xmrig | 68882589f65c3e5a0657529d1104c2603c69204d572dc90c6615511570dd863a

Analysis

max time kernel
7s
max time network
30s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
Size

2.1MB
MD5

0a9ec5a9494ccdb3b944ba90ed587e15
SHA1

c7da4167ac3fb41fa71d2defa9ab252ecd50a21f
SHA256

68882589f65c3e5a0657529d1104c2603c69204d572dc90c6615511570dd863a
SHA512

992de9fcfaece30eb5f4ca404e206c3b49f290a6e68cccaef903328ae9c5ca2bb036b1768b4844f1062c0b31d12301e7030b7f266e53f4987b750702317c021f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrp:NABy

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2772-114-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2532-117-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/1888-2004-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2520-129-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/2416-126-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2516-125-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2508-123-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	xmrig
behavioral1/memory/2556-111-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3048	rkXqFvN.exe
2576	xnWRAZo.exe
2520	EykniIN.exe
2556	DBonLZQ.exe
2772	xHvYeku.exe
2532	LAwCzNJ.exe
2508	LBsFmXh.exe
2516	lvvnnLO.exe
2416	CbkhPUh.exe
2308	fvXBSxe.exe
2888	wBHFnZj.exe
804	lwdGhVq.exe
1504	TORquCf.exe
2384	kHheWZi.exe
1872	eqyFlvy.exe
1348	cJOhTzg.exe
1568	McHrAuo.exe
276	ZROosVB.exe
1844	XHZDoef.exe
1656	XPgiVst.exe
2868	rGytquT.exe
2060	CPLarqy.exe
2904	FQTnpwM.exe
532	MwTjLJF.exe
1096	rjlXFfC.exe
1400	dmKjDil.exe
564	tWyDthR.exe
1692	MUnUOOl.exe
1040	tNKoHdn.exe
2072	ZAtmkxV.exe
2860	EDvzCBt.exe
2824	hjnPExa.exe
1996	iphspJv.exe
1684	YpldDEv.exe
692	PddXeWi.exe
1736	wedpVwC.exe
1220	WnpvONP.exe
1532	DBWcgTM.exe
908	wSFeaLC.exe
1564	wuvFddo.exe
1672	TstdUQt.exe
2476	PpgYJXk.exe
1724	hgLJpRA.exe
2200	nHvpiuZ.exe
2344	HCgRaMs.exe
2376	YVOGuAV.exe
1300	xjQadzf.exe
2720	FmJYcSf.exe
1704	TEYmArf.exe
2080	LlVlQij.exe
1496	uQIdfLk.exe
1628	iUufylp.exe
2988	hPXtOON.exe
2672	RblAtNK.exe
2404	LZtvqVK.exe
2436	FghwaEv.exe
2400	WNNcrVM.exe
2372	pJptPzR.exe
2472	FPtQTdC.exe
1468	YcCOhAW.exe
2312	fFIdoDU.exe
1452	KIIylBZ.exe
1984	RaKEuwb.exe
1824	irTnGdg.exe

Loads dropped DLL 64 IoCs

pid	Process
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1888-0-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/files/0x000b000000015cbd-3.dat	upx
behavioral1/files/0x0030000000015d24-13.dat	upx
behavioral1/memory/3048-9-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2576-15-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/files/0x0008000000015e6d-12.dat	upx
behavioral1/files/0x001800000000558a-26.dat	upx
behavioral1/memory/1888-23-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/files/0x00070000000161b3-44.dat	upx
behavioral1/files/0x0008000000016d05-56.dat	upx
behavioral1/files/0x0006000000016d1f-61.dat	upx
behavioral1/files/0x0006000000016d0e-54.dat	upx
behavioral1/files/0x0006000000016d9f-79.dat	upx
behavioral1/files/0x0006000000016db3-88.dat	upx
behavioral1/files/0x0006000000016fe8-98.dat	upx
behavioral1/files/0x0006000000016e78-97.dat	upx
behavioral1/files/0x0006000000016da4-96.dat	upx
behavioral1/files/0x0006000000016d3a-95.dat	upx
behavioral1/memory/2772-114-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/2532-117-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x00060000000173e5-131.dat	upx
behavioral1/files/0x000600000001739d-130.dat	upx
behavioral1/files/0x00050000000186d3-184.dat	upx
behavioral1/memory/1888-2004-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/files/0x0005000000018700-189.dat	upx
behavioral1/files/0x00050000000186c1-179.dat	upx
behavioral1/files/0x000500000001865a-174.dat	upx
behavioral1/files/0x0009000000018640-169.dat	upx
behavioral1/files/0x00060000000175b8-160.dat	upx
behavioral1/files/0x001500000001863c-163.dat	upx
behavioral1/files/0x00060000000175ac-149.dat	upx
behavioral1/files/0x00060000000175b2-154.dat	upx
behavioral1/files/0x000600000001744c-144.dat	upx
behavioral1/files/0x0030000000015d44-140.dat	upx
behavioral1/memory/2520-129-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/2416-126-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2516-125-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2508-123-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx
behavioral1/memory/2556-111-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/files/0x0006000000016d36-85.dat	upx
behavioral1/files/0x0006000000016d32-72.dat	upx
behavioral1/files/0x0006000000016d16-70.dat	upx
behavioral1/files/0x00070000000160cc-38.dat	upx
behavioral1/files/0x0008000000015fa7-35.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PddXeWi.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\RaKEuwb.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\XjQOHpc.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\GyiaRjg.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\LhxhRSf.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\uIgHcmt.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\NKOzyYK.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\BBqLwDk.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\gWPdvor.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\vfCQGHM.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\RrokcEP.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\wglrgXA.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\GDzQtRy.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\xYiiSEt.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\eDqBYQH.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\aXMEooW.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\atXpeEu.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\ZROosVB.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\fFIdoDU.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\hLXNdTa.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\DqltPNR.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\QqQOCGt.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\dmsZqgM.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\VNnBGwn.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\QnrHqpF.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\BgLNtXB.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\STlGHGe.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\yFfHZIC.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\MUnUOOl.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\wIQkmCk.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\PBPHWoE.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\cfxBCGI.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\SGiCUEM.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\uGuqdvH.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\mKjimxo.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\fJTAJbX.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\PbEhKWI.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\vrHGlKn.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\NpHJTwc.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\wxiTVFE.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\kEvUDIt.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\rGytquT.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\irTnGdg.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\GWXpjux.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\HJfZSAC.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\oYLtEAk.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\VpEBuFf.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\GUihGag.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\MEIZbXy.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\lvrvJxZ.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\wSFeaLC.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\GqdkHbG.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\ajtsBIJ.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\LBsFmXh.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\nHvpiuZ.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\ssAuZos.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\afhMeYQ.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\NYYJCxI.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\pNrQifI.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\dMiBKuX.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\cnRiBDW.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\AqNBgPq.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\qBMTlJq.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
File created	C:\Windows\System\wLDysLH.exe	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2992	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
Token: SeDebugPrivilege	2992	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2992	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	29
PID 1888 wrote to memory of 2992	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	29
PID 1888 wrote to memory of 2992	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	29
PID 1888 wrote to memory of 3048	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	30
PID 1888 wrote to memory of 3048	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	30
PID 1888 wrote to memory of 3048	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	30
PID 1888 wrote to memory of 2576	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	31
PID 1888 wrote to memory of 2576	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	31
PID 1888 wrote to memory of 2576	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	31
PID 1888 wrote to memory of 2520	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	32
PID 1888 wrote to memory of 2520	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	32
PID 1888 wrote to memory of 2520	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	32
PID 1888 wrote to memory of 2556	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	33
PID 1888 wrote to memory of 2556	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	33
PID 1888 wrote to memory of 2556	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	33
PID 1888 wrote to memory of 2772	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	34
PID 1888 wrote to memory of 2772	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	34
PID 1888 wrote to memory of 2772	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	34
PID 1888 wrote to memory of 2532	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	35
PID 1888 wrote to memory of 2532	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	35
PID 1888 wrote to memory of 2532	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	35
PID 1888 wrote to memory of 2508	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	36
PID 1888 wrote to memory of 2508	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	36
PID 1888 wrote to memory of 2508	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	36
PID 1888 wrote to memory of 2416	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	37
PID 1888 wrote to memory of 2416	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	37
PID 1888 wrote to memory of 2416	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	37
PID 1888 wrote to memory of 2516	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	38
PID 1888 wrote to memory of 2516	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	38
PID 1888 wrote to memory of 2516	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	38
PID 1888 wrote to memory of 2888	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	39
PID 1888 wrote to memory of 2888	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	39
PID 1888 wrote to memory of 2888	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	39
PID 1888 wrote to memory of 2308	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	40
PID 1888 wrote to memory of 2308	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	40
PID 1888 wrote to memory of 2308	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	40
PID 1888 wrote to memory of 804	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	41
PID 1888 wrote to memory of 804	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	41
PID 1888 wrote to memory of 804	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	41
PID 1888 wrote to memory of 1504	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	42
PID 1888 wrote to memory of 1504	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	42
PID 1888 wrote to memory of 1504	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	42
PID 1888 wrote to memory of 1348	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	43
PID 1888 wrote to memory of 1348	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	43
PID 1888 wrote to memory of 1348	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	43
PID 1888 wrote to memory of 2384	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	44
PID 1888 wrote to memory of 2384	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	44
PID 1888 wrote to memory of 2384	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	44
PID 1888 wrote to memory of 1568	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	45
PID 1888 wrote to memory of 1568	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	45
PID 1888 wrote to memory of 1568	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	45
PID 1888 wrote to memory of 1872	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	46
PID 1888 wrote to memory of 1872	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	46
PID 1888 wrote to memory of 1872	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	46
PID 1888 wrote to memory of 276	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	47
PID 1888 wrote to memory of 276	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	47
PID 1888 wrote to memory of 276	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	47
PID 1888 wrote to memory of 1844	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	48
PID 1888 wrote to memory of 1844	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	48
PID 1888 wrote to memory of 1844	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	48
PID 1888 wrote to memory of 1656	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	49
PID 1888 wrote to memory of 1656	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	49
PID 1888 wrote to memory of 1656	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	49
PID 1888 wrote to memory of 2868	1888	0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a9ec5a9494ccdb3b944ba90ed587e15_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\System\rkXqFvN.exe
  C:\Windows\System\rkXqFvN.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\xnWRAZo.exe
  C:\Windows\System\xnWRAZo.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\EykniIN.exe
  C:\Windows\System\EykniIN.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\DBonLZQ.exe
  C:\Windows\System\DBonLZQ.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\xHvYeku.exe
  C:\Windows\System\xHvYeku.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\LAwCzNJ.exe
  C:\Windows\System\LAwCzNJ.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\LBsFmXh.exe
  C:\Windows\System\LBsFmXh.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\CbkhPUh.exe
  C:\Windows\System\CbkhPUh.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\lvvnnLO.exe
  C:\Windows\System\lvvnnLO.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\wBHFnZj.exe
  C:\Windows\System\wBHFnZj.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\fvXBSxe.exe
  C:\Windows\System\fvXBSxe.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\lwdGhVq.exe
  C:\Windows\System\lwdGhVq.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\TORquCf.exe
  C:\Windows\System\TORquCf.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\cJOhTzg.exe
  C:\Windows\System\cJOhTzg.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\kHheWZi.exe
  C:\Windows\System\kHheWZi.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\McHrAuo.exe
  C:\Windows\System\McHrAuo.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\eqyFlvy.exe
  C:\Windows\System\eqyFlvy.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\ZROosVB.exe
  C:\Windows\System\ZROosVB.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\XHZDoef.exe
  C:\Windows\System\XHZDoef.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\XPgiVst.exe
  C:\Windows\System\XPgiVst.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\rGytquT.exe
  C:\Windows\System\rGytquT.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\CPLarqy.exe
  C:\Windows\System\CPLarqy.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\FQTnpwM.exe
  C:\Windows\System\FQTnpwM.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\MwTjLJF.exe
  C:\Windows\System\MwTjLJF.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\rjlXFfC.exe
  C:\Windows\System\rjlXFfC.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\dmKjDil.exe
  C:\Windows\System\dmKjDil.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\tWyDthR.exe
  C:\Windows\System\tWyDthR.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\MUnUOOl.exe
  C:\Windows\System\MUnUOOl.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\tNKoHdn.exe
  C:\Windows\System\tNKoHdn.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\ZAtmkxV.exe
  C:\Windows\System\ZAtmkxV.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\EDvzCBt.exe
  C:\Windows\System\EDvzCBt.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\hjnPExa.exe
  C:\Windows\System\hjnPExa.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\iphspJv.exe
  C:\Windows\System\iphspJv.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\YpldDEv.exe
  C:\Windows\System\YpldDEv.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\PddXeWi.exe
  C:\Windows\System\PddXeWi.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\DBWcgTM.exe
  C:\Windows\System\DBWcgTM.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\wedpVwC.exe
  C:\Windows\System\wedpVwC.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\wSFeaLC.exe
  C:\Windows\System\wSFeaLC.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\WnpvONP.exe
  C:\Windows\System\WnpvONP.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\wuvFddo.exe
  C:\Windows\System\wuvFddo.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\TstdUQt.exe
  C:\Windows\System\TstdUQt.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\PpgYJXk.exe
  C:\Windows\System\PpgYJXk.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\hgLJpRA.exe
  C:\Windows\System\hgLJpRA.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\nHvpiuZ.exe
  C:\Windows\System\nHvpiuZ.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\HCgRaMs.exe
  C:\Windows\System\HCgRaMs.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\YVOGuAV.exe
  C:\Windows\System\YVOGuAV.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\xjQadzf.exe
  C:\Windows\System\xjQadzf.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\FmJYcSf.exe
  C:\Windows\System\FmJYcSf.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\TEYmArf.exe
  C:\Windows\System\TEYmArf.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\LlVlQij.exe
  C:\Windows\System\LlVlQij.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\uQIdfLk.exe
  C:\Windows\System\uQIdfLk.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\iUufylp.exe
  C:\Windows\System\iUufylp.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\hPXtOON.exe
  C:\Windows\System\hPXtOON.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\RblAtNK.exe
  C:\Windows\System\RblAtNK.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\LZtvqVK.exe
  C:\Windows\System\LZtvqVK.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\FghwaEv.exe
  C:\Windows\System\FghwaEv.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\WNNcrVM.exe
  C:\Windows\System\WNNcrVM.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\CBZjdyP.exe
  C:\Windows\System\CBZjdyP.exe
  2⤵
  PID:2920
- C:\Windows\System\pJptPzR.exe
  C:\Windows\System\pJptPzR.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\jxgPplJ.exe
  C:\Windows\System\jxgPplJ.exe
  2⤵
  PID:760
- C:\Windows\System\FPtQTdC.exe
  C:\Windows\System\FPtQTdC.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\AEusjiH.exe
  C:\Windows\System\AEusjiH.exe
  2⤵
  PID:1500
- C:\Windows\System\YcCOhAW.exe
  C:\Windows\System\YcCOhAW.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\OYJPdpX.exe
  C:\Windows\System\OYJPdpX.exe
  2⤵
  PID:1864
- C:\Windows\System\fFIdoDU.exe
  C:\Windows\System\fFIdoDU.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\qjVYBYZ.exe
  C:\Windows\System\qjVYBYZ.exe
  2⤵
  PID:2288
- C:\Windows\System\KIIylBZ.exe
  C:\Windows\System\KIIylBZ.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\wIQkmCk.exe
  C:\Windows\System\wIQkmCk.exe
  2⤵
  PID:2304
- C:\Windows\System\RaKEuwb.exe
  C:\Windows\System\RaKEuwb.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\CxAvUZG.exe
  C:\Windows\System\CxAvUZG.exe
  2⤵
  PID:1412
- C:\Windows\System\irTnGdg.exe
  C:\Windows\System\irTnGdg.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\XjQOHpc.exe
  C:\Windows\System\XjQOHpc.exe
  2⤵
  PID:1056
- C:\Windows\System\FJyrlpC.exe
  C:\Windows\System\FJyrlpC.exe
  2⤵
  PID:1044
- C:\Windows\System\uTGPbeg.exe
  C:\Windows\System\uTGPbeg.exe
  2⤵
  PID:448
- C:\Windows\System\izjAVQo.exe
  C:\Windows\System\izjAVQo.exe
  2⤵
  PID:2232
- C:\Windows\System\OxeGaxK.exe
  C:\Windows\System\OxeGaxK.exe
  2⤵
  PID:1280
- C:\Windows\System\wLDysLH.exe
  C:\Windows\System\wLDysLH.exe
  2⤵
  PID:3024
- C:\Windows\System\GyiaRjg.exe
  C:\Windows\System\GyiaRjg.exe
  2⤵
  PID:2816
- C:\Windows\System\qkLnyKT.exe
  C:\Windows\System\qkLnyKT.exe
  2⤵
  PID:2840
- C:\Windows\System\opRWVMY.exe
  C:\Windows\System\opRWVMY.exe
  2⤵
  PID:1688
- C:\Windows\System\grOkpFC.exe
  C:\Windows\System\grOkpFC.exe
  2⤵
  PID:2360
- C:\Windows\System\eaeooJK.exe
  C:\Windows\System\eaeooJK.exe
  2⤵
  PID:568
- C:\Windows\System\PcsAFWt.exe
  C:\Windows\System\PcsAFWt.exe
  2⤵
  PID:1632
- C:\Windows\System\dkktOAI.exe
  C:\Windows\System\dkktOAI.exe
  2⤵
  PID:2708
- C:\Windows\System\LhxhRSf.exe
  C:\Windows\System\LhxhRSf.exe
  2⤵
  PID:2620
- C:\Windows\System\nkmrxSA.exe
  C:\Windows\System\nkmrxSA.exe
  2⤵
  PID:352
- C:\Windows\System\TftXYnF.exe
  C:\Windows\System\TftXYnF.exe
  2⤵
  PID:1604
- C:\Windows\System\WVkQXQY.exe
  C:\Windows\System\WVkQXQY.exe
  2⤵
  PID:1396
- C:\Windows\System\bSrnNys.exe
  C:\Windows\System\bSrnNys.exe
  2⤵
  PID:2272
- C:\Windows\System\WyYOIVv.exe
  C:\Windows\System\WyYOIVv.exe
  2⤵
  PID:2948
- C:\Windows\System\uIgHcmt.exe
  C:\Windows\System\uIgHcmt.exe
  2⤵
  PID:1712
- C:\Windows\System\RrokcEP.exe
  C:\Windows\System\RrokcEP.exe
  2⤵
  PID:2392
- C:\Windows\System\yDKkgoO.exe
  C:\Windows\System\yDKkgoO.exe
  2⤵
  PID:2684
- C:\Windows\System\PHBAcns.exe
  C:\Windows\System\PHBAcns.exe
  2⤵
  PID:2488
- C:\Windows\System\txEIoWc.exe
  C:\Windows\System\txEIoWc.exe
  2⤵
  PID:2876
- C:\Windows\System\pAepMch.exe
  C:\Windows\System\pAepMch.exe
  2⤵
  PID:1600
- C:\Windows\System\MRWdcJu.exe
  C:\Windows\System\MRWdcJu.exe
  2⤵
  PID:2140
- C:\Windows\System\ERNTRoO.exe
  C:\Windows\System\ERNTRoO.exe
  2⤵
  PID:2108
- C:\Windows\System\lyuUbjX.exe
  C:\Windows\System\lyuUbjX.exe
  2⤵
  PID:744
- C:\Windows\System\LWVjvgt.exe
  C:\Windows\System\LWVjvgt.exe
  2⤵
  PID:1696
- C:\Windows\System\aCLiwaf.exe
  C:\Windows\System\aCLiwaf.exe
  2⤵
  PID:836
- C:\Windows\System\mOJUnWH.exe
  C:\Windows\System\mOJUnWH.exe
  2⤵
  PID:340
- C:\Windows\System\qaNVBIs.exe
  C:\Windows\System\qaNVBIs.exe
  2⤵
  PID:2248
- C:\Windows\System\ECDZCwh.exe
  C:\Windows\System\ECDZCwh.exe
  2⤵
  PID:2980
- C:\Windows\System\VXFUvrL.exe
  C:\Windows\System\VXFUvrL.exe
  2⤵
  PID:2892
- C:\Windows\System\zpWbxis.exe
  C:\Windows\System\zpWbxis.exe
  2⤵
  PID:2244
- C:\Windows\System\LOthari.exe
  C:\Windows\System\LOthari.exe
  2⤵
  PID:2536
- C:\Windows\System\yxVMNHH.exe
  C:\Windows\System\yxVMNHH.exe
  2⤵
  PID:2316
- C:\Windows\System\QfHHwbO.exe
  C:\Windows\System\QfHHwbO.exe
  2⤵
  PID:1880
- C:\Windows\System\sDwSOOY.exe
  C:\Windows\System\sDwSOOY.exe
  2⤵
  PID:1544
- C:\Windows\System\Keyhmcl.exe
  C:\Windows\System\Keyhmcl.exe
  2⤵
  PID:2176
- C:\Windows\System\UgCcUXC.exe
  C:\Windows\System\UgCcUXC.exe
  2⤵
  PID:1892
- C:\Windows\System\ssAuZos.exe
  C:\Windows\System\ssAuZos.exe
  2⤵
  PID:1032
- C:\Windows\System\cJCrRLq.exe
  C:\Windows\System\cJCrRLq.exe
  2⤵
  PID:2184
- C:\Windows\System\fJTAJbX.exe
  C:\Windows\System\fJTAJbX.exe
  2⤵
  PID:1912
- C:\Windows\System\fkewoxF.exe
  C:\Windows\System\fkewoxF.exe
  2⤵
  PID:2568
- C:\Windows\System\jcVlvMN.exe
  C:\Windows\System\jcVlvMN.exe
  2⤵
  PID:1176
- C:\Windows\System\BXLiHVB.exe
  C:\Windows\System\BXLiHVB.exe
  2⤵
  PID:2292
- C:\Windows\System\OOpSmnS.exe
  C:\Windows\System\OOpSmnS.exe
  2⤵
  PID:1556
- C:\Windows\System\PBPHWoE.exe
  C:\Windows\System\PBPHWoE.exe
  2⤵
  PID:584
- C:\Windows\System\LipUhWA.exe
  C:\Windows\System\LipUhWA.exe
  2⤵
  PID:2700
- C:\Windows\System\AySnNME.exe
  C:\Windows\System\AySnNME.exe
  2⤵
  PID:2564
- C:\Windows\System\IlNixTQ.exe
  C:\Windows\System\IlNixTQ.exe
  2⤵
  PID:1900
- C:\Windows\System\dVCalki.exe
  C:\Windows\System\dVCalki.exe
  2⤵
  PID:1152
- C:\Windows\System\iUpyuNL.exe
  C:\Windows\System\iUpyuNL.exe
  2⤵
  PID:3032
- C:\Windows\System\bkMdJuk.exe
  C:\Windows\System\bkMdJuk.exe
  2⤵
  PID:2716
- C:\Windows\System\boLcCdC.exe
  C:\Windows\System\boLcCdC.exe
  2⤵
  PID:2396
- C:\Windows\System\UeWqIGV.exe
  C:\Windows\System\UeWqIGV.exe
  2⤵
  PID:2864
- C:\Windows\System\wglrgXA.exe
  C:\Windows\System\wglrgXA.exe
  2⤵
  PID:2560
- C:\Windows\System\HedoMtS.exe
  C:\Windows\System\HedoMtS.exe
  2⤵
  PID:2612
- C:\Windows\System\ElEBTec.exe
  C:\Windows\System\ElEBTec.exe
  2⤵
  PID:1612
- C:\Windows\System\LwkIxmB.exe
  C:\Windows\System\LwkIxmB.exe
  2⤵
  PID:2604
- C:\Windows\System\JdLlsNg.exe
  C:\Windows\System\JdLlsNg.exe
  2⤵
  PID:2084
- C:\Windows\System\nPEjZwQ.exe
  C:\Windows\System\nPEjZwQ.exe
  2⤵
  PID:784
- C:\Windows\System\PbEhKWI.exe
  C:\Windows\System\PbEhKWI.exe
  2⤵
  PID:2444
- C:\Windows\System\IiNYtMy.exe
  C:\Windows\System\IiNYtMy.exe
  2⤵
  PID:1772
- C:\Windows\System\DlfFbem.exe
  C:\Windows\System\DlfFbem.exe
  2⤵
  PID:2116
- C:\Windows\System\pzXqWok.exe
  C:\Windows\System\pzXqWok.exe
  2⤵
  PID:1716
- C:\Windows\System\GDzQtRy.exe
  C:\Windows\System\GDzQtRy.exe
  2⤵
  PID:2492
- C:\Windows\System\afhMeYQ.exe
  C:\Windows\System\afhMeYQ.exe
  2⤵
  PID:2524
- C:\Windows\System\wbfqXSG.exe
  C:\Windows\System\wbfqXSG.exe
  2⤵
  PID:1480
- C:\Windows\System\HpRRjiu.exe
  C:\Windows\System\HpRRjiu.exe
  2⤵
  PID:3064
- C:\Windows\System\aSgjrTG.exe
  C:\Windows\System\aSgjrTG.exe
  2⤵
  PID:1592
- C:\Windows\System\MpwKgUk.exe
  C:\Windows\System\MpwKgUk.exe
  2⤵
  PID:2328
- C:\Windows\System\cfxBCGI.exe
  C:\Windows\System\cfxBCGI.exe
  2⤵
  PID:2692
- C:\Windows\System\wnoUesu.exe
  C:\Windows\System\wnoUesu.exe
  2⤵
  PID:1460
- C:\Windows\System\YgpeMPZ.exe
  C:\Windows\System\YgpeMPZ.exe
  2⤵
  PID:1536
- C:\Windows\System\AqUvIjp.exe
  C:\Windows\System\AqUvIjp.exe
  2⤵
  PID:2448
- C:\Windows\System\zTuNtUH.exe
  C:\Windows\System\zTuNtUH.exe
  2⤵
  PID:1476
- C:\Windows\System\ufUabus.exe
  C:\Windows\System\ufUabus.exe
  2⤵
  PID:1576
- C:\Windows\System\cYrtuvE.exe
  C:\Windows\System\cYrtuvE.exe
  2⤵
  PID:828
- C:\Windows\System\MtjKMsy.exe
  C:\Windows\System\MtjKMsy.exe
  2⤵
  PID:2468
- C:\Windows\System\snkCIFz.exe
  C:\Windows\System\snkCIFz.exe
  2⤵
  PID:2160
- C:\Windows\System\aUTjrOA.exe
  C:\Windows\System\aUTjrOA.exe
  2⤵
  PID:1520
- C:\Windows\System\caHFJeI.exe
  C:\Windows\System\caHFJeI.exe
  2⤵
  PID:3084
- C:\Windows\System\ADrnzdL.exe
  C:\Windows\System\ADrnzdL.exe
  2⤵
  PID:3100
- C:\Windows\System\wQnVgMV.exe
  C:\Windows\System\wQnVgMV.exe
  2⤵
  PID:3116
- C:\Windows\System\XnobMQg.exe
  C:\Windows\System\XnobMQg.exe
  2⤵
  PID:3132
- C:\Windows\System\PgPYpQs.exe
  C:\Windows\System\PgPYpQs.exe
  2⤵
  PID:3148
- C:\Windows\System\OAhRCMT.exe
  C:\Windows\System\OAhRCMT.exe
  2⤵
  PID:3164
- C:\Windows\System\BCaIUxL.exe
  C:\Windows\System\BCaIUxL.exe
  2⤵
  PID:3180
- C:\Windows\System\VcGFdic.exe
  C:\Windows\System\VcGFdic.exe
  2⤵
  PID:3196
- C:\Windows\System\vrHGlKn.exe
  C:\Windows\System\vrHGlKn.exe
  2⤵
  PID:3216
- C:\Windows\System\VpEBuFf.exe
  C:\Windows\System\VpEBuFf.exe
  2⤵
  PID:3232
- C:\Windows\System\YHKXxqD.exe
  C:\Windows\System\YHKXxqD.exe
  2⤵
  PID:3248
- C:\Windows\System\WAQhTlm.exe
  C:\Windows\System\WAQhTlm.exe
  2⤵
  PID:3264
- C:\Windows\System\cKpOzrz.exe
  C:\Windows\System\cKpOzrz.exe
  2⤵
  PID:3280
- C:\Windows\System\RZpFhUQ.exe
  C:\Windows\System\RZpFhUQ.exe
  2⤵
  PID:3296
- C:\Windows\System\kPUyriS.exe
  C:\Windows\System\kPUyriS.exe
  2⤵
  PID:3312
- C:\Windows\System\ILdCyvY.exe
  C:\Windows\System\ILdCyvY.exe
  2⤵
  PID:3332
- C:\Windows\System\AbRdWzE.exe
  C:\Windows\System\AbRdWzE.exe
  2⤵
  PID:3348
- C:\Windows\System\nsqqXQr.exe
  C:\Windows\System\nsqqXQr.exe
  2⤵
  PID:3364
- C:\Windows\System\hLXNdTa.exe
  C:\Windows\System\hLXNdTa.exe
  2⤵
  PID:3380
- C:\Windows\System\WjBYSrk.exe
  C:\Windows\System\WjBYSrk.exe
  2⤵
  PID:3396
- C:\Windows\System\xYiiSEt.exe
  C:\Windows\System\xYiiSEt.exe
  2⤵
  PID:3412
- C:\Windows\System\GWXpjux.exe
  C:\Windows\System\GWXpjux.exe
  2⤵
  PID:3428
- C:\Windows\System\TuatRte.exe
  C:\Windows\System\TuatRte.exe
  2⤵
  PID:3448
- C:\Windows\System\imYuIrs.exe
  C:\Windows\System\imYuIrs.exe
  2⤵
  PID:3464
- C:\Windows\System\TtIABNB.exe
  C:\Windows\System\TtIABNB.exe
  2⤵
  PID:3480
- C:\Windows\System\NKOzyYK.exe
  C:\Windows\System\NKOzyYK.exe
  2⤵
  PID:3500
- C:\Windows\System\NYYJCxI.exe
  C:\Windows\System\NYYJCxI.exe
  2⤵
  PID:3516
- C:\Windows\System\UtdzhhJ.exe
  C:\Windows\System\UtdzhhJ.exe
  2⤵
  PID:3656
- C:\Windows\System\cXsrzEz.exe
  C:\Windows\System\cXsrzEz.exe
  2⤵
  PID:3672
- C:\Windows\System\tFqIVtX.exe
  C:\Windows\System\tFqIVtX.exe
  2⤵
  PID:3688
- C:\Windows\System\KUQuDPJ.exe
  C:\Windows\System\KUQuDPJ.exe
  2⤵
  PID:3704
- C:\Windows\System\PuHIvfd.exe
  C:\Windows\System\PuHIvfd.exe
  2⤵
  PID:3720
- C:\Windows\System\IgXzBuj.exe
  C:\Windows\System\IgXzBuj.exe
  2⤵
  PID:3736
- C:\Windows\System\pNrQifI.exe
  C:\Windows\System\pNrQifI.exe
  2⤵
  PID:3756
- C:\Windows\System\MlelSCI.exe
  C:\Windows\System\MlelSCI.exe
  2⤵
  PID:3772
- C:\Windows\System\gYBEHNK.exe
  C:\Windows\System\gYBEHNK.exe
  2⤵
  PID:3788
- C:\Windows\System\NWyNIjm.exe
  C:\Windows\System\NWyNIjm.exe
  2⤵
  PID:3804
- C:\Windows\System\DMgiRaD.exe
  C:\Windows\System\DMgiRaD.exe
  2⤵
  PID:3820
- C:\Windows\System\LAknrnu.exe
  C:\Windows\System\LAknrnu.exe
  2⤵
  PID:3836
- C:\Windows\System\vyjtNAW.exe
  C:\Windows\System\vyjtNAW.exe
  2⤵
  PID:3852
- C:\Windows\System\qaDCCmi.exe
  C:\Windows\System\qaDCCmi.exe
  2⤵
  PID:3868
- C:\Windows\System\BBqLwDk.exe
  C:\Windows\System\BBqLwDk.exe
  2⤵
  PID:3884
- C:\Windows\System\hfgXQcg.exe
  C:\Windows\System\hfgXQcg.exe
  2⤵
  PID:3904
- C:\Windows\System\GUihGag.exe
  C:\Windows\System\GUihGag.exe
  2⤵
  PID:3920
- C:\Windows\System\WIpZDrB.exe
  C:\Windows\System\WIpZDrB.exe
  2⤵
  PID:3936
- C:\Windows\System\ohXmdRT.exe
  C:\Windows\System\ohXmdRT.exe
  2⤵
  PID:3952
- C:\Windows\System\DGbSsfc.exe
  C:\Windows\System\DGbSsfc.exe
  2⤵
  PID:3968
- C:\Windows\System\AwBiqAI.exe
  C:\Windows\System\AwBiqAI.exe
  2⤵
  PID:3984
- C:\Windows\System\CzZVEQX.exe
  C:\Windows\System\CzZVEQX.exe
  2⤵
  PID:4000
- C:\Windows\System\MEIZbXy.exe
  C:\Windows\System\MEIZbXy.exe
  2⤵
  PID:4020
- C:\Windows\System\hfvLJLN.exe
  C:\Windows\System\hfvLJLN.exe
  2⤵
  PID:4036
- C:\Windows\System\KZgbFpE.exe
  C:\Windows\System\KZgbFpE.exe
  2⤵
  PID:4052
- C:\Windows\System\gfgpsbu.exe
  C:\Windows\System\gfgpsbu.exe
  2⤵
  PID:4068
- C:\Windows\System\dcgfZSu.exe
  C:\Windows\System\dcgfZSu.exe
  2⤵
  PID:4084
- C:\Windows\System\yPbJvaC.exe
  C:\Windows\System\yPbJvaC.exe
  2⤵
  PID:1932
- C:\Windows\System\abTxPMi.exe
  C:\Windows\System\abTxPMi.exe
  2⤵
  PID:2812
- C:\Windows\System\xHqgeih.exe
  C:\Windows\System\xHqgeih.exe
  2⤵
  PID:1052
- C:\Windows\System\amnTOrb.exe
  C:\Windows\System\amnTOrb.exe
  2⤵
  PID:2156
- C:\Windows\System\raIlHbi.exe
  C:\Windows\System\raIlHbi.exe
  2⤵
  PID:3112
- C:\Windows\System\YYuQZec.exe
  C:\Windows\System\YYuQZec.exe
  2⤵
  PID:3176
- C:\Windows\System\nnXKNOn.exe
  C:\Windows\System\nnXKNOn.exe
  2⤵
  PID:3272
- C:\Windows\System\aBOAoTz.exe
  C:\Windows\System\aBOAoTz.exe
  2⤵
  PID:3340
- C:\Windows\System\wagsMMX.exe
  C:\Windows\System\wagsMMX.exe
  2⤵
  PID:3192
- C:\Windows\System\bjTjgso.exe
  C:\Windows\System\bjTjgso.exe
  2⤵
  PID:3260
- C:\Windows\System\hPQKdXl.exe
  C:\Windows\System\hPQKdXl.exe
  2⤵
  PID:3324
- C:\Windows\System\dMiBKuX.exe
  C:\Windows\System\dMiBKuX.exe
  2⤵
  PID:3388
- C:\Windows\System\ipFaRGX.exe
  C:\Windows\System\ipFaRGX.exe
  2⤵
  PID:3456
- C:\Windows\System\eAKCktM.exe
  C:\Windows\System\eAKCktM.exe
  2⤵
  PID:3496
- C:\Windows\System\YsKKLVZ.exe
  C:\Windows\System\YsKKLVZ.exe
  2⤵
  PID:3532
- C:\Windows\System\irilBvc.exe
  C:\Windows\System\irilBvc.exe
  2⤵
  PID:3548
- C:\Windows\System\DqltPNR.exe
  C:\Windows\System\DqltPNR.exe
  2⤵
  PID:3444
- C:\Windows\System\SDUMbeK.exe
  C:\Windows\System\SDUMbeK.exe
  2⤵
  PID:3576
- C:\Windows\System\BwytGij.exe
  C:\Windows\System\BwytGij.exe
  2⤵
  PID:3592
- C:\Windows\System\tZWlNBa.exe
  C:\Windows\System\tZWlNBa.exe
  2⤵
  PID:952
- C:\Windows\System\eDqBYQH.exe
  C:\Windows\System\eDqBYQH.exe
  2⤵
  PID:3244
- C:\Windows\System\QnGcssq.exe
  C:\Windows\System\QnGcssq.exe
  2⤵
  PID:3696
- C:\Windows\System\coHBqWb.exe
  C:\Windows\System\coHBqWb.exe
  2⤵
  PID:3612
- C:\Windows\System\OAEZaZn.exe
  C:\Windows\System\OAEZaZn.exe
  2⤵
  PID:3624
- C:\Windows\System\BGGqfRi.exe
  C:\Windows\System\BGGqfRi.exe
  2⤵
  PID:3640
- C:\Windows\System\RqOOmGj.exe
  C:\Windows\System\RqOOmGj.exe
  2⤵
  PID:3528
- C:\Windows\System\mRJKTsA.exe
  C:\Windows\System\mRJKTsA.exe
  2⤵
  PID:3768
- C:\Windows\System\dZLayVY.exe
  C:\Windows\System\dZLayVY.exe
  2⤵
  PID:3828
- C:\Windows\System\aXMEooW.exe
  C:\Windows\System\aXMEooW.exe
  2⤵
  PID:3896
- C:\Windows\System\OMmNaQC.exe
  C:\Windows\System\OMmNaQC.exe
  2⤵
  PID:3512
- C:\Windows\System\CrySbAR.exe
  C:\Windows\System\CrySbAR.exe
  2⤵
  PID:3816
- C:\Windows\System\JkmeDjz.exe
  C:\Windows\System\JkmeDjz.exe
  2⤵
  PID:3140
- C:\Windows\System\QqQOCGt.exe
  C:\Windows\System\QqQOCGt.exe
  2⤵
  PID:3748
- C:\Windows\System\oGsdOTt.exe
  C:\Windows\System\oGsdOTt.exe
  2⤵
  PID:3812
- C:\Windows\System\gwqNrFu.exe
  C:\Windows\System\gwqNrFu.exe
  2⤵
  PID:3916
- C:\Windows\System\CxwFEHN.exe
  C:\Windows\System\CxwFEHN.exe
  2⤵
  PID:4008
- C:\Windows\System\HYJSEDn.exe
  C:\Windows\System\HYJSEDn.exe
  2⤵
  PID:4048
- C:\Windows\System\glamfFC.exe
  C:\Windows\System\glamfFC.exe
  2⤵
  PID:1896
- C:\Windows\System\onGTblx.exe
  C:\Windows\System\onGTblx.exe
  2⤵
  PID:3308
- C:\Windows\System\HJfZSAC.exe
  C:\Windows\System\HJfZSAC.exe
  2⤵
  PID:3080
- C:\Windows\System\nrpnJwX.exe
  C:\Windows\System\nrpnJwX.exe
  2⤵
  PID:3256
- C:\Windows\System\TqKxfZh.exe
  C:\Windows\System\TqKxfZh.exe
  2⤵
  PID:2968
- C:\Windows\System\ogixcVU.exe
  C:\Windows\System\ogixcVU.exe
  2⤵
  PID:3092
- C:\Windows\System\IgzBnyo.exe
  C:\Windows\System\IgzBnyo.exe
  2⤵
  PID:3124
- C:\Windows\System\mSlkxtX.exe
  C:\Windows\System\mSlkxtX.exe
  2⤵
  PID:4064
- C:\Windows\System\cnRiBDW.exe
  C:\Windows\System\cnRiBDW.exe
  2⤵
  PID:3356
- C:\Windows\System\dmsZqgM.exe
  C:\Windows\System\dmsZqgM.exe
  2⤵
  PID:3488
- C:\Windows\System\hZfqQXg.exe
  C:\Windows\System\hZfqQXg.exe
  2⤵
  PID:576
- C:\Windows\System\hyfynDQ.exe
  C:\Windows\System\hyfynDQ.exe
  2⤵
  PID:2264
- C:\Windows\System\ABOvIwA.exe
  C:\Windows\System\ABOvIwA.exe
  2⤵
  PID:3424
- C:\Windows\System\MeGDArX.exe
  C:\Windows\System\MeGDArX.exe
  2⤵
  PID:3436
- C:\Windows\System\EVvFzrQ.exe
  C:\Windows\System\EVvFzrQ.exe
  2⤵
  PID:1968
- C:\Windows\System\VNnBGwn.exe
  C:\Windows\System\VNnBGwn.exe
  2⤵
  PID:3440
- C:\Windows\System\HKwiLlc.exe
  C:\Windows\System\HKwiLlc.exe
  2⤵
  PID:1572
- C:\Windows\System\vrNDjsA.exe
  C:\Windows\System\vrNDjsA.exe
  2⤵
  PID:3632
- C:\Windows\System\pcPJYkg.exe
  C:\Windows\System\pcPJYkg.exe
  2⤵
  PID:3864
- C:\Windows\System\atXpeEu.exe
  C:\Windows\System\atXpeEu.exe
  2⤵
  PID:3744
- C:\Windows\System\vcwiJiC.exe
  C:\Windows\System\vcwiJiC.exe
  2⤵
  PID:3876
- C:\Windows\System\VugexoL.exe
  C:\Windows\System\VugexoL.exe
  2⤵
  PID:4016
- C:\Windows\System\cBasUui.exe
  C:\Windows\System\cBasUui.exe
  2⤵
  PID:3508
- C:\Windows\System\mzxdRCy.exe
  C:\Windows\System\mzxdRCy.exe
  2⤵
  PID:3668
- C:\Windows\System\YDqbUAU.exe
  C:\Windows\System\YDqbUAU.exe
  2⤵
  PID:1668
- C:\Windows\System\UkzbBXW.exe
  C:\Windows\System\UkzbBXW.exe
  2⤵
  PID:3880
- C:\Windows\System\CstgANY.exe
  C:\Windows\System\CstgANY.exe
  2⤵
  PID:3976
- C:\Windows\System\GqdkHbG.exe
  C:\Windows\System\GqdkHbG.exe
  2⤵
  PID:3228
- C:\Windows\System\QnrHqpF.exe
  C:\Windows\System\QnrHqpF.exe
  2⤵
  PID:2820
- C:\Windows\System\izkjZeQ.exe
  C:\Windows\System\izkjZeQ.exe
  2⤵
  PID:608
- C:\Windows\System\iwlyRBR.exe
  C:\Windows\System\iwlyRBR.exe
  2⤵
  PID:3376
- C:\Windows\System\ovnvUYo.exe
  C:\Windows\System\ovnvUYo.exe
  2⤵
  PID:268
- C:\Windows\System\kraRbli.exe
  C:\Windows\System\kraRbli.exe
  2⤵
  PID:1552
- C:\Windows\System\bjHNDMo.exe
  C:\Windows\System\bjHNDMo.exe
  2⤵
  PID:1036
- C:\Windows\System\MRfIKiz.exe
  C:\Windows\System\MRfIKiz.exe
  2⤵
  PID:3572
- C:\Windows\System\uWYAwrs.exe
  C:\Windows\System\uWYAwrs.exe
  2⤵
  PID:2728
- C:\Windows\System\htgJrkf.exe
  C:\Windows\System\htgJrkf.exe
  2⤵
  PID:1940
- C:\Windows\System\jQpFeNK.exe
  C:\Windows\System\jQpFeNK.exe
  2⤵
  PID:3892
- C:\Windows\System\BgLNtXB.exe
  C:\Windows\System\BgLNtXB.exe
  2⤵
  PID:3540
- C:\Windows\System\ElLLJeg.exe
  C:\Windows\System\ElLLJeg.exe
  2⤵
  PID:4104
- C:\Windows\System\bUEHVpL.exe
  C:\Windows\System\bUEHVpL.exe
  2⤵
  PID:4120
- C:\Windows\System\ricfZSf.exe
  C:\Windows\System\ricfZSf.exe
  2⤵
  PID:4136
- C:\Windows\System\XqnVnuh.exe
  C:\Windows\System\XqnVnuh.exe
  2⤵
  PID:4156
- C:\Windows\System\gWPdvor.exe
  C:\Windows\System\gWPdvor.exe
  2⤵
  PID:4172
- C:\Windows\System\HCrEPHa.exe
  C:\Windows\System\HCrEPHa.exe
  2⤵
  PID:4188
- C:\Windows\System\HoechkB.exe
  C:\Windows\System\HoechkB.exe
  2⤵
  PID:4204
- C:\Windows\System\AQyTZdS.exe
  C:\Windows\System\AQyTZdS.exe
  2⤵
  PID:4220
- C:\Windows\System\gjjDRzm.exe
  C:\Windows\System\gjjDRzm.exe
  2⤵
  PID:4236
- C:\Windows\System\EIHGteL.exe
  C:\Windows\System\EIHGteL.exe
  2⤵
  PID:4252
- C:\Windows\System\yYUPYFQ.exe
  C:\Windows\System\yYUPYFQ.exe
  2⤵
  PID:4268
- C:\Windows\System\LSAPqUF.exe
  C:\Windows\System\LSAPqUF.exe
  2⤵
  PID:4284
- C:\Windows\System\NpHJTwc.exe
  C:\Windows\System\NpHJTwc.exe
  2⤵
  PID:4300
- C:\Windows\System\TIbzvfR.exe
  C:\Windows\System\TIbzvfR.exe
  2⤵
  PID:4320
- C:\Windows\System\cavoTPE.exe
  C:\Windows\System\cavoTPE.exe
  2⤵
  PID:4344
- C:\Windows\System\aYqhBOO.exe
  C:\Windows\System\aYqhBOO.exe
  2⤵
  PID:4360
- C:\Windows\System\XyqkpDF.exe
  C:\Windows\System\XyqkpDF.exe
  2⤵
  PID:4376
- C:\Windows\System\YWxdSsA.exe
  C:\Windows\System\YWxdSsA.exe
  2⤵
  PID:4392
- C:\Windows\System\GvsAccm.exe
  C:\Windows\System\GvsAccm.exe
  2⤵
  PID:4408
- C:\Windows\System\wxiTVFE.exe
  C:\Windows\System\wxiTVFE.exe
  2⤵
  PID:4424
- C:\Windows\System\nfBuziZ.exe
  C:\Windows\System\nfBuziZ.exe
  2⤵
  PID:4440
- C:\Windows\System\OtktWuB.exe
  C:\Windows\System\OtktWuB.exe
  2⤵
  PID:4456
- C:\Windows\System\STlGHGe.exe
  C:\Windows\System\STlGHGe.exe
  2⤵
  PID:4472
- C:\Windows\System\hpGtXCk.exe
  C:\Windows\System\hpGtXCk.exe
  2⤵
  PID:4488
- C:\Windows\System\NMHUMnI.exe
  C:\Windows\System\NMHUMnI.exe
  2⤵
  PID:4508
- C:\Windows\System\PumopEI.exe
  C:\Windows\System\PumopEI.exe
  2⤵
  PID:4524
- C:\Windows\System\NUXmgRM.exe
  C:\Windows\System\NUXmgRM.exe
  2⤵
  PID:4540
- C:\Windows\System\ZkwCRNX.exe
  C:\Windows\System\ZkwCRNX.exe
  2⤵
  PID:4556
- C:\Windows\System\aYOyrgn.exe
  C:\Windows\System\aYOyrgn.exe
  2⤵
  PID:4572
- C:\Windows\System\KaSvlco.exe
  C:\Windows\System\KaSvlco.exe
  2⤵
  PID:4588
- C:\Windows\System\niWEgTs.exe
  C:\Windows\System\niWEgTs.exe
  2⤵
  PID:4604
- C:\Windows\System\oYLtEAk.exe
  C:\Windows\System\oYLtEAk.exe
  2⤵
  PID:4620
- C:\Windows\System\oqssxOq.exe
  C:\Windows\System\oqssxOq.exe
  2⤵
  PID:4636
- C:\Windows\System\mbcyzim.exe
  C:\Windows\System\mbcyzim.exe
  2⤵
  PID:4652
- C:\Windows\System\mTJnwQq.exe
  C:\Windows\System\mTJnwQq.exe
  2⤵
  PID:4668
- C:\Windows\System\cSfHgFn.exe
  C:\Windows\System\cSfHgFn.exe
  2⤵
  PID:4684
- C:\Windows\System\omsUnOf.exe
  C:\Windows\System\omsUnOf.exe
  2⤵
  PID:4700
- C:\Windows\System\RLmRBGy.exe
  C:\Windows\System\RLmRBGy.exe
  2⤵
  PID:4716
- C:\Windows\System\ayesQCn.exe
  C:\Windows\System\ayesQCn.exe
  2⤵
  PID:4732
- C:\Windows\System\RSQZCqo.exe
  C:\Windows\System\RSQZCqo.exe
  2⤵
  PID:4748
- C:\Windows\System\SHHoOCK.exe
  C:\Windows\System\SHHoOCK.exe
  2⤵
  PID:4764
- C:\Windows\System\DNYBMHt.exe
  C:\Windows\System\DNYBMHt.exe
  2⤵
  PID:4780
- C:\Windows\System\iXAtEkH.exe
  C:\Windows\System\iXAtEkH.exe
  2⤵
  PID:4796
- C:\Windows\System\SecFYkr.exe
  C:\Windows\System\SecFYkr.exe
  2⤵
  PID:4812
- C:\Windows\System\TKeIxYG.exe
  C:\Windows\System\TKeIxYG.exe
  2⤵
  PID:4828
- C:\Windows\System\rcsrhZU.exe
  C:\Windows\System\rcsrhZU.exe
  2⤵
  PID:4844
- C:\Windows\System\dYVIkCT.exe
  C:\Windows\System\dYVIkCT.exe
  2⤵
  PID:4860
- C:\Windows\System\yFfHZIC.exe
  C:\Windows\System\yFfHZIC.exe
  2⤵
  PID:4876
- C:\Windows\System\XycPLKq.exe
  C:\Windows\System\XycPLKq.exe
  2⤵
  PID:4896
- C:\Windows\System\PCHeyiF.exe
  C:\Windows\System\PCHeyiF.exe
  2⤵
  PID:4912
- C:\Windows\System\XApPyTc.exe
  C:\Windows\System\XApPyTc.exe
  2⤵
  PID:4928
- C:\Windows\System\GPUiCeM.exe
  C:\Windows\System\GPUiCeM.exe
  2⤵
  PID:4944
- C:\Windows\System\AqNBgPq.exe
  C:\Windows\System\AqNBgPq.exe
  2⤵
  PID:4960
- C:\Windows\System\WWQhehS.exe
  C:\Windows\System\WWQhehS.exe
  2⤵
  PID:4976
- C:\Windows\System\jegzGlm.exe
  C:\Windows\System\jegzGlm.exe
  2⤵
  PID:4992
- C:\Windows\System\kEvUDIt.exe
  C:\Windows\System\kEvUDIt.exe
  2⤵
  PID:5008
- C:\Windows\System\QVnVzbd.exe
  C:\Windows\System\QVnVzbd.exe
  2⤵
  PID:5024
- C:\Windows\System\ajtsBIJ.exe
  C:\Windows\System\ajtsBIJ.exe
  2⤵
  PID:5040
- C:\Windows\System\ahmLeXq.exe
  C:\Windows\System\ahmLeXq.exe
  2⤵
  PID:5056
- C:\Windows\System\GcBcKEu.exe
  C:\Windows\System\GcBcKEu.exe
  2⤵
  PID:5072
- C:\Windows\System\bESrolK.exe
  C:\Windows\System\bESrolK.exe
  2⤵
  PID:5088
- C:\Windows\System\eHjHFqm.exe
  C:\Windows\System\eHjHFqm.exe
  2⤵
  PID:5104
- C:\Windows\System\lxswZJe.exe
  C:\Windows\System\lxswZJe.exe
  2⤵
  PID:2764
- C:\Windows\System\SxEkIjw.exe
  C:\Windows\System\SxEkIjw.exe
  2⤵
  PID:4100
- C:\Windows\System\GxUqCUE.exe
  C:\Windows\System\GxUqCUE.exe
  2⤵
  PID:4164
- C:\Windows\System\qBMTlJq.exe
  C:\Windows\System\qBMTlJq.exe
  2⤵
  PID:3524
- C:\Windows\System\USlaXei.exe
  C:\Windows\System\USlaXei.exe
  2⤵
  PID:3764
- C:\Windows\System\EJaCPsA.exe
  C:\Windows\System\EJaCPsA.exe
  2⤵
  PID:4260
- C:\Windows\System\GdgMnnn.exe
  C:\Windows\System\GdgMnnn.exe
  2⤵
  PID:3912
- C:\Windows\System\wwYpWle.exe
  C:\Windows\System\wwYpWle.exe
  2⤵
  PID:3620
- C:\Windows\System\RcTwqsr.exe
  C:\Windows\System\RcTwqsr.exe
  2⤵
  PID:2036
- C:\Windows\System\cLmpEUv.exe
  C:\Windows\System\cLmpEUv.exe
  2⤵
  PID:3240
- C:\Windows\System\SGiCUEM.exe
  C:\Windows\System\SGiCUEM.exe
  2⤵
  PID:3960
- C:\Windows\System\jODHjEt.exe
  C:\Windows\System\jODHjEt.exe
  2⤵
  PID:4112
- C:\Windows\System\jtxwbby.exe
  C:\Windows\System\jtxwbby.exe
  2⤵
  PID:4152
- C:\Windows\System\QElZTNy.exe
  C:\Windows\System\QElZTNy.exe
  2⤵
  PID:4216
- C:\Windows\System\rTbmPWm.exe
  C:\Windows\System\rTbmPWm.exe
  2⤵
  PID:4244
- C:\Windows\System\URSwnVS.exe
  C:\Windows\System\URSwnVS.exe
  2⤵
  PID:4332
- C:\Windows\System\uGuqdvH.exe
  C:\Windows\System\uGuqdvH.exe
  2⤵
  PID:4340
- C:\Windows\System\lQtGsqt.exe
  C:\Windows\System\lQtGsqt.exe
  2⤵
  PID:4372
- C:\Windows\System\cNOVcAT.exe
  C:\Windows\System\cNOVcAT.exe
  2⤵
  PID:4464
- C:\Windows\System\sznHvgH.exe
  C:\Windows\System\sznHvgH.exe
  2⤵
  PID:4436
- C:\Windows\System\XOiFxXZ.exe
  C:\Windows\System\XOiFxXZ.exe
  2⤵
  PID:4564
- C:\Windows\System\mKjimxo.exe
  C:\Windows\System\mKjimxo.exe
  2⤵
  PID:2676
- C:\Windows\System\MSpEgFK.exe
  C:\Windows\System\MSpEgFK.exe
  2⤵
  PID:4628
- C:\Windows\System\QZaKbqI.exe
  C:\Windows\System\QZaKbqI.exe
  2⤵
  PID:4696
- C:\Windows\System\rOpAGtm.exe
  C:\Windows\System\rOpAGtm.exe
  2⤵
  PID:4760
- C:\Windows\System\yHjMFEt.exe
  C:\Windows\System\yHjMFEt.exe
  2⤵
  PID:888
- C:\Windows\System\wvBqlIJ.exe
  C:\Windows\System\wvBqlIJ.exe
  2⤵
  PID:4884
- C:\Windows\System\cBhsDOs.exe
  C:\Windows\System\cBhsDOs.exe
  2⤵
  PID:4920
- C:\Windows\System\lvrvJxZ.exe
  C:\Windows\System\lvrvJxZ.exe
  2⤵
  PID:4484
- C:\Windows\System\vfCQGHM.exe
  C:\Windows\System\vfCQGHM.exe
  2⤵
  PID:5020
- C:\Windows\System\jXnJhwQ.exe
  C:\Windows\System\jXnJhwQ.exe
  2⤵
  PID:5080
- C:\Windows\System\libxFUi.exe
  C:\Windows\System\libxFUi.exe
  2⤵
  PID:4552
- C:\Windows\System\DlrPeSk.exe
  C:\Windows\System\DlrPeSk.exe
  2⤵
  PID:3732
- C:\Windows\System\fKlDZuN.exe
  C:\Windows\System\fKlDZuN.exe
  2⤵
  PID:3780
- C:\Windows\System\OyhEUMs.exe
  C:\Windows\System\OyhEUMs.exe
  2⤵
  PID:3784
- C:\Windows\System\SNKNOsQ.exe
  C:\Windows\System\SNKNOsQ.exe
  2⤵
  PID:4712
- C:\Windows\System\KFWUGFO.exe
  C:\Windows\System\KFWUGFO.exe
  2⤵
  PID:4520
- C:\Windows\System\HrsMche.exe
  C:\Windows\System\HrsMche.exe
  2⤵
  PID:4148
- C:\Windows\System\inpUTww.exe
  C:\Windows\System\inpUTww.exe
  2⤵
  PID:4584
- C:\Windows\System\iZqHlJM.exe
  C:\Windows\System\iZqHlJM.exe
  2⤵
  PID:4940
- C:\Windows\System\oGIKiyq.exe
  C:\Windows\System\oGIKiyq.exe
  2⤵
  PID:4404
- C:\Windows\System\ptDTyiu.exe
  C:\Windows\System\ptDTyiu.exe
  2⤵
  PID:4680
- C:\Windows\System\qognIyH.exe
  C:\Windows\System\qognIyH.exe
  2⤵
  PID:4772
- C:\Windows\System\onEXJNM.exe
  C:\Windows\System\onEXJNM.exe
  2⤵
  PID:4872
- C:\Windows\System\AhPhBAI.exe
  C:\Windows\System\AhPhBAI.exe
  2⤵
  PID:4908
- C:\Windows\System\oAlJLtm.exe
  C:\Windows\System\oAlJLtm.exe
  2⤵
  PID:5004
- C:\Windows\System\tAYMLwD.exe
  C:\Windows\System\tAYMLwD.exe
  2⤵
  PID:5068
- C:\Windows\System\uziBQCI.exe
  C:\Windows\System\uziBQCI.exe
  2⤵
  PID:3320
- C:\Windows\System\xnCWBBZ.exe
  C:\Windows\System\xnCWBBZ.exe
  2⤵
  PID:4044
- C:\Windows\System\yCcTCCs.exe
  C:\Windows\System\yCcTCCs.exe
  2⤵
  PID:3292
- C:\Windows\System\AtQVcry.exe
  C:\Windows\System\AtQVcry.exe
  2⤵
  PID:4728
- C:\Windows\System\YIbsdkX.exe
  C:\Windows\System\YIbsdkX.exe
  2⤵
  PID:4316
- C:\Windows\System\nhnRPKX.exe
  C:\Windows\System\nhnRPKX.exe
  2⤵
  PID:4952
- C:\Windows\System\HFghOdg.exe
  C:\Windows\System\HFghOdg.exe
  2⤵
  PID:4648
- C:\Windows\System\sLlJNyo.exe
  C:\Windows\System\sLlJNyo.exe
  2⤵
  PID:4744
- C:\Windows\System\gZSABuj.exe
  C:\Windows\System\gZSABuj.exe
  2⤵
  PID:4448
- C:\Windows\System\kYNnSwj.exe
  C:\Windows\System\kYNnSwj.exe
  2⤵
  PID:3996
- C:\Windows\System\ENDptez.exe
  C:\Windows\System\ENDptez.exe
  2⤵
  PID:4212
- C:\Windows\System\IKJrzPR.exe
  C:\Windows\System\IKJrzPR.exe
  2⤵
  PID:4384
- C:\Windows\System\ukoFnvN.exe
  C:\Windows\System\ukoFnvN.exe
  2⤵
  PID:5036
- C:\Windows\System\HJkPxgF.exe
  C:\Windows\System\HJkPxgF.exe
  2⤵
  PID:5052
- C:\Windows\System\kngAoLB.exe
  C:\Windows\System\kngAoLB.exe
  2⤵
  PID:4516
- C:\Windows\System\hEsoxXZ.exe
  C:\Windows\System\hEsoxXZ.exe
  2⤵
  PID:4740
- C:\Windows\System\XsyGQlf.exe
  C:\Windows\System\XsyGQlf.exe
  2⤵
  PID:4824
- C:\Windows\System\bhLjHHO.exe
  C:\Windows\System\bhLjHHO.exe
  2⤵
  PID:2640
- C:\Windows\System\GbgtXvA.exe
  C:\Windows\System\GbgtXvA.exe
  2⤵
  PID:4836
- C:\Windows\System\URVcKHw.exe
  C:\Windows\System\URVcKHw.exe
  2⤵
  PID:2664
- C:\Windows\System\nvMtmxO.exe
  C:\Windows\System\nvMtmxO.exe
  2⤵
  PID:4580
- C:\Windows\System\TEVARfe.exe
  C:\Windows\System\TEVARfe.exe
  2⤵
  PID:2744
- C:\Windows\System\lIuAtDz.exe
  C:\Windows\System\lIuAtDz.exe
  2⤵
  PID:312
- C:\Windows\System\rpoiXqU.exe
  C:\Windows\System\rpoiXqU.exe
  2⤵
  PID:5124
- C:\Windows\System\dORauyY.exe
  C:\Windows\System\dORauyY.exe
  2⤵
  PID:5140
- C:\Windows\System\HXpghVk.exe
  C:\Windows\System\HXpghVk.exe
  2⤵
  PID:5156
- C:\Windows\System\DpOJMvx.exe
  C:\Windows\System\DpOJMvx.exe
  2⤵
  PID:5176
- C:\Windows\System\NdRGCTF.exe
  C:\Windows\System\NdRGCTF.exe
  2⤵
  PID:5192
- C:\Windows\System\reDesFM.exe
  C:\Windows\System\reDesFM.exe
  2⤵
  PID:5208
- C:\Windows\System\twxDWVF.exe
  C:\Windows\System\twxDWVF.exe
  2⤵
  PID:5224
- C:\Windows\System\desXnsa.exe
  C:\Windows\System\desXnsa.exe
  2⤵
  PID:5240
- C:\Windows\System\WSrqDrZ.exe
  C:\Windows\System\WSrqDrZ.exe
  2⤵
  PID:5256
- C:\Windows\System\BGqmlVn.exe
  C:\Windows\System\BGqmlVn.exe
  2⤵
  PID:5276
- C:\Windows\System\UmKxJOd.exe
  C:\Windows\System\UmKxJOd.exe
  2⤵
  PID:5296
- C:\Windows\System\PqPCMiK.exe
  C:\Windows\System\PqPCMiK.exe
  2⤵
  PID:5312
- C:\Windows\System\toumObs.exe
  C:\Windows\System\toumObs.exe
  2⤵
  PID:5328
- C:\Windows\System\HNdUUYg.exe
  C:\Windows\System\HNdUUYg.exe
  2⤵
  PID:5344
- C:\Windows\System\nZXRqig.exe
  C:\Windows\System\nZXRqig.exe
  2⤵
  PID:5360
- C:\Windows\System\teNhVek.exe
  C:\Windows\System\teNhVek.exe
  2⤵
  PID:5376
- C:\Windows\System\EigOtNZ.exe
  C:\Windows\System\EigOtNZ.exe
  2⤵
  PID:5392
- C:\Windows\System\uIlLHIj.exe
  C:\Windows\System\uIlLHIj.exe
  2⤵
  PID:5408
- C:\Windows\System\sRTrTqF.exe
  C:\Windows\System\sRTrTqF.exe
  2⤵
  PID:5424
- C:\Windows\System\tDHeEqu.exe
  C:\Windows\System\tDHeEqu.exe
  2⤵
  PID:5440
- C:\Windows\System\uGtlhLZ.exe
  C:\Windows\System\uGtlhLZ.exe
  2⤵
  PID:5456
- C:\Windows\System\LBrTylc.exe
  C:\Windows\System\LBrTylc.exe
  2⤵
  PID:5472
- C:\Windows\System\nTnLKNW.exe
  C:\Windows\System\nTnLKNW.exe
  2⤵
  PID:5492
- C:\Windows\System\xOyHZbA.exe
  C:\Windows\System\xOyHZbA.exe
  2⤵
  PID:5508
- C:\Windows\System\fHexfEB.exe
  C:\Windows\System\fHexfEB.exe
  2⤵
  PID:5524
- C:\Windows\System\JdRkouj.exe
  C:\Windows\System\JdRkouj.exe
  2⤵
  PID:5540
- C:\Windows\System\MvtzjOL.exe
  C:\Windows\System\MvtzjOL.exe
  2⤵
  PID:5556
- C:\Windows\System\ztLYfYk.exe
  C:\Windows\System\ztLYfYk.exe
  2⤵
  PID:5572
- C:\Windows\System\lGPWNgx.exe
  C:\Windows\System\lGPWNgx.exe
  2⤵
  PID:5592
- C:\Windows\System\YgXDZpr.exe
  C:\Windows\System\YgXDZpr.exe
  2⤵
  PID:5608
- C:\Windows\System\ICSvUEj.exe
  C:\Windows\System\ICSvUEj.exe
  2⤵
  PID:5624
- C:\Windows\System\aUPWxzo.exe
  C:\Windows\System\aUPWxzo.exe
  2⤵
  PID:5640
- C:\Windows\System\uCNbzfd.exe
  C:\Windows\System\uCNbzfd.exe
  2⤵
  PID:5656
- C:\Windows\System\brdTKyU.exe
  C:\Windows\System\brdTKyU.exe
  2⤵
  PID:5672
- C:\Windows\System\zBulKYU.exe
  C:\Windows\System\zBulKYU.exe
  2⤵
  PID:5688
- C:\Windows\System\jBaVZIN.exe
  C:\Windows\System\jBaVZIN.exe
  2⤵
  PID:5708
- C:\Windows\System\TleDhvI.exe
  C:\Windows\System\TleDhvI.exe
  2⤵
  PID:5732
- C:\Windows\System\YtzEPSc.exe
  C:\Windows\System\YtzEPSc.exe
  2⤵
  PID:5752
- C:\Windows\System\vRcLOUC.exe
  C:\Windows\System\vRcLOUC.exe
  2⤵
  PID:5768
- C:\Windows\System\tGkagEI.exe
  C:\Windows\System\tGkagEI.exe
  2⤵
  PID:5784
- C:\Windows\System\moJktjl.exe
  C:\Windows\System\moJktjl.exe
  2⤵
  PID:5800
- C:\Windows\System\CWoXVRI.exe
  C:\Windows\System\CWoXVRI.exe
  2⤵
  PID:5816
- C:\Windows\System\axQNwCX.exe
  C:\Windows\System\axQNwCX.exe
  2⤵
  PID:5832
- C:\Windows\System\MNLjocD.exe
  C:\Windows\System\MNLjocD.exe
  2⤵
  PID:5848
- C:\Windows\System\SXpZWzZ.exe
  C:\Windows\System\SXpZWzZ.exe
  2⤵
  PID:5864
- C:\Windows\System\ImyEvJS.exe
  C:\Windows\System\ImyEvJS.exe
  2⤵
  PID:5880
- C:\Windows\System\efjqklj.exe
  C:\Windows\System\efjqklj.exe
  2⤵
  PID:5900
- C:\Windows\System\NsocDVf.exe
  C:\Windows\System\NsocDVf.exe
  2⤵
  PID:5916
- C:\Windows\System\TTPLWRn.exe
  C:\Windows\System\TTPLWRn.exe
  2⤵
  PID:5932
- C:\Windows\System\WYlnywz.exe
  C:\Windows\System\WYlnywz.exe
  2⤵
  PID:5948
- C:\Windows\System\OrTMMWr.exe
  C:\Windows\System\OrTMMWr.exe
  2⤵
  PID:5964
- C:\Windows\System\uDaoUwx.exe
  C:\Windows\System\uDaoUwx.exe
  2⤵
  PID:5980
- C:\Windows\System\dPneSkY.exe
  C:\Windows\System\dPneSkY.exe
  2⤵
  PID:5996
- C:\Windows\System\MXuqmhq.exe
  C:\Windows\System\MXuqmhq.exe
  2⤵
  PID:6012
- C:\Windows\System\GChaIeF.exe
  C:\Windows\System\GChaIeF.exe
  2⤵
  PID:6028
- C:\Windows\System\aRYxYIy.exe
  C:\Windows\System\aRYxYIy.exe
  2⤵
  PID:6044
- C:\Windows\System\ldpwZgl.exe
  C:\Windows\System\ldpwZgl.exe
  2⤵
  PID:6064
- C:\Windows\System\RlrplGE.exe
  C:\Windows\System\RlrplGE.exe
  2⤵
  PID:6112
- C:\Windows\System\xxwcbiI.exe
  C:\Windows\System\xxwcbiI.exe
  2⤵
  PID:6132
- C:\Windows\System\QvMhDaZ.exe
  C:\Windows\System\QvMhDaZ.exe
  2⤵
  PID:4644
- C:\Windows\System\bRvAUjq.exe
  C:\Windows\System\bRvAUjq.exe
  2⤵
  PID:5416
- C:\Windows\System\aEjuuIz.exe
  C:\Windows\System\aEjuuIz.exe
  2⤵
  PID:5304
- C:\Windows\System\crgxXaY.exe
  C:\Windows\System\crgxXaY.exe
  2⤵
  PID:5452
- C:\Windows\System\aOrSefg.exe
  C:\Windows\System\aOrSefg.exe
  2⤵
  PID:5516
- C:\Windows\System\ubsWDEn.exe
  C:\Windows\System\ubsWDEn.exe
  2⤵
  PID:4184
- C:\Windows\System\akMvlvC.exe
  C:\Windows\System\akMvlvC.exe
  2⤵
  PID:5204
- C:\Windows\System\mjUdWYE.exe
  C:\Windows\System\mjUdWYE.exe
  2⤵
  PID:5268
- C:\Windows\System\AowDHWp.exe
  C:\Windows\System\AowDHWp.exe
  2⤵
  PID:5568
- C:\Windows\System\gEGyprt.exe
  C:\Windows\System\gEGyprt.exe
  2⤵
  PID:5468
- C:\Windows\System\GkFMWiA.exe
  C:\Windows\System\GkFMWiA.exe
  2⤵
  PID:5404
- C:\Windows\System\uwUFhmy.exe
  C:\Windows\System\uwUFhmy.exe
  2⤵
  PID:5464
- C:\Windows\System\PPTHxUC.exe
  C:\Windows\System\PPTHxUC.exe
  2⤵
  PID:5536
- C:\Windows\System\EyGBAxm.exe
  C:\Windows\System\EyGBAxm.exe
  2⤵
  PID:5696
- C:\Windows\System\LPTIxSi.exe
  C:\Windows\System\LPTIxSi.exe
  2⤵
  PID:5780
- C:\Windows\System\OqHcIpq.exe
  C:\Windows\System\OqHcIpq.exe
  2⤵
  PID:5844
- C:\Windows\System\umkpTZr.exe
  C:\Windows\System\umkpTZr.exe
  2⤵
  PID:5912
- C:\Windows\System\ieonlPE.exe
  C:\Windows\System\ieonlPE.exe
  2⤵
  PID:5976
- C:\Windows\System\EgRwcTm.exe
  C:\Windows\System\EgRwcTm.exe
  2⤵
  PID:6040
- C:\Windows\System\wrHQoxJ.exe
  C:\Windows\System\wrHQoxJ.exe
  2⤵
  PID:5620
- C:\Windows\System\NSFEGVC.exe
  C:\Windows\System\NSFEGVC.exe
  2⤵
  PID:5684
- C:\Windows\System\pkiduww.exe
  C:\Windows\System\pkiduww.exe
  2⤵
  PID:5760
- C:\Windows\System\gClRFDk.exe
  C:\Windows\System\gClRFDk.exe
  2⤵
  PID:5824
- C:\Windows\System\anFyRgu.exe
  C:\Windows\System\anFyRgu.exe
  2⤵
  PID:5888
- C:\Windows\System\zVCWGwZ.exe
  C:\Windows\System\zVCWGwZ.exe
  2⤵
  PID:5928
- C:\Windows\System\RwKUvzc.exe
  C:\Windows\System\RwKUvzc.exe
  2⤵
  PID:5992
- C:\Windows\System\UDYxMvC.exe
  C:\Windows\System\UDYxMvC.exe
  2⤵
  PID:6088
- C:\Windows\System\AlySLwJ.exe
  C:\Windows\System\AlySLwJ.exe
  2⤵
  PID:6104
- C:\Windows\System\sMnWClz.exe
  C:\Windows\System\sMnWClz.exe
  2⤵
  PID:5616
- C:\Windows\System\IZoduDs.exe
  C:\Windows\System\IZoduDs.exe
  2⤵
  PID:6128
- C:\Windows\System\MoYYJSP.exe
  C:\Windows\System\MoYYJSP.exe
  2⤵
  PID:6060
- C:\Windows\System\glcgqop.exe
  C:\Windows\System\glcgqop.exe
  2⤵
  PID:4852
- C:\Windows\System\CavDExI.exe
  C:\Windows\System\CavDExI.exe
  2⤵
  PID:4840
- C:\Windows\System\bdqDMRV.exe
  C:\Windows\System\bdqDMRV.exe
  2⤵
  PID:5188
- C:\Windows\System\ApvHfKL.exe
  C:\Windows\System\ApvHfKL.exe
  2⤵
  PID:5252
- C:\Windows\System\xLRhzoN.exe
  C:\Windows\System\xLRhzoN.exe
  2⤵
  PID:5288
- C:\Windows\System\toGloLq.exe
  C:\Windows\System\toGloLq.exe
  2⤵
  PID:5336
- C:\Windows\System\IHMEHBM.exe
  C:\Windows\System\IHMEHBM.exe
  2⤵
  PID:4988
- C:\Windows\System\RRIjqdH.exe
  C:\Windows\System\RRIjqdH.exe
  2⤵
  PID:5324
- C:\Windows\System\RseIdYS.exe
  C:\Windows\System\RseIdYS.exe
  2⤵
  PID:5484
- C:\Windows\System\jPEBJXB.exe
  C:\Windows\System\jPEBJXB.exe
  2⤵
  PID:5200
- C:\Windows\System\TxlsvuX.exe
  C:\Windows\System\TxlsvuX.exe
  2⤵
  PID:5388
- C:\Windows\System\ZKtrInR.exe
  C:\Windows\System\ZKtrInR.exe
  2⤵
  PID:5548
- C:\Windows\System\RqEcTXx.exe
  C:\Windows\System\RqEcTXx.exe
  2⤵
  PID:5236
- C:\Windows\System\ivIczhY.exe
  C:\Windows\System\ivIczhY.exe
  2⤵
  PID:5664
- C:\Windows\System\tBpGwbo.exe
  C:\Windows\System\tBpGwbo.exe
  2⤵
  PID:5744
- C:\Windows\System\JhcyQBr.exe
  C:\Windows\System\JhcyQBr.exe
  2⤵
  PID:5668
- C:\Windows\System\mCMRdkn.exe
  C:\Windows\System\mCMRdkn.exe
  2⤵
  PID:5944
- C:\Windows\System\oxVtlJv.exe
  C:\Windows\System\oxVtlJv.exe
  2⤵
  PID:5652
- C:\Windows\System\bFXxnba.exe
  C:\Windows\System\bFXxnba.exe
  2⤵
  PID:5972
- C:\Windows\System\KDQXiei.exe
  C:\Windows\System\KDQXiei.exe
  2⤵
  PID:5856
- C:\Windows\System\ioLaNjN.exe
  C:\Windows\System\ioLaNjN.exe
  2⤵
  PID:5924
- C:\Windows\System\WSuwHzh.exe
  C:\Windows\System\WSuwHzh.exe
  2⤵
  PID:6100
- C:\Windows\System\XwhMnID.exe
  C:\Windows\System\XwhMnID.exe
  2⤵
  PID:3596
- C:\Windows\System\cOmHNYe.exe
  C:\Windows\System\cOmHNYe.exe
  2⤵
  PID:2220
- C:\Windows\System\zIeSjpu.exe
  C:\Windows\System\zIeSjpu.exe
  2⤵
  PID:6084
- C:\Windows\System\PMlxrJY.exe
  C:\Windows\System\PMlxrJY.exe
  2⤵
  PID:5184
- C:\Windows\System\mrDmHIj.exe
  C:\Windows\System\mrDmHIj.exe
  2⤵
  PID:4452
- C:\Windows\System\gQfBYDw.exe
  C:\Windows\System\gQfBYDw.exe
  2⤵
  PID:5168
- C:\Windows\System\MYRoPvy.exe
  C:\Windows\System\MYRoPvy.exe
  2⤵
  PID:4888
- C:\Windows\System\FXRXjOv.exe
  C:\Windows\System\FXRXjOv.exe
  2⤵
  PID:5400
- C:\Windows\System\YwlbOVX.exe
  C:\Windows\System\YwlbOVX.exe
  2⤵
  PID:5384
- C:\Windows\System\uhpdJNc.exe
  C:\Windows\System\uhpdJNc.exe
  2⤵
  PID:5284
- C:\Windows\System\stKIFUN.exe
  C:\Windows\System\stKIFUN.exe
  2⤵
  PID:5792
- C:\Windows\System\IBGguNU.exe
  C:\Windows\System\IBGguNU.exe
  2⤵
  PID:628
- C:\Windows\System\hsfMUWU.exe
  C:\Windows\System\hsfMUWU.exe
  2⤵
  PID:5636
- C:\Windows\System\fJtlnfa.exe
  C:\Windows\System\fJtlnfa.exe
  2⤵
  PID:5552
- C:\Windows\System\vXzoGiq.exe
  C:\Windows\System\vXzoGiq.exe
  2⤵
  PID:6096
- C:\Windows\System\PcRVIlF.exe
  C:\Windows\System\PcRVIlF.exe
  2⤵
  PID:5308
- C:\Windows\System\LqeFDha.exe
  C:\Windows\System\LqeFDha.exe
  2⤵
  PID:6052
- C:\Windows\System\AVYBhDH.exe
  C:\Windows\System\AVYBhDH.exe
  2⤵
  PID:6036
- C:\Windows\System\UxcnhQr.exe
  C:\Windows\System\UxcnhQr.exe
  2⤵
  PID:6056
- C:\Windows\System\XhNhzou.exe
  C:\Windows\System\XhNhzou.exe
  2⤵
  PID:5532
- C:\Windows\System\uugLLBc.exe
  C:\Windows\System\uugLLBc.exe
  2⤵
  PID:5724
- C:\Windows\System\uvXZPve.exe
  C:\Windows\System\uvXZPve.exe
  2⤵
  PID:992
- C:\Windows\System\ljuJMfD.exe
  C:\Windows\System\ljuJMfD.exe
  2⤵
  PID:5632
- C:\Windows\System\AcwSBVM.exe
  C:\Windows\System\AcwSBVM.exe
  2⤵
  PID:5740
- C:\Windows\System\QNPOIJE.exe
  C:\Windows\System\QNPOIJE.exe
  2⤵
  PID:5220
- C:\Windows\System\JIBLTpt.exe
  C:\Windows\System\JIBLTpt.exe
  2⤵
  PID:6152
- C:\Windows\System\xmdEIvC.exe
  C:\Windows\System\xmdEIvC.exe
  2⤵
  PID:6168
- C:\Windows\System\ffIimcy.exe
  C:\Windows\System\ffIimcy.exe
  2⤵
  PID:6184
- C:\Windows\System\kEXybIr.exe
  C:\Windows\System\kEXybIr.exe
  2⤵
  PID:6200
- C:\Windows\System\ySFyVCc.exe
  C:\Windows\System\ySFyVCc.exe
  2⤵
  PID:6216
- C:\Windows\System\gKWVRvP.exe
  C:\Windows\System\gKWVRvP.exe
  2⤵
  PID:6232
- C:\Windows\System\wOFYwOz.exe
  C:\Windows\System\wOFYwOz.exe
  2⤵
  PID:6248
- C:\Windows\System\VswYfKt.exe
  C:\Windows\System\VswYfKt.exe
  2⤵
  PID:6268
- C:\Windows\System\fEWneMV.exe
  C:\Windows\System\fEWneMV.exe
  2⤵
  PID:6284
- C:\Windows\System\zoxCmYT.exe
  C:\Windows\System\zoxCmYT.exe
  2⤵
  PID:6376
- C:\Windows\System\iAYFNBp.exe
  C:\Windows\System\iAYFNBp.exe
  2⤵
  PID:6412
- C:\Windows\System\cWscfJu.exe
  C:\Windows\System\cWscfJu.exe
  2⤵
  PID:6432
- C:\Windows\System\rnZZvkc.exe
  C:\Windows\System\rnZZvkc.exe
  2⤵
  PID:6448
- C:\Windows\System\yIrfALd.exe
  C:\Windows\System\yIrfALd.exe
  2⤵
  PID:6464
- C:\Windows\System\yiMqOAh.exe
  C:\Windows\System\yiMqOAh.exe
  2⤵
  PID:6480
- C:\Windows\System\UheTICU.exe
  C:\Windows\System\UheTICU.exe
  2⤵
  PID:6496
- C:\Windows\System\YeJkLPa.exe
  C:\Windows\System\YeJkLPa.exe
  2⤵
  PID:6512
- C:\Windows\System\kqxNrgK.exe
  C:\Windows\System\kqxNrgK.exe
  2⤵
  PID:6528
- C:\Windows\System\joDZdqN.exe
  C:\Windows\System\joDZdqN.exe
  2⤵
  PID:6544
- C:\Windows\System\KceqJAY.exe
  C:\Windows\System\KceqJAY.exe
  2⤵
  PID:6560
- C:\Windows\System\GIDCSvM.exe
  C:\Windows\System\GIDCSvM.exe
  2⤵
  PID:6576
- C:\Windows\System\DXuaRHs.exe
  C:\Windows\System\DXuaRHs.exe
  2⤵
  PID:6592
- C:\Windows\System\BTjsGsS.exe
  C:\Windows\System\BTjsGsS.exe
  2⤵
  PID:6608
- C:\Windows\System\ohmUXuw.exe
  C:\Windows\System\ohmUXuw.exe
  2⤵
  PID:6624
- C:\Windows\System\SaUDXBC.exe
  C:\Windows\System\SaUDXBC.exe
  2⤵
  PID:6640
- C:\Windows\System\MPnkJJL.exe
  C:\Windows\System\MPnkJJL.exe
  2⤵
  PID:6656
- C:\Windows\System\VixnRFi.exe
  C:\Windows\System\VixnRFi.exe
  2⤵
  PID:6672
- C:\Windows\System\EpyhUnO.exe
  C:\Windows\System\EpyhUnO.exe
  2⤵
  PID:6688
- C:\Windows\System\xEmtqHX.exe
  C:\Windows\System\xEmtqHX.exe
  2⤵
  PID:6708
- C:\Windows\System\tdkAkip.exe
  C:\Windows\System\tdkAkip.exe
  2⤵
  PID:6724
- C:\Windows\System\AApOEQU.exe
  C:\Windows\System\AApOEQU.exe
  2⤵
  PID:6740
- C:\Windows\System\ycUmyVF.exe
  C:\Windows\System\ycUmyVF.exe
  2⤵
  PID:6756
- C:\Windows\System\BHQhKjB.exe
  C:\Windows\System\BHQhKjB.exe
  2⤵
  PID:6772
- C:\Windows\System\KsJpABD.exe
  C:\Windows\System\KsJpABD.exe
  2⤵
  PID:6788
- C:\Windows\System\zXvxfuw.exe
  C:\Windows\System\zXvxfuw.exe
  2⤵
  PID:6804
- C:\Windows\System\RLiFtWr.exe
  C:\Windows\System\RLiFtWr.exe
  2⤵
  PID:6820
- C:\Windows\System\JRBdZzU.exe
  C:\Windows\System\JRBdZzU.exe
  2⤵
  PID:6836
- C:\Windows\System\JyxMXdn.exe
  C:\Windows\System\JyxMXdn.exe
  2⤵
  PID:6852
- C:\Windows\System\bLRtdGm.exe
  C:\Windows\System\bLRtdGm.exe
  2⤵
  PID:6868
- C:\Windows\System\iyqohPA.exe
  C:\Windows\System\iyqohPA.exe
  2⤵
  PID:6884
- C:\Windows\System\XADcTWt.exe
  C:\Windows\System\XADcTWt.exe
  2⤵
  PID:6900
- C:\Windows\System\JaWAFCR.exe
  C:\Windows\System\JaWAFCR.exe
  2⤵
  PID:6916
- C:\Windows\System\JFzlSud.exe
  C:\Windows\System\JFzlSud.exe
  2⤵
  PID:6932
- C:\Windows\System\LzbnzJA.exe
  C:\Windows\System\LzbnzJA.exe
  2⤵
  PID:6948
- C:\Windows\System\KbLWfsj.exe
  C:\Windows\System\KbLWfsj.exe
  2⤵
  PID:6964
- C:\Windows\System\DNZFyog.exe
  C:\Windows\System\DNZFyog.exe
  2⤵
  PID:6980
- C:\Windows\System\bNQhLWH.exe
  C:\Windows\System\bNQhLWH.exe
  2⤵
  PID:6996
- C:\Windows\System\INIMSCZ.exe
  C:\Windows\System\INIMSCZ.exe
  2⤵
  PID:7012
- C:\Windows\System\gSghbhX.exe
  C:\Windows\System\gSghbhX.exe
  2⤵
  PID:7028
- C:\Windows\System\aoxOpyO.exe
  C:\Windows\System\aoxOpyO.exe
  2⤵
  PID:7044
- C:\Windows\System\KATFGQf.exe
  C:\Windows\System\KATFGQf.exe
  2⤵
  PID:7060
- C:\Windows\System\EqDBqih.exe
  C:\Windows\System\EqDBqih.exe
  2⤵
  PID:7076
- C:\Windows\System\ixCAkeG.exe
  C:\Windows\System\ixCAkeG.exe
  2⤵
  PID:7092
- C:\Windows\System\siMScAy.exe
  C:\Windows\System\siMScAy.exe
  2⤵
  PID:7108
- C:\Windows\System\FdItVFR.exe
  C:\Windows\System\FdItVFR.exe
  2⤵
  PID:7124
- C:\Windows\System\iHwCUfi.exe
  C:\Windows\System\iHwCUfi.exe
  2⤵
  PID:7140
- C:\Windows\System\FeFUgAb.exe
  C:\Windows\System\FeFUgAb.exe
  2⤵
  PID:7156
- C:\Windows\System\vItxTnt.exe
  C:\Windows\System\vItxTnt.exe
  2⤵
  PID:6164
- C:\Windows\System\cfKJTSb.exe
  C:\Windows\System\cfKJTSb.exe
  2⤵
  PID:6224
- C:\Windows\System\xUvZSUa.exe
  C:\Windows\System\xUvZSUa.exe
  2⤵
  PID:6148
- C:\Windows\System\hcIwdrM.exe
  C:\Windows\System\hcIwdrM.exe
  2⤵
  PID:6240
- C:\Windows\System\WObUfcG.exe
  C:\Windows\System\WObUfcG.exe
  2⤵
  PID:6292
- C:\Windows\System\WFlHjhW.exe
  C:\Windows\System\WFlHjhW.exe
  2⤵
  PID:6296
- C:\Windows\System\HAQileH.exe
  C:\Windows\System\HAQileH.exe
  2⤵
  PID:6300
- C:\Windows\System\eYlbESy.exe
  C:\Windows\System\eYlbESy.exe
  2⤵
  PID:6332
- C:\Windows\System\TFURumi.exe
  C:\Windows\System\TFURumi.exe
  2⤵
  PID:6344
- C:\Windows\System\jiraOHR.exe
  C:\Windows\System\jiraOHR.exe
  2⤵
  PID:6360
- C:\Windows\System\myqJGIC.exe
  C:\Windows\System\myqJGIC.exe
  2⤵
  PID:6384
- C:\Windows\System\ToojiBA.exe
  C:\Windows\System\ToojiBA.exe
  2⤵
  PID:6552
- C:\Windows\System\SvAwnte.exe
  C:\Windows\System\SvAwnte.exe
  2⤵
  PID:6616
- C:\Windows\System\jtbJWgw.exe
  C:\Windows\System\jtbJWgw.exe
  2⤵
  PID:6652
- C:\Windows\System\GlwVAle.exe
  C:\Windows\System\GlwVAle.exe
  2⤵
  PID:6632
- C:\Windows\System\BWIWIit.exe
  C:\Windows\System\BWIWIit.exe
  2⤵
  PID:6440
- C:\Windows\System\ZJRzxeH.exe
  C:\Windows\System\ZJRzxeH.exe
  2⤵
  PID:6536
- C:\Windows\System\MgpuwGK.exe
  C:\Windows\System\MgpuwGK.exe
  2⤵
  PID:6396
- C:\Windows\System\jQwNBZr.exe
  C:\Windows\System\jQwNBZr.exe
  2⤵
  PID:6472
- C:\Windows\System\NMUgaSw.exe
  C:\Windows\System\NMUgaSw.exe
  2⤵
  PID:6540
- C:\Windows\System\mKwKlae.exe
  C:\Windows\System\mKwKlae.exe
  2⤵
  PID:6664
- C:\Windows\System\lIDHXgn.exe
  C:\Windows\System\lIDHXgn.exe
  2⤵
  PID:6780
- C:\Windows\System\CqaTfEF.exe
  C:\Windows\System\CqaTfEF.exe
  2⤵
  PID:6816
- C:\Windows\System\QEClYmV.exe
  C:\Windows\System\QEClYmV.exe
  2⤵
  PID:6880
- C:\Windows\System\prSbmim.exe
  C:\Windows\System\prSbmim.exe
  2⤵
  PID:6944
- C:\Windows\System\iheiPvX.exe
  C:\Windows\System\iheiPvX.exe
  2⤵
  PID:6800
- C:\Windows\System\AOPFYJG.exe
  C:\Windows\System\AOPFYJG.exe
  2⤵
  PID:6832
- C:\Windows\System\DUODRQO.exe
  C:\Windows\System\DUODRQO.exe
  2⤵
  PID:6896
- C:\Windows\System\nQMZgCg.exe
  C:\Windows\System\nQMZgCg.exe
  2⤵
  PID:6960
- C:\Windows\System\kmRQVuV.exe
  C:\Windows\System\kmRQVuV.exe
  2⤵
  PID:7036
- C:\Windows\System\ycXTgDJ.exe
  C:\Windows\System\ycXTgDJ.exe
  2⤵
  PID:7056
- C:\Windows\System\EGVFTPT.exe
  C:\Windows\System\EGVFTPT.exe
  2⤵
  PID:7100
- C:\Windows\System\qRphfEm.exe
  C:\Windows\System\qRphfEm.exe
  2⤵
  PID:7136
- C:\Windows\System\dTVApzZ.exe
  C:\Windows\System\dTVApzZ.exe
  2⤵
  PID:7116
- C:\Windows\System\VRzTOFU.exe
  C:\Windows\System\VRzTOFU.exe
  2⤵
  PID:6196
- C:\Windows\System\rovOQrK.exe
  C:\Windows\System\rovOQrK.exe
  2⤵
  PID:6208
- C:\Windows\System\bmXKmYa.exe
  C:\Windows\System\bmXKmYa.exe
  2⤵
  PID:5584
- C:\Windows\System\WgkxvAz.exe
  C:\Windows\System\WgkxvAz.exe
  2⤵
  PID:6316
- C:\Windows\System\aFvqdEK.exe
  C:\Windows\System\aFvqdEK.exe
  2⤵
  PID:6352
- C:\Windows\System\VFStRir.exe
  C:\Windows\System\VFStRir.exe
  2⤵
  PID:6420
- C:\Windows\System\DJvuCfS.exe
  C:\Windows\System\DJvuCfS.exe
  2⤵
  PID:6488
- C:\Windows\System\svsdkqS.exe
  C:\Windows\System\svsdkqS.exe
  2⤵
  PID:6524
- C:\Windows\System\SoXbiCP.exe
  C:\Windows\System\SoXbiCP.exe
  2⤵
  PID:6716
- C:\Windows\System\XhCxYjy.exe
  C:\Windows\System\XhCxYjy.exe
  2⤵
  PID:6648
- C:\Windows\System\StrxFjr.exe
  C:\Windows\System\StrxFjr.exe
  2⤵
  PID:6584
- C:\Windows\System\VwhSVXS.exe
  C:\Windows\System\VwhSVXS.exe
  2⤵
  PID:6752
- C:\Windows\System\fqOiSFn.exe
  C:\Windows\System\fqOiSFn.exe
  2⤵
  PID:6976
- C:\Windows\System\OOamCZu.exe
  C:\Windows\System\OOamCZu.exe
  2⤵
  PID:6408
- C:\Windows\System\LfHrRgW.exe
  C:\Windows\System\LfHrRgW.exe
  2⤵
  PID:6940
- C:\Windows\System\GZYwIbe.exe
  C:\Windows\System\GZYwIbe.exe
  2⤵
  PID:7020
- C:\Windows\System\oytYYDB.exe
  C:\Windows\System\oytYYDB.exe
  2⤵
  PID:7148
- C:\Windows\System\jXCimFM.exe
  C:\Windows\System\jXCimFM.exe
  2⤵
  PID:5372
- C:\Windows\System\IzfECgI.exe
  C:\Windows\System\IzfECgI.exe
  2⤵
  PID:7120
- C:\Windows\System\CKboCfZ.exe
  C:\Windows\System\CKboCfZ.exe
  2⤵
  PID:6260
- C:\Windows\System\DbKUPeV.exe
  C:\Windows\System\DbKUPeV.exe
  2⤵
  PID:6340
- C:\Windows\System\iVoXbLp.exe
  C:\Windows\System\iVoXbLp.exe
  2⤵
  PID:6460
- C:\Windows\System\dLJcjeG.exe
  C:\Windows\System\dLJcjeG.exe
  2⤵
  PID:6520
- C:\Windows\System\alEZJar.exe
  C:\Windows\System\alEZJar.exe
  2⤵
  PID:6876
- C:\Windows\System\PEdmHzk.exe
  C:\Windows\System\PEdmHzk.exe
  2⤵
  PID:6444
- C:\Windows\System\AuesBAG.exe
  C:\Windows\System\AuesBAG.exe
  2⤵
  PID:6992
- C:\Windows\System\QGZzTPv.exe
  C:\Windows\System\QGZzTPv.exe
  2⤵
  PID:7084
- C:\Windows\System\mytFLvA.exe
  C:\Windows\System\mytFLvA.exe
  2⤵
  PID:6180
- C:\Windows\System\sJheAwo.exe
  C:\Windows\System\sJheAwo.exe
  2⤵
  PID:6356
- C:\Windows\System\TPLcBDa.exe
  C:\Windows\System\TPLcBDa.exe
  2⤵
  PID:6848
- C:\Windows\System\KCEAzmi.exe
  C:\Windows\System\KCEAzmi.exe
  2⤵
  PID:6572
- C:\Windows\System\bvyXXne.exe
  C:\Windows\System\bvyXXne.exe
  2⤵
  PID:7052
- C:\Windows\System\ElHzQdY.exe
  C:\Windows\System\ElHzQdY.exe
  2⤵
  PID:6600
- C:\Windows\System\SnnqvXA.exe
  C:\Windows\System\SnnqvXA.exe
  2⤵
  PID:7172
- C:\Windows\System\hEjmfod.exe
  C:\Windows\System\hEjmfod.exe
  2⤵
  PID:7188
- C:\Windows\System\URUEHay.exe
  C:\Windows\System\URUEHay.exe
  2⤵
  PID:7204
- C:\Windows\System\XawJeCT.exe
  C:\Windows\System\XawJeCT.exe
  2⤵
  PID:7220
- C:\Windows\System\gDREeUr.exe
  C:\Windows\System\gDREeUr.exe
  2⤵
  PID:7236
- C:\Windows\System\urMCzbM.exe
  C:\Windows\System\urMCzbM.exe
  2⤵
  PID:7252
- C:\Windows\System\lSZVOdy.exe
  C:\Windows\System\lSZVOdy.exe
  2⤵
  PID:7268
- C:\Windows\System\LbXgYBA.exe
  C:\Windows\System\LbXgYBA.exe
  2⤵
  PID:7284
- C:\Windows\System\SlyGvjx.exe
  C:\Windows\System\SlyGvjx.exe
  2⤵
  PID:7300
- C:\Windows\System\atSzoWy.exe
  C:\Windows\System\atSzoWy.exe
  2⤵
  PID:7316
- C:\Windows\System\PIpPZEs.exe
  C:\Windows\System\PIpPZEs.exe
  2⤵
  PID:7332
- C:\Windows\System\qQMgWfF.exe
  C:\Windows\System\qQMgWfF.exe
  2⤵
  PID:7368
- C:\Windows\System\wjnmofk.exe
  C:\Windows\System\wjnmofk.exe
  2⤵
  PID:7384
- C:\Windows\System\zSHcqxm.exe
  C:\Windows\System\zSHcqxm.exe
  2⤵
  PID:7400
- C:\Windows\System\Enyfjud.exe
  C:\Windows\System\Enyfjud.exe
  2⤵
  PID:7416
- C:\Windows\System\euMyyLX.exe
  C:\Windows\System\euMyyLX.exe
  2⤵
  PID:7432
- C:\Windows\System\AbnywSB.exe
  C:\Windows\System\AbnywSB.exe
  2⤵
  PID:7448
- C:\Windows\System\pkEZDIU.exe
  C:\Windows\System\pkEZDIU.exe
  2⤵
  PID:7464
- C:\Windows\System\AJnovrf.exe
  C:\Windows\System\AJnovrf.exe
  2⤵
  PID:7480
- C:\Windows\System\xVquWbo.exe
  C:\Windows\System\xVquWbo.exe
  2⤵
  PID:7500
- C:\Windows\System\cWFaHvm.exe
  C:\Windows\System\cWFaHvm.exe
  2⤵
  PID:7540
- C:\Windows\System\xQZtrxF.exe
  C:\Windows\System\xQZtrxF.exe
  2⤵
  PID:7556
- C:\Windows\System\EiUpdXm.exe
  C:\Windows\System\EiUpdXm.exe
  2⤵
  PID:7572
- C:\Windows\System\rgBJacP.exe
  C:\Windows\System\rgBJacP.exe
  2⤵
  PID:7588
- C:\Windows\System\lCLfkwm.exe
  C:\Windows\System\lCLfkwm.exe
  2⤵
  PID:7604
- C:\Windows\System\iXYjKYC.exe
  C:\Windows\System\iXYjKYC.exe
  2⤵
  PID:7620
- C:\Windows\System\ktwxPTc.exe
  C:\Windows\System\ktwxPTc.exe
  2⤵
  PID:7636
- C:\Windows\System\DWwEoIj.exe
  C:\Windows\System\DWwEoIj.exe
  2⤵
  PID:7652
- C:\Windows\System\OnoGxXI.exe
  C:\Windows\System\OnoGxXI.exe
  2⤵
  PID:7668
- C:\Windows\System\FTQOEdF.exe
  C:\Windows\System\FTQOEdF.exe
  2⤵
  PID:7692
- C:\Windows\System\XKYoNgQ.exe
  C:\Windows\System\XKYoNgQ.exe
  2⤵
  PID:7708
- C:\Windows\System\WQWSTlB.exe
  C:\Windows\System\WQWSTlB.exe
  2⤵
  PID:7724
- C:\Windows\System\zRGVmTK.exe
  C:\Windows\System\zRGVmTK.exe
  2⤵
  PID:7740
- C:\Windows\System\boATXng.exe
  C:\Windows\System\boATXng.exe
  2⤵
  PID:7756
- C:\Windows\System\XAjAoOq.exe
  C:\Windows\System\XAjAoOq.exe
  2⤵
  PID:7772
- C:\Windows\System\rToYsOZ.exe
  C:\Windows\System\rToYsOZ.exe
  2⤵
  PID:7788
- C:\Windows\System\ZnpeSjj.exe
  C:\Windows\System\ZnpeSjj.exe
  2⤵
  PID:7804
- C:\Windows\System\nZeYaqI.exe
  C:\Windows\System\nZeYaqI.exe
  2⤵
  PID:7820
- C:\Windows\System\OEsfuiV.exe
  C:\Windows\System\OEsfuiV.exe
  2⤵
  PID:7840
- C:\Windows\System\MFspJMT.exe
  C:\Windows\System\MFspJMT.exe
  2⤵
  PID:7860
- C:\Windows\System\zCNMTzu.exe
  C:\Windows\System\zCNMTzu.exe
  2⤵
  PID:7876
- C:\Windows\System\FmcBeQb.exe
  C:\Windows\System\FmcBeQb.exe
  2⤵
  PID:7892
- C:\Windows\System\elnTECu.exe
  C:\Windows\System\elnTECu.exe
  2⤵
  PID:7908
- C:\Windows\System\iYpTsuO.exe
  C:\Windows\System\iYpTsuO.exe
  2⤵
  PID:7924
- C:\Windows\System\MHawLGz.exe
  C:\Windows\System\MHawLGz.exe
  2⤵
  PID:7944
- C:\Windows\System\JYBWUMf.exe
  C:\Windows\System\JYBWUMf.exe
  2⤵
  PID:7960
- C:\Windows\System\BCsOQjV.exe
  C:\Windows\System\BCsOQjV.exe
  2⤵
  PID:7976
- C:\Windows\System\RuExLzh.exe
  C:\Windows\System\RuExLzh.exe
  2⤵
  PID:7992
- C:\Windows\System\pBAFxKl.exe
  C:\Windows\System\pBAFxKl.exe
  2⤵
  PID:8008
- C:\Windows\System\oeBNlgM.exe
  C:\Windows\System\oeBNlgM.exe
  2⤵
  PID:8024
- C:\Windows\System\dTEMLWQ.exe
  C:\Windows\System\dTEMLWQ.exe
  2⤵
  PID:8040
- C:\Windows\System\QeDPkKe.exe
  C:\Windows\System\QeDPkKe.exe
  2⤵
  PID:8056
- C:\Windows\System\ENpkhKy.exe
  C:\Windows\System\ENpkhKy.exe
  2⤵
  PID:8072
- C:\Windows\System\DNWTfgw.exe
  C:\Windows\System\DNWTfgw.exe
  2⤵
  PID:8088
- C:\Windows\System\oErAFYt.exe
  C:\Windows\System\oErAFYt.exe
  2⤵
  PID:8108
- C:\Windows\System\xKcEhCz.exe
  C:\Windows\System\xKcEhCz.exe
  2⤵
  PID:8124
- C:\Windows\System\zdKofCY.exe
  C:\Windows\System\zdKofCY.exe
  2⤵
  PID:8140
- C:\Windows\System\OLMueRV.exe
  C:\Windows\System\OLMueRV.exe
  2⤵
  PID:8156
- C:\Windows\System\gHuWoeu.exe
  C:\Windows\System\gHuWoeu.exe
  2⤵
  PID:8172
- C:\Windows\System\nSBltAL.exe
  C:\Windows\System\nSBltAL.exe
  2⤵
  PID:8188
- C:\Windows\System\xbqAcjo.exe
  C:\Windows\System\xbqAcjo.exe
  2⤵
  PID:7216
- C:\Windows\System\xPkMQED.exe
  C:\Windows\System\xPkMQED.exe
  2⤵
  PID:6588
- C:\Windows\System\wtYUbBS.exe
  C:\Windows\System\wtYUbBS.exe
  2⤵
  PID:7104
- C:\Windows\System\zKMGIgQ.exe
  C:\Windows\System\zKMGIgQ.exe
  2⤵
  PID:7232
- C:\Windows\System\VbOPJPx.exe
  C:\Windows\System\VbOPJPx.exe
  2⤵
  PID:6928
- C:\Windows\System\SDviuUC.exe
  C:\Windows\System\SDviuUC.exe
  2⤵
  PID:7260
- C:\Windows\System\NhAaRYu.exe
  C:\Windows\System\NhAaRYu.exe
  2⤵
  PID:7328
- C:\Windows\System\NtvqXKM.exe
  C:\Windows\System\NtvqXKM.exe
  2⤵
  PID:7352
- C:\Windows\System\mnmBnMb.exe
  C:\Windows\System\mnmBnMb.exe
  2⤵
  PID:7396
- C:\Windows\System\MyyUuFG.exe
  C:\Windows\System\MyyUuFG.exe
  2⤵
  PID:7488
- C:\Windows\System\McPyavA.exe
  C:\Windows\System\McPyavA.exe
  2⤵
  PID:7508
- C:\Windows\System\xEqoUjE.exe
  C:\Windows\System\xEqoUjE.exe
  2⤵
  PID:7408
- C:\Windows\System\LDTQgdE.exe
  C:\Windows\System\LDTQgdE.exe
  2⤵
  PID:7476
- C:\Windows\System\UVCbGnj.exe
  C:\Windows\System\UVCbGnj.exe
  2⤵
  PID:7524
- C:\Windows\System\KXBFCeT.exe
  C:\Windows\System\KXBFCeT.exe
  2⤵
  PID:7564
- C:\Windows\System\UZjjkwV.exe
  C:\Windows\System\UZjjkwV.exe
  2⤵
  PID:7628
- C:\Windows\System\HVrOzAC.exe
  C:\Windows\System\HVrOzAC.exe
  2⤵
  PID:7616
- C:\Windows\System\FXOJyac.exe
  C:\Windows\System\FXOJyac.exe
  2⤵
  PID:7688
- C:\Windows\System\BvBdqyM.exe
  C:\Windows\System\BvBdqyM.exe
  2⤵
  PID:7780
- C:\Windows\System\NPdcAyC.exe
  C:\Windows\System\NPdcAyC.exe
  2⤵
  PID:7852
- C:\Windows\System\uodibjH.exe
  C:\Windows\System\uodibjH.exe
  2⤵
  PID:7916
- C:\Windows\System\qJgSEFv.exe
  C:\Windows\System\qJgSEFv.exe
  2⤵
  PID:7952
- C:\Windows\System\mxpShPz.exe
  C:\Windows\System\mxpShPz.exe
  2⤵
  PID:7984
- C:\Windows\System\fWVcpQT.exe
  C:\Windows\System\fWVcpQT.exe
  2⤵
  PID:8020
- C:\Windows\System\ELdNUhr.exe
  C:\Windows\System\ELdNUhr.exe
  2⤵
  PID:8048
- C:\Windows\System\GMtxCBD.exe
  C:\Windows\System\GMtxCBD.exe
  2⤵
  PID:8148
- C:\Windows\System\vWNXXTG.exe
  C:\Windows\System\vWNXXTG.exe
  2⤵
  PID:7248
- C:\Windows\System\ieQxxwk.exe
  C:\Windows\System\ieQxxwk.exe
  2⤵
  PID:7228
- C:\Windows\System\WaoiIHC.exe
  C:\Windows\System\WaoiIHC.exe
  2⤵
  PID:7348
- C:\Windows\System\XHjgtqQ.exe
  C:\Windows\System\XHjgtqQ.exe
  2⤵
  PID:7376
- C:\Windows\System\fEcyTBm.exe
  C:\Windows\System\fEcyTBm.exe
  2⤵
  PID:7568
- C:\Windows\System\xBjMRQj.exe
  C:\Windows\System\xBjMRQj.exe
  2⤵
  PID:7816
- C:\Windows\System\HbUdRoo.exe
  C:\Windows\System\HbUdRoo.exe
  2⤵
  PID:7552
- C:\Windows\System\sEQQvnj.exe
  C:\Windows\System\sEQQvnj.exe
  2⤵
  PID:7704
- C:\Windows\System\XyyDFZJ.exe
  C:\Windows\System\XyyDFZJ.exe
  2⤵
  PID:7660
- C:\Windows\System\vfaNuqh.exe
  C:\Windows\System\vfaNuqh.exe
  2⤵
  PID:8016
- C:\Windows\System\RkhDEeL.exe
  C:\Windows\System\RkhDEeL.exe
  2⤵
  PID:7936
- C:\Windows\System\hcNrFor.exe
  C:\Windows\System\hcNrFor.exe
  2⤵
  PID:7536
- C:\Windows\System\hALYrxX.exe
  C:\Windows\System\hALYrxX.exe
  2⤵
  PID:7736
- C:\Windows\System\PPhsTPQ.exe
  C:\Windows\System\PPhsTPQ.exe
  2⤵
  PID:7828
- C:\Windows\System\BURraKf.exe
  C:\Windows\System\BURraKf.exe
  2⤵
  PID:7900
- C:\Windows\System\EZmevHN.exe
  C:\Windows\System\EZmevHN.exe
  2⤵
  PID:7968
- C:\Windows\System\HvLzQSK.exe
  C:\Windows\System\HvLzQSK.exe
  2⤵
  PID:8036
- C:\Windows\System\eqvTyzt.exe
  C:\Windows\System\eqvTyzt.exe
  2⤵
  PID:7700
- C:\Windows\System\WRUhvbb.exe
  C:\Windows\System\WRUhvbb.exe
  2⤵
  PID:8104
- C:\Windows\System\nNoDMpV.exe
  C:\Windows\System\nNoDMpV.exe
  2⤵
  PID:8164
- C:\Windows\System\gpZeQig.exe
  C:\Windows\System\gpZeQig.exe
  2⤵
  PID:6912
- C:\Windows\System\zzkbOIf.exe
  C:\Windows\System\zzkbOIf.exe
  2⤵
  PID:7324
- C:\Windows\System\fgnunli.exe
  C:\Windows\System\fgnunli.exe
  2⤵
  PID:7444
- C:\Windows\System\vsxWAJv.exe
  C:\Windows\System\vsxWAJv.exe
  2⤵
  PID:8064
- C:\Windows\System\ORXSLfF.exe
  C:\Windows\System\ORXSLfF.exe
  2⤵
  PID:7748
- C:\Windows\System\qMcslJE.exe
  C:\Windows\System\qMcslJE.exe
  2⤵
  PID:7632
- C:\Windows\System\CIRDgSY.exe
  C:\Windows\System\CIRDgSY.exe
  2⤵
  PID:7796
- C:\Windows\System\SUJypgm.exe
  C:\Windows\System\SUJypgm.exe
  2⤵
  PID:8184
- C:\Windows\System\AIqIGrp.exe
  C:\Windows\System\AIqIGrp.exe
  2⤵
  PID:7940
- C:\Windows\System\zMAkNNE.exe
  C:\Windows\System\zMAkNNE.exe
  2⤵
  PID:8136
- C:\Windows\System\qIobVLu.exe
  C:\Windows\System\qIobVLu.exe
  2⤵
  PID:8068
- C:\Windows\System\efgONMW.exe
  C:\Windows\System\efgONMW.exe
  2⤵
  PID:7884
- C:\Windows\System\IkmZJqw.exe
  C:\Windows\System\IkmZJqw.exe
  2⤵
  PID:8004
- C:\Windows\System\MoELqLx.exe
  C:\Windows\System\MoELqLx.exe
  2⤵
  PID:7308
- C:\Windows\System\dtAewsT.exe
  C:\Windows\System\dtAewsT.exe
  2⤵
  PID:7184
- C:\Windows\System\dTbUtrk.exe
  C:\Windows\System\dTbUtrk.exe
  2⤵
  PID:7888
- C:\Windows\System\OPhcbvT.exe
  C:\Windows\System\OPhcbvT.exe
  2⤵
  PID:7428
- C:\Windows\System\dnkaiwb.exe
  C:\Windows\System\dnkaiwb.exe
  2⤵
  PID:7200
- C:\Windows\System\OvmBZlO.exe
  C:\Windows\System\OvmBZlO.exe
  2⤵
  PID:8180
- C:\Windows\System\sFQYUHO.exe
  C:\Windows\System\sFQYUHO.exe
  2⤵
  PID:8204
- C:\Windows\System\sIikXRc.exe
  C:\Windows\System\sIikXRc.exe
  2⤵
  PID:8220
- C:\Windows\System\TXLCiEo.exe
  C:\Windows\System\TXLCiEo.exe
  2⤵
  PID:8236
- C:\Windows\System\XttWjuH.exe
  C:\Windows\System\XttWjuH.exe
  2⤵
  PID:8252
- C:\Windows\System\pMZJmXY.exe
  C:\Windows\System\pMZJmXY.exe
  2⤵
  PID:8268
- C:\Windows\System\XJlEaYV.exe
  C:\Windows\System\XJlEaYV.exe
  2⤵
  PID:8284
- C:\Windows\System\COluMBu.exe
  C:\Windows\System\COluMBu.exe
  2⤵
  PID:8304
- C:\Windows\System\kuRCBpq.exe
  C:\Windows\System\kuRCBpq.exe
  2⤵
  PID:8320
- C:\Windows\System\LcpzjNi.exe
  C:\Windows\System\LcpzjNi.exe
  2⤵
  PID:8336
- C:\Windows\System\WgTuaoX.exe
  C:\Windows\System\WgTuaoX.exe
  2⤵
  PID:8352
- C:\Windows\System\DcVZSks.exe
  C:\Windows\System\DcVZSks.exe
  2⤵
  PID:8368
- C:\Windows\System\rXbtCmr.exe
  C:\Windows\System\rXbtCmr.exe
  2⤵
  PID:8384
- C:\Windows\System\trKbAkV.exe
  C:\Windows\System\trKbAkV.exe
  2⤵
  PID:8400
- C:\Windows\System\CJSHKhZ.exe
  C:\Windows\System\CJSHKhZ.exe
  2⤵
  PID:8416
- C:\Windows\System\crYMNZS.exe
  C:\Windows\System\crYMNZS.exe
  2⤵
  PID:8432
- C:\Windows\System\ORJzIkP.exe
  C:\Windows\System\ORJzIkP.exe
  2⤵
  PID:8448
- C:\Windows\System\nraMzMu.exe
  C:\Windows\System\nraMzMu.exe
  2⤵
  PID:8464
- C:\Windows\System\ZQgLtiY.exe
  C:\Windows\System\ZQgLtiY.exe
  2⤵
  PID:8480
- C:\Windows\System\UPQTJyN.exe
  C:\Windows\System\UPQTJyN.exe
  2⤵
  PID:8496
- C:\Windows\System\mqFZzjK.exe
  C:\Windows\System\mqFZzjK.exe
  2⤵
  PID:8516
- C:\Windows\System\IDOpqXL.exe
  C:\Windows\System\IDOpqXL.exe
  2⤵
  PID:8532
- C:\Windows\System\tSblhId.exe
  C:\Windows\System\tSblhId.exe
  2⤵
  PID:8548
- C:\Windows\System\UcbVQmU.exe
  C:\Windows\System\UcbVQmU.exe
  2⤵
  PID:8564
- C:\Windows\System\QQSnjBn.exe
  C:\Windows\System\QQSnjBn.exe
  2⤵
  PID:8584
- C:\Windows\System\HsqkYcF.exe
  C:\Windows\System\HsqkYcF.exe
  2⤵
  PID:8600
- C:\Windows\System\MzyfxSn.exe
  C:\Windows\System\MzyfxSn.exe
  2⤵
  PID:8616
- C:\Windows\System\RfhmfFE.exe
  C:\Windows\System\RfhmfFE.exe
  2⤵
  PID:8632
- C:\Windows\System\lzMXXvU.exe
  C:\Windows\System\lzMXXvU.exe
  2⤵
  PID:8648
- C:\Windows\System\alhDoEU.exe
  C:\Windows\System\alhDoEU.exe
  2⤵
  PID:8664
- C:\Windows\System\nytApwv.exe
  C:\Windows\System\nytApwv.exe
  2⤵
  PID:8680
- C:\Windows\System\qhyjeEr.exe
  C:\Windows\System\qhyjeEr.exe
  2⤵
  PID:8696
- C:\Windows\System\NiUgjTz.exe
  C:\Windows\System\NiUgjTz.exe
  2⤵
  PID:8712
- C:\Windows\System\QdJvMfc.exe
  C:\Windows\System\QdJvMfc.exe
  2⤵
  PID:8728
- C:\Windows\System\uMowRmv.exe
  C:\Windows\System\uMowRmv.exe
  2⤵
  PID:8744
- C:\Windows\System\ZurRYNZ.exe
  C:\Windows\System\ZurRYNZ.exe
  2⤵
  PID:8760
- C:\Windows\System\JhqvmBi.exe
  C:\Windows\System\JhqvmBi.exe
  2⤵
  PID:8776
- C:\Windows\System\dthpOOY.exe
  C:\Windows\System\dthpOOY.exe
  2⤵
  PID:8796
- C:\Windows\System\LnBtxCQ.exe
  C:\Windows\System\LnBtxCQ.exe
  2⤵
  PID:8812
- C:\Windows\System\EZFfGcp.exe
  C:\Windows\System\EZFfGcp.exe
  2⤵
  PID:8828
- C:\Windows\System\xwuVQKx.exe
  C:\Windows\System\xwuVQKx.exe
  2⤵
  PID:8844
- C:\Windows\System\NRXhnqp.exe
  C:\Windows\System\NRXhnqp.exe
  2⤵
  PID:8860
- C:\Windows\System\CLxeCRg.exe
  C:\Windows\System\CLxeCRg.exe
  2⤵
  PID:8876
- C:\Windows\System\UGLqxEy.exe
  C:\Windows\System\UGLqxEy.exe
  2⤵
  PID:8892
- C:\Windows\System\iFWZWGU.exe
  C:\Windows\System\iFWZWGU.exe
  2⤵
  PID:8908
- C:\Windows\System\iarQaFQ.exe
  C:\Windows\System\iarQaFQ.exe
  2⤵
  PID:8924
- C:\Windows\System\CJAlnQy.exe
  C:\Windows\System\CJAlnQy.exe
  2⤵
  PID:8940
- C:\Windows\System\qANBTxM.exe
  C:\Windows\System\qANBTxM.exe
  2⤵
  PID:8956
- C:\Windows\System\CwRNZlJ.exe
  C:\Windows\System\CwRNZlJ.exe
  2⤵
  PID:8972
- C:\Windows\System\dQFzqdS.exe
  C:\Windows\System\dQFzqdS.exe
  2⤵
  PID:8988
- C:\Windows\System\RFhwuKC.exe
  C:\Windows\System\RFhwuKC.exe
  2⤵
  PID:9004
- C:\Windows\System\jDFzFdq.exe
  C:\Windows\System\jDFzFdq.exe
  2⤵
  PID:9020
- C:\Windows\System\Fhmvnaj.exe
  C:\Windows\System\Fhmvnaj.exe
  2⤵
  PID:9036
- C:\Windows\System\ujBlFnx.exe
  C:\Windows\System\ujBlFnx.exe
  2⤵
  PID:9052
- C:\Windows\System\HMZFbCN.exe
  C:\Windows\System\HMZFbCN.exe
  2⤵
  PID:9068
- C:\Windows\System\ovnzGBP.exe
  C:\Windows\System\ovnzGBP.exe
  2⤵
  PID:9084
- C:\Windows\System\lbzqDiV.exe
  C:\Windows\System\lbzqDiV.exe
  2⤵
  PID:9104
- C:\Windows\System\xlEKyJj.exe
  C:\Windows\System\xlEKyJj.exe
  2⤵
  PID:9120
- C:\Windows\System\bGMNFDw.exe
  C:\Windows\System\bGMNFDw.exe
  2⤵
  PID:9136
- C:\Windows\System\kNBOYKT.exe
  C:\Windows\System\kNBOYKT.exe
  2⤵
  PID:9152
- C:\Windows\System\BTaXJlb.exe
  C:\Windows\System\BTaXJlb.exe
  2⤵
  PID:9168
- C:\Windows\System\jfpVAIQ.exe
  C:\Windows\System\jfpVAIQ.exe
  2⤵
  PID:9184
- C:\Windows\System\EfdywxE.exe
  C:\Windows\System\EfdywxE.exe
  2⤵
  PID:9200
- C:\Windows\System\onqCqko.exe
  C:\Windows\System\onqCqko.exe
  2⤵
  PID:8132
- C:\Windows\System\AOfiIhe.exe
  C:\Windows\System\AOfiIhe.exe
  2⤵
  PID:7872
- C:\Windows\System\LxqlibF.exe
  C:\Windows\System\LxqlibF.exe
  2⤵
  PID:7904
- C:\Windows\System\ptHCTiy.exe
  C:\Windows\System\ptHCTiy.exe
  2⤵
  PID:7868
- C:\Windows\System\CbiWmiX.exe
  C:\Windows\System\CbiWmiX.exe
  2⤵
  PID:8264
- C:\Windows\System\WYOEBFG.exe
  C:\Windows\System\WYOEBFG.exe
  2⤵
  PID:8328
- C:\Windows\System\uWvnOnL.exe
  C:\Windows\System\uWvnOnL.exe
  2⤵
  PID:8392
- C:\Windows\System\uEfvMCL.exe
  C:\Windows\System\uEfvMCL.exe
  2⤵
  PID:8456
- C:\Windows\System\hgjQZoZ.exe
  C:\Windows\System\hgjQZoZ.exe
  2⤵
  PID:7832
- C:\Windows\System\nwtICUU.exe
  C:\Windows\System\nwtICUU.exe
  2⤵
  PID:8248
- C:\Windows\System\SNIiCqq.exe
  C:\Windows\System\SNIiCqq.exe
  2⤵
  PID:8316
- C:\Windows\System\KJDsSRH.exe
  C:\Windows\System\KJDsSRH.exe
  2⤵
  PID:8380
- C:\Windows\System\tQVGbVL.exe
  C:\Windows\System\tQVGbVL.exe
  2⤵
  PID:8444
- C:\Windows\System\Mongbfz.exe
  C:\Windows\System\Mongbfz.exe
  2⤵
  PID:8508
- C:\Windows\System\PWJpSdR.exe
  C:\Windows\System\PWJpSdR.exe
  2⤵
  PID:8544
- C:\Windows\System\yXsrbGq.exe
  C:\Windows\System\yXsrbGq.exe
  2⤵
  PID:8556
- C:\Windows\System\vjlnLWh.exe
  C:\Windows\System\vjlnLWh.exe
  2⤵
  PID:8624
- C:\Windows\System\FlYReZE.exe
  C:\Windows\System\FlYReZE.exe
  2⤵
  PID:8688
- C:\Windows\System\RLjHygC.exe
  C:\Windows\System\RLjHygC.exe
  2⤵
  PID:8752
- C:\Windows\System\rIijlZi.exe
  C:\Windows\System\rIijlZi.exe
  2⤵
  PID:8792
- C:\Windows\System\bPMuwZK.exe
  C:\Windows\System\bPMuwZK.exe
  2⤵
  PID:8704
- C:\Windows\System\DSSGKHH.exe
  C:\Windows\System\DSSGKHH.exe
  2⤵
  PID:8856
- C:\Windows\System\ZjPQUwk.exe
  C:\Windows\System\ZjPQUwk.exe
  2⤵
  PID:8672
- C:\Windows\System\tCOUnvr.exe
  C:\Windows\System\tCOUnvr.exe
  2⤵
  PID:8888
- C:\Windows\System\msokzTp.exe
  C:\Windows\System\msokzTp.exe
  2⤵
  PID:8644
- C:\Windows\System\EYQnhnW.exe
  C:\Windows\System\EYQnhnW.exe
  2⤵
  PID:8840
- C:\Windows\System\AHYRfku.exe
  C:\Windows\System\AHYRfku.exe
  2⤵
  PID:8868
- C:\Windows\System\oyxmzpa.exe
  C:\Windows\System\oyxmzpa.exe
  2⤵
  PID:8980
- C:\Windows\System\sgjMjky.exe
  C:\Windows\System\sgjMjky.exe
  2⤵
  PID:8936
- C:\Windows\System\aeUjLea.exe
  C:\Windows\System\aeUjLea.exe
  2⤵
  PID:9000
- C:\Windows\System\PRvVPRF.exe
  C:\Windows\System\PRvVPRF.exe
  2⤵
  PID:9048
- C:\Windows\System\PvkutZD.exe
  C:\Windows\System\PvkutZD.exe
  2⤵
  PID:9060
- C:\Windows\System\FsIsPcw.exe
  C:\Windows\System\FsIsPcw.exe
  2⤵
  PID:9116
- C:\Windows\System\ghicgLx.exe
  C:\Windows\System\ghicgLx.exe
  2⤵
  PID:9128
- C:\Windows\System\jakmjEt.exe
  C:\Windows\System\jakmjEt.exe
  2⤵
  PID:7612
- C:\Windows\System\igVPmuJ.exe
  C:\Windows\System\igVPmuJ.exe
  2⤵
  PID:7292
- C:\Windows\System\uYJlruL.exe
  C:\Windows\System\uYJlruL.exe
  2⤵
  PID:9164
- C:\Windows\System\cvbGgwS.exe
  C:\Windows\System\cvbGgwS.exe
  2⤵
  PID:7472
- C:\Windows\System\AhhyQTO.exe
  C:\Windows\System\AhhyQTO.exe
  2⤵
  PID:8492
- C:\Windows\System\OmciwRz.exe
  C:\Windows\System\OmciwRz.exe
  2⤵
  PID:8424
- C:\Windows\System\UwQhBNr.exe
  C:\Windows\System\UwQhBNr.exe
  2⤵
  PID:8244
- C:\Windows\System\pFFEYsD.exe
  C:\Windows\System\pFFEYsD.exe
  2⤵
  PID:8524
- C:\Windows\System\yUtthGR.exe
  C:\Windows\System\yUtthGR.exe
  2⤵
  PID:8576
- C:\Windows\System\jNKMUIO.exe
  C:\Windows\System\jNKMUIO.exe
  2⤵
  PID:8720
- C:\Windows\System\zWoKTXv.exe
  C:\Windows\System\zWoKTXv.exe
  2⤵
  PID:8660
- C:\Windows\System\EsbAexT.exe
  C:\Windows\System\EsbAexT.exe
  2⤵
  PID:8804
- C:\Windows\System\DcSDQOc.exe
  C:\Windows\System\DcSDQOc.exe
  2⤵
  PID:8736
- C:\Windows\System\wBBQPsm.exe
  C:\Windows\System\wBBQPsm.exe
  2⤵
  PID:8904
- C:\Windows\System\HTyOtJL.exe
  C:\Windows\System\HTyOtJL.exe
  2⤵
  PID:9044
- C:\Windows\System\dwkhdLz.exe
  C:\Windows\System\dwkhdLz.exe
  2⤵
  PID:9092
- C:\Windows\System\fYHcbiY.exe
  C:\Windows\System\fYHcbiY.exe
  2⤵
  PID:9208
- C:\Windows\System\eTPGyqY.exe
  C:\Windows\System\eTPGyqY.exe
  2⤵
  PID:9212
- C:\Windows\System\lxsmSqL.exe
  C:\Windows\System\lxsmSqL.exe
  2⤵
  PID:9132
- C:\Windows\System\KMtiLlg.exe
  C:\Windows\System\KMtiLlg.exe
  2⤵
  PID:7496
- C:\Windows\System\gvgiQeZ.exe
  C:\Windows\System\gvgiQeZ.exe
  2⤵
  PID:8312
- C:\Windows\System\eopWCmo.exe
  C:\Windows\System\eopWCmo.exe
  2⤵
  PID:9196
- C:\Windows\System\gHGebXH.exe
  C:\Windows\System\gHGebXH.exe
  2⤵
  PID:8440
- C:\Windows\System\nJQKwaE.exe
  C:\Windows\System\nJQKwaE.exe
  2⤵
  PID:8580
- C:\Windows\System\IGRboYI.exe
  C:\Windows\System\IGRboYI.exe
  2⤵
  PID:9012
- C:\Windows\System\slhnCQZ.exe
  C:\Windows\System\slhnCQZ.exe
  2⤵
  PID:9144
- C:\Windows\System\HuXixyb.exe
  C:\Windows\System\HuXixyb.exe
  2⤵
  PID:8608
- C:\Windows\System\vzeurhp.exe
  C:\Windows\System\vzeurhp.exe
  2⤵
  PID:8708
- C:\Windows\System\TSawHCp.exe
  C:\Windows\System\TSawHCp.exe
  2⤵
  PID:8740
- C:\Windows\System\VTWRzdv.exe
  C:\Windows\System\VTWRzdv.exe
  2⤵
  PID:8996
- C:\Windows\System\eUbknIS.exe
  C:\Windows\System\eUbknIS.exe
  2⤵
  PID:8280
- C:\Windows\System\TNCISqO.exe
  C:\Windows\System\TNCISqO.exe
  2⤵
  PID:8824
- C:\Windows\System\iuBSKZL.exe
  C:\Windows\System\iuBSKZL.exe
  2⤵
  PID:8612
- C:\Windows\System\NXjnsGJ.exe
  C:\Windows\System\NXjnsGJ.exe
  2⤵
  PID:8360
- C:\Windows\System\dzXalht.exe
  C:\Windows\System\dzXalht.exe
  2⤵
  PID:9232
- C:\Windows\System\DteQXzm.exe
  C:\Windows\System\DteQXzm.exe
  2⤵
  PID:9248
- C:\Windows\System\iSvfSJP.exe
  C:\Windows\System\iSvfSJP.exe
  2⤵
  PID:9264
- C:\Windows\System\EGTXhuE.exe
  C:\Windows\System\EGTXhuE.exe
  2⤵
  PID:9280
- C:\Windows\System\ScDJSLK.exe
  C:\Windows\System\ScDJSLK.exe
  2⤵
  PID:9296
- C:\Windows\System\VOavlhx.exe
  C:\Windows\System\VOavlhx.exe
  2⤵
  PID:9312
- C:\Windows\System\RuNlTOt.exe
  C:\Windows\System\RuNlTOt.exe
  2⤵
  PID:9328
- C:\Windows\System\tMCBOGp.exe
  C:\Windows\System\tMCBOGp.exe
  2⤵
  PID:9344
- C:\Windows\System\cwnZlJB.exe
  C:\Windows\System\cwnZlJB.exe
  2⤵
  PID:9360
- C:\Windows\System\vbJCFoZ.exe
  C:\Windows\System\vbJCFoZ.exe
  2⤵
  PID:9376
- C:\Windows\System\YDjyIAm.exe
  C:\Windows\System\YDjyIAm.exe
  2⤵
  PID:9392
- C:\Windows\System\WgLWjAe.exe
  C:\Windows\System\WgLWjAe.exe
  2⤵
  PID:9408
- C:\Windows\System\jlqllOo.exe
  C:\Windows\System\jlqllOo.exe
  2⤵
  PID:9424
- C:\Windows\System\ABnDfIb.exe
  C:\Windows\System\ABnDfIb.exe
  2⤵
  PID:9440
- C:\Windows\System\UqtKYSy.exe
  C:\Windows\System\UqtKYSy.exe
  2⤵
  PID:9456
- C:\Windows\System\IcXFUkt.exe
  C:\Windows\System\IcXFUkt.exe
  2⤵
  PID:9472
- C:\Windows\System\LrVGNJL.exe
  C:\Windows\System\LrVGNJL.exe
  2⤵
  PID:9488
- C:\Windows\System\jvRCZqg.exe
  C:\Windows\System\jvRCZqg.exe
  2⤵
  PID:9504
- C:\Windows\System\YIwkeRL.exe
  C:\Windows\System\YIwkeRL.exe
  2⤵
  PID:9520
- C:\Windows\System\YSzIjQg.exe
  C:\Windows\System\YSzIjQg.exe
  2⤵
  PID:9536
- C:\Windows\System\mpMWWbY.exe
  C:\Windows\System\mpMWWbY.exe
  2⤵
  PID:9552
- C:\Windows\System\lEznYOI.exe
  C:\Windows\System\lEznYOI.exe
  2⤵
  PID:9568
- C:\Windows\System\BCvGZxh.exe
  C:\Windows\System\BCvGZxh.exe
  2⤵
  PID:9584
- C:\Windows\System\OCkgNol.exe
  C:\Windows\System\OCkgNol.exe
  2⤵
  PID:9600
- C:\Windows\System\YllSExk.exe
  C:\Windows\System\YllSExk.exe
  2⤵
  PID:9616
- C:\Windows\System\NCGGqEi.exe
  C:\Windows\System\NCGGqEi.exe
  2⤵
  PID:9632
- C:\Windows\System\qGgFaGO.exe
  C:\Windows\System\qGgFaGO.exe
  2⤵
  PID:9648
- C:\Windows\System\jRbtnUi.exe
  C:\Windows\System\jRbtnUi.exe
  2⤵
  PID:9664
- C:\Windows\System\pkJUYzT.exe
  C:\Windows\System\pkJUYzT.exe
  2⤵
  PID:9680
- C:\Windows\System\iMpEKGC.exe
  C:\Windows\System\iMpEKGC.exe
  2⤵
  PID:9696
- C:\Windows\System\iaraQzQ.exe
  C:\Windows\System\iaraQzQ.exe
  2⤵
  PID:9712
- C:\Windows\System\pdcWyeV.exe
  C:\Windows\System\pdcWyeV.exe
  2⤵
  PID:9728
- C:\Windows\System\YGAWYAF.exe
  C:\Windows\System\YGAWYAF.exe
  2⤵
  PID:9744
- C:\Windows\System\QHDEDqO.exe
  C:\Windows\System\QHDEDqO.exe
  2⤵
  PID:9760
- C:\Windows\System\lRPWeXs.exe
  C:\Windows\System\lRPWeXs.exe
  2⤵
  PID:9776
- C:\Windows\System\AtIAaVO.exe
  C:\Windows\System\AtIAaVO.exe
  2⤵
  PID:9792
- C:\Windows\System\qlmZEei.exe
  C:\Windows\System\qlmZEei.exe
  2⤵
  PID:9808
- C:\Windows\System\ypofObM.exe
  C:\Windows\System\ypofObM.exe
  2⤵
  PID:9824
- C:\Windows\System\DjlJasv.exe
  C:\Windows\System\DjlJasv.exe
  2⤵
  PID:9840
- C:\Windows\System\TxiMPLy.exe
  C:\Windows\System\TxiMPLy.exe
  2⤵
  PID:9856
- C:\Windows\System\RemiGHz.exe
  C:\Windows\System\RemiGHz.exe
  2⤵
  PID:9872
- C:\Windows\System\NHXBRrg.exe
  C:\Windows\System\NHXBRrg.exe
  2⤵
  PID:9888
- C:\Windows\System\HfLNepl.exe
  C:\Windows\System\HfLNepl.exe
  2⤵
  PID:9904
- C:\Windows\System\iorhedC.exe
  C:\Windows\System\iorhedC.exe
  2⤵
  PID:9920
- C:\Windows\System\uXZVcJv.exe
  C:\Windows\System\uXZVcJv.exe
  2⤵
  PID:9936
- C:\Windows\System\ZEtafbw.exe
  C:\Windows\System\ZEtafbw.exe
  2⤵
  PID:9952
- C:\Windows\System\yLKGaUh.exe
  C:\Windows\System\yLKGaUh.exe
  2⤵
  PID:9968
- C:\Windows\System\JrfWhMP.exe
  C:\Windows\System\JrfWhMP.exe
  2⤵
  PID:9984
- C:\Windows\System\STPeqxH.exe
  C:\Windows\System\STPeqxH.exe
  2⤵
  PID:10000
- C:\Windows\System\pcULCZq.exe
  C:\Windows\System\pcULCZq.exe
  2⤵
  PID:10016
- C:\Windows\System\AxyuwwW.exe
  C:\Windows\System\AxyuwwW.exe
  2⤵
  PID:10032
- C:\Windows\System\iTCQfvD.exe
  C:\Windows\System\iTCQfvD.exe
  2⤵
  PID:10048
- C:\Windows\System\JasnZeU.exe
  C:\Windows\System\JasnZeU.exe
  2⤵
  PID:10064
- C:\Windows\System\FDpGysy.exe
  C:\Windows\System\FDpGysy.exe
  2⤵
  PID:10084
- C:\Windows\System\rPWAZkb.exe
  C:\Windows\System\rPWAZkb.exe
  2⤵
  PID:10100
- C:\Windows\System\SzdwCIL.exe
  C:\Windows\System\SzdwCIL.exe
  2⤵
  PID:10116
- C:\Windows\System\GuCzwrK.exe
  C:\Windows\System\GuCzwrK.exe
  2⤵
  PID:10132
- C:\Windows\System\fYiMxaf.exe
  C:\Windows\System\fYiMxaf.exe
  2⤵
  PID:10148
- C:\Windows\System\BavtqSo.exe
  C:\Windows\System\BavtqSo.exe
  2⤵
  PID:10164
- C:\Windows\System\ECcYlXa.exe
  C:\Windows\System\ECcYlXa.exe
  2⤵
  PID:10180
- C:\Windows\System\CHAZFLJ.exe
  C:\Windows\System\CHAZFLJ.exe
  2⤵
  PID:10196
- C:\Windows\System\tEVPddl.exe
  C:\Windows\System\tEVPddl.exe
  2⤵
  PID:10212
- C:\Windows\System\OGVMMZA.exe
  C:\Windows\System\OGVMMZA.exe
  2⤵
  PID:10228
- C:\Windows\System\fnXftxm.exe
  C:\Windows\System\fnXftxm.exe
  2⤵
  PID:8836
- C:\Windows\System\JjswRSK.exe
  C:\Windows\System\JjswRSK.exe
  2⤵
  PID:9224
- C:\Windows\System\zoKruxX.exe
  C:\Windows\System\zoKruxX.exe
  2⤵
  PID:9240
- C:\Windows\System\gbvSKMd.exe
  C:\Windows\System\gbvSKMd.exe
  2⤵
  PID:9288
- C:\Windows\System\idvbAHk.exe
  C:\Windows\System\idvbAHk.exe
  2⤵
  PID:9352
- C:\Windows\System\lKDBbJb.exe
  C:\Windows\System\lKDBbJb.exe
  2⤵
  PID:9416
- C:\Windows\System\cwgrebq.exe
  C:\Windows\System\cwgrebq.exe
  2⤵
  PID:9480
- C:\Windows\System\YrPKGGT.exe
  C:\Windows\System\YrPKGGT.exe
  2⤵
  PID:9544
- C:\Windows\System\BIQtmmD.exe
  C:\Windows\System\BIQtmmD.exe
  2⤵
  PID:9608
- C:\Windows\System\CTdTpWv.exe
  C:\Windows\System\CTdTpWv.exe
  2⤵
  PID:9436
- C:\Windows\System\lsDbfIs.exe
  C:\Windows\System\lsDbfIs.exe
  2⤵
  PID:9308
- C:\Windows\System\Ctsdjob.exe
  C:\Windows\System\Ctsdjob.exe
  2⤵
  PID:9340
- C:\Windows\System\OdUrNwW.exe
  C:\Windows\System\OdUrNwW.exe
  2⤵
  PID:7356
- C:\Windows\System\hshKIqZ.exe
  C:\Windows\System\hshKIqZ.exe
  2⤵
  PID:9708
- C:\Windows\System\jJkSOoS.exe
  C:\Windows\System\jJkSOoS.exe
  2⤵
  PID:9772
- C:\Windows\System\KRBHItd.exe
  C:\Windows\System\KRBHItd.exe
  2⤵
  PID:9624
- C:\Windows\System\yffXwPs.exe
  C:\Windows\System\yffXwPs.exe
  2⤵
  PID:9832
- C:\Windows\System\znHXzaH.exe
  C:\Windows\System\znHXzaH.exe
  2⤵
  PID:9532
- C:\Windows\System\uCfhlhT.exe
  C:\Windows\System\uCfhlhT.exe
  2⤵
  PID:9560
- C:\Windows\System\ajAYANK.exe
  C:\Windows\System\ajAYANK.exe
  2⤵
  PID:9628
- C:\Windows\System\HBhAGfw.exe
  C:\Windows\System\HBhAGfw.exe
  2⤵
  PID:9932
- C:\Windows\System\dEMeKHU.exe
  C:\Windows\System\dEMeKHU.exe
  2⤵
  PID:9996
- C:\Windows\System\RgHXePR.exe
  C:\Windows\System\RgHXePR.exe
  2⤵
  PID:10060
- C:\Windows\System\yVvvEcs.exe
  C:\Windows\System\yVvvEcs.exe
  2⤵
  PID:10124
- C:\Windows\System\WgaIUGW.exe
  C:\Windows\System\WgaIUGW.exe
  2⤵
  PID:10188
- C:\Windows\System\jltloMp.exe
  C:\Windows\System\jltloMp.exe
  2⤵
  PID:9912
- C:\Windows\System\agzfSCb.exe
  C:\Windows\System\agzfSCb.exe
  2⤵
  PID:9692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CPLarqy.exe

Filesize
2.1MB

MD5
26393cacae459c067af7589e409b6217

SHA1
f0714a247b7227e4cc568513d9591ce74570d03e

SHA256
e6903b12b86926db5073e729672b2e53cb3f0a41294f6ff0a5dc61dbe48d1b87

SHA512
892e52baddaca67f45c93724ac0d403b6f54cbfa8f326744fb67356dd7a312090387e22c5c8135d1b377814ae05f4b4cc43a8b83f88602bddde9b4e21606654d

Download Submit
C:\Windows\system\CbkhPUh.exe

Filesize
2.1MB

MD5
b8386f6a213c019d787900dff418daef

SHA1
2a83e964a770d719ae9f6819f2ec30f670ac8bbc

SHA256
36db2f7b6130229a760e97cc48d5d732ac52b4be41a65f4cc98531312c012c88

SHA512
15d81947335b2b9b04df61844af7e6560f312b8b0a37931d587f0204568acc272c1c653e54d8b10d8a45e85862a96cca57d98dd275c5c07ba84949b86cb983dd

Download Submit
C:\Windows\system\EDvzCBt.exe

Filesize
2.1MB

MD5
4af712d0065fbf31c066dd7ccacbff3e

SHA1
db9a260b21a764b4da04b148ca1ae053cdbd63e9

SHA256
b35ab4e2a116caef14007901476ce6380c52250eab9ee6ce969096e298127c21

SHA512
9e54b5d2d58a2df26989d4275a816c6116cdce271e04d7e62bdb4339a1dac6fb0b4dd0fd21ae6b9daedf0005e4afc0e850fb18fecf7a4915c335bb57f0e28aa4

Download Submit
C:\Windows\system\EykniIN.exe

Filesize
2.1MB

MD5
a1dca26127929ffcc92d933ef7f5e77c

SHA1
13a62d8ab02f11ea0ce2220b64a83844da3f5a34

SHA256
087826087d78126c035e7a7036d6396249e6669f0c16d7dc77bfc6a286b529d8

SHA512
f506d37858d50b29c53e0c465d8272d5e6eba8335f3e7e41dc207c1b5992c3047f314f18e89de93c5ca1788da5f7583d98a7799b4d0e1cf28c1f35a58e3daff1

Download Submit
C:\Windows\system\FQTnpwM.exe

Filesize
2.1MB

MD5
45bd7051fb22f45c120c26d915607953

SHA1
aea3fcf4a4899775d3b3df668bf64542c05a910b

SHA256
78125ecf233eb098710d2559c0365829b8ae205b3290df3f4f8b6b2abadeacd7

SHA512
3b46d11badb7760ab33e6f0b7005d8680e26d3fe1ed15ba7f1b404872b5e549b2e2b56a58e44e9097b2621de5ad943ec24768e2f9a86087f9e0300ede82bd96a

Download Submit
C:\Windows\system\LAwCzNJ.exe

Filesize
2.1MB

MD5
5d4fd38d36ea84f0269bacdb90fb5ba9

SHA1
76c818b71d955b5b9b840f5d605ab1e89d32901d

SHA256
996107245cd0a0a3e7a04aa1ad3de9e826dac59614ac2c087fcc732505cae4c7

SHA512
6a5fcf32bb81c4c98feae9e6feec99b8d7ed5590c3302489e83d80b369c417cbb106e8f8f64bc3ef8d8693d4f9ab31b476b75b84f84d2ba0850ff679522b4055

Download Submit
C:\Windows\system\LBsFmXh.exe

Filesize
2.1MB

MD5
78ebe420cd54e0450ff421a82e0c7c93

SHA1
7286623a128fd24bff1fcff95d7027f2bef0775c

SHA256
c3b063b9a6e33e0a2d83751fbcb957315d1440ddda384c7d55960df059068058

SHA512
11012520b238414305336cdfd68a793ad8d0d609e33778f1bfd4b767b37db02681969ea9ad11f36e1b6c745125d50724b27283ae8ba5c3a02f1737798f6a2fc0

Download Submit
C:\Windows\system\MUnUOOl.exe

Filesize
2.1MB

MD5
f32a5baec0d441dceec309d33276d401

SHA1
5fe551f26e57b6b6e662d9fce5ff97fa65327f1a

SHA256
4a2f73f06dd91745947af5699b5c7ce197595a7820ac465827b1624fc15a9646

SHA512
772097e591bc04cad166f46c995fe71cf023bdaab2424530d0e40610067012e96a16bd0f8a45e68405a7492ccc87e83feb4aaeeb986bc9cbd66ff318953702ab

Download Submit
C:\Windows\system\McHrAuo.exe

Filesize
2.1MB

MD5
115b91a5a366dda37b1cf555cea13c55

SHA1
c352df3b0b77a028e6d002505334298cd8e5dd92

SHA256
8336872419cd4a8c057694ac19111320f58de68e63f34dbda2984fa94851e12f

SHA512
592a13ec9f5560583b3862548e59d528c0af65ea7579f9fe4bf65395e31da3c70171af18c371c128d3aa07c2959753280c3c71c487fc31d46d1f6a4366b97f1e

Download Submit
C:\Windows\system\MwTjLJF.exe

Filesize
2.1MB

MD5
64f003700cbda7d5f71326837a82a65a

SHA1
e6e57fcecc65a7b1622aed4eaf41a4a98b5a02cb

SHA256
0638dcf50d8390c6229614375585c5b85752822c8c17e18a38c68624fe7a6aa9

SHA512
df2f09f132fd9eb91651fb88b8920400129dafb9c83522e8d564a375b3a8c87623bf442c5785ed61775167041f8d8c9ca2799757d432beb3233f84f63b3cf7ee

Download Submit
C:\Windows\system\TORquCf.exe

Filesize
2.1MB

MD5
6c3908dac1cd3f6a062641ef2815f1d6

SHA1
6dcdde8c7b16522c43ef5b95af9496388dacecdd

SHA256
520d799394824a80942757b48f67eaa1fd05f924d8f560667adae118d2f414fc

SHA512
4a09e66e181752cc99e4a5806609140ad51c604f3a55cfe3ceb54ab1037b588df7ee3605e074d4787047e3021889affaf8559d652732e76afeb5ce208370208b

Download Submit
C:\Windows\system\XPgiVst.exe

Filesize
2.1MB

MD5
b4c08245fe6a4086ced4d8d87a74c70d

SHA1
acb260ec1f581288745a8d8a5bba69fae164378d

SHA256
781c4087653646bdf2f41d6ec5ea868b6f0283b03fd2d9642f54ee68392b8e2e

SHA512
188fe7e5bb704d6d9208078b440710e16a0212ac1d587cb6e3c5befce73c1aff646176698a5d5b499e826887c16deddd63eb64f9936c7ec4e66b907255d57217

Download Submit
C:\Windows\system\ZAtmkxV.exe

Filesize
2.1MB

MD5
a8fb2ec7ae191fae4b03dae0438fa839

SHA1
5e037d873b2d7c77aa0a2807f3699b0e1df2be3e

SHA256
cbc346fe8f78d0530a3a2a66496733d9ea200c9a079acf010907bc4597ba2f6b

SHA512
d3850565d7e9f47ec7ad0136b492bb566409982a46eecacf5825e1d25fd1161682856a94ba7168141e735dcffe07cc0d6055b796dc442a6fa848b1cf06f23772

Download Submit
C:\Windows\system\ZROosVB.exe

Filesize
2.1MB

MD5
1102102b979b824fdc615b9b07447c6c

SHA1
431562d3849c78dc669cd8e2115f0895a985e8c7

SHA256
4585b35e4ba3b2794687367aa6ab2d1dcddacab816b92670861f3d7e727c9822

SHA512
90dfbbc3d2464977d40eb8208598dc5f694181e2837d1aec18304031f764a29ed9e7fa9bd8784c4d8c1195ad97797adf5d57c47eeeda6c5087fdf7e0c3d5734e

Download Submit
C:\Windows\system\cJOhTzg.exe

Filesize
2.1MB

MD5
e0bb8336f529575e9598c9079c67a0a3

SHA1
89e32a2ebd180124907a7e6858660a113e1d4240

SHA256
382b75d0b83c1c9564702849731f016287868c05ffff40c7d8822482f6432430

SHA512
24ff2848595336c80da4ee7c60eca3bc905b8fec0e59894746fc1b88fad1b13efa1b0915345a5770774fedcbca61267ab7994dcc189bf1a9c85e192e91259640

Download Submit
C:\Windows\system\dmKjDil.exe

Filesize
2.1MB

MD5
025b9bd63bea1db5df5c8270b63c4d9a

SHA1
a040d8d744aa9a474280dec203a61fb990d3aba1

SHA256
ac73eeb80d24c868f5cead4c326dcfb889344d442cd03cf855a1519507a1e32d

SHA512
cf135a561cb6866cb7660337665fbbcc00b7879c9f9eb2482017b084971c2d6dfa0b6de078f4c07da1440f484aeef67dd3468beb0602ca8011e7a7be97917191

Download Submit
C:\Windows\system\hjnPExa.exe

Filesize
2.1MB

MD5
f474696d263debe212f25884e996932f

SHA1
8c55037134daa2fd3746a2f81c8ffc42163939ee

SHA256
31ae0738e06fb0fcd810a5c0511992192ba25e9c539a2c0b3352025310693c33

SHA512
38de416e71f5fd279b0125f6143fec171370efffe40d498c2b8103a2c013958ba0ca2e3620044a1a8835363188beab1e81cb95e6860521926bc0e8a909444b4d

Download Submit
C:\Windows\system\lvvnnLO.exe

Filesize
2.1MB

MD5
33aae1b875da9cbda28e261599e4af12

SHA1
cbee21da2be878eba4430d97a7e95f382d4d23f0

SHA256
130f8e4c4c23626a6183f0d86a60509348bc252505c463f2ba2c0bf52876c4aa

SHA512
b9d7679793a978fdc082e517535a4bc7d4876978054ee15fff7d7b4ee129ce816e41accfa295062952cc6ab52cfa56ef21d27ff519f2e3a8ab3c360687bf04ed

Download Submit
C:\Windows\system\lwdGhVq.exe

Filesize
2.1MB

MD5
ef9369e680392715fb6829c516ce8c47

SHA1
d55038a23b6dc6a73bf781837f5cdbd3b1f582e3

SHA256
8a96d5ce606fe9921684a2378af1e0a4e9f33aaca357d0a6a9ac8d6380b203d3

SHA512
77a04863ed1d53b5370077366f634ce0f00b122d26abc96f11b0653aa095629705361b6ca982700cab192d475c402a5556a18aebf24570e6cde18d000fad0ec5

Download Submit
C:\Windows\system\rjlXFfC.exe

Filesize
2.1MB

MD5
6119237fe162f2c104ef5a03b4de80ed

SHA1
6b2ae5f90c647189554794494506db69fb6236b3

SHA256
faabfd36d8f84cc940814661a5ce1ec1284dc32e731ebfa4df2c92e296f33db8

SHA512
e4cf1b287795ed349e9c5bd3fe08a174303ef3ac7284d30a92f281efed0af31dd73597070ca94eb95d23ef276cea1c96ca02da852aff609913ed6891e30914a2

Download Submit
C:\Windows\system\tNKoHdn.exe

Filesize
2.1MB

MD5
82c7e5529a0fe0298eddce9e7053eaf2

SHA1
762685f86d4c06605eb364e17a426df37ea8ffa6

SHA256
bc6b5376da07a4aca90711065efbbfb1b0ea1f3e01c0e2adb4121cefac021da3

SHA512
1596d0a4ef724ee41b2530e3475e4e10cc560f28bf4157083fc227c9ee7283238ce203615121addee09de614f85b302be139b33d9bb4065b78375bb28861d0e7

Download Submit
C:\Windows\system\tWyDthR.exe

Filesize
2.1MB

MD5
807617832e73e3832df312f4df98699a

SHA1
44d1ae2e168f9b0e9af7525ddc753b35b2433e0b

SHA256
61015771e95609f06b1cc44e000ea8bdb68eabe6bb4c673dcb696b7e803731fe

SHA512
b6fdf839df393862293519d8b24b6414428fa6cb9013710c163538e7ab116dff8fbb58308e5007dff6f8b3056c19f717799a8848edb9718981106139128ff192

Download Submit
C:\Windows\system\wBHFnZj.exe

Filesize
2.1MB

MD5
3adbc72a9497ac975b0797a9823a6583

SHA1
e332c7a2e1aaf0420933b003a87c4aa768c10147

SHA256
1b1f54a877c28a343eadbadf555f10b5f03e23ae3341b03a6554172dbf210bb1

SHA512
394c7bfce9b004c6b6c2c96645aac4b1486bceff1460d7f26c291cb58d0b1417de5a37f797bf8e2d5b651d7607a9e0ffff258864c80e23e15e7679d51fb6f68f

Download Submit
C:\Windows\system\xHvYeku.exe

Filesize
2.1MB

MD5
7e9e5454b553488c5405ab7c53afc426

SHA1
f92659b761149f283822afeae9e3fe2236f01474

SHA256
005ce1ce7d71957659896fb9ee8594e7b1f0e16539aa9512b7deb29b68748b95

SHA512
64c2a2f9baca69be1191f3fbc9068d1fe9b30b4e231dd6843d04dd0ae4822155b3f32cc17979f506856f63eeb2dfade484e7e0ecb2647a0c76a6480b11de8c5d

Download Submit
C:\Windows\system\xnWRAZo.exe

Filesize
2.1MB

MD5
9fb336822bbea9121d1ac3249f7b65d8

SHA1
24393d31660b6cf078baa4e22291db14bedf97de

SHA256
bf4dac212147ff31749ba26ee2903d5d9cf6083f259d502c8e0c16a276ed8818

SHA512
f662d11fdcd81a5fcdf7de5da973b2d228cd4f75de6f75703b7ced19f30c39abf9a35ebaff384b39bd257d4686ebac2ac6bccc23c5358d184c67a68b8dcaf42f

Download Submit
\Windows\system\DBonLZQ.exe

Filesize
2.1MB

MD5
421ae674aced9b5721efcd2c267213c2

SHA1
b514f460c1b2ed6ae61c792df1da4d9514530ef0

SHA256
4775fa11d5c492697e377aa1df52bf8a70a39671b8c837b0af58973e8ac33c02

SHA512
60b597e92978ee01871b5b51518d7888c78b5dbc544adaf6874b4b9b9f1649ac1814e4b1a7d0f7f645e35469673942453e8a2563886c94f78667013acfa0a3dd

Download Submit
\Windows\system\XHZDoef.exe

Filesize
2.1MB

MD5
98612758b79e732b88530a998a1b47c4

SHA1
b5ceb6cc4baae07b17f67a0b2c6dea6d563605ec

SHA256
6d6d9f8c34298071d892bac342d7a945ead4c12d3d7c59fe83ab5b0d0bef60db

SHA512
b5fb4c94003ad9a8474fff13502bd93dc90ada2fa69238be01ff42f5e37d188770410eb0e40d5f0bda875c8115281474209bad3d2c2f796524f7438c1f8c7804

Download Submit
\Windows\system\eqyFlvy.exe

Filesize
2.1MB

MD5
8575408bdf4418e6c1da2a9c8c240aaf

SHA1
b501bbf105f83c73f44430005df9e1e0ca1505ce

SHA256
904e830ecab33ab6cb97bb2298c2d54bcbbe86761fbc20df65bcf55a31346946

SHA512
859dfc2bd8f7154d0ed31074080a3402615cf5234b9a9711ccafe56560f3f871e64eec8e18ef7e3fb378476a984e9677dbe77db1873d931066b2cd80fd1136b9

Download Submit
\Windows\system\fvXBSxe.exe

Filesize
2.1MB

MD5
c2008d125bfddf74729e6b3610946703

SHA1
05e1bf82142fc7af807fe2a69d0e3905d22fce8f

SHA256
ff0b25aacfdee7825aefa9c2fb02224d5ba0470d23754c9750dc73236468388b

SHA512
c24881fd627c493ca04a5dff427b8475ab1b065a3cf3eed2ee707457a5be8cfad4eb461cf9deab3e71b01728bea191c1e9ceb354dd79725911f574bf1dba5889

Download Submit
\Windows\system\kHheWZi.exe

Filesize
2.1MB

MD5
71766001da3d004d17010af8ebf59a6e

SHA1
1c64ff3ba78f4e283c32cfdb39be991a03b92262

SHA256
eff1539388049765cd17cb44b2d2eba16e2036b0bc6130d8a548efb792e13f71

SHA512
26d9e371b89dd0dd6ce42bde867934231e25860e48a530bd443e9a09417502126d2f7df487c7f975c760b961bdf5cfd7eed22fb5222db5a7edcffbf491907930

Download Submit
\Windows\system\rGytquT.exe

Filesize
2.1MB

MD5
8783864c1c83a27c5fbf183fd42addcd

SHA1
55add66a6b4f54dbbc462f17769d02ac82b5b778

SHA256
317f42cf42769479c728e8daa39b8c61489a3d0fdba58da38e9a32aaf772c146

SHA512
155930ba00c485cf5b484d509aadf907f13745647d4a161f59547f0196423c787818d30edc75483e08979ed19ea17cfc2d1cf902ed3fd212e45af901b67fca15

Download Submit
\Windows\system\rkXqFvN.exe

Filesize
2.1MB

MD5
df783eb9a58ef6c431de70572a4cb44d

SHA1
ff8ed725030012407a61620c8f80a12dc14af85d

SHA256
f11c327c754ea23e66df70de2d7d7e13d741605b60c0640643ccce45a829b2bb

SHA512
0717dc9ca062d1c1bdf58f236b88fde0c02aba019a23bed795c4f161cd22a8f8fa6eb73b7ccf86b8dffb187cea29f5aa26851fd68c38c5c0266f0709819b8979

Download Submit
memory/1888-7-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/1888-2004-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/1888-124-0x0000000003620000-0x0000000003A12000-memory.dmp

Filesize
3.9MB

Download
memory/1888-1-0x0000000000190000-0x00000000001A0000-memory.dmp

Filesize
64KB

Download
memory/1888-106-0x0000000003620000-0x0000000003A12000-memory.dmp

Filesize
3.9MB

Download
memory/1888-0-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/1888-115-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1888-113-0x0000000003620000-0x0000000003A12000-memory.dmp

Filesize
3.9MB

Download
memory/1888-23-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/1888-122-0x0000000003620000-0x0000000003A12000-memory.dmp

Filesize
3.9MB

Download
memory/1888-14-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/1888-127-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2416-126-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2508-123-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2516-125-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2520-129-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-117-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-111-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-15-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2772-114-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2992-128-0x000007FEF5B00000-0x000007FEF649D000-memory.dmp

Filesize
9.6MB

Download
memory/2992-24-0x00000000029C0000-0x0000000002A40000-memory.dmp

Filesize
512KB

Download
memory/2992-39-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2992-45-0x0000000001E20000-0x0000000001E28000-memory.dmp

Filesize
32KB

Download
memory/2992-112-0x00000000029C0000-0x0000000002A40000-memory.dmp

Filesize
512KB

Download
memory/2992-101-0x000007FEF5B00000-0x000007FEF649D000-memory.dmp

Filesize
9.6MB

Download
memory/2992-118-0x00000000029C0000-0x0000000002A40000-memory.dmp

Filesize
512KB

Download
memory/2992-340-0x000007FEF5B00000-0x000007FEF649D000-memory.dmp

Filesize
9.6MB

Download
memory/3048-9-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download