows\System\rKlTkeS.exe
  C:\Windows\System\rKlTkeS.exe
  2⤵
  PID:6556
- C:\Windows\System\oFVGjKN.exe
  C:\Windows\System\oFVGjKN.exe
  2⤵
  PID:6596
- C:\Windows\System\hhPOYqm.exe
  C:\Windows\System\hhPOYqm.exe
  2⤵
  PID:6628
- C:\Windows\System\ZzrLnkx.exe
  C:\Windows\System\ZzrLnkx.exe
  2⤵
  PID:6648
- C:\Windows\System\zslwLGU.exe
  C:\Windows\System\zslwLGU.exe
  2⤵
  PID:6696
- C:\Windows\System\VzVRYiu.exe
  C:\Windows\System\VzVRYiu.exe
  2⤵
  PID:6756
- C:\Windows\System\kBAKOmX.exe
  C:\Windows\System\kBAKOmX.exe
  2⤵
  PID:6996
- C:\Windows\System\lpCHepp.exe
  C:\Windows\System\lpCHepp.exe
  2⤵
  PID:7000
- C:\Windows\System\BDImenH.exe
  C:\Windows\System\BDImenH.exe
  2⤵
  PID:6820
- C:\Windows\System\HmzaKhX.exe
  C:\Windows\System\HmzaKhX.exe
  2⤵
  PID:6900
- C:\Windows\System\MCqnKjq.exe
  C:\Windows\System\MCqnKjq.exe
  2⤵
  PID:7044
- C:\Windows\System\CsYfxNU.exe
  C:\Windows\System\CsYfxNU.exe
  2⤵
  PID:7064
- C:\Windows\System\DfnaKIX.exe
  C:\Windows\System\DfnaKIX.exe
  2⤵
  PID:7160
- C:\Windows\System\vsTOVpN.exe
  C:\Windows\System\vsTOVpN.exe
  2⤵
  PID:5648
- C:\Windows\System\CqJeGBQ.exe
  C:\Windows\System\CqJeGBQ.exe
  2⤵
  PID:6508
- C:\Windows\System\xsZhqFi.exe
  C:\Windows\System\xsZhqFi.exe
  2⤵
  PID:6504
- C:\Windows\System\GCiyiqQ.exe
  C:\Windows\System\GCiyiqQ.exe
  2⤵
  PID:6888
- C:\Windows\System\bJrmxUC.exe
  C:\Windows\System\bJrmxUC.exe
  2⤵
  PID:6836
- C:\Windows\System\txmUfXH.exe
  C:\Windows\System\txmUfXH.exe
  2⤵
  PID:6316
- C:\Windows\System\nRqtJHd.exe
  C:\Windows\System\nRqtJHd.exe
  2⤵
  PID:7172
- C:\Windows\System\IrobsUh.exe
  C:\Windows\System\IrobsUh.exe
  2⤵
  PID:7192
- C:\Windows\System\KWmGDrQ.exe
  C:\Windows\System\KWmGDrQ.exe
  2⤵
  PID:7208
- C:\Windows\System\hwcuLoy.exe
  C:\Windows\System\hwcuLoy.exe
  2⤵
  PID:7224
- C:\Windows\System\fKKPOFi.exe
  C:\Windows\System\fKKPOFi.exe
  2⤵
  PID:7240
- C:\Windows\System\MoXzVxB.exe
  C:\Windows\System\MoXzVxB.exe
  2⤵
  PID:7260
- C:\Windows\System\EHOvvxL.exe
  C:\Windows\System\EHOvvxL.exe
  2⤵
  PID:7280
- C:\Windows\System\ECpUEAt.exe
  C:\Windows\System\ECpUEAt.exe
  2⤵
  PID:7300
- C:\Windows\System\OjUBWue.exe
  C:\Windows\System\OjUBWue.exe
  2⤵
  PID:7316
- C:\Windows\System\vgoxIMv.exe
  C:\Windows\System\vgoxIMv.exe
  2⤵
  PID:7332
- C:\Windows\System\YIOyQGJ.exe
  C:\Windows\System\YIOyQGJ.exe
  2⤵
  PID:7348
- C:\Windows\System\rqdQexm.exe
  C:\Windows\System\rqdQexm.exe
  2⤵
  PID:7364
- C:\Windows\System\hVtCwfO.exe
  C:\Windows\System\hVtCwfO.exe
  2⤵
  PID:7384
- C:\Windows\System\VgjimEE.exe
  C:\Windows\System\VgjimEE.exe
  2⤵
  PID:7400
- C:\Windows\System\jmrVHCv.exe
  C:\Windows\System\jmrVHCv.exe
  2⤵
  PID:7416
- C:\Windows\System\BYhSisV.exe
  C:\Windows\System\BYhSisV.exe
  2⤵
  PID:7432
- C:\Windows\System\weXXGbf.exe
  C:\Windows\System\weXXGbf.exe
  2⤵
  PID:7452
- C:\Windows\System\hPojszh.exe
  C:\Windows\System\hPojszh.exe
  2⤵
  PID:7468
- C:\Windows\System\ZTaJXdG.exe
  C:\Windows\System\ZTaJXdG.exe
  2⤵
  PID:7484
- C:\Windows\System\KroQlKl.exe
  C:\Windows\System\KroQlKl.exe
  2⤵
  PID:7500
- C:\Windows\System\QTvIwgN.exe
  C:\Windows\System\QTvIwgN.exe
  2⤵
  PID:7520
- C:\Windows\System\XMqNoRl.exe
  C:\Windows\System\XMqNoRl.exe
  2⤵
  PID:7540
- C:\Windows\System\cYHjozr.exe
  C:\Windows\System\cYHjozr.exe
  2⤵
  PID:7556
- C:\Windows\System\acwCQjE.exe
  C:\Windows\System\acwCQjE.exe
  2⤵
  PID:7572
- C:\Windows\System\nhkMKnu.exe
  C:\Windows\System\nhkMKnu.exe
  2⤵
  PID:7588
- C:\Windows\System\WQrwmfP.exe
  C:\Windows\System\WQrwmfP.exe
  2⤵
  PID:7604
- C:\Windows\System\VzWLDKe.exe
  C:\Windows\System\VzWLDKe.exe
  2⤵
  PID:7624
- C:\Windows\System\iauLLUA.exe
  C:\Windows\System\iauLLUA.exe
  2⤵
  PID:7644
- C:\Windows\System\XdluJeQ.exe
  C:\Windows\System\XdluJeQ.exe
  2⤵
  PID:7660
- C:\Windows\System\csKVjyU.exe
  C:\Windows\System\csKVjyU.exe
  2⤵
  PID:7676
- C:\Windows\System\xHBjMwu.exe
  C:\Windows\System\xHBjMwu.exe
  2⤵
  PID:7692
- C:\Windows\System\oEKwusx.exe
  C:\Windows\System\oEKwusx.exe
  2⤵
  PID:7708
- C:\Windows\System\SXEAwyW.exe
  C:\Windows\System\SXEAwyW.exe
  2⤵
  PID:7724
- C:\Windows\System\RmmZUTu.exe
  C:\Windows\System\RmmZUTu.exe
  2⤵
  PID:7740
- C:\Windows\System\alVwXkA.exe
  C:\Windows\System\alVwXkA.exe
  2⤵
  PID:7760
- C:\Windows\System\rvrJNXb.exe
  C:\Windows\System\rvrJNXb.exe
  2⤵
  PID:7776
- C:\Windows\System\mioYnNJ.exe
  C:\Windows\System\mioYnNJ.exe
  2⤵
  PID:7792
- C:\Windows\System\DLbMSDq.exe
  C:\Windows\System\DLbMSDq.exe
  2⤵
  PID:7808
- C:\Windows\System\VLqHXQJ.exe
  C:\Windows\System\VLqHXQJ.exe
  2⤵
  PID:7824
- C:\Windows\System\QylNPQS.exe
  C:\Windows\System\QylNPQS.exe
  2⤵
  PID:7840
- C:\Windows\System\KqwGxFe.exe
  C:\Windows\System\KqwGxFe.exe
  2⤵
  PID:7860
- C:\Windows\System\FixCqRS.exe
  C:\Windows\System\FixCqRS.exe
  2⤵
  PID:7880
- C:\Windows\System\feNaNMv.exe
  C:\Windows\System\feNaNMv.exe
  2⤵
  PID:7896
- C:\Windows\System\wrQnDru.exe
  C:\Windows\System\wrQnDru.exe
  2⤵
  PID:7912
- C:\Windows\System\bKUaynx.exe
  C:\Windows\System\bKUaynx.exe
  2⤵
  PID:7928
- C:\Windows\System\kGliHGk.exe
  C:\Windows\System\kGliHGk.exe
  2⤵
  PID:7944
- C:\Windows\System\IcBXsRI.exe
  C:\Windows\System\IcBXsRI.exe
  2⤵
  PID:7960
- C:\Windows\System\mzxlqbZ.exe
  C:\Windows\System\mzxlqbZ.exe
  2⤵
  PID:7976
- C:\Windows\System\knMuOTg.exe
  C:\Windows\System\knMuOTg.exe
  2⤵
  PID:7996
- C:\Windows\System\zvyZcin.exe
  C:\Windows\System\zvyZcin.exe
  2⤵
  PID:8012
- C:\Windows\System\LkCAolZ.exe
  C:\Windows\System\LkCAolZ.exe
  2⤵
  PID:8028
- C:\Windows\System\mqfANXi.exe
  C:\Windows\System\mqfANXi.exe
  2⤵
  PID:8072
- C:\Windows\System\DyVOZFF.exe
  C:\Windows\System\DyVOZFF.exe
  2⤵
  PID:8088
- C:\Windows\System\rlkCnwj.exe
  C:\Windows\System\rlkCnwj.exe
  2⤵
  PID:8108
- C:\Windows\System\vpiGarm.exe
  C:\Windows\System\vpiGarm.exe
  2⤵
  PID:8124
- C:\Windows\System\EUcXDzS.exe
  C:\Windows\System\EUcXDzS.exe
  2⤵
  PID:8140
- C:\Windows\System\PEOZwXx.exe
  C:\Windows\System\PEOZwXx.exe
  2⤵
  PID:8156
- C:\Windows\System\PkfOGNF.exe
  C:\Windows\System\PkfOGNF.exe
  2⤵
  PID:8172
- C:\Windows\System\LOTrmoI.exe
  C:\Windows\System\LOTrmoI.exe
  2⤵
  PID:8188
- C:\Windows\System\AbyVzwP.exe
  C:\Windows\System\AbyVzwP.exe
  2⤵
  PID:7200
- C:\Windows\System\WgITbmL.exe
  C:\Windows\System\WgITbmL.exe
  2⤵
  PID:7268
- C:\Windows\System\tLqDixt.exe
  C:\Windows\System\tLqDixt.exe
  2⤵
  PID:7312
- C:\Windows\System\MgSdyEv.exe
  C:\Windows\System\MgSdyEv.exe
  2⤵
  PID:7380
- C:\Windows\System\lHFYnUO.exe
  C:\Windows\System\lHFYnUO.exe
  2⤵
  PID:7440
- C:\Windows\System\SjMfVRI.exe
  C:\Windows\System\SjMfVRI.exe
  2⤵
  PID:7476
- C:\Windows\System\ppNAljv.exe
  C:\Windows\System\ppNAljv.exe
  2⤵
  PID:7552
- C:\Windows\System\wgdytYL.exe
  C:\Windows\System\wgdytYL.exe
  2⤵
  PID:7616
- C:\Windows\System\tOWlieo.exe
  C:\Windows\System\tOWlieo.exe
  2⤵
  PID:7684
- C:\Windows\System\GAHUxAT.exe
  C:\Windows\System\GAHUxAT.exe
  2⤵
  PID:7748
- C:\Windows\System\aYdGbJh.exe
  C:\Windows\System\aYdGbJh.exe
  2⤵
  PID:7788
- C:\Windows\System\kmXvGeT.exe
  C:\Windows\System\kmXvGeT.exe
  2⤵
  PID:7888
- C:\Windows\System\ufngVvk.exe
  C:\Windows\System\ufngVvk.exe
  2⤵
  PID:7952
- C:\Windows\System\zWgccTg.exe
  C:\Windows\System\zWgccTg.exe
  2⤵
  PID:7992
- C:\Windows\System\ypIuSox.exe
  C:\Windows\System\ypIuSox.exe
  2⤵
  PID:7360
- C:\Windows\System\vqQhqxA.exe
  C:\Windows\System\vqQhqxA.exe
  2⤵
  PID:7460
- C:\Windows\System\RKEMeEm.exe
  C:\Windows\System\RKEMeEm.exe
  2⤵
  PID:7528
- C:\Windows\System\nbkoGLa.exe
  C:\Windows\System\nbkoGLa.exe
  2⤵
  PID:7568
- C:\Windows\System\sIekoSy.exe
  C:\Windows\System\sIekoSy.exe
  2⤵
  PID:7640
- C:\Windows\System\rDrLxFc.exe
  C:\Windows\System\rDrLxFc.exe
  2⤵
  PID:7096
- C:\Windows\System\OjctpDS.exe
  C:\Windows\System\OjctpDS.exe
  2⤵
  PID:7324
- C:\Windows\System\sEBPyVU.exe
  C:\Windows\System\sEBPyVU.exe
  2⤵
  PID:7092
- C:\Windows\System\eVnabcT.exe
  C:\Windows\System\eVnabcT.exe
  2⤵
  PID:6176
- C:\Windows\System\tzRVRoE.exe
  C:\Windows\System\tzRVRoE.exe
  2⤵
  PID:6120
- C:\Windows\System\lTzSiqH.exe
  C:\Windows\System\lTzSiqH.exe
  2⤵
  PID:6576
- C:\Windows\System\FJJjcba.exe
  C:\Windows\System\FJJjcba.exe
  2⤵
  PID:1712
- C:\Windows\System\WErZaNn.exe
  C:\Windows\System\WErZaNn.exe
  2⤵
  PID:7016
- C:\Windows\System\bjgyYaz.exe
  C:\Windows\System\bjgyYaz.exe
  2⤵
  PID:6904
- C:\Windows\System\YNQADbE.exe
  C:\Windows\System\YNQADbE.exe
  2⤵
  PID:6032
- C:\Windows\System\vBBJhBz.exe
  C:\Windows\System\vBBJhBz.exe
  2⤵
  PID:6952
- C:\Windows\System\SHKgyCO.exe
  C:\Windows\System\SHKgyCO.exe
  2⤵
  PID:7188
- C:\Windows\System\dTOUkky.exe
  C:\Windows\System\dTOUkky.exe
  2⤵
  PID:7252
- C:\Windows\System\yjBlXYj.exe
  C:\Windows\System\yjBlXYj.exe
  2⤵
  PID:7732
- C:\Windows\System\mYqGRPQ.exe
  C:\Windows\System\mYqGRPQ.exe
  2⤵
  PID:7800
- C:\Windows\System\RFJBGmF.exe
  C:\Windows\System\RFJBGmF.exe
  2⤵
  PID:7868
- C:\Windows\System\nkxzrbJ.exe
  C:\Windows\System\nkxzrbJ.exe
  2⤵
  PID:7936
- C:\Windows\System\nzRwzYK.exe
  C:\Windows\System\nzRwzYK.exe
  2⤵
  PID:8008
- C:\Windows\System\ybHLWTH.exe
  C:\Windows\System\ybHLWTH.exe
  2⤵
  PID:7308
- C:\Windows\System\gvZcrDL.exe
  C:\Windows\System\gvZcrDL.exe
  2⤵
  PID:7372
- C:\Windows\System\FeuiMwe.exe
  C:\Windows\System\FeuiMwe.exe
  2⤵
  PID:7584
- C:\Windows\System\PDPNxhW.exe
  C:\Windows\System\PDPNxhW.exe
  2⤵
  PID:7408
- C:\Windows\System\sqatyKM.exe
  C:\Windows\System\sqatyKM.exe
  2⤵
  PID:7784
- C:\Windows\System\tRSQaCU.exe
  C:\Windows\System\tRSQaCU.exe
  2⤵
  PID:7924
- C:\Windows\System\vCqqizi.exe
  C:\Windows\System\vCqqizi.exe
  2⤵
  PID:7356
- C:\Windows\System\ouBOXnk.exe
  C:\Windows\System\ouBOXnk.exe
  2⤵
  PID:7632
- C:\Windows\System\GtkTfDo.exe
  C:\Windows\System\GtkTfDo.exe
  2⤵
  PID:7292
- C:\Windows\System\PEyXYQw.exe
  C:\Windows\System\PEyXYQw.exe
  2⤵
  PID:6276
- C:\Windows\System\xJfLkCr.exe
  C:\Windows\System\xJfLkCr.exe
  2⤵
  PID:7908
- C:\Windows\System\FrSFrvu.exe
  C:\Windows\System\FrSFrvu.exe
  2⤵
  PID:5420
- C:\Windows\System\jnRSTzo.exe
  C:\Windows\System\jnRSTzo.exe
  2⤵
  PID:7032
- C:\Windows\System\KimjJGx.exe
  C:\Windows\System\KimjJGx.exe
  2⤵
  PID:6772
- C:\Windows\System\BLemELr.exe
  C:\Windows\System\BLemELr.exe
  2⤵
  PID:7248
- C:\Windows\System\qHQviNT.exe
  C:\Windows\System\qHQviNT.exe
  2⤵
  PID:8048
- C:\Windows\System\VXvzXtT.exe
  C:\Windows\System\VXvzXtT.exe
  2⤵
  PID:7180
- C:\Windows\System\hlcBJvI.exe
  C:\Windows\System\hlcBJvI.exe
  2⤵
  PID:7836
- C:\Windows\System\PkXuhBB.exe
  C:\Windows\System\PkXuhBB.exe
  2⤵
  PID:8060
- C:\Windows\System\uNMzDbG.exe
  C:\Windows\System\uNMzDbG.exe
  2⤵
  PID:8080
- C:\Windows\System\kpIByGr.exe
  C:\Windows\System\kpIByGr.exe
  2⤵
  PID:6660
- C:\Windows\System\LYHHaEu.exe
  C:\Windows\System\LYHHaEu.exe
  2⤵
  PID:8164
- C:\Windows\System\YVSUxzF.exe
  C:\Windows\System\YVSUxzF.exe
  2⤵
  PID:6760
- C:\Windows\System\bNKqtrB.exe
  C:\Windows\System\bNKqtrB.exe
  2⤵
  PID:8116
- C:\Windows\System\dgxUTCy.exe
  C:\Windows\System\dgxUTCy.exe
  2⤵
  PID:7236
- C:\Windows\System\uwOFPCN.exe
  C:\Windows\System\uwOFPCN.exe
  2⤵
  PID:7412
- C:\Windows\System\akYcFgx.exe
  C:\Windows\System\akYcFgx.exe
  2⤵
  PID:7480
- C:\Windows\System\uYdSnBS.exe
  C:\Windows\System\uYdSnBS.exe
  2⤵
  PID:8024
- C:\Windows\System\OmrJOfX.exe
  C:\Windows\System\OmrJOfX.exe
  2⤵
  PID:7424
- C:\Windows\System\pdhWMqN.exe
  C:\Windows\System\pdhWMqN.exe
  2⤵
  PID:6676
- C:\Windows\System\WIXpySY.exe
  C:\Windows\System\WIXpySY.exe
  2⤵
  PID:7972
- C:\Windows\System\gTRzoGs.exe
  C:\Windows\System\gTRzoGs.exe
  2⤵
  PID:6884
- C:\Windows\System\WatYptf.exe
  C:\Windows\System\WatYptf.exe
  2⤵
  PID:7876
- C:\Windows\System\qmLtPnr.exe
  C:\Windows\System\qmLtPnr.exe
  2⤵
  PID:7832
- C:\Windows\System\IoIrcFN.exe
  C:\Windows\System\IoIrcFN.exe
  2⤵
  PID:8184
- C:\Windows\System\qkalzPG.exe
  C:\Windows\System\qkalzPG.exe
  2⤵
  PID:7656
- C:\Windows\System\ApNaMvL.exe
  C:\Windows\System\ApNaMvL.exe
  2⤵
  PID:7496
- C:\Windows\System\RJRzEXw.exe
  C:\Windows\System\RJRzEXw.exe
  2⤵
  PID:8120
- C:\Windows\System\NdmxYeU.exe
  C:\Windows\System\NdmxYeU.exe
  2⤵
  PID:7820
- C:\Windows\System\jOtDHKB.exe
  C:\Windows\System\jOtDHKB.exe
  2⤵
  PID:7772
- C:\Windows\System\CNyDRPC.exe
  C:\Windows\System\CNyDRPC.exe
  2⤵
  PID:8132
- C:\Windows\System\MNJipSU.exe
  C:\Windows\System\MNJipSU.exe
  2⤵
  PID:7296
- C:\Windows\System\ZflWiFQ.exe
  C:\Windows\System\ZflWiFQ.exe
  2⤵
  PID:5408
- C:\Windows\System\QzRqlRi.exe
  C:\Windows\System\QzRqlRi.exe
  2⤵
  PID:7516
- C:\Windows\System\xPzKlgB.exe
  C:\Windows\System\xPzKlgB.exe
  2⤵
  PID:8200
- C:\Windows\System\gJCvKeL.exe
  C:\Windows\System\gJCvKeL.exe
  2⤵
  PID:8220
- C:\Windows\System\kRFHfeF.exe
  C:\Windows\System\kRFHfeF.exe
  2⤵
  PID:8236
- C:\Windows\System\qMWzhUV.exe
  C:\Windows\System\qMWzhUV.exe
  2⤵
  PID:8252
- C:\Windows\System\xrFlhGx.exe
  C:\Windows\System\xrFlhGx.exe
  2⤵
  PID:8268
- C:\Windows\System\CrrMPNr.exe
  C:\Windows\System\CrrMPNr.exe
  2⤵
  PID:8284
- C:\Windows\System\jzgKoBk.exe
  C:\Windows\System\jzgKoBk.exe
  2⤵
  PID:8300
- C:\Windows\System\CnZGlVh.exe
  C:\Windows\System\CnZGlVh.exe
  2⤵
  PID:8320
- C:\Windows\System\CqQNdyt.exe
  C:\Windows\System\CqQNdyt.exe
  2⤵
  PID:8336
- C:\Windows\System\ypXsidN.exe
  C:\Windows\System\ypXsidN.exe
  2⤵
  PID:8356
- C:\Windows\System\ukjjvYW.exe
  C:\Windows\System\ukjjvYW.exe
  2⤵
  PID:8372
- C:\Windows\System\gUMJrES.exe
  C:\Windows\System\gUMJrES.exe
  2⤵
  PID:8388
- C:\Windows\System\bGfTSew.exe
  C:\Windows\System\bGfTSew.exe
  2⤵
  PID:8404
- C:\Windows\System\tgWzgVv.exe
  C:\Windows\System\tgWzgVv.exe
  2⤵
  PID:8424
- C:\Windows\System\Etrdfih.exe
  C:\Windows\System\Etrdfih.exe
  2⤵
  PID:8440
- C:\Windows\System\gtnBXjS.exe
  C:\Windows\System\gtnBXjS.exe
  2⤵
  PID:8456
- C:\Windows\System\fxzCPJn.exe
  C:\Windows\System\fxzCPJn.exe
  2⤵
  PID:8472
- C:\Windows\System\LnKztgi.exe
  C:\Windows\System\LnKztgi.exe
  2⤵
  PID:8488
- C:\Windows\System\lzTzAxo.exe
  C:\Windows\System\lzTzAxo.exe
  2⤵
  PID:8504
- C:\Windows\System\WRlHxYU.exe
  C:\Windows\System\WRlHxYU.exe
  2⤵
  PID:8520
- C:\Windows\System\CQJVODI.exe
  C:\Windows\System\CQJVODI.exe
  2⤵
  PID:8536
- C:\Windows\System\KDxCbDS.exe
  C:\Windows\System\KDxCbDS.exe
  2⤵
  PID:8552
- C:\Windows\System\jSjUaCz.exe
  C:\Windows\System\jSjUaCz.exe
  2⤵
  PID:8568
- C:\Windows\System\xcwKMky.exe
  C:\Windows\System\xcwKMky.exe
  2⤵
  PID:8588
- C:\Windows\System\VIsTrDZ.exe
  C:\Windows\System\VIsTrDZ.exe
  2⤵
  PID:8604
- C:\Windows\System\IhfCcEK.exe
  C:\Windows\System\IhfCcEK.exe
  2⤵
  PID:8620
- C:\Windows\System\LOsHsIG.exe
  C:\Windows\System\LOsHsIG.exe
  2⤵
  PID:8640
- C:\Windows\System\KcFPvXg.exe
  C:\Windows\System\KcFPvXg.exe
  2⤵
  PID:8656
- C:\Windows\System\nRVNXcG.exe
  C:\Windows\System\nRVNXcG.exe
  2⤵
  PID:8676
- C:\Windows\System\NFWfTgZ.exe
  C:\Windows\System\NFWfTgZ.exe
  2⤵
  PID:8692
- C:\Windows\System\SochUMF.exe
  C:\Windows\System\SochUMF.exe
  2⤵
  PID:8708
- C:\Windows\System\GkmWZlS.exe
  C:\Windows\System\GkmWZlS.exe
  2⤵
  PID:8728
- C:\Windows\System\PPuytUh.exe
  C:\Windows\System\PPuytUh.exe
  2⤵
  PID:8744
- C:\Windows\System\cgKdHwL.exe
  C:\Windows\System\cgKdHwL.exe
  2⤵
  PID:8760
- C:\Windows\System\joZiHHm.exe
  C:\Windows\System\joZiHHm.exe
  2⤵
  PID:8784
- C:\Windows\System\eCeJnbD.exe
  C:\Windows\System\eCeJnbD.exe
  2⤵
  PID:8800
- C:\Windows\System\rUstIdi.exe
  C:\Windows\System\rUstIdi.exe
  2⤵
  PID:8816
- C:\Windows\System\vmaKAkL.exe
  C:\Windows\System\vmaKAkL.exe
  2⤵
  PID:8832
- C:\Windows\System\XjVADSA.exe
  C:\Windows\System\XjVADSA.exe
  2⤵
  PID:8852
- C:\Windows\System\jfDYktO.exe
  C:\Windows\System\jfDYktO.exe
  2⤵
  PID:8868
- C:\Windows\System\oXCvjfc.exe
  C:\Windows\System\oXCvjfc.exe
  2⤵
  PID:8884
- C:\Windows\System\XMYKwbS.exe
  C:\Windows\System\XMYKwbS.exe
  2⤵
  PID:8904
- C:\Windows\System\eGQvsyt.exe
  C:\Windows\System\eGQvsyt.exe
  2⤵
  PID:8920
- C:\Windows\System\JYEBcUu.exe
  C:\Windows\System\JYEBcUu.exe
  2⤵
  PID:9044
- C:\Windows\System\RhLpsBj.exe
  C:\Windows\System\RhLpsBj.exe
  2⤵
  PID:9064
- C:\Windows\System\dDGYqMf.exe
  C:\Windows\System\dDGYqMf.exe
  2⤵
  PID:9080
- C:\Windows\System\RYosEBt.exe
  C:\Windows\System\RYosEBt.exe
  2⤵
  PID:9096
- C:\Windows\System\yqFBWBR.exe
  C:\Windows\System\yqFBWBR.exe
  2⤵
  PID:9112
- C:\Windows\System\FKSmOBN.exe
  C:\Windows\System\FKSmOBN.exe
  2⤵
  PID:9132
- C:\Windows\System\qjFTyJe.exe
  C:\Windows\System\qjFTyJe.exe
  2⤵
  PID:9148
- C:\Windows\System\NwyLpIR.exe
  C:\Windows\System\NwyLpIR.exe
  2⤵
  PID:9164
- C:\Windows\System\SJsSuBr.exe
  C:\Windows\System\SJsSuBr.exe
  2⤵
  PID:9180
- C:\Windows\System\nhIybMr.exe
  C:\Windows\System\nhIybMr.exe
  2⤵
  PID:9196
- C:\Windows\System\BxVVajM.exe
  C:\Windows\System\BxVVajM.exe
  2⤵
  PID:9212
- C:\Windows\System\kbMPMPY.exe
  C:\Windows\System\kbMPMPY.exe
  2⤵
  PID:8040
- C:\Windows\System\gfNIEiI.exe
  C:\Windows\System\gfNIEiI.exe
  2⤵
  PID:8328
- C:\Windows\System\dFPPdyF.exe
  C:\Windows\System\dFPPdyF.exe
  2⤵
  PID:8248
- C:\Windows\System\prIBgxM.exe
  C:\Windows\System\prIBgxM.exe
  2⤵
  PID:8280
- C:\Windows\System\gFLxRFg.exe
  C:\Windows\System\gFLxRFg.exe
  2⤵
  PID:8308
- C:\Windows\System\ecbGqKt.exe
  C:\Windows\System\ecbGqKt.exe
  2⤵
  PID:8368
- C:\Windows\System\pdnNdJU.exe
  C:\Windows\System\pdnNdJU.exe
  2⤵
  PID:8384
- C:\Windows\System\FbtuYPG.exe
  C:\Windows\System\FbtuYPG.exe
  2⤵
  PID:8448
- C:\Windows\System\eLzzOOj.exe
  C:\Windows\System\eLzzOOj.exe
  2⤵
  PID:8396
- C:\Windows\System\wwNxPBK.exe
  C:\Windows\System\wwNxPBK.exe
  2⤵
  PID:8464
- C:\Windows\System\jqajuVZ.exe
  C:\Windows\System\jqajuVZ.exe
  2⤵
  PID:8516
- C:\Windows\System\CvpwHmp.exe
  C:\Windows\System\CvpwHmp.exe
  2⤵
  PID:8528
- C:\Windows\System\fceoYOr.exe
  C:\Windows\System\fceoYOr.exe
  2⤵
  PID:8600
- C:\Windows\System\BpgNnEi.exe
  C:\Windows\System\BpgNnEi.exe
  2⤵
  PID:8668
- C:\Windows\System\PqgwUym.exe
  C:\Windows\System\PqgwUym.exe
  2⤵
  PID:8700
- C:\Windows\System\hnHioqh.exe
  C:\Windows\System\hnHioqh.exe
  2⤵
  PID:8768
- C:\Windows\System\FMEGVhe.exe
  C:\Windows\System\FMEGVhe.exe
  2⤵
  PID:8648
- C:\Windows\System\Hphocjb.exe
  C:\Windows\System\Hphocjb.exe
  2⤵
  PID:8580
- C:\Windows\System\CNjbARn.exe
  C:\Windows\System\CNjbARn.exe
  2⤵
  PID:8688
- C:\Windows\System\rDJbeHL.exe
  C:\Windows\System\rDJbeHL.exe
  2⤵
  PID:8756
- C:\Windows\System\iZBFtUS.exe
  C:\Windows\System\iZBFtUS.exe
  2⤵
  PID:8780
- C:\Windows\System\MPldpZK.exe
  C:\Windows\System\MPldpZK.exe
  2⤵
  PID:8864
- C:\Windows\System\JzYnrSR.exe
  C:\Windows\System\JzYnrSR.exe
  2⤵
  PID:8848
- C:\Windows\System\GkVeItq.exe
  C:\Windows\System\GkVeItq.exe
  2⤵
  PID:8912
- C:\Windows\System\VvEdTUJ.exe
  C:\Windows\System\VvEdTUJ.exe
  2⤵
  PID:8928
- C:\Windows\System\mAPTacO.exe
  C:\Windows\System\mAPTacO.exe
  2⤵
  PID:8944
- C:\Windows\System\IxQphwQ.exe
  C:\Windows\System\IxQphwQ.exe
  2⤵
  PID:8960
- C:\Windows\System\rCtWmxG.exe
  C:\Windows\System\rCtWmxG.exe
  2⤵
  PID:8976
- C:\Windows\System\thrOduU.exe
  C:\Windows\System\thrOduU.exe
  2⤵
  PID:8988
- C:\Windows\System\wBcaolU.exe
  C:\Windows\System\wBcaolU.exe
  2⤵
  PID:9008
- C:\Windows\System\EGZnqdm.exe
  C:\Windows\System\EGZnqdm.exe
  2⤵
  PID:9024
- C:\Windows\System\fONgZgz.exe
  C:\Windows\System\fONgZgz.exe
  2⤵
  PID:9032
- C:\Windows\System\AstasUF.exe
  C:\Windows\System\AstasUF.exe
  2⤵
  PID:9088
- C:\Windows\System\DdQNvjW.exe
  C:\Windows\System\DdQNvjW.exe
  2⤵
  PID:9128
- C:\Windows\System\OVpkQJb.exe
  C:\Windows\System\OVpkQJb.exe
  2⤵
  PID:9108
- C:\Windows\System\RVTpOZI.exe
  C:\Windows\System\RVTpOZI.exe
  2⤵
  PID:9144
- C:\Windows\System\EqguMMP.exe
  C:\Windows\System\EqguMMP.exe
  2⤵
  PID:9204
- C:\Windows\System\MJZjxjT.exe
  C:\Windows\System\MJZjxjT.exe
  2⤵
  PID:7156
- C:\Windows\System\lZQuHnk.exe
  C:\Windows\System\lZQuHnk.exe
  2⤵
  PID:8196
- C:\Windows\System\xFLTksw.exe
  C:\Windows\System\xFLTksw.exe
  2⤵
  PID:8276
- C:\Windows\System\zJmeBXh.exe
  C:\Windows\System\zJmeBXh.exe
  2⤵
  PID:8316
- C:\Windows\System\FmRwaeS.exe
  C:\Windows\System\FmRwaeS.exe
  2⤵
  PID:8416
- C:\Windows\System\VabtYeB.exe
  C:\Windows\System\VabtYeB.exe
  2⤵
  PID:8564
- C:\Windows\System\AqUFfYp.exe
  C:\Windows\System\AqUFfYp.exe
  2⤵
  PID:8436
- C:\Windows\System\CJTwqaS.exe
  C:\Windows\System\CJTwqaS.exe
  2⤵
  PID:8632
- C:\Windows\System\YstPxPp.exe
  C:\Windows\System\YstPxPp.exe
  2⤵
  PID:8772
- C:\Windows\System\SuECsAN.exe
  C:\Windows\System\SuECsAN.exe
  2⤵
  PID:8796
- C:\Windows\System\YFDhcnN.exe
  C:\Windows\System\YFDhcnN.exe
  2⤵
  PID:8808
- C:\Windows\System\rgqGmDZ.exe
  C:\Windows\System\rgqGmDZ.exe
  2⤵
  PID:8896
- C:\Windows\System\FHAikHK.exe
  C:\Windows\System\FHAikHK.exe
  2⤵
  PID:8940
- C:\Windows\System\fwBhWtO.exe
  C:\Windows\System\fwBhWtO.exe
  2⤵
  PID:8972
- C:\Windows\System\RMDblIy.exe
  C:\Windows\System\RMDblIy.exe
  2⤵
  PID:9040
- C:\Windows\System\RbBsVkB.exe
  C:\Windows\System\RbBsVkB.exe
  2⤵
  PID:9052
- C:\Windows\System\WOCDIaB.exe
  C:\Windows\System\WOCDIaB.exe
  2⤵
  PID:8136
- C:\Windows\System\JnrkUWU.exe
  C:\Windows\System\JnrkUWU.exe
  2⤵
  PID:9160
- C:\Windows\System\KYJniuI.exe
  C:\Windows\System\KYJniuI.exe
  2⤵
  PID:8264
- C:\Windows\System\WqRAAKu.exe
  C:\Windows\System\WqRAAKu.exe
  2⤵
  PID:7700
- C:\Windows\System\XVBWBYU.exe
  C:\Windows\System\XVBWBYU.exe
  2⤵
  PID:8052
- C:\Windows\System\YdhnkkV.exe
  C:\Windows\System\YdhnkkV.exe
  2⤵
  PID:8352
- C:\Windows\System\YGfdAnf.exe
  C:\Windows\System\YGfdAnf.exe
  2⤵
  PID:8432
- C:\Windows\System\CmreQfr.exe
  C:\Windows\System\CmreQfr.exe
  2⤵
  PID:8948
- C:\Windows\System\oLcdtkM.exe
  C:\Windows\System\oLcdtkM.exe
  2⤵
  PID:6656
- C:\Windows\System\xVFJdKi.exe
  C:\Windows\System\xVFJdKi.exe
  2⤵
  PID:8704
- C:\Windows\System\kfrtaBg.exe
  C:\Windows\System\kfrtaBg.exe
  2⤵
  PID:8672
- C:\Windows\System\HZDfiVO.exe
  C:\Windows\System\HZDfiVO.exe
  2⤵
  PID:9176
- C:\Windows\System\XjlEoYa.exe
  C:\Windows\System\XjlEoYa.exe
  2⤵
  PID:9020
- C:\Windows\System\VzsgMyx.exe
  C:\Windows\System\VzsgMyx.exe
  2⤵
  PID:8232
- C:\Windows\System\OOgVjUN.exe
  C:\Windows\System\OOgVjUN.exe
  2⤵
  PID:8296
- C:\Windows\System\LdKqduR.exe
  C:\Windows\System\LdKqduR.exe
  2⤵
  PID:8664
- C:\Windows\System\JkWobLC.exe
  C:\Windows\System\JkWobLC.exe
  2⤵
  PID:8720
- C:\Windows\System\quRoICG.exe
  C:\Windows\System\quRoICG.exe
  2⤵
  PID:9228
- C:\Windows\System\ZsGxFCy.exe
  C:\Windows\System\ZsGxFCy.exe
  2⤵
  PID:9252
- C:\Windows\System\iZBsErx.exe
  C:\Windows\System\iZBsErx.exe
  2⤵
  PID:9268
- C:\Windows\System\ROqCEXz.exe
  C:\Windows\System\ROqCEXz.exe
  2⤵
  PID:9284
- C:\Windows\System\zMRoPDw.exe
  C:\Windows\System\zMRoPDw.exe
  2⤵
  PID:9300
- C:\Windows\System\shKTTnb.exe
  C:\Windows\System\shKTTnb.exe
  2⤵
  PID:9316
- C:\Windows\System\nDkvAkw.exe
  C:\Windows\System\nDkvAkw.exe
  2⤵
  PID:9392
- C:\Windows\System\vIHjymx.exe
  C:\Windows\System\vIHjymx.exe
  2⤵
  PID:9408
- C:\Windows\System\PqMxNsg.exe
  C:\Windows\System\PqMxNsg.exe
  2⤵
  PID:9424
- C:\Windows\System\nVXwHFe.exe
  C:\Windows\System\nVXwHFe.exe
  2⤵
  PID:9440
- C:\Windows\System\FUIFrXG.exe
  C:\Windows\System\FUIFrXG.exe
  2⤵
  PID:9456
- C:\Windows\System\WinDtwh.exe
  C:\Windows\System\WinDtwh.exe
  2⤵
  PID:9472
- C:\Windows\System\dDGdDea.exe
  C:\Windows\System\dDGdDea.exe
  2⤵
  PID:9488
- C:\Windows\System\xOxhJDR.exe
  C:\Windows\System\xOxhJDR.exe
  2⤵
  PID:9564
- C:\Windows\System\IyAkmXF.exe
  C:\Windows\System\IyAkmXF.exe
  2⤵
  PID:9580
- C:\Windows\System\HElabro.exe
  C:\Windows\System\HElabro.exe
  2⤵
  PID:9596
- C:\Windows\System\chrMvBm.exe
  C:\Windows\System\chrMvBm.exe
  2⤵
  PID:9612
- C:\Windows\System\zPFQkuE.exe
  C:\Windows\System\zPFQkuE.exe
  2⤵
  PID:9628
- C:\Windows\System\GaRJAUU.exe
  C:\Windows\System\GaRJAUU.exe
  2⤵
  PID:9644
- C:\Windows\System\hfBSYEF.exe
  C:\Windows\System\hfBSYEF.exe
  2⤵
  PID:9660
- C:\Windows\System\EnRMxDr.exe
  C:\Windows\System\EnRMxDr.exe
  2⤵
  PID:9676
- C:\Windows\System\ohLTLNr.exe
  C:\Windows\System\ohLTLNr.exe
  2⤵
  PID:9692
- C:\Windows\System\qBFatpX.exe
  C:\Windows\System\qBFatpX.exe
  2⤵
  PID:9708
- C:\Windows\System\hbwoUfT.exe
  C:\Windows\System\hbwoUfT.exe
  2⤵
  PID:9724
- C:\Windows\System\jEPECuX.exe
  C:\Windows\System\jEPECuX.exe
  2⤵
  PID:9752
- C:\Windows\System\vfROQFC.exe
  C:\Windows\System\vfROQFC.exe
  2⤵
  PID:9776
- C:\Windows\System\NhjkgSq.exe
  C:\Windows\System\NhjkgSq.exe
  2⤵
  PID:9972
- C:\Windows\System\jPtmckD.exe
  C:\Windows\System\jPtmckD.exe
  2⤵
  PID:9988
- C:\Windows\System\eAvwLTQ.exe
  C:\Windows\System\eAvwLTQ.exe
  2⤵
  PID:10004
- C:\Windows\System\DtoSPYm.exe
  C:\Windows\System\DtoSPYm.exe
  2⤵
  PID:10024
- C:\Windows\System\KvKqAzX.exe
  C:\Windows\System\KvKqAzX.exe
  2⤵
  PID:10048
- C:\Windows\System\sBmokAz.exe
  C:\Windows\System\sBmokAz.exe
  2⤵
  PID:10064
- C:\Windows\System\YWGkWBa.exe
  C:\Windows\System\YWGkWBa.exe
  2⤵
  PID:10080
- C:\Windows\System\NfbyJJZ.exe
  C:\Windows\System\NfbyJJZ.exe
  2⤵
  PID:10096
- C:\Windows\System\DEEHAqb.exe
  C:\Windows\System\DEEHAqb.exe
  2⤵
  PID:10112
- C:\Windows\System\UEdvTyv.exe
  C:\Windows\System\UEdvTyv.exe
  2⤵
  PID:10128
- C:\Windows\System\fXQooEq.exe
  C:\Windows\System\fXQooEq.exe
  2⤵
  PID:10144
- C:\Windows\System\dIQeCHT.exe
  C:\Windows\System\dIQeCHT.exe
  2⤵
  PID:10160
- C:\Windows\System\uCiMXYB.exe
  C:\Windows\System\uCiMXYB.exe
  2⤵
  PID:10180
- C:\Windows\System\KcLJkiF.exe
  C:\Windows\System\KcLJkiF.exe
  2⤵
  PID:10200
- C:\Windows\System\mAFYbSh.exe
  C:\Windows\System\mAFYbSh.exe
  2⤵
  PID:10216
- C:\Windows\System\krVlVtg.exe
  C:\Windows\System\krVlVtg.exe
  2⤵
  PID:10232
- C:\Windows\System\xnEouFd.exe
  C:\Windows\System\xnEouFd.exe
  2⤵
  PID:9036
- C:\Windows\System\UTXaniu.exe
  C:\Windows\System\UTXaniu.exe
  2⤵
  PID:8548
- C:\Windows\System\KHcTWYX.exe
  C:\Windows\System\KHcTWYX.exe
  2⤵
  PID:9296
- C:\Windows\System\EFUFCsv.exe
  C:\Windows\System\EFUFCsv.exe
  2⤵
  PID:9308
- C:\Windows\System\NlfSKcY.exe
  C:\Windows\System\NlfSKcY.exe
  2⤵
  PID:9336
- C:\Windows\System\vmxVJEa.exe
  C:\Windows\System\vmxVJEa.exe
  2⤵
  PID:9348
- C:\Windows\System\WdJQYyB.exe
  C:\Windows\System\WdJQYyB.exe
  2⤵
  PID:9368
- C:\Windows\System\GolFidu.exe
  C:\Windows\System\GolFidu.exe
  2⤵
  PID:9388
- C:\Windows\System\GrmQOTC.exe
  C:\Windows\System\GrmQOTC.exe
  2⤵
  PID:9464
- C:\Windows\System\dJmoipw.exe
  C:\Windows\System\dJmoipw.exe
  2⤵
  PID:9504
- C:\Windows\System\qnMsOsL.exe
  C:\Windows\System\qnMsOsL.exe
  2⤵
  PID:9520
- C:\Windows\System\XawIgQQ.exe
  C:\Windows\System\XawIgQQ.exe
  2⤵
  PID:9536
- C:\Windows\System\bjiLFaQ.exe
  C:\Windows\System\bjiLFaQ.exe
  2⤵
  PID:9416
- C:\Windows\System\YOUnyQw.exe
  C:\Windows\System\YOUnyQw.exe
  2⤵
  PID:9484
- C:\Windows\System\ZyAPFqC.exe
  C:\Windows\System\ZyAPFqC.exe
  2⤵
  PID:9588
- C:\Windows\System\djJUzie.exe
  C:\Windows\System\djJUzie.exe
  2⤵
  PID:9608
- C:\Windows\System\RxHaUsa.exe
  C:\Windows\System\RxHaUsa.exe
  2⤵
  PID:9652
- C:\Windows\System\IvgRPcI.exe
  C:\Windows\System\IvgRPcI.exe
  2⤵
  PID:9748
- C:\Windows\System\sEeoPTL.exe
  C:\Windows\System\sEeoPTL.exe
  2⤵
  PID:9840
- C:\Windows\System\oFnzlLB.exe
  C:\Windows\System\oFnzlLB.exe
  2⤵
  PID:9852
- C:\Windows\System\byjBBqy.exe
  C:\Windows\System\byjBBqy.exe
  2⤵
  PID:9868
- C:\Windows\System\IPYCYQu.exe
  C:\Windows\System\IPYCYQu.exe
  2⤵
  PID:9876
- C:\Windows\System\XvKdfJQ.exe
  C:\Windows\System\XvKdfJQ.exe
  2⤵
  PID:9900
- C:\Windows\System\cvXJgpM.exe
  C:\Windows\System\cvXJgpM.exe
  2⤵
  PID:9912
- C:\Windows\System\JyvRzsU.exe
  C:\Windows\System\JyvRzsU.exe
  2⤵
  PID:9928
- C:\Windows\System\ztOgUUT.exe
  C:\Windows\System\ztOgUUT.exe
  2⤵
  PID:9948
- C:\Windows\System\udERqiU.exe
  C:\Windows\System\udERqiU.exe
  2⤵
  PID:9964
- C:\Windows\System\kYlLqgx.exe
  C:\Windows\System\kYlLqgx.exe
  2⤵
  PID:10032
- C:\Windows\System\MnhzbhO.exe
  C:\Windows\System\MnhzbhO.exe
  2⤵
  PID:10072
- C:\Windows\System\FtiURwa.exe
  C:\Windows\System\FtiURwa.exe
  2⤵
  PID:9984
- C:\Windows\System\jDDYSlt.exe
  C:\Windows\System\jDDYSlt.exe
  2⤵
  PID:10172
- C:\Windows\System\ZWjpugA.exe
  C:\Windows\System\ZWjpugA.exe
  2⤵
  PID:10212
- C:\Windows\System\pnHRdZV.exe
  C:\Windows\System\pnHRdZV.exe
  2⤵
  PID:8968
- C:\Windows\System\VpDgSfP.exe
  C:\Windows\System\VpDgSfP.exe
  2⤵
  PID:8208
- C:\Windows\System\bIJWYzE.exe
  C:\Windows\System\bIJWYzE.exe
  2⤵
  PID:10120
- C:\Windows\System\dFLMcyT.exe
  C:\Windows\System\dFLMcyT.exe
  2⤵
  PID:10188
- C:\Windows\System\ztOiCdZ.exe
  C:\Windows\System\ztOiCdZ.exe
  2⤵
  PID:10224
- C:\Windows\System\NQGuDto.exe
  C:\Windows\System\NQGuDto.exe
  2⤵
  PID:8840
- C:\Windows\System\sfsbuWo.exe
  C:\Windows\System\sfsbuWo.exe
  2⤵
  PID:9140
- C:\Windows\System\TQBeJfL.exe
  C:\Windows\System\TQBeJfL.exe
  2⤵
  PID:9236
- C:\Windows\System\Gxiwewo.exe
  C:\Windows\System\Gxiwewo.exe
  2⤵
  PID:9244
- C:\Windows\System\STCHQnh.exe
  C:\Windows\System\STCHQnh.exe
  2⤵
  PID:9260
- C:\Windows\System\foyzabc.exe
  C:\Windows\System\foyzabc.exe
  2⤵
  PID:9332
- C:\Windows\System\ypfRnLg.exe
  C:\Windows\System\ypfRnLg.exe
  2⤵
  PID:9432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AiveDgJ.exe

Filesize
1.9MB

MD5
3b1a2f11c8c7a980a5e05a83d92e5704

SHA1
d73d4e66381e5b659e11d879710e8bc8bb3ee2b0

SHA256
e053458fce7e37a33e8cc9e78db27f7135c4c6261de95e797de71de1bab2318a

SHA512
040cf9f85e3a4b235bb2874ce0dd44188e2c4fe537210147e42027472c8ff9eb4359924d2bd07a0af52afcedd45d55a97ed728b4368602940800cdcea58b9e07

Download Submit
C:\Windows\system\AksoaHC.exe

Filesize
1.9MB

MD5
16c8f85dcff96f7924db66435e5abd8b

SHA1
158b24c69e88f871a5d179b1a6b3c2166da3cfd6

SHA256
d4c826dfb553766245baead95cc88ceebae930906f735ceddf930f419082562d

SHA512
a7dead3f173b0e631e56c9e251798c393f4473cd3baaeacdd639c9d257a8db11bb0b9411edc2a4d62c4f34b1f569892487aa7267e7de57c047069baec6fe14a6

Download Submit
C:\Windows\system\CwoyRBv.exe

Filesize
1.9MB

MD5
d640d3e13973d3c1bcea4c7b6ac7e921

SHA1
300147cf3f59f5037d71bbd648278e3b54fb235d

SHA256
9307820e669bfebc0adacacd29eddc41666e3a04043e19322dd7a38a98262c4d

SHA512
4b99dccd845f2190b73ef89d3fddf2a558092093944384d1b5a6da47646efee1e5860ea2f8abb6d6fe838253d32eb0627cdbe4c0dbd888d8a7b3b0a204457365

Download Submit
C:\Windows\system\EIHkXOG.exe

Filesize
1.9MB

MD5
b21bdf52b3b4acadbd9baeba72e114a6

SHA1
8738e497142bada63f24aa9cd2b7fe8fd3066ddd

SHA256
a9a3b697e62c4a41414ccae1781f0140f34b9a46288be4da3b39e57bb8ae462d

SHA512
c384e50bce9316b1c79b314512e1a8e7979597705faf69e768ac76842b86565fc9fb020951a1aaa0b615990bdd7cc12d4da9d3cfe0fc7e83f350ca600e1adef9

Download Submit
C:\Windows\system\PlEtjAx.exe

Filesize
1.9MB

MD5
25b57554106e2f8e0bca661f806e191f

SHA1
f51afccfd7bd4be30a5909d33221aec23280de1c

SHA256
9fbd844695d9fa3f467c38d3cb2fe7df642db92efb44250e67acdc36c4b14998

SHA512
8d12117d0542daca48830bed5504d17ffd0cded5f98f2ab645c531ef00d8e0733e2faec4e67a709f44b74df913d74fd656fac843586c4b6c8ccfc52ced3f91a6

Download Submit
C:\Windows\system\UbhVcvg.exe

Filesize
1.9MB

MD5
82e2faaa164ac1d9032c3ebbd83de839

SHA1
29c8e5e8db4eea7d9696ecfcbad980c25be46577

SHA256
70e61862d530703706b1b67ba8a85381af3b24fa5e88173791c8db25d78774ed

SHA512
f486d5d3564ef74feebc5757b82a0847ff850485f0f568dd682f473d38dd1e87f959bac3f30378d5931c8a37ed2b116fcc06edf8b3bc34940ab3ff7d23714087

Download Submit
C:\Windows\system\UxMzXxv.exe

Filesize
1.9MB

MD5
d2267ca6095f39b9727d84e08b540c76

SHA1
651f95e2dd642d5a32dfa3890df924bce91eb043

SHA256
12ce5aa73d8b25cd1f2c0fe2dea8d6f888b1a3b3a6621d606b60dd75dfe83528

SHA512
67b6d291f391f1c8ac775221bd74734a71e51d88a5acfa8152a41f7920a3134fa168954475a07b4c26c9e12a51a7136380b4a7af2bb885af746e97dd84a06142

Download Submit
C:\Windows\system\XzzMNAg.exe

Filesize
1.9MB

MD5
ee703b2d8112ea9e2fe0a928616c9251

SHA1
d4dd14c1c25d40b04e019df7ee24ef4d1ddcbbf4

SHA256
6a2eb9283aa21934e5aae07ab9e1c0540ff8a8105f5330f3ab38048befbeabd8

SHA512
42920f8b398dd5e5c55be90405134a9840747b7973fdca99680008022613315c1b218d507ca17d7f13c5959f3976e3b96c7faa1979f859431aeedb1074b8558c

Download Submit
C:\Windows\system\YJqvNHv.exe

Filesize
1.9MB

MD5
893a78811a5e905859467a66f3db96b3

SHA1
b576b1cf0cbe7d26edf03cb1e922b9e89e4c8e91

SHA256
3799a2fbc68906fe18e5379adb966329ea58de59d53a76fad05f5d477ddc6e3f

SHA512
742b0849853cf00371cfb56e0cdba95882de9b56d21eeccc39b98cb919ebca17709cdb268dde0995db9b5adfdc2e86b756aaa03bc20501a58549f41c55a6f4a0

Download Submit
C:\Windows\system\YcWkrHD.exe

Filesize
1.9MB

MD5
338c5b3dc4f8a582a798959e2fcfaef8

SHA1
60c949ea2f25558fdbfb6eb67f26e6bd2a68281b

SHA256
041f96801b62721a76bba5a55ac52ee590a7b0c88eca7939f3a6181c175a48fc

SHA512
6c15fc6171f7cc6681df229c1eb5026b7ceb00d84a478fb91c653e073db7be40fdd0503390514a1f7b549b8cafe2031a72387530fa4cbb0b0d49ce110c092b2e

Download Submit
C:\Windows\system\elDSSUA.exe

Filesize
1.9MB

MD5
01496f06e745cdce215c58872d39db93

SHA1
32cb4bbfd3e96322c455d710b76b1dc01f449731

SHA256
be7d139ca045613bbb5d1fb7d31f64ec647119ca9366aa0c8d50d08d8e398095

SHA512
8669c641b831a5f2efa17a38a5374413f70a7c3fb62e14a3fcb72d997730e6157e1c9089bcb7c2ea822a0481b1f627ad4c9931d700164839899e96893631ef06

Download Submit
C:\Windows\system\flUIOzG.exe

Filesize
1.9MB

MD5
82ed90d5f88296271599d42ee394a9c9

SHA1
8d67fe297224376804c2b464667bf54ec92ac243

SHA256
229b5306e07422999a5f326883b1625e7aa90b2a86b2ecb43ff4e8ac48a23959

SHA512
3765661966790a192a1425c7f2608ae8b334ee54a56e38501aa047c3a6a0a11458a9992e0eb09d90d591bd3d7cf3023692275850d3c419a7f0764edf05496fa9

Download Submit
C:\Windows\system\hDIkFqV.exe

Filesize
1.9MB

MD5
ed8e3d9c7c3f71ac70a9eb5994b5ea8c

SHA1
75189667f3926e87d1a1f3fa27130a36c8a0922e

SHA256
eb6f16452dddb9750ab1debcd86eaa5ffc8f6222e39ee87c50d41dc90a1edf7a

SHA512
f7df06d852765da63aa1d01ad7774875abf64506df151ca931019eb5044886fe73dafe3b55c602f6d1a6a6b9e0a5a555aa113f5bf503a12c2d51753cc6d79be9

Download Submit
C:\Windows\system\jyPdGjR.exe

Filesize
1.9MB

MD5
d7b90faa314f68d30c810daee284bd4b

SHA1
83889f80c1291e59e533720e0bccaa2aa36fd391

SHA256
75a4f5c9b5b654d4f6e4c6e3b4e1e3050d429fcf15e5ab3f9803f68c8d904e59

SHA512
6dae964ec081088958c4f445035039407eba8ea38fe764e1928b85c5daa807c32c75f17e5ac945f0d9791f620716064cb6f00a0605022892ee4154d8973be20e

Download Submit
C:\Windows\system\kBdaItV.exe

Filesize
1.9MB

MD5
cf3a9d7f25776a650ee1390d3dfebafb

SHA1
33449e7e332b1dae358a2f9ab83fa841a559a286

SHA256
45fbbd35d06f31bd872dec35c7baf737640fe32c7528ce8dbfbf5d1d7c4e001f

SHA512
3b868bec0374f563cdec06a10f47975597ba7c0847cf2fd781f866d5ecb450b3bb805a8a13c80c65c5431094e532ceaf40e255f8bd8db91603e898d02f411b0c

Download Submit
C:\Windows\system\nJEzxIo.exe

Filesize
1.9MB

MD5
5b958301c95f82ed2e1fe9021153abad

SHA1
ea7214b88f6b9a11ba20cf6665eae8cef53d1485

SHA256
57e02c131834735c4cc84456096c79ee1f1e9ff1ba2da06a1225e4fdf87b5ccf

SHA512
ef613fd1868890a4d62f00c07795e02dee2b3d6da792bcfa58f880eca21ee691f4a75e2220d326db580414fb566cf75ed9fc87e53ec054e688267be4b5550bbe

Download Submit
C:\Windows\system\nbvEPxt.exe

Filesize
1.9MB

MD5
8f193529b2523c1bfa6119dd27521106

SHA1
839997335f9341984dc68ca6325a0214a547ae5d

SHA256
b5eb079ddbf419caf6621c04b0ae1e893ebca67faf368ace356d6e2c9e7ad3cd

SHA512
f8f6e99d78f2f062ea5e99ccf25608aeab22f402a48c97ef2ca31b42489a0c9f3824a32f73e951fe5742785e50e0f6574753ae9bc45d2da4ebeaae328f02f498

Download Submit
C:\Windows\system\oSHONHq.exe

Filesize
1.9MB

MD5
b86474cfb98d48a9c6a7042d54be7497

SHA1
1c8e2ff4fc63843961ea0ee2264b8ede62730f10

SHA256
093f07aa653e7394b73ccfa68504f4d4c5dd8e820bc4abc9e35b6e575f54bbe1

SHA512
b53fde72918b59eff9936b2631df95c209e3256002bb7102483cb841f3e9a30bce89933926c375b42f429539cd2be10f08824b2d2ad8999d62a6862fc29a988a

Download Submit
C:\Windows\system\pEBqOyQ.exe

Filesize
1.9MB

MD5
d1169984fcf454f6e7e23e7dba06a189

SHA1
31613afcb91bf06955ec63e882b228096580b9c9

SHA256
b65c331fc16873cfbd1cb90da9109b7d0a71ff7710387bef90ac70866e4d0d9d

SHA512
faf542250534953d357b25acd25705731a6ae2b4db759864835d40bc935dc591c38040d476213ee97dfa0dae2a0b6c12a145ca3997121f6787a3801709ad2c19

Download Submit
C:\Windows\system\rlyVECc.exe

Filesize
1.9MB

MD5
801d1083c2efb5a3d320ede5a6376289

SHA1
946bcd5dbe6ac12533d4a9566d7914f2b047a98b

SHA256
6a55983eb2e47e73ca0aa66f41cd3482b26cca36ff065122aa2389a3a841417e

SHA512
f716bd397137b459de80414cca582b34f5e0d215a7c9a14dd5e0b7eea91d523a353ec820d49bd84fdda9f3376b221fa5d52d4575fa1994f13190633f248208a9

Download Submit
C:\Windows\system\tTDoRBJ.exe

Filesize
1.9MB

MD5
8b6625274d0603a11fa4a8f67c5d1f95

SHA1
ab5dd900d65b4c9d5a3acb307cb7edbde2a5c704

SHA256
ba4a78f2bfc2a28fccc20f5a70750af67ccc61619bedb55594793751cb310899

SHA512
b43149dd83efda14f112d514301cbf6d73e177f5cafeb88975870ecb4e759714a24c5ab787814b119484189eb47eef32075c97afc60950cf66831ce2f55651bb

Download Submit
C:\Windows\system\veNaOdv.exe

Filesize
1.9MB

MD5
61b9565a5322e2b823fdce08a983eada

SHA1
f5aa4629e3f065e743d18f88936ed06311e6f2bd

SHA256
d7bb65d91eb58cf6f000b919d4b15ee48014815ac663d9b1027ba01c1eb8e3cd

SHA512
c2f52976ed3cd7ed2fb4072b1f63c8e3f12f586ea7eb6cee505be5ac047be0332b1db6bce5cfc3d037ea8c44305445fe6b63e9a4b92fa4b46d5b4f9f300274e6

Download Submit
C:\Windows\system\vfxCTRq.exe

Filesize
1.9MB

MD5
54e80d05f44cba5cc5e71268d72b9b8c

SHA1
5f0d76ce8ff32b99e25315d80fa3c127eb3b6da4

SHA256
55d833187f0c4eb78db71a423981abbbb0ee652571b04fbce60141632c425f80

SHA512
3d714f6148dd6e2643aa7b20c6b508fc1e992c4602a60ea46e33978b5efcceca6d2d679b823ee84d3c42f268da4c65ad208f0b69b665f168de1e2733b0b539a0

Download Submit
C:\Windows\system\wwALKjB.exe

Filesize
1.9MB

MD5
54c1d047798f418543fff27d6ca8431f

SHA1
ec2a7ed2dc898e930d4af4635142a4ef289f3257

SHA256
d25518e1628b851e7c6875b77ee55f8cc1ea6cf39a5627ab556d4311fcfc20b2

SHA512
17ce37c9de891d730547eedb70e78615998aafb2f6115ac3bf1fb9e216e8efbd31d76a974b8dd31c4d1db38f163ecd6ed81896e6c8322916a6e829b29efc9333

Download Submit
C:\Windows\system\xnNBpfL.exe

Filesize
1.9MB

MD5
dc8090988b36070e42189ef1ab4ce340

SHA1
c8e06e7087aff1f59f78de45296efa164b361348

SHA256
c5d8daf044959c15f0511f188d906f845e36e81817c93bfcbaf0df95fcb26a41

SHA512
7f459e5a75a9583ee44cc031dec8794d77c7a383004742f0c01520383d8b27b0e056158884a3b339ee6b5f3aa5c34b615f56b7d5429e5d1ab4c885f9b92f023b

Download Submit
C:\Windows\system\yGumcCG.exe

Filesize
1.9MB

MD5
8b35fe14e48d2b18753415c6792d3a36

SHA1
fc700cc756bdc199c4241055fcd18c1de38045a3

SHA256
02de392e059205628d26ac6730db67c76d503bc1dd8e2793b80c24566c9c4a78

SHA512
ff1722569aa120714a80871301c8517d73a94823da3e349f11f0bbff4f02303560bf1b20f19d704165e35a771c15b6f288f42f59b63e4400cff3c83413d46ee7

Download Submit
\Windows\system\BWDuDdD.exe

Filesize
1.9MB

MD5
8ca2a464edba3a7dfb66fb5dd698994d

SHA1
3d717f91e95b33d31d772eef07a4400db2d9518b

SHA256
8238b407224b16ede319216bf73b46d21c6cc6688aa7435e97a1f27e22a26940

SHA512
f300749449d9471e382125ccb73197b0dfc949a1f365ce53335b32f1be7b7636271c0d759ca4169f7ed7d6663b5a024302632695b2cb3b39730c52aca107660a

Download Submit
\Windows\system\HUdKFQN.exe

Filesize
1.9MB

MD5
732ae81db5a5a71e1a2b2d29007d1f65

SHA1
ed871b5334faa86091082973e2f580c554df4253

SHA256
836b4035259f359d50b20d1b3648897549c150d26e834e41e258631fb79255fb

SHA512
e3f18d8af71afc4d3df62bdf539a32236793887d2be2bb961ecc57fd8a345c728c37eecb4db8292b48daff5361cf5b48420bf8d35fe6e4f90ca5a6ec20f3d6cf

Download Submit
\Windows\system\PJKuIBq.exe

Filesize
1.9MB

MD5
2b158f6eb3da8852e28fde494cd00835

SHA1
7ac7c8e410592249f1265ed11e21bd9cfa0bb9c4

SHA256
38ab25ebc00cb4eeaebde4052c597c823360cce9aabd582d3a5a9de8062b36aa

SHA512
e66547aac6b2fac25348cba315f4be5b70014b7a7038bac901d925e7a447edf00cc360354aef949bcc0b5ec8212fab604ba991eda069f0e7231e361faeb99500

Download Submit
\Windows\system\SQPgeiS.exe

Filesize
1.9MB

MD5
ea7ed14f22247e42ad903558c9431a26

SHA1
468cb3af4d1695a70fbf9a90b3839bcde96c852b

SHA256
d995471c334f1564c9d468614d87f7ab3d27ef21d2149921268e32a6e7978c74

SHA512
cbb7d0130c197f5becb5493ab2477017a9dcf78999462aec4d2b843b6302e796c318d923234c1a09089e5929ddf272217b308a8438905ed223b0567d8d93854f

Download Submit
\Windows\system\wPwReMB.exe

Filesize
1.9MB

MD5
3ab490d9298ce196f684722fd85247b8

SHA1
e3de33a5977d1d6e61d90d490e2e93aa1e9c42da

SHA256
67c4682e7cb4fef415db1b7f84bab7b5ae55fbaebc5e8311e53023d0f8e00ba0

SHA512
42b4b57d234748cf55e706cb768452a137042913fbce70f2624e24df27fbfd52449c629cfe19a8ff6a62014a32c9f5eb193387448e2f9f9a6ff93b0d6d158645

Download Submit
\Windows\system\xpCtkum.exe

Filesize
1.9MB

MD5
a8ebe2f39081ae3abf85efc8f7698695

SHA1
50bf7e5276f3acbd0bb23d5ab1e412f9dc91e963

SHA256
fca52d3f3e0059277478e21fc3f88118f3f667bafb8819113c160376b8422fbf

SHA512
9a45565863444d9f003db5b974ee080ab9c99ded11480d84ff15c08ff606e86ec3f9c43cd19d594abe75d371c0a49c0f966802b6610818533eadddfda9c73179

Download Submit
memory/2168-58-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2168-1209-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2324-55-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2324-1207-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2384-85-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2396-65-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2428-62-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2508-25-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2520-66-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2560-37-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2596-29-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-30-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2704-20-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2796-79-0x0000000001E90000-0x0000000001E98000-memory.dmp

Filesize
32KB

Download
memory/2796-78-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2872-60-0x0000000003200000-0x00000000035F2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-24-0x0000000002CD0000-0x00000000030C2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-56-0x0000000003200000-0x00000000035F2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-59-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2872-87-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-61-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2872-27-0x0000000002CD0000-0x00000000030C2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-36-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2872-1-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2872-75-0x0000000003200000-0x00000000035F2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-51-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2872-22-0x0000000002CD0000-0x00000000030C2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-98-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2872-18-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download