xmrig | 3383f0d8b3495834e41ffc143c562531194bdfca58e9607598708e23d339f306

Analysis

max time kernel
8s
max time network
25s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
Size

1.8MB
MD5

0871c9767b76ecebeacad861a7ac579a
SHA1

b1260ff3ebfd284016a045a41330b78961b8d36b
SHA256

3383f0d8b3495834e41ffc143c562531194bdfca58e9607598708e23d339f306
SHA512

3f5a9f02af6413020d62e3a613fd14fc374c407eaa0d01f871f2038e67ca1d880e4f9e73f2fd81d8fc06fc605504d2839fa4d547b2793c5037b8c8ba7d7fa524
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlpZ:NAB8

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 3 IoCs

miner

resource	yara_rule
behavioral1/memory/2648-618-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/2928-636-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/2444-635-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2928	hQTaqKy.exe
2556	QyrWAes.exe
2648	VqtOsNl.exe
3040	VlahsCs.exe
2628	xJFVBhO.exe
2260	MmlrpEE.exe
2588	cntZriR.exe
2452	RuWCFOc.exe
2344	gozDwbN.exe
2592	FNwadrv.exe
2640	nmJROdv.exe
2444	zhKaPti.exe
2504	dqfPDtO.exe
3020	MwywiRw.exe
1868	thfUJOd.exe
2244	kcwNQzI.exe
2976	xEfBPZy.exe
2664	mPztXqG.exe
2704	DnbstEu.exe
1048	wSyElWa.exe
2668	bbGavTv.exe
1636	GHLFtFU.exe
2168	nTjwTzP.exe
2672	nsDMnaB.exe
572	DVohDof.exe
804	yBfWMCf.exe
2516	yfNVmlT.exe
1260	oDnhnCD.exe
1676	kOFoJhL.exe
1404	Dujmbcj.exe
2272	IsIHqKh.exe
1284	axxjxWb.exe
2024	QqWvlCD.exe
1268	tcEpTym.exe
2316	PuXnzju.exe
580	zpkpmMT.exe
2408	IFYlIhW.exe
2792	cxGRefN.exe
1444	SyNOufg.exe
2052	tDoWYxu.exe
1652	NbYWcxk.exe
1820	LSwiPLm.exe
1804	NpWqBUd.exe
1000	kcGQXjQ.exe
1796	dgyKyxG.exe
1124	ShANlgM.exe
1540	PEnqVSV.exe
1828	IZgqVdb.exe
1140	dvUzxlO.exe
2116	uqUSNfM.exe
1164	PETvhCm.exe
1556	sMtqrlT.exe
1552	aqZwqqB.exe
1400	QFagzHe.exe
1840	vyKhvle.exe
1620	bIlWSqA.exe
276	kJpRaBh.exe
2256	GatYIEt.exe
2748	XiUITKY.exe
380	BwocJsq.exe
1648	cLIVfGP.exe
564	bZATqQb.exe
2136	DrjJCRM.exe
2208	OTxndve.exe

Loads dropped DLL 64 IoCs

pid	Process
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2204-0-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/files/0x000c00000001313a-6.dat	upx
behavioral1/files/0x0034000000015d07-7.dat	upx
behavioral1/files/0x0007000000015d87-17.dat	upx
behavioral1/files/0x0007000000015d79-13.dat	upx
behavioral1/files/0x0008000000015d67-10.dat	upx
behavioral1/files/0x0007000000015d8f-28.dat	upx
behavioral1/files/0x0009000000015e3a-29.dat	upx
behavioral1/files/0x0007000000016c63-35.dat	upx
behavioral1/files/0x0006000000016c6b-39.dat	upx
behavioral1/files/0x0006000000016cb7-43.dat	upx
behavioral1/files/0x0006000000016d0d-51.dat	upx
behavioral1/files/0x0006000000016d3a-63.dat	upx
behavioral1/files/0x0006000000016d7e-67.dat	upx
behavioral1/files/0x0006000000016da7-79.dat	upx
behavioral1/files/0x00060000000173d8-107.dat	upx
behavioral1/memory/2556-616-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/3040-619-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2648-618-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/memory/2260-621-0x000000013FC10000-0x0000000140002000-memory.dmp	upx
behavioral1/memory/2628-620-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2928-636-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/2444-635-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/memory/2640-633-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/memory/2588-623-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2592-630-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/2344-628-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2452-625-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/files/0x0006000000017556-131.dat	upx
behavioral1/files/0x000600000001749c-127.dat	upx
behavioral1/files/0x000600000001747d-123.dat	upx
behavioral1/files/0x000600000001745e-119.dat	upx
behavioral1/files/0x0006000000017456-115.dat	upx
behavioral1/files/0x00060000000173e0-111.dat	upx
behavioral1/files/0x00060000000173d5-103.dat	upx
behavioral1/files/0x0006000000017052-99.dat	upx
behavioral1/files/0x0006000000016eb2-95.dat	upx
behavioral1/files/0x0006000000016e94-91.dat	upx
behavioral1/files/0x0006000000016dbf-87.dat	upx
behavioral1/files/0x0006000000016dbb-83.dat	upx
behavioral1/files/0x0034000000015d28-75.dat	upx
behavioral1/files/0x0006000000016d90-72.dat	upx
behavioral1/files/0x0006000000016d26-59.dat	upx
behavioral1/files/0x0006000000016d1e-55.dat	upx
behavioral1/files/0x0006000000016ce4-47.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sPLmpDn.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\avQbPAp.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\QyrWAes.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\hagHbgC.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\cPzHLep.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\yBfWMCf.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\xmSyfiK.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\gwgKnLa.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\aYzpnDr.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\cntZriR.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\GJdGZHD.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\xmNaEib.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\FTRUSZJ.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\MFXFgvd.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\GNFjKFF.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\LnQrXOK.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\gozDwbN.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\GHLFtFU.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\eOReUNw.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\gAFPFjR.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\nDeUTRZ.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\wTccTbt.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\dfnChpt.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\btmbDvV.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\qiIUwMJ.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\DWxekzO.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\CkYjrqm.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\DrjJCRM.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\SpnjjHT.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\emimLCN.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\qunqjhp.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\PIbdEHh.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\bbGavTv.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\GatYIEt.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\LwQbMRP.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\FYQEKlk.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\mPqeKuU.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\LfAiAge.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\MghBeBi.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\sMtqrlT.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\UUdyWeV.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\pxtAYnU.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\omjonQJ.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\vdsacic.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\BpcUHNd.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\thfUJOd.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\yfNVmlT.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\MSwvxkB.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\DDNsvkj.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\JnMtKUZ.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\NFKZlIf.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\HKQZfAu.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\SvFcbqn.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\GIwCSqv.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\xzDcqFr.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\nJoHIyn.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\tNwzHRd.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\Dujmbcj.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\zYqtdil.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\SQHLfDh.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\dqnyYfC.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\ITJGsXh.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\JYOOjVW.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
File created	C:\Windows\System\eEFmSWZ.exe	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2328	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	29
PID 2204 wrote to memory of 2328	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	29
PID 2204 wrote to memory of 2328	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	29
PID 2204 wrote to memory of 2928	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	30
PID 2204 wrote to memory of 2928	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	30
PID 2204 wrote to memory of 2928	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	30
PID 2204 wrote to memory of 3040	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	31
PID 2204 wrote to memory of 3040	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	31
PID 2204 wrote to memory of 3040	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	31
PID 2204 wrote to memory of 2556	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	32
PID 2204 wrote to memory of 2556	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	32
PID 2204 wrote to memory of 2556	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	32
PID 2204 wrote to memory of 2628	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	33
PID 2204 wrote to memory of 2628	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	33
PID 2204 wrote to memory of 2628	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	33
PID 2204 wrote to memory of 2648	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	34
PID 2204 wrote to memory of 2648	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	34
PID 2204 wrote to memory of 2648	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	34
PID 2204 wrote to memory of 2260	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	35
PID 2204 wrote to memory of 2260	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	35
PID 2204 wrote to memory of 2260	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	35
PID 2204 wrote to memory of 2588	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	36
PID 2204 wrote to memory of 2588	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	36
PID 2204 wrote to memory of 2588	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	36
PID 2204 wrote to memory of 2452	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	37
PID 2204 wrote to memory of 2452	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	37
PID 2204 wrote to memory of 2452	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	37
PID 2204 wrote to memory of 2344	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	38
PID 2204 wrote to memory of 2344	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	38
PID 2204 wrote to memory of 2344	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	38
PID 2204 wrote to memory of 2592	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	39
PID 2204 wrote to memory of 2592	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	39
PID 2204 wrote to memory of 2592	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	39
PID 2204 wrote to memory of 2640	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	40
PID 2204 wrote to memory of 2640	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	40
PID 2204 wrote to memory of 2640	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	40
PID 2204 wrote to memory of 2444	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	41
PID 2204 wrote to memory of 2444	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	41
PID 2204 wrote to memory of 2444	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	41
PID 2204 wrote to memory of 2504	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	42
PID 2204 wrote to memory of 2504	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	42
PID 2204 wrote to memory of 2504	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	42
PID 2204 wrote to memory of 3020	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	43
PID 2204 wrote to memory of 3020	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	43
PID 2204 wrote to memory of 3020	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	43
PID 2204 wrote to memory of 1868	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	44
PID 2204 wrote to memory of 1868	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	44
PID 2204 wrote to memory of 1868	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	44
PID 2204 wrote to memory of 2244	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	45
PID 2204 wrote to memory of 2244	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	45
PID 2204 wrote to memory of 2244	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	45
PID 2204 wrote to memory of 2976	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	46
PID 2204 wrote to memory of 2976	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	46
PID 2204 wrote to memory of 2976	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	46
PID 2204 wrote to memory of 2664	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	47
PID 2204 wrote to memory of 2664	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	47
PID 2204 wrote to memory of 2664	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	47
PID 2204 wrote to memory of 2704	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	48
PID 2204 wrote to memory of 2704	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	48
PID 2204 wrote to memory of 2704	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	48
PID 2204 wrote to memory of 1048	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	49
PID 2204 wrote to memory of 1048	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	49
PID 2204 wrote to memory of 1048	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	49
PID 2204 wrote to memory of 2668	2204	0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0871c9767b76ecebeacad861a7ac579a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  PID:2328
- C:\Windows\System\hQTaqKy.exe
  C:\Windows\System\hQTaqKy.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\VlahsCs.exe
  C:\Windows\System\VlahsCs.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\QyrWAes.exe
  C:\Windows\System\QyrWAes.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\xJFVBhO.exe
  C:\Windows\System\xJFVBhO.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\VqtOsNl.exe
  C:\Windows\System\VqtOsNl.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\MmlrpEE.exe
  C:\Windows\System\MmlrpEE.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\cntZriR.exe
  C:\Windows\System\cntZriR.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\RuWCFOc.exe
  C:\Windows\System\RuWCFOc.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\gozDwbN.exe
  C:\Windows\System\gozDwbN.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\FNwadrv.exe
  C:\Windows\System\FNwadrv.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\nmJROdv.exe
  C:\Windows\System\nmJROdv.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\zhKaPti.exe
  C:\Windows\System\zhKaPti.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\dqfPDtO.exe
  C:\Windows\System\dqfPDtO.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\MwywiRw.exe
  C:\Windows\System\MwywiRw.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\thfUJOd.exe
  C:\Windows\System\thfUJOd.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\kcwNQzI.exe
  C:\Windows\System\kcwNQzI.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\xEfBPZy.exe
  C:\Windows\System\xEfBPZy.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\mPztXqG.exe
  C:\Windows\System\mPztXqG.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\DnbstEu.exe
  C:\Windows\System\DnbstEu.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\wSyElWa.exe
  C:\Windows\System\wSyElWa.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\bbGavTv.exe
  C:\Windows\System\bbGavTv.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\GHLFtFU.exe
  C:\Windows\System\GHLFtFU.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\nTjwTzP.exe
  C:\Windows\System\nTjwTzP.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\nsDMnaB.exe
  C:\Windows\System\nsDMnaB.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\DVohDof.exe
  C:\Windows\System\DVohDof.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\yBfWMCf.exe
  C:\Windows\System\yBfWMCf.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\yfNVmlT.exe
  C:\Windows\System\yfNVmlT.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\oDnhnCD.exe
  C:\Windows\System\oDnhnCD.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\kOFoJhL.exe
  C:\Windows\System\kOFoJhL.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\Dujmbcj.exe
  C:\Windows\System\Dujmbcj.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\IsIHqKh.exe
  C:\Windows\System\IsIHqKh.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\axxjxWb.exe
  C:\Windows\System\axxjxWb.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\QqWvlCD.exe
  C:\Windows\System\QqWvlCD.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\tcEpTym.exe
  C:\Windows\System\tcEpTym.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\PuXnzju.exe
  C:\Windows\System\PuXnzju.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\zpkpmMT.exe
  C:\Windows\System\zpkpmMT.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\IFYlIhW.exe
  C:\Windows\System\IFYlIhW.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\cxGRefN.exe
  C:\Windows\System\cxGRefN.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\SyNOufg.exe
  C:\Windows\System\SyNOufg.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\tDoWYxu.exe
  C:\Windows\System\tDoWYxu.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\NbYWcxk.exe
  C:\Windows\System\NbYWcxk.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\LSwiPLm.exe
  C:\Windows\System\LSwiPLm.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\NpWqBUd.exe
  C:\Windows\System\NpWqBUd.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\kcGQXjQ.exe
  C:\Windows\System\kcGQXjQ.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\dgyKyxG.exe
  C:\Windows\System\dgyKyxG.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\ShANlgM.exe
  C:\Windows\System\ShANlgM.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\PEnqVSV.exe
  C:\Windows\System\PEnqVSV.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\IZgqVdb.exe
  C:\Windows\System\IZgqVdb.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\dvUzxlO.exe
  C:\Windows\System\dvUzxlO.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\uqUSNfM.exe
  C:\Windows\System\uqUSNfM.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\PETvhCm.exe
  C:\Windows\System\PETvhCm.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\sMtqrlT.exe
  C:\Windows\System\sMtqrlT.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\aqZwqqB.exe
  C:\Windows\System\aqZwqqB.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\QFagzHe.exe
  C:\Windows\System\QFagzHe.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\vyKhvle.exe
  C:\Windows\System\vyKhvle.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\bIlWSqA.exe
  C:\Windows\System\bIlWSqA.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\kJpRaBh.exe
  C:\Windows\System\kJpRaBh.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\GatYIEt.exe
  C:\Windows\System\GatYIEt.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\XiUITKY.exe
  C:\Windows\System\XiUITKY.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\BwocJsq.exe
  C:\Windows\System\BwocJsq.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\cLIVfGP.exe
  C:\Windows\System\cLIVfGP.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\bZATqQb.exe
  C:\Windows\System\bZATqQb.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\DrjJCRM.exe
  C:\Windows\System\DrjJCRM.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\OTxndve.exe
  C:\Windows\System\OTxndve.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\nXenBCM.exe
  C:\Windows\System\nXenBCM.exe
  2⤵
  PID:3008
- C:\Windows\System\vaSopIe.exe
  C:\Windows\System\vaSopIe.exe
  2⤵
  PID:1160
- C:\Windows\System\zFuoOrS.exe
  C:\Windows\System\zFuoOrS.exe
  2⤵
  PID:2292
- C:\Windows\System\noacAyL.exe
  C:\Windows\System\noacAyL.exe
  2⤵
  PID:2996
- C:\Windows\System\DYHbPAF.exe
  C:\Windows\System\DYHbPAF.exe
  2⤵
  PID:2836
- C:\Windows\System\ghJyVhv.exe
  C:\Windows\System\ghJyVhv.exe
  2⤵
  PID:2908
- C:\Windows\System\qDTBhNj.exe
  C:\Windows\System\qDTBhNj.exe
  2⤵
  PID:896
- C:\Windows\System\IRwkOxo.exe
  C:\Windows\System\IRwkOxo.exe
  2⤵
  PID:2124
- C:\Windows\System\jlIxnTZ.exe
  C:\Windows\System\jlIxnTZ.exe
  2⤵
  PID:2888
- C:\Windows\System\YrFLLXg.exe
  C:\Windows\System\YrFLLXg.exe
  2⤵
  PID:1968
- C:\Windows\System\sPOiUSs.exe
  C:\Windows\System\sPOiUSs.exe
  2⤵
  PID:1576
- C:\Windows\System\DczQnUt.exe
  C:\Windows\System\DczQnUt.exe
  2⤵
  PID:1600
- C:\Windows\System\XlGJpww.exe
  C:\Windows\System\XlGJpww.exe
  2⤵
  PID:1984
- C:\Windows\System\UUdyWeV.exe
  C:\Windows\System\UUdyWeV.exe
  2⤵
  PID:2616
- C:\Windows\System\yaYQjDn.exe
  C:\Windows\System\yaYQjDn.exe
  2⤵
  PID:2568
- C:\Windows\System\iPGgPwh.exe
  C:\Windows\System\iPGgPwh.exe
  2⤵
  PID:2276
- C:\Windows\System\eOReUNw.exe
  C:\Windows\System\eOReUNw.exe
  2⤵
  PID:2712
- C:\Windows\System\uZTdlQb.exe
  C:\Windows\System\uZTdlQb.exe
  2⤵
  PID:2720
- C:\Windows\System\nMZxrqO.exe
  C:\Windows\System\nMZxrqO.exe
  2⤵
  PID:2440
- C:\Windows\System\MfHdpwC.exe
  C:\Windows\System\MfHdpwC.exe
  2⤵
  PID:2948
- C:\Windows\System\vAsqGtJ.exe
  C:\Windows\System\vAsqGtJ.exe
  2⤵
  PID:1612
- C:\Windows\System\aUxYQut.exe
  C:\Windows\System\aUxYQut.exe
  2⤵
  PID:2684
- C:\Windows\System\GIwCSqv.exe
  C:\Windows\System\GIwCSqv.exe
  2⤵
  PID:1588
- C:\Windows\System\RnzvdVR.exe
  C:\Windows\System\RnzvdVR.exe
  2⤵
  PID:1856
- C:\Windows\System\vGwMuJx.exe
  C:\Windows\System\vGwMuJx.exe
  2⤵
  PID:644
- C:\Windows\System\ssudbgA.exe
  C:\Windows\System\ssudbgA.exe
  2⤵
  PID:540
- C:\Windows\System\GZgUGsR.exe
  C:\Windows\System\GZgUGsR.exe
  2⤵
  PID:2708
- C:\Windows\System\xzDcqFr.exe
  C:\Windows\System\xzDcqFr.exe
  2⤵
  PID:960
- C:\Windows\System\pxtAYnU.exe
  C:\Windows\System\pxtAYnU.exe
  2⤵
  PID:1336
- C:\Windows\System\xmSyfiK.exe
  C:\Windows\System\xmSyfiK.exe
  2⤵
  PID:1272
- C:\Windows\System\SpnjjHT.exe
  C:\Windows\System\SpnjjHT.exe
  2⤵
  PID:2068
- C:\Windows\System\CnYmUGu.exe
  C:\Windows\System\CnYmUGu.exe
  2⤵
  PID:1264
- C:\Windows\System\gSUWeLQ.exe
  C:\Windows\System\gSUWeLQ.exe
  2⤵
  PID:2280
- C:\Windows\System\qvUcQqN.exe
  C:\Windows\System\qvUcQqN.exe
  2⤵
  PID:2732
- C:\Windows\System\KjyFxeF.exe
  C:\Windows\System\KjyFxeF.exe
  2⤵
  PID:3052
- C:\Windows\System\nJoHIyn.exe
  C:\Windows\System\nJoHIyn.exe
  2⤵
  PID:2128
- C:\Windows\System\MSwvxkB.exe
  C:\Windows\System\MSwvxkB.exe
  2⤵
  PID:1512
- C:\Windows\System\eEFmSWZ.exe
  C:\Windows\System\eEFmSWZ.exe
  2⤵
  PID:1168
- C:\Windows\System\Zmsbadw.exe
  C:\Windows\System\Zmsbadw.exe
  2⤵
  PID:1808
- C:\Windows\System\EsfMemL.exe
  C:\Windows\System\EsfMemL.exe
  2⤵
  PID:1340
- C:\Windows\System\tHCNZxy.exe
  C:\Windows\System\tHCNZxy.exe
  2⤵
  PID:1720
- C:\Windows\System\PHEozMS.exe
  C:\Windows\System\PHEozMS.exe
  2⤵
  PID:1056
- C:\Windows\System\vihBdNV.exe
  C:\Windows\System\vihBdNV.exe
  2⤵
  PID:1044
- C:\Windows\System\UqpOYSF.exe
  C:\Windows\System\UqpOYSF.exe
  2⤵
  PID:472
- C:\Windows\System\fZhYsFh.exe
  C:\Windows\System\fZhYsFh.exe
  2⤵
  PID:808
- C:\Windows\System\DDNsvkj.exe
  C:\Windows\System\DDNsvkj.exe
  2⤵
  PID:1924
- C:\Windows\System\rVDMexf.exe
  C:\Windows\System\rVDMexf.exe
  2⤵
  PID:1980
- C:\Windows\System\kgATLWX.exe
  C:\Windows\System\kgATLWX.exe
  2⤵
  PID:2904
- C:\Windows\System\dVFDmVV.exe
  C:\Windows\System\dVFDmVV.exe
  2⤵
  PID:1680
- C:\Windows\System\CIwKUjf.exe
  C:\Windows\System\CIwKUjf.exe
  2⤵
  PID:2892
- C:\Windows\System\fekofMr.exe
  C:\Windows\System\fekofMr.exe
  2⤵
  PID:1696
- C:\Windows\System\jBdWmJD.exe
  C:\Windows\System\jBdWmJD.exe
  2⤵
  PID:3044
- C:\Windows\System\QOlKrMq.exe
  C:\Windows\System\QOlKrMq.exe
  2⤵
  PID:2656
- C:\Windows\System\SzDKVaG.exe
  C:\Windows\System\SzDKVaG.exe
  2⤵
  PID:2460
- C:\Windows\System\idVUDTI.exe
  C:\Windows\System\idVUDTI.exe
  2⤵
  PID:1584
- C:\Windows\System\hMZFZTA.exe
  C:\Windows\System\hMZFZTA.exe
  2⤵
  PID:852
- C:\Windows\System\lhyVbuA.exe
  C:\Windows\System\lhyVbuA.exe
  2⤵
  PID:1724
- C:\Windows\System\qUfsmGh.exe
  C:\Windows\System\qUfsmGh.exe
  2⤵
  PID:2496
- C:\Windows\System\tHFlOBp.exe
  C:\Windows\System\tHFlOBp.exe
  2⤵
  PID:2772
- C:\Windows\System\ypOUart.exe
  C:\Windows\System\ypOUart.exe
  2⤵
  PID:3076
- C:\Windows\System\BLgQXuh.exe
  C:\Windows\System\BLgQXuh.exe
  2⤵
  PID:3092
- C:\Windows\System\FcFkYxs.exe
  C:\Windows\System\FcFkYxs.exe
  2⤵
  PID:3108
- C:\Windows\System\oslsaHr.exe
  C:\Windows\System\oslsaHr.exe
  2⤵
  PID:3124
- C:\Windows\System\TItnvzA.exe
  C:\Windows\System\TItnvzA.exe
  2⤵
  PID:3140
- C:\Windows\System\JnMtKUZ.exe
  C:\Windows\System\JnMtKUZ.exe
  2⤵
  PID:3156
- C:\Windows\System\jmtTEHm.exe
  C:\Windows\System\jmtTEHm.exe
  2⤵
  PID:3172
- C:\Windows\System\OrtuFcX.exe
  C:\Windows\System\OrtuFcX.exe
  2⤵
  PID:3188
- C:\Windows\System\OMFsmBE.exe
  C:\Windows\System\OMFsmBE.exe
  2⤵
  PID:3204
- C:\Windows\System\RVFrCTj.exe
  C:\Windows\System\RVFrCTj.exe
  2⤵
  PID:3220
- C:\Windows\System\AkyGZZL.exe
  C:\Windows\System\AkyGZZL.exe
  2⤵
  PID:3236
- C:\Windows\System\hRfbHGg.exe
  C:\Windows\System\hRfbHGg.exe
  2⤵
  PID:3252
- C:\Windows\System\TvjOsMi.exe
  C:\Windows\System\TvjOsMi.exe
  2⤵
  PID:3268
- C:\Windows\System\rTSkKqV.exe
  C:\Windows\System\rTSkKqV.exe
  2⤵
  PID:3284
- C:\Windows\System\xPvrRZD.exe
  C:\Windows\System\xPvrRZD.exe
  2⤵
  PID:3300
- C:\Windows\System\PDTKnDw.exe
  C:\Windows\System\PDTKnDw.exe
  2⤵
  PID:3316
- C:\Windows\System\LwzydFL.exe
  C:\Windows\System\LwzydFL.exe
  2⤵
  PID:3332
- C:\Windows\System\xTQXfWQ.exe
  C:\Windows\System\xTQXfWQ.exe
  2⤵
  PID:3348
- C:\Windows\System\qNnKKeq.exe
  C:\Windows\System\qNnKKeq.exe
  2⤵
  PID:3364
- C:\Windows\System\VwHpgTh.exe
  C:\Windows\System\VwHpgTh.exe
  2⤵
  PID:3380
- C:\Windows\System\sgwzjtM.exe
  C:\Windows\System\sgwzjtM.exe
  2⤵
  PID:3396
- C:\Windows\System\VxtBkuP.exe
  C:\Windows\System\VxtBkuP.exe
  2⤵
  PID:3412
- C:\Windows\System\aIzRtna.exe
  C:\Windows\System\aIzRtna.exe
  2⤵
  PID:3428
- C:\Windows\System\zYqtdil.exe
  C:\Windows\System\zYqtdil.exe
  2⤵
  PID:3444
- C:\Windows\System\WsbEklC.exe
  C:\Windows\System\WsbEklC.exe
  2⤵
  PID:3460
- C:\Windows\System\foKbGja.exe
  C:\Windows\System\foKbGja.exe
  2⤵
  PID:3476
- C:\Windows\System\TXBkueC.exe
  C:\Windows\System\TXBkueC.exe
  2⤵
  PID:3492
- C:\Windows\System\fdMGnUi.exe
  C:\Windows\System\fdMGnUi.exe
  2⤵
  PID:3508
- C:\Windows\System\DUuiZkm.exe
  C:\Windows\System\DUuiZkm.exe
  2⤵
  PID:3524
- C:\Windows\System\NFKZlIf.exe
  C:\Windows\System\NFKZlIf.exe
  2⤵
  PID:3540
- C:\Windows\System\tdGjkXQ.exe
  C:\Windows\System\tdGjkXQ.exe
  2⤵
  PID:3556
- C:\Windows\System\emimLCN.exe
  C:\Windows\System\emimLCN.exe
  2⤵
  PID:3572
- C:\Windows\System\PXbAZYc.exe
  C:\Windows\System\PXbAZYc.exe
  2⤵
  PID:3588
- C:\Windows\System\xmNaEib.exe
  C:\Windows\System\xmNaEib.exe
  2⤵
  PID:3604
- C:\Windows\System\QHvkeuJ.exe
  C:\Windows\System\QHvkeuJ.exe
  2⤵
  PID:3620
- C:\Windows\System\BOpkTGa.exe
  C:\Windows\System\BOpkTGa.exe
  2⤵
  PID:3636
- C:\Windows\System\ZLaotzw.exe
  C:\Windows\System\ZLaotzw.exe
  2⤵
  PID:3652
- C:\Windows\System\NeNUnvi.exe
  C:\Windows\System\NeNUnvi.exe
  2⤵
  PID:3668
- C:\Windows\System\SQHLfDh.exe
  C:\Windows\System\SQHLfDh.exe
  2⤵
  PID:3684
- C:\Windows\System\EuczVOD.exe
  C:\Windows\System\EuczVOD.exe
  2⤵
  PID:3700
- C:\Windows\System\ReGKaLM.exe
  C:\Windows\System\ReGKaLM.exe
  2⤵
  PID:3716
- C:\Windows\System\HKQZfAu.exe
  C:\Windows\System\HKQZfAu.exe
  2⤵
  PID:3732
- C:\Windows\System\uPCNVLx.exe
  C:\Windows\System\uPCNVLx.exe
  2⤵
  PID:3748
- C:\Windows\System\ElVWtxf.exe
  C:\Windows\System\ElVWtxf.exe
  2⤵
  PID:3764
- C:\Windows\System\CrpVNPq.exe
  C:\Windows\System\CrpVNPq.exe
  2⤵
  PID:3780
- C:\Windows\System\qbJlZHA.exe
  C:\Windows\System\qbJlZHA.exe
  2⤵
  PID:3796
- C:\Windows\System\qbcXAeU.exe
  C:\Windows\System\qbcXAeU.exe
  2⤵
  PID:3812
- C:\Windows\System\MBPPbPg.exe
  C:\Windows\System\MBPPbPg.exe
  2⤵
  PID:3828
- C:\Windows\System\potisXd.exe
  C:\Windows\System\potisXd.exe
  2⤵
  PID:3844
- C:\Windows\System\gwgKnLa.exe
  C:\Windows\System\gwgKnLa.exe
  2⤵
  PID:3860
- C:\Windows\System\VCYNrPy.exe
  C:\Windows\System\VCYNrPy.exe
  2⤵
  PID:3876
- C:\Windows\System\FTRUSZJ.exe
  C:\Windows\System\FTRUSZJ.exe
  2⤵
  PID:3892
- C:\Windows\System\ilpjxYJ.exe
  C:\Windows\System\ilpjxYJ.exe
  2⤵
  PID:3908
- C:\Windows\System\iEAQJIb.exe
  C:\Windows\System\iEAQJIb.exe
  2⤵
  PID:3924
- C:\Windows\System\lNNuAYf.exe
  C:\Windows\System\lNNuAYf.exe
  2⤵
  PID:3940
- C:\Windows\System\aHatZhm.exe
  C:\Windows\System\aHatZhm.exe
  2⤵
  PID:3956
- C:\Windows\System\DjQEtTf.exe
  C:\Windows\System\DjQEtTf.exe
  2⤵
  PID:3972
- C:\Windows\System\VhhANnt.exe
  C:\Windows\System\VhhANnt.exe
  2⤵
  PID:3988
- C:\Windows\System\COrRXun.exe
  C:\Windows\System\COrRXun.exe
  2⤵
  PID:4004
- C:\Windows\System\fhREWUx.exe
  C:\Windows\System\fhREWUx.exe
  2⤵
  PID:4020
- C:\Windows\System\aykjJJr.exe
  C:\Windows\System\aykjJJr.exe
  2⤵
  PID:4036
- C:\Windows\System\PlRbHNU.exe
  C:\Windows\System\PlRbHNU.exe
  2⤵
  PID:4052
- C:\Windows\System\FYQEKlk.exe
  C:\Windows\System\FYQEKlk.exe
  2⤵
  PID:4068
- C:\Windows\System\KDpFmst.exe
  C:\Windows\System\KDpFmst.exe
  2⤵
  PID:4084
- C:\Windows\System\coqxuIX.exe
  C:\Windows\System\coqxuIX.exe
  2⤵
  PID:864
- C:\Windows\System\hagHbgC.exe
  C:\Windows\System\hagHbgC.exe
  2⤵
  PID:2032
- C:\Windows\System\dfnChpt.exe
  C:\Windows\System\dfnChpt.exe
  2⤵
  PID:2288
- C:\Windows\System\WtWwloe.exe
  C:\Windows\System\WtWwloe.exe
  2⤵
  PID:712
- C:\Windows\System\EQawKkV.exe
  C:\Windows\System\EQawKkV.exe
  2⤵
  PID:568
- C:\Windows\System\YXDtTxz.exe
  C:\Windows\System\YXDtTxz.exe
  2⤵
  PID:2384
- C:\Windows\System\jBRWjyH.exe
  C:\Windows\System\jBRWjyH.exe
  2⤵
  PID:2868
- C:\Windows\System\kwQcZOC.exe
  C:\Windows\System\kwQcZOC.exe
  2⤵
  PID:1308
- C:\Windows\System\btmbDvV.exe
  C:\Windows\System\btmbDvV.exe
  2⤵
  PID:3028
- C:\Windows\System\eFrvDPP.exe
  C:\Windows\System\eFrvDPP.exe
  2⤵
  PID:2100
- C:\Windows\System\SYOAbwT.exe
  C:\Windows\System\SYOAbwT.exe
  2⤵
  PID:2176
- C:\Windows\System\dDhjURm.exe
  C:\Windows\System\dDhjURm.exe
  2⤵
  PID:772
- C:\Windows\System\FLmTDIu.exe
  C:\Windows\System\FLmTDIu.exe
  2⤵
  PID:2584
- C:\Windows\System\FefhfIp.exe
  C:\Windows\System\FefhfIp.exe
  2⤵
  PID:2480
- C:\Windows\System\eTNntfR.exe
  C:\Windows\System\eTNntfR.exe
  2⤵
  PID:2220
- C:\Windows\System\CVXOTqC.exe
  C:\Windows\System\CVXOTqC.exe
  2⤵
  PID:1692
- C:\Windows\System\BtgHnSi.exe
  C:\Windows\System\BtgHnSi.exe
  2⤵
  PID:280
- C:\Windows\System\VIXtLGm.exe
  C:\Windows\System\VIXtLGm.exe
  2⤵
  PID:3104
- C:\Windows\System\BWTsgcD.exe
  C:\Windows\System\BWTsgcD.exe
  2⤵
  PID:3136
- C:\Windows\System\JbowwNr.exe
  C:\Windows\System\JbowwNr.exe
  2⤵
  PID:3168
- C:\Windows\System\MFXFgvd.exe
  C:\Windows\System\MFXFgvd.exe
  2⤵
  PID:3200
- C:\Windows\System\YcnpXTe.exe
  C:\Windows\System\YcnpXTe.exe
  2⤵
  PID:3232
- C:\Windows\System\kWUJhSw.exe
  C:\Windows\System\kWUJhSw.exe
  2⤵
  PID:3264
- C:\Windows\System\WyRCMmt.exe
  C:\Windows\System\WyRCMmt.exe
  2⤵
  PID:3296
- C:\Windows\System\wuMRyRu.exe
  C:\Windows\System\wuMRyRu.exe
  2⤵
  PID:3328
- C:\Windows\System\OyVOjjM.exe
  C:\Windows\System\OyVOjjM.exe
  2⤵
  PID:3360
- C:\Windows\System\yqAjHYK.exe
  C:\Windows\System\yqAjHYK.exe
  2⤵
  PID:3392
- C:\Windows\System\oXJPIoa.exe
  C:\Windows\System\oXJPIoa.exe
  2⤵
  PID:3424
- C:\Windows\System\XAeoNcu.exe
  C:\Windows\System\XAeoNcu.exe
  2⤵
  PID:3456
- C:\Windows\System\zTKTuGh.exe
  C:\Windows\System\zTKTuGh.exe
  2⤵
  PID:3488
- C:\Windows\System\eBaxfmC.exe
  C:\Windows\System\eBaxfmC.exe
  2⤵
  PID:3520
- C:\Windows\System\oZloimL.exe
  C:\Windows\System\oZloimL.exe
  2⤵
  PID:3552
- C:\Windows\System\WoQiCJk.exe
  C:\Windows\System\WoQiCJk.exe
  2⤵
  PID:3564
- C:\Windows\System\dGdRhKd.exe
  C:\Windows\System\dGdRhKd.exe
  2⤵
  PID:3616
- C:\Windows\System\YELngRM.exe
  C:\Windows\System\YELngRM.exe
  2⤵
  PID:3648
- C:\Windows\System\pLpPOwl.exe
  C:\Windows\System\pLpPOwl.exe
  2⤵
  PID:3680
- C:\Windows\System\IWJeKso.exe
  C:\Windows\System\IWJeKso.exe
  2⤵
  PID:3712
- C:\Windows\System\fmPWHBY.exe
  C:\Windows\System\fmPWHBY.exe
  2⤵
  PID:3744
- C:\Windows\System\pgzNrkw.exe
  C:\Windows\System\pgzNrkw.exe
  2⤵
  PID:3776
- C:\Windows\System\mosYyOj.exe
  C:\Windows\System\mosYyOj.exe
  2⤵
  PID:3808
- C:\Windows\System\cPzHLep.exe
  C:\Windows\System\cPzHLep.exe
  2⤵
  PID:3840
- C:\Windows\System\GNFjKFF.exe
  C:\Windows\System\GNFjKFF.exe
  2⤵
  PID:3884
- C:\Windows\System\qLxabXJ.exe
  C:\Windows\System\qLxabXJ.exe
  2⤵
  PID:3916
- C:\Windows\System\xShLEEv.exe
  C:\Windows\System\xShLEEv.exe
  2⤵
  PID:3948
- C:\Windows\System\LwQbMRP.exe
  C:\Windows\System\LwQbMRP.exe
  2⤵
  PID:3996
- C:\Windows\System\IwDCgAO.exe
  C:\Windows\System\IwDCgAO.exe
  2⤵
  PID:4012
- C:\Windows\System\dSvIHsZ.exe
  C:\Windows\System\dSvIHsZ.exe
  2⤵
  PID:4032
- C:\Windows\System\ozmBGqR.exe
  C:\Windows\System\ozmBGqR.exe
  2⤵
  PID:4064
- C:\Windows\System\LnQrXOK.exe
  C:\Windows\System\LnQrXOK.exe
  2⤵
  PID:4080
- C:\Windows\System\omjonQJ.exe
  C:\Windows\System\omjonQJ.exe
  2⤵
  PID:2840
- C:\Windows\System\QlNrbkt.exe
  C:\Windows\System\QlNrbkt.exe
  2⤵
  PID:2376
- C:\Windows\System\DqmWmVT.exe
  C:\Windows\System\DqmWmVT.exe
  2⤵
  PID:2740
- C:\Windows\System\gAFPFjR.exe
  C:\Windows\System\gAFPFjR.exe
  2⤵
  PID:1748
- C:\Windows\System\EkhfIqq.exe
  C:\Windows\System\EkhfIqq.exe
  2⤵
  PID:1256
- C:\Windows\System\LFhepKp.exe
  C:\Windows\System\LFhepKp.exe
  2⤵
  PID:3024
- C:\Windows\System\xipROIQ.exe
  C:\Windows\System\xipROIQ.exe
  2⤵
  PID:1708
- C:\Windows\System\YForqwz.exe
  C:\Windows\System\YForqwz.exe
  2⤵
  PID:2632
- C:\Windows\System\JmVyZjP.exe
  C:\Windows\System\JmVyZjP.exe
  2⤵
  PID:1812
- C:\Windows\System\vdsacic.exe
  C:\Windows\System\vdsacic.exe
  2⤵
  PID:3132
- C:\Windows\System\lJMutUX.exe
  C:\Windows\System\lJMutUX.exe
  2⤵
  PID:3088
- C:\Windows\System\OUkNWDk.exe
  C:\Windows\System\OUkNWDk.exe
  2⤵
  PID:3260
- C:\Windows\System\mPqeKuU.exe
  C:\Windows\System\mPqeKuU.exe
  2⤵
  PID:3216
- C:\Windows\System\nDeUTRZ.exe
  C:\Windows\System\nDeUTRZ.exe
  2⤵
  PID:3324
- C:\Windows\System\ZOqBbcy.exe
  C:\Windows\System\ZOqBbcy.exe
  2⤵
  PID:3344
- C:\Windows\System\YvEYpou.exe
  C:\Windows\System\YvEYpou.exe
  2⤵
  PID:3452
- C:\Windows\System\wPQJJSg.exe
  C:\Windows\System\wPQJJSg.exe
  2⤵
  PID:3568
- C:\Windows\System\dqnyYfC.exe
  C:\Windows\System\dqnyYfC.exe
  2⤵
  PID:3584
- C:\Windows\System\ITJGsXh.exe
  C:\Windows\System\ITJGsXh.exe
  2⤵
  PID:3612
- C:\Windows\System\MeGvmaQ.exe
  C:\Windows\System\MeGvmaQ.exe
  2⤵
  PID:3600
- C:\Windows\System\RwpzakN.exe
  C:\Windows\System\RwpzakN.exe
  2⤵
  PID:3728
- C:\Windows\System\aWNAIaH.exe
  C:\Windows\System\aWNAIaH.exe
  2⤵
  PID:3888
- C:\Windows\System\drjFHlr.exe
  C:\Windows\System\drjFHlr.exe
  2⤵
  PID:3872
- C:\Windows\System\YrJKEgq.exe
  C:\Windows\System\YrJKEgq.exe
  2⤵
  PID:2600
- C:\Windows\System\eHBeRot.exe
  C:\Windows\System\eHBeRot.exe
  2⤵
  PID:2644
- C:\Windows\System\tpwrwJr.exe
  C:\Windows\System\tpwrwJr.exe
  2⤵
  PID:1364
- C:\Windows\System\XqZJogf.exe
  C:\Windows\System\XqZJogf.exe
  2⤵
  PID:2296
- C:\Windows\System\qiIUwMJ.exe
  C:\Windows\System\qiIUwMJ.exe
  2⤵
  PID:2716
- C:\Windows\System\XxhQMIp.exe
  C:\Windows\System\XxhQMIp.exe
  2⤵
  PID:2544
- C:\Windows\System\mkTuiCw.exe
  C:\Windows\System\mkTuiCw.exe
  2⤵
  PID:1320
- C:\Windows\System\LfAiAge.exe
  C:\Windows\System\LfAiAge.exe
  2⤵
  PID:1736
- C:\Windows\System\zmYxsBB.exe
  C:\Windows\System\zmYxsBB.exe
  2⤵
  PID:3016
- C:\Windows\System\BPHaoWu.exe
  C:\Windows\System\BPHaoWu.exe
  2⤵
  PID:3100
- C:\Windows\System\IMFfuBY.exe
  C:\Windows\System\IMFfuBY.exe
  2⤵
  PID:3152
- C:\Windows\System\OiTYAeZ.exe
  C:\Windows\System\OiTYAeZ.exe
  2⤵
  PID:2736
- C:\Windows\System\vgtCTSx.exe
  C:\Windows\System\vgtCTSx.exe
  2⤵
  PID:3536
- C:\Windows\System\tQDXVmU.exe
  C:\Windows\System\tQDXVmU.exe
  2⤵
  PID:3804
- C:\Windows\System\SvFcbqn.exe
  C:\Windows\System\SvFcbqn.exe
  2⤵
  PID:3760
- C:\Windows\System\sPLmpDn.exe
  C:\Windows\System\sPLmpDn.exe
  2⤵
  PID:2284
- C:\Windows\System\EgcvzYu.exe
  C:\Windows\System\EgcvzYu.exe
  2⤵
  PID:4128
- C:\Windows\System\AHzGRvJ.exe
  C:\Windows\System\AHzGRvJ.exe
  2⤵
  PID:4188
- C:\Windows\System\NpgWgBn.exe
  C:\Windows\System\NpgWgBn.exe
  2⤵
  PID:4208
- C:\Windows\System\DWxekzO.exe
  C:\Windows\System\DWxekzO.exe
  2⤵
  PID:4248
- C:\Windows\System\zKSCHFU.exe
  C:\Windows\System\zKSCHFU.exe
  2⤵
  PID:4308
- C:\Windows\System\DTIfPHD.exe
  C:\Windows\System\DTIfPHD.exe
  2⤵
  PID:4340
- C:\Windows\System\RTmOCKe.exe
  C:\Windows\System\RTmOCKe.exe
  2⤵
  PID:4428
- C:\Windows\System\uPsmBKo.exe
  C:\Windows\System\uPsmBKo.exe
  2⤵
  PID:4448
- C:\Windows\System\idXajgJ.exe
  C:\Windows\System\idXajgJ.exe
  2⤵
  PID:4468
- C:\Windows\System\XFdbrGN.exe
  C:\Windows\System\XFdbrGN.exe
  2⤵
  PID:4488
- C:\Windows\System\pShsSGD.exe
  C:\Windows\System\pShsSGD.exe
  2⤵
  PID:4504
- C:\Windows\System\PJrMoNo.exe
  C:\Windows\System\PJrMoNo.exe
  2⤵
  PID:4520
- C:\Windows\System\NkTMhOF.exe
  C:\Windows\System\NkTMhOF.exe
  2⤵
  PID:4540
- C:\Windows\System\CkYjrqm.exe
  C:\Windows\System\CkYjrqm.exe
  2⤵
  PID:4556
- C:\Windows\System\YTaDsWt.exe
  C:\Windows\System\YTaDsWt.exe
  2⤵
  PID:4572
- C:\Windows\System\PIbdEHh.exe
  C:\Windows\System\PIbdEHh.exe
  2⤵
  PID:4592
- C:\Windows\System\MghBeBi.exe
  C:\Windows\System\MghBeBi.exe
  2⤵
  PID:4608
- C:\Windows\System\QKlMTCS.exe
  C:\Windows\System\QKlMTCS.exe
  2⤵
  PID:4624
- C:\Windows\System\gUKgIql.exe
  C:\Windows\System\gUKgIql.exe
  2⤵
  PID:4644
- C:\Windows\System\XvGVpJP.exe
  C:\Windows\System\XvGVpJP.exe
  2⤵
  PID:4660
- C:\Windows\System\soDnFwP.exe
  C:\Windows\System\soDnFwP.exe
  2⤵
  PID:4676
- C:\Windows\System\jCCejfk.exe
  C:\Windows\System\jCCejfk.exe
  2⤵
  PID:4696
- C:\Windows\System\iHoqCbD.exe
  C:\Windows\System\iHoqCbD.exe
  2⤵
  PID:4712
- C:\Windows\System\YwVqNJA.exe
  C:\Windows\System\YwVqNJA.exe
  2⤵
  PID:4744
- C:\Windows\System\OapupFT.exe
  C:\Windows\System\OapupFT.exe
  2⤵
  PID:4760
- C:\Windows\System\kGuNcnm.exe
  C:\Windows\System\kGuNcnm.exe
  2⤵
  PID:4776
- C:\Windows\System\tNwzHRd.exe
  C:\Windows\System\tNwzHRd.exe
  2⤵
  PID:4792
- C:\Windows\System\LhYBZPF.exe
  C:\Windows\System\LhYBZPF.exe
  2⤵
  PID:4808
- C:\Windows\System\lPGTaOL.exe
  C:\Windows\System\lPGTaOL.exe
  2⤵
  PID:4824
- C:\Windows\System\opsgarJ.exe
  C:\Windows\System\opsgarJ.exe
  2⤵
  PID:4844
- C:\Windows\System\oLShkMa.exe
  C:\Windows\System\oLShkMa.exe
  2⤵
  PID:4860
- C:\Windows\System\aYzpnDr.exe
  C:\Windows\System\aYzpnDr.exe
  2⤵
  PID:4876
- C:\Windows\System\KUHQnwH.exe
  C:\Windows\System\KUHQnwH.exe
  2⤵
  PID:4892
- C:\Windows\System\xySnarj.exe
  C:\Windows\System\xySnarj.exe
  2⤵
  PID:4908
- C:\Windows\System\wlwAfAZ.exe
  C:\Windows\System\wlwAfAZ.exe
  2⤵
  PID:4924
- C:\Windows\System\QflqSeR.exe
  C:\Windows\System\QflqSeR.exe
  2⤵
  PID:4940
- C:\Windows\System\ucwXQmW.exe
  C:\Windows\System\ucwXQmW.exe
  2⤵
  PID:4956
- C:\Windows\System\WUmXEaN.exe
  C:\Windows\System\WUmXEaN.exe
  2⤵
  PID:4976
- C:\Windows\System\oJELQdE.exe
  C:\Windows\System\oJELQdE.exe
  2⤵
  PID:4992
- C:\Windows\System\BPjwpwd.exe
  C:\Windows\System\BPjwpwd.exe
  2⤵
  PID:5008
- C:\Windows\System\wTccTbt.exe
  C:\Windows\System\wTccTbt.exe
  2⤵
  PID:5024
- C:\Windows\System\avQbPAp.exe
  C:\Windows\System\avQbPAp.exe
  2⤵
  PID:5040
- C:\Windows\System\nvGPvwf.exe
  C:\Windows\System\nvGPvwf.exe
  2⤵
  PID:5056
- C:\Windows\System\MOuOpRk.exe
  C:\Windows\System\MOuOpRk.exe
  2⤵
  PID:5076
- C:\Windows\System\fjXLDcB.exe
  C:\Windows\System\fjXLDcB.exe
  2⤵
  PID:5092
- C:\Windows\System\GJdGZHD.exe
  C:\Windows\System\GJdGZHD.exe
  2⤵
  PID:5108
- C:\Windows\System\jOEixeq.exe
  C:\Windows\System\jOEixeq.exe
  2⤵
  PID:4144
- C:\Windows\System\eQWBhMa.exe
  C:\Windows\System\eQWBhMa.exe
  2⤵
  PID:4108
- C:\Windows\System\iBGkHYr.exe
  C:\Windows\System\iBGkHYr.exe
  2⤵
  PID:4124
- C:\Windows\System\mnoSYaF.exe
  C:\Windows\System\mnoSYaF.exe
  2⤵
  PID:2428
- C:\Windows\System\NmdAtFv.exe
  C:\Windows\System\NmdAtFv.exe
  2⤵
  PID:1788
- C:\Windows\System\BpcUHNd.exe
  C:\Windows\System\BpcUHNd.exe
  2⤵
  PID:2988
- C:\Windows\System\SXnBpVl.exe
  C:\Windows\System\SXnBpVl.exe
  2⤵
  PID:3756
- C:\Windows\System\WxKosul.exe
  C:\Windows\System\WxKosul.exe
  2⤵
  PID:2944
- C:\Windows\System\JdZicJC.exe
  C:\Windows\System\JdZicJC.exe
  2⤵
  PID:1528
- C:\Windows\System\kihKGAM.exe
  C:\Windows\System\kihKGAM.exe
  2⤵
  PID:1328
- C:\Windows\System\bsSpkuM.exe
  C:\Windows\System\bsSpkuM.exe
  2⤵
  PID:1920
- C:\Windows\System\QNODijJ.exe
  C:\Windows\System\QNODijJ.exe
  2⤵
  PID:324
- C:\Windows\System\NetMOEC.exe
  C:\Windows\System\NetMOEC.exe
  2⤵
  PID:1032
- C:\Windows\System\RptKSVH.exe
  C:\Windows\System\RptKSVH.exe
  2⤵
  PID:1028
- C:\Windows\System\mpAouRi.exe
  C:\Windows\System\mpAouRi.exe
  2⤵
  PID:1800
- C:\Windows\System\LhZLTUr.exe
  C:\Windows\System\LhZLTUr.exe
  2⤵
  PID:3968
- C:\Windows\System\iLWrmDR.exe
  C:\Windows\System\iLWrmDR.exe
  2⤵
  PID:2524
- C:\Windows\System\NyRtPYs.exe
  C:\Windows\System\NyRtPYs.exe
  2⤵
  PID:4152
- C:\Windows\System\JYOOjVW.exe
  C:\Windows\System\JYOOjVW.exe
  2⤵
  PID:4168
- C:\Windows\System\RKKpsjw.exe
  C:\Windows\System\RKKpsjw.exe
  2⤵
  PID:4216
- C:\Windows\System\diLUXUg.exe
  C:\Windows\System\diLUXUg.exe
  2⤵
  PID:4260
- C:\Windows\System\qunqjhp.exe
  C:\Windows\System\qunqjhp.exe
  2⤵
  PID:4276
- C:\Windows\System\KjSAWWU.exe
  C:\Windows\System\KjSAWWU.exe
  2⤵
  PID:4292
- C:\Windows\System\EDkxGDh.exe
  C:\Windows\System\EDkxGDh.exe
  2⤵
  PID:4244
- C:\Windows\System\EoyLiuE.exe
  C:\Windows\System\EoyLiuE.exe
  2⤵
  PID:4360
- C:\Windows\System\WrXnKin.exe
  C:\Windows\System\WrXnKin.exe
  2⤵
  PID:4376
- C:\Windows\System\XvAfTSC.exe
  C:\Windows\System\XvAfTSC.exe
  2⤵
  PID:4392
- C:\Windows\System\lmNJGLK.exe
  C:\Windows\System\lmNJGLK.exe
  2⤵
  PID:4408
- C:\Windows\System\boEaiKm.exe
  C:\Windows\System\boEaiKm.exe
  2⤵
  PID:4424
- C:\Windows\System\doTPdkH.exe
  C:\Windows\System\doTPdkH.exe
  2⤵
  PID:4460
- C:\Windows\System\xsCxkBF.exe
  C:\Windows\System\xsCxkBF.exe
  2⤵
  PID:4528
- C:\Windows\System\GWfVNqk.exe
  C:\Windows\System\GWfVNqk.exe
  2⤵
  PID:4568
- C:\Windows\System\tMOhTxM.exe
  C:\Windows\System\tMOhTxM.exe
  2⤵
  PID:4640
- C:\Windows\System\WPGuzMF.exe
  C:\Windows\System\WPGuzMF.exe
  2⤵
  PID:4336
- C:\Windows\System\NjRaxts.exe
  C:\Windows\System\NjRaxts.exe
  2⤵
  PID:4436
- C:\Windows\System\YeCBQAe.exe
  C:\Windows\System\YeCBQAe.exe
  2⤵
  PID:4588
- C:\Windows\System\OWxwknJ.exe
  C:\Windows\System\OWxwknJ.exe
  2⤵
  PID:4652
- C:\Windows\System\ygSVuOf.exe
  C:\Windows\System\ygSVuOf.exe
  2⤵
  PID:4692
- C:\Windows\System\nvqsfrE.exe
  C:\Windows\System\nvqsfrE.exe
  2⤵
  PID:4516
- C:\Windows\System\zkArkJe.exe
  C:\Windows\System\zkArkJe.exe
  2⤵
  PID:4752
- C:\Windows\System\TPgXznU.exe
  C:\Windows\System\TPgXznU.exe
  2⤵
  PID:4820
- C:\Windows\System\efEoqVd.exe
  C:\Windows\System\efEoqVd.exe
  2⤵
  PID:4772
- C:\Windows\System\HHobfpE.exe
  C:\Windows\System\HHobfpE.exe
  2⤵
  PID:4884
- C:\Windows\System\uatZvSZ.exe
  C:\Windows\System\uatZvSZ.exe
  2⤵
  PID:4952
- C:\Windows\System\mKBpNPc.exe
  C:\Windows\System\mKBpNPc.exe
  2⤵
  PID:4868
- C:\Windows\System\IdZuTMb.exe
  C:\Windows\System\IdZuTMb.exe
  2⤵
  PID:5048
- C:\Windows\System\acTagdI.exe
  C:\Windows\System\acTagdI.exe
  2⤵
  PID:5084
- C:\Windows\System\QeCzDyI.exe
  C:\Windows\System\QeCzDyI.exe
  2⤵
  PID:4204
- C:\Windows\System\IAnfzrR.exe
  C:\Windows\System\IAnfzrR.exe
  2⤵
  PID:4120
- C:\Windows\System\DBBgZmp.exe
  C:\Windows\System\DBBgZmp.exe
  2⤵
  PID:5136
- C:\Windows\System\VvESyuf.exe
  C:\Windows\System\VvESyuf.exe
  2⤵
  PID:5152
- C:\Windows\System\npegcYp.exe
  C:\Windows\System\npegcYp.exe
  2⤵
  PID:5168
- C:\Windows\System\nieJCFy.exe
  C:\Windows\System\nieJCFy.exe
  2⤵
  PID:5184
- C:\Windows\System\BcMbjXz.exe
  C:\Windows\System\BcMbjXz.exe
  2⤵
  PID:5200
- C:\Windows\System\AKUFMxH.exe
  C:\Windows\System\AKUFMxH.exe
  2⤵
  PID:5216
- C:\Windows\System\EzjFBxV.exe
  C:\Windows\System\EzjFBxV.exe
  2⤵
  PID:5232
- C:\Windows\System\VZPizWd.exe
  C:\Windows\System\VZPizWd.exe
  2⤵
  PID:5248
- C:\Windows\System\frgbolD.exe
  C:\Windows\System\frgbolD.exe
  2⤵
  PID:5264
- C:\Windows\System\KPnKhxk.exe
  C:\Windows\System\KPnKhxk.exe
  2⤵
  PID:5280
- C:\Windows\System\fagdvnU.exe
  C:\Windows\System\fagdvnU.exe
  2⤵
  PID:5296
- C:\Windows\System\WrbfRDR.exe
  C:\Windows\System\WrbfRDR.exe
  2⤵
  PID:5312
- C:\Windows\System\udVDKZj.exe
  C:\Windows\System\udVDKZj.exe
  2⤵
  PID:5328
- C:\Windows\System\dPYGRLn.exe
  C:\Windows\System\dPYGRLn.exe
  2⤵
  PID:5344
- C:\Windows\System\xMvPzzp.exe
  C:\Windows\System\xMvPzzp.exe
  2⤵
  PID:5360
- C:\Windows\System\gRAIcnK.exe
  C:\Windows\System\gRAIcnK.exe
  2⤵
  PID:5376
- C:\Windows\System\xVSWhwD.exe
  C:\Windows\System\xVSWhwD.exe
  2⤵
  PID:5392
- C:\Windows\System\yjKPRmw.exe
  C:\Windows\System\yjKPRmw.exe
  2⤵
  PID:5408
- C:\Windows\System\gLywYUw.exe
  C:\Windows\System\gLywYUw.exe
  2⤵
  PID:5424
- C:\Windows\System\bXXnhXb.exe
  C:\Windows\System\bXXnhXb.exe
  2⤵
  PID:5440
- C:\Windows\System\pNAVaEP.exe
  C:\Windows\System\pNAVaEP.exe
  2⤵
  PID:5456
- C:\Windows\System\JwGFUrE.exe
  C:\Windows\System\JwGFUrE.exe
  2⤵
  PID:5476
- C:\Windows\System\vGtSTwF.exe
  C:\Windows\System\vGtSTwF.exe
  2⤵
  PID:5492
- C:\Windows\System\TgnQXNp.exe
  C:\Windows\System\TgnQXNp.exe
  2⤵
  PID:5508
- C:\Windows\System\UlepmcQ.exe
  C:\Windows\System\UlepmcQ.exe
  2⤵
  PID:5524
- C:\Windows\System\kSifjib.exe
  C:\Windows\System\kSifjib.exe
  2⤵
  PID:5540
- C:\Windows\System\ydhTJMV.exe
  C:\Windows\System\ydhTJMV.exe
  2⤵
  PID:5556
- C:\Windows\System\UZAzeGr.exe
  C:\Windows\System\UZAzeGr.exe
  2⤵
  PID:5572
- C:\Windows\System\MCkuXPd.exe
  C:\Windows\System\MCkuXPd.exe
  2⤵
  PID:5588
- C:\Windows\System\QSfNyxB.exe
  C:\Windows\System\QSfNyxB.exe
  2⤵
  PID:5604
- C:\Windows\System\OSSUMZb.exe
  C:\Windows\System\OSSUMZb.exe
  2⤵
  PID:5620
- C:\Windows\System\GprRiQV.exe
  C:\Windows\System\GprRiQV.exe
  2⤵
  PID:5636
- C:\Windows\System\RMTgeqn.exe
  C:\Windows\System\RMTgeqn.exe
  2⤵
  PID:5652
- C:\Windows\System\LLKIexK.exe
  C:\Windows\System\LLKIexK.exe
  2⤵
  PID:5668
- C:\Windows\System\tgowQkV.exe
  C:\Windows\System\tgowQkV.exe
  2⤵
  PID:5684
- C:\Windows\System\TaIvxuy.exe
  C:\Windows\System\TaIvxuy.exe
  2⤵
  PID:5704
- C:\Windows\System\veTktdt.exe
  C:\Windows\System\veTktdt.exe
  2⤵
  PID:5720
- C:\Windows\System\EzeBSAa.exe
  C:\Windows\System\EzeBSAa.exe
  2⤵
  PID:5736
- C:\Windows\System\igLkpBM.exe
  C:\Windows\System\igLkpBM.exe
  2⤵
  PID:5752
- C:\Windows\System\iwiMwLI.exe
  C:\Windows\System\iwiMwLI.exe
  2⤵
  PID:5768
- C:\Windows\System\KSCoDQH.exe
  C:\Windows\System\KSCoDQH.exe
  2⤵
  PID:5784
- C:\Windows\System\xSUmWTz.exe
  C:\Windows\System\xSUmWTz.exe
  2⤵
  PID:5804
- C:\Windows\System\CryquRu.exe
  C:\Windows\System\CryquRu.exe
  2⤵
  PID:5836
- C:\Windows\System\bImeGVu.exe
  C:\Windows\System\bImeGVu.exe
  2⤵
  PID:5892
- C:\Windows\System\RMFDxhj.exe
  C:\Windows\System\RMFDxhj.exe
  2⤵
  PID:5908
- C:\Windows\System\BrxmBEz.exe
  C:\Windows\System\BrxmBEz.exe
  2⤵
  PID:5924
- C:\Windows\System\nMQhSQK.exe
  C:\Windows\System\nMQhSQK.exe
  2⤵
  PID:5940
- C:\Windows\System\qoqDGpe.exe
  C:\Windows\System\qoqDGpe.exe
  2⤵
  PID:5960
- C:\Windows\System\plyOviT.exe
  C:\Windows\System\plyOviT.exe
  2⤵
  PID:5976
- C:\Windows\System\rywbHBp.exe
  C:\Windows\System\rywbHBp.exe
  2⤵
  PID:5992
- C:\Windows\System\QBKCDiH.exe
  C:\Windows\System\QBKCDiH.exe
  2⤵
  PID:6008
- C:\Windows\System\ykaljad.exe
  C:\Windows\System\ykaljad.exe
  2⤵
  PID:6024
- C:\Windows\System\azrfyED.exe
  C:\Windows\System\azrfyED.exe
  2⤵
  PID:6040
- C:\Windows\System\CdJUjvA.exe
  C:\Windows\System\CdJUjvA.exe
  2⤵
  PID:6056
- C:\Windows\System\cLQthOt.exe
  C:\Windows\System\cLQthOt.exe
  2⤵
  PID:6072
- C:\Windows\System\CRgfdrH.exe
  C:\Windows\System\CRgfdrH.exe
  2⤵
  PID:6092
- C:\Windows\System\ANQIQBU.exe
  C:\Windows\System\ANQIQBU.exe
  2⤵
  PID:6112
- C:\Windows\System\EPxlUNV.exe
  C:\Windows\System\EPxlUNV.exe
  2⤵
  PID:6128
- C:\Windows\System\IPVijSL.exe
  C:\Windows\System\IPVijSL.exe
  2⤵
  PID:4632
- C:\Windows\System\ZzpJqlX.exe
  C:\Windows\System\ZzpJqlX.exe
  2⤵
  PID:3408
- C:\Windows\System\GSnkoTJ.exe
  C:\Windows\System\GSnkoTJ.exe
  2⤵
  PID:1760
- C:\Windows\System\NHkhbuG.exe
  C:\Windows\System\NHkhbuG.exe
  2⤵
  PID:4704
- C:\Windows\System\STJjcQr.exe
  C:\Windows\System\STJjcQr.exe
  2⤵
  PID:944
- C:\Windows\System\sHUWMnR.exe
  C:\Windows\System\sHUWMnR.exe
  2⤵
  PID:4256
- C:\Windows\System\qgIHELN.exe
  C:\Windows\System\qgIHELN.exe
  2⤵
  PID:4356
- C:\Windows\System\GAnTZbr.exe
  C:\Windows\System\GAnTZbr.exe
  2⤵
  PID:4500
- C:\Windows\System\hSHAHlV.exe
  C:\Windows\System\hSHAHlV.exe
  2⤵
  PID:4620
- C:\Windows\System\HfRyMAD.exe
  C:\Windows\System\HfRyMAD.exe
  2⤵
  PID:4856
- C:\Windows\System\mPtumul.exe
  C:\Windows\System\mPtumul.exe
  2⤵
  PID:5208
- C:\Windows\System\NDUuoJL.exe
  C:\Windows\System\NDUuoJL.exe
  2⤵
  PID:5568
- C:\Windows\System\SOLBWax.exe
  C:\Windows\System\SOLBWax.exe
  2⤵
  PID:5660
- C:\Windows\System\cJxdDLh.exe
  C:\Windows\System\cJxdDLh.exe
  2⤵
  PID:5728
- C:\Windows\System\wFaGUOb.exe
  C:\Windows\System\wFaGUOb.exe
  2⤵
  PID:5792
- C:\Windows\System\hQciVZn.exe
  C:\Windows\System\hQciVZn.exe
  2⤵
  PID:4972
- C:\Windows\System\cQVyozh.exe
  C:\Windows\System\cQVyozh.exe
  2⤵
  PID:5000
- C:\Windows\System\adeTHNa.exe
  C:\Windows\System\adeTHNa.exe
  2⤵
  PID:4476
- C:\Windows\System\EBWCmgC.exe
  C:\Windows\System\EBWCmgC.exe
  2⤵
  PID:4740
- C:\Windows\System\eBlBYPd.exe
  C:\Windows\System\eBlBYPd.exe
  2⤵
  PID:4916
- C:\Windows\System\JrrtcjD.exe
  C:\Windows\System\JrrtcjD.exe
  2⤵
  PID:5116
- C:\Windows\System\puxtQVs.exe
  C:\Windows\System\puxtQVs.exe
  2⤵
  PID:5160
- C:\Windows\System\gcpeRIW.exe
  C:\Windows\System\gcpeRIW.exe
  2⤵
  PID:5224
- C:\Windows\System\fDorvSK.exe
  C:\Windows\System\fDorvSK.exe
  2⤵
  PID:5288
- C:\Windows\System\Kplfhmc.exe
  C:\Windows\System\Kplfhmc.exe
  2⤵
  PID:5352
- C:\Windows\System\FeHPzUn.exe
  C:\Windows\System\FeHPzUn.exe
  2⤵
  PID:5520
- C:\Windows\System\xGDXfOd.exe
  C:\Windows\System\xGDXfOd.exe
  2⤵
  PID:5584
- C:\Windows\System\jCmNYBI.exe
  C:\Windows\System\jCmNYBI.exe
  2⤵
  PID:5036
- C:\Windows\System\FjutVEW.exe
  C:\Windows\System\FjutVEW.exe
  2⤵
  PID:4368
- C:\Windows\System\kySzcZH.exe
  C:\Windows\System\kySzcZH.exe
  2⤵
  PID:1492
- C:\Windows\System\gSEzmBG.exe
  C:\Windows\System\gSEzmBG.exe
  2⤵
  PID:1932
- C:\Windows\System\euEaJBi.exe
  C:\Windows\System\euEaJBi.exe
  2⤵
  PID:2692
- C:\Windows\System\TYloVCr.exe
  C:\Windows\System\TYloVCr.exe
  2⤵
  PID:5872
- C:\Windows\System\PlIvBfR.exe
  C:\Windows\System\PlIvBfR.exe
  2⤵
  PID:5900
- C:\Windows\System\VbmzQkv.exe
  C:\Windows\System\VbmzQkv.exe
  2⤵
  PID:6000
- C:\Windows\System\ZIOhgqv.exe
  C:\Windows\System\ZIOhgqv.exe
  2⤵
  PID:6124
- C:\Windows\System\qgArPIK.exe
  C:\Windows\System\qgArPIK.exe
  2⤵
  PID:5240
- C:\Windows\System\dycgPaL.exe
  C:\Windows\System\dycgPaL.exe
  2⤵
  PID:5308
- C:\Windows\System\IZynSYr.exe
  C:\Windows\System\IZynSYr.exe
  2⤵
  PID:5192
- C:\Windows\System\SoAPYHX.exe
  C:\Windows\System\SoAPYHX.exe
  2⤵
  PID:5488
- C:\Windows\System\IwjmSSw.exe
  C:\Windows\System\IwjmSSw.exe
  2⤵
  PID:5764
- C:\Windows\System\lgjnLDH.exe
  C:\Windows\System\lgjnLDH.exe
  2⤵
  PID:4708
- C:\Windows\System\ZXyESUi.exe
  C:\Windows\System\ZXyESUi.exe
  2⤵
  PID:5676
- C:\Windows\System\BmSGnye.exe
  C:\Windows\System\BmSGnye.exe
  2⤵
  PID:3356
- C:\Windows\System\NhTVbJW.exe
  C:\Windows\System\NhTVbJW.exe
  2⤵
  PID:5680
- C:\Windows\System\fjfISNf.exe
  C:\Windows\System\fjfISNf.exe
  2⤵
  PID:1936
- C:\Windows\System\ZMihOuu.exe
  C:\Windows\System\ZMihOuu.exe
  2⤵
  PID:5812
- C:\Windows\System\BViCUOo.exe
  C:\Windows\System\BViCUOo.exe
  2⤵
  PID:4400
- C:\Windows\System\KJiXgTo.exe
  C:\Windows\System\KJiXgTo.exe
  2⤵
  PID:4268
- C:\Windows\System\DcGPUaK.exe
  C:\Windows\System\DcGPUaK.exe
  2⤵
  PID:5888
- C:\Windows\System\WANAMeG.exe
  C:\Windows\System\WANAMeG.exe
  2⤵
  PID:1672
- C:\Windows\System\fFkmHzf.exe
  C:\Windows\System\fFkmHzf.exe
  2⤵
  PID:4416
- C:\Windows\System\SDXOnRI.exe
  C:\Windows\System\SDXOnRI.exe
  2⤵
  PID:5952
- C:\Windows\System\VKPYWRl.exe
  C:\Windows\System\VKPYWRl.exe
  2⤵
  PID:6016
- C:\Windows\System\jZRJAhU.exe
  C:\Windows\System\jZRJAhU.exe
  2⤵
  PID:5880
- C:\Windows\System\itRTRXa.exe
  C:\Windows\System\itRTRXa.exe
  2⤵
  PID:2596
- C:\Windows\System\oSDWrxr.exe
  C:\Windows\System\oSDWrxr.exe
  2⤵
  PID:1580
- C:\Windows\System\PSGsxNV.exe
  C:\Windows\System\PSGsxNV.exe
  2⤵
  PID:1224
- C:\Windows\System\TebmhqX.exe
  C:\Windows\System\TebmhqX.exe
  2⤵
  PID:4104
- C:\Windows\System\cJQkvMB.exe
  C:\Windows\System\cJQkvMB.exe
  2⤵
  PID:5848
- C:\Windows\System\yaSSoJT.exe
  C:\Windows\System\yaSSoJT.exe
  2⤵
  PID:5932
- C:\Windows\System\dKELogI.exe
  C:\Windows\System\dKELogI.exe
  2⤵
  PID:5968
- C:\Windows\System\gRXxkOK.exe
  C:\Windows\System\gRXxkOK.exe
  2⤵
  PID:6100
- C:\Windows\System\HtgxUXS.exe
  C:\Windows\System\HtgxUXS.exe
  2⤵
  PID:4140
- C:\Windows\System\lMwSzSv.exe
  C:\Windows\System\lMwSzSv.exe
  2⤵
  PID:4332
- C:\Windows\System\ltaCTdf.exe
  C:\Windows\System\ltaCTdf.exe
  2⤵
  PID:4164
- C:\Windows\System\hTAsMpI.exe
  C:\Windows\System\hTAsMpI.exe
  2⤵
  PID:2780
- C:\Windows\System\nBZzrPH.exe
  C:\Windows\System\nBZzrPH.exe
  2⤵
  PID:5072
- C:\Windows\System\givVPMW.exe
  C:\Windows\System\givVPMW.exe
  2⤵
  PID:4420
- C:\Windows\System\KldfiDg.exe
  C:\Windows\System\KldfiDg.exe
  2⤵
  PID:4288
- C:\Windows\System\VWmCtjf.exe
  C:\Windows\System\VWmCtjf.exe
  2⤵
  PID:4552
- C:\Windows\System\HgFxHPM.exe
  C:\Windows\System\HgFxHPM.exe
  2⤵
  PID:5692
- C:\Windows\System\aCkEDfj.exe
  C:\Windows\System\aCkEDfj.exe
  2⤵
  PID:4672
- C:\Windows\System\JRreZmF.exe
  C:\Windows\System\JRreZmF.exe
  2⤵
  PID:4832
- C:\Windows\System\IKVPxwr.exe
  C:\Windows\System\IKVPxwr.exe
  2⤵
  PID:5132
- C:\Windows\System\arhqaqk.exe
  C:\Windows\System\arhqaqk.exe
  2⤵
  PID:5304
- C:\Windows\System\aVMrRyu.exe
  C:\Windows\System\aVMrRyu.exe
  2⤵
  PID:5504
- C:\Windows\System\LerzwxW.exe
  C:\Windows\System\LerzwxW.exe
  2⤵
  PID:5020
- C:\Windows\System\xSnFqJp.exe
  C:\Windows\System\xSnFqJp.exe
  2⤵
  PID:5464
- C:\Windows\System\tSOrlov.exe
  C:\Windows\System\tSOrlov.exe
  2⤵
  PID:5564
- C:\Windows\System\Twhvmow.exe
  C:\Windows\System\Twhvmow.exe
  2⤵
  PID:5144
- C:\Windows\System\jDfCPqk.exe
  C:\Windows\System\jDfCPqk.exe
  2⤵
  PID:5420
- C:\Windows\System\bZdmFia.exe
  C:\Windows\System\bZdmFia.exe
  2⤵
  PID:5324
- C:\Windows\System\uCmzZDY.exe
  C:\Windows\System\uCmzZDY.exe
  2⤵
  PID:6084
- C:\Windows\System\Wudysdx.exe
  C:\Windows\System\Wudysdx.exe
  2⤵
  PID:5832
- C:\Windows\System\INNOJvh.exe
  C:\Windows\System\INNOJvh.exe
  2⤵
  PID:5700
- C:\Windows\System\FtZdrlU.exe
  C:\Windows\System\FtZdrlU.exe
  2⤵
  PID:6136
- C:\Windows\System\FOPGYun.exe
  C:\Windows\System\FOPGYun.exe
  2⤵
  PID:4768
- C:\Windows\System\eJwlUOv.exe
  C:\Windows\System\eJwlUOv.exe
  2⤵
  PID:3904
- C:\Windows\System\hpuVJMf.exe
  C:\Windows\System\hpuVJMf.exe
  2⤵
  PID:5416
- C:\Windows\System\DnMfMLk.exe
  C:\Windows\System\DnMfMLk.exe
  2⤵
  PID:4616
- C:\Windows\System\IEBNsET.exe
  C:\Windows\System\IEBNsET.exe
  2⤵
  PID:5176
- C:\Windows\System\chdWmam.exe
  C:\Windows\System\chdWmam.exe
  2⤵
  PID:5552
- C:\Windows\System\FqsFZrH.exe
  C:\Windows\System\FqsFZrH.exe
  2⤵
  PID:5100
- C:\Windows\System\CaFNomn.exe
  C:\Windows\System\CaFNomn.exe
  2⤵
  PID:6048
- C:\Windows\System\WZcCfWt.exe
  C:\Windows\System\WZcCfWt.exe
  2⤵
  PID:3068
- C:\Windows\System\wWwHCVk.exe
  C:\Windows\System\wWwHCVk.exe
  2⤵
  PID:5852
- C:\Windows\System\jxXpHCS.exe
  C:\Windows\System\jxXpHCS.exe
  2⤵
  PID:1644
- C:\Windows\System\aAKqIXC.exe
  C:\Windows\System\aAKqIXC.exe
  2⤵
  PID:3952
- C:\Windows\System\luZGXLP.exe
  C:\Windows\System\luZGXLP.exe
  2⤵
  PID:5632
- C:\Windows\System\QLxfKBB.exe
  C:\Windows\System\QLxfKBB.exe
  2⤵
  PID:5580
- C:\Windows\System\LBZRiVP.exe
  C:\Windows\System\LBZRiVP.exe
  2⤵
  PID:5748
- C:\Windows\System\mgtyTIa.exe
  C:\Windows\System\mgtyTIa.exe
  2⤵
  PID:4936
- C:\Windows\System\GtQIOMr.exe
  C:\Windows\System\GtQIOMr.exe
  2⤵
  PID:4536
- C:\Windows\System\LUyEBFx.exe
  C:\Windows\System\LUyEBFx.exe
  2⤵
  PID:5400
- C:\Windows\System\JaEKYKU.exe
  C:\Windows\System\JaEKYKU.exe
  2⤵
  PID:3936
- C:\Windows\System\QoCKrRG.exe
  C:\Windows\System\QoCKrRG.exe
  2⤵
  PID:5256
- C:\Windows\System\tvTulVw.exe
  C:\Windows\System\tvTulVw.exe
  2⤵
  PID:5844
- C:\Windows\System\JLezMph.exe
  C:\Windows\System\JLezMph.exe
  2⤵
  PID:6104
- C:\Windows\System\bUHsCnX.exe
  C:\Windows\System\bUHsCnX.exe
  2⤵
  PID:4800
- C:\Windows\System\zstxikf.exe
  C:\Windows\System\zstxikf.exe
  2⤵
  PID:2688
- C:\Windows\System\xVBwFtq.exe
  C:\Windows\System\xVBwFtq.exe
  2⤵
  PID:5372
- C:\Windows\System\dTLESGt.exe
  C:\Windows\System\dTLESGt.exe
  2⤵
  PID:5948
- C:\Windows\System\ZkADqCB.exe
  C:\Windows\System\ZkADqCB.exe
  2⤵
  PID:2940
- C:\Windows\System\IIXYrVF.exe
  C:\Windows\System\IIXYrVF.exe
  2⤵
  PID:5104
- C:\Windows\System\JZnPakC.exe
  C:\Windows\System\JZnPakC.exe
  2⤵
  PID:2864
- C:\Windows\System\azYpfoO.exe
  C:\Windows\System\azYpfoO.exe
  2⤵
  PID:3516
- C:\Windows\System\UnzYcxb.exe
  C:\Windows\System\UnzYcxb.exe
  2⤵
  PID:5448
- C:\Windows\System\xcBRrwu.exe
  C:\Windows\System\xcBRrwu.exe
  2⤵
  PID:6160
- C:\Windows\System\ymTwRfY.exe
  C:\Windows\System\ymTwRfY.exe
  2⤵
  PID:6176
- C:\Windows\System\KOQyIRc.exe
  C:\Windows\System\KOQyIRc.exe
  2⤵
  PID:6192
- C:\Windows\System\JSTRzKS.exe
  C:\Windows\System\JSTRzKS.exe
  2⤵
  PID:6208
- C:\Windows\System\RVluref.exe
  C:\Windows\System\RVluref.exe
  2⤵
  PID:6224
- C:\Windows\System\BnAjMlR.exe
  C:\Windows\System\BnAjMlR.exe
  2⤵
  PID:6240
- C:\Windows\System\eaKwDTe.exe
  C:\Windows\System\eaKwDTe.exe
  2⤵
  PID:6256
- C:\Windows\System\nyFrANf.exe
  C:\Windows\System\nyFrANf.exe
  2⤵
  PID:6272
- C:\Windows\System\EoiNEcx.exe
  C:\Windows\System\EoiNEcx.exe
  2⤵
  PID:6288
- C:\Windows\System\HrBiqsk.exe
  C:\Windows\System\HrBiqsk.exe
  2⤵
  PID:6304
- C:\Windows\System\saoRVDI.exe
  C:\Windows\System\saoRVDI.exe
  2⤵
  PID:6320
- C:\Windows\System\usmIOXj.exe
  C:\Windows\System\usmIOXj.exe
  2⤵
  PID:6336
- C:\Windows\System\VxHevaW.exe
  C:\Windows\System\VxHevaW.exe
  2⤵
  PID:6352
- C:\Windows\System\BSeFQkK.exe
  C:\Windows\System\BSeFQkK.exe
  2⤵
  PID:6368
- C:\Windows\System\gsvwmne.exe
  C:\Windows\System\gsvwmne.exe
  2⤵
  PID:6384
- C:\Windows\System\IGfxcUJ.exe
  C:\Windows\System\IGfxcUJ.exe
  2⤵
  PID:6400
- C:\Windows\System\jPpALBT.exe
  C:\Windows\System\jPpALBT.exe
  2⤵
  PID:6416
- C:\Windows\System\SWMMwZF.exe
  C:\Windows\System\SWMMwZF.exe
  2⤵
  PID:6432
- C:\Windows\System\CZxwASL.exe
  C:\Windows\System\CZxwASL.exe
  2⤵
  PID:6448
- C:\Windows\System\bDMjODW.exe
  C:\Windows\System\bDMjODW.exe
  2⤵
  PID:6464
- C:\Windows\System\sCWNrhd.exe
  C:\Windows\System\sCWNrhd.exe
  2⤵
  PID:6480
- C:\Windows\System\uxFisEb.exe
  C:\Windows\System\uxFisEb.exe
  2⤵
  PID:6500
- C:\Windows\System\uWsCsNH.exe
  C:\Windows\System\uWsCsNH.exe
  2⤵
  PID:6516
- C:\Windows\System\pPaoLQG.exe
  C:\Windows\System\pPaoLQG.exe
  2⤵
  PID:6532
- C:\Windows\System\oisXkgJ.exe
  C:\Windows\System\oisXkgJ.exe
  2⤵
  PID:6548
- C:\Windows\System\GgruDlS.exe
  C:\Windows\System\GgruDlS.exe
  2⤵
  PID:6564
- C:\Windows\System\OaKrVNR.exe
  C:\Windows\System\OaKrVNR.exe
  2⤵
  PID:6580
- C:\Windows\System\ROOqGhi.exe
  C:\Windows\System\ROOqGhi.exe
  2⤵
  PID:6596
- C:\Windows\System\seXNPyN.exe
  C:\Windows\System\seXNPyN.exe
  2⤵
  PID:6620
- C:\Windows\System\ptDlGvJ.exe
  C:\Windows\System\ptDlGvJ.exe
  2⤵
  PID:6636
- C:\Windows\System\EqxTHqo.exe
  C:\Windows\System\EqxTHqo.exe
  2⤵
  PID:6652
- C:\Windows\System\qYJeHir.exe
  C:\Windows\System\qYJeHir.exe
  2⤵
  PID:6668
- C:\Windows\System\yOVwejP.exe
  C:\Windows\System\yOVwejP.exe
  2⤵
  PID:6684
- C:\Windows\System\kjteEsd.exe
  C:\Windows\System\kjteEsd.exe
  2⤵
  PID:6700
- C:\Windows\System\mQDGPCf.exe
  C:\Windows\System\mQDGPCf.exe
  2⤵
  PID:6716
- C:\Windows\System\ZczAWaY.exe
  C:\Windows\System\ZczAWaY.exe
  2⤵
  PID:6732
- C:\Windows\System\yZfonmS.exe
  C:\Windows\System\yZfonmS.exe
  2⤵
  PID:6748
- C:\Windows\System\lQIAuQY.exe
  C:\Windows\System\lQIAuQY.exe
  2⤵
  PID:6764
- C:\Windows\System\YPGhjIb.exe
  C:\Windows\System\YPGhjIb.exe
  2⤵
  PID:6780
- C:\Windows\System\IFTWcsJ.exe
  C:\Windows\System\IFTWcsJ.exe
  2⤵
  PID:6796
- C:\Windows\System\DgzzrkF.exe
  C:\Windows\System\DgzzrkF.exe
  2⤵
  PID:6812
- C:\Windows\System\qufJzSZ.exe
  C:\Windows\System\qufJzSZ.exe
  2⤵
  PID:6828
- C:\Windows\System\bWgPtkT.exe
  C:\Windows\System\bWgPtkT.exe
  2⤵
  PID:6848
- C:\Windows\System\NiPMogQ.exe
  C:\Windows\System\NiPMogQ.exe
  2⤵
  PID:6864
- C:\Windows\System\VScbDds.exe
  C:\Windows\System\VScbDds.exe
  2⤵
  PID:6880
- C:\Windows\System\MSserVB.exe
  C:\Windows\System\MSserVB.exe
  2⤵
  PID:6896
- C:\Windows\System\umEaMSx.exe
  C:\Windows\System\umEaMSx.exe
  2⤵
  PID:6912
- C:\Windows\System\sHanpgZ.exe
  C:\Windows\System\sHanpgZ.exe
  2⤵
  PID:6928
- C:\Windows\System\weHshvn.exe
  C:\Windows\System\weHshvn.exe
  2⤵
  PID:6944
- C:\Windows\System\THLWmDI.exe
  C:\Windows\System\THLWmDI.exe
  2⤵
  PID:6960
- C:\Windows\System\cGFpJog.exe
  C:\Windows\System\cGFpJog.exe
  2⤵
  PID:6976
- C:\Windows\System\GNvqDku.exe
  C:\Windows\System\GNvqDku.exe
  2⤵
  PID:6996
- C:\Windows\System\QqVVytC.exe
  C:\Windows\System\QqVVytC.exe
  2⤵
  PID:7012
- C:\Windows\System\UmXqwFN.exe
  C:\Windows\System\UmXqwFN.exe
  2⤵
  PID:7028
- C:\Windows\System\edjvAnQ.exe
  C:\Windows\System\edjvAnQ.exe
  2⤵
  PID:7044
- C:\Windows\System\nnksPiW.exe
  C:\Windows\System\nnksPiW.exe
  2⤵
  PID:7060
- C:\Windows\System\YzRVXnq.exe
  C:\Windows\System\YzRVXnq.exe
  2⤵
  PID:7076
- C:\Windows\System\XqHIFRj.exe
  C:\Windows\System\XqHIFRj.exe
  2⤵
  PID:7092
- C:\Windows\System\fqQgqdf.exe
  C:\Windows\System\fqQgqdf.exe
  2⤵
  PID:7108
- C:\Windows\System\klsnbZB.exe
  C:\Windows\System\klsnbZB.exe
  2⤵
  PID:7124
- C:\Windows\System\HmcdgOR.exe
  C:\Windows\System\HmcdgOR.exe
  2⤵
  PID:7140
- C:\Windows\System\WUWeSRq.exe
  C:\Windows\System\WUWeSRq.exe
  2⤵
  PID:7156
- C:\Windows\System\ObfRKCJ.exe
  C:\Windows\System\ObfRKCJ.exe
  2⤵
  PID:4564
- C:\Windows\System\ibbojve.exe
  C:\Windows\System\ibbojve.exe
  2⤵
  PID:1816
- C:\Windows\System\ZyVkmYn.exe
  C:\Windows\System\ZyVkmYn.exe
  2⤵
  PID:5920
- C:\Windows\System\sqkDsXu.exe
  C:\Windows\System\sqkDsXu.exe
  2⤵
  PID:4984
- C:\Windows\System\vNpmGZE.exe
  C:\Windows\System\vNpmGZE.exe
  2⤵
  PID:6172
- C:\Windows\System\IxXrUSi.exe
  C:\Windows\System\IxXrUSi.exe
  2⤵
  PID:6236
- C:\Windows\System\ZVFBUVw.exe
  C:\Windows\System\ZVFBUVw.exe
  2⤵
  PID:6300
- C:\Windows\System\BdLurTf.exe
  C:\Windows\System\BdLurTf.exe
  2⤵
  PID:6252
- C:\Windows\System\SnVzZQR.exe
  C:\Windows\System\SnVzZQR.exe
  2⤵
  PID:6364
- C:\Windows\System\kkenBPU.exe
  C:\Windows\System\kkenBPU.exe
  2⤵
  PID:6472
- C:\Windows\System\DCOlJCH.exe
  C:\Windows\System\DCOlJCH.exe
  2⤵
  PID:6512
- C:\Windows\System\wyRdhLx.exe
  C:\Windows\System\wyRdhLx.exe
  2⤵
  PID:6540
- C:\Windows\System\jwMsEIk.exe
  C:\Windows\System\jwMsEIk.exe
  2⤵
  PID:6496
- C:\Windows\System\EjrIBMf.exe
  C:\Windows\System\EjrIBMf.exe
  2⤵
  PID:6556
- C:\Windows\System\ugINGFB.exe
  C:\Windows\System\ugINGFB.exe
  2⤵
  PID:6628
- C:\Windows\System\GiDzzGr.exe
  C:\Windows\System\GiDzzGr.exe
  2⤵
  PID:6692
- C:\Windows\System\JUEVDBZ.exe
  C:\Windows\System\JUEVDBZ.exe
  2⤵
  PID:6728
- C:\Windows\System\AFUigZt.exe
  C:\Windows\System\AFUigZt.exe
  2⤵
  PID:6648
- C:\Windows\System\QSoWJHt.exe
  C:\Windows\System\QSoWJHt.exe
  2⤵
  PID:6708
- C:\Windows\System\WoxhcCh.exe
  C:\Windows\System\WoxhcCh.exe
  2⤵
  PID:6788
- C:\Windows\System\tquQWdt.exe
  C:\Windows\System\tquQWdt.exe
  2⤵
  PID:6772
- C:\Windows\System\CrmGBaQ.exe
  C:\Windows\System\CrmGBaQ.exe
  2⤵
  PID:6836
- C:\Windows\System\NSCBclc.exe
  C:\Windows\System\NSCBclc.exe
  2⤵
  PID:6872
- C:\Windows\System\oeZKoGh.exe
  C:\Windows\System\oeZKoGh.exe
  2⤵
  PID:6904
- C:\Windows\System\ouivmeb.exe
  C:\Windows\System\ouivmeb.exe
  2⤵
  PID:7008
- C:\Windows\System\SppOKHX.exe
  C:\Windows\System\SppOKHX.exe
  2⤵
  PID:6920
- C:\Windows\System\PMmUAjz.exe
  C:\Windows\System\PMmUAjz.exe
  2⤵
  PID:6988
- C:\Windows\System\AHyDBlq.exe
  C:\Windows\System\AHyDBlq.exe
  2⤵
  PID:7040
- C:\Windows\System\sXnbtGF.exe
  C:\Windows\System\sXnbtGF.exe
  2⤵
  PID:7104
- C:\Windows\System\otToVns.exe
  C:\Windows\System\otToVns.exe
  2⤵
  PID:7164
- C:\Windows\System\xkOowRp.exe
  C:\Windows\System\xkOowRp.exe
  2⤵
  PID:7084
- C:\Windows\System\UfwTNxh.exe
  C:\Windows\System\UfwTNxh.exe
  2⤵
  PID:7120
- C:\Windows\System\XPfHadW.exe
  C:\Windows\System\XPfHadW.exe
  2⤵
  PID:6156
- C:\Windows\System\chCyLmM.exe
  C:\Windows\System\chCyLmM.exe
  2⤵
  PID:5800
- C:\Windows\System\yctnWpt.exe
  C:\Windows\System\yctnWpt.exe
  2⤵
  PID:3664
- C:\Windows\System\YchDDMX.exe
  C:\Windows\System\YchDDMX.exe
  2⤵
  PID:608
- C:\Windows\System\hyuYYaW.exe
  C:\Windows\System\hyuYYaW.exe
  2⤵
  PID:5644
- C:\Windows\System\DNNlvjN.exe
  C:\Windows\System\DNNlvjN.exe
  2⤵
  PID:6508
- C:\Windows\System\yTgouEo.exe
  C:\Windows\System\yTgouEo.exe
  2⤵
  PID:6392
- C:\Windows\System\RugKOUL.exe
  C:\Windows\System\RugKOUL.exe
  2⤵
  PID:6644
- C:\Windows\System\xOeJagc.exe
  C:\Windows\System\xOeJagc.exe
  2⤵
  PID:6840
- C:\Windows\System\PmGArby.exe
  C:\Windows\System\PmGArby.exe
  2⤵
  PID:6984
- C:\Windows\System\AJARzTC.exe
  C:\Windows\System\AJARzTC.exe
  2⤵
  PID:7100
- C:\Windows\System\kXHRPlM.exe
  C:\Windows\System\kXHRPlM.exe
  2⤵
  PID:7056
- C:\Windows\System\utEusIg.exe
  C:\Windows\System\utEusIg.exe
  2⤵
  PID:6440
- C:\Windows\System\HEWlVcq.exe
  C:\Windows\System\HEWlVcq.exe
  2⤵
  PID:6248
- C:\Windows\System\tRwddWj.exe
  C:\Windows\System\tRwddWj.exe
  2⤵
  PID:6524
- C:\Windows\System\SpbNUIh.exe
  C:\Windows\System\SpbNUIh.exe
  2⤵
  PID:6820
- C:\Windows\System\uulReZg.exe
  C:\Windows\System\uulReZg.exe
  2⤵
  PID:6940
- C:\Windows\System\QIocuwF.exe
  C:\Windows\System\QIocuwF.exe
  2⤵
  PID:7020
- C:\Windows\System\pPKyAYu.exe
  C:\Windows\System\pPKyAYu.exe
  2⤵
  PID:7116
- C:\Windows\System\ixXaSiF.exe
  C:\Windows\System\ixXaSiF.exe
  2⤵
  PID:5600
- C:\Windows\System\JOsLtnO.exe
  C:\Windows\System\JOsLtnO.exe
  2⤵
  PID:2360
- C:\Windows\System\AMcLCdY.exe
  C:\Windows\System\AMcLCdY.exe
  2⤵
  PID:7072
- C:\Windows\System\uFRNNUv.exe
  C:\Windows\System\uFRNNUv.exe
  2⤵
  PID:6612
- C:\Windows\System\fRIGART.exe
  C:\Windows\System\fRIGART.exe
  2⤵
  PID:6936
- C:\Windows\System\hdNtYna.exe
  C:\Windows\System\hdNtYna.exe
  2⤵
  PID:4272
- C:\Windows\System\ptVHFmT.exe
  C:\Windows\System\ptVHFmT.exe
  2⤵
  PID:7088
- C:\Windows\System\VtUQWTT.exe
  C:\Windows\System\VtUQWTT.exe
  2⤵
  PID:7184
- C:\Windows\System\CbDtEFp.exe
  C:\Windows\System\CbDtEFp.exe
  2⤵
  PID:7200
- C:\Windows\System\sBwATxr.exe
  C:\Windows\System\sBwATxr.exe
  2⤵
  PID:7216
- C:\Windows\System\MfDinCJ.exe
  C:\Windows\System\MfDinCJ.exe
  2⤵
  PID:7232
- C:\Windows\System\XgmfZHR.exe
  C:\Windows\System\XgmfZHR.exe
  2⤵
  PID:7248
- C:\Windows\System\qNBejfB.exe
  C:\Windows\System\qNBejfB.exe
  2⤵
  PID:7264
- C:\Windows\System\QkJHALU.exe
  C:\Windows\System\QkJHALU.exe
  2⤵
  PID:7280
- C:\Windows\System\jVQIzxs.exe
  C:\Windows\System\jVQIzxs.exe
  2⤵
  PID:7360
- C:\Windows\System\gSJavtp.exe
  C:\Windows\System\gSJavtp.exe
  2⤵
  PID:7376
- C:\Windows\System\bErXXQM.exe
  C:\Windows\System\bErXXQM.exe
  2⤵
  PID:7392
- C:\Windows\System\YmuNFaC.exe
  C:\Windows\System\YmuNFaC.exe
  2⤵
  PID:7408
- C:\Windows\System\hqtLLIn.exe
  C:\Windows\System\hqtLLIn.exe
  2⤵
  PID:7424
- C:\Windows\System\RGDltWI.exe
  C:\Windows\System\RGDltWI.exe
  2⤵
  PID:7440
- C:\Windows\System\sBztPej.exe
  C:\Windows\System\sBztPej.exe
  2⤵
  PID:7456
- C:\Windows\System\YwNsabo.exe
  C:\Windows\System\YwNsabo.exe
  2⤵
  PID:7472
- C:\Windows\System\cJSKzWP.exe
  C:\Windows\System\cJSKzWP.exe
  2⤵
  PID:7488
- C:\Windows\System\hWSAwBj.exe
  C:\Windows\System\hWSAwBj.exe
  2⤵
  PID:7504
- C:\Windows\System\KZWmuhf.exe
  C:\Windows\System\KZWmuhf.exe
  2⤵
  PID:7520
- C:\Windows\System\KIQfEqi.exe
  C:\Windows\System\KIQfEqi.exe
  2⤵
  PID:7536
- C:\Windows\System\bjHivUb.exe
  C:\Windows\System\bjHivUb.exe
  2⤵
  PID:7552
- C:\Windows\System\lDvqnXk.exe
  C:\Windows\System\lDvqnXk.exe
  2⤵
  PID:7568
- C:\Windows\System\VsAEmxm.exe
  C:\Windows\System\VsAEmxm.exe
  2⤵
  PID:7584
- C:\Windows\System\vgcbchJ.exe
  C:\Windows\System\vgcbchJ.exe
  2⤵
  PID:7600
- C:\Windows\System\gvSDGzO.exe
  C:\Windows\System\gvSDGzO.exe
  2⤵
  PID:7616
- C:\Windows\System\pIPzxWd.exe
  C:\Windows\System\pIPzxWd.exe
  2⤵
  PID:7632
- C:\Windows\System\nuxEMim.exe
  C:\Windows\System\nuxEMim.exe
  2⤵
  PID:7648
- C:\Windows\System\bmfLeFG.exe
  C:\Windows\System\bmfLeFG.exe
  2⤵
  PID:7664
- C:\Windows\System\DyWeIkB.exe
  C:\Windows\System\DyWeIkB.exe
  2⤵
  PID:7680
- C:\Windows\System\jPXqknC.exe
  C:\Windows\System\jPXqknC.exe
  2⤵
  PID:7696
- C:\Windows\System\aWKqdwY.exe
  C:\Windows\System\aWKqdwY.exe
  2⤵
  PID:7712
- C:\Windows\System\vomWnGs.exe
  C:\Windows\System\vomWnGs.exe
  2⤵
  PID:7728
- C:\Windows\System\uLsPPHj.exe
  C:\Windows\System\uLsPPHj.exe
  2⤵
  PID:7744
- C:\Windows\System\NlEZtfP.exe
  C:\Windows\System\NlEZtfP.exe
  2⤵
  PID:7760
- C:\Windows\System\zmbVygB.exe
  C:\Windows\System\zmbVygB.exe
  2⤵
  PID:7776
- C:\Windows\System\oTsLvZy.exe
  C:\Windows\System\oTsLvZy.exe
  2⤵
  PID:7792
- C:\Windows\System\ZJTjDny.exe
  C:\Windows\System\ZJTjDny.exe
  2⤵
  PID:7812
- C:\Windows\System\EGQewzx.exe
  C:\Windows\System\EGQewzx.exe
  2⤵
  PID:7828
- C:\Windows\System\JMecRPu.exe
  C:\Windows\System\JMecRPu.exe
  2⤵
  PID:7844
- C:\Windows\System\YYcsPXp.exe
  C:\Windows\System\YYcsPXp.exe
  2⤵
  PID:7860
- C:\Windows\System\YgqSHuv.exe
  C:\Windows\System\YgqSHuv.exe
  2⤵
  PID:7880
- C:\Windows\System\FexePcF.exe
  C:\Windows\System\FexePcF.exe
  2⤵
  PID:7896
- C:\Windows\System\ZOTqRbJ.exe
  C:\Windows\System\ZOTqRbJ.exe
  2⤵
  PID:7912
- C:\Windows\System\vzltmbr.exe
  C:\Windows\System\vzltmbr.exe
  2⤵
  PID:7928
- C:\Windows\System\SZiImzN.exe
  C:\Windows\System\SZiImzN.exe
  2⤵
  PID:7944
- C:\Windows\System\jmHJgxH.exe
  C:\Windows\System\jmHJgxH.exe
  2⤵
  PID:7960
- C:\Windows\System\DEMlGdU.exe
  C:\Windows\System\DEMlGdU.exe
  2⤵
  PID:7976
- C:\Windows\System\vazfdep.exe
  C:\Windows\System\vazfdep.exe
  2⤵
  PID:8008
- C:\Windows\System\lbwNUWE.exe
  C:\Windows\System\lbwNUWE.exe
  2⤵
  PID:8044
- C:\Windows\System\rgOSIed.exe
  C:\Windows\System\rgOSIed.exe
  2⤵
  PID:8064
- C:\Windows\System\aoGCduY.exe
  C:\Windows\System\aoGCduY.exe
  2⤵
  PID:8080
- C:\Windows\System\HCIYREj.exe
  C:\Windows\System\HCIYREj.exe
  2⤵
  PID:8096
- C:\Windows\System\zqLsYcA.exe
  C:\Windows\System\zqLsYcA.exe
  2⤵
  PID:8116
- C:\Windows\System\SZehiBK.exe
  C:\Windows\System\SZehiBK.exe
  2⤵
  PID:8132
- C:\Windows\System\QybkKfz.exe
  C:\Windows\System\QybkKfz.exe
  2⤵
  PID:8148
- C:\Windows\System\eDYbKGk.exe
  C:\Windows\System\eDYbKGk.exe
  2⤵
  PID:8168
- C:\Windows\System\ADeYEon.exe
  C:\Windows\System\ADeYEon.exe
  2⤵
  PID:8184
- C:\Windows\System\oaJfNdc.exe
  C:\Windows\System\oaJfNdc.exe
  2⤵
  PID:7208
- C:\Windows\System\hAqbtnq.exe
  C:\Windows\System\hAqbtnq.exe
  2⤵
  PID:6268
- C:\Windows\System\lpLDskl.exe
  C:\Windows\System\lpLDskl.exe
  2⤵
  PID:6592
- C:\Windows\System\HEQKtkB.exe
  C:\Windows\System\HEQKtkB.exe
  2⤵
  PID:7004
- C:\Windows\System\ckccGdb.exe
  C:\Windows\System\ckccGdb.exe
  2⤵
  PID:6332
- C:\Windows\System\oqBJSKA.exe
  C:\Windows\System\oqBJSKA.exe
  2⤵
  PID:7244
- C:\Windows\System\QQvwSyV.exe
  C:\Windows\System\QQvwSyV.exe
  2⤵
  PID:6888
- C:\Windows\System\nOeiUOe.exe
  C:\Windows\System\nOeiUOe.exe
  2⤵
  PID:6460
- C:\Windows\System\YFYLVbz.exe
  C:\Windows\System\YFYLVbz.exe
  2⤵
  PID:6808
- C:\Windows\System\exGgHOz.exe
  C:\Windows\System\exGgHOz.exe
  2⤵
  PID:7288
- C:\Windows\System\JSJoVuW.exe
  C:\Windows\System\JSJoVuW.exe
  2⤵
  PID:7260
- C:\Windows\System\ZdzqfKl.exe
  C:\Windows\System\ZdzqfKl.exe
  2⤵
  PID:7304
- C:\Windows\System\girXdqV.exe
  C:\Windows\System\girXdqV.exe
  2⤵
  PID:7320
- C:\Windows\System\lxlNeVd.exe
  C:\Windows\System\lxlNeVd.exe
  2⤵
  PID:7336
- C:\Windows\System\DqMrlWu.exe
  C:\Windows\System\DqMrlWu.exe
  2⤵
  PID:7356
- C:\Windows\System\HKlkQPc.exe
  C:\Windows\System\HKlkQPc.exe
  2⤵
  PID:7420
- C:\Windows\System\LhBFQuC.exe
  C:\Windows\System\LhBFQuC.exe
  2⤵
  PID:7400
- C:\Windows\System\mmFtYZm.exe
  C:\Windows\System\mmFtYZm.exe
  2⤵
  PID:7464
- C:\Windows\System\jFzTmzu.exe
  C:\Windows\System\jFzTmzu.exe
  2⤵
  PID:7560
- C:\Windows\System\unNlmpk.exe
  C:\Windows\System\unNlmpk.exe
  2⤵
  PID:7592
- C:\Windows\System\XAnfkCZ.exe
  C:\Windows\System\XAnfkCZ.exe
  2⤵
  PID:7656
- C:\Windows\System\CPenfxN.exe
  C:\Windows\System\CPenfxN.exe
  2⤵
  PID:7480
- C:\Windows\System\naIbPVf.exe
  C:\Windows\System\naIbPVf.exe
  2⤵
  PID:7756
- C:\Windows\System\QAHYGSs.exe
  C:\Windows\System\QAHYGSs.exe
  2⤵
  PID:7448
- C:\Windows\System\eNifnFY.exe
  C:\Windows\System\eNifnFY.exe
  2⤵
  PID:7820
- C:\Windows\System\RRSRapQ.exe
  C:\Windows\System\RRSRapQ.exe
  2⤵
  PID:7920
- C:\Windows\System\XnIddhC.exe
  C:\Windows\System\XnIddhC.exe
  2⤵
  PID:7952
- C:\Windows\System\MAhqsPX.exe
  C:\Windows\System\MAhqsPX.exe
  2⤵
  PID:7580
- C:\Windows\System\giRJosD.exe
  C:\Windows\System\giRJosD.exe
  2⤵
  PID:7644
- C:\Windows\System\kEqJXFP.exe
  C:\Windows\System\kEqJXFP.exe
  2⤵
  PID:6760
- C:\Windows\System\jdmUEcB.exe
  C:\Windows\System\jdmUEcB.exe
  2⤵
  PID:7876
- C:\Windows\System\vIrLguJ.exe
  C:\Windows\System\vIrLguJ.exe
  2⤵
  PID:7736
- C:\Windows\System\UcWgCpL.exe
  C:\Windows\System\UcWgCpL.exe
  2⤵
  PID:7804
- C:\Windows\System\tazcqkH.exe
  C:\Windows\System\tazcqkH.exe
  2⤵
  PID:7908
- C:\Windows\System\ZAgJnao.exe
  C:\Windows\System\ZAgJnao.exe
  2⤵
  PID:7972
- C:\Windows\System\RDJQBBP.exe
  C:\Windows\System\RDJQBBP.exe
  2⤵
  PID:4720
- C:\Windows\System\CErdvPR.exe
  C:\Windows\System\CErdvPR.exe
  2⤵
  PID:8024
- C:\Windows\System\sEnJHXy.exe
  C:\Windows\System\sEnJHXy.exe
  2⤵
  PID:8040
- C:\Windows\System\LWEubkZ.exe
  C:\Windows\System\LWEubkZ.exe
  2⤵
  PID:8092
- C:\Windows\System\NvHHEjR.exe
  C:\Windows\System\NvHHEjR.exe
  2⤵
  PID:8212
- C:\Windows\System\WBOqHIS.exe
  C:\Windows\System\WBOqHIS.exe
  2⤵
  PID:8228
- C:\Windows\System\ACyEOVt.exe
  C:\Windows\System\ACyEOVt.exe
  2⤵
  PID:8244
- C:\Windows\System\AuBeVgC.exe
  C:\Windows\System\AuBeVgC.exe
  2⤵
  PID:8260
- C:\Windows\System\LuwonSE.exe
  C:\Windows\System\LuwonSE.exe
  2⤵
  PID:8276
- C:\Windows\System\oFsNUDF.exe
  C:\Windows\System\oFsNUDF.exe
  2⤵
  PID:8296
- C:\Windows\System\WfvBmxK.exe
  C:\Windows\System\WfvBmxK.exe
  2⤵
  PID:8312
- C:\Windows\System\VqCGQro.exe
  C:\Windows\System\VqCGQro.exe
  2⤵
  PID:8328
- C:\Windows\System\sPfdVLM.exe
  C:\Windows\System\sPfdVLM.exe
  2⤵
  PID:8344
- C:\Windows\System\nudsibW.exe
  C:\Windows\System\nudsibW.exe
  2⤵
  PID:8360
- C:\Windows\System\bwMHuZX.exe
  C:\Windows\System\bwMHuZX.exe
  2⤵
  PID:8376
- C:\Windows\System\MOItRJX.exe
  C:\Windows\System\MOItRJX.exe
  2⤵
  PID:8392
- C:\Windows\System\aDpxUdC.exe
  C:\Windows\System\aDpxUdC.exe
  2⤵
  PID:8408
- C:\Windows\System\JKMXVEe.exe
  C:\Windows\System\JKMXVEe.exe
  2⤵
  PID:8424
- C:\Windows\System\ZgrzjGX.exe
  C:\Windows\System\ZgrzjGX.exe
  2⤵
  PID:8440
- C:\Windows\System\PivTrfu.exe
  C:\Windows\System\PivTrfu.exe
  2⤵
  PID:8456
- C:\Windows\System\uuzBOts.exe
  C:\Windows\System\uuzBOts.exe
  2⤵
  PID:8472
- C:\Windows\System\iHQLKCy.exe
  C:\Windows\System\iHQLKCy.exe
  2⤵
  PID:8488
- C:\Windows\System\mCPlPew.exe
  C:\Windows\System\mCPlPew.exe
  2⤵
  PID:8504
- C:\Windows\System\sWAbjJA.exe
  C:\Windows\System\sWAbjJA.exe
  2⤵
  PID:8520
- C:\Windows\System\khywLhG.exe
  C:\Windows\System\khywLhG.exe
  2⤵
  PID:8536
- C:\Windows\System\UFHuqPZ.exe
  C:\Windows\System\UFHuqPZ.exe
  2⤵
  PID:8552
- C:\Windows\System\wmyDdOH.exe
  C:\Windows\System\wmyDdOH.exe
  2⤵
  PID:8568
- C:\Windows\System\kUJaNWc.exe
  C:\Windows\System\kUJaNWc.exe
  2⤵
  PID:8584
- C:\Windows\System\qdjMeRc.exe
  C:\Windows\System\qdjMeRc.exe
  2⤵
  PID:8600
- C:\Windows\System\fcFsqHn.exe
  C:\Windows\System\fcFsqHn.exe
  2⤵
  PID:8616
- C:\Windows\System\WIfiXyr.exe
  C:\Windows\System\WIfiXyr.exe
  2⤵
  PID:8636
- C:\Windows\System\YXqgjVH.exe
  C:\Windows\System\YXqgjVH.exe
  2⤵
  PID:8652
- C:\Windows\System\YJJDGyL.exe
  C:\Windows\System\YJJDGyL.exe
  2⤵
  PID:8668
- C:\Windows\System\nIxXjhA.exe
  C:\Windows\System\nIxXjhA.exe
  2⤵
  PID:8684
- C:\Windows\System\ZddIloj.exe
  C:\Windows\System\ZddIloj.exe
  2⤵
  PID:8700
- C:\Windows\System\ZRadQUF.exe
  C:\Windows\System\ZRadQUF.exe
  2⤵
  PID:8716
- C:\Windows\System\fmzMgvr.exe
  C:\Windows\System\fmzMgvr.exe
  2⤵
  PID:8732
- C:\Windows\System\nQcGxwc.exe
  C:\Windows\System\nQcGxwc.exe
  2⤵
  PID:8748
- C:\Windows\System\PfKRhDg.exe
  C:\Windows\System\PfKRhDg.exe
  2⤵
  PID:8768
- C:\Windows\System\oWvfkrL.exe
  C:\Windows\System\oWvfkrL.exe
  2⤵
  PID:8784
- C:\Windows\System\nIqktkl.exe
  C:\Windows\System\nIqktkl.exe
  2⤵
  PID:8800
- C:\Windows\System\DZyFIvd.exe
  C:\Windows\System\DZyFIvd.exe
  2⤵
  PID:8816
- C:\Windows\System\QARftEc.exe
  C:\Windows\System\QARftEc.exe
  2⤵
  PID:8832
- C:\Windows\System\HQqNZAN.exe
  C:\Windows\System\HQqNZAN.exe
  2⤵
  PID:8848
- C:\Windows\System\zilzmeK.exe
  C:\Windows\System\zilzmeK.exe
  2⤵
  PID:8864
- C:\Windows\System\ZOdLDsV.exe
  C:\Windows\System\ZOdLDsV.exe
  2⤵
  PID:8880
- C:\Windows\System\fJsYZME.exe
  C:\Windows\System\fJsYZME.exe
  2⤵
  PID:8896
- C:\Windows\System\qQRGTpw.exe
  C:\Windows\System\qQRGTpw.exe
  2⤵
  PID:8912
- C:\Windows\System\VNvAEUp.exe
  C:\Windows\System\VNvAEUp.exe
  2⤵
  PID:8928
- C:\Windows\System\OWCOTUW.exe
  C:\Windows\System\OWCOTUW.exe
  2⤵
  PID:8944
- C:\Windows\System\gweBFwu.exe
  C:\Windows\System\gweBFwu.exe
  2⤵
  PID:8960
- C:\Windows\System\Lxdbqpi.exe
  C:\Windows\System\Lxdbqpi.exe
  2⤵
  PID:8976
- C:\Windows\System\CqUbjWw.exe
  C:\Windows\System\CqUbjWw.exe
  2⤵
  PID:8992
- C:\Windows\System\viuJMRU.exe
  C:\Windows\System\viuJMRU.exe
  2⤵
  PID:9008
- C:\Windows\System\BhkJxVG.exe
  C:\Windows\System\BhkJxVG.exe
  2⤵
  PID:9024
- C:\Windows\System\zRgDIdM.exe
  C:\Windows\System\zRgDIdM.exe
  2⤵
  PID:9040
- C:\Windows\System\JhWDwUP.exe
  C:\Windows\System\JhWDwUP.exe
  2⤵
  PID:9056
- C:\Windows\System\RzsNsjq.exe
  C:\Windows\System\RzsNsjq.exe
  2⤵
  PID:9072
- C:\Windows\System\KUMadtL.exe
  C:\Windows\System\KUMadtL.exe
  2⤵
  PID:9088
- C:\Windows\System\XSDVnOt.exe
  C:\Windows\System\XSDVnOt.exe
  2⤵
  PID:9104
- C:\Windows\System\ZXJPrpr.exe
  C:\Windows\System\ZXJPrpr.exe
  2⤵
  PID:9120
- C:\Windows\System\avdtlJE.exe
  C:\Windows\System\avdtlJE.exe
  2⤵
  PID:9140
- C:\Windows\System\suWmMRA.exe
  C:\Windows\System\suWmMRA.exe
  2⤵
  PID:9156
- C:\Windows\System\ppKrAbV.exe
  C:\Windows\System\ppKrAbV.exe
  2⤵
  PID:9172
- C:\Windows\System\wQZzqoR.exe
  C:\Windows\System\wQZzqoR.exe
  2⤵
  PID:9188
- C:\Windows\System\mLBaWaQ.exe
  C:\Windows\System\mLBaWaQ.exe
  2⤵
  PID:8124
- C:\Windows\System\wtcYKPW.exe
  C:\Windows\System\wtcYKPW.exe
  2⤵
  PID:8052
- C:\Windows\System\pNoDaxn.exe
  C:\Windows\System\pNoDaxn.exe
  2⤵
  PID:7180
- C:\Windows\System\TqewDQN.exe
  C:\Windows\System\TqewDQN.exe
  2⤵
  PID:7276
- C:\Windows\System\SnYvuFi.exe
  C:\Windows\System\SnYvuFi.exe
  2⤵
  PID:7224
- C:\Windows\System\CrsqCdZ.exe
  C:\Windows\System\CrsqCdZ.exe
  2⤵
  PID:7312
- C:\Windows\System\oDihlLg.exe
  C:\Windows\System\oDihlLg.exe
  2⤵
  PID:8088
- C:\Windows\System\RHISDIa.exe
  C:\Windows\System\RHISDIa.exe
  2⤵
  PID:7348
- C:\Windows\System\Boetyyl.exe
  C:\Windows\System\Boetyyl.exe
  2⤵
  PID:8288
- C:\Windows\System\ahBBwcI.exe
  C:\Windows\System\ahBBwcI.exe
  2⤵
  PID:8352
- C:\Windows\System\oFjbYzn.exe
  C:\Windows\System\oFjbYzn.exe
  2⤵
  PID:8416
- C:\Windows\System\fAIUjRD.exe
  C:\Windows\System\fAIUjRD.exe
  2⤵
  PID:8480
- C:\Windows\System\ABVxhMi.exe
  C:\Windows\System\ABVxhMi.exe
  2⤵
  PID:8544
- C:\Windows\System\TbaJSSl.exe
  C:\Windows\System\TbaJSSl.exe
  2⤵
  PID:8608
- C:\Windows\System\wnEVpLM.exe
  C:\Windows\System\wnEVpLM.exe
  2⤵
  PID:8676
- C:\Windows\System\PFjKGab.exe
  C:\Windows\System\PFjKGab.exe
  2⤵
  PID:8740
- C:\Windows\System\lucLCKB.exe
  C:\Windows\System\lucLCKB.exe
  2⤵
  PID:8780
- C:\Windows\System\SaPRqEA.exe
  C:\Windows\System\SaPRqEA.exe
  2⤵
  PID:7724
- C:\Windows\System\rXFYQzb.exe
  C:\Windows\System\rXFYQzb.exe
  2⤵
  PID:8876
- C:\Windows\System\aXnhNaT.exe
  C:\Windows\System\aXnhNaT.exe
  2⤵
  PID:8940
- C:\Windows\System\UrarhuB.exe
  C:\Windows\System\UrarhuB.exe
  2⤵
  PID:9128
- C:\Windows\System\jZVSUxI.exe
  C:\Windows\System\jZVSUxI.exe
  2⤵
  PID:7612
- C:\Windows\System\QxQYRbL.exe
  C:\Windows\System\QxQYRbL.exe
  2⤵
  PID:7548
- C:\Windows\System\isrGAmF.exe
  C:\Windows\System\isrGAmF.exe
  2⤵
  PID:7940
- C:\Windows\System\TlltZLI.exe
  C:\Windows\System\TlltZLI.exe
  2⤵
  PID:9116
- C:\Windows\System\IZuRVHi.exe
  C:\Windows\System\IZuRVHi.exe
  2⤵
  PID:8108
- C:\Windows\System\LZgWQJg.exe
  C:\Windows\System\LZgWQJg.exe
  2⤵
  PID:8112
- C:\Windows\System\oKRIuvi.exe
  C:\Windows\System\oKRIuvi.exe
  2⤵
  PID:6972
- C:\Windows\System\ZIkAVVF.exe
  C:\Windows\System\ZIkAVVF.exe
  2⤵
  PID:4688
- C:\Windows\System\TkezUsQ.exe
  C:\Windows\System\TkezUsQ.exe
  2⤵
  PID:7296
- C:\Windows\System\eDqMDmv.exe
  C:\Windows\System\eDqMDmv.exe
  2⤵
  PID:8032
- C:\Windows\System\RiNxCPd.exe
  C:\Windows\System\RiNxCPd.exe
  2⤵
  PID:8208
- C:\Windows\System\kMspXPx.exe
  C:\Windows\System\kMspXPx.exe
  2⤵
  PID:8272
- C:\Windows\System\RbmDAKn.exe
  C:\Windows\System\RbmDAKn.exe
  2⤵
  PID:7888
- C:\Windows\System\jazooxE.exe
  C:\Windows\System\jazooxE.exe
  2⤵
  PID:8340
- C:\Windows\System\LYkixwK.exe
  C:\Windows\System\LYkixwK.exe
  2⤵
  PID:8432
- C:\Windows\System\sVwMjWc.exe
  C:\Windows\System\sVwMjWc.exe
  2⤵
  PID:7484
- C:\Windows\System\diQXhKe.exe
  C:\Windows\System\diQXhKe.exe
  2⤵
  PID:8500
- C:\Windows\System\bsAiotl.exe
  C:\Windows\System\bsAiotl.exe
  2⤵
  PID:8596
- C:\Windows\System\SYKDOtu.exe
  C:\Windows\System\SYKDOtu.exe
  2⤵
  PID:4736
- C:\Windows\System\SZTFCHB.exe
  C:\Windows\System\SZTFCHB.exe
  2⤵
  PID:8692
- C:\Windows\System\htkqSfV.exe
  C:\Windows\System\htkqSfV.exe
  2⤵
  PID:8760
- C:\Windows\System\kfqEscY.exe
  C:\Windows\System\kfqEscY.exe
  2⤵
  PID:7788
- C:\Windows\System\pUiGVWq.exe
  C:\Windows\System\pUiGVWq.exe
  2⤵
  PID:8856
- C:\Windows\System\teVcnCi.exe
  C:\Windows\System\teVcnCi.exe
  2⤵
  PID:8892
- C:\Windows\System\Vkxylui.exe
  C:\Windows\System\Vkxylui.exe
  2⤵
  PID:8952
- C:\Windows\System\kpGUSIZ.exe
  C:\Windows\System\kpGUSIZ.exe
  2⤵
  PID:9132
- C:\Windows\System\wzTJNie.exe
  C:\Windows\System\wzTJNie.exe
  2⤵
  PID:9052
- C:\Windows\System\WkWnxen.exe
  C:\Windows\System\WkWnxen.exe
  2⤵
  PID:9004
- C:\Windows\System\wUieYxg.exe
  C:\Windows\System\wUieYxg.exe
  2⤵
  PID:9036
- C:\Windows\System\MILRwQJ.exe
  C:\Windows\System\MILRwQJ.exe
  2⤵
  PID:9204
- C:\Windows\System\UDeZhma.exe
  C:\Windows\System\UDeZhma.exe
  2⤵
  PID:9152
- C:\Windows\System\iquoeSG.exe
  C:\Windows\System\iquoeSG.exe
  2⤵
  PID:8156
- C:\Windows\System\LXAaAnM.exe
  C:\Windows\System\LXAaAnM.exe
  2⤵
  PID:7152
- C:\Windows\System\ftUtrpF.exe
  C:\Windows\System\ftUtrpF.exe
  2⤵
  PID:8256
- C:\Windows\System\AvUeznb.exe
  C:\Windows\System\AvUeznb.exe
  2⤵
  PID:8384
- C:\Windows\System\TEKrrdJ.exe
  C:\Windows\System\TEKrrdJ.exe
  2⤵
  PID:8644
- C:\Windows\System\cZJOYhU.exe
  C:\Windows\System\cZJOYhU.exe
  2⤵
  PID:7640
- C:\Windows\System\woRBBSR.exe
  C:\Windows\System\woRBBSR.exe
  2⤵
  PID:8840
- C:\Windows\System\udTLYtf.exe
  C:\Windows\System\udTLYtf.exe
  2⤵
  PID:8224
- C:\Windows\System\EhlSUaq.exe
  C:\Windows\System\EhlSUaq.exe
  2⤵
  PID:8452
- C:\Windows\System\EagmsAi.exe
  C:\Windows\System\EagmsAi.exe
  2⤵
  PID:8712
- C:\Windows\System\hpThLBI.exe
  C:\Windows\System\hpThLBI.exe
  2⤵
  PID:8908
- C:\Windows\System\EFgdaKo.exe
  C:\Windows\System\EFgdaKo.exe
  2⤵
  PID:7532
- C:\Windows\System\XFFMvEX.exe
  C:\Windows\System\XFFMvEX.exe
  2⤵
  PID:7708
- C:\Windows\System\bQhqbYQ.exe
  C:\Windows\System\bQhqbYQ.exe
  2⤵
  PID:7372
- C:\Windows\System\vkanIpI.exe
  C:\Windows\System\vkanIpI.exe
  2⤵
  PID:7352
- C:\Windows\System\crdvnGo.exe
  C:\Windows\System\crdvnGo.exe
  2⤵
  PID:8176
- C:\Windows\System\VUWTWLV.exe
  C:\Windows\System\VUWTWLV.exe
  2⤵
  PID:8180
- C:\Windows\System\cYXRQHd.exe
  C:\Windows\System\cYXRQHd.exe
  2⤵
  PID:7328
- C:\Windows\System\aHrcWjg.exe
  C:\Windows\System\aHrcWjg.exe
  2⤵
  PID:8240
- C:\Windows\System\NBaSWcM.exe
  C:\Windows\System\NBaSWcM.exe
  2⤵
  PID:8308
- C:\Windows\System\HEewkTF.exe
  C:\Windows\System\HEewkTF.exe
  2⤵
  PID:7688
- C:\Windows\System\Bybxzsc.exe
  C:\Windows\System\Bybxzsc.exe
  2⤵
  PID:8592
- C:\Windows\System\ssmETki.exe
  C:\Windows\System\ssmETki.exe
  2⤵
  PID:8664
- C:\Windows\System\lfJbDzU.exe
  C:\Windows\System\lfJbDzU.exe
  2⤵
  PID:8532
- C:\Windows\System\tSRLKwJ.exe
  C:\Windows\System\tSRLKwJ.exe
  2⤵
  PID:8860
- C:\Windows\System\fDCJmZL.exe
  C:\Windows\System\fDCJmZL.exe
  2⤵
  PID:8888
- C:\Windows\System\cIfhCTj.exe
  C:\Windows\System\cIfhCTj.exe
  2⤵
  PID:8824
- C:\Windows\System\hkSOHZJ.exe
  C:\Windows\System\hkSOHZJ.exe
  2⤵
  PID:9032
- C:\Windows\System\NPlZdfE.exe
  C:\Windows\System\NPlZdfE.exe
  2⤵
  PID:9168
- C:\Windows\System\KPXyljM.exe
  C:\Windows\System\KPXyljM.exe
  2⤵
  PID:8000
- C:\Windows\System\JlNPsBI.exe
  C:\Windows\System\JlNPsBI.exe
  2⤵
  PID:8972
- C:\Windows\System\FjGhtHA.exe
  C:\Windows\System\FjGhtHA.exe
  2⤵
  PID:8844
- C:\Windows\System\lfQfOTq.exe
  C:\Windows\System\lfQfOTq.exe
  2⤵
  PID:8060
- C:\Windows\System\pZyNQOw.exe
  C:\Windows\System\pZyNQOw.exe
  2⤵
  PID:8220
- C:\Windows\System\PrgOVmN.exe
  C:\Windows\System\PrgOVmN.exe
  2⤵
  PID:9212
- C:\Windows\System\lMvedFv.exe
  C:\Windows\System\lMvedFv.exe
  2⤵
  PID:8580
- C:\Windows\System\QTuOEOD.exe
  C:\Windows\System\QTuOEOD.exe
  2⤵
  PID:7628
- C:\Windows\System\yyqXnQe.exe
  C:\Windows\System\yyqXnQe.exe
  2⤵
  PID:7512
- C:\Windows\System\rIRtKzI.exe
  C:\Windows\System\rIRtKzI.exe
  2⤵
  PID:7496
- C:\Windows\System\NZDozZz.exe
  C:\Windows\System\NZDozZz.exe
  2⤵
  PID:7388
- C:\Windows\System\CbDBFkw.exe
  C:\Windows\System\CbDBFkw.exe
  2⤵
  PID:8796
- C:\Windows\System\WVfOtpJ.exe
  C:\Windows\System\WVfOtpJ.exe
  2⤵
  PID:8036
- C:\Windows\System\DCJoQAB.exe
  C:\Windows\System\DCJoQAB.exe
  2⤵
  PID:7196
- C:\Windows\System\IoHRCCg.exe
  C:\Windows\System\IoHRCCg.exe
  2⤵
  PID:8564
- C:\Windows\System\WBNIyRK.exe
  C:\Windows\System\WBNIyRK.exe
  2⤵
  PID:9200
- C:\Windows\System\LAnZdBa.exe
  C:\Windows\System\LAnZdBa.exe
  2⤵
  PID:7516
- C:\Windows\System\ewqgwkf.exe
  C:\Windows\System\ewqgwkf.exe
  2⤵
  PID:8324
- C:\Windows\System\iNxQgaD.exe
  C:\Windows\System\iNxQgaD.exe
  2⤵
  PID:9068
- C:\Windows\System\hWMeucR.exe
  C:\Windows\System\hWMeucR.exe
  2⤵
  PID:6152
- C:\Windows\System\gWFTFoZ.exe
  C:\Windows\System\gWFTFoZ.exe
  2⤵
  PID:8660
- C:\Windows\System\JttUxvS.exe
  C:\Windows\System\JttUxvS.exe
  2⤵
  PID:8200
- C:\Windows\System\CAlcXJC.exe
  C:\Windows\System\CAlcXJC.exe
  2⤵
  PID:9136
- C:\Windows\System\rOyGXql.exe
  C:\Windows\System\rOyGXql.exe
  2⤵
  PID:9020
- C:\Windows\System\uBkwkvE.exe
  C:\Windows\System\uBkwkvE.exe
  2⤵
  PID:7768
- C:\Windows\System\DnwwjrX.exe
  C:\Windows\System\DnwwjrX.exe
  2⤵
  PID:8204
- C:\Windows\System\XtrMZes.exe
  C:\Windows\System\XtrMZes.exe
  2⤵
  PID:7240
- C:\Windows\System\NtqJNyZ.exe
  C:\Windows\System\NtqJNyZ.exe
  2⤵
  PID:8528
- C:\Windows\System\xQhMwCA.exe
  C:\Windows\System\xQhMwCA.exe
  2⤵
  PID:9112
- C:\Windows\System\FwQpdjj.exe
  C:\Windows\System\FwQpdjj.exe
  2⤵
  PID:9232
- C:\Windows\System\lGmPunP.exe
  C:\Windows\System\lGmPunP.exe
  2⤵
  PID:9252
- C:\Windows\System\jDFhiVw.exe
  C:\Windows\System\jDFhiVw.exe
  2⤵
  PID:9268
- C:\Windows\System\kribIuJ.exe
  C:\Windows\System\kribIuJ.exe
  2⤵
  PID:9284
- C:\Windows\System\icYNiWJ.exe
  C:\Windows\System\icYNiWJ.exe
  2⤵
  PID:9300
- C:\Windows\System\BvLqjbJ.exe
  C:\Windows\System\BvLqjbJ.exe
  2⤵
  PID:9316
- C:\Windows\System\pdGuNfH.exe
  C:\Windows\System\pdGuNfH.exe
  2⤵
  PID:9332
- C:\Windows\System\VACqynq.exe
  C:\Windows\System\VACqynq.exe
  2⤵
  PID:9348
- C:\Windows\System\hDJSEJz.exe
  C:\Windows\System\hDJSEJz.exe
  2⤵
  PID:9364
- C:\Windows\System\XJMKuWI.exe
  C:\Windows\System\XJMKuWI.exe
  2⤵
  PID:9380
- C:\Windows\System\uRdTJNg.exe
  C:\Windows\System\uRdTJNg.exe
  2⤵
  PID:9400
- C:\Windows\System\YCPioTE.exe
  C:\Windows\System\YCPioTE.exe
  2⤵
  PID:9416
- C:\Windows\System\jfhmixN.exe
  C:\Windows\System\jfhmixN.exe
  2⤵
  PID:9432
- C:\Windows\System\bhRihqo.exe
  C:\Windows\System\bhRihqo.exe
  2⤵
  PID:9448
- C:\Windows\System\NxsegTX.exe
  C:\Windows\System\NxsegTX.exe
  2⤵
  PID:9464
- C:\Windows\System\aXxbwaf.exe
  C:\Windows\System\aXxbwaf.exe
  2⤵
  PID:9480
- C:\Windows\System\wDFjXcN.exe
  C:\Windows\System\wDFjXcN.exe
  2⤵
  PID:9496
- C:\Windows\System\pTlTtGO.exe
  C:\Windows\System\pTlTtGO.exe
  2⤵
  PID:9512
- C:\Windows\System\RFLUUly.exe
  C:\Windows\System\RFLUUly.exe
  2⤵
  PID:9528
- C:\Windows\System\KbOQoBg.exe
  C:\Windows\System\KbOQoBg.exe
  2⤵
  PID:9544
- C:\Windows\System\LwvohYl.exe
  C:\Windows\System\LwvohYl.exe
  2⤵
  PID:9560
- C:\Windows\System\hngDEJI.exe
  C:\Windows\System\hngDEJI.exe
  2⤵
  PID:9576
- C:\Windows\System\oLoPnyB.exe
  C:\Windows\System\oLoPnyB.exe
  2⤵
  PID:9592
- C:\Windows\System\kSJOBUF.exe
  C:\Windows\System\kSJOBUF.exe
  2⤵
  PID:9608
- C:\Windows\System\PVpKkQK.exe
  C:\Windows\System\PVpKkQK.exe
  2⤵
  PID:9628
- C:\Windows\System\GsqEQjL.exe
  C:\Windows\System\GsqEQjL.exe
  2⤵
  PID:9644
- C:\Windows\System\utYABTZ.exe
  C:\Windows\System\utYABTZ.exe
  2⤵
  PID:9660
- C:\Windows\System\LxJNwdq.exe
  C:\Windows\System\LxJNwdq.exe
  2⤵
  PID:9676
- C:\Windows\System\pQPYpRd.exe
  C:\Windows\System\pQPYpRd.exe
  2⤵
  PID:9692
- C:\Windows\System\uJSdQZz.exe
  C:\Windows\System\uJSdQZz.exe
  2⤵
  PID:9708
- C:\Windows\System\sGicLiR.exe
  C:\Windows\System\sGicLiR.exe
  2⤵
  PID:9724
- C:\Windows\System\tHJfAKO.exe
  C:\Windows\System\tHJfAKO.exe
  2⤵
  PID:9740
- C:\Windows\System\CHvUYGp.exe
  C:\Windows\System\CHvUYGp.exe
  2⤵
  PID:9756
- C:\Windows\System\xbfHGPi.exe
  C:\Windows\System\xbfHGPi.exe
  2⤵
  PID:9772
- C:\Windows\System\rNRcjqn.exe
  C:\Windows\System\rNRcjqn.exe
  2⤵
  PID:9788
- C:\Windows\System\SnUXGSW.exe
  C:\Windows\System\SnUXGSW.exe
  2⤵
  PID:9804
- C:\Windows\System\oTbnHiS.exe
  C:\Windows\System\oTbnHiS.exe
  2⤵
  PID:9820
- C:\Windows\System\reRIrEX.exe
  C:\Windows\System\reRIrEX.exe
  2⤵
  PID:9836
- C:\Windows\System\RVnXMRt.exe
  C:\Windows\System\RVnXMRt.exe
  2⤵
  PID:9852
- C:\Windows\System\EVeRMqg.exe
  C:\Windows\System\EVeRMqg.exe
  2⤵
  PID:9868
- C:\Windows\System\xnpPvhE.exe
  C:\Windows\System\xnpPvhE.exe
  2⤵
  PID:9888
- C:\Windows\System\mhMHJeO.exe
  C:\Windows\System\mhMHJeO.exe
  2⤵
  PID:9904
- C:\Windows\System\REUgxQX.exe
  C:\Windows\System\REUgxQX.exe
  2⤵
  PID:9920
- C:\Windows\System\kKWRSht.exe
  C:\Windows\System\kKWRSht.exe
  2⤵
  PID:9936
- C:\Windows\System\EXZdeTQ.exe
  C:\Windows\System\EXZdeTQ.exe
  2⤵
  PID:9956
- C:\Windows\System\ZrtDOMq.exe
  C:\Windows\System\ZrtDOMq.exe
  2⤵
  PID:9972
- C:\Windows\System\zxPdavu.exe
  C:\Windows\System\zxPdavu.exe
  2⤵
  PID:9988
- C:\Windows\System\iiOSsEf.exe
  C:\Windows\System\iiOSsEf.exe
  2⤵
  PID:10004
- C:\Windows\System\LApbjrl.exe
  C:\Windows\System\LApbjrl.exe
  2⤵
  PID:10020
- C:\Windows\System\DbzDojq.exe
  C:\Windows\System\DbzDojq.exe
  2⤵
  PID:10036
- C:\Windows\System\JzEZdMz.exe
  C:\Windows\System\JzEZdMz.exe
  2⤵
  PID:10052
- C:\Windows\System\ZktbPIQ.exe
  C:\Windows\System\ZktbPIQ.exe
  2⤵
  PID:10068
- C:\Windows\System\mWMmvBn.exe
  C:\Windows\System\mWMmvBn.exe
  2⤵
  PID:10084
- C:\Windows\System\UkCpDhO.exe
  C:\Windows\System\UkCpDhO.exe
  2⤵
  PID:10100
- C:\Windows\System\JwloqjZ.exe
  C:\Windows\System\JwloqjZ.exe
  2⤵
  PID:10120
- C:\Windows\System\UiLZEIH.exe
  C:\Windows\System\UiLZEIH.exe
  2⤵
  PID:10136
- C:\Windows\System\etXugWp.exe
  C:\Windows\System\etXugWp.exe
  2⤵
  PID:10152
- C:\Windows\System\wFaXzfr.exe
  C:\Windows\System\wFaXzfr.exe
  2⤵
  PID:10168
- C:\Windows\System\NvodEPi.exe
  C:\Windows\System\NvodEPi.exe
  2⤵
  PID:10200
- C:\Windows\System\hbABTgB.exe
  C:\Windows\System\hbABTgB.exe
  2⤵
  PID:10216
- C:\Windows\System\KvozgdD.exe
  C:\Windows\System\KvozgdD.exe
  2⤵
  PID:10232
- C:\Windows\System\HMgGDLx.exe
  C:\Windows\System\HMgGDLx.exe
  2⤵
  PID:8624
- C:\Windows\System\AWyKnNX.exe
  C:\Windows\System\AWyKnNX.exe
  2⤵
  PID:7984
- C:\Windows\System\hpvpSxn.exe
  C:\Windows\System\hpvpSxn.exe
  2⤵
  PID:8904
- C:\Windows\System\lrqvCTU.exe
  C:\Windows\System\lrqvCTU.exe
  2⤵
  PID:9276
- C:\Windows\System\PuGflCF.exe
  C:\Windows\System\PuGflCF.exe
  2⤵
  PID:9292
- C:\Windows\System\VLShSsR.exe
  C:\Windows\System\VLShSsR.exe
  2⤵
  PID:9340
- C:\Windows\System\rEzcGLP.exe
  C:\Windows\System\rEzcGLP.exe
  2⤵
  PID:9360
- C:\Windows\System\twvaLKU.exe
  C:\Windows\System\twvaLKU.exe
  2⤵
  PID:9428
- C:\Windows\System\QpMbnBD.exe
  C:\Windows\System\QpMbnBD.exe
  2⤵
  PID:9492
- C:\Windows\System\OfCLFlt.exe
  C:\Windows\System\OfCLFlt.exe
  2⤵
  PID:9556
- C:\Windows\System\VfCuOKZ.exe
  C:\Windows\System\VfCuOKZ.exe
  2⤵
  PID:9444
- C:\Windows\System\ndRfWXI.exe
  C:\Windows\System\ndRfWXI.exe
  2⤵
  PID:9536
- C:\Windows\System\ogboDPN.exe
  C:\Windows\System\ogboDPN.exe
  2⤵
  PID:9652
- C:\Windows\System\aMXISwP.exe
  C:\Windows\System\aMXISwP.exe
  2⤵
  PID:9568
- C:\Windows\System\XtJpVhJ.exe
  C:\Windows\System\XtJpVhJ.exe
  2⤵
  PID:9640
- C:\Windows\System\baslOiF.exe
  C:\Windows\System\baslOiF.exe
  2⤵
  PID:9624
- C:\Windows\System\yJQNsvc.exe
  C:\Windows\System\yJQNsvc.exe
  2⤵
  PID:9720
- C:\Windows\System\lEgdiVG.exe
  C:\Windows\System\lEgdiVG.exe
  2⤵
  PID:9736
- C:\Windows\System\AxLyDLZ.exe
  C:\Windows\System\AxLyDLZ.exe
  2⤵
  PID:9784
- C:\Windows\System\pwPYUzM.exe
  C:\Windows\System\pwPYUzM.exe
  2⤵
  PID:9828
- C:\Windows\System\LCQUrhM.exe
  C:\Windows\System\LCQUrhM.exe
  2⤵
  PID:9844
- C:\Windows\System\dhceAgx.exe
  C:\Windows\System\dhceAgx.exe
  2⤵
  PID:9860
- C:\Windows\System\bnLCPfi.exe
  C:\Windows\System\bnLCPfi.exe
  2⤵
  PID:9884
- C:\Windows\System\PtqTypb.exe
  C:\Windows\System\PtqTypb.exe
  2⤵
  PID:9952
- C:\Windows\System\cKoSaky.exe
  C:\Windows\System\cKoSaky.exe
  2⤵
  PID:9984
- C:\Windows\System\tluWyhA.exe
  C:\Windows\System\tluWyhA.exe
  2⤵
  PID:10048
- C:\Windows\System\RZtIykR.exe
  C:\Windows\System\RZtIykR.exe
  2⤵
  PID:10176
- C:\Windows\System\YWWkzGq.exe
  C:\Windows\System\YWWkzGq.exe
  2⤵
  PID:10108
- C:\Windows\System\UbQAqhK.exe
  C:\Windows\System\UbQAqhK.exe
  2⤵
  PID:9968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DVohDof.exe

Filesize
1.9MB

MD5
64a5c59fe1ee54c181a5e3d446461aeb

SHA1
c279f0c1e828c62327aba90674ae9a4ccd57ba0e

SHA256
f1af161d29dccf7bb461a65f3012f27e764ad457274fba07b63bc1a512937291

SHA512
a504edacd45ac6ef4f1c6aadf591bbbd1ad3cd818c7af93eae23f8c0c2f3c858e306026908f35b8d4f2f458558339f54b01bfc02c1ccf746891a2e1fc058a91f

Download Submit
C:\Windows\system\DnbstEu.exe

Filesize
1.8MB

MD5
85dacdb5e04b53f34469a1d6383a2912

SHA1
8b05363d7207ecec70052f0f52c5c2e4e2041ecd

SHA256
6482430d0549e2850814a588f4f1f7743162399d1d438a2c4a18e6864490e61a

SHA512
90253528bee0fe445238c42ee59855787088ad44e072514e7c020ca10a7ab52bde241668fae91fad9ff362b678d57526dc816dfcf01ce771be971f909943020d

Download Submit
C:\Windows\system\Dujmbcj.exe

Filesize
1.9MB

MD5
23d517c70214f47df16a27e5486a52ae

SHA1
aa72918a2f1737831e1927e3f6caaa760d6e50e5

SHA256
5d30aac985f6f9bb247e2a66ce44be262a0bf2585bfa74f5cbe2a0d4564c18a0

SHA512
26accbbe8119271a530434c7b4e50779a4f1ddb319ec82eb00e6fe23fd5b309af7ec4b65df43a832fa2dccf537c47b23b538c544fe8c5eb03153d5910701a951

Download Submit
C:\Windows\system\FNwadrv.exe

Filesize
1.8MB

MD5
da37f2ff95b09cbd23c4787087d600f5

SHA1
05c5ab6e1492ed59fd12035787ac65d4a300369e

SHA256
c07f5d3629b5293ffe142147250202074a6e39c50e24efd76446d48439f77a75

SHA512
4caa0d180f216b16df0e2ae49e7ede02bb84e6204b4e6917349dfcd7135a1a5dad848259f0f1387ea8c71227c8e23dc7f35cb73e25e17cf0f8af307277df0ca3

Download Submit
C:\Windows\system\GHLFtFU.exe

Filesize
1.8MB

MD5
c67c068fb1b48057b4989158ec8118db

SHA1
50462905e8cb3507988e6719ac6cda87ee840953

SHA256
dab8b6526ad9a59708690f8358e470eedab84c713be90b3ed16fe88d9b3b7d85

SHA512
de31b40667949631f0188a53b50c7d741550eb352f62c52b4bf0115359650df279b4317ade3a03348caf85a2e4a1c226628bcc0298590db735ea28f8e841d364

Download Submit
C:\Windows\system\IsIHqKh.exe

Filesize
1.9MB

MD5
c7becd546df69725d19a096f08fa843e

SHA1
ec00cbbebe817d1f19f7c56d5130170fa5c0f04a

SHA256
3fe2aa1e434320fa07a7dc9b9cbbbe427ba083d2edebbd53978f42f7a7709f47

SHA512
9c08be2e627e54cb2caab3419fff7338c471f65f2c4e0b149f6b44ebe987442590744c154757f316248f5e3cd50ed59f1de4c9bc7d69f4eb42cc5fc96b71ec73

Download Submit
C:\Windows\system\MmlrpEE.exe

Filesize
1.8MB

MD5
755a8333bcf27ca9aaa26a341417d2a9

SHA1
3bac76274299771abaf62bc0bbfb4adc74f04e5a

SHA256
ff741d325a01e0d4125fac07807a4db5d25d2f97beaf669798a40e14ea3a30af

SHA512
15f437a6d985e4f8ad9b303b46c420a914f98849cb99454fd1386c01f7b27d26c59dfaa8da95c200ee08828ec52239580698e81382112c4dba0e56cad7a5d150

Download Submit
C:\Windows\system\MwywiRw.exe

Filesize
1.8MB

MD5
600f1394b6e044a2bf4afe582db52aa0

SHA1
6a3b79efbca62c8d19b7f8d45671781202794df1

SHA256
20b881e8084e7d5a3a57fdbf17572bcaab16b8f1697b8ea3f444f58e39d0fd74

SHA512
353db8125a00ea17518470ed1de1cb271043dd38379d2a274ec426f47aa13480b8b155af23f08aa051175e01dc44a1608558de866a0d34b3dba04e3a1bbee3c3

Download Submit
C:\Windows\system\RuWCFOc.exe

Filesize
1.8MB

MD5
4b28cf04b35322789ff7e6f1831e1f0b

SHA1
d330ac040fccc6cee71fbc0c29f07ee4f39224db

SHA256
1d04fdafa88b00e99bd20495b20585daca1a967dd846e21a0ccc39299fd69274

SHA512
3e30696e4e13345551e6c002d6470d77a5a29a97cb743eb861277b0cc1386d32c101c358133d84feaa72849d0a06360be82f10a17f74e13d9b17de3548872934

Download Submit
C:\Windows\system\axxjxWb.exe

Filesize
1.9MB

MD5
2f557605f91082a47501b1f15fb58c2e

SHA1
cffa73c241db34b8efc13c584ebf7cc159930e42

SHA256
c8cd129d4950357558a08ccff0db41036c6af0432be530b0085d7012bd44a132

SHA512
3a05ce7b7b69b5ed3d3b71f221e7f126a0396a29099923db6f3e96a523ba10f360f11f17a23a8283637420dac55636946a8886d7297659ae42ec23eca6c75c3e

Download Submit
C:\Windows\system\bbGavTv.exe

Filesize
1.8MB

MD5
26e054ac818dec089c43757848c8f022

SHA1
8a37674ad9a13ddf0ea4002d74b0b39cef779dd7

SHA256
293300c6ec4e26c096435ec39a7f7ba6fed065a54b96c9ede762095d1b0d85b7

SHA512
4d58e566acaa4b192d335b4c9df2df3b459db087169260c8ccf0679567dd66d2fdfe78da25e59a5c03fa5bcc04fa8e337952effc979872befb52d64553074e35

Download Submit
C:\Windows\system\dqfPDtO.exe

Filesize
1.8MB

MD5
123bdac34e2be997cb4046c3f5b7adf0

SHA1
e95dc942b94d3bfb895671fb29fd9991d8738bc2

SHA256
6b75afa765a71497c803a18e15dcbfe0464d7136fff0a46a2579a3a924379fe4

SHA512
cb3c93618f3eb6cc96b17b8559af37fe8bb1c5b8978f8553b5f9517c9a8762097a53f23ffd6dfbee6368c22152636d85c70d4dc359f7de9637959fbf81fc2b8c

Download Submit
C:\Windows\system\gozDwbN.exe

Filesize
1.8MB

MD5
299daad2487d2cef7516d0b483aab886

SHA1
b6384fce6bc551ffcfeb7a42bd9459b5549f3341

SHA256
d5eb026a7345acc1f7448954fd7f59454f56140cc9d69c0013c6748552f64a23

SHA512
81dc8bc9d059414666309f5822fac9931be600fb85418c496a2831032598b9c4a9d1eabc1656f1f966d599bacc4eaba0a80487d5a1db6f3defc72b78feeed57d

Download Submit
C:\Windows\system\hQTaqKy.exe

Filesize
1.8MB

MD5
e9aa1d1e2bee6a6b5cc87283d5240f27

SHA1
cb520cfac26915071a69f70d5ada27ed8a993d0d

SHA256
d2fafe1ea79d0e5388dd84f5d24a961e6a654e1efdbe8249dfccfcbee9e18e2b

SHA512
3ec1de007b41b82a611b0be5b08704489afeb0f2839046039036475ce45ab02e32bd1b7f80b40d483dd8765ec3e21d0e342cc20fa59b32d2f325151c0f8eeda5

Download Submit
C:\Windows\system\kOFoJhL.exe

Filesize
1.9MB

MD5
129a6cae89935aec273856a3c78a9d32

SHA1
3e5cbe9293921927fcfb7a60d151799e08e43c70

SHA256
141b248cdeda3e617fbc2dec7a34df20b99c53ba26c936518e0ed474d9a47962

SHA512
d96478c7dfbfb41552ead95cb0d811c32acab3576dad1c011d55e282e6c45a334c51cad4269dec68178e7055e5145defb0655264fe315c180c30c4227fd03f95

Download Submit
C:\Windows\system\kcwNQzI.exe

Filesize
1.8MB

MD5
ee29e645339e3ef9244ed36d69f6ab1f

SHA1
9afd460aa5ecf4458cedc688949cbc247d30f4b8

SHA256
bac36782b2aceab95a60a9ae67cec19bbcaf91851d705fb4fd6359547911bcb0

SHA512
04190033c72ddb4f3614e9328ad643bca49d42162d1653bda2d28291d6bb9ce8ff46a7555568a23200ea1205efd2ce60a0b7c24b483ec8424e32dc629f123981

Download Submit
C:\Windows\system\mPztXqG.exe

Filesize
1.8MB

MD5
394743393ed535f1fc454e241abd45e2

SHA1
37fa26f975bf8b1469b45a2bc83d6ebdbc9c2224

SHA256
a193fa10c4d05f5b5eae672b26b6bde41b9a5f2eaa4a713c867fe9868498bf10

SHA512
a7173f52379ecc5c8dfa5aba566641216c61bf85218ee287b872d9e95bdba2a125a270d69f93bd848efbcefc907ec4035ebd96b7197817c4574c2f42f384207d

Download Submit
C:\Windows\system\nTjwTzP.exe

Filesize
1.9MB

MD5
18bf10f23429b8b8dd00e4684d7b0ef8

SHA1
6854af2e7b973cc74837a1586c7476b7fcff04aa

SHA256
6ee409505400b40a1fc506fae5089f050f45c3f62c0e13e493645def89ec2ea1

SHA512
f6ae97744c83697f8391de500e9a0bfebabf67d14b920cbedb23774aae8bbaa6f4b9c8f992714763efd6299644ef708d8d97137f5eb85452a19ca52c4c8e5e2d

Download Submit
C:\Windows\system\nmJROdv.exe

Filesize
1.8MB

MD5
ca9d80d0b0446a8739c3e9773b631df4

SHA1
cd24844a13ac712f95a98a1439b29055e5fabb3c

SHA256
4603d5a7ce021b6cdc83f9dc74308ece2c97fe1e97c0b574ada4be9b1594193c

SHA512
5da5d096ed5a8dd2a7b429e2727fbf76ae1699c6729f94f355c0a9c4bb2772045130f56adb77b3d4f2f82af15079a06b699078a5efd6b3051278370193b4de7e

Download Submit
C:\Windows\system\nsDMnaB.exe

Filesize
1.9MB

MD5
4990f4622f3c027554fed51d7e393341

SHA1
7c97e96316a8f56258307234118f33479fc41315

SHA256
da12eaa0458b7df36fb0905f5646b029385d3d13cfde4f1da8f8747f69580c95

SHA512
a64d6811d1bbe5482eebb7c367d7b073964270d26b06421379feb241853aa874b525564520c7d9e05aecc0d191fe9b7dda50c4ac00e57e7f4bc581bd9b406419

Download Submit
C:\Windows\system\oDnhnCD.exe

Filesize
1.9MB

MD5
1e65901a92f4dc0fb32346f2309f2838

SHA1
91f1874b2228ca1cb7f14c24331dd5bb4ac8d4c6

SHA256
dbccabf052e48d0b748af0ba6db2be43b1779fe7853a88d2fc009083a267e54b

SHA512
0404dada97792c336f58420ff384ca975230ba4b74764d87c7a49769ac21c3423cc64ddd6e4f0e2c4b7aa6b3011c8666227b6cecd9381a90db589883b7f3344f

Download Submit
C:\Windows\system\thfUJOd.exe

Filesize
1.8MB

MD5
dee024bd649925a2c82195a74bb90a56

SHA1
767dbf9b3077eb134fa9fa7a6e24187bdfffbfbd

SHA256
9ed8d75393a4e71438aee4e3a14cd3933ec3ff7e480545c5caf5775ec216b206

SHA512
27c640083d1d6e20eb08861052fdcfde4de693ab674023ec07ae77915b8fe8d091baf3af17b1f420b2d7c106a6460797e3cb20fa0008d5b22fbcdd9b19713115

Download Submit
C:\Windows\system\wSyElWa.exe

Filesize
1.8MB

MD5
7b82d7c81bc53bfe72b835cc4a4c81d6

SHA1
e5ee476c9f4cafa0ff14a65c023fc4d15077b55c

SHA256
e596bd3db10d64979b44d9e2652157fcc8e5ccbc64aa44d62cfd5da210f7f9f2

SHA512
ffacb849091c88bdc6635b004eaf8d9808c957b57f02594330769dc72d818a09f8f223ba64eb2097acfd364d35067337eea0c2a065154713aef29866fe0f4eb5

Download Submit
C:\Windows\system\xEfBPZy.exe

Filesize
1.8MB

MD5
b3ab6a0e9e41630419e75d168974234f

SHA1
faea0931a3678b03a87f40b3c64d80701e67f73a

SHA256
91cf984c4be2cd6c4653d5a9e83173804f529c624f4408e2338367854a171bfa

SHA512
fb0c47f5c20eb213c3f290c8142bf7541746c48c424a05191b8bafccd638a68cdac6f82faab27b1ec92a2520cb906548825b330de517bd702bfd46836159ccb6

Download Submit
C:\Windows\system\xJFVBhO.exe

Filesize
1.8MB

MD5
9de911dd557a52493d109fc2847084d0

SHA1
a029b1c4146425c21c5ab92be319e07b16fae85f

SHA256
69568fcfb0ff3d4f4d43c7c50af57b612753463944f69941a738930137f6e006

SHA512
cd73c336ef988548da9b445f08b283e0d2d5c22afbf5b0a54276ca8ac4f11efd3daeab0c4013fb54f145a2483cd00eb47a4887c303a331c39f12cab9ab28942d

Download Submit
C:\Windows\system\yBfWMCf.exe

Filesize
1.9MB

MD5
c78fa4c44757caf2ba997aff900324d5

SHA1
67e199a0b1001c2eb93b0aa4aff7326bfa26977f

SHA256
961db8261a8e6a5b4fe017b1b7edd405c760f5ce8d8175da9cf88104942fb128

SHA512
50a4503b820272b5c9c069467d97a5e531666b4d280c0615f96a79eaba1776d7a93b427b22fe98dc88c22904cd616899e12f119fb967b60db56f2d6e7779bfbd

Download Submit
C:\Windows\system\yfNVmlT.exe

Filesize
1.9MB

MD5
8370ca75ed4bf6f37ea97c3499acc5a4

SHA1
46d1606b584fb148e4c2354a93baffb33ac38097

SHA256
7fe96208ecc1957d636930557e3408ad7b4c58fdcb47b25d5b80517a332ed4b1

SHA512
3911e042bef7478bd7574759bd402ffbb28a6eabaae6fdd184aee15316d618d5ff4fc5e2b465baf5318b86296d040550b1ca0a2c80d5a2bb2c85bc4efd215157

Download Submit
C:\Windows\system\zhKaPti.exe

Filesize
1.8MB

MD5
bdc3e2d8078878207ce444456cd331b0

SHA1
98aaf2abfa0eab35b1d95c2dcbab4f5f22e47db1

SHA256
4ae4a469c055ca97cd175a4f51395b4b62c15cf57eae476eefa3e5090beae574

SHA512
dd9438e0453f5d711009181106c3049f0281755b955e10b86b5dfccf521d0edaafab9ab9b14c982169a1afa12ce35321e32d2226be9e9e72cb41d64355e2b71c

Download Submit
\Windows\system\QyrWAes.exe

Filesize
1.8MB

MD5
f7716184b5506316cd7f2d218550a02a

SHA1
ca187266370916f4918039713d1bb9a825d35fb7

SHA256
54705c9fdc2596c702599f61ad0040d1ab3b193d531326032fe7988d083255b6

SHA512
d26b092dbf9c871d3cdbc43d943c898c52e33008a197f2c55333871258264b9ab892c050dc70080d43848a666c7136121be8c65fb7c1d6552d1ed927b430c160

Download Submit
\Windows\system\VlahsCs.exe

Filesize
1.8MB

MD5
cfdd69474d904262df691311c2493bd6

SHA1
daaebb5c17eae9e89c7d2b1b8cbbc05c752dc2d6

SHA256
3e1009bc43a546e4bc0168d3caec772a83c0921a759e2a8854764bae4269f3ee

SHA512
ded63149a485e0ee8597f8d04771e742f986ca2c8fe01b2cf14664155d89b4045a533ba5ec7aa6ff4189356912a480f23709e1d3fd89604c390c42daddafd54d

Download Submit
\Windows\system\VqtOsNl.exe

Filesize
1.8MB

MD5
64e25aa8482456a96ed5ef2457424cb2

SHA1
56962857b6b14f4580117b61c2fd31063e4f7568

SHA256
a38f34599ace0710b9b0182510e879f52a9d39c4526c9c618190b77818f6c22a

SHA512
9d67f6ced076c98288d0843044c6d699f02e546dc927c85eb597f63d3a29374fe8efc1f07fd9f7a69a61f9a4318d9cc4c7de14b9a938d61edfb5f6e38d930c23

Download Submit
\Windows\system\cntZriR.exe

Filesize
1.8MB

MD5
2799b5b5878a0fe66d7b041a4918b6f6

SHA1
b035b5a21eb54ee36498a85301d529b142884071

SHA256
9a993957aca567363666fc5cce7ee110a5bfac4ae7ccfc3f5dabd60326766423

SHA512
431b2e1844bd892a20acdfac61500d049e93e0fe1d2a09f2015ce7d13b4d86a70361d4311e8f961f56f4e73961f8ad094b86830fdd2a0833fbcd39c2e1c185cb

Download Submit
memory/2204-622-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2204-624-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-1-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/2204-629-0x0000000002B70000-0x0000000002F62000-memory.dmp

Filesize
3.9MB

Download
memory/2204-632-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2204-637-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2204-12-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-627-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2204-634-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-0-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2204-614-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-615-0x0000000002B70000-0x0000000002F62000-memory.dmp

Filesize
3.9MB

Download
memory/2260-621-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2328-1026-0x0000000002170000-0x0000000002178000-memory.dmp

Filesize
32KB

Download
memory/2328-985-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/2344-628-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2444-635-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2452-625-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-616-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2588-623-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2592-630-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-620-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-633-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2648-618-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2928-636-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/3040-619-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download