xmrig | 3e07afa6658d4fab5ad640528e24a2844790ed67ad1c0c157bd9d6b2b3fb713c

Analysis

max time kernel
29s
max time network
30s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
Size

2.2MB
MD5

05dba6e00982480d75e209a9dc41c420
SHA1

216225e5828e8c9edfc968a25c85c5249ce7737a
SHA256

3e07afa6658d4fab5ad640528e24a2844790ed67ad1c0c157bd9d6b2b3fb713c
SHA512

65a7fd157de71527b220c882a3723105d0477288783796f09e38842dbbb92d6f3da622145fbae201bb3a40490ab7e8e261d7b590e5c0d6e0dfb0c54b50e8eac7
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfu:NABb

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2652-117-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2448-115-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2712-113-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	xmrig
behavioral1/memory/2772-111-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/2572-109-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/2864-108-0x0000000002FF0000-0x00000000033E2000-memory.dmp	xmrig
behavioral1/memory/2716-107-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2672-105-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
772	nZYIREs.exe
2400	avchbNJ.exe
2652	eCIDqok.exe
2672	dDUZSzZ.exe
2716	yVXnpCW.exe
2572	ZmYYaNa.exe
2772	DZgLlMu.exe
2712	QDQuxnw.exe
2448	pZPiplp.exe
2516	KNWNMsd.exe
2876	xneQckr.exe
2128	xDhUgXQ.exe
2320	fWXXLoz.exe
2752	MkqqcVz.exe
2896	InWmaQB.exe
804	YySLedt.exe
3048	HyeyKFm.exe
1436	iEcieQZ.exe
308	SXHcIqJ.exe
2440	RRRtBaH.exe
2420	AQmLJXD.exe
1612	kHGzTKw.exe
1684	YOOgYQD.exe
2124	gPQSyMH.exe
752	uqUuxgq.exe
1520	GYBedNX.exe
672	uJeeyzn.exe
652	UMKyzdb.exe
1080	ioWBNUo.exe
2552	zlEnsnH.exe
2132	GHOfzKM.exe
1552	ltjWBfD.exe
1908	UYYUZWB.exe
2428	hsFktMm.exe
2952	fuscGmI.exe
1616	uDvgMwJ.exe
2808	yTrpGHg.exe
1860	BEhpBaR.exe
912	CaRpNAF.exe
1700	SmyEEQM.exe
2156	HxALMSh.exe
1200	QCmOnar.exe
2988	MYBLnQh.exe
2996	HRSemfu.exe
1284	PJuNKom.exe
612	uqCMbeX.exe
2088	luDNchQ.exe
2164	tOndxZn.exe
948	AkrqBng.exe
1592	dcylgWS.exe
2380	IxudXbr.exe
2460	oKNWukG.exe
2596	ODJWWqe.exe
2964	hdqncDh.exe
2488	GdTdTvF.exe
564	EWETLYW.exe
2568	dJRXCwT.exe
2192	mryIcjt.exe
2020	zokGiOM.exe
2860	LQZzlbp.exe
332	aongWNc.exe
3004	zeKjwym.exe
2684	Xvskuve.exe
2920	ubXKWNi.exe

Loads dropped DLL 64 IoCs

pid	Process
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2864-0-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/files/0x000b00000001267a-3.dat	upx
behavioral1/memory/772-8-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/files/0x002b000000012721-9.dat	upx
behavioral1/files/0x000e0000000054ab-20.dat	upx
behavioral1/files/0x000900000001313f-18.dat	upx
behavioral1/files/0x000900000001332e-30.dat	upx
behavioral1/files/0x000a000000013413-44.dat	upx
behavioral1/files/0x000800000001340b-38.dat	upx
behavioral1/files/0x0006000000014312-63.dat	upx
behavioral1/files/0x0006000000014358-74.dat	upx
behavioral1/files/0x00060000000144e8-89.dat	upx
behavioral1/files/0x000600000001458c-93.dat	upx
behavioral1/files/0x0006000000014597-99.dat	upx
behavioral1/files/0x0006000000014826-144.dat	upx
behavioral1/files/0x0006000000014a9a-156.dat	upx
behavioral1/files/0x00060000000146fc-136.dat	upx
behavioral1/files/0x0006000000014b4c-167.dat	upx
behavioral1/files/0x000600000001471a-161.dat	upx
behavioral1/files/0x002b000000012747-124.dat	upx
behavioral1/files/0x0006000000014712-137.dat	upx
behavioral1/files/0x00060000000146f4-130.dat	upx
behavioral1/memory/2652-117-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2448-115-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/2712-113-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/memory/2772-111-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/2572-109-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/memory/2716-107-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2672-105-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/files/0x000600000001469d-121.dat	upx
behavioral1/files/0x0006000000014e71-179.dat	upx
behavioral1/files/0x000600000001535e-184.dat	upx
behavioral1/files/0x0006000000014b18-162.dat	upx
behavioral1/files/0x000600000001487f-153.dat	upx
behavioral1/files/0x000600000001443b-84.dat	upx
behavioral1/files/0x00060000000143e5-80.dat	upx
behavioral1/files/0x0006000000014326-70.dat	upx
behavioral1/files/0x000600000001564f-187.dat	upx
behavioral1/files/0x0006000000014fa2-180.dat	upx
behavioral1/files/0x0006000000014bbc-172.dat	upx
behavioral1/files/0x0006000000014246-59.dat	upx
behavioral1/files/0x0006000000014228-54.dat	upx
behavioral1/files/0x000900000001341c-48.dat	upx
behavioral1/memory/2400-23-0x000000013F170000-0x000000013F562000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rHjNddx.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\GMCHMnN.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\mMlgVRj.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\FOGXGAi.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\lMOcvSi.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\TMGmpkC.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\KePAiXS.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\QswkuFv.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\dPcbzxV.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\WVxJuMP.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\mWCejbv.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\umcqJVq.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\MOqPjPt.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\BNrVAkO.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\MdsuykO.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\vJKFCmm.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\ukceINI.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\BUyHAVP.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\MIspabI.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\oKCetRK.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\CMqVaeb.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\YcqtYOy.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\gKxHAXQ.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\thqNqAz.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\mYqrMkC.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\jGNASyf.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\ozCTlXL.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\EiNBHNV.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\XvYvqPq.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\nZYIREs.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\nFRarqc.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\NYMYZyt.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\PYYvqGb.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\AxteBBO.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\KtrFWvJ.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\abRZnfv.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\CeRKRwB.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\QGIOkMZ.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\hAYfYfa.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\GaNGHKa.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\djpHbrT.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\hlToocU.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\vXlNDQX.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\slvoWlf.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\zEucaby.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\vXxIbxe.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\hLSVlIV.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\EuSpbsb.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\GfmDfUM.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\SWVvxMp.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\eJRvQBX.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\elKFMmZ.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\PowrbgJ.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\PtyVGUc.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\BNfNMUs.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\kITuItY.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\IrBDQDk.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\frRNQgI.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\hdbjXya.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\pnMJvTv.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\maxorOY.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\TBuikRg.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\IXPyicJ.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
File created	C:\Windows\System\BENTFnU.exe	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2408	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
Token: SeDebugPrivilege	2408	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2408	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	29
PID 2864 wrote to memory of 2408	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	29
PID 2864 wrote to memory of 2408	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	29
PID 2864 wrote to memory of 772	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	30
PID 2864 wrote to memory of 772	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	30
PID 2864 wrote to memory of 772	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2400	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	31
PID 2864 wrote to memory of 2400	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	31
PID 2864 wrote to memory of 2400	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	31
PID 2864 wrote to memory of 2652	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	32
PID 2864 wrote to memory of 2652	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	32
PID 2864 wrote to memory of 2652	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	32
PID 2864 wrote to memory of 2672	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	33
PID 2864 wrote to memory of 2672	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	33
PID 2864 wrote to memory of 2672	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	33
PID 2864 wrote to memory of 2716	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	34
PID 2864 wrote to memory of 2716	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	34
PID 2864 wrote to memory of 2716	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	34
PID 2864 wrote to memory of 2572	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	35
PID 2864 wrote to memory of 2572	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	35
PID 2864 wrote to memory of 2572	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	35
PID 2864 wrote to memory of 2772	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	36
PID 2864 wrote to memory of 2772	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	36
PID 2864 wrote to memory of 2772	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	36
PID 2864 wrote to memory of 2712	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	37
PID 2864 wrote to memory of 2712	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	37
PID 2864 wrote to memory of 2712	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	37
PID 2864 wrote to memory of 2448	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	38
PID 2864 wrote to memory of 2448	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	38
PID 2864 wrote to memory of 2448	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	38
PID 2864 wrote to memory of 2516	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	39
PID 2864 wrote to memory of 2516	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	39
PID 2864 wrote to memory of 2516	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	39
PID 2864 wrote to memory of 2876	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	40
PID 2864 wrote to memory of 2876	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	40
PID 2864 wrote to memory of 2876	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	40
PID 2864 wrote to memory of 2128	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	41
PID 2864 wrote to memory of 2128	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	41
PID 2864 wrote to memory of 2128	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	41
PID 2864 wrote to memory of 2320	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	42
PID 2864 wrote to memory of 2320	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	42
PID 2864 wrote to memory of 2320	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	42
PID 2864 wrote to memory of 2752	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	43
PID 2864 wrote to memory of 2752	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	43
PID 2864 wrote to memory of 2752	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	43
PID 2864 wrote to memory of 2896	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	44
PID 2864 wrote to memory of 2896	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	44
PID 2864 wrote to memory of 2896	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	44
PID 2864 wrote to memory of 804	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	45
PID 2864 wrote to memory of 804	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	45
PID 2864 wrote to memory of 804	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	45
PID 2864 wrote to memory of 3048	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	46
PID 2864 wrote to memory of 3048	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	46
PID 2864 wrote to memory of 3048	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	46
PID 2864 wrote to memory of 1436	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	47
PID 2864 wrote to memory of 1436	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	47
PID 2864 wrote to memory of 1436	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	47
PID 2864 wrote to memory of 308	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	48
PID 2864 wrote to memory of 308	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	48
PID 2864 wrote to memory of 308	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	48
PID 2864 wrote to memory of 2440	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	49
PID 2864 wrote to memory of 2440	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	49
PID 2864 wrote to memory of 2440	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	49
PID 2864 wrote to memory of 2420	2864	05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05dba6e00982480d75e209a9dc41c420_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2408
- C:\Windows\System\nZYIREs.exe
  C:\Windows\System\nZYIREs.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\avchbNJ.exe
  C:\Windows\System\avchbNJ.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\eCIDqok.exe
  C:\Windows\System\eCIDqok.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\dDUZSzZ.exe
  C:\Windows\System\dDUZSzZ.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\yVXnpCW.exe
  C:\Windows\System\yVXnpCW.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\ZmYYaNa.exe
  C:\Windows\System\ZmYYaNa.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\DZgLlMu.exe
  C:\Windows\System\DZgLlMu.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\QDQuxnw.exe
  C:\Windows\System\QDQuxnw.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\pZPiplp.exe
  C:\Windows\System\pZPiplp.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\KNWNMsd.exe
  C:\Windows\System\KNWNMsd.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\xneQckr.exe
  C:\Windows\System\xneQckr.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\xDhUgXQ.exe
  C:\Windows\System\xDhUgXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\fWXXLoz.exe
  C:\Windows\System\fWXXLoz.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\MkqqcVz.exe
  C:\Windows\System\MkqqcVz.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\InWmaQB.exe
  C:\Windows\System\InWmaQB.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\YySLedt.exe
  C:\Windows\System\YySLedt.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\HyeyKFm.exe
  C:\Windows\System\HyeyKFm.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\iEcieQZ.exe
  C:\Windows\System\iEcieQZ.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\SXHcIqJ.exe
  C:\Windows\System\SXHcIqJ.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\RRRtBaH.exe
  C:\Windows\System\RRRtBaH.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\AQmLJXD.exe
  C:\Windows\System\AQmLJXD.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\kHGzTKw.exe
  C:\Windows\System\kHGzTKw.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\YOOgYQD.exe
  C:\Windows\System\YOOgYQD.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\GYBedNX.exe
  C:\Windows\System\GYBedNX.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\gPQSyMH.exe
  C:\Windows\System\gPQSyMH.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\uJeeyzn.exe
  C:\Windows\System\uJeeyzn.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\uqUuxgq.exe
  C:\Windows\System\uqUuxgq.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\ioWBNUo.exe
  C:\Windows\System\ioWBNUo.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\UMKyzdb.exe
  C:\Windows\System\UMKyzdb.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\UYYUZWB.exe
  C:\Windows\System\UYYUZWB.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\zlEnsnH.exe
  C:\Windows\System\zlEnsnH.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\hsFktMm.exe
  C:\Windows\System\hsFktMm.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\GHOfzKM.exe
  C:\Windows\System\GHOfzKM.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\fuscGmI.exe
  C:\Windows\System\fuscGmI.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\ltjWBfD.exe
  C:\Windows\System\ltjWBfD.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\uDvgMwJ.exe
  C:\Windows\System\uDvgMwJ.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\yTrpGHg.exe
  C:\Windows\System\yTrpGHg.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\BEhpBaR.exe
  C:\Windows\System\BEhpBaR.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\CaRpNAF.exe
  C:\Windows\System\CaRpNAF.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\HxALMSh.exe
  C:\Windows\System\HxALMSh.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\SmyEEQM.exe
  C:\Windows\System\SmyEEQM.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\QCmOnar.exe
  C:\Windows\System\QCmOnar.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\MYBLnQh.exe
  C:\Windows\System\MYBLnQh.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\uqCMbeX.exe
  C:\Windows\System\uqCMbeX.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\HRSemfu.exe
  C:\Windows\System\HRSemfu.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\luDNchQ.exe
  C:\Windows\System\luDNchQ.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\PJuNKom.exe
  C:\Windows\System\PJuNKom.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\tOndxZn.exe
  C:\Windows\System\tOndxZn.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\AkrqBng.exe
  C:\Windows\System\AkrqBng.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\dcylgWS.exe
  C:\Windows\System\dcylgWS.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\IxudXbr.exe
  C:\Windows\System\IxudXbr.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\oKNWukG.exe
  C:\Windows\System\oKNWukG.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\ODJWWqe.exe
  C:\Windows\System\ODJWWqe.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\hdqncDh.exe
  C:\Windows\System\hdqncDh.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\GdTdTvF.exe
  C:\Windows\System\GdTdTvF.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\EWETLYW.exe
  C:\Windows\System\EWETLYW.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\dJRXCwT.exe
  C:\Windows\System\dJRXCwT.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\mryIcjt.exe
  C:\Windows\System\mryIcjt.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\zokGiOM.exe
  C:\Windows\System\zokGiOM.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\LQZzlbp.exe
  C:\Windows\System\LQZzlbp.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\aongWNc.exe
  C:\Windows\System\aongWNc.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\zeKjwym.exe
  C:\Windows\System\zeKjwym.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\Xvskuve.exe
  C:\Windows\System\Xvskuve.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\YGkLbDa.exe
  C:\Windows\System\YGkLbDa.exe
  2⤵
  PID:1028
- C:\Windows\System\ubXKWNi.exe
  C:\Windows\System\ubXKWNi.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\lPWYVBw.exe
  C:\Windows\System\lPWYVBw.exe
  2⤵
  PID:1492
- C:\Windows\System\uvRSZEH.exe
  C:\Windows\System\uvRSZEH.exe
  2⤵
  PID:1484
- C:\Windows\System\mYqrMkC.exe
  C:\Windows\System\mYqrMkC.exe
  2⤵
  PID:1380
- C:\Windows\System\rhlTTFd.exe
  C:\Windows\System\rhlTTFd.exe
  2⤵
  PID:2756
- C:\Windows\System\UbBMpZO.exe
  C:\Windows\System\UbBMpZO.exe
  2⤵
  PID:3016
- C:\Windows\System\YqFGWpx.exe
  C:\Windows\System\YqFGWpx.exe
  2⤵
  PID:2196
- C:\Windows\System\SWVvxMp.exe
  C:\Windows\System\SWVvxMp.exe
  2⤵
  PID:2704
- C:\Windows\System\QrhQPCP.exe
  C:\Windows\System\QrhQPCP.exe
  2⤵
  PID:1336
- C:\Windows\System\iGYOkNq.exe
  C:\Windows\System\iGYOkNq.exe
  2⤵
  PID:1852
- C:\Windows\System\xCSbFuv.exe
  C:\Windows\System\xCSbFuv.exe
  2⤵
  PID:324
- C:\Windows\System\KSjHaqo.exe
  C:\Windows\System\KSjHaqo.exe
  2⤵
  PID:1924
- C:\Windows\System\QejdqsO.exe
  C:\Windows\System\QejdqsO.exe
  2⤵
  PID:1884
- C:\Windows\System\iomNfER.exe
  C:\Windows\System\iomNfER.exe
  2⤵
  PID:1920
- C:\Windows\System\kuZvWDK.exe
  C:\Windows\System\kuZvWDK.exe
  2⤵
  PID:3068
- C:\Windows\System\aoDGSdH.exe
  C:\Windows\System\aoDGSdH.exe
  2⤵
  PID:1472
- C:\Windows\System\PqCStIH.exe
  C:\Windows\System\PqCStIH.exe
  2⤵
  PID:2004
- C:\Windows\System\gXJkFoa.exe
  C:\Windows\System\gXJkFoa.exe
  2⤵
  PID:3060
- C:\Windows\System\Kaqkpbr.exe
  C:\Windows\System\Kaqkpbr.exe
  2⤵
  PID:1148
- C:\Windows\System\AHzbPTx.exe
  C:\Windows\System\AHzbPTx.exe
  2⤵
  PID:1664
- C:\Windows\System\LRbbwRS.exe
  C:\Windows\System\LRbbwRS.exe
  2⤵
  PID:2680
- C:\Windows\System\LHbFawP.exe
  C:\Windows\System\LHbFawP.exe
  2⤵
  PID:1272
- C:\Windows\System\AqZFsFa.exe
  C:\Windows\System\AqZFsFa.exe
  2⤵
  PID:756
- C:\Windows\System\oNdNaRu.exe
  C:\Windows\System\oNdNaRu.exe
  2⤵
  PID:1504
- C:\Windows\System\UcAXvFk.exe
  C:\Windows\System\UcAXvFk.exe
  2⤵
  PID:2076
- C:\Windows\System\SpAGhRf.exe
  C:\Windows\System\SpAGhRf.exe
  2⤵
  PID:2180
- C:\Windows\System\iVAEAqJ.exe
  C:\Windows\System\iVAEAqJ.exe
  2⤵
  PID:1872
- C:\Windows\System\hmODDWZ.exe
  C:\Windows\System\hmODDWZ.exe
  2⤵
  PID:2960
- C:\Windows\System\MrNZsBs.exe
  C:\Windows\System\MrNZsBs.exe
  2⤵
  PID:2644
- C:\Windows\System\ooOCMtY.exe
  C:\Windows\System\ooOCMtY.exe
  2⤵
  PID:1600
- C:\Windows\System\viAdrAz.exe
  C:\Windows\System\viAdrAz.exe
  2⤵
  PID:2840
- C:\Windows\System\YIFLeHx.exe
  C:\Windows\System\YIFLeHx.exe
  2⤵
  PID:2664
- C:\Windows\System\sYMXrzq.exe
  C:\Windows\System\sYMXrzq.exe
  2⤵
  PID:2980
- C:\Windows\System\OyzGFrF.exe
  C:\Windows\System\OyzGFrF.exe
  2⤵
  PID:2648
- C:\Windows\System\kyJodPr.exe
  C:\Windows\System\kyJodPr.exe
  2⤵
  PID:1512
- C:\Windows\System\OHFrhNf.exe
  C:\Windows\System\OHFrhNf.exe
  2⤵
  PID:2472
- C:\Windows\System\xcgpcxN.exe
  C:\Windows\System\xcgpcxN.exe
  2⤵
  PID:2456
- C:\Windows\System\qctfcmR.exe
  C:\Windows\System\qctfcmR.exe
  2⤵
  PID:2872
- C:\Windows\System\RQMmgOe.exe
  C:\Windows\System\RQMmgOe.exe
  2⤵
  PID:984
- C:\Windows\System\dvJqFfQ.exe
  C:\Windows\System\dvJqFfQ.exe
  2⤵
  PID:2892
- C:\Windows\System\CpyOwfs.exe
  C:\Windows\System\CpyOwfs.exe
  2⤵
  PID:2776
- C:\Windows\System\DMCEDiM.exe
  C:\Windows\System\DMCEDiM.exe
  2⤵
  PID:2768
- C:\Windows\System\iobeuYZ.exe
  C:\Windows\System\iobeuYZ.exe
  2⤵
  PID:1292
- C:\Windows\System\gWCuziG.exe
  C:\Windows\System\gWCuziG.exe
  2⤵
  PID:884
- C:\Windows\System\LZPGbQf.exe
  C:\Windows\System\LZPGbQf.exe
  2⤵
  PID:1828
- C:\Windows\System\rjFHCuR.exe
  C:\Windows\System\rjFHCuR.exe
  2⤵
  PID:2524
- C:\Windows\System\qfZvCiP.exe
  C:\Windows\System\qfZvCiP.exe
  2⤵
  PID:2564
- C:\Windows\System\himMQNI.exe
  C:\Windows\System\himMQNI.exe
  2⤵
  PID:2656
- C:\Windows\System\zvCgpOy.exe
  C:\Windows\System\zvCgpOy.exe
  2⤵
  PID:2732
- C:\Windows\System\HvQdJSg.exe
  C:\Windows\System\HvQdJSg.exe
  2⤵
  PID:2476
- C:\Windows\System\MelyGkC.exe
  C:\Windows\System\MelyGkC.exe
  2⤵
  PID:1620
- C:\Windows\System\TryVZSZ.exe
  C:\Windows\System\TryVZSZ.exe
  2⤵
  PID:2404
- C:\Windows\System\guMLELc.exe
  C:\Windows\System\guMLELc.exe
  2⤵
  PID:1900
- C:\Windows\System\nQDyDuZ.exe
  C:\Windows\System\nQDyDuZ.exe
  2⤵
  PID:452
- C:\Windows\System\aSEmRNH.exe
  C:\Windows\System\aSEmRNH.exe
  2⤵
  PID:1716
- C:\Windows\System\xPkFuNX.exe
  C:\Windows\System\xPkFuNX.exe
  2⤵
  PID:840
- C:\Windows\System\KYLvmvr.exe
  C:\Windows\System\KYLvmvr.exe
  2⤵
  PID:2280
- C:\Windows\System\YFONijp.exe
  C:\Windows\System\YFONijp.exe
  2⤵
  PID:1540
- C:\Windows\System\dxPkYmH.exe
  C:\Windows\System\dxPkYmH.exe
  2⤵
  PID:1808
- C:\Windows\System\XDDIlAw.exe
  C:\Windows\System\XDDIlAw.exe
  2⤵
  PID:2788
- C:\Windows\System\OTvCcGr.exe
  C:\Windows\System\OTvCcGr.exe
  2⤵
  PID:2804
- C:\Windows\System\jGNASyf.exe
  C:\Windows\System\jGNASyf.exe
  2⤵
  PID:1340
- C:\Windows\System\qvofRYv.exe
  C:\Windows\System\qvofRYv.exe
  2⤵
  PID:1812
- C:\Windows\System\dwerrFY.exe
  C:\Windows\System\dwerrFY.exe
  2⤵
  PID:1696
- C:\Windows\System\fTVorul.exe
  C:\Windows\System\fTVorul.exe
  2⤵
  PID:1544
- C:\Windows\System\gfJghjK.exe
  C:\Windows\System\gfJghjK.exe
  2⤵
  PID:2244
- C:\Windows\System\lkDOVBI.exe
  C:\Windows\System\lkDOVBI.exe
  2⤵
  PID:2728
- C:\Windows\System\mbwgFkB.exe
  C:\Windows\System\mbwgFkB.exe
  2⤵
  PID:3064
- C:\Windows\System\YsULweK.exe
  C:\Windows\System\YsULweK.exe
  2⤵
  PID:1888
- C:\Windows\System\VOUDlMr.exe
  C:\Windows\System\VOUDlMr.exe
  2⤵
  PID:2928
- C:\Windows\System\kpWnnBZ.exe
  C:\Windows\System\kpWnnBZ.exe
  2⤵
  PID:2576
- C:\Windows\System\lMOcvSi.exe
  C:\Windows\System\lMOcvSi.exe
  2⤵
  PID:1032
- C:\Windows\System\JuLZRXx.exe
  C:\Windows\System\JuLZRXx.exe
  2⤵
  PID:1704
- C:\Windows\System\GSnkXXz.exe
  C:\Windows\System\GSnkXXz.exe
  2⤵
  PID:2152
- C:\Windows\System\FszSnFz.exe
  C:\Windows\System\FszSnFz.exe
  2⤵
  PID:1980
- C:\Windows\System\UWghFoF.exe
  C:\Windows\System\UWghFoF.exe
  2⤵
  PID:1772
- C:\Windows\System\tqproCR.exe
  C:\Windows\System\tqproCR.exe
  2⤵
  PID:2348
- C:\Windows\System\mZMCTvs.exe
  C:\Windows\System\mZMCTvs.exe
  2⤵
  PID:2120
- C:\Windows\System\ensRKRg.exe
  C:\Windows\System\ensRKRg.exe
  2⤵
  PID:2708
- C:\Windows\System\XCJRggs.exe
  C:\Windows\System\XCJRggs.exe
  2⤵
  PID:3008
- C:\Windows\System\kYsFRQZ.exe
  C:\Windows\System\kYsFRQZ.exe
  2⤵
  PID:2724
- C:\Windows\System\uqLCHJu.exe
  C:\Windows\System\uqLCHJu.exe
  2⤵
  PID:1680
- C:\Windows\System\ebVwGiI.exe
  C:\Windows\System\ebVwGiI.exe
  2⤵
  PID:2696
- C:\Windows\System\auzfSUl.exe
  C:\Windows\System\auzfSUl.exe
  2⤵
  PID:2632
- C:\Windows\System\bqAAZgc.exe
  C:\Windows\System\bqAAZgc.exe
  2⤵
  PID:1036
- C:\Windows\System\xMkdATL.exe
  C:\Windows\System\xMkdATL.exe
  2⤵
  PID:1712
- C:\Windows\System\FYXlllL.exe
  C:\Windows\System\FYXlllL.exe
  2⤵
  PID:2944
- C:\Windows\System\BKFhyjU.exe
  C:\Windows\System\BKFhyjU.exe
  2⤵
  PID:992
- C:\Windows\System\LjIeVVb.exe
  C:\Windows\System\LjIeVVb.exe
  2⤵
  PID:1476
- C:\Windows\System\PpWPiPa.exe
  C:\Windows\System\PpWPiPa.exe
  2⤵
  PID:892
- C:\Windows\System\eklCJRn.exe
  C:\Windows\System\eklCJRn.exe
  2⤵
  PID:2220
- C:\Windows\System\RCJfKkK.exe
  C:\Windows\System\RCJfKkK.exe
  2⤵
  PID:2484
- C:\Windows\System\cyeqHuU.exe
  C:\Windows\System\cyeqHuU.exe
  2⤵
  PID:304
- C:\Windows\System\lRKGgkj.exe
  C:\Windows\System\lRKGgkj.exe
  2⤵
  PID:2608
- C:\Windows\System\RJXmuRM.exe
  C:\Windows\System\RJXmuRM.exe
  2⤵
  PID:808
- C:\Windows\System\bchwdwa.exe
  C:\Windows\System\bchwdwa.exe
  2⤵
  PID:1896
- C:\Windows\System\IfhBsLW.exe
  C:\Windows\System\IfhBsLW.exe
  2⤵
  PID:2412
- C:\Windows\System\JyCkmyA.exe
  C:\Windows\System\JyCkmyA.exe
  2⤵
  PID:1252
- C:\Windows\System\nDvCaFu.exe
  C:\Windows\System\nDvCaFu.exe
  2⤵
  PID:1044
- C:\Windows\System\lNrRHhh.exe
  C:\Windows\System\lNrRHhh.exe
  2⤵
  PID:1500
- C:\Windows\System\RxmBzhG.exe
  C:\Windows\System\RxmBzhG.exe
  2⤵
  PID:1996
- C:\Windows\System\HFQbHtn.exe
  C:\Windows\System\HFQbHtn.exe
  2⤵
  PID:3052
- C:\Windows\System\SrqTzgh.exe
  C:\Windows\System\SrqTzgh.exe
  2⤵
  PID:2744
- C:\Windows\System\kxLOIaT.exe
  C:\Windows\System\kxLOIaT.exe
  2⤵
  PID:2736
- C:\Windows\System\otFyghR.exe
  C:\Windows\System\otFyghR.exe
  2⤵
  PID:2424
- C:\Windows\System\dmHOoTg.exe
  C:\Windows\System\dmHOoTg.exe
  2⤵
  PID:2016
- C:\Windows\System\kNrGsuU.exe
  C:\Windows\System\kNrGsuU.exe
  2⤵
  PID:1576
- C:\Windows\System\ATNncWa.exe
  C:\Windows\System\ATNncWa.exe
  2⤵
  PID:2228
- C:\Windows\System\YYZiVfr.exe
  C:\Windows\System\YYZiVfr.exe
  2⤵
  PID:1256
- C:\Windows\System\dOZjvXf.exe
  C:\Windows\System\dOZjvXf.exe
  2⤵
  PID:2984
- C:\Windows\System\jCwriAx.exe
  C:\Windows\System\jCwriAx.exe
  2⤵
  PID:1596
- C:\Windows\System\oxDLyyZ.exe
  C:\Windows\System\oxDLyyZ.exe
  2⤵
  PID:1988
- C:\Windows\System\bgIopNt.exe
  C:\Windows\System\bgIopNt.exe
  2⤵
  PID:2624
- C:\Windows\System\NqXdfUu.exe
  C:\Windows\System\NqXdfUu.exe
  2⤵
  PID:3084
- C:\Windows\System\wQhdPLp.exe
  C:\Windows\System\wQhdPLp.exe
  2⤵
  PID:3100
- C:\Windows\System\klKzkrF.exe
  C:\Windows\System\klKzkrF.exe
  2⤵
  PID:3128
- C:\Windows\System\xBUUkFS.exe
  C:\Windows\System\xBUUkFS.exe
  2⤵
  PID:3152
- C:\Windows\System\obHkdEt.exe
  C:\Windows\System\obHkdEt.exe
  2⤵
  PID:3168
- C:\Windows\System\ZtQxwzq.exe
  C:\Windows\System\ZtQxwzq.exe
  2⤵
  PID:3184
- C:\Windows\System\DEhbPPn.exe
  C:\Windows\System\DEhbPPn.exe
  2⤵
  PID:3200
- C:\Windows\System\SzYiGVc.exe
  C:\Windows\System\SzYiGVc.exe
  2⤵
  PID:3216
- C:\Windows\System\STcquVw.exe
  C:\Windows\System\STcquVw.exe
  2⤵
  PID:3232
- C:\Windows\System\TFPLsUF.exe
  C:\Windows\System\TFPLsUF.exe
  2⤵
  PID:3248
- C:\Windows\System\IEjMyHM.exe
  C:\Windows\System\IEjMyHM.exe
  2⤵
  PID:3268
- C:\Windows\System\mNJBcAV.exe
  C:\Windows\System\mNJBcAV.exe
  2⤵
  PID:3284
- C:\Windows\System\WozfPzp.exe
  C:\Windows\System\WozfPzp.exe
  2⤵
  PID:3300
- C:\Windows\System\ARONZJs.exe
  C:\Windows\System\ARONZJs.exe
  2⤵
  PID:3316
- C:\Windows\System\OtNcdUZ.exe
  C:\Windows\System\OtNcdUZ.exe
  2⤵
  PID:3332
- C:\Windows\System\uwGsPOp.exe
  C:\Windows\System\uwGsPOp.exe
  2⤵
  PID:3348
- C:\Windows\System\zvGNnHn.exe
  C:\Windows\System\zvGNnHn.exe
  2⤵
  PID:3416
- C:\Windows\System\UEubIPJ.exe
  C:\Windows\System\UEubIPJ.exe
  2⤵
  PID:3436
- C:\Windows\System\rYpDrkY.exe
  C:\Windows\System\rYpDrkY.exe
  2⤵
  PID:3452
- C:\Windows\System\OexbWVn.exe
  C:\Windows\System\OexbWVn.exe
  2⤵
  PID:3472
- C:\Windows\System\cSDAQkZ.exe
  C:\Windows\System\cSDAQkZ.exe
  2⤵
  PID:3488
- C:\Windows\System\eJRvQBX.exe
  C:\Windows\System\eJRvQBX.exe
  2⤵
  PID:3504
- C:\Windows\System\TqIPomm.exe
  C:\Windows\System\TqIPomm.exe
  2⤵
  PID:3520
- C:\Windows\System\sXEUXHY.exe
  C:\Windows\System\sXEUXHY.exe
  2⤵
  PID:3536
- C:\Windows\System\HqemzDi.exe
  C:\Windows\System\HqemzDi.exe
  2⤵
  PID:3552
- C:\Windows\System\xuJisNV.exe
  C:\Windows\System\xuJisNV.exe
  2⤵
  PID:3572
- C:\Windows\System\OpoFrNM.exe
  C:\Windows\System\OpoFrNM.exe
  2⤵
  PID:3588
- C:\Windows\System\WhvCrWD.exe
  C:\Windows\System\WhvCrWD.exe
  2⤵
  PID:3604
- C:\Windows\System\sISqHdF.exe
  C:\Windows\System\sISqHdF.exe
  2⤵
  PID:3620
- C:\Windows\System\qtRTWPz.exe
  C:\Windows\System\qtRTWPz.exe
  2⤵
  PID:3636
- C:\Windows\System\MUwItXA.exe
  C:\Windows\System\MUwItXA.exe
  2⤵
  PID:3652
- C:\Windows\System\oQmypjs.exe
  C:\Windows\System\oQmypjs.exe
  2⤵
  PID:3668
- C:\Windows\System\cNbEmkQ.exe
  C:\Windows\System\cNbEmkQ.exe
  2⤵
  PID:3688
- C:\Windows\System\elKFMmZ.exe
  C:\Windows\System\elKFMmZ.exe
  2⤵
  PID:3796
- C:\Windows\System\WMHKBlu.exe
  C:\Windows\System\WMHKBlu.exe
  2⤵
  PID:3816
- C:\Windows\System\OGvWMNy.exe
  C:\Windows\System\OGvWMNy.exe
  2⤵
  PID:3840
- C:\Windows\System\VrTISBk.exe
  C:\Windows\System\VrTISBk.exe
  2⤵
  PID:3856
- C:\Windows\System\RgdHWwp.exe
  C:\Windows\System\RgdHWwp.exe
  2⤵
  PID:3872
- C:\Windows\System\PHzSYiq.exe
  C:\Windows\System\PHzSYiq.exe
  2⤵
  PID:3888
- C:\Windows\System\XIPNHyz.exe
  C:\Windows\System\XIPNHyz.exe
  2⤵
  PID:3904
- C:\Windows\System\rhmVJEB.exe
  C:\Windows\System\rhmVJEB.exe
  2⤵
  PID:3920
- C:\Windows\System\yyEZoGV.exe
  C:\Windows\System\yyEZoGV.exe
  2⤵
  PID:3936
- C:\Windows\System\UsnSMyt.exe
  C:\Windows\System\UsnSMyt.exe
  2⤵
  PID:3952
- C:\Windows\System\sMoXcBI.exe
  C:\Windows\System\sMoXcBI.exe
  2⤵
  PID:3968
- C:\Windows\System\ZvuEIGM.exe
  C:\Windows\System\ZvuEIGM.exe
  2⤵
  PID:3988
- C:\Windows\System\yaGVNOO.exe
  C:\Windows\System\yaGVNOO.exe
  2⤵
  PID:4004
- C:\Windows\System\DDbAiuT.exe
  C:\Windows\System\DDbAiuT.exe
  2⤵
  PID:4020
- C:\Windows\System\CXaPpHr.exe
  C:\Windows\System\CXaPpHr.exe
  2⤵
  PID:4036
- C:\Windows\System\gWPHlWj.exe
  C:\Windows\System\gWPHlWj.exe
  2⤵
  PID:4052
- C:\Windows\System\zXvpmMI.exe
  C:\Windows\System\zXvpmMI.exe
  2⤵
  PID:4068
- C:\Windows\System\ttndhVy.exe
  C:\Windows\System\ttndhVy.exe
  2⤵
  PID:4088
- C:\Windows\System\MRFiBWq.exe
  C:\Windows\System\MRFiBWq.exe
  2⤵
  PID:1880
- C:\Windows\System\NpairwB.exe
  C:\Windows\System\NpairwB.exe
  2⤵
  PID:3080
- C:\Windows\System\FkPWSuV.exe
  C:\Windows\System\FkPWSuV.exe
  2⤵
  PID:3112
- C:\Windows\System\bSCvyfg.exe
  C:\Windows\System\bSCvyfg.exe
  2⤵
  PID:3092
- C:\Windows\System\YvYtUbH.exe
  C:\Windows\System\YvYtUbH.exe
  2⤵
  PID:3176
- C:\Windows\System\MwZUseT.exe
  C:\Windows\System\MwZUseT.exe
  2⤵
  PID:3244
- C:\Windows\System\XxouPyT.exe
  C:\Windows\System\XxouPyT.exe
  2⤵
  PID:3308
- C:\Windows\System\KvrbAaf.exe
  C:\Windows\System\KvrbAaf.exe
  2⤵
  PID:3180
- C:\Windows\System\ussAOvX.exe
  C:\Windows\System\ussAOvX.exe
  2⤵
  PID:3460
- C:\Windows\System\AicLJve.exe
  C:\Windows\System\AicLJve.exe
  2⤵
  PID:3368
- C:\Windows\System\CHNGzON.exe
  C:\Windows\System\CHNGzON.exe
  2⤵
  PID:3264
- C:\Windows\System\XZNnBUM.exe
  C:\Windows\System\XZNnBUM.exe
  2⤵
  PID:3328
- C:\Windows\System\eDpXtgV.exe
  C:\Windows\System\eDpXtgV.exe
  2⤵
  PID:3164
- C:\Windows\System\LQTqgUC.exe
  C:\Windows\System\LQTqgUC.exe
  2⤵
  PID:3528
- C:\Windows\System\tlaQfQD.exe
  C:\Windows\System\tlaQfQD.exe
  2⤵
  PID:3596
- C:\Windows\System\nKpvjwP.exe
  C:\Windows\System\nKpvjwP.exe
  2⤵
  PID:3664
- C:\Windows\System\uTqCaxT.exe
  C:\Windows\System\uTqCaxT.exe
  2⤵
  PID:3716
- C:\Windows\System\DVmAsKb.exe
  C:\Windows\System\DVmAsKb.exe
  2⤵
  PID:3728
- C:\Windows\System\RimHjMX.exe
  C:\Windows\System\RimHjMX.exe
  2⤵
  PID:3372
- C:\Windows\System\pEfyewi.exe
  C:\Windows\System\pEfyewi.exe
  2⤵
  PID:3384
- C:\Windows\System\rlAzGDq.exe
  C:\Windows\System\rlAzGDq.exe
  2⤵
  PID:3708
- C:\Windows\System\NhWcYQG.exe
  C:\Windows\System\NhWcYQG.exe
  2⤵
  PID:3396
- C:\Windows\System\VpwWCQm.exe
  C:\Windows\System\VpwWCQm.exe
  2⤵
  PID:3408
- C:\Windows\System\IejCWzl.exe
  C:\Windows\System\IejCWzl.exe
  2⤵
  PID:3516
- C:\Windows\System\WjrgjQW.exe
  C:\Windows\System\WjrgjQW.exe
  2⤵
  PID:3584
- C:\Windows\System\DzQhtHE.exe
  C:\Windows\System\DzQhtHE.exe
  2⤵
  PID:3648
- C:\Windows\System\UghVIub.exe
  C:\Windows\System\UghVIub.exe
  2⤵
  PID:3776
- C:\Windows\System\YWFZWFB.exe
  C:\Windows\System\YWFZWFB.exe
  2⤵
  PID:3448
- C:\Windows\System\HjKWEOa.exe
  C:\Windows\System\HjKWEOa.exe
  2⤵
  PID:3468
- C:\Windows\System\TSbSvEL.exe
  C:\Windows\System\TSbSvEL.exe
  2⤵
  PID:4064
- C:\Windows\System\cMnYdbZ.exe
  C:\Windows\System\cMnYdbZ.exe
  2⤵
  PID:3260
- C:\Windows\System\HfBBZoJ.exe
  C:\Windows\System\HfBBZoJ.exe
  2⤵
  PID:4080
- C:\Windows\System\vFHUPNm.exe
  C:\Windows\System\vFHUPNm.exe
  2⤵
  PID:3632
- C:\Windows\System\ZshoUKk.exe
  C:\Windows\System\ZshoUKk.exe
  2⤵
  PID:3884
- C:\Windows\System\DDUBhsB.exe
  C:\Windows\System\DDUBhsB.exe
  2⤵
  PID:3948
- C:\Windows\System\ufwqjkt.exe
  C:\Windows\System\ufwqjkt.exe
  2⤵
  PID:3980
- C:\Windows\System\lmkKxLV.exe
  C:\Windows\System\lmkKxLV.exe
  2⤵
  PID:4044
- C:\Windows\System\UFrdyYt.exe
  C:\Windows\System\UFrdyYt.exe
  2⤵
  PID:4084
- C:\Windows\System\BMoHzDH.exe
  C:\Windows\System\BMoHzDH.exe
  2⤵
  PID:1640
- C:\Windows\System\NdYMynT.exe
  C:\Windows\System\NdYMynT.exe
  2⤵
  PID:3296
- C:\Windows\System\PoTqxvn.exe
  C:\Windows\System\PoTqxvn.exe
  2⤵
  PID:3724
- C:\Windows\System\gZDxOfu.exe
  C:\Windows\System\gZDxOfu.exe
  2⤵
  PID:3484
- C:\Windows\System\MROTPxP.exe
  C:\Windows\System\MROTPxP.exe
  2⤵
  PID:3700
- C:\Windows\System\iRBpTJD.exe
  C:\Windows\System\iRBpTJD.exe
  2⤵
  PID:3836
- C:\Windows\System\GFDSNGZ.exe
  C:\Windows\System\GFDSNGZ.exe
  2⤵
  PID:3964
- C:\Windows\System\HPkUoMe.exe
  C:\Windows\System\HPkUoMe.exe
  2⤵
  PID:3900
- C:\Windows\System\DNLSYbo.exe
  C:\Windows\System\DNLSYbo.exe
  2⤵
  PID:3148
- C:\Windows\System\BrRPwaw.exe
  C:\Windows\System\BrRPwaw.exe
  2⤵
  PID:3932
- C:\Windows\System\BPPBGsa.exe
  C:\Windows\System\BPPBGsa.exe
  2⤵
  PID:3360
- C:\Windows\System\SzKyxHf.exe
  C:\Windows\System\SzKyxHf.exe
  2⤵
  PID:3532
- C:\Windows\System\WhxMDrw.exe
  C:\Windows\System\WhxMDrw.exe
  2⤵
  PID:3748
- C:\Windows\System\gberdzm.exe
  C:\Windows\System\gberdzm.exe
  2⤵
  PID:4032
- C:\Windows\System\GKRdeJg.exe
  C:\Windows\System\GKRdeJg.exe
  2⤵
  PID:4100
- C:\Windows\System\IxALSum.exe
  C:\Windows\System\IxALSum.exe
  2⤵
  PID:4116
- C:\Windows\System\rHjNddx.exe
  C:\Windows\System\rHjNddx.exe
  2⤵
  PID:4132
- C:\Windows\System\IPggnXV.exe
  C:\Windows\System\IPggnXV.exe
  2⤵
  PID:4148
- C:\Windows\System\cSbBMuK.exe
  C:\Windows\System\cSbBMuK.exe
  2⤵
  PID:4168
- C:\Windows\System\bspygsO.exe
  C:\Windows\System\bspygsO.exe
  2⤵
  PID:4184
- C:\Windows\System\VAfitTa.exe
  C:\Windows\System\VAfitTa.exe
  2⤵
  PID:4200
- C:\Windows\System\iylWtqb.exe
  C:\Windows\System\iylWtqb.exe
  2⤵
  PID:4216
- C:\Windows\System\zAJeqCZ.exe
  C:\Windows\System\zAJeqCZ.exe
  2⤵
  PID:4232
- C:\Windows\System\EpZeSYM.exe
  C:\Windows\System\EpZeSYM.exe
  2⤵
  PID:4252
- C:\Windows\System\SXsMEda.exe
  C:\Windows\System\SXsMEda.exe
  2⤵
  PID:4268
- C:\Windows\System\cOmRLMX.exe
  C:\Windows\System\cOmRLMX.exe
  2⤵
  PID:4284
- C:\Windows\System\XZyDJtm.exe
  C:\Windows\System\XZyDJtm.exe
  2⤵
  PID:4300
- C:\Windows\System\NdYXinp.exe
  C:\Windows\System\NdYXinp.exe
  2⤵
  PID:4316
- C:\Windows\System\ezLYFDL.exe
  C:\Windows\System\ezLYFDL.exe
  2⤵
  PID:4332
- C:\Windows\System\dDuEudM.exe
  C:\Windows\System\dDuEudM.exe
  2⤵
  PID:4348
- C:\Windows\System\zLSOpBm.exe
  C:\Windows\System\zLSOpBm.exe
  2⤵
  PID:4368
- C:\Windows\System\KxQAZqF.exe
  C:\Windows\System\KxQAZqF.exe
  2⤵
  PID:4384
- C:\Windows\System\JYWLFrw.exe
  C:\Windows\System\JYWLFrw.exe
  2⤵
  PID:4400
- C:\Windows\System\OvotBJF.exe
  C:\Windows\System\OvotBJF.exe
  2⤵
  PID:4416
- C:\Windows\System\PeUNpVl.exe
  C:\Windows\System\PeUNpVl.exe
  2⤵
  PID:4432
- C:\Windows\System\VbPYnXS.exe
  C:\Windows\System\VbPYnXS.exe
  2⤵
  PID:4448
- C:\Windows\System\rCBPvHZ.exe
  C:\Windows\System\rCBPvHZ.exe
  2⤵
  PID:4464
- C:\Windows\System\bbwYzxX.exe
  C:\Windows\System\bbwYzxX.exe
  2⤵
  PID:4484
- C:\Windows\System\HjWNZza.exe
  C:\Windows\System\HjWNZza.exe
  2⤵
  PID:4500
- C:\Windows\System\imhIuhm.exe
  C:\Windows\System\imhIuhm.exe
  2⤵
  PID:4516
- C:\Windows\System\xSloIHU.exe
  C:\Windows\System\xSloIHU.exe
  2⤵
  PID:4532
- C:\Windows\System\IXPyicJ.exe
  C:\Windows\System\IXPyicJ.exe
  2⤵
  PID:4548
- C:\Windows\System\gVkJPyL.exe
  C:\Windows\System\gVkJPyL.exe
  2⤵
  PID:4564
- C:\Windows\System\LEAnKPK.exe
  C:\Windows\System\LEAnKPK.exe
  2⤵
  PID:4580
- C:\Windows\System\YEUzLlg.exe
  C:\Windows\System\YEUzLlg.exe
  2⤵
  PID:4596
- C:\Windows\System\SgSdLRU.exe
  C:\Windows\System\SgSdLRU.exe
  2⤵
  PID:4616
- C:\Windows\System\PMMTuVO.exe
  C:\Windows\System\PMMTuVO.exe
  2⤵
  PID:4636
- C:\Windows\System\wmeqgxT.exe
  C:\Windows\System\wmeqgxT.exe
  2⤵
  PID:4652
- C:\Windows\System\XgayaZa.exe
  C:\Windows\System\XgayaZa.exe
  2⤵
  PID:4668
- C:\Windows\System\dDqLLuM.exe
  C:\Windows\System\dDqLLuM.exe
  2⤵
  PID:4684
- C:\Windows\System\uJOQjNW.exe
  C:\Windows\System\uJOQjNW.exe
  2⤵
  PID:4700
- C:\Windows\System\pUAabvd.exe
  C:\Windows\System\pUAabvd.exe
  2⤵
  PID:4832
- C:\Windows\System\NxCgDqv.exe
  C:\Windows\System\NxCgDqv.exe
  2⤵
  PID:4856
- C:\Windows\System\FDXDMQQ.exe
  C:\Windows\System\FDXDMQQ.exe
  2⤵
  PID:4884
- C:\Windows\System\SfFzhNB.exe
  C:\Windows\System\SfFzhNB.exe
  2⤵
  PID:4928
- C:\Windows\System\WdiodfW.exe
  C:\Windows\System\WdiodfW.exe
  2⤵
  PID:4968
- C:\Windows\System\ncoKgxn.exe
  C:\Windows\System\ncoKgxn.exe
  2⤵
  PID:4992
- C:\Windows\System\pnMJvTv.exe
  C:\Windows\System\pnMJvTv.exe
  2⤵
  PID:5060
- C:\Windows\System\ZjGyujF.exe
  C:\Windows\System\ZjGyujF.exe
  2⤵
  PID:5080
- C:\Windows\System\YkKGLpc.exe
  C:\Windows\System\YkKGLpc.exe
  2⤵
  PID:5100
- C:\Windows\System\VLOuqHh.exe
  C:\Windows\System\VLOuqHh.exe
  2⤵
  PID:3076
- C:\Windows\System\NkohDfz.exe
  C:\Windows\System\NkohDfz.exe
  2⤵
  PID:4124
- C:\Windows\System\FOkDDqz.exe
  C:\Windows\System\FOkDDqz.exe
  2⤵
  PID:4192
- C:\Windows\System\swtxrkH.exe
  C:\Windows\System\swtxrkH.exe
  2⤵
  PID:4296
- C:\Windows\System\aVMYUHs.exe
  C:\Windows\System\aVMYUHs.exe
  2⤵
  PID:4364
- C:\Windows\System\KqbChwA.exe
  C:\Windows\System\KqbChwA.exe
  2⤵
  PID:4524
- C:\Windows\System\IbcqJab.exe
  C:\Windows\System\IbcqJab.exe
  2⤵
  PID:4588
- C:\Windows\System\KQzCmFF.exe
  C:\Windows\System\KQzCmFF.exe
  2⤵
  PID:4660
- C:\Windows\System\YSGiHOU.exe
  C:\Windows\System\YSGiHOU.exe
  2⤵
  PID:3192
- C:\Windows\System\XdiWAIl.exe
  C:\Windows\System\XdiWAIl.exe
  2⤵
  PID:4376
- C:\Windows\System\qQTxxUP.exe
  C:\Windows\System\qQTxxUP.exe
  2⤵
  PID:4480
- C:\Windows\System\ZdCHEHr.exe
  C:\Windows\System\ZdCHEHr.exe
  2⤵
  PID:4612
- C:\Windows\System\kKKMevH.exe
  C:\Windows\System\kKKMevH.exe
  2⤵
  PID:3680
- C:\Windows\System\dnvvnGj.exe
  C:\Windows\System\dnvvnGj.exe
  2⤵
  PID:3880
- C:\Windows\System\JycAtEa.exe
  C:\Windows\System\JycAtEa.exe
  2⤵
  PID:3344
- C:\Windows\System\WRcesoq.exe
  C:\Windows\System\WRcesoq.exe
  2⤵
  PID:3832
- C:\Windows\System\mopkNKA.exe
  C:\Windows\System\mopkNKA.exe
  2⤵
  PID:3432
- C:\Windows\System\OjmgHyu.exe
  C:\Windows\System\OjmgHyu.exe
  2⤵
  PID:4176
- C:\Windows\System\PKihcZi.exe
  C:\Windows\System\PKihcZi.exe
  2⤵
  PID:4276
- C:\Windows\System\BkyJpVP.exe
  C:\Windows\System\BkyJpVP.exe
  2⤵
  PID:4476
- C:\Windows\System\nFsCxxB.exe
  C:\Windows\System\nFsCxxB.exe
  2⤵
  PID:4716
- C:\Windows\System\zYNAuke.exe
  C:\Windows\System\zYNAuke.exe
  2⤵
  PID:4692
- C:\Windows\System\QInbtMw.exe
  C:\Windows\System\QInbtMw.exe
  2⤵
  PID:4732
- C:\Windows\System\rOPBQyh.exe
  C:\Windows\System\rOPBQyh.exe
  2⤵
  PID:4752
- C:\Windows\System\yoUbsrm.exe
  C:\Windows\System\yoUbsrm.exe
  2⤵
  PID:4756
- C:\Windows\System\OVlImwm.exe
  C:\Windows\System\OVlImwm.exe
  2⤵
  PID:4792
- C:\Windows\System\ZrMhTqr.exe
  C:\Windows\System\ZrMhTqr.exe
  2⤵
  PID:4800
- C:\Windows\System\XQZmVUN.exe
  C:\Windows\System\XQZmVUN.exe
  2⤵
  PID:4816
- C:\Windows\System\eKapAAe.exe
  C:\Windows\System\eKapAAe.exe
  2⤵
  PID:4820
- C:\Windows\System\FlJyZLl.exe
  C:\Windows\System\FlJyZLl.exe
  2⤵
  PID:3116
- C:\Windows\System\zZvKrys.exe
  C:\Windows\System\zZvKrys.exe
  2⤵
  PID:4876
- C:\Windows\System\vYQrulO.exe
  C:\Windows\System\vYQrulO.exe
  2⤵
  PID:4920
- C:\Windows\System\mXHwAsx.exe
  C:\Windows\System\mXHwAsx.exe
  2⤵
  PID:4924
- C:\Windows\System\kITuItY.exe
  C:\Windows\System\kITuItY.exe
  2⤵
  PID:4956
- C:\Windows\System\voaaVzP.exe
  C:\Windows\System\voaaVzP.exe
  2⤵
  PID:5076
- C:\Windows\System\hClYtAH.exe
  C:\Windows\System\hClYtAH.exe
  2⤵
  PID:3340
- C:\Windows\System\nnFBdll.exe
  C:\Windows\System\nnFBdll.exe
  2⤵
  PID:3916
- C:\Windows\System\UGEyOcs.exe
  C:\Windows\System\UGEyOcs.exe
  2⤵
  PID:4156
- C:\Windows\System\sJBsyJa.exe
  C:\Windows\System\sJBsyJa.exe
  2⤵
  PID:3120
- C:\Windows\System\cDpJVaH.exe
  C:\Windows\System\cDpJVaH.exe
  2⤵
  PID:3140
- C:\Windows\System\zmxHYgz.exe
  C:\Windows\System\zmxHYgz.exe
  2⤵
  PID:3124
- C:\Windows\System\bKIRrHB.exe
  C:\Windows\System\bKIRrHB.exe
  2⤵
  PID:4228
- C:\Windows\System\qQhpBlM.exe
  C:\Windows\System\qQhpBlM.exe
  2⤵
  PID:4264
- C:\Windows\System\ZIHanUo.exe
  C:\Windows\System\ZIHanUo.exe
  2⤵
  PID:4396
- C:\Windows\System\OaIgLvU.exe
  C:\Windows\System\OaIgLvU.exe
  2⤵
  PID:4492
- C:\Windows\System\vXVbhUF.exe
  C:\Windows\System\vXVbhUF.exe
  2⤵
  PID:3928
- C:\Windows\System\drEwFte.exe
  C:\Windows\System\drEwFte.exe
  2⤵
  PID:2848
- C:\Windows\System\WNFsRga.exe
  C:\Windows\System\WNFsRga.exe
  2⤵
  PID:4608
- C:\Windows\System\FDeGiOr.exe
  C:\Windows\System\FDeGiOr.exe
  2⤵
  PID:3412
- C:\Windows\System\kYfVTpp.exe
  C:\Windows\System\kYfVTpp.exe
  2⤵
  PID:4076
- C:\Windows\System\xwuKLGv.exe
  C:\Windows\System\xwuKLGv.exe
  2⤵
  PID:4808
- C:\Windows\System\zTXJavP.exe
  C:\Windows\System\zTXJavP.exe
  2⤵
  PID:4984
- C:\Windows\System\GslXVdq.exe
  C:\Windows\System\GslXVdq.exe
  2⤵
  PID:5020
- C:\Windows\System\tRUKshX.exe
  C:\Windows\System\tRUKshX.exe
  2⤵
  PID:5040
- C:\Windows\System\TuTxCIV.exe
  C:\Windows\System\TuTxCIV.exe
  2⤵
  PID:5048
- C:\Windows\System\GrQJVOW.exe
  C:\Windows\System\GrQJVOW.exe
  2⤵
  PID:5068
- C:\Windows\System\pIiCzas.exe
  C:\Windows\System\pIiCzas.exe
  2⤵
  PID:5088
- C:\Windows\System\fsJBMNj.exe
  C:\Windows\System\fsJBMNj.exe
  2⤵
  PID:4208
- C:\Windows\System\YpPnDcw.exe
  C:\Windows\System\YpPnDcw.exe
  2⤵
  PID:4248
- C:\Windows\System\KcOKavh.exe
  C:\Windows\System\KcOKavh.exe
  2⤵
  PID:4108
- C:\Windows\System\fzboNBF.exe
  C:\Windows\System\fzboNBF.exe
  2⤵
  PID:4144
- C:\Windows\System\cBKYtSG.exe
  C:\Windows\System\cBKYtSG.exe
  2⤵
  PID:3752
- C:\Windows\System\Koihfjb.exe
  C:\Windows\System\Koihfjb.exe
  2⤵
  PID:4444
- C:\Windows\System\ahOQDrW.exe
  C:\Windows\System\ahOQDrW.exe
  2⤵
  PID:3744
- C:\Windows\System\hMjaPhO.exe
  C:\Windows\System\hMjaPhO.exe
  2⤵
  PID:4360
- C:\Windows\System\khOOGkg.exe
  C:\Windows\System\khOOGkg.exe
  2⤵
  PID:4428
- C:\Windows\System\KdqfGaW.exe
  C:\Windows\System\KdqfGaW.exe
  2⤵
  PID:4744
- C:\Windows\System\JvsJRow.exe
  C:\Windows\System\JvsJRow.exe
  2⤵
  PID:4852
- C:\Windows\System\qKuCXBU.exe
  C:\Windows\System\qKuCXBU.exe
  2⤵
  PID:5096
- C:\Windows\System\ViwqgAu.exe
  C:\Windows\System\ViwqgAu.exe
  2⤵
  PID:5092
- C:\Windows\System\CZuzrCC.exe
  C:\Windows\System\CZuzrCC.exe
  2⤵
  PID:4512
- C:\Windows\System\rYDCqOh.exe
  C:\Windows\System\rYDCqOh.exe
  2⤵
  PID:4644
- C:\Windows\System\zuxPYGK.exe
  C:\Windows\System\zuxPYGK.exe
  2⤵
  PID:4728
- C:\Windows\System\NGdbLVW.exe
  C:\Windows\System\NGdbLVW.exe
  2⤵
  PID:4824
- C:\Windows\System\IICflGl.exe
  C:\Windows\System\IICflGl.exe
  2⤵
  PID:4060
- C:\Windows\System\gfNoNqo.exe
  C:\Windows\System\gfNoNqo.exe
  2⤵
  PID:5012
- C:\Windows\System\MOqPjPt.exe
  C:\Windows\System\MOqPjPt.exe
  2⤵
  PID:4964
- C:\Windows\System\XZYaqCX.exe
  C:\Windows\System\XZYaqCX.exe
  2⤵
  PID:5004
- C:\Windows\System\hGPrXSU.exe
  C:\Windows\System\hGPrXSU.exe
  2⤵
  PID:4164
- C:\Windows\System\QwxNLJH.exe
  C:\Windows\System\QwxNLJH.exe
  2⤵
  PID:4944
- C:\Windows\System\oNbLahB.exe
  C:\Windows\System\oNbLahB.exe
  2⤵
  PID:4780
- C:\Windows\System\IqrbfCd.exe
  C:\Windows\System\IqrbfCd.exe
  2⤵
  PID:4740
- C:\Windows\System\qHmbDoB.exe
  C:\Windows\System\qHmbDoB.exe
  2⤵
  PID:4160
- C:\Windows\System\abRZnfv.exe
  C:\Windows\System\abRZnfv.exe
  2⤵
  PID:4676
- C:\Windows\System\IByDWbE.exe
  C:\Windows\System\IByDWbE.exe
  2⤵
  PID:4948
- C:\Windows\System\wzEPtss.exe
  C:\Windows\System\wzEPtss.exe
  2⤵
  PID:3736
- C:\Windows\System\NZkatQF.exe
  C:\Windows\System\NZkatQF.exe
  2⤵
  PID:5016
- C:\Windows\System\ZhoAobF.exe
  C:\Windows\System\ZhoAobF.exe
  2⤵
  PID:4560
- C:\Windows\System\hmcewKI.exe
  C:\Windows\System\hmcewKI.exe
  2⤵
  PID:4764
- C:\Windows\System\aLufiPk.exe
  C:\Windows\System\aLufiPk.exe
  2⤵
  PID:4900
- C:\Windows\System\ukmeIoE.exe
  C:\Windows\System\ukmeIoE.exe
  2⤵
  PID:4952
- C:\Windows\System\zGxPjNZ.exe
  C:\Windows\System\zGxPjNZ.exe
  2⤵
  PID:5116
- C:\Windows\System\etZRGMK.exe
  C:\Windows\System\etZRGMK.exe
  2⤵
  PID:5044
- C:\Windows\System\AOvDLyM.exe
  C:\Windows\System\AOvDLyM.exe
  2⤵
  PID:4624
- C:\Windows\System\zsKYLsV.exe
  C:\Windows\System\zsKYLsV.exe
  2⤵
  PID:5124
- C:\Windows\System\MIspabI.exe
  C:\Windows\System\MIspabI.exe
  2⤵
  PID:5140
- C:\Windows\System\zVZDLEc.exe
  C:\Windows\System\zVZDLEc.exe
  2⤵
  PID:5156
- C:\Windows\System\HZeYszX.exe
  C:\Windows\System\HZeYszX.exe
  2⤵
  PID:5180
- C:\Windows\System\yrGRGYw.exe
  C:\Windows\System\yrGRGYw.exe
  2⤵
  PID:5196
- C:\Windows\System\QvjArUj.exe
  C:\Windows\System\QvjArUj.exe
  2⤵
  PID:5212
- C:\Windows\System\OypfXZs.exe
  C:\Windows\System\OypfXZs.exe
  2⤵
  PID:5228
- C:\Windows\System\RKnWnaV.exe
  C:\Windows\System\RKnWnaV.exe
  2⤵
  PID:5244
- C:\Windows\System\GTYbJWr.exe
  C:\Windows\System\GTYbJWr.exe
  2⤵
  PID:5260
- C:\Windows\System\eXxUHxh.exe
  C:\Windows\System\eXxUHxh.exe
  2⤵
  PID:5276
- C:\Windows\System\IMPKAVi.exe
  C:\Windows\System\IMPKAVi.exe
  2⤵
  PID:5292
- C:\Windows\System\GcdXdOp.exe
  C:\Windows\System\GcdXdOp.exe
  2⤵
  PID:5308
- C:\Windows\System\HUQXpDD.exe
  C:\Windows\System\HUQXpDD.exe
  2⤵
  PID:5324
- C:\Windows\System\TNTFiNW.exe
  C:\Windows\System\TNTFiNW.exe
  2⤵
  PID:5340
- C:\Windows\System\TWslJZc.exe
  C:\Windows\System\TWslJZc.exe
  2⤵
  PID:5400
- C:\Windows\System\hQRPcAt.exe
  C:\Windows\System\hQRPcAt.exe
  2⤵
  PID:5416
- C:\Windows\System\nAJEWSY.exe
  C:\Windows\System\nAJEWSY.exe
  2⤵
  PID:5432
- C:\Windows\System\vnytQFU.exe
  C:\Windows\System\vnytQFU.exe
  2⤵
  PID:5448
- C:\Windows\System\MBaMVWm.exe
  C:\Windows\System\MBaMVWm.exe
  2⤵
  PID:5472
- C:\Windows\System\mrpOQyq.exe
  C:\Windows\System\mrpOQyq.exe
  2⤵
  PID:5488
- C:\Windows\System\NvEbDbk.exe
  C:\Windows\System\NvEbDbk.exe
  2⤵
  PID:5504
- C:\Windows\System\GbVtHzK.exe
  C:\Windows\System\GbVtHzK.exe
  2⤵
  PID:5524
- C:\Windows\System\guGQhRs.exe
  C:\Windows\System\guGQhRs.exe
  2⤵
  PID:5544
- C:\Windows\System\nglVxTw.exe
  C:\Windows\System\nglVxTw.exe
  2⤵
  PID:5568
- C:\Windows\System\LrJOSBX.exe
  C:\Windows\System\LrJOSBX.exe
  2⤵
  PID:5584
- C:\Windows\System\BfCPfdd.exe
  C:\Windows\System\BfCPfdd.exe
  2⤵
  PID:5600
- C:\Windows\System\TVhCLBi.exe
  C:\Windows\System\TVhCLBi.exe
  2⤵
  PID:5616
- C:\Windows\System\hIIcPWA.exe
  C:\Windows\System\hIIcPWA.exe
  2⤵
  PID:5632
- C:\Windows\System\PtoyIHV.exe
  C:\Windows\System\PtoyIHV.exe
  2⤵
  PID:5648
- C:\Windows\System\GuaZopW.exe
  C:\Windows\System\GuaZopW.exe
  2⤵
  PID:5664
- C:\Windows\System\fiTfEqH.exe
  C:\Windows\System\fiTfEqH.exe
  2⤵
  PID:5680
- C:\Windows\System\eIDKwoO.exe
  C:\Windows\System\eIDKwoO.exe
  2⤵
  PID:5696
- C:\Windows\System\QtXYaAg.exe
  C:\Windows\System\QtXYaAg.exe
  2⤵
  PID:5716
- C:\Windows\System\lgtErts.exe
  C:\Windows\System\lgtErts.exe
  2⤵
  PID:5732
- C:\Windows\System\snTYpzU.exe
  C:\Windows\System\snTYpzU.exe
  2⤵
  PID:5748
- C:\Windows\System\nFRarqc.exe
  C:\Windows\System\nFRarqc.exe
  2⤵
  PID:5780
- C:\Windows\System\CMwlsYi.exe
  C:\Windows\System\CMwlsYi.exe
  2⤵
  PID:5796
- C:\Windows\System\WGEOKvk.exe
  C:\Windows\System\WGEOKvk.exe
  2⤵
  PID:5812
- C:\Windows\System\vrNUAIM.exe
  C:\Windows\System\vrNUAIM.exe
  2⤵
  PID:5828
- C:\Windows\System\PnVRvQh.exe
  C:\Windows\System\PnVRvQh.exe
  2⤵
  PID:5844
- C:\Windows\System\PXRwjBE.exe
  C:\Windows\System\PXRwjBE.exe
  2⤵
  PID:5860
- C:\Windows\System\VaZUTTx.exe
  C:\Windows\System\VaZUTTx.exe
  2⤵
  PID:5880
- C:\Windows\System\fyzHdvh.exe
  C:\Windows\System\fyzHdvh.exe
  2⤵
  PID:5896
- C:\Windows\System\rVRNsDW.exe
  C:\Windows\System\rVRNsDW.exe
  2⤵
  PID:5912
- C:\Windows\System\weQvBzt.exe
  C:\Windows\System\weQvBzt.exe
  2⤵
  PID:5928
- C:\Windows\System\PsFByQH.exe
  C:\Windows\System\PsFByQH.exe
  2⤵
  PID:5944
- C:\Windows\System\JKrSeyq.exe
  C:\Windows\System\JKrSeyq.exe
  2⤵
  PID:5960
- C:\Windows\System\UBgIiNw.exe
  C:\Windows\System\UBgIiNw.exe
  2⤵
  PID:5976
- C:\Windows\System\hJuUeqS.exe
  C:\Windows\System\hJuUeqS.exe
  2⤵
  PID:5992
- C:\Windows\System\EVNzuxp.exe
  C:\Windows\System\EVNzuxp.exe
  2⤵
  PID:6008
- C:\Windows\System\ozVADfn.exe
  C:\Windows\System\ozVADfn.exe
  2⤵
  PID:6024
- C:\Windows\System\SJdyCIH.exe
  C:\Windows\System\SJdyCIH.exe
  2⤵
  PID:6040
- C:\Windows\System\XCpvZjF.exe
  C:\Windows\System\XCpvZjF.exe
  2⤵
  PID:6056
- C:\Windows\System\HxSdmxq.exe
  C:\Windows\System\HxSdmxq.exe
  2⤵
  PID:6072
- C:\Windows\System\MKxsuXq.exe
  C:\Windows\System\MKxsuXq.exe
  2⤵
  PID:6088
- C:\Windows\System\HbPssoz.exe
  C:\Windows\System\HbPssoz.exe
  2⤵
  PID:6104
- C:\Windows\System\dFyuCaV.exe
  C:\Windows\System\dFyuCaV.exe
  2⤵
  PID:6120
- C:\Windows\System\NiEJEom.exe
  C:\Windows\System\NiEJEom.exe
  2⤵
  PID:6136
- C:\Windows\System\KxnrHOa.exe
  C:\Windows\System\KxnrHOa.exe
  2⤵
  PID:3356
- C:\Windows\System\hBsyPEl.exe
  C:\Windows\System\hBsyPEl.exe
  2⤵
  PID:4576
- C:\Windows\System\ULDKhfR.exe
  C:\Windows\System\ULDKhfR.exe
  2⤵
  PID:5188
- C:\Windows\System\LYaoigc.exe
  C:\Windows\System\LYaoigc.exe
  2⤵
  PID:4628
- C:\Windows\System\yQSrqmY.exe
  C:\Windows\System\yQSrqmY.exe
  2⤵
  PID:5284
- C:\Windows\System\ZEreuYZ.exe
  C:\Windows\System\ZEreuYZ.exe
  2⤵
  PID:5236
- C:\Windows\System\fvpQNYO.exe
  C:\Windows\System\fvpQNYO.exe
  2⤵
  PID:4440
- C:\Windows\System\mJOOuMH.exe
  C:\Windows\System\mJOOuMH.exe
  2⤵
  PID:4380
- C:\Windows\System\ThvBHsd.exe
  C:\Windows\System\ThvBHsd.exe
  2⤵
  PID:5132
- C:\Windows\System\WtZbuyU.exe
  C:\Windows\System\WtZbuyU.exe
  2⤵
  PID:5176
- C:\Windows\System\espyScr.exe
  C:\Windows\System\espyScr.exe
  2⤵
  PID:5272
- C:\Windows\System\XXJBHdj.exe
  C:\Windows\System\XXJBHdj.exe
  2⤵
  PID:5320
- C:\Windows\System\ZJmOkDv.exe
  C:\Windows\System\ZJmOkDv.exe
  2⤵
  PID:5336
- C:\Windows\System\ogKsIUO.exe
  C:\Windows\System\ogKsIUO.exe
  2⤵
  PID:5372
- C:\Windows\System\nMYfqdv.exe
  C:\Windows\System\nMYfqdv.exe
  2⤵
  PID:5428
- C:\Windows\System\CeRKRwB.exe
  C:\Windows\System\CeRKRwB.exe
  2⤵
  PID:5376
- C:\Windows\System\EMVvRBe.exe
  C:\Windows\System\EMVvRBe.exe
  2⤵
  PID:5412
- C:\Windows\System\uOotJTl.exe
  C:\Windows\System\uOotJTl.exe
  2⤵
  PID:5468
- C:\Windows\System\mJBxtYo.exe
  C:\Windows\System\mJBxtYo.exe
  2⤵
  PID:5512
- C:\Windows\System\myjIjzP.exe
  C:\Windows\System\myjIjzP.exe
  2⤵
  PID:5556
- C:\Windows\System\MeaHdgK.exe
  C:\Windows\System\MeaHdgK.exe
  2⤵
  PID:5536
- C:\Windows\System\depWDHT.exe
  C:\Windows\System\depWDHT.exe
  2⤵
  PID:5580
- C:\Windows\System\BNrVAkO.exe
  C:\Windows\System\BNrVAkO.exe
  2⤵
  PID:5672
- C:\Windows\System\fzpTPSa.exe
  C:\Windows\System\fzpTPSa.exe
  2⤵
  PID:5712
- C:\Windows\System\lcFRNef.exe
  C:\Windows\System\lcFRNef.exe
  2⤵
  PID:5744
- C:\Windows\System\VWzzosN.exe
  C:\Windows\System\VWzzosN.exe
  2⤵
  PID:5660
- C:\Windows\System\XmNLwnz.exe
  C:\Windows\System\XmNLwnz.exe
  2⤵
  PID:5728
- C:\Windows\System\dPcpVhx.exe
  C:\Windows\System\dPcpVhx.exe
  2⤵
  PID:5792
- C:\Windows\System\rtzeQPq.exe
  C:\Windows\System\rtzeQPq.exe
  2⤵
  PID:5856
- C:\Windows\System\cdxBKhB.exe
  C:\Windows\System\cdxBKhB.exe
  2⤵
  PID:5924
- C:\Windows\System\cEcMNnd.exe
  C:\Windows\System\cEcMNnd.exe
  2⤵
  PID:5988
- C:\Windows\System\DlUzCfF.exe
  C:\Windows\System\DlUzCfF.exe
  2⤵
  PID:6052
- C:\Windows\System\oTgpWQN.exe
  C:\Windows\System\oTgpWQN.exe
  2⤵
  PID:6116
- C:\Windows\System\nbZQXCZ.exe
  C:\Windows\System\nbZQXCZ.exe
  2⤵
  PID:5192
- C:\Windows\System\RytPBVP.exe
  C:\Windows\System\RytPBVP.exe
  2⤵
  PID:5316
- C:\Windows\System\ysolFRr.exe
  C:\Windows\System\ysolFRr.exe
  2⤵
  PID:5760
- C:\Windows\System\vUHPhRr.exe
  C:\Windows\System\vUHPhRr.exe
  2⤵
  PID:5356
- C:\Windows\System\TlQmiOj.exe
  C:\Windows\System\TlQmiOj.exe
  2⤵
  PID:5464
- C:\Windows\System\maxorOY.exe
  C:\Windows\System\maxorOY.exe
  2⤵
  PID:5408
- C:\Windows\System\DEIKzGI.exe
  C:\Windows\System\DEIKzGI.exe
  2⤵
  PID:5480
- C:\Windows\System\ZvyRiZf.exe
  C:\Windows\System\ZvyRiZf.exe
  2⤵
  PID:3196
- C:\Windows\System\iNRwSGI.exe
  C:\Windows\System\iNRwSGI.exe
  2⤵
  PID:5164
- C:\Windows\System\btgxXnn.exe
  C:\Windows\System\btgxXnn.exe
  2⤵
  PID:5908
- C:\Windows\System\bIibyjk.exe
  C:\Windows\System\bIibyjk.exe
  2⤵
  PID:6032
- C:\Windows\System\sDNfboq.exe
  C:\Windows\System\sDNfboq.exe
  2⤵
  PID:6132
- C:\Windows\System\rpZaGsl.exe
  C:\Windows\System\rpZaGsl.exe
  2⤵
  PID:5852
- C:\Windows\System\xoJbBQa.exe
  C:\Windows\System\xoJbBQa.exe
  2⤵
  PID:5708
- C:\Windows\System\Ghylzzg.exe
  C:\Windows\System\Ghylzzg.exe
  2⤵
  PID:5892
- C:\Windows\System\OFFFxfG.exe
  C:\Windows\System\OFFFxfG.exe
  2⤵
  PID:3628
- C:\Windows\System\RVasXnu.exe
  C:\Windows\System\RVasXnu.exe
  2⤵
  PID:5268
- C:\Windows\System\OKxhmEu.exe
  C:\Windows\System\OKxhmEu.exe
  2⤵
  PID:5348
- C:\Windows\System\GMCHMnN.exe
  C:\Windows\System\GMCHMnN.exe
  2⤵
  PID:5876
- C:\Windows\System\mVdSqSa.exe
  C:\Windows\System\mVdSqSa.exe
  2⤵
  PID:4760
- C:\Windows\System\nfLENYz.exe
  C:\Windows\System\nfLENYz.exe
  2⤵
  PID:5972
- C:\Windows\System\ErrdYDj.exe
  C:\Windows\System\ErrdYDj.exe
  2⤵
  PID:5840
- C:\Windows\System\CMErxKf.exe
  C:\Windows\System\CMErxKf.exe
  2⤵
  PID:6100
- C:\Windows\System\vnqnddi.exe
  C:\Windows\System\vnqnddi.exe
  2⤵
  PID:4696
- C:\Windows\System\RYkhTbo.exe
  C:\Windows\System\RYkhTbo.exe
  2⤵
  PID:5396
- C:\Windows\System\urQrAVi.exe
  C:\Windows\System\urQrAVi.exe
  2⤵
  PID:2540
- C:\Windows\System\ofnFQOQ.exe
  C:\Windows\System\ofnFQOQ.exe
  2⤵
  PID:5532
- C:\Windows\System\lixaogP.exe
  C:\Windows\System\lixaogP.exe
  2⤵
  PID:5576
- C:\Windows\System\UZtUgkP.exe
  C:\Windows\System\UZtUgkP.exe
  2⤵
  PID:5740
- C:\Windows\System\Kypiahs.exe
  C:\Windows\System\Kypiahs.exe
  2⤵
  PID:5984
- C:\Windows\System\PZjhkQo.exe
  C:\Windows\System\PZjhkQo.exe
  2⤵
  PID:5112
- C:\Windows\System\FmdfbVW.exe
  C:\Windows\System\FmdfbVW.exe
  2⤵
  PID:5288
- C:\Windows\System\KmjGfWZ.exe
  C:\Windows\System\KmjGfWZ.exe
  2⤵
  PID:5360
- C:\Windows\System\RnHwLNf.exe
  C:\Windows\System\RnHwLNf.exe
  2⤵
  PID:5808
- C:\Windows\System\PChWEky.exe
  C:\Windows\System\PChWEky.exe
  2⤵
  PID:5768
- C:\Windows\System\ySzBQKG.exe
  C:\Windows\System\ySzBQKG.exe
  2⤵
  PID:5824
- C:\Windows\System\ckbrMqX.exe
  C:\Windows\System\ckbrMqX.exe
  2⤵
  PID:6156
- C:\Windows\System\jaqgJea.exe
  C:\Windows\System\jaqgJea.exe
  2⤵
  PID:6172
- C:\Windows\System\LMsiGdb.exe
  C:\Windows\System\LMsiGdb.exe
  2⤵
  PID:6188
- C:\Windows\System\xGQtrsz.exe
  C:\Windows\System\xGQtrsz.exe
  2⤵
  PID:6204
- C:\Windows\System\igSHSLt.exe
  C:\Windows\System\igSHSLt.exe
  2⤵
  PID:6224
- C:\Windows\System\BqUqLxa.exe
  C:\Windows\System\BqUqLxa.exe
  2⤵
  PID:6256
- C:\Windows\System\PLtPdoO.exe
  C:\Windows\System\PLtPdoO.exe
  2⤵
  PID:6272
- C:\Windows\System\nncJqzh.exe
  C:\Windows\System\nncJqzh.exe
  2⤵
  PID:6288
- C:\Windows\System\YjLxZel.exe
  C:\Windows\System\YjLxZel.exe
  2⤵
  PID:6304
- C:\Windows\System\RKEPdut.exe
  C:\Windows\System\RKEPdut.exe
  2⤵
  PID:6320
- C:\Windows\System\jaoSYGl.exe
  C:\Windows\System\jaoSYGl.exe
  2⤵
  PID:6336
- C:\Windows\System\SdSTeJP.exe
  C:\Windows\System\SdSTeJP.exe
  2⤵
  PID:6352
- C:\Windows\System\CTLZDiQ.exe
  C:\Windows\System\CTLZDiQ.exe
  2⤵
  PID:6368
- C:\Windows\System\rHSxeph.exe
  C:\Windows\System\rHSxeph.exe
  2⤵
  PID:6384
- C:\Windows\System\lzZJvvb.exe
  C:\Windows\System\lzZJvvb.exe
  2⤵
  PID:6400
- C:\Windows\System\JltNjBI.exe
  C:\Windows\System\JltNjBI.exe
  2⤵
  PID:6416
- C:\Windows\System\OLbMrqG.exe
  C:\Windows\System\OLbMrqG.exe
  2⤵
  PID:6432
- C:\Windows\System\blSWJlq.exe
  C:\Windows\System\blSWJlq.exe
  2⤵
  PID:6448
- C:\Windows\System\opspGOl.exe
  C:\Windows\System\opspGOl.exe
  2⤵
  PID:6464
- C:\Windows\System\gdwDgGd.exe
  C:\Windows\System\gdwDgGd.exe
  2⤵
  PID:6480
- C:\Windows\System\PwjxmNg.exe
  C:\Windows\System\PwjxmNg.exe
  2⤵
  PID:6496
- C:\Windows\System\UARWZMH.exe
  C:\Windows\System\UARWZMH.exe
  2⤵
  PID:6512
- C:\Windows\System\gTAKGoW.exe
  C:\Windows\System\gTAKGoW.exe
  2⤵
  PID:6528
- C:\Windows\System\emSlpzb.exe
  C:\Windows\System\emSlpzb.exe
  2⤵
  PID:6544
- C:\Windows\System\uINNoKI.exe
  C:\Windows\System\uINNoKI.exe
  2⤵
  PID:6560
- C:\Windows\System\EcEjuPZ.exe
  C:\Windows\System\EcEjuPZ.exe
  2⤵
  PID:6576
- C:\Windows\System\iBhecOp.exe
  C:\Windows\System\iBhecOp.exe
  2⤵
  PID:6592
- C:\Windows\System\yeaKeft.exe
  C:\Windows\System\yeaKeft.exe
  2⤵
  PID:6608
- C:\Windows\System\JGrMGTt.exe
  C:\Windows\System\JGrMGTt.exe
  2⤵
  PID:6624
- C:\Windows\System\VBUmbHm.exe
  C:\Windows\System\VBUmbHm.exe
  2⤵
  PID:6640
- C:\Windows\System\GKHdQyL.exe
  C:\Windows\System\GKHdQyL.exe
  2⤵
  PID:6656
- C:\Windows\System\rzBgYZO.exe
  C:\Windows\System\rzBgYZO.exe
  2⤵
  PID:6672
- C:\Windows\System\VMvpJsh.exe
  C:\Windows\System\VMvpJsh.exe
  2⤵
  PID:6688
- C:\Windows\System\EmcMLvj.exe
  C:\Windows\System\EmcMLvj.exe
  2⤵
  PID:6704
- C:\Windows\System\zSlPnjh.exe
  C:\Windows\System\zSlPnjh.exe
  2⤵
  PID:6720
- C:\Windows\System\TJktUfH.exe
  C:\Windows\System\TJktUfH.exe
  2⤵
  PID:6736
- C:\Windows\System\hcmGMUm.exe
  C:\Windows\System\hcmGMUm.exe
  2⤵
  PID:6752
- C:\Windows\System\TowsSRR.exe
  C:\Windows\System\TowsSRR.exe
  2⤵
  PID:6768
- C:\Windows\System\JpQpfFG.exe
  C:\Windows\System\JpQpfFG.exe
  2⤵
  PID:6788
- C:\Windows\System\IrBDQDk.exe
  C:\Windows\System\IrBDQDk.exe
  2⤵
  PID:6808
- C:\Windows\System\MdsuykO.exe
  C:\Windows\System\MdsuykO.exe
  2⤵
  PID:6824
- C:\Windows\System\vJKFCmm.exe
  C:\Windows\System\vJKFCmm.exe
  2⤵
  PID:6840
- C:\Windows\System\hWbJXEP.exe
  C:\Windows\System\hWbJXEP.exe
  2⤵
  PID:6856
- C:\Windows\System\fJVvOGQ.exe
  C:\Windows\System\fJVvOGQ.exe
  2⤵
  PID:6872
- C:\Windows\System\DIUTBVB.exe
  C:\Windows\System\DIUTBVB.exe
  2⤵
  PID:6888
- C:\Windows\System\ycRvOBc.exe
  C:\Windows\System\ycRvOBc.exe
  2⤵
  PID:6904
- C:\Windows\System\pFolorz.exe
  C:\Windows\System\pFolorz.exe
  2⤵
  PID:6924
- C:\Windows\System\YpVrBMV.exe
  C:\Windows\System\YpVrBMV.exe
  2⤵
  PID:6940
- C:\Windows\System\vqmqlHO.exe
  C:\Windows\System\vqmqlHO.exe
  2⤵
  PID:6956
- C:\Windows\System\pKsykuD.exe
  C:\Windows\System\pKsykuD.exe
  2⤵
  PID:6972
- C:\Windows\System\TBuikRg.exe
  C:\Windows\System\TBuikRg.exe
  2⤵
  PID:6988
- C:\Windows\System\zZWFriz.exe
  C:\Windows\System\zZWFriz.exe
  2⤵
  PID:7004
- C:\Windows\System\zzwaJkd.exe
  C:\Windows\System\zzwaJkd.exe
  2⤵
  PID:7020
- C:\Windows\System\gFtUTbR.exe
  C:\Windows\System\gFtUTbR.exe
  2⤵
  PID:7036
- C:\Windows\System\lkmPowN.exe
  C:\Windows\System\lkmPowN.exe
  2⤵
  PID:7052
- C:\Windows\System\uaqNkus.exe
  C:\Windows\System\uaqNkus.exe
  2⤵
  PID:7068
- C:\Windows\System\UhyDzTx.exe
  C:\Windows\System\UhyDzTx.exe
  2⤵
  PID:7084
- C:\Windows\System\DOKbgKq.exe
  C:\Windows\System\DOKbgKq.exe
  2⤵
  PID:7100
- C:\Windows\System\rxBjREE.exe
  C:\Windows\System\rxBjREE.exe
  2⤵
  PID:7116
- C:\Windows\System\KAGWvLn.exe
  C:\Windows\System\KAGWvLn.exe
  2⤵
  PID:7132
- C:\Windows\System\WfkuxiJ.exe
  C:\Windows\System\WfkuxiJ.exe
  2⤵
  PID:7148
- C:\Windows\System\YduRtHu.exe
  C:\Windows\System\YduRtHu.exe
  2⤵
  PID:7164
- C:\Windows\System\jvcxwuk.exe
  C:\Windows\System\jvcxwuk.exe
  2⤵
  PID:6164
- C:\Windows\System\OkCApvv.exe
  C:\Windows\System\OkCApvv.exe
  2⤵
  PID:6236
- C:\Windows\System\VBuorgW.exe
  C:\Windows\System\VBuorgW.exe
  2⤵
  PID:6252
- C:\Windows\System\vsEJotg.exe
  C:\Windows\System\vsEJotg.exe
  2⤵
  PID:4140
- C:\Windows\System\ylVlbGE.exe
  C:\Windows\System\ylVlbGE.exe
  2⤵
  PID:6316
- C:\Windows\System\ZZDYOHF.exe
  C:\Windows\System\ZZDYOHF.exe
  2⤵
  PID:6412
- C:\Windows\System\tUrosNx.exe
  C:\Windows\System\tUrosNx.exe
  2⤵
  PID:6476
- C:\Windows\System\mFBIsIz.exe
  C:\Windows\System\mFBIsIz.exe
  2⤵
  PID:6540
- C:\Windows\System\izKlaBI.exe
  C:\Windows\System\izKlaBI.exe
  2⤵
  PID:6604
- C:\Windows\System\yoEZaAa.exe
  C:\Windows\System\yoEZaAa.exe
  2⤵
  PID:6700
- C:\Windows\System\rwEEjHE.exe
  C:\Windows\System\rwEEjHE.exe
  2⤵
  PID:6760
- C:\Windows\System\DTGATUr.exe
  C:\Windows\System\DTGATUr.exe
  2⤵
  PID:6804
- C:\Windows\System\rgXFqcb.exe
  C:\Windows\System\rgXFqcb.exe
  2⤵
  PID:6868
- C:\Windows\System\OgKtXwp.exe
  C:\Windows\System\OgKtXwp.exe
  2⤵
  PID:6936
- C:\Windows\System\jQUgMvL.exe
  C:\Windows\System\jQUgMvL.exe
  2⤵
  PID:7028
- C:\Windows\System\fLeDiFI.exe
  C:\Windows\System\fLeDiFI.exe
  2⤵
  PID:7092
- C:\Windows\System\wnoRYgK.exe
  C:\Windows\System\wnoRYgK.exe
  2⤵
  PID:6196
- C:\Windows\System\qANYqPA.exe
  C:\Windows\System\qANYqPA.exe
  2⤵
  PID:5456
- C:\Windows\System\mgpnTUy.exe
  C:\Windows\System\mgpnTUy.exe
  2⤵
  PID:6536
- C:\Windows\System\hZmcMWS.exe
  C:\Windows\System\hZmcMWS.exe
  2⤵
  PID:6796
- C:\Windows\System\jUWNCZS.exe
  C:\Windows\System\jUWNCZS.exe
  2⤵
  PID:7060
- C:\Windows\System\WrFRwNw.exe
  C:\Windows\System\WrFRwNw.exe
  2⤵
  PID:6664
- C:\Windows\System\BrwDumW.exe
  C:\Windows\System\BrwDumW.exe
  2⤵
  PID:7184
- C:\Windows\System\OvovujI.exe
  C:\Windows\System\OvovujI.exe
  2⤵
  PID:7200
- C:\Windows\System\njpApFH.exe
  C:\Windows\System\njpApFH.exe
  2⤵
  PID:7216
- C:\Windows\System\JQecMdC.exe
  C:\Windows\System\JQecMdC.exe
  2⤵
  PID:7232
- C:\Windows\System\igPLtbc.exe
  C:\Windows\System\igPLtbc.exe
  2⤵
  PID:7344
- C:\Windows\System\xoRidBx.exe
  C:\Windows\System\xoRidBx.exe
  2⤵
  PID:7360
- C:\Windows\System\HClojDX.exe
  C:\Windows\System\HClojDX.exe
  2⤵
  PID:7376
- C:\Windows\System\anqHOZv.exe
  C:\Windows\System\anqHOZv.exe
  2⤵
  PID:7392
- C:\Windows\System\rdaZLKs.exe
  C:\Windows\System\rdaZLKs.exe
  2⤵
  PID:7408
- C:\Windows\System\rOLowIW.exe
  C:\Windows\System\rOLowIW.exe
  2⤵
  PID:7424
- C:\Windows\System\GroGlhK.exe
  C:\Windows\System\GroGlhK.exe
  2⤵
  PID:7440
- C:\Windows\System\HExZmHN.exe
  C:\Windows\System\HExZmHN.exe
  2⤵
  PID:7464
- C:\Windows\System\RYCDvlA.exe
  C:\Windows\System\RYCDvlA.exe
  2⤵
  PID:7480
- C:\Windows\System\OutxkVK.exe
  C:\Windows\System\OutxkVK.exe
  2⤵
  PID:7496
- C:\Windows\System\ZCazUvL.exe
  C:\Windows\System\ZCazUvL.exe
  2⤵
  PID:7512
- C:\Windows\System\ElGHyQN.exe
  C:\Windows\System\ElGHyQN.exe
  2⤵
  PID:7528
- C:\Windows\System\pvpNPLU.exe
  C:\Windows\System\pvpNPLU.exe
  2⤵
  PID:7544
- C:\Windows\System\ZNjmVPR.exe
  C:\Windows\System\ZNjmVPR.exe
  2⤵
  PID:7560
- C:\Windows\System\aDEwmQz.exe
  C:\Windows\System\aDEwmQz.exe
  2⤵
  PID:7576
- C:\Windows\System\BPYbovo.exe
  C:\Windows\System\BPYbovo.exe
  2⤵
  PID:7592
- C:\Windows\System\ULvZlnY.exe
  C:\Windows\System\ULvZlnY.exe
  2⤵
  PID:7608
- C:\Windows\System\BqMBANC.exe
  C:\Windows\System\BqMBANC.exe
  2⤵
  PID:7624
- C:\Windows\System\mwnTQLj.exe
  C:\Windows\System\mwnTQLj.exe
  2⤵
  PID:7640
- C:\Windows\System\GaNGHKa.exe
  C:\Windows\System\GaNGHKa.exe
  2⤵
  PID:7656
- C:\Windows\System\JLbroci.exe
  C:\Windows\System\JLbroci.exe
  2⤵
  PID:7672
- C:\Windows\System\VbxTDqs.exe
  C:\Windows\System\VbxTDqs.exe
  2⤵
  PID:7688
- C:\Windows\System\kRUkWCU.exe
  C:\Windows\System\kRUkWCU.exe
  2⤵
  PID:7704
- C:\Windows\System\JPdkiDT.exe
  C:\Windows\System\JPdkiDT.exe
  2⤵
  PID:7720
- C:\Windows\System\iarbJdL.exe
  C:\Windows\System\iarbJdL.exe
  2⤵
  PID:7736
- C:\Windows\System\JkXoeSq.exe
  C:\Windows\System\JkXoeSq.exe
  2⤵
  PID:7752
- C:\Windows\System\xvvvHtF.exe
  C:\Windows\System\xvvvHtF.exe
  2⤵
  PID:7768
- C:\Windows\System\FoVmNTV.exe
  C:\Windows\System\FoVmNTV.exe
  2⤵
  PID:7784
- C:\Windows\System\qJuGOzI.exe
  C:\Windows\System\qJuGOzI.exe
  2⤵
  PID:7800
- C:\Windows\System\rlqdeJt.exe
  C:\Windows\System\rlqdeJt.exe
  2⤵
  PID:7816
- C:\Windows\System\PWSxeEd.exe
  C:\Windows\System\PWSxeEd.exe
  2⤵
  PID:7832
- C:\Windows\System\TBRBuLP.exe
  C:\Windows\System\TBRBuLP.exe
  2⤵
  PID:7848
- C:\Windows\System\ByWIuaD.exe
  C:\Windows\System\ByWIuaD.exe
  2⤵
  PID:7864
- C:\Windows\System\MdUcggX.exe
  C:\Windows\System\MdUcggX.exe
  2⤵
  PID:7880
- C:\Windows\System\qXTwtkg.exe
  C:\Windows\System\qXTwtkg.exe
  2⤵
  PID:7896
- C:\Windows\System\eMSYThl.exe
  C:\Windows\System\eMSYThl.exe
  2⤵
  PID:7912
- C:\Windows\System\SYhLVAz.exe
  C:\Windows\System\SYhLVAz.exe
  2⤵
  PID:7928
- C:\Windows\System\hoEFyAv.exe
  C:\Windows\System\hoEFyAv.exe
  2⤵
  PID:7944
- C:\Windows\System\zgZEqiI.exe
  C:\Windows\System\zgZEqiI.exe
  2⤵
  PID:7960
- C:\Windows\System\mCKvLyP.exe
  C:\Windows\System\mCKvLyP.exe
  2⤵
  PID:7976
- C:\Windows\System\xdtPmtV.exe
  C:\Windows\System\xdtPmtV.exe
  2⤵
  PID:7992
- C:\Windows\System\zeLSguO.exe
  C:\Windows\System\zeLSguO.exe
  2⤵
  PID:8008
- C:\Windows\System\TsGqnOn.exe
  C:\Windows\System\TsGqnOn.exe
  2⤵
  PID:8024
- C:\Windows\System\jWumSGV.exe
  C:\Windows\System\jWumSGV.exe
  2⤵
  PID:8040
- C:\Windows\System\RamFJdJ.exe
  C:\Windows\System\RamFJdJ.exe
  2⤵
  PID:8056
- C:\Windows\System\hTdChAp.exe
  C:\Windows\System\hTdChAp.exe
  2⤵
  PID:8072
- C:\Windows\System\tyBMYbN.exe
  C:\Windows\System\tyBMYbN.exe
  2⤵
  PID:8088
- C:\Windows\System\NqsCFbC.exe
  C:\Windows\System\NqsCFbC.exe
  2⤵
  PID:8104
- C:\Windows\System\QGIOkMZ.exe
  C:\Windows\System\QGIOkMZ.exe
  2⤵
  PID:8120
- C:\Windows\System\RvheOAR.exe
  C:\Windows\System\RvheOAR.exe
  2⤵
  PID:8136
- C:\Windows\System\JHEXxVa.exe
  C:\Windows\System\JHEXxVa.exe
  2⤵
  PID:8152
- C:\Windows\System\EEpSkjU.exe
  C:\Windows\System\EEpSkjU.exe
  2⤵
  PID:8168
- C:\Windows\System\ztFduxg.exe
  C:\Windows\System\ztFduxg.exe
  2⤵
  PID:8184
- C:\Windows\System\MZFFrSg.exe
  C:\Windows\System\MZFFrSg.exe
  2⤵
  PID:7192
- C:\Windows\System\PjkzDHc.exe
  C:\Windows\System\PjkzDHc.exe
  2⤵
  PID:6684
- C:\Windows\System\buSbFAQ.exe
  C:\Windows\System\buSbFAQ.exe
  2⤵
  PID:7016
- C:\Windows\System\UUiyzqQ.exe
  C:\Windows\System\UUiyzqQ.exe
  2⤵
  PID:6444
- C:\Windows\System\TZXThxV.exe
  C:\Windows\System\TZXThxV.exe
  2⤵
  PID:6600
- C:\Windows\System\dtbIhQs.exe
  C:\Windows\System\dtbIhQs.exe
  2⤵
  PID:6864
- C:\Windows\System\prqJEEg.exe
  C:\Windows\System\prqJEEg.exe
  2⤵
  PID:7124
- C:\Windows\System\Ekeboez.exe
  C:\Windows\System\Ekeboez.exe
  2⤵
  PID:6408
- C:\Windows\System\rMmPrPm.exe
  C:\Windows\System\rMmPrPm.exe
  2⤵
  PID:7064
- C:\Windows\System\Xukiycv.exe
  C:\Windows\System\Xukiycv.exe
  2⤵
  PID:7212
- C:\Windows\System\cdPMhMt.exe
  C:\Windows\System\cdPMhMt.exe
  2⤵
  PID:7252
- C:\Windows\System\FuFTrIN.exe
  C:\Windows\System\FuFTrIN.exe
  2⤵
  PID:7296
- C:\Windows\System\efvyOEM.exe
  C:\Windows\System\efvyOEM.exe
  2⤵
  PID:5836
- C:\Windows\System\nhkAJtP.exe
  C:\Windows\System\nhkAJtP.exe
  2⤵
  PID:5920
- C:\Windows\System\ROOZDnR.exe
  C:\Windows\System\ROOZDnR.exe
  2⤵
  PID:6184
- C:\Windows\System\GgCminC.exe
  C:\Windows\System\GgCminC.exe
  2⤵
  PID:6264
- C:\Windows\System\zUJROtL.exe
  C:\Windows\System\zUJROtL.exe
  2⤵
  PID:6328
- C:\Windows\System\qvRfERw.exe
  C:\Windows\System\qvRfERw.exe
  2⤵
  PID:6392
- C:\Windows\System\MKRCtvm.exe
  C:\Windows\System\MKRCtvm.exe
  2⤵
  PID:6488
- C:\Windows\System\UGTzyap.exe
  C:\Windows\System\UGTzyap.exe
  2⤵
  PID:6524
- C:\Windows\System\xyjLwxH.exe
  C:\Windows\System\xyjLwxH.exe
  2⤵
  PID:6588
- C:\Windows\System\xHBVIXG.exe
  C:\Windows\System\xHBVIXG.exe
  2⤵
  PID:6680
- C:\Windows\System\DaKYYgn.exe
  C:\Windows\System\DaKYYgn.exe
  2⤵
  PID:6776
- C:\Windows\System\teokFIU.exe
  C:\Windows\System\teokFIU.exe
  2⤵
  PID:6848
- C:\Windows\System\xblDEwB.exe
  C:\Windows\System\xblDEwB.exe
  2⤵
  PID:6912
- C:\Windows\System\AAZnQJI.exe
  C:\Windows\System\AAZnQJI.exe
  2⤵
  PID:6980
- C:\Windows\System\nSfwpQM.exe
  C:\Windows\System\nSfwpQM.exe
  2⤵
  PID:7048
- C:\Windows\System\KWkWxeX.exe
  C:\Windows\System\KWkWxeX.exe
  2⤵
  PID:7144
- C:\Windows\System\DGwdFdk.exe
  C:\Windows\System\DGwdFdk.exe
  2⤵
  PID:6312
- C:\Windows\System\lVOAxDc.exe
  C:\Windows\System\lVOAxDc.exe
  2⤵
  PID:7276
- C:\Windows\System\LmTJplC.exe
  C:\Windows\System\LmTJplC.exe
  2⤵
  PID:7300
- C:\Windows\System\slvoWlf.exe
  C:\Windows\System\slvoWlf.exe
  2⤵
  PID:7320
- C:\Windows\System\RfctMiE.exe
  C:\Windows\System\RfctMiE.exe
  2⤵
  PID:7332
- C:\Windows\System\roYUbGn.exe
  C:\Windows\System\roYUbGn.exe
  2⤵
  PID:7352
- C:\Windows\System\KSDCxQw.exe
  C:\Windows\System\KSDCxQw.exe
  2⤵
  PID:7400
- C:\Windows\System\bNjbMPR.exe
  C:\Windows\System\bNjbMPR.exe
  2⤵
  PID:7416
- C:\Windows\System\JZLvyQJ.exe
  C:\Windows\System\JZLvyQJ.exe
  2⤵
  PID:7420
- C:\Windows\System\mKcfTUH.exe
  C:\Windows\System\mKcfTUH.exe
  2⤵
  PID:7520
- C:\Windows\System\mwUGPTn.exe
  C:\Windows\System\mwUGPTn.exe
  2⤵
  PID:7584
- C:\Windows\System\wqhMFbj.exe
  C:\Windows\System\wqhMFbj.exe
  2⤵
  PID:7648
- C:\Windows\System\BveMVSt.exe
  C:\Windows\System\BveMVSt.exe
  2⤵
  PID:7572
- C:\Windows\System\sqbfyxt.exe
  C:\Windows\System\sqbfyxt.exe
  2⤵
  PID:7684
- C:\Windows\System\EoEleFm.exe
  C:\Windows\System\EoEleFm.exe
  2⤵
  PID:7504
- C:\Windows\System\dBpgWhr.exe
  C:\Windows\System\dBpgWhr.exe
  2⤵
  PID:7600
- C:\Windows\System\BJuvOsk.exe
  C:\Windows\System\BJuvOsk.exe
  2⤵
  PID:7668
- C:\Windows\System\KjocGfu.exe
  C:\Windows\System\KjocGfu.exe
  2⤵
  PID:7748
- C:\Windows\System\zmuEUHo.exe
  C:\Windows\System\zmuEUHo.exe
  2⤵
  PID:7808
- C:\Windows\System\yQkdfjp.exe
  C:\Windows\System\yQkdfjp.exe
  2⤵
  PID:7840
- C:\Windows\System\oVSDMtJ.exe
  C:\Windows\System\oVSDMtJ.exe
  2⤵
  PID:7792
- C:\Windows\System\XpfMajM.exe
  C:\Windows\System\XpfMajM.exe
  2⤵
  PID:7908
- C:\Windows\System\rXjTcay.exe
  C:\Windows\System\rXjTcay.exe
  2⤵
  PID:7860
- C:\Windows\System\mFSwJGP.exe
  C:\Windows\System\mFSwJGP.exe
  2⤵
  PID:7940
- C:\Windows\System\XTDcbFz.exe
  C:\Windows\System\XTDcbFz.exe
  2⤵
  PID:8000
- C:\Windows\System\akdVniD.exe
  C:\Windows\System\akdVniD.exe
  2⤵
  PID:5704
- C:\Windows\System\LMxKyUy.exe
  C:\Windows\System\LMxKyUy.exe
  2⤵
  PID:8128
- C:\Windows\System\YFmKfPz.exe
  C:\Windows\System\YFmKfPz.exe
  2⤵
  PID:6668
- C:\Windows\System\mmlJOnQ.exe
  C:\Windows\System\mmlJOnQ.exe
  2⤵
  PID:6572
- C:\Windows\System\NYMYZyt.exe
  C:\Windows\System\NYMYZyt.exe
  2⤵
  PID:6932
- C:\Windows\System\NzajCrK.exe
  C:\Windows\System\NzajCrK.exe
  2⤵
  PID:6652
- C:\Windows\System\znrGScr.exe
  C:\Windows\System\znrGScr.exe
  2⤵
  PID:6300
- C:\Windows\System\LPpAcpN.exe
  C:\Windows\System\LPpAcpN.exe
  2⤵
  PID:6584
- C:\Windows\System\hAYfYfa.exe
  C:\Windows\System\hAYfYfa.exe
  2⤵
  PID:6884
- C:\Windows\System\AKPqpat.exe
  C:\Windows\System\AKPqpat.exe
  2⤵
  PID:6284
- C:\Windows\System\DFIyfYk.exe
  C:\Windows\System\DFIyfYk.exe
  2⤵
  PID:7328
- C:\Windows\System\YxopAKB.exe
  C:\Windows\System\YxopAKB.exe
  2⤵
  PID:7384
- C:\Windows\System\vCJlRoN.exe
  C:\Windows\System\vCJlRoN.exe
  2⤵
  PID:7924
- C:\Windows\System\VNMjVOH.exe
  C:\Windows\System\VNMjVOH.exe
  2⤵
  PID:8080
- C:\Windows\System\AdebKMS.exe
  C:\Windows\System\AdebKMS.exe
  2⤵
  PID:5640
- C:\Windows\System\yUeuEOm.exe
  C:\Windows\System\yUeuEOm.exe
  2⤵
  PID:8148
- C:\Windows\System\VfvRZLP.exe
  C:\Windows\System\VfvRZLP.exe
  2⤵
  PID:6836
- C:\Windows\System\zIqgkiW.exe
  C:\Windows\System\zIqgkiW.exe
  2⤵
  PID:7956
- C:\Windows\System\niVawPb.exe
  C:\Windows\System\niVawPb.exe
  2⤵
  PID:8020
- C:\Windows\System\qacpIey.exe
  C:\Windows\System\qacpIey.exe
  2⤵
  PID:7268
- C:\Windows\System\KQXxxgy.exe
  C:\Windows\System\KQXxxgy.exe
  2⤵
  PID:7160
- C:\Windows\System\fypIwBs.exe
  C:\Windows\System\fypIwBs.exe
  2⤵
  PID:6220
- C:\Windows\System\RySHcJM.exe
  C:\Windows\System\RySHcJM.exe
  2⤵
  PID:6520
- C:\Windows\System\oKCetRK.exe
  C:\Windows\System\oKCetRK.exe
  2⤵
  PID:6820
- C:\Windows\System\dJOTUuz.exe
  C:\Windows\System\dJOTUuz.exe
  2⤵
  PID:7388
- C:\Windows\System\VbtjHBR.exe
  C:\Windows\System\VbtjHBR.exe
  2⤵
  PID:7652
- C:\Windows\System\wanEbNz.exe
  C:\Windows\System\wanEbNz.exe
  2⤵
  PID:7620
- C:\Windows\System\twqZcSh.exe
  C:\Windows\System\twqZcSh.exe
  2⤵
  PID:7664
- C:\Windows\System\iknpJrp.exe
  C:\Windows\System\iknpJrp.exe
  2⤵
  PID:7540
- C:\Windows\System\QjKojQP.exe
  C:\Windows\System\QjKojQP.exe
  2⤵
  PID:7828
- C:\Windows\System\luwCJbq.exe
  C:\Windows\System\luwCJbq.exe
  2⤵
  PID:7728
- C:\Windows\System\LlVBRaQ.exe
  C:\Windows\System\LlVBRaQ.exe
  2⤵
  PID:7876
- C:\Windows\System\rqAKpDu.exe
  C:\Windows\System\rqAKpDu.exe
  2⤵
  PID:8064
- C:\Windows\System\ZVGwytz.exe
  C:\Windows\System\ZVGwytz.exe
  2⤵
  PID:8132
- C:\Windows\System\oUgcAvk.exe
  C:\Windows\System\oUgcAvk.exe
  2⤵
  PID:8096
- C:\Windows\System\kbuefND.exe
  C:\Windows\System\kbuefND.exe
  2⤵
  PID:6460
- C:\Windows\System\FIGrTjc.exe
  C:\Windows\System\FIGrTjc.exe
  2⤵
  PID:7292
- C:\Windows\System\wIfudEv.exe
  C:\Windows\System\wIfudEv.exe
  2⤵
  PID:6248
- C:\Windows\System\LHhKosE.exe
  C:\Windows\System\LHhKosE.exe
  2⤵
  PID:7228
- C:\Windows\System\Nmxxsry.exe
  C:\Windows\System\Nmxxsry.exe
  2⤵
  PID:7340
- C:\Windows\System\WeQUiCT.exe
  C:\Windows\System\WeQUiCT.exe
  2⤵
  PID:7316
- C:\Windows\System\irRaWvr.exe
  C:\Windows\System\irRaWvr.exe
  2⤵
  PID:7208
- C:\Windows\System\mjhFJDb.exe
  C:\Windows\System\mjhFJDb.exe
  2⤵
  PID:7556
- C:\Windows\System\AxteBBO.exe
  C:\Windows\System\AxteBBO.exe
  2⤵
  PID:7568
- C:\Windows\System\zEucaby.exe
  C:\Windows\System\zEucaby.exe
  2⤵
  PID:7796
- C:\Windows\System\IvtoHzt.exe
  C:\Windows\System\IvtoHzt.exe
  2⤵
  PID:7988
- C:\Windows\System\zpregNA.exe
  C:\Windows\System\zpregNA.exe
  2⤵
  PID:8016
- C:\Windows\System\ySAOQYO.exe
  C:\Windows\System\ySAOQYO.exe
  2⤵
  PID:6428
- C:\Windows\System\dofuGvi.exe
  C:\Windows\System\dofuGvi.exe
  2⤵
  PID:7616
- C:\Windows\System\tXFYxkT.exe
  C:\Windows\System\tXFYxkT.exe
  2⤵
  PID:7764
- C:\Windows\System\rPoKHNo.exe
  C:\Windows\System\rPoKHNo.exe
  2⤵
  PID:6900
- C:\Windows\System\NGQyUHb.exe
  C:\Windows\System\NGQyUHb.exe
  2⤵
  PID:7044
- C:\Windows\System\SDVyAcr.exe
  C:\Windows\System\SDVyAcr.exe
  2⤵
  PID:7456
- C:\Windows\System\Nfhqwsn.exe
  C:\Windows\System\Nfhqwsn.exe
  2⤵
  PID:8160
- C:\Windows\System\mVvbaTw.exe
  C:\Windows\System\mVvbaTw.exe
  2⤵
  PID:7760
- C:\Windows\System\CMqVaeb.exe
  C:\Windows\System\CMqVaeb.exe
  2⤵
  PID:6816
- C:\Windows\System\dALGvOp.exe
  C:\Windows\System\dALGvOp.exe
  2⤵
  PID:7140
- C:\Windows\System\HhEPwYM.exe
  C:\Windows\System\HhEPwYM.exe
  2⤵
  PID:6880
- C:\Windows\System\HYPYXci.exe
  C:\Windows\System\HYPYXci.exe
  2⤵
  PID:8084
- C:\Windows\System\WcWkeNM.exe
  C:\Windows\System\WcWkeNM.exe
  2⤵
  PID:7112
- C:\Windows\System\gpeAUyy.exe
  C:\Windows\System\gpeAUyy.exe
  2⤵
  PID:8196
- C:\Windows\System\PowrbgJ.exe
  C:\Windows\System\PowrbgJ.exe
  2⤵
  PID:8212
- C:\Windows\System\iYGcoyd.exe
  C:\Windows\System\iYGcoyd.exe
  2⤵
  PID:8228
- C:\Windows\System\cEFCopE.exe
  C:\Windows\System\cEFCopE.exe
  2⤵
  PID:8244
- C:\Windows\System\sRrgAKb.exe
  C:\Windows\System\sRrgAKb.exe
  2⤵
  PID:8260
- C:\Windows\System\VYiZWCR.exe
  C:\Windows\System\VYiZWCR.exe
  2⤵
  PID:8276
- C:\Windows\System\UPPtgjw.exe
  C:\Windows\System\UPPtgjw.exe
  2⤵
  PID:8292
- C:\Windows\System\xWYkjqE.exe
  C:\Windows\System\xWYkjqE.exe
  2⤵
  PID:8308
- C:\Windows\System\JngAIQs.exe
  C:\Windows\System\JngAIQs.exe
  2⤵
  PID:8324
- C:\Windows\System\kjJFMJU.exe
  C:\Windows\System\kjJFMJU.exe
  2⤵
  PID:8340
- C:\Windows\System\IQtWQIu.exe
  C:\Windows\System\IQtWQIu.exe
  2⤵
  PID:8356
- C:\Windows\System\hnSLoII.exe
  C:\Windows\System\hnSLoII.exe
  2⤵
  PID:8372
- C:\Windows\System\kzIWjHL.exe
  C:\Windows\System\kzIWjHL.exe
  2⤵
  PID:8388
- C:\Windows\System\CKlAPYG.exe
  C:\Windows\System\CKlAPYG.exe
  2⤵
  PID:8404
- C:\Windows\System\cdorVys.exe
  C:\Windows\System\cdorVys.exe
  2⤵
  PID:8420
- C:\Windows\System\ayxzlBL.exe
  C:\Windows\System\ayxzlBL.exe
  2⤵
  PID:8436
- C:\Windows\System\WxszJLC.exe
  C:\Windows\System\WxszJLC.exe
  2⤵
  PID:8452
- C:\Windows\System\PiDUfRx.exe
  C:\Windows\System\PiDUfRx.exe
  2⤵
  PID:8468
- C:\Windows\System\XgafuZZ.exe
  C:\Windows\System\XgafuZZ.exe
  2⤵
  PID:8484
- C:\Windows\System\gLVRmdD.exe
  C:\Windows\System\gLVRmdD.exe
  2⤵
  PID:8500
- C:\Windows\System\CTitEKD.exe
  C:\Windows\System\CTitEKD.exe
  2⤵
  PID:8516
- C:\Windows\System\frRNQgI.exe
  C:\Windows\System\frRNQgI.exe
  2⤵
  PID:8532
- C:\Windows\System\BLOHmCS.exe
  C:\Windows\System\BLOHmCS.exe
  2⤵
  PID:8548
- C:\Windows\System\eWYWFRa.exe
  C:\Windows\System\eWYWFRa.exe
  2⤵
  PID:8564
- C:\Windows\System\WaoYSqg.exe
  C:\Windows\System\WaoYSqg.exe
  2⤵
  PID:8580
- C:\Windows\System\DLIRCzJ.exe
  C:\Windows\System\DLIRCzJ.exe
  2⤵
  PID:8596
- C:\Windows\System\sbWVutT.exe
  C:\Windows\System\sbWVutT.exe
  2⤵
  PID:8612
- C:\Windows\System\xJvvSTj.exe
  C:\Windows\System\xJvvSTj.exe
  2⤵
  PID:8628
- C:\Windows\System\kvXIjTc.exe
  C:\Windows\System\kvXIjTc.exe
  2⤵
  PID:8644
- C:\Windows\System\oVTPzei.exe
  C:\Windows\System\oVTPzei.exe
  2⤵
  PID:8664
- C:\Windows\System\nwBHOsA.exe
  C:\Windows\System\nwBHOsA.exe
  2⤵
  PID:8680
- C:\Windows\System\dxaDGnw.exe
  C:\Windows\System\dxaDGnw.exe
  2⤵
  PID:8696
- C:\Windows\System\PkTgszl.exe
  C:\Windows\System\PkTgszl.exe
  2⤵
  PID:8712
- C:\Windows\System\djpHbrT.exe
  C:\Windows\System\djpHbrT.exe
  2⤵
  PID:8728
- C:\Windows\System\TLMfgzp.exe
  C:\Windows\System\TLMfgzp.exe
  2⤵
  PID:8748
- C:\Windows\System\mMlgVRj.exe
  C:\Windows\System\mMlgVRj.exe
  2⤵
  PID:8764
- C:\Windows\System\HuWCZrb.exe
  C:\Windows\System\HuWCZrb.exe
  2⤵
  PID:8780
- C:\Windows\System\cOpiIdc.exe
  C:\Windows\System\cOpiIdc.exe
  2⤵
  PID:8796
- C:\Windows\System\AKSoePz.exe
  C:\Windows\System\AKSoePz.exe
  2⤵
  PID:8812
- C:\Windows\System\gEekWad.exe
  C:\Windows\System\gEekWad.exe
  2⤵
  PID:8828
- C:\Windows\System\DQRUhUX.exe
  C:\Windows\System\DQRUhUX.exe
  2⤵
  PID:8844
- C:\Windows\System\hLYYvst.exe
  C:\Windows\System\hLYYvst.exe
  2⤵
  PID:8860
- C:\Windows\System\BaYtISK.exe
  C:\Windows\System\BaYtISK.exe
  2⤵
  PID:8876
- C:\Windows\System\bCeqUzr.exe
  C:\Windows\System\bCeqUzr.exe
  2⤵
  PID:8892
- C:\Windows\System\qWVKfQb.exe
  C:\Windows\System\qWVKfQb.exe
  2⤵
  PID:8908
- C:\Windows\System\zFSKLVN.exe
  C:\Windows\System\zFSKLVN.exe
  2⤵
  PID:8924
- C:\Windows\System\lJTzPDC.exe
  C:\Windows\System\lJTzPDC.exe
  2⤵
  PID:8940
- C:\Windows\System\tROWONU.exe
  C:\Windows\System\tROWONU.exe
  2⤵
  PID:8956
- C:\Windows\System\mvdJeuM.exe
  C:\Windows\System\mvdJeuM.exe
  2⤵
  PID:8972
- C:\Windows\System\FFFbCjJ.exe
  C:\Windows\System\FFFbCjJ.exe
  2⤵
  PID:8988
- C:\Windows\System\UOynFeA.exe
  C:\Windows\System\UOynFeA.exe
  2⤵
  PID:9004
- C:\Windows\System\qTWmJND.exe
  C:\Windows\System\qTWmJND.exe
  2⤵
  PID:9020
- C:\Windows\System\ifWPGlT.exe
  C:\Windows\System\ifWPGlT.exe
  2⤵
  PID:9036
- C:\Windows\System\mfqFvPs.exe
  C:\Windows\System\mfqFvPs.exe
  2⤵
  PID:9052
- C:\Windows\System\aANZiNp.exe
  C:\Windows\System\aANZiNp.exe
  2⤵
  PID:9068
- C:\Windows\System\bbCerHO.exe
  C:\Windows\System\bbCerHO.exe
  2⤵
  PID:9084
- C:\Windows\System\wfcWcpB.exe
  C:\Windows\System\wfcWcpB.exe
  2⤵
  PID:9100
- C:\Windows\System\fVSDxKM.exe
  C:\Windows\System\fVSDxKM.exe
  2⤵
  PID:9116
- C:\Windows\System\aPBcKlS.exe
  C:\Windows\System\aPBcKlS.exe
  2⤵
  PID:9132
- C:\Windows\System\girBNJW.exe
  C:\Windows\System\girBNJW.exe
  2⤵
  PID:9148
- C:\Windows\System\yrmLQsd.exe
  C:\Windows\System\yrmLQsd.exe
  2⤵
  PID:9164
- C:\Windows\System\dGisxpu.exe
  C:\Windows\System\dGisxpu.exe
  2⤵
  PID:9180
- C:\Windows\System\jkQPdOO.exe
  C:\Windows\System\jkQPdOO.exe
  2⤵
  PID:9196
- C:\Windows\System\BgankyX.exe
  C:\Windows\System\BgankyX.exe
  2⤵
  PID:9212
- C:\Windows\System\QxiZAvs.exe
  C:\Windows\System\QxiZAvs.exe
  2⤵
  PID:8240
- C:\Windows\System\MhIRcIK.exe
  C:\Windows\System\MhIRcIK.exe
  2⤵
  PID:8304
- C:\Windows\System\AMiXfeM.exe
  C:\Windows\System\AMiXfeM.exe
  2⤵
  PID:8364
- C:\Windows\System\otbuyuf.exe
  C:\Windows\System\otbuyuf.exe
  2⤵
  PID:8036
- C:\Windows\System\nlBVZRh.exe
  C:\Windows\System\nlBVZRh.exe
  2⤵
  PID:6180
- C:\Windows\System\lFGyfsI.exe
  C:\Windows\System\lFGyfsI.exe
  2⤵
  PID:8252
- C:\Windows\System\cFhvbfB.exe
  C:\Windows\System\cFhvbfB.exe
  2⤵
  PID:7476
- C:\Windows\System\zdtxcMK.exe
  C:\Windows\System\zdtxcMK.exe
  2⤵
  PID:8400
- C:\Windows\System\dpuBMvz.exe
  C:\Windows\System\dpuBMvz.exe
  2⤵
  PID:8380
- C:\Windows\System\rLNzFla.exe
  C:\Windows\System\rLNzFla.exe
  2⤵
  PID:8316
- C:\Windows\System\ooaEuce.exe
  C:\Windows\System\ooaEuce.exe
  2⤵
  PID:8492
- C:\Windows\System\kaZjmFb.exe
  C:\Windows\System\kaZjmFb.exe
  2⤵
  PID:8416
- C:\Windows\System\szqrGQN.exe
  C:\Windows\System\szqrGQN.exe
  2⤵
  PID:8508
- C:\Windows\System\uzNZMKl.exe
  C:\Windows\System\uzNZMKl.exe
  2⤵
  PID:8556
- C:\Windows\System\JwNFeBv.exe
  C:\Windows\System\JwNFeBv.exe
  2⤵
  PID:8588
- C:\Windows\System\mgJUGgS.exe
  C:\Windows\System\mgJUGgS.exe
  2⤵
  PID:8604
- C:\Windows\System\ucbybvh.exe
  C:\Windows\System\ucbybvh.exe
  2⤵
  PID:8620
- C:\Windows\System\gMsdcKX.exe
  C:\Windows\System\gMsdcKX.exe
  2⤵
  PID:8688
- C:\Windows\System\fcAJHKi.exe
  C:\Windows\System\fcAJHKi.exe
  2⤵
  PID:8704
- C:\Windows\System\vGKadNj.exe
  C:\Windows\System\vGKadNj.exe
  2⤵
  PID:8756
- C:\Windows\System\eFAXEks.exe
  C:\Windows\System\eFAXEks.exe
  2⤵
  PID:8760
- C:\Windows\System\hIfqBmc.exe
  C:\Windows\System\hIfqBmc.exe
  2⤵
  PID:8824
- C:\Windows\System\UwnkOqN.exe
  C:\Windows\System\UwnkOqN.exe
  2⤵
  PID:8856
- C:\Windows\System\pYMCSrQ.exe
  C:\Windows\System\pYMCSrQ.exe
  2⤵
  PID:8948
- C:\Windows\System\yomUqZB.exe
  C:\Windows\System\yomUqZB.exe
  2⤵
  PID:9012
- C:\Windows\System\eXYHRrZ.exe
  C:\Windows\System\eXYHRrZ.exe
  2⤵
  PID:9080
- C:\Windows\System\hClRgEH.exe
  C:\Windows\System\hClRgEH.exe
  2⤵
  PID:9144
- C:\Windows\System\efklOXL.exe
  C:\Windows\System\efklOXL.exe
  2⤵
  PID:9204
- C:\Windows\System\eLMYyrf.exe
  C:\Windows\System\eLMYyrf.exe
  2⤵
  PID:6556
- C:\Windows\System\BJVdYvU.exe
  C:\Windows\System\BJVdYvU.exe
  2⤵
  PID:8144
- C:\Windows\System\ZdkfkmP.exe
  C:\Windows\System\ZdkfkmP.exe
  2⤵
  PID:8524
- C:\Windows\System\EQpgIXp.exe
  C:\Windows\System\EQpgIXp.exe
  2⤵
  PID:8592
- C:\Windows\System\ozIzhVA.exe
  C:\Windows\System\ozIzhVA.exe
  2⤵
  PID:8840
- C:\Windows\System\FYlHhbW.exe
  C:\Windows\System\FYlHhbW.exe
  2⤵
  PID:8772
- C:\Windows\System\cmrnrrF.exe
  C:\Windows\System\cmrnrrF.exe
  2⤵
  PID:8920
- C:\Windows\System\gnmPXBu.exe
  C:\Windows\System\gnmPXBu.exe
  2⤵
  PID:9188
- C:\Windows\System\OcDMemR.exe
  C:\Windows\System\OcDMemR.exe
  2⤵
  PID:8256
- C:\Windows\System\JgzOmMR.exe
  C:\Windows\System\JgzOmMR.exe
  2⤵
  PID:6648
- C:\Windows\System\QglGexJ.exe
  C:\Windows\System\QglGexJ.exe
  2⤵
  PID:8836
- C:\Windows\System\CDSwiOt.exe
  C:\Windows\System\CDSwiOt.exe
  2⤵
  PID:8884
- C:\Windows\System\dkhFxyl.exe
  C:\Windows\System\dkhFxyl.exe
  2⤵
  PID:9160
- C:\Windows\System\XJPjXze.exe
  C:\Windows\System\XJPjXze.exe
  2⤵
  PID:8720
- C:\Windows\System\BaHiMvQ.exe
  C:\Windows\System\BaHiMvQ.exe
  2⤵
  PID:8740
- C:\Windows\System\iVFYHxL.exe
  C:\Windows\System\iVFYHxL.exe
  2⤵
  PID:8968
- C:\Windows\System\XbVXkCL.exe
  C:\Windows\System\XbVXkCL.exe
  2⤵
  PID:8980
- C:\Windows\System\vVmUJPl.exe
  C:\Windows\System\vVmUJPl.exe
  2⤵
  PID:8336
- C:\Windows\System\XyTObhl.exe
  C:\Windows\System\XyTObhl.exe
  2⤵
  PID:8448
- C:\Windows\System\AbuRDcI.exe
  C:\Windows\System\AbuRDcI.exe
  2⤵
  PID:8560
- C:\Windows\System\KlVnBTJ.exe
  C:\Windows\System\KlVnBTJ.exe
  2⤵
  PID:9140
- C:\Windows\System\PeCvsxT.exe
  C:\Windows\System\PeCvsxT.exe
  2⤵
  PID:8528
- C:\Windows\System\nygntHl.exe
  C:\Windows\System\nygntHl.exe
  2⤵
  PID:8792
- C:\Windows\System\vDJrTQi.exe
  C:\Windows\System\vDJrTQi.exe
  2⤵
  PID:9044
- C:\Windows\System\xjgHmzF.exe
  C:\Windows\System\xjgHmzF.exe
  2⤵
  PID:8208
- C:\Windows\System\wcSwpXP.exe
  C:\Windows\System\wcSwpXP.exe
  2⤵
  PID:8964
- C:\Windows\System\xFLwruN.exe
  C:\Windows\System\xFLwruN.exe
  2⤵
  PID:9076
- C:\Windows\System\nRoVXTP.exe
  C:\Windows\System\nRoVXTP.exe
  2⤵
  PID:9128
- C:\Windows\System\OXtKfjm.exe
  C:\Windows\System\OXtKfjm.exe
  2⤵
  PID:8236
- C:\Windows\System\MLdFDxc.exe
  C:\Windows\System\MLdFDxc.exe
  2⤵
  PID:8284
- C:\Windows\System\AThcaLZ.exe
  C:\Windows\System\AThcaLZ.exe
  2⤵
  PID:8432
- C:\Windows\System\RcGRxyM.exe
  C:\Windows\System\RcGRxyM.exe
  2⤵
  PID:8640
- C:\Windows\System\dEwOxbm.exe
  C:\Windows\System\dEwOxbm.exe
  2⤵
  PID:8544
- C:\Windows\System\lJfoJWM.exe
  C:\Windows\System\lJfoJWM.exe
  2⤵
  PID:7712
- C:\Windows\System\ATCKWiV.exe
  C:\Windows\System\ATCKWiV.exe
  2⤵
  PID:9232
- C:\Windows\System\GitRKdN.exe
  C:\Windows\System\GitRKdN.exe
  2⤵
  PID:9248
- C:\Windows\System\lYHHLRB.exe
  C:\Windows\System\lYHHLRB.exe
  2⤵
  PID:9264
- C:\Windows\System\tdUGfdm.exe
  C:\Windows\System\tdUGfdm.exe
  2⤵
  PID:9280
- C:\Windows\System\QVVNySc.exe
  C:\Windows\System\QVVNySc.exe
  2⤵
  PID:9296
- C:\Windows\System\FRrNIyt.exe
  C:\Windows\System\FRrNIyt.exe
  2⤵
  PID:9312
- C:\Windows\System\gmpsyck.exe
  C:\Windows\System\gmpsyck.exe
  2⤵
  PID:9328
- C:\Windows\System\ccOyjNY.exe
  C:\Windows\System\ccOyjNY.exe
  2⤵
  PID:9344
- C:\Windows\System\MONfQqp.exe
  C:\Windows\System\MONfQqp.exe
  2⤵
  PID:9360
- C:\Windows\System\WMixSCs.exe
  C:\Windows\System\WMixSCs.exe
  2⤵
  PID:9376
- C:\Windows\System\MaMzrcA.exe
  C:\Windows\System\MaMzrcA.exe
  2⤵
  PID:9392
- C:\Windows\System\bbqeQKe.exe
  C:\Windows\System\bbqeQKe.exe
  2⤵
  PID:9412
- C:\Windows\System\hlToocU.exe
  C:\Windows\System\hlToocU.exe
  2⤵
  PID:9428
- C:\Windows\System\yNoLCfc.exe
  C:\Windows\System\yNoLCfc.exe
  2⤵
  PID:9444
- C:\Windows\System\ThgTtYF.exe
  C:\Windows\System\ThgTtYF.exe
  2⤵
  PID:9460
- C:\Windows\System\hiltGgR.exe
  C:\Windows\System\hiltGgR.exe
  2⤵
  PID:9476
- C:\Windows\System\drIoBlp.exe
  C:\Windows\System\drIoBlp.exe
  2⤵
  PID:9492
- C:\Windows\System\wxlQozq.exe
  C:\Windows\System\wxlQozq.exe
  2⤵
  PID:9508
- C:\Windows\System\eenqSwc.exe
  C:\Windows\System\eenqSwc.exe
  2⤵
  PID:9524
- C:\Windows\System\ulhjaxz.exe
  C:\Windows\System\ulhjaxz.exe
  2⤵
  PID:9540
- C:\Windows\System\lGVLnzo.exe
  C:\Windows\System\lGVLnzo.exe
  2⤵
  PID:9556
- C:\Windows\System\usobzPz.exe
  C:\Windows\System\usobzPz.exe
  2⤵
  PID:9572
- C:\Windows\System\YcqtYOy.exe
  C:\Windows\System\YcqtYOy.exe
  2⤵
  PID:9588
- C:\Windows\System\RPZkVnl.exe
  C:\Windows\System\RPZkVnl.exe
  2⤵
  PID:9604
- C:\Windows\System\TMGmpkC.exe
  C:\Windows\System\TMGmpkC.exe
  2⤵
  PID:9620
- C:\Windows\System\ifywspf.exe
  C:\Windows\System\ifywspf.exe
  2⤵
  PID:9636
- C:\Windows\System\GKFBjqW.exe
  C:\Windows\System\GKFBjqW.exe
  2⤵
  PID:9652
- C:\Windows\System\aKmFbJp.exe
  C:\Windows\System\aKmFbJp.exe
  2⤵
  PID:9668
- C:\Windows\System\AGngWwJ.exe
  C:\Windows\System\AGngWwJ.exe
  2⤵
  PID:9684
- C:\Windows\System\clPHHZj.exe
  C:\Windows\System\clPHHZj.exe
  2⤵
  PID:9700
- C:\Windows\System\WIjztDu.exe
  C:\Windows\System\WIjztDu.exe
  2⤵
  PID:9716
- C:\Windows\System\omRHFHn.exe
  C:\Windows\System\omRHFHn.exe
  2⤵
  PID:9732
- C:\Windows\System\oKlbDhu.exe
  C:\Windows\System\oKlbDhu.exe
  2⤵
  PID:9748
- C:\Windows\System\RBonnSy.exe
  C:\Windows\System\RBonnSy.exe
  2⤵
  PID:9764
- C:\Windows\System\ozCTlXL.exe
  C:\Windows\System\ozCTlXL.exe
  2⤵
  PID:9780
- C:\Windows\System\mApnJts.exe
  C:\Windows\System\mApnJts.exe
  2⤵
  PID:9796
- C:\Windows\System\jaOaXLW.exe
  C:\Windows\System\jaOaXLW.exe
  2⤵
  PID:9812
- C:\Windows\System\vFoMfYI.exe
  C:\Windows\System\vFoMfYI.exe
  2⤵
  PID:9828
- C:\Windows\System\HITZvkF.exe
  C:\Windows\System\HITZvkF.exe
  2⤵
  PID:9844
- C:\Windows\System\VIEiZvo.exe
  C:\Windows\System\VIEiZvo.exe
  2⤵
  PID:9860
- C:\Windows\System\sFVXcYb.exe
  C:\Windows\System\sFVXcYb.exe
  2⤵
  PID:9876
- C:\Windows\System\DEkPNeq.exe
  C:\Windows\System\DEkPNeq.exe
  2⤵
  PID:9892
- C:\Windows\System\HEzDnhe.exe
  C:\Windows\System\HEzDnhe.exe
  2⤵
  PID:9908
- C:\Windows\System\IajGxzu.exe
  C:\Windows\System\IajGxzu.exe
  2⤵
  PID:9924
- C:\Windows\System\kwdeoNI.exe
  C:\Windows\System\kwdeoNI.exe
  2⤵
  PID:9940
- C:\Windows\System\UAhPpEi.exe
  C:\Windows\System\UAhPpEi.exe
  2⤵
  PID:9956
- C:\Windows\System\vaoKtUh.exe
  C:\Windows\System\vaoKtUh.exe
  2⤵
  PID:9972
- C:\Windows\System\svhBLIR.exe
  C:\Windows\System\svhBLIR.exe
  2⤵
  PID:9988
- C:\Windows\System\SnstFBi.exe
  C:\Windows\System\SnstFBi.exe
  2⤵
  PID:10004
- C:\Windows\System\NSJiwiF.exe
  C:\Windows\System\NSJiwiF.exe
  2⤵
  PID:10020
- C:\Windows\System\CvONiOi.exe
  C:\Windows\System\CvONiOi.exe
  2⤵
  PID:10036
- C:\Windows\System\dPcbzxV.exe
  C:\Windows\System\dPcbzxV.exe
  2⤵
  PID:10052
- C:\Windows\System\RCBNVrD.exe
  C:\Windows\System\RCBNVrD.exe
  2⤵
  PID:10068
- C:\Windows\System\cQeQgtV.exe
  C:\Windows\System\cQeQgtV.exe
  2⤵
  PID:10084
- C:\Windows\System\WVxJuMP.exe
  C:\Windows\System\WVxJuMP.exe
  2⤵
  PID:10100
- C:\Windows\System\aHUyoyK.exe
  C:\Windows\System\aHUyoyK.exe
  2⤵
  PID:10116
- C:\Windows\System\IBXErZY.exe
  C:\Windows\System\IBXErZY.exe
  2⤵
  PID:10132
- C:\Windows\System\ZRIvCDc.exe
  C:\Windows\System\ZRIvCDc.exe
  2⤵
  PID:10148
- C:\Windows\System\ICabXbG.exe
  C:\Windows\System\ICabXbG.exe
  2⤵
  PID:10164
- C:\Windows\System\ahFEkZX.exe
  C:\Windows\System\ahFEkZX.exe
  2⤵
  PID:10180
- C:\Windows\System\gcBqqoB.exe
  C:\Windows\System\gcBqqoB.exe
  2⤵
  PID:10196
- C:\Windows\System\DeRBMcN.exe
  C:\Windows\System\DeRBMcN.exe
  2⤵
  PID:10212
- C:\Windows\System\CGdcGUY.exe
  C:\Windows\System\CGdcGUY.exe
  2⤵
  PID:10228
- C:\Windows\System\fhbqaac.exe
  C:\Windows\System\fhbqaac.exe
  2⤵
  PID:9240
- C:\Windows\System\xmJbgYf.exe
  C:\Windows\System\xmJbgYf.exe
  2⤵
  PID:8868
- C:\Windows\System\euryhRb.exe
  C:\Windows\System\euryhRb.exe
  2⤵
  PID:9000
- C:\Windows\System\mTmdfRl.exe
  C:\Windows\System\mTmdfRl.exe
  2⤵
  PID:9340
- C:\Windows\System\aAdxckS.exe
  C:\Windows\System\aAdxckS.exe
  2⤵
  PID:9156
- C:\Windows\System\mEqlyZu.exe
  C:\Windows\System\mEqlyZu.exe
  2⤵
  PID:8660
- C:\Windows\System\eVvqXbr.exe
  C:\Windows\System\eVvqXbr.exe
  2⤵
  PID:9408
- C:\Windows\System\okRiTWg.exe
  C:\Windows\System\okRiTWg.exe
  2⤵
  PID:9096
- C:\Windows\System\gRolsCC.exe
  C:\Windows\System\gRolsCC.exe
  2⤵
  PID:9228
- C:\Windows\System\EntbHOo.exe
  C:\Windows\System\EntbHOo.exe
  2⤵
  PID:9356
- C:\Windows\System\kCubgMA.exe
  C:\Windows\System\kCubgMA.exe
  2⤵
  PID:9452
- C:\Windows\System\NoQtQeZ.exe
  C:\Windows\System\NoQtQeZ.exe
  2⤵
  PID:9440
- C:\Windows\System\fekOmZG.exe
  C:\Windows\System\fekOmZG.exe
  2⤵
  PID:9488
- C:\Windows\System\dkKbGLu.exe
  C:\Windows\System\dkKbGLu.exe
  2⤵
  PID:9536
- C:\Windows\System\FYpwAfV.exe
  C:\Windows\System\FYpwAfV.exe
  2⤵
  PID:9548
- C:\Windows\System\rVtiMMp.exe
  C:\Windows\System\rVtiMMp.exe
  2⤵
  PID:9628
- C:\Windows\System\mzwboJW.exe
  C:\Windows\System\mzwboJW.exe
  2⤵
  PID:9612
- C:\Windows\System\KePAiXS.exe
  C:\Windows\System\KePAiXS.exe
  2⤵
  PID:9616
- C:\Windows\System\QvYShhY.exe
  C:\Windows\System\QvYShhY.exe
  2⤵
  PID:9692
- C:\Windows\System\NEtbNXO.exe
  C:\Windows\System\NEtbNXO.exe
  2⤵
  PID:9728
- C:\Windows\System\AtwCXNu.exe
  C:\Windows\System\AtwCXNu.exe
  2⤵
  PID:9760
- C:\Windows\System\mWCejbv.exe
  C:\Windows\System\mWCejbv.exe
  2⤵
  PID:9772
- C:\Windows\System\RavoiCF.exe
  C:\Windows\System\RavoiCF.exe
  2⤵
  PID:9852
- C:\Windows\System\MRKYgDl.exe
  C:\Windows\System\MRKYgDl.exe
  2⤵
  PID:9808
- C:\Windows\System\PDNSKAW.exe
  C:\Windows\System\PDNSKAW.exe
  2⤵
  PID:9900
- C:\Windows\System\zgqQJgj.exe
  C:\Windows\System\zgqQJgj.exe
  2⤵
  PID:9920
- C:\Windows\System\SMMtOGW.exe
  C:\Windows\System\SMMtOGW.exe
  2⤵
  PID:9936
- C:\Windows\System\aflijBd.exe
  C:\Windows\System\aflijBd.exe
  2⤵
  PID:9996
- C:\Windows\System\VSoQucX.exe
  C:\Windows\System\VSoQucX.exe
  2⤵
  PID:10000
- C:\Windows\System\pIYKYrM.exe
  C:\Windows\System\pIYKYrM.exe
  2⤵
  PID:10080
- C:\Windows\System\NTXmbYx.exe
  C:\Windows\System\NTXmbYx.exe
  2⤵
  PID:10144
- C:\Windows\System\djmZpHT.exe
  C:\Windows\System\djmZpHT.exe
  2⤵
  PID:10208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AQmLJXD.exe

Filesize
2.2MB

MD5
ccb64b1927ab6c4b7c7ca6ad1f78b792

SHA1
2ed30c894e099d601912e15ffc82c1c4d1f649dd

SHA256
97ff6bbc5498b41c3087c68e87fafde6f2380bfdf573221719bd00418cf23983

SHA512
2b56f30a7da21e106cd8114de0620840d36258a2296d7c0d1c21df6a67f90c62394f62d196babbbce1eedd52602c4779f9b39592d996fbf5692e8637ce282e66

Download Submit
C:\Windows\system\DZgLlMu.exe

Filesize
2.2MB

MD5
bf8e33099a8ef04086833c8443a574ff

SHA1
4afe58db7539f98d6fc5ad7beac8513593bcf09d

SHA256
c64b2696197a0cd22bbbb2a9730030040c492247fa21483310a95fc3f3897085

SHA512
a3ffcb3c7c751af0e45b9ac5a638b2338a5f2ed03ab61cadb422658b342665be2d0463a6cd72b480e02bb6b5fade943112e793e4c0112eb8a042bce404eea455

Download Submit
C:\Windows\system\GYBedNX.exe

Filesize
2.2MB

MD5
67cd34993f5a29887a9c2bad7f4eeb82

SHA1
62719cdfde75a0af137869437a8c8648b9170d25

SHA256
d816669fc99b7ffaf4fb1338536dd74fbe54ae6a4178f15d1659031a986ed2f5

SHA512
6783b71f095cd74fe38197b2ea56ca42f040509903280aaab0158d38e55a576dc340428568508920e9cd5fc919c4aa9a8f383a96bcd4e6fd5fe871874bd9398d

Download Submit
C:\Windows\system\HyeyKFm.exe

Filesize
2.2MB

MD5
38db2814cd0b051b5c604eae364895ca

SHA1
ae7d313574566968495bc707b8ae5f9779eafe38

SHA256
3fbd748cf68d62d0c1c513792a22468bbbc9d8b7e5238e88dca1adbab92b7282

SHA512
2faa2190ea87234b9174cd598e03fe77879f1ccb6cd5e8e9b28b0c81cdd162a0ababd0c139372a5440bdcdfa6c2e8029cef1c8139b0f9e5f3a9555c4dc0f4ea4

Download Submit
C:\Windows\system\InWmaQB.exe

Filesize
2.2MB

MD5
f14a08a484483942ca2c32399990fe12

SHA1
d668e90d425538f3332a038a4c6c9e53dbe51b0f

SHA256
0d095045320fcc461a7490496f75c5d81a6f70186728b5aaea1fa5434b12bd89

SHA512
6712fa9c939c06668d2bbd75b890204590871e23657435e589ec73fa9185255f6810ba8c8ab90542854b3a1eb7a12e019845322abcd3f566c99e66da862eb52f

Download Submit
C:\Windows\system\KNWNMsd.exe

Filesize
2.2MB

MD5
a1aa5b89449064519641f9e0d593f64c

SHA1
2a8f0079106604b81584b79b1b94a654039626c6

SHA256
6277bb294aa4fc37f61a626e98a38913036be0bb938c7cf2605e16e316c9d1bf

SHA512
eaea428c0cf8e19e463bf72ba4d77f1826d2bbbfa4e6167f64731490b4e0b9de1e8b43d00536111abe33a7727b2a8fc2d6a332a835131de1b479432addcbb4bd

Download Submit
C:\Windows\system\MkqqcVz.exe

Filesize
2.2MB

MD5
d084a210d26fceed34465f57a6a38658

SHA1
e21638ec0252375c33e905457c1fee9079762be9

SHA256
4ecd609d09dc8d8fda96a7bfdc0fbfdb87a37951987c4f82fe113abe627571cc

SHA512
ed8efe386af21c37df23005f56c3465330e7c684abb5c9e066b913d1594f3b57a7a07b4ee8e2fb59426c2535fd2cde938e3216aa3dd501b3e6ffd5cf7f6a63ea

Download Submit
C:\Windows\system\QDQuxnw.exe

Filesize
2.2MB

MD5
b74a5fd70a0e64aa6f51e41bd2164ab0

SHA1
a92b0986e3adecfaa239856e6f66cefbaac1d6f5

SHA256
5a3e64ff961812a96834ff922a3a463c3a292204208b6848b5878f90fa519fbe

SHA512
c8e3c87f4ebcfcc3b230f2a5cb330cc54f77f7db44b937ee4abb06efef7be297485e5c8333155d00f9e82d444c7db75f0f39e717f2dd0b66b6277e3ad006cc48

Download Submit
C:\Windows\system\RRRtBaH.exe

Filesize
2.2MB

MD5
b51eee678862fae9bea3fc5d0c12016b

SHA1
04d1b35531070313a75c3f62c43d42e0057d4bdc

SHA256
8e7e037675767a36473876b70c56aa611eba1c42e27d2dd7a6f93129901f488a

SHA512
383a9efa18fcd2e5c2302a90f518edea7a027674bdb54918bc7ea869ec0d57c5a6d0fb7f10d113d24b486a753210c52413155227252c52749fe3a25a992dcd0d

Download Submit
C:\Windows\system\SXHcIqJ.exe

Filesize
2.2MB

MD5
5827418d27e19695a808170bf6694e85

SHA1
452863df2db8938e85a0c54b31c6b133aae704bd

SHA256
92498d9d3e09b5323d0a90e95eab2dd33bb505f35cd33e592cb55186ac2ce2cd

SHA512
980aef334234febf3bd9e5df3e084b3de75382b2d55fffea2c0baabddd54c4061f8021f488f47454765d4a748c3daaf3ceb92a9180952b14dd99e46a75f12ef1

Download Submit
C:\Windows\system\WReZbBq.exe

Filesize
18B

MD5
35bde48c57b79a5e0ea0718733e62371

SHA1
41d2e344c30d7af2c472ba7a6ded43f0a9d6d4c2

SHA256
407b155a736cda52f1eb2b18d7fea9e028f3f4f796230535df591f3124a679c0

SHA512
a6c519b6e0f42a0f961fc4c0161e01dfb018e01d40d6b50a2a61a6cfeffa9e0fa78a3d1bb24269ec827e815cd0942de8d545ba7f93aa13de1bab78f87b543dba

Download Submit
C:\Windows\system\YySLedt.exe

Filesize
2.2MB

MD5
83086c2ae9d19d8f7554d588f51b2c48

SHA1
1b3cb8e4ae853c8e0628b717debc75dc544571ca

SHA256
326810d1f95b3fbfd4d5e8e42df5f86548e79f3f29006f4b05ba9b3d207a6833

SHA512
b8609cc0a18a9a78028ef837c6dd7092a0cea843bae121fc0b63edfa7da5600806433dcf8ebe964b2126dfaabaef208fd2b85596d770bfbb0a7b316aabdbceb7

Download Submit
C:\Windows\system\ZmYYaNa.exe

Filesize
2.2MB

MD5
daf708cd51269b40c4318084a4b650b2

SHA1
2cdb9fcc6b392a9ab89d81d3b1ec788a62b4f3e5

SHA256
e0564350fc32322622041d8cb524de1f3b735bdffce232834d40eaaa8942a1b2

SHA512
f7a1975c0bccb64c85b9db1a429dc4ba5273969c3af8a563da118925be9b02cd2412168c26add9bc0c3778d0f45bd4ae6ed42afb48dbd1a896bf0556867132a6

Download Submit
C:\Windows\system\dDUZSzZ.exe

Filesize
2.2MB

MD5
a296816c832395ac662b6ef0fd380c78

SHA1
3959c3ae4eac894e0d2417c92b3057dd866ba49b

SHA256
e1c40c7e8f0ec35c9ed6d341de43f3d89cbee504c468bcc650f863d023edfab6

SHA512
085fcaed625b0a765005fc8d3383640b549b8455b2542d7ca8d51dd6f820e848daed6dfb379fe4f9265b06c9f819af38a7ff2b3a8119fda2b7c3f9d0625aeca7

Download Submit
C:\Windows\system\fWXXLoz.exe

Filesize
2.2MB

MD5
aa2a4efbd2cbbb5ffde20ef4596f56e5

SHA1
12e61766d7ad720a218095a0ca0e05e726bf9e05

SHA256
9c44c88ea0e8ce9c168032c3dafc3e8019117bace822d5ff9d8ec12d0fd416b3

SHA512
2b7832db2cc69c218b1bb22e109fb183c7afcc7722c7e3219484291c6738a3deb160753ba430534e70d86be1defdf612fb0d2569b2b67fbc5bc4ebbf8d54b652

Download Submit
C:\Windows\system\iEcieQZ.exe

Filesize
2.2MB

MD5
549c218407ac5ad0a6a3d07d8ae4888a

SHA1
f96798ec6e8cb8aebdc7f85c51bbf26b92678402

SHA256
aa7c9a5bcfb7b9e8204d46280e8888f485413916aa15cea08c512b56ba1f70b2

SHA512
2b4fb0b7884af66bfc30cf74c272e2638eaecec3a665fb9e99ac03f3a0bfd11f439fe012945b5cc378d7dc5a8a19c4c3781da64434bd5fe3452db10740c54b8e

Download Submit
C:\Windows\system\kHGzTKw.exe

Filesize
2.2MB

MD5
c148d01b793439a4f920d16e93b0c986

SHA1
44cbec4f613ab601646cdb1043b760ade196ab23

SHA256
500ad3f0d00a5a38cf4299e57be343a6eab3c4d72e0f78ed61441b145a88ba3b

SHA512
2327a04386aeb89be2db3374ef826727c8155ac8a6573a915e0d7558b06eb231591542e6894c399c2d76a593eb6a7ece7e1019c64fcaae3b374ef03d9a64e88a

Download Submit
C:\Windows\system\pZPiplp.exe

Filesize
2.2MB

MD5
44e8ac9821c54fd59474113f94f5deb2

SHA1
739d1907bf790b747270a5d429b19702e7c2399c

SHA256
284e8d6d21b57ab54acc5a3585d25578fe8a4e85fad15d37b9f218cd1272a15d

SHA512
1bb630625c6059f3fd24b46411cec99dc7e8ba0cecc9711f083e05895f43c8642af466a904322097e8d5d32fcc89b5fd6905e0d3fe7ed84b3d68ad41ad44349d

Download Submit
C:\Windows\system\xDhUgXQ.exe

Filesize
2.2MB

MD5
481c447c1a8045580360e220ed1f4316

SHA1
c04f9e7308129c67eaaa810a3c394c4b747a76e8

SHA256
490d1286054cfe959e27843af372668edc39863019b9305f8f01d165a6e029e3

SHA512
1848be2f072e6608ea97bf1440713d1e4b96424e9897ca4a530fa696200e254b6423a41ea400c9be362d043a983a3772f7e015d9852d3a439be13b6c80c9cf83

Download Submit
C:\Windows\system\xneQckr.exe

Filesize
2.2MB

MD5
e638950ca515589bb5fe3fbf51ee7722

SHA1
118353ac33132aa414e9bfefa9305436622e7631

SHA256
8530a0ab3644e5910f1b34e3e1a0953215a302f455eeb10c875c815c9eac6977

SHA512
019fc41ac69a3aa8512529d4153903afe9a28836b718857a10dac8b426ebb0ced5ea4886eae85f4f90844587ea23ad70737b3894994e635020d95b616ba74e1e

Download Submit
C:\Windows\system\zlEnsnH.exe

Filesize
2.2MB

MD5
95f011f12aa5c7c89cb964764362411a

SHA1
04565f9c4827968b1b03677bb61d85a186817120

SHA256
57c2481a0d32f0ffc4261d26060384a2f11f6d674050a482455840e7c086cea2

SHA512
7001a9c100fd963e04c255baf31b2f98f4e84f8b8b1c2dd50b003907272b485c376411b61783c11ef8743762460cfb975e3a40c3e2c39a447c128a83f3b6e767

Download Submit
\Windows\system\GHOfzKM.exe

Filesize
2.2MB

MD5
d71bb2151c514c31239b7ec7679f1c1f

SHA1
7a308d0561c258cc9d9519484c67151325486ca9

SHA256
1a7acf70dcc109b928cdbf0cf78bd90b315fad8bdef0bb02523f2ad80df4d713

SHA512
c2c0b355d33fd6ee3f5853daa5341a977ec02ad1e9446ced38db9c325569f73b85c597796b456655f1a9f59078e643274be6786ea1a34020bd5a9b07930e128d

Download Submit
\Windows\system\UMKyzdb.exe

Filesize
2.2MB

MD5
4514f03533628f85b0247c731a63841f

SHA1
a062ec1884b60ebf759a49ecb6da0a08ea58d860

SHA256
a12680b5499439289f306b81a9661088f32a0942e59bb89acd3a04ff92628a6d

SHA512
1c6c9148ce1008adeba532336b36d7314716d99e40fe78e4cf9b1bb63dee8408047ce3cb9a176dd258a95f00af8a6528f469f4f5a9853ad1eff14b45747ea3c0

Download Submit
\Windows\system\UYYUZWB.exe

Filesize
2.2MB

MD5
eaab67e96212f9889099c6574822aaf6

SHA1
26039024c716794ba2e7e8c18378c4dcad0d0f97

SHA256
90b0dc705421c2a8064ab0f17335349e34d0735279c3c444b82c2c9c17d9a989

SHA512
e8581c1eaf59927dc48310abb5a11ac36c5506a7d9afb3f92a4d71e7a0dfd6b7817a0ca1204a50d1b4c691e94b0d17ceda33afbd116e54655b996c61fb6808b1

Download Submit
\Windows\system\YOOgYQD.exe

Filesize
2.2MB

MD5
a5462ff9d9ac9c57af8bc303defe2b0f

SHA1
2038894f1c68d491be482be8fa8b65eb367bf2d5

SHA256
5348458621d613948e25330d310c2019905c35cc4cd144b8fe10bc7b4a2a0405

SHA512
b08055f0d10a15e9e94941b7392afd8dee5f51861e3ac1c8b065111d35f4acecc63f036698e60cff143bbf853e4cb0e27b32520ea341ade459e62c5dd27d04af

Download Submit
\Windows\system\avchbNJ.exe

Filesize
2.2MB

MD5
1619d968c5f8f8ca1d77fecc599b8ee5

SHA1
70f2ef2b79b3f3021eea1293fa688f8c2218339a

SHA256
b84b4f7f75c52220ed19f8fb27ddbb55a66381a79f4c960dbefacf9b2a7ff564

SHA512
aaa4148abba3a55250996bf670c762d64b3ba2dcd868372474ee41afccaeaf370ab215209b1b7922e90b9cf4f56c60c3ae68067274dc6d917bf205b96c5f791b

Download Submit
\Windows\system\eCIDqok.exe

Filesize
2.2MB

MD5
a77d1b9851398f726b8432d4d509bc34

SHA1
bae14e13bce107d810f436fa39c2af8b34ba1251

SHA256
54d816fc8cbd6097a58b96ed1d382026d40ab23d5aa45bf3ff04218a35106afd

SHA512
81dcae00450a4bcbc02dc67680080b7e85746194e98a61b682225b3d27efa6b7a766a92e317b73a8a8e37866394b078f9928018a5db73e9956ee8111a506d242

Download Submit
\Windows\system\fuscGmI.exe

Filesize
2.2MB

MD5
1ec181b618acc51bf40c06cdf8317f0c

SHA1
582841a4183c60b6845c97ddecd2c7907b378c13

SHA256
6150ce7740631eb675d101e0711273d3ec98c0b611953ef4811c9d767c764f11

SHA512
a6e5120a94331f0bf30ccd5ac9966a21918fbcbeb0506155f97502ac896ce227fb610dafc37895a5b2c5ba64f73009fb59c78fbaed5f5c551361bb79956e756a

Download Submit
\Windows\system\gPQSyMH.exe

Filesize
2.2MB

MD5
db8cdb41486a420462043b5356d05bb7

SHA1
037294f49e343c65425b8a7bd8726cd65df66dcc

SHA256
37c72eb2a6b93d0d69ebfee2777a2482fe9029bb32a2710b0355e402a67510d6

SHA512
f3f43d9d37211194d7b377ed5201cb5f33631554cc954fc5289178305d3d5484b8a4d38d26290b91f555b2511c52a9236e2fa0285a5b5937eefc0a770f50f72b

Download Submit
\Windows\system\hsFktMm.exe

Filesize
2.2MB

MD5
8125df9c0b02e19f53b329823fc2e4ba

SHA1
2d254b97ed0a8055ab477227fee9ebdb3f354e2f

SHA256
20ff77eb890a74280571531897a5d33b74226d2521f3338fa51015c92768fa60

SHA512
3d6ac6d0e41f71212b5383e7a87cd906f1ddb064b75d184a279e9d592941ce18d11935b2f38f812275ecaf485cbf79608fa7ff5b24fb3f8f71a4c5912e282511

Download Submit
\Windows\system\ioWBNUo.exe

Filesize
2.2MB

MD5
d3b9bcaebd7e9c5f87c326e231826b8a

SHA1
1e9cf3b2bc55cce7e41e9f70ff81033403e5d7c1

SHA256
fb36657fcb7dfee4da1e528787a9520f8dc6f8b8c186a672d0c913291f72a824

SHA512
5d4709b29a9dc6fe3c3fff008532f09eb04af6650e5c039a5cef5bacce39b1db56f01aaf4be0308223fc5e4dd5213ea61993b66bcb78fbeb1e4a536a915318b8

Download Submit
\Windows\system\nZYIREs.exe

Filesize
2.2MB

MD5
023265308bc8b9a4a58f081dd8774ce8

SHA1
a7a5c15d1fb2c6cb986d6e099191dba1d114e965

SHA256
1af2dc66e557643cc519a8b8606010bd3743777adc546c40d2e47ba478b760f8

SHA512
3cb33f762f050548428d0626f67bfc5f88d4505dca925504311de81005c53e4e11fb8809319f52323b6f2980625374f97a1962e08a3c71650d346f0b9e8eaea6

Download Submit
\Windows\system\uJeeyzn.exe

Filesize
2.2MB

MD5
0cc84a6ac936cfb05055690c179c8f4d

SHA1
ac8fa985734a3c6928e7913d888fe675080ca828

SHA256
96c07a31c821dc13d74f6321cf8f91a1fbe67e4fa4b68f0a9be8ec21b7d1cd3f

SHA512
776ccc0aa5aa8e6ca36116f1fef53b96c7dc7f6dcb2dc3c773272cc744875437632a2cd24d252c83cab2a107beeeb3898c54f604010a8d768b2caa8e1506b695

Download Submit
\Windows\system\uqUuxgq.exe

Filesize
2.2MB

MD5
95f2e6523de415f9d4d4f0db73bfdf09

SHA1
da36f69f32ab514b0882fa638a998e639eb97869

SHA256
abd935ee569b291d5492b56f2ab8c6f34c8dbb989ee94c9bfa3cf467bee72748

SHA512
b96e94f2fd3f219722e4476177425e8ebb2da872d177af976272b676b0110157ae6ad9f06efc7e65f87d4e8dde5fe98a36d462eeee6ff37b3800498467393aa6

Download Submit
\Windows\system\yVXnpCW.exe

Filesize
2.2MB

MD5
15aea38ccaa41d8c015ceb18d75e28e5

SHA1
f1168ce4febc673dd6e25ee2f6f02cc2564b6ace

SHA256
579d18da66fb353d919eb204b54f03afe492e6035401a005d00ab9ee92c43e8d

SHA512
209c91e5413a41e85019e130fbcaf12340c2bf8ad8c946a7549964384d8fdeab66f9d14f67a0a9d54701978b122919dad4fa86c3010d91df7951add1e4aad9bc

Download Submit
memory/772-8-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2400-23-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2408-103-0x0000000002E50000-0x0000000002ED0000-memory.dmp

Filesize
512KB

Download
memory/2408-151-0x000000001B780000-0x000000001BA62000-memory.dmp

Filesize
2.9MB

Download
memory/2408-239-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2408-24-0x0000000002E50000-0x0000000002ED0000-memory.dmp

Filesize
512KB

Download
memory/2408-102-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2408-152-0x0000000001DF0000-0x0000000001DF8000-memory.dmp

Filesize
32KB

Download
memory/2448-115-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-109-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2652-117-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2672-105-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2712-113-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-107-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2772-111-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2864-108-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-110-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2864-116-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-114-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-104-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2864-0-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2864-106-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-6-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-17-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2864-112-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download