xmrig | 89aa2636f404da59eec024847eea871b053e67d3e21d7362dee09713d36a895a

Analysis

max time kernel
38s
max time network
38s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
Size

2.2MB
MD5

0a7bf12090cbd5142c9ecb87828cc52b
SHA1

75909b29d47db6a28ff91af018973145ccbd1cfb
SHA256

89aa2636f404da59eec024847eea871b053e67d3e21d7362dee09713d36a895a
SHA512

3810c4fd7811b3336847ac6af4cc351e548f91721c34199cdef9bd7226d257f2941f22d535b02a32542c48646fe83f24cd562fb3ea185a1834b943dae05ae750
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cRbR:NAB7

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 3 IoCs

miner

resource	yara_rule
behavioral1/memory/2104-68-0x0000000003130000-0x0000000003522000-memory.dmp	xmrig
behavioral1/memory/1576-67-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2756-12-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2756	BrgIfPE.exe
3060	MeFYVTe.exe
2656	BUbXRFM.exe
2744	zWPadzD.exe
2748	faGRemw.exe
2792	famnMKm.exe
2736	aTNEjmI.exe
1576	cFUZzjH.exe
2440	IQCHwwM.exe
2608	glFnrVR.exe
2760	dQtaJnZ.exe
2708	VDGGdcZ.exe
1556	gWDnyKs.exe
2788	cAloXfm.exe
1448	dqnGLkl.exe
2496	HzPYjqd.exe
2524	ZNCCvxb.exe
1336	DsPggNs.exe
1260	JzLKiwy.exe
2804	jbAjFPw.exe
2056	TfFlTuj.exe
2404	GqHRRyB.exe
2092	DmzBOKd.exe
1144	FJQGUYR.exe
1480	FjnWoMI.exe
1784	nigFFPe.exe
884	eHHrOpW.exe
2384	KMKMwsB.exe
1536	ibkqZms.exe
1544	rkafCKM.exe
1864	pNdCtBk.exe
1976	eUzQUNy.exe
612	IfUMeIx.exe
1252	GZgHFuc.exe
2000	RwMGyxN.exe
1676	xboVypm.exe
1028	loEDMDV.exe
876	tCpArKx.exe
2412	oSXojqC.exe
1720	jXwVuHV.exe
2156	bVBZYxk.exe
2868	xFIThJE.exe
1860	QzASsgF.exe
2060	MJJRuJR.exe
2984	BQnQPbb.exe
1800	rAqElre.exe
1292	xrMgdaW.exe
1452	MgslTMl.exe
1852	GeOWkrg.exe
988	aGHaDlY.exe
2668	mnLZXrc.exe
2604	reiNsbv.exe
1500	AcwMmSF.exe
2660	EDhuCIN.exe
1048	iNRMefB.exe
452	TFGYHLY.exe
2012	OPvBsqM.exe
2712	HaQihsP.exe
2072	bRMgoAE.exe
2600	yLHAJVd.exe
1248	jeXxpDy.exe
2796	ljDsLSF.exe
1856	lyXBGqw.exe
3104	odwpwqd.exe

Loads dropped DLL 64 IoCs

pid	Process
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c0000000144e4-3.dat	upx
behavioral1/memory/2104-1-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/files/0x003400000001471d-9.dat	upx
behavioral1/memory/3060-15-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/files/0x0007000000014b27-20.dat	upx
behavioral1/files/0x0007000000014b63-30.dat	upx
behavioral1/files/0x000a000000014e51-42.dat	upx
behavioral1/files/0x0007000000015ce1-45.dat	upx
behavioral1/files/0x0006000000015ceb-49.dat	upx
behavioral1/files/0x0006000000015d07-51.dat	upx
behavioral1/files/0x000b000000014bea-37.dat	upx
behavioral1/files/0x0006000000015d5e-101.dat	upx
behavioral1/files/0x0006000000015d87-120.dat	upx
behavioral1/files/0x0006000000015d9b-127.dat	upx
behavioral1/files/0x0006000000015eaf-139.dat	upx
behavioral1/files/0x00060000000161e7-154.dat	upx
behavioral1/files/0x0006000000015fe9-148.dat	upx
behavioral1/files/0x0006000000016c63-182.dat	upx
behavioral1/files/0x0006000000016cb7-189.dat	upx
behavioral1/files/0x0006000000016a9a-177.dat	upx
behavioral1/files/0x000600000001661c-170.dat	upx
behavioral1/files/0x00060000000164b2-163.dat	upx
behavioral1/files/0x0006000000015d67-108.dat	upx
behavioral1/files/0x0006000000015d6f-112.dat	upx
behavioral1/files/0x0006000000015d56-98.dat	upx
behavioral1/files/0x0033000000014726-88.dat	upx
behavioral1/files/0x0006000000015d4a-92.dat	upx
behavioral1/files/0x0006000000015d28-83.dat	upx
behavioral1/memory/2440-69-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/1576-67-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/memory/2736-62-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/2792-60-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2748-56-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2744-54-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/files/0x0007000000004e76-34.dat	upx
behavioral1/memory/2656-26-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2756-12-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/files/0x0006000000015d79-117.dat	upx
behavioral1/files/0x0006000000015f6d-141.dat	upx
behavioral1/files/0x0006000000016c6b-186.dat	upx
behavioral1/files/0x0006000000016c4a-179.dat	upx
behavioral1/files/0x0006000000016843-172.dat	upx
behavioral1/files/0x0006000000016572-165.dat	upx
behavioral1/files/0x000600000001630b-158.dat	upx
behavioral1/files/0x0006000000016117-149.dat	upx
behavioral1/files/0x0006000000015e3a-132.dat	upx
behavioral1/files/0x0006000000015d8f-123.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fxzVxwJ.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\xYDxlKe.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\bWARUqF.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\dFOBSEd.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\sqnZMmO.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\MerBLnu.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\bafCDfV.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\HfgYZXK.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\wKmmaxu.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\wPMCwmP.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\DTfORvQ.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\rkafCKM.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\zMelvEG.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\uZHkKlA.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\OnjNmqq.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\OgNAcws.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\isyeTjT.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\jsZGndy.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\KDaYaXh.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\aPyzUyG.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\TfFlTuj.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\ETUBLTN.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\xkhOaAO.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\kSRnoPZ.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\IolUmtI.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\iAIsrxU.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\QBMpJcw.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\ZgGkZvK.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\nigFFPe.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\vkBmjOq.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\soPxXsg.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\BQmfjMR.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\imKpMoW.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\iEsuIEq.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\CmfDtdp.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\yraNLGI.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\OKAqAnq.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\DPRhLpq.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\BQnQPbb.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\vxTugwK.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\fbvjmrs.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\oFFonAM.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\csnYcPB.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\tVQoPti.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\UpLGIzT.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\IqOBcgh.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\MFyGgOU.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\OSKGIht.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\VyksUcy.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\VzOAPvN.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\jJquvZD.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\OOrGSsX.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\NUNyYKr.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\pkjXnLD.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\mblKqKO.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\pxCcbGr.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\goEnyjZ.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\rAqElre.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\GAkZJyP.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\gDxBtUv.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\kkKgWpn.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\EDhuCIN.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\goFumDX.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
File created	C:\Windows\System\jLbXVxb.exe	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1188	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
Token: SeDebugPrivilege	1188	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1188	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	29
PID 2104 wrote to memory of 1188	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	29
PID 2104 wrote to memory of 1188	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	29
PID 2104 wrote to memory of 2756	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2756	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2756	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	30
PID 2104 wrote to memory of 3060	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	31
PID 2104 wrote to memory of 3060	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	31
PID 2104 wrote to memory of 3060	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	31
PID 2104 wrote to memory of 2656	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	32
PID 2104 wrote to memory of 2656	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	32
PID 2104 wrote to memory of 2656	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	32
PID 2104 wrote to memory of 2744	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	33
PID 2104 wrote to memory of 2744	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	33
PID 2104 wrote to memory of 2744	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	33
PID 2104 wrote to memory of 2748	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	34
PID 2104 wrote to memory of 2748	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	34
PID 2104 wrote to memory of 2748	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	34
PID 2104 wrote to memory of 2792	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	35
PID 2104 wrote to memory of 2792	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	35
PID 2104 wrote to memory of 2792	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	35
PID 2104 wrote to memory of 2736	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	36
PID 2104 wrote to memory of 2736	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	36
PID 2104 wrote to memory of 2736	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	36
PID 2104 wrote to memory of 1576	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	37
PID 2104 wrote to memory of 1576	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	37
PID 2104 wrote to memory of 1576	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	37
PID 2104 wrote to memory of 2440	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	38
PID 2104 wrote to memory of 2440	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	38
PID 2104 wrote to memory of 2440	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	38
PID 2104 wrote to memory of 2608	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	39
PID 2104 wrote to memory of 2608	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	39
PID 2104 wrote to memory of 2608	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	39
PID 2104 wrote to memory of 2760	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	40
PID 2104 wrote to memory of 2760	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	40
PID 2104 wrote to memory of 2760	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	40
PID 2104 wrote to memory of 2708	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	41
PID 2104 wrote to memory of 2708	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	41
PID 2104 wrote to memory of 2708	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	41
PID 2104 wrote to memory of 1556	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	42
PID 2104 wrote to memory of 1556	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	42
PID 2104 wrote to memory of 1556	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	42
PID 2104 wrote to memory of 2788	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	43
PID 2104 wrote to memory of 2788	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	43
PID 2104 wrote to memory of 2788	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	43
PID 2104 wrote to memory of 1448	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	44
PID 2104 wrote to memory of 1448	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	44
PID 2104 wrote to memory of 1448	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	44
PID 2104 wrote to memory of 2496	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	45
PID 2104 wrote to memory of 2496	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	45
PID 2104 wrote to memory of 2496	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	45
PID 2104 wrote to memory of 2524	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	46
PID 2104 wrote to memory of 2524	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	46
PID 2104 wrote to memory of 2524	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	46
PID 2104 wrote to memory of 2804	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	47
PID 2104 wrote to memory of 2804	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	47
PID 2104 wrote to memory of 2804	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	47
PID 2104 wrote to memory of 1336	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	48
PID 2104 wrote to memory of 1336	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	48
PID 2104 wrote to memory of 1336	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	48
PID 2104 wrote to memory of 1324	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	49
PID 2104 wrote to memory of 1324	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	49
PID 2104 wrote to memory of 1324	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	49
PID 2104 wrote to memory of 1260	2104	0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a7bf12090cbd5142c9ecb87828cc52b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1188
- C:\Windows\System\BrgIfPE.exe
  C:\Windows\System\BrgIfPE.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\MeFYVTe.exe
  C:\Windows\System\MeFYVTe.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\BUbXRFM.exe
  C:\Windows\System\BUbXRFM.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\zWPadzD.exe
  C:\Windows\System\zWPadzD.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\faGRemw.exe
  C:\Windows\System\faGRemw.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\famnMKm.exe
  C:\Windows\System\famnMKm.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\aTNEjmI.exe
  C:\Windows\System\aTNEjmI.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\cFUZzjH.exe
  C:\Windows\System\cFUZzjH.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\IQCHwwM.exe
  C:\Windows\System\IQCHwwM.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\glFnrVR.exe
  C:\Windows\System\glFnrVR.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\dQtaJnZ.exe
  C:\Windows\System\dQtaJnZ.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\VDGGdcZ.exe
  C:\Windows\System\VDGGdcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\gWDnyKs.exe
  C:\Windows\System\gWDnyKs.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\cAloXfm.exe
  C:\Windows\System\cAloXfm.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\dqnGLkl.exe
  C:\Windows\System\dqnGLkl.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\HzPYjqd.exe
  C:\Windows\System\HzPYjqd.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\ZNCCvxb.exe
  C:\Windows\System\ZNCCvxb.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\jbAjFPw.exe
  C:\Windows\System\jbAjFPw.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\DsPggNs.exe
  C:\Windows\System\DsPggNs.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\EqOgavL.exe
  C:\Windows\System\EqOgavL.exe
  2⤵
  PID:1324
- C:\Windows\System\JzLKiwy.exe
  C:\Windows\System\JzLKiwy.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\SyOCJGh.exe
  C:\Windows\System\SyOCJGh.exe
  2⤵
  PID:2040
- C:\Windows\System\TfFlTuj.exe
  C:\Windows\System\TfFlTuj.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\mbNssUG.exe
  C:\Windows\System\mbNssUG.exe
  2⤵
  PID:2400
- C:\Windows\System\GqHRRyB.exe
  C:\Windows\System\GqHRRyB.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\huBJZYq.exe
  C:\Windows\System\huBJZYq.exe
  2⤵
  PID:2872
- C:\Windows\System\DmzBOKd.exe
  C:\Windows\System\DmzBOKd.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\SpKrXWL.exe
  C:\Windows\System\SpKrXWL.exe
  2⤵
  PID:1644
- C:\Windows\System\FJQGUYR.exe
  C:\Windows\System\FJQGUYR.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\bKYEwIL.exe
  C:\Windows\System\bKYEwIL.exe
  2⤵
  PID:1640
- C:\Windows\System\FjnWoMI.exe
  C:\Windows\System\FjnWoMI.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\VzOAPvN.exe
  C:\Windows\System\VzOAPvN.exe
  2⤵
  PID:1796
- C:\Windows\System\nigFFPe.exe
  C:\Windows\System\nigFFPe.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\dFOBSEd.exe
  C:\Windows\System\dFOBSEd.exe
  2⤵
  PID:2392
- C:\Windows\System\eHHrOpW.exe
  C:\Windows\System\eHHrOpW.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\PSnHIxK.exe
  C:\Windows\System\PSnHIxK.exe
  2⤵
  PID:2396
- C:\Windows\System\KMKMwsB.exe
  C:\Windows\System\KMKMwsB.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\aqgPkVr.exe
  C:\Windows\System\aqgPkVr.exe
  2⤵
  PID:784
- C:\Windows\System\ibkqZms.exe
  C:\Windows\System\ibkqZms.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\leBuddN.exe
  C:\Windows\System\leBuddN.exe
  2⤵
  PID:300
- C:\Windows\System\rkafCKM.exe
  C:\Windows\System\rkafCKM.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\QqweUXA.exe
  C:\Windows\System\QqweUXA.exe
  2⤵
  PID:944
- C:\Windows\System\pNdCtBk.exe
  C:\Windows\System\pNdCtBk.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\WwbFIhY.exe
  C:\Windows\System\WwbFIhY.exe
  2⤵
  PID:2276
- C:\Windows\System\eUzQUNy.exe
  C:\Windows\System\eUzQUNy.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\xUYPswr.exe
  C:\Windows\System\xUYPswr.exe
  2⤵
  PID:768
- C:\Windows\System\IfUMeIx.exe
  C:\Windows\System\IfUMeIx.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\zEdTZvB.exe
  C:\Windows\System\zEdTZvB.exe
  2⤵
  PID:2164
- C:\Windows\System\GZgHFuc.exe
  C:\Windows\System\GZgHFuc.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\ETUBLTN.exe
  C:\Windows\System\ETUBLTN.exe
  2⤵
  PID:2084
- C:\Windows\System\RwMGyxN.exe
  C:\Windows\System\RwMGyxN.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\NIEOGmy.exe
  C:\Windows\System\NIEOGmy.exe
  2⤵
  PID:1756
- C:\Windows\System\xboVypm.exe
  C:\Windows\System\xboVypm.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\xzBDFha.exe
  C:\Windows\System\xzBDFha.exe
  2⤵
  PID:304
- C:\Windows\System\loEDMDV.exe
  C:\Windows\System\loEDMDV.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\XgySWiC.exe
  C:\Windows\System\XgySWiC.exe
  2⤵
  PID:1504
- C:\Windows\System\tCpArKx.exe
  C:\Windows\System\tCpArKx.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\dacHvkP.exe
  C:\Windows\System\dacHvkP.exe
  2⤵
  PID:1620
- C:\Windows\System\oSXojqC.exe
  C:\Windows\System\oSXojqC.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\DhNUyRO.exe
  C:\Windows\System\DhNUyRO.exe
  2⤵
  PID:1600
- C:\Windows\System\jXwVuHV.exe
  C:\Windows\System\jXwVuHV.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\TLOjDta.exe
  C:\Windows\System\TLOjDta.exe
  2⤵
  PID:2624
- C:\Windows\System\bVBZYxk.exe
  C:\Windows\System\bVBZYxk.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\PHJQSXZ.exe
  C:\Windows\System\PHJQSXZ.exe
  2⤵
  PID:2596
- C:\Windows\System\xFIThJE.exe
  C:\Windows\System\xFIThJE.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\nyHJBBa.exe
  C:\Windows\System\nyHJBBa.exe
  2⤵
  PID:2828
- C:\Windows\System\QzASsgF.exe
  C:\Windows\System\QzASsgF.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\fxzVxwJ.exe
  C:\Windows\System\fxzVxwJ.exe
  2⤵
  PID:2468
- C:\Windows\System\MJJRuJR.exe
  C:\Windows\System\MJJRuJR.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\ixyUAVh.exe
  C:\Windows\System\ixyUAVh.exe
  2⤵
  PID:2780
- C:\Windows\System\BQnQPbb.exe
  C:\Windows\System\BQnQPbb.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\RDRdeJW.exe
  C:\Windows\System\RDRdeJW.exe
  2⤵
  PID:1988
- C:\Windows\System\rAqElre.exe
  C:\Windows\System\rAqElre.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\eGklwTF.exe
  C:\Windows\System\eGklwTF.exe
  2⤵
  PID:2812
- C:\Windows\System\xrMgdaW.exe
  C:\Windows\System\xrMgdaW.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\GzPomeW.exe
  C:\Windows\System\GzPomeW.exe
  2⤵
  PID:1972
- C:\Windows\System\MgslTMl.exe
  C:\Windows\System\MgslTMl.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\VvAAiTl.exe
  C:\Windows\System\VvAAiTl.exe
  2⤵
  PID:2044
- C:\Windows\System\GeOWkrg.exe
  C:\Windows\System\GeOWkrg.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\GzliqxD.exe
  C:\Windows\System\GzliqxD.exe
  2⤵
  PID:1124
- C:\Windows\System\aGHaDlY.exe
  C:\Windows\System\aGHaDlY.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\sqnZMmO.exe
  C:\Windows\System\sqnZMmO.exe
  2⤵
  PID:320
- C:\Windows\System\mnLZXrc.exe
  C:\Windows\System\mnLZXrc.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\QDxMpoY.exe
  C:\Windows\System\QDxMpoY.exe
  2⤵
  PID:2820
- C:\Windows\System\reiNsbv.exe
  C:\Windows\System\reiNsbv.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\upfKvMt.exe
  C:\Windows\System\upfKvMt.exe
  2⤵
  PID:1940
- C:\Windows\System\AcwMmSF.exe
  C:\Windows\System\AcwMmSF.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\ITTdhjb.exe
  C:\Windows\System\ITTdhjb.exe
  2⤵
  PID:1808
- C:\Windows\System\EDhuCIN.exe
  C:\Windows\System\EDhuCIN.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\aeqQNvc.exe
  C:\Windows\System\aeqQNvc.exe
  2⤵
  PID:2452
- C:\Windows\System\iNRMefB.exe
  C:\Windows\System\iNRMefB.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\Fesjary.exe
  C:\Windows\System\Fesjary.exe
  2⤵
  PID:1764
- C:\Windows\System\TFGYHLY.exe
  C:\Windows\System\TFGYHLY.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\DCorqjU.exe
  C:\Windows\System\DCorqjU.exe
  2⤵
  PID:2776
- C:\Windows\System\OPvBsqM.exe
  C:\Windows\System\OPvBsqM.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\NYvufzc.exe
  C:\Windows\System\NYvufzc.exe
  2⤵
  PID:2680
- C:\Windows\System\HaQihsP.exe
  C:\Windows\System\HaQihsP.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\WfZBCmX.exe
  C:\Windows\System\WfZBCmX.exe
  2⤵
  PID:2108
- C:\Windows\System\bRMgoAE.exe
  C:\Windows\System\bRMgoAE.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\srzFalw.exe
  C:\Windows\System\srzFalw.exe
  2⤵
  PID:2620
- C:\Windows\System\yLHAJVd.exe
  C:\Windows\System\yLHAJVd.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\quoXazS.exe
  C:\Windows\System\quoXazS.exe
  2⤵
  PID:740
- C:\Windows\System\jeXxpDy.exe
  C:\Windows\System\jeXxpDy.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\EmXqrLx.exe
  C:\Windows\System\EmXqrLx.exe
  2⤵
  PID:2848
- C:\Windows\System\ljDsLSF.exe
  C:\Windows\System\ljDsLSF.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\yrZZCrr.exe
  C:\Windows\System\yrZZCrr.exe
  2⤵
  PID:2200
- C:\Windows\System\lyXBGqw.exe
  C:\Windows\System\lyXBGqw.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\lsJbozv.exe
  C:\Windows\System\lsJbozv.exe
  2⤵
  PID:3088
- C:\Windows\System\odwpwqd.exe
  C:\Windows\System\odwpwqd.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\yjYOWEA.exe
  C:\Windows\System\yjYOWEA.exe
  2⤵
  PID:3120
- C:\Windows\System\JlCXhqJ.exe
  C:\Windows\System\JlCXhqJ.exe
  2⤵
  PID:3136
- C:\Windows\System\XoNWttT.exe
  C:\Windows\System\XoNWttT.exe
  2⤵
  PID:3152
- C:\Windows\System\kMsprom.exe
  C:\Windows\System\kMsprom.exe
  2⤵
  PID:3168
- C:\Windows\System\XcwGtiA.exe
  C:\Windows\System\XcwGtiA.exe
  2⤵
  PID:3184
- C:\Windows\System\OKAqAnq.exe
  C:\Windows\System\OKAqAnq.exe
  2⤵
  PID:3200
- C:\Windows\System\JTCoLCw.exe
  C:\Windows\System\JTCoLCw.exe
  2⤵
  PID:3216
- C:\Windows\System\zMRRhBT.exe
  C:\Windows\System\zMRRhBT.exe
  2⤵
  PID:3232
- C:\Windows\System\GzyNoaC.exe
  C:\Windows\System\GzyNoaC.exe
  2⤵
  PID:3248
- C:\Windows\System\xkhOaAO.exe
  C:\Windows\System\xkhOaAO.exe
  2⤵
  PID:3264
- C:\Windows\System\Pngveow.exe
  C:\Windows\System\Pngveow.exe
  2⤵
  PID:3280
- C:\Windows\System\munoEtM.exe
  C:\Windows\System\munoEtM.exe
  2⤵
  PID:3296
- C:\Windows\System\eOULYlF.exe
  C:\Windows\System\eOULYlF.exe
  2⤵
  PID:3312
- C:\Windows\System\jijlUdG.exe
  C:\Windows\System\jijlUdG.exe
  2⤵
  PID:3328
- C:\Windows\System\FKsRVXz.exe
  C:\Windows\System\FKsRVXz.exe
  2⤵
  PID:3344
- C:\Windows\System\nOHyANl.exe
  C:\Windows\System\nOHyANl.exe
  2⤵
  PID:3360
- C:\Windows\System\KnMacta.exe
  C:\Windows\System\KnMacta.exe
  2⤵
  PID:3376
- C:\Windows\System\ejEJJJM.exe
  C:\Windows\System\ejEJJJM.exe
  2⤵
  PID:3392
- C:\Windows\System\UBRzXpv.exe
  C:\Windows\System\UBRzXpv.exe
  2⤵
  PID:3408
- C:\Windows\System\KODmjEh.exe
  C:\Windows\System\KODmjEh.exe
  2⤵
  PID:3424
- C:\Windows\System\dGOBLSh.exe
  C:\Windows\System\dGOBLSh.exe
  2⤵
  PID:3440
- C:\Windows\System\HUZKxvs.exe
  C:\Windows\System\HUZKxvs.exe
  2⤵
  PID:3456
- C:\Windows\System\xvWhcKU.exe
  C:\Windows\System\xvWhcKU.exe
  2⤵
  PID:3472
- C:\Windows\System\MpZSobp.exe
  C:\Windows\System\MpZSobp.exe
  2⤵
  PID:3488
- C:\Windows\System\ybRqEKw.exe
  C:\Windows\System\ybRqEKw.exe
  2⤵
  PID:3504
- C:\Windows\System\VHvzepr.exe
  C:\Windows\System\VHvzepr.exe
  2⤵
  PID:3520
- C:\Windows\System\pxCcbGr.exe
  C:\Windows\System\pxCcbGr.exe
  2⤵
  PID:3536
- C:\Windows\System\gXomPfR.exe
  C:\Windows\System\gXomPfR.exe
  2⤵
  PID:3552
- C:\Windows\System\czIdakv.exe
  C:\Windows\System\czIdakv.exe
  2⤵
  PID:3568
- C:\Windows\System\RswsMQm.exe
  C:\Windows\System\RswsMQm.exe
  2⤵
  PID:3584
- C:\Windows\System\xfSZGBw.exe
  C:\Windows\System\xfSZGBw.exe
  2⤵
  PID:3600
- C:\Windows\System\xTpZVlp.exe
  C:\Windows\System\xTpZVlp.exe
  2⤵
  PID:3616
- C:\Windows\System\kSRnoPZ.exe
  C:\Windows\System\kSRnoPZ.exe
  2⤵
  PID:3632
- C:\Windows\System\HZzudMf.exe
  C:\Windows\System\HZzudMf.exe
  2⤵
  PID:3648
- C:\Windows\System\qAnjCAk.exe
  C:\Windows\System\qAnjCAk.exe
  2⤵
  PID:3664
- C:\Windows\System\Yfbvenr.exe
  C:\Windows\System\Yfbvenr.exe
  2⤵
  PID:3680
- C:\Windows\System\UZmJBbK.exe
  C:\Windows\System\UZmJBbK.exe
  2⤵
  PID:3696
- C:\Windows\System\ckUdskX.exe
  C:\Windows\System\ckUdskX.exe
  2⤵
  PID:3712
- C:\Windows\System\FLGzUDm.exe
  C:\Windows\System\FLGzUDm.exe
  2⤵
  PID:3728
- C:\Windows\System\ETemoxs.exe
  C:\Windows\System\ETemoxs.exe
  2⤵
  PID:3744
- C:\Windows\System\APHOJPK.exe
  C:\Windows\System\APHOJPK.exe
  2⤵
  PID:3760
- C:\Windows\System\zQOuMoj.exe
  C:\Windows\System\zQOuMoj.exe
  2⤵
  PID:3776
- C:\Windows\System\LolcVlO.exe
  C:\Windows\System\LolcVlO.exe
  2⤵
  PID:3792
- C:\Windows\System\rCdHKPi.exe
  C:\Windows\System\rCdHKPi.exe
  2⤵
  PID:3808
- C:\Windows\System\LTIhvix.exe
  C:\Windows\System\LTIhvix.exe
  2⤵
  PID:3824
- C:\Windows\System\xdTWkbg.exe
  C:\Windows\System\xdTWkbg.exe
  2⤵
  PID:3844
- C:\Windows\System\GeFkKFS.exe
  C:\Windows\System\GeFkKFS.exe
  2⤵
  PID:3860
- C:\Windows\System\yWxhYVh.exe
  C:\Windows\System\yWxhYVh.exe
  2⤵
  PID:3876
- C:\Windows\System\MerBLnu.exe
  C:\Windows\System\MerBLnu.exe
  2⤵
  PID:3892
- C:\Windows\System\yFBLDFd.exe
  C:\Windows\System\yFBLDFd.exe
  2⤵
  PID:3908
- C:\Windows\System\OSKGIht.exe
  C:\Windows\System\OSKGIht.exe
  2⤵
  PID:3924
- C:\Windows\System\FdKvJZU.exe
  C:\Windows\System\FdKvJZU.exe
  2⤵
  PID:3940
- C:\Windows\System\aTgAjSL.exe
  C:\Windows\System\aTgAjSL.exe
  2⤵
  PID:3956
- C:\Windows\System\MUGMQuU.exe
  C:\Windows\System\MUGMQuU.exe
  2⤵
  PID:3972
- C:\Windows\System\uawinZv.exe
  C:\Windows\System\uawinZv.exe
  2⤵
  PID:3988
- C:\Windows\System\SvpjoBE.exe
  C:\Windows\System\SvpjoBE.exe
  2⤵
  PID:4004
- C:\Windows\System\XeLPbOK.exe
  C:\Windows\System\XeLPbOK.exe
  2⤵
  PID:4020
- C:\Windows\System\udRlgqA.exe
  C:\Windows\System\udRlgqA.exe
  2⤵
  PID:4036
- C:\Windows\System\iMwoubk.exe
  C:\Windows\System\iMwoubk.exe
  2⤵
  PID:4052
- C:\Windows\System\UWnSJWR.exe
  C:\Windows\System\UWnSJWR.exe
  2⤵
  PID:4068
- C:\Windows\System\sekWdpF.exe
  C:\Windows\System\sekWdpF.exe
  2⤵
  PID:4084
- C:\Windows\System\pTZqFFE.exe
  C:\Windows\System\pTZqFFE.exe
  2⤵
  PID:3112
- C:\Windows\System\bDqkwWf.exe
  C:\Windows\System\bDqkwWf.exe
  2⤵
  PID:3148
- C:\Windows\System\zWqYxXO.exe
  C:\Windows\System\zWqYxXO.exe
  2⤵
  PID:3212
- C:\Windows\System\jReOkJT.exe
  C:\Windows\System\jReOkJT.exe
  2⤵
  PID:3276
- C:\Windows\System\gGLpIeQ.exe
  C:\Windows\System\gGLpIeQ.exe
  2⤵
  PID:2568
- C:\Windows\System\uGqUCFj.exe
  C:\Windows\System\uGqUCFj.exe
  2⤵
  PID:272
- C:\Windows\System\fPoQpIN.exe
  C:\Windows\System\fPoQpIN.exe
  2⤵
  PID:4108
- C:\Windows\System\gtQqQDe.exe
  C:\Windows\System\gtQqQDe.exe
  2⤵
  PID:4124
- C:\Windows\System\uZBUkLS.exe
  C:\Windows\System\uZBUkLS.exe
  2⤵
  PID:4140
- C:\Windows\System\zYnZsXa.exe
  C:\Windows\System\zYnZsXa.exe
  2⤵
  PID:4156
- C:\Windows\System\MxMjlhH.exe
  C:\Windows\System\MxMjlhH.exe
  2⤵
  PID:4172
- C:\Windows\System\ZrFfIHL.exe
  C:\Windows\System\ZrFfIHL.exe
  2⤵
  PID:4188
- C:\Windows\System\zAkhIeS.exe
  C:\Windows\System\zAkhIeS.exe
  2⤵
  PID:4204
- C:\Windows\System\baDZESR.exe
  C:\Windows\System\baDZESR.exe
  2⤵
  PID:4220
- C:\Windows\System\DpRpYZX.exe
  C:\Windows\System\DpRpYZX.exe
  2⤵
  PID:4236
- C:\Windows\System\bMwOuyZ.exe
  C:\Windows\System\bMwOuyZ.exe
  2⤵
  PID:4252
- C:\Windows\System\OiUUqic.exe
  C:\Windows\System\OiUUqic.exe
  2⤵
  PID:4268
- C:\Windows\System\pCiyQRN.exe
  C:\Windows\System\pCiyQRN.exe
  2⤵
  PID:4284
- C:\Windows\System\rKKCceo.exe
  C:\Windows\System\rKKCceo.exe
  2⤵
  PID:4300
- C:\Windows\System\OKAhNxG.exe
  C:\Windows\System\OKAhNxG.exe
  2⤵
  PID:4316
- C:\Windows\System\SnNquTZ.exe
  C:\Windows\System\SnNquTZ.exe
  2⤵
  PID:4332
- C:\Windows\System\kkKgWpn.exe
  C:\Windows\System\kkKgWpn.exe
  2⤵
  PID:4348
- C:\Windows\System\VeZhoQH.exe
  C:\Windows\System\VeZhoQH.exe
  2⤵
  PID:4364
- C:\Windows\System\bdBrfum.exe
  C:\Windows\System\bdBrfum.exe
  2⤵
  PID:4380
- C:\Windows\System\VNrdnlV.exe
  C:\Windows\System\VNrdnlV.exe
  2⤵
  PID:4396
- C:\Windows\System\EhTEGur.exe
  C:\Windows\System\EhTEGur.exe
  2⤵
  PID:4412
- C:\Windows\System\wVNKQdr.exe
  C:\Windows\System\wVNKQdr.exe
  2⤵
  PID:4428
- C:\Windows\System\soPxXsg.exe
  C:\Windows\System\soPxXsg.exe
  2⤵
  PID:4444
- C:\Windows\System\PaCLxwY.exe
  C:\Windows\System\PaCLxwY.exe
  2⤵
  PID:4460
- C:\Windows\System\RVpVlLk.exe
  C:\Windows\System\RVpVlLk.exe
  2⤵
  PID:4476
- C:\Windows\System\OgNAcws.exe
  C:\Windows\System\OgNAcws.exe
  2⤵
  PID:4492
- C:\Windows\System\mGxDaEk.exe
  C:\Windows\System\mGxDaEk.exe
  2⤵
  PID:4508
- C:\Windows\System\lWtOHFV.exe
  C:\Windows\System\lWtOHFV.exe
  2⤵
  PID:4524
- C:\Windows\System\pJkzaAG.exe
  C:\Windows\System\pJkzaAG.exe
  2⤵
  PID:4540
- C:\Windows\System\pnzPyJX.exe
  C:\Windows\System\pnzPyJX.exe
  2⤵
  PID:4556
- C:\Windows\System\EUZTaNx.exe
  C:\Windows\System\EUZTaNx.exe
  2⤵
  PID:4572
- C:\Windows\System\fbvjmrs.exe
  C:\Windows\System\fbvjmrs.exe
  2⤵
  PID:4592
- C:\Windows\System\NOGpwCD.exe
  C:\Windows\System\NOGpwCD.exe
  2⤵
  PID:4608
- C:\Windows\System\UXiIala.exe
  C:\Windows\System\UXiIala.exe
  2⤵
  PID:4624
- C:\Windows\System\wdHMbwh.exe
  C:\Windows\System\wdHMbwh.exe
  2⤵
  PID:4640
- C:\Windows\System\ryJWnhM.exe
  C:\Windows\System\ryJWnhM.exe
  2⤵
  PID:4656
- C:\Windows\System\Hayfveg.exe
  C:\Windows\System\Hayfveg.exe
  2⤵
  PID:4672
- C:\Windows\System\ZRCZxOj.exe
  C:\Windows\System\ZRCZxOj.exe
  2⤵
  PID:4688
- C:\Windows\System\goFumDX.exe
  C:\Windows\System\goFumDX.exe
  2⤵
  PID:4704
- C:\Windows\System\YwCdSWe.exe
  C:\Windows\System\YwCdSWe.exe
  2⤵
  PID:4720
- C:\Windows\System\YqxaRDE.exe
  C:\Windows\System\YqxaRDE.exe
  2⤵
  PID:4736
- C:\Windows\System\DZfTmzT.exe
  C:\Windows\System\DZfTmzT.exe
  2⤵
  PID:4752
- C:\Windows\System\nJndycx.exe
  C:\Windows\System\nJndycx.exe
  2⤵
  PID:4768
- C:\Windows\System\cKOWDCp.exe
  C:\Windows\System\cKOWDCp.exe
  2⤵
  PID:4784
- C:\Windows\System\dhBpcIm.exe
  C:\Windows\System\dhBpcIm.exe
  2⤵
  PID:4800
- C:\Windows\System\UVUEnNl.exe
  C:\Windows\System\UVUEnNl.exe
  2⤵
  PID:4816
- C:\Windows\System\HNYQEIN.exe
  C:\Windows\System\HNYQEIN.exe
  2⤵
  PID:4832
- C:\Windows\System\mblKqKO.exe
  C:\Windows\System\mblKqKO.exe
  2⤵
  PID:4848
- C:\Windows\System\eiVIPzt.exe
  C:\Windows\System\eiVIPzt.exe
  2⤵
  PID:4864
- C:\Windows\System\VyksUcy.exe
  C:\Windows\System\VyksUcy.exe
  2⤵
  PID:4880
- C:\Windows\System\xYDxlKe.exe
  C:\Windows\System\xYDxlKe.exe
  2⤵
  PID:5208
- C:\Windows\System\MEUCpfv.exe
  C:\Windows\System\MEUCpfv.exe
  2⤵
  PID:5224
- C:\Windows\System\CxxUXTz.exe
  C:\Windows\System\CxxUXTz.exe
  2⤵
  PID:5240
- C:\Windows\System\KssHFri.exe
  C:\Windows\System\KssHFri.exe
  2⤵
  PID:5256
- C:\Windows\System\iRsDwfD.exe
  C:\Windows\System\iRsDwfD.exe
  2⤵
  PID:5272
- C:\Windows\System\nblJXmz.exe
  C:\Windows\System\nblJXmz.exe
  2⤵
  PID:5288
- C:\Windows\System\YaXkErC.exe
  C:\Windows\System\YaXkErC.exe
  2⤵
  PID:5304
- C:\Windows\System\NnRkZMP.exe
  C:\Windows\System\NnRkZMP.exe
  2⤵
  PID:5320
- C:\Windows\System\VhToBjt.exe
  C:\Windows\System\VhToBjt.exe
  2⤵
  PID:5336
- C:\Windows\System\MFUNiYO.exe
  C:\Windows\System\MFUNiYO.exe
  2⤵
  PID:5352
- C:\Windows\System\atxeEDE.exe
  C:\Windows\System\atxeEDE.exe
  2⤵
  PID:5368
- C:\Windows\System\URNKoHO.exe
  C:\Windows\System\URNKoHO.exe
  2⤵
  PID:5384
- C:\Windows\System\znAaWrF.exe
  C:\Windows\System\znAaWrF.exe
  2⤵
  PID:5400
- C:\Windows\System\QBSMvTZ.exe
  C:\Windows\System\QBSMvTZ.exe
  2⤵
  PID:5416
- C:\Windows\System\RhjLsNd.exe
  C:\Windows\System\RhjLsNd.exe
  2⤵
  PID:5432
- C:\Windows\System\IolUmtI.exe
  C:\Windows\System\IolUmtI.exe
  2⤵
  PID:5448
- C:\Windows\System\CIUbBTz.exe
  C:\Windows\System\CIUbBTz.exe
  2⤵
  PID:5464
- C:\Windows\System\GCONazB.exe
  C:\Windows\System\GCONazB.exe
  2⤵
  PID:5480
- C:\Windows\System\KhenNRZ.exe
  C:\Windows\System\KhenNRZ.exe
  2⤵
  PID:5496
- C:\Windows\System\IsyrLMZ.exe
  C:\Windows\System\IsyrLMZ.exe
  2⤵
  PID:5512
- C:\Windows\System\RRHJLid.exe
  C:\Windows\System\RRHJLid.exe
  2⤵
  PID:5528
- C:\Windows\System\yzKkOxH.exe
  C:\Windows\System\yzKkOxH.exe
  2⤵
  PID:5544
- C:\Windows\System\fbXeoLU.exe
  C:\Windows\System\fbXeoLU.exe
  2⤵
  PID:5560
- C:\Windows\System\DHgKgeG.exe
  C:\Windows\System\DHgKgeG.exe
  2⤵
  PID:5576
- C:\Windows\System\TjZKaVs.exe
  C:\Windows\System\TjZKaVs.exe
  2⤵
  PID:5592
- C:\Windows\System\kQhluzx.exe
  C:\Windows\System\kQhluzx.exe
  2⤵
  PID:5608
- C:\Windows\System\CdnnflU.exe
  C:\Windows\System\CdnnflU.exe
  2⤵
  PID:5624
- C:\Windows\System\vrFHNHh.exe
  C:\Windows\System\vrFHNHh.exe
  2⤵
  PID:5640
- C:\Windows\System\cJrMSGL.exe
  C:\Windows\System\cJrMSGL.exe
  2⤵
  PID:5656
- C:\Windows\System\vjZPySr.exe
  C:\Windows\System\vjZPySr.exe
  2⤵
  PID:5672
- C:\Windows\System\ggDzeUD.exe
  C:\Windows\System\ggDzeUD.exe
  2⤵
  PID:5696
- C:\Windows\System\BGCslBy.exe
  C:\Windows\System\BGCslBy.exe
  2⤵
  PID:5712
- C:\Windows\System\cYhnJdm.exe
  C:\Windows\System\cYhnJdm.exe
  2⤵
  PID:5728
- C:\Windows\System\jsZGndy.exe
  C:\Windows\System\jsZGndy.exe
  2⤵
  PID:5744
- C:\Windows\System\hNTwBab.exe
  C:\Windows\System\hNTwBab.exe
  2⤵
  PID:5760
- C:\Windows\System\wfinlFM.exe
  C:\Windows\System\wfinlFM.exe
  2⤵
  PID:5776
- C:\Windows\System\goEnyjZ.exe
  C:\Windows\System\goEnyjZ.exe
  2⤵
  PID:5792
- C:\Windows\System\zHDLgwm.exe
  C:\Windows\System\zHDLgwm.exe
  2⤵
  PID:5808
- C:\Windows\System\NWXlFKX.exe
  C:\Windows\System\NWXlFKX.exe
  2⤵
  PID:5824
- C:\Windows\System\qVtCZaj.exe
  C:\Windows\System\qVtCZaj.exe
  2⤵
  PID:5840
- C:\Windows\System\zCSjHnM.exe
  C:\Windows\System\zCSjHnM.exe
  2⤵
  PID:5856
- C:\Windows\System\MBGzZqn.exe
  C:\Windows\System\MBGzZqn.exe
  2⤵
  PID:5872
- C:\Windows\System\fvtteNR.exe
  C:\Windows\System\fvtteNR.exe
  2⤵
  PID:5888
- C:\Windows\System\BQmfjMR.exe
  C:\Windows\System\BQmfjMR.exe
  2⤵
  PID:5904
- C:\Windows\System\OdzvQMr.exe
  C:\Windows\System\OdzvQMr.exe
  2⤵
  PID:5920
- C:\Windows\System\AAqgPaE.exe
  C:\Windows\System\AAqgPaE.exe
  2⤵
  PID:5936
- C:\Windows\System\kFZuXgp.exe
  C:\Windows\System\kFZuXgp.exe
  2⤵
  PID:5952
- C:\Windows\System\yKruJRl.exe
  C:\Windows\System\yKruJRl.exe
  2⤵
  PID:5968
- C:\Windows\System\rPgMfMj.exe
  C:\Windows\System\rPgMfMj.exe
  2⤵
  PID:5984
- C:\Windows\System\EtOhzEQ.exe
  C:\Windows\System\EtOhzEQ.exe
  2⤵
  PID:6000
- C:\Windows\System\URwihDn.exe
  C:\Windows\System\URwihDn.exe
  2⤵
  PID:6016
- C:\Windows\System\tpLmcKl.exe
  C:\Windows\System\tpLmcKl.exe
  2⤵
  PID:6032
- C:\Windows\System\xAavngl.exe
  C:\Windows\System\xAavngl.exe
  2⤵
  PID:6048
- C:\Windows\System\GGuYceu.exe
  C:\Windows\System\GGuYceu.exe
  2⤵
  PID:6064
- C:\Windows\System\OZJGMzd.exe
  C:\Windows\System\OZJGMzd.exe
  2⤵
  PID:6080
- C:\Windows\System\eXEcOdJ.exe
  C:\Windows\System\eXEcOdJ.exe
  2⤵
  PID:6096
- C:\Windows\System\jJquvZD.exe
  C:\Windows\System\jJquvZD.exe
  2⤵
  PID:6112
- C:\Windows\System\WgBcgYR.exe
  C:\Windows\System\WgBcgYR.exe
  2⤵
  PID:6128
- C:\Windows\System\pIryfEb.exe
  C:\Windows\System\pIryfEb.exe
  2⤵
  PID:2716
- C:\Windows\System\iAIsrxU.exe
  C:\Windows\System\iAIsrxU.exe
  2⤵
  PID:3308
- C:\Windows\System\AGQLYGE.exe
  C:\Windows\System\AGQLYGE.exe
  2⤵
  PID:3372
- C:\Windows\System\hwMZofY.exe
  C:\Windows\System\hwMZofY.exe
  2⤵
  PID:3436
- C:\Windows\System\RORhgQE.exe
  C:\Windows\System\RORhgQE.exe
  2⤵
  PID:3500
- C:\Windows\System\CDPdjAt.exe
  C:\Windows\System\CDPdjAt.exe
  2⤵
  PID:3564
- C:\Windows\System\QlDAyIb.exe
  C:\Windows\System\QlDAyIb.exe
  2⤵
  PID:3628
- C:\Windows\System\DNfCbjB.exe
  C:\Windows\System\DNfCbjB.exe
  2⤵
  PID:3692
- C:\Windows\System\oMgljfn.exe
  C:\Windows\System\oMgljfn.exe
  2⤵
  PID:3756
- C:\Windows\System\JSTKjGm.exe
  C:\Windows\System\JSTKjGm.exe
  2⤵
  PID:3820
- C:\Windows\System\TfLTVcE.exe
  C:\Windows\System\TfLTVcE.exe
  2⤵
  PID:3888
- C:\Windows\System\eVMxdfj.exe
  C:\Windows\System\eVMxdfj.exe
  2⤵
  PID:3952
- C:\Windows\System\hheCSDm.exe
  C:\Windows\System\hheCSDm.exe
  2⤵
  PID:4016
- C:\Windows\System\EcWOuDl.exe
  C:\Windows\System\EcWOuDl.exe
  2⤵
  PID:4080
- C:\Windows\System\SGWuXYg.exe
  C:\Windows\System\SGWuXYg.exe
  2⤵
  PID:3272
- C:\Windows\System\nJQHseT.exe
  C:\Windows\System\nJQHseT.exe
  2⤵
  PID:4120
- C:\Windows\System\TGfQvgd.exe
  C:\Windows\System\TGfQvgd.exe
  2⤵
  PID:4184
- C:\Windows\System\ehMZgxg.exe
  C:\Windows\System\ehMZgxg.exe
  2⤵
  PID:4276
- C:\Windows\System\EnXSjXd.exe
  C:\Windows\System\EnXSjXd.exe
  2⤵
  PID:4312
- C:\Windows\System\mAcLFcO.exe
  C:\Windows\System\mAcLFcO.exe
  2⤵
  PID:4376
- C:\Windows\System\UUJNYrD.exe
  C:\Windows\System\UUJNYrD.exe
  2⤵
  PID:4440
- C:\Windows\System\XlefqYs.exe
  C:\Windows\System\XlefqYs.exe
  2⤵
  PID:4504
- C:\Windows\System\bUCLUPu.exe
  C:\Windows\System\bUCLUPu.exe
  2⤵
  PID:4568
- C:\Windows\System\iDsfpuW.exe
  C:\Windows\System\iDsfpuW.exe
  2⤵
  PID:4636
- C:\Windows\System\QBMpJcw.exe
  C:\Windows\System\QBMpJcw.exe
  2⤵
  PID:4700
- C:\Windows\System\tziKPCW.exe
  C:\Windows\System\tziKPCW.exe
  2⤵
  PID:4764
- C:\Windows\System\jLbXVxb.exe
  C:\Windows\System\jLbXVxb.exe
  2⤵
  PID:4828
- C:\Windows\System\PVqTUxJ.exe
  C:\Windows\System\PVqTUxJ.exe
  2⤵
  PID:4896
- C:\Windows\System\WJfhFPq.exe
  C:\Windows\System\WJfhFPq.exe
  2⤵
  PID:4912
- C:\Windows\System\cIPPsky.exe
  C:\Windows\System\cIPPsky.exe
  2⤵
  PID:4928
- C:\Windows\System\fnbpowO.exe
  C:\Windows\System\fnbpowO.exe
  2⤵
  PID:4944
- C:\Windows\System\SvbDIXw.exe
  C:\Windows\System\SvbDIXw.exe
  2⤵
  PID:4960
- C:\Windows\System\lPrwVVH.exe
  C:\Windows\System\lPrwVVH.exe
  2⤵
  PID:4980
- C:\Windows\System\rtlrEaJ.exe
  C:\Windows\System\rtlrEaJ.exe
  2⤵
  PID:4996
- C:\Windows\System\LKBTaBt.exe
  C:\Windows\System\LKBTaBt.exe
  2⤵
  PID:5012
- C:\Windows\System\TJovqad.exe
  C:\Windows\System\TJovqad.exe
  2⤵
  PID:5028
- C:\Windows\System\jRxNrzJ.exe
  C:\Windows\System\jRxNrzJ.exe
  2⤵
  PID:5044
- C:\Windows\System\nwZPSEV.exe
  C:\Windows\System\nwZPSEV.exe
  2⤵
  PID:5060
- C:\Windows\System\RwZxEzV.exe
  C:\Windows\System\RwZxEzV.exe
  2⤵
  PID:5076
- C:\Windows\System\NLIBptx.exe
  C:\Windows\System\NLIBptx.exe
  2⤵
  PID:5092
- C:\Windows\System\oFFonAM.exe
  C:\Windows\System\oFFonAM.exe
  2⤵
  PID:5108
- C:\Windows\System\fWcrspQ.exe
  C:\Windows\System\fWcrspQ.exe
  2⤵
  PID:2260
- C:\Windows\System\OszhRfD.exe
  C:\Windows\System\OszhRfD.exe
  2⤵
  PID:5148
- C:\Windows\System\gYzHyyA.exe
  C:\Windows\System\gYzHyyA.exe
  2⤵
  PID:5160
- C:\Windows\System\kYLyLRQ.exe
  C:\Windows\System\kYLyLRQ.exe
  2⤵
  PID:5172
- C:\Windows\System\fRbgpWc.exe
  C:\Windows\System\fRbgpWc.exe
  2⤵
  PID:5192
- C:\Windows\System\UIrpSCO.exe
  C:\Windows\System\UIrpSCO.exe
  2⤵
  PID:5232
- C:\Windows\System\nJQRoNf.exe
  C:\Windows\System\nJQRoNf.exe
  2⤵
  PID:5296
- C:\Windows\System\SgYzJXY.exe
  C:\Windows\System\SgYzJXY.exe
  2⤵
  PID:5364
- C:\Windows\System\YHKCvyM.exe
  C:\Windows\System\YHKCvyM.exe
  2⤵
  PID:5456
- C:\Windows\System\SdQHdks.exe
  C:\Windows\System\SdQHdks.exe
  2⤵
  PID:2472
- C:\Windows\System\HlLhzim.exe
  C:\Windows\System\HlLhzim.exe
  2⤵
  PID:6168
- C:\Windows\System\imKpMoW.exe
  C:\Windows\System\imKpMoW.exe
  2⤵
  PID:6184
- C:\Windows\System\VhGjjyB.exe
  C:\Windows\System\VhGjjyB.exe
  2⤵
  PID:6200
- C:\Windows\System\mVtPAHn.exe
  C:\Windows\System\mVtPAHn.exe
  2⤵
  PID:6216
- C:\Windows\System\SFFDhHv.exe
  C:\Windows\System\SFFDhHv.exe
  2⤵
  PID:6268
- C:\Windows\System\GeymrBb.exe
  C:\Windows\System\GeymrBb.exe
  2⤵
  PID:6300
- C:\Windows\System\WVZdsqh.exe
  C:\Windows\System\WVZdsqh.exe
  2⤵
  PID:6316
- C:\Windows\System\DnWTbSz.exe
  C:\Windows\System\DnWTbSz.exe
  2⤵
  PID:6332
- C:\Windows\System\ZArLFWe.exe
  C:\Windows\System\ZArLFWe.exe
  2⤵
  PID:6348
- C:\Windows\System\zdpfwmQ.exe
  C:\Windows\System\zdpfwmQ.exe
  2⤵
  PID:6364
- C:\Windows\System\pAoFhgz.exe
  C:\Windows\System\pAoFhgz.exe
  2⤵
  PID:6380
- C:\Windows\System\ztWyxZU.exe
  C:\Windows\System\ztWyxZU.exe
  2⤵
  PID:6396
- C:\Windows\System\DIKcayk.exe
  C:\Windows\System\DIKcayk.exe
  2⤵
  PID:6412
- C:\Windows\System\npbjZJk.exe
  C:\Windows\System\npbjZJk.exe
  2⤵
  PID:6428
- C:\Windows\System\LJZPJkd.exe
  C:\Windows\System\LJZPJkd.exe
  2⤵
  PID:6444
- C:\Windows\System\OvLqAJg.exe
  C:\Windows\System\OvLqAJg.exe
  2⤵
  PID:6512
- C:\Windows\System\hJKHKaz.exe
  C:\Windows\System\hJKHKaz.exe
  2⤵
  PID:6580
- C:\Windows\System\RMljDcd.exe
  C:\Windows\System\RMljDcd.exe
  2⤵
  PID:6596
- C:\Windows\System\NjKmpBc.exe
  C:\Windows\System\NjKmpBc.exe
  2⤵
  PID:6612
- C:\Windows\System\XQcxjGn.exe
  C:\Windows\System\XQcxjGn.exe
  2⤵
  PID:6632
- C:\Windows\System\zXukgvx.exe
  C:\Windows\System\zXukgvx.exe
  2⤵
  PID:6652
- C:\Windows\System\oNmnfTA.exe
  C:\Windows\System\oNmnfTA.exe
  2⤵
  PID:6672
- C:\Windows\System\YijnirR.exe
  C:\Windows\System\YijnirR.exe
  2⤵
  PID:6692
- C:\Windows\System\ZgGkZvK.exe
  C:\Windows\System\ZgGkZvK.exe
  2⤵
  PID:6708
- C:\Windows\System\KBFBHFY.exe
  C:\Windows\System\KBFBHFY.exe
  2⤵
  PID:6724
- C:\Windows\System\yqKHjJp.exe
  C:\Windows\System\yqKHjJp.exe
  2⤵
  PID:6740
- C:\Windows\System\sHVUeLk.exe
  C:\Windows\System\sHVUeLk.exe
  2⤵
  PID:6756
- C:\Windows\System\zMelvEG.exe
  C:\Windows\System\zMelvEG.exe
  2⤵
  PID:6776
- C:\Windows\System\OyouUDa.exe
  C:\Windows\System\OyouUDa.exe
  2⤵
  PID:6792
- C:\Windows\System\VzLzanS.exe
  C:\Windows\System\VzLzanS.exe
  2⤵
  PID:6808
- C:\Windows\System\bafCDfV.exe
  C:\Windows\System\bafCDfV.exe
  2⤵
  PID:6824
- C:\Windows\System\SLGqMjp.exe
  C:\Windows\System\SLGqMjp.exe
  2⤵
  PID:6840
- C:\Windows\System\mKwFbbY.exe
  C:\Windows\System\mKwFbbY.exe
  2⤵
  PID:6860
- C:\Windows\System\iZctilr.exe
  C:\Windows\System\iZctilr.exe
  2⤵
  PID:6876
- C:\Windows\System\LFhSfPJ.exe
  C:\Windows\System\LFhSfPJ.exe
  2⤵
  PID:6896
- C:\Windows\System\AyXNcpH.exe
  C:\Windows\System\AyXNcpH.exe
  2⤵
  PID:6916
- C:\Windows\System\FWXglRu.exe
  C:\Windows\System\FWXglRu.exe
  2⤵
  PID:6932
- C:\Windows\System\OodPEhM.exe
  C:\Windows\System\OodPEhM.exe
  2⤵
  PID:6948
- C:\Windows\System\cUOaUaC.exe
  C:\Windows\System\cUOaUaC.exe
  2⤵
  PID:6964
- C:\Windows\System\aYamwma.exe
  C:\Windows\System\aYamwma.exe
  2⤵
  PID:6980
- C:\Windows\System\xiJydSo.exe
  C:\Windows\System\xiJydSo.exe
  2⤵
  PID:6996
- C:\Windows\System\FnwWAyT.exe
  C:\Windows\System\FnwWAyT.exe
  2⤵
  PID:7016
- C:\Windows\System\PxwYbvP.exe
  C:\Windows\System\PxwYbvP.exe
  2⤵
  PID:7032
- C:\Windows\System\vkBmjOq.exe
  C:\Windows\System\vkBmjOq.exe
  2⤵
  PID:7048
- C:\Windows\System\DPRhLpq.exe
  C:\Windows\System\DPRhLpq.exe
  2⤵
  PID:7068
- C:\Windows\System\iodprzf.exe
  C:\Windows\System\iodprzf.exe
  2⤵
  PID:7084
- C:\Windows\System\SYaxtNE.exe
  C:\Windows\System\SYaxtNE.exe
  2⤵
  PID:7100
- C:\Windows\System\oiZGexn.exe
  C:\Windows\System\oiZGexn.exe
  2⤵
  PID:7116
- C:\Windows\System\oTtMiXM.exe
  C:\Windows\System\oTtMiXM.exe
  2⤵
  PID:7132
- C:\Windows\System\mrEAfAt.exe
  C:\Windows\System\mrEAfAt.exe
  2⤵
  PID:7148
- C:\Windows\System\TyKXKYg.exe
  C:\Windows\System\TyKXKYg.exe
  2⤵
  PID:7164
- C:\Windows\System\aWLhstS.exe
  C:\Windows\System\aWLhstS.exe
  2⤵
  PID:5520
- C:\Windows\System\iEsuIEq.exe
  C:\Windows\System\iEsuIEq.exe
  2⤵
  PID:5588
- C:\Windows\System\csnYcPB.exe
  C:\Windows\System\csnYcPB.exe
  2⤵
  PID:5652
- C:\Windows\System\COyBtze.exe
  C:\Windows\System\COyBtze.exe
  2⤵
  PID:5692
- C:\Windows\System\ZGEMTcF.exe
  C:\Windows\System\ZGEMTcF.exe
  2⤵
  PID:5756
- C:\Windows\System\LQebwgy.exe
  C:\Windows\System\LQebwgy.exe
  2⤵
  PID:5820
- C:\Windows\System\vLnVCTE.exe
  C:\Windows\System\vLnVCTE.exe
  2⤵
  PID:5912
- C:\Windows\System\fpwOVCB.exe
  C:\Windows\System\fpwOVCB.exe
  2⤵
  PID:5976
- C:\Windows\System\gKWxTvz.exe
  C:\Windows\System\gKWxTvz.exe
  2⤵
  PID:6040
- C:\Windows\System\FHTaAsh.exe
  C:\Windows\System\FHTaAsh.exe
  2⤵
  PID:6104
- C:\Windows\System\QIiSoWg.exe
  C:\Windows\System\QIiSoWg.exe
  2⤵
  PID:3340
- C:\Windows\System\HeOKEsv.exe
  C:\Windows\System\HeOKEsv.exe
  2⤵
  PID:3596
- C:\Windows\System\sskMWdf.exe
  C:\Windows\System\sskMWdf.exe
  2⤵
  PID:3852
- C:\Windows\System\DAfJmQk.exe
  C:\Windows\System\DAfJmQk.exe
  2⤵
  PID:3144
- C:\Windows\System\QrjSvvJ.exe
  C:\Windows\System\QrjSvvJ.exe
  2⤵
  PID:4280
- C:\Windows\System\viFsJze.exe
  C:\Windows\System\viFsJze.exe
  2⤵
  PID:4564
- C:\Windows\System\tVQoPti.exe
  C:\Windows\System\tVQoPti.exe
  2⤵
  PID:4824
- C:\Windows\System\jWAaFAU.exe
  C:\Windows\System\jWAaFAU.exe
  2⤵
  PID:4968
- C:\Windows\System\uTxOUIX.exe
  C:\Windows\System\uTxOUIX.exe
  2⤵
  PID:5036
- C:\Windows\System\laDDqgE.exe
  C:\Windows\System\laDDqgE.exe
  2⤵
  PID:5104
- C:\Windows\System\geUMDyu.exe
  C:\Windows\System\geUMDyu.exe
  2⤵
  PID:5140
- C:\Windows\System\OgozusH.exe
  C:\Windows\System\OgozusH.exe
  2⤵
  PID:5488
- C:\Windows\System\AfCjVRm.exe
  C:\Windows\System\AfCjVRm.exe
  2⤵
  PID:5328
- C:\Windows\System\PUfjMHC.exe
  C:\Windows\System\PUfjMHC.exe
  2⤵
  PID:2696
- C:\Windows\System\mTHUxdj.exe
  C:\Windows\System\mTHUxdj.exe
  2⤵
  PID:2492
- C:\Windows\System\BAeSiWC.exe
  C:\Windows\System\BAeSiWC.exe
  2⤵
  PID:6212
- C:\Windows\System\faPoHUX.exe
  C:\Windows\System\faPoHUX.exe
  2⤵
  PID:6288
- C:\Windows\System\cnqAcDN.exe
  C:\Windows\System\cnqAcDN.exe
  2⤵
  PID:6328
- C:\Windows\System\CHZWoJR.exe
  C:\Windows\System\CHZWoJR.exe
  2⤵
  PID:6392
- C:\Windows\System\nUrKHSe.exe
  C:\Windows\System\nUrKHSe.exe
  2⤵
  PID:2572
- C:\Windows\System\nzWfHTx.exe
  C:\Windows\System\nzWfHTx.exe
  2⤵
  PID:6468
- C:\Windows\System\pjrAnHI.exe
  C:\Windows\System\pjrAnHI.exe
  2⤵
  PID:2564
- C:\Windows\System\ekltbny.exe
  C:\Windows\System\ekltbny.exe
  2⤵
  PID:1760
- C:\Windows\System\iHGguto.exe
  C:\Windows\System\iHGguto.exe
  2⤵
  PID:2636
- C:\Windows\System\xxrhCQq.exe
  C:\Windows\System\xxrhCQq.exe
  2⤵
  PID:4952
- C:\Windows\System\rfoyMvr.exe
  C:\Windows\System\rfoyMvr.exe
  2⤵
  PID:3836
- C:\Windows\System\FEDEBKc.exe
  C:\Windows\System\FEDEBKc.exe
  2⤵
  PID:5504
- C:\Windows\System\DxipRwN.exe
  C:\Windows\System\DxipRwN.exe
  2⤵
  PID:5572
- C:\Windows\System\ToaVpym.exe
  C:\Windows\System\ToaVpym.exe
  2⤵
  PID:5632
- C:\Windows\System\OOrGSsX.exe
  C:\Windows\System\OOrGSsX.exe
  2⤵
  PID:5704
- C:\Windows\System\TPXKNPi.exe
  C:\Windows\System\TPXKNPi.exe
  2⤵
  PID:5768
- C:\Windows\System\oUhgBvU.exe
  C:\Windows\System\oUhgBvU.exe
  2⤵
  PID:5896
- C:\Windows\System\FqeNRCh.exe
  C:\Windows\System\FqeNRCh.exe
  2⤵
  PID:5996
- C:\Windows\System\cAsGfcR.exe
  C:\Windows\System\cAsGfcR.exe
  2⤵
  PID:6536
- C:\Windows\System\CmfDtdp.exe
  C:\Windows\System\CmfDtdp.exe
  2⤵
  PID:4076
- C:\Windows\System\HfgYZXK.exe
  C:\Windows\System\HfgYZXK.exe
  2⤵
  PID:4244
- C:\Windows\System\UkjvSyZ.exe
  C:\Windows\System\UkjvSyZ.exe
  2⤵
  PID:4500
- C:\Windows\System\hoCOzfG.exe
  C:\Windows\System\hoCOzfG.exe
  2⤵
  PID:4860
- C:\Windows\System\AoSBWLz.exe
  C:\Windows\System\AoSBWLz.exe
  2⤵
  PID:4988
- C:\Windows\System\AqGekeU.exe
  C:\Windows\System\AqGekeU.exe
  2⤵
  PID:5052
- C:\Windows\System\bWARUqF.exe
  C:\Windows\System\bWARUqF.exe
  2⤵
  PID:5112
- C:\Windows\System\MiiJffE.exe
  C:\Windows\System\MiiJffE.exe
  2⤵
  PID:5184
- C:\Windows\System\cAcwlsZ.exe
  C:\Windows\System\cAcwlsZ.exe
  2⤵
  PID:336
- C:\Windows\System\JyrJlxH.exe
  C:\Windows\System\JyrJlxH.exe
  2⤵
  PID:2928
- C:\Windows\System\XTlpUIi.exe
  C:\Windows\System\XTlpUIi.exe
  2⤵
  PID:6236
- C:\Windows\System\fMwZtgd.exe
  C:\Windows\System\fMwZtgd.exe
  2⤵
  PID:308
- C:\Windows\System\uGQlcvV.exe
  C:\Windows\System\uGQlcvV.exe
  2⤵
  PID:5312
- C:\Windows\System\EkBUIvv.exe
  C:\Windows\System\EkBUIvv.exe
  2⤵
  PID:5248
- C:\Windows\System\pwWeEGH.exe
  C:\Windows\System\pwWeEGH.exe
  2⤵
  PID:4872
- C:\Windows\System\NswdPaV.exe
  C:\Windows\System\NswdPaV.exe
  2⤵
  PID:4808
- C:\Windows\System\HuLZOWi.exe
  C:\Windows\System\HuLZOWi.exe
  2⤵
  PID:4744
- C:\Windows\System\mohJmiA.exe
  C:\Windows\System\mohJmiA.exe
  2⤵
  PID:4680
- C:\Windows\System\FbDFElZ.exe
  C:\Windows\System\FbDFElZ.exe
  2⤵
  PID:4616
- C:\Windows\System\gynSuAN.exe
  C:\Windows\System\gynSuAN.exe
  2⤵
  PID:1008
- C:\Windows\System\OQIorNK.exe
  C:\Windows\System\OQIorNK.exe
  2⤵
  PID:4520
- C:\Windows\System\vyFRNKX.exe
  C:\Windows\System\vyFRNKX.exe
  2⤵
  PID:4456
- C:\Windows\System\uRmQlfH.exe
  C:\Windows\System\uRmQlfH.exe
  2⤵
  PID:4360
- C:\Windows\System\UvdpTJz.exe
  C:\Windows\System\UvdpTJz.exe
  2⤵
  PID:4296
- C:\Windows\System\NUNyYKr.exe
  C:\Windows\System\NUNyYKr.exe
  2⤵
  PID:4232
- C:\Windows\System\nrkYuAu.exe
  C:\Windows\System\nrkYuAu.exe
  2⤵
  PID:4168
- C:\Windows\System\pkjXnLD.exe
  C:\Windows\System\pkjXnLD.exe
  2⤵
  PID:4104
- C:\Windows\System\nXnohYe.exe
  C:\Windows\System\nXnohYe.exe
  2⤵
  PID:3208
- C:\Windows\System\guNARgG.exe
  C:\Windows\System\guNARgG.exe
  2⤵
  PID:4064
- C:\Windows\System\rRehXav.exe
  C:\Windows\System\rRehXav.exe
  2⤵
  PID:4000
- C:\Windows\System\KDaYaXh.exe
  C:\Windows\System\KDaYaXh.exe
  2⤵
  PID:3936
- C:\Windows\System\qHeNPow.exe
  C:\Windows\System\qHeNPow.exe
  2⤵
  PID:3872
- C:\Windows\System\rvOkGnS.exe
  C:\Windows\System\rvOkGnS.exe
  2⤵
  PID:3800
- C:\Windows\System\lHizCWK.exe
  C:\Windows\System\lHizCWK.exe
  2⤵
  PID:3736
- C:\Windows\System\yaIFjib.exe
  C:\Windows\System\yaIFjib.exe
  2⤵
  PID:3672
- C:\Windows\System\FCGuLjU.exe
  C:\Windows\System\FCGuLjU.exe
  2⤵
  PID:3548
- C:\Windows\System\TaPjEvk.exe
  C:\Windows\System\TaPjEvk.exe
  2⤵
  PID:3484
- C:\Windows\System\wAvgGBs.exe
  C:\Windows\System\wAvgGBs.exe
  2⤵
  PID:3388
- C:\Windows\System\vOgSick.exe
  C:\Windows\System\vOgSick.exe
  2⤵
  PID:3324
- C:\Windows\System\dJOXSOZ.exe
  C:\Windows\System\dJOXSOZ.exe
  2⤵
  PID:3196
- C:\Windows\System\iPJQLWG.exe
  C:\Windows\System\iPJQLWG.exe
  2⤵
  PID:3132
- C:\Windows\System\BsnqDrc.exe
  C:\Windows\System\BsnqDrc.exe
  2⤵
  PID:1984
- C:\Windows\System\sZwVtyC.exe
  C:\Windows\System\sZwVtyC.exe
  2⤵
  PID:1304
- C:\Windows\System\ODwwjYa.exe
  C:\Windows\System\ODwwjYa.exe
  2⤵
  PID:2808
- C:\Windows\System\pycMPfC.exe
  C:\Windows\System\pycMPfC.exe
  2⤵
  PID:2236
- C:\Windows\System\uOoSohZ.exe
  C:\Windows\System\uOoSohZ.exe
  2⤵
  PID:2080
- C:\Windows\System\IqNmQzh.exe
  C:\Windows\System\IqNmQzh.exe
  2⤵
  PID:1708
- C:\Windows\System\ASsHtMQ.exe
  C:\Windows\System\ASsHtMQ.exe
  2⤵
  PID:2632
- C:\Windows\System\nGpBDXG.exe
  C:\Windows\System\nGpBDXG.exe
  2⤵
  PID:2172
- C:\Windows\System\qaGRlnG.exe
  C:\Windows\System\qaGRlnG.exe
  2⤵
  PID:1312
- C:\Windows\System\CTseVmw.exe
  C:\Windows\System\CTseVmw.exe
  2⤵
  PID:3000
- C:\Windows\System\jlylxDx.exe
  C:\Windows\System\jlylxDx.exe
  2⤵
  PID:2484
- C:\Windows\System\UpLGIzT.exe
  C:\Windows\System\UpLGIzT.exe
  2⤵
  PID:2320
- C:\Windows\System\cnjuFzu.exe
  C:\Windows\System\cnjuFzu.exe
  2⤵
  PID:5204
- C:\Windows\System\nFOgxiA.exe
  C:\Windows\System\nFOgxiA.exe
  2⤵
  PID:6592
- C:\Windows\System\ZMlXPCj.exe
  C:\Windows\System\ZMlXPCj.exe
  2⤵
  PID:6660
- C:\Windows\System\ijShFzD.exe
  C:\Windows\System\ijShFzD.exe
  2⤵
  PID:6704
- C:\Windows\System\nnwmrcG.exe
  C:\Windows\System\nnwmrcG.exe
  2⤵
  PID:6764
- C:\Windows\System\TTzKVPb.exe
  C:\Windows\System\TTzKVPb.exe
  2⤵
  PID:6804
- C:\Windows\System\GAkZJyP.exe
  C:\Windows\System\GAkZJyP.exe
  2⤵
  PID:6872
- C:\Windows\System\rrUewhd.exe
  C:\Windows\System\rrUewhd.exe
  2⤵
  PID:6940
- C:\Windows\System\efPAAbd.exe
  C:\Windows\System\efPAAbd.exe
  2⤵
  PID:6976
- C:\Windows\System\jhYvTrQ.exe
  C:\Windows\System\jhYvTrQ.exe
  2⤵
  PID:7040
- C:\Windows\System\UrVDcgD.exe
  C:\Windows\System\UrVDcgD.exe
  2⤵
  PID:6564
- C:\Windows\System\MwXztTT.exe
  C:\Windows\System\MwXztTT.exe
  2⤵
  PID:7112
- C:\Windows\System\pINYupN.exe
  C:\Windows\System\pINYupN.exe
  2⤵
  PID:5492
- C:\Windows\System\NDWvnmS.exe
  C:\Windows\System\NDWvnmS.exe
  2⤵
  PID:5752
- C:\Windows\System\wWLNGhQ.exe
  C:\Windows\System\wWLNGhQ.exe
  2⤵
  PID:6012
- C:\Windows\System\QHFqJAG.exe
  C:\Windows\System\QHFqJAG.exe
  2⤵
  PID:3752
- C:\Windows\System\aPyzUyG.exe
  C:\Windows\System\aPyzUyG.exe
  2⤵
  PID:4796
- C:\Windows\System\hzKXqZq.exe
  C:\Windows\System\hzKXqZq.exe
  2⤵
  PID:5128
- C:\Windows\System\nZoxHWd.exe
  C:\Windows\System\nZoxHWd.exe
  2⤵
  PID:2764
- C:\Windows\System\WnUzjft.exe
  C:\Windows\System\WnUzjft.exe
  2⤵
  PID:6388
- C:\Windows\System\TSnFyEX.exe
  C:\Windows\System\TSnFyEX.exe
  2⤵
  PID:1788
- C:\Windows\System\JBPKyxT.exe
  C:\Windows\System\JBPKyxT.exe
  2⤵
  PID:2328
- C:\Windows\System\RzyHEdj.exe
  C:\Windows\System\RzyHEdj.exe
  2⤵
  PID:6572
- C:\Windows\System\Ytvuujq.exe
  C:\Windows\System\Ytvuujq.exe
  2⤵
  PID:2960
- C:\Windows\System\NWspWAK.exe
  C:\Windows\System\NWspWAK.exe
  2⤵
  PID:5960
- C:\Windows\System\NHBsJCp.exe
  C:\Windows\System\NHBsJCp.exe
  2⤵
  PID:6648
- C:\Windows\System\vaavjbJ.exe
  C:\Windows\System\vaavjbJ.exe
  2⤵
  PID:6716
- C:\Windows\System\fJJtxcx.exe
  C:\Windows\System\fJJtxcx.exe
  2⤵
  PID:6784
- C:\Windows\System\SwbDxBE.exe
  C:\Windows\System\SwbDxBE.exe
  2⤵
  PID:6848
- C:\Windows\System\TLndWNS.exe
  C:\Windows\System\TLndWNS.exe
  2⤵
  PID:6888
- C:\Windows\System\vmGudGi.exe
  C:\Windows\System\vmGudGi.exe
  2⤵
  PID:6960
- C:\Windows\System\GArQLpM.exe
  C:\Windows\System\GArQLpM.exe
  2⤵
  PID:7028
- C:\Windows\System\DqevTnp.exe
  C:\Windows\System\DqevTnp.exe
  2⤵
  PID:7092
- C:\Windows\System\xetkqMV.exe
  C:\Windows\System\xetkqMV.exe
  2⤵
  PID:7128
- C:\Windows\System\iWIXXWH.exe
  C:\Windows\System\iWIXXWH.exe
  2⤵
  PID:5552
- C:\Windows\System\HdMNuWf.exe
  C:\Windows\System\HdMNuWf.exe
  2⤵
  PID:5688
- C:\Windows\System\NZYUPZe.exe
  C:\Windows\System\NZYUPZe.exe
  2⤵
  PID:5948
- C:\Windows\System\DNZyyTx.exe
  C:\Windows\System\DNZyyTx.exe
  2⤵
  PID:3496
- C:\Windows\System\GVJTImR.exe
  C:\Windows\System\GVJTImR.exe
  2⤵
  PID:4536
- C:\Windows\System\YmJEZYc.exe
  C:\Windows\System\YmJEZYc.exe
  2⤵
  PID:5072
- C:\Windows\System\xheaCKn.exe
  C:\Windows\System\xheaCKn.exe
  2⤵
  PID:1816
- C:\Windows\System\TJFTMAC.exe
  C:\Windows\System\TJFTMAC.exe
  2⤵
  PID:6324
- C:\Windows\System\MRzivgP.exe
  C:\Windows\System\MRzivgP.exe
  2⤵
  PID:2640
- C:\Windows\System\LoPISyR.exe
  C:\Windows\System\LoPISyR.exe
  2⤵
  PID:2284
- C:\Windows\System\kNTUZqe.exe
  C:\Windows\System\kNTUZqe.exe
  2⤵
  PID:5664
- C:\Windows\System\TWWWxUX.exe
  C:\Windows\System\TWWWxUX.exe
  2⤵
  PID:5836
- C:\Windows\System\VeholDS.exe
  C:\Windows\System\VeholDS.exe
  2⤵
  PID:6028
- C:\Windows\System\JoKAmDY.exe
  C:\Windows\System\JoKAmDY.exe
  2⤵
  PID:6092
- C:\Windows\System\AkLQFtC.exe
  C:\Windows\System\AkLQFtC.exe
  2⤵
  PID:776
- C:\Windows\System\iFFPGdW.exe
  C:\Windows\System\iFFPGdW.exe
  2⤵
  PID:3560
- C:\Windows\System\PcqIHHe.exe
  C:\Windows\System\PcqIHHe.exe
  2⤵
  PID:1776
- C:\Windows\System\hEZBGcH.exe
  C:\Windows\System\hEZBGcH.exe
  2⤵
  PID:3816
- C:\Windows\System\yjRZPsO.exe
  C:\Windows\System\yjRZPsO.exe
  2⤵
  PID:4924
- C:\Windows\System\AZHmKTd.exe
  C:\Windows\System\AZHmKTd.exe
  2⤵
  PID:4760
- C:\Windows\System\vNnppGD.exe
  C:\Windows\System\vNnppGD.exe
  2⤵
  PID:5264
- C:\Windows\System\wKmmaxu.exe
  C:\Windows\System\wKmmaxu.exe
  2⤵
  PID:6152
- C:\Windows\System\epGVnYU.exe
  C:\Windows\System\epGVnYU.exe
  2⤵
  PID:1332
- C:\Windows\System\LZindQx.exe
  C:\Windows\System\LZindQx.exe
  2⤵
  PID:1540
- C:\Windows\System\IqOBcgh.exe
  C:\Windows\System\IqOBcgh.exe
  2⤵
  PID:2556
- C:\Windows\System\uZHkKlA.exe
  C:\Windows\System\uZHkKlA.exe
  2⤵
  PID:2956
- C:\Windows\System\TIIhxFu.exe
  C:\Windows\System\TIIhxFu.exe
  2⤵
  PID:6372
- C:\Windows\System\sUWXIHl.exe
  C:\Windows\System\sUWXIHl.exe
  2⤵
  PID:6264
- C:\Windows\System\faBjPfG.exe
  C:\Windows\System\faBjPfG.exe
  2⤵
  PID:6340
- C:\Windows\System\isyeTjT.exe
  C:\Windows\System\isyeTjT.exe
  2⤵
  PID:2292
- C:\Windows\System\LdNvzIu.exe
  C:\Windows\System\LdNvzIu.exe
  2⤵
  PID:872
- C:\Windows\System\wPMCwmP.exe
  C:\Windows\System\wPMCwmP.exe
  2⤵
  PID:3008
- C:\Windows\System\TfGinBC.exe
  C:\Windows\System\TfGinBC.exe
  2⤵
  PID:3036
- C:\Windows\System\xmViUVG.exe
  C:\Windows\System\xmViUVG.exe
  2⤵
  PID:1944
- C:\Windows\System\MFyGgOU.exe
  C:\Windows\System\MFyGgOU.exe
  2⤵
  PID:6244
- C:\Windows\System\jTpJKeN.exe
  C:\Windows\System\jTpJKeN.exe
  2⤵
  PID:6440
- C:\Windows\System\jlfLRlw.exe
  C:\Windows\System\jlfLRlw.exe
  2⤵
  PID:1664
- C:\Windows\System\OwuDpry.exe
  C:\Windows\System\OwuDpry.exe
  2⤵
  PID:2176
- C:\Windows\System\LHFuxpk.exe
  C:\Windows\System\LHFuxpk.exe
  2⤵
  PID:2952
- C:\Windows\System\CjkillX.exe
  C:\Windows\System\CjkillX.exe
  2⤵
  PID:5412
- C:\Windows\System\tDqzTzU.exe
  C:\Windows\System\tDqzTzU.exe
  2⤵
  PID:576
- C:\Windows\System\sBNUtvB.exe
  C:\Windows\System\sBNUtvB.exe
  2⤵
  PID:2644
- C:\Windows\System\WDiLCzY.exe
  C:\Windows\System\WDiLCzY.exe
  2⤵
  PID:2592
- C:\Windows\System\OnjNmqq.exe
  C:\Windows\System\OnjNmqq.exe
  2⤵
  PID:1772
- C:\Windows\System\BXChmQi.exe
  C:\Windows\System\BXChmQi.exe
  2⤵
  PID:5344
- C:\Windows\System\QghrXko.exe
  C:\Windows\System\QghrXko.exe
  2⤵
  PID:4388
- C:\Windows\System\JJDuumt.exe
  C:\Windows\System\JJDuumt.exe
  2⤵
  PID:4136
- C:\Windows\System\FAiNltA.exe
  C:\Windows\System\FAiNltA.exe
  2⤵
  PID:3964
- C:\Windows\System\uaKgtgs.exe
  C:\Windows\System\uaKgtgs.exe
  2⤵
  PID:4552
- C:\Windows\System\vxTugwK.exe
  C:\Windows\System\vxTugwK.exe
  2⤵
  PID:4684
- C:\Windows\System\uwaAuZn.exe
  C:\Windows\System\uwaAuZn.exe
  2⤵
  PID:1100
- C:\Windows\System\DnmhWxY.exe
  C:\Windows\System\DnmhWxY.exe
  2⤵
  PID:5280
- C:\Windows\System\kpnsqsK.exe
  C:\Windows\System\kpnsqsK.exe
  2⤵
  PID:4032
- C:\Windows\System\HiIBvai.exe
  C:\Windows\System\HiIBvai.exe
  2⤵
  PID:4200
- C:\Windows\System\BiJFGts.exe
  C:\Windows\System\BiJFGts.exe
  2⤵
  PID:3832
- C:\Windows\System\mKfZqIa.exe
  C:\Windows\System\mKfZqIa.exe
  2⤵
  PID:3804
- C:\Windows\System\BIBUZfM.exe
  C:\Windows\System\BIBUZfM.exe
  2⤵
  PID:5376
- C:\Windows\System\hHBIAXV.exe
  C:\Windows\System\hHBIAXV.exe
  2⤵
  PID:3512
- C:\Windows\System\EPwkLqI.exe
  C:\Windows\System\EPwkLqI.exe
  2⤵
  PID:3420
- C:\Windows\System\pBkbykf.exe
  C:\Windows\System\pBkbykf.exe
  2⤵
  PID:3164
- C:\Windows\System\flnGphL.exe
  C:\Windows\System\flnGphL.exe
  2⤵
  PID:3288
- C:\Windows\System\GpyzsYi.exe
  C:\Windows\System\GpyzsYi.exe
  2⤵
  PID:1524
- C:\Windows\System\HerGXMv.exe
  C:\Windows\System\HerGXMv.exe
  2⤵
  PID:2388
- C:\Windows\System\yraNLGI.exe
  C:\Windows\System\yraNLGI.exe
  2⤵
  PID:2420
- C:\Windows\System\gNIQIuV.exe
  C:\Windows\System\gNIQIuV.exe
  2⤵
  PID:1604
- C:\Windows\System\jRBArae.exe
  C:\Windows\System\jRBArae.exe
  2⤵
  PID:6624
- C:\Windows\System\VumtMvi.exe
  C:\Windows\System\VumtMvi.exe
  2⤵
  PID:6868
- C:\Windows\System\dLrMeXZ.exe
  C:\Windows\System\dLrMeXZ.exe
  2⤵
  PID:7080
- C:\Windows\System\GtihniY.exe
  C:\Windows\System\GtihniY.exe
  2⤵
  PID:6008
- C:\Windows\System\DctHrel.exe
  C:\Windows\System\DctHrel.exe
  2⤵
  PID:2768
- C:\Windows\System\KNjBYSt.exe
  C:\Windows\System\KNjBYSt.exe
  2⤵
  PID:6772
- C:\Windows\System\RmXNmLY.exe
  C:\Windows\System\RmXNmLY.exe
  2⤵
  PID:5648
- C:\Windows\System\iPtMZet.exe
  C:\Windows\System\iPtMZet.exe
  2⤵
  PID:1632
- C:\Windows\System\ylXxSTl.exe
  C:\Windows\System\ylXxSTl.exe
  2⤵
  PID:2648
- C:\Windows\System\aSytLDB.exe
  C:\Windows\System\aSytLDB.exe
  2⤵
  PID:1648
- C:\Windows\System\gDxBtUv.exe
  C:\Windows\System\gDxBtUv.exe
  2⤵
  PID:6912
- C:\Windows\System\HdIpGEc.exe
  C:\Windows\System\HdIpGEc.exe
  2⤵
  PID:3724
- C:\Windows\System\ObGbWnH.exe
  C:\Windows\System\ObGbWnH.exe
  2⤵
  PID:4632
- C:\Windows\System\QMciRYv.exe
  C:\Windows\System\QMciRYv.exe
  2⤵
  PID:5476
- C:\Windows\System\qPdzvQU.exe
  C:\Windows\System\qPdzvQU.exe
  2⤵
  PID:6640
- C:\Windows\System\ileACaU.exe
  C:\Windows\System\ileACaU.exe
  2⤵
  PID:5816
- C:\Windows\System\DTfORvQ.exe
  C:\Windows\System\DTfORvQ.exe
  2⤵
  PID:5332
- C:\Windows\System\IdVJOpl.exe
  C:\Windows\System\IdVJOpl.exe
  2⤵
  PID:5668
- C:\Windows\System\nCesQXH.exe
  C:\Windows\System\nCesQXH.exe
  2⤵
  PID:3948
- C:\Windows\System\JGyrHVY.exe
  C:\Windows\System\JGyrHVY.exe
  2⤵
  PID:4468
- C:\Windows\System\iPYmTdC.exe
  C:\Windows\System\iPYmTdC.exe
  2⤵
  PID:5428
- C:\Windows\System\edtZsed.exe
  C:\Windows\System\edtZsed.exe
  2⤵
  PID:6308
- C:\Windows\System\DXVRVaJ.exe
  C:\Windows\System\DXVRVaJ.exe
  2⤵
  PID:2916
- C:\Windows\System\UXVYcsd.exe
  C:\Windows\System\UXVYcsd.exe
  2⤵
  PID:6076
- C:\Windows\System\nypEpFu.exe
  C:\Windows\System\nypEpFu.exe
  2⤵
  PID:1732
- C:\Windows\System\yBocqgP.exe
  C:\Windows\System\yBocqgP.exe
  2⤵
  PID:3432
- C:\Windows\System\qmhCtwx.exe
  C:\Windows\System\qmhCtwx.exe
  2⤵
  PID:5084
- C:\Windows\System\IfRhoBM.exe
  C:\Windows\System\IfRhoBM.exe
  2⤵
  PID:3024
- C:\Windows\System\LTVLbpJ.exe
  C:\Windows\System\LTVLbpJ.exe
  2⤵
  PID:6256
- C:\Windows\System\NYLZFIl.exe
  C:\Windows\System\NYLZFIl.exe
  2⤵
  PID:1960
- C:\Windows\System\qRIAaPG.exe
  C:\Windows\System\qRIAaPG.exe
  2⤵
  PID:848
- C:\Windows\System\hztYSTX.exe
  C:\Windows\System\hztYSTX.exe
  2⤵
  PID:2896
- C:\Windows\System\OjJbrEr.exe
  C:\Windows\System\OjJbrEr.exe
  2⤵
  PID:5408
- C:\Windows\System\uuiTUIP.exe
  C:\Windows\System\uuiTUIP.exe
  2⤵
  PID:1396
- C:\Windows\System\WIHhRVr.exe
  C:\Windows\System\WIHhRVr.exe
  2⤵
  PID:2288
- C:\Windows\System\iZtSTiV.exe
  C:\Windows\System\iZtSTiV.exe
  2⤵
  PID:2588
- C:\Windows\System\VCBbHHu.exe
  C:\Windows\System\VCBbHHu.exe
  2⤵
  PID:1488
- C:\Windows\System\IoIWDvK.exe
  C:\Windows\System\IoIWDvK.exe
  2⤵
  PID:4876
- C:\Windows\System\TProGUX.exe
  C:\Windows\System\TProGUX.exe
  2⤵
  PID:4260
- C:\Windows\System\oNIxAug.exe
  C:\Windows\System\oNIxAug.exe
  2⤵
  PID:4132
- C:\Windows\System\hdOoBUj.exe
  C:\Windows\System\hdOoBUj.exe
  2⤵
  PID:4712
- C:\Windows\System\UdRiHWZ.exe
  C:\Windows\System\UdRiHWZ.exe
  2⤵
  PID:3608
- C:\Windows\System\fBIaWsx.exe
  C:\Windows\System\fBIaWsx.exe
  2⤵
  PID:3904
- C:\Windows\System\wjTZBjN.exe
  C:\Windows\System\wjTZBjN.exe
  2⤵
  PID:3256
- C:\Windows\System\XORpBLI.exe
  C:\Windows\System\XORpBLI.exe
  2⤵
  PID:5884
- C:\Windows\System\iAIrtZU.exe
  C:\Windows\System\iAIrtZU.exe
  2⤵
  PID:4392
- C:\Windows\System\GzZIvuP.exe
  C:\Windows\System\GzZIvuP.exe
  2⤵
  PID:1532
- C:\Windows\System\MDYppKe.exe
  C:\Windows\System\MDYppKe.exe
  2⤵
  PID:4920
- C:\Windows\System\JOFJFdc.exe
  C:\Windows\System\JOFJFdc.exe
  2⤵
  PID:3516
- C:\Windows\System\riwgNHg.exe
  C:\Windows\System\riwgNHg.exe
  2⤵
  PID:4488
- C:\Windows\System\UGhyTFb.exe
  C:\Windows\System\UGhyTFb.exe
  2⤵
  PID:7008
- C:\Windows\System\tOnWPDZ.exe
  C:\Windows\System\tOnWPDZ.exe
  2⤵
  PID:1656
- C:\Windows\System\xDMmwAd.exe
  C:\Windows\System\xDMmwAd.exe
  2⤵
  PID:6972
- C:\Windows\System\FOOaMQk.exe
  C:\Windows\System\FOOaMQk.exe
  2⤵
  PID:2444
- C:\Windows\System\SITbuSN.exe
  C:\Windows\System\SITbuSN.exe
  2⤵
  PID:6464
- C:\Windows\System\WkEmwih.exe
  C:\Windows\System\WkEmwih.exe
  2⤵
  PID:6688
- C:\Windows\System\ksLsqPy.exe
  C:\Windows\System\ksLsqPy.exe
  2⤵
  PID:7064
- C:\Windows\System\MRIBZzS.exe
  C:\Windows\System\MRIBZzS.exe
  2⤵
  PID:6752
- C:\Windows\System\fQZbYuK.exe
  C:\Windows\System\fQZbYuK.exe
  2⤵
  PID:6856
- C:\Windows\System\RTfWPhh.exe
  C:\Windows\System\RTfWPhh.exe
  2⤵
  PID:488
- C:\Windows\System\VTJEsat.exe
  C:\Windows\System\VTJEsat.exe
  2⤵
  PID:3788
- C:\Windows\System\DzysZnX.exe
  C:\Windows\System\DzysZnX.exe
  2⤵
  PID:5268
- C:\Windows\System\tmKtLlc.exe
  C:\Windows\System\tmKtLlc.exe
  2⤵
  PID:2120
- C:\Windows\System\BatSMaK.exe
  C:\Windows\System\BatSMaK.exe
  2⤵
  PID:5584
- C:\Windows\System\NMpbjMr.exe
  C:\Windows\System\NMpbjMr.exe
  2⤵
  PID:5068
- C:\Windows\System\XfUFAWb.exe
  C:\Windows\System\XfUFAWb.exe
  2⤵
  PID:2824
- C:\Windows\System\uTpIHlz.exe
  C:\Windows\System\uTpIHlz.exe
  2⤵
  PID:5152
- C:\Windows\System\bxVcJrz.exe
  C:\Windows\System\bxVcJrz.exe
  2⤵
  PID:588
- C:\Windows\System\SPKEOVR.exe
  C:\Windows\System\SPKEOVR.exe
  2⤵
  PID:2136
- C:\Windows\System\XrAubCS.exe
  C:\Windows\System\XrAubCS.exe
  2⤵
  PID:240
- C:\Windows\System\lPTkPOS.exe
  C:\Windows\System\lPTkPOS.exe
  2⤵
  PID:3704
- C:\Windows\System\fzABQwO.exe
  C:\Windows\System\fzABQwO.exe
  2⤵
  PID:5444
- C:\Windows\System\idhmZEe.exe
  C:\Windows\System\idhmZEe.exe
  2⤵
  PID:4748
- C:\Windows\System\kaZWdlm.exe
  C:\Windows\System\kaZWdlm.exe
  2⤵
  PID:2964
- C:\Windows\System\UxMreow.exe
  C:\Windows\System\UxMreow.exe
  2⤵
  PID:3968
- C:\Windows\System\HXNbyiU.exe
  C:\Windows\System\HXNbyiU.exe
  2⤵
  PID:6732
- C:\Windows\System\XPzIMVc.exe
  C:\Windows\System\XPzIMVc.exe
  2⤵
  PID:5004
- C:\Windows\System\gWqSEPL.exe
  C:\Windows\System\gWqSEPL.exe
  2⤵
  PID:3768
- C:\Windows\System\ggfYHjr.exe
  C:\Windows\System\ggfYHjr.exe
  2⤵
  PID:1928
- C:\Windows\System\gTTmKhW.exe
  C:\Windows\System\gTTmKhW.exe
  2⤵
  PID:6928
- C:\Windows\System\RygDLvF.exe
  C:\Windows\System\RygDLvF.exe
  2⤵
  PID:5540
- C:\Windows\System\kWMVuvJ.exe
  C:\Windows\System\kWMVuvJ.exe
  2⤵
  PID:4048
- C:\Windows\System\TEtcoWz.exe
  C:\Windows\System\TEtcoWz.exe
  2⤵
  PID:3032
- C:\Windows\System\JXPJYmZ.exe
  C:\Windows\System\JXPJYmZ.exe
  2⤵
  PID:6644
- C:\Windows\System\otLUedw.exe
  C:\Windows\System\otLUedw.exe
  2⤵
  PID:2332
- C:\Windows\System\iKMUqPl.exe
  C:\Windows\System\iKMUqPl.exe
  2⤵
  PID:5932
- C:\Windows\System\lgbbStm.exe
  C:\Windows\System\lgbbStm.exe
  2⤵
  PID:6248
- C:\Windows\System\YZViCOo.exe
  C:\Windows\System\YZViCOo.exe
  2⤵
  PID:5992
- C:\Windows\System\hPlAzqZ.exe
  C:\Windows\System\hPlAzqZ.exe
  2⤵
  PID:6228
- C:\Windows\System\Gpfgmgp.exe
  C:\Windows\System\Gpfgmgp.exe
  2⤵
  PID:4408
- C:\Windows\System\LedLYXf.exe
  C:\Windows\System\LedLYXf.exe
  2⤵
  PID:6628
- C:\Windows\System\jCxLMjX.exe
  C:\Windows\System\jCxLMjX.exe
  2⤵
  PID:5684
- C:\Windows\System\UkJrxGu.exe
  C:\Windows\System\UkJrxGu.exe
  2⤵
  PID:984
- C:\Windows\System\ewhqmTy.exe
  C:\Windows\System\ewhqmTy.exe
  2⤵
  PID:4028
- C:\Windows\System\dSrDMhG.exe
  C:\Windows\System\dSrDMhG.exe
  2⤵
  PID:6956
- C:\Windows\System\WNQHmbU.exe
  C:\Windows\System\WNQHmbU.exe
  2⤵
  PID:5252
- C:\Windows\System\EopQZgL.exe
  C:\Windows\System\EopQZgL.exe
  2⤵
  PID:2724
- C:\Windows\System\eicElYr.exe
  C:\Windows\System\eicElYr.exe
  2⤵
  PID:5604
- C:\Windows\System\FSyQVDz.exe
  C:\Windows\System\FSyQVDz.exe
  2⤵
  PID:7180
- C:\Windows\System\yMCQqnT.exe
  C:\Windows\System\yMCQqnT.exe
  2⤵
  PID:7196
- C:\Windows\System\ICEVTnZ.exe
  C:\Windows\System\ICEVTnZ.exe
  2⤵
  PID:7212
- C:\Windows\System\hyzMbbW.exe
  C:\Windows\System\hyzMbbW.exe
  2⤵
  PID:7228
- C:\Windows\System\SDRjgJQ.exe
  C:\Windows\System\SDRjgJQ.exe
  2⤵
  PID:7244
- C:\Windows\System\kzntyfG.exe
  C:\Windows\System\kzntyfG.exe
  2⤵
  PID:7260
- C:\Windows\System\MUptgKe.exe
  C:\Windows\System\MUptgKe.exe
  2⤵
  PID:7276
- C:\Windows\System\Lbmefjp.exe
  C:\Windows\System\Lbmefjp.exe
  2⤵
  PID:7292
- C:\Windows\System\rbKUIRu.exe
  C:\Windows\System\rbKUIRu.exe
  2⤵
  PID:7308
- C:\Windows\System\YDLZHcx.exe
  C:\Windows\System\YDLZHcx.exe
  2⤵
  PID:7324
- C:\Windows\System\qMGFWtL.exe
  C:\Windows\System\qMGFWtL.exe
  2⤵
  PID:7348
- C:\Windows\System\UICaGiR.exe
  C:\Windows\System\UICaGiR.exe
  2⤵
  PID:7364
- C:\Windows\System\hKzWRYS.exe
  C:\Windows\System\hKzWRYS.exe
  2⤵
  PID:7380
- C:\Windows\System\KRrwSmD.exe
  C:\Windows\System\KRrwSmD.exe
  2⤵
  PID:7404
- C:\Windows\System\hvVgpEl.exe
  C:\Windows\System\hvVgpEl.exe
  2⤵
  PID:7424
- C:\Windows\System\GPEQcSy.exe
  C:\Windows\System\GPEQcSy.exe
  2⤵
  PID:7440
- C:\Windows\System\lvRuGbV.exe
  C:\Windows\System\lvRuGbV.exe
  2⤵
  PID:7456
- C:\Windows\System\AmlklIl.exe
  C:\Windows\System\AmlklIl.exe
  2⤵
  PID:7472
- C:\Windows\System\uOClsBi.exe
  C:\Windows\System\uOClsBi.exe
  2⤵
  PID:7488
- C:\Windows\System\xMPmbCX.exe
  C:\Windows\System\xMPmbCX.exe
  2⤵
  PID:7504
- C:\Windows\System\TgTFeug.exe
  C:\Windows\System\TgTFeug.exe
  2⤵
  PID:7520
- C:\Windows\System\oBEDMUt.exe
  C:\Windows\System\oBEDMUt.exe
  2⤵
  PID:7540
- C:\Windows\System\pIYIYdD.exe
  C:\Windows\System\pIYIYdD.exe
  2⤵
  PID:7556
- C:\Windows\System\VzWbDWI.exe
  C:\Windows\System\VzWbDWI.exe
  2⤵
  PID:7572
- C:\Windows\System\gAXNjnA.exe
  C:\Windows\System\gAXNjnA.exe
  2⤵
  PID:7592
- C:\Windows\System\psWeeaU.exe
  C:\Windows\System\psWeeaU.exe
  2⤵
  PID:7608
- C:\Windows\System\wGpisTg.exe
  C:\Windows\System\wGpisTg.exe
  2⤵
  PID:7624
- C:\Windows\System\KyZkUuy.exe
  C:\Windows\System\KyZkUuy.exe
  2⤵
  PID:7640
- C:\Windows\System\ykweqJo.exe
  C:\Windows\System\ykweqJo.exe
  2⤵
  PID:7656
- C:\Windows\System\OAWnoEp.exe
  C:\Windows\System\OAWnoEp.exe
  2⤵
  PID:7676
- C:\Windows\System\MeMaMTM.exe
  C:\Windows\System\MeMaMTM.exe
  2⤵
  PID:7692
- C:\Windows\System\SGvmVSx.exe
  C:\Windows\System\SGvmVSx.exe
  2⤵
  PID:7708
- C:\Windows\System\bkcKLqJ.exe
  C:\Windows\System\bkcKLqJ.exe
  2⤵
  PID:7724
- C:\Windows\System\mUbLIJD.exe
  C:\Windows\System\mUbLIJD.exe
  2⤵
  PID:7744
- C:\Windows\System\obbPjSb.exe
  C:\Windows\System\obbPjSb.exe
  2⤵
  PID:7760
- C:\Windows\System\XSmhsce.exe
  C:\Windows\System\XSmhsce.exe
  2⤵
  PID:7776
- C:\Windows\System\ymKvgHx.exe
  C:\Windows\System\ymKvgHx.exe
  2⤵
  PID:7792
- C:\Windows\System\NlLBtVy.exe
  C:\Windows\System\NlLBtVy.exe
  2⤵
  PID:7808
- C:\Windows\System\LYeXkvw.exe
  C:\Windows\System\LYeXkvw.exe
  2⤵
  PID:7824
- C:\Windows\System\hRyIbgX.exe
  C:\Windows\System\hRyIbgX.exe
  2⤵
  PID:7840
- C:\Windows\System\McEutTF.exe
  C:\Windows\System\McEutTF.exe
  2⤵
  PID:7856
- C:\Windows\System\gUINjec.exe
  C:\Windows\System\gUINjec.exe
  2⤵
  PID:7872
- C:\Windows\System\MJsQPLA.exe
  C:\Windows\System\MJsQPLA.exe
  2⤵
  PID:7888
- C:\Windows\System\PpoUHIV.exe
  C:\Windows\System\PpoUHIV.exe
  2⤵
  PID:7904
- C:\Windows\System\kwgQaYz.exe
  C:\Windows\System\kwgQaYz.exe
  2⤵
  PID:7920
- C:\Windows\System\iOBickS.exe
  C:\Windows\System\iOBickS.exe
  2⤵
  PID:7936
- C:\Windows\System\iUzwhEQ.exe
  C:\Windows\System\iUzwhEQ.exe
  2⤵
  PID:7952
- C:\Windows\System\hbNoRvk.exe
  C:\Windows\System\hbNoRvk.exe
  2⤵
  PID:7968
- C:\Windows\System\tDeXWMW.exe
  C:\Windows\System\tDeXWMW.exe
  2⤵
  PID:7984
- C:\Windows\System\bbaKxnU.exe
  C:\Windows\System\bbaKxnU.exe
  2⤵
  PID:8000
- C:\Windows\System\RQfJmks.exe
  C:\Windows\System\RQfJmks.exe
  2⤵
  PID:8016
- C:\Windows\System\qIIlfvj.exe
  C:\Windows\System\qIIlfvj.exe
  2⤵
  PID:8032
- C:\Windows\System\FojJZFD.exe
  C:\Windows\System\FojJZFD.exe
  2⤵
  PID:8048
- C:\Windows\System\bEhVaUh.exe
  C:\Windows\System\bEhVaUh.exe
  2⤵
  PID:8064
- C:\Windows\System\lqrAhkd.exe
  C:\Windows\System\lqrAhkd.exe
  2⤵
  PID:8080
- C:\Windows\System\EXZTSGP.exe
  C:\Windows\System\EXZTSGP.exe
  2⤵
  PID:8096
- C:\Windows\System\IqFSIKE.exe
  C:\Windows\System\IqFSIKE.exe
  2⤵
  PID:8112
- C:\Windows\System\kNPJQrC.exe
  C:\Windows\System\kNPJQrC.exe
  2⤵
  PID:8128
- C:\Windows\System\VpeRtzW.exe
  C:\Windows\System\VpeRtzW.exe
  2⤵
  PID:8144
- C:\Windows\System\bJwhIJW.exe
  C:\Windows\System\bJwhIJW.exe
  2⤵
  PID:8160
- C:\Windows\System\aiZZWMb.exe
  C:\Windows\System\aiZZWMb.exe
  2⤵
  PID:8176
- C:\Windows\System\CjLVTfO.exe
  C:\Windows\System\CjLVTfO.exe
  2⤵
  PID:4452
- C:\Windows\System\kMvZPWp.exe
  C:\Windows\System\kMvZPWp.exe
  2⤵
  PID:2464
- C:\Windows\System\cNVkwBn.exe
  C:\Windows\System\cNVkwBn.exe
  2⤵
  PID:7224
- C:\Windows\System\oJFmMgR.exe
  C:\Windows\System\oJFmMgR.exe
  2⤵
  PID:3448
- C:\Windows\System\EnRjjGR.exe
  C:\Windows\System\EnRjjGR.exe
  2⤵
  PID:6748
- C:\Windows\System\CGkJoBW.exe
  C:\Windows\System\CGkJoBW.exe
  2⤵
  PID:2924
- C:\Windows\System\pOLMVXR.exe
  C:\Windows\System\pOLMVXR.exe
  2⤵
  PID:6820
- C:\Windows\System\mvhaMCS.exe
  C:\Windows\System\mvhaMCS.exe
  2⤵
  PID:7272
- C:\Windows\System\ubPjaMz.exe
  C:\Windows\System\ubPjaMz.exe
  2⤵
  PID:7300
- C:\Windows\System\UHEybSK.exe
  C:\Windows\System\UHEybSK.exe
  2⤵
  PID:7304
- C:\Windows\System\BUPFGNf.exe
  C:\Windows\System\BUPFGNf.exe
  2⤵
  PID:7344
- C:\Windows\System\TDQRAiZ.exe
  C:\Windows\System\TDQRAiZ.exe
  2⤵
  PID:7376
- C:\Windows\System\exCVFSd.exe
  C:\Windows\System\exCVFSd.exe
  2⤵
  PID:7400
- C:\Windows\System\dUgIATs.exe
  C:\Windows\System\dUgIATs.exe
  2⤵
  PID:7448
- C:\Windows\System\tpQMsTN.exe
  C:\Windows\System\tpQMsTN.exe
  2⤵
  PID:7532
- C:\Windows\System\qIzZWTe.exe
  C:\Windows\System\qIzZWTe.exe
  2⤵
  PID:7632
- C:\Windows\System\YdDZRii.exe
  C:\Windows\System\YdDZRii.exe
  2⤵
  PID:7580
- C:\Windows\System\aPoTxHw.exe
  C:\Windows\System\aPoTxHw.exe
  2⤵
  PID:7716
- C:\Windows\System\iSjTLKY.exe
  C:\Windows\System\iSjTLKY.exe
  2⤵
  PID:7652
- C:\Windows\System\GYCEvJR.exe
  C:\Windows\System\GYCEvJR.exe
  2⤵
  PID:7468
- C:\Windows\System\RhmVJOS.exe
  C:\Windows\System\RhmVJOS.exe
  2⤵
  PID:7752
- C:\Windows\System\gqoTdie.exe
  C:\Windows\System\gqoTdie.exe
  2⤵
  PID:7636
- C:\Windows\System\oTNwkkh.exe
  C:\Windows\System\oTNwkkh.exe
  2⤵
  PID:7732
- C:\Windows\System\xElnmaP.exe
  C:\Windows\System\xElnmaP.exe
  2⤵
  PID:7788
- C:\Windows\System\pjUpPmf.exe
  C:\Windows\System\pjUpPmf.exe
  2⤵
  PID:7836
- C:\Windows\System\wnwYCXh.exe
  C:\Windows\System\wnwYCXh.exe
  2⤵
  PID:7900
- C:\Windows\System\nfnIdmK.exe
  C:\Windows\System\nfnIdmK.exe
  2⤵
  PID:7960
- C:\Windows\System\BZxVYsw.exe
  C:\Windows\System\BZxVYsw.exe
  2⤵
  PID:8024
- C:\Windows\System\TZwGARw.exe
  C:\Windows\System\TZwGARw.exe
  2⤵
  PID:7820
- C:\Windows\System\aaOkbTB.exe
  C:\Windows\System\aaOkbTB.exe
  2⤵
  PID:8088
- C:\Windows\System\ZpIVBMz.exe
  C:\Windows\System\ZpIVBMz.exe
  2⤵
  PID:8152
- C:\Windows\System\oiJWOzx.exe
  C:\Windows\System\oiJWOzx.exe
  2⤵
  PID:8040
- C:\Windows\System\LqUKPWD.exe
  C:\Windows\System\LqUKPWD.exe
  2⤵
  PID:7912
- C:\Windows\System\csitLWa.exe
  C:\Windows\System\csitLWa.exe
  2⤵
  PID:8168
- C:\Windows\System\CZKXcoI.exe
  C:\Windows\System\CZKXcoI.exe
  2⤵
  PID:8108
- C:\Windows\System\cqMOEPM.exe
  C:\Windows\System\cqMOEPM.exe
  2⤵
  PID:3576
- C:\Windows\System\rqsedBI.exe
  C:\Windows\System\rqsedBI.exe
  2⤵
  PID:8184
- C:\Windows\System\GINYZuz.exe
  C:\Windows\System\GINYZuz.exe
  2⤵
  PID:4548
- C:\Windows\System\gCceqNg.exe
  C:\Windows\System\gCceqNg.exe
  2⤵
  PID:2884
- C:\Windows\System\pRzGgdp.exe
  C:\Windows\System\pRzGgdp.exe
  2⤵
  PID:6556
- C:\Windows\System\tDDuoeY.exe
  C:\Windows\System\tDDuoeY.exe
  2⤵
  PID:7208
- C:\Windows\System\qmuMDnS.exe
  C:\Windows\System\qmuMDnS.exe
  2⤵
  PID:7396
- C:\Windows\System\XbxqVYB.exe
  C:\Windows\System\XbxqVYB.exe
  2⤵
  PID:7600
- C:\Windows\System\wwFYhNE.exe
  C:\Windows\System\wwFYhNE.exe
  2⤵
  PID:7568
- C:\Windows\System\bkmETOY.exe
  C:\Windows\System\bkmETOY.exe
  2⤵
  PID:7512
- C:\Windows\System\UfSZUcT.exe
  C:\Windows\System\UfSZUcT.exe
  2⤵
  PID:7620
- C:\Windows\System\iVuFxRG.exe
  C:\Windows\System\iVuFxRG.exe
  2⤵
  PID:7464
- C:\Windows\System\uksNVOz.exe
  C:\Windows\System\uksNVOz.exe
  2⤵
  PID:7868
- C:\Windows\System\kGXNsNl.exe
  C:\Windows\System\kGXNsNl.exe
  2⤵
  PID:7852
- C:\Windows\System\AJhhjeL.exe
  C:\Windows\System\AJhhjeL.exe
  2⤵
  PID:8012
- C:\Windows\System\oKtozfZ.exe
  C:\Windows\System\oKtozfZ.exe
  2⤵
  PID:5724
- C:\Windows\System\InvQVyg.exe
  C:\Windows\System\InvQVyg.exe
  2⤵
  PID:2676
- C:\Windows\System\ChsMyur.exe
  C:\Windows\System\ChsMyur.exe
  2⤵
  PID:4328
- C:\Windows\System\yQvzwaA.exe
  C:\Windows\System\yQvzwaA.exe
  2⤵
  PID:8076
- C:\Windows\System\pHkzgyt.exe
  C:\Windows\System\pHkzgyt.exe
  2⤵
  PID:7804
- C:\Windows\System\iESLNCh.exe
  C:\Windows\System\iESLNCh.exe
  2⤵
  PID:8124
- C:\Windows\System\phmPzFR.exe
  C:\Windows\System\phmPzFR.exe
  2⤵
  PID:7236
- C:\Windows\System\rlAUuDR.exe
  C:\Windows\System\rlAUuDR.exe
  2⤵
  PID:7496
- C:\Windows\System\DitrFky.exe
  C:\Windows\System\DitrFky.exe
  2⤵
  PID:7756
- C:\Windows\System\tYVzaEs.exe
  C:\Windows\System\tYVzaEs.exe
  2⤵
  PID:7688
- C:\Windows\System\OXsTgUx.exe
  C:\Windows\System\OXsTgUx.exe
  2⤵
  PID:7420
- C:\Windows\System\tovxWLk.exe
  C:\Windows\System\tovxWLk.exe
  2⤵
  PID:7704
- C:\Windows\System\IfIegKF.exe
  C:\Windows\System\IfIegKF.exe
  2⤵
  PID:8104
- C:\Windows\System\lVZADEk.exe
  C:\Windows\System\lVZADEk.exe
  2⤵
  PID:7392
- C:\Windows\System\XagNeuc.exe
  C:\Windows\System\XagNeuc.exe
  2⤵
  PID:7996
- C:\Windows\System\pugeJAn.exe
  C:\Windows\System\pugeJAn.exe
  2⤵
  PID:8208
- C:\Windows\System\IjhhYro.exe
  C:\Windows\System\IjhhYro.exe
  2⤵
  PID:8228
- C:\Windows\System\aqNlXUe.exe
  C:\Windows\System\aqNlXUe.exe
  2⤵
  PID:8244
- C:\Windows\System\konuNeA.exe
  C:\Windows\System\konuNeA.exe
  2⤵
  PID:8260
- C:\Windows\System\kgInIne.exe
  C:\Windows\System\kgInIne.exe
  2⤵
  PID:8276
- C:\Windows\System\dmwzUGz.exe
  C:\Windows\System\dmwzUGz.exe
  2⤵
  PID:8292
- C:\Windows\System\rtkZFcA.exe
  C:\Windows\System\rtkZFcA.exe
  2⤵
  PID:8308
- C:\Windows\System\tQrkwPa.exe
  C:\Windows\System\tQrkwPa.exe
  2⤵
  PID:8324
- C:\Windows\System\ewwTlGf.exe
  C:\Windows\System\ewwTlGf.exe
  2⤵
  PID:8340
- C:\Windows\System\AgORunV.exe
  C:\Windows\System\AgORunV.exe
  2⤵
  PID:8356
- C:\Windows\System\XYfDtOs.exe
  C:\Windows\System\XYfDtOs.exe
  2⤵
  PID:8372
- C:\Windows\System\WXgxrue.exe
  C:\Windows\System\WXgxrue.exe
  2⤵
  PID:8388
- C:\Windows\System\fpeoMns.exe
  C:\Windows\System\fpeoMns.exe
  2⤵
  PID:8404
- C:\Windows\System\CwfXcrb.exe
  C:\Windows\System\CwfXcrb.exe
  2⤵
  PID:8420
- C:\Windows\System\YgWIvMG.exe
  C:\Windows\System\YgWIvMG.exe
  2⤵
  PID:8436
- C:\Windows\System\lmjpGNQ.exe
  C:\Windows\System\lmjpGNQ.exe
  2⤵
  PID:8452
- C:\Windows\System\lJtywMr.exe
  C:\Windows\System\lJtywMr.exe
  2⤵
  PID:8468
- C:\Windows\System\MVZzeff.exe
  C:\Windows\System\MVZzeff.exe
  2⤵
  PID:8484
- C:\Windows\System\uPrLxmw.exe
  C:\Windows\System\uPrLxmw.exe
  2⤵
  PID:8500
- C:\Windows\System\HHRPqJP.exe
  C:\Windows\System\HHRPqJP.exe
  2⤵
  PID:8516
- C:\Windows\System\EfyqDqR.exe
  C:\Windows\System\EfyqDqR.exe
  2⤵
  PID:8532
- C:\Windows\System\DKkUbdy.exe
  C:\Windows\System\DKkUbdy.exe
  2⤵
  PID:8548
- C:\Windows\System\tHtxdAk.exe
  C:\Windows\System\tHtxdAk.exe
  2⤵
  PID:8564
- C:\Windows\System\dGSuLKE.exe
  C:\Windows\System\dGSuLKE.exe
  2⤵
  PID:8580
- C:\Windows\System\FxjwHLc.exe
  C:\Windows\System\FxjwHLc.exe
  2⤵
  PID:8596
- C:\Windows\System\QvLuWrC.exe
  C:\Windows\System\QvLuWrC.exe
  2⤵
  PID:8612
- C:\Windows\System\NLxDTnX.exe
  C:\Windows\System\NLxDTnX.exe
  2⤵
  PID:8628
- C:\Windows\System\qEECqII.exe
  C:\Windows\System\qEECqII.exe
  2⤵
  PID:8644
- C:\Windows\System\obgbTuh.exe
  C:\Windows\System\obgbTuh.exe
  2⤵
  PID:8660
- C:\Windows\System\ICExkUv.exe
  C:\Windows\System\ICExkUv.exe
  2⤵
  PID:8676
- C:\Windows\System\LyUHROn.exe
  C:\Windows\System\LyUHROn.exe
  2⤵
  PID:8692
- C:\Windows\System\riSaTCM.exe
  C:\Windows\System\riSaTCM.exe
  2⤵
  PID:8708
- C:\Windows\System\PEOUnHc.exe
  C:\Windows\System\PEOUnHc.exe
  2⤵
  PID:8724
- C:\Windows\System\wrPgomH.exe
  C:\Windows\System\wrPgomH.exe
  2⤵
  PID:8740
- C:\Windows\System\gNhlKmj.exe
  C:\Windows\System\gNhlKmj.exe
  2⤵
  PID:8756
- C:\Windows\System\WPLZThB.exe
  C:\Windows\System\WPLZThB.exe
  2⤵
  PID:8772
- C:\Windows\System\cSovNFO.exe
  C:\Windows\System\cSovNFO.exe
  2⤵
  PID:8792
- C:\Windows\System\bjXSmWd.exe
  C:\Windows\System\bjXSmWd.exe
  2⤵
  PID:8812
- C:\Windows\System\FHbFxYW.exe
  C:\Windows\System\FHbFxYW.exe
  2⤵
  PID:8828
- C:\Windows\System\OuXBdll.exe
  C:\Windows\System\OuXBdll.exe
  2⤵
  PID:8844
- C:\Windows\System\LPoFRIc.exe
  C:\Windows\System\LPoFRIc.exe
  2⤵
  PID:8860
- C:\Windows\System\HhUcmuL.exe
  C:\Windows\System\HhUcmuL.exe
  2⤵
  PID:8876
- C:\Windows\System\fOiQXPZ.exe
  C:\Windows\System\fOiQXPZ.exe
  2⤵
  PID:8892
- C:\Windows\System\TLzGCUh.exe
  C:\Windows\System\TLzGCUh.exe
  2⤵
  PID:8908
- C:\Windows\System\IXNtLsI.exe
  C:\Windows\System\IXNtLsI.exe
  2⤵
  PID:8924
- C:\Windows\System\oCiLsUa.exe
  C:\Windows\System\oCiLsUa.exe
  2⤵
  PID:8940
- C:\Windows\System\dCymABz.exe
  C:\Windows\System\dCymABz.exe
  2⤵
  PID:8956
- C:\Windows\System\hLVZiZi.exe
  C:\Windows\System\hLVZiZi.exe
  2⤵
  PID:8976
- C:\Windows\System\kaWqdde.exe
  C:\Windows\System\kaWqdde.exe
  2⤵
  PID:8992
- C:\Windows\System\lhMxGRO.exe
  C:\Windows\System\lhMxGRO.exe
  2⤵
  PID:9012
- C:\Windows\System\CAQOSuo.exe
  C:\Windows\System\CAQOSuo.exe
  2⤵
  PID:9028
- C:\Windows\System\HjJSWhi.exe
  C:\Windows\System\HjJSWhi.exe
  2⤵
  PID:9044
- C:\Windows\System\fKYEfci.exe
  C:\Windows\System\fKYEfci.exe
  2⤵
  PID:9068
- C:\Windows\System\HEZpAEo.exe
  C:\Windows\System\HEZpAEo.exe
  2⤵
  PID:9084
- C:\Windows\System\VOYZUUT.exe
  C:\Windows\System\VOYZUUT.exe
  2⤵
  PID:9100
- C:\Windows\System\krIrmlz.exe
  C:\Windows\System\krIrmlz.exe
  2⤵
  PID:9124
- C:\Windows\System\qXsgYTW.exe
  C:\Windows\System\qXsgYTW.exe
  2⤵
  PID:9148
- C:\Windows\System\sPAPYgt.exe
  C:\Windows\System\sPAPYgt.exe
  2⤵
  PID:9168
- C:\Windows\System\JOLShFK.exe
  C:\Windows\System\JOLShFK.exe
  2⤵
  PID:9184
- C:\Windows\System\eUrukWO.exe
  C:\Windows\System\eUrukWO.exe
  2⤵
  PID:9204
- C:\Windows\System\dUJMVtR.exe
  C:\Windows\System\dUJMVtR.exe
  2⤵
  PID:7992
- C:\Windows\System\IKxRFym.exe
  C:\Windows\System\IKxRFym.exe
  2⤵
  PID:7288
- C:\Windows\System\yfAXcRa.exe
  C:\Windows\System\yfAXcRa.exe
  2⤵
  PID:7616
- C:\Windows\System\zLsLfRE.exe
  C:\Windows\System\zLsLfRE.exe
  2⤵
  PID:7684
- C:\Windows\System\lpPreUO.exe
  C:\Windows\System\lpPreUO.exe
  2⤵
  PID:7564
- C:\Windows\System\RckrLSp.exe
  C:\Windows\System\RckrLSp.exe
  2⤵
  PID:8216
- C:\Windows\System\AHCaRHi.exe
  C:\Windows\System\AHCaRHi.exe
  2⤵
  PID:8252
- C:\Windows\System\BxXBaTM.exe
  C:\Windows\System\BxXBaTM.exe
  2⤵
  PID:8320
- C:\Windows\System\SjpbhEJ.exe
  C:\Windows\System\SjpbhEJ.exe
  2⤵
  PID:8256
- C:\Windows\System\hAtHVEX.exe
  C:\Windows\System\hAtHVEX.exe
  2⤵
  PID:7736
- C:\Windows\System\jmBgBcb.exe
  C:\Windows\System\jmBgBcb.exe
  2⤵
  PID:8332
- C:\Windows\System\jeHibuc.exe
  C:\Windows\System\jeHibuc.exe
  2⤵
  PID:8480
- C:\Windows\System\yRIIDzE.exe
  C:\Windows\System\yRIIDzE.exe
  2⤵
  PID:8540
- C:\Windows\System\EHfJUjE.exe
  C:\Windows\System\EHfJUjE.exe
  2⤵
  PID:8268
- C:\Windows\System\uKiUgVF.exe
  C:\Windows\System\uKiUgVF.exe
  2⤵
  PID:8460
- C:\Windows\System\bQIewWv.exe
  C:\Windows\System\bQIewWv.exe
  2⤵
  PID:8604
- C:\Windows\System\pwhPJbz.exe
  C:\Windows\System\pwhPJbz.exe
  2⤵
  PID:8492
- C:\Windows\System\OnDxeDU.exe
  C:\Windows\System\OnDxeDU.exe
  2⤵
  PID:8592
- C:\Windows\System\kkLbAhX.exe
  C:\Windows\System\kkLbAhX.exe
  2⤵
  PID:8624
- C:\Windows\System\evUqEDR.exe
  C:\Windows\System\evUqEDR.exe
  2⤵
  PID:8684
- C:\Windows\System\Rztasin.exe
  C:\Windows\System\Rztasin.exe
  2⤵
  PID:8748
- C:\Windows\System\PwJMYNX.exe
  C:\Windows\System\PwJMYNX.exe
  2⤵
  PID:8788
- C:\Windows\System\undlNGB.exe
  C:\Windows\System\undlNGB.exe
  2⤵
  PID:8732
- C:\Windows\System\mNEiCmh.exe
  C:\Windows\System\mNEiCmh.exe
  2⤵
  PID:8800
- C:\Windows\System\ZpmksIu.exe
  C:\Windows\System\ZpmksIu.exe
  2⤵
  PID:8888
- C:\Windows\System\eToKbBp.exe
  C:\Windows\System\eToKbBp.exe
  2⤵
  PID:8916
- C:\Windows\System\vNofMzE.exe
  C:\Windows\System\vNofMzE.exe
  2⤵
  PID:8668
- C:\Windows\System\ZuohYOw.exe
  C:\Windows\System\ZuohYOw.exe
  2⤵
  PID:9108
- C:\Windows\System\HLIUscj.exe
  C:\Windows\System\HLIUscj.exe
  2⤵
  PID:9036
- C:\Windows\System\BmRgzix.exe
  C:\Windows\System\BmRgzix.exe
  2⤵
  PID:9056
- C:\Windows\System\dWUobmN.exe
  C:\Windows\System\dWUobmN.exe
  2⤵
  PID:9116
- C:\Windows\System\yrCCHpo.exe
  C:\Windows\System\yrCCHpo.exe
  2⤵
  PID:9132
- C:\Windows\System\OeyItdH.exe
  C:\Windows\System\OeyItdH.exe
  2⤵
  PID:9196
- C:\Windows\System\SoJzEgq.exe
  C:\Windows\System\SoJzEgq.exe
  2⤵
  PID:8120
- C:\Windows\System\oWzYjlR.exe
  C:\Windows\System\oWzYjlR.exe
  2⤵
  PID:9180
- C:\Windows\System\XIaNUeD.exe
  C:\Windows\System\XIaNUeD.exe
  2⤵
  PID:8316
- C:\Windows\System\bcwYGqf.exe
  C:\Windows\System\bcwYGqf.exe
  2⤵
  PID:8476
- C:\Windows\System\EMvlTOO.exe
  C:\Windows\System\EMvlTOO.exe
  2⤵
  PID:7720
- C:\Windows\System\YpixLdA.exe
  C:\Windows\System\YpixLdA.exe
  2⤵
  PID:8224
- C:\Windows\System\SzMkMaL.exe
  C:\Windows\System\SzMkMaL.exe
  2⤵
  PID:8352
- C:\Windows\System\ipIMXEo.exe
  C:\Windows\System\ipIMXEo.exe
  2⤵
  PID:8428
- C:\Windows\System\PdHjARB.exe
  C:\Windows\System\PdHjARB.exe
  2⤵
  PID:8368
- C:\Windows\System\UfiMMQH.exe
  C:\Windows\System\UfiMMQH.exe
  2⤵
  PID:8720
- C:\Windows\System\arUHfvQ.exe
  C:\Windows\System\arUHfvQ.exe
  2⤵
  PID:8588
- C:\Windows\System\VblyXyI.exe
  C:\Windows\System\VblyXyI.exe
  2⤵
  PID:8528
- C:\Windows\System\kFYmSoW.exe
  C:\Windows\System\kFYmSoW.exe
  2⤵
  PID:8784
- C:\Windows\System\aYICzna.exe
  C:\Windows\System\aYICzna.exe
  2⤵
  PID:8948
- C:\Windows\System\ByuQpLz.exe
  C:\Windows\System\ByuQpLz.exe
  2⤵
  PID:8700
- C:\Windows\System\kgADbnE.exe
  C:\Windows\System\kgADbnE.exe
  2⤵
  PID:9040
- C:\Windows\System\icKsoDA.exe
  C:\Windows\System\icKsoDA.exe
  2⤵
  PID:9192
- C:\Windows\System\RcfPPBh.exe
  C:\Windows\System\RcfPPBh.exe
  2⤵
  PID:9220
- C:\Windows\System\RyxbhBS.exe
  C:\Windows\System\RyxbhBS.exe
  2⤵
  PID:9236
- C:\Windows\System\NZOkayG.exe
  C:\Windows\System\NZOkayG.exe
  2⤵
  PID:9252
- C:\Windows\System\vyGJnIE.exe
  C:\Windows\System\vyGJnIE.exe
  2⤵
  PID:9268
- C:\Windows\System\IXiHROb.exe
  C:\Windows\System\IXiHROb.exe
  2⤵
  PID:9284
- C:\Windows\System\NwRFiGa.exe
  C:\Windows\System\NwRFiGa.exe
  2⤵
  PID:9300
- C:\Windows\System\DxWHkUa.exe
  C:\Windows\System\DxWHkUa.exe
  2⤵
  PID:9316
- C:\Windows\System\ilHEVmz.exe
  C:\Windows\System\ilHEVmz.exe
  2⤵
  PID:9332
- C:\Windows\System\ecxfDAT.exe
  C:\Windows\System\ecxfDAT.exe
  2⤵
  PID:9348
- C:\Windows\System\ldOdWsc.exe
  C:\Windows\System\ldOdWsc.exe
  2⤵
  PID:9364
- C:\Windows\System\TwuoAcv.exe
  C:\Windows\System\TwuoAcv.exe
  2⤵
  PID:9380
- C:\Windows\System\jXJzWFW.exe
  C:\Windows\System\jXJzWFW.exe
  2⤵
  PID:9396
- C:\Windows\System\NyNsCBj.exe
  C:\Windows\System\NyNsCBj.exe
  2⤵
  PID:9412
- C:\Windows\System\fIhwflj.exe
  C:\Windows\System\fIhwflj.exe
  2⤵
  PID:9428
- C:\Windows\System\ohLYyXx.exe
  C:\Windows\System\ohLYyXx.exe
  2⤵
  PID:9444
- C:\Windows\System\QzCWkCK.exe
  C:\Windows\System\QzCWkCK.exe
  2⤵
  PID:9464
- C:\Windows\System\EUJKYrE.exe
  C:\Windows\System\EUJKYrE.exe
  2⤵
  PID:9480
- C:\Windows\System\KduriuS.exe
  C:\Windows\System\KduriuS.exe
  2⤵
  PID:9496
- C:\Windows\System\NadtPlN.exe
  C:\Windows\System\NadtPlN.exe
  2⤵
  PID:9512
- C:\Windows\System\PphkeSL.exe
  C:\Windows\System\PphkeSL.exe
  2⤵
  PID:9528
- C:\Windows\System\WSvaQtR.exe
  C:\Windows\System\WSvaQtR.exe
  2⤵
  PID:9544
- C:\Windows\System\cdKMHdw.exe
  C:\Windows\System\cdKMHdw.exe
  2⤵
  PID:9560
- C:\Windows\System\HTXJHcm.exe
  C:\Windows\System\HTXJHcm.exe
  2⤵
  PID:9576
- C:\Windows\System\wXbuzlS.exe
  C:\Windows\System\wXbuzlS.exe
  2⤵
  PID:9592
- C:\Windows\System\AXJckdy.exe
  C:\Windows\System\AXJckdy.exe
  2⤵
  PID:9608
- C:\Windows\System\dRpvMcB.exe
  C:\Windows\System\dRpvMcB.exe
  2⤵
  PID:9624
- C:\Windows\System\jVmWNCN.exe
  C:\Windows\System\jVmWNCN.exe
  2⤵
  PID:9640
- C:\Windows\System\SJPhjEr.exe
  C:\Windows\System\SJPhjEr.exe
  2⤵
  PID:9656
- C:\Windows\System\thvDMvU.exe
  C:\Windows\System\thvDMvU.exe
  2⤵
  PID:9672
- C:\Windows\System\WgCaVPR.exe
  C:\Windows\System\WgCaVPR.exe
  2⤵
  PID:9688
- C:\Windows\System\ufNYAas.exe
  C:\Windows\System\ufNYAas.exe
  2⤵
  PID:9704
- C:\Windows\System\SoHNylD.exe
  C:\Windows\System\SoHNylD.exe
  2⤵
  PID:9720
- C:\Windows\System\ZYwWIwR.exe
  C:\Windows\System\ZYwWIwR.exe
  2⤵
  PID:9736
- C:\Windows\System\jiamUwU.exe
  C:\Windows\System\jiamUwU.exe
  2⤵
  PID:9752
- C:\Windows\System\IMIVfhw.exe
  C:\Windows\System\IMIVfhw.exe
  2⤵
  PID:9768
- C:\Windows\System\gJDsRJf.exe
  C:\Windows\System\gJDsRJf.exe
  2⤵
  PID:9784
- C:\Windows\System\CAMhrlJ.exe
  C:\Windows\System\CAMhrlJ.exe
  2⤵
  PID:9800
- C:\Windows\System\UqcsCbv.exe
  C:\Windows\System\UqcsCbv.exe
  2⤵
  PID:9816
- C:\Windows\System\hExgdWO.exe
  C:\Windows\System\hExgdWO.exe
  2⤵
  PID:9832
- C:\Windows\System\YCkOtzK.exe
  C:\Windows\System\YCkOtzK.exe
  2⤵
  PID:9848
- C:\Windows\System\uXqJnDy.exe
  C:\Windows\System\uXqJnDy.exe
  2⤵
  PID:9864
- C:\Windows\System\tQuaARq.exe
  C:\Windows\System\tQuaARq.exe
  2⤵
  PID:9880
- C:\Windows\System\enAwYdn.exe
  C:\Windows\System\enAwYdn.exe
  2⤵
  PID:9896
- C:\Windows\System\prCCTBK.exe
  C:\Windows\System\prCCTBK.exe
  2⤵
  PID:9912
- C:\Windows\System\tGRetMd.exe
  C:\Windows\System\tGRetMd.exe
  2⤵
  PID:9932
- C:\Windows\System\MVYrsHK.exe
  C:\Windows\System\MVYrsHK.exe
  2⤵
  PID:9948
- C:\Windows\System\XGInMqE.exe
  C:\Windows\System\XGInMqE.exe
  2⤵
  PID:9964
- C:\Windows\System\gfDMSzD.exe
  C:\Windows\System\gfDMSzD.exe
  2⤵
  PID:9980
- C:\Windows\System\HxPpuas.exe
  C:\Windows\System\HxPpuas.exe
  2⤵
  PID:9996
- C:\Windows\System\GiRznFN.exe
  C:\Windows\System\GiRznFN.exe
  2⤵
  PID:10012
- C:\Windows\System\suuXxBP.exe
  C:\Windows\System\suuXxBP.exe
  2⤵
  PID:10028
- C:\Windows\System\WYZuBCP.exe
  C:\Windows\System\WYZuBCP.exe
  2⤵
  PID:10044
- C:\Windows\System\LazIpDo.exe
  C:\Windows\System\LazIpDo.exe
  2⤵
  PID:10064
- C:\Windows\System\jblfcZO.exe
  C:\Windows\System\jblfcZO.exe
  2⤵
  PID:10080
- C:\Windows\System\HWYDOyJ.exe
  C:\Windows\System\HWYDOyJ.exe
  2⤵
  PID:10096
- C:\Windows\System\SpPHXsn.exe
  C:\Windows\System\SpPHXsn.exe
  2⤵
  PID:10112
- C:\Windows\System\PrLjodc.exe
  C:\Windows\System\PrLjodc.exe
  2⤵
  PID:10128
- C:\Windows\System\NMWWuRy.exe
  C:\Windows\System\NMWWuRy.exe
  2⤵
  PID:10144
- C:\Windows\System\eqoXkZM.exe
  C:\Windows\System\eqoXkZM.exe
  2⤵
  PID:10160
- C:\Windows\System\zFkIrMW.exe
  C:\Windows\System\zFkIrMW.exe
  2⤵
  PID:10176
- C:\Windows\System\BUueUTg.exe
  C:\Windows\System\BUueUTg.exe
  2⤵
  PID:10192
- C:\Windows\System\pfcbUvu.exe
  C:\Windows\System\pfcbUvu.exe
  2⤵
  PID:10208
- C:\Windows\System\btwjkSb.exe
  C:\Windows\System\btwjkSb.exe
  2⤵
  PID:10224
- C:\Windows\System\MzqTGlR.exe
  C:\Windows\System\MzqTGlR.exe
  2⤵
  PID:7884
- C:\Windows\System\TQuwhWr.exe
  C:\Windows\System\TQuwhWr.exe
  2⤵
  PID:8636
- C:\Windows\System\ahVUxLA.exe
  C:\Windows\System\ahVUxLA.exe
  2⤵
  PID:8856
- C:\Windows\System\kEjaOrf.exe
  C:\Windows\System\kEjaOrf.exe
  2⤵
  PID:8200
- C:\Windows\System\zHaxBsb.exe
  C:\Windows\System\zHaxBsb.exe
  2⤵
  PID:9276
- C:\Windows\System\NmRvVwA.exe
  C:\Windows\System\NmRvVwA.exe
  2⤵
  PID:9340
- C:\Windows\System\mEvjRMr.exe
  C:\Windows\System\mEvjRMr.exe
  2⤵
  PID:9372
- C:\Windows\System\fwgALLV.exe
  C:\Windows\System\fwgALLV.exe
  2⤵
  PID:9408
- C:\Windows\System\cgWJfWM.exe
  C:\Windows\System\cgWJfWM.exe
  2⤵
  PID:8972
- C:\Windows\System\gBQqZwW.exe
  C:\Windows\System\gBQqZwW.exe
  2⤵
  PID:8220
- C:\Windows\System\DVstEjw.exe
  C:\Windows\System\DVstEjw.exe
  2⤵
  PID:8432
- C:\Windows\System\RMPxNrx.exe
  C:\Windows\System\RMPxNrx.exe
  2⤵
  PID:8576
- C:\Windows\System\PriTRGa.exe
  C:\Windows\System\PriTRGa.exe
  2⤵
  PID:8652
- C:\Windows\System\dPrTJdu.exe
  C:\Windows\System\dPrTJdu.exe
  2⤵
  PID:9092
- C:\Windows\System\GMGXiBs.exe
  C:\Windows\System\GMGXiBs.exe
  2⤵
  PID:9024
- C:\Windows\System\HvKycpr.exe
  C:\Windows\System\HvKycpr.exe
  2⤵
  PID:9112
- C:\Windows\System\QBUtxJg.exe
  C:\Windows\System\QBUtxJg.exe
  2⤵
  PID:9292
- C:\Windows\System\fJpxsfv.exe
  C:\Windows\System\fJpxsfv.exe
  2⤵
  PID:9388
- C:\Windows\System\OjAheSn.exe
  C:\Windows\System\OjAheSn.exe
  2⤵
  PID:9452
- C:\Windows\System\sqqLgCl.exe
  C:\Windows\System\sqqLgCl.exe
  2⤵
  PID:9492
- C:\Windows\System\AoopYLS.exe
  C:\Windows\System\AoopYLS.exe
  2⤵
  PID:9556
- C:\Windows\System\vCVvdDW.exe
  C:\Windows\System\vCVvdDW.exe
  2⤵
  PID:9228
- C:\Windows\System\EMwoDEd.exe
  C:\Windows\System\EMwoDEd.exe
  2⤵
  PID:9876
- C:\Windows\System\QoNuLwq.exe
  C:\Windows\System\QoNuLwq.exe
  2⤵
  PID:9944
- C:\Windows\System\HfajnCY.exe
  C:\Windows\System\HfajnCY.exe
  2⤵
  PID:10008
- C:\Windows\System\eWQDnzS.exe
  C:\Windows\System\eWQDnzS.exe
  2⤵
  PID:9536
- C:\Windows\System\KRHlGlU.exe
  C:\Windows\System\KRHlGlU.exe
  2⤵
  PID:9600
- C:\Windows\System\CIHPiqQ.exe
  C:\Windows\System\CIHPiqQ.exe
  2⤵
  PID:9668
- C:\Windows\System\OmGFFKT.exe
  C:\Windows\System\OmGFFKT.exe
  2⤵
  PID:9732
- C:\Windows\System\zFrcvAi.exe
  C:\Windows\System\zFrcvAi.exe
  2⤵
  PID:9796
- C:\Windows\System\GrYLaik.exe
  C:\Windows\System\GrYLaik.exe
  2⤵
  PID:9860
- C:\Windows\System\fDtDYng.exe
  C:\Windows\System\fDtDYng.exe
  2⤵
  PID:9924
- C:\Windows\System\Rykunua.exe
  C:\Windows\System\Rykunua.exe
  2⤵
  PID:9988
- C:\Windows\System\saCZMUz.exe
  C:\Windows\System\saCZMUz.exe
  2⤵
  PID:10052
- C:\Windows\System\LmILJwO.exe
  C:\Windows\System\LmILJwO.exe
  2⤵
  PID:10092
- C:\Windows\System\nodFVFR.exe
  C:\Windows\System\nodFVFR.exe
  2⤵
  PID:10108
- C:\Windows\System\TFdkvRs.exe
  C:\Windows\System\TFdkvRs.exe
  2⤵
  PID:10168
- C:\Windows\System\FqXTOrA.exe
  C:\Windows\System\FqXTOrA.exe
  2⤵
  PID:10124
- C:\Windows\System\jhEStNy.exe
  C:\Windows\System\jhEStNy.exe
  2⤵
  PID:10184
- C:\Windows\System\lluqdvI.exe
  C:\Windows\System\lluqdvI.exe
  2⤵
  PID:8300
- C:\Windows\System\ilBYoyW.exe
  C:\Windows\System\ilBYoyW.exe
  2⤵
  PID:9312
- C:\Windows\System\LziIRcE.exe
  C:\Windows\System\LziIRcE.exe
  2⤵
  PID:8704
- C:\Windows\System\kORhtiP.exe
  C:\Windows\System\kORhtiP.exe
  2⤵
  PID:8952
- C:\Windows\System\AzKBxoT.exe
  C:\Windows\System\AzKBxoT.exe
  2⤵
  PID:9472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BUbXRFM.exe

Filesize
2.2MB

MD5
0d9d9f4cda8b4e87137ae84395caf44b

SHA1
048ecf707c8134281e7f0799d044838df836025b

SHA256
0751fc9146534d164012c09d150d6e551dbf65c094d9c89d1d337b2efbaa45c0

SHA512
d3ca49f3494aa1fd78cfca0c3b7deba33597261fac209b37a57dfb9f28724e5515cabd25ec4dad488f5bf64b5ed35ca3754ef18b541264b414d05f2de0107f49

Download Submit
C:\Windows\system\FJQGUYR.exe

Filesize
2.2MB

MD5
11495f0cc3c817dfaa7de17847d23257

SHA1
72d315d68cebd3573029e3fbe3cb408ec16cb12b

SHA256
a630f459fed6cd88bbafea64651eaaa05a83e50143362072269d1b8e6f634760

SHA512
4e6ec644b4617f4ef68c9d86fcd43cdd826859ff75cb2ea5e2600dce78d75ae4177af56d791d4262bb01d30bc2bcb4a9f7087535a01001ef74aa8bace8c6d40d

Download Submit
C:\Windows\system\FjnWoMI.exe

Filesize
2.2MB

MD5
403e506448b8094c1d33e7c463e47ebe

SHA1
1d235526cf9dbb14f34da9d98f065a55a622aa2c

SHA256
a6ab9b6cc3ece4fbfa0f1f76ed279f90c6847e62f046379ffabd89f48aee00a4

SHA512
dd99de1181a581b53d8ea3bc99b6277bb257bf028224e853884f0c199f0728035b31a1c6b767b74fe2e5ecef7d87bd60d579effd78e933ee96b2dafaa6bc138b

Download Submit
C:\Windows\system\GqHRRyB.exe

Filesize
2.2MB

MD5
211445271fbba4b42ad3697b3c32cc81

SHA1
108faa8fa442df57167b30173a2d025616c1d1b6

SHA256
e740f1fd96ee55171ff3446a1400f7fa42baff8666e8e3544a9503e6862d5731

SHA512
57e6ddf58bf5c3ee6e58101884f26e4c7433706140c5003b8c25ed7dd1946187470c475275e406930714561c19ff1c43441cc553f46a523f6c48b1a2e90f408e

Download Submit
C:\Windows\system\HzPYjqd.exe

Filesize
2.2MB

MD5
4c3dbffe6835ce26ff10ea60366b877d

SHA1
2a087ab1b9615d733f8a193217ab06eb68a9c87d

SHA256
581d8b3978554ca66296ae9be863f611eb8b4abfd507abd643a40fe794c21304

SHA512
df80ec6ae7b5d83ed816d7b3eda1f4899cdbf4688d7e98020b65489f9a2466702e098efd4e19f398ecd48d0c79a25b1e54cd0f1e63482687a243d80451ae569d

Download Submit
C:\Windows\system\IQCHwwM.exe

Filesize
2.2MB

MD5
c728ac014eecdc286186bae5d490ff9c

SHA1
9b8a94e060a0095d1d25bb1fad71acc9de80b85f

SHA256
9cf908dc2424940498ce4aec7c397bedc0af8ec39dfe87167fd9cd5ef6e56ede

SHA512
f01c48ca52683d629a830cf9f82d369a8b17a9f669e4cf4dd4e7ffe307d800bd13625637dbac455b02fe11aecbcd69154a248388a35ef5d377efc40aea3f6272

Download Submit
C:\Windows\system\TfFlTuj.exe

Filesize
2.2MB

MD5
99927b69e46a4c0fbf19ba7d30438da4

SHA1
5c02d565cdaafb4a8be77aaed1a9b42846eeee5b

SHA256
47c7b404a37884a1802859a7cd82eb0362872d3149475d70ce005bf9c29efa07

SHA512
0f0d8f435d8fc7aa1f6fc1e3aed4dc9b77b38c9644afe8932e06b83434de66e7c5ce438540a537bcad8d5b906e31f6b634bdf88d76705a6ae948f58c53aa6415

Download Submit
C:\Windows\system\VDGGdcZ.exe

Filesize
2.2MB

MD5
7452309c032fdb2786cf4ce76aef27b4

SHA1
2e6a1c26858d3e68270dffae8115f9734df5f80b

SHA256
516ae93cd93cc35dc2849be60527ed4ec0a2ef108627f1412951ac97a11603da

SHA512
0830c9307877246b9e1597b927f64fc23545c3e1b0e0985636bd3655b6575d57464a4af96ac6ef207abf0e0b8c7e2194c706b0dce530a6ed2faad403e03cc986

Download Submit
C:\Windows\system\ZNCCvxb.exe

Filesize
2.2MB

MD5
3d6102c5673e405e8d23dcb50fdc6fc1

SHA1
6d7ae32e8c74a498f2c089858897bceffa285b7a

SHA256
bc4da65b90dceddf9b9892a7773f116915a4065ade945f29b8e945648ac62ee5

SHA512
7ccd34d6e57ed0d1c51d5e0a3fbd582fb698b990da039557e9f1c8129d5a479f18293ae8d92e5e8103ee0461e0559fede84abf784f952af74bb971c4abd20d3b

Download Submit
C:\Windows\system\aTNEjmI.exe

Filesize
2.2MB

MD5
a3aa7c65c21c8469c48bd74580573a44

SHA1
766a7e0146a1e9bfdf6d92f11c7ac1d23db40aef

SHA256
5345ce5bae5aabdef4b68b6ebacbf68273599e6845a95e6a4299c3e2c8eb2791

SHA512
08fa64b134a3f9ea6431cfe3514b55917a84a46f4573771184136def35e33c0abce301885555904c33fa3107baa85495176902f8fbab5acadf758fb44582f396

Download Submit
C:\Windows\system\cAloXfm.exe

Filesize
2.2MB

MD5
49fa7b995a88b5e6eb9b0c428330da4f

SHA1
b180e92fe96b40afc849ca1c85c525a896ada842

SHA256
8fe0657be57389c3ba0efc1623c05db1a726cfde2595ca15e36c302bbc68d9f3

SHA512
0190ea1d88e09302f2363759b4cb88082fc390b30934c63251bbdeceb9a9180b9538fc233b29ee3550bfd67fe1c1e1f63bb9ffffeac8ead3423ebcd811c1e5e8

Download Submit
C:\Windows\system\cFUZzjH.exe

Filesize
2.2MB

MD5
61f4a617cd8e44dba0eb0fd46504a635

SHA1
2a7063c9ec7f450f6c368895acf901e00c48b7a7

SHA256
72a468e70853ba8bd5b5479daefbea80d183c5a7ed928b9e04c3a38c5a7d3c70

SHA512
52de11d6c1e04ac9042265a822e57cd76f5c898754ca03ac787982aa459640ddcb04301641523ec03ed1e70bc28c89365fd1a7268cb026d5c1db358af5667992

Download Submit
C:\Windows\system\dQtaJnZ.exe

Filesize
2.2MB

MD5
a70c5b6c6ca3405170af577d6591ddee

SHA1
a47113951091ed0295d939bfd5d855874bb55713

SHA256
9e85addc6f4dce79ddb882938d48653088ceb0666142526931b6a76158149d4f

SHA512
6c79bddab3c4f043f5d37007779f82c69d6a55a91de33ef04b2ee5f4743c70b9fb858ab800141c29a8451e6dca5007ddf2515517eba66557c505de9bf6ee0b60

Download Submit
C:\Windows\system\dqnGLkl.exe

Filesize
2.2MB

MD5
689f72dc8df16504ff3680c49cf1e156

SHA1
6b3b80fd7515cdebb621b40e2b3f49d39df7ad4c

SHA256
7f47abf5efbe6d10de3ab2110ae2c5cf1e1cd13cc80f7d703eaa8147ed8372ad

SHA512
86a44e05f41ce16163bdae8354fa072df299b111933289d99619a6db04c32e3f48525cc85d0be65902f46ff2102ea385c0a2b7a0ec37751074c8a4e95e3fea7d

Download Submit
C:\Windows\system\faGRemw.exe

Filesize
2.2MB

MD5
e0711c818fc2c4a0a473574122b652e8

SHA1
489238270a691039175bf741b08fd1b2d76b45cb

SHA256
f86ebbbe901c43aa6548d7642afefd4e3c98608aebca19ab9d4ad05c0bd45924

SHA512
e75b2f1b0106ebff488fb0caddd475680084328ebea9d215aa565888abfe8b728dfad83255f9ea8b439042edf45129e0a2c5197c71886058a46883db62229067

Download Submit
C:\Windows\system\famnMKm.exe

Filesize
2.2MB

MD5
2fd574a7a8de30aea11300f45d5f129c

SHA1
457c4d5671b5b0aba2413b803161db60c0539e14

SHA256
b6f7fdd9a8080050b646d0dd87811f2591d3e9db337919c439e8f7b5ff3b7c57

SHA512
add129ac98e987bdc308de3ecdbef82863da9401b8257ad72e01628db37c78d8a55616611180033513150a87c6ba55f40dfbf5c9550e1765fcb163df16a0310a

Download Submit
C:\Windows\system\gWDnyKs.exe

Filesize
2.2MB

MD5
5baad8e9c3f98feafe56dfe0a82c030c

SHA1
ce25ab0739e88e26e4705f5196b5bb3394ef96cb

SHA256
43b890aebadb03ff794f89dc116eec28afeb2a45057284290040353bd65afbda

SHA512
5b7b8c41a93fa1f25c79c39694ef2abaf1f49be24fd79acf15753d5ba657d4bf010f2459407369dad5d62239a8bdd8d8d6aae807a17fca14029b42028ec61ab7

Download Submit
C:\Windows\system\nigFFPe.exe

Filesize
2.2MB

MD5
2dabbb8348443c441b6620f2bda9b1fc

SHA1
adcd6d9a2440bcde146cfb97253c07c995d703d3

SHA256
cf96c14a92ff41b859d0132aa3f0afca4f021afb7e4c486bfeab88724f4b8713

SHA512
f4117806db2ed8886c2615ad4364e427bed2e274ab9a28170e23a6ade6af126daa69ca858bdf91bddcef691ed4d9e05ca3b5bd3f6824727ba03f64fb0aad780f

Download Submit
C:\Windows\system\zWPadzD.exe

Filesize
2.2MB

MD5
7bfacf44fead1ccf18f9cec9d9355840

SHA1
b38c52aa3828b917de0acfea68101a986c6454d8

SHA256
dab33fb2558d3a54ed708e69bf5842273a209372309f75e5a493c8b3819f7566

SHA512
e639de5bbaddd4f1f8e6a2699b8a5e1e1c92bc560b0f5d6a7b6956119ef8c1a8e46e75a00f139580914c06f80b0a05b1e3b4595e40242a146dd91c9fcceb9f21

Download Submit
\Windows\system\BrgIfPE.exe

Filesize
2.2MB

MD5
7c50414f9584bae91ec440d0da729edb

SHA1
296e8143bf33681431e01be58ac86531e2c269c9

SHA256
08c9b03b05d47bf7a0d4f357a4c1c8b5467ed1a817e4e3be336709ec8282750c

SHA512
3b36bdcca2ad7ff389bd6ee6f3b38d761425880daf4b70c0148aa67fc21a219379e9eab92b12a1a219851fdaf3d5c978be3a857420feb7a3c03a745d1eae3f70

Download Submit
\Windows\system\DmzBOKd.exe

Filesize
2.2MB

MD5
e179b6c6b38975d0d0d1e1ad93fe8d78

SHA1
27a3f813616e1680dff9936e381e9ebc076462de

SHA256
0e983b49ed166d413143431b86320f4ed31f7a43788288cb86a728b7da098a3c

SHA512
cd887220e00ad2d5c5331ae3f564b42a05ed89d02c758eb5af7a7cc19d3d488082e6894b153bf71340e47e8d7421404941ee63b7a4afae33efcc66e917b09149

Download Submit
\Windows\system\DsPggNs.exe

Filesize
2.2MB

MD5
62bf789794b53b06eb5d240eeb3c323a

SHA1
c47eaf268548225169fa5d6b5ecc450dd785fd52

SHA256
8af35f783f6fe613265ec010ee048443ef30659ab8128d53b9850490ea256c69

SHA512
544c618f695a1564b9e38033d4280b0c25015a9462c8a50dba3c264ff4a311597f4978905cc330ce856d50d5da98a1a47546b233088cd0e4b2ef17c159b9978d

Download Submit
\Windows\system\EqOgavL.exe

Filesize
2.2MB

MD5
53ddcb52012e7510c6832b9ac816f2f0

SHA1
600132f72198c4ac4d0999edc012054057ef0256

SHA256
a71faee3bba25e4781a2c874302c0d08115504a8167ab43e853b5195df70025b

SHA512
25639a9c6ce6afcd09d795fe367cd0ae74f95a13a1c5e4e80ce192f9e195b7428eba455cb3c3db08ac2b17a0c8ca610195dfedc7e6176f7792b089a57ffc2a45

Download Submit
\Windows\system\JzLKiwy.exe

Filesize
2.2MB

MD5
419963ab5434aca79b83c5bd5e0252c0

SHA1
00911b1f9ebc68fb862df89d961b0cccb79fdd58

SHA256
16d212026d3a8f7921980446223ea20f863553a6bd9dd859e82f270dbabbab77

SHA512
9aa96d1c61b009818096b015b246a88d8998ddfd7f8ac689501eaf99076f173fbd99c62eafeb1ff21667458197b5f7f4551b6032a2f36df34ce7a6bb5ac5cdc9

Download Submit
\Windows\system\KMKMwsB.exe

Filesize
2.2MB

MD5
0812ef5979a014327b0c00cc18c759ce

SHA1
e0b084ec0b1f76a56277d060fcf7e0426f4f45bf

SHA256
f15bf4c86cd808fe9c1872a96edfa3aff339cb1903f099902b4b48c05a2ab0f8

SHA512
4cec339ced652a0077e7f5cfa64eb731017334f4d787768613b0651c7644396e75bacb2dfa3b214612fec1d0908c85c794a75bdda7c71c1e55541e9677c8d86b

Download Submit
\Windows\system\MeFYVTe.exe

Filesize
2.2MB

MD5
6a65ea6c1809f67015bf2fc1d524f91a

SHA1
2fc4e07cbc50f85448554c6264a74ff4333f9e0e

SHA256
dc0e0e8ebf6f66eef1f927a55681c6bfb133b3efb7bea9c8ff52f0c36ddf1f9c

SHA512
d9c50bd75e19b9b3084703d6ed4f16333a3278848696ebd6547871fe1cf6ebe5acb473e9ae7d8c19040cd078810d8b987ba7792eb7f2077cf51de98a819293b2

Download Submit
\Windows\system\PSnHIxK.exe

Filesize
2.2MB

MD5
e35cd8ee68ef2b8ca964ef24ffd57ae3

SHA1
84c20fe1eaf570a07f6c139775bfbad156d1387d

SHA256
6dbf1a03c6f2e7390c5fdeb783c5125f01e73f7b382be79ba87d025a1ec0fa3a

SHA512
69c93eecf600c92604147ff803d643b4fbf9daef9899052774595651653bcb1e3199637f7d16c7b27ec10d885c6b293cc1ff4b7c0ac20b2c8478dc8bcee5c5be

Download Submit
\Windows\system\SpKrXWL.exe

Filesize
2.2MB

MD5
3657d1d0e833336b8771212d65acdce9

SHA1
9061f58234113d40c08a4b0eb74af6b875d14922

SHA256
80fbadcb9533932d522f21f8f9e47ae1cbc68f9c6f597daa42eacbfcac1e4dfb

SHA512
27323cd06a812408f9cf69d602876817f38f92cf7362bd7a528c50982aaad09c78e4db156e26ac599387b7b11fce18c8b433a4cf9367b39c6f8eba9f6b436dfe

Download Submit
\Windows\system\SyOCJGh.exe

Filesize
2.2MB

MD5
3fdc105df2c585f3f6020b3b391ca79b

SHA1
1e704040af8cfb833c1d8c61e0e4548f44b72fbf

SHA256
e0e59fc711fb902e7b39d5834df50a614638a0b3af79ed6c9eb4fc10960f1f20

SHA512
0555b69e7296f225bf27e74a7786c7d60b613e00c7dbfc35e518c98279e64ca63e27e22adfef8ec0013adb75bbfa8f38e6c62ca4173c0d742c3bc80a9e23a44e

Download Submit
\Windows\system\VzOAPvN.exe

Filesize
2.2MB

MD5
457a34d9ede82255858474a613033f01

SHA1
1d9880fd0df3296d5b54b2deb178a05aac023c26

SHA256
a3abb68374a649833b4f2d18933cd23e3b36283ec5f4ecc2ab99bd83b809243d

SHA512
ba005b526506f391b4a7f7be221ebe3d6928fdcf24d20df0889731837045d87ba27ff777b4907a05e220260f563df30d784d7adaa569fcca4a28876d3aa8eb8f

Download Submit
\Windows\system\bKYEwIL.exe

Filesize
2.2MB

MD5
6be406423a57ce773b73224ed0d61d0c

SHA1
5764dcfbf57798973e601f061401ce94fadfdc32

SHA256
b6239ba690784ed5ca8c26cd3c3456e47c3945ccb2bb834632f8a6a107408fc4

SHA512
0fbe94f4e6ceed8b57d9d87ff48cc5d15d3d586ccbbf86cb767cc9a7cb9c2533644cba06ef0eab2b1b36883c64126084d83b579719c0c380b827913bf191cb24

Download Submit
\Windows\system\dFOBSEd.exe

Filesize
2.2MB

MD5
ee2eac382531d705c984658606eb3a6f

SHA1
b3d152c453e3715adde11fb7650e5a498b62d587

SHA256
4e08cf3619035d3da81ee1211d3bd1df0b347a4c977ef586a80c31fc97ad9b0d

SHA512
1c0f9e07c3c453699758aab63a6919539750b47a5acc90f4fc7cce3129287d13486115b7bdf6b3745598c84a3c1f0ad16ffe93bf968f809c1f0bbda3d16f87a4

Download Submit
\Windows\system\eHHrOpW.exe

Filesize
2.2MB

MD5
cc0df8c44332455aa20961403da707a1

SHA1
7910a40654ef3bf4a5b8a474ac4ea06a6fe42b6c

SHA256
0b744d8ef44a0a0fd0718461093855de4f3b4fbfc086f192ea81364957a1e43c

SHA512
4c8ce463fa71ab9622d8c063361ad260d72837ede7ae3c86975336c4b7405fc63202b298cf004e7473679dfe908d8f9bd9ef1a933c69982cc7d7be5ae1a931c4

Download Submit
\Windows\system\glFnrVR.exe

Filesize
2.2MB

MD5
55b9b6c1d8f958911d78c8bffe68c39c

SHA1
c7357480550bd1e4e0e37f3e6a4c1a7c8a129b8c

SHA256
0fefc8e6dc03de2d9ad204df727f74e6dbb9467a06908ff6054d5b81ff2a46dc

SHA512
8346cdea70eafe76dc2c07e9c69f7e6efca1a12152c3f75ff3428fa7fcc1a494204eb392bd7094c8a888d352b4e59482184b98ccbb82e2833109ee2e3c14eb9a

Download Submit
\Windows\system\huBJZYq.exe

Filesize
2.2MB

MD5
4e1a2e98faea09fb120c3cf991053410

SHA1
7b822c8ce92229d69ea7f76a67937a694263bdbf

SHA256
c133217b9bc90405b0440061aeb554e120a5e556ac72c09400262d3eb2b63adc

SHA512
9f2dc3c5b5c26ed20673c0e020fbb5b33c544d5fce08a0ea5a47faf5bb3d8e107290ec1684cf364510b3290409bd9dbf8d1c8af852ad244458f94a415a6c6f80

Download Submit
\Windows\system\jbAjFPw.exe

Filesize
2.2MB

MD5
b97a9c340bd8e59667f0ad9043c8fc7a

SHA1
c90752304edd5b6c07bce98314442faf3b265352

SHA256
bc27137f733dc3e360dcc4ff883abd87007e2384369b67468a33f9c863c7cd4c

SHA512
776d52edb156d4a7f4d7040db96a344b894aed77e99db3bbab1b96f46ce3b6b764d91b059cc7930f114496d7b903e41ff2ab98a818abe3a6f86d8faf593dcb75

Download Submit
\Windows\system\mbNssUG.exe

Filesize
2.2MB

MD5
750fbc3c3b8bccdea5d834dce66e6c09

SHA1
5a43f48f3b8d7b9f337ebaa73104d19f460776f2

SHA256
5eb2cfe8ec652a796341a741d4cc7e812d98a3c3e46fb546363b3d749e59fe62

SHA512
1f78fc98c15c542ff09efa74e8221a73f45a106c455e6b3be5a74f7c9864cded118813d7ba94ace436b6c2529952330c74f8a0fe7f2cf057628b7be0ce08219e

Download Submit
memory/1188-75-0x000007FEF6280000-0x000007FEF6C1D000-memory.dmp

Filesize
9.6MB

Download
memory/1188-53-0x0000000002A70000-0x0000000002AF0000-memory.dmp

Filesize
512KB

Download
memory/1188-3494-0x000007FEF6280000-0x000007FEF6C1D000-memory.dmp

Filesize
9.6MB

Download
memory/1188-116-0x00000000022A0000-0x00000000022A8000-memory.dmp

Filesize
32KB

Download
memory/1188-115-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/1188-77-0x0000000002A70000-0x0000000002AF0000-memory.dmp

Filesize
512KB

Download
memory/1188-52-0x000007FEF6280000-0x000007FEF6C1D000-memory.dmp

Filesize
9.6MB

Download
memory/1576-67-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2104-25-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2104-68-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/2104-55-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2104-1-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2104-7-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/2104-66-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/2104-14-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2104-61-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2104-59-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/2104-76-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/2104-70-0x00000000032A0000-0x0000000003692000-memory.dmp

Filesize
3.9MB

Download
memory/2440-69-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-26-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2736-62-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-54-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2748-56-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2756-12-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2792-60-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/3060-15-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download