xmrig | 08b1fb7571cabe7fed53d86bb881223bb6b6905e0b22ab0bd0c1d8251bc5daaa

Analysis

max time kernel
18s
max time network
29s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

07a562b703be3290371261ffddb63500_JaffaCakes118.exe
Size

2.2MB
MD5

07a562b703be3290371261ffddb63500
SHA1

49e8e142c7a5a6e176dac7fe67a8b62399acea21
SHA256

08b1fb7571cabe7fed53d86bb881223bb6b6905e0b22ab0bd0c1d8251bc5daaa
SHA512

dcd9412fc3c6e01568528c7ea953f4986f935415b9a0578f71078e19eb2f809c4b6b60a20de9f78eadaa02981eff13fc318b017c0211f674c0b482104a3f4544
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrf6:NABb

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2772-349-0x000000013F420000-0x000000013F812000-memory.dmp	xmrig
behavioral1/memory/2612-432-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/1720-434-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2552-438-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2752-440-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig
behavioral1/memory/2580-442-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/3060-435-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2328-433-0x000000013F590000-0x000000013F982000-memory.dmp	xmrig
behavioral1/memory/2728-429-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1184	OOxhiqY.exe
2772	payXavk.exe
2728	qPCatFx.exe
2612	sVzCfjH.exe
2328	flJtvOH.exe
1720	FeKwtNv.exe
3060	xntBiyX.exe
2552	CNENZaC.exe
2752	gjLLjTD.exe
2580	sYPlkMU.exe
2356	ebZcSeb.exe
1448	aFSIMaX.exe
2640	PGZodkR.exe
2808	BFeCAZQ.exe
2016	PSnFSmU.exe
1308	VRBJpfL.exe
2360	HqwyduA.exe
2512	bQZFrfE.exe
1704	QOTRgqn.exe
1952	IxYACJj.exe
1048	jzEtUjn.exe
2604	lADlqxw.exe
1244	BMxWkwd.exe
2012	mlnLaHC.exe
1280	vAChbeP.exe
2460	iWOWxLA.exe
2268	MPRsgTc.exe
2276	rvaTczT.exe
664	urKwivW.exe
1500	xhvZJbo.exe
1144	YFrGpek.exe
980	hqFwZGX.exe
1484	ZOaCszr.exe
2476	rHhKVOF.exe
876	gwlviuq.exe
1128	ROVjIFK.exe
3032	cYuijjb.exe
1996	NVUTjDU.exe
2876	epZaztP.exe
1292	HKxaDQe.exe
996	tUlgAte.exe
1532	BFgrXNm.exe
1960	gzCsOUX.exe
2320	NHJFONd.exe
2980	GHTuRNe.exe
2848	rcKLsDC.exe
2132	JirDvxF.exe
1440	tOcqcmk.exe
2228	gJbqVJk.exe
1712	wrjzWKd.exe
2408	tJxvXxY.exe
2544	JErdvMy.exe
2564	GMjtwFb.exe
2496	TJBJlTD.exe
2400	NtFPjHU.exe
828	iqUaflr.exe
2768	qKwaybT.exe
1032	sIPCWbI.exe
2800	aRmoHKV.exe
1920	ZEKaxwJ.exe
1152	xOsfYtQ.exe
1492	beJMprJ.exe
1276	CeMbIHi.exe
2144	bWagsli.exe

Loads dropped DLL 64 IoCs

pid	Process
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2176-0-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/files/0x000b000000012279-3.dat	upx
behavioral1/memory/1184-14-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/files/0x0006000000016c5b-37.dat	upx
behavioral1/files/0x0007000000015d1e-36.dat	upx
behavioral1/files/0x002c000000015ca9-42.dat	upx
behavioral1/files/0x0006000000016d19-64.dat	upx
behavioral1/files/0x0006000000016d3e-76.dat	upx
behavioral1/files/0x0006000000016d4f-87.dat	upx
behavioral1/files/0x0008000000015ce1-18.dat	upx
behavioral1/files/0x0007000000015d02-25.dat	upx
behavioral1/files/0x0006000000016d73-130.dat	upx
behavioral1/files/0x0007000000016cf2-141.dat	upx
behavioral1/files/0x00060000000171ad-148.dat	upx
behavioral1/files/0x00060000000173e5-166.dat	upx
behavioral1/files/0x000600000001738e-164.dat	upx
behavioral1/files/0x00060000000173e2-162.dat	upx
behavioral1/files/0x000600000001708c-146.dat	upx
behavioral1/files/0x000600000001738f-159.dat	upx
behavioral1/files/0x00130000000054a8-137.dat	upx
behavioral1/files/0x0006000000016d36-119.dat	upx
behavioral1/files/0x0006000000016d21-117.dat	upx
behavioral1/files/0x0006000000016d10-115.dat	upx
behavioral1/files/0x0006000000016ca1-113.dat	upx
behavioral1/files/0x0006000000016d7d-107.dat	upx
behavioral1/files/0x0006000000016d5f-99.dat	upx
behavioral1/files/0x0006000000016d57-90.dat	upx
behavioral1/files/0x0008000000016c57-86.dat	upx
behavioral1/files/0x0006000000016d46-81.dat	upx
behavioral1/files/0x0007000000015d13-59.dat	upx
behavioral1/files/0x0006000000016fa9-123.dat	upx
behavioral1/files/0x0008000000015ced-15.dat	upx
behavioral1/files/0x0006000000016d79-104.dat	upx
behavioral1/files/0x0006000000016d2d-71.dat	upx
behavioral1/files/0x0006000000016d01-53.dat	upx
behavioral1/memory/2772-349-0x000000013F420000-0x000000013F812000-memory.dmp	upx
behavioral1/memory/2612-432-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/memory/1720-434-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2552-438-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2752-440-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/memory/2580-442-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/3060-435-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2328-433-0x000000013F590000-0x000000013F982000-memory.dmp	upx
behavioral1/memory/2728-429-0x000000013F360000-0x000000013F752000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LSjpehZ.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\cvCnGwN.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\ggabuTj.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\LgxePXg.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\ybuipER.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\KjRqsIV.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\BnQEHqD.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\ZogImoh.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\JirDvxF.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\NYxjCEU.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\wBHtCPd.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\JHRyBqm.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\REgFFxL.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\TTbCeNI.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\UZjNItA.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\lxOKHZm.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\qqaXgpb.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\FpUzQMw.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\pFfQGSx.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\kwUcaxD.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\xgYGXlr.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\zAqMdbj.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\lwNwXuw.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\eWkfQin.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\kojzGzK.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\LYjPSKp.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\NVUTjDU.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\wrjzWKd.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\iwknHyC.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\nqQbyQF.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\jMRLICA.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\RQFrEII.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\jzflgoa.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\CTxwCtv.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\tYDSCvf.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\LEfrVjg.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\TukstNQ.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\vAoaSvX.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\ebZcSeb.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\NIZTwka.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\ZPGlgfr.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\zxOpbYe.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\CYXNLQa.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\esbfMMN.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\iRbLGKY.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\EcugXlE.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\UPMaaPv.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\SpCDVwI.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\sfRYlqJ.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\AUQGNFs.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\mgCOUAQ.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\wstWcXR.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\neyZZra.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\yqcaqsv.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\hjzxYuR.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\UjMrLfL.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\iBexoQZ.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\ctvwBfK.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\egoaPzD.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\FYkfdyU.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\ghMBNUM.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\payXavk.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\HqwyduA.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
File created	C:\Windows\System\RDYbbbE.exe	07a562b703be3290371261ffddb63500_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2260	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeLockMemoryPrivilege	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2260	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	29
PID 2176 wrote to memory of 2260	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	29
PID 2176 wrote to memory of 2260	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	29
PID 2176 wrote to memory of 1184	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	30
PID 2176 wrote to memory of 1184	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	30
PID 2176 wrote to memory of 1184	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	30
PID 2176 wrote to memory of 1720	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	31
PID 2176 wrote to memory of 1720	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	31
PID 2176 wrote to memory of 1720	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	31
PID 2176 wrote to memory of 2772	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	32
PID 2176 wrote to memory of 2772	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	32
PID 2176 wrote to memory of 2772	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	32
PID 2176 wrote to memory of 3060	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	33
PID 2176 wrote to memory of 3060	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	33
PID 2176 wrote to memory of 3060	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	33
PID 2176 wrote to memory of 2728	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	34
PID 2176 wrote to memory of 2728	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	34
PID 2176 wrote to memory of 2728	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	34
PID 2176 wrote to memory of 2752	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	35
PID 2176 wrote to memory of 2752	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	35
PID 2176 wrote to memory of 2752	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	35
PID 2176 wrote to memory of 2612	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	36
PID 2176 wrote to memory of 2612	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	36
PID 2176 wrote to memory of 2612	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	36
PID 2176 wrote to memory of 2640	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	37
PID 2176 wrote to memory of 2640	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	37
PID 2176 wrote to memory of 2640	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	37
PID 2176 wrote to memory of 2328	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	38
PID 2176 wrote to memory of 2328	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	38
PID 2176 wrote to memory of 2328	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	38
PID 2176 wrote to memory of 2360	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	39
PID 2176 wrote to memory of 2360	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	39
PID 2176 wrote to memory of 2360	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	39
PID 2176 wrote to memory of 2552	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	40
PID 2176 wrote to memory of 2552	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	40
PID 2176 wrote to memory of 2552	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	40
PID 2176 wrote to memory of 2512	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	41
PID 2176 wrote to memory of 2512	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	41
PID 2176 wrote to memory of 2512	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	41
PID 2176 wrote to memory of 2580	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	42
PID 2176 wrote to memory of 2580	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	42
PID 2176 wrote to memory of 2580	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	42
PID 2176 wrote to memory of 1704	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	43
PID 2176 wrote to memory of 1704	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	43
PID 2176 wrote to memory of 1704	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	43
PID 2176 wrote to memory of 2356	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	44
PID 2176 wrote to memory of 2356	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	44
PID 2176 wrote to memory of 2356	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	44
PID 2176 wrote to memory of 1952	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	45
PID 2176 wrote to memory of 1952	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	45
PID 2176 wrote to memory of 1952	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	45
PID 2176 wrote to memory of 1448	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	46
PID 2176 wrote to memory of 1448	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	46
PID 2176 wrote to memory of 1448	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	46
PID 2176 wrote to memory of 2604	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	47
PID 2176 wrote to memory of 2604	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	47
PID 2176 wrote to memory of 2604	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	47
PID 2176 wrote to memory of 2808	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	48
PID 2176 wrote to memory of 2808	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	48
PID 2176 wrote to memory of 2808	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	48
PID 2176 wrote to memory of 1244	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	49
PID 2176 wrote to memory of 1244	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	49
PID 2176 wrote to memory of 1244	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	49
PID 2176 wrote to memory of 2016	2176	07a562b703be3290371261ffddb63500_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\07a562b703be3290371261ffddb63500_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07a562b703be3290371261ffddb63500_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Windows\System\OOxhiqY.exe
  C:\Windows\System\OOxhiqY.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\FeKwtNv.exe
  C:\Windows\System\FeKwtNv.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\payXavk.exe
  C:\Windows\System\payXavk.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\xntBiyX.exe
  C:\Windows\System\xntBiyX.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\qPCatFx.exe
  C:\Windows\System\qPCatFx.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\gjLLjTD.exe
  C:\Windows\System\gjLLjTD.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\sVzCfjH.exe
  C:\Windows\System\sVzCfjH.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\PGZodkR.exe
  C:\Windows\System\PGZodkR.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\flJtvOH.exe
  C:\Windows\System\flJtvOH.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\HqwyduA.exe
  C:\Windows\System\HqwyduA.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\CNENZaC.exe
  C:\Windows\System\CNENZaC.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\bQZFrfE.exe
  C:\Windows\System\bQZFrfE.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\sYPlkMU.exe
  C:\Windows\System\sYPlkMU.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\QOTRgqn.exe
  C:\Windows\System\QOTRgqn.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\ebZcSeb.exe
  C:\Windows\System\ebZcSeb.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\IxYACJj.exe
  C:\Windows\System\IxYACJj.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\aFSIMaX.exe
  C:\Windows\System\aFSIMaX.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\lADlqxw.exe
  C:\Windows\System\lADlqxw.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\BFeCAZQ.exe
  C:\Windows\System\BFeCAZQ.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\BMxWkwd.exe
  C:\Windows\System\BMxWkwd.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\PSnFSmU.exe
  C:\Windows\System\PSnFSmU.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\mlnLaHC.exe
  C:\Windows\System\mlnLaHC.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\VRBJpfL.exe
  C:\Windows\System\VRBJpfL.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\vAChbeP.exe
  C:\Windows\System\vAChbeP.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\jzEtUjn.exe
  C:\Windows\System\jzEtUjn.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\iWOWxLA.exe
  C:\Windows\System\iWOWxLA.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\MPRsgTc.exe
  C:\Windows\System\MPRsgTc.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\rvaTczT.exe
  C:\Windows\System\rvaTczT.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\urKwivW.exe
  C:\Windows\System\urKwivW.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\YFrGpek.exe
  C:\Windows\System\YFrGpek.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\xhvZJbo.exe
  C:\Windows\System\xhvZJbo.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\ZOaCszr.exe
  C:\Windows\System\ZOaCszr.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\hqFwZGX.exe
  C:\Windows\System\hqFwZGX.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\rHhKVOF.exe
  C:\Windows\System\rHhKVOF.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\gwlviuq.exe
  C:\Windows\System\gwlviuq.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\ROVjIFK.exe
  C:\Windows\System\ROVjIFK.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\cYuijjb.exe
  C:\Windows\System\cYuijjb.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\NVUTjDU.exe
  C:\Windows\System\NVUTjDU.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\epZaztP.exe
  C:\Windows\System\epZaztP.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\HKxaDQe.exe
  C:\Windows\System\HKxaDQe.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\tUlgAte.exe
  C:\Windows\System\tUlgAte.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\gavFgcU.exe
  C:\Windows\System\gavFgcU.exe
  2⤵
  PID:2440
- C:\Windows\System\BFgrXNm.exe
  C:\Windows\System\BFgrXNm.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\VJaRTgM.exe
  C:\Windows\System\VJaRTgM.exe
  2⤵
  PID:1700
- C:\Windows\System\gzCsOUX.exe
  C:\Windows\System\gzCsOUX.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\DfwGCfE.exe
  C:\Windows\System\DfwGCfE.exe
  2⤵
  PID:796
- C:\Windows\System\NHJFONd.exe
  C:\Windows\System\NHJFONd.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\ZhFBeof.exe
  C:\Windows\System\ZhFBeof.exe
  2⤵
  PID:3028
- C:\Windows\System\GHTuRNe.exe
  C:\Windows\System\GHTuRNe.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\RsqHJpC.exe
  C:\Windows\System\RsqHJpC.exe
  2⤵
  PID:628
- C:\Windows\System\rcKLsDC.exe
  C:\Windows\System\rcKLsDC.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\CaibCXZ.exe
  C:\Windows\System\CaibCXZ.exe
  2⤵
  PID:2992
- C:\Windows\System\JirDvxF.exe
  C:\Windows\System\JirDvxF.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\ANsBoqz.exe
  C:\Windows\System\ANsBoqz.exe
  2⤵
  PID:1688
- C:\Windows\System\tOcqcmk.exe
  C:\Windows\System\tOcqcmk.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\knSSkeU.exe
  C:\Windows\System\knSSkeU.exe
  2⤵
  PID:2432
- C:\Windows\System\gJbqVJk.exe
  C:\Windows\System\gJbqVJk.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\SRPKJZK.exe
  C:\Windows\System\SRPKJZK.exe
  2⤵
  PID:1596
- C:\Windows\System\wrjzWKd.exe
  C:\Windows\System\wrjzWKd.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\YXxxHAZ.exe
  C:\Windows\System\YXxxHAZ.exe
  2⤵
  PID:2088
- C:\Windows\System\tJxvXxY.exe
  C:\Windows\System\tJxvXxY.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\ZgJnNoZ.exe
  C:\Windows\System\ZgJnNoZ.exe
  2⤵
  PID:2856
- C:\Windows\System\JErdvMy.exe
  C:\Windows\System\JErdvMy.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\IJLQqyC.exe
  C:\Windows\System\IJLQqyC.exe
  2⤵
  PID:2532
- C:\Windows\System\GMjtwFb.exe
  C:\Windows\System\GMjtwFb.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\eWkfQin.exe
  C:\Windows\System\eWkfQin.exe
  2⤵
  PID:2956
- C:\Windows\System\TJBJlTD.exe
  C:\Windows\System\TJBJlTD.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\PGfXbyN.exe
  C:\Windows\System\PGfXbyN.exe
  2⤵
  PID:2020
- C:\Windows\System\NtFPjHU.exe
  C:\Windows\System\NtFPjHU.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\YwfEQaF.exe
  C:\Windows\System\YwfEQaF.exe
  2⤵
  PID:2636
- C:\Windows\System\iqUaflr.exe
  C:\Windows\System\iqUaflr.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\hmPunKZ.exe
  C:\Windows\System\hmPunKZ.exe
  2⤵
  PID:2716
- C:\Windows\System\qKwaybT.exe
  C:\Windows\System\qKwaybT.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\iRbLGKY.exe
  C:\Windows\System\iRbLGKY.exe
  2⤵
  PID:2528
- C:\Windows\System\sIPCWbI.exe
  C:\Windows\System\sIPCWbI.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\gvfFRTT.exe
  C:\Windows\System\gvfFRTT.exe
  2⤵
  PID:2484
- C:\Windows\System\aRmoHKV.exe
  C:\Windows\System\aRmoHKV.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\GAABxTe.exe
  C:\Windows\System\GAABxTe.exe
  2⤵
  PID:1228
- C:\Windows\System\ZEKaxwJ.exe
  C:\Windows\System\ZEKaxwJ.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\PwhUiqQ.exe
  C:\Windows\System\PwhUiqQ.exe
  2⤵
  PID:2236
- C:\Windows\System\xOsfYtQ.exe
  C:\Windows\System\xOsfYtQ.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\QkXWdGl.exe
  C:\Windows\System\QkXWdGl.exe
  2⤵
  PID:2804
- C:\Windows\System\beJMprJ.exe
  C:\Windows\System\beJMprJ.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\IoPUmyH.exe
  C:\Windows\System\IoPUmyH.exe
  2⤵
  PID:1792
- C:\Windows\System\CeMbIHi.exe
  C:\Windows\System\CeMbIHi.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\BRKuMCC.exe
  C:\Windows\System\BRKuMCC.exe
  2⤵
  PID:580
- C:\Windows\System\bWagsli.exe
  C:\Windows\System\bWagsli.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\mgCOUAQ.exe
  C:\Windows\System\mgCOUAQ.exe
  2⤵
  PID:1080
- C:\Windows\System\WoMcNtJ.exe
  C:\Windows\System\WoMcNtJ.exe
  2⤵
  PID:1696
- C:\Windows\System\WpAafgO.exe
  C:\Windows\System\WpAafgO.exe
  2⤵
  PID:1556
- C:\Windows\System\VaLtNpf.exe
  C:\Windows\System\VaLtNpf.exe
  2⤵
  PID:600
- C:\Windows\System\MCEtscE.exe
  C:\Windows\System\MCEtscE.exe
  2⤵
  PID:1984
- C:\Windows\System\ePyJJAn.exe
  C:\Windows\System\ePyJJAn.exe
  2⤵
  PID:840
- C:\Windows\System\mIkdsjp.exe
  C:\Windows\System\mIkdsjp.exe
  2⤵
  PID:1744
- C:\Windows\System\fyixBAY.exe
  C:\Windows\System\fyixBAY.exe
  2⤵
  PID:2344
- C:\Windows\System\RDYbbbE.exe
  C:\Windows\System\RDYbbbE.exe
  2⤵
  PID:2668
- C:\Windows\System\hkULICz.exe
  C:\Windows\System\hkULICz.exe
  2⤵
  PID:1936
- C:\Windows\System\GgEMOBc.exe
  C:\Windows\System\GgEMOBc.exe
  2⤵
  PID:2588
- C:\Windows\System\fEFNzkA.exe
  C:\Windows\System\fEFNzkA.exe
  2⤵
  PID:2816
- C:\Windows\System\vdLvbiO.exe
  C:\Windows\System\vdLvbiO.exe
  2⤵
  PID:1684
- C:\Windows\System\OkMYSJH.exe
  C:\Windows\System\OkMYSJH.exe
  2⤵
  PID:2928
- C:\Windows\System\SKRKRDs.exe
  C:\Windows\System\SKRKRDs.exe
  2⤵
  PID:2696
- C:\Windows\System\iwknHyC.exe
  C:\Windows\System\iwknHyC.exe
  2⤵
  PID:1040
- C:\Windows\System\ujRvnBp.exe
  C:\Windows\System\ujRvnBp.exe
  2⤵
  PID:2232
- C:\Windows\System\LSjpehZ.exe
  C:\Windows\System\LSjpehZ.exe
  2⤵
  PID:2628
- C:\Windows\System\RQFrEII.exe
  C:\Windows\System\RQFrEII.exe
  2⤵
  PID:448
- C:\Windows\System\nXzVTmh.exe
  C:\Windows\System\nXzVTmh.exe
  2⤵
  PID:3004
- C:\Windows\System\QqCwXPm.exe
  C:\Windows\System\QqCwXPm.exe
  2⤵
  PID:2952
- C:\Windows\System\fNiWLGn.exe
  C:\Windows\System\fNiWLGn.exe
  2⤵
  PID:2624
- C:\Windows\System\YIjOFyi.exe
  C:\Windows\System\YIjOFyi.exe
  2⤵
  PID:1716
- C:\Windows\System\styWSYM.exe
  C:\Windows\System\styWSYM.exe
  2⤵
  PID:2292
- C:\Windows\System\zeVOqwK.exe
  C:\Windows\System\zeVOqwK.exe
  2⤵
  PID:1948
- C:\Windows\System\NYxjCEU.exe
  C:\Windows\System\NYxjCEU.exe
  2⤵
  PID:2108
- C:\Windows\System\dNzkCkp.exe
  C:\Windows\System\dNzkCkp.exe
  2⤵
  PID:2036
- C:\Windows\System\OFKtDEi.exe
  C:\Windows\System\OFKtDEi.exe
  2⤵
  PID:1264
- C:\Windows\System\OuBTUNk.exe
  C:\Windows\System\OuBTUNk.exe
  2⤵
  PID:1944
- C:\Windows\System\UZuOlVk.exe
  C:\Windows\System\UZuOlVk.exe
  2⤵
  PID:2172
- C:\Windows\System\vpMaXRt.exe
  C:\Windows\System\vpMaXRt.exe
  2⤵
  PID:3196
- C:\Windows\System\wBHtCPd.exe
  C:\Windows\System\wBHtCPd.exe
  2⤵
  PID:3216
- C:\Windows\System\pPwCHGD.exe
  C:\Windows\System\pPwCHGD.exe
  2⤵
  PID:3252
- C:\Windows\System\JHRyBqm.exe
  C:\Windows\System\JHRyBqm.exe
  2⤵
  PID:3276
- C:\Windows\System\evIMLdY.exe
  C:\Windows\System\evIMLdY.exe
  2⤵
  PID:3292
- C:\Windows\System\MNBdwgh.exe
  C:\Windows\System\MNBdwgh.exe
  2⤵
  PID:3316
- C:\Windows\System\rwKwLLm.exe
  C:\Windows\System\rwKwLLm.exe
  2⤵
  PID:3332
- C:\Windows\System\xqLcUQg.exe
  C:\Windows\System\xqLcUQg.exe
  2⤵
  PID:3348
- C:\Windows\System\pMoiPcW.exe
  C:\Windows\System\pMoiPcW.exe
  2⤵
  PID:3368
- C:\Windows\System\bdfPUnv.exe
  C:\Windows\System\bdfPUnv.exe
  2⤵
  PID:3400
- C:\Windows\System\PZEzWGM.exe
  C:\Windows\System\PZEzWGM.exe
  2⤵
  PID:3656
- C:\Windows\System\KuSTtiN.exe
  C:\Windows\System\KuSTtiN.exe
  2⤵
  PID:3676
- C:\Windows\System\KYBIDCw.exe
  C:\Windows\System\KYBIDCw.exe
  2⤵
  PID:3692
- C:\Windows\System\wGvGgwL.exe
  C:\Windows\System\wGvGgwL.exe
  2⤵
  PID:3712
- C:\Windows\System\mZBhPYD.exe
  C:\Windows\System\mZBhPYD.exe
  2⤵
  PID:3728
- C:\Windows\System\eEMWCJM.exe
  C:\Windows\System\eEMWCJM.exe
  2⤵
  PID:3744
- C:\Windows\System\xhwWXaT.exe
  C:\Windows\System\xhwWXaT.exe
  2⤵
  PID:3764
- C:\Windows\System\cvCnGwN.exe
  C:\Windows\System\cvCnGwN.exe
  2⤵
  PID:3788
- C:\Windows\System\NIZTwka.exe
  C:\Windows\System\NIZTwka.exe
  2⤵
  PID:3804
- C:\Windows\System\yyMjDDR.exe
  C:\Windows\System\yyMjDDR.exe
  2⤵
  PID:3824
- C:\Windows\System\yGlOLCx.exe
  C:\Windows\System\yGlOLCx.exe
  2⤵
  PID:3840
- C:\Windows\System\VICyLTY.exe
  C:\Windows\System\VICyLTY.exe
  2⤵
  PID:3876
- C:\Windows\System\hSXMdpA.exe
  C:\Windows\System\hSXMdpA.exe
  2⤵
  PID:3892
- C:\Windows\System\SDTimKs.exe
  C:\Windows\System\SDTimKs.exe
  2⤵
  PID:3912
- C:\Windows\System\hyxNfVv.exe
  C:\Windows\System\hyxNfVv.exe
  2⤵
  PID:3928
- C:\Windows\System\MlvoSYy.exe
  C:\Windows\System\MlvoSYy.exe
  2⤵
  PID:3952
- C:\Windows\System\NvwSSOr.exe
  C:\Windows\System\NvwSSOr.exe
  2⤵
  PID:3968
- C:\Windows\System\peiOmhg.exe
  C:\Windows\System\peiOmhg.exe
  2⤵
  PID:3988
- C:\Windows\System\FeGeMTG.exe
  C:\Windows\System\FeGeMTG.exe
  2⤵
  PID:4004
- C:\Windows\System\LwPRuBT.exe
  C:\Windows\System\LwPRuBT.exe
  2⤵
  PID:4024
- C:\Windows\System\LYfiFlM.exe
  C:\Windows\System\LYfiFlM.exe
  2⤵
  PID:4040
- C:\Windows\System\wjDgWYy.exe
  C:\Windows\System\wjDgWYy.exe
  2⤵
  PID:4056
- C:\Windows\System\VhndxZm.exe
  C:\Windows\System\VhndxZm.exe
  2⤵
  PID:4076
- C:\Windows\System\BuEotVj.exe
  C:\Windows\System\BuEotVj.exe
  2⤵
  PID:2836
- C:\Windows\System\Itupdih.exe
  C:\Windows\System\Itupdih.exe
  2⤵
  PID:608
- C:\Windows\System\REgFFxL.exe
  C:\Windows\System\REgFFxL.exe
  2⤵
  PID:3080
- C:\Windows\System\VCgqhkE.exe
  C:\Windows\System\VCgqhkE.exe
  2⤵
  PID:3096
- C:\Windows\System\kjkcnKI.exe
  C:\Windows\System\kjkcnKI.exe
  2⤵
  PID:3116
- C:\Windows\System\pFfQGSx.exe
  C:\Windows\System\pFfQGSx.exe
  2⤵
  PID:3132
- C:\Windows\System\ndKacRm.exe
  C:\Windows\System\ndKacRm.exe
  2⤵
  PID:3148
- C:\Windows\System\lyGUBJe.exe
  C:\Windows\System\lyGUBJe.exe
  2⤵
  PID:3168
- C:\Windows\System\RxLGIsb.exe
  C:\Windows\System\RxLGIsb.exe
  2⤵
  PID:2396
- C:\Windows\System\MpMzquO.exe
  C:\Windows\System\MpMzquO.exe
  2⤵
  PID:3232
- C:\Windows\System\JRbjGgf.exe
  C:\Windows\System\JRbjGgf.exe
  2⤵
  PID:968
- C:\Windows\System\njrdnHo.exe
  C:\Windows\System\njrdnHo.exe
  2⤵
  PID:2968
- C:\Windows\System\hmtQdKC.exe
  C:\Windows\System\hmtQdKC.exe
  2⤵
  PID:1232
- C:\Windows\System\CwywYxt.exe
  C:\Windows\System\CwywYxt.exe
  2⤵
  PID:3360
- C:\Windows\System\yyuZpeb.exe
  C:\Windows\System\yyuZpeb.exe
  2⤵
  PID:3416
- C:\Windows\System\quKelsI.exe
  C:\Windows\System\quKelsI.exe
  2⤵
  PID:2648
- C:\Windows\System\aPFscQA.exe
  C:\Windows\System\aPFscQA.exe
  2⤵
  PID:1852
- C:\Windows\System\nqQbyQF.exe
  C:\Windows\System\nqQbyQF.exe
  2⤵
  PID:2780
- C:\Windows\System\ggabuTj.exe
  C:\Windows\System\ggabuTj.exe
  2⤵
  PID:1608
- C:\Windows\System\sfDYVnG.exe
  C:\Windows\System\sfDYVnG.exe
  2⤵
  PID:1908
- C:\Windows\System\uzInEmx.exe
  C:\Windows\System\uzInEmx.exe
  2⤵
  PID:3016
- C:\Windows\System\jnMlWEP.exe
  C:\Windows\System\jnMlWEP.exe
  2⤵
  PID:2688
- C:\Windows\System\EsdXpRs.exe
  C:\Windows\System\EsdXpRs.exe
  2⤵
  PID:556
- C:\Windows\System\gnzLvXr.exe
  C:\Windows\System\gnzLvXr.exe
  2⤵
  PID:2596
- C:\Windows\System\XpEuIJb.exe
  C:\Windows\System\XpEuIJb.exe
  2⤵
  PID:1052
- C:\Windows\System\gVNinYd.exe
  C:\Windows\System\gVNinYd.exe
  2⤵
  PID:2944
- C:\Windows\System\QtPUxiG.exe
  C:\Windows\System\QtPUxiG.exe
  2⤵
  PID:2748
- C:\Windows\System\gjwQbqJ.exe
  C:\Windows\System\gjwQbqJ.exe
  2⤵
  PID:3036
- C:\Windows\System\zEexbMb.exe
  C:\Windows\System\zEexbMb.exe
  2⤵
  PID:2704
- C:\Windows\System\ZmhUISH.exe
  C:\Windows\System\ZmhUISH.exe
  2⤵
  PID:3516
- C:\Windows\System\JdhpTKc.exe
  C:\Windows\System\JdhpTKc.exe
  2⤵
  PID:3544
- C:\Windows\System\qZqMBOW.exe
  C:\Windows\System\qZqMBOW.exe
  2⤵
  PID:3564
- C:\Windows\System\QHMlKua.exe
  C:\Windows\System\QHMlKua.exe
  2⤵
  PID:3580
- C:\Windows\System\HaFpKKD.exe
  C:\Windows\System\HaFpKKD.exe
  2⤵
  PID:3596
- C:\Windows\System\ntZPoxH.exe
  C:\Windows\System\ntZPoxH.exe
  2⤵
  PID:3612
- C:\Windows\System\ontgNlT.exe
  C:\Windows\System\ontgNlT.exe
  2⤵
  PID:3628
- C:\Windows\System\OJtqaxC.exe
  C:\Windows\System\OJtqaxC.exe
  2⤵
  PID:3688
- C:\Windows\System\eJYnswC.exe
  C:\Windows\System\eJYnswC.exe
  2⤵
  PID:3264
- C:\Windows\System\skQXezF.exe
  C:\Windows\System\skQXezF.exe
  2⤵
  PID:3752
- C:\Windows\System\ywpSvVe.exe
  C:\Windows\System\ywpSvVe.exe
  2⤵
  PID:3304
- C:\Windows\System\FIAugjw.exe
  C:\Windows\System\FIAugjw.exe
  2⤵
  PID:3380
- C:\Windows\System\AuEoVZe.exe
  C:\Windows\System\AuEoVZe.exe
  2⤵
  PID:3396
- C:\Windows\System\jzflgoa.exe
  C:\Windows\System\jzflgoa.exe
  2⤵
  PID:3796
- C:\Windows\System\YEGIabD.exe
  C:\Windows\System\YEGIabD.exe
  2⤵
  PID:3668
- C:\Windows\System\qUkFoTM.exe
  C:\Windows\System\qUkFoTM.exe
  2⤵
  PID:3884
- C:\Windows\System\cgcMNgT.exe
  C:\Windows\System\cgcMNgT.exe
  2⤵
  PID:3700
- C:\Windows\System\GlNkGKh.exe
  C:\Windows\System\GlNkGKh.exe
  2⤵
  PID:2940
- C:\Windows\System\tZPQUMt.exe
  C:\Windows\System\tZPQUMt.exe
  2⤵
  PID:3776
- C:\Windows\System\CTxwCtv.exe
  C:\Windows\System\CTxwCtv.exe
  2⤵
  PID:4072
- C:\Windows\System\XkaXBOJ.exe
  C:\Windows\System\XkaXBOJ.exe
  2⤵
  PID:3848
- C:\Windows\System\GJSsDof.exe
  C:\Windows\System\GJSsDof.exe
  2⤵
  PID:3864
- C:\Windows\System\gUyNUpY.exe
  C:\Windows\System\gUyNUpY.exe
  2⤵
  PID:3740
- C:\Windows\System\zfjMkfQ.exe
  C:\Windows\System\zfjMkfQ.exe
  2⤵
  PID:2040
- C:\Windows\System\ahDNLFZ.exe
  C:\Windows\System\ahDNLFZ.exe
  2⤵
  PID:3936
- C:\Windows\System\UPMaaPv.exe
  C:\Windows\System\UPMaaPv.exe
  2⤵
  PID:3092
- C:\Windows\System\ncMesEA.exe
  C:\Windows\System\ncMesEA.exe
  2⤵
  PID:3164
- C:\Windows\System\bmVMZSj.exe
  C:\Windows\System\bmVMZSj.exe
  2⤵
  PID:2712
- C:\Windows\System\tdfbjOT.exe
  C:\Windows\System\tdfbjOT.exe
  2⤵
  PID:3108
- C:\Windows\System\EPdmubb.exe
  C:\Windows\System\EPdmubb.exe
  2⤵
  PID:3224
- C:\Windows\System\RlhZfTh.exe
  C:\Windows\System\RlhZfTh.exe
  2⤵
  PID:2556
- C:\Windows\System\OwMhsnT.exe
  C:\Windows\System\OwMhsnT.exe
  2⤵
  PID:3412
- C:\Windows\System\KYXOSaZ.exe
  C:\Windows\System\KYXOSaZ.exe
  2⤵
  PID:2708
- C:\Windows\System\vjZYEwC.exe
  C:\Windows\System\vjZYEwC.exe
  2⤵
  PID:1396
- C:\Windows\System\wstWcXR.exe
  C:\Windows\System\wstWcXR.exe
  2⤵
  PID:3208
- C:\Windows\System\rzMBMKP.exe
  C:\Windows\System\rzMBMKP.exe
  2⤵
  PID:3560
- C:\Windows\System\DgorfcM.exe
  C:\Windows\System\DgorfcM.exe
  2⤵
  PID:3624
- C:\Windows\System\FXiqXef.exe
  C:\Windows\System\FXiqXef.exe
  2⤵
  PID:3388
- C:\Windows\System\exMgGoU.exe
  C:\Windows\System\exMgGoU.exe
  2⤵
  PID:3960
- C:\Windows\System\uywjpTe.exe
  C:\Windows\System\uywjpTe.exe
  2⤵
  PID:4036
- C:\Windows\System\OXIIvOw.exe
  C:\Windows\System\OXIIvOw.exe
  2⤵
  PID:3772
- C:\Windows\System\TAotURd.exe
  C:\Windows\System\TAotURd.exe
  2⤵
  PID:1972
- C:\Windows\System\svNcYpF.exe
  C:\Windows\System\svNcYpF.exe
  2⤵
  PID:1980
- C:\Windows\System\vJIvYYx.exe
  C:\Windows\System\vJIvYYx.exe
  2⤵
  PID:3904
- C:\Windows\System\UpAqSVh.exe
  C:\Windows\System\UpAqSVh.exe
  2⤵
  PID:2152
- C:\Windows\System\CvsDCTZ.exe
  C:\Windows\System\CvsDCTZ.exe
  2⤵
  PID:1120
- C:\Windows\System\OTZhwBZ.exe
  C:\Windows\System\OTZhwBZ.exe
  2⤵
  PID:1904
- C:\Windows\System\dRMaGkq.exe
  C:\Windows\System\dRMaGkq.exe
  2⤵
  PID:3636
- C:\Windows\System\YCuCHpn.exe
  C:\Windows\System\YCuCHpn.exe
  2⤵
  PID:2416
- C:\Windows\System\ECoQEfZ.exe
  C:\Windows\System\ECoQEfZ.exe
  2⤵
  PID:2520
- C:\Windows\System\WCGGHvq.exe
  C:\Windows\System\WCGGHvq.exe
  2⤵
  PID:3996
- C:\Windows\System\iBexoQZ.exe
  C:\Windows\System\iBexoQZ.exe
  2⤵
  PID:3860
- C:\Windows\System\iGaKZQG.exe
  C:\Windows\System\iGaKZQG.exe
  2⤵
  PID:3980
- C:\Windows\System\mRatMnA.exe
  C:\Windows\System\mRatMnA.exe
  2⤵
  PID:2904
- C:\Windows\System\qgroOyF.exe
  C:\Windows\System\qgroOyF.exe
  2⤵
  PID:3976
- C:\Windows\System\gQBDtam.exe
  C:\Windows\System\gQBDtam.exe
  2⤵
  PID:3512
- C:\Windows\System\aHDBfib.exe
  C:\Windows\System\aHDBfib.exe
  2⤵
  PID:3592
- C:\Windows\System\kojzGzK.exe
  C:\Windows\System\kojzGzK.exe
  2⤵
  PID:3820
- C:\Windows\System\JvFweBz.exe
  C:\Windows\System\JvFweBz.exe
  2⤵
  PID:4012
- C:\Windows\System\jOPEQHt.exe
  C:\Windows\System\jOPEQHt.exe
  2⤵
  PID:2960
- C:\Windows\System\LBvYjsR.exe
  C:\Windows\System\LBvYjsR.exe
  2⤵
  PID:4052
- C:\Windows\System\UJMfeQK.exe
  C:\Windows\System\UJMfeQK.exe
  2⤵
  PID:572
- C:\Windows\System\cPUCYge.exe
  C:\Windows\System\cPUCYge.exe
  2⤵
  PID:2684
- C:\Windows\System\XxQMOLc.exe
  C:\Windows\System\XxQMOLc.exe
  2⤵
  PID:300
- C:\Windows\System\ApGmXzR.exe
  C:\Windows\System\ApGmXzR.exe
  2⤵
  PID:2516
- C:\Windows\System\jUTRdWB.exe
  C:\Windows\System\jUTRdWB.exe
  2⤵
  PID:3836
- C:\Windows\System\OcYvVIr.exe
  C:\Windows\System\OcYvVIr.exe
  2⤵
  PID:3288
- C:\Windows\System\xpCaAWi.exe
  C:\Windows\System\xpCaAWi.exe
  2⤵
  PID:3140
- C:\Windows\System\YNlHOpk.exe
  C:\Windows\System\YNlHOpk.exe
  2⤵
  PID:4180
- C:\Windows\System\MmxIhtH.exe
  C:\Windows\System\MmxIhtH.exe
  2⤵
  PID:4196
- C:\Windows\System\kwUcaxD.exe
  C:\Windows\System\kwUcaxD.exe
  2⤵
  PID:4228
- C:\Windows\System\DfRCQRB.exe
  C:\Windows\System\DfRCQRB.exe
  2⤵
  PID:4244
- C:\Windows\System\lNDrEnd.exe
  C:\Windows\System\lNDrEnd.exe
  2⤵
  PID:4260
- C:\Windows\System\xgYGXlr.exe
  C:\Windows\System\xgYGXlr.exe
  2⤵
  PID:4276
- C:\Windows\System\HzeStUB.exe
  C:\Windows\System\HzeStUB.exe
  2⤵
  PID:4292
- C:\Windows\System\XYTiZUD.exe
  C:\Windows\System\XYTiZUD.exe
  2⤵
  PID:4308
- C:\Windows\System\ctvwBfK.exe
  C:\Windows\System\ctvwBfK.exe
  2⤵
  PID:4328
- C:\Windows\System\nYszwky.exe
  C:\Windows\System\nYszwky.exe
  2⤵
  PID:4348
- C:\Windows\System\EBFjpvO.exe
  C:\Windows\System\EBFjpvO.exe
  2⤵
  PID:4376
- C:\Windows\System\LkQOIvL.exe
  C:\Windows\System\LkQOIvL.exe
  2⤵
  PID:4392
- C:\Windows\System\yqNAFFD.exe
  C:\Windows\System\yqNAFFD.exe
  2⤵
  PID:4408
- C:\Windows\System\zAqMdbj.exe
  C:\Windows\System\zAqMdbj.exe
  2⤵
  PID:4424
- C:\Windows\System\qJCeXkh.exe
  C:\Windows\System\qJCeXkh.exe
  2⤵
  PID:4440
- C:\Windows\System\MAlaVkr.exe
  C:\Windows\System\MAlaVkr.exe
  2⤵
  PID:4456
- C:\Windows\System\XNdFyXA.exe
  C:\Windows\System\XNdFyXA.exe
  2⤵
  PID:4472
- C:\Windows\System\VUZDUiU.exe
  C:\Windows\System\VUZDUiU.exe
  2⤵
  PID:4488
- C:\Windows\System\ZPGlgfr.exe
  C:\Windows\System\ZPGlgfr.exe
  2⤵
  PID:4508
- C:\Windows\System\sTXFhbS.exe
  C:\Windows\System\sTXFhbS.exe
  2⤵
  PID:4524
- C:\Windows\System\ffsCneF.exe
  C:\Windows\System\ffsCneF.exe
  2⤵
  PID:4540
- C:\Windows\System\AMMVdHg.exe
  C:\Windows\System\AMMVdHg.exe
  2⤵
  PID:4556
- C:\Windows\System\yFYgXVc.exe
  C:\Windows\System\yFYgXVc.exe
  2⤵
  PID:4572
- C:\Windows\System\ueZPSpq.exe
  C:\Windows\System\ueZPSpq.exe
  2⤵
  PID:4588
- C:\Windows\System\jMRLICA.exe
  C:\Windows\System\jMRLICA.exe
  2⤵
  PID:4604
- C:\Windows\System\cjSTROV.exe
  C:\Windows\System\cjSTROV.exe
  2⤵
  PID:4620
- C:\Windows\System\SxWeCvN.exe
  C:\Windows\System\SxWeCvN.exe
  2⤵
  PID:4640
- C:\Windows\System\euAHiAL.exe
  C:\Windows\System\euAHiAL.exe
  2⤵
  PID:4656
- C:\Windows\System\SjZaWJg.exe
  C:\Windows\System\SjZaWJg.exe
  2⤵
  PID:4672
- C:\Windows\System\tYDSCvf.exe
  C:\Windows\System\tYDSCvf.exe
  2⤵
  PID:4688
- C:\Windows\System\wnYzQij.exe
  C:\Windows\System\wnYzQij.exe
  2⤵
  PID:4704
- C:\Windows\System\NnEyJJz.exe
  C:\Windows\System\NnEyJJz.exe
  2⤵
  PID:4720
- C:\Windows\System\FdWskRo.exe
  C:\Windows\System\FdWskRo.exe
  2⤵
  PID:4736
- C:\Windows\System\lqVHelX.exe
  C:\Windows\System\lqVHelX.exe
  2⤵
  PID:4752
- C:\Windows\System\xRfwwMd.exe
  C:\Windows\System\xRfwwMd.exe
  2⤵
  PID:4772
- C:\Windows\System\tjEjbkE.exe
  C:\Windows\System\tjEjbkE.exe
  2⤵
  PID:4788
- C:\Windows\System\jJikSsL.exe
  C:\Windows\System\jJikSsL.exe
  2⤵
  PID:4804
- C:\Windows\System\lxOKHZm.exe
  C:\Windows\System\lxOKHZm.exe
  2⤵
  PID:4820
- C:\Windows\System\aotRlDY.exe
  C:\Windows\System\aotRlDY.exe
  2⤵
  PID:4836
- C:\Windows\System\aozRfbC.exe
  C:\Windows\System\aozRfbC.exe
  2⤵
  PID:4852
- C:\Windows\System\nyGPejt.exe
  C:\Windows\System\nyGPejt.exe
  2⤵
  PID:4868
- C:\Windows\System\uXiYwcP.exe
  C:\Windows\System\uXiYwcP.exe
  2⤵
  PID:4884
- C:\Windows\System\zmuntXf.exe
  C:\Windows\System\zmuntXf.exe
  2⤵
  PID:4908
- C:\Windows\System\qqaXgpb.exe
  C:\Windows\System\qqaXgpb.exe
  2⤵
  PID:4924
- C:\Windows\System\uInYQQM.exe
  C:\Windows\System\uInYQQM.exe
  2⤵
  PID:4940
- C:\Windows\System\hXAiAQM.exe
  C:\Windows\System\hXAiAQM.exe
  2⤵
  PID:4956
- C:\Windows\System\LKmLPPs.exe
  C:\Windows\System\LKmLPPs.exe
  2⤵
  PID:4972
- C:\Windows\System\efBIWpm.exe
  C:\Windows\System\efBIWpm.exe
  2⤵
  PID:4988
- C:\Windows\System\LEfrVjg.exe
  C:\Windows\System\LEfrVjg.exe
  2⤵
  PID:5004
- C:\Windows\System\MmjbdVd.exe
  C:\Windows\System\MmjbdVd.exe
  2⤵
  PID:5024
- C:\Windows\System\VODKrZJ.exe
  C:\Windows\System\VODKrZJ.exe
  2⤵
  PID:5040
- C:\Windows\System\orddSlQ.exe
  C:\Windows\System\orddSlQ.exe
  2⤵
  PID:5056
- C:\Windows\System\BDjfmOe.exe
  C:\Windows\System\BDjfmOe.exe
  2⤵
  PID:5072
- C:\Windows\System\BLFtExR.exe
  C:\Windows\System\BLFtExR.exe
  2⤵
  PID:5088
- C:\Windows\System\ymraMBz.exe
  C:\Windows\System\ymraMBz.exe
  2⤵
  PID:5108
- C:\Windows\System\SeziirW.exe
  C:\Windows\System\SeziirW.exe
  2⤵
  PID:3356
- C:\Windows\System\JHxlMrD.exe
  C:\Windows\System\JHxlMrD.exe
  2⤵
  PID:2852
- C:\Windows\System\DRRyWNe.exe
  C:\Windows\System\DRRyWNe.exe
  2⤵
  PID:3228
- C:\Windows\System\LYjPSKp.exe
  C:\Windows\System\LYjPSKp.exe
  2⤵
  PID:1968
- C:\Windows\System\UTOFGqw.exe
  C:\Windows\System\UTOFGqw.exe
  2⤵
  PID:3760
- C:\Windows\System\UgxQcfi.exe
  C:\Windows\System\UgxQcfi.exe
  2⤵
  PID:3924
- C:\Windows\System\QHYpHlz.exe
  C:\Windows\System\QHYpHlz.exe
  2⤵
  PID:1064
- C:\Windows\System\auHWfAW.exe
  C:\Windows\System\auHWfAW.exe
  2⤵
  PID:4112
- C:\Windows\System\ZrdkIQh.exe
  C:\Windows\System\ZrdkIQh.exe
  2⤵
  PID:1372
- C:\Windows\System\erwzdMb.exe
  C:\Windows\System\erwzdMb.exe
  2⤵
  PID:3604
- C:\Windows\System\aTvOMfK.exe
  C:\Windows\System\aTvOMfK.exe
  2⤵
  PID:3376
- C:\Windows\System\mvjNskx.exe
  C:\Windows\System\mvjNskx.exe
  2⤵
  PID:4116
- C:\Windows\System\duAISCY.exe
  C:\Windows\System\duAISCY.exe
  2⤵
  PID:4132
- C:\Windows\System\gxIARkz.exe
  C:\Windows\System\gxIARkz.exe
  2⤵
  PID:1780
- C:\Windows\System\EGjjZqT.exe
  C:\Windows\System\EGjjZqT.exe
  2⤵
  PID:3244
- C:\Windows\System\bWtXRsz.exe
  C:\Windows\System\bWtXRsz.exe
  2⤵
  PID:4020
- C:\Windows\System\KPmGJYC.exe
  C:\Windows\System\KPmGJYC.exe
  2⤵
  PID:3528
- C:\Windows\System\ixBPgJT.exe
  C:\Windows\System\ixBPgJT.exe
  2⤵
  PID:4148
- C:\Windows\System\QBymbSR.exe
  C:\Windows\System\QBymbSR.exe
  2⤵
  PID:4192
- C:\Windows\System\askEUGX.exe
  C:\Windows\System\askEUGX.exe
  2⤵
  PID:3496
- C:\Windows\System\eioanuq.exe
  C:\Windows\System\eioanuq.exe
  2⤵
  PID:1524
- C:\Windows\System\twvJAkS.exe
  C:\Windows\System\twvJAkS.exe
  2⤵
  PID:4324
- C:\Windows\System\aIOXUvC.exe
  C:\Windows\System\aIOXUvC.exe
  2⤵
  PID:4304
- C:\Windows\System\ipvKsVQ.exe
  C:\Windows\System\ipvKsVQ.exe
  2⤵
  PID:4432
- C:\Windows\System\OzGBmgz.exe
  C:\Windows\System\OzGBmgz.exe
  2⤵
  PID:4340
- C:\Windows\System\NMkZcoZ.exe
  C:\Windows\System\NMkZcoZ.exe
  2⤵
  PID:4516
- C:\Windows\System\xrlaXeM.exe
  C:\Windows\System\xrlaXeM.exe
  2⤵
  PID:4584
- C:\Windows\System\AhWROmk.exe
  C:\Windows\System\AhWROmk.exe
  2⤵
  PID:4680
- C:\Windows\System\TZjhqat.exe
  C:\Windows\System\TZjhqat.exe
  2⤵
  PID:4744
- C:\Windows\System\EAnMlNY.exe
  C:\Windows\System\EAnMlNY.exe
  2⤵
  PID:4784
- C:\Windows\System\vIvPpSu.exe
  C:\Windows\System\vIvPpSu.exe
  2⤵
  PID:4876
- C:\Windows\System\hONmLkT.exe
  C:\Windows\System\hONmLkT.exe
  2⤵
  PID:4948
- C:\Windows\System\aOychZp.exe
  C:\Windows\System\aOychZp.exe
  2⤵
  PID:5020
- C:\Windows\System\vxKxItm.exe
  C:\Windows\System\vxKxItm.exe
  2⤵
  PID:5084
- C:\Windows\System\neoItfG.exe
  C:\Windows\System\neoItfG.exe
  2⤵
  PID:3556
- C:\Windows\System\mwSDiai.exe
  C:\Windows\System\mwSDiai.exe
  2⤵
  PID:4564
- C:\Windows\System\wVHkgtJ.exe
  C:\Windows\System\wVHkgtJ.exe
  2⤵
  PID:4628
- C:\Windows\System\RmAOsxz.exe
  C:\Windows\System\RmAOsxz.exe
  2⤵
  PID:4696
- C:\Windows\System\ZGzGFHG.exe
  C:\Windows\System\ZGzGFHG.exe
  2⤵
  PID:4760
- C:\Windows\System\LeoEXnE.exe
  C:\Windows\System\LeoEXnE.exe
  2⤵
  PID:4900
- C:\Windows\System\zWmrkWR.exe
  C:\Windows\System\zWmrkWR.exe
  2⤵
  PID:4968
- C:\Windows\System\tPnTOiJ.exe
  C:\Windows\System\tPnTOiJ.exe
  2⤵
  PID:5064
- C:\Windows\System\dZxtoyS.exe
  C:\Windows\System\dZxtoyS.exe
  2⤵
  PID:5104
- C:\Windows\System\yrVDfbH.exe
  C:\Windows\System\yrVDfbH.exe
  2⤵
  PID:3920
- C:\Windows\System\SpCDVwI.exe
  C:\Windows\System\SpCDVwI.exe
  2⤵
  PID:4140
- C:\Windows\System\RfZBabJ.exe
  C:\Windows\System\RfZBabJ.exe
  2⤵
  PID:3832
- C:\Windows\System\dAHXPtI.exe
  C:\Windows\System\dAHXPtI.exe
  2⤵
  PID:3144
- C:\Windows\System\xxmyVqK.exe
  C:\Windows\System\xxmyVqK.exe
  2⤵
  PID:4164
- C:\Windows\System\QzDIUPn.exe
  C:\Windows\System\QzDIUPn.exe
  2⤵
  PID:3428
- C:\Windows\System\MugfpFm.exe
  C:\Windows\System\MugfpFm.exe
  2⤵
  PID:4172
- C:\Windows\System\LgxePXg.exe
  C:\Windows\System\LgxePXg.exe
  2⤵
  PID:3444
- C:\Windows\System\upXEyRO.exe
  C:\Windows\System\upXEyRO.exe
  2⤵
  PID:4220
- C:\Windows\System\CYDTWaF.exe
  C:\Windows\System\CYDTWaF.exe
  2⤵
  PID:2240
- C:\Windows\System\xOhfHLo.exe
  C:\Windows\System\xOhfHLo.exe
  2⤵
  PID:3472
- C:\Windows\System\vmbePsU.exe
  C:\Windows\System\vmbePsU.exe
  2⤵
  PID:3488
- C:\Windows\System\AdDBead.exe
  C:\Windows\System\AdDBead.exe
  2⤵
  PID:3492
- C:\Windows\System\XcVPpQF.exe
  C:\Windows\System\XcVPpQF.exe
  2⤵
  PID:4252
- C:\Windows\System\msMvAWf.exe
  C:\Windows\System\msMvAWf.exe
  2⤵
  PID:3504
- C:\Windows\System\WXRjrwc.exe
  C:\Windows\System\WXRjrwc.exe
  2⤵
  PID:4268
- C:\Windows\System\TjObcny.exe
  C:\Windows\System\TjObcny.exe
  2⤵
  PID:4364
- C:\Windows\System\OrcCnJj.exe
  C:\Windows\System\OrcCnJj.exe
  2⤵
  PID:4372
- C:\Windows\System\hOEdkcx.exe
  C:\Windows\System\hOEdkcx.exe
  2⤵
  PID:688
- C:\Windows\System\lnFahGV.exe
  C:\Windows\System\lnFahGV.exe
  2⤵
  PID:2280
- C:\Windows\System\bwDQgHF.exe
  C:\Windows\System\bwDQgHF.exe
  2⤵
  PID:2872
- C:\Windows\System\uustXUG.exe
  C:\Windows\System\uustXUG.exe
  2⤵
  PID:4552
- C:\Windows\System\sfRYlqJ.exe
  C:\Windows\System\sfRYlqJ.exe
  2⤵
  PID:4648
- C:\Windows\System\PwTqHPs.exe
  C:\Windows\System\PwTqHPs.exe
  2⤵
  PID:4780
- C:\Windows\System\QURGfLp.exe
  C:\Windows\System\QURGfLp.exe
  2⤵
  PID:1844
- C:\Windows\System\TTbCeNI.exe
  C:\Windows\System\TTbCeNI.exe
  2⤵
  PID:5012
- C:\Windows\System\nfUvSMq.exe
  C:\Windows\System\nfUvSMq.exe
  2⤵
  PID:4732
- C:\Windows\System\npEzqIi.exe
  C:\Windows\System\npEzqIi.exe
  2⤵
  PID:3104
- C:\Windows\System\xZUKzCR.exe
  C:\Windows\System\xZUKzCR.exe
  2⤵
  PID:3156
- C:\Windows\System\RdhOuXj.exe
  C:\Windows\System\RdhOuXj.exe
  2⤵
  PID:4964
- C:\Windows\System\neyZZra.exe
  C:\Windows\System\neyZZra.exe
  2⤵
  PID:4496
- C:\Windows\System\QoRxFCN.exe
  C:\Windows\System\QoRxFCN.exe
  2⤵
  PID:4536
- C:\Windows\System\egoaPzD.exe
  C:\Windows\System\egoaPzD.exe
  2⤵
  PID:3948
- C:\Windows\System\lDmRUuV.exe
  C:\Windows\System\lDmRUuV.exe
  2⤵
  PID:4108
- C:\Windows\System\IUdNJWQ.exe
  C:\Windows\System\IUdNJWQ.exe
  2⤵
  PID:3856
- C:\Windows\System\ZetCysX.exe
  C:\Windows\System\ZetCysX.exe
  2⤵
  PID:3272
- C:\Windows\System\oExJsKI.exe
  C:\Windows\System\oExJsKI.exe
  2⤵
  PID:3436
- C:\Windows\System\YBTPDVs.exe
  C:\Windows\System\YBTPDVs.exe
  2⤵
  PID:4160
- C:\Windows\System\VLPcgrZ.exe
  C:\Windows\System\VLPcgrZ.exe
  2⤵
  PID:3456
- C:\Windows\System\UBWaImQ.exe
  C:\Windows\System\UBWaImQ.exe
  2⤵
  PID:2404
- C:\Windows\System\DliYwCR.exe
  C:\Windows\System\DliYwCR.exe
  2⤵
  PID:4188
- C:\Windows\System\zxOpbYe.exe
  C:\Windows\System\zxOpbYe.exe
  2⤵
  PID:4360
- C:\Windows\System\fudOgdg.exe
  C:\Windows\System\fudOgdg.exe
  2⤵
  PID:4480
- C:\Windows\System\sSNxAXr.exe
  C:\Windows\System\sSNxAXr.exe
  2⤵
  PID:4848
- C:\Windows\System\nAtqkwn.exe
  C:\Windows\System\nAtqkwn.exe
  2⤵
  PID:5080
- C:\Windows\System\sPVopSK.exe
  C:\Windows\System\sPVopSK.exe
  2⤵
  PID:2932
- C:\Windows\System\yYydRtz.exe
  C:\Windows\System\yYydRtz.exe
  2⤵
  PID:4600
- C:\Windows\System\VapOtID.exe
  C:\Windows\System\VapOtID.exe
  2⤵
  PID:4800
- C:\Windows\System\wUILDsJ.exe
  C:\Windows\System\wUILDsJ.exe
  2⤵
  PID:4128
- C:\Windows\System\EcugXlE.exe
  C:\Windows\System\EcugXlE.exe
  2⤵
  PID:4904
- C:\Windows\System\SRbCyRe.exe
  C:\Windows\System\SRbCyRe.exe
  2⤵
  PID:4532
- C:\Windows\System\XsBHtdM.exe
  C:\Windows\System\XsBHtdM.exe
  2⤵
  PID:4864
- C:\Windows\System\AOQxeZx.exe
  C:\Windows\System\AOQxeZx.exe
  2⤵
  PID:3408
- C:\Windows\System\ixbVPcm.exe
  C:\Windows\System\ixbVPcm.exe
  2⤵
  PID:3576
- C:\Windows\System\ybuipER.exe
  C:\Windows\System\ybuipER.exe
  2⤵
  PID:4204
- C:\Windows\System\nyPmQaK.exe
  C:\Windows\System\nyPmQaK.exe
  2⤵
  PID:1680
- C:\Windows\System\wIqtdhY.exe
  C:\Windows\System\wIqtdhY.exe
  2⤵
  PID:3440
- C:\Windows\System\BZNzZKU.exe
  C:\Windows\System\BZNzZKU.exe
  2⤵
  PID:3452
- C:\Windows\System\pYQjMPt.exe
  C:\Windows\System\pYQjMPt.exe
  2⤵
  PID:2664
- C:\Windows\System\zDbCbuO.exe
  C:\Windows\System\zDbCbuO.exe
  2⤵
  PID:1660
- C:\Windows\System\nopqkBl.exe
  C:\Windows\System\nopqkBl.exe
  2⤵
  PID:4272
- C:\Windows\System\yqcaqsv.exe
  C:\Windows\System\yqcaqsv.exe
  2⤵
  PID:2812
- C:\Windows\System\aXOJTOr.exe
  C:\Windows\System\aXOJTOr.exe
  2⤵
  PID:1776
- C:\Windows\System\pICkssv.exe
  C:\Windows\System\pICkssv.exe
  2⤵
  PID:764
- C:\Windows\System\OyTllmW.exe
  C:\Windows\System\OyTllmW.exe
  2⤵
  PID:2920
- C:\Windows\System\CYXNLQa.exe
  C:\Windows\System\CYXNLQa.exe
  2⤵
  PID:4980
- C:\Windows\System\mcNjVYx.exe
  C:\Windows\System\mcNjVYx.exe
  2⤵
  PID:5140
- C:\Windows\System\LovGzkr.exe
  C:\Windows\System\LovGzkr.exe
  2⤵
  PID:5160
- C:\Windows\System\QBVAyzP.exe
  C:\Windows\System\QBVAyzP.exe
  2⤵
  PID:5176
- C:\Windows\System\PiYfDFy.exe
  C:\Windows\System\PiYfDFy.exe
  2⤵
  PID:5196
- C:\Windows\System\fuNyBnh.exe
  C:\Windows\System\fuNyBnh.exe
  2⤵
  PID:5212
- C:\Windows\System\MUBUuvo.exe
  C:\Windows\System\MUBUuvo.exe
  2⤵
  PID:5228
- C:\Windows\System\EHmXcyD.exe
  C:\Windows\System\EHmXcyD.exe
  2⤵
  PID:5244
- C:\Windows\System\BFXlUOc.exe
  C:\Windows\System\BFXlUOc.exe
  2⤵
  PID:5264
- C:\Windows\System\AUQGNFs.exe
  C:\Windows\System\AUQGNFs.exe
  2⤵
  PID:5344
- C:\Windows\System\wDSVXUl.exe
  C:\Windows\System\wDSVXUl.exe
  2⤵
  PID:5360
- C:\Windows\System\UcFvOpV.exe
  C:\Windows\System\UcFvOpV.exe
  2⤵
  PID:5376
- C:\Windows\System\XKKOPNQ.exe
  C:\Windows\System\XKKOPNQ.exe
  2⤵
  PID:5392
- C:\Windows\System\khoOMAs.exe
  C:\Windows\System\khoOMAs.exe
  2⤵
  PID:5408
- C:\Windows\System\kYBnskL.exe
  C:\Windows\System\kYBnskL.exe
  2⤵
  PID:5424
- C:\Windows\System\TMsCRIZ.exe
  C:\Windows\System\TMsCRIZ.exe
  2⤵
  PID:5440
- C:\Windows\System\meXWYjo.exe
  C:\Windows\System\meXWYjo.exe
  2⤵
  PID:5456
- C:\Windows\System\MxOEvPe.exe
  C:\Windows\System\MxOEvPe.exe
  2⤵
  PID:5472
- C:\Windows\System\mYhqTPb.exe
  C:\Windows\System\mYhqTPb.exe
  2⤵
  PID:5492
- C:\Windows\System\giUYuKb.exe
  C:\Windows\System\giUYuKb.exe
  2⤵
  PID:5508
- C:\Windows\System\mJvUFXJ.exe
  C:\Windows\System\mJvUFXJ.exe
  2⤵
  PID:5524
- C:\Windows\System\RkZTyJx.exe
  C:\Windows\System\RkZTyJx.exe
  2⤵
  PID:5540
- C:\Windows\System\LjiefqS.exe
  C:\Windows\System\LjiefqS.exe
  2⤵
  PID:5560
- C:\Windows\System\PoegYoF.exe
  C:\Windows\System\PoegYoF.exe
  2⤵
  PID:5600
- C:\Windows\System\hQboqzZ.exe
  C:\Windows\System\hQboqzZ.exe
  2⤵
  PID:5616
- C:\Windows\System\TJpnnDm.exe
  C:\Windows\System\TJpnnDm.exe
  2⤵
  PID:5632
- C:\Windows\System\cIPLMHC.exe
  C:\Windows\System\cIPLMHC.exe
  2⤵
  PID:5656
- C:\Windows\System\BnKahxL.exe
  C:\Windows\System\BnKahxL.exe
  2⤵
  PID:5672
- C:\Windows\System\OivcTgB.exe
  C:\Windows\System\OivcTgB.exe
  2⤵
  PID:5688
- C:\Windows\System\SrAihxn.exe
  C:\Windows\System\SrAihxn.exe
  2⤵
  PID:5704
- C:\Windows\System\CQFYAju.exe
  C:\Windows\System\CQFYAju.exe
  2⤵
  PID:5720
- C:\Windows\System\FKdNVOX.exe
  C:\Windows\System\FKdNVOX.exe
  2⤵
  PID:5740
- C:\Windows\System\QBfAihT.exe
  C:\Windows\System\QBfAihT.exe
  2⤵
  PID:5760
- C:\Windows\System\LjQLDVF.exe
  C:\Windows\System\LjQLDVF.exe
  2⤵
  PID:5780
- C:\Windows\System\cPvJEJJ.exe
  C:\Windows\System\cPvJEJJ.exe
  2⤵
  PID:5796
- C:\Windows\System\BzOrJqB.exe
  C:\Windows\System\BzOrJqB.exe
  2⤵
  PID:5812
- C:\Windows\System\zcwETHh.exe
  C:\Windows\System\zcwETHh.exe
  2⤵
  PID:5828
- C:\Windows\System\PzjgEtM.exe
  C:\Windows\System\PzjgEtM.exe
  2⤵
  PID:5844
- C:\Windows\System\dFnfTbF.exe
  C:\Windows\System\dFnfTbF.exe
  2⤵
  PID:5860
- C:\Windows\System\pzXnnoE.exe
  C:\Windows\System\pzXnnoE.exe
  2⤵
  PID:5876
- C:\Windows\System\KmorDvQ.exe
  C:\Windows\System\KmorDvQ.exe
  2⤵
  PID:5892
- C:\Windows\System\mHdXiLF.exe
  C:\Windows\System\mHdXiLF.exe
  2⤵
  PID:5908
- C:\Windows\System\jertLbN.exe
  C:\Windows\System\jertLbN.exe
  2⤵
  PID:5928
- C:\Windows\System\YnUCFZY.exe
  C:\Windows\System\YnUCFZY.exe
  2⤵
  PID:5952
- C:\Windows\System\LqEImFQ.exe
  C:\Windows\System\LqEImFQ.exe
  2⤵
  PID:5968
- C:\Windows\System\EjEnjBi.exe
  C:\Windows\System\EjEnjBi.exe
  2⤵
  PID:5988
- C:\Windows\System\lcsCdIF.exe
  C:\Windows\System\lcsCdIF.exe
  2⤵
  PID:6004
- C:\Windows\System\TISAwlI.exe
  C:\Windows\System\TISAwlI.exe
  2⤵
  PID:6020
- C:\Windows\System\QNHxULx.exe
  C:\Windows\System\QNHxULx.exe
  2⤵
  PID:6036
- C:\Windows\System\TOMRAXf.exe
  C:\Windows\System\TOMRAXf.exe
  2⤵
  PID:6060
- C:\Windows\System\uTOaRsY.exe
  C:\Windows\System\uTOaRsY.exe
  2⤵
  PID:6076
- C:\Windows\System\TurYQfv.exe
  C:\Windows\System\TurYQfv.exe
  2⤵
  PID:6092
- C:\Windows\System\lRazOPH.exe
  C:\Windows\System\lRazOPH.exe
  2⤵
  PID:6108
- C:\Windows\System\CgmaGWh.exe
  C:\Windows\System\CgmaGWh.exe
  2⤵
  PID:6124
- C:\Windows\System\rcSlYet.exe
  C:\Windows\System\rcSlYet.exe
  2⤵
  PID:6140
- C:\Windows\System\EFVDxUs.exe
  C:\Windows\System\EFVDxUs.exe
  2⤵
  PID:4420
- C:\Windows\System\UgjlUuc.exe
  C:\Windows\System\UgjlUuc.exe
  2⤵
  PID:2464
- C:\Windows\System\VOWVqDV.exe
  C:\Windows\System\VOWVqDV.exe
  2⤵
  PID:4484
- C:\Windows\System\DFOMOoL.exe
  C:\Windows\System\DFOMOoL.exe
  2⤵
  PID:5124
- C:\Windows\System\zFLlrxo.exe
  C:\Windows\System\zFLlrxo.exe
  2⤵
  PID:3040
- C:\Windows\System\ghMBNUM.exe
  C:\Windows\System\ghMBNUM.exe
  2⤵
  PID:4896
- C:\Windows\System\iVpChPK.exe
  C:\Windows\System\iVpChPK.exe
  2⤵
  PID:3684
- C:\Windows\System\ZCZzDoo.exe
  C:\Windows\System\ZCZzDoo.exe
  2⤵
  PID:4216
- C:\Windows\System\LTLlnke.exe
  C:\Windows\System\LTLlnke.exe
  2⤵
  PID:4300
- C:\Windows\System\MWImZHY.exe
  C:\Windows\System\MWImZHY.exe
  2⤵
  PID:4916
- C:\Windows\System\EpuJqSp.exe
  C:\Windows\System\EpuJqSp.exe
  2⤵
  PID:5184
- C:\Windows\System\rqefTic.exe
  C:\Windows\System\rqefTic.exe
  2⤵
  PID:5224
- C:\Windows\System\gxcjyyD.exe
  C:\Windows\System\gxcjyyD.exe
  2⤵
  PID:5016
- C:\Windows\System\esbfMMN.exe
  C:\Windows\System\esbfMMN.exe
  2⤵
  PID:5272
- C:\Windows\System\YZBrdoJ.exe
  C:\Windows\System\YZBrdoJ.exe
  2⤵
  PID:5168
- C:\Windows\System\FIeLuRT.exe
  C:\Windows\System\FIeLuRT.exe
  2⤵
  PID:1452
- C:\Windows\System\XawtmGI.exe
  C:\Windows\System\XawtmGI.exe
  2⤵
  PID:5300
- C:\Windows\System\NiqOiic.exe
  C:\Windows\System\NiqOiic.exe
  2⤵
  PID:5288
- C:\Windows\System\LdNKsgX.exe
  C:\Windows\System\LdNKsgX.exe
  2⤵
  PID:5320
- C:\Windows\System\blDPCbj.exe
  C:\Windows\System\blDPCbj.exe
  2⤵
  PID:5336
- C:\Windows\System\tLhmVrQ.exe
  C:\Windows\System\tLhmVrQ.exe
  2⤵
  PID:5384
- C:\Windows\System\UuAizrh.exe
  C:\Windows\System\UuAizrh.exe
  2⤵
  PID:5448
- C:\Windows\System\bUSHMKJ.exe
  C:\Windows\System\bUSHMKJ.exe
  2⤵
  PID:5488
- C:\Windows\System\SPlTHqZ.exe
  C:\Windows\System\SPlTHqZ.exe
  2⤵
  PID:5404
- C:\Windows\System\lwNwXuw.exe
  C:\Windows\System\lwNwXuw.exe
  2⤵
  PID:5468
- C:\Windows\System\cJwYSWR.exe
  C:\Windows\System\cJwYSWR.exe
  2⤵
  PID:5516
- C:\Windows\System\UQyLVEj.exe
  C:\Windows\System\UQyLVEj.exe
  2⤵
  PID:5596
- C:\Windows\System\eYsgpsx.exe
  C:\Windows\System\eYsgpsx.exe
  2⤵
  PID:5576
- C:\Windows\System\xYVHWDg.exe
  C:\Windows\System\xYVHWDg.exe
  2⤵
  PID:5588
- C:\Windows\System\RImAiAP.exe
  C:\Windows\System\RImAiAP.exe
  2⤵
  PID:5732
- C:\Windows\System\BDMbXvi.exe
  C:\Windows\System\BDMbXvi.exe
  2⤵
  PID:5772
- C:\Windows\System\vqrLIPL.exe
  C:\Windows\System\vqrLIPL.exe
  2⤵
  PID:5840
- C:\Windows\System\orWdKdb.exe
  C:\Windows\System\orWdKdb.exe
  2⤵
  PID:5940
- C:\Windows\System\RMqGqFw.exe
  C:\Windows\System\RMqGqFw.exe
  2⤵
  PID:5980
- C:\Windows\System\TjHzifg.exe
  C:\Windows\System\TjHzifg.exe
  2⤵
  PID:5276
- C:\Windows\System\wNGHbRn.exe
  C:\Windows\System\wNGHbRn.exe
  2⤵
  PID:5644
- C:\Windows\System\FYkfdyU.exe
  C:\Windows\System\FYkfdyU.exe
  2⤵
  PID:5680
- C:\Windows\System\WiFENnR.exe
  C:\Windows\System\WiFENnR.exe
  2⤵
  PID:5788
- C:\Windows\System\ndEOFjw.exe
  C:\Windows\System\ndEOFjw.exe
  2⤵
  PID:5888
- C:\Windows\System\JomnJSP.exe
  C:\Windows\System\JomnJSP.exe
  2⤵
  PID:5964
- C:\Windows\System\dWdLzEw.exe
  C:\Windows\System\dWdLzEw.exe
  2⤵
  PID:6032
- C:\Windows\System\BZLSdJN.exe
  C:\Windows\System\BZLSdJN.exe
  2⤵
  PID:6132
- C:\Windows\System\bunxLzc.exe
  C:\Windows\System\bunxLzc.exe
  2⤵
  PID:4716
- C:\Windows\System\ZlLlqpA.exe
  C:\Windows\System\ZlLlqpA.exe
  2⤵
  PID:5852
- C:\Windows\System\jowannk.exe
  C:\Windows\System\jowannk.exe
  2⤵
  PID:4768
- C:\Windows\System\SmfaFvR.exe
  C:\Windows\System\SmfaFvR.exe
  2⤵
  PID:4984
- C:\Windows\System\DMfzoic.exe
  C:\Windows\System\DMfzoic.exe
  2⤵
  PID:5156
- C:\Windows\System\mdEgRZO.exe
  C:\Windows\System\mdEgRZO.exe
  2⤵
  PID:6120
- C:\Windows\System\yjvkPLk.exe
  C:\Windows\System\yjvkPLk.exe
  2⤵
  PID:5316
- C:\Windows\System\EdNrEBP.exe
  C:\Windows\System\EdNrEBP.exe
  2⤵
  PID:5172
- C:\Windows\System\JkquTnB.exe
  C:\Windows\System\JkquTnB.exe
  2⤵
  PID:5280
- C:\Windows\System\BnQEHqD.exe
  C:\Windows\System\BnQEHqD.exe
  2⤵
  PID:5480
- C:\Windows\System\tNUYZfp.exe
  C:\Windows\System\tNUYZfp.exe
  2⤵
  PID:5332
- C:\Windows\System\hABINGq.exe
  C:\Windows\System\hABINGq.exe
  2⤵
  PID:5372
- C:\Windows\System\leoLJRu.exe
  C:\Windows\System\leoLJRu.exe
  2⤵
  PID:5568
- C:\Windows\System\emPbypG.exe
  C:\Windows\System\emPbypG.exe
  2⤵
  PID:5664
- C:\Windows\System\kjTrVSc.exe
  C:\Windows\System\kjTrVSc.exe
  2⤵
  PID:5648
- C:\Windows\System\ZLwEauo.exe
  C:\Windows\System\ZLwEauo.exe
  2⤵
  PID:5836
- C:\Windows\System\NDRxdnT.exe
  C:\Windows\System\NDRxdnT.exe
  2⤵
  PID:5584
- C:\Windows\System\XfqAtnF.exe
  C:\Windows\System\XfqAtnF.exe
  2⤵
  PID:5936
- C:\Windows\System\eeHQbmX.exe
  C:\Windows\System\eeHQbmX.exe
  2⤵
  PID:5736
- C:\Windows\System\Jbbdglf.exe
  C:\Windows\System\Jbbdglf.exe
  2⤵
  PID:5756
- C:\Windows\System\FxUYMsH.exe
  C:\Windows\System\FxUYMsH.exe
  2⤵
  PID:6100
- C:\Windows\System\LLIQrJc.exe
  C:\Windows\System\LLIQrJc.exe
  2⤵
  PID:4664
- C:\Windows\System\WBXGMDQ.exe
  C:\Windows\System\WBXGMDQ.exe
  2⤵
  PID:6056
- C:\Windows\System\RQfWaad.exe
  C:\Windows\System\RQfWaad.exe
  2⤵
  PID:6116
- C:\Windows\System\ZogImoh.exe
  C:\Windows\System\ZogImoh.exe
  2⤵
  PID:4224
- C:\Windows\System\qcgsRWJ.exe
  C:\Windows\System\qcgsRWJ.exe
  2⤵
  PID:4404
- C:\Windows\System\vDistrT.exe
  C:\Windows\System\vDistrT.exe
  2⤵
  PID:4652
- C:\Windows\System\rjpUrRA.exe
  C:\Windows\System\rjpUrRA.exe
  2⤵
  PID:5136
- C:\Windows\System\RccRHai.exe
  C:\Windows\System\RccRHai.exe
  2⤵
  PID:5356
- C:\Windows\System\JXIoDRM.exe
  C:\Windows\System\JXIoDRM.exe
  2⤵
  PID:5284
- C:\Windows\System\TGroqiz.exe
  C:\Windows\System\TGroqiz.exe
  2⤵
  PID:5240
- C:\Windows\System\cgkRgib.exe
  C:\Windows\System\cgkRgib.exe
  2⤵
  PID:5556
- C:\Windows\System\lFscdqE.exe
  C:\Windows\System\lFscdqE.exe
  2⤵
  PID:5536
- C:\Windows\System\dZUrHFF.exe
  C:\Windows\System\dZUrHFF.exe
  2⤵
  PID:5768
- C:\Windows\System\fJJSQyO.exe
  C:\Windows\System\fJJSQyO.exe
  2⤵
  PID:4668
- C:\Windows\System\tFCDvle.exe
  C:\Windows\System\tFCDvle.exe
  2⤵
  PID:3468
- C:\Windows\System\XpVTGZd.exe
  C:\Windows\System\XpVTGZd.exe
  2⤵
  PID:5824
- C:\Windows\System\KjRqsIV.exe
  C:\Windows\System\KjRqsIV.exe
  2⤵
  PID:6048
- C:\Windows\System\dWGJPyn.exe
  C:\Windows\System\dWGJPyn.exe
  2⤵
  PID:5960
- C:\Windows\System\XyIZsyl.exe
  C:\Windows\System\XyIZsyl.exe
  2⤵
  PID:5260
- C:\Windows\System\yNCPuEc.exe
  C:\Windows\System\yNCPuEc.exe
  2⤵
  PID:5436
- C:\Windows\System\LhUHWbu.exe
  C:\Windows\System\LhUHWbu.exe
  2⤵
  PID:3480
- C:\Windows\System\GZlWKWr.exe
  C:\Windows\System\GZlWKWr.exe
  2⤵
  PID:5884
- C:\Windows\System\UbvTuPm.exe
  C:\Windows\System\UbvTuPm.exe
  2⤵
  PID:5220
- C:\Windows\System\FpUzQMw.exe
  C:\Windows\System\FpUzQMw.exe
  2⤵
  PID:5308
- C:\Windows\System\InrgYmG.exe
  C:\Windows\System\InrgYmG.exe
  2⤵
  PID:5820
- C:\Windows\System\JtiZcHx.exe
  C:\Windows\System\JtiZcHx.exe
  2⤵
  PID:5548
- C:\Windows\System\VXMpbvE.exe
  C:\Windows\System\VXMpbvE.exe
  2⤵
  PID:6012
- C:\Windows\System\LOaLIbv.exe
  C:\Windows\System\LOaLIbv.exe
  2⤵
  PID:5776
- C:\Windows\System\MlShXYZ.exe
  C:\Windows\System\MlShXYZ.exe
  2⤵
  PID:5572
- C:\Windows\System\TukstNQ.exe
  C:\Windows\System\TukstNQ.exe
  2⤵
  PID:6164
- C:\Windows\System\hjzxYuR.exe
  C:\Windows\System\hjzxYuR.exe
  2⤵
  PID:6184
- C:\Windows\System\avaLcZE.exe
  C:\Windows\System\avaLcZE.exe
  2⤵
  PID:6200
- C:\Windows\System\vElMAeD.exe
  C:\Windows\System\vElMAeD.exe
  2⤵
  PID:6216
- C:\Windows\System\zzCkoBa.exe
  C:\Windows\System\zzCkoBa.exe
  2⤵
  PID:6232
- C:\Windows\System\vAoaSvX.exe
  C:\Windows\System\vAoaSvX.exe
  2⤵
  PID:6252
- C:\Windows\System\LBWQnxe.exe
  C:\Windows\System\LBWQnxe.exe
  2⤵
  PID:6268
- C:\Windows\System\xTPEKnS.exe
  C:\Windows\System\xTPEKnS.exe
  2⤵
  PID:6284
- C:\Windows\System\pFcpfAI.exe
  C:\Windows\System\pFcpfAI.exe
  2⤵
  PID:6304
- C:\Windows\System\DXgHyPx.exe
  C:\Windows\System\DXgHyPx.exe
  2⤵
  PID:6320
- C:\Windows\System\ulwphBH.exe
  C:\Windows\System\ulwphBH.exe
  2⤵
  PID:6336
- C:\Windows\System\DPEEwOC.exe
  C:\Windows\System\DPEEwOC.exe
  2⤵
  PID:6352
- C:\Windows\System\EzUvGmd.exe
  C:\Windows\System\EzUvGmd.exe
  2⤵
  PID:6368
- C:\Windows\System\MTmTfvN.exe
  C:\Windows\System\MTmTfvN.exe
  2⤵
  PID:6384
- C:\Windows\System\jAgUpqT.exe
  C:\Windows\System\jAgUpqT.exe
  2⤵
  PID:6400
- C:\Windows\System\UZjNItA.exe
  C:\Windows\System\UZjNItA.exe
  2⤵
  PID:6416
- C:\Windows\System\YuAiIGP.exe
  C:\Windows\System\YuAiIGP.exe
  2⤵
  PID:6432
- C:\Windows\System\BzbZFhk.exe
  C:\Windows\System\BzbZFhk.exe
  2⤵
  PID:6448
- C:\Windows\System\CfCQxXV.exe
  C:\Windows\System\CfCQxXV.exe
  2⤵
  PID:6464
- C:\Windows\System\PYrRMxe.exe
  C:\Windows\System\PYrRMxe.exe
  2⤵
  PID:6480
- C:\Windows\System\EkyETRF.exe
  C:\Windows\System\EkyETRF.exe
  2⤵
  PID:6496
- C:\Windows\System\fVVZwmD.exe
  C:\Windows\System\fVVZwmD.exe
  2⤵
  PID:6512
- C:\Windows\System\QQZJmYI.exe
  C:\Windows\System\QQZJmYI.exe
  2⤵
  PID:6528
- C:\Windows\System\VZgKHpb.exe
  C:\Windows\System\VZgKHpb.exe
  2⤵
  PID:6544
- C:\Windows\System\WPNSDLJ.exe
  C:\Windows\System\WPNSDLJ.exe
  2⤵
  PID:6560
- C:\Windows\System\sajuWRW.exe
  C:\Windows\System\sajuWRW.exe
  2⤵
  PID:6576
- C:\Windows\System\vsfujAT.exe
  C:\Windows\System\vsfujAT.exe
  2⤵
  PID:6592
- C:\Windows\System\OjfQmfn.exe
  C:\Windows\System\OjfQmfn.exe
  2⤵
  PID:6608
- C:\Windows\System\oLilTvi.exe
  C:\Windows\System\oLilTvi.exe
  2⤵
  PID:6624
- C:\Windows\System\UjMrLfL.exe
  C:\Windows\System\UjMrLfL.exe
  2⤵
  PID:6644
- C:\Windows\System\rHZRjYv.exe
  C:\Windows\System\rHZRjYv.exe
  2⤵
  PID:6660
- C:\Windows\System\CJCElNQ.exe
  C:\Windows\System\CJCElNQ.exe
  2⤵
  PID:6676
- C:\Windows\System\mxdFgYG.exe
  C:\Windows\System\mxdFgYG.exe
  2⤵
  PID:6692
- C:\Windows\System\ZygEwsa.exe
  C:\Windows\System\ZygEwsa.exe
  2⤵
  PID:6708
- C:\Windows\System\KpCRlKS.exe
  C:\Windows\System\KpCRlKS.exe
  2⤵
  PID:6724
- C:\Windows\System\LRGwwoN.exe
  C:\Windows\System\LRGwwoN.exe
  2⤵
  PID:6740
- C:\Windows\System\CJAFsdq.exe
  C:\Windows\System\CJAFsdq.exe
  2⤵
  PID:6756
- C:\Windows\System\QtzhsZD.exe
  C:\Windows\System\QtzhsZD.exe
  2⤵
  PID:6772
- C:\Windows\System\dxfbUDk.exe
  C:\Windows\System\dxfbUDk.exe
  2⤵
  PID:6788
- C:\Windows\System\OtlHHcY.exe
  C:\Windows\System\OtlHHcY.exe
  2⤵
  PID:6804
- C:\Windows\System\XMvYsqI.exe
  C:\Windows\System\XMvYsqI.exe
  2⤵
  PID:6820
- C:\Windows\System\iNbNDpj.exe
  C:\Windows\System\iNbNDpj.exe
  2⤵
  PID:6836
- C:\Windows\System\ZkpHhic.exe
  C:\Windows\System\ZkpHhic.exe
  2⤵
  PID:6856
- C:\Windows\System\qFNohMY.exe
  C:\Windows\System\qFNohMY.exe
  2⤵
  PID:6872
- C:\Windows\System\lSlWUAG.exe
  C:\Windows\System\lSlWUAG.exe
  2⤵
  PID:6888
- C:\Windows\System\mJTDftk.exe
  C:\Windows\System\mJTDftk.exe
  2⤵
  PID:6908
- C:\Windows\System\jJvTHQL.exe
  C:\Windows\System\jJvTHQL.exe
  2⤵
  PID:6924
- C:\Windows\System\eyJiXPs.exe
  C:\Windows\System\eyJiXPs.exe
  2⤵
  PID:6940
- C:\Windows\System\KQnqQns.exe
  C:\Windows\System\KQnqQns.exe
  2⤵
  PID:6960
- C:\Windows\System\MbqYQTH.exe
  C:\Windows\System\MbqYQTH.exe
  2⤵
  PID:6976
- C:\Windows\System\knvxiKH.exe
  C:\Windows\System\knvxiKH.exe
  2⤵
  PID:6992
- C:\Windows\System\DGwOdVD.exe
  C:\Windows\System\DGwOdVD.exe
  2⤵
  PID:7008
- C:\Windows\System\FVTFJyr.exe
  C:\Windows\System\FVTFJyr.exe
  2⤵
  PID:7024
- C:\Windows\System\wbejvdT.exe
  C:\Windows\System\wbejvdT.exe
  2⤵
  PID:7040
- C:\Windows\System\FZtYWiJ.exe
  C:\Windows\System\FZtYWiJ.exe
  2⤵
  PID:7064
- C:\Windows\System\mvgmmVa.exe
  C:\Windows\System\mvgmmVa.exe
  2⤵
  PID:7080
- C:\Windows\System\MPnyNDg.exe
  C:\Windows\System\MPnyNDg.exe
  2⤵
  PID:7100
- C:\Windows\System\BXnYydS.exe
  C:\Windows\System\BXnYydS.exe
  2⤵
  PID:7116
- C:\Windows\System\VzdxgZf.exe
  C:\Windows\System\VzdxgZf.exe
  2⤵
  PID:7132
- C:\Windows\System\PyuSDAu.exe
  C:\Windows\System\PyuSDAu.exe
  2⤵
  PID:7148
- C:\Windows\System\kAFUanj.exe
  C:\Windows\System\kAFUanj.exe
  2⤵
  PID:5532
- C:\Windows\System\XSAlpZc.exe
  C:\Windows\System\XSAlpZc.exe
  2⤵
  PID:5684
- C:\Windows\System\HAgYmfO.exe
  C:\Windows\System\HAgYmfO.exe
  2⤵
  PID:5716
- C:\Windows\System\sLzwdIy.exe
  C:\Windows\System\sLzwdIy.exe
  2⤵
  PID:5236
- C:\Windows\System\gfhxhJX.exe
  C:\Windows\System\gfhxhJX.exe
  2⤵
  PID:6228
- C:\Windows\System\tNtGROe.exe
  C:\Windows\System\tNtGROe.exe
  2⤵
  PID:6248
- C:\Windows\System\CZHJVST.exe
  C:\Windows\System\CZHJVST.exe
  2⤵
  PID:6316
- C:\Windows\System\HSnKmDe.exe
  C:\Windows\System\HSnKmDe.exe
  2⤵
  PID:6412
- C:\Windows\System\IEIaKtW.exe
  C:\Windows\System\IEIaKtW.exe
  2⤵
  PID:6444
- C:\Windows\System\zbBxTQA.exe
  C:\Windows\System\zbBxTQA.exe
  2⤵
  PID:6508
- C:\Windows\System\DGSZbVS.exe
  C:\Windows\System\DGSZbVS.exe
  2⤵
  PID:6568
- C:\Windows\System\BXcBZBe.exe
  C:\Windows\System\BXcBZBe.exe
  2⤵
  PID:6428
- C:\Windows\System\hyhrcZX.exe
  C:\Windows\System\hyhrcZX.exe
  2⤵
  PID:6632
- C:\Windows\System\UTBsplQ.exe
  C:\Windows\System\UTBsplQ.exe
  2⤵
  PID:6260
- C:\Windows\System\kKPutqf.exe
  C:\Windows\System\kKPutqf.exe
  2⤵
  PID:6332
- C:\Windows\System\lXTFSMB.exe
  C:\Windows\System\lXTFSMB.exe
  2⤵
  PID:6488
- C:\Windows\System\daaChQc.exe
  C:\Windows\System\daaChQc.exe
  2⤵
  PID:6556
- C:\Windows\System\dCVKOWD.exe
  C:\Windows\System\dCVKOWD.exe
  2⤵
  PID:6672
- C:\Windows\System\LeectiY.exe
  C:\Windows\System\LeectiY.exe
  2⤵
  PID:6652
- C:\Windows\System\KzeTjJJ.exe
  C:\Windows\System\KzeTjJJ.exe
  2⤵
  PID:6656
- C:\Windows\System\uzIuXqJ.exe
  C:\Windows\System\uzIuXqJ.exe
  2⤵
  PID:6800
- C:\Windows\System\kUgUYUP.exe
  C:\Windows\System\kUgUYUP.exe
  2⤵
  PID:6688
- C:\Windows\System\iIEjBLH.exe
  C:\Windows\System\iIEjBLH.exe
  2⤵
  PID:6900
- C:\Windows\System\lvrQWfV.exe
  C:\Windows\System\lvrQWfV.exe
  2⤵
  PID:6780
- C:\Windows\System\ZDMTPbo.exe
  C:\Windows\System\ZDMTPbo.exe
  2⤵
  PID:6848
- C:\Windows\System\xbADEXU.exe
  C:\Windows\System\xbADEXU.exe
  2⤵
  PID:6920
- C:\Windows\System\vwAcKLX.exe
  C:\Windows\System\vwAcKLX.exe
  2⤵
  PID:7036
- C:\Windows\System\TSoaPDE.exe
  C:\Windows\System\TSoaPDE.exe
  2⤵
  PID:7056
- C:\Windows\System\rpMwrVk.exe
  C:\Windows\System\rpMwrVk.exe
  2⤵
  PID:7060
- C:\Windows\System\TwqPVGG.exe
  C:\Windows\System\TwqPVGG.exe
  2⤵
  PID:7088
- C:\Windows\System\orKchvB.exe
  C:\Windows\System\orKchvB.exe
  2⤵
  PID:7128
- C:\Windows\System\SMdCsgu.exe
  C:\Windows\System\SMdCsgu.exe
  2⤵
  PID:6212
- C:\Windows\System\tIVaxDI.exe
  C:\Windows\System\tIVaxDI.exe
  2⤵
  PID:6408
- C:\Windows\System\WxIYRxD.exe
  C:\Windows\System\WxIYRxD.exe
  2⤵
  PID:7156
- C:\Windows\System\dLFGwbl.exe
  C:\Windows\System\dLFGwbl.exe
  2⤵
  PID:7164
- C:\Windows\System\fYwPFaX.exe
  C:\Windows\System\fYwPFaX.exe
  2⤵
  PID:6296
- C:\Windows\System\NgkikHh.exe
  C:\Windows\System\NgkikHh.exe
  2⤵
  PID:6380
- C:\Windows\System\tQCLyZM.exe
  C:\Windows\System\tQCLyZM.exe
  2⤵
  PID:6524
- C:\Windows\System\EpukaHd.exe
  C:\Windows\System\EpukaHd.exe
  2⤵
  PID:6460
- C:\Windows\System\DTxcvZy.exe
  C:\Windows\System\DTxcvZy.exe
  2⤵
  PID:6720
- C:\Windows\System\pkISkug.exe
  C:\Windows\System\pkISkug.exe
  2⤵
  PID:6932
- C:\Windows\System\VlOPfUe.exe
  C:\Windows\System\VlOPfUe.exe
  2⤵
  PID:6704
- C:\Windows\System\hKMzYDP.exe
  C:\Windows\System\hKMzYDP.exe
  2⤵
  PID:6896
- C:\Windows\System\lAxdmas.exe
  C:\Windows\System\lAxdmas.exe
  2⤵
  PID:1572
- C:\Windows\System\UgARenZ.exe
  C:\Windows\System\UgARenZ.exe
  2⤵
  PID:6972
- C:\Windows\System\dzKGJlK.exe
  C:\Windows\System\dzKGJlK.exe
  2⤵
  PID:6988
- C:\Windows\System\zLxLXBm.exe
  C:\Windows\System\zLxLXBm.exe
  2⤵
  PID:7112
- C:\Windows\System\CaTiKte.exe
  C:\Windows\System\CaTiKte.exe
  2⤵
  PID:7076
- C:\Windows\System\VQzuDhN.exe
  C:\Windows\System\VQzuDhN.exe
  2⤵
  PID:6948
- C:\Windows\System\SLQwtbK.exe
  C:\Windows\System\SLQwtbK.exe
  2⤵
  PID:7096
- C:\Windows\System\lNMfuUU.exe
  C:\Windows\System\lNMfuUU.exe
  2⤵
  PID:6312
- C:\Windows\System\cdBXzIX.exe
  C:\Windows\System\cdBXzIX.exe
  2⤵
  PID:6668
- C:\Windows\System\yrSOiPa.exe
  C:\Windows\System\yrSOiPa.exe
  2⤵
  PID:6196
- C:\Windows\System\jAomUwb.exe
  C:\Windows\System\jAomUwb.exe
  2⤵
  PID:6832
- C:\Windows\System\reISmyq.exe
  C:\Windows\System\reISmyq.exe
  2⤵
  PID:6684
- C:\Windows\System\wtxPjYX.exe
  C:\Windows\System\wtxPjYX.exe
  2⤵
  PID:6748
- C:\Windows\System\iYrrDyQ.exe
  C:\Windows\System\iYrrDyQ.exe
  2⤵
  PID:6292
- C:\Windows\System\ypiItYL.exe
  C:\Windows\System\ypiItYL.exe
  2⤵
  PID:6768
- C:\Windows\System\kRRqguB.exe
  C:\Windows\System\kRRqguB.exe
  2⤵
  PID:6880
- C:\Windows\System\oCHDyUs.exe
  C:\Windows\System\oCHDyUs.exe
  2⤵
  PID:6936
- C:\Windows\System\RVereVt.exe
  C:\Windows\System\RVereVt.exe
  2⤵
  PID:6280
- C:\Windows\System\KDFeAct.exe
  C:\Windows\System\KDFeAct.exe
  2⤵
  PID:6868
- C:\Windows\System\eHxOQqk.exe
  C:\Windows\System\eHxOQqk.exe
  2⤵
  PID:7052
- C:\Windows\System\hRWFMHV.exe
  C:\Windows\System\hRWFMHV.exe
  2⤵
  PID:7176
- C:\Windows\System\wIkqwkh.exe
  C:\Windows\System\wIkqwkh.exe
  2⤵
  PID:7192
- C:\Windows\System\AivrvCJ.exe
  C:\Windows\System\AivrvCJ.exe
  2⤵
  PID:7208
- C:\Windows\System\XCbxGlQ.exe
  C:\Windows\System\XCbxGlQ.exe
  2⤵
  PID:7224
- C:\Windows\System\yXLSUUA.exe
  C:\Windows\System\yXLSUUA.exe
  2⤵
  PID:7240
- C:\Windows\System\usKWQDJ.exe
  C:\Windows\System\usKWQDJ.exe
  2⤵
  PID:7256
- C:\Windows\System\uXEYMkx.exe
  C:\Windows\System\uXEYMkx.exe
  2⤵
  PID:7272
- C:\Windows\System\MhfefgI.exe
  C:\Windows\System\MhfefgI.exe
  2⤵
  PID:7292
- C:\Windows\System\srjNLZF.exe
  C:\Windows\System\srjNLZF.exe
  2⤵
  PID:7312
- C:\Windows\System\XgemMMT.exe
  C:\Windows\System\XgemMMT.exe
  2⤵
  PID:7328
- C:\Windows\System\ZTVuTBC.exe
  C:\Windows\System\ZTVuTBC.exe
  2⤵
  PID:7344
- C:\Windows\System\bHnPYqm.exe
  C:\Windows\System\bHnPYqm.exe
  2⤵
  PID:7360
- C:\Windows\System\uUYUICq.exe
  C:\Windows\System\uUYUICq.exe
  2⤵
  PID:7376
- C:\Windows\System\STcuqOS.exe
  C:\Windows\System\STcuqOS.exe
  2⤵
  PID:7392
- C:\Windows\System\ViPReZJ.exe
  C:\Windows\System\ViPReZJ.exe
  2⤵
  PID:7408
- C:\Windows\System\LmsyFqN.exe
  C:\Windows\System\LmsyFqN.exe
  2⤵
  PID:7424
- C:\Windows\System\MxHqWwb.exe
  C:\Windows\System\MxHqWwb.exe
  2⤵
  PID:7440
- C:\Windows\System\cbIjTxs.exe
  C:\Windows\System\cbIjTxs.exe
  2⤵
  PID:7456
- C:\Windows\System\IryUJAl.exe
  C:\Windows\System\IryUJAl.exe
  2⤵
  PID:7480
- C:\Windows\System\fTdMQsF.exe
  C:\Windows\System\fTdMQsF.exe
  2⤵
  PID:7496
- C:\Windows\System\afAUJhX.exe
  C:\Windows\System\afAUJhX.exe
  2⤵
  PID:7516
- C:\Windows\System\HHmTwhm.exe
  C:\Windows\System\HHmTwhm.exe
  2⤵
  PID:7532
- C:\Windows\System\HtysYhE.exe
  C:\Windows\System\HtysYhE.exe
  2⤵
  PID:7552
- C:\Windows\System\EOVWirX.exe
  C:\Windows\System\EOVWirX.exe
  2⤵
  PID:7568
- C:\Windows\System\CBZvpTT.exe
  C:\Windows\System\CBZvpTT.exe
  2⤵
  PID:7588
- C:\Windows\System\YMWIjob.exe
  C:\Windows\System\YMWIjob.exe
  2⤵
  PID:7604
- C:\Windows\System\keanlEm.exe
  C:\Windows\System\keanlEm.exe
  2⤵
  PID:7620
- C:\Windows\System\LcUchoY.exe
  C:\Windows\System\LcUchoY.exe
  2⤵
  PID:7636
- C:\Windows\System\PIatrWa.exe
  C:\Windows\System\PIatrWa.exe
  2⤵
  PID:7652
- C:\Windows\System\BSXLpMe.exe
  C:\Windows\System\BSXLpMe.exe
  2⤵
  PID:7668
- C:\Windows\System\SWKCvvc.exe
  C:\Windows\System\SWKCvvc.exe
  2⤵
  PID:7688
- C:\Windows\System\vngQoCt.exe
  C:\Windows\System\vngQoCt.exe
  2⤵
  PID:7704
- C:\Windows\System\zZHpFyB.exe
  C:\Windows\System\zZHpFyB.exe
  2⤵
  PID:7720
- C:\Windows\System\gjrJfzP.exe
  C:\Windows\System\gjrJfzP.exe
  2⤵
  PID:7744
- C:\Windows\System\yNGHDah.exe
  C:\Windows\System\yNGHDah.exe
  2⤵
  PID:7760
- C:\Windows\System\PiSkLwb.exe
  C:\Windows\System\PiSkLwb.exe
  2⤵
  PID:7776
- C:\Windows\System\CBmUNIc.exe
  C:\Windows\System\CBmUNIc.exe
  2⤵
  PID:7796
- C:\Windows\System\RewgtrH.exe
  C:\Windows\System\RewgtrH.exe
  2⤵
  PID:7812
- C:\Windows\System\OyhDOTh.exe
  C:\Windows\System\OyhDOTh.exe
  2⤵
  PID:7828
- C:\Windows\System\VsGOMAK.exe
  C:\Windows\System\VsGOMAK.exe
  2⤵
  PID:7848
- C:\Windows\System\oQqRQoe.exe
  C:\Windows\System\oQqRQoe.exe
  2⤵
  PID:7864
- C:\Windows\System\RMDOorY.exe
  C:\Windows\System\RMDOorY.exe
  2⤵
  PID:7884
- C:\Windows\System\kxswZTT.exe
  C:\Windows\System\kxswZTT.exe
  2⤵
  PID:7900
- C:\Windows\System\pXKfvBw.exe
  C:\Windows\System\pXKfvBw.exe
  2⤵
  PID:7916
- C:\Windows\System\tYAWGfJ.exe
  C:\Windows\System\tYAWGfJ.exe
  2⤵
  PID:7932
- C:\Windows\System\cdraBiR.exe
  C:\Windows\System\cdraBiR.exe
  2⤵
  PID:7952
- C:\Windows\System\kATfpgP.exe
  C:\Windows\System\kATfpgP.exe
  2⤵
  PID:7968
- C:\Windows\System\srtOKTW.exe
  C:\Windows\System\srtOKTW.exe
  2⤵
  PID:7984
- C:\Windows\System\DGiXRro.exe
  C:\Windows\System\DGiXRro.exe
  2⤵
  PID:8004
- C:\Windows\System\TrglGqi.exe
  C:\Windows\System\TrglGqi.exe
  2⤵
  PID:8020
- C:\Windows\System\wbOnEZo.exe
  C:\Windows\System\wbOnEZo.exe
  2⤵
  PID:8040
- C:\Windows\System\roFIXxl.exe
  C:\Windows\System\roFIXxl.exe
  2⤵
  PID:8060
- C:\Windows\System\RBZIIyE.exe
  C:\Windows\System\RBZIIyE.exe
  2⤵
  PID:8076
- C:\Windows\System\GlCDeQm.exe
  C:\Windows\System\GlCDeQm.exe
  2⤵
  PID:8096
- C:\Windows\System\CQPAFJq.exe
  C:\Windows\System\CQPAFJq.exe
  2⤵
  PID:8116
- C:\Windows\System\trFmvSe.exe
  C:\Windows\System\trFmvSe.exe
  2⤵
  PID:8132
- C:\Windows\System\KrfUcwH.exe
  C:\Windows\System\KrfUcwH.exe
  2⤵
  PID:6984
- C:\Windows\System\eyuvhVq.exe
  C:\Windows\System\eyuvhVq.exe
  2⤵
  PID:6328
- C:\Windows\System\jCeDonQ.exe
  C:\Windows\System\jCeDonQ.exe
  2⤵
  PID:7200
- C:\Windows\System\PVOAcUo.exe
  C:\Windows\System\PVOAcUo.exe
  2⤵
  PID:7236
- C:\Windows\System\TLFTGOn.exe
  C:\Windows\System\TLFTGOn.exe
  2⤵
  PID:7340
- C:\Windows\System\eOKcdZI.exe
  C:\Windows\System\eOKcdZI.exe
  2⤵
  PID:7400
- C:\Windows\System\vmUhhJz.exe
  C:\Windows\System\vmUhhJz.exe
  2⤵
  PID:7468
- C:\Windows\System\KIVeMiy.exe
  C:\Windows\System\KIVeMiy.exe
  2⤵
  PID:7016
- C:\Windows\System\gETYLQz.exe
  C:\Windows\System\gETYLQz.exe
  2⤵
  PID:7320
- C:\Windows\System\OiFPWfR.exe
  C:\Windows\System\OiFPWfR.exe
  2⤵
  PID:7452
- C:\Windows\System\roJANnH.exe
  C:\Windows\System\roJANnH.exe
  2⤵
  PID:7540
- C:\Windows\System\vPXzkwW.exe
  C:\Windows\System\vPXzkwW.exe
  2⤵
  PID:7492
- C:\Windows\System\eJmDyvP.exe
  C:\Windows\System\eJmDyvP.exe
  2⤵
  PID:7580
- C:\Windows\System\jscdhPi.exe
  C:\Windows\System\jscdhPi.exe
  2⤵
  PID:7560
- C:\Windows\System\aYYOdrU.exe
  C:\Windows\System\aYYOdrU.exe
  2⤵
  PID:7528
- C:\Windows\System\kafpZwN.exe
  C:\Windows\System\kafpZwN.exe
  2⤵
  PID:7564
- C:\Windows\System\oZglJky.exe
  C:\Windows\System\oZglJky.exe
  2⤵
  PID:7684
- C:\Windows\System\txHViTi.exe
  C:\Windows\System\txHViTi.exe
  2⤵
  PID:7600
- C:\Windows\System\NUJawyV.exe
  C:\Windows\System\NUJawyV.exe
  2⤵
  PID:7788
- C:\Windows\System\sPRqgVZ.exe
  C:\Windows\System\sPRqgVZ.exe
  2⤵
  PID:7736
- C:\Windows\System\SwPeXvM.exe
  C:\Windows\System\SwPeXvM.exe
  2⤵
  PID:7860
- C:\Windows\System\KHvWHuj.exe
  C:\Windows\System\KHvWHuj.exe
  2⤵
  PID:7696
- C:\Windows\System\ilmTluG.exe
  C:\Windows\System\ilmTluG.exe
  2⤵
  PID:7928
- C:\Windows\System\FyFgFjP.exe
  C:\Windows\System\FyFgFjP.exe
  2⤵
  PID:7840
- C:\Windows\System\XQRdLBU.exe
  C:\Windows\System\XQRdLBU.exe
  2⤵
  PID:7700
- C:\Windows\System\lZUEimW.exe
  C:\Windows\System\lZUEimW.exe
  2⤵
  PID:7912
- C:\Windows\System\FOfowmc.exe
  C:\Windows\System\FOfowmc.exe
  2⤵
  PID:7996
- C:\Windows\System\vsFFsER.exe
  C:\Windows\System\vsFFsER.exe
  2⤵
  PID:8036
- C:\Windows\System\LYVbDoa.exe
  C:\Windows\System\LYVbDoa.exe
  2⤵
  PID:8108
- C:\Windows\System\RokkfQy.exe
  C:\Windows\System\RokkfQy.exe
  2⤵
  PID:8012
- C:\Windows\System\zJOVzAx.exe
  C:\Windows\System\zJOVzAx.exe
  2⤵
  PID:8088
- C:\Windows\System\RqxbWvg.exe
  C:\Windows\System\RqxbWvg.exe
  2⤵
  PID:8056
- C:\Windows\System\nLzOLkc.exe
  C:\Windows\System\nLzOLkc.exe
  2⤵
  PID:8140
- C:\Windows\System\pCmgfBY.exe
  C:\Windows\System\pCmgfBY.exe
  2⤵
  PID:8156
- C:\Windows\System\OTPZutp.exe
  C:\Windows\System\OTPZutp.exe
  2⤵
  PID:4796
- C:\Windows\System\SDylSCB.exe
  C:\Windows\System\SDylSCB.exe
  2⤵
  PID:6476
- C:\Windows\System\encKTLF.exe
  C:\Windows\System\encKTLF.exe
  2⤵
  PID:7472
- C:\Windows\System\mfUPtIb.exe
  C:\Windows\System\mfUPtIb.exe
  2⤵
  PID:7548
- C:\Windows\System\FHjpHbe.exe
  C:\Windows\System\FHjpHbe.exe
  2⤵
  PID:7644
- C:\Windows\System\EpQXCAB.exe
  C:\Windows\System\EpQXCAB.exe
  2⤵
  PID:8188
- C:\Windows\System\URjFzlX.exe
  C:\Windows\System\URjFzlX.exe
  2⤵
  PID:7784
- C:\Windows\System\ystPVvc.exe
  C:\Windows\System\ystPVvc.exe
  2⤵
  PID:7856
- C:\Windows\System\PeHJpqv.exe
  C:\Windows\System\PeHJpqv.exe
  2⤵
  PID:7740
- C:\Windows\System\RxdGgKc.exe
  C:\Windows\System\RxdGgKc.exe
  2⤵
  PID:7660
- C:\Windows\System\zHHsONh.exe
  C:\Windows\System\zHHsONh.exe
  2⤵
  PID:7772
- C:\Windows\System\tJYTlxc.exe
  C:\Windows\System\tJYTlxc.exe
  2⤵
  PID:8072
- C:\Windows\System\yHeAEzK.exe
  C:\Windows\System\yHeAEzK.exe
  2⤵
  PID:7976
- C:\Windows\System\pUhOBUE.exe
  C:\Windows\System\pUhOBUE.exe
  2⤵
  PID:8168
- C:\Windows\System\ElLvAJB.exe
  C:\Windows\System\ElLvAJB.exe
  2⤵
  PID:8112
- C:\Windows\System\QCNMFEN.exe
  C:\Windows\System\QCNMFEN.exe
  2⤵
  PID:7980
- C:\Windows\System\BUpHIps.exe
  C:\Windows\System\BUpHIps.exe
  2⤵
  PID:8144
- C:\Windows\System\KrtobtQ.exe
  C:\Windows\System\KrtobtQ.exe
  2⤵
  PID:7336
- C:\Windows\System\cqzpNzM.exe
  C:\Windows\System\cqzpNzM.exe
  2⤵
  PID:7648
- C:\Windows\System\RtDInKg.exe
  C:\Windows\System\RtDInKg.exe
  2⤵
  PID:7216
- C:\Windows\System\HhExvoc.exe
  C:\Windows\System\HhExvoc.exe
  2⤵
  PID:7432
- C:\Windows\System\eYXcApD.exe
  C:\Windows\System\eYXcApD.exe
  2⤵
  PID:5612
- C:\Windows\System\cqWCOPc.exe
  C:\Windows\System\cqWCOPc.exe
  2⤵
  PID:7512
- C:\Windows\System\TlYrJPU.exe
  C:\Windows\System\TlYrJPU.exe
  2⤵
  PID:7388
- C:\Windows\System\owixXSg.exe
  C:\Windows\System\owixXSg.exe
  2⤵
  PID:7680
- C:\Windows\System\hvkBnPo.exe
  C:\Windows\System\hvkBnPo.exe
  2⤵
  PID:7960
- C:\Windows\System\YfPuYDG.exe
  C:\Windows\System\YfPuYDG.exe
  2⤵
  PID:7264
- C:\Windows\System\dXcVcOC.exe
  C:\Windows\System\dXcVcOC.exe
  2⤵
  PID:8124
- C:\Windows\System\ecDDtlU.exe
  C:\Windows\System\ecDDtlU.exe
  2⤵
  PID:7464
- C:\Windows\System\hSRgktL.exe
  C:\Windows\System\hSRgktL.exe
  2⤵
  PID:8028
- C:\Windows\System\fRWubyG.exe
  C:\Windows\System\fRWubyG.exe
  2⤵
  PID:7436
- C:\Windows\System\xxYeEkJ.exe
  C:\Windows\System\xxYeEkJ.exe
  2⤵
  PID:7220
- C:\Windows\System\GkVFPNq.exe
  C:\Windows\System\GkVFPNq.exe
  2⤵
  PID:7712
- C:\Windows\System\rskDSXz.exe
  C:\Windows\System\rskDSXz.exe
  2⤵
  PID:7948
- C:\Windows\System\wVueCja.exe
  C:\Windows\System\wVueCja.exe
  2⤵
  PID:7448
- C:\Windows\System\wjLmyqH.exe
  C:\Windows\System\wjLmyqH.exe
  2⤵
  PID:7872
- C:\Windows\System\AVLocnd.exe
  C:\Windows\System\AVLocnd.exe
  2⤵
  PID:7488
- C:\Windows\System\pHTAFbt.exe
  C:\Windows\System\pHTAFbt.exe
  2⤵
  PID:8196
- C:\Windows\System\HKOvsaw.exe
  C:\Windows\System\HKOvsaw.exe
  2⤵
  PID:8212
- C:\Windows\System\DSCiMPK.exe
  C:\Windows\System\DSCiMPK.exe
  2⤵
  PID:8228
- C:\Windows\System\QQmkbLi.exe
  C:\Windows\System\QQmkbLi.exe
  2⤵
  PID:8244
- C:\Windows\System\jEgJAVy.exe
  C:\Windows\System\jEgJAVy.exe
  2⤵
  PID:8264
- C:\Windows\System\FociFGz.exe
  C:\Windows\System\FociFGz.exe
  2⤵
  PID:8280
- C:\Windows\System\FsgrDor.exe
  C:\Windows\System\FsgrDor.exe
  2⤵
  PID:8296
- C:\Windows\System\StRhNMW.exe
  C:\Windows\System\StRhNMW.exe
  2⤵
  PID:8312
- C:\Windows\System\mdNvmBz.exe
  C:\Windows\System\mdNvmBz.exe
  2⤵
  PID:8328
- C:\Windows\System\JFyZBWL.exe
  C:\Windows\System\JFyZBWL.exe
  2⤵
  PID:8344
- C:\Windows\System\tLDHkWp.exe
  C:\Windows\System\tLDHkWp.exe
  2⤵
  PID:8360
- C:\Windows\System\sgMgRaZ.exe
  C:\Windows\System\sgMgRaZ.exe
  2⤵
  PID:8376
- C:\Windows\System\grQtZRn.exe
  C:\Windows\System\grQtZRn.exe
  2⤵
  PID:8392
- C:\Windows\System\IsZGzPD.exe
  C:\Windows\System\IsZGzPD.exe
  2⤵
  PID:8408
- C:\Windows\System\TWvOeTI.exe
  C:\Windows\System\TWvOeTI.exe
  2⤵
  PID:8424
- C:\Windows\System\DYGxqxa.exe
  C:\Windows\System\DYGxqxa.exe
  2⤵
  PID:8440
- C:\Windows\System\oFOVmfC.exe
  C:\Windows\System\oFOVmfC.exe
  2⤵
  PID:8456
- C:\Windows\System\WuPEHzY.exe
  C:\Windows\System\WuPEHzY.exe
  2⤵
  PID:8472
- C:\Windows\System\kZkWVSA.exe
  C:\Windows\System\kZkWVSA.exe
  2⤵
  PID:8488
- C:\Windows\System\ZabwDvV.exe
  C:\Windows\System\ZabwDvV.exe
  2⤵
  PID:8504
- C:\Windows\System\PdGfLWx.exe
  C:\Windows\System\PdGfLWx.exe
  2⤵
  PID:8520
- C:\Windows\System\rvltCOH.exe
  C:\Windows\System\rvltCOH.exe
  2⤵
  PID:8536
- C:\Windows\System\foQWVKh.exe
  C:\Windows\System\foQWVKh.exe
  2⤵
  PID:8552
- C:\Windows\System\CFSCMMo.exe
  C:\Windows\System\CFSCMMo.exe
  2⤵
  PID:8568
- C:\Windows\System\UnEKjaB.exe
  C:\Windows\System\UnEKjaB.exe
  2⤵
  PID:8584
- C:\Windows\System\ZleuXeU.exe
  C:\Windows\System\ZleuXeU.exe
  2⤵
  PID:8600
- C:\Windows\System\syGCfyK.exe
  C:\Windows\System\syGCfyK.exe
  2⤵
  PID:8616
- C:\Windows\System\mmgLiFZ.exe
  C:\Windows\System\mmgLiFZ.exe
  2⤵
  PID:8632
- C:\Windows\System\VedbCWd.exe
  C:\Windows\System\VedbCWd.exe
  2⤵
  PID:8648
- C:\Windows\System\WxJqsJi.exe
  C:\Windows\System\WxJqsJi.exe
  2⤵
  PID:8664
- C:\Windows\System\ksZzcHc.exe
  C:\Windows\System\ksZzcHc.exe
  2⤵
  PID:8680
- C:\Windows\System\lMxAkkL.exe
  C:\Windows\System\lMxAkkL.exe
  2⤵
  PID:8696
- C:\Windows\System\vNMlJWT.exe
  C:\Windows\System\vNMlJWT.exe
  2⤵
  PID:8716
- C:\Windows\System\dhQhHaY.exe
  C:\Windows\System\dhQhHaY.exe
  2⤵
  PID:8732
- C:\Windows\System\OihTnqd.exe
  C:\Windows\System\OihTnqd.exe
  2⤵
  PID:8748
- C:\Windows\System\fsomTvr.exe
  C:\Windows\System\fsomTvr.exe
  2⤵
  PID:8764
- C:\Windows\System\LUkkwWQ.exe
  C:\Windows\System\LUkkwWQ.exe
  2⤵
  PID:8780
- C:\Windows\System\nsDanJg.exe
  C:\Windows\System\nsDanJg.exe
  2⤵
  PID:8796
- C:\Windows\System\xSbSPVg.exe
  C:\Windows\System\xSbSPVg.exe
  2⤵
  PID:8812
- C:\Windows\System\bEQaspZ.exe
  C:\Windows\System\bEQaspZ.exe
  2⤵
  PID:8828
- C:\Windows\System\aCHSbVP.exe
  C:\Windows\System\aCHSbVP.exe
  2⤵
  PID:8844
- C:\Windows\System\lSKZBDn.exe
  C:\Windows\System\lSKZBDn.exe
  2⤵
  PID:8860
- C:\Windows\System\YRrRNxf.exe
  C:\Windows\System\YRrRNxf.exe
  2⤵
  PID:8876
- C:\Windows\System\NIdJzbL.exe
  C:\Windows\System\NIdJzbL.exe
  2⤵
  PID:8892
- C:\Windows\System\WfxZqmA.exe
  C:\Windows\System\WfxZqmA.exe
  2⤵
  PID:8908
- C:\Windows\System\RKcecgb.exe
  C:\Windows\System\RKcecgb.exe
  2⤵
  PID:8924
- C:\Windows\System\ZkIbTwe.exe
  C:\Windows\System\ZkIbTwe.exe
  2⤵
  PID:8940
- C:\Windows\System\iejYfBv.exe
  C:\Windows\System\iejYfBv.exe
  2⤵
  PID:8956
- C:\Windows\System\nclgTjp.exe
  C:\Windows\System\nclgTjp.exe
  2⤵
  PID:8972
- C:\Windows\System\YqbFRhw.exe
  C:\Windows\System\YqbFRhw.exe
  2⤵
  PID:8988
- C:\Windows\System\FfPXAzf.exe
  C:\Windows\System\FfPXAzf.exe
  2⤵
  PID:9004
- C:\Windows\System\DnhJasx.exe
  C:\Windows\System\DnhJasx.exe
  2⤵
  PID:9020
- C:\Windows\System\kmAnFQr.exe
  C:\Windows\System\kmAnFQr.exe
  2⤵
  PID:9036
- C:\Windows\System\ZjtLZnV.exe
  C:\Windows\System\ZjtLZnV.exe
  2⤵
  PID:9052
- C:\Windows\System\JliYNzt.exe
  C:\Windows\System\JliYNzt.exe
  2⤵
  PID:9068
- C:\Windows\System\dIEfvuy.exe
  C:\Windows\System\dIEfvuy.exe
  2⤵
  PID:9084
- C:\Windows\System\GeYxIce.exe
  C:\Windows\System\GeYxIce.exe
  2⤵
  PID:9100
- C:\Windows\System\lCScgxn.exe
  C:\Windows\System\lCScgxn.exe
  2⤵
  PID:9116
- C:\Windows\System\xOBEGyh.exe
  C:\Windows\System\xOBEGyh.exe
  2⤵
  PID:9132
- C:\Windows\System\zjDeBvc.exe
  C:\Windows\System\zjDeBvc.exe
  2⤵
  PID:9148
- C:\Windows\System\qDfXiXA.exe
  C:\Windows\System\qDfXiXA.exe
  2⤵
  PID:9164
- C:\Windows\System\cVLbXUb.exe
  C:\Windows\System\cVLbXUb.exe
  2⤵
  PID:9180
- C:\Windows\System\yfeRGGB.exe
  C:\Windows\System\yfeRGGB.exe
  2⤵
  PID:9196
- C:\Windows\System\ezcMoLJ.exe
  C:\Windows\System\ezcMoLJ.exe
  2⤵
  PID:9212
- C:\Windows\System\JYVxdeC.exe
  C:\Windows\System\JYVxdeC.exe
  2⤵
  PID:7372
- C:\Windows\System\WblUUyl.exe
  C:\Windows\System\WblUUyl.exe
  2⤵
  PID:8240
- C:\Windows\System\CTOHmyp.exe
  C:\Windows\System\CTOHmyp.exe
  2⤵
  PID:8252
- C:\Windows\System\zaOmtYq.exe
  C:\Windows\System\zaOmtYq.exe
  2⤵
  PID:7612
- C:\Windows\System\UEyoGcZ.exe
  C:\Windows\System\UEyoGcZ.exe
  2⤵
  PID:8256
- C:\Windows\System\BpKgrUY.exe
  C:\Windows\System\BpKgrUY.exe
  2⤵
  PID:8320
- C:\Windows\System\PgZTIWu.exe
  C:\Windows\System\PgZTIWu.exe
  2⤵
  PID:8336
- C:\Windows\System\DWPdOOv.exe
  C:\Windows\System\DWPdOOv.exe
  2⤵
  PID:8372
- C:\Windows\System\zCzDQsv.exe
  C:\Windows\System\zCzDQsv.exe
  2⤵
  PID:8436
- C:\Windows\System\BeexMNK.exe
  C:\Windows\System\BeexMNK.exe
  2⤵
  PID:8352
- C:\Windows\System\ijqnTYS.exe
  C:\Windows\System\ijqnTYS.exe
  2⤵
  PID:8500
- C:\Windows\System\klNyuOe.exe
  C:\Windows\System\klNyuOe.exe
  2⤵
  PID:8416
- C:\Windows\System\xfNZxnQ.exe
  C:\Windows\System\xfNZxnQ.exe
  2⤵
  PID:8564
- C:\Windows\System\obOBSMQ.exe
  C:\Windows\System\obOBSMQ.exe
  2⤵
  PID:8516
- C:\Windows\System\MyBvnBL.exe
  C:\Windows\System\MyBvnBL.exe
  2⤵
  PID:8544
- C:\Windows\System\MzjUuha.exe
  C:\Windows\System\MzjUuha.exe
  2⤵
  PID:8580
- C:\Windows\System\ulptWXX.exe
  C:\Windows\System\ulptWXX.exe
  2⤵
  PID:8660
- C:\Windows\System\cvrXFIX.exe
  C:\Windows\System\cvrXFIX.exe
  2⤵
  PID:8644
- C:\Windows\System\xjWccWY.exe
  C:\Windows\System\xjWccWY.exe
  2⤵
  PID:8672
- C:\Windows\System\OYxRGYK.exe
  C:\Windows\System\OYxRGYK.exe
  2⤵
  PID:8740
- C:\Windows\System\rddFsJj.exe
  C:\Windows\System\rddFsJj.exe
  2⤵
  PID:8792
- C:\Windows\System\xTwmBZk.exe
  C:\Windows\System\xTwmBZk.exe
  2⤵
  PID:8776
- C:\Windows\System\xDRJElE.exe
  C:\Windows\System\xDRJElE.exe
  2⤵
  PID:8852
- C:\Windows\System\GNUIjST.exe
  C:\Windows\System\GNUIjST.exe
  2⤵
  PID:8916
- C:\Windows\System\Emfwktc.exe
  C:\Windows\System\Emfwktc.exe
  2⤵
  PID:8904
- C:\Windows\System\baTbBrc.exe
  C:\Windows\System\baTbBrc.exe
  2⤵
  PID:8932
- C:\Windows\System\uEFfMat.exe
  C:\Windows\System\uEFfMat.exe
  2⤵
  PID:8984
- C:\Windows\System\MGnrvIX.exe
  C:\Windows\System\MGnrvIX.exe
  2⤵
  PID:8996
- C:\Windows\System\dpAdjXE.exe
  C:\Windows\System\dpAdjXE.exe
  2⤵
  PID:9060
- C:\Windows\System\xXFlsWr.exe
  C:\Windows\System\xXFlsWr.exe
  2⤵
  PID:9124
- C:\Windows\System\GUAwgXL.exe
  C:\Windows\System\GUAwgXL.exe
  2⤵
  PID:9016
- C:\Windows\System\wcJEInT.exe
  C:\Windows\System\wcJEInT.exe
  2⤵
  PID:9140
- C:\Windows\System\lnUVrkK.exe
  C:\Windows\System\lnUVrkK.exe
  2⤵
  PID:9188
- C:\Windows\System\GhmtiJM.exe
  C:\Windows\System\GhmtiJM.exe
  2⤵
  PID:8092
- C:\Windows\System\MCcyJhw.exe
  C:\Windows\System\MCcyJhw.exe
  2⤵
  PID:8304
- C:\Windows\System\hoYSVGA.exe
  C:\Windows\System\hoYSVGA.exe
  2⤵
  PID:8288
- C:\Windows\System\yuhYJfD.exe
  C:\Windows\System\yuhYJfD.exe
  2⤵
  PID:9176
- C:\Windows\System\wRCIfaE.exe
  C:\Windows\System\wRCIfaE.exe
  2⤵
  PID:8308
- C:\Windows\System\NIKivzn.exe
  C:\Windows\System\NIKivzn.exe
  2⤵
  PID:8468
- C:\Windows\System\rknMeMY.exe
  C:\Windows\System\rknMeMY.exe
  2⤵
  PID:8384
- C:\Windows\System\BJVItMr.exe
  C:\Windows\System\BJVItMr.exe
  2⤵
  PID:8576
- C:\Windows\System\WSyQFnM.exe
  C:\Windows\System\WSyQFnM.exe
  2⤵
  PID:8708
- C:\Windows\System\DCnhBFC.exe
  C:\Windows\System\DCnhBFC.exe
  2⤵
  PID:8888
- C:\Windows\System\ymkiyZT.exe
  C:\Windows\System\ymkiyZT.exe
  2⤵
  PID:8760
- C:\Windows\System\LySgPRD.exe
  C:\Windows\System\LySgPRD.exe
  2⤵
  PID:8448
- C:\Windows\System\sDJrAjk.exe
  C:\Windows\System\sDJrAjk.exe
  2⤵
  PID:8628
- C:\Windows\System\CneeJTo.exe
  C:\Windows\System\CneeJTo.exe
  2⤵
  PID:7416
- C:\Windows\System\GGOLyUW.exe
  C:\Windows\System\GGOLyUW.exe
  2⤵
  PID:8872
- C:\Windows\System\mlGTFlw.exe
  C:\Windows\System\mlGTFlw.exe
  2⤵
  PID:9032
- C:\Windows\System\GJxxOgX.exe
  C:\Windows\System\GJxxOgX.exe
  2⤵
  PID:9092
- C:\Windows\System\NAdKzLr.exe
  C:\Windows\System\NAdKzLr.exe
  2⤵
  PID:8220
- C:\Windows\System\zsEkyEr.exe
  C:\Windows\System\zsEkyEr.exe
  2⤵
  PID:9160
- C:\Windows\System\WIBGNJJ.exe
  C:\Windows\System\WIBGNJJ.exe
  2⤵
  PID:9172
- C:\Windows\System\oEiDGLB.exe
  C:\Windows\System\oEiDGLB.exe
  2⤵
  PID:8548
- C:\Windows\System\JitHvUH.exe
  C:\Windows\System\JitHvUH.exe
  2⤵
  PID:8340
- C:\Windows\System\lgGDDxi.exe
  C:\Windows\System\lgGDDxi.exe
  2⤵
  PID:8704
- C:\Windows\System\KIistHx.exe
  C:\Windows\System\KIistHx.exe
  2⤵
  PID:8452
- C:\Windows\System\boXPDzo.exe
  C:\Windows\System\boXPDzo.exe
  2⤵
  PID:8952
- C:\Windows\System\nkGQcQr.exe
  C:\Windows\System\nkGQcQr.exe
  2⤵
  PID:8712
- C:\Windows\System\WAUtoEp.exe
  C:\Windows\System\WAUtoEp.exe
  2⤵
  PID:9208
- C:\Windows\System\ehcvISE.exe
  C:\Windows\System\ehcvISE.exe
  2⤵
  PID:8052
- C:\Windows\System\NXyvrxp.exe
  C:\Windows\System\NXyvrxp.exe
  2⤵
  PID:8484
- C:\Windows\System\jjZwLuq.exe
  C:\Windows\System\jjZwLuq.exe
  2⤵
  PID:9228
- C:\Windows\System\nluVzlp.exe
  C:\Windows\System\nluVzlp.exe
  2⤵
  PID:9244
- C:\Windows\System\XGxRSGX.exe
  C:\Windows\System\XGxRSGX.exe
  2⤵
  PID:9260
- C:\Windows\System\hJpdRYR.exe
  C:\Windows\System\hJpdRYR.exe
  2⤵
  PID:9276
- C:\Windows\System\rGxQoFs.exe
  C:\Windows\System\rGxQoFs.exe
  2⤵
  PID:9292
- C:\Windows\System\cZRqnDg.exe
  C:\Windows\System\cZRqnDg.exe
  2⤵
  PID:9308
- C:\Windows\System\kNNIncw.exe
  C:\Windows\System\kNNIncw.exe
  2⤵
  PID:9324
- C:\Windows\System\oMTximL.exe
  C:\Windows\System\oMTximL.exe
  2⤵
  PID:9340
- C:\Windows\System\NDSjzLN.exe
  C:\Windows\System\NDSjzLN.exe
  2⤵
  PID:9356
- C:\Windows\System\ALehhTz.exe
  C:\Windows\System\ALehhTz.exe
  2⤵
  PID:9372
- C:\Windows\System\dswzeUQ.exe
  C:\Windows\System\dswzeUQ.exe
  2⤵
  PID:9388
- C:\Windows\System\eSiTIRh.exe
  C:\Windows\System\eSiTIRh.exe
  2⤵
  PID:9404
- C:\Windows\System\aJkORCQ.exe
  C:\Windows\System\aJkORCQ.exe
  2⤵
  PID:9420
- C:\Windows\System\HjyRrhs.exe
  C:\Windows\System\HjyRrhs.exe
  2⤵
  PID:9436
- C:\Windows\System\FOLhnvA.exe
  C:\Windows\System\FOLhnvA.exe
  2⤵
  PID:9452
- C:\Windows\System\ybiPKzt.exe
  C:\Windows\System\ybiPKzt.exe
  2⤵
  PID:9468
- C:\Windows\System\cdAkSRi.exe
  C:\Windows\System\cdAkSRi.exe
  2⤵
  PID:9484
- C:\Windows\System\mJhkHzU.exe
  C:\Windows\System\mJhkHzU.exe
  2⤵
  PID:9500
- C:\Windows\System\mvffvKo.exe
  C:\Windows\System\mvffvKo.exe
  2⤵
  PID:9516
- C:\Windows\System\YlsLimm.exe
  C:\Windows\System\YlsLimm.exe
  2⤵
  PID:9532
- C:\Windows\System\VyAgYis.exe
  C:\Windows\System\VyAgYis.exe
  2⤵
  PID:9548
- C:\Windows\System\SAoGVxl.exe
  C:\Windows\System\SAoGVxl.exe
  2⤵
  PID:9564
- C:\Windows\System\URIAPRA.exe
  C:\Windows\System\URIAPRA.exe
  2⤵
  PID:9580
- C:\Windows\System\dFjZUjj.exe
  C:\Windows\System\dFjZUjj.exe
  2⤵
  PID:9596
- C:\Windows\System\HmfQKRh.exe
  C:\Windows\System\HmfQKRh.exe
  2⤵
  PID:9612
- C:\Windows\System\GwGnIqx.exe
  C:\Windows\System\GwGnIqx.exe
  2⤵
  PID:9628
- C:\Windows\System\HbUlRjc.exe
  C:\Windows\System\HbUlRjc.exe
  2⤵
  PID:9644
- C:\Windows\System\ZXNVVJW.exe
  C:\Windows\System\ZXNVVJW.exe
  2⤵
  PID:9660
- C:\Windows\System\trLHgCV.exe
  C:\Windows\System\trLHgCV.exe
  2⤵
  PID:9676
- C:\Windows\System\ooexQwJ.exe
  C:\Windows\System\ooexQwJ.exe
  2⤵
  PID:9692
- C:\Windows\System\VbtXafK.exe
  C:\Windows\System\VbtXafK.exe
  2⤵
  PID:9708
- C:\Windows\System\lcQytWW.exe
  C:\Windows\System\lcQytWW.exe
  2⤵
  PID:9724
- C:\Windows\System\fcYyTcK.exe
  C:\Windows\System\fcYyTcK.exe
  2⤵
  PID:9740
- C:\Windows\System\nwpRuAq.exe
  C:\Windows\System\nwpRuAq.exe
  2⤵
  PID:9756
- C:\Windows\System\wSaoOJe.exe
  C:\Windows\System\wSaoOJe.exe
  2⤵
  PID:9776
- C:\Windows\System\LEpGzOn.exe
  C:\Windows\System\LEpGzOn.exe
  2⤵
  PID:9792
- C:\Windows\System\AcjQjME.exe
  C:\Windows\System\AcjQjME.exe
  2⤵
  PID:9808
- C:\Windows\System\ayKILaG.exe
  C:\Windows\System\ayKILaG.exe
  2⤵
  PID:9824
- C:\Windows\System\gcLIUfl.exe
  C:\Windows\System\gcLIUfl.exe
  2⤵
  PID:9840
- C:\Windows\System\sdkcQht.exe
  C:\Windows\System\sdkcQht.exe
  2⤵
  PID:9856
- C:\Windows\System\RFGOVWh.exe
  C:\Windows\System\RFGOVWh.exe
  2⤵
  PID:9872
- C:\Windows\System\UFzCTRi.exe
  C:\Windows\System\UFzCTRi.exe
  2⤵
  PID:9888
- C:\Windows\System\TuxUvwJ.exe
  C:\Windows\System\TuxUvwJ.exe
  2⤵
  PID:9904
- C:\Windows\System\XOLMyEF.exe
  C:\Windows\System\XOLMyEF.exe
  2⤵
  PID:9920
- C:\Windows\System\QVDDily.exe
  C:\Windows\System\QVDDily.exe
  2⤵
  PID:9936
- C:\Windows\System\qFXJpaL.exe
  C:\Windows\System\qFXJpaL.exe
  2⤵
  PID:9952
- C:\Windows\System\QOQCOWt.exe
  C:\Windows\System\QOQCOWt.exe
  2⤵
  PID:9968
- C:\Windows\System\VKlKjnq.exe
  C:\Windows\System\VKlKjnq.exe
  2⤵
  PID:9984
- C:\Windows\System\TelqlwA.exe
  C:\Windows\System\TelqlwA.exe
  2⤵
  PID:10000
- C:\Windows\System\JiTLilk.exe
  C:\Windows\System\JiTLilk.exe
  2⤵
  PID:10016
- C:\Windows\System\nXKRMSs.exe
  C:\Windows\System\nXKRMSs.exe
  2⤵
  PID:10032
- C:\Windows\System\XhcRVVh.exe
  C:\Windows\System\XhcRVVh.exe
  2⤵
  PID:10048
- C:\Windows\System\IWzHius.exe
  C:\Windows\System\IWzHius.exe
  2⤵
  PID:10064
- C:\Windows\System\aaluNRH.exe
  C:\Windows\System\aaluNRH.exe
  2⤵
  PID:10080
- C:\Windows\System\FSXdLFW.exe
  C:\Windows\System\FSXdLFW.exe
  2⤵
  PID:10096
- C:\Windows\System\dPmefLy.exe
  C:\Windows\System\dPmefLy.exe
  2⤵
  PID:10112
- C:\Windows\System\aryGQAE.exe
  C:\Windows\System\aryGQAE.exe
  2⤵
  PID:10128
- C:\Windows\System\dLhIBFx.exe
  C:\Windows\System\dLhIBFx.exe
  2⤵
  PID:10144
- C:\Windows\System\cPbLWVC.exe
  C:\Windows\System\cPbLWVC.exe
  2⤵
  PID:10160
- C:\Windows\System\dwhTctV.exe
  C:\Windows\System\dwhTctV.exe
  2⤵
  PID:10176
- C:\Windows\System\EwpLvul.exe
  C:\Windows\System\EwpLvul.exe
  2⤵
  PID:10192
- C:\Windows\System\fXEjoWq.exe
  C:\Windows\System\fXEjoWq.exe
  2⤵
  PID:10208
- C:\Windows\System\SvRcZWY.exe
  C:\Windows\System\SvRcZWY.exe
  2⤵
  PID:10224
- C:\Windows\System\lmtSouk.exe
  C:\Windows\System\lmtSouk.exe
  2⤵
  PID:8884
- C:\Windows\System\RnaITVD.exe
  C:\Windows\System\RnaITVD.exe
  2⤵
  PID:8728
- C:\Windows\System\VDFKBcP.exe
  C:\Windows\System\VDFKBcP.exe
  2⤵
  PID:9220
- C:\Windows\System\sOVHjxm.exe
  C:\Windows\System\sOVHjxm.exe
  2⤵
  PID:9316
- C:\Windows\System\QWHGZzf.exe
  C:\Windows\System\QWHGZzf.exe
  2⤵
  PID:9348
- C:\Windows\System\qmnbqDk.exe
  C:\Windows\System\qmnbqDk.exe
  2⤵
  PID:9416
- C:\Windows\System\XZbyyPe.exe
  C:\Windows\System\XZbyyPe.exe
  2⤵
  PID:9480
- C:\Windows\System\FINIJWK.exe
  C:\Windows\System\FINIJWK.exe
  2⤵
  PID:9544
- C:\Windows\System\cMWcRgq.exe
  C:\Windows\System\cMWcRgq.exe
  2⤵
  PID:9608
- C:\Windows\System\vqNUJsD.exe
  C:\Windows\System\vqNUJsD.exe
  2⤵
  PID:9668
- C:\Windows\System\VHfmzUX.exe
  C:\Windows\System\VHfmzUX.exe
  2⤵
  PID:9044
- C:\Windows\System\asAUQTO.exe
  C:\Windows\System\asAUQTO.exe
  2⤵
  PID:9268
- C:\Windows\System\jlwtrbf.exe
  C:\Windows\System\jlwtrbf.exe
  2⤵
  PID:9428
- C:\Windows\System\EoxcMEq.exe
  C:\Windows\System\EoxcMEq.exe
  2⤵
  PID:9492
- C:\Windows\System\cfOYEoc.exe
  C:\Windows\System\cfOYEoc.exe
  2⤵
  PID:9556
- C:\Windows\System\CFVfDVQ.exe
  C:\Windows\System\CFVfDVQ.exe
  2⤵
  PID:9620
- C:\Windows\System\mxeHFbX.exe
  C:\Windows\System\mxeHFbX.exe
  2⤵
  PID:9684
- C:\Windows\System\RfLqnnc.exe
  C:\Windows\System\RfLqnnc.exe
  2⤵
  PID:9272
- C:\Windows\System\nbJsbbG.exe
  C:\Windows\System\nbJsbbG.exe
  2⤵
  PID:9364
- C:\Windows\System\gutoQBr.exe
  C:\Windows\System\gutoQBr.exe
  2⤵
  PID:9748
- C:\Windows\System\bxGUwqr.exe
  C:\Windows\System\bxGUwqr.exe
  2⤵
  PID:9820
- C:\Windows\System\eLdzHhG.exe
  C:\Windows\System\eLdzHhG.exe
  2⤵
  PID:9884
- C:\Windows\System\ABphFVh.exe
  C:\Windows\System\ABphFVh.exe
  2⤵
  PID:9948
- C:\Windows\System\cVtYksd.exe
  C:\Windows\System\cVtYksd.exe
  2⤵
  PID:9700
- C:\Windows\System\AZoLDwX.exe
  C:\Windows\System\AZoLDwX.exe
  2⤵
  PID:9764
- C:\Windows\System\pFyAWMu.exe
  C:\Windows\System\pFyAWMu.exe
  2⤵
  PID:9832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CNENZaC.exe

Filesize
2.2MB

MD5
4ac148126f4878bac37b4a75a11c6a47

SHA1
67c486f70a5ff4235ade000d66ed1b8cf5c56a3e

SHA256
db5c20dc950510d96917d9e65db76ecfa4877689ce14c69dfcae00aa06bad40b

SHA512
0a46348b7acb4b0091538d250c6fd660592fa2dde1fa133edf5d55b517f5becbe7de7ecb09b77974ec77b2eef9e8198114b106520abc4624bf9eb3d30c87735f

Download Submit
C:\Windows\system\FeKwtNv.exe

Filesize
2.2MB

MD5
67aa98c2f8175fe096ec2e049a893449

SHA1
032d9b12625753fdd96a4128c36a6bc483783218

SHA256
0424b14abc8a08bdf14aafa448b03b21a95e93daaff1e9619c23d7cc5a94aa11

SHA512
cc2399f6bbd0247dfbcdaebcd89476344fa21f90e97843049852596708ade520c946bba7a9a767d3b5b6adcd5caeaa93baf0682c07fb0a627cac36286af9f034

Download Submit
C:\Windows\system\HqwyduA.exe

Filesize
2.2MB

MD5
1ef8f6218bcb1e59c0e6df6411bc358d

SHA1
7b053261d833cd85d85524bff779034ebd4d142a

SHA256
a5341b99796ec78c9b6fda28193c7ea5c86f5a49417d49b08fe2789ba561a954

SHA512
9e165d457de0fdd4475f562381574d96e0a4dda34a8bf889c68bd22b6b28404892e6b78ea47f7ee7e217156ca8123284c45655fe1920c0ffe040ec938191b224

Download Submit
C:\Windows\system\IxYACJj.exe

Filesize
2.2MB

MD5
8df6c875dbc5ce6e295eb0143cc0ccc6

SHA1
9d76210661928724933a0083abdb1e779c844ba5

SHA256
a4a85f35b367af781de6bee6e54e6edf303df7bee3e9a88399f20214a2a6bb2d

SHA512
7889310c80adeeceef70776bdc932df9de186d7adf9c2ad6a73ff7ceb93cc11b0d81c8cc89f64f6ee1d00ab0917770d798868bb5429dc7bba90d2dee781324d9

Download Submit
C:\Windows\system\MPRsgTc.exe

Filesize
2.2MB

MD5
cbeeb3040902b8fa3cce730b8354fffb

SHA1
3ce1ba47cc4cb3ee55352ba69d99a459d9846127

SHA256
b6b07dbc943cfe2231fce19475287a46ddfb9df0cf40f2387bdfbbe12b20a4d2

SHA512
e6a8ffad1cc9c90c36ea0b411e51f1bb8a39c006260f26f34c35c8e9d8d3f386456724478aa6952ed4dc4d214416aeff17c4373b5a59e143e38590deeb05fdb0

Download Submit
C:\Windows\system\PGZodkR.exe

Filesize
2.2MB

MD5
3e88bb596cf8d07483c7f200b7e00a22

SHA1
e047d9f1ac0b72b6e7be655ba8ac10865c5ae2de

SHA256
1fd511c59be2b7ea6f5d671a44eeff8136132e5dbdf171ceb87fd51b0dc21649

SHA512
3dedd35e209d253ba6da2bbbafaa468c0c7fb8a1401e5403774967c649961f9e2602ea23b49fdcb28e8a7d76e85d20080fbc8439ad9a1d8b0c45aad7642325ec

Download Submit
C:\Windows\system\PSnFSmU.exe

Filesize
2.2MB

MD5
23bb4820b2d7a54cba4fe71f9ae63d92

SHA1
d5563702af1c5361670266ce032d2876d0519d75

SHA256
6b0a3ac193753ec905b446db84295e8801c6f609531916e6d718e6d9ae7307d5

SHA512
e2bddb8e6987e9336c378e7c2b0be09d9f1050b4a721f9d89ddc3655cbf48c04b8bfa0c7b9bb2edd02d41a952003d45a39a33bcd2531d25ee6098e6d65338e1f

Download Submit
C:\Windows\system\QOTRgqn.exe

Filesize
2.2MB

MD5
2680a14ddbc6bf0d4972f096c0c22b54

SHA1
6e0eb6ceedcba0925e86e0168dcfa50c9e564b5e

SHA256
9664ae248fefa4187117a7bb5b33386760abe40ea44fad308f3099e617b0631b

SHA512
879a441cff69440cf383e7e80355ce5ca139a3a0f84d08b63655d092b40bab41790ee490fea4d759fc0cc2cbc32ad2e529a194d5a22120395ecf78c728143d35

Download Submit
C:\Windows\system\VRBJpfL.exe

Filesize
2.2MB

MD5
911cea2728440be1fcf19254bfc0fac7

SHA1
5ba4395afa1bcc4633c652a58df44e106a9e329e

SHA256
769f46427e7a257baa97dec13bec6f544f159b1244934ed09295a12d923da767

SHA512
c5b1ef3b7fdfdeacff31c158cb271e0467a4c5ae930f0f9e391595790d15665612bfc875007dc529b4737b9254eb99f96922c986a382ceccf6275b49390dba4d

Download Submit
C:\Windows\system\YFrGpek.exe

Filesize
2.2MB

MD5
bf6c75cc5cec61cf3178a57249f1c47a

SHA1
b578a12c34f4cd7dac5e8dc3c40bf4244f647c60

SHA256
108c0f1c13bd8c0f4bdc63205fc763b82df91e14f393d0f850423db8cfeec573

SHA512
054c737a4759b6721157ed01acb57809d225ca5368c8b96a0c061954ff06295a7e77c91fa0e2eaa3b7dafac0531234f9cab55c53b1cdde036e29fe41e61f7734

Download Submit
C:\Windows\system\bQZFrfE.exe

Filesize
2.2MB

MD5
4fe1289e2f94e7d16e0b632929821fc9

SHA1
8a4df806afd778454c7f7434398b18c182df5a9e

SHA256
a5d49edc54142667aef3e524e7d724b36dcea04ba25c36cdc39964337a0b23f9

SHA512
7eb53d70cba45d57177206a46e4f050b0b3a6ba79f6a4766ae93d254e12ecc3e46beabd419c7c5cbbaf4970bb2d0681e3e66bde9745763faadd51f8bea98cbf3

Download Submit
C:\Windows\system\ebZcSeb.exe

Filesize
2.2MB

MD5
20811521892dd9e5f42c14059d56af4d

SHA1
fee1b9b6528c75b6099324fea9e2a7ad43b2564f

SHA256
df92220ecd394d7849ac21141548f41cbd92afdce04693c2396679a31b30bfb3

SHA512
5c7bf0e7bc9d1ca042650adb0376eac3ee86d7812b9e9663f6fd1a227b2c2e6df032e2ce35da37f7497acd9d0ee4cbf202ab69dcae6de2eb97ab0a36c8822cb0

Download Submit
C:\Windows\system\flJtvOH.exe

Filesize
2.2MB

MD5
d7acf7481639e2ee363785b8e6ca7644

SHA1
a7d051cd38273653c04e040cab27af9d3399ec5e

SHA256
17eea35c0b14137041f8acb13a4dbd97b0829d06a87d532a6b77a33849b11e8c

SHA512
b3ee251cb90952986da305033afaa839f1e01907cd652c4c46d5f528c3fbab5b550d12f021e5e2fac4f538b258690b9943271ef2678f3780520be96cd1e9c733

Download Submit
C:\Windows\system\gjLLjTD.exe

Filesize
2.2MB

MD5
4bf4f23f284550bb8f2664c08c79ee8b

SHA1
883f009ca00a822ce41d55b35ab7584c4c3ad336

SHA256
9b08222eaf8ddba3ec7c9e391d6ee2621f3dc6d6c3a9df061ae5d19bb01b1045

SHA512
2c1afa2965a01ed9230644a30aa866b631c7e378cc95fde4cdb9fcdf8ac6926e5cee209ee85d3d75f92c09f8f4a0b1a7d9af9cc904b7aaa044ccd0d7c6054263

Download Submit
C:\Windows\system\iWOWxLA.exe

Filesize
2.2MB

MD5
406449ec19c48a1d2d0131af2e14dfbf

SHA1
8c79927aaa4742d136063d6fd851fb3037589880

SHA256
90c55add2cab29253af12619067c966e608e45cd1ef1c01c657d06232ae69dee

SHA512
466732a13bc420b1cfd2f22725e06925da7d365a4ed2d56b4e410eecf97e10b2f93153a0da52908b3938694f85543ba27ecec7aa16f8d5cc73e4943983f77b15

Download Submit
C:\Windows\system\jzEtUjn.exe

Filesize
2.2MB

MD5
11f4360d0673c1c7892a8d6493eef837

SHA1
b66410539ab3e7aef9fee2c221ea7daaedada83a

SHA256
27a9473ce7fe0874a4772baeaa6ce4b6731a7caa98730555d3a1fb4359af7449

SHA512
5b7e5cdb2abf602b0ee2ff0399f289d7bd815ae1114406dec8299e4dd13dd8f6865af297ee15c7846fc9eced91bd8cb0b2ea4d92af7900efd5877decd4190d54

Download Submit
C:\Windows\system\mlnLaHC.exe

Filesize
2.2MB

MD5
8de0a4970d9c295f47ca16aa648c86d0

SHA1
a10e5bfb32a3d3d81fea58b8a43ef4292cb11a6f

SHA256
a52e87aa51952f0e9e8acc85f59c479a8ed89c2f3ea29ffd2bf49746f762913d

SHA512
215e5f710b85f01139f8a452f5b3678efa06f52f94ed871a752e8bd29aade3a98471b123abf477eb6180922d56ea73a67321a45bda083e810ee21cb3a31bca56

Download Submit
C:\Windows\system\payXavk.exe

Filesize
2.2MB

MD5
3616376d65d816e120b911fa6c06d1da

SHA1
b19c5477f49e3f9799e8cc8aebf194d52dcecb2c

SHA256
8b4879406bc2891472c64c67c877b1a72c6a17089e840afb7752d8eaca8437ee

SHA512
8ff016f893ab3bd02193cd2b8558faca85385f2f36a01fd240eb34789d7acab6506975bdf9f2c86378d6d2a0ba03d63f7af6187c3391759ed6d3665f7761a61a

Download Submit
C:\Windows\system\qPCatFx.exe

Filesize
2.2MB

MD5
efda11cc22897ca3c5aa8aefb658ba34

SHA1
ee26441469e6d7ddf665b16fad78d84cbd9e1b71

SHA256
943f366c6ac831f7645a71e20bce268f99e30a815f6aea52cc6496e34736a012

SHA512
dbd046bbbb045f8b86f5e37691e2a732704d01eb93ed2c57b12159bd597b71e86965733306ac6df40303cd4475908a789f197b66894f9b0840b5e4e5b0a6614d

Download Submit
C:\Windows\system\rvaTczT.exe

Filesize
2.2MB

MD5
bd4324055ca911a579c4611ea3df0d8b

SHA1
dee5faf495374e3faca41ea71f623831641de4a6

SHA256
c538071aa407f08905e364749d70e4be52add401ef92645bfc3817a682b751c1

SHA512
fe00c184b6bdc1a6b263e62540ccc0e1e9ffd28547ba176624b07e9c8a8d1444132071e0dbe7ddf6ade3ebf07e3a0656501f431fd6ae730a4a128f8e3c158e17

Download Submit
C:\Windows\system\sVzCfjH.exe

Filesize
2.2MB

MD5
5137e9325be4896df4c8e8d2215b60a6

SHA1
1fa930d4bbe16abde2dfb6406d2c6ba504ca8326

SHA256
16ca0090233ed3514b25ca35f66b5feead54e70e58ecebf1589aee11aeb9c62c

SHA512
6ae07ce6844ca672dbfac6ad0974ce0e3855712c7ec2eda3a552d233e91700d4c082b0a406a1b38ff49a9dc81654c27058ab4610b9fd8b5ad9f440d9b94a6bb9

Download Submit
C:\Windows\system\sYPlkMU.exe

Filesize
2.2MB

MD5
e2e59a7d9cbe70aca02343475359567f

SHA1
b8f7ce04fc42e5de9f32c451072372020ef0c00d

SHA256
7729773723f8aa4ebb7ce6b5648b80d8db54c71534904bc6cf7f047f0cc7b62f

SHA512
c45fa7f6fee75ff54c0af2eb7654c3339b664997007bd29c6ceef4ffa2446dbf8eebaa22794d6afe5113052ee05599d4b96bce520b46fde7230178724254854b

Download Submit
C:\Windows\system\xhvZJbo.exe

Filesize
2.2MB

MD5
7ba6dcb4e1cef8365c8edabb7cabba08

SHA1
6d5a197bce7aa423b9331c531ced35dad793f6b1

SHA256
2166c25897f150e29c2e7249d3eb6958831ebf547c3067d8e9f65adc6ee2b871

SHA512
b80d23252680ae6d775d9bb421b905655bb94bf0cf83ecaf8e25a0490c8c65945edb623178b676b03fc48055bfd680b18d29e21a935ce30b26a17f07920b1f37

Download Submit
\Windows\system\BFeCAZQ.exe

Filesize
2.2MB

MD5
a4e74b4aa94583bd76da5cd4e8f2f757

SHA1
fcb416dd6cb1109e856851595faaf885db4fdd82

SHA256
9d0f3e986cfb554e7671df23cbc003923b9ea8120f9fbc00733b42cb621dd260

SHA512
4ffd3084b453ff65d8498f10a9a71a5123aeb56f89534a6727556fcaee82e26993f678ef3659c588c441d8e56b203f3bb302146a651e013b843a94a38690dbb4

Download Submit
\Windows\system\BMxWkwd.exe

Filesize
2.2MB

MD5
98b5d4ff0f039dfaa43bef33e5a4af9a

SHA1
a569fba04018f828145afb4f1ac02c327f459c7e

SHA256
ab07541b3999545aa2f71e9425a1419ab5d86eb5e1396d9cff9355cca140d9d9

SHA512
a9536738377849325b02c450c5146e9b56e480285cd2a87126032e0d0172d68006d3fa23b1a8b37d4b0f0e31286a53b29381ae1ff3f3a412626148b7a7c570c9

Download Submit
\Windows\system\OOxhiqY.exe

Filesize
2.2MB

MD5
501cfe8c164aab5702ae60dcf631a303

SHA1
6d3d09fd4d3abc97e45b51d41c20a4ca3401ee90

SHA256
255378021e3991d872fce92d0c75d0c78539b4b055f9766db3c722e68a4c3753

SHA512
c6c35cda299fa014e27a04b9bf40a885eecbb496124d65213f517b1069e5dff74a701a8d7bbee49549458b8107dbb0424aaf225d6f3299152ac0d1751e129b93

Download Submit
\Windows\system\ZOaCszr.exe

Filesize
2.2MB

MD5
3c3ef4ec9b1455337644a827ea618493

SHA1
87ee396c97b71edf10ed97b2d4d0fde33efa4cea

SHA256
ebaac2e604f6be66f2a47e01067e81e0f5fb4e95b0120d0942a07a6fccbd1276

SHA512
f2b1c7ada244964e1b91784d7883634d7618499bbf06e3b60790c68371537f43402ba0fc4a577f6a67d4676b4989499609de9d4846c87a2ea9f9812a9672914a

Download Submit
\Windows\system\aFSIMaX.exe

Filesize
2.2MB

MD5
0fd07c920cffde73451dfc2e8d9d4de1

SHA1
f423ea633a651fcfa5ca03254f8b471db897bfd6

SHA256
59b72be947d520b33a77cf806eae41dc7948e6632ae825dd2ca261b5141f7c9f

SHA512
ed972477c514ccdba7bb9c544ff0786ce59edc0095744006773f95728393f40481e44ec6d73aa96a725f731c6b06908c39d89f1c44098935c5fcbfb83ef10b02

Download Submit
\Windows\system\hqFwZGX.exe

Filesize
2.2MB

MD5
809674b450667d1cc39617563b04fd90

SHA1
9c69f1fe4311792ff937718a94926e183b55f70e

SHA256
74d5d54ec9f25c1cd9948fd6875130f5b1760aa3fad8cf89710debb479503d59

SHA512
210ec9aea8e5f268e30e638b5eba571aa859f84bccd89cb984dd91aece015204048dcb9d8749f10b0bafeff726f221eb268673c631c44a7339738062ffabef93

Download Submit
\Windows\system\lADlqxw.exe

Filesize
2.2MB

MD5
56597ab74040b1e922569a7989350ffc

SHA1
799ecd60e59e026f8f9e0b9ed28b096b63c0d309

SHA256
e60381f9318067891f7bc2ec31cf978313b036a47ab7fd292aeac7d6d63a4107

SHA512
ddfca2c56190b0673ab11f964c2ab7540d3c61e31684859204181f8057169b50be7cb6e8d5813d1e5c28790f53c7902542348fa6f803ad12ef6111a63d81999d

Download Submit
\Windows\system\urKwivW.exe

Filesize
2.2MB

MD5
1a0674a90cf7b071e596d9aaa055c817

SHA1
5fe6777f8503e317996423d853591cc87eabb53a

SHA256
4a2e097fa6e8b0368664201b441fabba242302bb49594fe49dfd674fdd4d667d

SHA512
d435b7829e39430cb01360213ea8420fe13cbe9f520f6470dfa526d9b3d021014d37f25ee6e55ec3027382d06451e29196c97c77aeda9002aacdf6d89818e21f

Download Submit
\Windows\system\vAChbeP.exe

Filesize
2.2MB

MD5
ca7d9c35f5c81c9f4f7f45ebde108aa8

SHA1
9dbc4cde96e1cd2063e48477306022c7edb9b01a

SHA256
9b10fe0f9f12a31faceedbbdb98946e0521c059522a869ca0c3109b3e2eabe3f

SHA512
fd8a0e92463ec908051ae14dbe9ee85a6b4a3d921e60d37983d6e693ba10e78a19bea638e771441ca6e6d33bda90fb5d9b30f0a7d793938bd6ad6111c34bf83d

Download Submit
\Windows\system\xntBiyX.exe

Filesize
2.2MB

MD5
5d3f0114ae83291e8e10116ac856f7fc

SHA1
c7c40e6030122a3f824bb1e5611f9bf02421d540

SHA256
985e98eb6cfd3a6d8a8d053a709d6df4c51be504799940f289fa3a83b40a9a8f

SHA512
3bb85c1ea3fb6788741c11a552fb1d58926697978809945f7fb6baf9ff1caa70a05d83dab75c1ce4ef28d8edefb0929b565acc3621d44f214c393bb4436f5ba0

Download Submit
memory/1184-14-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/1720-434-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2176-441-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2176-444-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2176-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2176-427-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2176-430-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2176-428-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2176-431-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2176-0-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2176-436-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2176-437-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2176-443-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2176-446-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2176-445-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2176-6-0x0000000002A60000-0x0000000002E52000-memory.dmp

Filesize
3.9MB

Download
memory/2176-439-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2260-190-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2260-194-0x0000000001E50000-0x0000000001E58000-memory.dmp

Filesize
32KB

Download
memory/2328-433-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/2552-438-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2580-442-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2612-432-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2728-429-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2752-440-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2772-349-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/3060-435-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download