xmrig | c8c914cd5a97109109b11ebb5db5ddb57b3c19bf1c2bd5a2938744f3ae1831d5

Analysis

max time kernel
40s
max time network
37s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
Size

1.7MB
MD5

065fdad6d8a0742fe981834ead22c63c
SHA1

1f2b041bf3087fafd0c255461f78cdcc6a4f8777
SHA256

c8c914cd5a97109109b11ebb5db5ddb57b3c19bf1c2bd5a2938744f3ae1831d5
SHA512

d7ee7de51ef8bc54022be415c7d0067ca4b677b9c8160407303fccc8a5852aad94442bb4859b244dc97398f2b20ad3836a9c272441554b59126b918cabba8647
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SGkMK3:NAB+

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2620-38-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2112-176-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2568-171-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2952-170-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/2464-167-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2536-161-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2640-82-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/2808-43-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2620	TGBtNcc.exe
2808	xikrYPw.exe
2640	CqfkDOL.exe
2112	hzBflzx.exe
2536	OyhnpDS.exe
2464	fySqdlx.exe
2952	UtDckhz.exe
2568	oEwjkBr.exe
2560	yrBDqFm.exe
2580	Hcpuzlb.exe
2860	cDnrLMa.exe
2436	nJucepk.exe
1872	VNSbVvF.exe
2400	tTSWrGs.exe
1360	xfiuiyK.exe
2608	YwLvQZQ.exe
2916	sNkxQRQ.exe
480	edZRfCU.exe
1044	FOsQrzw.exe
2884	oOdUrob.exe
2672	MYaFVDB.exe
2752	eaXqyPi.exe
2504	yOVlnNz.exe
2176	wNmAjIL.exe
1076	qVGrrsK.exe
1500	CsYntfr.exe
2748	esDCTzV.exe
1776	WZmUtEk.exe
1856	YIXLGyO.exe
1592	NRqlfup.exe
2032	bmOutse.exe
1540	ocXXgua.exe
348	IQlaHrS.exe
2888	YCEHtKH.exe
2956	rXvFNKb.exe
2008	WCsNsiL.exe
2368	VYEycxl.exe
1656	RmbazqL.exe
972	xnlfHcA.exe
2972	lNStVga.exe
2292	jvonYpa.exe
1140	BXQPEQE.exe
868	bzRMHXh.exe
1968	DuyOykJ.exe
2656	YVpAVrf.exe
1464	xJZhSoG.exe
1196	Tgsbrma.exe
2512	rcvEhHx.exe
2396	RChfQXP.exe
3056	mqTsdRV.exe
2740	ADvWAqp.exe
2228	dAgmTUw.exe
2288	icmtmiR.exe
2308	iTMuPDI.exe
1456	WAhZctv.exe
2936	zoJrLXM.exe
3068	tfEwEqH.exe
2276	zbXkVrw.exe
3044	ETdGIZH.exe
996	XukZQbZ.exe
1596	gbooOai.exe
1396	rflQbaO.exe
1888	FgUvqSo.exe
1732	rnAkSqD.exe

Loads dropped DLL 64 IoCs

pid	Process
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1620-1-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/files/0x0008000000015c91-12.dat	upx
behavioral1/files/0x000b00000001226e-7.dat	upx
behavioral1/files/0x000600000001650f-184.dat	upx
behavioral1/files/0x000600000001738e-190.dat	upx
behavioral1/files/0x000600000001708c-150.dat	upx
behavioral1/files/0x0006000000016d7d-143.dat	upx
behavioral1/files/0x0006000000016d46-138.dat	upx
behavioral1/files/0x0006000000016d73-134.dat	upx
behavioral1/files/0x0006000000016d36-130.dat	upx
behavioral1/files/0x0006000000016d21-128.dat	upx
behavioral1/files/0x0006000000016d10-127.dat	upx
behavioral1/files/0x0006000000016d57-124.dat	upx
behavioral1/files/0x002f000000015a15-18.dat	upx
behavioral1/files/0x00130000000054a8-83.dat	upx
behavioral1/files/0x0006000000016ccd-74.dat	upx
behavioral1/files/0x0006000000016c5b-64.dat	upx
behavioral1/files/0x0006000000016591-59.dat	upx
behavioral1/files/0x0007000000015c9b-56.dat	upx
behavioral1/files/0x0006000000016a3a-52.dat	upx
behavioral1/files/0x000600000001640f-51.dat	upx
behavioral1/files/0x0007000000015cca-50.dat	upx
behavioral1/memory/2620-38-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/files/0x0007000000015ca9-21.dat	upx
behavioral1/files/0x0008000000016228-181.dat	upx
behavioral1/files/0x0007000000015cc2-180.dat	upx
behavioral1/memory/2112-176-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/2568-171-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2952-170-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/memory/2464-167-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2536-161-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/files/0x00060000000171ad-154.dat	upx
behavioral1/files/0x0006000000016fa9-146.dat	upx
behavioral1/files/0x0006000000016d79-139.dat	upx
behavioral1/files/0x0006000000016d5f-131.dat	upx
behavioral1/files/0x0006000000016d4f-120.dat	upx
behavioral1/files/0x0006000000016d3e-112.dat	upx
behavioral1/files/0x0006000000016d2d-105.dat	upx
behavioral1/files/0x0006000000016d19-98.dat	upx
behavioral1/files/0x0006000000016d01-87.dat	upx
behavioral1/memory/2640-82-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/files/0x0007000000016cf2-79.dat	upx
behavioral1/files/0x0006000000016ca1-67.dat	upx
behavioral1/files/0x0006000000016c3a-61.dat	upx
behavioral1/files/0x00060000000167e8-47.dat	upx
behavioral1/memory/2808-43-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/files/0x000600000001738f-192.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hzBflzx.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\OyhnpDS.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\FPKPzDD.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\bSCADRN.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\RENLvUU.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\DnMELzw.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\wiojOzA.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\UIJOqzw.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\tAAIXaE.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\bKNcMfo.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\qfpeMoA.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\SPwvMuQ.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\XgHwwTF.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\rOiwVcj.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\TGHSDVQ.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\aMzTvUU.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\CbmsVHS.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\BTITViF.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\ZIotzRz.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\LFuMcol.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\VgrjEKT.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\gYKShRs.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\zkCjgnm.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\gpLPINa.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\UtDckhz.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\FgblIUc.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\dOKTBfU.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\CmKqkXq.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\FzMbrNM.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\BzPTRmc.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\pfbpbSL.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\zSyOtxE.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\KFwcHxa.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\ttnWilo.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\qpPDarl.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\qEMaqet.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\fLiARMU.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\OPYaDoe.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\DcNnMLi.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\UQRKrkC.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\nrGNqDe.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\DxCZkrV.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\maFOgfw.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\hRehtvY.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\GpRTSxL.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\IdpNaBv.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\RChfQXP.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\PvYmwOt.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\pTAybBr.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\Fkuhmsn.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\YfBMcle.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\pKVAvJF.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\EqHLvob.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\XOMdLhl.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\UBQetcN.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\icmtmiR.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\AhLjGyN.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\NRfmzOv.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\XauIkVZ.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\XcNhbqc.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\AwhDsyI.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\xzmBNpT.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\hTHLsed.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
File created	C:\Windows\System\cWOIPFG.exe	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1692	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
Token: SeDebugPrivilege	1692	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1692	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	29
PID 1620 wrote to memory of 1692	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	29
PID 1620 wrote to memory of 1692	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	29
PID 1620 wrote to memory of 2620	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2620	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2620	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2640	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	31
PID 1620 wrote to memory of 2640	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	31
PID 1620 wrote to memory of 2640	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	31
PID 1620 wrote to memory of 2808	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	32
PID 1620 wrote to memory of 2808	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	32
PID 1620 wrote to memory of 2808	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	32
PID 1620 wrote to memory of 2952	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	33
PID 1620 wrote to memory of 2952	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	33
PID 1620 wrote to memory of 2952	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	33
PID 1620 wrote to memory of 2112	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	34
PID 1620 wrote to memory of 2112	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	34
PID 1620 wrote to memory of 2112	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	34
PID 1620 wrote to memory of 2672	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	35
PID 1620 wrote to memory of 2672	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	35
PID 1620 wrote to memory of 2672	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	35
PID 1620 wrote to memory of 2536	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	36
PID 1620 wrote to memory of 2536	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	36
PID 1620 wrote to memory of 2536	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	36
PID 1620 wrote to memory of 2752	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	37
PID 1620 wrote to memory of 2752	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	37
PID 1620 wrote to memory of 2752	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	37
PID 1620 wrote to memory of 2464	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	38
PID 1620 wrote to memory of 2464	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	38
PID 1620 wrote to memory of 2464	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	38
PID 1620 wrote to memory of 2504	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	39
PID 1620 wrote to memory of 2504	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	39
PID 1620 wrote to memory of 2504	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	39
PID 1620 wrote to memory of 2568	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	40
PID 1620 wrote to memory of 2568	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	40
PID 1620 wrote to memory of 2568	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	40
PID 1620 wrote to memory of 2176	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	41
PID 1620 wrote to memory of 2176	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	41
PID 1620 wrote to memory of 2176	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	41
PID 1620 wrote to memory of 2560	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	42
PID 1620 wrote to memory of 2560	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	42
PID 1620 wrote to memory of 2560	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	42
PID 1620 wrote to memory of 1500	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	43
PID 1620 wrote to memory of 1500	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	43
PID 1620 wrote to memory of 1500	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	43
PID 1620 wrote to memory of 2580	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	44
PID 1620 wrote to memory of 2580	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	44
PID 1620 wrote to memory of 2580	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	44
PID 1620 wrote to memory of 2748	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	45
PID 1620 wrote to memory of 2748	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	45
PID 1620 wrote to memory of 2748	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	45
PID 1620 wrote to memory of 2860	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	46
PID 1620 wrote to memory of 2860	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	46
PID 1620 wrote to memory of 2860	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	46
PID 1620 wrote to memory of 1856	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	47
PID 1620 wrote to memory of 1856	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	47
PID 1620 wrote to memory of 1856	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	47
PID 1620 wrote to memory of 2436	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	48
PID 1620 wrote to memory of 2436	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	48
PID 1620 wrote to memory of 2436	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	48
PID 1620 wrote to memory of 1592	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	49
PID 1620 wrote to memory of 1592	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	49
PID 1620 wrote to memory of 1592	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	49
PID 1620 wrote to memory of 1872	1620	065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\065fdad6d8a0742fe981834ead22c63c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1692
- C:\Windows\System\TGBtNcc.exe
  C:\Windows\System\TGBtNcc.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\CqfkDOL.exe
  C:\Windows\System\CqfkDOL.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\xikrYPw.exe
  C:\Windows\System\xikrYPw.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\UtDckhz.exe
  C:\Windows\System\UtDckhz.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\hzBflzx.exe
  C:\Windows\System\hzBflzx.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\MYaFVDB.exe
  C:\Windows\System\MYaFVDB.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\OyhnpDS.exe
  C:\Windows\System\OyhnpDS.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\eaXqyPi.exe
  C:\Windows\System\eaXqyPi.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\fySqdlx.exe
  C:\Windows\System\fySqdlx.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\yOVlnNz.exe
  C:\Windows\System\yOVlnNz.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\oEwjkBr.exe
  C:\Windows\System\oEwjkBr.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\wNmAjIL.exe
  C:\Windows\System\wNmAjIL.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\yrBDqFm.exe
  C:\Windows\System\yrBDqFm.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\CsYntfr.exe
  C:\Windows\System\CsYntfr.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\Hcpuzlb.exe
  C:\Windows\System\Hcpuzlb.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\esDCTzV.exe
  C:\Windows\System\esDCTzV.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\cDnrLMa.exe
  C:\Windows\System\cDnrLMa.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\YIXLGyO.exe
  C:\Windows\System\YIXLGyO.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\nJucepk.exe
  C:\Windows\System\nJucepk.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\NRqlfup.exe
  C:\Windows\System\NRqlfup.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\VNSbVvF.exe
  C:\Windows\System\VNSbVvF.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\bmOutse.exe
  C:\Windows\System\bmOutse.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\tTSWrGs.exe
  C:\Windows\System\tTSWrGs.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\ocXXgua.exe
  C:\Windows\System\ocXXgua.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\xfiuiyK.exe
  C:\Windows\System\xfiuiyK.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\YCEHtKH.exe
  C:\Windows\System\YCEHtKH.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\YwLvQZQ.exe
  C:\Windows\System\YwLvQZQ.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\WCsNsiL.exe
  C:\Windows\System\WCsNsiL.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\sNkxQRQ.exe
  C:\Windows\System\sNkxQRQ.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\VYEycxl.exe
  C:\Windows\System\VYEycxl.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\edZRfCU.exe
  C:\Windows\System\edZRfCU.exe
  2⤵
  - Executes dropped EXE
  PID:480
- C:\Windows\System\xnlfHcA.exe
  C:\Windows\System\xnlfHcA.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\FOsQrzw.exe
  C:\Windows\System\FOsQrzw.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\lNStVga.exe
  C:\Windows\System\lNStVga.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\oOdUrob.exe
  C:\Windows\System\oOdUrob.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\jvonYpa.exe
  C:\Windows\System\jvonYpa.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\qVGrrsK.exe
  C:\Windows\System\qVGrrsK.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\xJZhSoG.exe
  C:\Windows\System\xJZhSoG.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\WZmUtEk.exe
  C:\Windows\System\WZmUtEk.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\Tgsbrma.exe
  C:\Windows\System\Tgsbrma.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\IQlaHrS.exe
  C:\Windows\System\IQlaHrS.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\RChfQXP.exe
  C:\Windows\System\RChfQXP.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\rXvFNKb.exe
  C:\Windows\System\rXvFNKb.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\dAgmTUw.exe
  C:\Windows\System\dAgmTUw.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\RmbazqL.exe
  C:\Windows\System\RmbazqL.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\icmtmiR.exe
  C:\Windows\System\icmtmiR.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\BXQPEQE.exe
  C:\Windows\System\BXQPEQE.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\iTMuPDI.exe
  C:\Windows\System\iTMuPDI.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\bzRMHXh.exe
  C:\Windows\System\bzRMHXh.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\WAhZctv.exe
  C:\Windows\System\WAhZctv.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\DuyOykJ.exe
  C:\Windows\System\DuyOykJ.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\zoJrLXM.exe
  C:\Windows\System\zoJrLXM.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\YVpAVrf.exe
  C:\Windows\System\YVpAVrf.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\tfEwEqH.exe
  C:\Windows\System\tfEwEqH.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\rcvEhHx.exe
  C:\Windows\System\rcvEhHx.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\zbXkVrw.exe
  C:\Windows\System\zbXkVrw.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\mqTsdRV.exe
  C:\Windows\System\mqTsdRV.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\ETdGIZH.exe
  C:\Windows\System\ETdGIZH.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\ADvWAqp.exe
  C:\Windows\System\ADvWAqp.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\XukZQbZ.exe
  C:\Windows\System\XukZQbZ.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\gbooOai.exe
  C:\Windows\System\gbooOai.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\rflQbaO.exe
  C:\Windows\System\rflQbaO.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\FgUvqSo.exe
  C:\Windows\System\FgUvqSo.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\rnAkSqD.exe
  C:\Windows\System\rnAkSqD.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\qgenAEW.exe
  C:\Windows\System\qgenAEW.exe
  2⤵
  PID:736
- C:\Windows\System\OjLAUhy.exe
  C:\Windows\System\OjLAUhy.exe
  2⤵
  PID:1604
- C:\Windows\System\KDzNLLy.exe
  C:\Windows\System\KDzNLLy.exe
  2⤵
  PID:1768
- C:\Windows\System\FPKPzDD.exe
  C:\Windows\System\FPKPzDD.exe
  2⤵
  PID:2108
- C:\Windows\System\URcLYbW.exe
  C:\Windows\System\URcLYbW.exe
  2⤵
  PID:2100
- C:\Windows\System\mgHBKPG.exe
  C:\Windows\System\mgHBKPG.exe
  2⤵
  PID:2236
- C:\Windows\System\VAeuFqn.exe
  C:\Windows\System\VAeuFqn.exe
  2⤵
  PID:2428
- C:\Windows\System\TiSmGfQ.exe
  C:\Windows\System\TiSmGfQ.exe
  2⤵
  PID:1848
- C:\Windows\System\WwYzcIf.exe
  C:\Windows\System\WwYzcIf.exe
  2⤵
  PID:1924
- C:\Windows\System\ocwEidF.exe
  C:\Windows\System\ocwEidF.exe
  2⤵
  PID:2412
- C:\Windows\System\rOiwVcj.exe
  C:\Windows\System\rOiwVcj.exe
  2⤵
  PID:1976
- C:\Windows\System\hTpgwtG.exe
  C:\Windows\System\hTpgwtG.exe
  2⤵
  PID:1560
- C:\Windows\System\xyDmpuV.exe
  C:\Windows\System\xyDmpuV.exe
  2⤵
  PID:336
- C:\Windows\System\PLMZKzv.exe
  C:\Windows\System\PLMZKzv.exe
  2⤵
  PID:1852
- C:\Windows\System\EopCODy.exe
  C:\Windows\System\EopCODy.exe
  2⤵
  PID:1232
- C:\Windows\System\dMTzwfM.exe
  C:\Windows\System\dMTzwfM.exe
  2⤵
  PID:2544
- C:\Windows\System\DnxjACg.exe
  C:\Windows\System\DnxjACg.exe
  2⤵
  PID:956
- C:\Windows\System\vYWmZor.exe
  C:\Windows\System\vYWmZor.exe
  2⤵
  PID:768
- C:\Windows\System\nKeSZfS.exe
  C:\Windows\System\nKeSZfS.exe
  2⤵
  PID:952
- C:\Windows\System\JLlnwpz.exe
  C:\Windows\System\JLlnwpz.exe
  2⤵
  PID:2572
- C:\Windows\System\mArFwJn.exe
  C:\Windows\System\mArFwJn.exe
  2⤵
  PID:1928
- C:\Windows\System\VsMMQwk.exe
  C:\Windows\System\VsMMQwk.exe
  2⤵
  PID:1528
- C:\Windows\System\JRdAWuF.exe
  C:\Windows\System\JRdAWuF.exe
  2⤵
  PID:1264
- C:\Windows\System\YbyJmmn.exe
  C:\Windows\System\YbyJmmn.exe
  2⤵
  PID:1412
- C:\Windows\System\BNmOpaZ.exe
  C:\Windows\System\BNmOpaZ.exe
  2⤵
  PID:2084
- C:\Windows\System\ZIotzRz.exe
  C:\Windows\System\ZIotzRz.exe
  2⤵
  PID:528
- C:\Windows\System\PuFbMML.exe
  C:\Windows\System\PuFbMML.exe
  2⤵
  PID:2036
- C:\Windows\System\dFhPYOX.exe
  C:\Windows\System\dFhPYOX.exe
  2⤵
  PID:832
- C:\Windows\System\RWJqdVE.exe
  C:\Windows\System\RWJqdVE.exe
  2⤵
  PID:900
- C:\Windows\System\YydrIJl.exe
  C:\Windows\System\YydrIJl.exe
  2⤵
  PID:1916
- C:\Windows\System\zkCjgnm.exe
  C:\Windows\System\zkCjgnm.exe
  2⤵
  PID:548
- C:\Windows\System\OckRgKn.exe
  C:\Windows\System\OckRgKn.exe
  2⤵
  PID:1524
- C:\Windows\System\fXBDKiD.exe
  C:\Windows\System\fXBDKiD.exe
  2⤵
  PID:2180
- C:\Windows\System\huLlvgm.exe
  C:\Windows\System\huLlvgm.exe
  2⤵
  PID:2056
- C:\Windows\System\rCwowZr.exe
  C:\Windows\System\rCwowZr.exe
  2⤵
  PID:2624
- C:\Windows\System\fvwXcXr.exe
  C:\Windows\System\fvwXcXr.exe
  2⤵
  PID:1668
- C:\Windows\System\rBkkwTe.exe
  C:\Windows\System\rBkkwTe.exe
  2⤵
  PID:488
- C:\Windows\System\KclefMV.exe
  C:\Windows\System\KclefMV.exe
  2⤵
  PID:1884
- C:\Windows\System\CcdXCiM.exe
  C:\Windows\System\CcdXCiM.exe
  2⤵
  PID:2220
- C:\Windows\System\nYMRsMm.exe
  C:\Windows\System\nYMRsMm.exe
  2⤵
  PID:2072
- C:\Windows\System\APcuJcj.exe
  C:\Windows\System\APcuJcj.exe
  2⤵
  PID:2828
- C:\Windows\System\ttnWilo.exe
  C:\Windows\System\ttnWilo.exe
  2⤵
  PID:1920
- C:\Windows\System\cTvjVzb.exe
  C:\Windows\System\cTvjVzb.exe
  2⤵
  PID:1840
- C:\Windows\System\zjtxSmq.exe
  C:\Windows\System\zjtxSmq.exe
  2⤵
  PID:976
- C:\Windows\System\LQpkMwb.exe
  C:\Windows\System\LQpkMwb.exe
  2⤵
  PID:1212
- C:\Windows\System\MrfzxPk.exe
  C:\Windows\System\MrfzxPk.exe
  2⤵
  PID:2784
- C:\Windows\System\BSnVHGn.exe
  C:\Windows\System\BSnVHGn.exe
  2⤵
  PID:2764
- C:\Windows\System\goKLyuG.exe
  C:\Windows\System\goKLyuG.exe
  2⤵
  PID:2224
- C:\Windows\System\trvNZVU.exe
  C:\Windows\System\trvNZVU.exe
  2⤵
  PID:316
- C:\Windows\System\RklSMkR.exe
  C:\Windows\System\RklSMkR.exe
  2⤵
  PID:3028
- C:\Windows\System\aXmWmvN.exe
  C:\Windows\System\aXmWmvN.exe
  2⤵
  PID:2540
- C:\Windows\System\apPTsTK.exe
  C:\Windows\System\apPTsTK.exe
  2⤵
  PID:2780
- C:\Windows\System\vvdHzUk.exe
  C:\Windows\System\vvdHzUk.exe
  2⤵
  PID:2600
- C:\Windows\System\vQVHElB.exe
  C:\Windows\System\vQVHElB.exe
  2⤵
  PID:2280
- C:\Windows\System\ILIprUp.exe
  C:\Windows\System\ILIprUp.exe
  2⤵
  PID:2196
- C:\Windows\System\reiUAfa.exe
  C:\Windows\System\reiUAfa.exe
  2⤵
  PID:1624
- C:\Windows\System\TIHvDbi.exe
  C:\Windows\System\TIHvDbi.exe
  2⤵
  PID:2404
- C:\Windows\System\vOPsRTn.exe
  C:\Windows\System\vOPsRTn.exe
  2⤵
  PID:1960
- C:\Windows\System\hrnbigr.exe
  C:\Windows\System\hrnbigr.exe
  2⤵
  PID:1476
- C:\Windows\System\vFrDLdD.exe
  C:\Windows\System\vFrDLdD.exe
  2⤵
  PID:2344
- C:\Windows\System\mURPDzw.exe
  C:\Windows\System\mURPDzw.exe
  2⤵
  PID:1764
- C:\Windows\System\HSMBasJ.exe
  C:\Windows\System\HSMBasJ.exe
  2⤵
  PID:1772
- C:\Windows\System\RdbnMGL.exe
  C:\Windows\System\RdbnMGL.exe
  2⤵
  PID:2792
- C:\Windows\System\PDFuaUb.exe
  C:\Windows\System\PDFuaUb.exe
  2⤵
  PID:2756
- C:\Windows\System\DMfouiu.exe
  C:\Windows\System\DMfouiu.exe
  2⤵
  PID:1520
- C:\Windows\System\rHpyLto.exe
  C:\Windows\System\rHpyLto.exe
  2⤵
  PID:1208
- C:\Windows\System\BzPTRmc.exe
  C:\Windows\System\BzPTRmc.exe
  2⤵
  PID:2104
- C:\Windows\System\pKVAvJF.exe
  C:\Windows\System\pKVAvJF.exe
  2⤵
  PID:840
- C:\Windows\System\redBkEC.exe
  C:\Windows\System\redBkEC.exe
  2⤵
  PID:1704
- C:\Windows\System\qpPDarl.exe
  C:\Windows\System\qpPDarl.exe
  2⤵
  PID:2788
- C:\Windows\System\udbPFSd.exe
  C:\Windows\System\udbPFSd.exe
  2⤵
  PID:2712
- C:\Windows\System\USaudNC.exe
  C:\Windows\System\USaudNC.exe
  2⤵
  PID:2472
- C:\Windows\System\DcNnMLi.exe
  C:\Windows\System\DcNnMLi.exe
  2⤵
  PID:544
- C:\Windows\System\llhfIul.exe
  C:\Windows\System\llhfIul.exe
  2⤵
  PID:2632
- C:\Windows\System\GgJdIcP.exe
  C:\Windows\System\GgJdIcP.exe
  2⤵
  PID:2840
- C:\Windows\System\UIDqwMH.exe
  C:\Windows\System\UIDqwMH.exe
  2⤵
  PID:236
- C:\Windows\System\UQRKrkC.exe
  C:\Windows\System\UQRKrkC.exe
  2⤵
  PID:744
- C:\Windows\System\GfTerrA.exe
  C:\Windows\System\GfTerrA.exe
  2⤵
  PID:2408
- C:\Windows\System\viLKBcp.exe
  C:\Windows\System\viLKBcp.exe
  2⤵
  PID:2980
- C:\Windows\System\pjZFWlO.exe
  C:\Windows\System\pjZFWlO.exe
  2⤵
  PID:568
- C:\Windows\System\BaqJSAH.exe
  C:\Windows\System\BaqJSAH.exe
  2⤵
  PID:2476
- C:\Windows\System\jLjONQv.exe
  C:\Windows\System\jLjONQv.exe
  2⤵
  PID:1536
- C:\Windows\System\mMbZmzP.exe
  C:\Windows\System\mMbZmzP.exe
  2⤵
  PID:1912
- C:\Windows\System\HGKElYS.exe
  C:\Windows\System\HGKElYS.exe
  2⤵
  PID:2732
- C:\Windows\System\nMeDQdU.exe
  C:\Windows\System\nMeDQdU.exe
  2⤵
  PID:1448
- C:\Windows\System\SLUsEja.exe
  C:\Windows\System\SLUsEja.exe
  2⤵
  PID:2528
- C:\Windows\System\kwzYqOz.exe
  C:\Windows\System\kwzYqOz.exe
  2⤵
  PID:2516
- C:\Windows\System\DeVIuLO.exe
  C:\Windows\System\DeVIuLO.exe
  2⤵
  PID:1544
- C:\Windows\System\nEgthlQ.exe
  C:\Windows\System\nEgthlQ.exe
  2⤵
  PID:884
- C:\Windows\System\PApAvnf.exe
  C:\Windows\System\PApAvnf.exe
  2⤵
  PID:2116
- C:\Windows\System\KEwMCMV.exe
  C:\Windows\System\KEwMCMV.exe
  2⤵
  PID:1424
- C:\Windows\System\hgdwRiT.exe
  C:\Windows\System\hgdwRiT.exe
  2⤵
  PID:1684
- C:\Windows\System\TfaYUyP.exe
  C:\Windows\System\TfaYUyP.exe
  2⤵
  PID:2728
- C:\Windows\System\hGimZoD.exe
  C:\Windows\System\hGimZoD.exe
  2⤵
  PID:1164
- C:\Windows\System\DwZEavJ.exe
  C:\Windows\System\DwZEavJ.exe
  2⤵
  PID:3080
- C:\Windows\System\wOzwPGC.exe
  C:\Windows\System\wOzwPGC.exe
  2⤵
  PID:3096
- C:\Windows\System\TOdNkhA.exe
  C:\Windows\System\TOdNkhA.exe
  2⤵
  PID:3112
- C:\Windows\System\uLdwDlq.exe
  C:\Windows\System\uLdwDlq.exe
  2⤵
  PID:3128
- C:\Windows\System\ZKdgSJB.exe
  C:\Windows\System\ZKdgSJB.exe
  2⤵
  PID:3144
- C:\Windows\System\exitYRl.exe
  C:\Windows\System\exitYRl.exe
  2⤵
  PID:3160
- C:\Windows\System\UMLKTju.exe
  C:\Windows\System\UMLKTju.exe
  2⤵
  PID:3176
- C:\Windows\System\pEMtLkA.exe
  C:\Windows\System\pEMtLkA.exe
  2⤵
  PID:3192
- C:\Windows\System\MtrbEDI.exe
  C:\Windows\System\MtrbEDI.exe
  2⤵
  PID:3208
- C:\Windows\System\cIBXAuB.exe
  C:\Windows\System\cIBXAuB.exe
  2⤵
  PID:3224
- C:\Windows\System\asGWTFN.exe
  C:\Windows\System\asGWTFN.exe
  2⤵
  PID:3240
- C:\Windows\System\YLKSvJI.exe
  C:\Windows\System\YLKSvJI.exe
  2⤵
  PID:3256
- C:\Windows\System\RzhFXeu.exe
  C:\Windows\System\RzhFXeu.exe
  2⤵
  PID:3272
- C:\Windows\System\zRRzIXJ.exe
  C:\Windows\System\zRRzIXJ.exe
  2⤵
  PID:3292
- C:\Windows\System\ySPyazG.exe
  C:\Windows\System\ySPyazG.exe
  2⤵
  PID:3308
- C:\Windows\System\dArnUdM.exe
  C:\Windows\System\dArnUdM.exe
  2⤵
  PID:3340
- C:\Windows\System\HvpRuHI.exe
  C:\Windows\System\HvpRuHI.exe
  2⤵
  PID:3376
- C:\Windows\System\JtiVIjs.exe
  C:\Windows\System\JtiVIjs.exe
  2⤵
  PID:3408
- C:\Windows\System\WgARPXX.exe
  C:\Windows\System\WgARPXX.exe
  2⤵
  PID:3424
- C:\Windows\System\EPGARpn.exe
  C:\Windows\System\EPGARpn.exe
  2⤵
  PID:3440
- C:\Windows\System\JcQnkkP.exe
  C:\Windows\System\JcQnkkP.exe
  2⤵
  PID:3456
- C:\Windows\System\TvAVRhR.exe
  C:\Windows\System\TvAVRhR.exe
  2⤵
  PID:3480
- C:\Windows\System\KQKujOh.exe
  C:\Windows\System\KQKujOh.exe
  2⤵
  PID:3496
- C:\Windows\System\DqxUDYj.exe
  C:\Windows\System\DqxUDYj.exe
  2⤵
  PID:3528
- C:\Windows\System\YHPlsiW.exe
  C:\Windows\System\YHPlsiW.exe
  2⤵
  PID:3552
- C:\Windows\System\GYntJub.exe
  C:\Windows\System\GYntJub.exe
  2⤵
  PID:3568
- C:\Windows\System\WQsaljo.exe
  C:\Windows\System\WQsaljo.exe
  2⤵
  PID:3584
- C:\Windows\System\TwfjMAe.exe
  C:\Windows\System\TwfjMAe.exe
  2⤵
  PID:3600
- C:\Windows\System\GXlgTQt.exe
  C:\Windows\System\GXlgTQt.exe
  2⤵
  PID:3624
- C:\Windows\System\oqhLyWT.exe
  C:\Windows\System\oqhLyWT.exe
  2⤵
  PID:3640
- C:\Windows\System\AJzcPmZ.exe
  C:\Windows\System\AJzcPmZ.exe
  2⤵
  PID:3656
- C:\Windows\System\VuOMZhK.exe
  C:\Windows\System\VuOMZhK.exe
  2⤵
  PID:3672
- C:\Windows\System\QZWBmXW.exe
  C:\Windows\System\QZWBmXW.exe
  2⤵
  PID:3688
- C:\Windows\System\mCTlYHx.exe
  C:\Windows\System\mCTlYHx.exe
  2⤵
  PID:3712
- C:\Windows\System\eiXbJFP.exe
  C:\Windows\System\eiXbJFP.exe
  2⤵
  PID:3728
- C:\Windows\System\LgbsMTR.exe
  C:\Windows\System\LgbsMTR.exe
  2⤵
  PID:3744
- C:\Windows\System\vbVGcSM.exe
  C:\Windows\System\vbVGcSM.exe
  2⤵
  PID:3760
- C:\Windows\System\GmHozbT.exe
  C:\Windows\System\GmHozbT.exe
  2⤵
  PID:3780
- C:\Windows\System\znqrOLC.exe
  C:\Windows\System\znqrOLC.exe
  2⤵
  PID:3796
- C:\Windows\System\octoLHW.exe
  C:\Windows\System\octoLHW.exe
  2⤵
  PID:3812
- C:\Windows\System\gCuXhFV.exe
  C:\Windows\System\gCuXhFV.exe
  2⤵
  PID:3828
- C:\Windows\System\AVcPOMH.exe
  C:\Windows\System\AVcPOMH.exe
  2⤵
  PID:3844
- C:\Windows\System\WNpWgmW.exe
  C:\Windows\System\WNpWgmW.exe
  2⤵
  PID:3864
- C:\Windows\System\rFnjUQx.exe
  C:\Windows\System\rFnjUQx.exe
  2⤵
  PID:3880
- C:\Windows\System\VyBIySF.exe
  C:\Windows\System\VyBIySF.exe
  2⤵
  PID:3896
- C:\Windows\System\lmNDlgc.exe
  C:\Windows\System\lmNDlgc.exe
  2⤵
  PID:3916
- C:\Windows\System\vKsyOwT.exe
  C:\Windows\System\vKsyOwT.exe
  2⤵
  PID:3932
- C:\Windows\System\TJJpcFz.exe
  C:\Windows\System\TJJpcFz.exe
  2⤵
  PID:3948
- C:\Windows\System\giRPMCy.exe
  C:\Windows\System\giRPMCy.exe
  2⤵
  PID:3984
- C:\Windows\System\cqrTvZv.exe
  C:\Windows\System\cqrTvZv.exe
  2⤵
  PID:4072
- C:\Windows\System\cyreTBo.exe
  C:\Windows\System\cyreTBo.exe
  2⤵
  PID:4088
- C:\Windows\System\OblaQKS.exe
  C:\Windows\System\OblaQKS.exe
  2⤵
  PID:2268
- C:\Windows\System\pwagJZT.exe
  C:\Windows\System\pwagJZT.exe
  2⤵
  PID:1724
- C:\Windows\System\sDfgKCu.exe
  C:\Windows\System\sDfgKCu.exe
  2⤵
  PID:3088
- C:\Windows\System\YLCSzPg.exe
  C:\Windows\System\YLCSzPg.exe
  2⤵
  PID:3104
- C:\Windows\System\hNsGnxh.exe
  C:\Windows\System\hNsGnxh.exe
  2⤵
  PID:3136
- C:\Windows\System\YdcXCkj.exe
  C:\Windows\System\YdcXCkj.exe
  2⤵
  PID:3200
- C:\Windows\System\TUSbAeR.exe
  C:\Windows\System\TUSbAeR.exe
  2⤵
  PID:2004
- C:\Windows\System\slSOZHd.exe
  C:\Windows\System\slSOZHd.exe
  2⤵
  PID:1832
- C:\Windows\System\INfDxSp.exe
  C:\Windows\System\INfDxSp.exe
  2⤵
  PID:3264
- C:\Windows\System\ttxWuzf.exe
  C:\Windows\System\ttxWuzf.exe
  2⤵
  PID:3284
- C:\Windows\System\kihUehp.exe
  C:\Windows\System\kihUehp.exe
  2⤵
  PID:3324
- C:\Windows\System\FsFeNKV.exe
  C:\Windows\System\FsFeNKV.exe
  2⤵
  PID:3320
- C:\Windows\System\nrGNqDe.exe
  C:\Windows\System\nrGNqDe.exe
  2⤵
  PID:3364
- C:\Windows\System\sCLLIwB.exe
  C:\Windows\System\sCLLIwB.exe
  2⤵
  PID:3384
- C:\Windows\System\BLwHlAQ.exe
  C:\Windows\System\BLwHlAQ.exe
  2⤵
  PID:3392
- C:\Windows\System\VrgmvXp.exe
  C:\Windows\System\VrgmvXp.exe
  2⤵
  PID:3420
- C:\Windows\System\SLMtZIN.exe
  C:\Windows\System\SLMtZIN.exe
  2⤵
  PID:3448
- C:\Windows\System\TGHSDVQ.exe
  C:\Windows\System\TGHSDVQ.exe
  2⤵
  PID:3512
- C:\Windows\System\iYTDMOg.exe
  C:\Windows\System\iYTDMOg.exe
  2⤵
  PID:2664
- C:\Windows\System\WzXgZJJ.exe
  C:\Windows\System\WzXgZJJ.exe
  2⤵
  PID:3564
- C:\Windows\System\LFuMcol.exe
  C:\Windows\System\LFuMcol.exe
  2⤵
  PID:3668
- C:\Windows\System\sEYzScK.exe
  C:\Windows\System\sEYzScK.exe
  2⤵
  PID:3612
- C:\Windows\System\FjDeCjg.exe
  C:\Windows\System\FjDeCjg.exe
  2⤵
  PID:3544
- C:\Windows\System\CikUNuQ.exe
  C:\Windows\System\CikUNuQ.exe
  2⤵
  PID:3652
- C:\Windows\System\YanaenA.exe
  C:\Windows\System\YanaenA.exe
  2⤵
  PID:3740
- C:\Windows\System\OKHrQXA.exe
  C:\Windows\System\OKHrQXA.exe
  2⤵
  PID:3724
- C:\Windows\System\VzUfDtV.exe
  C:\Windows\System\VzUfDtV.exe
  2⤵
  PID:3808
- C:\Windows\System\JrvkPYQ.exe
  C:\Windows\System\JrvkPYQ.exe
  2⤵
  PID:3876
- C:\Windows\System\TzLGahB.exe
  C:\Windows\System\TzLGahB.exe
  2⤵
  PID:3940
- C:\Windows\System\XxCkGoh.exe
  C:\Windows\System\XxCkGoh.exe
  2⤵
  PID:3792
- C:\Windows\System\vCjEjto.exe
  C:\Windows\System\vCjEjto.exe
  2⤵
  PID:3976
- C:\Windows\System\cvIDkoM.exe
  C:\Windows\System\cvIDkoM.exe
  2⤵
  PID:3928
- C:\Windows\System\YigflHr.exe
  C:\Windows\System\YigflHr.exe
  2⤵
  PID:2216
- C:\Windows\System\xgTgkql.exe
  C:\Windows\System\xgTgkql.exe
  2⤵
  PID:4028
- C:\Windows\System\WbcGioa.exe
  C:\Windows\System\WbcGioa.exe
  2⤵
  PID:4052
- C:\Windows\System\VUgxBft.exe
  C:\Windows\System\VUgxBft.exe
  2⤵
  PID:4068
- C:\Windows\System\QfIwHfv.exe
  C:\Windows\System\QfIwHfv.exe
  2⤵
  PID:980
- C:\Windows\System\dVGXaek.exe
  C:\Windows\System\dVGXaek.exe
  2⤵
  PID:3124
- C:\Windows\System\SmEOEhk.exe
  C:\Windows\System\SmEOEhk.exe
  2⤵
  PID:1844
- C:\Windows\System\EqHLvob.exe
  C:\Windows\System\EqHLvob.exe
  2⤵
  PID:3172
- C:\Windows\System\vSYfeNw.exe
  C:\Windows\System\vSYfeNw.exe
  2⤵
  PID:2484
- C:\Windows\System\zWUubZK.exe
  C:\Windows\System\zWUubZK.exe
  2⤵
  PID:3304
- C:\Windows\System\kYNaFjD.exe
  C:\Windows\System\kYNaFjD.exe
  2⤵
  PID:3236
- C:\Windows\System\WmjIhel.exe
  C:\Windows\System\WmjIhel.exe
  2⤵
  PID:3360
- C:\Windows\System\ptwlIaD.exe
  C:\Windows\System\ptwlIaD.exe
  2⤵
  PID:3336
- C:\Windows\System\omketTD.exe
  C:\Windows\System\omketTD.exe
  2⤵
  PID:3400
- C:\Windows\System\ucClpDK.exe
  C:\Windows\System\ucClpDK.exe
  2⤵
  PID:3416
- C:\Windows\System\DxCZkrV.exe
  C:\Windows\System\DxCZkrV.exe
  2⤵
  PID:3472
- C:\Windows\System\XkDHTnV.exe
  C:\Windows\System\XkDHTnV.exe
  2⤵
  PID:3592
- C:\Windows\System\tSveWvo.exe
  C:\Windows\System\tSveWvo.exe
  2⤵
  PID:3540
- C:\Windows\System\uMsirUL.exe
  C:\Windows\System\uMsirUL.exe
  2⤵
  PID:3708
- C:\Windows\System\qstJTgI.exe
  C:\Windows\System\qstJTgI.exe
  2⤵
  PID:3804
- C:\Windows\System\NUzQbiP.exe
  C:\Windows\System\NUzQbiP.exe
  2⤵
  PID:3860
- C:\Windows\System\WyJKFkl.exe
  C:\Windows\System\WyJKFkl.exe
  2⤵
  PID:3992
- C:\Windows\System\hsGJMlH.exe
  C:\Windows\System\hsGJMlH.exe
  2⤵
  PID:4016
- C:\Windows\System\blYAYMY.exe
  C:\Windows\System\blYAYMY.exe
  2⤵
  PID:3616
- C:\Windows\System\VNWLFcE.exe
  C:\Windows\System\VNWLFcE.exe
  2⤵
  PID:3840
- C:\Windows\System\EXGvyaX.exe
  C:\Windows\System\EXGvyaX.exe
  2⤵
  PID:3892
- C:\Windows\System\ohtnmHj.exe
  C:\Windows\System\ohtnmHj.exe
  2⤵
  PID:4044
- C:\Windows\System\OntrcGO.exe
  C:\Windows\System\OntrcGO.exe
  2⤵
  PID:1780
- C:\Windows\System\PkWQQsG.exe
  C:\Windows\System\PkWQQsG.exe
  2⤵
  PID:4064
- C:\Windows\System\HrqQXus.exe
  C:\Windows\System\HrqQXus.exe
  2⤵
  PID:3204
- C:\Windows\System\QVHCKiP.exe
  C:\Windows\System\QVHCKiP.exe
  2⤵
  PID:3352
- C:\Windows\System\ejyCNHt.exe
  C:\Windows\System\ejyCNHt.exe
  2⤵
  PID:3248
- C:\Windows\System\miUfxxU.exe
  C:\Windows\System\miUfxxU.exe
  2⤵
  PID:3140
- C:\Windows\System\sxhAaMG.exe
  C:\Windows\System\sxhAaMG.exe
  2⤵
  PID:3288
- C:\Windows\System\SyTmjFX.exe
  C:\Windows\System\SyTmjFX.exe
  2⤵
  PID:3912
- C:\Windows\System\mpXGhuH.exe
  C:\Windows\System\mpXGhuH.exe
  2⤵
  PID:3720
- C:\Windows\System\aoqwToW.exe
  C:\Windows\System\aoqwToW.exe
  2⤵
  PID:4060
- C:\Windows\System\rAxpejM.exe
  C:\Windows\System\rAxpejM.exe
  2⤵
  PID:3108
- C:\Windows\System\HasyAnT.exe
  C:\Windows\System\HasyAnT.exe
  2⤵
  PID:3524
- C:\Windows\System\LQPWdVL.exe
  C:\Windows\System\LQPWdVL.exe
  2⤵
  PID:3372
- C:\Windows\System\KVezKiH.exe
  C:\Windows\System\KVezKiH.exe
  2⤵
  PID:3752
- C:\Windows\System\sCyIwDr.exe
  C:\Windows\System\sCyIwDr.exe
  2⤵
  PID:3776
- C:\Windows\System\plzKzYs.exe
  C:\Windows\System\plzKzYs.exe
  2⤵
  PID:4112
- C:\Windows\System\bQxegPj.exe
  C:\Windows\System\bQxegPj.exe
  2⤵
  PID:4128
- C:\Windows\System\gKYRTde.exe
  C:\Windows\System\gKYRTde.exe
  2⤵
  PID:4144
- C:\Windows\System\kqxlvTS.exe
  C:\Windows\System\kqxlvTS.exe
  2⤵
  PID:4160
- C:\Windows\System\DfuXwAF.exe
  C:\Windows\System\DfuXwAF.exe
  2⤵
  PID:4176
- C:\Windows\System\pBLJGJU.exe
  C:\Windows\System\pBLJGJU.exe
  2⤵
  PID:4192
- C:\Windows\System\jzQyqYb.exe
  C:\Windows\System\jzQyqYb.exe
  2⤵
  PID:4208
- C:\Windows\System\tVdclgR.exe
  C:\Windows\System\tVdclgR.exe
  2⤵
  PID:4224
- C:\Windows\System\JtQOors.exe
  C:\Windows\System\JtQOors.exe
  2⤵
  PID:4240
- C:\Windows\System\rpkzxQP.exe
  C:\Windows\System\rpkzxQP.exe
  2⤵
  PID:4256
- C:\Windows\System\GVQUlXv.exe
  C:\Windows\System\GVQUlXv.exe
  2⤵
  PID:4272
- C:\Windows\System\OIMtoot.exe
  C:\Windows\System\OIMtoot.exe
  2⤵
  PID:4288
- C:\Windows\System\qieiKpB.exe
  C:\Windows\System\qieiKpB.exe
  2⤵
  PID:4304
- C:\Windows\System\EqYNXGQ.exe
  C:\Windows\System\EqYNXGQ.exe
  2⤵
  PID:4320
- C:\Windows\System\sYMDbCq.exe
  C:\Windows\System\sYMDbCq.exe
  2⤵
  PID:4340
- C:\Windows\System\vtDCbeq.exe
  C:\Windows\System\vtDCbeq.exe
  2⤵
  PID:4356
- C:\Windows\System\ukmSSRu.exe
  C:\Windows\System\ukmSSRu.exe
  2⤵
  PID:4372
- C:\Windows\System\YNEMlWB.exe
  C:\Windows\System\YNEMlWB.exe
  2⤵
  PID:4388
- C:\Windows\System\TvSPBKP.exe
  C:\Windows\System\TvSPBKP.exe
  2⤵
  PID:4404
- C:\Windows\System\tJfeNdf.exe
  C:\Windows\System\tJfeNdf.exe
  2⤵
  PID:4420
- C:\Windows\System\IfNjNNo.exe
  C:\Windows\System\IfNjNNo.exe
  2⤵
  PID:4436
- C:\Windows\System\dvzMqJW.exe
  C:\Windows\System\dvzMqJW.exe
  2⤵
  PID:4452
- C:\Windows\System\TNMyrjT.exe
  C:\Windows\System\TNMyrjT.exe
  2⤵
  PID:4468
- C:\Windows\System\Uhrenqe.exe
  C:\Windows\System\Uhrenqe.exe
  2⤵
  PID:4484
- C:\Windows\System\bkzpXKU.exe
  C:\Windows\System\bkzpXKU.exe
  2⤵
  PID:4500
- C:\Windows\System\ZtUxdAH.exe
  C:\Windows\System\ZtUxdAH.exe
  2⤵
  PID:4516
- C:\Windows\System\oMaSTFR.exe
  C:\Windows\System\oMaSTFR.exe
  2⤵
  PID:4532
- C:\Windows\System\VpgEEXX.exe
  C:\Windows\System\VpgEEXX.exe
  2⤵
  PID:4548
- C:\Windows\System\eUqAdjX.exe
  C:\Windows\System\eUqAdjX.exe
  2⤵
  PID:4572
- C:\Windows\System\cWdOVMr.exe
  C:\Windows\System\cWdOVMr.exe
  2⤵
  PID:4596
- C:\Windows\System\fYGXRZG.exe
  C:\Windows\System\fYGXRZG.exe
  2⤵
  PID:4612
- C:\Windows\System\MZgggUi.exe
  C:\Windows\System\MZgggUi.exe
  2⤵
  PID:4628
- C:\Windows\System\mEdowEV.exe
  C:\Windows\System\mEdowEV.exe
  2⤵
  PID:4644
- C:\Windows\System\ACvyaUA.exe
  C:\Windows\System\ACvyaUA.exe
  2⤵
  PID:4660
- C:\Windows\System\GQcBXai.exe
  C:\Windows\System\GQcBXai.exe
  2⤵
  PID:4688
- C:\Windows\System\nYNhjyI.exe
  C:\Windows\System\nYNhjyI.exe
  2⤵
  PID:4704
- C:\Windows\System\pfbpbSL.exe
  C:\Windows\System\pfbpbSL.exe
  2⤵
  PID:4720
- C:\Windows\System\OOQlKVZ.exe
  C:\Windows\System\OOQlKVZ.exe
  2⤵
  PID:4740
- C:\Windows\System\knDOdEh.exe
  C:\Windows\System\knDOdEh.exe
  2⤵
  PID:4756
- C:\Windows\System\cVSaZLi.exe
  C:\Windows\System\cVSaZLi.exe
  2⤵
  PID:4776
- C:\Windows\System\ggcLrpw.exe
  C:\Windows\System\ggcLrpw.exe
  2⤵
  PID:4792
- C:\Windows\System\JYRVGmi.exe
  C:\Windows\System\JYRVGmi.exe
  2⤵
  PID:4812
- C:\Windows\System\PvYmwOt.exe
  C:\Windows\System\PvYmwOt.exe
  2⤵
  PID:4828
- C:\Windows\System\xeuspOn.exe
  C:\Windows\System\xeuspOn.exe
  2⤵
  PID:4844
- C:\Windows\System\SXePRQa.exe
  C:\Windows\System\SXePRQa.exe
  2⤵
  PID:4860
- C:\Windows\System\GVScoav.exe
  C:\Windows\System\GVScoav.exe
  2⤵
  PID:4876
- C:\Windows\System\mtSRdSW.exe
  C:\Windows\System\mtSRdSW.exe
  2⤵
  PID:4896
- C:\Windows\System\jQhuvzA.exe
  C:\Windows\System\jQhuvzA.exe
  2⤵
  PID:4912
- C:\Windows\System\SjhNrlz.exe
  C:\Windows\System\SjhNrlz.exe
  2⤵
  PID:4928
- C:\Windows\System\hgSNAlB.exe
  C:\Windows\System\hgSNAlB.exe
  2⤵
  PID:4944
- C:\Windows\System\YRCsemv.exe
  C:\Windows\System\YRCsemv.exe
  2⤵
  PID:4960
- C:\Windows\System\oixvWjH.exe
  C:\Windows\System\oixvWjH.exe
  2⤵
  PID:4976
- C:\Windows\System\cjruqsi.exe
  C:\Windows\System\cjruqsi.exe
  2⤵
  PID:4992
- C:\Windows\System\qPFMrrI.exe
  C:\Windows\System\qPFMrrI.exe
  2⤵
  PID:5024
- C:\Windows\System\ZkAUPKx.exe
  C:\Windows\System\ZkAUPKx.exe
  2⤵
  PID:5040
- C:\Windows\System\QgiAJYt.exe
  C:\Windows\System\QgiAJYt.exe
  2⤵
  PID:5056
- C:\Windows\System\SmSzMSV.exe
  C:\Windows\System\SmSzMSV.exe
  2⤵
  PID:5072
- C:\Windows\System\Tnxmgue.exe
  C:\Windows\System\Tnxmgue.exe
  2⤵
  PID:5088
- C:\Windows\System\tAAIXaE.exe
  C:\Windows\System\tAAIXaE.exe
  2⤵
  PID:5104
- C:\Windows\System\nskdOZe.exe
  C:\Windows\System\nskdOZe.exe
  2⤵
  PID:3520
- C:\Windows\System\zDXvjlQ.exe
  C:\Windows\System\zDXvjlQ.exe
  2⤵
  PID:4104
- C:\Windows\System\vcPdeTG.exe
  C:\Windows\System\vcPdeTG.exe
  2⤵
  PID:4232
- C:\Windows\System\ghyrsJU.exe
  C:\Windows\System\ghyrsJU.exe
  2⤵
  PID:4204
- C:\Windows\System\PzBjFgf.exe
  C:\Windows\System\PzBjFgf.exe
  2⤵
  PID:576
- C:\Windows\System\gFZrcnA.exe
  C:\Windows\System\gFZrcnA.exe
  2⤵
  PID:3436
- C:\Windows\System\hQWBqKb.exe
  C:\Windows\System\hQWBqKb.exe
  2⤵
  PID:3580
- C:\Windows\System\rrGNoPz.exe
  C:\Windows\System\rrGNoPz.exe
  2⤵
  PID:4000
- C:\Windows\System\erFyNbl.exe
  C:\Windows\System\erFyNbl.exe
  2⤵
  PID:3704
- C:\Windows\System\RTtERBV.exe
  C:\Windows\System\RTtERBV.exe
  2⤵
  PID:4336
- C:\Windows\System\rkIvdHk.exe
  C:\Windows\System\rkIvdHk.exe
  2⤵
  PID:4368
- C:\Windows\System\bKNcMfo.exe
  C:\Windows\System\bKNcMfo.exe
  2⤵
  PID:4428
- C:\Windows\System\cshyKUB.exe
  C:\Windows\System\cshyKUB.exe
  2⤵
  PID:4412
- C:\Windows\System\CMURxQO.exe
  C:\Windows\System\CMURxQO.exe
  2⤵
  PID:4220
- C:\Windows\System\VLmzuOs.exe
  C:\Windows\System\VLmzuOs.exe
  2⤵
  PID:4284
- C:\Windows\System\wOxwquG.exe
  C:\Windows\System\wOxwquG.exe
  2⤵
  PID:4316
- C:\Windows\System\GebuiAq.exe
  C:\Windows\System\GebuiAq.exe
  2⤵
  PID:4460
- C:\Windows\System\fUHPwES.exe
  C:\Windows\System\fUHPwES.exe
  2⤵
  PID:4492
- C:\Windows\System\AXUwlGR.exe
  C:\Windows\System\AXUwlGR.exe
  2⤵
  PID:4560
- C:\Windows\System\kpDkCyE.exe
  C:\Windows\System\kpDkCyE.exe
  2⤵
  PID:4544
- C:\Windows\System\onUmnOe.exe
  C:\Windows\System\onUmnOe.exe
  2⤵
  PID:4640
- C:\Windows\System\wqnoFys.exe
  C:\Windows\System\wqnoFys.exe
  2⤵
  PID:4676
- C:\Windows\System\AhLjGyN.exe
  C:\Windows\System\AhLjGyN.exe
  2⤵
  PID:4580
- C:\Windows\System\qFfXByD.exe
  C:\Windows\System\qFfXByD.exe
  2⤵
  PID:4620
- C:\Windows\System\dziOclD.exe
  C:\Windows\System\dziOclD.exe
  2⤵
  PID:4752
- C:\Windows\System\CjJPdDH.exe
  C:\Windows\System\CjJPdDH.exe
  2⤵
  PID:4656
- C:\Windows\System\kpdbgNN.exe
  C:\Windows\System\kpdbgNN.exe
  2⤵
  PID:4820
- C:\Windows\System\bfQyHVx.exe
  C:\Windows\System\bfQyHVx.exe
  2⤵
  PID:4892
- C:\Windows\System\sUBlPXC.exe
  C:\Windows\System\sUBlPXC.exe
  2⤵
  PID:4984
- C:\Windows\System\TnmTFzi.exe
  C:\Windows\System\TnmTFzi.exe
  2⤵
  PID:4768
- C:\Windows\System\AdESUch.exe
  C:\Windows\System\AdESUch.exe
  2⤵
  PID:4808
- C:\Windows\System\CMwwnTP.exe
  C:\Windows\System\CMwwnTP.exe
  2⤵
  PID:4904
- C:\Windows\System\muRvHPI.exe
  C:\Windows\System\muRvHPI.exe
  2⤵
  PID:4940
- C:\Windows\System\GlCrRWh.exe
  C:\Windows\System\GlCrRWh.exe
  2⤵
  PID:5012
- C:\Windows\System\hHjMXER.exe
  C:\Windows\System\hHjMXER.exe
  2⤵
  PID:5064
- C:\Windows\System\ryYTqOa.exe
  C:\Windows\System\ryYTqOa.exe
  2⤵
  PID:5096
- C:\Windows\System\ajprTYR.exe
  C:\Windows\System\ajprTYR.exe
  2⤵
  PID:4172
- C:\Windows\System\KJlYzwf.exe
  C:\Windows\System\KJlYzwf.exe
  2⤵
  PID:3696
- C:\Windows\System\mdQMofO.exe
  C:\Windows\System\mdQMofO.exe
  2⤵
  PID:4008
- C:\Windows\System\bBAoqGh.exe
  C:\Windows\System\bBAoqGh.exe
  2⤵
  PID:4120
- C:\Windows\System\wopvpJf.exe
  C:\Windows\System\wopvpJf.exe
  2⤵
  PID:4464
- C:\Windows\System\dxUOnui.exe
  C:\Windows\System\dxUOnui.exe
  2⤵
  PID:4564
- C:\Windows\System\gYJoNuF.exe
  C:\Windows\System\gYJoNuF.exe
  2⤵
  PID:4684
- C:\Windows\System\Vyxekbb.exe
  C:\Windows\System\Vyxekbb.exe
  2⤵
  PID:5048
- C:\Windows\System\aMzTvUU.exe
  C:\Windows\System\aMzTvUU.exe
  2⤵
  PID:4852
- C:\Windows\System\gpLPINa.exe
  C:\Windows\System\gpLPINa.exe
  2⤵
  PID:4136
- C:\Windows\System\xUFxvub.exe
  C:\Windows\System\xUFxvub.exe
  2⤵
  PID:3092
- C:\Windows\System\IWBLdUB.exe
  C:\Windows\System\IWBLdUB.exe
  2⤵
  PID:4040
- C:\Windows\System\eFXwtAm.exe
  C:\Windows\System\eFXwtAm.exe
  2⤵
  PID:4252
- C:\Windows\System\LxPqEpQ.exe
  C:\Windows\System\LxPqEpQ.exe
  2⤵
  PID:4348
- C:\Windows\System\vILztcO.exe
  C:\Windows\System\vILztcO.exe
  2⤵
  PID:4636
- C:\Windows\System\NRfmzOv.exe
  C:\Windows\System\NRfmzOv.exe
  2⤵
  PID:4748
- C:\Windows\System\LkUDnmc.exe
  C:\Windows\System\LkUDnmc.exe
  2⤵
  PID:4856
- C:\Windows\System\lxgOIHg.exe
  C:\Windows\System\lxgOIHg.exe
  2⤵
  PID:4764
- C:\Windows\System\gtxnlKL.exe
  C:\Windows\System\gtxnlKL.exe
  2⤵
  PID:4868
- C:\Windows\System\gUeQDQV.exe
  C:\Windows\System\gUeQDQV.exe
  2⤵
  PID:4788
- C:\Windows\System\bnwlafH.exe
  C:\Windows\System\bnwlafH.exe
  2⤵
  PID:4296
- C:\Windows\System\DJJKSpt.exe
  C:\Windows\System\DJJKSpt.exe
  2⤵
  PID:4380
- C:\Windows\System\rnDNVLj.exe
  C:\Windows\System\rnDNVLj.exe
  2⤵
  PID:5036
- C:\Windows\System\tqtfpsl.exe
  C:\Windows\System\tqtfpsl.exe
  2⤵
  PID:4804
- C:\Windows\System\QQYljCf.exe
  C:\Windows\System\QQYljCf.exe
  2⤵
  PID:2524
- C:\Windows\System\hMcStkY.exe
  C:\Windows\System\hMcStkY.exe
  2⤵
  PID:4672
- C:\Windows\System\FJgPBxH.exe
  C:\Windows\System\FJgPBxH.exe
  2⤵
  PID:4140
- C:\Windows\System\KKdSnrG.exe
  C:\Windows\System\KKdSnrG.exe
  2⤵
  PID:4476
- C:\Windows\System\CmzriHV.exe
  C:\Windows\System\CmzriHV.exe
  2⤵
  PID:3820
- C:\Windows\System\bcfQfZA.exe
  C:\Windows\System\bcfQfZA.exe
  2⤵
  PID:4924
- C:\Windows\System\mCmbeti.exe
  C:\Windows\System\mCmbeti.exe
  2⤵
  PID:4352
- C:\Windows\System\yIEEJwU.exe
  C:\Windows\System\yIEEJwU.exe
  2⤵
  PID:4716
- C:\Windows\System\HHluPQe.exe
  C:\Windows\System\HHluPQe.exe
  2⤵
  PID:4332
- C:\Windows\System\pQNPlZF.exe
  C:\Windows\System\pQNPlZF.exe
  2⤵
  PID:1104
- C:\Windows\System\AXUqxmv.exe
  C:\Windows\System\AXUqxmv.exe
  2⤵
  PID:2492
- C:\Windows\System\MZErRxd.exe
  C:\Windows\System\MZErRxd.exe
  2⤵
  PID:5080
- C:\Windows\System\VmBVgyY.exe
  C:\Windows\System\VmBVgyY.exe
  2⤵
  PID:5116
- C:\Windows\System\rbpVlko.exe
  C:\Windows\System\rbpVlko.exe
  2⤵
  PID:5132
- C:\Windows\System\IWZjMAZ.exe
  C:\Windows\System\IWZjMAZ.exe
  2⤵
  PID:5148
- C:\Windows\System\ghTmBmM.exe
  C:\Windows\System\ghTmBmM.exe
  2⤵
  PID:5176
- C:\Windows\System\TuvNhic.exe
  C:\Windows\System\TuvNhic.exe
  2⤵
  PID:5192
- C:\Windows\System\FArORAI.exe
  C:\Windows\System\FArORAI.exe
  2⤵
  PID:5208
- C:\Windows\System\mVODuoV.exe
  C:\Windows\System\mVODuoV.exe
  2⤵
  PID:5224
- C:\Windows\System\DAQOfMa.exe
  C:\Windows\System\DAQOfMa.exe
  2⤵
  PID:5240
- C:\Windows\System\ERCNUIP.exe
  C:\Windows\System\ERCNUIP.exe
  2⤵
  PID:5256
- C:\Windows\System\UGoAsly.exe
  C:\Windows\System\UGoAsly.exe
  2⤵
  PID:5272
- C:\Windows\System\bXbqTlj.exe
  C:\Windows\System\bXbqTlj.exe
  2⤵
  PID:5292
- C:\Windows\System\MzzXnlo.exe
  C:\Windows\System\MzzXnlo.exe
  2⤵
  PID:5308
- C:\Windows\System\COaDKTm.exe
  C:\Windows\System\COaDKTm.exe
  2⤵
  PID:5324
- C:\Windows\System\BVAssuU.exe
  C:\Windows\System\BVAssuU.exe
  2⤵
  PID:5344
- C:\Windows\System\DGWIhMp.exe
  C:\Windows\System\DGWIhMp.exe
  2⤵
  PID:5360
- C:\Windows\System\WlcGodX.exe
  C:\Windows\System\WlcGodX.exe
  2⤵
  PID:5376
- C:\Windows\System\vCglEpQ.exe
  C:\Windows\System\vCglEpQ.exe
  2⤵
  PID:5392
- C:\Windows\System\gKNzzid.exe
  C:\Windows\System\gKNzzid.exe
  2⤵
  PID:5408
- C:\Windows\System\NdjZuNG.exe
  C:\Windows\System\NdjZuNG.exe
  2⤵
  PID:5428
- C:\Windows\System\nJiyBEP.exe
  C:\Windows\System\nJiyBEP.exe
  2⤵
  PID:5444
- C:\Windows\System\bkPxVyq.exe
  C:\Windows\System\bkPxVyq.exe
  2⤵
  PID:5460
- C:\Windows\System\oMTwCMm.exe
  C:\Windows\System\oMTwCMm.exe
  2⤵
  PID:5480
- C:\Windows\System\gQOTApH.exe
  C:\Windows\System\gQOTApH.exe
  2⤵
  PID:5496
- C:\Windows\System\zdYnrwa.exe
  C:\Windows\System\zdYnrwa.exe
  2⤵
  PID:5512
- C:\Windows\System\GZBllaV.exe
  C:\Windows\System\GZBllaV.exe
  2⤵
  PID:5528
- C:\Windows\System\eSnmDOP.exe
  C:\Windows\System\eSnmDOP.exe
  2⤵
  PID:5544
- C:\Windows\System\JhrFaDf.exe
  C:\Windows\System\JhrFaDf.exe
  2⤵
  PID:5564
- C:\Windows\System\PPdFqQu.exe
  C:\Windows\System\PPdFqQu.exe
  2⤵
  PID:5580
- C:\Windows\System\LlbTNqk.exe
  C:\Windows\System\LlbTNqk.exe
  2⤵
  PID:5596
- C:\Windows\System\IULvGwf.exe
  C:\Windows\System\IULvGwf.exe
  2⤵
  PID:5612
- C:\Windows\System\BNPjlRv.exe
  C:\Windows\System\BNPjlRv.exe
  2⤵
  PID:5628
- C:\Windows\System\NYWKNFi.exe
  C:\Windows\System\NYWKNFi.exe
  2⤵
  PID:5644
- C:\Windows\System\vSkQgQD.exe
  C:\Windows\System\vSkQgQD.exe
  2⤵
  PID:5664
- C:\Windows\System\dCTkmnJ.exe
  C:\Windows\System\dCTkmnJ.exe
  2⤵
  PID:5680
- C:\Windows\System\LgVahnD.exe
  C:\Windows\System\LgVahnD.exe
  2⤵
  PID:5696
- C:\Windows\System\ilIvysJ.exe
  C:\Windows\System\ilIvysJ.exe
  2⤵
  PID:5712
- C:\Windows\System\tOUpPmF.exe
  C:\Windows\System\tOUpPmF.exe
  2⤵
  PID:5728
- C:\Windows\System\eouJsFp.exe
  C:\Windows\System\eouJsFp.exe
  2⤵
  PID:5744
- C:\Windows\System\QHjBmYr.exe
  C:\Windows\System\QHjBmYr.exe
  2⤵
  PID:5760
- C:\Windows\System\qEMaqet.exe
  C:\Windows\System\qEMaqet.exe
  2⤵
  PID:5780
- C:\Windows\System\xZrXdBp.exe
  C:\Windows\System\xZrXdBp.exe
  2⤵
  PID:5796
- C:\Windows\System\IfVNJbm.exe
  C:\Windows\System\IfVNJbm.exe
  2⤵
  PID:5812
- C:\Windows\System\TkPsdlH.exe
  C:\Windows\System\TkPsdlH.exe
  2⤵
  PID:5828
- C:\Windows\System\zIaVbnQ.exe
  C:\Windows\System\zIaVbnQ.exe
  2⤵
  PID:5844
- C:\Windows\System\qcJXlmb.exe
  C:\Windows\System\qcJXlmb.exe
  2⤵
  PID:5864
- C:\Windows\System\bKaNVNe.exe
  C:\Windows\System\bKaNVNe.exe
  2⤵
  PID:5880
- C:\Windows\System\MJRGpYw.exe
  C:\Windows\System\MJRGpYw.exe
  2⤵
  PID:5896
- C:\Windows\System\OkkGwWA.exe
  C:\Windows\System\OkkGwWA.exe
  2⤵
  PID:5932
- C:\Windows\System\hVqFSnI.exe
  C:\Windows\System\hVqFSnI.exe
  2⤵
  PID:5948
- C:\Windows\System\DnQbPzi.exe
  C:\Windows\System\DnQbPzi.exe
  2⤵
  PID:5968
- C:\Windows\System\LikcvPk.exe
  C:\Windows\System\LikcvPk.exe
  2⤵
  PID:5984
- C:\Windows\System\FgblIUc.exe
  C:\Windows\System\FgblIUc.exe
  2⤵
  PID:6000
- C:\Windows\System\zTTDKCr.exe
  C:\Windows\System\zTTDKCr.exe
  2⤵
  PID:6016
- C:\Windows\System\mrFQTFI.exe
  C:\Windows\System\mrFQTFI.exe
  2⤵
  PID:6036
- C:\Windows\System\eOQxFJA.exe
  C:\Windows\System\eOQxFJA.exe
  2⤵
  PID:6052
- C:\Windows\System\lupPfIG.exe
  C:\Windows\System\lupPfIG.exe
  2⤵
  PID:6068
- C:\Windows\System\XOMdLhl.exe
  C:\Windows\System\XOMdLhl.exe
  2⤵
  PID:6084
- C:\Windows\System\MtlReKL.exe
  C:\Windows\System\MtlReKL.exe
  2⤵
  PID:6100
- C:\Windows\System\nFkXOSj.exe
  C:\Windows\System\nFkXOSj.exe
  2⤵
  PID:6116
- C:\Windows\System\EHnqPWr.exe
  C:\Windows\System\EHnqPWr.exe
  2⤵
  PID:6132
- C:\Windows\System\qfpeMoA.exe
  C:\Windows\System\qfpeMoA.exe
  2⤵
  PID:5128
- C:\Windows\System\sUthSmg.exe
  C:\Windows\System\sUthSmg.exe
  2⤵
  PID:5200
- C:\Windows\System\eqnPnwq.exe
  C:\Windows\System\eqnPnwq.exe
  2⤵
  PID:5264
- C:\Windows\System\oZwAXnI.exe
  C:\Windows\System\oZwAXnI.exe
  2⤵
  PID:5332
- C:\Windows\System\rjwzGQp.exe
  C:\Windows\System\rjwzGQp.exe
  2⤵
  PID:5220
- C:\Windows\System\lnqfzUu.exe
  C:\Windows\System\lnqfzUu.exe
  2⤵
  PID:5400
- C:\Windows\System\ewdOLJb.exe
  C:\Windows\System\ewdOLJb.exe
  2⤵
  PID:5468
- C:\Windows\System\FkfdPcz.exe
  C:\Windows\System\FkfdPcz.exe
  2⤵
  PID:5508
- C:\Windows\System\hIdlilv.exe
  C:\Windows\System\hIdlilv.exe
  2⤵
  PID:4624
- C:\Windows\System\GmUiiAE.exe
  C:\Windows\System\GmUiiAE.exe
  2⤵
  PID:4728
- C:\Windows\System\YqucYNk.exe
  C:\Windows\System\YqucYNk.exe
  2⤵
  PID:5540
- C:\Windows\System\VgrjEKT.exe
  C:\Windows\System\VgrjEKT.exe
  2⤵
  PID:2244
- C:\Windows\System\lWvLTPd.exe
  C:\Windows\System\lWvLTPd.exe
  2⤵
  PID:4888
- C:\Windows\System\NUvCmIh.exe
  C:\Windows\System\NUvCmIh.exe
  2⤵
  PID:5140
- C:\Windows\System\zkRXSAH.exe
  C:\Windows\System\zkRXSAH.exe
  2⤵
  PID:5184
- C:\Windows\System\AwIhmAI.exe
  C:\Windows\System\AwIhmAI.exe
  2⤵
  PID:5420
- C:\Windows\System\XrBcXvg.exe
  C:\Windows\System\XrBcXvg.exe
  2⤵
  PID:5488
- C:\Windows\System\DjTCrxd.exe
  C:\Windows\System\DjTCrxd.exe
  2⤵
  PID:5560
- C:\Windows\System\rKyVGDY.exe
  C:\Windows\System\rKyVGDY.exe
  2⤵
  PID:5640
- C:\Windows\System\FeIzXhF.exe
  C:\Windows\System\FeIzXhF.exe
  2⤵
  PID:2124
- C:\Windows\System\AfyvHdF.exe
  C:\Windows\System\AfyvHdF.exe
  2⤵
  PID:5956
- C:\Windows\System\yGqoELu.exe
  C:\Windows\System\yGqoELu.exe
  2⤵
  PID:6064
- C:\Windows\System\syvOJNv.exe
  C:\Windows\System\syvOJNv.exe
  2⤵
  PID:5340
- C:\Windows\System\LTVktFY.exe
  C:\Windows\System\LTVktFY.exe
  2⤵
  PID:5524
- C:\Windows\System\zLCRCzw.exe
  C:\Windows\System\zLCRCzw.exe
  2⤵
  PID:2304
- C:\Windows\System\sSsPcxz.exe
  C:\Windows\System\sSsPcxz.exe
  2⤵
  PID:1084
- C:\Windows\System\owVVLMH.exe
  C:\Windows\System\owVVLMH.exe
  2⤵
  PID:5692
- C:\Windows\System\pTAybBr.exe
  C:\Windows\System\pTAybBr.exe
  2⤵
  PID:5924
- C:\Windows\System\otAizmY.exe
  C:\Windows\System\otAizmY.exe
  2⤵
  PID:5964
- C:\Windows\System\HalWypo.exe
  C:\Windows\System\HalWypo.exe
  2⤵
  PID:6032
- C:\Windows\System\rtPsgqP.exe
  C:\Windows\System\rtPsgqP.exe
  2⤵
  PID:5852
- C:\Windows\System\XQmHcdU.exe
  C:\Windows\System\XQmHcdU.exe
  2⤵
  PID:6008
- C:\Windows\System\hTHLsed.exe
  C:\Windows\System\hTHLsed.exe
  2⤵
  PID:6060
- C:\Windows\System\gtwIVIg.exe
  C:\Windows\System\gtwIVIg.exe
  2⤵
  PID:6124
- C:\Windows\System\rQPCTXb.exe
  C:\Windows\System\rQPCTXb.exe
  2⤵
  PID:5168
- C:\Windows\System\RFgmlxA.exe
  C:\Windows\System\RFgmlxA.exe
  2⤵
  PID:6140
- C:\Windows\System\AVXbjPs.exe
  C:\Windows\System\AVXbjPs.exe
  2⤵
  PID:5320
- C:\Windows\System\VYXOvaz.exe
  C:\Windows\System\VYXOvaz.exe
  2⤵
  PID:2420
- C:\Windows\System\JKgLUAp.exe
  C:\Windows\System\JKgLUAp.exe
  2⤵
  PID:4556
- C:\Windows\System\jkAcBCK.exe
  C:\Windows\System\jkAcBCK.exe
  2⤵
  PID:5576
- C:\Windows\System\YEHDFyB.exe
  C:\Windows\System\YEHDFyB.exe
  2⤵
  PID:5552
- C:\Windows\System\SpLqxhh.exe
  C:\Windows\System\SpLqxhh.exe
  2⤵
  PID:5944
- C:\Windows\System\AGHWzbe.exe
  C:\Windows\System\AGHWzbe.exe
  2⤵
  PID:5824
- C:\Windows\System\HvuQPAD.exe
  C:\Windows\System\HvuQPAD.exe
  2⤵
  PID:6012
- C:\Windows\System\TfKoaKy.exe
  C:\Windows\System\TfKoaKy.exe
  2⤵
  PID:3516
- C:\Windows\System\qMAdBKi.exe
  C:\Windows\System\qMAdBKi.exe
  2⤵
  PID:6108
- C:\Windows\System\AevICyB.exe
  C:\Windows\System\AevICyB.exe
  2⤵
  PID:5372
- C:\Windows\System\pGBYKBf.exe
  C:\Windows\System\pGBYKBf.exe
  2⤵
  PID:5216
- C:\Windows\System\OsmlpoZ.exe
  C:\Windows\System\OsmlpoZ.exe
  2⤵
  PID:2120
- C:\Windows\System\PIDjfnt.exe
  C:\Windows\System\PIDjfnt.exe
  2⤵
  PID:5440
- C:\Windows\System\XFGxAgQ.exe
  C:\Windows\System\XFGxAgQ.exe
  2⤵
  PID:5452
- C:\Windows\System\BemHuPk.exe
  C:\Windows\System\BemHuPk.exe
  2⤵
  PID:4216
- C:\Windows\System\cxsUlKH.exe
  C:\Windows\System\cxsUlKH.exe
  2⤵
  PID:5724
- C:\Windows\System\ckQgumn.exe
  C:\Windows\System\ckQgumn.exe
  2⤵
  PID:5768
- C:\Windows\System\WeUiyDO.exe
  C:\Windows\System\WeUiyDO.exe
  2⤵
  PID:2592
- C:\Windows\System\lxeJVuD.exe
  C:\Windows\System\lxeJVuD.exe
  2⤵
  PID:5804
- C:\Windows\System\zqLpAAT.exe
  C:\Windows\System\zqLpAAT.exe
  2⤵
  PID:5912
- C:\Windows\System\wQdhMBe.exe
  C:\Windows\System\wQdhMBe.exe
  2⤵
  PID:5688
- C:\Windows\System\wwhbuyc.exe
  C:\Windows\System\wwhbuyc.exe
  2⤵
  PID:5892
- C:\Windows\System\qkxbTlb.exe
  C:\Windows\System\qkxbTlb.exe
  2⤵
  PID:5124
- C:\Windows\System\qvdhDGi.exe
  C:\Windows\System\qvdhDGi.exe
  2⤵
  PID:6044
- C:\Windows\System\wWDEnpp.exe
  C:\Windows\System\wWDEnpp.exe
  2⤵
  PID:5252
- C:\Windows\System\GOdhHPN.exe
  C:\Windows\System\GOdhHPN.exe
  2⤵
  PID:5416
- C:\Windows\System\XauIkVZ.exe
  C:\Windows\System\XauIkVZ.exe
  2⤵
  PID:5232
- C:\Windows\System\CSzaWTR.exe
  C:\Windows\System\CSzaWTR.exe
  2⤵
  PID:5304
- C:\Windows\System\NNsFfgv.exe
  C:\Windows\System\NNsFfgv.exe
  2⤵
  PID:5808
- C:\Windows\System\hhbESLI.exe
  C:\Windows\System\hhbESLI.exe
  2⤵
  PID:5476
- C:\Windows\System\BePfIMZ.exe
  C:\Windows\System\BePfIMZ.exe
  2⤵
  PID:5876
- C:\Windows\System\rpmsxLW.exe
  C:\Windows\System\rpmsxLW.exe
  2⤵
  PID:6048
- C:\Windows\System\jqcSDyA.exe
  C:\Windows\System\jqcSDyA.exe
  2⤵
  PID:2064
- C:\Windows\System\fNMMLpG.exe
  C:\Windows\System\fNMMLpG.exe
  2⤵
  PID:2652
- C:\Windows\System\WyAAMDB.exe
  C:\Windows\System\WyAAMDB.exe
  2⤵
  PID:5916
- C:\Windows\System\AiEiZaB.exe
  C:\Windows\System\AiEiZaB.exe
  2⤵
  PID:5820
- C:\Windows\System\iamQCMB.exe
  C:\Windows\System\iamQCMB.exe
  2⤵
  PID:5656
- C:\Windows\System\mLQpZLr.exe
  C:\Windows\System\mLQpZLr.exe
  2⤵
  PID:5520
- C:\Windows\System\hOZWhYa.exe
  C:\Windows\System\hOZWhYa.exe
  2⤵
  PID:6112
- C:\Windows\System\olocdKB.exe
  C:\Windows\System\olocdKB.exe
  2⤵
  PID:6096
- C:\Windows\System\rByImRX.exe
  C:\Windows\System\rByImRX.exe
  2⤵
  PID:6156
- C:\Windows\System\GimyRfz.exe
  C:\Windows\System\GimyRfz.exe
  2⤵
  PID:6336
- C:\Windows\System\tMGJbmz.exe
  C:\Windows\System\tMGJbmz.exe
  2⤵
  PID:6352
- C:\Windows\System\hlNCXDW.exe
  C:\Windows\System\hlNCXDW.exe
  2⤵
  PID:6368
- C:\Windows\System\cWOIPFG.exe
  C:\Windows\System\cWOIPFG.exe
  2⤵
  PID:6404
- C:\Windows\System\OJcfdwl.exe
  C:\Windows\System\OJcfdwl.exe
  2⤵
  PID:6420
- C:\Windows\System\KtwHzQv.exe
  C:\Windows\System\KtwHzQv.exe
  2⤵
  PID:6436
- C:\Windows\System\GurfPMU.exe
  C:\Windows\System\GurfPMU.exe
  2⤵
  PID:6452
- C:\Windows\System\kNlauta.exe
  C:\Windows\System\kNlauta.exe
  2⤵
  PID:6468
- C:\Windows\System\hpnRLdl.exe
  C:\Windows\System\hpnRLdl.exe
  2⤵
  PID:6484
- C:\Windows\System\jIMZLLw.exe
  C:\Windows\System\jIMZLLw.exe
  2⤵
  PID:6500
- C:\Windows\System\DVPZtVt.exe
  C:\Windows\System\DVPZtVt.exe
  2⤵
  PID:6520
- C:\Windows\System\WewJtGh.exe
  C:\Windows\System\WewJtGh.exe
  2⤵
  PID:6536
- C:\Windows\System\wOVYEMW.exe
  C:\Windows\System\wOVYEMW.exe
  2⤵
  PID:6552
- C:\Windows\System\NrjTzuk.exe
  C:\Windows\System\NrjTzuk.exe
  2⤵
  PID:6568
- C:\Windows\System\RTjRyIk.exe
  C:\Windows\System\RTjRyIk.exe
  2⤵
  PID:6584
- C:\Windows\System\vXgioEM.exe
  C:\Windows\System\vXgioEM.exe
  2⤵
  PID:6604
- C:\Windows\System\UzGWrQc.exe
  C:\Windows\System\UzGWrQc.exe
  2⤵
  PID:6620
- C:\Windows\System\fIwtULe.exe
  C:\Windows\System\fIwtULe.exe
  2⤵
  PID:6636
- C:\Windows\System\OsjoGjS.exe
  C:\Windows\System\OsjoGjS.exe
  2⤵
  PID:6652
- C:\Windows\System\bzVolnG.exe
  C:\Windows\System\bzVolnG.exe
  2⤵
  PID:6668
- C:\Windows\System\OOcGMcL.exe
  C:\Windows\System\OOcGMcL.exe
  2⤵
  PID:6684
- C:\Windows\System\HbRgoov.exe
  C:\Windows\System\HbRgoov.exe
  2⤵
  PID:6700
- C:\Windows\System\vKIlFVf.exe
  C:\Windows\System\vKIlFVf.exe
  2⤵
  PID:6812
- C:\Windows\System\JdzRSzs.exe
  C:\Windows\System\JdzRSzs.exe
  2⤵
  PID:6868
- C:\Windows\System\wtPKzUx.exe
  C:\Windows\System\wtPKzUx.exe
  2⤵
  PID:6892
- C:\Windows\System\IqdKbuV.exe
  C:\Windows\System\IqdKbuV.exe
  2⤵
  PID:6908
- C:\Windows\System\zivhuUF.exe
  C:\Windows\System\zivhuUF.exe
  2⤵
  PID:7068
- C:\Windows\System\JnoqSUv.exe
  C:\Windows\System\JnoqSUv.exe
  2⤵
  PID:7084
- C:\Windows\System\MZPYCwU.exe
  C:\Windows\System\MZPYCwU.exe
  2⤵
  PID:7100
- C:\Windows\System\uzwVBCi.exe
  C:\Windows\System\uzwVBCi.exe
  2⤵
  PID:7152
- C:\Windows\System\nGQoqTt.exe
  C:\Windows\System\nGQoqTt.exe
  2⤵
  PID:5736
- C:\Windows\System\Depeysy.exe
  C:\Windows\System\Depeysy.exe
  2⤵
  PID:268
- C:\Windows\System\AByvaeI.exe
  C:\Windows\System\AByvaeI.exe
  2⤵
  PID:6172
- C:\Windows\System\zFOseeR.exe
  C:\Windows\System\zFOseeR.exe
  2⤵
  PID:6184
- C:\Windows\System\pLpfscj.exe
  C:\Windows\System\pLpfscj.exe
  2⤵
  PID:6200
- C:\Windows\System\xYcYwEJ.exe
  C:\Windows\System\xYcYwEJ.exe
  2⤵
  PID:6224
- C:\Windows\System\PwkGMif.exe
  C:\Windows\System\PwkGMif.exe
  2⤵
  PID:6244
- C:\Windows\System\DWyKbIK.exe
  C:\Windows\System\DWyKbIK.exe
  2⤵
  PID:6260
- C:\Windows\System\WScxNBW.exe
  C:\Windows\System\WScxNBW.exe
  2⤵
  PID:6276
- C:\Windows\System\IxtqTMn.exe
  C:\Windows\System\IxtqTMn.exe
  2⤵
  PID:6292
- C:\Windows\System\askHAGJ.exe
  C:\Windows\System\askHAGJ.exe
  2⤵
  PID:6304
- C:\Windows\System\VObRcJV.exe
  C:\Windows\System\VObRcJV.exe
  2⤵
  PID:6320
- C:\Windows\System\LcosEjK.exe
  C:\Windows\System\LcosEjK.exe
  2⤵
  PID:6376
- C:\Windows\System\hrhcOGx.exe
  C:\Windows\System\hrhcOGx.exe
  2⤵
  PID:6396
- C:\Windows\System\iEgySOe.exe
  C:\Windows\System\iEgySOe.exe
  2⤵
  PID:6328
- C:\Windows\System\aznBPey.exe
  C:\Windows\System\aznBPey.exe
  2⤵
  PID:6428
- C:\Windows\System\TaJTYOB.exe
  C:\Windows\System\TaJTYOB.exe
  2⤵
  PID:6496
- C:\Windows\System\EWvGWSD.exe
  C:\Windows\System\EWvGWSD.exe
  2⤵
  PID:6564
- C:\Windows\System\ohNCkDw.exe
  C:\Windows\System\ohNCkDw.exe
  2⤵
  PID:6628
- C:\Windows\System\xwPDruq.exe
  C:\Windows\System\xwPDruq.exe
  2⤵
  PID:6692
- C:\Windows\System\ShKQTfl.exe
  C:\Windows\System\ShKQTfl.exe
  2⤵
  PID:6580
- C:\Windows\System\NEuFtpI.exe
  C:\Windows\System\NEuFtpI.exe
  2⤵
  PID:6516
- C:\Windows\System\jvATgEZ.exe
  C:\Windows\System\jvATgEZ.exe
  2⤵
  PID:6476
- C:\Windows\System\AxWxagi.exe
  C:\Windows\System\AxWxagi.exe
  2⤵
  PID:6644
- C:\Windows\System\idXDAxt.exe
  C:\Windows\System\idXDAxt.exe
  2⤵
  PID:6412
- C:\Windows\System\dQkBcOg.exe
  C:\Windows\System\dQkBcOg.exe
  2⤵
  PID:6720
- C:\Windows\System\uveMyBe.exe
  C:\Windows\System\uveMyBe.exe
  2⤵
  PID:6740
- C:\Windows\System\bsNxPov.exe
  C:\Windows\System\bsNxPov.exe
  2⤵
  PID:6756
- C:\Windows\System\rzhbLsR.exe
  C:\Windows\System\rzhbLsR.exe
  2⤵
  PID:6772
- C:\Windows\System\XvOVDjj.exe
  C:\Windows\System\XvOVDjj.exe
  2⤵
  PID:6788
- C:\Windows\System\AsbnrSF.exe
  C:\Windows\System\AsbnrSF.exe
  2⤵
  PID:6808
- C:\Windows\System\DqeYSux.exe
  C:\Windows\System\DqeYSux.exe
  2⤵
  PID:6836
- C:\Windows\System\MtLXAxS.exe
  C:\Windows\System\MtLXAxS.exe
  2⤵
  PID:6844
- C:\Windows\System\cCbDBXA.exe
  C:\Windows\System\cCbDBXA.exe
  2⤵
  PID:6860
- C:\Windows\System\bSCADRN.exe
  C:\Windows\System\bSCADRN.exe
  2⤵
  PID:6880
- C:\Windows\System\FkZNjZV.exe
  C:\Windows\System\FkZNjZV.exe
  2⤵
  PID:6916
- C:\Windows\System\zKeEcCr.exe
  C:\Windows\System\zKeEcCr.exe
  2⤵
  PID:6936
- C:\Windows\System\TWQMyot.exe
  C:\Windows\System\TWQMyot.exe
  2⤵
  PID:6952
- C:\Windows\System\WNTxbfG.exe
  C:\Windows\System\WNTxbfG.exe
  2⤵
  PID:6976
- C:\Windows\System\hFOWGCH.exe
  C:\Windows\System\hFOWGCH.exe
  2⤵
  PID:6988
- C:\Windows\System\jqzKnfk.exe
  C:\Windows\System\jqzKnfk.exe
  2⤵
  PID:7004
- C:\Windows\System\mHFwaVV.exe
  C:\Windows\System\mHFwaVV.exe
  2⤵
  PID:7020
- C:\Windows\System\EmifNrR.exe
  C:\Windows\System\EmifNrR.exe
  2⤵
  PID:7036
- C:\Windows\System\vpqgkjs.exe
  C:\Windows\System\vpqgkjs.exe
  2⤵
  PID:7056
- C:\Windows\System\nsJSuVi.exe
  C:\Windows\System\nsJSuVi.exe
  2⤵
  PID:7076
- C:\Windows\System\GgDCrSg.exe
  C:\Windows\System\GgDCrSg.exe
  2⤵
  PID:7120
- C:\Windows\System\MhmbaKN.exe
  C:\Windows\System\MhmbaKN.exe
  2⤵
  PID:7136
- C:\Windows\System\chZvwmv.exe
  C:\Windows\System\chZvwmv.exe
  2⤵
  PID:7144
- C:\Windows\System\nHMPUHF.exe
  C:\Windows\System\nHMPUHF.exe
  2⤵
  PID:5740
- C:\Windows\System\MyEoUKf.exe
  C:\Windows\System\MyEoUKf.exe
  2⤵
  PID:6220
- C:\Windows\System\CrUnKya.exe
  C:\Windows\System\CrUnKya.exe
  2⤵
  PID:6312
- C:\Windows\System\kMQAKeb.exe
  C:\Windows\System\kMQAKeb.exe
  2⤵
  PID:6388
- C:\Windows\System\AxVmWqS.exe
  C:\Windows\System\AxVmWqS.exe
  2⤵
  PID:6528
- C:\Windows\System\TjAXomJ.exe
  C:\Windows\System\TjAXomJ.exe
  2⤵
  PID:6548
- C:\Windows\System\BIuOLmW.exe
  C:\Windows\System\BIuOLmW.exe
  2⤵
  PID:6464
- C:\Windows\System\sfpdYun.exe
  C:\Windows\System\sfpdYun.exe
  2⤵
  PID:6596
- C:\Windows\System\chFWEya.exe
  C:\Windows\System\chFWEya.exe
  2⤵
  PID:5164
- C:\Windows\System\SRttLik.exe
  C:\Windows\System\SRttLik.exe
  2⤵
  PID:6344
- C:\Windows\System\GCcbbsq.exe
  C:\Windows\System\GCcbbsq.exe
  2⤵
  PID:6460
- C:\Windows\System\VEoULvw.exe
  C:\Windows\System\VEoULvw.exe
  2⤵
  PID:6164
- C:\Windows\System\mTsdAbX.exe
  C:\Windows\System\mTsdAbX.exe
  2⤵
  PID:6752
- C:\Windows\System\BjUAmrp.exe
  C:\Windows\System\BjUAmrp.exe
  2⤵
  PID:6192
- C:\Windows\System\UcwiPiF.exe
  C:\Windows\System\UcwiPiF.exe
  2⤵
  PID:6852
- C:\Windows\System\rOBIiTu.exe
  C:\Windows\System\rOBIiTu.exe
  2⤵
  PID:6888
- C:\Windows\System\RENLvUU.exe
  C:\Windows\System\RENLvUU.exe
  2⤵
  PID:6828
- C:\Windows\System\NSqPGvN.exe
  C:\Windows\System\NSqPGvN.exe
  2⤵
  PID:6824
- C:\Windows\System\eafAPGh.exe
  C:\Windows\System\eafAPGh.exe
  2⤵
  PID:6804
- C:\Windows\System\uTjkpIH.exe
  C:\Windows\System\uTjkpIH.exe
  2⤵
  PID:6948
- C:\Windows\System\pSNWgRb.exe
  C:\Windows\System\pSNWgRb.exe
  2⤵
  PID:7044
- C:\Windows\System\dZjzGMK.exe
  C:\Windows\System\dZjzGMK.exe
  2⤵
  PID:7116
- C:\Windows\System\nHUSGOa.exe
  C:\Windows\System\nHUSGOa.exe
  2⤵
  PID:7140
- C:\Windows\System\fLiARMU.exe
  C:\Windows\System\fLiARMU.exe
  2⤵
  PID:6316
- C:\Windows\System\SxnpZsX.exe
  C:\Windows\System\SxnpZsX.exe
  2⤵
  PID:7164
- C:\Windows\System\YVEprju.exe
  C:\Windows\System\YVEprju.exe
  2⤵
  PID:6416
- C:\Windows\System\wHyGTNZ.exe
  C:\Windows\System\wHyGTNZ.exe
  2⤵
  PID:6768
- C:\Windows\System\RHsWmKF.exe
  C:\Windows\System\RHsWmKF.exe
  2⤵
  PID:6964
- C:\Windows\System\LXysegk.exe
  C:\Windows\System\LXysegk.exe
  2⤵
  PID:7016
- C:\Windows\System\AvjWAuI.exe
  C:\Windows\System\AvjWAuI.exe
  2⤵
  PID:6996
- C:\Windows\System\sUkeMCE.exe
  C:\Windows\System\sUkeMCE.exe
  2⤵
  PID:6732
- C:\Windows\System\nDFaUqB.exe
  C:\Windows\System\nDFaUqB.exe
  2⤵
  PID:7032
- C:\Windows\System\fiYBQjk.exe
  C:\Windows\System\fiYBQjk.exe
  2⤵
  PID:6288
- C:\Windows\System\lRLavcj.exe
  C:\Windows\System\lRLavcj.exe
  2⤵
  PID:7028
- C:\Windows\System\jZtuVfh.exe
  C:\Windows\System\jZtuVfh.exe
  2⤵
  PID:7184
- C:\Windows\System\UapSooL.exe
  C:\Windows\System\UapSooL.exe
  2⤵
  PID:7200
- C:\Windows\System\mADWahE.exe
  C:\Windows\System\mADWahE.exe
  2⤵
  PID:7216
- C:\Windows\System\qVDfWxl.exe
  C:\Windows\System\qVDfWxl.exe
  2⤵
  PID:7232
- C:\Windows\System\ypnhovl.exe
  C:\Windows\System\ypnhovl.exe
  2⤵
  PID:7252
- C:\Windows\System\ylbeHJR.exe
  C:\Windows\System\ylbeHJR.exe
  2⤵
  PID:7268
- C:\Windows\System\CiDRvih.exe
  C:\Windows\System\CiDRvih.exe
  2⤵
  PID:7284
- C:\Windows\System\nTcxxvU.exe
  C:\Windows\System\nTcxxvU.exe
  2⤵
  PID:7300
- C:\Windows\System\nzHXCxc.exe
  C:\Windows\System\nzHXCxc.exe
  2⤵
  PID:7316
- C:\Windows\System\hREtcWb.exe
  C:\Windows\System\hREtcWb.exe
  2⤵
  PID:7332
- C:\Windows\System\bkWQqVl.exe
  C:\Windows\System\bkWQqVl.exe
  2⤵
  PID:7348
- C:\Windows\System\nhpkkCG.exe
  C:\Windows\System\nhpkkCG.exe
  2⤵
  PID:7364
- C:\Windows\System\WMLmDHd.exe
  C:\Windows\System\WMLmDHd.exe
  2⤵
  PID:7380
- C:\Windows\System\zDnxwre.exe
  C:\Windows\System\zDnxwre.exe
  2⤵
  PID:7396
- C:\Windows\System\bfqdnjj.exe
  C:\Windows\System\bfqdnjj.exe
  2⤵
  PID:7412
- C:\Windows\System\CSlzBDU.exe
  C:\Windows\System\CSlzBDU.exe
  2⤵
  PID:7428
- C:\Windows\System\ustBOnU.exe
  C:\Windows\System\ustBOnU.exe
  2⤵
  PID:7444
- C:\Windows\System\iQlFYir.exe
  C:\Windows\System\iQlFYir.exe
  2⤵
  PID:7460
- C:\Windows\System\RSpDXuL.exe
  C:\Windows\System\RSpDXuL.exe
  2⤵
  PID:7476
- C:\Windows\System\MIdqOqN.exe
  C:\Windows\System\MIdqOqN.exe
  2⤵
  PID:7492
- C:\Windows\System\iQzUqfy.exe
  C:\Windows\System\iQzUqfy.exe
  2⤵
  PID:7508
- C:\Windows\System\OzfXmcg.exe
  C:\Windows\System\OzfXmcg.exe
  2⤵
  PID:7524
- C:\Windows\System\ugigrNu.exe
  C:\Windows\System\ugigrNu.exe
  2⤵
  PID:7540
- C:\Windows\System\dOKTBfU.exe
  C:\Windows\System\dOKTBfU.exe
  2⤵
  PID:7556
- C:\Windows\System\uQgQoSS.exe
  C:\Windows\System\uQgQoSS.exe
  2⤵
  PID:7572
- C:\Windows\System\YxkHmpG.exe
  C:\Windows\System\YxkHmpG.exe
  2⤵
  PID:7588
- C:\Windows\System\jpoUcDC.exe
  C:\Windows\System\jpoUcDC.exe
  2⤵
  PID:7604
- C:\Windows\System\gjdhVFJ.exe
  C:\Windows\System\gjdhVFJ.exe
  2⤵
  PID:7620
- C:\Windows\System\ArAbzGC.exe
  C:\Windows\System\ArAbzGC.exe
  2⤵
  PID:7636
- C:\Windows\System\lhixUab.exe
  C:\Windows\System\lhixUab.exe
  2⤵
  PID:7652
- C:\Windows\System\HIlQvVr.exe
  C:\Windows\System\HIlQvVr.exe
  2⤵
  PID:7668
- C:\Windows\System\oWhNuBt.exe
  C:\Windows\System\oWhNuBt.exe
  2⤵
  PID:7684
- C:\Windows\System\GYlKMEZ.exe
  C:\Windows\System\GYlKMEZ.exe
  2⤵
  PID:7700
- C:\Windows\System\EkUYWDT.exe
  C:\Windows\System\EkUYWDT.exe
  2⤵
  PID:7716
- C:\Windows\System\ymIQonk.exe
  C:\Windows\System\ymIQonk.exe
  2⤵
  PID:7732
- C:\Windows\System\qNzIQAx.exe
  C:\Windows\System\qNzIQAx.exe
  2⤵
  PID:7748
- C:\Windows\System\AOdEwRn.exe
  C:\Windows\System\AOdEwRn.exe
  2⤵
  PID:7764
- C:\Windows\System\ngApIQU.exe
  C:\Windows\System\ngApIQU.exe
  2⤵
  PID:7788
- C:\Windows\System\UhJFrIq.exe
  C:\Windows\System\UhJFrIq.exe
  2⤵
  PID:7804
- C:\Windows\System\SVRpOqj.exe
  C:\Windows\System\SVRpOqj.exe
  2⤵
  PID:7820
- C:\Windows\System\eRtYHLU.exe
  C:\Windows\System\eRtYHLU.exe
  2⤵
  PID:7836
- C:\Windows\System\mpfIRXb.exe
  C:\Windows\System\mpfIRXb.exe
  2⤵
  PID:7852
- C:\Windows\System\REOxZMZ.exe
  C:\Windows\System\REOxZMZ.exe
  2⤵
  PID:7868
- C:\Windows\System\cVGxfWB.exe
  C:\Windows\System\cVGxfWB.exe
  2⤵
  PID:7884
- C:\Windows\System\MKnFzaB.exe
  C:\Windows\System\MKnFzaB.exe
  2⤵
  PID:7900
- C:\Windows\System\SJtKAUX.exe
  C:\Windows\System\SJtKAUX.exe
  2⤵
  PID:7916
- C:\Windows\System\waWocYw.exe
  C:\Windows\System\waWocYw.exe
  2⤵
  PID:7932
- C:\Windows\System\zDgZjPK.exe
  C:\Windows\System\zDgZjPK.exe
  2⤵
  PID:7948
- C:\Windows\System\esQEQia.exe
  C:\Windows\System\esQEQia.exe
  2⤵
  PID:7964
- C:\Windows\System\VQWJJvI.exe
  C:\Windows\System\VQWJJvI.exe
  2⤵
  PID:7980
- C:\Windows\System\Fkuhmsn.exe
  C:\Windows\System\Fkuhmsn.exe
  2⤵
  PID:7996
- C:\Windows\System\fgVxTFZ.exe
  C:\Windows\System\fgVxTFZ.exe
  2⤵
  PID:8012
- C:\Windows\System\LqMQPLn.exe
  C:\Windows\System\LqMQPLn.exe
  2⤵
  PID:8028
- C:\Windows\System\mStUrgE.exe
  C:\Windows\System\mStUrgE.exe
  2⤵
  PID:8044
- C:\Windows\System\EOyshOZ.exe
  C:\Windows\System\EOyshOZ.exe
  2⤵
  PID:8060
- C:\Windows\System\JhPgBzw.exe
  C:\Windows\System\JhPgBzw.exe
  2⤵
  PID:8076
- C:\Windows\System\ZMIEhHb.exe
  C:\Windows\System\ZMIEhHb.exe
  2⤵
  PID:8092
- C:\Windows\System\GzTbuZV.exe
  C:\Windows\System\GzTbuZV.exe
  2⤵
  PID:8108
- C:\Windows\System\kUKMqyy.exe
  C:\Windows\System\kUKMqyy.exe
  2⤵
  PID:8124
- C:\Windows\System\GRFGWVJ.exe
  C:\Windows\System\GRFGWVJ.exe
  2⤵
  PID:8140
- C:\Windows\System\mgwSARu.exe
  C:\Windows\System\mgwSARu.exe
  2⤵
  PID:8156
- C:\Windows\System\bCxqZZF.exe
  C:\Windows\System\bCxqZZF.exe
  2⤵
  PID:8172
- C:\Windows\System\oEmVxrN.exe
  C:\Windows\System\oEmVxrN.exe
  2⤵
  PID:8188
- C:\Windows\System\aIpOKMr.exe
  C:\Windows\System\aIpOKMr.exe
  2⤵
  PID:7228
- C:\Windows\System\hjIlRbX.exe
  C:\Windows\System\hjIlRbX.exe
  2⤵
  PID:7292
- C:\Windows\System\OPYaDoe.exe
  C:\Windows\System\OPYaDoe.exe
  2⤵
  PID:7132
- C:\Windows\System\iTUQncb.exe
  C:\Windows\System\iTUQncb.exe
  2⤵
  PID:6232
- C:\Windows\System\SPwvMuQ.exe
  C:\Windows\System\SPwvMuQ.exe
  2⤵
  PID:7360
- C:\Windows\System\lnTliEM.exe
  C:\Windows\System\lnTliEM.exe
  2⤵
  PID:7392
- C:\Windows\System\SowxJol.exe
  C:\Windows\System\SowxJol.exe
  2⤵
  PID:7276
- C:\Windows\System\BFuNijG.exe
  C:\Windows\System\BFuNijG.exe
  2⤵
  PID:6984
- C:\Windows\System\GhipbiH.exe
  C:\Windows\System\GhipbiH.exe
  2⤵
  PID:6508
- C:\Windows\System\OgHZBQi.exe
  C:\Windows\System\OgHZBQi.exe
  2⤵
  PID:7484
- C:\Windows\System\ebMbbCL.exe
  C:\Windows\System\ebMbbCL.exe
  2⤵
  PID:6300
- C:\Windows\System\uVFvYqU.exe
  C:\Windows\System\uVFvYqU.exe
  2⤵
  PID:7376
- C:\Windows\System\lGYGBEK.exe
  C:\Windows\System\lGYGBEK.exe
  2⤵
  PID:7240
- C:\Windows\System\scMNGSF.exe
  C:\Windows\System\scMNGSF.exe
  2⤵
  PID:6664
- C:\Windows\System\heKYRbv.exe
  C:\Windows\System\heKYRbv.exe
  2⤵
  PID:7344
- C:\Windows\System\kGoiORi.exe
  C:\Windows\System\kGoiORi.exe
  2⤵
  PID:7520
- C:\Windows\System\nfgrgQQ.exe
  C:\Windows\System\nfgrgQQ.exe
  2⤵
  PID:7408
- C:\Windows\System\jnUUNQM.exe
  C:\Windows\System\jnUUNQM.exe
  2⤵
  PID:7248
- C:\Windows\System\OrTzcsH.exe
  C:\Windows\System\OrTzcsH.exe
  2⤵
  PID:7312
- C:\Windows\System\TvBTBQu.exe
  C:\Windows\System\TvBTBQu.exe
  2⤵
  PID:7404
- C:\Windows\System\wYZEaQu.exe
  C:\Windows\System\wYZEaQu.exe
  2⤵
  PID:7616
- C:\Windows\System\yOAMkRR.exe
  C:\Windows\System\yOAMkRR.exe
  2⤵
  PID:7648
- C:\Windows\System\yLQnKOa.exe
  C:\Windows\System\yLQnKOa.exe
  2⤵
  PID:7600
- C:\Windows\System\DnMELzw.exe
  C:\Windows\System\DnMELzw.exe
  2⤵
  PID:7712
- C:\Windows\System\fLIjSON.exe
  C:\Windows\System\fLIjSON.exe
  2⤵
  PID:1484
- C:\Windows\System\ZsFrrck.exe
  C:\Windows\System\ZsFrrck.exe
  2⤵
  PID:7696
- C:\Windows\System\sVXOHhc.exe
  C:\Windows\System\sVXOHhc.exe
  2⤵
  PID:7760
- C:\Windows\System\wTUnauw.exe
  C:\Windows\System\wTUnauw.exe
  2⤵
  PID:7812
- C:\Windows\System\UTCvTFu.exe
  C:\Windows\System\UTCvTFu.exe
  2⤵
  PID:7848
- C:\Windows\System\wlMDWHD.exe
  C:\Windows\System\wlMDWHD.exe
  2⤵
  PID:7880
- C:\Windows\System\zSyOtxE.exe
  C:\Windows\System\zSyOtxE.exe
  2⤵
  PID:7892
- C:\Windows\System\efNXafa.exe
  C:\Windows\System\efNXafa.exe
  2⤵
  PID:7940
- C:\Windows\System\dFXUaia.exe
  C:\Windows\System\dFXUaia.exe
  2⤵
  PID:8004
- C:\Windows\System\BLJgwqR.exe
  C:\Windows\System\BLJgwqR.exe
  2⤵
  PID:8068
- C:\Windows\System\ZXOZciq.exe
  C:\Windows\System\ZXOZciq.exe
  2⤵
  PID:7924
- C:\Windows\System\oKoDIti.exe
  C:\Windows\System\oKoDIti.exe
  2⤵
  PID:6272
- C:\Windows\System\bMlcgSS.exe
  C:\Windows\System\bMlcgSS.exe
  2⤵
  PID:8168
- C:\Windows\System\XcNhbqc.exe
  C:\Windows\System\XcNhbqc.exe
  2⤵
  PID:7308
- C:\Windows\System\EfrsYCz.exe
  C:\Windows\System\EfrsYCz.exe
  2⤵
  PID:7424
- C:\Windows\System\FzMbrNM.exe
  C:\Windows\System\FzMbrNM.exe
  2⤵
  PID:6748
- C:\Windows\System\zFBtrkm.exe
  C:\Windows\System\zFBtrkm.exe
  2⤵
  PID:7744
- C:\Windows\System\EdVzenz.exe
  C:\Windows\System\EdVzenz.exe
  2⤵
  PID:7180
- C:\Windows\System\wiojOzA.exe
  C:\Windows\System\wiojOzA.exe
  2⤵
  PID:7388
- C:\Windows\System\BkWRffF.exe
  C:\Windows\System\BkWRffF.exe
  2⤵
  PID:7708
- C:\Windows\System\dccwgkx.exe
  C:\Windows\System\dccwgkx.exe
  2⤵
  PID:7504
- C:\Windows\System\BTSpAwl.exe
  C:\Windows\System\BTSpAwl.exe
  2⤵
  PID:7012
- C:\Windows\System\sToXRQa.exe
  C:\Windows\System\sToXRQa.exe
  2⤵
  PID:7756
- C:\Windows\System\PPhMJPK.exe
  C:\Windows\System\PPhMJPK.exe
  2⤵
  PID:8184
- C:\Windows\System\MDAgXFP.exe
  C:\Windows\System\MDAgXFP.exe
  2⤵
  PID:7468
- C:\Windows\System\MYUyNZt.exe
  C:\Windows\System\MYUyNZt.exe
  2⤵
  PID:6820
- C:\Windows\System\nFeWQhw.exe
  C:\Windows\System\nFeWQhw.exe
  2⤵
  PID:7784
- C:\Windows\System\takdfFe.exe
  C:\Windows\System\takdfFe.exe
  2⤵
  PID:6968
- C:\Windows\System\PJDiFNV.exe
  C:\Windows\System\PJDiFNV.exe
  2⤵
  PID:8036
- C:\Windows\System\TQVytxE.exe
  C:\Windows\System\TQVytxE.exe
  2⤵
  PID:7960
- C:\Windows\System\OaPYNMQ.exe
  C:\Windows\System\OaPYNMQ.exe
  2⤵
  PID:8020
- C:\Windows\System\oQwyBEc.exe
  C:\Windows\System\oQwyBEc.exe
  2⤵
  PID:8088
- C:\Windows\System\ZRPYsth.exe
  C:\Windows\System\ZRPYsth.exe
  2⤵
  PID:7060
- C:\Windows\System\PXghMlt.exe
  C:\Windows\System\PXghMlt.exe
  2⤵
  PID:7676
- C:\Windows\System\anjdLZQ.exe
  C:\Windows\System\anjdLZQ.exe
  2⤵
  PID:7536
- C:\Windows\System\oqyJAOG.exe
  C:\Windows\System\oqyJAOG.exe
  2⤵
  PID:8132
- C:\Windows\System\pVOyEsv.exe
  C:\Windows\System\pVOyEsv.exe
  2⤵
  PID:8152
- C:\Windows\System\xAyTOdO.exe
  C:\Windows\System\xAyTOdO.exe
  2⤵
  PID:7440
- C:\Windows\System\VKZspFL.exe
  C:\Windows\System\VKZspFL.exe
  2⤵
  PID:7356
- C:\Windows\System\AgQPWGb.exe
  C:\Windows\System\AgQPWGb.exe
  2⤵
  PID:6268
- C:\Windows\System\XrYTzWm.exe
  C:\Windows\System\XrYTzWm.exe
  2⤵
  PID:8120
- C:\Windows\System\IHlajSV.exe
  C:\Windows\System\IHlajSV.exe
  2⤵
  PID:7956
- C:\Windows\System\hENbcKd.exe
  C:\Windows\System\hENbcKd.exe
  2⤵
  PID:8136
- C:\Windows\System\CNezaRk.exe
  C:\Windows\System\CNezaRk.exe
  2⤵
  PID:8056
- C:\Windows\System\UvTqGlI.exe
  C:\Windows\System\UvTqGlI.exe
  2⤵
  PID:8040
- C:\Windows\System\scDlaeL.exe
  C:\Windows\System\scDlaeL.exe
  2⤵
  PID:7340
- C:\Windows\System\YMgHvMu.exe
  C:\Windows\System\YMgHvMu.exe
  2⤵
  PID:8100
- C:\Windows\System\pWtUpAY.exe
  C:\Windows\System\pWtUpAY.exe
  2⤵
  PID:7488
- C:\Windows\System\lyJOfnt.exe
  C:\Windows\System\lyJOfnt.exe
  2⤵
  PID:7992
- C:\Windows\System\nbTFJzW.exe
  C:\Windows\System\nbTFJzW.exe
  2⤵
  PID:7796
- C:\Windows\System\ETlFpTa.exe
  C:\Windows\System\ETlFpTa.exe
  2⤵
  PID:7876
- C:\Windows\System\xJhGXez.exe
  C:\Windows\System\xJhGXez.exe
  2⤵
  PID:7644
- C:\Windows\System\kodDCyr.exe
  C:\Windows\System\kodDCyr.exe
  2⤵
  PID:8208
- C:\Windows\System\OviVCno.exe
  C:\Windows\System\OviVCno.exe
  2⤵
  PID:8224
- C:\Windows\System\OuJmLTW.exe
  C:\Windows\System\OuJmLTW.exe
  2⤵
  PID:8240
- C:\Windows\System\nrVJVDC.exe
  C:\Windows\System\nrVJVDC.exe
  2⤵
  PID:8256
- C:\Windows\System\dWMYhTy.exe
  C:\Windows\System\dWMYhTy.exe
  2⤵
  PID:8272
- C:\Windows\System\OwlqUBZ.exe
  C:\Windows\System\OwlqUBZ.exe
  2⤵
  PID:8292
- C:\Windows\System\jGZxiQS.exe
  C:\Windows\System\jGZxiQS.exe
  2⤵
  PID:8308
- C:\Windows\System\lvNLtvt.exe
  C:\Windows\System\lvNLtvt.exe
  2⤵
  PID:8344
- C:\Windows\System\NWszeuM.exe
  C:\Windows\System\NWszeuM.exe
  2⤵
  PID:8368
- C:\Windows\System\msykboT.exe
  C:\Windows\System\msykboT.exe
  2⤵
  PID:8384
- C:\Windows\System\PsLqOoy.exe
  C:\Windows\System\PsLqOoy.exe
  2⤵
  PID:8400
- C:\Windows\System\uItmXNf.exe
  C:\Windows\System\uItmXNf.exe
  2⤵
  PID:8416
- C:\Windows\System\SxnDFri.exe
  C:\Windows\System\SxnDFri.exe
  2⤵
  PID:8432
- C:\Windows\System\PZxZeGj.exe
  C:\Windows\System\PZxZeGj.exe
  2⤵
  PID:8448
- C:\Windows\System\VtziWJE.exe
  C:\Windows\System\VtziWJE.exe
  2⤵
  PID:8468
- C:\Windows\System\scBKprC.exe
  C:\Windows\System\scBKprC.exe
  2⤵
  PID:8484
- C:\Windows\System\zeTLNUd.exe
  C:\Windows\System\zeTLNUd.exe
  2⤵
  PID:8500
- C:\Windows\System\smIsAuH.exe
  C:\Windows\System\smIsAuH.exe
  2⤵
  PID:8516
- C:\Windows\System\MZFNmkO.exe
  C:\Windows\System\MZFNmkO.exe
  2⤵
  PID:8532
- C:\Windows\System\mIQRNkC.exe
  C:\Windows\System\mIQRNkC.exe
  2⤵
  PID:8548
- C:\Windows\System\GMvPtgS.exe
  C:\Windows\System\GMvPtgS.exe
  2⤵
  PID:8564
- C:\Windows\System\enMIXbn.exe
  C:\Windows\System\enMIXbn.exe
  2⤵
  PID:8580
- C:\Windows\System\maFOgfw.exe
  C:\Windows\System\maFOgfw.exe
  2⤵
  PID:8644
- C:\Windows\System\jeBCCxH.exe
  C:\Windows\System\jeBCCxH.exe
  2⤵
  PID:8660
- C:\Windows\System\adqaMYN.exe
  C:\Windows\System\adqaMYN.exe
  2⤵
  PID:8676
- C:\Windows\System\WleIgdU.exe
  C:\Windows\System\WleIgdU.exe
  2⤵
  PID:8696
- C:\Windows\System\eMkRUny.exe
  C:\Windows\System\eMkRUny.exe
  2⤵
  PID:8712
- C:\Windows\System\heOrKxL.exe
  C:\Windows\System\heOrKxL.exe
  2⤵
  PID:8728
- C:\Windows\System\LwWzvbr.exe
  C:\Windows\System\LwWzvbr.exe
  2⤵
  PID:8744
- C:\Windows\System\BPsweJX.exe
  C:\Windows\System\BPsweJX.exe
  2⤵
  PID:8760
- C:\Windows\System\KzBUAmo.exe
  C:\Windows\System\KzBUAmo.exe
  2⤵
  PID:8776
- C:\Windows\System\IwCvAnp.exe
  C:\Windows\System\IwCvAnp.exe
  2⤵
  PID:8792
- C:\Windows\System\kdeXGeT.exe
  C:\Windows\System\kdeXGeT.exe
  2⤵
  PID:8812
- C:\Windows\System\RoPlQfg.exe
  C:\Windows\System\RoPlQfg.exe
  2⤵
  PID:8828
- C:\Windows\System\fWaKLcZ.exe
  C:\Windows\System\fWaKLcZ.exe
  2⤵
  PID:8844
- C:\Windows\System\PQEGCHQ.exe
  C:\Windows\System\PQEGCHQ.exe
  2⤵
  PID:9080
- C:\Windows\System\amBTRto.exe
  C:\Windows\System\amBTRto.exe
  2⤵
  PID:9096
- C:\Windows\System\MyrDKQQ.exe
  C:\Windows\System\MyrDKQQ.exe
  2⤵
  PID:9112
- C:\Windows\System\qyvZZzL.exe
  C:\Windows\System\qyvZZzL.exe
  2⤵
  PID:9128
- C:\Windows\System\mMoRuPo.exe
  C:\Windows\System\mMoRuPo.exe
  2⤵
  PID:9148
- C:\Windows\System\ZzcNvAJ.exe
  C:\Windows\System\ZzcNvAJ.exe
  2⤵
  PID:9164
- C:\Windows\System\nKsUatw.exe
  C:\Windows\System\nKsUatw.exe
  2⤵
  PID:9192
- C:\Windows\System\FoxJnjy.exe
  C:\Windows\System\FoxJnjy.exe
  2⤵
  PID:9208
- C:\Windows\System\yYcmqdk.exe
  C:\Windows\System\yYcmqdk.exe
  2⤵
  PID:7772
- C:\Windows\System\qoZYyZJ.exe
  C:\Windows\System\qoZYyZJ.exe
  2⤵
  PID:8204
- C:\Windows\System\sfIIvvI.exe
  C:\Windows\System\sfIIvvI.exe
  2⤵
  PID:8268
- C:\Windows\System\DvYPHDj.exe
  C:\Windows\System\DvYPHDj.exe
  2⤵
  PID:8304
- C:\Windows\System\FOgGEcm.exe
  C:\Windows\System\FOgGEcm.exe
  2⤵
  PID:8364
- C:\Windows\System\qqFjiTz.exe
  C:\Windows\System\qqFjiTz.exe
  2⤵
  PID:8248
- C:\Windows\System\bLtETbF.exe
  C:\Windows\System\bLtETbF.exe
  2⤵
  PID:6716
- C:\Windows\System\FHgZacB.exe
  C:\Windows\System\FHgZacB.exe
  2⤵
  PID:8288
- C:\Windows\System\KFwcHxa.exe
  C:\Windows\System\KFwcHxa.exe
  2⤵
  PID:8332
- C:\Windows\System\wWsoXJU.exe
  C:\Windows\System\wWsoXJU.exe
  2⤵
  PID:8376
- C:\Windows\System\mYCeYBJ.exe
  C:\Windows\System\mYCeYBJ.exe
  2⤵
  PID:8428
- C:\Windows\System\gNGMMdr.exe
  C:\Windows\System\gNGMMdr.exe
  2⤵
  PID:8464
- C:\Windows\System\yyOfgwJ.exe
  C:\Windows\System\yyOfgwJ.exe
  2⤵
  PID:8528
- C:\Windows\System\sxSUIRh.exe
  C:\Windows\System\sxSUIRh.exe
  2⤵
  PID:8592
- C:\Windows\System\YllKcVA.exe
  C:\Windows\System\YllKcVA.exe
  2⤵
  PID:8572
- C:\Windows\System\kpLHJfk.exe
  C:\Windows\System\kpLHJfk.exe
  2⤵
  PID:8512
- C:\Windows\System\gYKShRs.exe
  C:\Windows\System\gYKShRs.exe
  2⤵
  PID:8608
- C:\Windows\System\vjRcalO.exe
  C:\Windows\System\vjRcalO.exe
  2⤵
  PID:8624
- C:\Windows\System\GotkhSL.exe
  C:\Windows\System\GotkhSL.exe
  2⤵
  PID:8640
- C:\Windows\System\tkUAYHg.exe
  C:\Windows\System\tkUAYHg.exe
  2⤵
  PID:8708
- C:\Windows\System\hRehtvY.exe
  C:\Windows\System\hRehtvY.exe
  2⤵
  PID:8772
- C:\Windows\System\enGLTcO.exe
  C:\Windows\System\enGLTcO.exe
  2⤵
  PID:8840
- C:\Windows\System\dGRapBP.exe
  C:\Windows\System\dGRapBP.exe
  2⤵
  PID:8868
- C:\Windows\System\ccabBXu.exe
  C:\Windows\System\ccabBXu.exe
  2⤵
  PID:8880
- C:\Windows\System\VOCfcAE.exe
  C:\Windows\System\VOCfcAE.exe
  2⤵
  PID:8904
- C:\Windows\System\vOaNoAE.exe
  C:\Windows\System\vOaNoAE.exe
  2⤵
  PID:8924
- C:\Windows\System\zvuqrWH.exe
  C:\Windows\System\zvuqrWH.exe
  2⤵
  PID:8936
- C:\Windows\System\URVnCCR.exe
  C:\Windows\System\URVnCCR.exe
  2⤵
  PID:8956
- C:\Windows\System\HuHcncK.exe
  C:\Windows\System\HuHcncK.exe
  2⤵
  PID:8972
- C:\Windows\System\cZGSqbQ.exe
  C:\Windows\System\cZGSqbQ.exe
  2⤵
  PID:8992
- C:\Windows\System\SmBBdNJ.exe
  C:\Windows\System\SmBBdNJ.exe
  2⤵
  PID:9108
- C:\Windows\System\XPizGlC.exe
  C:\Windows\System\XPizGlC.exe
  2⤵
  PID:9188
- C:\Windows\System\oXtskKk.exe
  C:\Windows\System\oXtskKk.exe
  2⤵
  PID:8540
- C:\Windows\System\pqHcCey.exe
  C:\Windows\System\pqHcCey.exe
  2⤵
  PID:8704
- C:\Windows\System\PYJWpYf.exe
  C:\Windows\System\PYJWpYf.exe
  2⤵
  PID:8104
- C:\Windows\System\dExLPMQ.exe
  C:\Windows\System\dExLPMQ.exe
  2⤵
  PID:8412
- C:\Windows\System\tNDdyNn.exe
  C:\Windows\System\tNDdyNn.exe
  2⤵
  PID:8524
- C:\Windows\System\Liqmkeh.exe
  C:\Windows\System\Liqmkeh.exe
  2⤵
  PID:8724
- C:\Windows\System\prKOHfS.exe
  C:\Windows\System\prKOHfS.exe
  2⤵
  PID:8600
- C:\Windows\System\zFEMbbd.exe
  C:\Windows\System\zFEMbbd.exe
  2⤵
  PID:8636
- C:\Windows\System\JSylgRs.exe
  C:\Windows\System\JSylgRs.exe
  2⤵
  PID:8688
- C:\Windows\System\Huzrtgm.exe
  C:\Windows\System\Huzrtgm.exe
  2⤵
  PID:8752
- C:\Windows\System\tZTPeHl.exe
  C:\Windows\System\tZTPeHl.exe
  2⤵
  PID:8720
- C:\Windows\System\PZtPDNR.exe
  C:\Windows\System\PZtPDNR.exe
  2⤵
  PID:8888
- C:\Windows\System\llLKauI.exe
  C:\Windows\System\llLKauI.exe
  2⤵
  PID:8920
- C:\Windows\System\HkiIQlN.exe
  C:\Windows\System\HkiIQlN.exe
  2⤵
  PID:8996
- C:\Windows\System\dZNrLiz.exe
  C:\Windows\System\dZNrLiz.exe
  2⤵
  PID:8912
- C:\Windows\System\QadFQQP.exe
  C:\Windows\System\QadFQQP.exe
  2⤵
  PID:8980
- C:\Windows\System\ngXyZGv.exe
  C:\Windows\System\ngXyZGv.exe
  2⤵
  PID:9008
- C:\Windows\System\MHdRoQg.exe
  C:\Windows\System\MHdRoQg.exe
  2⤵
  PID:9028
- C:\Windows\System\zqKgCcZ.exe
  C:\Windows\System\zqKgCcZ.exe
  2⤵
  PID:9048
- C:\Windows\System\LzchBuY.exe
  C:\Windows\System\LzchBuY.exe
  2⤵
  PID:9056
- C:\Windows\System\YcQJvRE.exe
  C:\Windows\System\YcQJvRE.exe
  2⤵
  PID:9160
- C:\Windows\System\RzWTHMq.exe
  C:\Windows\System\RzWTHMq.exe
  2⤵
  PID:9104
- C:\Windows\System\GNlqqoZ.exe
  C:\Windows\System\GNlqqoZ.exe
  2⤵
  PID:8200
- C:\Windows\System\pjrcdAJ.exe
  C:\Windows\System\pjrcdAJ.exe
  2⤵
  PID:9172
- C:\Windows\System\NsKfLKg.exe
  C:\Windows\System\NsKfLKg.exe
  2⤵
  PID:9184
- C:\Windows\System\hxHrxev.exe
  C:\Windows\System\hxHrxev.exe
  2⤵
  PID:8336
- C:\Windows\System\DKabkLp.exe
  C:\Windows\System\DKabkLp.exe
  2⤵
  PID:8460
- C:\Windows\System\NuWAAgh.exe
  C:\Windows\System\NuWAAgh.exe
  2⤵
  PID:8620
- C:\Windows\System\epkrXft.exe
  C:\Windows\System\epkrXft.exe
  2⤵
  PID:8768
- C:\Windows\System\WHsrZvL.exe
  C:\Windows\System\WHsrZvL.exe
  2⤵
  PID:8544
- C:\Windows\System\fYUTBTj.exe
  C:\Windows\System\fYUTBTj.exe
  2⤵
  PID:8860
- C:\Windows\System\xUVCRuB.exe
  C:\Windows\System\xUVCRuB.exe
  2⤵
  PID:8948
- C:\Windows\System\OdcAuvB.exe
  C:\Windows\System\OdcAuvB.exe
  2⤵
  PID:8836
- C:\Windows\System\LXAWyqh.exe
  C:\Windows\System\LXAWyqh.exe
  2⤵
  PID:8496
- C:\Windows\System\zhbuCMd.exe
  C:\Windows\System\zhbuCMd.exe
  2⤵
  PID:8908
- C:\Windows\System\QKiahCc.exe
  C:\Windows\System\QKiahCc.exe
  2⤵
  PID:9036
- C:\Windows\System\NvXEDjA.exe
  C:\Windows\System\NvXEDjA.exe
  2⤵
  PID:8820
- C:\Windows\System\CZtMdCr.exe
  C:\Windows\System\CZtMdCr.exe
  2⤵
  PID:8824
- C:\Windows\System\yOhaleU.exe
  C:\Windows\System\yOhaleU.exe
  2⤵
  PID:8560
- C:\Windows\System\HCOhfGJ.exe
  C:\Windows\System\HCOhfGJ.exe
  2⤵
  PID:8320
- C:\Windows\System\ZMsYFcq.exe
  C:\Windows\System\ZMsYFcq.exe
  2⤵
  PID:9120
- C:\Windows\System\ZQhCoOl.exe
  C:\Windows\System\ZQhCoOl.exe
  2⤵
  PID:9068
- C:\Windows\System\CbmsVHS.exe
  C:\Windows\System\CbmsVHS.exe
  2⤵
  PID:9200
- C:\Windows\System\rpIiBKQ.exe
  C:\Windows\System\rpIiBKQ.exe
  2⤵
  PID:8900
- C:\Windows\System\zwPPvAs.exe
  C:\Windows\System\zwPPvAs.exe
  2⤵
  PID:9176
- C:\Windows\System\eQntuQr.exe
  C:\Windows\System\eQntuQr.exe
  2⤵
  PID:8656
- C:\Windows\System\HykTBbp.exe
  C:\Windows\System\HykTBbp.exe
  2⤵
  PID:6676
- C:\Windows\System\iQpKwCH.exe
  C:\Windows\System\iQpKwCH.exe
  2⤵
  PID:8756
- C:\Windows\System\JYPTghA.exe
  C:\Windows\System\JYPTghA.exe
  2⤵
  PID:8052
- C:\Windows\System\icGuCUK.exe
  C:\Windows\System\icGuCUK.exe
  2⤵
  PID:8424
- C:\Windows\System\LiPhZQJ.exe
  C:\Windows\System\LiPhZQJ.exe
  2⤵
  PID:9076
- C:\Windows\System\XIHXCnt.exe
  C:\Windows\System\XIHXCnt.exe
  2⤵
  PID:9228
- C:\Windows\System\lwsJxOw.exe
  C:\Windows\System\lwsJxOw.exe
  2⤵
  PID:9252
- C:\Windows\System\OJGdtdd.exe
  C:\Windows\System\OJGdtdd.exe
  2⤵
  PID:9268
- C:\Windows\System\DNuTqBw.exe
  C:\Windows\System\DNuTqBw.exe
  2⤵
  PID:9296
- C:\Windows\System\ZfbKPrD.exe
  C:\Windows\System\ZfbKPrD.exe
  2⤵
  PID:9312
- C:\Windows\System\kCNDHYe.exe
  C:\Windows\System\kCNDHYe.exe
  2⤵
  PID:9328
- C:\Windows\System\iVEIlWN.exe
  C:\Windows\System\iVEIlWN.exe
  2⤵
  PID:9344
- C:\Windows\System\nHuJjHm.exe
  C:\Windows\System\nHuJjHm.exe
  2⤵
  PID:9360
- C:\Windows\System\tPqKcFj.exe
  C:\Windows\System\tPqKcFj.exe
  2⤵
  PID:9376
- C:\Windows\System\mRyVnTr.exe
  C:\Windows\System\mRyVnTr.exe
  2⤵
  PID:9396
- C:\Windows\System\ShYDyQM.exe
  C:\Windows\System\ShYDyQM.exe
  2⤵
  PID:9412
- C:\Windows\System\uTlTtcN.exe
  C:\Windows\System\uTlTtcN.exe
  2⤵
  PID:9432
- C:\Windows\System\UgEOzxr.exe
  C:\Windows\System\UgEOzxr.exe
  2⤵
  PID:9448
- C:\Windows\System\zvdcEPm.exe
  C:\Windows\System\zvdcEPm.exe
  2⤵
  PID:9464
- C:\Windows\System\EroVZGp.exe
  C:\Windows\System\EroVZGp.exe
  2⤵
  PID:9480
- C:\Windows\System\tlPVQto.exe
  C:\Windows\System\tlPVQto.exe
  2⤵
  PID:9496
- C:\Windows\System\OHAdmoj.exe
  C:\Windows\System\OHAdmoj.exe
  2⤵
  PID:9512
- C:\Windows\System\ORHuuqs.exe
  C:\Windows\System\ORHuuqs.exe
  2⤵
  PID:9528
- C:\Windows\System\aLNQCVt.exe
  C:\Windows\System\aLNQCVt.exe
  2⤵
  PID:9544
- C:\Windows\System\FEEosZc.exe
  C:\Windows\System\FEEosZc.exe
  2⤵
  PID:9560
- C:\Windows\System\YfBMcle.exe
  C:\Windows\System\YfBMcle.exe
  2⤵
  PID:9580
- C:\Windows\System\quXwoKm.exe
  C:\Windows\System\quXwoKm.exe
  2⤵
  PID:9596
- C:\Windows\System\AwhDsyI.exe
  C:\Windows\System\AwhDsyI.exe
  2⤵
  PID:9612
- C:\Windows\System\mttxNch.exe
  C:\Windows\System\mttxNch.exe
  2⤵
  PID:9628
- C:\Windows\System\EDSibsW.exe
  C:\Windows\System\EDSibsW.exe
  2⤵
  PID:9648
- C:\Windows\System\vUKXhBL.exe
  C:\Windows\System\vUKXhBL.exe
  2⤵
  PID:9664
- C:\Windows\System\eYlHwmJ.exe
  C:\Windows\System\eYlHwmJ.exe
  2⤵
  PID:9680
- C:\Windows\System\hmkPZMx.exe
  C:\Windows\System\hmkPZMx.exe
  2⤵
  PID:9696
- C:\Windows\System\niYHQNZ.exe
  C:\Windows\System\niYHQNZ.exe
  2⤵
  PID:9712
- C:\Windows\System\GqrgJdc.exe
  C:\Windows\System\GqrgJdc.exe
  2⤵
  PID:9728
- C:\Windows\System\RecrQuo.exe
  C:\Windows\System\RecrQuo.exe
  2⤵
  PID:9748
- C:\Windows\System\LoPPKKD.exe
  C:\Windows\System\LoPPKKD.exe
  2⤵
  PID:9764
- C:\Windows\System\BrISnHS.exe
  C:\Windows\System\BrISnHS.exe
  2⤵
  PID:9780
- C:\Windows\System\vvmbkBC.exe
  C:\Windows\System\vvmbkBC.exe
  2⤵
  PID:9796
- C:\Windows\System\gvlHAZu.exe
  C:\Windows\System\gvlHAZu.exe
  2⤵
  PID:9812
- C:\Windows\System\iGkcyfi.exe
  C:\Windows\System\iGkcyfi.exe
  2⤵
  PID:9832
- C:\Windows\System\QFPRrnz.exe
  C:\Windows\System\QFPRrnz.exe
  2⤵
  PID:9848
- C:\Windows\System\dxDvAUB.exe
  C:\Windows\System\dxDvAUB.exe
  2⤵
  PID:9864
- C:\Windows\System\fQeXvWh.exe
  C:\Windows\System\fQeXvWh.exe
  2⤵
  PID:9880
- C:\Windows\System\TjTxBpf.exe
  C:\Windows\System\TjTxBpf.exe
  2⤵
  PID:9900
- C:\Windows\System\cjhzpue.exe
  C:\Windows\System\cjhzpue.exe
  2⤵
  PID:9916
- C:\Windows\System\zSqAmgd.exe
  C:\Windows\System\zSqAmgd.exe
  2⤵
  PID:9932
- C:\Windows\System\pUXXsCW.exe
  C:\Windows\System\pUXXsCW.exe
  2⤵
  PID:9948
- C:\Windows\System\AlZnmXh.exe
  C:\Windows\System\AlZnmXh.exe
  2⤵
  PID:9964
- C:\Windows\System\QdQtDIp.exe
  C:\Windows\System\QdQtDIp.exe
  2⤵
  PID:10004
- C:\Windows\System\BtfGDTv.exe
  C:\Windows\System\BtfGDTv.exe
  2⤵
  PID:10020
- C:\Windows\System\oNwDJxj.exe
  C:\Windows\System\oNwDJxj.exe
  2⤵
  PID:10040
- C:\Windows\System\AshGiFL.exe
  C:\Windows\System\AshGiFL.exe
  2⤵
  PID:10056
- C:\Windows\System\VRBqtzM.exe
  C:\Windows\System\VRBqtzM.exe
  2⤵
  PID:10072
- C:\Windows\System\iPbLncG.exe
  C:\Windows\System\iPbLncG.exe
  2⤵
  PID:10088
- C:\Windows\System\otHrPIo.exe
  C:\Windows\System\otHrPIo.exe
  2⤵
  PID:10104
- C:\Windows\System\sQLtRzq.exe
  C:\Windows\System\sQLtRzq.exe
  2⤵
  PID:10120
- C:\Windows\System\jLzrQRW.exe
  C:\Windows\System\jLzrQRW.exe
  2⤵
  PID:10136
- C:\Windows\System\PVPmGjb.exe
  C:\Windows\System\PVPmGjb.exe
  2⤵
  PID:10152
- C:\Windows\System\iirpsEd.exe
  C:\Windows\System\iirpsEd.exe
  2⤵
  PID:10168
- C:\Windows\System\wTyFPdd.exe
  C:\Windows\System\wTyFPdd.exe
  2⤵
  PID:10184
- C:\Windows\System\KpYRdQo.exe
  C:\Windows\System\KpYRdQo.exe
  2⤵
  PID:10204
- C:\Windows\System\vUJgBSf.exe
  C:\Windows\System\vUJgBSf.exe
  2⤵
  PID:10220
- C:\Windows\System\mpUMozj.exe
  C:\Windows\System\mpUMozj.exe
  2⤵
  PID:10236
- C:\Windows\System\aylNrpZ.exe
  C:\Windows\System\aylNrpZ.exe
  2⤵
  PID:9044
- C:\Windows\System\aBuAmYz.exe
  C:\Windows\System\aBuAmYz.exe
  2⤵
  PID:8784
- C:\Windows\System\QyPVsQJ.exe
  C:\Windows\System\QyPVsQJ.exe
  2⤵
  PID:9236
- C:\Windows\System\JZQlNWl.exe
  C:\Windows\System\JZQlNWl.exe
  2⤵
  PID:9248
- C:\Windows\System\zCcNums.exe
  C:\Windows\System\zCcNums.exe
  2⤵
  PID:9340
- C:\Windows\System\BTITViF.exe
  C:\Windows\System\BTITViF.exe
  2⤵
  PID:9356
- C:\Windows\System\kzXyDeY.exe
  C:\Windows\System\kzXyDeY.exe
  2⤵
  PID:9472
- C:\Windows\System\ZvVtGia.exe
  C:\Windows\System\ZvVtGia.exe
  2⤵
  PID:9536
- C:\Windows\System\ijPNBec.exe
  C:\Windows\System\ijPNBec.exe
  2⤵
  PID:9604
- C:\Windows\System\sRjwNGZ.exe
  C:\Windows\System\sRjwNGZ.exe
  2⤵
  PID:9636
- C:\Windows\System\pcHKSZV.exe
  C:\Windows\System\pcHKSZV.exe
  2⤵
  PID:9492
- C:\Windows\System\YHgOAKB.exe
  C:\Windows\System\YHgOAKB.exe
  2⤵
  PID:9704
- C:\Windows\System\cpVLmfj.exe
  C:\Windows\System\cpVLmfj.exe
  2⤵
  PID:9424
- C:\Windows\System\eBoKISI.exe
  C:\Windows\System\eBoKISI.exe
  2⤵
  PID:9524
- C:\Windows\System\somYdve.exe
  C:\Windows\System\somYdve.exe
  2⤵
  PID:9624
- C:\Windows\System\iQIjuJC.exe
  C:\Windows\System\iQIjuJC.exe
  2⤵
  PID:9688
- C:\Windows\System\nMDdbkl.exe
  C:\Windows\System\nMDdbkl.exe
  2⤵
  PID:9724
- C:\Windows\System\oCdxvmC.exe
  C:\Windows\System\oCdxvmC.exe
  2⤵
  PID:9772
- C:\Windows\System\UBQetcN.exe
  C:\Windows\System\UBQetcN.exe
  2⤵
  PID:9840
- C:\Windows\System\TrbgmUD.exe
  C:\Windows\System\TrbgmUD.exe
  2⤵
  PID:9912
- C:\Windows\System\lTJbDhK.exe
  C:\Windows\System\lTJbDhK.exe
  2⤵
  PID:9976
- C:\Windows\System\faLHLOZ.exe
  C:\Windows\System\faLHLOZ.exe
  2⤵
  PID:9756
- C:\Windows\System\SVLPrjP.exe
  C:\Windows\System\SVLPrjP.exe
  2⤵
  PID:9860
- C:\Windows\System\rXashCX.exe
  C:\Windows\System\rXashCX.exe
  2⤵
  PID:9792
- C:\Windows\System\aAwTgUR.exe
  C:\Windows\System\aAwTgUR.exe
  2⤵
  PID:9896
- C:\Windows\System\kDmQpnD.exe
  C:\Windows\System\kDmQpnD.exe
  2⤵
  PID:9820
- C:\Windows\System\pHneDem.exe
  C:\Windows\System\pHneDem.exe
  2⤵
  PID:10012
- C:\Windows\System\yRkgdFq.exe
  C:\Windows\System\yRkgdFq.exe
  2⤵
  PID:10096
- C:\Windows\System\pmJRxcC.exe
  C:\Windows\System\pmJRxcC.exe
  2⤵
  PID:10192
- C:\Windows\System\JkIoKqm.exe
  C:\Windows\System\JkIoKqm.exe
  2⤵
  PID:10228
- C:\Windows\System\GPCkOWG.exe
  C:\Windows\System\GPCkOWG.exe
  2⤵
  PID:10144
- C:\Windows\System\nhoiMbD.exe
  C:\Windows\System\nhoiMbD.exe
  2⤵
  PID:10180
- C:\Windows\System\MeJTMPb.exe
  C:\Windows\System\MeJTMPb.exe
  2⤵
  PID:10216
- C:\Windows\System\scPANxn.exe
  C:\Windows\System\scPANxn.exe
  2⤵
  PID:9064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CqfkDOL.exe

Filesize
1.7MB

MD5
f0fb65c7a55c085fabf97388db431544

SHA1
3bbb4231fd73fd6aa92361ff43b9043542e439aa

SHA256
5a5d98834ae6833c992612896f2259b3a2932bc4789e0d6508025c39677565a5

SHA512
dd6233e283cd180dcb553714b69e02b98104e09d8dde24e9dbe3fc7af0cb8f4d95ff58b212bd157838ca2a0146572efb83ac13e9433ae393926d107f0fa680b4

Download Submit
C:\Windows\system\MYaFVDB.exe

Filesize
1.7MB

MD5
6b22534347e8f06454f44a9a6feac61a

SHA1
24b5ce1b607cd5d3f5bdce19f5bb19fe973b20a1

SHA256
9544c16ee2a3a63157e971363dcb856b7bd0f7dbb29d7c369259850eb12de86a

SHA512
b448c88fe1f15b841bb75bfb33a30993ba8b149f11dd364b732ac135f3fc7342bc2e40a8776409f7d7074d48137ec26e33e16bc4193601ad01722e502fb928a6

Download Submit
C:\Windows\system\OyhnpDS.exe

Filesize
1.7MB

MD5
c30de5a3ce284e719599e40e2ff8d990

SHA1
dd0d0eadd42b1c3e00d451e5c67352607dcae177

SHA256
098d9aa969e61dea8f7b763830b63c488c36a3c71503fc9c141d20ef78ad65b5

SHA512
624fcb3a2df3456e47bac087b4ae1965d2d38f7a27a77abc74a3fe1d401d435b9c0fcecdaf3e3f86ae0e495debe4ef56376d317eb1ed77a9cb2db4e1ecf25a49

Download Submit
C:\Windows\system\TGBtNcc.exe

Filesize
1.7MB

MD5
61bff840b344d322aa3432fe59594207

SHA1
70120ee9f2e8518c40ebe0b794205b3525f6a4f4

SHA256
55df150dca52b7217fc7101b9faea10aeb9f9be47ff87c68f0207e5a657a16fb

SHA512
7c2360e2fb57a8863820af9f1174f5741f781086719bbc1d0cb586e9ef127fec0e99ae705735a3d0f24812703f8eb23acb35996af8336aaf5c02c8a80484e218

Download Submit
C:\Windows\system\UtDckhz.exe

Filesize
1.7MB

MD5
26635c2328f1a1960c1161ba4ddb981d

SHA1
5bda1361964580fd1d9762fe1a4d4623012f84af

SHA256
68886af3011ae76a4194dba8862901abb704106cb854963a74c97db1416297c2

SHA512
35c8615fff5a25798bbe4085fd18154e6a22289aee3cc99c618f6313cfc33e0abb5ef5eb29ebbc4e47346f90b5a1cae7c6d8115a23ccb36031d93a81bfb41109

Download Submit
C:\Windows\system\VNSbVvF.exe

Filesize
1.7MB

MD5
49cd52512deb9734a0633f7d731c622a

SHA1
f6b98e62732f40ee98bcc43c1a1cf1642057d0b9

SHA256
aa2452cd91122168b4aca0d879d4f650140e85b4d6c76c1a4a6ecf6c3cb1dc43

SHA512
883e4113f5f160138f95fac29f68c85653c89c1b4ccc9e22928f088211f624ba631212fab29421a74fc2a53b6a0dd2c4adb54c925cce934b4b1143f9107022b8

Download Submit
C:\Windows\system\YwLvQZQ.exe

Filesize
1.7MB

MD5
1ee44f5cdba306930fc7f336ee391ccb

SHA1
13cc4099d01e3d330f0b028ea0701a08b105bd32

SHA256
10845445e70f7fedee5f90bdbbdefc5c161a464c3183a531fce10ceb74639a09

SHA512
eb5797075e47cf2ac133d5eafb18b533e52fc18e6b3e8959dacbb17712fcb42b4dcc018e8789523d72057805b4fc16e7207a9baac187ed5cb89c77e7e1ac96d3

Download Submit
C:\Windows\system\eaXqyPi.exe

Filesize
1.7MB

MD5
e009a9520b979622feb186a6b7c5f1b2

SHA1
f2e3b96f579f32e4b7f8357baebbef4064c9941a

SHA256
52b02c1008591d13c52871f72408f4911ad3312a888396a95808e668331d7437

SHA512
66b389bbd194c9a4be6f130904a5b237101fa63b7fe6d0491964f69395435c010eb9da58a62567118171314049c32f4dd1e6df07d01430d97a4b23ec8f4c6519

Download Submit
C:\Windows\system\fySqdlx.exe

Filesize
1.7MB

MD5
cad032e9fc408c03ddd3cb4caefa803f

SHA1
9c960cc8c8c0df3bceb043ad7c0814aa10392ba0

SHA256
690e6bcf95b614d7d34ac6794fb9b7c6e8175827ebbcb437eb94ec14b3174b3e

SHA512
fff61b07b70ebfce25aa69e84a8ea0d06b3449974ec1749704d116ee93b96c20b27ca9ef640d74a2df9329005dd37320dbcb4a0b092cf5ff4dc772fc5f1b8b1a

Download Submit
C:\Windows\system\oEwjkBr.exe

Filesize
1.7MB

MD5
9f0e139850a1130ab22af42788f5bcc0

SHA1
ae787ab32dec44e5eb8a0046063c291202d00679

SHA256
7092584a6729f52975e27ae8f32c864123677b9d122c3d13ff8317008cc60172

SHA512
40e3b93170b318f82a663cd2866b749b0154b5f9a534617cc9b2ae4e2262f4484daca6a1bbaf37463fdad6436e4da15a05271a67128afaf0fa200aa93bb418a7

Download Submit
C:\Windows\system\qVGrrsK.exe

Filesize
1.7MB

MD5
db5cdada2c7f5d45cc93e4b896a0a98c

SHA1
aaa97dfd724f3c55105401618094aa97da2db0d6

SHA256
73f32fdad849938884bfca92d193c4f463be105902629322f4e8ee0b5f85e955

SHA512
50825766e4d68475aa3e220b4844e3cda4827f4541ca7e6c6b738873e97e3473d238871010997c89bc6a7337fff4cfa3ba321fc84d081266480da2a8e974f3d1

Download Submit
C:\Windows\system\tTSWrGs.exe

Filesize
1.7MB

MD5
2bb92ffb7d25c7eef289eee89bc4630f

SHA1
8dae4e3281818e40eade48e11e00df0b7f8e787c

SHA256
7e474f0eed185e83f1a60b423e2ae2b616516617743a5068f09cb1affa574d6f

SHA512
e780bfb2dc120973b58db6c8da1e579e10d7787e1cee4384c6b73c94e6bd8e0fb6cde95e7d13a7621c6a81df97458b3928159b4bdf6be74cae42f3d2461aa1a7

Download Submit
C:\Windows\system\xfiuiyK.exe

Filesize
1.7MB

MD5
994d0e179f6e496e3b8280edd67124ee

SHA1
3eb34d17734ddbebb0cd699d71b3e0dc8dc1ec80

SHA256
daa77e779e6d16a5b9873da9478261e8262ab7cacf16498c31520de2c4e08542

SHA512
bc25be17cfdda2ddf99eebda48b6b687211f3fb36b5dd48c36de1adf6ec7992ea05b365367cdfa3c79f89f0c292a45a19f88590b2943894db44bdd0ca8d12002

Download Submit
C:\Windows\system\xikrYPw.exe

Filesize
1.7MB

MD5
0467c3db7bcaf02ef6bd945bb6df68ee

SHA1
ab70191d5eace6e7944758471a19515d266f398a

SHA256
68ccfc5be8864e8d31457a1f359c463dac47720dc49b59d28b1ac7a2a23aa37f

SHA512
408137e8dbe5cc2cb9ea76c5e308e7a4b3c8ee7d9361cd18794c4a305f2551fb292495f484b9edd2bf77141bb282b3e97e0db9d516671d79dc986d7155562415

Download Submit
C:\Windows\system\yOVlnNz.exe

Filesize
1.7MB

MD5
e250ba126e2ab2e5fd6694071eeaefbc

SHA1
b8f1968e6a31d16a7e5dbe1fb2efed7675988c0e

SHA256
d3dd02f5e10310270a656d987962205fd4ede2ca558f44c418b26bb8813481f2

SHA512
18cc81b8153708c6932ddc450438c5d086caba535aea4883d69528e70c67dfedb49c4fb2bfdc3d0397e86c56960a70f986ca9d56b30afab8c378c1cbbbf2b3ee

Download Submit
\Windows\system\CsYntfr.exe

Filesize
1.7MB

MD5
45f1819f2aea81af8fe2d519c5647094

SHA1
f7bd998a940d2009e14b716f0ee7486175a655de

SHA256
b1cce4ce9b2c46ae0dab8b86f9504290bf4f54083ab165a55cf545085ddcbd99

SHA512
ea286766aa58d9c8f4b5523d7c0bb2105aa68cd1272d5b76c0d6f1567bad4d0d0088decc7904e2bce82ca24311bca927ef88e2c4b86c4d6bbc0249cf734379f0

Download Submit
\Windows\system\FOsQrzw.exe

Filesize
1.7MB

MD5
6df2232d723fba0521cfc9c97165839b

SHA1
36b75437a036378dbb23863d6581cb43e3235362

SHA256
42900685d973ffd96bf355d7ef462cf41a4694af5300830e6d07d277b0aebc30

SHA512
91e0469c0f9c6a1b7325529c52f867f9a4f48d43f7f170a187f7359f3b6831cff4106cee609830014bf7597ecbe83a8c0a9dcc0b35de5a8ccbf7312374990cbf

Download Submit
\Windows\system\Hcpuzlb.exe

Filesize
1.7MB

MD5
05a66eacc88add1c36b5578ba5985bf7

SHA1
d46b383230a1d0e5420ac2253285044bb576273f

SHA256
ad76a49fd11af4211c3bd7bc9039e5c07a11247dbb840a2069213fe2083b97c9

SHA512
de4ce20e95886d4b6ec928e73104e180c553722c64b946b541d72837cfaa068bb4893d95372ad8cc635037044ee37b386f01036fba0c6e6e8a13cbc8277dc87b

Download Submit
\Windows\system\NRqlfup.exe

Filesize
1.7MB

MD5
d06ae05f9c2bb0250a560768862dcf88

SHA1
a344b16e5433c6420c2a928a6e67686b3523b32b

SHA256
66554188179f72462aa16c944e6b1cb647fc670c735a9fbf6ee519d6018e12b7

SHA512
a4fb53041b112482a9c6c935d06e587446a4d6ead5f39b57abc649f090f6ca18b42cc32623f7a2ec7ccf3517e998d9c6420c4ee0427631c4442d6d3f16c19530

Download Submit
\Windows\system\VYEycxl.exe

Filesize
1.7MB

MD5
263eac4c7e3b424e003f0beba84bfc8d

SHA1
248cde7189a884f8cf23a3248311e637cddec5c3

SHA256
ff4626d215fac15ac54b26c532071be022e867c8ca4696977310401d317f4335

SHA512
9b7469f5cbd7a6a6e63ae8c7c81f0716bc807344b145f217e5c52aa73ccca5a5ff04b04f31dcd16e50d1f5a7398290bfb18e333e1bb3f09b0a26db729b8057b0

Download Submit
\Windows\system\WCsNsiL.exe

Filesize
1.7MB

MD5
8aa45e4e4bbe0482403c2248ad708d1d

SHA1
c0776938200ec036f73330d424c0e40e8dbed11b

SHA256
c311cf0451fd982cf041e41edab4e73bb9dd8389776d1ccbf3d340f0398d49e3

SHA512
1962ed2d27e56da728d57524aa30bdd44c460bff810718b157be98eebe688ce099f7e92e55355699caa43f5251d4a1e346809533d6d8efedf57ef4f8e211ff20

Download Submit
\Windows\system\YCEHtKH.exe

Filesize
1.7MB

MD5
7321eab6393c7ca9a2fa72876b5d9bff

SHA1
037f4b4db0e96d32cb926a04903d78245c9591be

SHA256
fce94ee5d8b4e3e9f7fe1286b39b3b94f25634919746d8035fb0225ff9c3b4e8

SHA512
6a74bbc9f864ac28f3d152408cb92dbec20836fb1553f7830acc1f6035487917deec40b5feaf9220b6e9f89a6cc282239429517cb40e43416aa5beed1f00faa3

Download Submit
\Windows\system\YIXLGyO.exe

Filesize
1.7MB

MD5
f2142729fe232dded162dffc3c2e5ec4

SHA1
a09cfbe2d680375df85e9d1d7f8438905d4b75df

SHA256
a44fe97252170e8c15d22cce0fec8d6205b5315a29ee698e200c61a944f598c3

SHA512
cf6092e869f46ff850a90805ec7f38b1a74178fea7e398451de9000fdac39be624285d458a5a5babce5b4a57d08f4e620299776310ba2c675a10ceeebed94046

Download Submit
\Windows\system\bmOutse.exe

Filesize
1.7MB

MD5
b3cbf18e290e119e6a9d433e37e0599c

SHA1
c4343eb3dac5e3288f6d7f0f2778217e8bec7654

SHA256
fd59dc86a8d26e4d7b8213928f6b50d0556c930cdc65856673350c26a7f216c1

SHA512
21e6fbe4bae73fd117f0f1fba3bcad1fa382114658b0cf9b7c6695a241f67a67ca2296ec2d2d316bcd428a24ccc3cd03b7bb18b6a56ac75d5b31d8cb68583a5f

Download Submit
\Windows\system\cDnrLMa.exe

Filesize
1.7MB

MD5
53befa5902e5bd983cf1642fc3c9a12e

SHA1
ffdd64d979bf29608bbf583b99e5ec56ad3d1b5c

SHA256
259536be1146d329169589ecdaa8fa4b0208e17251499cf5ea00d892ab02d425

SHA512
95a5649f2ce05c1f12fe8e32feb7aeed7849f72756cfec83311bc8ac1a844825ca775fa9b103b081eb1f3180abc77c47c3d18d6b06f74c04c99d3e563cf7acb9

Download Submit
\Windows\system\edZRfCU.exe

Filesize
1.7MB

MD5
c2b7142037a58c65bd5b570bc4d1c5ec

SHA1
730adfd385f17daa06b844cbb0810677b2600f05

SHA256
7d2448f45083c9a3420cdbd360883af805d1ebd1a458d09a3f7e5f308185d141

SHA512
1d160d0436bb1961db5ea6bb13147303f7182f5089ebb9ff209bbd5a5440ce4876060ed34175e1d55d471eb8b443933effc8734c734d2a5f83eacdbf7f80b1c3

Download Submit
\Windows\system\esDCTzV.exe

Filesize
1.7MB

MD5
47a3b24700d192f6a886804b3b9d99dc

SHA1
063d0827b60386b17fc0a5198a05b254559ffbe7

SHA256
2ace99bae290b61acf76ed28224c463db3579df15bba0df3bfc7659b03f572a2

SHA512
7867ad3b43e7017e3e234f69ec178e8ced3f53bff4a40a0fc23b22d6974e852bf3cde2c63955bb24be32e8645570307ec6c0c93687b1c25f094948f0090480f0

Download Submit
\Windows\system\hzBflzx.exe

Filesize
1.7MB

MD5
3d970e99be1b796bbe0efa6d499bc12c

SHA1
f40133d75cd32137dda6561ba0627c0ca8d6b088

SHA256
276ea8ee459601593ca34961d9baf1a05a1b479492fd81cf328ff25600fe924d

SHA512
3e7f32be18a8286a5131e904365828dcc8a1446cd7882384c3b4fd9cdfa1e976b439ecfa1ae530587f079752595d15baed26660aedf786fc3d5b9a6545a82ffb

Download Submit
\Windows\system\jvonYpa.exe

Filesize
1.7MB

MD5
e782c7126e8581222b381193d231bd22

SHA1
f3ecba422838644800052fb92c51124deb52c8e1

SHA256
ea2d1e1a25cd2fff5a08317a01cd326edea58175fd59747761b8edbfe09dcfa9

SHA512
f700cf42cbce479183c45bc7d18974d57aff2ba1331a07ced7d2b4d2a9d7dc10cb31a9e274966a46a9c4f61d5307e0ad7f8c95458708e49e8f28fdc5854ce8c4

Download Submit
\Windows\system\lNStVga.exe

Filesize
1.7MB

MD5
42c6254eb1f48d29ad284e4e0c09c822

SHA1
0564e1c83bf507d47f486ae91d710e0b9925f3fc

SHA256
bb3e0d78a9acb6be55051353b7b9754b8774fa659da3ce2730187948ad4fb473

SHA512
bbabcac04e3dcdcc1bafc79b0d4740a0a2b05a817dbb87a1e17e2543910f34d28aa2074497a901e7f64c1eb6b635f89dcc3b495f6f65d03354dc69c495b9dc9c

Download Submit
\Windows\system\nJucepk.exe

Filesize
1.7MB

MD5
269e906d2c54f03affc90e072285df75

SHA1
c926383cd4123ee0dcf60999ed00dfffbfc209ec

SHA256
7d2085015ef25cdf9ce30ffee6d668713aacd313f5d4186aaa70333e42d3a534

SHA512
58b674bf1e4371ed122f17b9f04e35a7d200a6628e6a25912fb782f076979fd214ae909505f120e55de00723d9193352cfb307fd2bd2438d5fc76456693cb0d2

Download Submit
\Windows\system\oOdUrob.exe

Filesize
1.7MB

MD5
30d54ae3dec8e530a2cd7346794be7a0

SHA1
e71cd9c45860012086f4ba9c182e9cce26e26ab1

SHA256
fdaa9fdc1e6ef4e6696aeab24ce161e1c82563e810edba58454bef900fde8c67

SHA512
c783a0cd3231212abad58ee9c6f6c0fd51d0b4d9ece5ea517c5beb301f26ea28fdd2e0fbffe85632470f754dfeb32dd9786f4ca409ac8ef68943a13d18e16bc0

Download Submit
\Windows\system\ocXXgua.exe

Filesize
1.7MB

MD5
bc43a9819777c58dc8454d4ac01c9413

SHA1
811b476c02564180cd724adf8bfc5f9076493d80

SHA256
014cf636550a239defd9b7a73fadca05e5e21aa983fda0c436e97faa659ebd28

SHA512
abffac623cce8f8fc25c8bb0da3efaaa3543670fa1ad81dbe7a03b703a73513b2ed9b6bafa543056da5f9209db24fc27bf642b3097e033be65117430b3fa422f

Download Submit
\Windows\system\sNkxQRQ.exe

Filesize
1.7MB

MD5
87e2a31f52a45b774a86e993e887c076

SHA1
e189db9fc1196cd434baba6c51db920a684e93df

SHA256
ef6b3a93bef270b5f79c1718204633aa81ac990616f237d6af7fa098675bfa2e

SHA512
5efea82dcf415defce2d99fb7370cb07fa642695b9aa3760f3381027528337b782fe27cf8c3bf668ee1197a69c8935afc247c80571c2c3d645267946677f9c1c

Download Submit
\Windows\system\wNmAjIL.exe

Filesize
1.7MB

MD5
0166b281a4d6524048c64734d66dd07e

SHA1
91bf9cf78b6125315ccc6058a56255f1dc2162d7

SHA256
e9745be5eeb81c590d8ecd40fbf80a5a1afb637e83d4f365f340aad1e0437be2

SHA512
05bc1cc070e7a796437d2c34ad5e8b2d407029aa9bf58de67fa15dcb3877916817074242dfc35d12cecd3aaf28f50a23c87150d52d72dc04f4379b95e92493d7

Download Submit
\Windows\system\xJZhSoG.exe

Filesize
1.7MB

MD5
07569605acd96aec54ecf237c6b6acd9

SHA1
96aa8effb7d6b0dff748e880146c69239801b595

SHA256
f69792b350fc3124a359d5477492122224fe00f2214bc52dec1e4b8c2d2da063

SHA512
e5fa552217eb84d092dc1e5a2ac4aa1a800122aba80acbf4b54683fdcdd1bfda62ed7ade8cb179179e509c9a46d52836d15281ebeefcc69acc5d15c09e730481

Download Submit
\Windows\system\xnlfHcA.exe

Filesize
1.7MB

MD5
4543f21344d48d83a46823d6dab7439b

SHA1
9a2e34f3cafb6c23661f59bd78abec9d4a18f7bb

SHA256
02cf124031248ac24d49cb6a70df8df53c16bda5b29d13570e395897c08f4753

SHA512
c6e2d5626096c57fe30fe765f69d315814337a6668f7023a7ecab1b8749e45f0caeaeecbed89ddc4b44dc4e9166b122c3d212ff4d036eaa3b58777956aa2012c

Download Submit
\Windows\system\yrBDqFm.exe

Filesize
1.7MB

MD5
494bb4e2ec1a2d2eac08599c33b4fbdd

SHA1
1584c03c057afaafda3ba314fdab7c9eea48a54a

SHA256
6e156bb559bd2721664d29f748a975a70a5a52be90389d9830a34607bba019d7

SHA512
1286ac74ee3048dabc95e66c6616c94a96b1f8e47911a68dfb7c0733e3a1b29dd5fcff8717e335202026d9e89985d3ae1f6d33234940bd1818217234c27e6c30

Download Submit
memory/1620-118-0x00000000030F0000-0x00000000034E2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-173-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-26-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/1620-1-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/1620-169-0x00000000030F0000-0x00000000034E2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1620-86-0x00000000030F0000-0x00000000034E2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-172-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/1620-159-0x00000000030F0000-0x00000000034E2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-20-0x0000000002ED0000-0x00000000032C2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-174-0x00000000030F0000-0x00000000034E2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-175-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/1620-60-0x00000000030F0000-0x00000000034E2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-123-0x00000000030F0000-0x00000000034E2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-177-0x00000000030F0000-0x00000000034E2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-178-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-179-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/1692-160-0x0000000001D10000-0x0000000001D18000-memory.dmp

Filesize
32KB

Download
memory/1692-153-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2112-176-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2464-167-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2536-161-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2568-171-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-38-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2640-82-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2808-43-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2952-170-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download