xmrig | 11380006e6ccda4994f8413986ce5e2f3c5146ab3e1fdc77f740ece32e3fdad5

Analysis

max time kernel
124s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
Size

1.7MB
MD5

087beeb1c01f911bd2d3c31cad92279f
SHA1

965887f9f3ce01e1c5db997ef0810c15496f189b
SHA256

11380006e6ccda4994f8413986ce5e2f3c5146ab3e1fdc77f740ece32e3fdad5
SHA512

72161687454e25f7e9ddfe18b9d3d2d9d507223666180f1b367ac3b63bf36a65d8d60dc1a8bf5e0756436c4bc2ddb586e0f08464310c953ba5a3f98d9616fca5
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDB:NABo

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2852-13-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2592-165-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig
behavioral1/memory/2424-167-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/2672-157-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2580-159-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	xmrig
behavioral1/memory/2668-161-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2964-163-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2780-155-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2564-153-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2852-1855-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2964-1856-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2780-1857-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2580-1859-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	xmrig
behavioral1/memory/2424-1858-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/2592-1860-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig
behavioral1/memory/2668-1861-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2672-1865-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2564-1887-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2852	kvKMZYZ.exe
2564	QgvDbDp.exe
2780	RSaoWWG.exe
2672	urOOPgC.exe
2580	BzIAVPL.exe
2668	QulnqXQ.exe
2964	HgJYwIA.exe
2592	DjSCJZu.exe
2424	KrKPNcZ.exe
2888	cJThAqm.exe
2880	TUycxDK.exe
560	BSBJuKM.exe
1148	hZcgYLL.exe
944	vRAlbgR.exe
2708	UYnaJzg.exe
2692	XNHstmA.exe
2836	DITjLSa.exe
1672	BmhDfYV.exe
832	hQXQtqa.exe
2212	AoGLFsd.exe
1520	kBgwwVP.exe
1572	UiJtTbe.exe
2972	ttjGksR.exe
2000	laAicpT.exe
1388	fDUUBGQ.exe
1920	pIspALO.exe
1100	ekteIkG.exe
1384	SpSXQmQ.exe
1716	jdOoafR.exe
432	LBqpqTG.exe
768	CKRixca.exe
1064	BMjISWD.exe
1068	koySitx.exe
2256	bFgLcSh.exe
1632	ECKXoug.exe
1364	fNynAWO.exe
956	mqvANgv.exe
796	NlUqhnj.exe
1092	kJnQLaY.exe
3016	ihNhgYE.exe
1020	fGsxeoR.exe
1736	vHUPGlF.exe
2240	avzAUfA.exe
2308	tGyCfPB.exe
2188	tQBAqjf.exe
572	UJGenJd.exe
752	SxOxWMB.exe
1180	TWFkCeP.exe
2928	MFnwgzh.exe
1756	TQFpCul.exe
1988	NjgWLMY.exe
2264	iDZuiIu.exe
1612	HtVnLqD.exe
1784	hRHSfej.exe
2684	EyAchOy.exe
2828	AwZTLXd.exe
2688	ApSGSPX.exe
2628	gYvQUnF.exe
2080	hIlfUVQ.exe
2516	bgeNjeR.exe
2496	vspFicR.exe
2500	ebuwIhv.exe
1480	MmYCfnl.exe
1040	RATEFzm.exe

Loads dropped DLL 64 IoCs

pid	Process
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2784-1-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/files/0x0009000000016332-10.dat	upx
behavioral1/memory/2852-13-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-15.dat	upx
behavioral1/files/0x0009000000016c90-19.dat	upx
behavioral1/files/0x0010000000016c10-25.dat	upx
behavioral1/files/0x0009000000016ccf-33.dat	upx
behavioral1/files/0x0009000000016cd4-38.dat	upx
behavioral1/files/0x000700000001704f-41.dat	upx
behavioral1/files/0x000500000001946f-43.dat	upx
behavioral1/files/0x0005000000019473-57.dat	upx
behavioral1/files/0x00050000000194a4-67.dat	upx
behavioral1/files/0x00040000000194d8-77.dat	upx
behavioral1/files/0x00050000000194e8-88.dat	upx
behavioral1/files/0x0005000000019547-129.dat	upx
behavioral1/files/0x000500000001959c-137.dat	upx
behavioral1/files/0x00050000000195a2-146.dat	upx
behavioral1/files/0x00050000000195a4-172.dat	upx
behavioral1/files/0x000500000001959e-143.dat	upx
behavioral1/files/0x0005000000019570-134.dat	upx
behavioral1/files/0x0005000000019521-124.dat	upx
behavioral1/files/0x000500000001950c-119.dat	upx
behavioral1/files/0x00050000000194f2-105.dat	upx
behavioral1/files/0x00050000000194ee-96.dat	upx
behavioral1/files/0x00050000000194f4-110.dat	upx
behavioral1/files/0x00050000000194ef-102.dat	upx
behavioral1/files/0x00050000000194ea-91.dat	upx
behavioral1/files/0x00040000000194dc-82.dat	upx
behavioral1/files/0x00040000000194d6-71.dat	upx
behavioral1/files/0x0005000000019485-62.dat	upx
behavioral1/files/0x0007000000016ca9-30.dat	upx
behavioral1/files/0x00050000000195a9-191.dat	upx
behavioral1/files/0x00050000000195a6-188.dat	upx
behavioral1/files/0x00050000000195a8-185.dat	upx
behavioral1/files/0x00050000000195a7-181.dat	upx
behavioral1/memory/2592-165-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/memory/2424-167-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/memory/2672-157-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2580-159-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	upx
behavioral1/memory/2668-161-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/memory/2964-163-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2780-155-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2564-153-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/memory/2852-1855-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/2964-1856-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2780-1857-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2580-1859-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	upx
behavioral1/memory/2424-1858-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/memory/2592-1860-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/memory/2668-1861-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/memory/2672-1865-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2564-1887-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xUqGUno.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\GOpvzKf.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\FuGYskX.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\GXtJCRZ.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\ecKQePg.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\FhyLnax.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\ngAIYFY.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\jMRxWtF.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\FqUFKQP.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\wZqroJO.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\jVKtHdG.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\fJaWhkQ.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\AoJEMdJ.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\wXeDdYw.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\Tzebbtg.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\QkTYeVe.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\claLRkA.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\xHgfxYm.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\iyiYMkX.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\XVjeBNd.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\zvdRrVL.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\MlTKBfQ.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\HUYqhRy.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\EiTxjMj.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\ZtQURfa.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\cJThAqm.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\LOGMgsF.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\WUYTxnX.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\lhydLTs.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\kATVDPp.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\uoJItQU.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\mSyrgar.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\JZUwyeC.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\wurhekR.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\BURTZSE.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\WAdzgGW.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\IlXkdnY.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\UWYwpki.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\hpJycwl.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\aGQmhZz.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\GorJXdT.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\TDtkHDl.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\JwPVqIJ.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\tMSySIA.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\mwkBriT.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\QAMNwLJ.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\KuAwjtP.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\LPdpZDq.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\SYobdOD.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\jpCNWvs.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\fUmjmFb.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\DRtxsRI.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\qADFpgb.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\psVDicg.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\AoDdNvP.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\TBhUeRQ.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\FTaerXo.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\BwmVvcS.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\YBCCLws.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\YbXtHST.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\rZLGqgQ.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\eecrDIq.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\jFwgNZq.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
File created	C:\Windows\System\WOPruUa.exe	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2820	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
Token: SeDebugPrivilege	2820	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2820	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	29
PID 2784 wrote to memory of 2820	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	29
PID 2784 wrote to memory of 2820	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	29
PID 2784 wrote to memory of 2852	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	30
PID 2784 wrote to memory of 2852	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	30
PID 2784 wrote to memory of 2852	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	30
PID 2784 wrote to memory of 2564	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	31
PID 2784 wrote to memory of 2564	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	31
PID 2784 wrote to memory of 2564	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	31
PID 2784 wrote to memory of 2780	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	32
PID 2784 wrote to memory of 2780	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	32
PID 2784 wrote to memory of 2780	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	32
PID 2784 wrote to memory of 2672	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	33
PID 2784 wrote to memory of 2672	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	33
PID 2784 wrote to memory of 2672	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	33
PID 2784 wrote to memory of 2580	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	34
PID 2784 wrote to memory of 2580	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	34
PID 2784 wrote to memory of 2580	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	34
PID 2784 wrote to memory of 2668	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	35
PID 2784 wrote to memory of 2668	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	35
PID 2784 wrote to memory of 2668	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	35
PID 2784 wrote to memory of 2964	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	36
PID 2784 wrote to memory of 2964	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	36
PID 2784 wrote to memory of 2964	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	36
PID 2784 wrote to memory of 2592	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	37
PID 2784 wrote to memory of 2592	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	37
PID 2784 wrote to memory of 2592	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	37
PID 2784 wrote to memory of 2424	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	38
PID 2784 wrote to memory of 2424	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	38
PID 2784 wrote to memory of 2424	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	38
PID 2784 wrote to memory of 2888	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	39
PID 2784 wrote to memory of 2888	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	39
PID 2784 wrote to memory of 2888	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	39
PID 2784 wrote to memory of 2880	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	40
PID 2784 wrote to memory of 2880	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	40
PID 2784 wrote to memory of 2880	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	40
PID 2784 wrote to memory of 560	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	41
PID 2784 wrote to memory of 560	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	41
PID 2784 wrote to memory of 560	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	41
PID 2784 wrote to memory of 1148	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	42
PID 2784 wrote to memory of 1148	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	42
PID 2784 wrote to memory of 1148	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	42
PID 2784 wrote to memory of 944	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	43
PID 2784 wrote to memory of 944	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	43
PID 2784 wrote to memory of 944	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	43
PID 2784 wrote to memory of 2708	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	44
PID 2784 wrote to memory of 2708	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	44
PID 2784 wrote to memory of 2708	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	44
PID 2784 wrote to memory of 2692	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	45
PID 2784 wrote to memory of 2692	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	45
PID 2784 wrote to memory of 2692	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	45
PID 2784 wrote to memory of 2836	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	46
PID 2784 wrote to memory of 2836	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	46
PID 2784 wrote to memory of 2836	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	46
PID 2784 wrote to memory of 2212	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	47
PID 2784 wrote to memory of 2212	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	47
PID 2784 wrote to memory of 2212	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	47
PID 2784 wrote to memory of 1672	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	48
PID 2784 wrote to memory of 1672	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	48
PID 2784 wrote to memory of 1672	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	48
PID 2784 wrote to memory of 1520	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	49
PID 2784 wrote to memory of 1520	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	49
PID 2784 wrote to memory of 1520	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	49
PID 2784 wrote to memory of 832	2784	087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\087beeb1c01f911bd2d3c31cad92279f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\System\kvKMZYZ.exe
  C:\Windows\System\kvKMZYZ.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\QgvDbDp.exe
  C:\Windows\System\QgvDbDp.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\RSaoWWG.exe
  C:\Windows\System\RSaoWWG.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\urOOPgC.exe
  C:\Windows\System\urOOPgC.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\BzIAVPL.exe
  C:\Windows\System\BzIAVPL.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\QulnqXQ.exe
  C:\Windows\System\QulnqXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\HgJYwIA.exe
  C:\Windows\System\HgJYwIA.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\DjSCJZu.exe
  C:\Windows\System\DjSCJZu.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\KrKPNcZ.exe
  C:\Windows\System\KrKPNcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\cJThAqm.exe
  C:\Windows\System\cJThAqm.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\TUycxDK.exe
  C:\Windows\System\TUycxDK.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\BSBJuKM.exe
  C:\Windows\System\BSBJuKM.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\hZcgYLL.exe
  C:\Windows\System\hZcgYLL.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\vRAlbgR.exe
  C:\Windows\System\vRAlbgR.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\UYnaJzg.exe
  C:\Windows\System\UYnaJzg.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\XNHstmA.exe
  C:\Windows\System\XNHstmA.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\DITjLSa.exe
  C:\Windows\System\DITjLSa.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\AoGLFsd.exe
  C:\Windows\System\AoGLFsd.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\BmhDfYV.exe
  C:\Windows\System\BmhDfYV.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\kBgwwVP.exe
  C:\Windows\System\kBgwwVP.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\hQXQtqa.exe
  C:\Windows\System\hQXQtqa.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\UiJtTbe.exe
  C:\Windows\System\UiJtTbe.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\ttjGksR.exe
  C:\Windows\System\ttjGksR.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\laAicpT.exe
  C:\Windows\System\laAicpT.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\fDUUBGQ.exe
  C:\Windows\System\fDUUBGQ.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\pIspALO.exe
  C:\Windows\System\pIspALO.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\ekteIkG.exe
  C:\Windows\System\ekteIkG.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\jdOoafR.exe
  C:\Windows\System\jdOoafR.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\SpSXQmQ.exe
  C:\Windows\System\SpSXQmQ.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\CKRixca.exe
  C:\Windows\System\CKRixca.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\LBqpqTG.exe
  C:\Windows\System\LBqpqTG.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\koySitx.exe
  C:\Windows\System\koySitx.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\BMjISWD.exe
  C:\Windows\System\BMjISWD.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\bFgLcSh.exe
  C:\Windows\System\bFgLcSh.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\ECKXoug.exe
  C:\Windows\System\ECKXoug.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\fNynAWO.exe
  C:\Windows\System\fNynAWO.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\mqvANgv.exe
  C:\Windows\System\mqvANgv.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\NlUqhnj.exe
  C:\Windows\System\NlUqhnj.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\kJnQLaY.exe
  C:\Windows\System\kJnQLaY.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\ihNhgYE.exe
  C:\Windows\System\ihNhgYE.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\fGsxeoR.exe
  C:\Windows\System\fGsxeoR.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\vHUPGlF.exe
  C:\Windows\System\vHUPGlF.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\avzAUfA.exe
  C:\Windows\System\avzAUfA.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\tGyCfPB.exe
  C:\Windows\System\tGyCfPB.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\tQBAqjf.exe
  C:\Windows\System\tQBAqjf.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\UJGenJd.exe
  C:\Windows\System\UJGenJd.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\SxOxWMB.exe
  C:\Windows\System\SxOxWMB.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\TWFkCeP.exe
  C:\Windows\System\TWFkCeP.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\MFnwgzh.exe
  C:\Windows\System\MFnwgzh.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\TQFpCul.exe
  C:\Windows\System\TQFpCul.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\NjgWLMY.exe
  C:\Windows\System\NjgWLMY.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\iDZuiIu.exe
  C:\Windows\System\iDZuiIu.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\HtVnLqD.exe
  C:\Windows\System\HtVnLqD.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\hRHSfej.exe
  C:\Windows\System\hRHSfej.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\EyAchOy.exe
  C:\Windows\System\EyAchOy.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\AwZTLXd.exe
  C:\Windows\System\AwZTLXd.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\ApSGSPX.exe
  C:\Windows\System\ApSGSPX.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\gYvQUnF.exe
  C:\Windows\System\gYvQUnF.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\hIlfUVQ.exe
  C:\Windows\System\hIlfUVQ.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\bgeNjeR.exe
  C:\Windows\System\bgeNjeR.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\vspFicR.exe
  C:\Windows\System\vspFicR.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\ebuwIhv.exe
  C:\Windows\System\ebuwIhv.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\MmYCfnl.exe
  C:\Windows\System\MmYCfnl.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\RATEFzm.exe
  C:\Windows\System\RATEFzm.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\HWYwEwd.exe
  C:\Windows\System\HWYwEwd.exe
  2⤵
  PID:2740
- C:\Windows\System\wFqdHIz.exe
  C:\Windows\System\wFqdHIz.exe
  2⤵
  PID:2332
- C:\Windows\System\JGHEsgT.exe
  C:\Windows\System\JGHEsgT.exe
  2⤵
  PID:2704
- C:\Windows\System\RYDmDtz.exe
  C:\Windows\System\RYDmDtz.exe
  2⤵
  PID:856
- C:\Windows\System\nPuiCuj.exe
  C:\Windows\System\nPuiCuj.exe
  2⤵
  PID:2324
- C:\Windows\System\vlfAqGX.exe
  C:\Windows\System\vlfAqGX.exe
  2⤵
  PID:1996
- C:\Windows\System\sutvuyX.exe
  C:\Windows\System\sutvuyX.exe
  2⤵
  PID:2136
- C:\Windows\System\JUoLqIy.exe
  C:\Windows\System\JUoLqIy.exe
  2⤵
  PID:2604
- C:\Windows\System\JLwLgsg.exe
  C:\Windows\System\JLwLgsg.exe
  2⤵
  PID:2420
- C:\Windows\System\kOWQXTK.exe
  C:\Windows\System\kOWQXTK.exe
  2⤵
  PID:456
- C:\Windows\System\dIIdFsq.exe
  C:\Windows\System\dIIdFsq.exe
  2⤵
  PID:2812
- C:\Windows\System\RGlVAza.exe
  C:\Windows\System\RGlVAza.exe
  2⤵
  PID:1120
- C:\Windows\System\vcOZGFp.exe
  C:\Windows\System\vcOZGFp.exe
  2⤵
  PID:1140
- C:\Windows\System\sUSuaeD.exe
  C:\Windows\System\sUSuaeD.exe
  2⤵
  PID:1544
- C:\Windows\System\mJXPdvN.exe
  C:\Windows\System\mJXPdvN.exe
  2⤵
  PID:1748
- C:\Windows\System\BYcUOOl.exe
  C:\Windows\System\BYcUOOl.exe
  2⤵
  PID:836
- C:\Windows\System\kZFvBnz.exe
  C:\Windows\System\kZFvBnz.exe
  2⤵
  PID:1804
- C:\Windows\System\BxTMTYJ.exe
  C:\Windows\System\BxTMTYJ.exe
  2⤵
  PID:1400
- C:\Windows\System\dtaEKYe.exe
  C:\Windows\System\dtaEKYe.exe
  2⤵
  PID:2868
- C:\Windows\System\Wdcbhdw.exe
  C:\Windows\System\Wdcbhdw.exe
  2⤵
  PID:2392
- C:\Windows\System\ozZwTEL.exe
  C:\Windows\System\ozZwTEL.exe
  2⤵
  PID:1372
- C:\Windows\System\xLIUuHL.exe
  C:\Windows\System\xLIUuHL.exe
  2⤵
  PID:896
- C:\Windows\System\ByynxAM.exe
  C:\Windows\System\ByynxAM.exe
  2⤵
  PID:1260
- C:\Windows\System\dUMqofh.exe
  C:\Windows\System\dUMqofh.exe
  2⤵
  PID:1568
- C:\Windows\System\ZCdabbu.exe
  C:\Windows\System\ZCdabbu.exe
  2⤵
  PID:1780
- C:\Windows\System\YLyooMV.exe
  C:\Windows\System\YLyooMV.exe
  2⤵
  PID:3008
- C:\Windows\System\LpDvUFE.exe
  C:\Windows\System\LpDvUFE.exe
  2⤵
  PID:2572
- C:\Windows\System\WNsCvae.exe
  C:\Windows\System\WNsCvae.exe
  2⤵
  PID:1984
- C:\Windows\System\HdSPQfJ.exe
  C:\Windows\System\HdSPQfJ.exe
  2⤵
  PID:1712
- C:\Windows\System\HouIrgv.exe
  C:\Windows\System\HouIrgv.exe
  2⤵
  PID:2176
- C:\Windows\System\rkjytEw.exe
  C:\Windows\System\rkjytEw.exe
  2⤵
  PID:1772
- C:\Windows\System\bbAARLb.exe
  C:\Windows\System\bbAARLb.exe
  2⤵
  PID:2752
- C:\Windows\System\uipLgJs.exe
  C:\Windows\System\uipLgJs.exe
  2⤵
  PID:2472
- C:\Windows\System\qNNdzUS.exe
  C:\Windows\System\qNNdzUS.exe
  2⤵
  PID:2488
- C:\Windows\System\nOpviRn.exe
  C:\Windows\System\nOpviRn.exe
  2⤵
  PID:808
- C:\Windows\System\zAoOwrx.exe
  C:\Windows\System\zAoOwrx.exe
  2⤵
  PID:2408
- C:\Windows\System\IIIMHak.exe
  C:\Windows\System\IIIMHak.exe
  2⤵
  PID:1656
- C:\Windows\System\mSyrgar.exe
  C:\Windows\System\mSyrgar.exe
  2⤵
  PID:2872
- C:\Windows\System\FbeAGRy.exe
  C:\Windows\System\FbeAGRy.exe
  2⤵
  PID:2396
- C:\Windows\System\jphCZcy.exe
  C:\Windows\System\jphCZcy.exe
  2⤵
  PID:464
- C:\Windows\System\evymtpo.exe
  C:\Windows\System\evymtpo.exe
  2⤵
  PID:2512
- C:\Windows\System\LOGMgsF.exe
  C:\Windows\System\LOGMgsF.exe
  2⤵
  PID:268
- C:\Windows\System\kcZHqHg.exe
  C:\Windows\System\kcZHqHg.exe
  2⤵
  PID:2344
- C:\Windows\System\gfcqaqT.exe
  C:\Windows\System\gfcqaqT.exe
  2⤵
  PID:2116
- C:\Windows\System\ObQlbJI.exe
  C:\Windows\System\ObQlbJI.exe
  2⤵
  PID:2804
- C:\Windows\System\SojIbRS.exe
  C:\Windows\System\SojIbRS.exe
  2⤵
  PID:1676
- C:\Windows\System\qADFpgb.exe
  C:\Windows\System\qADFpgb.exe
  2⤵
  PID:1652
- C:\Windows\System\hmpqttV.exe
  C:\Windows\System\hmpqttV.exe
  2⤵
  PID:1648
- C:\Windows\System\vJWQUzs.exe
  C:\Windows\System\vJWQUzs.exe
  2⤵
  PID:968
- C:\Windows\System\MlTKBfQ.exe
  C:\Windows\System\MlTKBfQ.exe
  2⤵
  PID:2768
- C:\Windows\System\RxyPGgT.exe
  C:\Windows\System\RxyPGgT.exe
  2⤵
  PID:524
- C:\Windows\System\ayisGMI.exe
  C:\Windows\System\ayisGMI.exe
  2⤵
  PID:2164
- C:\Windows\System\Lbvhbqt.exe
  C:\Windows\System\Lbvhbqt.exe
  2⤵
  PID:2348
- C:\Windows\System\sYDrcGp.exe
  C:\Windows\System\sYDrcGp.exe
  2⤵
  PID:1600
- C:\Windows\System\vcdeEzP.exe
  C:\Windows\System\vcdeEzP.exe
  2⤵
  PID:1048
- C:\Windows\System\DdCEXGm.exe
  C:\Windows\System\DdCEXGm.exe
  2⤵
  PID:2520
- C:\Windows\System\eoqIJak.exe
  C:\Windows\System\eoqIJak.exe
  2⤵
  PID:3060
- C:\Windows\System\wMEFBqh.exe
  C:\Windows\System\wMEFBqh.exe
  2⤵
  PID:2252
- C:\Windows\System\HEyuKNH.exe
  C:\Windows\System\HEyuKNH.exe
  2⤵
  PID:2944
- C:\Windows\System\GIzfqXR.exe
  C:\Windows\System\GIzfqXR.exe
  2⤵
  PID:2036
- C:\Windows\System\OzaeGhY.exe
  C:\Windows\System\OzaeGhY.exe
  2⤵
  PID:2932
- C:\Windows\System\Xxhzfey.exe
  C:\Windows\System\Xxhzfey.exe
  2⤵
  PID:952
- C:\Windows\System\bLKassZ.exe
  C:\Windows\System\bLKassZ.exe
  2⤵
  PID:2800
- C:\Windows\System\BwwgeQZ.exe
  C:\Windows\System\BwwgeQZ.exe
  2⤵
  PID:880
- C:\Windows\System\SiSytKv.exe
  C:\Windows\System\SiSytKv.exe
  2⤵
  PID:2224
- C:\Windows\System\ddkXuWG.exe
  C:\Windows\System\ddkXuWG.exe
  2⤵
  PID:3048
- C:\Windows\System\LGngWAs.exe
  C:\Windows\System\LGngWAs.exe
  2⤵
  PID:3028
- C:\Windows\System\nxQhKiP.exe
  C:\Windows\System\nxQhKiP.exe
  2⤵
  PID:3068
- C:\Windows\System\yXLwSrY.exe
  C:\Windows\System\yXLwSrY.exe
  2⤵
  PID:2724
- C:\Windows\System\mwGIPZU.exe
  C:\Windows\System\mwGIPZU.exe
  2⤵
  PID:2696
- C:\Windows\System\ZpKkKol.exe
  C:\Windows\System\ZpKkKol.exe
  2⤵
  PID:3064
- C:\Windows\System\RxIRDQS.exe
  C:\Windows\System\RxIRDQS.exe
  2⤵
  PID:2720
- C:\Windows\System\Ekkpxnm.exe
  C:\Windows\System\Ekkpxnm.exe
  2⤵
  PID:2236
- C:\Windows\System\ZuzLvAT.exe
  C:\Windows\System\ZuzLvAT.exe
  2⤵
  PID:1540
- C:\Windows\System\MfyuIOy.exe
  C:\Windows\System\MfyuIOy.exe
  2⤵
  PID:1212
- C:\Windows\System\MQizwzv.exe
  C:\Windows\System\MQizwzv.exe
  2⤵
  PID:1992
- C:\Windows\System\XZHnKfB.exe
  C:\Windows\System\XZHnKfB.exe
  2⤵
  PID:1276
- C:\Windows\System\urNJLkP.exe
  C:\Windows\System\urNJLkP.exe
  2⤵
  PID:1928
- C:\Windows\System\RvcGPvt.exe
  C:\Windows\System\RvcGPvt.exe
  2⤵
  PID:2900
- C:\Windows\System\cWMwfLv.exe
  C:\Windows\System\cWMwfLv.exe
  2⤵
  PID:876
- C:\Windows\System\VbdOwOb.exe
  C:\Windows\System\VbdOwOb.exe
  2⤵
  PID:2272
- C:\Windows\System\NuKJySa.exe
  C:\Windows\System\NuKJySa.exe
  2⤵
  PID:2532
- C:\Windows\System\LjdGxwb.exe
  C:\Windows\System\LjdGxwb.exe
  2⤵
  PID:2204
- C:\Windows\System\IHhnvkj.exe
  C:\Windows\System\IHhnvkj.exe
  2⤵
  PID:1340
- C:\Windows\System\hTzsNvN.exe
  C:\Windows\System\hTzsNvN.exe
  2⤵
  PID:1200
- C:\Windows\System\JZUwyeC.exe
  C:\Windows\System\JZUwyeC.exe
  2⤵
  PID:1628
- C:\Windows\System\oEBFEzl.exe
  C:\Windows\System\oEBFEzl.exe
  2⤵
  PID:2352
- C:\Windows\System\HZmHMvM.exe
  C:\Windows\System\HZmHMvM.exe
  2⤵
  PID:1204
- C:\Windows\System\uzeBvku.exe
  C:\Windows\System\uzeBvku.exe
  2⤵
  PID:1096
- C:\Windows\System\FhyLnax.exe
  C:\Windows\System\FhyLnax.exe
  2⤵
  PID:1884
- C:\Windows\System\hOaoDgk.exe
  C:\Windows\System\hOaoDgk.exe
  2⤵
  PID:1536
- C:\Windows\System\wurhekR.exe
  C:\Windows\System\wurhekR.exe
  2⤵
  PID:2656
- C:\Windows\System\tIVMkEi.exe
  C:\Windows\System\tIVMkEi.exe
  2⤵
  PID:2792
- C:\Windows\System\zmfpzIq.exe
  C:\Windows\System\zmfpzIq.exe
  2⤵
  PID:3052
- C:\Windows\System\LYJelAu.exe
  C:\Windows\System\LYJelAu.exe
  2⤵
  PID:2444
- C:\Windows\System\jgoCoLL.exe
  C:\Windows\System\jgoCoLL.exe
  2⤵
  PID:2952
- C:\Windows\System\aALwDTz.exe
  C:\Windows\System\aALwDTz.exe
  2⤵
  PID:1344
- C:\Windows\System\qkkrerj.exe
  C:\Windows\System\qkkrerj.exe
  2⤵
  PID:1828
- C:\Windows\System\wZqroJO.exe
  C:\Windows\System\wZqroJO.exe
  2⤵
  PID:1424
- C:\Windows\System\DPefNYi.exe
  C:\Windows\System\DPefNYi.exe
  2⤵
  PID:388
- C:\Windows\System\QQosFxx.exe
  C:\Windows\System\QQosFxx.exe
  2⤵
  PID:2400
- C:\Windows\System\bUNWEIm.exe
  C:\Windows\System\bUNWEIm.exe
  2⤵
  PID:2576
- C:\Windows\System\VXuSWAc.exe
  C:\Windows\System\VXuSWAc.exe
  2⤵
  PID:2996
- C:\Windows\System\StDoeId.exe
  C:\Windows\System\StDoeId.exe
  2⤵
  PID:2128
- C:\Windows\System\gsLtzaB.exe
  C:\Windows\System\gsLtzaB.exe
  2⤵
  PID:1080
- C:\Windows\System\NsuCJwS.exe
  C:\Windows\System\NsuCJwS.exe
  2⤵
  PID:2180
- C:\Windows\System\cRWmnTh.exe
  C:\Windows\System\cRWmnTh.exe
  2⤵
  PID:2492
- C:\Windows\System\XRLhmsP.exe
  C:\Windows\System\XRLhmsP.exe
  2⤵
  PID:2840
- C:\Windows\System\QMrzPMa.exe
  C:\Windows\System\QMrzPMa.exe
  2⤵
  PID:2680
- C:\Windows\System\PNsoBUG.exe
  C:\Windows\System\PNsoBUG.exe
  2⤵
  PID:1724
- C:\Windows\System\WxfXpXI.exe
  C:\Windows\System\WxfXpXI.exe
  2⤵
  PID:588
- C:\Windows\System\lSodMZr.exe
  C:\Windows\System\lSodMZr.exe
  2⤵
  PID:2856
- C:\Windows\System\ZZdNGjN.exe
  C:\Windows\System\ZZdNGjN.exe
  2⤵
  PID:2376
- C:\Windows\System\WRQoaZX.exe
  C:\Windows\System\WRQoaZX.exe
  2⤵
  PID:1580
- C:\Windows\System\WfzcEhy.exe
  C:\Windows\System\WfzcEhy.exe
  2⤵
  PID:972
- C:\Windows\System\mWfUIfA.exe
  C:\Windows\System\mWfUIfA.exe
  2⤵
  PID:2540
- C:\Windows\System\AbAfCnM.exe
  C:\Windows\System\AbAfCnM.exe
  2⤵
  PID:3088
- C:\Windows\System\OJnDXNO.exe
  C:\Windows\System\OJnDXNO.exe
  2⤵
  PID:3104
- C:\Windows\System\XzzhHYr.exe
  C:\Windows\System\XzzhHYr.exe
  2⤵
  PID:3120
- C:\Windows\System\wqCczWD.exe
  C:\Windows\System\wqCczWD.exe
  2⤵
  PID:3136
- C:\Windows\System\TlCNWMY.exe
  C:\Windows\System\TlCNWMY.exe
  2⤵
  PID:3152
- C:\Windows\System\asTDavl.exe
  C:\Windows\System\asTDavl.exe
  2⤵
  PID:3192
- C:\Windows\System\SKJZfiv.exe
  C:\Windows\System\SKJZfiv.exe
  2⤵
  PID:3208
- C:\Windows\System\gecnOOU.exe
  C:\Windows\System\gecnOOU.exe
  2⤵
  PID:3224
- C:\Windows\System\fCyTCUk.exe
  C:\Windows\System\fCyTCUk.exe
  2⤵
  PID:3240
- C:\Windows\System\ngkhQkl.exe
  C:\Windows\System\ngkhQkl.exe
  2⤵
  PID:3256
- C:\Windows\System\VSclDMo.exe
  C:\Windows\System\VSclDMo.exe
  2⤵
  PID:3280
- C:\Windows\System\SXQpCSM.exe
  C:\Windows\System\SXQpCSM.exe
  2⤵
  PID:3296
- C:\Windows\System\cgVivEU.exe
  C:\Windows\System\cgVivEU.exe
  2⤵
  PID:3312
- C:\Windows\System\AkRStaR.exe
  C:\Windows\System\AkRStaR.exe
  2⤵
  PID:3332
- C:\Windows\System\Woycrox.exe
  C:\Windows\System\Woycrox.exe
  2⤵
  PID:3348
- C:\Windows\System\FjnVetB.exe
  C:\Windows\System\FjnVetB.exe
  2⤵
  PID:3364
- C:\Windows\System\vBaadkq.exe
  C:\Windows\System\vBaadkq.exe
  2⤵
  PID:3380
- C:\Windows\System\gdNSijV.exe
  C:\Windows\System\gdNSijV.exe
  2⤵
  PID:3412
- C:\Windows\System\NdULLYC.exe
  C:\Windows\System\NdULLYC.exe
  2⤵
  PID:3428
- C:\Windows\System\GAISMtM.exe
  C:\Windows\System\GAISMtM.exe
  2⤵
  PID:3444
- C:\Windows\System\yqAZTBu.exe
  C:\Windows\System\yqAZTBu.exe
  2⤵
  PID:3460
- C:\Windows\System\cWzfKLs.exe
  C:\Windows\System\cWzfKLs.exe
  2⤵
  PID:3476
- C:\Windows\System\xFhvPar.exe
  C:\Windows\System\xFhvPar.exe
  2⤵
  PID:3496
- C:\Windows\System\LLrXxji.exe
  C:\Windows\System\LLrXxji.exe
  2⤵
  PID:3512
- C:\Windows\System\EubtrXx.exe
  C:\Windows\System\EubtrXx.exe
  2⤵
  PID:3528
- C:\Windows\System\HUYqhRy.exe
  C:\Windows\System\HUYqhRy.exe
  2⤵
  PID:3544
- C:\Windows\System\uWtPWpv.exe
  C:\Windows\System\uWtPWpv.exe
  2⤵
  PID:3560
- C:\Windows\System\tDGMvhm.exe
  C:\Windows\System\tDGMvhm.exe
  2⤵
  PID:3584
- C:\Windows\System\RHZOYRC.exe
  C:\Windows\System\RHZOYRC.exe
  2⤵
  PID:3600
- C:\Windows\System\uqUOfdE.exe
  C:\Windows\System\uqUOfdE.exe
  2⤵
  PID:3616
- C:\Windows\System\npUTHGx.exe
  C:\Windows\System\npUTHGx.exe
  2⤵
  PID:3632
- C:\Windows\System\qdbPEvp.exe
  C:\Windows\System\qdbPEvp.exe
  2⤵
  PID:3648
- C:\Windows\System\vRzZnPM.exe
  C:\Windows\System\vRzZnPM.exe
  2⤵
  PID:3688
- C:\Windows\System\NEkvzJk.exe
  C:\Windows\System\NEkvzJk.exe
  2⤵
  PID:3704
- C:\Windows\System\XkJCpiA.exe
  C:\Windows\System\XkJCpiA.exe
  2⤵
  PID:3720
- C:\Windows\System\LKDAEAn.exe
  C:\Windows\System\LKDAEAn.exe
  2⤵
  PID:3740
- C:\Windows\System\DghLRAi.exe
  C:\Windows\System\DghLRAi.exe
  2⤵
  PID:3756
- C:\Windows\System\TqMPqdq.exe
  C:\Windows\System\TqMPqdq.exe
  2⤵
  PID:3780
- C:\Windows\System\RKJtKnE.exe
  C:\Windows\System\RKJtKnE.exe
  2⤵
  PID:3804
- C:\Windows\System\OcOvrxv.exe
  C:\Windows\System\OcOvrxv.exe
  2⤵
  PID:3820
- C:\Windows\System\MpShjzk.exe
  C:\Windows\System\MpShjzk.exe
  2⤵
  PID:3836
- C:\Windows\System\jSkXteH.exe
  C:\Windows\System\jSkXteH.exe
  2⤵
  PID:3860
- C:\Windows\System\LeHzCsG.exe
  C:\Windows\System\LeHzCsG.exe
  2⤵
  PID:3876
- C:\Windows\System\RRfdufS.exe
  C:\Windows\System\RRfdufS.exe
  2⤵
  PID:3892
- C:\Windows\System\fITzYld.exe
  C:\Windows\System\fITzYld.exe
  2⤵
  PID:3908
- C:\Windows\System\criKlvZ.exe
  C:\Windows\System\criKlvZ.exe
  2⤵
  PID:3928
- C:\Windows\System\qrygxBm.exe
  C:\Windows\System\qrygxBm.exe
  2⤵
  PID:3944
- C:\Windows\System\TUsXYHB.exe
  C:\Windows\System\TUsXYHB.exe
  2⤵
  PID:4048
- C:\Windows\System\GorJXdT.exe
  C:\Windows\System\GorJXdT.exe
  2⤵
  PID:4080
- C:\Windows\System\PzYXKNw.exe
  C:\Windows\System\PzYXKNw.exe
  2⤵
  PID:672
- C:\Windows\System\xUqGUno.exe
  C:\Windows\System\xUqGUno.exe
  2⤵
  PID:1216
- C:\Windows\System\aInpKqd.exe
  C:\Windows\System\aInpKqd.exe
  2⤵
  PID:2560
- C:\Windows\System\KXqWqRp.exe
  C:\Windows\System\KXqWqRp.exe
  2⤵
  PID:1896
- C:\Windows\System\VIaTBFk.exe
  C:\Windows\System\VIaTBFk.exe
  2⤵
  PID:3232
- C:\Windows\System\KNhRwJq.exe
  C:\Windows\System\KNhRwJq.exe
  2⤵
  PID:1832
- C:\Windows\System\SUCjdVZ.exe
  C:\Windows\System\SUCjdVZ.exe
  2⤵
  PID:3116
- C:\Windows\System\EhTGkEM.exe
  C:\Windows\System\EhTGkEM.exe
  2⤵
  PID:3180
- C:\Windows\System\AaSOECI.exe
  C:\Windows\System\AaSOECI.exe
  2⤵
  PID:3304
- C:\Windows\System\GThAnFs.exe
  C:\Windows\System\GThAnFs.exe
  2⤵
  PID:3220
- C:\Windows\System\XsyvWxq.exe
  C:\Windows\System\XsyvWxq.exe
  2⤵
  PID:3324
- C:\Windows\System\woOduZt.exe
  C:\Windows\System\woOduZt.exe
  2⤵
  PID:3288
- C:\Windows\System\WMvxEkj.exe
  C:\Windows\System\WMvxEkj.exe
  2⤵
  PID:3360
- C:\Windows\System\IoHiuzG.exe
  C:\Windows\System\IoHiuzG.exe
  2⤵
  PID:3388
- C:\Windows\System\dINSLxo.exe
  C:\Windows\System\dINSLxo.exe
  2⤵
  PID:3484
- C:\Windows\System\DLHNGyv.exe
  C:\Windows\System\DLHNGyv.exe
  2⤵
  PID:3472
- C:\Windows\System\UKnVXbB.exe
  C:\Windows\System\UKnVXbB.exe
  2⤵
  PID:3508
- C:\Windows\System\lHlnVUq.exe
  C:\Windows\System\lHlnVUq.exe
  2⤵
  PID:3576
- C:\Windows\System\nhoRqTJ.exe
  C:\Windows\System\nhoRqTJ.exe
  2⤵
  PID:3552
- C:\Windows\System\QPWwkeD.exe
  C:\Windows\System\QPWwkeD.exe
  2⤵
  PID:3656
- C:\Windows\System\JmBITUu.exe
  C:\Windows\System\JmBITUu.exe
  2⤵
  PID:3672
- C:\Windows\System\TMjcIUb.exe
  C:\Windows\System\TMjcIUb.exe
  2⤵
  PID:3716
- C:\Windows\System\hcdiHBZ.exe
  C:\Windows\System\hcdiHBZ.exe
  2⤵
  PID:580
- C:\Windows\System\hjEIhDE.exe
  C:\Windows\System\hjEIhDE.exe
  2⤵
  PID:3640
- C:\Windows\System\qdwUWUW.exe
  C:\Windows\System\qdwUWUW.exe
  2⤵
  PID:3728
- C:\Windows\System\WiKtbHZ.exe
  C:\Windows\System\WiKtbHZ.exe
  2⤵
  PID:3904
- C:\Windows\System\NKadihQ.exe
  C:\Windows\System\NKadihQ.exe
  2⤵
  PID:3884
- C:\Windows\System\KuAwjtP.exe
  C:\Windows\System\KuAwjtP.exe
  2⤵
  PID:3960
- C:\Windows\System\EOwwDaa.exe
  C:\Windows\System\EOwwDaa.exe
  2⤵
  PID:3980
- C:\Windows\System\fGLZEJU.exe
  C:\Windows\System\fGLZEJU.exe
  2⤵
  PID:4000
- C:\Windows\System\aniYbIu.exe
  C:\Windows\System\aniYbIu.exe
  2⤵
  PID:4008
- C:\Windows\System\pLkFlHg.exe
  C:\Windows\System\pLkFlHg.exe
  2⤵
  PID:3268
- C:\Windows\System\eDgPjYI.exe
  C:\Windows\System\eDgPjYI.exe
  2⤵
  PID:4036
- C:\Windows\System\tTDsWYe.exe
  C:\Windows\System\tTDsWYe.exe
  2⤵
  PID:4064
- C:\Windows\System\pCuAose.exe
  C:\Windows\System\pCuAose.exe
  2⤵
  PID:4076
- C:\Windows\System\AOVsfON.exe
  C:\Windows\System\AOVsfON.exe
  2⤵
  PID:4088
- C:\Windows\System\cwCXEze.exe
  C:\Windows\System\cwCXEze.exe
  2⤵
  PID:3132
- C:\Windows\System\PHUROup.exe
  C:\Windows\System\PHUROup.exe
  2⤵
  PID:3172
- C:\Windows\System\VTtdUtQ.exe
  C:\Windows\System\VTtdUtQ.exe
  2⤵
  PID:1968
- C:\Windows\System\TDtkHDl.exe
  C:\Windows\System\TDtkHDl.exe
  2⤵
  PID:1964
- C:\Windows\System\XusWhxQ.exe
  C:\Windows\System\XusWhxQ.exe
  2⤵
  PID:1512
- C:\Windows\System\saLKbno.exe
  C:\Windows\System\saLKbno.exe
  2⤵
  PID:3424
- C:\Windows\System\zTjVXdR.exe
  C:\Windows\System\zTjVXdR.exe
  2⤵
  PID:3084
- C:\Windows\System\BAFNWun.exe
  C:\Windows\System\BAFNWun.exe
  2⤵
  PID:3372
- C:\Windows\System\ZBJoIQW.exe
  C:\Windows\System\ZBJoIQW.exe
  2⤵
  PID:3436
- C:\Windows\System\QhZkloz.exe
  C:\Windows\System\QhZkloz.exe
  2⤵
  PID:3540
- C:\Windows\System\TlpYyhN.exe
  C:\Windows\System\TlpYyhN.exe
  2⤵
  PID:3628
- C:\Windows\System\euZBUAT.exe
  C:\Windows\System\euZBUAT.exe
  2⤵
  PID:3612
- C:\Windows\System\hwJcviV.exe
  C:\Windows\System\hwJcviV.exe
  2⤵
  PID:3668
- C:\Windows\System\akSQHbe.exe
  C:\Windows\System\akSQHbe.exe
  2⤵
  PID:3572
- C:\Windows\System\spGgPFb.exe
  C:\Windows\System\spGgPFb.exe
  2⤵
  PID:3700
- C:\Windows\System\gXXTYbX.exe
  C:\Windows\System\gXXTYbX.exe
  2⤵
  PID:3844
- C:\Windows\System\PyuPQhH.exe
  C:\Windows\System\PyuPQhH.exe
  2⤵
  PID:3900
- C:\Windows\System\LuiiJIp.exe
  C:\Windows\System\LuiiJIp.exe
  2⤵
  PID:3976
- C:\Windows\System\vzCKadI.exe
  C:\Windows\System\vzCKadI.exe
  2⤵
  PID:4016
- C:\Windows\System\xilLazT.exe
  C:\Windows\System\xilLazT.exe
  2⤵
  PID:4004
- C:\Windows\System\GkHwEkg.exe
  C:\Windows\System\GkHwEkg.exe
  2⤵
  PID:3968
- C:\Windows\System\CkqHyKl.exe
  C:\Windows\System\CkqHyKl.exe
  2⤵
  PID:4044
- C:\Windows\System\NxBXUFv.exe
  C:\Windows\System\NxBXUFv.exe
  2⤵
  PID:3252
- C:\Windows\System\jVKtHdG.exe
  C:\Windows\System\jVKtHdG.exe
  2⤵
  PID:1608
- C:\Windows\System\DVOEzUn.exe
  C:\Windows\System\DVOEzUn.exe
  2⤵
  PID:2728
- C:\Windows\System\OBhEOPb.exe
  C:\Windows\System\OBhEOPb.exe
  2⤵
  PID:2064
- C:\Windows\System\yavlsdj.exe
  C:\Windows\System\yavlsdj.exe
  2⤵
  PID:3504
- C:\Windows\System\NXopMmx.exe
  C:\Windows\System\NXopMmx.exe
  2⤵
  PID:3752
- C:\Windows\System\uoNOqyc.exe
  C:\Windows\System\uoNOqyc.exe
  2⤵
  PID:3768
- C:\Windows\System\AmHtYMT.exe
  C:\Windows\System\AmHtYMT.exe
  2⤵
  PID:3996
- C:\Windows\System\QuqjOKp.exe
  C:\Windows\System\QuqjOKp.exe
  2⤵
  PID:3580
- C:\Windows\System\PHZxGET.exe
  C:\Windows\System\PHZxGET.exe
  2⤵
  PID:3112
- C:\Windows\System\iUjxioa.exe
  C:\Windows\System\iUjxioa.exe
  2⤵
  PID:3924
- C:\Windows\System\VsWpRgo.exe
  C:\Windows\System\VsWpRgo.exe
  2⤵
  PID:3320
- C:\Windows\System\QdmGcha.exe
  C:\Windows\System\QdmGcha.exe
  2⤵
  PID:3100
- C:\Windows\System\SIbwjdT.exe
  C:\Windows\System\SIbwjdT.exe
  2⤵
  PID:3608
- C:\Windows\System\coAKkwF.exe
  C:\Windows\System\coAKkwF.exe
  2⤵
  PID:2892
- C:\Windows\System\FpHyzzP.exe
  C:\Windows\System\FpHyzzP.exe
  2⤵
  PID:4112
- C:\Windows\System\GSSmEny.exe
  C:\Windows\System\GSSmEny.exe
  2⤵
  PID:4128
- C:\Windows\System\RTvLXCY.exe
  C:\Windows\System\RTvLXCY.exe
  2⤵
  PID:4144
- C:\Windows\System\gPBKdpM.exe
  C:\Windows\System\gPBKdpM.exe
  2⤵
  PID:4160
- C:\Windows\System\EYBTESb.exe
  C:\Windows\System\EYBTESb.exe
  2⤵
  PID:4176
- C:\Windows\System\oiTrUyZ.exe
  C:\Windows\System\oiTrUyZ.exe
  2⤵
  PID:4192
- C:\Windows\System\kGJwppK.exe
  C:\Windows\System\kGJwppK.exe
  2⤵
  PID:4216
- C:\Windows\System\ZhcYdMD.exe
  C:\Windows\System\ZhcYdMD.exe
  2⤵
  PID:4232
- C:\Windows\System\QIYnMng.exe
  C:\Windows\System\QIYnMng.exe
  2⤵
  PID:4248
- C:\Windows\System\jIhSWen.exe
  C:\Windows\System\jIhSWen.exe
  2⤵
  PID:4264
- C:\Windows\System\kCkwgmE.exe
  C:\Windows\System\kCkwgmE.exe
  2⤵
  PID:4280
- C:\Windows\System\lYOCDTr.exe
  C:\Windows\System\lYOCDTr.exe
  2⤵
  PID:4296
- C:\Windows\System\ecLbYLY.exe
  C:\Windows\System\ecLbYLY.exe
  2⤵
  PID:4312
- C:\Windows\System\bwAHmzN.exe
  C:\Windows\System\bwAHmzN.exe
  2⤵
  PID:4328
- C:\Windows\System\RTlJfvN.exe
  C:\Windows\System\RTlJfvN.exe
  2⤵
  PID:4344
- C:\Windows\System\KKUaWnB.exe
  C:\Windows\System\KKUaWnB.exe
  2⤵
  PID:4360
- C:\Windows\System\zzhYOpt.exe
  C:\Windows\System\zzhYOpt.exe
  2⤵
  PID:4376
- C:\Windows\System\KzDqCSx.exe
  C:\Windows\System\KzDqCSx.exe
  2⤵
  PID:4392
- C:\Windows\System\YBQFsRy.exe
  C:\Windows\System\YBQFsRy.exe
  2⤵
  PID:4408
- C:\Windows\System\HvFnVkW.exe
  C:\Windows\System\HvFnVkW.exe
  2⤵
  PID:4428
- C:\Windows\System\GDrJdML.exe
  C:\Windows\System\GDrJdML.exe
  2⤵
  PID:4444
- C:\Windows\System\jTphuWt.exe
  C:\Windows\System\jTphuWt.exe
  2⤵
  PID:4460
- C:\Windows\System\ZHxfPPL.exe
  C:\Windows\System\ZHxfPPL.exe
  2⤵
  PID:4476
- C:\Windows\System\HCxteMx.exe
  C:\Windows\System\HCxteMx.exe
  2⤵
  PID:4496
- C:\Windows\System\UJGonPE.exe
  C:\Windows\System\UJGonPE.exe
  2⤵
  PID:4512
- C:\Windows\System\mweywPo.exe
  C:\Windows\System\mweywPo.exe
  2⤵
  PID:4532
- C:\Windows\System\lOWAAWr.exe
  C:\Windows\System\lOWAAWr.exe
  2⤵
  PID:4548
- C:\Windows\System\yBveOMl.exe
  C:\Windows\System\yBveOMl.exe
  2⤵
  PID:4568
- C:\Windows\System\jztOoTj.exe
  C:\Windows\System\jztOoTj.exe
  2⤵
  PID:4584
- C:\Windows\System\LobtRnB.exe
  C:\Windows\System\LobtRnB.exe
  2⤵
  PID:4600
- C:\Windows\System\nSZSGtK.exe
  C:\Windows\System\nSZSGtK.exe
  2⤵
  PID:4616
- C:\Windows\System\jFBHKAo.exe
  C:\Windows\System\jFBHKAo.exe
  2⤵
  PID:4632
- C:\Windows\System\psVDicg.exe
  C:\Windows\System\psVDicg.exe
  2⤵
  PID:4648
- C:\Windows\System\LynBvBp.exe
  C:\Windows\System\LynBvBp.exe
  2⤵
  PID:4664
- C:\Windows\System\NZyeGDb.exe
  C:\Windows\System\NZyeGDb.exe
  2⤵
  PID:4680
- C:\Windows\System\yLshNpp.exe
  C:\Windows\System\yLshNpp.exe
  2⤵
  PID:4696
- C:\Windows\System\jpwyrEK.exe
  C:\Windows\System\jpwyrEK.exe
  2⤵
  PID:4712
- C:\Windows\System\MqsXhhw.exe
  C:\Windows\System\MqsXhhw.exe
  2⤵
  PID:4728
- C:\Windows\System\IqDCheL.exe
  C:\Windows\System\IqDCheL.exe
  2⤵
  PID:4744
- C:\Windows\System\hdyzYPo.exe
  C:\Windows\System\hdyzYPo.exe
  2⤵
  PID:4760
- C:\Windows\System\EiTxjMj.exe
  C:\Windows\System\EiTxjMj.exe
  2⤵
  PID:4784
- C:\Windows\System\vjNFicE.exe
  C:\Windows\System\vjNFicE.exe
  2⤵
  PID:4800
- C:\Windows\System\MerNNRU.exe
  C:\Windows\System\MerNNRU.exe
  2⤵
  PID:4820
- C:\Windows\System\UFGzqKk.exe
  C:\Windows\System\UFGzqKk.exe
  2⤵
  PID:4836
- C:\Windows\System\fYGwbFa.exe
  C:\Windows\System\fYGwbFa.exe
  2⤵
  PID:4856
- C:\Windows\System\czisyJj.exe
  C:\Windows\System\czisyJj.exe
  2⤵
  PID:4884
- C:\Windows\System\YqYYIsb.exe
  C:\Windows\System\YqYYIsb.exe
  2⤵
  PID:4908
- C:\Windows\System\FGpnxVi.exe
  C:\Windows\System\FGpnxVi.exe
  2⤵
  PID:4928
- C:\Windows\System\FAtZbkq.exe
  C:\Windows\System\FAtZbkq.exe
  2⤵
  PID:4944
- C:\Windows\System\TMFShYk.exe
  C:\Windows\System\TMFShYk.exe
  2⤵
  PID:4960
- C:\Windows\System\KnnMXZK.exe
  C:\Windows\System\KnnMXZK.exe
  2⤵
  PID:4976
- C:\Windows\System\kWxXZOK.exe
  C:\Windows\System\kWxXZOK.exe
  2⤵
  PID:4996
- C:\Windows\System\jpCNWvs.exe
  C:\Windows\System\jpCNWvs.exe
  2⤵
  PID:5012
- C:\Windows\System\JejpqPI.exe
  C:\Windows\System\JejpqPI.exe
  2⤵
  PID:5028
- C:\Windows\System\lSoCkpJ.exe
  C:\Windows\System\lSoCkpJ.exe
  2⤵
  PID:5044
- C:\Windows\System\KhJbnNT.exe
  C:\Windows\System\KhJbnNT.exe
  2⤵
  PID:5060
- C:\Windows\System\vlUhesg.exe
  C:\Windows\System\vlUhesg.exe
  2⤵
  PID:5076
- C:\Windows\System\boMFCeK.exe
  C:\Windows\System\boMFCeK.exe
  2⤵
  PID:5092
- C:\Windows\System\BURTZSE.exe
  C:\Windows\System\BURTZSE.exe
  2⤵
  PID:5108
- C:\Windows\System\xHoLizR.exe
  C:\Windows\System\xHoLizR.exe
  2⤵
  PID:3144
- C:\Windows\System\CWbcRIH.exe
  C:\Windows\System\CWbcRIH.exe
  2⤵
  PID:3128
- C:\Windows\System\WOPruUa.exe
  C:\Windows\System\WOPruUa.exe
  2⤵
  PID:4124
- C:\Windows\System\ZHdWfnX.exe
  C:\Windows\System\ZHdWfnX.exe
  2⤵
  PID:4136
- C:\Windows\System\soLQnhF.exe
  C:\Windows\System\soLQnhF.exe
  2⤵
  PID:3392
- C:\Windows\System\shSyYfE.exe
  C:\Windows\System\shSyYfE.exe
  2⤵
  PID:4140
- C:\Windows\System\THJkhXO.exe
  C:\Windows\System\THJkhXO.exe
  2⤵
  PID:4172
- C:\Windows\System\HrQzRzh.exe
  C:\Windows\System\HrQzRzh.exe
  2⤵
  PID:4224
- C:\Windows\System\HIKYKqZ.exe
  C:\Windows\System\HIKYKqZ.exe
  2⤵
  PID:4200
- C:\Windows\System\KvqxxKJ.exe
  C:\Windows\System\KvqxxKJ.exe
  2⤵
  PID:4292
- C:\Windows\System\jhaZuLe.exe
  C:\Windows\System\jhaZuLe.exe
  2⤵
  PID:4272
- C:\Windows\System\icSuPGH.exe
  C:\Windows\System\icSuPGH.exe
  2⤵
  PID:4352
- C:\Windows\System\fJaWhkQ.exe
  C:\Windows\System\fJaWhkQ.exe
  2⤵
  PID:4340
- C:\Windows\System\OiTVdBA.exe
  C:\Windows\System\OiTVdBA.exe
  2⤵
  PID:4416
- C:\Windows\System\ZelrclK.exe
  C:\Windows\System\ZelrclK.exe
  2⤵
  PID:4420
- C:\Windows\System\oDxbmqn.exe
  C:\Windows\System\oDxbmqn.exe
  2⤵
  PID:4488
- C:\Windows\System\jpBgrzx.exe
  C:\Windows\System\jpBgrzx.exe
  2⤵
  PID:4524
- C:\Windows\System\WQGTErS.exe
  C:\Windows\System\WQGTErS.exe
  2⤵
  PID:4436
- C:\Windows\System\YVmyLoH.exe
  C:\Windows\System\YVmyLoH.exe
  2⤵
  PID:4628
- C:\Windows\System\bjtzixf.exe
  C:\Windows\System\bjtzixf.exe
  2⤵
  PID:4692
- C:\Windows\System\tJqmoCj.exe
  C:\Windows\System\tJqmoCj.exe
  2⤵
  PID:4740
- C:\Windows\System\Yaxhdbc.exe
  C:\Windows\System\Yaxhdbc.exe
  2⤵
  PID:4672
- C:\Windows\System\cAnLGbL.exe
  C:\Windows\System\cAnLGbL.exe
  2⤵
  PID:4580
- C:\Windows\System\lKZDrom.exe
  C:\Windows\System\lKZDrom.exe
  2⤵
  PID:4472
- C:\Windows\System\aQipeqI.exe
  C:\Windows\System\aQipeqI.exe
  2⤵
  PID:4796
- C:\Windows\System\eTyCdfa.exe
  C:\Windows\System\eTyCdfa.exe
  2⤵
  PID:4828
- C:\Windows\System\bZGsvrn.exe
  C:\Windows\System\bZGsvrn.exe
  2⤵
  PID:4872
- C:\Windows\System\GjoeGEy.exe
  C:\Windows\System\GjoeGEy.exe
  2⤵
  PID:4876
- C:\Windows\System\BuylyDi.exe
  C:\Windows\System\BuylyDi.exe
  2⤵
  PID:4904
- C:\Windows\System\vxtpxMd.exe
  C:\Windows\System\vxtpxMd.exe
  2⤵
  PID:4952
- C:\Windows\System\wxJgEEH.exe
  C:\Windows\System\wxJgEEH.exe
  2⤵
  PID:4972
- C:\Windows\System\uEkKviT.exe
  C:\Windows\System\uEkKviT.exe
  2⤵
  PID:5020
- C:\Windows\System\KeLqEmc.exe
  C:\Windows\System\KeLqEmc.exe
  2⤵
  PID:5084
- C:\Windows\System\FnMDequ.exe
  C:\Windows\System\FnMDequ.exe
  2⤵
  PID:5088
- C:\Windows\System\VyuAbQo.exe
  C:\Windows\System\VyuAbQo.exe
  2⤵
  PID:5116
- C:\Windows\System\dEZUVQg.exe
  C:\Windows\System\dEZUVQg.exe
  2⤵
  PID:4104
- C:\Windows\System\jhSStWf.exe
  C:\Windows\System\jhSStWf.exe
  2⤵
  PID:4208
- C:\Windows\System\SGwDewi.exe
  C:\Windows\System\SGwDewi.exe
  2⤵
  PID:4092
- C:\Windows\System\ZVVuWfB.exe
  C:\Windows\System\ZVVuWfB.exe
  2⤵
  PID:3468
- C:\Windows\System\QAMNwLJ.exe
  C:\Windows\System\QAMNwLJ.exe
  2⤵
  PID:4204
- C:\Windows\System\AYKvGbU.exe
  C:\Windows\System\AYKvGbU.exe
  2⤵
  PID:4240
- C:\Windows\System\kzPYMdO.exe
  C:\Windows\System\kzPYMdO.exe
  2⤵
  PID:4564
- C:\Windows\System\QkTYeVe.exe
  C:\Windows\System\QkTYeVe.exe
  2⤵
  PID:4372
- C:\Windows\System\Lyvehho.exe
  C:\Windows\System\Lyvehho.exe
  2⤵
  PID:4544
- C:\Windows\System\EkUwmvu.exe
  C:\Windows\System\EkUwmvu.exe
  2⤵
  PID:4704
- C:\Windows\System\SNRwZDG.exe
  C:\Windows\System\SNRwZDG.exe
  2⤵
  PID:4792
- C:\Windows\System\MtFiEMR.exe
  C:\Windows\System\MtFiEMR.exe
  2⤵
  PID:4868
- C:\Windows\System\YbXtHST.exe
  C:\Windows\System\YbXtHST.exe
  2⤵
  PID:4900
- C:\Windows\System\jLsWENr.exe
  C:\Windows\System\jLsWENr.exe
  2⤵
  PID:5056
- C:\Windows\System\MBIVZsY.exe
  C:\Windows\System\MBIVZsY.exe
  2⤵
  PID:3596
- C:\Windows\System\NBgETLd.exe
  C:\Windows\System\NBgETLd.exe
  2⤵
  PID:4120
- C:\Windows\System\VNlSjGr.exe
  C:\Windows\System\VNlSjGr.exe
  2⤵
  PID:4256
- C:\Windows\System\chRYPVs.exe
  C:\Windows\System\chRYPVs.exe
  2⤵
  PID:4404
- C:\Windows\System\YpWdhVu.exe
  C:\Windows\System\YpWdhVu.exe
  2⤵
  PID:4724
- C:\Windows\System\CCYsPEe.exe
  C:\Windows\System\CCYsPEe.exe
  2⤵
  PID:4624
- C:\Windows\System\ZugWRcE.exe
  C:\Windows\System\ZugWRcE.exe
  2⤵
  PID:4644
- C:\Windows\System\uObiixi.exe
  C:\Windows\System\uObiixi.exe
  2⤵
  PID:4456
- C:\Windows\System\uRWemzi.exe
  C:\Windows\System\uRWemzi.exe
  2⤵
  PID:4968
- C:\Windows\System\bqMyOsj.exe
  C:\Windows\System\bqMyOsj.exe
  2⤵
  PID:4440
- C:\Windows\System\sjDnNMY.exe
  C:\Windows\System\sjDnNMY.exe
  2⤵
  PID:4168
- C:\Windows\System\UsfbCEl.exe
  C:\Windows\System\UsfbCEl.exe
  2⤵
  PID:5104
- C:\Windows\System\iJCEJMw.exe
  C:\Windows\System\iJCEJMw.exe
  2⤵
  PID:4640
- C:\Windows\System\UsVnBDw.exe
  C:\Windows\System\UsVnBDw.exe
  2⤵
  PID:4768
- C:\Windows\System\FKlKMPc.exe
  C:\Windows\System\FKlKMPc.exe
  2⤵
  PID:4156
- C:\Windows\System\xRTpRwN.exe
  C:\Windows\System\xRTpRwN.exe
  2⤵
  PID:4756
- C:\Windows\System\kPuExpS.exe
  C:\Windows\System\kPuExpS.exe
  2⤵
  PID:4308
- C:\Windows\System\IZAnpiF.exe
  C:\Windows\System\IZAnpiF.exe
  2⤵
  PID:4520
- C:\Windows\System\alyJKDD.exe
  C:\Windows\System\alyJKDD.exe
  2⤵
  PID:4780
- C:\Windows\System\MYrhmMf.exe
  C:\Windows\System\MYrhmMf.exe
  2⤵
  PID:5136
- C:\Windows\System\OCNJDPv.exe
  C:\Windows\System\OCNJDPv.exe
  2⤵
  PID:5152
- C:\Windows\System\GHTTqzH.exe
  C:\Windows\System\GHTTqzH.exe
  2⤵
  PID:5188
- C:\Windows\System\UViFyGg.exe
  C:\Windows\System\UViFyGg.exe
  2⤵
  PID:5236
- C:\Windows\System\ERNGihb.exe
  C:\Windows\System\ERNGihb.exe
  2⤵
  PID:5288
- C:\Windows\System\lmivCAO.exe
  C:\Windows\System\lmivCAO.exe
  2⤵
  PID:5308
- C:\Windows\System\paaheSl.exe
  C:\Windows\System\paaheSl.exe
  2⤵
  PID:5328
- C:\Windows\System\eNVBRAg.exe
  C:\Windows\System\eNVBRAg.exe
  2⤵
  PID:5348
- C:\Windows\System\kihibcH.exe
  C:\Windows\System\kihibcH.exe
  2⤵
  PID:5368
- C:\Windows\System\cesBnGa.exe
  C:\Windows\System\cesBnGa.exe
  2⤵
  PID:5436
- C:\Windows\System\crPsPOG.exe
  C:\Windows\System\crPsPOG.exe
  2⤵
  PID:5476
- C:\Windows\System\ocsIFVK.exe
  C:\Windows\System\ocsIFVK.exe
  2⤵
  PID:5492
- C:\Windows\System\rZLGqgQ.exe
  C:\Windows\System\rZLGqgQ.exe
  2⤵
  PID:5508
- C:\Windows\System\YrkHAQg.exe
  C:\Windows\System\YrkHAQg.exe
  2⤵
  PID:5528
- C:\Windows\System\UTSraUc.exe
  C:\Windows\System\UTSraUc.exe
  2⤵
  PID:5548
- C:\Windows\System\uCHgTEZ.exe
  C:\Windows\System\uCHgTEZ.exe
  2⤵
  PID:5564
- C:\Windows\System\TdvwHvI.exe
  C:\Windows\System\TdvwHvI.exe
  2⤵
  PID:5588
- C:\Windows\System\wxmoHPV.exe
  C:\Windows\System\wxmoHPV.exe
  2⤵
  PID:5604
- C:\Windows\System\sYdPVux.exe
  C:\Windows\System\sYdPVux.exe
  2⤵
  PID:5620
- C:\Windows\System\ewWcETe.exe
  C:\Windows\System\ewWcETe.exe
  2⤵
  PID:5636
- C:\Windows\System\krkkMKC.exe
  C:\Windows\System\krkkMKC.exe
  2⤵
  PID:5656
- C:\Windows\System\UCDntUa.exe
  C:\Windows\System\UCDntUa.exe
  2⤵
  PID:5672
- C:\Windows\System\cAyFBAs.exe
  C:\Windows\System\cAyFBAs.exe
  2⤵
  PID:5692
- C:\Windows\System\KqOxguz.exe
  C:\Windows\System\KqOxguz.exe
  2⤵
  PID:5708
- C:\Windows\System\lroMoNc.exe
  C:\Windows\System\lroMoNc.exe
  2⤵
  PID:5728
- C:\Windows\System\ZdGJZaw.exe
  C:\Windows\System\ZdGJZaw.exe
  2⤵
  PID:5744
- C:\Windows\System\cJzanir.exe
  C:\Windows\System\cJzanir.exe
  2⤵
  PID:5760
- C:\Windows\System\zmjfQMy.exe
  C:\Windows\System\zmjfQMy.exe
  2⤵
  PID:5780
- C:\Windows\System\bhxmtJc.exe
  C:\Windows\System\bhxmtJc.exe
  2⤵
  PID:5800
- C:\Windows\System\gSLpwCq.exe
  C:\Windows\System\gSLpwCq.exe
  2⤵
  PID:5816
- C:\Windows\System\HRasHEh.exe
  C:\Windows\System\HRasHEh.exe
  2⤵
  PID:5832
- C:\Windows\System\BSvbwgP.exe
  C:\Windows\System\BSvbwgP.exe
  2⤵
  PID:5848
- C:\Windows\System\zugASYo.exe
  C:\Windows\System\zugASYo.exe
  2⤵
  PID:5864
- C:\Windows\System\WaQAcPn.exe
  C:\Windows\System\WaQAcPn.exe
  2⤵
  PID:5880
- C:\Windows\System\lWyXRCu.exe
  C:\Windows\System\lWyXRCu.exe
  2⤵
  PID:5896
- C:\Windows\System\fovSnnK.exe
  C:\Windows\System\fovSnnK.exe
  2⤵
  PID:5924
- C:\Windows\System\DUrRSWZ.exe
  C:\Windows\System\DUrRSWZ.exe
  2⤵
  PID:5940
- C:\Windows\System\ilQGpre.exe
  C:\Windows\System\ilQGpre.exe
  2⤵
  PID:5956
- C:\Windows\System\ofLchMy.exe
  C:\Windows\System\ofLchMy.exe
  2⤵
  PID:5972
- C:\Windows\System\HoBnhet.exe
  C:\Windows\System\HoBnhet.exe
  2⤵
  PID:5988
- C:\Windows\System\GXXnSCC.exe
  C:\Windows\System\GXXnSCC.exe
  2⤵
  PID:6004
- C:\Windows\System\HZXBYWA.exe
  C:\Windows\System\HZXBYWA.exe
  2⤵
  PID:6020
- C:\Windows\System\GOpvzKf.exe
  C:\Windows\System\GOpvzKf.exe
  2⤵
  PID:6036
- C:\Windows\System\gFkHraE.exe
  C:\Windows\System\gFkHraE.exe
  2⤵
  PID:6052
- C:\Windows\System\MxtLpAa.exe
  C:\Windows\System\MxtLpAa.exe
  2⤵
  PID:6068
- C:\Windows\System\qCxreYT.exe
  C:\Windows\System\qCxreYT.exe
  2⤵
  PID:6096
- C:\Windows\System\pjZmvtB.exe
  C:\Windows\System\pjZmvtB.exe
  2⤵
  PID:6112
- C:\Windows\System\zgQLgyn.exe
  C:\Windows\System\zgQLgyn.exe
  2⤵
  PID:6132
- C:\Windows\System\mehrXcY.exe
  C:\Windows\System\mehrXcY.exe
  2⤵
  PID:5280
- C:\Windows\System\SrqXNdx.exe
  C:\Windows\System\SrqXNdx.exe
  2⤵
  PID:5320
- C:\Windows\System\HAyXXVA.exe
  C:\Windows\System\HAyXXVA.exe
  2⤵
  PID:5340
- C:\Windows\System\oalhNOE.exe
  C:\Windows\System\oalhNOE.exe
  2⤵
  PID:5384
- C:\Windows\System\aJLMXRa.exe
  C:\Windows\System\aJLMXRa.exe
  2⤵
  PID:5284
- C:\Windows\System\bflrmcI.exe
  C:\Windows\System\bflrmcI.exe
  2⤵
  PID:5296
- C:\Windows\System\NjFbLgd.exe
  C:\Windows\System\NjFbLgd.exe
  2⤵
  PID:5400
- C:\Windows\System\crELtFV.exe
  C:\Windows\System\crELtFV.exe
  2⤵
  PID:5428
- C:\Windows\System\LUNRLSJ.exe
  C:\Windows\System\LUNRLSJ.exe
  2⤵
  PID:5556
- C:\Windows\System\NOhktyP.exe
  C:\Windows\System\NOhktyP.exe
  2⤵
  PID:5464
- C:\Windows\System\HjUdMyi.exe
  C:\Windows\System\HjUdMyi.exe
  2⤵
  PID:5504
- C:\Windows\System\OlqwuTO.exe
  C:\Windows\System\OlqwuTO.exe
  2⤵
  PID:5560
- C:\Windows\System\fipnRGZ.exe
  C:\Windows\System\fipnRGZ.exe
  2⤵
  PID:5572
- C:\Windows\System\wrvXEfd.exe
  C:\Windows\System\wrvXEfd.exe
  2⤵
  PID:5596
- C:\Windows\System\JJqcKAK.exe
  C:\Windows\System\JJqcKAK.exe
  2⤵
  PID:5664
- C:\Windows\System\dmFzkTc.exe
  C:\Windows\System\dmFzkTc.exe
  2⤵
  PID:5616
- C:\Windows\System\XSfkMPI.exe
  C:\Windows\System\XSfkMPI.exe
  2⤵
  PID:5700
- C:\Windows\System\sZppgiN.exe
  C:\Windows\System\sZppgiN.exe
  2⤵
  PID:5716
- C:\Windows\System\miDOzYI.exe
  C:\Windows\System\miDOzYI.exe
  2⤵
  PID:5756
- C:\Windows\System\MPNZwxP.exe
  C:\Windows\System\MPNZwxP.exe
  2⤵
  PID:5792
- C:\Windows\System\ONPICUV.exe
  C:\Windows\System\ONPICUV.exe
  2⤵
  PID:5888
- C:\Windows\System\ivcNTHV.exe
  C:\Windows\System\ivcNTHV.exe
  2⤵
  PID:5812
- C:\Windows\System\vQaIIRv.exe
  C:\Windows\System\vQaIIRv.exe
  2⤵
  PID:5968
- C:\Windows\System\rdTgDPF.exe
  C:\Windows\System\rdTgDPF.exe
  2⤵
  PID:6032
- C:\Windows\System\wcQodyR.exe
  C:\Windows\System\wcQodyR.exe
  2⤵
  PID:6016
- C:\Windows\System\JysXXHg.exe
  C:\Windows\System\JysXXHg.exe
  2⤵
  PID:6080
- C:\Windows\System\OQMtQYa.exe
  C:\Windows\System\OQMtQYa.exe
  2⤵
  PID:5204
- C:\Windows\System\zWXwCWT.exe
  C:\Windows\System\zWXwCWT.exe
  2⤵
  PID:5264
- C:\Windows\System\VwfMxSH.exe
  C:\Windows\System\VwfMxSH.exe
  2⤵
  PID:4752
- C:\Windows\System\rRoiXXf.exe
  C:\Windows\System\rRoiXXf.exe
  2⤵
  PID:5680
- C:\Windows\System\YSiuSPk.exe
  C:\Windows\System\YSiuSPk.exe
  2⤵
  PID:5584
- C:\Windows\System\ncsSdQc.exe
  C:\Windows\System\ncsSdQc.exe
  2⤵
  PID:5768
- C:\Windows\System\FuGYskX.exe
  C:\Windows\System\FuGYskX.exe
  2⤵
  PID:5176
- C:\Windows\System\QFnRqnp.exe
  C:\Windows\System\QFnRqnp.exe
  2⤵
  PID:4540
- C:\Windows\System\yrKQfhz.exe
  C:\Windows\System\yrKQfhz.exe
  2⤵
  PID:5008
- C:\Windows\System\LDMGeEQ.exe
  C:\Windows\System\LDMGeEQ.exe
  2⤵
  PID:5364
- C:\Windows\System\miCLkDY.exe
  C:\Windows\System\miCLkDY.exe
  2⤵
  PID:5484
- C:\Windows\System\jQjQZmr.exe
  C:\Windows\System\jQjQZmr.exe
  2⤵
  PID:6076
- C:\Windows\System\TkMsFLj.exe
  C:\Windows\System\TkMsFLj.exe
  2⤵
  PID:5824
- C:\Windows\System\uwmfShT.exe
  C:\Windows\System\uwmfShT.exe
  2⤵
  PID:5232
- C:\Windows\System\iKqxXim.exe
  C:\Windows\System\iKqxXim.exe
  2⤵
  PID:5844
- C:\Windows\System\EPjSiyW.exe
  C:\Windows\System\EPjSiyW.exe
  2⤵
  PID:5952
- C:\Windows\System\JETAOtM.exe
  C:\Windows\System\JETAOtM.exe
  2⤵
  PID:6108
- C:\Windows\System\jKeyWis.exe
  C:\Windows\System\jKeyWis.exe
  2⤵
  PID:6012
- C:\Windows\System\CsmvHFk.exe
  C:\Windows\System\CsmvHFk.exe
  2⤵
  PID:6084
- C:\Windows\System\NnIbVqq.exe
  C:\Windows\System\NnIbVqq.exe
  2⤵
  PID:5444
- C:\Windows\System\ENavdne.exe
  C:\Windows\System\ENavdne.exe
  2⤵
  PID:5200
- C:\Windows\System\SqfeDZK.exe
  C:\Windows\System\SqfeDZK.exe
  2⤵
  PID:5408
- C:\Windows\System\GMnwAoc.exe
  C:\Windows\System\GMnwAoc.exe
  2⤵
  PID:5260
- C:\Windows\System\Knkkzaj.exe
  C:\Windows\System\Knkkzaj.exe
  2⤵
  PID:5580
- C:\Windows\System\tPeIkuo.exe
  C:\Windows\System\tPeIkuo.exe
  2⤵
  PID:5544
- C:\Windows\System\JtClEda.exe
  C:\Windows\System\JtClEda.exe
  2⤵
  PID:5488
- C:\Windows\System\VACburp.exe
  C:\Windows\System\VACburp.exe
  2⤵
  PID:5336
- C:\Windows\System\yaLApKj.exe
  C:\Windows\System\yaLApKj.exe
  2⤵
  PID:240
- C:\Windows\System\QgkmKfR.exe
  C:\Windows\System\QgkmKfR.exe
  2⤵
  PID:5652
- C:\Windows\System\KiGYVjv.exe
  C:\Windows\System\KiGYVjv.exe
  2⤵
  PID:5912
- C:\Windows\System\hQXogYt.exe
  C:\Windows\System\hQXogYt.exe
  2⤵
  PID:5212
- C:\Windows\System\YqrdVMR.exe
  C:\Windows\System\YqrdVMR.exe
  2⤵
  PID:5776
- C:\Windows\System\StXhAAm.exe
  C:\Windows\System\StXhAAm.exe
  2⤵
  PID:6092
- C:\Windows\System\zQBPVWd.exe
  C:\Windows\System\zQBPVWd.exe
  2⤵
  PID:5304
- C:\Windows\System\mJxzGNt.exe
  C:\Windows\System\mJxzGNt.exe
  2⤵
  PID:5248
- C:\Windows\System\PhQlPNG.exe
  C:\Windows\System\PhQlPNG.exe
  2⤵
  PID:5460
- C:\Windows\System\lHcuvOp.exe
  C:\Windows\System\lHcuvOp.exe
  2⤵
  PID:4212
- C:\Windows\System\WdvJquw.exe
  C:\Windows\System\WdvJquw.exe
  2⤵
  PID:5856
- C:\Windows\System\QbecVGn.exe
  C:\Windows\System\QbecVGn.exe
  2⤵
  PID:5920
- C:\Windows\System\sSkfPQO.exe
  C:\Windows\System\sSkfPQO.exe
  2⤵
  PID:5324
- C:\Windows\System\hEieMbf.exe
  C:\Windows\System\hEieMbf.exe
  2⤵
  PID:5964
- C:\Windows\System\yQQveXQ.exe
  C:\Windows\System\yQQveXQ.exe
  2⤵
  PID:5736
- C:\Windows\System\QrWLknP.exe
  C:\Windows\System\QrWLknP.exe
  2⤵
  PID:5632
- C:\Windows\System\VNyctbz.exe
  C:\Windows\System\VNyctbz.exe
  2⤵
  PID:5872
- C:\Windows\System\rGXliiy.exe
  C:\Windows\System\rGXliiy.exe
  2⤵
  PID:5540
- C:\Windows\System\mnIIAHC.exe
  C:\Windows\System\mnIIAHC.exe
  2⤵
  PID:6156
- C:\Windows\System\tNjIpXY.exe
  C:\Windows\System\tNjIpXY.exe
  2⤵
  PID:6172
- C:\Windows\System\LpIDzsw.exe
  C:\Windows\System\LpIDzsw.exe
  2⤵
  PID:6196
- C:\Windows\System\fuKDzJZ.exe
  C:\Windows\System\fuKDzJZ.exe
  2⤵
  PID:6212
- C:\Windows\System\SpfEVub.exe
  C:\Windows\System\SpfEVub.exe
  2⤵
  PID:6228
- C:\Windows\System\XbJhHgO.exe
  C:\Windows\System\XbJhHgO.exe
  2⤵
  PID:6244
- C:\Windows\System\CyYDfLO.exe
  C:\Windows\System\CyYDfLO.exe
  2⤵
  PID:6260
- C:\Windows\System\uypsEMC.exe
  C:\Windows\System\uypsEMC.exe
  2⤵
  PID:6276
- C:\Windows\System\xSnOjxV.exe
  C:\Windows\System\xSnOjxV.exe
  2⤵
  PID:6292
- C:\Windows\System\yBUUfhL.exe
  C:\Windows\System\yBUUfhL.exe
  2⤵
  PID:6308
- C:\Windows\System\uUhgyXC.exe
  C:\Windows\System\uUhgyXC.exe
  2⤵
  PID:6324
- C:\Windows\System\wIyZPDS.exe
  C:\Windows\System\wIyZPDS.exe
  2⤵
  PID:6340
- C:\Windows\System\VfQDTPQ.exe
  C:\Windows\System\VfQDTPQ.exe
  2⤵
  PID:6356
- C:\Windows\System\bYsOltF.exe
  C:\Windows\System\bYsOltF.exe
  2⤵
  PID:6372
- C:\Windows\System\xsRPraw.exe
  C:\Windows\System\xsRPraw.exe
  2⤵
  PID:6388
- C:\Windows\System\QfzJbin.exe
  C:\Windows\System\QfzJbin.exe
  2⤵
  PID:6404
- C:\Windows\System\WUYTxnX.exe
  C:\Windows\System\WUYTxnX.exe
  2⤵
  PID:6420
- C:\Windows\System\sPMNicN.exe
  C:\Windows\System\sPMNicN.exe
  2⤵
  PID:6440
- C:\Windows\System\qsSfdec.exe
  C:\Windows\System\qsSfdec.exe
  2⤵
  PID:6456
- C:\Windows\System\gHfqiWv.exe
  C:\Windows\System\gHfqiWv.exe
  2⤵
  PID:6472
- C:\Windows\System\GqrFdbe.exe
  C:\Windows\System\GqrFdbe.exe
  2⤵
  PID:6488
- C:\Windows\System\kSqyMhT.exe
  C:\Windows\System\kSqyMhT.exe
  2⤵
  PID:6504
- C:\Windows\System\gOjyeDP.exe
  C:\Windows\System\gOjyeDP.exe
  2⤵
  PID:6520
- C:\Windows\System\UerrwSn.exe
  C:\Windows\System\UerrwSn.exe
  2⤵
  PID:6536
- C:\Windows\System\lQswyNY.exe
  C:\Windows\System\lQswyNY.exe
  2⤵
  PID:6552
- C:\Windows\System\nIBHfcC.exe
  C:\Windows\System\nIBHfcC.exe
  2⤵
  PID:6568
- C:\Windows\System\kbBgWxn.exe
  C:\Windows\System\kbBgWxn.exe
  2⤵
  PID:6584
- C:\Windows\System\RtVpdKG.exe
  C:\Windows\System\RtVpdKG.exe
  2⤵
  PID:6600
- C:\Windows\System\PzPjmFE.exe
  C:\Windows\System\PzPjmFE.exe
  2⤵
  PID:6616
- C:\Windows\System\jEqehRI.exe
  C:\Windows\System\jEqehRI.exe
  2⤵
  PID:6632
- C:\Windows\System\cyxJAhc.exe
  C:\Windows\System\cyxJAhc.exe
  2⤵
  PID:6648
- C:\Windows\System\PJCxjih.exe
  C:\Windows\System\PJCxjih.exe
  2⤵
  PID:6664
- C:\Windows\System\RJtaTWB.exe
  C:\Windows\System\RJtaTWB.exe
  2⤵
  PID:6680
- C:\Windows\System\CxJIYLi.exe
  C:\Windows\System\CxJIYLi.exe
  2⤵
  PID:6696
- C:\Windows\System\OyYKxtj.exe
  C:\Windows\System\OyYKxtj.exe
  2⤵
  PID:6712
- C:\Windows\System\pOXDMlp.exe
  C:\Windows\System\pOXDMlp.exe
  2⤵
  PID:6728
- C:\Windows\System\vbaHCns.exe
  C:\Windows\System\vbaHCns.exe
  2⤵
  PID:6744
- C:\Windows\System\vKWrfzB.exe
  C:\Windows\System\vKWrfzB.exe
  2⤵
  PID:6760
- C:\Windows\System\DsfpOYq.exe
  C:\Windows\System\DsfpOYq.exe
  2⤵
  PID:6776
- C:\Windows\System\IHDMctF.exe
  C:\Windows\System\IHDMctF.exe
  2⤵
  PID:6792
- C:\Windows\System\NmPoZHd.exe
  C:\Windows\System\NmPoZHd.exe
  2⤵
  PID:6808
- C:\Windows\System\QsCGEcf.exe
  C:\Windows\System\QsCGEcf.exe
  2⤵
  PID:6828
- C:\Windows\System\NgRukbV.exe
  C:\Windows\System\NgRukbV.exe
  2⤵
  PID:6844
- C:\Windows\System\UHIJOff.exe
  C:\Windows\System\UHIJOff.exe
  2⤵
  PID:6860
- C:\Windows\System\TMVXeeI.exe
  C:\Windows\System\TMVXeeI.exe
  2⤵
  PID:6876
- C:\Windows\System\QSsJJkP.exe
  C:\Windows\System\QSsJJkP.exe
  2⤵
  PID:6892
- C:\Windows\System\LWhixTh.exe
  C:\Windows\System\LWhixTh.exe
  2⤵
  PID:6908
- C:\Windows\System\kpllsQb.exe
  C:\Windows\System\kpllsQb.exe
  2⤵
  PID:6924
- C:\Windows\System\aveZEKK.exe
  C:\Windows\System\aveZEKK.exe
  2⤵
  PID:6940
- C:\Windows\System\GCnrPhb.exe
  C:\Windows\System\GCnrPhb.exe
  2⤵
  PID:6956
- C:\Windows\System\tQSaLhc.exe
  C:\Windows\System\tQSaLhc.exe
  2⤵
  PID:6972
- C:\Windows\System\IYMmSTh.exe
  C:\Windows\System\IYMmSTh.exe
  2⤵
  PID:6988
- C:\Windows\System\qInFQcE.exe
  C:\Windows\System\qInFQcE.exe
  2⤵
  PID:7004
- C:\Windows\System\yRrLnjy.exe
  C:\Windows\System\yRrLnjy.exe
  2⤵
  PID:7020
- C:\Windows\System\IMXbIny.exe
  C:\Windows\System\IMXbIny.exe
  2⤵
  PID:7036
- C:\Windows\System\dcrVCOq.exe
  C:\Windows\System\dcrVCOq.exe
  2⤵
  PID:7052
- C:\Windows\System\omMznwm.exe
  C:\Windows\System\omMznwm.exe
  2⤵
  PID:7068
- C:\Windows\System\WeTQlok.exe
  C:\Windows\System\WeTQlok.exe
  2⤵
  PID:7084
- C:\Windows\System\VmWlDaW.exe
  C:\Windows\System\VmWlDaW.exe
  2⤵
  PID:7100
- C:\Windows\System\RQJWAum.exe
  C:\Windows\System\RQJWAum.exe
  2⤵
  PID:7116
- C:\Windows\System\MaCXUzy.exe
  C:\Windows\System\MaCXUzy.exe
  2⤵
  PID:7132
- C:\Windows\System\bUbCQWN.exe
  C:\Windows\System\bUbCQWN.exe
  2⤵
  PID:7148
- C:\Windows\System\BCyxEKv.exe
  C:\Windows\System\BCyxEKv.exe
  2⤵
  PID:5416
- C:\Windows\System\wWdZKFh.exe
  C:\Windows\System\wWdZKFh.exe
  2⤵
  PID:6204
- C:\Windows\System\FqbWXik.exe
  C:\Windows\System\FqbWXik.exe
  2⤵
  PID:6268
- C:\Windows\System\XnqCJTR.exe
  C:\Windows\System\XnqCJTR.exe
  2⤵
  PID:6368
- C:\Windows\System\cgAgjNc.exe
  C:\Windows\System\cgAgjNc.exe
  2⤵
  PID:6432
- C:\Windows\System\FAqKJes.exe
  C:\Windows\System\FAqKJes.exe
  2⤵
  PID:6380
- C:\Windows\System\iXeiKUX.exe
  C:\Windows\System\iXeiKUX.exe
  2⤵
  PID:6288
- C:\Windows\System\padPepL.exe
  C:\Windows\System\padPepL.exe
  2⤵
  PID:6352
- C:\Windows\System\VtenyfP.exe
  C:\Windows\System\VtenyfP.exe
  2⤵
  PID:6448
- C:\Windows\System\DsQKAYQ.exe
  C:\Windows\System\DsQKAYQ.exe
  2⤵
  PID:6416
- C:\Windows\System\myDVpUf.exe
  C:\Windows\System\myDVpUf.exe
  2⤵
  PID:6452
- C:\Windows\System\xlhvEfJ.exe
  C:\Windows\System\xlhvEfJ.exe
  2⤵
  PID:6624
- C:\Windows\System\jIXxaEu.exe
  C:\Windows\System\jIXxaEu.exe
  2⤵
  PID:6580
- C:\Windows\System\rarcDSV.exe
  C:\Windows\System\rarcDSV.exe
  2⤵
  PID:6692
- C:\Windows\System\xEoQUAP.exe
  C:\Windows\System\xEoQUAP.exe
  2⤵
  PID:6704
- C:\Windows\System\gurUZbQ.exe
  C:\Windows\System\gurUZbQ.exe
  2⤵
  PID:6756
- C:\Windows\System\NHspXPw.exe
  C:\Windows\System\NHspXPw.exe
  2⤵
  PID:6740
- C:\Windows\System\mzBEAHu.exe
  C:\Windows\System\mzBEAHu.exe
  2⤵
  PID:6868
- C:\Windows\System\LPXGWwu.exe
  C:\Windows\System\LPXGWwu.exe
  2⤵
  PID:6804
- C:\Windows\System\IIQXkNE.exe
  C:\Windows\System\IIQXkNE.exe
  2⤵
  PID:6888
- C:\Windows\System\CDQpshO.exe
  C:\Windows\System\CDQpshO.exe
  2⤵
  PID:6952
- C:\Windows\System\pVtIXWp.exe
  C:\Windows\System\pVtIXWp.exe
  2⤵
  PID:6980
- C:\Windows\System\FPrQdzA.exe
  C:\Windows\System\FPrQdzA.exe
  2⤵
  PID:6936
- C:\Windows\System\FTgxPBo.exe
  C:\Windows\System\FTgxPBo.exe
  2⤵
  PID:7076
- C:\Windows\System\rrMKJTr.exe
  C:\Windows\System\rrMKJTr.exe
  2⤵
  PID:6840
- C:\Windows\System\DIYjPbs.exe
  C:\Windows\System\DIYjPbs.exe
  2⤵
  PID:7000
- C:\Windows\System\mZCWXXY.exe
  C:\Windows\System\mZCWXXY.exe
  2⤵
  PID:7060
- C:\Windows\System\NUtnDbW.exe
  C:\Windows\System\NUtnDbW.exe
  2⤵
  PID:7128
- C:\Windows\System\bmfKNHB.exe
  C:\Windows\System\bmfKNHB.exe
  2⤵
  PID:5916
- C:\Windows\System\eecrDIq.exe
  C:\Windows\System\eecrDIq.exe
  2⤵
  PID:6168
- C:\Windows\System\XMeSQFM.exe
  C:\Windows\System\XMeSQFM.exe
  2⤵
  PID:5180
- C:\Windows\System\dJBRFYz.exe
  C:\Windows\System\dJBRFYz.exe
  2⤵
  PID:6364
- C:\Windows\System\zyeGPty.exe
  C:\Windows\System\zyeGPty.exe
  2⤵
  PID:6252
- C:\Windows\System\evllCPm.exe
  C:\Windows\System\evllCPm.exe
  2⤵
  PID:6528
- C:\Windows\System\JZnWsrz.exe
  C:\Windows\System\JZnWsrz.exe
  2⤵
  PID:6284
- C:\Windows\System\xmAsHqx.exe
  C:\Windows\System\xmAsHqx.exe
  2⤵
  PID:6480
- C:\Windows\System\rumESfK.exe
  C:\Windows\System\rumESfK.exe
  2⤵
  PID:6660
- C:\Windows\System\tDYlWvy.exe
  C:\Windows\System\tDYlWvy.exe
  2⤵
  PID:6688
- C:\Windows\System\yZeesjz.exe
  C:\Windows\System\yZeesjz.exe
  2⤵
  PID:6824
- C:\Windows\System\tDRTgxL.exe
  C:\Windows\System\tDRTgxL.exe
  2⤵
  PID:6884
- C:\Windows\System\XEFfTjE.exe
  C:\Windows\System\XEFfTjE.exe
  2⤵
  PID:6720
- C:\Windows\System\VuojUqv.exe
  C:\Windows\System\VuojUqv.exe
  2⤵
  PID:6788
- C:\Windows\System\BZBTKPu.exe
  C:\Windows\System\BZBTKPu.exe
  2⤵
  PID:7108
- C:\Windows\System\rkWKyus.exe
  C:\Windows\System\rkWKyus.exe
  2⤵
  PID:6184
- C:\Windows\System\oTKWPsG.exe
  C:\Windows\System\oTKWPsG.exe
  2⤵
  PID:7140
- C:\Windows\System\AJhiEVK.exe
  C:\Windows\System\AJhiEVK.exe
  2⤵
  PID:6236
- C:\Windows\System\BnemSnt.exe
  C:\Windows\System\BnemSnt.exe
  2⤵
  PID:6180
- C:\Windows\System\AEkjsqd.exe
  C:\Windows\System\AEkjsqd.exe
  2⤵
  PID:6816
- C:\Windows\System\byawdEb.exe
  C:\Windows\System\byawdEb.exe
  2⤵
  PID:6996
- C:\Windows\System\bUTHPcL.exe
  C:\Windows\System\bUTHPcL.exe
  2⤵
  PID:6300
- C:\Windows\System\DndWLyt.exe
  C:\Windows\System\DndWLyt.exe
  2⤵
  PID:6152
- C:\Windows\System\QBjJdig.exe
  C:\Windows\System\QBjJdig.exe
  2⤵
  PID:6560
- C:\Windows\System\CEjxUqS.exe
  C:\Windows\System\CEjxUqS.exe
  2⤵
  PID:6964
- C:\Windows\System\fWDUXop.exe
  C:\Windows\System\fWDUXop.exe
  2⤵
  PID:6612
- C:\Windows\System\sJqyVSV.exe
  C:\Windows\System\sJqyVSV.exe
  2⤵
  PID:6920
- C:\Windows\System\gokLbxW.exe
  C:\Windows\System\gokLbxW.exe
  2⤵
  PID:6872
- C:\Windows\System\oWzlhDq.exe
  C:\Windows\System\oWzlhDq.exe
  2⤵
  PID:7028
- C:\Windows\System\oCTdGtn.exe
  C:\Windows\System\oCTdGtn.exe
  2⤵
  PID:7032
- C:\Windows\System\HZjdrGx.exe
  C:\Windows\System\HZjdrGx.exe
  2⤵
  PID:6304
- C:\Windows\System\TOddCcU.exe
  C:\Windows\System\TOddCcU.exe
  2⤵
  PID:6548
- C:\Windows\System\yzYKAEk.exe
  C:\Windows\System\yzYKAEk.exe
  2⤵
  PID:6752
- C:\Windows\System\rSaFQHT.exe
  C:\Windows\System\rSaFQHT.exe
  2⤵
  PID:7180
- C:\Windows\System\GiGxRim.exe
  C:\Windows\System\GiGxRim.exe
  2⤵
  PID:7268
- C:\Windows\System\YRPasdf.exe
  C:\Windows\System\YRPasdf.exe
  2⤵
  PID:7284
- C:\Windows\System\maYSjfT.exe
  C:\Windows\System\maYSjfT.exe
  2⤵
  PID:7300
- C:\Windows\System\pTwsQyz.exe
  C:\Windows\System\pTwsQyz.exe
  2⤵
  PID:7316
- C:\Windows\System\SXwjyyS.exe
  C:\Windows\System\SXwjyyS.exe
  2⤵
  PID:7336
- C:\Windows\System\IyuaeOB.exe
  C:\Windows\System\IyuaeOB.exe
  2⤵
  PID:7352
- C:\Windows\System\iBITxJD.exe
  C:\Windows\System\iBITxJD.exe
  2⤵
  PID:7368
- C:\Windows\System\xJBAfoY.exe
  C:\Windows\System\xJBAfoY.exe
  2⤵
  PID:7384
- C:\Windows\System\RBwmsKR.exe
  C:\Windows\System\RBwmsKR.exe
  2⤵
  PID:7400
- C:\Windows\System\AhumAON.exe
  C:\Windows\System\AhumAON.exe
  2⤵
  PID:7416
- C:\Windows\System\KvsjsJh.exe
  C:\Windows\System\KvsjsJh.exe
  2⤵
  PID:7432
- C:\Windows\System\TrUCtLJ.exe
  C:\Windows\System\TrUCtLJ.exe
  2⤵
  PID:7448
- C:\Windows\System\KkmoaoW.exe
  C:\Windows\System\KkmoaoW.exe
  2⤵
  PID:7464
- C:\Windows\System\byvwmfJ.exe
  C:\Windows\System\byvwmfJ.exe
  2⤵
  PID:7480
- C:\Windows\System\cScAvFU.exe
  C:\Windows\System\cScAvFU.exe
  2⤵
  PID:7496
- C:\Windows\System\wGATDTw.exe
  C:\Windows\System\wGATDTw.exe
  2⤵
  PID:7512
- C:\Windows\System\IiRGDwm.exe
  C:\Windows\System\IiRGDwm.exe
  2⤵
  PID:7528
- C:\Windows\System\MjhGbCd.exe
  C:\Windows\System\MjhGbCd.exe
  2⤵
  PID:7544
- C:\Windows\System\LGqjHRR.exe
  C:\Windows\System\LGqjHRR.exe
  2⤵
  PID:7560
- C:\Windows\System\CcrlOrj.exe
  C:\Windows\System\CcrlOrj.exe
  2⤵
  PID:7576
- C:\Windows\System\hsgNDOK.exe
  C:\Windows\System\hsgNDOK.exe
  2⤵
  PID:7596
- C:\Windows\System\TZNQUNC.exe
  C:\Windows\System\TZNQUNC.exe
  2⤵
  PID:7612
- C:\Windows\System\jDbKpfw.exe
  C:\Windows\System\jDbKpfw.exe
  2⤵
  PID:7628
- C:\Windows\System\TXmZYXX.exe
  C:\Windows\System\TXmZYXX.exe
  2⤵
  PID:7644
- C:\Windows\System\bZYeqXl.exe
  C:\Windows\System\bZYeqXl.exe
  2⤵
  PID:7660
- C:\Windows\System\PjAfxfV.exe
  C:\Windows\System\PjAfxfV.exe
  2⤵
  PID:7676
- C:\Windows\System\LSAGvRE.exe
  C:\Windows\System\LSAGvRE.exe
  2⤵
  PID:7692
- C:\Windows\System\iyiYMkX.exe
  C:\Windows\System\iyiYMkX.exe
  2⤵
  PID:7708
- C:\Windows\System\HsvYbSZ.exe
  C:\Windows\System\HsvYbSZ.exe
  2⤵
  PID:7724
- C:\Windows\System\yIpKxdF.exe
  C:\Windows\System\yIpKxdF.exe
  2⤵
  PID:7740
- C:\Windows\System\mCuxoQQ.exe
  C:\Windows\System\mCuxoQQ.exe
  2⤵
  PID:7756
- C:\Windows\System\weMYBDX.exe
  C:\Windows\System\weMYBDX.exe
  2⤵
  PID:7772
- C:\Windows\System\GmGbPEq.exe
  C:\Windows\System\GmGbPEq.exe
  2⤵
  PID:7788
- C:\Windows\System\pdyYVBM.exe
  C:\Windows\System\pdyYVBM.exe
  2⤵
  PID:7804
- C:\Windows\System\nuOMpTB.exe
  C:\Windows\System\nuOMpTB.exe
  2⤵
  PID:7820
- C:\Windows\System\NLQSbsN.exe
  C:\Windows\System\NLQSbsN.exe
  2⤵
  PID:7836
- C:\Windows\System\fcIhFql.exe
  C:\Windows\System\fcIhFql.exe
  2⤵
  PID:7852
- C:\Windows\System\QoMIntm.exe
  C:\Windows\System\QoMIntm.exe
  2⤵
  PID:7868
- C:\Windows\System\EUFosRA.exe
  C:\Windows\System\EUFosRA.exe
  2⤵
  PID:7884
- C:\Windows\System\AoJEMdJ.exe
  C:\Windows\System\AoJEMdJ.exe
  2⤵
  PID:7900
- C:\Windows\System\BUsHbGt.exe
  C:\Windows\System\BUsHbGt.exe
  2⤵
  PID:7916
- C:\Windows\System\pDyIndx.exe
  C:\Windows\System\pDyIndx.exe
  2⤵
  PID:7932
- C:\Windows\System\BwmVvcS.exe
  C:\Windows\System\BwmVvcS.exe
  2⤵
  PID:7952
- C:\Windows\System\pVvAjzX.exe
  C:\Windows\System\pVvAjzX.exe
  2⤵
  PID:7968
- C:\Windows\System\sjhukjP.exe
  C:\Windows\System\sjhukjP.exe
  2⤵
  PID:7984
- C:\Windows\System\luugVwc.exe
  C:\Windows\System\luugVwc.exe
  2⤵
  PID:8004
- C:\Windows\System\nsdMDTh.exe
  C:\Windows\System\nsdMDTh.exe
  2⤵
  PID:8024
- C:\Windows\System\CfkopYV.exe
  C:\Windows\System\CfkopYV.exe
  2⤵
  PID:8040
- C:\Windows\System\CLTUciJ.exe
  C:\Windows\System\CLTUciJ.exe
  2⤵
  PID:8056
- C:\Windows\System\TJPJvqE.exe
  C:\Windows\System\TJPJvqE.exe
  2⤵
  PID:8072
- C:\Windows\System\rEFHsre.exe
  C:\Windows\System\rEFHsre.exe
  2⤵
  PID:8088
- C:\Windows\System\ZzBbVIK.exe
  C:\Windows\System\ZzBbVIK.exe
  2⤵
  PID:8108
- C:\Windows\System\qSCwVuB.exe
  C:\Windows\System\qSCwVuB.exe
  2⤵
  PID:8124
- C:\Windows\System\lxZUbBj.exe
  C:\Windows\System\lxZUbBj.exe
  2⤵
  PID:8140
- C:\Windows\System\SgkLZtD.exe
  C:\Windows\System\SgkLZtD.exe
  2⤵
  PID:8156
- C:\Windows\System\sUlBLlK.exe
  C:\Windows\System\sUlBLlK.exe
  2⤵
  PID:8172
- C:\Windows\System\OEVJwHh.exe
  C:\Windows\System\OEVJwHh.exe
  2⤵
  PID:8188
- C:\Windows\System\HGIMrlA.exe
  C:\Windows\System\HGIMrlA.exe
  2⤵
  PID:7176
- C:\Windows\System\RTjDpXf.exe
  C:\Windows\System\RTjDpXf.exe
  2⤵
  PID:7192
- C:\Windows\System\bpHMsnK.exe
  C:\Windows\System\bpHMsnK.exe
  2⤵
  PID:7208
- C:\Windows\System\HIhTTSQ.exe
  C:\Windows\System\HIhTTSQ.exe
  2⤵
  PID:7224
- C:\Windows\System\QPoxEkj.exe
  C:\Windows\System\QPoxEkj.exe
  2⤵
  PID:7248
- C:\Windows\System\HdgRmgR.exe
  C:\Windows\System\HdgRmgR.exe
  2⤵
  PID:7276
- C:\Windows\System\SMCgHUL.exe
  C:\Windows\System\SMCgHUL.exe
  2⤵
  PID:7344
- C:\Windows\System\jriBDVa.exe
  C:\Windows\System\jriBDVa.exe
  2⤵
  PID:7408
- C:\Windows\System\bUqpESW.exe
  C:\Windows\System\bUqpESW.exe
  2⤵
  PID:7444
- C:\Windows\System\ltpndpA.exe
  C:\Windows\System\ltpndpA.exe
  2⤵
  PID:7260
- C:\Windows\System\twwMkKE.exe
  C:\Windows\System\twwMkKE.exe
  2⤵
  PID:7488
- C:\Windows\System\gwjQNvp.exe
  C:\Windows\System\gwjQNvp.exe
  2⤵
  PID:7456
- C:\Windows\System\prTYNgs.exe
  C:\Windows\System\prTYNgs.exe
  2⤵
  PID:7428
- C:\Windows\System\ujVkwYI.exe
  C:\Windows\System\ujVkwYI.exe
  2⤵
  PID:7568
- C:\Windows\System\KoHPpfd.exe
  C:\Windows\System\KoHPpfd.exe
  2⤵
  PID:7608
- C:\Windows\System\ENwgUyi.exe
  C:\Windows\System\ENwgUyi.exe
  2⤵
  PID:7672
- C:\Windows\System\UPCdeQA.exe
  C:\Windows\System\UPCdeQA.exe
  2⤵
  PID:7736
- C:\Windows\System\RIQPmcH.exe
  C:\Windows\System\RIQPmcH.exe
  2⤵
  PID:7720
- C:\Windows\System\KwIgBlh.exe
  C:\Windows\System\KwIgBlh.exe
  2⤵
  PID:7656
- C:\Windows\System\zicPPFV.exe
  C:\Windows\System\zicPPFV.exe
  2⤵
  PID:7688
- C:\Windows\System\sYaTqmJ.exe
  C:\Windows\System\sYaTqmJ.exe
  2⤵
  PID:7752
- C:\Windows\System\RZXBOgd.exe
  C:\Windows\System\RZXBOgd.exe
  2⤵
  PID:7860
- C:\Windows\System\zeOvSdU.exe
  C:\Windows\System\zeOvSdU.exe
  2⤵
  PID:7784
- C:\Windows\System\vpOjLny.exe
  C:\Windows\System\vpOjLny.exe
  2⤵
  PID:7896
- C:\Windows\System\dstkCqW.exe
  C:\Windows\System\dstkCqW.exe
  2⤵
  PID:7016
- C:\Windows\System\TQfaOcS.exe
  C:\Windows\System\TQfaOcS.exe
  2⤵
  PID:7964
- C:\Windows\System\vCyQWac.exe
  C:\Windows\System\vCyQWac.exe
  2⤵
  PID:6500
- C:\Windows\System\hpVZLKK.exe
  C:\Windows\System\hpVZLKK.exe
  2⤵
  PID:8032
- C:\Windows\System\uAbOaQG.exe
  C:\Windows\System\uAbOaQG.exe
  2⤵
  PID:8096
- C:\Windows\System\qgSlswP.exe
  C:\Windows\System\qgSlswP.exe
  2⤵
  PID:8168
- C:\Windows\System\WAdzgGW.exe
  C:\Windows\System\WAdzgGW.exe
  2⤵
  PID:8080
- C:\Windows\System\FHKaKBF.exe
  C:\Windows\System\FHKaKBF.exe
  2⤵
  PID:8120
- C:\Windows\System\bbnSaxn.exe
  C:\Windows\System\bbnSaxn.exe
  2⤵
  PID:6672
- C:\Windows\System\pprGlwt.exe
  C:\Windows\System\pprGlwt.exe
  2⤵
  PID:7232
- C:\Windows\System\BGhMCTq.exe
  C:\Windows\System\BGhMCTq.exe
  2⤵
  PID:8152
- C:\Windows\System\zCOajSK.exe
  C:\Windows\System\zCOajSK.exe
  2⤵
  PID:8184
- C:\Windows\System\idmuoaX.exe
  C:\Windows\System\idmuoaX.exe
  2⤵
  PID:7220
- C:\Windows\System\heqnWYT.exe
  C:\Windows\System\heqnWYT.exe
  2⤵
  PID:7380
- C:\Windows\System\YtghKDU.exe
  C:\Windows\System\YtghKDU.exe
  2⤵
  PID:7392
- C:\Windows\System\lBqSEOe.exe
  C:\Windows\System\lBqSEOe.exe
  2⤵
  PID:7328
- C:\Windows\System\XMKYQmx.exe
  C:\Windows\System\XMKYQmx.exe
  2⤵
  PID:7604
- C:\Windows\System\lgNBnhk.exe
  C:\Windows\System\lgNBnhk.exe
  2⤵
  PID:7524
- C:\Windows\System\jbMKaYr.exe
  C:\Windows\System\jbMKaYr.exe
  2⤵
  PID:7256
- C:\Windows\System\uPXolhp.exe
  C:\Windows\System\uPXolhp.exe
  2⤵
  PID:7748
- C:\Windows\System\LPdpZDq.exe
  C:\Windows\System\LPdpZDq.exe
  2⤵
  PID:7640
- C:\Windows\System\ZaxGYCQ.exe
  C:\Windows\System\ZaxGYCQ.exe
  2⤵
  PID:7716
- C:\Windows\System\YbXuJYA.exe
  C:\Windows\System\YbXuJYA.exe
  2⤵
  PID:7912
- C:\Windows\System\AAlGkoN.exe
  C:\Windows\System\AAlGkoN.exe
  2⤵
  PID:7908
- C:\Windows\System\GTRgveE.exe
  C:\Windows\System\GTRgveE.exe
  2⤵
  PID:8020
- C:\Windows\System\RCermRM.exe
  C:\Windows\System\RCermRM.exe
  2⤵
  PID:8000
- C:\Windows\System\MqpvXOC.exe
  C:\Windows\System\MqpvXOC.exe
  2⤵
  PID:8104
- C:\Windows\System\nAIytlI.exe
  C:\Windows\System\nAIytlI.exe
  2⤵
  PID:7588
- C:\Windows\System\CRDEqlf.exe
  C:\Windows\System\CRDEqlf.exe
  2⤵
  PID:7440
- C:\Windows\System\KJnMBKH.exe
  C:\Windows\System\KJnMBKH.exe
  2⤵
  PID:7620
- C:\Windows\System\lBCRulK.exe
  C:\Windows\System\lBCRulK.exe
  2⤵
  PID:8132
- C:\Windows\System\vFEgPxr.exe
  C:\Windows\System\vFEgPxr.exe
  2⤵
  PID:7476
- C:\Windows\System\XJhzFjf.exe
  C:\Windows\System\XJhzFjf.exe
  2⤵
  PID:8148
- C:\Windows\System\OeLtrWV.exe
  C:\Windows\System\OeLtrWV.exe
  2⤵
  PID:6608
- C:\Windows\System\bUcagqw.exe
  C:\Windows\System\bUcagqw.exe
  2⤵
  PID:7732
- C:\Windows\System\jZFVPAN.exe
  C:\Windows\System\jZFVPAN.exe
  2⤵
  PID:7204
- C:\Windows\System\eizaUgQ.exe
  C:\Windows\System\eizaUgQ.exe
  2⤵
  PID:7880
- C:\Windows\System\ROlPtDC.exe
  C:\Windows\System\ROlPtDC.exe
  2⤵
  PID:7624
- C:\Windows\System\CsmHDUn.exe
  C:\Windows\System\CsmHDUn.exe
  2⤵
  PID:7796
- C:\Windows\System\gLFhgKQ.exe
  C:\Windows\System\gLFhgKQ.exe
  2⤵
  PID:8220
- C:\Windows\System\oDKZSPS.exe
  C:\Windows\System\oDKZSPS.exe
  2⤵
  PID:8236
- C:\Windows\System\IXJFghF.exe
  C:\Windows\System\IXJFghF.exe
  2⤵
  PID:8252
- C:\Windows\System\BJwkrYb.exe
  C:\Windows\System\BJwkrYb.exe
  2⤵
  PID:8268
- C:\Windows\System\VyeJbTM.exe
  C:\Windows\System\VyeJbTM.exe
  2⤵
  PID:8284
- C:\Windows\System\wpTaEDI.exe
  C:\Windows\System\wpTaEDI.exe
  2⤵
  PID:8300
- C:\Windows\System\LpINXcJ.exe
  C:\Windows\System\LpINXcJ.exe
  2⤵
  PID:8316
- C:\Windows\System\nJdsyPd.exe
  C:\Windows\System\nJdsyPd.exe
  2⤵
  PID:8332
- C:\Windows\System\wFnbbSj.exe
  C:\Windows\System\wFnbbSj.exe
  2⤵
  PID:8348
- C:\Windows\System\rHzITgZ.exe
  C:\Windows\System\rHzITgZ.exe
  2⤵
  PID:8364
- C:\Windows\System\andNXMG.exe
  C:\Windows\System\andNXMG.exe
  2⤵
  PID:8380
- C:\Windows\System\SYobdOD.exe
  C:\Windows\System\SYobdOD.exe
  2⤵
  PID:8400
- C:\Windows\System\scSuHFg.exe
  C:\Windows\System\scSuHFg.exe
  2⤵
  PID:8416
- C:\Windows\System\GIYVyRB.exe
  C:\Windows\System\GIYVyRB.exe
  2⤵
  PID:8440
- C:\Windows\System\rmfDZeQ.exe
  C:\Windows\System\rmfDZeQ.exe
  2⤵
  PID:8456
- C:\Windows\System\NsHymTe.exe
  C:\Windows\System\NsHymTe.exe
  2⤵
  PID:8472
- C:\Windows\System\iaEoaOh.exe
  C:\Windows\System\iaEoaOh.exe
  2⤵
  PID:8488
- C:\Windows\System\uMlrjTD.exe
  C:\Windows\System\uMlrjTD.exe
  2⤵
  PID:8504
- C:\Windows\System\pDvUsza.exe
  C:\Windows\System\pDvUsza.exe
  2⤵
  PID:8520
- C:\Windows\System\ixVoFuv.exe
  C:\Windows\System\ixVoFuv.exe
  2⤵
  PID:8536
- C:\Windows\System\FaFuMfx.exe
  C:\Windows\System\FaFuMfx.exe
  2⤵
  PID:8552
- C:\Windows\System\isatoNP.exe
  C:\Windows\System\isatoNP.exe
  2⤵
  PID:8568
- C:\Windows\System\JIaAryQ.exe
  C:\Windows\System\JIaAryQ.exe
  2⤵
  PID:8584
- C:\Windows\System\TIgChQB.exe
  C:\Windows\System\TIgChQB.exe
  2⤵
  PID:8600
- C:\Windows\System\ONgeWlO.exe
  C:\Windows\System\ONgeWlO.exe
  2⤵
  PID:8752
- C:\Windows\System\wHYrcIT.exe
  C:\Windows\System\wHYrcIT.exe
  2⤵
  PID:8768
- C:\Windows\System\AReEgVX.exe
  C:\Windows\System\AReEgVX.exe
  2⤵
  PID:8784
- C:\Windows\System\zFldwwm.exe
  C:\Windows\System\zFldwwm.exe
  2⤵
  PID:8800
- C:\Windows\System\XVcAvqH.exe
  C:\Windows\System\XVcAvqH.exe
  2⤵
  PID:8816
- C:\Windows\System\xHpnFSN.exe
  C:\Windows\System\xHpnFSN.exe
  2⤵
  PID:8832
- C:\Windows\System\yqWxQAS.exe
  C:\Windows\System\yqWxQAS.exe
  2⤵
  PID:8848
- C:\Windows\System\bEzpYNZ.exe
  C:\Windows\System\bEzpYNZ.exe
  2⤵
  PID:8900
- C:\Windows\System\KYoonnj.exe
  C:\Windows\System\KYoonnj.exe
  2⤵
  PID:8928
- C:\Windows\System\hpdlkpN.exe
  C:\Windows\System\hpdlkpN.exe
  2⤵
  PID:8948
- C:\Windows\System\tGEXqUn.exe
  C:\Windows\System\tGEXqUn.exe
  2⤵
  PID:8964
- C:\Windows\System\LKEtHOG.exe
  C:\Windows\System\LKEtHOG.exe
  2⤵
  PID:8988
- C:\Windows\System\EgUITYQ.exe
  C:\Windows\System\EgUITYQ.exe
  2⤵
  PID:9008
- C:\Windows\System\fAzRhCQ.exe
  C:\Windows\System\fAzRhCQ.exe
  2⤵
  PID:9024
- C:\Windows\System\rZenVvo.exe
  C:\Windows\System\rZenVvo.exe
  2⤵
  PID:9040
- C:\Windows\System\aoqHncy.exe
  C:\Windows\System\aoqHncy.exe
  2⤵
  PID:9060
- C:\Windows\System\YuPwmTd.exe
  C:\Windows\System\YuPwmTd.exe
  2⤵
  PID:9080
- C:\Windows\System\uulnjVv.exe
  C:\Windows\System\uulnjVv.exe
  2⤵
  PID:9100
- C:\Windows\System\RKBjZFY.exe
  C:\Windows\System\RKBjZFY.exe
  2⤵
  PID:9176
- C:\Windows\System\JlsQebU.exe
  C:\Windows\System\JlsQebU.exe
  2⤵
  PID:9200
- C:\Windows\System\rNIIhGk.exe
  C:\Windows\System\rNIIhGk.exe
  2⤵
  PID:7996
- C:\Windows\System\GHeoAUd.exe
  C:\Windows\System\GHeoAUd.exe
  2⤵
  PID:8264
- C:\Windows\System\RRVbChz.exe
  C:\Windows\System\RRVbChz.exe
  2⤵
  PID:8512
- C:\Windows\System\laFhWhv.exe
  C:\Windows\System\laFhWhv.exe
  2⤵
  PID:8340
- C:\Windows\System\SiInaRb.exe
  C:\Windows\System\SiInaRb.exe
  2⤵
  PID:7536
- C:\Windows\System\dJzRiAA.exe
  C:\Windows\System\dJzRiAA.exe
  2⤵
  PID:7424
- C:\Windows\System\qUcpaDj.exe
  C:\Windows\System\qUcpaDj.exe
  2⤵
  PID:8204
- C:\Windows\System\LcRAspv.exe
  C:\Windows\System\LcRAspv.exe
  2⤵
  PID:8276
- C:\Windows\System\BYSphsy.exe
  C:\Windows\System\BYSphsy.exe
  2⤵
  PID:8448
- C:\Windows\System\nNpigpE.exe
  C:\Windows\System\nNpigpE.exe
  2⤵
  PID:8544
- C:\Windows\System\EbnyoAs.exe
  C:\Windows\System\EbnyoAs.exe
  2⤵
  PID:8592
- C:\Windows\System\PNPDzOa.exe
  C:\Windows\System\PNPDzOa.exe
  2⤵
  PID:8796
- C:\Windows\System\oAKucvI.exe
  C:\Windows\System\oAKucvI.exe
  2⤵
  PID:9148
- C:\Windows\System\okVKzRP.exe
  C:\Windows\System\okVKzRP.exe
  2⤵
  PID:8432
- C:\Windows\System\SSsEejp.exe
  C:\Windows\System\SSsEejp.exe
  2⤵
  PID:2452
- C:\Windows\System\FCMGEMg.exe
  C:\Windows\System\FCMGEMg.exe
  2⤵
  PID:2460
- C:\Windows\System\ByMDFgu.exe
  C:\Windows\System\ByMDFgu.exe
  2⤵
  PID:2056
- C:\Windows\System\yYFupmp.exe
  C:\Windows\System\yYFupmp.exe
  2⤵
  PID:8612
- C:\Windows\System\wBbdihf.exe
  C:\Windows\System\wBbdihf.exe
  2⤵
  PID:8828
- C:\Windows\System\ijpdLsE.exe
  C:\Windows\System\ijpdLsE.exe
  2⤵
  PID:8684
- C:\Windows\System\pAKcKVF.exe
  C:\Windows\System\pAKcKVF.exe
  2⤵
  PID:8716
- C:\Windows\System\yHHhKBl.exe
  C:\Windows\System\yHHhKBl.exe
  2⤵
  PID:8576
- C:\Windows\System\ImuTLzo.exe
  C:\Windows\System\ImuTLzo.exe
  2⤵
  PID:8620
- C:\Windows\System\LSZLUdz.exe
  C:\Windows\System\LSZLUdz.exe
  2⤵
  PID:8644
- C:\Windows\System\pvJHLtw.exe
  C:\Windows\System\pvJHLtw.exe
  2⤵
  PID:8672
- C:\Windows\System\NUzSepc.exe
  C:\Windows\System\NUzSepc.exe
  2⤵
  PID:8844
- C:\Windows\System\juAEFiX.exe
  C:\Windows\System\juAEFiX.exe
  2⤵
  PID:8808
- C:\Windows\System\BBuXkbv.exe
  C:\Windows\System\BBuXkbv.exe
  2⤵
  PID:8972
- C:\Windows\System\sUYwgHE.exe
  C:\Windows\System\sUYwgHE.exe
  2⤵
  PID:8912
- C:\Windows\System\JhXoBPd.exe
  C:\Windows\System\JhXoBPd.exe
  2⤵
  PID:9048
- C:\Windows\System\otvnEEs.exe
  C:\Windows\System\otvnEEs.exe
  2⤵
  PID:8908
- C:\Windows\System\VERQMox.exe
  C:\Windows\System\VERQMox.exe
  2⤵
  PID:8996
- C:\Windows\System\qEjXghB.exe
  C:\Windows\System\qEjXghB.exe
  2⤵
  PID:7928
- C:\Windows\System\CrJzEqt.exe
  C:\Windows\System\CrJzEqt.exe
  2⤵
  PID:8328
- C:\Windows\System\TaRxHgC.exe
  C:\Windows\System\TaRxHgC.exe
  2⤵
  PID:8388
- C:\Windows\System\hWyRXgc.exe
  C:\Windows\System\hWyRXgc.exe
  2⤵
  PID:7244
- C:\Windows\System\NItDppr.exe
  C:\Windows\System\NItDppr.exe
  2⤵
  PID:8528
- C:\Windows\System\ifXyIQn.exe
  C:\Windows\System\ifXyIQn.exe
  2⤵
  PID:7520
- C:\Windows\System\LKsYZwN.exe
  C:\Windows\System\LKsYZwN.exe
  2⤵
  PID:8376
- C:\Windows\System\VgvuEqw.exe
  C:\Windows\System\VgvuEqw.exe
  2⤵
  PID:2088
- C:\Windows\System\CKwqkyB.exe
  C:\Windows\System\CKwqkyB.exe
  2⤵
  PID:4028
- C:\Windows\System\DUKorHH.exe
  C:\Windows\System\DUKorHH.exe
  2⤵
  PID:9088
- C:\Windows\System\ptmqpES.exe
  C:\Windows\System\ptmqpES.exe
  2⤵
  PID:8704
- C:\Windows\System\ZyXefwK.exe
  C:\Windows\System\ZyXefwK.exe
  2⤵
  PID:5224
- C:\Windows\System\sSXjlbg.exe
  C:\Windows\System\sSXjlbg.exe
  2⤵
  PID:8692
- C:\Windows\System\kKCZmCd.exe
  C:\Windows\System\kKCZmCd.exe
  2⤵
  PID:8920
- C:\Windows\System\bZIfXee.exe
  C:\Windows\System\bZIfXee.exe
  2⤵
  PID:8960
- C:\Windows\System\bSVMgWI.exe
  C:\Windows\System\bSVMgWI.exe
  2⤵
  PID:8668
- C:\Windows\System\eohEXMw.exe
  C:\Windows\System\eohEXMw.exe
  2⤵
  PID:7240
- C:\Windows\System\vMEyNnX.exe
  C:\Windows\System\vMEyNnX.exe
  2⤵
  PID:8532
- C:\Windows\System\FaGwaDX.exe
  C:\Windows\System\FaGwaDX.exe
  2⤵
  PID:9000
- C:\Windows\System\SzzDsax.exe
  C:\Windows\System\SzzDsax.exe
  2⤵
  PID:8812
- C:\Windows\System\IlXkdnY.exe
  C:\Windows\System\IlXkdnY.exe
  2⤵
  PID:8744
- C:\Windows\System\wDlbQSM.exe
  C:\Windows\System\wDlbQSM.exe
  2⤵
  PID:7844
- C:\Windows\System\GDJDjqW.exe
  C:\Windows\System\GDJDjqW.exe
  2⤵
  PID:9116
- C:\Windows\System\tsQFMgO.exe
  C:\Windows\System\tsQFMgO.exe
  2⤵
  PID:8436
- C:\Windows\System\KQdmiCX.exe
  C:\Windows\System\KQdmiCX.exe
  2⤵
  PID:9212
- C:\Windows\System\CICCEqv.exe
  C:\Windows\System\CICCEqv.exe
  2⤵
  PID:8468
- C:\Windows\System\RwbVatf.exe
  C:\Windows\System\RwbVatf.exe
  2⤵
  PID:9188
- C:\Windows\System\lhydLTs.exe
  C:\Windows\System\lhydLTs.exe
  2⤵
  PID:8876
- C:\Windows\System\aDNLPnX.exe
  C:\Windows\System\aDNLPnX.exe
  2⤵
  PID:8212
- C:\Windows\System\OHCXecl.exe
  C:\Windows\System\OHCXecl.exe
  2⤵
  PID:9020
- C:\Windows\System\GXtJCRZ.exe
  C:\Windows\System\GXtJCRZ.exe
  2⤵
  PID:2060
- C:\Windows\System\DoKjEdf.exe
  C:\Windows\System\DoKjEdf.exe
  2⤵
  PID:8564
- C:\Windows\System\qlxEMEx.exe
  C:\Windows\System\qlxEMEx.exe
  2⤵
  PID:8464
- C:\Windows\System\wYASSgm.exe
  C:\Windows\System\wYASSgm.exe
  2⤵
  PID:9128
- C:\Windows\System\peVtxEx.exe
  C:\Windows\System\peVtxEx.exe
  2⤵
  PID:8776
- C:\Windows\System\lMhwHHf.exe
  C:\Windows\System\lMhwHHf.exe
  2⤵
  PID:8896
- C:\Windows\System\MQTLiJN.exe
  C:\Windows\System\MQTLiJN.exe
  2⤵
  PID:9108
- C:\Windows\System\enQSVbo.exe
  C:\Windows\System\enQSVbo.exe
  2⤵
  PID:9156
- C:\Windows\System\UUcItbr.exe
  C:\Windows\System\UUcItbr.exe
  2⤵
  PID:9132
- C:\Windows\System\ebhjgWQ.exe
  C:\Windows\System\ebhjgWQ.exe
  2⤵
  PID:8200
- C:\Windows\System\IYqAtXJ.exe
  C:\Windows\System\IYqAtXJ.exe
  2⤵
  PID:8944
- C:\Windows\System\YybjgJY.exe
  C:\Windows\System\YybjgJY.exe
  2⤵
  PID:8956
- C:\Windows\System\xzDHupn.exe
  C:\Windows\System\xzDHupn.exe
  2⤵
  PID:9096
- C:\Windows\System\lwWhHpE.exe
  C:\Windows\System\lwWhHpE.exe
  2⤵
  PID:8708
- C:\Windows\System\UMhOCAT.exe
  C:\Windows\System\UMhOCAT.exe
  2⤵
  PID:9228
- C:\Windows\System\HCQlAcX.exe
  C:\Windows\System\HCQlAcX.exe
  2⤵
  PID:9244
- C:\Windows\System\zOXPwRa.exe
  C:\Windows\System\zOXPwRa.exe
  2⤵
  PID:9260
- C:\Windows\System\TlkcSpr.exe
  C:\Windows\System\TlkcSpr.exe
  2⤵
  PID:9276
- C:\Windows\System\dflILcA.exe
  C:\Windows\System\dflILcA.exe
  2⤵
  PID:9296
- C:\Windows\System\OQkQprT.exe
  C:\Windows\System\OQkQprT.exe
  2⤵
  PID:9312
- C:\Windows\System\TpqQQys.exe
  C:\Windows\System\TpqQQys.exe
  2⤵
  PID:9328
- C:\Windows\System\oWLXHNT.exe
  C:\Windows\System\oWLXHNT.exe
  2⤵
  PID:9344
- C:\Windows\System\yajhRoJ.exe
  C:\Windows\System\yajhRoJ.exe
  2⤵
  PID:9360
- C:\Windows\System\iqjussg.exe
  C:\Windows\System\iqjussg.exe
  2⤵
  PID:9376
- C:\Windows\System\SNBCWjC.exe
  C:\Windows\System\SNBCWjC.exe
  2⤵
  PID:9392
- C:\Windows\System\NdEwvMC.exe
  C:\Windows\System\NdEwvMC.exe
  2⤵
  PID:9408
- C:\Windows\System\bvjeiIl.exe
  C:\Windows\System\bvjeiIl.exe
  2⤵
  PID:9424
- C:\Windows\System\wsjwaSG.exe
  C:\Windows\System\wsjwaSG.exe
  2⤵
  PID:9440
- C:\Windows\System\bLldkAk.exe
  C:\Windows\System\bLldkAk.exe
  2⤵
  PID:9456
- C:\Windows\System\RsmHXkd.exe
  C:\Windows\System\RsmHXkd.exe
  2⤵
  PID:9472
- C:\Windows\System\VgSevLn.exe
  C:\Windows\System\VgSevLn.exe
  2⤵
  PID:9488
- C:\Windows\System\VSqwIAe.exe
  C:\Windows\System\VSqwIAe.exe
  2⤵
  PID:9504
- C:\Windows\System\YdIpudT.exe
  C:\Windows\System\YdIpudT.exe
  2⤵
  PID:9520
- C:\Windows\System\lZujdah.exe
  C:\Windows\System\lZujdah.exe
  2⤵
  PID:9540
- C:\Windows\System\uiyVaxl.exe
  C:\Windows\System\uiyVaxl.exe
  2⤵
  PID:9556
- C:\Windows\System\COgQweA.exe
  C:\Windows\System\COgQweA.exe
  2⤵
  PID:9576
- C:\Windows\System\nDAkfgb.exe
  C:\Windows\System\nDAkfgb.exe
  2⤵
  PID:9596
- C:\Windows\System\bDLArSi.exe
  C:\Windows\System\bDLArSi.exe
  2⤵
  PID:9612
- C:\Windows\System\SPWLWnw.exe
  C:\Windows\System\SPWLWnw.exe
  2⤵
  PID:9628
- C:\Windows\System\QHfRFST.exe
  C:\Windows\System\QHfRFST.exe
  2⤵
  PID:9644
- C:\Windows\System\OpYFezp.exe
  C:\Windows\System\OpYFezp.exe
  2⤵
  PID:9660
- C:\Windows\System\HHSbMGT.exe
  C:\Windows\System\HHSbMGT.exe
  2⤵
  PID:9676
- C:\Windows\System\bNNZUHy.exe
  C:\Windows\System\bNNZUHy.exe
  2⤵
  PID:9700
- C:\Windows\System\XKaaQLW.exe
  C:\Windows\System\XKaaQLW.exe
  2⤵
  PID:9720
- C:\Windows\System\lbuRxsr.exe
  C:\Windows\System\lbuRxsr.exe
  2⤵
  PID:9736
- C:\Windows\System\gHaqdxw.exe
  C:\Windows\System\gHaqdxw.exe
  2⤵
  PID:9752
- C:\Windows\System\iVieHTR.exe
  C:\Windows\System\iVieHTR.exe
  2⤵
  PID:9768
- C:\Windows\System\mkKAjtQ.exe
  C:\Windows\System\mkKAjtQ.exe
  2⤵
  PID:9784
- C:\Windows\System\DhdiJRJ.exe
  C:\Windows\System\DhdiJRJ.exe
  2⤵
  PID:9800
- C:\Windows\System\qLiCdms.exe
  C:\Windows\System\qLiCdms.exe
  2⤵
  PID:9816
- C:\Windows\System\vSywWXW.exe
  C:\Windows\System\vSywWXW.exe
  2⤵
  PID:9832
- C:\Windows\System\dSnLYcz.exe
  C:\Windows\System\dSnLYcz.exe
  2⤵
  PID:9848
- C:\Windows\System\USXtNFT.exe
  C:\Windows\System\USXtNFT.exe
  2⤵
  PID:9864
- C:\Windows\System\vdrpvLa.exe
  C:\Windows\System\vdrpvLa.exe
  2⤵
  PID:9880
- C:\Windows\System\MDmqSnv.exe
  C:\Windows\System\MDmqSnv.exe
  2⤵
  PID:9896
- C:\Windows\System\NAwGpMA.exe
  C:\Windows\System\NAwGpMA.exe
  2⤵
  PID:9916
- C:\Windows\System\tTXAkQN.exe
  C:\Windows\System\tTXAkQN.exe
  2⤵
  PID:9932
- C:\Windows\System\bjYTkpM.exe
  C:\Windows\System\bjYTkpM.exe
  2⤵
  PID:9948
- C:\Windows\System\zMwdpqm.exe
  C:\Windows\System\zMwdpqm.exe
  2⤵
  PID:9964
- C:\Windows\System\yJkFAMF.exe
  C:\Windows\System\yJkFAMF.exe
  2⤵
  PID:9980
- C:\Windows\System\OYAZoXK.exe
  C:\Windows\System\OYAZoXK.exe
  2⤵
  PID:9996
- C:\Windows\System\KqtbLmX.exe
  C:\Windows\System\KqtbLmX.exe
  2⤵
  PID:10012
- C:\Windows\System\siTtUij.exe
  C:\Windows\System\siTtUij.exe
  2⤵
  PID:10028
- C:\Windows\System\RImKMVI.exe
  C:\Windows\System\RImKMVI.exe
  2⤵
  PID:10044
- C:\Windows\System\dHrWfTm.exe
  C:\Windows\System\dHrWfTm.exe
  2⤵
  PID:10060
- C:\Windows\System\csrGTyI.exe
  C:\Windows\System\csrGTyI.exe
  2⤵
  PID:10076
- C:\Windows\System\KNYbUPS.exe
  C:\Windows\System\KNYbUPS.exe
  2⤵
  PID:10100
- C:\Windows\System\quHdIbe.exe
  C:\Windows\System\quHdIbe.exe
  2⤵
  PID:10116
- C:\Windows\System\dUHSCuB.exe
  C:\Windows\System\dUHSCuB.exe
  2⤵
  PID:10132
- C:\Windows\System\RsQLTSk.exe
  C:\Windows\System\RsQLTSk.exe
  2⤵
  PID:10148
- C:\Windows\System\uYKcolV.exe
  C:\Windows\System\uYKcolV.exe
  2⤵
  PID:10164
- C:\Windows\System\EDsrfvx.exe
  C:\Windows\System\EDsrfvx.exe
  2⤵
  PID:10180
- C:\Windows\System\UoUPPgQ.exe
  C:\Windows\System\UoUPPgQ.exe
  2⤵
  PID:10196
- C:\Windows\System\MwJNxzu.exe
  C:\Windows\System\MwJNxzu.exe
  2⤵
  PID:10216
- C:\Windows\System\JyNcVdJ.exe
  C:\Windows\System\JyNcVdJ.exe
  2⤵
  PID:10232
- C:\Windows\System\hIaxWzi.exe
  C:\Windows\System\hIaxWzi.exe
  2⤵
  PID:2096
- C:\Windows\System\bfHRgtF.exe
  C:\Windows\System\bfHRgtF.exe
  2⤵
  PID:8696
- C:\Windows\System\KfIWvxG.exe
  C:\Windows\System\KfIWvxG.exe
  2⤵
  PID:9324
- C:\Windows\System\kppoict.exe
  C:\Windows\System\kppoict.exe
  2⤵
  PID:9352
- C:\Windows\System\wXeDdYw.exe
  C:\Windows\System\wXeDdYw.exe
  2⤵
  PID:8216
- C:\Windows\System\mdtBiwr.exe
  C:\Windows\System\mdtBiwr.exe
  2⤵
  PID:8764
- C:\Windows\System\EVtBSBc.exe
  C:\Windows\System\EVtBSBc.exe
  2⤵
  PID:8548
- C:\Windows\System\fuYmgFi.exe
  C:\Windows\System\fuYmgFi.exe
  2⤵
  PID:1192
- C:\Windows\System\OMMoCrJ.exe
  C:\Windows\System\OMMoCrJ.exe
  2⤵
  PID:2380
- C:\Windows\System\eiSvURf.exe
  C:\Windows\System\eiSvURf.exe
  2⤵
  PID:9016
- C:\Windows\System\noXhqbq.exe
  C:\Windows\System\noXhqbq.exe
  2⤵
  PID:9068
- C:\Windows\System\yxZoaFY.exe
  C:\Windows\System\yxZoaFY.exe
  2⤵
  PID:8712
- C:\Windows\System\sVxjzFI.exe
  C:\Windows\System\sVxjzFI.exe
  2⤵
  PID:8228
- C:\Windows\System\iirdBAO.exe
  C:\Windows\System\iirdBAO.exe
  2⤵
  PID:8608
- C:\Windows\System\iYSvXDc.exe
  C:\Windows\System\iYSvXDc.exe
  2⤵
  PID:2620
- C:\Windows\System\uqAwNwf.exe
  C:\Windows\System\uqAwNwf.exe
  2⤵
  PID:9240
- C:\Windows\System\cehgvqX.exe
  C:\Windows\System\cehgvqX.exe
  2⤵
  PID:9340
- C:\Windows\System\CiLsFBs.exe
  C:\Windows\System\CiLsFBs.exe
  2⤵
  PID:9404
- C:\Windows\System\nDlXcuV.exe
  C:\Windows\System\nDlXcuV.exe
  2⤵
  PID:9468
- C:\Windows\System\AVNjvOV.exe
  C:\Windows\System\AVNjvOV.exe
  2⤵
  PID:9452
- C:\Windows\System\WGbDuNr.exe
  C:\Windows\System\WGbDuNr.exe
  2⤵
  PID:9516
- C:\Windows\System\ehPKeHa.exe
  C:\Windows\System\ehPKeHa.exe
  2⤵
  PID:9536
- C:\Windows\System\MsFEvXo.exe
  C:\Windows\System\MsFEvXo.exe
  2⤵
  PID:9604
- C:\Windows\System\nDwbrzr.exe
  C:\Windows\System\nDwbrzr.exe
  2⤵
  PID:9584
- C:\Windows\System\OHfiOwN.exe
  C:\Windows\System\OHfiOwN.exe
  2⤵
  PID:9552
- C:\Windows\System\mZMyNQz.exe
  C:\Windows\System\mZMyNQz.exe
  2⤵
  PID:9652
- C:\Windows\System\TsvPTyl.exe
  C:\Windows\System\TsvPTyl.exe
  2⤵
  PID:9688
- C:\Windows\System\MHkaMUv.exe
  C:\Windows\System\MHkaMUv.exe
  2⤵
  PID:9744
- C:\Windows\System\jNWMJME.exe
  C:\Windows\System\jNWMJME.exe
  2⤵
  PID:9732
- C:\Windows\System\fyrNymi.exe
  C:\Windows\System\fyrNymi.exe
  2⤵
  PID:9812
- C:\Windows\System\pUEeWsx.exe
  C:\Windows\System\pUEeWsx.exe
  2⤵
  PID:9872
- C:\Windows\System\rPOlgQU.exe
  C:\Windows\System\rPOlgQU.exe
  2⤵
  PID:9876
- C:\Windows\System\UoIZrzo.exe
  C:\Windows\System\UoIZrzo.exe
  2⤵
  PID:9940
- C:\Windows\System\giPvLIe.exe
  C:\Windows\System\giPvLIe.exe
  2⤵
  PID:9956
- C:\Windows\System\pfHSHDC.exe
  C:\Windows\System\pfHSHDC.exe
  2⤵
  PID:9928
- C:\Windows\System\gcqbZLk.exe
  C:\Windows\System\gcqbZLk.exe
  2⤵
  PID:10008
- C:\Windows\System\FAVHEOY.exe
  C:\Windows\System\FAVHEOY.exe
  2⤵
  PID:9992
- C:\Windows\System\VTcBuwk.exe
  C:\Windows\System\VTcBuwk.exe
  2⤵
  PID:10112
- C:\Windows\System\BmrOTuv.exe
  C:\Windows\System\BmrOTuv.exe
  2⤵
  PID:10128
- C:\Windows\System\tndYxTZ.exe
  C:\Windows\System\tndYxTZ.exe
  2⤵
  PID:10092
- C:\Windows\System\qlraQbm.exe
  C:\Windows\System\qlraQbm.exe
  2⤵
  PID:9224
- C:\Windows\System\isxceOR.exe
  C:\Windows\System\isxceOR.exe
  2⤵
  PID:10224
- C:\Windows\System\pGUjOmD.exe
  C:\Windows\System\pGUjOmD.exe
  2⤵
  PID:9384
- C:\Windows\System\djiyoep.exe
  C:\Windows\System\djiyoep.exe
  2⤵
  PID:9320
- C:\Windows\System\nMJGFXk.exe
  C:\Windows\System\nMJGFXk.exe
  2⤵
  PID:7048
- C:\Windows\System\JSsRsQZ.exe
  C:\Windows\System\JSsRsQZ.exe
  2⤵
  PID:9272
- C:\Windows\System\UHhMJCh.exe
  C:\Windows\System\UHhMJCh.exe
  2⤵
  PID:8656
- C:\Windows\System\grmggre.exe
  C:\Windows\System\grmggre.exe
  2⤵
  PID:8396
- C:\Windows\System\xTQaaep.exe
  C:\Windows\System\xTQaaep.exe
  2⤵
  PID:9684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BSBJuKM.exe

Filesize
1.7MB

MD5
0c09dfb2611941945b0cd3eeab0761d9

SHA1
0cbc6e0ce390233a6234637338eeefcb6aec5cfe

SHA256
7e5e8136fa7231462748130997bae62703f47f3a6f1594162caf844bdc5e8a37

SHA512
348ffc1b3870373a6ad4e7083987ae43261445aa2dee5420f7799d5411db12557a2275d43b43bf3d43a1ed7cf6903a8fe47974233a146f874033f67facbe3145

Download Submit
C:\Windows\system\BmhDfYV.exe

Filesize
1.7MB

MD5
6caada106fb07d0f6e10ff38a9ea0778

SHA1
bc9829064d4569afedcb08a258fa751712251ab9

SHA256
7123a08a67ca294f858c1c8b03ddaca473163916d3cf44a539122c0d11b9e99d

SHA512
4faf487f6e2df3186091a0c71b13caf24c06dbc2b2d6f6f03caca7eb462ec11a81c04e542b31724bee7350149d86c90784db507b02de415e6129e7d2f5c54b73

Download Submit
C:\Windows\system\BzIAVPL.exe

Filesize
1.7MB

MD5
34758f11dbdf444002fff4c92802ac29

SHA1
af3573457c8aa58dd5c0820dc7f22a8bb174480e

SHA256
1f4e374402e4a53944b15254fe241f758bc4ec3b7948ba78f5d003ae59dc7bbb

SHA512
5e17c045a888bd0e4ef9cf3b4da669950d3c619f056fe16ac0810d1253bcc4c6d9c8e0d91ed6d5d8e920315917021607440037d942b8ecdaf6443c63e53c3ca6

Download Submit
C:\Windows\system\CKRixca.exe

Filesize
1.7MB

MD5
1e8f03dadbda88abc029cf1577024f32

SHA1
6b16dc0549c6d5e3394365fa8c9534a0f90ba959

SHA256
b9328c4439008fc3b3a96633d203d19abaf98fdbd183276cfc097cb6674b6bfc

SHA512
2ce65dcb6b1e6b975b4c4fe3d28b4795cb614639fdc2dc367017767a1a17356a09c52a9878a08bc501bb159f96c908e1288910fdf33557263d82c0e61e4c79f7

Download Submit
C:\Windows\system\DITjLSa.exe

Filesize
1.7MB

MD5
bee4eda11c41d2f9c3629b0ca4c1a600

SHA1
bd70f570f2f0b8664a173d14e836c33b8b7ca261

SHA256
e5d878e7c42e090e024c9d6bf336d29fb83b82facd86415c49d2bbc4cf004d7a

SHA512
3d6d1100ee501c892edcabc45ff02f6f4fd9a33c7d1da42304ee31e55a582aa2788161ac5b48917e76450337623110b0197a786e1858de3f02733d5ef24200f2

Download Submit
C:\Windows\system\DjSCJZu.exe

Filesize
1.7MB

MD5
e3b43a283ff22bd3e0ffacd0280c6318

SHA1
18fbbdb29d808173615505e873ec7c99d0a5190c

SHA256
ded94f68ffb16f204cd6349563bfa8576d28e302f9311e1b3ae7efc183743345

SHA512
2209e47815342e2649e9e3d9807d3db4b0ece4c4a86ab4cca1d77c756753ab134d36480b87a27ffee9990f11b28d8c88c746ba46e95c4d00a0860a7c7bd0804e

Download Submit
C:\Windows\system\HgJYwIA.exe

Filesize
1.7MB

MD5
f5a3e0482db2756c7cc46cfde9baa42b

SHA1
b38778f1f0e2eaf02a6cc9bf7c5934eea4d16378

SHA256
a23954f8b6e8a4dd1c8d4b9f33f487dee5f62175fec93483a97ac85caea52ac0

SHA512
9b0866486866c499576a53443a63a137f2287fa090557db9b25e077e0beb7eb0429670fe91c99592504015ab314782ecad07d6a79464344049ffa467dda366a7

Download Submit
C:\Windows\system\LBqpqTG.exe

Filesize
1.7MB

MD5
daf31698c7ee41219d224d8cc653477d

SHA1
3fc26dccbcb4ce7020fb0a09f2d3723fdfc09213

SHA256
43f42db49f26733594a60f856b4b9110bdaffe87ef20499f68efbfbc2bc1b441

SHA512
2436c28eb798ccb919ba8ea86a626670b9f037624d7086e070e238ab8612378bad81ba838650c22050f8b915fd8766d1da20b64f8c69ad0b6ae48f05b4bd4530

Download Submit
C:\Windows\system\QulnqXQ.exe

Filesize
1.7MB

MD5
4dfec4cb9eccde7e2807193a91270c8f

SHA1
6b6e2693cdba9732aa5bbdb43383f64e92357e9f

SHA256
3c3ab633f0c9c30c374bd420439f7b9f68e9752c3854df1df23bc6ea434ec696

SHA512
301c365ef4a6ecb9b06fe39abfb57f621ead426c3358cab8555b3a1d12a32034739a8d0520343a5a641d50fc7c30059394a332e72d8c27c94b2b072f3f8e4401

Download Submit
C:\Windows\system\SpSXQmQ.exe

Filesize
1.7MB

MD5
8a103d820f81f95cfc69c8c5d9c68db0

SHA1
a16f6aea102b46aab3de152ce9141feaab4e7d49

SHA256
f4ab214115c69376e1afea768c573c87f20ebc4acb030827f5dc1a37cd4ff878

SHA512
13574869167f7d65578faf42d935ac6d59dfb3281873b65c59d6abb921b0bd565e3e604ecc4139efeddc5d1df412889fa05e3a95d590cac5762e22305ff155d4

Download Submit
C:\Windows\system\TUycxDK.exe

Filesize
1.7MB

MD5
8942f56b387cb19ae4cfd36a03803625

SHA1
9173681a5dc169a9bfeaf3e1cb9ba4762063baaf

SHA256
d0e93312684b69850ac9cbc36838a179268c11f25aaec429e2cf348628196732

SHA512
90bb9324da73d7575e96c12ba35c5b0a5c894e6e13ddca2b6c5a5a91f259f81f0b5b3c328db5e4c74704a68b511b179cf3d770bf28e599be2bd9bdeb8726da51

Download Submit
C:\Windows\system\UYnaJzg.exe

Filesize
1.7MB

MD5
8fe4eaa879167dffb24fd7a2c9634fe2

SHA1
4a30bb1617f85a23b630c61cf33a501fbb134fc8

SHA256
34c9d8428e3f54c83491630ce47c0b7647c303d1f74977ec72c4e8e95a18afae

SHA512
f47b9c6d131f4d34d55e3a8b6e2346089f3e5ac47b3325888554755eb2f63b14ef9814c14820e19407fb63e4a1ab544aea411323450688907b304c332a50b3b7

Download Submit
C:\Windows\system\UiJtTbe.exe

Filesize
1.7MB

MD5
8e56c8547beab3efbfab9ba9094f7423

SHA1
2a01f9c8fcffb8fca6e485ed0d528f8949add63d

SHA256
7849d61e6a8ca76150e9f588a3cd4e9cd6a577416ec5ca75bac470c6e2b64940

SHA512
5f0785650d98ca771f12e820933d273b94050c6251709674fcc59a0ec01b327f090c9fba9bca6441a365d8bf62aea4107aa2541f81ad80f5bb68034938fcdb00

Download Submit
C:\Windows\system\XNHstmA.exe

Filesize
1.7MB

MD5
8681e8155039b477353141a9b1012a5a

SHA1
16b0d7de57013e87432b6a762beeeb93b893556d

SHA256
d8b40cc0185217e8baffda8323acc78fe9a775d67ddf50a1302a18c4f16e7e46

SHA512
d10afa57410dda8b81a5ff854ca6879527f15c8b6c074d080ea069aa9109ca2a9697c07170f458ef8cdb9019eca9f401b6f8d3cc9062e59bc088dce965f05ec5

Download Submit
C:\Windows\system\cJThAqm.exe

Filesize
1.7MB

MD5
a1523c29da219dc1983383b051f7d306

SHA1
d933846f4ec5f69027354724c2c92124683fe186

SHA256
e2882f2b71c6f8f10329aa84c69112a8aa10cd352f73e2a34628a9652c64be7f

SHA512
0b6d9a38e8ff7465e48ec91e04d5071dda0e53d3decf5a9bfdec4fa965a5f0b3bca381766b5001d9ec213adabdf205d5b7bb0e1b178a38daedbe4ce1d3b681e4

Download Submit
C:\Windows\system\ekteIkG.exe

Filesize
1.7MB

MD5
3a6ac4a3171727c96a8e2f3e6838c1f4

SHA1
77c055b586831954c1bd663a6826c33f3ad7c2f2

SHA256
60d56db7e36a5e8a4a728e89c4df2fa506b74342b04fe9d2ecb7ebe4fceef478

SHA512
bd0aaa492a02a866bb8350687784236c381727536ebd9fd77902dc6e9bde86babe67bcb318dea1cc38a57a640e10f298867bc9bc64a19fb177699e477cb6e4e7

Download Submit
C:\Windows\system\fDUUBGQ.exe

Filesize
1.7MB

MD5
aa1e85f629fda4d15d57784b7f9a2de9

SHA1
a2f498f8b18eb81e51049d259e8e181d95e6d86f

SHA256
a4ef7b446f09100f4f1ac9b98cff2990c20b019c96acafc6201e1cac89ad6a7c

SHA512
b5221a053e808add3c8b6218740cd5ed953c3b33178259ec57bf2cd7f815071d97374e205a5b57fa0f001d22e0517a006029ce2f0883c28d13c1f79fbc62c093

Download Submit
C:\Windows\system\hQXQtqa.exe

Filesize
1.7MB

MD5
b98c9f966f7344c713f7a023b3659f2f

SHA1
eb0d17c8f3dcf372b18bb24e52561e0141515760

SHA256
296828624e4ecce7837758dfed79cb48b20d29b2069ef7334835b4edfb01df0b

SHA512
dbac0f7c55a4f84de10bb8883cefafcfdf567efac361fd6172e91634260b10ffaf6d243476d8680b9b5f973fc026d5f650f4a95c064136eb45b4212a09e439c1

Download Submit
C:\Windows\system\hZcgYLL.exe

Filesize
1.7MB

MD5
00bb9219323535b5a38bf8316d6773ee

SHA1
30cde08f94688beccbf1511faae8ffa6d63e96d0

SHA256
7cc396a2e8d61cc6f679c2070fc8a1e481963db3968d759e6b22c069e1f2043e

SHA512
8519ce963b210afb414987c07937918e01f8cc44a7144f078396c799e6432554c93e1cfc894eab7c812fc42785f983da2704be38aebd96a662d8965f0eda1eb1

Download Submit
C:\Windows\system\kvKMZYZ.exe

Filesize
1.7MB

MD5
8cb95274812a5f47ffa938cfdeeeb8b7

SHA1
1b5f2ec8c19fd7b81b578947bf11b093c5008511

SHA256
23afc22fee01e9c7ff769f62aaa5b1242074d34c5f2cdf0b894b26d911b45d5b

SHA512
12d0bd3a81c7dd4ef46dc5d8fce8c20d9f4015a68a765d0a175164ad2888cb5cb8ab770194f047369ac7d237723ffdfd65c86bc12ca092f8d497f6a7b1b70ce2

Download Submit
C:\Windows\system\laAicpT.exe

Filesize
1.7MB

MD5
30acade1a3248ab7e1f48c03e9432204

SHA1
d94b283f7e211d9a5708bbdb55365d75c5cb4bfc

SHA256
acfe780d2449281d151abef42e9a9414ef4c37f805ed7f598e061b196408b155

SHA512
59ff9fce9911710e874e157d488bd53e2712fac5327e7b3db2136c49f2e94e5849c6727897f2eb4b2d7b244e2939ce0b07899677d043397cd8d55fa66fec33e2

Download Submit
C:\Windows\system\ttjGksR.exe

Filesize
1.7MB

MD5
dd74fd5f53f24460e35966eecfc0caf9

SHA1
c4245bdb50575d9c4df7e463079ddb6b1f3f10f8

SHA256
db37476e3fccb0bc8a5924c1d1c962d319e1a3660e58ad7bb42a016c3d4268b0

SHA512
795ee2f91244f6ae2c4b47b525e0ec6a46c55c0329e0dd4662831016175d4d5068b691c1391f3dcd11bd47544c0bc3b19884c7200c3aa98178041ef0b8407e17

Download Submit
C:\Windows\system\urOOPgC.exe

Filesize
1.7MB

MD5
7de1a68fdf6b3c2586a8b3d59d34672a

SHA1
b48dd9d2b372b749b2caa0d0a4c7c231290d5394

SHA256
7370e67743f5f25e318cf6789417af2a8fa1595b64e8e6c1205f9239b8404611

SHA512
a61992bc5cb648f58181900458c657d8e8043ead7f351c04a694ade2e367f82c7cbeefb589cc1614ec7e6c4f96d37468c9c86eff90afb12a47c510011f9be343

Download Submit
C:\Windows\system\vRAlbgR.exe

Filesize
1.7MB

MD5
d0096aa261b912f973ed6f0051e97966

SHA1
e59cc703bb22a4f58d51adf87bfd8e1cd559e347

SHA256
f8791ec7e1156787392d83c57346943119b32a489efbd81be96152528e8e0ddb

SHA512
71783795c20c30aad860b890b8f2ecc020b3e511d16d0135b1dcc0ed420326adb5a6e982f95e1d25b61c887fdb8602f84fb9180dd14d43dab34b4780c58f72cc

Download Submit
\Windows\system\AoGLFsd.exe

Filesize
1.7MB

MD5
6d7aa40d391f2977159fd57cf755e4b5

SHA1
28e0883374b31293e9d0c98418abfe2affd69c00

SHA256
ee7846c7d7af9f087c7b6ed808f833f94199f7a9e01cc4cf8f550f07a7dc3158

SHA512
74c39e2e3450539f2558cfc05406e89b9c4bb3b2abc3c13b2aa01b89fbd06537dbbb4be8db284e87f1c00b64fe629e06f9c0526adc995604d37462f8ebdabf9c

Download Submit
\Windows\system\BMjISWD.exe

Filesize
1.7MB

MD5
d3e064f6e256cb88f539b8e52a4eca94

SHA1
15a64521e2badf841b3febb3f59b479cebeac2ee

SHA256
701048af25768e2f845a131d728396810d82a31a821d6c670e9f25cc07674420

SHA512
a14a8b060930455766b4c563e994bce435f20f5df602ac5324846b06d82810de6bd9066934b235e60abb05123b9865aa5f51a77dce4a190b0a6d4865f7d7c5c0

Download Submit
\Windows\system\KrKPNcZ.exe

Filesize
1.7MB

MD5
597a08774b798f60f12ef7e6105405a7

SHA1
9757fff7d6f3ffb8d1f3351d6c0e714aa51d93c6

SHA256
8407e8a5b6777759e1aa951d26ec7666df8f029136b514ca4da87885f16fb97a

SHA512
777efe6e06eff4171241ed89ddc80b91d1e927dd51be4e24a4159b8801372f37fb32a633b39af0689c7e2efa1a1f010c1579e2e5433ebaef7b76bfda03418488

Download Submit
\Windows\system\QgvDbDp.exe

Filesize
1.7MB

MD5
b730a568ee1b3ca4d7ce08067dd452b8

SHA1
0e79cd14cc3e84913b486c96f1f0920f12a73f6e

SHA256
29b1fc0d012d503d9fd8d79c10a7ac37416d86cf26d59d2f43efe1c4ac2b8136

SHA512
6fa0beac3809e4bf1402ccf09d2c39c95e4530e37559d69ead97a443b4a5f5ffc2bd1b82d336320a34ff95467961fff75a013a317a95a3070c788e51f5300be9

Download Submit
\Windows\system\RSaoWWG.exe

Filesize
1.7MB

MD5
ba20e6e96c936c28306bd623e088ffc5

SHA1
0b8d194be86ee3885429b0836f0f22913a6142c0

SHA256
7535c58721eae52edd1f2343bb0a2ae949b7d45bd96156129f405e9a6e3d82c6

SHA512
da1aaf46d8e239195dff504039239d0e29e31a9b36313d142e398f260164c43c511a0d0e8c8aa8820485d49afb5190cd07dede24de99accdb59be1d9e1b5f655

Download Submit
\Windows\system\jdOoafR.exe

Filesize
1.7MB

MD5
3e6b5130d239287c563a300b1c67977c

SHA1
99b81f385db50c78196a38f40d702eb5b1811536

SHA256
b3c6fa7606b05872d58a514d13f0de7a1c800fa2abfba929b0d1466e551a8e1e

SHA512
6e32664d68526a19980ef32899f3497b4e320cf30db4cd2af8049cf4a86999997560a82a32a921a746170dd3323f7dcb21647d587ddf830468c225abd997fee5

Download Submit
\Windows\system\kBgwwVP.exe

Filesize
1.7MB

MD5
5a7e67378542ed85cea081f0fa8f6e8a

SHA1
7241d6ce117a0e2ef75f394ef9b9e862af4888cc

SHA256
4d365493a7f2f2c47ef14424eafc6526cef377fdb56d0db6611041a609ba575c

SHA512
3a268d8136b8f408efce556af9138ebd9fa04b581d03214bc6b52ff985910cdc22b5bce48277d9d0ac781b988da13e9a93b64e3bf43ec58b9ea9ee5c1c88be8b

Download Submit
\Windows\system\koySitx.exe

Filesize
1.7MB

MD5
3e520de1a1104b5b3c57a3af80e56c83

SHA1
8f91bab4c11ec7b4c91ba820a82ae5651a78f2cc

SHA256
e1b2d6c6fb1faa8c636c4d3d12c2e110b86d3302e1ebe3d1ac8d4ad28f4e8ee2

SHA512
d2c2f595d0af91c7f73a578833606464a0a24ff6c1793b3ca920670645c085923dde7014353d6ebb7078774f3744481f7af31f3acf1d9a5b47030d63f84aef0e

Download Submit
\Windows\system\pIspALO.exe

Filesize
1.7MB

MD5
e445c9ae666b8a1b88377eb79efceac9

SHA1
6ddb874480c33118ee93324771fd5158a9549631

SHA256
a8722519914c57ed2fb452be8499b45e6781cd6541186877a558d20cfc0a0c41

SHA512
d57210b65f778716a5a0ad72337c5f17788502f8a3dfc9250b6920903f7119e38e853da48ca372bfaebee73ed16ebf3b7577ca3ab8b35ba255bebf62605c5acb

Download Submit
memory/2424-1858-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2424-167-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2564-1887-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2564-153-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-1859-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-159-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-1860-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-165-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-1861-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2668-161-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2672-1865-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2672-157-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2780-1857-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2780-155-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2784-164-0x0000000002C10000-0x0000000003002000-memory.dmp

Filesize
3.9MB

Download
memory/2784-156-0x0000000002C10000-0x0000000003002000-memory.dmp

Filesize
3.9MB

Download
memory/2784-152-0x0000000002C10000-0x0000000003002000-memory.dmp

Filesize
3.9MB

Download
memory/2784-166-0x0000000002EF0000-0x00000000032E2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-158-0x0000000002C10000-0x0000000003002000-memory.dmp

Filesize
3.9MB

Download
memory/2784-1-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-160-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2784-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2784-162-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-12-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-154-0x0000000002C10000-0x0000000003002000-memory.dmp

Filesize
3.9MB

Download
memory/2784-168-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-150-0x000007FEF5110000-0x000007FEF5AAD000-memory.dmp

Filesize
9.6MB

Download
memory/2820-14-0x0000000002A80000-0x0000000002B00000-memory.dmp

Filesize
512KB

Download
memory/2820-95-0x000000001B3A0000-0x000000001B682000-memory.dmp

Filesize
2.9MB

Download
memory/2820-99-0x0000000001DF0000-0x0000000001DF8000-memory.dmp

Filesize
32KB

Download
memory/2820-184-0x000007FEF5110000-0x000007FEF5AAD000-memory.dmp

Filesize
9.6MB

Download
memory/2820-169-0x000007FEF5110000-0x000007FEF5AAD000-memory.dmp

Filesize
9.6MB

Download
memory/2820-151-0x0000000002A80000-0x0000000002B00000-memory.dmp

Filesize
512KB

Download
memory/2852-1855-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-13-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-163-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-1856-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download