xmrig | 15404c23f9ba620a8ba8d5fb1720e15b10463f29dd017f880639310cd911360b

Analysis

max time kernel
24s
max time network
35s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
Size

1.7MB
MD5

06bf77cc23847b6390e771aae689a8ba
SHA1

dfc879cfefeb22ddfc446c1b62b07a5253ec6ee1
SHA256

15404c23f9ba620a8ba8d5fb1720e15b10463f29dd017f880639310cd911360b
SHA512

9932025eba815d1ff23daa3c8856e41e8776bdc453969262b342259b1f36411755532b8e7bf8e1e061d0008fe02adf8c1de27f9aa1f08c52336f7e38bfa00d56
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD5:NABo

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 3 IoCs

miner

resource	yara_rule
behavioral1/memory/3056-17-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/2656-83-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2128-52-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3056	ooFUATZ.exe
2128	SXzKikz.exe
2656	yCSndBP.exe
2600	DFaUCgf.exe
2556	dEWUzHW.exe
2704	tHvBLza.exe
2720	dqYSMLu.exe
2712	XyLVtkM.exe
2408	pMwrRCn.exe
2456	ZkjKizK.exe
3032	dYAcuBq.exe
2960	UDRIiAj.exe
2920	AsFtdQr.exe
2984	mqbpbAX.exe
1560	xyUQPhz.exe
1592	PnPsWEC.exe
2548	DwntwTj.exe
2696	bKIvxQa.exe
2812	mBFTErh.exe
2500	rynPNmY.exe
2512	FEmvwxB.exe
2116	ZJHLdAX.exe
2864	QfusdVL.exe
2792	FivOeSB.exe
2916	WIFdUUL.exe
2972	mXjlYWD.exe
1488	kPqwTBU.exe
2744	gjYjLzO.exe
2796	PMzYEUR.exe
1868	CaKQAzM.exe
1460	bowHzTM.exe
1156	iBOAYSf.exe
1124	dGqQRhS.exe
2280	pVXzJlG.exe
1336	GOibNdX.exe
2288	UerdCMV.exe
1332	OGGMRQy.exe
1284	KJxGZPP.exe
1344	eHdZlEu.exe
604	IHkZfFk.exe
1280	xeftjop.exe
320	eatWJva.exe
3048	umKNDLs.exe
776	lXbsIGu.exe
1672	QknZlEY.exe
2340	WwvXjhI.exe
1856	zgaEXOh.exe
1300	tgeQMam.exe
1752	uZHFlpD.exe
864	hsLjpME.exe
2892	acFbVZK.exe
2248	kYPqrRX.exe
1996	efjdsnr.exe
1564	GVEgJVZ.exe
2848	uGqcYBB.exe
2092	sFkvjti.exe
2028	zTdPIpK.exe
2268	hpWZhLn.exe
668	lhOsvFt.exe
1604	lcWfmea.exe
2840	QwbPvIC.exe
2536	GbfWHEb.exe
2196	xRuEVKM.exe
1268	FnSIgLz.exe

Loads dropped DLL 64 IoCs

pid	Process
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe

UPX packed file 36 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1652-0-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/files/0x000c00000001432c-3.dat	upx
behavioral1/memory/3056-17-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/files/0x0006000000015fe9-96.dat	upx
behavioral1/files/0x0006000000015eaf-89.dat	upx
behavioral1/memory/2656-83-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/files/0x0006000000015d9b-82.dat	upx
behavioral1/files/0x00060000000161e7-150.dat	upx
behavioral1/files/0x0006000000015d8f-158.dat	upx
behavioral1/files/0x0006000000015f6d-162.dat	upx
behavioral1/files/0x0009000000014b63-111.dat	upx
behavioral1/files/0x0007000000004e76-183.dat	upx
behavioral1/files/0x0006000000016117-167.dat	upx
behavioral1/files/0x000600000001630b-163.dat	upx
behavioral1/files/0x0006000000015d56-146.dat	upx
behavioral1/files/0x0006000000015d28-144.dat	upx
behavioral1/files/0x0006000000015ceb-143.dat	upx
behavioral1/files/0x0006000000015cd5-141.dat	upx
behavioral1/files/0x0008000000015ca6-126.dat	upx
behavioral1/files/0x00060000000164b2-176.dat	upx
behavioral1/files/0x0006000000015d87-118.dat	upx
behavioral1/files/0x0006000000015d6f-117.dat	upx
behavioral1/files/0x0006000000015d5e-116.dat	upx
behavioral1/files/0x0006000000015d4a-115.dat	upx
behavioral1/files/0x0006000000015d07-114.dat	upx
behavioral1/files/0x0006000000015ce1-113.dat	upx
behavioral1/files/0x0006000000015cba-112.dat	upx
behavioral1/files/0x0007000000014aa2-109.dat	upx
behavioral1/files/0x0007000000014857-108.dat	upx
behavioral1/files/0x0009000000014b27-107.dat	upx
behavioral1/files/0x0006000000015e3a-86.dat	upx
behavioral1/files/0x0006000000015d79-71.dat	upx
behavioral1/files/0x0006000000015d67-65.dat	upx
behavioral1/memory/2128-52-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/files/0x0007000000014971-63.dat	upx
behavioral1/files/0x0036000000014594-30.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MmQXdKF.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\CAhRtpS.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\VutQmls.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\eeRqIBm.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\zmyzbWG.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\ObkdFHV.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\oOKPPvh.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\kJKnuig.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\unwNvPj.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\GxARmtD.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\QLhJoqR.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\tIUxSNq.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\ypMUxlD.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\CZuQcGz.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\pcpFjWo.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\RfQXtXs.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\VWiGdne.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\feaEjdC.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\sJIFTRy.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\BHQUERw.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\xRuEVKM.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\YNyciZz.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\oglSGqe.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\wRquZbr.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\NMRbcxe.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\LjUHmEr.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\AQumtgq.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\yzBpnFV.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\BoSZAzW.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\ZJHLdAX.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\ndlqIKI.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\wlXNbSp.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\lULIFQZ.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\XhjnDOS.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\eGVhHBA.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\kgJehLP.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\HADRDlt.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\REEsljk.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\UMeOJPx.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\sFkvjti.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\SSUSwBy.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\GOibNdX.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\ocjJJHt.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\laLnIBY.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\gtnLNlm.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\lWAvCvG.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\VVquadQ.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\mxIYCGC.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\LKIiBWM.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\NHryNqv.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\IhrflXA.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\zbnYuiC.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\svswrCa.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\SxNZTPe.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\cgkfdMh.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\nYxNlUX.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\ocjbDYC.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\pmoxSav.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\PGpGUmG.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\gouzHBD.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\AdrkipF.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\zEqdQYF.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\WIFdUUL.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\uJqSEoJ.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2024	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeLockMemoryPrivilege	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2024	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	29
PID 1652 wrote to memory of 2024	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	29
PID 1652 wrote to memory of 2024	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	29
PID 1652 wrote to memory of 3056	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	30
PID 1652 wrote to memory of 3056	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	30
PID 1652 wrote to memory of 3056	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	30
PID 1652 wrote to memory of 2128	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	31
PID 1652 wrote to memory of 2128	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	31
PID 1652 wrote to memory of 2128	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	31
PID 1652 wrote to memory of 2556	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	32
PID 1652 wrote to memory of 2556	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	32
PID 1652 wrote to memory of 2556	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	32
PID 1652 wrote to memory of 2656	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	33
PID 1652 wrote to memory of 2656	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	33
PID 1652 wrote to memory of 2656	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	33
PID 1652 wrote to memory of 2704	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	34
PID 1652 wrote to memory of 2704	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	34
PID 1652 wrote to memory of 2704	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	34
PID 1652 wrote to memory of 2600	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	35
PID 1652 wrote to memory of 2600	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	35
PID 1652 wrote to memory of 2600	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	35
PID 1652 wrote to memory of 2720	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	36
PID 1652 wrote to memory of 2720	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	36
PID 1652 wrote to memory of 2720	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	36
PID 1652 wrote to memory of 2696	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	37
PID 1652 wrote to memory of 2696	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	37
PID 1652 wrote to memory of 2696	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	37
PID 1652 wrote to memory of 2712	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	38
PID 1652 wrote to memory of 2712	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	38
PID 1652 wrote to memory of 2712	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	38
PID 1652 wrote to memory of 2812	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	39
PID 1652 wrote to memory of 2812	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	39
PID 1652 wrote to memory of 2812	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	39
PID 1652 wrote to memory of 2408	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	40
PID 1652 wrote to memory of 2408	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	40
PID 1652 wrote to memory of 2408	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	40
PID 1652 wrote to memory of 2500	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	41
PID 1652 wrote to memory of 2500	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	41
PID 1652 wrote to memory of 2500	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	41
PID 1652 wrote to memory of 2456	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	42
PID 1652 wrote to memory of 2456	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	42
PID 1652 wrote to memory of 2456	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	42
PID 1652 wrote to memory of 2512	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	43
PID 1652 wrote to memory of 2512	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	43
PID 1652 wrote to memory of 2512	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	43
PID 1652 wrote to memory of 3032	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	44
PID 1652 wrote to memory of 3032	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	44
PID 1652 wrote to memory of 3032	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	44
PID 1652 wrote to memory of 2116	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	45
PID 1652 wrote to memory of 2116	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	45
PID 1652 wrote to memory of 2116	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	45
PID 1652 wrote to memory of 2960	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	46
PID 1652 wrote to memory of 2960	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	46
PID 1652 wrote to memory of 2960	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	46
PID 1652 wrote to memory of 2792	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	47
PID 1652 wrote to memory of 2792	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	47
PID 1652 wrote to memory of 2792	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	47
PID 1652 wrote to memory of 2920	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	48
PID 1652 wrote to memory of 2920	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	48
PID 1652 wrote to memory of 2920	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	48
PID 1652 wrote to memory of 2916	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	49
PID 1652 wrote to memory of 2916	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	49
PID 1652 wrote to memory of 2916	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	49
PID 1652 wrote to memory of 2984	1652	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2024
- C:\Windows\System\ooFUATZ.exe
  C:\Windows\System\ooFUATZ.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\SXzKikz.exe
  C:\Windows\System\SXzKikz.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\dEWUzHW.exe
  C:\Windows\System\dEWUzHW.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\yCSndBP.exe
  C:\Windows\System\yCSndBP.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\tHvBLza.exe
  C:\Windows\System\tHvBLza.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\DFaUCgf.exe
  C:\Windows\System\DFaUCgf.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\dqYSMLu.exe
  C:\Windows\System\dqYSMLu.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\bKIvxQa.exe
  C:\Windows\System\bKIvxQa.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\XyLVtkM.exe
  C:\Windows\System\XyLVtkM.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\mBFTErh.exe
  C:\Windows\System\mBFTErh.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\pMwrRCn.exe
  C:\Windows\System\pMwrRCn.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\rynPNmY.exe
  C:\Windows\System\rynPNmY.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\ZkjKizK.exe
  C:\Windows\System\ZkjKizK.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\FEmvwxB.exe
  C:\Windows\System\FEmvwxB.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\dYAcuBq.exe
  C:\Windows\System\dYAcuBq.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\ZJHLdAX.exe
  C:\Windows\System\ZJHLdAX.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\UDRIiAj.exe
  C:\Windows\System\UDRIiAj.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\FivOeSB.exe
  C:\Windows\System\FivOeSB.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\AsFtdQr.exe
  C:\Windows\System\AsFtdQr.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\WIFdUUL.exe
  C:\Windows\System\WIFdUUL.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\mqbpbAX.exe
  C:\Windows\System\mqbpbAX.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\mXjlYWD.exe
  C:\Windows\System\mXjlYWD.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\xyUQPhz.exe
  C:\Windows\System\xyUQPhz.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\kPqwTBU.exe
  C:\Windows\System\kPqwTBU.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\PnPsWEC.exe
  C:\Windows\System\PnPsWEC.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\gjYjLzO.exe
  C:\Windows\System\gjYjLzO.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\DwntwTj.exe
  C:\Windows\System\DwntwTj.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\PMzYEUR.exe
  C:\Windows\System\PMzYEUR.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\QfusdVL.exe
  C:\Windows\System\QfusdVL.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\bowHzTM.exe
  C:\Windows\System\bowHzTM.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\CaKQAzM.exe
  C:\Windows\System\CaKQAzM.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\iBOAYSf.exe
  C:\Windows\System\iBOAYSf.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\dGqQRhS.exe
  C:\Windows\System\dGqQRhS.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\UerdCMV.exe
  C:\Windows\System\UerdCMV.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\pVXzJlG.exe
  C:\Windows\System\pVXzJlG.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\KJxGZPP.exe
  C:\Windows\System\KJxGZPP.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\GOibNdX.exe
  C:\Windows\System\GOibNdX.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\eHdZlEu.exe
  C:\Windows\System\eHdZlEu.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\OGGMRQy.exe
  C:\Windows\System\OGGMRQy.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\IHkZfFk.exe
  C:\Windows\System\IHkZfFk.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\xeftjop.exe
  C:\Windows\System\xeftjop.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\eatWJva.exe
  C:\Windows\System\eatWJva.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\umKNDLs.exe
  C:\Windows\System\umKNDLs.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\lXbsIGu.exe
  C:\Windows\System\lXbsIGu.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\QknZlEY.exe
  C:\Windows\System\QknZlEY.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\zgaEXOh.exe
  C:\Windows\System\zgaEXOh.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\WwvXjhI.exe
  C:\Windows\System\WwvXjhI.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\tgeQMam.exe
  C:\Windows\System\tgeQMam.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\uZHFlpD.exe
  C:\Windows\System\uZHFlpD.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\hsLjpME.exe
  C:\Windows\System\hsLjpME.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\acFbVZK.exe
  C:\Windows\System\acFbVZK.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\kYPqrRX.exe
  C:\Windows\System\kYPqrRX.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\efjdsnr.exe
  C:\Windows\System\efjdsnr.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\GVEgJVZ.exe
  C:\Windows\System\GVEgJVZ.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\uGqcYBB.exe
  C:\Windows\System\uGqcYBB.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\XSCrLBf.exe
  C:\Windows\System\XSCrLBf.exe
  2⤵
  PID:2120
- C:\Windows\System\sFkvjti.exe
  C:\Windows\System\sFkvjti.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\LuwqSjI.exe
  C:\Windows\System\LuwqSjI.exe
  2⤵
  PID:2700
- C:\Windows\System\zTdPIpK.exe
  C:\Windows\System\zTdPIpK.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\fIhkllv.exe
  C:\Windows\System\fIhkllv.exe
  2⤵
  PID:2944
- C:\Windows\System\hpWZhLn.exe
  C:\Windows\System\hpWZhLn.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\xQjcjju.exe
  C:\Windows\System\xQjcjju.exe
  2⤵
  PID:1936
- C:\Windows\System\lhOsvFt.exe
  C:\Windows\System\lhOsvFt.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\hvuLaRe.exe
  C:\Windows\System\hvuLaRe.exe
  2⤵
  PID:612
- C:\Windows\System\lcWfmea.exe
  C:\Windows\System\lcWfmea.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\eULoEam.exe
  C:\Windows\System\eULoEam.exe
  2⤵
  PID:2584
- C:\Windows\System\QwbPvIC.exe
  C:\Windows\System\QwbPvIC.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\exIweHq.exe
  C:\Windows\System\exIweHq.exe
  2⤵
  PID:1656
- C:\Windows\System\GbfWHEb.exe
  C:\Windows\System\GbfWHEb.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\Qikexbl.exe
  C:\Windows\System\Qikexbl.exe
  2⤵
  PID:1596
- C:\Windows\System\xRuEVKM.exe
  C:\Windows\System\xRuEVKM.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\jwKJoNX.exe
  C:\Windows\System\jwKJoNX.exe
  2⤵
  PID:2416
- C:\Windows\System\FnSIgLz.exe
  C:\Windows\System\FnSIgLz.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\gzSfohf.exe
  C:\Windows\System\gzSfohf.exe
  2⤵
  PID:1748
- C:\Windows\System\jSOPAVk.exe
  C:\Windows\System\jSOPAVk.exe
  2⤵
  PID:2428
- C:\Windows\System\OsRraPK.exe
  C:\Windows\System\OsRraPK.exe
  2⤵
  PID:472
- C:\Windows\System\TKsKglG.exe
  C:\Windows\System\TKsKglG.exe
  2⤵
  PID:2628
- C:\Windows\System\WtSQLSf.exe
  C:\Windows\System\WtSQLSf.exe
  2⤵
  PID:1804
- C:\Windows\System\NxnnSer.exe
  C:\Windows\System\NxnnSer.exe
  2⤵
  PID:1464
- C:\Windows\System\rfObqKH.exe
  C:\Windows\System\rfObqKH.exe
  2⤵
  PID:1832
- C:\Windows\System\mNGjuXl.exe
  C:\Windows\System\mNGjuXl.exe
  2⤵
  PID:828
- C:\Windows\System\rvASiiJ.exe
  C:\Windows\System\rvASiiJ.exe
  2⤵
  PID:1808
- C:\Windows\System\apQkpVX.exe
  C:\Windows\System\apQkpVX.exe
  2⤵
  PID:1828
- C:\Windows\System\RuubRwB.exe
  C:\Windows\System\RuubRwB.exe
  2⤵
  PID:1876
- C:\Windows\System\vwXLTdY.exe
  C:\Windows\System\vwXLTdY.exe
  2⤵
  PID:1240
- C:\Windows\System\AxVbZMB.exe
  C:\Windows\System\AxVbZMB.exe
  2⤵
  PID:2880
- C:\Windows\System\LjUHmEr.exe
  C:\Windows\System\LjUHmEr.exe
  2⤵
  PID:1796
- C:\Windows\System\OgxEcNT.exe
  C:\Windows\System\OgxEcNT.exe
  2⤵
  PID:1144
- C:\Windows\System\DCsPoDG.exe
  C:\Windows\System\DCsPoDG.exe
  2⤵
  PID:1072
- C:\Windows\System\VCHBRkW.exe
  C:\Windows\System\VCHBRkW.exe
  2⤵
  PID:564
- C:\Windows\System\YPAsWWK.exe
  C:\Windows\System\YPAsWWK.exe
  2⤵
  PID:2344
- C:\Windows\System\ENasQSJ.exe
  C:\Windows\System\ENasQSJ.exe
  2⤵
  PID:2000
- C:\Windows\System\MIsapNt.exe
  C:\Windows\System\MIsapNt.exe
  2⤵
  PID:284
- C:\Windows\System\mLdUxVw.exe
  C:\Windows\System\mLdUxVw.exe
  2⤵
  PID:1576
- C:\Windows\System\nplDCDC.exe
  C:\Windows\System\nplDCDC.exe
  2⤵
  PID:3064
- C:\Windows\System\UKAuVBT.exe
  C:\Windows\System\UKAuVBT.exe
  2⤵
  PID:2256
- C:\Windows\System\GPFszOa.exe
  C:\Windows\System\GPFszOa.exe
  2⤵
  PID:2676
- C:\Windows\System\pVrRqdL.exe
  C:\Windows\System\pVrRqdL.exe
  2⤵
  PID:2568
- C:\Windows\System\UFapnAa.exe
  C:\Windows\System\UFapnAa.exe
  2⤵
  PID:1532
- C:\Windows\System\mMGkAWh.exe
  C:\Windows\System\mMGkAWh.exe
  2⤵
  PID:2296
- C:\Windows\System\BpHURjK.exe
  C:\Windows\System\BpHURjK.exe
  2⤵
  PID:3040
- C:\Windows\System\GBxBNor.exe
  C:\Windows\System\GBxBNor.exe
  2⤵
  PID:2464
- C:\Windows\System\QLhJoqR.exe
  C:\Windows\System\QLhJoqR.exe
  2⤵
  PID:1516
- C:\Windows\System\JpiNENZ.exe
  C:\Windows\System\JpiNENZ.exe
  2⤵
  PID:1520
- C:\Windows\System\SaquOGN.exe
  C:\Windows\System\SaquOGN.exe
  2⤵
  PID:3000
- C:\Windows\System\vHsWcdG.exe
  C:\Windows\System\vHsWcdG.exe
  2⤵
  PID:2220
- C:\Windows\System\rUilKPT.exe
  C:\Windows\System\rUilKPT.exe
  2⤵
  PID:2888
- C:\Windows\System\OIeUoup.exe
  C:\Windows\System\OIeUoup.exe
  2⤵
  PID:1688
- C:\Windows\System\HXwExEt.exe
  C:\Windows\System\HXwExEt.exe
  2⤵
  PID:488
- C:\Windows\System\qjWDJzV.exe
  C:\Windows\System\qjWDJzV.exe
  2⤵
  PID:696
- C:\Windows\System\WpMscXg.exe
  C:\Windows\System\WpMscXg.exe
  2⤵
  PID:1028
- C:\Windows\System\emCMpIE.exe
  C:\Windows\System\emCMpIE.exe
  2⤵
  PID:1324
- C:\Windows\System\cjGFBVN.exe
  C:\Windows\System\cjGFBVN.exe
  2⤵
  PID:1064
- C:\Windows\System\EHvxaPQ.exe
  C:\Windows\System\EHvxaPQ.exe
  2⤵
  PID:2404
- C:\Windows\System\RzApfxB.exe
  C:\Windows\System\RzApfxB.exe
  2⤵
  PID:3076
- C:\Windows\System\AixCVfp.exe
  C:\Windows\System\AixCVfp.exe
  2⤵
  PID:3092
- C:\Windows\System\hZzjhqC.exe
  C:\Windows\System\hZzjhqC.exe
  2⤵
  PID:3108
- C:\Windows\System\koseOET.exe
  C:\Windows\System\koseOET.exe
  2⤵
  PID:3124
- C:\Windows\System\aWCByoC.exe
  C:\Windows\System\aWCByoC.exe
  2⤵
  PID:3156
- C:\Windows\System\KhgSqDe.exe
  C:\Windows\System\KhgSqDe.exe
  2⤵
  PID:3172
- C:\Windows\System\ejRZYcc.exe
  C:\Windows\System\ejRZYcc.exe
  2⤵
  PID:3188
- C:\Windows\System\argsAkT.exe
  C:\Windows\System\argsAkT.exe
  2⤵
  PID:3204
- C:\Windows\System\uCriKIj.exe
  C:\Windows\System\uCriKIj.exe
  2⤵
  PID:3220
- C:\Windows\System\eTkQLXH.exe
  C:\Windows\System\eTkQLXH.exe
  2⤵
  PID:3236
- C:\Windows\System\lwQRXmt.exe
  C:\Windows\System\lwQRXmt.exe
  2⤵
  PID:3252
- C:\Windows\System\aqsZLtc.exe
  C:\Windows\System\aqsZLtc.exe
  2⤵
  PID:3268
- C:\Windows\System\NUfIJTq.exe
  C:\Windows\System\NUfIJTq.exe
  2⤵
  PID:3284
- C:\Windows\System\iLVUcZI.exe
  C:\Windows\System\iLVUcZI.exe
  2⤵
  PID:3300
- C:\Windows\System\aSjkVRG.exe
  C:\Windows\System\aSjkVRG.exe
  2⤵
  PID:3316
- C:\Windows\System\FpGHVCV.exe
  C:\Windows\System\FpGHVCV.exe
  2⤵
  PID:3332
- C:\Windows\System\ZuCLvSq.exe
  C:\Windows\System\ZuCLvSq.exe
  2⤵
  PID:3348
- C:\Windows\System\WQTXewg.exe
  C:\Windows\System\WQTXewg.exe
  2⤵
  PID:3364
- C:\Windows\System\UtJjnWY.exe
  C:\Windows\System\UtJjnWY.exe
  2⤵
  PID:3380
- C:\Windows\System\AQumtgq.exe
  C:\Windows\System\AQumtgq.exe
  2⤵
  PID:3396
- C:\Windows\System\hRBMDEJ.exe
  C:\Windows\System\hRBMDEJ.exe
  2⤵
  PID:3412
- C:\Windows\System\OgHDbEJ.exe
  C:\Windows\System\OgHDbEJ.exe
  2⤵
  PID:3428
- C:\Windows\System\vdeMxtc.exe
  C:\Windows\System\vdeMxtc.exe
  2⤵
  PID:3444
- C:\Windows\System\YfyynDi.exe
  C:\Windows\System\YfyynDi.exe
  2⤵
  PID:3460
- C:\Windows\System\rAEjHlZ.exe
  C:\Windows\System\rAEjHlZ.exe
  2⤵
  PID:3476
- C:\Windows\System\NMEdEgi.exe
  C:\Windows\System\NMEdEgi.exe
  2⤵
  PID:3492
- C:\Windows\System\nzMiCEw.exe
  C:\Windows\System\nzMiCEw.exe
  2⤵
  PID:3508
- C:\Windows\System\LuKmcfk.exe
  C:\Windows\System\LuKmcfk.exe
  2⤵
  PID:3524
- C:\Windows\System\YMGFYVD.exe
  C:\Windows\System\YMGFYVD.exe
  2⤵
  PID:3716
- C:\Windows\System\mATomNH.exe
  C:\Windows\System\mATomNH.exe
  2⤵
  PID:3964
- C:\Windows\System\wIfvuFC.exe
  C:\Windows\System\wIfvuFC.exe
  2⤵
  PID:3984
- C:\Windows\System\rIDDBsN.exe
  C:\Windows\System\rIDDBsN.exe
  2⤵
  PID:4004
- C:\Windows\System\SyhMAXq.exe
  C:\Windows\System\SyhMAXq.exe
  2⤵
  PID:4024
- C:\Windows\System\IBWQwDa.exe
  C:\Windows\System\IBWQwDa.exe
  2⤵
  PID:4044
- C:\Windows\System\lVVVIEB.exe
  C:\Windows\System\lVVVIEB.exe
  2⤵
  PID:4060
- C:\Windows\System\pRAuTFf.exe
  C:\Windows\System\pRAuTFf.exe
  2⤵
  PID:4076
- C:\Windows\System\KCcfXbt.exe
  C:\Windows\System\KCcfXbt.exe
  2⤵
  PID:1600
- C:\Windows\System\KQyAROi.exe
  C:\Windows\System\KQyAROi.exe
  2⤵
  PID:952
- C:\Windows\System\nfNsPSE.exe
  C:\Windows\System\nfNsPSE.exe
  2⤵
  PID:3116
- C:\Windows\System\rfcwzNn.exe
  C:\Windows\System\rfcwzNn.exe
  2⤵
  PID:3196
- C:\Windows\System\yxzWDpC.exe
  C:\Windows\System\yxzWDpC.exe
  2⤵
  PID:3292
- C:\Windows\System\RufXcvX.exe
  C:\Windows\System\RufXcvX.exe
  2⤵
  PID:3356
- C:\Windows\System\NNdkxOQ.exe
  C:\Windows\System\NNdkxOQ.exe
  2⤵
  PID:3420
- C:\Windows\System\svSXFye.exe
  C:\Windows\System\svSXFye.exe
  2⤵
  PID:3488
- C:\Windows\System\rMBIBiW.exe
  C:\Windows\System\rMBIBiW.exe
  2⤵
  PID:3724
- C:\Windows\System\sCZPKhM.exe
  C:\Windows\System\sCZPKhM.exe
  2⤵
  PID:1292
- C:\Windows\System\rpYmbeW.exe
  C:\Windows\System\rpYmbeW.exe
  2⤵
  PID:2576
- C:\Windows\System\kgJehLP.exe
  C:\Windows\System\kgJehLP.exe
  2⤵
  PID:3752
- C:\Windows\System\iKkDMBz.exe
  C:\Windows\System\iKkDMBz.exe
  2⤵
  PID:584
- C:\Windows\System\yQHhsBH.exe
  C:\Windows\System\yQHhsBH.exe
  2⤵
  PID:3760
- C:\Windows\System\CLzxNZK.exe
  C:\Windows\System\CLzxNZK.exe
  2⤵
  PID:3788
- C:\Windows\System\nAaSSbE.exe
  C:\Windows\System\nAaSSbE.exe
  2⤵
  PID:3796
- C:\Windows\System\SSYYtEj.exe
  C:\Windows\System\SSYYtEj.exe
  2⤵
  PID:3816
- C:\Windows\System\pztRJaP.exe
  C:\Windows\System\pztRJaP.exe
  2⤵
  PID:3832
- C:\Windows\System\mmrWVTz.exe
  C:\Windows\System\mmrWVTz.exe
  2⤵
  PID:3848
- C:\Windows\System\ejtNvrP.exe
  C:\Windows\System\ejtNvrP.exe
  2⤵
  PID:3860
- C:\Windows\System\teZlIYL.exe
  C:\Windows\System\teZlIYL.exe
  2⤵
  PID:3884
- C:\Windows\System\rKJdhGP.exe
  C:\Windows\System\rKJdhGP.exe
  2⤵
  PID:3896
- C:\Windows\System\MJQiUaS.exe
  C:\Windows\System\MJQiUaS.exe
  2⤵
  PID:2080
- C:\Windows\System\cbmVxyj.exe
  C:\Windows\System\cbmVxyj.exe
  2⤵
  PID:1616
- C:\Windows\System\RsSvvYv.exe
  C:\Windows\System\RsSvvYv.exe
  2⤵
  PID:2660
- C:\Windows\System\YzYJxoz.exe
  C:\Windows\System\YzYJxoz.exe
  2⤵
  PID:2496
- C:\Windows\System\pbpuLVE.exe
  C:\Windows\System\pbpuLVE.exe
  2⤵
  PID:1016
- C:\Windows\System\UNWkbkV.exe
  C:\Windows\System\UNWkbkV.exe
  2⤵
  PID:2776
- C:\Windows\System\eptqEZZ.exe
  C:\Windows\System\eptqEZZ.exe
  2⤵
  PID:2040
- C:\Windows\System\iOFElnU.exe
  C:\Windows\System\iOFElnU.exe
  2⤵
  PID:2232
- C:\Windows\System\ySjBdBa.exe
  C:\Windows\System\ySjBdBa.exe
  2⤵
  PID:2328
- C:\Windows\System\RsVfxTs.exe
  C:\Windows\System\RsVfxTs.exe
  2⤵
  PID:1648
- C:\Windows\System\KXeFJmp.exe
  C:\Windows\System\KXeFJmp.exe
  2⤵
  PID:1820
- C:\Windows\System\iDYIoyJ.exe
  C:\Windows\System\iDYIoyJ.exe
  2⤵
  PID:3100
- C:\Windows\System\EaCtWeQ.exe
  C:\Windows\System\EaCtWeQ.exe
  2⤵
  PID:3180
- C:\Windows\System\vwvTuWG.exe
  C:\Windows\System\vwvTuWG.exe
  2⤵
  PID:3312
- C:\Windows\System\HADRDlt.exe
  C:\Windows\System\HADRDlt.exe
  2⤵
  PID:3404
- C:\Windows\System\YnFOjYn.exe
  C:\Windows\System\YnFOjYn.exe
  2⤵
  PID:3504
- C:\Windows\System\LKIiBWM.exe
  C:\Windows\System\LKIiBWM.exe
  2⤵
  PID:3552
- C:\Windows\System\yombexI.exe
  C:\Windows\System\yombexI.exe
  2⤵
  PID:3568
- C:\Windows\System\ZtNylEi.exe
  C:\Windows\System\ZtNylEi.exe
  2⤵
  PID:3588
- C:\Windows\System\VjTOBef.exe
  C:\Windows\System\VjTOBef.exe
  2⤵
  PID:3604
- C:\Windows\System\TdNbuaF.exe
  C:\Windows\System\TdNbuaF.exe
  2⤵
  PID:3632
- C:\Windows\System\UhUyWeZ.exe
  C:\Windows\System\UhUyWeZ.exe
  2⤵
  PID:3644
- C:\Windows\System\PQbbaBY.exe
  C:\Windows\System\PQbbaBY.exe
  2⤵
  PID:3660
- C:\Windows\System\mRqxzlt.exe
  C:\Windows\System\mRqxzlt.exe
  2⤵
  PID:3680
- C:\Windows\System\PvaUusG.exe
  C:\Windows\System\PvaUusG.exe
  2⤵
  PID:3700
- C:\Windows\System\IAtMsFR.exe
  C:\Windows\System\IAtMsFR.exe
  2⤵
  PID:1308
- C:\Windows\System\hSNubdI.exe
  C:\Windows\System\hSNubdI.exe
  2⤵
  PID:3952
- C:\Windows\System\iseyCwT.exe
  C:\Windows\System\iseyCwT.exe
  2⤵
  PID:3980
- C:\Windows\System\xhnHLas.exe
  C:\Windows\System\xhnHLas.exe
  2⤵
  PID:2668
- C:\Windows\System\NbNOtyJ.exe
  C:\Windows\System\NbNOtyJ.exe
  2⤵
  PID:4016
- C:\Windows\System\wdIDhTX.exe
  C:\Windows\System\wdIDhTX.exe
  2⤵
  PID:4068
- C:\Windows\System\PIIqYPZ.exe
  C:\Windows\System\PIIqYPZ.exe
  2⤵
  PID:1236
- C:\Windows\System\QjzebxJ.exe
  C:\Windows\System\QjzebxJ.exe
  2⤵
  PID:3164
- C:\Windows\System\vprHzaf.exe
  C:\Windows\System\vprHzaf.exe
  2⤵
  PID:608
- C:\Windows\System\jLXdnEp.exe
  C:\Windows\System\jLXdnEp.exe
  2⤵
  PID:3456
- C:\Windows\System\rhOcOZY.exe
  C:\Windows\System\rhOcOZY.exe
  2⤵
  PID:3232
- C:\Windows\System\tghKpSV.exe
  C:\Windows\System\tghKpSV.exe
  2⤵
  PID:3388
- C:\Windows\System\csKgwfC.exe
  C:\Windows\System\csKgwfC.exe
  2⤵
  PID:1696
- C:\Windows\System\UlaADTv.exe
  C:\Windows\System\UlaADTv.exe
  2⤵
  PID:1920
- C:\Windows\System\KFYXMRt.exe
  C:\Windows\System\KFYXMRt.exe
  2⤵
  PID:3728
- C:\Windows\System\ZemvEAw.exe
  C:\Windows\System\ZemvEAw.exe
  2⤵
  PID:1584
- C:\Windows\System\adHcKqz.exe
  C:\Windows\System\adHcKqz.exe
  2⤵
  PID:1172
- C:\Windows\System\zdwWdhq.exe
  C:\Windows\System\zdwWdhq.exe
  2⤵
  PID:3792
- C:\Windows\System\DkakZcJ.exe
  C:\Windows\System\DkakZcJ.exe
  2⤵
  PID:3776
- C:\Windows\System\jEiAIIC.exe
  C:\Windows\System\jEiAIIC.exe
  2⤵
  PID:3856
- C:\Windows\System\HfdicYc.exe
  C:\Windows\System\HfdicYc.exe
  2⤵
  PID:1644
- C:\Windows\System\xDFOlKO.exe
  C:\Windows\System\xDFOlKO.exe
  2⤵
  PID:3812
- C:\Windows\System\pdjkvoQ.exe
  C:\Windows\System\pdjkvoQ.exe
  2⤵
  PID:2980
- C:\Windows\System\YNAeURT.exe
  C:\Windows\System\YNAeURT.exe
  2⤵
  PID:3876
- C:\Windows\System\LxcRiWn.exe
  C:\Windows\System\LxcRiWn.exe
  2⤵
  PID:2816
- C:\Windows\System\zRxLVFJ.exe
  C:\Windows\System\zRxLVFJ.exe
  2⤵
  PID:2188
- C:\Windows\System\RacFPfR.exe
  C:\Windows\System\RacFPfR.exe
  2⤵
  PID:876
- C:\Windows\System\TBgbJdM.exe
  C:\Windows\System\TBgbJdM.exe
  2⤵
  PID:2292
- C:\Windows\System\BJyvwiX.exe
  C:\Windows\System\BJyvwiX.exe
  2⤵
  PID:3028
- C:\Windows\System\RZJMhSg.exe
  C:\Windows\System\RZJMhSg.exe
  2⤵
  PID:2868
- C:\Windows\System\lWAvCvG.exe
  C:\Windows\System\lWAvCvG.exe
  2⤵
  PID:3308
- C:\Windows\System\UZdWEAy.exe
  C:\Windows\System\UZdWEAy.exe
  2⤵
  PID:2388
- C:\Windows\System\GsndVNu.exe
  C:\Windows\System\GsndVNu.exe
  2⤵
  PID:3500
- C:\Windows\System\gxgyMEA.exe
  C:\Windows\System\gxgyMEA.exe
  2⤵
  PID:2044
- C:\Windows\System\tIUxSNq.exe
  C:\Windows\System\tIUxSNq.exe
  2⤵
  PID:3560
- C:\Windows\System\NobcXcF.exe
  C:\Windows\System\NobcXcF.exe
  2⤵
  PID:3636
- C:\Windows\System\CSNtanI.exe
  C:\Windows\System\CSNtanI.exe
  2⤵
  PID:3672
- C:\Windows\System\ueSReyX.exe
  C:\Windows\System\ueSReyX.exe
  2⤵
  PID:1772
- C:\Windows\System\fdBZIVH.exe
  C:\Windows\System\fdBZIVH.exe
  2⤵
  PID:2644
- C:\Windows\System\yzawzNl.exe
  C:\Windows\System\yzawzNl.exe
  2⤵
  PID:3972
- C:\Windows\System\eJnhzxA.exe
  C:\Windows\System\eJnhzxA.exe
  2⤵
  PID:4088
- C:\Windows\System\IQcXbIh.exe
  C:\Windows\System\IQcXbIh.exe
  2⤵
  PID:3392
- C:\Windows\System\oPVxYUb.exe
  C:\Windows\System\oPVxYUb.exe
  2⤵
  PID:2276
- C:\Windows\System\DAuaCPD.exe
  C:\Windows\System\DAuaCPD.exe
  2⤵
  PID:4104
- C:\Windows\System\OTfvcJq.exe
  C:\Windows\System\OTfvcJq.exe
  2⤵
  PID:4124
- C:\Windows\System\ISIMBza.exe
  C:\Windows\System\ISIMBza.exe
  2⤵
  PID:4140
- C:\Windows\System\hickKzv.exe
  C:\Windows\System\hickKzv.exe
  2⤵
  PID:4156
- C:\Windows\System\RaNDxSe.exe
  C:\Windows\System\RaNDxSe.exe
  2⤵
  PID:4172
- C:\Windows\System\VVquadQ.exe
  C:\Windows\System\VVquadQ.exe
  2⤵
  PID:4188
- C:\Windows\System\CgrveoU.exe
  C:\Windows\System\CgrveoU.exe
  2⤵
  PID:4204
- C:\Windows\System\kLbqnHZ.exe
  C:\Windows\System\kLbqnHZ.exe
  2⤵
  PID:4220
- C:\Windows\System\BKpHSDm.exe
  C:\Windows\System\BKpHSDm.exe
  2⤵
  PID:4236
- C:\Windows\System\eQpGnSh.exe
  C:\Windows\System\eQpGnSh.exe
  2⤵
  PID:4252
- C:\Windows\System\NBSMIyw.exe
  C:\Windows\System\NBSMIyw.exe
  2⤵
  PID:4268
- C:\Windows\System\uJqSEoJ.exe
  C:\Windows\System\uJqSEoJ.exe
  2⤵
  PID:4284
- C:\Windows\System\zQnumzk.exe
  C:\Windows\System\zQnumzk.exe
  2⤵
  PID:4308
- C:\Windows\System\mMIQixq.exe
  C:\Windows\System\mMIQixq.exe
  2⤵
  PID:4324
- C:\Windows\System\FOYveog.exe
  C:\Windows\System\FOYveog.exe
  2⤵
  PID:4340
- C:\Windows\System\ZeQgJYz.exe
  C:\Windows\System\ZeQgJYz.exe
  2⤵
  PID:4356
- C:\Windows\System\ztzQpCq.exe
  C:\Windows\System\ztzQpCq.exe
  2⤵
  PID:4372
- C:\Windows\System\aQYdjMi.exe
  C:\Windows\System\aQYdjMi.exe
  2⤵
  PID:4388
- C:\Windows\System\vVTDpVt.exe
  C:\Windows\System\vVTDpVt.exe
  2⤵
  PID:4404
- C:\Windows\System\NryoaMQ.exe
  C:\Windows\System\NryoaMQ.exe
  2⤵
  PID:4420
- C:\Windows\System\MgaRJAh.exe
  C:\Windows\System\MgaRJAh.exe
  2⤵
  PID:4436
- C:\Windows\System\YYNBspL.exe
  C:\Windows\System\YYNBspL.exe
  2⤵
  PID:4452
- C:\Windows\System\NMRbcxe.exe
  C:\Windows\System\NMRbcxe.exe
  2⤵
  PID:4468
- C:\Windows\System\TSzwgdG.exe
  C:\Windows\System\TSzwgdG.exe
  2⤵
  PID:4484
- C:\Windows\System\SRAsTiW.exe
  C:\Windows\System\SRAsTiW.exe
  2⤵
  PID:4500
- C:\Windows\System\omiWMTN.exe
  C:\Windows\System\omiWMTN.exe
  2⤵
  PID:4516
- C:\Windows\System\Pxvzvxm.exe
  C:\Windows\System\Pxvzvxm.exe
  2⤵
  PID:4532
- C:\Windows\System\pmoxSav.exe
  C:\Windows\System\pmoxSav.exe
  2⤵
  PID:4548
- C:\Windows\System\EiYTQmE.exe
  C:\Windows\System\EiYTQmE.exe
  2⤵
  PID:4564
- C:\Windows\System\rpIinEm.exe
  C:\Windows\System\rpIinEm.exe
  2⤵
  PID:4580
- C:\Windows\System\CYTrQyy.exe
  C:\Windows\System\CYTrQyy.exe
  2⤵
  PID:4596
- C:\Windows\System\apFxxey.exe
  C:\Windows\System\apFxxey.exe
  2⤵
  PID:4612
- C:\Windows\System\OpLftqT.exe
  C:\Windows\System\OpLftqT.exe
  2⤵
  PID:4628
- C:\Windows\System\jrPxbzA.exe
  C:\Windows\System\jrPxbzA.exe
  2⤵
  PID:4648
- C:\Windows\System\vsEAWfY.exe
  C:\Windows\System\vsEAWfY.exe
  2⤵
  PID:4664
- C:\Windows\System\tqacGWj.exe
  C:\Windows\System\tqacGWj.exe
  2⤵
  PID:4684
- C:\Windows\System\PGpGUmG.exe
  C:\Windows\System\PGpGUmG.exe
  2⤵
  PID:4700
- C:\Windows\System\DfrUwmm.exe
  C:\Windows\System\DfrUwmm.exe
  2⤵
  PID:4716
- C:\Windows\System\pxBHVOO.exe
  C:\Windows\System\pxBHVOO.exe
  2⤵
  PID:4732
- C:\Windows\System\iOklhHV.exe
  C:\Windows\System\iOklhHV.exe
  2⤵
  PID:4768
- C:\Windows\System\KfFVDUe.exe
  C:\Windows\System\KfFVDUe.exe
  2⤵
  PID:4784
- C:\Windows\System\wrrtCQq.exe
  C:\Windows\System\wrrtCQq.exe
  2⤵
  PID:4800
- C:\Windows\System\nYxNlUX.exe
  C:\Windows\System\nYxNlUX.exe
  2⤵
  PID:4816
- C:\Windows\System\pJljPfT.exe
  C:\Windows\System\pJljPfT.exe
  2⤵
  PID:4840
- C:\Windows\System\oXWZzgn.exe
  C:\Windows\System\oXWZzgn.exe
  2⤵
  PID:4856
- C:\Windows\System\MTfEFiv.exe
  C:\Windows\System\MTfEFiv.exe
  2⤵
  PID:4872
- C:\Windows\System\nXWxsHH.exe
  C:\Windows\System\nXWxsHH.exe
  2⤵
  PID:4888
- C:\Windows\System\gouzHBD.exe
  C:\Windows\System\gouzHBD.exe
  2⤵
  PID:4904
- C:\Windows\System\TZFptLE.exe
  C:\Windows\System\TZFptLE.exe
  2⤵
  PID:4920
- C:\Windows\System\PupsSDA.exe
  C:\Windows\System\PupsSDA.exe
  2⤵
  PID:4944
- C:\Windows\System\yDVOZZz.exe
  C:\Windows\System\yDVOZZz.exe
  2⤵
  PID:4972
- C:\Windows\System\lULIFQZ.exe
  C:\Windows\System\lULIFQZ.exe
  2⤵
  PID:4988
- C:\Windows\System\YNyciZz.exe
  C:\Windows\System\YNyciZz.exe
  2⤵
  PID:5004
- C:\Windows\System\qZJzCjI.exe
  C:\Windows\System\qZJzCjI.exe
  2⤵
  PID:5020
- C:\Windows\System\JWAdQQv.exe
  C:\Windows\System\JWAdQQv.exe
  2⤵
  PID:5036
- C:\Windows\System\UFpSuEZ.exe
  C:\Windows\System\UFpSuEZ.exe
  2⤵
  PID:5052
- C:\Windows\System\MfBbesM.exe
  C:\Windows\System\MfBbesM.exe
  2⤵
  PID:5068
- C:\Windows\System\MhQpodv.exe
  C:\Windows\System\MhQpodv.exe
  2⤵
  PID:5084
- C:\Windows\System\npaFUpg.exe
  C:\Windows\System\npaFUpg.exe
  2⤵
  PID:5100
- C:\Windows\System\TOyqowW.exe
  C:\Windows\System\TOyqowW.exe
  2⤵
  PID:5116
- C:\Windows\System\WbiXGQY.exe
  C:\Windows\System\WbiXGQY.exe
  2⤵
  PID:2272
- C:\Windows\System\InVjibI.exe
  C:\Windows\System\InVjibI.exe
  2⤵
  PID:2572
- C:\Windows\System\CJguUYB.exe
  C:\Windows\System\CJguUYB.exe
  2⤵
  PID:3468
- C:\Windows\System\taRWkur.exe
  C:\Windows\System\taRWkur.exe
  2⤵
  PID:4152
- C:\Windows\System\wpyUbNg.exe
  C:\Windows\System\wpyUbNg.exe
  2⤵
  PID:4276
- C:\Windows\System\ibfKYYA.exe
  C:\Windows\System\ibfKYYA.exe
  2⤵
  PID:4792
- C:\Windows\System\EGSyZaz.exe
  C:\Windows\System\EGSyZaz.exe
  2⤵
  PID:4832
- C:\Windows\System\CMJStmU.exe
  C:\Windows\System\CMJStmU.exe
  2⤵
  PID:4896
- C:\Windows\System\ilOWdQo.exe
  C:\Windows\System\ilOWdQo.exe
  2⤵
  PID:4940
- C:\Windows\System\CoYLQGm.exe
  C:\Windows\System\CoYLQGm.exe
  2⤵
  PID:5016
- C:\Windows\System\xLkvBko.exe
  C:\Windows\System\xLkvBko.exe
  2⤵
  PID:5080
- C:\Windows\System\YrBJFRJ.exe
  C:\Windows\System\YrBJFRJ.exe
  2⤵
  PID:3576
- C:\Windows\System\ifLArEE.exe
  C:\Windows\System\ifLArEE.exe
  2⤵
  PID:3344
- C:\Windows\System\GTpsIyu.exe
  C:\Windows\System\GTpsIyu.exe
  2⤵
  PID:1712
- C:\Windows\System\BmYfFMz.exe
  C:\Windows\System\BmYfFMz.exe
  2⤵
  PID:4036
- C:\Windows\System\svswrCa.exe
  C:\Windows\System\svswrCa.exe
  2⤵
  PID:3748
- C:\Windows\System\YAwDfdY.exe
  C:\Windows\System\YAwDfdY.exe
  2⤵
  PID:3540
- C:\Windows\System\mxvSDcL.exe
  C:\Windows\System\mxvSDcL.exe
  2⤵
  PID:1108
- C:\Windows\System\ocjJJHt.exe
  C:\Windows\System\ocjJJHt.exe
  2⤵
  PID:1188
- C:\Windows\System\HsXRtvz.exe
  C:\Windows\System\HsXRtvz.exe
  2⤵
  PID:1296
- C:\Windows\System\Lamgtuy.exe
  C:\Windows\System\Lamgtuy.exe
  2⤵
  PID:3612
- C:\Windows\System\ZXnEXvD.exe
  C:\Windows\System\ZXnEXvD.exe
  2⤵
  PID:3920
- C:\Windows\System\VMyzXng.exe
  C:\Windows\System\VMyzXng.exe
  2⤵
  PID:4020
- C:\Windows\System\AiGOibu.exe
  C:\Windows\System\AiGOibu.exe
  2⤵
  PID:3084
- C:\Windows\System\fUxiTVc.exe
  C:\Windows\System\fUxiTVc.exe
  2⤵
  PID:3264
- C:\Windows\System\PyRoVvY.exe
  C:\Windows\System\PyRoVvY.exe
  2⤵
  PID:2996
- C:\Windows\System\IHRxnte.exe
  C:\Windows\System\IHRxnte.exe
  2⤵
  PID:2380
- C:\Windows\System\DUoLCHe.exe
  C:\Windows\System\DUoLCHe.exe
  2⤵
  PID:2640
- C:\Windows\System\rnijllz.exe
  C:\Windows\System\rnijllz.exe
  2⤵
  PID:2688
- C:\Windows\System\VXKFSBp.exe
  C:\Windows\System\VXKFSBp.exe
  2⤵
  PID:2632
- C:\Windows\System\HYkHBRZ.exe
  C:\Windows\System\HYkHBRZ.exe
  2⤵
  PID:3712
- C:\Windows\System\nlBNVTz.exe
  C:\Windows\System\nlBNVTz.exe
  2⤵
  PID:3132
- C:\Windows\System\wcYkpIP.exe
  C:\Windows\System\wcYkpIP.exe
  2⤵
  PID:3828
- C:\Windows\System\GWOAFGK.exe
  C:\Windows\System\GWOAFGK.exe
  2⤵
  PID:3548
- C:\Windows\System\UxVrzDe.exe
  C:\Windows\System\UxVrzDe.exe
  2⤵
  PID:4164
- C:\Windows\System\GsFewAU.exe
  C:\Windows\System\GsFewAU.exe
  2⤵
  PID:4232
- C:\Windows\System\rMPFrVX.exe
  C:\Windows\System\rMPFrVX.exe
  2⤵
  PID:4292
- C:\Windows\System\LtGmRgW.exe
  C:\Windows\System\LtGmRgW.exe
  2⤵
  PID:4336
- C:\Windows\System\IxyMglF.exe
  C:\Windows\System\IxyMglF.exe
  2⤵
  PID:4728
- C:\Windows\System\CMtAeOD.exe
  C:\Windows\System\CMtAeOD.exe
  2⤵
  PID:4528
- C:\Windows\System\SJbUTUm.exe
  C:\Windows\System\SJbUTUm.exe
  2⤵
  PID:2932
- C:\Windows\System\jCfDPAX.exe
  C:\Windows\System\jCfDPAX.exe
  2⤵
  PID:4508
- C:\Windows\System\WrvSiWY.exe
  C:\Windows\System\WrvSiWY.exe
  2⤵
  PID:2264
- C:\Windows\System\LEFeJDu.exe
  C:\Windows\System\LEFeJDu.exe
  2⤵
  PID:2616
- C:\Windows\System\VTAMDsU.exe
  C:\Windows\System\VTAMDsU.exe
  2⤵
  PID:4756
- C:\Windows\System\fdNgDtV.exe
  C:\Windows\System\fdNgDtV.exe
  2⤵
  PID:4864
- C:\Windows\System\yLgwizI.exe
  C:\Windows\System\yLgwizI.exe
  2⤵
  PID:5112
- C:\Windows\System\IiDNtWl.exe
  C:\Windows\System\IiDNtWl.exe
  2⤵
  PID:4932
- C:\Windows\System\vxfwuVL.exe
  C:\Windows\System\vxfwuVL.exe
  2⤵
  PID:5076
- C:\Windows\System\yueCJgm.exe
  C:\Windows\System\yueCJgm.exe
  2⤵
  PID:992
- C:\Windows\System\qqssYrn.exe
  C:\Windows\System\qqssYrn.exe
  2⤵
  PID:4116
- C:\Windows\System\FizoztK.exe
  C:\Windows\System\FizoztK.exe
  2⤵
  PID:2064
- C:\Windows\System\OPapeED.exe
  C:\Windows\System\OPapeED.exe
  2⤵
  PID:3324
- C:\Windows\System\PKoFAga.exe
  C:\Windows\System\PKoFAga.exe
  2⤵
  PID:2648
- C:\Windows\System\AdrkipF.exe
  C:\Windows\System\AdrkipF.exe
  2⤵
  PID:540
- C:\Windows\System\LERLHYS.exe
  C:\Windows\System\LERLHYS.exe
  2⤵
  PID:3624
- C:\Windows\System\yJKZBel.exe
  C:\Windows\System\yJKZBel.exe
  2⤵
  PID:1628
- C:\Windows\System\RfQXtXs.exe
  C:\Windows\System\RfQXtXs.exe
  2⤵
  PID:3544
- C:\Windows\System\ishvmTw.exe
  C:\Windows\System\ishvmTw.exe
  2⤵
  PID:3372
- C:\Windows\System\cgkfdMh.exe
  C:\Windows\System\cgkfdMh.exe
  2⤵
  PID:3824
- C:\Windows\System\fbHZCie.exe
  C:\Windows\System\fbHZCie.exe
  2⤵
  PID:4132
- C:\Windows\System\HaJMZrR.exe
  C:\Windows\System\HaJMZrR.exe
  2⤵
  PID:4296
- C:\Windows\System\CAhRtpS.exe
  C:\Windows\System\CAhRtpS.exe
  2⤵
  PID:4496
- C:\Windows\System\GHnKahI.exe
  C:\Windows\System\GHnKahI.exe
  2⤵
  PID:4744
- C:\Windows\System\PDadRpz.exe
  C:\Windows\System\PDadRpz.exe
  2⤵
  PID:4524
- C:\Windows\System\ZLcrvYy.exe
  C:\Windows\System\ZLcrvYy.exe
  2⤵
  PID:4620
- C:\Windows\System\IHTjIWk.exe
  C:\Windows\System\IHTjIWk.exe
  2⤵
  PID:4780
- C:\Windows\System\YFjHyBf.exe
  C:\Windows\System\YFjHyBf.exe
  2⤵
  PID:2368
- C:\Windows\System\cEAMBqk.exe
  C:\Windows\System\cEAMBqk.exe
  2⤵
  PID:4348
- C:\Windows\System\TrqBknX.exe
  C:\Windows\System\TrqBknX.exe
  2⤵
  PID:4384
- C:\Windows\System\yxXcKbN.exe
  C:\Windows\System\yxXcKbN.exe
  2⤵
  PID:4960
- C:\Windows\System\YDOipQo.exe
  C:\Windows\System\YDOipQo.exe
  2⤵
  PID:5060
- C:\Windows\System\YsBMgjR.exe
  C:\Windows\System\YsBMgjR.exe
  2⤵
  PID:3216
- C:\Windows\System\GXXnUHa.exe
  C:\Windows\System\GXXnUHa.exe
  2⤵
  PID:4168
- C:\Windows\System\rgmBRsg.exe
  C:\Windows\System\rgmBRsg.exe
  2⤵
  PID:1676
- C:\Windows\System\GqpfKLH.exe
  C:\Windows\System\GqpfKLH.exe
  2⤵
  PID:4848
- C:\Windows\System\vJnSOLA.exe
  C:\Windows\System\vJnSOLA.exe
  2⤵
  PID:4956
- C:\Windows\System\btYrFUv.exe
  C:\Windows\System\btYrFUv.exe
  2⤵
  PID:5092
- C:\Windows\System\jpRjFkv.exe
  C:\Windows\System\jpRjFkv.exe
  2⤵
  PID:4476
- C:\Windows\System\lbiZjBZ.exe
  C:\Windows\System\lbiZjBZ.exe
  2⤵
  PID:4248
- C:\Windows\System\fsMrnEA.exe
  C:\Windows\System\fsMrnEA.exe
  2⤵
  PID:2072
- C:\Windows\System\RLbDGSf.exe
  C:\Windows\System\RLbDGSf.exe
  2⤵
  PID:4644
- C:\Windows\System\nkjuCqZ.exe
  C:\Windows\System\nkjuCqZ.exe
  2⤵
  PID:2684
- C:\Windows\System\eRxvNzY.exe
  C:\Windows\System\eRxvNzY.exe
  2⤵
  PID:1148
- C:\Windows\System\ycyhrYM.exe
  C:\Windows\System\ycyhrYM.exe
  2⤵
  PID:3772
- C:\Windows\System\aIMnHOd.exe
  C:\Windows\System\aIMnHOd.exe
  2⤵
  PID:3228
- C:\Windows\System\oPUXxRn.exe
  C:\Windows\System\oPUXxRn.exe
  2⤵
  PID:1120
- C:\Windows\System\SSUSwBy.exe
  C:\Windows\System\SSUSwBy.exe
  2⤵
  PID:2736
- C:\Windows\System\cviseLo.exe
  C:\Windows\System\cviseLo.exe
  2⤵
  PID:4636
- C:\Windows\System\CZuQcGz.exe
  C:\Windows\System\CZuQcGz.exe
  2⤵
  PID:4672
- C:\Windows\System\KsvWITF.exe
  C:\Windows\System\KsvWITF.exe
  2⤵
  PID:4680
- C:\Windows\System\AVPlLGu.exe
  C:\Windows\System\AVPlLGu.exe
  2⤵
  PID:2580
- C:\Windows\System\IxZYhvr.exe
  C:\Windows\System\IxZYhvr.exe
  2⤵
  PID:3564
- C:\Windows\System\nIAtjTv.exe
  C:\Windows\System\nIAtjTv.exe
  2⤵
  PID:4712
- C:\Windows\System\pawcaud.exe
  C:\Windows\System\pawcaud.exe
  2⤵
  PID:4656
- C:\Windows\System\sJfsyMm.exe
  C:\Windows\System\sJfsyMm.exe
  2⤵
  PID:2524
- C:\Windows\System\TNXoxUf.exe
  C:\Windows\System\TNXoxUf.exe
  2⤵
  PID:4880
- C:\Windows\System\xlpLFbO.exe
  C:\Windows\System\xlpLFbO.exe
  2⤵
  PID:4228
- C:\Windows\System\mAXdbHM.exe
  C:\Windows\System\mAXdbHM.exe
  2⤵
  PID:2364
- C:\Windows\System\AqJDDkD.exe
  C:\Windows\System\AqJDDkD.exe
  2⤵
  PID:4592
- C:\Windows\System\Pnuzugz.exe
  C:\Windows\System\Pnuzugz.exe
  2⤵
  PID:5032
- C:\Windows\System\VeQPCaZ.exe
  C:\Windows\System\VeQPCaZ.exe
  2⤵
  PID:4952
- C:\Windows\System\POKQqMY.exe
  C:\Windows\System\POKQqMY.exe
  2⤵
  PID:5096
- C:\Windows\System\MYIVDOa.exe
  C:\Windows\System\MYIVDOa.exe
  2⤵
  PID:2808
- C:\Windows\System\DOEyCDq.exe
  C:\Windows\System\DOEyCDq.exe
  2⤵
  PID:4824
- C:\Windows\System\HXILnSz.exe
  C:\Windows\System\HXILnSz.exe
  2⤵
  PID:2320
- C:\Windows\System\eiWDKld.exe
  C:\Windows\System\eiWDKld.exe
  2⤵
  PID:4760
- C:\Windows\System\dIRiwdz.exe
  C:\Windows\System\dIRiwdz.exe
  2⤵
  PID:4968
- C:\Windows\System\oYYmhfC.exe
  C:\Windows\System\oYYmhfC.exe
  2⤵
  PID:4448
- C:\Windows\System\zDBPfvg.exe
  C:\Windows\System\zDBPfvg.exe
  2⤵
  PID:4608
- C:\Windows\System\maCsWbi.exe
  C:\Windows\System\maCsWbi.exe
  2⤵
  PID:3168
- C:\Windows\System\zheIAXm.exe
  C:\Windows\System\zheIAXm.exe
  2⤵
  PID:4032
- C:\Windows\System\yfSKMfE.exe
  C:\Windows\System\yfSKMfE.exe
  2⤵
  PID:4696
- C:\Windows\System\TjiKTFL.exe
  C:\Windows\System\TjiKTFL.exe
  2⤵
  PID:3328
- C:\Windows\System\VWiGdne.exe
  C:\Windows\System\VWiGdne.exe
  2⤵
  PID:3656
- C:\Windows\System\HLOuvNt.exe
  C:\Windows\System\HLOuvNt.exe
  2⤵
  PID:4604
- C:\Windows\System\qiIslsN.exe
  C:\Windows\System\qiIslsN.exe
  2⤵
  PID:4332
- C:\Windows\System\NxQqeGw.exe
  C:\Windows\System\NxQqeGw.exe
  2⤵
  PID:348
- C:\Windows\System\AxQvaiF.exe
  C:\Windows\System\AxQvaiF.exe
  2⤵
  PID:5000
- C:\Windows\System\tIpkNYS.exe
  C:\Windows\System\tIpkNYS.exe
  2⤵
  PID:4576
- C:\Windows\System\JgwbWVj.exe
  C:\Windows\System\JgwbWVj.exe
  2⤵
  PID:2100
- C:\Windows\System\ELPtgnb.exe
  C:\Windows\System\ELPtgnb.exe
  2⤵
  PID:4964
- C:\Windows\System\yDHqhpl.exe
  C:\Windows\System\yDHqhpl.exe
  2⤵
  PID:356
- C:\Windows\System\KibPFuZ.exe
  C:\Windows\System\KibPFuZ.exe
  2⤵
  PID:4692
- C:\Windows\System\NdCNAMP.exe
  C:\Windows\System\NdCNAMP.exe
  2⤵
  PID:3676
- C:\Windows\System\sTtczuZ.exe
  C:\Windows\System\sTtczuZ.exe
  2⤵
  PID:4428
- C:\Windows\System\Tqauyvc.exe
  C:\Windows\System\Tqauyvc.exe
  2⤵
  PID:4460
- C:\Windows\System\VutQmls.exe
  C:\Windows\System\VutQmls.exe
  2⤵
  PID:4120
- C:\Windows\System\vynkfUv.exe
  C:\Windows\System\vynkfUv.exe
  2⤵
  PID:5124
- C:\Windows\System\SQvqhBv.exe
  C:\Windows\System\SQvqhBv.exe
  2⤵
  PID:5140
- C:\Windows\System\CzYjhoe.exe
  C:\Windows\System\CzYjhoe.exe
  2⤵
  PID:5156
- C:\Windows\System\lmkgdZx.exe
  C:\Windows\System\lmkgdZx.exe
  2⤵
  PID:5172
- C:\Windows\System\QFCSZib.exe
  C:\Windows\System\QFCSZib.exe
  2⤵
  PID:5188
- C:\Windows\System\CNwpskG.exe
  C:\Windows\System\CNwpskG.exe
  2⤵
  PID:5204
- C:\Windows\System\KMmbtkw.exe
  C:\Windows\System\KMmbtkw.exe
  2⤵
  PID:5220
- C:\Windows\System\xLghotm.exe
  C:\Windows\System\xLghotm.exe
  2⤵
  PID:5236
- C:\Windows\System\PhbrTzk.exe
  C:\Windows\System\PhbrTzk.exe
  2⤵
  PID:5252
- C:\Windows\System\VkrANqa.exe
  C:\Windows\System\VkrANqa.exe
  2⤵
  PID:5268
- C:\Windows\System\SxNZTPe.exe
  C:\Windows\System\SxNZTPe.exe
  2⤵
  PID:5284
- C:\Windows\System\tNUinzo.exe
  C:\Windows\System\tNUinzo.exe
  2⤵
  PID:5300
- C:\Windows\System\XhjnDOS.exe
  C:\Windows\System\XhjnDOS.exe
  2⤵
  PID:5316
- C:\Windows\System\HzZeFCQ.exe
  C:\Windows\System\HzZeFCQ.exe
  2⤵
  PID:5332
- C:\Windows\System\bPcmZlr.exe
  C:\Windows\System\bPcmZlr.exe
  2⤵
  PID:5348
- C:\Windows\System\OkZDyuH.exe
  C:\Windows\System\OkZDyuH.exe
  2⤵
  PID:5364
- C:\Windows\System\YOGErtS.exe
  C:\Windows\System\YOGErtS.exe
  2⤵
  PID:5380
- C:\Windows\System\QeXmfzR.exe
  C:\Windows\System\QeXmfzR.exe
  2⤵
  PID:5396
- C:\Windows\System\ecYJxTP.exe
  C:\Windows\System\ecYJxTP.exe
  2⤵
  PID:5412
- C:\Windows\System\biypoYK.exe
  C:\Windows\System\biypoYK.exe
  2⤵
  PID:5472
- C:\Windows\System\dMehnWW.exe
  C:\Windows\System\dMehnWW.exe
  2⤵
  PID:5512
- C:\Windows\System\IsQrCMb.exe
  C:\Windows\System\IsQrCMb.exe
  2⤵
  PID:5532
- C:\Windows\System\hqkbjdD.exe
  C:\Windows\System\hqkbjdD.exe
  2⤵
  PID:5548
- C:\Windows\System\MfFQHlN.exe
  C:\Windows\System\MfFQHlN.exe
  2⤵
  PID:5564
- C:\Windows\System\aWtlfHZ.exe
  C:\Windows\System\aWtlfHZ.exe
  2⤵
  PID:5580
- C:\Windows\System\VtXHZDJ.exe
  C:\Windows\System\VtXHZDJ.exe
  2⤵
  PID:5596
- C:\Windows\System\NxxdKlH.exe
  C:\Windows\System\NxxdKlH.exe
  2⤵
  PID:5612
- C:\Windows\System\GhcMBSz.exe
  C:\Windows\System\GhcMBSz.exe
  2⤵
  PID:5628
- C:\Windows\System\wtALKRV.exe
  C:\Windows\System\wtALKRV.exe
  2⤵
  PID:5648
- C:\Windows\System\DBGCgHQ.exe
  C:\Windows\System\DBGCgHQ.exe
  2⤵
  PID:5664
- C:\Windows\System\Bzjwbcy.exe
  C:\Windows\System\Bzjwbcy.exe
  2⤵
  PID:5680
- C:\Windows\System\heZlJoQ.exe
  C:\Windows\System\heZlJoQ.exe
  2⤵
  PID:5696
- C:\Windows\System\vOotxpX.exe
  C:\Windows\System\vOotxpX.exe
  2⤵
  PID:5712
- C:\Windows\System\AYoYaqY.exe
  C:\Windows\System\AYoYaqY.exe
  2⤵
  PID:5728
- C:\Windows\System\wwqtJip.exe
  C:\Windows\System\wwqtJip.exe
  2⤵
  PID:5748
- C:\Windows\System\HXbsNxr.exe
  C:\Windows\System\HXbsNxr.exe
  2⤵
  PID:5764
- C:\Windows\System\boHubBM.exe
  C:\Windows\System\boHubBM.exe
  2⤵
  PID:5780
- C:\Windows\System\dqhZoth.exe
  C:\Windows\System\dqhZoth.exe
  2⤵
  PID:5796
- C:\Windows\System\DulIEQr.exe
  C:\Windows\System\DulIEQr.exe
  2⤵
  PID:5812
- C:\Windows\System\xkQtKZw.exe
  C:\Windows\System\xkQtKZw.exe
  2⤵
  PID:5828
- C:\Windows\System\VYPFJwL.exe
  C:\Windows\System\VYPFJwL.exe
  2⤵
  PID:5844
- C:\Windows\System\KQmxxba.exe
  C:\Windows\System\KQmxxba.exe
  2⤵
  PID:5860
- C:\Windows\System\yhZqqMw.exe
  C:\Windows\System\yhZqqMw.exe
  2⤵
  PID:5876
- C:\Windows\System\dUzbnPJ.exe
  C:\Windows\System\dUzbnPJ.exe
  2⤵
  PID:5892
- C:\Windows\System\iikuYqx.exe
  C:\Windows\System\iikuYqx.exe
  2⤵
  PID:5908
- C:\Windows\System\aUsmPes.exe
  C:\Windows\System\aUsmPes.exe
  2⤵
  PID:5924
- C:\Windows\System\kQaHmEd.exe
  C:\Windows\System\kQaHmEd.exe
  2⤵
  PID:5940
- C:\Windows\System\ekNWhUF.exe
  C:\Windows\System\ekNWhUF.exe
  2⤵
  PID:5956
- C:\Windows\System\QPUlOeJ.exe
  C:\Windows\System\QPUlOeJ.exe
  2⤵
  PID:5972
- C:\Windows\System\Xlforuf.exe
  C:\Windows\System\Xlforuf.exe
  2⤵
  PID:5988
- C:\Windows\System\vXNKsuD.exe
  C:\Windows\System\vXNKsuD.exe
  2⤵
  PID:6004
- C:\Windows\System\nXAsmrp.exe
  C:\Windows\System\nXAsmrp.exe
  2⤵
  PID:6020
- C:\Windows\System\liHlJvK.exe
  C:\Windows\System\liHlJvK.exe
  2⤵
  PID:6036
- C:\Windows\System\YLEQrmi.exe
  C:\Windows\System\YLEQrmi.exe
  2⤵
  PID:6052
- C:\Windows\System\yhzBdEl.exe
  C:\Windows\System\yhzBdEl.exe
  2⤵
  PID:6068
- C:\Windows\System\nuxzKaM.exe
  C:\Windows\System\nuxzKaM.exe
  2⤵
  PID:6084
- C:\Windows\System\mtFksZq.exe
  C:\Windows\System\mtFksZq.exe
  2⤵
  PID:6100
- C:\Windows\System\WPbBqZQ.exe
  C:\Windows\System\WPbBqZQ.exe
  2⤵
  PID:6116
- C:\Windows\System\mLtkLqY.exe
  C:\Windows\System\mLtkLqY.exe
  2⤵
  PID:6132
- C:\Windows\System\RoXcjxH.exe
  C:\Windows\System\RoXcjxH.exe
  2⤵
  PID:2620
- C:\Windows\System\MbloAZH.exe
  C:\Windows\System\MbloAZH.exe
  2⤵
  PID:5164
- C:\Windows\System\LqDtszB.exe
  C:\Windows\System\LqDtszB.exe
  2⤵
  PID:5168
- C:\Windows\System\OfizjlH.exe
  C:\Windows\System\OfizjlH.exe
  2⤵
  PID:5232
- C:\Windows\System\sRrYvBH.exe
  C:\Windows\System\sRrYvBH.exe
  2⤵
  PID:5296
- C:\Windows\System\jAovljM.exe
  C:\Windows\System\jAovljM.exe
  2⤵
  PID:5356
- C:\Windows\System\ruKihkC.exe
  C:\Windows\System\ruKihkC.exe
  2⤵
  PID:5148
- C:\Windows\System\jPdMzZG.exe
  C:\Windows\System\jPdMzZG.exe
  2⤵
  PID:5212
- C:\Windows\System\TnPVXuH.exe
  C:\Windows\System\TnPVXuH.exe
  2⤵
  PID:5308
- C:\Windows\System\QSpyDBo.exe
  C:\Windows\System\QSpyDBo.exe
  2⤵
  PID:5420
- C:\Windows\System\DTgAPOS.exe
  C:\Windows\System\DTgAPOS.exe
  2⤵
  PID:5424
- C:\Windows\System\TlxRFWX.exe
  C:\Windows\System\TlxRFWX.exe
  2⤵
  PID:5440
- C:\Windows\System\qwWlnFf.exe
  C:\Windows\System\qwWlnFf.exe
  2⤵
  PID:5456
- C:\Windows\System\haQBxkX.exe
  C:\Windows\System\haQBxkX.exe
  2⤵
  PID:5480
- C:\Windows\System\laLnIBY.exe
  C:\Windows\System\laLnIBY.exe
  2⤵
  PID:5500
- C:\Windows\System\MLgzjFf.exe
  C:\Windows\System\MLgzjFf.exe
  2⤵
  PID:5496
- C:\Windows\System\iuBVMAe.exe
  C:\Windows\System\iuBVMAe.exe
  2⤵
  PID:5576
- C:\Windows\System\ryXqZjX.exe
  C:\Windows\System\ryXqZjX.exe
  2⤵
  PID:5524
- C:\Windows\System\gLNyJau.exe
  C:\Windows\System\gLNyJau.exe
  2⤵
  PID:5588
- C:\Windows\System\ndlqIKI.exe
  C:\Windows\System\ndlqIKI.exe
  2⤵
  PID:5636
- C:\Windows\System\jGVIJKH.exe
  C:\Windows\System\jGVIJKH.exe
  2⤵
  PID:5644
- C:\Windows\System\mcEhDqz.exe
  C:\Windows\System\mcEhDqz.exe
  2⤵
  PID:5688
- C:\Windows\System\eWETabK.exe
  C:\Windows\System\eWETabK.exe
  2⤵
  PID:5692
- C:\Windows\System\QehtFoT.exe
  C:\Windows\System\QehtFoT.exe
  2⤵
  PID:5724
- C:\Windows\System\GZdQjXQ.exe
  C:\Windows\System\GZdQjXQ.exe
  2⤵
  PID:5760
- C:\Windows\System\kYbDMLF.exe
  C:\Windows\System\kYbDMLF.exe
  2⤵
  PID:5820
- C:\Windows\System\QgbqxKq.exe
  C:\Windows\System\QgbqxKq.exe
  2⤵
  PID:5884
- C:\Windows\System\jHqYwpX.exe
  C:\Windows\System\jHqYwpX.exe
  2⤵
  PID:6048
- C:\Windows\System\ixsgkhv.exe
  C:\Windows\System\ixsgkhv.exe
  2⤵
  PID:6112
- C:\Windows\System\GfUfRrS.exe
  C:\Windows\System\GfUfRrS.exe
  2⤵
  PID:6140
- C:\Windows\System\Heykffq.exe
  C:\Windows\System\Heykffq.exe
  2⤵
  PID:5932
- C:\Windows\System\jAXJudf.exe
  C:\Windows\System\jAXJudf.exe
  2⤵
  PID:4752
- C:\Windows\System\qwcjpHQ.exe
  C:\Windows\System\qwcjpHQ.exe
  2⤵
  PID:6092
- C:\Windows\System\kWfYkBi.exe
  C:\Windows\System\kWfYkBi.exe
  2⤵
  PID:5964
- C:\Windows\System\gcRChUb.exe
  C:\Windows\System\gcRChUb.exe
  2⤵
  PID:6028
- C:\Windows\System\qUIFfHL.exe
  C:\Windows\System\qUIFfHL.exe
  2⤵
  PID:5132
- C:\Windows\System\FUIoNzI.exe
  C:\Windows\System\FUIoNzI.exe
  2⤵
  PID:5328
- C:\Windows\System\MRcKVKV.exe
  C:\Windows\System\MRcKVKV.exe
  2⤵
  PID:5244
- C:\Windows\System\GpUgFVB.exe
  C:\Windows\System\GpUgFVB.exe
  2⤵
  PID:5428
- C:\Windows\System\ZFVrskc.exe
  C:\Windows\System\ZFVrskc.exe
  2⤵
  PID:5340
- C:\Windows\System\gngFfan.exe
  C:\Windows\System\gngFfan.exe
  2⤵
  PID:5372
- C:\Windows\System\TyAfeyR.exe
  C:\Windows\System\TyAfeyR.exe
  2⤵
  PID:2224
- C:\Windows\System\XhMaBKl.exe
  C:\Windows\System\XhMaBKl.exe
  2⤵
  PID:5572
- C:\Windows\System\hNWJdFi.exe
  C:\Windows\System\hNWJdFi.exe
  2⤵
  PID:5640
- C:\Windows\System\FeVSjic.exe
  C:\Windows\System\FeVSjic.exe
  2⤵
  PID:5520
- C:\Windows\System\tgxczeg.exe
  C:\Windows\System\tgxczeg.exe
  2⤵
  PID:5704
- C:\Windows\System\hqACJXL.exe
  C:\Windows\System\hqACJXL.exe
  2⤵
  PID:5740
- C:\Windows\System\GCwUxRe.exe
  C:\Windows\System\GCwUxRe.exe
  2⤵
  PID:5792
- C:\Windows\System\jjQMOvI.exe
  C:\Windows\System\jjQMOvI.exe
  2⤵
  PID:5788
- C:\Windows\System\QldnpTQ.exe
  C:\Windows\System\QldnpTQ.exe
  2⤵
  PID:5980
- C:\Windows\System\pcpFjWo.exe
  C:\Windows\System\pcpFjWo.exe
  2⤵
  PID:6012
- C:\Windows\System\cupXJHh.exe
  C:\Windows\System\cupXJHh.exe
  2⤵
  PID:6124
- C:\Windows\System\whdRnQz.exe
  C:\Windows\System\whdRnQz.exe
  2⤵
  PID:6032
- C:\Windows\System\juRQvaQ.exe
  C:\Windows\System\juRQvaQ.exe
  2⤵
  PID:5448
- C:\Windows\System\oDUMAaB.exe
  C:\Windows\System\oDUMAaB.exe
  2⤵
  PID:5436
- C:\Windows\System\VZxIhMP.exe
  C:\Windows\System\VZxIhMP.exe
  2⤵
  PID:5292
- C:\Windows\System\NmUDZWt.exe
  C:\Windows\System\NmUDZWt.exe
  2⤵
  PID:2444
- C:\Windows\System\XDibPiB.exe
  C:\Windows\System\XDibPiB.exe
  2⤵
  PID:5432
- C:\Windows\System\BoSZAzW.exe
  C:\Windows\System\BoSZAzW.exe
  2⤵
  PID:5660
- C:\Windows\System\FUdTowt.exe
  C:\Windows\System\FUdTowt.exe
  2⤵
  PID:5540
- C:\Windows\System\FhiMAcV.exe
  C:\Windows\System\FhiMAcV.exe
  2⤵
  PID:5856
- C:\Windows\System\UKJyJWW.exe
  C:\Windows\System\UKJyJWW.exe
  2⤵
  PID:4416
- C:\Windows\System\IhrflXA.exe
  C:\Windows\System\IhrflXA.exe
  2⤵
  PID:5184
- C:\Windows\System\ewgQNWa.exe
  C:\Windows\System\ewgQNWa.exe
  2⤵
  PID:5280
- C:\Windows\System\mVzxidk.exe
  C:\Windows\System\mVzxidk.exe
  2⤵
  PID:5464
- C:\Windows\System\tGWUOhZ.exe
  C:\Windows\System\tGWUOhZ.exe
  2⤵
  PID:5936
- C:\Windows\System\bJoNwsa.exe
  C:\Windows\System\bJoNwsa.exe
  2⤵
  PID:6000
- C:\Windows\System\CPtLXpe.exe
  C:\Windows\System\CPtLXpe.exe
  2⤵
  PID:5736
- C:\Windows\System\meuCaTg.exe
  C:\Windows\System\meuCaTg.exe
  2⤵
  PID:6064
- C:\Windows\System\OdDWGTR.exe
  C:\Windows\System\OdDWGTR.exe
  2⤵
  PID:5900
- C:\Windows\System\TZDljKA.exe
  C:\Windows\System\TZDljKA.exe
  2⤵
  PID:6148
- C:\Windows\System\YRzHDtw.exe
  C:\Windows\System\YRzHDtw.exe
  2⤵
  PID:6164
- C:\Windows\System\DLhehhB.exe
  C:\Windows\System\DLhehhB.exe
  2⤵
  PID:6180
- C:\Windows\System\bMEMHXg.exe
  C:\Windows\System\bMEMHXg.exe
  2⤵
  PID:6200
- C:\Windows\System\twGkCty.exe
  C:\Windows\System\twGkCty.exe
  2⤵
  PID:6216
- C:\Windows\System\tOJQQSr.exe
  C:\Windows\System\tOJQQSr.exe
  2⤵
  PID:6232
- C:\Windows\System\miNoBQb.exe
  C:\Windows\System\miNoBQb.exe
  2⤵
  PID:6248
- C:\Windows\System\fBrkbCn.exe
  C:\Windows\System\fBrkbCn.exe
  2⤵
  PID:6264
- C:\Windows\System\fBrRhmU.exe
  C:\Windows\System\fBrRhmU.exe
  2⤵
  PID:6280
- C:\Windows\System\qvBMgam.exe
  C:\Windows\System\qvBMgam.exe
  2⤵
  PID:6296
- C:\Windows\System\AimwNXx.exe
  C:\Windows\System\AimwNXx.exe
  2⤵
  PID:6312
- C:\Windows\System\jrAndEL.exe
  C:\Windows\System\jrAndEL.exe
  2⤵
  PID:6328
- C:\Windows\System\ObkdFHV.exe
  C:\Windows\System\ObkdFHV.exe
  2⤵
  PID:6344
- C:\Windows\System\eeRqIBm.exe
  C:\Windows\System\eeRqIBm.exe
  2⤵
  PID:6360
- C:\Windows\System\PRFaHJq.exe
  C:\Windows\System\PRFaHJq.exe
  2⤵
  PID:6376
- C:\Windows\System\OpPmqRW.exe
  C:\Windows\System\OpPmqRW.exe
  2⤵
  PID:6392
- C:\Windows\System\oglSGqe.exe
  C:\Windows\System\oglSGqe.exe
  2⤵
  PID:6412
- C:\Windows\System\CdLEOcP.exe
  C:\Windows\System\CdLEOcP.exe
  2⤵
  PID:6428
- C:\Windows\System\yQSuuKa.exe
  C:\Windows\System\yQSuuKa.exe
  2⤵
  PID:6444
- C:\Windows\System\OChfzHU.exe
  C:\Windows\System\OChfzHU.exe
  2⤵
  PID:6460
- C:\Windows\System\efEmIhi.exe
  C:\Windows\System\efEmIhi.exe
  2⤵
  PID:6476
- C:\Windows\System\bXkwFTc.exe
  C:\Windows\System\bXkwFTc.exe
  2⤵
  PID:6492
- C:\Windows\System\YZvebYT.exe
  C:\Windows\System\YZvebYT.exe
  2⤵
  PID:6508
- C:\Windows\System\XEAJKdQ.exe
  C:\Windows\System\XEAJKdQ.exe
  2⤵
  PID:6524
- C:\Windows\System\RkgUXmV.exe
  C:\Windows\System\RkgUXmV.exe
  2⤵
  PID:6540
- C:\Windows\System\AkasUNu.exe
  C:\Windows\System\AkasUNu.exe
  2⤵
  PID:6556
- C:\Windows\System\oiTSKuL.exe
  C:\Windows\System\oiTSKuL.exe
  2⤵
  PID:6572
- C:\Windows\System\jMIDsFx.exe
  C:\Windows\System\jMIDsFx.exe
  2⤵
  PID:6592
- C:\Windows\System\TKEyqnO.exe
  C:\Windows\System\TKEyqnO.exe
  2⤵
  PID:6608
- C:\Windows\System\FTAOnLt.exe
  C:\Windows\System\FTAOnLt.exe
  2⤵
  PID:6624
- C:\Windows\System\dMDuPdT.exe
  C:\Windows\System\dMDuPdT.exe
  2⤵
  PID:6640
- C:\Windows\System\UgCjcBa.exe
  C:\Windows\System\UgCjcBa.exe
  2⤵
  PID:6656
- C:\Windows\System\IeVCinQ.exe
  C:\Windows\System\IeVCinQ.exe
  2⤵
  PID:6672
- C:\Windows\System\OfNgZGK.exe
  C:\Windows\System\OfNgZGK.exe
  2⤵
  PID:6792
- C:\Windows\System\TSfOIdI.exe
  C:\Windows\System\TSfOIdI.exe
  2⤵
  PID:6808
- C:\Windows\System\eNaiOuI.exe
  C:\Windows\System\eNaiOuI.exe
  2⤵
  PID:6824
- C:\Windows\System\mseItne.exe
  C:\Windows\System\mseItne.exe
  2⤵
  PID:6840
- C:\Windows\System\oLOBJjG.exe
  C:\Windows\System\oLOBJjG.exe
  2⤵
  PID:6860
- C:\Windows\System\SJWGNvn.exe
  C:\Windows\System\SJWGNvn.exe
  2⤵
  PID:6876
- C:\Windows\System\DfaTdli.exe
  C:\Windows\System\DfaTdli.exe
  2⤵
  PID:6892
- C:\Windows\System\oWnJnKX.exe
  C:\Windows\System\oWnJnKX.exe
  2⤵
  PID:6908
- C:\Windows\System\WsNvFWP.exe
  C:\Windows\System\WsNvFWP.exe
  2⤵
  PID:6924
- C:\Windows\System\qlblEEX.exe
  C:\Windows\System\qlblEEX.exe
  2⤵
  PID:6940
- C:\Windows\System\RVuLMXR.exe
  C:\Windows\System\RVuLMXR.exe
  2⤵
  PID:6956
- C:\Windows\System\jbNBCMx.exe
  C:\Windows\System\jbNBCMx.exe
  2⤵
  PID:6972
- C:\Windows\System\liDjsaJ.exe
  C:\Windows\System\liDjsaJ.exe
  2⤵
  PID:6988
- C:\Windows\System\yeNXTXr.exe
  C:\Windows\System\yeNXTXr.exe
  2⤵
  PID:7004
- C:\Windows\System\ItQLsnv.exe
  C:\Windows\System\ItQLsnv.exe
  2⤵
  PID:7028
- C:\Windows\System\HbZevhO.exe
  C:\Windows\System\HbZevhO.exe
  2⤵
  PID:7044
- C:\Windows\System\zZZogme.exe
  C:\Windows\System\zZZogme.exe
  2⤵
  PID:7060
- C:\Windows\System\UoXVnjP.exe
  C:\Windows\System\UoXVnjP.exe
  2⤵
  PID:7076
- C:\Windows\System\lpmwfXu.exe
  C:\Windows\System\lpmwfXu.exe
  2⤵
  PID:7092
- C:\Windows\System\DIWfdpW.exe
  C:\Windows\System\DIWfdpW.exe
  2⤵
  PID:7108
- C:\Windows\System\OCuujUD.exe
  C:\Windows\System\OCuujUD.exe
  2⤵
  PID:7124
- C:\Windows\System\uxLzzAc.exe
  C:\Windows\System\uxLzzAc.exe
  2⤵
  PID:7140
- C:\Windows\System\VujEOgK.exe
  C:\Windows\System\VujEOgK.exe
  2⤵
  PID:7164
- C:\Windows\System\ZYIzaIe.exe
  C:\Windows\System\ZYIzaIe.exe
  2⤵
  PID:6156
- C:\Windows\System\ZqfaGGu.exe
  C:\Windows\System\ZqfaGGu.exe
  2⤵
  PID:6224
- C:\Windows\System\AExyISn.exe
  C:\Windows\System\AExyISn.exe
  2⤵
  PID:6288
- C:\Windows\System\zvuupYW.exe
  C:\Windows\System\zvuupYW.exe
  2⤵
  PID:6352
- C:\Windows\System\ZjUZtrP.exe
  C:\Windows\System\ZjUZtrP.exe
  2⤵
  PID:6420
- C:\Windows\System\wauYzSi.exe
  C:\Windows\System\wauYzSi.exe
  2⤵
  PID:6208
- C:\Windows\System\gQKKfJU.exe
  C:\Windows\System\gQKKfJU.exe
  2⤵
  PID:6336
- C:\Windows\System\KpltTxr.exe
  C:\Windows\System\KpltTxr.exe
  2⤵
  PID:5852
- C:\Windows\System\mVjyaId.exe
  C:\Windows\System\mVjyaId.exe
  2⤵
  PID:6176
- C:\Windows\System\FgFddcC.exe
  C:\Windows\System\FgFddcC.exe
  2⤵
  PID:6276
- C:\Windows\System\Qeecusl.exe
  C:\Windows\System\Qeecusl.exe
  2⤵
  PID:6404
- C:\Windows\System\iIMVwtS.exe
  C:\Windows\System\iIMVwtS.exe
  2⤵
  PID:6500
- C:\Windows\System\lUczQFj.exe
  C:\Windows\System\lUczQFj.exe
  2⤵
  PID:6504
- C:\Windows\System\lWsKCHb.exe
  C:\Windows\System\lWsKCHb.exe
  2⤵
  PID:6580
- C:\Windows\System\zZgxgvN.exe
  C:\Windows\System\zZgxgvN.exe
  2⤵
  PID:6620
- C:\Windows\System\YgNzdBP.exe
  C:\Windows\System\YgNzdBP.exe
  2⤵
  PID:6536
- C:\Windows\System\eBsFfPg.exe
  C:\Windows\System\eBsFfPg.exe
  2⤵
  PID:6604
- C:\Windows\System\TTRGvig.exe
  C:\Windows\System\TTRGvig.exe
  2⤵
  PID:6600
- C:\Windows\System\MmQXdKF.exe
  C:\Windows\System\MmQXdKF.exe
  2⤵
  PID:6696
- C:\Windows\System\WieuaYe.exe
  C:\Windows\System\WieuaYe.exe
  2⤵
  PID:6704
- C:\Windows\System\LSBIAVB.exe
  C:\Windows\System\LSBIAVB.exe
  2⤵
  PID:6728
- C:\Windows\System\emciSto.exe
  C:\Windows\System\emciSto.exe
  2⤵
  PID:6744
- C:\Windows\System\TVWPOwo.exe
  C:\Windows\System\TVWPOwo.exe
  2⤵
  PID:6760
- C:\Windows\System\UFuEpZp.exe
  C:\Windows\System\UFuEpZp.exe
  2⤵
  PID:6772
- C:\Windows\System\aeYHfVo.exe
  C:\Windows\System\aeYHfVo.exe
  2⤵
  PID:6868
- C:\Windows\System\slRxFaZ.exe
  C:\Windows\System\slRxFaZ.exe
  2⤵
  PID:6900
- C:\Windows\System\saTcMTu.exe
  C:\Windows\System\saTcMTu.exe
  2⤵
  PID:6968
- C:\Windows\System\wlXNbSp.exe
  C:\Windows\System\wlXNbSp.exe
  2⤵
  PID:6788
- C:\Windows\System\ZJUBOFO.exe
  C:\Windows\System\ZJUBOFO.exe
  2⤵
  PID:6852
- C:\Windows\System\dfohJGG.exe
  C:\Windows\System\dfohJGG.exe
  2⤵
  PID:7000
- C:\Windows\System\UVXSYLW.exe
  C:\Windows\System\UVXSYLW.exe
  2⤵
  PID:6980
- C:\Windows\System\CTYXaHr.exe
  C:\Windows\System\CTYXaHr.exe
  2⤵
  PID:7020
- C:\Windows\System\KQoNxFz.exe
  C:\Windows\System\KQoNxFz.exe
  2⤵
  PID:7084
- C:\Windows\System\aJiJDMg.exe
  C:\Windows\System\aJiJDMg.exe
  2⤵
  PID:7148
- C:\Windows\System\rLZBStd.exe
  C:\Windows\System\rLZBStd.exe
  2⤵
  PID:7072
- C:\Windows\System\LnNFmAz.exe
  C:\Windows\System\LnNFmAz.exe
  2⤵
  PID:7132
- C:\Windows\System\QYJLGut.exe
  C:\Windows\System\QYJLGut.exe
  2⤵
  PID:7156
- C:\Windows\System\OCHHDlX.exe
  C:\Windows\System\OCHHDlX.exe
  2⤵
  PID:6256
- C:\Windows\System\pUfRGvs.exe
  C:\Windows\System\pUfRGvs.exe
  2⤵
  PID:6484
- C:\Windows\System\herUXpV.exe
  C:\Windows\System\herUXpV.exe
  2⤵
  PID:5544
- C:\Windows\System\SFylYJy.exe
  C:\Windows\System\SFylYJy.exe
  2⤵
  PID:6324
- C:\Windows\System\SWyDknn.exe
  C:\Windows\System\SWyDknn.exe
  2⤵
  PID:6400
- C:\Windows\System\npdUydC.exe
  C:\Windows\System\npdUydC.exe
  2⤵
  PID:6436
- C:\Windows\System\hBMUUhm.exe
  C:\Windows\System\hBMUUhm.exe
  2⤵
  PID:6680
- C:\Windows\System\SGjGWyv.exe
  C:\Windows\System\SGjGWyv.exe
  2⤵
  PID:6192
- C:\Windows\System\tldmqyD.exe
  C:\Windows\System\tldmqyD.exe
  2⤵
  PID:6740
- C:\Windows\System\REEsljk.exe
  C:\Windows\System\REEsljk.exe
  2⤵
  PID:6468
- C:\Windows\System\CRpKDNp.exe
  C:\Windows\System\CRpKDNp.exe
  2⤵
  PID:6784
- C:\Windows\System\SmblqhO.exe
  C:\Windows\System\SmblqhO.exe
  2⤵
  PID:7016
- C:\Windows\System\FwqxSym.exe
  C:\Windows\System\FwqxSym.exe
  2⤵
  PID:7104
- C:\Windows\System\uGxCeNb.exe
  C:\Windows\System\uGxCeNb.exe
  2⤵
  PID:5560
- C:\Windows\System\OLIlYLF.exe
  C:\Windows\System\OLIlYLF.exe
  2⤵
  PID:6652
- C:\Windows\System\GyAEhGv.exe
  C:\Windows\System\GyAEhGv.exe
  2⤵
  PID:6616
- C:\Windows\System\YRnvLPx.exe
  C:\Windows\System\YRnvLPx.exe
  2⤵
  PID:6752
- C:\Windows\System\gtnLNlm.exe
  C:\Windows\System\gtnLNlm.exe
  2⤵
  PID:6804
- C:\Windows\System\OmCzFJi.exe
  C:\Windows\System\OmCzFJi.exe
  2⤵
  PID:6820
- C:\Windows\System\zwgKbHC.exe
  C:\Windows\System\zwgKbHC.exe
  2⤵
  PID:6244
- C:\Windows\System\MpRKQGr.exe
  C:\Windows\System\MpRKQGr.exe
  2⤵
  PID:6308
- C:\Windows\System\MRtzZos.exe
  C:\Windows\System\MRtzZos.exe
  2⤵
  PID:6932
- C:\Windows\System\nJTnsMf.exe
  C:\Windows\System\nJTnsMf.exe
  2⤵
  PID:7052
- C:\Windows\System\bwSJlPu.exe
  C:\Windows\System\bwSJlPu.exe
  2⤵
  PID:6160
- C:\Windows\System\UPhptpt.exe
  C:\Windows\System\UPhptpt.exe
  2⤵
  PID:6372
- C:\Windows\System\rmNEBsr.exe
  C:\Windows\System\rmNEBsr.exe
  2⤵
  PID:7012
- C:\Windows\System\mesqiTL.exe
  C:\Windows\System\mesqiTL.exe
  2⤵
  PID:6440
- C:\Windows\System\LAShJIs.exe
  C:\Windows\System\LAShJIs.exe
  2⤵
  PID:1536
- C:\Windows\System\FeriIIp.exe
  C:\Windows\System\FeriIIp.exe
  2⤵
  PID:7100
- C:\Windows\System\VHWEGIS.exe
  C:\Windows\System\VHWEGIS.exe
  2⤵
  PID:6800
- C:\Windows\System\rdzjlXN.exe
  C:\Windows\System\rdzjlXN.exe
  2⤵
  PID:6872
- C:\Windows\System\UMeOJPx.exe
  C:\Windows\System\UMeOJPx.exe
  2⤵
  PID:7120
- C:\Windows\System\noiVvAT.exe
  C:\Windows\System\noiVvAT.exe
  2⤵
  PID:7184
- C:\Windows\System\NfCJNOz.exe
  C:\Windows\System\NfCJNOz.exe
  2⤵
  PID:7220
- C:\Windows\System\sNJZkXC.exe
  C:\Windows\System\sNJZkXC.exe
  2⤵
  PID:7236
- C:\Windows\System\eGVhHBA.exe
  C:\Windows\System\eGVhHBA.exe
  2⤵
  PID:7252
- C:\Windows\System\hzEtRmC.exe
  C:\Windows\System\hzEtRmC.exe
  2⤵
  PID:7268
- C:\Windows\System\jgBBzxo.exe
  C:\Windows\System\jgBBzxo.exe
  2⤵
  PID:7284
- C:\Windows\System\ZsBAWhn.exe
  C:\Windows\System\ZsBAWhn.exe
  2⤵
  PID:7304
- C:\Windows\System\mILjGGR.exe
  C:\Windows\System\mILjGGR.exe
  2⤵
  PID:7320
- C:\Windows\System\zEqdQYF.exe
  C:\Windows\System\zEqdQYF.exe
  2⤵
  PID:7336
- C:\Windows\System\imBgMkK.exe
  C:\Windows\System\imBgMkK.exe
  2⤵
  PID:7352
- C:\Windows\System\GGxOOCA.exe
  C:\Windows\System\GGxOOCA.exe
  2⤵
  PID:7368
- C:\Windows\System\oOKPPvh.exe
  C:\Windows\System\oOKPPvh.exe
  2⤵
  PID:7384
- C:\Windows\System\MlezXtI.exe
  C:\Windows\System\MlezXtI.exe
  2⤵
  PID:7400
- C:\Windows\System\RReekOt.exe
  C:\Windows\System\RReekOt.exe
  2⤵
  PID:7416
- C:\Windows\System\JGlPpYv.exe
  C:\Windows\System\JGlPpYv.exe
  2⤵
  PID:7436
- C:\Windows\System\lLJcKAJ.exe
  C:\Windows\System\lLJcKAJ.exe
  2⤵
  PID:7452
- C:\Windows\System\wRquZbr.exe
  C:\Windows\System\wRquZbr.exe
  2⤵
  PID:7468
- C:\Windows\System\umIyGaV.exe
  C:\Windows\System\umIyGaV.exe
  2⤵
  PID:7484
- C:\Windows\System\jQrlQah.exe
  C:\Windows\System\jQrlQah.exe
  2⤵
  PID:7500
- C:\Windows\System\DGODbmB.exe
  C:\Windows\System\DGODbmB.exe
  2⤵
  PID:7516
- C:\Windows\System\RWdZKAR.exe
  C:\Windows\System\RWdZKAR.exe
  2⤵
  PID:7532
- C:\Windows\System\QKqPmNm.exe
  C:\Windows\System\QKqPmNm.exe
  2⤵
  PID:7548
- C:\Windows\System\SpdFZlI.exe
  C:\Windows\System\SpdFZlI.exe
  2⤵
  PID:7568
- C:\Windows\System\KeThATD.exe
  C:\Windows\System\KeThATD.exe
  2⤵
  PID:7588
- C:\Windows\System\ExiKGGg.exe
  C:\Windows\System\ExiKGGg.exe
  2⤵
  PID:7604
- C:\Windows\System\pzbhCEf.exe
  C:\Windows\System\pzbhCEf.exe
  2⤵
  PID:7620
- C:\Windows\System\mqSpqLm.exe
  C:\Windows\System\mqSpqLm.exe
  2⤵
  PID:7636
- C:\Windows\System\TowoIfE.exe
  C:\Windows\System\TowoIfE.exe
  2⤵
  PID:7656
- C:\Windows\System\SnbJEGQ.exe
  C:\Windows\System\SnbJEGQ.exe
  2⤵
  PID:7672
- C:\Windows\System\oklthSJ.exe
  C:\Windows\System\oklthSJ.exe
  2⤵
  PID:7688
- C:\Windows\System\VgaViio.exe
  C:\Windows\System\VgaViio.exe
  2⤵
  PID:7704
- C:\Windows\System\ScIPZKh.exe
  C:\Windows\System\ScIPZKh.exe
  2⤵
  PID:7720
- C:\Windows\System\EkQsinK.exe
  C:\Windows\System\EkQsinK.exe
  2⤵
  PID:7736
- C:\Windows\System\suIqXjg.exe
  C:\Windows\System\suIqXjg.exe
  2⤵
  PID:7752
- C:\Windows\System\nLHqxXf.exe
  C:\Windows\System\nLHqxXf.exe
  2⤵
  PID:7772
- C:\Windows\System\TBczzda.exe
  C:\Windows\System\TBczzda.exe
  2⤵
  PID:7788
- C:\Windows\System\GXLbEeW.exe
  C:\Windows\System\GXLbEeW.exe
  2⤵
  PID:7804
- C:\Windows\System\paONySY.exe
  C:\Windows\System\paONySY.exe
  2⤵
  PID:7820
- C:\Windows\System\nSHQfTe.exe
  C:\Windows\System\nSHQfTe.exe
  2⤵
  PID:7836
- C:\Windows\System\kyqDWWd.exe
  C:\Windows\System\kyqDWWd.exe
  2⤵
  PID:7852
- C:\Windows\System\kJKnuig.exe
  C:\Windows\System\kJKnuig.exe
  2⤵
  PID:7868
- C:\Windows\System\JhGIued.exe
  C:\Windows\System\JhGIued.exe
  2⤵
  PID:7884
- C:\Windows\System\LTvhYOU.exe
  C:\Windows\System\LTvhYOU.exe
  2⤵
  PID:7904
- C:\Windows\System\MInQKub.exe
  C:\Windows\System\MInQKub.exe
  2⤵
  PID:7920
- C:\Windows\System\UILdNFk.exe
  C:\Windows\System\UILdNFk.exe
  2⤵
  PID:7936
- C:\Windows\System\ZyGIIkc.exe
  C:\Windows\System\ZyGIIkc.exe
  2⤵
  PID:7952
- C:\Windows\System\bVXyCyX.exe
  C:\Windows\System\bVXyCyX.exe
  2⤵
  PID:7968
- C:\Windows\System\PPFsgqd.exe
  C:\Windows\System\PPFsgqd.exe
  2⤵
  PID:7984
- C:\Windows\System\NgujZFq.exe
  C:\Windows\System\NgujZFq.exe
  2⤵
  PID:8000
- C:\Windows\System\lpddlSg.exe
  C:\Windows\System\lpddlSg.exe
  2⤵
  PID:8016
- C:\Windows\System\CrWiFJy.exe
  C:\Windows\System\CrWiFJy.exe
  2⤵
  PID:8036
- C:\Windows\System\qqDlegE.exe
  C:\Windows\System\qqDlegE.exe
  2⤵
  PID:8052
- C:\Windows\System\NHryNqv.exe
  C:\Windows\System\NHryNqv.exe
  2⤵
  PID:8068
- C:\Windows\System\LNlCfKb.exe
  C:\Windows\System\LNlCfKb.exe
  2⤵
  PID:8088
- C:\Windows\System\AxAZjEK.exe
  C:\Windows\System\AxAZjEK.exe
  2⤵
  PID:8104
- C:\Windows\System\xqTDpMD.exe
  C:\Windows\System\xqTDpMD.exe
  2⤵
  PID:8120
- C:\Windows\System\QvDYfQf.exe
  C:\Windows\System\QvDYfQf.exe
  2⤵
  PID:8136
- C:\Windows\System\rwsYHjT.exe
  C:\Windows\System\rwsYHjT.exe
  2⤵
  PID:8152
- C:\Windows\System\OUHwqEo.exe
  C:\Windows\System\OUHwqEo.exe
  2⤵
  PID:8172
- C:\Windows\System\LxAutoX.exe
  C:\Windows\System\LxAutoX.exe
  2⤵
  PID:8188
- C:\Windows\System\TXclLGi.exe
  C:\Windows\System\TXclLGi.exe
  2⤵
  PID:6692
- C:\Windows\System\nZBVnPp.exe
  C:\Windows\System\nZBVnPp.exe
  2⤵
  PID:6472
- C:\Windows\System\sQNuAYz.exe
  C:\Windows\System\sQNuAYz.exe
  2⤵
  PID:6668
- C:\Windows\System\pAfXAYb.exe
  C:\Windows\System\pAfXAYb.exe
  2⤵
  PID:6920
- C:\Windows\System\wZYCWnJ.exe
  C:\Windows\System\wZYCWnJ.exe
  2⤵
  PID:7264
- C:\Windows\System\ObDZhmE.exe
  C:\Windows\System\ObDZhmE.exe
  2⤵
  PID:7208
- C:\Windows\System\LnQkMLR.exe
  C:\Windows\System\LnQkMLR.exe
  2⤵
  PID:7328
- C:\Windows\System\tlXCRty.exe
  C:\Windows\System\tlXCRty.exe
  2⤵
  PID:7392
- C:\Windows\System\hEzimro.exe
  C:\Windows\System\hEzimro.exe
  2⤵
  PID:7428
- C:\Windows\System\QJPzYeF.exe
  C:\Windows\System\QJPzYeF.exe
  2⤵
  PID:7216
- C:\Windows\System\feaEjdC.exe
  C:\Windows\System\feaEjdC.exe
  2⤵
  PID:7380
- C:\Windows\System\tWyrMRg.exe
  C:\Windows\System\tWyrMRg.exe
  2⤵
  PID:7280
- C:\Windows\System\rOPwSrq.exe
  C:\Windows\System\rOPwSrq.exe
  2⤵
  PID:7348
- C:\Windows\System\yzBpnFV.exe
  C:\Windows\System\yzBpnFV.exe
  2⤵
  PID:7476
- C:\Windows\System\evsNngC.exe
  C:\Windows\System\evsNngC.exe
  2⤵
  PID:7560
- C:\Windows\System\iYtLgay.exe
  C:\Windows\System\iYtLgay.exe
  2⤵
  PID:7596
- C:\Windows\System\UokKZYc.exe
  C:\Windows\System\UokKZYc.exe
  2⤵
  PID:7508
- C:\Windows\System\FzOWcYW.exe
  C:\Windows\System\FzOWcYW.exe
  2⤵
  PID:7616
- C:\Windows\System\PXUOWmS.exe
  C:\Windows\System\PXUOWmS.exe
  2⤵
  PID:7584
- C:\Windows\System\sUEUdgt.exe
  C:\Windows\System\sUEUdgt.exe
  2⤵
  PID:7760
- C:\Windows\System\EbGKzVH.exe
  C:\Windows\System\EbGKzVH.exe
  2⤵
  PID:7684
- C:\Windows\System\dNubwbw.exe
  C:\Windows\System\dNubwbw.exe
  2⤵
  PID:7832
- C:\Windows\System\bSruisl.exe
  C:\Windows\System\bSruisl.exe
  2⤵
  PID:7680
- C:\Windows\System\EqGIAXZ.exe
  C:\Windows\System\EqGIAXZ.exe
  2⤵
  PID:7900
- C:\Windows\System\NkIuJJZ.exe
  C:\Windows\System\NkIuJJZ.exe
  2⤵
  PID:7844
- C:\Windows\System\diXxsQe.exe
  C:\Windows\System\diXxsQe.exe
  2⤵
  PID:7848
- C:\Windows\System\fChPtSz.exe
  C:\Windows\System\fChPtSz.exe
  2⤵
  PID:7992
- C:\Windows\System\wyERquE.exe
  C:\Windows\System\wyERquE.exe
  2⤵
  PID:8032
- C:\Windows\System\JjrLdzD.exe
  C:\Windows\System\JjrLdzD.exe
  2⤵
  PID:8012
- C:\Windows\System\ZyUuJwH.exe
  C:\Windows\System\ZyUuJwH.exe
  2⤵
  PID:7976
- C:\Windows\System\tornSYx.exe
  C:\Windows\System\tornSYx.exe
  2⤵
  PID:8132
- C:\Windows\System\YeoSBfj.exe
  C:\Windows\System\YeoSBfj.exe
  2⤵
  PID:8164
- C:\Windows\System\jKoaqXP.exe
  C:\Windows\System\jKoaqXP.exe
  2⤵
  PID:8148
- C:\Windows\System\LPXAQAJ.exe
  C:\Windows\System\LPXAQAJ.exe
  2⤵
  PID:8080
- C:\Windows\System\MptenTv.exe
  C:\Windows\System\MptenTv.exe
  2⤵
  PID:7296
- C:\Windows\System\KkzUxQe.exe
  C:\Windows\System\KkzUxQe.exe
  2⤵
  PID:7424
- C:\Windows\System\gJsdBDS.exe
  C:\Windows\System\gJsdBDS.exe
  2⤵
  PID:7176
- C:\Windows\System\PsliCzj.exe
  C:\Windows\System\PsliCzj.exe
  2⤵
  PID:7528
- C:\Windows\System\HjVbTRT.exe
  C:\Windows\System\HjVbTRT.exe
  2⤵
  PID:8184
- C:\Windows\System\QqqvdAG.exe
  C:\Windows\System\QqqvdAG.exe
  2⤵
  PID:7364
- C:\Windows\System\qUZKylU.exe
  C:\Windows\System\qUZKylU.exe
  2⤵
  PID:7276
- C:\Windows\System\hvlvzEL.exe
  C:\Windows\System\hvlvzEL.exe
  2⤵
  PID:7480
- C:\Windows\System\ZAOdgwZ.exe
  C:\Windows\System\ZAOdgwZ.exe
  2⤵
  PID:7412
- C:\Windows\System\UukRxXw.exe
  C:\Windows\System\UukRxXw.exe
  2⤵
  PID:7796
- C:\Windows\System\YhKAGYa.exe
  C:\Windows\System\YhKAGYa.exe
  2⤵
  PID:7816
- C:\Windows\System\YQKulxD.exe
  C:\Windows\System\YQKulxD.exe
  2⤵
  PID:7964
- C:\Windows\System\eAXQUUc.exe
  C:\Windows\System\eAXQUUc.exe
  2⤵
  PID:8128
- C:\Windows\System\lDkNpzz.exe
  C:\Windows\System\lDkNpzz.exe
  2⤵
  PID:7260
- C:\Windows\System\KRdvevc.exe
  C:\Windows\System\KRdvevc.exe
  2⤵
  PID:7228
- C:\Windows\System\duVZpld.exe
  C:\Windows\System\duVZpld.exe
  2⤵
  PID:8144
- C:\Windows\System\jRbUVcM.exe
  C:\Windows\System\jRbUVcM.exe
  2⤵
  PID:7628
- C:\Windows\System\tURAKDQ.exe
  C:\Windows\System\tURAKDQ.exe
  2⤵
  PID:7700
- C:\Windows\System\zqXPbEU.exe
  C:\Windows\System\zqXPbEU.exe
  2⤵
  PID:7612
- C:\Windows\System\aCbxerQ.exe
  C:\Windows\System\aCbxerQ.exe
  2⤵
  PID:7928
- C:\Windows\System\XbhSZFH.exe
  C:\Windows\System\XbhSZFH.exe
  2⤵
  PID:8076
- C:\Windows\System\diKVBAx.exe
  C:\Windows\System\diKVBAx.exe
  2⤵
  PID:7576
- C:\Windows\System\iiFsBge.exe
  C:\Windows\System\iiFsBge.exe
  2⤵
  PID:8116
- C:\Windows\System\HtYBECm.exe
  C:\Windows\System\HtYBECm.exe
  2⤵
  PID:7932
- C:\Windows\System\ZXVgfnD.exe
  C:\Windows\System\ZXVgfnD.exe
  2⤵
  PID:7068
- C:\Windows\System\McMtcZl.exe
  C:\Windows\System\McMtcZl.exe
  2⤵
  PID:7344
- C:\Windows\System\SKrvJsm.exe
  C:\Windows\System\SKrvJsm.exe
  2⤵
  PID:6720
- C:\Windows\System\bgbGIZP.exe
  C:\Windows\System\bgbGIZP.exe
  2⤵
  PID:7648
- C:\Windows\System\PyVeSVC.exe
  C:\Windows\System\PyVeSVC.exe
  2⤵
  PID:7448
- C:\Windows\System\sfrwWWu.exe
  C:\Windows\System\sfrwWWu.exe
  2⤵
  PID:8096
- C:\Windows\System\Jklhlvi.exe
  C:\Windows\System\Jklhlvi.exe
  2⤵
  PID:7652
- C:\Windows\System\uWvOYYq.exe
  C:\Windows\System\uWvOYYq.exe
  2⤵
  PID:7864
- C:\Windows\System\wUYvMtM.exe
  C:\Windows\System\wUYvMtM.exe
  2⤵
  PID:7812
- C:\Windows\System\UkrPnKG.exe
  C:\Windows\System\UkrPnKG.exe
  2⤵
  PID:8044
- C:\Windows\System\zyFQBjL.exe
  C:\Windows\System\zyFQBjL.exe
  2⤵
  PID:7896
- C:\Windows\System\DRZUOxI.exe
  C:\Windows\System\DRZUOxI.exe
  2⤵
  PID:8196
- C:\Windows\System\gNCAQQh.exe
  C:\Windows\System\gNCAQQh.exe
  2⤵
  PID:8212
- C:\Windows\System\DcqRyMO.exe
  C:\Windows\System\DcqRyMO.exe
  2⤵
  PID:8228
- C:\Windows\System\ITkeAsW.exe
  C:\Windows\System\ITkeAsW.exe
  2⤵
  PID:8244
- C:\Windows\System\TBMRkBC.exe
  C:\Windows\System\TBMRkBC.exe
  2⤵
  PID:8264
- C:\Windows\System\lFEDVcp.exe
  C:\Windows\System\lFEDVcp.exe
  2⤵
  PID:8288
- C:\Windows\System\GTjrZon.exe
  C:\Windows\System\GTjrZon.exe
  2⤵
  PID:8304
- C:\Windows\System\skqHATF.exe
  C:\Windows\System\skqHATF.exe
  2⤵
  PID:8320
- C:\Windows\System\EWnsnZL.exe
  C:\Windows\System\EWnsnZL.exe
  2⤵
  PID:8420
- C:\Windows\System\jsyRAiM.exe
  C:\Windows\System\jsyRAiM.exe
  2⤵
  PID:8436
- C:\Windows\System\LAYdLgh.exe
  C:\Windows\System\LAYdLgh.exe
  2⤵
  PID:8452
- C:\Windows\System\tcDzFpp.exe
  C:\Windows\System\tcDzFpp.exe
  2⤵
  PID:8472
- C:\Windows\System\unwNvPj.exe
  C:\Windows\System\unwNvPj.exe
  2⤵
  PID:8488
- C:\Windows\System\iuDPwPp.exe
  C:\Windows\System\iuDPwPp.exe
  2⤵
  PID:8504
- C:\Windows\System\JAZUTWf.exe
  C:\Windows\System\JAZUTWf.exe
  2⤵
  PID:8520
- C:\Windows\System\dcJmdwf.exe
  C:\Windows\System\dcJmdwf.exe
  2⤵
  PID:8540
- C:\Windows\System\YIcHAvB.exe
  C:\Windows\System\YIcHAvB.exe
  2⤵
  PID:8556
- C:\Windows\System\CwxkwvK.exe
  C:\Windows\System\CwxkwvK.exe
  2⤵
  PID:8572
- C:\Windows\System\UcaUefD.exe
  C:\Windows\System\UcaUefD.exe
  2⤵
  PID:8588
- C:\Windows\System\OsVhRWr.exe
  C:\Windows\System\OsVhRWr.exe
  2⤵
  PID:8604
- C:\Windows\System\odYMJMs.exe
  C:\Windows\System\odYMJMs.exe
  2⤵
  PID:8624
- C:\Windows\System\fodfuzk.exe
  C:\Windows\System\fodfuzk.exe
  2⤵
  PID:8644
- C:\Windows\System\sJIFTRy.exe
  C:\Windows\System\sJIFTRy.exe
  2⤵
  PID:8664
- C:\Windows\System\swfoReC.exe
  C:\Windows\System\swfoReC.exe
  2⤵
  PID:8680
- C:\Windows\System\VGWQLkS.exe
  C:\Windows\System\VGWQLkS.exe
  2⤵
  PID:8696
- C:\Windows\System\sVWuyaG.exe
  C:\Windows\System\sVWuyaG.exe
  2⤵
  PID:8712
- C:\Windows\System\EcmJQrc.exe
  C:\Windows\System\EcmJQrc.exe
  2⤵
  PID:8728
- C:\Windows\System\Tulyqog.exe
  C:\Windows\System\Tulyqog.exe
  2⤵
  PID:8744
- C:\Windows\System\TqRovvp.exe
  C:\Windows\System\TqRovvp.exe
  2⤵
  PID:8760
- C:\Windows\System\Wozayft.exe
  C:\Windows\System\Wozayft.exe
  2⤵
  PID:8776
- C:\Windows\System\PvzxwKs.exe
  C:\Windows\System\PvzxwKs.exe
  2⤵
  PID:8792
- C:\Windows\System\atSKIjy.exe
  C:\Windows\System\atSKIjy.exe
  2⤵
  PID:8808
- C:\Windows\System\qIPEKKI.exe
  C:\Windows\System\qIPEKKI.exe
  2⤵
  PID:8824
- C:\Windows\System\JaaRBEP.exe
  C:\Windows\System\JaaRBEP.exe
  2⤵
  PID:8840
- C:\Windows\System\coOxITA.exe
  C:\Windows\System\coOxITA.exe
  2⤵
  PID:8856
- C:\Windows\System\RDHLxnV.exe
  C:\Windows\System\RDHLxnV.exe
  2⤵
  PID:8872
- C:\Windows\System\CHXtXQG.exe
  C:\Windows\System\CHXtXQG.exe
  2⤵
  PID:8888
- C:\Windows\System\robVDAu.exe
  C:\Windows\System\robVDAu.exe
  2⤵
  PID:8908
- C:\Windows\System\aJQkIdT.exe
  C:\Windows\System\aJQkIdT.exe
  2⤵
  PID:8928
- C:\Windows\System\SXIlpyd.exe
  C:\Windows\System\SXIlpyd.exe
  2⤵
  PID:8944
- C:\Windows\System\DbZaqSR.exe
  C:\Windows\System\DbZaqSR.exe
  2⤵
  PID:8960
- C:\Windows\System\OwyTpjd.exe
  C:\Windows\System\OwyTpjd.exe
  2⤵
  PID:8976
- C:\Windows\System\zfhhUGR.exe
  C:\Windows\System\zfhhUGR.exe
  2⤵
  PID:8992
- C:\Windows\System\gkArVQv.exe
  C:\Windows\System\gkArVQv.exe
  2⤵
  PID:9008
- C:\Windows\System\XwHrqSi.exe
  C:\Windows\System\XwHrqSi.exe
  2⤵
  PID:9024
- C:\Windows\System\XOTMvpw.exe
  C:\Windows\System\XOTMvpw.exe
  2⤵
  PID:9040
- C:\Windows\System\BHQUERw.exe
  C:\Windows\System\BHQUERw.exe
  2⤵
  PID:9056
- C:\Windows\System\jKPvMQT.exe
  C:\Windows\System\jKPvMQT.exe
  2⤵
  PID:9072
- C:\Windows\System\moOHEuj.exe
  C:\Windows\System\moOHEuj.exe
  2⤵
  PID:9088
- C:\Windows\System\PibNJvI.exe
  C:\Windows\System\PibNJvI.exe
  2⤵
  PID:9104
- C:\Windows\System\nCTcPTo.exe
  C:\Windows\System\nCTcPTo.exe
  2⤵
  PID:9120
- C:\Windows\System\mqYJpmT.exe
  C:\Windows\System\mqYJpmT.exe
  2⤵
  PID:9136
- C:\Windows\System\IkqkheZ.exe
  C:\Windows\System\IkqkheZ.exe
  2⤵
  PID:9152
- C:\Windows\System\GxARmtD.exe
  C:\Windows\System\GxARmtD.exe
  2⤵
  PID:9168
- C:\Windows\System\xpfDHjw.exe
  C:\Windows\System\xpfDHjw.exe
  2⤵
  PID:9184
- C:\Windows\System\JdvOqJO.exe
  C:\Windows\System\JdvOqJO.exe
  2⤵
  PID:9200
- C:\Windows\System\XUjZmuZ.exe
  C:\Windows\System\XUjZmuZ.exe
  2⤵
  PID:8048
- C:\Windows\System\tquNRgp.exe
  C:\Windows\System\tquNRgp.exe
  2⤵
  PID:8236
- C:\Windows\System\sWzdOvb.exe
  C:\Windows\System\sWzdOvb.exe
  2⤵
  PID:8284
- C:\Windows\System\bbHIPrF.exe
  C:\Windows\System\bbHIPrF.exe
  2⤵
  PID:8312
- C:\Windows\System\HfAkNpf.exe
  C:\Windows\System\HfAkNpf.exe
  2⤵
  PID:8256
- C:\Windows\System\UBneVpD.exe
  C:\Windows\System\UBneVpD.exe
  2⤵
  PID:8384
- C:\Windows\System\cCRYehq.exe
  C:\Windows\System\cCRYehq.exe
  2⤵
  PID:8432
- C:\Windows\System\bJlxXcR.exe
  C:\Windows\System\bJlxXcR.exe
  2⤵
  PID:8240
- C:\Windows\System\jXTNNIr.exe
  C:\Windows\System\jXTNNIr.exe
  2⤵
  PID:8532
- C:\Windows\System\zmyzbWG.exe
  C:\Windows\System\zmyzbWG.exe
  2⤵
  PID:8600
- C:\Windows\System\KJVePqd.exe
  C:\Windows\System\KJVePqd.exe
  2⤵
  PID:8676
- C:\Windows\System\suEslnR.exe
  C:\Windows\System\suEslnR.exe
  2⤵
  PID:8740
- C:\Windows\System\vBnjIpE.exe
  C:\Windows\System\vBnjIpE.exe
  2⤵
  PID:8800
- C:\Windows\System\fJmkMKy.exe
  C:\Windows\System\fJmkMKy.exe
  2⤵
  PID:8868
- C:\Windows\System\wAHTKZG.exe
  C:\Windows\System\wAHTKZG.exe
  2⤵
  PID:8904
- C:\Windows\System\nEYiRho.exe
  C:\Windows\System\nEYiRho.exe
  2⤵
  PID:8340
- C:\Windows\System\TaNZkEg.exe
  C:\Windows\System\TaNZkEg.exe
  2⤵
  PID:8356
- C:\Windows\System\ubGkAuT.exe
  C:\Windows\System\ubGkAuT.exe
  2⤵
  PID:8368
- C:\Windows\System\QIkdAdz.exe
  C:\Windows\System\QIkdAdz.exe
  2⤵
  PID:8392
- C:\Windows\System\ghWaKGq.exe
  C:\Windows\System\ghWaKGq.exe
  2⤵
  PID:9004
- C:\Windows\System\owqldSx.exe
  C:\Windows\System\owqldSx.exe
  2⤵
  PID:9064
- C:\Windows\System\DZcTwAG.exe
  C:\Windows\System\DZcTwAG.exe
  2⤵
  PID:9128
- C:\Windows\System\gwtzJst.exe
  C:\Windows\System\gwtzJst.exe
  2⤵
  PID:9192
- C:\Windows\System\zRGPKJQ.exe
  C:\Windows\System\zRGPKJQ.exe
  2⤵
  PID:8336
- C:\Windows\System\mxIYCGC.exe
  C:\Windows\System\mxIYCGC.exe
  2⤵
  PID:8756
- C:\Windows\System\SYaCRbo.exe
  C:\Windows\System\SYaCRbo.exe
  2⤵
  PID:8848
- C:\Windows\System\RzSuiNY.exe
  C:\Windows\System\RzSuiNY.exe
  2⤵
  PID:8580
- C:\Windows\System\qYyfqpb.exe
  C:\Windows\System\qYyfqpb.exe
  2⤵
  PID:8252
- C:\Windows\System\cILrOhy.exe
  C:\Windows\System\cILrOhy.exe
  2⤵
  PID:8516
- C:\Windows\System\wruuhOT.exe
  C:\Windows\System\wruuhOT.exe
  2⤵
  PID:8612
- C:\Windows\System\CXaRkqp.exe
  C:\Windows\System\CXaRkqp.exe
  2⤵
  PID:8688
- C:\Windows\System\IoGdEVW.exe
  C:\Windows\System\IoGdEVW.exe
  2⤵
  PID:8880
- C:\Windows\System\tTgxSDL.exe
  C:\Windows\System\tTgxSDL.exe
  2⤵
  PID:8984
- C:\Windows\System\ypMUxlD.exe
  C:\Windows\System\ypMUxlD.exe
  2⤵
  PID:9084
- C:\Windows\System\kgQngOd.exe
  C:\Windows\System\kgQngOd.exe
  2⤵
  PID:9148
- C:\Windows\System\DbobYnR.exe
  C:\Windows\System\DbobYnR.exe
  2⤵
  PID:9212
- C:\Windows\System\hQRzefy.exe
  C:\Windows\System\hQRzefy.exe
  2⤵
  PID:8220
- C:\Windows\System\zbnYuiC.exe
  C:\Windows\System\zbnYuiC.exe
  2⤵
  PID:8500
- C:\Windows\System\LtXeyGW.exe
  C:\Windows\System\LtXeyGW.exe
  2⤵
  PID:8736
- C:\Windows\System\hEzAShz.exe
  C:\Windows\System\hEzAShz.exe
  2⤵
  PID:8864
- C:\Windows\System\AhpUgTI.exe
  C:\Windows\System\AhpUgTI.exe
  2⤵
  PID:8360
- C:\Windows\System\lAiTqNU.exe
  C:\Windows\System\lAiTqNU.exe
  2⤵
  PID:9100
- C:\Windows\System\ArFWwZQ.exe
  C:\Windows\System\ArFWwZQ.exe
  2⤵
  PID:8788
- C:\Windows\System\wjTquUI.exe
  C:\Windows\System\wjTquUI.exe
  2⤵
  PID:8464
- C:\Windows\System\hGMrvIe.exe
  C:\Windows\System\hGMrvIe.exe
  2⤵
  PID:9052
- C:\Windows\System\ocjbDYC.exe
  C:\Windows\System\ocjbDYC.exe
  2⤵
  PID:8820
- C:\Windows\System\RLDuHcP.exe
  C:\Windows\System\RLDuHcP.exe
  2⤵
  PID:9208
- C:\Windows\System\exxGISA.exe
  C:\Windows\System\exxGISA.exe
  2⤵
  PID:8568
- C:\Windows\System\RPWFIit.exe
  C:\Windows\System\RPWFIit.exe
  2⤵
  PID:8988
- C:\Windows\System\wOAHtQG.exe
  C:\Windows\System\wOAHtQG.exe
  2⤵
  PID:8596
- C:\Windows\System\rwbSmFC.exe
  C:\Windows\System\rwbSmFC.exe
  2⤵
  PID:8940
- C:\Windows\System\OwYNZIt.exe
  C:\Windows\System\OwYNZIt.exe
  2⤵
  PID:8752
- C:\Windows\System\eOIQyYB.exe
  C:\Windows\System\eOIQyYB.exe
  2⤵
  PID:8632
- C:\Windows\System\SEbzdlO.exe
  C:\Windows\System\SEbzdlO.exe
  2⤵
  PID:8380
- C:\Windows\System\ySZgtQY.exe
  C:\Windows\System\ySZgtQY.exe
  2⤵
  PID:8692
- C:\Windows\System\NCOQZdm.exe
  C:\Windows\System\NCOQZdm.exe
  2⤵
  PID:8660
- C:\Windows\System\ebOAVJR.exe
  C:\Windows\System\ebOAVJR.exe
  2⤵
  PID:9116
- C:\Windows\System\fgztAyO.exe
  C:\Windows\System\fgztAyO.exe
  2⤵
  PID:8564
- C:\Windows\System\JoYBuOO.exe
  C:\Windows\System\JoYBuOO.exe
  2⤵
  PID:8652
- C:\Windows\System\yTXQsXv.exe
  C:\Windows\System\yTXQsXv.exe
  2⤵
  PID:9080
- C:\Windows\System\wBqreYl.exe
  C:\Windows\System\wBqreYl.exe
  2⤵
  PID:8484
- C:\Windows\System\qhPtpSa.exe
  C:\Windows\System\qhPtpSa.exe
  2⤵
  PID:8896
- C:\Windows\System\LJJtCLP.exe
  C:\Windows\System\LJJtCLP.exe
  2⤵
  PID:8300
- C:\Windows\System\GuYZTPL.exe
  C:\Windows\System\GuYZTPL.exe
  2⤵
  PID:9160
- C:\Windows\System\quoXGCi.exe
  C:\Windows\System\quoXGCi.exe
  2⤵
  PID:9220
- C:\Windows\System\GWJvITw.exe
  C:\Windows\System\GWJvITw.exe
  2⤵
  PID:9236
- C:\Windows\System\UTroTgb.exe
  C:\Windows\System\UTroTgb.exe
  2⤵
  PID:9252
- C:\Windows\System\FrSIweb.exe
  C:\Windows\System\FrSIweb.exe
  2⤵
  PID:9268
- C:\Windows\System\OqTaNUY.exe
  C:\Windows\System\OqTaNUY.exe
  2⤵
  PID:9284
- C:\Windows\System\DHbrZkt.exe
  C:\Windows\System\DHbrZkt.exe
  2⤵
  PID:9300
- C:\Windows\System\GcClUeT.exe
  C:\Windows\System\GcClUeT.exe
  2⤵
  PID:9316
- C:\Windows\System\VUgaBTk.exe
  C:\Windows\System\VUgaBTk.exe
  2⤵
  PID:9332
- C:\Windows\System\frusmNk.exe
  C:\Windows\System\frusmNk.exe
  2⤵
  PID:9348
- C:\Windows\System\DpFzyhP.exe
  C:\Windows\System\DpFzyhP.exe
  2⤵
  PID:9364
- C:\Windows\System\UnplLnL.exe
  C:\Windows\System\UnplLnL.exe
  2⤵
  PID:9380
- C:\Windows\System\CKudnSA.exe
  C:\Windows\System\CKudnSA.exe
  2⤵
  PID:9396
- C:\Windows\System\sXZRrqS.exe
  C:\Windows\System\sXZRrqS.exe
  2⤵
  PID:9412
- C:\Windows\System\IWSLBzl.exe
  C:\Windows\System\IWSLBzl.exe
  2⤵
  PID:9428
- C:\Windows\System\QUxoLHy.exe
  C:\Windows\System\QUxoLHy.exe
  2⤵
  PID:9444
- C:\Windows\System\HvIVmTL.exe
  C:\Windows\System\HvIVmTL.exe
  2⤵
  PID:9460
- C:\Windows\System\xLUZHyb.exe
  C:\Windows\System\xLUZHyb.exe
  2⤵
  PID:9476
- C:\Windows\System\zyxgUvC.exe
  C:\Windows\System\zyxgUvC.exe
  2⤵
  PID:9492
- C:\Windows\System\xeATWSn.exe
  C:\Windows\System\xeATWSn.exe
  2⤵
  PID:9508
- C:\Windows\System\MzKnNOB.exe
  C:\Windows\System\MzKnNOB.exe
  2⤵
  PID:9524
- C:\Windows\System\oLaNHDM.exe
  C:\Windows\System\oLaNHDM.exe
  2⤵
  PID:9540
- C:\Windows\System\ZStEWbF.exe
  C:\Windows\System\ZStEWbF.exe
  2⤵
  PID:9560
- C:\Windows\System\kakkyAb.exe
  C:\Windows\System\kakkyAb.exe
  2⤵
  PID:9576
- C:\Windows\System\YsSfXnJ.exe
  C:\Windows\System\YsSfXnJ.exe
  2⤵
  PID:9592
- C:\Windows\System\cbMjVol.exe
  C:\Windows\System\cbMjVol.exe
  2⤵
  PID:9608
- C:\Windows\System\PMJbeES.exe
  C:\Windows\System\PMJbeES.exe
  2⤵
  PID:9624
- C:\Windows\System\kHnSwgf.exe
  C:\Windows\System\kHnSwgf.exe
  2⤵
  PID:9640
- C:\Windows\System\JiLHyzS.exe
  C:\Windows\System\JiLHyzS.exe
  2⤵
  PID:9656
- C:\Windows\System\ShYGKvo.exe
  C:\Windows\System\ShYGKvo.exe
  2⤵
  PID:9672
- C:\Windows\System\EjPfyhV.exe
  C:\Windows\System\EjPfyhV.exe
  2⤵
  PID:9688
- C:\Windows\System\JxfqJgB.exe
  C:\Windows\System\JxfqJgB.exe
  2⤵
  PID:9704
- C:\Windows\System\hHTGyyD.exe
  C:\Windows\System\hHTGyyD.exe
  2⤵
  PID:9720
- C:\Windows\System\ABPsyhr.exe
  C:\Windows\System\ABPsyhr.exe
  2⤵
  PID:9736
- C:\Windows\System\NoNLoGA.exe
  C:\Windows\System\NoNLoGA.exe
  2⤵
  PID:9752
- C:\Windows\System\fBOvWVg.exe
  C:\Windows\System\fBOvWVg.exe
  2⤵
  PID:9768
- C:\Windows\System\qinDrKX.exe
  C:\Windows\System\qinDrKX.exe
  2⤵
  PID:9784
- C:\Windows\System\RNrjoAs.exe
  C:\Windows\System\RNrjoAs.exe
  2⤵
  PID:9800
- C:\Windows\System\IwHlclF.exe
  C:\Windows\System\IwHlclF.exe
  2⤵
  PID:9816
- C:\Windows\System\Lixrcrt.exe
  C:\Windows\System\Lixrcrt.exe
  2⤵
  PID:9832
- C:\Windows\System\BGvRIwJ.exe
  C:\Windows\System\BGvRIwJ.exe
  2⤵
  PID:9848
- C:\Windows\System\CzJSLYn.exe
  C:\Windows\System\CzJSLYn.exe
  2⤵
  PID:9864
- C:\Windows\System\KOQEHju.exe
  C:\Windows\System\KOQEHju.exe
  2⤵
  PID:9880
- C:\Windows\System\YUicfhr.exe
  C:\Windows\System\YUicfhr.exe
  2⤵
  PID:9896
- C:\Windows\System\uwaYFZe.exe
  C:\Windows\System\uwaYFZe.exe
  2⤵
  PID:9912
- C:\Windows\System\NALJCuL.exe
  C:\Windows\System\NALJCuL.exe
  2⤵
  PID:9928
- C:\Windows\System\VaVsBiR.exe
  C:\Windows\System\VaVsBiR.exe
  2⤵
  PID:9944
- C:\Windows\System\yhhYlsg.exe
  C:\Windows\System\yhhYlsg.exe
  2⤵
  PID:9960
- C:\Windows\System\POtbiHc.exe
  C:\Windows\System\POtbiHc.exe
  2⤵
  PID:9976
- C:\Windows\System\vhHFIKT.exe
  C:\Windows\System\vhHFIKT.exe
  2⤵
  PID:9992
- C:\Windows\System\QJIfRJg.exe
  C:\Windows\System\QJIfRJg.exe
  2⤵
  PID:10008
- C:\Windows\System\sqadJfi.exe
  C:\Windows\System\sqadJfi.exe
  2⤵
  PID:10024
- C:\Windows\System\vIopWPd.exe
  C:\Windows\System\vIopWPd.exe
  2⤵
  PID:10040
- C:\Windows\System\TijeKAs.exe
  C:\Windows\System\TijeKAs.exe
  2⤵
  PID:10056
- C:\Windows\System\KnYUicT.exe
  C:\Windows\System\KnYUicT.exe
  2⤵
  PID:10072
- C:\Windows\System\ekRQeMl.exe
  C:\Windows\System\ekRQeMl.exe
  2⤵
  PID:10088
- C:\Windows\System\UNvcmrZ.exe
  C:\Windows\System\UNvcmrZ.exe
  2⤵
  PID:10104
- C:\Windows\System\OImGjHt.exe
  C:\Windows\System\OImGjHt.exe
  2⤵
  PID:10120
- C:\Windows\System\qpaFbCF.exe
  C:\Windows\System\qpaFbCF.exe
  2⤵
  PID:10136
- C:\Windows\System\nKRIKjP.exe
  C:\Windows\System\nKRIKjP.exe
  2⤵
  PID:10152
- C:\Windows\System\plbgEzV.exe
  C:\Windows\System\plbgEzV.exe
  2⤵
  PID:10168
- C:\Windows\System\RqNWqjC.exe
  C:\Windows\System\RqNWqjC.exe
  2⤵
  PID:10184
- C:\Windows\System\WSGTLTs.exe
  C:\Windows\System\WSGTLTs.exe
  2⤵
  PID:10200
- C:\Windows\System\gAhjwXO.exe
  C:\Windows\System\gAhjwXO.exe
  2⤵
  PID:10216
- C:\Windows\System\NrpQveU.exe
  C:\Windows\System\NrpQveU.exe
  2⤵
  PID:10232
- C:\Windows\System\FdNHDqp.exe
  C:\Windows\System\FdNHDqp.exe
  2⤵
  PID:9260
- C:\Windows\System\UBPCbYQ.exe
  C:\Windows\System\UBPCbYQ.exe
  2⤵
  PID:9324
- C:\Windows\System\vgkNxEF.exe
  C:\Windows\System\vgkNxEF.exe
  2⤵
  PID:9388
- C:\Windows\System\msFryET.exe
  C:\Windows\System\msFryET.exe
  2⤵
  PID:9452
- C:\Windows\System\attcNcW.exe
  C:\Windows\System\attcNcW.exe
  2⤵
  PID:9516
- C:\Windows\System\uazaRmS.exe
  C:\Windows\System\uazaRmS.exe
  2⤵
  PID:9584
- C:\Windows\System\eAtuuXc.exe
  C:\Windows\System\eAtuuXc.exe
  2⤵
  PID:9652
- C:\Windows\System\xCwUTis.exe
  C:\Windows\System\xCwUTis.exe
  2⤵
  PID:9436
- C:\Windows\System\rDJVUKY.exe
  C:\Windows\System\rDJVUKY.exe
  2⤵
  PID:9776
- C:\Windows\System\lAjHJZU.exe
  C:\Windows\System\lAjHJZU.exe
  2⤵
  PID:9808
- C:\Windows\System\Jmuncbs.exe
  C:\Windows\System\Jmuncbs.exe
  2⤵
  PID:9812
- C:\Windows\System\FIczSUJ.exe
  C:\Windows\System\FIczSUJ.exe
  2⤵
  PID:8956
- C:\Windows\System\ElNvyQF.exe
  C:\Windows\System\ElNvyQF.exe
  2⤵
  PID:8656
- C:\Windows\System\oIpEsbr.exe
  C:\Windows\System\oIpEsbr.exe
  2⤵
  PID:9248
- C:\Windows\System\eqegbhT.exe
  C:\Windows\System\eqegbhT.exe
  2⤵
  PID:9404
- C:\Windows\System\dmPRGmr.exe
  C:\Windows\System\dmPRGmr.exe
  2⤵
  PID:9180
- C:\Windows\System\TdXaITd.exe
  C:\Windows\System\TdXaITd.exe
  2⤵
  PID:9600
- C:\Windows\System\tXDznxy.exe
  C:\Windows\System\tXDznxy.exe
  2⤵
  PID:9876
- C:\Windows\System\htxIyty.exe
  C:\Windows\System\htxIyty.exe
  2⤵
  PID:8332
- C:\Windows\System\LbaiBNH.exe
  C:\Windows\System\LbaiBNH.exe
  2⤵
  PID:9280
- C:\Windows\System\KtsJBdf.exe
  C:\Windows\System\KtsJBdf.exe
  2⤵
  PID:9312
- C:\Windows\System\SDesFeH.exe
  C:\Windows\System\SDesFeH.exe
  2⤵
  PID:9472
- C:\Windows\System\CEVcrpe.exe
  C:\Windows\System\CEVcrpe.exe
  2⤵
  PID:9632
- C:\Windows\System\ObdwHCr.exe
  C:\Windows\System\ObdwHCr.exe
  2⤵
  PID:9728
- C:\Windows\System\pSEBeJi.exe
  C:\Windows\System\pSEBeJi.exe
  2⤵
  PID:9908
- C:\Windows\System\rrMxrHN.exe
  C:\Windows\System\rrMxrHN.exe
  2⤵
  PID:9892
- C:\Windows\System\MhZUQZB.exe
  C:\Windows\System\MhZUQZB.exe
  2⤵
  PID:9920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AsFtdQr.exe

Filesize
1.7MB

MD5
b911560ab55ff39c791d167daae3ba3e

SHA1
0c6a223d207929ddb838da08a7e6e89678070156

SHA256
b53819b212b3f217d168a35d9f92535d63f19553b65d9f51f92ac607ab8f3556

SHA512
7d213e5a7050eed72b48118a3e569746a1cd726b32c0f9defe93019310387731b3cf8204efb6e9f3d7761446491df8d85e4e152c31f683811789ae224e5a2974

Download Submit
C:\Windows\system\CaKQAzM.exe

Filesize
1.7MB

MD5
3ff63782c7a23c6316def098c9111032

SHA1
b7a14c25b377b208ddf30351d98e128e3a5fbf1b

SHA256
2ea2c64be5984f85d2d0e4f3ab9ee14c5f7899893f5991ac071e2469d5bf082a

SHA512
d0f5ae314825fb119aa9adecd2ef1bc1e70e5d4f419f891709b12a571493b97eaf0a6960ca0baf353efe0d2f852b85d01aaf2622ea87fe1e070dabd1005f78c4

Download Submit
C:\Windows\system\DFaUCgf.exe

Filesize
1.7MB

MD5
0892c0eb997f0d0a9349caed5461df57

SHA1
1eb5096b9c67bb61fa7500a3d1baa93ac93c8434

SHA256
dc89dcdca394d1ad63f67ff98d4ffb6c34ca81c1be70662e1aea4e5d486c0285

SHA512
e84fe2c6521ae5ca155e9691991593dbb3035e73dda362c2d5dab6bf2fe7b348c3b051bcbc7bf8ad6c6bdcad42e6ae42eb3f79055c05858ebe01ef7d6fd5d438

Download Submit
C:\Windows\system\FEmvwxB.exe

Filesize
1.7MB

MD5
03302cda364de5a305c25e61a697adf7

SHA1
cbda44d7717a753c7d42d2954c0d2593facbf91a

SHA256
c7c1aac9b8d7555cd37e2d0f7bf3a9ce202be04c0668d46359b39d6e05d165ee

SHA512
de0f95b8b77f0704a0c56b6a3a035fc7a03297ab41b8143c29d246c4da20039895ce8bc588c65f4b271fa4e9d22571c37a1f921817805045bc96325d3707e9e8

Download Submit
C:\Windows\system\PMzYEUR.exe

Filesize
1.7MB

MD5
a892667320ad2f5c83845f0a1c852c1d

SHA1
b32b5ce4361f60676dc3eaaf6ca68c6ee7feae32

SHA256
6fe209f7a1eeae566cccf9480258748e9e3cf6848065a1d3a21877901346b469

SHA512
5c8114856f76c3d58ace33e3016f5661e5cd2be1eef89647c55ec48465b6da6c32efc1994f8a6e3b36d04549cdda91609a96f2d74efb5e85cf20c5b37f5178b3

Download Submit
C:\Windows\system\QfusdVL.exe

Filesize
1.7MB

MD5
4818a1dd3415c5ac1b453fea234f24d5

SHA1
4d3a4453152eeaad02379a7e3c25f37136864cc9

SHA256
177f3f10581a4d58513033014e14355b63e14fd73167ab6d864b8d248ad9c3d7

SHA512
31ab6c7964eca61111a8f92115d65b5e0c5df76feb9eea08abbcb2884cc3b7d08613b047dc30f80cf401d506203474e3faf9ab88faa5ae1bc047de1c5e1e3338

Download Submit
C:\Windows\system\SXzKikz.exe

Filesize
1.7MB

MD5
4353df16633f0892aeba609e9bfd6c11

SHA1
fdb37ec1714f68bc0aa134913b0b8c8f705207a3

SHA256
44a90226db8b695f796d00c997783d022992b7658abb550980c6de0111547cb2

SHA512
20d20b4854fc8dce49415afbc6c5163f0e243357aaaff3d1ff0afbade45d4fa5475da05833b66ec40029efc8cfc57f312fb69d0858dd300ddac580accb12b700

Download Submit
C:\Windows\system\UDRIiAj.exe

Filesize
1.7MB

MD5
fb776ffe8153b1e1b9d8c4278fe0e877

SHA1
8180ef0bcea199c8e704aad6f3378207596c80e7

SHA256
47be28462ff6784047e9e79fec73e8f7c29abfd613377988be9eea18744099ca

SHA512
4791f09f98d2e7717e00095f2cfc0dbed251b10cdc37d873a2c28abaf69a7a3e4ad9af8505c74dfc1e6acb3a4191d5648a1a750bbb52b5dbbcdcc5b3d6cb4781

Download Submit
C:\Windows\system\XyLVtkM.exe

Filesize
1.7MB

MD5
8ccd4da901750bda2abb7c441a552412

SHA1
d643e625e844986b666122fee46c637e21b59f80

SHA256
689b99e6a558f5faa0c75f30f17cef08065b424cda02ce0fd6bc3a151db8fe90

SHA512
412b4c19258c8c0960ac0c468c2e68c5c243972276318ad4948427525bac699d39dd6d30363c2d29a5027357c807e33cf0c9aacddb831dd8a679ae77c18a7b08

Download Submit
C:\Windows\system\ZJHLdAX.exe

Filesize
1.7MB

MD5
fb77497ea3273c4d5f3726800f754199

SHA1
1068436f8a248830f0dcd1c6449aabfff289a12e

SHA256
cde7c43675475e7a90b6b20fdde02e2fc555d0186101cda9a15cfe8192d9e9d5

SHA512
24c73c5874c11d460215dd9d522886c5d01d35cd92f18f9fd580d17dae32d1a2b3d67818ed2fd07a508aaeccf7bce151ed7d51f79372f0c92d2e66aea9a2d5c7

Download Submit
C:\Windows\system\ZkjKizK.exe

Filesize
1.7MB

MD5
d92cd99ff49246b32f5873a9388541c2

SHA1
95df43a20c75f33ec4961f7f5ac6738878b29c1c

SHA256
0022ab0c8330eaac7f7c7a2548af2f7bff5d538a2524c415d57346c68f81efc9

SHA512
f9fd539c9bf5bcc10917d9e3b49882bd5d04c21bff4b2a9249bac8c04a8529f550d38594c9f6fa40b3ed6038747e7e75269ee5551c1071579497a6fe39788b25

Download Submit
C:\Windows\system\bKIvxQa.exe

Filesize
1.7MB

MD5
1ab05fcb6baef65b284cc41b62294f56

SHA1
08cfcae9d14a4bbb92265addd934d26f91030bc9

SHA256
32fe1c8b8bdbbaefb0c22c83e96b0f1ff49b59ce0004ffd8c02fedcba563510c

SHA512
8fb6b4fd9fbfcceda69f0546e720218470389c05c050b453b64176b6fe8f495966516c9f546fcd0b3dbd3a99b84c229c15876c9d434a17f4d3316252476826c0

Download Submit
C:\Windows\system\dEWUzHW.exe

Filesize
1.7MB

MD5
935d73083ef5a35045a25ed265ebb30d

SHA1
648410c76d4365c982dc496a8d9eafa42138b803

SHA256
2caddfb8951db6173bdeacf8f397d9c9bf808320c9d02a9d51169f602065ff4a

SHA512
f8c70081f30f5449000622df1edea7c55c6a45f2ae9d9755444a14199e4eec19447f2187e08deb231a6a2b21f38fa899b1c2be34534b30764ee682e6df7a1278

Download Submit
C:\Windows\system\dYAcuBq.exe

Filesize
1.7MB

MD5
876b6a5fb9d07af3720155ed0591ba5b

SHA1
eb53839543793b39fed376521c541152c1fb069f

SHA256
c2c21ef734982d33d3f4b2d9764fc5d390d980999d56b7deb9568fd21444b7e4

SHA512
8cdb7d580d73c01fa7ab2cba17aecee4f0c7caa625669c68d5bd274b2fbff768f9ee15c5f58d122909d7d3fbb203131f8b32615632e222b3922486ce66241c19

Download Submit
C:\Windows\system\dqYSMLu.exe

Filesize
1.7MB

MD5
520dd67c383339419dc0f7413f0c36c1

SHA1
c0cf1228c7ff6bef17be8ccfad00c2bfaabe48b2

SHA256
085ac71208c2d7bce5636fd9445ca9403d2c08bd2b6cf712a8ddcbf60a7d79af

SHA512
2a7b5ddc1029b5249d173ca3abfa763319527f7513255d4fd728972c45f20173df10fe3df463ff1126db35c6bbc682a15de29ed3b34e11e16e13eb9b1d0ab031

Download Submit
C:\Windows\system\gjYjLzO.exe

Filesize
1.7MB

MD5
4ccce370fe4eec69468c5e66feec94d1

SHA1
7a2aad116c28d03f4809620e9ac64e91ea66fe77

SHA256
746f2f1166b5eece1abd3ab371e1c936f9ff5fd07d66b1661acc76d1a0f79d15

SHA512
3b351a0e1f2a510a4aeb37281000d582e157dab68358d61b08dde76e14faeeaa87db1f6714b4642d87f9fbf0f4d259285effaabb54465ed9414fd7b40a9b1f85

Download Submit
C:\Windows\system\iBOAYSf.exe

Filesize
1.7MB

MD5
ae791492ee1fd674eca23fc6fbc312d5

SHA1
a89c5cff24e2e093c4f5aca0794284dbe675f345

SHA256
4e9001168dcb1e60a0fe0d4a185231ba1eaa6c33e080f9bbd6569d8a4c7ebba8

SHA512
6bcfef728199cc62a8e3b2ca6ec84b3c3ef322b30c014ebda687c6fdeb66472bccef1f6eed1dc62c7b45980bae2045f5e2ccd36846ed4e91ca9f2737bdbb986b

Download Submit
C:\Windows\system\mBFTErh.exe

Filesize
1.7MB

MD5
b1c81af1d71be5cccc426e7fc21a9973

SHA1
8f92cf1b63e244f3c5eb65ec3e50fe2ca2efb917

SHA256
9f05aae1154638cca80eb2716dde57046500d357fa023dcedadabfd7cec1bef7

SHA512
2d9910b7170aad2a35a240b31fd80c25814ddfbd1b890b8a1c94aede46ab8f953ef957f07389658f7323fd93a9dc24bac613a6bef04ee5841b5455dc7effa68b

Download Submit
C:\Windows\system\mXjlYWD.exe

Filesize
1.7MB

MD5
0eaa746cab022cd3562683cf823bc542

SHA1
4dc9324c0a15dd8e4b931fdd8a7d987a278e9ee3

SHA256
5274a1ee13c919161774d0844939a011f189de193ed0b7b83203bebf9b406b7f

SHA512
a16f1b5c5a3d23beb9d9a02b41f46d6d781804cab03114d470493e9253aae8c89874abadbdce01141057b49d77ea905b0e635ca2c8006b84fc9b27dfdfe48512

Download Submit
C:\Windows\system\mqbpbAX.exe

Filesize
1.7MB

MD5
a67f96aef913f403655fdadd75568df0

SHA1
7bd192de365e70a8a3b44213dd86367d9b821143

SHA256
e7ac9d356346d9913e6e674264cad3678c4eca59a23aca64ca6d5a1ea7775377

SHA512
cf6402ff7667be68f81edd50322bf16da6a69c7df1d0bf18d22f74e488d824e948e18e7267d042412d29a2a57389707512cd627cb1425532eb1150d8b3792e55

Download Submit
C:\Windows\system\pMwrRCn.exe

Filesize
1.7MB

MD5
e1f49ac85f1841e122b5ebc67699c721

SHA1
0eb8a2970a7ec568618be7a177c3c2ef2247a1bf

SHA256
aa13f575c91f3d1be54a577ad2936a429b18ae05078dc9419d3fe1910c2a187f

SHA512
933a1749ce01bcfaed28a7c8eda1e5fd6c41436b6ecc6a23fd2cd947786b361c3e7af6f959eb94362d163cf9ac2ea261b49127278f0e600280ea84d5090978e4

Download Submit
C:\Windows\system\rynPNmY.exe

Filesize
1.7MB

MD5
b105e0885b6dd6a3923294eb3e1d676f

SHA1
74e3144046e969852b27bdaf471790407fe77df8

SHA256
d7edea3dda3c49008a1304b36f8dd77191c4c890e97ec87e0013b4a2354528bf

SHA512
9b3a367bb35508110b5255841f77be5b9a5dee6e66235ac6cae3180c73bd6b898630f85785402b007aa14654e687c0dd3b1c79c0b44df9a4dbc941243ac9539e

Download Submit
C:\Windows\system\tHvBLza.exe

Filesize
1.7MB

MD5
80e611c32ce0a52b751e2e6f3f9afd0d

SHA1
26328a6e40df768d548bd4a0aa8bd76f01ec22b5

SHA256
b8bfddea3441cd0388c57ce1f85097c7a3a8ecf2202f77c9044e14e9c779e6af

SHA512
5cf12822e022296f0e26519eab1ddaf3ed99b7a773cab647eecb3f8d830378d98d40e667122d301a588381c5dc5d5b6d97c89f58291154502e0cb745b7bdb17b

Download Submit
C:\Windows\system\yCSndBP.exe

Filesize
1.7MB

MD5
0220d72fc931a5d40dfea7a6c2051b0f

SHA1
1c7608942d4994f91d17be04ae8353f85cbda3d3

SHA256
1eee12587ade1320c13e690adfb3671b7b106e3158ed7203303be25bccf3e3d2

SHA512
4f72fed095f6213e6c4d9832fcbbf3a8141fcf11aa7b8459cdbecf49f08847c9609e9704df57f2ab2ca012befb0e9c9cff1de1f77666baaf1df6d87d88a57e34

Download Submit
\Windows\system\DwntwTj.exe

Filesize
1.7MB

MD5
d1e79c9be84610ccb3dc1f6437e79f71

SHA1
de76816d54aa14e7f87d1a4ffc49cb9c52689cad

SHA256
0968ef24bec1907dc1c9f6d824f6c977bb33c306799921c1b64fe12c1227e25b

SHA512
bb815cf3cf479b3ee62f85d3fafb62dee61360264c75d34305e3d25aa81be7f57156f2856e90727303e0eb4fd01fea920a627a86756124e707b34379f33c235a

Download Submit
\Windows\system\FivOeSB.exe

Filesize
1.7MB

MD5
8a82f2c3265d4e17371465362e77f0d8

SHA1
27246bbd9b29ad3824747c7621945b0cdc815921

SHA256
8631c96c68a9f252c80147c9bbf406ead559ce68f11e66f6ded37c34951c1b7f

SHA512
f940cd46b2b57cffefc4dadf67cec1ffaf6f26fd4c4935b31a9157988903d919b7a1d857e213fd437745ca8645b646b4c92177156b2c07c56bc238507363ce40

Download Submit
\Windows\system\PnPsWEC.exe

Filesize
1.7MB

MD5
ddcb9dd41caab79bb4b9f78140538954

SHA1
5872262df97163c821ed98c7369f1f40cfc91caf

SHA256
f76355bb783913065251581181e4d4e008183ed407fa47f56215dbfb848867b2

SHA512
9106dc5d71171c00f040cb5cd4e6e4b3b537c8cd070cda58b55b0721dab26dbb69b47ba50f7736b9798ac5178d68e5182fd61e21b734ec5c2ad821ff8b5bad83

Download Submit
\Windows\system\WIFdUUL.exe

Filesize
1.7MB

MD5
5bc0bf287b8c5dfe383cdcc9988cd4f5

SHA1
3aa4343eaf9eab8426b671ef30ba52bd19d8f08b

SHA256
eb4786ea12316869122417c6c429db637c2a4726db778e12855c2bab7de37424

SHA512
3242fd5fb0fc78f922f2ff7d2ffd93bc7197518b6d4e4a4ed47dc9cf38903eb8dd14dd07eb622af7e2979586df10bc78ce19a01ed3c58762ce4085ad115b03f1

Download Submit
\Windows\system\bowHzTM.exe

Filesize
1.7MB

MD5
0b85835e04a91e0704b16937dbde96f9

SHA1
2d6f3c62862c7e742a80d2ea70ce10c0e24546f1

SHA256
c12113cd462d870b7dbe3c104693caf4c6c9f9db2803436ecb5b85c6b2fa9f64

SHA512
e1bb698f7f8dc980dc33599b96a9cba431750fb1ffa9b4c4ada72383b8d55826e01256562d2c6a576bbe0a7141098c94aa2df5fa3adcb323bbf3b90291262c32

Download Submit
\Windows\system\kPqwTBU.exe

Filesize
1.7MB

MD5
cd81aa91de0952d131d1ba00feace33d

SHA1
ead611556966eb04713426f9a8a5c0bc6418eae5

SHA256
b52029fc2eff48ad2488918c93b94eb0ee7bf6a9e55fa93510565dedfd5422d6

SHA512
675d13a578909b8ec27082b4586ebae78c009d3c66a3509fbade35108ea80e8cafb8ce2a2cd39a605d6bb7438e7a7b7668ad0809454febae9bdce6df9c23aaeb

Download Submit
\Windows\system\ooFUATZ.exe

Filesize
1.7MB

MD5
609b0e22e4ea5d5c2a89810d6d51ee4b

SHA1
8dc55388e719af4505935ed0ddad50711768bc01

SHA256
8d950659278b4bcb11166d236e897b8fbaacaa9b4c7defbc74e8655ce56bcbf8

SHA512
03b3275264161359e07b8a3006b6bf739afe2f46f316d28f0b053e7e07b6b9d115b28d1244eb9666cb729ecef3e4029b6dd5807617b3c07a7ef7e28948e38d64

Download Submit
\Windows\system\xyUQPhz.exe

Filesize
1.7MB

MD5
3087b1252ee92d682cf0fd0a7680e26a

SHA1
7fbdc1268190d74a0ecdbf47ba9af1c38ee6c2a7

SHA256
41fcf58aaba753c57df01cc370cb88806b1f7b9e53e7ecc9b7c40234d920e4a9

SHA512
85a2f8c1bfdaa2dc0eaeac157b9f19a04a1b6dc8d67316cc4530f323e94c19ee309cfc95942c422177c58e51ca4f49e94b82af2274bd7a1815ea4703642d49c6

Download Submit
memory/1652-123-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/1652-92-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/1652-0-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/1652-125-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/1652-133-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/1652-106-0x0000000003110000-0x0000000003502000-memory.dmp

Filesize
3.9MB

Download
memory/1652-105-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/1652-104-0x000000013FC30000-0x0000000140022000-memory.dmp

Filesize
3.9MB

Download
memory/1652-103-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/1652-24-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/1652-74-0x0000000003110000-0x0000000003502000-memory.dmp

Filesize
3.9MB

Download
memory/1652-122-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/1652-98-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/1652-57-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/1652-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1652-64-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/1652-32-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2024-252-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2024-250-0x000000001B860000-0x000000001BB42000-memory.dmp

Filesize
2.9MB

Download
memory/2128-52-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2656-83-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/3056-17-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download