xmrig | 9ad7f921e8bf69936e626b7fb4ebf8914a3c2530f0b333cf9eca498416f8a450

Analysis

max time kernel
34s
max time network
31s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
Size

1.9MB
MD5

066f43b9c7dbbe5118fee1d4178ded0b
SHA1

bc2d5ac21b70dd9251b9aecc642f9a6ca7c1114d
SHA256

9ad7f921e8bf69936e626b7fb4ebf8914a3c2530f0b333cf9eca498416f8a450
SHA512

1abcabfea10e592044fada34de670fb63a6be4aa2015790f3bc4ddc93f63c0ad21781bcb3aefa953d1a29f51b8a546751b30984480fbf73639d0343ce2d780f7
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1E:NAB1

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2936-13-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2656-54-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2372-63-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2144-69-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/2276-59-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/2648-56-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2944-50-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2500-48-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/1624-2275-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2936	sItrRVd.exe
2500	SkYGeOY.exe
2944	wDApakD.exe
2656	ILLtpLN.exe
2648	zzkPpgf.exe
2276	CNoqOFR.exe
2372	OJGcVTO.exe
2144	nasNnbk.exe
2416	heWpGIK.exe
2444	ZXJjvqc.exe
1476	gwxjpJN.exe
1848	KnXzzxS.exe
1780	RzjMWTt.exe
2248	PGmEZCE.exe
1628	ZqwAKUe.exe
1472	dkcQsat.exe
808	leMUEVL.exe
1276	JVbVbgW.exe
1260	NsgccdZ.exe
2856	khpxFRW.exe
1664	zHsyify.exe
1868	JCEHQWB.exe
1696	VDgXNtd.exe
2724	iOepiBh.exe
2832	WSIGjSl.exe
1992	wKoRIwW.exe
1060	lmTkejG.exe
700	pxyQHok.exe
1792	ekWSlbk.exe
1004	nZejols.exe
2252	eWnkbgw.exe
2932	aRuhEcb.exe
1576	nphHChy.exe
2636	KNbydGF.exe
1608	xAMobPD.exe
1720	VemKbGJ.exe
1800	vMGwPBu.exe
548	wfesdga.exe
1652	cRTHUks.exe
908	IhyXFxV.exe
1068	UqtyaeL.exe
2824	yaaBdoe.exe
2044	ELijScZ.exe
2004	GxYKuNK.exe
2992	TdABJaH.exe
2120	TbuietR.exe
2312	Bbvjjhz.exe
812	OjCPRBj.exe
2128	hhHELNb.exe
2316	IPcewbv.exe
2436	KlslJBy.exe
2228	fPllond.exe
1240	fcVMNMl.exe
1936	nnGPgBd.exe
2580	OUrodci.exe
2760	OuksgXi.exe
2468	vSWFCqD.exe
2368	PsnYfuC.exe
2896	mfhyMKp.exe
2604	rppRCPa.exe
2680	qbBtUhU.exe
1900	PpbBEEG.exe
2728	AOBNZhQ.exe
2764	CBrVgVT.exe

Loads dropped DLL 64 IoCs

pid	Process
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1624-0-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/files/0x000c000000013ab9-3.dat	upx
behavioral1/memory/2936-13-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x00310000000165f0-18.dat	upx
behavioral1/files/0x001800000000558a-19.dat	upx
behavioral1/files/0x0008000000016c8c-23.dat	upx
behavioral1/files/0x0007000000016cb2-34.dat	upx
behavioral1/files/0x0007000000016ce4-37.dat	upx
behavioral1/files/0x0009000000016cfd-44.dat	upx
behavioral1/memory/2656-54-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/files/0x000800000001739d-58.dat	upx
behavioral1/memory/2372-63-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/files/0x00060000000173e5-72.dat	upx
behavioral1/memory/2144-69-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/memory/2276-59-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/2648-56-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2944-50-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2500-48-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/files/0x00060000000175ac-83.dat	upx
behavioral1/files/0x000600000001744c-75.dat	upx
behavioral1/memory/2416-78-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/files/0x0030000000016813-89.dat	upx
behavioral1/files/0x00060000000175b8-95.dat	upx
behavioral1/files/0x000500000001865a-114.dat	upx
behavioral1/files/0x0009000000018640-108.dat	upx
behavioral1/files/0x00050000000186d3-121.dat	upx
behavioral1/files/0x00050000000191ed-143.dat	upx
behavioral1/files/0x0006000000018bba-136.dat	upx
behavioral1/files/0x0005000000019235-175.dat	upx
behavioral1/files/0x0005000000019254-187.dat	upx
behavioral1/files/0x0005000000019331-186.dat	upx
behavioral1/files/0x0005000000019248-181.dat	upx
behavioral1/files/0x0005000000019233-171.dat	upx
behavioral1/files/0x000500000001934a-190.dat	upx
behavioral1/files/0x0005000000019227-166.dat	upx
behavioral1/files/0x0005000000019223-160.dat	upx
behavioral1/files/0x00050000000191eb-158.dat	upx
behavioral1/files/0x000500000001874c-156.dat	upx
behavioral1/files/0x0005000000018700-154.dat	upx
behavioral1/files/0x00050000000186c1-120.dat	upx
behavioral1/files/0x000500000001874a-130.dat	upx
behavioral1/files/0x001500000001863c-104.dat	upx
behavioral1/files/0x00060000000175b2-93.dat	upx
behavioral1/memory/1624-2275-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MssnkfN.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\WzvGjjH.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\znIufyK.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\dPxfrxp.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\kyHCWIr.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\uGYDDUI.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\YOSyBlR.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\mSMjGKI.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\WqwyUKA.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\fPllond.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\xTKZeAB.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\TZRjKCa.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\SliFKde.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\rmrCEFJ.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\SdgxobB.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\czvvcgh.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\ltXBZCW.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\BmpWJjv.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\YltDVhV.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\DFlNKHZ.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\ZIwdRUW.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\fNJzcBf.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\QqFcrhU.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\sWlHRoX.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\WfJNCmx.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\GcMAmCm.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\tbjXIGV.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\HWtoUQX.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\PuEMYVQ.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\RuHtABg.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\eQuaGTJ.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\zfFVjfY.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\CHXYrHA.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\IPcewbv.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\kADJwMo.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\kAraLoO.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\reGToxx.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\tyjITac.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\ElFDphs.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\KsRTbuA.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\qyaPqFK.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\RDtaseB.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\yXMjQmM.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\ELijScZ.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\QPsUhCG.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\JqDaePz.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\jGdvCde.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\gAKBuZQ.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\LgAJMBj.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\SXHQVAA.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\ERYIjjb.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\MJmTTtl.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\RhshAOA.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\IcBLiTi.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\CDGfZMQ.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\hfXmyHo.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\yjlqPQk.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\iJYFJwC.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\OJGcVTO.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\GnbgLbW.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\fbpbWVE.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\RUQaISv.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\jHkNhGe.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
File created	C:\Windows\System\mPjnYXY.exe	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2920	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
Token: SeDebugPrivilege	2920	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2920	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	29
PID 1624 wrote to memory of 2920	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	29
PID 1624 wrote to memory of 2920	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	29
PID 1624 wrote to memory of 2936	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	30
PID 1624 wrote to memory of 2936	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	30
PID 1624 wrote to memory of 2936	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	30
PID 1624 wrote to memory of 2500	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	31
PID 1624 wrote to memory of 2500	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	31
PID 1624 wrote to memory of 2500	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	31
PID 1624 wrote to memory of 2944	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	32
PID 1624 wrote to memory of 2944	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	32
PID 1624 wrote to memory of 2944	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	32
PID 1624 wrote to memory of 2656	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	33
PID 1624 wrote to memory of 2656	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	33
PID 1624 wrote to memory of 2656	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	33
PID 1624 wrote to memory of 2648	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	34
PID 1624 wrote to memory of 2648	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	34
PID 1624 wrote to memory of 2648	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	34
PID 1624 wrote to memory of 2276	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	35
PID 1624 wrote to memory of 2276	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	35
PID 1624 wrote to memory of 2276	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	35
PID 1624 wrote to memory of 2372	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	36
PID 1624 wrote to memory of 2372	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	36
PID 1624 wrote to memory of 2372	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	36
PID 1624 wrote to memory of 2144	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	37
PID 1624 wrote to memory of 2144	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	37
PID 1624 wrote to memory of 2144	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	37
PID 1624 wrote to memory of 2416	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	38
PID 1624 wrote to memory of 2416	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	38
PID 1624 wrote to memory of 2416	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	38
PID 1624 wrote to memory of 2444	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	39
PID 1624 wrote to memory of 2444	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	39
PID 1624 wrote to memory of 2444	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	39
PID 1624 wrote to memory of 1476	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	40
PID 1624 wrote to memory of 1476	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	40
PID 1624 wrote to memory of 1476	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	40
PID 1624 wrote to memory of 1848	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	41
PID 1624 wrote to memory of 1848	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	41
PID 1624 wrote to memory of 1848	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	41
PID 1624 wrote to memory of 1780	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	42
PID 1624 wrote to memory of 1780	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	42
PID 1624 wrote to memory of 1780	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	42
PID 1624 wrote to memory of 2248	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	43
PID 1624 wrote to memory of 2248	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	43
PID 1624 wrote to memory of 2248	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	43
PID 1624 wrote to memory of 1628	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	44
PID 1624 wrote to memory of 1628	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	44
PID 1624 wrote to memory of 1628	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	44
PID 1624 wrote to memory of 1472	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	45
PID 1624 wrote to memory of 1472	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	45
PID 1624 wrote to memory of 1472	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	45
PID 1624 wrote to memory of 808	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	46
PID 1624 wrote to memory of 808	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	46
PID 1624 wrote to memory of 808	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	46
PID 1624 wrote to memory of 1276	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	47
PID 1624 wrote to memory of 1276	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	47
PID 1624 wrote to memory of 1276	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	47
PID 1624 wrote to memory of 1260	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	48
PID 1624 wrote to memory of 1260	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	48
PID 1624 wrote to memory of 1260	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	48
PID 1624 wrote to memory of 1696	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	49
PID 1624 wrote to memory of 1696	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	49
PID 1624 wrote to memory of 1696	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	49
PID 1624 wrote to memory of 2856	1624	066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\066f43b9c7dbbe5118fee1d4178ded0b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\System\sItrRVd.exe
  C:\Windows\System\sItrRVd.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\SkYGeOY.exe
  C:\Windows\System\SkYGeOY.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\wDApakD.exe
  C:\Windows\System\wDApakD.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\ILLtpLN.exe
  C:\Windows\System\ILLtpLN.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\zzkPpgf.exe
  C:\Windows\System\zzkPpgf.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\CNoqOFR.exe
  C:\Windows\System\CNoqOFR.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\OJGcVTO.exe
  C:\Windows\System\OJGcVTO.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\nasNnbk.exe
  C:\Windows\System\nasNnbk.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\heWpGIK.exe
  C:\Windows\System\heWpGIK.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\ZXJjvqc.exe
  C:\Windows\System\ZXJjvqc.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\gwxjpJN.exe
  C:\Windows\System\gwxjpJN.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\KnXzzxS.exe
  C:\Windows\System\KnXzzxS.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\RzjMWTt.exe
  C:\Windows\System\RzjMWTt.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\PGmEZCE.exe
  C:\Windows\System\PGmEZCE.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\ZqwAKUe.exe
  C:\Windows\System\ZqwAKUe.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\dkcQsat.exe
  C:\Windows\System\dkcQsat.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\leMUEVL.exe
  C:\Windows\System\leMUEVL.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\JVbVbgW.exe
  C:\Windows\System\JVbVbgW.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\NsgccdZ.exe
  C:\Windows\System\NsgccdZ.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\VDgXNtd.exe
  C:\Windows\System\VDgXNtd.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\khpxFRW.exe
  C:\Windows\System\khpxFRW.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\iOepiBh.exe
  C:\Windows\System\iOepiBh.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\zHsyify.exe
  C:\Windows\System\zHsyify.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\WSIGjSl.exe
  C:\Windows\System\WSIGjSl.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\JCEHQWB.exe
  C:\Windows\System\JCEHQWB.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\wKoRIwW.exe
  C:\Windows\System\wKoRIwW.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\lmTkejG.exe
  C:\Windows\System\lmTkejG.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\pxyQHok.exe
  C:\Windows\System\pxyQHok.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\ekWSlbk.exe
  C:\Windows\System\ekWSlbk.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\nZejols.exe
  C:\Windows\System\nZejols.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\eWnkbgw.exe
  C:\Windows\System\eWnkbgw.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\nphHChy.exe
  C:\Windows\System\nphHChy.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\aRuhEcb.exe
  C:\Windows\System\aRuhEcb.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\KNbydGF.exe
  C:\Windows\System\KNbydGF.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\xAMobPD.exe
  C:\Windows\System\xAMobPD.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\VemKbGJ.exe
  C:\Windows\System\VemKbGJ.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\vMGwPBu.exe
  C:\Windows\System\vMGwPBu.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\wfesdga.exe
  C:\Windows\System\wfesdga.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\cRTHUks.exe
  C:\Windows\System\cRTHUks.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\IhyXFxV.exe
  C:\Windows\System\IhyXFxV.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\UqtyaeL.exe
  C:\Windows\System\UqtyaeL.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\yaaBdoe.exe
  C:\Windows\System\yaaBdoe.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\ELijScZ.exe
  C:\Windows\System\ELijScZ.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\Bbvjjhz.exe
  C:\Windows\System\Bbvjjhz.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\GxYKuNK.exe
  C:\Windows\System\GxYKuNK.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\OjCPRBj.exe
  C:\Windows\System\OjCPRBj.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\TdABJaH.exe
  C:\Windows\System\TdABJaH.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\hhHELNb.exe
  C:\Windows\System\hhHELNb.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\TbuietR.exe
  C:\Windows\System\TbuietR.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\IPcewbv.exe
  C:\Windows\System\IPcewbv.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\KlslJBy.exe
  C:\Windows\System\KlslJBy.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\fPllond.exe
  C:\Windows\System\fPllond.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\fcVMNMl.exe
  C:\Windows\System\fcVMNMl.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\nnGPgBd.exe
  C:\Windows\System\nnGPgBd.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\OUrodci.exe
  C:\Windows\System\OUrodci.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\OuksgXi.exe
  C:\Windows\System\OuksgXi.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\vSWFCqD.exe
  C:\Windows\System\vSWFCqD.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\PsnYfuC.exe
  C:\Windows\System\PsnYfuC.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\mfhyMKp.exe
  C:\Windows\System\mfhyMKp.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\rppRCPa.exe
  C:\Windows\System\rppRCPa.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\qbBtUhU.exe
  C:\Windows\System\qbBtUhU.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\PpbBEEG.exe
  C:\Windows\System\PpbBEEG.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\AOBNZhQ.exe
  C:\Windows\System\AOBNZhQ.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\CBrVgVT.exe
  C:\Windows\System\CBrVgVT.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\ZHKELnw.exe
  C:\Windows\System\ZHKELnw.exe
  2⤵
  PID:628
- C:\Windows\System\VucEGmr.exe
  C:\Windows\System\VucEGmr.exe
  2⤵
  PID:692
- C:\Windows\System\LiatuOY.exe
  C:\Windows\System\LiatuOY.exe
  2⤵
  PID:2244
- C:\Windows\System\DqFgkGw.exe
  C:\Windows\System\DqFgkGw.exe
  2⤵
  PID:2700
- C:\Windows\System\eQIKSWR.exe
  C:\Windows\System\eQIKSWR.exe
  2⤵
  PID:1256
- C:\Windows\System\btoMkvJ.exe
  C:\Windows\System\btoMkvJ.exe
  2⤵
  PID:2532
- C:\Windows\System\ywDMmYe.exe
  C:\Windows\System\ywDMmYe.exe
  2⤵
  PID:2080
- C:\Windows\System\eSMZEtF.exe
  C:\Windows\System\eSMZEtF.exe
  2⤵
  PID:1560
- C:\Windows\System\vvASMeO.exe
  C:\Windows\System\vvASMeO.exe
  2⤵
  PID:2916
- C:\Windows\System\cgmNyQZ.exe
  C:\Windows\System\cgmNyQZ.exe
  2⤵
  PID:2852
- C:\Windows\System\SdgxobB.exe
  C:\Windows\System\SdgxobB.exe
  2⤵
  PID:2192
- C:\Windows\System\xtlHuhV.exe
  C:\Windows\System\xtlHuhV.exe
  2⤵
  PID:2784
- C:\Windows\System\SDKDhzr.exe
  C:\Windows\System\SDKDhzr.exe
  2⤵
  PID:588
- C:\Windows\System\saBRpWx.exe
  C:\Windows\System\saBRpWx.exe
  2⤵
  PID:2256
- C:\Windows\System\szqOhHF.exe
  C:\Windows\System\szqOhHF.exe
  2⤵
  PID:2072
- C:\Windows\System\xQKTiRL.exe
  C:\Windows\System\xQKTiRL.exe
  2⤵
  PID:1564
- C:\Windows\System\QPODeMe.exe
  C:\Windows\System\QPODeMe.exe
  2⤵
  PID:1228
- C:\Windows\System\RIeKheO.exe
  C:\Windows\System\RIeKheO.exe
  2⤵
  PID:1288
- C:\Windows\System\CLneyge.exe
  C:\Windows\System\CLneyge.exe
  2⤵
  PID:1300
- C:\Windows\System\AhdGMzd.exe
  C:\Windows\System\AhdGMzd.exe
  2⤵
  PID:1268
- C:\Windows\System\aePWddg.exe
  C:\Windows\System\aePWddg.exe
  2⤵
  PID:760
- C:\Windows\System\ATzFccZ.exe
  C:\Windows\System\ATzFccZ.exe
  2⤵
  PID:552
- C:\Windows\System\fbnJgLZ.exe
  C:\Windows\System\fbnJgLZ.exe
  2⤵
  PID:320
- C:\Windows\System\CAuIzmg.exe
  C:\Windows\System\CAuIzmg.exe
  2⤵
  PID:3020
- C:\Windows\System\ytvvrCy.exe
  C:\Windows\System\ytvvrCy.exe
  2⤵
  PID:2108
- C:\Windows\System\MJmTTtl.exe
  C:\Windows\System\MJmTTtl.exe
  2⤵
  PID:3008
- C:\Windows\System\QKqOxEs.exe
  C:\Windows\System\QKqOxEs.exe
  2⤵
  PID:2056
- C:\Windows\System\XxNwcHb.exe
  C:\Windows\System\XxNwcHb.exe
  2⤵
  PID:2024
- C:\Windows\System\IWlkIaA.exe
  C:\Windows\System\IWlkIaA.exe
  2⤵
  PID:2976
- C:\Windows\System\jMLAXnJ.exe
  C:\Windows\System\jMLAXnJ.exe
  2⤵
  PID:2572
- C:\Windows\System\HNOwKdW.exe
  C:\Windows\System\HNOwKdW.exe
  2⤵
  PID:2672
- C:\Windows\System\YlGErVA.exe
  C:\Windows\System\YlGErVA.exe
  2⤵
  PID:2736
- C:\Windows\System\KJXtBPb.exe
  C:\Windows\System\KJXtBPb.exe
  2⤵
  PID:1692
- C:\Windows\System\czvvcgh.exe
  C:\Windows\System\czvvcgh.exe
  2⤵
  PID:2412
- C:\Windows\System\PNiYTHS.exe
  C:\Windows\System\PNiYTHS.exe
  2⤵
  PID:2616
- C:\Windows\System\WKjTKeI.exe
  C:\Windows\System\WKjTKeI.exe
  2⤵
  PID:2380
- C:\Windows\System\nTckPQT.exe
  C:\Windows\System\nTckPQT.exe
  2⤵
  PID:2528
- C:\Windows\System\LvJtiOa.exe
  C:\Windows\System\LvJtiOa.exe
  2⤵
  PID:1532
- C:\Windows\System\xitsyRV.exe
  C:\Windows\System\xitsyRV.exe
  2⤵
  PID:2560
- C:\Windows\System\GKyyPdY.exe
  C:\Windows\System\GKyyPdY.exe
  2⤵
  PID:2688
- C:\Windows\System\XRsQaTp.exe
  C:\Windows\System\XRsQaTp.exe
  2⤵
  PID:392
- C:\Windows\System\LfRYGvm.exe
  C:\Windows\System\LfRYGvm.exe
  2⤵
  PID:904
- C:\Windows\System\wXjzwCU.exe
  C:\Windows\System\wXjzwCU.exe
  2⤵
  PID:2184
- C:\Windows\System\FHCccdM.exe
  C:\Windows\System\FHCccdM.exe
  2⤵
  PID:2012
- C:\Windows\System\KWfVOUZ.exe
  C:\Windows\System\KWfVOUZ.exe
  2⤵
  PID:2356
- C:\Windows\System\viGJHsx.exe
  C:\Windows\System\viGJHsx.exe
  2⤵
  PID:2272
- C:\Windows\System\AwKifvG.exe
  C:\Windows\System\AwKifvG.exe
  2⤵
  PID:1932
- C:\Windows\System\HETFkUr.exe
  C:\Windows\System\HETFkUr.exe
  2⤵
  PID:572
- C:\Windows\System\xEAsMKL.exe
  C:\Windows\System\xEAsMKL.exe
  2⤵
  PID:884
- C:\Windows\System\LjbOfEQ.exe
  C:\Windows\System\LjbOfEQ.exe
  2⤵
  PID:2076
- C:\Windows\System\zJjGfWg.exe
  C:\Windows\System\zJjGfWg.exe
  2⤵
  PID:2732
- C:\Windows\System\YBpLSXZ.exe
  C:\Windows\System\YBpLSXZ.exe
  2⤵
  PID:1940
- C:\Windows\System\aQJCUoK.exe
  C:\Windows\System\aQJCUoK.exe
  2⤵
  PID:3016
- C:\Windows\System\plNfGpQ.exe
  C:\Windows\System\plNfGpQ.exe
  2⤵
  PID:3064
- C:\Windows\System\mfjAdkw.exe
  C:\Windows\System\mfjAdkw.exe
  2⤵
  PID:2460
- C:\Windows\System\NlfKJOW.exe
  C:\Windows\System\NlfKJOW.exe
  2⤵
  PID:1544
- C:\Windows\System\JMbGfWa.exe
  C:\Windows\System\JMbGfWa.exe
  2⤵
  PID:2348
- C:\Windows\System\VSmzsUZ.exe
  C:\Windows\System\VSmzsUZ.exe
  2⤵
  PID:1052
- C:\Windows\System\QaCpGbS.exe
  C:\Windows\System\QaCpGbS.exe
  2⤵
  PID:816
- C:\Windows\System\tHOhcps.exe
  C:\Windows\System\tHOhcps.exe
  2⤵
  PID:2160
- C:\Windows\System\XeYDTSN.exe
  C:\Windows\System\XeYDTSN.exe
  2⤵
  PID:1040
- C:\Windows\System\rJJysOt.exe
  C:\Windows\System\rJJysOt.exe
  2⤵
  PID:2408
- C:\Windows\System\MxrIQTK.exe
  C:\Windows\System\MxrIQTK.exe
  2⤵
  PID:672
- C:\Windows\System\IYNoTSw.exe
  C:\Windows\System\IYNoTSw.exe
  2⤵
  PID:3044
- C:\Windows\System\zveHXvc.exe
  C:\Windows\System\zveHXvc.exe
  2⤵
  PID:876
- C:\Windows\System\rVwRuLg.exe
  C:\Windows\System\rVwRuLg.exe
  2⤵
  PID:1764
- C:\Windows\System\EgYdLBU.exe
  C:\Windows\System\EgYdLBU.exe
  2⤵
  PID:1964
- C:\Windows\System\quVQbnS.exe
  C:\Windows\System\quVQbnS.exe
  2⤵
  PID:936
- C:\Windows\System\XqlIVVo.exe
  C:\Windows\System\XqlIVVo.exe
  2⤵
  PID:916
- C:\Windows\System\UVSDAKV.exe
  C:\Windows\System\UVSDAKV.exe
  2⤵
  PID:608
- C:\Windows\System\LTyNZIy.exe
  C:\Windows\System\LTyNZIy.exe
  2⤵
  PID:556
- C:\Windows\System\glfgaQo.exe
  C:\Windows\System\glfgaQo.exe
  2⤵
  PID:1852
- C:\Windows\System\SgIUMNH.exe
  C:\Windows\System\SgIUMNH.exe
  2⤵
  PID:2820
- C:\Windows\System\OvcKFrV.exe
  C:\Windows\System\OvcKFrV.exe
  2⤵
  PID:576
- C:\Windows\System\UMviclS.exe
  C:\Windows\System\UMviclS.exe
  2⤵
  PID:1596
- C:\Windows\System\JQppYEZ.exe
  C:\Windows\System\JQppYEZ.exe
  2⤵
  PID:2008
- C:\Windows\System\qyiZeZM.exe
  C:\Windows\System\qyiZeZM.exe
  2⤵
  PID:2492
- C:\Windows\System\lbKIdEl.exe
  C:\Windows\System\lbKIdEl.exe
  2⤵
  PID:2132
- C:\Windows\System\MmfiadQ.exe
  C:\Windows\System\MmfiadQ.exe
  2⤵
  PID:2788
- C:\Windows\System\VxsmlZm.exe
  C:\Windows\System\VxsmlZm.exe
  2⤵
  PID:1688
- C:\Windows\System\xsHwYiV.exe
  C:\Windows\System\xsHwYiV.exe
  2⤵
  PID:1584
- C:\Windows\System\wtpmpRo.exe
  C:\Windows\System\wtpmpRo.exe
  2⤵
  PID:2608
- C:\Windows\System\uZWCwTZ.exe
  C:\Windows\System\uZWCwTZ.exe
  2⤵
  PID:1612
- C:\Windows\System\fcszdpR.exe
  C:\Windows\System\fcszdpR.exe
  2⤵
  PID:636
- C:\Windows\System\PtNZmVY.exe
  C:\Windows\System\PtNZmVY.exe
  2⤵
  PID:2592
- C:\Windows\System\ElFDphs.exe
  C:\Windows\System\ElFDphs.exe
  2⤵
  PID:2904
- C:\Windows\System\zxXGCud.exe
  C:\Windows\System\zxXGCud.exe
  2⤵
  PID:2508
- C:\Windows\System\NgtCkbF.exe
  C:\Windows\System\NgtCkbF.exe
  2⤵
  PID:1044
- C:\Windows\System\ohxVmln.exe
  C:\Windows\System\ohxVmln.exe
  2⤵
  PID:880
- C:\Windows\System\MrfArbz.exe
  C:\Windows\System\MrfArbz.exe
  2⤵
  PID:2096
- C:\Windows\System\fbpbWVE.exe
  C:\Windows\System\fbpbWVE.exe
  2⤵
  PID:2840
- C:\Windows\System\OWLhkwL.exe
  C:\Windows\System\OWLhkwL.exe
  2⤵
  PID:1188
- C:\Windows\System\oWACzBe.exe
  C:\Windows\System\oWACzBe.exe
  2⤵
  PID:2392
- C:\Windows\System\UvdWIwe.exe
  C:\Windows\System\UvdWIwe.exe
  2⤵
  PID:3060
- C:\Windows\System\hdwCZZg.exe
  C:\Windows\System\hdwCZZg.exe
  2⤵
  PID:2516
- C:\Windows\System\zzOAMfo.exe
  C:\Windows\System\zzOAMfo.exe
  2⤵
  PID:2068
- C:\Windows\System\iaSCqEf.exe
  C:\Windows\System\iaSCqEf.exe
  2⤵
  PID:2268
- C:\Windows\System\mwXItsv.exe
  C:\Windows\System\mwXItsv.exe
  2⤵
  PID:1220
- C:\Windows\System\IhhcthO.exe
  C:\Windows\System\IhhcthO.exe
  2⤵
  PID:2860
- C:\Windows\System\zGHmgZP.exe
  C:\Windows\System\zGHmgZP.exe
  2⤵
  PID:1424
- C:\Windows\System\uZSwkvZ.exe
  C:\Windows\System\uZSwkvZ.exe
  2⤵
  PID:1788
- C:\Windows\System\nMCHKLb.exe
  C:\Windows\System\nMCHKLb.exe
  2⤵
  PID:580
- C:\Windows\System\irxrzgX.exe
  C:\Windows\System\irxrzgX.exe
  2⤵
  PID:1468
- C:\Windows\System\UShBqqk.exe
  C:\Windows\System\UShBqqk.exe
  2⤵
  PID:764
- C:\Windows\System\mppHgmg.exe
  C:\Windows\System\mppHgmg.exe
  2⤵
  PID:1508
- C:\Windows\System\TZRLget.exe
  C:\Windows\System\TZRLget.exe
  2⤵
  PID:3040
- C:\Windows\System\adQSSxs.exe
  C:\Windows\System\adQSSxs.exe
  2⤵
  PID:1316
- C:\Windows\System\RorfMrC.exe
  C:\Windows\System\RorfMrC.exe
  2⤵
  PID:1984
- C:\Windows\System\JjbkPTr.exe
  C:\Windows\System\JjbkPTr.exe
  2⤵
  PID:2320
- C:\Windows\System\RhshAOA.exe
  C:\Windows\System\RhshAOA.exe
  2⤵
  PID:2596
- C:\Windows\System\TKOtIGV.exe
  C:\Windows\System\TKOtIGV.exe
  2⤵
  PID:3076
- C:\Windows\System\cVUSZBq.exe
  C:\Windows\System\cVUSZBq.exe
  2⤵
  PID:3092
- C:\Windows\System\gWLoFNK.exe
  C:\Windows\System\gWLoFNK.exe
  2⤵
  PID:3108
- C:\Windows\System\KOCyTFv.exe
  C:\Windows\System\KOCyTFv.exe
  2⤵
  PID:3124
- C:\Windows\System\TIyKWXw.exe
  C:\Windows\System\TIyKWXw.exe
  2⤵
  PID:3144
- C:\Windows\System\utHTXxl.exe
  C:\Windows\System\utHTXxl.exe
  2⤵
  PID:3160
- C:\Windows\System\VPRYfkR.exe
  C:\Windows\System\VPRYfkR.exe
  2⤵
  PID:3176
- C:\Windows\System\LfrgnQw.exe
  C:\Windows\System\LfrgnQw.exe
  2⤵
  PID:3192
- C:\Windows\System\znIufyK.exe
  C:\Windows\System\znIufyK.exe
  2⤵
  PID:3208
- C:\Windows\System\UjZIXRs.exe
  C:\Windows\System\UjZIXRs.exe
  2⤵
  PID:3224
- C:\Windows\System\gqVVHzp.exe
  C:\Windows\System\gqVVHzp.exe
  2⤵
  PID:3240
- C:\Windows\System\ygBuyWp.exe
  C:\Windows\System\ygBuyWp.exe
  2⤵
  PID:3260
- C:\Windows\System\UrDZVxJ.exe
  C:\Windows\System\UrDZVxJ.exe
  2⤵
  PID:3276
- C:\Windows\System\lmQHiFh.exe
  C:\Windows\System\lmQHiFh.exe
  2⤵
  PID:3292
- C:\Windows\System\TwXsEMR.exe
  C:\Windows\System\TwXsEMR.exe
  2⤵
  PID:3308
- C:\Windows\System\drstTWX.exe
  C:\Windows\System\drstTWX.exe
  2⤵
  PID:3324
- C:\Windows\System\MNwxqXc.exe
  C:\Windows\System\MNwxqXc.exe
  2⤵
  PID:3424
- C:\Windows\System\JiXSrfT.exe
  C:\Windows\System\JiXSrfT.exe
  2⤵
  PID:3440
- C:\Windows\System\KsRTbuA.exe
  C:\Windows\System\KsRTbuA.exe
  2⤵
  PID:3460
- C:\Windows\System\IcsNTtb.exe
  C:\Windows\System\IcsNTtb.exe
  2⤵
  PID:3476
- C:\Windows\System\RtLEBpB.exe
  C:\Windows\System\RtLEBpB.exe
  2⤵
  PID:3492
- C:\Windows\System\iWQKJbd.exe
  C:\Windows\System\iWQKJbd.exe
  2⤵
  PID:3508
- C:\Windows\System\TEtVFVq.exe
  C:\Windows\System\TEtVFVq.exe
  2⤵
  PID:3524
- C:\Windows\System\bWidsxO.exe
  C:\Windows\System\bWidsxO.exe
  2⤵
  PID:3540
- C:\Windows\System\WvbdgTm.exe
  C:\Windows\System\WvbdgTm.exe
  2⤵
  PID:3556
- C:\Windows\System\mKHzdfS.exe
  C:\Windows\System\mKHzdfS.exe
  2⤵
  PID:3572
- C:\Windows\System\SqCdMoY.exe
  C:\Windows\System\SqCdMoY.exe
  2⤵
  PID:3588
- C:\Windows\System\cFNTqii.exe
  C:\Windows\System\cFNTqii.exe
  2⤵
  PID:3604
- C:\Windows\System\oeCjxQe.exe
  C:\Windows\System\oeCjxQe.exe
  2⤵
  PID:3684
- C:\Windows\System\BLbkKRI.exe
  C:\Windows\System\BLbkKRI.exe
  2⤵
  PID:3748
- C:\Windows\System\FouEnXy.exe
  C:\Windows\System\FouEnXy.exe
  2⤵
  PID:3764
- C:\Windows\System\owRcghm.exe
  C:\Windows\System\owRcghm.exe
  2⤵
  PID:3780
- C:\Windows\System\NlOTrxz.exe
  C:\Windows\System\NlOTrxz.exe
  2⤵
  PID:3796
- C:\Windows\System\IeeRNeg.exe
  C:\Windows\System\IeeRNeg.exe
  2⤵
  PID:3812
- C:\Windows\System\yuRDcnM.exe
  C:\Windows\System\yuRDcnM.exe
  2⤵
  PID:3828
- C:\Windows\System\tpMhaVB.exe
  C:\Windows\System\tpMhaVB.exe
  2⤵
  PID:3844
- C:\Windows\System\duWXcrK.exe
  C:\Windows\System\duWXcrK.exe
  2⤵
  PID:3860
- C:\Windows\System\EDxpShV.exe
  C:\Windows\System\EDxpShV.exe
  2⤵
  PID:3880
- C:\Windows\System\XzEdQCv.exe
  C:\Windows\System\XzEdQCv.exe
  2⤵
  PID:3896
- C:\Windows\System\ZPaneNf.exe
  C:\Windows\System\ZPaneNf.exe
  2⤵
  PID:3912
- C:\Windows\System\xTKZeAB.exe
  C:\Windows\System\xTKZeAB.exe
  2⤵
  PID:3928
- C:\Windows\System\fnoQPRk.exe
  C:\Windows\System\fnoQPRk.exe
  2⤵
  PID:3948
- C:\Windows\System\UhMpwmM.exe
  C:\Windows\System\UhMpwmM.exe
  2⤵
  PID:3964
- C:\Windows\System\fMFFERL.exe
  C:\Windows\System\fMFFERL.exe
  2⤵
  PID:3980
- C:\Windows\System\pkYpbbX.exe
  C:\Windows\System\pkYpbbX.exe
  2⤵
  PID:3996
- C:\Windows\System\ufmwMsD.exe
  C:\Windows\System\ufmwMsD.exe
  2⤵
  PID:4012
- C:\Windows\System\ABPHIRe.exe
  C:\Windows\System\ABPHIRe.exe
  2⤵
  PID:4028
- C:\Windows\System\SSmdNHW.exe
  C:\Windows\System\SSmdNHW.exe
  2⤵
  PID:4048
- C:\Windows\System\hhLOSLL.exe
  C:\Windows\System\hhLOSLL.exe
  2⤵
  PID:4064
- C:\Windows\System\mgCJvMW.exe
  C:\Windows\System\mgCJvMW.exe
  2⤵
  PID:4080
- C:\Windows\System\wjPFFBb.exe
  C:\Windows\System\wjPFFBb.exe
  2⤵
  PID:1840
- C:\Windows\System\yMPVnnf.exe
  C:\Windows\System\yMPVnnf.exe
  2⤵
  PID:1856
- C:\Windows\System\tbjXIGV.exe
  C:\Windows\System\tbjXIGV.exe
  2⤵
  PID:1212
- C:\Windows\System\KSxvhmC.exe
  C:\Windows\System\KSxvhmC.exe
  2⤵
  PID:3100
- C:\Windows\System\oiRvGzq.exe
  C:\Windows\System\oiRvGzq.exe
  2⤵
  PID:2424
- C:\Windows\System\sZBjmzD.exe
  C:\Windows\System\sZBjmzD.exe
  2⤵
  PID:3200
- C:\Windows\System\hmDzbCh.exe
  C:\Windows\System\hmDzbCh.exe
  2⤵
  PID:2220
- C:\Windows\System\dZdEWkr.exe
  C:\Windows\System\dZdEWkr.exe
  2⤵
  PID:1844
- C:\Windows\System\fpokSMo.exe
  C:\Windows\System\fpokSMo.exe
  2⤵
  PID:2696
- C:\Windows\System\ljAqLJt.exe
  C:\Windows\System\ljAqLJt.exe
  2⤵
  PID:1456
- C:\Windows\System\cmFBSIP.exe
  C:\Windows\System\cmFBSIP.exe
  2⤵
  PID:3120
- C:\Windows\System\ypeDDrE.exe
  C:\Windows\System\ypeDDrE.exe
  2⤵
  PID:3188
- C:\Windows\System\EhTKBrK.exe
  C:\Windows\System\EhTKBrK.exe
  2⤵
  PID:3252
- C:\Windows\System\ZlUiNWj.exe
  C:\Windows\System\ZlUiNWj.exe
  2⤵
  PID:3320
- C:\Windows\System\SyMpwod.exe
  C:\Windows\System\SyMpwod.exe
  2⤵
  PID:3348
- C:\Windows\System\RUQaISv.exe
  C:\Windows\System\RUQaISv.exe
  2⤵
  PID:3364
- C:\Windows\System\EYphhTx.exe
  C:\Windows\System\EYphhTx.exe
  2⤵
  PID:3380
- C:\Windows\System\rLOtUPF.exe
  C:\Windows\System\rLOtUPF.exe
  2⤵
  PID:3628
- C:\Windows\System\qyaPqFK.exe
  C:\Windows\System\qyaPqFK.exe
  2⤵
  PID:3644
- C:\Windows\System\dMnQLTd.exe
  C:\Windows\System\dMnQLTd.exe
  2⤵
  PID:3656
- C:\Windows\System\WxRhDNK.exe
  C:\Windows\System\WxRhDNK.exe
  2⤵
  PID:3668
- C:\Windows\System\zxSqDxH.exe
  C:\Windows\System\zxSqDxH.exe
  2⤵
  PID:3676
- C:\Windows\System\BXoqdzs.exe
  C:\Windows\System\BXoqdzs.exe
  2⤵
  PID:3596
- C:\Windows\System\qvomONM.exe
  C:\Windows\System\qvomONM.exe
  2⤵
  PID:3736
- C:\Windows\System\YgidvII.exe
  C:\Windows\System\YgidvII.exe
  2⤵
  PID:3788
- C:\Windows\System\PkpVqtp.exe
  C:\Windows\System\PkpVqtp.exe
  2⤵
  PID:3924
- C:\Windows\System\AKkjJUa.exe
  C:\Windows\System\AKkjJUa.exe
  2⤵
  PID:3988
- C:\Windows\System\JCtnywL.exe
  C:\Windows\System\JCtnywL.exe
  2⤵
  PID:4056
- C:\Windows\System\HZbphaa.exe
  C:\Windows\System\HZbphaa.exe
  2⤵
  PID:996
- C:\Windows\System\XtWCpJy.exe
  C:\Windows\System\XtWCpJy.exe
  2⤵
  PID:2744
- C:\Windows\System\OCjoTTL.exe
  C:\Windows\System\OCjoTTL.exe
  2⤵
  PID:3220
- C:\Windows\System\KGmYcJU.exe
  C:\Windows\System\KGmYcJU.exe
  2⤵
  PID:3340
- C:\Windows\System\XaZFKsc.exe
  C:\Windows\System\XaZFKsc.exe
  2⤵
  PID:4024
- C:\Windows\System\oJcmmjU.exe
  C:\Windows\System\oJcmmjU.exe
  2⤵
  PID:3940
- C:\Windows\System\YltDVhV.exe
  C:\Windows\System\YltDVhV.exe
  2⤵
  PID:4036
- C:\Windows\System\sXBdeyY.exe
  C:\Windows\System\sXBdeyY.exe
  2⤵
  PID:2032
- C:\Windows\System\DcBiZth.exe
  C:\Windows\System\DcBiZth.exe
  2⤵
  PID:3268
- C:\Windows\System\bscgryS.exe
  C:\Windows\System\bscgryS.exe
  2⤵
  PID:3772
- C:\Windows\System\dzqKhVe.exe
  C:\Windows\System\dzqKhVe.exe
  2⤵
  PID:3448
- C:\Windows\System\SyTJyPG.exe
  C:\Windows\System\SyTJyPG.exe
  2⤵
  PID:3484
- C:\Windows\System\fBSasxW.exe
  C:\Windows\System\fBSasxW.exe
  2⤵
  PID:3904
- C:\Windows\System\UGXcwmC.exe
  C:\Windows\System\UGXcwmC.exe
  2⤵
  PID:1904
- C:\Windows\System\HWtoUQX.exe
  C:\Windows\System\HWtoUQX.exe
  2⤵
  PID:3456
- C:\Windows\System\LvrduFU.exe
  C:\Windows\System\LvrduFU.exe
  2⤵
  PID:2628
- C:\Windows\System\jUDaihr.exe
  C:\Windows\System\jUDaihr.exe
  2⤵
  PID:1436
- C:\Windows\System\seLSqYb.exe
  C:\Windows\System\seLSqYb.exe
  2⤵
  PID:3156
- C:\Windows\System\rBkqfkq.exe
  C:\Windows\System\rBkqfkq.exe
  2⤵
  PID:3360
- C:\Windows\System\uRRbXXP.exe
  C:\Windows\System\uRRbXXP.exe
  2⤵
  PID:3408
- C:\Windows\System\FpSbUmv.exe
  C:\Windows\System\FpSbUmv.exe
  2⤵
  PID:3580
- C:\Windows\System\acgpjRk.exe
  C:\Windows\System\acgpjRk.exe
  2⤵
  PID:3436
- C:\Windows\System\cNlakzB.exe
  C:\Windows\System\cNlakzB.exe
  2⤵
  PID:3420
- C:\Windows\System\yPcxJTl.exe
  C:\Windows\System\yPcxJTl.exe
  2⤵
  PID:3956
- C:\Windows\System\bMOIDPH.exe
  C:\Windows\System\bMOIDPH.exe
  2⤵
  PID:3376
- C:\Windows\System\IKEwhYf.exe
  C:\Windows\System\IKEwhYf.exe
  2⤵
  PID:3840
- C:\Windows\System\TtCZpAp.exe
  C:\Windows\System\TtCZpAp.exe
  2⤵
  PID:3824
- C:\Windows\System\UAidzXx.exe
  C:\Windows\System\UAidzXx.exe
  2⤵
  PID:796
- C:\Windows\System\oSOmFOl.exe
  C:\Windows\System\oSOmFOl.exe
  2⤵
  PID:3660
- C:\Windows\System\NfytSwl.exe
  C:\Windows\System\NfytSwl.exe
  2⤵
  PID:3756
- C:\Windows\System\THzxmyb.exe
  C:\Windows\System\THzxmyb.exe
  2⤵
  PID:3168
- C:\Windows\System\TtwQmLm.exe
  C:\Windows\System\TtwQmLm.exe
  2⤵
  PID:3808
- C:\Windows\System\znqciSs.exe
  C:\Windows\System\znqciSs.exe
  2⤵
  PID:3548
- C:\Windows\System\FCQmRyT.exe
  C:\Windows\System\FCQmRyT.exe
  2⤵
  PID:3872
- C:\Windows\System\ZWxzPAh.exe
  C:\Windows\System\ZWxzPAh.exe
  2⤵
  PID:4072
- C:\Windows\System\kgLpqPi.exe
  C:\Windows\System\kgLpqPi.exe
  2⤵
  PID:4008
- C:\Windows\System\PcuKYQH.exe
  C:\Windows\System\PcuKYQH.exe
  2⤵
  PID:2504
- C:\Windows\System\CewFGEJ.exe
  C:\Windows\System\CewFGEJ.exe
  2⤵
  PID:3620
- C:\Windows\System\gfiaoBu.exe
  C:\Windows\System\gfiaoBu.exe
  2⤵
  PID:3696
- C:\Windows\System\WksJqrx.exe
  C:\Windows\System\WksJqrx.exe
  2⤵
  PID:3892
- C:\Windows\System\RRnmODt.exe
  C:\Windows\System\RRnmODt.exe
  2⤵
  PID:3520
- C:\Windows\System\HPapElA.exe
  C:\Windows\System\HPapElA.exe
  2⤵
  PID:3640
- C:\Windows\System\hwnNyXj.exe
  C:\Windows\System\hwnNyXj.exe
  2⤵
  PID:3652
- C:\Windows\System\Vatujuv.exe
  C:\Windows\System\Vatujuv.exe
  2⤵
  PID:1368
- C:\Windows\System\pyhXesn.exe
  C:\Windows\System\pyhXesn.exe
  2⤵
  PID:3316
- C:\Windows\System\PuEMYVQ.exe
  C:\Windows\System\PuEMYVQ.exe
  2⤵
  PID:3532
- C:\Windows\System\lyKQrIk.exe
  C:\Windows\System\lyKQrIk.exe
  2⤵
  PID:3976
- C:\Windows\System\ZfTcBPx.exe
  C:\Windows\System\ZfTcBPx.exe
  2⤵
  PID:3132
- C:\Windows\System\qfIYRog.exe
  C:\Windows\System\qfIYRog.exe
  2⤵
  PID:4020
- C:\Windows\System\lRyEAVK.exe
  C:\Windows\System\lRyEAVK.exe
  2⤵
  PID:3568
- C:\Windows\System\TSZmIAA.exe
  C:\Windows\System\TSZmIAA.exe
  2⤵
  PID:3232
- C:\Windows\System\dLtSIrV.exe
  C:\Windows\System\dLtSIrV.exe
  2⤵
  PID:4092
- C:\Windows\System\JXNERrE.exe
  C:\Windows\System\JXNERrE.exe
  2⤵
  PID:3488
- C:\Windows\System\IThITCd.exe
  C:\Windows\System\IThITCd.exe
  2⤵
  PID:4044
- C:\Windows\System\QulKHMD.exe
  C:\Windows\System\QulKHMD.exe
  2⤵
  PID:3612
- C:\Windows\System\BNeOKGV.exe
  C:\Windows\System\BNeOKGV.exe
  2⤵
  PID:2476
- C:\Windows\System\zFiytfd.exe
  C:\Windows\System\zFiytfd.exe
  2⤵
  PID:4076
- C:\Windows\System\INYmKNP.exe
  C:\Windows\System\INYmKNP.exe
  2⤵
  PID:4104
- C:\Windows\System\sEezWWa.exe
  C:\Windows\System\sEezWWa.exe
  2⤵
  PID:4120
- C:\Windows\System\zqjTWtC.exe
  C:\Windows\System\zqjTWtC.exe
  2⤵
  PID:4152
- C:\Windows\System\dUlLpTf.exe
  C:\Windows\System\dUlLpTf.exe
  2⤵
  PID:4176
- C:\Windows\System\myhHrEG.exe
  C:\Windows\System\myhHrEG.exe
  2⤵
  PID:4192
- C:\Windows\System\KFWCmHZ.exe
  C:\Windows\System\KFWCmHZ.exe
  2⤵
  PID:4212
- C:\Windows\System\HigEyCJ.exe
  C:\Windows\System\HigEyCJ.exe
  2⤵
  PID:4236
- C:\Windows\System\hUKWQZV.exe
  C:\Windows\System\hUKWQZV.exe
  2⤵
  PID:4252
- C:\Windows\System\zLGEbet.exe
  C:\Windows\System\zLGEbet.exe
  2⤵
  PID:4268
- C:\Windows\System\SXjoTpt.exe
  C:\Windows\System\SXjoTpt.exe
  2⤵
  PID:4284
- C:\Windows\System\ddZuaYz.exe
  C:\Windows\System\ddZuaYz.exe
  2⤵
  PID:4300
- C:\Windows\System\kADJwMo.exe
  C:\Windows\System\kADJwMo.exe
  2⤵
  PID:4316
- C:\Windows\System\kwdiJSz.exe
  C:\Windows\System\kwdiJSz.exe
  2⤵
  PID:4332
- C:\Windows\System\neseRGj.exe
  C:\Windows\System\neseRGj.exe
  2⤵
  PID:4348
- C:\Windows\System\esjGKUv.exe
  C:\Windows\System\esjGKUv.exe
  2⤵
  PID:4364
- C:\Windows\System\NieDfGr.exe
  C:\Windows\System\NieDfGr.exe
  2⤵
  PID:4380
- C:\Windows\System\AaoQBtz.exe
  C:\Windows\System\AaoQBtz.exe
  2⤵
  PID:4396
- C:\Windows\System\hcHoyBm.exe
  C:\Windows\System\hcHoyBm.exe
  2⤵
  PID:4420
- C:\Windows\System\KVGHwwT.exe
  C:\Windows\System\KVGHwwT.exe
  2⤵
  PID:4436
- C:\Windows\System\RNNKaFb.exe
  C:\Windows\System\RNNKaFb.exe
  2⤵
  PID:4452
- C:\Windows\System\PdVMbTk.exe
  C:\Windows\System\PdVMbTk.exe
  2⤵
  PID:4468
- C:\Windows\System\qhVwvMD.exe
  C:\Windows\System\qhVwvMD.exe
  2⤵
  PID:4484
- C:\Windows\System\ePpwmcg.exe
  C:\Windows\System\ePpwmcg.exe
  2⤵
  PID:4500
- C:\Windows\System\wjPvyZe.exe
  C:\Windows\System\wjPvyZe.exe
  2⤵
  PID:4516
- C:\Windows\System\VFydDDA.exe
  C:\Windows\System\VFydDDA.exe
  2⤵
  PID:4532
- C:\Windows\System\iJfCeGa.exe
  C:\Windows\System\iJfCeGa.exe
  2⤵
  PID:4548
- C:\Windows\System\UCsAtZp.exe
  C:\Windows\System\UCsAtZp.exe
  2⤵
  PID:4564
- C:\Windows\System\BMNZTIa.exe
  C:\Windows\System\BMNZTIa.exe
  2⤵
  PID:4580
- C:\Windows\System\iBPoSao.exe
  C:\Windows\System\iBPoSao.exe
  2⤵
  PID:4596
- C:\Windows\System\BiBWWUv.exe
  C:\Windows\System\BiBWWUv.exe
  2⤵
  PID:4616
- C:\Windows\System\FYhrkAh.exe
  C:\Windows\System\FYhrkAh.exe
  2⤵
  PID:4632
- C:\Windows\System\dPxfrxp.exe
  C:\Windows\System\dPxfrxp.exe
  2⤵
  PID:4652
- C:\Windows\System\fNJzcBf.exe
  C:\Windows\System\fNJzcBf.exe
  2⤵
  PID:4668
- C:\Windows\System\jYJTIGS.exe
  C:\Windows\System\jYJTIGS.exe
  2⤵
  PID:4684
- C:\Windows\System\tJhGodo.exe
  C:\Windows\System\tJhGodo.exe
  2⤵
  PID:4700
- C:\Windows\System\mAqJtcC.exe
  C:\Windows\System\mAqJtcC.exe
  2⤵
  PID:4744
- C:\Windows\System\iRkBxoG.exe
  C:\Windows\System\iRkBxoG.exe
  2⤵
  PID:4764
- C:\Windows\System\HRzJadl.exe
  C:\Windows\System\HRzJadl.exe
  2⤵
  PID:4800
- C:\Windows\System\JUUSjYW.exe
  C:\Windows\System\JUUSjYW.exe
  2⤵
  PID:4848
- C:\Windows\System\hTGwpvx.exe
  C:\Windows\System\hTGwpvx.exe
  2⤵
  PID:4868
- C:\Windows\System\tLJVgyA.exe
  C:\Windows\System\tLJVgyA.exe
  2⤵
  PID:4884
- C:\Windows\System\bodGfjb.exe
  C:\Windows\System\bodGfjb.exe
  2⤵
  PID:4916
- C:\Windows\System\hursXuI.exe
  C:\Windows\System\hursXuI.exe
  2⤵
  PID:4940
- C:\Windows\System\nPkkNpT.exe
  C:\Windows\System\nPkkNpT.exe
  2⤵
  PID:4956
- C:\Windows\System\FjMZqpF.exe
  C:\Windows\System\FjMZqpF.exe
  2⤵
  PID:4980
- C:\Windows\System\SGckhct.exe
  C:\Windows\System\SGckhct.exe
  2⤵
  PID:5032
- C:\Windows\System\odGphNA.exe
  C:\Windows\System\odGphNA.exe
  2⤵
  PID:5072
- C:\Windows\System\ljyZOFt.exe
  C:\Windows\System\ljyZOFt.exe
  2⤵
  PID:5092
- C:\Windows\System\aeOAmSw.exe
  C:\Windows\System\aeOAmSw.exe
  2⤵
  PID:5108
- C:\Windows\System\SIOcRGK.exe
  C:\Windows\System\SIOcRGK.exe
  2⤵
  PID:3888
- C:\Windows\System\EOoktRi.exe
  C:\Windows\System\EOoktRi.exe
  2⤵
  PID:4116
- C:\Windows\System\IcBLiTi.exe
  C:\Windows\System\IcBLiTi.exe
  2⤵
  PID:4132
- C:\Windows\System\IpIexql.exe
  C:\Windows\System\IpIexql.exe
  2⤵
  PID:4148
- C:\Windows\System\ZMgmdkL.exe
  C:\Windows\System\ZMgmdkL.exe
  2⤵
  PID:4188
- C:\Windows\System\oaCEyYT.exe
  C:\Windows\System\oaCEyYT.exe
  2⤵
  PID:4280
- C:\Windows\System\SPsFNmY.exe
  C:\Windows\System\SPsFNmY.exe
  2⤵
  PID:4232
- C:\Windows\System\nWSgLmB.exe
  C:\Windows\System\nWSgLmB.exe
  2⤵
  PID:4308
- C:\Windows\System\hfXmyHo.exe
  C:\Windows\System\hfXmyHo.exe
  2⤵
  PID:4416
- C:\Windows\System\cEtqlhS.exe
  C:\Windows\System\cEtqlhS.exe
  2⤵
  PID:4480
- C:\Windows\System\sTThnfz.exe
  C:\Windows\System\sTThnfz.exe
  2⤵
  PID:4412
- C:\Windows\System\jGdvCde.exe
  C:\Windows\System\jGdvCde.exe
  2⤵
  PID:4612
- C:\Windows\System\xNJGtbd.exe
  C:\Windows\System\xNJGtbd.exe
  2⤵
  PID:4556
- C:\Windows\System\reGToxx.exe
  C:\Windows\System\reGToxx.exe
  2⤵
  PID:4356
- C:\Windows\System\bzXTQVb.exe
  C:\Windows\System\bzXTQVb.exe
  2⤵
  PID:4432
- C:\Windows\System\VcAkYYD.exe
  C:\Windows\System\VcAkYYD.exe
  2⤵
  PID:4592
- C:\Windows\System\MGyiqMY.exe
  C:\Windows\System\MGyiqMY.exe
  2⤵
  PID:4664
- C:\Windows\System\vgOrYOf.exe
  C:\Windows\System\vgOrYOf.exe
  2⤵
  PID:4676
- C:\Windows\System\jLWvDdD.exe
  C:\Windows\System\jLWvDdD.exe
  2⤵
  PID:4716
- C:\Windows\System\dTRJZYh.exe
  C:\Windows\System\dTRJZYh.exe
  2⤵
  PID:4736
- C:\Windows\System\gyPwEyX.exe
  C:\Windows\System\gyPwEyX.exe
  2⤵
  PID:3172
- C:\Windows\System\yrhzNvb.exe
  C:\Windows\System\yrhzNvb.exe
  2⤵
  PID:4780
- C:\Windows\System\HKleDtz.exe
  C:\Windows\System\HKleDtz.exe
  2⤵
  PID:4820
- C:\Windows\System\oekHfaQ.exe
  C:\Windows\System\oekHfaQ.exe
  2⤵
  PID:4824
- C:\Windows\System\eJyGimY.exe
  C:\Windows\System\eJyGimY.exe
  2⤵
  PID:4844
- C:\Windows\System\gfjLpUV.exe
  C:\Windows\System\gfjLpUV.exe
  2⤵
  PID:4892
- C:\Windows\System\rSIqCHY.exe
  C:\Windows\System\rSIqCHY.exe
  2⤵
  PID:4912
- C:\Windows\System\CfSlilo.exe
  C:\Windows\System\CfSlilo.exe
  2⤵
  PID:4952
- C:\Windows\System\xjDobQX.exe
  C:\Windows\System\xjDobQX.exe
  2⤵
  PID:4924
- C:\Windows\System\yXENhwr.exe
  C:\Windows\System\yXENhwr.exe
  2⤵
  PID:4992
- C:\Windows\System\LIeoKjn.exe
  C:\Windows\System\LIeoKjn.exe
  2⤵
  PID:5056
- C:\Windows\System\KdrWyLc.exe
  C:\Windows\System\KdrWyLc.exe
  2⤵
  PID:5084
- C:\Windows\System\nuTwmUS.exe
  C:\Windows\System\nuTwmUS.exe
  2⤵
  PID:4168
- C:\Windows\System\dWyUypP.exe
  C:\Windows\System\dWyUypP.exe
  2⤵
  PID:4408
- C:\Windows\System\phpbjro.exe
  C:\Windows\System\phpbjro.exe
  2⤵
  PID:1580
- C:\Windows\System\ynWELsj.exe
  C:\Windows\System\ynWELsj.exe
  2⤵
  PID:4392
- C:\Windows\System\zTEgcpF.exe
  C:\Windows\System\zTEgcpF.exe
  2⤵
  PID:4296
- C:\Windows\System\iYSUlhY.exe
  C:\Windows\System\iYSUlhY.exe
  2⤵
  PID:4644
- C:\Windows\System\BIHEiYH.exe
  C:\Windows\System\BIHEiYH.exe
  2⤵
  PID:4496
- C:\Windows\System\TBrmHfZ.exe
  C:\Windows\System\TBrmHfZ.exe
  2⤵
  PID:4832
- C:\Windows\System\PiQBsGh.exe
  C:\Windows\System\PiQBsGh.exe
  2⤵
  PID:4900
- C:\Windows\System\QzuqVIV.exe
  C:\Windows\System\QzuqVIV.exe
  2⤵
  PID:4448
- C:\Windows\System\qwSZBQB.exe
  C:\Windows\System\qwSZBQB.exe
  2⤵
  PID:4608
- C:\Windows\System\WlnySrn.exe
  C:\Windows\System\WlnySrn.exe
  2⤵
  PID:5024
- C:\Windows\System\OaFxNeu.exe
  C:\Windows\System\OaFxNeu.exe
  2⤵
  PID:5028
- C:\Windows\System\tyZmaIp.exe
  C:\Windows\System\tyZmaIp.exe
  2⤵
  PID:5088
- C:\Windows\System\GxXJwgy.exe
  C:\Windows\System\GxXJwgy.exe
  2⤵
  PID:4624
- C:\Windows\System\TWoUitD.exe
  C:\Windows\System\TWoUitD.exe
  2⤵
  PID:4732
- C:\Windows\System\UwGTWMS.exe
  C:\Windows\System\UwGTWMS.exe
  2⤵
  PID:4860
- C:\Windows\System\AXoDmRm.exe
  C:\Windows\System\AXoDmRm.exe
  2⤵
  PID:4968
- C:\Windows\System\VikVYZM.exe
  C:\Windows\System\VikVYZM.exe
  2⤵
  PID:5052
- C:\Windows\System\LCSRJIY.exe
  C:\Windows\System\LCSRJIY.exe
  2⤵
  PID:4224
- C:\Windows\System\SliFKde.exe
  C:\Windows\System\SliFKde.exe
  2⤵
  PID:4376
- C:\Windows\System\NPuKccK.exe
  C:\Windows\System\NPuKccK.exe
  2⤵
  PID:4128
- C:\Windows\System\qKVgNlr.exe
  C:\Windows\System\qKVgNlr.exe
  2⤵
  PID:4340
- C:\Windows\System\qJceimt.exe
  C:\Windows\System\qJceimt.exe
  2⤵
  PID:4640
- C:\Windows\System\uWfmhBO.exe
  C:\Windows\System\uWfmhBO.exe
  2⤵
  PID:4712
- C:\Windows\System\tDMLRWR.exe
  C:\Windows\System\tDMLRWR.exe
  2⤵
  PID:4836
- C:\Windows\System\sarsChf.exe
  C:\Windows\System\sarsChf.exe
  2⤵
  PID:4896
- C:\Windows\System\jLhkMfQ.exe
  C:\Windows\System\jLhkMfQ.exe
  2⤵
  PID:4936
- C:\Windows\System\kAraLoO.exe
  C:\Windows\System\kAraLoO.exe
  2⤵
  PID:4828
- C:\Windows\System\ycSjAXn.exe
  C:\Windows\System\ycSjAXn.exe
  2⤵
  PID:5020
- C:\Windows\System\kowjcKN.exe
  C:\Windows\System\kowjcKN.exe
  2⤵
  PID:4492
- C:\Windows\System\LJXZOCJ.exe
  C:\Windows\System\LJXZOCJ.exe
  2⤵
  PID:4756
- C:\Windows\System\gAKBuZQ.exe
  C:\Windows\System\gAKBuZQ.exe
  2⤵
  PID:4908
- C:\Windows\System\LgAJMBj.exe
  C:\Windows\System\LgAJMBj.exe
  2⤵
  PID:4728
- C:\Windows\System\QmmFtNm.exe
  C:\Windows\System\QmmFtNm.exe
  2⤵
  PID:5124
- C:\Windows\System\oiksIQc.exe
  C:\Windows\System\oiksIQc.exe
  2⤵
  PID:5140
- C:\Windows\System\sFxsMFo.exe
  C:\Windows\System\sFxsMFo.exe
  2⤵
  PID:5168
- C:\Windows\System\RpsJulZ.exe
  C:\Windows\System\RpsJulZ.exe
  2⤵
  PID:5184
- C:\Windows\System\CuJmSYW.exe
  C:\Windows\System\CuJmSYW.exe
  2⤵
  PID:5200
- C:\Windows\System\NAlGhKI.exe
  C:\Windows\System\NAlGhKI.exe
  2⤵
  PID:5216
- C:\Windows\System\gkHnEtb.exe
  C:\Windows\System\gkHnEtb.exe
  2⤵
  PID:5236
- C:\Windows\System\KvmxQAt.exe
  C:\Windows\System\KvmxQAt.exe
  2⤵
  PID:5252
- C:\Windows\System\nLzzFsy.exe
  C:\Windows\System\nLzzFsy.exe
  2⤵
  PID:5268
- C:\Windows\System\CHxpnFq.exe
  C:\Windows\System\CHxpnFq.exe
  2⤵
  PID:5284
- C:\Windows\System\ZSFVZbq.exe
  C:\Windows\System\ZSFVZbq.exe
  2⤵
  PID:5300
- C:\Windows\System\afJdiSF.exe
  C:\Windows\System\afJdiSF.exe
  2⤵
  PID:5320
- C:\Windows\System\GUjrQwi.exe
  C:\Windows\System\GUjrQwi.exe
  2⤵
  PID:5336
- C:\Windows\System\gZaDipL.exe
  C:\Windows\System\gZaDipL.exe
  2⤵
  PID:5352
- C:\Windows\System\qoEuShz.exe
  C:\Windows\System\qoEuShz.exe
  2⤵
  PID:5460
- C:\Windows\System\uYZUiUt.exe
  C:\Windows\System\uYZUiUt.exe
  2⤵
  PID:5476
- C:\Windows\System\TwhcQVK.exe
  C:\Windows\System\TwhcQVK.exe
  2⤵
  PID:5492
- C:\Windows\System\vrFqQFj.exe
  C:\Windows\System\vrFqQFj.exe
  2⤵
  PID:5508
- C:\Windows\System\xyNiYLW.exe
  C:\Windows\System\xyNiYLW.exe
  2⤵
  PID:5524
- C:\Windows\System\SwIjzmd.exe
  C:\Windows\System\SwIjzmd.exe
  2⤵
  PID:5544
- C:\Windows\System\LiZeIti.exe
  C:\Windows\System\LiZeIti.exe
  2⤵
  PID:5560
- C:\Windows\System\KesNntb.exe
  C:\Windows\System\KesNntb.exe
  2⤵
  PID:5576
- C:\Windows\System\nLnhclO.exe
  C:\Windows\System\nLnhclO.exe
  2⤵
  PID:5592
- C:\Windows\System\mbmIeEY.exe
  C:\Windows\System\mbmIeEY.exe
  2⤵
  PID:5608
- C:\Windows\System\jiegiow.exe
  C:\Windows\System\jiegiow.exe
  2⤵
  PID:5624
- C:\Windows\System\uGRuKyZ.exe
  C:\Windows\System\uGRuKyZ.exe
  2⤵
  PID:5672
- C:\Windows\System\flLOLbe.exe
  C:\Windows\System\flLOLbe.exe
  2⤵
  PID:5696
- C:\Windows\System\coPkyaZ.exe
  C:\Windows\System\coPkyaZ.exe
  2⤵
  PID:5712
- C:\Windows\System\itbmaIx.exe
  C:\Windows\System\itbmaIx.exe
  2⤵
  PID:5728
- C:\Windows\System\aocOVpf.exe
  C:\Windows\System\aocOVpf.exe
  2⤵
  PID:5744
- C:\Windows\System\rCPquLJ.exe
  C:\Windows\System\rCPquLJ.exe
  2⤵
  PID:5760
- C:\Windows\System\JpQBAEG.exe
  C:\Windows\System\JpQBAEG.exe
  2⤵
  PID:5776
- C:\Windows\System\fPhHIie.exe
  C:\Windows\System\fPhHIie.exe
  2⤵
  PID:5792
- C:\Windows\System\QPsUhCG.exe
  C:\Windows\System\QPsUhCG.exe
  2⤵
  PID:5808
- C:\Windows\System\AGUGTZw.exe
  C:\Windows\System\AGUGTZw.exe
  2⤵
  PID:5824
- C:\Windows\System\AQYxIhq.exe
  C:\Windows\System\AQYxIhq.exe
  2⤵
  PID:5840
- C:\Windows\System\yondPHa.exe
  C:\Windows\System\yondPHa.exe
  2⤵
  PID:5856
- C:\Windows\System\IIkoZBV.exe
  C:\Windows\System\IIkoZBV.exe
  2⤵
  PID:5872
- C:\Windows\System\Iehbyfz.exe
  C:\Windows\System\Iehbyfz.exe
  2⤵
  PID:5888
- C:\Windows\System\sIdWOTE.exe
  C:\Windows\System\sIdWOTE.exe
  2⤵
  PID:5904
- C:\Windows\System\MMXkXuU.exe
  C:\Windows\System\MMXkXuU.exe
  2⤵
  PID:5920
- C:\Windows\System\OdVwpUc.exe
  C:\Windows\System\OdVwpUc.exe
  2⤵
  PID:5936
- C:\Windows\System\awKjveV.exe
  C:\Windows\System\awKjveV.exe
  2⤵
  PID:5952
- C:\Windows\System\rimHCzw.exe
  C:\Windows\System\rimHCzw.exe
  2⤵
  PID:5968
- C:\Windows\System\pCpuzQb.exe
  C:\Windows\System\pCpuzQb.exe
  2⤵
  PID:5984
- C:\Windows\System\qxxMSUu.exe
  C:\Windows\System\qxxMSUu.exe
  2⤵
  PID:6000
- C:\Windows\System\DFzvBRd.exe
  C:\Windows\System\DFzvBRd.exe
  2⤵
  PID:6016
- C:\Windows\System\hRsXaxh.exe
  C:\Windows\System\hRsXaxh.exe
  2⤵
  PID:6032
- C:\Windows\System\yhYQzVZ.exe
  C:\Windows\System\yhYQzVZ.exe
  2⤵
  PID:6048
- C:\Windows\System\hIOdgaF.exe
  C:\Windows\System\hIOdgaF.exe
  2⤵
  PID:6064
- C:\Windows\System\lLmHYqK.exe
  C:\Windows\System\lLmHYqK.exe
  2⤵
  PID:6080
- C:\Windows\System\foxEbUg.exe
  C:\Windows\System\foxEbUg.exe
  2⤵
  PID:6096
- C:\Windows\System\FzJMPcv.exe
  C:\Windows\System\FzJMPcv.exe
  2⤵
  PID:6112
- C:\Windows\System\iNHpjtp.exe
  C:\Windows\System\iNHpjtp.exe
  2⤵
  PID:6128
- C:\Windows\System\lrtqwqj.exe
  C:\Windows\System\lrtqwqj.exe
  2⤵
  PID:4388
- C:\Windows\System\eptieQP.exe
  C:\Windows\System\eptieQP.exe
  2⤵
  PID:4792
- C:\Windows\System\UdarWtQ.exe
  C:\Windows\System\UdarWtQ.exe
  2⤵
  PID:5148
- C:\Windows\System\shOYDYR.exe
  C:\Windows\System\shOYDYR.exe
  2⤵
  PID:4208
- C:\Windows\System\xzoGqbD.exe
  C:\Windows\System\xzoGqbD.exe
  2⤵
  PID:5008
- C:\Windows\System\GTrZKFu.exe
  C:\Windows\System\GTrZKFu.exe
  2⤵
  PID:4260
- C:\Windows\System\NRHgicy.exe
  C:\Windows\System\NRHgicy.exe
  2⤵
  PID:5292
- C:\Windows\System\YkFYHZf.exe
  C:\Windows\System\YkFYHZf.exe
  2⤵
  PID:5360
- C:\Windows\System\oRxKxFS.exe
  C:\Windows\System\oRxKxFS.exe
  2⤵
  PID:5376
- C:\Windows\System\xdykrtd.exe
  C:\Windows\System\xdykrtd.exe
  2⤵
  PID:5384
- C:\Windows\System\zGwhgWF.exe
  C:\Windows\System\zGwhgWF.exe
  2⤵
  PID:5400
- C:\Windows\System\bVftwjP.exe
  C:\Windows\System\bVftwjP.exe
  2⤵
  PID:5412
- C:\Windows\System\XFIgawk.exe
  C:\Windows\System\XFIgawk.exe
  2⤵
  PID:5432
- C:\Windows\System\dnhfVHK.exe
  C:\Windows\System\dnhfVHK.exe
  2⤵
  PID:5312
- C:\Windows\System\tyeqFRH.exe
  C:\Windows\System\tyeqFRH.exe
  2⤵
  PID:5344
- C:\Windows\System\QOGhUhv.exe
  C:\Windows\System\QOGhUhv.exe
  2⤵
  PID:5488
- C:\Windows\System\rtzfrki.exe
  C:\Windows\System\rtzfrki.exe
  2⤵
  PID:5620
- C:\Windows\System\AYFXSJG.exe
  C:\Windows\System\AYFXSJG.exe
  2⤵
  PID:5556
- C:\Windows\System\kzovIVR.exe
  C:\Windows\System\kzovIVR.exe
  2⤵
  PID:5080
- C:\Windows\System\pLpTagg.exe
  C:\Windows\System\pLpTagg.exe
  2⤵
  PID:4136
- C:\Windows\System\FyFUuSt.exe
  C:\Windows\System\FyFUuSt.exe
  2⤵
  PID:5308
- C:\Windows\System\hIcDlgg.exe
  C:\Windows\System\hIcDlgg.exe
  2⤵
  PID:5104
- C:\Windows\System\FqucyJb.exe
  C:\Windows\System\FqucyJb.exe
  2⤵
  PID:5208
- C:\Windows\System\wvgYMMF.exe
  C:\Windows\System\wvgYMMF.exe
  2⤵
  PID:5348
- C:\Windows\System\gTEkmCm.exe
  C:\Windows\System\gTEkmCm.exe
  2⤵
  PID:5500
- C:\Windows\System\bVunXYi.exe
  C:\Windows\System\bVunXYi.exe
  2⤵
  PID:5540
- C:\Windows\System\gGpAEai.exe
  C:\Windows\System\gGpAEai.exe
  2⤵
  PID:5632
- C:\Windows\System\tMOHQPU.exe
  C:\Windows\System\tMOHQPU.exe
  2⤵
  PID:5644
- C:\Windows\System\jippRMH.exe
  C:\Windows\System\jippRMH.exe
  2⤵
  PID:5664
- C:\Windows\System\rNMSGyw.exe
  C:\Windows\System\rNMSGyw.exe
  2⤵
  PID:5680
- C:\Windows\System\RDGUNjH.exe
  C:\Windows\System\RDGUNjH.exe
  2⤵
  PID:5736
- C:\Windows\System\ajyCant.exe
  C:\Windows\System\ajyCant.exe
  2⤵
  PID:5752
- C:\Windows\System\vmBNYEG.exe
  C:\Windows\System\vmBNYEG.exe
  2⤵
  PID:5816
- C:\Windows\System\npzhGsw.exe
  C:\Windows\System\npzhGsw.exe
  2⤵
  PID:5832
- C:\Windows\System\QPXrLCR.exe
  C:\Windows\System\QPXrLCR.exe
  2⤵
  PID:5836
- C:\Windows\System\ywkYSQZ.exe
  C:\Windows\System\ywkYSQZ.exe
  2⤵
  PID:5884
- C:\Windows\System\NdlIMUp.exe
  C:\Windows\System\NdlIMUp.exe
  2⤵
  PID:5928
- C:\Windows\System\IGgEUsG.exe
  C:\Windows\System\IGgEUsG.exe
  2⤵
  PID:5944
- C:\Windows\System\SVqrGMS.exe
  C:\Windows\System\SVqrGMS.exe
  2⤵
  PID:5976
- C:\Windows\System\WDQGfNT.exe
  C:\Windows\System\WDQGfNT.exe
  2⤵
  PID:6012
- C:\Windows\System\AEPSLNm.exe
  C:\Windows\System\AEPSLNm.exe
  2⤵
  PID:6044
- C:\Windows\System\XGVGPMc.exe
  C:\Windows\System\XGVGPMc.exe
  2⤵
  PID:6076
- C:\Windows\System\ASDCPYu.exe
  C:\Windows\System\ASDCPYu.exe
  2⤵
  PID:6108
- C:\Windows\System\MqnbYUk.exe
  C:\Windows\System\MqnbYUk.exe
  2⤵
  PID:6140
- C:\Windows\System\qMVSUzg.exe
  C:\Windows\System\qMVSUzg.exe
  2⤵
  PID:2180
- C:\Windows\System\nmpeQOD.exe
  C:\Windows\System\nmpeQOD.exe
  2⤵
  PID:5164
- C:\Windows\System\eZBVJtP.exe
  C:\Windows\System\eZBVJtP.exe
  2⤵
  PID:5260
- C:\Windows\System\nqqGRPJ.exe
  C:\Windows\System\nqqGRPJ.exe
  2⤵
  PID:5372
- C:\Windows\System\WjsnoLL.exe
  C:\Windows\System\WjsnoLL.exe
  2⤵
  PID:5392
- C:\Windows\System\DtvgTFM.exe
  C:\Windows\System\DtvgTFM.exe
  2⤵
  PID:5364
- C:\Windows\System\FBOSGEf.exe
  C:\Windows\System\FBOSGEf.exe
  2⤵
  PID:5456
- C:\Windows\System\BLBqavA.exe
  C:\Windows\System\BLBqavA.exe
  2⤵
  PID:5424
- C:\Windows\System\MqmtLji.exe
  C:\Windows\System\MqmtLji.exe
  2⤵
  PID:5880
- C:\Windows\System\DFlNKHZ.exe
  C:\Windows\System\DFlNKHZ.exe
  2⤵
  PID:6008
- C:\Windows\System\IolGzFL.exe
  C:\Windows\System\IolGzFL.exe
  2⤵
  PID:5960
- C:\Windows\System\VyHLaXn.exe
  C:\Windows\System\VyHLaXn.exe
  2⤵
  PID:6092
- C:\Windows\System\ddvKFNL.exe
  C:\Windows\System\ddvKFNL.exe
  2⤵
  PID:6136
- C:\Windows\System\eAqDnfX.exe
  C:\Windows\System\eAqDnfX.exe
  2⤵
  PID:5328
- C:\Windows\System\duuXGTj.exe
  C:\Windows\System\duuXGTj.exe
  2⤵
  PID:4404
- C:\Windows\System\qFqADXd.exe
  C:\Windows\System\qFqADXd.exe
  2⤵
  PID:5396
- C:\Windows\System\vLkGezb.exe
  C:\Windows\System\vLkGezb.exe
  2⤵
  PID:5520
- C:\Windows\System\aIoLhDz.exe
  C:\Windows\System\aIoLhDz.exe
  2⤵
  PID:5244
- C:\Windows\System\QqFcrhU.exe
  C:\Windows\System\QqFcrhU.exe
  2⤵
  PID:5588
- C:\Windows\System\nkhAkdU.exe
  C:\Windows\System\nkhAkdU.exe
  2⤵
  PID:5420
- C:\Windows\System\rVSNQTQ.exe
  C:\Windows\System\rVSNQTQ.exe
  2⤵
  PID:4796
- C:\Windows\System\KuhpFlk.exe
  C:\Windows\System\KuhpFlk.exe
  2⤵
  PID:5472
- C:\Windows\System\kyHCWIr.exe
  C:\Windows\System\kyHCWIr.exe
  2⤵
  PID:5536
- C:\Windows\System\EoVlTuO.exe
  C:\Windows\System\EoVlTuO.exe
  2⤵
  PID:5740
- C:\Windows\System\SncbXii.exe
  C:\Windows\System\SncbXii.exe
  2⤵
  PID:5704
- C:\Windows\System\oRavCsB.exe
  C:\Windows\System\oRavCsB.exe
  2⤵
  PID:5804
- C:\Windows\System\QOdwdVc.exe
  C:\Windows\System\QOdwdVc.exe
  2⤵
  PID:5788
- C:\Windows\System\omRIHMp.exe
  C:\Windows\System\omRIHMp.exe
  2⤵
  PID:6072
- C:\Windows\System\FdhLuJX.exe
  C:\Windows\System\FdhLuJX.exe
  2⤵
  PID:5156
- C:\Windows\System\LJEJcoV.exe
  C:\Windows\System\LJEJcoV.exe
  2⤵
  PID:5380
- C:\Windows\System\KAMqVxY.exe
  C:\Windows\System\KAMqVxY.exe
  2⤵
  PID:5332
- C:\Windows\System\ErZieuQ.exe
  C:\Windows\System\ErZieuQ.exe
  2⤵
  PID:5584
- C:\Windows\System\WilMIiG.exe
  C:\Windows\System\WilMIiG.exe
  2⤵
  PID:5448
- C:\Windows\System\MjqLpGt.exe
  C:\Windows\System\MjqLpGt.exe
  2⤵
  PID:5468
- C:\Windows\System\StkTSmX.exe
  C:\Windows\System\StkTSmX.exe
  2⤵
  PID:5820
- C:\Windows\System\hZHGkkD.exe
  C:\Windows\System\hZHGkkD.exe
  2⤵
  PID:5996
- C:\Windows\System\vasaPkd.exe
  C:\Windows\System\vasaPkd.exe
  2⤵
  PID:5224
- C:\Windows\System\ZJVBpcl.exe
  C:\Windows\System\ZJVBpcl.exe
  2⤵
  PID:5864
- C:\Windows\System\ttMpTeJ.exe
  C:\Windows\System\ttMpTeJ.exe
  2⤵
  PID:5280
- C:\Windows\System\TZNyjBR.exe
  C:\Windows\System\TZNyjBR.exe
  2⤵
  PID:5532
- C:\Windows\System\CpMqukm.exe
  C:\Windows\System\CpMqukm.exe
  2⤵
  PID:5848
- C:\Windows\System\yjlqPQk.exe
  C:\Windows\System\yjlqPQk.exe
  2⤵
  PID:5636
- C:\Windows\System\WcBryjb.exe
  C:\Windows\System\WcBryjb.exe
  2⤵
  PID:6040
- C:\Windows\System\YuaYSGA.exe
  C:\Windows\System\YuaYSGA.exe
  2⤵
  PID:5692
- C:\Windows\System\FEjXbhR.exe
  C:\Windows\System\FEjXbhR.exe
  2⤵
  PID:5724
- C:\Windows\System\xnBUGBO.exe
  C:\Windows\System\xnBUGBO.exe
  2⤵
  PID:6156
- C:\Windows\System\orNcNQs.exe
  C:\Windows\System\orNcNQs.exe
  2⤵
  PID:6172
- C:\Windows\System\kxEkiNk.exe
  C:\Windows\System\kxEkiNk.exe
  2⤵
  PID:6244
- C:\Windows\System\JZoRVwN.exe
  C:\Windows\System\JZoRVwN.exe
  2⤵
  PID:6260
- C:\Windows\System\OqUxlIw.exe
  C:\Windows\System\OqUxlIw.exe
  2⤵
  PID:6276
- C:\Windows\System\RIGUPTO.exe
  C:\Windows\System\RIGUPTO.exe
  2⤵
  PID:6296
- C:\Windows\System\ZigInvI.exe
  C:\Windows\System\ZigInvI.exe
  2⤵
  PID:6312
- C:\Windows\System\THwhOJu.exe
  C:\Windows\System\THwhOJu.exe
  2⤵
  PID:6332
- C:\Windows\System\pSmDMjR.exe
  C:\Windows\System\pSmDMjR.exe
  2⤵
  PID:6348
- C:\Windows\System\sxEmnfp.exe
  C:\Windows\System\sxEmnfp.exe
  2⤵
  PID:6456
- C:\Windows\System\qpYVzAk.exe
  C:\Windows\System\qpYVzAk.exe
  2⤵
  PID:6480
- C:\Windows\System\kpEPBwl.exe
  C:\Windows\System\kpEPBwl.exe
  2⤵
  PID:6496
- C:\Windows\System\TfRHygc.exe
  C:\Windows\System\TfRHygc.exe
  2⤵
  PID:6512
- C:\Windows\System\XOfCEWP.exe
  C:\Windows\System\XOfCEWP.exe
  2⤵
  PID:6540
- C:\Windows\System\TjavtEQ.exe
  C:\Windows\System\TjavtEQ.exe
  2⤵
  PID:6556
- C:\Windows\System\IJDbdto.exe
  C:\Windows\System\IJDbdto.exe
  2⤵
  PID:6576
- C:\Windows\System\ScDUCGh.exe
  C:\Windows\System\ScDUCGh.exe
  2⤵
  PID:6592
- C:\Windows\System\Awddafo.exe
  C:\Windows\System\Awddafo.exe
  2⤵
  PID:6608
- C:\Windows\System\rYbOIvQ.exe
  C:\Windows\System\rYbOIvQ.exe
  2⤵
  PID:6624
- C:\Windows\System\SrQHQcN.exe
  C:\Windows\System\SrQHQcN.exe
  2⤵
  PID:6656
- C:\Windows\System\QcRqIQL.exe
  C:\Windows\System\QcRqIQL.exe
  2⤵
  PID:6672
- C:\Windows\System\UeBbrSB.exe
  C:\Windows\System\UeBbrSB.exe
  2⤵
  PID:6688
- C:\Windows\System\zlqZdnt.exe
  C:\Windows\System\zlqZdnt.exe
  2⤵
  PID:6724
- C:\Windows\System\ITjvXnx.exe
  C:\Windows\System\ITjvXnx.exe
  2⤵
  PID:6744
- C:\Windows\System\jHGpKBD.exe
  C:\Windows\System\jHGpKBD.exe
  2⤵
  PID:6760
- C:\Windows\System\OxavBkN.exe
  C:\Windows\System\OxavBkN.exe
  2⤵
  PID:6784
- C:\Windows\System\PvpJxTF.exe
  C:\Windows\System\PvpJxTF.exe
  2⤵
  PID:6800
- C:\Windows\System\PFoFXze.exe
  C:\Windows\System\PFoFXze.exe
  2⤵
  PID:6832
- C:\Windows\System\OLQSfrE.exe
  C:\Windows\System\OLQSfrE.exe
  2⤵
  PID:6848
- C:\Windows\System\bySbGNf.exe
  C:\Windows\System\bySbGNf.exe
  2⤵
  PID:6864
- C:\Windows\System\FUKfdAo.exe
  C:\Windows\System\FUKfdAo.exe
  2⤵
  PID:6880
- C:\Windows\System\ecGGjDf.exe
  C:\Windows\System\ecGGjDf.exe
  2⤵
  PID:6896
- C:\Windows\System\EILAkwd.exe
  C:\Windows\System\EILAkwd.exe
  2⤵
  PID:6920
- C:\Windows\System\qXxydBU.exe
  C:\Windows\System\qXxydBU.exe
  2⤵
  PID:6936
- C:\Windows\System\XGWzMZo.exe
  C:\Windows\System\XGWzMZo.exe
  2⤵
  PID:6952
- C:\Windows\System\GkoKoDj.exe
  C:\Windows\System\GkoKoDj.exe
  2⤵
  PID:6972
- C:\Windows\System\AjcOpfH.exe
  C:\Windows\System\AjcOpfH.exe
  2⤵
  PID:7000
- C:\Windows\System\lNaBmIJ.exe
  C:\Windows\System\lNaBmIJ.exe
  2⤵
  PID:7020
- C:\Windows\System\lAymlmv.exe
  C:\Windows\System\lAymlmv.exe
  2⤵
  PID:7036
- C:\Windows\System\tVrvqYf.exe
  C:\Windows\System\tVrvqYf.exe
  2⤵
  PID:7056
- C:\Windows\System\aPSabFM.exe
  C:\Windows\System\aPSabFM.exe
  2⤵
  PID:7072
- C:\Windows\System\Hhsours.exe
  C:\Windows\System\Hhsours.exe
  2⤵
  PID:7088
- C:\Windows\System\rKYaRPG.exe
  C:\Windows\System\rKYaRPG.exe
  2⤵
  PID:7112
- C:\Windows\System\oXXFzvm.exe
  C:\Windows\System\oXXFzvm.exe
  2⤵
  PID:7148
- C:\Windows\System\JRhALgO.exe
  C:\Windows\System\JRhALgO.exe
  2⤵
  PID:7164
- C:\Windows\System\QDlyjUB.exe
  C:\Windows\System\QDlyjUB.exe
  2⤵
  PID:4976
- C:\Windows\System\KzcOFeM.exe
  C:\Windows\System\KzcOFeM.exe
  2⤵
  PID:6188
- C:\Windows\System\lAJjFvn.exe
  C:\Windows\System\lAJjFvn.exe
  2⤵
  PID:6216
- C:\Windows\System\rJkgtxd.exe
  C:\Windows\System\rJkgtxd.exe
  2⤵
  PID:6232
- C:\Windows\System\zhhyrwt.exe
  C:\Windows\System\zhhyrwt.exe
  2⤵
  PID:6256
- C:\Windows\System\tYnjAVU.exe
  C:\Windows\System\tYnjAVU.exe
  2⤵
  PID:6716
- C:\Windows\System\ezFueOs.exe
  C:\Windows\System\ezFueOs.exe
  2⤵
  PID:6904
- C:\Windows\System\VxDXpih.exe
  C:\Windows\System\VxDXpih.exe
  2⤵
  PID:6980
- C:\Windows\System\wZdmZSS.exe
  C:\Windows\System\wZdmZSS.exe
  2⤵
  PID:6268
- C:\Windows\System\sYKjDBb.exe
  C:\Windows\System\sYKjDBb.exe
  2⤵
  PID:7064
- C:\Windows\System\OutUhdH.exe
  C:\Windows\System\OutUhdH.exe
  2⤵
  PID:6452
- C:\Windows\System\IXEUAVV.exe
  C:\Windows\System\IXEUAVV.exe
  2⤵
  PID:6432
- C:\Windows\System\puhCbUL.exe
  C:\Windows\System\puhCbUL.exe
  2⤵
  PID:6376
- C:\Windows\System\tDVzKHE.exe
  C:\Windows\System\tDVzKHE.exe
  2⤵
  PID:6652
- C:\Windows\System\MIxVdtD.exe
  C:\Windows\System\MIxVdtD.exe
  2⤵
  PID:7048
- C:\Windows\System\ykClWNS.exe
  C:\Windows\System\ykClWNS.exe
  2⤵
  PID:6408
- C:\Windows\System\sWlHRoX.exe
  C:\Windows\System\sWlHRoX.exe
  2⤵
  PID:6568
- C:\Windows\System\NOSZKfD.exe
  C:\Windows\System\NOSZKfD.exe
  2⤵
  PID:6776
- C:\Windows\System\eUDyNxB.exe
  C:\Windows\System\eUDyNxB.exe
  2⤵
  PID:6444
- C:\Windows\System\bhzSoeB.exe
  C:\Windows\System\bhzSoeB.exe
  2⤵
  PID:6536
- C:\Windows\System\zfFVjfY.exe
  C:\Windows\System\zfFVjfY.exe
  2⤵
  PID:6684
- C:\Windows\System\foOwlDi.exe
  C:\Windows\System\foOwlDi.exe
  2⤵
  PID:6768
- C:\Windows\System\xAdiEHY.exe
  C:\Windows\System\xAdiEHY.exe
  2⤵
  PID:6816
- C:\Windows\System\gHcoZaG.exe
  C:\Windows\System\gHcoZaG.exe
  2⤵
  PID:6860
- C:\Windows\System\KNByoZS.exe
  C:\Windows\System\KNByoZS.exe
  2⤵
  PID:7012
- C:\Windows\System\OjDdaun.exe
  C:\Windows\System\OjDdaun.exe
  2⤵
  PID:7128
- C:\Windows\System\GDbpSzj.exe
  C:\Windows\System\GDbpSzj.exe
  2⤵
  PID:6200
- C:\Windows\System\tPfiuUe.exe
  C:\Windows\System\tPfiuUe.exe
  2⤵
  PID:7136
- C:\Windows\System\fmJgElT.exe
  C:\Windows\System\fmJgElT.exe
  2⤵
  PID:7096
- C:\Windows\System\ckbWBoc.exe
  C:\Windows\System\ckbWBoc.exe
  2⤵
  PID:6164
- C:\Windows\System\USpJUOp.exe
  C:\Windows\System\USpJUOp.exe
  2⤵
  PID:6220
- C:\Windows\System\FfCCBsc.exe
  C:\Windows\System\FfCCBsc.exe
  2⤵
  PID:6464
- C:\Windows\System\eoWrajs.exe
  C:\Windows\System\eoWrajs.exe
  2⤵
  PID:6504
- C:\Windows\System\RzShVhN.exe
  C:\Windows\System\RzShVhN.exe
  2⤵
  PID:6584
- C:\Windows\System\HxsTBsA.exe
  C:\Windows\System\HxsTBsA.exe
  2⤵
  PID:6792
- C:\Windows\System\qDorwnP.exe
  C:\Windows\System\qDorwnP.exe
  2⤵
  PID:6668
- C:\Windows\System\rIrjjnk.exe
  C:\Windows\System\rIrjjnk.exe
  2⤵
  PID:6712
- C:\Windows\System\RgzpNin.exe
  C:\Windows\System\RgzpNin.exe
  2⤵
  PID:6948
- C:\Windows\System\qyFhjAN.exe
  C:\Windows\System\qyFhjAN.exe
  2⤵
  PID:6304
- C:\Windows\System\VwqqdiU.exe
  C:\Windows\System\VwqqdiU.exe
  2⤵
  PID:6872
- C:\Windows\System\isjHrha.exe
  C:\Windows\System\isjHrha.exe
  2⤵
  PID:6996
- C:\Windows\System\EJzRXCh.exe
  C:\Windows\System\EJzRXCh.exe
  2⤵
  PID:6424
- C:\Windows\System\dePTDUe.exe
  C:\Windows\System\dePTDUe.exe
  2⤵
  PID:6644
- C:\Windows\System\YJnzcMr.exe
  C:\Windows\System\YJnzcMr.exe
  2⤵
  PID:6416
- C:\Windows\System\SXHQVAA.exe
  C:\Windows\System\SXHQVAA.exe
  2⤵
  PID:6436
- C:\Windows\System\teVWAzx.exe
  C:\Windows\System\teVWAzx.exe
  2⤵
  PID:6396
- C:\Windows\System\YJwDdhT.exe
  C:\Windows\System\YJwDdhT.exe
  2⤵
  PID:6736
- C:\Windows\System\cfIfUxd.exe
  C:\Windows\System\cfIfUxd.exe
  2⤵
  PID:6820
- C:\Windows\System\IoFOhTT.exe
  C:\Windows\System\IoFOhTT.exe
  2⤵
  PID:6600
- C:\Windows\System\zibakoJ.exe
  C:\Windows\System\zibakoJ.exe
  2⤵
  PID:1512
- C:\Windows\System\aNVNRIR.exe
  C:\Windows\System\aNVNRIR.exe
  2⤵
  PID:7124
- C:\Windows\System\jtNzobr.exe
  C:\Windows\System\jtNzobr.exe
  2⤵
  PID:7108
- C:\Windows\System\jmDQuMD.exe
  C:\Windows\System\jmDQuMD.exe
  2⤵
  PID:6344
- C:\Windows\System\PQepJsh.exe
  C:\Windows\System\PQepJsh.exe
  2⤵
  PID:6916
- C:\Windows\System\aiPFBZg.exe
  C:\Windows\System\aiPFBZg.exe
  2⤵
  PID:6700
- C:\Windows\System\iJYFJwC.exe
  C:\Windows\System\iJYFJwC.exe
  2⤵
  PID:6472
- C:\Windows\System\jRScVuT.exe
  C:\Windows\System\jRScVuT.exe
  2⤵
  PID:6448
- C:\Windows\System\khIlYnO.exe
  C:\Windows\System\khIlYnO.exe
  2⤵
  PID:6180
- C:\Windows\System\CBQYQbY.exe
  C:\Windows\System\CBQYQbY.exe
  2⤵
  PID:6420
- C:\Windows\System\YsmogIB.exe
  C:\Windows\System\YsmogIB.exe
  2⤵
  PID:6988
- C:\Windows\System\isVugsz.exe
  C:\Windows\System\isVugsz.exe
  2⤵
  PID:6636
- C:\Windows\System\pifzvaH.exe
  C:\Windows\System\pifzvaH.exe
  2⤵
  PID:6572
- C:\Windows\System\acfJSDm.exe
  C:\Windows\System\acfJSDm.exe
  2⤵
  PID:6808
- C:\Windows\System\ZIwdRUW.exe
  C:\Windows\System\ZIwdRUW.exe
  2⤵
  PID:6552
- C:\Windows\System\lpPxImG.exe
  C:\Windows\System\lpPxImG.exe
  2⤵
  PID:6184
- C:\Windows\System\EalxvfX.exe
  C:\Windows\System\EalxvfX.exe
  2⤵
  PID:6488
- C:\Windows\System\DlazBxs.exe
  C:\Windows\System\DlazBxs.exe
  2⤵
  PID:7172
- C:\Windows\System\fiWpwWx.exe
  C:\Windows\System\fiWpwWx.exe
  2⤵
  PID:7188
- C:\Windows\System\UlxTeAt.exe
  C:\Windows\System\UlxTeAt.exe
  2⤵
  PID:7204
- C:\Windows\System\cjVfYUx.exe
  C:\Windows\System\cjVfYUx.exe
  2⤵
  PID:7220
- C:\Windows\System\vpnRrFf.exe
  C:\Windows\System\vpnRrFf.exe
  2⤵
  PID:7236
- C:\Windows\System\Fygervw.exe
  C:\Windows\System\Fygervw.exe
  2⤵
  PID:7252
- C:\Windows\System\rJUOHpG.exe
  C:\Windows\System\rJUOHpG.exe
  2⤵
  PID:7268
- C:\Windows\System\HErvZtL.exe
  C:\Windows\System\HErvZtL.exe
  2⤵
  PID:7284
- C:\Windows\System\VAjlcCu.exe
  C:\Windows\System\VAjlcCu.exe
  2⤵
  PID:7380
- C:\Windows\System\oyItqWJ.exe
  C:\Windows\System\oyItqWJ.exe
  2⤵
  PID:7400
- C:\Windows\System\oyBvoXY.exe
  C:\Windows\System\oyBvoXY.exe
  2⤵
  PID:7416
- C:\Windows\System\WfJNCmx.exe
  C:\Windows\System\WfJNCmx.exe
  2⤵
  PID:7432
- C:\Windows\System\XYMVzMX.exe
  C:\Windows\System\XYMVzMX.exe
  2⤵
  PID:7448
- C:\Windows\System\GcMAmCm.exe
  C:\Windows\System\GcMAmCm.exe
  2⤵
  PID:7468
- C:\Windows\System\oRvljkg.exe
  C:\Windows\System\oRvljkg.exe
  2⤵
  PID:7484
- C:\Windows\System\vzBsWea.exe
  C:\Windows\System\vzBsWea.exe
  2⤵
  PID:7500
- C:\Windows\System\RzaBwFc.exe
  C:\Windows\System\RzaBwFc.exe
  2⤵
  PID:7516
- C:\Windows\System\vUuNuAi.exe
  C:\Windows\System\vUuNuAi.exe
  2⤵
  PID:7536
- C:\Windows\System\ylGFPyS.exe
  C:\Windows\System\ylGFPyS.exe
  2⤵
  PID:7552
- C:\Windows\System\wWYtVmG.exe
  C:\Windows\System\wWYtVmG.exe
  2⤵
  PID:7568
- C:\Windows\System\JAxVDpm.exe
  C:\Windows\System\JAxVDpm.exe
  2⤵
  PID:7584
- C:\Windows\System\WhQiCxS.exe
  C:\Windows\System\WhQiCxS.exe
  2⤵
  PID:7600
- C:\Windows\System\scJyEbF.exe
  C:\Windows\System\scJyEbF.exe
  2⤵
  PID:7616
- C:\Windows\System\IsVXhoS.exe
  C:\Windows\System\IsVXhoS.exe
  2⤵
  PID:7632
- C:\Windows\System\gKDhTuf.exe
  C:\Windows\System\gKDhTuf.exe
  2⤵
  PID:7648
- C:\Windows\System\RZaXvEa.exe
  C:\Windows\System\RZaXvEa.exe
  2⤵
  PID:7664
- C:\Windows\System\JqDaePz.exe
  C:\Windows\System\JqDaePz.exe
  2⤵
  PID:7680
- C:\Windows\System\mBGqEwL.exe
  C:\Windows\System\mBGqEwL.exe
  2⤵
  PID:7696
- C:\Windows\System\ijNwTYo.exe
  C:\Windows\System\ijNwTYo.exe
  2⤵
  PID:7712
- C:\Windows\System\LVcFqkv.exe
  C:\Windows\System\LVcFqkv.exe
  2⤵
  PID:7728
- C:\Windows\System\qqbZuGa.exe
  C:\Windows\System\qqbZuGa.exe
  2⤵
  PID:7744
- C:\Windows\System\wYoaNFu.exe
  C:\Windows\System\wYoaNFu.exe
  2⤵
  PID:7760
- C:\Windows\System\lvUHlFP.exe
  C:\Windows\System\lvUHlFP.exe
  2⤵
  PID:7776
- C:\Windows\System\XyUApmp.exe
  C:\Windows\System\XyUApmp.exe
  2⤵
  PID:7792
- C:\Windows\System\VviZYnf.exe
  C:\Windows\System\VviZYnf.exe
  2⤵
  PID:7808
- C:\Windows\System\ubfzzer.exe
  C:\Windows\System\ubfzzer.exe
  2⤵
  PID:7824
- C:\Windows\System\QWUWdqu.exe
  C:\Windows\System\QWUWdqu.exe
  2⤵
  PID:7840
- C:\Windows\System\RuHtABg.exe
  C:\Windows\System\RuHtABg.exe
  2⤵
  PID:7860
- C:\Windows\System\CHXYrHA.exe
  C:\Windows\System\CHXYrHA.exe
  2⤵
  PID:7876
- C:\Windows\System\upIQFbJ.exe
  C:\Windows\System\upIQFbJ.exe
  2⤵
  PID:7892
- C:\Windows\System\hzaOEaY.exe
  C:\Windows\System\hzaOEaY.exe
  2⤵
  PID:7924
- C:\Windows\System\vAPiKCz.exe
  C:\Windows\System\vAPiKCz.exe
  2⤵
  PID:8008
- C:\Windows\System\QUjVfwK.exe
  C:\Windows\System\QUjVfwK.exe
  2⤵
  PID:8024
- C:\Windows\System\FjCbBkY.exe
  C:\Windows\System\FjCbBkY.exe
  2⤵
  PID:8040
- C:\Windows\System\qWuOfyY.exe
  C:\Windows\System\qWuOfyY.exe
  2⤵
  PID:8056
- C:\Windows\System\tyjITac.exe
  C:\Windows\System\tyjITac.exe
  2⤵
  PID:8072
- C:\Windows\System\egXjCIo.exe
  C:\Windows\System\egXjCIo.exe
  2⤵
  PID:8088
- C:\Windows\System\ltXBZCW.exe
  C:\Windows\System\ltXBZCW.exe
  2⤵
  PID:8104
- C:\Windows\System\xRxTZXB.exe
  C:\Windows\System\xRxTZXB.exe
  2⤵
  PID:8120
- C:\Windows\System\ECOMWpt.exe
  C:\Windows\System\ECOMWpt.exe
  2⤵
  PID:8136
- C:\Windows\System\nDSOkko.exe
  C:\Windows\System\nDSOkko.exe
  2⤵
  PID:8152
- C:\Windows\System\KOKbLzk.exe
  C:\Windows\System\KOKbLzk.exe
  2⤵
  PID:8168
- C:\Windows\System\vovYCKk.exe
  C:\Windows\System\vovYCKk.exe
  2⤵
  PID:8184
- C:\Windows\System\ndkTbJo.exe
  C:\Windows\System\ndkTbJo.exe
  2⤵
  PID:7180
- C:\Windows\System\uavZvjd.exe
  C:\Windows\System\uavZvjd.exe
  2⤵
  PID:7100
- C:\Windows\System\litGmaF.exe
  C:\Windows\System\litGmaF.exe
  2⤵
  PID:7244
- C:\Windows\System\hPqGkZj.exe
  C:\Windows\System\hPqGkZj.exe
  2⤵
  PID:6152
- C:\Windows\System\fKloBtm.exe
  C:\Windows\System\fKloBtm.exe
  2⤵
  PID:6756
- C:\Windows\System\bQmzDUA.exe
  C:\Windows\System\bQmzDUA.exe
  2⤵
  PID:6392
- C:\Windows\System\KhHDLwz.exe
  C:\Windows\System\KhHDLwz.exe
  2⤵
  PID:6928
- C:\Windows\System\CWiPYpB.exe
  C:\Windows\System\CWiPYpB.exe
  2⤵
  PID:7196
- C:\Windows\System\LiwNwFM.exe
  C:\Windows\System\LiwNwFM.exe
  2⤵
  PID:7260
- C:\Windows\System\wDDqYvw.exe
  C:\Windows\System\wDDqYvw.exe
  2⤵
  PID:7300
- C:\Windows\System\QZwClii.exe
  C:\Windows\System\QZwClii.exe
  2⤵
  PID:7316
- C:\Windows\System\FAjSajE.exe
  C:\Windows\System\FAjSajE.exe
  2⤵
  PID:7332
- C:\Windows\System\pjWrPMl.exe
  C:\Windows\System\pjWrPMl.exe
  2⤵
  PID:7348
- C:\Windows\System\oLyOmpe.exe
  C:\Windows\System\oLyOmpe.exe
  2⤵
  PID:7364
- C:\Windows\System\nmDvkcZ.exe
  C:\Windows\System\nmDvkcZ.exe
  2⤵
  PID:7392
- C:\Windows\System\NbfvPPV.exe
  C:\Windows\System\NbfvPPV.exe
  2⤵
  PID:7408
- C:\Windows\System\VGlFucQ.exe
  C:\Windows\System\VGlFucQ.exe
  2⤵
  PID:7508
- C:\Windows\System\DOlocqq.exe
  C:\Windows\System\DOlocqq.exe
  2⤵
  PID:7424
- C:\Windows\System\kgyArwf.exe
  C:\Windows\System\kgyArwf.exe
  2⤵
  PID:7492
- C:\Windows\System\ysguYYE.exe
  C:\Windows\System\ysguYYE.exe
  2⤵
  PID:7528
- C:\Windows\System\FtbvEgh.exe
  C:\Windows\System\FtbvEgh.exe
  2⤵
  PID:7596
- C:\Windows\System\TZRjKCa.exe
  C:\Windows\System\TZRjKCa.exe
  2⤵
  PID:7756
- C:\Windows\System\eiGerBA.exe
  C:\Windows\System\eiGerBA.exe
  2⤵
  PID:7692
- C:\Windows\System\fNJTobI.exe
  C:\Windows\System\fNJTobI.exe
  2⤵
  PID:7908
- C:\Windows\System\FeZCYcs.exe
  C:\Windows\System\FeZCYcs.exe
  2⤵
  PID:7884
- C:\Windows\System\slggYOI.exe
  C:\Windows\System\slggYOI.exe
  2⤵
  PID:7948
- C:\Windows\System\CUeRpwh.exe
  C:\Windows\System\CUeRpwh.exe
  2⤵
  PID:7964
- C:\Windows\System\AESsQie.exe
  C:\Windows\System\AESsQie.exe
  2⤵
  PID:7980
- C:\Windows\System\cQEPWey.exe
  C:\Windows\System\cQEPWey.exe
  2⤵
  PID:7996
- C:\Windows\System\DiSMbKa.exe
  C:\Windows\System\DiSMbKa.exe
  2⤵
  PID:7932
- C:\Windows\System\hnfwWxA.exe
  C:\Windows\System\hnfwWxA.exe
  2⤵
  PID:8068
- C:\Windows\System\btLmJhB.exe
  C:\Windows\System\btLmJhB.exe
  2⤵
  PID:8132
- C:\Windows\System\mLgwgQg.exe
  C:\Windows\System\mLgwgQg.exe
  2⤵
  PID:8080
- C:\Windows\System\wLcgYit.exe
  C:\Windows\System\wLcgYit.exe
  2⤵
  PID:6532
- C:\Windows\System\PZoKHpK.exe
  C:\Windows\System\PZoKHpK.exe
  2⤵
  PID:6960
- C:\Windows\System\lXOMhFO.exe
  C:\Windows\System\lXOMhFO.exe
  2⤵
  PID:8084
- C:\Windows\System\WzvGjjH.exe
  C:\Windows\System\WzvGjjH.exe
  2⤵
  PID:6524
- C:\Windows\System\essPiOd.exe
  C:\Windows\System\essPiOd.exe
  2⤵
  PID:7308
- C:\Windows\System\HaiOJyo.exe
  C:\Windows\System\HaiOJyo.exe
  2⤵
  PID:7372
- C:\Windows\System\oRmwhTA.exe
  C:\Windows\System\oRmwhTA.exe
  2⤵
  PID:6288
- C:\Windows\System\PuNfQKw.exe
  C:\Windows\System\PuNfQKw.exe
  2⤵
  PID:7460
- C:\Windows\System\jxqtqMn.exe
  C:\Windows\System\jxqtqMn.exe
  2⤵
  PID:8180
- C:\Windows\System\ERYIjjb.exe
  C:\Windows\System\ERYIjjb.exe
  2⤵
  PID:7120
- C:\Windows\System\fIhSnBb.exe
  C:\Windows\System\fIhSnBb.exe
  2⤵
  PID:7944
- C:\Windows\System\deBbRkc.exe
  C:\Windows\System\deBbRkc.exe
  2⤵
  PID:7888
- C:\Windows\System\ftRjbAj.exe
  C:\Windows\System\ftRjbAj.exe
  2⤵
  PID:7856
- C:\Windows\System\LMIkjPq.exe
  C:\Windows\System\LMIkjPq.exe
  2⤵
  PID:7232
- C:\Windows\System\PnJUDXe.exe
  C:\Windows\System\PnJUDXe.exe
  2⤵
  PID:8176
- C:\Windows\System\gPVwHpl.exe
  C:\Windows\System\gPVwHpl.exe
  2⤵
  PID:7920
- C:\Windows\System\fatPCXG.exe
  C:\Windows\System\fatPCXG.exe
  2⤵
  PID:7496
- C:\Windows\System\VlKcejd.exe
  C:\Windows\System\VlKcejd.exe
  2⤵
  PID:7960
- C:\Windows\System\QPRhGQB.exe
  C:\Windows\System\QPRhGQB.exe
  2⤵
  PID:7992
- C:\Windows\System\DoVkfef.exe
  C:\Windows\System\DoVkfef.exe
  2⤵
  PID:8052
- C:\Windows\System\egDxWqd.exe
  C:\Windows\System\egDxWqd.exe
  2⤵
  PID:7396
- C:\Windows\System\crWoiVs.exe
  C:\Windows\System\crWoiVs.exe
  2⤵
  PID:7476
- C:\Windows\System\pbqbLmt.exe
  C:\Windows\System\pbqbLmt.exe
  2⤵
  PID:7296
- C:\Windows\System\JcSgLZl.exe
  C:\Windows\System\JcSgLZl.exe
  2⤵
  PID:6212
- C:\Windows\System\iITlLEU.exe
  C:\Windows\System\iITlLEU.exe
  2⤵
  PID:7628
- C:\Windows\System\RBxjlTz.exe
  C:\Windows\System\RBxjlTz.exe
  2⤵
  PID:7580
- C:\Windows\System\HYtmOOr.exe
  C:\Windows\System\HYtmOOr.exe
  2⤵
  PID:8128
- C:\Windows\System\pcRSkyT.exe
  C:\Windows\System\pcRSkyT.exe
  2⤵
  PID:7228
- C:\Windows\System\KoAAzwn.exe
  C:\Windows\System\KoAAzwn.exe
  2⤵
  PID:7852
- C:\Windows\System\AiihDyy.exe
  C:\Windows\System\AiihDyy.exe
  2⤵
  PID:8064
- C:\Windows\System\JzyyROV.exe
  C:\Windows\System\JzyyROV.exe
  2⤵
  PID:7480
- C:\Windows\System\LYIteKL.exe
  C:\Windows\System\LYIteKL.exe
  2⤵
  PID:8020
- C:\Windows\System\iHXTDWf.exe
  C:\Windows\System\iHXTDWf.exe
  2⤵
  PID:7524
- C:\Windows\System\SEEMwQE.exe
  C:\Windows\System\SEEMwQE.exe
  2⤵
  PID:7592
- C:\Windows\System\gAHzkNQ.exe
  C:\Windows\System\gAHzkNQ.exe
  2⤵
  PID:7356
- C:\Windows\System\jFheQlX.exe
  C:\Windows\System\jFheQlX.exe
  2⤵
  PID:7644
- C:\Windows\System\YIkQvOP.exe
  C:\Windows\System\YIkQvOP.exe
  2⤵
  PID:7704
- C:\Windows\System\TfyfAwl.exe
  C:\Windows\System\TfyfAwl.exe
  2⤵
  PID:7832
- C:\Windows\System\cIXjGyV.exe
  C:\Windows\System\cIXjGyV.exe
  2⤵
  PID:7820
- C:\Windows\System\Vqzppaz.exe
  C:\Windows\System\Vqzppaz.exe
  2⤵
  PID:7784
- C:\Windows\System\XyZxsGl.exe
  C:\Windows\System\XyZxsGl.exe
  2⤵
  PID:7940
- C:\Windows\System\BROdpUB.exe
  C:\Windows\System\BROdpUB.exe
  2⤵
  PID:7324
- C:\Windows\System\GePiAPK.exe
  C:\Windows\System\GePiAPK.exe
  2⤵
  PID:7560
- C:\Windows\System\MNoGoKR.exe
  C:\Windows\System\MNoGoKR.exe
  2⤵
  PID:8212
- C:\Windows\System\DseywCa.exe
  C:\Windows\System\DseywCa.exe
  2⤵
  PID:8228
- C:\Windows\System\xiZjClv.exe
  C:\Windows\System\xiZjClv.exe
  2⤵
  PID:8244
- C:\Windows\System\ZixFCns.exe
  C:\Windows\System\ZixFCns.exe
  2⤵
  PID:8260
- C:\Windows\System\INGEvan.exe
  C:\Windows\System\INGEvan.exe
  2⤵
  PID:8276
- C:\Windows\System\FrVQpWV.exe
  C:\Windows\System\FrVQpWV.exe
  2⤵
  PID:8292
- C:\Windows\System\aRDDbFM.exe
  C:\Windows\System\aRDDbFM.exe
  2⤵
  PID:8308
- C:\Windows\System\zUKHFSE.exe
  C:\Windows\System\zUKHFSE.exe
  2⤵
  PID:8324
- C:\Windows\System\fRwnAmZ.exe
  C:\Windows\System\fRwnAmZ.exe
  2⤵
  PID:8340
- C:\Windows\System\gmefGxH.exe
  C:\Windows\System\gmefGxH.exe
  2⤵
  PID:8356
- C:\Windows\System\FfCPSgy.exe
  C:\Windows\System\FfCPSgy.exe
  2⤵
  PID:8372
- C:\Windows\System\ZjYPkTJ.exe
  C:\Windows\System\ZjYPkTJ.exe
  2⤵
  PID:8388
- C:\Windows\System\KfTICHk.exe
  C:\Windows\System\KfTICHk.exe
  2⤵
  PID:8404
- C:\Windows\System\WxrxgfJ.exe
  C:\Windows\System\WxrxgfJ.exe
  2⤵
  PID:8420
- C:\Windows\System\uGYDDUI.exe
  C:\Windows\System\uGYDDUI.exe
  2⤵
  PID:8436
- C:\Windows\System\eQuaGTJ.exe
  C:\Windows\System\eQuaGTJ.exe
  2⤵
  PID:8452
- C:\Windows\System\uQMSmyC.exe
  C:\Windows\System\uQMSmyC.exe
  2⤵
  PID:8468
- C:\Windows\System\oNLwNec.exe
  C:\Windows\System\oNLwNec.exe
  2⤵
  PID:8484
- C:\Windows\System\kGZsgdN.exe
  C:\Windows\System\kGZsgdN.exe
  2⤵
  PID:8500
- C:\Windows\System\mWqIyEQ.exe
  C:\Windows\System\mWqIyEQ.exe
  2⤵
  PID:8516
- C:\Windows\System\pDhCUAo.exe
  C:\Windows\System\pDhCUAo.exe
  2⤵
  PID:8532
- C:\Windows\System\FyVHKFB.exe
  C:\Windows\System\FyVHKFB.exe
  2⤵
  PID:8548
- C:\Windows\System\fHmDpkV.exe
  C:\Windows\System\fHmDpkV.exe
  2⤵
  PID:8564
- C:\Windows\System\uXGXFxW.exe
  C:\Windows\System\uXGXFxW.exe
  2⤵
  PID:8580
- C:\Windows\System\FWmXuAA.exe
  C:\Windows\System\FWmXuAA.exe
  2⤵
  PID:8596
- C:\Windows\System\SkJIOeh.exe
  C:\Windows\System\SkJIOeh.exe
  2⤵
  PID:8720
- C:\Windows\System\uJFiKIG.exe
  C:\Windows\System\uJFiKIG.exe
  2⤵
  PID:8736
- C:\Windows\System\wACyuyx.exe
  C:\Windows\System\wACyuyx.exe
  2⤵
  PID:8752
- C:\Windows\System\DOLxXbT.exe
  C:\Windows\System\DOLxXbT.exe
  2⤵
  PID:8768
- C:\Windows\System\lwHzdlt.exe
  C:\Windows\System\lwHzdlt.exe
  2⤵
  PID:8788
- C:\Windows\System\CDGfZMQ.exe
  C:\Windows\System\CDGfZMQ.exe
  2⤵
  PID:8932
- C:\Windows\System\MQCRNPe.exe
  C:\Windows\System\MQCRNPe.exe
  2⤵
  PID:8952
- C:\Windows\System\hqwcMRy.exe
  C:\Windows\System\hqwcMRy.exe
  2⤵
  PID:8968
- C:\Windows\System\DlTkHCS.exe
  C:\Windows\System\DlTkHCS.exe
  2⤵
  PID:8984
- C:\Windows\System\KkcuHcH.exe
  C:\Windows\System\KkcuHcH.exe
  2⤵
  PID:9000
- C:\Windows\System\rpozUjH.exe
  C:\Windows\System\rpozUjH.exe
  2⤵
  PID:9016
- C:\Windows\System\nDaCQtd.exe
  C:\Windows\System\nDaCQtd.exe
  2⤵
  PID:9032
- C:\Windows\System\tRJbIrc.exe
  C:\Windows\System\tRJbIrc.exe
  2⤵
  PID:9048
- C:\Windows\System\GXqBWmy.exe
  C:\Windows\System\GXqBWmy.exe
  2⤵
  PID:9064
- C:\Windows\System\Pypcarg.exe
  C:\Windows\System\Pypcarg.exe
  2⤵
  PID:9084
- C:\Windows\System\vwFyLRT.exe
  C:\Windows\System\vwFyLRT.exe
  2⤵
  PID:9100
- C:\Windows\System\nyoZGEv.exe
  C:\Windows\System\nyoZGEv.exe
  2⤵
  PID:9116
- C:\Windows\System\bKjFBnG.exe
  C:\Windows\System\bKjFBnG.exe
  2⤵
  PID:9144
- C:\Windows\System\IFUyrAC.exe
  C:\Windows\System\IFUyrAC.exe
  2⤵
  PID:9168
- C:\Windows\System\ZwaUssF.exe
  C:\Windows\System\ZwaUssF.exe
  2⤵
  PID:9188
- C:\Windows\System\GYNNHaN.exe
  C:\Windows\System\GYNNHaN.exe
  2⤵
  PID:8004
- C:\Windows\System\GBNehfw.exe
  C:\Windows\System\GBNehfw.exe
  2⤵
  PID:7576
- C:\Windows\System\VBZzwqL.exe
  C:\Windows\System\VBZzwqL.exe
  2⤵
  PID:8204
- C:\Windows\System\ETealty.exe
  C:\Windows\System\ETealty.exe
  2⤵
  PID:7800
- C:\Windows\System\EjDFgYt.exe
  C:\Windows\System\EjDFgYt.exe
  2⤵
  PID:8268
- C:\Windows\System\JljmwPV.exe
  C:\Windows\System\JljmwPV.exe
  2⤵
  PID:7640
- C:\Windows\System\sLztXMG.exe
  C:\Windows\System\sLztXMG.exe
  2⤵
  PID:7836
- C:\Windows\System\alBKKxI.exe
  C:\Windows\System\alBKKxI.exe
  2⤵
  PID:8256
- C:\Windows\System\PtBPDcd.exe
  C:\Windows\System\PtBPDcd.exe
  2⤵
  PID:8364
- C:\Windows\System\BrsUlwY.exe
  C:\Windows\System\BrsUlwY.exe
  2⤵
  PID:8400
- C:\Windows\System\GPRzuBj.exe
  C:\Windows\System\GPRzuBj.exe
  2⤵
  PID:8460
- C:\Windows\System\ooHhrPs.exe
  C:\Windows\System\ooHhrPs.exe
  2⤵
  PID:8496
- C:\Windows\System\sqFZEUU.exe
  C:\Windows\System\sqFZEUU.exe
  2⤵
  PID:8352
- C:\Windows\System\OjuCygd.exe
  C:\Windows\System\OjuCygd.exe
  2⤵
  PID:8444
- C:\Windows\System\ynFfemy.exe
  C:\Windows\System\ynFfemy.exe
  2⤵
  PID:8592
- C:\Windows\System\HFTZyRJ.exe
  C:\Windows\System\HFTZyRJ.exe
  2⤵
  PID:8576
- C:\Windows\System\YiNxSUb.exe
  C:\Windows\System\YiNxSUb.exe
  2⤵
  PID:8616
- C:\Windows\System\TpdCMQU.exe
  C:\Windows\System\TpdCMQU.exe
  2⤵
  PID:8632
- C:\Windows\System\DrAQnDB.exe
  C:\Windows\System\DrAQnDB.exe
  2⤵
  PID:8656
- C:\Windows\System\sUtXpyy.exe
  C:\Windows\System\sUtXpyy.exe
  2⤵
  PID:8704
- C:\Windows\System\FADdyEU.exe
  C:\Windows\System\FADdyEU.exe
  2⤵
  PID:8636
- C:\Windows\System\yOwKlXf.exe
  C:\Windows\System\yOwKlXf.exe
  2⤵
  PID:8760
- C:\Windows\System\NWuKseT.exe
  C:\Windows\System\NWuKseT.exe
  2⤵
  PID:8808
- C:\Windows\System\NaEDsVI.exe
  C:\Windows\System\NaEDsVI.exe
  2⤵
  PID:8828
- C:\Windows\System\LJWhlVi.exe
  C:\Windows\System\LJWhlVi.exe
  2⤵
  PID:8848
- C:\Windows\System\RLbXTFI.exe
  C:\Windows\System\RLbXTFI.exe
  2⤵
  PID:8880
- C:\Windows\System\jCXgfiG.exe
  C:\Windows\System\jCXgfiG.exe
  2⤵
  PID:8864
- C:\Windows\System\nNTZHWt.exe
  C:\Windows\System\nNTZHWt.exe
  2⤵
  PID:8896
- C:\Windows\System\JhWjiJW.exe
  C:\Windows\System\JhWjiJW.exe
  2⤵
  PID:8912
- C:\Windows\System\PjzvFJx.exe
  C:\Windows\System\PjzvFJx.exe
  2⤵
  PID:8992
- C:\Windows\System\LBuQUPf.exe
  C:\Windows\System\LBuQUPf.exe
  2⤵
  PID:9024
- C:\Windows\System\jDESOmP.exe
  C:\Windows\System\jDESOmP.exe
  2⤵
  PID:8944
- C:\Windows\System\FiYYjTW.exe
  C:\Windows\System\FiYYjTW.exe
  2⤵
  PID:9044
- C:\Windows\System\zltDwbz.exe
  C:\Windows\System\zltDwbz.exe
  2⤵
  PID:9076
- C:\Windows\System\jqyHwlm.exe
  C:\Windows\System\jqyHwlm.exe
  2⤵
  PID:9008
- C:\Windows\System\GRySgRC.exe
  C:\Windows\System\GRySgRC.exe
  2⤵
  PID:9180
- C:\Windows\System\MssnkfN.exe
  C:\Windows\System\MssnkfN.exe
  2⤵
  PID:7788
- C:\Windows\System\rwrnfqT.exe
  C:\Windows\System\rwrnfqT.exe
  2⤵
  PID:7360
- C:\Windows\System\mkogiqT.exe
  C:\Windows\System\mkogiqT.exe
  2⤵
  PID:8304
- C:\Windows\System\cqpDcpT.exe
  C:\Windows\System\cqpDcpT.exe
  2⤵
  PID:9152
- C:\Windows\System\umIDXmh.exe
  C:\Windows\System\umIDXmh.exe
  2⤵
  PID:7976
- C:\Windows\System\YOSyBlR.exe
  C:\Windows\System\YOSyBlR.exe
  2⤵
  PID:8288
- C:\Windows\System\imBxBVs.exe
  C:\Windows\System\imBxBVs.exe
  2⤵
  PID:8284
- C:\Windows\System\ESAVgvO.exe
  C:\Windows\System\ESAVgvO.exe
  2⤵
  PID:8412
- C:\Windows\System\GwPlYzE.exe
  C:\Windows\System\GwPlYzE.exe
  2⤵
  PID:8320
- C:\Windows\System\depRFiH.exe
  C:\Windows\System\depRFiH.exe
  2⤵
  PID:8380
- C:\Windows\System\xbQSinl.exe
  C:\Windows\System\xbQSinl.exe
  2⤵
  PID:8528
- C:\Windows\System\xQASDSM.exe
  C:\Windows\System\xQASDSM.exe
  2⤵
  PID:8624
- C:\Windows\System\UQvqXIP.exe
  C:\Windows\System\UQvqXIP.exe
  2⤵
  PID:8544
- C:\Windows\System\QWTMekp.exe
  C:\Windows\System\QWTMekp.exe
  2⤵
  PID:8540
- C:\Windows\System\HuLElFL.exe
  C:\Windows\System\HuLElFL.exe
  2⤵
  PID:8604
- C:\Windows\System\xDeeDsA.exe
  C:\Windows\System\xDeeDsA.exe
  2⤵
  PID:8680
- C:\Windows\System\XsKNkMn.exe
  C:\Windows\System\XsKNkMn.exe
  2⤵
  PID:8716
- C:\Windows\System\JzRvZqO.exe
  C:\Windows\System\JzRvZqO.exe
  2⤵
  PID:8652
- C:\Windows\System\UjmhHJk.exe
  C:\Windows\System\UjmhHJk.exe
  2⤵
  PID:8872
- C:\Windows\System\wZbxuOr.exe
  C:\Windows\System\wZbxuOr.exe
  2⤵
  PID:8512
- C:\Windows\System\cOcxmci.exe
  C:\Windows\System\cOcxmci.exe
  2⤵
  PID:8668
- C:\Windows\System\fZdEhbT.exe
  C:\Windows\System\fZdEhbT.exe
  2⤵
  PID:8876
- C:\Windows\System\IPFurnt.exe
  C:\Windows\System\IPFurnt.exe
  2⤵
  PID:8980
- C:\Windows\System\FdfXSib.exe
  C:\Windows\System\FdfXSib.exe
  2⤵
  PID:9212
- C:\Windows\System\IrJhXev.exe
  C:\Windows\System\IrJhXev.exe
  2⤵
  PID:8240
- C:\Windows\System\BvrRlaX.exe
  C:\Windows\System\BvrRlaX.exe
  2⤵
  PID:7656
- C:\Windows\System\VPYGOYb.exe
  C:\Windows\System\VPYGOYb.exe
  2⤵
  PID:8836
- C:\Windows\System\THWrjrS.exe
  C:\Windows\System\THWrjrS.exe
  2⤵
  PID:9136
- C:\Windows\System\PVtHdXe.exe
  C:\Windows\System\PVtHdXe.exe
  2⤵
  PID:8764
- C:\Windows\System\rmrCEFJ.exe
  C:\Windows\System\rmrCEFJ.exe
  2⤵
  PID:8908
- C:\Windows\System\xpxJXaa.exe
  C:\Windows\System\xpxJXaa.exe
  2⤵
  PID:9012
- C:\Windows\System\IqpnSsk.exe
  C:\Windows\System\IqpnSsk.exe
  2⤵
  PID:9128
- C:\Windows\System\KEKdRWw.exe
  C:\Windows\System\KEKdRWw.exe
  2⤵
  PID:9200
- C:\Windows\System\KqDjOMj.exe
  C:\Windows\System\KqDjOMj.exe
  2⤵
  PID:7708
- C:\Windows\System\pTqlpFH.exe
  C:\Windows\System\pTqlpFH.exe
  2⤵
  PID:8628
- C:\Windows\System\EdlgbIM.exe
  C:\Windows\System\EdlgbIM.exe
  2⤵
  PID:9176
- C:\Windows\System\uvxgaYL.exe
  C:\Windows\System\uvxgaYL.exe
  2⤵
  PID:8924
- C:\Windows\System\omHFFLr.exe
  C:\Windows\System\omHFFLr.exe
  2⤵
  PID:8804
- C:\Windows\System\wdfTBFV.exe
  C:\Windows\System\wdfTBFV.exe
  2⤵
  PID:8672
- C:\Windows\System\qgYqBsV.exe
  C:\Windows\System\qgYqBsV.exe
  2⤵
  PID:8748
- C:\Windows\System\ruzeKbQ.exe
  C:\Windows\System\ruzeKbQ.exe
  2⤵
  PID:8200
- C:\Windows\System\RSeNaJb.exe
  C:\Windows\System\RSeNaJb.exe
  2⤵
  PID:8964
- C:\Windows\System\RbSOilq.exe
  C:\Windows\System\RbSOilq.exe
  2⤵
  PID:8744
- C:\Windows\System\TzPopnx.exe
  C:\Windows\System\TzPopnx.exe
  2⤵
  PID:8252
- C:\Windows\System\yKYfkgN.exe
  C:\Windows\System\yKYfkgN.exe
  2⤵
  PID:8696
- C:\Windows\System\WWbIHfs.exe
  C:\Windows\System\WWbIHfs.exe
  2⤵
  PID:8572
- C:\Windows\System\mvFrDDD.exe
  C:\Windows\System\mvFrDDD.exe
  2⤵
  PID:8416
- C:\Windows\System\BTXGtFm.exe
  C:\Windows\System\BTXGtFm.exe
  2⤵
  PID:8860
- C:\Windows\System\mSMjGKI.exe
  C:\Windows\System\mSMjGKI.exe
  2⤵
  PID:9224
- C:\Windows\System\mYKlhxF.exe
  C:\Windows\System\mYKlhxF.exe
  2⤵
  PID:9244
- C:\Windows\System\HuMQhPS.exe
  C:\Windows\System\HuMQhPS.exe
  2⤵
  PID:9260
- C:\Windows\System\GhtdaEz.exe
  C:\Windows\System\GhtdaEz.exe
  2⤵
  PID:9276
- C:\Windows\System\rMCUXee.exe
  C:\Windows\System\rMCUXee.exe
  2⤵
  PID:9292
- C:\Windows\System\NRUpdUt.exe
  C:\Windows\System\NRUpdUt.exe
  2⤵
  PID:9308
- C:\Windows\System\SidQSiq.exe
  C:\Windows\System\SidQSiq.exe
  2⤵
  PID:9324
- C:\Windows\System\rnIUmBR.exe
  C:\Windows\System\rnIUmBR.exe
  2⤵
  PID:9340
- C:\Windows\System\cjbqwuL.exe
  C:\Windows\System\cjbqwuL.exe
  2⤵
  PID:9356
- C:\Windows\System\sxsnaWz.exe
  C:\Windows\System\sxsnaWz.exe
  2⤵
  PID:9372
- C:\Windows\System\fLFTGBU.exe
  C:\Windows\System\fLFTGBU.exe
  2⤵
  PID:9388
- C:\Windows\System\cZmLXKH.exe
  C:\Windows\System\cZmLXKH.exe
  2⤵
  PID:9404
- C:\Windows\System\hfrFaJm.exe
  C:\Windows\System\hfrFaJm.exe
  2⤵
  PID:9420
- C:\Windows\System\SAIoMFm.exe
  C:\Windows\System\SAIoMFm.exe
  2⤵
  PID:9440
- C:\Windows\System\rkmhIMK.exe
  C:\Windows\System\rkmhIMK.exe
  2⤵
  PID:9456
- C:\Windows\System\aCSZGqX.exe
  C:\Windows\System\aCSZGqX.exe
  2⤵
  PID:9472
- C:\Windows\System\jEdhQdH.exe
  C:\Windows\System\jEdhQdH.exe
  2⤵
  PID:9488
- C:\Windows\System\xVyKbTw.exe
  C:\Windows\System\xVyKbTw.exe
  2⤵
  PID:9504
- C:\Windows\System\jHkNhGe.exe
  C:\Windows\System\jHkNhGe.exe
  2⤵
  PID:9520
- C:\Windows\System\uPNUyqL.exe
  C:\Windows\System\uPNUyqL.exe
  2⤵
  PID:9536
- C:\Windows\System\RDtaseB.exe
  C:\Windows\System\RDtaseB.exe
  2⤵
  PID:9552
- C:\Windows\System\WqwyUKA.exe
  C:\Windows\System\WqwyUKA.exe
  2⤵
  PID:9568
- C:\Windows\System\IbpTSet.exe
  C:\Windows\System\IbpTSet.exe
  2⤵
  PID:9588
- C:\Windows\System\ZWXtVmj.exe
  C:\Windows\System\ZWXtVmj.exe
  2⤵
  PID:9604
- C:\Windows\System\IJdZPEs.exe
  C:\Windows\System\IJdZPEs.exe
  2⤵
  PID:9620
- C:\Windows\System\UqRQlRj.exe
  C:\Windows\System\UqRQlRj.exe
  2⤵
  PID:9636
- C:\Windows\System\rLQPSXp.exe
  C:\Windows\System\rLQPSXp.exe
  2⤵
  PID:9656
- C:\Windows\System\TtajoRj.exe
  C:\Windows\System\TtajoRj.exe
  2⤵
  PID:9672
- C:\Windows\System\sdsvdyt.exe
  C:\Windows\System\sdsvdyt.exe
  2⤵
  PID:9688
- C:\Windows\System\EdRvaun.exe
  C:\Windows\System\EdRvaun.exe
  2⤵
  PID:9704
- C:\Windows\System\aOgiyki.exe
  C:\Windows\System\aOgiyki.exe
  2⤵
  PID:9720
- C:\Windows\System\btldsWj.exe
  C:\Windows\System\btldsWj.exe
  2⤵
  PID:9736
- C:\Windows\System\JqZRPzS.exe
  C:\Windows\System\JqZRPzS.exe
  2⤵
  PID:9756
- C:\Windows\System\GUZTXMz.exe
  C:\Windows\System\GUZTXMz.exe
  2⤵
  PID:9772
- C:\Windows\System\eBJsWaB.exe
  C:\Windows\System\eBJsWaB.exe
  2⤵
  PID:9788
- C:\Windows\System\BmpWJjv.exe
  C:\Windows\System\BmpWJjv.exe
  2⤵
  PID:9804
- C:\Windows\System\wbEtStE.exe
  C:\Windows\System\wbEtStE.exe
  2⤵
  PID:9820
- C:\Windows\System\WQBVrPb.exe
  C:\Windows\System\WQBVrPb.exe
  2⤵
  PID:9836
- C:\Windows\System\YbFwoHI.exe
  C:\Windows\System\YbFwoHI.exe
  2⤵
  PID:9852
- C:\Windows\System\oCvpQqf.exe
  C:\Windows\System\oCvpQqf.exe
  2⤵
  PID:9868
- C:\Windows\System\PvpYNpF.exe
  C:\Windows\System\PvpYNpF.exe
  2⤵
  PID:9884
- C:\Windows\System\WPENexN.exe
  C:\Windows\System\WPENexN.exe
  2⤵
  PID:9900
- C:\Windows\System\kaPgoAZ.exe
  C:\Windows\System\kaPgoAZ.exe
  2⤵
  PID:9916
- C:\Windows\System\VNpyyUS.exe
  C:\Windows\System\VNpyyUS.exe
  2⤵
  PID:9936
- C:\Windows\System\mPLKXOH.exe
  C:\Windows\System\mPLKXOH.exe
  2⤵
  PID:9952
- C:\Windows\System\mnzECun.exe
  C:\Windows\System\mnzECun.exe
  2⤵
  PID:9968
- C:\Windows\System\ZnpenPS.exe
  C:\Windows\System\ZnpenPS.exe
  2⤵
  PID:9984
- C:\Windows\System\EqiCVQD.exe
  C:\Windows\System\EqiCVQD.exe
  2⤵
  PID:10000
- C:\Windows\System\acJuPIe.exe
  C:\Windows\System\acJuPIe.exe
  2⤵
  PID:10016
- C:\Windows\System\dKgLFVq.exe
  C:\Windows\System\dKgLFVq.exe
  2⤵
  PID:10032
- C:\Windows\System\SYjQeIE.exe
  C:\Windows\System\SYjQeIE.exe
  2⤵
  PID:10048
- C:\Windows\System\FgWYOTu.exe
  C:\Windows\System\FgWYOTu.exe
  2⤵
  PID:10064
- C:\Windows\System\pGnXAfV.exe
  C:\Windows\System\pGnXAfV.exe
  2⤵
  PID:10080
- C:\Windows\System\hOolkxL.exe
  C:\Windows\System\hOolkxL.exe
  2⤵
  PID:10096
- C:\Windows\System\klhjRjw.exe
  C:\Windows\System\klhjRjw.exe
  2⤵
  PID:10116
- C:\Windows\System\NhDYuob.exe
  C:\Windows\System\NhDYuob.exe
  2⤵
  PID:10232
- C:\Windows\System\VtVWGyR.exe
  C:\Windows\System\VtVWGyR.exe
  2⤵
  PID:9232
- C:\Windows\System\GgucKWX.exe
  C:\Windows\System\GgucKWX.exe
  2⤵
  PID:9272
- C:\Windows\System\RvReZqC.exe
  C:\Windows\System\RvReZqC.exe
  2⤵
  PID:9336
- C:\Windows\System\mPjnYXY.exe
  C:\Windows\System\mPjnYXY.exe
  2⤵
  PID:9428
- C:\Windows\System\APcrBkj.exe
  C:\Windows\System\APcrBkj.exe
  2⤵
  PID:9464
- C:\Windows\System\OcmPIRz.exe
  C:\Windows\System\OcmPIRz.exe
  2⤵
  PID:9252
- C:\Windows\System\oFCxJEz.exe
  C:\Windows\System\oFCxJEz.exe
  2⤵
  PID:8832
- C:\Windows\System\jPwjEuT.exe
  C:\Windows\System\jPwjEuT.exe
  2⤵
  PID:8820
- C:\Windows\System\ezFazWq.exe
  C:\Windows\System\ezFazWq.exe
  2⤵
  PID:8960
- C:\Windows\System\tkRvHwd.exe
  C:\Windows\System\tkRvHwd.exe
  2⤵
  PID:9284
- C:\Windows\System\SDZQKvF.exe
  C:\Windows\System\SDZQKvF.exe
  2⤵
  PID:9348
- C:\Windows\System\TIXuOXc.exe
  C:\Windows\System\TIXuOXc.exe
  2⤵
  PID:9412
- C:\Windows\System\zrbtROS.exe
  C:\Windows\System\zrbtROS.exe
  2⤵
  PID:9480
- C:\Windows\System\acAIbRK.exe
  C:\Windows\System\acAIbRK.exe
  2⤵
  PID:9528
- C:\Windows\System\oJPISKU.exe
  C:\Windows\System\oJPISKU.exe
  2⤵
  PID:9548
- C:\Windows\System\BQztsyB.exe
  C:\Windows\System\BQztsyB.exe
  2⤵
  PID:9632
- C:\Windows\System\PQQliMK.exe
  C:\Windows\System\PQQliMK.exe
  2⤵
  PID:9700
- C:\Windows\System\djNvjbz.exe
  C:\Windows\System\djNvjbz.exe
  2⤵
  PID:9764
- C:\Windows\System\oTfMUaJ.exe
  C:\Windows\System\oTfMUaJ.exe
  2⤵
  PID:9648
- C:\Windows\System\zqMIBDq.exe
  C:\Windows\System\zqMIBDq.exe
  2⤵
  PID:9584
- C:\Windows\System\WFoHLmj.exe
  C:\Windows\System\WFoHLmj.exe
  2⤵
  PID:9748
- C:\Windows\System\NUhnARW.exe
  C:\Windows\System\NUhnARW.exe
  2⤵
  PID:9784
- C:\Windows\System\SjulNrn.exe
  C:\Windows\System\SjulNrn.exe
  2⤵
  PID:9816
- C:\Windows\System\DgkpvSM.exe
  C:\Windows\System\DgkpvSM.exe
  2⤵
  PID:9880
- C:\Windows\System\tAqnVfY.exe
  C:\Windows\System\tAqnVfY.exe
  2⤵
  PID:9864
- C:\Windows\System\CoRIFZL.exe
  C:\Windows\System\CoRIFZL.exe
  2⤵
  PID:9928
- C:\Windows\System\JaihzYl.exe
  C:\Windows\System\JaihzYl.exe
  2⤵
  PID:9912
- C:\Windows\System\XnKlNoW.exe
  C:\Windows\System\XnKlNoW.exe
  2⤵
  PID:9996
- C:\Windows\System\JlsCgUu.exe
  C:\Windows\System\JlsCgUu.exe
  2⤵
  PID:10060
- C:\Windows\System\aCQkfQM.exe
  C:\Windows\System\aCQkfQM.exe
  2⤵
  PID:10124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CNoqOFR.exe

Filesize
1.9MB

MD5
e71c0c03cc9c1f9c6bf2a06482e65882

SHA1
25f0f5d011cad652d4ae3f0a78621980f07bb0c3

SHA256
5205292378666d9df2c89f6c46cb06e5fd7d87344e8665fc11a11a0284115b48

SHA512
faf72f099cfd88c76a94358c8da2958438921bad9300809f48e0fa7b6a26bd98e57790c1adb63ddd4d15232d355900a876ec5d417c00bcdd451c19bc7150eefa

Download Submit
C:\Windows\system\JVbVbgW.exe

Filesize
1.9MB

MD5
90616feaa526cff593a0aa2e0ea5ff0c

SHA1
ff4e19465f51e66c355ddeeccc9b5080c7057490

SHA256
4eed4ce170836c84e02a55de3149022434e0e7d9d552116ebc0b977b3c139f1a

SHA512
9b8972792d0649ca9eb2103c517f016ec4a562dbaefd7973415befbea464c9e6b434d7a3a080ab69eb4a5f00bad663ded8d5c0132b19f771fd24f2b922c121a4

Download Submit
C:\Windows\system\KnXzzxS.exe

Filesize
1.9MB

MD5
27749682606195ed2a824c1e267cb6e0

SHA1
fea523f51f9bf34d72fcdfe292c3edf2dc883b05

SHA256
4e40a1b9e45f7c0a46033b72ca1d91f14a95264c3f2530a0d1981d86828d471c

SHA512
54f7c32708e649ded7532af063aed90ac27b7b2ba4d031adc092e4481015511b0a5f928091eeeb104bfdc637121ca60d33fa26e9eebaaa5cfde31f0813c9b9a6

Download Submit
C:\Windows\system\OJGcVTO.exe

Filesize
1.9MB

MD5
4feae063dd106e9c40848ddd174351ad

SHA1
d74b01344818df4deed90753524cb3e6ee69a104

SHA256
4a24e8c29c10d6a5ed764893100d7fddda5852ba6600f04083b8ee9fdb1c75c1

SHA512
3cd0fc8029e127d581f4b36dc0847e08107e811a8217a63e92570e048e1584ec9dd56212c46264cb3b0f16ea21e8c6935c36cd7481cc66651be2bc9a4e849c7e

Download Submit
C:\Windows\system\RzjMWTt.exe

Filesize
1.9MB

MD5
981417cc6b80381f126ffd4ce2eba928

SHA1
59e03b229d6510a43b4d24ac481861f43452b578

SHA256
65658be848b59a5b190d7d00a12da4b5fcddd3378cedc700b9322a646ea192fc

SHA512
d9175d39a64224607c104c055553dbacbd42acb56c8972f2c71e39ce02d2c0f9220332f78ec813d194eac285dd264af2fa62437ae529d1021b347cd864db801a

Download Submit
C:\Windows\system\SkYGeOY.exe

Filesize
1.9MB

MD5
bc6c2717a7ffc9360f952ccb0c79c92d

SHA1
864a792063f6522155d331a8f8795e64c26269ee

SHA256
dc3d4aa61d91a0a1d11e31ec3359816efdb37c78045e0e6755452f11dfa2fd07

SHA512
e05ff8631f6b9f7118bcc03e1fefa86abc4c1f6039aef9e240d85d46b23ecc82ef4e0342b567fb04f35c29b5c7141332c1e40343a59998173f40883e7b50f441

Download Submit
C:\Windows\system\VDgXNtd.exe

Filesize
1.9MB

MD5
bb7f8e0f4a14c98f1ff4537c5a41352d

SHA1
bfa7ea7cba735a589337e6b439877c1a7ec5fedd

SHA256
f84fa4bf64b234f8216664455b278c3f51e9b2f83dd59a6d795a10afb71e3913

SHA512
b14c4500c38d40491d89a9050ce6f8b84e071e2264e49762d9e565110bfa96936830d2b86ad0144d03c7d72b28bfd1de0a55967eea5066329fb59967c6f4fab9

Download Submit
C:\Windows\system\WSIGjSl.exe

Filesize
1.9MB

MD5
fd5fc1921208c626b1be0887dc49e98e

SHA1
2a733d1e499064f0fa372f7aea9e3dbd1b2ee44f

SHA256
cb1e6f974c4cb088f58c941bc1b5c47192e48109dd5ead1fb6a6a00fe3abff03

SHA512
a8fc224a7720132a569bec7bdafa819db6e73b2031d7bd9978cc4ed01c0ad40822fc34a2d1603e82f2acf55c71703878c0cd61acfb0ab7d58721374c682f13ad

Download Submit
C:\Windows\system\ZqwAKUe.exe

Filesize
1.9MB

MD5
7bdc6b6e5da6f0ecd3965d45798d2279

SHA1
4f1943b97ae440419a2d03ef2f2642b7a82802b7

SHA256
8f68a1ba4b1cea477be189bcbff567b3021ba4ca23eb435a2f4e1a1189c8b6d1

SHA512
e2bb01699bc4f2a5a595390edc44fa6bba336f8495180fc1107d7a3cfcf0c9b9a95d84e35216aa3b01a4466009afd54774cab0965a714c4237ac94c64fef4957

Download Submit
C:\Windows\system\dkcQsat.exe

Filesize
1.9MB

MD5
54b328941c71077b869790a69ddb4da3

SHA1
d2f4648a9564af1bf07157058d149ddbe8e49ff1

SHA256
ccb2f3021ad8f3222aa04e1d5e19737a91a10f6f40fef9ddf9f9a435b5a0c60a

SHA512
dc82952bb08a4841c12586196ff7660a6ac5fe899ac886f374dcc5e3aa4632df82cedba9311ee3d5ae21cb3b18cb8926263f5edbd8f520e9a31e94e284ae6820

Download Submit
C:\Windows\system\eWnkbgw.exe

Filesize
1.9MB

MD5
486b6c79c91f0baf99f965fe5bd34ebe

SHA1
0b0ee54c45143904b40e94324cc6843eb59fd332

SHA256
54716209cffdc8ce0d406d6cc37a05955a05704c33af20535203625824145291

SHA512
4e508e64970f46726fe15437fa1661abe7b8f5ba028cf0cba2f144037d9cd59a0cd8fdc6925d3351856f8f072843e0ed28244a181db25e79e4c4e2d6afbf27c4

Download Submit
C:\Windows\system\ekWSlbk.exe

Filesize
1.9MB

MD5
dc2319f494f4c9562387f4d53a1adf9d

SHA1
27972db7aba42e120bbaa717d0ed4c5755f9918a

SHA256
723b9837769469aace6a89669c1638933cce646c567128ae3971ac34016aab25

SHA512
bbd6f75f9a18e54588d5d30e62ab768f9b896c67f39331b3fa71aa6345d750dac76679e2d6aeb40810af00e08d856a1be9cdc882c47848d7f8798a8390933bd5

Download Submit
C:\Windows\system\heWpGIK.exe

Filesize
1.9MB

MD5
d7a443248c204e41759012d78ac8d425

SHA1
71dcc9deaac3db57fb6ad62c76634730c271e89b

SHA256
e26c9133baf6362965d638b2dc9c04841d19c929d6e6fb23bcfaaf23386312cf

SHA512
5cc7816c403cb780aaadd93906820b2c295dbfaf3d27fdec721355969f51e9d7fb95904f1a3d9b19509e498a97a0dd4653b571f788317fcc1b20e54b9bf3c84f

Download Submit
C:\Windows\system\iOepiBh.exe

Filesize
1.9MB

MD5
519da04447e3e0d31936e80be165d8c3

SHA1
1d3f9e5daa58f8b34e940dee93016061bca4cc29

SHA256
1c0bf6bc9db1e7fc1eeaf5f6bad07c7ef6805494e4c287b55b2de2999d3d2a8d

SHA512
88dc014c96559fc40e23fdd06a07b8021a0d29ca55933914c5822815c5d4ddc37d4b34958b743b3a13a79a1410967b931ab2cfedd35effc04f0955ee040c3ef7

Download Submit
C:\Windows\system\khpxFRW.exe

Filesize
1.9MB

MD5
a8f535baf87b01e684b89e4152e9c196

SHA1
6d14a156b55c286d69a47d53fc20b78055ca294a

SHA256
df6ac4a271bd23c2b6236f13b3849874c3245eb2879946f535cb3f7f4b3a37f1

SHA512
2e0f24acfee7ad680c74264267f99a8a1185f0c91dddf8414d9cc36a073a46418c2d8d3cddca4a05cecfbe3941a594f5bae06069413f7d6cf8462d5d2ed36f68

Download Submit
C:\Windows\system\leMUEVL.exe

Filesize
1.9MB

MD5
e0633d4c7b9d74960eb13026c0cde7c5

SHA1
ce74ba42c518139b60aa65997b96c20cd1bacee4

SHA256
c0c13fba3be4d298f14c0a65ed1fd8294d0047bfb186ffeb86637c88914bfef5

SHA512
815c58ac69cc6447d6f0246b05960d7858c450c96a29ae26a2a61daf449ac4aeace82d51be81ebf0ac2392fa7a8e82543be8b006d986dc408866497fc16defae

Download Submit
C:\Windows\system\lmTkejG.exe

Filesize
1.9MB

MD5
d9c5223344ca72ea9da11aba0cf42919

SHA1
eeeaafda1eb0075556814d363d33776a6df753d8

SHA256
cf8802a55f10bc5b11e5d8c178e20e78a838e7494fe2c112d02f6affbcec84b0

SHA512
ddc5d5c101f8ead991fd5dc9ac105e5a6be3620a3f4210e42316eb5a959fcc95b69c95c9016e1b80234af5d42e05d7f8f86e4938f9a08240d5f73f8134e396db

Download Submit
C:\Windows\system\nZejols.exe

Filesize
1.9MB

MD5
071aee15cb59d440a01a24955c1024e0

SHA1
badcad881cf40b51e61c3009dfe1af21d896eb42

SHA256
ca1b25b156c19026de8d745c8e2352474ac95705c3263ac76d03378d8282eb49

SHA512
da42acb3e43ccfd62e45f8665379f467763fb87ab12b798d6d2261248bdec8bcaee480976e18fd31006b5d213e76d9718ebcc888edc8124a3cb476324c8adc28

Download Submit
C:\Windows\system\pxyQHok.exe

Filesize
1.9MB

MD5
28104e7c42310d5de8710b7f13123c34

SHA1
8b1765e47eaeafb0793c3f304297cf9d8b8a2bc9

SHA256
e2d0fe986a002654b6dbe67b487c795d7bde20c877ed5c660b57eb350f1e9e65

SHA512
ed3e9f29548705a017e07b83efc91f5ce300c54f8ab5448897ffdd80998d238140dfc7fb17c8ddbba735cf77cb5934c016d4a336549e463862cea5979440dd7f

Download Submit
C:\Windows\system\wKoRIwW.exe

Filesize
1.9MB

MD5
72f6480d51f18bbe41b26b07de3592f5

SHA1
e40a3610a4c0c35c8487dd5bc7f04edd2de83cfa

SHA256
ca3adf6a1828712b7b7cf29f26417e8eb04f0963b909e9108bdce953b03f632a

SHA512
eb218908fef0870b48f8781a1f8d76942969ea58374f416fd758b8e9df97f758fa70e61e7b40a6cc097dd045841bcbf2e7ca573a7e05950999704dfe0688ca73

Download Submit
C:\Windows\system\zzkPpgf.exe

Filesize
1.9MB

MD5
a33d2be8f3e37a230874c76dd100aabf

SHA1
3f775483e46b633d23b6e85e028017c2bfe66728

SHA256
d57c2f1c6121eadca52a2d651886360683180f2ba754dd326653c0003c0374f7

SHA512
37f689f50983d9dae8ac848c24bb6e27e31486123a1114563c90f7f6899e2089be4f3d0a99916ab45ad2ea90123cbeacee9a27e5f3465dc0237a1473b8e7c52a

Download Submit
\Windows\system\ILLtpLN.exe

Filesize
1.9MB

MD5
f7db545d94f3ed5e1b621bec1aaa3648

SHA1
d3b473141d59415e48cb492fc07ed1eb00247301

SHA256
8ad4cc5c99c7faad45372e8b093a3fd54716055461a3596b43df976476869292

SHA512
bf77fec68fcffc307c70824dba0fe1911d4e2972c076e69dce2bdd7160a78eac716d69c49611f98ef6d1e9a0fbdbd40bcaafc93aa462cf6c07cda28e23b0f575

Download Submit
\Windows\system\JCEHQWB.exe

Filesize
1.9MB

MD5
e72bd0e7c1e47d3260953cb8c7c3a3da

SHA1
f0a7c310d2217d14dfe4ab1cec3150cb28e7ac33

SHA256
841705fda707f4ce40bbb8be89dac1df7dadd660271fe315a91d8dfc94fbee4f

SHA512
f73f299bd0d68a32d4b365c304eff5f75592a8d3bb550ce1ed55ae16a91a720a24ee7a5c45937824a34a3f69660df0e5f650c8279f8de0678aed17cfc41c3231

Download Submit
\Windows\system\NsgccdZ.exe

Filesize
1.9MB

MD5
631744289052fd410108e960582fa1a5

SHA1
a1f855ccd1ed5493276f6a9e763e30e6c6e80ba2

SHA256
747df218d3bd16fa7a5001662bde59c0e1726190080cd4d6161a5d044c896cbf

SHA512
4efd6ce475dfb7bb1494fc639f7dbbf8d75b7a4107e3d53800fbbfc1409358d9f1dcf98aff36e525874e3027dda56d8ce4fc82fce6c7cefc5bbfa70c1b8c00c8

Download Submit
\Windows\system\PGmEZCE.exe

Filesize
1.9MB

MD5
0dcf21023937e0dc093d86a63c0a82c3

SHA1
dafea9dcd5f53c714d4b99c55a29750dc04154eb

SHA256
7bfb758db59c4cbe05fac5eca634a17cbe407b96f022bea3a679e545b2acb273

SHA512
fcdd38ca8635c4144a96ca02f988ea3c4b65b27980c5040256676a0d0e010219f96e4eb348448c820aedfa129e2ee34f882a3b2c25b5e160d729030cb8b5de55

Download Submit
\Windows\system\ZXJjvqc.exe

Filesize
1.9MB

MD5
9dc2de57d246d92283a270bc1e20cbaa

SHA1
9163674f1cb8bf92338c198027c4ac1350dc0f1e

SHA256
c5d163df64db0e5e787678937fa63952dff95d9526c95410e9b41394e5940cb2

SHA512
79dbe5e4c712b2ccf68afd2fd1101b3e5cd10ad4b33f338f71dcfd3c91606f7efac8b08500f96165efce48ebf4597d8b8ef0eb6079febc42d86eb42e556b4c95

Download Submit
\Windows\system\aRuhEcb.exe

Filesize
1.9MB

MD5
e8793abb4d17949f3989b9dc604b2d46

SHA1
0ecedeae22aea205df1469272ebb12c6b7e2f385

SHA256
2038050d404643cf5cc66a385a634047d08bf318216bd595beba89f120a836cf

SHA512
c021129c0567c2a614893454c14151280c11d793967c3beeb391465f421bd02c45a4f60136a5d38c188939ad88370deda7b9069664525856cf2edd8b06bf231c

Download Submit
\Windows\system\gwxjpJN.exe

Filesize
1.9MB

MD5
88652498570c54deffdd547c6535d3bd

SHA1
3ee2370beb2c2c1ab71518833329c3ca93b704ba

SHA256
1213663cad64ca7ced97c1783e473683ea2427936efeb0da67f480b75d65ab74

SHA512
7b6d5f379d1d11d0d21133c4ef7cbb76804b41e6c4f079e1a050981625fe24f6f21463f77a0a688b2ebcd00be42cb596a46c375b35408ff58da83d9e2c6becd5

Download Submit
\Windows\system\nasNnbk.exe

Filesize
1.9MB

MD5
bd7e196feb58a8f3c450af5271b1d334

SHA1
da831b336270a4ebb4bbf057c0ae726a2d5cce15

SHA256
9628e58f69a312c1ae8d19b7b0d1f5740aee1a3742788b95c8c9f7af782c2016

SHA512
c510d7f5bca968917db018f75ad9833692fdcb9a01744ea72b169735a67986090493d7cff77ff5c2957fd64e54f36b494d0ae67fd3361b72c30af784f48ef6fb

Download Submit
\Windows\system\nphHChy.exe

Filesize
1.9MB

MD5
b39442167563667310d932105ac1d0bd

SHA1
39750588b3263b513f326927e96bc7d5675099be

SHA256
b0ea66c11a2a0a572658aeeb9c834026d9fbf6cec9f247d03859352ba73154ea

SHA512
4f119595db092c283da61211e257f22d2efd94fd1f9618913f2e97892fba7b93a22a1bdc13ed2d87d0cca8c66cb743fa2f795bd3044ea2476bb6b4a75fe3b3c8

Download Submit
\Windows\system\sItrRVd.exe

Filesize
1.9MB

MD5
d6eb26a0049146add670d24652196d8b

SHA1
c17b69a1e09814f74a5952af63d16d9e5a58aaab

SHA256
e322a8cf3474e1f67e71f376964095faf82fa66b980525063874e18d3ed2651a

SHA512
1331c475949936d64ad78aca71a22edd96d0c568a3ca9b89bd3c3edcf489de394634a4477d466fef57b8550e83c415c3c149370ddba9d6ecf1c67d8ea8872736

Download Submit
\Windows\system\wDApakD.exe

Filesize
1.9MB

MD5
8b6f07881a4fa3323b677aad06d2d886

SHA1
704c282970952026e0269b3d3788bc70c16a9726

SHA256
04641497789463917876791f2c373f3b9addf97cd8e89fc0560692df2bd20fe1

SHA512
852e48fba77979b6810cccbbbd7e537d88090a1cf92a55b993fc95fa081f3d5f4df8197691dd86668c9931848ce9ec37a8bf59ced6751ba4e9c4f3ade106ec7d

Download Submit
\Windows\system\zHsyify.exe

Filesize
1.9MB

MD5
a99d53f50d1cbf5ccab5b9ff7136ddeb

SHA1
57199639ab5207960880d3e95589984c564ae205

SHA256
67310df9c85c6306e9f119aa6921bdb324e208f9bcd7c5405efeb0a7fc903c05

SHA512
eff8bc48974d86efa3e9e9a9b6eda23a06623bdddf6bb10b7504de8919adf0ca36b186cffd18e132cbc79abed15fda9970df63805d0801a1f282198c2e9f3bf2

Download Submit
memory/1624-62-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/1624-55-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/1624-66-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/1624-57-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1624-79-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/1624-74-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/1624-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1624-68-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/1624-49-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/1624-12-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/1624-2278-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/1624-2275-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/1624-0-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/1624-52-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/2144-69-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2276-59-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2372-63-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2416-78-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-48-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-56-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-54-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-65-0x000007FEF5C80000-0x000007FEF661D000-memory.dmp

Filesize
9.6MB

Download
memory/2920-46-0x000007FEF5C80000-0x000007FEF661D000-memory.dmp

Filesize
9.6MB

Download
memory/2920-53-0x0000000002BE0000-0x0000000002C60000-memory.dmp

Filesize
512KB

Download
memory/2920-162-0x000007FEF5C80000-0x000007FEF661D000-memory.dmp

Filesize
9.6MB

Download
memory/2920-30-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/2920-26-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/2920-47-0x0000000002BE0000-0x0000000002C60000-memory.dmp

Filesize
512KB

Download
memory/2920-14-0x0000000002BE0000-0x0000000002C60000-memory.dmp

Filesize
512KB

Download
memory/2936-13-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-50-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download