xmrig | aa28693edd9ee60d07ff598f0145f4c3be9521e11576755d546032b5322bacfb

Analysis

max time kernel
35s
max time network
36s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 11:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
Size

1.4MB
MD5

09b7493b12b8fb17a374aed02a80f692
SHA1

25c5ee7f02417eae4be69f5826a2dae3bf2dc398
SHA256

aa28693edd9ee60d07ff598f0145f4c3be9521e11576755d546032b5322bacfb
SHA512

554ae5b473a602d68f731e221b9763c32a83982c3b7ea93ccefa8564f72908f83506a8fd82c608bfdd8add285ad97bc6d402ae2218e7b8056487dda49f7fac99
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwk:Lz071uv4BPMkibTIA5CJT

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/3064-13-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	xmrig
behavioral1/memory/2604-35-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2476-40-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2444-48-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2884-37-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2080-36-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/1968-423-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2352-58-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2080-1946-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3064	WFtrAKJ.exe
2604	GDuICbp.exe
2884	gYDajjy.exe
2476	rZrtQIE.exe
2444	GQliVuY.exe
2352	XwAMiZd.exe
1968	xlMffWe.exe
2980	vkiuJgs.exe
2720	cfuMoVL.exe
1228	wlufZbx.exe
2684	hOBAHaV.exe
2828	XUoawyg.exe
2796	cHFxPsj.exe
1876	vJBPWBM.exe
1528	dfqYpxm.exe
1908	YVZMVZB.exe
824	iPyNhlo.exe
2344	DczYJwZ.exe
2856	ZbLUynl.exe
2520	FcjhQoh.exe
1436	NJeIama.exe
2864	gputZwI.exe
1336	JwJqYLg.exe
1052	hUYBCUs.exe
2128	UcJeoDJ.exe
336	PdIDFoJ.exe
584	GXpUdwW.exe
1592	uDJuYTK.exe
1328	UVoHmND.exe
1796	TeUiLsz.exe
820	SdCROCx.exe
3008	HPUJIOb.exe
412	nptnRuO.exe
2416	XnbkQrP.exe
2892	HeMpNwj.exe
2364	ftdYsKp.exe
848	gSuUNjl.exe
1636	rdrxGck.exe
1500	KPwZlpU.exe
1712	CUgWzTk.exe
1312	DzPMRmR.exe
2644	oqmSdGM.exe
1000	ZxhdObB.exe
2068	vRMxogY.exe
1220	HHMNlHY.exe
960	uvXknno.exe
856	lpptoJB.exe
708	xDQzDMd.exe
2092	KFJfDVF.exe
2340	hAgZXxr.exe
1700	empIieT.exe
588	VkVWHHj.exe
1196	ubMuzIE.exe
576	KZpLXLv.exe
628	vtXSlnR.exe
2124	xUmxLvM.exe
1448	vyWrmEK.exe
380	CSVkSVa.exe
2192	gdarLIr.exe
1808	Qpwujle.exe
1540	CUMjWzY.exe
1548	kIMQkCt.exe
2592	COQeueN.exe
2744	ieEojKN.exe

Loads dropped DLL 64 IoCs

pid	Process
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2080-0-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/files/0x000b00000001444f-6.dat	upx
behavioral1/memory/3064-13-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/files/0x0031000000014665-17.dat	upx
behavioral1/files/0x001400000000549e-16.dat	upx
behavioral1/files/0x0008000000014b12-29.dat	upx
behavioral1/memory/2604-35-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2476-40-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/files/0x0007000000014c25-45.dat	upx
behavioral1/memory/2444-48-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2884-37-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/files/0x0007000000014e5a-49.dat	upx
behavioral1/files/0x0009000000015136-76.dat	upx
behavioral1/files/0x0006000000015cca-85.dat	upx
behavioral1/files/0x0006000000015cdb-94.dat	upx
behavioral1/files/0x0006000000015cec-98.dat	upx
behavioral1/files/0x0006000000015f9e-122.dat	upx
behavioral1/files/0x00060000000160f8-130.dat	upx
behavioral1/files/0x0006000000016411-138.dat	upx
behavioral1/files/0x0006000000016c2e-166.dat	upx
behavioral1/memory/1968-423-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/files/0x0006000000016c26-162.dat	upx
behavioral1/files/0x0006000000016c17-158.dat	upx
behavioral1/files/0x0006000000016a45-154.dat	upx
behavioral1/files/0x00060000000167ef-150.dat	upx
behavioral1/files/0x0006000000016597-146.dat	upx
behavioral1/files/0x0006000000016525-142.dat	upx
behavioral1/files/0x0006000000016277-134.dat	upx
behavioral1/files/0x0006000000016056-126.dat	upx
behavioral1/files/0x0006000000015f1b-118.dat	upx
behavioral1/files/0x0006000000015d6e-114.dat	upx
behavioral1/files/0x0006000000015d5d-110.dat	upx
behavioral1/files/0x0006000000015d06-106.dat	upx
behavioral1/files/0x0006000000015cf7-102.dat	upx
behavioral1/files/0x0006000000015cc1-88.dat	upx
behavioral1/files/0x0006000000015cb9-84.dat	upx
behavioral1/files/0x0007000000015ca5-83.dat	upx
behavioral1/files/0x0006000000015cad-82.dat	upx
behavioral1/files/0x0031000000014701-62.dat	upx
behavioral1/memory/2352-58-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2080-1946-0x000000013F570000-0x000000013F962000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IpXNWGA.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\zueWLHP.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\OuCLgaS.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\uPQJQdg.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\OxHytSH.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\JRiIBNd.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\ryxNYqF.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\dSmYDqs.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\EZKgAZw.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\HDCPbyR.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\KFJfDVF.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\gKCapvH.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\VbvTvKN.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\ERYDbdo.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\eqYLwOz.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\kHONKih.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\qhMfcTL.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\OJirMQo.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\KBZlNdn.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\inbtZTD.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\jzPmXwW.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\UnLPPkg.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\GBMgfle.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\VWQWfCg.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\uHRXjQT.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\CYvAypi.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\EHlzZJr.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\IQqydTy.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\ZaGxnkB.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\FARBaMU.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\DjlZViC.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\adVlcnS.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\UQGjCEA.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\VNBQSnZ.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\auLinKm.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\jVyhbeL.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\vVNysPI.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\CUiGHsK.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\eSKpfrA.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\qhKGQrz.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\TNNbnII.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\ePLBgIA.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\qOoabGN.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\OrEHeji.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\mqHRFnq.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\jARvOGO.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\QZIhKYi.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\iAhwzFr.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\mimSZaC.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\GmcfaKc.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\WQaamjp.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\FuEDyiH.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\sMlUrys.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\xGXcbxG.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\SVeBiWJ.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\SEJCkJa.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\uyuVQBl.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\FNtTCiq.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\Ebvpwrs.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\ZlLcNKI.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\MotoqrV.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\yLGgkJc.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\lpptoJB.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
File created	C:\Windows\System\CSVkSVa.exe	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2636	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
Token: SeDebugPrivilege	2636	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2636	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	29
PID 2080 wrote to memory of 2636	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	29
PID 2080 wrote to memory of 2636	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	29
PID 2080 wrote to memory of 3064	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	30
PID 2080 wrote to memory of 3064	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	30
PID 2080 wrote to memory of 3064	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	30
PID 2080 wrote to memory of 2604	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	31
PID 2080 wrote to memory of 2604	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	31
PID 2080 wrote to memory of 2604	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	31
PID 2080 wrote to memory of 2884	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	32
PID 2080 wrote to memory of 2884	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	32
PID 2080 wrote to memory of 2884	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	32
PID 2080 wrote to memory of 2476	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	33
PID 2080 wrote to memory of 2476	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	33
PID 2080 wrote to memory of 2476	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	33
PID 2080 wrote to memory of 2444	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	34
PID 2080 wrote to memory of 2444	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	34
PID 2080 wrote to memory of 2444	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	34
PID 2080 wrote to memory of 2352	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	35
PID 2080 wrote to memory of 2352	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	35
PID 2080 wrote to memory of 2352	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	35
PID 2080 wrote to memory of 1968	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	36
PID 2080 wrote to memory of 1968	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	36
PID 2080 wrote to memory of 1968	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	36
PID 2080 wrote to memory of 2980	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	37
PID 2080 wrote to memory of 2980	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	37
PID 2080 wrote to memory of 2980	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	37
PID 2080 wrote to memory of 1228	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	38
PID 2080 wrote to memory of 1228	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	38
PID 2080 wrote to memory of 1228	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	38
PID 2080 wrote to memory of 2720	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	39
PID 2080 wrote to memory of 2720	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	39
PID 2080 wrote to memory of 2720	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	39
PID 2080 wrote to memory of 2684	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	40
PID 2080 wrote to memory of 2684	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	40
PID 2080 wrote to memory of 2684	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	40
PID 2080 wrote to memory of 2796	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	41
PID 2080 wrote to memory of 2796	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	41
PID 2080 wrote to memory of 2796	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	41
PID 2080 wrote to memory of 2828	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	42
PID 2080 wrote to memory of 2828	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	42
PID 2080 wrote to memory of 2828	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	42
PID 2080 wrote to memory of 1876	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	43
PID 2080 wrote to memory of 1876	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	43
PID 2080 wrote to memory of 1876	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	43
PID 2080 wrote to memory of 1528	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	44
PID 2080 wrote to memory of 1528	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	44
PID 2080 wrote to memory of 1528	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	44
PID 2080 wrote to memory of 1908	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	45
PID 2080 wrote to memory of 1908	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	45
PID 2080 wrote to memory of 1908	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	45
PID 2080 wrote to memory of 824	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	46
PID 2080 wrote to memory of 824	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	46
PID 2080 wrote to memory of 824	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	46
PID 2080 wrote to memory of 2344	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	47
PID 2080 wrote to memory of 2344	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	47
PID 2080 wrote to memory of 2344	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	47
PID 2080 wrote to memory of 2856	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	48
PID 2080 wrote to memory of 2856	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	48
PID 2080 wrote to memory of 2856	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	48
PID 2080 wrote to memory of 2520	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	49
PID 2080 wrote to memory of 2520	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	49
PID 2080 wrote to memory of 2520	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	49
PID 2080 wrote to memory of 1436	2080	09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09b7493b12b8fb17a374aed02a80f692_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\System\WFtrAKJ.exe
  C:\Windows\System\WFtrAKJ.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\GDuICbp.exe
  C:\Windows\System\GDuICbp.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\gYDajjy.exe
  C:\Windows\System\gYDajjy.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\rZrtQIE.exe
  C:\Windows\System\rZrtQIE.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\GQliVuY.exe
  C:\Windows\System\GQliVuY.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\XwAMiZd.exe
  C:\Windows\System\XwAMiZd.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\xlMffWe.exe
  C:\Windows\System\xlMffWe.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\vkiuJgs.exe
  C:\Windows\System\vkiuJgs.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\wlufZbx.exe
  C:\Windows\System\wlufZbx.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\cfuMoVL.exe
  C:\Windows\System\cfuMoVL.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\hOBAHaV.exe
  C:\Windows\System\hOBAHaV.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\cHFxPsj.exe
  C:\Windows\System\cHFxPsj.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\XUoawyg.exe
  C:\Windows\System\XUoawyg.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\vJBPWBM.exe
  C:\Windows\System\vJBPWBM.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\dfqYpxm.exe
  C:\Windows\System\dfqYpxm.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\YVZMVZB.exe
  C:\Windows\System\YVZMVZB.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\iPyNhlo.exe
  C:\Windows\System\iPyNhlo.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\DczYJwZ.exe
  C:\Windows\System\DczYJwZ.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\ZbLUynl.exe
  C:\Windows\System\ZbLUynl.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\FcjhQoh.exe
  C:\Windows\System\FcjhQoh.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\NJeIama.exe
  C:\Windows\System\NJeIama.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\gputZwI.exe
  C:\Windows\System\gputZwI.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\JwJqYLg.exe
  C:\Windows\System\JwJqYLg.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\hUYBCUs.exe
  C:\Windows\System\hUYBCUs.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\UcJeoDJ.exe
  C:\Windows\System\UcJeoDJ.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\PdIDFoJ.exe
  C:\Windows\System\PdIDFoJ.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\GXpUdwW.exe
  C:\Windows\System\GXpUdwW.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\uDJuYTK.exe
  C:\Windows\System\uDJuYTK.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\UVoHmND.exe
  C:\Windows\System\UVoHmND.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\TeUiLsz.exe
  C:\Windows\System\TeUiLsz.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\SdCROCx.exe
  C:\Windows\System\SdCROCx.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\HPUJIOb.exe
  C:\Windows\System\HPUJIOb.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\nptnRuO.exe
  C:\Windows\System\nptnRuO.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\XnbkQrP.exe
  C:\Windows\System\XnbkQrP.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\HeMpNwj.exe
  C:\Windows\System\HeMpNwj.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\ftdYsKp.exe
  C:\Windows\System\ftdYsKp.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\gSuUNjl.exe
  C:\Windows\System\gSuUNjl.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\rdrxGck.exe
  C:\Windows\System\rdrxGck.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\KPwZlpU.exe
  C:\Windows\System\KPwZlpU.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\CUgWzTk.exe
  C:\Windows\System\CUgWzTk.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\DzPMRmR.exe
  C:\Windows\System\DzPMRmR.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\oqmSdGM.exe
  C:\Windows\System\oqmSdGM.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\ZxhdObB.exe
  C:\Windows\System\ZxhdObB.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\vRMxogY.exe
  C:\Windows\System\vRMxogY.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\HHMNlHY.exe
  C:\Windows\System\HHMNlHY.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\uvXknno.exe
  C:\Windows\System\uvXknno.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\lpptoJB.exe
  C:\Windows\System\lpptoJB.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\xDQzDMd.exe
  C:\Windows\System\xDQzDMd.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\KFJfDVF.exe
  C:\Windows\System\KFJfDVF.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\hAgZXxr.exe
  C:\Windows\System\hAgZXxr.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\empIieT.exe
  C:\Windows\System\empIieT.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\VkVWHHj.exe
  C:\Windows\System\VkVWHHj.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\ubMuzIE.exe
  C:\Windows\System\ubMuzIE.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\KZpLXLv.exe
  C:\Windows\System\KZpLXLv.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\vtXSlnR.exe
  C:\Windows\System\vtXSlnR.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\xUmxLvM.exe
  C:\Windows\System\xUmxLvM.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\vyWrmEK.exe
  C:\Windows\System\vyWrmEK.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\CSVkSVa.exe
  C:\Windows\System\CSVkSVa.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\gdarLIr.exe
  C:\Windows\System\gdarLIr.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\Qpwujle.exe
  C:\Windows\System\Qpwujle.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\CUMjWzY.exe
  C:\Windows\System\CUMjWzY.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\kIMQkCt.exe
  C:\Windows\System\kIMQkCt.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\COQeueN.exe
  C:\Windows\System\COQeueN.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\ieEojKN.exe
  C:\Windows\System\ieEojKN.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\TehjRjw.exe
  C:\Windows\System\TehjRjw.exe
  2⤵
  PID:2596
- C:\Windows\System\gQIajvV.exe
  C:\Windows\System\gQIajvV.exe
  2⤵
  PID:2780
- C:\Windows\System\blSkoMm.exe
  C:\Windows\System\blSkoMm.exe
  2⤵
  PID:2724
- C:\Windows\System\JUDeDFb.exe
  C:\Windows\System\JUDeDFb.exe
  2⤵
  PID:2772
- C:\Windows\System\NJKPwfp.exe
  C:\Windows\System\NJKPwfp.exe
  2⤵
  PID:1624
- C:\Windows\System\mIuhCkZ.exe
  C:\Windows\System\mIuhCkZ.exe
  2⤵
  PID:2480
- C:\Windows\System\RTvhxkO.exe
  C:\Windows\System\RTvhxkO.exe
  2⤵
  PID:1956
- C:\Windows\System\bbCdqXP.exe
  C:\Windows\System\bbCdqXP.exe
  2⤵
  PID:2668
- C:\Windows\System\OYaVJjn.exe
  C:\Windows\System\OYaVJjn.exe
  2⤵
  PID:2812
- C:\Windows\System\NbgyLML.exe
  C:\Windows\System\NbgyLML.exe
  2⤵
  PID:2712
- C:\Windows\System\gNaOnja.exe
  C:\Windows\System\gNaOnja.exe
  2⤵
  PID:2628
- C:\Windows\System\DkCzLDU.exe
  C:\Windows\System\DkCzLDU.exe
  2⤵
  PID:712
- C:\Windows\System\mTFSuvK.exe
  C:\Windows\System\mTFSuvK.exe
  2⤵
  PID:2844
- C:\Windows\System\NBiZIyq.exe
  C:\Windows\System\NBiZIyq.exe
  2⤵
  PID:2176
- C:\Windows\System\nJTCAAU.exe
  C:\Windows\System\nJTCAAU.exe
  2⤵
  PID:272
- C:\Windows\System\ncYNiAL.exe
  C:\Windows\System\ncYNiAL.exe
  2⤵
  PID:1364
- C:\Windows\System\AAXtrcV.exe
  C:\Windows\System\AAXtrcV.exe
  2⤵
  PID:1460
- C:\Windows\System\pvnYjwA.exe
  C:\Windows\System\pvnYjwA.exe
  2⤵
  PID:2300
- C:\Windows\System\KIWmXyt.exe
  C:\Windows\System\KIWmXyt.exe
  2⤵
  PID:2944
- C:\Windows\System\BpqAzpY.exe
  C:\Windows\System\BpqAzpY.exe
  2⤵
  PID:1432
- C:\Windows\System\sXwDJLB.exe
  C:\Windows\System\sXwDJLB.exe
  2⤵
  PID:544
- C:\Windows\System\SVeBiWJ.exe
  C:\Windows\System\SVeBiWJ.exe
  2⤵
  PID:1156
- C:\Windows\System\yjPZAJX.exe
  C:\Windows\System\yjPZAJX.exe
  2⤵
  PID:704
- C:\Windows\System\WhWbUaN.exe
  C:\Windows\System\WhWbUaN.exe
  2⤵
  PID:3036
- C:\Windows\System\UTbtmKX.exe
  C:\Windows\System\UTbtmKX.exe
  2⤵
  PID:1720
- C:\Windows\System\GgJZGws.exe
  C:\Windows\System\GgJZGws.exe
  2⤵
  PID:1232
- C:\Windows\System\KZptzua.exe
  C:\Windows\System\KZptzua.exe
  2⤵
  PID:308
- C:\Windows\System\fjUNKJF.exe
  C:\Windows\System\fjUNKJF.exe
  2⤵
  PID:1648
- C:\Windows\System\gOzmVqD.exe
  C:\Windows\System\gOzmVqD.exe
  2⤵
  PID:916
- C:\Windows\System\PXQwrxw.exe
  C:\Windows\System\PXQwrxw.exe
  2⤵
  PID:2136
- C:\Windows\System\wmwnqnJ.exe
  C:\Windows\System\wmwnqnJ.exe
  2⤵
  PID:2012
- C:\Windows\System\NUwvxxD.exe
  C:\Windows\System\NUwvxxD.exe
  2⤵
  PID:996
- C:\Windows\System\inWWVJH.exe
  C:\Windows\System\inWWVJH.exe
  2⤵
  PID:1680
- C:\Windows\System\wqXwWtZ.exe
  C:\Windows\System\wqXwWtZ.exe
  2⤵
  PID:1616
- C:\Windows\System\RNKlbQp.exe
  C:\Windows\System\RNKlbQp.exe
  2⤵
  PID:908
- C:\Windows\System\eKdnyJC.exe
  C:\Windows\System\eKdnyJC.exe
  2⤵
  PID:2464
- C:\Windows\System\lAjtfmL.exe
  C:\Windows\System\lAjtfmL.exe
  2⤵
  PID:1696
- C:\Windows\System\ECujSaW.exe
  C:\Windows\System\ECujSaW.exe
  2⤵
  PID:1656
- C:\Windows\System\SVaLErQ.exe
  C:\Windows\System\SVaLErQ.exe
  2⤵
  PID:2756
- C:\Windows\System\xNSHTgh.exe
  C:\Windows\System\xNSHTgh.exe
  2⤵
  PID:2552
- C:\Windows\System\lotaiSX.exe
  C:\Windows\System\lotaiSX.exe
  2⤵
  PID:2064
- C:\Windows\System\jenESOp.exe
  C:\Windows\System\jenESOp.exe
  2⤵
  PID:2728
- C:\Windows\System\thOQgdr.exe
  C:\Windows\System\thOQgdr.exe
  2⤵
  PID:2556
- C:\Windows\System\XMLvtzM.exe
  C:\Windows\System\XMLvtzM.exe
  2⤵
  PID:2688
- C:\Windows\System\JgzMjqc.exe
  C:\Windows\System\JgzMjqc.exe
  2⤵
  PID:1800
- C:\Windows\System\NnqNCwi.exe
  C:\Windows\System\NnqNCwi.exe
  2⤵
  PID:2360
- C:\Windows\System\mILJqJx.exe
  C:\Windows\System\mILJqJx.exe
  2⤵
  PID:2532
- C:\Windows\System\ZbrFztz.exe
  C:\Windows\System\ZbrFztz.exe
  2⤵
  PID:2616
- C:\Windows\System\GPMpkjg.exe
  C:\Windows\System\GPMpkjg.exe
  2⤵
  PID:400
- C:\Windows\System\LhdnmcM.exe
  C:\Windows\System\LhdnmcM.exe
  2⤵
  PID:2700
- C:\Windows\System\jdWEqoG.exe
  C:\Windows\System\jdWEqoG.exe
  2⤵
  PID:2964
- C:\Windows\System\iuNeMGY.exe
  C:\Windows\System\iuNeMGY.exe
  2⤵
  PID:2652
- C:\Windows\System\GWuVRDL.exe
  C:\Windows\System\GWuVRDL.exe
  2⤵
  PID:2436
- C:\Windows\System\jNawvbm.exe
  C:\Windows\System\jNawvbm.exe
  2⤵
  PID:1248
- C:\Windows\System\QPnBakA.exe
  C:\Windows\System\QPnBakA.exe
  2⤵
  PID:2956
- C:\Windows\System\aTOlpxE.exe
  C:\Windows\System\aTOlpxE.exe
  2⤵
  PID:2028
- C:\Windows\System\uozZdbn.exe
  C:\Windows\System\uozZdbn.exe
  2⤵
  PID:1588
- C:\Windows\System\WpJahbi.exe
  C:\Windows\System\WpJahbi.exe
  2⤵
  PID:1860
- C:\Windows\System\yDepMLI.exe
  C:\Windows\System\yDepMLI.exe
  2⤵
  PID:3056
- C:\Windows\System\VNBQSnZ.exe
  C:\Windows\System\VNBQSnZ.exe
  2⤵
  PID:928
- C:\Windows\System\tLBIxbi.exe
  C:\Windows\System\tLBIxbi.exe
  2⤵
  PID:2664
- C:\Windows\System\IQqydTy.exe
  C:\Windows\System\IQqydTy.exe
  2⤵
  PID:2696
- C:\Windows\System\elzaNRL.exe
  C:\Windows\System\elzaNRL.exe
  2⤵
  PID:2336
- C:\Windows\System\mmsXvKp.exe
  C:\Windows\System\mmsXvKp.exe
  2⤵
  PID:2648
- C:\Windows\System\hVnPhxy.exe
  C:\Windows\System\hVnPhxy.exe
  2⤵
  PID:2484
- C:\Windows\System\VpCcNsL.exe
  C:\Windows\System\VpCcNsL.exe
  2⤵
  PID:1604
- C:\Windows\System\QqqPmDz.exe
  C:\Windows\System\QqqPmDz.exe
  2⤵
  PID:2224
- C:\Windows\System\HqAWtyh.exe
  C:\Windows\System\HqAWtyh.exe
  2⤵
  PID:1964
- C:\Windows\System\Ebvpwrs.exe
  C:\Windows\System\Ebvpwrs.exe
  2⤵
  PID:2912
- C:\Windows\System\BiGExcE.exe
  C:\Windows\System\BiGExcE.exe
  2⤵
  PID:1764
- C:\Windows\System\pEkXyuS.exe
  C:\Windows\System\pEkXyuS.exe
  2⤵
  PID:320
- C:\Windows\System\ySxRXHb.exe
  C:\Windows\System\ySxRXHb.exe
  2⤵
  PID:1948
- C:\Windows\System\BkHrQjl.exe
  C:\Windows\System\BkHrQjl.exe
  2⤵
  PID:2284
- C:\Windows\System\tfVhzNN.exe
  C:\Windows\System\tfVhzNN.exe
  2⤵
  PID:1668
- C:\Windows\System\pwiygtI.exe
  C:\Windows\System\pwiygtI.exe
  2⤵
  PID:2512
- C:\Windows\System\wyQsuOH.exe
  C:\Windows\System\wyQsuOH.exe
  2⤵
  PID:1020
- C:\Windows\System\cPuXEZV.exe
  C:\Windows\System\cPuXEZV.exe
  2⤵
  PID:2860
- C:\Windows\System\RQYdJnU.exe
  C:\Windows\System\RQYdJnU.exe
  2⤵
  PID:2424
- C:\Windows\System\SthAeSF.exe
  C:\Windows\System\SthAeSF.exe
  2⤵
  PID:2748
- C:\Windows\System\QgXbEey.exe
  C:\Windows\System\QgXbEey.exe
  2⤵
  PID:2736
- C:\Windows\System\GiWBXQN.exe
  C:\Windows\System\GiWBXQN.exe
  2⤵
  PID:1728
- C:\Windows\System\DCnBqiQ.exe
  C:\Windows\System\DCnBqiQ.exe
  2⤵
  PID:776
- C:\Windows\System\atdJQAq.exe
  C:\Windows\System\atdJQAq.exe
  2⤵
  PID:2896
- C:\Windows\System\JAPdDub.exe
  C:\Windows\System\JAPdDub.exe
  2⤵
  PID:608
- C:\Windows\System\ieGmyXx.exe
  C:\Windows\System\ieGmyXx.exe
  2⤵
  PID:2420
- C:\Windows\System\mqHRFnq.exe
  C:\Windows\System\mqHRFnq.exe
  2⤵
  PID:836
- C:\Windows\System\fQeYCSe.exe
  C:\Windows\System\fQeYCSe.exe
  2⤵
  PID:1888
- C:\Windows\System\pyfJaTU.exe
  C:\Windows\System\pyfJaTU.exe
  2⤵
  PID:1380
- C:\Windows\System\zcrHnto.exe
  C:\Windows\System\zcrHnto.exe
  2⤵
  PID:2148
- C:\Windows\System\gLhHsrZ.exe
  C:\Windows\System\gLhHsrZ.exe
  2⤵
  PID:2940
- C:\Windows\System\mfQkyKs.exe
  C:\Windows\System\mfQkyKs.exe
  2⤵
  PID:1032
- C:\Windows\System\sOcnjUn.exe
  C:\Windows\System\sOcnjUn.exe
  2⤵
  PID:2868
- C:\Windows\System\PLWFkFt.exe
  C:\Windows\System\PLWFkFt.exe
  2⤵
  PID:1376
- C:\Windows\System\bSIhiZA.exe
  C:\Windows\System\bSIhiZA.exe
  2⤵
  PID:1532
- C:\Windows\System\PaXUokB.exe
  C:\Windows\System\PaXUokB.exe
  2⤵
  PID:2088
- C:\Windows\System\SUUvjqw.exe
  C:\Windows\System\SUUvjqw.exe
  2⤵
  PID:1420
- C:\Windows\System\zrYDElD.exe
  C:\Windows\System\zrYDElD.exe
  2⤵
  PID:284
- C:\Windows\System\IhGxMWa.exe
  C:\Windows\System\IhGxMWa.exe
  2⤵
  PID:3088
- C:\Windows\System\SEXLpuZ.exe
  C:\Windows\System\SEXLpuZ.exe
  2⤵
  PID:3104
- C:\Windows\System\vszIcYu.exe
  C:\Windows\System\vszIcYu.exe
  2⤵
  PID:3120
- C:\Windows\System\BOrMpLG.exe
  C:\Windows\System\BOrMpLG.exe
  2⤵
  PID:3136
- C:\Windows\System\GUPAQfH.exe
  C:\Windows\System\GUPAQfH.exe
  2⤵
  PID:3152
- C:\Windows\System\KwdFSRc.exe
  C:\Windows\System\KwdFSRc.exe
  2⤵
  PID:3168
- C:\Windows\System\TOEWRzw.exe
  C:\Windows\System\TOEWRzw.exe
  2⤵
  PID:3188
- C:\Windows\System\AQxHXmZ.exe
  C:\Windows\System\AQxHXmZ.exe
  2⤵
  PID:3204
- C:\Windows\System\kWREgdj.exe
  C:\Windows\System\kWREgdj.exe
  2⤵
  PID:3220
- C:\Windows\System\sEigHMW.exe
  C:\Windows\System\sEigHMW.exe
  2⤵
  PID:3236
- C:\Windows\System\PesLdiP.exe
  C:\Windows\System\PesLdiP.exe
  2⤵
  PID:3252
- C:\Windows\System\eyScdIe.exe
  C:\Windows\System\eyScdIe.exe
  2⤵
  PID:3272
- C:\Windows\System\gsvhgBM.exe
  C:\Windows\System\gsvhgBM.exe
  2⤵
  PID:3288
- C:\Windows\System\TVaEYGF.exe
  C:\Windows\System\TVaEYGF.exe
  2⤵
  PID:3308
- C:\Windows\System\MSWQbko.exe
  C:\Windows\System\MSWQbko.exe
  2⤵
  PID:3324
- C:\Windows\System\WiTdEkG.exe
  C:\Windows\System\WiTdEkG.exe
  2⤵
  PID:3344
- C:\Windows\System\ovfOJZj.exe
  C:\Windows\System\ovfOJZj.exe
  2⤵
  PID:3360
- C:\Windows\System\uUfSftq.exe
  C:\Windows\System\uUfSftq.exe
  2⤵
  PID:3376
- C:\Windows\System\xCjBMZo.exe
  C:\Windows\System\xCjBMZo.exe
  2⤵
  PID:3392
- C:\Windows\System\qVoRjPU.exe
  C:\Windows\System\qVoRjPU.exe
  2⤵
  PID:3412
- C:\Windows\System\hYEtlyF.exe
  C:\Windows\System\hYEtlyF.exe
  2⤵
  PID:3428
- C:\Windows\System\lzqnSFH.exe
  C:\Windows\System\lzqnSFH.exe
  2⤵
  PID:3444
- C:\Windows\System\kPeyfNF.exe
  C:\Windows\System\kPeyfNF.exe
  2⤵
  PID:3460
- C:\Windows\System\HsVTrGA.exe
  C:\Windows\System\HsVTrGA.exe
  2⤵
  PID:3480
- C:\Windows\System\AEdVtSA.exe
  C:\Windows\System\AEdVtSA.exe
  2⤵
  PID:3588
- C:\Windows\System\GGVpRJv.exe
  C:\Windows\System\GGVpRJv.exe
  2⤵
  PID:3604
- C:\Windows\System\XfdVQyU.exe
  C:\Windows\System\XfdVQyU.exe
  2⤵
  PID:3620
- C:\Windows\System\ququlNe.exe
  C:\Windows\System\ququlNe.exe
  2⤵
  PID:3636
- C:\Windows\System\gKCapvH.exe
  C:\Windows\System\gKCapvH.exe
  2⤵
  PID:3656
- C:\Windows\System\UFYtHkU.exe
  C:\Windows\System\UFYtHkU.exe
  2⤵
  PID:3676
- C:\Windows\System\ETkAvFL.exe
  C:\Windows\System\ETkAvFL.exe
  2⤵
  PID:3692
- C:\Windows\System\HuytvKk.exe
  C:\Windows\System\HuytvKk.exe
  2⤵
  PID:3708
- C:\Windows\System\ALjIQDG.exe
  C:\Windows\System\ALjIQDG.exe
  2⤵
  PID:3724
- C:\Windows\System\HHAPcsm.exe
  C:\Windows\System\HHAPcsm.exe
  2⤵
  PID:3740
- C:\Windows\System\KtvBqrM.exe
  C:\Windows\System\KtvBqrM.exe
  2⤵
  PID:3756
- C:\Windows\System\lJrEZiM.exe
  C:\Windows\System\lJrEZiM.exe
  2⤵
  PID:3776
- C:\Windows\System\ZCHryXS.exe
  C:\Windows\System\ZCHryXS.exe
  2⤵
  PID:3792
- C:\Windows\System\diSwhkC.exe
  C:\Windows\System\diSwhkC.exe
  2⤵
  PID:3808
- C:\Windows\System\zRxGheJ.exe
  C:\Windows\System\zRxGheJ.exe
  2⤵
  PID:3824
- C:\Windows\System\MTNbKfP.exe
  C:\Windows\System\MTNbKfP.exe
  2⤵
  PID:3840
- C:\Windows\System\EnaurxE.exe
  C:\Windows\System\EnaurxE.exe
  2⤵
  PID:3856
- C:\Windows\System\yoKOxmo.exe
  C:\Windows\System\yoKOxmo.exe
  2⤵
  PID:3872
- C:\Windows\System\hHIsbCP.exe
  C:\Windows\System\hHIsbCP.exe
  2⤵
  PID:3892
- C:\Windows\System\ICDuWKp.exe
  C:\Windows\System\ICDuWKp.exe
  2⤵
  PID:3908
- C:\Windows\System\wQYEMVx.exe
  C:\Windows\System\wQYEMVx.exe
  2⤵
  PID:3924
- C:\Windows\System\xPJZLKP.exe
  C:\Windows\System\xPJZLKP.exe
  2⤵
  PID:3940
- C:\Windows\System\kXavbKA.exe
  C:\Windows\System\kXavbKA.exe
  2⤵
  PID:3960
- C:\Windows\System\MfDLivZ.exe
  C:\Windows\System\MfDLivZ.exe
  2⤵
  PID:3976
- C:\Windows\System\XKezmli.exe
  C:\Windows\System\XKezmli.exe
  2⤵
  PID:3992
- C:\Windows\System\cCUKNEh.exe
  C:\Windows\System\cCUKNEh.exe
  2⤵
  PID:4008
- C:\Windows\System\eBRmvnd.exe
  C:\Windows\System\eBRmvnd.exe
  2⤵
  PID:4024
- C:\Windows\System\qhjvvEi.exe
  C:\Windows\System\qhjvvEi.exe
  2⤵
  PID:4040
- C:\Windows\System\eayvvlj.exe
  C:\Windows\System\eayvvlj.exe
  2⤵
  PID:4060
- C:\Windows\System\QXLKzDh.exe
  C:\Windows\System\QXLKzDh.exe
  2⤵
  PID:4076
- C:\Windows\System\vkRNZaQ.exe
  C:\Windows\System\vkRNZaQ.exe
  2⤵
  PID:4092
- C:\Windows\System\QHEoiMU.exe
  C:\Windows\System\QHEoiMU.exe
  2⤵
  PID:2020
- C:\Windows\System\sGljiAg.exe
  C:\Windows\System\sGljiAg.exe
  2⤵
  PID:896
- C:\Windows\System\UGfMRUw.exe
  C:\Windows\System\UGfMRUw.exe
  2⤵
  PID:1880
- C:\Windows\System\CjzgOuG.exe
  C:\Windows\System\CjzgOuG.exe
  2⤵
  PID:976
- C:\Windows\System\swhCvms.exe
  C:\Windows\System\swhCvms.exe
  2⤵
  PID:3280
- C:\Windows\System\YvLtzhR.exe
  C:\Windows\System\YvLtzhR.exe
  2⤵
  PID:3132
- C:\Windows\System\znNRits.exe
  C:\Windows\System\znNRits.exe
  2⤵
  PID:3164
- C:\Windows\System\FpoQKCW.exe
  C:\Windows\System\FpoQKCW.exe
  2⤵
  PID:3232
- C:\Windows\System\HtEzugS.exe
  C:\Windows\System\HtEzugS.exe
  2⤵
  PID:3296
- C:\Windows\System\fhlzHIg.exe
  C:\Windows\System\fhlzHIg.exe
  2⤵
  PID:3244
- C:\Windows\System\NTLBwCH.exe
  C:\Windows\System\NTLBwCH.exe
  2⤵
  PID:3332
- C:\Windows\System\IdfEcXe.exe
  C:\Windows\System\IdfEcXe.exe
  2⤵
  PID:3116
- C:\Windows\System\bwvkUKr.exe
  C:\Windows\System\bwvkUKr.exe
  2⤵
  PID:3580
- C:\Windows\System\oZFwwFT.exe
  C:\Windows\System\oZFwwFT.exe
  2⤵
  PID:1572
- C:\Windows\System\XKfCDTT.exe
  C:\Windows\System\XKfCDTT.exe
  2⤵
  PID:3716
- C:\Windows\System\kQFmnFd.exe
  C:\Windows\System\kQFmnFd.exe
  2⤵
  PID:3468
- C:\Windows\System\MNvHNCC.exe
  C:\Windows\System\MNvHNCC.exe
  2⤵
  PID:3600
- C:\Windows\System\kelhuhz.exe
  C:\Windows\System\kelhuhz.exe
  2⤵
  PID:3672
- C:\Windows\System\uTCNrOj.exe
  C:\Windows\System\uTCNrOj.exe
  2⤵
  PID:3736
- C:\Windows\System\xpHDkuy.exe
  C:\Windows\System\xpHDkuy.exe
  2⤵
  PID:3772
- C:\Windows\System\eDMZksa.exe
  C:\Windows\System\eDMZksa.exe
  2⤵
  PID:3836
- C:\Windows\System\gQGcpvV.exe
  C:\Windows\System\gQGcpvV.exe
  2⤵
  PID:3900
- C:\Windows\System\pRrqHUk.exe
  C:\Windows\System\pRrqHUk.exe
  2⤵
  PID:3972
- C:\Windows\System\NaMYAdm.exe
  C:\Windows\System\NaMYAdm.exe
  2⤵
  PID:3848
- C:\Windows\System\bMhGWaj.exe
  C:\Windows\System\bMhGWaj.exe
  2⤵
  PID:3916
- C:\Windows\System\jwgrhUg.exe
  C:\Windows\System\jwgrhUg.exe
  2⤵
  PID:3752
- C:\Windows\System\IbUJtww.exe
  C:\Windows\System\IbUJtww.exe
  2⤵
  PID:328
- C:\Windows\System\kMuwLck.exe
  C:\Windows\System\kMuwLck.exe
  2⤵
  PID:1992
- C:\Windows\System\fQhGfmX.exe
  C:\Windows\System\fQhGfmX.exe
  2⤵
  PID:3884
- C:\Windows\System\XIkuXiI.exe
  C:\Windows\System\XIkuXiI.exe
  2⤵
  PID:3952
- C:\Windows\System\cCVttbx.exe
  C:\Windows\System\cCVttbx.exe
  2⤵
  PID:4020
- C:\Windows\System\aWxAWfI.exe
  C:\Windows\System\aWxAWfI.exe
  2⤵
  PID:2832
- C:\Windows\System\DXtrjmk.exe
  C:\Windows\System\DXtrjmk.exe
  2⤵
  PID:2984
- C:\Windows\System\uAVtKcM.exe
  C:\Windows\System\uAVtKcM.exe
  2⤵
  PID:3228
- C:\Windows\System\ygQtnwj.exe
  C:\Windows\System\ygQtnwj.exe
  2⤵
  PID:3112
- C:\Windows\System\BPWuoge.exe
  C:\Windows\System\BPWuoge.exe
  2⤵
  PID:4072
- C:\Windows\System\bxOaBJs.exe
  C:\Windows\System\bxOaBJs.exe
  2⤵
  PID:2412
- C:\Windows\System\ySzmvbL.exe
  C:\Windows\System\ySzmvbL.exe
  2⤵
  PID:3304
- C:\Windows\System\ZsizgXZ.exe
  C:\Windows\System\ZsizgXZ.exe
  2⤵
  PID:3284
- C:\Windows\System\NzrlIKG.exe
  C:\Windows\System\NzrlIKG.exe
  2⤵
  PID:3316
- C:\Windows\System\jWfboEe.exe
  C:\Windows\System\jWfboEe.exe
  2⤵
  PID:3384
- C:\Windows\System\SQkQLlz.exe
  C:\Windows\System\SQkQLlz.exe
  2⤵
  PID:3456
- C:\Windows\System\KFboTQW.exe
  C:\Windows\System\KFboTQW.exe
  2⤵
  PID:3512
- C:\Windows\System\FzLLWMV.exe
  C:\Windows\System\FzLLWMV.exe
  2⤵
  PID:3544
- C:\Windows\System\UrnInyq.exe
  C:\Windows\System\UrnInyq.exe
  2⤵
  PID:3556
- C:\Windows\System\qIzVSXR.exe
  C:\Windows\System\qIzVSXR.exe
  2⤵
  PID:3572
- C:\Windows\System\GTCkDvt.exe
  C:\Windows\System\GTCkDvt.exe
  2⤵
  PID:3372
- C:\Windows\System\fRIZHOQ.exe
  C:\Windows\System\fRIZHOQ.exe
  2⤵
  PID:1304
- C:\Windows\System\IPCKWfw.exe
  C:\Windows\System\IPCKWfw.exe
  2⤵
  PID:3408
- C:\Windows\System\VbvTvKN.exe
  C:\Windows\System\VbvTvKN.exe
  2⤵
  PID:4056
- C:\Windows\System\FzucjRG.exe
  C:\Windows\System\FzucjRG.exe
  2⤵
  PID:4104
- C:\Windows\System\mVJzrxG.exe
  C:\Windows\System\mVJzrxG.exe
  2⤵
  PID:4120
- C:\Windows\System\PdPKOxM.exe
  C:\Windows\System\PdPKOxM.exe
  2⤵
  PID:4136
- C:\Windows\System\JXmHuWb.exe
  C:\Windows\System\JXmHuWb.exe
  2⤵
  PID:4156
- C:\Windows\System\ZnDoqBk.exe
  C:\Windows\System\ZnDoqBk.exe
  2⤵
  PID:4172
- C:\Windows\System\iPcESBP.exe
  C:\Windows\System\iPcESBP.exe
  2⤵
  PID:4188
- C:\Windows\System\wStVwzg.exe
  C:\Windows\System\wStVwzg.exe
  2⤵
  PID:4204
- C:\Windows\System\ydxuzgB.exe
  C:\Windows\System\ydxuzgB.exe
  2⤵
  PID:4220
- C:\Windows\System\hLqLAOK.exe
  C:\Windows\System\hLqLAOK.exe
  2⤵
  PID:4236
- C:\Windows\System\jAJepRf.exe
  C:\Windows\System\jAJepRf.exe
  2⤵
  PID:4252
- C:\Windows\System\JNQAIMS.exe
  C:\Windows\System\JNQAIMS.exe
  2⤵
  PID:4272
- C:\Windows\System\KDHVMyv.exe
  C:\Windows\System\KDHVMyv.exe
  2⤵
  PID:4288
- C:\Windows\System\zMlzHFD.exe
  C:\Windows\System\zMlzHFD.exe
  2⤵
  PID:4304
- C:\Windows\System\odCdYoO.exe
  C:\Windows\System\odCdYoO.exe
  2⤵
  PID:4324
- C:\Windows\System\lcuAncY.exe
  C:\Windows\System\lcuAncY.exe
  2⤵
  PID:4340
- C:\Windows\System\vFpMNPc.exe
  C:\Windows\System\vFpMNPc.exe
  2⤵
  PID:4356
- C:\Windows\System\soKMFoh.exe
  C:\Windows\System\soKMFoh.exe
  2⤵
  PID:4372
- C:\Windows\System\Bzvkvkg.exe
  C:\Windows\System\Bzvkvkg.exe
  2⤵
  PID:4392
- C:\Windows\System\jSnAoRA.exe
  C:\Windows\System\jSnAoRA.exe
  2⤵
  PID:4408
- C:\Windows\System\teTUOOp.exe
  C:\Windows\System\teTUOOp.exe
  2⤵
  PID:4424
- C:\Windows\System\ffAEFyL.exe
  C:\Windows\System\ffAEFyL.exe
  2⤵
  PID:4440
- C:\Windows\System\oKTCtUD.exe
  C:\Windows\System\oKTCtUD.exe
  2⤵
  PID:4456
- C:\Windows\System\VZySSkG.exe
  C:\Windows\System\VZySSkG.exe
  2⤵
  PID:4472
- C:\Windows\System\ERYDbdo.exe
  C:\Windows\System\ERYDbdo.exe
  2⤵
  PID:4488
- C:\Windows\System\PDbJLxm.exe
  C:\Windows\System\PDbJLxm.exe
  2⤵
  PID:4508
- C:\Windows\System\VnAYnWK.exe
  C:\Windows\System\VnAYnWK.exe
  2⤵
  PID:4524
- C:\Windows\System\Auvlggu.exe
  C:\Windows\System\Auvlggu.exe
  2⤵
  PID:4540
- C:\Windows\System\yJlUwnH.exe
  C:\Windows\System\yJlUwnH.exe
  2⤵
  PID:4556
- C:\Windows\System\kKlxSeG.exe
  C:\Windows\System\kKlxSeG.exe
  2⤵
  PID:4572
- C:\Windows\System\bhOzFdb.exe
  C:\Windows\System\bhOzFdb.exe
  2⤵
  PID:4592
- C:\Windows\System\cxiuvzz.exe
  C:\Windows\System\cxiuvzz.exe
  2⤵
  PID:4608
- C:\Windows\System\KeiQNUB.exe
  C:\Windows\System\KeiQNUB.exe
  2⤵
  PID:4624
- C:\Windows\System\ynFLbOi.exe
  C:\Windows\System\ynFLbOi.exe
  2⤵
  PID:4640
- C:\Windows\System\OXXeFpx.exe
  C:\Windows\System\OXXeFpx.exe
  2⤵
  PID:4656
- C:\Windows\System\QtSoUdL.exe
  C:\Windows\System\QtSoUdL.exe
  2⤵
  PID:4672
- C:\Windows\System\RFHiQYW.exe
  C:\Windows\System\RFHiQYW.exe
  2⤵
  PID:4796
- C:\Windows\System\XmJEqpa.exe
  C:\Windows\System\XmJEqpa.exe
  2⤵
  PID:4900
- C:\Windows\System\BWmulhK.exe
  C:\Windows\System\BWmulhK.exe
  2⤵
  PID:4928
- C:\Windows\System\FEEdnLI.exe
  C:\Windows\System\FEEdnLI.exe
  2⤵
  PID:4948
- C:\Windows\System\BagcyJe.exe
  C:\Windows\System\BagcyJe.exe
  2⤵
  PID:4972
- C:\Windows\System\knYRAZs.exe
  C:\Windows\System\knYRAZs.exe
  2⤵
  PID:4992
- C:\Windows\System\sIiVBEQ.exe
  C:\Windows\System\sIiVBEQ.exe
  2⤵
  PID:5008
- C:\Windows\System\UzVVrPj.exe
  C:\Windows\System\UzVVrPj.exe
  2⤵
  PID:5080
- C:\Windows\System\yvRZSCS.exe
  C:\Windows\System\yvRZSCS.exe
  2⤵
  PID:5096
- C:\Windows\System\CKXxekz.exe
  C:\Windows\System\CKXxekz.exe
  2⤵
  PID:5116
- C:\Windows\System\iGgcGPd.exe
  C:\Windows\System\iGgcGPd.exe
  2⤵
  PID:3200
- C:\Windows\System\BjvzexA.exe
  C:\Windows\System\BjvzexA.exe
  2⤵
  PID:2996
- C:\Windows\System\GfYvvJd.exe
  C:\Windows\System\GfYvvJd.exe
  2⤵
  PID:3452
- C:\Windows\System\ADaSFBS.exe
  C:\Windows\System\ADaSFBS.exe
  2⤵
  PID:3732
- C:\Windows\System\xWhFXzc.exe
  C:\Windows\System\xWhFXzc.exe
  2⤵
  PID:3648
- C:\Windows\System\OZmiFjs.exe
  C:\Windows\System\OZmiFjs.exe
  2⤵
  PID:3868
- C:\Windows\System\TkOBEgD.exe
  C:\Windows\System\TkOBEgD.exe
  2⤵
  PID:4016
- C:\Windows\System\gxygjmm.exe
  C:\Windows\System\gxygjmm.exe
  2⤵
  PID:3632
- C:\Windows\System\JIqQZEH.exe
  C:\Windows\System\JIqQZEH.exe
  2⤵
  PID:3788
- C:\Windows\System\WrKQIyf.exe
  C:\Windows\System\WrKQIyf.exe
  2⤵
  PID:3988
- C:\Windows\System\rmxiDMy.exe
  C:\Windows\System\rmxiDMy.exe
  2⤵
  PID:4180
- C:\Windows\System\fSxbLVw.exe
  C:\Windows\System\fSxbLVw.exe
  2⤵
  PID:4148
- C:\Windows\System\VrFYEVD.exe
  C:\Windows\System\VrFYEVD.exe
  2⤵
  PID:4168
- C:\Windows\System\CSDilMG.exe
  C:\Windows\System\CSDilMG.exe
  2⤵
  PID:4280
- C:\Windows\System\HUgqNDj.exe
  C:\Windows\System\HUgqNDj.exe
  2⤵
  PID:3504
- C:\Windows\System\UqwYEpw.exe
  C:\Windows\System\UqwYEpw.exe
  2⤵
  PID:3668
- C:\Windows\System\CYvAypi.exe
  C:\Windows\System\CYvAypi.exe
  2⤵
  PID:4228
- C:\Windows\System\hmAlwQJ.exe
  C:\Windows\System\hmAlwQJ.exe
  2⤵
  PID:4348
- C:\Windows\System\cYjikqb.exe
  C:\Windows\System\cYjikqb.exe
  2⤵
  PID:4400
- C:\Windows\System\SPFOeaW.exe
  C:\Windows\System\SPFOeaW.exe
  2⤵
  PID:4536
- C:\Windows\System\FqMGGls.exe
  C:\Windows\System\FqMGGls.exe
  2⤵
  PID:4368
- C:\Windows\System\BZHXWSs.exe
  C:\Windows\System\BZHXWSs.exe
  2⤵
  PID:4580
- C:\Windows\System\dgxkfYv.exe
  C:\Windows\System\dgxkfYv.exe
  2⤵
  PID:4384
- C:\Windows\System\WGSbvwU.exe
  C:\Windows\System\WGSbvwU.exe
  2⤵
  PID:2808
- C:\Windows\System\czWWatP.exe
  C:\Windows\System\czWWatP.exe
  2⤵
  PID:4584
- C:\Windows\System\zTxhYPP.exe
  C:\Windows\System\zTxhYPP.exe
  2⤵
  PID:4680
- C:\Windows\System\nRHiUUu.exe
  C:\Windows\System\nRHiUUu.exe
  2⤵
  PID:4664
- C:\Windows\System\hFQaeeV.exe
  C:\Windows\System\hFQaeeV.exe
  2⤵
  PID:2524
- C:\Windows\System\dRyRaqA.exe
  C:\Windows\System\dRyRaqA.exe
  2⤵
  PID:4748
- C:\Windows\System\jARvOGO.exe
  C:\Windows\System\jARvOGO.exe
  2⤵
  PID:4768
- C:\Windows\System\ALVtrwj.exe
  C:\Windows\System\ALVtrwj.exe
  2⤵
  PID:4780
- C:\Windows\System\aMpvdal.exe
  C:\Windows\System\aMpvdal.exe
  2⤵
  PID:4828
- C:\Windows\System\nfGDkbp.exe
  C:\Windows\System\nfGDkbp.exe
  2⤵
  PID:4844
- C:\Windows\System\vbfEsnI.exe
  C:\Windows\System\vbfEsnI.exe
  2⤵
  PID:4864
- C:\Windows\System\kdsicsi.exe
  C:\Windows\System\kdsicsi.exe
  2⤵
  PID:4908
- C:\Windows\System\IrseGPY.exe
  C:\Windows\System\IrseGPY.exe
  2⤵
  PID:4880
- C:\Windows\System\gkcToXF.exe
  C:\Windows\System\gkcToXF.exe
  2⤵
  PID:4924
- C:\Windows\System\ezxnZrr.exe
  C:\Windows\System\ezxnZrr.exe
  2⤵
  PID:4940
- C:\Windows\System\sDVfNOQ.exe
  C:\Windows\System\sDVfNOQ.exe
  2⤵
  PID:4980
- C:\Windows\System\UdIbQoR.exe
  C:\Windows\System\UdIbQoR.exe
  2⤵
  PID:2976
- C:\Windows\System\pLpytAB.exe
  C:\Windows\System\pLpytAB.exe
  2⤵
  PID:5040
- C:\Windows\System\XLZBZgx.exe
  C:\Windows\System\XLZBZgx.exe
  2⤵
  PID:5052
- C:\Windows\System\wUazPDN.exe
  C:\Windows\System\wUazPDN.exe
  2⤵
  PID:5068
- C:\Windows\System\LuHmTlb.exe
  C:\Windows\System\LuHmTlb.exe
  2⤵
  PID:1580
- C:\Windows\System\TsXjopt.exe
  C:\Windows\System\TsXjopt.exe
  2⤵
  PID:2452
- C:\Windows\System\DZzTovO.exe
  C:\Windows\System\DZzTovO.exe
  2⤵
  PID:4152
- C:\Windows\System\OSnWukH.exe
  C:\Windows\System\OSnWukH.exe
  2⤵
  PID:3564
- C:\Windows\System\qQOcwpF.exe
  C:\Windows\System\qQOcwpF.exe
  2⤵
  PID:4388
- C:\Windows\System\JjiZMjn.exe
  C:\Windows\System\JjiZMjn.exe
  2⤵
  PID:4320
- C:\Windows\System\RfTMfjU.exe
  C:\Windows\System\RfTMfjU.exe
  2⤵
  PID:3768
- C:\Windows\System\XPWzFNc.exe
  C:\Windows\System\XPWzFNc.exe
  2⤵
  PID:4684
- C:\Windows\System\NDEuwkC.exe
  C:\Windows\System\NDEuwkC.exe
  2⤵
  PID:4688
- C:\Windows\System\NHdfNJQ.exe
  C:\Windows\System\NHdfNJQ.exe
  2⤵
  PID:3084
- C:\Windows\System\pykDIlO.exe
  C:\Windows\System\pykDIlO.exe
  2⤵
  PID:4872
- C:\Windows\System\uxJjKKC.exe
  C:\Windows\System\uxJjKKC.exe
  2⤵
  PID:4216
- C:\Windows\System\uCtcniR.exe
  C:\Windows\System\uCtcniR.exe
  2⤵
  PID:4232
- C:\Windows\System\bWkUvWf.exe
  C:\Windows\System\bWkUvWf.exe
  2⤵
  PID:3404
- C:\Windows\System\HmhnClV.exe
  C:\Windows\System\HmhnClV.exe
  2⤵
  PID:4260
- C:\Windows\System\ukVzcEe.exe
  C:\Windows\System\ukVzcEe.exe
  2⤵
  PID:4296
- C:\Windows\System\XOQOTkt.exe
  C:\Windows\System\XOQOTkt.exe
  2⤵
  PID:4500
- C:\Windows\System\IXlZRTf.exe
  C:\Windows\System\IXlZRTf.exe
  2⤵
  PID:4404
- C:\Windows\System\nriYrCU.exe
  C:\Windows\System\nriYrCU.exe
  2⤵
  PID:4316
- C:\Windows\System\GMAzBWj.exe
  C:\Windows\System\GMAzBWj.exe
  2⤵
  PID:4636
- C:\Windows\System\qpWNVOI.exe
  C:\Windows\System\qpWNVOI.exe
  2⤵
  PID:4648
- C:\Windows\System\spikeGT.exe
  C:\Windows\System\spikeGT.exe
  2⤵
  PID:4744
- C:\Windows\System\LZeCQBg.exe
  C:\Windows\System\LZeCQBg.exe
  2⤵
  PID:4756
- C:\Windows\System\RWHdRfM.exe
  C:\Windows\System\RWHdRfM.exe
  2⤵
  PID:4884
- C:\Windows\System\wGINQRJ.exe
  C:\Windows\System\wGINQRJ.exe
  2⤵
  PID:4964
- C:\Windows\System\cGtgJRZ.exe
  C:\Windows\System\cGtgJRZ.exe
  2⤵
  PID:4956
- C:\Windows\System\nkikvIp.exe
  C:\Windows\System\nkikvIp.exe
  2⤵
  PID:4936
- C:\Windows\System\eszDMxa.exe
  C:\Windows\System\eszDMxa.exe
  2⤵
  PID:5016
- C:\Windows\System\rEzkEWS.exe
  C:\Windows\System\rEzkEWS.exe
  2⤵
  PID:3216
- C:\Windows\System\zFRgApa.exe
  C:\Windows\System\zFRgApa.exe
  2⤵
  PID:3080
- C:\Windows\System\PSGIGzQ.exe
  C:\Windows\System\PSGIGzQ.exe
  2⤵
  PID:5044
- C:\Windows\System\SctZoWe.exe
  C:\Windows\System\SctZoWe.exe
  2⤵
  PID:4856
- C:\Windows\System\CUbanpk.exe
  C:\Windows\System\CUbanpk.exe
  2⤵
  PID:5076
- C:\Windows\System\pZxYMnM.exe
  C:\Windows\System\pZxYMnM.exe
  2⤵
  PID:1952
- C:\Windows\System\rEqMPNX.exe
  C:\Windows\System\rEqMPNX.exe
  2⤵
  PID:3956
- C:\Windows\System\USCSuLw.exe
  C:\Windows\System\USCSuLw.exe
  2⤵
  PID:3500
- C:\Windows\System\jzPmXwW.exe
  C:\Windows\System\jzPmXwW.exe
  2⤵
  PID:4332
- C:\Windows\System\LINVxSs.exe
  C:\Windows\System\LINVxSs.exe
  2⤵
  PID:4380
- C:\Windows\System\iDvfWdp.exe
  C:\Windows\System\iDvfWdp.exe
  2⤵
  PID:4532
- C:\Windows\System\XkbKKoz.exe
  C:\Windows\System\XkbKKoz.exe
  2⤵
  PID:4820
- C:\Windows\System\uTAuNxr.exe
  C:\Windows\System\uTAuNxr.exe
  2⤵
  PID:5104
- C:\Windows\System\QNBLrhX.exe
  C:\Windows\System\QNBLrhX.exe
  2⤵
  PID:4600
- C:\Windows\System\pdmBOdV.exe
  C:\Windows\System\pdmBOdV.exe
  2⤵
  PID:3356
- C:\Windows\System\vGSFeiA.exe
  C:\Windows\System\vGSFeiA.exe
  2⤵
  PID:4052
- C:\Windows\System\TOzNAbs.exe
  C:\Windows\System\TOzNAbs.exe
  2⤵
  PID:2448
- C:\Windows\System\jfAxifh.exe
  C:\Windows\System\jfAxifh.exe
  2⤵
  PID:3436
- C:\Windows\System\oentbry.exe
  C:\Windows\System\oentbry.exe
  2⤵
  PID:2900
- C:\Windows\System\bZVHSex.exe
  C:\Windows\System\bZVHSex.exe
  2⤵
  PID:4960
- C:\Windows\System\bPqNmsh.exe
  C:\Windows\System\bPqNmsh.exe
  2⤵
  PID:1744
- C:\Windows\System\gtVndjt.exe
  C:\Windows\System\gtVndjt.exe
  2⤵
  PID:4808
- C:\Windows\System\LTRXJyV.exe
  C:\Windows\System\LTRXJyV.exe
  2⤵
  PID:1640
- C:\Windows\System\dtBtlCP.exe
  C:\Windows\System\dtBtlCP.exe
  2⤵
  PID:4112
- C:\Windows\System\lBPSOsC.exe
  C:\Windows\System\lBPSOsC.exe
  2⤵
  PID:2784
- C:\Windows\System\RFqONAu.exe
  C:\Windows\System\RFqONAu.exe
  2⤵
  PID:4312
- C:\Windows\System\JZBurjr.exe
  C:\Windows\System\JZBurjr.exe
  2⤵
  PID:4452
- C:\Windows\System\sAHlwYy.exe
  C:\Windows\System\sAHlwYy.exe
  2⤵
  PID:4840
- C:\Windows\System\ZaGxnkB.exe
  C:\Windows\System\ZaGxnkB.exe
  2⤵
  PID:4812
- C:\Windows\System\Qgvtiya.exe
  C:\Windows\System\Qgvtiya.exe
  2⤵
  PID:4516
- C:\Windows\System\HxyIjKv.exe
  C:\Windows\System\HxyIjKv.exe
  2⤵
  PID:3920
- C:\Windows\System\GfMgZHU.exe
  C:\Windows\System\GfMgZHU.exe
  2⤵
  PID:4620
- C:\Windows\System\hROxhlf.exe
  C:\Windows\System\hROxhlf.exe
  2⤵
  PID:2528
- C:\Windows\System\AsYqZKc.exe
  C:\Windows\System\AsYqZKc.exe
  2⤵
  PID:5136
- C:\Windows\System\qkWzDQP.exe
  C:\Windows\System\qkWzDQP.exe
  2⤵
  PID:5152
- C:\Windows\System\zYwlcEc.exe
  C:\Windows\System\zYwlcEc.exe
  2⤵
  PID:5168
- C:\Windows\System\GOvoEIS.exe
  C:\Windows\System\GOvoEIS.exe
  2⤵
  PID:5188
- C:\Windows\System\uPQJQdg.exe
  C:\Windows\System\uPQJQdg.exe
  2⤵
  PID:5204
- C:\Windows\System\lPuqldQ.exe
  C:\Windows\System\lPuqldQ.exe
  2⤵
  PID:5220
- C:\Windows\System\OZOoSav.exe
  C:\Windows\System\OZOoSav.exe
  2⤵
  PID:5236
- C:\Windows\System\FIEqxTP.exe
  C:\Windows\System\FIEqxTP.exe
  2⤵
  PID:5252
- C:\Windows\System\mNCIUvR.exe
  C:\Windows\System\mNCIUvR.exe
  2⤵
  PID:5272
- C:\Windows\System\TTVdBUA.exe
  C:\Windows\System\TTVdBUA.exe
  2⤵
  PID:5288
- C:\Windows\System\jrOzZrV.exe
  C:\Windows\System\jrOzZrV.exe
  2⤵
  PID:5304
- C:\Windows\System\nPbKlEY.exe
  C:\Windows\System\nPbKlEY.exe
  2⤵
  PID:5320
- C:\Windows\System\cxZsgJq.exe
  C:\Windows\System\cxZsgJq.exe
  2⤵
  PID:5344
- C:\Windows\System\FsVopzS.exe
  C:\Windows\System\FsVopzS.exe
  2⤵
  PID:5360
- C:\Windows\System\UnRLLof.exe
  C:\Windows\System\UnRLLof.exe
  2⤵
  PID:5376
- C:\Windows\System\mrXsmgv.exe
  C:\Windows\System\mrXsmgv.exe
  2⤵
  PID:5392
- C:\Windows\System\sqRQSxK.exe
  C:\Windows\System\sqRQSxK.exe
  2⤵
  PID:5408
- C:\Windows\System\GqPUxPC.exe
  C:\Windows\System\GqPUxPC.exe
  2⤵
  PID:5424
- C:\Windows\System\ttxvChj.exe
  C:\Windows\System\ttxvChj.exe
  2⤵
  PID:5520
- C:\Windows\System\JafcLdE.exe
  C:\Windows\System\JafcLdE.exe
  2⤵
  PID:5544
- C:\Windows\System\RnltvDO.exe
  C:\Windows\System\RnltvDO.exe
  2⤵
  PID:5568
- C:\Windows\System\AKmoATs.exe
  C:\Windows\System\AKmoATs.exe
  2⤵
  PID:5624
- C:\Windows\System\mvVAWmJ.exe
  C:\Windows\System\mvVAWmJ.exe
  2⤵
  PID:5640
- C:\Windows\System\qJuPfgm.exe
  C:\Windows\System\qJuPfgm.exe
  2⤵
  PID:5656
- C:\Windows\System\ZZgdfub.exe
  C:\Windows\System\ZZgdfub.exe
  2⤵
  PID:5680
- C:\Windows\System\BmLgEdf.exe
  C:\Windows\System\BmLgEdf.exe
  2⤵
  PID:5696
- C:\Windows\System\eSKpfrA.exe
  C:\Windows\System\eSKpfrA.exe
  2⤵
  PID:5768
- C:\Windows\System\HRKYszf.exe
  C:\Windows\System\HRKYszf.exe
  2⤵
  PID:5784
- C:\Windows\System\dhviFgK.exe
  C:\Windows\System\dhviFgK.exe
  2⤵
  PID:5800
- C:\Windows\System\EkxrdOs.exe
  C:\Windows\System\EkxrdOs.exe
  2⤵
  PID:5816
- C:\Windows\System\RblsahN.exe
  C:\Windows\System\RblsahN.exe
  2⤵
  PID:5832
- C:\Windows\System\jRyodFm.exe
  C:\Windows\System\jRyodFm.exe
  2⤵
  PID:5852
- C:\Windows\System\MSzAegn.exe
  C:\Windows\System\MSzAegn.exe
  2⤵
  PID:5872
- C:\Windows\System\wsTsbNI.exe
  C:\Windows\System\wsTsbNI.exe
  2⤵
  PID:5888
- C:\Windows\System\cOBpVqQ.exe
  C:\Windows\System\cOBpVqQ.exe
  2⤵
  PID:5904
- C:\Windows\System\lZUPATx.exe
  C:\Windows\System\lZUPATx.exe
  2⤵
  PID:5928
- C:\Windows\System\OpKEMsx.exe
  C:\Windows\System\OpKEMsx.exe
  2⤵
  PID:5944
- C:\Windows\System\OPJUPfN.exe
  C:\Windows\System\OPJUPfN.exe
  2⤵
  PID:5960
- C:\Windows\System\fTGZyni.exe
  C:\Windows\System\fTGZyni.exe
  2⤵
  PID:5976
- C:\Windows\System\eGskBTY.exe
  C:\Windows\System\eGskBTY.exe
  2⤵
  PID:5996
- C:\Windows\System\PMPzlZV.exe
  C:\Windows\System\PMPzlZV.exe
  2⤵
  PID:6012
- C:\Windows\System\cuEwdpF.exe
  C:\Windows\System\cuEwdpF.exe
  2⤵
  PID:6028
- C:\Windows\System\gdCrdgN.exe
  C:\Windows\System\gdCrdgN.exe
  2⤵
  PID:6044
- C:\Windows\System\djqjYGW.exe
  C:\Windows\System\djqjYGW.exe
  2⤵
  PID:6060
- C:\Windows\System\zOHsDEt.exe
  C:\Windows\System\zOHsDEt.exe
  2⤵
  PID:6076
- C:\Windows\System\YMdcHSk.exe
  C:\Windows\System\YMdcHSk.exe
  2⤵
  PID:6092
- C:\Windows\System\NbtxILI.exe
  C:\Windows\System\NbtxILI.exe
  2⤵
  PID:6112
- C:\Windows\System\hdlDnTs.exe
  C:\Windows\System\hdlDnTs.exe
  2⤵
  PID:6128
- C:\Windows\System\CbtVjYt.exe
  C:\Windows\System\CbtVjYt.exe
  2⤵
  PID:4504
- C:\Windows\System\BPqsoTA.exe
  C:\Windows\System\BPqsoTA.exe
  2⤵
  PID:5196
- C:\Windows\System\NpvJUup.exe
  C:\Windows\System\NpvJUup.exe
  2⤵
  PID:3596
- C:\Windows\System\AUHaSkq.exe
  C:\Windows\System\AUHaSkq.exe
  2⤵
  PID:2536
- C:\Windows\System\LqmwLRK.exe
  C:\Windows\System\LqmwLRK.exe
  2⤵
  PID:3352
- C:\Windows\System\KrxQZcp.exe
  C:\Windows\System\KrxQZcp.exe
  2⤵
  PID:5264
- C:\Windows\System\ARXwRge.exe
  C:\Windows\System\ARXwRge.exe
  2⤵
  PID:5000
- C:\Windows\System\GFPsKin.exe
  C:\Windows\System\GFPsKin.exe
  2⤵
  PID:5128
- C:\Windows\System\RLqyWgl.exe
  C:\Windows\System\RLqyWgl.exe
  2⤵
  PID:5340
- C:\Windows\System\IdEUEPq.exe
  C:\Windows\System\IdEUEPq.exe
  2⤵
  PID:5420
- C:\Windows\System\PgRtJJT.exe
  C:\Windows\System\PgRtJJT.exe
  2⤵
  PID:5176
- C:\Windows\System\OxHytSH.exe
  C:\Windows\System\OxHytSH.exe
  2⤵
  PID:5284
- C:\Windows\System\JxcOMVX.exe
  C:\Windows\System\JxcOMVX.exe
  2⤵
  PID:5464
- C:\Windows\System\uzvpBwI.exe
  C:\Windows\System\uzvpBwI.exe
  2⤵
  PID:5480
- C:\Windows\System\aYJRNsm.exe
  C:\Windows\System\aYJRNsm.exe
  2⤵
  PID:5496
- C:\Windows\System\YcaqELx.exe
  C:\Windows\System\YcaqELx.exe
  2⤵
  PID:5516
- C:\Windows\System\qdWzryS.exe
  C:\Windows\System\qdWzryS.exe
  2⤵
  PID:5556
- C:\Windows\System\pypvbAG.exe
  C:\Windows\System\pypvbAG.exe
  2⤵
  PID:5576
- C:\Windows\System\oQeTCrh.exe
  C:\Windows\System\oQeTCrh.exe
  2⤵
  PID:5592
- C:\Windows\System\fKWPRZq.exe
  C:\Windows\System\fKWPRZq.exe
  2⤵
  PID:5608
- C:\Windows\System\OQuKnhK.exe
  C:\Windows\System\OQuKnhK.exe
  2⤵
  PID:5612
- C:\Windows\System\CiVyjQv.exe
  C:\Windows\System\CiVyjQv.exe
  2⤵
  PID:5636
- C:\Windows\System\TPvxhFi.exe
  C:\Windows\System\TPvxhFi.exe
  2⤵
  PID:5672
- C:\Windows\System\pmIvQGd.exe
  C:\Windows\System\pmIvQGd.exe
  2⤵
  PID:5708
- C:\Windows\System\VuydJNg.exe
  C:\Windows\System\VuydJNg.exe
  2⤵
  PID:5724
- C:\Windows\System\pZdGKpk.exe
  C:\Windows\System\pZdGKpk.exe
  2⤵
  PID:5760
- C:\Windows\System\FARBaMU.exe
  C:\Windows\System\FARBaMU.exe
  2⤵
  PID:5864
- C:\Windows\System\PDBIfbY.exe
  C:\Windows\System\PDBIfbY.exe
  2⤵
  PID:5972
- C:\Windows\System\AJWBVMH.exe
  C:\Windows\System\AJWBVMH.exe
  2⤵
  PID:6040
- C:\Windows\System\rGWlefY.exe
  C:\Windows\System\rGWlefY.exe
  2⤵
  PID:6108
- C:\Windows\System\ijqLmVy.exe
  C:\Windows\System\ijqLmVy.exe
  2⤵
  PID:6136
- C:\Windows\System\KPumpVc.exe
  C:\Windows\System\KPumpVc.exe
  2⤵
  PID:6088
- C:\Windows\System\geSBRXD.exe
  C:\Windows\System\geSBRXD.exe
  2⤵
  PID:5164
- C:\Windows\System\xAXZRJa.exe
  C:\Windows\System\xAXZRJa.exe
  2⤵
  PID:3936
- C:\Windows\System\vncYcJu.exe
  C:\Windows\System\vncYcJu.exe
  2⤵
  PID:5444
- C:\Windows\System\ZWawfkQ.exe
  C:\Windows\System\ZWawfkQ.exe
  2⤵
  PID:5952
- C:\Windows\System\LWOcUyE.exe
  C:\Windows\System\LWOcUyE.exe
  2⤵
  PID:5368
- C:\Windows\System\dayKmuN.exe
  C:\Windows\System\dayKmuN.exe
  2⤵
  PID:3684
- C:\Windows\System\PELZyCy.exe
  C:\Windows\System\PELZyCy.exe
  2⤵
  PID:5180
- C:\Windows\System\GQEFYyW.exe
  C:\Windows\System\GQEFYyW.exe
  2⤵
  PID:5028
- C:\Windows\System\JRiIBNd.exe
  C:\Windows\System\JRiIBNd.exe
  2⤵
  PID:5296
- C:\Windows\System\JRZpXpy.exe
  C:\Windows\System\JRZpXpy.exe
  2⤵
  PID:5584
- C:\Windows\System\CicWWCW.exe
  C:\Windows\System\CicWWCW.exe
  2⤵
  PID:5472
- C:\Windows\System\BkXhIfu.exe
  C:\Windows\System\BkXhIfu.exe
  2⤵
  PID:5476
- C:\Windows\System\qhKGQrz.exe
  C:\Windows\System\qhKGQrz.exe
  2⤵
  PID:5632
- C:\Windows\System\TUsLnHA.exe
  C:\Windows\System\TUsLnHA.exe
  2⤵
  PID:5704
- C:\Windows\System\IvocrOk.exe
  C:\Windows\System\IvocrOk.exe
  2⤵
  PID:5716
- C:\Windows\System\fIbikVh.exe
  C:\Windows\System\fIbikVh.exe
  2⤵
  PID:5492
- C:\Windows\System\zkNSGeB.exe
  C:\Windows\System\zkNSGeB.exe
  2⤵
  PID:5712
- C:\Windows\System\FwzGKog.exe
  C:\Windows\System\FwzGKog.exe
  2⤵
  PID:5868
- C:\Windows\System\IwcTngL.exe
  C:\Windows\System\IwcTngL.exe
  2⤵
  PID:5824
- C:\Windows\System\yvpgKSs.exe
  C:\Windows\System\yvpgKSs.exe
  2⤵
  PID:6036
- C:\Windows\System\YLBOqGR.exe
  C:\Windows\System\YLBOqGR.exe
  2⤵
  PID:6072
- C:\Windows\System\QZIhKYi.exe
  C:\Windows\System\QZIhKYi.exe
  2⤵
  PID:5228
- C:\Windows\System\qhMfcTL.exe
  C:\Windows\System\qhMfcTL.exe
  2⤵
  PID:5984
- C:\Windows\System\qIfwGWq.exe
  C:\Windows\System\qIfwGWq.exe
  2⤵
  PID:5880
- C:\Windows\System\pEkquGf.exe
  C:\Windows\System\pEkquGf.exe
  2⤵
  PID:6056
- C:\Windows\System\awvUkWx.exe
  C:\Windows\System\awvUkWx.exe
  2⤵
  PID:5448
- C:\Windows\System\ryxNYqF.exe
  C:\Windows\System\ryxNYqF.exe
  2⤵
  PID:4420
- C:\Windows\System\DjlZViC.exe
  C:\Windows\System\DjlZViC.exe
  2⤵
  PID:5432
- C:\Windows\System\LpfjmEy.exe
  C:\Windows\System\LpfjmEy.exe
  2⤵
  PID:3520
- C:\Windows\System\OskMBlF.exe
  C:\Windows\System\OskMBlF.exe
  2⤵
  PID:5248
- C:\Windows\System\UnlIMNv.exe
  C:\Windows\System\UnlIMNv.exe
  2⤵
  PID:5452
- C:\Windows\System\cqZLIrs.exe
  C:\Windows\System\cqZLIrs.exe
  2⤵
  PID:5456
- C:\Windows\System\DjhaJPD.exe
  C:\Windows\System\DjhaJPD.exe
  2⤵
  PID:6008
- C:\Windows\System\TWbLUna.exe
  C:\Windows\System\TWbLUna.exe
  2⤵
  PID:5488
- C:\Windows\System\aJkdfpr.exe
  C:\Windows\System\aJkdfpr.exe
  2⤵
  PID:3804
- C:\Windows\System\naEwbuS.exe
  C:\Windows\System\naEwbuS.exe
  2⤵
  PID:5828
- C:\Windows\System\jmNIYnq.exe
  C:\Windows\System\jmNIYnq.exe
  2⤵
  PID:4436
- C:\Windows\System\QbkKdwr.exe
  C:\Windows\System\QbkKdwr.exe
  2⤵
  PID:5988
- C:\Windows\System\PfWTUvN.exe
  C:\Windows\System\PfWTUvN.exe
  2⤵
  PID:5936
- C:\Windows\System\DjQeIks.exe
  C:\Windows\System\DjQeIks.exe
  2⤵
  PID:5776
- C:\Windows\System\ZpeboOK.exe
  C:\Windows\System\ZpeboOK.exe
  2⤵
  PID:5808
- C:\Windows\System\oGOJQLN.exe
  C:\Windows\System\oGOJQLN.exe
  2⤵
  PID:5440
- C:\Windows\System\YsTjSNu.exe
  C:\Windows\System\YsTjSNu.exe
  2⤵
  PID:3028
- C:\Windows\System\lIYvsPf.exe
  C:\Windows\System\lIYvsPf.exe
  2⤵
  PID:1644
- C:\Windows\System\OJirMQo.exe
  C:\Windows\System\OJirMQo.exe
  2⤵
  PID:5384
- C:\Windows\System\oJYcwQH.exe
  C:\Windows\System\oJYcwQH.exe
  2⤵
  PID:3984
- C:\Windows\System\NcrhzRt.exe
  C:\Windows\System\NcrhzRt.exe
  2⤵
  PID:3568
- C:\Windows\System\iQMSvQW.exe
  C:\Windows\System\iQMSvQW.exe
  2⤵
  PID:5536
- C:\Windows\System\rCsGYQk.exe
  C:\Windows\System\rCsGYQk.exe
  2⤵
  PID:5844
- C:\Windows\System\BTFTOQf.exe
  C:\Windows\System\BTFTOQf.exe
  2⤵
  PID:4860
- C:\Windows\System\IkDHcIz.exe
  C:\Windows\System\IkDHcIz.exe
  2⤵
  PID:5912
- C:\Windows\System\QqNrLon.exe
  C:\Windows\System\QqNrLon.exe
  2⤵
  PID:5812
- C:\Windows\System\GwlCEsM.exe
  C:\Windows\System\GwlCEsM.exe
  2⤵
  PID:5312
- C:\Windows\System\ZlLcNKI.exe
  C:\Windows\System\ZlLcNKI.exe
  2⤵
  PID:6160
- C:\Windows\System\szFdHPw.exe
  C:\Windows\System\szFdHPw.exe
  2⤵
  PID:6176
- C:\Windows\System\JXJXStn.exe
  C:\Windows\System\JXJXStn.exe
  2⤵
  PID:6196
- C:\Windows\System\DBxeeJR.exe
  C:\Windows\System\DBxeeJR.exe
  2⤵
  PID:6212
- C:\Windows\System\IpXNWGA.exe
  C:\Windows\System\IpXNWGA.exe
  2⤵
  PID:6228
- C:\Windows\System\idUHnHA.exe
  C:\Windows\System\idUHnHA.exe
  2⤵
  PID:6244
- C:\Windows\System\dzHOiHR.exe
  C:\Windows\System\dzHOiHR.exe
  2⤵
  PID:6264
- C:\Windows\System\EnggRNV.exe
  C:\Windows\System\EnggRNV.exe
  2⤵
  PID:6280
- C:\Windows\System\kwjcMaU.exe
  C:\Windows\System\kwjcMaU.exe
  2⤵
  PID:6296
- C:\Windows\System\adVlcnS.exe
  C:\Windows\System\adVlcnS.exe
  2⤵
  PID:6312
- C:\Windows\System\PpnAivC.exe
  C:\Windows\System\PpnAivC.exe
  2⤵
  PID:6332
- C:\Windows\System\zCfaFft.exe
  C:\Windows\System\zCfaFft.exe
  2⤵
  PID:6348
- C:\Windows\System\doBVhUS.exe
  C:\Windows\System\doBVhUS.exe
  2⤵
  PID:6364
- C:\Windows\System\finSYrz.exe
  C:\Windows\System\finSYrz.exe
  2⤵
  PID:6380
- C:\Windows\System\QSNsgaj.exe
  C:\Windows\System\QSNsgaj.exe
  2⤵
  PID:6396
- C:\Windows\System\xrVusWS.exe
  C:\Windows\System\xrVusWS.exe
  2⤵
  PID:6412
- C:\Windows\System\YqxJQTP.exe
  C:\Windows\System\YqxJQTP.exe
  2⤵
  PID:6428
- C:\Windows\System\QzHxYKW.exe
  C:\Windows\System\QzHxYKW.exe
  2⤵
  PID:6444
- C:\Windows\System\fZciMYD.exe
  C:\Windows\System\fZciMYD.exe
  2⤵
  PID:6460
- C:\Windows\System\EtDULuY.exe
  C:\Windows\System\EtDULuY.exe
  2⤵
  PID:6484
- C:\Windows\System\hphCcdk.exe
  C:\Windows\System\hphCcdk.exe
  2⤵
  PID:6500
- C:\Windows\System\YiqAqia.exe
  C:\Windows\System\YiqAqia.exe
  2⤵
  PID:6516
- C:\Windows\System\qjcXlFG.exe
  C:\Windows\System\qjcXlFG.exe
  2⤵
  PID:6532
- C:\Windows\System\vEXGVub.exe
  C:\Windows\System\vEXGVub.exe
  2⤵
  PID:6548
- C:\Windows\System\QUCwOqC.exe
  C:\Windows\System\QUCwOqC.exe
  2⤵
  PID:6568
- C:\Windows\System\lSyLefK.exe
  C:\Windows\System\lSyLefK.exe
  2⤵
  PID:6584
- C:\Windows\System\AWNUttA.exe
  C:\Windows\System\AWNUttA.exe
  2⤵
  PID:6600
- C:\Windows\System\VRKmyZY.exe
  C:\Windows\System\VRKmyZY.exe
  2⤵
  PID:6616
- C:\Windows\System\fFAPgWw.exe
  C:\Windows\System\fFAPgWw.exe
  2⤵
  PID:6632
- C:\Windows\System\rqjpVII.exe
  C:\Windows\System\rqjpVII.exe
  2⤵
  PID:6648
- C:\Windows\System\ZtVrAQo.exe
  C:\Windows\System\ZtVrAQo.exe
  2⤵
  PID:6664
- C:\Windows\System\zXGQSAJ.exe
  C:\Windows\System\zXGQSAJ.exe
  2⤵
  PID:6680
- C:\Windows\System\FoSzfHs.exe
  C:\Windows\System\FoSzfHs.exe
  2⤵
  PID:6700
- C:\Windows\System\dGDxRAr.exe
  C:\Windows\System\dGDxRAr.exe
  2⤵
  PID:6716
- C:\Windows\System\ODLENFL.exe
  C:\Windows\System\ODLENFL.exe
  2⤵
  PID:6732
- C:\Windows\System\SEJCkJa.exe
  C:\Windows\System\SEJCkJa.exe
  2⤵
  PID:6748
- C:\Windows\System\RPQnFvF.exe
  C:\Windows\System\RPQnFvF.exe
  2⤵
  PID:6764
- C:\Windows\System\JycwEyq.exe
  C:\Windows\System\JycwEyq.exe
  2⤵
  PID:6780
- C:\Windows\System\LfOcifo.exe
  C:\Windows\System\LfOcifo.exe
  2⤵
  PID:6800
- C:\Windows\System\kvNGrlb.exe
  C:\Windows\System\kvNGrlb.exe
  2⤵
  PID:6816
- C:\Windows\System\qkLdPiX.exe
  C:\Windows\System\qkLdPiX.exe
  2⤵
  PID:6832
- C:\Windows\System\LMjykwq.exe
  C:\Windows\System\LMjykwq.exe
  2⤵
  PID:6888
- C:\Windows\System\vFfuZTH.exe
  C:\Windows\System\vFfuZTH.exe
  2⤵
  PID:6916
- C:\Windows\System\XAetPPa.exe
  C:\Windows\System\XAetPPa.exe
  2⤵
  PID:6932
- C:\Windows\System\hjJUrPo.exe
  C:\Windows\System\hjJUrPo.exe
  2⤵
  PID:6952
- C:\Windows\System\qBpeLmK.exe
  C:\Windows\System\qBpeLmK.exe
  2⤵
  PID:6980
- C:\Windows\System\SsYfQrL.exe
  C:\Windows\System\SsYfQrL.exe
  2⤵
  PID:6996
- C:\Windows\System\IkpMnBS.exe
  C:\Windows\System\IkpMnBS.exe
  2⤵
  PID:7012
- C:\Windows\System\sWPRhXi.exe
  C:\Windows\System\sWPRhXi.exe
  2⤵
  PID:7028
- C:\Windows\System\bnWoSZP.exe
  C:\Windows\System\bnWoSZP.exe
  2⤵
  PID:7044
- C:\Windows\System\IrWyhys.exe
  C:\Windows\System\IrWyhys.exe
  2⤵
  PID:7064
- C:\Windows\System\KrdOLBU.exe
  C:\Windows\System\KrdOLBU.exe
  2⤵
  PID:7080
- C:\Windows\System\ESMtzzj.exe
  C:\Windows\System\ESMtzzj.exe
  2⤵
  PID:7096
- C:\Windows\System\cQpJESG.exe
  C:\Windows\System\cQpJESG.exe
  2⤵
  PID:7112
- C:\Windows\System\DwFRnao.exe
  C:\Windows\System\DwFRnao.exe
  2⤵
  PID:7128
- C:\Windows\System\QTWOLzs.exe
  C:\Windows\System\QTWOLzs.exe
  2⤵
  PID:7144
- C:\Windows\System\dzITHSs.exe
  C:\Windows\System\dzITHSs.exe
  2⤵
  PID:7160
- C:\Windows\System\KKkIoSv.exe
  C:\Windows\System\KKkIoSv.exe
  2⤵
  PID:5732
- C:\Windows\System\CCHpnir.exe
  C:\Windows\System\CCHpnir.exe
  2⤵
  PID:5596
- C:\Windows\System\ugBOnEF.exe
  C:\Windows\System\ugBOnEF.exe
  2⤵
  PID:6024
- C:\Windows\System\dyHuzRp.exe
  C:\Windows\System\dyHuzRp.exe
  2⤵
  PID:6236
- C:\Windows\System\iQMwrEH.exe
  C:\Windows\System\iQMwrEH.exe
  2⤵
  PID:6304
- C:\Windows\System\iWjIVJj.exe
  C:\Windows\System\iWjIVJj.exe
  2⤵
  PID:6376
- C:\Windows\System\StTZwIW.exe
  C:\Windows\System\StTZwIW.exe
  2⤵
  PID:6440
- C:\Windows\System\TftOQaP.exe
  C:\Windows\System\TftOQaP.exe
  2⤵
  PID:6252
- C:\Windows\System\iAhwzFr.exe
  C:\Windows\System\iAhwzFr.exe
  2⤵
  PID:6292
- C:\Windows\System\RBtraIk.exe
  C:\Windows\System\RBtraIk.exe
  2⤵
  PID:6356
- C:\Windows\System\brYhALf.exe
  C:\Windows\System\brYhALf.exe
  2⤵
  PID:6420
- C:\Windows\System\LwWwZvj.exe
  C:\Windows\System\LwWwZvj.exe
  2⤵
  PID:6724
- C:\Windows\System\VKejBFm.exe
  C:\Windows\System\VKejBFm.exe
  2⤵
  PID:6788
- C:\Windows\System\HPJiNyY.exe
  C:\Windows\System\HPJiNyY.exe
  2⤵
  PID:6828
- C:\Windows\System\dAFCvRS.exe
  C:\Windows\System\dAFCvRS.exe
  2⤵
  PID:6968
- C:\Windows\System\DebMbuB.exe
  C:\Windows\System\DebMbuB.exe
  2⤵
  PID:7036
- C:\Windows\System\laKHsaJ.exe
  C:\Windows\System\laKHsaJ.exe
  2⤵
  PID:7108
- C:\Windows\System\UNdRlJa.exe
  C:\Windows\System\UNdRlJa.exe
  2⤵
  PID:5924
- C:\Windows\System\QvLluhF.exe
  C:\Windows\System\QvLluhF.exe
  2⤵
  PID:6408
- C:\Windows\System\yLAkTqp.exe
  C:\Windows\System\yLAkTqp.exe
  2⤵
  PID:6860
- C:\Windows\System\PIChkah.exe
  C:\Windows\System\PIChkah.exe
  2⤵
  PID:6880
- C:\Windows\System\pezKCJq.exe
  C:\Windows\System\pezKCJq.exe
  2⤵
  PID:3016
- C:\Windows\System\QyqfzGo.exe
  C:\Windows\System\QyqfzGo.exe
  2⤵
  PID:6560
- C:\Windows\System\BJYMPXz.exe
  C:\Windows\System\BJYMPXz.exe
  2⤵
  PID:6904
- C:\Windows\System\Gkcolff.exe
  C:\Windows\System\Gkcolff.exe
  2⤵
  PID:7056
- C:\Windows\System\JECuCGL.exe
  C:\Windows\System\JECuCGL.exe
  2⤵
  PID:7156
- C:\Windows\System\VNYNqpV.exe
  C:\Windows\System\VNYNqpV.exe
  2⤵
  PID:6344
- C:\Windows\System\JgHFcFm.exe
  C:\Windows\System\JgHFcFm.exe
  2⤵
  PID:6708
- C:\Windows\System\KeozWhf.exe
  C:\Windows\System\KeozWhf.exe
  2⤵
  PID:6844
- C:\Windows\System\NKIWatI.exe
  C:\Windows\System\NKIWatI.exe
  2⤵
  PID:5920
- C:\Windows\System\ZZeWFKf.exe
  C:\Windows\System\ZZeWFKf.exe
  2⤵
  PID:6556
- C:\Windows\System\QgdqmTC.exe
  C:\Windows\System\QgdqmTC.exe
  2⤵
  PID:6948
- C:\Windows\System\SrNqcpI.exe
  C:\Windows\System\SrNqcpI.exe
  2⤵
  PID:7088
- C:\Windows\System\KBZlNdn.exe
  C:\Windows\System\KBZlNdn.exe
  2⤵
  PID:6512
- C:\Windows\System\auLinKm.exe
  C:\Windows\System\auLinKm.exe
  2⤵
  PID:6544
- C:\Windows\System\SJuIloz.exe
  C:\Windows\System\SJuIloz.exe
  2⤵
  PID:6772
- C:\Windows\System\JUmoAeL.exe
  C:\Windows\System\JUmoAeL.exe
  2⤵
  PID:6372
- C:\Windows\System\jLKHjVX.exe
  C:\Windows\System\jLKHjVX.exe
  2⤵
  PID:7072
- C:\Windows\System\ChMtdWM.exe
  C:\Windows\System\ChMtdWM.exe
  2⤵
  PID:6872
- C:\Windows\System\YvsqwoT.exe
  C:\Windows\System\YvsqwoT.exe
  2⤵
  PID:4984
- C:\Windows\System\ZpAShwf.exe
  C:\Windows\System\ZpAShwf.exe
  2⤵
  PID:6452
- C:\Windows\System\TNNbnII.exe
  C:\Windows\System\TNNbnII.exe
  2⤵
  PID:6564
- C:\Windows\System\WQavivk.exe
  C:\Windows\System\WQavivk.exe
  2⤵
  PID:6656
- C:\Windows\System\BUuNtZQ.exe
  C:\Windows\System\BUuNtZQ.exe
  2⤵
  PID:6696
- C:\Windows\System\ePLBgIA.exe
  C:\Windows\System\ePLBgIA.exe
  2⤵
  PID:7020
- C:\Windows\System\eckYDTI.exe
  C:\Windows\System\eckYDTI.exe
  2⤵
  PID:6740
- C:\Windows\System\xSccKxk.exe
  C:\Windows\System\xSccKxk.exe
  2⤵
  PID:6168
- C:\Windows\System\wwhQWSw.exe
  C:\Windows\System\wwhQWSw.exe
  2⤵
  PID:6676
- C:\Windows\System\DraLdmp.exe
  C:\Windows\System\DraLdmp.exe
  2⤵
  PID:7092
- C:\Windows\System\TCiljrt.exe
  C:\Windows\System\TCiljrt.exe
  2⤵
  PID:5388
- C:\Windows\System\xcCsumL.exe
  C:\Windows\System\xcCsumL.exe
  2⤵
  PID:7140
- C:\Windows\System\UzhkAcZ.exe
  C:\Windows\System\UzhkAcZ.exe
  2⤵
  PID:7024
- C:\Windows\System\lJqnHgz.exe
  C:\Windows\System\lJqnHgz.exe
  2⤵
  PID:6540
- C:\Windows\System\GehzSux.exe
  C:\Windows\System\GehzSux.exe
  2⤵
  PID:6644
- C:\Windows\System\lMeetzd.exe
  C:\Windows\System\lMeetzd.exe
  2⤵
  PID:6756
- C:\Windows\System\zueWLHP.exe
  C:\Windows\System\zueWLHP.exe
  2⤵
  PID:7076
- C:\Windows\System\LWhwOsF.exe
  C:\Windows\System\LWhwOsF.exe
  2⤵
  PID:6152
- C:\Windows\System\SBuyIAg.exe
  C:\Windows\System\SBuyIAg.exe
  2⤵
  PID:6388
- C:\Windows\System\jlbVSrj.exe
  C:\Windows\System\jlbVSrj.exe
  2⤵
  PID:6924
- C:\Windows\System\FAVENDl.exe
  C:\Windows\System\FAVENDl.exe
  2⤵
  PID:6508
- C:\Windows\System\GMCJHqo.exe
  C:\Windows\System\GMCJHqo.exe
  2⤵
  PID:6672
- C:\Windows\System\LHxJrgP.exe
  C:\Windows\System\LHxJrgP.exe
  2⤵
  PID:7152
- C:\Windows\System\HrkVUaP.exe
  C:\Windows\System\HrkVUaP.exe
  2⤵
  PID:6204
- C:\Windows\System\hRYITuH.exe
  C:\Windows\System\hRYITuH.exe
  2⤵
  PID:5144
- C:\Windows\System\PllWffR.exe
  C:\Windows\System\PllWffR.exe
  2⤵
  PID:6184
- C:\Windows\System\ejgzXgo.exe
  C:\Windows\System\ejgzXgo.exe
  2⤵
  PID:6808
- C:\Windows\System\kpOuCrX.exe
  C:\Windows\System\kpOuCrX.exe
  2⤵
  PID:6612
- C:\Windows\System\qfSkTRK.exe
  C:\Windows\System\qfSkTRK.exe
  2⤵
  PID:6660
- C:\Windows\System\bBVKKZN.exe
  C:\Windows\System\bBVKKZN.exe
  2⤵
  PID:6812
- C:\Windows\System\IGxfIkE.exe
  C:\Windows\System\IGxfIkE.exe
  2⤵
  PID:6288
- C:\Windows\System\UQGjCEA.exe
  C:\Windows\System\UQGjCEA.exe
  2⤵
  PID:5580
- C:\Windows\System\nKjmMEY.exe
  C:\Windows\System\nKjmMEY.exe
  2⤵
  PID:6824
- C:\Windows\System\MMjGyYd.exe
  C:\Windows\System\MMjGyYd.exe
  2⤵
  PID:7184
- C:\Windows\System\HqtFpwp.exe
  C:\Windows\System\HqtFpwp.exe
  2⤵
  PID:7200
- C:\Windows\System\WdrQKMT.exe
  C:\Windows\System\WdrQKMT.exe
  2⤵
  PID:7220
- C:\Windows\System\nkfSeoW.exe
  C:\Windows\System\nkfSeoW.exe
  2⤵
  PID:7244
- C:\Windows\System\sfVgEkp.exe
  C:\Windows\System\sfVgEkp.exe
  2⤵
  PID:7260
- C:\Windows\System\jkSfZuA.exe
  C:\Windows\System\jkSfZuA.exe
  2⤵
  PID:7276
- C:\Windows\System\LKTcYBy.exe
  C:\Windows\System\LKTcYBy.exe
  2⤵
  PID:7292
- C:\Windows\System\dErxudY.exe
  C:\Windows\System\dErxudY.exe
  2⤵
  PID:7312
- C:\Windows\System\aoggrAX.exe
  C:\Windows\System\aoggrAX.exe
  2⤵
  PID:7328
- C:\Windows\System\KrldfHz.exe
  C:\Windows\System\KrldfHz.exe
  2⤵
  PID:7344
- C:\Windows\System\DzHyjZu.exe
  C:\Windows\System\DzHyjZu.exe
  2⤵
  PID:7360
- C:\Windows\System\rXFechA.exe
  C:\Windows\System\rXFechA.exe
  2⤵
  PID:7376
- C:\Windows\System\UCYZQQZ.exe
  C:\Windows\System\UCYZQQZ.exe
  2⤵
  PID:7392
- C:\Windows\System\VapsgXc.exe
  C:\Windows\System\VapsgXc.exe
  2⤵
  PID:7408
- C:\Windows\System\DDNvYKN.exe
  C:\Windows\System\DDNvYKN.exe
  2⤵
  PID:7532
- C:\Windows\System\pleVLsF.exe
  C:\Windows\System\pleVLsF.exe
  2⤵
  PID:7664
- C:\Windows\System\NUcGdPi.exe
  C:\Windows\System\NUcGdPi.exe
  2⤵
  PID:7680
- C:\Windows\System\cZherAb.exe
  C:\Windows\System\cZherAb.exe
  2⤵
  PID:7696
- C:\Windows\System\FuEDyiH.exe
  C:\Windows\System\FuEDyiH.exe
  2⤵
  PID:7712
- C:\Windows\System\WKiQLFc.exe
  C:\Windows\System\WKiQLFc.exe
  2⤵
  PID:7728
- C:\Windows\System\RiVzjam.exe
  C:\Windows\System\RiVzjam.exe
  2⤵
  PID:7744
- C:\Windows\System\eSgCsfE.exe
  C:\Windows\System\eSgCsfE.exe
  2⤵
  PID:7764
- C:\Windows\System\wYvwMha.exe
  C:\Windows\System\wYvwMha.exe
  2⤵
  PID:7780
- C:\Windows\System\jVyhbeL.exe
  C:\Windows\System\jVyhbeL.exe
  2⤵
  PID:7796
- C:\Windows\System\LuyzFqh.exe
  C:\Windows\System\LuyzFqh.exe
  2⤵
  PID:7864
- C:\Windows\System\UvjVUFS.exe
  C:\Windows\System\UvjVUFS.exe
  2⤵
  PID:7880
- C:\Windows\System\BYIvoWJ.exe
  C:\Windows\System\BYIvoWJ.exe
  2⤵
  PID:7896
- C:\Windows\System\KTrcUXO.exe
  C:\Windows\System\KTrcUXO.exe
  2⤵
  PID:7912
- C:\Windows\System\JuIlAjD.exe
  C:\Windows\System\JuIlAjD.exe
  2⤵
  PID:7928
- C:\Windows\System\oyqwWvm.exe
  C:\Windows\System\oyqwWvm.exe
  2⤵
  PID:7952
- C:\Windows\System\RKUJHcM.exe
  C:\Windows\System\RKUJHcM.exe
  2⤵
  PID:7972
- C:\Windows\System\SGtqSTU.exe
  C:\Windows\System\SGtqSTU.exe
  2⤵
  PID:8024
- C:\Windows\System\yiXFHtX.exe
  C:\Windows\System\yiXFHtX.exe
  2⤵
  PID:8040
- C:\Windows\System\VgNprTV.exe
  C:\Windows\System\VgNprTV.exe
  2⤵
  PID:8060
- C:\Windows\System\kBzxomq.exe
  C:\Windows\System\kBzxomq.exe
  2⤵
  PID:8076
- C:\Windows\System\NMCqTyy.exe
  C:\Windows\System\NMCqTyy.exe
  2⤵
  PID:8092
- C:\Windows\System\axxKxol.exe
  C:\Windows\System\axxKxol.exe
  2⤵
  PID:8108
- C:\Windows\System\TgdOGpp.exe
  C:\Windows\System\TgdOGpp.exe
  2⤵
  PID:8124
- C:\Windows\System\fMNBRVR.exe
  C:\Windows\System\fMNBRVR.exe
  2⤵
  PID:8140
- C:\Windows\System\CVOomfh.exe
  C:\Windows\System\CVOomfh.exe
  2⤵
  PID:8156
- C:\Windows\System\khrMOoM.exe
  C:\Windows\System\khrMOoM.exe
  2⤵
  PID:8172
- C:\Windows\System\zZzntnU.exe
  C:\Windows\System\zZzntnU.exe
  2⤵
  PID:6852
- C:\Windows\System\SptFljF.exe
  C:\Windows\System\SptFljF.exe
  2⤵
  PID:6524
- C:\Windows\System\gsXgIou.exe
  C:\Windows\System\gsXgIou.exe
  2⤵
  PID:5792
- C:\Windows\System\eaWSYtS.exe
  C:\Windows\System\eaWSYtS.exe
  2⤵
  PID:6928
- C:\Windows\System\SlEpUKe.exe
  C:\Windows\System\SlEpUKe.exe
  2⤵
  PID:5508
- C:\Windows\System\XiGcdVs.exe
  C:\Windows\System\XiGcdVs.exe
  2⤵
  PID:7192
- C:\Windows\System\EWQTFCa.exe
  C:\Windows\System\EWQTFCa.exe
  2⤵
  PID:7236
- C:\Windows\System\QWhERKL.exe
  C:\Windows\System\QWhERKL.exe
  2⤵
  PID:7300
- C:\Windows\System\FpQhSeT.exe
  C:\Windows\System\FpQhSeT.exe
  2⤵
  PID:7320
- C:\Windows\System\WHCGmHp.exe
  C:\Windows\System\WHCGmHp.exe
  2⤵
  PID:7356
- C:\Windows\System\ioDGRbb.exe
  C:\Windows\System\ioDGRbb.exe
  2⤵
  PID:7428
- C:\Windows\System\LIjCqEQ.exe
  C:\Windows\System\LIjCqEQ.exe
  2⤵
  PID:7444
- C:\Windows\System\OTJuPTU.exe
  C:\Windows\System\OTJuPTU.exe
  2⤵
  PID:1516
- C:\Windows\System\KZTHEmz.exe
  C:\Windows\System\KZTHEmz.exe
  2⤵
  PID:7524
- C:\Windows\System\TTrmQwv.exe
  C:\Windows\System\TTrmQwv.exe
  2⤵
  PID:7624
- C:\Windows\System\BXNHVhq.exe
  C:\Windows\System\BXNHVhq.exe
  2⤵
  PID:7640
- C:\Windows\System\mSuxZms.exe
  C:\Windows\System\mSuxZms.exe
  2⤵
  PID:7308
- C:\Windows\System\BXiwxTz.exe
  C:\Windows\System\BXiwxTz.exe
  2⤵
  PID:7564
- C:\Windows\System\QKzCuOv.exe
  C:\Windows\System\QKzCuOv.exe
  2⤵
  PID:7588
- C:\Windows\System\zpxxyss.exe
  C:\Windows\System\zpxxyss.exe
  2⤵
  PID:7400
- C:\Windows\System\EOLqUFy.exe
  C:\Windows\System\EOLqUFy.exe
  2⤵
  PID:7652
- C:\Windows\System\KuzFjxd.exe
  C:\Windows\System\KuzFjxd.exe
  2⤵
  PID:7540
- C:\Windows\System\XREToMq.exe
  C:\Windows\System\XREToMq.exe
  2⤵
  PID:7568
- C:\Windows\System\LCTjMam.exe
  C:\Windows\System\LCTjMam.exe
  2⤵
  PID:7596
- C:\Windows\System\ZIXHrPV.exe
  C:\Windows\System\ZIXHrPV.exe
  2⤵
  PID:7660
- C:\Windows\System\UHxlBKF.exe
  C:\Windows\System\UHxlBKF.exe
  2⤵
  PID:7752
- C:\Windows\System\jfNzGWM.exe
  C:\Windows\System\jfNzGWM.exe
  2⤵
  PID:7804
- C:\Windows\System\coiuMFa.exe
  C:\Windows\System\coiuMFa.exe
  2⤵
  PID:7816
- C:\Windows\System\WIrZOlu.exe
  C:\Windows\System\WIrZOlu.exe
  2⤵
  PID:7828
- C:\Windows\System\lTSIgRj.exe
  C:\Windows\System\lTSIgRj.exe
  2⤵
  PID:7844
- C:\Windows\System\KWCTKVc.exe
  C:\Windows\System\KWCTKVc.exe
  2⤵
  PID:7860
- C:\Windows\System\jNQQluS.exe
  C:\Windows\System\jNQQluS.exe
  2⤵
  PID:7876
- C:\Windows\System\ZLXtcRn.exe
  C:\Windows\System\ZLXtcRn.exe
  2⤵
  PID:7960
- C:\Windows\System\lsWjRbK.exe
  C:\Windows\System\lsWjRbK.exe
  2⤵
  PID:7948
- C:\Windows\System\ZmLPnXr.exe
  C:\Windows\System\ZmLPnXr.exe
  2⤵
  PID:7992
- C:\Windows\System\NtSfNgn.exe
  C:\Windows\System\NtSfNgn.exe
  2⤵
  PID:8008
- C:\Windows\System\QSTQHfD.exe
  C:\Windows\System\QSTQHfD.exe
  2⤵
  PID:8032
- C:\Windows\System\wyBCgCW.exe
  C:\Windows\System\wyBCgCW.exe
  2⤵
  PID:8068
- C:\Windows\System\ICIDToF.exe
  C:\Windows\System\ICIDToF.exe
  2⤵
  PID:8056
- C:\Windows\System\klgnfQS.exe
  C:\Windows\System\klgnfQS.exe
  2⤵
  PID:8152
- C:\Windows\System\zkVUWfW.exe
  C:\Windows\System\zkVUWfW.exe
  2⤵
  PID:8088
- C:\Windows\System\XOYaKZn.exe
  C:\Windows\System\XOYaKZn.exe
  2⤵
  PID:7268
- C:\Windows\System\opnyhRx.exe
  C:\Windows\System\opnyhRx.exe
  2⤵
  PID:7436
- C:\Windows\System\EmpEEhi.exe
  C:\Windows\System\EmpEEhi.exe
  2⤵
  PID:7456
- C:\Windows\System\fhYXnXe.exe
  C:\Windows\System\fhYXnXe.exe
  2⤵
  PID:7512
- C:\Windows\System\YVdFxQN.exe
  C:\Windows\System\YVdFxQN.exe
  2⤵
  PID:7560
- C:\Windows\System\MJwyATW.exe
  C:\Windows\System\MJwyATW.exe
  2⤵
  PID:7488
- C:\Windows\System\drwYkPf.exe
  C:\Windows\System\drwYkPf.exe
  2⤵
  PID:7516
- C:\Windows\System\fnGAyBU.exe
  C:\Windows\System\fnGAyBU.exe
  2⤵
  PID:7496
- C:\Windows\System\fSIueTt.exe
  C:\Windows\System\fSIueTt.exe
  2⤵
  PID:7548
- C:\Windows\System\istDKpJ.exe
  C:\Windows\System\istDKpJ.exe
  2⤵
  PID:7340
- C:\Windows\System\QdOvchZ.exe
  C:\Windows\System\QdOvchZ.exe
  2⤵
  PID:7648
- C:\Windows\System\HklCSfU.exe
  C:\Windows\System\HklCSfU.exe
  2⤵
  PID:7604
- C:\Windows\System\mNWYkOa.exe
  C:\Windows\System\mNWYkOa.exe
  2⤵
  PID:7792
- C:\Windows\System\KBGEEgT.exe
  C:\Windows\System\KBGEEgT.exe
  2⤵
  PID:7824
- C:\Windows\System\gRHcAtW.exe
  C:\Windows\System\gRHcAtW.exe
  2⤵
  PID:8016
- C:\Windows\System\nSWCSXF.exe
  C:\Windows\System\nSWCSXF.exe
  2⤵
  PID:7232
- C:\Windows\System\FFrFEQv.exe
  C:\Windows\System\FFrFEQv.exe
  2⤵
  PID:6340
- C:\Windows\System\auzDIXg.exe
  C:\Windows\System\auzDIXg.exe
  2⤵
  PID:8168
- C:\Windows\System\cCyFPja.exe
  C:\Windows\System\cCyFPja.exe
  2⤵
  PID:7284
- C:\Windows\System\ztNQRIM.exe
  C:\Windows\System\ztNQRIM.exe
  2⤵
  PID:7460
- C:\Windows\System\GjfpGqZ.exe
  C:\Windows\System\GjfpGqZ.exe
  2⤵
  PID:7528
- C:\Windows\System\uFPcezs.exe
  C:\Windows\System\uFPcezs.exe
  2⤵
  PID:7772
- C:\Windows\System\xwOHlTu.exe
  C:\Windows\System\xwOHlTu.exe
  2⤵
  PID:7788
- C:\Windows\System\MimLVfZ.exe
  C:\Windows\System\MimLVfZ.exe
  2⤵
  PID:7600
- C:\Windows\System\SZdbNLx.exe
  C:\Windows\System\SZdbNLx.exe
  2⤵
  PID:7708
- C:\Windows\System\EgmGrNO.exe
  C:\Windows\System\EgmGrNO.exe
  2⤵
  PID:8132
- C:\Windows\System\JmOipID.exe
  C:\Windows\System\JmOipID.exe
  2⤵
  PID:7840
- C:\Windows\System\EzILwFz.exe
  C:\Windows\System\EzILwFz.exe
  2⤵
  PID:7656
- C:\Windows\System\tSSFczX.exe
  C:\Windows\System\tSSFczX.exe
  2⤵
  PID:7216
- C:\Windows\System\xvyejfS.exe
  C:\Windows\System\xvyejfS.exe
  2⤵
  PID:7256
- C:\Windows\System\aBOunZs.exe
  C:\Windows\System\aBOunZs.exe
  2⤵
  PID:7888
- C:\Windows\System\ALobHBa.exe
  C:\Windows\System\ALobHBa.exe
  2⤵
  PID:6868
- C:\Windows\System\UaYHeuP.exe
  C:\Windows\System\UaYHeuP.exe
  2⤵
  PID:6596
- C:\Windows\System\UnLPPkg.exe
  C:\Windows\System\UnLPPkg.exe
  2⤵
  PID:7636
- C:\Windows\System\jEsYewF.exe
  C:\Windows\System\jEsYewF.exe
  2⤵
  PID:7416
- C:\Windows\System\kyVzoAC.exe
  C:\Windows\System\kyVzoAC.exe
  2⤵
  PID:8136
- C:\Windows\System\GBMgfle.exe
  C:\Windows\System\GBMgfle.exe
  2⤵
  PID:7936
- C:\Windows\System\TeTJeso.exe
  C:\Windows\System\TeTJeso.exe
  2⤵
  PID:8196
- C:\Windows\System\EYGPuCj.exe
  C:\Windows\System\EYGPuCj.exe
  2⤵
  PID:8216
- C:\Windows\System\vuKFaQc.exe
  C:\Windows\System\vuKFaQc.exe
  2⤵
  PID:8232
- C:\Windows\System\kFmTyGM.exe
  C:\Windows\System\kFmTyGM.exe
  2⤵
  PID:8248
- C:\Windows\System\TQOOHGD.exe
  C:\Windows\System\TQOOHGD.exe
  2⤵
  PID:8264
- C:\Windows\System\VWQWfCg.exe
  C:\Windows\System\VWQWfCg.exe
  2⤵
  PID:8280
- C:\Windows\System\PXcnZBn.exe
  C:\Windows\System\PXcnZBn.exe
  2⤵
  PID:8300
- C:\Windows\System\oyJtLNx.exe
  C:\Windows\System\oyJtLNx.exe
  2⤵
  PID:8316
- C:\Windows\System\ktBdoSx.exe
  C:\Windows\System\ktBdoSx.exe
  2⤵
  PID:8332
- C:\Windows\System\XCsIMFP.exe
  C:\Windows\System\XCsIMFP.exe
  2⤵
  PID:8352
- C:\Windows\System\DBrUsqx.exe
  C:\Windows\System\DBrUsqx.exe
  2⤵
  PID:8368
- C:\Windows\System\EiLPQTY.exe
  C:\Windows\System\EiLPQTY.exe
  2⤵
  PID:8384
- C:\Windows\System\dAWnwze.exe
  C:\Windows\System\dAWnwze.exe
  2⤵
  PID:8400
- C:\Windows\System\QKkNwlx.exe
  C:\Windows\System\QKkNwlx.exe
  2⤵
  PID:8416
- C:\Windows\System\XBkcrqG.exe
  C:\Windows\System\XBkcrqG.exe
  2⤵
  PID:8432
- C:\Windows\System\oxksWiC.exe
  C:\Windows\System\oxksWiC.exe
  2⤵
  PID:8544
- C:\Windows\System\ZRRrbEO.exe
  C:\Windows\System\ZRRrbEO.exe
  2⤵
  PID:8560
- C:\Windows\System\EHlzZJr.exe
  C:\Windows\System\EHlzZJr.exe
  2⤵
  PID:8580
- C:\Windows\System\EKyzsXb.exe
  C:\Windows\System\EKyzsXb.exe
  2⤵
  PID:8596
- C:\Windows\System\aJRdvbS.exe
  C:\Windows\System\aJRdvbS.exe
  2⤵
  PID:8632
- C:\Windows\System\knjvhqZ.exe
  C:\Windows\System\knjvhqZ.exe
  2⤵
  PID:8648
- C:\Windows\System\AzQRzeC.exe
  C:\Windows\System\AzQRzeC.exe
  2⤵
  PID:8668
- C:\Windows\System\ZrQVmNr.exe
  C:\Windows\System\ZrQVmNr.exe
  2⤵
  PID:8692
- C:\Windows\System\MXrUKjr.exe
  C:\Windows\System\MXrUKjr.exe
  2⤵
  PID:8708
- C:\Windows\System\OuCLgaS.exe
  C:\Windows\System\OuCLgaS.exe
  2⤵
  PID:8724
- C:\Windows\System\MhfHERd.exe
  C:\Windows\System\MhfHERd.exe
  2⤵
  PID:8740
- C:\Windows\System\KeAuQBF.exe
  C:\Windows\System\KeAuQBF.exe
  2⤵
  PID:8768
- C:\Windows\System\krYuGSZ.exe
  C:\Windows\System\krYuGSZ.exe
  2⤵
  PID:8784
- C:\Windows\System\mimSZaC.exe
  C:\Windows\System\mimSZaC.exe
  2⤵
  PID:8800
- C:\Windows\System\NiSTCSU.exe
  C:\Windows\System\NiSTCSU.exe
  2⤵
  PID:8816
- C:\Windows\System\uFruumF.exe
  C:\Windows\System\uFruumF.exe
  2⤵
  PID:8832
- C:\Windows\System\MgQWdkg.exe
  C:\Windows\System\MgQWdkg.exe
  2⤵
  PID:8848
- C:\Windows\System\UFZTSSi.exe
  C:\Windows\System\UFZTSSi.exe
  2⤵
  PID:8868
- C:\Windows\System\EqQketv.exe
  C:\Windows\System\EqQketv.exe
  2⤵
  PID:8884
- C:\Windows\System\fpruCtB.exe
  C:\Windows\System\fpruCtB.exe
  2⤵
  PID:8900
- C:\Windows\System\EIsBpnr.exe
  C:\Windows\System\EIsBpnr.exe
  2⤵
  PID:8916
- C:\Windows\System\bygVzYn.exe
  C:\Windows\System\bygVzYn.exe
  2⤵
  PID:8932
- C:\Windows\System\WEUSxut.exe
  C:\Windows\System\WEUSxut.exe
  2⤵
  PID:8952
- C:\Windows\System\dCgZTeH.exe
  C:\Windows\System\dCgZTeH.exe
  2⤵
  PID:8968
- C:\Windows\System\ilNqzZl.exe
  C:\Windows\System\ilNqzZl.exe
  2⤵
  PID:8984
- C:\Windows\System\tMnWDTM.exe
  C:\Windows\System\tMnWDTM.exe
  2⤵
  PID:9000
- C:\Windows\System\SOhmYOJ.exe
  C:\Windows\System\SOhmYOJ.exe
  2⤵
  PID:9016
- C:\Windows\System\eGAXUmd.exe
  C:\Windows\System\eGAXUmd.exe
  2⤵
  PID:9032
- C:\Windows\System\FSetfMd.exe
  C:\Windows\System\FSetfMd.exe
  2⤵
  PID:9052
- C:\Windows\System\cCKmUpe.exe
  C:\Windows\System\cCKmUpe.exe
  2⤵
  PID:9068
- C:\Windows\System\QTHABsq.exe
  C:\Windows\System\QTHABsq.exe
  2⤵
  PID:9124
- C:\Windows\System\hlOUsig.exe
  C:\Windows\System\hlOUsig.exe
  2⤵
  PID:9140
- C:\Windows\System\dhrgZmY.exe
  C:\Windows\System\dhrgZmY.exe
  2⤵
  PID:9156
- C:\Windows\System\ZuYafJZ.exe
  C:\Windows\System\ZuYafJZ.exe
  2⤵
  PID:9172
- C:\Windows\System\fuGCqJj.exe
  C:\Windows\System\fuGCqJj.exe
  2⤵
  PID:9188
- C:\Windows\System\KJuPUTD.exe
  C:\Windows\System\KJuPUTD.exe
  2⤵
  PID:9204
- C:\Windows\System\AyjWCMW.exe
  C:\Windows\System\AyjWCMW.exe
  2⤵
  PID:8188
- C:\Windows\System\lqzMAyj.exe
  C:\Windows\System\lqzMAyj.exe
  2⤵
  PID:6328
- C:\Windows\System\Dblbnao.exe
  C:\Windows\System\Dblbnao.exe
  2⤵
  PID:8240
- C:\Windows\System\cBvfbKv.exe
  C:\Windows\System\cBvfbKv.exe
  2⤵
  PID:8348
- C:\Windows\System\spdViBp.exe
  C:\Windows\System\spdViBp.exe
  2⤵
  PID:7908
- C:\Windows\System\jzwaWOM.exe
  C:\Windows\System\jzwaWOM.exe
  2⤵
  PID:8412
- C:\Windows\System\wxecTIV.exe
  C:\Windows\System\wxecTIV.exe
  2⤵
  PID:8344
- C:\Windows\System\MotoqrV.exe
  C:\Windows\System\MotoqrV.exe
  2⤵
  PID:7836
- C:\Windows\System\cRNabKU.exe
  C:\Windows\System\cRNabKU.exe
  2⤵
  PID:8292
- C:\Windows\System\vHMYtgp.exe
  C:\Windows\System\vHMYtgp.exe
  2⤵
  PID:8224
- C:\Windows\System\pJgfmmQ.exe
  C:\Windows\System\pJgfmmQ.exe
  2⤵
  PID:8456
- C:\Windows\System\EWQeKUi.exe
  C:\Windows\System\EWQeKUi.exe
  2⤵
  PID:8472
- C:\Windows\System\yLGgkJc.exe
  C:\Windows\System\yLGgkJc.exe
  2⤵
  PID:8488
- C:\Windows\System\bMNhYaQ.exe
  C:\Windows\System\bMNhYaQ.exe
  2⤵
  PID:8004
- C:\Windows\System\naRTpsY.exe
  C:\Windows\System\naRTpsY.exe
  2⤵
  PID:8508
- C:\Windows\System\dxgdtLH.exe
  C:\Windows\System\dxgdtLH.exe
  2⤵
  PID:8524
- C:\Windows\System\WzusPPL.exe
  C:\Windows\System\WzusPPL.exe
  2⤵
  PID:8540
- C:\Windows\System\OTSCTbT.exe
  C:\Windows\System\OTSCTbT.exe
  2⤵
  PID:8604
- C:\Windows\System\eqYLwOz.exe
  C:\Windows\System\eqYLwOz.exe
  2⤵
  PID:8616
- C:\Windows\System\wfpluGV.exe
  C:\Windows\System\wfpluGV.exe
  2⤵
  PID:8624
- C:\Windows\System\YIZBiJm.exe
  C:\Windows\System\YIZBiJm.exe
  2⤵
  PID:8660
- C:\Windows\System\hIdQqPz.exe
  C:\Windows\System\hIdQqPz.exe
  2⤵
  PID:8732
- C:\Windows\System\kFyjzYI.exe
  C:\Windows\System\kFyjzYI.exe
  2⤵
  PID:8908
- C:\Windows\System\akNzXOh.exe
  C:\Windows\System\akNzXOh.exe
  2⤵
  PID:8780
- C:\Windows\System\XtIidWt.exe
  C:\Windows\System\XtIidWt.exe
  2⤵
  PID:8756
- C:\Windows\System\bTzOZBw.exe
  C:\Windows\System\bTzOZBw.exe
  2⤵
  PID:8676
- C:\Windows\System\WvteIXx.exe
  C:\Windows\System\WvteIXx.exe
  2⤵
  PID:8980
- C:\Windows\System\HugMZtP.exe
  C:\Windows\System\HugMZtP.exe
  2⤵
  PID:8720
- C:\Windows\System\canrzrW.exe
  C:\Windows\System\canrzrW.exe
  2⤵
  PID:8828
- C:\Windows\System\DXwLIBy.exe
  C:\Windows\System\DXwLIBy.exe
  2⤵
  PID:8892
- C:\Windows\System\GEIdEUZ.exe
  C:\Windows\System\GEIdEUZ.exe
  2⤵
  PID:9060
- C:\Windows\System\gCDkeOG.exe
  C:\Windows\System\gCDkeOG.exe
  2⤵
  PID:9064
- C:\Windows\System\SKAVeVp.exe
  C:\Windows\System\SKAVeVp.exe
  2⤵
  PID:9092
- C:\Windows\System\jOJKVRX.exe
  C:\Windows\System\jOJKVRX.exe
  2⤵
  PID:9088
- C:\Windows\System\ReZtGKP.exe
  C:\Windows\System\ReZtGKP.exe
  2⤵
  PID:7552
- C:\Windows\System\FDgbvBO.exe
  C:\Windows\System\FDgbvBO.exe
  2⤵
  PID:7424
- C:\Windows\System\KCeeHzr.exe
  C:\Windows\System\KCeeHzr.exe
  2⤵
  PID:7476
- C:\Windows\System\GmcfaKc.exe
  C:\Windows\System\GmcfaKc.exe
  2⤵
  PID:7688
- C:\Windows\System\BXbqoOs.exe
  C:\Windows\System\BXbqoOs.exe
  2⤵
  PID:8424
- C:\Windows\System\LZAKRMb.exe
  C:\Windows\System\LZAKRMb.exe
  2⤵
  PID:8272
- C:\Windows\System\vnLXMxA.exe
  C:\Windows\System\vnLXMxA.exe
  2⤵
  PID:8312
- C:\Windows\System\RheSHvn.exe
  C:\Windows\System\RheSHvn.exe
  2⤵
  PID:8364
- C:\Windows\System\sLiHhxc.exe
  C:\Windows\System\sLiHhxc.exe
  2⤵
  PID:9200
- C:\Windows\System\DtiFyaS.exe
  C:\Windows\System\DtiFyaS.exe
  2⤵
  PID:8484
- C:\Windows\System\UCGRYIC.exe
  C:\Windows\System\UCGRYIC.exe
  2⤵
  PID:8864
- C:\Windows\System\fiZOksl.exe
  C:\Windows\System\fiZOksl.exe
  2⤵
  PID:8764
- C:\Windows\System\zLxHfDU.exe
  C:\Windows\System\zLxHfDU.exe
  2⤵
  PID:8576
- C:\Windows\System\TxpbYyv.exe
  C:\Windows\System\TxpbYyv.exe
  2⤵
  PID:8000
- C:\Windows\System\jKAmspT.exe
  C:\Windows\System\jKAmspT.exe
  2⤵
  PID:8256
- C:\Windows\System\EWNeKTQ.exe
  C:\Windows\System\EWNeKTQ.exe
  2⤵
  PID:8700
- C:\Windows\System\iuJeDVi.exe
  C:\Windows\System\iuJeDVi.exe
  2⤵
  PID:8948
- C:\Windows\System\GVjCMSM.exe
  C:\Windows\System\GVjCMSM.exe
  2⤵
  PID:8656
- C:\Windows\System\wgJPwfr.exe
  C:\Windows\System\wgJPwfr.exe
  2⤵
  PID:9116
- C:\Windows\System\PMDKPJu.exe
  C:\Windows\System\PMDKPJu.exe
  2⤵
  PID:8796
- C:\Windows\System\hCUDivQ.exe
  C:\Windows\System\hCUDivQ.exe
  2⤵
  PID:8964
- C:\Windows\System\hANuguw.exe
  C:\Windows\System\hANuguw.exe
  2⤵
  PID:9024
- C:\Windows\System\LjGnAqd.exe
  C:\Windows\System\LjGnAqd.exe
  2⤵
  PID:9120
- C:\Windows\System\OYaRSmA.exe
  C:\Windows\System\OYaRSmA.exe
  2⤵
  PID:7584
- C:\Windows\System\ABMhMCD.exe
  C:\Windows\System\ABMhMCD.exe
  2⤵
  PID:6220
- C:\Windows\System\HGGZMjT.exe
  C:\Windows\System\HGGZMjT.exe
  2⤵
  PID:8180
- C:\Windows\System\JxNXAXH.exe
  C:\Windows\System\JxNXAXH.exe
  2⤵
  PID:8464
- C:\Windows\System\SGBNNlM.exe
  C:\Windows\System\SGBNNlM.exe
  2⤵
  PID:8532
- C:\Windows\System\KWcATQV.exe
  C:\Windows\System\KWcATQV.exe
  2⤵
  PID:8612
- C:\Windows\System\kLYiJow.exe
  C:\Windows\System\kLYiJow.exe
  2⤵
  PID:8620
- C:\Windows\System\xbCePLO.exe
  C:\Windows\System\xbCePLO.exe
  2⤵
  PID:8516
- C:\Windows\System\WWOxIry.exe
  C:\Windows\System\WWOxIry.exe
  2⤵
  PID:9196
- C:\Windows\System\sUwKyZQ.exe
  C:\Windows\System\sUwKyZQ.exe
  2⤵
  PID:8296
- C:\Windows\System\cURDUtE.exe
  C:\Windows\System\cURDUtE.exe
  2⤵
  PID:8520
- C:\Windows\System\slZgCMn.exe
  C:\Windows\System\slZgCMn.exe
  2⤵
  PID:8588
- C:\Windows\System\lvdbKnr.exe
  C:\Windows\System\lvdbKnr.exe
  2⤵
  PID:8944
- C:\Windows\System\zUbRynp.exe
  C:\Windows\System\zUbRynp.exe
  2⤵
  PID:8536
- C:\Windows\System\NOEcYGz.exe
  C:\Windows\System\NOEcYGz.exe
  2⤵
  PID:8452
- C:\Windows\System\fbeiNkO.exe
  C:\Windows\System\fbeiNkO.exe
  2⤵
  PID:8928
- C:\Windows\System\ednvJJZ.exe
  C:\Windows\System\ednvJJZ.exe
  2⤵
  PID:7920
- C:\Windows\System\yBIfPLB.exe
  C:\Windows\System\yBIfPLB.exe
  2⤵
  PID:8212
- C:\Windows\System\LKTOIZw.exe
  C:\Windows\System\LKTOIZw.exe
  2⤵
  PID:7984
- C:\Windows\System\PoyHQlS.exe
  C:\Windows\System\PoyHQlS.exe
  2⤵
  PID:8880
- C:\Windows\System\JTUuKPJ.exe
  C:\Windows\System\JTUuKPJ.exe
  2⤵
  PID:9180
- C:\Windows\System\emNNbeA.exe
  C:\Windows\System\emNNbeA.exe
  2⤵
  PID:8592
- C:\Windows\System\oPDcnpz.exe
  C:\Windows\System\oPDcnpz.exe
  2⤵
  PID:8500
- C:\Windows\System\OZdRIyc.exe
  C:\Windows\System\OZdRIyc.exe
  2⤵
  PID:8976
- C:\Windows\System\xEEMxIv.exe
  C:\Windows\System\xEEMxIv.exe
  2⤵
  PID:8840
- C:\Windows\System\eTTRGjX.exe
  C:\Windows\System\eTTRGjX.exe
  2⤵
  PID:9044
- C:\Windows\System\sMlUrys.exe
  C:\Windows\System\sMlUrys.exe
  2⤵
  PID:8960
- C:\Windows\System\XkeMHqJ.exe
  C:\Windows\System\XkeMHqJ.exe
  2⤵
  PID:9084
- C:\Windows\System\Ynlsolx.exe
  C:\Windows\System\Ynlsolx.exe
  2⤵
  PID:8480
- C:\Windows\System\RdvugvZ.exe
  C:\Windows\System\RdvugvZ.exe
  2⤵
  PID:9236
- C:\Windows\System\CtoKsOc.exe
  C:\Windows\System\CtoKsOc.exe
  2⤵
  PID:9252
- C:\Windows\System\xLyHRXg.exe
  C:\Windows\System\xLyHRXg.exe
  2⤵
  PID:9268
- C:\Windows\System\lgXsESp.exe
  C:\Windows\System\lgXsESp.exe
  2⤵
  PID:9284
- C:\Windows\System\uJaDNXX.exe
  C:\Windows\System\uJaDNXX.exe
  2⤵
  PID:9304
- C:\Windows\System\FrTOHKG.exe
  C:\Windows\System\FrTOHKG.exe
  2⤵
  PID:9320
- C:\Windows\System\oJndPfB.exe
  C:\Windows\System\oJndPfB.exe
  2⤵
  PID:9336
- C:\Windows\System\MaCtOcb.exe
  C:\Windows\System\MaCtOcb.exe
  2⤵
  PID:9356
- C:\Windows\System\hvxeCOG.exe
  C:\Windows\System\hvxeCOG.exe
  2⤵
  PID:9388
- C:\Windows\System\JpyVmgN.exe
  C:\Windows\System\JpyVmgN.exe
  2⤵
  PID:9404
- C:\Windows\System\kHONKih.exe
  C:\Windows\System\kHONKih.exe
  2⤵
  PID:9420
- C:\Windows\System\bzgNoMk.exe
  C:\Windows\System\bzgNoMk.exe
  2⤵
  PID:9440
- C:\Windows\System\VFSSNVp.exe
  C:\Windows\System\VFSSNVp.exe
  2⤵
  PID:9456
- C:\Windows\System\skRzDXS.exe
  C:\Windows\System\skRzDXS.exe
  2⤵
  PID:9472
- C:\Windows\System\ccfirkn.exe
  C:\Windows\System\ccfirkn.exe
  2⤵
  PID:9488
- C:\Windows\System\oDlEYkV.exe
  C:\Windows\System\oDlEYkV.exe
  2⤵
  PID:9504
- C:\Windows\System\qzJJWXq.exe
  C:\Windows\System\qzJJWXq.exe
  2⤵
  PID:9520
- C:\Windows\System\cftqoGK.exe
  C:\Windows\System\cftqoGK.exe
  2⤵
  PID:9536
- C:\Windows\System\WQaamjp.exe
  C:\Windows\System\WQaamjp.exe
  2⤵
  PID:9556
- C:\Windows\System\JbAxMvf.exe
  C:\Windows\System\JbAxMvf.exe
  2⤵
  PID:9572
- C:\Windows\System\XIVDxTi.exe
  C:\Windows\System\XIVDxTi.exe
  2⤵
  PID:9592
- C:\Windows\System\XtxOrlg.exe
  C:\Windows\System\XtxOrlg.exe
  2⤵
  PID:9612
- C:\Windows\System\mxhsdTc.exe
  C:\Windows\System\mxhsdTc.exe
  2⤵
  PID:9628
- C:\Windows\System\AjZyHPI.exe
  C:\Windows\System\AjZyHPI.exe
  2⤵
  PID:9644
- C:\Windows\System\rrMtyNg.exe
  C:\Windows\System\rrMtyNg.exe
  2⤵
  PID:9660
- C:\Windows\System\UDBvuWr.exe
  C:\Windows\System\UDBvuWr.exe
  2⤵
  PID:9676
- C:\Windows\System\BozsIVo.exe
  C:\Windows\System\BozsIVo.exe
  2⤵
  PID:9692
- C:\Windows\System\eJIWYqm.exe
  C:\Windows\System\eJIWYqm.exe
  2⤵
  PID:9708
- C:\Windows\System\tRGLBSN.exe
  C:\Windows\System\tRGLBSN.exe
  2⤵
  PID:9768
- C:\Windows\System\dQxXuxG.exe
  C:\Windows\System\dQxXuxG.exe
  2⤵
  PID:9784
- C:\Windows\System\OlojFaN.exe
  C:\Windows\System\OlojFaN.exe
  2⤵
  PID:9800
- C:\Windows\System\LfHCHcC.exe
  C:\Windows\System\LfHCHcC.exe
  2⤵
  PID:9820
- C:\Windows\System\ErRLbsO.exe
  C:\Windows\System\ErRLbsO.exe
  2⤵
  PID:9836
- C:\Windows\System\FADQruM.exe
  C:\Windows\System\FADQruM.exe
  2⤵
  PID:9852
- C:\Windows\System\sbUONSO.exe
  C:\Windows\System\sbUONSO.exe
  2⤵
  PID:9872
- C:\Windows\System\NkBXHkx.exe
  C:\Windows\System\NkBXHkx.exe
  2⤵
  PID:9928
- C:\Windows\System\mbpvADa.exe
  C:\Windows\System\mbpvADa.exe
  2⤵
  PID:9944
- C:\Windows\System\iPhzJNO.exe
  C:\Windows\System\iPhzJNO.exe
  2⤵
  PID:9960
- C:\Windows\System\pbkApUm.exe
  C:\Windows\System\pbkApUm.exe
  2⤵
  PID:9976
- C:\Windows\System\ObRRnrE.exe
  C:\Windows\System\ObRRnrE.exe
  2⤵
  PID:10004
- C:\Windows\System\RYjkNDi.exe
  C:\Windows\System\RYjkNDi.exe
  2⤵
  PID:10020
- C:\Windows\System\rzXNFUZ.exe
  C:\Windows\System\rzXNFUZ.exe
  2⤵
  PID:10036
- C:\Windows\System\IgIzZFW.exe
  C:\Windows\System\IgIzZFW.exe
  2⤵
  PID:10052
- C:\Windows\System\NkSpncG.exe
  C:\Windows\System\NkSpncG.exe
  2⤵
  PID:10068
- C:\Windows\System\QlPxtmJ.exe
  C:\Windows\System\QlPxtmJ.exe
  2⤵
  PID:10084
- C:\Windows\System\inbtZTD.exe
  C:\Windows\System\inbtZTD.exe
  2⤵
  PID:10100
- C:\Windows\System\QQPGRfd.exe
  C:\Windows\System\QQPGRfd.exe
  2⤵
  PID:10116
- C:\Windows\System\xUCxjKY.exe
  C:\Windows\System\xUCxjKY.exe
  2⤵
  PID:10132
- C:\Windows\System\ydpBLCx.exe
  C:\Windows\System\ydpBLCx.exe
  2⤵
  PID:10148
- C:\Windows\System\urAnxBJ.exe
  C:\Windows\System\urAnxBJ.exe
  2⤵
  PID:10164
- C:\Windows\System\gSLfHdS.exe
  C:\Windows\System\gSLfHdS.exe
  2⤵
  PID:10180
- C:\Windows\System\qOoabGN.exe
  C:\Windows\System\qOoabGN.exe
  2⤵
  PID:10196
- C:\Windows\System\KuTsNBL.exe
  C:\Windows\System\KuTsNBL.exe
  2⤵
  PID:10212
- C:\Windows\System\UuxgXhf.exe
  C:\Windows\System\UuxgXhf.exe
  2⤵
  PID:10228
- C:\Windows\System\FykhHsM.exe
  C:\Windows\System\FykhHsM.exe
  2⤵
  PID:9232
- C:\Windows\System\xymZCOT.exe
  C:\Windows\System\xymZCOT.exe
  2⤵
  PID:9296
- C:\Windows\System\XlvDcAk.exe
  C:\Windows\System\XlvDcAk.exe
  2⤵
  PID:7776
- C:\Windows\System\jWIeUkt.exe
  C:\Windows\System\jWIeUkt.exe
  2⤵
  PID:8496
- C:\Windows\System\OrEHeji.exe
  C:\Windows\System\OrEHeji.exe
  2⤵
  PID:9012
- C:\Windows\System\qgkqmpO.exe
  C:\Windows\System\qgkqmpO.exe
  2⤵
  PID:9276
- C:\Windows\System\IgxBAvp.exe
  C:\Windows\System\IgxBAvp.exe
  2⤵
  PID:9344
- C:\Windows\System\uNmIhcp.exe
  C:\Windows\System\uNmIhcp.exe
  2⤵
  PID:8684
- C:\Windows\System\suSimOp.exe
  C:\Windows\System\suSimOp.exe
  2⤵
  PID:9376
- C:\Windows\System\RDRtquu.exe
  C:\Windows\System\RDRtquu.exe
  2⤵
  PID:9416
- C:\Windows\System\qcAktWt.exe
  C:\Windows\System\qcAktWt.exe
  2⤵
  PID:9484
- C:\Windows\System\PZJEwKX.exe
  C:\Windows\System\PZJEwKX.exe
  2⤵
  PID:9552
- C:\Windows\System\dSmYDqs.exe
  C:\Windows\System\dSmYDqs.exe
  2⤵
  PID:9428
- C:\Windows\System\ovwyzMO.exe
  C:\Windows\System\ovwyzMO.exe
  2⤵
  PID:9468
- C:\Windows\System\CaiaLdH.exe
  C:\Windows\System\CaiaLdH.exe
  2⤵
  PID:9532
- C:\Windows\System\WcjsOOT.exe
  C:\Windows\System\WcjsOOT.exe
  2⤵
  PID:9620
- C:\Windows\System\FKBiRso.exe
  C:\Windows\System\FKBiRso.exe
  2⤵
  PID:9624
- C:\Windows\System\LtUjoNK.exe
  C:\Windows\System\LtUjoNK.exe
  2⤵
  PID:9656
- C:\Windows\System\tAvnGtP.exe
  C:\Windows\System\tAvnGtP.exe
  2⤵
  PID:9668
- C:\Windows\System\aJGpyLY.exe
  C:\Windows\System\aJGpyLY.exe
  2⤵
  PID:9728
- C:\Windows\System\xUwfGtK.exe
  C:\Windows\System\xUwfGtK.exe
  2⤵
  PID:9748
- C:\Windows\System\TahiWra.exe
  C:\Windows\System\TahiWra.exe
  2⤵
  PID:9752
- C:\Windows\System\oYnkcFJ.exe
  C:\Windows\System\oYnkcFJ.exe
  2⤵
  PID:9828
- C:\Windows\System\VhFvNEH.exe
  C:\Windows\System\VhFvNEH.exe
  2⤵
  PID:9936
- C:\Windows\System\uQlWFkm.exe
  C:\Windows\System\uQlWFkm.exe
  2⤵
  PID:9776
- C:\Windows\System\uHRXjQT.exe
  C:\Windows\System\uHRXjQT.exe
  2⤵
  PID:10080
- C:\Windows\System\IRIKbck.exe
  C:\Windows\System\IRIKbck.exe
  2⤵
  PID:9332
- C:\Windows\System\tDxpClf.exe
  C:\Windows\System\tDxpClf.exe
  2⤵
  PID:9312
- C:\Windows\System\vVNysPI.exe
  C:\Windows\System\vVNysPI.exe
  2⤵
  PID:9480
- C:\Windows\System\dPPAMAP.exe
  C:\Windows\System\dPPAMAP.exe
  2⤵
  PID:9248
- C:\Windows\System\kcgFtiJ.exe
  C:\Windows\System\kcgFtiJ.exe
  2⤵
  PID:9264
- C:\Windows\System\iBfwkKA.exe
  C:\Windows\System\iBfwkKA.exe
  2⤵
  PID:9544
- C:\Windows\System\IHNWtfS.exe
  C:\Windows\System\IHNWtfS.exe
  2⤵
  PID:9244
- C:\Windows\System\sAFbHBW.exe
  C:\Windows\System\sAFbHBW.exe
  2⤵
  PID:9568
- C:\Windows\System\UwlOUfD.exe
  C:\Windows\System\UwlOUfD.exe
  2⤵
  PID:9608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DczYJwZ.exe

Filesize
1.4MB

MD5
b74d9f45bf3071b18b1a5f4b363ae7d3

SHA1
f54b27cbb43c130333fc6c7a996e503eccce49d9

SHA256
df58c9502ce2d509dec4d137929c9005e1a207d53a7ecafe7bd80e62bbd597bb

SHA512
c3b2d805d60e60bfde5548ca849620f69cc51462169efd76878f7fc889a2c20a7fe5e85353e16784f50a3677042b727d497372caee3133e6110201a5a8dd528d

Download Submit
C:\Windows\system\FcjhQoh.exe

Filesize
1.4MB

MD5
b7d24373a79f8badef00852e048fc820

SHA1
44403bc6a5930103abcb25fc74f502df0a90d112

SHA256
48dcadecbff8e6a840764befacfdc37682fee590a58a8c7727288492c3fe1565

SHA512
6d941c33bd1dbb71ff2685186ebc1c261ab8c89ac0a10b38ee50ae96e6af4056cf78608476df81861d76df10885b90e1eb93d2ffa412f74d5e34cbee4cc89430

Download Submit
C:\Windows\system\GDuICbp.exe

Filesize
1.4MB

MD5
c633846f7fc063523b88687f0b144e82

SHA1
7e5302cc04b29f6731f855c297ed55085c1abf37

SHA256
8e67436bca573df46d8d6cb2b9ff02e68a5e7421c3f5f48f2ae77aa060bf361f

SHA512
a4ff2921d08367d878fc0fd13fb92d9830e241d1fb6f2f57368318a9239d86444b83b9d16d8d40c07c3cee890b4079b389bb484f4e7ff4f29441920aa31a9772

Download Submit
C:\Windows\system\GQliVuY.exe

Filesize
1.4MB

MD5
e44506a8e7a9cc970d3dacb8672672bb

SHA1
f0a51a105bc7f1159f2dddbceaf199ba25f391f5

SHA256
161627caf3e62c581b8a0c4d57c47a611f3f505b41576bfcf63b3f3b87a68ba2

SHA512
4131b9c3d18e0c6beab6f0680b4e5737c31699d824cc49974c2f2e8d05513dcac9b74f55439cc0789f7eb91072d846a118121391ff615cdca42bf4ba91543cae

Download Submit
C:\Windows\system\GXpUdwW.exe

Filesize
1.4MB

MD5
cd2bf2b19d76b10835daf04a17662759

SHA1
2cfb97eeee185112948b29183d8a2d1638765e2a

SHA256
0031011d487abf4609e8747c813c1aab9bf2e22121adac068cd04ff7cc32d805

SHA512
346ed4fab81c5d96a1f60d78ab9f3be02a23ad80248647f33edee56516e3e3685acaf9dcb8f4a76e82743c545e67b98135805726951534ceb691b5791519ddee

Download Submit
C:\Windows\system\HPUJIOb.exe

Filesize
1.5MB

MD5
3b37fc5c4c5bec6039c5ee84264c11cd

SHA1
7c7a9a5c67c26950c5a3399380dec14a1f882106

SHA256
693c0af244edc6b9515c135c7f8a2af2e4130e06c2453284784efaca06a0a2b1

SHA512
47cac1620ad33e3707064fcfa14c4ad10e491a8655767a2daec709b19553d473d3887d91b8f788cbf9409bafe5c9709f95f109052bb497256e7a371802c82173

Download Submit
C:\Windows\system\JwJqYLg.exe

Filesize
1.4MB

MD5
f95f014b010aa7743bb9944037393c1b

SHA1
17ab1a8e67318448c5c81e98ee095b771e2a2cff

SHA256
58015f68ba2517163c2a49d99e3119c92a4ad31d37e89d35c624cf0c43b1fd45

SHA512
18d4d7db0f85433d106520f96ab323cedec99dca5f09c5591730653cace651c8a7e363497472fd944579b5729a5836c638801f5dbbc883e097a6750661ad1df6

Download Submit
C:\Windows\system\NJeIama.exe

Filesize
1.4MB

MD5
d5ea8545b77b191105552dd1fffd4059

SHA1
aa694ec9e6867e894a6f223d435957f89fcca3cf

SHA256
85c66af23bb61bbbe385bd6c7382d64eb118ae74f7c04aceb832db2500e701f4

SHA512
f5891b7d41c34453ffa119c1d7121e3fb4abc00e424f6c4132725b19a37fb59fe847bfee907a37a424318f905cf65d9ee1e1faf4c05b6642859fea31e121bdcd

Download Submit
C:\Windows\system\PdIDFoJ.exe

Filesize
1.4MB

MD5
ead7066b129c1a6205ce80d64a616b5c

SHA1
ffa6b2fc093aa23da2a0c509cb7e86893031e749

SHA256
a0c6d20d3a9a416479b66b37171571f482f3651e8844636e81ab5b1e4ad1968c

SHA512
9146341cf6488c419f5b88e14b5d88981e024868966e54f989d53f75a59239901bac51f5434956b711fa1c537fd9d3311a19093a1cde9e68f93f8160e41fe979

Download Submit
C:\Windows\system\SdCROCx.exe

Filesize
1.5MB

MD5
62d448e140ba4d272407408b9f274a71

SHA1
9af1e7758454a6f136e9b200e7a9f34624a1eb8e

SHA256
3c88c6c9658ed7d2450d15953518ec8f259492694fa152fa7417cdedee777b03

SHA512
b900147b95280ca7d6490136e318b6c7592bcfd83ca9be7f3339f8de34afc3c1aa995e2c68c9791e0cbcdad173abb955cfb6fe280389198ed3324af200894af4

Download Submit
C:\Windows\system\TeUiLsz.exe

Filesize
1.4MB

MD5
2a55469ea86f10da1be9ef43b5b460af

SHA1
3cd6d201249a38cddfd603ce15bc4be922c60457

SHA256
07396f02d709330aeeaf54c3ba168d72561284009ad14e19f1490ec237457e4b

SHA512
7020f4aada7f672e35c33b99cc0847e0de70a3ff4787b6c9fc08cf96cbc031260c026bf69a8d94e0f9686eff8eb911ae5c655d260955fd55a524e0283002b234

Download Submit
C:\Windows\system\UVoHmND.exe

Filesize
1.4MB

MD5
2f2de99ce3ff8edb6269c12d1a61153a

SHA1
fe7c64076607d39c35d42f47545fce470fe33155

SHA256
15c17e1ed664c4386f621127e82cc31077d98dacee2155ffb4d431e5100628d8

SHA512
81ffc497d7abb52a238bd28e8d1b6b043b182a39c0aee5538ffa66a5237cfa4708f2538334059b986eea25a0206f57470ac05bc32bb07500d5320a2255516600

Download Submit
C:\Windows\system\UcJeoDJ.exe

Filesize
1.4MB

MD5
cc7bccaab946a35695f9d0483b793ea6

SHA1
0647624420b20c8c5a5f102da785c2b669684df8

SHA256
b2ba2095d6a8897c26fbd43b19d4258d756363e324daf6db7ff969ab3c92cf5f

SHA512
13f9af0eac737daa613b91ffe76d18ac49b7bbcb37bdd76524de42ac68e5014e9ea99b6c642ff4c78283fe81c116f3587f24202b87a8837b5dd23102be6046fa

Download Submit
C:\Windows\system\WFtrAKJ.exe

Filesize
1.4MB

MD5
c72619cf36748f3283a72ec9d0a22ea4

SHA1
c757901e6e966e19c22821482c822484a883c836

SHA256
7e211dfa32eea4a46c7f2587b6ec867a12ebbd5465eba49ba1c4ad698e6c5ebc

SHA512
ede4d71b87afc9e2367fd37e1807ae76e29533bb03fa942fcba0cd9ef32343738432255b993ae7d1bd934ed829d642e395c39b04eb19a008ee29c1669b27f19e

Download Submit
C:\Windows\system\XUoawyg.exe

Filesize
1.4MB

MD5
7738695513e811aa14d5d7c39c8184cd

SHA1
3e770a051c5f7c5c3cd250b8b7633c32c0cba88c

SHA256
b2f83512739d54adf4207cf0076b3f58ad0b209c360491204d3eb5eaa285a943

SHA512
4c4c7e8806a2293084963b7efa9406aeac32916a80a6b0c2ccca803af64bf3f440ce2216460844885024f3f4a7838ff0395c931d5d59fa305ae034d6a834c3a1

Download Submit
C:\Windows\system\YVZMVZB.exe

Filesize
1.4MB

MD5
bd862d84249cb19f837e9f8939c4dbbe

SHA1
f7bcf1ec40540dd99b2c059e43685dea5e996542

SHA256
38ec74fb782f409fdb7c564c715f30b3c9a16b2b81dd77abc2e12483117febbb

SHA512
459d5dcdffe99253df90df4b2c7a63a3187fd37ce0938fcd7b26697b61af4588ee9ee9f0352022975d31e40b38e355f0ffe14f023ff26a7d8c1a1b87806c1469

Download Submit
C:\Windows\system\ZbLUynl.exe

Filesize
1.4MB

MD5
737f6414ed66287e89aed0c407bd4289

SHA1
03c31b96aa412e4ead8578bad2f89a5b65abf4b0

SHA256
6e8920246e5230feac404da8e8e70921aff7dcb74b782491f01a31d40fab02bc

SHA512
98fcb261d015bf20ba1642f5a1fb1ff128bb0e1241e9bbfab47efa5ed5cf8f4ed0a0a67c9c9d759d0dcf9675158494519bf2bffce332537987c665ec702bf97f

Download Submit
C:\Windows\system\cHFxPsj.exe

Filesize
1.4MB

MD5
b219ddbee86224492cc4d25df1b93777

SHA1
637c16dbe83e911d7083f5ac6e8ae60ae3394e5d

SHA256
8a75cce94c45247a176c10fb8e47f558d122d00eab6f6be29148a6d8698b549e

SHA512
8aa70b3cc3086f7dadd7c50700cf3f6cb8e4d39eeebffe460c70a3c34a1634b8d9d7dc30bbbe62122fbaeaab43ea229be793dc06499cada1f6e6eb727f9bf7be

Download Submit
C:\Windows\system\cfuMoVL.exe

Filesize
1.4MB

MD5
be11adee28ff2464d3c79768752b6aaf

SHA1
a3a121874eb631341ebac285874e8c16e83dc7ee

SHA256
f727c371c67665cafe77ed4bc461bf3cffce44ef7fa99972abb12f12a4d90e42

SHA512
796580bb62319156bc5734616784c500b4f59ba20484df9193c2a73dfdfb9a735724bf1fd78e77d99141f6f50e1ca0d5716374cb9a324e17919570b7a59d40f7

Download Submit
C:\Windows\system\dfqYpxm.exe

Filesize
1.4MB

MD5
220bb08c2e420c26147a34857b0b43a2

SHA1
4006a927c8e76965605248135617efb2f3e36f6e

SHA256
831ef04987e26a08ea6e75b461e8e643505b5c44441d3ea2261561a9e44328c1

SHA512
aaf322661c263a0b36bbce790c9cc56a338da112dcd95a73dc17b432c0b1fd4cfd81a0de873532c3df7699e71b15e69bfdd25c394793719ac92c796a7718f369

Download Submit
C:\Windows\system\gYDajjy.exe

Filesize
1.4MB

MD5
ebcf39df8e304afa2e2f429e21ef5c15

SHA1
f084cdd8e39d21445bfd73e62d3bbc90e8ef151c

SHA256
7e171d80ab9e33a4d1abffdc7fda8282bd978fa8773cdd091453abd7f45557aa

SHA512
b58aec68c0dbc1ba8a9a091432623606309a2661a4b957564d2c4b3ce545e12c4d2ac6e554b96ce67ac3e29919f9058d8cedf77851d16b055994c17118850100

Download Submit
C:\Windows\system\gputZwI.exe

Filesize
1.4MB

MD5
2f30ce9eeaaa7ea41a6606c3521ce056

SHA1
d8b4d483625297da8813f2cddc4c56e3f947077b

SHA256
50006850dbc47003e88ae1450aaa0b4a0ae564f8d87cd4d36503d11c443a4fb1

SHA512
a7c084a3f52fa6eec4e7ce9221b54e2ab4df9bb502d8ad06534e00258429f97d1f9e06ee9f79a9c2c59747f13bebde452b9dcd1094d8357ecc09864fb9aeffdc

Download Submit
C:\Windows\system\hOBAHaV.exe

Filesize
1.4MB

MD5
f6281e4e33450c4d15293008f4414106

SHA1
e58de7296278a1e02eeb7d66b66deb813420e25e

SHA256
7760d4af342e4693de338f28920d833d70d6122ecdbd3c4ba14ffc2b569e9eb7

SHA512
c2f0b2b09e2a655f632f26675c933abfbd9dc8b3453da3e484f4e38ffde2e5ad2f771eec257a0b5fe5305c23f17902b6289df98a85ad1abeeaf1048ac63ff8f7

Download Submit
C:\Windows\system\hUYBCUs.exe

Filesize
1.4MB

MD5
16e6d30454f3cc080cc2680b1ef0499a

SHA1
5acf7188f918e16f6917f8590d2e7edf5604756d

SHA256
d2b3ae93938099b82c63bec0975c2d471181f8dc408e4e90eba1a39fad71c7e6

SHA512
f32ad0f93584dbc58cd125e4901e2d9f377adf4019258d0d2565c58b834cb01a41ade66a07879523c28c74ef0990c7a33ba59f06ea48775fba50450de64d5a7c

Download Submit
C:\Windows\system\iPyNhlo.exe

Filesize
1.4MB

MD5
74369b555d8ae5e894e25721b8cd42d7

SHA1
5ea294e88bf2bd78e7c70b93b9da1bcf217022e6

SHA256
932cd4607894c406fd366b627904823729aa3d1928302d52cfa33bbde2e71063

SHA512
a22b73a4e36160d5d66c2cc088d07daa077a5b36024338178d5dbf956a9409ee1ee650a813f902fd0003c8aa5ccc131e546e202b6e58aa959106674ed61de377

Download Submit
C:\Windows\system\rZrtQIE.exe

Filesize
1.4MB

MD5
5e6123774fe6b352bf58bde9baa71ec8

SHA1
9b79748624f332072e1db350ce8ef0fd2e1d0b3a

SHA256
9a0dc7781dc5ab16a3d3dc400be992162a05e569d1f8a754ab5c1b0e99c82ec8

SHA512
d21a8ef10d57e0ba82aef31d618f58e9e01d8e727d845d1f27e8dda210f1777ce8ee37da85258bb1f1deeff2058f24ad86ec9f9a6e15a5906fc4756edf52aa20

Download Submit
C:\Windows\system\uDJuYTK.exe

Filesize
1.4MB

MD5
96d6e7b09e30a3e67043d57f6a342f4c

SHA1
63a7d7a52b68ba5851817d2a0291057dbbe849f8

SHA256
e83e809c522088c45a8c118a14ad341476478b77f7b45f78d62d4581296d8b1f

SHA512
1673acb8880311264122dd58cdd43fd5aca0757fa3b85c0d160b65fa4b0104085bde2bae1379dc6d3e67fa856caea11a0e0213d37727d79f7dd893caf87a1330

Download Submit
C:\Windows\system\vJBPWBM.exe

Filesize
1.4MB

MD5
2fff45a74e805ab1bef5ce36472f1318

SHA1
4102e4743725a846a9a82ede0a81aa91967c47ef

SHA256
977554e45e81ce548f3da3fd94783b1d0b166e8850bc8fce5c90e6fb9d76e008

SHA512
69d3bd1bb9168cc7cd7e9926e9d6d36aae9c1c2122af1760553ea093783e8b6688a14b8eddc2ae68b155c2d6a4768e4d711af19678719b4606d12afe776f0b04

Download Submit
C:\Windows\system\vkiuJgs.exe

Filesize
1.4MB

MD5
81cea3460b6248b05c8c235b31b1a988

SHA1
302fd3728755c672b84329285b1020a663e2a29c

SHA256
4c104967cbc53dc72546ff8d146d00415d87dc7068cf0bda562717d83f473e06

SHA512
9522e9c1b1031b4268fc8e298ccbcdbdf6749661ceb2b90e0562e9310ded46b016996e2beaf2066a1fe06a7c1c60c13a1a665f82563d46e91998f7351674f696

Download Submit
C:\Windows\system\wlufZbx.exe

Filesize
1.4MB

MD5
456b690dc753267a60536e7d98b27569

SHA1
5a4246a254ef2c1779a8d4b2bec489f09928395c

SHA256
50ce9f6b1f5dbce498eb5f609b7d3910fbad47fdb437bea806c78fb1b0401790

SHA512
a6c642e6a77ad42726b915b0570b951d5159fb05f9a0a4c224bb0c4fdf81e9bfb17dba3586990893d957ed295d44a5fad3b24ba8d0293af89b651d0885270885

Download Submit
C:\Windows\system\xlMffWe.exe

Filesize
1.4MB

MD5
cc15005daefe6cabbb22f966c289ba01

SHA1
5f04b26fa5e1d9738d46d43f3b711c382af57cfa

SHA256
4616c6a8ab31bbc3efbb35bd039d4512fa7ff3734a0a8cd02ea33818e64eb21e

SHA512
deb70b1550fc393cf23a2cd78d7570c181ee844425a0233483bd08b351f45da8fc9be286ebbb1679a25f026fc965dcb1a8591bccc16148b0877a48b1454c7745

Download Submit
\Windows\system\XwAMiZd.exe

Filesize
1.4MB

MD5
0f9d0c6adb68b70ba854ea1ee8fd9720

SHA1
ec4f74062978dc88d2ccfab7b7e348b2452f59d6

SHA256
c4d7776e2ebe5962a5d3ac9c8096088404d645f335cf5d988d9498f645e19813

SHA512
9420bcc7539acfe49ea5e4cd3fff92a300136f280704e2d8425da6c471367a7fd08ece10502bafd0990b0cfa9b51e876680c0897cf12ec176fcdc21f9318eb8c

Download Submit
memory/1968-423-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2080-53-0x00000000034B0000-0x00000000038A2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-39-0x00000000034B0000-0x00000000038A2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-421-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-420-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2080-419-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-418-0x00000000034B0000-0x00000000038A2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2080-81-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2080-41-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2080-47-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-1946-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2080-8-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-36-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2080-0-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2352-58-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2444-48-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-40-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2604-35-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-22-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/2636-31-0x0000000002BB0000-0x0000000002C30000-memory.dmp

Filesize
512KB

Download
memory/2636-30-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2636-34-0x0000000002BB0000-0x0000000002C30000-memory.dmp

Filesize
512KB

Download
memory/2636-428-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2636-33-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2636-38-0x0000000002BB0000-0x0000000002C30000-memory.dmp

Filesize
512KB

Download
memory/2636-25-0x00000000026E0000-0x00000000026E8000-memory.dmp

Filesize
32KB

Download
memory/2884-37-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/3064-13-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download