xmrig | 5c6c80f3a5477beae31bce203422d19bfaf2a575403f65eb67cf92ce0771bed5

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
Size

2.1MB
MD5

0cd385aba84b52d8cf1a91ffe304a5e7
SHA1

7956efb35d06c5ad29467f873d07d1893aef72f6
SHA256

5c6c80f3a5477beae31bce203422d19bfaf2a575403f65eb67cf92ce0771bed5
SHA512

4e0c50f463828d329e955f761f466a6a77d9bcee86b20362601715c74dd6004385a973ba0acaf5991cbf8a954722569aa90804d690a4ba3d47ba48cb125c3f46
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrG0:NAB4

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/2484-175-0x000000013F420000-0x000000013F812000-memory.dmp	xmrig
behavioral1/memory/2648-188-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/808-186-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2960-185-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2948-183-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/1132-182-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2672-181-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2468-179-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2464-177-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2776-172-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2592-169-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2064-9-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2776-4100-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2648-5202-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2592-5242-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2672-5244-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2464-5319-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2960-5690-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/808-5693-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2468-5917-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/3060-6146-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2064	LVorAAO.exe
3060	cJuDALY.exe
2648	nCzhlzs.exe
2592	oZCWceE.exe
2776	JzdgFfZ.exe
2484	upUauCW.exe
2464	VYiEExx.exe
2468	gVuhTQl.exe
2672	asXoTas.exe
2948	DxtHUcD.exe
2960	MtezNPb.exe
808	XIwqDTa.exe
2940	sErJoBj.exe
2476	oaZxUdT.exe
1792	hkHwGjZ.exe
1908	UjNGlko.exe
2292	yPsYpwp.exe
1524	qPXSnEb.exe
1192	OHCslKM.exe
2712	UPjTZNG.exe
2700	QdmiSKo.exe
2816	AkKhUZU.exe
2832	eoSwQlu.exe
1336	LVvJlNh.exe
2204	ApKsbAk.exe
1084	RmmrjNO.exe
2116	uKAmUjn.exe
2092	AxryjSO.exe
1008	vDeoQkN.exe
812	kQVdWnA.exe
640	EnwFsLA.exe
2312	bkkbzPa.exe
1536	ZxeSAuX.exe
1288	giDmcbj.exe
1304	PYeWeeU.exe
768	iPdFqXg.exe
2164	MHhMuuJ.exe
2084	zOVrPkg.exe
1756	jZwMeCJ.exe
1676	lLLKbVH.exe
2916	fmOYmzO.exe
2332	igXCgpD.exe
1720	sOsIdtY.exe
2580	cpuUUiC.exe
2820	glebkkM.exe
2584	eiEsbTx.exe
2480	XpqrSKo.exe
2944	oZVkQRH.exe
2080	GrVfkeR.exe
1448	NSAgSnK.exe
1952	fmSomSy.exe
836	BPyOhPJ.exe
1852	cwGClKM.exe
2872	MrVylXu.exe
988	RclhICR.exe
308	XqCcSlJ.exe
1944	wrXoOHs.exe
2508	hlWwlRW.exe
1396	qsmTRVx.exe
1976	FNXQeCJ.exe
612	uBaUHcB.exe
1252	NCiiFiO.exe
3044	MFpdUwK.exe
1164	HAiVDxo.exe

Loads dropped DLL 64 IoCs

pid	Process
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1132-0-0x000000013F730000-0x000000013FB22000-memory.dmp	upx
behavioral1/files/0x000c0000000144e4-3.dat	upx
behavioral1/files/0x0007000000004e76-20.dat	upx
behavioral1/files/0x003400000001471d-13.dat	upx
behavioral1/files/0x0008000000014baa-33.dat	upx
behavioral1/files/0x000a000000014e51-42.dat	upx
behavioral1/files/0x0006000000015ceb-48.dat	upx
behavioral1/files/0x0007000000015ce1-54.dat	upx
behavioral1/files/0x0006000000015d07-59.dat	upx
behavioral1/files/0x0006000000015d28-63.dat	upx
behavioral1/files/0x0006000000015f6d-123.dat	upx
behavioral1/files/0x0006000000016843-161.dat	upx
behavioral1/files/0x00060000000164b2-144.dat	upx
behavioral1/memory/2484-175-0x000000013F420000-0x000000013F812000-memory.dmp	upx
behavioral1/memory/2648-188-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/808-186-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2960-185-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2948-183-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2672-181-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2468-179-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/2464-177-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2776-172-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2592-169-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/files/0x000600000001661c-168.dat	upx
behavioral1/files/0x00060000000161e7-139.dat	upx
behavioral1/files/0x0006000000016a9a-192.dat	upx
behavioral1/files/0x0006000000016572-153.dat	upx
behavioral1/files/0x0006000000015fe9-128.dat	upx
behavioral1/files/0x00060000000164b2-149.dat	upx
behavioral1/files/0x000600000001630b-142.dat	upx
behavioral1/files/0x0006000000016117-132.dat	upx
behavioral1/files/0x0006000000015eaf-118.dat	upx
behavioral1/files/0x0006000000015d9b-108.dat	upx
behavioral1/files/0x0006000000015e3a-112.dat	upx
behavioral1/files/0x0006000000015d87-98.dat	upx
behavioral1/files/0x0006000000015d8f-103.dat	upx
behavioral1/files/0x0006000000015d79-93.dat	upx
behavioral1/files/0x0006000000015d6f-88.dat	upx
behavioral1/files/0x0006000000015d6f-86.dat	upx
behavioral1/files/0x0006000000015d67-83.dat	upx
behavioral1/files/0x0006000000015d5e-78.dat	upx
behavioral1/files/0x0006000000015d4a-68.dat	upx
behavioral1/files/0x0006000000015d56-73.dat	upx
behavioral1/files/0x000a000000014bea-47.dat	upx
behavioral1/files/0x0007000000014b27-27.dat	upx
behavioral1/memory/3060-25-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2064-9-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2776-4100-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2648-5202-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/2592-5242-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2672-5244-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2464-5319-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2960-5690-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/808-5693-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2468-5917-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/3060-6146-0x000000013F580000-0x000000013F972000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HlDxCkw.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\JTxXDDq.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\pHJKgyo.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\vRozWdA.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\POBTdap.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\YlvrbAE.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\inlgsnc.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\jSFtnww.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\UTvnrjn.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\JPiuqTK.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\dbZrAxd.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\zYrZXwW.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\hFGFWxN.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\iTOQoYw.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\MJBRIPY.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\puGGdLe.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\XEhogly.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\aDeZSVN.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\HEtDIBC.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\QVMRrRk.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\vOGvGuc.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\GymNRdP.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\ginnNAA.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\MPxJFAs.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\XviIImJ.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\fSuUrcj.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\bmVLWmv.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\FCewQLE.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\qtIoJus.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\urXfCqx.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\CtKAEEf.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\jeRFWWs.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\PXclsQj.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\bJyGVZJ.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\yssbLEB.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\sGfwWhp.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\MRfMEpn.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\eQqgzPw.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\OFlKSgq.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\mgHEhDP.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\HTaYsOG.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\AMgxGmW.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\QaffzlC.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\fGmTWLn.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\rejjvUs.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\DBptJAZ.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\bQqveuH.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\ajHdJDF.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\XZoqAkf.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\ryObkLA.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\pwKJCit.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\FXfNRax.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\eiLaGWA.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\xppqGIH.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\peAuXwF.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\CuDzgrx.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\rxEzbXJ.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\DxIjQAf.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\vePzOfu.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\iZNmvgl.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\TldAVPf.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\ayZkWjw.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\RsVYjaR.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
File created	C:\Windows\System\NofeeWU.exe	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1160	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
Token: SeDebugPrivilege	1160	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1160	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	29
PID 1132 wrote to memory of 1160	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	29
PID 1132 wrote to memory of 1160	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	29
PID 1132 wrote to memory of 2064	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	30
PID 1132 wrote to memory of 2064	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	30
PID 1132 wrote to memory of 2064	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	30
PID 1132 wrote to memory of 3060	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	31
PID 1132 wrote to memory of 3060	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	31
PID 1132 wrote to memory of 3060	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	31
PID 1132 wrote to memory of 2648	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	32
PID 1132 wrote to memory of 2648	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	32
PID 1132 wrote to memory of 2648	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	32
PID 1132 wrote to memory of 2592	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	33
PID 1132 wrote to memory of 2592	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	33
PID 1132 wrote to memory of 2592	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	33
PID 1132 wrote to memory of 2776	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	34
PID 1132 wrote to memory of 2776	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	34
PID 1132 wrote to memory of 2776	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	34
PID 1132 wrote to memory of 2464	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	35
PID 1132 wrote to memory of 2464	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	35
PID 1132 wrote to memory of 2464	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	35
PID 1132 wrote to memory of 2484	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	36
PID 1132 wrote to memory of 2484	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	36
PID 1132 wrote to memory of 2484	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	36
PID 1132 wrote to memory of 2672	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	37
PID 1132 wrote to memory of 2672	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	37
PID 1132 wrote to memory of 2672	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	37
PID 1132 wrote to memory of 2468	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	38
PID 1132 wrote to memory of 2468	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	38
PID 1132 wrote to memory of 2468	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	38
PID 1132 wrote to memory of 2948	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	39
PID 1132 wrote to memory of 2948	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	39
PID 1132 wrote to memory of 2948	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	39
PID 1132 wrote to memory of 2960	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	40
PID 1132 wrote to memory of 2960	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	40
PID 1132 wrote to memory of 2960	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	40
PID 1132 wrote to memory of 808	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	41
PID 1132 wrote to memory of 808	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	41
PID 1132 wrote to memory of 808	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	41
PID 1132 wrote to memory of 2940	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	42
PID 1132 wrote to memory of 2940	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	42
PID 1132 wrote to memory of 2940	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	42
PID 1132 wrote to memory of 2476	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	43
PID 1132 wrote to memory of 2476	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	43
PID 1132 wrote to memory of 2476	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	43
PID 1132 wrote to memory of 1792	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	44
PID 1132 wrote to memory of 1792	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	44
PID 1132 wrote to memory of 1792	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	44
PID 1132 wrote to memory of 1908	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	45
PID 1132 wrote to memory of 1908	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	45
PID 1132 wrote to memory of 1908	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	45
PID 1132 wrote to memory of 2292	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	46
PID 1132 wrote to memory of 2292	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	46
PID 1132 wrote to memory of 2292	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	46
PID 1132 wrote to memory of 1524	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	47
PID 1132 wrote to memory of 1524	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	47
PID 1132 wrote to memory of 1524	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	47
PID 1132 wrote to memory of 1192	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	48
PID 1132 wrote to memory of 1192	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	48
PID 1132 wrote to memory of 1192	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	48
PID 1132 wrote to memory of 2712	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	49
PID 1132 wrote to memory of 2712	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	49
PID 1132 wrote to memory of 2712	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	49
PID 1132 wrote to memory of 2700	1132	0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0cd385aba84b52d8cf1a91ffe304a5e7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1160
- C:\Windows\System\LVorAAO.exe
  C:\Windows\System\LVorAAO.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\cJuDALY.exe
  C:\Windows\System\cJuDALY.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\nCzhlzs.exe
  C:\Windows\System\nCzhlzs.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\oZCWceE.exe
  C:\Windows\System\oZCWceE.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\JzdgFfZ.exe
  C:\Windows\System\JzdgFfZ.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\VYiEExx.exe
  C:\Windows\System\VYiEExx.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\upUauCW.exe
  C:\Windows\System\upUauCW.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\asXoTas.exe
  C:\Windows\System\asXoTas.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\gVuhTQl.exe
  C:\Windows\System\gVuhTQl.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\DxtHUcD.exe
  C:\Windows\System\DxtHUcD.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\MtezNPb.exe
  C:\Windows\System\MtezNPb.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\XIwqDTa.exe
  C:\Windows\System\XIwqDTa.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\sErJoBj.exe
  C:\Windows\System\sErJoBj.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\oaZxUdT.exe
  C:\Windows\System\oaZxUdT.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\hkHwGjZ.exe
  C:\Windows\System\hkHwGjZ.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\UjNGlko.exe
  C:\Windows\System\UjNGlko.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\yPsYpwp.exe
  C:\Windows\System\yPsYpwp.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\qPXSnEb.exe
  C:\Windows\System\qPXSnEb.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\OHCslKM.exe
  C:\Windows\System\OHCslKM.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\UPjTZNG.exe
  C:\Windows\System\UPjTZNG.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\QdmiSKo.exe
  C:\Windows\System\QdmiSKo.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\AkKhUZU.exe
  C:\Windows\System\AkKhUZU.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\eoSwQlu.exe
  C:\Windows\System\eoSwQlu.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\LVvJlNh.exe
  C:\Windows\System\LVvJlNh.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\ApKsbAk.exe
  C:\Windows\System\ApKsbAk.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\RmmrjNO.exe
  C:\Windows\System\RmmrjNO.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\uKAmUjn.exe
  C:\Windows\System\uKAmUjn.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\AxryjSO.exe
  C:\Windows\System\AxryjSO.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\vDeoQkN.exe
  C:\Windows\System\vDeoQkN.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\EnwFsLA.exe
  C:\Windows\System\EnwFsLA.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\kQVdWnA.exe
  C:\Windows\System\kQVdWnA.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\bkkbzPa.exe
  C:\Windows\System\bkkbzPa.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\ZxeSAuX.exe
  C:\Windows\System\ZxeSAuX.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\wrXoOHs.exe
  C:\Windows\System\wrXoOHs.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\giDmcbj.exe
  C:\Windows\System\giDmcbj.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\qsmTRVx.exe
  C:\Windows\System\qsmTRVx.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\PYeWeeU.exe
  C:\Windows\System\PYeWeeU.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\FNXQeCJ.exe
  C:\Windows\System\FNXQeCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\iPdFqXg.exe
  C:\Windows\System\iPdFqXg.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\uBaUHcB.exe
  C:\Windows\System\uBaUHcB.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\MHhMuuJ.exe
  C:\Windows\System\MHhMuuJ.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\NCiiFiO.exe
  C:\Windows\System\NCiiFiO.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\zOVrPkg.exe
  C:\Windows\System\zOVrPkg.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\MFpdUwK.exe
  C:\Windows\System\MFpdUwK.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\jZwMeCJ.exe
  C:\Windows\System\jZwMeCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\HAiVDxo.exe
  C:\Windows\System\HAiVDxo.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\lLLKbVH.exe
  C:\Windows\System\lLLKbVH.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\KPAyGHW.exe
  C:\Windows\System\KPAyGHW.exe
  2⤵
  PID:2136
- C:\Windows\System\fmOYmzO.exe
  C:\Windows\System\fmOYmzO.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\HqpPxaQ.exe
  C:\Windows\System\HqpPxaQ.exe
  2⤵
  PID:1256
- C:\Windows\System\igXCgpD.exe
  C:\Windows\System\igXCgpD.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\CvXqsRg.exe
  C:\Windows\System\CvXqsRg.exe
  2⤵
  PID:2012
- C:\Windows\System\sOsIdtY.exe
  C:\Windows\System\sOsIdtY.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\mjHGgaA.exe
  C:\Windows\System\mjHGgaA.exe
  2⤵
  PID:1608
- C:\Windows\System\cpuUUiC.exe
  C:\Windows\System\cpuUUiC.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\EKCdsMm.exe
  C:\Windows\System\EKCdsMm.exe
  2⤵
  PID:2644
- C:\Windows\System\glebkkM.exe
  C:\Windows\System\glebkkM.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\NOwdInO.exe
  C:\Windows\System\NOwdInO.exe
  2⤵
  PID:2512
- C:\Windows\System\eiEsbTx.exe
  C:\Windows\System\eiEsbTx.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\VTcAiOC.exe
  C:\Windows\System\VTcAiOC.exe
  2⤵
  PID:2736
- C:\Windows\System\XpqrSKo.exe
  C:\Windows\System\XpqrSKo.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\wRjuHUc.exe
  C:\Windows\System\wRjuHUc.exe
  2⤵
  PID:2980
- C:\Windows\System\oZVkQRH.exe
  C:\Windows\System\oZVkQRH.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\QAYrpHR.exe
  C:\Windows\System\QAYrpHR.exe
  2⤵
  PID:2984
- C:\Windows\System\GrVfkeR.exe
  C:\Windows\System\GrVfkeR.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\WjibFDO.exe
  C:\Windows\System\WjibFDO.exe
  2⤵
  PID:2424
- C:\Windows\System\NSAgSnK.exe
  C:\Windows\System\NSAgSnK.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\vHtAxtX.exe
  C:\Windows\System\vHtAxtX.exe
  2⤵
  PID:2724
- C:\Windows\System\fmSomSy.exe
  C:\Windows\System\fmSomSy.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\clirMNO.exe
  C:\Windows\System\clirMNO.exe
  2⤵
  PID:1312
- C:\Windows\System\BPyOhPJ.exe
  C:\Windows\System\BPyOhPJ.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\cqnDNDm.exe
  C:\Windows\System\cqnDNDm.exe
  2⤵
  PID:2216
- C:\Windows\System\cwGClKM.exe
  C:\Windows\System\cwGClKM.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\EWFomkM.exe
  C:\Windows\System\EWFomkM.exe
  2⤵
  PID:588
- C:\Windows\System\MrVylXu.exe
  C:\Windows\System\MrVylXu.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\EnxtBZl.exe
  C:\Windows\System\EnxtBZl.exe
  2⤵
  PID:1596
- C:\Windows\System\RclhICR.exe
  C:\Windows\System\RclhICR.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\WLEpirX.exe
  C:\Windows\System\WLEpirX.exe
  2⤵
  PID:2840
- C:\Windows\System\XqCcSlJ.exe
  C:\Windows\System\XqCcSlJ.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\wFkMwfy.exe
  C:\Windows\System\wFkMwfy.exe
  2⤵
  PID:2616
- C:\Windows\System\hlWwlRW.exe
  C:\Windows\System\hlWwlRW.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\BvpkZBg.exe
  C:\Windows\System\BvpkZBg.exe
  2⤵
  PID:696
- C:\Windows\System\UQUPVxm.exe
  C:\Windows\System\UQUPVxm.exe
  2⤵
  PID:1784
- C:\Windows\System\VXCqJUt.exe
  C:\Windows\System\VXCqJUt.exe
  2⤵
  PID:272
- C:\Windows\System\VVpcchf.exe
  C:\Windows\System\VVpcchf.exe
  2⤵
  PID:2552
- C:\Windows\System\mgHEhDP.exe
  C:\Windows\System\mgHEhDP.exe
  2⤵
  PID:2352
- C:\Windows\System\SWSlAxY.exe
  C:\Windows\System\SWSlAxY.exe
  2⤵
  PID:1804
- C:\Windows\System\JBhjozZ.exe
  C:\Windows\System\JBhjozZ.exe
  2⤵
  PID:2488
- C:\Windows\System\ySkzvQZ.exe
  C:\Windows\System\ySkzvQZ.exe
  2⤵
  PID:704
- C:\Windows\System\YmJvrPf.exe
  C:\Windows\System\YmJvrPf.exe
  2⤵
  PID:1888
- C:\Windows\System\LYmZPAt.exe
  C:\Windows\System\LYmZPAt.exe
  2⤵
  PID:876
- C:\Windows\System\flOieLt.exe
  C:\Windows\System\flOieLt.exe
  2⤵
  PID:1604
- C:\Windows\System\JGRKxiR.exe
  C:\Windows\System\JGRKxiR.exe
  2⤵
  PID:2072
- C:\Windows\System\vQpGAkX.exe
  C:\Windows\System\vQpGAkX.exe
  2⤵
  PID:3004
- C:\Windows\System\DhdRyvq.exe
  C:\Windows\System\DhdRyvq.exe
  2⤵
  PID:2692
- C:\Windows\System\zLILytF.exe
  C:\Windows\System\zLILytF.exe
  2⤵
  PID:1248
- C:\Windows\System\vkPLnno.exe
  C:\Windows\System\vkPLnno.exe
  2⤵
  PID:1532
- C:\Windows\System\RrFrsSB.exe
  C:\Windows\System\RrFrsSB.exe
  2⤵
  PID:2272
- C:\Windows\System\mYnAVrf.exe
  C:\Windows\System\mYnAVrf.exe
  2⤵
  PID:2492
- C:\Windows\System\gneiZuS.exe
  C:\Windows\System\gneiZuS.exe
  2⤵
  PID:2228
- C:\Windows\System\GvHeCyy.exe
  C:\Windows\System\GvHeCyy.exe
  2⤵
  PID:1504
- C:\Windows\System\qvQRekA.exe
  C:\Windows\System\qvQRekA.exe
  2⤵
  PID:1716
- C:\Windows\System\eUmxeYu.exe
  C:\Windows\System\eUmxeYu.exe
  2⤵
  PID:2576
- C:\Windows\System\rRbOJIT.exe
  C:\Windows\System\rRbOJIT.exe
  2⤵
  PID:324
- C:\Windows\System\ElodRbA.exe
  C:\Windows\System\ElodRbA.exe
  2⤵
  PID:1508
- C:\Windows\System\LbSIFTR.exe
  C:\Windows\System\LbSIFTR.exe
  2⤵
  PID:868
- C:\Windows\System\zMYbqVE.exe
  C:\Windows\System\zMYbqVE.exe
  2⤵
  PID:2540
- C:\Windows\System\SzsLASN.exe
  C:\Windows\System\SzsLASN.exe
  2⤵
  PID:2696
- C:\Windows\System\HgfWyPi.exe
  C:\Windows\System\HgfWyPi.exe
  2⤵
  PID:1340
- C:\Windows\System\VsDwiXI.exe
  C:\Windows\System\VsDwiXI.exe
  2⤵
  PID:2412
- C:\Windows\System\WBLHepJ.exe
  C:\Windows\System\WBLHepJ.exe
  2⤵
  PID:2896
- C:\Windows\System\ntyQPbR.exe
  C:\Windows\System\ntyQPbR.exe
  2⤵
  PID:2432
- C:\Windows\System\NhwZdmt.exe
  C:\Windows\System\NhwZdmt.exe
  2⤵
  PID:1868
- C:\Windows\System\VcgIPBr.exe
  C:\Windows\System\VcgIPBr.exe
  2⤵
  PID:2100
- C:\Windows\System\XuXUxXg.exe
  C:\Windows\System\XuXUxXg.exe
  2⤵
  PID:1572
- C:\Windows\System\VLrHLXY.exe
  C:\Windows\System\VLrHLXY.exe
  2⤵
  PID:1808
- C:\Windows\System\PqHWhtI.exe
  C:\Windows\System\PqHWhtI.exe
  2⤵
  PID:1728
- C:\Windows\System\LgGqbbl.exe
  C:\Windows\System\LgGqbbl.exe
  2⤵
  PID:2448
- C:\Windows\System\haMlBGc.exe
  C:\Windows\System\haMlBGc.exe
  2⤵
  PID:1712
- C:\Windows\System\GwRCwVe.exe
  C:\Windows\System\GwRCwVe.exe
  2⤵
  PID:3088
- C:\Windows\System\ywbEZkK.exe
  C:\Windows\System\ywbEZkK.exe
  2⤵
  PID:3104
- C:\Windows\System\ZKyKrJM.exe
  C:\Windows\System\ZKyKrJM.exe
  2⤵
  PID:3188
- C:\Windows\System\tQqrMFs.exe
  C:\Windows\System\tQqrMFs.exe
  2⤵
  PID:3212
- C:\Windows\System\wKBrDfd.exe
  C:\Windows\System\wKBrDfd.exe
  2⤵
  PID:3228
- C:\Windows\System\AtngzTu.exe
  C:\Windows\System\AtngzTu.exe
  2⤵
  PID:3244
- C:\Windows\System\MNrXgBa.exe
  C:\Windows\System\MNrXgBa.exe
  2⤵
  PID:3264
- C:\Windows\System\pPGhQTH.exe
  C:\Windows\System\pPGhQTH.exe
  2⤵
  PID:3280
- C:\Windows\System\xnsjOOF.exe
  C:\Windows\System\xnsjOOF.exe
  2⤵
  PID:3296
- C:\Windows\System\GDHqqhH.exe
  C:\Windows\System\GDHqqhH.exe
  2⤵
  PID:3316
- C:\Windows\System\TNRIHhZ.exe
  C:\Windows\System\TNRIHhZ.exe
  2⤵
  PID:3336
- C:\Windows\System\HTaYsOG.exe
  C:\Windows\System\HTaYsOG.exe
  2⤵
  PID:3352
- C:\Windows\System\HnCcJpp.exe
  C:\Windows\System\HnCcJpp.exe
  2⤵
  PID:3368
- C:\Windows\System\EpMZZEp.exe
  C:\Windows\System\EpMZZEp.exe
  2⤵
  PID:3388
- C:\Windows\System\bDPCTNP.exe
  C:\Windows\System\bDPCTNP.exe
  2⤵
  PID:3404
- C:\Windows\System\SPNlOhP.exe
  C:\Windows\System\SPNlOhP.exe
  2⤵
  PID:3420
- C:\Windows\System\AcmsAnS.exe
  C:\Windows\System\AcmsAnS.exe
  2⤵
  PID:3436
- C:\Windows\System\pCLfWre.exe
  C:\Windows\System\pCLfWre.exe
  2⤵
  PID:3452
- C:\Windows\System\LyMyuOw.exe
  C:\Windows\System\LyMyuOw.exe
  2⤵
  PID:3468
- C:\Windows\System\qKMLKpX.exe
  C:\Windows\System\qKMLKpX.exe
  2⤵
  PID:3484
- C:\Windows\System\OlnaxPt.exe
  C:\Windows\System\OlnaxPt.exe
  2⤵
  PID:3504
- C:\Windows\System\dNOVEKI.exe
  C:\Windows\System\dNOVEKI.exe
  2⤵
  PID:3520
- C:\Windows\System\piwQSpX.exe
  C:\Windows\System\piwQSpX.exe
  2⤵
  PID:3536
- C:\Windows\System\KJKDIfR.exe
  C:\Windows\System\KJKDIfR.exe
  2⤵
  PID:3552
- C:\Windows\System\TnjvzXu.exe
  C:\Windows\System\TnjvzXu.exe
  2⤵
  PID:3568
- C:\Windows\System\eBFjbNW.exe
  C:\Windows\System\eBFjbNW.exe
  2⤵
  PID:3584
- C:\Windows\System\SvaAcvd.exe
  C:\Windows\System\SvaAcvd.exe
  2⤵
  PID:3604
- C:\Windows\System\sodsiCO.exe
  C:\Windows\System\sodsiCO.exe
  2⤵
  PID:3620
- C:\Windows\System\PVaVLkX.exe
  C:\Windows\System\PVaVLkX.exe
  2⤵
  PID:3636
- C:\Windows\System\dyWmLFD.exe
  C:\Windows\System\dyWmLFD.exe
  2⤵
  PID:3652
- C:\Windows\System\BuumEle.exe
  C:\Windows\System\BuumEle.exe
  2⤵
  PID:3668
- C:\Windows\System\geEBjCl.exe
  C:\Windows\System\geEBjCl.exe
  2⤵
  PID:3688
- C:\Windows\System\OhyKkjM.exe
  C:\Windows\System\OhyKkjM.exe
  2⤵
  PID:3704
- C:\Windows\System\QUQcGlu.exe
  C:\Windows\System\QUQcGlu.exe
  2⤵
  PID:3720
- C:\Windows\System\BGfRluC.exe
  C:\Windows\System\BGfRluC.exe
  2⤵
  PID:3736
- C:\Windows\System\bCPgaLS.exe
  C:\Windows\System\bCPgaLS.exe
  2⤵
  PID:3752
- C:\Windows\System\yHWQwkb.exe
  C:\Windows\System\yHWQwkb.exe
  2⤵
  PID:3772
- C:\Windows\System\CUIJPib.exe
  C:\Windows\System\CUIJPib.exe
  2⤵
  PID:3788
- C:\Windows\System\bggBOJe.exe
  C:\Windows\System\bggBOJe.exe
  2⤵
  PID:3804
- C:\Windows\System\qAPzlHc.exe
  C:\Windows\System\qAPzlHc.exe
  2⤵
  PID:3820
- C:\Windows\System\GHHfyVW.exe
  C:\Windows\System\GHHfyVW.exe
  2⤵
  PID:3840
- C:\Windows\System\ddGXcUQ.exe
  C:\Windows\System\ddGXcUQ.exe
  2⤵
  PID:3856
- C:\Windows\System\praHivf.exe
  C:\Windows\System\praHivf.exe
  2⤵
  PID:3872
- C:\Windows\System\fCqKYwx.exe
  C:\Windows\System\fCqKYwx.exe
  2⤵
  PID:3888
- C:\Windows\System\ipwUAsy.exe
  C:\Windows\System\ipwUAsy.exe
  2⤵
  PID:3904
- C:\Windows\System\wjokLoF.exe
  C:\Windows\System\wjokLoF.exe
  2⤵
  PID:3920
- C:\Windows\System\raTVrWC.exe
  C:\Windows\System\raTVrWC.exe
  2⤵
  PID:3936
- C:\Windows\System\nzIIEWE.exe
  C:\Windows\System\nzIIEWE.exe
  2⤵
  PID:3956
- C:\Windows\System\TBZmoOV.exe
  C:\Windows\System\TBZmoOV.exe
  2⤵
  PID:3972
- C:\Windows\System\CyEZspG.exe
  C:\Windows\System\CyEZspG.exe
  2⤵
  PID:3988
- C:\Windows\System\EUoDXql.exe
  C:\Windows\System\EUoDXql.exe
  2⤵
  PID:4004
- C:\Windows\System\WXvMVUW.exe
  C:\Windows\System\WXvMVUW.exe
  2⤵
  PID:4020
- C:\Windows\System\ZDhgJkF.exe
  C:\Windows\System\ZDhgJkF.exe
  2⤵
  PID:4040
- C:\Windows\System\veCmrJQ.exe
  C:\Windows\System\veCmrJQ.exe
  2⤵
  PID:4056
- C:\Windows\System\EzynENb.exe
  C:\Windows\System\EzynENb.exe
  2⤵
  PID:4072
- C:\Windows\System\fZwjDVP.exe
  C:\Windows\System\fZwjDVP.exe
  2⤵
  PID:4088
- C:\Windows\System\gnBEVIB.exe
  C:\Windows\System\gnBEVIB.exe
  2⤵
  PID:560
- C:\Windows\System\HZcFrcP.exe
  C:\Windows\System\HZcFrcP.exe
  2⤵
  PID:3040
- C:\Windows\System\pCDSLjr.exe
  C:\Windows\System\pCDSLjr.exe
  2⤵
  PID:2264
- C:\Windows\System\mlSbiHr.exe
  C:\Windows\System\mlSbiHr.exe
  2⤵
  PID:2528
- C:\Windows\System\SiQzBZE.exe
  C:\Windows\System\SiQzBZE.exe
  2⤵
  PID:1620
- C:\Windows\System\UjMZaKF.exe
  C:\Windows\System\UjMZaKF.exe
  2⤵
  PID:3116
- C:\Windows\System\YUeSyPF.exe
  C:\Windows\System\YUeSyPF.exe
  2⤵
  PID:2588
- C:\Windows\System\jeRghjQ.exe
  C:\Windows\System\jeRghjQ.exe
  2⤵
  PID:2320
- C:\Windows\System\qyUQocD.exe
  C:\Windows\System\qyUQocD.exe
  2⤵
  PID:3132
- C:\Windows\System\sxdlBxn.exe
  C:\Windows\System\sxdlBxn.exe
  2⤵
  PID:3148
- C:\Windows\System\LtkkquE.exe
  C:\Windows\System\LtkkquE.exe
  2⤵
  PID:3164
- C:\Windows\System\GRLcVmd.exe
  C:\Windows\System\GRLcVmd.exe
  2⤵
  PID:540
- C:\Windows\System\MTINCgr.exe
  C:\Windows\System\MTINCgr.exe
  2⤵
  PID:2836
- C:\Windows\System\EioFhvf.exe
  C:\Windows\System\EioFhvf.exe
  2⤵
  PID:1752
- C:\Windows\System\cQAuvqZ.exe
  C:\Windows\System\cQAuvqZ.exe
  2⤵
  PID:1188
- C:\Windows\System\GzlRKJW.exe
  C:\Windows\System\GzlRKJW.exe
  2⤵
  PID:1152
- C:\Windows\System\JuTIorX.exe
  C:\Windows\System\JuTIorX.exe
  2⤵
  PID:2848
- C:\Windows\System\naiomot.exe
  C:\Windows\System\naiomot.exe
  2⤵
  PID:3100
- C:\Windows\System\qjQLVty.exe
  C:\Windows\System\qjQLVty.exe
  2⤵
  PID:3180
- C:\Windows\System\vbPWHyb.exe
  C:\Windows\System\vbPWHyb.exe
  2⤵
  PID:3252
- C:\Windows\System\sdBQMRH.exe
  C:\Windows\System\sdBQMRH.exe
  2⤵
  PID:1048
- C:\Windows\System\jMcwIvq.exe
  C:\Windows\System\jMcwIvq.exe
  2⤵
  PID:3240
- C:\Windows\System\uEzjkpv.exe
  C:\Windows\System\uEzjkpv.exe
  2⤵
  PID:3324
- C:\Windows\System\OtactSF.exe
  C:\Windows\System\OtactSF.exe
  2⤵
  PID:3292
- C:\Windows\System\PGCynIM.exe
  C:\Windows\System\PGCynIM.exe
  2⤵
  PID:3364
- C:\Windows\System\buCKuFg.exe
  C:\Windows\System\buCKuFg.exe
  2⤵
  PID:3432
- C:\Windows\System\FXfNRax.exe
  C:\Windows\System\FXfNRax.exe
  2⤵
  PID:3304
- C:\Windows\System\awaBbZF.exe
  C:\Windows\System\awaBbZF.exe
  2⤵
  PID:3412
- C:\Windows\System\RMSPItg.exe
  C:\Windows\System\RMSPItg.exe
  2⤵
  PID:4112
- C:\Windows\System\wJDjdYp.exe
  C:\Windows\System\wJDjdYp.exe
  2⤵
  PID:4128
- C:\Windows\System\gDyiBTG.exe
  C:\Windows\System\gDyiBTG.exe
  2⤵
  PID:4144
- C:\Windows\System\yaEVhOE.exe
  C:\Windows\System\yaEVhOE.exe
  2⤵
  PID:4160
- C:\Windows\System\RFlYAuz.exe
  C:\Windows\System\RFlYAuz.exe
  2⤵
  PID:4176
- C:\Windows\System\mvqsQmC.exe
  C:\Windows\System\mvqsQmC.exe
  2⤵
  PID:4196
- C:\Windows\System\CXXQIAN.exe
  C:\Windows\System\CXXQIAN.exe
  2⤵
  PID:4212
- C:\Windows\System\KlqtMZz.exe
  C:\Windows\System\KlqtMZz.exe
  2⤵
  PID:4228
- C:\Windows\System\NosmBEl.exe
  C:\Windows\System\NosmBEl.exe
  2⤵
  PID:4244
- C:\Windows\System\QKYCSEF.exe
  C:\Windows\System\QKYCSEF.exe
  2⤵
  PID:4260
- C:\Windows\System\RKvbBAg.exe
  C:\Windows\System\RKvbBAg.exe
  2⤵
  PID:4276
- C:\Windows\System\KNnwweK.exe
  C:\Windows\System\KNnwweK.exe
  2⤵
  PID:4296
- C:\Windows\System\uZPnREA.exe
  C:\Windows\System\uZPnREA.exe
  2⤵
  PID:4312
- C:\Windows\System\ngiADNv.exe
  C:\Windows\System\ngiADNv.exe
  2⤵
  PID:4328
- C:\Windows\System\RFEDvkS.exe
  C:\Windows\System\RFEDvkS.exe
  2⤵
  PID:4344
- C:\Windows\System\dHtZyxc.exe
  C:\Windows\System\dHtZyxc.exe
  2⤵
  PID:4360
- C:\Windows\System\uWUmtpF.exe
  C:\Windows\System\uWUmtpF.exe
  2⤵
  PID:4376
- C:\Windows\System\VTTltcW.exe
  C:\Windows\System\VTTltcW.exe
  2⤵
  PID:4452
- C:\Windows\System\cqMcnmU.exe
  C:\Windows\System\cqMcnmU.exe
  2⤵
  PID:4468
- C:\Windows\System\WVjtDUp.exe
  C:\Windows\System\WVjtDUp.exe
  2⤵
  PID:4484
- C:\Windows\System\rGXpmXU.exe
  C:\Windows\System\rGXpmXU.exe
  2⤵
  PID:4500
- C:\Windows\System\IJePUlA.exe
  C:\Windows\System\IJePUlA.exe
  2⤵
  PID:4516
- C:\Windows\System\TYfUtXr.exe
  C:\Windows\System\TYfUtXr.exe
  2⤵
  PID:4532
- C:\Windows\System\iZNmvgl.exe
  C:\Windows\System\iZNmvgl.exe
  2⤵
  PID:4548
- C:\Windows\System\okDCWCW.exe
  C:\Windows\System\okDCWCW.exe
  2⤵
  PID:4564
- C:\Windows\System\gOwTAJX.exe
  C:\Windows\System\gOwTAJX.exe
  2⤵
  PID:4580
- C:\Windows\System\xYfEUVN.exe
  C:\Windows\System\xYfEUVN.exe
  2⤵
  PID:4596
- C:\Windows\System\EQTuhPW.exe
  C:\Windows\System\EQTuhPW.exe
  2⤵
  PID:4612
- C:\Windows\System\itGywny.exe
  C:\Windows\System\itGywny.exe
  2⤵
  PID:4628
- C:\Windows\System\QZugxbv.exe
  C:\Windows\System\QZugxbv.exe
  2⤵
  PID:4644
- C:\Windows\System\Qhbmdnn.exe
  C:\Windows\System\Qhbmdnn.exe
  2⤵
  PID:4660
- C:\Windows\System\culaJll.exe
  C:\Windows\System\culaJll.exe
  2⤵
  PID:4676
- C:\Windows\System\AKnAWGM.exe
  C:\Windows\System\AKnAWGM.exe
  2⤵
  PID:4692
- C:\Windows\System\pNdSAys.exe
  C:\Windows\System\pNdSAys.exe
  2⤵
  PID:4708
- C:\Windows\System\kLjAczC.exe
  C:\Windows\System\kLjAczC.exe
  2⤵
  PID:4724
- C:\Windows\System\RQfzbNR.exe
  C:\Windows\System\RQfzbNR.exe
  2⤵
  PID:4740
- C:\Windows\System\niDZjIX.exe
  C:\Windows\System\niDZjIX.exe
  2⤵
  PID:4756
- C:\Windows\System\fMKcPvV.exe
  C:\Windows\System\fMKcPvV.exe
  2⤵
  PID:4772
- C:\Windows\System\YcOdPqu.exe
  C:\Windows\System\YcOdPqu.exe
  2⤵
  PID:4788
- C:\Windows\System\kftnUtb.exe
  C:\Windows\System\kftnUtb.exe
  2⤵
  PID:4804
- C:\Windows\System\uTDuWrY.exe
  C:\Windows\System\uTDuWrY.exe
  2⤵
  PID:4820
- C:\Windows\System\cfWNnCf.exe
  C:\Windows\System\cfWNnCf.exe
  2⤵
  PID:4836
- C:\Windows\System\zZXJrzW.exe
  C:\Windows\System\zZXJrzW.exe
  2⤵
  PID:4852
- C:\Windows\System\pPTTMDd.exe
  C:\Windows\System\pPTTMDd.exe
  2⤵
  PID:4868
- C:\Windows\System\ZVffFhO.exe
  C:\Windows\System\ZVffFhO.exe
  2⤵
  PID:4884
- C:\Windows\System\TxFlcJv.exe
  C:\Windows\System\TxFlcJv.exe
  2⤵
  PID:4900
- C:\Windows\System\pRtnaNt.exe
  C:\Windows\System\pRtnaNt.exe
  2⤵
  PID:4916
- C:\Windows\System\xPUpDMw.exe
  C:\Windows\System\xPUpDMw.exe
  2⤵
  PID:4932
- C:\Windows\System\AqpeglV.exe
  C:\Windows\System\AqpeglV.exe
  2⤵
  PID:4948
- C:\Windows\System\TGpsTUl.exe
  C:\Windows\System\TGpsTUl.exe
  2⤵
  PID:4964
- C:\Windows\System\xNDxJjT.exe
  C:\Windows\System\xNDxJjT.exe
  2⤵
  PID:4980
- C:\Windows\System\gtZArwZ.exe
  C:\Windows\System\gtZArwZ.exe
  2⤵
  PID:4996
- C:\Windows\System\gKKqHum.exe
  C:\Windows\System\gKKqHum.exe
  2⤵
  PID:5012
- C:\Windows\System\kGTZBTT.exe
  C:\Windows\System\kGTZBTT.exe
  2⤵
  PID:5028
- C:\Windows\System\whzOUsR.exe
  C:\Windows\System\whzOUsR.exe
  2⤵
  PID:5044
- C:\Windows\System\ZsAoOZN.exe
  C:\Windows\System\ZsAoOZN.exe
  2⤵
  PID:5060
- C:\Windows\System\JlJqdld.exe
  C:\Windows\System\JlJqdld.exe
  2⤵
  PID:5076
- C:\Windows\System\tkArIVg.exe
  C:\Windows\System\tkArIVg.exe
  2⤵
  PID:5092
- C:\Windows\System\HzocbyD.exe
  C:\Windows\System\HzocbyD.exe
  2⤵
  PID:5108
- C:\Windows\System\EBMlggD.exe
  C:\Windows\System\EBMlggD.exe
  2⤵
  PID:3476
- C:\Windows\System\pQkJbvb.exe
  C:\Windows\System\pQkJbvb.exe
  2⤵
  PID:3500
- C:\Windows\System\lUjZoCV.exe
  C:\Windows\System\lUjZoCV.exe
  2⤵
  PID:3564
- C:\Windows\System\KIFeSdn.exe
  C:\Windows\System\KIFeSdn.exe
  2⤵
  PID:3204
- C:\Windows\System\lDwXmLy.exe
  C:\Windows\System\lDwXmLy.exe
  2⤵
  PID:3732
- C:\Windows\System\AZXzefD.exe
  C:\Windows\System\AZXzefD.exe
  2⤵
  PID:3796
- C:\Windows\System\BKkKzcH.exe
  C:\Windows\System\BKkKzcH.exe
  2⤵
  PID:3828
- C:\Windows\System\ouhXfBd.exe
  C:\Windows\System\ouhXfBd.exe
  2⤵
  PID:3896
- C:\Windows\System\CKsGYoQ.exe
  C:\Windows\System\CKsGYoQ.exe
  2⤵
  PID:3964
- C:\Windows\System\ZEPFMPR.exe
  C:\Windows\System\ZEPFMPR.exe
  2⤵
  PID:3644
- C:\Windows\System\ojQZwHe.exe
  C:\Windows\System\ojQZwHe.exe
  2⤵
  PID:3712
- C:\Windows\System\QAwygru.exe
  C:\Windows\System\QAwygru.exe
  2⤵
  PID:3748
- C:\Windows\System\Udfofuy.exe
  C:\Windows\System\Udfofuy.exe
  2⤵
  PID:3848
- C:\Windows\System\lqorpEm.exe
  C:\Windows\System\lqorpEm.exe
  2⤵
  PID:3912
- C:\Windows\System\NaRzutY.exe
  C:\Windows\System\NaRzutY.exe
  2⤵
  PID:3952
- C:\Windows\System\RERXWiq.exe
  C:\Windows\System\RERXWiq.exe
  2⤵
  PID:4016
- C:\Windows\System\IZsOAvO.exe
  C:\Windows\System\IZsOAvO.exe
  2⤵
  PID:4080
- C:\Windows\System\ENIMmsp.exe
  C:\Windows\System\ENIMmsp.exe
  2⤵
  PID:880
- C:\Windows\System\CrVUzGL.exe
  C:\Windows\System\CrVUzGL.exe
  2⤵
  PID:3008
- C:\Windows\System\LeOLdYo.exe
  C:\Windows\System\LeOLdYo.exe
  2⤵
  PID:1576
- C:\Windows\System\OhJvelX.exe
  C:\Windows\System\OhJvelX.exe
  2⤵
  PID:300
- C:\Windows\System\iIYScXH.exe
  C:\Windows\System\iIYScXH.exe
  2⤵
  PID:2628
- C:\Windows\System\LRJKHJz.exe
  C:\Windows\System\LRJKHJz.exe
  2⤵
  PID:3428
- C:\Windows\System\hOyyGPB.exe
  C:\Windows\System\hOyyGPB.exe
  2⤵
  PID:4124
- C:\Windows\System\WkwGXcu.exe
  C:\Windows\System\WkwGXcu.exe
  2⤵
  PID:4188
- C:\Windows\System\PWeofMA.exe
  C:\Windows\System\PWeofMA.exe
  2⤵
  PID:4252
- C:\Windows\System\ASYqKWI.exe
  C:\Windows\System\ASYqKWI.exe
  2⤵
  PID:4292
- C:\Windows\System\gsAGwQA.exe
  C:\Windows\System\gsAGwQA.exe
  2⤵
  PID:4356
- C:\Windows\System\wYHrqhP.exe
  C:\Windows\System\wYHrqhP.exe
  2⤵
  PID:3480
- C:\Windows\System\IBwOHkl.exe
  C:\Windows\System\IBwOHkl.exe
  2⤵
  PID:4404
- C:\Windows\System\TVcrOjN.exe
  C:\Windows\System\TVcrOjN.exe
  2⤵
  PID:4420
- C:\Windows\System\HcRCHXT.exe
  C:\Windows\System\HcRCHXT.exe
  2⤵
  PID:4436
- C:\Windows\System\GXgypxP.exe
  C:\Windows\System\GXgypxP.exe
  2⤵
  PID:4460
- C:\Windows\System\byqQQFU.exe
  C:\Windows\System\byqQQFU.exe
  2⤵
  PID:2608
- C:\Windows\System\GSJuYAZ.exe
  C:\Windows\System\GSJuYAZ.exe
  2⤵
  PID:4496
- C:\Windows\System\iCtbYzK.exe
  C:\Windows\System\iCtbYzK.exe
  2⤵
  PID:4560
- C:\Windows\System\lJzVBwy.exe
  C:\Windows\System\lJzVBwy.exe
  2⤵
  PID:4912
- C:\Windows\System\nqrYpcO.exe
  C:\Windows\System\nqrYpcO.exe
  2⤵
  PID:4976
- C:\Windows\System\JQvweFV.exe
  C:\Windows\System\JQvweFV.exe
  2⤵
  PID:5040
- C:\Windows\System\cZhZLhd.exe
  C:\Windows\System\cZhZLhd.exe
  2⤵
  PID:5104
- C:\Windows\System\AMgxGmW.exe
  C:\Windows\System\AMgxGmW.exe
  2⤵
  PID:3496
- C:\Windows\System\tEZnTWq.exe
  C:\Windows\System\tEZnTWq.exe
  2⤵
  PID:4508
- C:\Windows\System\KlJvfaG.exe
  C:\Windows\System\KlJvfaG.exe
  2⤵
  PID:4572
- C:\Windows\System\eeJuHQG.exe
  C:\Windows\System\eeJuHQG.exe
  2⤵
  PID:4924
- C:\Windows\System\JGvofNt.exe
  C:\Windows\System\JGvofNt.exe
  2⤵
  PID:4988
- C:\Windows\System\EynotRn.exe
  C:\Windows\System\EynotRn.exe
  2⤵
  PID:2828
- C:\Windows\System\LcznFtU.exe
  C:\Windows\System\LcznFtU.exe
  2⤵
  PID:2952
- C:\Windows\System\RAyTSIt.exe
  C:\Windows\System\RAyTSIt.exe
  2⤵
  PID:636
- C:\Windows\System\sjixFAt.exe
  C:\Windows\System\sjixFAt.exe
  2⤵
  PID:3928
- C:\Windows\System\bvqbboe.exe
  C:\Windows\System\bvqbboe.exe
  2⤵
  PID:3812
- C:\Windows\System\TGnMNqw.exe
  C:\Windows\System\TGnMNqw.exe
  2⤵
  PID:3948
- C:\Windows\System\sWSzHeI.exe
  C:\Windows\System\sWSzHeI.exe
  2⤵
  PID:3832
- C:\Windows\System\PJpQCVc.exe
  C:\Windows\System\PJpQCVc.exe
  2⤵
  PID:4028
- C:\Windows\System\xPrWVST.exe
  C:\Windows\System\xPrWVST.exe
  2⤵
  PID:4068
- C:\Windows\System\MvtgagF.exe
  C:\Windows\System\MvtgagF.exe
  2⤵
  PID:3380
- C:\Windows\System\XwAuyEU.exe
  C:\Windows\System\XwAuyEU.exe
  2⤵
  PID:2868
- C:\Windows\System\bBXaOag.exe
  C:\Windows\System\bBXaOag.exe
  2⤵
  PID:4604
- C:\Windows\System\xppqGIH.exe
  C:\Windows\System\xppqGIH.exe
  2⤵
  PID:2624
- C:\Windows\System\mRuNTuV.exe
  C:\Windows\System\mRuNTuV.exe
  2⤵
  PID:3160
- C:\Windows\System\kkVTUwF.exe
  C:\Windows\System\kkVTUwF.exe
  2⤵
  PID:2156
- C:\Windows\System\HkswSJq.exe
  C:\Windows\System\HkswSJq.exe
  2⤵
  PID:1300
- C:\Windows\System\OIfspRq.exe
  C:\Windows\System\OIfspRq.exe
  2⤵
  PID:3360
- C:\Windows\System\JngEUcA.exe
  C:\Windows\System\JngEUcA.exe
  2⤵
  PID:4104
- C:\Windows\System\PoeTOub.exe
  C:\Windows\System\PoeTOub.exe
  2⤵
  PID:4832
- C:\Windows\System\ufkmMaQ.exe
  C:\Windows\System\ufkmMaQ.exe
  2⤵
  PID:4284
- C:\Windows\System\iKPKURs.exe
  C:\Windows\System\iKPKURs.exe
  2⤵
  PID:2600
- C:\Windows\System\XcdDNcW.exe
  C:\Windows\System\XcdDNcW.exe
  2⤵
  PID:3260
- C:\Windows\System\GlfDHFE.exe
  C:\Windows\System\GlfDHFE.exe
  2⤵
  PID:4492
- C:\Windows\System\TKpPgvX.exe
  C:\Windows\System\TKpPgvX.exe
  2⤵
  PID:4172
- C:\Windows\System\ENGiGFZ.exe
  C:\Windows\System\ENGiGFZ.exe
  2⤵
  PID:4208
- C:\Windows\System\tzEqNyQ.exe
  C:\Windows\System\tzEqNyQ.exe
  2⤵
  PID:4336
- C:\Windows\System\JIOPIPj.exe
  C:\Windows\System\JIOPIPj.exe
  2⤵
  PID:4368
- C:\Windows\System\jkSCOHq.exe
  C:\Windows\System\jkSCOHq.exe
  2⤵
  PID:3612
- C:\Windows\System\wzBAOWS.exe
  C:\Windows\System\wzBAOWS.exe
  2⤵
  PID:2152
- C:\Windows\System\WtZtvQB.exe
  C:\Windows\System\WtZtvQB.exe
  2⤵
  PID:3716
- C:\Windows\System\VQYpBjt.exe
  C:\Windows\System\VQYpBjt.exe
  2⤵
  PID:3984
- C:\Windows\System\gWzIKen.exe
  C:\Windows\System\gWzIKen.exe
  2⤵
  PID:1276
- C:\Windows\System\oipibIr.exe
  C:\Windows\System\oipibIr.exe
  2⤵
  PID:3220
- C:\Windows\System\lvOBeYl.exe
  C:\Windows\System\lvOBeYl.exe
  2⤵
  PID:3344
- C:\Windows\System\SJtTFJM.exe
  C:\Windows\System\SJtTFJM.exe
  2⤵
  PID:3376
- C:\Windows\System\UYWnvcu.exe
  C:\Windows\System\UYWnvcu.exe
  2⤵
  PID:4324
- C:\Windows\System\CCkbUON.exe
  C:\Windows\System\CCkbUON.exe
  2⤵
  PID:4684
- C:\Windows\System\qjxyubg.exe
  C:\Windows\System\qjxyubg.exe
  2⤵
  PID:4428
- C:\Windows\System\kGvcQeY.exe
  C:\Windows\System\kGvcQeY.exe
  2⤵
  PID:4720
- C:\Windows\System\GrirHKQ.exe
  C:\Windows\System\GrirHKQ.exe
  2⤵
  PID:4656
- C:\Windows\System\kMxquQM.exe
  C:\Windows\System\kMxquQM.exe
  2⤵
  PID:4556
- C:\Windows\System\zYrZXwW.exe
  C:\Windows\System\zYrZXwW.exe
  2⤵
  PID:5100
- C:\Windows\System\zYRYAlD.exe
  C:\Windows\System\zYRYAlD.exe
  2⤵
  PID:4896
- C:\Windows\System\HhPydJX.exe
  C:\Windows\System\HhPydJX.exe
  2⤵
  PID:3444
- C:\Windows\System\utMAFXy.exe
  C:\Windows\System\utMAFXy.exe
  2⤵
  PID:3576
- C:\Windows\System\UmUvwfX.exe
  C:\Windows\System\UmUvwfX.exe
  2⤵
  PID:4608
- C:\Windows\System\IUYpsTn.exe
  C:\Windows\System\IUYpsTn.exe
  2⤵
  PID:4828
- C:\Windows\System\dyRhzdS.exe
  C:\Windows\System\dyRhzdS.exe
  2⤵
  PID:4640
- C:\Windows\System\ENPeGqM.exe
  C:\Windows\System\ENPeGqM.exe
  2⤵
  PID:4860
- C:\Windows\System\VxkNdAq.exe
  C:\Windows\System\VxkNdAq.exe
  2⤵
  PID:3208
- C:\Windows\System\DWUPgaI.exe
  C:\Windows\System\DWUPgaI.exe
  2⤵
  PID:3996
- C:\Windows\System\YkHLHzo.exe
  C:\Windows\System\YkHLHzo.exe
  2⤵
  PID:548
- C:\Windows\System\CuOrleU.exe
  C:\Windows\System\CuOrleU.exe
  2⤵
  PID:2976
- C:\Windows\System\hJunmSy.exe
  C:\Windows\System\hJunmSy.exe
  2⤵
  PID:3492
- C:\Windows\System\OTbVnAL.exe
  C:\Windows\System\OTbVnAL.exe
  2⤵
  PID:5052
- C:\Windows\System\sgcWedx.exe
  C:\Windows\System\sgcWedx.exe
  2⤵
  PID:4184
- C:\Windows\System\oZVurHM.exe
  C:\Windows\System\oZVurHM.exe
  2⤵
  PID:4224
- C:\Windows\System\AflSIvY.exe
  C:\Windows\System\AflSIvY.exe
  2⤵
  PID:4672
- C:\Windows\System\dmJVdnn.exe
  C:\Windows\System\dmJVdnn.exe
  2⤵
  PID:3816
- C:\Windows\System\TfeDvWG.exe
  C:\Windows\System\TfeDvWG.exe
  2⤵
  PID:4768
- C:\Windows\System\dHOjumk.exe
  C:\Windows\System\dHOjumk.exe
  2⤵
  PID:4204
- C:\Windows\System\DtSwwxL.exe
  C:\Windows\System\DtSwwxL.exe
  2⤵
  PID:2144
- C:\Windows\System\yJfnkYv.exe
  C:\Windows\System\yJfnkYv.exe
  2⤵
  PID:4736
- C:\Windows\System\YVBzuDE.exe
  C:\Windows\System\YVBzuDE.exe
  2⤵
  PID:3348
- C:\Windows\System\mHZtfDu.exe
  C:\Windows\System\mHZtfDu.exe
  2⤵
  PID:2856
- C:\Windows\System\wwDuwhq.exe
  C:\Windows\System\wwDuwhq.exe
  2⤵
  PID:4140
- C:\Windows\System\dOvsJlt.exe
  C:\Windows\System\dOvsJlt.exe
  2⤵
  PID:1480
- C:\Windows\System\sZHRFtF.exe
  C:\Windows\System\sZHRFtF.exe
  2⤵
  PID:4444
- C:\Windows\System\slYIJpk.exe
  C:\Windows\System\slYIJpk.exe
  2⤵
  PID:4960
- C:\Windows\System\baLeRXD.exe
  C:\Windows\System\baLeRXD.exe
  2⤵
  PID:2544
- C:\Windows\System\PmnBFJk.exe
  C:\Windows\System\PmnBFJk.exe
  2⤵
  PID:1828
- C:\Windows\System\YPZcBsq.exe
  C:\Windows\System\YPZcBsq.exe
  2⤵
  PID:4416
- C:\Windows\System\aeEGQoI.exe
  C:\Windows\System\aeEGQoI.exe
  2⤵
  PID:2928
- C:\Windows\System\QslpBBi.exe
  C:\Windows\System\QslpBBi.exe
  2⤵
  PID:2496
- C:\Windows\System\xtibFet.exe
  C:\Windows\System\xtibFet.exe
  2⤵
  PID:2444
- C:\Windows\System\LDfkUtH.exe
  C:\Windows\System\LDfkUtH.exe
  2⤵
  PID:1772
- C:\Windows\System\lRLiusi.exe
  C:\Windows\System\lRLiusi.exe
  2⤵
  PID:3560
- C:\Windows\System\BpSoMNW.exe
  C:\Windows\System\BpSoMNW.exe
  2⤵
  PID:2252
- C:\Windows\System\HGzsEGn.exe
  C:\Windows\System\HGzsEGn.exe
  2⤵
  PID:2296
- C:\Windows\System\ntQEHQc.exe
  C:\Windows\System\ntQEHQc.exe
  2⤵
  PID:3016
- C:\Windows\System\xtnZHFv.exe
  C:\Windows\System\xtnZHFv.exe
  2⤵
  PID:3600
- C:\Windows\System\ALAOtmJ.exe
  C:\Windows\System\ALAOtmJ.exe
  2⤵
  PID:5084
- C:\Windows\System\VPTenfu.exe
  C:\Windows\System\VPTenfu.exe
  2⤵
  PID:4052
- C:\Windows\System\ZLiJggI.exe
  C:\Windows\System\ZLiJggI.exe
  2⤵
  PID:4848
- C:\Windows\System\lNZPxIr.exe
  C:\Windows\System\lNZPxIr.exe
  2⤵
  PID:2456
- C:\Windows\System\bydcoKr.exe
  C:\Windows\System\bydcoKr.exe
  2⤵
  PID:3580
- C:\Windows\System\ALBWEES.exe
  C:\Windows\System\ALBWEES.exe
  2⤵
  PID:3288
- C:\Windows\System\cFacwar.exe
  C:\Windows\System\cFacwar.exe
  2⤵
  PID:4464
- C:\Windows\System\FbjEZon.exe
  C:\Windows\System\FbjEZon.exe
  2⤵
  PID:4748
- C:\Windows\System\zLzsTOx.exe
  C:\Windows\System\zLzsTOx.exe
  2⤵
  PID:3276
- C:\Windows\System\KvJfHeN.exe
  C:\Windows\System\KvJfHeN.exe
  2⤵
  PID:4620
- C:\Windows\System\tHtReVZ.exe
  C:\Windows\System\tHtReVZ.exe
  2⤵
  PID:5008
- C:\Windows\System\OxiEYvs.exe
  C:\Windows\System\OxiEYvs.exe
  2⤵
  PID:4844
- C:\Windows\System\FZykAZY.exe
  C:\Windows\System\FZykAZY.exe
  2⤵
  PID:4396
- C:\Windows\System\xpMtaDx.exe
  C:\Windows\System\xpMtaDx.exe
  2⤵
  PID:2808
- C:\Windows\System\ajHdJDF.exe
  C:\Windows\System\ajHdJDF.exe
  2⤵
  PID:4268
- C:\Windows\System\hdUNMss.exe
  C:\Windows\System\hdUNMss.exe
  2⤵
  PID:4816
- C:\Windows\System\wgrcXKc.exe
  C:\Windows\System\wgrcXKc.exe
  2⤵
  PID:4372
- C:\Windows\System\oPbmyEF.exe
  C:\Windows\System\oPbmyEF.exe
  2⤵
  PID:984
- C:\Windows\System\gJiAsle.exe
  C:\Windows\System\gJiAsle.exe
  2⤵
  PID:1916
- C:\Windows\System\NSMSOrO.exe
  C:\Windows\System\NSMSOrO.exe
  2⤵
  PID:4512
- C:\Windows\System\XaDgPIb.exe
  C:\Windows\System\XaDgPIb.exe
  2⤵
  PID:4732
- C:\Windows\System\YKXmAeh.exe
  C:\Windows\System\YKXmAeh.exe
  2⤵
  PID:3176
- C:\Windows\System\ctCjMGz.exe
  C:\Windows\System\ctCjMGz.exe
  2⤵
  PID:4624
- C:\Windows\System\JDgFzut.exe
  C:\Windows\System\JDgFzut.exe
  2⤵
  PID:5132
- C:\Windows\System\XDtQPIO.exe
  C:\Windows\System\XDtQPIO.exe
  2⤵
  PID:5148
- C:\Windows\System\NkSExaY.exe
  C:\Windows\System\NkSExaY.exe
  2⤵
  PID:5164
- C:\Windows\System\xkbReiP.exe
  C:\Windows\System\xkbReiP.exe
  2⤵
  PID:5180
- C:\Windows\System\bVWZzzl.exe
  C:\Windows\System\bVWZzzl.exe
  2⤵
  PID:5196
- C:\Windows\System\NctcLgy.exe
  C:\Windows\System\NctcLgy.exe
  2⤵
  PID:5212
- C:\Windows\System\KBPVhZM.exe
  C:\Windows\System\KBPVhZM.exe
  2⤵
  PID:5228
- C:\Windows\System\EZfIPnP.exe
  C:\Windows\System\EZfIPnP.exe
  2⤵
  PID:5280
- C:\Windows\System\YnHgUxf.exe
  C:\Windows\System\YnHgUxf.exe
  2⤵
  PID:5312
- C:\Windows\System\xxMroqI.exe
  C:\Windows\System\xxMroqI.exe
  2⤵
  PID:5344
- C:\Windows\System\CiZgJRx.exe
  C:\Windows\System\CiZgJRx.exe
  2⤵
  PID:5384
- C:\Windows\System\josSgBF.exe
  C:\Windows\System\josSgBF.exe
  2⤵
  PID:5400
- C:\Windows\System\dfaTHtF.exe
  C:\Windows\System\dfaTHtF.exe
  2⤵
  PID:5416
- C:\Windows\System\BuhkTsm.exe
  C:\Windows\System\BuhkTsm.exe
  2⤵
  PID:5432
- C:\Windows\System\isZhPUe.exe
  C:\Windows\System\isZhPUe.exe
  2⤵
  PID:5448
- C:\Windows\System\CXJTgxB.exe
  C:\Windows\System\CXJTgxB.exe
  2⤵
  PID:5584
- C:\Windows\System\xSkovhq.exe
  C:\Windows\System\xSkovhq.exe
  2⤵
  PID:5600
- C:\Windows\System\WZbqXGY.exe
  C:\Windows\System\WZbqXGY.exe
  2⤵
  PID:5616
- C:\Windows\System\DZeslyZ.exe
  C:\Windows\System\DZeslyZ.exe
  2⤵
  PID:5632
- C:\Windows\System\rMmInbO.exe
  C:\Windows\System\rMmInbO.exe
  2⤵
  PID:5648
- C:\Windows\System\QaffzlC.exe
  C:\Windows\System\QaffzlC.exe
  2⤵
  PID:5664
- C:\Windows\System\kCZllZc.exe
  C:\Windows\System\kCZllZc.exe
  2⤵
  PID:5680
- C:\Windows\System\hEQKGCy.exe
  C:\Windows\System\hEQKGCy.exe
  2⤵
  PID:5696
- C:\Windows\System\GMbqGkR.exe
  C:\Windows\System\GMbqGkR.exe
  2⤵
  PID:5736
- C:\Windows\System\hbVqrtZ.exe
  C:\Windows\System\hbVqrtZ.exe
  2⤵
  PID:5752
- C:\Windows\System\EFYZsbt.exe
  C:\Windows\System\EFYZsbt.exe
  2⤵
  PID:5768
- C:\Windows\System\cGCYKxI.exe
  C:\Windows\System\cGCYKxI.exe
  2⤵
  PID:5784
- C:\Windows\System\AhOBbWU.exe
  C:\Windows\System\AhOBbWU.exe
  2⤵
  PID:5804
- C:\Windows\System\uwCqvow.exe
  C:\Windows\System\uwCqvow.exe
  2⤵
  PID:5820
- C:\Windows\System\YsIYgYj.exe
  C:\Windows\System\YsIYgYj.exe
  2⤵
  PID:5836
- C:\Windows\System\ECHLPqL.exe
  C:\Windows\System\ECHLPqL.exe
  2⤵
  PID:5852
- C:\Windows\System\EOJplpS.exe
  C:\Windows\System\EOJplpS.exe
  2⤵
  PID:5868
- C:\Windows\System\QrJwmpY.exe
  C:\Windows\System\QrJwmpY.exe
  2⤵
  PID:5884
- C:\Windows\System\XNAbCxt.exe
  C:\Windows\System\XNAbCxt.exe
  2⤵
  PID:5900
- C:\Windows\System\IAenjbm.exe
  C:\Windows\System\IAenjbm.exe
  2⤵
  PID:5916
- C:\Windows\System\fQoAhcR.exe
  C:\Windows\System\fQoAhcR.exe
  2⤵
  PID:5932
- C:\Windows\System\MFlMPtm.exe
  C:\Windows\System\MFlMPtm.exe
  2⤵
  PID:5948
- C:\Windows\System\EosvDoO.exe
  C:\Windows\System\EosvDoO.exe
  2⤵
  PID:5964
- C:\Windows\System\xNBLhXb.exe
  C:\Windows\System\xNBLhXb.exe
  2⤵
  PID:5980
- C:\Windows\System\FKXmMBD.exe
  C:\Windows\System\FKXmMBD.exe
  2⤵
  PID:5996
- C:\Windows\System\TXAiIdL.exe
  C:\Windows\System\TXAiIdL.exe
  2⤵
  PID:6016
- C:\Windows\System\xLvpyik.exe
  C:\Windows\System\xLvpyik.exe
  2⤵
  PID:6032
- C:\Windows\System\joAsCQh.exe
  C:\Windows\System\joAsCQh.exe
  2⤵
  PID:6048
- C:\Windows\System\IhZISGZ.exe
  C:\Windows\System\IhZISGZ.exe
  2⤵
  PID:6064
- C:\Windows\System\uLWCDOz.exe
  C:\Windows\System\uLWCDOz.exe
  2⤵
  PID:6080
- C:\Windows\System\fSuUrcj.exe
  C:\Windows\System\fSuUrcj.exe
  2⤵
  PID:6096
- C:\Windows\System\AICezMh.exe
  C:\Windows\System\AICezMh.exe
  2⤵
  PID:6112
- C:\Windows\System\PJLDICM.exe
  C:\Windows\System\PJLDICM.exe
  2⤵
  PID:6128
- C:\Windows\System\mCFujuF.exe
  C:\Windows\System\mCFujuF.exe
  2⤵
  PID:4220
- C:\Windows\System\RZHGDlx.exe
  C:\Windows\System\RZHGDlx.exe
  2⤵
  PID:5088
- C:\Windows\System\YxRtoAn.exe
  C:\Windows\System\YxRtoAn.exe
  2⤵
  PID:4908
- C:\Windows\System\TxxQusj.exe
  C:\Windows\System\TxxQusj.exe
  2⤵
  PID:5124
- C:\Windows\System\iYvBzTr.exe
  C:\Windows\System\iYvBzTr.exe
  2⤵
  PID:5188
- C:\Windows\System\YnGjsLb.exe
  C:\Windows\System\YnGjsLb.exe
  2⤵
  PID:1688
- C:\Windows\System\rxXykkr.exe
  C:\Windows\System\rxXykkr.exe
  2⤵
  PID:452
- C:\Windows\System\HsqjCel.exe
  C:\Windows\System\HsqjCel.exe
  2⤵
  PID:3836
- C:\Windows\System\uZtXkJI.exe
  C:\Windows\System\uZtXkJI.exe
  2⤵
  PID:5140
- C:\Windows\System\xAHkltF.exe
  C:\Windows\System\xAHkltF.exe
  2⤵
  PID:5236
- C:\Windows\System\uIOHfOS.exe
  C:\Windows\System\uIOHfOS.exe
  2⤵
  PID:5332
- C:\Windows\System\ckQPUWx.exe
  C:\Windows\System\ckQPUWx.exe
  2⤵
  PID:5352
- C:\Windows\System\jzkPhhU.exe
  C:\Windows\System\jzkPhhU.exe
  2⤵
  PID:5356
- C:\Windows\System\IbfRzpS.exe
  C:\Windows\System\IbfRzpS.exe
  2⤵
  PID:5372
- C:\Windows\System\KnTRhYI.exe
  C:\Windows\System\KnTRhYI.exe
  2⤵
  PID:5380
- C:\Windows\System\IsmYSML.exe
  C:\Windows\System\IsmYSML.exe
  2⤵
  PID:5456
- C:\Windows\System\QTUbKrG.exe
  C:\Windows\System\QTUbKrG.exe
  2⤵
  PID:5424
- C:\Windows\System\AymVXfA.exe
  C:\Windows\System\AymVXfA.exe
  2⤵
  PID:5480
- C:\Windows\System\QSdvUYg.exe
  C:\Windows\System\QSdvUYg.exe
  2⤵
  PID:5500
- C:\Windows\System\bmVLWmv.exe
  C:\Windows\System\bmVLWmv.exe
  2⤵
  PID:5532
- C:\Windows\System\bVoreGK.exe
  C:\Windows\System\bVoreGK.exe
  2⤵
  PID:5508
- C:\Windows\System\qLIQqFI.exe
  C:\Windows\System\qLIQqFI.exe
  2⤵
  PID:5540
- C:\Windows\System\LmPTGFC.exe
  C:\Windows\System\LmPTGFC.exe
  2⤵
  PID:5564
- C:\Windows\System\iwZJNbZ.exe
  C:\Windows\System\iwZJNbZ.exe
  2⤵
  PID:5580
- C:\Windows\System\ujtOAfh.exe
  C:\Windows\System\ujtOAfh.exe
  2⤵
  PID:5704
- C:\Windows\System\sFzPwTY.exe
  C:\Windows\System\sFzPwTY.exe
  2⤵
  PID:5592
- C:\Windows\System\nAYfXoa.exe
  C:\Windows\System\nAYfXoa.exe
  2⤵
  PID:5624
- C:\Windows\System\DdioTXJ.exe
  C:\Windows\System\DdioTXJ.exe
  2⤵
  PID:5712
- C:\Windows\System\CTqcVts.exe
  C:\Windows\System\CTqcVts.exe
  2⤵
  PID:5720
- C:\Windows\System\tiVIHeC.exe
  C:\Windows\System\tiVIHeC.exe
  2⤵
  PID:5760
- C:\Windows\System\oCyxMVG.exe
  C:\Windows\System\oCyxMVG.exe
  2⤵
  PID:5800
- C:\Windows\System\KSdKmaH.exe
  C:\Windows\System\KSdKmaH.exe
  2⤵
  PID:6140
- C:\Windows\System\upJBSwo.exe
  C:\Windows\System\upJBSwo.exe
  2⤵
  PID:4400
- C:\Windows\System\rlsLzvr.exe
  C:\Windows\System\rlsLzvr.exe
  2⤵
  PID:5928
- C:\Windows\System\hVtiIVH.exe
  C:\Windows\System\hVtiIVH.exe
  2⤵
  PID:6124
- C:\Windows\System\cLbgeUO.exe
  C:\Windows\System\cLbgeUO.exe
  2⤵
  PID:6056
- C:\Windows\System\pFEksFT.exe
  C:\Windows\System\pFEksFT.exe
  2⤵
  PID:5072
- C:\Windows\System\qJBlEUR.exe
  C:\Windows\System\qJBlEUR.exe
  2⤵
  PID:5960
- C:\Windows\System\PmuGtrj.exe
  C:\Windows\System\PmuGtrj.exe
  2⤵
  PID:5176
- C:\Windows\System\GDEXfqk.exe
  C:\Windows\System\GDEXfqk.exe
  2⤵
  PID:3680
- C:\Windows\System\UYaZWcb.exe
  C:\Windows\System\UYaZWcb.exe
  2⤵
  PID:5256
- C:\Windows\System\PSTSALm.exe
  C:\Windows\System\PSTSALm.exe
  2⤵
  PID:5260
- C:\Windows\System\lPOvler.exe
  C:\Windows\System\lPOvler.exe
  2⤵
  PID:5268
- C:\Windows\System\RjLFobo.exe
  C:\Windows\System\RjLFobo.exe
  2⤵
  PID:5440
- C:\Windows\System\MXXVTpd.exe
  C:\Windows\System\MXXVTpd.exe
  2⤵
  PID:5492
- C:\Windows\System\yACkBJq.exe
  C:\Windows\System\yACkBJq.exe
  2⤵
  PID:5552
- C:\Windows\System\XfPbitq.exe
  C:\Windows\System\XfPbitq.exe
  2⤵
  PID:5724
- C:\Windows\System\WQEXRoD.exe
  C:\Windows\System\WQEXRoD.exe
  2⤵
  PID:5308
- C:\Windows\System\XGkuLbt.exe
  C:\Windows\System\XGkuLbt.exe
  2⤵
  PID:5324
- C:\Windows\System\IqDuPjO.exe
  C:\Windows\System\IqDuPjO.exe
  2⤵
  PID:5464
- C:\Windows\System\jKXqcNW.exe
  C:\Windows\System\jKXqcNW.exe
  2⤵
  PID:5544
- C:\Windows\System\DyrcsKv.exe
  C:\Windows\System\DyrcsKv.exe
  2⤵
  PID:5644
- C:\Windows\System\ZxrmwZY.exe
  C:\Windows\System\ZxrmwZY.exe
  2⤵
  PID:5744
- C:\Windows\System\spgRETv.exe
  C:\Windows\System\spgRETv.exe
  2⤵
  PID:5828
- C:\Windows\System\FQCnnqU.exe
  C:\Windows\System\FQCnnqU.exe
  2⤵
  PID:5860
- C:\Windows\System\yjXlWQY.exe
  C:\Windows\System\yjXlWQY.exe
  2⤵
  PID:5892
- C:\Windows\System\rgnxUCU.exe
  C:\Windows\System\rgnxUCU.exe
  2⤵
  PID:5368
- C:\Windows\System\eDeNxcM.exe
  C:\Windows\System\eDeNxcM.exe
  2⤵
  PID:5912
- C:\Windows\System\qTIJARE.exe
  C:\Windows\System\qTIJARE.exe
  2⤵
  PID:6104
- C:\Windows\System\MOqKHMF.exe
  C:\Windows\System\MOqKHMF.exe
  2⤵
  PID:5816
- C:\Windows\System\HmEdGGs.exe
  C:\Windows\System\HmEdGGs.exe
  2⤵
  PID:6008
- C:\Windows\System\UBtnDKn.exe
  C:\Windows\System\UBtnDKn.exe
  2⤵
  PID:4800
- C:\Windows\System\YWHrCzG.exe
  C:\Windows\System\YWHrCzG.exe
  2⤵
  PID:6088
- C:\Windows\System\MwsOkVW.exe
  C:\Windows\System\MwsOkVW.exe
  2⤵
  PID:5292
- C:\Windows\System\IUQyjdy.exe
  C:\Windows\System\IUQyjdy.exe
  2⤵
  PID:5676
- C:\Windows\System\sGapDhu.exe
  C:\Windows\System\sGapDhu.exe
  2⤵
  PID:5572
- C:\Windows\System\KFvHFfo.exe
  C:\Windows\System\KFvHFfo.exe
  2⤵
  PID:5880
- C:\Windows\System\CBYBUXF.exe
  C:\Windows\System\CBYBUXF.exe
  2⤵
  PID:2852
- C:\Windows\System\BbXvyUM.exe
  C:\Windows\System\BbXvyUM.exe
  2⤵
  PID:5396
- C:\Windows\System\UkTgaUR.exe
  C:\Windows\System\UkTgaUR.exe
  2⤵
  PID:5748
- C:\Windows\System\sqPwnrb.exe
  C:\Windows\System\sqPwnrb.exe
  2⤵
  PID:5460
- C:\Windows\System\zFtyfAv.exe
  C:\Windows\System\zFtyfAv.exe
  2⤵
  PID:5908
- C:\Windows\System\gLXwqZU.exe
  C:\Windows\System\gLXwqZU.exe
  2⤵
  PID:6148
- C:\Windows\System\xRSmPSz.exe
  C:\Windows\System\xRSmPSz.exe
  2⤵
  PID:6164
- C:\Windows\System\hTTAdVu.exe
  C:\Windows\System\hTTAdVu.exe
  2⤵
  PID:6180
- C:\Windows\System\ZpbCebw.exe
  C:\Windows\System\ZpbCebw.exe
  2⤵
  PID:6200
- C:\Windows\System\wrPpFtI.exe
  C:\Windows\System\wrPpFtI.exe
  2⤵
  PID:6220
- C:\Windows\System\OKFpdOR.exe
  C:\Windows\System\OKFpdOR.exe
  2⤵
  PID:6236
- C:\Windows\System\XXjFKkF.exe
  C:\Windows\System\XXjFKkF.exe
  2⤵
  PID:6256
- C:\Windows\System\AqtHNAm.exe
  C:\Windows\System\AqtHNAm.exe
  2⤵
  PID:6272
- C:\Windows\System\DFyMkZS.exe
  C:\Windows\System\DFyMkZS.exe
  2⤵
  PID:6288
- C:\Windows\System\tBfLUAn.exe
  C:\Windows\System\tBfLUAn.exe
  2⤵
  PID:6304
- C:\Windows\System\UTJaemE.exe
  C:\Windows\System\UTJaemE.exe
  2⤵
  PID:6324
- C:\Windows\System\OZdQFPr.exe
  C:\Windows\System\OZdQFPr.exe
  2⤵
  PID:6340
- C:\Windows\System\dxBOlnR.exe
  C:\Windows\System\dxBOlnR.exe
  2⤵
  PID:6356
- C:\Windows\System\pucAjfm.exe
  C:\Windows\System\pucAjfm.exe
  2⤵
  PID:6372
- C:\Windows\System\ybGVIHm.exe
  C:\Windows\System\ybGVIHm.exe
  2⤵
  PID:6388
- C:\Windows\System\aLeeXRl.exe
  C:\Windows\System\aLeeXRl.exe
  2⤵
  PID:6404
- C:\Windows\System\jFULvuL.exe
  C:\Windows\System\jFULvuL.exe
  2⤵
  PID:6420
- C:\Windows\System\qZdbkCV.exe
  C:\Windows\System\qZdbkCV.exe
  2⤵
  PID:6436
- C:\Windows\System\MhAihnr.exe
  C:\Windows\System\MhAihnr.exe
  2⤵
  PID:6452
- C:\Windows\System\rdRKZhh.exe
  C:\Windows\System\rdRKZhh.exe
  2⤵
  PID:6468
- C:\Windows\System\dkFSYkU.exe
  C:\Windows\System\dkFSYkU.exe
  2⤵
  PID:6484
- C:\Windows\System\WTHPlMK.exe
  C:\Windows\System\WTHPlMK.exe
  2⤵
  PID:6500
- C:\Windows\System\gDqaNVI.exe
  C:\Windows\System\gDqaNVI.exe
  2⤵
  PID:6516
- C:\Windows\System\xuuqxuK.exe
  C:\Windows\System\xuuqxuK.exe
  2⤵
  PID:6532
- C:\Windows\System\IabFXPV.exe
  C:\Windows\System\IabFXPV.exe
  2⤵
  PID:6548
- C:\Windows\System\OQtNDPD.exe
  C:\Windows\System\OQtNDPD.exe
  2⤵
  PID:6564
- C:\Windows\System\QAuQOfU.exe
  C:\Windows\System\QAuQOfU.exe
  2⤵
  PID:6580
- C:\Windows\System\tAufDNi.exe
  C:\Windows\System\tAufDNi.exe
  2⤵
  PID:6596
- C:\Windows\System\hsYLpEF.exe
  C:\Windows\System\hsYLpEF.exe
  2⤵
  PID:6612
- C:\Windows\System\sTHcKnJ.exe
  C:\Windows\System\sTHcKnJ.exe
  2⤵
  PID:6628
- C:\Windows\System\XdmWERe.exe
  C:\Windows\System\XdmWERe.exe
  2⤵
  PID:6644
- C:\Windows\System\ledFYXt.exe
  C:\Windows\System\ledFYXt.exe
  2⤵
  PID:6660
- C:\Windows\System\UHlUcWF.exe
  C:\Windows\System\UHlUcWF.exe
  2⤵
  PID:6676
- C:\Windows\System\UzLkgmZ.exe
  C:\Windows\System\UzLkgmZ.exe
  2⤵
  PID:6692
- C:\Windows\System\qnvqjjZ.exe
  C:\Windows\System\qnvqjjZ.exe
  2⤵
  PID:6708
- C:\Windows\System\uzVnAlu.exe
  C:\Windows\System\uzVnAlu.exe
  2⤵
  PID:6724
- C:\Windows\System\wREyzFk.exe
  C:\Windows\System\wREyzFk.exe
  2⤵
  PID:6740
- C:\Windows\System\weLAQSN.exe
  C:\Windows\System\weLAQSN.exe
  2⤵
  PID:6756
- C:\Windows\System\OvHjxmE.exe
  C:\Windows\System\OvHjxmE.exe
  2⤵
  PID:6772
- C:\Windows\System\iafeeFO.exe
  C:\Windows\System\iafeeFO.exe
  2⤵
  PID:6792
- C:\Windows\System\OANzuhh.exe
  C:\Windows\System\OANzuhh.exe
  2⤵
  PID:6808
- C:\Windows\System\EcqvgTU.exe
  C:\Windows\System\EcqvgTU.exe
  2⤵
  PID:6824
- C:\Windows\System\DNikPnG.exe
  C:\Windows\System\DNikPnG.exe
  2⤵
  PID:6840
- C:\Windows\System\NzHDKSA.exe
  C:\Windows\System\NzHDKSA.exe
  2⤵
  PID:6856
- C:\Windows\System\tBsuefL.exe
  C:\Windows\System\tBsuefL.exe
  2⤵
  PID:6872
- C:\Windows\System\gYZVdvD.exe
  C:\Windows\System\gYZVdvD.exe
  2⤵
  PID:6892
- C:\Windows\System\ALLkFHf.exe
  C:\Windows\System\ALLkFHf.exe
  2⤵
  PID:6908
- C:\Windows\System\iZSFAyn.exe
  C:\Windows\System\iZSFAyn.exe
  2⤵
  PID:6924
- C:\Windows\System\PzPzWub.exe
  C:\Windows\System\PzPzWub.exe
  2⤵
  PID:6940
- C:\Windows\System\cvcefgX.exe
  C:\Windows\System\cvcefgX.exe
  2⤵
  PID:6956
- C:\Windows\System\dFFCVqi.exe
  C:\Windows\System\dFFCVqi.exe
  2⤵
  PID:6972
- C:\Windows\System\lRMHWms.exe
  C:\Windows\System\lRMHWms.exe
  2⤵
  PID:6988
- C:\Windows\System\xpBGdcQ.exe
  C:\Windows\System\xpBGdcQ.exe
  2⤵
  PID:7004
- C:\Windows\System\JRqynVL.exe
  C:\Windows\System\JRqynVL.exe
  2⤵
  PID:7020
- C:\Windows\System\CHrAlkt.exe
  C:\Windows\System\CHrAlkt.exe
  2⤵
  PID:7036
- C:\Windows\System\JbkqGeX.exe
  C:\Windows\System\JbkqGeX.exe
  2⤵
  PID:7052
- C:\Windows\System\rIqSWwT.exe
  C:\Windows\System\rIqSWwT.exe
  2⤵
  PID:7068
- C:\Windows\System\PLEOAsN.exe
  C:\Windows\System\PLEOAsN.exe
  2⤵
  PID:7084
- C:\Windows\System\evnsrWh.exe
  C:\Windows\System\evnsrWh.exe
  2⤵
  PID:7100
- C:\Windows\System\RMwmUeG.exe
  C:\Windows\System\RMwmUeG.exe
  2⤵
  PID:7116
- C:\Windows\System\OGPySQj.exe
  C:\Windows\System\OGPySQj.exe
  2⤵
  PID:7132
- C:\Windows\System\RuOwbOz.exe
  C:\Windows\System\RuOwbOz.exe
  2⤵
  PID:7148
- C:\Windows\System\XjRsqIc.exe
  C:\Windows\System\XjRsqIc.exe
  2⤵
  PID:7164
- C:\Windows\System\iCwOkoK.exe
  C:\Windows\System\iCwOkoK.exe
  2⤵
  PID:6188
- C:\Windows\System\aYKMrqU.exe
  C:\Windows\System\aYKMrqU.exe
  2⤵
  PID:6264
- C:\Windows\System\oyGYCSq.exe
  C:\Windows\System\oyGYCSq.exe
  2⤵
  PID:6332
- C:\Windows\System\BEasPAL.exe
  C:\Windows\System\BEasPAL.exe
  2⤵
  PID:6028
- C:\Windows\System\rQYozEG.exe
  C:\Windows\System\rQYozEG.exe
  2⤵
  PID:4812
- C:\Windows\System\cAWMhkm.exe
  C:\Windows\System\cAWMhkm.exe
  2⤵
  PID:6460
- C:\Windows\System\oPYkODg.exe
  C:\Windows\System\oPYkODg.exe
  2⤵
  PID:6528
- C:\Windows\System\nsruLDr.exe
  C:\Windows\System\nsruLDr.exe
  2⤵
  PID:6588
- C:\Windows\System\ShkPpzF.exe
  C:\Windows\System\ShkPpzF.exe
  2⤵
  PID:6244
- C:\Windows\System\CuCxZDW.exe
  C:\Windows\System\CuCxZDW.exe
  2⤵
  PID:6684
- C:\Windows\System\MxceifY.exe
  C:\Windows\System\MxceifY.exe
  2⤵
  PID:6748
- C:\Windows\System\YlvrbAE.exe
  C:\Windows\System\YlvrbAE.exe
  2⤵
  PID:6788
- C:\Windows\System\uvmFitK.exe
  C:\Windows\System\uvmFitK.exe
  2⤵
  PID:2884
- C:\Windows\System\mpeHZip.exe
  C:\Windows\System\mpeHZip.exe
  2⤵
  PID:6416
- C:\Windows\System\ziuumEw.exe
  C:\Windows\System\ziuumEw.exe
  2⤵
  PID:5780
- C:\Windows\System\FsclGio.exe
  C:\Windows\System\FsclGio.exe
  2⤵
  PID:6880
- C:\Windows\System\RDOpSxb.exe
  C:\Windows\System\RDOpSxb.exe
  2⤵
  PID:6948
- C:\Windows\System\CBurZYo.exe
  C:\Windows\System\CBurZYo.exe
  2⤵
  PID:6984
- C:\Windows\System\CBfVBEg.exe
  C:\Windows\System\CBfVBEg.exe
  2⤵
  PID:5248
- C:\Windows\System\xDSQhKL.exe
  C:\Windows\System\xDSQhKL.exe
  2⤵
  PID:7048
- C:\Windows\System\sebeqoU.exe
  C:\Windows\System\sebeqoU.exe
  2⤵
  PID:5300
- C:\Windows\System\ftXNnWH.exe
  C:\Windows\System\ftXNnWH.exe
  2⤵
  PID:6576
- C:\Windows\System\wnnEpfC.exe
  C:\Windows\System\wnnEpfC.exe
  2⤵
  PID:6252
- C:\Windows\System\ENHdDPU.exe
  C:\Windows\System\ENHdDPU.exe
  2⤵
  PID:6284
- C:\Windows\System\vRpntgz.exe
  C:\Windows\System\vRpntgz.exe
  2⤵
  PID:5792
- C:\Windows\System\PtAQQVG.exe
  C:\Windows\System\PtAQQVG.exe
  2⤵
  PID:5516
- C:\Windows\System\vbBkkcA.exe
  C:\Windows\System\vbBkkcA.exe
  2⤵
  PID:5692
- C:\Windows\System\bVowSiI.exe
  C:\Windows\System\bVowSiI.exe
  2⤵
  PID:6156
- C:\Windows\System\rPHlrqp.exe
  C:\Windows\System\rPHlrqp.exe
  2⤵
  PID:6300
- C:\Windows\System\grIPAEo.exe
  C:\Windows\System\grIPAEo.exe
  2⤵
  PID:6496
- C:\Windows\System\HveqifE.exe
  C:\Windows\System\HveqifE.exe
  2⤵
  PID:6832
- C:\Windows\System\iEPAnVW.exe
  C:\Windows\System\iEPAnVW.exe
  2⤵
  PID:6040
- C:\Windows\System\fJKUOCn.exe
  C:\Windows\System\fJKUOCn.exe
  2⤵
  PID:6720
- C:\Windows\System\JxaGgBG.exe
  C:\Windows\System\JxaGgBG.exe
  2⤵
  PID:6004
- C:\Windows\System\osqPpXm.exe
  C:\Windows\System\osqPpXm.exe
  2⤵
  PID:5876
- C:\Windows\System\wBfnEtv.exe
  C:\Windows\System\wBfnEtv.exe
  2⤵
  PID:7016
- C:\Windows\System\UJscPeR.exe
  C:\Windows\System\UJscPeR.exe
  2⤵
  PID:5172
- C:\Windows\System\XExEXXd.exe
  C:\Windows\System\XExEXXd.exe
  2⤵
  PID:6216
- C:\Windows\System\DyBvDQH.exe
  C:\Windows\System\DyBvDQH.exe
  2⤵
  PID:6172
- C:\Windows\System\XIyNFez.exe
  C:\Windows\System\XIyNFez.exe
  2⤵
  PID:6212
- C:\Windows\System\qBSKUhv.exe
  C:\Windows\System\qBSKUhv.exe
  2⤵
  PID:6668
- C:\Windows\System\SEkDMvo.exe
  C:\Windows\System\SEkDMvo.exe
  2⤵
  PID:6348
- C:\Windows\System\apsgOtM.exe
  C:\Windows\System\apsgOtM.exe
  2⤵
  PID:6232
- C:\Windows\System\grXVhNW.exe
  C:\Windows\System\grXVhNW.exe
  2⤵
  PID:7140
- C:\Windows\System\LSWdCFR.exe
  C:\Windows\System\LSWdCFR.exe
  2⤵
  PID:6476
- C:\Windows\System\HJxfork.exe
  C:\Windows\System\HJxfork.exe
  2⤵
  PID:6572
- C:\Windows\System\GKAtIHO.exe
  C:\Windows\System\GKAtIHO.exe
  2⤵
  PID:6732
- C:\Windows\System\BqPzUaH.exe
  C:\Windows\System\BqPzUaH.exe
  2⤵
  PID:6368
- C:\Windows\System\gakaXBA.exe
  C:\Windows\System\gakaXBA.exe
  2⤵
  PID:6296
- C:\Windows\System\oxhNfHT.exe
  C:\Windows\System\oxhNfHT.exe
  2⤵
  PID:5208
- C:\Windows\System\KniNrGu.exe
  C:\Windows\System\KniNrGu.exe
  2⤵
  PID:7000
- C:\Windows\System\ZIYJZrM.exe
  C:\Windows\System\ZIYJZrM.exe
  2⤵
  PID:7124
- C:\Windows\System\uNcPIpY.exe
  C:\Windows\System\uNcPIpY.exe
  2⤵
  PID:5528
- C:\Windows\System\fspUcUp.exe
  C:\Windows\System\fspUcUp.exe
  2⤵
  PID:5628
- C:\Windows\System\foojlHO.exe
  C:\Windows\System\foojlHO.exe
  2⤵
  PID:6620
- C:\Windows\System\epQUprt.exe
  C:\Windows\System\epQUprt.exe
  2⤵
  PID:6852
- C:\Windows\System\cPDwPBs.exe
  C:\Windows\System\cPDwPBs.exe
  2⤵
  PID:6208
- C:\Windows\System\inlgsnc.exe
  C:\Windows\System\inlgsnc.exe
  2⤵
  PID:6916
- C:\Windows\System\kIrUFlF.exe
  C:\Windows\System\kIrUFlF.exe
  2⤵
  PID:7064
- C:\Windows\System\pzkgBVa.exe
  C:\Windows\System\pzkgBVa.exe
  2⤵
  PID:6320
- C:\Windows\System\xMtGjZr.exe
  C:\Windows\System\xMtGjZr.exe
  2⤵
  PID:6704
- C:\Windows\System\fyDyvNU.exe
  C:\Windows\System\fyDyvNU.exe
  2⤵
  PID:6964
- C:\Windows\System\uTOsffU.exe
  C:\Windows\System\uTOsffU.exe
  2⤵
  PID:5520
- C:\Windows\System\yYgYCUv.exe
  C:\Windows\System\yYgYCUv.exe
  2⤵
  PID:5956
- C:\Windows\System\PIaQSKX.exe
  C:\Windows\System\PIaQSKX.exe
  2⤵
  PID:6444
- C:\Windows\System\xzAofvb.exe
  C:\Windows\System\xzAofvb.exe
  2⤵
  PID:7144
- C:\Windows\System\BcZkicP.exe
  C:\Windows\System\BcZkicP.exe
  2⤵
  PID:7180
- C:\Windows\System\pzCTDYC.exe
  C:\Windows\System\pzCTDYC.exe
  2⤵
  PID:7196
- C:\Windows\System\lZOBDmZ.exe
  C:\Windows\System\lZOBDmZ.exe
  2⤵
  PID:7212
- C:\Windows\System\exEoiZd.exe
  C:\Windows\System\exEoiZd.exe
  2⤵
  PID:7228
- C:\Windows\System\fylPadC.exe
  C:\Windows\System\fylPadC.exe
  2⤵
  PID:7244
- C:\Windows\System\JNaNmfX.exe
  C:\Windows\System\JNaNmfX.exe
  2⤵
  PID:7260
- C:\Windows\System\CHCEVLm.exe
  C:\Windows\System\CHCEVLm.exe
  2⤵
  PID:7280
- C:\Windows\System\LhLgQlJ.exe
  C:\Windows\System\LhLgQlJ.exe
  2⤵
  PID:7296
- C:\Windows\System\CMgaQJT.exe
  C:\Windows\System\CMgaQJT.exe
  2⤵
  PID:7312
- C:\Windows\System\BOrUeCs.exe
  C:\Windows\System\BOrUeCs.exe
  2⤵
  PID:7328
- C:\Windows\System\ybNQqCd.exe
  C:\Windows\System\ybNQqCd.exe
  2⤵
  PID:7344
- C:\Windows\System\StjoKnX.exe
  C:\Windows\System\StjoKnX.exe
  2⤵
  PID:7360
- C:\Windows\System\nYeXpyR.exe
  C:\Windows\System\nYeXpyR.exe
  2⤵
  PID:7376
- C:\Windows\System\lZrqdNT.exe
  C:\Windows\System\lZrqdNT.exe
  2⤵
  PID:7392
- C:\Windows\System\bOnZFYa.exe
  C:\Windows\System\bOnZFYa.exe
  2⤵
  PID:7408
- C:\Windows\System\NLcaVzq.exe
  C:\Windows\System\NLcaVzq.exe
  2⤵
  PID:7424
- C:\Windows\System\dxRMLbJ.exe
  C:\Windows\System\dxRMLbJ.exe
  2⤵
  PID:7448
- C:\Windows\System\cECdoxq.exe
  C:\Windows\System\cECdoxq.exe
  2⤵
  PID:7464
- C:\Windows\System\SeqOxqn.exe
  C:\Windows\System\SeqOxqn.exe
  2⤵
  PID:7480
- C:\Windows\System\YCOikpW.exe
  C:\Windows\System\YCOikpW.exe
  2⤵
  PID:7496
- C:\Windows\System\KdElNZR.exe
  C:\Windows\System\KdElNZR.exe
  2⤵
  PID:7548
- C:\Windows\System\yTPtRPx.exe
  C:\Windows\System\yTPtRPx.exe
  2⤵
  PID:7568
- C:\Windows\System\bRZdZMO.exe
  C:\Windows\System\bRZdZMO.exe
  2⤵
  PID:7584
- C:\Windows\System\OWJyyhG.exe
  C:\Windows\System\OWJyyhG.exe
  2⤵
  PID:7600
- C:\Windows\System\QXFFWUH.exe
  C:\Windows\System\QXFFWUH.exe
  2⤵
  PID:7616
- C:\Windows\System\Atooxdl.exe
  C:\Windows\System\Atooxdl.exe
  2⤵
  PID:7636
- C:\Windows\System\RZmnVLg.exe
  C:\Windows\System\RZmnVLg.exe
  2⤵
  PID:7652
- C:\Windows\System\OiAkjPa.exe
  C:\Windows\System\OiAkjPa.exe
  2⤵
  PID:7668
- C:\Windows\System\mAIjlrf.exe
  C:\Windows\System\mAIjlrf.exe
  2⤵
  PID:7684
- C:\Windows\System\PHjDEMn.exe
  C:\Windows\System\PHjDEMn.exe
  2⤵
  PID:7700
- C:\Windows\System\IBGgtLC.exe
  C:\Windows\System\IBGgtLC.exe
  2⤵
  PID:7716
- C:\Windows\System\mlAynkX.exe
  C:\Windows\System\mlAynkX.exe
  2⤵
  PID:7732
- C:\Windows\System\uFhDTCQ.exe
  C:\Windows\System\uFhDTCQ.exe
  2⤵
  PID:7748
- C:\Windows\System\iaXkTqd.exe
  C:\Windows\System\iaXkTqd.exe
  2⤵
  PID:7768
- C:\Windows\System\XNmZofm.exe
  C:\Windows\System\XNmZofm.exe
  2⤵
  PID:7784
- C:\Windows\System\ZftWter.exe
  C:\Windows\System\ZftWter.exe
  2⤵
  PID:7800
- C:\Windows\System\CoUogpt.exe
  C:\Windows\System\CoUogpt.exe
  2⤵
  PID:7816
- C:\Windows\System\ahVYWTn.exe
  C:\Windows\System\ahVYWTn.exe
  2⤵
  PID:7832
- C:\Windows\System\sAsHyWp.exe
  C:\Windows\System\sAsHyWp.exe
  2⤵
  PID:7848
- C:\Windows\System\PJkqBBk.exe
  C:\Windows\System\PJkqBBk.exe
  2⤵
  PID:7864
- C:\Windows\System\jOCnJKO.exe
  C:\Windows\System\jOCnJKO.exe
  2⤵
  PID:7880
- C:\Windows\System\dKuduTJ.exe
  C:\Windows\System\dKuduTJ.exe
  2⤵
  PID:7896
- C:\Windows\System\xntmlAW.exe
  C:\Windows\System\xntmlAW.exe
  2⤵
  PID:7912
- C:\Windows\System\QytVfyn.exe
  C:\Windows\System\QytVfyn.exe
  2⤵
  PID:7928
- C:\Windows\System\LdNoJWF.exe
  C:\Windows\System\LdNoJWF.exe
  2⤵
  PID:7944
- C:\Windows\System\lFfmrDZ.exe
  C:\Windows\System\lFfmrDZ.exe
  2⤵
  PID:7968
- C:\Windows\System\ZrWovmC.exe
  C:\Windows\System\ZrWovmC.exe
  2⤵
  PID:7984
- C:\Windows\System\BYsBGAi.exe
  C:\Windows\System\BYsBGAi.exe
  2⤵
  PID:8004
- C:\Windows\System\qXcAjyU.exe
  C:\Windows\System\qXcAjyU.exe
  2⤵
  PID:8020
- C:\Windows\System\KCUzzQy.exe
  C:\Windows\System\KCUzzQy.exe
  2⤵
  PID:8036
- C:\Windows\System\QwKGxnG.exe
  C:\Windows\System\QwKGxnG.exe
  2⤵
  PID:8056
- C:\Windows\System\zvFfhbD.exe
  C:\Windows\System\zvFfhbD.exe
  2⤵
  PID:8120
- C:\Windows\System\dFkMdqt.exe
  C:\Windows\System\dFkMdqt.exe
  2⤵
  PID:8136
- C:\Windows\System\qXnMuUf.exe
  C:\Windows\System\qXnMuUf.exe
  2⤵
  PID:8152
- C:\Windows\System\pHziSaM.exe
  C:\Windows\System\pHziSaM.exe
  2⤵
  PID:8168
- C:\Windows\System\tHxyYmE.exe
  C:\Windows\System\tHxyYmE.exe
  2⤵
  PID:8184
- C:\Windows\System\LmZLvjH.exe
  C:\Windows\System\LmZLvjH.exe
  2⤵
  PID:7172
- C:\Windows\System\mZHbNEa.exe
  C:\Windows\System\mZHbNEa.exe
  2⤵
  PID:6836
- C:\Windows\System\CqUJNJP.exe
  C:\Windows\System\CqUJNJP.exe
  2⤵
  PID:5336
- C:\Windows\System\JtjzYVS.exe
  C:\Windows\System\JtjzYVS.exe
  2⤵
  PID:7092
- C:\Windows\System\gWIvJZd.exe
  C:\Windows\System\gWIvJZd.exe
  2⤵
  PID:6864
- C:\Windows\System\qFmyHyb.exe
  C:\Windows\System\qFmyHyb.exe
  2⤵
  PID:6752
- C:\Windows\System\apwqNSB.exe
  C:\Windows\System\apwqNSB.exe
  2⤵
  PID:6556
- C:\Windows\System\UAjuxYe.exe
  C:\Windows\System\UAjuxYe.exe
  2⤵
  PID:7112
- C:\Windows\System\YxrNuIi.exe
  C:\Windows\System\YxrNuIi.exe
  2⤵
  PID:6804
- C:\Windows\System\pAECyvu.exe
  C:\Windows\System\pAECyvu.exe
  2⤵
  PID:5276
- C:\Windows\System\cxqFJHy.exe
  C:\Windows\System\cxqFJHy.exe
  2⤵
  PID:7236
- C:\Windows\System\bPeawTe.exe
  C:\Windows\System\bPeawTe.exe
  2⤵
  PID:7276
- C:\Windows\System\jAbEMKA.exe
  C:\Windows\System\jAbEMKA.exe
  2⤵
  PID:7340
- C:\Windows\System\qGIwpuA.exe
  C:\Windows\System\qGIwpuA.exe
  2⤵
  PID:7404
- C:\Windows\System\OqBmxux.exe
  C:\Windows\System\OqBmxux.exe
  2⤵
  PID:7444
- C:\Windows\System\DSarGbk.exe
  C:\Windows\System\DSarGbk.exe
  2⤵
  PID:7224
- C:\Windows\System\eYcLjwr.exe
  C:\Windows\System\eYcLjwr.exe
  2⤵
  PID:7324
- C:\Windows\System\DwsgQQX.exe
  C:\Windows\System\DwsgQQX.exe
  2⤵
  PID:7256
- C:\Windows\System\DlOLAzX.exe
  C:\Windows\System\DlOLAzX.exe
  2⤵
  PID:7352
- C:\Windows\System\NifLcLX.exe
  C:\Windows\System\NifLcLX.exe
  2⤵
  PID:7456
- C:\Windows\System\zsDsKMy.exe
  C:\Windows\System\zsDsKMy.exe
  2⤵
  PID:7516
- C:\Windows\System\RidYBtI.exe
  C:\Windows\System\RidYBtI.exe
  2⤵
  PID:7532
- C:\Windows\System\HKKFtcf.exe
  C:\Windows\System\HKKFtcf.exe
  2⤵
  PID:7560
- C:\Windows\System\FLpgAyi.exe
  C:\Windows\System\FLpgAyi.exe
  2⤵
  PID:7624
- C:\Windows\System\StPkGIz.exe
  C:\Windows\System\StPkGIz.exe
  2⤵
  PID:7664
- C:\Windows\System\PHHtpNS.exe
  C:\Windows\System\PHHtpNS.exe
  2⤵
  PID:7728
- C:\Windows\System\AYiRfta.exe
  C:\Windows\System\AYiRfta.exe
  2⤵
  PID:7608
- C:\Windows\System\ELkjoOI.exe
  C:\Windows\System\ELkjoOI.exe
  2⤵
  PID:7856
- C:\Windows\System\NRjmrMr.exe
  C:\Windows\System\NRjmrMr.exe
  2⤵
  PID:7920
- C:\Windows\System\qZKtgyM.exe
  C:\Windows\System\qZKtgyM.exe
  2⤵
  PID:7996
- C:\Windows\System\GxAkimC.exe
  C:\Windows\System\GxAkimC.exe
  2⤵
  PID:8084
- C:\Windows\System\vpFMAIm.exe
  C:\Windows\System\vpFMAIm.exe
  2⤵
  PID:8092
- C:\Windows\System\jGRmAiw.exe
  C:\Windows\System\jGRmAiw.exe
  2⤵
  PID:7844
- C:\Windows\System\sWuCCJN.exe
  C:\Windows\System\sWuCCJN.exe
  2⤵
  PID:7780
- C:\Windows\System\MsqnyFS.exe
  C:\Windows\System\MsqnyFS.exe
  2⤵
  PID:7940
- C:\Windows\System\iOrOOsM.exe
  C:\Windows\System\iOrOOsM.exe
  2⤵
  PID:8016
- C:\Windows\System\vcqPeHa.exe
  C:\Windows\System\vcqPeHa.exe
  2⤵
  PID:8128
- C:\Windows\System\nDHckFD.exe
  C:\Windows\System\nDHckFD.exe
  2⤵
  PID:8132
- C:\Windows\System\PMyBESE.exe
  C:\Windows\System\PMyBESE.exe
  2⤵
  PID:6412
- C:\Windows\System\UbQOsnY.exe
  C:\Windows\System\UbQOsnY.exe
  2⤵
  PID:6900
- C:\Windows\System\LPzRCuv.exe
  C:\Windows\System\LPzRCuv.exe
  2⤵
  PID:8104
- C:\Windows\System\qoqQNnu.exe
  C:\Windows\System\qoqQNnu.exe
  2⤵
  PID:7060
- C:\Windows\System\eYlIvBU.exe
  C:\Windows\System\eYlIvBU.exe
  2⤵
  PID:7308
- C:\Windows\System\NLRirQb.exe
  C:\Windows\System\NLRirQb.exe
  2⤵
  PID:7220
- C:\Windows\System\SNRJXTL.exe
  C:\Windows\System\SNRJXTL.exe
  2⤵
  PID:8180
- C:\Windows\System\cyfgTLG.exe
  C:\Windows\System\cyfgTLG.exe
  2⤵
  PID:8108
- C:\Windows\System\gmeSVWk.exe
  C:\Windows\System\gmeSVWk.exe
  2⤵
  PID:2780
- C:\Windows\System\MRCEQHz.exe
  C:\Windows\System\MRCEQHz.exe
  2⤵
  PID:6716
- C:\Windows\System\jUwuQAF.exe
  C:\Windows\System\jUwuQAF.exe
  2⤵
  PID:7272
- C:\Windows\System\DUKxdxc.exe
  C:\Windows\System\DUKxdxc.exe
  2⤵
  PID:7472
- C:\Windows\System\sGnvPjq.exe
  C:\Windows\System\sGnvPjq.exe
  2⤵
  PID:7508
- C:\Windows\System\oSBpjOH.exe
  C:\Windows\System\oSBpjOH.exe
  2⤵
  PID:7528
- C:\Windows\System\eiLaGWA.exe
  C:\Windows\System\eiLaGWA.exe
  2⤵
  PID:7632
- C:\Windows\System\AUvijiZ.exe
  C:\Windows\System\AUvijiZ.exe
  2⤵
  PID:7644
- C:\Windows\System\FtwQLyh.exe
  C:\Windows\System\FtwQLyh.exe
  2⤵
  PID:7676
- C:\Windows\System\zxmhNRc.exe
  C:\Windows\System\zxmhNRc.exe
  2⤵
  PID:7796
- C:\Windows\System\pzhtYxn.exe
  C:\Windows\System\pzhtYxn.exe
  2⤵
  PID:7892
- C:\Windows\System\vmClHGj.exe
  C:\Windows\System\vmClHGj.exe
  2⤵
  PID:7872
- C:\Windows\System\GVatUmd.exe
  C:\Windows\System\GVatUmd.exe
  2⤵
  PID:8088
- C:\Windows\System\yyxHWfM.exe
  C:\Windows\System\yyxHWfM.exe
  2⤵
  PID:8176
- C:\Windows\System\RgWzxMA.exe
  C:\Windows\System\RgWzxMA.exe
  2⤵
  PID:6540
- C:\Windows\System\TRLVPPD.exe
  C:\Windows\System\TRLVPPD.exe
  2⤵
  PID:6448
- C:\Windows\System\GztaZNB.exe
  C:\Windows\System\GztaZNB.exe
  2⤵
  PID:7724
- C:\Windows\System\KlfTrpQ.exe
  C:\Windows\System\KlfTrpQ.exe
  2⤵
  PID:5972
- C:\Windows\System\msWnVsK.exe
  C:\Windows\System\msWnVsK.exe
  2⤵
  PID:8164
- C:\Windows\System\PynFEHa.exe
  C:\Windows\System\PynFEHa.exe
  2⤵
  PID:7540
- C:\Windows\System\HXBTtYf.exe
  C:\Windows\System\HXBTtYf.exe
  2⤵
  PID:7888
- C:\Windows\System\rMSaWnN.exe
  C:\Windows\System\rMSaWnN.exe
  2⤵
  PID:6768
- C:\Windows\System\efHBmDu.exe
  C:\Windows\System\efHBmDu.exe
  2⤵
  PID:6656
- C:\Windows\System\KHLdwhV.exe
  C:\Windows\System\KHLdwhV.exe
  2⤵
  PID:7992
- C:\Windows\System\Qjmipgh.exe
  C:\Windows\System\Qjmipgh.exe
  2⤵
  PID:7032
- C:\Windows\System\ZGAkiVd.exe
  C:\Windows\System\ZGAkiVd.exe
  2⤵
  PID:8012
- C:\Windows\System\jGJnDmT.exe
  C:\Windows\System\jGJnDmT.exe
  2⤵
  PID:6228
- C:\Windows\System\TIrPHjt.exe
  C:\Windows\System\TIrPHjt.exe
  2⤵
  PID:7208
- C:\Windows\System\AywgidU.exe
  C:\Windows\System\AywgidU.exe
  2⤵
  PID:8196
- C:\Windows\System\SgkMWwl.exe
  C:\Windows\System\SgkMWwl.exe
  2⤵
  PID:8212
- C:\Windows\System\bDbYxoh.exe
  C:\Windows\System\bDbYxoh.exe
  2⤵
  PID:8332
- C:\Windows\System\BTnVEfH.exe
  C:\Windows\System\BTnVEfH.exe
  2⤵
  PID:8348
- C:\Windows\System\TNWtfOq.exe
  C:\Windows\System\TNWtfOq.exe
  2⤵
  PID:8364
- C:\Windows\System\JhXFOJH.exe
  C:\Windows\System\JhXFOJH.exe
  2⤵
  PID:8380
- C:\Windows\System\NHHtfCB.exe
  C:\Windows\System\NHHtfCB.exe
  2⤵
  PID:8396
- C:\Windows\System\BtLnYaq.exe
  C:\Windows\System\BtLnYaq.exe
  2⤵
  PID:8416
- C:\Windows\System\xxwJxVe.exe
  C:\Windows\System\xxwJxVe.exe
  2⤵
  PID:8432
- C:\Windows\System\aCjLCwc.exe
  C:\Windows\System\aCjLCwc.exe
  2⤵
  PID:8452
- C:\Windows\System\ovaDhav.exe
  C:\Windows\System\ovaDhav.exe
  2⤵
  PID:8468
- C:\Windows\System\DDqzerv.exe
  C:\Windows\System\DDqzerv.exe
  2⤵
  PID:8484
- C:\Windows\System\edibiLN.exe
  C:\Windows\System\edibiLN.exe
  2⤵
  PID:8504
- C:\Windows\System\hqXVllP.exe
  C:\Windows\System\hqXVllP.exe
  2⤵
  PID:8520
- C:\Windows\System\SWIpZwv.exe
  C:\Windows\System\SWIpZwv.exe
  2⤵
  PID:8536
- C:\Windows\System\qgmsNIp.exe
  C:\Windows\System\qgmsNIp.exe
  2⤵
  PID:8552
- C:\Windows\System\XoEjUbg.exe
  C:\Windows\System\XoEjUbg.exe
  2⤵
  PID:8568
- C:\Windows\System\aVtmKqv.exe
  C:\Windows\System\aVtmKqv.exe
  2⤵
  PID:8584
- C:\Windows\System\ATPFPLW.exe
  C:\Windows\System\ATPFPLW.exe
  2⤵
  PID:8600
- C:\Windows\System\JPNrAOF.exe
  C:\Windows\System\JPNrAOF.exe
  2⤵
  PID:8616
- C:\Windows\System\ANTRbWc.exe
  C:\Windows\System\ANTRbWc.exe
  2⤵
  PID:8632
- C:\Windows\System\frGEcrZ.exe
  C:\Windows\System\frGEcrZ.exe
  2⤵
  PID:8652
- C:\Windows\System\QKMBPuO.exe
  C:\Windows\System\QKMBPuO.exe
  2⤵
  PID:8668
- C:\Windows\System\iNJQeck.exe
  C:\Windows\System\iNJQeck.exe
  2⤵
  PID:8684
- C:\Windows\System\Imjfuuo.exe
  C:\Windows\System\Imjfuuo.exe
  2⤵
  PID:8800
- C:\Windows\System\cpOhGXJ.exe
  C:\Windows\System\cpOhGXJ.exe
  2⤵
  PID:8816
- C:\Windows\System\XmjrPHx.exe
  C:\Windows\System\XmjrPHx.exe
  2⤵
  PID:8832
- C:\Windows\System\qWaNSEc.exe
  C:\Windows\System\qWaNSEc.exe
  2⤵
  PID:8848
- C:\Windows\System\MwVbAzK.exe
  C:\Windows\System\MwVbAzK.exe
  2⤵
  PID:8880
- C:\Windows\System\CvBKxyw.exe
  C:\Windows\System\CvBKxyw.exe
  2⤵
  PID:8896
- C:\Windows\System\zMxHlGt.exe
  C:\Windows\System\zMxHlGt.exe
  2⤵
  PID:8912
- C:\Windows\System\ZkiXKJD.exe
  C:\Windows\System\ZkiXKJD.exe
  2⤵
  PID:8928
- C:\Windows\System\WthDlvp.exe
  C:\Windows\System\WthDlvp.exe
  2⤵
  PID:8944
- C:\Windows\System\LSUHtEx.exe
  C:\Windows\System\LSUHtEx.exe
  2⤵
  PID:8960
- C:\Windows\System\XLsBmpY.exe
  C:\Windows\System\XLsBmpY.exe
  2⤵
  PID:8976
- C:\Windows\System\RLCtVtx.exe
  C:\Windows\System\RLCtVtx.exe
  2⤵
  PID:8992
- C:\Windows\System\rRYGRzS.exe
  C:\Windows\System\rRYGRzS.exe
  2⤵
  PID:9008
- C:\Windows\System\ODlxxix.exe
  C:\Windows\System\ODlxxix.exe
  2⤵
  PID:9024
- C:\Windows\System\ZapfEBx.exe
  C:\Windows\System\ZapfEBx.exe
  2⤵
  PID:9040
- C:\Windows\System\BAHnibT.exe
  C:\Windows\System\BAHnibT.exe
  2⤵
  PID:9056
- C:\Windows\System\ofGqXfu.exe
  C:\Windows\System\ofGqXfu.exe
  2⤵
  PID:9076
- C:\Windows\System\efxNrVR.exe
  C:\Windows\System\efxNrVR.exe
  2⤵
  PID:9092
- C:\Windows\System\liujsSz.exe
  C:\Windows\System\liujsSz.exe
  2⤵
  PID:9108
- C:\Windows\System\NfecQwe.exe
  C:\Windows\System\NfecQwe.exe
  2⤵
  PID:9128
- C:\Windows\System\ffhkkkT.exe
  C:\Windows\System\ffhkkkT.exe
  2⤵
  PID:9144
- C:\Windows\System\CVFEhuu.exe
  C:\Windows\System\CVFEhuu.exe
  2⤵
  PID:9160
- C:\Windows\System\mgKWtpc.exe
  C:\Windows\System\mgKWtpc.exe
  2⤵
  PID:9176
- C:\Windows\System\pgeaHnD.exe
  C:\Windows\System\pgeaHnD.exe
  2⤵
  PID:9192
- C:\Windows\System\VhfeqBj.exe
  C:\Windows\System\VhfeqBj.exe
  2⤵
  PID:9208
- C:\Windows\System\vupwMuq.exe
  C:\Windows\System\vupwMuq.exe
  2⤵
  PID:7400
- C:\Windows\System\kxhynLS.exe
  C:\Windows\System\kxhynLS.exe
  2⤵
  PID:7764
- C:\Windows\System\cHeIaxU.exe
  C:\Windows\System\cHeIaxU.exe
  2⤵
  PID:7792
- C:\Windows\System\obIHJqo.exe
  C:\Windows\System\obIHJqo.exe
  2⤵
  PID:7436
- C:\Windows\System\XaLrMRX.exe
  C:\Windows\System\XaLrMRX.exe
  2⤵
  PID:7808
- C:\Windows\System\PNbogcP.exe
  C:\Windows\System\PNbogcP.exe
  2⤵
  PID:8256
- C:\Windows\System\JIxTxDh.exe
  C:\Windows\System\JIxTxDh.exe
  2⤵
  PID:8248
- C:\Windows\System\xacgMYj.exe
  C:\Windows\System\xacgMYj.exe
  2⤵
  PID:8264
- C:\Windows\System\zogWcPn.exe
  C:\Windows\System\zogWcPn.exe
  2⤵
  PID:7612
- C:\Windows\System\ySQOJdX.exe
  C:\Windows\System\ySQOJdX.exe
  2⤵
  PID:7440
- C:\Windows\System\wUUIybR.exe
  C:\Windows\System\wUUIybR.exe
  2⤵
  PID:8300
- C:\Windows\System\dZvjRkL.exe
  C:\Windows\System\dZvjRkL.exe
  2⤵
  PID:8320
- C:\Windows\System\pYWMRyz.exe
  C:\Windows\System\pYWMRyz.exe
  2⤵
  PID:8356
- C:\Windows\System\scbecSV.exe
  C:\Windows\System\scbecSV.exe
  2⤵
  PID:7268
- C:\Windows\System\JVUTbiX.exe
  C:\Windows\System\JVUTbiX.exe
  2⤵
  PID:8464
- C:\Windows\System\IyIaefl.exe
  C:\Windows\System\IyIaefl.exe
  2⤵
  PID:7980
- C:\Windows\System\QxREBUx.exe
  C:\Windows\System\QxREBUx.exe
  2⤵
  PID:8528
- C:\Windows\System\shRUxmG.exe
  C:\Windows\System\shRUxmG.exe
  2⤵
  PID:8448
- C:\Windows\System\YUkDkKo.exe
  C:\Windows\System\YUkDkKo.exe
  2⤵
  PID:8560
- C:\Windows\System\McghtBQ.exe
  C:\Windows\System\McghtBQ.exe
  2⤵
  PID:8372
- C:\Windows\System\jaFpZYZ.exe
  C:\Windows\System\jaFpZYZ.exe
  2⤵
  PID:8624
- C:\Windows\System\yDuVHVN.exe
  C:\Windows\System\yDuVHVN.exe
  2⤵
  PID:8628
- C:\Windows\System\YErJDck.exe
  C:\Windows\System\YErJDck.exe
  2⤵
  PID:8612
- C:\Windows\System\jTcCxur.exe
  C:\Windows\System\jTcCxur.exe
  2⤵
  PID:8692
- C:\Windows\System\dLjoswi.exe
  C:\Windows\System\dLjoswi.exe
  2⤵
  PID:8676
- C:\Windows\System\RzzWHwD.exe
  C:\Windows\System\RzzWHwD.exe
  2⤵
  PID:8704
- C:\Windows\System\odvDPoX.exe
  C:\Windows\System\odvDPoX.exe
  2⤵
  PID:8724
- C:\Windows\System\YRtGXgN.exe
  C:\Windows\System\YRtGXgN.exe
  2⤵
  PID:8744
- C:\Windows\System\maTihQH.exe
  C:\Windows\System\maTihQH.exe
  2⤵
  PID:8760
- C:\Windows\System\JadwwNx.exe
  C:\Windows\System\JadwwNx.exe
  2⤵
  PID:8776
- C:\Windows\System\inmmMUr.exe
  C:\Windows\System\inmmMUr.exe
  2⤵
  PID:8784
- C:\Windows\System\SvcATqO.exe
  C:\Windows\System\SvcATqO.exe
  2⤵
  PID:8840
- C:\Windows\System\WOXqwbA.exe
  C:\Windows\System\WOXqwbA.exe
  2⤵
  PID:8824
- C:\Windows\System\xDxLDlI.exe
  C:\Windows\System\xDxLDlI.exe
  2⤵
  PID:8876
- C:\Windows\System\XZoqAkf.exe
  C:\Windows\System\XZoqAkf.exe
  2⤵
  PID:8940
- C:\Windows\System\QFZyhEQ.exe
  C:\Windows\System\QFZyhEQ.exe
  2⤵
  PID:9004
- C:\Windows\System\oikUnux.exe
  C:\Windows\System\oikUnux.exe
  2⤵
  PID:9064
- C:\Windows\System\xWrMyoC.exe
  C:\Windows\System\xWrMyoC.exe
  2⤵
  PID:9104
- C:\Windows\System\UvKdVrc.exe
  C:\Windows\System\UvKdVrc.exe
  2⤵
  PID:8892
- C:\Windows\System\gKSGIQi.exe
  C:\Windows\System\gKSGIQi.exe
  2⤵
  PID:9172
- C:\Windows\System\ZtMRPwD.exe
  C:\Windows\System\ZtMRPwD.exe
  2⤵
  PID:7520
- C:\Windows\System\VGhNpTP.exe
  C:\Windows\System\VGhNpTP.exe
  2⤵
  PID:9116
- C:\Windows\System\bZlDcVa.exe
  C:\Windows\System\bZlDcVa.exe
  2⤵
  PID:7556
- C:\Windows\System\EsMWQzv.exe
  C:\Windows\System\EsMWQzv.exe
  2⤵
  PID:9016
- C:\Windows\System\hxJcrhQ.exe
  C:\Windows\System\hxJcrhQ.exe
  2⤵
  PID:9084
- C:\Windows\System\xaDTdDg.exe
  C:\Windows\System\xaDTdDg.exe
  2⤵
  PID:8220
- C:\Windows\System\irsFdLL.exe
  C:\Windows\System\irsFdLL.exe
  2⤵
  PID:7388
- C:\Windows\System\DPvdiVm.exe
  C:\Windows\System\DPvdiVm.exe
  2⤵
  PID:7320
- C:\Windows\System\VRPtMKA.exe
  C:\Windows\System\VRPtMKA.exe
  2⤵
  PID:8228
- C:\Windows\System\MElVbfJ.exe
  C:\Windows\System\MElVbfJ.exe
  2⤵
  PID:8280
- C:\Windows\System\pETYjtr.exe
  C:\Windows\System\pETYjtr.exe
  2⤵
  PID:8316
- C:\Windows\System\BJhWZPB.exe
  C:\Windows\System\BJhWZPB.exe
  2⤵
  PID:8496
- C:\Windows\System\gcWFqsj.exe
  C:\Windows\System\gcWFqsj.exe
  2⤵
  PID:8516
- C:\Windows\System\ycyJNfM.exe
  C:\Windows\System\ycyJNfM.exe
  2⤵
  PID:8580
- C:\Windows\System\YiitXuR.exe
  C:\Windows\System\YiitXuR.exe
  2⤵
  PID:8736
- C:\Windows\System\ICKcGPB.exe
  C:\Windows\System\ICKcGPB.exe
  2⤵
  PID:8812
- C:\Windows\System\nvQrQhs.exe
  C:\Windows\System\nvQrQhs.exe
  2⤵
  PID:8972
- C:\Windows\System\IgEkaid.exe
  C:\Windows\System\IgEkaid.exe
  2⤵
  PID:9168
- C:\Windows\System\NrVrpfR.exe
  C:\Windows\System\NrVrpfR.exe
  2⤵
  PID:8988
- C:\Windows\System\sByGCka.exe
  C:\Windows\System\sByGCka.exe
  2⤵
  PID:8160
- C:\Windows\System\lfJKhbY.exe
  C:\Windows\System\lfJKhbY.exe
  2⤵
  PID:8312
- C:\Windows\System\yRfVzIC.exe
  C:\Windows\System\yRfVzIC.exe
  2⤵
  PID:8720
- C:\Windows\System\DQriBtk.exe
  C:\Windows\System\DQriBtk.exe
  2⤵
  PID:7960
- C:\Windows\System\ROZHrst.exe
  C:\Windows\System\ROZHrst.exe
  2⤵
  PID:8860
- C:\Windows\System\fRcLWuh.exe
  C:\Windows\System\fRcLWuh.exe
  2⤵
  PID:8284
- C:\Windows\System\toqcTOs.exe
  C:\Windows\System\toqcTOs.exe
  2⤵
  PID:8344
- C:\Windows\System\rCsLQcP.exe
  C:\Windows\System\rCsLQcP.exe
  2⤵
  PID:8644
- C:\Windows\System\qXGhRBY.exe
  C:\Windows\System\qXGhRBY.exe
  2⤵
  PID:8752
- C:\Windows\System\MFhKIgO.exe
  C:\Windows\System\MFhKIgO.exe
  2⤵
  PID:8908
- C:\Windows\System\KnwioJK.exe
  C:\Windows\System\KnwioJK.exe
  2⤵
  PID:9036
- C:\Windows\System\rdxPNGQ.exe
  C:\Windows\System\rdxPNGQ.exe
  2⤵
  PID:9048
- C:\Windows\System\sKAkyfz.exe
  C:\Windows\System\sKAkyfz.exe
  2⤵
  PID:8144
- C:\Windows\System\tkamzdW.exe
  C:\Windows\System\tkamzdW.exe
  2⤵
  PID:8444
- C:\Windows\System\tnHeDrK.exe
  C:\Windows\System\tnHeDrK.exe
  2⤵
  PID:8868
- C:\Windows\System\IShxwzq.exe
  C:\Windows\System\IShxwzq.exe
  2⤵
  PID:8296
- C:\Windows\System\VqchWnW.exe
  C:\Windows\System\VqchWnW.exe
  2⤵
  PID:8664
- C:\Windows\System\nHagLfo.exe
  C:\Windows\System\nHagLfo.exe
  2⤵
  PID:8924
- C:\Windows\System\XiZKeEl.exe
  C:\Windows\System\XiZKeEl.exe
  2⤵
  PID:8872
- C:\Windows\System\Tlbjqii.exe
  C:\Windows\System\Tlbjqii.exe
  2⤵
  PID:9052
- C:\Windows\System\dkRIENF.exe
  C:\Windows\System\dkRIENF.exe
  2⤵
  PID:9204
- C:\Windows\System\lnCcQFr.exe
  C:\Windows\System\lnCcQFr.exe
  2⤵
  PID:8608
- C:\Windows\System\yVYnXkb.exe
  C:\Windows\System\yVYnXkb.exe
  2⤵
  PID:9156
- C:\Windows\System\slqxtPS.exe
  C:\Windows\System\slqxtPS.exe
  2⤵
  PID:7544
- C:\Windows\System\LTVWXCk.exe
  C:\Windows\System\LTVWXCk.exe
  2⤵
  PID:8408
- C:\Windows\System\CdRRDCr.exe
  C:\Windows\System\CdRRDCr.exe
  2⤵
  PID:8716
- C:\Windows\System\Lndhoby.exe
  C:\Windows\System\Lndhoby.exe
  2⤵
  PID:8392
- C:\Windows\System\TRBnNvC.exe
  C:\Windows\System\TRBnNvC.exe
  2⤵
  PID:9232
- C:\Windows\System\dUxGDEp.exe
  C:\Windows\System\dUxGDEp.exe
  2⤵
  PID:9248
- C:\Windows\System\XYSaQZL.exe
  C:\Windows\System\XYSaQZL.exe
  2⤵
  PID:9264
- C:\Windows\System\rWNYQyX.exe
  C:\Windows\System\rWNYQyX.exe
  2⤵
  PID:9280
- C:\Windows\System\XeooMmB.exe
  C:\Windows\System\XeooMmB.exe
  2⤵
  PID:9296
- C:\Windows\System\sBkzFbn.exe
  C:\Windows\System\sBkzFbn.exe
  2⤵
  PID:9312
- C:\Windows\System\wZodADu.exe
  C:\Windows\System\wZodADu.exe
  2⤵
  PID:9328
- C:\Windows\System\aPpLIxM.exe
  C:\Windows\System\aPpLIxM.exe
  2⤵
  PID:9344
- C:\Windows\System\fsMEpot.exe
  C:\Windows\System\fsMEpot.exe
  2⤵
  PID:9360
- C:\Windows\System\KfuItxn.exe
  C:\Windows\System\KfuItxn.exe
  2⤵
  PID:9376
- C:\Windows\System\ecXrKvq.exe
  C:\Windows\System\ecXrKvq.exe
  2⤵
  PID:9392
- C:\Windows\System\ddJhYsp.exe
  C:\Windows\System\ddJhYsp.exe
  2⤵
  PID:9408
- C:\Windows\System\jUzPVle.exe
  C:\Windows\System\jUzPVle.exe
  2⤵
  PID:9424
- C:\Windows\System\nhvNkpx.exe
  C:\Windows\System\nhvNkpx.exe
  2⤵
  PID:9440
- C:\Windows\System\ykJqcKD.exe
  C:\Windows\System\ykJqcKD.exe
  2⤵
  PID:9456
- C:\Windows\System\vWWJylg.exe
  C:\Windows\System\vWWJylg.exe
  2⤵
  PID:9472
- C:\Windows\System\GGJdODr.exe
  C:\Windows\System\GGJdODr.exe
  2⤵
  PID:9488
- C:\Windows\System\FAjXlmv.exe
  C:\Windows\System\FAjXlmv.exe
  2⤵
  PID:9504
- C:\Windows\System\thiqtzr.exe
  C:\Windows\System\thiqtzr.exe
  2⤵
  PID:9520
- C:\Windows\System\LRcXfHh.exe
  C:\Windows\System\LRcXfHh.exe
  2⤵
  PID:9536
- C:\Windows\System\zhQXrou.exe
  C:\Windows\System\zhQXrou.exe
  2⤵
  PID:9552
- C:\Windows\System\fsrPFYF.exe
  C:\Windows\System\fsrPFYF.exe
  2⤵
  PID:9568
- C:\Windows\System\tlNRtUk.exe
  C:\Windows\System\tlNRtUk.exe
  2⤵
  PID:9584
- C:\Windows\System\OXsnViE.exe
  C:\Windows\System\OXsnViE.exe
  2⤵
  PID:9600
- C:\Windows\System\yoLCbwj.exe
  C:\Windows\System\yoLCbwj.exe
  2⤵
  PID:9616
- C:\Windows\System\gYTCGTe.exe
  C:\Windows\System\gYTCGTe.exe
  2⤵
  PID:9632
- C:\Windows\System\BJeVkPo.exe
  C:\Windows\System\BJeVkPo.exe
  2⤵
  PID:9648
- C:\Windows\System\WTLLuFN.exe
  C:\Windows\System\WTLLuFN.exe
  2⤵
  PID:9664
- C:\Windows\System\jGFzKDa.exe
  C:\Windows\System\jGFzKDa.exe
  2⤵
  PID:9680
- C:\Windows\System\eoSMiJF.exe
  C:\Windows\System\eoSMiJF.exe
  2⤵
  PID:9696
- C:\Windows\System\zixhBrV.exe
  C:\Windows\System\zixhBrV.exe
  2⤵
  PID:9712
- C:\Windows\System\BmbAOQE.exe
  C:\Windows\System\BmbAOQE.exe
  2⤵
  PID:9732
- C:\Windows\System\ACLOmAH.exe
  C:\Windows\System\ACLOmAH.exe
  2⤵
  PID:9748
- C:\Windows\System\BcZSIaR.exe
  C:\Windows\System\BcZSIaR.exe
  2⤵
  PID:9764
- C:\Windows\System\ysntesG.exe
  C:\Windows\System\ysntesG.exe
  2⤵
  PID:9780
- C:\Windows\System\wLTzuHS.exe
  C:\Windows\System\wLTzuHS.exe
  2⤵
  PID:9796
- C:\Windows\System\oXwDnxu.exe
  C:\Windows\System\oXwDnxu.exe
  2⤵
  PID:9812
- C:\Windows\System\svDFwee.exe
  C:\Windows\System\svDFwee.exe
  2⤵
  PID:9828
- C:\Windows\System\JKvHbVm.exe
  C:\Windows\System\JKvHbVm.exe
  2⤵
  PID:9844
- C:\Windows\System\ABjNdZe.exe
  C:\Windows\System\ABjNdZe.exe
  2⤵
  PID:9860
- C:\Windows\System\myaxhvM.exe
  C:\Windows\System\myaxhvM.exe
  2⤵
  PID:9876
- C:\Windows\System\ilRryfu.exe
  C:\Windows\System\ilRryfu.exe
  2⤵
  PID:9892
- C:\Windows\System\KBWeFBu.exe
  C:\Windows\System\KBWeFBu.exe
  2⤵
  PID:9908
- C:\Windows\System\GudxyRp.exe
  C:\Windows\System\GudxyRp.exe
  2⤵
  PID:9924
- C:\Windows\System\RQTgvGw.exe
  C:\Windows\System\RQTgvGw.exe
  2⤵
  PID:9940
- C:\Windows\System\CTAYWTK.exe
  C:\Windows\System\CTAYWTK.exe
  2⤵
  PID:9956
- C:\Windows\System\DRQAjMF.exe
  C:\Windows\System\DRQAjMF.exe
  2⤵
  PID:9972
- C:\Windows\System\QZEtQUr.exe
  C:\Windows\System\QZEtQUr.exe
  2⤵
  PID:9988
- C:\Windows\System\qcqbAeT.exe
  C:\Windows\System\qcqbAeT.exe
  2⤵
  PID:10004
- C:\Windows\System\jBJYGXW.exe
  C:\Windows\System\jBJYGXW.exe
  2⤵
  PID:10020
- C:\Windows\System\eMgUzOi.exe
  C:\Windows\System\eMgUzOi.exe
  2⤵
  PID:10036
- C:\Windows\System\yzYdwiu.exe
  C:\Windows\System\yzYdwiu.exe
  2⤵
  PID:10056
- C:\Windows\System\gPGYMuZ.exe
  C:\Windows\System\gPGYMuZ.exe
  2⤵
  PID:10072
- C:\Windows\System\TIZszLn.exe
  C:\Windows\System\TIZszLn.exe
  2⤵
  PID:10088
- C:\Windows\System\JEPXAcy.exe
  C:\Windows\System\JEPXAcy.exe
  2⤵
  PID:10108
- C:\Windows\System\SvyjRsS.exe
  C:\Windows\System\SvyjRsS.exe
  2⤵
  PID:10124
- C:\Windows\System\TbrufiQ.exe
  C:\Windows\System\TbrufiQ.exe
  2⤵
  PID:10140
- C:\Windows\System\rIjMpvW.exe
  C:\Windows\System\rIjMpvW.exe
  2⤵
  PID:10156
- C:\Windows\System\AsbOggz.exe
  C:\Windows\System\AsbOggz.exe
  2⤵
  PID:10176
- C:\Windows\System\QSBhsaf.exe
  C:\Windows\System\QSBhsaf.exe
  2⤵
  PID:10192
- C:\Windows\System\ITLNTyq.exe
  C:\Windows\System\ITLNTyq.exe
  2⤵
  PID:10208
- C:\Windows\System\teyButZ.exe
  C:\Windows\System\teyButZ.exe
  2⤵
  PID:10224
- C:\Windows\System\JuywXVh.exe
  C:\Windows\System\JuywXVh.exe
  2⤵
  PID:9272
- C:\Windows\System\ZzLLiTd.exe
  C:\Windows\System\ZzLLiTd.exe
  2⤵
  PID:9124
- C:\Windows\System\HVtfdWA.exe
  C:\Windows\System\HVtfdWA.exe
  2⤵
  PID:9088
- C:\Windows\System\delJgSS.exe
  C:\Windows\System\delJgSS.exe
  2⤵
  PID:9368
- C:\Windows\System\cFdxXpt.exe
  C:\Windows\System\cFdxXpt.exe
  2⤵
  PID:9404
- C:\Windows\System\VfZBnIX.exe
  C:\Windows\System\VfZBnIX.exe
  2⤵
  PID:8276
- C:\Windows\System\pgMOSHI.exe
  C:\Windows\System\pgMOSHI.exe
  2⤵
  PID:9500
- C:\Windows\System\bJeorIS.exe
  C:\Windows\System\bJeorIS.exe
  2⤵
  PID:9564
- C:\Windows\System\aqjgRvS.exe
  C:\Windows\System\aqjgRvS.exe
  2⤵
  PID:9628
- C:\Windows\System\mExQdXl.exe
  C:\Windows\System\mExQdXl.exe
  2⤵
  PID:9692
- C:\Windows\System\AfkkdvP.exe
  C:\Windows\System\AfkkdvP.exe
  2⤵
  PID:9760
- C:\Windows\System\LtxfFkx.exe
  C:\Windows\System\LtxfFkx.exe
  2⤵
  PID:9792
- C:\Windows\System\kdQZZNe.exe
  C:\Windows\System\kdQZZNe.exe
  2⤵
  PID:9852
- C:\Windows\System\XqumtoK.exe
  C:\Windows\System\XqumtoK.exe
  2⤵
  PID:8984
- C:\Windows\System\OeJgXks.exe
  C:\Windows\System\OeJgXks.exe
  2⤵
  PID:8596
- C:\Windows\System\YRVQLDA.exe
  C:\Windows\System\YRVQLDA.exe
  2⤵
  PID:9256
- C:\Windows\System\BMuMkKC.exe
  C:\Windows\System\BMuMkKC.exe
  2⤵
  PID:9320
- C:\Windows\System\VagzXvP.exe
  C:\Windows\System\VagzXvP.exe
  2⤵
  PID:9388
- C:\Windows\System\tUBouWl.exe
  C:\Windows\System\tUBouWl.exe
  2⤵
  PID:9452
- C:\Windows\System\yQKkdIs.exe
  C:\Windows\System\yQKkdIs.exe
  2⤵
  PID:9516
- C:\Windows\System\QVMRrRk.exe
  C:\Windows\System\QVMRrRk.exe
  2⤵
  PID:9580
- C:\Windows\System\iBFovjG.exe
  C:\Windows\System\iBFovjG.exe
  2⤵
  PID:9676
- C:\Windows\System\iVCseBs.exe
  C:\Windows\System\iVCseBs.exe
  2⤵
  PID:9744
- C:\Windows\System\VgZAfUp.exe
  C:\Windows\System\VgZAfUp.exe
  2⤵
  PID:9808
- C:\Windows\System\OAoGFwP.exe
  C:\Windows\System\OAoGFwP.exe
  2⤵
  PID:9884
- C:\Windows\System\iRhBKri.exe
  C:\Windows\System\iRhBKri.exe
  2⤵
  PID:9916
- C:\Windows\System\MaZKYOr.exe
  C:\Windows\System\MaZKYOr.exe
  2⤵
  PID:9980
- C:\Windows\System\SHNaUdG.exe
  C:\Windows\System\SHNaUdG.exe
  2⤵
  PID:10044
- C:\Windows\System\jtFVEJj.exe
  C:\Windows\System\jtFVEJj.exe
  2⤵
  PID:10084
- C:\Windows\System\UICccTB.exe
  C:\Windows\System\UICccTB.exe
  2⤵
  PID:9936
- C:\Windows\System\fveQqfT.exe
  C:\Windows\System\fveQqfT.exe
  2⤵
  PID:10116
- C:\Windows\System\tPzzAVE.exe
  C:\Windows\System\tPzzAVE.exe
  2⤵
  PID:9996
- C:\Windows\System\TOloSNG.exe
  C:\Windows\System\TOloSNG.exe
  2⤵
  PID:10032
- C:\Windows\System\zsrFcLZ.exe
  C:\Windows\System\zsrFcLZ.exe
  2⤵
  PID:10096
- C:\Windows\System\RVWGXfQ.exe
  C:\Windows\System\RVWGXfQ.exe
  2⤵
  PID:10184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AkKhUZU.exe

Filesize
2.1MB

MD5
048fc6cbb63e63955122aa440fcb62d0

SHA1
19ca5cc49d77cc8d5d3c748cdcd61f90dd959d1e

SHA256
68818af6576ef0a7f442f908fd993fd983578409ada1ec97718625312c59a645

SHA512
0b93f7f28ca636234506bb8f5475d1f7eb355ebb18fa125d58438b88cede49427bacb74130d8ab63ba97e73fd9e1a687db4640fef9092ba58b2ec505c991cb45

Download Submit
C:\Windows\system\ApKsbAk.exe

Filesize
2.1MB

MD5
4e3be9ee941f7dc51e65fa2b0408e4af

SHA1
c08fc866e44ec39b575fe7128c239501e73600e7

SHA256
65f8c2a6301541cd119e7a9492cdc254a179d8bdb7cf6fe23d6fbb1e5fef1f4f

SHA512
2c7b6acc447928e29d5cd4b8e09155513db405969a7d1e5ba1a72e459e0cc275f8682a8065614f904bd544b1ed5b824f94d21b08140c3ff3a5410f78e6713e44

Download Submit
C:\Windows\system\AxryjSO.exe

Filesize
2.1MB

MD5
0ea96d0d3fbda96b05703037f9d45d42

SHA1
fd32ce309e9dfeb8404c42dd698c8fbdd8250bda

SHA256
26f93fb9379454fcc4cf1c8d8592b35f2c45ba87749dbc3571adb4367c4ccbc2

SHA512
874fe525c005d5a87abec1b74dea5d0e2f46fa9b9f1bd6b97697454a9f5739c6952c1ffedc8d3b5ef9567378c7ffaf4c3b9b456b032c50a2fbbca81db0ad61fd

Download Submit
C:\Windows\system\DxtHUcD.exe

Filesize
2.1MB

MD5
0b83f4571c27df9bfed55eaa871d6b67

SHA1
062d3a883bfc77d03898ec3116090e07a79cf59c

SHA256
c48fa74b7c45d5e440d245ac2362c3a524ec85a22eed9a233dcf213661b0ae0e

SHA512
0e2843837afe6278faf27e2b56baab0a3a0429b5c9bdf8a8a0bdee21e3a7c0f90712cecdb432e9482623c0afa3cd0b9116ed21ae6da7c5b711fd42f7aa2334f5

Download Submit
C:\Windows\system\EnwFsLA.exe

Filesize
2.1MB

MD5
06eca558336d785c7aa7c22140f2e2ea

SHA1
e2b4d8f304355023792227f28085abf5931c7df3

SHA256
906e5a0dcd9e5898a85c0cd737efe9d19d64428604128003a114b80d7b8609dc

SHA512
1b0cb47178ea56998493b3e9b0c3b3b5fc3d898fa0b75c73c1c12429748542470521dd0bb6980112e643f4a2a053ed82b867e958696969897b779743dead7f47

Download Submit
C:\Windows\system\JzdgFfZ.exe

Filesize
2.1MB

MD5
dcfac82e3d402e7df239ce75bd726d64

SHA1
c716a8c177bca8a08d69b1df93dd7252ceb970db

SHA256
e035b3323176544cf70fd3a0ee9376df8cafaa3aa938e7d05579b5107050e21e

SHA512
cdf79b5a53d5a635abb8e9c8a87c238319c29bdf48f025172185fc16091aba7e4db4fe24e9d1980082bcfbd519e03bdcc2bba11c9474a13d48467876adc1001d

Download Submit
C:\Windows\system\LVvJlNh.exe

Filesize
2.1MB

MD5
3cab134b8410495fe8940f7b4ae03af9

SHA1
a43098611eacf487ced5f8b6fe2fbabe6b03d9ae

SHA256
3a6325300712d9c5a2749cf82cbab5ab96077d10a4ed542f2fb51d30af281b8b

SHA512
ea092fbe6f3ee4642a4d4838cbe621ad1b9a797a77dfef175621d80c129a28f793d83fa78f63c6bb6596aec8716dcb9c12237d225ca9e3e98d47bd26aeec43af

Download Submit
C:\Windows\system\MtezNPb.exe

Filesize
2.1MB

MD5
6781e7524f579a612eecf8a5ba3b21d1

SHA1
cf1dc4776a4f9b074189e30d9c484584b64b4ff3

SHA256
49e0a12d3e258d5220af788922c0ca222ad3dd63a8cfdc022eb34604c1ed756f

SHA512
e3b89764b8a17e47e6bac4bdd0b6fe7d9522eb748f1e8cd9b8ff7070c69b490603da1f0eedc52d719bdeb2b0b39701d7dfda4dbb50486c2c42af572884f0b379

Download Submit
C:\Windows\system\OHCslKM.exe

Filesize
2.1MB

MD5
017134a3ad096b7f29a65f6ba521fc5b

SHA1
4c769f617f059fcdfe0280f87de9669398c931ef

SHA256
f13e782e12bde84da0b14eba84b6b0b67888ecc42dcb9ca282fb263ab32ecc16

SHA512
487f811dbe001b0040326559b2e96ec99a666f83cbe92f7376e3b525bb33a50dd428ca61edefa77c563ecb9d7ac9580779c5eff28c19f00cf89491634d08e297

Download Submit
C:\Windows\system\QdmiSKo.exe

Filesize
2.1MB

MD5
8af450ed9cb694aaecb90085882101fb

SHA1
3451d39051e6d7b8f168559a89e01f5d333e910c

SHA256
8484d07b95f8bb0385924e78d61e766ba985ccdc675e67378b6efdbcbcb76da4

SHA512
21bbdd8f8a9dcb633dec2f917f50d6226559fd7e8a0813dbe96bd8fd58d4b112e8d470e230e5a377471340c2a67596e1b8f575921d1edfa25510ce6e17153879

Download Submit
C:\Windows\system\RechxKk.exe

Filesize
8B

MD5
408407fe49e2a1bd1de2fb4f4e1c1e4e

SHA1
6781f0ed16b9f9a0e8a861848782ae1a9b183885

SHA256
413c20c52ba69478c63daee39bcd70926f09cbc71ce3aa1577802440938b324a

SHA512
51204da6f17b6725f4e9b8b9381f34a7ed365926b3780a3bfe9e8d70ab81ec8caad96b3f0838e87a0f0c0c6baeed1ea2ea2f5c7ee1fa6a13b720a1ec69c3f3fd

Download Submit
C:\Windows\system\RmmrjNO.exe

Filesize
2.1MB

MD5
9ccdc492b2074cc083fbe65aa2f256db

SHA1
b2775e3a2c26e378af2c3549f8a5714c6c2de2b3

SHA256
e8f21e558ca452caa067a9cadd090dbcc40168c991e5a9f2549eb8cb5502231f

SHA512
52c70260850fa8aa06fb53701648e13ed477051a79f5f1535d5088fd9c993702c3e0c969741a6a6f9025b8487b188a0ac3c45a593e46c86b16040e3b2ef2388d

Download Submit
C:\Windows\system\UPjTZNG.exe

Filesize
2.1MB

MD5
d680575b19d9fe2d3cae6f099097b053

SHA1
b5ca837c1a71b8f35f6a8ab3abc901f083b8a4ac

SHA256
d359c15e2e6fb291208490e19eeb3638a193b2db09a35d5e34c94840cab3beba

SHA512
63564874c55bbc59212fd8065be1359286909624cd6eded188500b3420f1ff9d501f020223666ae57b7f89cdbbf492fb4925016de88b1098bf18bcbf0f1d2234

Download Submit
C:\Windows\system\UjNGlko.exe

Filesize
2.1MB

MD5
ff85926ae28b5ae47059b7c360d50dc0

SHA1
5dd7452ad70c586db30249ea7221b633db57fa80

SHA256
b3d5d0fdc3f719f59198d6c10b0a3fdee0246adac6a97d1a821ddd321d32c688

SHA512
12234cc715c199979b060512db950bdae46df496fbcb4f99ed8ffd3618223cdc5132bb4df93a842986377c2eb4d58cdf8e4a6bdb5644f58d177c93d0dc190994

Download Submit
C:\Windows\system\VYiEExx.exe

Filesize
2.1MB

MD5
6bd08c6e0af7435725814b56711fd98b

SHA1
c5eefa9558b6e7cb52baa7f248652bff425f55a9

SHA256
0ecdf79b038ec8ba7736fb71a32ecc4f3b18fb4d5fe508a72753039150d01c9c

SHA512
acdaedaf8f706bd91de76cbba0896bff69db73193c7224dc2286619747a5040ffec1ccc0d508adf7ce842b16ba1061e0afa2aa04c4cb599a420f7559c907584a

Download Submit
C:\Windows\system\XIwqDTa.exe

Filesize
2.1MB

MD5
52fd92d31d014f0576df9ba858dd0961

SHA1
917f146d05ebae9770bdc422bc9d49994ad93050

SHA256
c287b4928afe37cb7158eb3a21542d5cb07f3ea7fcf43dff5482b4e2d01764aa

SHA512
b3ebea50ebece8cec162e5e6ce3c85aec7d07a40b6ff0fe7fe7186a96da720f71f9dce5ee81c22e6784de67046e942b1bbb0367a229b55fab4d0a3ff16530f1b

Download Submit
C:\Windows\system\asXoTas.exe

Filesize
2.1MB

MD5
e931aff8bb5115d35e0eca5096071344

SHA1
6e6f6a06ff806e411874e75250eab3d39c358844

SHA256
1719a1deba0ec2fd16a3a9b0ad5d5407e6e02a9dcca9c7d251e0f1f97c147d3c

SHA512
0015c7e1c56ed633e69eaeb60f5a581f40f7711c6fdf7bb7f3e7c5bc17039cb2ccc198f94bde69fa269f1b54fab8ac40668d9da998d4056050efd2b8c2cc9cda

Download Submit
C:\Windows\system\bkkbzPa.exe

Filesize
2.1MB

MD5
95029dcce962695f251009165ca9b660

SHA1
67f957f79f01a3df73d17c1d768c92305a1bec42

SHA256
9bdf636ff6538793bfd7116a0a7ba4214094f84941617383c8c271a44dee3d2b

SHA512
b3ec87a8b61a54ae8f0466ab0377df784e025b2ebaedfc0255308287d4d135a5607c74a4bd3c1369164f6a402be6623583e7a213f41133fb375d7b541e24b7f0

Download Submit
C:\Windows\system\cJuDALY.exe

Filesize
2.1MB

MD5
65d33c507519e0d36891ef3bfef21ad8

SHA1
f28a87f545ff42a0e269065265e8ae4315209929

SHA256
aebfad14bc59951a99e90231cb577e1be03606c65c2d0963f311522f059166d6

SHA512
b2a49a406cce0a96e61a21b8acabafd7ba5ed4325d7088646b837f2579495731a0d6eafcf3dfc5784e3165b421591379eb76302494a679cc471230f18993bca5

Download Submit
C:\Windows\system\eoSwQlu.exe

Filesize
2.1MB

MD5
f50a784122c93aad47651f9fc84fbc37

SHA1
b97c478a594c7411b394fcce1bd480021da87cb2

SHA256
ee036c302be5a3831bf947b5e9f879f44a091cd9208f270b7beabe02f4380468

SHA512
d1f16de101c50dc63de3ace0e610427aabb327f7706025212d65be29ac6936057230fcd154181076958e498bd0ea0fa66dd63b85cecbd5605faf1bd0c79f24a1

Download Submit
C:\Windows\system\hkHwGjZ.exe

Filesize
2.1MB

MD5
230193d302d94cb1ae90ed8495848576

SHA1
a0125c295e438c2aac1d9a1c3581dfa5ca584eb4

SHA256
ee0a03ce0c1dca358af6b5dec1a3961a50f74cafb12d5717faea223a5b879ca1

SHA512
5fa1b8d88dd2c0ada8ad4d3fc8d93f90a20f424804c8d4c1caa38b14439ad0d8374152c811f715958dff4ad654e1a14a143b3ea4bc5af407ebb0cbac8cdb921f

Download Submit
C:\Windows\system\kQVdWnA.exe

Filesize
2.1MB

MD5
33a22fe8e81408f694ea2c8c8b6c3891

SHA1
5f4efaf45486f27f31349caf3039000ed47f6970

SHA256
3ee2b1e484c259bcfede01c30838e3317462d1a19ab22ee736af905797a0a4a4

SHA512
456f3c7eaee4dcf53df2762a8bda4ea38150c6ea7e85269fc07ee3d0ad3bef9c81e06f7fb786e3a368689f48eb5ba79a7a6104f83166eee54f64cddf7beeed78

Download Submit
C:\Windows\system\nCzhlzs.exe

Filesize
2.1MB

MD5
52cdf910b6d552c7bd19e3412eeaf80c

SHA1
47efbaa26e7670053eae2aca1be078f197741dff

SHA256
f487b84fa9b8df8230d9d720b56ccc9f4a2e670713bb59874b453c10075eb024

SHA512
f7583f4f7ec38bdb81ab802686309c6c5e5269aa2384807b974bf0a12c4c5d1544b98bd4658ae37257138683e7254004962b344d010ccc8fa300fb8a215b5ec4

Download Submit
C:\Windows\system\oZCWceE.exe

Filesize
2.1MB

MD5
f864d75ad2a9e97ef9140e3ba59e8dea

SHA1
c8bd91f5b0a32b464990ca620e005b952c239d26

SHA256
9cf0c3570c8d5e7328bb158ce687b63b3cf2c6faed0cd0ede5bffb3726dcdc25

SHA512
7465a404f05a6d39129def919ec5de14efeee1b7ce0e0ea5f42486193b3a205a34706e23f6ff1f51aed282a9cbb68edbb5b05fbcf708fec0253437db70dfb2ee

Download Submit
C:\Windows\system\oaZxUdT.exe

Filesize
2.1MB

MD5
c3b533b5ec63277eebdc8a8a56ba1dbe

SHA1
7dae8337794a876baa07bda094254ea58cb0e24f

SHA256
f1d19b96111664a12ceb318f52ab287ddd3e38edb6f601e559ad0af3ea8b57ac

SHA512
296df127d17e9b0b1f066ca550d7a09a27cab4512876271e8cb7ca3493a04e444ae30a2d5a3befb105f973bd7ba7311a4a8506b7ccc5a31ba8851913e19c98c0

Download Submit
C:\Windows\system\qPXSnEb.exe

Filesize
2.1MB

MD5
7c47c7d3dc3b66116e5086a3e381894d

SHA1
efb8d462f74d7b15467df0d1eb6a24f07d5f4820

SHA256
d98999319db3aa171196a0afbab3b78d0c57bd4ec88d366a35ca5ba8563f1b96

SHA512
20457c17d509b4a6e3f715e82606dc7cceadd1aef77838817d2837feb25d2476320dd639dcb6c31895a7fc205a8e0918b880ef2a23d128aa1bbcadb6ea2736d8

Download Submit
C:\Windows\system\sErJoBj.exe

Filesize
2.1MB

MD5
756c1949861d79f73b4c37c9d2ee11a4

SHA1
66c3a4bfd0cdb6bbb746eceff02a4ba279e08412

SHA256
4faec629514e538bca5ac47cfed70c92af5392b5ba825ababa794f3f042cd365

SHA512
dee74ccc22a5e258f934e10cac1e38cf3d5c9243a6e5dce2645d47f48786371d12d127da1e8cb7aa54ebf669e04d5fdf02317c9ba831bdfceb80bb60ed0436fb

Download Submit
C:\Windows\system\uKAmUjn.exe

Filesize
2.1MB

MD5
e92e5f628f8c755af93f04013cecc9e3

SHA1
f93991aee761f2cc8a80fb551f114f03bc19c61c

SHA256
626cfae9ba6f5be6e5feceb937218885071d6f14fffebcee117a6b8325b854f3

SHA512
74ecb479e47720eca1265e85a655d854f505c8b51a692ad38bbbf830f4c24ad6271776c16ae681099f9e64f9407d6880f1b1104b5d03d0a12b6082c0a717ced3

Download Submit
C:\Windows\system\upUauCW.exe

Filesize
2.1MB

MD5
02563014ceaf3b270853a67e851f03aa

SHA1
f5328dd46d797cf9ffc68892f4384e2f56d0992c

SHA256
6b02dbb839c796d9924d302f6e79eff3df4f81e9bd9b919d0041fc59262a8cb8

SHA512
7aabee970dcdc25b833156a3da0bae02daea1f4cf5ca74b6b9d778730fe37e591244cf95fd999671438704661683db1d7de38b9871b12125c59f066ecb7afb65

Download Submit
C:\Windows\system\vDeoQkN.exe

Filesize
2.1MB

MD5
eec6b94fe69fa7f6b8d26634e33c9d2b

SHA1
68e7b91dff714c8df59b03c0db6f73a69f8400a8

SHA256
3425fb0922daf7a4267c86a1b611a486e7723ce70e69b34a172cd3653c37f22a

SHA512
8a6ad048b7b86d521e30c60e64f2b4954f3481403a888d6e1a51bae61574893340e6eb5d7c4719c978f262a2e4698da80e6019f7a1282d1a9c11bee14571ebbf

Download Submit
C:\Windows\system\yPsYpwp.exe

Filesize
2.1MB

MD5
4e8e53ecc2e240667aa4ec9c5ab3f988

SHA1
ac9753664887094d81c7718369dc5a08907d66d4

SHA256
4735f591d1fd81d79bf1638974ffdcb5f85ad73f9f3b37d9874fb88f28eedcc2

SHA512
99398f76fe6f0b66e5da2d342a7b5c63ac34c8f7e671a21fe02d2eab1eaf45242c8a516ec51bfbc49e935e3bd1f7668be67df34ee94922706714e53d8d8305ea

Download Submit
\Windows\system\AxryjSO.exe

Filesize
1024KB

MD5
82758aae579415e098e3eb1ae1ab3185

SHA1
bfa9082abc63b41cf6dcac7fb438df6da03a51c4

SHA256
896acc78340b1a2f75047646f1ccd9b81d080a748e61cff8f40cf9917c052e7e

SHA512
90a712d172bdf442a024e3aff92368018c5dc51cfa41dc641606aefaa99460ba8d14bd4a42ac8385cf9e460cea72169b397a630732a6563ee956ba9bf0929f35

Download Submit
\Windows\system\LVorAAO.exe

Filesize
2.1MB

MD5
525317549a5e1049ce90ce33f1412ef6

SHA1
687fb2342e86664c800a3db2f188ae313756c5db

SHA256
8a1baa4cea1d76ebe1affabd85717b4342af75ed4f0736dc77757a91dbabf7f7

SHA512
82d628b7fba7bd0058da9f2a4a631cd293534fa2a63869c7f9a22bbebd73a2eae2a88f387772ac3136c938665d4d95faad47aa815bf316a7ebd22f8b96c1e464

Download Submit
\Windows\system\UjNGlko.exe

Filesize
1.6MB

MD5
7890b48ae3163491590762dcbfbb7dcf

SHA1
bd4df87638273f7b1ca15f37cef42d150c1d0ea8

SHA256
debec8d904251ab14e25594c9435c8818db91fcadfc559e5b35f5d52bbdec995

SHA512
ae1e55655a6e20410efb4314e7155497ee02ed6219f7668c77df48c429e716eafe8827fbd63c5e7f5ef1b506227c5401ff9356cb2e24b44ebe1755a2a645ffaa

Download Submit
\Windows\system\gVuhTQl.exe

Filesize
2.1MB

MD5
87c4804a3e73cb0bfd27271681147400

SHA1
1039be70ecf922248d6944062d9b66237244cfd2

SHA256
b880ae00aab29a6f768fb3b6400eee6425a53874d7346703688ac6efc12748e9

SHA512
8e471a48403530fae20f4a83a4f0a6e4e531b98d3fc147c3fa306d355b1ae41ea243258af9377371b547eb7aa97c1add9c231ebe045a12f8d8eff2609f904d4c

Download Submit
memory/808-5693-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/808-186-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/1132-187-0x0000000002E30000-0x0000000003222000-memory.dmp

Filesize
3.9MB

Download
memory/1132-174-0x00000000034B0000-0x00000000038A2000-memory.dmp

Filesize
3.9MB

Download
memory/1132-166-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/1132-184-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/1132-8-0x0000000002CE0000-0x00000000030D2000-memory.dmp

Filesize
3.9MB

Download
memory/1132-24-0x0000000002E30000-0x0000000003222000-memory.dmp

Filesize
3.9MB

Download
memory/1132-171-0x00000000034B0000-0x00000000038A2000-memory.dmp

Filesize
3.9MB

Download
memory/1132-1-0x0000000000090000-0x00000000000A0000-memory.dmp

Filesize
64KB

Download
memory/1132-173-0x00000000034B0000-0x00000000038A2000-memory.dmp

Filesize
3.9MB

Download
memory/1132-182-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/1132-176-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/1132-0-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/1132-178-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/1160-26-0x000007FEF653E000-0x000007FEF653F000-memory.dmp

Filesize
4KB

Download
memory/1160-180-0x0000000002330000-0x0000000002338000-memory.dmp

Filesize
32KB

Download
memory/1160-164-0x000007FEF6280000-0x000007FEF6C1D000-memory.dmp

Filesize
9.6MB

Download
memory/1160-167-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/1160-341-0x000007FEF6280000-0x000007FEF6C1D000-memory.dmp

Filesize
9.6MB

Download
memory/2064-9-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-5319-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2464-177-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2468-5917-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-179-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-175-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/2592-5242-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2592-169-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2648-5202-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-188-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-5244-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-181-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2776-4100-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2776-172-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2948-183-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2960-185-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2960-5690-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/3060-25-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/3060-6146-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download