xmrig | 6d04b0632e3a341d4a6df2752535cfcb7945170d97a8f6f751bd5c0a6160dcf4

Analysis

max time kernel
37s
max time network
36s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
Size

1.6MB
MD5

045127c7c12c3ebdfe34eeefb52bc666
SHA1

ef8d805fd8548e21a93a3b227b51d9c79c7b38cc
SHA256

6d04b0632e3a341d4a6df2752535cfcb7945170d97a8f6f751bd5c0a6160dcf4
SHA512

6715bb040a0d4728153fcc0e69c825b1f2b88f8ae61b06637f3a33a48797670be8ddca26e23ea8fe840d4f6c3467a19f1b33789ba49baec7d321dcea2eab495f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SOs:NABa

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2004-13-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2688-184-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2624-148-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/2808-146-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2704-115-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/2720-113-0x000000013FA90000-0x000000013FE82000-memory.dmp	xmrig
behavioral1/memory/2060-111-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2716-109-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2664-107-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2004	dMCogqh.exe
2664	hmtTaFa.exe
2716	HdQcUEl.exe
2060	OClZGlL.exe
2720	HpumZAh.exe
2704	fauUXgl.exe
2808	WKDqGVV.exe
2624	skBtbHt.exe
2688	fuzyREh.exe
2484	KMiGgkA.exe
2572	VVKJgPZ.exe
3004	RylknEM.exe
1764	fKzlsQJ.exe
2780	wKnYXQV.exe
2836	lFIzuzK.exe
2980	nTdfJAf.exe
1684	lfnlsuu.exe
1592	AGdFSjX.exe
1528	SwnfNxX.exe
552	nDzNQci.exe
1988	knJJwRB.exe
2992	zNyoLBW.exe
1388	yYGKmLw.exe
2144	SkkMoPA.exe
1920	HBGkQkM.exe
1236	xcMgBqT.exe
1064	CKnUTLA.exe
2128	gLzIWNf.exe
1868	NXLKjVv.exe
1736	vyqvmda.exe
2832	XaQXFAb.exe
1252	KqoSgpD.exe
2984	zgNyMJj.exe
2548	nWcpCsE.exe
2044	PScdyDF.exe
1996	dSgZpXP.exe
1016	HWbrKfC.exe
336	DjnLNEX.exe
2640	ySWvLUV.exe
988	uEQcGOl.exe
2016	pidcPwV.exe
2424	KiJWqQi.exe
880	SdVbIVs.exe
1748	axLjeze.exe
2032	vwnciag.exe
2388	shWJjVX.exe
2896	gMbeAeC.exe
1928	XHESwOM.exe
1980	KBQOlEc.exe
2536	yAAVNgP.exe
1604	zBOgFld.exe
1948	OHRDJwc.exe
2728	wBXMzwH.exe
2564	Lxfevwp.exe
2768	qWLQFrs.exe
2544	yIPvbcS.exe
2760	wPCLRhF.exe
2608	wYGiuCy.exe
2588	TzduhuJ.exe
1984	eSPhGio.exe
2828	vzJjZhe.exe
2872	krJVMtf.exe
1864	TLYdmSb.exe
2944	zaAoBJW.exe

Loads dropped DLL 64 IoCs

pid	Process
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/384-0-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/files/0x000c000000015cce-5.dat	upx
behavioral1/memory/2004-13-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/files/0x002a000000015d4c-15.dat	upx
behavioral1/files/0x00080000000160cc-27.dat	upx
behavioral1/files/0x00070000000161b3-31.dat	upx
behavioral1/files/0x00070000000162c9-34.dat	upx
behavioral1/files/0x0006000000016d1f-52.dat	upx
behavioral1/files/0x0006000000016d3a-64.dat	upx
behavioral1/files/0x0006000000016da4-72.dat	upx
behavioral1/files/0x00060000000173e5-100.dat	upx
behavioral1/files/0x000500000001874a-186.dat	upx
behavioral1/memory/2688-184-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/files/0x0005000000019233-180.dat	upx
behavioral1/files/0x0005000000019223-174.dat	upx
behavioral1/files/0x00050000000191eb-168.dat	upx
behavioral1/files/0x000500000001874c-158.dat	upx
behavioral1/files/0x0005000000018700-152.dat	upx
behavioral1/files/0x00050000000186c1-137.dat	upx
behavioral1/files/0x0009000000018640-131.dat	upx
behavioral1/files/0x00060000000175b8-125.dat	upx
behavioral1/files/0x00060000000175ac-117.dat	upx
behavioral1/files/0x0006000000016fe8-92.dat	upx
behavioral1/files/0x00050000000191ed-171.dat	upx
behavioral1/files/0x00050000000186d3-167.dat	upx
behavioral1/files/0x000500000001865a-151.dat	upx
behavioral1/files/0x001500000001863c-150.dat	upx
behavioral1/files/0x00060000000175b2-149.dat	upx
behavioral1/memory/2624-148-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/2808-146-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/files/0x0005000000019227-177.dat	upx
behavioral1/files/0x0006000000018bba-161.dat	upx
behavioral1/memory/2704-115-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/memory/2720-113-0x000000013FA90000-0x000000013FE82000-memory.dmp	upx
behavioral1/memory/2060-111-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2716-109-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/memory/2664-107-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/files/0x000600000001744c-104.dat	upx
behavioral1/files/0x000600000001739d-96.dat	upx
behavioral1/files/0x0006000000016e78-88.dat	upx
behavioral1/files/0x0006000000016db3-76.dat	upx
behavioral1/files/0x0006000000016d9f-68.dat	upx
behavioral1/files/0x0006000000016d36-60.dat	upx
behavioral1/files/0x0006000000016d32-56.dat	upx
behavioral1/files/0x0006000000016d16-46.dat	upx
behavioral1/files/0x00070000000165f0-42.dat	upx
behavioral1/files/0x000900000001654a-39.dat	upx
behavioral1/files/0x001800000000558a-22.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dazywdW.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\RwPBpgH.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\TfTacwT.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\pxEoLaV.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\gJjdhLv.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\VUwuFHf.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\YDqvtEh.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\tZWqiWp.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\wBAEcoR.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\hVRGdRa.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\pSHQTJa.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\MHTkYiI.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\lLMqeeM.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\ynVEZBq.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\iUmDcDJ.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\YMBIjHB.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\dNrpOWm.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\KZEQXPy.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\VUhHWqL.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\DPRdTsz.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\TwAwzNO.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\vjRLdOc.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\JFZgVsM.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\DnlMJQI.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\TMODFtJ.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\JLvmFyz.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\fFVNlRN.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\cBZCHiD.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\aohItPy.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\UzXwsMQ.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\UKGEjNG.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\NArFujH.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\qniVjWM.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\OuGSsMR.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\bsgoKVi.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\ExgXJvy.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\uzaAbht.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\cfrmCuw.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\VIJCary.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\XlnmIOt.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\naTejBt.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\dTrPUsi.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\kOWcfae.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\dcShaLu.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\ILThWNL.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\eolbZhe.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\gFKNVZS.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\oxlyWPb.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\fKzlsQJ.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\PgMLCqh.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\SVKXHKW.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\SUxxSFr.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\rkBiPza.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\BBTRlRU.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\zqMGcdw.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\ZYOmRqY.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\MwQdXAO.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\GbaAIVs.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\CnKrWqZ.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\POHoypl.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\SQypYjM.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\NRftYTk.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\EjiFxmg.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
File created	C:\Windows\System\imZgbBq.exe	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1856	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
Token: SeDebugPrivilege	1856	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 1856	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	29
PID 384 wrote to memory of 1856	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	29
PID 384 wrote to memory of 1856	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	29
PID 384 wrote to memory of 2004	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	30
PID 384 wrote to memory of 2004	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	30
PID 384 wrote to memory of 2004	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	30
PID 384 wrote to memory of 2664	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	31
PID 384 wrote to memory of 2664	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	31
PID 384 wrote to memory of 2664	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	31
PID 384 wrote to memory of 2716	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	32
PID 384 wrote to memory of 2716	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	32
PID 384 wrote to memory of 2716	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	32
PID 384 wrote to memory of 2060	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	33
PID 384 wrote to memory of 2060	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	33
PID 384 wrote to memory of 2060	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	33
PID 384 wrote to memory of 2720	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	34
PID 384 wrote to memory of 2720	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	34
PID 384 wrote to memory of 2720	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	34
PID 384 wrote to memory of 2704	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	35
PID 384 wrote to memory of 2704	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	35
PID 384 wrote to memory of 2704	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	35
PID 384 wrote to memory of 2808	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	36
PID 384 wrote to memory of 2808	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	36
PID 384 wrote to memory of 2808	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	36
PID 384 wrote to memory of 2624	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	37
PID 384 wrote to memory of 2624	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	37
PID 384 wrote to memory of 2624	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	37
PID 384 wrote to memory of 2688	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	38
PID 384 wrote to memory of 2688	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	38
PID 384 wrote to memory of 2688	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	38
PID 384 wrote to memory of 2484	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	39
PID 384 wrote to memory of 2484	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	39
PID 384 wrote to memory of 2484	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	39
PID 384 wrote to memory of 2572	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	40
PID 384 wrote to memory of 2572	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	40
PID 384 wrote to memory of 2572	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	40
PID 384 wrote to memory of 3004	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	41
PID 384 wrote to memory of 3004	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	41
PID 384 wrote to memory of 3004	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	41
PID 384 wrote to memory of 1764	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	42
PID 384 wrote to memory of 1764	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	42
PID 384 wrote to memory of 1764	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	42
PID 384 wrote to memory of 2780	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	43
PID 384 wrote to memory of 2780	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	43
PID 384 wrote to memory of 2780	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	43
PID 384 wrote to memory of 2836	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	44
PID 384 wrote to memory of 2836	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	44
PID 384 wrote to memory of 2836	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	44
PID 384 wrote to memory of 2980	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	45
PID 384 wrote to memory of 2980	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	45
PID 384 wrote to memory of 2980	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	45
PID 384 wrote to memory of 1684	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	46
PID 384 wrote to memory of 1684	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	46
PID 384 wrote to memory of 1684	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	46
PID 384 wrote to memory of 1592	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	47
PID 384 wrote to memory of 1592	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	47
PID 384 wrote to memory of 1592	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	47
PID 384 wrote to memory of 1528	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	48
PID 384 wrote to memory of 1528	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	48
PID 384 wrote to memory of 1528	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	48
PID 384 wrote to memory of 552	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	49
PID 384 wrote to memory of 552	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	49
PID 384 wrote to memory of 552	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	49
PID 384 wrote to memory of 1988	384	045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\045127c7c12c3ebdfe34eeefb52bc666_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Windows\System\dMCogqh.exe
  C:\Windows\System\dMCogqh.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\hmtTaFa.exe
  C:\Windows\System\hmtTaFa.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\HdQcUEl.exe
  C:\Windows\System\HdQcUEl.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\OClZGlL.exe
  C:\Windows\System\OClZGlL.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\HpumZAh.exe
  C:\Windows\System\HpumZAh.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\fauUXgl.exe
  C:\Windows\System\fauUXgl.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\WKDqGVV.exe
  C:\Windows\System\WKDqGVV.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\skBtbHt.exe
  C:\Windows\System\skBtbHt.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\fuzyREh.exe
  C:\Windows\System\fuzyREh.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\KMiGgkA.exe
  C:\Windows\System\KMiGgkA.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\VVKJgPZ.exe
  C:\Windows\System\VVKJgPZ.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\RylknEM.exe
  C:\Windows\System\RylknEM.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\fKzlsQJ.exe
  C:\Windows\System\fKzlsQJ.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\wKnYXQV.exe
  C:\Windows\System\wKnYXQV.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\lFIzuzK.exe
  C:\Windows\System\lFIzuzK.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\nTdfJAf.exe
  C:\Windows\System\nTdfJAf.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\lfnlsuu.exe
  C:\Windows\System\lfnlsuu.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\AGdFSjX.exe
  C:\Windows\System\AGdFSjX.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\SwnfNxX.exe
  C:\Windows\System\SwnfNxX.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\nDzNQci.exe
  C:\Windows\System\nDzNQci.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\knJJwRB.exe
  C:\Windows\System\knJJwRB.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\XaQXFAb.exe
  C:\Windows\System\XaQXFAb.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\zNyoLBW.exe
  C:\Windows\System\zNyoLBW.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\zgNyMJj.exe
  C:\Windows\System\zgNyMJj.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\yYGKmLw.exe
  C:\Windows\System\yYGKmLw.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\nWcpCsE.exe
  C:\Windows\System\nWcpCsE.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\SkkMoPA.exe
  C:\Windows\System\SkkMoPA.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\PScdyDF.exe
  C:\Windows\System\PScdyDF.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\HBGkQkM.exe
  C:\Windows\System\HBGkQkM.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\dSgZpXP.exe
  C:\Windows\System\dSgZpXP.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\xcMgBqT.exe
  C:\Windows\System\xcMgBqT.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\DjnLNEX.exe
  C:\Windows\System\DjnLNEX.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\CKnUTLA.exe
  C:\Windows\System\CKnUTLA.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\ySWvLUV.exe
  C:\Windows\System\ySWvLUV.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\gLzIWNf.exe
  C:\Windows\System\gLzIWNf.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\uEQcGOl.exe
  C:\Windows\System\uEQcGOl.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\NXLKjVv.exe
  C:\Windows\System\NXLKjVv.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\KiJWqQi.exe
  C:\Windows\System\KiJWqQi.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\vyqvmda.exe
  C:\Windows\System\vyqvmda.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\axLjeze.exe
  C:\Windows\System\axLjeze.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\KqoSgpD.exe
  C:\Windows\System\KqoSgpD.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\vwnciag.exe
  C:\Windows\System\vwnciag.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\HWbrKfC.exe
  C:\Windows\System\HWbrKfC.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\shWJjVX.exe
  C:\Windows\System\shWJjVX.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\pidcPwV.exe
  C:\Windows\System\pidcPwV.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\XHESwOM.exe
  C:\Windows\System\XHESwOM.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\SdVbIVs.exe
  C:\Windows\System\SdVbIVs.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\KBQOlEc.exe
  C:\Windows\System\KBQOlEc.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\gMbeAeC.exe
  C:\Windows\System\gMbeAeC.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\yAAVNgP.exe
  C:\Windows\System\yAAVNgP.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\zBOgFld.exe
  C:\Windows\System\zBOgFld.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\yIPvbcS.exe
  C:\Windows\System\yIPvbcS.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\OHRDJwc.exe
  C:\Windows\System\OHRDJwc.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\wYGiuCy.exe
  C:\Windows\System\wYGiuCy.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\wBXMzwH.exe
  C:\Windows\System\wBXMzwH.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\TzduhuJ.exe
  C:\Windows\System\TzduhuJ.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\Lxfevwp.exe
  C:\Windows\System\Lxfevwp.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\eSPhGio.exe
  C:\Windows\System\eSPhGio.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\qWLQFrs.exe
  C:\Windows\System\qWLQFrs.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\vzJjZhe.exe
  C:\Windows\System\vzJjZhe.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\wPCLRhF.exe
  C:\Windows\System\wPCLRhF.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\gyftbch.exe
  C:\Windows\System\gyftbch.exe
  2⤵
  PID:1768
- C:\Windows\System\krJVMtf.exe
  C:\Windows\System\krJVMtf.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\uKmmBNW.exe
  C:\Windows\System\uKmmBNW.exe
  2⤵
  PID:588
- C:\Windows\System\TLYdmSb.exe
  C:\Windows\System\TLYdmSb.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\bgADBUm.exe
  C:\Windows\System\bgADBUm.exe
  2⤵
  PID:2744
- C:\Windows\System\zaAoBJW.exe
  C:\Windows\System\zaAoBJW.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\fUInCwH.exe
  C:\Windows\System\fUInCwH.exe
  2⤵
  PID:1312
- C:\Windows\System\PBjoeeZ.exe
  C:\Windows\System\PBjoeeZ.exe
  2⤵
  PID:2356
- C:\Windows\System\yYctOOQ.exe
  C:\Windows\System\yYctOOQ.exe
  2⤵
  PID:2248
- C:\Windows\System\LAMUNCW.exe
  C:\Windows\System\LAMUNCW.exe
  2⤵
  PID:1524
- C:\Windows\System\zauKUsf.exe
  C:\Windows\System\zauKUsf.exe
  2⤵
  PID:1744
- C:\Windows\System\WVpzQLr.exe
  C:\Windows\System\WVpzQLr.exe
  2⤵
  PID:2904
- C:\Windows\System\SWMjNNZ.exe
  C:\Windows\System\SWMjNNZ.exe
  2⤵
  PID:1716
- C:\Windows\System\gQvfJmx.exe
  C:\Windows\System\gQvfJmx.exe
  2⤵
  PID:320
- C:\Windows\System\ifaiSWN.exe
  C:\Windows\System\ifaiSWN.exe
  2⤵
  PID:2920
- C:\Windows\System\JoXbDPf.exe
  C:\Windows\System\JoXbDPf.exe
  2⤵
  PID:2452
- C:\Windows\System\DPRdTsz.exe
  C:\Windows\System\DPRdTsz.exe
  2⤵
  PID:560
- C:\Windows\System\xtdlVlE.exe
  C:\Windows\System\xtdlVlE.exe
  2⤵
  PID:2784
- C:\Windows\System\nJJOrlP.exe
  C:\Windows\System\nJJOrlP.exe
  2⤵
  PID:2524
- C:\Windows\System\lFxXzRJ.exe
  C:\Windows\System\lFxXzRJ.exe
  2⤵
  PID:2812
- C:\Windows\System\vaNGjPp.exe
  C:\Windows\System\vaNGjPp.exe
  2⤵
  PID:1440
- C:\Windows\System\mpmqaWD.exe
  C:\Windows\System\mpmqaWD.exe
  2⤵
  PID:768
- C:\Windows\System\APZfUDV.exe
  C:\Windows\System\APZfUDV.exe
  2⤵
  PID:1756
- C:\Windows\System\FduyCnJ.exe
  C:\Windows\System\FduyCnJ.exe
  2⤵
  PID:772
- C:\Windows\System\nsXdqcg.exe
  C:\Windows\System\nsXdqcg.exe
  2⤵
  PID:2940
- C:\Windows\System\qxJSwNt.exe
  C:\Windows\System\qxJSwNt.exe
  2⤵
  PID:1136
- C:\Windows\System\kbQyvvz.exe
  C:\Windows\System\kbQyvvz.exe
  2⤵
  PID:2112
- C:\Windows\System\QHiOMJs.exe
  C:\Windows\System\QHiOMJs.exe
  2⤵
  PID:1556
- C:\Windows\System\hPdwKjM.exe
  C:\Windows\System\hPdwKjM.exe
  2⤵
  PID:848
- C:\Windows\System\cLLsAgq.exe
  C:\Windows\System\cLLsAgq.exe
  2⤵
  PID:764
- C:\Windows\System\aEzexQg.exe
  C:\Windows\System\aEzexQg.exe
  2⤵
  PID:1196
- C:\Windows\System\ElgPmEs.exe
  C:\Windows\System\ElgPmEs.exe
  2⤵
  PID:1700
- C:\Windows\System\zYsRUur.exe
  C:\Windows\System\zYsRUur.exe
  2⤵
  PID:1600
- C:\Windows\System\fZJnJqD.exe
  C:\Windows\System\fZJnJqD.exe
  2⤵
  PID:2216
- C:\Windows\System\xuUWdpX.exe
  C:\Windows\System\xuUWdpX.exe
  2⤵
  PID:1820
- C:\Windows\System\QTkaaif.exe
  C:\Windows\System\QTkaaif.exe
  2⤵
  PID:2012
- C:\Windows\System\xnpSxPT.exe
  C:\Windows\System\xnpSxPT.exe
  2⤵
  PID:1408
- C:\Windows\System\uGogVCp.exe
  C:\Windows\System\uGogVCp.exe
  2⤵
  PID:2792
- C:\Windows\System\dTrPUsi.exe
  C:\Windows\System\dTrPUsi.exe
  2⤵
  PID:2232
- C:\Windows\System\BsuVxZG.exe
  C:\Windows\System\BsuVxZG.exe
  2⤵
  PID:2436
- C:\Windows\System\mSvRnFu.exe
  C:\Windows\System\mSvRnFu.exe
  2⤵
  PID:2136
- C:\Windows\System\aNNGMDB.exe
  C:\Windows\System\aNNGMDB.exe
  2⤵
  PID:2084
- C:\Windows\System\vxwKGre.exe
  C:\Windows\System\vxwKGre.exe
  2⤵
  PID:2952
- C:\Windows\System\UMUnPEP.exe
  C:\Windows\System\UMUnPEP.exe
  2⤵
  PID:328
- C:\Windows\System\SqHfDpw.exe
  C:\Windows\System\SqHfDpw.exe
  2⤵
  PID:2580
- C:\Windows\System\OuGSsMR.exe
  C:\Windows\System\OuGSsMR.exe
  2⤵
  PID:2328
- C:\Windows\System\MWZbWDy.exe
  C:\Windows\System\MWZbWDy.exe
  2⤵
  PID:2732
- C:\Windows\System\NjiqdKp.exe
  C:\Windows\System\NjiqdKp.exe
  2⤵
  PID:2268
- C:\Windows\System\dPLyvTw.exe
  C:\Windows\System\dPLyvTw.exe
  2⤵
  PID:908
- C:\Windows\System\jjamUcy.exe
  C:\Windows\System\jjamUcy.exe
  2⤵
  PID:1432
- C:\Windows\System\yPenMzD.exe
  C:\Windows\System\yPenMzD.exe
  2⤵
  PID:3012
- C:\Windows\System\cAoztbi.exe
  C:\Windows\System\cAoztbi.exe
  2⤵
  PID:2352
- C:\Windows\System\HAoANsu.exe
  C:\Windows\System\HAoANsu.exe
  2⤵
  PID:2676
- C:\Windows\System\MFZOGBP.exe
  C:\Windows\System\MFZOGBP.exe
  2⤵
  PID:2752
- C:\Windows\System\cCMnhSG.exe
  C:\Windows\System\cCMnhSG.exe
  2⤵
  PID:1672
- C:\Windows\System\KVceMXc.exe
  C:\Windows\System\KVceMXc.exe
  2⤵
  PID:2000
- C:\Windows\System\tgNLlBr.exe
  C:\Windows\System\tgNLlBr.exe
  2⤵
  PID:1480
- C:\Windows\System\SxESosU.exe
  C:\Windows\System\SxESosU.exe
  2⤵
  PID:2120
- C:\Windows\System\OtfCvPS.exe
  C:\Windows\System\OtfCvPS.exe
  2⤵
  PID:2336
- C:\Windows\System\kMQKluT.exe
  C:\Windows\System\kMQKluT.exe
  2⤵
  PID:2212
- C:\Windows\System\gbZxDvQ.exe
  C:\Windows\System\gbZxDvQ.exe
  2⤵
  PID:2280
- C:\Windows\System\IFsRlGO.exe
  C:\Windows\System\IFsRlGO.exe
  2⤵
  PID:2028
- C:\Windows\System\FFGADas.exe
  C:\Windows\System\FFGADas.exe
  2⤵
  PID:2488
- C:\Windows\System\SiABise.exe
  C:\Windows\System\SiABise.exe
  2⤵
  PID:1624
- C:\Windows\System\RzIcNcf.exe
  C:\Windows\System\RzIcNcf.exe
  2⤵
  PID:1484
- C:\Windows\System\OtSiWLD.exe
  C:\Windows\System\OtSiWLD.exe
  2⤵
  PID:1380
- C:\Windows\System\nuIKhrF.exe
  C:\Windows\System\nuIKhrF.exe
  2⤵
  PID:1320
- C:\Windows\System\SdwxLbq.exe
  C:\Windows\System\SdwxLbq.exe
  2⤵
  PID:2556
- C:\Windows\System\kMTIFiw.exe
  C:\Windows\System\kMTIFiw.exe
  2⤵
  PID:2348
- C:\Windows\System\GQQvzGt.exe
  C:\Windows\System\GQQvzGt.exe
  2⤵
  PID:2592
- C:\Windows\System\XFSFKUY.exe
  C:\Windows\System\XFSFKUY.exe
  2⤵
  PID:2652
- C:\Windows\System\KbkgMTn.exe
  C:\Windows\System\KbkgMTn.exe
  2⤵
  PID:3036
- C:\Windows\System\uahGxlE.exe
  C:\Windows\System\uahGxlE.exe
  2⤵
  PID:3080
- C:\Windows\System\leZTfYT.exe
  C:\Windows\System\leZTfYT.exe
  2⤵
  PID:3096
- C:\Windows\System\OIAUekg.exe
  C:\Windows\System\OIAUekg.exe
  2⤵
  PID:3112
- C:\Windows\System\LLfszPJ.exe
  C:\Windows\System\LLfszPJ.exe
  2⤵
  PID:3128
- C:\Windows\System\BoLPnWR.exe
  C:\Windows\System\BoLPnWR.exe
  2⤵
  PID:3144
- C:\Windows\System\TIwLXlI.exe
  C:\Windows\System\TIwLXlI.exe
  2⤵
  PID:3160
- C:\Windows\System\kzTkhsu.exe
  C:\Windows\System\kzTkhsu.exe
  2⤵
  PID:3176
- C:\Windows\System\XHNkkZH.exe
  C:\Windows\System\XHNkkZH.exe
  2⤵
  PID:3192
- C:\Windows\System\QnuOSFi.exe
  C:\Windows\System\QnuOSFi.exe
  2⤵
  PID:3208
- C:\Windows\System\LFgGHDn.exe
  C:\Windows\System\LFgGHDn.exe
  2⤵
  PID:3224
- C:\Windows\System\bcNkDpV.exe
  C:\Windows\System\bcNkDpV.exe
  2⤵
  PID:3240
- C:\Windows\System\uzVOKkN.exe
  C:\Windows\System\uzVOKkN.exe
  2⤵
  PID:3256
- C:\Windows\System\agJMuil.exe
  C:\Windows\System\agJMuil.exe
  2⤵
  PID:3272
- C:\Windows\System\hXirhuu.exe
  C:\Windows\System\hXirhuu.exe
  2⤵
  PID:3288
- C:\Windows\System\PypFcYt.exe
  C:\Windows\System\PypFcYt.exe
  2⤵
  PID:3304
- C:\Windows\System\qInyGkZ.exe
  C:\Windows\System\qInyGkZ.exe
  2⤵
  PID:3320
- C:\Windows\System\RxgYbKl.exe
  C:\Windows\System\RxgYbKl.exe
  2⤵
  PID:3336
- C:\Windows\System\PgMLCqh.exe
  C:\Windows\System\PgMLCqh.exe
  2⤵
  PID:3352
- C:\Windows\System\dUztEAG.exe
  C:\Windows\System\dUztEAG.exe
  2⤵
  PID:3368
- C:\Windows\System\Lyleagx.exe
  C:\Windows\System\Lyleagx.exe
  2⤵
  PID:3384
- C:\Windows\System\XItVcCT.exe
  C:\Windows\System\XItVcCT.exe
  2⤵
  PID:3400
- C:\Windows\System\OuTuVFr.exe
  C:\Windows\System\OuTuVFr.exe
  2⤵
  PID:3416
- C:\Windows\System\yFJLPmg.exe
  C:\Windows\System\yFJLPmg.exe
  2⤵
  PID:3432
- C:\Windows\System\ffvQhOO.exe
  C:\Windows\System\ffvQhOO.exe
  2⤵
  PID:3448
- C:\Windows\System\HpbwWKz.exe
  C:\Windows\System\HpbwWKz.exe
  2⤵
  PID:3464
- C:\Windows\System\WoubVST.exe
  C:\Windows\System\WoubVST.exe
  2⤵
  PID:3480
- C:\Windows\System\KuUEqpq.exe
  C:\Windows\System\KuUEqpq.exe
  2⤵
  PID:3496
- C:\Windows\System\tLblNiW.exe
  C:\Windows\System\tLblNiW.exe
  2⤵
  PID:3512
- C:\Windows\System\URlrIhm.exe
  C:\Windows\System\URlrIhm.exe
  2⤵
  PID:3528
- C:\Windows\System\Hnpebnm.exe
  C:\Windows\System\Hnpebnm.exe
  2⤵
  PID:3544
- C:\Windows\System\pGwzJST.exe
  C:\Windows\System\pGwzJST.exe
  2⤵
  PID:3560
- C:\Windows\System\AaOmgYk.exe
  C:\Windows\System\AaOmgYk.exe
  2⤵
  PID:3576
- C:\Windows\System\bxDwMmv.exe
  C:\Windows\System\bxDwMmv.exe
  2⤵
  PID:3592
- C:\Windows\System\POHoypl.exe
  C:\Windows\System\POHoypl.exe
  2⤵
  PID:3608
- C:\Windows\System\QnWDXXI.exe
  C:\Windows\System\QnWDXXI.exe
  2⤵
  PID:3624
- C:\Windows\System\jdeUxtE.exe
  C:\Windows\System\jdeUxtE.exe
  2⤵
  PID:3640
- C:\Windows\System\JJcUmjU.exe
  C:\Windows\System\JJcUmjU.exe
  2⤵
  PID:3660
- C:\Windows\System\oXSvChb.exe
  C:\Windows\System\oXSvChb.exe
  2⤵
  PID:3676
- C:\Windows\System\VqXpAWO.exe
  C:\Windows\System\VqXpAWO.exe
  2⤵
  PID:3692
- C:\Windows\System\RwPBpgH.exe
  C:\Windows\System\RwPBpgH.exe
  2⤵
  PID:3708
- C:\Windows\System\FXCfnEJ.exe
  C:\Windows\System\FXCfnEJ.exe
  2⤵
  PID:3724
- C:\Windows\System\tstKQie.exe
  C:\Windows\System\tstKQie.exe
  2⤵
  PID:3740
- C:\Windows\System\uLleNkQ.exe
  C:\Windows\System\uLleNkQ.exe
  2⤵
  PID:3756
- C:\Windows\System\erIXChf.exe
  C:\Windows\System\erIXChf.exe
  2⤵
  PID:3772
- C:\Windows\System\AQlRqHn.exe
  C:\Windows\System\AQlRqHn.exe
  2⤵
  PID:3788
- C:\Windows\System\BOhirAM.exe
  C:\Windows\System\BOhirAM.exe
  2⤵
  PID:3804
- C:\Windows\System\EiELadn.exe
  C:\Windows\System\EiELadn.exe
  2⤵
  PID:3820
- C:\Windows\System\blQXtWT.exe
  C:\Windows\System\blQXtWT.exe
  2⤵
  PID:3836
- C:\Windows\System\ELWgIRN.exe
  C:\Windows\System\ELWgIRN.exe
  2⤵
  PID:3852
- C:\Windows\System\JDwLJqy.exe
  C:\Windows\System\JDwLJqy.exe
  2⤵
  PID:3868
- C:\Windows\System\xRuIvoe.exe
  C:\Windows\System\xRuIvoe.exe
  2⤵
  PID:3884
- C:\Windows\System\mmEWHWO.exe
  C:\Windows\System\mmEWHWO.exe
  2⤵
  PID:3900
- C:\Windows\System\WVUURDO.exe
  C:\Windows\System\WVUURDO.exe
  2⤵
  PID:3916
- C:\Windows\System\lGajXQv.exe
  C:\Windows\System\lGajXQv.exe
  2⤵
  PID:3932
- C:\Windows\System\ZiBpskG.exe
  C:\Windows\System\ZiBpskG.exe
  2⤵
  PID:3948
- C:\Windows\System\nKbBQPh.exe
  C:\Windows\System\nKbBQPh.exe
  2⤵
  PID:3964
- C:\Windows\System\TwAwzNO.exe
  C:\Windows\System\TwAwzNO.exe
  2⤵
  PID:3980
- C:\Windows\System\SKlcYPX.exe
  C:\Windows\System\SKlcYPX.exe
  2⤵
  PID:3996
- C:\Windows\System\IbDcDdb.exe
  C:\Windows\System\IbDcDdb.exe
  2⤵
  PID:4012
- C:\Windows\System\TDCKMBa.exe
  C:\Windows\System\TDCKMBa.exe
  2⤵
  PID:4028
- C:\Windows\System\xcXMYYV.exe
  C:\Windows\System\xcXMYYV.exe
  2⤵
  PID:4044
- C:\Windows\System\dXhYczw.exe
  C:\Windows\System\dXhYczw.exe
  2⤵
  PID:4060
- C:\Windows\System\wyOLdaO.exe
  C:\Windows\System\wyOLdaO.exe
  2⤵
  PID:4076
- C:\Windows\System\SyuGVUB.exe
  C:\Windows\System\SyuGVUB.exe
  2⤵
  PID:4092
- C:\Windows\System\FeQbANl.exe
  C:\Windows\System\FeQbANl.exe
  2⤵
  PID:2364
- C:\Windows\System\doMalOx.exe
  C:\Windows\System\doMalOx.exe
  2⤵
  PID:2068
- C:\Windows\System\lcuMvQz.exe
  C:\Windows\System\lcuMvQz.exe
  2⤵
  PID:2512
- C:\Windows\System\RseKlVk.exe
  C:\Windows\System\RseKlVk.exe
  2⤵
  PID:2852
- C:\Windows\System\cvGxbNE.exe
  C:\Windows\System\cvGxbNE.exe
  2⤵
  PID:1612
- C:\Windows\System\uCWyCfh.exe
  C:\Windows\System\uCWyCfh.exe
  2⤵
  PID:2656
- C:\Windows\System\xfuGgEV.exe
  C:\Windows\System\xfuGgEV.exe
  2⤵
  PID:2600
- C:\Windows\System\QjjuXKv.exe
  C:\Windows\System\QjjuXKv.exe
  2⤵
  PID:2764
- C:\Windows\System\LueKdbR.exe
  C:\Windows\System\LueKdbR.exe
  2⤵
  PID:996
- C:\Windows\System\ujbwYni.exe
  C:\Windows\System\ujbwYni.exe
  2⤵
  PID:2644
- C:\Windows\System\XMGEJAJ.exe
  C:\Windows\System\XMGEJAJ.exe
  2⤵
  PID:3108
- C:\Windows\System\QAlUNlG.exe
  C:\Windows\System\QAlUNlG.exe
  2⤵
  PID:3124
- C:\Windows\System\tHygqFw.exe
  C:\Windows\System\tHygqFw.exe
  2⤵
  PID:3156
- C:\Windows\System\grfvxNs.exe
  C:\Windows\System\grfvxNs.exe
  2⤵
  PID:3204
- C:\Windows\System\boYvnte.exe
  C:\Windows\System\boYvnte.exe
  2⤵
  PID:3220
- C:\Windows\System\mAGgTkS.exe
  C:\Windows\System\mAGgTkS.exe
  2⤵
  PID:3252
- C:\Windows\System\NtovcQb.exe
  C:\Windows\System\NtovcQb.exe
  2⤵
  PID:3284
- C:\Windows\System\dqZJGkB.exe
  C:\Windows\System\dqZJGkB.exe
  2⤵
  PID:3328
- C:\Windows\System\uCKWqkv.exe
  C:\Windows\System\uCKWqkv.exe
  2⤵
  PID:3360
- C:\Windows\System\kHmHTJy.exe
  C:\Windows\System\kHmHTJy.exe
  2⤵
  PID:3376
- C:\Windows\System\dTHhvrY.exe
  C:\Windows\System\dTHhvrY.exe
  2⤵
  PID:3408
- C:\Windows\System\TfTacwT.exe
  C:\Windows\System\TfTacwT.exe
  2⤵
  PID:3440
- C:\Windows\System\FOWBQll.exe
  C:\Windows\System\FOWBQll.exe
  2⤵
  PID:4104
- C:\Windows\System\jZWzeQL.exe
  C:\Windows\System\jZWzeQL.exe
  2⤵
  PID:4120
- C:\Windows\System\wBAEcoR.exe
  C:\Windows\System\wBAEcoR.exe
  2⤵
  PID:4256
- C:\Windows\System\KmdWcof.exe
  C:\Windows\System\KmdWcof.exe
  2⤵
  PID:4272
- C:\Windows\System\zEGrhTz.exe
  C:\Windows\System\zEGrhTz.exe
  2⤵
  PID:4288
- C:\Windows\System\uldsbCi.exe
  C:\Windows\System\uldsbCi.exe
  2⤵
  PID:4304
- C:\Windows\System\bcJJxSJ.exe
  C:\Windows\System\bcJJxSJ.exe
  2⤵
  PID:4320
- C:\Windows\System\AcWuKqa.exe
  C:\Windows\System\AcWuKqa.exe
  2⤵
  PID:4336
- C:\Windows\System\vksHWSd.exe
  C:\Windows\System\vksHWSd.exe
  2⤵
  PID:4352
- C:\Windows\System\XBetpOV.exe
  C:\Windows\System\XBetpOV.exe
  2⤵
  PID:4368
- C:\Windows\System\aTWjwRM.exe
  C:\Windows\System\aTWjwRM.exe
  2⤵
  PID:4384
- C:\Windows\System\enILkod.exe
  C:\Windows\System\enILkod.exe
  2⤵
  PID:4400
- C:\Windows\System\AJpPuSJ.exe
  C:\Windows\System\AJpPuSJ.exe
  2⤵
  PID:4416
- C:\Windows\System\NafdrvR.exe
  C:\Windows\System\NafdrvR.exe
  2⤵
  PID:4432
- C:\Windows\System\gJxHzAa.exe
  C:\Windows\System\gJxHzAa.exe
  2⤵
  PID:4456
- C:\Windows\System\rJejvMP.exe
  C:\Windows\System\rJejvMP.exe
  2⤵
  PID:4476
- C:\Windows\System\YxLLzWH.exe
  C:\Windows\System\YxLLzWH.exe
  2⤵
  PID:4492
- C:\Windows\System\wLyrWEz.exe
  C:\Windows\System\wLyrWEz.exe
  2⤵
  PID:4508
- C:\Windows\System\OmTkaPu.exe
  C:\Windows\System\OmTkaPu.exe
  2⤵
  PID:4524
- C:\Windows\System\dkqJjkZ.exe
  C:\Windows\System\dkqJjkZ.exe
  2⤵
  PID:4540
- C:\Windows\System\WIxHDNM.exe
  C:\Windows\System\WIxHDNM.exe
  2⤵
  PID:4556
- C:\Windows\System\hmHUugU.exe
  C:\Windows\System\hmHUugU.exe
  2⤵
  PID:4572
- C:\Windows\System\VdWdJpT.exe
  C:\Windows\System\VdWdJpT.exe
  2⤵
  PID:4588
- C:\Windows\System\iLqhzHb.exe
  C:\Windows\System\iLqhzHb.exe
  2⤵
  PID:4604
- C:\Windows\System\RKHfDRU.exe
  C:\Windows\System\RKHfDRU.exe
  2⤵
  PID:4652
- C:\Windows\System\rpIxXEY.exe
  C:\Windows\System\rpIxXEY.exe
  2⤵
  PID:4672
- C:\Windows\System\NdtJaaf.exe
  C:\Windows\System\NdtJaaf.exe
  2⤵
  PID:4688
- C:\Windows\System\WEChesp.exe
  C:\Windows\System\WEChesp.exe
  2⤵
  PID:4704
- C:\Windows\System\zBCMEDZ.exe
  C:\Windows\System\zBCMEDZ.exe
  2⤵
  PID:4720
- C:\Windows\System\GbzHInh.exe
  C:\Windows\System\GbzHInh.exe
  2⤵
  PID:4736
- C:\Windows\System\XJccBGj.exe
  C:\Windows\System\XJccBGj.exe
  2⤵
  PID:4752
- C:\Windows\System\CTZgHlu.exe
  C:\Windows\System\CTZgHlu.exe
  2⤵
  PID:4768
- C:\Windows\System\SJDqmEp.exe
  C:\Windows\System\SJDqmEp.exe
  2⤵
  PID:4784
- C:\Windows\System\lPfzEUg.exe
  C:\Windows\System\lPfzEUg.exe
  2⤵
  PID:4800
- C:\Windows\System\TYKwdXa.exe
  C:\Windows\System\TYKwdXa.exe
  2⤵
  PID:4816
- C:\Windows\System\PSjKRbg.exe
  C:\Windows\System\PSjKRbg.exe
  2⤵
  PID:4832
- C:\Windows\System\phDZvNr.exe
  C:\Windows\System\phDZvNr.exe
  2⤵
  PID:4848
- C:\Windows\System\aDUeABm.exe
  C:\Windows\System\aDUeABm.exe
  2⤵
  PID:4864
- C:\Windows\System\iyDGTkN.exe
  C:\Windows\System\iyDGTkN.exe
  2⤵
  PID:4880
- C:\Windows\System\oXTXRWM.exe
  C:\Windows\System\oXTXRWM.exe
  2⤵
  PID:4896
- C:\Windows\System\LFtxAwM.exe
  C:\Windows\System\LFtxAwM.exe
  2⤵
  PID:4912
- C:\Windows\System\lyNrOnk.exe
  C:\Windows\System\lyNrOnk.exe
  2⤵
  PID:4928
- C:\Windows\System\kCrAGWb.exe
  C:\Windows\System\kCrAGWb.exe
  2⤵
  PID:4944
- C:\Windows\System\KcmxXmg.exe
  C:\Windows\System\KcmxXmg.exe
  2⤵
  PID:4960
- C:\Windows\System\nlhrsqB.exe
  C:\Windows\System\nlhrsqB.exe
  2⤵
  PID:4976
- C:\Windows\System\tsJrXvs.exe
  C:\Windows\System\tsJrXvs.exe
  2⤵
  PID:4992
- C:\Windows\System\SMuFBsN.exe
  C:\Windows\System\SMuFBsN.exe
  2⤵
  PID:5008
- C:\Windows\System\kktazIh.exe
  C:\Windows\System\kktazIh.exe
  2⤵
  PID:5024
- C:\Windows\System\KdYdadg.exe
  C:\Windows\System\KdYdadg.exe
  2⤵
  PID:5040
- C:\Windows\System\dIRbbaB.exe
  C:\Windows\System\dIRbbaB.exe
  2⤵
  PID:5056
- C:\Windows\System\rdwbcCd.exe
  C:\Windows\System\rdwbcCd.exe
  2⤵
  PID:5072
- C:\Windows\System\ThQuhEX.exe
  C:\Windows\System\ThQuhEX.exe
  2⤵
  PID:5088
- C:\Windows\System\DZQiIGU.exe
  C:\Windows\System\DZQiIGU.exe
  2⤵
  PID:5104
- C:\Windows\System\QVejXeP.exe
  C:\Windows\System\QVejXeP.exe
  2⤵
  PID:3488
- C:\Windows\System\gHUfMCx.exe
  C:\Windows\System\gHUfMCx.exe
  2⤵
  PID:3552
- C:\Windows\System\XTYkrHk.exe
  C:\Windows\System\XTYkrHk.exe
  2⤵
  PID:3584
- C:\Windows\System\BxuiWIj.exe
  C:\Windows\System\BxuiWIj.exe
  2⤵
  PID:3648
- C:\Windows\System\lhMfasr.exe
  C:\Windows\System\lhMfasr.exe
  2⤵
  PID:3688
- C:\Windows\System\WBnrroG.exe
  C:\Windows\System\WBnrroG.exe
  2⤵
  PID:3752
- C:\Windows\System\pTUzzDW.exe
  C:\Windows\System\pTUzzDW.exe
  2⤵
  PID:3816
- C:\Windows\System\mJelbDf.exe
  C:\Windows\System\mJelbDf.exe
  2⤵
  PID:3880
- C:\Windows\System\ngyjMyf.exe
  C:\Windows\System\ngyjMyf.exe
  2⤵
  PID:3944
- C:\Windows\System\qDJGkAc.exe
  C:\Windows\System\qDJGkAc.exe
  2⤵
  PID:4008
- C:\Windows\System\ExgXJvy.exe
  C:\Windows\System\ExgXJvy.exe
  2⤵
  PID:4072
- C:\Windows\System\hVRGdRa.exe
  C:\Windows\System\hVRGdRa.exe
  2⤵
  PID:1040
- C:\Windows\System\OJeBFFD.exe
  C:\Windows\System\OJeBFFD.exe
  2⤵
  PID:1752
- C:\Windows\System\HkEUqez.exe
  C:\Windows\System\HkEUqez.exe
  2⤵
  PID:3104
- C:\Windows\System\VIeGPzB.exe
  C:\Windows\System\VIeGPzB.exe
  2⤵
  PID:3268
- C:\Windows\System\venVxxH.exe
  C:\Windows\System\venVxxH.exe
  2⤵
  PID:3504
- C:\Windows\System\SXGSKkC.exe
  C:\Windows\System\SXGSKkC.exe
  2⤵
  PID:4100
- C:\Windows\System\SVKXHKW.exe
  C:\Windows\System\SVKXHKW.exe
  2⤵
  PID:4136
- C:\Windows\System\VzMAqpj.exe
  C:\Windows\System\VzMAqpj.exe
  2⤵
  PID:4152
- C:\Windows\System\PpWcPLf.exe
  C:\Windows\System\PpWcPLf.exe
  2⤵
  PID:4168
- C:\Windows\System\uKnjsvk.exe
  C:\Windows\System\uKnjsvk.exe
  2⤵
  PID:4188
- C:\Windows\System\XQTikNe.exe
  C:\Windows\System\XQTikNe.exe
  2⤵
  PID:4208
- C:\Windows\System\GXTOtZq.exe
  C:\Windows\System\GXTOtZq.exe
  2⤵
  PID:4224
- C:\Windows\System\gUgBCsU.exe
  C:\Windows\System\gUgBCsU.exe
  2⤵
  PID:4240
- C:\Windows\System\YdzbVtf.exe
  C:\Windows\System\YdzbVtf.exe
  2⤵
  PID:4132
- C:\Windows\System\GmbsVZq.exe
  C:\Windows\System\GmbsVZq.exe
  2⤵
  PID:4316
- C:\Windows\System\oEnMlfe.exe
  C:\Windows\System\oEnMlfe.exe
  2⤵
  PID:4408
- C:\Windows\System\AzCWNYQ.exe
  C:\Windows\System\AzCWNYQ.exe
  2⤵
  PID:3572
- C:\Windows\System\PzhbNIm.exe
  C:\Windows\System\PzhbNIm.exe
  2⤵
  PID:3636
- C:\Windows\System\SQypYjM.exe
  C:\Windows\System\SQypYjM.exe
  2⤵
  PID:3704
- C:\Windows\System\DrDdKXC.exe
  C:\Windows\System\DrDdKXC.exe
  2⤵
  PID:3768
- C:\Windows\System\JpVaHor.exe
  C:\Windows\System\JpVaHor.exe
  2⤵
  PID:3832
- C:\Windows\System\mUsVacR.exe
  C:\Windows\System\mUsVacR.exe
  2⤵
  PID:3864
- C:\Windows\System\xYUWKhS.exe
  C:\Windows\System\xYUWKhS.exe
  2⤵
  PID:3928
- C:\Windows\System\LDndAtk.exe
  C:\Windows\System\LDndAtk.exe
  2⤵
  PID:3992
- C:\Windows\System\INYXQat.exe
  C:\Windows\System\INYXQat.exe
  2⤵
  PID:4056
- C:\Windows\System\ebeyzcU.exe
  C:\Windows\System\ebeyzcU.exe
  2⤵
  PID:844
- C:\Windows\System\TGnrgUC.exe
  C:\Windows\System\TGnrgUC.exe
  2⤵
  PID:2960
- C:\Windows\System\xtHviUU.exe
  C:\Windows\System\xtHviUU.exe
  2⤵
  PID:3076
- C:\Windows\System\hfLGnie.exe
  C:\Windows\System\hfLGnie.exe
  2⤵
  PID:3188
- C:\Windows\System\HjMXVFF.exe
  C:\Windows\System\HjMXVFF.exe
  2⤵
  PID:3312
- C:\Windows\System\MhsLLQa.exe
  C:\Windows\System\MhsLLQa.exe
  2⤵
  PID:3428
- C:\Windows\System\XpordWn.exe
  C:\Windows\System\XpordWn.exe
  2⤵
  PID:4296
- C:\Windows\System\pkIoDpI.exe
  C:\Windows\System\pkIoDpI.exe
  2⤵
  PID:4360
- C:\Windows\System\JVHMlkg.exe
  C:\Windows\System\JVHMlkg.exe
  2⤵
  PID:4424
- C:\Windows\System\FeoUjKC.exe
  C:\Windows\System\FeoUjKC.exe
  2⤵
  PID:2124
- C:\Windows\System\SJMImRB.exe
  C:\Windows\System\SJMImRB.exe
  2⤵
  PID:4484
- C:\Windows\System\JAPcMcu.exe
  C:\Windows\System\JAPcMcu.exe
  2⤵
  PID:4520
- C:\Windows\System\CDPDQJf.exe
  C:\Windows\System\CDPDQJf.exe
  2⤵
  PID:1740
- C:\Windows\System\WFVyMUX.exe
  C:\Windows\System\WFVyMUX.exe
  2⤵
  PID:2040
- C:\Windows\System\mFmQhIj.exe
  C:\Windows\System\mFmQhIj.exe
  2⤵
  PID:4580
- C:\Windows\System\LIvbzwL.exe
  C:\Windows\System\LIvbzwL.exe
  2⤵
  PID:4472
- C:\Windows\System\bDYFNCj.exe
  C:\Windows\System\bDYFNCj.exe
  2⤵
  PID:4564
- C:\Windows\System\OZHmrht.exe
  C:\Windows\System\OZHmrht.exe
  2⤵
  PID:4644
- C:\Windows\System\VrHMATE.exe
  C:\Windows\System\VrHMATE.exe
  2⤵
  PID:2296
- C:\Windows\System\tbdgIsO.exe
  C:\Windows\System\tbdgIsO.exe
  2⤵
  PID:4664
- C:\Windows\System\jXSNZmw.exe
  C:\Windows\System\jXSNZmw.exe
  2⤵
  PID:4744
- C:\Windows\System\QiezgKN.exe
  C:\Windows\System\QiezgKN.exe
  2⤵
  PID:4780
- C:\Windows\System\dIwdesT.exe
  C:\Windows\System\dIwdesT.exe
  2⤵
  PID:4844
- C:\Windows\System\lLIzEHT.exe
  C:\Windows\System\lLIzEHT.exe
  2⤵
  PID:4876
- C:\Windows\System\KzYGxlZ.exe
  C:\Windows\System\KzYGxlZ.exe
  2⤵
  PID:4908
- C:\Windows\System\VaFgymZ.exe
  C:\Windows\System\VaFgymZ.exe
  2⤵
  PID:4968
- C:\Windows\System\CirfuyT.exe
  C:\Windows\System\CirfuyT.exe
  2⤵
  PID:5000
- C:\Windows\System\CwCrpPu.exe
  C:\Windows\System\CwCrpPu.exe
  2⤵
  PID:5064
- C:\Windows\System\eYTuZlN.exe
  C:\Windows\System\eYTuZlN.exe
  2⤵
  PID:4728
- C:\Windows\System\iUmDcDJ.exe
  C:\Windows\System\iUmDcDJ.exe
  2⤵
  PID:3520
- C:\Windows\System\RxlMzMn.exe
  C:\Windows\System\RxlMzMn.exe
  2⤵
  PID:3620
- C:\Windows\System\BBbQJQh.exe
  C:\Windows\System\BBbQJQh.exe
  2⤵
  PID:1304
- C:\Windows\System\ZvMNrSG.exe
  C:\Windows\System\ZvMNrSG.exe
  2⤵
  PID:4828
- C:\Windows\System\hEJKfUl.exe
  C:\Windows\System\hEJKfUl.exe
  2⤵
  PID:3848
- C:\Windows\System\yPiKvbs.exe
  C:\Windows\System\yPiKvbs.exe
  2⤵
  PID:3876
- C:\Windows\System\SajTIBZ.exe
  C:\Windows\System\SajTIBZ.exe
  2⤵
  PID:4988
- C:\Windows\System\HYpUlBO.exe
  C:\Windows\System\HYpUlBO.exe
  2⤵
  PID:5048
- C:\Windows\System\HQzuvjH.exe
  C:\Windows\System\HQzuvjH.exe
  2⤵
  PID:5112
- C:\Windows\System\MctMLBP.exe
  C:\Windows\System\MctMLBP.exe
  2⤵
  PID:3656
- C:\Windows\System\fTrIOaL.exe
  C:\Windows\System\fTrIOaL.exe
  2⤵
  PID:3912
- C:\Windows\System\UZGgRZV.exe
  C:\Windows\System\UZGgRZV.exe
  2⤵
  PID:2508
- C:\Windows\System\LGysTyB.exe
  C:\Windows\System\LGysTyB.exe
  2⤵
  PID:3092
- C:\Windows\System\ANmmSUm.exe
  C:\Windows\System\ANmmSUm.exe
  2⤵
  PID:4164
- C:\Windows\System\LiGhAqa.exe
  C:\Windows\System\LiGhAqa.exe
  2⤵
  PID:4204
- C:\Windows\System\DdNFvQM.exe
  C:\Windows\System\DdNFvQM.exe
  2⤵
  PID:4312
- C:\Windows\System\gWnuTuh.exe
  C:\Windows\System\gWnuTuh.exe
  2⤵
  PID:3168
- C:\Windows\System\pnHMkLo.exe
  C:\Windows\System\pnHMkLo.exe
  2⤵
  PID:3396
- C:\Windows\System\AhzcQRi.exe
  C:\Windows\System\AhzcQRi.exe
  2⤵
  PID:4180
- C:\Windows\System\YIxKYHy.exe
  C:\Windows\System\YIxKYHy.exe
  2⤵
  PID:3700
- C:\Windows\System\xZTyYCA.exe
  C:\Windows\System\xZTyYCA.exe
  2⤵
  PID:4252
- C:\Windows\System\MpBCySI.exe
  C:\Windows\System\MpBCySI.exe
  2⤵
  PID:4348
- C:\Windows\System\opUZkJO.exe
  C:\Windows\System\opUZkJO.exe
  2⤵
  PID:3800
- C:\Windows\System\MAtFjFm.exe
  C:\Windows\System\MAtFjFm.exe
  2⤵
  PID:3764
- C:\Windows\System\YwObtAe.exe
  C:\Windows\System\YwObtAe.exe
  2⤵
  PID:2496
- C:\Windows\System\qIFUUoo.exe
  C:\Windows\System\qIFUUoo.exe
  2⤵
  PID:4088
- C:\Windows\System\CVQZPWK.exe
  C:\Windows\System\CVQZPWK.exe
  2⤵
  PID:3140
- C:\Windows\System\FsUVSXc.exe
  C:\Windows\System\FsUVSXc.exe
  2⤵
  PID:2176
- C:\Windows\System\aNUOWsr.exe
  C:\Windows\System\aNUOWsr.exe
  2⤵
  PID:2736
- C:\Windows\System\iitFZUn.exe
  C:\Windows\System\iitFZUn.exe
  2⤵
  PID:3456
- C:\Windows\System\MEZgNzM.exe
  C:\Windows\System\MEZgNzM.exe
  2⤵
  PID:4392
- C:\Windows\System\MZkeKpw.exe
  C:\Windows\System\MZkeKpw.exe
  2⤵
  PID:480
- C:\Windows\System\JLvmFyz.exe
  C:\Windows\System\JLvmFyz.exe
  2⤵
  PID:4548
- C:\Windows\System\LLpwmVQ.exe
  C:\Windows\System\LLpwmVQ.exe
  2⤵
  PID:4552
- C:\Windows\System\grzoYpP.exe
  C:\Windows\System\grzoYpP.exe
  2⤵
  PID:2996
- C:\Windows\System\JikZxwK.exe
  C:\Windows\System\JikZxwK.exe
  2⤵
  PID:4536
- C:\Windows\System\yyQYZQa.exe
  C:\Windows\System\yyQYZQa.exe
  2⤵
  PID:4600
- C:\Windows\System\tBGWqVk.exe
  C:\Windows\System\tBGWqVk.exe
  2⤵
  PID:4776
- C:\Windows\System\XmobHId.exe
  C:\Windows\System\XmobHId.exe
  2⤵
  PID:4500
- C:\Windows\System\qzUgJdO.exe
  C:\Windows\System\qzUgJdO.exe
  2⤵
  PID:4936
- C:\Windows\System\NnFXjVQ.exe
  C:\Windows\System\NnFXjVQ.exe
  2⤵
  PID:4904
- C:\Windows\System\PNUYcZM.exe
  C:\Windows\System\PNUYcZM.exe
  2⤵
  PID:5068
- C:\Windows\System\uebqXqU.exe
  C:\Windows\System\uebqXqU.exe
  2⤵
  PID:2976
- C:\Windows\System\SRDuQEw.exe
  C:\Windows\System\SRDuQEw.exe
  2⤵
  PID:4956
- C:\Windows\System\soPIkCX.exe
  C:\Windows\System\soPIkCX.exe
  2⤵
  PID:1784
- C:\Windows\System\vHgKvEc.exe
  C:\Windows\System\vHgKvEc.exe
  2⤵
  PID:1668
- C:\Windows\System\pQQVfXY.exe
  C:\Windows\System\pQQVfXY.exe
  2⤵
  PID:4952
- C:\Windows\System\khyoIvs.exe
  C:\Windows\System\khyoIvs.exe
  2⤵
  PID:5084
- C:\Windows\System\axydDDE.exe
  C:\Windows\System\axydDDE.exe
  2⤵
  PID:1816
- C:\Windows\System\EjpzqyR.exe
  C:\Windows\System\EjpzqyR.exe
  2⤵
  PID:2108
- C:\Windows\System\lFwqxkS.exe
  C:\Windows\System\lFwqxkS.exe
  2⤵
  PID:4216
- C:\Windows\System\llQaSUQ.exe
  C:\Windows\System\llQaSUQ.exe
  2⤵
  PID:1972
- C:\Windows\System\pHvDVkL.exe
  C:\Windows\System\pHvDVkL.exe
  2⤵
  PID:2036
- C:\Windows\System\SeazpBQ.exe
  C:\Windows\System\SeazpBQ.exe
  2⤵
  PID:4376
- C:\Windows\System\GuhbwMF.exe
  C:\Windows\System\GuhbwMF.exe
  2⤵
  PID:3344
- C:\Windows\System\fJxyiHR.exe
  C:\Windows\System\fJxyiHR.exe
  2⤵
  PID:3896
- C:\Windows\System\tgHrRzQ.exe
  C:\Windows\System\tgHrRzQ.exe
  2⤵
  PID:3364
- C:\Windows\System\KhoFbDw.exe
  C:\Windows\System\KhoFbDw.exe
  2⤵
  PID:3568
- C:\Windows\System\OcruRiQ.exe
  C:\Windows\System\OcruRiQ.exe
  2⤵
  PID:4128
- C:\Windows\System\eeQfQgc.exe
  C:\Windows\System\eeQfQgc.exe
  2⤵
  PID:2884
- C:\Windows\System\trsWMQa.exe
  C:\Windows\System\trsWMQa.exe
  2⤵
  PID:4660
- C:\Windows\System\OStRrJN.exe
  C:\Windows\System\OStRrJN.exe
  2⤵
  PID:4808
- C:\Windows\System\kfSJzQD.exe
  C:\Windows\System\kfSJzQD.exe
  2⤵
  PID:2540
- C:\Windows\System\JOetyBo.exe
  C:\Windows\System\JOetyBo.exe
  2⤵
  PID:1724
- C:\Windows\System\AeJWBmI.exe
  C:\Windows\System\AeJWBmI.exe
  2⤵
  PID:2528
- C:\Windows\System\fYHhhoo.exe
  C:\Windows\System\fYHhhoo.exe
  2⤵
  PID:2888
- C:\Windows\System\uxaSPBU.exe
  C:\Windows\System\uxaSPBU.exe
  2⤵
  PID:3604
- C:\Windows\System\YTANpsI.exe
  C:\Windows\System\YTANpsI.exe
  2⤵
  PID:3264
- C:\Windows\System\SSdVSyN.exe
  C:\Windows\System\SSdVSyN.exe
  2⤵
  PID:3616
- C:\Windows\System\pSHQTJa.exe
  C:\Windows\System\pSHQTJa.exe
  2⤵
  PID:4196
- C:\Windows\System\dLkywre.exe
  C:\Windows\System\dLkywre.exe
  2⤵
  PID:3924
- C:\Windows\System\ZHCUpRN.exe
  C:\Windows\System\ZHCUpRN.exe
  2⤵
  PID:1532
- C:\Windows\System\LCnTHyU.exe
  C:\Windows\System\LCnTHyU.exe
  2⤵
  PID:3472
- C:\Windows\System\gwDazqC.exe
  C:\Windows\System\gwDazqC.exe
  2⤵
  PID:2840
- C:\Windows\System\aVQVeBW.exe
  C:\Windows\System\aVQVeBW.exe
  2⤵
  PID:2024
- C:\Windows\System\aDbCeFG.exe
  C:\Windows\System\aDbCeFG.exe
  2⤵
  PID:2948
- C:\Windows\System\hwzMAbg.exe
  C:\Windows\System\hwzMAbg.exe
  2⤵
  PID:4684
- C:\Windows\System\aVdqxht.exe
  C:\Windows\System\aVdqxht.exe
  2⤵
  PID:5096
- C:\Windows\System\yrhnXCr.exe
  C:\Windows\System\yrhnXCr.exe
  2⤵
  PID:2552
- C:\Windows\System\mNvMRcl.exe
  C:\Windows\System\mNvMRcl.exe
  2⤵
  PID:3392
- C:\Windows\System\JUdXRgQ.exe
  C:\Windows\System\JUdXRgQ.exe
  2⤵
  PID:3988
- C:\Windows\System\FgLiEMT.exe
  C:\Windows\System\FgLiEMT.exe
  2⤵
  PID:2612
- C:\Windows\System\CIzZUxS.exe
  C:\Windows\System\CIzZUxS.exe
  2⤵
  PID:4068
- C:\Windows\System\iajApbe.exe
  C:\Windows\System\iajApbe.exe
  2⤵
  PID:4052
- C:\Windows\System\xIitvkv.exe
  C:\Windows\System\xIitvkv.exe
  2⤵
  PID:5128
- C:\Windows\System\LTlVHZa.exe
  C:\Windows\System\LTlVHZa.exe
  2⤵
  PID:5148
- C:\Windows\System\ziRiUZj.exe
  C:\Windows\System\ziRiUZj.exe
  2⤵
  PID:5164
- C:\Windows\System\mCeKIft.exe
  C:\Windows\System\mCeKIft.exe
  2⤵
  PID:5180
- C:\Windows\System\pXCYrnz.exe
  C:\Windows\System\pXCYrnz.exe
  2⤵
  PID:5196
- C:\Windows\System\rCLpqpo.exe
  C:\Windows\System\rCLpqpo.exe
  2⤵
  PID:5212
- C:\Windows\System\qBIToqI.exe
  C:\Windows\System\qBIToqI.exe
  2⤵
  PID:5232
- C:\Windows\System\cishMJV.exe
  C:\Windows\System\cishMJV.exe
  2⤵
  PID:5248
- C:\Windows\System\VZVfkWa.exe
  C:\Windows\System\VZVfkWa.exe
  2⤵
  PID:5264
- C:\Windows\System\TkTFnBo.exe
  C:\Windows\System\TkTFnBo.exe
  2⤵
  PID:5280
- C:\Windows\System\GUfjgJD.exe
  C:\Windows\System\GUfjgJD.exe
  2⤵
  PID:5296
- C:\Windows\System\wleDZQv.exe
  C:\Windows\System\wleDZQv.exe
  2⤵
  PID:5312
- C:\Windows\System\lYyAVZv.exe
  C:\Windows\System\lYyAVZv.exe
  2⤵
  PID:5328
- C:\Windows\System\ncsAatf.exe
  C:\Windows\System\ncsAatf.exe
  2⤵
  PID:5344
- C:\Windows\System\TMmggsW.exe
  C:\Windows\System\TMmggsW.exe
  2⤵
  PID:5360
- C:\Windows\System\AWuCwED.exe
  C:\Windows\System\AWuCwED.exe
  2⤵
  PID:5376
- C:\Windows\System\oaTGqAy.exe
  C:\Windows\System\oaTGqAy.exe
  2⤵
  PID:5392
- C:\Windows\System\vzsENnx.exe
  C:\Windows\System\vzsENnx.exe
  2⤵
  PID:5408
- C:\Windows\System\MehphVg.exe
  C:\Windows\System\MehphVg.exe
  2⤵
  PID:5424
- C:\Windows\System\DuPpZtr.exe
  C:\Windows\System\DuPpZtr.exe
  2⤵
  PID:5440
- C:\Windows\System\dxTygeE.exe
  C:\Windows\System\dxTygeE.exe
  2⤵
  PID:5456
- C:\Windows\System\nGQAkEj.exe
  C:\Windows\System\nGQAkEj.exe
  2⤵
  PID:5472
- C:\Windows\System\gctfvlN.exe
  C:\Windows\System\gctfvlN.exe
  2⤵
  PID:5488
- C:\Windows\System\yZNzsvG.exe
  C:\Windows\System\yZNzsvG.exe
  2⤵
  PID:5504
- C:\Windows\System\VhqkJsB.exe
  C:\Windows\System\VhqkJsB.exe
  2⤵
  PID:5520
- C:\Windows\System\tliQbgW.exe
  C:\Windows\System\tliQbgW.exe
  2⤵
  PID:5536
- C:\Windows\System\weuYkFJ.exe
  C:\Windows\System\weuYkFJ.exe
  2⤵
  PID:5552
- C:\Windows\System\sfjRTuK.exe
  C:\Windows\System\sfjRTuK.exe
  2⤵
  PID:5568
- C:\Windows\System\JKZpwpc.exe
  C:\Windows\System\JKZpwpc.exe
  2⤵
  PID:5584
- C:\Windows\System\uDRUgzu.exe
  C:\Windows\System\uDRUgzu.exe
  2⤵
  PID:5600
- C:\Windows\System\kOWcfae.exe
  C:\Windows\System\kOWcfae.exe
  2⤵
  PID:5616
- C:\Windows\System\HAxMttc.exe
  C:\Windows\System\HAxMttc.exe
  2⤵
  PID:5632
- C:\Windows\System\SUxxSFr.exe
  C:\Windows\System\SUxxSFr.exe
  2⤵
  PID:5648
- C:\Windows\System\IzjrRBs.exe
  C:\Windows\System\IzjrRBs.exe
  2⤵
  PID:5664
- C:\Windows\System\TCqsjYj.exe
  C:\Windows\System\TCqsjYj.exe
  2⤵
  PID:5684
- C:\Windows\System\cHfQvtO.exe
  C:\Windows\System\cHfQvtO.exe
  2⤵
  PID:5700
- C:\Windows\System\XARCMPZ.exe
  C:\Windows\System\XARCMPZ.exe
  2⤵
  PID:5716
- C:\Windows\System\nDNExJU.exe
  C:\Windows\System\nDNExJU.exe
  2⤵
  PID:5732
- C:\Windows\System\tcgxiyI.exe
  C:\Windows\System\tcgxiyI.exe
  2⤵
  PID:5748
- C:\Windows\System\SLtSFBS.exe
  C:\Windows\System\SLtSFBS.exe
  2⤵
  PID:5764
- C:\Windows\System\OvaDmeo.exe
  C:\Windows\System\OvaDmeo.exe
  2⤵
  PID:5780
- C:\Windows\System\rSGYjVW.exe
  C:\Windows\System\rSGYjVW.exe
  2⤵
  PID:5796
- C:\Windows\System\rkBiPza.exe
  C:\Windows\System\rkBiPza.exe
  2⤵
  PID:5812
- C:\Windows\System\uIIwbmv.exe
  C:\Windows\System\uIIwbmv.exe
  2⤵
  PID:5828
- C:\Windows\System\lNtvEdF.exe
  C:\Windows\System\lNtvEdF.exe
  2⤵
  PID:5844
- C:\Windows\System\RkutQMF.exe
  C:\Windows\System\RkutQMF.exe
  2⤵
  PID:5860
- C:\Windows\System\ZDfRBjH.exe
  C:\Windows\System\ZDfRBjH.exe
  2⤵
  PID:5876
- C:\Windows\System\WbdYRco.exe
  C:\Windows\System\WbdYRco.exe
  2⤵
  PID:5892
- C:\Windows\System\IPTNxNp.exe
  C:\Windows\System\IPTNxNp.exe
  2⤵
  PID:5908
- C:\Windows\System\GYSqaLN.exe
  C:\Windows\System\GYSqaLN.exe
  2⤵
  PID:5924
- C:\Windows\System\MuGAVfW.exe
  C:\Windows\System\MuGAVfW.exe
  2⤵
  PID:5940
- C:\Windows\System\gOelleA.exe
  C:\Windows\System\gOelleA.exe
  2⤵
  PID:5956
- C:\Windows\System\zVqTVEk.exe
  C:\Windows\System\zVqTVEk.exe
  2⤵
  PID:5972
- C:\Windows\System\oROicCZ.exe
  C:\Windows\System\oROicCZ.exe
  2⤵
  PID:5988
- C:\Windows\System\PKfTSgx.exe
  C:\Windows\System\PKfTSgx.exe
  2⤵
  PID:6004
- C:\Windows\System\cGZRyXd.exe
  C:\Windows\System\cGZRyXd.exe
  2⤵
  PID:6020
- C:\Windows\System\BBTRlRU.exe
  C:\Windows\System\BBTRlRU.exe
  2⤵
  PID:6036
- C:\Windows\System\lYTOfnM.exe
  C:\Windows\System\lYTOfnM.exe
  2⤵
  PID:6052
- C:\Windows\System\CRdPJay.exe
  C:\Windows\System\CRdPJay.exe
  2⤵
  PID:6068
- C:\Windows\System\GMnHehE.exe
  C:\Windows\System\GMnHehE.exe
  2⤵
  PID:6084
- C:\Windows\System\rQASQCd.exe
  C:\Windows\System\rQASQCd.exe
  2⤵
  PID:6100
- C:\Windows\System\ACTiyBZ.exe
  C:\Windows\System\ACTiyBZ.exe
  2⤵
  PID:6116
- C:\Windows\System\XfRlzxW.exe
  C:\Windows\System\XfRlzxW.exe
  2⤵
  PID:6132
- C:\Windows\System\EyuzRpl.exe
  C:\Windows\System\EyuzRpl.exe
  2⤵
  PID:4284
- C:\Windows\System\XzLpFzL.exe
  C:\Windows\System\XzLpFzL.exe
  2⤵
  PID:5156
- C:\Windows\System\MVswrdN.exe
  C:\Windows\System\MVswrdN.exe
  2⤵
  PID:5220
- C:\Windows\System\qpSihdi.exe
  C:\Windows\System\qpSihdi.exe
  2⤵
  PID:5256
- C:\Windows\System\qntkZBp.exe
  C:\Windows\System\qntkZBp.exe
  2⤵
  PID:5292
- C:\Windows\System\CAioqUA.exe
  C:\Windows\System\CAioqUA.exe
  2⤵
  PID:5240
- C:\Windows\System\jYKJshb.exe
  C:\Windows\System\jYKJshb.exe
  2⤵
  PID:5356
- C:\Windows\System\LdvSpbU.exe
  C:\Windows\System\LdvSpbU.exe
  2⤵
  PID:5384
- C:\Windows\System\BJJTEqc.exe
  C:\Windows\System\BJJTEqc.exe
  2⤵
  PID:4024
- C:\Windows\System\FtEhehu.exe
  C:\Windows\System\FtEhehu.exe
  2⤵
  PID:5208
- C:\Windows\System\SojdhEL.exe
  C:\Windows\System\SojdhEL.exe
  2⤵
  PID:3748
- C:\Windows\System\diBRFOG.exe
  C:\Windows\System\diBRFOG.exe
  2⤵
  PID:5140
- C:\Windows\System\GYLoYAi.exe
  C:\Windows\System\GYLoYAi.exe
  2⤵
  PID:5340
- C:\Windows\System\oSCEDny.exe
  C:\Windows\System\oSCEDny.exe
  2⤵
  PID:5516
- C:\Windows\System\KOvvUMx.exe
  C:\Windows\System\KOvvUMx.exe
  2⤵
  PID:5372
- C:\Windows\System\aYbBgVq.exe
  C:\Windows\System\aYbBgVq.exe
  2⤵
  PID:5436
- C:\Windows\System\DfpiBez.exe
  C:\Windows\System\DfpiBez.exe
  2⤵
  PID:5608
- C:\Windows\System\zMBPXWT.exe
  C:\Windows\System\zMBPXWT.exe
  2⤵
  PID:5496
- C:\Windows\System\XJhCMSe.exe
  C:\Windows\System\XJhCMSe.exe
  2⤵
  PID:5640
- C:\Windows\System\JjsSFJt.exe
  C:\Windows\System\JjsSFJt.exe
  2⤵
  PID:5680
- C:\Windows\System\ZPUCFzR.exe
  C:\Windows\System\ZPUCFzR.exe
  2⤵
  PID:5596
- C:\Windows\System\RxFnCJv.exe
  C:\Windows\System\RxFnCJv.exe
  2⤵
  PID:5708
- C:\Windows\System\DIFJXdo.exe
  C:\Windows\System\DIFJXdo.exe
  2⤵
  PID:5692
- C:\Windows\System\jguBzRy.exe
  C:\Windows\System\jguBzRy.exe
  2⤵
  PID:5696
- C:\Windows\System\ySvqDJT.exe
  C:\Windows\System\ySvqDJT.exe
  2⤵
  PID:5868
- C:\Windows\System\nWnhJmH.exe
  C:\Windows\System\nWnhJmH.exe
  2⤵
  PID:5900
- C:\Windows\System\ZFPSjFO.exe
  C:\Windows\System\ZFPSjFO.exe
  2⤵
  PID:5728
- C:\Windows\System\jQQxqRk.exe
  C:\Windows\System\jQQxqRk.exe
  2⤵
  PID:5852
- C:\Windows\System\pMTneiZ.exe
  C:\Windows\System\pMTneiZ.exe
  2⤵
  PID:5916
- C:\Windows\System\NYgvqmC.exe
  C:\Windows\System\NYgvqmC.exe
  2⤵
  PID:5968
- C:\Windows\System\nPVEgud.exe
  C:\Windows\System\nPVEgud.exe
  2⤵
  PID:5984
- C:\Windows\System\WagXlNb.exe
  C:\Windows\System\WagXlNb.exe
  2⤵
  PID:5920
- C:\Windows\System\gFKNVZS.exe
  C:\Windows\System\gFKNVZS.exe
  2⤵
  PID:6092
- C:\Windows\System\oxlyWPb.exe
  C:\Windows\System\oxlyWPb.exe
  2⤵
  PID:6080
- C:\Windows\System\AwgOVpV.exe
  C:\Windows\System\AwgOVpV.exe
  2⤵
  PID:5124
- C:\Windows\System\AwrLHns.exe
  C:\Windows\System\AwrLHns.exe
  2⤵
  PID:6048
- C:\Windows\System\qLcScbg.exe
  C:\Windows\System\qLcScbg.exe
  2⤵
  PID:6112
- C:\Windows\System\XlnmIOt.exe
  C:\Windows\System\XlnmIOt.exe
  2⤵
  PID:6076
- C:\Windows\System\oOCxMLa.exe
  C:\Windows\System\oOCxMLa.exe
  2⤵
  PID:4764
- C:\Windows\System\tDJYrgC.exe
  C:\Windows\System\tDJYrgC.exe
  2⤵
  PID:4920
- C:\Windows\System\ytyQkuK.exe
  C:\Windows\System\ytyQkuK.exe
  2⤵
  PID:5136
- C:\Windows\System\NGjEruK.exe
  C:\Windows\System\NGjEruK.exe
  2⤵
  PID:5400
- C:\Windows\System\zABODSt.exe
  C:\Windows\System\zABODSt.exe
  2⤵
  PID:5672
- C:\Windows\System\QGRIVGj.exe
  C:\Windows\System\QGRIVGj.exe
  2⤵
  PID:5624
- C:\Windows\System\VVsfsQD.exe
  C:\Windows\System\VVsfsQD.exe
  2⤵
  PID:5840
- C:\Windows\System\auxqtDx.exe
  C:\Windows\System\auxqtDx.exe
  2⤵
  PID:5872
- C:\Windows\System\qRezEmj.exe
  C:\Windows\System\qRezEmj.exe
  2⤵
  PID:5788
- C:\Windows\System\qJUcWyX.exe
  C:\Windows\System\qJUcWyX.exe
  2⤵
  PID:5952
- C:\Windows\System\JhOEbgb.exe
  C:\Windows\System\JhOEbgb.exe
  2⤵
  PID:5452
- C:\Windows\System\UjtlEZr.exe
  C:\Windows\System\UjtlEZr.exe
  2⤵
  PID:5740
- C:\Windows\System\IuAlRjs.exe
  C:\Windows\System\IuAlRjs.exe
  2⤵
  PID:5792
- C:\Windows\System\rdpnbXQ.exe
  C:\Windows\System\rdpnbXQ.exe
  2⤵
  PID:6160
- C:\Windows\System\ZfJaUoR.exe
  C:\Windows\System\ZfJaUoR.exe
  2⤵
  PID:6176
- C:\Windows\System\jhLpItW.exe
  C:\Windows\System\jhLpItW.exe
  2⤵
  PID:6192
- C:\Windows\System\XwptnJF.exe
  C:\Windows\System\XwptnJF.exe
  2⤵
  PID:6208
- C:\Windows\System\FqllqhE.exe
  C:\Windows\System\FqllqhE.exe
  2⤵
  PID:6224
- C:\Windows\System\mGnPTAj.exe
  C:\Windows\System\mGnPTAj.exe
  2⤵
  PID:6240
- C:\Windows\System\SgxFFoJ.exe
  C:\Windows\System\SgxFFoJ.exe
  2⤵
  PID:6256
- C:\Windows\System\iuTXMDg.exe
  C:\Windows\System\iuTXMDg.exe
  2⤵
  PID:6272
- C:\Windows\System\UkGJgEp.exe
  C:\Windows\System\UkGJgEp.exe
  2⤵
  PID:6288
- C:\Windows\System\cvirTsX.exe
  C:\Windows\System\cvirTsX.exe
  2⤵
  PID:6304
- C:\Windows\System\nlvAtGc.exe
  C:\Windows\System\nlvAtGc.exe
  2⤵
  PID:6320
- C:\Windows\System\PmTpNge.exe
  C:\Windows\System\PmTpNge.exe
  2⤵
  PID:6336
- C:\Windows\System\xkWOjPz.exe
  C:\Windows\System\xkWOjPz.exe
  2⤵
  PID:6352
- C:\Windows\System\pPCdyLL.exe
  C:\Windows\System\pPCdyLL.exe
  2⤵
  PID:6368
- C:\Windows\System\KJPpIkP.exe
  C:\Windows\System\KJPpIkP.exe
  2⤵
  PID:6384
- C:\Windows\System\PBmAvOJ.exe
  C:\Windows\System\PBmAvOJ.exe
  2⤵
  PID:6400
- C:\Windows\System\NRftYTk.exe
  C:\Windows\System\NRftYTk.exe
  2⤵
  PID:6416
- C:\Windows\System\ULAKhEN.exe
  C:\Windows\System\ULAKhEN.exe
  2⤵
  PID:6432
- C:\Windows\System\vRaZztj.exe
  C:\Windows\System\vRaZztj.exe
  2⤵
  PID:6448
- C:\Windows\System\IIRTFMw.exe
  C:\Windows\System\IIRTFMw.exe
  2⤵
  PID:6464
- C:\Windows\System\GHJxxBH.exe
  C:\Windows\System\GHJxxBH.exe
  2⤵
  PID:6480
- C:\Windows\System\TyePtOe.exe
  C:\Windows\System\TyePtOe.exe
  2⤵
  PID:6496
- C:\Windows\System\LvumLJT.exe
  C:\Windows\System\LvumLJT.exe
  2⤵
  PID:6512
- C:\Windows\System\ecmWvMK.exe
  C:\Windows\System\ecmWvMK.exe
  2⤵
  PID:6528
- C:\Windows\System\iwXILmv.exe
  C:\Windows\System\iwXILmv.exe
  2⤵
  PID:6544
- C:\Windows\System\aGnlfYu.exe
  C:\Windows\System\aGnlfYu.exe
  2⤵
  PID:6560
- C:\Windows\System\rxqGOYH.exe
  C:\Windows\System\rxqGOYH.exe
  2⤵
  PID:6576
- C:\Windows\System\BCPkcSd.exe
  C:\Windows\System\BCPkcSd.exe
  2⤵
  PID:6592
- C:\Windows\System\YLqtzjW.exe
  C:\Windows\System\YLqtzjW.exe
  2⤵
  PID:6608
- C:\Windows\System\JFtjfPB.exe
  C:\Windows\System\JFtjfPB.exe
  2⤵
  PID:6624
- C:\Windows\System\zaqpfEU.exe
  C:\Windows\System\zaqpfEU.exe
  2⤵
  PID:6640
- C:\Windows\System\QGIRjqr.exe
  C:\Windows\System\QGIRjqr.exe
  2⤵
  PID:6656
- C:\Windows\System\tBCcbBk.exe
  C:\Windows\System\tBCcbBk.exe
  2⤵
  PID:6672
- C:\Windows\System\pUYDoRn.exe
  C:\Windows\System\pUYDoRn.exe
  2⤵
  PID:6692
- C:\Windows\System\RyEGLQh.exe
  C:\Windows\System\RyEGLQh.exe
  2⤵
  PID:6708
- C:\Windows\System\CiXNLug.exe
  C:\Windows\System\CiXNLug.exe
  2⤵
  PID:6724
- C:\Windows\System\BTBHnvg.exe
  C:\Windows\System\BTBHnvg.exe
  2⤵
  PID:6740
- C:\Windows\System\tFpDSiC.exe
  C:\Windows\System\tFpDSiC.exe
  2⤵
  PID:6756
- C:\Windows\System\MhaRxay.exe
  C:\Windows\System\MhaRxay.exe
  2⤵
  PID:6772
- C:\Windows\System\btuMeHC.exe
  C:\Windows\System\btuMeHC.exe
  2⤵
  PID:6788
- C:\Windows\System\GcOoeBF.exe
  C:\Windows\System\GcOoeBF.exe
  2⤵
  PID:6804
- C:\Windows\System\csFQwHt.exe
  C:\Windows\System\csFQwHt.exe
  2⤵
  PID:6820
- C:\Windows\System\rvnwSWT.exe
  C:\Windows\System\rvnwSWT.exe
  2⤵
  PID:6836
- C:\Windows\System\wdqtypP.exe
  C:\Windows\System\wdqtypP.exe
  2⤵
  PID:6856
- C:\Windows\System\ghEGuts.exe
  C:\Windows\System\ghEGuts.exe
  2⤵
  PID:6876
- C:\Windows\System\RCsgDAH.exe
  C:\Windows\System\RCsgDAH.exe
  2⤵
  PID:6892
- C:\Windows\System\AEpUmSL.exe
  C:\Windows\System\AEpUmSL.exe
  2⤵
  PID:6912
- C:\Windows\System\ucrGNfT.exe
  C:\Windows\System\ucrGNfT.exe
  2⤵
  PID:6940
- C:\Windows\System\YeeglVz.exe
  C:\Windows\System\YeeglVz.exe
  2⤵
  PID:6956
- C:\Windows\System\zTsUcDT.exe
  C:\Windows\System\zTsUcDT.exe
  2⤵
  PID:6972
- C:\Windows\System\AUKdlpT.exe
  C:\Windows\System\AUKdlpT.exe
  2⤵
  PID:6988
- C:\Windows\System\MyccOHv.exe
  C:\Windows\System\MyccOHv.exe
  2⤵
  PID:7004
- C:\Windows\System\vhLjHqo.exe
  C:\Windows\System\vhLjHqo.exe
  2⤵
  PID:7020
- C:\Windows\System\ZgjDIWC.exe
  C:\Windows\System\ZgjDIWC.exe
  2⤵
  PID:7036
- C:\Windows\System\NwCeYzx.exe
  C:\Windows\System\NwCeYzx.exe
  2⤵
  PID:7052
- C:\Windows\System\QuAYeJo.exe
  C:\Windows\System\QuAYeJo.exe
  2⤵
  PID:7068
- C:\Windows\System\ekWRgvs.exe
  C:\Windows\System\ekWRgvs.exe
  2⤵
  PID:7084
- C:\Windows\System\pYnLBsE.exe
  C:\Windows\System\pYnLBsE.exe
  2⤵
  PID:7100
- C:\Windows\System\HXGPHQv.exe
  C:\Windows\System\HXGPHQv.exe
  2⤵
  PID:7132
- C:\Windows\System\jnKTKUl.exe
  C:\Windows\System\jnKTKUl.exe
  2⤵
  PID:7152
- C:\Windows\System\ouKabOP.exe
  C:\Windows\System\ouKabOP.exe
  2⤵
  PID:5484
- C:\Windows\System\LEMqSPJ.exe
  C:\Windows\System\LEMqSPJ.exe
  2⤵
  PID:5324
- C:\Windows\System\RCIYyTM.exe
  C:\Windows\System\RCIYyTM.exe
  2⤵
  PID:5888
- C:\Windows\System\gXJLrMA.exe
  C:\Windows\System\gXJLrMA.exe
  2⤵
  PID:5804
- C:\Windows\System\NaEdjad.exe
  C:\Windows\System\NaEdjad.exe
  2⤵
  PID:5756
- C:\Windows\System\kPmHAPl.exe
  C:\Windows\System\kPmHAPl.exe
  2⤵
  PID:6172
- C:\Windows\System\mjARyBI.exe
  C:\Windows\System\mjARyBI.exe
  2⤵
  PID:5228
- C:\Windows\System\mrVVcgJ.exe
  C:\Windows\System\mrVVcgJ.exe
  2⤵
  PID:4872
- C:\Windows\System\hhODVzh.exe
  C:\Windows\System\hhODVzh.exe
  2⤵
  PID:5560
- C:\Windows\System\fPyzZBQ.exe
  C:\Windows\System\fPyzZBQ.exe
  2⤵
  PID:5564
- C:\Windows\System\hfqytke.exe
  C:\Windows\System\hfqytke.exe
  2⤵
  PID:5980
- C:\Windows\System\AHdrNQk.exe
  C:\Windows\System\AHdrNQk.exe
  2⤵
  PID:6184
- C:\Windows\System\jUXhcau.exe
  C:\Windows\System\jUXhcau.exe
  2⤵
  PID:6252
- C:\Windows\System\UQMSnjO.exe
  C:\Windows\System\UQMSnjO.exe
  2⤵
  PID:6236
- C:\Windows\System\YbTTIOO.exe
  C:\Windows\System\YbTTIOO.exe
  2⤵
  PID:6536
- C:\Windows\System\qutBpqZ.exe
  C:\Windows\System\qutBpqZ.exe
  2⤵
  PID:6348
- C:\Windows\System\AViDaBl.exe
  C:\Windows\System\AViDaBl.exe
  2⤵
  PID:6412
- C:\Windows\System\aliRwEP.exe
  C:\Windows\System\aliRwEP.exe
  2⤵
  PID:6476
- C:\Windows\System\DieQytY.exe
  C:\Windows\System\DieQytY.exe
  2⤵
  PID:4004
- C:\Windows\System\LUOcToh.exe
  C:\Windows\System\LUOcToh.exe
  2⤵
  PID:6572
- C:\Windows\System\nuqhZdp.exe
  C:\Windows\System\nuqhZdp.exe
  2⤵
  PID:6520
- C:\Windows\System\vCINRJi.exe
  C:\Windows\System\vCINRJi.exe
  2⤵
  PID:6268
- C:\Windows\System\rYIJupp.exe
  C:\Windows\System\rYIJupp.exe
  2⤵
  PID:6700
- C:\Windows\System\oRVPzCZ.exe
  C:\Windows\System\oRVPzCZ.exe
  2⤵
  PID:7076
- C:\Windows\System\DBJExoU.exe
  C:\Windows\System\DBJExoU.exe
  2⤵
  PID:7140
- C:\Windows\System\gXsWUuS.exe
  C:\Windows\System\gXsWUuS.exe
  2⤵
  PID:6012
- C:\Windows\System\KNncnfM.exe
  C:\Windows\System\KNncnfM.exe
  2⤵
  PID:6168
- C:\Windows\System\YfbGsFR.exe
  C:\Windows\System\YfbGsFR.exe
  2⤵
  PID:5336
- C:\Windows\System\MjHqnRq.exe
  C:\Windows\System\MjHqnRq.exe
  2⤵
  PID:6284
- C:\Windows\System\johjdqX.exe
  C:\Windows\System\johjdqX.exe
  2⤵
  PID:6296
- C:\Windows\System\hJHerFn.exe
  C:\Windows\System\hJHerFn.exe
  2⤵
  PID:6604
- C:\Windows\System\gbPUBAU.exe
  C:\Windows\System\gbPUBAU.exe
  2⤵
  PID:5020
- C:\Windows\System\zaUmyuz.exe
  C:\Windows\System\zaUmyuz.exe
  2⤵
  PID:6156
- C:\Windows\System\WVZSrki.exe
  C:\Windows\System\WVZSrki.exe
  2⤵
  PID:6472
- C:\Windows\System\CfRnrsa.exe
  C:\Windows\System\CfRnrsa.exe
  2⤵
  PID:6568
- C:\Windows\System\Wbmkacm.exe
  C:\Windows\System\Wbmkacm.exe
  2⤵
  PID:6736
- C:\Windows\System\dcShaLu.exe
  C:\Windows\System\dcShaLu.exe
  2⤵
  PID:412
- C:\Windows\System\SYegDdf.exe
  C:\Windows\System\SYegDdf.exe
  2⤵
  PID:6864
- C:\Windows\System\cQXbxxS.exe
  C:\Windows\System\cQXbxxS.exe
  2⤵
  PID:6360
- C:\Windows\System\hvlmESP.exe
  C:\Windows\System\hvlmESP.exe
  2⤵
  PID:6424
- C:\Windows\System\omvFuFb.exe
  C:\Windows\System\omvFuFb.exe
  2⤵
  PID:6488
- C:\Windows\System\UBwWcKE.exe
  C:\Windows\System\UBwWcKE.exe
  2⤵
  PID:6908
- C:\Windows\System\pPdCUul.exe
  C:\Windows\System\pPdCUul.exe
  2⤵
  PID:6648
- C:\Windows\System\ecUHJir.exe
  C:\Windows\System\ecUHJir.exe
  2⤵
  PID:6784
- C:\Windows\System\MQeRvcC.exe
  C:\Windows\System\MQeRvcC.exe
  2⤵
  PID:6888
- C:\Windows\System\YfOdOlp.exe
  C:\Windows\System\YfOdOlp.exe
  2⤵
  PID:6952
- C:\Windows\System\uLIjTOe.exe
  C:\Windows\System\uLIjTOe.exe
  2⤵
  PID:6852
- C:\Windows\System\NArFujH.exe
  C:\Windows\System\NArFujH.exe
  2⤵
  PID:7160
- C:\Windows\System\RLfxqzO.exe
  C:\Windows\System\RLfxqzO.exe
  2⤵
  PID:6964
- C:\Windows\System\SlbNSGr.exe
  C:\Windows\System\SlbNSGr.exe
  2⤵
  PID:7032
- C:\Windows\System\WPOeSqw.exe
  C:\Windows\System\WPOeSqw.exe
  2⤵
  PID:6128
- C:\Windows\System\hHwxgpG.exe
  C:\Windows\System\hHwxgpG.exe
  2⤵
  PID:2804
- C:\Windows\System\USMLEid.exe
  C:\Windows\System\USMLEid.exe
  2⤵
  PID:6796
- C:\Windows\System\USKDsgG.exe
  C:\Windows\System\USKDsgG.exe
  2⤵
  PID:6900
- C:\Windows\System\EjiFxmg.exe
  C:\Windows\System\EjiFxmg.exe
  2⤵
  PID:5660
- C:\Windows\System\TwWFFDa.exe
  C:\Windows\System\TwWFFDa.exe
  2⤵
  PID:6620
- C:\Windows\System\GHJuzWD.exe
  C:\Windows\System\GHJuzWD.exe
  2⤵
  PID:6748
- C:\Windows\System\QISdiNn.exe
  C:\Windows\System\QISdiNn.exe
  2⤵
  PID:448
- C:\Windows\System\MpErdFY.exe
  C:\Windows\System\MpErdFY.exe
  2⤵
  PID:6968
- C:\Windows\System\eaYXdgY.exe
  C:\Windows\System\eaYXdgY.exe
  2⤵
  PID:2748
- C:\Windows\System\XMYYVsv.exe
  C:\Windows\System\XMYYVsv.exe
  2⤵
  PID:6848
- C:\Windows\System\zLdyRoF.exe
  C:\Windows\System\zLdyRoF.exe
  2⤵
  PID:7044
- C:\Windows\System\zaTGDgg.exe
  C:\Windows\System\zaTGDgg.exe
  2⤵
  PID:7116
- C:\Windows\System\nenBOxJ.exe
  C:\Windows\System\nenBOxJ.exe
  2⤵
  PID:6556
- C:\Windows\System\AGENAcI.exe
  C:\Windows\System\AGENAcI.exe
  2⤵
  PID:6752
- C:\Windows\System\cgXDjNB.exe
  C:\Windows\System\cgXDjNB.exe
  2⤵
  PID:7112
- C:\Windows\System\AobQHlL.exe
  C:\Windows\System\AobQHlL.exe
  2⤵
  PID:7092
- C:\Windows\System\uGcOuqJ.exe
  C:\Windows\System\uGcOuqJ.exe
  2⤵
  PID:5288
- C:\Windows\System\fYgVdcV.exe
  C:\Windows\System\fYgVdcV.exe
  2⤵
  PID:1372
- C:\Windows\System\UjZpCjf.exe
  C:\Windows\System\UjZpCjf.exe
  2⤵
  PID:5176
- C:\Windows\System\VhCsEYn.exe
  C:\Windows\System\VhCsEYn.exe
  2⤵
  PID:6408
- C:\Windows\System\NAWMWVX.exe
  C:\Windows\System\NAWMWVX.exe
  2⤵
  PID:5884
- C:\Windows\System\rXBhAZi.exe
  C:\Windows\System\rXBhAZi.exe
  2⤵
  PID:6444
- C:\Windows\System\AqplKpP.exe
  C:\Windows\System\AqplKpP.exe
  2⤵
  PID:2092
- C:\Windows\System\JFiKANH.exe
  C:\Windows\System\JFiKANH.exe
  2⤵
  PID:7172
- C:\Windows\System\gILcWuF.exe
  C:\Windows\System\gILcWuF.exe
  2⤵
  PID:7188
- C:\Windows\System\pxEoLaV.exe
  C:\Windows\System\pxEoLaV.exe
  2⤵
  PID:7204
- C:\Windows\System\ddomfEL.exe
  C:\Windows\System\ddomfEL.exe
  2⤵
  PID:7220
- C:\Windows\System\QuoxMxX.exe
  C:\Windows\System\QuoxMxX.exe
  2⤵
  PID:7872
- C:\Windows\System\AAPIEoK.exe
  C:\Windows\System\AAPIEoK.exe
  2⤵
  PID:7888
- C:\Windows\System\aRYEwZX.exe
  C:\Windows\System\aRYEwZX.exe
  2⤵
  PID:7904
- C:\Windows\System\KczDoYW.exe
  C:\Windows\System\KczDoYW.exe
  2⤵
  PID:7924
- C:\Windows\System\RezwHMx.exe
  C:\Windows\System\RezwHMx.exe
  2⤵
  PID:7940
- C:\Windows\System\tPZTCrq.exe
  C:\Windows\System\tPZTCrq.exe
  2⤵
  PID:7964
- C:\Windows\System\xQtvPiI.exe
  C:\Windows\System\xQtvPiI.exe
  2⤵
  PID:7980
- C:\Windows\System\wBUzRys.exe
  C:\Windows\System\wBUzRys.exe
  2⤵
  PID:7996
- C:\Windows\System\bEqzKsF.exe
  C:\Windows\System\bEqzKsF.exe
  2⤵
  PID:8012
- C:\Windows\System\zPeWDnn.exe
  C:\Windows\System\zPeWDnn.exe
  2⤵
  PID:8028
- C:\Windows\System\xCQQJEB.exe
  C:\Windows\System\xCQQJEB.exe
  2⤵
  PID:8052
- C:\Windows\System\gmHPlEF.exe
  C:\Windows\System\gmHPlEF.exe
  2⤵
  PID:8068
- C:\Windows\System\jZitwRm.exe
  C:\Windows\System\jZitwRm.exe
  2⤵
  PID:8092
- C:\Windows\System\zujjNXh.exe
  C:\Windows\System\zujjNXh.exe
  2⤵
  PID:6928
- C:\Windows\System\BIamRoR.exe
  C:\Windows\System\BIamRoR.exe
  2⤵
  PID:6248
- C:\Windows\System\FYiAfJx.exe
  C:\Windows\System\FYiAfJx.exe
  2⤵
  PID:6380
- C:\Windows\System\MCtMypJ.exe
  C:\Windows\System\MCtMypJ.exe
  2⤵
  PID:6396
- C:\Windows\System\OUopjoJ.exe
  C:\Windows\System\OUopjoJ.exe
  2⤵
  PID:6456
- C:\Windows\System\vjRLdOc.exe
  C:\Windows\System\vjRLdOc.exe
  2⤵
  PID:7048
- C:\Windows\System\gVeEdru.exe
  C:\Windows\System\gVeEdru.exe
  2⤵
  PID:5964
- C:\Windows\System\KWztbtN.exe
  C:\Windows\System\KWztbtN.exe
  2⤵
  PID:7216
- C:\Windows\System\bqXfYKR.exe
  C:\Windows\System\bqXfYKR.exe
  2⤵
  PID:7240
- C:\Windows\System\RNucyRX.exe
  C:\Windows\System\RNucyRX.exe
  2⤵
  PID:7272
- C:\Windows\System\hrHNJGm.exe
  C:\Windows\System\hrHNJGm.exe
  2⤵
  PID:7296
- C:\Windows\System\fHrTAyF.exe
  C:\Windows\System\fHrTAyF.exe
  2⤵
  PID:7312
- C:\Windows\System\bwQqTpl.exe
  C:\Windows\System\bwQqTpl.exe
  2⤵
  PID:7340
- C:\Windows\System\ogfkUAa.exe
  C:\Windows\System\ogfkUAa.exe
  2⤵
  PID:7360
- C:\Windows\System\qqAfjNR.exe
  C:\Windows\System\qqAfjNR.exe
  2⤵
  PID:7376
- C:\Windows\System\ZVGvgYx.exe
  C:\Windows\System\ZVGvgYx.exe
  2⤵
  PID:7392
- C:\Windows\System\XeBBUKo.exe
  C:\Windows\System\XeBBUKo.exe
  2⤵
  PID:7412
- C:\Windows\System\maiNDDZ.exe
  C:\Windows\System\maiNDDZ.exe
  2⤵
  PID:1944
- C:\Windows\System\CZuzkQh.exe
  C:\Windows\System\CZuzkQh.exe
  2⤵
  PID:6508
- C:\Windows\System\oRBnKMZ.exe
  C:\Windows\System\oRBnKMZ.exe
  2⤵
  PID:7436
- C:\Windows\System\pcybjcC.exe
  C:\Windows\System\pcybjcC.exe
  2⤵
  PID:7452
- C:\Windows\System\LFVEfRo.exe
  C:\Windows\System\LFVEfRo.exe
  2⤵
  PID:7712
- C:\Windows\System\Wtuozgd.exe
  C:\Windows\System\Wtuozgd.exe
  2⤵
  PID:7484
- C:\Windows\System\xgfslLy.exe
  C:\Windows\System\xgfslLy.exe
  2⤵
  PID:7504
- C:\Windows\System\ypQZPFd.exe
  C:\Windows\System\ypQZPFd.exe
  2⤵
  PID:7520
- C:\Windows\System\kOgJxbe.exe
  C:\Windows\System\kOgJxbe.exe
  2⤵
  PID:7536
- C:\Windows\System\MweZLjq.exe
  C:\Windows\System\MweZLjq.exe
  2⤵
  PID:7556
- C:\Windows\System\oHmYynM.exe
  C:\Windows\System\oHmYynM.exe
  2⤵
  PID:7572
- C:\Windows\System\vOpxdWY.exe
  C:\Windows\System\vOpxdWY.exe
  2⤵
  PID:7596
- C:\Windows\System\TnltXKK.exe
  C:\Windows\System\TnltXKK.exe
  2⤵
  PID:7612
- C:\Windows\System\GdpMRnL.exe
  C:\Windows\System\GdpMRnL.exe
  2⤵
  PID:7644
- C:\Windows\System\HRZdBYh.exe
  C:\Windows\System\HRZdBYh.exe
  2⤵
  PID:8036
- C:\Windows\System\XiTZgRJ.exe
  C:\Windows\System\XiTZgRJ.exe
  2⤵
  PID:8044
- C:\Windows\System\wOaBbIA.exe
  C:\Windows\System\wOaBbIA.exe
  2⤵
  PID:8152
- C:\Windows\System\qpNuwWn.exe
  C:\Windows\System\qpNuwWn.exe
  2⤵
  PID:7912
- C:\Windows\System\bqFMErA.exe
  C:\Windows\System\bqFMErA.exe
  2⤵
  PID:7956
- C:\Windows\System\zqMGcdw.exe
  C:\Windows\System\zqMGcdw.exe
  2⤵
  PID:8020
- C:\Windows\System\BZIcwzq.exe
  C:\Windows\System\BZIcwzq.exe
  2⤵
  PID:8100
- C:\Windows\System\JhmupeY.exe
  C:\Windows\System\JhmupeY.exe
  2⤵
  PID:8116
- C:\Windows\System\VKgclJa.exe
  C:\Windows\System\VKgclJa.exe
  2⤵
  PID:8140
- C:\Windows\System\tVulPtu.exe
  C:\Windows\System\tVulPtu.exe
  2⤵
  PID:8168
- C:\Windows\System\cbNPJVn.exe
  C:\Windows\System\cbNPJVn.exe
  2⤵
  PID:7028
- C:\Windows\System\imASRJx.exe
  C:\Windows\System\imASRJx.exe
  2⤵
  PID:6720
- C:\Windows\System\ANEYpTi.exe
  C:\Windows\System\ANEYpTi.exe
  2⤵
  PID:7184
- C:\Windows\System\vKHVKuI.exe
  C:\Windows\System\vKHVKuI.exe
  2⤵
  PID:6332
- C:\Windows\System\HQKgzpL.exe
  C:\Windows\System\HQKgzpL.exe
  2⤵
  PID:7236
- C:\Windows\System\cNZWwMF.exe
  C:\Windows\System\cNZWwMF.exe
  2⤵
  PID:7256
- C:\Windows\System\bOEPbEK.exe
  C:\Windows\System\bOEPbEK.exe
  2⤵
  PID:6392
- C:\Windows\System\CXHsjBD.exe
  C:\Windows\System\CXHsjBD.exe
  2⤵
  PID:6688
- C:\Windows\System\jjXAzSD.exe
  C:\Windows\System\jjXAzSD.exe
  2⤵
  PID:7348
- C:\Windows\System\sljlCyQ.exe
  C:\Windows\System\sljlCyQ.exe
  2⤵
  PID:7384
- C:\Windows\System\QaBJyfv.exe
  C:\Windows\System\QaBJyfv.exe
  2⤵
  PID:7432
- C:\Windows\System\GuFpodf.exe
  C:\Windows\System\GuFpodf.exe
  2⤵
  PID:7492
- C:\Windows\System\gotxqWq.exe
  C:\Windows\System\gotxqWq.exe
  2⤵
  PID:7532
- C:\Windows\System\uBQrabX.exe
  C:\Windows\System\uBQrabX.exe
  2⤵
  PID:7292
- C:\Windows\System\BpDAhgv.exe
  C:\Windows\System\BpDAhgv.exe
  2⤵
  PID:7372
- C:\Windows\System\xhPLgLn.exe
  C:\Windows\System\xhPLgLn.exe
  2⤵
  PID:6984
- C:\Windows\System\KENoHOO.exe
  C:\Windows\System\KENoHOO.exe
  2⤵
  PID:7512
- C:\Windows\System\quypwli.exe
  C:\Windows\System\quypwli.exe
  2⤵
  PID:7444
- C:\Windows\System\ONALIyw.exe
  C:\Windows\System\ONALIyw.exe
  2⤵
  PID:7588
- C:\Windows\System\SKPGQvN.exe
  C:\Windows\System\SKPGQvN.exe
  2⤵
  PID:7632
- C:\Windows\System\pWdDNFe.exe
  C:\Windows\System\pWdDNFe.exe
  2⤵
  PID:7660
- C:\Windows\System\FFyNDCn.exe
  C:\Windows\System\FFyNDCn.exe
  2⤵
  PID:7664
- C:\Windows\System\xVkXkBs.exe
  C:\Windows\System\xVkXkBs.exe
  2⤵
  PID:7896
- C:\Windows\System\cDmHNKW.exe
  C:\Windows\System\cDmHNKW.exe
  2⤵
  PID:7976
- C:\Windows\System\dKXMspW.exe
  C:\Windows\System\dKXMspW.exe
  2⤵
  PID:8088
- C:\Windows\System\SQuSIJr.exe
  C:\Windows\System\SQuSIJr.exe
  2⤵
  PID:7684
- C:\Windows\System\hxTZqEO.exe
  C:\Windows\System\hxTZqEO.exe
  2⤵
  PID:7704
- C:\Windows\System\wPWUQLB.exe
  C:\Windows\System\wPWUQLB.exe
  2⤵
  PID:7732
- C:\Windows\System\GYJkXnm.exe
  C:\Windows\System\GYJkXnm.exe
  2⤵
  PID:8084
- C:\Windows\System\xrQwcSg.exe
  C:\Windows\System\xrQwcSg.exe
  2⤵
  PID:7952
- C:\Windows\System\LGTvefw.exe
  C:\Windows\System\LGTvefw.exe
  2⤵
  PID:8124
- C:\Windows\System\ZYOmRqY.exe
  C:\Windows\System\ZYOmRqY.exe
  2⤵
  PID:8176
- C:\Windows\System\IuTJIJv.exe
  C:\Windows\System\IuTJIJv.exe
  2⤵
  PID:7180
- C:\Windows\System\iSzfwIP.exe
  C:\Windows\System\iSzfwIP.exe
  2⤵
  PID:6552
- C:\Windows\System\JbUsFGG.exe
  C:\Windows\System\JbUsFGG.exe
  2⤵
  PID:7500
- C:\Windows\System\JuXgAzx.exe
  C:\Windows\System\JuXgAzx.exe
  2⤵
  PID:7848
- C:\Windows\System\zwiOLla.exe
  C:\Windows\System\zwiOLla.exe
  2⤵
  PID:7992
- C:\Windows\System\YwgGYUg.exe
  C:\Windows\System\YwgGYUg.exe
  2⤵
  PID:8160
- C:\Windows\System\qlJgDvu.exe
  C:\Windows\System\qlJgDvu.exe
  2⤵
  PID:7264
- C:\Windows\System\VPEkyYa.exe
  C:\Windows\System\VPEkyYa.exe
  2⤵
  PID:7808
- C:\Windows\System\LtbejIa.exe
  C:\Windows\System\LtbejIa.exe
  2⤵
  PID:7528
- C:\Windows\System\WTEhJta.exe
  C:\Windows\System\WTEhJta.exe
  2⤵
  PID:7544
- C:\Windows\System\NcOGTaZ.exe
  C:\Windows\System\NcOGTaZ.exe
  2⤵
  PID:7868
- C:\Windows\System\NppvGRg.exe
  C:\Windows\System\NppvGRg.exe
  2⤵
  PID:7788
- C:\Windows\System\vpBnjMH.exe
  C:\Windows\System\vpBnjMH.exe
  2⤵
  PID:7820
- C:\Windows\System\GBtpGsC.exe
  C:\Windows\System\GBtpGsC.exe
  2⤵
  PID:7844
- C:\Windows\System\SJmuhCJ.exe
  C:\Windows\System\SJmuhCJ.exe
  2⤵
  PID:7880
- C:\Windows\System\UePxmiV.exe
  C:\Windows\System\UePxmiV.exe
  2⤵
  PID:7592
- C:\Windows\System\fUkIwuN.exe
  C:\Windows\System\fUkIwuN.exe
  2⤵
  PID:6316
- C:\Windows\System\ZViHair.exe
  C:\Windows\System\ZViHair.exe
  2⤵
  PID:7356
- C:\Windows\System\fFXZYbi.exe
  C:\Windows\System\fFXZYbi.exe
  2⤵
  PID:7404
- C:\Windows\System\umBSYEN.exe
  C:\Windows\System\umBSYEN.exe
  2⤵
  PID:7672
- C:\Windows\System\Gvsxicy.exe
  C:\Windows\System\Gvsxicy.exe
  2⤵
  PID:7696
- C:\Windows\System\MDMmqEq.exe
  C:\Windows\System\MDMmqEq.exe
  2⤵
  PID:7744
- C:\Windows\System\ZxMrgwt.exe
  C:\Windows\System\ZxMrgwt.exe
  2⤵
  PID:7640
- C:\Windows\System\Jhtomru.exe
  C:\Windows\System\Jhtomru.exe
  2⤵
  PID:7584
- C:\Windows\System\YMBIjHB.exe
  C:\Windows\System\YMBIjHB.exe
  2⤵
  PID:8180
- C:\Windows\System\rLImoUF.exe
  C:\Windows\System\rLImoUF.exe
  2⤵
  PID:7460
- C:\Windows\System\yTAPDCj.exe
  C:\Windows\System\yTAPDCj.exe
  2⤵
  PID:7920
- C:\Windows\System\XASEPYh.exe
  C:\Windows\System\XASEPYh.exe
  2⤵
  PID:7752
- C:\Windows\System\MHTkYiI.exe
  C:\Windows\System\MHTkYiI.exe
  2⤵
  PID:7776
- C:\Windows\System\efmSZrd.exe
  C:\Windows\System\efmSZrd.exe
  2⤵
  PID:1940
- C:\Windows\System\bWMsmRx.exe
  C:\Windows\System\bWMsmRx.exe
  2⤵
  PID:6668
- C:\Windows\System\iDWMZxQ.exe
  C:\Windows\System\iDWMZxQ.exe
  2⤵
  PID:8004
- C:\Windows\System\xriLGVn.exe
  C:\Windows\System\xriLGVn.exe
  2⤵
  PID:7608
- C:\Windows\System\GfVAHzM.exe
  C:\Windows\System\GfVAHzM.exe
  2⤵
  PID:7840
- C:\Windows\System\WejzLkn.exe
  C:\Windows\System\WejzLkn.exe
  2⤵
  PID:7784
- C:\Windows\System\lFlQwtv.exe
  C:\Windows\System\lFlQwtv.exe
  2⤵
  PID:7652
- C:\Windows\System\EIjSpfR.exe
  C:\Windows\System\EIjSpfR.exe
  2⤵
  PID:7828
- C:\Windows\System\sqSUXSS.exe
  C:\Windows\System\sqSUXSS.exe
  2⤵
  PID:6996
- C:\Windows\System\bKhYyvF.exe
  C:\Windows\System\bKhYyvF.exe
  2⤵
  PID:7724
- C:\Windows\System\Zmxpftt.exe
  C:\Windows\System\Zmxpftt.exe
  2⤵
  PID:7864
- C:\Windows\System\IjiXkZw.exe
  C:\Windows\System\IjiXkZw.exe
  2⤵
  PID:8112
- C:\Windows\System\YkRttFd.exe
  C:\Windows\System\YkRttFd.exe
  2⤵
  PID:7720
- C:\Windows\System\TXTHVYB.exe
  C:\Windows\System\TXTHVYB.exe
  2⤵
  PID:7988
- C:\Windows\System\YqgIJNS.exe
  C:\Windows\System\YqgIJNS.exe
  2⤵
  PID:7624
- C:\Windows\System\taESUQF.exe
  C:\Windows\System\taESUQF.exe
  2⤵
  PID:7740
- C:\Windows\System\SOaiWJw.exe
  C:\Windows\System\SOaiWJw.exe
  2⤵
  PID:7688
- C:\Windows\System\rENltZO.exe
  C:\Windows\System\rENltZO.exe
  2⤵
  PID:7900
- C:\Windows\System\qxbbjRh.exe
  C:\Windows\System\qxbbjRh.exe
  2⤵
  PID:7792
- C:\Windows\System\DcZrlZW.exe
  C:\Windows\System\DcZrlZW.exe
  2⤵
  PID:7464
- C:\Windows\System\uzaAbht.exe
  C:\Windows\System\uzaAbht.exe
  2⤵
  PID:8132
- C:\Windows\System\SzbhXwC.exe
  C:\Windows\System\SzbhXwC.exe
  2⤵
  PID:7832
- C:\Windows\System\BOVNPrF.exe
  C:\Windows\System\BOVNPrF.exe
  2⤵
  PID:8212
- C:\Windows\System\WVxeAkF.exe
  C:\Windows\System\WVxeAkF.exe
  2⤵
  PID:8232
- C:\Windows\System\YqyCXKX.exe
  C:\Windows\System\YqyCXKX.exe
  2⤵
  PID:8248
- C:\Windows\System\JsVtfes.exe
  C:\Windows\System\JsVtfes.exe
  2⤵
  PID:8264
- C:\Windows\System\TrHQtDb.exe
  C:\Windows\System\TrHQtDb.exe
  2⤵
  PID:8280
- C:\Windows\System\NkYYBGR.exe
  C:\Windows\System\NkYYBGR.exe
  2⤵
  PID:8300
- C:\Windows\System\ouAEOzZ.exe
  C:\Windows\System\ouAEOzZ.exe
  2⤵
  PID:8316
- C:\Windows\System\XwKzQdm.exe
  C:\Windows\System\XwKzQdm.exe
  2⤵
  PID:8332
- C:\Windows\System\lLMqeeM.exe
  C:\Windows\System\lLMqeeM.exe
  2⤵
  PID:8348
- C:\Windows\System\Swvitdo.exe
  C:\Windows\System\Swvitdo.exe
  2⤵
  PID:8368
- C:\Windows\System\VmaydIx.exe
  C:\Windows\System\VmaydIx.exe
  2⤵
  PID:8388
- C:\Windows\System\CQWREGg.exe
  C:\Windows\System\CQWREGg.exe
  2⤵
  PID:8404
- C:\Windows\System\NmQZezp.exe
  C:\Windows\System\NmQZezp.exe
  2⤵
  PID:8420
- C:\Windows\System\vJsQoBJ.exe
  C:\Windows\System\vJsQoBJ.exe
  2⤵
  PID:8440
- C:\Windows\System\wPVsxzo.exe
  C:\Windows\System\wPVsxzo.exe
  2⤵
  PID:8460
- C:\Windows\System\fVxssBL.exe
  C:\Windows\System\fVxssBL.exe
  2⤵
  PID:8476
- C:\Windows\System\HhMwycn.exe
  C:\Windows\System\HhMwycn.exe
  2⤵
  PID:8492
- C:\Windows\System\iYopZXG.exe
  C:\Windows\System\iYopZXG.exe
  2⤵
  PID:8548
- C:\Windows\System\WXFTWtm.exe
  C:\Windows\System\WXFTWtm.exe
  2⤵
  PID:8584
- C:\Windows\System\gJjdhLv.exe
  C:\Windows\System\gJjdhLv.exe
  2⤵
  PID:8600
- C:\Windows\System\yvqncPA.exe
  C:\Windows\System\yvqncPA.exe
  2⤵
  PID:8616
- C:\Windows\System\Yxwiysu.exe
  C:\Windows\System\Yxwiysu.exe
  2⤵
  PID:8632
- C:\Windows\System\zLpjmGE.exe
  C:\Windows\System\zLpjmGE.exe
  2⤵
  PID:8648
- C:\Windows\System\njArJyV.exe
  C:\Windows\System\njArJyV.exe
  2⤵
  PID:8672
- C:\Windows\System\UoIpKgg.exe
  C:\Windows\System\UoIpKgg.exe
  2⤵
  PID:8688
- C:\Windows\System\kNgGDRz.exe
  C:\Windows\System\kNgGDRz.exe
  2⤵
  PID:8724
- C:\Windows\System\NrOxaIJ.exe
  C:\Windows\System\NrOxaIJ.exe
  2⤵
  PID:8748
- C:\Windows\System\lxgwbds.exe
  C:\Windows\System\lxgwbds.exe
  2⤵
  PID:8764
- C:\Windows\System\YKxZkwp.exe
  C:\Windows\System\YKxZkwp.exe
  2⤵
  PID:8780
- C:\Windows\System\qfkKoZT.exe
  C:\Windows\System\qfkKoZT.exe
  2⤵
  PID:8796
- C:\Windows\System\MVImFWc.exe
  C:\Windows\System\MVImFWc.exe
  2⤵
  PID:8812
- C:\Windows\System\akpkYVb.exe
  C:\Windows\System\akpkYVb.exe
  2⤵
  PID:8828
- C:\Windows\System\kTBGHdA.exe
  C:\Windows\System\kTBGHdA.exe
  2⤵
  PID:8848
- C:\Windows\System\ypBUZLX.exe
  C:\Windows\System\ypBUZLX.exe
  2⤵
  PID:8864
- C:\Windows\System\qXQSBRY.exe
  C:\Windows\System\qXQSBRY.exe
  2⤵
  PID:8884
- C:\Windows\System\MHmFAqf.exe
  C:\Windows\System\MHmFAqf.exe
  2⤵
  PID:8900
- C:\Windows\System\UbubEqj.exe
  C:\Windows\System\UbubEqj.exe
  2⤵
  PID:8916
- C:\Windows\System\IbIJFer.exe
  C:\Windows\System\IbIJFer.exe
  2⤵
  PID:8932
- C:\Windows\System\aHKhesM.exe
  C:\Windows\System\aHKhesM.exe
  2⤵
  PID:8948
- C:\Windows\System\aBPJYjw.exe
  C:\Windows\System\aBPJYjw.exe
  2⤵
  PID:8964
- C:\Windows\System\uuFJYet.exe
  C:\Windows\System\uuFJYet.exe
  2⤵
  PID:9020
- C:\Windows\System\FloHQTn.exe
  C:\Windows\System\FloHQTn.exe
  2⤵
  PID:9040
- C:\Windows\System\qeLVHWp.exe
  C:\Windows\System\qeLVHWp.exe
  2⤵
  PID:9056
- C:\Windows\System\DWKJWHJ.exe
  C:\Windows\System\DWKJWHJ.exe
  2⤵
  PID:9072
- C:\Windows\System\QYifGfi.exe
  C:\Windows\System\QYifGfi.exe
  2⤵
  PID:9088
- C:\Windows\System\yoPdAVz.exe
  C:\Windows\System\yoPdAVz.exe
  2⤵
  PID:9104
- C:\Windows\System\DAIJITL.exe
  C:\Windows\System\DAIJITL.exe
  2⤵
  PID:9120
- C:\Windows\System\UgXXONq.exe
  C:\Windows\System\UgXXONq.exe
  2⤵
  PID:9140
- C:\Windows\System\fVPFLQZ.exe
  C:\Windows\System\fVPFLQZ.exe
  2⤵
  PID:9156
- C:\Windows\System\uQOleJQ.exe
  C:\Windows\System\uQOleJQ.exe
  2⤵
  PID:9172
- C:\Windows\System\zEbwcvN.exe
  C:\Windows\System\zEbwcvN.exe
  2⤵
  PID:9188
- C:\Windows\System\tyoZAAk.exe
  C:\Windows\System\tyoZAAk.exe
  2⤵
  PID:9204
- C:\Windows\System\SHSOrmo.exe
  C:\Windows\System\SHSOrmo.exe
  2⤵
  PID:7516
- C:\Windows\System\NMdcrzI.exe
  C:\Windows\System\NMdcrzI.exe
  2⤵
  PID:8200
- C:\Windows\System\rGVpkFT.exe
  C:\Windows\System\rGVpkFT.exe
  2⤵
  PID:8224
- C:\Windows\System\aBdTOYR.exe
  C:\Windows\System\aBdTOYR.exe
  2⤵
  PID:8364
- C:\Windows\System\Fbspkrr.exe
  C:\Windows\System\Fbspkrr.exe
  2⤵
  PID:8296
- C:\Windows\System\DbCnGPl.exe
  C:\Windows\System\DbCnGPl.exe
  2⤵
  PID:8360
- C:\Windows\System\ZNpWXGG.exe
  C:\Windows\System\ZNpWXGG.exe
  2⤵
  PID:8436
- C:\Windows\System\XByBSfu.exe
  C:\Windows\System\XByBSfu.exe
  2⤵
  PID:8500
- C:\Windows\System\JFZgVsM.exe
  C:\Windows\System\JFZgVsM.exe
  2⤵
  PID:8312
- C:\Windows\System\EKyrsnl.exe
  C:\Windows\System\EKyrsnl.exe
  2⤵
  PID:8380
- C:\Windows\System\PfySJiE.exe
  C:\Windows\System\PfySJiE.exe
  2⤵
  PID:8504
- C:\Windows\System\kGXBkcW.exe
  C:\Windows\System\kGXBkcW.exe
  2⤵
  PID:8456
- C:\Windows\System\vHMZkaf.exe
  C:\Windows\System\vHMZkaf.exe
  2⤵
  PID:7564
- C:\Windows\System\hLMKqzk.exe
  C:\Windows\System\hLMKqzk.exe
  2⤵
  PID:8524
- C:\Windows\System\UUnlAOO.exe
  C:\Windows\System\UUnlAOO.exe
  2⤵
  PID:8544
- C:\Windows\System\TSUXKcL.exe
  C:\Windows\System\TSUXKcL.exe
  2⤵
  PID:8564
- C:\Windows\System\zjPBNsN.exe
  C:\Windows\System\zjPBNsN.exe
  2⤵
  PID:8592
- C:\Windows\System\VcuXcCj.exe
  C:\Windows\System\VcuXcCj.exe
  2⤵
  PID:8612
- C:\Windows\System\jItaylZ.exe
  C:\Windows\System\jItaylZ.exe
  2⤵
  PID:8644
- C:\Windows\System\MJeoffo.exe
  C:\Windows\System\MJeoffo.exe
  2⤵
  PID:8664
- C:\Windows\System\OlndxQd.exe
  C:\Windows\System\OlndxQd.exe
  2⤵
  PID:8704
- C:\Windows\System\nfbPyAk.exe
  C:\Windows\System\nfbPyAk.exe
  2⤵
  PID:8720
- C:\Windows\System\CiNGPVc.exe
  C:\Windows\System\CiNGPVc.exe
  2⤵
  PID:8792
- C:\Windows\System\XJgrHbZ.exe
  C:\Windows\System\XJgrHbZ.exe
  2⤵
  PID:8860
- C:\Windows\System\urcIjRx.exe
  C:\Windows\System\urcIjRx.exe
  2⤵
  PID:8928
- C:\Windows\System\KdrmisO.exe
  C:\Windows\System\KdrmisO.exe
  2⤵
  PID:9032
- C:\Windows\System\wEuKrPK.exe
  C:\Windows\System\wEuKrPK.exe
  2⤵
  PID:9096
- C:\Windows\System\NXbhhDF.exe
  C:\Windows\System\NXbhhDF.exe
  2⤵
  PID:8744
- C:\Windows\System\kqcqfRh.exe
  C:\Windows\System\kqcqfRh.exe
  2⤵
  PID:8808
- C:\Windows\System\ArEXuxD.exe
  C:\Windows\System\ArEXuxD.exe
  2⤵
  PID:8872
- C:\Windows\System\wbzfSyH.exe
  C:\Windows\System\wbzfSyH.exe
  2⤵
  PID:8984
- C:\Windows\System\YQYKjAh.exe
  C:\Windows\System\YQYKjAh.exe
  2⤵
  PID:9000
- C:\Windows\System\LbKCmOg.exe
  C:\Windows\System\LbKCmOg.exe
  2⤵
  PID:9048
- C:\Windows\System\dSaEKgZ.exe
  C:\Windows\System\dSaEKgZ.exe
  2⤵
  PID:8680
- C:\Windows\System\afhAXdj.exe
  C:\Windows\System\afhAXdj.exe
  2⤵
  PID:8912
- C:\Windows\System\TczntWT.exe
  C:\Windows\System\TczntWT.exe
  2⤵
  PID:9052
- C:\Windows\System\vrcBUHT.exe
  C:\Windows\System\vrcBUHT.exe
  2⤵
  PID:9132
- C:\Windows\System\PIZGqfs.exe
  C:\Windows\System\PIZGqfs.exe
  2⤵
  PID:9180
- C:\Windows\System\IbvaonX.exe
  C:\Windows\System\IbvaonX.exe
  2⤵
  PID:8076
- C:\Windows\System\RoEnumU.exe
  C:\Windows\System\RoEnumU.exe
  2⤵
  PID:8256
- C:\Windows\System\WaVWazO.exe
  C:\Windows\System\WaVWazO.exe
  2⤵
  PID:8356
- C:\Windows\System\gfliWuv.exe
  C:\Windows\System\gfliWuv.exe
  2⤵
  PID:8240
- C:\Windows\System\MwQdXAO.exe
  C:\Windows\System\MwQdXAO.exe
  2⤵
  PID:8344
- C:\Windows\System\tPneSvz.exe
  C:\Windows\System\tPneSvz.exe
  2⤵
  PID:8452
- C:\Windows\System\HQmfNBu.exe
  C:\Windows\System\HQmfNBu.exe
  2⤵
  PID:8416
- C:\Windows\System\YTtMsPA.exe
  C:\Windows\System\YTtMsPA.exe
  2⤵
  PID:8308
- C:\Windows\System\DnlMJQI.exe
  C:\Windows\System\DnlMJQI.exe
  2⤵
  PID:8488
- C:\Windows\System\cFyTfcN.exe
  C:\Windows\System\cFyTfcN.exe
  2⤵
  PID:8656
- C:\Windows\System\xAxSpGG.exe
  C:\Windows\System\xAxSpGG.exe
  2⤵
  PID:8696
- C:\Windows\System\MQIpFXh.exe
  C:\Windows\System\MQIpFXh.exe
  2⤵
  PID:8760
- C:\Windows\System\HyGFNxA.exe
  C:\Windows\System\HyGFNxA.exe
  2⤵
  PID:8960
- C:\Windows\System\IUbkaoL.exe
  C:\Windows\System\IUbkaoL.exe
  2⤵
  PID:9128
- C:\Windows\System\VScXCLz.exe
  C:\Windows\System\VScXCLz.exe
  2⤵
  PID:8996
- C:\Windows\System\nJoerlX.exe
  C:\Windows\System\nJoerlX.exe
  2⤵
  PID:9064
- C:\Windows\System\OncyyFc.exe
  C:\Windows\System\OncyyFc.exe
  2⤵
  PID:9008
- C:\Windows\System\dNrpOWm.exe
  C:\Windows\System\dNrpOWm.exe
  2⤵
  PID:8944
- C:\Windows\System\hBDyPpG.exe
  C:\Windows\System\hBDyPpG.exe
  2⤵
  PID:9152
- C:\Windows\System\iLSKVbJ.exe
  C:\Windows\System\iLSKVbJ.exe
  2⤵
  PID:8428
- C:\Windows\System\ewvvREz.exe
  C:\Windows\System\ewvvREz.exe
  2⤵
  PID:8400
- C:\Windows\System\yLfyAZY.exe
  C:\Windows\System\yLfyAZY.exe
  2⤵
  PID:8740
- C:\Windows\System\UefoIia.exe
  C:\Windows\System\UefoIia.exe
  2⤵
  PID:9184
- C:\Windows\System\DjPYoEP.exe
  C:\Windows\System\DjPYoEP.exe
  2⤵
  PID:1572
- C:\Windows\System\beFTvXL.exe
  C:\Windows\System\beFTvXL.exe
  2⤵
  PID:8540
- C:\Windows\System\wMnquRM.exe
  C:\Windows\System\wMnquRM.exe
  2⤵
  PID:8700
- C:\Windows\System\tAqniEf.exe
  C:\Windows\System\tAqniEf.exe
  2⤵
  PID:9028
- C:\Windows\System\FFdmsQW.exe
  C:\Windows\System\FFdmsQW.exe
  2⤵
  PID:8880
- C:\Windows\System\KXMlTua.exe
  C:\Windows\System\KXMlTua.exe
  2⤵
  PID:9168
- C:\Windows\System\RFNetwN.exe
  C:\Windows\System\RFNetwN.exe
  2⤵
  PID:7728
- C:\Windows\System\KlwkZun.exe
  C:\Windows\System\KlwkZun.exe
  2⤵
  PID:8572
- C:\Windows\System\XzPVzru.exe
  C:\Windows\System\XzPVzru.exe
  2⤵
  PID:8776
- C:\Windows\System\AhoBiGc.exe
  C:\Windows\System\AhoBiGc.exe
  2⤵
  PID:8536
- C:\Windows\System\cCiRKuS.exe
  C:\Windows\System\cCiRKuS.exe
  2⤵
  PID:9228
- C:\Windows\System\yEvISnT.exe
  C:\Windows\System\yEvISnT.exe
  2⤵
  PID:9244
- C:\Windows\System\AwrOkIL.exe
  C:\Windows\System\AwrOkIL.exe
  2⤵
  PID:9260
- C:\Windows\System\zBstbkk.exe
  C:\Windows\System\zBstbkk.exe
  2⤵
  PID:9276
- C:\Windows\System\XfjTnMV.exe
  C:\Windows\System\XfjTnMV.exe
  2⤵
  PID:9292
- C:\Windows\System\SyXQePp.exe
  C:\Windows\System\SyXQePp.exe
  2⤵
  PID:9308
- C:\Windows\System\mpJyZkz.exe
  C:\Windows\System\mpJyZkz.exe
  2⤵
  PID:9324
- C:\Windows\System\vvcaMNX.exe
  C:\Windows\System\vvcaMNX.exe
  2⤵
  PID:9340
- C:\Windows\System\bEJVBfw.exe
  C:\Windows\System\bEJVBfw.exe
  2⤵
  PID:9356
- C:\Windows\System\RuRqUnc.exe
  C:\Windows\System\RuRqUnc.exe
  2⤵
  PID:9372
- C:\Windows\System\ZRszkpo.exe
  C:\Windows\System\ZRszkpo.exe
  2⤵
  PID:9388
- C:\Windows\System\gdhcLlZ.exe
  C:\Windows\System\gdhcLlZ.exe
  2⤵
  PID:9404
- C:\Windows\System\cLuPQjh.exe
  C:\Windows\System\cLuPQjh.exe
  2⤵
  PID:9420
- C:\Windows\System\fTbniNR.exe
  C:\Windows\System\fTbniNR.exe
  2⤵
  PID:9436
- C:\Windows\System\CdzZfJI.exe
  C:\Windows\System\CdzZfJI.exe
  2⤵
  PID:9452
- C:\Windows\System\VLsIHly.exe
  C:\Windows\System\VLsIHly.exe
  2⤵
  PID:9468
- C:\Windows\System\llcaRoe.exe
  C:\Windows\System\llcaRoe.exe
  2⤵
  PID:9484
- C:\Windows\System\tePvgEf.exe
  C:\Windows\System\tePvgEf.exe
  2⤵
  PID:9500
- C:\Windows\System\EONlVWB.exe
  C:\Windows\System\EONlVWB.exe
  2⤵
  PID:9516
- C:\Windows\System\GbaAIVs.exe
  C:\Windows\System\GbaAIVs.exe
  2⤵
  PID:9532
- C:\Windows\System\OLGlfpf.exe
  C:\Windows\System\OLGlfpf.exe
  2⤵
  PID:9548
- C:\Windows\System\FIaqAMB.exe
  C:\Windows\System\FIaqAMB.exe
  2⤵
  PID:9564
- C:\Windows\System\naTejBt.exe
  C:\Windows\System\naTejBt.exe
  2⤵
  PID:9580
- C:\Windows\System\ZNJlTya.exe
  C:\Windows\System\ZNJlTya.exe
  2⤵
  PID:9596
- C:\Windows\System\mqQLhDf.exe
  C:\Windows\System\mqQLhDf.exe
  2⤵
  PID:9612
- C:\Windows\System\TxKhjTr.exe
  C:\Windows\System\TxKhjTr.exe
  2⤵
  PID:9628
- C:\Windows\System\KZEQXPy.exe
  C:\Windows\System\KZEQXPy.exe
  2⤵
  PID:9644
- C:\Windows\System\zCPbvpe.exe
  C:\Windows\System\zCPbvpe.exe
  2⤵
  PID:9660
- C:\Windows\System\keqkOVj.exe
  C:\Windows\System\keqkOVj.exe
  2⤵
  PID:9684
- C:\Windows\System\yYhXcMR.exe
  C:\Windows\System\yYhXcMR.exe
  2⤵
  PID:9700
- C:\Windows\System\fFVNlRN.exe
  C:\Windows\System\fFVNlRN.exe
  2⤵
  PID:9716
- C:\Windows\System\PbsiYhU.exe
  C:\Windows\System\PbsiYhU.exe
  2⤵
  PID:9732
- C:\Windows\System\zGvtjno.exe
  C:\Windows\System\zGvtjno.exe
  2⤵
  PID:9748
- C:\Windows\System\hEgiPws.exe
  C:\Windows\System\hEgiPws.exe
  2⤵
  PID:9764
- C:\Windows\System\SAnEerW.exe
  C:\Windows\System\SAnEerW.exe
  2⤵
  PID:9780
- C:\Windows\System\KWUIlbQ.exe
  C:\Windows\System\KWUIlbQ.exe
  2⤵
  PID:9796
- C:\Windows\System\HkJtqAB.exe
  C:\Windows\System\HkJtqAB.exe
  2⤵
  PID:9812
- C:\Windows\System\UPELIwv.exe
  C:\Windows\System\UPELIwv.exe
  2⤵
  PID:9828
- C:\Windows\System\bsgoKVi.exe
  C:\Windows\System\bsgoKVi.exe
  2⤵
  PID:9844
- C:\Windows\System\EhzUPzf.exe
  C:\Windows\System\EhzUPzf.exe
  2⤵
  PID:9860
- C:\Windows\System\OGlmlEf.exe
  C:\Windows\System\OGlmlEf.exe
  2⤵
  PID:9876
- C:\Windows\System\AYHVebN.exe
  C:\Windows\System\AYHVebN.exe
  2⤵
  PID:9892
- C:\Windows\System\LppGqbV.exe
  C:\Windows\System\LppGqbV.exe
  2⤵
  PID:9908
- C:\Windows\System\EdhZHTc.exe
  C:\Windows\System\EdhZHTc.exe
  2⤵
  PID:9924
- C:\Windows\System\rwYyiTl.exe
  C:\Windows\System\rwYyiTl.exe
  2⤵
  PID:9940
- C:\Windows\System\QLcwqgd.exe
  C:\Windows\System\QLcwqgd.exe
  2⤵
  PID:9956
- C:\Windows\System\PdLaSQj.exe
  C:\Windows\System\PdLaSQj.exe
  2⤵
  PID:9972
- C:\Windows\System\SIyqzru.exe
  C:\Windows\System\SIyqzru.exe
  2⤵
  PID:9988
- C:\Windows\System\cfrmCuw.exe
  C:\Windows\System\cfrmCuw.exe
  2⤵
  PID:10004
- C:\Windows\System\SkUuTlV.exe
  C:\Windows\System\SkUuTlV.exe
  2⤵
  PID:10020
- C:\Windows\System\imZgbBq.exe
  C:\Windows\System\imZgbBq.exe
  2⤵
  PID:10036
- C:\Windows\System\moAZyCw.exe
  C:\Windows\System\moAZyCw.exe
  2⤵
  PID:10052
- C:\Windows\System\jfobyLZ.exe
  C:\Windows\System\jfobyLZ.exe
  2⤵
  PID:10068
- C:\Windows\System\dgWNnvN.exe
  C:\Windows\System\dgWNnvN.exe
  2⤵
  PID:10084
- C:\Windows\System\dUkeFBj.exe
  C:\Windows\System\dUkeFBj.exe
  2⤵
  PID:10100
- C:\Windows\System\GqsULmT.exe
  C:\Windows\System\GqsULmT.exe
  2⤵
  PID:10120
- C:\Windows\System\wujkIoV.exe
  C:\Windows\System\wujkIoV.exe
  2⤵
  PID:10216
- C:\Windows\System\xclUdAf.exe
  C:\Windows\System\xclUdAf.exe
  2⤵
  PID:9200
- C:\Windows\System\iIyUrEz.exe
  C:\Windows\System\iIyUrEz.exe
  2⤵
  PID:8532
- C:\Windows\System\gXVFpZO.exe
  C:\Windows\System\gXVFpZO.exe
  2⤵
  PID:9084
- C:\Windows\System\jdACBKy.exe
  C:\Windows\System\jdACBKy.exe
  2⤵
  PID:8448
- C:\Windows\System\SEmKYPC.exe
  C:\Windows\System\SEmKYPC.exe
  2⤵
  PID:9304
- C:\Windows\System\wLieLhn.exe
  C:\Windows\System\wLieLhn.exe
  2⤵
  PID:8736
- C:\Windows\System\OCQCWeE.exe
  C:\Windows\System\OCQCWeE.exe
  2⤵
  PID:9268
- C:\Windows\System\ahEyuCa.exe
  C:\Windows\System\ahEyuCa.exe
  2⤵
  PID:9272
- C:\Windows\System\UaLEnsj.exe
  C:\Windows\System\UaLEnsj.exe
  2⤵
  PID:9444
- C:\Windows\System\AEFvLUn.exe
  C:\Windows\System\AEFvLUn.exe
  2⤵
  PID:9540
- C:\Windows\System\rPcIxbF.exe
  C:\Windows\System\rPcIxbF.exe
  2⤵
  PID:9572
- C:\Windows\System\NAsDvOO.exe
  C:\Windows\System\NAsDvOO.exe
  2⤵
  PID:9640
- C:\Windows\System\vxvZisR.exe
  C:\Windows\System\vxvZisR.exe
  2⤵
  PID:9676
- C:\Windows\System\cBZCHiD.exe
  C:\Windows\System\cBZCHiD.exe
  2⤵
  PID:9708
- C:\Windows\System\eweSArz.exe
  C:\Windows\System\eweSArz.exe
  2⤵
  PID:9744
- C:\Windows\System\QgOAIvR.exe
  C:\Windows\System\QgOAIvR.exe
  2⤵
  PID:9836
- C:\Windows\System\ZbaHzbr.exe
  C:\Windows\System\ZbaHzbr.exe
  2⤵
  PID:9624
- C:\Windows\System\EnvGGjr.exe
  C:\Windows\System\EnvGGjr.exe
  2⤵
  PID:9792
- C:\Windows\System\HVLSrZp.exe
  C:\Windows\System\HVLSrZp.exe
  2⤵
  PID:9996
- C:\Windows\System\kyLIPmd.exe
  C:\Windows\System\kyLIPmd.exe
  2⤵
  PID:9968
- C:\Windows\System\HqnjJpj.exe
  C:\Windows\System\HqnjJpj.exe
  2⤵
  PID:10128
- C:\Windows\System\PmJOzLo.exe
  C:\Windows\System\PmJOzLo.exe
  2⤵
  PID:10080
- C:\Windows\System\JhAcNFr.exe
  C:\Windows\System\JhAcNFr.exe
  2⤵
  PID:9952
- C:\Windows\System\ZtLpPvY.exe
  C:\Windows\System\ZtLpPvY.exe
  2⤵
  PID:10016
- C:\Windows\System\xJVrsop.exe
  C:\Windows\System\xJVrsop.exe
  2⤵
  PID:10012
- C:\Windows\System\awFDqPL.exe
  C:\Windows\System\awFDqPL.exe
  2⤵
  PID:10204
- C:\Windows\System\dSYyFrT.exe
  C:\Windows\System\dSYyFrT.exe
  2⤵
  PID:10228
- C:\Windows\System\vYFHGRz.exe
  C:\Windows\System\vYFHGRz.exe
  2⤵
  PID:9224
- C:\Windows\System\SLchLvb.exe
  C:\Windows\System\SLchLvb.exe
  2⤵
  PID:9348
- C:\Windows\System\sfVVQGj.exe
  C:\Windows\System\sfVVQGj.exe
  2⤵
  PID:9364
- C:\Windows\System\VXIEnhf.exe
  C:\Windows\System\VXIEnhf.exe
  2⤵
  PID:9068
- C:\Windows\System\qzmAqey.exe
  C:\Windows\System\qzmAqey.exe
  2⤵
  PID:9316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AGdFSjX.exe

Filesize
1.6MB

MD5
95a9f6fedc2bc9df3422ffb481e94d3b

SHA1
379965d17a66e5ea9db832a67f62812e55c9589d

SHA256
c2077e44011c0b36ef66556fe21b8c76e30c311d9052715fe9e456727f946f60

SHA512
4859825160076dd119f0bf05f534d2ce30826f37886299fce817ee86431ce93b16ae70465504a2ccb80eda30544d3de89d6544f9b79abf734d977814aad800a2

Download Submit
C:\Windows\system\HBGkQkM.exe

Filesize
1.6MB

MD5
31db0452a2b53f74d248f05780e166f7

SHA1
0837d9348fe72668dc88a067a75057c297fba6b8

SHA256
d36ba8843f8726eb93dc79bb99992b532e8242a5245860b34daf465c91709f8e

SHA512
4ffd1c0bf6605df40def85a3fec3accc09f9108c1a0ed6e9a7b08c305c3fc6b064ffa3aad0ee8b094459675800e470a01affb7d46ae152cda91b8ee6a5695ed4

Download Submit
C:\Windows\system\HdQcUEl.exe

Filesize
1.6MB

MD5
bf3ab5ccbba0a679b7b75f1a8c7a47cd

SHA1
5112a1aeb955eef7ce296b482674812f314373b8

SHA256
719ed75bef6f5bfe03c610e96dcd4123c491095876b58ea864c62f6cb9264eef

SHA512
c8f882db7d15b6cb98728fdcc16dac611ebc0898b99854294c3e50608ec1e5451a7a81d847a00e48dada60197418f109c7f41385c7d90f8d6de147f48b1bb9a3

Download Submit
C:\Windows\system\HpumZAh.exe

Filesize
1.6MB

MD5
c3eeb1e51175467769f4e35c0f0d93d2

SHA1
0379757387cb8edbf1c2051e99173a3720368aa3

SHA256
e9847f2f1a9518284e30a173b739c7e649570e31e82fff21d3f4a5bc7b271216

SHA512
1f1732331a6910a9bd9f25b6a944fbe2f69cb6e271fded8b09a62159c2bfb1f0ca56e24cb50609aa8d4b1082c4e99dbfd708f5f495896594adafbe07748415c2

Download Submit
C:\Windows\system\KMiGgkA.exe

Filesize
1.6MB

MD5
5aaa495e5052c918b1998ac56a5ba57f

SHA1
ea29e2bee19804399514b079a6b2fd8369983ead

SHA256
7cba10f92fee1e123d10767ec8841160cee37f0d7bec81772bc21beae57cb678

SHA512
4d80e26de45a6011a66b22572dbbdd9ae2bb25d75482e607cbae04e574336f18fd5446ee23f9ce542ed849c8ccd09af16293f492cf40e8a249fd6b32237d07f4

Download Submit
C:\Windows\system\OClZGlL.exe

Filesize
1.6MB

MD5
2e416ab033f7aa28d43eefe3581b1182

SHA1
61ebf49b97a646c9754e8dd31b57eeecf79d631f

SHA256
93a1394aa22be22e54091bb8d0235ec7b495013872b653bf483f289123fe7b7e

SHA512
ff89abd88180877b8f76bde5266fab9dc4865e80383efee470c03f67ca803a318beafde65685249f9b7314f5acdc17bbb9502abc3d75cd781030cc4ca2e6cf2d

Download Submit
C:\Windows\system\RylknEM.exe

Filesize
1.6MB

MD5
68557b09cf2c52f694a7df10bb805660

SHA1
a42abb0d556aeadb8a7148940b29c24213ad1643

SHA256
a2217a5efdbd5bf5034e51f73652970dc7ebb6a3ba6f5e99b6dfb9c287bf68e7

SHA512
e3f0d2fa7cac1d648566ae9246d237594fa94c4e254b2b0ca685d9e46471a7b5b51803febf002af85fe5f4211a75c4698fc8f31c13d56b5543d6097a8b705811

Download Submit
C:\Windows\system\SkkMoPA.exe

Filesize
1.6MB

MD5
4598406d47338661defd68390649b160

SHA1
f8883031be2ee03cd06f663373e80c3cd9017a66

SHA256
7bfa26f81120ab29805b421ba3aed8ee60d8f58ad7ca775828bace6b8d119f6b

SHA512
0a308ba6183a6b4d47061e8df28cd65b53ea23f44276c9328bc9013199b61e3a8166e81a06101208483882615960dd3f04c6cbff72034836431c015acac8dbdb

Download Submit
C:\Windows\system\SwnfNxX.exe

Filesize
1.6MB

MD5
0a92d711ebdd219aa1056cee849f3dd7

SHA1
e4cdf3df38598bc596eeaa9d074cea9304cdb138

SHA256
4acd473924bc99c6f26868175ca1c21ba0c309d3ed390adb0044b30b30c6c1e7

SHA512
81a406b3cb85c8cca9bd1bdee705fe6fcb66a7a3e1956497c0fc62ebe9644f99d0dbaa6244a19cbabb8bb1c10edf8b221ad1abcaac56290aa7c465a1fc466f39

Download Submit
C:\Windows\system\VVKJgPZ.exe

Filesize
1.6MB

MD5
e386a7682d2ded879658a06b43673cbf

SHA1
8d925699340edc052ebe3dbf62fd0ab83df7f220

SHA256
8248c97228fbdf71667257513f1fb40e983b2def926d5a741d45c7869cc036c8

SHA512
4283e455b0103e2c54fe12dcf9a1e1fcbb2be713eb7cb9a37d355762eec94ac8840cb955d27eb0f70ae470994371449a37079ebe930c1750536dcc4a60fef7d5

Download Submit
C:\Windows\system\WKDqGVV.exe

Filesize
1.6MB

MD5
f802929f633b5a7309a451879769a8be

SHA1
3c01f47e1767012c66bc81e2b03e96cb230bd479

SHA256
3848b141510aa1f7f083a50bb159b36dadfe398b56e46208b6e88440bee73979

SHA512
924ad460337b0726ea1290f0e94183c5ab6191b9bdf03f7f1534b362cd0fa8ed57a1ffd6b116556e0b0228a19e0ac37a8db327ddcfa6c0974b60007f4680e500

Download Submit
C:\Windows\system\dMCogqh.exe

Filesize
1.6MB

MD5
768e0a5ff5abb53fcd032d53027e6938

SHA1
cce1334e8e1c8d1bb9fa7cab0565d862c018ec0b

SHA256
992fc6745c4e68e99865cda49e625eb749af5ee3ed6a3e1af63406bfec5ae443

SHA512
3e14bd77f93104dc6f83d62a5366317f945d6402f4cb6268bb6c6d7896885e30dfc56470e1ad754b17ab4428aedc8c3b097d30ef601cd61ea53f0d87aafcbbbe

Download Submit
C:\Windows\system\fKzlsQJ.exe

Filesize
1.6MB

MD5
c71e71b26d606c42a8de17de493c1266

SHA1
ae2697b5eca531e39ead4aeda5d9c50aec6fb8e3

SHA256
ea5d30cd885fa4a06ce04519f040bd554024bcecaf400a5b9399ceb7edf6cf4a

SHA512
7f02e55a4ed4aa7941aea9f2c8b4806bf273c5cfbdd4b2cc928d554bc0d63d662d0df5ba5386cc5964e7cb8433a6798b3542286cb62e990780926d825a2a2687

Download Submit
C:\Windows\system\fauUXgl.exe

Filesize
1.6MB

MD5
fbfdb7e6fcd1d924d11959befb7ea6de

SHA1
fc24c24eed6bc0f3ac26a78c40311e4d9dc57bac

SHA256
bf5f09460f28b13748221730d4d397206ca93a3e8ecf79006fbd867ba0d47eb2

SHA512
57e4b6ac2731aafdfbdbf7993e59edf45724d600bef609c897e56a8ade835a6544ae86bb65ead55012f5f0e666531e90d77245d0305ea90205a8f8a8dc65e51a

Download Submit
C:\Windows\system\fuzyREh.exe

Filesize
1.6MB

MD5
182730fe35c2213a15963fb0190b2a98

SHA1
8bba60e6215697ef4f62ff02dcb057c9a64f4348

SHA256
adbfc383172fc1efe1d314c054ddfb96bb4d65f7df046a9f4d5a9a954d74d947

SHA512
db8b3adc8594b63f1c3371a0659a3a6c193eca92a038ec92faf80e86a48fef5e3d1f6a1268158d9a2d0e5da46dbce82f75cedc85eb5331e778fe2d75286cd488

Download Submit
C:\Windows\system\knJJwRB.exe

Filesize
1.6MB

MD5
f49e5d95e5899592cec8336da33340b4

SHA1
7e8f3bf1539037f2a5d11761ea534d49b799785e

SHA256
969b275d25688ad4c1b2a9734be71c2b7e57b54725692ed36864a4322a417c6f

SHA512
9f2276d529bdb7636a0cdacc7e7b79fe5844eb9f817a8fecb427d93f9e83856250968b197d52507cbab285afadd9434801e26d1802b0be34aea068336cfa5a1a

Download Submit
C:\Windows\system\lFIzuzK.exe

Filesize
1.6MB

MD5
310e3bb90688330616f3e4ff2cdd8cd1

SHA1
994c95e1bece47ad0ff9aac0defe6ba5c733dc28

SHA256
bf7d97404a8f59d3d91dc5bdbe1f6e06bce1f0779b0ef84cecdeefa33dac7283

SHA512
28f90a962f8f71f6efd1c4eb04930e5ed9b6ca78ddb75b10b97c6d9f228a7dbb843632e82b9bd219ae96ac3bc17851e55847e8f9cca3dfa4f5558bce49054bac

Download Submit
C:\Windows\system\lfnlsuu.exe

Filesize
1.6MB

MD5
f53e0329628176f395768200013881f6

SHA1
dbef5c320ffd68a05245cc4c67275de068ecca2f

SHA256
f64a04131893f5e1cab910ea0daa664e5977972351c1069f8dbd6f14ca9ae02e

SHA512
ecab7f766cd92d7042efa08bafb71482a3dbf84bbcae09581cfd50576a2fc5f3016f258a37a2b4cd4d2d1fbd32764ac4bcb047f8ed0f2a91b2809691069107da

Download Submit
C:\Windows\system\nDzNQci.exe

Filesize
1.6MB

MD5
f9e7d494f8f9f74588353d70409a0121

SHA1
a8e6cb1f21c0fd01176cdbf1cfd1ad473cac2c2f

SHA256
842adfe2da6dce47d7175d201e67ed233014c5595273fbb9b02bb3c8daf71902

SHA512
c684b8c1de8cd50dc95ca66a3eea6a5b85eebce7c5b0cc730ca9eb54e50f40a40dd6a51ea4e3ec41c3b1d38cd990fcb5499a21b7ac497a37466e501f1aa0a61a

Download Submit
C:\Windows\system\nTdfJAf.exe

Filesize
1.6MB

MD5
6e84b07ccd6206e138042f3c56da5694

SHA1
6257816f7f195bd2c053007961deb57b1b5637c2

SHA256
ad13f4a452adf69ee2f7c6624d6cf224a827f002d838f76c32dd6a9cf2ed40ee

SHA512
ed46b5808dfd949cc3dac7493ed7033aa5b4f5b93e306cb5b0f2e23386d23f80edf5d377df49f92e5ae75a5002e1ce609cb37047368a17b879dff8e0349efce5

Download Submit
C:\Windows\system\skBtbHt.exe

Filesize
1.6MB

MD5
1f8ef2c973313f5380604bbd68389b65

SHA1
1e064d5a8224fbf6a96025dac88fe9e9a3627036

SHA256
a404aac6b321d5c37c2fd9a67b7a55e71e8f46e5b7d1ae7cdcb4c12294223afa

SHA512
5bcfe2ee2cc47bd6676b4ae83094f8b2a23d6ba6e48fdc260d7dd93c4401f8f1fda42fc96af8e87e4ef14d44c502b20ce0c78b84fba26fe6dc6afeb03d916c7b

Download Submit
C:\Windows\system\wKnYXQV.exe

Filesize
1.6MB

MD5
019e66ecd294391d29e379a2cd562098

SHA1
242c4921dfea9e8c41424241f74ffdb29f0984d5

SHA256
5189a6f579b734f1451579f002a9de4aa14b74578768b03882f4682471a057a9

SHA512
4afebb22939d849d2924677d1466df8ca54aac54e9fbe250c0f056716fdb03c99b79cbebe216631081c742dab04d480a2a437556deb609e418d9567104e5e8a6

Download Submit
C:\Windows\system\xcMgBqT.exe

Filesize
1.6MB

MD5
a40d4d7e731a8b0f4c4a301f9bb1bd78

SHA1
7d395efe61bf0942613adc17d7bed4232210c48b

SHA256
f848a197be9561f86686a4d55cbcdcef8a7f9b88844e60c541327945bde83a5e

SHA512
55cfd334217e6a62fcee2d7fedefc63830a02d76e109878d2afdd6b53e3c568d05c3820311d11fad268da74205277f4eb4e1c5473c8f7bb6fc1f06f3ca2966c3

Download Submit
C:\Windows\system\yYGKmLw.exe

Filesize
1.6MB

MD5
141da7a2d73d35ccdcf635af04b50487

SHA1
c49fc6fcc57c45cdcb1bd4d07a73f0d6fc7ca893

SHA256
af32aeabdb5a2aa406d77bda13c877f39197baaba697cc4e8e85a1ea1661aef6

SHA512
88aa40ae67117b2b25d14d5d708409daa0f6b24ee11962035c03205b623581d23f0b463f66360e6b4df467730dacdb7c6b8d6e33fa743d9aeeb6e8f8fd2e081d

Download Submit
C:\Windows\system\zNyoLBW.exe

Filesize
1.6MB

MD5
7b8915ba7281ca998553dc34b13c4e8e

SHA1
df09bebfa95445e4bd38488a19a1c715455f7a8f

SHA256
b912f5c6218d440ee3945567079db77da4d56d76947a5dfe322c5606bd2c24a9

SHA512
ca46d5cd3ee0ea07296c89280c2e15fba527025af2a0f696f3adfffa5ee3cdf32d06d514d1d44696a993a2c8531e86867ff50192d06fe65f9a64ba8ed0e3c60c

Download Submit
\Windows\system\CKnUTLA.exe

Filesize
1.6MB

MD5
043e30b08f1784dba762ce9fa17d69bc

SHA1
385f7beb5bc69de07e0cbd2af26723b8a6aa4462

SHA256
a4c0f4f346dbc30773acf2993c8605914d8e6ea3d6713040efec0d15e65d9594

SHA512
a268f87668226bc2bb2a3af34616fb954e794d424ec9b48bca5582e1b649be171aedb08d1a6c4da668f77d5e24d079308646cc16e14ec83c3e3229a4416f413d

Download Submit
\Windows\system\DjnLNEX.exe

Filesize
1.6MB

MD5
b7566244ecbedbb35ff54aac53bc088b

SHA1
73e8631144757e4ada041c8df4db47da0b928603

SHA256
54f6cb75fc5544d067f04785baa6fe6701bb44e830ba8145fbd15263d9fd0b32

SHA512
1809db8241d51de32bc7f53c183fb36df7dffac2f3d0cd0a3c87ddba3da09576699820fcb6e05bfa9398a953edc6339578660b896279132b776bc7d156988409

Download Submit
\Windows\system\KiJWqQi.exe

Filesize
1.6MB

MD5
7c59bcd11807fce3e091d74486acc09c

SHA1
67a9abd96b246846a1b409445c3951b4d9fc4d6e

SHA256
d86f9eae505e56d1662bb3ffcb1f2a0276c29c1a7d6a5adef02ad0fb17cc853e

SHA512
19f73526b276c6fce506440408d5c49e39c338dec59a752e1eb7509aafe530cc696c20b7e39493567523aeef5e3798ae83970a0ebee931315f333ea1ab47eceb

Download Submit
\Windows\system\NXLKjVv.exe

Filesize
1.6MB

MD5
b44f250d61264e301220f16207ba6fb7

SHA1
e4d69433760dca2bfca0c3288711302536350fe7

SHA256
fe8808f66efa9969e216883479133d101ed8cc38f5d85dbac7ac5e771d65bd04

SHA512
38c9218d6cb6a7dc4077c01914bab0ce8d77e6309213493c11fe3b2f02b03247fb341e1cdcbb6b689315397df9a32024ce014d538be5fbce40234cf5560004f2

Download Submit
\Windows\system\PScdyDF.exe

Filesize
1.6MB

MD5
af26996a13492b5c31b38c228086bfbb

SHA1
e41d4477987c316206eb2e5ee9ad1b1461c25f38

SHA256
7f9729375354549b57d1d6c57ac4ff6ff74c1c3cd2333d288bf163724cd6b2cf

SHA512
6d9e98043d8636c60a927146e40235b148d58738a50620ca50be09ac579e45c493c26012b26fc4a091df5e754a02b7dce1d731bca01fe7c400aa238d3b030304

Download Submit
\Windows\system\XaQXFAb.exe

Filesize
1.6MB

MD5
24daf8c4d3041389d9a70d811779dfd2

SHA1
867628b7680ce016fefafd22ea06f39d84dea878

SHA256
82bbcad80244a3949e7a7ab5e88facba7d8cbe8b69b19d016902b2760713ec3b

SHA512
69a6167c98b0498da94a2d85a39c82a1b3742d58af316a85f5f027a0a142e42cc85ad95c58f39ff1084769e78611b57f42a6344e2ba16de60bd3443ac23545d1

Download Submit
\Windows\system\dSgZpXP.exe

Filesize
1.6MB

MD5
dfc4ee583c872b102a82198826deeb2b

SHA1
ca1c78af6e3da6c18ae5252cff743d6d0d3b44e8

SHA256
dcf36540daf86cedd5d69c8bbe9555e4a2b84546bf9c7f63e10c8cb5e05bd5bf

SHA512
976f6e01225c2f9e78664da452a98aebb8ef628640deb9be309e018df2d7165893e74eeaaa6ce66a44f00c9b453963f72794aae4b414aeedb70b2e13942a7734

Download Submit
\Windows\system\gLzIWNf.exe

Filesize
1.6MB

MD5
b9ba7122bcd5c617865b6196117d6d57

SHA1
e83876d1dc1e85510b35c5a16dcc43c4d5f2422d

SHA256
32af653e1827f946594dfed9421365899519bc8bb770cfde71f04e06dff38273

SHA512
77934ef7578203a81ebe31a08140377d26573947d0b16efdce7426d00b17a23980b0b92f72c217b0f3952e21ef73fbd539f5ce0b2bfcd0c1ef8bd10e176f6179

Download Submit
\Windows\system\hmtTaFa.exe

Filesize
1.6MB

MD5
6a2d760ae2768cf413bda335d58e0a81

SHA1
bdcee82ab1580d01c9dacf022f853d8837c25342

SHA256
3460ad21b42a92d16616e517a46f30ae1dfdc125739c998599b9c3e6e7df2ba5

SHA512
e78343cc7594a2ec4deb92717d984011cccde44f90985a0df2ba1fd9d944d13a6e412d57099f5ba7304b53db301220ab0534dc0358279b29943c37357cb49b34

Download Submit
\Windows\system\nWcpCsE.exe

Filesize
1.6MB

MD5
1808de592687349218d2a0e5b74132b3

SHA1
4f9818f344231e92ad3aecef0be6380616d098f3

SHA256
7e616f1a6adbcd513712d99ca9f7a5cf0f4f7a878eb2641acc612d76542b3bd1

SHA512
4566a6744704656e20cbeb3516ba7a372a8e31d8a097417b2f4c571e17e7f625b2567a4b00e1a82f76b0dcd1342705d1a249acb9697dda07118f9aca564ae54d

Download Submit
\Windows\system\uEQcGOl.exe

Filesize
1.6MB

MD5
1a9a434a71aef4c9338d17d2d68ff619

SHA1
b48df84b5921bd17eb616476808bef224c0e3ddd

SHA256
7517cc8cdf73992619aa0b722f520a6af58aceb3c8b487db83e36dded5e4ade6

SHA512
c5600a2ddd6748c63ac0195fa0a3aaf8ea911f682eba10d8354224966514ef4a9c5cc3ba967a8ffdac27bdde503c122c17e9d57745398728ff075e86ff1754ba

Download Submit
\Windows\system\ySWvLUV.exe

Filesize
1.6MB

MD5
4f6975a1ad8767fa9c191001091bfcbe

SHA1
eb7234ecd0c25d6929c4d83df16b681c62d953c9

SHA256
fbee1216171d2fd22a6cab294094b45a3e6c040d90e83599d8e0fa06cbddb60e

SHA512
553ff87665a9be79f221158bf8f87728588be7b7589ba5eb441f41fa9dc2395ccaa2ea98d1ce51772de9414ccf9722c80fd07292b9d3b0258f81ac3ece976637

Download Submit
\Windows\system\zgNyMJj.exe

Filesize
1.6MB

MD5
741ed3ac004baa765e64c4da67c50ad1

SHA1
2f6eafe0d668db60c692e79fb32f66cb45a26294

SHA256
b3c222721deedb249709886abeda74734f29c594ecb9979645930f74aebca515

SHA512
3bb807a32b96eecea7995682706973067319d3dfa88be2492329636646df8ff98b1db392bdac5cec2389b78d41d90e678b7b29938b31d00bf475fa722c2da99a

Download Submit
memory/384-12-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/384-183-0x0000000003320000-0x0000000003712000-memory.dmp

Filesize
3.9MB

Download
memory/384-147-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/384-196-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/384-110-0x0000000003320000-0x0000000003712000-memory.dmp

Filesize
3.9MB

Download
memory/384-1-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/384-116-0x0000000003320000-0x0000000003712000-memory.dmp

Filesize
3.9MB

Download
memory/384-0-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/384-114-0x0000000003320000-0x0000000003712000-memory.dmp

Filesize
3.9MB

Download
memory/384-199-0x0000000002CF0000-0x00000000030E2000-memory.dmp

Filesize
3.9MB

Download
memory/384-112-0x0000000003320000-0x0000000003712000-memory.dmp

Filesize
3.9MB

Download
memory/384-108-0x0000000002CF0000-0x00000000030E2000-memory.dmp

Filesize
3.9MB

Download
memory/1856-279-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Filesize
9.6MB

Download
memory/1856-185-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download
memory/1856-14-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download
memory/1856-106-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Filesize
9.6MB

Download
memory/1856-48-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/1856-82-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/1856-198-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download
memory/1856-197-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Filesize
9.6MB

Download
memory/2004-13-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2060-111-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-148-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2664-107-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2688-184-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2704-115-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2716-109-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2720-113-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/2808-146-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download