xmrig | d6d39cd62712a85faaa181d1f66a748764d96ae0bdf09e74ccdf4431445cba47

Analysis

max time kernel
24s
max time network
24s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
Size

2.1MB
MD5

0b0df83670739b620f6b43c7d4a516a7
SHA1

4e8a2e78b21cbedeb1060036788c358ee0c1ddba
SHA256

d6d39cd62712a85faaa181d1f66a748764d96ae0bdf09e74ccdf4431445cba47
SHA512

82c66144e5a3b1538f4606cd2c8bac95246e6c701f1ec44641f276026be1c91f81167a48b2947f2ef9fe8a6fc18621cbc23b23a56ff60be19dfd357654668845
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrGk:NABk

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2712-88-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig
behavioral1/memory/2580-97-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2752-101-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/2736-99-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2628-82-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/2496-111-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2428-109-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/2544-107-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2456-105-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2744-103-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/2116-75-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2976	vItPxsq.exe
2116	EXGFOjA.exe
2628	NXxvYpN.exe
2712	TvgjNek.exe
2580	FxDaFif.exe
2736	hvbhrit.exe
2752	UTvTlvF.exe
2744	LrAylmc.exe
2456	ToXJoYC.exe
2544	wGHVKjV.exe
2428	PPgGioD.exe
2496	iyIOGKE.exe
2864	hnexfVD.exe
1816	LMfbgty.exe
2868	ifuGyYq.exe
2672	NjHmOlV.exe
2224	fOpPKnV.exe
848	GoKQEqJ.exe
1320	mMZIzxx.exe
2104	nFYmidB.exe
1392	kOgxOrI.exe
2660	YImeMZb.exe
1292	ReJOIeL.exe
556	NRbQEzM.exe
1652	XPfHLnO.exe
1864	fwdFIaL.exe
988	YCVObKk.exe
3032	BoLEjnu.exe
1560	eLiRjzB.exe
1232	EFZUsTv.exe
2820	uczAcOz.exe
956	xpvlMeg.exe
540	MqxiJvt.exe
1952	AqnVZZr.exe
580	qPkLeyb.exe
2696	iLmvEzL.exe
1336	GdcwPst.exe
1120	HqCvQGk.exe
3000	mgoMiUk.exe
312	yEOrvXr.exe
472	xeBkOJe.exe
2780	kjvULDm.exe
2356	SMWtIPj.exe
1564	kaoKYvM.exe
2832	isjViPB.exe
2024	vJsjkCT.exe
1992	qrgYwEu.exe
888	focsNQu.exe
2852	qdbQELw.exe
1304	aWpZyix.exe
2856	ZvJjrhr.exe
352	DmEODoh.exe
2936	FlRCIgI.exe
2540	BRPsUzD.exe
2624	QsKdotR.exe
2792	UnSWCBm.exe
2896	kXKqIXF.exe
2284	BMKoXXm.exe
2052	xsKsxNL.exe
2408	aOWqCHV.exe
2676	xfisvMy.exe
2212	LBMVjzW.exe
2848	NSlFcgG.exe
2228	TlAdtGz.exe

Loads dropped DLL 64 IoCs

pid	Process
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2904-1-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/files/0x000c000000014890-3.dat	upx
behavioral1/memory/2976-8-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/files/0x0016000000005586-19.dat	upx
behavioral1/files/0x00080000000158d9-24.dat	upx
behavioral1/files/0x0007000000015ae3-25.dat	upx
behavioral1/files/0x0009000000015b50-31.dat	upx
behavioral1/files/0x0007000000015d61-39.dat	upx
behavioral1/files/0x0006000000015d85-43.dat	upx
behavioral1/files/0x0006000000015d9c-47.dat	upx
behavioral1/files/0x0006000000016013-59.dat	upx
behavioral1/files/0x0006000000016122-61.dat	upx
behavioral1/files/0x0006000000015fa6-55.dat	upx
behavioral1/files/0x0006000000015f23-51.dat	upx
behavioral1/files/0x0009000000015b85-36.dat	upx
behavioral1/memory/2712-88-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/memory/2580-97-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2752-101-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/files/0x00340000000150d9-113.dat	upx
behavioral1/memory/2736-99-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/files/0x00060000000163eb-84.dat	upx
behavioral1/memory/2628-82-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/memory/2496-111-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/files/0x00060000000164ec-121.dat	upx
behavioral1/memory/2428-109-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/files/0x0006000000016a28-132.dat	upx
behavioral1/files/0x0006000000016c30-142.dat	upx
behavioral1/files/0x0006000000016d29-191.dat	upx
behavioral1/files/0x00060000000167bf-131.dat	upx
behavioral1/files/0x0006000000016d31-193.dat	upx
behavioral1/files/0x0006000000016d18-184.dat	upx
behavioral1/files/0x0006000000016d21-183.dat	upx
behavioral1/files/0x0006000000016d06-179.dat	upx
behavioral1/files/0x0006000000016d10-176.dat	upx
behavioral1/files/0x0006000000016cfd-170.dat	upx
behavioral1/files/0x0006000000016ced-160.dat	upx
behavioral1/files/0x0006000000016c84-154.dat	upx
behavioral1/files/0x0006000000016cb5-151.dat	upx
behavioral1/files/0x0006000000016c38-144.dat	upx
behavioral1/files/0x0006000000016c1f-135.dat	upx
behavioral1/files/0x0006000000016cf3-166.dat	upx
behavioral1/files/0x0006000000016ce0-158.dat	upx
behavioral1/files/0x0006000000016575-125.dat	upx
behavioral1/memory/2544-107-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2456-105-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/memory/2744-103-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/2116-75-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/files/0x00060000000161ee-69.dat	upx
behavioral1/files/0x0034000000015083-16.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fvLrygI.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\BUAHBgh.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\ybymFSo.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\xSnWEoJ.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\RMVQDbS.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\KudlHJt.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\rXjIwQO.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\fXlMojd.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\ZpOlnHS.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\uTblFWq.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\JerencV.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\svPXKaZ.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\iyFEsob.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\rCRogLe.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\WLEiuAW.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\ptaGnYY.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\YiefrnL.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\QAQlQtt.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\yPuzICL.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\MpRaLFQ.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\scaBlsK.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\nJnCSlu.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\sCbRnrG.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\mfzzSOM.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\NcZFQlF.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\SOXhuZG.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\KHyGyCP.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\HrIpwAt.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\onCuOsP.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\hzrvXmR.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\dteVsPq.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\NdtjVsZ.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\majPWVR.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\sFgYuKr.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\WEdsBCF.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\KYyCgfi.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\uEQRwLc.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\euPTPgt.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\TQnpfDT.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\FntUHpO.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\bJMptyt.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\CaLcwDO.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\vBFUEeS.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\HaUgThR.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\MWZBXjG.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\DmEODoh.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\gUEGDuv.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\xytaQuu.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\sclmnhD.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\LMfbgty.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\xuWiVms.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\dprdymK.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\nCLfGJD.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\fiAaQcB.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\qqYVgIJ.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\WfkzQoT.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\YCVObKk.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\bUIADuz.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\zmGXVKh.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\Wpspgcw.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\DwnYrmv.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\oeWMbCb.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\xzTbOty.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\IbVooey.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2964	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
Token: SeDebugPrivilege	2964	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2964	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	29
PID 2904 wrote to memory of 2964	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	29
PID 2904 wrote to memory of 2964	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	29
PID 2904 wrote to memory of 2976	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	30
PID 2904 wrote to memory of 2976	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	30
PID 2904 wrote to memory of 2976	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	30
PID 2904 wrote to memory of 2116	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	31
PID 2904 wrote to memory of 2116	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	31
PID 2904 wrote to memory of 2116	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	31
PID 2904 wrote to memory of 2628	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	32
PID 2904 wrote to memory of 2628	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	32
PID 2904 wrote to memory of 2628	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	32
PID 2904 wrote to memory of 2712	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	33
PID 2904 wrote to memory of 2712	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	33
PID 2904 wrote to memory of 2712	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	33
PID 2904 wrote to memory of 2580	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	34
PID 2904 wrote to memory of 2580	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	34
PID 2904 wrote to memory of 2580	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	34
PID 2904 wrote to memory of 2736	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	35
PID 2904 wrote to memory of 2736	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	35
PID 2904 wrote to memory of 2736	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	35
PID 2904 wrote to memory of 2752	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	36
PID 2904 wrote to memory of 2752	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	36
PID 2904 wrote to memory of 2752	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	36
PID 2904 wrote to memory of 2744	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	37
PID 2904 wrote to memory of 2744	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	37
PID 2904 wrote to memory of 2744	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	37
PID 2904 wrote to memory of 2456	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	38
PID 2904 wrote to memory of 2456	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	38
PID 2904 wrote to memory of 2456	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	38
PID 2904 wrote to memory of 2544	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	39
PID 2904 wrote to memory of 2544	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	39
PID 2904 wrote to memory of 2544	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	39
PID 2904 wrote to memory of 2428	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	40
PID 2904 wrote to memory of 2428	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	40
PID 2904 wrote to memory of 2428	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	40
PID 2904 wrote to memory of 2496	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	41
PID 2904 wrote to memory of 2496	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	41
PID 2904 wrote to memory of 2496	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	41
PID 2904 wrote to memory of 2864	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	42
PID 2904 wrote to memory of 2864	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	42
PID 2904 wrote to memory of 2864	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	42
PID 2904 wrote to memory of 2868	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	43
PID 2904 wrote to memory of 2868	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	43
PID 2904 wrote to memory of 2868	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	43
PID 2904 wrote to memory of 1816	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	44
PID 2904 wrote to memory of 1816	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	44
PID 2904 wrote to memory of 1816	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	44
PID 2904 wrote to memory of 2672	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	45
PID 2904 wrote to memory of 2672	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	45
PID 2904 wrote to memory of 2672	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	45
PID 2904 wrote to memory of 2224	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	46
PID 2904 wrote to memory of 2224	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	46
PID 2904 wrote to memory of 2224	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	46
PID 2904 wrote to memory of 848	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	47
PID 2904 wrote to memory of 848	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	47
PID 2904 wrote to memory of 848	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	47
PID 2904 wrote to memory of 1320	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	48
PID 2904 wrote to memory of 1320	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	48
PID 2904 wrote to memory of 1320	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	48
PID 2904 wrote to memory of 2104	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	49
PID 2904 wrote to memory of 2104	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	49
PID 2904 wrote to memory of 2104	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	49
PID 2904 wrote to memory of 1392	2904	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2964
- C:\Windows\System\vItPxsq.exe
  C:\Windows\System\vItPxsq.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\EXGFOjA.exe
  C:\Windows\System\EXGFOjA.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\NXxvYpN.exe
  C:\Windows\System\NXxvYpN.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\TvgjNek.exe
  C:\Windows\System\TvgjNek.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\FxDaFif.exe
  C:\Windows\System\FxDaFif.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\hvbhrit.exe
  C:\Windows\System\hvbhrit.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\UTvTlvF.exe
  C:\Windows\System\UTvTlvF.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\LrAylmc.exe
  C:\Windows\System\LrAylmc.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\ToXJoYC.exe
  C:\Windows\System\ToXJoYC.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\wGHVKjV.exe
  C:\Windows\System\wGHVKjV.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\PPgGioD.exe
  C:\Windows\System\PPgGioD.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\iyIOGKE.exe
  C:\Windows\System\iyIOGKE.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\hnexfVD.exe
  C:\Windows\System\hnexfVD.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\ifuGyYq.exe
  C:\Windows\System\ifuGyYq.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\LMfbgty.exe
  C:\Windows\System\LMfbgty.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\NjHmOlV.exe
  C:\Windows\System\NjHmOlV.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\fOpPKnV.exe
  C:\Windows\System\fOpPKnV.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\GoKQEqJ.exe
  C:\Windows\System\GoKQEqJ.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\mMZIzxx.exe
  C:\Windows\System\mMZIzxx.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\nFYmidB.exe
  C:\Windows\System\nFYmidB.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\kOgxOrI.exe
  C:\Windows\System\kOgxOrI.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\EFZUsTv.exe
  C:\Windows\System\EFZUsTv.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\YImeMZb.exe
  C:\Windows\System\YImeMZb.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\uczAcOz.exe
  C:\Windows\System\uczAcOz.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\ReJOIeL.exe
  C:\Windows\System\ReJOIeL.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\MqxiJvt.exe
  C:\Windows\System\MqxiJvt.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\NRbQEzM.exe
  C:\Windows\System\NRbQEzM.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\qPkLeyb.exe
  C:\Windows\System\qPkLeyb.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\XPfHLnO.exe
  C:\Windows\System\XPfHLnO.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\iLmvEzL.exe
  C:\Windows\System\iLmvEzL.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\fwdFIaL.exe
  C:\Windows\System\fwdFIaL.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\GdcwPst.exe
  C:\Windows\System\GdcwPst.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\YCVObKk.exe
  C:\Windows\System\YCVObKk.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\HqCvQGk.exe
  C:\Windows\System\HqCvQGk.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\BoLEjnu.exe
  C:\Windows\System\BoLEjnu.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\mgoMiUk.exe
  C:\Windows\System\mgoMiUk.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\eLiRjzB.exe
  C:\Windows\System\eLiRjzB.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\yEOrvXr.exe
  C:\Windows\System\yEOrvXr.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\xpvlMeg.exe
  C:\Windows\System\xpvlMeg.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\xeBkOJe.exe
  C:\Windows\System\xeBkOJe.exe
  2⤵
  - Executes dropped EXE
  PID:472
- C:\Windows\System\AqnVZZr.exe
  C:\Windows\System\AqnVZZr.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\SMWtIPj.exe
  C:\Windows\System\SMWtIPj.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\kjvULDm.exe
  C:\Windows\System\kjvULDm.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\kaoKYvM.exe
  C:\Windows\System\kaoKYvM.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\isjViPB.exe
  C:\Windows\System\isjViPB.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\vJsjkCT.exe
  C:\Windows\System\vJsjkCT.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\qrgYwEu.exe
  C:\Windows\System\qrgYwEu.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\aWpZyix.exe
  C:\Windows\System\aWpZyix.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\focsNQu.exe
  C:\Windows\System\focsNQu.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\ZvJjrhr.exe
  C:\Windows\System\ZvJjrhr.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\qdbQELw.exe
  C:\Windows\System\qdbQELw.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\DmEODoh.exe
  C:\Windows\System\DmEODoh.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\FlRCIgI.exe
  C:\Windows\System\FlRCIgI.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\BRPsUzD.exe
  C:\Windows\System\BRPsUzD.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\QsKdotR.exe
  C:\Windows\System\QsKdotR.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\UnSWCBm.exe
  C:\Windows\System\UnSWCBm.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\kXKqIXF.exe
  C:\Windows\System\kXKqIXF.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\BMKoXXm.exe
  C:\Windows\System\BMKoXXm.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\xsKsxNL.exe
  C:\Windows\System\xsKsxNL.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\aOWqCHV.exe
  C:\Windows\System\aOWqCHV.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\xfisvMy.exe
  C:\Windows\System\xfisvMy.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\LBMVjzW.exe
  C:\Windows\System\LBMVjzW.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\NSlFcgG.exe
  C:\Windows\System\NSlFcgG.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\TlAdtGz.exe
  C:\Windows\System\TlAdtGz.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\TwxfXbf.exe
  C:\Windows\System\TwxfXbf.exe
  2⤵
  PID:2768
- C:\Windows\System\kZsvuNV.exe
  C:\Windows\System\kZsvuNV.exe
  2⤵
  PID:2304
- C:\Windows\System\ypAxiJP.exe
  C:\Windows\System\ypAxiJP.exe
  2⤵
  PID:1136
- C:\Windows\System\sIreniT.exe
  C:\Windows\System\sIreniT.exe
  2⤵
  PID:600
- C:\Windows\System\UXhePvS.exe
  C:\Windows\System\UXhePvS.exe
  2⤵
  PID:1824
- C:\Windows\System\mQJKIQO.exe
  C:\Windows\System\mQJKIQO.exe
  2⤵
  PID:2400
- C:\Windows\System\jaNccqk.exe
  C:\Windows\System\jaNccqk.exe
  2⤵
  PID:2632
- C:\Windows\System\nnOqRni.exe
  C:\Windows\System\nnOqRni.exe
  2⤵
  PID:1544
- C:\Windows\System\JvbNtbv.exe
  C:\Windows\System\JvbNtbv.exe
  2⤵
  PID:2396
- C:\Windows\System\HKoGCAR.exe
  C:\Windows\System\HKoGCAR.exe
  2⤵
  PID:1052
- C:\Windows\System\dCCgkwr.exe
  C:\Windows\System\dCCgkwr.exe
  2⤵
  PID:572
- C:\Windows\System\twyjPDh.exe
  C:\Windows\System\twyjPDh.exe
  2⤵
  PID:2448
- C:\Windows\System\hheDINL.exe
  C:\Windows\System\hheDINL.exe
  2⤵
  PID:2288
- C:\Windows\System\QuGCBxt.exe
  C:\Windows\System\QuGCBxt.exe
  2⤵
  PID:488
- C:\Windows\System\KLbqDZH.exe
  C:\Windows\System\KLbqDZH.exe
  2⤵
  PID:784
- C:\Windows\System\uSGMEUH.exe
  C:\Windows\System\uSGMEUH.exe
  2⤵
  PID:1920
- C:\Windows\System\ISJRnbu.exe
  C:\Windows\System\ISJRnbu.exe
  2⤵
  PID:1092
- C:\Windows\System\waLKEVn.exe
  C:\Windows\System\waLKEVn.exe
  2⤵
  PID:1812
- C:\Windows\System\uINQUbm.exe
  C:\Windows\System\uINQUbm.exe
  2⤵
  PID:1288
- C:\Windows\System\PAFSQEJ.exe
  C:\Windows\System\PAFSQEJ.exe
  2⤵
  PID:1716
- C:\Windows\System\UssfwTQ.exe
  C:\Windows\System\UssfwTQ.exe
  2⤵
  PID:1124
- C:\Windows\System\WuewTJj.exe
  C:\Windows\System\WuewTJj.exe
  2⤵
  PID:2280
- C:\Windows\System\ULyXSBH.exe
  C:\Windows\System\ULyXSBH.exe
  2⤵
  PID:2260
- C:\Windows\System\QBDfNbK.exe
  C:\Windows\System\QBDfNbK.exe
  2⤵
  PID:2948
- C:\Windows\System\xuWiVms.exe
  C:\Windows\System\xuWiVms.exe
  2⤵
  PID:896
- C:\Windows\System\DwnYrmv.exe
  C:\Windows\System\DwnYrmv.exe
  2⤵
  PID:1588
- C:\Windows\System\zxQjEtq.exe
  C:\Windows\System\zxQjEtq.exe
  2⤵
  PID:3056
- C:\Windows\System\tBwUFcZ.exe
  C:\Windows\System\tBwUFcZ.exe
  2⤵
  PID:2576
- C:\Windows\System\WVZtQUz.exe
  C:\Windows\System\WVZtQUz.exe
  2⤵
  PID:2640
- C:\Windows\System\KWYondC.exe
  C:\Windows\System\KWYondC.exe
  2⤵
  PID:2732
- C:\Windows\System\yyVfaOL.exe
  C:\Windows\System\yyVfaOL.exe
  2⤵
  PID:2436
- C:\Windows\System\gzUwhDY.exe
  C:\Windows\System\gzUwhDY.exe
  2⤵
  PID:1532
- C:\Windows\System\eswWYIJ.exe
  C:\Windows\System\eswWYIJ.exe
  2⤵
  PID:2500
- C:\Windows\System\mjkCosa.exe
  C:\Windows\System\mjkCosa.exe
  2⤵
  PID:2520
- C:\Windows\System\wxeUlDc.exe
  C:\Windows\System\wxeUlDc.exe
  2⤵
  PID:1984
- C:\Windows\System\anefmrf.exe
  C:\Windows\System\anefmrf.exe
  2⤵
  PID:3036
- C:\Windows\System\WSBwDGn.exe
  C:\Windows\System\WSBwDGn.exe
  2⤵
  PID:636
- C:\Windows\System\WvakDQH.exe
  C:\Windows\System\WvakDQH.exe
  2⤵
  PID:1604
- C:\Windows\System\AnFkQdh.exe
  C:\Windows\System\AnFkQdh.exe
  2⤵
  PID:1268
- C:\Windows\System\BxLhPyV.exe
  C:\Windows\System\BxLhPyV.exe
  2⤵
  PID:2568
- C:\Windows\System\LhDIEpm.exe
  C:\Windows\System\LhDIEpm.exe
  2⤵
  PID:1016
- C:\Windows\System\SptymmJ.exe
  C:\Windows\System\SptymmJ.exe
  2⤵
  PID:568
- C:\Windows\System\LHaCMdk.exe
  C:\Windows\System\LHaCMdk.exe
  2⤵
  PID:304
- C:\Windows\System\vbzBaxY.exe
  C:\Windows\System\vbzBaxY.exe
  2⤵
  PID:664
- C:\Windows\System\OdThazB.exe
  C:\Windows\System\OdThazB.exe
  2⤵
  PID:2220
- C:\Windows\System\GXtFsnz.exe
  C:\Windows\System\GXtFsnz.exe
  2⤵
  PID:3088
- C:\Windows\System\fwqEqfH.exe
  C:\Windows\System\fwqEqfH.exe
  2⤵
  PID:3108
- C:\Windows\System\AKxSyDm.exe
  C:\Windows\System\AKxSyDm.exe
  2⤵
  PID:3124
- C:\Windows\System\ymKrRLe.exe
  C:\Windows\System\ymKrRLe.exe
  2⤵
  PID:3164
- C:\Windows\System\HAuCgEW.exe
  C:\Windows\System\HAuCgEW.exe
  2⤵
  PID:3184
- C:\Windows\System\OpCtihu.exe
  C:\Windows\System\OpCtihu.exe
  2⤵
  PID:3200
- C:\Windows\System\kHYfNVR.exe
  C:\Windows\System\kHYfNVR.exe
  2⤵
  PID:3216
- C:\Windows\System\izTMUTx.exe
  C:\Windows\System\izTMUTx.exe
  2⤵
  PID:3232
- C:\Windows\System\srjdiNz.exe
  C:\Windows\System\srjdiNz.exe
  2⤵
  PID:3252
- C:\Windows\System\oeWMbCb.exe
  C:\Windows\System\oeWMbCb.exe
  2⤵
  PID:3272
- C:\Windows\System\yPuzICL.exe
  C:\Windows\System\yPuzICL.exe
  2⤵
  PID:3288
- C:\Windows\System\onLoyAc.exe
  C:\Windows\System\onLoyAc.exe
  2⤵
  PID:3304
- C:\Windows\System\RTwGvoT.exe
  C:\Windows\System\RTwGvoT.exe
  2⤵
  PID:3360
- C:\Windows\System\MpRaLFQ.exe
  C:\Windows\System\MpRaLFQ.exe
  2⤵
  PID:3392
- C:\Windows\System\tAXhzKM.exe
  C:\Windows\System\tAXhzKM.exe
  2⤵
  PID:3424
- C:\Windows\System\fsNjcJv.exe
  C:\Windows\System\fsNjcJv.exe
  2⤵
  PID:3456
- C:\Windows\System\WJXMbVn.exe
  C:\Windows\System\WJXMbVn.exe
  2⤵
  PID:3484
- C:\Windows\System\eSUDefl.exe
  C:\Windows\System\eSUDefl.exe
  2⤵
  PID:3512
- C:\Windows\System\mcKxJTY.exe
  C:\Windows\System\mcKxJTY.exe
  2⤵
  PID:3536
- C:\Windows\System\YgmrzJk.exe
  C:\Windows\System\YgmrzJk.exe
  2⤵
  PID:3568
- C:\Windows\System\aApIqbz.exe
  C:\Windows\System\aApIqbz.exe
  2⤵
  PID:3588
- C:\Windows\System\scaBlsK.exe
  C:\Windows\System\scaBlsK.exe
  2⤵
  PID:3608
- C:\Windows\System\GRouTQt.exe
  C:\Windows\System\GRouTQt.exe
  2⤵
  PID:3632
- C:\Windows\System\RrrMODq.exe
  C:\Windows\System\RrrMODq.exe
  2⤵
  PID:3652
- C:\Windows\System\IgnbDcy.exe
  C:\Windows\System\IgnbDcy.exe
  2⤵
  PID:3672
- C:\Windows\System\OPgRQbH.exe
  C:\Windows\System\OPgRQbH.exe
  2⤵
  PID:3692
- C:\Windows\System\CVPlynO.exe
  C:\Windows\System\CVPlynO.exe
  2⤵
  PID:3716
- C:\Windows\System\UmHNprn.exe
  C:\Windows\System\UmHNprn.exe
  2⤵
  PID:3736
- C:\Windows\System\oxdaHZC.exe
  C:\Windows\System\oxdaHZC.exe
  2⤵
  PID:3756
- C:\Windows\System\qmGxqIU.exe
  C:\Windows\System\qmGxqIU.exe
  2⤵
  PID:3776
- C:\Windows\System\bpelxVj.exe
  C:\Windows\System\bpelxVj.exe
  2⤵
  PID:3796
- C:\Windows\System\oQBVBMM.exe
  C:\Windows\System\oQBVBMM.exe
  2⤵
  PID:3816
- C:\Windows\System\DwAPmSw.exe
  C:\Windows\System\DwAPmSw.exe
  2⤵
  PID:3836
- C:\Windows\System\QVYqhbX.exe
  C:\Windows\System\QVYqhbX.exe
  2⤵
  PID:3856
- C:\Windows\System\tyLgqDS.exe
  C:\Windows\System\tyLgqDS.exe
  2⤵
  PID:3876
- C:\Windows\System\ReCkSkB.exe
  C:\Windows\System\ReCkSkB.exe
  2⤵
  PID:3900
- C:\Windows\System\legvRAz.exe
  C:\Windows\System\legvRAz.exe
  2⤵
  PID:3916
- C:\Windows\System\xCPWpBY.exe
  C:\Windows\System\xCPWpBY.exe
  2⤵
  PID:3936
- C:\Windows\System\KLgTtYI.exe
  C:\Windows\System\KLgTtYI.exe
  2⤵
  PID:3956
- C:\Windows\System\DTIIejQ.exe
  C:\Windows\System\DTIIejQ.exe
  2⤵
  PID:3976
- C:\Windows\System\UedlpFO.exe
  C:\Windows\System\UedlpFO.exe
  2⤵
  PID:3996
- C:\Windows\System\wqmoCPN.exe
  C:\Windows\System\wqmoCPN.exe
  2⤵
  PID:4016
- C:\Windows\System\xIbZvIr.exe
  C:\Windows\System\xIbZvIr.exe
  2⤵
  PID:4040
- C:\Windows\System\ktMPMwo.exe
  C:\Windows\System\ktMPMwo.exe
  2⤵
  PID:4056
- C:\Windows\System\QoDZihe.exe
  C:\Windows\System\QoDZihe.exe
  2⤵
  PID:4080
- C:\Windows\System\YqlhomC.exe
  C:\Windows\System\YqlhomC.exe
  2⤵
  PID:1620
- C:\Windows\System\FjWyDIm.exe
  C:\Windows\System\FjWyDIm.exe
  2⤵
  PID:2596
- C:\Windows\System\nJnCSlu.exe
  C:\Windows\System\nJnCSlu.exe
  2⤵
  PID:1944
- C:\Windows\System\RJvpEYc.exe
  C:\Windows\System\RJvpEYc.exe
  2⤵
  PID:840
- C:\Windows\System\kJqyWsB.exe
  C:\Windows\System\kJqyWsB.exe
  2⤵
  PID:2420
- C:\Windows\System\hjYDsmn.exe
  C:\Windows\System\hjYDsmn.exe
  2⤵
  PID:2036
- C:\Windows\System\xSnWEoJ.exe
  C:\Windows\System\xSnWEoJ.exe
  2⤵
  PID:1740
- C:\Windows\System\bNRhICF.exe
  C:\Windows\System\bNRhICF.exe
  2⤵
  PID:2328
- C:\Windows\System\djbKExw.exe
  C:\Windows\System\djbKExw.exe
  2⤵
  PID:1496
- C:\Windows\System\FeVrRMV.exe
  C:\Windows\System\FeVrRMV.exe
  2⤵
  PID:2144
- C:\Windows\System\IXspHPC.exe
  C:\Windows\System\IXspHPC.exe
  2⤵
  PID:1748
- C:\Windows\System\ClEBhjD.exe
  C:\Windows\System\ClEBhjD.exe
  2⤵
  PID:1340
- C:\Windows\System\ntJQFju.exe
  C:\Windows\System\ntJQFju.exe
  2⤵
  PID:3208
- C:\Windows\System\SyQtzdh.exe
  C:\Windows\System\SyQtzdh.exe
  2⤵
  PID:3248
- C:\Windows\System\JbQagZX.exe
  C:\Windows\System\JbQagZX.exe
  2⤵
  PID:3284
- C:\Windows\System\UMfBspQ.exe
  C:\Windows\System\UMfBspQ.exe
  2⤵
  PID:3356
- C:\Windows\System\lPEasOg.exe
  C:\Windows\System\lPEasOg.exe
  2⤵
  PID:2384
- C:\Windows\System\iYYdJoG.exe
  C:\Windows\System\iYYdJoG.exe
  2⤵
  PID:3400
- C:\Windows\System\vLdTfGL.exe
  C:\Windows\System\vLdTfGL.exe
  2⤵
  PID:3412
- C:\Windows\System\MtPIaOf.exe
  C:\Windows\System\MtPIaOf.exe
  2⤵
  PID:2112
- C:\Windows\System\TUGcnjK.exe
  C:\Windows\System\TUGcnjK.exe
  2⤵
  PID:2528
- C:\Windows\System\ojsWPEE.exe
  C:\Windows\System\ojsWPEE.exe
  2⤵
  PID:3464
- C:\Windows\System\tjKKrPB.exe
  C:\Windows\System\tjKKrPB.exe
  2⤵
  PID:2404
- C:\Windows\System\SaFkteC.exe
  C:\Windows\System\SaFkteC.exe
  2⤵
  PID:412
- C:\Windows\System\EVlhXDZ.exe
  C:\Windows\System\EVlhXDZ.exe
  2⤵
  PID:2320
- C:\Windows\System\OMaYIYQ.exe
  C:\Windows\System\OMaYIYQ.exe
  2⤵
  PID:1648
- C:\Windows\System\Crnkgkl.exe
  C:\Windows\System\Crnkgkl.exe
  2⤵
  PID:1592
- C:\Windows\System\ABdBnAR.exe
  C:\Windows\System\ABdBnAR.exe
  2⤵
  PID:2760
- C:\Windows\System\IJvDMJX.exe
  C:\Windows\System\IJvDMJX.exe
  2⤵
  PID:2648
- C:\Windows\System\iwKmJaA.exe
  C:\Windows\System\iwKmJaA.exe
  2⤵
  PID:3100
- C:\Windows\System\HeerKaB.exe
  C:\Windows\System\HeerKaB.exe
  2⤵
  PID:1660
- C:\Windows\System\joqljwo.exe
  C:\Windows\System\joqljwo.exe
  2⤵
  PID:3136
- C:\Windows\System\WfHLWtB.exe
  C:\Windows\System\WfHLWtB.exe
  2⤵
  PID:3196
- C:\Windows\System\NORZaCH.exe
  C:\Windows\System\NORZaCH.exe
  2⤵
  PID:3492
- C:\Windows\System\LWixKKi.exe
  C:\Windows\System\LWixKKi.exe
  2⤵
  PID:3508
- C:\Windows\System\uTWjZZu.exe
  C:\Windows\System\uTWjZZu.exe
  2⤵
  PID:3552
- C:\Windows\System\SaIeRQf.exe
  C:\Windows\System\SaIeRQf.exe
  2⤵
  PID:2508
- C:\Windows\System\ANrLxUy.exe
  C:\Windows\System\ANrLxUy.exe
  2⤵
  PID:2344
- C:\Windows\System\tzgsSLE.exe
  C:\Windows\System\tzgsSLE.exe
  2⤵
  PID:3628
- C:\Windows\System\aRmUGEX.exe
  C:\Windows\System\aRmUGEX.exe
  2⤵
  PID:3640
- C:\Windows\System\sCbRnrG.exe
  C:\Windows\System\sCbRnrG.exe
  2⤵
  PID:3668
- C:\Windows\System\nidjdvD.exe
  C:\Windows\System\nidjdvD.exe
  2⤵
  PID:3680
- C:\Windows\System\YAvVsbc.exe
  C:\Windows\System\YAvVsbc.exe
  2⤵
  PID:3684
- C:\Windows\System\OkrtZtO.exe
  C:\Windows\System\OkrtZtO.exe
  2⤵
  PID:2700
- C:\Windows\System\BVwrDtl.exe
  C:\Windows\System\BVwrDtl.exe
  2⤵
  PID:3748
- C:\Windows\System\KZYFvqy.exe
  C:\Windows\System\KZYFvqy.exe
  2⤵
  PID:3788
- C:\Windows\System\PoROuJS.exe
  C:\Windows\System\PoROuJS.exe
  2⤵
  PID:3832
- C:\Windows\System\bUIADuz.exe
  C:\Windows\System\bUIADuz.exe
  2⤵
  PID:3872
- C:\Windows\System\lzilRze.exe
  C:\Windows\System\lzilRze.exe
  2⤵
  PID:3848
- C:\Windows\System\eebrmFP.exe
  C:\Windows\System\eebrmFP.exe
  2⤵
  PID:1684
- C:\Windows\System\YlTgKkm.exe
  C:\Windows\System\YlTgKkm.exe
  2⤵
  PID:344
- C:\Windows\System\lFaxBWF.exe
  C:\Windows\System\lFaxBWF.exe
  2⤵
  PID:1520
- C:\Windows\System\XvaetKu.exe
  C:\Windows\System\XvaetKu.exe
  2⤵
  PID:3912
- C:\Windows\System\uokfwpf.exe
  C:\Windows\System\uokfwpf.exe
  2⤵
  PID:3952
- C:\Windows\System\SFIoTcg.exe
  C:\Windows\System\SFIoTcg.exe
  2⤵
  PID:3984
- C:\Windows\System\ngTHKuI.exe
  C:\Windows\System\ngTHKuI.exe
  2⤵
  PID:1852
- C:\Windows\System\SOJfPno.exe
  C:\Windows\System\SOJfPno.exe
  2⤵
  PID:4032
- C:\Windows\System\axgRvaj.exe
  C:\Windows\System\axgRvaj.exe
  2⤵
  PID:4028
- C:\Windows\System\cUGYEzm.exe
  C:\Windows\System\cUGYEzm.exe
  2⤵
  PID:4076
- C:\Windows\System\KqmGpTc.exe
  C:\Windows\System\KqmGpTc.exe
  2⤵
  PID:680
- C:\Windows\System\MIvmIfb.exe
  C:\Windows\System\MIvmIfb.exe
  2⤵
  PID:2472
- C:\Windows\System\FQGCYhV.exe
  C:\Windows\System\FQGCYhV.exe
  2⤵
  PID:1316
- C:\Windows\System\sMDIFTT.exe
  C:\Windows\System\sMDIFTT.exe
  2⤵
  PID:1800
- C:\Windows\System\uhOgsve.exe
  C:\Windows\System\uhOgsve.exe
  2⤵
  PID:2056
- C:\Windows\System\WRwFwQq.exe
  C:\Windows\System\WRwFwQq.exe
  2⤵
  PID:1772
- C:\Windows\System\RdEIkZm.exe
  C:\Windows\System\RdEIkZm.exe
  2⤵
  PID:3180
- C:\Windows\System\CCchsth.exe
  C:\Windows\System\CCchsth.exe
  2⤵
  PID:776
- C:\Windows\System\NffqHVp.exe
  C:\Windows\System\NffqHVp.exe
  2⤵
  PID:3244
- C:\Windows\System\bLRVlgH.exe
  C:\Windows\System\bLRVlgH.exe
  2⤵
  PID:3328
- C:\Windows\System\zhOVuok.exe
  C:\Windows\System\zhOVuok.exe
  2⤵
  PID:3344
- C:\Windows\System\svPXKaZ.exe
  C:\Windows\System\svPXKaZ.exe
  2⤵
  PID:2812
- C:\Windows\System\bUtOonx.exe
  C:\Windows\System\bUtOonx.exe
  2⤵
  PID:3176
- C:\Windows\System\RrAOqEN.exe
  C:\Windows\System\RrAOqEN.exe
  2⤵
  PID:2516
- C:\Windows\System\xExYHiC.exe
  C:\Windows\System\xExYHiC.exe
  2⤵
  PID:2996
- C:\Windows\System\QdzxkZt.exe
  C:\Windows\System\QdzxkZt.exe
  2⤵
  PID:2564
- C:\Windows\System\qbOYezy.exe
  C:\Windows\System\qbOYezy.exe
  2⤵
  PID:912
- C:\Windows\System\CiqEVux.exe
  C:\Windows\System\CiqEVux.exe
  2⤵
  PID:2572
- C:\Windows\System\eljXUlW.exe
  C:\Windows\System\eljXUlW.exe
  2⤵
  PID:1344
- C:\Windows\System\glrZPYw.exe
  C:\Windows\System\glrZPYw.exe
  2⤵
  PID:3104
- C:\Windows\System\EVEbzfc.exe
  C:\Windows\System\EVEbzfc.exe
  2⤵
  PID:2460
- C:\Windows\System\NWJFkXs.exe
  C:\Windows\System\NWJFkXs.exe
  2⤵
  PID:2080
- C:\Windows\System\xRFSnAc.exe
  C:\Windows\System\xRFSnAc.exe
  2⤵
  PID:3452
- C:\Windows\System\zqvYwBW.exe
  C:\Windows\System\zqvYwBW.exe
  2⤵
  PID:1048
- C:\Windows\System\rmakTiq.exe
  C:\Windows\System\rmakTiq.exe
  2⤵
  PID:3584
- C:\Windows\System\QsfIyxZ.exe
  C:\Windows\System\QsfIyxZ.exe
  2⤵
  PID:3140
- C:\Windows\System\COfMXsH.exe
  C:\Windows\System\COfMXsH.exe
  2⤵
  PID:3192
- C:\Windows\System\QMfijJL.exe
  C:\Windows\System\QMfijJL.exe
  2⤵
  PID:3380
- C:\Windows\System\oGcdKEL.exe
  C:\Windows\System\oGcdKEL.exe
  2⤵
  PID:2432
- C:\Windows\System\gMmfpUR.exe
  C:\Windows\System\gMmfpUR.exe
  2⤵
  PID:3548
- C:\Windows\System\fswuyFZ.exe
  C:\Windows\System\fswuyFZ.exe
  2⤵
  PID:3644
- C:\Windows\System\UUzPNWd.exe
  C:\Windows\System\UUzPNWd.exe
  2⤵
  PID:3772
- C:\Windows\System\AjMniUT.exe
  C:\Windows\System\AjMniUT.exe
  2⤵
  PID:3624
- C:\Windows\System\IvlALVK.exe
  C:\Windows\System\IvlALVK.exe
  2⤵
  PID:3812
- C:\Windows\System\UXQsrjL.exe
  C:\Windows\System\UXQsrjL.exe
  2⤵
  PID:3064
- C:\Windows\System\nhOuxSy.exe
  C:\Windows\System\nhOuxSy.exe
  2⤵
  PID:1956
- C:\Windows\System\uCHUsND.exe
  C:\Windows\System\uCHUsND.exe
  2⤵
  PID:4008
- C:\Windows\System\JXICggQ.exe
  C:\Windows\System\JXICggQ.exe
  2⤵
  PID:4072
- C:\Windows\System\JcDOHIc.exe
  C:\Windows\System\JcDOHIc.exe
  2⤵
  PID:3700
- C:\Windows\System\BmLOVuq.exe
  C:\Windows\System\BmLOVuq.exe
  2⤵
  PID:2440
- C:\Windows\System\Weanpnx.exe
  C:\Windows\System\Weanpnx.exe
  2⤵
  PID:1284
- C:\Windows\System\vuByGCZ.exe
  C:\Windows\System\vuByGCZ.exe
  2⤵
  PID:3352
- C:\Windows\System\QHHAmQK.exe
  C:\Windows\System\QHHAmQK.exe
  2⤵
  PID:1764
- C:\Windows\System\KLzFfkY.exe
  C:\Windows\System\KLzFfkY.exe
  2⤵
  PID:3864
- C:\Windows\System\BryPCpz.exe
  C:\Windows\System\BryPCpz.exe
  2⤵
  PID:3928
- C:\Windows\System\rIrjOtE.exe
  C:\Windows\System\rIrjOtE.exe
  2⤵
  PID:4036
- C:\Windows\System\heUoVUY.exe
  C:\Windows\System\heUoVUY.exe
  2⤵
  PID:2236
- C:\Windows\System\ZrfoSqe.exe
  C:\Windows\System\ZrfoSqe.exe
  2⤵
  PID:2656
- C:\Windows\System\UsUwccQ.exe
  C:\Windows\System\UsUwccQ.exe
  2⤵
  PID:3340
- C:\Windows\System\QyWSQdu.exe
  C:\Windows\System\QyWSQdu.exe
  2⤵
  PID:800
- C:\Windows\System\NyfJPZI.exe
  C:\Windows\System\NyfJPZI.exe
  2⤵
  PID:1668
- C:\Windows\System\yqQMqIh.exe
  C:\Windows\System\yqQMqIh.exe
  2⤵
  PID:2776
- C:\Windows\System\UurFfWS.exe
  C:\Windows\System\UurFfWS.exe
  2⤵
  PID:1876
- C:\Windows\System\Ordbrey.exe
  C:\Windows\System\Ordbrey.exe
  2⤵
  PID:1928
- C:\Windows\System\NyqqJai.exe
  C:\Windows\System\NyqqJai.exe
  2⤵
  PID:3596
- C:\Windows\System\LfdTLri.exe
  C:\Windows\System\LfdTLri.exe
  2⤵
  PID:3528
- C:\Windows\System\EbmzLnS.exe
  C:\Windows\System\EbmzLnS.exe
  2⤵
  PID:3564
- C:\Windows\System\aZBbzeE.exe
  C:\Windows\System\aZBbzeE.exe
  2⤵
  PID:3444
- C:\Windows\System\JwsVnbR.exe
  C:\Windows\System\JwsVnbR.exe
  2⤵
  PID:3576
- C:\Windows\System\jsXVOQO.exe
  C:\Windows\System\jsXVOQO.exe
  2⤵
  PID:3504
- C:\Windows\System\IzBNwgl.exe
  C:\Windows\System\IzBNwgl.exe
  2⤵
  PID:3824
- C:\Windows\System\ZHyfdUt.exe
  C:\Windows\System\ZHyfdUt.exe
  2⤵
  PID:3972
- C:\Windows\System\aUtjsBU.exe
  C:\Windows\System\aUtjsBU.exe
  2⤵
  PID:1960
- C:\Windows\System\qKXmnWt.exe
  C:\Windows\System\qKXmnWt.exe
  2⤵
  PID:3004
- C:\Windows\System\YBTQTTF.exe
  C:\Windows\System\YBTQTTF.exe
  2⤵
  PID:3888
- C:\Windows\System\AiyFpEQ.exe
  C:\Windows\System\AiyFpEQ.exe
  2⤵
  PID:3336
- C:\Windows\System\miktSRc.exe
  C:\Windows\System\miktSRc.exe
  2⤵
  PID:3408
- C:\Windows\System\kTbdwwJ.exe
  C:\Windows\System\kTbdwwJ.exe
  2⤵
  PID:4112
- C:\Windows\System\nQppqdX.exe
  C:\Windows\System\nQppqdX.exe
  2⤵
  PID:4128
- C:\Windows\System\zWPHpBE.exe
  C:\Windows\System\zWPHpBE.exe
  2⤵
  PID:4148
- C:\Windows\System\RaTzWEx.exe
  C:\Windows\System\RaTzWEx.exe
  2⤵
  PID:4164
- C:\Windows\System\fNQjnZm.exe
  C:\Windows\System\fNQjnZm.exe
  2⤵
  PID:4180
- C:\Windows\System\JCMYonS.exe
  C:\Windows\System\JCMYonS.exe
  2⤵
  PID:4196
- C:\Windows\System\CIwZxZQ.exe
  C:\Windows\System\CIwZxZQ.exe
  2⤵
  PID:4216
- C:\Windows\System\cgIdVmm.exe
  C:\Windows\System\cgIdVmm.exe
  2⤵
  PID:4232
- C:\Windows\System\MYxhVBs.exe
  C:\Windows\System\MYxhVBs.exe
  2⤵
  PID:4248
- C:\Windows\System\QCsWUIu.exe
  C:\Windows\System\QCsWUIu.exe
  2⤵
  PID:4268
- C:\Windows\System\utgeZSj.exe
  C:\Windows\System\utgeZSj.exe
  2⤵
  PID:4284
- C:\Windows\System\RqjKeVr.exe
  C:\Windows\System\RqjKeVr.exe
  2⤵
  PID:4300
- C:\Windows\System\ecIMoWa.exe
  C:\Windows\System\ecIMoWa.exe
  2⤵
  PID:4316
- C:\Windows\System\OIyLcVE.exe
  C:\Windows\System\OIyLcVE.exe
  2⤵
  PID:4332
- C:\Windows\System\pLopbmw.exe
  C:\Windows\System\pLopbmw.exe
  2⤵
  PID:4352
- C:\Windows\System\EFGApwU.exe
  C:\Windows\System\EFGApwU.exe
  2⤵
  PID:4368
- C:\Windows\System\rTadsgw.exe
  C:\Windows\System\rTadsgw.exe
  2⤵
  PID:4384
- C:\Windows\System\rLZfRhG.exe
  C:\Windows\System\rLZfRhG.exe
  2⤵
  PID:4400
- C:\Windows\System\nySWNYi.exe
  C:\Windows\System\nySWNYi.exe
  2⤵
  PID:4420
- C:\Windows\System\AJcLvid.exe
  C:\Windows\System\AJcLvid.exe
  2⤵
  PID:4436
- C:\Windows\System\BLEguMO.exe
  C:\Windows\System\BLEguMO.exe
  2⤵
  PID:4452
- C:\Windows\System\KDjkJAk.exe
  C:\Windows\System\KDjkJAk.exe
  2⤵
  PID:4468
- C:\Windows\System\VTotLFr.exe
  C:\Windows\System\VTotLFr.exe
  2⤵
  PID:4484
- C:\Windows\System\SHktkkj.exe
  C:\Windows\System\SHktkkj.exe
  2⤵
  PID:4500
- C:\Windows\System\DFlTtJV.exe
  C:\Windows\System\DFlTtJV.exe
  2⤵
  PID:4520
- C:\Windows\System\YEOpLWe.exe
  C:\Windows\System\YEOpLWe.exe
  2⤵
  PID:4536
- C:\Windows\System\GwKYfhC.exe
  C:\Windows\System\GwKYfhC.exe
  2⤵
  PID:4552
- C:\Windows\System\pwMROHS.exe
  C:\Windows\System\pwMROHS.exe
  2⤵
  PID:4572
- C:\Windows\System\TkioBPO.exe
  C:\Windows\System\TkioBPO.exe
  2⤵
  PID:4604
- C:\Windows\System\EwfVXvv.exe
  C:\Windows\System\EwfVXvv.exe
  2⤵
  PID:4620
- C:\Windows\System\IFcFZDJ.exe
  C:\Windows\System\IFcFZDJ.exe
  2⤵
  PID:4636
- C:\Windows\System\VEmthXG.exe
  C:\Windows\System\VEmthXG.exe
  2⤵
  PID:4680
- C:\Windows\System\XjaStod.exe
  C:\Windows\System\XjaStod.exe
  2⤵
  PID:4696
- C:\Windows\System\YWftMZe.exe
  C:\Windows\System\YWftMZe.exe
  2⤵
  PID:4712
- C:\Windows\System\HVYoLLg.exe
  C:\Windows\System\HVYoLLg.exe
  2⤵
  PID:4736
- C:\Windows\System\xtEvzUx.exe
  C:\Windows\System\xtEvzUx.exe
  2⤵
  PID:4752
- C:\Windows\System\dcyNDuk.exe
  C:\Windows\System\dcyNDuk.exe
  2⤵
  PID:4768
- C:\Windows\System\irwbTCf.exe
  C:\Windows\System\irwbTCf.exe
  2⤵
  PID:4784
- C:\Windows\System\wCPnGiC.exe
  C:\Windows\System\wCPnGiC.exe
  2⤵
  PID:4800
- C:\Windows\System\BjqoeXu.exe
  C:\Windows\System\BjqoeXu.exe
  2⤵
  PID:4824
- C:\Windows\System\sFvvCOK.exe
  C:\Windows\System\sFvvCOK.exe
  2⤵
  PID:4840
- C:\Windows\System\ZksMmqx.exe
  C:\Windows\System\ZksMmqx.exe
  2⤵
  PID:4856
- C:\Windows\System\oFmnBjy.exe
  C:\Windows\System\oFmnBjy.exe
  2⤵
  PID:4872
- C:\Windows\System\bWMCgmX.exe
  C:\Windows\System\bWMCgmX.exe
  2⤵
  PID:4892
- C:\Windows\System\YAeuhdK.exe
  C:\Windows\System\YAeuhdK.exe
  2⤵
  PID:4908
- C:\Windows\System\ynmfyZu.exe
  C:\Windows\System\ynmfyZu.exe
  2⤵
  PID:4924
- C:\Windows\System\gzoxrGD.exe
  C:\Windows\System\gzoxrGD.exe
  2⤵
  PID:4944
- C:\Windows\System\CBpHAoH.exe
  C:\Windows\System\CBpHAoH.exe
  2⤵
  PID:4960
- C:\Windows\System\VzwiEZK.exe
  C:\Windows\System\VzwiEZK.exe
  2⤵
  PID:4976
- C:\Windows\System\chRFAOS.exe
  C:\Windows\System\chRFAOS.exe
  2⤵
  PID:4996
- C:\Windows\System\xzTbOty.exe
  C:\Windows\System\xzTbOty.exe
  2⤵
  PID:5016
- C:\Windows\System\RWpClVY.exe
  C:\Windows\System\RWpClVY.exe
  2⤵
  PID:5032
- C:\Windows\System\IbVooey.exe
  C:\Windows\System\IbVooey.exe
  2⤵
  PID:5068
- C:\Windows\System\XvfJGVt.exe
  C:\Windows\System\XvfJGVt.exe
  2⤵
  PID:5084
- C:\Windows\System\FntUHpO.exe
  C:\Windows\System\FntUHpO.exe
  2⤵
  PID:5100
- C:\Windows\System\GenhOxw.exe
  C:\Windows\System\GenhOxw.exe
  2⤵
  PID:5116
- C:\Windows\System\VPUufvn.exe
  C:\Windows\System\VPUufvn.exe
  2⤵
  PID:3728
- C:\Windows\System\rHTxhSg.exe
  C:\Windows\System\rHTxhSg.exe
  2⤵
  PID:2716
- C:\Windows\System\CCGBPVq.exe
  C:\Windows\System\CCGBPVq.exe
  2⤵
  PID:3908
- C:\Windows\System\ehjujmt.exe
  C:\Windows\System\ehjujmt.exe
  2⤵
  PID:4124
- C:\Windows\System\nGYuNBN.exe
  C:\Windows\System\nGYuNBN.exe
  2⤵
  PID:4192
- C:\Windows\System\uktSXAt.exe
  C:\Windows\System\uktSXAt.exe
  2⤵
  PID:4228
- C:\Windows\System\IMikrLI.exe
  C:\Windows\System\IMikrLI.exe
  2⤵
  PID:1624
- C:\Windows\System\VplPMYw.exe
  C:\Windows\System\VplPMYw.exe
  2⤵
  PID:4260
- C:\Windows\System\YWMsCWG.exe
  C:\Windows\System\YWMsCWG.exe
  2⤵
  PID:4328
- C:\Windows\System\OxniVnZ.exe
  C:\Windows\System\OxniVnZ.exe
  2⤵
  PID:4460
- C:\Windows\System\iQZdtNi.exe
  C:\Windows\System\iQZdtNi.exe
  2⤵
  PID:4528
- C:\Windows\System\pnMnaEj.exe
  C:\Windows\System\pnMnaEj.exe
  2⤵
  PID:4064
- C:\Windows\System\fREoFZM.exe
  C:\Windows\System\fREoFZM.exe
  2⤵
  PID:4092
- C:\Windows\System\lHGHjLl.exe
  C:\Windows\System\lHGHjLl.exe
  2⤵
  PID:4108
- C:\Windows\System\lWFOUcZ.exe
  C:\Windows\System\lWFOUcZ.exe
  2⤵
  PID:4172
- C:\Windows\System\PVpcLAh.exe
  C:\Windows\System\PVpcLAh.exe
  2⤵
  PID:4212
- C:\Windows\System\vZgDXmu.exe
  C:\Windows\System\vZgDXmu.exe
  2⤵
  PID:4308
- C:\Windows\System\jdacoAI.exe
  C:\Windows\System\jdacoAI.exe
  2⤵
  PID:4348
- C:\Windows\System\WIvjMwS.exe
  C:\Windows\System\WIvjMwS.exe
  2⤵
  PID:4444
- C:\Windows\System\RMVQDbS.exe
  C:\Windows\System\RMVQDbS.exe
  2⤵
  PID:4512
- C:\Windows\System\vmMdRjx.exe
  C:\Windows\System\vmMdRjx.exe
  2⤵
  PID:3324
- C:\Windows\System\uZCexwd.exe
  C:\Windows\System\uZCexwd.exe
  2⤵
  PID:3468
- C:\Windows\System\Agjyjpm.exe
  C:\Windows\System\Agjyjpm.exe
  2⤵
  PID:1692
- C:\Windows\System\QzcjCLU.exe
  C:\Windows\System\QzcjCLU.exe
  2⤵
  PID:3964
- C:\Windows\System\aojSHev.exe
  C:\Windows\System\aojSHev.exe
  2⤵
  PID:3724
- C:\Windows\System\rLkeYnU.exe
  C:\Windows\System\rLkeYnU.exe
  2⤵
  PID:4276
- C:\Windows\System\EztaBxJ.exe
  C:\Windows\System\EztaBxJ.exe
  2⤵
  PID:4616
- C:\Windows\System\bJMptyt.exe
  C:\Windows\System\bJMptyt.exe
  2⤵
  PID:4652
- C:\Windows\System\FKUWHzH.exe
  C:\Windows\System\FKUWHzH.exe
  2⤵
  PID:4668
- C:\Windows\System\pcoleDZ.exe
  C:\Windows\System\pcoleDZ.exe
  2⤵
  PID:4704
- C:\Windows\System\mfzzSOM.exe
  C:\Windows\System\mfzzSOM.exe
  2⤵
  PID:4596
- C:\Windows\System\xtphxTV.exe
  C:\Windows\System\xtphxTV.exe
  2⤵
  PID:1044
- C:\Windows\System\rSQZJaW.exe
  C:\Windows\System\rSQZJaW.exe
  2⤵
  PID:4816
- C:\Windows\System\qEDrBLx.exe
  C:\Windows\System\qEDrBLx.exe
  2⤵
  PID:4848
- C:\Windows\System\eNqvhmJ.exe
  C:\Windows\System\eNqvhmJ.exe
  2⤵
  PID:4880
- C:\Windows\System\jMBsgzb.exe
  C:\Windows\System\jMBsgzb.exe
  2⤵
  PID:4920
- C:\Windows\System\tgxoCsU.exe
  C:\Windows\System\tgxoCsU.exe
  2⤵
  PID:1820
- C:\Windows\System\sFgYuKr.exe
  C:\Windows\System\sFgYuKr.exe
  2⤵
  PID:4688
- C:\Windows\System\xeMaUHK.exe
  C:\Windows\System\xeMaUHK.exe
  2⤵
  PID:4728
- C:\Windows\System\PaLUHqT.exe
  C:\Windows\System\PaLUHqT.exe
  2⤵
  PID:4792
- C:\Windows\System\jmsDPnw.exe
  C:\Windows\System\jmsDPnw.exe
  2⤵
  PID:4968
- C:\Windows\System\kbPwBob.exe
  C:\Windows\System\kbPwBob.exe
  2⤵
  PID:5004
- C:\Windows\System\nIcRtli.exe
  C:\Windows\System\nIcRtli.exe
  2⤵
  PID:5040
- C:\Windows\System\RKBGUxh.exe
  C:\Windows\System\RKBGUxh.exe
  2⤵
  PID:5060
- C:\Windows\System\gHVPFVe.exe
  C:\Windows\System\gHVPFVe.exe
  2⤵
  PID:5096
- C:\Windows\System\SxDAjPk.exe
  C:\Windows\System\SxDAjPk.exe
  2⤵
  PID:3784
- C:\Windows\System\BtWDjIV.exe
  C:\Windows\System\BtWDjIV.exe
  2⤵
  PID:4952
- C:\Windows\System\JNwCffQ.exe
  C:\Windows\System\JNwCffQ.exe
  2⤵
  PID:4496
- C:\Windows\System\FYQReuz.exe
  C:\Windows\System\FYQReuz.exe
  2⤵
  PID:4280
- C:\Windows\System\IqSPCqQ.exe
  C:\Windows\System\IqSPCqQ.exe
  2⤵
  PID:4408
- C:\Windows\System\yfZOMdO.exe
  C:\Windows\System\yfZOMdO.exe
  2⤵
  PID:4548
- C:\Windows\System\xNxwMjm.exe
  C:\Windows\System\xNxwMjm.exe
  2⤵
  PID:4992
- C:\Windows\System\qqUTboz.exe
  C:\Windows\System\qqUTboz.exe
  2⤵
  PID:5076
- C:\Windows\System\EGpfqnC.exe
  C:\Windows\System\EGpfqnC.exe
  2⤵
  PID:3436
- C:\Windows\System\DnsZgVO.exe
  C:\Windows\System\DnsZgVO.exe
  2⤵
  PID:3404
- C:\Windows\System\NeXgBzz.exe
  C:\Windows\System\NeXgBzz.exe
  2⤵
  PID:4360
- C:\Windows\System\UBWdAUj.exe
  C:\Windows\System\UBWdAUj.exe
  2⤵
  PID:4564
- C:\Windows\System\liSzxhf.exe
  C:\Windows\System\liSzxhf.exe
  2⤵
  PID:4104
- C:\Windows\System\jCYKsHo.exe
  C:\Windows\System\jCYKsHo.exe
  2⤵
  PID:4340
- C:\Windows\System\sWBugqm.exe
  C:\Windows\System\sWBugqm.exe
  2⤵
  PID:4448
- C:\Windows\System\PJJUOwo.exe
  C:\Windows\System\PJJUOwo.exe
  2⤵
  PID:3896
- C:\Windows\System\iMZEcaE.exe
  C:\Windows\System\iMZEcaE.exe
  2⤵
  PID:2416
- C:\Windows\System\wgLeBdi.exe
  C:\Windows\System\wgLeBdi.exe
  2⤵
  PID:4244
- C:\Windows\System\iRVYouL.exe
  C:\Windows\System\iRVYouL.exe
  2⤵
  PID:3240
- C:\Windows\System\qNVjjbU.exe
  C:\Windows\System\qNVjjbU.exe
  2⤵
  PID:892
- C:\Windows\System\YRkJiPo.exe
  C:\Windows\System\YRkJiPo.exe
  2⤵
  PID:3448
- C:\Windows\System\Cyaapdx.exe
  C:\Windows\System\Cyaapdx.exe
  2⤵
  PID:3500
- C:\Windows\System\KrbuYVQ.exe
  C:\Windows\System\KrbuYVQ.exe
  2⤵
  PID:3852
- C:\Windows\System\CDUqgTm.exe
  C:\Windows\System\CDUqgTm.exe
  2⤵
  PID:4744
- C:\Windows\System\krRpJKx.exe
  C:\Windows\System\krRpJKx.exe
  2⤵
  PID:5012
- C:\Windows\System\JxLIAbL.exe
  C:\Windows\System\JxLIAbL.exe
  2⤵
  PID:4188
- C:\Windows\System\PSurSMu.exe
  C:\Windows\System\PSurSMu.exe
  2⤵
  PID:4592
- C:\Windows\System\IcTLZiX.exe
  C:\Windows\System\IcTLZiX.exe
  2⤵
  PID:4676
- C:\Windows\System\HrIpwAt.exe
  C:\Windows\System\HrIpwAt.exe
  2⤵
  PID:2176
- C:\Windows\System\PYeFCCG.exe
  C:\Windows\System\PYeFCCG.exe
  2⤵
  PID:4820
- C:\Windows\System\CgqDhiV.exe
  C:\Windows\System\CgqDhiV.exe
  2⤵
  PID:5052
- C:\Windows\System\AzGTrEP.exe
  C:\Windows\System\AzGTrEP.exe
  2⤵
  PID:4224
- C:\Windows\System\BxePoBM.exe
  C:\Windows\System\BxePoBM.exe
  2⤵
  PID:4988
- C:\Windows\System\MvnPUkQ.exe
  C:\Windows\System\MvnPUkQ.exe
  2⤵
  PID:4144
- C:\Windows\System\YMBeStV.exe
  C:\Windows\System\YMBeStV.exe
  2⤵
  PID:1712
- C:\Windows\System\qhUqvpf.exe
  C:\Windows\System\qhUqvpf.exe
  2⤵
  PID:4724
- C:\Windows\System\dWgphQL.exe
  C:\Windows\System\dWgphQL.exe
  2⤵
  PID:1760
- C:\Windows\System\kBFMTlK.exe
  C:\Windows\System\kBFMTlK.exe
  2⤵
  PID:4644
- C:\Windows\System\xZtWvKw.exe
  C:\Windows\System\xZtWvKw.exe
  2⤵
  PID:5056
- C:\Windows\System\pNcVNfE.exe
  C:\Windows\System\pNcVNfE.exe
  2⤵
  PID:4508
- C:\Windows\System\yBIbcVl.exe
  C:\Windows\System\yBIbcVl.exe
  2⤵
  PID:4428
- C:\Windows\System\kovwqkL.exe
  C:\Windows\System\kovwqkL.exe
  2⤵
  PID:4416
- C:\Windows\System\KudlHJt.exe
  C:\Windows\System\KudlHJt.exe
  2⤵
  PID:5132
- C:\Windows\System\ZlZnEJp.exe
  C:\Windows\System\ZlZnEJp.exe
  2⤵
  PID:5148
- C:\Windows\System\GljYCkU.exe
  C:\Windows\System\GljYCkU.exe
  2⤵
  PID:5164
- C:\Windows\System\KTwpOVN.exe
  C:\Windows\System\KTwpOVN.exe
  2⤵
  PID:5180
- C:\Windows\System\PhpkBAY.exe
  C:\Windows\System\PhpkBAY.exe
  2⤵
  PID:5196
- C:\Windows\System\HjDLFFh.exe
  C:\Windows\System\HjDLFFh.exe
  2⤵
  PID:5216
- C:\Windows\System\kInXFou.exe
  C:\Windows\System\kInXFou.exe
  2⤵
  PID:5232
- C:\Windows\System\fpTGDJg.exe
  C:\Windows\System\fpTGDJg.exe
  2⤵
  PID:5248
- C:\Windows\System\dNNLNyv.exe
  C:\Windows\System\dNNLNyv.exe
  2⤵
  PID:5264
- C:\Windows\System\mWkvYFZ.exe
  C:\Windows\System\mWkvYFZ.exe
  2⤵
  PID:5280
- C:\Windows\System\alorGsC.exe
  C:\Windows\System\alorGsC.exe
  2⤵
  PID:5296
- C:\Windows\System\tgVZfDg.exe
  C:\Windows\System\tgVZfDg.exe
  2⤵
  PID:5312
- C:\Windows\System\tfGMYwy.exe
  C:\Windows\System\tfGMYwy.exe
  2⤵
  PID:5328
- C:\Windows\System\lXWzvEk.exe
  C:\Windows\System\lXWzvEk.exe
  2⤵
  PID:5344
- C:\Windows\System\RaGzIQm.exe
  C:\Windows\System\RaGzIQm.exe
  2⤵
  PID:5360
- C:\Windows\System\RTxhegf.exe
  C:\Windows\System\RTxhegf.exe
  2⤵
  PID:5380
- C:\Windows\System\kunmVhF.exe
  C:\Windows\System\kunmVhF.exe
  2⤵
  PID:5404
- C:\Windows\System\rXjIwQO.exe
  C:\Windows\System\rXjIwQO.exe
  2⤵
  PID:5428
- C:\Windows\System\aGxDKfd.exe
  C:\Windows\System\aGxDKfd.exe
  2⤵
  PID:5456
- C:\Windows\System\NYCIwTY.exe
  C:\Windows\System\NYCIwTY.exe
  2⤵
  PID:5472
- C:\Windows\System\aqHcsgf.exe
  C:\Windows\System\aqHcsgf.exe
  2⤵
  PID:5488
- C:\Windows\System\cYHgYsR.exe
  C:\Windows\System\cYHgYsR.exe
  2⤵
  PID:5612
- C:\Windows\System\uyXqxtU.exe
  C:\Windows\System\uyXqxtU.exe
  2⤵
  PID:5628
- C:\Windows\System\rgSBXTc.exe
  C:\Windows\System\rgSBXTc.exe
  2⤵
  PID:5644
- C:\Windows\System\HwuvkOv.exe
  C:\Windows\System\HwuvkOv.exe
  2⤵
  PID:5660
- C:\Windows\System\TuPwWTM.exe
  C:\Windows\System\TuPwWTM.exe
  2⤵
  PID:5676
- C:\Windows\System\EJnuvqY.exe
  C:\Windows\System\EJnuvqY.exe
  2⤵
  PID:5692
- C:\Windows\System\LSygPCH.exe
  C:\Windows\System\LSygPCH.exe
  2⤵
  PID:5708
- C:\Windows\System\LATLrwc.exe
  C:\Windows\System\LATLrwc.exe
  2⤵
  PID:5724
- C:\Windows\System\dKtSmqI.exe
  C:\Windows\System\dKtSmqI.exe
  2⤵
  PID:5740
- C:\Windows\System\rgiUcHa.exe
  C:\Windows\System\rgiUcHa.exe
  2⤵
  PID:5756
- C:\Windows\System\CjMBbil.exe
  C:\Windows\System\CjMBbil.exe
  2⤵
  PID:5772
- C:\Windows\System\esgoCls.exe
  C:\Windows\System\esgoCls.exe
  2⤵
  PID:5792
- C:\Windows\System\fZsMiIi.exe
  C:\Windows\System\fZsMiIi.exe
  2⤵
  PID:5808
- C:\Windows\System\tsXgVcG.exe
  C:\Windows\System\tsXgVcG.exe
  2⤵
  PID:5824
- C:\Windows\System\aWYUXBm.exe
  C:\Windows\System\aWYUXBm.exe
  2⤵
  PID:5844
- C:\Windows\System\rRvLJEr.exe
  C:\Windows\System\rRvLJEr.exe
  2⤵
  PID:5860
- C:\Windows\System\gUEGDuv.exe
  C:\Windows\System\gUEGDuv.exe
  2⤵
  PID:5876
- C:\Windows\System\pUVQMPy.exe
  C:\Windows\System\pUVQMPy.exe
  2⤵
  PID:5892
- C:\Windows\System\EMZVlqq.exe
  C:\Windows\System\EMZVlqq.exe
  2⤵
  PID:5908
- C:\Windows\System\zWvFrrh.exe
  C:\Windows\System\zWvFrrh.exe
  2⤵
  PID:5924
- C:\Windows\System\czAmVhX.exe
  C:\Windows\System\czAmVhX.exe
  2⤵
  PID:5940
- C:\Windows\System\ElrHgIJ.exe
  C:\Windows\System\ElrHgIJ.exe
  2⤵
  PID:5956
- C:\Windows\System\fkQhraF.exe
  C:\Windows\System\fkQhraF.exe
  2⤵
  PID:5972
- C:\Windows\System\GcbSDRH.exe
  C:\Windows\System\GcbSDRH.exe
  2⤵
  PID:5988
- C:\Windows\System\TfbHTdc.exe
  C:\Windows\System\TfbHTdc.exe
  2⤵
  PID:6004
- C:\Windows\System\rldtenr.exe
  C:\Windows\System\rldtenr.exe
  2⤵
  PID:6020
- C:\Windows\System\delBrJp.exe
  C:\Windows\System\delBrJp.exe
  2⤵
  PID:6036
- C:\Windows\System\elRPwno.exe
  C:\Windows\System\elRPwno.exe
  2⤵
  PID:6052
- C:\Windows\System\txSCHMC.exe
  C:\Windows\System\txSCHMC.exe
  2⤵
  PID:6068
- C:\Windows\System\izEiyRF.exe
  C:\Windows\System\izEiyRF.exe
  2⤵
  PID:6084
- C:\Windows\System\SpCLndD.exe
  C:\Windows\System\SpCLndD.exe
  2⤵
  PID:6100
- C:\Windows\System\WEdsBCF.exe
  C:\Windows\System\WEdsBCF.exe
  2⤵
  PID:6116
- C:\Windows\System\kTsRuzz.exe
  C:\Windows\System\kTsRuzz.exe
  2⤵
  PID:3988
- C:\Windows\System\hyizTER.exe
  C:\Windows\System\hyizTER.exe
  2⤵
  PID:5308
- C:\Windows\System\cjqBPeS.exe
  C:\Windows\System\cjqBPeS.exe
  2⤵
  PID:5376
- C:\Windows\System\ngEepZr.exe
  C:\Windows\System\ngEepZr.exe
  2⤵
  PID:4748
- C:\Windows\System\aBlNtZn.exe
  C:\Windows\System\aBlNtZn.exe
  2⤵
  PID:5540
- C:\Windows\System\pIJBZkM.exe
  C:\Windows\System\pIJBZkM.exe
  2⤵
  PID:5420
- C:\Windows\System\YjqbifA.exe
  C:\Windows\System\YjqbifA.exe
  2⤵
  PID:5508
- C:\Windows\System\xytaQuu.exe
  C:\Windows\System\xytaQuu.exe
  2⤵
  PID:5512
- C:\Windows\System\uRegubg.exe
  C:\Windows\System\uRegubg.exe
  2⤵
  PID:5552
- C:\Windows\System\DirHRkI.exe
  C:\Windows\System\DirHRkI.exe
  2⤵
  PID:5584
- C:\Windows\System\nYsDKmL.exe
  C:\Windows\System\nYsDKmL.exe
  2⤵
  PID:5592
- C:\Windows\System\KYyCgfi.exe
  C:\Windows\System\KYyCgfi.exe
  2⤵
  PID:5608
- C:\Windows\System\JGLhLbe.exe
  C:\Windows\System\JGLhLbe.exe
  2⤵
  PID:4664
- C:\Windows\System\rMVUNVF.exe
  C:\Windows\System\rMVUNVF.exe
  2⤵
  PID:5160
- C:\Windows\System\XQmGzBy.exe
  C:\Windows\System\XQmGzBy.exe
  2⤵
  PID:4916
- C:\Windows\System\qgLzPnm.exe
  C:\Windows\System\qgLzPnm.exe
  2⤵
  PID:5352
- C:\Windows\System\DlOjqLk.exe
  C:\Windows\System\DlOjqLk.exe
  2⤵
  PID:5444
- C:\Windows\System\rgTFyfB.exe
  C:\Windows\System\rgTFyfB.exe
  2⤵
  PID:5484
- C:\Windows\System\tolFrhX.exe
  C:\Windows\System\tolFrhX.exe
  2⤵
  PID:4932
- C:\Windows\System\QjTUWJn.exe
  C:\Windows\System\QjTUWJn.exe
  2⤵
  PID:5192
- C:\Windows\System\aaRlJWA.exe
  C:\Windows\System\aaRlJWA.exe
  2⤵
  PID:5292
- C:\Windows\System\sjnjUxf.exe
  C:\Windows\System\sjnjUxf.exe
  2⤵
  PID:5396
- C:\Windows\System\dZnWJSB.exe
  C:\Windows\System\dZnWJSB.exe
  2⤵
  PID:5656
- C:\Windows\System\EWJISzA.exe
  C:\Windows\System\EWJISzA.exe
  2⤵
  PID:5732
- C:\Windows\System\ALqQDAl.exe
  C:\Windows\System\ALqQDAl.exe
  2⤵
  PID:5904
- C:\Windows\System\tGxXfnE.exe
  C:\Windows\System\tGxXfnE.exe
  2⤵
  PID:5968
- C:\Windows\System\mQgICLr.exe
  C:\Windows\System\mQgICLr.exe
  2⤵
  PID:6032
- C:\Windows\System\CTGmzco.exe
  C:\Windows\System\CTGmzco.exe
  2⤵
  PID:6096
- C:\Windows\System\cxwWCCD.exe
  C:\Windows\System\cxwWCCD.exe
  2⤵
  PID:5820
- C:\Windows\System\Xbzjqyo.exe
  C:\Windows\System\Xbzjqyo.exe
  2⤵
  PID:5716
- C:\Windows\System\JDMujxU.exe
  C:\Windows\System\JDMujxU.exe
  2⤵
  PID:5748
- C:\Windows\System\KOqblEB.exe
  C:\Windows\System\KOqblEB.exe
  2⤵
  PID:5884
- C:\Windows\System\zLQjuvO.exe
  C:\Windows\System\zLQjuvO.exe
  2⤵
  PID:5952
- C:\Windows\System\qLUoOBn.exe
  C:\Windows\System\qLUoOBn.exe
  2⤵
  PID:6016
- C:\Windows\System\sugflsS.exe
  C:\Windows\System\sugflsS.exe
  2⤵
  PID:6112
- C:\Windows\System\ItPihAm.exe
  C:\Windows\System\ItPihAm.exe
  2⤵
  PID:6124
- C:\Windows\System\YvOEzeA.exe
  C:\Windows\System\YvOEzeA.exe
  2⤵
  PID:6136
- C:\Windows\System\PeonMCs.exe
  C:\Windows\System\PeonMCs.exe
  2⤵
  PID:4764
- C:\Windows\System\mAbRKHZ.exe
  C:\Windows\System\mAbRKHZ.exe
  2⤵
  PID:2644
- C:\Windows\System\ejDzzsp.exe
  C:\Windows\System\ejDzzsp.exe
  2⤵
  PID:4004
- C:\Windows\System\rvpUpgv.exe
  C:\Windows\System\rvpUpgv.exe
  2⤵
  PID:5368
- C:\Windows\System\BqrRkUF.exe
  C:\Windows\System\BqrRkUF.exe
  2⤵
  PID:5468
- C:\Windows\System\KueyBwK.exe
  C:\Windows\System\KueyBwK.exe
  2⤵
  PID:5496
- C:\Windows\System\lEbyEvj.exe
  C:\Windows\System\lEbyEvj.exe
  2⤵
  PID:4660
- C:\Windows\System\aCfQCqR.exe
  C:\Windows\System\aCfQCqR.exe
  2⤵
  PID:5636
- C:\Windows\System\bpKPufd.exe
  C:\Windows\System\bpKPufd.exe
  2⤵
  PID:5288
- C:\Windows\System\AUcFKTa.exe
  C:\Windows\System\AUcFKTa.exe
  2⤵
  PID:5244
- C:\Windows\System\jEqgJQO.exe
  C:\Windows\System\jEqgJQO.exe
  2⤵
  PID:5212
- C:\Windows\System\HxBPNvq.exe
  C:\Windows\System\HxBPNvq.exe
  2⤵
  PID:5304
- C:\Windows\System\IkRFmfr.exe
  C:\Windows\System\IkRFmfr.exe
  2⤵
  PID:5156
- C:\Windows\System\HNxwsKB.exe
  C:\Windows\System\HNxwsKB.exe
  2⤵
  PID:5400
- C:\Windows\System\nEnaWTr.exe
  C:\Windows\System\nEnaWTr.exe
  2⤵
  PID:5532
- C:\Windows\System\dxQVEMO.exe
  C:\Windows\System\dxQVEMO.exe
  2⤵
  PID:5520
- C:\Windows\System\xLWfWAU.exe
  C:\Windows\System\xLWfWAU.exe
  2⤵
  PID:5124
- C:\Windows\System\bMBgRpL.exe
  C:\Windows\System\bMBgRpL.exe
  2⤵
  PID:5700
- C:\Windows\System\qgljULN.exe
  C:\Windows\System\qgljULN.exe
  2⤵
  PID:5840
- C:\Windows\System\yDxcBzT.exe
  C:\Windows\System\yDxcBzT.exe
  2⤵
  PID:5936
- C:\Windows\System\FDfpcVl.exe
  C:\Windows\System\FDfpcVl.exe
  2⤵
  PID:5688
- C:\Windows\System\emYmEtj.exe
  C:\Windows\System\emYmEtj.exe
  2⤵
  PID:6012
- C:\Windows\System\AVYEKaY.exe
  C:\Windows\System\AVYEKaY.exe
  2⤵
  PID:6028
- C:\Windows\System\FOvDnjd.exe
  C:\Windows\System\FOvDnjd.exe
  2⤵
  PID:6080
- C:\Windows\System\IlzmRqr.exe
  C:\Windows\System\IlzmRqr.exe
  2⤵
  PID:1996
- C:\Windows\System\HYtUYlh.exe
  C:\Windows\System\HYtUYlh.exe
  2⤵
  PID:5028
- C:\Windows\System\XcoqMrh.exe
  C:\Windows\System\XcoqMrh.exe
  2⤵
  PID:3620
- C:\Windows\System\qEselJI.exe
  C:\Windows\System\qEselJI.exe
  2⤵
  PID:5412
- C:\Windows\System\Buobthy.exe
  C:\Windows\System\Buobthy.exe
  2⤵
  PID:5572
- C:\Windows\System\vjpswqo.exe
  C:\Windows\System\vjpswqo.exe
  2⤵
  PID:4632
- C:\Windows\System\MuyVMqV.exe
  C:\Windows\System\MuyVMqV.exe
  2⤵
  PID:5276
- C:\Windows\System\dprdymK.exe
  C:\Windows\System\dprdymK.exe
  2⤵
  PID:5504
- C:\Windows\System\LwMbijN.exe
  C:\Windows\System\LwMbijN.exe
  2⤵
  PID:5816
- C:\Windows\System\GzmBCHW.exe
  C:\Windows\System\GzmBCHW.exe
  2⤵
  PID:5900
- C:\Windows\System\JfjmAhD.exe
  C:\Windows\System\JfjmAhD.exe
  2⤵
  PID:5600
- C:\Windows\System\dwcVHvK.exe
  C:\Windows\System\dwcVHvK.exe
  2⤵
  PID:5208
- C:\Windows\System\ndvVsQH.exe
  C:\Windows\System\ndvVsQH.exe
  2⤵
  PID:5768
- C:\Windows\System\rPiSUFK.exe
  C:\Windows\System\rPiSUFK.exe
  2⤵
  PID:6108
- C:\Windows\System\oOtiBcp.exe
  C:\Windows\System\oOtiBcp.exe
  2⤵
  PID:5204
- C:\Windows\System\kqwTsBv.exe
  C:\Windows\System\kqwTsBv.exe
  2⤵
  PID:5588
- C:\Windows\System\epGnsif.exe
  C:\Windows\System\epGnsif.exe
  2⤵
  PID:5436
- C:\Windows\System\VKCaYAp.exe
  C:\Windows\System\VKCaYAp.exe
  2⤵
  PID:5228
- C:\Windows\System\WeqSDfM.exe
  C:\Windows\System\WeqSDfM.exe
  2⤵
  PID:5624
- C:\Windows\System\hIvlUgh.exe
  C:\Windows\System\hIvlUgh.exe
  2⤵
  PID:5272
- C:\Windows\System\KPzchPc.exe
  C:\Windows\System\KPzchPc.exe
  2⤵
  PID:1248
- C:\Windows\System\CaLcwDO.exe
  C:\Windows\System\CaLcwDO.exe
  2⤵
  PID:5448
- C:\Windows\System\xSNDLjU.exe
  C:\Windows\System\xSNDLjU.exe
  2⤵
  PID:6160
- C:\Windows\System\OpEQjAu.exe
  C:\Windows\System\OpEQjAu.exe
  2⤵
  PID:6176
- C:\Windows\System\JYaZyda.exe
  C:\Windows\System\JYaZyda.exe
  2⤵
  PID:6192
- C:\Windows\System\oEIGbuv.exe
  C:\Windows\System\oEIGbuv.exe
  2⤵
  PID:6208
- C:\Windows\System\WAupWkq.exe
  C:\Windows\System\WAupWkq.exe
  2⤵
  PID:6224
- C:\Windows\System\cEecQDf.exe
  C:\Windows\System\cEecQDf.exe
  2⤵
  PID:6240
- C:\Windows\System\yhOoBcN.exe
  C:\Windows\System\yhOoBcN.exe
  2⤵
  PID:6256
- C:\Windows\System\CoIHQnq.exe
  C:\Windows\System\CoIHQnq.exe
  2⤵
  PID:6272
- C:\Windows\System\zDIBiPE.exe
  C:\Windows\System\zDIBiPE.exe
  2⤵
  PID:6288
- C:\Windows\System\sSpZfmL.exe
  C:\Windows\System\sSpZfmL.exe
  2⤵
  PID:6304
- C:\Windows\System\thDzHBp.exe
  C:\Windows\System\thDzHBp.exe
  2⤵
  PID:6320
- C:\Windows\System\DTkqCqM.exe
  C:\Windows\System\DTkqCqM.exe
  2⤵
  PID:6336
- C:\Windows\System\ziHbJCv.exe
  C:\Windows\System\ziHbJCv.exe
  2⤵
  PID:6352
- C:\Windows\System\kvcJBBo.exe
  C:\Windows\System\kvcJBBo.exe
  2⤵
  PID:6368
- C:\Windows\System\OPKTEbm.exe
  C:\Windows\System\OPKTEbm.exe
  2⤵
  PID:6384
- C:\Windows\System\SommlOD.exe
  C:\Windows\System\SommlOD.exe
  2⤵
  PID:6400
- C:\Windows\System\mEiRKaz.exe
  C:\Windows\System\mEiRKaz.exe
  2⤵
  PID:6416
- C:\Windows\System\apDNOeb.exe
  C:\Windows\System\apDNOeb.exe
  2⤵
  PID:6436
- C:\Windows\System\gdXyEhb.exe
  C:\Windows\System\gdXyEhb.exe
  2⤵
  PID:6452
- C:\Windows\System\oDjYNTE.exe
  C:\Windows\System\oDjYNTE.exe
  2⤵
  PID:6468
- C:\Windows\System\YyTvOFu.exe
  C:\Windows\System\YyTvOFu.exe
  2⤵
  PID:6484
- C:\Windows\System\LisEMtQ.exe
  C:\Windows\System\LisEMtQ.exe
  2⤵
  PID:6508
- C:\Windows\System\cwSvaIr.exe
  C:\Windows\System\cwSvaIr.exe
  2⤵
  PID:6524
- C:\Windows\System\iyFEsob.exe
  C:\Windows\System\iyFEsob.exe
  2⤵
  PID:6540
- C:\Windows\System\fWqGRwO.exe
  C:\Windows\System\fWqGRwO.exe
  2⤵
  PID:6556
- C:\Windows\System\qCgtFdr.exe
  C:\Windows\System\qCgtFdr.exe
  2⤵
  PID:6572
- C:\Windows\System\TSoWzxV.exe
  C:\Windows\System\TSoWzxV.exe
  2⤵
  PID:6588
- C:\Windows\System\HLuQVob.exe
  C:\Windows\System\HLuQVob.exe
  2⤵
  PID:6604
- C:\Windows\System\uHZeuZh.exe
  C:\Windows\System\uHZeuZh.exe
  2⤵
  PID:6620
- C:\Windows\System\VfOODpL.exe
  C:\Windows\System\VfOODpL.exe
  2⤵
  PID:6636
- C:\Windows\System\onCuOsP.exe
  C:\Windows\System\onCuOsP.exe
  2⤵
  PID:6652
- C:\Windows\System\HgaQEye.exe
  C:\Windows\System\HgaQEye.exe
  2⤵
  PID:6668
- C:\Windows\System\lQfYNfm.exe
  C:\Windows\System\lQfYNfm.exe
  2⤵
  PID:6684
- C:\Windows\System\bOZUalr.exe
  C:\Windows\System\bOZUalr.exe
  2⤵
  PID:6700
- C:\Windows\System\kqNqnUP.exe
  C:\Windows\System\kqNqnUP.exe
  2⤵
  PID:6716
- C:\Windows\System\BJacbZt.exe
  C:\Windows\System\BJacbZt.exe
  2⤵
  PID:6732
- C:\Windows\System\nhEIIyu.exe
  C:\Windows\System\nhEIIyu.exe
  2⤵
  PID:6748
- C:\Windows\System\UiiHARP.exe
  C:\Windows\System\UiiHARP.exe
  2⤵
  PID:6764
- C:\Windows\System\wBKSdom.exe
  C:\Windows\System\wBKSdom.exe
  2⤵
  PID:6780
- C:\Windows\System\bSYcvOD.exe
  C:\Windows\System\bSYcvOD.exe
  2⤵
  PID:6796
- C:\Windows\System\oXOxNcR.exe
  C:\Windows\System\oXOxNcR.exe
  2⤵
  PID:6812
- C:\Windows\System\abRUsMv.exe
  C:\Windows\System\abRUsMv.exe
  2⤵
  PID:6828
- C:\Windows\System\bUBJdeK.exe
  C:\Windows\System\bUBJdeK.exe
  2⤵
  PID:6844
- C:\Windows\System\CVPwVcU.exe
  C:\Windows\System\CVPwVcU.exe
  2⤵
  PID:6860
- C:\Windows\System\zXKYBKz.exe
  C:\Windows\System\zXKYBKz.exe
  2⤵
  PID:6876
- C:\Windows\System\eDwtnzm.exe
  C:\Windows\System\eDwtnzm.exe
  2⤵
  PID:6892
- C:\Windows\System\pHXshfK.exe
  C:\Windows\System\pHXshfK.exe
  2⤵
  PID:6908
- C:\Windows\System\LLvLTzZ.exe
  C:\Windows\System\LLvLTzZ.exe
  2⤵
  PID:6924
- C:\Windows\System\QBgmLCp.exe
  C:\Windows\System\QBgmLCp.exe
  2⤵
  PID:6940
- C:\Windows\System\VEuuwaF.exe
  C:\Windows\System\VEuuwaF.exe
  2⤵
  PID:6956
- C:\Windows\System\zhnsfmE.exe
  C:\Windows\System\zhnsfmE.exe
  2⤵
  PID:6972
- C:\Windows\System\bBVlJEu.exe
  C:\Windows\System\bBVlJEu.exe
  2⤵
  PID:6988
- C:\Windows\System\GbGqCxn.exe
  C:\Windows\System\GbGqCxn.exe
  2⤵
  PID:7004
- C:\Windows\System\NshFAaQ.exe
  C:\Windows\System\NshFAaQ.exe
  2⤵
  PID:7020
- C:\Windows\System\cBMjtyk.exe
  C:\Windows\System\cBMjtyk.exe
  2⤵
  PID:7036
- C:\Windows\System\XCamRup.exe
  C:\Windows\System\XCamRup.exe
  2⤵
  PID:7052
- C:\Windows\System\MPvMDCh.exe
  C:\Windows\System\MPvMDCh.exe
  2⤵
  PID:7068
- C:\Windows\System\cRdecCe.exe
  C:\Windows\System\cRdecCe.exe
  2⤵
  PID:7084
- C:\Windows\System\XYekXSK.exe
  C:\Windows\System\XYekXSK.exe
  2⤵
  PID:7100
- C:\Windows\System\ayuoRTk.exe
  C:\Windows\System\ayuoRTk.exe
  2⤵
  PID:7116
- C:\Windows\System\pdnbhqI.exe
  C:\Windows\System\pdnbhqI.exe
  2⤵
  PID:7132
- C:\Windows\System\hCIaKVS.exe
  C:\Windows\System\hCIaKVS.exe
  2⤵
  PID:7148
- C:\Windows\System\inhLGtB.exe
  C:\Windows\System\inhLGtB.exe
  2⤵
  PID:7164
- C:\Windows\System\YQGtoHn.exe
  C:\Windows\System\YQGtoHn.exe
  2⤵
  PID:5964
- C:\Windows\System\MeLhFpm.exe
  C:\Windows\System\MeLhFpm.exe
  2⤵
  PID:5452
- C:\Windows\System\xoLsggU.exe
  C:\Windows\System\xoLsggU.exe
  2⤵
  PID:6204
- C:\Windows\System\bOPxfJe.exe
  C:\Windows\System\bOPxfJe.exe
  2⤵
  PID:6268
- C:\Windows\System\lUAgWFZ.exe
  C:\Windows\System\lUAgWFZ.exe
  2⤵
  PID:6300
- C:\Windows\System\gqLzpaK.exe
  C:\Windows\System\gqLzpaK.exe
  2⤵
  PID:5604
- C:\Windows\System\WMxSqTl.exe
  C:\Windows\System\WMxSqTl.exe
  2⤵
  PID:6312
- C:\Windows\System\vxzFUmi.exe
  C:\Windows\System\vxzFUmi.exe
  2⤵
  PID:6284
- C:\Windows\System\XgwHQaE.exe
  C:\Windows\System\XgwHQaE.exe
  2⤵
  PID:6188
- C:\Windows\System\ijRLYxZ.exe
  C:\Windows\System\ijRLYxZ.exe
  2⤵
  PID:6396
- C:\Windows\System\pbDsCwb.exe
  C:\Windows\System\pbDsCwb.exe
  2⤵
  PID:6432
- C:\Windows\System\OJjNdXO.exe
  C:\Windows\System\OJjNdXO.exe
  2⤵
  PID:6408
- C:\Windows\System\boQNFHW.exe
  C:\Windows\System\boQNFHW.exe
  2⤵
  PID:6460
- C:\Windows\System\YxBoXyv.exe
  C:\Windows\System\YxBoXyv.exe
  2⤵
  PID:6476
- C:\Windows\System\PsUSIjz.exe
  C:\Windows\System\PsUSIjz.exe
  2⤵
  PID:6532
- C:\Windows\System\PkpHFWb.exe
  C:\Windows\System\PkpHFWb.exe
  2⤵
  PID:6596
- C:\Windows\System\fdCqbvc.exe
  C:\Windows\System\fdCqbvc.exe
  2⤵
  PID:6580
- C:\Windows\System\yIJpjce.exe
  C:\Windows\System\yIJpjce.exe
  2⤵
  PID:6644
- C:\Windows\System\YxNmnVd.exe
  C:\Windows\System\YxNmnVd.exe
  2⤵
  PID:6696
- C:\Windows\System\rlFIZLq.exe
  C:\Windows\System\rlFIZLq.exe
  2⤵
  PID:6756
- C:\Windows\System\frKFFYw.exe
  C:\Windows\System\frKFFYw.exe
  2⤵
  PID:6792
- C:\Windows\System\iftkroN.exe
  C:\Windows\System\iftkroN.exe
  2⤵
  PID:6824
- C:\Windows\System\hzrvXmR.exe
  C:\Windows\System\hzrvXmR.exe
  2⤵
  PID:6680
- C:\Windows\System\PRaBWkg.exe
  C:\Windows\System\PRaBWkg.exe
  2⤵
  PID:6804
- C:\Windows\System\yMReOyX.exe
  C:\Windows\System\yMReOyX.exe
  2⤵
  PID:6884
- C:\Windows\System\utcWLpP.exe
  C:\Windows\System\utcWLpP.exe
  2⤵
  PID:6840
- C:\Windows\System\itiHhKY.exe
  C:\Windows\System\itiHhKY.exe
  2⤵
  PID:6904
- C:\Windows\System\dyeipnH.exe
  C:\Windows\System\dyeipnH.exe
  2⤵
  PID:6932
- C:\Windows\System\FAImspJ.exe
  C:\Windows\System\FAImspJ.exe
  2⤵
  PID:6984
- C:\Windows\System\etKRxRH.exe
  C:\Windows\System\etKRxRH.exe
  2⤵
  PID:6996
- C:\Windows\System\wYPZFdd.exe
  C:\Windows\System\wYPZFdd.exe
  2⤵
  PID:7044
- C:\Windows\System\rCRogLe.exe
  C:\Windows\System\rCRogLe.exe
  2⤵
  PID:7108
- C:\Windows\System\OcQZjpf.exe
  C:\Windows\System\OcQZjpf.exe
  2⤵
  PID:7092
- C:\Windows\System\hxFmlDu.exe
  C:\Windows\System\hxFmlDu.exe
  2⤵
  PID:7032
- C:\Windows\System\xTTkScI.exe
  C:\Windows\System\xTTkScI.exe
  2⤵
  PID:7128
- C:\Windows\System\eHiMJEE.exe
  C:\Windows\System\eHiMJEE.exe
  2⤵
  PID:7156
- C:\Windows\System\ZEOoWIo.exe
  C:\Windows\System\ZEOoWIo.exe
  2⤵
  PID:6360
- C:\Windows\System\vJfOpDq.exe
  C:\Windows\System\vJfOpDq.exe
  2⤵
  PID:6264
- C:\Windows\System\jaOpsmt.exe
  C:\Windows\System\jaOpsmt.exe
  2⤵
  PID:6152
- C:\Windows\System\CyGggKq.exe
  C:\Windows\System\CyGggKq.exe
  2⤵
  PID:6444
- C:\Windows\System\UWRmkpT.exe
  C:\Windows\System\UWRmkpT.exe
  2⤵
  PID:6248
- C:\Windows\System\GzqgrOu.exe
  C:\Windows\System\GzqgrOu.exe
  2⤵
  PID:6632
- C:\Windows\System\uEQRwLc.exe
  C:\Windows\System\uEQRwLc.exe
  2⤵
  PID:6612
- C:\Windows\System\BIWzQWm.exe
  C:\Windows\System\BIWzQWm.exe
  2⤵
  PID:6480
- C:\Windows\System\XfoyyXN.exe
  C:\Windows\System\XfoyyXN.exe
  2⤵
  PID:6648
- C:\Windows\System\MyEHwbt.exe
  C:\Windows\System\MyEHwbt.exe
  2⤵
  PID:6564
- C:\Windows\System\AjTvqZF.exe
  C:\Windows\System\AjTvqZF.exe
  2⤵
  PID:6740
- C:\Windows\System\Kuiqqnt.exe
  C:\Windows\System\Kuiqqnt.exe
  2⤵
  PID:6836
- C:\Windows\System\jLFDNOE.exe
  C:\Windows\System\jLFDNOE.exe
  2⤵
  PID:6952
- C:\Windows\System\BGcSOlK.exe
  C:\Windows\System\BGcSOlK.exe
  2⤵
  PID:7016
- C:\Windows\System\JqTzonW.exe
  C:\Windows\System\JqTzonW.exe
  2⤵
  PID:6964
- C:\Windows\System\tZlrEFs.exe
  C:\Windows\System\tZlrEFs.exe
  2⤵
  PID:5176
- C:\Windows\System\ZYQoojG.exe
  C:\Windows\System\ZYQoojG.exe
  2⤵
  PID:7076
- C:\Windows\System\OHODOOa.exe
  C:\Windows\System\OHODOOa.exe
  2⤵
  PID:6520
- C:\Windows\System\wxtjxdQ.exe
  C:\Windows\System\wxtjxdQ.exe
  2⤵
  PID:5736
- C:\Windows\System\pUOukuB.exe
  C:\Windows\System\pUOukuB.exe
  2⤵
  PID:6428
- C:\Windows\System\zBHTYsK.exe
  C:\Windows\System\zBHTYsK.exe
  2⤵
  PID:6660
- C:\Windows\System\vBFUEeS.exe
  C:\Windows\System\vBFUEeS.exe
  2⤵
  PID:6772
- C:\Windows\System\rJzmVgp.exe
  C:\Windows\System\rJzmVgp.exe
  2⤵
  PID:6968
- C:\Windows\System\aMFYnaC.exe
  C:\Windows\System\aMFYnaC.exe
  2⤵
  PID:6788
- C:\Windows\System\xAiZjKh.exe
  C:\Windows\System\xAiZjKh.exe
  2⤵
  PID:6920
- C:\Windows\System\xLkoWKo.exe
  C:\Windows\System\xLkoWKo.exe
  2⤵
  PID:7172
- C:\Windows\System\chXukyt.exe
  C:\Windows\System\chXukyt.exe
  2⤵
  PID:7188
- C:\Windows\System\hBJzZxC.exe
  C:\Windows\System\hBJzZxC.exe
  2⤵
  PID:7204
- C:\Windows\System\OJniWwo.exe
  C:\Windows\System\OJniWwo.exe
  2⤵
  PID:7220
- C:\Windows\System\hlHSaOF.exe
  C:\Windows\System\hlHSaOF.exe
  2⤵
  PID:7240
- C:\Windows\System\tngZvtE.exe
  C:\Windows\System\tngZvtE.exe
  2⤵
  PID:7256
- C:\Windows\System\INcoNdn.exe
  C:\Windows\System\INcoNdn.exe
  2⤵
  PID:7272
- C:\Windows\System\wiTIgwN.exe
  C:\Windows\System\wiTIgwN.exe
  2⤵
  PID:7288
- C:\Windows\System\jwBpNWC.exe
  C:\Windows\System\jwBpNWC.exe
  2⤵
  PID:7304
- C:\Windows\System\fFaHzNx.exe
  C:\Windows\System\fFaHzNx.exe
  2⤵
  PID:7320
- C:\Windows\System\vsKveCV.exe
  C:\Windows\System\vsKveCV.exe
  2⤵
  PID:7344
- C:\Windows\System\YEywuNJ.exe
  C:\Windows\System\YEywuNJ.exe
  2⤵
  PID:7360
- C:\Windows\System\LOCzDCU.exe
  C:\Windows\System\LOCzDCU.exe
  2⤵
  PID:7376
- C:\Windows\System\WTTEzAN.exe
  C:\Windows\System\WTTEzAN.exe
  2⤵
  PID:7392
- C:\Windows\System\ouiauUY.exe
  C:\Windows\System\ouiauUY.exe
  2⤵
  PID:7408
- C:\Windows\System\uXXTtHN.exe
  C:\Windows\System\uXXTtHN.exe
  2⤵
  PID:7424
- C:\Windows\System\RIbJTIm.exe
  C:\Windows\System\RIbJTIm.exe
  2⤵
  PID:7440
- C:\Windows\System\UUWpnEz.exe
  C:\Windows\System\UUWpnEz.exe
  2⤵
  PID:7456
- C:\Windows\System\DbeLMLQ.exe
  C:\Windows\System\DbeLMLQ.exe
  2⤵
  PID:7472
- C:\Windows\System\hDjmHMv.exe
  C:\Windows\System\hDjmHMv.exe
  2⤵
  PID:7488
- C:\Windows\System\hKvltVJ.exe
  C:\Windows\System\hKvltVJ.exe
  2⤵
  PID:7504
- C:\Windows\System\iOAPjAK.exe
  C:\Windows\System\iOAPjAK.exe
  2⤵
  PID:7520
- C:\Windows\System\cffFOia.exe
  C:\Windows\System\cffFOia.exe
  2⤵
  PID:7536
- C:\Windows\System\EVkSoPV.exe
  C:\Windows\System\EVkSoPV.exe
  2⤵
  PID:7552
- C:\Windows\System\JpfhCIA.exe
  C:\Windows\System\JpfhCIA.exe
  2⤵
  PID:7568
- C:\Windows\System\lJwVajv.exe
  C:\Windows\System\lJwVajv.exe
  2⤵
  PID:7584
- C:\Windows\System\OGesgjM.exe
  C:\Windows\System\OGesgjM.exe
  2⤵
  PID:7600
- C:\Windows\System\CHyFiVS.exe
  C:\Windows\System\CHyFiVS.exe
  2⤵
  PID:7616
- C:\Windows\System\cKtUEaE.exe
  C:\Windows\System\cKtUEaE.exe
  2⤵
  PID:7632
- C:\Windows\System\NcZFQlF.exe
  C:\Windows\System\NcZFQlF.exe
  2⤵
  PID:7648
- C:\Windows\System\lCbeytG.exe
  C:\Windows\System\lCbeytG.exe
  2⤵
  PID:7664
- C:\Windows\System\pfouwdU.exe
  C:\Windows\System\pfouwdU.exe
  2⤵
  PID:7680
- C:\Windows\System\OjkMDdt.exe
  C:\Windows\System\OjkMDdt.exe
  2⤵
  PID:7696
- C:\Windows\System\WRGCXGx.exe
  C:\Windows\System\WRGCXGx.exe
  2⤵
  PID:7712
- C:\Windows\System\rldmZHp.exe
  C:\Windows\System\rldmZHp.exe
  2⤵
  PID:7728
- C:\Windows\System\SHvOEhA.exe
  C:\Windows\System\SHvOEhA.exe
  2⤵
  PID:7744
- C:\Windows\System\rxfCIWo.exe
  C:\Windows\System\rxfCIWo.exe
  2⤵
  PID:7760
- C:\Windows\System\PjyxUAw.exe
  C:\Windows\System\PjyxUAw.exe
  2⤵
  PID:7776
- C:\Windows\System\GtKhHPN.exe
  C:\Windows\System\GtKhHPN.exe
  2⤵
  PID:7792
- C:\Windows\System\nVpyAaR.exe
  C:\Windows\System\nVpyAaR.exe
  2⤵
  PID:7808
- C:\Windows\System\oUsplKq.exe
  C:\Windows\System\oUsplKq.exe
  2⤵
  PID:7824
- C:\Windows\System\xshFXib.exe
  C:\Windows\System\xshFXib.exe
  2⤵
  PID:7840
- C:\Windows\System\hnfKpwB.exe
  C:\Windows\System\hnfKpwB.exe
  2⤵
  PID:7856
- C:\Windows\System\VlANTqW.exe
  C:\Windows\System\VlANTqW.exe
  2⤵
  PID:7872
- C:\Windows\System\OwytebN.exe
  C:\Windows\System\OwytebN.exe
  2⤵
  PID:7888
- C:\Windows\System\fkkHbfo.exe
  C:\Windows\System\fkkHbfo.exe
  2⤵
  PID:7904
- C:\Windows\System\YPjHfuT.exe
  C:\Windows\System\YPjHfuT.exe
  2⤵
  PID:7920
- C:\Windows\System\nTRjARa.exe
  C:\Windows\System\nTRjARa.exe
  2⤵
  PID:7936
- C:\Windows\System\pRHONlq.exe
  C:\Windows\System\pRHONlq.exe
  2⤵
  PID:7952
- C:\Windows\System\IiFwlmC.exe
  C:\Windows\System\IiFwlmC.exe
  2⤵
  PID:7968
- C:\Windows\System\PevJWlz.exe
  C:\Windows\System\PevJWlz.exe
  2⤵
  PID:7984
- C:\Windows\System\myQjUGz.exe
  C:\Windows\System\myQjUGz.exe
  2⤵
  PID:8000
- C:\Windows\System\RFUVicv.exe
  C:\Windows\System\RFUVicv.exe
  2⤵
  PID:8020
- C:\Windows\System\Npspnln.exe
  C:\Windows\System\Npspnln.exe
  2⤵
  PID:8036
- C:\Windows\System\FJqChDx.exe
  C:\Windows\System\FJqChDx.exe
  2⤵
  PID:8052
- C:\Windows\System\ZxVKIbQ.exe
  C:\Windows\System\ZxVKIbQ.exe
  2⤵
  PID:8068
- C:\Windows\System\HiMpIxI.exe
  C:\Windows\System\HiMpIxI.exe
  2⤵
  PID:8084
- C:\Windows\System\ukIUHgV.exe
  C:\Windows\System\ukIUHgV.exe
  2⤵
  PID:8100
- C:\Windows\System\lXGVmXF.exe
  C:\Windows\System\lXGVmXF.exe
  2⤵
  PID:8116
- C:\Windows\System\vbosRMr.exe
  C:\Windows\System\vbosRMr.exe
  2⤵
  PID:8132
- C:\Windows\System\gQmgCjs.exe
  C:\Windows\System\gQmgCjs.exe
  2⤵
  PID:8148
- C:\Windows\System\DgemdTT.exe
  C:\Windows\System\DgemdTT.exe
  2⤵
  PID:8164
- C:\Windows\System\nCLfGJD.exe
  C:\Windows\System\nCLfGJD.exe
  2⤵
  PID:8180
- C:\Windows\System\unMBkAT.exe
  C:\Windows\System\unMBkAT.exe
  2⤵
  PID:7180
- C:\Windows\System\xsjtNny.exe
  C:\Windows\System\xsjtNny.exe
  2⤵
  PID:1004
- C:\Windows\System\ptioqGh.exe
  C:\Windows\System\ptioqGh.exe
  2⤵
  PID:7280
- C:\Windows\System\xkRIbaq.exe
  C:\Windows\System\xkRIbaq.exe
  2⤵
  PID:7312
- C:\Windows\System\jGwrtrn.exe
  C:\Windows\System\jGwrtrn.exe
  2⤵
  PID:7060
- C:\Windows\System\gReFDvN.exe
  C:\Windows\System\gReFDvN.exe
  2⤵
  PID:7196
- C:\Windows\System\ppGqkgD.exe
  C:\Windows\System\ppGqkgD.exe
  2⤵
  PID:6424
- C:\Windows\System\fiAaQcB.exe
  C:\Windows\System\fiAaQcB.exe
  2⤵
  PID:7268
- C:\Windows\System\dluUTjS.exe
  C:\Windows\System\dluUTjS.exe
  2⤵
  PID:7236
- C:\Windows\System\iVtIwHB.exe
  C:\Windows\System\iVtIwHB.exe
  2⤵
  PID:6500
- C:\Windows\System\VfDbcQb.exe
  C:\Windows\System\VfDbcQb.exe
  2⤵
  PID:7400
- C:\Windows\System\EexKScc.exe
  C:\Windows\System\EexKScc.exe
  2⤵
  PID:7420
- C:\Windows\System\tTFtDHO.exe
  C:\Windows\System\tTFtDHO.exe
  2⤵
  PID:7388
- C:\Windows\System\qKdOZgv.exe
  C:\Windows\System\qKdOZgv.exe
  2⤵
  PID:7484
- C:\Windows\System\fboQeUv.exe
  C:\Windows\System\fboQeUv.exe
  2⤵
  PID:7548
- C:\Windows\System\RJkVfqs.exe
  C:\Windows\System\RJkVfqs.exe
  2⤵
  PID:7608
- C:\Windows\System\KgdzAst.exe
  C:\Windows\System\KgdzAst.exe
  2⤵
  PID:7644
- C:\Windows\System\WKPvlyF.exe
  C:\Windows\System\WKPvlyF.exe
  2⤵
  PID:7708
- C:\Windows\System\XdwTyKw.exe
  C:\Windows\System\XdwTyKw.exe
  2⤵
  PID:7436
- C:\Windows\System\UzvAFiE.exe
  C:\Windows\System\UzvAFiE.exe
  2⤵
  PID:7468
- C:\Windows\System\bUtuWMh.exe
  C:\Windows\System\bUtuWMh.exe
  2⤵
  PID:7720
- C:\Windows\System\yVJDmad.exe
  C:\Windows\System\yVJDmad.exe
  2⤵
  PID:7628
- C:\Windows\System\EGoZhSC.exe
  C:\Windows\System\EGoZhSC.exe
  2⤵
  PID:7692
- C:\Windows\System\PTINEkw.exe
  C:\Windows\System\PTINEkw.exe
  2⤵
  PID:7800
- C:\Windows\System\IFlxkfH.exe
  C:\Windows\System\IFlxkfH.exe
  2⤵
  PID:7816
- C:\Windows\System\wSzbvGl.exe
  C:\Windows\System\wSzbvGl.exe
  2⤵
  PID:7848
- C:\Windows\System\vthZaHX.exe
  C:\Windows\System\vthZaHX.exe
  2⤵
  PID:7884
- C:\Windows\System\RKIYBvM.exe
  C:\Windows\System\RKIYBvM.exe
  2⤵
  PID:7900
- C:\Windows\System\KBZkIuw.exe
  C:\Windows\System\KBZkIuw.exe
  2⤵
  PID:7960
- C:\Windows\System\fIuwKaX.exe
  C:\Windows\System\fIuwKaX.exe
  2⤵
  PID:7992
- C:\Windows\System\hLkngJU.exe
  C:\Windows\System\hLkngJU.exe
  2⤵
  PID:7980
- C:\Windows\System\nlmcTOO.exe
  C:\Windows\System\nlmcTOO.exe
  2⤵
  PID:8032
- C:\Windows\System\HDIJPaY.exe
  C:\Windows\System\HDIJPaY.exe
  2⤵
  PID:8096
- C:\Windows\System\Okosrst.exe
  C:\Windows\System\Okosrst.exe
  2⤵
  PID:8160
- C:\Windows\System\FxExtGp.exe
  C:\Windows\System\FxExtGp.exe
  2⤵
  PID:7252
- C:\Windows\System\vndtTZC.exe
  C:\Windows\System\vndtTZC.exe
  2⤵
  PID:8044
- C:\Windows\System\KGLYXzf.exe
  C:\Windows\System\KGLYXzf.exe
  2⤵
  PID:6516
- C:\Windows\System\nuIksBD.exe
  C:\Windows\System\nuIksBD.exe
  2⤵
  PID:8176
- C:\Windows\System\pbzvASr.exe
  C:\Windows\System\pbzvASr.exe
  2⤵
  PID:8108
- C:\Windows\System\rZCQyiw.exe
  C:\Windows\System\rZCQyiw.exe
  2⤵
  PID:6728
- C:\Windows\System\HbLOnBy.exe
  C:\Windows\System\HbLOnBy.exe
  2⤵
  PID:7264
- C:\Windows\System\JrawKWQ.exe
  C:\Windows\System\JrawKWQ.exe
  2⤵
  PID:7384
- C:\Windows\System\FXMkuCj.exe
  C:\Windows\System\FXMkuCj.exe
  2⤵
  PID:7640
- C:\Windows\System\EnBJsJf.exe
  C:\Windows\System\EnBJsJf.exe
  2⤵
  PID:6852
- C:\Windows\System\CEHFNck.exe
  C:\Windows\System\CEHFNck.exe
  2⤵
  PID:7452
- C:\Windows\System\ATROVQx.exe
  C:\Windows\System\ATROVQx.exe
  2⤵
  PID:7688
- C:\Windows\System\sclmnhD.exe
  C:\Windows\System\sclmnhD.exe
  2⤵
  PID:7596
- C:\Windows\System\enKhLlV.exe
  C:\Windows\System\enKhLlV.exe
  2⤵
  PID:7880
- C:\Windows\System\cdQDhPd.exe
  C:\Windows\System\cdQDhPd.exe
  2⤵
  PID:7676
- C:\Windows\System\iXEqUhS.exe
  C:\Windows\System\iXEqUhS.exe
  2⤵
  PID:7768
- C:\Windows\System\exqbxzo.exe
  C:\Windows\System\exqbxzo.exe
  2⤵
  PID:8064
- C:\Windows\System\TFGgUFt.exe
  C:\Windows\System\TFGgUFt.exe
  2⤵
  PID:7012
- C:\Windows\System\OoRkRUB.exe
  C:\Windows\System\OoRkRUB.exe
  2⤵
  PID:7868
- C:\Windows\System\HZqWtzK.exe
  C:\Windows\System\HZqWtzK.exe
  2⤵
  PID:7916
- C:\Windows\System\RrLsMSv.exe
  C:\Windows\System\RrLsMSv.exe
  2⤵
  PID:6568
- C:\Windows\System\vYjyidP.exe
  C:\Windows\System\vYjyidP.exe
  2⤵
  PID:8112
- C:\Windows\System\gQOiwWb.exe
  C:\Windows\System\gQOiwWb.exe
  2⤵
  PID:7592
- C:\Windows\System\oFSoUKN.exe
  C:\Windows\System\oFSoUKN.exe
  2⤵
  PID:7316
- C:\Windows\System\dlTIUin.exe
  C:\Windows\System\dlTIUin.exe
  2⤵
  PID:7284
- C:\Windows\System\bVqdtmk.exe
  C:\Windows\System\bVqdtmk.exe
  2⤵
  PID:6184
- C:\Windows\System\LljmHSi.exe
  C:\Windows\System\LljmHSi.exe
  2⤵
  PID:7416
- C:\Windows\System\SRSVIDA.exe
  C:\Windows\System\SRSVIDA.exe
  2⤵
  PID:6376
- C:\Windows\System\fvLrygI.exe
  C:\Windows\System\fvLrygI.exe
  2⤵
  PID:8080
- C:\Windows\System\CVcYuEK.exe
  C:\Windows\System\CVcYuEK.exe
  2⤵
  PID:6856
- C:\Windows\System\RRpLWmt.exe
  C:\Windows\System\RRpLWmt.exe
  2⤵
  PID:7976
- C:\Windows\System\pyLgZPA.exe
  C:\Windows\System\pyLgZPA.exe
  2⤵
  PID:7560
- C:\Windows\System\brMxIuS.exe
  C:\Windows\System\brMxIuS.exe
  2⤵
  PID:7624
- C:\Windows\System\pSuNCVh.exe
  C:\Windows\System\pSuNCVh.exe
  2⤵
  PID:7756
- C:\Windows\System\hrftHoi.exe
  C:\Windows\System\hrftHoi.exe
  2⤵
  PID:8076
- C:\Windows\System\RjhXhMK.exe
  C:\Windows\System\RjhXhMK.exe
  2⤵
  PID:8200
- C:\Windows\System\OzFwEhi.exe
  C:\Windows\System\OzFwEhi.exe
  2⤵
  PID:8216
- C:\Windows\System\AJzaWKV.exe
  C:\Windows\System\AJzaWKV.exe
  2⤵
  PID:8232
- C:\Windows\System\EKvJiFl.exe
  C:\Windows\System\EKvJiFl.exe
  2⤵
  PID:8248
- C:\Windows\System\dGVYRPj.exe
  C:\Windows\System\dGVYRPj.exe
  2⤵
  PID:8264
- C:\Windows\System\aPnRyaF.exe
  C:\Windows\System\aPnRyaF.exe
  2⤵
  PID:8280
- C:\Windows\System\dteVsPq.exe
  C:\Windows\System\dteVsPq.exe
  2⤵
  PID:8296
- C:\Windows\System\zmGXVKh.exe
  C:\Windows\System\zmGXVKh.exe
  2⤵
  PID:8312
- C:\Windows\System\QDAswxI.exe
  C:\Windows\System\QDAswxI.exe
  2⤵
  PID:8328
- C:\Windows\System\DiNBIzf.exe
  C:\Windows\System\DiNBIzf.exe
  2⤵
  PID:8344
- C:\Windows\System\AaFzRzd.exe
  C:\Windows\System\AaFzRzd.exe
  2⤵
  PID:8360
- C:\Windows\System\lHqGAHa.exe
  C:\Windows\System\lHqGAHa.exe
  2⤵
  PID:8376
- C:\Windows\System\XkEpSLC.exe
  C:\Windows\System\XkEpSLC.exe
  2⤵
  PID:8392
- C:\Windows\System\QPIPpyO.exe
  C:\Windows\System\QPIPpyO.exe
  2⤵
  PID:8408
- C:\Windows\System\xByRcKe.exe
  C:\Windows\System\xByRcKe.exe
  2⤵
  PID:8424
- C:\Windows\System\lAUgOFj.exe
  C:\Windows\System\lAUgOFj.exe
  2⤵
  PID:8440
- C:\Windows\System\cTdvgTX.exe
  C:\Windows\System\cTdvgTX.exe
  2⤵
  PID:8456
- C:\Windows\System\uylcdBl.exe
  C:\Windows\System\uylcdBl.exe
  2⤵
  PID:8472
- C:\Windows\System\REDvhdO.exe
  C:\Windows\System\REDvhdO.exe
  2⤵
  PID:8488
- C:\Windows\System\miRqsOX.exe
  C:\Windows\System\miRqsOX.exe
  2⤵
  PID:8504
- C:\Windows\System\PDoGLmu.exe
  C:\Windows\System\PDoGLmu.exe
  2⤵
  PID:8520
- C:\Windows\System\brJYRbj.exe
  C:\Windows\System\brJYRbj.exe
  2⤵
  PID:8536
- C:\Windows\System\kbHMTlO.exe
  C:\Windows\System\kbHMTlO.exe
  2⤵
  PID:8552
- C:\Windows\System\qqYVgIJ.exe
  C:\Windows\System\qqYVgIJ.exe
  2⤵
  PID:8568
- C:\Windows\System\tYdbYmX.exe
  C:\Windows\System\tYdbYmX.exe
  2⤵
  PID:8584
- C:\Windows\System\tyqeDrS.exe
  C:\Windows\System\tyqeDrS.exe
  2⤵
  PID:8600
- C:\Windows\System\wNpoRjv.exe
  C:\Windows\System\wNpoRjv.exe
  2⤵
  PID:8616
- C:\Windows\System\cpDzblG.exe
  C:\Windows\System\cpDzblG.exe
  2⤵
  PID:8632
- C:\Windows\System\Wpspgcw.exe
  C:\Windows\System\Wpspgcw.exe
  2⤵
  PID:8648
- C:\Windows\System\LuqzbCv.exe
  C:\Windows\System\LuqzbCv.exe
  2⤵
  PID:8664
- C:\Windows\System\HJLdoNT.exe
  C:\Windows\System\HJLdoNT.exe
  2⤵
  PID:8680
- C:\Windows\System\SIkPAiN.exe
  C:\Windows\System\SIkPAiN.exe
  2⤵
  PID:8696
- C:\Windows\System\mIEOzQn.exe
  C:\Windows\System\mIEOzQn.exe
  2⤵
  PID:8712
- C:\Windows\System\nPohjZd.exe
  C:\Windows\System\nPohjZd.exe
  2⤵
  PID:8728
- C:\Windows\System\LTImkNU.exe
  C:\Windows\System\LTImkNU.exe
  2⤵
  PID:8744
- C:\Windows\System\NXEFmvd.exe
  C:\Windows\System\NXEFmvd.exe
  2⤵
  PID:8760
- C:\Windows\System\GGycaMG.exe
  C:\Windows\System\GGycaMG.exe
  2⤵
  PID:8776
- C:\Windows\System\KsWGOyg.exe
  C:\Windows\System\KsWGOyg.exe
  2⤵
  PID:8792
- C:\Windows\System\YLsMpvc.exe
  C:\Windows\System\YLsMpvc.exe
  2⤵
  PID:8808
- C:\Windows\System\XzItAEp.exe
  C:\Windows\System\XzItAEp.exe
  2⤵
  PID:8824
- C:\Windows\System\MjoAgNX.exe
  C:\Windows\System\MjoAgNX.exe
  2⤵
  PID:8840
- C:\Windows\System\hHMxtwV.exe
  C:\Windows\System\hHMxtwV.exe
  2⤵
  PID:8856
- C:\Windows\System\yIFDePU.exe
  C:\Windows\System\yIFDePU.exe
  2⤵
  PID:8872
- C:\Windows\System\IYThTxg.exe
  C:\Windows\System\IYThTxg.exe
  2⤵
  PID:8888
- C:\Windows\System\PZVzSGt.exe
  C:\Windows\System\PZVzSGt.exe
  2⤵
  PID:8904
- C:\Windows\System\SDGkQce.exe
  C:\Windows\System\SDGkQce.exe
  2⤵
  PID:8920
- C:\Windows\System\IUJQQKN.exe
  C:\Windows\System\IUJQQKN.exe
  2⤵
  PID:8936
- C:\Windows\System\aziyVMD.exe
  C:\Windows\System\aziyVMD.exe
  2⤵
  PID:8952
- C:\Windows\System\vXAaliv.exe
  C:\Windows\System\vXAaliv.exe
  2⤵
  PID:8968
- C:\Windows\System\aQmrzoV.exe
  C:\Windows\System\aQmrzoV.exe
  2⤵
  PID:8984
- C:\Windows\System\AweuQmm.exe
  C:\Windows\System\AweuQmm.exe
  2⤵
  PID:9000
- C:\Windows\System\pcitApr.exe
  C:\Windows\System\pcitApr.exe
  2⤵
  PID:9016
- C:\Windows\System\ZYNLHER.exe
  C:\Windows\System\ZYNLHER.exe
  2⤵
  PID:9032
- C:\Windows\System\WLEiuAW.exe
  C:\Windows\System\WLEiuAW.exe
  2⤵
  PID:9048
- C:\Windows\System\IDwenrW.exe
  C:\Windows\System\IDwenrW.exe
  2⤵
  PID:9064
- C:\Windows\System\PejoVFl.exe
  C:\Windows\System\PejoVFl.exe
  2⤵
  PID:9080
- C:\Windows\System\HcVuaqc.exe
  C:\Windows\System\HcVuaqc.exe
  2⤵
  PID:9096
- C:\Windows\System\DNNBWns.exe
  C:\Windows\System\DNNBWns.exe
  2⤵
  PID:9112
- C:\Windows\System\IGlIJzN.exe
  C:\Windows\System\IGlIJzN.exe
  2⤵
  PID:9128
- C:\Windows\System\uHusjvd.exe
  C:\Windows\System\uHusjvd.exe
  2⤵
  PID:9144
- C:\Windows\System\NnsbkTZ.exe
  C:\Windows\System\NnsbkTZ.exe
  2⤵
  PID:9160
- C:\Windows\System\wLdEKtg.exe
  C:\Windows\System\wLdEKtg.exe
  2⤵
  PID:9176
- C:\Windows\System\VLFHYpr.exe
  C:\Windows\System\VLFHYpr.exe
  2⤵
  PID:9192
- C:\Windows\System\Azjczqc.exe
  C:\Windows\System\Azjczqc.exe
  2⤵
  PID:9208
- C:\Windows\System\FGaoTwk.exe
  C:\Windows\System\FGaoTwk.exe
  2⤵
  PID:8240
- C:\Windows\System\KQVCljg.exe
  C:\Windows\System\KQVCljg.exe
  2⤵
  PID:8304
- C:\Windows\System\jmtJoxh.exe
  C:\Windows\System\jmtJoxh.exe
  2⤵
  PID:8368
- C:\Windows\System\NpsSRuM.exe
  C:\Windows\System\NpsSRuM.exe
  2⤵
  PID:7944
- C:\Windows\System\QvvULHU.exe
  C:\Windows\System\QvvULHU.exe
  2⤵
  PID:8404
- C:\Windows\System\ptaGnYY.exe
  C:\Windows\System\ptaGnYY.exe
  2⤵
  PID:8256
- C:\Windows\System\nfowFUO.exe
  C:\Windows\System\nfowFUO.exe
  2⤵
  PID:8388
- C:\Windows\System\gMvmOqU.exe
  C:\Windows\System\gMvmOqU.exe
  2⤵
  PID:8196
- C:\Windows\System\TbhMHpy.exe
  C:\Windows\System\TbhMHpy.exe
  2⤵
  PID:8320
- C:\Windows\System\VCozbHb.exe
  C:\Windows\System\VCozbHb.exe
  2⤵
  PID:8468
- C:\Windows\System\ZVSwyrz.exe
  C:\Windows\System\ZVSwyrz.exe
  2⤵
  PID:8480
- C:\Windows\System\OvfYffw.exe
  C:\Windows\System\OvfYffw.exe
  2⤵
  PID:8528
- C:\Windows\System\wSKYsRH.exe
  C:\Windows\System\wSKYsRH.exe
  2⤵
  PID:8564
- C:\Windows\System\YgMSdft.exe
  C:\Windows\System\YgMSdft.exe
  2⤵
  PID:8624
- C:\Windows\System\OkuHpIY.exe
  C:\Windows\System\OkuHpIY.exe
  2⤵
  PID:8688
- C:\Windows\System\bwMyJfE.exe
  C:\Windows\System\bwMyJfE.exe
  2⤵
  PID:8752
- C:\Windows\System\BREDabF.exe
  C:\Windows\System\BREDabF.exe
  2⤵
  PID:8788
- C:\Windows\System\gpjommk.exe
  C:\Windows\System\gpjommk.exe
  2⤵
  PID:8852
- C:\Windows\System\wvaTKvi.exe
  C:\Windows\System\wvaTKvi.exe
  2⤵
  PID:8916
- C:\Windows\System\KFJWEck.exe
  C:\Windows\System\KFJWEck.exe
  2⤵
  PID:8580
- C:\Windows\System\CcmFEny.exe
  C:\Windows\System\CcmFEny.exe
  2⤵
  PID:8948
- C:\Windows\System\uecKxTB.exe
  C:\Windows\System\uecKxTB.exe
  2⤵
  PID:8804
- C:\Windows\System\TikNswU.exe
  C:\Windows\System\TikNswU.exe
  2⤵
  PID:9012
- C:\Windows\System\HgBNWkm.exe
  C:\Windows\System\HgBNWkm.exe
  2⤵
  PID:8740
- C:\Windows\System\FiUlylM.exe
  C:\Windows\System\FiUlylM.exe
  2⤵
  PID:8768
- C:\Windows\System\hEMiATM.exe
  C:\Windows\System\hEMiATM.exe
  2⤵
  PID:9044
- C:\Windows\System\uffUPnt.exe
  C:\Windows\System\uffUPnt.exe
  2⤵
  PID:8672
- C:\Windows\System\ycxjTBM.exe
  C:\Windows\System\ycxjTBM.exe
  2⤵
  PID:8868
- C:\Windows\System\eKlSoBr.exe
  C:\Windows\System\eKlSoBr.exe
  2⤵
  PID:9056
- C:\Windows\System\roWERZV.exe
  C:\Windows\System\roWERZV.exe
  2⤵
  PID:9108
- C:\Windows\System\XqHljOL.exe
  C:\Windows\System\XqHljOL.exe
  2⤵
  PID:9120
- C:\Windows\System\mGnSTbX.exe
  C:\Windows\System\mGnSTbX.exe
  2⤵
  PID:9172
- C:\Windows\System\eYPqjSL.exe
  C:\Windows\System\eYPqjSL.exe
  2⤵
  PID:9204
- C:\Windows\System\GmDznea.exe
  C:\Windows\System\GmDznea.exe
  2⤵
  PID:7532
- C:\Windows\System\diqKeDZ.exe
  C:\Windows\System\diqKeDZ.exe
  2⤵
  PID:9188
- C:\Windows\System\BUAHBgh.exe
  C:\Windows\System\BUAHBgh.exe
  2⤵
  PID:8384
- C:\Windows\System\HceQgoS.exe
  C:\Windows\System\HceQgoS.exe
  2⤵
  PID:8260
- C:\Windows\System\eDqOKOe.exe
  C:\Windows\System\eDqOKOe.exe
  2⤵
  PID:8356
- C:\Windows\System\vbFhkPA.exe
  C:\Windows\System\vbFhkPA.exe
  2⤵
  PID:7368
- C:\Windows\System\tFKWWZh.exe
  C:\Windows\System\tFKWWZh.exe
  2⤵
  PID:8596
- C:\Windows\System\vldmbFF.exe
  C:\Windows\System\vldmbFF.exe
  2⤵
  PID:8560
- C:\Windows\System\SOXhuZG.exe
  C:\Windows\System\SOXhuZG.exe
  2⤵
  PID:8660
- C:\Windows\System\UjHvGyc.exe
  C:\Windows\System\UjHvGyc.exe
  2⤵
  PID:8756
- C:\Windows\System\SRpWNSJ.exe
  C:\Windows\System\SRpWNSJ.exe
  2⤵
  PID:8980
- C:\Windows\System\VrkYRFg.exe
  C:\Windows\System\VrkYRFg.exe
  2⤵
  PID:8896
- C:\Windows\System\lmmtzce.exe
  C:\Windows\System\lmmtzce.exe
  2⤵
  PID:8960
- C:\Windows\System\dSxELQV.exe
  C:\Windows\System\dSxELQV.exe
  2⤵
  PID:8832
- C:\Windows\System\LVJMDSb.exe
  C:\Windows\System\LVJMDSb.exe
  2⤵
  PID:8964
- C:\Windows\System\dqJxVoE.exe
  C:\Windows\System\dqJxVoE.exe
  2⤵
  PID:9140
- C:\Windows\System\elPvUTk.exe
  C:\Windows\System\elPvUTk.exe
  2⤵
  PID:9088
- C:\Windows\System\qxEstLO.exe
  C:\Windows\System\qxEstLO.exe
  2⤵
  PID:8432
- C:\Windows\System\kClKoPU.exe
  C:\Windows\System\kClKoPU.exe
  2⤵
  PID:9152
- C:\Windows\System\uiCqvoh.exe
  C:\Windows\System\uiCqvoh.exe
  2⤵
  PID:8436
- C:\Windows\System\ansfHVP.exe
  C:\Windows\System\ansfHVP.exe
  2⤵
  PID:8724
- C:\Windows\System\VtffvZr.exe
  C:\Windows\System\VtffvZr.exe
  2⤵
  PID:8800
- C:\Windows\System\gPMDwiv.exe
  C:\Windows\System\gPMDwiv.exe
  2⤵
  PID:9028
- C:\Windows\System\SBrRsaC.exe
  C:\Windows\System\SBrRsaC.exe
  2⤵
  PID:8772
- C:\Windows\System\cjvHwcr.exe
  C:\Windows\System\cjvHwcr.exe
  2⤵
  PID:8912
- C:\Windows\System\kVNnNVa.exe
  C:\Windows\System\kVNnNVa.exe
  2⤵
  PID:9200
- C:\Windows\System\izdYVtK.exe
  C:\Windows\System\izdYVtK.exe
  2⤵
  PID:8848
- C:\Windows\System\KHyOheR.exe
  C:\Windows\System\KHyOheR.exe
  2⤵
  PID:8400
- C:\Windows\System\HlpOVsj.exe
  C:\Windows\System\HlpOVsj.exe
  2⤵
  PID:8656
- C:\Windows\System\NxgKkLB.exe
  C:\Windows\System\NxgKkLB.exe
  2⤵
  PID:9040
- C:\Windows\System\eHUjmmp.exe
  C:\Windows\System\eHUjmmp.exe
  2⤵
  PID:8500
- C:\Windows\System\CbrrVQQ.exe
  C:\Windows\System\CbrrVQQ.exe
  2⤵
  PID:9228
- C:\Windows\System\qRWJVXE.exe
  C:\Windows\System\qRWJVXE.exe
  2⤵
  PID:9244
- C:\Windows\System\UAufrbT.exe
  C:\Windows\System\UAufrbT.exe
  2⤵
  PID:9260
- C:\Windows\System\JxIBAsp.exe
  C:\Windows\System\JxIBAsp.exe
  2⤵
  PID:9276
- C:\Windows\System\PTmVAOU.exe
  C:\Windows\System\PTmVAOU.exe
  2⤵
  PID:9292
- C:\Windows\System\uJtihpR.exe
  C:\Windows\System\uJtihpR.exe
  2⤵
  PID:9308
- C:\Windows\System\kQXNrnK.exe
  C:\Windows\System\kQXNrnK.exe
  2⤵
  PID:9324
- C:\Windows\System\milthhV.exe
  C:\Windows\System\milthhV.exe
  2⤵
  PID:9340
- C:\Windows\System\lXGrOGM.exe
  C:\Windows\System\lXGrOGM.exe
  2⤵
  PID:9356
- C:\Windows\System\CMINBhi.exe
  C:\Windows\System\CMINBhi.exe
  2⤵
  PID:9372
- C:\Windows\System\olpXEne.exe
  C:\Windows\System\olpXEne.exe
  2⤵
  PID:9392
- C:\Windows\System\toqknOI.exe
  C:\Windows\System\toqknOI.exe
  2⤵
  PID:9408
- C:\Windows\System\NUGkhtX.exe
  C:\Windows\System\NUGkhtX.exe
  2⤵
  PID:9424
- C:\Windows\System\tRHcgLa.exe
  C:\Windows\System\tRHcgLa.exe
  2⤵
  PID:9440
- C:\Windows\System\PafWRrW.exe
  C:\Windows\System\PafWRrW.exe
  2⤵
  PID:9456
- C:\Windows\System\tQNMabk.exe
  C:\Windows\System\tQNMabk.exe
  2⤵
  PID:9472
- C:\Windows\System\AiLYTXp.exe
  C:\Windows\System\AiLYTXp.exe
  2⤵
  PID:9488
- C:\Windows\System\XIbQrsN.exe
  C:\Windows\System\XIbQrsN.exe
  2⤵
  PID:9504
- C:\Windows\System\WfkzQoT.exe
  C:\Windows\System\WfkzQoT.exe
  2⤵
  PID:9520
- C:\Windows\System\LKvVAvh.exe
  C:\Windows\System\LKvVAvh.exe
  2⤵
  PID:9536
- C:\Windows\System\dQxJAmF.exe
  C:\Windows\System\dQxJAmF.exe
  2⤵
  PID:9552
- C:\Windows\System\ybymFSo.exe
  C:\Windows\System\ybymFSo.exe
  2⤵
  PID:9568
- C:\Windows\System\aWhnjdI.exe
  C:\Windows\System\aWhnjdI.exe
  2⤵
  PID:9584
- C:\Windows\System\PRSzmqB.exe
  C:\Windows\System\PRSzmqB.exe
  2⤵
  PID:9600
- C:\Windows\System\DBReIku.exe
  C:\Windows\System\DBReIku.exe
  2⤵
  PID:9616
- C:\Windows\System\euPTPgt.exe
  C:\Windows\System\euPTPgt.exe
  2⤵
  PID:9632
- C:\Windows\System\bmhWQfE.exe
  C:\Windows\System\bmhWQfE.exe
  2⤵
  PID:9648
- C:\Windows\System\OtKKWbY.exe
  C:\Windows\System\OtKKWbY.exe
  2⤵
  PID:9668
- C:\Windows\System\HaUgThR.exe
  C:\Windows\System\HaUgThR.exe
  2⤵
  PID:9684
- C:\Windows\System\tlWvQkx.exe
  C:\Windows\System\tlWvQkx.exe
  2⤵
  PID:9700
- C:\Windows\System\zbDuwVi.exe
  C:\Windows\System\zbDuwVi.exe
  2⤵
  PID:9716
- C:\Windows\System\SMvJsWg.exe
  C:\Windows\System\SMvJsWg.exe
  2⤵
  PID:9732
- C:\Windows\System\hqigjMS.exe
  C:\Windows\System\hqigjMS.exe
  2⤵
  PID:9748
- C:\Windows\System\sJKbOJu.exe
  C:\Windows\System\sJKbOJu.exe
  2⤵
  PID:9764
- C:\Windows\System\OnndJJz.exe
  C:\Windows\System\OnndJJz.exe
  2⤵
  PID:9780
- C:\Windows\System\kTPwYFy.exe
  C:\Windows\System\kTPwYFy.exe
  2⤵
  PID:9796
- C:\Windows\System\EyflYxS.exe
  C:\Windows\System\EyflYxS.exe
  2⤵
  PID:9812
- C:\Windows\System\IbKxVpd.exe
  C:\Windows\System\IbKxVpd.exe
  2⤵
  PID:9828
- C:\Windows\System\OWithAo.exe
  C:\Windows\System\OWithAo.exe
  2⤵
  PID:9844
- C:\Windows\System\uPtMykg.exe
  C:\Windows\System\uPtMykg.exe
  2⤵
  PID:9860
- C:\Windows\System\IpFOexM.exe
  C:\Windows\System\IpFOexM.exe
  2⤵
  PID:9876
- C:\Windows\System\bNYOccv.exe
  C:\Windows\System\bNYOccv.exe
  2⤵
  PID:9892
- C:\Windows\System\pYotaoC.exe
  C:\Windows\System\pYotaoC.exe
  2⤵
  PID:9908
- C:\Windows\System\iYyqjjn.exe
  C:\Windows\System\iYyqjjn.exe
  2⤵
  PID:9924
- C:\Windows\System\GUIWLeZ.exe
  C:\Windows\System\GUIWLeZ.exe
  2⤵
  PID:9940
- C:\Windows\System\NSwoTYn.exe
  C:\Windows\System\NSwoTYn.exe
  2⤵
  PID:9956
- C:\Windows\System\LoHpHhj.exe
  C:\Windows\System\LoHpHhj.exe
  2⤵
  PID:9972
- C:\Windows\System\TSBDSda.exe
  C:\Windows\System\TSBDSda.exe
  2⤵
  PID:9988
- C:\Windows\System\NbZWlWO.exe
  C:\Windows\System\NbZWlWO.exe
  2⤵
  PID:10004
- C:\Windows\System\DSljvMF.exe
  C:\Windows\System\DSljvMF.exe
  2⤵
  PID:10020
- C:\Windows\System\rJOEPkk.exe
  C:\Windows\System\rJOEPkk.exe
  2⤵
  PID:10036
- C:\Windows\System\JGrSEtn.exe
  C:\Windows\System\JGrSEtn.exe
  2⤵
  PID:10052
- C:\Windows\System\PIAfeyT.exe
  C:\Windows\System\PIAfeyT.exe
  2⤵
  PID:10072
- C:\Windows\System\vBsftyE.exe
  C:\Windows\System\vBsftyE.exe
  2⤵
  PID:10088
- C:\Windows\System\ueydNgf.exe
  C:\Windows\System\ueydNgf.exe
  2⤵
  PID:10104
- C:\Windows\System\YUjLxgA.exe
  C:\Windows\System\YUjLxgA.exe
  2⤵
  PID:10120
- C:\Windows\System\rzEfyhF.exe
  C:\Windows\System\rzEfyhF.exe
  2⤵
  PID:10136
- C:\Windows\System\QsXqoOh.exe
  C:\Windows\System\QsXqoOh.exe
  2⤵
  PID:10152
- C:\Windows\System\BtDQtjA.exe
  C:\Windows\System\BtDQtjA.exe
  2⤵
  PID:10168
- C:\Windows\System\HBAyLph.exe
  C:\Windows\System\HBAyLph.exe
  2⤵
  PID:10184
- C:\Windows\System\KXFCIGt.exe
  C:\Windows\System\KXFCIGt.exe
  2⤵
  PID:10200
- C:\Windows\System\AgIPvLr.exe
  C:\Windows\System\AgIPvLr.exe
  2⤵
  PID:10216
- C:\Windows\System\tOZVmTN.exe
  C:\Windows\System\tOZVmTN.exe
  2⤵
  PID:10232
- C:\Windows\System\sqeMaPe.exe
  C:\Windows\System\sqeMaPe.exe
  2⤵
  PID:9136
- C:\Windows\System\uJrhWkY.exe
  C:\Windows\System\uJrhWkY.exe
  2⤵
  PID:9268
- C:\Windows\System\fyMJqYc.exe
  C:\Windows\System\fyMJqYc.exe
  2⤵
  PID:9300
- C:\Windows\System\TfDrZAO.exe
  C:\Windows\System\TfDrZAO.exe
  2⤵
  PID:8736
- C:\Windows\System\aDbrPZC.exe
  C:\Windows\System\aDbrPZC.exe
  2⤵
  PID:9224
- C:\Windows\System\WzqqIWE.exe
  C:\Windows\System\WzqqIWE.exe
  2⤵
  PID:9320
- C:\Windows\System\NyeEXmz.exe
  C:\Windows\System\NyeEXmz.exe
  2⤵
  PID:9288
- C:\Windows\System\lpTWbzl.exe
  C:\Windows\System\lpTWbzl.exe
  2⤵
  PID:9388
- C:\Windows\System\foNxOde.exe
  C:\Windows\System\foNxOde.exe
  2⤵
  PID:9420
- C:\Windows\System\AWWUaVl.exe
  C:\Windows\System\AWWUaVl.exe
  2⤵
  PID:9496
- C:\Windows\System\TPmkARA.exe
  C:\Windows\System\TPmkARA.exe
  2⤵
  PID:9560
- C:\Windows\System\CiMVari.exe
  C:\Windows\System\CiMVari.exe
  2⤵
  PID:9452
- C:\Windows\System\yMZTPNk.exe
  C:\Windows\System\yMZTPNk.exe
  2⤵
  PID:9660
- C:\Windows\System\zNOcznC.exe
  C:\Windows\System\zNOcznC.exe
  2⤵
  PID:9696
- C:\Windows\System\NxpUICT.exe
  C:\Windows\System\NxpUICT.exe
  2⤵
  PID:9760
- C:\Windows\System\sIBqOMq.exe
  C:\Windows\System\sIBqOMq.exe
  2⤵
  PID:9820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BoLEjnu.exe

Filesize
2.1MB

MD5
f6816d7bb758e37b48f7daecf87c4189

SHA1
51ae4b31ba8a5427a8d5f5a62568dc8c9e6ea4fc

SHA256
be8229e1f6ebd15b32cad5a79f073476b3285f285d07eccc0e94b156fc17df78

SHA512
be6f4d5c0f48319a2ba452210e6ea281287bdcb6c282b57c8ffe7a331338f694d3e673a6f259cc8eca0e3492b3ada33dc2d3e24d284140d5795afeb1bbdb70dc

Download Submit
C:\Windows\system\EXGFOjA.exe

Filesize
2.1MB

MD5
2ab4dca90bbf2ce549c8c3da9c10915e

SHA1
9976344d3b88a155ca52686a056df843cd482934

SHA256
1228f04afce4f020d8c8897f6d811b14b58fd45e831185ebd2d32ca02938ff5c

SHA512
63af6c5fb3a9fb4eecd81f9701de4812981771df1db9b45d1cf6f5593f536dca67f3e0f754b6a88fee8a3749edccf61ee9a310919a66d9c39d72c43049a1fd83

Download Submit
C:\Windows\system\GoKQEqJ.exe

Filesize
2.1MB

MD5
cf0c1ad2dbfd516d52fe0fb9e5cbf916

SHA1
0d0f4258b7b11e5c3b763da088d664d832253b84

SHA256
7c5836c714853034b20af87b78232daf9df39cf05a5cef8d24d19d0d4fecb7ff

SHA512
9b86fde1f8e4fb08fba6b6191bd5916cc0760c35b4356dbf228600ed0d3df9f3b79440c70b612067252828dca53c99771d2aed12e4ab16c4f51d27e1511deb64

Download Submit
C:\Windows\system\LMfbgty.exe

Filesize
2.1MB

MD5
43c489081df3bbee4180e7612271aec0

SHA1
984a29ebe0a94dc7f5b6508c14e974794e60e3a1

SHA256
5f4c7ad683c4ae56931b354010bc047ef1bdb3def8c7a3aa1ac030b551730808

SHA512
acd5f83c35a2cc306f05dcfae7f3fda583468898b07d752cd73fb6fabc6416a784ae380ff86b079b7edf8a74b42676e4060f67c61390ef3ea52ec6c2013d5a38

Download Submit
C:\Windows\system\LrAylmc.exe

Filesize
2.1MB

MD5
5529e6961a4c772ea539718113e609e0

SHA1
af8af6ecca89bf8ca21d1a5af99202fcaa4d5fff

SHA256
58b0d4d3cfe8402b21b3540d55126534b5e703b16a57f1593edaf9d6802b67cd

SHA512
5fdebc6aea3e17c27daaab5efdcd910ade3924f772e0ddd84a19b722f8c6d99a729536745d76979956e100cfbd176e4365e35ba9f23a4ab5f7479cf0bbca4d91

Download Submit
C:\Windows\system\NRbQEzM.exe

Filesize
2.1MB

MD5
1f7483dee0e1abd9dc677efb440a0092

SHA1
24dd901ea7d97bd4538ead577649819309ca5f3b

SHA256
38e0c642f1c03834aad08382311be1896b19514c2b5ef9a9258c463df6a9d03d

SHA512
c917b34487e05f6879c470ac4cf597938a70b0604adb001f1cbd4070355893140e90dd146531269b8cf07f35eb81ee57986b9e4053ecb629df98640cf5e8bed2

Download Submit
C:\Windows\system\NXxvYpN.exe

Filesize
2.1MB

MD5
333d5c62a8eaf925e31617e683467ef2

SHA1
520dce2293b89d56dd27ef961316a0acd0e80594

SHA256
0f7f7b3ee9ae7d639976c71f6d3d16327b8f9e17b7df29841d57ce68fe22c75d

SHA512
0ef3580a0b2b3fdc10bd7cfb484ef6f3e57f83c9de55a3e2636506ed5a606d107317860d8bfc437216c7a7c9a2007144705a566327fc6bc647d70b98451a96f0

Download Submit
C:\Windows\system\NjHmOlV.exe

Filesize
2.1MB

MD5
fab641fc5be578ee479e2bf3233fcc26

SHA1
639f3ab2849a344a3060fddac41a8dedfe9a047c

SHA256
b61f091c0a3d14c6534b34ba2e861cc985b513a3165ed3a7d12f9d6dce78dba8

SHA512
5f5cfb436fbddd4938c0784857f39ee14089c11b79e907e308a6c74c65c489268cc17dcb074a0209c4994a789f8c68fd8737b53b4926f07f44ec1d54f518cdaf

Download Submit
C:\Windows\system\PPgGioD.exe

Filesize
2.1MB

MD5
d5301a8494550b22f2c36107e5a56505

SHA1
b8e9b741cd95709794ba55478a6243f8c44366bb

SHA256
f21faffb8d12f1156ef1432f1e3634051e8240de0dcd0b50125e69e53423868e

SHA512
532711561aa5173d0356b5db8dc879fcdb8bd60d1a57f3f4fd0de2c8e544364ea526ef89538b3bcaa76d7bd28d66696e3a51b7582c4334ac72c846add549cce9

Download Submit
C:\Windows\system\ReJOIeL.exe

Filesize
2.1MB

MD5
2aa4fe0059ac2219f51a7aa92558906e

SHA1
a8f302248b9c5a44d5435ee0605f6575378c1915

SHA256
9839e71fd6b0fa424a52d83b21216629b718138357ed8c0d4d603811332fb46d

SHA512
e93257fd227bd623e52a68c6c69437f64bdd2c763f0084e639a653075010f7ef3544ad55ec8bb245f65744179d4d96a32fe312cda8ec505ae4e6a4259c80dd2a

Download Submit
C:\Windows\system\ToXJoYC.exe

Filesize
2.1MB

MD5
72d00f7de0ca701d43bfc732ec12579f

SHA1
2f851e222b536e9d3710e4c5ed319d89bc483a24

SHA256
ece437948709b8ff594e11c5811f68ca2ab150535ce03e343d08070abadb73db

SHA512
d9d58ad65f07cfbea91f8cb15f14566d30a6df3b0385f98e9d7ffa2ae20e5b3cc6a9e8ae4fc52d8305a7363cd7c513ee23fc750b2d17425329369b5ba1ad8949

Download Submit
C:\Windows\system\TvgjNek.exe

Filesize
2.1MB

MD5
c457cc6a8889b117573348dbe6e21593

SHA1
b681d0cf2c7d1e1e3d40962a80ba9247f6a37230

SHA256
db26bea4d6e8f3c6c5baf2e4c57c13a12181f43176851783901d08fd1eb29f61

SHA512
e4103b7df009ed747ce6e063c4e7604f4f0d39a5c308e102698c7d97a5ffeb17175aa646115a0e99568899d756999ae11e272d1f001b965507e2e679be4391b8

Download Submit
C:\Windows\system\UTvTlvF.exe

Filesize
2.1MB

MD5
ea48d948cd15fa49f1668d1f45b37533

SHA1
9d80e38585fb4d4c19cbacc6e6d5e90a4c88d687

SHA256
ae25c28c6db6ab28791f648a2c6a419fd6a7abd51dd7bd6a1a5d4df78a4effc7

SHA512
04cfc0d6a17c6ec848fb26acef6f4fad33415d981ea96d75f53ac68034b03947f51345b3dc0b5b736cf776f0370abd593cf155b53c452c044958212872567a73

Download Submit
C:\Windows\system\XPfHLnO.exe

Filesize
2.1MB

MD5
f89a631c1e5adce14385c126cb74727b

SHA1
46cf685e1ff7bfbceabce5326b23ae6d081e674b

SHA256
81c183f1a00106504dc4b896b2ff3dbd0a33c68e87ad62d9c70545c47e2dcec4

SHA512
6f9b785425de73b6b05b3cd5b059fcab049e5eef7876945163ab7b1d3f037fe406b00cd1a8bc55e8585d2c43fe00acb4a2b97d980069d2b0ee86bc5379822747

Download Submit
C:\Windows\system\YCVObKk.exe

Filesize
2.1MB

MD5
5f95b5bf584b4b709d174bf539478d10

SHA1
3e76b56ac505e78c97ba7175817344c5eb1bc895

SHA256
cc8a089d1e26756ed6444789c67b1dd62ff41eb8fd893a765b9aaaa20ac86586

SHA512
33840db8a4e6b16add2f97c3404019e4d9b1d9f58a31b1b188b46787ad5a482729d2c4d8d8f9d7538bab3807850f2a68c8b933a381a9e64240a7d97ab7ca0455

Download Submit
C:\Windows\system\YImeMZb.exe

Filesize
2.1MB

MD5
3a31f5ec017e578302b88e5c33a59c75

SHA1
18cee06b6d5b0cf04ae4c22750ddae2dbc9dcc1b

SHA256
191b91fd534dd1c0895a8ca6a85917a9b3f857b5ee1c1fb31628bd813b2b215f

SHA512
014c81c20f9fd89916920bbee2ef67b45b108abca72f25862aaf73f61344d8af975c9badef6f39e68e154008b7ce5fed70a1a02eeac40cfa8815f5ee2317d90a

Download Submit
C:\Windows\system\fwdFIaL.exe

Filesize
2.1MB

MD5
9ed851042e4900630a4499b36188ac21

SHA1
3a5189f04bcedaaa496d7cae9e3bc4363300b24c

SHA256
6f37f7807467ba0b00dc77bfc881577778616f0ad87735c7cc272b9793ccbeed

SHA512
c09f97fea74b4d3c41e5d648935830aa2db21c6debe283f45ebe7e03263af1d3a29cb0ab9065d2f50d36eadf37422b54aa2cdfc8a52b5ab4e5aaaff8b91a95e5

Download Submit
C:\Windows\system\hnexfVD.exe

Filesize
2.1MB

MD5
fe692b42cc2797173bbebc8b898a38a2

SHA1
1dee29d51068b3ac05255f1a5cdf6bc8d5c85509

SHA256
f53957dcbf6ba3513c10b53bac7ae8e67f440237189192fcf6ab5cc5233964de

SHA512
126fc6c17b6137e417fc2b33eab7ea9d1f12b172bbb9e8f59e9b88d419d15fd9d7e63e6d1f04629a3a71e453d8b1a2f34248ba9801187d78e0cf7bcf068dcbfe

Download Submit
C:\Windows\system\hvbhrit.exe

Filesize
2.1MB

MD5
b1dabe7d3e5310b8d2ee08ed9cfa01d5

SHA1
37d5f92c71ec5ab175194be66f668f2c0a2f89cd

SHA256
e17a906b9e3dbf9e48694aa6d5ec089a454130b587200d9703fb65635e038259

SHA512
b24d229ebf44daa87d4462cc54fa4a1b71d55694984fc7d12e196578a37cf03985ca787f14410ec7f04828ced1ab6916acf5c642c399dffb11222dc9a9479735

Download Submit
C:\Windows\system\iyIOGKE.exe

Filesize
2.1MB

MD5
f62369215f16da70beef9ff77ad9b37b

SHA1
c22573b67e0e7e61ba771740b4342b0c9934c75e

SHA256
74f4577369880d80330276267f06acb2ea58490546a8c2b354dd1b61c0d33655

SHA512
75c152a3a99924e89e03fa10c6bc7f695976f7ba7aa861e1570433be00ab6cfb9b56a2661bb93977b555b690810416cc3876e52fa3f5141ec9b4023ac07c53a0

Download Submit
C:\Windows\system\mMZIzxx.exe

Filesize
2.1MB

MD5
4a96afe00a383a3318c9442247b071a9

SHA1
fc6d1d30f1928145ba1c0398ddc4e58052c32a41

SHA256
2e9d7194c58904133f4d81202a8ebc17ee70cb4fefabbc8771f7462543fdabf3

SHA512
6b27e36c55e779d60bd278308b8db1a7d182c07ce1f6ef7c3df99a1c3e245c87a84b0fa8323f626d793d0a1e306c2185ef5bf68001cf2c626540fb3153b64987

Download Submit
C:\Windows\system\nFYmidB.exe

Filesize
2.1MB

MD5
1415979f9097922e5d837734382c5b40

SHA1
9c31e7881e9a7580eb1f780a193b823e0a23c575

SHA256
53ecc3e013272e6eb614adf8fcc7e389d0ae6e5bc75a9501956de3b8e822df81

SHA512
a77302a3be10390ccae78972338ed51bf70dac823fffcc5919e672f159416bdf0c4f8dfddc8799cbd053e3a11190aaca61be2e739e09294cb2d5b4fed86dabaa

Download Submit
C:\Windows\system\wGHVKjV.exe

Filesize
2.1MB

MD5
5c3f6bd5e2557051aa10c32dbc4d616d

SHA1
9f6a13f9696012de4418551349205d36301907fe

SHA256
62ffca9cb6e7567a6d2944575ad4dc95246db55ae2557dfbafca3588ae51d8f1

SHA512
fc0809afea9ed431241a7e45cfaaee3df3de7644f342694f77068532a2aec5101ae220f6703e2e01356a370eaf4436a48922559c0e5e2f7baff55ea6510bc35e

Download Submit
\Windows\system\EFZUsTv.exe

Filesize
2.1MB

MD5
07cf35b36a9b84ec6fe916d0bdb5f54f

SHA1
e6622f6bbf44d482d13165e35f669bfaa04ea177

SHA256
9fd8e4d5b272e26e017951015c55835b358f0dda783228b4d2645055850df6e0

SHA512
d720cce0d42f230cef2fd38060ede022cb71ffded1dbea683675a13273f5cec861fe4b101595c7c7eb7d4c7def3ff4506ccce259d11767ec525b7373a59e4d75

Download Submit
\Windows\system\FxDaFif.exe

Filesize
2.1MB

MD5
d72d965e2669cb1db606567eadb8a473

SHA1
ef1123e101e54822f3461447fb5db284acef1708

SHA256
b079c1d0563ead5367c1ae303149877bc4af013aa39e7f8169b139d08a5e30e7

SHA512
52cd13b3d813ddf5abe6d92468de933413435b6db20470e2845c2268f7068a3a27ca197e834717702a8c2923a10d05c2f6242f2bcf6abac4ad48cf817a976d32

Download Submit
\Windows\system\GdcwPst.exe

Filesize
2.1MB

MD5
1f9b826dc48167a28fc3e3bda062ce14

SHA1
312e41d279cbab782c74b7d7328ede4b110b3363

SHA256
81506ff5289c2132b81fe21c060d003ee4ca6221e6289ba95bba2d2664ceb8d8

SHA512
9c5ea51fde8da8999fa5b440305bb6055f83cb93439048a01e60fefacbb0ad70c80e279b224fbae25ca85fb0b0fb95f23cdefa03e1182c3fa0c24c86e57dda65

Download Submit
\Windows\system\HqCvQGk.exe

Filesize
2.1MB

MD5
a67376ba986b4695d72bcf37c9a39002

SHA1
4b141b1ba37f8ce971afc5a5fc59c1b67bcff2c2

SHA256
ff30e706c85771a3081b5aabeac3bf6af4c42b8d4350326ad5b280c8a244f559

SHA512
fdc5de5cf634c57d4deec67685d81f50f0fa31def4f349adfa277342d0e18bc027a9e79ac71bdd15391294f8a1e0292b3f5ee4006b3fa4247f61917a16298bd1

Download Submit
\Windows\system\MqxiJvt.exe

Filesize
2.1MB

MD5
485c28578a5ec32cc14bbbce6aa89abc

SHA1
0f378195904febbfc8f268a2c6ffb077f81469a6

SHA256
83a0d75ed91d7cf525eff414d61cfb8179bb37fe6c109f02baae0dd69ae240fb

SHA512
05f2cd4d59d3186fd70ab25aac8efefeee3f9a4803e62c39c77c49608a7ac00ca1454c0617f20e95542e8bec8957e1db9208bb2758b833cfee00411471eb3db4

Download Submit
\Windows\system\fOpPKnV.exe

Filesize
2.1MB

MD5
3deeb9e9fb5c51683aca77ce2f1ec546

SHA1
0dc6fb32caa6092ec7542462593ed2a859e3ee6e

SHA256
e387cf9d82a906da04cf175affe154346b695c3ed630ede20fbd8414d2d8ca67

SHA512
e4e5751dfd477ef7a6c50ad71dfc8ca38fe78c9de5fcf960b40fd1cedca7dc34608b3bc593d1bbe7d8d5f516066297a55f5360a7221cbb47175ab50e0c227626

Download Submit
\Windows\system\iLmvEzL.exe

Filesize
2.1MB

MD5
1380e5a954942c3c74f13de0f57167e5

SHA1
48a69fd33aff014f86bcd7790edd13f61c343d9e

SHA256
2d46bb0856dd83de00c07daa2e2fa4bd7c0441aa89e5c93bbc035cbbdd050911

SHA512
f7f49676eebc4428e0f078d5ccc4546e7639e2fc7c4a9d280246eff3dabe5691406418bfbf9afbf143f0c6b6282b5f86723fcd1d8db0839ba1e573e0f9579055

Download Submit
\Windows\system\ifuGyYq.exe

Filesize
2.1MB

MD5
fbf6b1317157132d680d5428788ca91d

SHA1
8b502cadda0717147cf8cb1c319311a1eeae9aff

SHA256
7ea79bac4db6e9fd5f7dbe696d036c7745edab5395d8409dba53e0352bd0c582

SHA512
42d8ad826915e36b88baecf3139e64ddeb827f57c6cb397e9eafbe12222d9c691c9d2b78e59f21d2be63ab6b7116e3bd9e4955016e7119d84615503de210bcdf

Download Submit
\Windows\system\kOgxOrI.exe

Filesize
2.1MB

MD5
46bd633f6bbd009771abed756e79d0de

SHA1
22452d4991cfaebf29aae713de51e260cfccdd22

SHA256
3dcbf57d84f10f767e8b4a1e871630af30e9713ce670d4fe34ab173f6d7e5582

SHA512
78e60b3f3818c7461d60e459fbab60756585c7bbabfccde3262270d01dd47b8f3f1f3971924b19562018dbb6e0816ad220d283a30b5f0a4c00ef135db248fdde

Download Submit
\Windows\system\mgoMiUk.exe

Filesize
2.1MB

MD5
d5a529faca7aa364e84e7d0bf0e90eb1

SHA1
dda6feb93623cd12852cd17107b7afd3f6d38b79

SHA256
c51979c7cb6e203ac578bcd5bb45fbe0a14f276cb0de594cceb946d19d0a5741

SHA512
e9f39e5c1b3bb35fecf85d7749d24099f0ec918f8a5ce6cdc0a19b8b4b0f7deda5cdea36888252751e48a249061b5671d0d8af565cf2f7a46f51959e05ac5fa1

Download Submit
\Windows\system\qPkLeyb.exe

Filesize
2.1MB

MD5
611ac7824062a2367d76a541303c061e

SHA1
4514ff8eccb0c16cdd2639cd037509d8417fc547

SHA256
268fe6bc26bb7e2532656e4dfb2a275097771ac2e9a9270b455030a1a68d62df

SHA512
6c3e2d6129687f1bef5d96844a7971f505e1d1d4b73023a69867628b4e94e8deb7fa768897629a382324b42432805fa1fbd0300fbb517d5f717e8d7c47b7be89

Download Submit
\Windows\system\uczAcOz.exe

Filesize
2.1MB

MD5
dd602fb87289917e6508fad6a5e82409

SHA1
2780367b15589db45c7270643c9cebcbb2930d82

SHA256
b9e90d5fa59f37b573aaac3423868c5a2efacd323ba12201a73fd674b5927ee2

SHA512
b5bf4889f5867b108e236648c217bcc5f2896f6fab81ec99fbb0927a44cdef43293da764f3146215a504790aeafa7859140340c9baca010ef16ae62eb2dc870d

Download Submit
\Windows\system\vItPxsq.exe

Filesize
2.1MB

MD5
e196c9123f12fa34c1c3cfbb20ef5232

SHA1
7babbf99e46f7c4eee52aa80231967a95e79462e

SHA256
05f2d262efbba77c5c86d516bb1af037cece7bdcacd5ed7e8240f45a5d931870

SHA512
1559cbc583f1045d10ed5dda0205131ae75aee2b74f1d2e29e2a967a14bd5cf92a72f049c0d06810a1d4c5792781e299faed2c37bed6d4243e486d5dbc24445c

Download Submit
memory/2116-75-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2428-109-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2456-105-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2496-111-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2544-107-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-97-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2628-82-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2712-88-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2736-99-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-103-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2752-101-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-104-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2904-78-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2904-102-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2904-100-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-95-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2904-1-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-83-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2904-108-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2904-112-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2904-106-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-74-0x0000000002210000-0x0000000002602000-memory.dmp

Filesize
3.9MB

Download
memory/2904-110-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2904-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2904-98-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-87-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/2964-85-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/2976-8-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download