xmrig | 9976a1d97eed7c3b32aa5c347df2dfcbf9f204296d0bfb2334cfd9860621259d

Analysis

max time kernel
17s
max time network
30s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
Size

2.3MB
MD5

083ac4bc45e2f9da0230bef9fbe1ab14
SHA1

813880eedb94055aa3dc367f38732c1f871f69a7
SHA256

9976a1d97eed7c3b32aa5c347df2dfcbf9f204296d0bfb2334cfd9860621259d
SHA512

c766f1033233d49315a01b38578e883aee9db267da5b527f6cf63bcee645fe72c858c7284b4bdee1da4f8ed2f19c6c3efc156490d4b45ed32da720184520eccd
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//2E:NAB1

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 5 IoCs

miner

resource	yara_rule
behavioral1/memory/3064-13-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2640-19-0x000000013F940000-0x000000013FD32000-memory.dmp	xmrig
behavioral1/memory/2496-128-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2620-109-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/2600-103-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3064	cpWdqyp.exe
2640	ChnAaor.exe
2600	xwHGUZn.exe
2620	oHZhlbb.exe
2496	hdBAJHm.exe
2936	oGauXzt.exe
2932	eUswaaH.exe
1644	AYYwPYo.exe
2816	DBfueMv.exe
2552	FLmrxfD.exe
1584	RGsokZD.exe
620	qvjrqyV.exe
1768	gZqCbcW.exe
2396	JaxwQLK.exe
2536	yYyUCIE.exe
2548	qgTwNoa.exe
2308	TsPgNci.exe
1656	pZDXAJB.exe
2424	NiibCsy.exe
1620	CEUAqQH.exe
2780	GqIbjmR.exe
1772	UkrgMJa.exe
352	xsBBTeU.exe
944	tiqKKDL.exe
348	LYpWqXG.exe
1764	pplbuiP.exe
2008	XWEivjN.exe
2776	bjPjesr.exe
1212	uIvWwOa.exe
2164	ZwrIwUb.exe
1568	fRlgohu.exe
2020	CMvAfWJ.exe
896	vbyHSNo.exe
1628	MvUffqq.exe
2192	wlogtXC.exe
1592	EqGHTHv.exe
1316	uTOUcFo.exe
2056	ONaYFWh.exe
880	bdIocRZ.exe
1688	oMYBVtR.exe
1524	KjCEMyX.exe
2628	ErKvvib.exe
2608	PqygRve.exe
3016	sWrrEGJ.exe
2304	UfcXbqS.exe
1816	lFUClEy.exe
592	jeTYkhs.exe
2880	GAcGGGu.exe
2996	rFApJte.exe
292	yuoXqnF.exe
2264	oaDuWFQ.exe
2636	YVlxWDs.exe
1228	PhzTXxA.exe
1532	bmwLywF.exe
2984	QuQYvLJ.exe
988	EbxnudO.exe
2908	ntQmygJ.exe
1940	DYyUFll.exe
3104	loRgnKb.exe
3136	zTiZGBH.exe
3168	KrwcVYL.exe
3200	ewgTohx.exe
3232	MLjxZod.exe
3264	madKuPA.exe

Loads dropped DLL 64 IoCs

pid	Process
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2084-0-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/files/0x00090000000122ee-6.dat	upx
behavioral1/memory/3064-13-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/files/0x003700000001448b-17.dat	upx
behavioral1/memory/2640-19-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/files/0x00130000000054a8-21.dat	upx
behavioral1/files/0x00090000000145d4-26.dat	upx
behavioral1/files/0x0006000000015ced-57.dat	upx
behavioral1/files/0x0006000000015cca-46.dat	upx
behavioral1/files/0x00070000000148af-40.dat	upx
behavioral1/files/0x00080000000146a7-36.dat	upx
behavioral1/files/0x0006000000015ce1-134.dat	upx
behavioral1/files/0x0006000000015d28-144.dat	upx
behavioral1/files/0x0006000000015d13-142.dat	upx
behavioral1/files/0x000600000001640f-154.dat	upx
behavioral1/files/0x0006000000016591-162.dat	upx
behavioral1/files/0x0006000000015fbb-157.dat	upx
behavioral1/files/0x0006000000015cf5-140.dat	upx
behavioral1/files/0x0006000000016228-137.dat	upx
behavioral1/files/0x000700000001474b-32.dat	upx
behavioral1/files/0x0006000000016020-92.dat	upx
behavioral1/files/0x0006000000016a3a-171.dat	upx
behavioral1/files/0x0006000000016ca1-185.dat	upx
behavioral1/files/0x0006000000016c57-178.dat	upx
behavioral1/files/0x0006000000015f40-85.dat	upx
behavioral1/files/0x0006000000015d89-79.dat	upx
behavioral1/files/0x0006000000015d1e-73.dat	upx
behavioral1/files/0x0006000000015d02-67.dat	upx
behavioral1/files/0x0006000000015cd8-49.dat	upx
behavioral1/files/0x0009000000014c0b-43.dat	upx
behavioral1/files/0x000700000001475f-37.dat	upx
behavioral1/files/0x000600000001650f-159.dat	upx
behavioral1/files/0x00060000000167e8-166.dat	upx
behavioral1/files/0x0006000000015d99-82.dat	upx
behavioral1/files/0x00380000000144d6-145.dat	upx
behavioral1/memory/2496-128-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2620-109-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/2600-103-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/files/0x0006000000016126-95.dat	upx
behavioral1/files/0x0006000000016c5b-180.dat	upx
behavioral1/files/0x0006000000016c3a-173.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\upkIgVn.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\urZkbXN.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\TScejoG.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\goxbjKp.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\PsUtOVA.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\equYLtS.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\BrQZxAQ.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\hvrKWuL.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\JJjqZuc.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\mlMaasV.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\EQXkYDU.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\bBZiglx.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\DaWnXJL.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\UenyYfl.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\CEUAqQH.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\dgsufTL.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\MjZPJkd.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\OITfFfa.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\MmDSCdI.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\MBTsInA.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\waCPtoM.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\rnGtnOf.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\rOgCOeI.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\KJqdmAQ.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\QiKydgx.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\xkOkueg.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\eNMLtRL.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\xUqhYUx.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\rlTMSil.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\faqHLPs.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\FFJiEmu.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\THyUumT.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\pplbuiP.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\dsHOPNl.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\ffTfpPS.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\HWiTarx.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\vXUdssb.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\QQyAQpb.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\EaCkzAv.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\FmZmKnL.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\YhWTakl.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\XCDUhhf.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\hdBAJHm.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\GKtBAYY.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\KBULYnk.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\mtjIwtL.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\hTBKZpZ.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\rRNbUjC.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\deFRkcX.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\oCzpkZQ.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\jihbgPZ.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\mvJeLUV.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\bjCxmPn.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\vuhKgGo.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\iyOSROH.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\oZTKNIk.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\WPpFaMG.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\mDxUfMe.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\oHZhlbb.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\hBCstyC.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\NcFrRya.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\otSQUen.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\bjPjesr.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
File created	C:\Windows\System\RENihLr.exe	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2032	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
Token: SeDebugPrivilege	2032	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2032	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	29
PID 2084 wrote to memory of 2032	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	29
PID 2084 wrote to memory of 2032	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	29
PID 2084 wrote to memory of 3064	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	30
PID 2084 wrote to memory of 3064	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	30
PID 2084 wrote to memory of 3064	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2640	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	31
PID 2084 wrote to memory of 2640	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	31
PID 2084 wrote to memory of 2640	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	31
PID 2084 wrote to memory of 2600	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	32
PID 2084 wrote to memory of 2600	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	32
PID 2084 wrote to memory of 2600	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	32
PID 2084 wrote to memory of 2816	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	33
PID 2084 wrote to memory of 2816	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	33
PID 2084 wrote to memory of 2816	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	33
PID 2084 wrote to memory of 2620	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	34
PID 2084 wrote to memory of 2620	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	34
PID 2084 wrote to memory of 2620	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	34
PID 2084 wrote to memory of 2536	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	35
PID 2084 wrote to memory of 2536	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	35
PID 2084 wrote to memory of 2536	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	35
PID 2084 wrote to memory of 2496	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	36
PID 2084 wrote to memory of 2496	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	36
PID 2084 wrote to memory of 2496	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	36
PID 2084 wrote to memory of 2548	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	37
PID 2084 wrote to memory of 2548	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	37
PID 2084 wrote to memory of 2548	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	37
PID 2084 wrote to memory of 2936	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	38
PID 2084 wrote to memory of 2936	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	38
PID 2084 wrote to memory of 2936	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	38
PID 2084 wrote to memory of 2308	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	39
PID 2084 wrote to memory of 2308	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	39
PID 2084 wrote to memory of 2308	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	39
PID 2084 wrote to memory of 2932	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	40
PID 2084 wrote to memory of 2932	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	40
PID 2084 wrote to memory of 2932	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	40
PID 2084 wrote to memory of 1656	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	41
PID 2084 wrote to memory of 1656	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	41
PID 2084 wrote to memory of 1656	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	41
PID 2084 wrote to memory of 1644	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	42
PID 2084 wrote to memory of 1644	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	42
PID 2084 wrote to memory of 1644	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	42
PID 2084 wrote to memory of 1620	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	43
PID 2084 wrote to memory of 1620	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	43
PID 2084 wrote to memory of 1620	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	43
PID 2084 wrote to memory of 2552	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	44
PID 2084 wrote to memory of 2552	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	44
PID 2084 wrote to memory of 2552	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	44
PID 2084 wrote to memory of 2780	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	45
PID 2084 wrote to memory of 2780	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	45
PID 2084 wrote to memory of 2780	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	45
PID 2084 wrote to memory of 1584	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	46
PID 2084 wrote to memory of 1584	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	46
PID 2084 wrote to memory of 1584	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	46
PID 2084 wrote to memory of 1772	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	47
PID 2084 wrote to memory of 1772	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	47
PID 2084 wrote to memory of 1772	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	47
PID 2084 wrote to memory of 620	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	48
PID 2084 wrote to memory of 620	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	48
PID 2084 wrote to memory of 620	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	48
PID 2084 wrote to memory of 352	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	49
PID 2084 wrote to memory of 352	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	49
PID 2084 wrote to memory of 352	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	49
PID 2084 wrote to memory of 1768	2084	083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\083ac4bc45e2f9da0230bef9fbe1ab14_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2032
- C:\Windows\System\cpWdqyp.exe
  C:\Windows\System\cpWdqyp.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\ChnAaor.exe
  C:\Windows\System\ChnAaor.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\xwHGUZn.exe
  C:\Windows\System\xwHGUZn.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\DBfueMv.exe
  C:\Windows\System\DBfueMv.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\oHZhlbb.exe
  C:\Windows\System\oHZhlbb.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\yYyUCIE.exe
  C:\Windows\System\yYyUCIE.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\hdBAJHm.exe
  C:\Windows\System\hdBAJHm.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\qgTwNoa.exe
  C:\Windows\System\qgTwNoa.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\oGauXzt.exe
  C:\Windows\System\oGauXzt.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\TsPgNci.exe
  C:\Windows\System\TsPgNci.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\eUswaaH.exe
  C:\Windows\System\eUswaaH.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\pZDXAJB.exe
  C:\Windows\System\pZDXAJB.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\AYYwPYo.exe
  C:\Windows\System\AYYwPYo.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\CEUAqQH.exe
  C:\Windows\System\CEUAqQH.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\FLmrxfD.exe
  C:\Windows\System\FLmrxfD.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\GqIbjmR.exe
  C:\Windows\System\GqIbjmR.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\RGsokZD.exe
  C:\Windows\System\RGsokZD.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\UkrgMJa.exe
  C:\Windows\System\UkrgMJa.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\qvjrqyV.exe
  C:\Windows\System\qvjrqyV.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\xsBBTeU.exe
  C:\Windows\System\xsBBTeU.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\gZqCbcW.exe
  C:\Windows\System\gZqCbcW.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\LYpWqXG.exe
  C:\Windows\System\LYpWqXG.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\JaxwQLK.exe
  C:\Windows\System\JaxwQLK.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\iuaQiiI.exe
  C:\Windows\System\iuaQiiI.exe
  2⤵
  PID:1944
- C:\Windows\System\NiibCsy.exe
  C:\Windows\System\NiibCsy.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\hBCstyC.exe
  C:\Windows\System\hBCstyC.exe
  2⤵
  PID:704
- C:\Windows\System\tiqKKDL.exe
  C:\Windows\System\tiqKKDL.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\nbkZTel.exe
  C:\Windows\System\nbkZTel.exe
  2⤵
  PID:1844
- C:\Windows\System\pplbuiP.exe
  C:\Windows\System\pplbuiP.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\PfbJnpu.exe
  C:\Windows\System\PfbJnpu.exe
  2⤵
  PID:2448
- C:\Windows\System\XWEivjN.exe
  C:\Windows\System\XWEivjN.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\hcdtCSl.exe
  C:\Windows\System\hcdtCSl.exe
  2⤵
  PID:3052
- C:\Windows\System\bjPjesr.exe
  C:\Windows\System\bjPjesr.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\WHQVXap.exe
  C:\Windows\System\WHQVXap.exe
  2⤵
  PID:1744
- C:\Windows\System\uIvWwOa.exe
  C:\Windows\System\uIvWwOa.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\DWvyKSS.exe
  C:\Windows\System\DWvyKSS.exe
  2⤵
  PID:1276
- C:\Windows\System\ZwrIwUb.exe
  C:\Windows\System\ZwrIwUb.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\sobnGxg.exe
  C:\Windows\System\sobnGxg.exe
  2⤵
  PID:1292
- C:\Windows\System\fRlgohu.exe
  C:\Windows\System\fRlgohu.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\WyauzHE.exe
  C:\Windows\System\WyauzHE.exe
  2⤵
  PID:2028
- C:\Windows\System\CMvAfWJ.exe
  C:\Windows\System\CMvAfWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\emmusiO.exe
  C:\Windows\System\emmusiO.exe
  2⤵
  PID:1988
- C:\Windows\System\vbyHSNo.exe
  C:\Windows\System\vbyHSNo.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\xpLAdvO.exe
  C:\Windows\System\xpLAdvO.exe
  2⤵
  PID:612
- C:\Windows\System\MvUffqq.exe
  C:\Windows\System\MvUffqq.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\TDHWDaT.exe
  C:\Windows\System\TDHWDaT.exe
  2⤵
  PID:2060
- C:\Windows\System\wlogtXC.exe
  C:\Windows\System\wlogtXC.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\dRiYLIS.exe
  C:\Windows\System\dRiYLIS.exe
  2⤵
  PID:1348
- C:\Windows\System\EqGHTHv.exe
  C:\Windows\System\EqGHTHv.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\SJZxBgq.exe
  C:\Windows\System\SJZxBgq.exe
  2⤵
  PID:2188
- C:\Windows\System\uTOUcFo.exe
  C:\Windows\System\uTOUcFo.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\vgbOuVt.exe
  C:\Windows\System\vgbOuVt.exe
  2⤵
  PID:2184
- C:\Windows\System\ONaYFWh.exe
  C:\Windows\System\ONaYFWh.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\ZybFNIL.exe
  C:\Windows\System\ZybFNIL.exe
  2⤵
  PID:2972
- C:\Windows\System\bdIocRZ.exe
  C:\Windows\System\bdIocRZ.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\lELiZeX.exe
  C:\Windows\System\lELiZeX.exe
  2⤵
  PID:1632
- C:\Windows\System\oMYBVtR.exe
  C:\Windows\System\oMYBVtR.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\wNKwFjg.exe
  C:\Windows\System\wNKwFjg.exe
  2⤵
  PID:2856
- C:\Windows\System\KjCEMyX.exe
  C:\Windows\System\KjCEMyX.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\hbppnuv.exe
  C:\Windows\System\hbppnuv.exe
  2⤵
  PID:1624
- C:\Windows\System\ErKvvib.exe
  C:\Windows\System\ErKvvib.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\XldYCna.exe
  C:\Windows\System\XldYCna.exe
  2⤵
  PID:2860
- C:\Windows\System\PqygRve.exe
  C:\Windows\System\PqygRve.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\QiKydgx.exe
  C:\Windows\System\QiKydgx.exe
  2⤵
  PID:2744
- C:\Windows\System\sWrrEGJ.exe
  C:\Windows\System\sWrrEGJ.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\gQIyCHL.exe
  C:\Windows\System\gQIyCHL.exe
  2⤵
  PID:1604
- C:\Windows\System\UfcXbqS.exe
  C:\Windows\System\UfcXbqS.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\eRacppg.exe
  C:\Windows\System\eRacppg.exe
  2⤵
  PID:2572
- C:\Windows\System\lFUClEy.exe
  C:\Windows\System\lFUClEy.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\XhMDcPA.exe
  C:\Windows\System\XhMDcPA.exe
  2⤵
  PID:2144
- C:\Windows\System\jeTYkhs.exe
  C:\Windows\System\jeTYkhs.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\jjLCvGo.exe
  C:\Windows\System\jjLCvGo.exe
  2⤵
  PID:980
- C:\Windows\System\GAcGGGu.exe
  C:\Windows\System\GAcGGGu.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\pGxGoXv.exe
  C:\Windows\System\pGxGoXv.exe
  2⤵
  PID:1116
- C:\Windows\System\rFApJte.exe
  C:\Windows\System\rFApJte.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\jNRGsga.exe
  C:\Windows\System\jNRGsga.exe
  2⤵
  PID:2276
- C:\Windows\System\yuoXqnF.exe
  C:\Windows\System\yuoXqnF.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\gFCfTNY.exe
  C:\Windows\System\gFCfTNY.exe
  2⤵
  PID:868
- C:\Windows\System\oaDuWFQ.exe
  C:\Windows\System\oaDuWFQ.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\HpdDXOY.exe
  C:\Windows\System\HpdDXOY.exe
  2⤵
  PID:2528
- C:\Windows\System\YVlxWDs.exe
  C:\Windows\System\YVlxWDs.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\RsocEvH.exe
  C:\Windows\System\RsocEvH.exe
  2⤵
  PID:2944
- C:\Windows\System\PhzTXxA.exe
  C:\Windows\System\PhzTXxA.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\xkOkueg.exe
  C:\Windows\System\xkOkueg.exe
  2⤵
  PID:1232
- C:\Windows\System\bmwLywF.exe
  C:\Windows\System\bmwLywF.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\XUrXrwT.exe
  C:\Windows\System\XUrXrwT.exe
  2⤵
  PID:2508
- C:\Windows\System\QuQYvLJ.exe
  C:\Windows\System\QuQYvLJ.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\GjLYjcb.exe
  C:\Windows\System\GjLYjcb.exe
  2⤵
  PID:780
- C:\Windows\System\EbxnudO.exe
  C:\Windows\System\EbxnudO.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\gUlkllS.exe
  C:\Windows\System\gUlkllS.exe
  2⤵
  PID:1912
- C:\Windows\System\ntQmygJ.exe
  C:\Windows\System\ntQmygJ.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\miPUjAr.exe
  C:\Windows\System\miPUjAr.exe
  2⤵
  PID:2708
- C:\Windows\System\DYyUFll.exe
  C:\Windows\System\DYyUFll.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\NzuMRfZ.exe
  C:\Windows\System\NzuMRfZ.exe
  2⤵
  PID:3088
- C:\Windows\System\loRgnKb.exe
  C:\Windows\System\loRgnKb.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\srWKRYM.exe
  C:\Windows\System\srWKRYM.exe
  2⤵
  PID:3120
- C:\Windows\System\zTiZGBH.exe
  C:\Windows\System\zTiZGBH.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\IiUjxaV.exe
  C:\Windows\System\IiUjxaV.exe
  2⤵
  PID:3152
- C:\Windows\System\KrwcVYL.exe
  C:\Windows\System\KrwcVYL.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\CtNQaUX.exe
  C:\Windows\System\CtNQaUX.exe
  2⤵
  PID:3184
- C:\Windows\System\ewgTohx.exe
  C:\Windows\System\ewgTohx.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\psAdUVI.exe
  C:\Windows\System\psAdUVI.exe
  2⤵
  PID:3216
- C:\Windows\System\MLjxZod.exe
  C:\Windows\System\MLjxZod.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\kROFLOb.exe
  C:\Windows\System\kROFLOb.exe
  2⤵
  PID:3248
- C:\Windows\System\madKuPA.exe
  C:\Windows\System\madKuPA.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\gmlzvPi.exe
  C:\Windows\System\gmlzvPi.exe
  2⤵
  PID:3280
- C:\Windows\System\AykWiIi.exe
  C:\Windows\System\AykWiIi.exe
  2⤵
  PID:3296
- C:\Windows\System\GKtBAYY.exe
  C:\Windows\System\GKtBAYY.exe
  2⤵
  PID:3312
- C:\Windows\System\rZAsVmM.exe
  C:\Windows\System\rZAsVmM.exe
  2⤵
  PID:3328
- C:\Windows\System\kiFuztx.exe
  C:\Windows\System\kiFuztx.exe
  2⤵
  PID:3344
- C:\Windows\System\MTnDUJz.exe
  C:\Windows\System\MTnDUJz.exe
  2⤵
  PID:3360
- C:\Windows\System\UCdHHvM.exe
  C:\Windows\System\UCdHHvM.exe
  2⤵
  PID:3456
- C:\Windows\System\UQmUGdz.exe
  C:\Windows\System\UQmUGdz.exe
  2⤵
  PID:3472
- C:\Windows\System\xlyBgMM.exe
  C:\Windows\System\xlyBgMM.exe
  2⤵
  PID:3496
- C:\Windows\System\MFWZHxc.exe
  C:\Windows\System\MFWZHxc.exe
  2⤵
  PID:3512
- C:\Windows\System\HnjVzZe.exe
  C:\Windows\System\HnjVzZe.exe
  2⤵
  PID:3532
- C:\Windows\System\xILUgdr.exe
  C:\Windows\System\xILUgdr.exe
  2⤵
  PID:3548
- C:\Windows\System\xFkejVE.exe
  C:\Windows\System\xFkejVE.exe
  2⤵
  PID:3564
- C:\Windows\System\oKgaufi.exe
  C:\Windows\System\oKgaufi.exe
  2⤵
  PID:3580
- C:\Windows\System\eNMLtRL.exe
  C:\Windows\System\eNMLtRL.exe
  2⤵
  PID:3596
- C:\Windows\System\duEiwYG.exe
  C:\Windows\System\duEiwYG.exe
  2⤵
  PID:3612
- C:\Windows\System\qygLGte.exe
  C:\Windows\System\qygLGte.exe
  2⤵
  PID:3628
- C:\Windows\System\vUuClFb.exe
  C:\Windows\System\vUuClFb.exe
  2⤵
  PID:3644
- C:\Windows\System\qwllzyv.exe
  C:\Windows\System\qwllzyv.exe
  2⤵
  PID:3660
- C:\Windows\System\TrbwlBi.exe
  C:\Windows\System\TrbwlBi.exe
  2⤵
  PID:3684
- C:\Windows\System\EnFhXje.exe
  C:\Windows\System\EnFhXje.exe
  2⤵
  PID:3708
- C:\Windows\System\OLqezen.exe
  C:\Windows\System\OLqezen.exe
  2⤵
  PID:3740
- C:\Windows\System\mvRJYhH.exe
  C:\Windows\System\mvRJYhH.exe
  2⤵
  PID:3764
- C:\Windows\System\NBpRyfV.exe
  C:\Windows\System\NBpRyfV.exe
  2⤵
  PID:3780
- C:\Windows\System\oDIxjMM.exe
  C:\Windows\System\oDIxjMM.exe
  2⤵
  PID:3796
- C:\Windows\System\iboyWNw.exe
  C:\Windows\System\iboyWNw.exe
  2⤵
  PID:3812
- C:\Windows\System\xOLmlaO.exe
  C:\Windows\System\xOLmlaO.exe
  2⤵
  PID:3828
- C:\Windows\System\kiqcObb.exe
  C:\Windows\System\kiqcObb.exe
  2⤵
  PID:3848
- C:\Windows\System\NAHJwaA.exe
  C:\Windows\System\NAHJwaA.exe
  2⤵
  PID:3864
- C:\Windows\System\LASbdzp.exe
  C:\Windows\System\LASbdzp.exe
  2⤵
  PID:3880
- C:\Windows\System\RyPqZLE.exe
  C:\Windows\System\RyPqZLE.exe
  2⤵
  PID:3896
- C:\Windows\System\tILhQtP.exe
  C:\Windows\System\tILhQtP.exe
  2⤵
  PID:3912
- C:\Windows\System\KvnhXIu.exe
  C:\Windows\System\KvnhXIu.exe
  2⤵
  PID:3928
- C:\Windows\System\TKjHkoi.exe
  C:\Windows\System\TKjHkoi.exe
  2⤵
  PID:3944
- C:\Windows\System\evANqfK.exe
  C:\Windows\System\evANqfK.exe
  2⤵
  PID:3960
- C:\Windows\System\jIQcmYk.exe
  C:\Windows\System\jIQcmYk.exe
  2⤵
  PID:3976
- C:\Windows\System\fNxRbRM.exe
  C:\Windows\System\fNxRbRM.exe
  2⤵
  PID:3992
- C:\Windows\System\YMxwKbU.exe
  C:\Windows\System\YMxwKbU.exe
  2⤵
  PID:4008
- C:\Windows\System\xUqhYUx.exe
  C:\Windows\System\xUqhYUx.exe
  2⤵
  PID:4024
- C:\Windows\System\AeEqXll.exe
  C:\Windows\System\AeEqXll.exe
  2⤵
  PID:4040
- C:\Windows\System\FIJgFcq.exe
  C:\Windows\System\FIJgFcq.exe
  2⤵
  PID:4056
- C:\Windows\System\OTOlIpV.exe
  C:\Windows\System\OTOlIpV.exe
  2⤵
  PID:4072
- C:\Windows\System\xqxCtnd.exe
  C:\Windows\System\xqxCtnd.exe
  2⤵
  PID:4088
- C:\Windows\System\yAOSWKq.exe
  C:\Windows\System\yAOSWKq.exe
  2⤵
  PID:484
- C:\Windows\System\EaCkzAv.exe
  C:\Windows\System\EaCkzAv.exe
  2⤵
  PID:2232
- C:\Windows\System\wosTZbU.exe
  C:\Windows\System\wosTZbU.exe
  2⤵
  PID:2864
- C:\Windows\System\JTUpeck.exe
  C:\Windows\System\JTUpeck.exe
  2⤵
  PID:1036
- C:\Windows\System\vuhKgGo.exe
  C:\Windows\System\vuhKgGo.exe
  2⤵
  PID:328
- C:\Windows\System\RENihLr.exe
  C:\Windows\System\RENihLr.exe
  2⤵
  PID:3272
- C:\Windows\System\HMRLjCT.exe
  C:\Windows\System\HMRLjCT.exe
  2⤵
  PID:3308
- C:\Windows\System\dsHOPNl.exe
  C:\Windows\System\dsHOPNl.exe
  2⤵
  PID:3372
- C:\Windows\System\ArzuVKZ.exe
  C:\Windows\System\ArzuVKZ.exe
  2⤵
  PID:3032
- C:\Windows\System\YCWSNaO.exe
  C:\Windows\System\YCWSNaO.exe
  2⤵
  PID:1680
- C:\Windows\System\UsTJyZs.exe
  C:\Windows\System\UsTJyZs.exe
  2⤵
  PID:3560
- C:\Windows\System\SaPUVkF.exe
  C:\Windows\System\SaPUVkF.exe
  2⤵
  PID:3624
- C:\Windows\System\UsPTkiK.exe
  C:\Windows\System\UsPTkiK.exe
  2⤵
  PID:3696
- C:\Windows\System\WNkvENc.exe
  C:\Windows\System\WNkvENc.exe
  2⤵
  PID:1712
- C:\Windows\System\laNbicp.exe
  C:\Windows\System\laNbicp.exe
  2⤵
  PID:4104
- C:\Windows\System\exopIRg.exe
  C:\Windows\System\exopIRg.exe
  2⤵
  PID:4120
- C:\Windows\System\VTPcBbR.exe
  C:\Windows\System\VTPcBbR.exe
  2⤵
  PID:4136
- C:\Windows\System\DCeqSkb.exe
  C:\Windows\System\DCeqSkb.exe
  2⤵
  PID:4152
- C:\Windows\System\OWPqSMf.exe
  C:\Windows\System\OWPqSMf.exe
  2⤵
  PID:4168
- C:\Windows\System\QxipIgr.exe
  C:\Windows\System\QxipIgr.exe
  2⤵
  PID:4184
- C:\Windows\System\LTFCXML.exe
  C:\Windows\System\LTFCXML.exe
  2⤵
  PID:4200
- C:\Windows\System\gtNRjjg.exe
  C:\Windows\System\gtNRjjg.exe
  2⤵
  PID:4216
- C:\Windows\System\LBZrlVV.exe
  C:\Windows\System\LBZrlVV.exe
  2⤵
  PID:4232
- C:\Windows\System\MJZValu.exe
  C:\Windows\System\MJZValu.exe
  2⤵
  PID:4248
- C:\Windows\System\VbYlPdg.exe
  C:\Windows\System\VbYlPdg.exe
  2⤵
  PID:4264
- C:\Windows\System\FmZmKnL.exe
  C:\Windows\System\FmZmKnL.exe
  2⤵
  PID:4280
- C:\Windows\System\EYchULL.exe
  C:\Windows\System\EYchULL.exe
  2⤵
  PID:4296
- C:\Windows\System\KHbTUgD.exe
  C:\Windows\System\KHbTUgD.exe
  2⤵
  PID:4312
- C:\Windows\System\EQXkYDU.exe
  C:\Windows\System\EQXkYDU.exe
  2⤵
  PID:4328
- C:\Windows\System\CCzFXmP.exe
  C:\Windows\System\CCzFXmP.exe
  2⤵
  PID:4344
- C:\Windows\System\lbpfqSd.exe
  C:\Windows\System\lbpfqSd.exe
  2⤵
  PID:4360
- C:\Windows\System\goxbjKp.exe
  C:\Windows\System\goxbjKp.exe
  2⤵
  PID:4376
- C:\Windows\System\WYjRsGX.exe
  C:\Windows\System\WYjRsGX.exe
  2⤵
  PID:4392
- C:\Windows\System\aeymQxE.exe
  C:\Windows\System\aeymQxE.exe
  2⤵
  PID:4408
- C:\Windows\System\yllCfpz.exe
  C:\Windows\System\yllCfpz.exe
  2⤵
  PID:4424
- C:\Windows\System\eRoMeWt.exe
  C:\Windows\System\eRoMeWt.exe
  2⤵
  PID:4440
- C:\Windows\System\urpiGzW.exe
  C:\Windows\System\urpiGzW.exe
  2⤵
  PID:4456
- C:\Windows\System\bQdAPOH.exe
  C:\Windows\System\bQdAPOH.exe
  2⤵
  PID:4472
- C:\Windows\System\XJVtVjh.exe
  C:\Windows\System\XJVtVjh.exe
  2⤵
  PID:4488
- C:\Windows\System\DKeJGpz.exe
  C:\Windows\System\DKeJGpz.exe
  2⤵
  PID:4504
- C:\Windows\System\dmYrHLn.exe
  C:\Windows\System\dmYrHLn.exe
  2⤵
  PID:4520
- C:\Windows\System\xXmoiES.exe
  C:\Windows\System\xXmoiES.exe
  2⤵
  PID:4536
- C:\Windows\System\teHecRs.exe
  C:\Windows\System\teHecRs.exe
  2⤵
  PID:4552
- C:\Windows\System\vcTtMgb.exe
  C:\Windows\System\vcTtMgb.exe
  2⤵
  PID:4568
- C:\Windows\System\OyZGtEQ.exe
  C:\Windows\System\OyZGtEQ.exe
  2⤵
  PID:4784
- C:\Windows\System\vXUdssb.exe
  C:\Windows\System\vXUdssb.exe
  2⤵
  PID:4832
- C:\Windows\System\DuJJCWX.exe
  C:\Windows\System\DuJJCWX.exe
  2⤵
  PID:4852
- C:\Windows\System\tWNTZgW.exe
  C:\Windows\System\tWNTZgW.exe
  2⤵
  PID:4868
- C:\Windows\System\zsgzfsB.exe
  C:\Windows\System\zsgzfsB.exe
  2⤵
  PID:4884
- C:\Windows\System\DSseqij.exe
  C:\Windows\System\DSseqij.exe
  2⤵
  PID:4900
- C:\Windows\System\HtKywFF.exe
  C:\Windows\System\HtKywFF.exe
  2⤵
  PID:4916
- C:\Windows\System\LFfrcdl.exe
  C:\Windows\System\LFfrcdl.exe
  2⤵
  PID:4932
- C:\Windows\System\JBQXxgw.exe
  C:\Windows\System\JBQXxgw.exe
  2⤵
  PID:4948
- C:\Windows\System\dgsufTL.exe
  C:\Windows\System\dgsufTL.exe
  2⤵
  PID:4964
- C:\Windows\System\hLeDdgs.exe
  C:\Windows\System\hLeDdgs.exe
  2⤵
  PID:4988
- C:\Windows\System\GHcSgXB.exe
  C:\Windows\System\GHcSgXB.exe
  2⤵
  PID:5016
- C:\Windows\System\GqXCCwY.exe
  C:\Windows\System\GqXCCwY.exe
  2⤵
  PID:5072
- C:\Windows\System\iyOSROH.exe
  C:\Windows\System\iyOSROH.exe
  2⤵
  PID:5092
- C:\Windows\System\QTBesRT.exe
  C:\Windows\System\QTBesRT.exe
  2⤵
  PID:5108
- C:\Windows\System\jbCTBDn.exe
  C:\Windows\System\jbCTBDn.exe
  2⤵
  PID:2476
- C:\Windows\System\AyseGvR.exe
  C:\Windows\System\AyseGvR.exe
  2⤵
  PID:2812
- C:\Windows\System\TZKFOLD.exe
  C:\Windows\System\TZKFOLD.exe
  2⤵
  PID:3752
- C:\Windows\System\QOJMqoE.exe
  C:\Windows\System\QOJMqoE.exe
  2⤵
  PID:3856
- C:\Windows\System\qeGIKrU.exe
  C:\Windows\System\qeGIKrU.exe
  2⤵
  PID:3920
- C:\Windows\System\HFIpCtV.exe
  C:\Windows\System\HFIpCtV.exe
  2⤵
  PID:3984
- C:\Windows\System\NqnsmAv.exe
  C:\Windows\System\NqnsmAv.exe
  2⤵
  PID:4048
- C:\Windows\System\cQqlhfu.exe
  C:\Windows\System\cQqlhfu.exe
  2⤵
  PID:4336
- C:\Windows\System\WHBfRrL.exe
  C:\Windows\System\WHBfRrL.exe
  2⤵
  PID:4240
- C:\Windows\System\GQkApwf.exe
  C:\Windows\System\GQkApwf.exe
  2⤵
  PID:4180
- C:\Windows\System\lvwJrOO.exe
  C:\Windows\System\lvwJrOO.exe
  2⤵
  PID:4148
- C:\Windows\System\PnuEorQ.exe
  C:\Windows\System\PnuEorQ.exe
  2⤵
  PID:3592
- C:\Windows\System\NcFrRya.exe
  C:\Windows\System\NcFrRya.exe
  2⤵
  PID:3244
- C:\Windows\System\jHTOWZX.exe
  C:\Windows\System\jHTOWZX.exe
  2⤵
  PID:1956
- C:\Windows\System\jvoXMVk.exe
  C:\Windows\System\jvoXMVk.exe
  2⤵
  PID:5132
- C:\Windows\System\oCzpkZQ.exe
  C:\Windows\System\oCzpkZQ.exe
  2⤵
  PID:5148
- C:\Windows\System\uRfriOA.exe
  C:\Windows\System\uRfriOA.exe
  2⤵
  PID:5164
- C:\Windows\System\OoKrlfJ.exe
  C:\Windows\System\OoKrlfJ.exe
  2⤵
  PID:5180
- C:\Windows\System\akQXgJA.exe
  C:\Windows\System\akQXgJA.exe
  2⤵
  PID:5260
- C:\Windows\System\jihbgPZ.exe
  C:\Windows\System\jihbgPZ.exe
  2⤵
  PID:5276
- C:\Windows\System\aQteYLp.exe
  C:\Windows\System\aQteYLp.exe
  2⤵
  PID:5292
- C:\Windows\System\CLfaiLq.exe
  C:\Windows\System\CLfaiLq.exe
  2⤵
  PID:5308
- C:\Windows\System\tjJfuHa.exe
  C:\Windows\System\tjJfuHa.exe
  2⤵
  PID:5324
- C:\Windows\System\gowiAoC.exe
  C:\Windows\System\gowiAoC.exe
  2⤵
  PID:5340
- C:\Windows\System\mEVPJQt.exe
  C:\Windows\System\mEVPJQt.exe
  2⤵
  PID:5356
- C:\Windows\System\BCDWilJ.exe
  C:\Windows\System\BCDWilJ.exe
  2⤵
  PID:5372
- C:\Windows\System\mtjIwtL.exe
  C:\Windows\System\mtjIwtL.exe
  2⤵
  PID:5388
- C:\Windows\System\REWNOAq.exe
  C:\Windows\System\REWNOAq.exe
  2⤵
  PID:5404
- C:\Windows\System\GKqELjj.exe
  C:\Windows\System\GKqELjj.exe
  2⤵
  PID:5420
- C:\Windows\System\mlPwpRp.exe
  C:\Windows\System\mlPwpRp.exe
  2⤵
  PID:5436
- C:\Windows\System\mtzxgWI.exe
  C:\Windows\System\mtzxgWI.exe
  2⤵
  PID:5452
- C:\Windows\System\QaSuApG.exe
  C:\Windows\System\QaSuApG.exe
  2⤵
  PID:5468
- C:\Windows\System\vIpZKXs.exe
  C:\Windows\System\vIpZKXs.exe
  2⤵
  PID:5484
- C:\Windows\System\dzebBNM.exe
  C:\Windows\System\dzebBNM.exe
  2⤵
  PID:5500
- C:\Windows\System\xKHTLeV.exe
  C:\Windows\System\xKHTLeV.exe
  2⤵
  PID:5516
- C:\Windows\System\Qigfrec.exe
  C:\Windows\System\Qigfrec.exe
  2⤵
  PID:5532
- C:\Windows\System\pYxgFeV.exe
  C:\Windows\System\pYxgFeV.exe
  2⤵
  PID:5548
- C:\Windows\System\vgyzsJA.exe
  C:\Windows\System\vgyzsJA.exe
  2⤵
  PID:5576
- C:\Windows\System\jxOpMuk.exe
  C:\Windows\System\jxOpMuk.exe
  2⤵
  PID:5592
- C:\Windows\System\wmQiiDP.exe
  C:\Windows\System\wmQiiDP.exe
  2⤵
  PID:5608
- C:\Windows\System\MRBPXGB.exe
  C:\Windows\System\MRBPXGB.exe
  2⤵
  PID:5624
- C:\Windows\System\cNICaLu.exe
  C:\Windows\System\cNICaLu.exe
  2⤵
  PID:5644
- C:\Windows\System\aVClNEA.exe
  C:\Windows\System\aVClNEA.exe
  2⤵
  PID:5660
- C:\Windows\System\aSsdLTM.exe
  C:\Windows\System\aSsdLTM.exe
  2⤵
  PID:5676
- C:\Windows\System\SPRknUa.exe
  C:\Windows\System\SPRknUa.exe
  2⤵
  PID:5692
- C:\Windows\System\hJEjurt.exe
  C:\Windows\System\hJEjurt.exe
  2⤵
  PID:5708
- C:\Windows\System\bBZiglx.exe
  C:\Windows\System\bBZiglx.exe
  2⤵
  PID:5724
- C:\Windows\System\FrSafAp.exe
  C:\Windows\System\FrSafAp.exe
  2⤵
  PID:5740
- C:\Windows\System\yVdvBig.exe
  C:\Windows\System\yVdvBig.exe
  2⤵
  PID:5756
- C:\Windows\System\oxnSImP.exe
  C:\Windows\System\oxnSImP.exe
  2⤵
  PID:5772
- C:\Windows\System\MmDSCdI.exe
  C:\Windows\System\MmDSCdI.exe
  2⤵
  PID:5788
- C:\Windows\System\eOhKWNX.exe
  C:\Windows\System\eOhKWNX.exe
  2⤵
  PID:5804
- C:\Windows\System\tolTPGb.exe
  C:\Windows\System\tolTPGb.exe
  2⤵
  PID:5820
- C:\Windows\System\QhVbQop.exe
  C:\Windows\System\QhVbQop.exe
  2⤵
  PID:5836
- C:\Windows\System\haKOwpy.exe
  C:\Windows\System\haKOwpy.exe
  2⤵
  PID:5852
- C:\Windows\System\jIBTSXd.exe
  C:\Windows\System\jIBTSXd.exe
  2⤵
  PID:5868
- C:\Windows\System\rVCpryo.exe
  C:\Windows\System\rVCpryo.exe
  2⤵
  PID:5884
- C:\Windows\System\VdyEMks.exe
  C:\Windows\System\VdyEMks.exe
  2⤵
  PID:5900
- C:\Windows\System\TygHMMt.exe
  C:\Windows\System\TygHMMt.exe
  2⤵
  PID:5916
- C:\Windows\System\ukRHJis.exe
  C:\Windows\System\ukRHJis.exe
  2⤵
  PID:5932
- C:\Windows\System\SuLSkak.exe
  C:\Windows\System\SuLSkak.exe
  2⤵
  PID:5948
- C:\Windows\System\sFfCHNa.exe
  C:\Windows\System\sFfCHNa.exe
  2⤵
  PID:5964
- C:\Windows\System\eWsOWjG.exe
  C:\Windows\System\eWsOWjG.exe
  2⤵
  PID:5980
- C:\Windows\System\NtmmEvj.exe
  C:\Windows\System\NtmmEvj.exe
  2⤵
  PID:5996
- C:\Windows\System\DaWnXJL.exe
  C:\Windows\System\DaWnXJL.exe
  2⤵
  PID:6012
- C:\Windows\System\BfKoAVp.exe
  C:\Windows\System\BfKoAVp.exe
  2⤵
  PID:6028
- C:\Windows\System\ENCoYcJ.exe
  C:\Windows\System\ENCoYcJ.exe
  2⤵
  PID:6044
- C:\Windows\System\RckAgVc.exe
  C:\Windows\System\RckAgVc.exe
  2⤵
  PID:6060
- C:\Windows\System\IoMwFsY.exe
  C:\Windows\System\IoMwFsY.exe
  2⤵
  PID:6076
- C:\Windows\System\mvJeLUV.exe
  C:\Windows\System\mvJeLUV.exe
  2⤵
  PID:6092
- C:\Windows\System\mkqTXNb.exe
  C:\Windows\System\mkqTXNb.exe
  2⤵
  PID:6108
- C:\Windows\System\smCuojx.exe
  C:\Windows\System\smCuojx.exe
  2⤵
  PID:6124
- C:\Windows\System\tclrRTD.exe
  C:\Windows\System\tclrRTD.exe
  2⤵
  PID:6140
- C:\Windows\System\DXnJNlh.exe
  C:\Windows\System\DXnJNlh.exe
  2⤵
  PID:4824
- C:\Windows\System\MDGcFEu.exe
  C:\Windows\System\MDGcFEu.exe
  2⤵
  PID:4896
- C:\Windows\System\ECeTeKm.exe
  C:\Windows\System\ECeTeKm.exe
  2⤵
  PID:4960
- C:\Windows\System\pdlvCcP.exe
  C:\Windows\System\pdlvCcP.exe
  2⤵
  PID:5080
- C:\Windows\System\cyjybyu.exe
  C:\Windows\System\cyjybyu.exe
  2⤵
  PID:1440
- C:\Windows\System\rvEPefF.exe
  C:\Windows\System\rvEPefF.exe
  2⤵
  PID:4016
- C:\Windows\System\wiZlQgN.exe
  C:\Windows\System\wiZlQgN.exe
  2⤵
  PID:4116
- C:\Windows\System\JpjzHvY.exe
  C:\Windows\System\JpjzHvY.exe
  2⤵
  PID:1548
- C:\Windows\System\waCPtoM.exe
  C:\Windows\System\waCPtoM.exe
  2⤵
  PID:5156
- C:\Windows\System\lkDpcUV.exe
  C:\Windows\System\lkDpcUV.exe
  2⤵
  PID:5196
- C:\Windows\System\zBQVLnS.exe
  C:\Windows\System\zBQVLnS.exe
  2⤵
  PID:5216
- C:\Windows\System\jhARvRV.exe
  C:\Windows\System\jhARvRV.exe
  2⤵
  PID:5232
- C:\Windows\System\zLuQMms.exe
  C:\Windows\System\zLuQMms.exe
  2⤵
  PID:2168
- C:\Windows\System\UenyYfl.exe
  C:\Windows\System\UenyYfl.exe
  2⤵
  PID:760
- C:\Windows\System\PsUtOVA.exe
  C:\Windows\System\PsUtOVA.exe
  2⤵
  PID:1788
- C:\Windows\System\svIpvaZ.exe
  C:\Windows\System\svIpvaZ.exe
  2⤵
  PID:4192
- C:\Windows\System\YDCkpnH.exe
  C:\Windows\System\YDCkpnH.exe
  2⤵
  PID:4128
- C:\Windows\System\PMygtGo.exe
  C:\Windows\System\PMygtGo.exe
  2⤵
  PID:3692
- C:\Windows\System\pYSsTpA.exe
  C:\Windows\System\pYSsTpA.exe
  2⤵
  PID:3488
- C:\Windows\System\ESSWGEs.exe
  C:\Windows\System\ESSWGEs.exe
  2⤵
  PID:1464
- C:\Windows\System\NIKYlgT.exe
  C:\Windows\System\NIKYlgT.exe
  2⤵
  PID:3808
- C:\Windows\System\kieewZV.exe
  C:\Windows\System\kieewZV.exe
  2⤵
  PID:3940
- C:\Windows\System\FPfquEp.exe
  C:\Windows\System\FPfquEp.exe
  2⤵
  PID:4068
- C:\Windows\System\bZvLIEv.exe
  C:\Windows\System\bZvLIEv.exe
  2⤵
  PID:1668
- C:\Windows\System\anHSUjb.exe
  C:\Windows\System\anHSUjb.exe
  2⤵
  PID:2532
- C:\Windows\System\cmzSnMM.exe
  C:\Windows\System\cmzSnMM.exe
  2⤵
  PID:2344
- C:\Windows\System\KADPzYd.exe
  C:\Windows\System\KADPzYd.exe
  2⤵
  PID:2728
- C:\Windows\System\Ppicuzg.exe
  C:\Windows\System\Ppicuzg.exe
  2⤵
  PID:3228
- C:\Windows\System\KjFyhGk.exe
  C:\Windows\System\KjFyhGk.exe
  2⤵
  PID:3356
- C:\Windows\System\qOcAGyE.exe
  C:\Windows\System\qOcAGyE.exe
  2⤵
  PID:3576
- C:\Windows\System\QVpJIhv.exe
  C:\Windows\System\QVpJIhv.exe
  2⤵
  PID:556
- C:\Windows\System\JGVjdPm.exe
  C:\Windows\System\JGVjdPm.exe
  2⤵
  PID:1984
- C:\Windows\System\XyhgVGy.exe
  C:\Windows\System\XyhgVGy.exe
  2⤵
  PID:4368
- C:\Windows\System\UfqnDlU.exe
  C:\Windows\System\UfqnDlU.exe
  2⤵
  PID:4436
- C:\Windows\System\zcSrBQB.exe
  C:\Windows\System\zcSrBQB.exe
  2⤵
  PID:1804
- C:\Windows\System\ACqGrAd.exe
  C:\Windows\System\ACqGrAd.exe
  2⤵
  PID:316
- C:\Windows\System\UNgkJdW.exe
  C:\Windows\System\UNgkJdW.exe
  2⤵
  PID:3804
- C:\Windows\System\ppykZds.exe
  C:\Windows\System\ppykZds.exe
  2⤵
  PID:3604
- C:\Windows\System\NGrRscJ.exe
  C:\Windows\System\NGrRscJ.exe
  2⤵
  PID:3464
- C:\Windows\System\YnvKKNP.exe
  C:\Windows\System\YnvKKNP.exe
  2⤵
  PID:3256
- C:\Windows\System\aKGhtfZ.exe
  C:\Windows\System\aKGhtfZ.exe
  2⤵
  PID:2624
- C:\Windows\System\AdaAFFH.exe
  C:\Windows\System\AdaAFFH.exe
  2⤵
  PID:2512
- C:\Windows\System\LhAQTzi.exe
  C:\Windows\System\LhAQTzi.exe
  2⤵
  PID:1904
- C:\Windows\System\ecvZjvv.exe
  C:\Windows\System\ecvZjvv.exe
  2⤵
  PID:4688
- C:\Windows\System\rnGtnOf.exe
  C:\Windows\System\rnGtnOf.exe
  2⤵
  PID:4704
- C:\Windows\System\cISlsNI.exe
  C:\Windows\System\cISlsNI.exe
  2⤵
  PID:4724
- C:\Windows\System\YodYjdF.exe
  C:\Windows\System\YodYjdF.exe
  2⤵
  PID:4744
- C:\Windows\System\hQtYHZJ.exe
  C:\Windows\System\hQtYHZJ.exe
  2⤵
  PID:4760
- C:\Windows\System\aUmotzs.exe
  C:\Windows\System\aUmotzs.exe
  2⤵
  PID:4776
- C:\Windows\System\QoxetDQ.exe
  C:\Windows\System\QoxetDQ.exe
  2⤵
  PID:5032
- C:\Windows\System\OGzVnih.exe
  C:\Windows\System\OGzVnih.exe
  2⤵
  PID:5104
- C:\Windows\System\bqDaiyn.exe
  C:\Windows\System\bqDaiyn.exe
  2⤵
  PID:3148
- C:\Windows\System\hTBKZpZ.exe
  C:\Windows\System\hTBKZpZ.exe
  2⤵
  PID:4808
- C:\Windows\System\esMBCAd.exe
  C:\Windows\System\esMBCAd.exe
  2⤵
  PID:5144
- C:\Windows\System\yRFSwaK.exe
  C:\Windows\System\yRFSwaK.exe
  2⤵
  PID:5572
- C:\Windows\System\iqJQxdw.exe
  C:\Windows\System\iqJQxdw.exe
  2⤵
  PID:5556
- C:\Windows\System\LHhqFEU.exe
  C:\Windows\System\LHhqFEU.exe
  2⤵
  PID:5428
- C:\Windows\System\YymnLQd.exe
  C:\Windows\System\YymnLQd.exe
  2⤵
  PID:5364
- C:\Windows\System\MzPtAkp.exe
  C:\Windows\System\MzPtAkp.exe
  2⤵
  PID:5304
- C:\Windows\System\upkIgVn.exe
  C:\Windows\System\upkIgVn.exe
  2⤵
  PID:4288
- C:\Windows\System\QxOnsEH.exe
  C:\Windows\System\QxOnsEH.exe
  2⤵
  PID:3640
- C:\Windows\System\VwvdWqn.exe
  C:\Windows\System\VwvdWqn.exe
  2⤵
  PID:2568
- C:\Windows\System\WzouJHO.exe
  C:\Windows\System\WzouJHO.exe
  2⤵
  PID:4036
- C:\Windows\System\EkwzRKN.exe
  C:\Windows\System\EkwzRKN.exe
  2⤵
  PID:5244
- C:\Windows\System\kNVdPnW.exe
  C:\Windows\System\kNVdPnW.exe
  2⤵
  PID:5124
- C:\Windows\System\RHItXEJ.exe
  C:\Windows\System\RHItXEJ.exe
  2⤵
  PID:5116
- C:\Windows\System\FerHVLx.exe
  C:\Windows\System\FerHVLx.exe
  2⤵
  PID:820
- C:\Windows\System\jOmLJlA.exe
  C:\Windows\System\jOmLJlA.exe
  2⤵
  PID:6056
- C:\Windows\System\ROPohdP.exe
  C:\Windows\System\ROPohdP.exe
  2⤵
  PID:5992
- C:\Windows\System\cwamyiN.exe
  C:\Windows\System\cwamyiN.exe
  2⤵
  PID:5928
- C:\Windows\System\JsszjEN.exe
  C:\Windows\System\JsszjEN.exe
  2⤵
  PID:5864
- C:\Windows\System\WIWEkhy.exe
  C:\Windows\System\WIWEkhy.exe
  2⤵
  PID:5800
- C:\Windows\System\zboxPme.exe
  C:\Windows\System\zboxPme.exe
  2⤵
  PID:5736
- C:\Windows\System\uvWwJlQ.exe
  C:\Windows\System\uvWwJlQ.exe
  2⤵
  PID:5672
- C:\Windows\System\mBovaZa.exe
  C:\Windows\System\mBovaZa.exe
  2⤵
  PID:5780
- C:\Windows\System\ksYoNKJ.exe
  C:\Windows\System\ksYoNKJ.exe
  2⤵
  PID:5912
- C:\Windows\System\urZkbXN.exe
  C:\Windows\System\urZkbXN.exe
  2⤵
  PID:5448
- C:\Windows\System\bjCxmPn.exe
  C:\Windows\System\bjCxmPn.exe
  2⤵
  PID:3908
- C:\Windows\System\DScriZK.exe
  C:\Windows\System\DScriZK.exe
  2⤵
  PID:804
- C:\Windows\System\ADfJRuy.exe
  C:\Windows\System\ADfJRuy.exe
  2⤵
  PID:4292
- C:\Windows\System\zuTWqhx.exe
  C:\Windows\System\zuTWqhx.exe
  2⤵
  PID:6132
- C:\Windows\System\zIQdGEK.exe
  C:\Windows\System\zIQdGEK.exe
  2⤵
  PID:5652
- C:\Windows\System\cPKRNVY.exe
  C:\Windows\System\cPKRNVY.exe
  2⤵
  PID:5716
- C:\Windows\System\ovebYaR.exe
  C:\Windows\System\ovebYaR.exe
  2⤵
  PID:4512
- C:\Windows\System\TTgkgJs.exe
  C:\Windows\System\TTgkgJs.exe
  2⤵
  PID:5848
- C:\Windows\System\HMrfDoh.exe
  C:\Windows\System\HMrfDoh.exe
  2⤵
  PID:6072
- C:\Windows\System\rOgCOeI.exe
  C:\Windows\System\rOgCOeI.exe
  2⤵
  PID:6136
- C:\Windows\System\lbIvfLH.exe
  C:\Windows\System\lbIvfLH.exe
  2⤵
  PID:5004
- C:\Windows\System\EKZPGiD.exe
  C:\Windows\System\EKZPGiD.exe
  2⤵
  PID:1208
- C:\Windows\System\NjrawMc.exe
  C:\Windows\System\NjrawMc.exe
  2⤵
  PID:4448
- C:\Windows\System\DDRRNAI.exe
  C:\Windows\System\DDRRNAI.exe
  2⤵
  PID:4384
- C:\Windows\System\KlgsyoD.exe
  C:\Windows\System\KlgsyoD.exe
  2⤵
  PID:2332
- C:\Windows\System\bzMaDRw.exe
  C:\Windows\System\bzMaDRw.exe
  2⤵
  PID:1572
- C:\Windows\System\wCjRnDv.exe
  C:\Windows\System\wCjRnDv.exe
  2⤵
  PID:3876
- C:\Windows\System\ffTfpPS.exe
  C:\Windows\System\ffTfpPS.exe
  2⤵
  PID:3116
- C:\Windows\System\dLAYEvU.exe
  C:\Windows\System\dLAYEvU.exe
  2⤵
  PID:5416
- C:\Windows\System\WRTezSK.exe
  C:\Windows\System\WRTezSK.exe
  2⤵
  PID:4516
- C:\Windows\System\YhWTakl.exe
  C:\Windows\System\YhWTakl.exe
  2⤵
  PID:4848
- C:\Windows\System\qpslEBP.exe
  C:\Windows\System\qpslEBP.exe
  2⤵
  PID:4912
- C:\Windows\System\obkjuIg.exe
  C:\Windows\System\obkjuIg.exe
  2⤵
  PID:4976
- C:\Windows\System\elDSxCT.exe
  C:\Windows\System\elDSxCT.exe
  2⤵
  PID:3956
- C:\Windows\System\UDIkJuC.exe
  C:\Windows\System\UDIkJuC.exe
  2⤵
  PID:3340
- C:\Windows\System\uIhjpjQ.exe
  C:\Windows\System\uIhjpjQ.exe
  2⤵
  PID:3788
- C:\Windows\System\RwUeArQ.exe
  C:\Windows\System\RwUeArQ.exe
  2⤵
  PID:4844
- C:\Windows\System\pduzVkL.exe
  C:\Windows\System\pduzVkL.exe
  2⤵
  PID:3176
- C:\Windows\System\ztxkgrb.exe
  C:\Windows\System\ztxkgrb.exe
  2⤵
  PID:2656
- C:\Windows\System\rpDLpWG.exe
  C:\Windows\System\rpDLpWG.exe
  2⤵
  PID:4804
- C:\Windows\System\QKqUyBn.exe
  C:\Windows\System\QKqUyBn.exe
  2⤵
  PID:2524
- C:\Windows\System\FdzrxBK.exe
  C:\Windows\System\FdzrxBK.exe
  2⤵
  PID:4528
- C:\Windows\System\EfkriBm.exe
  C:\Windows\System\EfkriBm.exe
  2⤵
  PID:1428
- C:\Windows\System\ODmfGUp.exe
  C:\Windows\System\ODmfGUp.exe
  2⤵
  PID:2348
- C:\Windows\System\bsXEsuf.exe
  C:\Windows\System\bsXEsuf.exe
  2⤵
  PID:2384
- C:\Windows\System\HEUDurn.exe
  C:\Windows\System\HEUDurn.exe
  2⤵
  PID:2116
- C:\Windows\System\TScejoG.exe
  C:\Windows\System\TScejoG.exe
  2⤵
  PID:444
- C:\Windows\System\cvtwdhY.exe
  C:\Windows\System\cvtwdhY.exe
  2⤵
  PID:3288
- C:\Windows\System\hVcBQtx.exe
  C:\Windows\System\hVcBQtx.exe
  2⤵
  PID:1740
- C:\Windows\System\wuMXDTH.exe
  C:\Windows\System\wuMXDTH.exe
  2⤵
  PID:668
- C:\Windows\System\QQyAQpb.exe
  C:\Windows\System\QQyAQpb.exe
  2⤵
  PID:3160
- C:\Windows\System\UvdVmNt.exe
  C:\Windows\System\UvdVmNt.exe
  2⤵
  PID:1480
- C:\Windows\System\rlNaQvj.exe
  C:\Windows\System\rlNaQvj.exe
  2⤵
  PID:4600
- C:\Windows\System\dJGvsqz.exe
  C:\Windows\System\dJGvsqz.exe
  2⤵
  PID:4620
- C:\Windows\System\equYLtS.exe
  C:\Windows\System\equYLtS.exe
  2⤵
  PID:2672
- C:\Windows\System\yGRrPpF.exe
  C:\Windows\System\yGRrPpF.exe
  2⤵
  PID:2752
- C:\Windows\System\xwCPsCZ.exe
  C:\Windows\System\xwCPsCZ.exe
  2⤵
  PID:2576
- C:\Windows\System\hvrKWuL.exe
  C:\Windows\System\hvrKWuL.exe
  2⤵
  PID:3936
- C:\Windows\System\sblioeW.exe
  C:\Windows\System\sblioeW.exe
  2⤵
  PID:1088
- C:\Windows\System\oZTKNIk.exe
  C:\Windows\System\oZTKNIk.exe
  2⤵
  PID:4648
- C:\Windows\System\htElKGc.exe
  C:\Windows\System\htElKGc.exe
  2⤵
  PID:4672
- C:\Windows\System\FlMAcAc.exe
  C:\Windows\System\FlMAcAc.exe
  2⤵
  PID:4720
- C:\Windows\System\RLqEWSI.exe
  C:\Windows\System\RLqEWSI.exe
  2⤵
  PID:5028
- C:\Windows\System\otSQUen.exe
  C:\Windows\System\otSQUen.exe
  2⤵
  PID:4700
- C:\Windows\System\EkRxfXg.exe
  C:\Windows\System\EkRxfXg.exe
  2⤵
  PID:5040
- C:\Windows\System\whabLSu.exe
  C:\Windows\System\whabLSu.exe
  2⤵
  PID:4356
- C:\Windows\System\unBYdae.exe
  C:\Windows\System\unBYdae.exe
  2⤵
  PID:2912
- C:\Windows\System\GldZtfw.exe
  C:\Windows\System\GldZtfw.exe
  2⤵
  PID:2736
- C:\Windows\System\GnNWTux.exe
  C:\Windows\System\GnNWTux.exe
  2⤵
  PID:572
- C:\Windows\System\KBULYnk.exe
  C:\Windows\System\KBULYnk.exe
  2⤵
  PID:1032
- C:\Windows\System\KTEEijR.exe
  C:\Windows\System\KTEEijR.exe
  2⤵
  PID:5640
- C:\Windows\System\bBLrGSa.exe
  C:\Windows\System\bBLrGSa.exe
  2⤵
  PID:5560
- C:\Windows\System\KJqdmAQ.exe
  C:\Windows\System\KJqdmAQ.exe
  2⤵
  PID:5632
- C:\Windows\System\zzkVSKL.exe
  C:\Windows\System\zzkVSKL.exe
  2⤵
  PID:5332
- C:\Windows\System\HWiTarx.exe
  C:\Windows\System\HWiTarx.exe
  2⤵
  PID:560
- C:\Windows\System\XCDUhhf.exe
  C:\Windows\System\XCDUhhf.exe
  2⤵
  PID:5368
- C:\Windows\System\iTNSsQF.exe
  C:\Windows\System\iTNSsQF.exe
  2⤵
  PID:3556
- C:\Windows\System\LUmrlCe.exe
  C:\Windows\System\LUmrlCe.exe
  2⤵
  PID:3292
- C:\Windows\System\icCMRob.exe
  C:\Windows\System\icCMRob.exe
  2⤵
  PID:1708
- C:\Windows\System\mbSWzXm.exe
  C:\Windows\System\mbSWzXm.exe
  2⤵
  PID:5128
- C:\Windows\System\MjZPJkd.exe
  C:\Windows\System\MjZPJkd.exe
  2⤵
  PID:6020
- C:\Windows\System\ANvyxDW.exe
  C:\Windows\System\ANvyxDW.exe
  2⤵
  PID:5764
- C:\Windows\System\rRNbUjC.exe
  C:\Windows\System\rRNbUjC.exe
  2⤵
  PID:6004
- C:\Windows\System\azMAOlH.exe
  C:\Windows\System\azMAOlH.exe
  2⤵
  PID:4480
- C:\Windows\System\NYlPukh.exe
  C:\Windows\System\NYlPukh.exe
  2⤵
  PID:4892
- C:\Windows\System\mDxUfMe.exe
  C:\Windows\System\mDxUfMe.exe
  2⤵
  PID:2492
- C:\Windows\System\gAvQybu.exe
  C:\Windows\System\gAvQybu.exe
  2⤵
  PID:5828
- C:\Windows\System\ueHAHiw.exe
  C:\Windows\System\ueHAHiw.exe
  2⤵
  PID:5512
- C:\Windows\System\lCZSchl.exe
  C:\Windows\System\lCZSchl.exe
  2⤵
  PID:2372
- C:\Windows\System\THyUumT.exe
  C:\Windows\System\THyUumT.exe
  2⤵
  PID:5876
- C:\Windows\System\MDAiakK.exe
  C:\Windows\System\MDAiakK.exe
  2⤵
  PID:6100
- C:\Windows\System\ACPcICi.exe
  C:\Windows\System\ACPcICi.exe
  2⤵
  PID:2136
- C:\Windows\System\nHDyrkB.exe
  C:\Windows\System\nHDyrkB.exe
  2⤵
  PID:4416
- C:\Windows\System\KJnPPuh.exe
  C:\Windows\System\KJnPPuh.exe
  2⤵
  PID:6088
- C:\Windows\System\MnRzJRj.exe
  C:\Windows\System\MnRzJRj.exe
  2⤵
  PID:5700
- C:\Windows\System\xTaNgbP.exe
  C:\Windows\System\xTaNgbP.exe
  2⤵
  PID:2160
- C:\Windows\System\oPgLXnS.exe
  C:\Windows\System\oPgLXnS.exe
  2⤵
  PID:4576
- C:\Windows\System\mImJCon.exe
  C:\Windows\System\mImJCon.exe
  2⤵
  PID:5048
- C:\Windows\System\AwwcTIU.exe
  C:\Windows\System\AwwcTIU.exe
  2⤵
  PID:2224
- C:\Windows\System\QrtYoPk.exe
  C:\Windows\System\QrtYoPk.exe
  2⤵
  PID:4612
- C:\Windows\System\kCRTfHG.exe
  C:\Windows\System\kCRTfHG.exe
  2⤵
  PID:5316
- C:\Windows\System\BSFdPGl.exe
  C:\Windows\System\BSFdPGl.exe
  2⤵
  PID:5320
- C:\Windows\System\MBTsInA.exe
  C:\Windows\System\MBTsInA.exe
  2⤵
  PID:2152
- C:\Windows\System\OJaHPYj.exe
  C:\Windows\System\OJaHPYj.exe
  2⤵
  PID:3508
- C:\Windows\System\XKShYLu.exe
  C:\Windows\System\XKShYLu.exe
  2⤵
  PID:860
- C:\Windows\System\unbbJXH.exe
  C:\Windows\System\unbbJXH.exe
  2⤵
  PID:5384
- C:\Windows\System\hREBzZI.exe
  C:\Windows\System\hREBzZI.exe
  2⤵
  PID:4452
- C:\Windows\System\dkCqMiw.exe
  C:\Windows\System\dkCqMiw.exe
  2⤵
  PID:4080
- C:\Windows\System\rIpGKyC.exe
  C:\Windows\System\rIpGKyC.exe
  2⤵
  PID:2652
- C:\Windows\System\ZyLCcjG.exe
  C:\Windows\System\ZyLCcjG.exe
  2⤵
  PID:1128
- C:\Windows\System\VoQDmgV.exe
  C:\Windows\System\VoQDmgV.exe
  2⤵
  PID:3636
- C:\Windows\System\BJSgPWI.exe
  C:\Windows\System\BJSgPWI.exe
  2⤵
  PID:1408
- C:\Windows\System\zKTbINQ.exe
  C:\Windows\System\zKTbINQ.exe
  2⤵
  PID:4616
- C:\Windows\System\WlqCGHl.exe
  C:\Windows\System\WlqCGHl.exe
  2⤵
  PID:4496
- C:\Windows\System\xyddBOp.exe
  C:\Windows\System\xyddBOp.exe
  2⤵
  PID:4404
- C:\Windows\System\njAfarf.exe
  C:\Windows\System\njAfarf.exe
  2⤵
  PID:1796
- C:\Windows\System\LNPesgA.exe
  C:\Windows\System\LNPesgA.exe
  2⤵
  PID:1544
- C:\Windows\System\AkxAKBi.exe
  C:\Windows\System\AkxAKBi.exe
  2⤵
  PID:2696
- C:\Windows\System\DDRyzpp.exe
  C:\Windows\System\DDRyzpp.exe
  2⤵
  PID:4636
- C:\Windows\System\GxPbggW.exe
  C:\Windows\System\GxPbggW.exe
  2⤵
  PID:4696
- C:\Windows\System\RMdxILY.exe
  C:\Windows\System\RMdxILY.exe
  2⤵
  PID:2044
- C:\Windows\System\JJjqZuc.exe
  C:\Windows\System\JJjqZuc.exe
  2⤵
  PID:4740
- C:\Windows\System\fzxmRXc.exe
  C:\Windows\System\fzxmRXc.exe
  2⤵
  PID:1372
- C:\Windows\System\qqfFAkp.exe
  C:\Windows\System\qqfFAkp.exe
  2⤵
  PID:5024
- C:\Windows\System\suTrXdK.exe
  C:\Windows\System\suTrXdK.exe
  2⤵
  PID:2964
- C:\Windows\System\LHdSoCl.exe
  C:\Windows\System\LHdSoCl.exe
  2⤵
  PID:5176
- C:\Windows\System\kbMXeOC.exe
  C:\Windows\System\kbMXeOC.exe
  2⤵
  PID:5432
- C:\Windows\System\RZWfMny.exe
  C:\Windows\System\RZWfMny.exe
  2⤵
  PID:5212
- C:\Windows\System\zIKjHJc.exe
  C:\Windows\System\zIKjHJc.exe
  2⤵
  PID:5768
- C:\Windows\System\FlZGyOC.exe
  C:\Windows\System\FlZGyOC.exe
  2⤵
  PID:5972
- C:\Windows\System\cdhpmlh.exe
  C:\Windows\System\cdhpmlh.exe
  2⤵
  PID:3776
- C:\Windows\System\gIQCVHH.exe
  C:\Windows\System\gIQCVHH.exe
  2⤵
  PID:6024
- C:\Windows\System\VXsqBNK.exe
  C:\Windows\System\VXsqBNK.exe
  2⤵
  PID:5748
- C:\Windows\System\yBlsQNm.exe
  C:\Windows\System\yBlsQNm.exe
  2⤵
  PID:3240
- C:\Windows\System\ZraBlgU.exe
  C:\Windows\System\ZraBlgU.exe
  2⤵
  PID:4260
- C:\Windows\System\IRZjThZ.exe
  C:\Windows\System\IRZjThZ.exe
  2⤵
  PID:4940
- C:\Windows\System\lNiGBHQ.exe
  C:\Windows\System\lNiGBHQ.exe
  2⤵
  PID:3892
- C:\Windows\System\fjekeSG.exe
  C:\Windows\System\fjekeSG.exe
  2⤵
  PID:5960
- C:\Windows\System\ArMskvX.exe
  C:\Windows\System\ArMskvX.exe
  2⤵
  PID:2852
- C:\Windows\System\wsjteKg.exe
  C:\Windows\System\wsjteKg.exe
  2⤵
  PID:4792
- C:\Windows\System\IrHIUQG.exe
  C:\Windows\System\IrHIUQG.exe
  2⤵
  PID:1328
- C:\Windows\System\TbmzzQz.exe
  C:\Windows\System\TbmzzQz.exe
  2⤵
  PID:3196
- C:\Windows\System\zsLvEbR.exe
  C:\Windows\System\zsLvEbR.exe
  2⤵
  PID:1828
- C:\Windows\System\iSdpiGd.exe
  C:\Windows\System\iSdpiGd.exe
  2⤵
  PID:2828
- C:\Windows\System\khZjouF.exe
  C:\Windows\System\khZjouF.exe
  2⤵
  PID:4560
- C:\Windows\System\nwUuuMZ.exe
  C:\Windows\System\nwUuuMZ.exe
  2⤵
  PID:5720
- C:\Windows\System\PdNKNyd.exe
  C:\Windows\System\PdNKNyd.exe
  2⤵
  PID:3968
- C:\Windows\System\JShGwgR.exe
  C:\Windows\System\JShGwgR.exe
  2⤵
  PID:4716
- C:\Windows\System\hWaxivw.exe
  C:\Windows\System\hWaxivw.exe
  2⤵
  PID:756
- C:\Windows\System\eOrvqXo.exe
  C:\Windows\System\eOrvqXo.exe
  2⤵
  PID:3872
- C:\Windows\System\rYiyUTu.exe
  C:\Windows\System\rYiyUTu.exe
  2⤵
  PID:2380
- C:\Windows\System\UZMAOSW.exe
  C:\Windows\System\UZMAOSW.exe
  2⤵
  PID:1504
- C:\Windows\System\BOrIZis.exe
  C:\Windows\System\BOrIZis.exe
  2⤵
  PID:2368
- C:\Windows\System\efEadOL.exe
  C:\Windows\System\efEadOL.exe
  2⤵
  PID:5272
- C:\Windows\System\gXHmtZg.exe
  C:\Windows\System\gXHmtZg.exe
  2⤵
  PID:4772
- C:\Windows\System\AMggiUI.exe
  C:\Windows\System\AMggiUI.exe
  2⤵
  PID:4796
- C:\Windows\System\cgWxDIf.exe
  C:\Windows\System\cgWxDIf.exe
  2⤵
  PID:4880
- C:\Windows\System\SodmGCf.exe
  C:\Windows\System\SodmGCf.exe
  2⤵
  PID:5288
- C:\Windows\System\pZNhVEo.exe
  C:\Windows\System\pZNhVEo.exe
  2⤵
  PID:5380
- C:\Windows\System\FwnWMDR.exe
  C:\Windows\System\FwnWMDR.exe
  2⤵
  PID:3540
- C:\Windows\System\RwJijbz.exe
  C:\Windows\System\RwJijbz.exe
  2⤵
  PID:2036
- C:\Windows\System\FoNKroI.exe
  C:\Windows\System\FoNKroI.exe
  2⤵
  PID:2292
- C:\Windows\System\oPFrspm.exe
  C:\Windows\System\oPFrspm.exe
  2⤵
  PID:3504
- C:\Windows\System\uhWpFXP.exe
  C:\Windows\System\uhWpFXP.exe
  2⤵
  PID:1412
- C:\Windows\System\WPpFaMG.exe
  C:\Windows\System\WPpFaMG.exe
  2⤵
  PID:2388
- C:\Windows\System\deFRkcX.exe
  C:\Windows\System\deFRkcX.exe
  2⤵
  PID:5352
- C:\Windows\System\cdVeshb.exe
  C:\Windows\System\cdVeshb.exe
  2⤵
  PID:5604
- C:\Windows\System\EBpcSsy.exe
  C:\Windows\System\EBpcSsy.exe
  2⤵
  PID:2704
- C:\Windows\System\ClRlpul.exe
  C:\Windows\System\ClRlpul.exe
  2⤵
  PID:5688
- C:\Windows\System\SVDENvx.exe
  C:\Windows\System\SVDENvx.exe
  2⤵
  PID:5252
- C:\Windows\System\aulhfxd.exe
  C:\Windows\System\aulhfxd.exe
  2⤵
  PID:5284
- C:\Windows\System\wMKsxFW.exe
  C:\Windows\System\wMKsxFW.exe
  2⤵
  PID:3044
- C:\Windows\System\RwLYgHk.exe
  C:\Windows\System\RwLYgHk.exe
  2⤵
  PID:1660
- C:\Windows\System\sbwwijd.exe
  C:\Windows\System\sbwwijd.exe
  2⤵
  PID:4756
- C:\Windows\System\xqrJBNW.exe
  C:\Windows\System\xqrJBNW.exe
  2⤵
  PID:1164
- C:\Windows\System\lHARGQy.exe
  C:\Windows\System\lHARGQy.exe
  2⤵
  PID:6148
- C:\Windows\System\mRYwmBR.exe
  C:\Windows\System\mRYwmBR.exe
  2⤵
  PID:6168
- C:\Windows\System\vgHdmhC.exe
  C:\Windows\System\vgHdmhC.exe
  2⤵
  PID:6184
- C:\Windows\System\sKWCIfH.exe
  C:\Windows\System\sKWCIfH.exe
  2⤵
  PID:6200
- C:\Windows\System\rlTMSil.exe
  C:\Windows\System\rlTMSil.exe
  2⤵
  PID:6220
- C:\Windows\System\qcKiwSe.exe
  C:\Windows\System\qcKiwSe.exe
  2⤵
  PID:6236
- C:\Windows\System\faqHLPs.exe
  C:\Windows\System\faqHLPs.exe
  2⤵
  PID:6252
- C:\Windows\System\zkkFfKe.exe
  C:\Windows\System\zkkFfKe.exe
  2⤵
  PID:6268
- C:\Windows\System\SoMblxk.exe
  C:\Windows\System\SoMblxk.exe
  2⤵
  PID:6284
- C:\Windows\System\lvGWWIh.exe
  C:\Windows\System\lvGWWIh.exe
  2⤵
  PID:6300
- C:\Windows\System\HzrHwBb.exe
  C:\Windows\System\HzrHwBb.exe
  2⤵
  PID:6316
- C:\Windows\System\sGypBwb.exe
  C:\Windows\System\sGypBwb.exe
  2⤵
  PID:6336
- C:\Windows\System\OttqJtJ.exe
  C:\Windows\System\OttqJtJ.exe
  2⤵
  PID:6352
- C:\Windows\System\OrpTCSM.exe
  C:\Windows\System\OrpTCSM.exe
  2⤵
  PID:6368
- C:\Windows\System\mLnAacp.exe
  C:\Windows\System\mLnAacp.exe
  2⤵
  PID:6384
- C:\Windows\System\FvRLPMd.exe
  C:\Windows\System\FvRLPMd.exe
  2⤵
  PID:6404
- C:\Windows\System\FFJiEmu.exe
  C:\Windows\System\FFJiEmu.exe
  2⤵
  PID:6420
- C:\Windows\System\KmEYHrk.exe
  C:\Windows\System\KmEYHrk.exe
  2⤵
  PID:6436
- C:\Windows\System\lxPHqDQ.exe
  C:\Windows\System\lxPHqDQ.exe
  2⤵
  PID:6452
- C:\Windows\System\mlMaasV.exe
  C:\Windows\System\mlMaasV.exe
  2⤵
  PID:6472
- C:\Windows\System\WsENUTa.exe
  C:\Windows\System\WsENUTa.exe
  2⤵
  PID:6488
- C:\Windows\System\ajKLtyN.exe
  C:\Windows\System\ajKLtyN.exe
  2⤵
  PID:6504
- C:\Windows\System\zgswKTD.exe
  C:\Windows\System\zgswKTD.exe
  2⤵
  PID:6520
- C:\Windows\System\OvwvHIw.exe
  C:\Windows\System\OvwvHIw.exe
  2⤵
  PID:6536
- C:\Windows\System\KxstAxd.exe
  C:\Windows\System\KxstAxd.exe
  2⤵
  PID:6552
- C:\Windows\System\oGXqHVq.exe
  C:\Windows\System\oGXqHVq.exe
  2⤵
  PID:6568
- C:\Windows\System\CTDzqSI.exe
  C:\Windows\System\CTDzqSI.exe
  2⤵
  PID:6584
- C:\Windows\System\iqEAlDM.exe
  C:\Windows\System\iqEAlDM.exe
  2⤵
  PID:6600
- C:\Windows\System\BQkkSaw.exe
  C:\Windows\System\BQkkSaw.exe
  2⤵
  PID:6616
- C:\Windows\System\bPtDwXM.exe
  C:\Windows\System\bPtDwXM.exe
  2⤵
  PID:6632
- C:\Windows\System\QlHzsan.exe
  C:\Windows\System\QlHzsan.exe
  2⤵
  PID:6648
- C:\Windows\System\joAYrMQ.exe
  C:\Windows\System\joAYrMQ.exe
  2⤵
  PID:6668
- C:\Windows\System\ZKUEtIC.exe
  C:\Windows\System\ZKUEtIC.exe
  2⤵
  PID:6684
- C:\Windows\System\tlWFGUY.exe
  C:\Windows\System\tlWFGUY.exe
  2⤵
  PID:6700
- C:\Windows\System\BHSewPD.exe
  C:\Windows\System\BHSewPD.exe
  2⤵
  PID:6716
- C:\Windows\System\QKvpHqp.exe
  C:\Windows\System\QKvpHqp.exe
  2⤵
  PID:6732
- C:\Windows\System\lAXuIHb.exe
  C:\Windows\System\lAXuIHb.exe
  2⤵
  PID:6748
- C:\Windows\System\aQWYbNC.exe
  C:\Windows\System\aQWYbNC.exe
  2⤵
  PID:6768
- C:\Windows\System\hXKeMaC.exe
  C:\Windows\System\hXKeMaC.exe
  2⤵
  PID:6784
- C:\Windows\System\LJkmPiw.exe
  C:\Windows\System\LJkmPiw.exe
  2⤵
  PID:6876
- C:\Windows\System\oYZdtRp.exe
  C:\Windows\System\oYZdtRp.exe
  2⤵
  PID:6892
- C:\Windows\System\xomgwcJ.exe
  C:\Windows\System\xomgwcJ.exe
  2⤵
  PID:6908
- C:\Windows\System\TUGuoAA.exe
  C:\Windows\System\TUGuoAA.exe
  2⤵
  PID:6924
- C:\Windows\System\wpbZJev.exe
  C:\Windows\System\wpbZJev.exe
  2⤵
  PID:6940
- C:\Windows\System\ScHDnHP.exe
  C:\Windows\System\ScHDnHP.exe
  2⤵
  PID:6956
- C:\Windows\System\TloNMmu.exe
  C:\Windows\System\TloNMmu.exe
  2⤵
  PID:6972
- C:\Windows\System\TOwJPSy.exe
  C:\Windows\System\TOwJPSy.exe
  2⤵
  PID:6988
- C:\Windows\System\CjIMqlS.exe
  C:\Windows\System\CjIMqlS.exe
  2⤵
  PID:7004
- C:\Windows\System\FyYIsBQ.exe
  C:\Windows\System\FyYIsBQ.exe
  2⤵
  PID:7020
- C:\Windows\System\aHoUSvB.exe
  C:\Windows\System\aHoUSvB.exe
  2⤵
  PID:7036
- C:\Windows\System\OITfFfa.exe
  C:\Windows\System\OITfFfa.exe
  2⤵
  PID:7052
- C:\Windows\System\VzdRzCn.exe
  C:\Windows\System\VzdRzCn.exe
  2⤵
  PID:7068
- C:\Windows\System\ZFFYtvV.exe
  C:\Windows\System\ZFFYtvV.exe
  2⤵
  PID:7084
- C:\Windows\System\PZuEGwc.exe
  C:\Windows\System\PZuEGwc.exe
  2⤵
  PID:7100
- C:\Windows\System\OUiJDek.exe
  C:\Windows\System\OUiJDek.exe
  2⤵
  PID:7116
- C:\Windows\System\apDhNxg.exe
  C:\Windows\System\apDhNxg.exe
  2⤵
  PID:7140
- C:\Windows\System\gtPWWCT.exe
  C:\Windows\System\gtPWWCT.exe
  2⤵
  PID:7156
- C:\Windows\System\xJdhYok.exe
  C:\Windows\System\xJdhYok.exe
  2⤵
  PID:952
- C:\Windows\System\IwnOCxx.exe
  C:\Windows\System\IwnOCxx.exe
  2⤵
  PID:5784
- C:\Windows\System\Ysztqdq.exe
  C:\Windows\System\Ysztqdq.exe
  2⤵
  PID:4684
- C:\Windows\System\cpdJwnZ.exe
  C:\Windows\System\cpdJwnZ.exe
  2⤵
  PID:5412
- C:\Windows\System\CQIYyvP.exe
  C:\Windows\System\CQIYyvP.exe
  2⤵
  PID:6176
- C:\Windows\System\zdXYOPD.exe
  C:\Windows\System\zdXYOPD.exe
  2⤵
  PID:6216
- C:\Windows\System\UQaQZdQ.exe
  C:\Windows\System\UQaQZdQ.exe
  2⤵
  PID:6276
- C:\Windows\System\vhAfmFW.exe
  C:\Windows\System\vhAfmFW.exe
  2⤵
  PID:6344
- C:\Windows\System\OKPsLly.exe
  C:\Windows\System\OKPsLly.exe
  2⤵
  PID:6380
- C:\Windows\System\yjoOmlI.exe
  C:\Windows\System\yjoOmlI.exe
  2⤵
  PID:6448
- C:\Windows\System\fwhmaxQ.exe
  C:\Windows\System\fwhmaxQ.exe
  2⤵
  PID:6264
- C:\Windows\System\jmNMDBG.exe
  C:\Windows\System\jmNMDBG.exe
  2⤵
  PID:6232
- C:\Windows\System\rYUAZLe.exe
  C:\Windows\System\rYUAZLe.exe
  2⤵
  PID:6324
- C:\Windows\System\wXoxWCm.exe
  C:\Windows\System\wXoxWCm.exe
  2⤵
  PID:6392
- C:\Windows\System\htSlYWg.exe
  C:\Windows\System\htSlYWg.exe
  2⤵
  PID:6468
- C:\Windows\System\vDZNjIo.exe
  C:\Windows\System\vDZNjIo.exe
  2⤵
  PID:6512
- C:\Windows\System\mswCLRX.exe
  C:\Windows\System\mswCLRX.exe
  2⤵
  PID:6576
- C:\Windows\System\gdmpUCr.exe
  C:\Windows\System\gdmpUCr.exe
  2⤵
  PID:6640
- C:\Windows\System\FLBkjyA.exe
  C:\Windows\System\FLBkjyA.exe
  2⤵
  PID:6560
- C:\Windows\System\mFpnpGR.exe
  C:\Windows\System\mFpnpGR.exe
  2⤵
  PID:6564
- C:\Windows\System\jMbswll.exe
  C:\Windows\System\jMbswll.exe
  2⤵
  PID:6660
- C:\Windows\System\SNXQPOZ.exe
  C:\Windows\System\SNXQPOZ.exe
  2⤵
  PID:6708
- C:\Windows\System\sThZEke.exe
  C:\Windows\System\sThZEke.exe
  2⤵
  PID:6776
- C:\Windows\System\AJkyZgM.exe
  C:\Windows\System\AJkyZgM.exe
  2⤵
  PID:6764
- C:\Windows\System\tHQcIVL.exe
  C:\Windows\System\tHQcIVL.exe
  2⤵
  PID:6728
- C:\Windows\System\kRtJSLz.exe
  C:\Windows\System\kRtJSLz.exe
  2⤵
  PID:6804
- C:\Windows\System\BrQZxAQ.exe
  C:\Windows\System\BrQZxAQ.exe
  2⤵
  PID:6820
- C:\Windows\System\yjmEJrd.exe
  C:\Windows\System\yjmEJrd.exe
  2⤵
  PID:6840
- C:\Windows\System\KroMthp.exe
  C:\Windows\System\KroMthp.exe
  2⤵
  PID:6856
- C:\Windows\System\MhEMjYQ.exe
  C:\Windows\System\MhEMjYQ.exe
  2⤵
  PID:6868
- C:\Windows\System\OHiGjRt.exe
  C:\Windows\System\OHiGjRt.exe
  2⤵
  PID:6920
- C:\Windows\System\ApqsSMi.exe
  C:\Windows\System\ApqsSMi.exe
  2⤵
  PID:6984
- C:\Windows\System\EyetTnN.exe
  C:\Windows\System\EyetTnN.exe
  2⤵
  PID:6900
- C:\Windows\System\TLtbcbX.exe
  C:\Windows\System\TLtbcbX.exe
  2⤵
  PID:6964
- C:\Windows\System\cHSDBnh.exe
  C:\Windows\System\cHSDBnh.exe
  2⤵
  PID:7060
- C:\Windows\System\vqgHIbg.exe
  C:\Windows\System\vqgHIbg.exe
  2⤵
  PID:7096
- C:\Windows\System\eXKXBDo.exe
  C:\Windows\System\eXKXBDo.exe
  2⤵
  PID:7044
- C:\Windows\System\txLdchP.exe
  C:\Windows\System\txLdchP.exe
  2⤵
  PID:7112
- C:\Windows\System\FBROgyF.exe
  C:\Windows\System\FBROgyF.exe
  2⤵
  PID:5600
- C:\Windows\System\TurNWUR.exe
  C:\Windows\System\TurNWUR.exe
  2⤵
  PID:6308
- C:\Windows\System\LHWLiOI.exe
  C:\Windows\System\LHWLiOI.exe
  2⤵
  PID:6428
- C:\Windows\System\trXbeBN.exe
  C:\Windows\System\trXbeBN.exe
  2⤵
  PID:7164
- C:\Windows\System\NFeCFVM.exe
  C:\Windows\System\NFeCFVM.exe
  2⤵
  PID:832
- C:\Windows\System\lfgKfaA.exe
  C:\Windows\System\lfgKfaA.exe
  2⤵
  PID:2468
- C:\Windows\System\zuCckoM.exe
  C:\Windows\System\zuCckoM.exe
  2⤵
  PID:6396
- C:\Windows\System\iSHEZpk.exe
  C:\Windows\System\iSHEZpk.exe
  2⤵
  PID:6608
- C:\Windows\System\bKTmDHH.exe
  C:\Windows\System\bKTmDHH.exe
  2⤵
  PID:6656
- C:\Windows\System\fLKjlNO.exe
  C:\Windows\System\fLKjlNO.exe
  2⤵
  PID:6756
- C:\Windows\System\PIYICtv.exe
  C:\Windows\System\PIYICtv.exe
  2⤵
  PID:6460
- C:\Windows\System\TofmgLg.exe
  C:\Windows\System\TofmgLg.exe
  2⤵
  PID:6816
- C:\Windows\System\xwRzZjM.exe
  C:\Windows\System\xwRzZjM.exe
  2⤵
  PID:6980
- C:\Windows\System\USweqed.exe
  C:\Windows\System\USweqed.exe
  2⤵
  PID:6852
- C:\Windows\System\qqujJCs.exe
  C:\Windows\System\qqujJCs.exe
  2⤵
  PID:6628
- C:\Windows\System\RFdAcyw.exe
  C:\Windows\System\RFdAcyw.exe
  2⤵
  PID:6696
- C:\Windows\System\xqGUbol.exe
  C:\Windows\System\xqGUbol.exe
  2⤵
  PID:7016
- C:\Windows\System\LYwvOuV.exe
  C:\Windows\System\LYwvOuV.exe
  2⤵
  PID:7076
- C:\Windows\System\UxRSvHO.exe
  C:\Windows\System\UxRSvHO.exe
  2⤵
  PID:7108
- C:\Windows\System\GZZWIET.exe
  C:\Windows\System\GZZWIET.exe
  2⤵
  PID:6212
- C:\Windows\System\nupONkA.exe
  C:\Windows\System\nupONkA.exe
  2⤵
  PID:7152
- C:\Windows\System\QfiTwjo.exe
  C:\Windows\System\QfiTwjo.exe
  2⤵
  PID:6164
- C:\Windows\System\CTNUWyT.exe
  C:\Windows\System\CTNUWyT.exe
  2⤵
  PID:6348
- C:\Windows\System\YHqoSnk.exe
  C:\Windows\System\YHqoSnk.exe
  2⤵
  PID:6692
- C:\Windows\System\fJoRDDf.exe
  C:\Windows\System\fJoRDDf.exe
  2⤵
  PID:6812
- C:\Windows\System\XtImqeS.exe
  C:\Windows\System\XtImqeS.exe
  2⤵
  PID:6848
- C:\Windows\System\aYGrlyi.exe
  C:\Windows\System\aYGrlyi.exe
  2⤵
  PID:6596
- C:\Windows\System\UKahPiX.exe
  C:\Windows\System\UKahPiX.exe
  2⤵
  PID:6936
- C:\Windows\System\asHATdv.exe
  C:\Windows\System\asHATdv.exe
  2⤵
  PID:6444
- C:\Windows\System\sUNJSOj.exe
  C:\Windows\System\sUNJSOj.exe
  2⤵
  PID:6680
- C:\Windows\System\Scttacv.exe
  C:\Windows\System\Scttacv.exe
  2⤵
  PID:6888
- C:\Windows\System\PeLoFDR.exe
  C:\Windows\System\PeLoFDR.exe
  2⤵
  PID:7172
- C:\Windows\System\OqolarA.exe
  C:\Windows\System\OqolarA.exe
  2⤵
  PID:7188
- C:\Windows\System\gbFKjAH.exe
  C:\Windows\System\gbFKjAH.exe
  2⤵
  PID:7204
- C:\Windows\System\iprnLFL.exe
  C:\Windows\System\iprnLFL.exe
  2⤵
  PID:7220
- C:\Windows\System\QalQqnP.exe
  C:\Windows\System\QalQqnP.exe
  2⤵
  PID:7236
- C:\Windows\System\bpNdnCp.exe
  C:\Windows\System\bpNdnCp.exe
  2⤵
  PID:7252
- C:\Windows\System\fMQkQoH.exe
  C:\Windows\System\fMQkQoH.exe
  2⤵
  PID:7268
- C:\Windows\System\TkRGrVQ.exe
  C:\Windows\System\TkRGrVQ.exe
  2⤵
  PID:7284
- C:\Windows\System\YhPTsdU.exe
  C:\Windows\System\YhPTsdU.exe
  2⤵
  PID:7300
- C:\Windows\System\iCpmiMY.exe
  C:\Windows\System\iCpmiMY.exe
  2⤵
  PID:7316
- C:\Windows\System\YuxDNWy.exe
  C:\Windows\System\YuxDNWy.exe
  2⤵
  PID:7332
- C:\Windows\System\rgwyujg.exe
  C:\Windows\System\rgwyujg.exe
  2⤵
  PID:7348
- C:\Windows\System\vARJdcZ.exe
  C:\Windows\System\vARJdcZ.exe
  2⤵
  PID:7364
- C:\Windows\System\SySBnbO.exe
  C:\Windows\System\SySBnbO.exe
  2⤵
  PID:7380
- C:\Windows\System\WEPffXV.exe
  C:\Windows\System\WEPffXV.exe
  2⤵
  PID:7396
- C:\Windows\System\bBRWsCn.exe
  C:\Windows\System\bBRWsCn.exe
  2⤵
  PID:7416
- C:\Windows\System\KhNkONV.exe
  C:\Windows\System\KhNkONV.exe
  2⤵
  PID:7432
- C:\Windows\System\jTibBqs.exe
  C:\Windows\System\jTibBqs.exe
  2⤵
  PID:7448
- C:\Windows\System\KRysHfY.exe
  C:\Windows\System\KRysHfY.exe
  2⤵
  PID:7464
- C:\Windows\System\KWerZjq.exe
  C:\Windows\System\KWerZjq.exe
  2⤵
  PID:7484
- C:\Windows\System\ySnZPRU.exe
  C:\Windows\System\ySnZPRU.exe
  2⤵
  PID:7504
- C:\Windows\System\tLVAmvH.exe
  C:\Windows\System\tLVAmvH.exe
  2⤵
  PID:7520
- C:\Windows\System\hEZXGHX.exe
  C:\Windows\System\hEZXGHX.exe
  2⤵
  PID:7540
- C:\Windows\System\YDJnyCr.exe
  C:\Windows\System\YDJnyCr.exe
  2⤵
  PID:7556
- C:\Windows\System\KrOSfHp.exe
  C:\Windows\System\KrOSfHp.exe
  2⤵
  PID:7572
- C:\Windows\System\sDfXrcE.exe
  C:\Windows\System\sDfXrcE.exe
  2⤵
  PID:7588
- C:\Windows\System\sxPYVCp.exe
  C:\Windows\System\sxPYVCp.exe
  2⤵
  PID:7604
- C:\Windows\System\FrGLaCT.exe
  C:\Windows\System\FrGLaCT.exe
  2⤵
  PID:7620
- C:\Windows\System\LEyhFin.exe
  C:\Windows\System\LEyhFin.exe
  2⤵
  PID:7636
- C:\Windows\System\KrZmzHR.exe
  C:\Windows\System\KrZmzHR.exe
  2⤵
  PID:7652
- C:\Windows\System\qrVNCUM.exe
  C:\Windows\System\qrVNCUM.exe
  2⤵
  PID:7668
- C:\Windows\System\fzSEved.exe
  C:\Windows\System\fzSEved.exe
  2⤵
  PID:7684
- C:\Windows\System\UOYqenH.exe
  C:\Windows\System\UOYqenH.exe
  2⤵
  PID:7700
- C:\Windows\System\aVBxsPw.exe
  C:\Windows\System\aVBxsPw.exe
  2⤵
  PID:7716
- C:\Windows\System\zuNvuGh.exe
  C:\Windows\System\zuNvuGh.exe
  2⤵
  PID:7732
- C:\Windows\System\ujDgBkq.exe
  C:\Windows\System\ujDgBkq.exe
  2⤵
  PID:7748
- C:\Windows\System\FeseOcm.exe
  C:\Windows\System\FeseOcm.exe
  2⤵
  PID:7764
- C:\Windows\System\fvLnRte.exe
  C:\Windows\System\fvLnRte.exe
  2⤵
  PID:7780
- C:\Windows\System\CNVJRJN.exe
  C:\Windows\System\CNVJRJN.exe
  2⤵
  PID:7796
- C:\Windows\System\KEZZOmB.exe
  C:\Windows\System\KEZZOmB.exe
  2⤵
  PID:7812
- C:\Windows\System\fHZNgMl.exe
  C:\Windows\System\fHZNgMl.exe
  2⤵
  PID:7828
- C:\Windows\System\FcEkfmn.exe
  C:\Windows\System\FcEkfmn.exe
  2⤵
  PID:7844
- C:\Windows\System\FnvaWAt.exe
  C:\Windows\System\FnvaWAt.exe
  2⤵
  PID:7860
- C:\Windows\System\oaObvST.exe
  C:\Windows\System\oaObvST.exe
  2⤵
  PID:7876
- C:\Windows\System\mhUwltJ.exe
  C:\Windows\System\mhUwltJ.exe
  2⤵
  PID:7892
- C:\Windows\System\DOcwzdC.exe
  C:\Windows\System\DOcwzdC.exe
  2⤵
  PID:7908
- C:\Windows\System\jqWzsNL.exe
  C:\Windows\System\jqWzsNL.exe
  2⤵
  PID:7924
- C:\Windows\System\msUlGxq.exe
  C:\Windows\System\msUlGxq.exe
  2⤵
  PID:7940
- C:\Windows\System\fODVOyh.exe
  C:\Windows\System\fODVOyh.exe
  2⤵
  PID:7956
- C:\Windows\System\TQYNday.exe
  C:\Windows\System\TQYNday.exe
  2⤵
  PID:7972
- C:\Windows\System\orsbooM.exe
  C:\Windows\System\orsbooM.exe
  2⤵
  PID:7988
- C:\Windows\System\jlPWCcG.exe
  C:\Windows\System\jlPWCcG.exe
  2⤵
  PID:8004
- C:\Windows\System\BtXGLPE.exe
  C:\Windows\System\BtXGLPE.exe
  2⤵
  PID:8020
- C:\Windows\System\BXULutI.exe
  C:\Windows\System\BXULutI.exe
  2⤵
  PID:8036
- C:\Windows\System\xPUoSHS.exe
  C:\Windows\System\xPUoSHS.exe
  2⤵
  PID:8052
- C:\Windows\System\EtpSnzw.exe
  C:\Windows\System\EtpSnzw.exe
  2⤵
  PID:8068
- C:\Windows\System\eBDieed.exe
  C:\Windows\System\eBDieed.exe
  2⤵
  PID:8084
- C:\Windows\System\PRNKqUz.exe
  C:\Windows\System\PRNKqUz.exe
  2⤵
  PID:8104
- C:\Windows\System\guqSasO.exe
  C:\Windows\System\guqSasO.exe
  2⤵
  PID:8120
- C:\Windows\System\zkyBmpA.exe
  C:\Windows\System\zkyBmpA.exe
  2⤵
  PID:8140
- C:\Windows\System\MRNpRwb.exe
  C:\Windows\System\MRNpRwb.exe
  2⤵
  PID:8160
- C:\Windows\System\VHVqHur.exe
  C:\Windows\System\VHVqHur.exe
  2⤵
  PID:8176
- C:\Windows\System\defNvhs.exe
  C:\Windows\System\defNvhs.exe
  2⤵
  PID:7196
- C:\Windows\System\QYeaqMq.exe
  C:\Windows\System\QYeaqMq.exe
  2⤵
  PID:7260
- C:\Windows\System\AxFPiPG.exe
  C:\Windows\System\AxFPiPG.exe
  2⤵
  PID:7000
- C:\Windows\System\qxmSHzR.exe
  C:\Windows\System\qxmSHzR.exe
  2⤵
  PID:7324
- C:\Windows\System\bddPgWi.exe
  C:\Windows\System\bddPgWi.exe
  2⤵
  PID:3208
- C:\Windows\System\muBxZew.exe
  C:\Windows\System\muBxZew.exe
  2⤵
  PID:6416
- C:\Windows\System\AVGngPZ.exe
  C:\Windows\System\AVGngPZ.exe
  2⤵
  PID:6156
- C:\Windows\System\LHTXKcB.exe
  C:\Windows\System\LHTXKcB.exe
  2⤵
  PID:7212
- C:\Windows\System\dJMqfIw.exe
  C:\Windows\System\dJMqfIw.exe
  2⤵
  PID:7276
- C:\Windows\System\NEWOZKr.exe
  C:\Windows\System\NEWOZKr.exe
  2⤵
  PID:7344
- C:\Windows\System\epFsYod.exe
  C:\Windows\System\epFsYod.exe
  2⤵
  PID:7388
- C:\Windows\System\RPCgFkB.exe
  C:\Windows\System\RPCgFkB.exe
  2⤵
  PID:7428
- C:\Windows\System\HiSXwWG.exe
  C:\Windows\System\HiSXwWG.exe
  2⤵
  PID:7496
- C:\Windows\System\VNiAYAR.exe
  C:\Windows\System\VNiAYAR.exe
  2⤵
  PID:7536
- C:\Windows\System\tLAViJx.exe
  C:\Windows\System\tLAViJx.exe
  2⤵
  PID:7600
- C:\Windows\System\kPsejYj.exe
  C:\Windows\System\kPsejYj.exe
  2⤵
  PID:7444
- C:\Windows\System\rSqatEd.exe
  C:\Windows\System\rSqatEd.exe
  2⤵
  PID:7664
- C:\Windows\System\RGHtsVj.exe
  C:\Windows\System\RGHtsVj.exe
  2⤵
  PID:7548
- C:\Windows\System\KUcTEvs.exe
  C:\Windows\System\KUcTEvs.exe
  2⤵
  PID:7644
- C:\Windows\System\MsKvEbo.exe
  C:\Windows\System\MsKvEbo.exe
  2⤵
  PID:7676
- C:\Windows\System\GhojdNZ.exe
  C:\Windows\System\GhojdNZ.exe
  2⤵
  PID:7708
- C:\Windows\System\DyxNYRM.exe
  C:\Windows\System\DyxNYRM.exe
  2⤵
  PID:7740
- C:\Windows\System\aqFZAtf.exe
  C:\Windows\System\aqFZAtf.exe
  2⤵
  PID:7792
- C:\Windows\System\GNxCaPB.exe
  C:\Windows\System\GNxCaPB.exe
  2⤵
  PID:7808
- C:\Windows\System\uTKskPs.exe
  C:\Windows\System\uTKskPs.exe
  2⤵
  PID:7856
- C:\Windows\System\tfrLnhr.exe
  C:\Windows\System\tfrLnhr.exe
  2⤵
  PID:7916
- C:\Windows\System\YwavlVl.exe
  C:\Windows\System\YwavlVl.exe
  2⤵
  PID:7932
- C:\Windows\System\VbvJHSR.exe
  C:\Windows\System\VbvJHSR.exe
  2⤵
  PID:7996
- C:\Windows\System\vykNYBW.exe
  C:\Windows\System\vykNYBW.exe
  2⤵
  PID:7980
- C:\Windows\System\efUFYAA.exe
  C:\Windows\System\efUFYAA.exe
  2⤵
  PID:8016
- C:\Windows\System\exiEoIB.exe
  C:\Windows\System\exiEoIB.exe
  2⤵
  PID:8032
- C:\Windows\System\iwRrogJ.exe
  C:\Windows\System\iwRrogJ.exe
  2⤵
  PID:8064
- C:\Windows\System\lSTudpr.exe
  C:\Windows\System\lSTudpr.exe
  2⤵
  PID:8152
- C:\Windows\System\HQvnVvU.exe
  C:\Windows\System\HQvnVvU.exe
  2⤵
  PID:7028
- C:\Windows\System\feuDGlm.exe
  C:\Windows\System\feuDGlm.exe
  2⤵
  PID:8096
- C:\Windows\System\GWlRWKM.exe
  C:\Windows\System\GWlRWKM.exe
  2⤵
  PID:8136
- C:\Windows\System\RrbCoyr.exe
  C:\Windows\System\RrbCoyr.exe
  2⤵
  PID:872
- C:\Windows\System\xlBgHWB.exe
  C:\Windows\System\xlBgHWB.exe
  2⤵
  PID:6864
- C:\Windows\System\SlAJdZU.exe
  C:\Windows\System\SlAJdZU.exe
  2⤵
  PID:6624
- C:\Windows\System\OSmejQF.exe
  C:\Windows\System\OSmejQF.exe
  2⤵
  PID:7376
- C:\Windows\System\AUZnJIV.exe
  C:\Windows\System\AUZnJIV.exe
  2⤵
  PID:7356
- C:\Windows\System\QKoUlCf.exe
  C:\Windows\System\QKoUlCf.exe
  2⤵
  PID:7568
- C:\Windows\System\xfpSSTq.exe
  C:\Windows\System\xfpSSTq.exe
  2⤵
  PID:7660
- C:\Windows\System\KJmjsri.exe
  C:\Windows\System\KJmjsri.exe
  2⤵
  PID:7404
- C:\Windows\System\ZyvzXsp.exe
  C:\Windows\System\ZyvzXsp.exe
  2⤵
  PID:7776
- C:\Windows\System\rrnxmIU.exe
  C:\Windows\System\rrnxmIU.exe
  2⤵
  PID:7512
- C:\Windows\System\jxVvnNf.exe
  C:\Windows\System\jxVvnNf.exe
  2⤵
  PID:7424
- C:\Windows\System\mPRgTSj.exe
  C:\Windows\System\mPRgTSj.exe
  2⤵
  PID:7760
- C:\Windows\System\GwOoxMI.exe
  C:\Windows\System\GwOoxMI.exe
  2⤵
  PID:7824
- C:\Windows\System\ilhttlT.exe
  C:\Windows\System\ilhttlT.exe
  2⤵
  PID:7964
- C:\Windows\System\KGDpIjW.exe
  C:\Windows\System\KGDpIjW.exe
  2⤵
  PID:7888
- C:\Windows\System\rPqEESx.exe
  C:\Windows\System\rPqEESx.exe
  2⤵
  PID:8148
- C:\Windows\System\TpMMyRY.exe
  C:\Windows\System\TpMMyRY.exe
  2⤵
  PID:8000
- C:\Windows\System\CXTeBQD.exe
  C:\Windows\System\CXTeBQD.exe
  2⤵
  PID:8188
- C:\Windows\System\nJUrbos.exe
  C:\Windows\System\nJUrbos.exe
  2⤵
  PID:7180
- C:\Windows\System\EzkGJPJ.exe
  C:\Windows\System\EzkGJPJ.exe
  2⤵
  PID:8132
- C:\Windows\System\VREhqMr.exe
  C:\Windows\System\VREhqMr.exe
  2⤵
  PID:7308
- C:\Windows\System\oPEktVq.exe
  C:\Windows\System\oPEktVq.exe
  2⤵
  PID:7772
- C:\Windows\System\lxJbSEN.exe
  C:\Windows\System\lxJbSEN.exe
  2⤵
  PID:7820
- C:\Windows\System\uhhskCw.exe
  C:\Windows\System\uhhskCw.exe
  2⤵
  PID:8172
- C:\Windows\System\UyvIcsP.exe
  C:\Windows\System\UyvIcsP.exe
  2⤵
  PID:7372
- C:\Windows\System\YXvSZYZ.exe
  C:\Windows\System\YXvSZYZ.exe
  2⤵
  PID:7532
- C:\Windows\System\SLrOstL.exe
  C:\Windows\System\SLrOstL.exe
  2⤵
  PID:7228
- C:\Windows\System\BEdbVaH.exe
  C:\Windows\System\BEdbVaH.exe
  2⤵
  PID:6744
- C:\Windows\System\ziWTmMK.exe
  C:\Windows\System\ziWTmMK.exe
  2⤵
  PID:7904
- C:\Windows\System\pROJuOG.exe
  C:\Windows\System\pROJuOG.exe
  2⤵
  PID:8080
- C:\Windows\System\FyAiWUn.exe
  C:\Windows\System\FyAiWUn.exe
  2⤵
  PID:7680
- C:\Windows\System\xzkFZFx.exe
  C:\Windows\System\xzkFZFx.exe
  2⤵
  PID:7696
- C:\Windows\System\RLMMiRf.exe
  C:\Windows\System\RLMMiRf.exe
  2⤵
  PID:7248
- C:\Windows\System\UZovGOA.exe
  C:\Windows\System\UZovGOA.exe
  2⤵
  PID:1500
- C:\Windows\System\jJeXWWk.exe
  C:\Windows\System\jJeXWWk.exe
  2⤵
  PID:7528
- C:\Windows\System\MMeEMWR.exe
  C:\Windows\System\MMeEMWR.exe
  2⤵
  PID:8208
- C:\Windows\System\jrPodvx.exe
  C:\Windows\System\jrPodvx.exe
  2⤵
  PID:8228
- C:\Windows\System\CAnjkJE.exe
  C:\Windows\System\CAnjkJE.exe
  2⤵
  PID:8244
- C:\Windows\System\AMcrUkO.exe
  C:\Windows\System\AMcrUkO.exe
  2⤵
  PID:8260
- C:\Windows\System\zlQwcaU.exe
  C:\Windows\System\zlQwcaU.exe
  2⤵
  PID:8276
- C:\Windows\System\oJWwPEL.exe
  C:\Windows\System\oJWwPEL.exe
  2⤵
  PID:8292
- C:\Windows\System\kspKdOF.exe
  C:\Windows\System\kspKdOF.exe
  2⤵
  PID:8308
- C:\Windows\System\NpGnIEP.exe
  C:\Windows\System\NpGnIEP.exe
  2⤵
  PID:8324
- C:\Windows\System\zageBWY.exe
  C:\Windows\System\zageBWY.exe
  2⤵
  PID:8340
- C:\Windows\System\BBrEYho.exe
  C:\Windows\System\BBrEYho.exe
  2⤵
  PID:8360
- C:\Windows\System\RoQRFnk.exe
  C:\Windows\System\RoQRFnk.exe
  2⤵
  PID:8376
- C:\Windows\System\IcVNZhT.exe
  C:\Windows\System\IcVNZhT.exe
  2⤵
  PID:8392
- C:\Windows\System\LtFcPKp.exe
  C:\Windows\System\LtFcPKp.exe
  2⤵
  PID:8408
- C:\Windows\System\xhpbsdo.exe
  C:\Windows\System\xhpbsdo.exe
  2⤵
  PID:8424
- C:\Windows\System\cVmWqsy.exe
  C:\Windows\System\cVmWqsy.exe
  2⤵
  PID:8440
- C:\Windows\System\UnuGGrr.exe
  C:\Windows\System\UnuGGrr.exe
  2⤵
  PID:8456
- C:\Windows\System\vBNfFTP.exe
  C:\Windows\System\vBNfFTP.exe
  2⤵
  PID:8472
- C:\Windows\System\bNxgqsa.exe
  C:\Windows\System\bNxgqsa.exe
  2⤵
  PID:8488
- C:\Windows\System\RHDlFfc.exe
  C:\Windows\System\RHDlFfc.exe
  2⤵
  PID:8504
- C:\Windows\System\XLTEazI.exe
  C:\Windows\System\XLTEazI.exe
  2⤵
  PID:8524
- C:\Windows\System\BPDjtCY.exe
  C:\Windows\System\BPDjtCY.exe
  2⤵
  PID:8540
- C:\Windows\System\QiZjTSN.exe
  C:\Windows\System\QiZjTSN.exe
  2⤵
  PID:8556
- C:\Windows\System\gJENEDe.exe
  C:\Windows\System\gJENEDe.exe
  2⤵
  PID:8572
- C:\Windows\System\HhnsrXp.exe
  C:\Windows\System\HhnsrXp.exe
  2⤵
  PID:8588
- C:\Windows\System\GUokYwd.exe
  C:\Windows\System\GUokYwd.exe
  2⤵
  PID:8604
- C:\Windows\System\VmTSYqK.exe
  C:\Windows\System\VmTSYqK.exe
  2⤵
  PID:8620
- C:\Windows\System\xormcGR.exe
  C:\Windows\System\xormcGR.exe
  2⤵
  PID:8636
- C:\Windows\System\WYjDaIx.exe
  C:\Windows\System\WYjDaIx.exe
  2⤵
  PID:8652
- C:\Windows\System\AywqQzy.exe
  C:\Windows\System\AywqQzy.exe
  2⤵
  PID:8668
- C:\Windows\System\zfseKBq.exe
  C:\Windows\System\zfseKBq.exe
  2⤵
  PID:8684
- C:\Windows\System\gWlTbRT.exe
  C:\Windows\System\gWlTbRT.exe
  2⤵
  PID:8700
- C:\Windows\System\ntAeRBY.exe
  C:\Windows\System\ntAeRBY.exe
  2⤵
  PID:8716
- C:\Windows\System\dsexwIz.exe
  C:\Windows\System\dsexwIz.exe
  2⤵
  PID:8732
- C:\Windows\System\yCysMkq.exe
  C:\Windows\System\yCysMkq.exe
  2⤵
  PID:8748
- C:\Windows\System\MAbTcoS.exe
  C:\Windows\System\MAbTcoS.exe
  2⤵
  PID:8768
- C:\Windows\System\PMHBSiP.exe
  C:\Windows\System\PMHBSiP.exe
  2⤵
  PID:8784
- C:\Windows\System\JefrdGu.exe
  C:\Windows\System\JefrdGu.exe
  2⤵
  PID:8800
- C:\Windows\System\kiWkVfX.exe
  C:\Windows\System\kiWkVfX.exe
  2⤵
  PID:8816
- C:\Windows\System\GJFCEaU.exe
  C:\Windows\System\GJFCEaU.exe
  2⤵
  PID:8832
- C:\Windows\System\zOxTxjj.exe
  C:\Windows\System\zOxTxjj.exe
  2⤵
  PID:8848
- C:\Windows\System\ZNcDfwD.exe
  C:\Windows\System\ZNcDfwD.exe
  2⤵
  PID:8864
- C:\Windows\System\PwEcwrZ.exe
  C:\Windows\System\PwEcwrZ.exe
  2⤵
  PID:8880
- C:\Windows\System\ETuaMLh.exe
  C:\Windows\System\ETuaMLh.exe
  2⤵
  PID:8896
- C:\Windows\System\OPFpwrT.exe
  C:\Windows\System\OPFpwrT.exe
  2⤵
  PID:8912
- C:\Windows\System\uFHfvPd.exe
  C:\Windows\System\uFHfvPd.exe
  2⤵
  PID:8928
- C:\Windows\System\lTXbBEm.exe
  C:\Windows\System\lTXbBEm.exe
  2⤵
  PID:8944
- C:\Windows\System\OLgNGRL.exe
  C:\Windows\System\OLgNGRL.exe
  2⤵
  PID:8960
- C:\Windows\System\zOhtDfF.exe
  C:\Windows\System\zOhtDfF.exe
  2⤵
  PID:8976
- C:\Windows\System\jIhRvtU.exe
  C:\Windows\System\jIhRvtU.exe
  2⤵
  PID:8992
- C:\Windows\System\zqdBowg.exe
  C:\Windows\System\zqdBowg.exe
  2⤵
  PID:9008
- C:\Windows\System\gGeQUey.exe
  C:\Windows\System\gGeQUey.exe
  2⤵
  PID:9024
- C:\Windows\System\ELZfgeQ.exe
  C:\Windows\System\ELZfgeQ.exe
  2⤵
  PID:9040
- C:\Windows\System\TiRfILU.exe
  C:\Windows\System\TiRfILU.exe
  2⤵
  PID:9056
- C:\Windows\System\rvbbCvb.exe
  C:\Windows\System\rvbbCvb.exe
  2⤵
  PID:9072
- C:\Windows\System\KsZiCqy.exe
  C:\Windows\System\KsZiCqy.exe
  2⤵
  PID:9088
- C:\Windows\System\GSxMDDO.exe
  C:\Windows\System\GSxMDDO.exe
  2⤵
  PID:9108
- C:\Windows\System\ZqSTKzT.exe
  C:\Windows\System\ZqSTKzT.exe
  2⤵
  PID:9124
- C:\Windows\System\hovloci.exe
  C:\Windows\System\hovloci.exe
  2⤵
  PID:9140
- C:\Windows\System\hZyGzKj.exe
  C:\Windows\System\hZyGzKj.exe
  2⤵
  PID:9160
- C:\Windows\System\uBlXBRg.exe
  C:\Windows\System\uBlXBRg.exe
  2⤵
  PID:9176
- C:\Windows\System\DKVAHVZ.exe
  C:\Windows\System\DKVAHVZ.exe
  2⤵
  PID:9192
- C:\Windows\System\uCQHQmt.exe
  C:\Windows\System\uCQHQmt.exe
  2⤵
  PID:9212
- C:\Windows\System\KLxgqno.exe
  C:\Windows\System\KLxgqno.exe
  2⤵
  PID:8048
- C:\Windows\System\JxaREbc.exe
  C:\Windows\System\JxaREbc.exe
  2⤵
  PID:8204
- C:\Windows\System\RTjZQwl.exe
  C:\Windows\System\RTjZQwl.exe
  2⤵
  PID:8252
- C:\Windows\System\VgjcVmt.exe
  C:\Windows\System\VgjcVmt.exe
  2⤵
  PID:8320
- C:\Windows\System\atYFoWC.exe
  C:\Windows\System\atYFoWC.exe
  2⤵
  PID:8272
- C:\Windows\System\alEiRLu.exe
  C:\Windows\System\alEiRLu.exe
  2⤵
  PID:8336
- C:\Windows\System\gGZsoSB.exe
  C:\Windows\System\gGZsoSB.exe
  2⤵
  PID:8356
- C:\Windows\System\dZtCcHx.exe
  C:\Windows\System\dZtCcHx.exe
  2⤵
  PID:8416
- C:\Windows\System\jKGLoIB.exe
  C:\Windows\System\jKGLoIB.exe
  2⤵
  PID:8484
- C:\Windows\System\tckRCuW.exe
  C:\Windows\System\tckRCuW.exe
  2⤵
  PID:8552
- C:\Windows\System\qPVdtAc.exe
  C:\Windows\System\qPVdtAc.exe
  2⤵
  PID:8372
- C:\Windows\System\zGxGTOD.exe
  C:\Windows\System\zGxGTOD.exe
  2⤵
  PID:8400
- C:\Windows\System\lVdXOOn.exe
  C:\Windows\System\lVdXOOn.exe
  2⤵
  PID:8500
- C:\Windows\System\ezHWcwC.exe
  C:\Windows\System\ezHWcwC.exe
  2⤵
  PID:8568
- C:\Windows\System\KNECWCR.exe
  C:\Windows\System\KNECWCR.exe
  2⤵
  PID:8628
- C:\Windows\System\qCicTrF.exe
  C:\Windows\System\qCicTrF.exe
  2⤵
  PID:8692
- C:\Windows\System\KOwGymk.exe
  C:\Windows\System\KOwGymk.exe
  2⤵
  PID:8756
- C:\Windows\System\mjClRbp.exe
  C:\Windows\System\mjClRbp.exe
  2⤵
  PID:8776
- C:\Windows\System\gjgPqnF.exe
  C:\Windows\System\gjgPqnF.exe
  2⤵
  PID:8676
- C:\Windows\System\xQFoykn.exe
  C:\Windows\System\xQFoykn.exe
  2⤵
  PID:8812
- C:\Windows\System\sDwrMaT.exe
  C:\Windows\System\sDwrMaT.exe
  2⤵
  PID:8876
- C:\Windows\System\jNmYJZY.exe
  C:\Windows\System\jNmYJZY.exe
  2⤵
  PID:8824
- C:\Windows\System\DsDvDDo.exe
  C:\Windows\System\DsDvDDo.exe
  2⤵
  PID:8856
- C:\Windows\System\EDBvAat.exe
  C:\Windows\System\EDBvAat.exe
  2⤵
  PID:8920
- C:\Windows\System\XxWIDir.exe
  C:\Windows\System\XxWIDir.exe
  2⤵
  PID:8956
- C:\Windows\System\TeGdGhu.exe
  C:\Windows\System\TeGdGhu.exe
  2⤵
  PID:9004
- C:\Windows\System\WSXwCVI.exe
  C:\Windows\System\WSXwCVI.exe
  2⤵
  PID:9016
- C:\Windows\System\mpVpZod.exe
  C:\Windows\System\mpVpZod.exe
  2⤵
  PID:9068
- C:\Windows\System\KheHMHX.exe
  C:\Windows\System\KheHMHX.exe
  2⤵
  PID:9136
- C:\Windows\System\epBGoeI.exe
  C:\Windows\System\epBGoeI.exe
  2⤵
  PID:9052
- C:\Windows\System\FPzQTHG.exe
  C:\Windows\System\FPzQTHG.exe
  2⤵
  PID:9208
- C:\Windows\System\PfqHYpP.exe
  C:\Windows\System\PfqHYpP.exe
  2⤵
  PID:9152
- C:\Windows\System\ZsnlmAs.exe
  C:\Windows\System\ZsnlmAs.exe
  2⤵
  PID:9184
- C:\Windows\System\CAvEqHx.exe
  C:\Windows\System\CAvEqHx.exe
  2⤵
  PID:8116
- C:\Windows\System\VosHgoQ.exe
  C:\Windows\System\VosHgoQ.exe
  2⤵
  PID:8256
- C:\Windows\System\VWRkKjF.exe
  C:\Windows\System\VWRkKjF.exe
  2⤵
  PID:8300
- C:\Windows\System\nbxUAUI.exe
  C:\Windows\System\nbxUAUI.exe
  2⤵
  PID:8548
- C:\Windows\System\uAaTxSX.exe
  C:\Windows\System\uAaTxSX.exe
  2⤵
  PID:8404
- C:\Windows\System\rkUQLXz.exe
  C:\Windows\System\rkUQLXz.exe
  2⤵
  PID:8612
- C:\Windows\System\iCSbXYu.exe
  C:\Windows\System\iCSbXYu.exe
  2⤵
  PID:8564
- C:\Windows\System\hehfgsw.exe
  C:\Windows\System\hehfgsw.exe
  2⤵
  PID:8660
- C:\Windows\System\qXUxwXx.exe
  C:\Windows\System\qXUxwXx.exe
  2⤵
  PID:8724
- C:\Windows\System\QdASJKH.exe
  C:\Windows\System\QdASJKH.exe
  2⤵
  PID:8740
- C:\Windows\System\fPrTdmx.exe
  C:\Windows\System\fPrTdmx.exe
  2⤵
  PID:7408
- C:\Windows\System\EUXonYN.exe
  C:\Windows\System\EUXonYN.exe
  2⤵
  PID:8972
- C:\Windows\System\GrMXWQw.exe
  C:\Windows\System\GrMXWQw.exe
  2⤵
  PID:8968
- C:\Windows\System\DowsvPj.exe
  C:\Windows\System\DowsvPj.exe
  2⤵
  PID:9100
- C:\Windows\System\GWSSFNO.exe
  C:\Windows\System\GWSSFNO.exe
  2⤵
  PID:9084
- C:\Windows\System\qtsLZZy.exe
  C:\Windows\System\qtsLZZy.exe
  2⤵
  PID:8028
- C:\Windows\System\dzFocAo.exe
  C:\Windows\System\dzFocAo.exe
  2⤵
  PID:8448
- C:\Windows\System\bDpWDvE.exe
  C:\Windows\System\bDpWDvE.exe
  2⤵
  PID:8764
- C:\Windows\System\NYZQGhd.exe
  C:\Windows\System\NYZQGhd.exe
  2⤵
  PID:8828
- C:\Windows\System\VgcxXYw.exe
  C:\Windows\System\VgcxXYw.exe
  2⤵
  PID:8288
- C:\Windows\System\kIbGtBr.exe
  C:\Windows\System\kIbGtBr.exe
  2⤵
  PID:9132
- C:\Windows\System\mKZQMah.exe
  C:\Windows\System\mKZQMah.exe
  2⤵
  PID:8520
- C:\Windows\System\cUTLVff.exe
  C:\Windows\System\cUTLVff.exe
  2⤵
  PID:8648
- C:\Windows\System\drRRKhH.exe
  C:\Windows\System\drRRKhH.exe
  2⤵
  PID:9064
- C:\Windows\System\lRnEPYa.exe
  C:\Windows\System\lRnEPYa.exe
  2⤵
  PID:8872
- C:\Windows\System\iTtaZwu.exe
  C:\Windows\System\iTtaZwu.exe
  2⤵
  PID:8616
- C:\Windows\System\cYeRIrH.exe
  C:\Windows\System\cYeRIrH.exe
  2⤵
  PID:9224
- C:\Windows\System\fCFDBIO.exe
  C:\Windows\System\fCFDBIO.exe
  2⤵
  PID:9240
- C:\Windows\System\BrwzaJw.exe
  C:\Windows\System\BrwzaJw.exe
  2⤵
  PID:9260
- C:\Windows\System\fpCVCwY.exe
  C:\Windows\System\fpCVCwY.exe
  2⤵
  PID:9276
- C:\Windows\System\VcGPbWx.exe
  C:\Windows\System\VcGPbWx.exe
  2⤵
  PID:9292
- C:\Windows\System\onfDcrD.exe
  C:\Windows\System\onfDcrD.exe
  2⤵
  PID:9308
- C:\Windows\System\tsFDUZy.exe
  C:\Windows\System\tsFDUZy.exe
  2⤵
  PID:9324
- C:\Windows\System\gUOoMqY.exe
  C:\Windows\System\gUOoMqY.exe
  2⤵
  PID:9340
- C:\Windows\System\ofgoYSk.exe
  C:\Windows\System\ofgoYSk.exe
  2⤵
  PID:9356
- C:\Windows\System\MtkwcVW.exe
  C:\Windows\System\MtkwcVW.exe
  2⤵
  PID:9372
- C:\Windows\System\ZjeYuKK.exe
  C:\Windows\System\ZjeYuKK.exe
  2⤵
  PID:9388
- C:\Windows\System\TcdmMtz.exe
  C:\Windows\System\TcdmMtz.exe
  2⤵
  PID:9404
- C:\Windows\System\IJIOEuK.exe
  C:\Windows\System\IJIOEuK.exe
  2⤵
  PID:9424
- C:\Windows\System\bZhfKOF.exe
  C:\Windows\System\bZhfKOF.exe
  2⤵
  PID:9440
- C:\Windows\System\LDKxVVC.exe
  C:\Windows\System\LDKxVVC.exe
  2⤵
  PID:9456
- C:\Windows\System\CvBjNmk.exe
  C:\Windows\System\CvBjNmk.exe
  2⤵
  PID:9472
- C:\Windows\System\quJqsTF.exe
  C:\Windows\System\quJqsTF.exe
  2⤵
  PID:9488
- C:\Windows\System\XjBtYYj.exe
  C:\Windows\System\XjBtYYj.exe
  2⤵
  PID:9504
- C:\Windows\System\IYXayzA.exe
  C:\Windows\System\IYXayzA.exe
  2⤵
  PID:9520
- C:\Windows\System\LurFOFZ.exe
  C:\Windows\System\LurFOFZ.exe
  2⤵
  PID:9536
- C:\Windows\System\WyDWTjP.exe
  C:\Windows\System\WyDWTjP.exe
  2⤵
  PID:9552
- C:\Windows\System\JegiFZZ.exe
  C:\Windows\System\JegiFZZ.exe
  2⤵
  PID:9576
- C:\Windows\System\RgTlJxJ.exe
  C:\Windows\System\RgTlJxJ.exe
  2⤵
  PID:9592
- C:\Windows\System\HEwCCXe.exe
  C:\Windows\System\HEwCCXe.exe
  2⤵
  PID:9608
- C:\Windows\System\jJnCcBH.exe
  C:\Windows\System\jJnCcBH.exe
  2⤵
  PID:9628
- C:\Windows\System\FgcanUk.exe
  C:\Windows\System\FgcanUk.exe
  2⤵
  PID:9644
- C:\Windows\System\AAzKPQz.exe
  C:\Windows\System\AAzKPQz.exe
  2⤵
  PID:9660
- C:\Windows\System\IVTYpLq.exe
  C:\Windows\System\IVTYpLq.exe
  2⤵
  PID:9676
- C:\Windows\System\mEhPBTb.exe
  C:\Windows\System\mEhPBTb.exe
  2⤵
  PID:9692
- C:\Windows\System\KbknUBn.exe
  C:\Windows\System\KbknUBn.exe
  2⤵
  PID:9708
- C:\Windows\System\efaDeBR.exe
  C:\Windows\System\efaDeBR.exe
  2⤵
  PID:9724
- C:\Windows\System\juVfHWL.exe
  C:\Windows\System\juVfHWL.exe
  2⤵
  PID:9740
- C:\Windows\System\PaBPtRL.exe
  C:\Windows\System\PaBPtRL.exe
  2⤵
  PID:9760
- C:\Windows\System\lxipwmv.exe
  C:\Windows\System\lxipwmv.exe
  2⤵
  PID:9776
- C:\Windows\System\njMUAZq.exe
  C:\Windows\System\njMUAZq.exe
  2⤵
  PID:9792
- C:\Windows\System\JwWrysv.exe
  C:\Windows\System\JwWrysv.exe
  2⤵
  PID:9808
- C:\Windows\System\FkGCoAu.exe
  C:\Windows\System\FkGCoAu.exe
  2⤵
  PID:9824
- C:\Windows\System\aBGyMGt.exe
  C:\Windows\System\aBGyMGt.exe
  2⤵
  PID:9840
- C:\Windows\System\vYXngzs.exe
  C:\Windows\System\vYXngzs.exe
  2⤵
  PID:9856
- C:\Windows\System\hekYjIB.exe
  C:\Windows\System\hekYjIB.exe
  2⤵
  PID:9872
- C:\Windows\System\EIdQqrR.exe
  C:\Windows\System\EIdQqrR.exe
  2⤵
  PID:9896
- C:\Windows\System\dJPNUiz.exe
  C:\Windows\System\dJPNUiz.exe
  2⤵
  PID:9912
- C:\Windows\System\VGnZfdj.exe
  C:\Windows\System\VGnZfdj.exe
  2⤵
  PID:9928
- C:\Windows\System\MmMCWnm.exe
  C:\Windows\System\MmMCWnm.exe
  2⤵
  PID:10004
- C:\Windows\System\GydrnrT.exe
  C:\Windows\System\GydrnrT.exe
  2⤵
  PID:10020
- C:\Windows\System\uhKKIqn.exe
  C:\Windows\System\uhKKIqn.exe
  2⤵
  PID:10036
- C:\Windows\System\jkYrjeN.exe
  C:\Windows\System\jkYrjeN.exe
  2⤵
  PID:10052
- C:\Windows\System\RsyctXr.exe
  C:\Windows\System\RsyctXr.exe
  2⤵
  PID:10068
- C:\Windows\System\ZzspWuK.exe
  C:\Windows\System\ZzspWuK.exe
  2⤵
  PID:10084
- C:\Windows\System\YWPnEHq.exe
  C:\Windows\System\YWPnEHq.exe
  2⤵
  PID:10100
- C:\Windows\System\zNpdDlc.exe
  C:\Windows\System\zNpdDlc.exe
  2⤵
  PID:10116
- C:\Windows\System\XHdJYVv.exe
  C:\Windows\System\XHdJYVv.exe
  2⤵
  PID:10132
- C:\Windows\System\VMlHSsj.exe
  C:\Windows\System\VMlHSsj.exe
  2⤵
  PID:10148
- C:\Windows\System\nBUoEiF.exe
  C:\Windows\System\nBUoEiF.exe
  2⤵
  PID:10164
- C:\Windows\System\yrukKfE.exe
  C:\Windows\System\yrukKfE.exe
  2⤵
  PID:10180
- C:\Windows\System\UlmjeFz.exe
  C:\Windows\System\UlmjeFz.exe
  2⤵
  PID:10196
- C:\Windows\System\XJZaqdd.exe
  C:\Windows\System\XJZaqdd.exe
  2⤵
  PID:10212
- C:\Windows\System\eHSzOdT.exe
  C:\Windows\System\eHSzOdT.exe
  2⤵
  PID:10228
- C:\Windows\System\VuKJcby.exe
  C:\Windows\System\VuKJcby.exe
  2⤵
  PID:8988
- C:\Windows\System\AvAllHP.exe
  C:\Windows\System\AvAllHP.exe
  2⤵
  PID:8464
- C:\Windows\System\QwDMgKa.exe
  C:\Windows\System\QwDMgKa.exe
  2⤵
  PID:9204
- C:\Windows\System\sdnDRwn.exe
  C:\Windows\System\sdnDRwn.exe
  2⤵
  PID:9000
- C:\Windows\System\HoIZcTc.exe
  C:\Windows\System\HoIZcTc.exe
  2⤵
  PID:9156
- C:\Windows\System\baNFkwF.exe
  C:\Windows\System\baNFkwF.exe
  2⤵
  PID:9268
- C:\Windows\System\vSGtrSH.exe
  C:\Windows\System\vSGtrSH.exe
  2⤵
  PID:9316
- C:\Windows\System\ILgNzkj.exe
  C:\Windows\System\ILgNzkj.exe
  2⤵
  PID:9348
- C:\Windows\System\cWBXGqA.exe
  C:\Windows\System\cWBXGqA.exe
  2⤵
  PID:9412
- C:\Windows\System\igvHiwE.exe
  C:\Windows\System\igvHiwE.exe
  2⤵
  PID:9448
- C:\Windows\System\PflUbYf.exe
  C:\Windows\System\PflUbYf.exe
  2⤵
  PID:9368
- C:\Windows\System\kMsOhoy.exe
  C:\Windows\System\kMsOhoy.exe
  2⤵
  PID:9452
- C:\Windows\System\UwUzfOC.exe
  C:\Windows\System\UwUzfOC.exe
  2⤵
  PID:9480
- C:\Windows\System\ibqnNwP.exe
  C:\Windows\System\ibqnNwP.exe
  2⤵
  PID:9544
- C:\Windows\System\MwLbhKY.exe
  C:\Windows\System\MwLbhKY.exe
  2⤵
  PID:9528
- C:\Windows\System\ZOwYxmk.exe
  C:\Windows\System\ZOwYxmk.exe
  2⤵
  PID:9652
- C:\Windows\System\ZoWWtOS.exe
  C:\Windows\System\ZoWWtOS.exe
  2⤵
  PID:9568
- C:\Windows\System\pOJldJf.exe
  C:\Windows\System\pOJldJf.exe
  2⤵
  PID:9560
- C:\Windows\System\VIjWGyA.exe
  C:\Windows\System\VIjWGyA.exe
  2⤵
  PID:9636
- C:\Windows\System\AvtCaAI.exe
  C:\Windows\System\AvtCaAI.exe
  2⤵
  PID:9716
- C:\Windows\System\jqTWJiI.exe
  C:\Windows\System\jqTWJiI.exe
  2⤵
  PID:9756
- C:\Windows\System\HolEKrs.exe
  C:\Windows\System\HolEKrs.exe
  2⤵
  PID:9732
- C:\Windows\System\CDrCHlf.exe
  C:\Windows\System\CDrCHlf.exe
  2⤵
  PID:9700
- C:\Windows\System\fJJFHMZ.exe
  C:\Windows\System\fJJFHMZ.exe
  2⤵
  PID:9820
- C:\Windows\System\vbdVnqG.exe
  C:\Windows\System\vbdVnqG.exe
  2⤵
  PID:9836
- C:\Windows\System\iDWpHqM.exe
  C:\Windows\System\iDWpHqM.exe
  2⤵
  PID:9904
- C:\Windows\System\xDsxgRP.exe
  C:\Windows\System\xDsxgRP.exe
  2⤵
  PID:9892
- C:\Windows\System\RjVZesq.exe
  C:\Windows\System\RjVZesq.exe
  2⤵
  PID:9988
- C:\Windows\System\wxSNVym.exe
  C:\Windows\System\wxSNVym.exe
  2⤵
  PID:10000
- C:\Windows\System\qqyxwzP.exe
  C:\Windows\System\qqyxwzP.exe
  2⤵
  PID:10076
- C:\Windows\System\qNzcqKv.exe
  C:\Windows\System\qNzcqKv.exe
  2⤵
  PID:10060
- C:\Windows\System\AksvjUa.exe
  C:\Windows\System\AksvjUa.exe
  2⤵
  PID:10096
- C:\Windows\System\dtdAjmx.exe
  C:\Windows\System\dtdAjmx.exe
  2⤵
  PID:10144
- C:\Windows\System\MZKmItl.exe
  C:\Windows\System\MZKmItl.exe
  2⤵
  PID:10236
- C:\Windows\System\IZFpyLS.exe
  C:\Windows\System\IZFpyLS.exe
  2⤵
  PID:8892
- C:\Windows\System\BQxJIYL.exe
  C:\Windows\System\BQxJIYL.exe
  2⤵
  PID:9320
- C:\Windows\System\PoVirTu.exe
  C:\Windows\System\PoVirTu.exe
  2⤵
  PID:8220
- C:\Windows\System\VMsVfvG.exe
  C:\Windows\System\VMsVfvG.exe
  2⤵
  PID:8532
- C:\Windows\System\ZVmEnvN.exe
  C:\Windows\System\ZVmEnvN.exe
  2⤵
  PID:8200
- C:\Windows\System\YqMQQTd.exe
  C:\Windows\System\YqMQQTd.exe
  2⤵
  PID:9284
- C:\Windows\System\MjZJfUM.exe
  C:\Windows\System\MjZJfUM.exe
  2⤵
  PID:9436
- C:\Windows\System\zlEwycm.exe
  C:\Windows\System\zlEwycm.exe
  2⤵
  PID:9336
- C:\Windows\System\LBTRoxq.exe
  C:\Windows\System\LBTRoxq.exe
  2⤵
  PID:9588
- C:\Windows\System\HsTrYtS.exe
  C:\Windows\System\HsTrYtS.exe
  2⤵
  PID:9564
- C:\Windows\System\DEdfCNZ.exe
  C:\Windows\System\DEdfCNZ.exe
  2⤵
  PID:9604
- C:\Windows\System\uGlAIJK.exe
  C:\Windows\System\uGlAIJK.exe
  2⤵
  PID:9688
- C:\Windows\System\QUTqZjI.exe
  C:\Windows\System\QUTqZjI.exe
  2⤵
  PID:9816
- C:\Windows\System\JsVwlCf.exe
  C:\Windows\System\JsVwlCf.exe
  2⤵
  PID:9848
- C:\Windows\System\VuiebVv.exe
  C:\Windows\System\VuiebVv.exe
  2⤵
  PID:9888
- C:\Windows\System\HTMihYb.exe
  C:\Windows\System\HTMihYb.exe
  2⤵
  PID:10048
- C:\Windows\System\tVvEWdi.exe
  C:\Windows\System\tVvEWdi.exe
  2⤵
  PID:9996
- C:\Windows\System\elBBxcb.exe
  C:\Windows\System\elBBxcb.exe
  2⤵
  PID:10140
- C:\Windows\System\blrKfuW.exe
  C:\Windows\System\blrKfuW.exe
  2⤵
  PID:10208
- C:\Windows\System\aUWIwlv.exe
  C:\Windows\System\aUWIwlv.exe
  2⤵
  PID:8480
- C:\Windows\System\KGOaNBF.exe
  C:\Windows\System\KGOaNBF.exe
  2⤵
  PID:10160
- C:\Windows\System\toLXZnl.exe
  C:\Windows\System\toLXZnl.exe
  2⤵
  PID:9384
- C:\Windows\System\FdoePeH.exe
  C:\Windows\System\FdoePeH.exe
  2⤵
  PID:9364
- C:\Windows\System\WypkNJY.exe
  C:\Windows\System\WypkNJY.exe
  2⤵
  PID:9584
- C:\Windows\System\HfjZfKt.exe
  C:\Windows\System\HfjZfKt.exe
  2⤵
  PID:9800
- C:\Windows\System\hLzExPo.exe
  C:\Windows\System\hLzExPo.exe
  2⤵
  PID:9768
- C:\Windows\System\iMpJIhO.exe
  C:\Windows\System\iMpJIhO.exe
  2⤵
  PID:9924
- C:\Windows\System\REUXsUu.exe
  C:\Windows\System\REUXsUu.exe
  2⤵
  PID:9880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CEUAqQH.exe

Filesize
2.3MB

MD5
4d862b74d3949ef193bef562b57be0d0

SHA1
80520a1a9a4374b319048df8fe35e7badc81c173

SHA256
96b3a7a354b9921e5c81c62c33887463deef6f5bb627f4df0823cb790241aa09

SHA512
b42c961715276767636dc8460839570d06a884f2550181247e9018c109c72f9731a36ba6f5145e065a5a52042e1ccfc7a895f7e4d18a4ee83c5451cdc17e489c

Download Submit
C:\Windows\system\ChnAaor.exe

Filesize
2.3MB

MD5
17ef95904d3e4f533737ebc2e2040420

SHA1
a630d36f83643889a46945253ff4baa94a19c58f

SHA256
87c2dec3adebaa50d9c77b1181f52476d832550d2402d8407a6ff656d9d38152

SHA512
90476a265e12c419950eff1fa61a60dca3ad0b0b648743f45fcb38dccaf3dec6def73231ff62baba83054af8db1a76f6c69f78c112d92196797fa273868b56b4

Download Submit
C:\Windows\system\GqIbjmR.exe

Filesize
2.3MB

MD5
90d762634d728dc49e3dea3d65f6330a

SHA1
17ddb95d7a793642c7e8665f59e5461b73af9d06

SHA256
ffcc208905b1e954a7b09a6a3abdf3b8b0f4ecd0f0206ebe37b5a501ee3e441e

SHA512
9a5366a01de1d7bd079142b66ab0bd296e9fcb6f87e58e2d29ef22ceb3915b34df9ea9aea0e35656d213a532d0eda91c61b8ed0d9576f64044224e27c22e1793

Download Submit
C:\Windows\system\LYpWqXG.exe

Filesize
2.3MB

MD5
235ccacd137ebec1f8c589e2622f524d

SHA1
46e24c9022f872a7675d76838b37d2eb4d89e4f4

SHA256
32023cef273fb0b24b94295d18816a1231e18a7e8173db9b01ef99bb4e7defd1

SHA512
0217fe67cf09400fd9415193fe8bfb8947abe45806cf6eac29d33e2516a51c63bdd32f94434d64a3a2202b7a2892625ad300cbea925ac8522a22cd31d8c986b8

Download Submit
C:\Windows\system\NiibCsy.exe

Filesize
2.3MB

MD5
7272e141061624abe77cd412aa20729d

SHA1
a6c14609776e404a50067af4cf0690cb35d75bcf

SHA256
618f072475d153398ecb1412397e2835068bc16cc7bdc1e34f8952fb72294a8d

SHA512
1823e23718ecc7936c8f9f30bea7e6ba204b0a7f74bc7882cc24354ea7886cbdcc35641ac4067463f3048debcde8c69feb77c350ca96fc9ffadb3eb8e24b1efd

Download Submit
C:\Windows\system\UkrgMJa.exe

Filesize
2.3MB

MD5
96a8eff1089b5b3689d6e72a54926923

SHA1
aa48e56172f82f5d586299f745a46e0f71e6fc2a

SHA256
a9773a03c3c163491d360a1332a35971b11eb7e6f51cc5342ec6171e5388554f

SHA512
649fdd4506843c80726d3550a296fb7e808642f7d2f00447f46438c47508ace92475c59fdca83a8a905553d145c43ad2198862b26e0c3d83977690928e8ca47c

Download Submit
C:\Windows\system\XWEivjN.exe

Filesize
2.3MB

MD5
9c82e1da920340986b196df595a6f278

SHA1
fe9ffc9954b41752a86187f8f2b4ab5cb39b239f

SHA256
da5436ffbd26cbc0c6eefffb14300deeb499cca0350a5ace0eba27cb3687deec

SHA512
7855902297cad536e63d005402b69731c5d32df84486c4d70f0f334a8a80334fd8b455b9588f36e47e2d14c2582662c785c8eaff7d599ded6249fb674633d6cf

Download Submit
C:\Windows\system\bjPjesr.exe

Filesize
2.3MB

MD5
b15e392d17617fdf8a407f07cbbbab99

SHA1
5bf6a7448e45bcd281ed834b34a94d1581ca5d51

SHA256
03d83e07baab974a8a2e9d89e27a9adea8e4b4ccd2cb94978fbefb1dd7556edf

SHA512
be6302075309872bae16c6b30a2869e3848e6f60e4a99050e5832195712bb4fbb854984077b97f600b6b32b13c819e09ec0609708726fa22b676ac1ccb4ea026

Download Submit
C:\Windows\system\cpWdqyp.exe

Filesize
2.3MB

MD5
484ca610c629ac0dc670cf91d33a06e3

SHA1
775300113dd8d5cdc38473fcbd9f6e3e58410913

SHA256
3a3c64f24a9db8768b1be86b89ac0b9b65268243002f4e7afb54f769cfa61d0f

SHA512
3ce56cc162382e5a9ae7accd547f20bd5bb7e6329374e300bf4b8f30c09c2d829c5f39c8c7549af22d0bd9eca849ed36a7307f320b4c87df5be496a71d68ca8a

Download Submit
C:\Windows\system\oHZhlbb.exe

Filesize
2.3MB

MD5
7e24d2483aabec00797d951a8d8ac630

SHA1
82eaa09374bdcdd4debdf7afab89d9f18e25fd87

SHA256
9e7d295aab7ff28d5659e580ef76e7998194a4456184aa533826e24a6e98d934

SHA512
d3b4c51fb28a197fa7318c0b861e2f52f908953064458aeeecb0a1795c9e6e44caa91093a97b56904fc121881699c0ec685aa6c0f6512e7db65b927a0ed29a4e

Download Submit
C:\Windows\system\pZDXAJB.exe

Filesize
2.3MB

MD5
dd4a7f31fc117a4947c46a90f65c8ebb

SHA1
f205b41f87f36981b0493a2d3c4e60548a5426d4

SHA256
d64c69a24e76e6616b8d8d177e76acba2d90272899970f0c0dc642691660bc42

SHA512
43498968b82f03a89760161733326dea6d4e192d7ec495580eeb8684634df88d3812e8952a11c0df98f0dc0a382b5d57905207e454a1696a2b5700287d71b7b5

Download Submit
C:\Windows\system\tiqKKDL.exe

Filesize
2.3MB

MD5
7dced3ff204b4aac1161e50ee23f0c75

SHA1
a325091993ad29edb82ae2a8d0359f7a5f0ece00

SHA256
e7b36c1b8de423a4be45b9e5f558494b91362b7a958822fbca34133b66db62ce

SHA512
d88d9b0d079caa1755afb4b3874e5b65bc81965feed202f83828284debdc1fce9a86f3f46d75a681e7a637e1fdae9b72e7b85a36ef5bb5e0ba7e3ce72ba70ef1

Download Submit
C:\Windows\system\uIvWwOa.exe

Filesize
2.3MB

MD5
9718354884a9e510e2733daf43512934

SHA1
fa27409eef5f6968791fe335b3b25cfc4e29a421

SHA256
816996f68755656fde5ffef2ffbf22f0b2a8adfbbe03ad17e148637552c2bac2

SHA512
3cf74364a18658f7f1fb31d71dd911493d796fe022fc0b7fa7ff6ef90c4b053ae0061b3ce43c70c2ac75f2af96fbecca0d9fc6dbc501d60f8846127e2bffe5f2

Download Submit
\Windows\system\AYYwPYo.exe

Filesize
2.3MB

MD5
6f93c3bfc976999f4c82a550f83be26d

SHA1
c717775b38d2f02d78dc1ed44de24c87a0db90e4

SHA256
c9eb9b41a78539fca89ae767b0ccfd729a1e556772b0214c02f37ac0edf0a334

SHA512
55d331d5cea5ba08282a0a338a5ef8a949ea8dfa8b386d4d4ddfa9bdb33e348aca1f241a6900e5bb4df09f1f852eb8f4bdb5bf0d12e3486f05d81a8caa1acdde

Download Submit
\Windows\system\DBfueMv.exe

Filesize
2.3MB

MD5
85cb9f94b3e9cfba49146ce92bd39243

SHA1
ba6f485b18feef109fb7ed64c24cb7ffc945f827

SHA256
a5908b892bb790a9c9ce2069e3ebb657a20ad6abe9b702f69ff6206f946ed32a

SHA512
384f38c5d852b17b41cdd01a9b2b4c3acdf826bc5547737072453b0d0304d1a2e5adbb711a5246cdc12cbc6720f970d8b579e51e385d9a7f1c04e59f37cf2400

Download Submit
\Windows\system\FLmrxfD.exe

Filesize
2.3MB

MD5
fab3aee7cd5b7b212c8138e48e1e73eb

SHA1
c7e936471e78838c482dc277da4e55008002e2e7

SHA256
b3ab01428839ad6da15c68a40b17721e926513bdcc438ffe0a460e2000e2705e

SHA512
af0d4c92cf8d3af2bf0e1d17f3049d293840663bf7f8d5b1be879e057a4f728d85d865f8ba8051364f1d035bd1bdf90b2f0be0e3b43e601fbc03a3a2bb4cfc30

Download Submit
\Windows\system\JaxwQLK.exe

Filesize
2.3MB

MD5
c6533a81892cd61c7c4a0f5f789e8f25

SHA1
89bee5c2216673569443a45647a3c7ffea8c96ba

SHA256
b5e3dc9095da265b5ccaeb8ac0c1a13c9b8e9f1a73415178001f05de00fcf340

SHA512
afefb3a50896d6191baccf36517466eb99b559deb6ed71936b55830ac965db54bb838ee969e9d583fe27dd98ae354f4639615b9b0d8541d2fbd34f2cfe1e1d53

Download Submit
\Windows\system\PfbJnpu.exe

Filesize
2.3MB

MD5
3d5cd5ad876bc3adb3a142978f2543af

SHA1
d6353b7ae803721616a59558827729dd0a04b5ea

SHA256
a3faba0a66bef57b22cf093e418ee900becac171ad03446f5a430035923de534

SHA512
0a3ce694c3cec8f88c9ff3173c5429655a5b9c388aa1f78700bb2ffc08f9677dd2c2c58a424c9d6c13b7586688679f9e72777d926392823048dc5fa5772a3a61

Download Submit
\Windows\system\RGsokZD.exe

Filesize
2.3MB

MD5
70fed1c06cd4d5642825da7fb70b73a4

SHA1
9266c4519d965102f6a02bafaae8fed87058328f

SHA256
f2de99680840c169d518c3a6412753b9d0bf4297e6d3b7b38f9c2ce5379c349b

SHA512
7c7ece3738de2328a4835f2f24fcdf4f725ca1f1de798d23a1057993e559ccd8746bfe36c7ec695b28ea269e269e035e7e8972a92674542e91d6171bdd5772d2

Download Submit
\Windows\system\TsPgNci.exe

Filesize
2.3MB

MD5
0946e16fe90f3c96a3286c95df22f40a

SHA1
b6bd4c47f4adccf24a08f1983e4ca1da1ba8b4ba

SHA256
9186076b79ab2a1166023171413203b94f2d9fc20f8e8c9ee412b976b05f13b0

SHA512
38192b4fde73da1295c017bb748b738a3e462ff4ed143a7704655b9c3e24d72dfe11683e79f25eea4bfec944e988d5073ae4434f73acd60b529d0c8e1bfd5be5

Download Submit
\Windows\system\WHQVXap.exe

Filesize
2.3MB

MD5
943c17f21f5f8f2bf13f4c61e12207bd

SHA1
a0ec3d4c9e6d80271c44cf979212c8a1fff32482

SHA256
6b5fe7df3362be8a5d2cdcfdd6eed4232ba6421198d4b01a211a2797088b8c81

SHA512
0a79d49f3b82dba819f85d6692a32f372250432a725ff19f3bbe40bf9dcfa638298c9cc2159e629a172dfb379fdd6f448568821e5b487e6d71a05d3ec1ea6fc2

Download Submit
\Windows\system\eUswaaH.exe

Filesize
2.3MB

MD5
cb407eccf589f991e31f563d14897967

SHA1
067bcf058c923c7bdb43c864e4552f41438ef36c

SHA256
d68430f94aec96b13edfce393bfc6029b60dd7bf21092cd9db71b697f4a82a7a

SHA512
80a12800a92b5bc99ab851b77e9e94e76ffd75e88f79baf3061e07064594034783b31128afd15a8abdafdba4e30ea6c41cc8d8ad8cf879bfb155122d3d7bad51

Download Submit
\Windows\system\gZqCbcW.exe

Filesize
2.3MB

MD5
48100bd23a899afd95c58df42333daab

SHA1
3ce6b8ad7765a0203f38af604b213ff1494c78db

SHA256
cb4c782cd4b8b17bf4d978ca0d07301a7b5697b327cb15b74c6016af5978eed4

SHA512
250c48b14ad3b0b8f4924cf622d75c6b575ac724c9654694f54c608b293a62a844188a3264e93d28f7d6578d19c062b883e872c34278295516d85c7962fea8de

Download Submit
\Windows\system\hBCstyC.exe

Filesize
2.3MB

MD5
6e2eb73f2b3e88e9483401cdd5233570

SHA1
c1e0f1a96bea2d00c3c7f3d64fd8f62c4b0f5a86

SHA256
471b69d1cde617be2e64c973f4fdc342a61d9cea9dde5edb0774be04e2f4bd49

SHA512
1d09ad1f8a22f699cae1952afc38358b108e03a14f48e7b340c945c1556eee29da2ce985defdea0b947865a2ab1c11582281712434424ea854b1f42b3187cedd

Download Submit
\Windows\system\hcdtCSl.exe

Filesize
2.3MB

MD5
074612676ecaea58bae1971461a53598

SHA1
08f2f41c6797654a2b61eaf710df766c3b3e7426

SHA256
d7d45329f20c730650de8c2b7e07d1de5fc426d5008d3e05341f42ce1d5c2713

SHA512
0162ef1798a1fc982adc880e778ebf36ef7aaee54090625d9fe642ccc984c9ddb26f63bcfc3b134374bf4d919587b3d869e22f1e895e89086f8c2a2cc7c8394a

Download Submit
\Windows\system\hdBAJHm.exe

Filesize
2.3MB

MD5
ee46c302494fdc2d07acffba5057155f

SHA1
4502fe7f103eaf32184e06c062cdf93bd555775b

SHA256
6094a3770d7fafc0af574e2661cfa5d6294b3f7619b7af72f7e29906d2ee8eeb

SHA512
f46c8510e5978c430aabb75d03ee2f247491dec0f79a6b800a0b21d49f90b461a4e9b520c4a5e42c2c31a0c443761e59032d6e0cde3b45a37385b5c891774fd1

Download Submit
\Windows\system\iuaQiiI.exe

Filesize
2.3MB

MD5
9c15572675947888a36796d5753a22ba

SHA1
c4fc04124c4f0eb222303a55e5150053f89667da

SHA256
d3577dba966e74d263645103a8ac08104b9e94730776b4e994660c41d92b8b87

SHA512
8830c44e17fd76e8ae83befff23b49af41b751d136cb7149ef97ffa01cb61ee26fd48dfd40209a4d9205fa7cad4e9addb4dec4e9d378ebea3bdc5b8c1b944f4d

Download Submit
\Windows\system\nbkZTel.exe

Filesize
2.3MB

MD5
8e5c3d3542641d6a15a8670352f1483c

SHA1
20d848b10e43d74796b0964b914d4d672ea0105b

SHA256
ce7eff4c89e76ffa3daf922b9fd21cf9ae26abaca304570499bd47996312acb1

SHA512
ec0c4a686b246a510d693a456d6f480b179e784c494458a8dff631cba4cafcb14548f93088ae49c4b80c06ca2132a60d30a1ce7e9e990e1b7f444c64bb71a231

Download Submit
\Windows\system\oGauXzt.exe

Filesize
2.3MB

MD5
43ba1bcbf914b22b198299b417b7574d

SHA1
06489c564a09e18ccaa995c00af4958790e11d2a

SHA256
9fcfea6e1e8a6982cf215f7bbe1270358fe0a81f15079eacc0979f66b7844189

SHA512
aa2d49de68bf4b67bc980c12d0f763a265d0198d68ba126773d0212332d5a363ac04234113efe0ea7616126f3b15285437654da70fb1be0a817d7d0a921238ae

Download Submit
\Windows\system\pplbuiP.exe

Filesize
2.3MB

MD5
17eda30c20250f5450ac5890d6b10aec

SHA1
f314d1b284e42904af8e32166049b9cdb1b516f3

SHA256
17ea51856d19590418aab9ca80fce9f6f93af7e63072e0ec42fb7dbe940427c8

SHA512
cc4bed659dc00e974d81d9675f983ce81e1b92e54fdd36e76ac5f76778aae5bbc727d3fb1e65bd18e4bdf5c72c5c40175de2db62e31bf14b65f6ad64445385df

Download Submit
\Windows\system\qgTwNoa.exe

Filesize
2.3MB

MD5
9c9116c4f805744058d7b73825fe5a7e

SHA1
069c75cce99a80395613335989ed77692072f280

SHA256
8b8881663bc4e32827d712d0eadeaf5246fbeb88d5981cff77c692d232674bcb

SHA512
e898b715aa33de63d6de4b68b673909a2ee426f4adb50276610be8e475dbb4bad1c912fc6f46d5813ac761d30591399f6e6a40e801ff3bd8fc1e772a2f0b3815

Download Submit
\Windows\system\qvjrqyV.exe

Filesize
2.3MB

MD5
a026f34a54d34cb7cf510802625f2f54

SHA1
20337f5faafa46ad9e2ce2817a2110300b3c5a39

SHA256
cc5e48e4ee1e25c954150fcef7a96fe203c5d71460e3de88e25e43d8804c53d5

SHA512
fea21771e0bc2f8c4a91240fdcfcfbf1e6db2005aff46737a4879f8101588fcf7ae7bfe2e7ae0af11aa9b340e4bd28a6ab90e1e02510ae6fcd91f02c82a8e9ef

Download Submit
\Windows\system\xsBBTeU.exe

Filesize
2.3MB

MD5
2514e5d84d71dafe89dc4311eaa6eb0b

SHA1
2fd9fd7ea7d5b4aa58aa711512fbe6170b482347

SHA256
d1896d6d9e0c6bdeedbdde6a1357e9f5558e55fde90ca111214c00e24768e42c

SHA512
b1181794969b3ed732234706912badcd187e81de43600ea724be9cffa3974a19e04b151078700bf0cb8ed2e262a08f91be42bd99c2f4e43a5a2bf8f8d01d4dc2

Download Submit
\Windows\system\xwHGUZn.exe

Filesize
2.3MB

MD5
7a47b9cb22f7c64b7869a7ce5b451dc8

SHA1
51b9e02b8a1b1ec32e2a9ed057e88be3798a8956

SHA256
fc8dffbfec9891b3ef4adeddfb62309a16d53c9de1fe2a29a45d755efd9c1963

SHA512
5983bba2f86e6c60cace3cacd967becec4bcf64bf8c3c4f70fd1dcf1f210621c37cc45c3c05effb153425d31ef75c03a508ecb7819f5724b89e61cdeb32016a8

Download Submit
\Windows\system\yYyUCIE.exe

Filesize
2.3MB

MD5
d442d891b909470c37715ffd2eb238c9

SHA1
e28f356f04648b72e826e83f95f198b38c7002b8

SHA256
4f37799a5dfef2de9f32192c4d138b63398b38bf64cb55f6cf4f3fc6fcfc4b6a

SHA512
73a6b4b6ccfa3e34a5336ac9f200eae9db7c7d0054ab3bb1db51db63ca26d7d6e1161c89a28ac76179fbfe2f81acd377c545748f81ebb67e9321592e36ea1323

Download Submit
memory/2032-87-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2032-23-0x0000000001EA0000-0x0000000001F20000-memory.dmp

Filesize
512KB

Download
memory/2032-22-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2032-1023-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2032-151-0x0000000001F60000-0x0000000001F68000-memory.dmp

Filesize
32KB

Download
memory/2084-113-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2084-127-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/2084-126-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2084-125-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/2084-124-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/2084-131-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/2084-130-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/2084-129-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2084-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2084-18-0x00000000031F0000-0x00000000035E2000-memory.dmp

Filesize
3.9MB

Download
memory/2084-0-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2084-112-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/2084-110-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2084-8-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2496-128-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2600-103-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-109-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2640-19-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/3064-13-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download