xmrig | 42888ec979391c7cf95676d572e4d3f2faed8fe27302baaddaef5564e8099f9b

Analysis

max time kernel
32s
max time network
30s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
Size

2.3MB
MD5

06a3d418c95867d90fc36a8d66e007d5
SHA1

2943880a46befd210605b5a388de811d03f35e63
SHA256

42888ec979391c7cf95676d572e4d3f2faed8fe27302baaddaef5564e8099f9b
SHA512

3801535795fbeb658772518fcdc8619241cd59e14a5b6529bc935b8c5f6238e29132e82a54d8143f67bf718c3b34fb2d6cf38b59eb679ea6ab294e0bb527bfc6
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cQTG:NABV

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral1/memory/2760-34-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2640-31-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2056-24-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2844-74-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2532-73-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2460-72-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/2300-78-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/1528-91-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2880-77-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2444-76-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	xmrig
behavioral1/memory/1600-899-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/1600-1123-0x0000000002F20000-0x0000000003312000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2988	toSFwXJ.exe
2056	ImDiuSU.exe
2640	mQioKAV.exe
2760	OWoLwRm.exe
2444	EippOIq.exe
2880	jenrxMt.exe
2460	rOlzain.exe
2532	MYxPxls.exe
2844	oAlmiHM.exe
2300	EvuRFAz.exe
2600	WByvJdk.exe
1528	dIjnwtc.exe
1608	gEuSHVK.exe
284	ohvjMlu.exe
108	SGhUXtT.exe
1360	xJcyHcN.exe
2328	MJzAdED.exe
2816	oOosVfZ.exe
240	JIFVgHT.exe
1264	MLagrvF.exe
348	zavpMqm.exe
2052	btQsERF.exe
2684	kEszDaF.exe
2064	UeDrWKu.exe
676	WYrhzGP.exe
1584	AOKOZQv.exe
556	iByKsiw.exe
704	CxijPfV.exe
1768	JLxjLeG.exe
1908	otjHBVp.exe
1000	HKZAGJn.exe
2376	xBoWpcE.exe
2956	XHmvjeg.exe
2948	uYSelKr.exe
1720	YGMrkiP.exe
2160	DoYWplh.exe
1332	cwHEWtp.exe
2904	hDDemSa.exe
1660	NGrAnkQ.exe
764	ysCRkkj.exe
2668	qorGIKl.exe
3016	psTmQhX.exe
2196	tcSddJn.exe
2984	ECixJTJ.exe
1568	rHjYhSs.exe
2976	DypIbJS.exe
1692	KWIOFoH.exe
2044	bYnmrJz.exe
996	HBIuGWb.exe
2808	bmnvhxj.exe
2276	ZpRZtJm.exe
2088	QBedbnI.exe
2924	cYaIRoq.exe
1672	iWyJFmR.exe
2728	sRwvbsW.exe
1548	zODZsof.exe
2488	MFEFhtA.exe
1656	SlhjFpd.exe
380	wWEBGmd.exe
2536	tCUXZoL.exe
2676	ZqjWmRb.exe
2544	VJmeZrf.exe
2840	HryvFEl.exe
1764	vaAKcbJ.exe

Loads dropped DLL 64 IoCs

pid	Process
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0036000000014b10-7.dat	upx
behavioral1/files/0x000800000001502c-10.dat	upx
behavioral1/files/0x00070000000153c7-14.dat	upx
behavioral1/memory/2760-34-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/files/0x00070000000153d9-35.dat	upx
behavioral1/memory/2640-31-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2056-24-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2988-19-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/files/0x001800000000558a-53.dat	upx
behavioral1/files/0x0006000000015d0c-62.dat	upx
behavioral1/files/0x00080000000155f6-61.dat	upx
behavioral1/memory/2844-74-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/files/0x0006000000015e09-93.dat	upx
behavioral1/files/0x0006000000015d24-65.dat	upx
behavioral1/memory/2532-73-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/2460-72-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/files/0x0006000000015d44-81.dat	upx
behavioral1/files/0x0009000000015cf5-59.dat	upx
behavioral1/files/0x0006000000015f3c-100.dat	upx
behavioral1/memory/2600-88-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/files/0x00060000000160cc-108.dat	upx
behavioral1/files/0x0006000000015d4c-84.dat	upx
behavioral1/files/0x00080000000122bf-6.dat	upx
behavioral1/memory/1600-1-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/files/0x00060000000162c9-115.dat	upx
behavioral1/memory/2300-78-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/1528-91-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/files/0x0006000000015e6d-97.dat	upx
behavioral1/files/0x0006000000015fa7-132.dat	upx
behavioral1/files/0x000600000001654a-129.dat	upx
behavioral1/files/0x00060000000161b3-112.dat	upx
behavioral1/files/0x0006000000016476-137.dat	upx
behavioral1/files/0x00060000000165f0-133.dat	upx
behavioral1/files/0x0006000000016a6f-152.dat	upx
behavioral1/files/0x0006000000016c8c-168.dat	upx
behavioral1/files/0x0006000000016c1d-173.dat	upx
behavioral1/files/0x0006000000016ce4-184.dat	upx
behavioral1/files/0x0006000000016cb2-180.dat	upx
behavioral1/files/0x0006000000016c42-165.dat	upx
behavioral1/files/0x0006000000016813-150.dat	upx
behavioral1/files/0x0006000000016cf5-189.dat	upx
behavioral1/files/0x0006000000016c3a-163.dat	upx
behavioral1/files/0x0035000000014b36-144.dat	upx
behavioral1/memory/2880-77-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2444-76-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/memory/1600-899-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DWCazqY.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\SVUcuMm.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\pOBtRmV.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\zxNpZaK.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\HKZAGJn.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\ECixJTJ.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\NlOHDYi.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\usdYmRN.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\WoBXhht.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\gDxWccR.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\bminYOx.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\rHjYhSs.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\zBljYQW.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\zFnkCDO.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\FJFyoJC.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\yyABnbI.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\fgTYMWM.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\iKHjRHw.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\quPqfiF.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\HSJXYnL.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\PjBAVph.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\vKlkVSc.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\IlVJSCN.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\MiAdSxg.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\xPCKPWG.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\YgZdizF.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\ZvWFoUk.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\MJzAdED.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\KWIOFoH.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\TsNsJWh.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\YaJPYFl.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\THEMRBF.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\fsQmnoJ.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\bAXujlr.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\HLULslB.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\VbxNdfA.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\QHUnvea.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\jenrxMt.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\cONqhrG.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\jranSIO.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\suVbLtY.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\evCwkxo.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\KxvWKIN.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\vTboOnQ.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\SGhUXtT.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\LmRdWsX.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\GojpoYd.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\jEUovTD.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\ihrbxNn.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\WQrEmsr.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\djBhAvr.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\aTXoEQw.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\VOSORSD.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\mikvgRj.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\aWpsZyV.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\ScczFUa.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\gxajiaB.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\bmoClHf.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\UXjakTX.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\juVWjAc.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\BsThDsY.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\QjcKnzH.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\FcDNiiy.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
File created	C:\Windows\System\SorZciq.exe	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2108	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
Token: SeDebugPrivilege	2108	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2108	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	29
PID 1600 wrote to memory of 2108	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	29
PID 1600 wrote to memory of 2108	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	29
PID 1600 wrote to memory of 2988	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	30
PID 1600 wrote to memory of 2988	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	30
PID 1600 wrote to memory of 2988	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	30
PID 1600 wrote to memory of 2056	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	31
PID 1600 wrote to memory of 2056	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	31
PID 1600 wrote to memory of 2056	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	31
PID 1600 wrote to memory of 2640	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	32
PID 1600 wrote to memory of 2640	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	32
PID 1600 wrote to memory of 2640	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	32
PID 1600 wrote to memory of 2760	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	33
PID 1600 wrote to memory of 2760	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	33
PID 1600 wrote to memory of 2760	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	33
PID 1600 wrote to memory of 2460	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	34
PID 1600 wrote to memory of 2460	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	34
PID 1600 wrote to memory of 2460	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	34
PID 1600 wrote to memory of 2444	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	35
PID 1600 wrote to memory of 2444	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	35
PID 1600 wrote to memory of 2444	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	35
PID 1600 wrote to memory of 2532	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	36
PID 1600 wrote to memory of 2532	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	36
PID 1600 wrote to memory of 2532	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	36
PID 1600 wrote to memory of 2880	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	37
PID 1600 wrote to memory of 2880	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	37
PID 1600 wrote to memory of 2880	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	37
PID 1600 wrote to memory of 2844	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	38
PID 1600 wrote to memory of 2844	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	38
PID 1600 wrote to memory of 2844	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	38
PID 1600 wrote to memory of 2300	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	39
PID 1600 wrote to memory of 2300	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	39
PID 1600 wrote to memory of 2300	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	39
PID 1600 wrote to memory of 2600	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	40
PID 1600 wrote to memory of 2600	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	40
PID 1600 wrote to memory of 2600	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	40
PID 1600 wrote to memory of 1528	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	41
PID 1600 wrote to memory of 1528	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	41
PID 1600 wrote to memory of 1528	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	41
PID 1600 wrote to memory of 1608	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	42
PID 1600 wrote to memory of 1608	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	42
PID 1600 wrote to memory of 1608	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	42
PID 1600 wrote to memory of 2328	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	43
PID 1600 wrote to memory of 2328	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	43
PID 1600 wrote to memory of 2328	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	43
PID 1600 wrote to memory of 284	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	44
PID 1600 wrote to memory of 284	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	44
PID 1600 wrote to memory of 284	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	44
PID 1600 wrote to memory of 240	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	45
PID 1600 wrote to memory of 240	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	45
PID 1600 wrote to memory of 240	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	45
PID 1600 wrote to memory of 108	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	46
PID 1600 wrote to memory of 108	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	46
PID 1600 wrote to memory of 108	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	46
PID 1600 wrote to memory of 1264	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	47
PID 1600 wrote to memory of 1264	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	47
PID 1600 wrote to memory of 1264	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	47
PID 1600 wrote to memory of 1360	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	48
PID 1600 wrote to memory of 1360	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	48
PID 1600 wrote to memory of 1360	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	48
PID 1600 wrote to memory of 348	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	49
PID 1600 wrote to memory of 348	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	49
PID 1600 wrote to memory of 348	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	49
PID 1600 wrote to memory of 2816	1600	06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06a3d418c95867d90fc36a8d66e007d5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2108
- C:\Windows\System\toSFwXJ.exe
  C:\Windows\System\toSFwXJ.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\ImDiuSU.exe
  C:\Windows\System\ImDiuSU.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\mQioKAV.exe
  C:\Windows\System\mQioKAV.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\OWoLwRm.exe
  C:\Windows\System\OWoLwRm.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\rOlzain.exe
  C:\Windows\System\rOlzain.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\EippOIq.exe
  C:\Windows\System\EippOIq.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\MYxPxls.exe
  C:\Windows\System\MYxPxls.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\jenrxMt.exe
  C:\Windows\System\jenrxMt.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\oAlmiHM.exe
  C:\Windows\System\oAlmiHM.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\EvuRFAz.exe
  C:\Windows\System\EvuRFAz.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\WByvJdk.exe
  C:\Windows\System\WByvJdk.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\dIjnwtc.exe
  C:\Windows\System\dIjnwtc.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\gEuSHVK.exe
  C:\Windows\System\gEuSHVK.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\MJzAdED.exe
  C:\Windows\System\MJzAdED.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\ohvjMlu.exe
  C:\Windows\System\ohvjMlu.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\JIFVgHT.exe
  C:\Windows\System\JIFVgHT.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\SGhUXtT.exe
  C:\Windows\System\SGhUXtT.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\MLagrvF.exe
  C:\Windows\System\MLagrvF.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\xJcyHcN.exe
  C:\Windows\System\xJcyHcN.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\zavpMqm.exe
  C:\Windows\System\zavpMqm.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\oOosVfZ.exe
  C:\Windows\System\oOosVfZ.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\btQsERF.exe
  C:\Windows\System\btQsERF.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\kEszDaF.exe
  C:\Windows\System\kEszDaF.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\UeDrWKu.exe
  C:\Windows\System\UeDrWKu.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\WYrhzGP.exe
  C:\Windows\System\WYrhzGP.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\CxijPfV.exe
  C:\Windows\System\CxijPfV.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\AOKOZQv.exe
  C:\Windows\System\AOKOZQv.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\JLxjLeG.exe
  C:\Windows\System\JLxjLeG.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\iByKsiw.exe
  C:\Windows\System\iByKsiw.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\otjHBVp.exe
  C:\Windows\System\otjHBVp.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\HKZAGJn.exe
  C:\Windows\System\HKZAGJn.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\xBoWpcE.exe
  C:\Windows\System\xBoWpcE.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\XHmvjeg.exe
  C:\Windows\System\XHmvjeg.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\uYSelKr.exe
  C:\Windows\System\uYSelKr.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\YGMrkiP.exe
  C:\Windows\System\YGMrkiP.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\DoYWplh.exe
  C:\Windows\System\DoYWplh.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\cwHEWtp.exe
  C:\Windows\System\cwHEWtp.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\hDDemSa.exe
  C:\Windows\System\hDDemSa.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\NGrAnkQ.exe
  C:\Windows\System\NGrAnkQ.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\ysCRkkj.exe
  C:\Windows\System\ysCRkkj.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\qorGIKl.exe
  C:\Windows\System\qorGIKl.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\psTmQhX.exe
  C:\Windows\System\psTmQhX.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\tcSddJn.exe
  C:\Windows\System\tcSddJn.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\ECixJTJ.exe
  C:\Windows\System\ECixJTJ.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\rHjYhSs.exe
  C:\Windows\System\rHjYhSs.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\KWIOFoH.exe
  C:\Windows\System\KWIOFoH.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\DypIbJS.exe
  C:\Windows\System\DypIbJS.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\HBIuGWb.exe
  C:\Windows\System\HBIuGWb.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\bYnmrJz.exe
  C:\Windows\System\bYnmrJz.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\bmnvhxj.exe
  C:\Windows\System\bmnvhxj.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\ZpRZtJm.exe
  C:\Windows\System\ZpRZtJm.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\QBedbnI.exe
  C:\Windows\System\QBedbnI.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\cYaIRoq.exe
  C:\Windows\System\cYaIRoq.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\zODZsof.exe
  C:\Windows\System\zODZsof.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\iWyJFmR.exe
  C:\Windows\System\iWyJFmR.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\tCUXZoL.exe
  C:\Windows\System\tCUXZoL.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\sRwvbsW.exe
  C:\Windows\System\sRwvbsW.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\VJmeZrf.exe
  C:\Windows\System\VJmeZrf.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\MFEFhtA.exe
  C:\Windows\System\MFEFhtA.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\HryvFEl.exe
  C:\Windows\System\HryvFEl.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\SlhjFpd.exe
  C:\Windows\System\SlhjFpd.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\vaAKcbJ.exe
  C:\Windows\System\vaAKcbJ.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\wWEBGmd.exe
  C:\Windows\System\wWEBGmd.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\lvdiHZn.exe
  C:\Windows\System\lvdiHZn.exe
  2⤵
  PID:1592
- C:\Windows\System\ZqjWmRb.exe
  C:\Windows\System\ZqjWmRb.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\rJdJrsT.exe
  C:\Windows\System\rJdJrsT.exe
  2⤵
  PID:1488
- C:\Windows\System\CqnuuUv.exe
  C:\Windows\System\CqnuuUv.exe
  2⤵
  PID:1752
- C:\Windows\System\fOYZYcw.exe
  C:\Windows\System\fOYZYcw.exe
  2⤵
  PID:2732
- C:\Windows\System\oExjwZD.exe
  C:\Windows\System\oExjwZD.exe
  2⤵
  PID:2392
- C:\Windows\System\hYEEoOL.exe
  C:\Windows\System\hYEEoOL.exe
  2⤵
  PID:2424
- C:\Windows\System\PCkcbIj.exe
  C:\Windows\System\PCkcbIj.exe
  2⤵
  PID:2908
- C:\Windows\System\rXETVLY.exe
  C:\Windows\System\rXETVLY.exe
  2⤵
  PID:1148
- C:\Windows\System\okTcPZf.exe
  C:\Windows\System\okTcPZf.exe
  2⤵
  PID:580
- C:\Windows\System\SsOPrXx.exe
  C:\Windows\System\SsOPrXx.exe
  2⤵
  PID:1664
- C:\Windows\System\GVmgrmd.exe
  C:\Windows\System\GVmgrmd.exe
  2⤵
  PID:1124
- C:\Windows\System\IafdxHZ.exe
  C:\Windows\System\IafdxHZ.exe
  2⤵
  PID:656
- C:\Windows\System\ERwsPYQ.exe
  C:\Windows\System\ERwsPYQ.exe
  2⤵
  PID:1340
- C:\Windows\System\IkWmdws.exe
  C:\Windows\System\IkWmdws.exe
  2⤵
  PID:3056
- C:\Windows\System\OkpjndQ.exe
  C:\Windows\System\OkpjndQ.exe
  2⤵
  PID:3068
- C:\Windows\System\oePTVQw.exe
  C:\Windows\System\oePTVQw.exe
  2⤵
  PID:3064
- C:\Windows\System\ddzLtyq.exe
  C:\Windows\System\ddzLtyq.exe
  2⤵
  PID:1496
- C:\Windows\System\TtfWcnz.exe
  C:\Windows\System\TtfWcnz.exe
  2⤵
  PID:1612
- C:\Windows\System\DVwRKEa.exe
  C:\Windows\System\DVwRKEa.exe
  2⤵
  PID:972
- C:\Windows\System\NtDezSw.exe
  C:\Windows\System\NtDezSw.exe
  2⤵
  PID:2752
- C:\Windows\System\wuFoCrd.exe
  C:\Windows\System\wuFoCrd.exe
  2⤵
  PID:908
- C:\Windows\System\bxYQaGP.exe
  C:\Windows\System\bxYQaGP.exe
  2⤵
  PID:1904
- C:\Windows\System\oNwzWVG.exe
  C:\Windows\System\oNwzWVG.exe
  2⤵
  PID:2004
- C:\Windows\System\VXOrTrI.exe
  C:\Windows\System\VXOrTrI.exe
  2⤵
  PID:2220
- C:\Windows\System\bqTBNUQ.exe
  C:\Windows\System\bqTBNUQ.exe
  2⤵
  PID:852
- C:\Windows\System\dHFWicO.exe
  C:\Windows\System\dHFWicO.exe
  2⤵
  PID:1540
- C:\Windows\System\FokkmkX.exe
  C:\Windows\System\FokkmkX.exe
  2⤵
  PID:2672
- C:\Windows\System\lIbvAEi.exe
  C:\Windows\System\lIbvAEi.exe
  2⤵
  PID:2708
- C:\Windows\System\vpSEDbg.exe
  C:\Windows\System\vpSEDbg.exe
  2⤵
  PID:2288
- C:\Windows\System\MyYwKmt.exe
  C:\Windows\System\MyYwKmt.exe
  2⤵
  PID:616
- C:\Windows\System\YeXppJa.exe
  C:\Windows\System\YeXppJa.exe
  2⤵
  PID:3036
- C:\Windows\System\LemDRKG.exe
  C:\Windows\System\LemDRKG.exe
  2⤵
  PID:1996
- C:\Windows\System\MlHdQly.exe
  C:\Windows\System\MlHdQly.exe
  2⤵
  PID:2324
- C:\Windows\System\PTCjBKV.exe
  C:\Windows\System\PTCjBKV.exe
  2⤵
  PID:2180
- C:\Windows\System\yFWzLUn.exe
  C:\Windows\System\yFWzLUn.exe
  2⤵
  PID:2140
- C:\Windows\System\ZVognlY.exe
  C:\Windows\System\ZVognlY.exe
  2⤵
  PID:2540
- C:\Windows\System\NKmsZFx.exe
  C:\Windows\System\NKmsZFx.exe
  2⤵
  PID:1776
- C:\Windows\System\rZupCkM.exe
  C:\Windows\System\rZupCkM.exe
  2⤵
  PID:2016
- C:\Windows\System\buTwZGV.exe
  C:\Windows\System\buTwZGV.exe
  2⤵
  PID:2072
- C:\Windows\System\xjMzPtt.exe
  C:\Windows\System\xjMzPtt.exe
  2⤵
  PID:2240
- C:\Windows\System\KKHnSGL.exe
  C:\Windows\System\KKHnSGL.exe
  2⤵
  PID:1572
- C:\Windows\System\LtaYGbk.exe
  C:\Windows\System\LtaYGbk.exe
  2⤵
  PID:1208
- C:\Windows\System\RQlRtuY.exe
  C:\Windows\System\RQlRtuY.exe
  2⤵
  PID:1428
- C:\Windows\System\WubBWoB.exe
  C:\Windows\System\WubBWoB.exe
  2⤵
  PID:1760
- C:\Windows\System\VgyQkbo.exe
  C:\Windows\System\VgyQkbo.exe
  2⤵
  PID:1300
- C:\Windows\System\FjlGtzj.exe
  C:\Windows\System\FjlGtzj.exe
  2⤵
  PID:2916
- C:\Windows\System\qFrJguY.exe
  C:\Windows\System\qFrJguY.exe
  2⤵
  PID:2468
- C:\Windows\System\SztPoEj.exe
  C:\Windows\System\SztPoEj.exe
  2⤵
  PID:376
- C:\Windows\System\EbxyQLj.exe
  C:\Windows\System\EbxyQLj.exe
  2⤵
  PID:2380
- C:\Windows\System\dZwLmrb.exe
  C:\Windows\System\dZwLmrb.exe
  2⤵
  PID:1304
- C:\Windows\System\lFSnILS.exe
  C:\Windows\System\lFSnILS.exe
  2⤵
  PID:1580
- C:\Windows\System\YMmWwFC.exe
  C:\Windows\System\YMmWwFC.exe
  2⤵
  PID:2996
- C:\Windows\System\EQFbkRK.exe
  C:\Windows\System\EQFbkRK.exe
  2⤵
  PID:340
- C:\Windows\System\opORViW.exe
  C:\Windows\System\opORViW.exe
  2⤵
  PID:2700
- C:\Windows\System\xtEbMIg.exe
  C:\Windows\System\xtEbMIg.exe
  2⤵
  PID:2736
- C:\Windows\System\wMAdlLS.exe
  C:\Windows\System\wMAdlLS.exe
  2⤵
  PID:1556
- C:\Windows\System\wNKyWZS.exe
  C:\Windows\System\wNKyWZS.exe
  2⤵
  PID:2344
- C:\Windows\System\MiAdSxg.exe
  C:\Windows\System\MiAdSxg.exe
  2⤵
  PID:2612
- C:\Windows\System\iqhjTdg.exe
  C:\Windows\System\iqhjTdg.exe
  2⤵
  PID:956
- C:\Windows\System\SVdNsZv.exe
  C:\Windows\System\SVdNsZv.exe
  2⤵
  PID:1668
- C:\Windows\System\VyNKkYH.exe
  C:\Windows\System\VyNKkYH.exe
  2⤵
  PID:2000
- C:\Windows\System\DObJWSw.exe
  C:\Windows\System\DObJWSw.exe
  2⤵
  PID:1800
- C:\Windows\System\DWCazqY.exe
  C:\Windows\System\DWCazqY.exe
  2⤵
  PID:2572
- C:\Windows\System\cXWxVAE.exe
  C:\Windows\System\cXWxVAE.exe
  2⤵
  PID:2356
- C:\Windows\System\XIvdJIO.exe
  C:\Windows\System\XIvdJIO.exe
  2⤵
  PID:1384
- C:\Windows\System\TpyviqD.exe
  C:\Windows\System\TpyviqD.exe
  2⤵
  PID:780
- C:\Windows\System\eedLUho.exe
  C:\Windows\System\eedLUho.exe
  2⤵
  PID:2316
- C:\Windows\System\mzQsFYM.exe
  C:\Windows\System\mzQsFYM.exe
  2⤵
  PID:1960
- C:\Windows\System\RVrLAtz.exe
  C:\Windows\System\RVrLAtz.exe
  2⤵
  PID:1184
- C:\Windows\System\kDTrfJe.exe
  C:\Windows\System\kDTrfJe.exe
  2⤵
  PID:2152
- C:\Windows\System\pZxHmNf.exe
  C:\Windows\System\pZxHmNf.exe
  2⤵
  PID:2512
- C:\Windows\System\ZffvPng.exe
  C:\Windows\System\ZffvPng.exe
  2⤵
  PID:600
- C:\Windows\System\vMJzMIg.exe
  C:\Windows\System\vMJzMIg.exe
  2⤵
  PID:2224
- C:\Windows\System\EYsJzqm.exe
  C:\Windows\System\EYsJzqm.exe
  2⤵
  PID:1144
- C:\Windows\System\nUTclii.exe
  C:\Windows\System\nUTclii.exe
  2⤵
  PID:2596
- C:\Windows\System\GNeUCic.exe
  C:\Windows\System\GNeUCic.exe
  2⤵
  PID:2548
- C:\Windows\System\dHYGkTJ.exe
  C:\Windows\System\dHYGkTJ.exe
  2⤵
  PID:2040
- C:\Windows\System\ioxdxKc.exe
  C:\Windows\System\ioxdxKc.exe
  2⤵
  PID:940
- C:\Windows\System\nficivv.exe
  C:\Windows\System\nficivv.exe
  2⤵
  PID:2472
- C:\Windows\System\YXXjsqB.exe
  C:\Windows\System\YXXjsqB.exe
  2⤵
  PID:2212
- C:\Windows\System\nsdnsNa.exe
  C:\Windows\System\nsdnsNa.exe
  2⤵
  PID:2992
- C:\Windows\System\DxVUEPF.exe
  C:\Windows\System\DxVUEPF.exe
  2⤵
  PID:2792
- C:\Windows\System\puGQPFU.exe
  C:\Windows\System\puGQPFU.exe
  2⤵
  PID:2436
- C:\Windows\System\bBCQCUD.exe
  C:\Windows\System\bBCQCUD.exe
  2⤵
  PID:436
- C:\Windows\System\FFDuuUm.exe
  C:\Windows\System\FFDuuUm.exe
  2⤵
  PID:1544
- C:\Windows\System\awDJJZc.exe
  C:\Windows\System\awDJJZc.exe
  2⤵
  PID:848
- C:\Windows\System\yyAsiuo.exe
  C:\Windows\System\yyAsiuo.exe
  2⤵
  PID:2820
- C:\Windows\System\unKCaJl.exe
  C:\Windows\System\unKCaJl.exe
  2⤵
  PID:2188
- C:\Windows\System\CIrqwYf.exe
  C:\Windows\System\CIrqwYf.exe
  2⤵
  PID:668
- C:\Windows\System\NrOdAKa.exe
  C:\Windows\System\NrOdAKa.exe
  2⤵
  PID:2120
- C:\Windows\System\XzElQHv.exe
  C:\Windows\System\XzElQHv.exe
  2⤵
  PID:1652
- C:\Windows\System\rsnUzpb.exe
  C:\Windows\System\rsnUzpb.exe
  2⤵
  PID:3080
- C:\Windows\System\wTvNSYo.exe
  C:\Windows\System\wTvNSYo.exe
  2⤵
  PID:3096
- C:\Windows\System\IYBVwlb.exe
  C:\Windows\System\IYBVwlb.exe
  2⤵
  PID:3112
- C:\Windows\System\xWtUxnb.exe
  C:\Windows\System\xWtUxnb.exe
  2⤵
  PID:3128
- C:\Windows\System\KBeewRv.exe
  C:\Windows\System\KBeewRv.exe
  2⤵
  PID:3144
- C:\Windows\System\sPMgBuy.exe
  C:\Windows\System\sPMgBuy.exe
  2⤵
  PID:3164
- C:\Windows\System\xBPjbiO.exe
  C:\Windows\System\xBPjbiO.exe
  2⤵
  PID:3180
- C:\Windows\System\cONqhrG.exe
  C:\Windows\System\cONqhrG.exe
  2⤵
  PID:3196
- C:\Windows\System\KhEQbjg.exe
  C:\Windows\System\KhEQbjg.exe
  2⤵
  PID:3212
- C:\Windows\System\fBjjytg.exe
  C:\Windows\System\fBjjytg.exe
  2⤵
  PID:3356
- C:\Windows\System\PQoxzBE.exe
  C:\Windows\System\PQoxzBE.exe
  2⤵
  PID:3404
- C:\Windows\System\JHzFAaQ.exe
  C:\Windows\System\JHzFAaQ.exe
  2⤵
  PID:3420
- C:\Windows\System\RMIsljG.exe
  C:\Windows\System\RMIsljG.exe
  2⤵
  PID:3436
- C:\Windows\System\QgXEAZy.exe
  C:\Windows\System\QgXEAZy.exe
  2⤵
  PID:3452
- C:\Windows\System\SorZciq.exe
  C:\Windows\System\SorZciq.exe
  2⤵
  PID:3468
- C:\Windows\System\iiRBrLo.exe
  C:\Windows\System\iiRBrLo.exe
  2⤵
  PID:3484
- C:\Windows\System\LeXacXW.exe
  C:\Windows\System\LeXacXW.exe
  2⤵
  PID:3500
- C:\Windows\System\kIyDRcj.exe
  C:\Windows\System\kIyDRcj.exe
  2⤵
  PID:3516
- C:\Windows\System\fVeEqEl.exe
  C:\Windows\System\fVeEqEl.exe
  2⤵
  PID:3532
- C:\Windows\System\wQYyGRQ.exe
  C:\Windows\System\wQYyGRQ.exe
  2⤵
  PID:3548
- C:\Windows\System\uuHvZiI.exe
  C:\Windows\System\uuHvZiI.exe
  2⤵
  PID:3568
- C:\Windows\System\DOeOiIQ.exe
  C:\Windows\System\DOeOiIQ.exe
  2⤵
  PID:3584
- C:\Windows\System\LanyptC.exe
  C:\Windows\System\LanyptC.exe
  2⤵
  PID:3600
- C:\Windows\System\eUYXACV.exe
  C:\Windows\System\eUYXACV.exe
  2⤵
  PID:3616
- C:\Windows\System\ublhtQa.exe
  C:\Windows\System\ublhtQa.exe
  2⤵
  PID:3632
- C:\Windows\System\ZGWYBdb.exe
  C:\Windows\System\ZGWYBdb.exe
  2⤵
  PID:3648
- C:\Windows\System\oNGLmCX.exe
  C:\Windows\System\oNGLmCX.exe
  2⤵
  PID:3664
- C:\Windows\System\DYFToIt.exe
  C:\Windows\System\DYFToIt.exe
  2⤵
  PID:3680
- C:\Windows\System\EUUuwPx.exe
  C:\Windows\System\EUUuwPx.exe
  2⤵
  PID:3696
- C:\Windows\System\uyjCVwI.exe
  C:\Windows\System\uyjCVwI.exe
  2⤵
  PID:3712
- C:\Windows\System\IOTPZPI.exe
  C:\Windows\System\IOTPZPI.exe
  2⤵
  PID:3728
- C:\Windows\System\gZccDUT.exe
  C:\Windows\System\gZccDUT.exe
  2⤵
  PID:3744
- C:\Windows\System\grjZKYv.exe
  C:\Windows\System\grjZKYv.exe
  2⤵
  PID:3764
- C:\Windows\System\ocjFCnI.exe
  C:\Windows\System\ocjFCnI.exe
  2⤵
  PID:3780
- C:\Windows\System\WpNNsYR.exe
  C:\Windows\System\WpNNsYR.exe
  2⤵
  PID:3796
- C:\Windows\System\lCQRVZS.exe
  C:\Windows\System\lCQRVZS.exe
  2⤵
  PID:3812
- C:\Windows\System\PdtZpqm.exe
  C:\Windows\System\PdtZpqm.exe
  2⤵
  PID:3828
- C:\Windows\System\MuMEkKD.exe
  C:\Windows\System\MuMEkKD.exe
  2⤵
  PID:3844
- C:\Windows\System\nDMFgAG.exe
  C:\Windows\System\nDMFgAG.exe
  2⤵
  PID:3860
- C:\Windows\System\WcdcKtN.exe
  C:\Windows\System\WcdcKtN.exe
  2⤵
  PID:3876
- C:\Windows\System\JXokfbZ.exe
  C:\Windows\System\JXokfbZ.exe
  2⤵
  PID:3896
- C:\Windows\System\fbKBbZW.exe
  C:\Windows\System\fbKBbZW.exe
  2⤵
  PID:3912
- C:\Windows\System\JFlwGLq.exe
  C:\Windows\System\JFlwGLq.exe
  2⤵
  PID:3928
- C:\Windows\System\SsPaJsQ.exe
  C:\Windows\System\SsPaJsQ.exe
  2⤵
  PID:4060
- C:\Windows\System\HFPKZOi.exe
  C:\Windows\System\HFPKZOi.exe
  2⤵
  PID:4080
- C:\Windows\System\glqrPRm.exe
  C:\Windows\System\glqrPRm.exe
  2⤵
  PID:532
- C:\Windows\System\HWTKiFz.exe
  C:\Windows\System\HWTKiFz.exe
  2⤵
  PID:816
- C:\Windows\System\oGqQdLG.exe
  C:\Windows\System\oGqQdLG.exe
  2⤵
  PID:1212
- C:\Windows\System\WHMcgkE.exe
  C:\Windows\System\WHMcgkE.exe
  2⤵
  PID:1724
- C:\Windows\System\KzpjRmK.exe
  C:\Windows\System\KzpjRmK.exe
  2⤵
  PID:636
- C:\Windows\System\YXMJamV.exe
  C:\Windows\System\YXMJamV.exe
  2⤵
  PID:2480
- C:\Windows\System\yLnGasI.exe
  C:\Windows\System\yLnGasI.exe
  2⤵
  PID:3160
- C:\Windows\System\AmUjmYZ.exe
  C:\Windows\System\AmUjmYZ.exe
  2⤵
  PID:1964
- C:\Windows\System\QzKEIrp.exe
  C:\Windows\System\QzKEIrp.exe
  2⤵
  PID:3044
- C:\Windows\System\gPotHje.exe
  C:\Windows\System\gPotHje.exe
  2⤵
  PID:2644
- C:\Windows\System\suVbLtY.exe
  C:\Windows\System\suVbLtY.exe
  2⤵
  PID:2528
- C:\Windows\System\zkFomks.exe
  C:\Windows\System\zkFomks.exe
  2⤵
  PID:1564
- C:\Windows\System\OmDnsRN.exe
  C:\Windows\System\OmDnsRN.exe
  2⤵
  PID:2320
- C:\Windows\System\vnOjkLy.exe
  C:\Windows\System\vnOjkLy.exe
  2⤵
  PID:2336
- C:\Windows\System\ELISueY.exe
  C:\Windows\System\ELISueY.exe
  2⤵
  PID:1992
- C:\Windows\System\loTtkqG.exe
  C:\Windows\System\loTtkqG.exe
  2⤵
  PID:3136
- C:\Windows\System\MuOowmc.exe
  C:\Windows\System\MuOowmc.exe
  2⤵
  PID:3208
- C:\Windows\System\NufbFoy.exe
  C:\Windows\System\NufbFoy.exe
  2⤵
  PID:3248
- C:\Windows\System\BdZuWDS.exe
  C:\Windows\System\BdZuWDS.exe
  2⤵
  PID:3256
- C:\Windows\System\kMUGqvJ.exe
  C:\Windows\System\kMUGqvJ.exe
  2⤵
  PID:3272
- C:\Windows\System\BHhuXtj.exe
  C:\Windows\System\BHhuXtj.exe
  2⤵
  PID:3288
- C:\Windows\System\RytPaFm.exe
  C:\Windows\System\RytPaFm.exe
  2⤵
  PID:3092
- C:\Windows\System\riTXRXZ.exe
  C:\Windows\System\riTXRXZ.exe
  2⤵
  PID:3228
- C:\Windows\System\WuktZAU.exe
  C:\Windows\System\WuktZAU.exe
  2⤵
  PID:3300
- C:\Windows\System\aBgBftM.exe
  C:\Windows\System\aBgBftM.exe
  2⤵
  PID:3320
- C:\Windows\System\YQiJMmn.exe
  C:\Windows\System\YQiJMmn.exe
  2⤵
  PID:3336
- C:\Windows\System\YdOMSZp.exe
  C:\Windows\System\YdOMSZp.exe
  2⤵
  PID:3348
- C:\Windows\System\KKoMPiu.exe
  C:\Windows\System\KKoMPiu.exe
  2⤵
  PID:3396
- C:\Windows\System\VWNVqxj.exe
  C:\Windows\System\VWNVqxj.exe
  2⤵
  PID:1084
- C:\Windows\System\WGafJQJ.exe
  C:\Windows\System\WGafJQJ.exe
  2⤵
  PID:3480
- C:\Windows\System\IYqvUYs.exe
  C:\Windows\System\IYqvUYs.exe
  2⤵
  PID:3540
- C:\Windows\System\JShIOlq.exe
  C:\Windows\System\JShIOlq.exe
  2⤵
  PID:3612
- C:\Windows\System\NzWbGND.exe
  C:\Windows\System\NzWbGND.exe
  2⤵
  PID:3704
- C:\Windows\System\FJFyoJC.exe
  C:\Windows\System\FJFyoJC.exe
  2⤵
  PID:3772
- C:\Windows\System\MzzcxQo.exe
  C:\Windows\System\MzzcxQo.exe
  2⤵
  PID:3868
- C:\Windows\System\PHgYOTd.exe
  C:\Windows\System\PHgYOTd.exe
  2⤵
  PID:3936
- C:\Windows\System\EFsdNtO.exe
  C:\Windows\System\EFsdNtO.exe
  2⤵
  PID:3756
- C:\Windows\System\YHmTHIl.exe
  C:\Windows\System\YHmTHIl.exe
  2⤵
  PID:3964
- C:\Windows\System\YbwtoPW.exe
  C:\Windows\System\YbwtoPW.exe
  2⤵
  PID:3984
- C:\Windows\System\zobfcwH.exe
  C:\Windows\System\zobfcwH.exe
  2⤵
  PID:3996
- C:\Windows\System\pZHwEmn.exe
  C:\Windows\System\pZHwEmn.exe
  2⤵
  PID:4008
- C:\Windows\System\iNXFmrB.exe
  C:\Windows\System\iNXFmrB.exe
  2⤵
  PID:3808
- C:\Windows\System\XslvHIj.exe
  C:\Windows\System\XslvHIj.exe
  2⤵
  PID:4032
- C:\Windows\System\wPDhrBf.exe
  C:\Windows\System\wPDhrBf.exe
  2⤵
  PID:4048
- C:\Windows\System\jeRFpuG.exe
  C:\Windows\System\jeRFpuG.exe
  2⤵
  PID:3940
- C:\Windows\System\nkdZcMu.exe
  C:\Windows\System\nkdZcMu.exe
  2⤵
  PID:3492
- C:\Windows\System\sLvbZXI.exe
  C:\Windows\System\sLvbZXI.exe
  2⤵
  PID:3560
- C:\Windows\System\seDedfr.exe
  C:\Windows\System\seDedfr.exe
  2⤵
  PID:3624
- C:\Windows\System\YiIaZRr.exe
  C:\Windows\System\YiIaZRr.exe
  2⤵
  PID:3688
- C:\Windows\System\FLYAzVn.exe
  C:\Windows\System\FLYAzVn.exe
  2⤵
  PID:3752
- C:\Windows\System\SVUcuMm.exe
  C:\Windows\System\SVUcuMm.exe
  2⤵
  PID:3852
- C:\Windows\System\kGuxGBx.exe
  C:\Windows\System\kGuxGBx.exe
  2⤵
  PID:4092
- C:\Windows\System\shyziCV.exe
  C:\Windows\System\shyziCV.exe
  2⤵
  PID:2788
- C:\Windows\System\vlshuMD.exe
  C:\Windows\System\vlshuMD.exe
  2⤵
  PID:4088
- C:\Windows\System\pHaJbiZ.exe
  C:\Windows\System\pHaJbiZ.exe
  2⤵
  PID:968
- C:\Windows\System\yhWzwpG.exe
  C:\Windows\System\yhWzwpG.exe
  2⤵
  PID:4104
- C:\Windows\System\HQcZoGt.exe
  C:\Windows\System\HQcZoGt.exe
  2⤵
  PID:4124
- C:\Windows\System\gwotYiB.exe
  C:\Windows\System\gwotYiB.exe
  2⤵
  PID:4140
- C:\Windows\System\cYjnuKt.exe
  C:\Windows\System\cYjnuKt.exe
  2⤵
  PID:4156
- C:\Windows\System\mIUpRIQ.exe
  C:\Windows\System\mIUpRIQ.exe
  2⤵
  PID:4172
- C:\Windows\System\aHLTgtM.exe
  C:\Windows\System\aHLTgtM.exe
  2⤵
  PID:4188
- C:\Windows\System\ikfuKDt.exe
  C:\Windows\System\ikfuKDt.exe
  2⤵
  PID:4204
- C:\Windows\System\BXQPNZL.exe
  C:\Windows\System\BXQPNZL.exe
  2⤵
  PID:4396
- C:\Windows\System\dJNoJGd.exe
  C:\Windows\System\dJNoJGd.exe
  2⤵
  PID:4412
- C:\Windows\System\QdTEiZi.exe
  C:\Windows\System\QdTEiZi.exe
  2⤵
  PID:4432
- C:\Windows\System\juVWjAc.exe
  C:\Windows\System\juVWjAc.exe
  2⤵
  PID:4448
- C:\Windows\System\ipHfrke.exe
  C:\Windows\System\ipHfrke.exe
  2⤵
  PID:4464
- C:\Windows\System\FNetasC.exe
  C:\Windows\System\FNetasC.exe
  2⤵
  PID:4480
- C:\Windows\System\wKYqYZr.exe
  C:\Windows\System\wKYqYZr.exe
  2⤵
  PID:4496
- C:\Windows\System\jzSuoxf.exe
  C:\Windows\System\jzSuoxf.exe
  2⤵
  PID:4512
- C:\Windows\System\YSHKnHb.exe
  C:\Windows\System\YSHKnHb.exe
  2⤵
  PID:4532
- C:\Windows\System\FPPuuyE.exe
  C:\Windows\System\FPPuuyE.exe
  2⤵
  PID:4564
- C:\Windows\System\vKjyAGB.exe
  C:\Windows\System\vKjyAGB.exe
  2⤵
  PID:4644
- C:\Windows\System\djBhAvr.exe
  C:\Windows\System\djBhAvr.exe
  2⤵
  PID:4664
- C:\Windows\System\fwSwGKR.exe
  C:\Windows\System\fwSwGKR.exe
  2⤵
  PID:4680
- C:\Windows\System\tobMqHS.exe
  C:\Windows\System\tobMqHS.exe
  2⤵
  PID:4696
- C:\Windows\System\IBwrmih.exe
  C:\Windows\System\IBwrmih.exe
  2⤵
  PID:4712
- C:\Windows\System\HPNKIyN.exe
  C:\Windows\System\HPNKIyN.exe
  2⤵
  PID:4728
- C:\Windows\System\fsPNbvW.exe
  C:\Windows\System\fsPNbvW.exe
  2⤵
  PID:4744
- C:\Windows\System\TTjetkS.exe
  C:\Windows\System\TTjetkS.exe
  2⤵
  PID:4760
- C:\Windows\System\FhRwYiu.exe
  C:\Windows\System\FhRwYiu.exe
  2⤵
  PID:4776
- C:\Windows\System\WmjzsGB.exe
  C:\Windows\System\WmjzsGB.exe
  2⤵
  PID:4792
- C:\Windows\System\gVApCng.exe
  C:\Windows\System\gVApCng.exe
  2⤵
  PID:4808
- C:\Windows\System\UdwOSfS.exe
  C:\Windows\System\UdwOSfS.exe
  2⤵
  PID:4824
- C:\Windows\System\vRuJjSG.exe
  C:\Windows\System\vRuJjSG.exe
  2⤵
  PID:4840
- C:\Windows\System\OvNvZoL.exe
  C:\Windows\System\OvNvZoL.exe
  2⤵
  PID:4856
- C:\Windows\System\NfkQpJq.exe
  C:\Windows\System\NfkQpJq.exe
  2⤵
  PID:4872
- C:\Windows\System\qevTazN.exe
  C:\Windows\System\qevTazN.exe
  2⤵
  PID:4888
- C:\Windows\System\LTHmpuH.exe
  C:\Windows\System\LTHmpuH.exe
  2⤵
  PID:4904
- C:\Windows\System\HaCTQfo.exe
  C:\Windows\System\HaCTQfo.exe
  2⤵
  PID:4920
- C:\Windows\System\nmMNlUv.exe
  C:\Windows\System\nmMNlUv.exe
  2⤵
  PID:4936
- C:\Windows\System\EqzafUC.exe
  C:\Windows\System\EqzafUC.exe
  2⤵
  PID:4952
- C:\Windows\System\EWhyVhJ.exe
  C:\Windows\System\EWhyVhJ.exe
  2⤵
  PID:4968
- C:\Windows\System\EZctPEM.exe
  C:\Windows\System\EZctPEM.exe
  2⤵
  PID:4984
- C:\Windows\System\zBljYQW.exe
  C:\Windows\System\zBljYQW.exe
  2⤵
  PID:5000
- C:\Windows\System\OLkoFyS.exe
  C:\Windows\System\OLkoFyS.exe
  2⤵
  PID:5016
- C:\Windows\System\UplOusq.exe
  C:\Windows\System\UplOusq.exe
  2⤵
  PID:5032
- C:\Windows\System\dYplTEb.exe
  C:\Windows\System\dYplTEb.exe
  2⤵
  PID:5048
- C:\Windows\System\edqbwpv.exe
  C:\Windows\System\edqbwpv.exe
  2⤵
  PID:5064
- C:\Windows\System\FHkAlKG.exe
  C:\Windows\System\FHkAlKG.exe
  2⤵
  PID:5080
- C:\Windows\System\gtwvjPB.exe
  C:\Windows\System\gtwvjPB.exe
  2⤵
  PID:5096
- C:\Windows\System\jQqvllj.exe
  C:\Windows\System\jQqvllj.exe
  2⤵
  PID:5112
- C:\Windows\System\HLQZfDC.exe
  C:\Windows\System\HLQZfDC.exe
  2⤵
  PID:3252
- C:\Windows\System\cIpFyqT.exe
  C:\Windows\System\cIpFyqT.exe
  2⤵
  PID:3284
- C:\Windows\System\ZVAaijw.exe
  C:\Windows\System\ZVAaijw.exe
  2⤵
  PID:1388
- C:\Windows\System\VKlLbOP.exe
  C:\Windows\System\VKlLbOP.exe
  2⤵
  PID:4004
- C:\Windows\System\tLjqhnR.exe
  C:\Windows\System\tLjqhnR.exe
  2⤵
  PID:4056
- C:\Windows\System\AjRmmtf.exe
  C:\Windows\System\AjRmmtf.exe
  2⤵
  PID:1204
- C:\Windows\System\pohVXrm.exe
  C:\Windows\System\pohVXrm.exe
  2⤵
  PID:3124
- C:\Windows\System\UwnleoS.exe
  C:\Windows\System\UwnleoS.exe
  2⤵
  PID:3316
- C:\Windows\System\TSYtuwc.exe
  C:\Windows\System\TSYtuwc.exe
  2⤵
  PID:4268
- C:\Windows\System\RfTFJuS.exe
  C:\Windows\System\RfTFJuS.exe
  2⤵
  PID:3512
- C:\Windows\System\wDpgxYY.exe
  C:\Windows\System\wDpgxYY.exe
  2⤵
  PID:4292
- C:\Windows\System\qfWIXHn.exe
  C:\Windows\System\qfWIXHn.exe
  2⤵
  PID:4304
- C:\Windows\System\NQuDbUE.exe
  C:\Windows\System\NQuDbUE.exe
  2⤵
  PID:3192
- C:\Windows\System\bYbXiRQ.exe
  C:\Windows\System\bYbXiRQ.exe
  2⤵
  PID:1588
- C:\Windows\System\QdkchFh.exe
  C:\Windows\System\QdkchFh.exe
  2⤵
  PID:4328
- C:\Windows\System\blFoGWr.exe
  C:\Windows\System\blFoGWr.exe
  2⤵
  PID:3740
- C:\Windows\System\rnLSfGS.exe
  C:\Windows\System\rnLSfGS.exe
  2⤵
  PID:3460
- C:\Windows\System\PUMgygL.exe
  C:\Windows\System\PUMgygL.exe
  2⤵
  PID:4368
- C:\Windows\System\VqXvZIG.exe
  C:\Windows\System\VqXvZIG.exe
  2⤵
  PID:4388
- C:\Windows\System\GvlwHQQ.exe
  C:\Windows\System\GvlwHQQ.exe
  2⤵
  PID:4372
- C:\Windows\System\qnCWgbe.exe
  C:\Windows\System\qnCWgbe.exe
  2⤵
  PID:3720
- C:\Windows\System\hlTvkXt.exe
  C:\Windows\System\hlTvkXt.exe
  2⤵
  PID:4100
- C:\Windows\System\tGiUtVy.exe
  C:\Windows\System\tGiUtVy.exe
  2⤵
  PID:4200
- C:\Windows\System\dOoZDhg.exe
  C:\Windows\System\dOoZDhg.exe
  2⤵
  PID:2772
- C:\Windows\System\HzNtVEA.exe
  C:\Windows\System\HzNtVEA.exe
  2⤵
  PID:564
- C:\Windows\System\cncFHGP.exe
  C:\Windows\System\cncFHGP.exe
  2⤵
  PID:3292
- C:\Windows\System\bmoClHf.exe
  C:\Windows\System\bmoClHf.exe
  2⤵
  PID:3392
- C:\Windows\System\UJjJjPQ.exe
  C:\Windows\System\UJjJjPQ.exe
  2⤵
  PID:3444
- C:\Windows\System\caxgIJt.exe
  C:\Windows\System\caxgIJt.exe
  2⤵
  PID:3592
- C:\Windows\System\DosbKKl.exe
  C:\Windows\System\DosbKKl.exe
  2⤵
  PID:4444
- C:\Windows\System\TutFOxM.exe
  C:\Windows\System\TutFOxM.exe
  2⤵
  PID:4456
- C:\Windows\System\mbbISFX.exe
  C:\Windows\System\mbbISFX.exe
  2⤵
  PID:4544
- C:\Windows\System\UxvSoPX.exe
  C:\Windows\System\UxvSoPX.exe
  2⤵
  PID:4548
- C:\Windows\System\fywQlAY.exe
  C:\Windows\System\fywQlAY.exe
  2⤵
  PID:4632
- C:\Windows\System\dJfJFEi.exe
  C:\Windows\System\dJfJFEi.exe
  2⤵
  PID:4704
- C:\Windows\System\ntUlEnz.exe
  C:\Windows\System\ntUlEnz.exe
  2⤵
  PID:4768
- C:\Windows\System\gAFgPXN.exe
  C:\Windows\System\gAFgPXN.exe
  2⤵
  PID:4816
- C:\Windows\System\LAZujra.exe
  C:\Windows\System\LAZujra.exe
  2⤵
  PID:4848
- C:\Windows\System\iKHjRHw.exe
  C:\Windows\System\iKHjRHw.exe
  2⤵
  PID:4884
- C:\Windows\System\SnAutfW.exe
  C:\Windows\System\SnAutfW.exe
  2⤵
  PID:4832
- C:\Windows\System\mxZylfF.exe
  C:\Windows\System\mxZylfF.exe
  2⤵
  PID:5008
- C:\Windows\System\blUfgGm.exe
  C:\Windows\System\blUfgGm.exe
  2⤵
  PID:5076
- C:\Windows\System\onIcFga.exe
  C:\Windows\System\onIcFga.exe
  2⤵
  PID:4932
- C:\Windows\System\gdwDuEM.exe
  C:\Windows\System\gdwDuEM.exe
  2⤵
  PID:4868
- C:\Windows\System\DvhYBTy.exe
  C:\Windows\System\DvhYBTy.exe
  2⤵
  PID:5088
- C:\Windows\System\yVsauiD.exe
  C:\Windows\System\yVsauiD.exe
  2⤵
  PID:3432
- C:\Windows\System\KJwQlQI.exe
  C:\Windows\System\KJwQlQI.exe
  2⤵
  PID:4992
- C:\Windows\System\hlVksVa.exe
  C:\Windows\System\hlVksVa.exe
  2⤵
  PID:4864
- C:\Windows\System\RTJVjxj.exe
  C:\Windows\System\RTJVjxj.exe
  2⤵
  PID:3508
- C:\Windows\System\aPcfouZ.exe
  C:\Windows\System\aPcfouZ.exe
  2⤵
  PID:3788
- C:\Windows\System\yCLEkVE.exe
  C:\Windows\System\yCLEkVE.exe
  2⤵
  PID:1016
- C:\Windows\System\rqAgGHA.exe
  C:\Windows\System\rqAgGHA.exe
  2⤵
  PID:2664
- C:\Windows\System\EidlHrl.exe
  C:\Windows\System\EidlHrl.exe
  2⤵
  PID:4116
- C:\Windows\System\pfWdsgw.exe
  C:\Windows\System\pfWdsgw.exe
  2⤵
  PID:4220
- C:\Windows\System\UkuvPVD.exe
  C:\Windows\System\UkuvPVD.exe
  2⤵
  PID:1524
- C:\Windows\System\YgZdizF.exe
  C:\Windows\System\YgZdizF.exe
  2⤵
  PID:4240
- C:\Windows\System\IDkjRWW.exe
  C:\Windows\System\IDkjRWW.exe
  2⤵
  PID:3344
- C:\Windows\System\gqYmPYe.exe
  C:\Windows\System\gqYmPYe.exe
  2⤵
  PID:4272
- C:\Windows\System\esontFS.exe
  C:\Windows\System\esontFS.exe
  2⤵
  PID:4660
- C:\Windows\System\SJzkFHb.exe
  C:\Windows\System\SJzkFHb.exe
  2⤵
  PID:3524
- C:\Windows\System\odXwrmO.exe
  C:\Windows\System\odXwrmO.exe
  2⤵
  PID:4320
- C:\Windows\System\eQntUvI.exe
  C:\Windows\System\eQntUvI.exe
  2⤵
  PID:4332
- C:\Windows\System\RTxDwEj.exe
  C:\Windows\System\RTxDwEj.exe
  2⤵
  PID:4360
- C:\Windows\System\tqisgIe.exe
  C:\Windows\System\tqisgIe.exe
  2⤵
  PID:3220
- C:\Windows\System\BmkuaAb.exe
  C:\Windows\System\BmkuaAb.exe
  2⤵
  PID:1808
- C:\Windows\System\NKkzawi.exe
  C:\Windows\System\NKkzawi.exe
  2⤵
  PID:2920
- C:\Windows\System\EYcydVO.exe
  C:\Windows\System\EYcydVO.exe
  2⤵
  PID:3328
- C:\Windows\System\JlZAmAa.exe
  C:\Windows\System\JlZAmAa.exe
  2⤵
  PID:3908
- C:\Windows\System\DgSouGP.exe
  C:\Windows\System\DgSouGP.exe
  2⤵
  PID:3992
- C:\Windows\System\KvzUFGX.exe
  C:\Windows\System\KvzUFGX.exe
  2⤵
  PID:1640
- C:\Windows\System\TwzBUhh.exe
  C:\Windows\System\TwzBUhh.exe
  2⤵
  PID:4476
- C:\Windows\System\ggmCdLo.exe
  C:\Windows\System\ggmCdLo.exe
  2⤵
  PID:4580
- C:\Windows\System\IZgAgKj.exe
  C:\Windows\System\IZgAgKj.exe
  2⤵
  PID:4556
- C:\Windows\System\rRVIHSf.exe
  C:\Windows\System\rRVIHSf.exe
  2⤵
  PID:4592
- C:\Windows\System\ODOYmJH.exe
  C:\Windows\System\ODOYmJH.exe
  2⤵
  PID:4600
- C:\Windows\System\EVmYbhi.exe
  C:\Windows\System\EVmYbhi.exe
  2⤵
  PID:4588
- C:\Windows\System\dxJtrQu.exe
  C:\Windows\System\dxJtrQu.exe
  2⤵
  PID:4624
- C:\Windows\System\ZfhuKut.exe
  C:\Windows\System\ZfhuKut.exe
  2⤵
  PID:4692
- C:\Windows\System\ZOqVPtF.exe
  C:\Windows\System\ZOqVPtF.exe
  2⤵
  PID:4672
- C:\Windows\System\JRTPFSQ.exe
  C:\Windows\System\JRTPFSQ.exe
  2⤵
  PID:4676
- C:\Windows\System\RkwhejN.exe
  C:\Windows\System\RkwhejN.exe
  2⤵
  PID:4976
- C:\Windows\System\IcXJWHD.exe
  C:\Windows\System\IcXJWHD.exe
  2⤵
  PID:5104
- C:\Windows\System\GFyiTlb.exe
  C:\Windows\System\GFyiTlb.exe
  2⤵
  PID:4980
- C:\Windows\System\cUsbVjG.exe
  C:\Windows\System\cUsbVjG.exe
  2⤵
  PID:4076
- C:\Windows\System\JDfEdUt.exe
  C:\Windows\System\JDfEdUt.exe
  2⤵
  PID:3416
- C:\Windows\System\DGBykkz.exe
  C:\Windows\System\DGBykkz.exe
  2⤵
  PID:2296
- C:\Windows\System\VPOzPJw.exe
  C:\Windows\System\VPOzPJw.exe
  2⤵
  PID:4288
- C:\Windows\System\WtWJUde.exe
  C:\Windows\System\WtWJUde.exe
  2⤵
  PID:2504
- C:\Windows\System\Xaupuqn.exe
  C:\Windows\System\Xaupuqn.exe
  2⤵
  PID:5072
- C:\Windows\System\YXuVFWt.exe
  C:\Windows\System\YXuVFWt.exe
  2⤵
  PID:4040
- C:\Windows\System\cbkmKCL.exe
  C:\Windows\System\cbkmKCL.exe
  2⤵
  PID:4148
- C:\Windows\System\FRozKmc.exe
  C:\Windows\System\FRozKmc.exe
  2⤵
  PID:3464
- C:\Windows\System\fyBtcmY.exe
  C:\Windows\System\fyBtcmY.exe
  2⤵
  PID:4132
- C:\Windows\System\vDyKFCq.exe
  C:\Windows\System\vDyKFCq.exe
  2⤵
  PID:1188
- C:\Windows\System\qNzrqUY.exe
  C:\Windows\System\qNzrqUY.exe
  2⤵
  PID:4168
- C:\Windows\System\nftwRUx.exe
  C:\Windows\System\nftwRUx.exe
  2⤵
  PID:4604
- C:\Windows\System\HZHIuCF.exe
  C:\Windows\System\HZHIuCF.exe
  2⤵
  PID:4752
- C:\Windows\System\xPCKPWG.exe
  C:\Windows\System\xPCKPWG.exe
  2⤵
  PID:4880
- C:\Windows\System\ltbhfkt.exe
  C:\Windows\System\ltbhfkt.exe
  2⤵
  PID:4356
- C:\Windows\System\lOIfSIH.exe
  C:\Windows\System\lOIfSIH.exe
  2⤵
  PID:3236
- C:\Windows\System\EOtUDAp.exe
  C:\Windows\System\EOtUDAp.exe
  2⤵
  PID:3280
- C:\Windows\System\ywDItSr.exe
  C:\Windows\System\ywDItSr.exe
  2⤵
  PID:3672
- C:\Windows\System\xaAWowL.exe
  C:\Windows\System\xaAWowL.exe
  2⤵
  PID:4504
- C:\Windows\System\fCawCXt.exe
  C:\Windows\System\fCawCXt.exe
  2⤵
  PID:4252
- C:\Windows\System\jicHLlm.exe
  C:\Windows\System\jicHLlm.exe
  2⤵
  PID:3476
- C:\Windows\System\HQOfqku.exe
  C:\Windows\System\HQOfqku.exe
  2⤵
  PID:4488
- C:\Windows\System\uOqaawv.exe
  C:\Windows\System\uOqaawv.exe
  2⤵
  PID:4652
- C:\Windows\System\iWHKqGb.exe
  C:\Windows\System\iWHKqGb.exe
  2⤵
  PID:4784
- C:\Windows\System\jfHVCjw.exe
  C:\Windows\System\jfHVCjw.exe
  2⤵
  PID:4112
- C:\Windows\System\HKPsLCz.exe
  C:\Windows\System\HKPsLCz.exe
  2⤵
  PID:4340
- C:\Windows\System\hfHSiZS.exe
  C:\Windows\System\hfHSiZS.exe
  2⤵
  PID:5040
- C:\Windows\System\XfEllgG.exe
  C:\Windows\System\XfEllgG.exe
  2⤵
  PID:3628
- C:\Windows\System\rwWUpnK.exe
  C:\Windows\System\rwWUpnK.exe
  2⤵
  PID:4256
- C:\Windows\System\MHCnORd.exe
  C:\Windows\System\MHCnORd.exe
  2⤵
  PID:4540
- C:\Windows\System\UYOcIbT.exe
  C:\Windows\System\UYOcIbT.exe
  2⤵
  PID:5044
- C:\Windows\System\AUkcbIc.exe
  C:\Windows\System\AUkcbIc.exe
  2⤵
  PID:4724
- C:\Windows\System\JHaVbWT.exe
  C:\Windows\System\JHaVbWT.exe
  2⤵
  PID:3088
- C:\Windows\System\dIZRaun.exe
  C:\Windows\System\dIZRaun.exe
  2⤵
  PID:2124
- C:\Windows\System\goFivVV.exe
  C:\Windows\System\goFivVV.exe
  2⤵
  PID:4944
- C:\Windows\System\HGqNZIH.exe
  C:\Windows\System\HGqNZIH.exe
  2⤵
  PID:4196
- C:\Windows\System\QQWlSnL.exe
  C:\Windows\System\QQWlSnL.exe
  2⤵
  PID:5132
- C:\Windows\System\mkuooKq.exe
  C:\Windows\System\mkuooKq.exe
  2⤵
  PID:5156
- C:\Windows\System\GSOdKDw.exe
  C:\Windows\System\GSOdKDw.exe
  2⤵
  PID:5172
- C:\Windows\System\LhKCJPy.exe
  C:\Windows\System\LhKCJPy.exe
  2⤵
  PID:5188
- C:\Windows\System\wwWAETt.exe
  C:\Windows\System\wwWAETt.exe
  2⤵
  PID:5208
- C:\Windows\System\aVHqArk.exe
  C:\Windows\System\aVHqArk.exe
  2⤵
  PID:5224
- C:\Windows\System\TasTIeJ.exe
  C:\Windows\System\TasTIeJ.exe
  2⤵
  PID:5240
- C:\Windows\System\dBVubWe.exe
  C:\Windows\System\dBVubWe.exe
  2⤵
  PID:5256
- C:\Windows\System\RSkgLMx.exe
  C:\Windows\System\RSkgLMx.exe
  2⤵
  PID:5272
- C:\Windows\System\APJspmp.exe
  C:\Windows\System\APJspmp.exe
  2⤵
  PID:5288
- C:\Windows\System\OoEfpSq.exe
  C:\Windows\System\OoEfpSq.exe
  2⤵
  PID:5308
- C:\Windows\System\SDOTIDA.exe
  C:\Windows\System\SDOTIDA.exe
  2⤵
  PID:5324
- C:\Windows\System\HjvVxJF.exe
  C:\Windows\System\HjvVxJF.exe
  2⤵
  PID:5340
- C:\Windows\System\vzsXhOC.exe
  C:\Windows\System\vzsXhOC.exe
  2⤵
  PID:5356
- C:\Windows\System\jPqnsaH.exe
  C:\Windows\System\jPqnsaH.exe
  2⤵
  PID:5372
- C:\Windows\System\rfXMxcY.exe
  C:\Windows\System\rfXMxcY.exe
  2⤵
  PID:5388
- C:\Windows\System\BFMAKze.exe
  C:\Windows\System\BFMAKze.exe
  2⤵
  PID:5408
- C:\Windows\System\JeYJEml.exe
  C:\Windows\System\JeYJEml.exe
  2⤵
  PID:5424
- C:\Windows\System\YMiwwxr.exe
  C:\Windows\System\YMiwwxr.exe
  2⤵
  PID:5440
- C:\Windows\System\jhMOgjY.exe
  C:\Windows\System\jhMOgjY.exe
  2⤵
  PID:5456
- C:\Windows\System\SEiGqFU.exe
  C:\Windows\System\SEiGqFU.exe
  2⤵
  PID:5472
- C:\Windows\System\VOKmwuj.exe
  C:\Windows\System\VOKmwuj.exe
  2⤵
  PID:5488
- C:\Windows\System\jpDoPMh.exe
  C:\Windows\System\jpDoPMh.exe
  2⤵
  PID:5508
- C:\Windows\System\mRgbWUf.exe
  C:\Windows\System\mRgbWUf.exe
  2⤵
  PID:5524
- C:\Windows\System\hYwwXWJ.exe
  C:\Windows\System\hYwwXWJ.exe
  2⤵
  PID:5540
- C:\Windows\System\tbJYxXK.exe
  C:\Windows\System\tbJYxXK.exe
  2⤵
  PID:5556
- C:\Windows\System\FLRmFjP.exe
  C:\Windows\System\FLRmFjP.exe
  2⤵
  PID:5612
- C:\Windows\System\fjJFdJs.exe
  C:\Windows\System\fjJFdJs.exe
  2⤵
  PID:5628
- C:\Windows\System\EWCIthF.exe
  C:\Windows\System\EWCIthF.exe
  2⤵
  PID:5652
- C:\Windows\System\gPMPorf.exe
  C:\Windows\System\gPMPorf.exe
  2⤵
  PID:5668
- C:\Windows\System\lugSxde.exe
  C:\Windows\System\lugSxde.exe
  2⤵
  PID:5684
- C:\Windows\System\WcGCGjR.exe
  C:\Windows\System\WcGCGjR.exe
  2⤵
  PID:5700
- C:\Windows\System\qRqtAJz.exe
  C:\Windows\System\qRqtAJz.exe
  2⤵
  PID:5720
- C:\Windows\System\dJwIsmm.exe
  C:\Windows\System\dJwIsmm.exe
  2⤵
  PID:5736
- C:\Windows\System\UjsGbQf.exe
  C:\Windows\System\UjsGbQf.exe
  2⤵
  PID:5752
- C:\Windows\System\aQiEANr.exe
  C:\Windows\System\aQiEANr.exe
  2⤵
  PID:5768
- C:\Windows\System\rAaZXgu.exe
  C:\Windows\System\rAaZXgu.exe
  2⤵
  PID:5784
- C:\Windows\System\KxvWKIN.exe
  C:\Windows\System\KxvWKIN.exe
  2⤵
  PID:5800
- C:\Windows\System\KqzFlIv.exe
  C:\Windows\System\KqzFlIv.exe
  2⤵
  PID:5816
- C:\Windows\System\bXONBIp.exe
  C:\Windows\System\bXONBIp.exe
  2⤵
  PID:5836
- C:\Windows\System\kZWyIjQ.exe
  C:\Windows\System\kZWyIjQ.exe
  2⤵
  PID:5852
- C:\Windows\System\XGBSoYh.exe
  C:\Windows\System\XGBSoYh.exe
  2⤵
  PID:5868
- C:\Windows\System\Qgrjhla.exe
  C:\Windows\System\Qgrjhla.exe
  2⤵
  PID:5884
- C:\Windows\System\sUWFLQP.exe
  C:\Windows\System\sUWFLQP.exe
  2⤵
  PID:5900
- C:\Windows\System\yabDNtw.exe
  C:\Windows\System\yabDNtw.exe
  2⤵
  PID:5916
- C:\Windows\System\hIsoDyD.exe
  C:\Windows\System\hIsoDyD.exe
  2⤵
  PID:5932
- C:\Windows\System\trWIpCZ.exe
  C:\Windows\System\trWIpCZ.exe
  2⤵
  PID:5948
- C:\Windows\System\DCXKUFG.exe
  C:\Windows\System\DCXKUFG.exe
  2⤵
  PID:5964
- C:\Windows\System\eAuqCdw.exe
  C:\Windows\System\eAuqCdw.exe
  2⤵
  PID:5988
- C:\Windows\System\nCGqbeB.exe
  C:\Windows\System\nCGqbeB.exe
  2⤵
  PID:6004
- C:\Windows\System\TdMxQbv.exe
  C:\Windows\System\TdMxQbv.exe
  2⤵
  PID:6044
- C:\Windows\System\ptgMxJV.exe
  C:\Windows\System\ptgMxJV.exe
  2⤵
  PID:6060
- C:\Windows\System\YpbGroG.exe
  C:\Windows\System\YpbGroG.exe
  2⤵
  PID:6076
- C:\Windows\System\fvyqcVw.exe
  C:\Windows\System\fvyqcVw.exe
  2⤵
  PID:6092
- C:\Windows\System\hUgHqTU.exe
  C:\Windows\System\hUgHqTU.exe
  2⤵
  PID:6108
- C:\Windows\System\DmTcBtQ.exe
  C:\Windows\System\DmTcBtQ.exe
  2⤵
  PID:6124
- C:\Windows\System\pBegIMf.exe
  C:\Windows\System\pBegIMf.exe
  2⤵
  PID:6140
- C:\Windows\System\BJSDmow.exe
  C:\Windows\System\BJSDmow.exe
  2⤵
  PID:4948
- C:\Windows\System\NDQhsSz.exe
  C:\Windows\System\NDQhsSz.exe
  2⤵
  PID:4016
- C:\Windows\System\JEaQvYg.exe
  C:\Windows\System\JEaQvYg.exe
  2⤵
  PID:1536
- C:\Windows\System\qTanzFQ.exe
  C:\Windows\System\qTanzFQ.exe
  2⤵
  PID:5124
- C:\Windows\System\nVfGArP.exe
  C:\Windows\System\nVfGArP.exe
  2⤵
  PID:5168
- C:\Windows\System\BBqZNhS.exe
  C:\Windows\System\BBqZNhS.exe
  2⤵
  PID:5232
- C:\Windows\System\stbbFQv.exe
  C:\Windows\System\stbbFQv.exe
  2⤵
  PID:5296
- C:\Windows\System\aGYsYlu.exe
  C:\Windows\System\aGYsYlu.exe
  2⤵
  PID:5336
- C:\Windows\System\MjBhbAp.exe
  C:\Windows\System\MjBhbAp.exe
  2⤵
  PID:5400
- C:\Windows\System\SpQgTYA.exe
  C:\Windows\System\SpQgTYA.exe
  2⤵
  PID:5464
- C:\Windows\System\hyTXbCe.exe
  C:\Windows\System\hyTXbCe.exe
  2⤵
  PID:5504
- C:\Windows\System\wBCMkUQ.exe
  C:\Windows\System\wBCMkUQ.exe
  2⤵
  PID:4800
- C:\Windows\System\sZihlQm.exe
  C:\Windows\System\sZihlQm.exe
  2⤵
  PID:4736
- C:\Windows\System\RURhWDC.exe
  C:\Windows\System\RURhWDC.exe
  2⤵
  PID:4384
- C:\Windows\System\MrwhDSd.exe
  C:\Windows\System\MrwhDSd.exe
  2⤵
  PID:3596
- C:\Windows\System\ASLTPuW.exe
  C:\Windows\System\ASLTPuW.exe
  2⤵
  PID:4552
- C:\Windows\System\bxDErdT.exe
  C:\Windows\System\bxDErdT.exe
  2⤵
  PID:5140
- C:\Windows\System\CPgRypY.exe
  C:\Windows\System\CPgRypY.exe
  2⤵
  PID:5180
- C:\Windows\System\XKlHMJF.exe
  C:\Windows\System\XKlHMJF.exe
  2⤵
  PID:5248
- C:\Windows\System\OBKNfsa.exe
  C:\Windows\System\OBKNfsa.exe
  2⤵
  PID:5316
- C:\Windows\System\jranSIO.exe
  C:\Windows\System\jranSIO.exe
  2⤵
  PID:5380
- C:\Windows\System\jfjMqbJ.exe
  C:\Windows\System\jfjMqbJ.exe
  2⤵
  PID:5448
- C:\Windows\System\YTRvNCt.exe
  C:\Windows\System\YTRvNCt.exe
  2⤵
  PID:5516
- C:\Windows\System\YMsppKv.exe
  C:\Windows\System\YMsppKv.exe
  2⤵
  PID:5584
- C:\Windows\System\YpVekKu.exe
  C:\Windows\System\YpVekKu.exe
  2⤵
  PID:5600
- C:\Windows\System\kRGpuWx.exe
  C:\Windows\System\kRGpuWx.exe
  2⤵
  PID:5576
- C:\Windows\System\CvLoFCW.exe
  C:\Windows\System\CvLoFCW.exe
  2⤵
  PID:5636
- C:\Windows\System\LGhScpd.exe
  C:\Windows\System\LGhScpd.exe
  2⤵
  PID:5676
- C:\Windows\System\YBPvpkb.exe
  C:\Windows\System\YBPvpkb.exe
  2⤵
  PID:5708
- C:\Windows\System\FrZPukF.exe
  C:\Windows\System\FrZPukF.exe
  2⤵
  PID:5696
- C:\Windows\System\qVVxbYU.exe
  C:\Windows\System\qVVxbYU.exe
  2⤵
  PID:5764
- C:\Windows\System\LZchsYG.exe
  C:\Windows\System\LZchsYG.exe
  2⤵
  PID:5828
- C:\Windows\System\AMIzySa.exe
  C:\Windows\System\AMIzySa.exe
  2⤵
  PID:5860
- C:\Windows\System\TCPPrQD.exe
  C:\Windows\System\TCPPrQD.exe
  2⤵
  PID:5744
- C:\Windows\System\GwPaUQR.exe
  C:\Windows\System\GwPaUQR.exe
  2⤵
  PID:5808
- C:\Windows\System\APOsUWg.exe
  C:\Windows\System\APOsUWg.exe
  2⤵
  PID:5876
- C:\Windows\System\oYKRctA.exe
  C:\Windows\System\oYKRctA.exe
  2⤵
  PID:5940
- C:\Windows\System\PfTxhaz.exe
  C:\Windows\System\PfTxhaz.exe
  2⤵
  PID:5944
- C:\Windows\System\hDnhgLJ.exe
  C:\Windows\System\hDnhgLJ.exe
  2⤵
  PID:5996
- C:\Windows\System\IZheaPg.exe
  C:\Windows\System\IZheaPg.exe
  2⤵
  PID:6020
- C:\Windows\System\WVRGnur.exe
  C:\Windows\System\WVRGnur.exe
  2⤵
  PID:6040
- C:\Windows\System\HwcwIMm.exe
  C:\Windows\System\HwcwIMm.exe
  2⤵
  PID:5204
- C:\Windows\System\lEuZslW.exe
  C:\Windows\System\lEuZslW.exe
  2⤵
  PID:5436
- C:\Windows\System\DDZlcFR.exe
  C:\Windows\System\DDZlcFR.exe
  2⤵
  PID:6104
- C:\Windows\System\oELwzVR.exe
  C:\Windows\System\oELwzVR.exe
  2⤵
  PID:4364
- C:\Windows\System\nlglrcr.exe
  C:\Windows\System\nlglrcr.exe
  2⤵
  PID:4996
- C:\Windows\System\BTSqZLq.exe
  C:\Windows\System\BTSqZLq.exe
  2⤵
  PID:5144
- C:\Windows\System\BJdyYKV.exe
  C:\Windows\System\BJdyYKV.exe
  2⤵
  PID:5416
- C:\Windows\System\jjvVTbz.exe
  C:\Windows\System\jjvVTbz.exe
  2⤵
  PID:5568
- C:\Windows\System\FEylAKA.exe
  C:\Windows\System\FEylAKA.exe
  2⤵
  PID:5692
- C:\Windows\System\cNuRKNu.exe
  C:\Windows\System\cNuRKNu.exe
  2⤵
  PID:5896
- C:\Windows\System\QgHAuSf.exe
  C:\Windows\System\QgHAuSf.exe
  2⤵
  PID:5980
- C:\Windows\System\GoJlmZf.exe
  C:\Windows\System\GoJlmZf.exe
  2⤵
  PID:6120
- C:\Windows\System\RHGtdXX.exe
  C:\Windows\System\RHGtdXX.exe
  2⤵
  PID:5268
- C:\Windows\System\ROcarwc.exe
  C:\Windows\System\ROcarwc.exe
  2⤵
  PID:5216
- C:\Windows\System\NCHVxHA.exe
  C:\Windows\System\NCHVxHA.exe
  2⤵
  PID:5760
- C:\Windows\System\IWYoaMU.exe
  C:\Windows\System\IWYoaMU.exe
  2⤵
  PID:3660
- C:\Windows\System\WYONHLf.exe
  C:\Windows\System\WYONHLf.exe
  2⤵
  PID:5500
- C:\Windows\System\cWOefHb.exe
  C:\Windows\System\cWOefHb.exe
  2⤵
  PID:6088
- C:\Windows\System\GyNCtQL.exe
  C:\Windows\System\GyNCtQL.exe
  2⤵
  PID:5368
- C:\Windows\System\xoRyHOr.exe
  C:\Windows\System\xoRyHOr.exe
  2⤵
  PID:5348
- C:\Windows\System\WWLPIsl.exe
  C:\Windows\System\WWLPIsl.exe
  2⤵
  PID:5596
- C:\Windows\System\iEtcXlX.exe
  C:\Windows\System\iEtcXlX.exe
  2⤵
  PID:5732
- C:\Windows\System\oiqhHrq.exe
  C:\Windows\System\oiqhHrq.exe
  2⤵
  PID:5200
- C:\Windows\System\ERsRtcz.exe
  C:\Windows\System\ERsRtcz.exe
  2⤵
  PID:6028
- C:\Windows\System\oyvjdkt.exe
  C:\Windows\System\oyvjdkt.exe
  2⤵
  PID:5564
- C:\Windows\System\bylmphz.exe
  C:\Windows\System\bylmphz.exe
  2⤵
  PID:5648
- C:\Windows\System\IxTRMUl.exe
  C:\Windows\System\IxTRMUl.exe
  2⤵
  PID:5264
- C:\Windows\System\bbRMHZd.exe
  C:\Windows\System\bbRMHZd.exe
  2⤵
  PID:5396
- C:\Windows\System\aKsavOv.exe
  C:\Windows\System\aKsavOv.exe
  2⤵
  PID:5592
- C:\Windows\System\RNDmWBo.exe
  C:\Windows\System\RNDmWBo.exe
  2⤵
  PID:5824
- C:\Windows\System\DjSgmmS.exe
  C:\Windows\System\DjSgmmS.exe
  2⤵
  PID:4244
- C:\Windows\System\YAXdEPY.exe
  C:\Windows\System\YAXdEPY.exe
  2⤵
  PID:6136
- C:\Windows\System\YMJtxEt.exe
  C:\Windows\System\YMJtxEt.exe
  2⤵
  PID:4912
- C:\Windows\System\wGRHpyV.exe
  C:\Windows\System\wGRHpyV.exe
  2⤵
  PID:4428
- C:\Windows\System\kEsviym.exe
  C:\Windows\System\kEsviym.exe
  2⤵
  PID:5960
- C:\Windows\System\RCcZPrR.exe
  C:\Windows\System\RCcZPrR.exe
  2⤵
  PID:4164
- C:\Windows\System\AZDTbVA.exe
  C:\Windows\System\AZDTbVA.exe
  2⤵
  PID:3312
- C:\Windows\System\GFmBoQB.exe
  C:\Windows\System\GFmBoQB.exe
  2⤵
  PID:5792
- C:\Windows\System\OelXtzk.exe
  C:\Windows\System\OelXtzk.exe
  2⤵
  PID:5164
- C:\Windows\System\rVDzjrp.exe
  C:\Windows\System\rVDzjrp.exe
  2⤵
  PID:6148
- C:\Windows\System\lHDIHyr.exe
  C:\Windows\System\lHDIHyr.exe
  2⤵
  PID:6164
- C:\Windows\System\tItFHIC.exe
  C:\Windows\System\tItFHIC.exe
  2⤵
  PID:6184
- C:\Windows\System\XAKUnjn.exe
  C:\Windows\System\XAKUnjn.exe
  2⤵
  PID:6200
- C:\Windows\System\azaZrUP.exe
  C:\Windows\System\azaZrUP.exe
  2⤵
  PID:6216
- C:\Windows\System\TyilHZz.exe
  C:\Windows\System\TyilHZz.exe
  2⤵
  PID:6236
- C:\Windows\System\gEKXajQ.exe
  C:\Windows\System\gEKXajQ.exe
  2⤵
  PID:6252
- C:\Windows\System\pAjDZgq.exe
  C:\Windows\System\pAjDZgq.exe
  2⤵
  PID:6268
- C:\Windows\System\QmshTfb.exe
  C:\Windows\System\QmshTfb.exe
  2⤵
  PID:6288
- C:\Windows\System\aWpsZyV.exe
  C:\Windows\System\aWpsZyV.exe
  2⤵
  PID:6304
- C:\Windows\System\ZrMNEMU.exe
  C:\Windows\System\ZrMNEMU.exe
  2⤵
  PID:6320
- C:\Windows\System\MlJKsOS.exe
  C:\Windows\System\MlJKsOS.exe
  2⤵
  PID:6336
- C:\Windows\System\xgTeoIM.exe
  C:\Windows\System\xgTeoIM.exe
  2⤵
  PID:6352
- C:\Windows\System\cKkscAE.exe
  C:\Windows\System\cKkscAE.exe
  2⤵
  PID:6368
- C:\Windows\System\wWdXhvW.exe
  C:\Windows\System\wWdXhvW.exe
  2⤵
  PID:6384
- C:\Windows\System\sagmdYy.exe
  C:\Windows\System\sagmdYy.exe
  2⤵
  PID:6400
- C:\Windows\System\mPMNuiV.exe
  C:\Windows\System\mPMNuiV.exe
  2⤵
  PID:6416
- C:\Windows\System\UBluLCi.exe
  C:\Windows\System\UBluLCi.exe
  2⤵
  PID:6432
- C:\Windows\System\GLvquPi.exe
  C:\Windows\System\GLvquPi.exe
  2⤵
  PID:6448
- C:\Windows\System\ceUUFbm.exe
  C:\Windows\System\ceUUFbm.exe
  2⤵
  PID:6464
- C:\Windows\System\CVbbGcn.exe
  C:\Windows\System\CVbbGcn.exe
  2⤵
  PID:6480
- C:\Windows\System\QakmPmc.exe
  C:\Windows\System\QakmPmc.exe
  2⤵
  PID:6496
- C:\Windows\System\LOnwTZY.exe
  C:\Windows\System\LOnwTZY.exe
  2⤵
  PID:6512
- C:\Windows\System\sJldVOg.exe
  C:\Windows\System\sJldVOg.exe
  2⤵
  PID:6584
- C:\Windows\System\fgTYMWM.exe
  C:\Windows\System\fgTYMWM.exe
  2⤵
  PID:6600
- C:\Windows\System\ktLzCCi.exe
  C:\Windows\System\ktLzCCi.exe
  2⤵
  PID:6616
- C:\Windows\System\bLPRSEZ.exe
  C:\Windows\System\bLPRSEZ.exe
  2⤵
  PID:6632
- C:\Windows\System\IxaPzLz.exe
  C:\Windows\System\IxaPzLz.exe
  2⤵
  PID:6648
- C:\Windows\System\YXkCIrD.exe
  C:\Windows\System\YXkCIrD.exe
  2⤵
  PID:6664
- C:\Windows\System\ISzwjLi.exe
  C:\Windows\System\ISzwjLi.exe
  2⤵
  PID:6680
- C:\Windows\System\CMCxmkl.exe
  C:\Windows\System\CMCxmkl.exe
  2⤵
  PID:6696
- C:\Windows\System\wJAXrQw.exe
  C:\Windows\System\wJAXrQw.exe
  2⤵
  PID:6712
- C:\Windows\System\TTSUYhZ.exe
  C:\Windows\System\TTSUYhZ.exe
  2⤵
  PID:6732
- C:\Windows\System\GYpFvUA.exe
  C:\Windows\System\GYpFvUA.exe
  2⤵
  PID:6748
- C:\Windows\System\APftdyx.exe
  C:\Windows\System\APftdyx.exe
  2⤵
  PID:6764
- C:\Windows\System\DBMJiLx.exe
  C:\Windows\System\DBMJiLx.exe
  2⤵
  PID:6780
- C:\Windows\System\qENrZSa.exe
  C:\Windows\System\qENrZSa.exe
  2⤵
  PID:6796
- C:\Windows\System\iIPZHBl.exe
  C:\Windows\System\iIPZHBl.exe
  2⤵
  PID:6812
- C:\Windows\System\OjJTCmT.exe
  C:\Windows\System\OjJTCmT.exe
  2⤵
  PID:6828
- C:\Windows\System\qTpeRcm.exe
  C:\Windows\System\qTpeRcm.exe
  2⤵
  PID:6844
- C:\Windows\System\acIVnaq.exe
  C:\Windows\System\acIVnaq.exe
  2⤵
  PID:6860
- C:\Windows\System\EnXWCGe.exe
  C:\Windows\System\EnXWCGe.exe
  2⤵
  PID:6876
- C:\Windows\System\ZypqnmN.exe
  C:\Windows\System\ZypqnmN.exe
  2⤵
  PID:6892
- C:\Windows\System\QkklXBc.exe
  C:\Windows\System\QkklXBc.exe
  2⤵
  PID:6908
- C:\Windows\System\ihrbxNn.exe
  C:\Windows\System\ihrbxNn.exe
  2⤵
  PID:6924
- C:\Windows\System\PLMapOq.exe
  C:\Windows\System\PLMapOq.exe
  2⤵
  PID:6940
- C:\Windows\System\IeTBpCg.exe
  C:\Windows\System\IeTBpCg.exe
  2⤵
  PID:6956
- C:\Windows\System\TvFXnTW.exe
  C:\Windows\System\TvFXnTW.exe
  2⤵
  PID:6972
- C:\Windows\System\TTMqKnG.exe
  C:\Windows\System\TTMqKnG.exe
  2⤵
  PID:6988
- C:\Windows\System\qEgCfbo.exe
  C:\Windows\System\qEgCfbo.exe
  2⤵
  PID:7004
- C:\Windows\System\ViFYWyC.exe
  C:\Windows\System\ViFYWyC.exe
  2⤵
  PID:7020
- C:\Windows\System\jxRRNzB.exe
  C:\Windows\System\jxRRNzB.exe
  2⤵
  PID:7036
- C:\Windows\System\TUSHPCx.exe
  C:\Windows\System\TUSHPCx.exe
  2⤵
  PID:7052
- C:\Windows\System\dIkHHrk.exe
  C:\Windows\System\dIkHHrk.exe
  2⤵
  PID:7068
- C:\Windows\System\rszKPor.exe
  C:\Windows\System\rszKPor.exe
  2⤵
  PID:7084
- C:\Windows\System\uFXtiBk.exe
  C:\Windows\System\uFXtiBk.exe
  2⤵
  PID:7100
- C:\Windows\System\oMpIFlK.exe
  C:\Windows\System\oMpIFlK.exe
  2⤵
  PID:7116
- C:\Windows\System\csmuLNg.exe
  C:\Windows\System\csmuLNg.exe
  2⤵
  PID:7132
- C:\Windows\System\bQOedRj.exe
  C:\Windows\System\bQOedRj.exe
  2⤵
  PID:7148
- C:\Windows\System\lNAFjcX.exe
  C:\Windows\System\lNAFjcX.exe
  2⤵
  PID:7164
- C:\Windows\System\EIWrZhi.exe
  C:\Windows\System\EIWrZhi.exe
  2⤵
  PID:6192
- C:\Windows\System\vTboOnQ.exe
  C:\Windows\System\vTboOnQ.exe
  2⤵
  PID:5284
- C:\Windows\System\ScczFUa.exe
  C:\Windows\System\ScczFUa.exe
  2⤵
  PID:6264
- C:\Windows\System\WOsRjVb.exe
  C:\Windows\System\WOsRjVb.exe
  2⤵
  PID:5432
- C:\Windows\System\fMZZGeP.exe
  C:\Windows\System\fMZZGeP.exe
  2⤵
  PID:6172
- C:\Windows\System\LHRUdmw.exe
  C:\Windows\System\LHRUdmw.exe
  2⤵
  PID:5332
- C:\Windows\System\UkLSQTz.exe
  C:\Windows\System\UkLSQTz.exe
  2⤵
  PID:5848
- C:\Windows\System\MKQHSbX.exe
  C:\Windows\System\MKQHSbX.exe
  2⤵
  PID:6300
- C:\Windows\System\HUDPBKP.exe
  C:\Windows\System\HUDPBKP.exe
  2⤵
  PID:6284
- C:\Windows\System\ljCgvPN.exe
  C:\Windows\System\ljCgvPN.exe
  2⤵
  PID:6360
- C:\Windows\System\mMXVDCF.exe
  C:\Windows\System\mMXVDCF.exe
  2⤵
  PID:6424
- C:\Windows\System\OcXrenv.exe
  C:\Windows\System\OcXrenv.exe
  2⤵
  PID:6348
- C:\Windows\System\UVsYkTv.exe
  C:\Windows\System\UVsYkTv.exe
  2⤵
  PID:6472
- C:\Windows\System\nHgrJoS.exe
  C:\Windows\System\nHgrJoS.exe
  2⤵
  PID:6528
- C:\Windows\System\SxOxtzO.exe
  C:\Windows\System\SxOxtzO.exe
  2⤵
  PID:6544
- C:\Windows\System\DnzEyan.exe
  C:\Windows\System\DnzEyan.exe
  2⤵
  PID:6560
- C:\Windows\System\qPXJvSw.exe
  C:\Windows\System\qPXJvSw.exe
  2⤵
  PID:6580
- C:\Windows\System\IQOZEQK.exe
  C:\Windows\System\IQOZEQK.exe
  2⤵
  PID:6720
- C:\Windows\System\dqpXnTy.exe
  C:\Windows\System\dqpXnTy.exe
  2⤵
  PID:6772
- C:\Windows\System\kbPFHGT.exe
  C:\Windows\System\kbPFHGT.exe
  2⤵
  PID:6760
- C:\Windows\System\WgGWotb.exe
  C:\Windows\System\WgGWotb.exe
  2⤵
  PID:6836
- C:\Windows\System\DkXRHPK.exe
  C:\Windows\System\DkXRHPK.exe
  2⤵
  PID:6936
- C:\Windows\System\HgYpiaj.exe
  C:\Windows\System\HgYpiaj.exe
  2⤵
  PID:6964
- C:\Windows\System\BbPqUlV.exe
  C:\Windows\System\BbPqUlV.exe
  2⤵
  PID:7000
- C:\Windows\System\qTFvAOM.exe
  C:\Windows\System\qTFvAOM.exe
  2⤵
  PID:6332
- C:\Windows\System\vzvudLw.exe
  C:\Windows\System\vzvudLw.exe
  2⤵
  PID:6344
- C:\Windows\System\vVixvqY.exe
  C:\Windows\System\vVixvqY.exe
  2⤵
  PID:6656
- C:\Windows\System\blYAZIt.exe
  C:\Windows\System\blYAZIt.exe
  2⤵
  PID:6872
- C:\Windows\System\axWokvg.exe
  C:\Windows\System\axWokvg.exe
  2⤵
  PID:6296
- C:\Windows\System\YLGjdfL.exe
  C:\Windows\System\YLGjdfL.exe
  2⤵
  PID:5776
- C:\Windows\System\nQybHUD.exe
  C:\Windows\System\nQybHUD.exe
  2⤵
  PID:7156
- C:\Windows\System\hlQEZks.exe
  C:\Windows\System\hlQEZks.exe
  2⤵
  PID:6444
- C:\Windows\System\njgCvkT.exe
  C:\Windows\System\njgCvkT.exe
  2⤵
  PID:6212
- C:\Windows\System\GeQPmTc.exe
  C:\Windows\System\GeQPmTc.exe
  2⤵
  PID:6520
- C:\Windows\System\GEihkzB.exe
  C:\Windows\System\GEihkzB.exe
  2⤵
  PID:6244
- C:\Windows\System\RBCRsXd.exe
  C:\Windows\System\RBCRsXd.exe
  2⤵
  PID:7160
- C:\Windows\System\rMGmxMu.exe
  C:\Windows\System\rMGmxMu.exe
  2⤵
  PID:6948
- C:\Windows\System\AMkyDku.exe
  C:\Windows\System\AMkyDku.exe
  2⤵
  PID:7012
- C:\Windows\System\JQOoRnn.exe
  C:\Windows\System\JQOoRnn.exe
  2⤵
  PID:7076
- C:\Windows\System\yjfVMdX.exe
  C:\Windows\System\yjfVMdX.exe
  2⤵
  PID:7144
- C:\Windows\System\MBuqVCW.exe
  C:\Windows\System\MBuqVCW.exe
  2⤵
  PID:6532
- C:\Windows\System\AkekYWC.exe
  C:\Windows\System\AkekYWC.exe
  2⤵
  PID:6740
- C:\Windows\System\iLuhiyt.exe
  C:\Windows\System\iLuhiyt.exe
  2⤵
  PID:7028
- C:\Windows\System\dtFsyKF.exe
  C:\Windows\System\dtFsyKF.exe
  2⤵
  PID:6316
- C:\Windows\System\ZEJGcNY.exe
  C:\Windows\System\ZEJGcNY.exe
  2⤵
  PID:6440
- C:\Windows\System\QWkAOnm.exe
  C:\Windows\System\QWkAOnm.exe
  2⤵
  PID:7096
- C:\Windows\System\ZTzqmpu.exe
  C:\Windows\System\ZTzqmpu.exe
  2⤵
  PID:6328
- C:\Windows\System\uVQvCKQ.exe
  C:\Windows\System\uVQvCKQ.exe
  2⤵
  PID:6868
- C:\Windows\System\pOBtRmV.exe
  C:\Windows\System\pOBtRmV.exe
  2⤵
  PID:6808
- C:\Windows\System\VSyNQwe.exe
  C:\Windows\System\VSyNQwe.exe
  2⤵
  PID:6856
- C:\Windows\System\UtRgjCn.exe
  C:\Windows\System\UtRgjCn.exe
  2⤵
  PID:6968
- C:\Windows\System\AcQTDyM.exe
  C:\Windows\System\AcQTDyM.exe
  2⤵
  PID:6888
- C:\Windows\System\jvZvCPI.exe
  C:\Windows\System\jvZvCPI.exe
  2⤵
  PID:7140
- C:\Windows\System\KnaeRRl.exe
  C:\Windows\System\KnaeRRl.exe
  2⤵
  PID:2588
- C:\Windows\System\UtswtDw.exe
  C:\Windows\System\UtswtDw.exe
  2⤵
  PID:6756
- C:\Windows\System\jnFVYTh.exe
  C:\Windows\System\jnFVYTh.exe
  2⤵
  PID:6884
- C:\Windows\System\lmzzzsL.exe
  C:\Windows\System\lmzzzsL.exe
  2⤵
  PID:7176
- C:\Windows\System\bAxLVHQ.exe
  C:\Windows\System\bAxLVHQ.exe
  2⤵
  PID:7192
- C:\Windows\System\xjeDhGQ.exe
  C:\Windows\System\xjeDhGQ.exe
  2⤵
  PID:7208
- C:\Windows\System\BbHveCk.exe
  C:\Windows\System\BbHveCk.exe
  2⤵
  PID:7224
- C:\Windows\System\Mmeisrs.exe
  C:\Windows\System\Mmeisrs.exe
  2⤵
  PID:7240
- C:\Windows\System\XbDAqYA.exe
  C:\Windows\System\XbDAqYA.exe
  2⤵
  PID:7256
- C:\Windows\System\fvrYXhJ.exe
  C:\Windows\System\fvrYXhJ.exe
  2⤵
  PID:7272
- C:\Windows\System\nsdmnBB.exe
  C:\Windows\System\nsdmnBB.exe
  2⤵
  PID:7288
- C:\Windows\System\DpAFbls.exe
  C:\Windows\System\DpAFbls.exe
  2⤵
  PID:7304
- C:\Windows\System\PjBAVph.exe
  C:\Windows\System\PjBAVph.exe
  2⤵
  PID:7320
- C:\Windows\System\JmmRPWd.exe
  C:\Windows\System\JmmRPWd.exe
  2⤵
  PID:7336
- C:\Windows\System\dCuEahk.exe
  C:\Windows\System\dCuEahk.exe
  2⤵
  PID:7352
- C:\Windows\System\wJFmAoI.exe
  C:\Windows\System\wJFmAoI.exe
  2⤵
  PID:7368
- C:\Windows\System\PnIKvHy.exe
  C:\Windows\System\PnIKvHy.exe
  2⤵
  PID:7384
- C:\Windows\System\Tmzjoar.exe
  C:\Windows\System\Tmzjoar.exe
  2⤵
  PID:7400
- C:\Windows\System\VdcZcqj.exe
  C:\Windows\System\VdcZcqj.exe
  2⤵
  PID:7416
- C:\Windows\System\KUiXruA.exe
  C:\Windows\System\KUiXruA.exe
  2⤵
  PID:7436
- C:\Windows\System\PhsLdkq.exe
  C:\Windows\System\PhsLdkq.exe
  2⤵
  PID:7452
- C:\Windows\System\nwPvpPL.exe
  C:\Windows\System\nwPvpPL.exe
  2⤵
  PID:7468
- C:\Windows\System\AcBbjQZ.exe
  C:\Windows\System\AcBbjQZ.exe
  2⤵
  PID:7484
- C:\Windows\System\FOqurET.exe
  C:\Windows\System\FOqurET.exe
  2⤵
  PID:7500
- C:\Windows\System\ndCwVzZ.exe
  C:\Windows\System\ndCwVzZ.exe
  2⤵
  PID:7516
- C:\Windows\System\fyeQROf.exe
  C:\Windows\System\fyeQROf.exe
  2⤵
  PID:7532
- C:\Windows\System\yqzWzzL.exe
  C:\Windows\System\yqzWzzL.exe
  2⤵
  PID:7548
- C:\Windows\System\UCfuPqh.exe
  C:\Windows\System\UCfuPqh.exe
  2⤵
  PID:7564
- C:\Windows\System\gkkVnEl.exe
  C:\Windows\System\gkkVnEl.exe
  2⤵
  PID:7580
- C:\Windows\System\pDQQyqE.exe
  C:\Windows\System\pDQQyqE.exe
  2⤵
  PID:7596
- C:\Windows\System\joWZuCt.exe
  C:\Windows\System\joWZuCt.exe
  2⤵
  PID:7612
- C:\Windows\System\CrGCyhp.exe
  C:\Windows\System\CrGCyhp.exe
  2⤵
  PID:7628
- C:\Windows\System\hjoKruc.exe
  C:\Windows\System\hjoKruc.exe
  2⤵
  PID:7644
- C:\Windows\System\ckTPVZz.exe
  C:\Windows\System\ckTPVZz.exe
  2⤵
  PID:7660
- C:\Windows\System\PSozrSW.exe
  C:\Windows\System\PSozrSW.exe
  2⤵
  PID:7676
- C:\Windows\System\ygFguqm.exe
  C:\Windows\System\ygFguqm.exe
  2⤵
  PID:7692
- C:\Windows\System\SzDGwcI.exe
  C:\Windows\System\SzDGwcI.exe
  2⤵
  PID:7708
- C:\Windows\System\VdaOTNB.exe
  C:\Windows\System\VdaOTNB.exe
  2⤵
  PID:7724
- C:\Windows\System\cNCJVsz.exe
  C:\Windows\System\cNCJVsz.exe
  2⤵
  PID:7740
- C:\Windows\System\srwEujs.exe
  C:\Windows\System\srwEujs.exe
  2⤵
  PID:7756
- C:\Windows\System\eERcchz.exe
  C:\Windows\System\eERcchz.exe
  2⤵
  PID:7772
- C:\Windows\System\nHmlrcB.exe
  C:\Windows\System\nHmlrcB.exe
  2⤵
  PID:7788
- C:\Windows\System\DwQpmaB.exe
  C:\Windows\System\DwQpmaB.exe
  2⤵
  PID:7804
- C:\Windows\System\kqbHinA.exe
  C:\Windows\System\kqbHinA.exe
  2⤵
  PID:7820
- C:\Windows\System\UXWdHcG.exe
  C:\Windows\System\UXWdHcG.exe
  2⤵
  PID:7836
- C:\Windows\System\sViquIz.exe
  C:\Windows\System\sViquIz.exe
  2⤵
  PID:7852
- C:\Windows\System\ZNQUVwH.exe
  C:\Windows\System\ZNQUVwH.exe
  2⤵
  PID:7868
- C:\Windows\System\pUAzvDX.exe
  C:\Windows\System\pUAzvDX.exe
  2⤵
  PID:7884
- C:\Windows\System\yYGQAmd.exe
  C:\Windows\System\yYGQAmd.exe
  2⤵
  PID:7900
- C:\Windows\System\OTLSpsu.exe
  C:\Windows\System\OTLSpsu.exe
  2⤵
  PID:7916
- C:\Windows\System\SonVBmF.exe
  C:\Windows\System\SonVBmF.exe
  2⤵
  PID:7932
- C:\Windows\System\VtJCuTA.exe
  C:\Windows\System\VtJCuTA.exe
  2⤵
  PID:7952
- C:\Windows\System\GCzObUr.exe
  C:\Windows\System\GCzObUr.exe
  2⤵
  PID:7968
- C:\Windows\System\dfCYCRn.exe
  C:\Windows\System\dfCYCRn.exe
  2⤵
  PID:7984
- C:\Windows\System\TnGXvOe.exe
  C:\Windows\System\TnGXvOe.exe
  2⤵
  PID:8000
- C:\Windows\System\sHHRnXy.exe
  C:\Windows\System\sHHRnXy.exe
  2⤵
  PID:8016
- C:\Windows\System\XiADyec.exe
  C:\Windows\System\XiADyec.exe
  2⤵
  PID:8032
- C:\Windows\System\jySwUfb.exe
  C:\Windows\System\jySwUfb.exe
  2⤵
  PID:8048
- C:\Windows\System\FfTFZWk.exe
  C:\Windows\System\FfTFZWk.exe
  2⤵
  PID:8064
- C:\Windows\System\vTqMdmJ.exe
  C:\Windows\System\vTqMdmJ.exe
  2⤵
  PID:8080
- C:\Windows\System\kHRmWGW.exe
  C:\Windows\System\kHRmWGW.exe
  2⤵
  PID:8096
- C:\Windows\System\rgCnTjg.exe
  C:\Windows\System\rgCnTjg.exe
  2⤵
  PID:8112
- C:\Windows\System\EtPHoDr.exe
  C:\Windows\System\EtPHoDr.exe
  2⤵
  PID:8128
- C:\Windows\System\vdDikPO.exe
  C:\Windows\System\vdDikPO.exe
  2⤵
  PID:8144
- C:\Windows\System\VXLrIpE.exe
  C:\Windows\System\VXLrIpE.exe
  2⤵
  PID:8160
- C:\Windows\System\IxbkMsm.exe
  C:\Windows\System\IxbkMsm.exe
  2⤵
  PID:8176
- C:\Windows\System\zDPEZiJ.exe
  C:\Windows\System\zDPEZiJ.exe
  2⤵
  PID:6016
- C:\Windows\System\xPUZMhi.exe
  C:\Windows\System\xPUZMhi.exe
  2⤵
  PID:7216
- C:\Windows\System\jzcaGoY.exe
  C:\Windows\System\jzcaGoY.exe
  2⤵
  PID:7280
- C:\Windows\System\ZPVWIGG.exe
  C:\Windows\System\ZPVWIGG.exe
  2⤵
  PID:6116
- C:\Windows\System\BhUaKRy.exe
  C:\Windows\System\BhUaKRy.exe
  2⤵
  PID:5620
- C:\Windows\System\KVUDBee.exe
  C:\Windows\System\KVUDBee.exe
  2⤵
  PID:6524
- C:\Windows\System\BGvkSGa.exe
  C:\Windows\System\BGvkSGa.exe
  2⤵
  PID:6916
- C:\Windows\System\ApLKgpH.exe
  C:\Windows\System\ApLKgpH.exe
  2⤵
  PID:7048
- C:\Windows\System\GRUqNTt.exe
  C:\Windows\System\GRUqNTt.exe
  2⤵
  PID:6488
- C:\Windows\System\zupIWqA.exe
  C:\Windows\System\zupIWqA.exe
  2⤵
  PID:7232
- C:\Windows\System\wmgQZLl.exe
  C:\Windows\System\wmgQZLl.exe
  2⤵
  PID:7268
- C:\Windows\System\PBrxROe.exe
  C:\Windows\System\PBrxROe.exe
  2⤵
  PID:7344
- C:\Windows\System\ieznpcj.exe
  C:\Windows\System\ieznpcj.exe
  2⤵
  PID:7380
- C:\Windows\System\FXqbsfd.exe
  C:\Windows\System\FXqbsfd.exe
  2⤵
  PID:7412
- C:\Windows\System\ijCUSum.exe
  C:\Windows\System\ijCUSum.exe
  2⤵
  PID:7392
- C:\Windows\System\XisCbVX.exe
  C:\Windows\System\XisCbVX.exe
  2⤵
  PID:7448
- C:\Windows\System\gfxhECf.exe
  C:\Windows\System\gfxhECf.exe
  2⤵
  PID:7512
- C:\Windows\System\wZyoOkK.exe
  C:\Windows\System\wZyoOkK.exe
  2⤵
  PID:7540
- C:\Windows\System\xKsZqCG.exe
  C:\Windows\System\xKsZqCG.exe
  2⤵
  PID:7640
- C:\Windows\System\jJzHgjb.exe
  C:\Windows\System\jJzHgjb.exe
  2⤵
  PID:7700
- C:\Windows\System\GojpoYd.exe
  C:\Windows\System\GojpoYd.exe
  2⤵
  PID:7764
- C:\Windows\System\CRVzKca.exe
  C:\Windows\System\CRVzKca.exe
  2⤵
  PID:7464
- C:\Windows\System\FaxeGlu.exe
  C:\Windows\System\FaxeGlu.exe
  2⤵
  PID:7796
- C:\Windows\System\McQiIdH.exe
  C:\Windows\System\McQiIdH.exe
  2⤵
  PID:7752
- C:\Windows\System\dcsXzYf.exe
  C:\Windows\System\dcsXzYf.exe
  2⤵
  PID:7780
- C:\Windows\System\OWmrvQD.exe
  C:\Windows\System\OWmrvQD.exe
  2⤵
  PID:7656
- C:\Windows\System\dmJAIYH.exe
  C:\Windows\System\dmJAIYH.exe
  2⤵
  PID:7748
- C:\Windows\System\ncbaxjL.exe
  C:\Windows\System\ncbaxjL.exe
  2⤵
  PID:7816
- C:\Windows\System\YKUqCUK.exe
  C:\Windows\System\YKUqCUK.exe
  2⤵
  PID:7848
- C:\Windows\System\bNsxOBf.exe
  C:\Windows\System\bNsxOBf.exe
  2⤵
  PID:7880
- C:\Windows\System\RCRsADo.exe
  C:\Windows\System\RCRsADo.exe
  2⤵
  PID:7912
- C:\Windows\System\eNgsOkz.exe
  C:\Windows\System\eNgsOkz.exe
  2⤵
  PID:7948
- C:\Windows\System\aTXoEQw.exe
  C:\Windows\System\aTXoEQw.exe
  2⤵
  PID:7996
- C:\Windows\System\wGaixTy.exe
  C:\Windows\System\wGaixTy.exe
  2⤵
  PID:8056
- C:\Windows\System\aUVdrRk.exe
  C:\Windows\System\aUVdrRk.exe
  2⤵
  PID:8120
- C:\Windows\System\jcotsdA.exe
  C:\Windows\System\jcotsdA.exe
  2⤵
  PID:8188
- C:\Windows\System\EtYDaqf.exe
  C:\Windows\System\EtYDaqf.exe
  2⤵
  PID:7252
- C:\Windows\System\UQTrPsT.exe
  C:\Windows\System\UQTrPsT.exe
  2⤵
  PID:8040
- C:\Windows\System\DlzysCk.exe
  C:\Windows\System\DlzysCk.exe
  2⤵
  PID:8172
- C:\Windows\System\QgMuegP.exe
  C:\Windows\System\QgMuegP.exe
  2⤵
  PID:6792
- C:\Windows\System\qMyAGIC.exe
  C:\Windows\System\qMyAGIC.exe
  2⤵
  PID:8044
- C:\Windows\System\UhaVRMb.exe
  C:\Windows\System\UhaVRMb.exe
  2⤵
  PID:6552
- C:\Windows\System\XTiFfUo.exe
  C:\Windows\System\XTiFfUo.exe
  2⤵
  PID:7112
- C:\Windows\System\ZSRlwDz.exe
  C:\Windows\System\ZSRlwDz.exe
  2⤵
  PID:6852
- C:\Windows\System\IRhZmQm.exe
  C:\Windows\System\IRhZmQm.exe
  2⤵
  PID:7348
- C:\Windows\System\OmMHBuk.exe
  C:\Windows\System\OmMHBuk.exe
  2⤵
  PID:7364
- C:\Windows\System\CAUHJfi.exe
  C:\Windows\System\CAUHJfi.exe
  2⤵
  PID:7328
- C:\Windows\System\wIFHbJX.exe
  C:\Windows\System\wIFHbJX.exe
  2⤵
  PID:7360
- C:\Windows\System\GftvdYL.exe
  C:\Windows\System\GftvdYL.exe
  2⤵
  PID:7608
- C:\Windows\System\pGtwvyb.exe
  C:\Windows\System\pGtwvyb.exe
  2⤵
  PID:7672
- C:\Windows\System\hiVgCWI.exe
  C:\Windows\System\hiVgCWI.exe
  2⤵
  PID:7560
- C:\Windows\System\lwWYblI.exe
  C:\Windows\System\lwWYblI.exe
  2⤵
  PID:7556
- C:\Windows\System\cpyThBt.exe
  C:\Windows\System\cpyThBt.exe
  2⤵
  PID:7624
- C:\Windows\System\DXzYMqU.exe
  C:\Windows\System\DXzYMqU.exe
  2⤵
  PID:6412
- C:\Windows\System\VVMIAPT.exe
  C:\Windows\System\VVMIAPT.exe
  2⤵
  PID:7964
- C:\Windows\System\NQKGMyz.exe
  C:\Windows\System\NQKGMyz.exe
  2⤵
  PID:7876
- C:\Windows\System\ZQzpyjo.exe
  C:\Windows\System\ZQzpyjo.exe
  2⤵
  PID:8024
- C:\Windows\System\slbUuXq.exe
  C:\Windows\System\slbUuXq.exe
  2⤵
  PID:7248
- C:\Windows\System\nufXrtK.exe
  C:\Windows\System\nufXrtK.exe
  2⤵
  PID:6260
- C:\Windows\System\ZTrIODy.exe
  C:\Windows\System\ZTrIODy.exe
  2⤵
  PID:8012
- C:\Windows\System\eGdtqbc.exe
  C:\Windows\System\eGdtqbc.exe
  2⤵
  PID:6232
- C:\Windows\System\gavRVfM.exe
  C:\Windows\System\gavRVfM.exe
  2⤵
  PID:7376
- C:\Windows\System\DGkBELQ.exe
  C:\Windows\System\DGkBELQ.exe
  2⤵
  PID:7200
- C:\Windows\System\oUBrMlY.exe
  C:\Windows\System\oUBrMlY.exe
  2⤵
  PID:7524
- C:\Windows\System\oBneayk.exe
  C:\Windows\System\oBneayk.exe
  2⤵
  PID:7864
- C:\Windows\System\ZhwgiYj.exe
  C:\Windows\System\ZhwgiYj.exe
  2⤵
  PID:7444
- C:\Windows\System\PrJlCNT.exe
  C:\Windows\System\PrJlCNT.exe
  2⤵
  PID:1516
- C:\Windows\System\rWAJPEK.exe
  C:\Windows\System\rWAJPEK.exe
  2⤵
  PID:7896
- C:\Windows\System\xTMXvGx.exe
  C:\Windows\System\xTMXvGx.exe
  2⤵
  PID:7980
- C:\Windows\System\ALAgOhr.exe
  C:\Windows\System\ALAgOhr.exe
  2⤵
  PID:7652
- C:\Windows\System\tOzFSJS.exe
  C:\Windows\System\tOzFSJS.exe
  2⤵
  PID:7528
- C:\Windows\System\leYKcts.exe
  C:\Windows\System\leYKcts.exe
  2⤵
  PID:7604
- C:\Windows\System\NwcBuVG.exe
  C:\Windows\System\NwcBuVG.exe
  2⤵
  PID:7924
- C:\Windows\System\fYWBuye.exe
  C:\Windows\System\fYWBuye.exe
  2⤵
  PID:6208
- C:\Windows\System\ZikadlE.exe
  C:\Windows\System\ZikadlE.exe
  2⤵
  PID:7736
- C:\Windows\System\nEEOgkg.exe
  C:\Windows\System\nEEOgkg.exe
  2⤵
  PID:8208
- C:\Windows\System\qPZMBRo.exe
  C:\Windows\System\qPZMBRo.exe
  2⤵
  PID:8224
- C:\Windows\System\ksIqPWN.exe
  C:\Windows\System\ksIqPWN.exe
  2⤵
  PID:8240
- C:\Windows\System\PLgAKYM.exe
  C:\Windows\System\PLgAKYM.exe
  2⤵
  PID:8256
- C:\Windows\System\bADtdtX.exe
  C:\Windows\System\bADtdtX.exe
  2⤵
  PID:8272
- C:\Windows\System\OnExPNG.exe
  C:\Windows\System\OnExPNG.exe
  2⤵
  PID:8288
- C:\Windows\System\tmVaCpe.exe
  C:\Windows\System\tmVaCpe.exe
  2⤵
  PID:8304
- C:\Windows\System\opxKCoz.exe
  C:\Windows\System\opxKCoz.exe
  2⤵
  PID:8320
- C:\Windows\System\FhnrMEs.exe
  C:\Windows\System\FhnrMEs.exe
  2⤵
  PID:8336
- C:\Windows\System\WsZrjiy.exe
  C:\Windows\System\WsZrjiy.exe
  2⤵
  PID:8352
- C:\Windows\System\MfiXbRe.exe
  C:\Windows\System\MfiXbRe.exe
  2⤵
  PID:8368
- C:\Windows\System\uEqxrqk.exe
  C:\Windows\System\uEqxrqk.exe
  2⤵
  PID:8384
- C:\Windows\System\XJwUSwQ.exe
  C:\Windows\System\XJwUSwQ.exe
  2⤵
  PID:8400
- C:\Windows\System\JADPuJC.exe
  C:\Windows\System\JADPuJC.exe
  2⤵
  PID:8416
- C:\Windows\System\WFlmwVn.exe
  C:\Windows\System\WFlmwVn.exe
  2⤵
  PID:8432
- C:\Windows\System\eazKQQY.exe
  C:\Windows\System\eazKQQY.exe
  2⤵
  PID:8448
- C:\Windows\System\kRiJipQ.exe
  C:\Windows\System\kRiJipQ.exe
  2⤵
  PID:8464
- C:\Windows\System\jnCIusb.exe
  C:\Windows\System\jnCIusb.exe
  2⤵
  PID:8480
- C:\Windows\System\YITLYpE.exe
  C:\Windows\System\YITLYpE.exe
  2⤵
  PID:8496
- C:\Windows\System\gxajiaB.exe
  C:\Windows\System\gxajiaB.exe
  2⤵
  PID:8512
- C:\Windows\System\phWxyYW.exe
  C:\Windows\System\phWxyYW.exe
  2⤵
  PID:8528
- C:\Windows\System\hmDfTeN.exe
  C:\Windows\System\hmDfTeN.exe
  2⤵
  PID:8544
- C:\Windows\System\IIGlxPg.exe
  C:\Windows\System\IIGlxPg.exe
  2⤵
  PID:8560
- C:\Windows\System\GIZWceP.exe
  C:\Windows\System\GIZWceP.exe
  2⤵
  PID:8576
- C:\Windows\System\nELNJwV.exe
  C:\Windows\System\nELNJwV.exe
  2⤵
  PID:8592
- C:\Windows\System\LheqPvR.exe
  C:\Windows\System\LheqPvR.exe
  2⤵
  PID:8608
- C:\Windows\System\gLTVWZq.exe
  C:\Windows\System\gLTVWZq.exe
  2⤵
  PID:8628
- C:\Windows\System\rXgtNUi.exe
  C:\Windows\System\rXgtNUi.exe
  2⤵
  PID:8644
- C:\Windows\System\ZXAybAU.exe
  C:\Windows\System\ZXAybAU.exe
  2⤵
  PID:8660
- C:\Windows\System\FOhLQSq.exe
  C:\Windows\System\FOhLQSq.exe
  2⤵
  PID:8676
- C:\Windows\System\bFBoJXY.exe
  C:\Windows\System\bFBoJXY.exe
  2⤵
  PID:8696
- C:\Windows\System\icPVeYC.exe
  C:\Windows\System\icPVeYC.exe
  2⤵
  PID:8712
- C:\Windows\System\RzAkUtE.exe
  C:\Windows\System\RzAkUtE.exe
  2⤵
  PID:8728
- C:\Windows\System\VOSORSD.exe
  C:\Windows\System\VOSORSD.exe
  2⤵
  PID:8744
- C:\Windows\System\hCamBZQ.exe
  C:\Windows\System\hCamBZQ.exe
  2⤵
  PID:8760
- C:\Windows\System\tpdPLOk.exe
  C:\Windows\System\tpdPLOk.exe
  2⤵
  PID:8776
- C:\Windows\System\vUELofl.exe
  C:\Windows\System\vUELofl.exe
  2⤵
  PID:8792
- C:\Windows\System\YMZMLKQ.exe
  C:\Windows\System\YMZMLKQ.exe
  2⤵
  PID:8816
- C:\Windows\System\HfkqRMU.exe
  C:\Windows\System\HfkqRMU.exe
  2⤵
  PID:8860
- C:\Windows\System\csVImoY.exe
  C:\Windows\System\csVImoY.exe
  2⤵
  PID:8876
- C:\Windows\System\FJVdRna.exe
  C:\Windows\System\FJVdRna.exe
  2⤵
  PID:8892
- C:\Windows\System\QsaFECN.exe
  C:\Windows\System\QsaFECN.exe
  2⤵
  PID:8908
- C:\Windows\System\sNFadtp.exe
  C:\Windows\System\sNFadtp.exe
  2⤵
  PID:8924
- C:\Windows\System\ddIJFCQ.exe
  C:\Windows\System\ddIJFCQ.exe
  2⤵
  PID:8940
- C:\Windows\System\jwwLGic.exe
  C:\Windows\System\jwwLGic.exe
  2⤵
  PID:8956
- C:\Windows\System\GrxxWYT.exe
  C:\Windows\System\GrxxWYT.exe
  2⤵
  PID:8972
- C:\Windows\System\nTAebmZ.exe
  C:\Windows\System\nTAebmZ.exe
  2⤵
  PID:8988
- C:\Windows\System\ffeWrHl.exe
  C:\Windows\System\ffeWrHl.exe
  2⤵
  PID:9004
- C:\Windows\System\ZWsBbZd.exe
  C:\Windows\System\ZWsBbZd.exe
  2⤵
  PID:9020
- C:\Windows\System\fMrwdcb.exe
  C:\Windows\System\fMrwdcb.exe
  2⤵
  PID:9036
- C:\Windows\System\KINbFfp.exe
  C:\Windows\System\KINbFfp.exe
  2⤵
  PID:9056
- C:\Windows\System\cVwdwHm.exe
  C:\Windows\System\cVwdwHm.exe
  2⤵
  PID:9072
- C:\Windows\System\ZRYpsTJ.exe
  C:\Windows\System\ZRYpsTJ.exe
  2⤵
  PID:9088
- C:\Windows\System\tOojwiT.exe
  C:\Windows\System\tOojwiT.exe
  2⤵
  PID:9104
- C:\Windows\System\HLULslB.exe
  C:\Windows\System\HLULslB.exe
  2⤵
  PID:9120
- C:\Windows\System\DSTWRzS.exe
  C:\Windows\System\DSTWRzS.exe
  2⤵
  PID:9136
- C:\Windows\System\lGuuXsA.exe
  C:\Windows\System\lGuuXsA.exe
  2⤵
  PID:9188
- C:\Windows\System\DSXVNJF.exe
  C:\Windows\System\DSXVNJF.exe
  2⤵
  PID:9204
- C:\Windows\System\CTxHRYc.exe
  C:\Windows\System\CTxHRYc.exe
  2⤵
  PID:8220
- C:\Windows\System\ohjbTvX.exe
  C:\Windows\System\ohjbTvX.exe
  2⤵
  PID:8280
- C:\Windows\System\ecmaLlN.exe
  C:\Windows\System\ecmaLlN.exe
  2⤵
  PID:8344
- C:\Windows\System\QKWHlHC.exe
  C:\Windows\System\QKWHlHC.exe
  2⤵
  PID:8408
- C:\Windows\System\Vpvjjgl.exe
  C:\Windows\System\Vpvjjgl.exe
  2⤵
  PID:8264
- C:\Windows\System\ThHTPcQ.exe
  C:\Windows\System\ThHTPcQ.exe
  2⤵
  PID:8364
- C:\Windows\System\yjUokBo.exe
  C:\Windows\System\yjUokBo.exe
  2⤵
  PID:6380
- C:\Windows\System\lDBiZXO.exe
  C:\Windows\System\lDBiZXO.exe
  2⤵
  PID:8072
- C:\Windows\System\uHtxYNR.exe
  C:\Windows\System\uHtxYNR.exe
  2⤵
  PID:8460
- C:\Windows\System\DwBkSkz.exe
  C:\Windows\System\DwBkSkz.exe
  2⤵
  PID:8300
- C:\Windows\System\MwAnNYi.exe
  C:\Windows\System\MwAnNYi.exe
  2⤵
  PID:8396
- C:\Windows\System\eVlcRtF.exe
  C:\Windows\System\eVlcRtF.exe
  2⤵
  PID:8492
- C:\Windows\System\JOUlenc.exe
  C:\Windows\System\JOUlenc.exe
  2⤵
  PID:8572
- C:\Windows\System\UXjakTX.exe
  C:\Windows\System\UXjakTX.exe
  2⤵
  PID:8636
- C:\Windows\System\meSNUTn.exe
  C:\Windows\System\meSNUTn.exe
  2⤵
  PID:8704
- C:\Windows\System\lIvDdyB.exe
  C:\Windows\System\lIvDdyB.exe
  2⤵
  PID:8620
- C:\Windows\System\DnBnyGw.exe
  C:\Windows\System\DnBnyGw.exe
  2⤵
  PID:8584
- C:\Windows\System\SFIRNsv.exe
  C:\Windows\System\SFIRNsv.exe
  2⤵
  PID:8740
- C:\Windows\System\ewdEOPL.exe
  C:\Windows\System\ewdEOPL.exe
  2⤵
  PID:8772
- C:\Windows\System\quPqfiF.exe
  C:\Windows\System\quPqfiF.exe
  2⤵
  PID:8784
- C:\Windows\System\QBEmqUZ.exe
  C:\Windows\System\QBEmqUZ.exe
  2⤵
  PID:8812
- C:\Windows\System\wEDbXpt.exe
  C:\Windows\System\wEDbXpt.exe
  2⤵
  PID:8828
- C:\Windows\System\QepFnOi.exe
  C:\Windows\System\QepFnOi.exe
  2⤵
  PID:8848
- C:\Windows\System\uJwLbSP.exe
  C:\Windows\System\uJwLbSP.exe
  2⤵
  PID:8872
- C:\Windows\System\CuDlRVx.exe
  C:\Windows\System\CuDlRVx.exe
  2⤵
  PID:8884
- C:\Windows\System\SZCvUzP.exe
  C:\Windows\System\SZCvUzP.exe
  2⤵
  PID:8964
- C:\Windows\System\EnqsRbd.exe
  C:\Windows\System\EnqsRbd.exe
  2⤵
  PID:8916
- C:\Windows\System\MUhGhnS.exe
  C:\Windows\System\MUhGhnS.exe
  2⤵
  PID:9012
- C:\Windows\System\vKaaqpr.exe
  C:\Windows\System\vKaaqpr.exe
  2⤵
  PID:9016
- C:\Windows\System\zlGnMDS.exe
  C:\Windows\System\zlGnMDS.exe
  2⤵
  PID:9052
- C:\Windows\System\VoRGXlf.exe
  C:\Windows\System\VoRGXlf.exe
  2⤵
  PID:9100
- C:\Windows\System\wNUCFZR.exe
  C:\Windows\System\wNUCFZR.exe
  2⤵
  PID:9112
- C:\Windows\System\RUFOViN.exe
  C:\Windows\System\RUFOViN.exe
  2⤵
  PID:9156
- C:\Windows\System\ZRSaKFO.exe
  C:\Windows\System\ZRSaKFO.exe
  2⤵
  PID:9176
- C:\Windows\System\nIiCjUx.exe
  C:\Windows\System\nIiCjUx.exe
  2⤵
  PID:8332
- C:\Windows\System\BTShVMu.exe
  C:\Windows\System\BTShVMu.exe
  2⤵
  PID:8736
- C:\Windows\System\wZXsmYW.exe
  C:\Windows\System\wZXsmYW.exe
  2⤵
  PID:8684
- C:\Windows\System\HwekbJX.exe
  C:\Windows\System\HwekbJX.exe
  2⤵
  PID:8756
- C:\Windows\System\XwaocIT.exe
  C:\Windows\System\XwaocIT.exe
  2⤵
  PID:8720
- C:\Windows\System\lOHFTSC.exe
  C:\Windows\System\lOHFTSC.exe
  2⤵
  PID:8800
- C:\Windows\System\cEZgYYo.exe
  C:\Windows\System\cEZgYYo.exe
  2⤵
  PID:8904
- C:\Windows\System\GZmICqE.exe
  C:\Windows\System\GZmICqE.exe
  2⤵
  PID:8980
- C:\Windows\System\jZeLrwi.exe
  C:\Windows\System\jZeLrwi.exe
  2⤵
  PID:8952
- C:\Windows\System\ZvWFoUk.exe
  C:\Windows\System\ZvWFoUk.exe
  2⤵
  PID:9168
- C:\Windows\System\kwyywnj.exe
  C:\Windows\System\kwyywnj.exe
  2⤵
  PID:9152
- C:\Windows\System\MhDAyrg.exe
  C:\Windows\System\MhDAyrg.exe
  2⤵
  PID:8252
- C:\Windows\System\rSoAXAm.exe
  C:\Windows\System\rSoAXAm.exe
  2⤵
  PID:7572
- C:\Windows\System\GedDLZX.exe
  C:\Windows\System\GedDLZX.exe
  2⤵
  PID:8472
- C:\Windows\System\NKljfAt.exe
  C:\Windows\System\NKljfAt.exe
  2⤵
  PID:8296
- C:\Windows\System\QhDUMDG.exe
  C:\Windows\System\QhDUMDG.exe
  2⤵
  PID:8392
- C:\Windows\System\mikvgRj.exe
  C:\Windows\System\mikvgRj.exe
  2⤵
  PID:8488
- C:\Windows\System\DwUPQSO.exe
  C:\Windows\System\DwUPQSO.exe
  2⤵
  PID:8456
- C:\Windows\System\FoAEJcm.exe
  C:\Windows\System\FoAEJcm.exe
  2⤵
  PID:8540
- C:\Windows\System\fWydlyo.exe
  C:\Windows\System\fWydlyo.exe
  2⤵
  PID:8692
- C:\Windows\System\MxEcEpe.exe
  C:\Windows\System\MxEcEpe.exe
  2⤵
  PID:8752
- C:\Windows\System\HSJXYnL.exe
  C:\Windows\System\HSJXYnL.exe
  2⤵
  PID:8824
- C:\Windows\System\MlZQoHa.exe
  C:\Windows\System\MlZQoHa.exe
  2⤵
  PID:8948
- C:\Windows\System\LVoZoet.exe
  C:\Windows\System\LVoZoet.exe
  2⤵
  PID:9096
- C:\Windows\System\SslOioW.exe
  C:\Windows\System\SslOioW.exe
  2⤵
  PID:8476
- C:\Windows\System\rcvUqOO.exe
  C:\Windows\System\rcvUqOO.exe
  2⤵
  PID:8604
- C:\Windows\System\DFnsvAR.exe
  C:\Windows\System\DFnsvAR.exe
  2⤵
  PID:7828
- C:\Windows\System\EzXKqsl.exe
  C:\Windows\System\EzXKqsl.exe
  2⤵
  PID:9184
- C:\Windows\System\BCYTDaP.exe
  C:\Windows\System\BCYTDaP.exe
  2⤵
  PID:8920
- C:\Windows\System\wwzvrCn.exe
  C:\Windows\System\wwzvrCn.exe
  2⤵
  PID:8832
- C:\Windows\System\hKEWWXx.exe
  C:\Windows\System\hKEWWXx.exe
  2⤵
  PID:8936
- C:\Windows\System\ydmqdzO.exe
  C:\Windows\System\ydmqdzO.exe
  2⤵
  PID:9196
- C:\Windows\System\RwiZoJi.exe
  C:\Windows\System\RwiZoJi.exe
  2⤵
  PID:8316
- C:\Windows\System\JhyhHlW.exe
  C:\Windows\System\JhyhHlW.exe
  2⤵
  PID:8508
- C:\Windows\System\lffhUhq.exe
  C:\Windows\System\lffhUhq.exe
  2⤵
  PID:9228
- C:\Windows\System\KanofCS.exe
  C:\Windows\System\KanofCS.exe
  2⤵
  PID:9244
- C:\Windows\System\jOsbQDy.exe
  C:\Windows\System\jOsbQDy.exe
  2⤵
  PID:9260
- C:\Windows\System\ygiRbER.exe
  C:\Windows\System\ygiRbER.exe
  2⤵
  PID:9276
- C:\Windows\System\KpKfoRJ.exe
  C:\Windows\System\KpKfoRJ.exe
  2⤵
  PID:9292
- C:\Windows\System\CgiCDuo.exe
  C:\Windows\System\CgiCDuo.exe
  2⤵
  PID:9312
- C:\Windows\System\KveAfQV.exe
  C:\Windows\System\KveAfQV.exe
  2⤵
  PID:9328
- C:\Windows\System\ixjaJdP.exe
  C:\Windows\System\ixjaJdP.exe
  2⤵
  PID:9344
- C:\Windows\System\rTyhjoj.exe
  C:\Windows\System\rTyhjoj.exe
  2⤵
  PID:9360
- C:\Windows\System\wOolgpu.exe
  C:\Windows\System\wOolgpu.exe
  2⤵
  PID:9376
- C:\Windows\System\JztwgFE.exe
  C:\Windows\System\JztwgFE.exe
  2⤵
  PID:9392
- C:\Windows\System\aFAQxIy.exe
  C:\Windows\System\aFAQxIy.exe
  2⤵
  PID:9408
- C:\Windows\System\OoVVEHf.exe
  C:\Windows\System\OoVVEHf.exe
  2⤵
  PID:9424
- C:\Windows\System\gDxWccR.exe
  C:\Windows\System\gDxWccR.exe
  2⤵
  PID:9440
- C:\Windows\System\hdbMRTX.exe
  C:\Windows\System\hdbMRTX.exe
  2⤵
  PID:9456
- C:\Windows\System\oKWwvnw.exe
  C:\Windows\System\oKWwvnw.exe
  2⤵
  PID:9472
- C:\Windows\System\mBOTgoc.exe
  C:\Windows\System\mBOTgoc.exe
  2⤵
  PID:9488
- C:\Windows\System\zVgYgVy.exe
  C:\Windows\System\zVgYgVy.exe
  2⤵
  PID:9504
- C:\Windows\System\azraceu.exe
  C:\Windows\System\azraceu.exe
  2⤵
  PID:9520
- C:\Windows\System\TLxIYDM.exe
  C:\Windows\System\TLxIYDM.exe
  2⤵
  PID:9536
- C:\Windows\System\RViJVSy.exe
  C:\Windows\System\RViJVSy.exe
  2⤵
  PID:9552
- C:\Windows\System\eZegkTk.exe
  C:\Windows\System\eZegkTk.exe
  2⤵
  PID:9568
- C:\Windows\System\cTcHufU.exe
  C:\Windows\System\cTcHufU.exe
  2⤵
  PID:9584
- C:\Windows\System\JExAOhO.exe
  C:\Windows\System\JExAOhO.exe
  2⤵
  PID:9600
- C:\Windows\System\dMVjnuo.exe
  C:\Windows\System\dMVjnuo.exe
  2⤵
  PID:9616
- C:\Windows\System\glFXyYU.exe
  C:\Windows\System\glFXyYU.exe
  2⤵
  PID:9632
- C:\Windows\System\mwDRSlP.exe
  C:\Windows\System\mwDRSlP.exe
  2⤵
  PID:9648
- C:\Windows\System\AWdksBm.exe
  C:\Windows\System\AWdksBm.exe
  2⤵
  PID:9664
- C:\Windows\System\achaZHT.exe
  C:\Windows\System\achaZHT.exe
  2⤵
  PID:9680
- C:\Windows\System\mvXfMgo.exe
  C:\Windows\System\mvXfMgo.exe
  2⤵
  PID:9700
- C:\Windows\System\uMNoJNR.exe
  C:\Windows\System\uMNoJNR.exe
  2⤵
  PID:9716
- C:\Windows\System\idJagXW.exe
  C:\Windows\System\idJagXW.exe
  2⤵
  PID:9732
- C:\Windows\System\wcSWIPW.exe
  C:\Windows\System\wcSWIPW.exe
  2⤵
  PID:9748
- C:\Windows\System\IeXHzdf.exe
  C:\Windows\System\IeXHzdf.exe
  2⤵
  PID:9768
- C:\Windows\System\sRsygWf.exe
  C:\Windows\System\sRsygWf.exe
  2⤵
  PID:9784
- C:\Windows\System\AXrcDAv.exe
  C:\Windows\System\AXrcDAv.exe
  2⤵
  PID:9800
- C:\Windows\System\URyllPk.exe
  C:\Windows\System\URyllPk.exe
  2⤵
  PID:9816
- C:\Windows\System\auvfJFy.exe
  C:\Windows\System\auvfJFy.exe
  2⤵
  PID:9832
- C:\Windows\System\zxNpZaK.exe
  C:\Windows\System\zxNpZaK.exe
  2⤵
  PID:9848
- C:\Windows\System\UYxNfyR.exe
  C:\Windows\System\UYxNfyR.exe
  2⤵
  PID:9864
- C:\Windows\System\jZNGfhr.exe
  C:\Windows\System\jZNGfhr.exe
  2⤵
  PID:9880
- C:\Windows\System\JPqPUZj.exe
  C:\Windows\System\JPqPUZj.exe
  2⤵
  PID:10048
- C:\Windows\System\AaPfqjP.exe
  C:\Windows\System\AaPfqjP.exe
  2⤵
  PID:10068
- C:\Windows\System\CgcbHmy.exe
  C:\Windows\System\CgcbHmy.exe
  2⤵
  PID:10084
- C:\Windows\System\etOrlfp.exe
  C:\Windows\System\etOrlfp.exe
  2⤵
  PID:10100
- C:\Windows\System\ioqkXbL.exe
  C:\Windows\System\ioqkXbL.exe
  2⤵
  PID:10116
- C:\Windows\System\KqeyEkD.exe
  C:\Windows\System\KqeyEkD.exe
  2⤵
  PID:10132
- C:\Windows\System\VbxNdfA.exe
  C:\Windows\System\VbxNdfA.exe
  2⤵
  PID:10148
- C:\Windows\System\qKQAAcI.exe
  C:\Windows\System\qKQAAcI.exe
  2⤵
  PID:10164
- C:\Windows\System\cMMntkz.exe
  C:\Windows\System\cMMntkz.exe
  2⤵
  PID:10180
- C:\Windows\System\BYUICTh.exe
  C:\Windows\System\BYUICTh.exe
  2⤵
  PID:10196
- C:\Windows\System\FHGQDJh.exe
  C:\Windows\System\FHGQDJh.exe
  2⤵
  PID:10212
- C:\Windows\System\fAeAFYu.exe
  C:\Windows\System\fAeAFYu.exe
  2⤵
  PID:10228
- C:\Windows\System\wsIvWeS.exe
  C:\Windows\System\wsIvWeS.exe
  2⤵
  PID:8428
- C:\Windows\System\RJnbGWr.exe
  C:\Windows\System\RJnbGWr.exe
  2⤵
  PID:9240
- C:\Windows\System\RNznGyM.exe
  C:\Windows\System\RNznGyM.exe
  2⤵
  PID:8868
- C:\Windows\System\CffCSCz.exe
  C:\Windows\System\CffCSCz.exe
  2⤵
  PID:8556
- C:\Windows\System\ySBSVFD.exe
  C:\Windows\System\ySBSVFD.exe
  2⤵
  PID:9252
- C:\Windows\System\fGGOEiU.exe
  C:\Windows\System\fGGOEiU.exe
  2⤵
  PID:9356
- C:\Windows\System\jTOHaWv.exe
  C:\Windows\System\jTOHaWv.exe
  2⤵
  PID:9384
- C:\Windows\System\ZmMsGCl.exe
  C:\Windows\System\ZmMsGCl.exe
  2⤵
  PID:9404
- C:\Windows\System\yVBqLZL.exe
  C:\Windows\System\yVBqLZL.exe
  2⤵
  PID:9420
- C:\Windows\System\QHUnvea.exe
  C:\Windows\System\QHUnvea.exe
  2⤵
  PID:9484
- C:\Windows\System\GfTlEwV.exe
  C:\Windows\System\GfTlEwV.exe
  2⤵
  PID:9464
- C:\Windows\System\sJPhOPR.exe
  C:\Windows\System\sJPhOPR.exe
  2⤵
  PID:9576
- C:\Windows\System\FNIQrZB.exe
  C:\Windows\System\FNIQrZB.exe
  2⤵
  PID:9468
- C:\Windows\System\PdMLZoF.exe
  C:\Windows\System\PdMLZoF.exe
  2⤵
  PID:9528
- C:\Windows\System\GZKBoPz.exe
  C:\Windows\System\GZKBoPz.exe
  2⤵
  PID:9624
- C:\Windows\System\WcawPIY.exe
  C:\Windows\System\WcawPIY.exe
  2⤵
  PID:9608
- C:\Windows\System\jlWdsGf.exe
  C:\Windows\System\jlWdsGf.exe
  2⤵
  PID:9728
- C:\Windows\System\crCAtLD.exe
  C:\Windows\System\crCAtLD.exe
  2⤵
  PID:9676
- C:\Windows\System\jDyoshN.exe
  C:\Windows\System\jDyoshN.exe
  2⤵
  PID:9756
- C:\Windows\System\wlhCVHs.exe
  C:\Windows\System\wlhCVHs.exe
  2⤵
  PID:9764
- C:\Windows\System\ZISkULR.exe
  C:\Windows\System\ZISkULR.exe
  2⤵
  PID:9828
- C:\Windows\System\sAncFJK.exe
  C:\Windows\System\sAncFJK.exe
  2⤵
  PID:9892
- C:\Windows\System\exNuRUo.exe
  C:\Windows\System\exNuRUo.exe
  2⤵
  PID:9844
- C:\Windows\System\CEvvhol.exe
  C:\Windows\System\CEvvhol.exe
  2⤵
  PID:9904
- C:\Windows\System\VheNHjk.exe
  C:\Windows\System\VheNHjk.exe
  2⤵
  PID:9920
- C:\Windows\System\lgTCKOq.exe
  C:\Windows\System\lgTCKOq.exe
  2⤵
  PID:9936
- C:\Windows\System\ewxWFxm.exe
  C:\Windows\System\ewxWFxm.exe
  2⤵
  PID:9948
- C:\Windows\System\dlnSXXR.exe
  C:\Windows\System\dlnSXXR.exe
  2⤵
  PID:9964
- C:\Windows\System\uLLDkCq.exe
  C:\Windows\System\uLLDkCq.exe
  2⤵
  PID:9980
- C:\Windows\System\rocFWjI.exe
  C:\Windows\System\rocFWjI.exe
  2⤵
  PID:9996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AOKOZQv.exe

Filesize
2.3MB

MD5
76348f8bf079d318a3861950ae00d3ab

SHA1
f364b8b1bb174afc47f8ff32e23736f8a045bf6e

SHA256
9e10409c47c24fe791f9f69acf0132235cc65c1d91660f4a124718ae65cc61e1

SHA512
ff69caec418130bd97928c84c2e0c128a75cd74cc655734e04a09c116df0f788884aed87352d7a25c189facca828d59300bddac53b845dd9999418435ab95c45

Download Submit
C:\Windows\system\CxijPfV.exe

Filesize
2.3MB

MD5
2be8f65eb7899b3faa62c693cff64f3f

SHA1
c54e3e0fc2274aaee9823ae4c20815d4396d0a4d

SHA256
f3cff52aad5bb625bafc00b516158959560d0419469e397b2545d6e505f88f62

SHA512
2c7d41996e25278fc7092310b4a8e164ee5d990f8b848873dd5d6ee67dd49b2236acd28b6f2ac52e3050ea584845c31b02747fa316e0d4f3d1456192d2167cea

Download Submit
C:\Windows\system\EippOIq.exe

Filesize
2.3MB

MD5
bf676a50f78cff28af4881142940c9ab

SHA1
7ccb868e46569852f9c9056c86c92e4148db2200

SHA256
3ae7f9529f4a3752d78badd302b8ef1c79615ee7dde55056b78704507cd65416

SHA512
daf2608f73332f91083b51b9c105950b1a781eb7e717b4fcb5299c3edd9b28d7d7f9a4fb86334e66fc6dcdee54291266e08312d67c364802b858ac85d2a1c0fe

Download Submit
C:\Windows\system\EvuRFAz.exe

Filesize
2.3MB

MD5
2216b5bcafb0e8f8cbe87bd438257a4d

SHA1
89588eec514be56e7bb2b52f7cecb42cbb88e1fa

SHA256
0694b487e20896cdd311f4c0ba81c5e96c11f15a887a9f633ef4f2d4031ad086

SHA512
efd09312c39ad597fc7a8db33239e7e16d04392c1ababe7e4b1ec43f029fbc608a3f89e2461fbd6a6dbaaaa2f4c7da46de699828fde0cab055cc503572362930

Download Submit
C:\Windows\system\HKZAGJn.exe

Filesize
2.3MB

MD5
1260949effdcffb8fcbdbfa27c1d3556

SHA1
20476960e8b1af8bba749f21448be948d9734e87

SHA256
2a4d6df26cdd4a4b1529a4b3ab8fcd59ec503f70089dc07f43d344b0cbd08673

SHA512
af85ad6b906a508e03373095095b84e95502f499126706f0c8f752ffec35f1007992451cd1497ca6042b26b4f112f390232f19c8dec2f61306a98fe7e252ea9b

Download Submit
C:\Windows\system\JIFVgHT.exe

Filesize
2.3MB

MD5
fa2c7535db49fcbde32eef5ff19348dd

SHA1
3121df1e32a0b9a49853e59dc013d6dd51e55703

SHA256
be6188bc83b55da4854be1c0ce9544eebd51e3144fcfa7b7bc79d466fb08b24c

SHA512
d097559b13d5123228a7a130cff421139a3e4662b6d493972acd8a72b5f911f1b58db7dbf92e71fe976aac3d2d13f766873dce7fee670c7658942028a1dbcec8

Download Submit
C:\Windows\system\MYxPxls.exe

Filesize
2.3MB

MD5
be106967ab57fb872d0a7ad199b11234

SHA1
1b6116e872f173841cb3be98356f8e1f173bf5cc

SHA256
7cb28599958b7397328bc474888d22a644bfa137d8b321191beefe470c281669

SHA512
b35ded7aef41f7d0dd058fab0fb2dc792e502babfda005bf2dcf5e9b9bd570ec74007c98aecfd536157a33c36cc5bccf4cf7b44f6854703594860f8c896bf0c1

Download Submit
C:\Windows\system\UeDrWKu.exe

Filesize
2.3MB

MD5
85e0a111cc69c728aa552562afec065e

SHA1
435c813937120d503c56e972ed7634b07e789b3c

SHA256
9a4304eb2432427909fecfa7a31c7592c7b03fceda743b469ac628256d593462

SHA512
9719f8e3b6b0fe4c4d1436a7de0363fde0c07470e86332c3523c0a96c585fd2e58b76993128ee1e0955848794f6c244ec0f343f856e7e639767e7ddc62b51569

Download Submit
C:\Windows\system\WByvJdk.exe

Filesize
2.3MB

MD5
e1e9e8d32efce74827deeedf3d78b874

SHA1
4cadc2f0b06e75407d665912f0250460d9e7cdb5

SHA256
ae0751095a9023c893b5ed51c21b6f28df8383a704a7c0f70217ab0848d249f7

SHA512
c3dcd7fa83619e30d39580a0f8a55f4d344211297284dbbe4a6682982302d430376ca19034a1fd5cfdbd348fa5b7d38ac82d59520cff28a4931317714f52658c

Download Submit
C:\Windows\system\jenrxMt.exe

Filesize
2.3MB

MD5
a1d8d7a98af0b65d097a0570440f7738

SHA1
88c029cf1857f03aa0098c304e80e2354cd4bdca

SHA256
d7f9271fff802bcd9b14dc88f45b32bb0acd8888899c8dd67597fd42e92b1830

SHA512
3a7c329a63e32c051e6c73aeda45f4470f6669a3f60c4b1ad06d219251752d615a47f006eee511955fc98f253ba6faae4a11e09e1ba321dc474353739bdcf98d

Download Submit
C:\Windows\system\kEszDaF.exe

Filesize
2.3MB

MD5
c2ef06a1c32308a4f2104ab8d8b16b17

SHA1
d62d3ad2f7f5853ff4ff1988f9941b2415f11405

SHA256
4326fc28f6e5bf83cd1aa54847013e5c1f2ebaa7894aab84337cbe1bf725e0af

SHA512
9f472a30f95c0a9fb0b5c5320090bb8ce5521980afe9d83055e4f85b560f94e3a6085e38cc5b32f751a24dce09447c6e60ad3c7f6de1facaa0ce4adb6f0a2065

Download Submit
C:\Windows\system\oAlmiHM.exe

Filesize
2.3MB

MD5
2a5db7a87118a57fc6896b8dba401158

SHA1
463ea30e90999991cd17a6376c19c6d91ebad5e0

SHA256
89ee0845fd70c7dd12a4086f20de9db0bf3b01774bf4a14c68cf6d4b9fa45341

SHA512
58e2e5def9b0f1d7334e118222afd15bce64362bad913c9a48825f3bd121de6480c119e6667d4d71f593ee8f3acecc6184728f34c3efa1e0d4859f76e1e317b4

Download Submit
C:\Windows\system\oOosVfZ.exe

Filesize
2.3MB

MD5
5fd016397c4cf32245c357c6987fefbb

SHA1
94fd3011e028c33d14e63f7b1cadfaad606bb88b

SHA256
14324314af34cb46fe64e2ba9fc6a659f82f7167b486248eb06db2e08eaf54f4

SHA512
963ad84ed4d4bf408f1ddbca1bb013ee703d77ddf594c62286d05f103699e5b738f4cf51bcef1f61b5aea74be0ad753a90dac46e4f1153ae85e4b0d44af1d649

Download Submit
C:\Windows\system\otjHBVp.exe

Filesize
2.3MB

MD5
66a51ff0dc5085435ecc9d38ec29ae42

SHA1
b7db73827c0a1929b8eb93e57656ef42dc960826

SHA256
196ae50e017a5d6825c9437f6c5565cf3fe605544d0d956ddaff1d35b50268bd

SHA512
5a6d78a5d1cc7d4c364726c411d09779e056010f2a961ac4d81f98d519d4a531bb737216b32b64c0d01e5d5baccae38760e2a846f6465421be2cbd72ca8fdf8f

Download Submit
C:\Windows\system\toSFwXJ.exe

Filesize
2.3MB

MD5
c3ba91fbb00e9727144a2bebd1754816

SHA1
efe2ae476cc29491aa6e6d02078118610ae040d7

SHA256
72e913d083f5d4b0a5e9ae9cc7f26035bf0aa5393cb19b98cca14467f0e2d5c3

SHA512
b53ab718cf10a8163b1d339121519e1aada767ca6ed3e1f6d1a99b69a0c65518f22898a776cbda33d40ff6ec571db6a812ea0d5b8b6a6f0ece94b938f0ff9307

Download Submit
C:\Windows\system\xBoWpcE.exe

Filesize
2.3MB

MD5
f9ee37c1601e9116b7fa5cc059fabfcd

SHA1
9c9dff064be9f001d85847c56c782c675e5b9ff3

SHA256
6332aa5bec7e069c1424fa2f0098c558a22f0987c647fd16c3e88221b1305096

SHA512
607334755a234a9dfb1033de75bdd60e14656e115012c7ed69fb07763818acca9f61cc6e6da595e3958b4db69f505d0a329598e82e37831572a826f8046a0a8b

Download Submit
C:\Windows\system\zavpMqm.exe

Filesize
2.3MB

MD5
ac3d5796d3f9031ab5237e5d9dda88b9

SHA1
ff93d71d689ec1ecf38615c97d6b6d94a16dc057

SHA256
aac455aa57a14d0b10df205570da2a135191d3dd59907357f4ebce4a26c69e9e

SHA512
046727e4cd81d3f03f8307d52446619318cc7295bd661e6cfeca1efe49990eec9acbb3be534965d9764b6156b1f6830f4d0594681b6ad3e4e38d9025c950c3f3

Download Submit
\Windows\system\ImDiuSU.exe

Filesize
2.3MB

MD5
701c60f71d5dc5a7a92bb8c1d2746439

SHA1
09467858fa0c29174134bff0b51f91ca944f736f

SHA256
aa61eb193ee6e27bf6078bb1ffba5d76d2c96c2d68280e0d01f884df3b190c7e

SHA512
186dea1bd7561292e009750c8930b517bea9ece54b70d9eac0186c166a7e027f46ab1067b242725eb879b1ac492a4a548bf3421469f2da70ebf68804d0b41288

Download Submit
\Windows\system\JLxjLeG.exe

Filesize
2.3MB

MD5
c507f493e33faf9a572ccb70ba2b8f0c

SHA1
53069e84b6d057c2d778b212a1723e1a4a089001

SHA256
335fecb805512debf6d4449da9f8295a6559091e5d9db201cab783905acb830b

SHA512
a64b9005b0e838837a710ff160fe3e237836b9ce05e3d293d35cfa3c19fb26ba5c420af234c3eee72d88cefb3e4bfc367e0c821d3065e09b1af2ed8a4653ace9

Download Submit
\Windows\system\MJzAdED.exe

Filesize
2.3MB

MD5
510faccd8411a91d3370dcd53f398cc3

SHA1
45d1f8fec9b4c052f34482ace1723dba50f20c63

SHA256
2c209a91f51d5479fb91baed792524da714745c2053d1a668fdcfb39938f306e

SHA512
f125adaadab0d8e1d9e03ecb0e6db050262fb3c40887426f2ff26e2734f838bc142c32e5f8d29315a85809cce14bab45ee262d20264030ab9f78071cad45be54

Download Submit
\Windows\system\MLagrvF.exe

Filesize
2.3MB

MD5
779f8f94c45e29564b16caf7995478ee

SHA1
2cf77cac2221ea256dba91c4f9ef3f6355fe76a0

SHA256
92875d91a9672ff5bf3fc9538eafc399142f99dfbc83819a0a5b7c261470cce2

SHA512
bb15181c8ed55dca9d84fcd4005686dfd51bc53c0566010c0cd84c683667478655b1e95f684433ef64d6d114d812d3e768fdd9516ddb9392c9dc4b8b0389860e

Download Submit
\Windows\system\OWoLwRm.exe

Filesize
2.3MB

MD5
6b6c907921210f493833a1edc8d06dd5

SHA1
2d96dced4785fe21878df4adddcec73b182fed79

SHA256
8bb6d34929738c4c53c2e208cce02febaa828033b49f93a10bb1eb9a1575a4c6

SHA512
cc4cb8ef969d8a760a83e5b86c43d7b816667532d1a8d4ad3bdd82d2374f46d286be6bedce4b3b46dc8ddc0518b4dedee6f81e8445086e579828a2fda982e87a

Download Submit
\Windows\system\SGhUXtT.exe

Filesize
2.3MB

MD5
ae496a58ce25a540ced7979ab76a29bb

SHA1
68e8e26fcf70ce4dc6f6d4528621665d2ad952a9

SHA256
c570bf2bb5fecbe66de943f288e90409ef8c5484b6d39979941ad436c8c630ca

SHA512
62aea2d69d5f1e0d5479dc714f0a7261d95e706440ebb80087b1f30159e3bd19735dc7c69ee2dc54c4c3ff146db6084bc06974a7593e49a252d09c10b0d37b76

Download Submit
\Windows\system\WYrhzGP.exe

Filesize
2.3MB

MD5
173afd4bea14eee1a36c2f6cafc8b19d

SHA1
c950d4c26c67528936872012969d560f13bcae9d

SHA256
c63fd3f2457c2bbf183d87da1135d80f2c3708940abe51790f589e22f1ebd265

SHA512
0c3a020a0aaff340ca8e520626aef1d807adc53abc31ed682e3bb360fa39d12aec6296c22ff59daac2e390e485d2b4f5e4e42761d3b6f17f66bc063b1d0b60af

Download Submit
\Windows\system\btQsERF.exe

Filesize
2.3MB

MD5
ee55c45dacf9b87aaa6013cc504bdb4c

SHA1
a40d680243c31c3c371ea1f43e5d3d3a279f817d

SHA256
ec85c06dcc9a6fe504ee1038d8fc021e83a279c0448c25fc8088f253f1c7772a

SHA512
7de0863b0e5f76a20148494064afcd339ba5d7697bf8cab25c5ba76faed4d80c24f53a00056e4c6c30963832818c2312d85c4f4f1fced098beda80d460ce2d72

Download Submit
\Windows\system\dIjnwtc.exe

Filesize
2.3MB

MD5
e625e1c9ecac72d7f0f01be98ee4fb7e

SHA1
0160c761e326f0a834447b3bfb7375d67a1159ab

SHA256
fcd8af8b7e881f6c45c8b78a188dcad893d9006fcd5d8b468471adc7db5fec6d

SHA512
84bcfdaff14accb8b162361405128365c54eb25472f71ae3157e1ef507b7ec81a6047556b39a9f01bb7fd32be46e1b6637922638d8a223531997c64abf03b648

Download Submit
\Windows\system\gEuSHVK.exe

Filesize
2.3MB

MD5
f5a02c41fc1977f13b641da987eeda4c

SHA1
89f9996f9601f96390cf1b3a2cefe88652cc846e

SHA256
6c577bf7cb87565497b38706669962178789bfddff3299e19e929a522580afe9

SHA512
c998aa9def3ed94d9914861e02bc935e28832c37db371446c3bc2c34932ea03a56b195234a989894dcefae2a14ac0b9670d01ead0758475acfa2bf292143e887

Download Submit
\Windows\system\iByKsiw.exe

Filesize
2.3MB

MD5
3f55fe821af844526dcfccda986ceafe

SHA1
3e68fb4f449b1b29bf77811aad14c2f8f030e65c

SHA256
003c28dfeaed92d0a59dbf686db6435abd720b8f126cb2a86ab13eaffbc45b37

SHA512
59e87eda928a10790cd634019b3ed1d38fbbb2a34cad6d6efc390ac37489356aed77357b7d7626110bcef5e44b401a185d956adea510bd89f752ac5b80c4cf2e

Download Submit
\Windows\system\mQioKAV.exe

Filesize
2.3MB

MD5
3e6c64eb730ddf779aef22c3a5bf92ee

SHA1
07c8b924bb11827745c6c9c106f7ff41f4617083

SHA256
92d00f5f01d1486ba1f1052fd2146437e3f19f7166db08fe0f19efd2e7854124

SHA512
66339b7be6adde2f1347a1ddd5b57214f6b36828e1f88bb4d50fb85a5b31ecb6df96669b1cdfeef78ecaf61d495e33343e789bad573140c26150603dec2c5297

Download Submit
\Windows\system\ohvjMlu.exe

Filesize
2.3MB

MD5
1f11e002a289707322c94098ff388eb0

SHA1
034aab6eb029eeaebf55047352ac0438556a0669

SHA256
69a24a4c008245d1f47b72dabab3dcf697998732ee7be704a0d292cf31e1609a

SHA512
53f2acebfe9b8a11b23a1b4837dbe10b73645a949e7362143987431d6b1e1eda5e7445da30b87b57611a320695baca02cbb9abb3d126d98817049b6839764eee

Download Submit
\Windows\system\rOlzain.exe

Filesize
2.3MB

MD5
7969dff3e0f181fceac10a7763e52677

SHA1
0833620c1b28494709cb33442695d5f082b9e186

SHA256
11bf25b1e4a0b4fe21da0863ff57c1cca84587525255ce6e418a596edee2aaba

SHA512
67d0b8e68d71b9395b3b96b006acfc37b67d782114b4350a5736c0f54215cd7cdfee5e6816f210c6e295400efff4f04083e2d72130e1143c2d52293f0f3f3775

Download Submit
\Windows\system\xJcyHcN.exe

Filesize
2.3MB

MD5
3cdfaeeb9a2838d9b036d08292daa37e

SHA1
56381b4c03feb190b4fa22c1660f0e692e6c9ee8

SHA256
08f762c8523555d3ace1a75e1a880dd988a0b680e87eb6fed392ddb36ba71ed5

SHA512
e283545952490359b8f379987346eab92a7500369249b4e5bc9b7fcbcc9b68d971966b44aab86a9540f63cbebccdadaae978be0b37b6da6552e9fb3e037866b4

Download Submit
memory/1528-91-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/1600-83-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1600-63-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/1600-1-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/1600-0-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/1600-70-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/1600-89-0x00000000036E0000-0x0000000003AD2000-memory.dmp

Filesize
3.9MB

Download
memory/1600-899-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/1600-33-0x0000000002F20000-0x0000000003312000-memory.dmp

Filesize
3.9MB

Download
memory/1600-75-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/1600-71-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/1600-57-0x00000000036E0000-0x0000000003AD2000-memory.dmp

Filesize
3.9MB

Download
memory/1600-32-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/1600-36-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/1600-1123-0x0000000002F20000-0x0000000003312000-memory.dmp

Filesize
3.9MB

Download
memory/1600-22-0x0000000002A90000-0x0000000002E82000-memory.dmp

Filesize
3.9MB

Download
memory/1600-25-0x0000000002F20000-0x0000000003312000-memory.dmp

Filesize
3.9MB

Download
memory/2056-24-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2108-37-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2108-38-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/2300-78-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2444-76-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-72-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-73-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-88-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-31-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-34-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-74-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2880-77-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2988-19-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download