xmrig | 520655622dbf973a9015320e1bcf52976c0181e43784404d595df3d534457310

Analysis

max time kernel
34s
max time network
31s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
Size

2.2MB
MD5

04d4a36845d29019ab11f9d517c6203c
SHA1

ae26bcd5e18471e222dab83a0d21075165dc18dd
SHA256

520655622dbf973a9015320e1bcf52976c0181e43784404d595df3d534457310
SHA512

d4707ab374abd0e61d27396d9290680c44b55fd3fbc04900909632d60f412ab3047f2b2b5ee5fea19513b0439dc9ede36cbd205140a325d668652f7ce9f544bd
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfO:NABJ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2428-163-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2360-161-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2640-159-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/1940-157-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2464-154-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2592-148-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2480-146-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2520-122-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2508	DGBffNv.exe
2520	ELtxEPM.exe
2480	PuWuulJ.exe
2592	EfyHaMR.exe
2464	jTBzxIO.exe
1940	hJJUBDP.exe
2640	afcNBgI.exe
2360	SpzTodW.exe
2428	oHzSAvg.exe
2796	zKGJzrz.exe
3024	VRtcVFb.exe
1444	HzkUGrw.exe
1476	LEwvqeE.exe
2424	BCQnKeo.exe
2588	YrJiUNi.exe
2548	HYnwFhY.exe
1748	JBjiWcs.exe
1816	fUKRXfS.exe
1760	XvGaeQv.exe
1600	sjSpROI.exe
1628	JVxjjap.exe
2292	QILXMhF.exe
300	tonsBac.exe
1688	dlALnRJ.exe
1560	ZkXpUtr.exe
864	idtULuX.exe
836	fCfVxHb.exe
1884	pufZKwh.exe
2696	iQaBKkL.exe
700	dBQnBII.exe
1652	Wdsvrlp.exe
2044	nKerqyy.exe
2208	sXNRccm.exe
1768	pUZfifk.exe
912	XezSPkx.exe
1056	FtSbAka.exe
2240	rRXxyEb.exe
2940	gkyxqDR.exe
2904	eFjBYva.exe
1664	xrHpisi.exe
2992	UeQbJli.exe
1104	SeLKGVd.exe
3060	rSDMOUE.exe
1700	jIrhvvC.exe
2280	VpqetMM.exe
1836	gDkTBDG.exe
1268	kANaEHU.exe
1256	QMOMOhL.exe
1580	cPveDdo.exe
684	QItXLcr.exe
2712	HGuZhvK.exe
3016	qCBQNaX.exe
1988	pTWkqkw.exe
2236	tsKxqQi.exe
2324	jgGgtgc.exe
1964	kZtgZLV.exe
1532	BIPpvmu.exe
2600	kCnAyBn.exe
2060	qxggoIe.exe
2364	UdXarpg.exe
1552	IOkwOCf.exe
2660	UhDMqfb.exe
1000	fBISljG.exe
2084	FmOVrLr.exe

Loads dropped DLL 64 IoCs

pid	Process
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1904-1-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/files/0x000d00000001449a-3.dat	upx
behavioral1/memory/2508-8-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/files/0x0034000000014701-14.dat	upx
behavioral1/files/0x001400000000549e-21.dat	upx
behavioral1/files/0x0007000000014c25-28.dat	upx
behavioral1/files/0x0008000000014b12-26.dat	upx
behavioral1/files/0x0007000000014e5a-34.dat	upx
behavioral1/files/0x0007000000015023-39.dat	upx
behavioral1/files/0x0006000000015f1b-82.dat	upx
behavioral1/files/0x0006000000016411-103.dat	upx
behavioral1/files/0x0006000000016525-107.dat	upx
behavioral1/files/0x0006000000016cc9-143.dat	upx
behavioral1/memory/2428-163-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/2360-161-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2640-159-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/memory/1940-157-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/files/0x0006000000016ce1-156.dat	upx
behavioral1/files/0x0006000000016cab-140.dat	upx
behavioral1/files/0x0006000000016c2e-133.dat	upx
behavioral1/files/0x0006000000016c17-127.dat	upx
behavioral1/files/0x00060000000167ef-115.dat	upx
behavioral1/memory/2464-154-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/files/0x0006000000016c7a-151.dat	upx
behavioral1/files/0x0006000000016c26-150.dat	upx
behavioral1/files/0x0006000000016a45-149.dat	upx
behavioral1/memory/2592-148-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2480-146-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2520-122-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/files/0x0006000000016597-111.dat	upx
behavioral1/files/0x0006000000016277-98.dat	upx
behavioral1/files/0x00060000000160f8-94.dat	upx
behavioral1/files/0x0006000000016056-90.dat	upx
behavioral1/files/0x0006000000015f9e-86.dat	upx
behavioral1/files/0x0006000000015d6e-78.dat	upx
behavioral1/files/0x0006000000015d5d-74.dat	upx
behavioral1/files/0x0006000000015d06-70.dat	upx
behavioral1/files/0x0006000000015cf7-66.dat	upx
behavioral1/files/0x0006000000015cec-62.dat	upx
behavioral1/files/0x0006000000015cdb-58.dat	upx
behavioral1/files/0x0006000000015cca-54.dat	upx
behavioral1/files/0x0006000000015cc1-50.dat	upx
behavioral1/files/0x0007000000015cb9-46.dat	upx
behavioral1/files/0x000a0000000155e3-43.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zKEWgGL.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\xiGWqaj.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\ceWVQrQ.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\DcyMGfR.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\vyjFZcX.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\dpRPUnA.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\ccOwzTk.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\TkvZsnq.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\yFjLUSW.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\xrCwDdy.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\LGlMZKh.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\wZeCybl.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\EnHiWGq.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\liMGdAI.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\rTKeQZY.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\adLmICh.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\uvQSGMC.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\lhhFfde.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\lGLiUJj.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\slVLJYC.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\oHzSAvg.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\GiESCbi.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\lYaLKOb.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\zzQuYwn.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\JrbuIPn.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\VKlAYAE.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\iPIDmui.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\BsAcojW.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\enHcYpA.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\lEFYwbb.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\QEAoftt.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\JxFuVFe.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\drPNUkV.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\XjZYFNe.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\rjaZWeJ.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\RZqzFyo.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\bGzmYzk.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\zjKKvfy.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\WtVrOst.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\ljHerkZ.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\eYDbqRQ.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\MEaUmUo.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\NZsgBOG.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\uamtSxt.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\bCgeSOh.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\BWYjtAJ.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\TcuHlQd.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\mtDgGvc.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\TsnLHDx.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\waejXhg.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\BCpesgf.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\ZkkKwEX.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\TlIJwet.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\bZDPyKL.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\SKIGDWZ.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\JNYDvwp.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\DAVgHgH.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\SsJLUqs.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\IhViqqD.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\tKCuHxp.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\WvLgyVK.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\wUFmdWQ.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\eCZFqPA.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
File created	C:\Windows\System\DbdvDJd.exe	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2872	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeLockMemoryPrivilege	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2872	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	29
PID 1904 wrote to memory of 2872	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	29
PID 1904 wrote to memory of 2872	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	29
PID 1904 wrote to memory of 2508	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	30
PID 1904 wrote to memory of 2508	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	30
PID 1904 wrote to memory of 2508	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	30
PID 1904 wrote to memory of 2520	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	31
PID 1904 wrote to memory of 2520	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	31
PID 1904 wrote to memory of 2520	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	31
PID 1904 wrote to memory of 2480	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	32
PID 1904 wrote to memory of 2480	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	32
PID 1904 wrote to memory of 2480	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	32
PID 1904 wrote to memory of 2592	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	33
PID 1904 wrote to memory of 2592	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	33
PID 1904 wrote to memory of 2592	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	33
PID 1904 wrote to memory of 2464	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	34
PID 1904 wrote to memory of 2464	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	34
PID 1904 wrote to memory of 2464	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	34
PID 1904 wrote to memory of 1940	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	35
PID 1904 wrote to memory of 1940	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	35
PID 1904 wrote to memory of 1940	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	35
PID 1904 wrote to memory of 2640	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	36
PID 1904 wrote to memory of 2640	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	36
PID 1904 wrote to memory of 2640	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	36
PID 1904 wrote to memory of 2360	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	37
PID 1904 wrote to memory of 2360	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	37
PID 1904 wrote to memory of 2360	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	37
PID 1904 wrote to memory of 2428	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	38
PID 1904 wrote to memory of 2428	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	38
PID 1904 wrote to memory of 2428	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	38
PID 1904 wrote to memory of 2796	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	39
PID 1904 wrote to memory of 2796	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	39
PID 1904 wrote to memory of 2796	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	39
PID 1904 wrote to memory of 3024	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	40
PID 1904 wrote to memory of 3024	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	40
PID 1904 wrote to memory of 3024	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	40
PID 1904 wrote to memory of 1444	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	41
PID 1904 wrote to memory of 1444	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	41
PID 1904 wrote to memory of 1444	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	41
PID 1904 wrote to memory of 1476	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	42
PID 1904 wrote to memory of 1476	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	42
PID 1904 wrote to memory of 1476	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	42
PID 1904 wrote to memory of 2424	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	43
PID 1904 wrote to memory of 2424	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	43
PID 1904 wrote to memory of 2424	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	43
PID 1904 wrote to memory of 2588	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	44
PID 1904 wrote to memory of 2588	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	44
PID 1904 wrote to memory of 2588	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	44
PID 1904 wrote to memory of 2548	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	45
PID 1904 wrote to memory of 2548	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	45
PID 1904 wrote to memory of 2548	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	45
PID 1904 wrote to memory of 1748	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	46
PID 1904 wrote to memory of 1748	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	46
PID 1904 wrote to memory of 1748	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	46
PID 1904 wrote to memory of 1816	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	47
PID 1904 wrote to memory of 1816	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	47
PID 1904 wrote to memory of 1816	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	47
PID 1904 wrote to memory of 1760	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	48
PID 1904 wrote to memory of 1760	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	48
PID 1904 wrote to memory of 1760	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	48
PID 1904 wrote to memory of 1600	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	49
PID 1904 wrote to memory of 1600	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	49
PID 1904 wrote to memory of 1600	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	49
PID 1904 wrote to memory of 1628	1904	04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04d4a36845d29019ab11f9d517c6203c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\System\DGBffNv.exe
  C:\Windows\System\DGBffNv.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\ELtxEPM.exe
  C:\Windows\System\ELtxEPM.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\PuWuulJ.exe
  C:\Windows\System\PuWuulJ.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\EfyHaMR.exe
  C:\Windows\System\EfyHaMR.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\jTBzxIO.exe
  C:\Windows\System\jTBzxIO.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\hJJUBDP.exe
  C:\Windows\System\hJJUBDP.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\afcNBgI.exe
  C:\Windows\System\afcNBgI.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\SpzTodW.exe
  C:\Windows\System\SpzTodW.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\oHzSAvg.exe
  C:\Windows\System\oHzSAvg.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\zKGJzrz.exe
  C:\Windows\System\zKGJzrz.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\VRtcVFb.exe
  C:\Windows\System\VRtcVFb.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\HzkUGrw.exe
  C:\Windows\System\HzkUGrw.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\LEwvqeE.exe
  C:\Windows\System\LEwvqeE.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\BCQnKeo.exe
  C:\Windows\System\BCQnKeo.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\YrJiUNi.exe
  C:\Windows\System\YrJiUNi.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\HYnwFhY.exe
  C:\Windows\System\HYnwFhY.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\JBjiWcs.exe
  C:\Windows\System\JBjiWcs.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\fUKRXfS.exe
  C:\Windows\System\fUKRXfS.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\XvGaeQv.exe
  C:\Windows\System\XvGaeQv.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\sjSpROI.exe
  C:\Windows\System\sjSpROI.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\JVxjjap.exe
  C:\Windows\System\JVxjjap.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\QILXMhF.exe
  C:\Windows\System\QILXMhF.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\tonsBac.exe
  C:\Windows\System\tonsBac.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\dlALnRJ.exe
  C:\Windows\System\dlALnRJ.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\ZkXpUtr.exe
  C:\Windows\System\ZkXpUtr.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\idtULuX.exe
  C:\Windows\System\idtULuX.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\fCfVxHb.exe
  C:\Windows\System\fCfVxHb.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\Wdsvrlp.exe
  C:\Windows\System\Wdsvrlp.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\pufZKwh.exe
  C:\Windows\System\pufZKwh.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\nKerqyy.exe
  C:\Windows\System\nKerqyy.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\iQaBKkL.exe
  C:\Windows\System\iQaBKkL.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\sXNRccm.exe
  C:\Windows\System\sXNRccm.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\dBQnBII.exe
  C:\Windows\System\dBQnBII.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\FtSbAka.exe
  C:\Windows\System\FtSbAka.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\pUZfifk.exe
  C:\Windows\System\pUZfifk.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\rRXxyEb.exe
  C:\Windows\System\rRXxyEb.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\XezSPkx.exe
  C:\Windows\System\XezSPkx.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\gkyxqDR.exe
  C:\Windows\System\gkyxqDR.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\eFjBYva.exe
  C:\Windows\System\eFjBYva.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\SeLKGVd.exe
  C:\Windows\System\SeLKGVd.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\xrHpisi.exe
  C:\Windows\System\xrHpisi.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\rSDMOUE.exe
  C:\Windows\System\rSDMOUE.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\UeQbJli.exe
  C:\Windows\System\UeQbJli.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\jIrhvvC.exe
  C:\Windows\System\jIrhvvC.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\VpqetMM.exe
  C:\Windows\System\VpqetMM.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\kANaEHU.exe
  C:\Windows\System\kANaEHU.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\gDkTBDG.exe
  C:\Windows\System\gDkTBDG.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\liMGdAI.exe
  C:\Windows\System\liMGdAI.exe
  2⤵
  PID:3012
- C:\Windows\System\QMOMOhL.exe
  C:\Windows\System\QMOMOhL.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\tLAoPjF.exe
  C:\Windows\System\tLAoPjF.exe
  2⤵
  PID:756
- C:\Windows\System\cPveDdo.exe
  C:\Windows\System\cPveDdo.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\pyMloZs.exe
  C:\Windows\System\pyMloZs.exe
  2⤵
  PID:1048
- C:\Windows\System\QItXLcr.exe
  C:\Windows\System\QItXLcr.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\ASFqAWY.exe
  C:\Windows\System\ASFqAWY.exe
  2⤵
  PID:1616
- C:\Windows\System\HGuZhvK.exe
  C:\Windows\System\HGuZhvK.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\TDFYJUV.exe
  C:\Windows\System\TDFYJUV.exe
  2⤵
  PID:556
- C:\Windows\System\qCBQNaX.exe
  C:\Windows\System\qCBQNaX.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\IhvGyUO.exe
  C:\Windows\System\IhvGyUO.exe
  2⤵
  PID:2316
- C:\Windows\System\pTWkqkw.exe
  C:\Windows\System\pTWkqkw.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\ydXgMxY.exe
  C:\Windows\System\ydXgMxY.exe
  2⤵
  PID:1668
- C:\Windows\System\tsKxqQi.exe
  C:\Windows\System\tsKxqQi.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\YULARcp.exe
  C:\Windows\System\YULARcp.exe
  2⤵
  PID:892
- C:\Windows\System\jgGgtgc.exe
  C:\Windows\System\jgGgtgc.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\WmcXSKZ.exe
  C:\Windows\System\WmcXSKZ.exe
  2⤵
  PID:2016
- C:\Windows\System\kZtgZLV.exe
  C:\Windows\System\kZtgZLV.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\DLqxRjf.exe
  C:\Windows\System\DLqxRjf.exe
  2⤵
  PID:2472
- C:\Windows\System\BIPpvmu.exe
  C:\Windows\System\BIPpvmu.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\lrabkTL.exe
  C:\Windows\System\lrabkTL.exe
  2⤵
  PID:2168
- C:\Windows\System\kCnAyBn.exe
  C:\Windows\System\kCnAyBn.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\cKHqRFC.exe
  C:\Windows\System\cKHqRFC.exe
  2⤵
  PID:2632
- C:\Windows\System\qxggoIe.exe
  C:\Windows\System\qxggoIe.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\eUsrEEB.exe
  C:\Windows\System\eUsrEEB.exe
  2⤵
  PID:2820
- C:\Windows\System\UdXarpg.exe
  C:\Windows\System\UdXarpg.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\ViAPnIq.exe
  C:\Windows\System\ViAPnIq.exe
  2⤵
  PID:2804
- C:\Windows\System\IOkwOCf.exe
  C:\Windows\System\IOkwOCf.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\oZWSyqt.exe
  C:\Windows\System\oZWSyqt.exe
  2⤵
  PID:628
- C:\Windows\System\UhDMqfb.exe
  C:\Windows\System\UhDMqfb.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\JcRqdHj.exe
  C:\Windows\System\JcRqdHj.exe
  2⤵
  PID:2252
- C:\Windows\System\fBISljG.exe
  C:\Windows\System\fBISljG.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\fEsAbvY.exe
  C:\Windows\System\fEsAbvY.exe
  2⤵
  PID:1648
- C:\Windows\System\FmOVrLr.exe
  C:\Windows\System\FmOVrLr.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\IoXhIZB.exe
  C:\Windows\System\IoXhIZB.exe
  2⤵
  PID:3008
- C:\Windows\System\anNDYpq.exe
  C:\Windows\System\anNDYpq.exe
  2⤵
  PID:796
- C:\Windows\System\ZoTIMMV.exe
  C:\Windows\System\ZoTIMMV.exe
  2⤵
  PID:292
- C:\Windows\System\rrNHiRq.exe
  C:\Windows\System\rrNHiRq.exe
  2⤵
  PID:1204
- C:\Windows\System\mnInjED.exe
  C:\Windows\System\mnInjED.exe
  2⤵
  PID:1248
- C:\Windows\System\whEpLvH.exe
  C:\Windows\System\whEpLvH.exe
  2⤵
  PID:412
- C:\Windows\System\PIdkWTV.exe
  C:\Windows\System\PIdkWTV.exe
  2⤵
  PID:1252
- C:\Windows\System\YgcTGUk.exe
  C:\Windows\System\YgcTGUk.exe
  2⤵
  PID:324
- C:\Windows\System\YqPjLLE.exe
  C:\Windows\System\YqPjLLE.exe
  2⤵
  PID:1076
- C:\Windows\System\GkCnWvw.exe
  C:\Windows\System\GkCnWvw.exe
  2⤵
  PID:1512
- C:\Windows\System\tauXrFr.exe
  C:\Windows\System\tauXrFr.exe
  2⤵
  PID:1656
- C:\Windows\System\FfNWtAI.exe
  C:\Windows\System\FfNWtAI.exe
  2⤵
  PID:612
- C:\Windows\System\WvshFsl.exe
  C:\Windows\System\WvshFsl.exe
  2⤵
  PID:2132
- C:\Windows\System\wUFmdWQ.exe
  C:\Windows\System\wUFmdWQ.exe
  2⤵
  PID:576
- C:\Windows\System\uOlUkAJ.exe
  C:\Windows\System\uOlUkAJ.exe
  2⤵
  PID:2164
- C:\Windows\System\BmEymBx.exe
  C:\Windows\System\BmEymBx.exe
  2⤵
  PID:2576
- C:\Windows\System\uvFmtTf.exe
  C:\Windows\System\uvFmtTf.exe
  2⤵
  PID:2036
- C:\Windows\System\PIfRHWw.exe
  C:\Windows\System\PIfRHWw.exe
  2⤵
  PID:2396
- C:\Windows\System\zKEWgGL.exe
  C:\Windows\System\zKEWgGL.exe
  2⤵
  PID:2256
- C:\Windows\System\NNIbmTY.exe
  C:\Windows\System\NNIbmTY.exe
  2⤵
  PID:3088
- C:\Windows\System\aGRwOjd.exe
  C:\Windows\System\aGRwOjd.exe
  2⤵
  PID:3104
- C:\Windows\System\KKnnRfY.exe
  C:\Windows\System\KKnnRfY.exe
  2⤵
  PID:3120
- C:\Windows\System\GvKeCjv.exe
  C:\Windows\System\GvKeCjv.exe
  2⤵
  PID:3136
- C:\Windows\System\lsmxeXl.exe
  C:\Windows\System\lsmxeXl.exe
  2⤵
  PID:3152
- C:\Windows\System\LyYDsWB.exe
  C:\Windows\System\LyYDsWB.exe
  2⤵
  PID:3168
- C:\Windows\System\BQOAgfu.exe
  C:\Windows\System\BQOAgfu.exe
  2⤵
  PID:3184
- C:\Windows\System\QqfjdSL.exe
  C:\Windows\System\QqfjdSL.exe
  2⤵
  PID:3200
- C:\Windows\System\hNuhBIG.exe
  C:\Windows\System\hNuhBIG.exe
  2⤵
  PID:3216
- C:\Windows\System\UGBVZoC.exe
  C:\Windows\System\UGBVZoC.exe
  2⤵
  PID:3232
- C:\Windows\System\VzYLpnA.exe
  C:\Windows\System\VzYLpnA.exe
  2⤵
  PID:3248
- C:\Windows\System\HWdyBXk.exe
  C:\Windows\System\HWdyBXk.exe
  2⤵
  PID:3264
- C:\Windows\System\aWONCuX.exe
  C:\Windows\System\aWONCuX.exe
  2⤵
  PID:3280
- C:\Windows\System\qCjnQQn.exe
  C:\Windows\System\qCjnQQn.exe
  2⤵
  PID:3296
- C:\Windows\System\OhLKqRm.exe
  C:\Windows\System\OhLKqRm.exe
  2⤵
  PID:3312
- C:\Windows\System\ozSqrkH.exe
  C:\Windows\System\ozSqrkH.exe
  2⤵
  PID:3328
- C:\Windows\System\wmBbsNh.exe
  C:\Windows\System\wmBbsNh.exe
  2⤵
  PID:3344
- C:\Windows\System\wOrPeiM.exe
  C:\Windows\System\wOrPeiM.exe
  2⤵
  PID:3360
- C:\Windows\System\SxhicsR.exe
  C:\Windows\System\SxhicsR.exe
  2⤵
  PID:3376
- C:\Windows\System\pQcXdBb.exe
  C:\Windows\System\pQcXdBb.exe
  2⤵
  PID:3392
- C:\Windows\System\FaAXwdH.exe
  C:\Windows\System\FaAXwdH.exe
  2⤵
  PID:3408
- C:\Windows\System\YOaGUiM.exe
  C:\Windows\System\YOaGUiM.exe
  2⤵
  PID:3424
- C:\Windows\System\CliSuJl.exe
  C:\Windows\System\CliSuJl.exe
  2⤵
  PID:3440
- C:\Windows\System\CVQoRtC.exe
  C:\Windows\System\CVQoRtC.exe
  2⤵
  PID:3456
- C:\Windows\System\kkGAdrk.exe
  C:\Windows\System\kkGAdrk.exe
  2⤵
  PID:3472
- C:\Windows\System\EBHGGKo.exe
  C:\Windows\System\EBHGGKo.exe
  2⤵
  PID:3488
- C:\Windows\System\GlmePAL.exe
  C:\Windows\System\GlmePAL.exe
  2⤵
  PID:3504
- C:\Windows\System\RZcfwCE.exe
  C:\Windows\System\RZcfwCE.exe
  2⤵
  PID:3520
- C:\Windows\System\mHyVdeA.exe
  C:\Windows\System\mHyVdeA.exe
  2⤵
  PID:3536
- C:\Windows\System\QXfGbwD.exe
  C:\Windows\System\QXfGbwD.exe
  2⤵
  PID:3552
- C:\Windows\System\WufBlhN.exe
  C:\Windows\System\WufBlhN.exe
  2⤵
  PID:3568
- C:\Windows\System\GiESCbi.exe
  C:\Windows\System\GiESCbi.exe
  2⤵
  PID:3584
- C:\Windows\System\HtgRYFq.exe
  C:\Windows\System\HtgRYFq.exe
  2⤵
  PID:3600
- C:\Windows\System\gqmTIQE.exe
  C:\Windows\System\gqmTIQE.exe
  2⤵
  PID:3616
- C:\Windows\System\uZLBeUU.exe
  C:\Windows\System\uZLBeUU.exe
  2⤵
  PID:3632
- C:\Windows\System\lvBRBGe.exe
  C:\Windows\System\lvBRBGe.exe
  2⤵
  PID:3648
- C:\Windows\System\IlkJvwj.exe
  C:\Windows\System\IlkJvwj.exe
  2⤵
  PID:3664
- C:\Windows\System\KOpyLas.exe
  C:\Windows\System\KOpyLas.exe
  2⤵
  PID:3680
- C:\Windows\System\rTKeQZY.exe
  C:\Windows\System\rTKeQZY.exe
  2⤵
  PID:3696
- C:\Windows\System\JaCnVdC.exe
  C:\Windows\System\JaCnVdC.exe
  2⤵
  PID:3712
- C:\Windows\System\YntaSzg.exe
  C:\Windows\System\YntaSzg.exe
  2⤵
  PID:3728
- C:\Windows\System\edIhPZh.exe
  C:\Windows\System\edIhPZh.exe
  2⤵
  PID:3744
- C:\Windows\System\jeNwoJP.exe
  C:\Windows\System\jeNwoJP.exe
  2⤵
  PID:3760
- C:\Windows\System\JwVVaPB.exe
  C:\Windows\System\JwVVaPB.exe
  2⤵
  PID:3776
- C:\Windows\System\FBfbqGZ.exe
  C:\Windows\System\FBfbqGZ.exe
  2⤵
  PID:3792
- C:\Windows\System\HgkLhSi.exe
  C:\Windows\System\HgkLhSi.exe
  2⤵
  PID:3808
- C:\Windows\System\rQfivIr.exe
  C:\Windows\System\rQfivIr.exe
  2⤵
  PID:3824
- C:\Windows\System\bWWnOie.exe
  C:\Windows\System\bWWnOie.exe
  2⤵
  PID:3840
- C:\Windows\System\vhxguzM.exe
  C:\Windows\System\vhxguzM.exe
  2⤵
  PID:3856
- C:\Windows\System\sQfudON.exe
  C:\Windows\System\sQfudON.exe
  2⤵
  PID:3872
- C:\Windows\System\DniqYRa.exe
  C:\Windows\System\DniqYRa.exe
  2⤵
  PID:3888
- C:\Windows\System\BvlFmUK.exe
  C:\Windows\System\BvlFmUK.exe
  2⤵
  PID:3904
- C:\Windows\System\nTaaSAw.exe
  C:\Windows\System\nTaaSAw.exe
  2⤵
  PID:3920
- C:\Windows\System\xrCwDdy.exe
  C:\Windows\System\xrCwDdy.exe
  2⤵
  PID:3936
- C:\Windows\System\AexGEyD.exe
  C:\Windows\System\AexGEyD.exe
  2⤵
  PID:3952
- C:\Windows\System\JRivJlh.exe
  C:\Windows\System\JRivJlh.exe
  2⤵
  PID:3968
- C:\Windows\System\zxboZaR.exe
  C:\Windows\System\zxboZaR.exe
  2⤵
  PID:3984
- C:\Windows\System\SywDnCQ.exe
  C:\Windows\System\SywDnCQ.exe
  2⤵
  PID:4000
- C:\Windows\System\iTJTbIV.exe
  C:\Windows\System\iTJTbIV.exe
  2⤵
  PID:4016
- C:\Windows\System\ulswxGC.exe
  C:\Windows\System\ulswxGC.exe
  2⤵
  PID:4032
- C:\Windows\System\pleEqah.exe
  C:\Windows\System\pleEqah.exe
  2⤵
  PID:4048
- C:\Windows\System\jSIaXEO.exe
  C:\Windows\System\jSIaXEO.exe
  2⤵
  PID:4064
- C:\Windows\System\XEdkVMR.exe
  C:\Windows\System\XEdkVMR.exe
  2⤵
  PID:4080
- C:\Windows\System\PyueNEf.exe
  C:\Windows\System\PyueNEf.exe
  2⤵
  PID:2096
- C:\Windows\System\yQFpugw.exe
  C:\Windows\System\yQFpugw.exe
  2⤵
  PID:488
- C:\Windows\System\cqiCYQx.exe
  C:\Windows\System\cqiCYQx.exe
  2⤵
  PID:2964
- C:\Windows\System\iBgcHXe.exe
  C:\Windows\System\iBgcHXe.exe
  2⤵
  PID:1720
- C:\Windows\System\ogJiLoC.exe
  C:\Windows\System\ogJiLoC.exe
  2⤵
  PID:2008
- C:\Windows\System\VUyIktw.exe
  C:\Windows\System\VUyIktw.exe
  2⤵
  PID:1428
- C:\Windows\System\xiGWqaj.exe
  C:\Windows\System\xiGWqaj.exe
  2⤵
  PID:3128
- C:\Windows\System\VhwOcns.exe
  C:\Windows\System\VhwOcns.exe
  2⤵
  PID:3192
- C:\Windows\System\FSmPVNn.exe
  C:\Windows\System\FSmPVNn.exe
  2⤵
  PID:3256
- C:\Windows\System\MEamqHR.exe
  C:\Windows\System\MEamqHR.exe
  2⤵
  PID:3320
- C:\Windows\System\xKHzYpT.exe
  C:\Windows\System\xKHzYpT.exe
  2⤵
  PID:3384
- C:\Windows\System\cAyToTP.exe
  C:\Windows\System\cAyToTP.exe
  2⤵
  PID:3448
- C:\Windows\System\WCtAWFG.exe
  C:\Windows\System\WCtAWFG.exe
  2⤵
  PID:3512
- C:\Windows\System\YvEdtnA.exe
  C:\Windows\System\YvEdtnA.exe
  2⤵
  PID:3548
- C:\Windows\System\hkdnuzL.exe
  C:\Windows\System\hkdnuzL.exe
  2⤵
  PID:3608
- C:\Windows\System\bDjHFfi.exe
  C:\Windows\System\bDjHFfi.exe
  2⤵
  PID:3672
- C:\Windows\System\APOCsIx.exe
  C:\Windows\System\APOCsIx.exe
  2⤵
  PID:3736
- C:\Windows\System\KwRxefE.exe
  C:\Windows\System\KwRxefE.exe
  2⤵
  PID:3800
- C:\Windows\System\MUPjXDg.exe
  C:\Windows\System\MUPjXDg.exe
  2⤵
  PID:3864
- C:\Windows\System\SbLCjBH.exe
  C:\Windows\System\SbLCjBH.exe
  2⤵
  PID:3928
- C:\Windows\System\axWTRgP.exe
  C:\Windows\System\axWTRgP.exe
  2⤵
  PID:3992
- C:\Windows\System\NUhARdD.exe
  C:\Windows\System\NUhARdD.exe
  2⤵
  PID:4056
- C:\Windows\System\iDobrxj.exe
  C:\Windows\System\iDobrxj.exe
  2⤵
  PID:1564
- C:\Windows\System\VEFSGVJ.exe
  C:\Windows\System\VEFSGVJ.exe
  2⤵
  PID:3096
- C:\Windows\System\rzPTlhH.exe
  C:\Windows\System\rzPTlhH.exe
  2⤵
  PID:3356
- C:\Windows\System\KXaZpII.exe
  C:\Windows\System\KXaZpII.exe
  2⤵
  PID:2656
- C:\Windows\System\ATRLdka.exe
  C:\Windows\System\ATRLdka.exe
  2⤵
  PID:3832
- C:\Windows\System\nITElgF.exe
  C:\Windows\System\nITElgF.exe
  2⤵
  PID:4108
- C:\Windows\System\fIvwXVN.exe
  C:\Windows\System\fIvwXVN.exe
  2⤵
  PID:4124
- C:\Windows\System\NzxtpFG.exe
  C:\Windows\System\NzxtpFG.exe
  2⤵
  PID:4140
- C:\Windows\System\UrHYKcx.exe
  C:\Windows\System\UrHYKcx.exe
  2⤵
  PID:4156
- C:\Windows\System\hNfOAtt.exe
  C:\Windows\System\hNfOAtt.exe
  2⤵
  PID:4172
- C:\Windows\System\IXjLqjI.exe
  C:\Windows\System\IXjLqjI.exe
  2⤵
  PID:4188
- C:\Windows\System\tlkYCvf.exe
  C:\Windows\System\tlkYCvf.exe
  2⤵
  PID:4204
- C:\Windows\System\JDvryWS.exe
  C:\Windows\System\JDvryWS.exe
  2⤵
  PID:4220
- C:\Windows\System\TknSyIp.exe
  C:\Windows\System\TknSyIp.exe
  2⤵
  PID:4236
- C:\Windows\System\PGJYmqs.exe
  C:\Windows\System\PGJYmqs.exe
  2⤵
  PID:4252
- C:\Windows\System\VscQHaC.exe
  C:\Windows\System\VscQHaC.exe
  2⤵
  PID:4268
- C:\Windows\System\WymDMLO.exe
  C:\Windows\System\WymDMLO.exe
  2⤵
  PID:4284
- C:\Windows\System\gNoISiK.exe
  C:\Windows\System\gNoISiK.exe
  2⤵
  PID:4300
- C:\Windows\System\CJfjmEm.exe
  C:\Windows\System\CJfjmEm.exe
  2⤵
  PID:4316
- C:\Windows\System\qsXFfkK.exe
  C:\Windows\System\qsXFfkK.exe
  2⤵
  PID:4332
- C:\Windows\System\HghWoyS.exe
  C:\Windows\System\HghWoyS.exe
  2⤵
  PID:4348
- C:\Windows\System\zxLtXnX.exe
  C:\Windows\System\zxLtXnX.exe
  2⤵
  PID:4364
- C:\Windows\System\WcFrJpv.exe
  C:\Windows\System\WcFrJpv.exe
  2⤵
  PID:4380
- C:\Windows\System\ePJFIMD.exe
  C:\Windows\System\ePJFIMD.exe
  2⤵
  PID:4396
- C:\Windows\System\CpgJTUk.exe
  C:\Windows\System\CpgJTUk.exe
  2⤵
  PID:4412
- C:\Windows\System\PkNJXey.exe
  C:\Windows\System\PkNJXey.exe
  2⤵
  PID:4428
- C:\Windows\System\hejFyIR.exe
  C:\Windows\System\hejFyIR.exe
  2⤵
  PID:4444
- C:\Windows\System\fEIKGWl.exe
  C:\Windows\System\fEIKGWl.exe
  2⤵
  PID:4460
- C:\Windows\System\DDjTxZL.exe
  C:\Windows\System\DDjTxZL.exe
  2⤵
  PID:4480
- C:\Windows\System\nkblcCE.exe
  C:\Windows\System\nkblcCE.exe
  2⤵
  PID:4496
- C:\Windows\System\NCGUKiQ.exe
  C:\Windows\System\NCGUKiQ.exe
  2⤵
  PID:4512
- C:\Windows\System\rUSfZrE.exe
  C:\Windows\System\rUSfZrE.exe
  2⤵
  PID:4528
- C:\Windows\System\kMkZAhr.exe
  C:\Windows\System\kMkZAhr.exe
  2⤵
  PID:4544
- C:\Windows\System\tRoyrPn.exe
  C:\Windows\System\tRoyrPn.exe
  2⤵
  PID:4564
- C:\Windows\System\SCHCnZG.exe
  C:\Windows\System\SCHCnZG.exe
  2⤵
  PID:4580
- C:\Windows\System\caFTdek.exe
  C:\Windows\System\caFTdek.exe
  2⤵
  PID:4596
- C:\Windows\System\rstrTVj.exe
  C:\Windows\System\rstrTVj.exe
  2⤵
  PID:4612
- C:\Windows\System\dPPmAeN.exe
  C:\Windows\System\dPPmAeN.exe
  2⤵
  PID:4628
- C:\Windows\System\khomeRc.exe
  C:\Windows\System\khomeRc.exe
  2⤵
  PID:4644
- C:\Windows\System\ymiWxTJ.exe
  C:\Windows\System\ymiWxTJ.exe
  2⤵
  PID:4660
- C:\Windows\System\mQKfWXv.exe
  C:\Windows\System\mQKfWXv.exe
  2⤵
  PID:4676
- C:\Windows\System\ukLIIwo.exe
  C:\Windows\System\ukLIIwo.exe
  2⤵
  PID:4692
- C:\Windows\System\LcOaklr.exe
  C:\Windows\System\LcOaklr.exe
  2⤵
  PID:4708
- C:\Windows\System\NrVpPjp.exe
  C:\Windows\System\NrVpPjp.exe
  2⤵
  PID:4724
- C:\Windows\System\XdwQtYp.exe
  C:\Windows\System\XdwQtYp.exe
  2⤵
  PID:4740
- C:\Windows\System\DqnclQf.exe
  C:\Windows\System\DqnclQf.exe
  2⤵
  PID:4756
- C:\Windows\System\pRPzpvj.exe
  C:\Windows\System\pRPzpvj.exe
  2⤵
  PID:4772
- C:\Windows\System\WZdCsoL.exe
  C:\Windows\System\WZdCsoL.exe
  2⤵
  PID:4788
- C:\Windows\System\OSvXxkm.exe
  C:\Windows\System\OSvXxkm.exe
  2⤵
  PID:4804
- C:\Windows\System\HTuBVaL.exe
  C:\Windows\System\HTuBVaL.exe
  2⤵
  PID:4820
- C:\Windows\System\jjWngsr.exe
  C:\Windows\System\jjWngsr.exe
  2⤵
  PID:4836
- C:\Windows\System\SQuvDTK.exe
  C:\Windows\System\SQuvDTK.exe
  2⤵
  PID:4852
- C:\Windows\System\DcyMGfR.exe
  C:\Windows\System\DcyMGfR.exe
  2⤵
  PID:4868
- C:\Windows\System\rYVaVbx.exe
  C:\Windows\System\rYVaVbx.exe
  2⤵
  PID:4884
- C:\Windows\System\BjWSbYR.exe
  C:\Windows\System\BjWSbYR.exe
  2⤵
  PID:4900
- C:\Windows\System\wlTAmrj.exe
  C:\Windows\System\wlTAmrj.exe
  2⤵
  PID:4916
- C:\Windows\System\CyIdIFQ.exe
  C:\Windows\System\CyIdIFQ.exe
  2⤵
  PID:4932
- C:\Windows\System\vyjFZcX.exe
  C:\Windows\System\vyjFZcX.exe
  2⤵
  PID:4948
- C:\Windows\System\ZkkKwEX.exe
  C:\Windows\System\ZkkKwEX.exe
  2⤵
  PID:4964
- C:\Windows\System\HDYLhnq.exe
  C:\Windows\System\HDYLhnq.exe
  2⤵
  PID:4980
- C:\Windows\System\RgkeHQb.exe
  C:\Windows\System\RgkeHQb.exe
  2⤵
  PID:4996
- C:\Windows\System\uHeykfR.exe
  C:\Windows\System\uHeykfR.exe
  2⤵
  PID:5012
- C:\Windows\System\GKUVKdt.exe
  C:\Windows\System\GKUVKdt.exe
  2⤵
  PID:5028
- C:\Windows\System\hocBCse.exe
  C:\Windows\System\hocBCse.exe
  2⤵
  PID:5044
- C:\Windows\System\LYuViuo.exe
  C:\Windows\System\LYuViuo.exe
  2⤵
  PID:5060
- C:\Windows\System\TKvabvd.exe
  C:\Windows\System\TKvabvd.exe
  2⤵
  PID:5076
- C:\Windows\System\EvrCDtc.exe
  C:\Windows\System\EvrCDtc.exe
  2⤵
  PID:5092
- C:\Windows\System\mntXNTq.exe
  C:\Windows\System\mntXNTq.exe
  2⤵
  PID:5108
- C:\Windows\System\JktbyPd.exe
  C:\Windows\System\JktbyPd.exe
  2⤵
  PID:3964
- C:\Windows\System\YmhBRoz.exe
  C:\Windows\System\YmhBRoz.exe
  2⤵
  PID:3228
- C:\Windows\System\vsyiaOU.exe
  C:\Windows\System\vsyiaOU.exe
  2⤵
  PID:4120
- C:\Windows\System\RRKMmkE.exe
  C:\Windows\System\RRKMmkE.exe
  2⤵
  PID:2688
- C:\Windows\System\qgDcRWR.exe
  C:\Windows\System\qgDcRWR.exe
  2⤵
  PID:4216
- C:\Windows\System\LjWNncz.exe
  C:\Windows\System\LjWNncz.exe
  2⤵
  PID:4280
- C:\Windows\System\nSUQELq.exe
  C:\Windows\System\nSUQELq.exe
  2⤵
  PID:4344
- C:\Windows\System\NAcYJjW.exe
  C:\Windows\System\NAcYJjW.exe
  2⤵
  PID:4408
- C:\Windows\System\mXuyqNn.exe
  C:\Windows\System\mXuyqNn.exe
  2⤵
  PID:2952
- C:\Windows\System\gUkawJj.exe
  C:\Windows\System\gUkawJj.exe
  2⤵
  PID:328
- C:\Windows\System\bhhgUXM.exe
  C:\Windows\System\bhhgUXM.exe
  2⤵
  PID:1704
- C:\Windows\System\molZgNI.exe
  C:\Windows\System\molZgNI.exe
  2⤵
  PID:2716
- C:\Windows\System\JqXsamH.exe
  C:\Windows\System\JqXsamH.exe
  2⤵
  PID:2680
- C:\Windows\System\XXmcxiz.exe
  C:\Windows\System\XXmcxiz.exe
  2⤵
  PID:1888
- C:\Windows\System\AmGSOHq.exe
  C:\Windows\System\AmGSOHq.exe
  2⤵
  PID:2744
- C:\Windows\System\LOsBpoi.exe
  C:\Windows\System\LOsBpoi.exe
  2⤵
  PID:752
- C:\Windows\System\VZzLXTj.exe
  C:\Windows\System\VZzLXTj.exe
  2⤵
  PID:3116
- C:\Windows\System\FGvGvhX.exe
  C:\Windows\System\FGvGvhX.exe
  2⤵
  PID:3180
- C:\Windows\System\GBeKwhM.exe
  C:\Windows\System\GBeKwhM.exe
  2⤵
  PID:3244
- C:\Windows\System\sqFKorh.exe
  C:\Windows\System\sqFKorh.exe
  2⤵
  PID:3340
- C:\Windows\System\XtQZZJU.exe
  C:\Windows\System\XtQZZJU.exe
  2⤵
  PID:3496
- C:\Windows\System\mkCyrRi.exe
  C:\Windows\System\mkCyrRi.exe
  2⤵
  PID:3560
- C:\Windows\System\QYpdRmB.exe
  C:\Windows\System\QYpdRmB.exe
  2⤵
  PID:3628
- C:\Windows\System\dCrdbUr.exe
  C:\Windows\System\dCrdbUr.exe
  2⤵
  PID:3720
- C:\Windows\System\HgWcsjt.exe
  C:\Windows\System\HgWcsjt.exe
  2⤵
  PID:3788
- C:\Windows\System\EDhciwS.exe
  C:\Windows\System\EDhciwS.exe
  2⤵
  PID:3852
- C:\Windows\System\opZpLaJ.exe
  C:\Windows\System\opZpLaJ.exe
  2⤵
  PID:3916
- C:\Windows\System\XbzrLzL.exe
  C:\Windows\System\XbzrLzL.exe
  2⤵
  PID:4008
- C:\Windows\System\CixoiAN.exe
  C:\Windows\System\CixoiAN.exe
  2⤵
  PID:4076
- C:\Windows\System\skvrqCo.exe
  C:\Windows\System\skvrqCo.exe
  2⤵
  PID:1536
- C:\Windows\System\TmXYSly.exe
  C:\Windows\System\TmXYSly.exe
  2⤵
  PID:3292
- C:\Windows\System\MEaUmUo.exe
  C:\Windows\System\MEaUmUo.exe
  2⤵
  PID:3768
- C:\Windows\System\Uvfjijd.exe
  C:\Windows\System\Uvfjijd.exe
  2⤵
  PID:4100
- C:\Windows\System\MRqkUoI.exe
  C:\Windows\System\MRqkUoI.exe
  2⤵
  PID:4196
- C:\Windows\System\eYzAUjb.exe
  C:\Windows\System\eYzAUjb.exe
  2⤵
  PID:4260
- C:\Windows\System\EZcqWoZ.exe
  C:\Windows\System\EZcqWoZ.exe
  2⤵
  PID:4356
- C:\Windows\System\kPABiAF.exe
  C:\Windows\System\kPABiAF.exe
  2⤵
  PID:4420
- C:\Windows\System\TlIJwet.exe
  C:\Windows\System\TlIJwet.exe
  2⤵
  PID:1736
- C:\Windows\System\cQQcyPX.exe
  C:\Windows\System\cQQcyPX.exe
  2⤵
  PID:2752
- C:\Windows\System\CDlRsoN.exe
  C:\Windows\System\CDlRsoN.exe
  2⤵
  PID:1284
- C:\Windows\System\rJzcZdA.exe
  C:\Windows\System\rJzcZdA.exe
  2⤵
  PID:916
- C:\Windows\System\VBXcdUA.exe
  C:\Windows\System\VBXcdUA.exe
  2⤵
  PID:2476
- C:\Windows\System\IbAZfQW.exe
  C:\Windows\System\IbAZfQW.exe
  2⤵
  PID:4476
- C:\Windows\System\EhcLTLt.exe
  C:\Windows\System\EhcLTLt.exe
  2⤵
  PID:2000
- C:\Windows\System\qfbVJAc.exe
  C:\Windows\System\qfbVJAc.exe
  2⤵
  PID:1712
- C:\Windows\System\QBjaiGY.exe
  C:\Windows\System\QBjaiGY.exe
  2⤵
  PID:4604
- C:\Windows\System\mTDxpYz.exe
  C:\Windows\System\mTDxpYz.exe
  2⤵
  PID:4668
- C:\Windows\System\Cbdmdqx.exe
  C:\Windows\System\Cbdmdqx.exe
  2⤵
  PID:4732
- C:\Windows\System\esvAXQa.exe
  C:\Windows\System\esvAXQa.exe
  2⤵
  PID:4796
- C:\Windows\System\CuSEpEG.exe
  C:\Windows\System\CuSEpEG.exe
  2⤵
  PID:1016
- C:\Windows\System\SflWZFv.exe
  C:\Windows\System\SflWZFv.exe
  2⤵
  PID:4864
- C:\Windows\System\AeguikT.exe
  C:\Windows\System\AeguikT.exe
  2⤵
  PID:4928
- C:\Windows\System\PdhzOYq.exe
  C:\Windows\System\PdhzOYq.exe
  2⤵
  PID:2420
- C:\Windows\System\RIisCmG.exe
  C:\Windows\System\RIisCmG.exe
  2⤵
  PID:4992
- C:\Windows\System\aXrEHgs.exe
  C:\Windows\System\aXrEHgs.exe
  2⤵
  PID:1804
- C:\Windows\System\qxHrEGA.exe
  C:\Windows\System\qxHrEGA.exe
  2⤵
  PID:284
- C:\Windows\System\vWrdFIb.exe
  C:\Windows\System\vWrdFIb.exe
  2⤵
  PID:1548
- C:\Windows\System\LJfkrwH.exe
  C:\Windows\System\LJfkrwH.exe
  2⤵
  PID:1820
- C:\Windows\System\ArSgnpk.exe
  C:\Windows\System\ArSgnpk.exe
  2⤵
  PID:2500
- C:\Windows\System\WqcZdMB.exe
  C:\Windows\System\WqcZdMB.exe
  2⤵
  PID:1828
- C:\Windows\System\mdLsuWv.exe
  C:\Windows\System\mdLsuWv.exe
  2⤵
  PID:1216
- C:\Windows\System\UBekIDA.exe
  C:\Windows\System\UBekIDA.exe
  2⤵
  PID:1212
- C:\Windows\System\ZehLkph.exe
  C:\Windows\System\ZehLkph.exe
  2⤵
  PID:3592
- C:\Windows\System\lbUmGct.exe
  C:\Windows\System\lbUmGct.exe
  2⤵
  PID:4072
- C:\Windows\System\fOjeXtn.exe
  C:\Windows\System\fOjeXtn.exe
  2⤵
  PID:2988
- C:\Windows\System\OVdhAQZ.exe
  C:\Windows\System\OVdhAQZ.exe
  2⤵
  PID:4388
- C:\Windows\System\JfZhHpZ.exe
  C:\Windows\System\JfZhHpZ.exe
  2⤵
  PID:2200
- C:\Windows\System\pNoWrzx.exe
  C:\Windows\System\pNoWrzx.exe
  2⤵
  PID:2552
- C:\Windows\System\PgHwJGu.exe
  C:\Windows\System\PgHwJGu.exe
  2⤵
  PID:4488
- C:\Windows\System\IeJsLlu.exe
  C:\Windows\System\IeJsLlu.exe
  2⤵
  PID:4552
- C:\Windows\System\rfzxNrX.exe
  C:\Windows\System\rfzxNrX.exe
  2⤵
  PID:4620
- C:\Windows\System\ogQpUZm.exe
  C:\Windows\System\ogQpUZm.exe
  2⤵
  PID:4684
- C:\Windows\System\IQXQtQo.exe
  C:\Windows\System\IQXQtQo.exe
  2⤵
  PID:4748
- C:\Windows\System\qqjFWJL.exe
  C:\Windows\System\qqjFWJL.exe
  2⤵
  PID:4812
- C:\Windows\System\CptpSDV.exe
  C:\Windows\System\CptpSDV.exe
  2⤵
  PID:4876
- C:\Windows\System\MPvCdwC.exe
  C:\Windows\System\MPvCdwC.exe
  2⤵
  PID:4940
- C:\Windows\System\KbHqsPR.exe
  C:\Windows\System\KbHqsPR.exe
  2⤵
  PID:5004
- C:\Windows\System\qQzZZPl.exe
  C:\Windows\System\qQzZZPl.exe
  2⤵
  PID:5068
- C:\Windows\System\bReApOS.exe
  C:\Windows\System\bReApOS.exe
  2⤵
  PID:4092
- C:\Windows\System\LApbTZI.exe
  C:\Windows\System\LApbTZI.exe
  2⤵
  PID:4276
- C:\Windows\System\IYXPdlg.exe
  C:\Windows\System\IYXPdlg.exe
  2⤵
  PID:776
- C:\Windows\System\PRxKnfX.exe
  C:\Windows\System\PRxKnfX.exe
  2⤵
  PID:1612
- C:\Windows\System\kVVTlsa.exe
  C:\Windows\System\kVVTlsa.exe
  2⤵
  PID:3400
- C:\Windows\System\msbtDuK.exe
  C:\Windows\System\msbtDuK.exe
  2⤵
  PID:3240
- C:\Windows\System\qSgCsrm.exe
  C:\Windows\System\qSgCsrm.exe
  2⤵
  PID:3660
- C:\Windows\System\jdnkYbQ.exe
  C:\Windows\System\jdnkYbQ.exe
  2⤵
  PID:3948
- C:\Windows\System\kVdNzsE.exe
  C:\Windows\System\kVdNzsE.exe
  2⤵
  PID:3420
- C:\Windows\System\upuphLG.exe
  C:\Windows\System\upuphLG.exe
  2⤵
  PID:3900
- C:\Windows\System\HHZUtmV.exe
  C:\Windows\System\HHZUtmV.exe
  2⤵
  PID:2160
- C:\Windows\System\BAkuHRo.exe
  C:\Windows\System\BAkuHRo.exe
  2⤵
  PID:2260
- C:\Windows\System\JxFuVFe.exe
  C:\Windows\System\JxFuVFe.exe
  2⤵
  PID:3432
- C:\Windows\System\lwaujXS.exe
  C:\Windows\System\lwaujXS.exe
  2⤵
  PID:3624
- C:\Windows\System\XPXDgpE.exe
  C:\Windows\System\XPXDgpE.exe
  2⤵
  PID:4040
- C:\Windows\System\eCZFqPA.exe
  C:\Windows\System\eCZFqPA.exe
  2⤵
  PID:3896
- C:\Windows\System\RDrxRun.exe
  C:\Windows\System\RDrxRun.exe
  2⤵
  PID:1404
- C:\Windows\System\uOTaroC.exe
  C:\Windows\System\uOTaroC.exe
  2⤵
  PID:2432
- C:\Windows\System\algVEiu.exe
  C:\Windows\System\algVEiu.exe
  2⤵
  PID:3480
- C:\Windows\System\MCrKOLw.exe
  C:\Windows\System\MCrKOLw.exe
  2⤵
  PID:4228
- C:\Windows\System\GMRceHJ.exe
  C:\Windows\System\GMRceHJ.exe
  2⤵
  PID:2140
- C:\Windows\System\HGHOWtc.exe
  C:\Windows\System\HGHOWtc.exe
  2⤵
  PID:4472
- C:\Windows\System\IBhYSzF.exe
  C:\Windows\System\IBhYSzF.exe
  2⤵
  PID:4636
- C:\Windows\System\jNxzMeX.exe
  C:\Windows\System\jNxzMeX.exe
  2⤵
  PID:4832
- C:\Windows\System\KKHyiOa.exe
  C:\Windows\System\KKHyiOa.exe
  2⤵
  PID:4440
- C:\Windows\System\jnFnurS.exe
  C:\Windows\System\jnFnurS.exe
  2⤵
  PID:1692
- C:\Windows\System\LEscXmL.exe
  C:\Windows\System\LEscXmL.exe
  2⤵
  PID:2776
- C:\Windows\System\zbJDPRp.exe
  C:\Windows\System\zbJDPRp.exe
  2⤵
  PID:4132
- C:\Windows\System\ygyBeDC.exe
  C:\Windows\System\ygyBeDC.exe
  2⤵
  PID:344
- C:\Windows\System\KuWHlhf.exe
  C:\Windows\System\KuWHlhf.exe
  2⤵
  PID:4716
- C:\Windows\System\gvDQqmX.exe
  C:\Windows\System\gvDQqmX.exe
  2⤵
  PID:2800
- C:\Windows\System\cWEHwVr.exe
  C:\Windows\System\cWEHwVr.exe
  2⤵
  PID:4988
- C:\Windows\System\FBjzBHi.exe
  C:\Windows\System\FBjzBHi.exe
  2⤵
  PID:5088
- C:\Windows\System\FXMifSi.exe
  C:\Windows\System\FXMifSi.exe
  2⤵
  PID:1624
- C:\Windows\System\Vmunuyi.exe
  C:\Windows\System\Vmunuyi.exe
  2⤵
  PID:4292
- C:\Windows\System\CKkeUkk.exe
  C:\Windows\System\CKkeUkk.exe
  2⤵
  PID:4520
- C:\Windows\System\VchbslJ.exe
  C:\Windows\System\VchbslJ.exe
  2⤵
  PID:4972
- C:\Windows\System\QEGfcii.exe
  C:\Windows\System\QEGfcii.exe
  2⤵
  PID:4376
- C:\Windows\System\CYbOGGH.exe
  C:\Windows\System\CYbOGGH.exe
  2⤵
  PID:3148
- C:\Windows\System\VHkBjXf.exe
  C:\Windows\System\VHkBjXf.exe
  2⤵
  PID:3532
- C:\Windows\System\sxXtIAF.exe
  C:\Windows\System\sxXtIAF.exe
  2⤵
  PID:2572
- C:\Windows\System\IohsoLF.exe
  C:\Windows\System\IohsoLF.exe
  2⤵
  PID:4896
- C:\Windows\System\dKgyONJ.exe
  C:\Windows\System\dKgyONJ.exe
  2⤵
  PID:1420
- C:\Windows\System\xxxtSGx.exe
  C:\Windows\System\xxxtSGx.exe
  2⤵
  PID:4164
- C:\Windows\System\UxjkpSs.exe
  C:\Windows\System\UxjkpSs.exe
  2⤵
  PID:4700
- C:\Windows\System\DOKcaoc.exe
  C:\Windows\System\DOKcaoc.exe
  2⤵
  PID:4652
- C:\Windows\System\MXYtvwv.exe
  C:\Windows\System\MXYtvwv.exe
  2⤵
  PID:2488
- C:\Windows\System\XEEjeto.exe
  C:\Windows\System\XEEjeto.exe
  2⤵
  PID:5036
- C:\Windows\System\wGxcECZ.exe
  C:\Windows\System\wGxcECZ.exe
  2⤵
  PID:2612
- C:\Windows\System\XCTPcXN.exe
  C:\Windows\System\XCTPcXN.exe
  2⤵
  PID:3212
- C:\Windows\System\lzCcyQw.exe
  C:\Windows\System\lzCcyQw.exe
  2⤵
  PID:2124
- C:\Windows\System\EPPghZm.exe
  C:\Windows\System\EPPghZm.exe
  2⤵
  PID:3752
- C:\Windows\System\nbcprir.exe
  C:\Windows\System\nbcprir.exe
  2⤵
  PID:888
- C:\Windows\System\iPIDmui.exe
  C:\Windows\System\iPIDmui.exe
  2⤵
  PID:2232
- C:\Windows\System\ulaGNJl.exe
  C:\Windows\System\ulaGNJl.exe
  2⤵
  PID:4956
- C:\Windows\System\jsjxDEc.exe
  C:\Windows\System\jsjxDEc.exe
  2⤵
  PID:320
- C:\Windows\System\XCPEBPE.exe
  C:\Windows\System\XCPEBPE.exe
  2⤵
  PID:544
- C:\Windows\System\eTIDwVg.exe
  C:\Windows\System\eTIDwVg.exe
  2⤵
  PID:5020
- C:\Windows\System\TMRNCrt.exe
  C:\Windows\System\TMRNCrt.exe
  2⤵
  PID:4588
- C:\Windows\System\Bfcrmas.exe
  C:\Windows\System\Bfcrmas.exe
  2⤵
  PID:4960
- C:\Windows\System\bIwTFyE.exe
  C:\Windows\System\bIwTFyE.exe
  2⤵
  PID:4340
- C:\Windows\System\XgUesDE.exe
  C:\Windows\System\XgUesDE.exe
  2⤵
  PID:3784
- C:\Windows\System\FvHKiHl.exe
  C:\Windows\System\FvHKiHl.exe
  2⤵
  PID:2916
- C:\Windows\System\mKcHJfM.exe
  C:\Windows\System\mKcHJfM.exe
  2⤵
  PID:560
- C:\Windows\System\bCgeSOh.exe
  C:\Windows\System\bCgeSOh.exe
  2⤵
  PID:4452
- C:\Windows\System\ZCWdqVP.exe
  C:\Windows\System\ZCWdqVP.exe
  2⤵
  PID:872
- C:\Windows\System\gOEGWTc.exe
  C:\Windows\System\gOEGWTc.exe
  2⤵
  PID:572
- C:\Windows\System\ZCIxliW.exe
  C:\Windows\System\ZCIxliW.exe
  2⤵
  PID:5104
- C:\Windows\System\tqtoiRl.exe
  C:\Windows\System\tqtoiRl.exe
  2⤵
  PID:1880
- C:\Windows\System\JcWgtuf.exe
  C:\Windows\System\JcWgtuf.exe
  2⤵
  PID:4780
- C:\Windows\System\ZfHkXUx.exe
  C:\Windows\System\ZfHkXUx.exe
  2⤵
  PID:4180
- C:\Windows\System\bZDPyKL.exe
  C:\Windows\System\bZDPyKL.exe
  2⤵
  PID:808
- C:\Windows\System\AwWMkCv.exe
  C:\Windows\System\AwWMkCv.exe
  2⤵
  PID:2064
- C:\Windows\System\tDkfLpz.exe
  C:\Windows\System\tDkfLpz.exe
  2⤵
  PID:5024
- C:\Windows\System\LAvHmVy.exe
  C:\Windows\System\LAvHmVy.exe
  2⤵
  PID:2692
- C:\Windows\System\LnVrLfZ.exe
  C:\Windows\System\LnVrLfZ.exe
  2⤵
  PID:4768
- C:\Windows\System\BUYwnWW.exe
  C:\Windows\System\BUYwnWW.exe
  2⤵
  PID:1332
- C:\Windows\System\WHnxCzQ.exe
  C:\Windows\System\WHnxCzQ.exe
  2⤵
  PID:1708
- C:\Windows\System\ulTMTfp.exe
  C:\Windows\System\ulTMTfp.exe
  2⤵
  PID:1632
- C:\Windows\System\vxmUqyt.exe
  C:\Windows\System\vxmUqyt.exe
  2⤵
  PID:3336
- C:\Windows\System\QzahmGL.exe
  C:\Windows\System\QzahmGL.exe
  2⤵
  PID:2368
- C:\Windows\System\XcIlNey.exe
  C:\Windows\System\XcIlNey.exe
  2⤵
  PID:2320
- C:\Windows\System\xVqDIsA.exe
  C:\Windows\System\xVqDIsA.exe
  2⤵
  PID:4536
- C:\Windows\System\lYWiClj.exe
  C:\Windows\System\lYWiClj.exe
  2⤵
  PID:3048
- C:\Windows\System\QoAduOo.exe
  C:\Windows\System\QoAduOo.exe
  2⤵
  PID:2184
- C:\Windows\System\GJfJkin.exe
  C:\Windows\System\GJfJkin.exe
  2⤵
  PID:4152
- C:\Windows\System\zoCcvUL.exe
  C:\Windows\System\zoCcvUL.exe
  2⤵
  PID:5136
- C:\Windows\System\OGtahgz.exe
  C:\Windows\System\OGtahgz.exe
  2⤵
  PID:5152
- C:\Windows\System\BWYjtAJ.exe
  C:\Windows\System\BWYjtAJ.exe
  2⤵
  PID:5168
- C:\Windows\System\pqMmEwQ.exe
  C:\Windows\System\pqMmEwQ.exe
  2⤵
  PID:5184
- C:\Windows\System\EJLvYze.exe
  C:\Windows\System\EJLvYze.exe
  2⤵
  PID:5200
- C:\Windows\System\ijFQBqV.exe
  C:\Windows\System\ijFQBqV.exe
  2⤵
  PID:5216
- C:\Windows\System\jyLutEo.exe
  C:\Windows\System\jyLutEo.exe
  2⤵
  PID:5232
- C:\Windows\System\lWJGykI.exe
  C:\Windows\System\lWJGykI.exe
  2⤵
  PID:5248
- C:\Windows\System\JgvMXaf.exe
  C:\Windows\System\JgvMXaf.exe
  2⤵
  PID:5264
- C:\Windows\System\WwJyLtv.exe
  C:\Windows\System\WwJyLtv.exe
  2⤵
  PID:5280
- C:\Windows\System\pCDwkvJ.exe
  C:\Windows\System\pCDwkvJ.exe
  2⤵
  PID:5296
- C:\Windows\System\aLCLLpI.exe
  C:\Windows\System\aLCLLpI.exe
  2⤵
  PID:5312
- C:\Windows\System\ljOGQQW.exe
  C:\Windows\System\ljOGQQW.exe
  2⤵
  PID:5328
- C:\Windows\System\PkcuNtg.exe
  C:\Windows\System\PkcuNtg.exe
  2⤵
  PID:5344
- C:\Windows\System\gpgVbLi.exe
  C:\Windows\System\gpgVbLi.exe
  2⤵
  PID:5360
- C:\Windows\System\SpyIuvA.exe
  C:\Windows\System\SpyIuvA.exe
  2⤵
  PID:5376
- C:\Windows\System\LGsTZit.exe
  C:\Windows\System\LGsTZit.exe
  2⤵
  PID:5392
- C:\Windows\System\QJHyRtd.exe
  C:\Windows\System\QJHyRtd.exe
  2⤵
  PID:5408
- C:\Windows\System\nFmuHwS.exe
  C:\Windows\System\nFmuHwS.exe
  2⤵
  PID:5424
- C:\Windows\System\ATfmVen.exe
  C:\Windows\System\ATfmVen.exe
  2⤵
  PID:5440
- C:\Windows\System\RZqzFyo.exe
  C:\Windows\System\RZqzFyo.exe
  2⤵
  PID:5456
- C:\Windows\System\XDReHYy.exe
  C:\Windows\System\XDReHYy.exe
  2⤵
  PID:5476
- C:\Windows\System\oOMcjSX.exe
  C:\Windows\System\oOMcjSX.exe
  2⤵
  PID:5492
- C:\Windows\System\BAFmSoa.exe
  C:\Windows\System\BAFmSoa.exe
  2⤵
  PID:5508
- C:\Windows\System\tFdqMwl.exe
  C:\Windows\System\tFdqMwl.exe
  2⤵
  PID:5524
- C:\Windows\System\lDtfJpq.exe
  C:\Windows\System\lDtfJpq.exe
  2⤵
  PID:5540
- C:\Windows\System\qpSYOat.exe
  C:\Windows\System\qpSYOat.exe
  2⤵
  PID:5556
- C:\Windows\System\vqlgHtI.exe
  C:\Windows\System\vqlgHtI.exe
  2⤵
  PID:5572
- C:\Windows\System\UuntPPR.exe
  C:\Windows\System\UuntPPR.exe
  2⤵
  PID:5588
- C:\Windows\System\nGjONlL.exe
  C:\Windows\System\nGjONlL.exe
  2⤵
  PID:5604
- C:\Windows\System\WbSrVtL.exe
  C:\Windows\System\WbSrVtL.exe
  2⤵
  PID:5620
- C:\Windows\System\LcBvQNS.exe
  C:\Windows\System\LcBvQNS.exe
  2⤵
  PID:5636
- C:\Windows\System\BSphqtJ.exe
  C:\Windows\System\BSphqtJ.exe
  2⤵
  PID:5652
- C:\Windows\System\ZbCLcqC.exe
  C:\Windows\System\ZbCLcqC.exe
  2⤵
  PID:5668
- C:\Windows\System\YnkubXY.exe
  C:\Windows\System\YnkubXY.exe
  2⤵
  PID:5684
- C:\Windows\System\CPrWpEn.exe
  C:\Windows\System\CPrWpEn.exe
  2⤵
  PID:5700
- C:\Windows\System\SKIGDWZ.exe
  C:\Windows\System\SKIGDWZ.exe
  2⤵
  PID:5716
- C:\Windows\System\ceWVQrQ.exe
  C:\Windows\System\ceWVQrQ.exe
  2⤵
  PID:5732
- C:\Windows\System\TwKKpiB.exe
  C:\Windows\System\TwKKpiB.exe
  2⤵
  PID:5748
- C:\Windows\System\SieVmyl.exe
  C:\Windows\System\SieVmyl.exe
  2⤵
  PID:5764
- C:\Windows\System\cQLvSMu.exe
  C:\Windows\System\cQLvSMu.exe
  2⤵
  PID:5780
- C:\Windows\System\eMAKWtR.exe
  C:\Windows\System\eMAKWtR.exe
  2⤵
  PID:5796
- C:\Windows\System\TlsqiJT.exe
  C:\Windows\System\TlsqiJT.exe
  2⤵
  PID:5812
- C:\Windows\System\iMuFKTk.exe
  C:\Windows\System\iMuFKTk.exe
  2⤵
  PID:5828
- C:\Windows\System\MhHoFVA.exe
  C:\Windows\System\MhHoFVA.exe
  2⤵
  PID:5844
- C:\Windows\System\kdlbJIo.exe
  C:\Windows\System\kdlbJIo.exe
  2⤵
  PID:5860
- C:\Windows\System\dzQrPXK.exe
  C:\Windows\System\dzQrPXK.exe
  2⤵
  PID:5876
- C:\Windows\System\FpvCCpf.exe
  C:\Windows\System\FpvCCpf.exe
  2⤵
  PID:5892
- C:\Windows\System\VrOzAvm.exe
  C:\Windows\System\VrOzAvm.exe
  2⤵
  PID:5908
- C:\Windows\System\ySXDcEo.exe
  C:\Windows\System\ySXDcEo.exe
  2⤵
  PID:5924
- C:\Windows\System\ZsxPjoO.exe
  C:\Windows\System\ZsxPjoO.exe
  2⤵
  PID:5940
- C:\Windows\System\TSOVWBm.exe
  C:\Windows\System\TSOVWBm.exe
  2⤵
  PID:5956
- C:\Windows\System\pAKdAQy.exe
  C:\Windows\System\pAKdAQy.exe
  2⤵
  PID:5972
- C:\Windows\System\hMYftBi.exe
  C:\Windows\System\hMYftBi.exe
  2⤵
  PID:5988
- C:\Windows\System\cwWMiAP.exe
  C:\Windows\System\cwWMiAP.exe
  2⤵
  PID:6004
- C:\Windows\System\RRFjDHD.exe
  C:\Windows\System\RRFjDHD.exe
  2⤵
  PID:6020
- C:\Windows\System\cuMiKMg.exe
  C:\Windows\System\cuMiKMg.exe
  2⤵
  PID:6036
- C:\Windows\System\qUklHnf.exe
  C:\Windows\System\qUklHnf.exe
  2⤵
  PID:6052
- C:\Windows\System\btSsRnb.exe
  C:\Windows\System\btSsRnb.exe
  2⤵
  PID:6068
- C:\Windows\System\rKgEEjf.exe
  C:\Windows\System\rKgEEjf.exe
  2⤵
  PID:6084
- C:\Windows\System\IrRUDbR.exe
  C:\Windows\System\IrRUDbR.exe
  2⤵
  PID:6100
- C:\Windows\System\CFaiusd.exe
  C:\Windows\System\CFaiusd.exe
  2⤵
  PID:6116
- C:\Windows\System\tEdLhCU.exe
  C:\Windows\System\tEdLhCU.exe
  2⤵
  PID:6132
- C:\Windows\System\pjBSpHt.exe
  C:\Windows\System\pjBSpHt.exe
  2⤵
  PID:2024
- C:\Windows\System\oLzlcka.exe
  C:\Windows\System\oLzlcka.exe
  2⤵
  PID:4324
- C:\Windows\System\XvJCSJt.exe
  C:\Windows\System\XvJCSJt.exe
  2⤵
  PID:5164
- C:\Windows\System\kQTfjSP.exe
  C:\Windows\System\kQTfjSP.exe
  2⤵
  PID:2264
- C:\Windows\System\bCzVTkk.exe
  C:\Windows\System\bCzVTkk.exe
  2⤵
  PID:2532
- C:\Windows\System\hQYBbck.exe
  C:\Windows\System\hQYBbck.exe
  2⤵
  PID:580
- C:\Windows\System\uECRASt.exe
  C:\Windows\System\uECRASt.exe
  2⤵
  PID:2816
- C:\Windows\System\ejfoZPI.exe
  C:\Windows\System\ejfoZPI.exe
  2⤵
  PID:5256
- C:\Windows\System\lACZhcK.exe
  C:\Windows\System\lACZhcK.exe
  2⤵
  PID:5320
- C:\Windows\System\xIahUNN.exe
  C:\Windows\System\xIahUNN.exe
  2⤵
  PID:5384
- C:\Windows\System\XGNJqEZ.exe
  C:\Windows\System\XGNJqEZ.exe
  2⤵
  PID:5452
- C:\Windows\System\dsSMRSw.exe
  C:\Windows\System\dsSMRSw.exe
  2⤵
  PID:5488
- C:\Windows\System\ijgmPuP.exe
  C:\Windows\System\ijgmPuP.exe
  2⤵
  PID:5340
- C:\Windows\System\NZsgBOG.exe
  C:\Windows\System\NZsgBOG.exe
  2⤵
  PID:5404
- C:\Windows\System\IMqWNlJ.exe
  C:\Windows\System\IMqWNlJ.exe
  2⤵
  PID:5468
- C:\Windows\System\kmXEjzg.exe
  C:\Windows\System\kmXEjzg.exe
  2⤵
  PID:5548
- C:\Windows\System\fQUEJoz.exe
  C:\Windows\System\fQUEJoz.exe
  2⤵
  PID:1380
- C:\Windows\System\LtQUOAM.exe
  C:\Windows\System\LtQUOAM.exe
  2⤵
  PID:4844
- C:\Windows\System\iktxgup.exe
  C:\Windows\System\iktxgup.exe
  2⤵
  PID:5616
- C:\Windows\System\ePeiOZG.exe
  C:\Windows\System\ePeiOZG.exe
  2⤵
  PID:5712
- C:\Windows\System\EGxNuXW.exe
  C:\Windows\System\EGxNuXW.exe
  2⤵
  PID:5304
- C:\Windows\System\QVufbbu.exe
  C:\Windows\System\QVufbbu.exe
  2⤵
  PID:5808
- C:\Windows\System\lnHhWSy.exe
  C:\Windows\System\lnHhWSy.exe
  2⤵
  PID:5872
- C:\Windows\System\qQAvbUH.exe
  C:\Windows\System\qQAvbUH.exe
  2⤵
  PID:5144
- C:\Windows\System\khWvtYU.exe
  C:\Windows\System\khWvtYU.exe
  2⤵
  PID:5208
- C:\Windows\System\gaBxGlR.exe
  C:\Windows\System\gaBxGlR.exe
  2⤵
  PID:5904
- C:\Windows\System\BOSIdQp.exe
  C:\Windows\System\BOSIdQp.exe
  2⤵
  PID:5968
- C:\Windows\System\imlybTI.exe
  C:\Windows\System\imlybTI.exe
  2⤵
  PID:6000
- C:\Windows\System\KPbKiUc.exe
  C:\Windows\System\KPbKiUc.exe
  2⤵
  PID:5568
- C:\Windows\System\EfFKPea.exe
  C:\Windows\System\EfFKPea.exe
  2⤵
  PID:5628
- C:\Windows\System\uEsnYCv.exe
  C:\Windows\System\uEsnYCv.exe
  2⤵
  PID:5692
- C:\Windows\System\JDnZjzk.exe
  C:\Windows\System\JDnZjzk.exe
  2⤵
  PID:5760
- C:\Windows\System\VaoeABX.exe
  C:\Windows\System\VaoeABX.exe
  2⤵
  PID:5788
- C:\Windows\System\dPsNMcv.exe
  C:\Windows\System\dPsNMcv.exe
  2⤵
  PID:6128
- C:\Windows\System\qegmCBL.exe
  C:\Windows\System\qegmCBL.exe
  2⤵
  PID:4456
- C:\Windows\System\BWswUgM.exe
  C:\Windows\System\BWswUgM.exe
  2⤵
  PID:5852
- C:\Windows\System\xnNbyUk.exe
  C:\Windows\System\xnNbyUk.exe
  2⤵
  PID:5916
- C:\Windows\System\uSeRhxp.exe
  C:\Windows\System\uSeRhxp.exe
  2⤵
  PID:5132
- C:\Windows\System\sHaptEz.exe
  C:\Windows\System\sHaptEz.exe
  2⤵
  PID:5980
- C:\Windows\System\JwVKiIc.exe
  C:\Windows\System\JwVKiIc.exe
  2⤵
  PID:6012
- C:\Windows\System\qjZbmBG.exe
  C:\Windows\System\qjZbmBG.exe
  2⤵
  PID:4116
- C:\Windows\System\xZSMWgF.exe
  C:\Windows\System\xZSMWgF.exe
  2⤵
  PID:5516
- C:\Windows\System\oTMfIIU.exe
  C:\Windows\System\oTMfIIU.exe
  2⤵
  PID:6044
- C:\Windows\System\vGFSVZy.exe
  C:\Windows\System\vGFSVZy.exe
  2⤵
  PID:6108
- C:\Windows\System\lWGiWvu.exe
  C:\Windows\System\lWGiWvu.exe
  2⤵
  PID:5160
- C:\Windows\System\ELMZXyM.exe
  C:\Windows\System\ELMZXyM.exe
  2⤵
  PID:5648
- C:\Windows\System\AGHUhDT.exe
  C:\Windows\System\AGHUhDT.exe
  2⤵
  PID:5416
- C:\Windows\System\TcuHlQd.exe
  C:\Windows\System\TcuHlQd.exe
  2⤵
  PID:5336
- C:\Windows\System\lZVvJFb.exe
  C:\Windows\System\lZVvJFb.exe
  2⤵
  PID:5584
- C:\Windows\System\pEgjIIs.exe
  C:\Windows\System\pEgjIIs.exe
  2⤵
  PID:5708
- C:\Windows\System\DXfIbIj.exe
  C:\Windows\System\DXfIbIj.exe
  2⤵
  PID:2540
- C:\Windows\System\qPKYgPQ.exe
  C:\Windows\System\qPKYgPQ.exe
  2⤵
  PID:5996
- C:\Windows\System\XlYxxPj.exe
  C:\Windows\System\XlYxxPj.exe
  2⤵
  PID:5728
- C:\Windows\System\TNnTGAa.exe
  C:\Windows\System\TNnTGAa.exe
  2⤵
  PID:5776
- C:\Windows\System\ogFCujH.exe
  C:\Windows\System\ogFCujH.exe
  2⤵
  PID:5180
- C:\Windows\System\BrZButG.exe
  C:\Windows\System\BrZButG.exe
  2⤵
  PID:5564
- C:\Windows\System\sURXPbA.exe
  C:\Windows\System\sURXPbA.exe
  2⤵
  PID:6152
- C:\Windows\System\FAwhfvs.exe
  C:\Windows\System\FAwhfvs.exe
  2⤵
  PID:6168
- C:\Windows\System\QkFHxbr.exe
  C:\Windows\System\QkFHxbr.exe
  2⤵
  PID:6184
- C:\Windows\System\zJQusXC.exe
  C:\Windows\System\zJQusXC.exe
  2⤵
  PID:6200
- C:\Windows\System\dcYazNC.exe
  C:\Windows\System\dcYazNC.exe
  2⤵
  PID:6216
- C:\Windows\System\wTqQtOR.exe
  C:\Windows\System\wTqQtOR.exe
  2⤵
  PID:6232
- C:\Windows\System\EYAlzDo.exe
  C:\Windows\System\EYAlzDo.exe
  2⤵
  PID:6248
- C:\Windows\System\FcHWyAO.exe
  C:\Windows\System\FcHWyAO.exe
  2⤵
  PID:6264
- C:\Windows\System\GqhTFtL.exe
  C:\Windows\System\GqhTFtL.exe
  2⤵
  PID:6280
- C:\Windows\System\EKvcaRz.exe
  C:\Windows\System\EKvcaRz.exe
  2⤵
  PID:6296
- C:\Windows\System\TIBQYbU.exe
  C:\Windows\System\TIBQYbU.exe
  2⤵
  PID:6312
- C:\Windows\System\bFHavVh.exe
  C:\Windows\System\bFHavVh.exe
  2⤵
  PID:6328
- C:\Windows\System\XuaCbti.exe
  C:\Windows\System\XuaCbti.exe
  2⤵
  PID:6344
- C:\Windows\System\LRWetJd.exe
  C:\Windows\System\LRWetJd.exe
  2⤵
  PID:6360
- C:\Windows\System\motVjYI.exe
  C:\Windows\System\motVjYI.exe
  2⤵
  PID:6376
- C:\Windows\System\gpjjSJJ.exe
  C:\Windows\System\gpjjSJJ.exe
  2⤵
  PID:6392
- C:\Windows\System\NYoKHnC.exe
  C:\Windows\System\NYoKHnC.exe
  2⤵
  PID:6408
- C:\Windows\System\LZOcrJF.exe
  C:\Windows\System\LZOcrJF.exe
  2⤵
  PID:6424
- C:\Windows\System\CpdWmtt.exe
  C:\Windows\System\CpdWmtt.exe
  2⤵
  PID:6440
- C:\Windows\System\KUyrFaq.exe
  C:\Windows\System\KUyrFaq.exe
  2⤵
  PID:6456
- C:\Windows\System\RUCVXFc.exe
  C:\Windows\System\RUCVXFc.exe
  2⤵
  PID:6472
- C:\Windows\System\WycYUcC.exe
  C:\Windows\System\WycYUcC.exe
  2⤵
  PID:6488
- C:\Windows\System\ynFAYqR.exe
  C:\Windows\System\ynFAYqR.exe
  2⤵
  PID:6504
- C:\Windows\System\sTtZzFr.exe
  C:\Windows\System\sTtZzFr.exe
  2⤵
  PID:6520
- C:\Windows\System\adLmICh.exe
  C:\Windows\System\adLmICh.exe
  2⤵
  PID:6536
- C:\Windows\System\qxtfzMO.exe
  C:\Windows\System\qxtfzMO.exe
  2⤵
  PID:6552
- C:\Windows\System\fneVHhb.exe
  C:\Windows\System\fneVHhb.exe
  2⤵
  PID:6568
- C:\Windows\System\CHLJfRK.exe
  C:\Windows\System\CHLJfRK.exe
  2⤵
  PID:6584
- C:\Windows\System\xlDVcmX.exe
  C:\Windows\System\xlDVcmX.exe
  2⤵
  PID:6600
- C:\Windows\System\EIIuEdQ.exe
  C:\Windows\System\EIIuEdQ.exe
  2⤵
  PID:6616
- C:\Windows\System\tGmgsIv.exe
  C:\Windows\System\tGmgsIv.exe
  2⤵
  PID:6632
- C:\Windows\System\eagKvMw.exe
  C:\Windows\System\eagKvMw.exe
  2⤵
  PID:6648
- C:\Windows\System\XbdgfkS.exe
  C:\Windows\System\XbdgfkS.exe
  2⤵
  PID:6664
- C:\Windows\System\SIhEoaK.exe
  C:\Windows\System\SIhEoaK.exe
  2⤵
  PID:6680
- C:\Windows\System\VJHONgq.exe
  C:\Windows\System\VJHONgq.exe
  2⤵
  PID:6696
- C:\Windows\System\alWMbkv.exe
  C:\Windows\System\alWMbkv.exe
  2⤵
  PID:6712
- C:\Windows\System\DPZepim.exe
  C:\Windows\System\DPZepim.exe
  2⤵
  PID:6728
- C:\Windows\System\AqdlOhi.exe
  C:\Windows\System\AqdlOhi.exe
  2⤵
  PID:6744
- C:\Windows\System\DUSHpjz.exe
  C:\Windows\System\DUSHpjz.exe
  2⤵
  PID:6760
- C:\Windows\System\WDxJKSj.exe
  C:\Windows\System\WDxJKSj.exe
  2⤵
  PID:6776
- C:\Windows\System\YbdVfsi.exe
  C:\Windows\System\YbdVfsi.exe
  2⤵
  PID:6792
- C:\Windows\System\ZoyOOMX.exe
  C:\Windows\System\ZoyOOMX.exe
  2⤵
  PID:6808
- C:\Windows\System\lZJiQjl.exe
  C:\Windows\System\lZJiQjl.exe
  2⤵
  PID:6824
- C:\Windows\System\fsBIMQo.exe
  C:\Windows\System\fsBIMQo.exe
  2⤵
  PID:6840
- C:\Windows\System\ePQAczn.exe
  C:\Windows\System\ePQAczn.exe
  2⤵
  PID:6860
- C:\Windows\System\SgBcboF.exe
  C:\Windows\System\SgBcboF.exe
  2⤵
  PID:6876
- C:\Windows\System\EKgZBdT.exe
  C:\Windows\System\EKgZBdT.exe
  2⤵
  PID:6892
- C:\Windows\System\zPTMnBH.exe
  C:\Windows\System\zPTMnBH.exe
  2⤵
  PID:6912
- C:\Windows\System\mjawmda.exe
  C:\Windows\System\mjawmda.exe
  2⤵
  PID:6936
- C:\Windows\System\gaZnilG.exe
  C:\Windows\System\gaZnilG.exe
  2⤵
  PID:6952
- C:\Windows\System\ZhsgOWA.exe
  C:\Windows\System\ZhsgOWA.exe
  2⤵
  PID:6968
- C:\Windows\System\RqQpCVs.exe
  C:\Windows\System\RqQpCVs.exe
  2⤵
  PID:6988
- C:\Windows\System\LIJzjdO.exe
  C:\Windows\System\LIJzjdO.exe
  2⤵
  PID:7004
- C:\Windows\System\abPNUhf.exe
  C:\Windows\System\abPNUhf.exe
  2⤵
  PID:7020
- C:\Windows\System\waPQXSd.exe
  C:\Windows\System\waPQXSd.exe
  2⤵
  PID:7036
- C:\Windows\System\AFYnEzu.exe
  C:\Windows\System\AFYnEzu.exe
  2⤵
  PID:7056
- C:\Windows\System\CMhcKAT.exe
  C:\Windows\System\CMhcKAT.exe
  2⤵
  PID:7072
- C:\Windows\System\fiOxSrA.exe
  C:\Windows\System\fiOxSrA.exe
  2⤵
  PID:7088
- C:\Windows\System\vUSSbeP.exe
  C:\Windows\System\vUSSbeP.exe
  2⤵
  PID:7104
- C:\Windows\System\AwpUNtt.exe
  C:\Windows\System\AwpUNtt.exe
  2⤵
  PID:7120
- C:\Windows\System\WQJKtjd.exe
  C:\Windows\System\WQJKtjd.exe
  2⤵
  PID:7136
- C:\Windows\System\JRFbKrC.exe
  C:\Windows\System\JRFbKrC.exe
  2⤵
  PID:7152
- C:\Windows\System\IdrIxRf.exe
  C:\Windows\System\IdrIxRf.exe
  2⤵
  PID:5820
- C:\Windows\System\hnDyecy.exe
  C:\Windows\System\hnDyecy.exe
  2⤵
  PID:6076
- C:\Windows\System\fauHqcm.exe
  C:\Windows\System\fauHqcm.exe
  2⤵
  PID:5420
- C:\Windows\System\cigSjYW.exe
  C:\Windows\System\cigSjYW.exe
  2⤵
  PID:5244
- C:\Windows\System\EnFVnch.exe
  C:\Windows\System\EnFVnch.exe
  2⤵
  PID:5964
- C:\Windows\System\rXDoEUt.exe
  C:\Windows\System\rXDoEUt.exe
  2⤵
  PID:6192
- C:\Windows\System\RfDAzCH.exe
  C:\Windows\System\RfDAzCH.exe
  2⤵
  PID:2636
- C:\Windows\System\wZVDlFJ.exe
  C:\Windows\System\wZVDlFJ.exe
  2⤵
  PID:6224
- C:\Windows\System\CpLrUSN.exe
  C:\Windows\System\CpLrUSN.exe
  2⤵
  PID:6288
- C:\Windows\System\gsESzly.exe
  C:\Windows\System\gsESzly.exe
  2⤵
  PID:6324
- C:\Windows\System\PQfXfqR.exe
  C:\Windows\System\PQfXfqR.exe
  2⤵
  PID:848
- C:\Windows\System\LJfLldO.exe
  C:\Windows\System\LJfLldO.exe
  2⤵
  PID:5948
- C:\Windows\System\JNYDvwp.exe
  C:\Windows\System\JNYDvwp.exe
  2⤵
  PID:3084
- C:\Windows\System\IDpIWHz.exe
  C:\Windows\System\IDpIWHz.exe
  2⤵
  PID:3464
- C:\Windows\System\WycoDFK.exe
  C:\Windows\System\WycoDFK.exe
  2⤵
  PID:5804
- C:\Windows\System\esCeifT.exe
  C:\Windows\System\esCeifT.exe
  2⤵
  PID:5868
- C:\Windows\System\jOlIcdr.exe
  C:\Windows\System\jOlIcdr.exe
  2⤵
  PID:6176
- C:\Windows\System\lPDzvgA.exe
  C:\Windows\System\lPDzvgA.exe
  2⤵
  PID:6212
- C:\Windows\System\ZeEHDCH.exe
  C:\Windows\System\ZeEHDCH.exe
  2⤵
  PID:608
- C:\Windows\System\YiQPCIL.exe
  C:\Windows\System\YiQPCIL.exe
  2⤵
  PID:6420
- C:\Windows\System\UPxAjkq.exe
  C:\Windows\System\UPxAjkq.exe
  2⤵
  PID:6484
- C:\Windows\System\MzoCgqA.exe
  C:\Windows\System\MzoCgqA.exe
  2⤵
  PID:6340
- C:\Windows\System\bsTFcmj.exe
  C:\Windows\System\bsTFcmj.exe
  2⤵
  PID:6516
- C:\Windows\System\zlxkuaR.exe
  C:\Windows\System\zlxkuaR.exe
  2⤵
  PID:6532
- C:\Windows\System\xjSaNDR.exe
  C:\Windows\System\xjSaNDR.exe
  2⤵
  PID:6464
- C:\Windows\System\WwfGkRk.exe
  C:\Windows\System\WwfGkRk.exe
  2⤵
  PID:6560
- C:\Windows\System\BsAcojW.exe
  C:\Windows\System\BsAcojW.exe
  2⤵
  PID:6596
- C:\Windows\System\wsYvBSR.exe
  C:\Windows\System\wsYvBSR.exe
  2⤵
  PID:6624
- C:\Windows\System\GSEJbma.exe
  C:\Windows\System\GSEJbma.exe
  2⤵
  PID:2100
- C:\Windows\System\mlSruyC.exe
  C:\Windows\System\mlSruyC.exe
  2⤵
  PID:6672
- C:\Windows\System\ykozujC.exe
  C:\Windows\System\ykozujC.exe
  2⤵
  PID:6768
- C:\Windows\System\xhvgreR.exe
  C:\Windows\System\xhvgreR.exe
  2⤵
  PID:6608
- C:\Windows\System\tGbGJKr.exe
  C:\Windows\System\tGbGJKr.exe
  2⤵
  PID:6740
- C:\Windows\System\tYsqjaX.exe
  C:\Windows\System\tYsqjaX.exe
  2⤵
  PID:6836
- C:\Windows\System\HQVTLND.exe
  C:\Windows\System\HQVTLND.exe
  2⤵
  PID:6788
- C:\Windows\System\eypNQYB.exe
  C:\Windows\System\eypNQYB.exe
  2⤵
  PID:6692
- C:\Windows\System\StIdlHF.exe
  C:\Windows\System\StIdlHF.exe
  2⤵
  PID:6816
- C:\Windows\System\vWwVNBm.exe
  C:\Windows\System\vWwVNBm.exe
  2⤵
  PID:6848
- C:\Windows\System\bzGvyxx.exe
  C:\Windows\System\bzGvyxx.exe
  2⤵
  PID:6980
- C:\Windows\System\gEzsEsC.exe
  C:\Windows\System\gEzsEsC.exe
  2⤵
  PID:6704
- C:\Windows\System\byvTdkH.exe
  C:\Windows\System\byvTdkH.exe
  2⤵
  PID:7052
- C:\Windows\System\KzhSBks.exe
  C:\Windows\System\KzhSBks.exe
  2⤵
  PID:6960
- C:\Windows\System\fybjJUi.exe
  C:\Windows\System\fybjJUi.exe
  2⤵
  PID:6256
- C:\Windows\System\rJskBDw.exe
  C:\Windows\System\rJskBDw.exe
  2⤵
  PID:6976
- C:\Windows\System\PQOjXiI.exe
  C:\Windows\System\PQOjXiI.exe
  2⤵
  PID:6320
- C:\Windows\System\qMfIWtg.exe
  C:\Windows\System\qMfIWtg.exe
  2⤵
  PID:5744
- C:\Windows\System\SXSTHIT.exe
  C:\Windows\System\SXSTHIT.exe
  2⤵
  PID:6416
- C:\Windows\System\bpZyHUE.exe
  C:\Windows\System\bpZyHUE.exe
  2⤵
  PID:6804
- C:\Windows\System\lfPUQGh.exe
  C:\Windows\System\lfPUQGh.exe
  2⤵
  PID:7112
- C:\Windows\System\HDsfEnF.exe
  C:\Windows\System\HDsfEnF.exe
  2⤵
  PID:6924
- C:\Windows\System\DAVgHgH.exe
  C:\Windows\System\DAVgHgH.exe
  2⤵
  PID:7068
- C:\Windows\System\enHcYpA.exe
  C:\Windows\System\enHcYpA.exe
  2⤵
  PID:7096
- C:\Windows\System\AnDzlLW.exe
  C:\Windows\System\AnDzlLW.exe
  2⤵
  PID:6688
- C:\Windows\System\vMFfShB.exe
  C:\Windows\System\vMFfShB.exe
  2⤵
  PID:5276
- C:\Windows\System\wHgiYlk.exe
  C:\Windows\System\wHgiYlk.exe
  2⤵
  PID:7044
- C:\Windows\System\TwvxXPK.exe
  C:\Windows\System\TwvxXPK.exe
  2⤵
  PID:6548
- C:\Windows\System\Frlrflm.exe
  C:\Windows\System\Frlrflm.exe
  2⤵
  PID:7084
- C:\Windows\System\jOGlUUU.exe
  C:\Windows\System\jOGlUUU.exe
  2⤵
  PID:6244
- C:\Windows\System\LcHvSIu.exe
  C:\Windows\System\LcHvSIu.exe
  2⤵
  PID:5356
- C:\Windows\System\UzcHEga.exe
  C:\Windows\System\UzcHEga.exe
  2⤵
  PID:6480
- C:\Windows\System\lpNOHOJ.exe
  C:\Windows\System\lpNOHOJ.exe
  2⤵
  PID:7000
- C:\Windows\System\TsVcAIn.exe
  C:\Windows\System\TsVcAIn.exe
  2⤵
  PID:5664
- C:\Windows\System\YfCkSFQ.exe
  C:\Windows\System\YfCkSFQ.exe
  2⤵
  PID:1752
- C:\Windows\System\hHRLgGB.exe
  C:\Windows\System\hHRLgGB.exe
  2⤵
  PID:6164
- C:\Windows\System\MBeOzPL.exe
  C:\Windows\System\MBeOzPL.exe
  2⤵
  PID:6208
- C:\Windows\System\QzcBOec.exe
  C:\Windows\System\QzcBOec.exe
  2⤵
  PID:1808
- C:\Windows\System\bWBqoYf.exe
  C:\Windows\System\bWBqoYf.exe
  2⤵
  PID:6904
- C:\Windows\System\WEDzJgi.exe
  C:\Windows\System\WEDzJgi.exe
  2⤵
  PID:7064
- C:\Windows\System\riutmYt.exe
  C:\Windows\System\riutmYt.exe
  2⤵
  PID:6920
- C:\Windows\System\tjIRMFP.exe
  C:\Windows\System\tjIRMFP.exe
  2⤵
  PID:6276
- C:\Windows\System\ZJmPcFt.exe
  C:\Windows\System\ZJmPcFt.exe
  2⤵
  PID:7144
- C:\Windows\System\FJNRbNt.exe
  C:\Windows\System\FJNRbNt.exe
  2⤵
  PID:5772
- C:\Windows\System\qUwQrFn.exe
  C:\Windows\System\qUwQrFn.exe
  2⤵
  PID:6372
- C:\Windows\System\hcxnwMg.exe
  C:\Windows\System\hcxnwMg.exe
  2⤵
  PID:6512
- C:\Windows\System\QMOjgEG.exe
  C:\Windows\System\QMOjgEG.exe
  2⤵
  PID:6928
- C:\Windows\System\lhDoEfS.exe
  C:\Windows\System\lhDoEfS.exe
  2⤵
  PID:7132
- C:\Windows\System\CaTumWD.exe
  C:\Windows\System\CaTumWD.exe
  2⤵
  PID:2792
- C:\Windows\System\hsMBsKA.exe
  C:\Windows\System\hsMBsKA.exe
  2⤵
  PID:6400
- C:\Windows\System\bPCUMjT.exe
  C:\Windows\System\bPCUMjT.exe
  2⤵
  PID:6580
- C:\Windows\System\uarKZQw.exe
  C:\Windows\System\uarKZQw.exe
  2⤵
  PID:6948
- C:\Windows\System\gKrrsmu.exe
  C:\Windows\System\gKrrsmu.exe
  2⤵
  PID:5580
- C:\Windows\System\stLkJiM.exe
  C:\Windows\System\stLkJiM.exe
  2⤵
  PID:6528
- C:\Windows\System\PnhPWCv.exe
  C:\Windows\System\PnhPWCv.exe
  2⤵
  PID:7172
- C:\Windows\System\jbCUlJO.exe
  C:\Windows\System\jbCUlJO.exe
  2⤵
  PID:7188
- C:\Windows\System\ZZQAYaJ.exe
  C:\Windows\System\ZZQAYaJ.exe
  2⤵
  PID:7204
- C:\Windows\System\CUrPZqB.exe
  C:\Windows\System\CUrPZqB.exe
  2⤵
  PID:7220
- C:\Windows\System\DhYviOw.exe
  C:\Windows\System\DhYviOw.exe
  2⤵
  PID:7236
- C:\Windows\System\SecfOoI.exe
  C:\Windows\System\SecfOoI.exe
  2⤵
  PID:7252
- C:\Windows\System\ECljNgU.exe
  C:\Windows\System\ECljNgU.exe
  2⤵
  PID:7268
- C:\Windows\System\bpZZyfn.exe
  C:\Windows\System\bpZZyfn.exe
  2⤵
  PID:7284
- C:\Windows\System\ZOydcRD.exe
  C:\Windows\System\ZOydcRD.exe
  2⤵
  PID:7304
- C:\Windows\System\QHYgfKF.exe
  C:\Windows\System\QHYgfKF.exe
  2⤵
  PID:7320
- C:\Windows\System\EaAkDGi.exe
  C:\Windows\System\EaAkDGi.exe
  2⤵
  PID:7336
- C:\Windows\System\zRrIBnR.exe
  C:\Windows\System\zRrIBnR.exe
  2⤵
  PID:7352
- C:\Windows\System\hHEhJCX.exe
  C:\Windows\System\hHEhJCX.exe
  2⤵
  PID:7368
- C:\Windows\System\rgghJAW.exe
  C:\Windows\System\rgghJAW.exe
  2⤵
  PID:7384
- C:\Windows\System\ZhVXsAC.exe
  C:\Windows\System\ZhVXsAC.exe
  2⤵
  PID:7400
- C:\Windows\System\TSvwoSQ.exe
  C:\Windows\System\TSvwoSQ.exe
  2⤵
  PID:7416
- C:\Windows\System\EvPGtFA.exe
  C:\Windows\System\EvPGtFA.exe
  2⤵
  PID:7432
- C:\Windows\System\KAoTfUG.exe
  C:\Windows\System\KAoTfUG.exe
  2⤵
  PID:7448
- C:\Windows\System\fUclmrV.exe
  C:\Windows\System\fUclmrV.exe
  2⤵
  PID:7468
- C:\Windows\System\UpcKSOQ.exe
  C:\Windows\System\UpcKSOQ.exe
  2⤵
  PID:7484
- C:\Windows\System\qULVWfO.exe
  C:\Windows\System\qULVWfO.exe
  2⤵
  PID:7500
- C:\Windows\System\uzqekPW.exe
  C:\Windows\System\uzqekPW.exe
  2⤵
  PID:7516
- C:\Windows\System\lylGPpK.exe
  C:\Windows\System\lylGPpK.exe
  2⤵
  PID:7532
- C:\Windows\System\UzaLREi.exe
  C:\Windows\System\UzaLREi.exe
  2⤵
  PID:7548
- C:\Windows\System\HODjVIh.exe
  C:\Windows\System\HODjVIh.exe
  2⤵
  PID:7564
- C:\Windows\System\ETpQNkX.exe
  C:\Windows\System\ETpQNkX.exe
  2⤵
  PID:7580
- C:\Windows\System\XrvtTsF.exe
  C:\Windows\System\XrvtTsF.exe
  2⤵
  PID:7596
- C:\Windows\System\BBTHbav.exe
  C:\Windows\System\BBTHbav.exe
  2⤵
  PID:7664
- C:\Windows\System\JYzzWSh.exe
  C:\Windows\System\JYzzWSh.exe
  2⤵
  PID:7680
- C:\Windows\System\RrXPdDn.exe
  C:\Windows\System\RrXPdDn.exe
  2⤵
  PID:7700
- C:\Windows\System\PuEtlsA.exe
  C:\Windows\System\PuEtlsA.exe
  2⤵
  PID:7720
- C:\Windows\System\VfiySgU.exe
  C:\Windows\System\VfiySgU.exe
  2⤵
  PID:7736
- C:\Windows\System\tTJXgwi.exe
  C:\Windows\System\tTJXgwi.exe
  2⤵
  PID:7756
- C:\Windows\System\PwFBWnw.exe
  C:\Windows\System\PwFBWnw.exe
  2⤵
  PID:7772
- C:\Windows\System\SWKDEhy.exe
  C:\Windows\System\SWKDEhy.exe
  2⤵
  PID:7788
- C:\Windows\System\lnXEwdn.exe
  C:\Windows\System\lnXEwdn.exe
  2⤵
  PID:7828
- C:\Windows\System\HVHruQv.exe
  C:\Windows\System\HVHruQv.exe
  2⤵
  PID:7848
- C:\Windows\System\WocAENx.exe
  C:\Windows\System\WocAENx.exe
  2⤵
  PID:7892
- C:\Windows\System\LjwaSEP.exe
  C:\Windows\System\LjwaSEP.exe
  2⤵
  PID:7908
- C:\Windows\System\tMYFUAL.exe
  C:\Windows\System\tMYFUAL.exe
  2⤵
  PID:7924
- C:\Windows\System\VKSaBgl.exe
  C:\Windows\System\VKSaBgl.exe
  2⤵
  PID:7940
- C:\Windows\System\HIRbnkC.exe
  C:\Windows\System\HIRbnkC.exe
  2⤵
  PID:7956
- C:\Windows\System\OTIuTRx.exe
  C:\Windows\System\OTIuTRx.exe
  2⤵
  PID:7972
- C:\Windows\System\zNGKhPM.exe
  C:\Windows\System\zNGKhPM.exe
  2⤵
  PID:7988
- C:\Windows\System\onfXDSp.exe
  C:\Windows\System\onfXDSp.exe
  2⤵
  PID:8004
- C:\Windows\System\QzbCOCg.exe
  C:\Windows\System\QzbCOCg.exe
  2⤵
  PID:8020
- C:\Windows\System\xHoWMpC.exe
  C:\Windows\System\xHoWMpC.exe
  2⤵
  PID:8036
- C:\Windows\System\pjBtwJc.exe
  C:\Windows\System\pjBtwJc.exe
  2⤵
  PID:8052
- C:\Windows\System\QkitQdE.exe
  C:\Windows\System\QkitQdE.exe
  2⤵
  PID:8068
- C:\Windows\System\OaGRDxP.exe
  C:\Windows\System\OaGRDxP.exe
  2⤵
  PID:8084
- C:\Windows\System\FiVeWKm.exe
  C:\Windows\System\FiVeWKm.exe
  2⤵
  PID:8100
- C:\Windows\System\qFSUCWl.exe
  C:\Windows\System\qFSUCWl.exe
  2⤵
  PID:8120
- C:\Windows\System\PYxjNys.exe
  C:\Windows\System\PYxjNys.exe
  2⤵
  PID:8136
- C:\Windows\System\jADPBQV.exe
  C:\Windows\System\jADPBQV.exe
  2⤵
  PID:8152
- C:\Windows\System\pVfEJME.exe
  C:\Windows\System\pVfEJME.exe
  2⤵
  PID:8168
- C:\Windows\System\EktSKob.exe
  C:\Windows\System\EktSKob.exe
  2⤵
  PID:8184
- C:\Windows\System\DynVoav.exe
  C:\Windows\System\DynVoav.exe
  2⤵
  PID:7244
- C:\Windows\System\FwuKEWj.exe
  C:\Windows\System\FwuKEWj.exe
  2⤵
  PID:7360
- C:\Windows\System\aLSTmnz.exe
  C:\Windows\System\aLSTmnz.exe
  2⤵
  PID:7232
- C:\Windows\System\KPFWwFx.exe
  C:\Windows\System\KPFWwFx.exe
  2⤵
  PID:6272
- C:\Windows\System\TXbkivN.exe
  C:\Windows\System\TXbkivN.exe
  2⤵
  PID:6060
- C:\Windows\System\mZmQTyx.exe
  C:\Windows\System\mZmQTyx.exe
  2⤵
  PID:3596
- C:\Windows\System\mtDgGvc.exe
  C:\Windows\System\mtDgGvc.exe
  2⤵
  PID:7296
- C:\Windows\System\eLCeMCO.exe
  C:\Windows\System\eLCeMCO.exe
  2⤵
  PID:7376
- C:\Windows\System\VdNSYpC.exe
  C:\Windows\System\VdNSYpC.exe
  2⤵
  PID:7428
- C:\Windows\System\tEIGtse.exe
  C:\Windows\System\tEIGtse.exe
  2⤵
  PID:7412
- C:\Windows\System\QUTQpBW.exe
  C:\Windows\System\QUTQpBW.exe
  2⤵
  PID:7460
- C:\Windows\System\xXwwFiG.exe
  C:\Windows\System\xXwwFiG.exe
  2⤵
  PID:7492
- C:\Windows\System\dFRacjq.exe
  C:\Windows\System\dFRacjq.exe
  2⤵
  PID:7588
- C:\Windows\System\ghExtSS.exe
  C:\Windows\System\ghExtSS.exe
  2⤵
  PID:7512
- C:\Windows\System\QvpHPBf.exe
  C:\Windows\System\QvpHPBf.exe
  2⤵
  PID:7576
- C:\Windows\System\GaiFpbA.exe
  C:\Windows\System\GaiFpbA.exe
  2⤵
  PID:7612
- C:\Windows\System\hhOtKjo.exe
  C:\Windows\System\hhOtKjo.exe
  2⤵
  PID:7628
- C:\Windows\System\ePTWGFb.exe
  C:\Windows\System\ePTWGFb.exe
  2⤵
  PID:7632
- C:\Windows\System\ghtDwrR.exe
  C:\Windows\System\ghtDwrR.exe
  2⤵
  PID:7660
- C:\Windows\System\tDWkhIr.exe
  C:\Windows\System\tDWkhIr.exe
  2⤵
  PID:7712
- C:\Windows\System\vOZtdgJ.exe
  C:\Windows\System\vOZtdgJ.exe
  2⤵
  PID:7728
- C:\Windows\System\BFyZmNC.exe
  C:\Windows\System\BFyZmNC.exe
  2⤵
  PID:7752
- C:\Windows\System\PehzaHS.exe
  C:\Windows\System\PehzaHS.exe
  2⤵
  PID:7800
- C:\Windows\System\YIauyFf.exe
  C:\Windows\System\YIauyFf.exe
  2⤵
  PID:7836
- C:\Windows\System\tonTueh.exe
  C:\Windows\System\tonTueh.exe
  2⤵
  PID:7816
- C:\Windows\System\bGzmYzk.exe
  C:\Windows\System\bGzmYzk.exe
  2⤵
  PID:7860
- C:\Windows\System\SoLjwmr.exe
  C:\Windows\System\SoLjwmr.exe
  2⤵
  PID:7904
- C:\Windows\System\WDZNVrC.exe
  C:\Windows\System\WDZNVrC.exe
  2⤵
  PID:7884
- C:\Windows\System\rJEwUfM.exe
  C:\Windows\System\rJEwUfM.exe
  2⤵
  PID:7920
- C:\Windows\System\oVfLSPl.exe
  C:\Windows\System\oVfLSPl.exe
  2⤵
  PID:7916
- C:\Windows\System\nFYLIat.exe
  C:\Windows\System\nFYLIat.exe
  2⤵
  PID:8028
- C:\Windows\System\xUuqpee.exe
  C:\Windows\System\xUuqpee.exe
  2⤵
  PID:8060
- C:\Windows\System\DdYHAPs.exe
  C:\Windows\System\DdYHAPs.exe
  2⤵
  PID:8092
- C:\Windows\System\rgucdzH.exe
  C:\Windows\System\rgucdzH.exe
  2⤵
  PID:8044
- C:\Windows\System\GDPlros.exe
  C:\Windows\System\GDPlros.exe
  2⤵
  PID:8108
- C:\Windows\System\xhhpjDp.exe
  C:\Windows\System\xhhpjDp.exe
  2⤵
  PID:7608
- C:\Windows\System\aUcAqvg.exe
  C:\Windows\System\aUcAqvg.exe
  2⤵
  PID:7300
- C:\Windows\System\TsnLHDx.exe
  C:\Windows\System\TsnLHDx.exe
  2⤵
  PID:5372
- C:\Windows\System\OzjSoRK.exe
  C:\Windows\System\OzjSoRK.exe
  2⤵
  PID:7344
- C:\Windows\System\yorjJzJ.exe
  C:\Windows\System\yorjJzJ.exe
  2⤵
  PID:7196
- C:\Windows\System\HtLqKby.exe
  C:\Windows\System\HtLqKby.exe
  2⤵
  PID:7364
- C:\Windows\System\OZXfYfx.exe
  C:\Windows\System\OZXfYfx.exe
  2⤵
  PID:7592
- C:\Windows\System\bwZzABj.exe
  C:\Windows\System\bwZzABj.exe
  2⤵
  PID:1972
- C:\Windows\System\BtXchdg.exe
  C:\Windows\System\BtXchdg.exe
  2⤵
  PID:7620
- C:\Windows\System\NUKsxsM.exe
  C:\Windows\System\NUKsxsM.exe
  2⤵
  PID:7768
- C:\Windows\System\VubZBcf.exe
  C:\Windows\System\VubZBcf.exe
  2⤵
  PID:7824
- C:\Windows\System\dpRPUnA.exe
  C:\Windows\System\dpRPUnA.exe
  2⤵
  PID:7732
- C:\Windows\System\eFJlslN.exe
  C:\Windows\System\eFJlslN.exe
  2⤵
  PID:7648
- C:\Windows\System\APXHbMc.exe
  C:\Windows\System\APXHbMc.exe
  2⤵
  PID:7784
- C:\Windows\System\NeiDGpe.exe
  C:\Windows\System\NeiDGpe.exe
  2⤵
  PID:7936
- C:\Windows\System\SoyYlFW.exe
  C:\Windows\System\SoyYlFW.exe
  2⤵
  PID:8016
- C:\Windows\System\nwlAFCI.exe
  C:\Windows\System\nwlAFCI.exe
  2⤵
  PID:7984
- C:\Windows\System\rCbLVQs.exe
  C:\Windows\System\rCbLVQs.exe
  2⤵
  PID:8076
- C:\Windows\System\pduLKaW.exe
  C:\Windows\System\pduLKaW.exe
  2⤵
  PID:8112
- C:\Windows\System\mezmHox.exe
  C:\Windows\System\mezmHox.exe
  2⤵
  PID:8176
- C:\Windows\System\wASGael.exe
  C:\Windows\System\wASGael.exe
  2⤵
  PID:7276
- C:\Windows\System\iENSShA.exe
  C:\Windows\System\iENSShA.exe
  2⤵
  PID:7440
- C:\Windows\System\ZpVVJNu.exe
  C:\Windows\System\ZpVVJNu.exe
  2⤵
  PID:7624
- C:\Windows\System\xuloKOp.exe
  C:\Windows\System\xuloKOp.exe
  2⤵
  PID:7280
- C:\Windows\System\FmjjXgL.exe
  C:\Windows\System\FmjjXgL.exe
  2⤵
  PID:6996
- C:\Windows\System\HyXlbVm.exe
  C:\Windows\System\HyXlbVm.exe
  2⤵
  PID:7880
- C:\Windows\System\VNzTpfg.exe
  C:\Windows\System\VNzTpfg.exe
  2⤵
  PID:7744
- C:\Windows\System\uxcEtfp.exe
  C:\Windows\System\uxcEtfp.exe
  2⤵
  PID:7508
- C:\Windows\System\XlZdhnX.exe
  C:\Windows\System\XlZdhnX.exe
  2⤵
  PID:6352
- C:\Windows\System\NOZeGAT.exe
  C:\Windows\System\NOZeGAT.exe
  2⤵
  PID:7652
- C:\Windows\System\LQxdgNj.exe
  C:\Windows\System\LQxdgNj.exe
  2⤵
  PID:8200
- C:\Windows\System\kJElSKd.exe
  C:\Windows\System\kJElSKd.exe
  2⤵
  PID:8216
- C:\Windows\System\AQUhvQN.exe
  C:\Windows\System\AQUhvQN.exe
  2⤵
  PID:8232
- C:\Windows\System\GHkhQFG.exe
  C:\Windows\System\GHkhQFG.exe
  2⤵
  PID:8248
- C:\Windows\System\yDjCgrV.exe
  C:\Windows\System\yDjCgrV.exe
  2⤵
  PID:8264
- C:\Windows\System\ZhYUzNi.exe
  C:\Windows\System\ZhYUzNi.exe
  2⤵
  PID:8280
- C:\Windows\System\ilMirgK.exe
  C:\Windows\System\ilMirgK.exe
  2⤵
  PID:8296
- C:\Windows\System\gylsMpx.exe
  C:\Windows\System\gylsMpx.exe
  2⤵
  PID:8312
- C:\Windows\System\uamtSxt.exe
  C:\Windows\System\uamtSxt.exe
  2⤵
  PID:8328
- C:\Windows\System\mXtFMyM.exe
  C:\Windows\System\mXtFMyM.exe
  2⤵
  PID:8344
- C:\Windows\System\MwvDzmf.exe
  C:\Windows\System\MwvDzmf.exe
  2⤵
  PID:8360
- C:\Windows\System\SKdhLHK.exe
  C:\Windows\System\SKdhLHK.exe
  2⤵
  PID:8376
- C:\Windows\System\waejXhg.exe
  C:\Windows\System\waejXhg.exe
  2⤵
  PID:8392
- C:\Windows\System\hmuGMSS.exe
  C:\Windows\System\hmuGMSS.exe
  2⤵
  PID:8408
- C:\Windows\System\wAfFwmm.exe
  C:\Windows\System\wAfFwmm.exe
  2⤵
  PID:8424
- C:\Windows\System\WfgcrJB.exe
  C:\Windows\System\WfgcrJB.exe
  2⤵
  PID:8440
- C:\Windows\System\MeaGapP.exe
  C:\Windows\System\MeaGapP.exe
  2⤵
  PID:8456
- C:\Windows\System\PstnWvV.exe
  C:\Windows\System\PstnWvV.exe
  2⤵
  PID:8472
- C:\Windows\System\fgOjNVK.exe
  C:\Windows\System\fgOjNVK.exe
  2⤵
  PID:8488
- C:\Windows\System\DSBBBHc.exe
  C:\Windows\System\DSBBBHc.exe
  2⤵
  PID:8504
- C:\Windows\System\IQGRlLC.exe
  C:\Windows\System\IQGRlLC.exe
  2⤵
  PID:8520
- C:\Windows\System\sNrjPlA.exe
  C:\Windows\System\sNrjPlA.exe
  2⤵
  PID:8536
- C:\Windows\System\vCheMBr.exe
  C:\Windows\System\vCheMBr.exe
  2⤵
  PID:8556
- C:\Windows\System\frkEKTR.exe
  C:\Windows\System\frkEKTR.exe
  2⤵
  PID:8572
- C:\Windows\System\sBFSZTL.exe
  C:\Windows\System\sBFSZTL.exe
  2⤵
  PID:8588
- C:\Windows\System\zjKKvfy.exe
  C:\Windows\System\zjKKvfy.exe
  2⤵
  PID:8604
- C:\Windows\System\RqkPjIs.exe
  C:\Windows\System\RqkPjIs.exe
  2⤵
  PID:8620
- C:\Windows\System\XBoUCxB.exe
  C:\Windows\System\XBoUCxB.exe
  2⤵
  PID:8636
- C:\Windows\System\SsJLUqs.exe
  C:\Windows\System\SsJLUqs.exe
  2⤵
  PID:8652
- C:\Windows\System\mxNQwvj.exe
  C:\Windows\System\mxNQwvj.exe
  2⤵
  PID:8668
- C:\Windows\System\lYaLKOb.exe
  C:\Windows\System\lYaLKOb.exe
  2⤵
  PID:8684
- C:\Windows\System\QbEKVMe.exe
  C:\Windows\System\QbEKVMe.exe
  2⤵
  PID:8700
- C:\Windows\System\luPWmcy.exe
  C:\Windows\System\luPWmcy.exe
  2⤵
  PID:8716
- C:\Windows\System\oqnBIuZ.exe
  C:\Windows\System\oqnBIuZ.exe
  2⤵
  PID:8732
- C:\Windows\System\NLxCtgU.exe
  C:\Windows\System\NLxCtgU.exe
  2⤵
  PID:8748
- C:\Windows\System\mRxqmzJ.exe
  C:\Windows\System\mRxqmzJ.exe
  2⤵
  PID:8764
- C:\Windows\System\mmVSvPL.exe
  C:\Windows\System\mmVSvPL.exe
  2⤵
  PID:8780
- C:\Windows\System\lDHqLPk.exe
  C:\Windows\System\lDHqLPk.exe
  2⤵
  PID:8796
- C:\Windows\System\SwDFJEE.exe
  C:\Windows\System\SwDFJEE.exe
  2⤵
  PID:8812
- C:\Windows\System\uIPcQzx.exe
  C:\Windows\System\uIPcQzx.exe
  2⤵
  PID:8828
- C:\Windows\System\UupjLBw.exe
  C:\Windows\System\UupjLBw.exe
  2⤵
  PID:8844
- C:\Windows\System\CvDpxsW.exe
  C:\Windows\System\CvDpxsW.exe
  2⤵
  PID:8860
- C:\Windows\System\QRszBVg.exe
  C:\Windows\System\QRszBVg.exe
  2⤵
  PID:8876
- C:\Windows\System\aPUmgzD.exe
  C:\Windows\System\aPUmgzD.exe
  2⤵
  PID:8892
- C:\Windows\System\BjQaUuF.exe
  C:\Windows\System\BjQaUuF.exe
  2⤵
  PID:8908
- C:\Windows\System\MhssYHF.exe
  C:\Windows\System\MhssYHF.exe
  2⤵
  PID:8924
- C:\Windows\System\JLpSSlE.exe
  C:\Windows\System\JLpSSlE.exe
  2⤵
  PID:8940
- C:\Windows\System\nxikzMu.exe
  C:\Windows\System\nxikzMu.exe
  2⤵
  PID:8956
- C:\Windows\System\OvOhWtV.exe
  C:\Windows\System\OvOhWtV.exe
  2⤵
  PID:8972
- C:\Windows\System\kmcnzgx.exe
  C:\Windows\System\kmcnzgx.exe
  2⤵
  PID:8988
- C:\Windows\System\TyCFExg.exe
  C:\Windows\System\TyCFExg.exe
  2⤵
  PID:9004
- C:\Windows\System\pKaIcRZ.exe
  C:\Windows\System\pKaIcRZ.exe
  2⤵
  PID:9020
- C:\Windows\System\SxDsENI.exe
  C:\Windows\System\SxDsENI.exe
  2⤵
  PID:9036
- C:\Windows\System\NgHlFTI.exe
  C:\Windows\System\NgHlFTI.exe
  2⤵
  PID:9052
- C:\Windows\System\PozJBuU.exe
  C:\Windows\System\PozJBuU.exe
  2⤵
  PID:9068
- C:\Windows\System\kqZKbqg.exe
  C:\Windows\System\kqZKbqg.exe
  2⤵
  PID:9084
- C:\Windows\System\XLfuNWL.exe
  C:\Windows\System\XLfuNWL.exe
  2⤵
  PID:9100
- C:\Windows\System\EZIPfUx.exe
  C:\Windows\System\EZIPfUx.exe
  2⤵
  PID:9116
- C:\Windows\System\cIZlqJV.exe
  C:\Windows\System\cIZlqJV.exe
  2⤵
  PID:9132
- C:\Windows\System\qNhsdal.exe
  C:\Windows\System\qNhsdal.exe
  2⤵
  PID:9148
- C:\Windows\System\UTcTbLK.exe
  C:\Windows\System\UTcTbLK.exe
  2⤵
  PID:9164
- C:\Windows\System\LWmygCN.exe
  C:\Windows\System\LWmygCN.exe
  2⤵
  PID:9180
- C:\Windows\System\EZVyVoa.exe
  C:\Windows\System\EZVyVoa.exe
  2⤵
  PID:9196
- C:\Windows\System\dcBrTyg.exe
  C:\Windows\System\dcBrTyg.exe
  2⤵
  PID:9212
- C:\Windows\System\InbZBRw.exe
  C:\Windows\System\InbZBRw.exe
  2⤵
  PID:7968
- C:\Windows\System\teKcUvM.exe
  C:\Windows\System\teKcUvM.exe
  2⤵
  PID:7748
- C:\Windows\System\nXQAITx.exe
  C:\Windows\System\nXQAITx.exe
  2⤵
  PID:7656
- C:\Windows\System\rkdYWFE.exe
  C:\Windows\System\rkdYWFE.exe
  2⤵
  PID:8164
- C:\Windows\System\DbdvDJd.exe
  C:\Windows\System\DbdvDJd.exe
  2⤵
  PID:7444
- C:\Windows\System\sgnYzWI.exe
  C:\Windows\System\sgnYzWI.exe
  2⤵
  PID:7844
- C:\Windows\System\FETarcz.exe
  C:\Windows\System\FETarcz.exe
  2⤵
  PID:8224
- C:\Windows\System\PcoJXNM.exe
  C:\Windows\System\PcoJXNM.exe
  2⤵
  PID:8260
- C:\Windows\System\drPNUkV.exe
  C:\Windows\System\drPNUkV.exe
  2⤵
  PID:8276
- C:\Windows\System\feDEzKv.exe
  C:\Windows\System\feDEzKv.exe
  2⤵
  PID:8324
- C:\Windows\System\kTzeIDz.exe
  C:\Windows\System\kTzeIDz.exe
  2⤵
  PID:8340
- C:\Windows\System\OPpuvZb.exe
  C:\Windows\System\OPpuvZb.exe
  2⤵
  PID:8404
- C:\Windows\System\cJSHbTi.exe
  C:\Windows\System\cJSHbTi.exe
  2⤵
  PID:8388
- C:\Windows\System\aruYgEM.exe
  C:\Windows\System\aruYgEM.exe
  2⤵
  PID:8464
- C:\Windows\System\JSMvPim.exe
  C:\Windows\System\JSMvPim.exe
  2⤵
  PID:8500
- C:\Windows\System\cHELzTp.exe
  C:\Windows\System\cHELzTp.exe
  2⤵
  PID:8568
- C:\Windows\System\UOEGqks.exe
  C:\Windows\System\UOEGqks.exe
  2⤵
  PID:8548
- C:\Windows\System\ZMRkMIv.exe
  C:\Windows\System\ZMRkMIv.exe
  2⤵
  PID:8552
- C:\Windows\System\KCDuHSE.exe
  C:\Windows\System\KCDuHSE.exe
  2⤵
  PID:8600
- C:\Windows\System\qygfiFC.exe
  C:\Windows\System\qygfiFC.exe
  2⤵
  PID:8616
- C:\Windows\System\DJwDXdm.exe
  C:\Windows\System\DJwDXdm.exe
  2⤵
  PID:8660
- C:\Windows\System\favhiEL.exe
  C:\Windows\System\favhiEL.exe
  2⤵
  PID:8648
- C:\Windows\System\ctfvrQA.exe
  C:\Windows\System\ctfvrQA.exe
  2⤵
  PID:8756
- C:\Windows\System\ZofIBoR.exe
  C:\Windows\System\ZofIBoR.exe
  2⤵
  PID:8744
- C:\Windows\System\THTAWeZ.exe
  C:\Windows\System\THTAWeZ.exe
  2⤵
  PID:8788
- C:\Windows\System\vvxxySo.exe
  C:\Windows\System\vvxxySo.exe
  2⤵
  PID:8808
- C:\Windows\System\AIRtsid.exe
  C:\Windows\System\AIRtsid.exe
  2⤵
  PID:8856
- C:\Windows\System\SSshRiu.exe
  C:\Windows\System\SSshRiu.exe
  2⤵
  PID:8888
- C:\Windows\System\KGVqciX.exe
  C:\Windows\System\KGVqciX.exe
  2⤵
  PID:8920
- C:\Windows\System\RAIkutm.exe
  C:\Windows\System\RAIkutm.exe
  2⤵
  PID:8984
- C:\Windows\System\vxZUAEv.exe
  C:\Windows\System\vxZUAEv.exe
  2⤵
  PID:8968
- C:\Windows\System\iSMkFoc.exe
  C:\Windows\System\iSMkFoc.exe
  2⤵
  PID:9048
- C:\Windows\System\uonAnrV.exe
  C:\Windows\System\uonAnrV.exe
  2⤵
  PID:9000
- C:\Windows\System\IeLvxqP.exe
  C:\Windows\System\IeLvxqP.exe
  2⤵
  PID:9080
- C:\Windows\System\WjKGStO.exe
  C:\Windows\System\WjKGStO.exe
  2⤵
  PID:9112
- C:\Windows\System\xBmFcMY.exe
  C:\Windows\System\xBmFcMY.exe
  2⤵
  PID:9144
- C:\Windows\System\GbwItvx.exe
  C:\Windows\System\GbwItvx.exe
  2⤵
  PID:9208
- C:\Windows\System\ogBmEER.exe
  C:\Windows\System\ogBmEER.exe
  2⤵
  PID:7856
- C:\Windows\System\IYTEtjI.exe
  C:\Windows\System\IYTEtjI.exe
  2⤵
  PID:7424
- C:\Windows\System\euskoDn.exe
  C:\Windows\System\euskoDn.exe
  2⤵
  PID:7616
- C:\Windows\System\hECrPph.exe
  C:\Windows\System\hECrPph.exe
  2⤵
  PID:8292
- C:\Windows\System\oetkKRH.exe
  C:\Windows\System\oetkKRH.exe
  2⤵
  PID:8320
- C:\Windows\System\hYjVUiY.exe
  C:\Windows\System\hYjVUiY.exe
  2⤵
  PID:8420
- C:\Windows\System\BCpesgf.exe
  C:\Windows\System\BCpesgf.exe
  2⤵
  PID:8336
- C:\Windows\System\dlvmNxu.exe
  C:\Windows\System\dlvmNxu.exe
  2⤵
  PID:8356
- C:\Windows\System\TvkgPmR.exe
  C:\Windows\System\TvkgPmR.exe
  2⤵
  PID:8484
- C:\Windows\System\HUiVMmo.exe
  C:\Windows\System\HUiVMmo.exe
  2⤵
  PID:8480
- C:\Windows\System\rWeAKQE.exe
  C:\Windows\System\rWeAKQE.exe
  2⤵
  PID:8696
- C:\Windows\System\NRnQnzZ.exe
  C:\Windows\System\NRnQnzZ.exe
  2⤵
  PID:8836
- C:\Windows\System\hHSXJsm.exe
  C:\Windows\System\hHSXJsm.exe
  2⤵
  PID:9060
- C:\Windows\System\lpZJGYE.exe
  C:\Windows\System\lpZJGYE.exe
  2⤵
  PID:8900
- C:\Windows\System\BSavXAn.exe
  C:\Windows\System\BSavXAn.exe
  2⤵
  PID:9096
- C:\Windows\System\EgxFlZy.exe
  C:\Windows\System\EgxFlZy.exe
  2⤵
  PID:7524
- C:\Windows\System\fktTGNu.exe
  C:\Windows\System\fktTGNu.exe
  2⤵
  PID:8400
- C:\Windows\System\YsLYEzw.exe
  C:\Windows\System\YsLYEzw.exe
  2⤵
  PID:8448
- C:\Windows\System\DaOabvb.exe
  C:\Windows\System\DaOabvb.exe
  2⤵
  PID:9192
- C:\Windows\System\LGlMZKh.exe
  C:\Windows\System\LGlMZKh.exe
  2⤵
  PID:8496
- C:\Windows\System\NFvsAkX.exe
  C:\Windows\System\NFvsAkX.exe
  2⤵
  PID:6872
- C:\Windows\System\HNAvATq.exe
  C:\Windows\System\HNAvATq.exe
  2⤵
  PID:8820
- C:\Windows\System\YsvQktZ.exe
  C:\Windows\System\YsvQktZ.exe
  2⤵
  PID:8728
- C:\Windows\System\vgfZVLd.exe
  C:\Windows\System\vgfZVLd.exe
  2⤵
  PID:8980
- C:\Windows\System\YKRYeSl.exe
  C:\Windows\System\YKRYeSl.exe
  2⤵
  PID:8196
- C:\Windows\System\LyIsFwK.exe
  C:\Windows\System\LyIsFwK.exe
  2⤵
  PID:9032
- C:\Windows\System\JEeDCIv.exe
  C:\Windows\System\JEeDCIv.exe
  2⤵
  PID:8884
- C:\Windows\System\QPBinvS.exe
  C:\Windows\System\QPBinvS.exe
  2⤵
  PID:8996
- C:\Windows\System\lADVxyd.exe
  C:\Windows\System\lADVxyd.exe
  2⤵
  PID:8372
- C:\Windows\System\LASScOV.exe
  C:\Windows\System\LASScOV.exe
  2⤵
  PID:7948
- C:\Windows\System\fhtgqvP.exe
  C:\Windows\System\fhtgqvP.exe
  2⤵
  PID:9228
- C:\Windows\System\NkBnBDE.exe
  C:\Windows\System\NkBnBDE.exe
  2⤵
  PID:9244
- C:\Windows\System\QwkPVMV.exe
  C:\Windows\System\QwkPVMV.exe
  2⤵
  PID:9260
- C:\Windows\System\nSdkfqy.exe
  C:\Windows\System\nSdkfqy.exe
  2⤵
  PID:9276
- C:\Windows\System\zxQtwBn.exe
  C:\Windows\System\zxQtwBn.exe
  2⤵
  PID:9292
- C:\Windows\System\PtYeipW.exe
  C:\Windows\System\PtYeipW.exe
  2⤵
  PID:9308
- C:\Windows\System\WtVrOst.exe
  C:\Windows\System\WtVrOst.exe
  2⤵
  PID:9324
- C:\Windows\System\lEFYwbb.exe
  C:\Windows\System\lEFYwbb.exe
  2⤵
  PID:9340
- C:\Windows\System\FANdbUG.exe
  C:\Windows\System\FANdbUG.exe
  2⤵
  PID:9356
- C:\Windows\System\FmTTCuz.exe
  C:\Windows\System\FmTTCuz.exe
  2⤵
  PID:9372
- C:\Windows\System\gGDuWlK.exe
  C:\Windows\System\gGDuWlK.exe
  2⤵
  PID:9388
- C:\Windows\System\sXEKnZL.exe
  C:\Windows\System\sXEKnZL.exe
  2⤵
  PID:9408
- C:\Windows\System\iUxohGI.exe
  C:\Windows\System\iUxohGI.exe
  2⤵
  PID:9424
- C:\Windows\System\iOWArBv.exe
  C:\Windows\System\iOWArBv.exe
  2⤵
  PID:9440
- C:\Windows\System\BQQrbwO.exe
  C:\Windows\System\BQQrbwO.exe
  2⤵
  PID:9456
- C:\Windows\System\invjkDt.exe
  C:\Windows\System\invjkDt.exe
  2⤵
  PID:9476
- C:\Windows\System\TJHaEpV.exe
  C:\Windows\System\TJHaEpV.exe
  2⤵
  PID:9492
- C:\Windows\System\TkvZsnq.exe
  C:\Windows\System\TkvZsnq.exe
  2⤵
  PID:9508
- C:\Windows\System\yVQvQHV.exe
  C:\Windows\System\yVQvQHV.exe
  2⤵
  PID:9524
- C:\Windows\System\xPJdTZY.exe
  C:\Windows\System\xPJdTZY.exe
  2⤵
  PID:9540
- C:\Windows\System\McHbutg.exe
  C:\Windows\System\McHbutg.exe
  2⤵
  PID:9556
- C:\Windows\System\QOhWgbY.exe
  C:\Windows\System\QOhWgbY.exe
  2⤵
  PID:9572
- C:\Windows\System\uvQSGMC.exe
  C:\Windows\System\uvQSGMC.exe
  2⤵
  PID:9588
- C:\Windows\System\scvKnXm.exe
  C:\Windows\System\scvKnXm.exe
  2⤵
  PID:9604
- C:\Windows\System\XrHXEUq.exe
  C:\Windows\System\XrHXEUq.exe
  2⤵
  PID:9620
- C:\Windows\System\tarEqep.exe
  C:\Windows\System\tarEqep.exe
  2⤵
  PID:9636
- C:\Windows\System\ZwNgbKj.exe
  C:\Windows\System\ZwNgbKj.exe
  2⤵
  PID:9652
- C:\Windows\System\QqIyDwL.exe
  C:\Windows\System\QqIyDwL.exe
  2⤵
  PID:9668
- C:\Windows\System\pffKIIy.exe
  C:\Windows\System\pffKIIy.exe
  2⤵
  PID:9684
- C:\Windows\System\hyHoVMf.exe
  C:\Windows\System\hyHoVMf.exe
  2⤵
  PID:9704
- C:\Windows\System\XpKybgK.exe
  C:\Windows\System\XpKybgK.exe
  2⤵
  PID:9720
- C:\Windows\System\EuAylfX.exe
  C:\Windows\System\EuAylfX.exe
  2⤵
  PID:9736
- C:\Windows\System\uWexNrg.exe
  C:\Windows\System\uWexNrg.exe
  2⤵
  PID:9752
- C:\Windows\System\emIuqPi.exe
  C:\Windows\System\emIuqPi.exe
  2⤵
  PID:9768
- C:\Windows\System\cwEsDSe.exe
  C:\Windows\System\cwEsDSe.exe
  2⤵
  PID:9784
- C:\Windows\System\BZDlKsh.exe
  C:\Windows\System\BZDlKsh.exe
  2⤵
  PID:9804
- C:\Windows\System\GWHsvzG.exe
  C:\Windows\System\GWHsvzG.exe
  2⤵
  PID:9820
- C:\Windows\System\MOShzUg.exe
  C:\Windows\System\MOShzUg.exe
  2⤵
  PID:9836
- C:\Windows\System\MJWRojZ.exe
  C:\Windows\System\MJWRojZ.exe
  2⤵
  PID:9856
- C:\Windows\System\WsQTAmo.exe
  C:\Windows\System\WsQTAmo.exe
  2⤵
  PID:9872
- C:\Windows\System\jVbLEbt.exe
  C:\Windows\System\jVbLEbt.exe
  2⤵
  PID:9888
- C:\Windows\System\OtPJyUX.exe
  C:\Windows\System\OtPJyUX.exe
  2⤵
  PID:9904
- C:\Windows\System\LTqzheY.exe
  C:\Windows\System\LTqzheY.exe
  2⤵
  PID:9920
- C:\Windows\System\oSKgGiW.exe
  C:\Windows\System\oSKgGiW.exe
  2⤵
  PID:9936
- C:\Windows\System\olknLwG.exe
  C:\Windows\System\olknLwG.exe
  2⤵
  PID:9960
- C:\Windows\System\XPiMUOf.exe
  C:\Windows\System\XPiMUOf.exe
  2⤵
  PID:10000
- C:\Windows\System\hZLMJnw.exe
  C:\Windows\System\hZLMJnw.exe
  2⤵
  PID:10016
- C:\Windows\System\DThciHU.exe
  C:\Windows\System\DThciHU.exe
  2⤵
  PID:10032
- C:\Windows\System\IBxybZP.exe
  C:\Windows\System\IBxybZP.exe
  2⤵
  PID:10048
- C:\Windows\System\GEJoRWb.exe
  C:\Windows\System\GEJoRWb.exe
  2⤵
  PID:10064
- C:\Windows\System\XTxINcE.exe
  C:\Windows\System\XTxINcE.exe
  2⤵
  PID:10080
- C:\Windows\System\XpGFYzm.exe
  C:\Windows\System\XpGFYzm.exe
  2⤵
  PID:10096
- C:\Windows\System\iFGlCUv.exe
  C:\Windows\System\iFGlCUv.exe
  2⤵
  PID:10112
- C:\Windows\System\ucWDVUh.exe
  C:\Windows\System\ucWDVUh.exe
  2⤵
  PID:10128
- C:\Windows\System\epBZSqC.exe
  C:\Windows\System\epBZSqC.exe
  2⤵
  PID:10144
- C:\Windows\System\TgFXtMq.exe
  C:\Windows\System\TgFXtMq.exe
  2⤵
  PID:10160
- C:\Windows\System\pHMwgWw.exe
  C:\Windows\System\pHMwgWw.exe
  2⤵
  PID:10176
- C:\Windows\System\wDUXxnT.exe
  C:\Windows\System\wDUXxnT.exe
  2⤵
  PID:10192
- C:\Windows\System\jQLsOid.exe
  C:\Windows\System\jQLsOid.exe
  2⤵
  PID:10208
- C:\Windows\System\SvHPahb.exe
  C:\Windows\System\SvHPahb.exe
  2⤵
  PID:10224
- C:\Windows\System\qzitgzP.exe
  C:\Windows\System\qzitgzP.exe
  2⤵
  PID:9016
- C:\Windows\System\njvRxLH.exe
  C:\Windows\System\njvRxLH.exe
  2⤵
  PID:9252
- C:\Windows\System\XOkqUYH.exe
  C:\Windows\System\XOkqUYH.exe
  2⤵
  PID:9316
- C:\Windows\System\PMpijWE.exe
  C:\Windows\System\PMpijWE.exe
  2⤵
  PID:9380
- C:\Windows\System\OqVgeUU.exe
  C:\Windows\System\OqVgeUU.exe
  2⤵
  PID:9092
- C:\Windows\System\IkiudhD.exe
  C:\Windows\System\IkiudhD.exe
  2⤵
  PID:9268
- C:\Windows\System\NPahaGR.exe
  C:\Windows\System\NPahaGR.exe
  2⤵
  PID:9304
- C:\Windows\System\bpejwGO.exe
  C:\Windows\System\bpejwGO.exe
  2⤵
  PID:9028
- C:\Windows\System\jQitQtt.exe
  C:\Windows\System\jQitQtt.exe
  2⤵
  PID:9452
- C:\Windows\System\wWwccFp.exe
  C:\Windows\System\wWwccFp.exe
  2⤵
  PID:9548
- C:\Windows\System\gAOAbrw.exe
  C:\Windows\System\gAOAbrw.exe
  2⤵
  PID:9612
- C:\Windows\System\rXMVCIr.exe
  C:\Windows\System\rXMVCIr.exe
  2⤵
  PID:9676
- C:\Windows\System\WVYAEeT.exe
  C:\Windows\System\WVYAEeT.exe
  2⤵
  PID:3288
- C:\Windows\System\WGqRUdI.exe
  C:\Windows\System\WGqRUdI.exe
  2⤵
  PID:9336
- C:\Windows\System\ObGifbA.exe
  C:\Windows\System\ObGifbA.exe
  2⤵
  PID:9368
- C:\Windows\System\yFjLUSW.exe
  C:\Windows\System\yFjLUSW.exe
  2⤵
  PID:9436
- C:\Windows\System\xELlNwE.exe
  C:\Windows\System\xELlNwE.exe
  2⤵
  PID:9564
- C:\Windows\System\veIGJoQ.exe
  C:\Windows\System\veIGJoQ.exe
  2⤵
  PID:9728
- C:\Windows\System\AUrPqOT.exe
  C:\Windows\System\AUrPqOT.exe
  2⤵
  PID:9468
- C:\Windows\System\WaEsHdn.exe
  C:\Windows\System\WaEsHdn.exe
  2⤵
  PID:9660
- C:\Windows\System\wZeCybl.exe
  C:\Windows\System\wZeCybl.exe
  2⤵
  PID:9700
- C:\Windows\System\oOgyLpN.exe
  C:\Windows\System\oOgyLpN.exe
  2⤵
  PID:9848
- C:\Windows\System\ueqDlqP.exe
  C:\Windows\System\ueqDlqP.exe
  2⤵
  PID:9884
- C:\Windows\System\sCWYHjp.exe
  C:\Windows\System\sCWYHjp.exe
  2⤵
  PID:8212
- C:\Windows\System\IhViqqD.exe
  C:\Windows\System\IhViqqD.exe
  2⤵
  PID:9956
- C:\Windows\System\hZaiTGw.exe
  C:\Windows\System\hZaiTGw.exe
  2⤵
  PID:9828
- C:\Windows\System\ILWsiDv.exe
  C:\Windows\System\ILWsiDv.exe
  2⤵
  PID:9792
- C:\Windows\System\VeLalZO.exe
  C:\Windows\System\VeLalZO.exe
  2⤵
  PID:9900
- C:\Windows\System\uciDslb.exe
  C:\Windows\System\uciDslb.exe
  2⤵
  PID:9980
- C:\Windows\System\yMaKjOb.exe
  C:\Windows\System\yMaKjOb.exe
  2⤵
  PID:9992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BCQnKeo.exe

Filesize
2.2MB

MD5
9066589107b567018ef736c3f5ef9147

SHA1
9db2c46732438ca0ea4191197747da33f75bc89a

SHA256
362c17acfd88aae9223c09dad558b4a11c3511cbd17995f85465892d6c79a365

SHA512
3c3624e014f14d20563418de81e2d815707652f7472e1b5cc908aa3c0975902bcd0e84dfcfaae5a2dc2c13aea4535d62118037e019f3521c6435bc9b1da62b93

Download Submit
C:\Windows\system\EfyHaMR.exe

Filesize
2.2MB

MD5
63122be81dd15d7d51cab7e1e7bca351

SHA1
606eba696664d1f8a5c23fd432ed655bd31bae82

SHA256
4325cfb0795899f737ecb71ae323a4b68e7048b354ef1763c5d2c43fc3afd825

SHA512
499f7f8ee98e86bcf4113689a415ef823b048e6c2b612bc8122607b977d1b5bf1774b02cc851ce9a8750c11f1a9903d46502fef204b45e8ea787ed1b3d418763

Download Submit
C:\Windows\system\HYnwFhY.exe

Filesize
2.2MB

MD5
923730d4cbc9393597ed26fbaeaed369

SHA1
f674e4a977ffe10e8735a7827b1e545b8b74c022

SHA256
9ed016528276d0f4c4166b4f0f36f869b2a15f87cb422c64a24945ee9df9f18f

SHA512
3742ae77e6643dd34a02cff7faf423c9f4b1aea6aef5a7ad481791fc33aa124d3a91a116a770663c3feee7791ba988c44d526e7f8dba16458630e549a9dc71f8

Download Submit
C:\Windows\system\HzkUGrw.exe

Filesize
2.2MB

MD5
31d834c2dcd5f1a9a715dcd698c5d9c9

SHA1
86b63816f146b511681aba1fc49b379fbcdcc2e2

SHA256
482e0ecafd857e5fb194e28cfc10dced732295b7987c74ca0dd60a37018482ff

SHA512
5441ba850fc5d472090d215619a1efd31afde5ea9380e8db44d442781cc4edcbb274b6cf87042db4d44f11c5483aeaaa0550e19e552af9d437dcc19939301f6e

Download Submit
C:\Windows\system\JBjiWcs.exe

Filesize
2.2MB

MD5
e6540bd1e2db3689ba1de32247338aa0

SHA1
8e9fde95d2fe1e3491b728b0a33f82a6fc4c9550

SHA256
9d4f31a3da3882d452a489dfcbf9ab305458bd8180fd9d87218288d6d18ee0c3

SHA512
25a6e2fbb442fd98597f28dcf4a95b170658dfd6185522a6b24579c1ce7a5bb2914b8efb672cd86c54b3c56dfbbdde8cc833100c6fa864e23a30c79da703abe3

Download Submit
C:\Windows\system\JVxjjap.exe

Filesize
2.2MB

MD5
2b109c0b0e09139443a0ea2c8042da53

SHA1
af87891dc293c2295fcfc8c28282de67ab8c9816

SHA256
3f255f8fe8b5aab18b5a61f1c5c6c77f56eea0c71cc7c83f4e71dfaf753df095

SHA512
afdcbef3adf453d4eaf49c69dea71d1be75684592b79d0be2b1acf3efa7035747c07b67e244d6fa7b305cd308343f0c9dadfb1b23096dfdc113a66eca7d022d0

Download Submit
C:\Windows\system\LEwvqeE.exe

Filesize
2.2MB

MD5
5d05bd08f0c618356c981638a4c64774

SHA1
cb8cfc3acf0d5047fe7a37d1b9c894fdf0da03da

SHA256
f90846b5a2a7430d82ace1fefa5873f7984982e49a0576902f8ffde462bb52b1

SHA512
800dcafbdabee210dade621d388ae0dac0eb3f5a7323687470aa279c0c508a8efa0e3d0367ba3660c2a4225f6b0392584dd9e6ea3866f2dcaf005ea26b870290

Download Submit
C:\Windows\system\PuWuulJ.exe

Filesize
2.2MB

MD5
37569c842b3c5b97b95e208fdb0a28fd

SHA1
77e13269b28d0514ca49949e473b7af24535dc68

SHA256
188a1aec7ea3ffcce052c47ad0ef855135914e77584664cb1581b61ac1f5a6b3

SHA512
74af67b19b2ded4b6d8259e644f88b6092e3c0d4c1e8c82f883df7cbf6e889aac5c82d9654057027ff273b9daa517bd52c40f5d816c5f5551410f33aab6234a2

Download Submit
C:\Windows\system\QILXMhF.exe

Filesize
2.2MB

MD5
119fc89b9b0ed830586e4308daf4ee74

SHA1
ceb66cb0e3dd4b1141206a4bd251a3e68ef96832

SHA256
8bca57e58b7efe457d5f62ae6bd60c2ecb8e5eefc508ef261b77198818f50a75

SHA512
0923dd7bd0d5b22c242c418450733774235ddd8ccad24cb12df5e70f1f8486c4ed33b39ffa8c26067b3cdf555055c89817c8741832a2e4de5a6ae85a18287a12

Download Submit
C:\Windows\system\SpzTodW.exe

Filesize
2.2MB

MD5
0b7043d1e189f1987ae8dc66771d20af

SHA1
412f03f0c9bd3980914ca43fa5701ebaa4679c98

SHA256
32b62bc0777caf57492837e92f2efdae9e722159fec6116063e579c85d0ccefd

SHA512
557c32b4c67b586c95d31a90595f725189a4722ea9ed97be8d3fbc98636989ab7dc36458b69681d7f69ce3003cefac70b3e84f4247ee93b96043bd40dd7bde96

Download Submit
C:\Windows\system\VRtcVFb.exe

Filesize
2.2MB

MD5
c3e1426a61fa186936d747d1de967705

SHA1
16b41eca282ce1d4b5cadbf3f87d5990f6ddb79b

SHA256
4fcb19b4dffb08568636ca0953a166dcd46ca2cbe9db2ab1932b56061262673d

SHA512
a59e759f3dbe3897246606f18ab0b3c3b325c17db78e6a3bfed58047e1c923c4160e746fa682fd6ef322571254e88f40ca57b9f3e4ad669cced47f847a2655f3

Download Submit
C:\Windows\system\XvGaeQv.exe

Filesize
2.2MB

MD5
1185d95c2e78146bb87073019fbf9128

SHA1
743c9c7d7a84f82d7914459ef977a1f7da4eaa8b

SHA256
a23c896a517fa4776a1bc13d4088ed0886639a9b00fe87363fadbc5f3ab65a3b

SHA512
6324e8007afa88c8a468eb92feacc86529f212af8c18afc2d718baa517b7b03c7f16c6e4715727107ef493e98393934d4cf61645c7df5512c400e6f654af2e52

Download Submit
C:\Windows\system\YrJiUNi.exe

Filesize
2.2MB

MD5
5f46816dfbfd28c04ccdf976bd25e5ce

SHA1
bddb2cdad7055f697e2d21a928eb78e612a7d65a

SHA256
96fb7ba90ce4661e4522ecd994ee6acf00a8f6922d60c2366f42328b445baf71

SHA512
5ddd73098e1b13ff1dd87e05de23bf769fd4209312c69cf17b8f1d9c0e9a23f8c85c788e836128805170176f5242c9e55c96887c0e3f821dcdb87e0cc2681e2a

Download Submit
C:\Windows\system\ZkXpUtr.exe

Filesize
2.2MB

MD5
0334a9346858877a34cc2b79a73a3d70

SHA1
93918dc4091609d30cac0daebf1c47cb8b0f0aaa

SHA256
c4030a698007db172d7585f182f997e192a176a06a191994cecef21c80cb90cf

SHA512
d5510865a9251c25711b641421140dfbfe8c97928bf75604e4bb89e05fd49c77f65388eda8acad96ab4ba7bf29289738e9052bf7bd165195bf8e23c636291652

Download Submit
C:\Windows\system\afcNBgI.exe

Filesize
2.2MB

MD5
19d26ecebe9e146ffd0cbc9d71341a0e

SHA1
d18df71fd645fbc20471186ff748676b1c1249a0

SHA256
c4b5551280382497164cc5ffcecda5b08eb852cf0a29a9ce8554346d57a1643c

SHA512
6ad603d19cf90a89d43e33227715c00122beb543292c4bad9a0ec85226e6069aead6e95660c263989bc4929c6916cd393c00c311d792a6423b6f1a9267533e18

Download Submit
C:\Windows\system\dlALnRJ.exe

Filesize
2.2MB

MD5
326dd63dd53a381d8668f2852f13978f

SHA1
d25a51a7e13c01dd1bd6f8244adf5737c08dad21

SHA256
46f5b10b683d89cc8c0e246c7eb4d49e3e979b20386109eb4f47a89f3c776fd7

SHA512
67c26f65dbb57a95d532e17faf6a27f2e902391fca3db4b958bd61dfaa2e08067aa896ad5309c6f51da03e384b686d55ae8008f5d833df755421b9834158a8f7

Download Submit
C:\Windows\system\fCfVxHb.exe

Filesize
2.2MB

MD5
a45e873e54ab75e758233ba1369018dd

SHA1
6685e04e31c0cce7b4bf79568b04e34296a41472

SHA256
dd7225d8b5e6e93900d1d8b7ab01b69c3f821ba705514cf2cbf3d4d5f205b08b

SHA512
b595148ada829836c77d9658199f776bc82bb16ecb49ca7510c738a381063624c4c1978906ae572edff26a1698231db9ac6a885d461d620f3c2ad2ff2561d69e

Download Submit
C:\Windows\system\fUKRXfS.exe

Filesize
2.2MB

MD5
6513c8c1f025e6012f1538ec9083f679

SHA1
ac28bf3cb168719a3e4dfb44e3ad1d2714fa93b7

SHA256
a871acf8ffca8161bb3b626c7dd9c6d49949c5e792d26cf755747e245cbc1549

SHA512
ba046cfa4076b09252c33e7be642b2899c355bfdcd838e7d6b35abbfde2fc84cb8e86471ff49c7c85d51416a83abba457073f59a3fa5564ad6fce09711cf37ad

Download Submit
C:\Windows\system\hJJUBDP.exe

Filesize
2.2MB

MD5
80e86cb200530727cae8397d372cd270

SHA1
9988f6512c80122c82415e292d20ccd9972bfa00

SHA256
1e0d4c32dc313ec2ee2d679c9f44be68faeadd85f6db24491bba658f9a83c5de

SHA512
193d71a39dfff6b9e97b34f940d0ab71ab9f0527096eb708089e2ceccfdd879199eea9400ff6d092e9650cf4c26eb7512dd145da618fdf586d7b8a64a742d80a

Download Submit
C:\Windows\system\iQaBKkL.exe

Filesize
2.2MB

MD5
ce9e416dbedc28b6b6ea86a57b6dcc30

SHA1
cba7bbce1a3730eb97233e935f0bbd67bc9a642c

SHA256
bf3534afd6fff2c46ff686ee4cc68e686e49a10e9bab616eacce17a05040af2c

SHA512
4e97f2919e0f53feaf2ad2e61e40a95a5df898b6fbd68204e79705a1e44ffdbf4c7a0ce61aaf3e7c125d635eac9751893c8d7efecd88a12d2c14d0eae571d736

Download Submit
C:\Windows\system\idtULuX.exe

Filesize
2.2MB

MD5
fa75b2c6e7d946cc08280d26e9a07a3b

SHA1
f7a959b0d99b04925ba7f7cb829b330fa91686e1

SHA256
9a9ddf5ad7eb70c537f3e8754679ad60cc5f0c594fc309ed3690d61d222c2d5c

SHA512
e5e01df0ebc0cab2d7f5633ada91a8f138d10157964df13c4fb0d0a0929d9173942bd81f6827f9cbc72abf581308cc116c4789579fba09dfadf357c98a6fee20

Download Submit
C:\Windows\system\oHzSAvg.exe

Filesize
2.2MB

MD5
7fcb6482207f51cea735e0fe42ce65a2

SHA1
42de12ac0f19a5ba73c7a5f9cd938f6c368b9f61

SHA256
d993798c4806b393c36116d93321e8f3bc671dbb41d18ded10617fdcfd4d9e1d

SHA512
02de3e372ae5a70e24c58717090701f262e4cf039c6662367fc133ad12d9e43c14968e2f9a40d345c3d91f70e572ee18af6a5fc1b9a703bba547f6df1fade0c4

Download Submit
C:\Windows\system\pufZKwh.exe

Filesize
2.2MB

MD5
c86f1fea6b8d800a68e88cc20559b8c4

SHA1
45131c88bb3d0ba94d71b549459b695809c32fdb

SHA256
092742973b4101148c942c7d8028653908bd711a4e72948ff71d82aae6b79b81

SHA512
046d8d580c742fbd41b73a2571acc85aafa1bcf99f1ebfe92f6e4d2af6c0ee51797164a593d11b63a66043c397b8dd565c09a93cd0805e3abb2db69ae238261a

Download Submit
C:\Windows\system\sjSpROI.exe

Filesize
2.2MB

MD5
58aa6ff074ea5c3d990ae3f70076f646

SHA1
e0d0de9cb0268daee49ebb35154a57741280c5b6

SHA256
f8db28ec485ad117531c85ec266f1b284d656bef2f6cc9f2c3c48c4b79646352

SHA512
2fda5b4076558ac2ff0095c3875fe2c32435452197e15c8536ca41f65054287ccda4d9ace9abad32ec214efc3b1a598cb4dc6b345f3ce2391fbb1a9c21b08daa

Download Submit
C:\Windows\system\tonsBac.exe

Filesize
2.2MB

MD5
6f669fe771d5e3740d25bc288790a21a

SHA1
8a9aaec7910fa0dd6304776478c1a444f66ad51e

SHA256
7f60205869213d1118e13a8ee2eec4856097879aec89adf53f83a6d16c6e173f

SHA512
87f477f781f7a0bb7302f8e867ec6c378eb05928713d868cf12fcd489d90312a3ff98cafc22412adcf2fe7dd55a2283ea5a695566bf828654d48eee61e139afc

Download Submit
C:\Windows\system\zKGJzrz.exe

Filesize
2.2MB

MD5
e75b81d792bf8f7f5c6a7123803526ad

SHA1
88b94577e94f2c30a291ed2bed91a0a5d76ada13

SHA256
67f9b196583bfe8aedc10cf8b5de07d58f03092d4171a70de43a5adaf8193927

SHA512
0597126dec67d1375ceb1fbece0ec717c1fb26de7fc4f1ae310416f6f2494481e9665af2417e92d0b273446211d2ef97fcf7cbcbc039c5493c09a4a867203c09

Download Submit
\Windows\system\DGBffNv.exe

Filesize
2.2MB

MD5
27bcc1c41fc307681aadc7f2c62efb48

SHA1
6069a1d352573a49b14dfb42aa9c1672f9650ef9

SHA256
90f7be1b8a679c24792b6d34ef78fbb123877feac98cdfeea52934c055aff50a

SHA512
8ae9b8a7c59a9f4af80b58ae9a832e06ad3a1d7e59ffcfe7c3308d9c9f4297e2fe426ec925d3fb55c6dcb52e7fa65cebd52448ede5b153ebf4cd508d363d6239

Download Submit
\Windows\system\ELtxEPM.exe

Filesize
2.2MB

MD5
f3a33a66c4853b5c30d6c7962e933f70

SHA1
99d6b72580754747a09069bbcb276a5de84889ab

SHA256
678c2ce3a8a422dc80d9286aa439c3284e0ab71d086cdb52f1ba03c8f6471262

SHA512
3016713ebea9fca6e54d5607e3f5b5132aebd254a0fa9de46f9518ad9effdbd23401a86f0cd60c2039b1fe524d257205d41bb69208c98c96ab6a0353d17fd0cd

Download Submit
\Windows\system\FtSbAka.exe

Filesize
2.2MB

MD5
c0890becd8d0a08e49d24ffd82d40a5c

SHA1
33ded4ff52da1fbd2f08c5051f7252fb243109db

SHA256
b0d85f685590a15f59d6e7ff552602816146c0844fbeeef282c1e74b798cae9b

SHA512
44debfa8788ce5d2ad6bbb9ecd74ba7bd68415d8332642df2d1705b8025fe26597b8bded9c85e5aa0b8890a0c14509b9e69c3abcb285e1d730108feb87f6bce4

Download Submit
\Windows\system\Wdsvrlp.exe

Filesize
2.2MB

MD5
f3426477811f9e68977b7131d15bad71

SHA1
86197d0b23fa1638c61a9c747d758fbf5018c729

SHA256
c7dda1868c27bc8174ceb3b2d5c5d82324db7658fe31b0a9ba4b34445abd00e2

SHA512
e1e77d8a9b0e3e38a3270b37b28e009b3e34b2679803981829746d91f63df547f383fa33462689ca90340ad749bdadd617c26cc89dd4463dfda4c2917b3e4562

Download Submit
\Windows\system\dBQnBII.exe

Filesize
2.2MB

MD5
3bb9dc758d3eb5358d686b84fa38c769

SHA1
366d060aba48818940357f9de1ee3fa4e0e31a41

SHA256
2c6640b4d84a043dc7d6b91add120050bc6c046444ca24c82a85ce393d713439

SHA512
7a377ab88978cc7f539b6f455aa56bc7f68aca61ee52f85ebe6641f78944162ef4f4d497c2cb4e792b9108f4fbb38cd5dc84e9267cae034a0a27819baaf7c032

Download Submit
\Windows\system\jTBzxIO.exe

Filesize
2.2MB

MD5
3c87e1904e075d51ec55bba2e3a08206

SHA1
ec62ae59b57b841479f640a473da4a5b7c92a70b

SHA256
209bb51d49f0e3d46158183508328053561b30dd7d3aefc7b98c5b42d27e2ff2

SHA512
89b897073ca314c5b07d7fb83028a6afc42e9a07187640dde5bf252a151dbdcda6fde6f2ab7876baf3ab5167a018bdb6101b8e7c31f9ce963a80ecb2f52912a2

Download Submit
\Windows\system\nKerqyy.exe

Filesize
2.2MB

MD5
d2da4a5fa336f28b84fb1a5fc82fdecc

SHA1
d6d333d0c516808256668b26eda1de82d6b53b1c

SHA256
8c58827e8f48ad529a3885dcff7e03e904a87b5cfe82e29ed42460d8d1ccb7db

SHA512
98840f3c53bd7cb0885a67d8083ba0d7f945192346374f94f119a4bb19d15b13b49ff8aee5a051047e5c2ecdfb1737fcacc99a3453754255cd835749dd1c99c8

Download Submit
\Windows\system\sXNRccm.exe

Filesize
2.2MB

MD5
e0c6cfa9b3d8225459b26a3027d003ee

SHA1
51561f5c49d21d38ace5554d486483e29cffc395

SHA256
b91d47b5ec34fa396376697da04cf9a03772f90855205e26c9847aa46a94b6c2

SHA512
fc8f87bb300cd203caa5200480e10aab60faf668168bd37efc4c8e145cf17b4db90329eed4b4bf19cbca9ff9b480ab6d9ab0628c37e9a82f29915a2d69c189d5

Download Submit
memory/1904-121-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/1904-6-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/1904-1-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/1904-153-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/1904-164-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/1904-147-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/1904-162-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/1904-123-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/1904-160-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/1904-155-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/1904-158-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/1904-0-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/1940-157-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2360-161-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2428-163-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2464-154-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2480-146-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2508-8-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2520-122-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-148-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2640-159-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2872-165-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2872-100-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2872-119-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2872-118-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2872-120-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2872-134-0x00000000028F0000-0x00000000028F8000-memory.dmp

Filesize
32KB

Download
memory/2872-2503-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download