xmrig | 8ea459c17cd909f454130aef539fd956e1dc52342eeea8313370fa6f1e459021

Analysis

max time kernel
29s
max time network
29s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
Size

1.7MB
MD5

05445304ee0102f726bc7d2a260e22ea
SHA1

e2af57956a3bb26548538fdbc10c92e39c4643e8
SHA256

8ea459c17cd909f454130aef539fd956e1dc52342eeea8313370fa6f1e459021
SHA512

3d687197f893085fbd90b39cae30156e8f4724318d236577d3ca08729a8082984ba2b662094257a0cc71f2621cf2303cd5d102421e58c0759374d35d914e79a2
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDh:NAB4

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral1/memory/2496-244-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/1124-242-0x000000013F690000-0x000000013FA82000-memory.dmp	xmrig
behavioral1/memory/2664-235-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/2656-230-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2608-229-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2100-226-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1124	IbFmlQj.exe
2100	ZXkzTES.exe
2608	fZjlWCT.exe
2656	dZlqvuv.exe
2664	ptHcZmX.exe
2496	PdEZyXu.exe
2768	qifMBXb.exe
2572	KuJWnPw.exe
2536	INgxqTl.exe
1060	JPIDVmI.exe
2468	wuxcIOa.exe
1824	RVklWAt.exe
1988	JGLRoDv.exe
2116	oLFtWvr.exe
2784	lcgJrlV.exe
2428	EHTuTnx.exe
2704	EJLFWhy.exe
2104	UyQKQkS.exe
636	yjrUULO.exe
2456	TCvWxaK.exe
1616	wIVyyAT.exe
780	tZdcqtX.exe
3056	aykzocT.exe
2356	DxdVWSJ.exe
2968	GIZCjmi.exe
2900	KhaSTzz.exe
2716	GquXhVS.exe
1676	wKbTvSF.exe
784	LhlpRWG.exe
2948	iteevEh.exe
1072	GOJNaID.exe
1640	VItHtTT.exe
1704	WdqSXzY.exe
1816	CQwiGtj.exe
952	SAEDbMW.exe
1668	GkIPTPb.exe
1316	wGTnFbQ.exe
1564	YEKqbdU.exe
2944	PhSmqNj.exe
3036	rADVBfQ.exe
540	tMuxQlD.exe
1168	bjmneXd.exe
1172	tibvIut.exe
1940	aSecaOs.exe
2764	bYnheUS.exe
1136	hKRkewy.exe
1868	TzoerGu.exe
2596	veJMqhe.exe
1508	OjvYnXB.exe
2360	LzUDRsH.exe
328	bphBAKt.exe
2384	UUMciCQ.exe
1772	FAqfIHr.exe
2224	QddYWzr.exe
2000	nJBOSDR.exe
2752	wnERQgQ.exe
1600	zqGdKbo.exe
1212	KoLlyME.exe
2524	lsdAYHC.exe
956	kprdbPp.exe
1608	DmlImha.exe
2652	SSCoPIo.exe
2992	mYQDxld.exe
2528	QqPfSbB.exe

Loads dropped DLL 64 IoCs

pid	Process
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2212-0-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/files/0x00090000000141e6-3.dat	upx
behavioral1/files/0x00070000000149f5-59.dat	upx
behavioral1/files/0x000900000001447e-21.dat	upx
behavioral1/files/0x000a0000000146b8-68.dat	upx
behavioral1/files/0x00060000000155ed-76.dat	upx
behavioral1/files/0x0006000000015b6f-106.dat	upx
behavioral1/files/0x0006000000015c52-114.dat	upx
behavioral1/files/0x0006000000015cce-139.dat	upx
behavioral1/files/0x0006000000015d07-157.dat	upx
behavioral1/files/0x00070000000146a2-28.dat	upx
behavioral1/files/0x0008000000014667-43.dat	upx
behavioral1/files/0x0007000000014abe-42.dat	upx
behavioral1/files/0x000a000000014825-35.dat	upx
behavioral1/files/0x000f000000005578-27.dat	upx
behavioral1/files/0x0006000000015d0f-160.dat	upx
behavioral1/files/0x0006000000014b31-49.dat	upx
behavioral1/files/0x0006000000014de9-62.dat	upx
behavioral1/memory/2496-244-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/1124-242-0x000000013F690000-0x000000013FA82000-memory.dmp	upx
behavioral1/files/0x0006000000015cf6-153.dat	upx
behavioral1/memory/2664-235-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/2656-230-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2608-229-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2100-226-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x0006000000015cfe-150.dat	upx
behavioral1/files/0x0006000000015cee-142.dat	upx
behavioral1/files/0x0006000000015cb6-136.dat	upx
behavioral1/files/0x0006000000015c83-126.dat	upx
behavioral1/files/0x0006000000015c6b-117.dat	upx
behavioral1/files/0x0006000000015c3d-108.dat	upx
behavioral1/files/0x0006000000015626-98.dat	upx
behavioral1/files/0x0006000000015605-90.dat	upx
behavioral1/files/0x00060000000155f3-80.dat	upx
behavioral1/files/0x0006000000015018-73.dat	upx
behavioral1/files/0x0006000000015d27-168.dat	upx
behavioral1/files/0x0006000000015d1a-165.dat	upx
behavioral1/files/0x0006000000015c9f-135.dat	upx
behavioral1/files/0x0006000000015c78-123.dat	upx
behavioral1/files/0x0006000000015616-97.dat	upx
behavioral1/files/0x00060000000155f7-87.dat	upx
behavioral1/files/0x0006000000014ef8-67.dat	upx
behavioral1/files/0x0006000000014b70-61.dat	upx
behavioral1/files/0x0007000000014af6-60.dat	upx
behavioral1/files/0x00090000000147ea-58.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oRosiAy.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\xSZSJMS.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\dgDqDnz.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\KjbDkNC.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\KfCbetm.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\pxkBhRs.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\rVvWAoJ.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\GBjlcrv.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\fgRMSOy.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\UWhcgZs.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\RwzEoWS.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\foPAGyk.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\tpBKPyN.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\EgKrvwM.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\GqjdJEk.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\ZCrnLkT.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\KmpYLPr.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\anfnVwU.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\iWCXpjO.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\cvAcVyJ.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\ZRMxdUG.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\bCzVyIx.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\EKpuXHL.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\RETxvIb.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\EYKZVIK.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\DzqWymr.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\bfzTtfu.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\tftkxME.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\ynSbojy.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\NYGAAAO.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\OIdDPQV.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\uMuVurI.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\OktJqQP.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\fLmRoXF.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\RjcPzfK.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\BNiLaSL.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\qLEIojM.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\yquLBOB.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\DpoFwCt.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\LuZBSuz.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\IxsslJH.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\GRORYju.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\XZQrqsN.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\fCZhyHh.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\JEERLiz.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\THNKccx.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\ttySRzP.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\pLSaHBT.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\oJqPcUZ.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\opqgABV.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\bjOFtJq.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\exTgIkX.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\iFVnChS.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\JEvxGVC.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\XFkZGHJ.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\lOQcyYe.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\ViqrYGF.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\CtZhJgD.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\SEFfZvH.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\oiKXugy.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\NIYnPWC.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\WsnwpFD.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\skLhDsZ.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
File created	C:\Windows\System\hlraORj.exe	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1216	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeLockMemoryPrivilege	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 1216	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	29
PID 2212 wrote to memory of 1216	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	29
PID 2212 wrote to memory of 1216	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	29
PID 2212 wrote to memory of 1124	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	30
PID 2212 wrote to memory of 1124	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	30
PID 2212 wrote to memory of 1124	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	30
PID 2212 wrote to memory of 2100	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	31
PID 2212 wrote to memory of 2100	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	31
PID 2212 wrote to memory of 2100	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	31
PID 2212 wrote to memory of 2608	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	32
PID 2212 wrote to memory of 2608	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	32
PID 2212 wrote to memory of 2608	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	32
PID 2212 wrote to memory of 2664	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	33
PID 2212 wrote to memory of 2664	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	33
PID 2212 wrote to memory of 2664	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	33
PID 2212 wrote to memory of 2656	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	34
PID 2212 wrote to memory of 2656	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	34
PID 2212 wrote to memory of 2656	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	34
PID 2212 wrote to memory of 2468	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	35
PID 2212 wrote to memory of 2468	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	35
PID 2212 wrote to memory of 2468	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	35
PID 2212 wrote to memory of 2496	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	36
PID 2212 wrote to memory of 2496	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	36
PID 2212 wrote to memory of 2496	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	36
PID 2212 wrote to memory of 2784	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	37
PID 2212 wrote to memory of 2784	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	37
PID 2212 wrote to memory of 2784	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	37
PID 2212 wrote to memory of 2768	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	38
PID 2212 wrote to memory of 2768	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	38
PID 2212 wrote to memory of 2768	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	38
PID 2212 wrote to memory of 2704	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	39
PID 2212 wrote to memory of 2704	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	39
PID 2212 wrote to memory of 2704	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	39
PID 2212 wrote to memory of 2572	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	40
PID 2212 wrote to memory of 2572	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	40
PID 2212 wrote to memory of 2572	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	40
PID 2212 wrote to memory of 2456	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	41
PID 2212 wrote to memory of 2456	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	41
PID 2212 wrote to memory of 2456	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	41
PID 2212 wrote to memory of 2536	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	42
PID 2212 wrote to memory of 2536	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	42
PID 2212 wrote to memory of 2536	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	42
PID 2212 wrote to memory of 2900	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	43
PID 2212 wrote to memory of 2900	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	43
PID 2212 wrote to memory of 2900	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	43
PID 2212 wrote to memory of 1060	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	44
PID 2212 wrote to memory of 1060	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	44
PID 2212 wrote to memory of 1060	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	44
PID 2212 wrote to memory of 1640	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	45
PID 2212 wrote to memory of 1640	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	45
PID 2212 wrote to memory of 1640	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	45
PID 2212 wrote to memory of 1824	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	46
PID 2212 wrote to memory of 1824	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	46
PID 2212 wrote to memory of 1824	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	46
PID 2212 wrote to memory of 1704	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	47
PID 2212 wrote to memory of 1704	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	47
PID 2212 wrote to memory of 1704	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	47
PID 2212 wrote to memory of 1988	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	48
PID 2212 wrote to memory of 1988	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	48
PID 2212 wrote to memory of 1988	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	48
PID 2212 wrote to memory of 952	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	49
PID 2212 wrote to memory of 952	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	49
PID 2212 wrote to memory of 952	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	49
PID 2212 wrote to memory of 2116	2212	05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05445304ee0102f726bc7d2a260e22ea_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- C:\Windows\System\IbFmlQj.exe
  C:\Windows\System\IbFmlQj.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\ZXkzTES.exe
  C:\Windows\System\ZXkzTES.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\fZjlWCT.exe
  C:\Windows\System\fZjlWCT.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\ptHcZmX.exe
  C:\Windows\System\ptHcZmX.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\dZlqvuv.exe
  C:\Windows\System\dZlqvuv.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\wuxcIOa.exe
  C:\Windows\System\wuxcIOa.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\PdEZyXu.exe
  C:\Windows\System\PdEZyXu.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\lcgJrlV.exe
  C:\Windows\System\lcgJrlV.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\qifMBXb.exe
  C:\Windows\System\qifMBXb.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\EJLFWhy.exe
  C:\Windows\System\EJLFWhy.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\KuJWnPw.exe
  C:\Windows\System\KuJWnPw.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\TCvWxaK.exe
  C:\Windows\System\TCvWxaK.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\INgxqTl.exe
  C:\Windows\System\INgxqTl.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\KhaSTzz.exe
  C:\Windows\System\KhaSTzz.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\JPIDVmI.exe
  C:\Windows\System\JPIDVmI.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\VItHtTT.exe
  C:\Windows\System\VItHtTT.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\RVklWAt.exe
  C:\Windows\System\RVklWAt.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\WdqSXzY.exe
  C:\Windows\System\WdqSXzY.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\JGLRoDv.exe
  C:\Windows\System\JGLRoDv.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\SAEDbMW.exe
  C:\Windows\System\SAEDbMW.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\oLFtWvr.exe
  C:\Windows\System\oLFtWvr.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\GkIPTPb.exe
  C:\Windows\System\GkIPTPb.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\EHTuTnx.exe
  C:\Windows\System\EHTuTnx.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\wGTnFbQ.exe
  C:\Windows\System\wGTnFbQ.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\UyQKQkS.exe
  C:\Windows\System\UyQKQkS.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\YEKqbdU.exe
  C:\Windows\System\YEKqbdU.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\yjrUULO.exe
  C:\Windows\System\yjrUULO.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\PhSmqNj.exe
  C:\Windows\System\PhSmqNj.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\wIVyyAT.exe
  C:\Windows\System\wIVyyAT.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\tMuxQlD.exe
  C:\Windows\System\tMuxQlD.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\tZdcqtX.exe
  C:\Windows\System\tZdcqtX.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\bjmneXd.exe
  C:\Windows\System\bjmneXd.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\aykzocT.exe
  C:\Windows\System\aykzocT.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\tibvIut.exe
  C:\Windows\System\tibvIut.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\DxdVWSJ.exe
  C:\Windows\System\DxdVWSJ.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\aSecaOs.exe
  C:\Windows\System\aSecaOs.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\GIZCjmi.exe
  C:\Windows\System\GIZCjmi.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\bYnheUS.exe
  C:\Windows\System\bYnheUS.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\GquXhVS.exe
  C:\Windows\System\GquXhVS.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\hKRkewy.exe
  C:\Windows\System\hKRkewy.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\wKbTvSF.exe
  C:\Windows\System\wKbTvSF.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\TzoerGu.exe
  C:\Windows\System\TzoerGu.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\LhlpRWG.exe
  C:\Windows\System\LhlpRWG.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\OjvYnXB.exe
  C:\Windows\System\OjvYnXB.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\iteevEh.exe
  C:\Windows\System\iteevEh.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\LzUDRsH.exe
  C:\Windows\System\LzUDRsH.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\GOJNaID.exe
  C:\Windows\System\GOJNaID.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\bphBAKt.exe
  C:\Windows\System\bphBAKt.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\CQwiGtj.exe
  C:\Windows\System\CQwiGtj.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\kprdbPp.exe
  C:\Windows\System\kprdbPp.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\rADVBfQ.exe
  C:\Windows\System\rADVBfQ.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\DmlImha.exe
  C:\Windows\System\DmlImha.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\veJMqhe.exe
  C:\Windows\System\veJMqhe.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\QqPfSbB.exe
  C:\Windows\System\QqPfSbB.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\UUMciCQ.exe
  C:\Windows\System\UUMciCQ.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\xNqdYcT.exe
  C:\Windows\System\xNqdYcT.exe
  2⤵
  PID:1528
- C:\Windows\System\FAqfIHr.exe
  C:\Windows\System\FAqfIHr.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\VNakoYj.exe
  C:\Windows\System\VNakoYj.exe
  2⤵
  PID:2444
- C:\Windows\System\QddYWzr.exe
  C:\Windows\System\QddYWzr.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\ePszBxE.exe
  C:\Windows\System\ePszBxE.exe
  2⤵
  PID:1044
- C:\Windows\System\nJBOSDR.exe
  C:\Windows\System\nJBOSDR.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\jeArCEL.exe
  C:\Windows\System\jeArCEL.exe
  2⤵
  PID:2960
- C:\Windows\System\wnERQgQ.exe
  C:\Windows\System\wnERQgQ.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\oQKsxcK.exe
  C:\Windows\System\oQKsxcK.exe
  2⤵
  PID:1764
- C:\Windows\System\zqGdKbo.exe
  C:\Windows\System\zqGdKbo.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\gEfdkES.exe
  C:\Windows\System\gEfdkES.exe
  2⤵
  PID:1120
- C:\Windows\System\KoLlyME.exe
  C:\Windows\System\KoLlyME.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\CgAsynW.exe
  C:\Windows\System\CgAsynW.exe
  2⤵
  PID:1560
- C:\Windows\System\lsdAYHC.exe
  C:\Windows\System\lsdAYHC.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\NbhdHqf.exe
  C:\Windows\System\NbhdHqf.exe
  2⤵
  PID:1624
- C:\Windows\System\SSCoPIo.exe
  C:\Windows\System\SSCoPIo.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\yQlIQDx.exe
  C:\Windows\System\yQlIQDx.exe
  2⤵
  PID:1184
- C:\Windows\System\mYQDxld.exe
  C:\Windows\System\mYQDxld.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\DVMDIiQ.exe
  C:\Windows\System\DVMDIiQ.exe
  2⤵
  PID:2904
- C:\Windows\System\pxkBhRs.exe
  C:\Windows\System\pxkBhRs.exe
  2⤵
  PID:2908
- C:\Windows\System\DzqWymr.exe
  C:\Windows\System\DzqWymr.exe
  2⤵
  PID:1160
- C:\Windows\System\AbxdEnr.exe
  C:\Windows\System\AbxdEnr.exe
  2⤵
  PID:2448
- C:\Windows\System\TzumXph.exe
  C:\Windows\System\TzumXph.exe
  2⤵
  PID:1972
- C:\Windows\System\jXtInLp.exe
  C:\Windows\System\jXtInLp.exe
  2⤵
  PID:2248
- C:\Windows\System\tFbLSDF.exe
  C:\Windows\System\tFbLSDF.exe
  2⤵
  PID:624
- C:\Windows\System\UxlRwPv.exe
  C:\Windows\System\UxlRwPv.exe
  2⤵
  PID:2112
- C:\Windows\System\CZugFme.exe
  C:\Windows\System\CZugFme.exe
  2⤵
  PID:2300
- C:\Windows\System\GCOuXxE.exe
  C:\Windows\System\GCOuXxE.exe
  2⤵
  PID:820
- C:\Windows\System\VGsGqXk.exe
  C:\Windows\System\VGsGqXk.exe
  2⤵
  PID:2648
- C:\Windows\System\nFhGHhv.exe
  C:\Windows\System\nFhGHhv.exe
  2⤵
  PID:1828
- C:\Windows\System\HCQOOHm.exe
  C:\Windows\System\HCQOOHm.exe
  2⤵
  PID:912
- C:\Windows\System\gNzAZYx.exe
  C:\Windows\System\gNzAZYx.exe
  2⤵
  PID:1504
- C:\Windows\System\yiuWKva.exe
  C:\Windows\System\yiuWKva.exe
  2⤵
  PID:1152
- C:\Windows\System\AuErCfH.exe
  C:\Windows\System\AuErCfH.exe
  2⤵
  PID:472
- C:\Windows\System\kMZrDSF.exe
  C:\Windows\System\kMZrDSF.exe
  2⤵
  PID:2732
- C:\Windows\System\TicPUsm.exe
  C:\Windows\System\TicPUsm.exe
  2⤵
  PID:412
- C:\Windows\System\oDYlAdL.exe
  C:\Windows\System\oDYlAdL.exe
  2⤵
  PID:680
- C:\Windows\System\QiQqRSm.exe
  C:\Windows\System\QiQqRSm.exe
  2⤵
  PID:2236
- C:\Windows\System\mcYcVYn.exe
  C:\Windows\System\mcYcVYn.exe
  2⤵
  PID:2380
- C:\Windows\System\uiHXQSB.exe
  C:\Windows\System\uiHXQSB.exe
  2⤵
  PID:2564
- C:\Windows\System\eaFWDoM.exe
  C:\Windows\System\eaFWDoM.exe
  2⤵
  PID:2140
- C:\Windows\System\vKsDkcN.exe
  C:\Windows\System\vKsDkcN.exe
  2⤵
  PID:2776
- C:\Windows\System\TQTmwAA.exe
  C:\Windows\System\TQTmwAA.exe
  2⤵
  PID:1268
- C:\Windows\System\ECWfZOI.exe
  C:\Windows\System\ECWfZOI.exe
  2⤵
  PID:2548
- C:\Windows\System\lBfhhMA.exe
  C:\Windows\System\lBfhhMA.exe
  2⤵
  PID:356
- C:\Windows\System\KaowJAp.exe
  C:\Windows\System\KaowJAp.exe
  2⤵
  PID:1424
- C:\Windows\System\WxXSjNx.exe
  C:\Windows\System\WxXSjNx.exe
  2⤵
  PID:1580
- C:\Windows\System\ogZkfMC.exe
  C:\Windows\System\ogZkfMC.exe
  2⤵
  PID:1832
- C:\Windows\System\IToFGsY.exe
  C:\Windows\System\IToFGsY.exe
  2⤵
  PID:2512
- C:\Windows\System\LWbJwEu.exe
  C:\Windows\System\LWbJwEu.exe
  2⤵
  PID:1204
- C:\Windows\System\mXIvKbo.exe
  C:\Windows\System\mXIvKbo.exe
  2⤵
  PID:2304
- C:\Windows\System\yGXXkIW.exe
  C:\Windows\System\yGXXkIW.exe
  2⤵
  PID:2964
- C:\Windows\System\JJlPcmJ.exe
  C:\Windows\System\JJlPcmJ.exe
  2⤵
  PID:1996
- C:\Windows\System\skNbhzl.exe
  C:\Windows\System\skNbhzl.exe
  2⤵
  PID:1620
- C:\Windows\System\TnZmdms.exe
  C:\Windows\System\TnZmdms.exe
  2⤵
  PID:2912
- C:\Windows\System\ImuPqDx.exe
  C:\Windows\System\ImuPqDx.exe
  2⤵
  PID:3076
- C:\Windows\System\zxXRCye.exe
  C:\Windows\System\zxXRCye.exe
  2⤵
  PID:3092
- C:\Windows\System\GUJqeJC.exe
  C:\Windows\System\GUJqeJC.exe
  2⤵
  PID:3108
- C:\Windows\System\WmELoTe.exe
  C:\Windows\System\WmELoTe.exe
  2⤵
  PID:3124
- C:\Windows\System\GOsoOrr.exe
  C:\Windows\System\GOsoOrr.exe
  2⤵
  PID:3148
- C:\Windows\System\kolgwdd.exe
  C:\Windows\System\kolgwdd.exe
  2⤵
  PID:3164
- C:\Windows\System\rjYcwoS.exe
  C:\Windows\System\rjYcwoS.exe
  2⤵
  PID:3180
- C:\Windows\System\WQMuvrN.exe
  C:\Windows\System\WQMuvrN.exe
  2⤵
  PID:3196
- C:\Windows\System\PYaIxqD.exe
  C:\Windows\System\PYaIxqD.exe
  2⤵
  PID:3220
- C:\Windows\System\NdyZcGW.exe
  C:\Windows\System\NdyZcGW.exe
  2⤵
  PID:3236
- C:\Windows\System\leMPKZO.exe
  C:\Windows\System\leMPKZO.exe
  2⤵
  PID:3252
- C:\Windows\System\hpUxpcE.exe
  C:\Windows\System\hpUxpcE.exe
  2⤵
  PID:3268
- C:\Windows\System\VPpXfkm.exe
  C:\Windows\System\VPpXfkm.exe
  2⤵
  PID:3284
- C:\Windows\System\lMYMbBn.exe
  C:\Windows\System\lMYMbBn.exe
  2⤵
  PID:3300
- C:\Windows\System\dfhLtoq.exe
  C:\Windows\System\dfhLtoq.exe
  2⤵
  PID:3320
- C:\Windows\System\ocHwPSH.exe
  C:\Windows\System\ocHwPSH.exe
  2⤵
  PID:3348
- C:\Windows\System\ahydQfT.exe
  C:\Windows\System\ahydQfT.exe
  2⤵
  PID:3364
- C:\Windows\System\iikqfZB.exe
  C:\Windows\System\iikqfZB.exe
  2⤵
  PID:3380
- C:\Windows\System\dyixRcW.exe
  C:\Windows\System\dyixRcW.exe
  2⤵
  PID:3396
- C:\Windows\System\RnMJkdm.exe
  C:\Windows\System\RnMJkdm.exe
  2⤵
  PID:3412
- C:\Windows\System\CiZnwOJ.exe
  C:\Windows\System\CiZnwOJ.exe
  2⤵
  PID:3428
- C:\Windows\System\LDhKjaq.exe
  C:\Windows\System\LDhKjaq.exe
  2⤵
  PID:3444
- C:\Windows\System\GeylEoV.exe
  C:\Windows\System\GeylEoV.exe
  2⤵
  PID:3460
- C:\Windows\System\lsAvaEf.exe
  C:\Windows\System\lsAvaEf.exe
  2⤵
  PID:3476
- C:\Windows\System\IawclCc.exe
  C:\Windows\System\IawclCc.exe
  2⤵
  PID:3496
- C:\Windows\System\AqZWPdR.exe
  C:\Windows\System\AqZWPdR.exe
  2⤵
  PID:3520
- C:\Windows\System\MxmXeih.exe
  C:\Windows\System\MxmXeih.exe
  2⤵
  PID:3540
- C:\Windows\System\WginJDO.exe
  C:\Windows\System\WginJDO.exe
  2⤵
  PID:3556
- C:\Windows\System\xxBTGzg.exe
  C:\Windows\System\xxBTGzg.exe
  2⤵
  PID:3572
- C:\Windows\System\VHuvkoS.exe
  C:\Windows\System\VHuvkoS.exe
  2⤵
  PID:3588
- C:\Windows\System\wfkUKEQ.exe
  C:\Windows\System\wfkUKEQ.exe
  2⤵
  PID:3604
- C:\Windows\System\utBIISN.exe
  C:\Windows\System\utBIISN.exe
  2⤵
  PID:3620
- C:\Windows\System\PgZLyjM.exe
  C:\Windows\System\PgZLyjM.exe
  2⤵
  PID:3640
- C:\Windows\System\dUXnWHK.exe
  C:\Windows\System\dUXnWHK.exe
  2⤵
  PID:3656
- C:\Windows\System\NiCmOLz.exe
  C:\Windows\System\NiCmOLz.exe
  2⤵
  PID:3672
- C:\Windows\System\yHZYZww.exe
  C:\Windows\System\yHZYZww.exe
  2⤵
  PID:3688
- C:\Windows\System\UykXgrF.exe
  C:\Windows\System\UykXgrF.exe
  2⤵
  PID:3704
- C:\Windows\System\TMYXGrY.exe
  C:\Windows\System\TMYXGrY.exe
  2⤵
  PID:3720
- C:\Windows\System\HBLWmQH.exe
  C:\Windows\System\HBLWmQH.exe
  2⤵
  PID:3740
- C:\Windows\System\Crpppwb.exe
  C:\Windows\System\Crpppwb.exe
  2⤵
  PID:3756
- C:\Windows\System\ykKqgrD.exe
  C:\Windows\System\ykKqgrD.exe
  2⤵
  PID:3772
- C:\Windows\System\foPAGyk.exe
  C:\Windows\System\foPAGyk.exe
  2⤵
  PID:3792
- C:\Windows\System\rVvWAoJ.exe
  C:\Windows\System\rVvWAoJ.exe
  2⤵
  PID:3812
- C:\Windows\System\wjKACee.exe
  C:\Windows\System\wjKACee.exe
  2⤵
  PID:3828
- C:\Windows\System\AYYCaxF.exe
  C:\Windows\System\AYYCaxF.exe
  2⤵
  PID:4024
- C:\Windows\System\SalwjYc.exe
  C:\Windows\System\SalwjYc.exe
  2⤵
  PID:4084
- C:\Windows\System\AREBnRh.exe
  C:\Windows\System\AREBnRh.exe
  2⤵
  PID:1716
- C:\Windows\System\OkFEohu.exe
  C:\Windows\System\OkFEohu.exe
  2⤵
  PID:3088
- C:\Windows\System\NIYnPWC.exe
  C:\Windows\System\NIYnPWC.exe
  2⤵
  PID:3188
- C:\Windows\System\BARouht.exe
  C:\Windows\System\BARouht.exe
  2⤵
  PID:3260
- C:\Windows\System\eREbxrI.exe
  C:\Windows\System\eREbxrI.exe
  2⤵
  PID:3296
- C:\Windows\System\JwlEfqK.exe
  C:\Windows\System\JwlEfqK.exe
  2⤵
  PID:2636
- C:\Windows\System\OUBLryj.exe
  C:\Windows\System\OUBLryj.exe
  2⤵
  PID:3376
- C:\Windows\System\bEHnpUF.exe
  C:\Windows\System\bEHnpUF.exe
  2⤵
  PID:3440
- C:\Windows\System\YTUQmlk.exe
  C:\Windows\System\YTUQmlk.exe
  2⤵
  PID:3512
- C:\Windows\System\GqpRcMx.exe
  C:\Windows\System\GqpRcMx.exe
  2⤵
  PID:3552
- C:\Windows\System\BjZXKZU.exe
  C:\Windows\System\BjZXKZU.exe
  2⤵
  PID:3616
- C:\Windows\System\YigERMN.exe
  C:\Windows\System\YigERMN.exe
  2⤵
  PID:3712
- C:\Windows\System\xuGclYF.exe
  C:\Windows\System\xuGclYF.exe
  2⤵
  PID:3748
- C:\Windows\System\FklfNdS.exe
  C:\Windows\System\FklfNdS.exe
  2⤵
  PID:2464
- C:\Windows\System\WiPQKWm.exe
  C:\Windows\System\WiPQKWm.exe
  2⤵
  PID:2792
- C:\Windows\System\fIevuMn.exe
  C:\Windows\System\fIevuMn.exe
  2⤵
  PID:2936
- C:\Windows\System\fcpEelP.exe
  C:\Windows\System\fcpEelP.exe
  2⤵
  PID:940
- C:\Windows\System\pLSaHBT.exe
  C:\Windows\System\pLSaHBT.exe
  2⤵
  PID:3064
- C:\Windows\System\arCGvEN.exe
  C:\Windows\System\arCGvEN.exe
  2⤵
  PID:2044
- C:\Windows\System\zLlszGT.exe
  C:\Windows\System\zLlszGT.exe
  2⤵
  PID:2692
- C:\Windows\System\ddmcXvD.exe
  C:\Windows\System\ddmcXvD.exe
  2⤵
  PID:1688
- C:\Windows\System\QZjlIAV.exe
  C:\Windows\System\QZjlIAV.exe
  2⤵
  PID:3628
- C:\Windows\System\aqKuSfp.exe
  C:\Windows\System\aqKuSfp.exe
  2⤵
  PID:1812
- C:\Windows\System\fCZhyHh.exe
  C:\Windows\System\fCZhyHh.exe
  2⤵
  PID:1472
- C:\Windows\System\nHwjhyt.exe
  C:\Windows\System\nHwjhyt.exe
  2⤵
  PID:2516
- C:\Windows\System\XtbOcGX.exe
  C:\Windows\System\XtbOcGX.exe
  2⤵
  PID:3140
- C:\Windows\System\gkLRkfI.exe
  C:\Windows\System\gkLRkfI.exe
  2⤵
  PID:3172
- C:\Windows\System\lgzdHMu.exe
  C:\Windows\System\lgzdHMu.exe
  2⤵
  PID:3276
- C:\Windows\System\bgxYERc.exe
  C:\Windows\System\bgxYERc.exe
  2⤵
  PID:3316
- C:\Windows\System\dPzihkQ.exe
  C:\Windows\System\dPzihkQ.exe
  2⤵
  PID:3392
- C:\Windows\System\HffdfBd.exe
  C:\Windows\System\HffdfBd.exe
  2⤵
  PID:3456
- C:\Windows\System\jBPevzn.exe
  C:\Windows\System\jBPevzn.exe
  2⤵
  PID:3528
- C:\Windows\System\AjikKkL.exe
  C:\Windows\System\AjikKkL.exe
  2⤵
  PID:3568
- C:\Windows\System\vqumKmg.exe
  C:\Windows\System\vqumKmg.exe
  2⤵
  PID:3696
- C:\Windows\System\DDjhivZ.exe
  C:\Windows\System\DDjhivZ.exe
  2⤵
  PID:3736
- C:\Windows\System\GXbcgem.exe
  C:\Windows\System\GXbcgem.exe
  2⤵
  PID:3808
- C:\Windows\System\JZeScoP.exe
  C:\Windows\System\JZeScoP.exe
  2⤵
  PID:3856
- C:\Windows\System\JEvxGVC.exe
  C:\Windows\System\JEvxGVC.exe
  2⤵
  PID:3872
- C:\Windows\System\KdxhxgO.exe
  C:\Windows\System\KdxhxgO.exe
  2⤵
  PID:3888
- C:\Windows\System\ZOJgGUA.exe
  C:\Windows\System\ZOJgGUA.exe
  2⤵
  PID:3920
- C:\Windows\System\HqZFTZn.exe
  C:\Windows\System\HqZFTZn.exe
  2⤵
  PID:3940
- C:\Windows\System\ncjzaUk.exe
  C:\Windows\System\ncjzaUk.exe
  2⤵
  PID:3956
- C:\Windows\System\AOpVQGt.exe
  C:\Windows\System\AOpVQGt.exe
  2⤵
  PID:3972
- C:\Windows\System\iPBnpjh.exe
  C:\Windows\System\iPBnpjh.exe
  2⤵
  PID:3988
- C:\Windows\System\FjjtkFD.exe
  C:\Windows\System\FjjtkFD.exe
  2⤵
  PID:2600
- C:\Windows\System\hYWmlco.exe
  C:\Windows\System\hYWmlco.exe
  2⤵
  PID:4008
- C:\Windows\System\WsnwpFD.exe
  C:\Windows\System\WsnwpFD.exe
  2⤵
  PID:4072
- C:\Windows\System\OktJqQP.exe
  C:\Windows\System\OktJqQP.exe
  2⤵
  PID:2068
- C:\Windows\System\pZROKEk.exe
  C:\Windows\System\pZROKEk.exe
  2⤵
  PID:3156
- C:\Windows\System\IbYOGQW.exe
  C:\Windows\System\IbYOGQW.exe
  2⤵
  PID:3160
- C:\Windows\System\RwWLeRw.exe
  C:\Windows\System\RwWLeRw.exe
  2⤵
  PID:3508
- C:\Windows\System\WZZJlfq.exe
  C:\Windows\System\WZZJlfq.exe
  2⤵
  PID:3784
- C:\Windows\System\ZiLBdKF.exe
  C:\Windows\System\ZiLBdKF.exe
  2⤵
  PID:2580
- C:\Windows\System\LsFAofG.exe
  C:\Windows\System\LsFAofG.exe
  2⤵
  PID:1964
- C:\Windows\System\avnfPBd.exe
  C:\Windows\System\avnfPBd.exe
  2⤵
  PID:2760
- C:\Windows\System\XWzhWCV.exe
  C:\Windows\System\XWzhWCV.exe
  2⤵
  PID:1680
- C:\Windows\System\ocShgai.exe
  C:\Windows\System\ocShgai.exe
  2⤵
  PID:3104
- C:\Windows\System\QtsFlYB.exe
  C:\Windows\System\QtsFlYB.exe
  2⤵
  PID:3752
- C:\Windows\System\CuNOMoi.exe
  C:\Windows\System\CuNOMoi.exe
  2⤵
  PID:1544
- C:\Windows\System\eXxJsbd.exe
  C:\Windows\System\eXxJsbd.exe
  2⤵
  PID:3360
- C:\Windows\System\lxCWzEm.exe
  C:\Windows\System\lxCWzEm.exe
  2⤵
  PID:3488
- C:\Windows\System\JEERLiz.exe
  C:\Windows\System\JEERLiz.exe
  2⤵
  PID:852
- C:\Windows\System\SrcAMvP.exe
  C:\Windows\System\SrcAMvP.exe
  2⤵
  PID:3864
- C:\Windows\System\cVGNTlA.exe
  C:\Windows\System\cVGNTlA.exe
  2⤵
  PID:3852
- C:\Windows\System\RmWLIPk.exe
  C:\Windows\System\RmWLIPk.exe
  2⤵
  PID:3292
- C:\Windows\System\JgSdqkW.exe
  C:\Windows\System\JgSdqkW.exe
  2⤵
  PID:3900
- C:\Windows\System\YmSQbXA.exe
  C:\Windows\System\YmSQbXA.exe
  2⤵
  PID:3908
- C:\Windows\System\lkcJIrv.exe
  C:\Windows\System\lkcJIrv.exe
  2⤵
  PID:4036
- C:\Windows\System\fdItyjF.exe
  C:\Windows\System\fdItyjF.exe
  2⤵
  PID:3564
- C:\Windows\System\pGMtBRf.exe
  C:\Windows\System\pGMtBRf.exe
  2⤵
  PID:3980
- C:\Windows\System\tpBKPyN.exe
  C:\Windows\System\tpBKPyN.exe
  2⤵
  PID:384
- C:\Windows\System\DbXytSj.exe
  C:\Windows\System\DbXytSj.exe
  2⤵
  PID:3732
- C:\Windows\System\JeRMqaq.exe
  C:\Windows\System\JeRMqaq.exe
  2⤵
  PID:3884
- C:\Windows\System\uLQlaCD.exe
  C:\Windows\System\uLQlaCD.exe
  2⤵
  PID:3680
- C:\Windows\System\kdsbRFM.exe
  C:\Windows\System\kdsbRFM.exe
  2⤵
  PID:1540
- C:\Windows\System\pMVnyUn.exe
  C:\Windows\System\pMVnyUn.exe
  2⤵
  PID:2628
- C:\Windows\System\BKBAzay.exe
  C:\Windows\System\BKBAzay.exe
  2⤵
  PID:3612
- C:\Windows\System\VksqBSv.exe
  C:\Windows\System\VksqBSv.exe
  2⤵
  PID:2504
- C:\Windows\System\HDIpHNV.exe
  C:\Windows\System\HDIpHNV.exe
  2⤵
  PID:2016
- C:\Windows\System\bfzTtfu.exe
  C:\Windows\System\bfzTtfu.exe
  2⤵
  PID:2480
- C:\Windows\System\mrSMVwW.exe
  C:\Windows\System\mrSMVwW.exe
  2⤵
  PID:3668
- C:\Windows\System\OgfQVTz.exe
  C:\Windows\System\OgfQVTz.exe
  2⤵
  PID:3312
- C:\Windows\System\KIDKtHK.exe
  C:\Windows\System\KIDKtHK.exe
  2⤵
  PID:3232
- C:\Windows\System\wnqePOf.exe
  C:\Windows\System\wnqePOf.exe
  2⤵
  PID:4100
- C:\Windows\System\iWCXpjO.exe
  C:\Windows\System\iWCXpjO.exe
  2⤵
  PID:4116
- C:\Windows\System\UTkqWNp.exe
  C:\Windows\System\UTkqWNp.exe
  2⤵
  PID:4132
- C:\Windows\System\TAGMpPP.exe
  C:\Windows\System\TAGMpPP.exe
  2⤵
  PID:4152
- C:\Windows\System\xMcjgaz.exe
  C:\Windows\System\xMcjgaz.exe
  2⤵
  PID:4168
- C:\Windows\System\oIOWAYk.exe
  C:\Windows\System\oIOWAYk.exe
  2⤵
  PID:4188
- C:\Windows\System\WvbzHba.exe
  C:\Windows\System\WvbzHba.exe
  2⤵
  PID:4204
- C:\Windows\System\UFcXAAi.exe
  C:\Windows\System\UFcXAAi.exe
  2⤵
  PID:4220
- C:\Windows\System\uhaXliN.exe
  C:\Windows\System\uhaXliN.exe
  2⤵
  PID:4236
- C:\Windows\System\EKubssP.exe
  C:\Windows\System\EKubssP.exe
  2⤵
  PID:4252
- C:\Windows\System\OjMBLYN.exe
  C:\Windows\System\OjMBLYN.exe
  2⤵
  PID:4268
- C:\Windows\System\BCnHdyD.exe
  C:\Windows\System\BCnHdyD.exe
  2⤵
  PID:4284
- C:\Windows\System\wqCpDat.exe
  C:\Windows\System\wqCpDat.exe
  2⤵
  PID:4304
- C:\Windows\System\vCJXCFr.exe
  C:\Windows\System\vCJXCFr.exe
  2⤵
  PID:4320
- C:\Windows\System\YBdCJYT.exe
  C:\Windows\System\YBdCJYT.exe
  2⤵
  PID:4336
- C:\Windows\System\Ttkfwqv.exe
  C:\Windows\System\Ttkfwqv.exe
  2⤵
  PID:4352
- C:\Windows\System\OCUovkj.exe
  C:\Windows\System\OCUovkj.exe
  2⤵
  PID:4368
- C:\Windows\System\YdFMQtB.exe
  C:\Windows\System\YdFMQtB.exe
  2⤵
  PID:4384
- C:\Windows\System\THzATmB.exe
  C:\Windows\System\THzATmB.exe
  2⤵
  PID:4400
- C:\Windows\System\fPqyQCS.exe
  C:\Windows\System\fPqyQCS.exe
  2⤵
  PID:4416
- C:\Windows\System\rNZwwrn.exe
  C:\Windows\System\rNZwwrn.exe
  2⤵
  PID:4432
- C:\Windows\System\WMlkojp.exe
  C:\Windows\System\WMlkojp.exe
  2⤵
  PID:4564
- C:\Windows\System\UdVvOWi.exe
  C:\Windows\System\UdVvOWi.exe
  2⤵
  PID:4580
- C:\Windows\System\OrlQPFP.exe
  C:\Windows\System\OrlQPFP.exe
  2⤵
  PID:4604
- C:\Windows\System\lhYctdE.exe
  C:\Windows\System\lhYctdE.exe
  2⤵
  PID:4624
- C:\Windows\System\kpTwLqi.exe
  C:\Windows\System\kpTwLqi.exe
  2⤵
  PID:4640
- C:\Windows\System\erMxHOh.exe
  C:\Windows\System\erMxHOh.exe
  2⤵
  PID:4656
- C:\Windows\System\LFYcfAH.exe
  C:\Windows\System\LFYcfAH.exe
  2⤵
  PID:4672
- C:\Windows\System\iRoFBbd.exe
  C:\Windows\System\iRoFBbd.exe
  2⤵
  PID:4688
- C:\Windows\System\qpUsUVR.exe
  C:\Windows\System\qpUsUVR.exe
  2⤵
  PID:4704
- C:\Windows\System\gJfWQFR.exe
  C:\Windows\System\gJfWQFR.exe
  2⤵
  PID:4720
- C:\Windows\System\iFVnChS.exe
  C:\Windows\System\iFVnChS.exe
  2⤵
  PID:4736
- C:\Windows\System\PFweKYO.exe
  C:\Windows\System\PFweKYO.exe
  2⤵
  PID:4752
- C:\Windows\System\gDPMBDh.exe
  C:\Windows\System\gDPMBDh.exe
  2⤵
  PID:4768
- C:\Windows\System\RnCOqeL.exe
  C:\Windows\System\RnCOqeL.exe
  2⤵
  PID:4784
- C:\Windows\System\tOzBVXB.exe
  C:\Windows\System\tOzBVXB.exe
  2⤵
  PID:4800
- C:\Windows\System\vUusrfo.exe
  C:\Windows\System\vUusrfo.exe
  2⤵
  PID:4816
- C:\Windows\System\RsfKFlF.exe
  C:\Windows\System\RsfKFlF.exe
  2⤵
  PID:4832
- C:\Windows\System\IrbnGeF.exe
  C:\Windows\System\IrbnGeF.exe
  2⤵
  PID:4848
- C:\Windows\System\ylEGVfb.exe
  C:\Windows\System\ylEGVfb.exe
  2⤵
  PID:4864
- C:\Windows\System\NllxJXq.exe
  C:\Windows\System\NllxJXq.exe
  2⤵
  PID:4880
- C:\Windows\System\RFwzTpT.exe
  C:\Windows\System\RFwzTpT.exe
  2⤵
  PID:4900
- C:\Windows\System\ODUoSPD.exe
  C:\Windows\System\ODUoSPD.exe
  2⤵
  PID:5028
- C:\Windows\System\skLhDsZ.exe
  C:\Windows\System\skLhDsZ.exe
  2⤵
  PID:5080
- C:\Windows\System\EgKrvwM.exe
  C:\Windows\System\EgKrvwM.exe
  2⤵
  PID:5100
- C:\Windows\System\jGqQrKa.exe
  C:\Windows\System\jGqQrKa.exe
  2⤵
  PID:5116
- C:\Windows\System\CYOzyxv.exe
  C:\Windows\System\CYOzyxv.exe
  2⤵
  PID:3424
- C:\Windows\System\cHaOrbP.exe
  C:\Windows\System\cHaOrbP.exe
  2⤵
  PID:3996
- C:\Windows\System\GqjdJEk.exe
  C:\Windows\System\GqjdJEk.exe
  2⤵
  PID:4020
- C:\Windows\System\IJvEUiw.exe
  C:\Windows\System\IJvEUiw.exe
  2⤵
  PID:3408
- C:\Windows\System\YGBGRkQ.exe
  C:\Windows\System\YGBGRkQ.exe
  2⤵
  PID:1844
- C:\Windows\System\gIvlxPv.exe
  C:\Windows\System\gIvlxPv.exe
  2⤵
  PID:3504
- C:\Windows\System\xijuOGM.exe
  C:\Windows\System\xijuOGM.exe
  2⤵
  PID:3584
- C:\Windows\System\YzEfEsY.exe
  C:\Windows\System\YzEfEsY.exe
  2⤵
  PID:560
- C:\Windows\System\cQmaVRO.exe
  C:\Windows\System\cQmaVRO.exe
  2⤵
  PID:2476
- C:\Windows\System\OAWoATq.exe
  C:\Windows\System\OAWoATq.exe
  2⤵
  PID:4164
- C:\Windows\System\uvYFCRH.exe
  C:\Windows\System\uvYFCRH.exe
  2⤵
  PID:944
- C:\Windows\System\AKzpSew.exe
  C:\Windows\System\AKzpSew.exe
  2⤵
  PID:4292
- C:\Windows\System\epdMpws.exe
  C:\Windows\System\epdMpws.exe
  2⤵
  PID:4360
- C:\Windows\System\JTvJOTY.exe
  C:\Windows\System\JTvJOTY.exe
  2⤵
  PID:4396
- C:\Windows\System\OOXqMoQ.exe
  C:\Windows\System\OOXqMoQ.exe
  2⤵
  PID:2028
- C:\Windows\System\mwFDLTM.exe
  C:\Windows\System\mwFDLTM.exe
  2⤵
  PID:1912
- C:\Windows\System\qkMiLXB.exe
  C:\Windows\System\qkMiLXB.exe
  2⤵
  PID:3388
- C:\Windows\System\oJqPcUZ.exe
  C:\Windows\System\oJqPcUZ.exe
  2⤵
  PID:1208
- C:\Windows\System\WGsHhTz.exe
  C:\Windows\System\WGsHhTz.exe
  2⤵
  PID:3536
- C:\Windows\System\aainrRu.exe
  C:\Windows\System\aainrRu.exe
  2⤵
  PID:1636
- C:\Windows\System\QzrPrZs.exe
  C:\Windows\System\QzrPrZs.exe
  2⤵
  PID:4448
- C:\Windows\System\NkbArDR.exe
  C:\Windows\System\NkbArDR.exe
  2⤵
  PID:4464
- C:\Windows\System\RTWDrgr.exe
  C:\Windows\System\RTWDrgr.exe
  2⤵
  PID:4480
- C:\Windows\System\uQSnuHj.exe
  C:\Windows\System\uQSnuHj.exe
  2⤵
  PID:4496
- C:\Windows\System\ECSJmCL.exe
  C:\Windows\System\ECSJmCL.exe
  2⤵
  PID:4528
- C:\Windows\System\TKQyVua.exe
  C:\Windows\System\TKQyVua.exe
  2⤵
  PID:4412
- C:\Windows\System\ccXNFIs.exe
  C:\Windows\System\ccXNFIs.exe
  2⤵
  PID:4348
- C:\Windows\System\bAKiooD.exe
  C:\Windows\System\bAKiooD.exe
  2⤵
  PID:4548
- C:\Windows\System\kZzEAls.exe
  C:\Windows\System\kZzEAls.exe
  2⤵
  PID:948
- C:\Windows\System\PugDKUZ.exe
  C:\Windows\System\PugDKUZ.exe
  2⤵
  PID:1856
- C:\Windows\System\kjgxDEl.exe
  C:\Windows\System\kjgxDEl.exe
  2⤵
  PID:4572
- C:\Windows\System\TbmKRuf.exe
  C:\Windows\System\TbmKRuf.exe
  2⤵
  PID:4620
- C:\Windows\System\RHHbFQv.exe
  C:\Windows\System\RHHbFQv.exe
  2⤵
  PID:4600
- C:\Windows\System\FypVCvI.exe
  C:\Windows\System\FypVCvI.exe
  2⤵
  PID:4684
- C:\Windows\System\rjOkRhg.exe
  C:\Windows\System\rjOkRhg.exe
  2⤵
  PID:4908
- C:\Windows\System\adcwkxY.exe
  C:\Windows\System\adcwkxY.exe
  2⤵
  PID:4716
- C:\Windows\System\RIZSuLw.exe
  C:\Windows\System\RIZSuLw.exe
  2⤵
  PID:4796
- C:\Windows\System\QbpmagJ.exe
  C:\Windows\System\QbpmagJ.exe
  2⤵
  PID:4776
- C:\Windows\System\DEZBUwk.exe
  C:\Windows\System\DEZBUwk.exe
  2⤵
  PID:4808
- C:\Windows\System\EkrTjBL.exe
  C:\Windows\System\EkrTjBL.exe
  2⤵
  PID:4924
- C:\Windows\System\nbrtnOP.exe
  C:\Windows\System\nbrtnOP.exe
  2⤵
  PID:4896
- C:\Windows\System\rAqXHmM.exe
  C:\Windows\System\rAqXHmM.exe
  2⤵
  PID:4960
- C:\Windows\System\hysTQLi.exe
  C:\Windows\System\hysTQLi.exe
  2⤵
  PID:4984
- C:\Windows\System\XbYXiZj.exe
  C:\Windows\System\XbYXiZj.exe
  2⤵
  PID:2604
- C:\Windows\System\vXbirbS.exe
  C:\Windows\System\vXbirbS.exe
  2⤵
  PID:5004
- C:\Windows\System\xMNXcmS.exe
  C:\Windows\System\xMNXcmS.exe
  2⤵
  PID:5024
- C:\Windows\System\QCqZhnJ.exe
  C:\Windows\System\QCqZhnJ.exe
  2⤵
  PID:5052
- C:\Windows\System\obUIpaZ.exe
  C:\Windows\System\obUIpaZ.exe
  2⤵
  PID:5096
- C:\Windows\System\TshvnIO.exe
  C:\Windows\System\TshvnIO.exe
  2⤵
  PID:5072
- C:\Windows\System\OCtpvYq.exe
  C:\Windows\System\OCtpvYq.exe
  2⤵
  PID:5112
- C:\Windows\System\duFPNMq.exe
  C:\Windows\System\duFPNMq.exe
  2⤵
  PID:1848
- C:\Windows\System\hcntCLK.exe
  C:\Windows\System\hcntCLK.exe
  2⤵
  PID:3840
- C:\Windows\System\HLuAWoU.exe
  C:\Windows\System\HLuAWoU.exe
  2⤵
  PID:3084
- C:\Windows\System\tDlHqSo.exe
  C:\Windows\System\tDlHqSo.exe
  2⤵
  PID:2748
- C:\Windows\System\cvAcVyJ.exe
  C:\Windows\System\cvAcVyJ.exe
  2⤵
  PID:2520
- C:\Windows\System\nLWUILM.exe
  C:\Windows\System\nLWUILM.exe
  2⤵
  PID:4316
- C:\Windows\System\vGGePyX.exe
  C:\Windows\System\vGGePyX.exe
  2⤵
  PID:4228
- C:\Windows\System\IweYOsm.exe
  C:\Windows\System\IweYOsm.exe
  2⤵
  PID:884
- C:\Windows\System\VlCklvC.exe
  C:\Windows\System\VlCklvC.exe
  2⤵
  PID:1040
- C:\Windows\System\sFndbRH.exe
  C:\Windows\System\sFndbRH.exe
  2⤵
  PID:1980
- C:\Windows\System\MpmWNXy.exe
  C:\Windows\System\MpmWNXy.exe
  2⤵
  PID:4128
- C:\Windows\System\bYPxSGf.exe
  C:\Windows\System\bYPxSGf.exe
  2⤵
  PID:2660
- C:\Windows\System\DXPhwdb.exe
  C:\Windows\System\DXPhwdb.exe
  2⤵
  PID:2056
- C:\Windows\System\NckYZxA.exe
  C:\Windows\System\NckYZxA.exe
  2⤵
  PID:3984
- C:\Windows\System\VpzGKxC.exe
  C:\Windows\System\VpzGKxC.exe
  2⤵
  PID:4144
- C:\Windows\System\kyXxcpQ.exe
  C:\Windows\System\kyXxcpQ.exe
  2⤵
  PID:4212
- C:\Windows\System\rmFBoKN.exe
  C:\Windows\System\rmFBoKN.exe
  2⤵
  PID:4280
- C:\Windows\System\CBWwvCl.exe
  C:\Windows\System\CBWwvCl.exe
  2⤵
  PID:4312
- C:\Windows\System\NJIBMrt.exe
  C:\Windows\System\NJIBMrt.exe
  2⤵
  PID:4456
- C:\Windows\System\gJLPTLA.exe
  C:\Windows\System\gJLPTLA.exe
  2⤵
  PID:4488
- C:\Windows\System\rCrXARd.exe
  C:\Windows\System\rCrXARd.exe
  2⤵
  PID:4508
- C:\Windows\System\DPNgFBC.exe
  C:\Windows\System\DPNgFBC.exe
  2⤵
  PID:4444
- C:\Windows\System\JtcAlmH.exe
  C:\Windows\System\JtcAlmH.exe
  2⤵
  PID:4732
- C:\Windows\System\XjMiAap.exe
  C:\Windows\System\XjMiAap.exe
  2⤵
  PID:600
- C:\Windows\System\otpCgJY.exe
  C:\Windows\System\otpCgJY.exe
  2⤵
  PID:4912
- C:\Windows\System\lSZzGcs.exe
  C:\Windows\System\lSZzGcs.exe
  2⤵
  PID:4948
- C:\Windows\System\TtDxntJ.exe
  C:\Windows\System\TtDxntJ.exe
  2⤵
  PID:4976
- C:\Windows\System\nBPgwmP.exe
  C:\Windows\System\nBPgwmP.exe
  2⤵
  PID:5064
- C:\Windows\System\ndvFUQC.exe
  C:\Windows\System\ndvFUQC.exe
  2⤵
  PID:5040
- C:\Windows\System\KgqNnKi.exe
  C:\Windows\System\KgqNnKi.exe
  2⤵
  PID:1188
- C:\Windows\System\sIUxapY.exe
  C:\Windows\System\sIUxapY.exe
  2⤵
  PID:1196
- C:\Windows\System\ZeWSrbC.exe
  C:\Windows\System\ZeWSrbC.exe
  2⤵
  PID:4392
- C:\Windows\System\YOwLGAb.exe
  C:\Windows\System\YOwLGAb.exe
  2⤵
  PID:3904
- C:\Windows\System\JzyxmRM.exe
  C:\Windows\System\JzyxmRM.exe
  2⤵
  PID:4184
- C:\Windows\System\gdziqen.exe
  C:\Windows\System\gdziqen.exe
  2⤵
  PID:4160
- C:\Windows\System\bvGYbLr.exe
  C:\Windows\System\bvGYbLr.exe
  2⤵
  PID:2320
- C:\Windows\System\cphvrYI.exe
  C:\Windows\System\cphvrYI.exe
  2⤵
  PID:4476
- C:\Windows\System\wingHui.exe
  C:\Windows\System\wingHui.exe
  2⤵
  PID:2348
- C:\Windows\System\AEtddnR.exe
  C:\Windows\System\AEtddnR.exe
  2⤵
  PID:1800
- C:\Windows\System\UOcDLef.exe
  C:\Windows\System\UOcDLef.exe
  2⤵
  PID:4636
- C:\Windows\System\WFZKdDy.exe
  C:\Windows\System\WFZKdDy.exe
  2⤵
  PID:4612
- C:\Windows\System\CGWroHa.exe
  C:\Windows\System\CGWroHa.exe
  2⤵
  PID:4680
- C:\Windows\System\OOIyoes.exe
  C:\Windows\System\OOIyoes.exe
  2⤵
  PID:4760
- C:\Windows\System\LhrfauP.exe
  C:\Windows\System\LhrfauP.exe
  2⤵
  PID:4856
- C:\Windows\System\SgizYMG.exe
  C:\Windows\System\SgizYMG.exe
  2⤵
  PID:4892
- C:\Windows\System\QNAUSHD.exe
  C:\Windows\System\QNAUSHD.exe
  2⤵
  PID:300
- C:\Windows\System\UNxslfp.exe
  C:\Windows\System\UNxslfp.exe
  2⤵
  PID:4016
- C:\Windows\System\eJVBKBS.exe
  C:\Windows\System\eJVBKBS.exe
  2⤵
  PID:4196
- C:\Windows\System\luaDezp.exe
  C:\Windows\System\luaDezp.exe
  2⤵
  PID:5016
- C:\Windows\System\KJDcNjF.exe
  C:\Windows\System\KJDcNjF.exe
  2⤵
  PID:3100
- C:\Windows\System\wkIvhcT.exe
  C:\Windows\System\wkIvhcT.exe
  2⤵
  PID:4052
- C:\Windows\System\zhNKbvQ.exe
  C:\Windows\System\zhNKbvQ.exe
  2⤵
  PID:3344
- C:\Windows\System\SooaYAv.exe
  C:\Windows\System\SooaYAv.exe
  2⤵
  PID:4652
- C:\Windows\System\cCLQCWQ.exe
  C:\Windows\System\cCLQCWQ.exe
  2⤵
  PID:4916
- C:\Windows\System\VMVfpdJ.exe
  C:\Windows\System\VMVfpdJ.exe
  2⤵
  PID:4728
- C:\Windows\System\vdiEEBK.exe
  C:\Windows\System\vdiEEBK.exe
  2⤵
  PID:2804
- C:\Windows\System\FAliGqE.exe
  C:\Windows\System\FAliGqE.exe
  2⤵
  PID:4980
- C:\Windows\System\XuwouOm.exe
  C:\Windows\System\XuwouOm.exe
  2⤵
  PID:4596
- C:\Windows\System\gykXmNm.exe
  C:\Windows\System\gykXmNm.exe
  2⤵
  PID:2560
- C:\Windows\System\fhNWDVQ.exe
  C:\Windows\System\fhNWDVQ.exe
  2⤵
  PID:4300
- C:\Windows\System\ADobNCH.exe
  C:\Windows\System\ADobNCH.exe
  2⤵
  PID:4592
- C:\Windows\System\bjtkhzM.exe
  C:\Windows\System\bjtkhzM.exe
  2⤵
  PID:2568
- C:\Windows\System\tSLpGhw.exe
  C:\Windows\System\tSLpGhw.exe
  2⤵
  PID:5020
- C:\Windows\System\dTkcIIg.exe
  C:\Windows\System\dTkcIIg.exe
  2⤵
  PID:5012
- C:\Windows\System\IuUbAhS.exe
  C:\Windows\System\IuUbAhS.exe
  2⤵
  PID:3044
- C:\Windows\System\BBHzvgE.exe
  C:\Windows\System\BBHzvgE.exe
  2⤵
  PID:2884
- C:\Windows\System\KCetJHk.exe
  C:\Windows\System\KCetJHk.exe
  2⤵
  PID:4440
- C:\Windows\System\tftkxME.exe
  C:\Windows\System\tftkxME.exe
  2⤵
  PID:4876
- C:\Windows\System\dRvtrjf.exe
  C:\Windows\System\dRvtrjf.exe
  2⤵
  PID:4824
- C:\Windows\System\SAOgKKW.exe
  C:\Windows\System\SAOgKKW.exe
  2⤵
  PID:4860
- C:\Windows\System\pgJCRMm.exe
  C:\Windows\System\pgJCRMm.exe
  2⤵
  PID:4700
- C:\Windows\System\sqcPooK.exe
  C:\Windows\System\sqcPooK.exe
  2⤵
  PID:4112
- C:\Windows\System\KzdPIke.exe
  C:\Windows\System\KzdPIke.exe
  2⤵
  PID:3028
- C:\Windows\System\BVcsQjc.exe
  C:\Windows\System\BVcsQjc.exe
  2⤵
  PID:2556
- C:\Windows\System\fQtgRgR.exe
  C:\Windows\System\fQtgRgR.exe
  2⤵
  PID:1588
- C:\Windows\System\jhlgWXI.exe
  C:\Windows\System\jhlgWXI.exe
  2⤵
  PID:2820
- C:\Windows\System\QOqVtwH.exe
  C:\Windows\System\QOqVtwH.exe
  2⤵
  PID:5136
- C:\Windows\System\UvHwJYt.exe
  C:\Windows\System\UvHwJYt.exe
  2⤵
  PID:5152
- C:\Windows\System\YpaCmOT.exe
  C:\Windows\System\YpaCmOT.exe
  2⤵
  PID:5168
- C:\Windows\System\icXNaxH.exe
  C:\Windows\System\icXNaxH.exe
  2⤵
  PID:5184
- C:\Windows\System\NcMzCoJ.exe
  C:\Windows\System\NcMzCoJ.exe
  2⤵
  PID:5200
- C:\Windows\System\wdYNmxv.exe
  C:\Windows\System\wdYNmxv.exe
  2⤵
  PID:5216
- C:\Windows\System\WVMkFiS.exe
  C:\Windows\System\WVMkFiS.exe
  2⤵
  PID:5232
- C:\Windows\System\YkMzPTV.exe
  C:\Windows\System\YkMzPTV.exe
  2⤵
  PID:5248
- C:\Windows\System\LpqWuix.exe
  C:\Windows\System\LpqWuix.exe
  2⤵
  PID:5264
- C:\Windows\System\PQUFJTf.exe
  C:\Windows\System\PQUFJTf.exe
  2⤵
  PID:5280
- C:\Windows\System\grBfRWa.exe
  C:\Windows\System\grBfRWa.exe
  2⤵
  PID:5296
- C:\Windows\System\aSGFJoO.exe
  C:\Windows\System\aSGFJoO.exe
  2⤵
  PID:5312
- C:\Windows\System\rYQWhqA.exe
  C:\Windows\System\rYQWhqA.exe
  2⤵
  PID:5328
- C:\Windows\System\RSDbiYG.exe
  C:\Windows\System\RSDbiYG.exe
  2⤵
  PID:5344
- C:\Windows\System\VfuFzXp.exe
  C:\Windows\System\VfuFzXp.exe
  2⤵
  PID:5432
- C:\Windows\System\GhlKNkl.exe
  C:\Windows\System\GhlKNkl.exe
  2⤵
  PID:5468
- C:\Windows\System\DUHtZqH.exe
  C:\Windows\System\DUHtZqH.exe
  2⤵
  PID:5484
- C:\Windows\System\rFdentn.exe
  C:\Windows\System\rFdentn.exe
  2⤵
  PID:5500
- C:\Windows\System\xdDaGBK.exe
  C:\Windows\System\xdDaGBK.exe
  2⤵
  PID:5688
- C:\Windows\System\lPplOJE.exe
  C:\Windows\System\lPplOJE.exe
  2⤵
  PID:5704
- C:\Windows\System\fhxOKoq.exe
  C:\Windows\System\fhxOKoq.exe
  2⤵
  PID:5720
- C:\Windows\System\SEFfZvH.exe
  C:\Windows\System\SEFfZvH.exe
  2⤵
  PID:5736
- C:\Windows\System\BYssBrJ.exe
  C:\Windows\System\BYssBrJ.exe
  2⤵
  PID:5752
- C:\Windows\System\NMLeNcY.exe
  C:\Windows\System\NMLeNcY.exe
  2⤵
  PID:5768
- C:\Windows\System\GTHVgzb.exe
  C:\Windows\System\GTHVgzb.exe
  2⤵
  PID:5788
- C:\Windows\System\jVGbiEM.exe
  C:\Windows\System\jVGbiEM.exe
  2⤵
  PID:5804
- C:\Windows\System\vevtVyR.exe
  C:\Windows\System\vevtVyR.exe
  2⤵
  PID:5820
- C:\Windows\System\wzgoNxf.exe
  C:\Windows\System\wzgoNxf.exe
  2⤵
  PID:5836
- C:\Windows\System\EMRCSxc.exe
  C:\Windows\System\EMRCSxc.exe
  2⤵
  PID:5852
- C:\Windows\System\iwqFqMm.exe
  C:\Windows\System\iwqFqMm.exe
  2⤵
  PID:5868
- C:\Windows\System\FIOvyrL.exe
  C:\Windows\System\FIOvyrL.exe
  2⤵
  PID:5884
- C:\Windows\System\jRgVIbk.exe
  C:\Windows\System\jRgVIbk.exe
  2⤵
  PID:5900
- C:\Windows\System\XFkZGHJ.exe
  C:\Windows\System\XFkZGHJ.exe
  2⤵
  PID:5920
- C:\Windows\System\lOQcyYe.exe
  C:\Windows\System\lOQcyYe.exe
  2⤵
  PID:5936
- C:\Windows\System\ZQrTWrc.exe
  C:\Windows\System\ZQrTWrc.exe
  2⤵
  PID:5952
- C:\Windows\System\ZHdKFWp.exe
  C:\Windows\System\ZHdKFWp.exe
  2⤵
  PID:5972
- C:\Windows\System\DXslVFl.exe
  C:\Windows\System\DXslVFl.exe
  2⤵
  PID:5988
- C:\Windows\System\lZtOiiE.exe
  C:\Windows\System\lZtOiiE.exe
  2⤵
  PID:6032
- C:\Windows\System\PtJPBBF.exe
  C:\Windows\System\PtJPBBF.exe
  2⤵
  PID:6048
- C:\Windows\System\JpfwaVD.exe
  C:\Windows\System\JpfwaVD.exe
  2⤵
  PID:6064
- C:\Windows\System\znvJYqn.exe
  C:\Windows\System\znvJYqn.exe
  2⤵
  PID:6088
- C:\Windows\System\crEVGQl.exe
  C:\Windows\System\crEVGQl.exe
  2⤵
  PID:6132
- C:\Windows\System\axGTzqw.exe
  C:\Windows\System\axGTzqw.exe
  2⤵
  PID:4992
- C:\Windows\System\KOBaNyV.exe
  C:\Windows\System\KOBaNyV.exe
  2⤵
  PID:5176
- C:\Windows\System\KdxTaIG.exe
  C:\Windows\System\KdxTaIG.exe
  2⤵
  PID:5228
- C:\Windows\System\DgHeKui.exe
  C:\Windows\System\DgHeKui.exe
  2⤵
  PID:5240
- C:\Windows\System\ynSbojy.exe
  C:\Windows\System\ynSbojy.exe
  2⤵
  PID:5304
- C:\Windows\System\LgezRUe.exe
  C:\Windows\System\LgezRUe.exe
  2⤵
  PID:4616
- C:\Windows\System\YFpeyXK.exe
  C:\Windows\System\YFpeyXK.exe
  2⤵
  PID:5160
- C:\Windows\System\WVZaUkj.exe
  C:\Windows\System\WVZaUkj.exe
  2⤵
  PID:5260
- C:\Windows\System\lZkQWoY.exe
  C:\Windows\System\lZkQWoY.exe
  2⤵
  PID:5324
- C:\Windows\System\aZbVKSf.exe
  C:\Windows\System\aZbVKSf.exe
  2⤵
  PID:5360
- C:\Windows\System\vQsGUCl.exe
  C:\Windows\System\vQsGUCl.exe
  2⤵
  PID:5408
- C:\Windows\System\jCqmwvk.exe
  C:\Windows\System\jCqmwvk.exe
  2⤵
  PID:5428
- C:\Windows\System\CLVhmDJ.exe
  C:\Windows\System\CLVhmDJ.exe
  2⤵
  PID:5420
- C:\Windows\System\qZnNjzS.exe
  C:\Windows\System\qZnNjzS.exe
  2⤵
  PID:5464
- C:\Windows\System\UYIrivG.exe
  C:\Windows\System\UYIrivG.exe
  2⤵
  PID:5476
- C:\Windows\System\hHDrbFU.exe
  C:\Windows\System\hHDrbFU.exe
  2⤵
  PID:5516
- C:\Windows\System\ZCrnLkT.exe
  C:\Windows\System\ZCrnLkT.exe
  2⤵
  PID:5532
- C:\Windows\System\DddfuhU.exe
  C:\Windows\System\DddfuhU.exe
  2⤵
  PID:5548
- C:\Windows\System\rMCwAwq.exe
  C:\Windows\System\rMCwAwq.exe
  2⤵
  PID:5564
- C:\Windows\System\hqOsJLT.exe
  C:\Windows\System\hqOsJLT.exe
  2⤵
  PID:5580
- C:\Windows\System\CCGYxVs.exe
  C:\Windows\System\CCGYxVs.exe
  2⤵
  PID:5596
- C:\Windows\System\zdIOKxF.exe
  C:\Windows\System\zdIOKxF.exe
  2⤵
  PID:5616
- C:\Windows\System\cGubHRw.exe
  C:\Windows\System\cGubHRw.exe
  2⤵
  PID:5636
- C:\Windows\System\fRbKMbq.exe
  C:\Windows\System\fRbKMbq.exe
  2⤵
  PID:5652
- C:\Windows\System\ViqrYGF.exe
  C:\Windows\System\ViqrYGF.exe
  2⤵
  PID:5664
- C:\Windows\System\farfkns.exe
  C:\Windows\System\farfkns.exe
  2⤵
  PID:5680
- C:\Windows\System\PQsdfFx.exe
  C:\Windows\System\PQsdfFx.exe
  2⤵
  PID:5728
- C:\Windows\System\sBuvuaa.exe
  C:\Windows\System\sBuvuaa.exe
  2⤵
  PID:5776
- C:\Windows\System\sAiyxlO.exe
  C:\Windows\System\sAiyxlO.exe
  2⤵
  PID:5844
- C:\Windows\System\ZtLzxkC.exe
  C:\Windows\System\ZtLzxkC.exe
  2⤵
  PID:5760
- C:\Windows\System\ZRMxdUG.exe
  C:\Windows\System\ZRMxdUG.exe
  2⤵
  PID:5860
- C:\Windows\System\bHkNXlI.exe
  C:\Windows\System\bHkNXlI.exe
  2⤵
  PID:5832
- C:\Windows\System\ikTDtwf.exe
  C:\Windows\System\ikTDtwf.exe
  2⤵
  PID:5780
- C:\Windows\System\AtXurIg.exe
  C:\Windows\System\AtXurIg.exe
  2⤵
  PID:5916
- C:\Windows\System\yeMlxuT.exe
  C:\Windows\System\yeMlxuT.exe
  2⤵
  PID:5964
- C:\Windows\System\YDoPCDR.exe
  C:\Windows\System\YDoPCDR.exe
  2⤵
  PID:6004
- C:\Windows\System\QfIVOll.exe
  C:\Windows\System\QfIVOll.exe
  2⤵
  PID:6020
- C:\Windows\System\JgpTMzb.exe
  C:\Windows\System\JgpTMzb.exe
  2⤵
  PID:6128
- C:\Windows\System\msjmSpV.exe
  C:\Windows\System\msjmSpV.exe
  2⤵
  PID:5212
- C:\Windows\System\dItmcco.exe
  C:\Windows\System\dItmcco.exe
  2⤵
  PID:5256
- C:\Windows\System\laHgjHI.exe
  C:\Windows\System\laHgjHI.exe
  2⤵
  PID:5416
- C:\Windows\System\vobWbEk.exe
  C:\Windows\System\vobWbEk.exe
  2⤵
  PID:5492
- C:\Windows\System\vmYdsBZ.exe
  C:\Windows\System\vmYdsBZ.exe
  2⤵
  PID:6080
- C:\Windows\System\tqESlcA.exe
  C:\Windows\System\tqESlcA.exe
  2⤵
  PID:1712
- C:\Windows\System\vfoqBdf.exe
  C:\Windows\System\vfoqBdf.exe
  2⤵
  PID:5540
- C:\Windows\System\UOZUjFs.exe
  C:\Windows\System\UOZUjFs.exe
  2⤵
  PID:6028
- C:\Windows\System\muIcJbQ.exe
  C:\Windows\System\muIcJbQ.exe
  2⤵
  PID:6116
- C:\Windows\System\fTaOgjS.exe
  C:\Windows\System\fTaOgjS.exe
  2⤵
  PID:6000
- C:\Windows\System\FRJvibj.exe
  C:\Windows\System\FRJvibj.exe
  2⤵
  PID:5960
- C:\Windows\System\qMbTTJL.exe
  C:\Windows\System\qMbTTJL.exe
  2⤵
  PID:5892
- C:\Windows\System\oWPBasx.exe
  C:\Windows\System\oWPBasx.exe
  2⤵
  PID:5748
- C:\Windows\System\SLhEbnP.exe
  C:\Windows\System\SLhEbnP.exe
  2⤵
  PID:5644
- C:\Windows\System\RpiDvUJ.exe
  C:\Windows\System\RpiDvUJ.exe
  2⤵
  PID:5572
- C:\Windows\System\nwGDldl.exe
  C:\Windows\System\nwGDldl.exe
  2⤵
  PID:5524
- C:\Windows\System\GrxFQrZ.exe
  C:\Windows\System\GrxFQrZ.exe
  2⤵
  PID:5588
- C:\Windows\System\rVFAMZR.exe
  C:\Windows\System\rVFAMZR.exe
  2⤵
  PID:6124
- C:\Windows\System\GPgTkqW.exe
  C:\Windows\System\GPgTkqW.exe
  2⤵
  PID:3936
- C:\Windows\System\jNsgiBK.exe
  C:\Windows\System\jNsgiBK.exe
  2⤵
  PID:5480
- C:\Windows\System\tPcyzaN.exe
  C:\Windows\System\tPcyzaN.exe
  2⤵
  PID:5132
- C:\Windows\System\uRnwEZN.exe
  C:\Windows\System\uRnwEZN.exe
  2⤵
  PID:5368
- C:\Windows\System\XJILlWX.exe
  C:\Windows\System\XJILlWX.exe
  2⤵
  PID:6012
- C:\Windows\System\lYfyQoq.exe
  C:\Windows\System\lYfyQoq.exe
  2⤵
  PID:5700
- C:\Windows\System\fvNKRad.exe
  C:\Windows\System\fvNKRad.exe
  2⤵
  PID:5796
- C:\Windows\System\cFPUiWK.exe
  C:\Windows\System\cFPUiWK.exe
  2⤵
  PID:6104
- C:\Windows\System\VPfUKcB.exe
  C:\Windows\System\VPfUKcB.exe
  2⤵
  PID:5648
- C:\Windows\System\frcBnJi.exe
  C:\Windows\System\frcBnJi.exe
  2⤵
  PID:5356
- C:\Windows\System\bwxoVrc.exe
  C:\Windows\System\bwxoVrc.exe
  2⤵
  PID:6072
- C:\Windows\System\BemmvXs.exe
  C:\Windows\System\BemmvXs.exe
  2⤵
  PID:5712
- C:\Windows\System\hSXClJd.exe
  C:\Windows\System\hSXClJd.exe
  2⤵
  PID:5208
- C:\Windows\System\eRAkSjQ.exe
  C:\Windows\System\eRAkSjQ.exe
  2⤵
  PID:5372
- C:\Windows\System\CKXKAqr.exe
  C:\Windows\System\CKXKAqr.exe
  2⤵
  PID:6044
- C:\Windows\System\OOpgBFi.exe
  C:\Windows\System\OOpgBFi.exe
  2⤵
  PID:5592
- C:\Windows\System\wAeAnae.exe
  C:\Windows\System\wAeAnae.exe
  2⤵
  PID:6108
- C:\Windows\System\KeFitvn.exe
  C:\Windows\System\KeFitvn.exe
  2⤵
  PID:5696
- C:\Windows\System\rsSkArn.exe
  C:\Windows\System\rsSkArn.exe
  2⤵
  PID:5452
- C:\Windows\System\kDNmvpy.exe
  C:\Windows\System\kDNmvpy.exe
  2⤵
  PID:5460
- C:\Windows\System\umBYaKU.exe
  C:\Windows\System\umBYaKU.exe
  2⤵
  PID:6160
- C:\Windows\System\opqgABV.exe
  C:\Windows\System\opqgABV.exe
  2⤵
  PID:6176
- C:\Windows\System\xSaWhkk.exe
  C:\Windows\System\xSaWhkk.exe
  2⤵
  PID:6192
- C:\Windows\System\tULBOgF.exe
  C:\Windows\System\tULBOgF.exe
  2⤵
  PID:6208
- C:\Windows\System\ENRheem.exe
  C:\Windows\System\ENRheem.exe
  2⤵
  PID:6224
- C:\Windows\System\lFOkNZw.exe
  C:\Windows\System\lFOkNZw.exe
  2⤵
  PID:6240
- C:\Windows\System\MGQJgpy.exe
  C:\Windows\System\MGQJgpy.exe
  2⤵
  PID:6256
- C:\Windows\System\Eevewhf.exe
  C:\Windows\System\Eevewhf.exe
  2⤵
  PID:6272
- C:\Windows\System\yZNwbKz.exe
  C:\Windows\System\yZNwbKz.exe
  2⤵
  PID:6288
- C:\Windows\System\gjNEIPq.exe
  C:\Windows\System\gjNEIPq.exe
  2⤵
  PID:6304
- C:\Windows\System\LJlpqoY.exe
  C:\Windows\System\LJlpqoY.exe
  2⤵
  PID:6320
- C:\Windows\System\INmUieH.exe
  C:\Windows\System\INmUieH.exe
  2⤵
  PID:6336
- C:\Windows\System\UThaOYh.exe
  C:\Windows\System\UThaOYh.exe
  2⤵
  PID:6352
- C:\Windows\System\qkeRbjS.exe
  C:\Windows\System\qkeRbjS.exe
  2⤵
  PID:6368
- C:\Windows\System\eyjuObg.exe
  C:\Windows\System\eyjuObg.exe
  2⤵
  PID:6384
- C:\Windows\System\ndUKypX.exe
  C:\Windows\System\ndUKypX.exe
  2⤵
  PID:6400
- C:\Windows\System\KcObksF.exe
  C:\Windows\System\KcObksF.exe
  2⤵
  PID:6416
- C:\Windows\System\fZXOHtm.exe
  C:\Windows\System\fZXOHtm.exe
  2⤵
  PID:6436
- C:\Windows\System\rZziFFx.exe
  C:\Windows\System\rZziFFx.exe
  2⤵
  PID:6452
- C:\Windows\System\khSNILk.exe
  C:\Windows\System\khSNILk.exe
  2⤵
  PID:6468
- C:\Windows\System\bCzVyIx.exe
  C:\Windows\System\bCzVyIx.exe
  2⤵
  PID:6484
- C:\Windows\System\owwrpbY.exe
  C:\Windows\System\owwrpbY.exe
  2⤵
  PID:6500
- C:\Windows\System\KmpYLPr.exe
  C:\Windows\System\KmpYLPr.exe
  2⤵
  PID:6516
- C:\Windows\System\tHFFQvZ.exe
  C:\Windows\System\tHFFQvZ.exe
  2⤵
  PID:6532
- C:\Windows\System\TZTvUjk.exe
  C:\Windows\System\TZTvUjk.exe
  2⤵
  PID:6548
- C:\Windows\System\dYnfuec.exe
  C:\Windows\System\dYnfuec.exe
  2⤵
  PID:6564
- C:\Windows\System\fLmRoXF.exe
  C:\Windows\System\fLmRoXF.exe
  2⤵
  PID:6580
- C:\Windows\System\jWfthTl.exe
  C:\Windows\System\jWfthTl.exe
  2⤵
  PID:6596
- C:\Windows\System\THNKccx.exe
  C:\Windows\System\THNKccx.exe
  2⤵
  PID:6612
- C:\Windows\System\guNgEap.exe
  C:\Windows\System\guNgEap.exe
  2⤵
  PID:6628
- C:\Windows\System\LFhiRuo.exe
  C:\Windows\System\LFhiRuo.exe
  2⤵
  PID:6644
- C:\Windows\System\ULPTSOz.exe
  C:\Windows\System\ULPTSOz.exe
  2⤵
  PID:6660
- C:\Windows\System\SLFLJqx.exe
  C:\Windows\System\SLFLJqx.exe
  2⤵
  PID:6676
- C:\Windows\System\AXNhzVU.exe
  C:\Windows\System\AXNhzVU.exe
  2⤵
  PID:6692
- C:\Windows\System\NRhIqla.exe
  C:\Windows\System\NRhIqla.exe
  2⤵
  PID:6708
- C:\Windows\System\TYhEsmD.exe
  C:\Windows\System\TYhEsmD.exe
  2⤵
  PID:6728
- C:\Windows\System\pPLBXyj.exe
  C:\Windows\System\pPLBXyj.exe
  2⤵
  PID:6748
- C:\Windows\System\LWSbGgG.exe
  C:\Windows\System\LWSbGgG.exe
  2⤵
  PID:6764
- C:\Windows\System\wxyXVDf.exe
  C:\Windows\System\wxyXVDf.exe
  2⤵
  PID:6780
- C:\Windows\System\oRosiAy.exe
  C:\Windows\System\oRosiAy.exe
  2⤵
  PID:6796
- C:\Windows\System\VDrnuZg.exe
  C:\Windows\System\VDrnuZg.exe
  2⤵
  PID:6812
- C:\Windows\System\ENWgkjV.exe
  C:\Windows\System\ENWgkjV.exe
  2⤵
  PID:6828
- C:\Windows\System\IUuGrhv.exe
  C:\Windows\System\IUuGrhv.exe
  2⤵
  PID:6844
- C:\Windows\System\dKYAhyg.exe
  C:\Windows\System\dKYAhyg.exe
  2⤵
  PID:6860
- C:\Windows\System\weswerh.exe
  C:\Windows\System\weswerh.exe
  2⤵
  PID:6876
- C:\Windows\System\cIHzfbl.exe
  C:\Windows\System\cIHzfbl.exe
  2⤵
  PID:6892
- C:\Windows\System\pYxjsQs.exe
  C:\Windows\System\pYxjsQs.exe
  2⤵
  PID:6912
- C:\Windows\System\KJdUHNL.exe
  C:\Windows\System\KJdUHNL.exe
  2⤵
  PID:6928
- C:\Windows\System\oagtjbR.exe
  C:\Windows\System\oagtjbR.exe
  2⤵
  PID:6944
- C:\Windows\System\dcoqpXs.exe
  C:\Windows\System\dcoqpXs.exe
  2⤵
  PID:6960
- C:\Windows\System\lbYrzsl.exe
  C:\Windows\System\lbYrzsl.exe
  2⤵
  PID:6980
- C:\Windows\System\qekrcAO.exe
  C:\Windows\System\qekrcAO.exe
  2⤵
  PID:6996
- C:\Windows\System\rNbieFY.exe
  C:\Windows\System\rNbieFY.exe
  2⤵
  PID:7012
- C:\Windows\System\TYbFNGR.exe
  C:\Windows\System\TYbFNGR.exe
  2⤵
  PID:7028
- C:\Windows\System\qtUszid.exe
  C:\Windows\System\qtUszid.exe
  2⤵
  PID:7048
- C:\Windows\System\VVtCVvw.exe
  C:\Windows\System\VVtCVvw.exe
  2⤵
  PID:7088
- C:\Windows\System\BoEAQvV.exe
  C:\Windows\System\BoEAQvV.exe
  2⤵
  PID:5576
- C:\Windows\System\XVVQxWl.exe
  C:\Windows\System\XVVQxWl.exe
  2⤵
  PID:5996
- C:\Windows\System\DEXnKnm.exe
  C:\Windows\System\DEXnKnm.exe
  2⤵
  PID:6200
- C:\Windows\System\DpoFwCt.exe
  C:\Windows\System\DpoFwCt.exe
  2⤵
  PID:6232
- C:\Windows\System\NPmCEpp.exe
  C:\Windows\System\NPmCEpp.exe
  2⤵
  PID:6296
- C:\Windows\System\QPvgwaF.exe
  C:\Windows\System\QPvgwaF.exe
  2⤵
  PID:6156
- C:\Windows\System\TetFmEy.exe
  C:\Windows\System\TetFmEy.exe
  2⤵
  PID:6188
- C:\Windows\System\YZXHuJC.exe
  C:\Windows\System\YZXHuJC.exe
  2⤵
  PID:5608
- C:\Windows\System\zoTuldM.exe
  C:\Windows\System\zoTuldM.exe
  2⤵
  PID:6252
- C:\Windows\System\aCKOXAL.exe
  C:\Windows\System\aCKOXAL.exe
  2⤵
  PID:6360
- C:\Windows\System\ZJnLFDX.exe
  C:\Windows\System\ZJnLFDX.exe
  2⤵
  PID:6364
- C:\Windows\System\RjcPzfK.exe
  C:\Windows\System\RjcPzfK.exe
  2⤵
  PID:6392
- C:\Windows\System\GsiUOPC.exe
  C:\Windows\System\GsiUOPC.exe
  2⤵
  PID:6460
- C:\Windows\System\pAzTcSN.exe
  C:\Windows\System\pAzTcSN.exe
  2⤵
  PID:6496
- C:\Windows\System\nvogGet.exe
  C:\Windows\System\nvogGet.exe
  2⤵
  PID:6560
- C:\Windows\System\BTzMOlF.exe
  C:\Windows\System\BTzMOlF.exe
  2⤵
  PID:6348
- C:\Windows\System\fzNvMTF.exe
  C:\Windows\System\fzNvMTF.exe
  2⤵
  PID:6672
- C:\Windows\System\NfckdBe.exe
  C:\Windows\System\NfckdBe.exe
  2⤵
  PID:6744
- C:\Windows\System\wRIgJOt.exe
  C:\Windows\System\wRIgJOt.exe
  2⤵
  PID:6836
- C:\Windows\System\QgmkSOX.exe
  C:\Windows\System\QgmkSOX.exe
  2⤵
  PID:6900
- C:\Windows\System\SkfCcwv.exe
  C:\Windows\System\SkfCcwv.exe
  2⤵
  PID:6972
- C:\Windows\System\AjBZGdV.exe
  C:\Windows\System\AjBZGdV.exe
  2⤵
  PID:7044
- C:\Windows\System\iHCeYSw.exe
  C:\Windows\System\iHCeYSw.exe
  2⤵
  PID:7036
- C:\Windows\System\QVVbfLi.exe
  C:\Windows\System\QVVbfLi.exe
  2⤵
  PID:6444
- C:\Windows\System\JzXHtMN.exe
  C:\Windows\System\JzXHtMN.exe
  2⤵
  PID:6576
- C:\Windows\System\qedhnWG.exe
  C:\Windows\System\qedhnWG.exe
  2⤵
  PID:6168
- C:\Windows\System\TJMkVgF.exe
  C:\Windows\System\TJMkVgF.exe
  2⤵
  PID:6328
- C:\Windows\System\GlZPDds.exe
  C:\Windows\System\GlZPDds.exe
  2⤵
  PID:6220
- C:\Windows\System\yfgfwOY.exe
  C:\Windows\System\yfgfwOY.exe
  2⤵
  PID:6556
- C:\Windows\System\DPpiEvK.exe
  C:\Windows\System\DPpiEvK.exe
  2⤵
  PID:6904
- C:\Windows\System\CQBFEcW.exe
  C:\Windows\System\CQBFEcW.exe
  2⤵
  PID:6940
- C:\Windows\System\xQmcWmA.exe
  C:\Windows\System\xQmcWmA.exe
  2⤵
  PID:7172
- C:\Windows\System\CiHNxZH.exe
  C:\Windows\System\CiHNxZH.exe
  2⤵
  PID:7192
- C:\Windows\System\KDCqKxe.exe
  C:\Windows\System\KDCqKxe.exe
  2⤵
  PID:7212
- C:\Windows\System\zvwpiza.exe
  C:\Windows\System\zvwpiza.exe
  2⤵
  PID:7228
- C:\Windows\System\SaCkQLl.exe
  C:\Windows\System\SaCkQLl.exe
  2⤵
  PID:7248
- C:\Windows\System\EsISROL.exe
  C:\Windows\System\EsISROL.exe
  2⤵
  PID:7264
- C:\Windows\System\IrXnFyI.exe
  C:\Windows\System\IrXnFyI.exe
  2⤵
  PID:7280
- C:\Windows\System\UqXbMjS.exe
  C:\Windows\System\UqXbMjS.exe
  2⤵
  PID:7296
- C:\Windows\System\RstFnHT.exe
  C:\Windows\System\RstFnHT.exe
  2⤵
  PID:7312
- C:\Windows\System\lpHHfra.exe
  C:\Windows\System\lpHHfra.exe
  2⤵
  PID:7328
- C:\Windows\System\BWexZaU.exe
  C:\Windows\System\BWexZaU.exe
  2⤵
  PID:7344
- C:\Windows\System\WQephGG.exe
  C:\Windows\System\WQephGG.exe
  2⤵
  PID:7368
- C:\Windows\System\MOQWXuM.exe
  C:\Windows\System\MOQWXuM.exe
  2⤵
  PID:7388
- C:\Windows\System\IKkhtgg.exe
  C:\Windows\System\IKkhtgg.exe
  2⤵
  PID:7408
- C:\Windows\System\TLpwKVO.exe
  C:\Windows\System\TLpwKVO.exe
  2⤵
  PID:7424
- C:\Windows\System\VXGMjef.exe
  C:\Windows\System\VXGMjef.exe
  2⤵
  PID:7440
- C:\Windows\System\oYGlZTD.exe
  C:\Windows\System\oYGlZTD.exe
  2⤵
  PID:7464
- C:\Windows\System\aEyJwyW.exe
  C:\Windows\System\aEyJwyW.exe
  2⤵
  PID:7608
- C:\Windows\System\WQTMKBR.exe
  C:\Windows\System\WQTMKBR.exe
  2⤵
  PID:7628
- C:\Windows\System\JKiIfKj.exe
  C:\Windows\System\JKiIfKj.exe
  2⤵
  PID:7644
- C:\Windows\System\xSZSJMS.exe
  C:\Windows\System\xSZSJMS.exe
  2⤵
  PID:7660
- C:\Windows\System\OFNONex.exe
  C:\Windows\System\OFNONex.exe
  2⤵
  PID:7676
- C:\Windows\System\vqOPRmu.exe
  C:\Windows\System\vqOPRmu.exe
  2⤵
  PID:7696
- C:\Windows\System\dgDqDnz.exe
  C:\Windows\System\dgDqDnz.exe
  2⤵
  PID:7720
- C:\Windows\System\dmyRnTO.exe
  C:\Windows\System\dmyRnTO.exe
  2⤵
  PID:7736
- C:\Windows\System\FqCvcBe.exe
  C:\Windows\System\FqCvcBe.exe
  2⤵
  PID:7812
- C:\Windows\System\RzfGoSG.exe
  C:\Windows\System\RzfGoSG.exe
  2⤵
  PID:7828
- C:\Windows\System\nHRdqMm.exe
  C:\Windows\System\nHRdqMm.exe
  2⤵
  PID:7848
- C:\Windows\System\UJChNaa.exe
  C:\Windows\System\UJChNaa.exe
  2⤵
  PID:7880
- C:\Windows\System\sCwZqYl.exe
  C:\Windows\System\sCwZqYl.exe
  2⤵
  PID:8132
- C:\Windows\System\VZOykht.exe
  C:\Windows\System\VZOykht.exe
  2⤵
  PID:8156
- C:\Windows\System\McQLftd.exe
  C:\Windows\System\McQLftd.exe
  2⤵
  PID:8172
- C:\Windows\System\pYLvfVJ.exe
  C:\Windows\System\pYLvfVJ.exe
  2⤵
  PID:8188
- C:\Windows\System\RPUZKBr.exe
  C:\Windows\System\RPUZKBr.exe
  2⤵
  PID:6512
- C:\Windows\System\gSKrHVq.exe
  C:\Windows\System\gSKrHVq.exe
  2⤵
  PID:6428
- C:\Windows\System\qRAplOO.exe
  C:\Windows\System\qRAplOO.exe
  2⤵
  PID:7180
- C:\Windows\System\YpwZvUv.exe
  C:\Windows\System\YpwZvUv.exe
  2⤵
  PID:7256
- C:\Windows\System\WubkSDi.exe
  C:\Windows\System\WubkSDi.exe
  2⤵
  PID:7320
- C:\Windows\System\hRVwUfR.exe
  C:\Windows\System\hRVwUfR.exe
  2⤵
  PID:7360
- C:\Windows\System\AuCxvBE.exe
  C:\Windows\System\AuCxvBE.exe
  2⤵
  PID:7432
- C:\Windows\System\GWZNVGf.exe
  C:\Windows\System\GWZNVGf.exe
  2⤵
  PID:6652
- C:\Windows\System\cLOsexz.exe
  C:\Windows\System\cLOsexz.exe
  2⤵
  PID:6956
- C:\Windows\System\xrVUBzd.exe
  C:\Windows\System\xrVUBzd.exe
  2⤵
  PID:6620
- C:\Windows\System\kIbtNpX.exe
  C:\Windows\System\kIbtNpX.exe
  2⤵
  PID:6852
- C:\Windows\System\mguIQuH.exe
  C:\Windows\System\mguIQuH.exe
  2⤵
  PID:6760
- C:\Windows\System\aznlmpc.exe
  C:\Windows\System\aznlmpc.exe
  2⤵
  PID:6716
- C:\Windows\System\pHHqFuk.exe
  C:\Windows\System\pHHqFuk.exe
  2⤵
  PID:7024
- C:\Windows\System\mptHvzr.exe
  C:\Windows\System\mptHvzr.exe
  2⤵
  PID:7072
- C:\Windows\System\psIkyXY.exe
  C:\Windows\System\psIkyXY.exe
  2⤵
  PID:7084
- C:\Windows\System\IrfFnwa.exe
  C:\Windows\System\IrfFnwa.exe
  2⤵
  PID:6204
- C:\Windows\System\PlIwogq.exe
  C:\Windows\System\PlIwogq.exe
  2⤵
  PID:6016
- C:\Windows\System\oYCxFaf.exe
  C:\Windows\System\oYCxFaf.exe
  2⤵
  PID:6492
- C:\Windows\System\ykHwFtj.exe
  C:\Windows\System\ykHwFtj.exe
  2⤵
  PID:7480
- C:\Windows\System\PVJuDyy.exe
  C:\Windows\System\PVJuDyy.exe
  2⤵
  PID:7496
- C:\Windows\System\hlraORj.exe
  C:\Windows\System\hlraORj.exe
  2⤵
  PID:7508
- C:\Windows\System\mWIpgUb.exe
  C:\Windows\System\mWIpgUb.exe
  2⤵
  PID:7524
- C:\Windows\System\sWGklqr.exe
  C:\Windows\System\sWGklqr.exe
  2⤵
  PID:7540
- C:\Windows\System\YsuWVXA.exe
  C:\Windows\System\YsuWVXA.exe
  2⤵
  PID:7560
- C:\Windows\System\MOlqFrW.exe
  C:\Windows\System\MOlqFrW.exe
  2⤵
  PID:7576
- C:\Windows\System\BNiLaSL.exe
  C:\Windows\System\BNiLaSL.exe
  2⤵
  PID:7588
- C:\Windows\System\QWuNRgc.exe
  C:\Windows\System\QWuNRgc.exe
  2⤵
  PID:7040
- C:\Windows\System\MNDrLGd.exe
  C:\Windows\System\MNDrLGd.exe
  2⤵
  PID:7164
- C:\Windows\System\tWNpvZF.exe
  C:\Windows\System\tWNpvZF.exe
  2⤵
  PID:7748
- C:\Windows\System\gUSCrtI.exe
  C:\Windows\System\gUSCrtI.exe
  2⤵
  PID:6332
- C:\Windows\System\UpuEArY.exe
  C:\Windows\System\UpuEArY.exe
  2⤵
  PID:7380
- C:\Windows\System\TYeGUYi.exe
  C:\Windows\System\TYeGUYi.exe
  2⤵
  PID:6408
- C:\Windows\System\bjOFtJq.exe
  C:\Windows\System\bjOFtJq.exe
  2⤵
  PID:7448
- C:\Windows\System\inGNNeR.exe
  C:\Windows\System\inGNNeR.exe
  2⤵
  PID:6776
- C:\Windows\System\aAjBhmN.exe
  C:\Windows\System\aAjBhmN.exe
  2⤵
  PID:7272
- C:\Windows\System\vdKnILS.exe
  C:\Windows\System\vdKnILS.exe
  2⤵
  PID:7308
- C:\Windows\System\eFdnrgN.exe
  C:\Windows\System\eFdnrgN.exe
  2⤵
  PID:7420
- C:\Windows\System\JFrzWND.exe
  C:\Windows\System\JFrzWND.exe
  2⤵
  PID:7620
- C:\Windows\System\xqPUpCN.exe
  C:\Windows\System\xqPUpCN.exe
  2⤵
  PID:7636
- C:\Windows\System\oNHaPRL.exe
  C:\Windows\System\oNHaPRL.exe
  2⤵
  PID:7656
- C:\Windows\System\mviIybM.exe
  C:\Windows\System\mviIybM.exe
  2⤵
  PID:7732
- C:\Windows\System\DLTPsBD.exe
  C:\Windows\System\DLTPsBD.exe
  2⤵
  PID:7716
- C:\Windows\System\RemSlBk.exe
  C:\Windows\System\RemSlBk.exe
  2⤵
  PID:7780
- C:\Windows\System\VpluEgK.exe
  C:\Windows\System\VpluEgK.exe
  2⤵
  PID:7904
- C:\Windows\System\WgnCrYP.exe
  C:\Windows\System\WgnCrYP.exe
  2⤵
  PID:7952
- C:\Windows\System\WCRlPFQ.exe
  C:\Windows\System\WCRlPFQ.exe
  2⤵
  PID:7972
- C:\Windows\System\bzYPhtN.exe
  C:\Windows\System\bzYPhtN.exe
  2⤵
  PID:7888
- C:\Windows\System\wbHrBrH.exe
  C:\Windows\System\wbHrBrH.exe
  2⤵
  PID:7920
- C:\Windows\System\NluQXod.exe
  C:\Windows\System\NluQXod.exe
  2⤵
  PID:8000
- C:\Windows\System\UMKDHRl.exe
  C:\Windows\System\UMKDHRl.exe
  2⤵
  PID:8016
- C:\Windows\System\gLIzvVo.exe
  C:\Windows\System\gLIzvVo.exe
  2⤵
  PID:8184
- C:\Windows\System\asRGozf.exe
  C:\Windows\System\asRGozf.exe
  2⤵
  PID:7992
- C:\Windows\System\tpURHHM.exe
  C:\Windows\System\tpURHHM.exe
  2⤵
  PID:8028
- C:\Windows\System\tJExElu.exe
  C:\Windows\System\tJExElu.exe
  2⤵
  PID:8044
- C:\Windows\System\COnQHHI.exe
  C:\Windows\System\COnQHHI.exe
  2⤵
  PID:8052
- C:\Windows\System\rgyXzei.exe
  C:\Windows\System\rgyXzei.exe
  2⤵
  PID:8068
- C:\Windows\System\DnYJatX.exe
  C:\Windows\System\DnYJatX.exe
  2⤵
  PID:8088
- C:\Windows\System\anHFpWh.exe
  C:\Windows\System\anHFpWh.exe
  2⤵
  PID:8104
- C:\Windows\System\eGymglJ.exe
  C:\Windows\System\eGymglJ.exe
  2⤵
  PID:8120
- C:\Windows\System\HYnRvCf.exe
  C:\Windows\System\HYnRvCf.exe
  2⤵
  PID:6508
- C:\Windows\System\qLEIojM.exe
  C:\Windows\System\qLEIojM.exe
  2⤵
  PID:6976
- C:\Windows\System\gFGuKsm.exe
  C:\Windows\System\gFGuKsm.exe
  2⤵
  PID:7356
- C:\Windows\System\HSNuals.exe
  C:\Windows\System\HSNuals.exe
  2⤵
  PID:6920
- C:\Windows\System\RltqiYe.exe
  C:\Windows\System\RltqiYe.exe
  2⤵
  PID:6684
- C:\Windows\System\ZOOhPkb.exe
  C:\Windows\System\ZOOhPkb.exe
  2⤵
  PID:6988
- C:\Windows\System\MLwNATo.exe
  C:\Windows\System\MLwNATo.exe
  2⤵
  PID:7080
- C:\Windows\System\OcyUoyc.exe
  C:\Windows\System\OcyUoyc.exe
  2⤵
  PID:7064
- C:\Windows\System\kFTgFac.exe
  C:\Windows\System\kFTgFac.exe
  2⤵
  PID:5440
- C:\Windows\System\sDuokaj.exe
  C:\Windows\System\sDuokaj.exe
  2⤵
  PID:6704
- C:\Windows\System\WchoKeR.exe
  C:\Windows\System\WchoKeR.exe
  2⤵
  PID:7488
- C:\Windows\System\rIHFZGm.exe
  C:\Windows\System\rIHFZGm.exe
  2⤵
  PID:7600
- C:\Windows\System\SQDoKwJ.exe
  C:\Windows\System\SQDoKwJ.exe
  2⤵
  PID:6636
- C:\Windows\System\cdphpSG.exe
  C:\Windows\System\cdphpSG.exe
  2⤵
  PID:7276
- C:\Windows\System\mPsDjlp.exe
  C:\Windows\System\mPsDjlp.exe
  2⤵
  PID:7304
- C:\Windows\System\QcvULCQ.exe
  C:\Windows\System\QcvULCQ.exe
  2⤵
  PID:7672
- C:\Windows\System\RRImjqH.exe
  C:\Windows\System\RRImjqH.exe
  2⤵
  PID:7776
- C:\Windows\System\anfnVwU.exe
  C:\Windows\System\anfnVwU.exe
  2⤵
  PID:7616
- C:\Windows\System\NSpBfsR.exe
  C:\Windows\System\NSpBfsR.exe
  2⤵
  PID:7760
- C:\Windows\System\kxjJiIS.exe
  C:\Windows\System\kxjJiIS.exe
  2⤵
  PID:7804
- C:\Windows\System\mpyCVCY.exe
  C:\Windows\System\mpyCVCY.exe
  2⤵
  PID:7808
- C:\Windows\System\Odivmii.exe
  C:\Windows\System\Odivmii.exe
  2⤵
  PID:7868
- C:\Windows\System\HIQOSff.exe
  C:\Windows\System\HIQOSff.exe
  2⤵
  PID:7932
- C:\Windows\System\YymXnVL.exe
  C:\Windows\System\YymXnVL.exe
  2⤵
  PID:7936
- C:\Windows\System\jSjALGn.exe
  C:\Windows\System\jSjALGn.exe
  2⤵
  PID:7860
- C:\Windows\System\wQmArgl.exe
  C:\Windows\System\wQmArgl.exe
  2⤵
  PID:7960
- C:\Windows\System\PeXzvil.exe
  C:\Windows\System\PeXzvil.exe
  2⤵
  PID:8008
- C:\Windows\System\bTDPHHZ.exe
  C:\Windows\System\bTDPHHZ.exe
  2⤵
  PID:7988
- C:\Windows\System\QjSocfO.exe
  C:\Windows\System\QjSocfO.exe
  2⤵
  PID:8084
- C:\Windows\System\UbSSqMV.exe
  C:\Windows\System\UbSSqMV.exe
  2⤵
  PID:1908
- C:\Windows\System\mZLLDxX.exe
  C:\Windows\System\mZLLDxX.exe
  2⤵
  PID:7396
- C:\Windows\System\LuZBSuz.exe
  C:\Windows\System\LuZBSuz.exe
  2⤵
  PID:6992
- C:\Windows\System\hTLIaYA.exe
  C:\Windows\System\hTLIaYA.exe
  2⤵
  PID:7060
- C:\Windows\System\hmdmXOO.exe
  C:\Windows\System\hmdmXOO.exe
  2⤵
  PID:8164
- C:\Windows\System\BLwOKiK.exe
  C:\Windows\System\BLwOKiK.exe
  2⤵
  PID:6872
- C:\Windows\System\RNSBzWJ.exe
  C:\Windows\System\RNSBzWJ.exe
  2⤵
  PID:7712
- C:\Windows\System\QxNuJig.exe
  C:\Windows\System\QxNuJig.exe
  2⤵
  PID:7244
- C:\Windows\System\tGxeXIn.exe
  C:\Windows\System\tGxeXIn.exe
  2⤵
  PID:5512
- C:\Windows\System\bjkLNGG.exe
  C:\Windows\System\bjkLNGG.exe
  2⤵
  PID:7384
- C:\Windows\System\mEVOmqV.exe
  C:\Windows\System\mEVOmqV.exe
  2⤵
  PID:7800
- C:\Windows\System\lWoWPJg.exe
  C:\Windows\System\lWoWPJg.exe
  2⤵
  PID:7940
- C:\Windows\System\vjmIOYj.exe
  C:\Windows\System\vjmIOYj.exe
  2⤵
  PID:7840
- C:\Windows\System\DulGXmV.exe
  C:\Windows\System\DulGXmV.exe
  2⤵
  PID:7996
- C:\Windows\System\nIZUHrU.exe
  C:\Windows\System\nIZUHrU.exe
  2⤵
  PID:7968
- C:\Windows\System\hAxIfXn.exe
  C:\Windows\System\hAxIfXn.exe
  2⤵
  PID:7900
- C:\Windows\System\EbSKuEn.exe
  C:\Windows\System\EbSKuEn.exe
  2⤵
  PID:8080
- C:\Windows\System\JSDuzSG.exe
  C:\Windows\System\JSDuzSG.exe
  2⤵
  PID:8100
- C:\Windows\System\rdpBZYp.exe
  C:\Windows\System\rdpBZYp.exe
  2⤵
  PID:7400
- C:\Windows\System\OcZErJm.exe
  C:\Windows\System\OcZErJm.exe
  2⤵
  PID:7504
- C:\Windows\System\XeZpkdD.exe
  C:\Windows\System\XeZpkdD.exe
  2⤵
  PID:6316
- C:\Windows\System\owNYigY.exe
  C:\Windows\System\owNYigY.exe
  2⤵
  PID:7572
- C:\Windows\System\xeamJUR.exe
  C:\Windows\System\xeamJUR.exe
  2⤵
  PID:7584
- C:\Windows\System\icZAsdc.exe
  C:\Windows\System\icZAsdc.exe
  2⤵
  PID:7240
- C:\Windows\System\IobCqyg.exe
  C:\Windows\System\IobCqyg.exe
  2⤵
  PID:6608
- C:\Windows\System\iuOHIqs.exe
  C:\Windows\System\iuOHIqs.exe
  2⤵
  PID:7624
- C:\Windows\System\VKQwYjF.exe
  C:\Windows\System\VKQwYjF.exe
  2⤵
  PID:7548
- C:\Windows\System\pbReAjT.exe
  C:\Windows\System\pbReAjT.exe
  2⤵
  PID:7844
- C:\Windows\System\ycurWDQ.exe
  C:\Windows\System\ycurWDQ.exe
  2⤵
  PID:8140
- C:\Windows\System\qpmvRzo.exe
  C:\Windows\System\qpmvRzo.exe
  2⤵
  PID:6788
- C:\Windows\System\KDvrHKv.exe
  C:\Windows\System\KDvrHKv.exe
  2⤵
  PID:7492
- C:\Windows\System\RMLfJMX.exe
  C:\Windows\System\RMLfJMX.exe
  2⤵
  PID:7768
- C:\Windows\System\lWKTakw.exe
  C:\Windows\System\lWKTakw.exe
  2⤵
  PID:7708
- C:\Windows\System\ZfglEil.exe
  C:\Windows\System\ZfglEil.exe
  2⤵
  PID:8212
- C:\Windows\System\NJzmmDZ.exe
  C:\Windows\System\NJzmmDZ.exe
  2⤵
  PID:8228
- C:\Windows\System\ZqXGwdG.exe
  C:\Windows\System\ZqXGwdG.exe
  2⤵
  PID:8248
- C:\Windows\System\ukqUwir.exe
  C:\Windows\System\ukqUwir.exe
  2⤵
  PID:8264
- C:\Windows\System\olpHDzS.exe
  C:\Windows\System\olpHDzS.exe
  2⤵
  PID:8280
- C:\Windows\System\XRfJFbs.exe
  C:\Windows\System\XRfJFbs.exe
  2⤵
  PID:8296
- C:\Windows\System\XEfNByc.exe
  C:\Windows\System\XEfNByc.exe
  2⤵
  PID:8312
- C:\Windows\System\PIviOcj.exe
  C:\Windows\System\PIviOcj.exe
  2⤵
  PID:8328
- C:\Windows\System\kRzRAmD.exe
  C:\Windows\System\kRzRAmD.exe
  2⤵
  PID:8344
- C:\Windows\System\hVJbLPu.exe
  C:\Windows\System\hVJbLPu.exe
  2⤵
  PID:8364
- C:\Windows\System\aoeJEAl.exe
  C:\Windows\System\aoeJEAl.exe
  2⤵
  PID:8384
- C:\Windows\System\XxbmVny.exe
  C:\Windows\System\XxbmVny.exe
  2⤵
  PID:8400
- C:\Windows\System\coufskG.exe
  C:\Windows\System\coufskG.exe
  2⤵
  PID:8416
- C:\Windows\System\ThUZGcm.exe
  C:\Windows\System\ThUZGcm.exe
  2⤵
  PID:8432
- C:\Windows\System\JYOMREI.exe
  C:\Windows\System\JYOMREI.exe
  2⤵
  PID:8452
- C:\Windows\System\wVqggFT.exe
  C:\Windows\System\wVqggFT.exe
  2⤵
  PID:8468
- C:\Windows\System\eLbLtXh.exe
  C:\Windows\System\eLbLtXh.exe
  2⤵
  PID:8488
- C:\Windows\System\iBYTVdU.exe
  C:\Windows\System\iBYTVdU.exe
  2⤵
  PID:8504
- C:\Windows\System\LtEFFVo.exe
  C:\Windows\System\LtEFFVo.exe
  2⤵
  PID:8520
- C:\Windows\System\Gmbsjta.exe
  C:\Windows\System\Gmbsjta.exe
  2⤵
  PID:8540
- C:\Windows\System\hJlSRBH.exe
  C:\Windows\System\hJlSRBH.exe
  2⤵
  PID:8556
- C:\Windows\System\ZmPDiSE.exe
  C:\Windows\System\ZmPDiSE.exe
  2⤵
  PID:8572
- C:\Windows\System\MFjbuXp.exe
  C:\Windows\System\MFjbuXp.exe
  2⤵
  PID:8592
- C:\Windows\System\eHuhjEB.exe
  C:\Windows\System\eHuhjEB.exe
  2⤵
  PID:8608
- C:\Windows\System\AsFNrbx.exe
  C:\Windows\System\AsFNrbx.exe
  2⤵
  PID:8728
- C:\Windows\System\WfnFjRm.exe
  C:\Windows\System\WfnFjRm.exe
  2⤵
  PID:8744
- C:\Windows\System\JndfXom.exe
  C:\Windows\System\JndfXom.exe
  2⤵
  PID:8760
- C:\Windows\System\KjbDkNC.exe
  C:\Windows\System\KjbDkNC.exe
  2⤵
  PID:8776
- C:\Windows\System\IxsslJH.exe
  C:\Windows\System\IxsslJH.exe
  2⤵
  PID:8792
- C:\Windows\System\ELHTWTN.exe
  C:\Windows\System\ELHTWTN.exe
  2⤵
  PID:8808
- C:\Windows\System\FgcNBnM.exe
  C:\Windows\System\FgcNBnM.exe
  2⤵
  PID:8824
- C:\Windows\System\obRiKtA.exe
  C:\Windows\System\obRiKtA.exe
  2⤵
  PID:8840
- C:\Windows\System\SNYctaQ.exe
  C:\Windows\System\SNYctaQ.exe
  2⤵
  PID:8856
- C:\Windows\System\WAxJBom.exe
  C:\Windows\System\WAxJBom.exe
  2⤵
  PID:8872
- C:\Windows\System\wtmadod.exe
  C:\Windows\System\wtmadod.exe
  2⤵
  PID:8892
- C:\Windows\System\UWhcgZs.exe
  C:\Windows\System\UWhcgZs.exe
  2⤵
  PID:8916
- C:\Windows\System\ArJlmzs.exe
  C:\Windows\System\ArJlmzs.exe
  2⤵
  PID:8932
- C:\Windows\System\FShjfrk.exe
  C:\Windows\System\FShjfrk.exe
  2⤵
  PID:8952
- C:\Windows\System\tTHtaIS.exe
  C:\Windows\System\tTHtaIS.exe
  2⤵
  PID:8968
- C:\Windows\System\kPZbPff.exe
  C:\Windows\System\kPZbPff.exe
  2⤵
  PID:8984
- C:\Windows\System\zTOSiII.exe
  C:\Windows\System\zTOSiII.exe
  2⤵
  PID:9000
- C:\Windows\System\vKqGdGc.exe
  C:\Windows\System\vKqGdGc.exe
  2⤵
  PID:9020
- C:\Windows\System\WHFZqyL.exe
  C:\Windows\System\WHFZqyL.exe
  2⤵
  PID:9040
- C:\Windows\System\DhGTaen.exe
  C:\Windows\System\DhGTaen.exe
  2⤵
  PID:9060
- C:\Windows\System\myYoCjq.exe
  C:\Windows\System\myYoCjq.exe
  2⤵
  PID:9076
- C:\Windows\System\YpaxeGy.exe
  C:\Windows\System\YpaxeGy.exe
  2⤵
  PID:9092
- C:\Windows\System\CtZhJgD.exe
  C:\Windows\System\CtZhJgD.exe
  2⤵
  PID:9108
- C:\Windows\System\KAVzdOS.exe
  C:\Windows\System\KAVzdOS.exe
  2⤵
  PID:9124
- C:\Windows\System\TNizDUr.exe
  C:\Windows\System\TNizDUr.exe
  2⤵
  PID:9148
- C:\Windows\System\qpNMIkU.exe
  C:\Windows\System\qpNMIkU.exe
  2⤵
  PID:9168
- C:\Windows\System\gjNzzFo.exe
  C:\Windows\System\gjNzzFo.exe
  2⤵
  PID:9184
- C:\Windows\System\OMCNWkk.exe
  C:\Windows\System\OMCNWkk.exe
  2⤵
  PID:9200
- C:\Windows\System\OomTrbQ.exe
  C:\Windows\System\OomTrbQ.exe
  2⤵
  PID:8128
- C:\Windows\System\qZXbaGn.exe
  C:\Windows\System\qZXbaGn.exe
  2⤵
  PID:8220
- C:\Windows\System\VPhDWKt.exe
  C:\Windows\System\VPhDWKt.exe
  2⤵
  PID:6152
- C:\Windows\System\ICCootj.exe
  C:\Windows\System\ICCootj.exe
  2⤵
  PID:6736
- C:\Windows\System\qAuEiBg.exe
  C:\Windows\System\qAuEiBg.exe
  2⤵
  PID:8260
- C:\Windows\System\WUVfARi.exe
  C:\Windows\System\WUVfARi.exe
  2⤵
  PID:8324
- C:\Windows\System\uDQsdIc.exe
  C:\Windows\System\uDQsdIc.exe
  2⤵
  PID:8064
- C:\Windows\System\xbYLaBh.exe
  C:\Windows\System\xbYLaBh.exe
  2⤵
  PID:7836
- C:\Windows\System\IfxnIii.exe
  C:\Windows\System\IfxnIii.exe
  2⤵
  PID:7964
- C:\Windows\System\JMHPZir.exe
  C:\Windows\System\JMHPZir.exe
  2⤵
  PID:7692
- C:\Windows\System\AaKOxeL.exe
  C:\Windows\System\AaKOxeL.exe
  2⤵
  PID:7224
- C:\Windows\System\HXCoJHx.exe
  C:\Windows\System\HXCoJHx.exe
  2⤵
  PID:8204
- C:\Windows\System\OjwzJNv.exe
  C:\Windows\System\OjwzJNv.exe
  2⤵
  PID:8244
- C:\Windows\System\JOSdLCX.exe
  C:\Windows\System\JOSdLCX.exe
  2⤵
  PID:8308
- C:\Windows\System\FQqNCur.exe
  C:\Windows\System\FQqNCur.exe
  2⤵
  PID:8376
- C:\Windows\System\cmnwVoY.exe
  C:\Windows\System\cmnwVoY.exe
  2⤵
  PID:8424
- C:\Windows\System\FKKjnKJ.exe
  C:\Windows\System\FKKjnKJ.exe
  2⤵
  PID:8496
- C:\Windows\System\iNYCBXS.exe
  C:\Windows\System\iNYCBXS.exe
  2⤵
  PID:8536
- C:\Windows\System\MqAoXFW.exe
  C:\Windows\System\MqAoXFW.exe
  2⤵
  PID:8600
- C:\Windows\System\WPCCIvv.exe
  C:\Windows\System\WPCCIvv.exe
  2⤵
  PID:8484
- C:\Windows\System\ffjrxcc.exe
  C:\Windows\System\ffjrxcc.exe
  2⤵
  PID:8444
- C:\Windows\System\UZuICxP.exe
  C:\Windows\System\UZuICxP.exe
  2⤵
  PID:8552
- C:\Windows\System\OYZnkUS.exe
  C:\Windows\System\OYZnkUS.exe
  2⤵
  PID:8620
- C:\Windows\System\YzQhrOX.exe
  C:\Windows\System\YzQhrOX.exe
  2⤵
  PID:8716
- C:\Windows\System\rLPoBpP.exe
  C:\Windows\System\rLPoBpP.exe
  2⤵
  PID:8784
- C:\Windows\System\prhPMMY.exe
  C:\Windows\System\prhPMMY.exe
  2⤵
  PID:8868
- C:\Windows\System\oiKXugy.exe
  C:\Windows\System\oiKXugy.exe
  2⤵
  PID:8940
- C:\Windows\System\NntjWNj.exe
  C:\Windows\System\NntjWNj.exe
  2⤵
  PID:8980
- C:\Windows\System\ZmLUzLT.exe
  C:\Windows\System\ZmLUzLT.exe
  2⤵
  PID:9048
- C:\Windows\System\hVcdptD.exe
  C:\Windows\System\hVcdptD.exe
  2⤵
  PID:9084
- C:\Windows\System\LsQlTuD.exe
  C:\Windows\System\LsQlTuD.exe
  2⤵
  PID:9120
- C:\Windows\System\JqCfxPu.exe
  C:\Windows\System\JqCfxPu.exe
  2⤵
  PID:8756
- C:\Windows\System\eSwfZux.exe
  C:\Windows\System\eSwfZux.exe
  2⤵
  PID:8996
- C:\Windows\System\drmOQbp.exe
  C:\Windows\System\drmOQbp.exe
  2⤵
  PID:8848
- C:\Windows\System\XPGalNd.exe
  C:\Windows\System\XPGalNd.exe
  2⤵
  PID:8960
- C:\Windows\System\eoDCSPv.exe
  C:\Windows\System\eoDCSPv.exe
  2⤵
  PID:9100
- C:\Windows\System\UUHFpVh.exe
  C:\Windows\System\UUHFpVh.exe
  2⤵
  PID:9140
- C:\Windows\System\emCWSQV.exe
  C:\Windows\System\emCWSQV.exe
  2⤵
  PID:9176
- C:\Windows\System\NNqMkVi.exe
  C:\Windows\System\NNqMkVi.exe
  2⤵
  PID:8036
- C:\Windows\System\amZTWXw.exe
  C:\Windows\System\amZTWXw.exe
  2⤵
  PID:8320
- C:\Windows\System\miWcpHd.exe
  C:\Windows\System\miWcpHd.exe
  2⤵
  PID:7352
- C:\Windows\System\oQbgutG.exe
  C:\Windows\System\oQbgutG.exe
  2⤵
  PID:8304
- C:\Windows\System\DPwShmq.exe
  C:\Windows\System\DPwShmq.exe
  2⤵
  PID:8532
- C:\Windows\System\dlqRkqa.exe
  C:\Windows\System\dlqRkqa.exe
  2⤵
  PID:8480
- C:\Windows\System\MBAuUmn.exe
  C:\Windows\System\MBAuUmn.exe
  2⤵
  PID:8464
- C:\Windows\System\iVrYbjx.exe
  C:\Windows\System\iVrYbjx.exe
  2⤵
  PID:9212
- C:\Windows\System\NwBdivH.exe
  C:\Windows\System\NwBdivH.exe
  2⤵
  PID:8360
- C:\Windows\System\ehUfNNg.exe
  C:\Windows\System\ehUfNNg.exe
  2⤵
  PID:8236
- C:\Windows\System\fuObGEK.exe
  C:\Windows\System\fuObGEK.exe
  2⤵
  PID:8460
- C:\Windows\System\foQLcGx.exe
  C:\Windows\System\foQLcGx.exe
  2⤵
  PID:8440
- C:\Windows\System\oMKLZjf.exe
  C:\Windows\System\oMKLZjf.exe
  2⤵
  PID:8804
- C:\Windows\System\PumzqTT.exe
  C:\Windows\System\PumzqTT.exe
  2⤵
  PID:8648
- C:\Windows\System\BnrjLhg.exe
  C:\Windows\System\BnrjLhg.exe
  2⤵
  PID:8664
- C:\Windows\System\cKThamC.exe
  C:\Windows\System\cKThamC.exe
  2⤵
  PID:8684
- C:\Windows\System\lZOtOBT.exe
  C:\Windows\System\lZOtOBT.exe
  2⤵
  PID:8704
- C:\Windows\System\tvfiKmx.exe
  C:\Windows\System\tvfiKmx.exe
  2⤵
  PID:8768
- C:\Windows\System\NDxNEpa.exe
  C:\Windows\System\NDxNEpa.exe
  2⤵
  PID:8864
- C:\Windows\System\bjDnmPQ.exe
  C:\Windows\System\bjDnmPQ.exe
  2⤵
  PID:8676
- C:\Windows\System\XkWVlSj.exe
  C:\Windows\System\XkWVlSj.exe
  2⤵
  PID:8632
- C:\Windows\System\dHdEGXU.exe
  C:\Windows\System\dHdEGXU.exe
  2⤵
  PID:8888
- C:\Windows\System\npmoUyl.exe
  C:\Windows\System\npmoUyl.exe
  2⤵
  PID:8992
- C:\Windows\System\tYkxCAY.exe
  C:\Windows\System\tYkxCAY.exe
  2⤵
  PID:9160
- C:\Windows\System\KexsIbI.exe
  C:\Windows\System\KexsIbI.exe
  2⤵
  PID:6268
- C:\Windows\System\sWDicNu.exe
  C:\Windows\System\sWDicNu.exe
  2⤵
  PID:8056
- C:\Windows\System\ZmetbaD.exe
  C:\Windows\System\ZmetbaD.exe
  2⤵
  PID:8548
- C:\Windows\System\hMMZIaK.exe
  C:\Windows\System\hMMZIaK.exe
  2⤵
  PID:8256
- C:\Windows\System\IleiHse.exe
  C:\Windows\System\IleiHse.exe
  2⤵
  PID:8072
- C:\Windows\System\UBZAdjO.exe
  C:\Windows\System\UBZAdjO.exe
  2⤵
  PID:8908
- C:\Windows\System\RadDUWq.exe
  C:\Windows\System\RadDUWq.exe
  2⤵
  PID:8708
- C:\Windows\System\jsUmmvP.exe
  C:\Windows\System\jsUmmvP.exe
  2⤵
  PID:7684
- C:\Windows\System\yebzGrD.exe
  C:\Windows\System\yebzGrD.exe
  2⤵
  PID:8340
- C:\Windows\System\LyZAGxQ.exe
  C:\Windows\System\LyZAGxQ.exe
  2⤵
  PID:8660
- C:\Windows\System\nDGTltT.exe
  C:\Windows\System\nDGTltT.exe
  2⤵
  PID:7568
- C:\Windows\System\OtThuBp.exe
  C:\Windows\System\OtThuBp.exe
  2⤵
  PID:9016
- C:\Windows\System\gTmYtcS.exe
  C:\Windows\System\gTmYtcS.exe
  2⤵
  PID:8724
- C:\Windows\System\KmzUfSV.exe
  C:\Windows\System\KmzUfSV.exe
  2⤵
  PID:9036
- C:\Windows\System\qnQeyNz.exe
  C:\Windows\System\qnQeyNz.exe
  2⤵
  PID:9072
- C:\Windows\System\GtbcuoS.exe
  C:\Windows\System\GtbcuoS.exe
  2⤵
  PID:8276
- C:\Windows\System\gDEVBme.exe
  C:\Windows\System\gDEVBme.exe
  2⤵
  PID:8904
- C:\Windows\System\FYQOboz.exe
  C:\Windows\System\FYQOboz.exe
  2⤵
  PID:8672
- C:\Windows\System\SWFjSeJ.exe
  C:\Windows\System\SWFjSeJ.exe
  2⤵
  PID:8712
- C:\Windows\System\cQNcmBC.exe
  C:\Windows\System\cQNcmBC.exe
  2⤵
  PID:8964
- C:\Windows\System\buSyLsb.exe
  C:\Windows\System\buSyLsb.exe
  2⤵
  PID:8836
- C:\Windows\System\GRORYju.exe
  C:\Windows\System\GRORYju.exe
  2⤵
  PID:9136
- C:\Windows\System\pZqiSzz.exe
  C:\Windows\System\pZqiSzz.exe
  2⤵
  PID:8948
- C:\Windows\System\HiJlKPn.exe
  C:\Windows\System\HiJlKPn.exe
  2⤵
  PID:8528
- C:\Windows\System\oXwSNeW.exe
  C:\Windows\System\oXwSNeW.exe
  2⤵
  PID:9164
- C:\Windows\System\TlUhKLJ.exe
  C:\Windows\System\TlUhKLJ.exe
  2⤵
  PID:8800
- C:\Windows\System\zYDRkbI.exe
  C:\Windows\System\zYDRkbI.exe
  2⤵
  PID:9196
- C:\Windows\System\SNqKmPr.exe
  C:\Windows\System\SNqKmPr.exe
  2⤵
  PID:9220
- C:\Windows\System\wKEkikn.exe
  C:\Windows\System\wKEkikn.exe
  2⤵
  PID:9236
- C:\Windows\System\ycyZfcb.exe
  C:\Windows\System\ycyZfcb.exe
  2⤵
  PID:9252
- C:\Windows\System\KZSyypK.exe
  C:\Windows\System\KZSyypK.exe
  2⤵
  PID:9268
- C:\Windows\System\hbpKcAi.exe
  C:\Windows\System\hbpKcAi.exe
  2⤵
  PID:9284
- C:\Windows\System\ZHwpaNf.exe
  C:\Windows\System\ZHwpaNf.exe
  2⤵
  PID:9300
- C:\Windows\System\radfMTM.exe
  C:\Windows\System\radfMTM.exe
  2⤵
  PID:9316
- C:\Windows\System\IhwiBAy.exe
  C:\Windows\System\IhwiBAy.exe
  2⤵
  PID:9332
- C:\Windows\System\PQRKqeD.exe
  C:\Windows\System\PQRKqeD.exe
  2⤵
  PID:9348
- C:\Windows\System\HUOdXrS.exe
  C:\Windows\System\HUOdXrS.exe
  2⤵
  PID:9364
- C:\Windows\System\CCmOcGG.exe
  C:\Windows\System\CCmOcGG.exe
  2⤵
  PID:9380
- C:\Windows\System\ugoWLuC.exe
  C:\Windows\System\ugoWLuC.exe
  2⤵
  PID:9396
- C:\Windows\System\OaWPEMk.exe
  C:\Windows\System\OaWPEMk.exe
  2⤵
  PID:9412
- C:\Windows\System\JqXtGcI.exe
  C:\Windows\System\JqXtGcI.exe
  2⤵
  PID:9428
- C:\Windows\System\dhOYRsU.exe
  C:\Windows\System\dhOYRsU.exe
  2⤵
  PID:9444
- C:\Windows\System\RCuYQei.exe
  C:\Windows\System\RCuYQei.exe
  2⤵
  PID:9460
- C:\Windows\System\yRuqGwh.exe
  C:\Windows\System\yRuqGwh.exe
  2⤵
  PID:9476
- C:\Windows\System\FRJmImk.exe
  C:\Windows\System\FRJmImk.exe
  2⤵
  PID:9492
- C:\Windows\System\HtYLJwt.exe
  C:\Windows\System\HtYLJwt.exe
  2⤵
  PID:9508
- C:\Windows\System\BCsyjwD.exe
  C:\Windows\System\BCsyjwD.exe
  2⤵
  PID:9524
- C:\Windows\System\rjOWciD.exe
  C:\Windows\System\rjOWciD.exe
  2⤵
  PID:9540
- C:\Windows\System\WCYJLvS.exe
  C:\Windows\System\WCYJLvS.exe
  2⤵
  PID:9560
- C:\Windows\System\WNfnHwW.exe
  C:\Windows\System\WNfnHwW.exe
  2⤵
  PID:9576
- C:\Windows\System\GWyQAmf.exe
  C:\Windows\System\GWyQAmf.exe
  2⤵
  PID:9592
- C:\Windows\System\wprfpAw.exe
  C:\Windows\System\wprfpAw.exe
  2⤵
  PID:9608
- C:\Windows\System\rnbQGSk.exe
  C:\Windows\System\rnbQGSk.exe
  2⤵
  PID:9624
- C:\Windows\System\bXRGMDO.exe
  C:\Windows\System\bXRGMDO.exe
  2⤵
  PID:9640
- C:\Windows\System\aDwkUMd.exe
  C:\Windows\System\aDwkUMd.exe
  2⤵
  PID:9656
- C:\Windows\System\yEXTiSV.exe
  C:\Windows\System\yEXTiSV.exe
  2⤵
  PID:9672
- C:\Windows\System\DDLbvmt.exe
  C:\Windows\System\DDLbvmt.exe
  2⤵
  PID:9688
- C:\Windows\System\yZHTGhM.exe
  C:\Windows\System\yZHTGhM.exe
  2⤵
  PID:9704
- C:\Windows\System\NzPVVnD.exe
  C:\Windows\System\NzPVVnD.exe
  2⤵
  PID:9720
- C:\Windows\System\VFzSGrF.exe
  C:\Windows\System\VFzSGrF.exe
  2⤵
  PID:9736
- C:\Windows\System\ZEUxwIC.exe
  C:\Windows\System\ZEUxwIC.exe
  2⤵
  PID:9752
- C:\Windows\System\RhaAlQy.exe
  C:\Windows\System\RhaAlQy.exe
  2⤵
  PID:9768
- C:\Windows\System\aIZbmtV.exe
  C:\Windows\System\aIZbmtV.exe
  2⤵
  PID:9784
- C:\Windows\System\BVgqGbj.exe
  C:\Windows\System\BVgqGbj.exe
  2⤵
  PID:9800
- C:\Windows\System\OeQttrV.exe
  C:\Windows\System\OeQttrV.exe
  2⤵
  PID:9816
- C:\Windows\System\dDQJbBi.exe
  C:\Windows\System\dDQJbBi.exe
  2⤵
  PID:9832
- C:\Windows\System\JTaimqm.exe
  C:\Windows\System\JTaimqm.exe
  2⤵
  PID:9848
- C:\Windows\System\HndnWTv.exe
  C:\Windows\System\HndnWTv.exe
  2⤵
  PID:9864
- C:\Windows\System\QsiMauu.exe
  C:\Windows\System\QsiMauu.exe
  2⤵
  PID:9880
- C:\Windows\System\JXbIgec.exe
  C:\Windows\System\JXbIgec.exe
  2⤵
  PID:9896
- C:\Windows\System\rEvfPNe.exe
  C:\Windows\System\rEvfPNe.exe
  2⤵
  PID:9912
- C:\Windows\System\xaZgXVD.exe
  C:\Windows\System\xaZgXVD.exe
  2⤵
  PID:9928
- C:\Windows\System\pGlCQJM.exe
  C:\Windows\System\pGlCQJM.exe
  2⤵
  PID:9944
- C:\Windows\System\DxaJPzM.exe
  C:\Windows\System\DxaJPzM.exe
  2⤵
  PID:9960
- C:\Windows\System\qCxaKTt.exe
  C:\Windows\System\qCxaKTt.exe
  2⤵
  PID:9976
- C:\Windows\System\yquLBOB.exe
  C:\Windows\System\yquLBOB.exe
  2⤵
  PID:9992
- C:\Windows\System\UtommSu.exe
  C:\Windows\System\UtommSu.exe
  2⤵
  PID:10008
- C:\Windows\System\eviEzWd.exe
  C:\Windows\System\eviEzWd.exe
  2⤵
  PID:10024
- C:\Windows\System\gcsKHkg.exe
  C:\Windows\System\gcsKHkg.exe
  2⤵
  PID:10040
- C:\Windows\System\fmRNIfc.exe
  C:\Windows\System\fmRNIfc.exe
  2⤵
  PID:10056
- C:\Windows\System\GBjlcrv.exe
  C:\Windows\System\GBjlcrv.exe
  2⤵
  PID:10072
- C:\Windows\System\QGYYheA.exe
  C:\Windows\System\QGYYheA.exe
  2⤵
  PID:10088
- C:\Windows\System\cLVSPtr.exe
  C:\Windows\System\cLVSPtr.exe
  2⤵
  PID:10104
- C:\Windows\System\YbxXnmj.exe
  C:\Windows\System\YbxXnmj.exe
  2⤵
  PID:10120
- C:\Windows\System\mYJGCKc.exe
  C:\Windows\System\mYJGCKc.exe
  2⤵
  PID:10136
- C:\Windows\System\GKUgHfx.exe
  C:\Windows\System\GKUgHfx.exe
  2⤵
  PID:10152
- C:\Windows\System\CgINUxD.exe
  C:\Windows\System\CgINUxD.exe
  2⤵
  PID:10168
- C:\Windows\System\kBNAmdf.exe
  C:\Windows\System\kBNAmdf.exe
  2⤵
  PID:10184
- C:\Windows\System\SDvGyCr.exe
  C:\Windows\System\SDvGyCr.exe
  2⤵
  PID:10200
- C:\Windows\System\NnIapHN.exe
  C:\Windows\System\NnIapHN.exe
  2⤵
  PID:10216
- C:\Windows\System\LOQJGhY.exe
  C:\Windows\System\LOQJGhY.exe
  2⤵
  PID:10232
- C:\Windows\System\BjuesbZ.exe
  C:\Windows\System\BjuesbZ.exe
  2⤵
  PID:8740
- C:\Windows\System\ocvBwoQ.exe
  C:\Windows\System\ocvBwoQ.exe
  2⤵
  PID:9232
- C:\Windows\System\wfByuoz.exe
  C:\Windows\System\wfByuoz.exe
  2⤵
  PID:9312
- C:\Windows\System\WlZuOxP.exe
  C:\Windows\System\WlZuOxP.exe
  2⤵
  PID:9228
- C:\Windows\System\FjUWJMx.exe
  C:\Windows\System\FjUWJMx.exe
  2⤵
  PID:9404
- C:\Windows\System\HbbDVeB.exe
  C:\Windows\System\HbbDVeB.exe
  2⤵
  PID:9408
- C:\Windows\System\zmwwXia.exe
  C:\Windows\System\zmwwXia.exe
  2⤵
  PID:9472
- C:\Windows\System\iqldLlj.exe
  C:\Windows\System\iqldLlj.exe
  2⤵
  PID:9488
- C:\Windows\System\sRDYMjf.exe
  C:\Windows\System\sRDYMjf.exe
  2⤵
  PID:9456
- C:\Windows\System\niUeYtt.exe
  C:\Windows\System\niUeYtt.exe
  2⤵
  PID:9484
- C:\Windows\System\MTyZtUI.exe
  C:\Windows\System\MTyZtUI.exe
  2⤵
  PID:9516
- C:\Windows\System\XxIsGwM.exe
  C:\Windows\System\XxIsGwM.exe
  2⤵
  PID:9568
- C:\Windows\System\WhLWExS.exe
  C:\Windows\System\WhLWExS.exe
  2⤵
  PID:9632
- C:\Windows\System\TkPrgkL.exe
  C:\Windows\System\TkPrgkL.exe
  2⤵
  PID:9588
- C:\Windows\System\PFzjoXV.exe
  C:\Windows\System\PFzjoXV.exe
  2⤵
  PID:9652
- C:\Windows\System\Nvwnqlz.exe
  C:\Windows\System\Nvwnqlz.exe
  2⤵
  PID:9584
- C:\Windows\System\kOJBLiu.exe
  C:\Windows\System\kOJBLiu.exe
  2⤵
  PID:9732
- C:\Windows\System\HMIotDZ.exe
  C:\Windows\System\HMIotDZ.exe
  2⤵
  PID:9764
- C:\Windows\System\ZTQkpBC.exe
  C:\Windows\System\ZTQkpBC.exe
  2⤵
  PID:9748
- C:\Windows\System\BekOffp.exe
  C:\Windows\System\BekOffp.exe
  2⤵
  PID:9856
- C:\Windows\System\kXELrxl.exe
  C:\Windows\System\kXELrxl.exe
  2⤵
  PID:9812
- C:\Windows\System\FIOiIOU.exe
  C:\Windows\System\FIOiIOU.exe
  2⤵
  PID:9844
- C:\Windows\System\dZlJhdt.exe
  C:\Windows\System\dZlJhdt.exe
  2⤵
  PID:9908
- C:\Windows\System\exTgIkX.exe
  C:\Windows\System\exTgIkX.exe
  2⤵
  PID:9940
- C:\Windows\System\gqZdqLg.exe
  C:\Windows\System\gqZdqLg.exe
  2⤵
  PID:10016
- C:\Windows\System\OQpgORd.exe
  C:\Windows\System\OQpgORd.exe
  2⤵
  PID:9972
- C:\Windows\System\TGagoPB.exe
  C:\Windows\System\TGagoPB.exe
  2⤵
  PID:10000
- C:\Windows\System\KnIOWwE.exe
  C:\Windows\System\KnIOWwE.exe
  2⤵
  PID:10080
- C:\Windows\System\htQoRmf.exe
  C:\Windows\System\htQoRmf.exe
  2⤵
  PID:10144
- C:\Windows\System\sUrqwah.exe
  C:\Windows\System\sUrqwah.exe
  2⤵
  PID:10096
- C:\Windows\System\lnWUkhh.exe
  C:\Windows\System\lnWUkhh.exe
  2⤵
  PID:10132
- C:\Windows\System\OBzNghG.exe
  C:\Windows\System\OBzNghG.exe
  2⤵
  PID:10196
- C:\Windows\System\CzvHrEn.exe
  C:\Windows\System\CzvHrEn.exe
  2⤵
  PID:9280
- C:\Windows\System\gsFXKXV.exe
  C:\Windows\System\gsFXKXV.exe
  2⤵
  PID:9440
- C:\Windows\System\ZZeaTCX.exe
  C:\Windows\System\ZZeaTCX.exe
  2⤵
  PID:9452
- C:\Windows\System\TMDzQme.exe
  C:\Windows\System\TMDzQme.exe
  2⤵
  PID:9344
- C:\Windows\System\hwZKxXm.exe
  C:\Windows\System\hwZKxXm.exe
  2⤵
  PID:9620
- C:\Windows\System\cRHMOGw.exe
  C:\Windows\System\cRHMOGw.exe
  2⤵
  PID:9728
- C:\Windows\System\ByUwfGc.exe
  C:\Windows\System\ByUwfGc.exe
  2⤵
  PID:9248
- C:\Windows\System\RRhCDqg.exe
  C:\Windows\System\RRhCDqg.exe
  2⤵
  PID:9392
- C:\Windows\System\fXxvpLJ.exe
  C:\Windows\System\fXxvpLJ.exe
  2⤵
  PID:9680
- C:\Windows\System\VOaCwop.exe
  C:\Windows\System\VOaCwop.exe
  2⤵
  PID:9796
- C:\Windows\System\KfCbetm.exe
  C:\Windows\System\KfCbetm.exe
  2⤵
  PID:9828
- C:\Windows\System\bbGTWqQ.exe
  C:\Windows\System\bbGTWqQ.exe
  2⤵
  PID:9904
- C:\Windows\System\kOEhObn.exe
  C:\Windows\System\kOEhObn.exe
  2⤵
  PID:10068
- C:\Windows\System\mWAXTtS.exe
  C:\Windows\System\mWAXTtS.exe
  2⤵
  PID:10052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DxdVWSJ.exe

Filesize
1.7MB

MD5
156f8aa6f24c3d7cac8f5745afe898f4

SHA1
1a366e015b1beb8e528ab35d46f83f1139657d1c

SHA256
4f5b927a6fd5d2a499424679ee2485c8eef20afaafe79b7d40fbbefcdb5a4041

SHA512
501edd29c8e95d338fbc7452fe7c5085fa14a7551357d5286db1fa63c8a0639be1f60a5aaa6f1292ae55dc825056c11b2208c3f2f4713ee0cdca00b6f2dc67fe

Download Submit
C:\Windows\system\EHTuTnx.exe

Filesize
1.7MB

MD5
177862f9600c38dbf4e8cf43a9c5856e

SHA1
3ac12af4bd71e215394755476b8dacf0ad5d1f4b

SHA256
da2dce1c7dd19877ca4d0d19c0e0d52c2f9c2499ae1068402f798be91ab7bb7d

SHA512
5f8e4e9944b4256b263091d0b6f6b2af8f41c71d46e5e8c3f964112ff497a83a7dae63e4e83b1847461652550fed5af22282d770e36f74821df47f249201dfc5

Download Submit
C:\Windows\system\GIZCjmi.exe

Filesize
1.7MB

MD5
4da583d56de9706574d794f863c927b8

SHA1
177b73b9abfec2aba5f2848945d4ad6801b4d38e

SHA256
064ce3f5d07cb06dedfb70edd42d616e1cf0d6fd3f862d79da477ae3f6530906

SHA512
6fd76ad738d70ade8e055f1f40800e8fff4910ad770f411163baa59bff1ecfe2254dc3f6dcca03db615532de9c6eb5900c6fcb5bdca40209137da196441d001f

Download Submit
C:\Windows\system\INgxqTl.exe

Filesize
1.7MB

MD5
a74e2840ee4cdb188f28ff8b65c7badc

SHA1
e38193eda61b7f280928ff22fd3b9f046064a985

SHA256
cdb00f24c155d8d71a1bd27967d9567af30e04d2cbfd52a360e270673205b62e

SHA512
033403aec2524744e2a46f4824ed454e97ac08690e06ddc44323052ea09eaed8eb91fbe86e99c89d27e63a8f255056df35fa4b3a9de63d06d99fe87b537a25fb

Download Submit
C:\Windows\system\JGLRoDv.exe

Filesize
1.7MB

MD5
3246b660be1d26a33d38a21643c36c08

SHA1
22799a6a7f9a51cc69e0f502cd13b8f673890460

SHA256
7acce871e0459e5c08161f1336330cb4a28dbd778e182751fb0e07ee728f2552

SHA512
121c7723d2b7b4021f8ca6f2624289789db02d5e4e8ccb158266404451797b59dedab615566b30649213c55bf547cf5ad09e310eb210207f26ba8cd8e860658b

Download Submit
C:\Windows\system\JPIDVmI.exe

Filesize
1.7MB

MD5
7009afc7af1fdb2fa4a566a65a7b07e6

SHA1
85669e6c46b1f006374d57c9fdd0930113b841c9

SHA256
59ef2b5a57f2b0b97b4b03dd99728e27be246d39a1668a7a1ea5351d2d1da066

SHA512
a9dd8e52eb5d7b71360d43b82c43ac617bbf0a2d2cc19dc932e3a57eac60f78d568ed54983a6998694f8874ccb451eadfb63196e6a292dcf305d7f2fc059d2f7

Download Submit
C:\Windows\system\KuJWnPw.exe

Filesize
1.7MB

MD5
dddc4421a0db55ca9eb781d008d52656

SHA1
adad305bdb0fc6b84dbb652e60b58c46e4b177f4

SHA256
7cd74a74fbeb566ebf24f307630a64774ff42e6bbbb47135906a12f5b9428b12

SHA512
acc73ebfd2d42ab4545768d71634f5d2286d08fd5daa72deb689e507882356fe86be0c576572cd83518d0af54a61e21a22970674ec8e42805022b0c9fc15733b

Download Submit
C:\Windows\system\PdEZyXu.exe

Filesize
1.7MB

MD5
4d0c6d9c632df873be2e55c613d78029

SHA1
984de056bcd23bb39e4a3363010f8a75eab9602e

SHA256
33378ce7db9d86a469e86b179125715aa7aed5ff812118d2fb523d93822a993b

SHA512
31a4fe6e62e91fad2a9c58448c2ca4642bb461b255dfc8c158fb3fe0f2f0a2db100e9668f547c523878b957621378f291c18cfa444a035aa9b3189b5dac3a5b6

Download Submit
C:\Windows\system\ZXkzTES.exe

Filesize
1.7MB

MD5
5f29dbbbbed0ad4b65cc43245a9ec88e

SHA1
45b5140fd8ac395cf0e517c7f817f73ae78bd405

SHA256
5762ac7dbca8e63f28710cc737ad54e9d4ebfda6395b0b85d68183a705a8b2d8

SHA512
4d1d3cbcd95290e99acf99fb6baaa18aa39a93141f7f1d35a1f1f48d4ada0c4f9c6e73862c9e327752fa91921e3bec349fffa3cea818a26dfad310accea09279

Download Submit
C:\Windows\system\aykzocT.exe

Filesize
1.7MB

MD5
4b55358adbafbf155f94699d12d44d50

SHA1
9ee7322b5984bc0c19284dfd33496bb452dd699b

SHA256
749609f1eee6d4040f4fe58f2156d49da4d8636271d5d73034e84bd2d4dd3606

SHA512
a1e66dd39252d4d9d13a01d5394a3fc9db72b839d6318a8cd7e04299ade34966ff439468d9defe3440381b08dec71b29a179e0df5e7e05dcf712278bf47cd6e0

Download Submit
C:\Windows\system\dZlqvuv.exe

Filesize
1.7MB

MD5
34db3c70a7a04b09e5f26b6ee52f6c78

SHA1
344f78221fed95f7584b9df6d0e4bb3953ea9472

SHA256
1fccf47e708259bf5e0373a1d3b1aae9139a55a6369acb6d0abf10a0acf9e0fa

SHA512
e706bbd07e9284fab7e7b827aa823831f26be6046cc7d62e3d425814a0da35e70d91a09962254905d4b147651573bcfdf4217189e63915b438d7515cb56c8e21

Download Submit
C:\Windows\system\fZjlWCT.exe

Filesize
1.7MB

MD5
d05599378884a8a18ce159c083c38d33

SHA1
aaba61d23d78727a65c18d1a19abba079646485d

SHA256
c01282fd03bb7c16b75d153af465c05e774fb5fe77f8a280bebc4cd4feb55b31

SHA512
942235e31bb97acb87ffd700eaa51fa204b93c667fd7c5aff482318fdc674c1e8c978cd1e6a52ea363b0f0ab59839bbc32660fbb1fab0942cb2d9cd7397d5396

Download Submit
C:\Windows\system\oLFtWvr.exe

Filesize
1.7MB

MD5
8d4afd94f093945685caa8bec2b4556e

SHA1
05027e8f864a7f3255b4994281ccda88fbb1bef2

SHA256
9653ff13a63be642f5e948fe5c64db16659a45db614b6325123fd2450fc622f6

SHA512
0f55fe4b3ba348b0efc9d1102adefb91be526a7d1a7a1fb875b1c852f7e11dc099d7b9f17d80cc90ac5efd2d6b7440ef36f58ea7057d76643029624ac83ee11f

Download Submit
C:\Windows\system\ptHcZmX.exe

Filesize
1.7MB

MD5
3f8e0e6881b92ea57bb34cc0f32e467c

SHA1
a8ab9df755fd3857d762db094e531ceb49c7e935

SHA256
731df62515ac1ebcc1b4bc770072cbdc7f9e9a6a2f0a55d3bd0e16c50b215215

SHA512
f8f580286d88066a28a9d4256ca08fa510d2d3e85ec4d4c325cad000a9145fd60aa0630c63b18de2efce6ac6eb67da046ea3691f34df28ca21e7b40e5cb8ac6c

Download Submit
C:\Windows\system\qifMBXb.exe

Filesize
1.7MB

MD5
0d70320ff31254bd14e7fa112b7bf38a

SHA1
3fe869324f29fa199a8ea4611d84a5af50a471bf

SHA256
3b1517d34746fe1c968b0a23ae8ee538c62da6fce8ac1bc5183c8fd013d800be

SHA512
fb587bd9b7bd1dc657a626453bcee46f491dccf1953c7f6db908b88be05d274a448cb075f0f322b1fe3367dd3eaf6da2fe1a701fb517437f7f3a736b545ace71

Download Submit
C:\Windows\system\wIVyyAT.exe

Filesize
1.7MB

MD5
19d1e0587f7bb4be7fe925c1613ad84c

SHA1
396c5ea826343dd675fa43b6a3548702d5019bfa

SHA256
9a287b0493e72b7cfb66e110bb8b8f22398897fdcb7b47bacf4a1c7042ea971d

SHA512
f2e715879f838af2e31d0b225c786ddeca086df5f685d4ed481ed70e75b8d34760936a7193f62bfcd37c94416e209952cbf0d6f0a3774a6baf61281e2f6d5515

Download Submit
C:\Windows\system\wuxcIOa.exe

Filesize
1.7MB

MD5
fdd71f45ae64705d225befbd58e3e236

SHA1
9a1e90b4c64395d86e501cc4aeb4132c1d392cb3

SHA256
a45f49f9f655d003347e3dcc0df0f65dd2716ab3cff6908b7785c63dc9f2db40

SHA512
70b8a45b9843faed6921df96756e064bd5c66f9020dd7d2782753207abefcd16115ad36435648b726c62538cbc2be9635e605f63c53a87761d2bcae9b42859f6

Download Submit
C:\Windows\system\yjrUULO.exe

Filesize
1.7MB

MD5
22bbe8e6410f2322a1ca501eb47106f0

SHA1
a0aa1b9eda35fae06aa9f9641d9eb633313ecf8e

SHA256
aa91f345daf10d4b6ecbe07612f410b91ce02501c6f1d64d1361d760715940b5

SHA512
a1687576faa314b4ca8df70c555bb8ff646815c15e841c60b61adeaf4034a2d3ad5f418ffd376a2e18f53541577268d4f436309f141017c54a4dd4957b8e133d

Download Submit
\Windows\system\EJLFWhy.exe

Filesize
1.7MB

MD5
e76cbfc9fde0fa9db585783d9b5b3c57

SHA1
ec55a4db993aba095c27477781734e2d79d25103

SHA256
176e75d7272b8a25034f6379a8ceccf2195091d20b067a8992e66570225806af

SHA512
a5c9c034d50245bcc7ce97f29c05d67b7d22601876bece4135d4e6f8d90b192d78607dfc830380b94440ff1eb5275a6cc44f3c182508b0949f74a03435f2e162

Download Submit
\Windows\system\GkIPTPb.exe

Filesize
1.7MB

MD5
d127943c27051a6c0c78384433b09068

SHA1
11a21a6e76240d55253ff1f6b005465929e8818d

SHA256
bedfe43778b7d78af8a4d8cd3c39fb94d524a8c303d1597c2863344220be02fa

SHA512
4158467b8d99b362eda22c8ce14d8ac0021776434bfb7bc77714c320d0f54f7b99fc77376ccd7df0e179d648d75b7eeea4f5b0177dd4d4902abac15fa9918b6d

Download Submit
\Windows\system\IbFmlQj.exe

Filesize
1.7MB

MD5
b1179abd61b8d93b808ef08114abbc8a

SHA1
666f36f437e4a02de678cf73903bf8ae63346076

SHA256
65b44bb153a2a0085f9db0015c683ac494e9f3e5cb242fd27159d3810fcf8dde

SHA512
947017b1108443eb308ab135511a563e328ef1261066434f2ae9d9c1a6288bc05a7d92b628877579eb506f79fbef4667e61b323603074e35e4f3ec0e06c75a7c

Download Submit
\Windows\system\KhaSTzz.exe

Filesize
1.7MB

MD5
4989da73d854b3e905eb313d2a0b5df0

SHA1
703f7377b47c5855ac462ff6ef2f6508a7632e5b

SHA256
e03139695441345a4ee9cce9d3c476dcbc5d1a89937e5f3a28860e5efb391149

SHA512
b6c766465e99f28ba392138994934919e2b9f3b0a72ea8b1f0ec1b7e7c4936acc20f230f698c30aaeec7f5e1e139cae2dc6353b1e14a9bb022a68cac150ba62f

Download Submit
\Windows\system\PhSmqNj.exe

Filesize
1.7MB

MD5
60772fb35d323439ae95be1c6627bf8e

SHA1
e25ea2dfebb5336f9fe10f0a2e321b84a4fd6ce5

SHA256
327ebd16faffc143c3f59bebcf01b715c1be2e5a41b2e81c790bfe789a2d3798

SHA512
e174a455a9767d906e67d6127d92973016e23e29ca9ae814d14a7efeb8581114c73ccc5f6ca237ded55e710d7e2cfdf31494f1b42e5ff84b2d8c43e7a5fb993f

Download Submit
\Windows\system\RVklWAt.exe

Filesize
1.7MB

MD5
5bd973fef74ab0ab702d48a63d1628fb

SHA1
f5dac3fcc422255b78765e12d7d2dcf724d1ba1e

SHA256
0c3638442c262da9af7e99aaf1f23e8cadccb487c568673e80b3a31c15ff9c23

SHA512
4f64f20ec5a061e1e49abf4965b73519f4f981d3fbc144cd555eb7ee530a928f8d603e8903b734d2468721bb47e229a97b424bae77a0eb93c7d38668267cbb60

Download Submit
\Windows\system\SAEDbMW.exe

Filesize
1.7MB

MD5
5da2642db65e3a3e95dc8715c107ba9d

SHA1
0f2eceb65228305bae40762260f9038b0f4eca86

SHA256
b9ba012556e72be3ce132a99ab166de5e128f0d20f8f44baf7ad4b8195345d09

SHA512
0e276f6884c2fad666c6bc0967b809c1a0b6a1a689c688459cfef4d723a6e2a409ca0c5a44cf90f203358ccdb673512f6a89579d98396981d728f532c747d6fa

Download Submit
\Windows\system\TCvWxaK.exe

Filesize
1.7MB

MD5
af0384d1290cc01e7a1e2920a0fd0955

SHA1
30148eaa71cdf1f08b1fe978da0bb82dfc627aaf

SHA256
bd68f5c8448e44c0072d13d74be928d832053808044d5c1f77770ee79f4f9177

SHA512
4b57d65bf4cdc5b4c50e64f5c7a76ef5bb898090e4169a21888c08800055158711ce6b46a588a940a99e507692892e0eb7e3c502db3ece73cf56b0971563b786

Download Submit
\Windows\system\UyQKQkS.exe

Filesize
1.7MB

MD5
87ddc34f1261ee8803365c6c2cae1b81

SHA1
38bceed86ee78df5d0d77602997d5146df2315e5

SHA256
860c86a6192fab92e400a7002ced9ca02b92f0da593011ca58c74979d38c0aca

SHA512
bf35234259897ca657f89635b04b66fc749d3586ca841b67c54ce3134203ab181d518bddc39377179ee82fd4d737fabcd6150f8d9370fc0f9714816647c846d1

Download Submit
\Windows\system\VItHtTT.exe

Filesize
1.7MB

MD5
67f680821e88cecbdeaeedc9f6dfebb3

SHA1
2e1cf5b849a343cad300c827d4d47deeb6381708

SHA256
16122332a5d81d25f6d60c23c28501db0d3e3d40422f36e41967f4dd65eea9fa

SHA512
0b1b6168a92f1560eb108712266518b87623392e7f39832093589faa4112047b72b72656a74d815b89c99d107d3f26fcf1e6022a8c1660955f8c27f2ac2f55d8

Download Submit
\Windows\system\WdqSXzY.exe

Filesize
1.7MB

MD5
52e6b995c7fe81bf1b971d8e68f72e75

SHA1
f7347dacc34bc043453ecea4e289ff431553794e

SHA256
f4270ba4e6ab7e7ffe05999da538b6aa4d4df6ca1def975d421ff33e3a80ff25

SHA512
260ba9558b2600897e57a0c64d38ba373117af397c459259c3c091b81a7f2012a87bf392a6081f64d6b4ae1c40872412f0c5493738e016570b3e3aa572ffb276

Download Submit
\Windows\system\YEKqbdU.exe

Filesize
1.7MB

MD5
a896e13d938757af8725660ebd5da3ab

SHA1
1f3533fe0e7974599f6eef099ac1c47b87603c78

SHA256
8dbf1e02aa3591490837f2148a8a89b576e20c843e39b4ff05eeef26713f434f

SHA512
e0a244e95b099dd955c9108e7b50007a05b0a546f91d91d703a82c6c491ec6a6df8d37697ab15678f48cc8779d0a5d13999fffeec4d3e8a2395077c6c638b3ce

Download Submit
\Windows\system\aSecaOs.exe

Filesize
1.7MB

MD5
2c4f277cc9879495f2112bad4b7789ee

SHA1
c8db376a1a7d18f6c101529ab0c402d12411bb69

SHA256
fb42b13e7346e8aff0e8fa41b0a16a15f0a3afc59181946ae9c313331a5400d8

SHA512
ed2f02befacd9c5b3dee1750962652957b3b9e04622f0bdf27353a75155cf945c2301dccd50fe6dd9dbcf0b2e153516263d6f586b05031ccd526e7dd54f3abe7

Download Submit
\Windows\system\bYnheUS.exe

Filesize
1.7MB

MD5
541011c77a6213f3f5f682d71faab197

SHA1
6c2475168bfc41e86e972776eb227597cceede35

SHA256
9357260e4f8d83618926cabdeea8d7c03c1b1d83a81775ec49af18bef3a036b4

SHA512
67c7ae0806d3667e38f436d3f407cd4728510dced8887d4153c503b5ca2a13ec3b689cf5464ebfcc61da707075457655c54711ef188b64446e21c20abfacc66d

Download Submit
\Windows\system\bjmneXd.exe

Filesize
1.7MB

MD5
940b9bb1baa0ffedcbe2f5893852bb4c

SHA1
2ed05452de58fdb11f5faf0e0b2cc31df0358990

SHA256
095286550f88976e3d1afcf8a413ceedf7cb784e129fe351d05f3902cd136b31

SHA512
c41fb8946e675c148da56a1d73c1712a46f71fcd47b3f3ceda668cad0cb883bcd0527b5a4c2d029374eab25d3e60d0a39f3baaaf45e8a660eab46d4bc7199e83

Download Submit
\Windows\system\lcgJrlV.exe

Filesize
1.7MB

MD5
85afd35546f2b5acdd48dc0188bf3a90

SHA1
e8761d1857ab40cd97cf0a497640b7ab244a20a6

SHA256
4b9eead21b1e5f0ae7669e70108f5c02d0947480cb20a94e9e9d53b54cb3dd3f

SHA512
6e297c1c98f188b75bd47a4108078ae400b25f07b6dfc3a7db5637df8c72e231fd1bf439f96026674e2973e9d65642e1d8306d55ef7e621454eb19e50279e173

Download Submit
\Windows\system\tMuxQlD.exe

Filesize
1.7MB

MD5
4fd2484eeafd3f170f3ce54136b01156

SHA1
0d4179535e7fa96a3a2b92d567b2a2155c847a4b

SHA256
c49c4a058b777a61fdf78f9919e999c26323e22707a75d1d30bc34a61cc654c1

SHA512
5ff87331a4780c7ca2941b5ff95b80e6416f15009453eeaad1f200af0e56266652f009fc5a6517340791c35dd51fd8bf50c78f25a56b80ebf0cb819728839fdb

Download Submit
\Windows\system\tZdcqtX.exe

Filesize
1.7MB

MD5
450bad744880447f711d1df03dd97846

SHA1
402605e4f54fb40cee4088fdb408c9cac7b6c592

SHA256
2ed84fa0ac8a3b12d7bbce42e8aaf8105ff7902a17d05a93bcbe676c09a3b834

SHA512
603bbfabc0e13b00b815fb85523fcaf3b492a0719726894cf551d0704208486d0e638e3495e701504fc5798f60022608fdd0ee770c479de44ba31ad146662f90

Download Submit
\Windows\system\tibvIut.exe

Filesize
1.7MB

MD5
570f13e014e1ce60193a0532d9fda2ff

SHA1
2456c8e0d902b88d375d17f8723bbb4f8f571d1c

SHA256
71b9e8494270c2e5540bc91d8aa4b27c6faddea14e11565d0a53ab373696a703

SHA512
d5832892c303e417423f8e1d29a1e7aabc212bbc6b48ab1d62cb0c5fe4c4a603b30da516bc903a087424c7af2ceac41932674f9a0d4ce7d34d0ad6d98e2039ef

Download Submit
\Windows\system\wGTnFbQ.exe

Filesize
1.7MB

MD5
3e06c70785ec055f85c45cea31b87038

SHA1
7d7bdcb8390fa3c8dcccd5bbcb6dd90932b8095e

SHA256
0581cd496bd65751dadad3bb9873bd36ba6980719449491c19bbf3ce208c5aed

SHA512
6660afadf401889236def62479b143f33a5c24d603d7205b6fc8b17b9f01c2cba6bde36790da48de5f9a9c1f54c5a0306b02000ce5461ab280d32e19f6db884b

Download Submit
memory/1124-242-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/1216-232-0x0000000002B00000-0x0000000002B80000-memory.dmp

Filesize
512KB

Download
memory/1216-222-0x0000000002B00000-0x0000000002B80000-memory.dmp

Filesize
512KB

Download
memory/1216-221-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/1216-33-0x000000001B510000-0x000000001B7F2000-memory.dmp

Filesize
2.9MB

Download
memory/1216-243-0x0000000002B00000-0x0000000002B80000-memory.dmp

Filesize
512KB

Download
memory/1216-223-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/1216-322-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/1216-180-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2100-226-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-227-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2212-228-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-231-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-12-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/2212-233-0x0000000003340000-0x0000000003732000-memory.dmp

Filesize
3.9MB

Download
memory/2212-234-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2212-224-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2212-0-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2212-225-0x0000000003340000-0x0000000003732000-memory.dmp

Filesize
3.9MB

Download
memory/2212-239-0x0000000003340000-0x0000000003732000-memory.dmp

Filesize
3.9MB

Download
memory/2496-244-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2608-229-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-230-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2664-235-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download