xmrig | e81b746af331095207d84ba53a7ab9d25585c49e0ff9b11a2e736c7a3b37d787

Analysis

max time kernel
31s
max time network
32s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
Size

1.9MB
MD5

08377e9296f614b33f74d8cbc937d626
SHA1

f6248ab89cea3b08ae723ed02504e03f4745fd2a
SHA256

e81b746af331095207d84ba53a7ab9d25585c49e0ff9b11a2e736c7a3b37d787
SHA512

dd69d539f98f873a5a4779a76e01ba775888a03da3be60bf84864f1ac9372a1f95ad07c16f5b82d8386b22dd2abe68129888aae151aa324c9524d70868ac2d94
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UO:NAB/

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2484-138-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2464-147-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/1964-144-0x0000000002F10000-0x0000000003302000-memory.dmp	xmrig
behavioral1/memory/2420-143-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2612-141-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/2696-113-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/2540-52-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2532-46-0x000000013FC10000-0x0000000140002000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2420	xrQjHqL.exe
2532	YjFkiKP.exe
2540	uUmBOqm.exe
2672	aHQehoB.exe
2696	HeEDtvr.exe
2484	GcuTHHM.exe
2612	rzfHOqc.exe
2464	JCwtjPF.exe
2636	pQZGClv.exe
2600	NpGZyln.exe
3016	ZSCpGKn.exe
1740	WhkMiVk.exe
1904	lVweJws.exe
1688	XATSXjN.exe
1480	DievcsS.exe
2436	BBsNbNx.exe
2816	xyfVJRS.exe
2336	lvKcntN.exe
2456	NpwdPNS.exe
2716	jxMiSyn.exe
2504	dwOJCXe.exe
1976	AsemeIt.exe
2020	LRJqlOy.exe
1020	DnluPeZ.exe
1536	gvuIvCk.exe
1348	yDiVHPy.exe
1928	oTeMpnY.exe
2508	iVqGoaf.exe
2768	JVeRxLx.exe
2796	fOceFOz.exe
2880	cPjpriS.exe
692	exrssCj.exe
836	zHKnmha.exe
1540	jRBoOFI.exe
1232	WDXtQLg.exe
1228	jHkDxVh.exe
284	btmBkam.exe
2268	PPoyqSP.exe
1060	DqZVcZE.exe
1076	zrXpXGP.exe
740	fsDwlcO.exe
1432	UEXbZyu.exe
572	uBpPceC.exe
2856	TYKoyvh.exe
2392	KNanmkN.exe
1628	uJCEuUH.exe
2008	aXeQnfw.exe
1608	guQsubv.exe
872	RZpxkMz.exe
2616	pTPwQKt.exe
2520	ePYHxmj.exe
2812	nQzdheS.exe
1744	hOPlPDC.exe
380	xIIQUYG.exe
2224	iylEnih.exe
324	zgEhpjI.exe
1652	YgDLHqK.exe
3008	KbSaZdA.exe
1528	cPTdqVJ.exe
3036	MwZqgNg.exe
1988	tlzKRbt.exe
1036	XMETQfQ.exe
896	lEHumvU.exe
956	MzSuvGz.exe

Loads dropped DLL 64 IoCs

pid	Process
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1964-0-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/files/0x000a0000000126e1-6.dat	upx
behavioral1/files/0x000a00000001329e-7.dat	upx
behavioral1/files/0x00090000000133b9-14.dat	upx
behavioral1/files/0x000800000001342b-12.dat	upx
behavioral1/files/0x0007000000014120-45.dat	upx
behavioral1/files/0x0008000000013928-25.dat	upx
behavioral1/files/0x0006000000014825-106.dat	upx
behavioral1/memory/2484-138-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/files/0x0008000000013a71-133.dat	upx
behavioral1/files/0x0009000000013a11-127.dat	upx
behavioral1/files/0x0006000000014abe-158.dat	upx
behavioral1/files/0x000f000000005578-184.dat	upx
behavioral1/files/0x00060000000147ea-180.dat	upx
behavioral1/files/0x00060000000146b8-178.dat	upx
behavioral1/files/0x0006000000014667-176.dat	upx
behavioral1/files/0x00060000000144ac-174.dat	upx
behavioral1/files/0x000600000001447e-172.dat	upx
behavioral1/files/0x0006000000014b31-169.dat	upx
behavioral1/files/0x00060000000142c4-156.dat	upx
behavioral1/files/0x00060000000141e6-153.dat	upx
behavioral1/files/0x00060000000141a2-152.dat	upx
behavioral1/memory/2464-147-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2420-143-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/2612-141-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/files/0x00060000000149f5-140.dat	upx
behavioral1/files/0x0006000000014390-71.dat	upx
behavioral1/memory/2672-57-0x000000013F690000-0x000000013FA82000-memory.dmp	upx
behavioral1/files/0x00060000000146c0-124.dat	upx
behavioral1/files/0x00060000000146a2-123.dat	upx
behavioral1/files/0x0006000000014539-122.dat	upx
behavioral1/files/0x000600000001448a-121.dat	upx
behavioral1/files/0x00060000000143ec-120.dat	upx
behavioral1/files/0x0006000000014316-119.dat	upx
behavioral1/memory/2696-113-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/files/0x00060000000142b0-110.dat	upx
behavioral1/files/0x000b0000000139b4-96.dat	upx
behavioral1/files/0x000a0000000139e0-33.dat	upx
behavioral1/memory/2540-52-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/files/0x00060000000141c0-50.dat	upx
behavioral1/memory/2532-46-0x000000013FC10000-0x0000000140002000-memory.dmp	upx
behavioral1/files/0x000a000000013a21-44.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CpbOCxx.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\TRLBEkN.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\AuRMFNh.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\iVqGoaf.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\kcYaSYV.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\pMtmlcT.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\mxCKmsZ.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\gRttqSW.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\FssXVaW.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\vBQaFQE.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\fjlpMNA.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\zauXcfG.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\eVEUtqw.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\BoxIQGz.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\grakYwg.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\ksaFkiV.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\NohZxHe.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\UOnQHkQ.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\kyNDpZd.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\tIQBPzz.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\mtsjgfa.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\WhUzIqX.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\cbFOkog.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\NluLQVq.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\EaIWYrP.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\eosTInb.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\TkJcSCR.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\gxEMFMw.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\lvKcntN.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\UJexUKS.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\YTAGYbn.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\xbIvuoF.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\HqkFiVs.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\wLJpkyN.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\viUnKQa.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\UPCUEit.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\ncmuxsD.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\fwhjcaX.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\ZlUeenQ.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\uBpPceC.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\ucCRLZA.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\dxIruHT.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\YjFkiKP.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\iyvvqjK.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\jvDskOG.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\tSQpomz.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\WawfZnD.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\KbSaZdA.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\QJFMHcY.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\ramiZMx.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\GIqrNOy.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\TaMvojY.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\HootHFC.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\pYGZlWG.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\JWVXgDq.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\OPxTKXw.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\zlmrVad.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\pzFIbeC.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\IuHXAnT.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\HYTfrQZ.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\LtLmhpE.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\MHfdKzV.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\ocDqVfj.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
File created	C:\Windows\System\EvyPnxt.exe	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2916	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
Token: SeDebugPrivilege	2916	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2916	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	29
PID 1964 wrote to memory of 2916	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	29
PID 1964 wrote to memory of 2916	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	29
PID 1964 wrote to memory of 2420	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	30
PID 1964 wrote to memory of 2420	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	30
PID 1964 wrote to memory of 2420	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	30
PID 1964 wrote to memory of 2532	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	31
PID 1964 wrote to memory of 2532	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	31
PID 1964 wrote to memory of 2532	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	31
PID 1964 wrote to memory of 2540	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	32
PID 1964 wrote to memory of 2540	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	32
PID 1964 wrote to memory of 2540	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	32
PID 1964 wrote to memory of 2636	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	33
PID 1964 wrote to memory of 2636	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	33
PID 1964 wrote to memory of 2636	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	33
PID 1964 wrote to memory of 2672	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	34
PID 1964 wrote to memory of 2672	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	34
PID 1964 wrote to memory of 2672	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	34
PID 1964 wrote to memory of 2600	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	35
PID 1964 wrote to memory of 2600	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	35
PID 1964 wrote to memory of 2600	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	35
PID 1964 wrote to memory of 2696	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	36
PID 1964 wrote to memory of 2696	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	36
PID 1964 wrote to memory of 2696	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	36
PID 1964 wrote to memory of 2456	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	37
PID 1964 wrote to memory of 2456	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	37
PID 1964 wrote to memory of 2456	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	37
PID 1964 wrote to memory of 2484	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	38
PID 1964 wrote to memory of 2484	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	38
PID 1964 wrote to memory of 2484	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	38
PID 1964 wrote to memory of 2716	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	39
PID 1964 wrote to memory of 2716	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	39
PID 1964 wrote to memory of 2716	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	39
PID 1964 wrote to memory of 2612	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	40
PID 1964 wrote to memory of 2612	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	40
PID 1964 wrote to memory of 2612	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	40
PID 1964 wrote to memory of 2504	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	41
PID 1964 wrote to memory of 2504	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	41
PID 1964 wrote to memory of 2504	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	41
PID 1964 wrote to memory of 2464	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	42
PID 1964 wrote to memory of 2464	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	42
PID 1964 wrote to memory of 2464	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	42
PID 1964 wrote to memory of 1976	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	43
PID 1964 wrote to memory of 1976	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	43
PID 1964 wrote to memory of 1976	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	43
PID 1964 wrote to memory of 3016	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	44
PID 1964 wrote to memory of 3016	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	44
PID 1964 wrote to memory of 3016	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	44
PID 1964 wrote to memory of 2020	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	45
PID 1964 wrote to memory of 2020	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	45
PID 1964 wrote to memory of 2020	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	45
PID 1964 wrote to memory of 1740	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	46
PID 1964 wrote to memory of 1740	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	46
PID 1964 wrote to memory of 1740	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	46
PID 1964 wrote to memory of 1536	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	47
PID 1964 wrote to memory of 1536	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	47
PID 1964 wrote to memory of 1536	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	47
PID 1964 wrote to memory of 1904	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	48
PID 1964 wrote to memory of 1904	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	48
PID 1964 wrote to memory of 1904	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	48
PID 1964 wrote to memory of 1348	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	49
PID 1964 wrote to memory of 1348	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	49
PID 1964 wrote to memory of 1348	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	49
PID 1964 wrote to memory of 1688	1964	08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08377e9296f614b33f74d8cbc937d626_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2916
- C:\Windows\System\xrQjHqL.exe
  C:\Windows\System\xrQjHqL.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\YjFkiKP.exe
  C:\Windows\System\YjFkiKP.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\uUmBOqm.exe
  C:\Windows\System\uUmBOqm.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\pQZGClv.exe
  C:\Windows\System\pQZGClv.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\aHQehoB.exe
  C:\Windows\System\aHQehoB.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\NpGZyln.exe
  C:\Windows\System\NpGZyln.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\HeEDtvr.exe
  C:\Windows\System\HeEDtvr.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\NpwdPNS.exe
  C:\Windows\System\NpwdPNS.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\GcuTHHM.exe
  C:\Windows\System\GcuTHHM.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\jxMiSyn.exe
  C:\Windows\System\jxMiSyn.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\rzfHOqc.exe
  C:\Windows\System\rzfHOqc.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\dwOJCXe.exe
  C:\Windows\System\dwOJCXe.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\JCwtjPF.exe
  C:\Windows\System\JCwtjPF.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\AsemeIt.exe
  C:\Windows\System\AsemeIt.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\ZSCpGKn.exe
  C:\Windows\System\ZSCpGKn.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\LRJqlOy.exe
  C:\Windows\System\LRJqlOy.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\WhkMiVk.exe
  C:\Windows\System\WhkMiVk.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\gvuIvCk.exe
  C:\Windows\System\gvuIvCk.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\lVweJws.exe
  C:\Windows\System\lVweJws.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\yDiVHPy.exe
  C:\Windows\System\yDiVHPy.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\XATSXjN.exe
  C:\Windows\System\XATSXjN.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\oTeMpnY.exe
  C:\Windows\System\oTeMpnY.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\DievcsS.exe
  C:\Windows\System\DievcsS.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\iVqGoaf.exe
  C:\Windows\System\iVqGoaf.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\BBsNbNx.exe
  C:\Windows\System\BBsNbNx.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\JVeRxLx.exe
  C:\Windows\System\JVeRxLx.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\xyfVJRS.exe
  C:\Windows\System\xyfVJRS.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\fOceFOz.exe
  C:\Windows\System\fOceFOz.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\lvKcntN.exe
  C:\Windows\System\lvKcntN.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\exrssCj.exe
  C:\Windows\System\exrssCj.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\DnluPeZ.exe
  C:\Windows\System\DnluPeZ.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\zHKnmha.exe
  C:\Windows\System\zHKnmha.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\cPjpriS.exe
  C:\Windows\System\cPjpriS.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\jRBoOFI.exe
  C:\Windows\System\jRBoOFI.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\WDXtQLg.exe
  C:\Windows\System\WDXtQLg.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\jHkDxVh.exe
  C:\Windows\System\jHkDxVh.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\btmBkam.exe
  C:\Windows\System\btmBkam.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\PPoyqSP.exe
  C:\Windows\System\PPoyqSP.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\DqZVcZE.exe
  C:\Windows\System\DqZVcZE.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\zrXpXGP.exe
  C:\Windows\System\zrXpXGP.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\fsDwlcO.exe
  C:\Windows\System\fsDwlcO.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\UEXbZyu.exe
  C:\Windows\System\UEXbZyu.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\uBpPceC.exe
  C:\Windows\System\uBpPceC.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\iylEnih.exe
  C:\Windows\System\iylEnih.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\TYKoyvh.exe
  C:\Windows\System\TYKoyvh.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\MwZqgNg.exe
  C:\Windows\System\MwZqgNg.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\KNanmkN.exe
  C:\Windows\System\KNanmkN.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\lEHumvU.exe
  C:\Windows\System\lEHumvU.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\uJCEuUH.exe
  C:\Windows\System\uJCEuUH.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\MzSuvGz.exe
  C:\Windows\System\MzSuvGz.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\aXeQnfw.exe
  C:\Windows\System\aXeQnfw.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\akYVfug.exe
  C:\Windows\System\akYVfug.exe
  2⤵
  PID:2680
- C:\Windows\System\guQsubv.exe
  C:\Windows\System\guQsubv.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\zymWWDg.exe
  C:\Windows\System\zymWWDg.exe
  2⤵
  PID:2896
- C:\Windows\System\RZpxkMz.exe
  C:\Windows\System\RZpxkMz.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\hGtHTNl.exe
  C:\Windows\System\hGtHTNl.exe
  2⤵
  PID:2580
- C:\Windows\System\pTPwQKt.exe
  C:\Windows\System\pTPwQKt.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\lPvwDhP.exe
  C:\Windows\System\lPvwDhP.exe
  2⤵
  PID:2496
- C:\Windows\System\ePYHxmj.exe
  C:\Windows\System\ePYHxmj.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\LRVTJNw.exe
  C:\Windows\System\LRVTJNw.exe
  2⤵
  PID:2984
- C:\Windows\System\nQzdheS.exe
  C:\Windows\System\nQzdheS.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\AohUzwF.exe
  C:\Windows\System\AohUzwF.exe
  2⤵
  PID:1932
- C:\Windows\System\hOPlPDC.exe
  C:\Windows\System\hOPlPDC.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\EOTrHsA.exe
  C:\Windows\System\EOTrHsA.exe
  2⤵
  PID:1656
- C:\Windows\System\xIIQUYG.exe
  C:\Windows\System\xIIQUYG.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\MdRxCsJ.exe
  C:\Windows\System\MdRxCsJ.exe
  2⤵
  PID:1872
- C:\Windows\System\zgEhpjI.exe
  C:\Windows\System\zgEhpjI.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\gpRYyce.exe
  C:\Windows\System\gpRYyce.exe
  2⤵
  PID:488
- C:\Windows\System\YgDLHqK.exe
  C:\Windows\System\YgDLHqK.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\LobWMKP.exe
  C:\Windows\System\LobWMKP.exe
  2⤵
  PID:1728
- C:\Windows\System\KbSaZdA.exe
  C:\Windows\System\KbSaZdA.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\lthHRdt.exe
  C:\Windows\System\lthHRdt.exe
  2⤵
  PID:2964
- C:\Windows\System\cPTdqVJ.exe
  C:\Windows\System\cPTdqVJ.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\MHfdKzV.exe
  C:\Windows\System\MHfdKzV.exe
  2⤵
  PID:2728
- C:\Windows\System\tlzKRbt.exe
  C:\Windows\System\tlzKRbt.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\KNeCeMf.exe
  C:\Windows\System\KNeCeMf.exe
  2⤵
  PID:2072
- C:\Windows\System\XMETQfQ.exe
  C:\Windows\System\XMETQfQ.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\EzGWddL.exe
  C:\Windows\System\EzGWddL.exe
  2⤵
  PID:2356
- C:\Windows\System\EsKTxHE.exe
  C:\Windows\System\EsKTxHE.exe
  2⤵
  PID:2704
- C:\Windows\System\yOyQxcR.exe
  C:\Windows\System\yOyQxcR.exe
  2⤵
  PID:2592
- C:\Windows\System\bafGOTf.exe
  C:\Windows\System\bafGOTf.exe
  2⤵
  PID:2804
- C:\Windows\System\DMbqZwS.exe
  C:\Windows\System\DMbqZwS.exe
  2⤵
  PID:1684
- C:\Windows\System\rCRxPDE.exe
  C:\Windows\System\rCRxPDE.exe
  2⤵
  PID:2560
- C:\Windows\System\vVCOnrI.exe
  C:\Windows\System\vVCOnrI.exe
  2⤵
  PID:2840
- C:\Windows\System\nbGLhnB.exe
  C:\Windows\System\nbGLhnB.exe
  2⤵
  PID:1196
- C:\Windows\System\zxhxLgi.exe
  C:\Windows\System\zxhxLgi.exe
  2⤵
  PID:2156
- C:\Windows\System\LjXYDkE.exe
  C:\Windows\System\LjXYDkE.exe
  2⤵
  PID:2940
- C:\Windows\System\BlsJHXp.exe
  C:\Windows\System\BlsJHXp.exe
  2⤵
  PID:1996
- C:\Windows\System\MtRdyAQ.exe
  C:\Windows\System\MtRdyAQ.exe
  2⤵
  PID:1456
- C:\Windows\System\qzXtUJX.exe
  C:\Windows\System\qzXtUJX.exe
  2⤵
  PID:1556
- C:\Windows\System\qEhqbDs.exe
  C:\Windows\System\qEhqbDs.exe
  2⤵
  PID:1616
- C:\Windows\System\UQENxoe.exe
  C:\Windows\System\UQENxoe.exe
  2⤵
  PID:1160
- C:\Windows\System\tlzIRBE.exe
  C:\Windows\System\tlzIRBE.exe
  2⤵
  PID:2780
- C:\Windows\System\LBvefQj.exe
  C:\Windows\System\LBvefQj.exe
  2⤵
  PID:3048
- C:\Windows\System\LkPctqb.exe
  C:\Windows\System\LkPctqb.exe
  2⤵
  PID:1192
- C:\Windows\System\HDXuWqw.exe
  C:\Windows\System\HDXuWqw.exe
  2⤵
  PID:2264
- C:\Windows\System\DUzVsNd.exe
  C:\Windows\System\DUzVsNd.exe
  2⤵
  PID:2236
- C:\Windows\System\LXpFfhM.exe
  C:\Windows\System\LXpFfhM.exe
  2⤵
  PID:2572
- C:\Windows\System\uUBdrqz.exe
  C:\Windows\System\uUBdrqz.exe
  2⤵
  PID:2952
- C:\Windows\System\YlPxEtg.exe
  C:\Windows\System\YlPxEtg.exe
  2⤵
  PID:1040
- C:\Windows\System\GUPYRjO.exe
  C:\Windows\System\GUPYRjO.exe
  2⤵
  PID:2424
- C:\Windows\System\MObFhFz.exe
  C:\Windows\System\MObFhFz.exe
  2⤵
  PID:2824
- C:\Windows\System\rZbZyjn.exe
  C:\Windows\System\rZbZyjn.exe
  2⤵
  PID:2808
- C:\Windows\System\bJRrepv.exe
  C:\Windows\System\bJRrepv.exe
  2⤵
  PID:1600
- C:\Windows\System\auySlux.exe
  C:\Windows\System\auySlux.exe
  2⤵
  PID:1072
- C:\Windows\System\fNfnsbL.exe
  C:\Windows\System\fNfnsbL.exe
  2⤵
  PID:412
- C:\Windows\System\FifUCja.exe
  C:\Windows\System\FifUCja.exe
  2⤵
  PID:2252
- C:\Windows\System\LGTCRTE.exe
  C:\Windows\System\LGTCRTE.exe
  2⤵
  PID:688
- C:\Windows\System\drKjzat.exe
  C:\Windows\System\drKjzat.exe
  2⤵
  PID:3032
- C:\Windows\System\oiibENP.exe
  C:\Windows\System\oiibENP.exe
  2⤵
  PID:1712
- C:\Windows\System\bXlAQnh.exe
  C:\Windows\System\bXlAQnh.exe
  2⤵
  PID:2664
- C:\Windows\System\GIqrNOy.exe
  C:\Windows\System\GIqrNOy.exe
  2⤵
  PID:2128
- C:\Windows\System\tmoxqvq.exe
  C:\Windows\System\tmoxqvq.exe
  2⤵
  PID:2688
- C:\Windows\System\KtbwRnW.exe
  C:\Windows\System\KtbwRnW.exe
  2⤵
  PID:2584
- C:\Windows\System\AOrgiMg.exe
  C:\Windows\System\AOrgiMg.exe
  2⤵
  PID:584
- C:\Windows\System\VCXFXoK.exe
  C:\Windows\System\VCXFXoK.exe
  2⤵
  PID:1940
- C:\Windows\System\ZERrODC.exe
  C:\Windows\System\ZERrODC.exe
  2⤵
  PID:2176
- C:\Windows\System\MYIdHBR.exe
  C:\Windows\System\MYIdHBR.exe
  2⤵
  PID:2200
- C:\Windows\System\CBbKVnP.exe
  C:\Windows\System\CBbKVnP.exe
  2⤵
  PID:952
- C:\Windows\System\TEsGbwk.exe
  C:\Windows\System\TEsGbwk.exe
  2⤵
  PID:2260
- C:\Windows\System\mhtAQMS.exe
  C:\Windows\System\mhtAQMS.exe
  2⤵
  PID:2760
- C:\Windows\System\UZFykHQ.exe
  C:\Windows\System\UZFykHQ.exe
  2⤵
  PID:1624
- C:\Windows\System\lAYWJlU.exe
  C:\Windows\System\lAYWJlU.exe
  2⤵
  PID:1588
- C:\Windows\System\pBBLHid.exe
  C:\Windows\System\pBBLHid.exe
  2⤵
  PID:904
- C:\Windows\System\vGNMAtW.exe
  C:\Windows\System\vGNMAtW.exe
  2⤵
  PID:2708
- C:\Windows\System\NHuuDxb.exe
  C:\Windows\System\NHuuDxb.exe
  2⤵
  PID:704
- C:\Windows\System\rrxSxFg.exe
  C:\Windows\System\rrxSxFg.exe
  2⤵
  PID:1924
- C:\Windows\System\zlmrVad.exe
  C:\Windows\System\zlmrVad.exe
  2⤵
  PID:2052
- C:\Windows\System\TOXudVM.exe
  C:\Windows\System\TOXudVM.exe
  2⤵
  PID:2860
- C:\Windows\System\ToJWvil.exe
  C:\Windows\System\ToJWvil.exe
  2⤵
  PID:1916
- C:\Windows\System\DaOhuRk.exe
  C:\Windows\System\DaOhuRk.exe
  2⤵
  PID:2472
- C:\Windows\System\LvvwktO.exe
  C:\Windows\System\LvvwktO.exe
  2⤵
  PID:1152
- C:\Windows\System\BvfMCLN.exe
  C:\Windows\System\BvfMCLN.exe
  2⤵
  PID:2648
- C:\Windows\System\rLhreWL.exe
  C:\Windows\System\rLhreWL.exe
  2⤵
  PID:3080
- C:\Windows\System\iFRbwCA.exe
  C:\Windows\System\iFRbwCA.exe
  2⤵
  PID:3096
- C:\Windows\System\UJexUKS.exe
  C:\Windows\System\UJexUKS.exe
  2⤵
  PID:3116
- C:\Windows\System\skTEIiy.exe
  C:\Windows\System\skTEIiy.exe
  2⤵
  PID:3132
- C:\Windows\System\dfdTckx.exe
  C:\Windows\System\dfdTckx.exe
  2⤵
  PID:3148
- C:\Windows\System\eRmxtFA.exe
  C:\Windows\System\eRmxtFA.exe
  2⤵
  PID:3164
- C:\Windows\System\vPwMhvA.exe
  C:\Windows\System\vPwMhvA.exe
  2⤵
  PID:3180
- C:\Windows\System\kcYaSYV.exe
  C:\Windows\System\kcYaSYV.exe
  2⤵
  PID:3196
- C:\Windows\System\UchsTAN.exe
  C:\Windows\System\UchsTAN.exe
  2⤵
  PID:3212
- C:\Windows\System\wekKrPl.exe
  C:\Windows\System\wekKrPl.exe
  2⤵
  PID:3236
- C:\Windows\System\MdDaqkr.exe
  C:\Windows\System\MdDaqkr.exe
  2⤵
  PID:3252
- C:\Windows\System\hPghqHn.exe
  C:\Windows\System\hPghqHn.exe
  2⤵
  PID:3268
- C:\Windows\System\pzFIbeC.exe
  C:\Windows\System\pzFIbeC.exe
  2⤵
  PID:3284
- C:\Windows\System\ESewPmF.exe
  C:\Windows\System\ESewPmF.exe
  2⤵
  PID:3300
- C:\Windows\System\BAcVTeH.exe
  C:\Windows\System\BAcVTeH.exe
  2⤵
  PID:3316
- C:\Windows\System\CZWLNkS.exe
  C:\Windows\System\CZWLNkS.exe
  2⤵
  PID:3332
- C:\Windows\System\zTqnMvH.exe
  C:\Windows\System\zTqnMvH.exe
  2⤵
  PID:3348
- C:\Windows\System\xpahSKL.exe
  C:\Windows\System\xpahSKL.exe
  2⤵
  PID:3364
- C:\Windows\System\TwLrrsd.exe
  C:\Windows\System\TwLrrsd.exe
  2⤵
  PID:3380
- C:\Windows\System\puBiDeo.exe
  C:\Windows\System\puBiDeo.exe
  2⤵
  PID:3396
- C:\Windows\System\yMjVPbD.exe
  C:\Windows\System\yMjVPbD.exe
  2⤵
  PID:3412
- C:\Windows\System\LlrKdGT.exe
  C:\Windows\System\LlrKdGT.exe
  2⤵
  PID:3428
- C:\Windows\System\nVyVokt.exe
  C:\Windows\System\nVyVokt.exe
  2⤵
  PID:3444
- C:\Windows\System\RogfMbk.exe
  C:\Windows\System\RogfMbk.exe
  2⤵
  PID:3460
- C:\Windows\System\BVFphoD.exe
  C:\Windows\System\BVFphoD.exe
  2⤵
  PID:3476
- C:\Windows\System\LpAoaCJ.exe
  C:\Windows\System\LpAoaCJ.exe
  2⤵
  PID:3492
- C:\Windows\System\zpwwrVI.exe
  C:\Windows\System\zpwwrVI.exe
  2⤵
  PID:3508
- C:\Windows\System\TaMvojY.exe
  C:\Windows\System\TaMvojY.exe
  2⤵
  PID:3540
- C:\Windows\System\ZwhiYWx.exe
  C:\Windows\System\ZwhiYWx.exe
  2⤵
  PID:3556
- C:\Windows\System\mTLBQqv.exe
  C:\Windows\System\mTLBQqv.exe
  2⤵
  PID:3576
- C:\Windows\System\ebQEqcU.exe
  C:\Windows\System\ebQEqcU.exe
  2⤵
  PID:3592
- C:\Windows\System\FXdGOdB.exe
  C:\Windows\System\FXdGOdB.exe
  2⤵
  PID:3608
- C:\Windows\System\mJBKuan.exe
  C:\Windows\System\mJBKuan.exe
  2⤵
  PID:3628
- C:\Windows\System\kFHyeQZ.exe
  C:\Windows\System\kFHyeQZ.exe
  2⤵
  PID:3648
- C:\Windows\System\OqCZZcl.exe
  C:\Windows\System\OqCZZcl.exe
  2⤵
  PID:3664
- C:\Windows\System\SROXFKw.exe
  C:\Windows\System\SROXFKw.exe
  2⤵
  PID:3684
- C:\Windows\System\dpITEVq.exe
  C:\Windows\System\dpITEVq.exe
  2⤵
  PID:3736
- C:\Windows\System\XxVIgZY.exe
  C:\Windows\System\XxVIgZY.exe
  2⤵
  PID:3752
- C:\Windows\System\FqehCZM.exe
  C:\Windows\System\FqehCZM.exe
  2⤵
  PID:3768
- C:\Windows\System\xAmFBJr.exe
  C:\Windows\System\xAmFBJr.exe
  2⤵
  PID:3784
- C:\Windows\System\hoepkXf.exe
  C:\Windows\System\hoepkXf.exe
  2⤵
  PID:3800
- C:\Windows\System\qNDOuwi.exe
  C:\Windows\System\qNDOuwi.exe
  2⤵
  PID:3816
- C:\Windows\System\lXubUVz.exe
  C:\Windows\System\lXubUVz.exe
  2⤵
  PID:3832
- C:\Windows\System\RQcOZYu.exe
  C:\Windows\System\RQcOZYu.exe
  2⤵
  PID:3848
- C:\Windows\System\wysqTXL.exe
  C:\Windows\System\wysqTXL.exe
  2⤵
  PID:3864
- C:\Windows\System\kHYqSCb.exe
  C:\Windows\System\kHYqSCb.exe
  2⤵
  PID:3880
- C:\Windows\System\qylKOEt.exe
  C:\Windows\System\qylKOEt.exe
  2⤵
  PID:3896
- C:\Windows\System\CBThchS.exe
  C:\Windows\System\CBThchS.exe
  2⤵
  PID:3912
- C:\Windows\System\qiMDAaH.exe
  C:\Windows\System\qiMDAaH.exe
  2⤵
  PID:3928
- C:\Windows\System\sxfBGsk.exe
  C:\Windows\System\sxfBGsk.exe
  2⤵
  PID:3944
- C:\Windows\System\RImYfLV.exe
  C:\Windows\System\RImYfLV.exe
  2⤵
  PID:3960
- C:\Windows\System\fkdiHFA.exe
  C:\Windows\System\fkdiHFA.exe
  2⤵
  PID:3976
- C:\Windows\System\CRYwKKU.exe
  C:\Windows\System\CRYwKKU.exe
  2⤵
  PID:3992
- C:\Windows\System\XZMYuES.exe
  C:\Windows\System\XZMYuES.exe
  2⤵
  PID:4008
- C:\Windows\System\ApUQQlj.exe
  C:\Windows\System\ApUQQlj.exe
  2⤵
  PID:4024
- C:\Windows\System\GDqDPto.exe
  C:\Windows\System\GDqDPto.exe
  2⤵
  PID:4040
- C:\Windows\System\fhZingx.exe
  C:\Windows\System\fhZingx.exe
  2⤵
  PID:4056
- C:\Windows\System\apdptSm.exe
  C:\Windows\System\apdptSm.exe
  2⤵
  PID:4072
- C:\Windows\System\kyNDpZd.exe
  C:\Windows\System\kyNDpZd.exe
  2⤵
  PID:4088
- C:\Windows\System\qhUSlcf.exe
  C:\Windows\System\qhUSlcf.exe
  2⤵
  PID:3020
- C:\Windows\System\mLOCBVQ.exe
  C:\Windows\System\mLOCBVQ.exe
  2⤵
  PID:2344
- C:\Windows\System\yXMlfLa.exe
  C:\Windows\System\yXMlfLa.exe
  2⤵
  PID:3112
- C:\Windows\System\kuHuuJm.exe
  C:\Windows\System\kuHuuJm.exe
  2⤵
  PID:3140
- C:\Windows\System\ykSMSuy.exe
  C:\Windows\System\ykSMSuy.exe
  2⤵
  PID:3204
- C:\Windows\System\wWWTPoU.exe
  C:\Windows\System\wWWTPoU.exe
  2⤵
  PID:2772
- C:\Windows\System\fPmtKaJ.exe
  C:\Windows\System\fPmtKaJ.exe
  2⤵
  PID:2692
- C:\Windows\System\Lfoqwcd.exe
  C:\Windows\System\Lfoqwcd.exe
  2⤵
  PID:3340
- C:\Windows\System\UxFCQOP.exe
  C:\Windows\System\UxFCQOP.exe
  2⤵
  PID:3404
- C:\Windows\System\sqIluur.exe
  C:\Windows\System\sqIluur.exe
  2⤵
  PID:3468
- C:\Windows\System\iAyPbkx.exe
  C:\Windows\System\iAyPbkx.exe
  2⤵
  PID:3548
- C:\Windows\System\hJkhIdq.exe
  C:\Windows\System\hJkhIdq.exe
  2⤵
  PID:2968
- C:\Windows\System\cfFodmY.exe
  C:\Windows\System\cfFodmY.exe
  2⤵
  PID:1784
- C:\Windows\System\egRzoiO.exe
  C:\Windows\System\egRzoiO.exe
  2⤵
  PID:1868
- C:\Windows\System\pwpXxqa.exe
  C:\Windows\System\pwpXxqa.exe
  2⤵
  PID:3616
- C:\Windows\System\FrREUrr.exe
  C:\Windows\System\FrREUrr.exe
  2⤵
  PID:3660
- C:\Windows\System\odjJcOn.exe
  C:\Windows\System\odjJcOn.exe
  2⤵
  PID:3704
- C:\Windows\System\mlKhCic.exe
  C:\Windows\System\mlKhCic.exe
  2⤵
  PID:3720
- C:\Windows\System\gMMPTDl.exe
  C:\Windows\System\gMMPTDl.exe
  2⤵
  PID:2588
- C:\Windows\System\kMVVlXR.exe
  C:\Windows\System\kMVVlXR.exe
  2⤵
  PID:2076
- C:\Windows\System\cNtgVVW.exe
  C:\Windows\System\cNtgVVW.exe
  2⤵
  PID:1140
- C:\Windows\System\DGtXsVt.exe
  C:\Windows\System\DGtXsVt.exe
  2⤵
  PID:3068
- C:\Windows\System\vMPBAKC.exe
  C:\Windows\System\vMPBAKC.exe
  2⤵
  PID:1612
- C:\Windows\System\hCNZEOg.exe
  C:\Windows\System\hCNZEOg.exe
  2⤵
  PID:3092
- C:\Windows\System\bDmgIHP.exe
  C:\Windows\System\bDmgIHP.exe
  2⤵
  PID:3188
- C:\Windows\System\mUwlYuG.exe
  C:\Windows\System\mUwlYuG.exe
  2⤵
  PID:3360
- C:\Windows\System\qgVrZSp.exe
  C:\Windows\System\qgVrZSp.exe
  2⤵
  PID:3528
- C:\Windows\System\KABfqet.exe
  C:\Windows\System\KABfqet.exe
  2⤵
  PID:3568
- C:\Windows\System\cjpWZxz.exe
  C:\Windows\System\cjpWZxz.exe
  2⤵
  PID:3636
- C:\Windows\System\TSROSeK.exe
  C:\Windows\System\TSROSeK.exe
  2⤵
  PID:3676
- C:\Windows\System\BLPVSMn.exe
  C:\Windows\System\BLPVSMn.exe
  2⤵
  PID:3924
- C:\Windows\System\eSpemQP.exe
  C:\Windows\System\eSpemQP.exe
  2⤵
  PID:2488
- C:\Windows\System\wpsKPwT.exe
  C:\Windows\System\wpsKPwT.exe
  2⤵
  PID:3940
- C:\Windows\System\bsGqnLt.exe
  C:\Windows\System\bsGqnLt.exe
  2⤵
  PID:3972
- C:\Windows\System\xhBNezn.exe
  C:\Windows\System\xhBNezn.exe
  2⤵
  PID:4020
- C:\Windows\System\yqDcUhz.exe
  C:\Windows\System\yqDcUhz.exe
  2⤵
  PID:2284
- C:\Windows\System\vsCslYV.exe
  C:\Windows\System\vsCslYV.exe
  2⤵
  PID:4080
- C:\Windows\System\pVBwzVc.exe
  C:\Windows\System\pVBwzVc.exe
  2⤵
  PID:1632
- C:\Windows\System\hOahmvY.exe
  C:\Windows\System\hOahmvY.exe
  2⤵
  PID:2724
- C:\Windows\System\QtYutIN.exe
  C:\Windows\System\QtYutIN.exe
  2⤵
  PID:2528
- C:\Windows\System\rgdJzBf.exe
  C:\Windows\System\rgdJzBf.exe
  2⤵
  PID:3248
- C:\Windows\System\GnVbdPL.exe
  C:\Windows\System\GnVbdPL.exe
  2⤵
  PID:3308
- C:\Windows\System\twnVQoI.exe
  C:\Windows\System\twnVQoI.exe
  2⤵
  PID:3440
- C:\Windows\System\sWTTSfH.exe
  C:\Windows\System\sWTTSfH.exe
  2⤵
  PID:1328
- C:\Windows\System\IMTmFxc.exe
  C:\Windows\System\IMTmFxc.exe
  2⤵
  PID:1472
- C:\Windows\System\bETObdv.exe
  C:\Windows\System\bETObdv.exe
  2⤵
  PID:1824
- C:\Windows\System\GgOaTkw.exe
  C:\Windows\System\GgOaTkw.exe
  2⤵
  PID:2476
- C:\Windows\System\IcdfAOi.exe
  C:\Windows\System\IcdfAOi.exe
  2⤵
  PID:3712
- C:\Windows\System\XCyCzQW.exe
  C:\Windows\System\XCyCzQW.exe
  2⤵
  PID:1992
- C:\Windows\System\ptmnAdO.exe
  C:\Windows\System\ptmnAdO.exe
  2⤵
  PID:1484
- C:\Windows\System\oXdlbxT.exe
  C:\Windows\System\oXdlbxT.exe
  2⤵
  PID:1212
- C:\Windows\System\wyARoTM.exe
  C:\Windows\System\wyARoTM.exe
  2⤵
  PID:2872
- C:\Windows\System\dZoPzmB.exe
  C:\Windows\System\dZoPzmB.exe
  2⤵
  PID:632
- C:\Windows\System\aVyNrJl.exe
  C:\Windows\System\aVyNrJl.exe
  2⤵
  PID:3192
- C:\Windows\System\rqJRtMl.exe
  C:\Windows\System\rqJRtMl.exe
  2⤵
  PID:3232
- C:\Windows\System\mPEmtTZ.exe
  C:\Windows\System\mPEmtTZ.exe
  2⤵
  PID:3296
- C:\Windows\System\JvLteFZ.exe
  C:\Windows\System\JvLteFZ.exe
  2⤵
  PID:3392
- C:\Windows\System\KUfdiJu.exe
  C:\Windows\System\KUfdiJu.exe
  2⤵
  PID:3484
- C:\Windows\System\UfYCowr.exe
  C:\Windows\System\UfYCowr.exe
  2⤵
  PID:3524
- C:\Windows\System\RyxioXg.exe
  C:\Windows\System\RyxioXg.exe
  2⤵
  PID:2084
- C:\Windows\System\lzDmotf.exe
  C:\Windows\System\lzDmotf.exe
  2⤵
  PID:2340
- C:\Windows\System\qBOwNyf.exe
  C:\Windows\System\qBOwNyf.exe
  2⤵
  PID:3536
- C:\Windows\System\ubPxRNo.exe
  C:\Windows\System\ubPxRNo.exe
  2⤵
  PID:2608
- C:\Windows\System\BulnaQu.exe
  C:\Windows\System\BulnaQu.exe
  2⤵
  PID:3776
- C:\Windows\System\tcuAwyy.exe
  C:\Windows\System\tcuAwyy.exe
  2⤵
  PID:3828
- C:\Windows\System\zUuqtBB.exe
  C:\Windows\System\zUuqtBB.exe
  2⤵
  PID:3840
- C:\Windows\System\VWDgOqm.exe
  C:\Windows\System\VWDgOqm.exe
  2⤵
  PID:3732
- C:\Windows\System\rFtirUJ.exe
  C:\Windows\System\rFtirUJ.exe
  2⤵
  PID:3844
- C:\Windows\System\hFiIrBR.exe
  C:\Windows\System\hFiIrBR.exe
  2⤵
  PID:876
- C:\Windows\System\pihYINg.exe
  C:\Windows\System\pihYINg.exe
  2⤵
  PID:4004
- C:\Windows\System\qKqIfdi.exe
  C:\Windows\System\qKqIfdi.exe
  2⤵
  PID:3104
- C:\Windows\System\twJvluy.exe
  C:\Windows\System\twJvluy.exe
  2⤵
  PID:2512
- C:\Windows\System\iWMIYgw.exe
  C:\Windows\System\iWMIYgw.exe
  2⤵
  PID:3588
- C:\Windows\System\nsTGaIb.exe
  C:\Windows\System\nsTGaIb.exe
  2⤵
  PID:3936
- C:\Windows\System\ZBfVVjs.exe
  C:\Windows\System\ZBfVVjs.exe
  2⤵
  PID:3172
- C:\Windows\System\dkTPtKn.exe
  C:\Windows\System\dkTPtKn.exe
  2⤵
  PID:3584
- C:\Windows\System\DUFhRcF.exe
  C:\Windows\System\DUFhRcF.exe
  2⤵
  PID:2280
- C:\Windows\System\UacYsXU.exe
  C:\Windows\System\UacYsXU.exe
  2⤵
  PID:3228
- C:\Windows\System\ocDqVfj.exe
  C:\Windows\System\ocDqVfj.exe
  2⤵
  PID:3264
- C:\Windows\System\dEuuPkt.exe
  C:\Windows\System\dEuuPkt.exe
  2⤵
  PID:3452
- C:\Windows\System\wfZUKvH.exe
  C:\Windows\System\wfZUKvH.exe
  2⤵
  PID:1448
- C:\Windows\System\HefOPNZ.exe
  C:\Windows\System\HefOPNZ.exe
  2⤵
  PID:2764
- C:\Windows\System\XJlxdEq.exe
  C:\Windows\System\XJlxdEq.exe
  2⤵
  PID:3748
- C:\Windows\System\ZUnPrEA.exe
  C:\Windows\System\ZUnPrEA.exe
  2⤵
  PID:1476
- C:\Windows\System\pQZHewM.exe
  C:\Windows\System\pQZHewM.exe
  2⤵
  PID:2656
- C:\Windows\System\KVbJHyW.exe
  C:\Windows\System\KVbJHyW.exe
  2⤵
  PID:3456
- C:\Windows\System\PLuKFpR.exe
  C:\Windows\System\PLuKFpR.exe
  2⤵
  PID:1444
- C:\Windows\System\BecHbIY.exe
  C:\Windows\System\BecHbIY.exe
  2⤵
  PID:1164
- C:\Windows\System\GApxAqy.exe
  C:\Windows\System\GApxAqy.exe
  2⤵
  PID:3824
- C:\Windows\System\MipwqWT.exe
  C:\Windows\System\MipwqWT.exe
  2⤵
  PID:1300
- C:\Windows\System\lWjHqmk.exe
  C:\Windows\System\lWjHqmk.exe
  2⤵
  PID:2668
- C:\Windows\System\PvkmQEo.exe
  C:\Windows\System\PvkmQEo.exe
  2⤵
  PID:2208
- C:\Windows\System\NQngaPg.exe
  C:\Windows\System\NQngaPg.exe
  2⤵
  PID:4032
- C:\Windows\System\XcEEWrm.exe
  C:\Windows\System\XcEEWrm.exe
  2⤵
  PID:3728
- C:\Windows\System\nVRQdte.exe
  C:\Windows\System\nVRQdte.exe
  2⤵
  PID:3516
- C:\Windows\System\MFDrFzL.exe
  C:\Windows\System\MFDrFzL.exe
  2⤵
  PID:1532
- C:\Windows\System\SRqyeXS.exe
  C:\Windows\System\SRqyeXS.exe
  2⤵
  PID:3812
- C:\Windows\System\MiCmThL.exe
  C:\Windows\System\MiCmThL.exe
  2⤵
  PID:3224
- C:\Windows\System\fqgIdYE.exe
  C:\Windows\System\fqgIdYE.exe
  2⤵
  PID:3436
- C:\Windows\System\SFobARX.exe
  C:\Windows\System\SFobARX.exe
  2⤵
  PID:288
- C:\Windows\System\YTAGYbn.exe
  C:\Windows\System\YTAGYbn.exe
  2⤵
  PID:3792
- C:\Windows\System\tuzkuYp.exe
  C:\Windows\System\tuzkuYp.exe
  2⤵
  PID:1832
- C:\Windows\System\lTfqJZT.exe
  C:\Windows\System\lTfqJZT.exe
  2⤵
  PID:3644
- C:\Windows\System\FndKbxD.exe
  C:\Windows\System\FndKbxD.exe
  2⤵
  PID:3808
- C:\Windows\System\FEqwNTz.exe
  C:\Windows\System\FEqwNTz.exe
  2⤵
  PID:1564
- C:\Windows\System\aYZGMdO.exe
  C:\Windows\System\aYZGMdO.exe
  2⤵
  PID:3724
- C:\Windows\System\BsJQxYy.exe
  C:\Windows\System\BsJQxYy.exe
  2⤵
  PID:3376
- C:\Windows\System\skbtRbP.exe
  C:\Windows\System\skbtRbP.exe
  2⤵
  PID:4052
- C:\Windows\System\TPTExSS.exe
  C:\Windows\System\TPTExSS.exe
  2⤵
  PID:4100
- C:\Windows\System\WwzDZcX.exe
  C:\Windows\System\WwzDZcX.exe
  2⤵
  PID:4116
- C:\Windows\System\zUsnPWx.exe
  C:\Windows\System\zUsnPWx.exe
  2⤵
  PID:4132
- C:\Windows\System\qkoOeyb.exe
  C:\Windows\System\qkoOeyb.exe
  2⤵
  PID:4148
- C:\Windows\System\CEzbErP.exe
  C:\Windows\System\CEzbErP.exe
  2⤵
  PID:4164
- C:\Windows\System\xDHwlbc.exe
  C:\Windows\System\xDHwlbc.exe
  2⤵
  PID:4180
- C:\Windows\System\ntTzGAW.exe
  C:\Windows\System\ntTzGAW.exe
  2⤵
  PID:4200
- C:\Windows\System\PSmuuxH.exe
  C:\Windows\System\PSmuuxH.exe
  2⤵
  PID:4216
- C:\Windows\System\YvqMbBe.exe
  C:\Windows\System\YvqMbBe.exe
  2⤵
  PID:4232
- C:\Windows\System\KpveaDO.exe
  C:\Windows\System\KpveaDO.exe
  2⤵
  PID:4248
- C:\Windows\System\DXxvgSG.exe
  C:\Windows\System\DXxvgSG.exe
  2⤵
  PID:4264
- C:\Windows\System\ehPEAAK.exe
  C:\Windows\System\ehPEAAK.exe
  2⤵
  PID:4280
- C:\Windows\System\Vroency.exe
  C:\Windows\System\Vroency.exe
  2⤵
  PID:4296
- C:\Windows\System\iVOqCRq.exe
  C:\Windows\System\iVOqCRq.exe
  2⤵
  PID:4312
- C:\Windows\System\NtQsoBK.exe
  C:\Windows\System\NtQsoBK.exe
  2⤵
  PID:4328
- C:\Windows\System\KfMqngK.exe
  C:\Windows\System\KfMqngK.exe
  2⤵
  PID:4344
- C:\Windows\System\SlUEemV.exe
  C:\Windows\System\SlUEemV.exe
  2⤵
  PID:4360
- C:\Windows\System\HdKHnWx.exe
  C:\Windows\System\HdKHnWx.exe
  2⤵
  PID:4380
- C:\Windows\System\IuHXAnT.exe
  C:\Windows\System\IuHXAnT.exe
  2⤵
  PID:4396
- C:\Windows\System\gVQqHMS.exe
  C:\Windows\System\gVQqHMS.exe
  2⤵
  PID:4412
- C:\Windows\System\uwLcyuC.exe
  C:\Windows\System\uwLcyuC.exe
  2⤵
  PID:4428
- C:\Windows\System\gPXaNNs.exe
  C:\Windows\System\gPXaNNs.exe
  2⤵
  PID:4444
- C:\Windows\System\GkNPtlY.exe
  C:\Windows\System\GkNPtlY.exe
  2⤵
  PID:4460
- C:\Windows\System\aUtTrVd.exe
  C:\Windows\System\aUtTrVd.exe
  2⤵
  PID:4476
- C:\Windows\System\sAhbREH.exe
  C:\Windows\System\sAhbREH.exe
  2⤵
  PID:4492
- C:\Windows\System\EvyPnxt.exe
  C:\Windows\System\EvyPnxt.exe
  2⤵
  PID:4508
- C:\Windows\System\hSAmMmT.exe
  C:\Windows\System\hSAmMmT.exe
  2⤵
  PID:4524
- C:\Windows\System\FPbHLFJ.exe
  C:\Windows\System\FPbHLFJ.exe
  2⤵
  PID:4540
- C:\Windows\System\tsORgRe.exe
  C:\Windows\System\tsORgRe.exe
  2⤵
  PID:4556
- C:\Windows\System\pkhLrbF.exe
  C:\Windows\System\pkhLrbF.exe
  2⤵
  PID:4572
- C:\Windows\System\blnDxTq.exe
  C:\Windows\System\blnDxTq.exe
  2⤵
  PID:4588
- C:\Windows\System\NoHiWpl.exe
  C:\Windows\System\NoHiWpl.exe
  2⤵
  PID:4604
- C:\Windows\System\lQJeyzN.exe
  C:\Windows\System\lQJeyzN.exe
  2⤵
  PID:4620
- C:\Windows\System\MIVXAui.exe
  C:\Windows\System\MIVXAui.exe
  2⤵
  PID:4640
- C:\Windows\System\bYkOJTl.exe
  C:\Windows\System\bYkOJTl.exe
  2⤵
  PID:4656
- C:\Windows\System\dsfDHtJ.exe
  C:\Windows\System\dsfDHtJ.exe
  2⤵
  PID:4672
- C:\Windows\System\FegUvrE.exe
  C:\Windows\System\FegUvrE.exe
  2⤵
  PID:4688
- C:\Windows\System\qpVLlej.exe
  C:\Windows\System\qpVLlej.exe
  2⤵
  PID:4704
- C:\Windows\System\ipjLsdy.exe
  C:\Windows\System\ipjLsdy.exe
  2⤵
  PID:4720
- C:\Windows\System\WhUzIqX.exe
  C:\Windows\System\WhUzIqX.exe
  2⤵
  PID:4736
- C:\Windows\System\licTRWI.exe
  C:\Windows\System\licTRWI.exe
  2⤵
  PID:4752
- C:\Windows\System\dtqctRc.exe
  C:\Windows\System\dtqctRc.exe
  2⤵
  PID:4768
- C:\Windows\System\kbfNJrk.exe
  C:\Windows\System\kbfNJrk.exe
  2⤵
  PID:4784
- C:\Windows\System\BZHwKHb.exe
  C:\Windows\System\BZHwKHb.exe
  2⤵
  PID:4800
- C:\Windows\System\OTnfDbi.exe
  C:\Windows\System\OTnfDbi.exe
  2⤵
  PID:4816
- C:\Windows\System\KzRjtmm.exe
  C:\Windows\System\KzRjtmm.exe
  2⤵
  PID:4832
- C:\Windows\System\bfiurru.exe
  C:\Windows\System\bfiurru.exe
  2⤵
  PID:4848
- C:\Windows\System\NzgHQoY.exe
  C:\Windows\System\NzgHQoY.exe
  2⤵
  PID:4864
- C:\Windows\System\iAsCAGX.exe
  C:\Windows\System\iAsCAGX.exe
  2⤵
  PID:4880
- C:\Windows\System\smIktTy.exe
  C:\Windows\System\smIktTy.exe
  2⤵
  PID:4896
- C:\Windows\System\XwYZMYk.exe
  C:\Windows\System\XwYZMYk.exe
  2⤵
  PID:4912
- C:\Windows\System\JjUAtQu.exe
  C:\Windows\System\JjUAtQu.exe
  2⤵
  PID:4928
- C:\Windows\System\qlmpPdl.exe
  C:\Windows\System\qlmpPdl.exe
  2⤵
  PID:4944
- C:\Windows\System\NHvhwgP.exe
  C:\Windows\System\NHvhwgP.exe
  2⤵
  PID:4960
- C:\Windows\System\ARmfCtr.exe
  C:\Windows\System\ARmfCtr.exe
  2⤵
  PID:4976
- C:\Windows\System\UefbMvj.exe
  C:\Windows\System\UefbMvj.exe
  2⤵
  PID:4992
- C:\Windows\System\oSSLVrc.exe
  C:\Windows\System\oSSLVrc.exe
  2⤵
  PID:5008
- C:\Windows\System\vrOdZAC.exe
  C:\Windows\System\vrOdZAC.exe
  2⤵
  PID:5024
- C:\Windows\System\hlhEbFq.exe
  C:\Windows\System\hlhEbFq.exe
  2⤵
  PID:5040
- C:\Windows\System\VTniiOT.exe
  C:\Windows\System\VTniiOT.exe
  2⤵
  PID:5056
- C:\Windows\System\VoVStbO.exe
  C:\Windows\System\VoVStbO.exe
  2⤵
  PID:5072
- C:\Windows\System\ucCRLZA.exe
  C:\Windows\System\ucCRLZA.exe
  2⤵
  PID:5088
- C:\Windows\System\JoMUnIv.exe
  C:\Windows\System\JoMUnIv.exe
  2⤵
  PID:5104
- C:\Windows\System\ZudOQdm.exe
  C:\Windows\System\ZudOQdm.exe
  2⤵
  PID:3672
- C:\Windows\System\tIQBPzz.exe
  C:\Windows\System\tIQBPzz.exe
  2⤵
  PID:4160
- C:\Windows\System\yoJbWrj.exe
  C:\Windows\System\yoJbWrj.exe
  2⤵
  PID:4156
- C:\Windows\System\xQgaqfG.exe
  C:\Windows\System\xQgaqfG.exe
  2⤵
  PID:4228
- C:\Windows\System\rPIFZEq.exe
  C:\Windows\System\rPIFZEq.exe
  2⤵
  PID:4320
- C:\Windows\System\pMtmlcT.exe
  C:\Windows\System\pMtmlcT.exe
  2⤵
  PID:4388
- C:\Windows\System\MYdwDKj.exe
  C:\Windows\System\MYdwDKj.exe
  2⤵
  PID:4420
- C:\Windows\System\cqAFlsL.exe
  C:\Windows\System\cqAFlsL.exe
  2⤵
  PID:4484
- C:\Windows\System\zoapGFC.exe
  C:\Windows\System\zoapGFC.exe
  2⤵
  PID:4112
- C:\Windows\System\uskGIol.exe
  C:\Windows\System\uskGIol.exe
  2⤵
  PID:4548
- C:\Windows\System\QJFMHcY.exe
  C:\Windows\System\QJFMHcY.exe
  2⤵
  PID:4580
- C:\Windows\System\dxIruHT.exe
  C:\Windows\System\dxIruHT.exe
  2⤵
  PID:4140
- C:\Windows\System\RBOpgxK.exe
  C:\Windows\System\RBOpgxK.exe
  2⤵
  PID:4208
- C:\Windows\System\tgSdYZI.exe
  C:\Windows\System\tgSdYZI.exe
  2⤵
  PID:4272
- C:\Windows\System\CSkywBQ.exe
  C:\Windows\System\CSkywBQ.exe
  2⤵
  PID:4340
- C:\Windows\System\EBURYym.exe
  C:\Windows\System\EBURYym.exe
  2⤵
  PID:4648
- C:\Windows\System\xymIRrX.exe
  C:\Windows\System\xymIRrX.exe
  2⤵
  PID:4468
- C:\Windows\System\TuueZcq.exe
  C:\Windows\System\TuueZcq.exe
  2⤵
  PID:4532
- C:\Windows\System\UJrwEOj.exe
  C:\Windows\System\UJrwEOj.exe
  2⤵
  PID:4596
- C:\Windows\System\mxCKmsZ.exe
  C:\Windows\System\mxCKmsZ.exe
  2⤵
  PID:4680
- C:\Windows\System\HqkFiVs.exe
  C:\Windows\System\HqkFiVs.exe
  2⤵
  PID:4744
- C:\Windows\System\IAjJfRF.exe
  C:\Windows\System\IAjJfRF.exe
  2⤵
  PID:4808
- C:\Windows\System\vKPhHmw.exe
  C:\Windows\System\vKPhHmw.exe
  2⤵
  PID:4840
- C:\Windows\System\PpASqxx.exe
  C:\Windows\System\PpASqxx.exe
  2⤵
  PID:4904
- C:\Windows\System\CpbOCxx.exe
  C:\Windows\System\CpbOCxx.exe
  2⤵
  PID:4936
- C:\Windows\System\ZNZCpFD.exe
  C:\Windows\System\ZNZCpFD.exe
  2⤵
  PID:5004
- C:\Windows\System\sFpPxje.exe
  C:\Windows\System\sFpPxje.exe
  2⤵
  PID:4920
- C:\Windows\System\GqIlHax.exe
  C:\Windows\System\GqIlHax.exe
  2⤵
  PID:4764
- C:\Windows\System\RNZPDcK.exe
  C:\Windows\System\RNZPDcK.exe
  2⤵
  PID:4888
- C:\Windows\System\JbvDWVj.exe
  C:\Windows\System\JbvDWVj.exe
  2⤵
  PID:4892
- C:\Windows\System\SHELBXq.exe
  C:\Windows\System\SHELBXq.exe
  2⤵
  PID:4956
- C:\Windows\System\wgPwlzd.exe
  C:\Windows\System\wgPwlzd.exe
  2⤵
  PID:5100
- C:\Windows\System\nYuYOrH.exe
  C:\Windows\System\nYuYOrH.exe
  2⤵
  PID:4224
- C:\Windows\System\OPCTcTL.exe
  C:\Windows\System\OPCTcTL.exe
  2⤵
  PID:4356
- C:\Windows\System\xbIvuoF.exe
  C:\Windows\System\xbIvuoF.exe
  2⤵
  PID:4452
- C:\Windows\System\EADMItW.exe
  C:\Windows\System\EADMItW.exe
  2⤵
  PID:4276
- C:\Windows\System\vdRkwrr.exe
  C:\Windows\System\vdRkwrr.exe
  2⤵
  PID:4240
- C:\Windows\System\reidviw.exe
  C:\Windows\System\reidviw.exe
  2⤵
  PID:5052
- C:\Windows\System\RDPzPvk.exe
  C:\Windows\System\RDPzPvk.exe
  2⤵
  PID:3876
- C:\Windows\System\jDAsQHk.exe
  C:\Windows\System\jDAsQHk.exe
  2⤵
  PID:4372
- C:\Windows\System\hfPUsUm.exe
  C:\Windows\System\hfPUsUm.exe
  2⤵
  PID:4652
- C:\Windows\System\diEFxuS.exe
  C:\Windows\System\diEFxuS.exe
  2⤵
  PID:4876
- C:\Windows\System\tOkdmDW.exe
  C:\Windows\System\tOkdmDW.exe
  2⤵
  PID:2748
- C:\Windows\System\ubHxhvI.exe
  C:\Windows\System\ubHxhvI.exe
  2⤵
  PID:4760
- C:\Windows\System\jDNhXeA.exe
  C:\Windows\System\jDNhXeA.exe
  2⤵
  PID:5036
- C:\Windows\System\ramiZMx.exe
  C:\Windows\System\ramiZMx.exe
  2⤵
  PID:4564
- C:\Windows\System\iGHRKzv.exe
  C:\Windows\System\iGHRKzv.exe
  2⤵
  PID:4776
- C:\Windows\System\wuMFKZe.exe
  C:\Windows\System\wuMFKZe.exe
  2⤵
  PID:4828
- C:\Windows\System\Yjeawek.exe
  C:\Windows\System\Yjeawek.exe
  2⤵
  PID:5132
- C:\Windows\System\TOSYIKs.exe
  C:\Windows\System\TOSYIKs.exe
  2⤵
  PID:5148
- C:\Windows\System\DhjeHOP.exe
  C:\Windows\System\DhjeHOP.exe
  2⤵
  PID:5168
- C:\Windows\System\kMZPdiD.exe
  C:\Windows\System\kMZPdiD.exe
  2⤵
  PID:5184
- C:\Windows\System\NUitXRf.exe
  C:\Windows\System\NUitXRf.exe
  2⤵
  PID:5200
- C:\Windows\System\WaodIhF.exe
  C:\Windows\System\WaodIhF.exe
  2⤵
  PID:5216
- C:\Windows\System\EnAlGXN.exe
  C:\Windows\System\EnAlGXN.exe
  2⤵
  PID:5232
- C:\Windows\System\YbhRjMV.exe
  C:\Windows\System\YbhRjMV.exe
  2⤵
  PID:5248
- C:\Windows\System\zKYgrIb.exe
  C:\Windows\System\zKYgrIb.exe
  2⤵
  PID:5264
- C:\Windows\System\PWQUnIf.exe
  C:\Windows\System\PWQUnIf.exe
  2⤵
  PID:5280
- C:\Windows\System\xtBwjML.exe
  C:\Windows\System\xtBwjML.exe
  2⤵
  PID:5296
- C:\Windows\System\KUGQYgO.exe
  C:\Windows\System\KUGQYgO.exe
  2⤵
  PID:5312
- C:\Windows\System\dfBKuLd.exe
  C:\Windows\System\dfBKuLd.exe
  2⤵
  PID:5328
- C:\Windows\System\lxuVdOS.exe
  C:\Windows\System\lxuVdOS.exe
  2⤵
  PID:5348
- C:\Windows\System\cGPfLNz.exe
  C:\Windows\System\cGPfLNz.exe
  2⤵
  PID:5364
- C:\Windows\System\UiabDQN.exe
  C:\Windows\System\UiabDQN.exe
  2⤵
  PID:5380
- C:\Windows\System\rYwItai.exe
  C:\Windows\System\rYwItai.exe
  2⤵
  PID:5400
- C:\Windows\System\SMkZuRF.exe
  C:\Windows\System\SMkZuRF.exe
  2⤵
  PID:5416
- C:\Windows\System\MJxQKUP.exe
  C:\Windows\System\MJxQKUP.exe
  2⤵
  PID:5432
- C:\Windows\System\QFaTxPo.exe
  C:\Windows\System\QFaTxPo.exe
  2⤵
  PID:5448
- C:\Windows\System\ngnvQag.exe
  C:\Windows\System\ngnvQag.exe
  2⤵
  PID:5468
- C:\Windows\System\eMeWYgL.exe
  C:\Windows\System\eMeWYgL.exe
  2⤵
  PID:5484
- C:\Windows\System\CTfgill.exe
  C:\Windows\System\CTfgill.exe
  2⤵
  PID:5500
- C:\Windows\System\JZSeuMm.exe
  C:\Windows\System\JZSeuMm.exe
  2⤵
  PID:5516
- C:\Windows\System\oyLRWgp.exe
  C:\Windows\System\oyLRWgp.exe
  2⤵
  PID:5532
- C:\Windows\System\nTKqqMP.exe
  C:\Windows\System\nTKqqMP.exe
  2⤵
  PID:5548
- C:\Windows\System\zauXcfG.exe
  C:\Windows\System\zauXcfG.exe
  2⤵
  PID:5564
- C:\Windows\System\AQEkzDl.exe
  C:\Windows\System\AQEkzDl.exe
  2⤵
  PID:5580
- C:\Windows\System\rEVyePY.exe
  C:\Windows\System\rEVyePY.exe
  2⤵
  PID:5596
- C:\Windows\System\DtXhbIu.exe
  C:\Windows\System\DtXhbIu.exe
  2⤵
  PID:5612
- C:\Windows\System\AEwzbTI.exe
  C:\Windows\System\AEwzbTI.exe
  2⤵
  PID:5632
- C:\Windows\System\bMZueMp.exe
  C:\Windows\System\bMZueMp.exe
  2⤵
  PID:5648
- C:\Windows\System\kUZcWRt.exe
  C:\Windows\System\kUZcWRt.exe
  2⤵
  PID:5664
- C:\Windows\System\yGozRuM.exe
  C:\Windows\System\yGozRuM.exe
  2⤵
  PID:5680
- C:\Windows\System\PLDuAnJ.exe
  C:\Windows\System\PLDuAnJ.exe
  2⤵
  PID:5696
- C:\Windows\System\GdekHfc.exe
  C:\Windows\System\GdekHfc.exe
  2⤵
  PID:5712
- C:\Windows\System\hGfPCyz.exe
  C:\Windows\System\hGfPCyz.exe
  2⤵
  PID:5728
- C:\Windows\System\jRYMPXk.exe
  C:\Windows\System\jRYMPXk.exe
  2⤵
  PID:5744
- C:\Windows\System\emQkNvo.exe
  C:\Windows\System\emQkNvo.exe
  2⤵
  PID:5760
- C:\Windows\System\XoPscqT.exe
  C:\Windows\System\XoPscqT.exe
  2⤵
  PID:5776
- C:\Windows\System\MmXqhzi.exe
  C:\Windows\System\MmXqhzi.exe
  2⤵
  PID:5792
- C:\Windows\System\KFBtVOc.exe
  C:\Windows\System\KFBtVOc.exe
  2⤵
  PID:5808
- C:\Windows\System\ZvmZHEP.exe
  C:\Windows\System\ZvmZHEP.exe
  2⤵
  PID:5824
- C:\Windows\System\ErpduMS.exe
  C:\Windows\System\ErpduMS.exe
  2⤵
  PID:5840
- C:\Windows\System\IVXvLkZ.exe
  C:\Windows\System\IVXvLkZ.exe
  2⤵
  PID:5856
- C:\Windows\System\SfdPnDp.exe
  C:\Windows\System\SfdPnDp.exe
  2⤵
  PID:5872
- C:\Windows\System\CIffQDY.exe
  C:\Windows\System\CIffQDY.exe
  2⤵
  PID:5888
- C:\Windows\System\EBkhLEr.exe
  C:\Windows\System\EBkhLEr.exe
  2⤵
  PID:5904
- C:\Windows\System\SpjCtDV.exe
  C:\Windows\System\SpjCtDV.exe
  2⤵
  PID:5920
- C:\Windows\System\vITjMbW.exe
  C:\Windows\System\vITjMbW.exe
  2⤵
  PID:5936
- C:\Windows\System\bOdtsYD.exe
  C:\Windows\System\bOdtsYD.exe
  2⤵
  PID:5952
- C:\Windows\System\eVEUtqw.exe
  C:\Windows\System\eVEUtqw.exe
  2⤵
  PID:5968
- C:\Windows\System\xmfcmFM.exe
  C:\Windows\System\xmfcmFM.exe
  2⤵
  PID:5984
- C:\Windows\System\riKsCvk.exe
  C:\Windows\System\riKsCvk.exe
  2⤵
  PID:6000
- C:\Windows\System\moFnfwi.exe
  C:\Windows\System\moFnfwi.exe
  2⤵
  PID:6016
- C:\Windows\System\cYOtOmY.exe
  C:\Windows\System\cYOtOmY.exe
  2⤵
  PID:6032
- C:\Windows\System\JhoTngl.exe
  C:\Windows\System\JhoTngl.exe
  2⤵
  PID:6052
- C:\Windows\System\DxEspOv.exe
  C:\Windows\System\DxEspOv.exe
  2⤵
  PID:6068
- C:\Windows\System\GvrTens.exe
  C:\Windows\System\GvrTens.exe
  2⤵
  PID:6084
- C:\Windows\System\xcknDev.exe
  C:\Windows\System\xcknDev.exe
  2⤵
  PID:6100
- C:\Windows\System\ZzsCRXP.exe
  C:\Windows\System\ZzsCRXP.exe
  2⤵
  PID:6116
- C:\Windows\System\BxAnmWd.exe
  C:\Windows\System\BxAnmWd.exe
  2⤵
  PID:6132
- C:\Windows\System\yssbLAW.exe
  C:\Windows\System\yssbLAW.exe
  2⤵
  PID:4952
- C:\Windows\System\IQTsGvY.exe
  C:\Windows\System\IQTsGvY.exe
  2⤵
  PID:4404
- C:\Windows\System\soWmvLQ.exe
  C:\Windows\System\soWmvLQ.exe
  2⤵
  PID:4436
- C:\Windows\System\CDIpRqE.exe
  C:\Windows\System\CDIpRqE.exe
  2⤵
  PID:5068
- C:\Windows\System\WlLRlDn.exe
  C:\Windows\System\WlLRlDn.exe
  2⤵
  PID:4176
- C:\Windows\System\OcdHqjZ.exe
  C:\Windows\System\OcdHqjZ.exe
  2⤵
  PID:5212
- C:\Windows\System\NPcpVSO.exe
  C:\Windows\System\NPcpVSO.exe
  2⤵
  PID:5244
- C:\Windows\System\cbFOkog.exe
  C:\Windows\System\cbFOkog.exe
  2⤵
  PID:4124
- C:\Windows\System\OhdrJnB.exe
  C:\Windows\System\OhdrJnB.exe
  2⤵
  PID:5048
- C:\Windows\System\vUknKrg.exe
  C:\Windows\System\vUknKrg.exe
  2⤵
  PID:4500
- C:\Windows\System\HEcHtIg.exe
  C:\Windows\System\HEcHtIg.exe
  2⤵
  PID:4308
- C:\Windows\System\CeitiRE.exe
  C:\Windows\System\CeitiRE.exe
  2⤵
  PID:4632
- C:\Windows\System\lvZlMiw.exe
  C:\Windows\System\lvZlMiw.exe
  2⤵
  PID:5128
- C:\Windows\System\wLJpkyN.exe
  C:\Windows\System\wLJpkyN.exe
  2⤵
  PID:5304
- C:\Windows\System\zEfaXqm.exe
  C:\Windows\System\zEfaXqm.exe
  2⤵
  PID:5320
- C:\Windows\System\HfipIUG.exe
  C:\Windows\System\HfipIUG.exe
  2⤵
  PID:5288
- C:\Windows\System\WTZxJpB.exe
  C:\Windows\System\WTZxJpB.exe
  2⤵
  PID:5196
- C:\Windows\System\SKhCrei.exe
  C:\Windows\System\SKhCrei.exe
  2⤵
  PID:5440
- C:\Windows\System\zLKLKGq.exe
  C:\Windows\System\zLKLKGq.exe
  2⤵
  PID:5512
- C:\Windows\System\GfNBGgq.exe
  C:\Windows\System\GfNBGgq.exe
  2⤵
  PID:5540
- C:\Windows\System\GPcXFAs.exe
  C:\Windows\System\GPcXFAs.exe
  2⤵
  PID:5576
- C:\Windows\System\dKOqeZK.exe
  C:\Windows\System\dKOqeZK.exe
  2⤵
  PID:5628
- C:\Windows\System\OcvuBlr.exe
  C:\Windows\System\OcvuBlr.exe
  2⤵
  PID:5388
- C:\Windows\System\oYpUjjg.exe
  C:\Windows\System\oYpUjjg.exe
  2⤵
  PID:5428
- C:\Windows\System\jxZoTxE.exe
  C:\Windows\System\jxZoTxE.exe
  2⤵
  PID:5492
- C:\Windows\System\ZAIXspX.exe
  C:\Windows\System\ZAIXspX.exe
  2⤵
  PID:5556
- C:\Windows\System\vYLSlBU.exe
  C:\Windows\System\vYLSlBU.exe
  2⤵
  PID:5592
- C:\Windows\System\viUnKQa.exe
  C:\Windows\System\viUnKQa.exe
  2⤵
  PID:5740
- C:\Windows\System\DshAgAQ.exe
  C:\Windows\System\DshAgAQ.exe
  2⤵
  PID:5804
- C:\Windows\System\zzfzDBS.exe
  C:\Windows\System\zzfzDBS.exe
  2⤵
  PID:5836
- C:\Windows\System\tVYaAxI.exe
  C:\Windows\System\tVYaAxI.exe
  2⤵
  PID:5692
- C:\Windows\System\WDeLWGL.exe
  C:\Windows\System\WDeLWGL.exe
  2⤵
  PID:5720
- C:\Windows\System\ZOfrrUO.exe
  C:\Windows\System\ZOfrrUO.exe
  2⤵
  PID:5752
- C:\Windows\System\dhprQOH.exe
  C:\Windows\System\dhprQOH.exe
  2⤵
  PID:5820
- C:\Windows\System\JEaFqFb.exe
  C:\Windows\System\JEaFqFb.exe
  2⤵
  PID:5912
- C:\Windows\System\JwyNCYs.exe
  C:\Windows\System\JwyNCYs.exe
  2⤵
  PID:5964
- C:\Windows\System\PVFLPIo.exe
  C:\Windows\System\PVFLPIo.exe
  2⤵
  PID:6060
- C:\Windows\System\aSZKjdX.exe
  C:\Windows\System\aSZKjdX.exe
  2⤵
  PID:6124
- C:\Windows\System\uNbBcsx.exe
  C:\Windows\System\uNbBcsx.exe
  2⤵
  PID:5140
- C:\Windows\System\YvfkjrI.exe
  C:\Windows\System\YvfkjrI.exe
  2⤵
  PID:5308
- C:\Windows\System\MuhDJFV.exe
  C:\Windows\System\MuhDJFV.exe
  2⤵
  PID:5116
- C:\Windows\System\iutiDHE.exe
  C:\Windows\System\iutiDHE.exe
  2⤵
  PID:5948
- C:\Windows\System\SQCQOkm.exe
  C:\Windows\System\SQCQOkm.exe
  2⤵
  PID:5276
- C:\Windows\System\uQFfzbI.exe
  C:\Windows\System\uQFfzbI.exe
  2⤵
  PID:5344
- C:\Windows\System\kGhtgHM.exe
  C:\Windows\System\kGhtgHM.exe
  2⤵
  PID:5608
- C:\Windows\System\HAWAQNz.exe
  C:\Windows\System\HAWAQNz.exe
  2⤵
  PID:5424
- C:\Windows\System\iEFiRlD.exe
  C:\Windows\System\iEFiRlD.exe
  2⤵
  PID:5660
- C:\Windows\System\kXRkIcv.exe
  C:\Windows\System\kXRkIcv.exe
  2⤵
  PID:6040
- C:\Windows\System\lwLPQEF.exe
  C:\Windows\System\lwLPQEF.exe
  2⤵
  PID:5932
- C:\Windows\System\gRttqSW.exe
  C:\Windows\System\gRttqSW.exe
  2⤵
  PID:4972
- C:\Windows\System\CfKvTvH.exe
  C:\Windows\System\CfKvTvH.exe
  2⤵
  PID:5324
- C:\Windows\System\aoTnosM.exe
  C:\Windows\System\aoTnosM.exe
  2⤵
  PID:6108
- C:\Windows\System\WLhBRPp.exe
  C:\Windows\System\WLhBRPp.exe
  2⤵
  PID:6048
- C:\Windows\System\xLvxShy.exe
  C:\Windows\System\xLvxShy.exe
  2⤵
  PID:5016
- C:\Windows\System\iVxIqwq.exe
  C:\Windows\System\iVxIqwq.exe
  2⤵
  PID:4552
- C:\Windows\System\XbINsHh.exe
  C:\Windows\System\XbINsHh.exe
  2⤵
  PID:5240
- C:\Windows\System\DzHeFbL.exe
  C:\Windows\System\DzHeFbL.exe
  2⤵
  PID:5124
- C:\Windows\System\nIIukie.exe
  C:\Windows\System\nIIukie.exe
  2⤵
  PID:5476
- C:\Windows\System\yIjPuHJ.exe
  C:\Windows\System\yIjPuHJ.exe
  2⤵
  PID:5644
- C:\Windows\System\ZiMuDXR.exe
  C:\Windows\System\ZiMuDXR.exe
  2⤵
  PID:5560
- C:\Windows\System\hVxreqS.exe
  C:\Windows\System\hVxreqS.exe
  2⤵
  PID:5900
- C:\Windows\System\mioXhYm.exe
  C:\Windows\System\mioXhYm.exe
  2⤵
  PID:5880
- C:\Windows\System\KarqbzI.exe
  C:\Windows\System\KarqbzI.exe
  2⤵
  PID:6028
- C:\Windows\System\NBcCbAx.exe
  C:\Windows\System\NBcCbAx.exe
  2⤵
  PID:5784
- C:\Windows\System\FpxZFqf.exe
  C:\Windows\System\FpxZFqf.exe
  2⤵
  PID:5112
- C:\Windows\System\AJVbkaM.exe
  C:\Windows\System\AJVbkaM.exe
  2⤵
  PID:5528
- C:\Windows\System\SSRgILo.exe
  C:\Windows\System\SSRgILo.exe
  2⤵
  PID:5852
- C:\Windows\System\QiJGibZ.exe
  C:\Windows\System\QiJGibZ.exe
  2⤵
  PID:6140
- C:\Windows\System\aRaGySL.exe
  C:\Windows\System\aRaGySL.exe
  2⤵
  PID:5228
- C:\Windows\System\dBSlOac.exe
  C:\Windows\System\dBSlOac.exe
  2⤵
  PID:3292
- C:\Windows\System\zZVRBUv.exe
  C:\Windows\System\zZVRBUv.exe
  2⤵
  PID:6148
- C:\Windows\System\zxbRHqE.exe
  C:\Windows\System\zxbRHqE.exe
  2⤵
  PID:6164
- C:\Windows\System\YGyulrb.exe
  C:\Windows\System\YGyulrb.exe
  2⤵
  PID:6180
- C:\Windows\System\OLvZtSi.exe
  C:\Windows\System\OLvZtSi.exe
  2⤵
  PID:6196
- C:\Windows\System\QyNgOXY.exe
  C:\Windows\System\QyNgOXY.exe
  2⤵
  PID:6212
- C:\Windows\System\XMQJmvj.exe
  C:\Windows\System\XMQJmvj.exe
  2⤵
  PID:6232
- C:\Windows\System\KOLkVHt.exe
  C:\Windows\System\KOLkVHt.exe
  2⤵
  PID:6248
- C:\Windows\System\UPCUEit.exe
  C:\Windows\System\UPCUEit.exe
  2⤵
  PID:6264
- C:\Windows\System\lhtVJBo.exe
  C:\Windows\System\lhtVJBo.exe
  2⤵
  PID:6280
- C:\Windows\System\JdvHukO.exe
  C:\Windows\System\JdvHukO.exe
  2⤵
  PID:6296
- C:\Windows\System\WemiULh.exe
  C:\Windows\System\WemiULh.exe
  2⤵
  PID:6312
- C:\Windows\System\nGTkJMQ.exe
  C:\Windows\System\nGTkJMQ.exe
  2⤵
  PID:6332
- C:\Windows\System\jTaBlFC.exe
  C:\Windows\System\jTaBlFC.exe
  2⤵
  PID:6348
- C:\Windows\System\dUShPvZ.exe
  C:\Windows\System\dUShPvZ.exe
  2⤵
  PID:6364
- C:\Windows\System\SJAnDig.exe
  C:\Windows\System\SJAnDig.exe
  2⤵
  PID:6380
- C:\Windows\System\WAoGbyP.exe
  C:\Windows\System\WAoGbyP.exe
  2⤵
  PID:6396
- C:\Windows\System\gGDvvUV.exe
  C:\Windows\System\gGDvvUV.exe
  2⤵
  PID:6416
- C:\Windows\System\vxWYxQo.exe
  C:\Windows\System\vxWYxQo.exe
  2⤵
  PID:6432
- C:\Windows\System\PRnvslO.exe
  C:\Windows\System\PRnvslO.exe
  2⤵
  PID:6448
- C:\Windows\System\NUSLLry.exe
  C:\Windows\System\NUSLLry.exe
  2⤵
  PID:6464
- C:\Windows\System\GjVpudb.exe
  C:\Windows\System\GjVpudb.exe
  2⤵
  PID:6484
- C:\Windows\System\OimvuRn.exe
  C:\Windows\System\OimvuRn.exe
  2⤵
  PID:6500
- C:\Windows\System\Qilznpz.exe
  C:\Windows\System\Qilznpz.exe
  2⤵
  PID:6516
- C:\Windows\System\QjvHeuY.exe
  C:\Windows\System\QjvHeuY.exe
  2⤵
  PID:6532
- C:\Windows\System\ZlTyXhG.exe
  C:\Windows\System\ZlTyXhG.exe
  2⤵
  PID:6552
- C:\Windows\System\GdTnsbJ.exe
  C:\Windows\System\GdTnsbJ.exe
  2⤵
  PID:6568
- C:\Windows\System\OSSOsvu.exe
  C:\Windows\System\OSSOsvu.exe
  2⤵
  PID:6584
- C:\Windows\System\NluLQVq.exe
  C:\Windows\System\NluLQVq.exe
  2⤵
  PID:6600
- C:\Windows\System\jQCnGlW.exe
  C:\Windows\System\jQCnGlW.exe
  2⤵
  PID:6620
- C:\Windows\System\DNTtBkH.exe
  C:\Windows\System\DNTtBkH.exe
  2⤵
  PID:6636
- C:\Windows\System\IfVQhXW.exe
  C:\Windows\System\IfVQhXW.exe
  2⤵
  PID:6652
- C:\Windows\System\QHFLmaJ.exe
  C:\Windows\System\QHFLmaJ.exe
  2⤵
  PID:6668
- C:\Windows\System\iyvvqjK.exe
  C:\Windows\System\iyvvqjK.exe
  2⤵
  PID:6688
- C:\Windows\System\hBBiBWU.exe
  C:\Windows\System\hBBiBWU.exe
  2⤵
  PID:6704
- C:\Windows\System\ZsmBWgE.exe
  C:\Windows\System\ZsmBWgE.exe
  2⤵
  PID:6720
- C:\Windows\System\MCkrnFT.exe
  C:\Windows\System\MCkrnFT.exe
  2⤵
  PID:6736
- C:\Windows\System\emGArkC.exe
  C:\Windows\System\emGArkC.exe
  2⤵
  PID:6756
- C:\Windows\System\dKdtVtC.exe
  C:\Windows\System\dKdtVtC.exe
  2⤵
  PID:6772
- C:\Windows\System\nFLGjBm.exe
  C:\Windows\System\nFLGjBm.exe
  2⤵
  PID:6792
- C:\Windows\System\LmAHlhR.exe
  C:\Windows\System\LmAHlhR.exe
  2⤵
  PID:6808
- C:\Windows\System\zybloim.exe
  C:\Windows\System\zybloim.exe
  2⤵
  PID:6824
- C:\Windows\System\TzkHAMV.exe
  C:\Windows\System\TzkHAMV.exe
  2⤵
  PID:6844
- C:\Windows\System\nfmPJhQ.exe
  C:\Windows\System\nfmPJhQ.exe
  2⤵
  PID:6860
- C:\Windows\System\jUtqWkk.exe
  C:\Windows\System\jUtqWkk.exe
  2⤵
  PID:6876
- C:\Windows\System\TRLBEkN.exe
  C:\Windows\System\TRLBEkN.exe
  2⤵
  PID:6892
- C:\Windows\System\ZmQDKxo.exe
  C:\Windows\System\ZmQDKxo.exe
  2⤵
  PID:6912
- C:\Windows\System\WjmCNpY.exe
  C:\Windows\System\WjmCNpY.exe
  2⤵
  PID:6928
- C:\Windows\System\xiEQWgb.exe
  C:\Windows\System\xiEQWgb.exe
  2⤵
  PID:6952
- C:\Windows\System\urnUuYr.exe
  C:\Windows\System\urnUuYr.exe
  2⤵
  PID:6972
- C:\Windows\System\FssXVaW.exe
  C:\Windows\System\FssXVaW.exe
  2⤵
  PID:6988
- C:\Windows\System\zxJRDhG.exe
  C:\Windows\System\zxJRDhG.exe
  2⤵
  PID:7004
- C:\Windows\System\iqiWjKz.exe
  C:\Windows\System\iqiWjKz.exe
  2⤵
  PID:7020
- C:\Windows\System\QrQxnUw.exe
  C:\Windows\System\QrQxnUw.exe
  2⤵
  PID:7084
- C:\Windows\System\qCMYqAC.exe
  C:\Windows\System\qCMYqAC.exe
  2⤵
  PID:7120
- C:\Windows\System\BfZhIMh.exe
  C:\Windows\System\BfZhIMh.exe
  2⤵
  PID:7140
- C:\Windows\System\LsJAWoa.exe
  C:\Windows\System\LsJAWoa.exe
  2⤵
  PID:7156
- C:\Windows\System\afzSzxj.exe
  C:\Windows\System\afzSzxj.exe
  2⤵
  PID:5656
- C:\Windows\System\lmGmqEZ.exe
  C:\Windows\System\lmGmqEZ.exe
  2⤵
  PID:5460
- C:\Windows\System\HUmaFVv.exe
  C:\Windows\System\HUmaFVv.exe
  2⤵
  PID:4940
- C:\Windows\System\GgUtuZb.exe
  C:\Windows\System\GgUtuZb.exe
  2⤵
  PID:5772
- C:\Windows\System\sEGbCuY.exe
  C:\Windows\System\sEGbCuY.exe
  2⤵
  PID:6156
- C:\Windows\System\dELOFVJ.exe
  C:\Windows\System\dELOFVJ.exe
  2⤵
  PID:5800
- C:\Windows\System\IiDNVdk.exe
  C:\Windows\System\IiDNVdk.exe
  2⤵
  PID:4172
- C:\Windows\System\Onqwxcz.exe
  C:\Windows\System\Onqwxcz.exe
  2⤵
  PID:5736
- C:\Windows\System\FNjImjG.exe
  C:\Windows\System\FNjImjG.exe
  2⤵
  PID:6204
- C:\Windows\System\XUMyJCk.exe
  C:\Windows\System\XUMyJCk.exe
  2⤵
  PID:6256
- C:\Windows\System\RJvYfkY.exe
  C:\Windows\System\RJvYfkY.exe
  2⤵
  PID:6320
- C:\Windows\System\TlOmury.exe
  C:\Windows\System\TlOmury.exe
  2⤵
  PID:6360
- C:\Windows\System\rUZXisV.exe
  C:\Windows\System\rUZXisV.exe
  2⤵
  PID:6428
- C:\Windows\System\wNmgAaU.exe
  C:\Windows\System\wNmgAaU.exe
  2⤵
  PID:6308
- C:\Windows\System\kCYwAeW.exe
  C:\Windows\System\kCYwAeW.exe
  2⤵
  PID:6492
- C:\Windows\System\lXaFSZM.exe
  C:\Windows\System\lXaFSZM.exe
  2⤵
  PID:6376
- C:\Windows\System\KcDcQop.exe
  C:\Windows\System\KcDcQop.exe
  2⤵
  PID:6404
- C:\Windows\System\xYnfYfO.exe
  C:\Windows\System\xYnfYfO.exe
  2⤵
  PID:6440
- C:\Windows\System\WQvQsET.exe
  C:\Windows\System\WQvQsET.exe
  2⤵
  PID:6628
- C:\Windows\System\LoWSrWZ.exe
  C:\Windows\System\LoWSrWZ.exe
  2⤵
  PID:6480
- C:\Windows\System\BoxIQGz.exe
  C:\Windows\System\BoxIQGz.exe
  2⤵
  PID:6664
- C:\Windows\System\jADZpbC.exe
  C:\Windows\System\jADZpbC.exe
  2⤵
  PID:6732
- C:\Windows\System\LkLpJHh.exe
  C:\Windows\System\LkLpJHh.exe
  2⤵
  PID:6800
- C:\Windows\System\JbMfOmt.exe
  C:\Windows\System\JbMfOmt.exe
  2⤵
  PID:6836
- C:\Windows\System\aIjhvgE.exe
  C:\Windows\System\aIjhvgE.exe
  2⤵
  PID:6872
- C:\Windows\System\LjtlVEB.exe
  C:\Windows\System\LjtlVEB.exe
  2⤵
  PID:6616
- C:\Windows\System\HsFavfa.exe
  C:\Windows\System\HsFavfa.exe
  2⤵
  PID:6820
- C:\Windows\System\DgIfjpc.exe
  C:\Windows\System\DgIfjpc.exe
  2⤵
  PID:6548
- C:\Windows\System\nnayXMv.exe
  C:\Windows\System\nnayXMv.exe
  2⤵
  PID:6608
- C:\Windows\System\EaIWYrP.exe
  C:\Windows\System\EaIWYrP.exe
  2⤵
  PID:6712
- C:\Windows\System\iJZAxUp.exe
  C:\Windows\System\iJZAxUp.exe
  2⤵
  PID:6788
- C:\Windows\System\CAahEWB.exe
  C:\Windows\System\CAahEWB.exe
  2⤵
  PID:6920
- C:\Windows\System\BwmaEAa.exe
  C:\Windows\System\BwmaEAa.exe
  2⤵
  PID:6940
- C:\Windows\System\XwuUxrb.exe
  C:\Windows\System\XwuUxrb.exe
  2⤵
  PID:6960
- C:\Windows\System\BpytSiB.exe
  C:\Windows\System\BpytSiB.exe
  2⤵
  PID:7028
- C:\Windows\System\dHvLVxb.exe
  C:\Windows\System\dHvLVxb.exe
  2⤵
  PID:7032
- C:\Windows\System\mkoAwuQ.exe
  C:\Windows\System\mkoAwuQ.exe
  2⤵
  PID:7092
- C:\Windows\System\YlamkQv.exe
  C:\Windows\System\YlamkQv.exe
  2⤵
  PID:7104
- C:\Windows\System\qezMWcd.exe
  C:\Windows\System\qezMWcd.exe
  2⤵
  PID:7164
- C:\Windows\System\jFEldpQ.exe
  C:\Windows\System\jFEldpQ.exe
  2⤵
  PID:5996
- C:\Windows\System\FqDBaWA.exe
  C:\Windows\System\FqDBaWA.exe
  2⤵
  PID:5412
- C:\Windows\System\ggcmbYr.exe
  C:\Windows\System\ggcmbYr.exe
  2⤵
  PID:5508
- C:\Windows\System\mtsjgfa.exe
  C:\Windows\System\mtsjgfa.exe
  2⤵
  PID:5208
- C:\Windows\System\tJYwNLj.exe
  C:\Windows\System\tJYwNLj.exe
  2⤵
  PID:6192
- C:\Windows\System\DdNhzSr.exe
  C:\Windows\System\DdNhzSr.exe
  2⤵
  PID:6240
- C:\Windows\System\zyyLRcm.exe
  C:\Windows\System\zyyLRcm.exe
  2⤵
  PID:6424
- C:\Windows\System\zZCFWOv.exe
  C:\Windows\System\zZCFWOv.exe
  2⤵
  PID:6372
- C:\Windows\System\lBEdlLb.exe
  C:\Windows\System\lBEdlLb.exe
  2⤵
  PID:6592
- C:\Windows\System\ErFkPYc.exe
  C:\Windows\System\ErFkPYc.exe
  2⤵
  PID:6648
- C:\Windows\System\jFUbqWz.exe
  C:\Windows\System\jFUbqWz.exe
  2⤵
  PID:6716
- C:\Windows\System\wsaSIQt.exe
  C:\Windows\System\wsaSIQt.exe
  2⤵
  PID:6752
- C:\Windows\System\wVehTTE.exe
  C:\Windows\System\wVehTTE.exe
  2⤵
  PID:7012
- C:\Windows\System\RvXhlhD.exe
  C:\Windows\System\RvXhlhD.exe
  2⤵
  PID:4636
- C:\Windows\System\ncmuxsD.exe
  C:\Windows\System\ncmuxsD.exe
  2⤵
  PID:7128
- C:\Windows\System\wJipAhf.exe
  C:\Windows\System\wJipAhf.exe
  2⤵
  PID:7116
- C:\Windows\System\OFkkCAB.exe
  C:\Windows\System\OFkkCAB.exe
  2⤵
  PID:5356
- C:\Windows\System\JAVTckm.exe
  C:\Windows\System\JAVTckm.exe
  2⤵
  PID:6024
- C:\Windows\System\AOSLFPj.exe
  C:\Windows\System\AOSLFPj.exe
  2⤵
  PID:6176
- C:\Windows\System\mlHEudn.exe
  C:\Windows\System\mlHEudn.exe
  2⤵
  PID:6328
- C:\Windows\System\cXcGsiJ.exe
  C:\Windows\System\cXcGsiJ.exe
  2⤵
  PID:6292
- C:\Windows\System\PHvhTwg.exe
  C:\Windows\System\PHvhTwg.exe
  2⤵
  PID:6276
- C:\Windows\System\OJpqvOw.exe
  C:\Windows\System\OJpqvOw.exe
  2⤵
  PID:6412
- C:\Windows\System\hPfoeEP.exe
  C:\Windows\System\hPfoeEP.exe
  2⤵
  PID:6512
- C:\Windows\System\eLJDajm.exe
  C:\Windows\System\eLJDajm.exe
  2⤵
  PID:6764
- C:\Windows\System\ZPuFNbY.exe
  C:\Windows\System\ZPuFNbY.exe
  2⤵
  PID:6868
- C:\Windows\System\jAWYhXR.exe
  C:\Windows\System\jAWYhXR.exe
  2⤵
  PID:6676
- C:\Windows\System\kyYbOJc.exe
  C:\Windows\System\kyYbOJc.exe
  2⤵
  PID:6948
- C:\Windows\System\MSPWeFv.exe
  C:\Windows\System\MSPWeFv.exe
  2⤵
  PID:5976
- C:\Windows\System\AjosGrl.exe
  C:\Windows\System\AjosGrl.exe
  2⤵
  PID:6564
- C:\Windows\System\GVuPhXK.exe
  C:\Windows\System\GVuPhXK.exe
  2⤵
  PID:6852
- C:\Windows\System\joSdoOF.exe
  C:\Windows\System\joSdoOF.exe
  2⤵
  PID:6884
- C:\Windows\System\TdEBvYO.exe
  C:\Windows\System\TdEBvYO.exe
  2⤵
  PID:7188
- C:\Windows\System\yAeggyn.exe
  C:\Windows\System\yAeggyn.exe
  2⤵
  PID:7204
- C:\Windows\System\ofeRehD.exe
  C:\Windows\System\ofeRehD.exe
  2⤵
  PID:7224
- C:\Windows\System\UzkxKaa.exe
  C:\Windows\System\UzkxKaa.exe
  2⤵
  PID:7240
- C:\Windows\System\gtdjonY.exe
  C:\Windows\System\gtdjonY.exe
  2⤵
  PID:7256
- C:\Windows\System\iUjvhbx.exe
  C:\Windows\System\iUjvhbx.exe
  2⤵
  PID:7276
- C:\Windows\System\fkccCVf.exe
  C:\Windows\System\fkccCVf.exe
  2⤵
  PID:7292
- C:\Windows\System\rmalCAo.exe
  C:\Windows\System\rmalCAo.exe
  2⤵
  PID:7308
- C:\Windows\System\TAjfQbU.exe
  C:\Windows\System\TAjfQbU.exe
  2⤵
  PID:7324
- C:\Windows\System\qiOSlVc.exe
  C:\Windows\System\qiOSlVc.exe
  2⤵
  PID:7340
- C:\Windows\System\SENAEka.exe
  C:\Windows\System\SENAEka.exe
  2⤵
  PID:7368
- C:\Windows\System\xtpIZDL.exe
  C:\Windows\System\xtpIZDL.exe
  2⤵
  PID:7384
- C:\Windows\System\KkZojBA.exe
  C:\Windows\System\KkZojBA.exe
  2⤵
  PID:7400
- C:\Windows\System\QFhQqRH.exe
  C:\Windows\System\QFhQqRH.exe
  2⤵
  PID:7420
- C:\Windows\System\ciYIZHl.exe
  C:\Windows\System\ciYIZHl.exe
  2⤵
  PID:7436
- C:\Windows\System\lorNqjW.exe
  C:\Windows\System\lorNqjW.exe
  2⤵
  PID:7452
- C:\Windows\System\gOPOlUD.exe
  C:\Windows\System\gOPOlUD.exe
  2⤵
  PID:7468
- C:\Windows\System\iPvmrka.exe
  C:\Windows\System\iPvmrka.exe
  2⤵
  PID:7488
- C:\Windows\System\pOewNTe.exe
  C:\Windows\System\pOewNTe.exe
  2⤵
  PID:7504
- C:\Windows\System\xKrYbEI.exe
  C:\Windows\System\xKrYbEI.exe
  2⤵
  PID:7520
- C:\Windows\System\hOWjocT.exe
  C:\Windows\System\hOWjocT.exe
  2⤵
  PID:7536
- C:\Windows\System\kHUBzZv.exe
  C:\Windows\System\kHUBzZv.exe
  2⤵
  PID:7552
- C:\Windows\System\OgryvlJ.exe
  C:\Windows\System\OgryvlJ.exe
  2⤵
  PID:7568
- C:\Windows\System\KceiCaX.exe
  C:\Windows\System\KceiCaX.exe
  2⤵
  PID:7584
- C:\Windows\System\tJTZiQr.exe
  C:\Windows\System\tJTZiQr.exe
  2⤵
  PID:7604
- C:\Windows\System\zpCNylt.exe
  C:\Windows\System\zpCNylt.exe
  2⤵
  PID:7620
- C:\Windows\System\NIXbNhy.exe
  C:\Windows\System\NIXbNhy.exe
  2⤵
  PID:7636
- C:\Windows\System\AuRMFNh.exe
  C:\Windows\System\AuRMFNh.exe
  2⤵
  PID:7652
- C:\Windows\System\QEIeHdz.exe
  C:\Windows\System\QEIeHdz.exe
  2⤵
  PID:7668
- C:\Windows\System\uZQpmHu.exe
  C:\Windows\System\uZQpmHu.exe
  2⤵
  PID:7684
- C:\Windows\System\QzEGZIK.exe
  C:\Windows\System\QzEGZIK.exe
  2⤵
  PID:7700
- C:\Windows\System\FmTprJw.exe
  C:\Windows\System\FmTprJw.exe
  2⤵
  PID:7716
- C:\Windows\System\XgNsWnf.exe
  C:\Windows\System\XgNsWnf.exe
  2⤵
  PID:7732
- C:\Windows\System\HYPtORU.exe
  C:\Windows\System\HYPtORU.exe
  2⤵
  PID:7748
- C:\Windows\System\TgyvXoz.exe
  C:\Windows\System\TgyvXoz.exe
  2⤵
  PID:7764
- C:\Windows\System\BcJIfvh.exe
  C:\Windows\System\BcJIfvh.exe
  2⤵
  PID:7780
- C:\Windows\System\hvrlzLP.exe
  C:\Windows\System\hvrlzLP.exe
  2⤵
  PID:7800
- C:\Windows\System\poGcFfX.exe
  C:\Windows\System\poGcFfX.exe
  2⤵
  PID:7816
- C:\Windows\System\AcaQafh.exe
  C:\Windows\System\AcaQafh.exe
  2⤵
  PID:7832
- C:\Windows\System\haIJEJt.exe
  C:\Windows\System\haIJEJt.exe
  2⤵
  PID:7848
- C:\Windows\System\zEPEkEF.exe
  C:\Windows\System\zEPEkEF.exe
  2⤵
  PID:7864
- C:\Windows\System\DyYSsHA.exe
  C:\Windows\System\DyYSsHA.exe
  2⤵
  PID:7880
- C:\Windows\System\ZmXucHt.exe
  C:\Windows\System\ZmXucHt.exe
  2⤵
  PID:7896
- C:\Windows\System\FkVQHes.exe
  C:\Windows\System\FkVQHes.exe
  2⤵
  PID:7912
- C:\Windows\System\JxjdKOi.exe
  C:\Windows\System\JxjdKOi.exe
  2⤵
  PID:7928
- C:\Windows\System\hXAicAa.exe
  C:\Windows\System\hXAicAa.exe
  2⤵
  PID:7944
- C:\Windows\System\crTBlmv.exe
  C:\Windows\System\crTBlmv.exe
  2⤵
  PID:7960
- C:\Windows\System\GCjROMN.exe
  C:\Windows\System\GCjROMN.exe
  2⤵
  PID:7976
- C:\Windows\System\YItuEwD.exe
  C:\Windows\System\YItuEwD.exe
  2⤵
  PID:7996
- C:\Windows\System\jnzendy.exe
  C:\Windows\System\jnzendy.exe
  2⤵
  PID:8020
- C:\Windows\System\TVaJtPM.exe
  C:\Windows\System\TVaJtPM.exe
  2⤵
  PID:8040
- C:\Windows\System\QwdTTpi.exe
  C:\Windows\System\QwdTTpi.exe
  2⤵
  PID:8056
- C:\Windows\System\hmWSKMe.exe
  C:\Windows\System\hmWSKMe.exe
  2⤵
  PID:8076
- C:\Windows\System\Dkoerzf.exe
  C:\Windows\System\Dkoerzf.exe
  2⤵
  PID:8092
- C:\Windows\System\lCFnwEF.exe
  C:\Windows\System\lCFnwEF.exe
  2⤵
  PID:8108
- C:\Windows\System\vikZvjS.exe
  C:\Windows\System\vikZvjS.exe
  2⤵
  PID:8124
- C:\Windows\System\debXkNK.exe
  C:\Windows\System\debXkNK.exe
  2⤵
  PID:8140
- C:\Windows\System\byBMvCY.exe
  C:\Windows\System\byBMvCY.exe
  2⤵
  PID:8156
- C:\Windows\System\muVcisd.exe
  C:\Windows\System\muVcisd.exe
  2⤵
  PID:8172
- C:\Windows\System\grakYwg.exe
  C:\Windows\System\grakYwg.exe
  2⤵
  PID:6936
- C:\Windows\System\obmUiGS.exe
  C:\Windows\System\obmUiGS.exe
  2⤵
  PID:7176
- C:\Windows\System\cnVDtyl.exe
  C:\Windows\System\cnVDtyl.exe
  2⤵
  PID:7248
- C:\Windows\System\KpoWvia.exe
  C:\Windows\System\KpoWvia.exe
  2⤵
  PID:6220
- C:\Windows\System\qqcLaVe.exe
  C:\Windows\System\qqcLaVe.exe
  2⤵
  PID:6996
- C:\Windows\System\KMsvoDh.exe
  C:\Windows\System\KMsvoDh.exe
  2⤵
  PID:6908
- C:\Windows\System\uqQejyz.exe
  C:\Windows\System\uqQejyz.exe
  2⤵
  PID:6288
- C:\Windows\System\SHfxfyn.exe
  C:\Windows\System\SHfxfyn.exe
  2⤵
  PID:7136
- C:\Windows\System\PEqHNEH.exe
  C:\Windows\System\PEqHNEH.exe
  2⤵
  PID:7236
- C:\Windows\System\oMdbPBM.exe
  C:\Windows\System\oMdbPBM.exe
  2⤵
  PID:6044
- C:\Windows\System\jvDskOG.exe
  C:\Windows\System\jvDskOG.exe
  2⤵
  PID:7348
- C:\Windows\System\mKDrGss.exe
  C:\Windows\System\mKDrGss.exe
  2⤵
  PID:7360
- C:\Windows\System\rPTtAtJ.exe
  C:\Windows\System\rPTtAtJ.exe
  2⤵
  PID:7396
- C:\Windows\System\GqrPJLU.exe
  C:\Windows\System\GqrPJLU.exe
  2⤵
  PID:7500
- C:\Windows\System\BecEymR.exe
  C:\Windows\System\BecEymR.exe
  2⤵
  PID:7528
- C:\Windows\System\ggsHjIe.exe
  C:\Windows\System\ggsHjIe.exe
  2⤵
  PID:7592
- C:\Windows\System\nYHRnmh.exe
  C:\Windows\System\nYHRnmh.exe
  2⤵
  PID:7304
- C:\Windows\System\xPcRERR.exe
  C:\Windows\System\xPcRERR.exe
  2⤵
  PID:7408
- C:\Windows\System\YyLSTMA.exe
  C:\Windows\System\YyLSTMA.exe
  2⤵
  PID:7448
- C:\Windows\System\BbpmdsH.exe
  C:\Windows\System\BbpmdsH.exe
  2⤵
  PID:7724
- C:\Windows\System\wEaKpBW.exe
  C:\Windows\System\wEaKpBW.exe
  2⤵
  PID:7760
- C:\Windows\System\hyvzrRO.exe
  C:\Windows\System\hyvzrRO.exe
  2⤵
  PID:6188
- C:\Windows\System\ayvnQqG.exe
  C:\Windows\System\ayvnQqG.exe
  2⤵
  PID:7860
- C:\Windows\System\rZGEYQX.exe
  C:\Windows\System\rZGEYQX.exe
  2⤵
  PID:7924
- C:\Windows\System\nKeXMnE.exe
  C:\Windows\System\nKeXMnE.exe
  2⤵
  PID:7992
- C:\Windows\System\tPJPych.exe
  C:\Windows\System\tPJPych.exe
  2⤵
  PID:7600
- C:\Windows\System\HootHFC.exe
  C:\Windows\System\HootHFC.exe
  2⤵
  PID:7484
- C:\Windows\System\DAREvYR.exe
  C:\Windows\System\DAREvYR.exe
  2⤵
  PID:7548
- C:\Windows\System\ucVVrWW.exe
  C:\Windows\System\ucVVrWW.exe
  2⤵
  PID:7612
- C:\Windows\System\pbuiOth.exe
  C:\Windows\System\pbuiOth.exe
  2⤵
  PID:7644
- C:\Windows\System\Fttswml.exe
  C:\Windows\System\Fttswml.exe
  2⤵
  PID:7712
- C:\Windows\System\dUPDYKo.exe
  C:\Windows\System\dUPDYKo.exe
  2⤵
  PID:7808
- C:\Windows\System\yiRexKM.exe
  C:\Windows\System\yiRexKM.exe
  2⤵
  PID:7904
- C:\Windows\System\DwNKyWg.exe
  C:\Windows\System\DwNKyWg.exe
  2⤵
  PID:7968
- C:\Windows\System\zDaNjqF.exe
  C:\Windows\System\zDaNjqF.exe
  2⤵
  PID:8016
- C:\Windows\System\rXmZbpj.exe
  C:\Windows\System\rXmZbpj.exe
  2⤵
  PID:8100
- C:\Windows\System\eiBzODT.exe
  C:\Windows\System\eiBzODT.exe
  2⤵
  PID:8136
- C:\Windows\System\MHIaLnj.exe
  C:\Windows\System\MHIaLnj.exe
  2⤵
  PID:7252
- C:\Windows\System\ZNXSYCL.exe
  C:\Windows\System\ZNXSYCL.exe
  2⤵
  PID:6832
- C:\Windows\System\Ikiebbr.exe
  C:\Windows\System\Ikiebbr.exe
  2⤵
  PID:7148
- C:\Windows\System\sqWFwcr.exe
  C:\Windows\System\sqWFwcr.exe
  2⤵
  PID:8048
- C:\Windows\System\IAqlLmc.exe
  C:\Windows\System\IAqlLmc.exe
  2⤵
  PID:6344
- C:\Windows\System\oBZMvnk.exe
  C:\Windows\System\oBZMvnk.exe
  2⤵
  PID:8180
- C:\Windows\System\FGnsxEN.exe
  C:\Windows\System\FGnsxEN.exe
  2⤵
  PID:7320
- C:\Windows\System\oPULKrK.exe
  C:\Windows\System\oPULKrK.exe
  2⤵
  PID:6508
- C:\Windows\System\SoDFmnr.exe
  C:\Windows\System\SoDFmnr.exe
  2⤵
  PID:7936
- C:\Windows\System\eDyEvKi.exe
  C:\Windows\System\eDyEvKi.exe
  2⤵
  PID:7856
- C:\Windows\System\YNoCdWg.exe
  C:\Windows\System\YNoCdWg.exe
  2⤵
  PID:8008
- C:\Windows\System\ETVyYCF.exe
  C:\Windows\System\ETVyYCF.exe
  2⤵
  PID:8164
- C:\Windows\System\lDggFaq.exe
  C:\Windows\System\lDggFaq.exe
  2⤵
  PID:7756
- C:\Windows\System\ZfPFzVM.exe
  C:\Windows\System\ZfPFzVM.exe
  2⤵
  PID:7812
- C:\Windows\System\IWQjyeR.exe
  C:\Windows\System\IWQjyeR.exe
  2⤵
  PID:7080
- C:\Windows\System\KJTTvNw.exe
  C:\Windows\System\KJTTvNw.exe
  2⤵
  PID:8120
- C:\Windows\System\zVZqqSq.exe
  C:\Windows\System\zVZqqSq.exe
  2⤵
  PID:8088
- C:\Windows\System\QsdMniJ.exe
  C:\Windows\System\QsdMniJ.exe
  2⤵
  PID:7216
- C:\Windows\System\AQFkoud.exe
  C:\Windows\System\AQFkoud.exe
  2⤵
  PID:7352
- C:\Windows\System\tSQpomz.exe
  C:\Windows\System\tSQpomz.exe
  2⤵
  PID:7696
- C:\Windows\System\BMtFFmY.exe
  C:\Windows\System\BMtFFmY.exe
  2⤵
  PID:7828
- C:\Windows\System\wNslqUD.exe
  C:\Windows\System\wNslqUD.exe
  2⤵
  PID:7516
- C:\Windows\System\DSePucg.exe
  C:\Windows\System\DSePucg.exe
  2⤵
  PID:8028
- C:\Windows\System\iTqPHhI.exe
  C:\Windows\System\iTqPHhI.exe
  2⤵
  PID:7596
- C:\Windows\System\WWDKDhC.exe
  C:\Windows\System\WWDKDhC.exe
  2⤵
  PID:7184
- C:\Windows\System\NntzKRp.exe
  C:\Windows\System\NntzKRp.exe
  2⤵
  PID:7476
- C:\Windows\System\ywNRHkK.exe
  C:\Windows\System\ywNRHkK.exe
  2⤵
  PID:8068
- C:\Windows\System\IqLgLFq.exe
  C:\Windows\System\IqLgLFq.exe
  2⤵
  PID:7232
- C:\Windows\System\EahxYfi.exe
  C:\Windows\System\EahxYfi.exe
  2⤵
  PID:8084
- C:\Windows\System\ifQHPda.exe
  C:\Windows\System\ifQHPda.exe
  2⤵
  PID:6944
- C:\Windows\System\hbSilGc.exe
  C:\Windows\System\hbSilGc.exe
  2⤵
  PID:8012
- C:\Windows\System\TkzmLHH.exe
  C:\Windows\System\TkzmLHH.exe
  2⤵
  PID:7376
- C:\Windows\System\hXKbURQ.exe
  C:\Windows\System\hXKbURQ.exe
  2⤵
  PID:7872
- C:\Windows\System\FyitcTo.exe
  C:\Windows\System\FyitcTo.exe
  2⤵
  PID:8072
- C:\Windows\System\tUKCGqg.exe
  C:\Windows\System\tUKCGqg.exe
  2⤵
  PID:8208
- C:\Windows\System\RPzDiPi.exe
  C:\Windows\System\RPzDiPi.exe
  2⤵
  PID:8236
- C:\Windows\System\HSwzfrG.exe
  C:\Windows\System\HSwzfrG.exe
  2⤵
  PID:8260
- C:\Windows\System\kgFcNyz.exe
  C:\Windows\System\kgFcNyz.exe
  2⤵
  PID:8276
- C:\Windows\System\Qfdlrxc.exe
  C:\Windows\System\Qfdlrxc.exe
  2⤵
  PID:8304
- C:\Windows\System\MFOiZAf.exe
  C:\Windows\System\MFOiZAf.exe
  2⤵
  PID:8324
- C:\Windows\System\SAIthqc.exe
  C:\Windows\System\SAIthqc.exe
  2⤵
  PID:8340
- C:\Windows\System\DxbGpzw.exe
  C:\Windows\System\DxbGpzw.exe
  2⤵
  PID:8460
- C:\Windows\System\LhqQSLW.exe
  C:\Windows\System\LhqQSLW.exe
  2⤵
  PID:8476
- C:\Windows\System\kyYpaeV.exe
  C:\Windows\System\kyYpaeV.exe
  2⤵
  PID:8492
- C:\Windows\System\qhUaqCh.exe
  C:\Windows\System\qhUaqCh.exe
  2⤵
  PID:8508
- C:\Windows\System\hBcmbtg.exe
  C:\Windows\System\hBcmbtg.exe
  2⤵
  PID:8524
- C:\Windows\System\APrhvyC.exe
  C:\Windows\System\APrhvyC.exe
  2⤵
  PID:8560
- C:\Windows\System\oFjBYGz.exe
  C:\Windows\System\oFjBYGz.exe
  2⤵
  PID:8576
- C:\Windows\System\bbimMAE.exe
  C:\Windows\System\bbimMAE.exe
  2⤵
  PID:8592
- C:\Windows\System\hvUHDrM.exe
  C:\Windows\System\hvUHDrM.exe
  2⤵
  PID:8608
- C:\Windows\System\HcXevEk.exe
  C:\Windows\System\HcXevEk.exe
  2⤵
  PID:8628
- C:\Windows\System\wdUIyif.exe
  C:\Windows\System\wdUIyif.exe
  2⤵
  PID:8644
- C:\Windows\System\dyruVYY.exe
  C:\Windows\System\dyruVYY.exe
  2⤵
  PID:8708
- C:\Windows\System\TerGtsW.exe
  C:\Windows\System\TerGtsW.exe
  2⤵
  PID:8724
- C:\Windows\System\eosTInb.exe
  C:\Windows\System\eosTInb.exe
  2⤵
  PID:8740
- C:\Windows\System\YBOvKdJ.exe
  C:\Windows\System\YBOvKdJ.exe
  2⤵
  PID:8756
- C:\Windows\System\rFjRGpH.exe
  C:\Windows\System\rFjRGpH.exe
  2⤵
  PID:8772
- C:\Windows\System\WkVawng.exe
  C:\Windows\System\WkVawng.exe
  2⤵
  PID:8788
- C:\Windows\System\JVEJzBi.exe
  C:\Windows\System\JVEJzBi.exe
  2⤵
  PID:8804
- C:\Windows\System\fMpMrDt.exe
  C:\Windows\System\fMpMrDt.exe
  2⤵
  PID:8820
- C:\Windows\System\UjfgDUE.exe
  C:\Windows\System\UjfgDUE.exe
  2⤵
  PID:8836
- C:\Windows\System\xWaGvHH.exe
  C:\Windows\System\xWaGvHH.exe
  2⤵
  PID:8852
- C:\Windows\System\qXYEurK.exe
  C:\Windows\System\qXYEurK.exe
  2⤵
  PID:8868
- C:\Windows\System\bfFcdhW.exe
  C:\Windows\System\bfFcdhW.exe
  2⤵
  PID:8884
- C:\Windows\System\OWVYjym.exe
  C:\Windows\System\OWVYjym.exe
  2⤵
  PID:8900
- C:\Windows\System\BRcmXrX.exe
  C:\Windows\System\BRcmXrX.exe
  2⤵
  PID:8916
- C:\Windows\System\SVESuss.exe
  C:\Windows\System\SVESuss.exe
  2⤵
  PID:8932
- C:\Windows\System\JPgSJJH.exe
  C:\Windows\System\JPgSJJH.exe
  2⤵
  PID:8948
- C:\Windows\System\znCNkDP.exe
  C:\Windows\System\znCNkDP.exe
  2⤵
  PID:8964
- C:\Windows\System\clKTRhx.exe
  C:\Windows\System\clKTRhx.exe
  2⤵
  PID:8980
- C:\Windows\System\oavhUgA.exe
  C:\Windows\System\oavhUgA.exe
  2⤵
  PID:8996
- C:\Windows\System\wpKHmEw.exe
  C:\Windows\System\wpKHmEw.exe
  2⤵
  PID:9016
- C:\Windows\System\zBiHkBt.exe
  C:\Windows\System\zBiHkBt.exe
  2⤵
  PID:9032
- C:\Windows\System\QTFdSdC.exe
  C:\Windows\System\QTFdSdC.exe
  2⤵
  PID:9048
- C:\Windows\System\ncnvhMq.exe
  C:\Windows\System\ncnvhMq.exe
  2⤵
  PID:9064
- C:\Windows\System\TkJcSCR.exe
  C:\Windows\System\TkJcSCR.exe
  2⤵
  PID:9080
- C:\Windows\System\EAKiejV.exe
  C:\Windows\System\EAKiejV.exe
  2⤵
  PID:9096
- C:\Windows\System\PDhJtGL.exe
  C:\Windows\System\PDhJtGL.exe
  2⤵
  PID:9112
- C:\Windows\System\zvSWoKm.exe
  C:\Windows\System\zvSWoKm.exe
  2⤵
  PID:9128
- C:\Windows\System\fwhjcaX.exe
  C:\Windows\System\fwhjcaX.exe
  2⤵
  PID:9144
- C:\Windows\System\QFfTuvo.exe
  C:\Windows\System\QFfTuvo.exe
  2⤵
  PID:9160
- C:\Windows\System\wxoekAb.exe
  C:\Windows\System\wxoekAb.exe
  2⤵
  PID:9180
- C:\Windows\System\rMptWPu.exe
  C:\Windows\System\rMptWPu.exe
  2⤵
  PID:9196
- C:\Windows\System\KmTurfD.exe
  C:\Windows\System\KmTurfD.exe
  2⤵
  PID:9212
- C:\Windows\System\kRLoJIB.exe
  C:\Windows\System\kRLoJIB.exe
  2⤵
  PID:8116
- C:\Windows\System\TTGRUoT.exe
  C:\Windows\System\TTGRUoT.exe
  2⤵
  PID:7480
- C:\Windows\System\sBXEGnF.exe
  C:\Windows\System\sBXEGnF.exe
  2⤵
  PID:6112
- C:\Windows\System\KgOfGhr.exe
  C:\Windows\System\KgOfGhr.exe
  2⤵
  PID:8356
- C:\Windows\System\kPSVsQi.exe
  C:\Windows\System\kPSVsQi.exe
  2⤵
  PID:8376
- C:\Windows\System\trdOfhN.exe
  C:\Windows\System\trdOfhN.exe
  2⤵
  PID:8396
- C:\Windows\System\HAYonrO.exe
  C:\Windows\System\HAYonrO.exe
  2⤵
  PID:8500
- C:\Windows\System\KMFIfuN.exe
  C:\Windows\System\KMFIfuN.exe
  2⤵
  PID:8540
- C:\Windows\System\TzVNzBN.exe
  C:\Windows\System\TzVNzBN.exe
  2⤵
  PID:8428
- C:\Windows\System\pYGZlWG.exe
  C:\Windows\System\pYGZlWG.exe
  2⤵
  PID:8620
- C:\Windows\System\abpBUGM.exe
  C:\Windows\System\abpBUGM.exe
  2⤵
  PID:8432
- C:\Windows\System\JAQrrUk.exe
  C:\Windows\System\JAQrrUk.exe
  2⤵
  PID:8420
- C:\Windows\System\qseZPWY.exe
  C:\Windows\System\qseZPWY.exe
  2⤵
  PID:8456
- C:\Windows\System\vJdzRgk.exe
  C:\Windows\System\vJdzRgk.exe
  2⤵
  PID:8544
- C:\Windows\System\WZbypJA.exe
  C:\Windows\System\WZbypJA.exe
  2⤵
  PID:8600
- C:\Windows\System\nRZEErH.exe
  C:\Windows\System\nRZEErH.exe
  2⤵
  PID:8660
- C:\Windows\System\NeEzUeG.exe
  C:\Windows\System\NeEzUeG.exe
  2⤵
  PID:8680
- C:\Windows\System\PdtdSCc.exe
  C:\Windows\System\PdtdSCc.exe
  2⤵
  PID:8692
- C:\Windows\System\VOMfMyt.exe
  C:\Windows\System\VOMfMyt.exe
  2⤵
  PID:8716
- C:\Windows\System\fDbUBeF.exe
  C:\Windows\System\fDbUBeF.exe
  2⤵
  PID:8736
- C:\Windows\System\PzcUcPA.exe
  C:\Windows\System\PzcUcPA.exe
  2⤵
  PID:8828
- C:\Windows\System\ofGPhph.exe
  C:\Windows\System\ofGPhph.exe
  2⤵
  PID:8896
- C:\Windows\System\MGWKIFL.exe
  C:\Windows\System\MGWKIFL.exe
  2⤵
  PID:8960
- C:\Windows\System\peSpHug.exe
  C:\Windows\System\peSpHug.exe
  2⤵
  PID:9024
- C:\Windows\System\jhfiBjy.exe
  C:\Windows\System\jhfiBjy.exe
  2⤵
  PID:9004
- C:\Windows\System\HYTfrQZ.exe
  C:\Windows\System\HYTfrQZ.exe
  2⤵
  PID:8812
- C:\Windows\System\vBQaFQE.exe
  C:\Windows\System\vBQaFQE.exe
  2⤵
  PID:8748
- C:\Windows\System\yjuFWVR.exe
  C:\Windows\System\yjuFWVR.exe
  2⤵
  PID:8848
- C:\Windows\System\KozCAiy.exe
  C:\Windows\System\KozCAiy.exe
  2⤵
  PID:9056
- C:\Windows\System\PGYDjWI.exe
  C:\Windows\System\PGYDjWI.exe
  2⤵
  PID:9092
- C:\Windows\System\YRjCUeC.exe
  C:\Windows\System\YRjCUeC.exe
  2⤵
  PID:9152
- C:\Windows\System\UjbaKCH.exe
  C:\Windows\System\UjbaKCH.exe
  2⤵
  PID:8036
- C:\Windows\System\UgKISBS.exe
  C:\Windows\System\UgKISBS.exe
  2⤵
  PID:8200
- C:\Windows\System\kMMqide.exe
  C:\Windows\System\kMMqide.exe
  2⤵
  PID:8272
- C:\Windows\System\FabZucb.exe
  C:\Windows\System\FabZucb.exe
  2⤵
  PID:8320
- C:\Windows\System\qnKGNuw.exe
  C:\Windows\System\qnKGNuw.exe
  2⤵
  PID:8556
- C:\Windows\System\tonCpDd.exe
  C:\Windows\System\tonCpDd.exe
  2⤵
  PID:8720
- C:\Windows\System\qdxhhmw.exe
  C:\Windows\System\qdxhhmw.exe
  2⤵
  PID:8908
- C:\Windows\System\jXwFQHx.exe
  C:\Windows\System\jXwFQHx.exe
  2⤵
  PID:8816
- C:\Windows\System\fhteakg.exe
  C:\Windows\System\fhteakg.exe
  2⤵
  PID:8640
- C:\Windows\System\pkUPwqO.exe
  C:\Windows\System\pkUPwqO.exe
  2⤵
  PID:9124
- C:\Windows\System\ZdsNmHa.exe
  C:\Windows\System\ZdsNmHa.exe
  2⤵
  PID:9076
- C:\Windows\System\XpnzeWX.exe
  C:\Windows\System\XpnzeWX.exe
  2⤵
  PID:8412
- C:\Windows\System\edIyDRB.exe
  C:\Windows\System\edIyDRB.exe
  2⤵
  PID:8516
- C:\Windows\System\qjJZmIJ.exe
  C:\Windows\System\qjJZmIJ.exe
  2⤵
  PID:8864
- C:\Windows\System\BLMSTwq.exe
  C:\Windows\System\BLMSTwq.exe
  2⤵
  PID:9108
- C:\Windows\System\RLgcxss.exe
  C:\Windows\System\RLgcxss.exe
  2⤵
  PID:9168
- C:\Windows\System\qWSicTh.exe
  C:\Windows\System\qWSicTh.exe
  2⤵
  PID:9172
- C:\Windows\System\hodVBUs.exe
  C:\Windows\System\hodVBUs.exe
  2⤵
  PID:8004
- C:\Windows\System\pPlalui.exe
  C:\Windows\System\pPlalui.exe
  2⤵
  PID:8216
- C:\Windows\System\TQwFkJw.exe
  C:\Windows\System\TQwFkJw.exe
  2⤵
  PID:8332
- C:\Windows\System\VzKQJHO.exe
  C:\Windows\System\VzKQJHO.exe
  2⤵
  PID:8256
- C:\Windows\System\hazXsGn.exe
  C:\Windows\System\hazXsGn.exe
  2⤵
  PID:8232
- C:\Windows\System\lKgqKOU.exe
  C:\Windows\System\lKgqKOU.exe
  2⤵
  PID:8380
- C:\Windows\System\gkQydNJ.exe
  C:\Windows\System\gkQydNJ.exe
  2⤵
  PID:8472
- C:\Windows\System\VwdSBrO.exe
  C:\Windows\System\VwdSBrO.exe
  2⤵
  PID:8424
- C:\Windows\System\LkXRIcN.exe
  C:\Windows\System\LkXRIcN.exe
  2⤵
  PID:8668
- C:\Windows\System\WZxAehq.exe
  C:\Windows\System\WZxAehq.exe
  2⤵
  PID:8976
- C:\Windows\System\ByLLfWo.exe
  C:\Windows\System\ByLLfWo.exe
  2⤵
  PID:8876
- C:\Windows\System\pAponYv.exe
  C:\Windows\System\pAponYv.exe
  2⤵
  PID:9228
- C:\Windows\System\SLiKien.exe
  C:\Windows\System\SLiKien.exe
  2⤵
  PID:9244
- C:\Windows\System\YUiISrO.exe
  C:\Windows\System\YUiISrO.exe
  2⤵
  PID:9264
- C:\Windows\System\eREQmqb.exe
  C:\Windows\System\eREQmqb.exe
  2⤵
  PID:9284
- C:\Windows\System\BVRzPZg.exe
  C:\Windows\System\BVRzPZg.exe
  2⤵
  PID:9300
- C:\Windows\System\LciCWLI.exe
  C:\Windows\System\LciCWLI.exe
  2⤵
  PID:9324
- C:\Windows\System\LuRIhWb.exe
  C:\Windows\System\LuRIhWb.exe
  2⤵
  PID:9348
- C:\Windows\System\lKgszgI.exe
  C:\Windows\System\lKgszgI.exe
  2⤵
  PID:9364
- C:\Windows\System\IVRRYYS.exe
  C:\Windows\System\IVRRYYS.exe
  2⤵
  PID:9384
- C:\Windows\System\DoybsNG.exe
  C:\Windows\System\DoybsNG.exe
  2⤵
  PID:9400
- C:\Windows\System\tWNnIVz.exe
  C:\Windows\System\tWNnIVz.exe
  2⤵
  PID:9416
- C:\Windows\System\dUUsmEL.exe
  C:\Windows\System\dUUsmEL.exe
  2⤵
  PID:9432
- C:\Windows\System\ghPvoUX.exe
  C:\Windows\System\ghPvoUX.exe
  2⤵
  PID:9448
- C:\Windows\System\tUcNHHm.exe
  C:\Windows\System\tUcNHHm.exe
  2⤵
  PID:9476
- C:\Windows\System\FlpdydP.exe
  C:\Windows\System\FlpdydP.exe
  2⤵
  PID:9500
- C:\Windows\System\kfLDZbu.exe
  C:\Windows\System\kfLDZbu.exe
  2⤵
  PID:9548
- C:\Windows\System\hQAKnIt.exe
  C:\Windows\System\hQAKnIt.exe
  2⤵
  PID:9564
- C:\Windows\System\UYtciBv.exe
  C:\Windows\System\UYtciBv.exe
  2⤵
  PID:9584
- C:\Windows\System\EbvocCe.exe
  C:\Windows\System\EbvocCe.exe
  2⤵
  PID:9608
- C:\Windows\System\TuCTauo.exe
  C:\Windows\System\TuCTauo.exe
  2⤵
  PID:9628
- C:\Windows\System\fePMHLO.exe
  C:\Windows\System\fePMHLO.exe
  2⤵
  PID:9656
- C:\Windows\System\mZXKPhd.exe
  C:\Windows\System\mZXKPhd.exe
  2⤵
  PID:9672
- C:\Windows\System\PrLvGAV.exe
  C:\Windows\System\PrLvGAV.exe
  2⤵
  PID:9688
- C:\Windows\System\dsLpjPx.exe
  C:\Windows\System\dsLpjPx.exe
  2⤵
  PID:9704
- C:\Windows\System\SGWEsyT.exe
  C:\Windows\System\SGWEsyT.exe
  2⤵
  PID:9720
- C:\Windows\System\NniVSXt.exe
  C:\Windows\System\NniVSXt.exe
  2⤵
  PID:9736
- C:\Windows\System\VXwouso.exe
  C:\Windows\System\VXwouso.exe
  2⤵
  PID:9752
- C:\Windows\System\pVRCtQs.exe
  C:\Windows\System\pVRCtQs.exe
  2⤵
  PID:9768
- C:\Windows\System\YtwkMjw.exe
  C:\Windows\System\YtwkMjw.exe
  2⤵
  PID:9784
- C:\Windows\System\jUmyFol.exe
  C:\Windows\System\jUmyFol.exe
  2⤵
  PID:9800
- C:\Windows\System\OrwihXS.exe
  C:\Windows\System\OrwihXS.exe
  2⤵
  PID:9816
- C:\Windows\System\ZSuctHk.exe
  C:\Windows\System\ZSuctHk.exe
  2⤵
  PID:9832
- C:\Windows\System\QhLEfzi.exe
  C:\Windows\System\QhLEfzi.exe
  2⤵
  PID:9848
- C:\Windows\System\mKSgDfZ.exe
  C:\Windows\System\mKSgDfZ.exe
  2⤵
  PID:9864
- C:\Windows\System\gBdWLlv.exe
  C:\Windows\System\gBdWLlv.exe
  2⤵
  PID:9880
- C:\Windows\System\WawfZnD.exe
  C:\Windows\System\WawfZnD.exe
  2⤵
  PID:9896
- C:\Windows\System\PTqTWqq.exe
  C:\Windows\System\PTqTWqq.exe
  2⤵
  PID:9912
- C:\Windows\System\etZXkLK.exe
  C:\Windows\System\etZXkLK.exe
  2⤵
  PID:9928
- C:\Windows\System\yfzPboq.exe
  C:\Windows\System\yfzPboq.exe
  2⤵
  PID:9444
- C:\Windows\System\faJXpcx.exe
  C:\Windows\System\faJXpcx.exe
  2⤵
  PID:10004
- C:\Windows\System\OMTKjin.exe
  C:\Windows\System\OMTKjin.exe
  2⤵
  PID:10024
- C:\Windows\System\tYgoLvU.exe
  C:\Windows\System\tYgoLvU.exe
  2⤵
  PID:10056
- C:\Windows\System\lhhukon.exe
  C:\Windows\System\lhhukon.exe
  2⤵
  PID:10080
- C:\Windows\System\edKKdbc.exe
  C:\Windows\System\edKKdbc.exe
  2⤵
  PID:10104
- C:\Windows\System\eVRPpmJ.exe
  C:\Windows\System\eVRPpmJ.exe
  2⤵
  PID:10120
- C:\Windows\System\YLppTdm.exe
  C:\Windows\System\YLppTdm.exe
  2⤵
  PID:10140
- C:\Windows\System\ZEkBkGN.exe
  C:\Windows\System\ZEkBkGN.exe
  2⤵
  PID:10160
- C:\Windows\System\wJmubVa.exe
  C:\Windows\System\wJmubVa.exe
  2⤵
  PID:10180
- C:\Windows\System\qvxpIcI.exe
  C:\Windows\System\qvxpIcI.exe
  2⤵
  PID:10216
- C:\Windows\System\aoqvwYJ.exe
  C:\Windows\System\aoqvwYJ.exe
  2⤵
  PID:10100
- C:\Windows\System\EcVeQOr.exe
  C:\Windows\System\EcVeQOr.exe
  2⤵
  PID:9392
- C:\Windows\System\JlWMafs.exe
  C:\Windows\System\JlWMafs.exe
  2⤵
  PID:9464
- C:\Windows\System\akMOjZt.exe
  C:\Windows\System\akMOjZt.exe
  2⤵
  PID:7580
- C:\Windows\System\VwZgYxc.exe
  C:\Windows\System\VwZgYxc.exe
  2⤵
  PID:9796
- C:\Windows\System\ENXEIVv.exe
  C:\Windows\System\ENXEIVv.exe
  2⤵
  PID:10036
- C:\Windows\System\FRthKvH.exe
  C:\Windows\System\FRthKvH.exe
  2⤵
  PID:9556
- C:\Windows\System\TqwrQVI.exe
  C:\Windows\System\TqwrQVI.exe
  2⤵
  PID:10204
- C:\Windows\System\ksaFkiV.exe
  C:\Windows\System\ksaFkiV.exe
  2⤵
  PID:10232
- C:\Windows\System\JczzMHF.exe
  C:\Windows\System\JczzMHF.exe
  2⤵
  PID:8768
- C:\Windows\System\uEcvLIr.exe
  C:\Windows\System\uEcvLIr.exe
  2⤵
  PID:9508
- C:\Windows\System\mPlvpYO.exe
  C:\Windows\System\mPlvpYO.exe
  2⤵
  PID:9604
- C:\Windows\System\suhGCOI.exe
  C:\Windows\System\suhGCOI.exe
  2⤵
  PID:9716
- C:\Windows\System\pXLsiaZ.exe
  C:\Windows\System\pXLsiaZ.exe
  2⤵
  PID:9936
- C:\Windows\System\DlNVMot.exe
  C:\Windows\System\DlNVMot.exe
  2⤵
  PID:9952
- C:\Windows\System\AAbHyie.exe
  C:\Windows\System\AAbHyie.exe
  2⤵
  PID:9976
- C:\Windows\System\YJUfVkB.exe
  C:\Windows\System\YJUfVkB.exe
  2⤵
  PID:10048
- C:\Windows\System\OltGenX.exe
  C:\Windows\System\OltGenX.exe
  2⤵
  PID:9992
- C:\Windows\System\mmJsLRl.exe
  C:\Windows\System\mmJsLRl.exe
  2⤵
  PID:10172
- C:\Windows\System\MyIQgQo.exe
  C:\Windows\System\MyIQgQo.exe
  2⤵
  PID:8796
- C:\Windows\System\YyZBcXF.exe
  C:\Windows\System\YyZBcXF.exe
  2⤵
  PID:8336
- C:\Windows\System\fhDDpXg.exe
  C:\Windows\System\fhDDpXg.exe
  2⤵
  PID:10108
- C:\Windows\System\IuAroRN.exe
  C:\Windows\System\IuAroRN.exe
  2⤵
  PID:9044
- C:\Windows\System\WAKtpSN.exe
  C:\Windows\System\WAKtpSN.exe
  2⤵
  PID:10064
- C:\Windows\System\ryxSQpm.exe
  C:\Windows\System\ryxSQpm.exe
  2⤵
  PID:10176
- C:\Windows\System\AHxhnrG.exe
  C:\Windows\System\AHxhnrG.exe
  2⤵
  PID:1576
- C:\Windows\System\AcveQEf.exe
  C:\Windows\System\AcveQEf.exe
  2⤵
  PID:9428
- C:\Windows\System\pABGWrI.exe
  C:\Windows\System\pABGWrI.exe
  2⤵
  PID:8404
- C:\Windows\System\WLUpcWV.exe
  C:\Windows\System\WLUpcWV.exe
  2⤵
  PID:8452
- C:\Windows\System\mLyaBPg.exe
  C:\Windows\System\mLyaBPg.exe
  2⤵
  PID:8552
- C:\Windows\System\odiqPkz.exe
  C:\Windows\System\odiqPkz.exe
  2⤵
  PID:9120
- C:\Windows\System\JIOKhui.exe
  C:\Windows\System\JIOKhui.exe
  2⤵
  PID:9320
- C:\Windows\System\vyxBUWf.exe
  C:\Windows\System\vyxBUWf.exe
  2⤵
  PID:9276
- C:\Windows\System\ZfCWbBq.exe
  C:\Windows\System\ZfCWbBq.exe
  2⤵
  PID:9344
- C:\Windows\System\iVgZfOt.exe
  C:\Windows\System\iVgZfOt.exe
  2⤵
  PID:9260
- C:\Windows\System\uFFUIrP.exe
  C:\Windows\System\uFFUIrP.exe
  2⤵
  PID:8568
- C:\Windows\System\CzLNupJ.exe
  C:\Windows\System\CzLNupJ.exe
  2⤵
  PID:8292
- C:\Windows\System\EVMrVJW.exe
  C:\Windows\System\EVMrVJW.exe
  2⤵
  PID:9732
- C:\Windows\System\dQCPDSj.exe
  C:\Windows\System\dQCPDSj.exe
  2⤵
  PID:9792
- C:\Windows\System\HdvCyaF.exe
  C:\Windows\System\HdvCyaF.exe
  2⤵
  PID:9524
- C:\Windows\System\VbmrjOt.exe
  C:\Windows\System\VbmrjOt.exe
  2⤵
  PID:9680
- C:\Windows\System\YGPIkba.exe
  C:\Windows\System\YGPIkba.exe
  2⤵
  PID:9696
- C:\Windows\System\cLhIxLI.exe
  C:\Windows\System\cLhIxLI.exe
  2⤵
  PID:9856
- C:\Windows\System\LvbXjxL.exe
  C:\Windows\System\LvbXjxL.exe
  2⤵
  PID:9860
- C:\Windows\System\WaSarDf.exe
  C:\Windows\System\WaSarDf.exe
  2⤵
  PID:10044
- C:\Windows\System\DrqjbDD.exe
  C:\Windows\System\DrqjbDD.exe
  2⤵
  PID:10132
- C:\Windows\System\qGsRiDR.exe
  C:\Windows\System\qGsRiDR.exe
  2⤵
  PID:9904
- C:\Windows\System\AbqzUcj.exe
  C:\Windows\System\AbqzUcj.exe
  2⤵
  PID:9964
- C:\Windows\System\cZHjWmM.exe
  C:\Windows\System\cZHjWmM.exe
  2⤵
  PID:10200
- C:\Windows\System\kaaqBxf.exe
  C:\Windows\System\kaaqBxf.exe
  2⤵
  PID:10212
- C:\Windows\System\pjAykHZ.exe
  C:\Windows\System\pjAykHZ.exe
  2⤵
  PID:8064
- C:\Windows\System\JWVXgDq.exe
  C:\Windows\System\JWVXgDq.exe
  2⤵
  PID:10224
- C:\Windows\System\vULEeNk.exe
  C:\Windows\System\vULEeNk.exe
  2⤵
  PID:9948
- C:\Windows\System\KHIBPrr.exe
  C:\Windows\System\KHIBPrr.exe
  2⤵
  PID:9192
- C:\Windows\System\sltchaN.exe
  C:\Windows\System\sltchaN.exe
  2⤵
  PID:9968
- C:\Windows\System\TznIgly.exe
  C:\Windows\System\TznIgly.exe
  2⤵
  PID:9572
- C:\Windows\System\SAMwoTu.exe
  C:\Windows\System\SAMwoTu.exe
  2⤵
  PID:9528
- C:\Windows\System\sQJgfYQ.exe
  C:\Windows\System\sQJgfYQ.exe
  2⤵
  PID:10192
- C:\Windows\System\NohZxHe.exe
  C:\Windows\System\NohZxHe.exe
  2⤵
  PID:10148
- C:\Windows\System\cUNYOlc.exe
  C:\Windows\System\cUNYOlc.exe
  2⤵
  PID:9988
- C:\Windows\System\birKSkI.exe
  C:\Windows\System\birKSkI.exe
  2⤵
  PID:10076
- C:\Windows\System\DFHTxcs.exe
  C:\Windows\System\DFHTxcs.exe
  2⤵
  PID:8228
- C:\Windows\System\gxEMFMw.exe
  C:\Windows\System\gxEMFMw.exe
  2⤵
  PID:9648
- C:\Windows\System\WSnWsFT.exe
  C:\Windows\System\WSnWsFT.exe
  2⤵
  PID:9236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AsemeIt.exe

Filesize
1.9MB

MD5
d86746cb72bd6b632c83fee5d788b9e7

SHA1
18096a16b09d1fb0cb06f88ae4b47f5a1aefd88c

SHA256
3f49b7120f68be3f316d3a137a7480a8a5b2378a8258059ffa515f31cee9d7b5

SHA512
ea7b0768b6ef67eb9d54c2b74148afd6211129d3518f4b3908d8ca7f3cddfa72ec9f43d42adafbda23d742a7512ccf2d6544cc4870e6ec66a0a27f13ce9d9fae

Download Submit
C:\Windows\system\BBsNbNx.exe

Filesize
1.9MB

MD5
a2ce38e27215ed13d2ad41b41c0bd7a4

SHA1
16caf71e6ddc6b0010e8e34782702fb84a97a7d8

SHA256
0f888332617f4e206ebe4a841299c226a629d3020f79e2ba7575d8630bbc0803

SHA512
c381e3607237e7ecd60827aeba274187dc53ec497b8c004157a4eae9f052b2a224dc7226563daa6ceb80b9f46934ede31f748b530aba0efce70b95ebf1d54085

Download Submit
C:\Windows\system\DievcsS.exe

Filesize
1.9MB

MD5
f7f29c29224910b3f62e8545516c10c3

SHA1
125f492102c1cd344f98ba589857bebfdc142f00

SHA256
e62d28b4b1a42e2d6ea653669ea3ba4fc3845ef75489a790b42f13cd85e8ee5e

SHA512
4cddd57fa725e1d25463f56ec0a89cda7a4b6754247b04eed394e2cf1b0aebd28d20963d445632ae4ce76069af101b4d72efde6bf05a93ea27511a6bbadb98f7

Download Submit
C:\Windows\system\GcuTHHM.exe

Filesize
1.9MB

MD5
9e7fc5b7565d99924cd7868823c2d598

SHA1
ee8ee1c2c50fbff439b42d09c4d84fa55559a6b1

SHA256
dfd8f39d6ed5759afb14e61cd5745245a15d3bd80a131b634b6fb6224e093dab

SHA512
1166ee1c2018e72ef4d61d37241bd1038d24784aa6e802aa5d4914bb3d0f736ede4ed6b97e07b51fc7a73dfdb1e9b82c4af992be20f258ce89642c0baf6f672c

Download Submit
C:\Windows\system\HeEDtvr.exe

Filesize
1.9MB

MD5
effdefab43fecdad7ef727c97dfa3a4e

SHA1
da4487249c8a3cc56109c8c4bcaa242334233a53

SHA256
ac80d5c3ba03939533d524ed1ac2faa43068bd2c4c4081870b3074ce668d0a92

SHA512
2f7a0cb7b6f7e0c5a5c20e414ce854fab44651e299ce886c5e6be6e889bc1b9833e99c8f1122ad3bdc8ebb4ff45c40feef3a7f67029dc8a5582def543ef15205

Download Submit
C:\Windows\system\JVeRxLx.exe

Filesize
1.9MB

MD5
f429c86cdaeabce0844e416266b9ff20

SHA1
d5105bdfb0a8bacd235d021780aa06f984c2ddb4

SHA256
1a94b461fd18d12a65916736f440949c4231b532e30bd88dbff87b4d6e407d0c

SHA512
d278b99654f923c6e1de21152f7528859c5ae0dfc19d6ce753a68817b1c598c82d81f4147310eb9019ca8134c3644aca394bc1ca88e42298114f010d3f8456c5

Download Submit
C:\Windows\system\LRJqlOy.exe

Filesize
1.9MB

MD5
246131efa80db50314726bc650289dca

SHA1
54e8dd399da70f2364bd62bf21eb88b48b8eea09

SHA256
a380d1ed80d4ed347f68dcb5f428dc254264dd95484cfb773c34f7c7d896d155

SHA512
1c5f7e9e50382946a67ce35bae3537b58dcbb3341ae23d521c9f4249d9e1412059fc7bf95a6ca7b2f2919d38b387ded91b18f1c004ad4449a83b282fe4dbdaf0

Download Submit
C:\Windows\system\NpGZyln.exe

Filesize
1.9MB

MD5
3928a7989eee0716443090e0091f8ef0

SHA1
54a6d29db9ee574929d48d446f760f1e33610716

SHA256
c6b65643a17d37eb993a4c3e532c42d7086a81b5d3b624aa27691c3f42c96396

SHA512
625af71cbf75a54e788f49f0150476961369528664e8ab8570f230d27f448b6698cf603fb778883a50a9f31bf4dbb7313da6f68bfde2189290297b179bbf921f

Download Submit
C:\Windows\system\NpwdPNS.exe

Filesize
1.9MB

MD5
fd7b0d44c12c2b744ebda68560050a3f

SHA1
fa61170821a4efaa8b53ffaa119d9352c68d568c

SHA256
6d0a79ab8458d778d030035eba59c5f1a495280dbd8976f7c5e0508bd0c22019

SHA512
e4511652c2c83dceec5e18a658f4e2e8137b404423521f68abd02aa94c3147e296a137dab4c833879dcc2f937a9571f78877899555e134988256355cf3b25450

Download Submit
C:\Windows\system\WhkMiVk.exe

Filesize
1.9MB

MD5
74ed63fb55242e773c70c4ec035a669b

SHA1
022376a806c2b818c8cae3f80009c79864914419

SHA256
43259fa3433a1f2971c3f5f8b8818a674bd40fff0c593ae37c31760bce7eac9f

SHA512
5df0ac91d2344c8cd2e6bb47040fc33c9305c557b3d439840e79e3c101d15f38c63e921b830ea9e7327fb1c179c01d10a2568a8c83874ac9a63249a6997a9141

Download Submit
C:\Windows\system\XATSXjN.exe

Filesize
1.9MB

MD5
e606061b695de160da9e10dcd50edf51

SHA1
5547d6fb69c6e195fa68179a17b7dd61bffd697c

SHA256
863f546e93a60acd00057640a405f3b3ea7abcc97c81263bb25df0c158ee8ae7

SHA512
96ce69dcdb11f57052793b3350176431a32c2cfbeabafb1917cca829a5327f25d986e605fc0bca6847cae403a0fd404e783523eca8c4966d784bff4b0e05b3a1

Download Submit
C:\Windows\system\ZSCpGKn.exe

Filesize
1.9MB

MD5
3058ee1ffe5130f10fe7ff1b30f922f9

SHA1
31e33f71e69941ae0fe9338ab45aef7e11f34218

SHA256
efc66ed4ef3aa35e0e434b5768863bb19e6261d5a3aeec8a0263021b607377b0

SHA512
bd228f272ccc1329e5b6ebbb0137f5f9456a49b77703c7c8ea9d1c1a3e17cf5c9f26d498444bdbfc98ccf277acd59dc49f230e7d1fb13b0a96d4d0c9c51e7d2a

Download Submit
C:\Windows\system\aHQehoB.exe

Filesize
1.9MB

MD5
36d8528e9c25458286ec1f30889bc94a

SHA1
a3be52ac6e54295c51dff1d3ad497d5e82de0514

SHA256
60023d888249d2bf89cadaaa14b030a455ee733e13d1db038291fea5ef8cc83f

SHA512
3d21d990fbbc6338902194ad0e6f93d761d6158abfd58825eac215fbb80d61f4071b236c66a4f451bd52d443cfa4784164b6cce4a3374935681e2eac4b51ea54

Download Submit
C:\Windows\system\cPjpriS.exe

Filesize
1.9MB

MD5
0e82cd1c2067e8f511652d6ca3ad1259

SHA1
f0bde0aa7bca2d572b02b79341357ea08082fc0d

SHA256
18be92096a63b37eb9961938970a15093b9510789f7dcc2238626db8847b0891

SHA512
6cd06315609da33fbf88c2e2ceb0b4432d75ce1bef92f5143cf2ba36871cf77b3b8e8045eb0d33d33c331ec159b2fe71fd34afc80ffe217c1ace06e19e838e75

Download Submit
C:\Windows\system\dwOJCXe.exe

Filesize
1.9MB

MD5
91556e0e8965b517d3be73073b0ef8a4

SHA1
cc9438b2716968a4693375d50ed04c7cecda33a2

SHA256
e8ed1364674888060606783f0f17a55e1c26845202d78ccfb7c1a1f5a5087ed4

SHA512
8759ebe9254032dca5da5bb87af36e74d56f348966b8ffeb9b6282632561f88cb8ebe6a4827d3f85eff056ec3c1c572d2470da4c7be140d8164f863bb5e83a85

Download Submit
C:\Windows\system\fOceFOz.exe

Filesize
1.9MB

MD5
54caa3c98b150498b431d7a8fec3800f

SHA1
c0102f52ee4f6223b31020995f0ba5fbeda5bf6c

SHA256
f670d52134606b7cecaec9cf47b22fe5db1670ce37f281cfc236fa24dc436ea3

SHA512
295a7b8082e82f173efbb10562ca20023148e5953fe5ad0994f2eb2da4e33bb955c3e6d4136cf932b03166e02fb4346dfd2e987fb1621bdb8b192694b5c13cb4

Download Submit
C:\Windows\system\iVqGoaf.exe

Filesize
1.9MB

MD5
9646e31b3986efa3aaab73cec726d76f

SHA1
97bb6c91c01835ae2d3ee54bd738ada86db4e1ed

SHA256
26c5d7182d320322b4d5aa55641b86761ed73b1d3e4fa83602dc783334920eea

SHA512
0f5863ea9a1ba62755d1ebd0290b00a33877e133001aadc6691edd2537369d72db7e7fffdfe780d5239fca741634531dae72644892ea2aa8135020c20bd48f57

Download Submit
C:\Windows\system\jxMiSyn.exe

Filesize
1.9MB

MD5
2c6ce473d1af3d4bc009c6365d9975c2

SHA1
12782fd40b41d3190cdb56fa64153a7fe38cb319

SHA256
9a9e5d949ab801ae1e72fd2a7c7947bfe7dc4afe76b432100fd3a66876e2975f

SHA512
82d2c36f31e3feb6f264882cf252b07e4ab04c9f0023ab2d1336594d2ac65baddfe0fd2c7142ccf295cc28e8a9f6be0e2cdf2a6b6aec7a715fae7b90002d2ddf

Download Submit
C:\Windows\system\lVweJws.exe

Filesize
1.9MB

MD5
751ce5fa7ee9cd52efc96d8714c10bb8

SHA1
e1aa9ba48027c94446cb9b21a4e03429b35f2155

SHA256
d428e3a9a95e5e4a6f5cae1405e4bdf40c9ed8ce61a9063fb6ac06b901bb386f

SHA512
4b2d87f140af1184147cf9160da09fb2d437308adb60eecbc3d5ba5d794200bb4a1623271a519f4ea5d7d4d9d140c5d395ef44bd410586038e1cea106a73beda

Download Submit
C:\Windows\system\oTeMpnY.exe

Filesize
1.9MB

MD5
1420ac1c559505d7c739952595fb81d1

SHA1
213a4779cf4e33ea44e5bf879781d0282992833d

SHA256
6ebd8033218053e82b30636b6a285e7825cead2fd01af1ec44d8c229205579a5

SHA512
aa92bc8d084c7630eac21abac065ef1085310271f118cca2395fcd2abe23ae8e022d70cb7e7c626c0978a519dfe0c52a902c34bbf36f40fcad036322bf4f8eb5

Download Submit
C:\Windows\system\pQZGClv.exe

Filesize
1.9MB

MD5
454c75b6af68c66a74b96ba6efb46d7c

SHA1
50baa8e875708774fb51d8909ed0e325e93fc5ba

SHA256
898c05dabce514ffce0a698584f4b757b2931b218250a3789ee6ac0061f37f56

SHA512
ac5653cac4d1308d4549e88d2511e7a7112a08a1e303dec9b886b0c09a1297082844ae55577abd1ca4ca2e5bd1a5f2099aa02aee3866b7e632c6ee3eaff8ddbb

Download Submit
C:\Windows\system\rzfHOqc.exe

Filesize
1.9MB

MD5
e3b563a7a168bc5755f1489cd406e8ae

SHA1
a4480001b9d395d284885c5a6235957bb3f1ab41

SHA256
ac2f15c71388e2f23c62c01ebff5ea9a0fdf4a37372186585f5a747ad84c10f2

SHA512
0b322de4549478b01f239285543be74c7940ae6000b6050f0085cc40066ce6532554b80cbed180f00f204f77af118090366d2fafc6ea7c24f7d07fd6697ccd99

Download Submit
C:\Windows\system\uUmBOqm.exe

Filesize
1.9MB

MD5
123af18e214a39ef864509d3f172e684

SHA1
bf5bac22e9e6831d916d6dd90025df66d686f9c3

SHA256
84b4d4592afafd50389d5fc640430776842fb1b88d27b73cc83c8703a623e7e0

SHA512
b1fbb2b11717789c9d8b48d9df624929bf02abd087991cbc57dbcd15fe4a900d5c86d29da264ed444451eb1c49f3db88e48c0dfa478dba0c0024afbfc4dc2510

Download Submit
C:\Windows\system\xrQjHqL.exe

Filesize
1.9MB

MD5
2d354533df56198e551ed6e4a3e80baa

SHA1
2a61379511f6802b616f1bacf4bb74b5788e889a

SHA256
d22f000279de04bea0a87e7fe3f75de5f744bc85922e0081049d518ef0f26996

SHA512
8423390a5e8cc1238214d18096858464ff5ee24fbdfe55771ecbd47fd056863c781f87127917ba5e56c1b65f19e27bf3190d55c4e6a1a0a78fb28a537a7ca76b

Download Submit
C:\Windows\system\xyfVJRS.exe

Filesize
1.9MB

MD5
0c548c0bcb354fb47f402b6bc204a956

SHA1
4c06a9ad78cf9da791a2fa3b0b50b602b16b4f2a

SHA256
d49e84df111e4a1e4648538630540b89d4f8fbca73ee8dad34480558719a9f9d

SHA512
fe60174e8dd66ab7427678a619461d75a0544548a1710bdcf3d174d2de7ed7c561edf12976566cbf16a890d89c0e4532cfba400ec18925342154517f80871646

Download Submit
C:\Windows\system\yDiVHPy.exe

Filesize
1.9MB

MD5
8b8bfec9afca4f19b002b816608dfbd3

SHA1
551c59fdd0fb234bb8912e018cac7d80e5238b64

SHA256
f4abccf1ba8db224dd12e0b929e69d1690aa5e4eb5e77739068e1d4eea2e0b93

SHA512
0477795bf480c248e27d822b0b4f4162b2c0016f510dbf7b7f8898ca39fc7d37a978361a8e8234d0f02d08b9ee46379196c684da28e46ce4262f31bbd2ca0f81

Download Submit
\Windows\system\DnluPeZ.exe

Filesize
1.9MB

MD5
0403a44f82d5b3ecbb83b820adf39960

SHA1
e2ee27b78337e1d5c5a18c8fd9a11be281244475

SHA256
ff9e7125e47122268910cca2b5a1b4e7a28bb04d8526f317b4f84f5e4a729d09

SHA512
0ae4177909ae81d88023e28ba934c32ec013de44a68f316c5703361231210d4fffe7fd0b60f740a4608253c230ca8961532aa03e3e91f7b872b41eced40767b9

Download Submit
\Windows\system\JCwtjPF.exe

Filesize
1.9MB

MD5
bd24dc1498ee60fa4daeb333e942287e

SHA1
096a114cb499b5a18a567dcc02b6853559fde914

SHA256
ebc6a6cf070db2c35df379b4434c6996f0499f4b4e2a7c5b249d43f560135bfe

SHA512
2bd60bcca13cb4a8b488391bccca829e7f5b43c4590e628ca223f912ca2e2130ec197c1597e977ef6c9299c08ec00cf48717d0ec2f7af7c016f9d3525096f273

Download Submit
\Windows\system\YjFkiKP.exe

Filesize
1.9MB

MD5
0bc1f77143328afd269aff28104c5f58

SHA1
0c652670db7b1c695381bede0427dbd70ae32e0a

SHA256
8c93c3b4ce226129a7c46aae7f45fbb2169e4c1c7f1c2efddf002399c4e150c4

SHA512
cc7e3b7c6ef2635a791a1f07760ff15bc40fe80c02c37beb3965451d23478cc3902228254c8fed6e0e3d3bdcaa007666c07d65b1b4f010bf446156b0671bdd08

Download Submit
\Windows\system\exrssCj.exe

Filesize
1.9MB

MD5
90e0c6f65acd3084b5f87d9982c5e3fa

SHA1
c789fada3cf178e93a0f487b7e2c20495a4f9d77

SHA256
39a486a848a438646c7c1d50a86f65c7d309d060dd807e570d2de49a6924e6d5

SHA512
91cc4ed3be669b211cf61ed7fef23e010ab5306569ee1db9bef076b3d30d2fa6b6d8596638c72e1faa5e9094f5fb12d3fc36f7d1f0cad5041e01c2e9c8693677

Download Submit
\Windows\system\gvuIvCk.exe

Filesize
1.9MB

MD5
5f5b63e54a18f9ee456dccb77ce36bd6

SHA1
6b9e3e29e60b37aa5c460dcc4dbb930a093ab5e7

SHA256
7654b678e0ccbe20470d6917f899638c3623f5b95be55e608364fde33d230cb3

SHA512
c8863d1d756fa1e6500a7aaaaf4df86e55563ffe18c2390aabc605fd20883cf105ee192e4da4d8169810a96fcbaf3cbcc574085a29e1118624ef60fc84174af4

Download Submit
\Windows\system\lvKcntN.exe

Filesize
1.9MB

MD5
976801f3b9154f34d6bd4376b88468fd

SHA1
5e2e7c8803c4d6050bf484d09e25edff2e985689

SHA256
37f8dcb27b6c2611958661a8050270d3607fa52dc6ef93be0ac9ded1943730bf

SHA512
6ef73f5074aa54957f4ce70a0f4da85c4dff71976f0aa518e50a4fe5332d1b39d37caf4edf2eb5dcb39a13cde0fb1ee14112d8ec6e837444948c8228e723b2ff

Download Submit
\Windows\system\zHKnmha.exe

Filesize
1.9MB

MD5
2a917629145545f24ccdee05e56e3bdc

SHA1
cac531c1ecce2c706885b48a8bcba58756aebc64

SHA256
e6ea3504e69f98d89367bc76e69692c740ea7ec2dd18691443d90ab0e7b6220e

SHA512
6e4bedf42bf5ce70afc9f5e617b2997b078579a0e5fabe7180b18b99e7fa51d1a30a6f1f3b141b6dcf60cc32aafec3e1aee9dd616a7896eaae302981157441a6

Download Submit
memory/1964-149-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/1964-145-0x0000000003150000-0x0000000003542000-memory.dmp

Filesize
3.9MB

Download
memory/1964-142-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/1964-0-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/1964-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1964-144-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/1964-126-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/1964-34-0x0000000002D30000-0x0000000003122000-memory.dmp

Filesize
3.9MB

Download
memory/1964-146-0x0000000003150000-0x0000000003542000-memory.dmp

Filesize
3.9MB

Download
memory/1964-111-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/1964-148-0x0000000003150000-0x0000000003542000-memory.dmp

Filesize
3.9MB

Download
memory/1964-55-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/1964-112-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-143-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-147-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2484-138-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2532-46-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2540-52-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-141-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2672-57-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/2696-113-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2916-215-0x000000001B930000-0x000000001BC12000-memory.dmp

Filesize
2.9MB

Download
memory/2916-216-0x0000000001D10000-0x0000000001D18000-memory.dmp

Filesize
32KB

Download