xmrig | a8adf5fae8c2ffc574bae91d717758af93c27ba02e77110e4cd3dc21fb37b8d2

Analysis

max time kernel
29s
max time network
16s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
Size

1.9MB
MD5

0b5da1706a431139af73f3605fdfcfe6
SHA1

1351fa641ff85152c6856bb83b344a6b7f533de8
SHA256

a8adf5fae8c2ffc574bae91d717758af93c27ba02e77110e4cd3dc21fb37b8d2
SHA512

ea71e741870a4a48e5908877b15d611eff7affdea8b2e25ddc6f90ac88d64767b770673eebc6ea3139da172f01709720254bc035377b504b66d10244d1270ae9
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1W:NABl

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/1836-38-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2636-50-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/2700-55-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/2588-54-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig
behavioral1/memory/2292-52-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2596-51-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/1840-36-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1840	wODsBtF.exe
1836	eDLoPMs.exe
2588	ynjJOVM.exe
2636	HdDNjOx.exe
2596	NOfaIyd.exe
2292	TlzMSIB.exe
2700	daszDoC.exe
2496	IvtqxeU.exe
2544	rexEGNh.exe
2200	PHZgbDm.exe
1632	aQxqRxf.exe
2940	EjMOTkH.exe
1940	nmVUzNa.exe
2892	tDGHLpi.exe
1660	WlxRDuI.exe
2864	cSuCyOZ.exe
1704	mlTEikh.exe
2804	XEyqHfC.exe
1512	KPBfrKg.exe
1364	aZnJbRM.exe
2932	FZJlDWI.exe
1952	iwOlkPv.exe
1136	uguWsAP.exe
2592	zVrFLXM.exe
2368	PuwiKVu.exe
488	HkMjBQy.exe
1176	bFVfWSd.exe
2256	ZcOijDq.exe
1780	UnSsWho.exe
764	mQDKQvb.exe
568	HaAMgLK.exe
1088	SnnAiFS.exe
1788	XQQLPDV.exe
980	UGScCwu.exe
352	ZFvCjBQ.exe
1116	CFGFWLl.exe
376	BdXRtNB.exe
1984	EmsEHID.exe
2288	qTyFwHH.exe
2432	HjDjHCx.exe
1640	lyxXxGK.exe
2252	ezhFFwP.exe
2092	weRGwhR.exe
2952	JpeCEcG.exe
2964	IoqNdWs.exe
2520	jtdYmGD.exe
2720	ISYGzML.exe
548	HPjRtmc.exe
3032	oJPevDS.exe
2928	VMSrYXc.exe
2908	MlUzlIg.exe
2896	bdPzKRZ.exe
2936	QavdPSs.exe
1988	jqWPlqi.exe
1120	djZVWYd.exe
1212	UBVgaDs.exe
3024	BVUxahH.exe
2924	ZFfYQbt.exe
1228	qZfOWxG.exe
1592	ConcgEE.exe
2528	iqYINzL.exe
1084	EjsGeeV.exe
1720	MILRPto.exe
1488	oZlgdBl.exe

Loads dropped DLL 64 IoCs

pid	Process
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2264-2-0x000000013F870000-0x000000013FC62000-memory.dmp	upx
behavioral1/files/0x000c0000000122e4-3.dat	upx
behavioral1/files/0x000b000000012303-10.dat	upx
behavioral1/files/0x0008000000012678-14.dat	upx
behavioral1/files/0x000900000001264d-29.dat	upx
behavioral1/memory/1836-38-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2636-50-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/memory/2700-55-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/files/0x000f000000005578-60.dat	upx
behavioral1/files/0x00070000000133b9-85.dat	upx
behavioral1/files/0x0007000000013928-101.dat	upx
behavioral1/files/0x00070000000139d8-111.dat	upx
behavioral1/files/0x0007000000013a71-142.dat	upx
behavioral1/files/0x0006000000014316-180.dat	upx
behavioral1/files/0x00060000000141e6-184.dat	upx
behavioral1/files/0x000b000000012309-177.dat	upx
behavioral1/files/0x00060000000142c4-173.dat	upx
behavioral1/files/0x0006000000014120-149.dat	upx
behavioral1/files/0x0006000000014390-187.dat	upx
behavioral1/files/0x00060000000142b0-170.dat	upx
behavioral1/files/0x00060000000141c0-163.dat	upx
behavioral1/files/0x0007000000013a21-139.dat	upx
behavioral1/files/0x00070000000139e0-137.dat	upx
behavioral1/files/0x00070000000139b4-135.dat	upx
behavioral1/files/0x000700000001342b-133.dat	upx
behavioral1/files/0x00070000000133b0-131.dat	upx
behavioral1/files/0x000800000001329e-128.dat	upx
behavioral1/files/0x00060000000141a2-156.dat	upx
behavioral1/files/0x0009000000013113-119.dat	upx
behavioral1/memory/2200-91-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x00070000000133a8-84.dat	upx
behavioral1/memory/2544-83-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/files/0x0008000000013172-75.dat	upx
behavioral1/memory/2496-72-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/files/0x000b000000012713-59.dat	upx
behavioral1/files/0x0007000000013a11-123.dat	upx
behavioral1/memory/2588-54-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/memory/2292-52-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/memory/2596-51-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/files/0x00080000000126ab-39.dat	upx
behavioral1/memory/1840-36-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/files/0x000b0000000126e1-31.dat	upx
behavioral1/files/0x000800000001269d-30.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QJgtfPu.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\bgvhOjX.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\wpMLCzX.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\othsJjP.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\Trgsqal.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\JpqwsND.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\liKzrbk.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\vASyuif.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\OxbwAVh.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\GyChHej.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\bccSkpo.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\KjtJGpw.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\EfkCNXy.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\Cuhvfxa.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\VFFRaUk.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\gWCxsSG.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\eFatdXP.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\LixFqdF.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\XPLOohw.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\SkDKUzX.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\LdTgfoq.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\LfnZhhV.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\WkyVroV.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\wsTysUs.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\qhTHDpK.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\uOdgLgT.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\ruzQqdG.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\hqqQmqv.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\sXsBwyQ.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\KEKlnhR.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\tuZaEZJ.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\LxldGfX.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\hoaexCr.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\oPhZsvE.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\jExksOi.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\nMmgweY.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\ECVscoy.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\XGIJOzX.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\pxYhigg.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\WBIIOBM.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\fTMPHgR.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\fSxUVdG.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\rBzeRgG.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\edFmWDr.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\uizhdTc.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\jwoZBcV.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\brEfVJq.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\vWHfiqo.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\QbkywIO.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\wHifoXc.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\lEkuoyL.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\MLQhCpz.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\ilBfUEH.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\LhZRUgW.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\MlUzlIg.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\DxWWpTC.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\RGIsYrF.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\kPnOgXJ.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\sOCSByj.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\VjOMyGT.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\fgXwZQv.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\tPFOAJm.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\gqHNKGI.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
File created	C:\Windows\System\nmIXysE.exe	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2088	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
Token: SeDebugPrivilege	2088	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2088	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	29
PID 2264 wrote to memory of 2088	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	29
PID 2264 wrote to memory of 2088	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	29
PID 2264 wrote to memory of 1840	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	30
PID 2264 wrote to memory of 1840	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	30
PID 2264 wrote to memory of 1840	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	30
PID 2264 wrote to memory of 1836	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	31
PID 2264 wrote to memory of 1836	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	31
PID 2264 wrote to memory of 1836	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	31
PID 2264 wrote to memory of 2588	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	32
PID 2264 wrote to memory of 2588	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	32
PID 2264 wrote to memory of 2588	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	32
PID 2264 wrote to memory of 2292	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	33
PID 2264 wrote to memory of 2292	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	33
PID 2264 wrote to memory of 2292	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	33
PID 2264 wrote to memory of 2636	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	34
PID 2264 wrote to memory of 2636	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	34
PID 2264 wrote to memory of 2636	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	34
PID 2264 wrote to memory of 2700	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	35
PID 2264 wrote to memory of 2700	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	35
PID 2264 wrote to memory of 2700	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	35
PID 2264 wrote to memory of 2596	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	36
PID 2264 wrote to memory of 2596	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	36
PID 2264 wrote to memory of 2596	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	36
PID 2264 wrote to memory of 2496	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	37
PID 2264 wrote to memory of 2496	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	37
PID 2264 wrote to memory of 2496	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	37
PID 2264 wrote to memory of 2544	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	38
PID 2264 wrote to memory of 2544	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	38
PID 2264 wrote to memory of 2544	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	38
PID 2264 wrote to memory of 1660	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	39
PID 2264 wrote to memory of 1660	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	39
PID 2264 wrote to memory of 1660	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	39
PID 2264 wrote to memory of 2200	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	40
PID 2264 wrote to memory of 2200	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	40
PID 2264 wrote to memory of 2200	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	40
PID 2264 wrote to memory of 1704	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	41
PID 2264 wrote to memory of 1704	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	41
PID 2264 wrote to memory of 1704	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	41
PID 2264 wrote to memory of 1632	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	42
PID 2264 wrote to memory of 1632	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	42
PID 2264 wrote to memory of 1632	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	42
PID 2264 wrote to memory of 2804	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	43
PID 2264 wrote to memory of 2804	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	43
PID 2264 wrote to memory of 2804	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	43
PID 2264 wrote to memory of 2940	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	44
PID 2264 wrote to memory of 2940	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	44
PID 2264 wrote to memory of 2940	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	44
PID 2264 wrote to memory of 1512	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	45
PID 2264 wrote to memory of 1512	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	45
PID 2264 wrote to memory of 1512	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	45
PID 2264 wrote to memory of 1940	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	46
PID 2264 wrote to memory of 1940	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	46
PID 2264 wrote to memory of 1940	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	46
PID 2264 wrote to memory of 1364	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	47
PID 2264 wrote to memory of 1364	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	47
PID 2264 wrote to memory of 1364	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	47
PID 2264 wrote to memory of 2892	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	48
PID 2264 wrote to memory of 2892	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	48
PID 2264 wrote to memory of 2892	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	48
PID 2264 wrote to memory of 2932	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	49
PID 2264 wrote to memory of 2932	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	49
PID 2264 wrote to memory of 2932	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	49
PID 2264 wrote to memory of 2864	2264	0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b5da1706a431139af73f3605fdfcfe6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2088
- C:\Windows\System\wODsBtF.exe
  C:\Windows\System\wODsBtF.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\eDLoPMs.exe
  C:\Windows\System\eDLoPMs.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\ynjJOVM.exe
  C:\Windows\System\ynjJOVM.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\TlzMSIB.exe
  C:\Windows\System\TlzMSIB.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\HdDNjOx.exe
  C:\Windows\System\HdDNjOx.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\daszDoC.exe
  C:\Windows\System\daszDoC.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\NOfaIyd.exe
  C:\Windows\System\NOfaIyd.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\IvtqxeU.exe
  C:\Windows\System\IvtqxeU.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\rexEGNh.exe
  C:\Windows\System\rexEGNh.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\WlxRDuI.exe
  C:\Windows\System\WlxRDuI.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\PHZgbDm.exe
  C:\Windows\System\PHZgbDm.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\mlTEikh.exe
  C:\Windows\System\mlTEikh.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\aQxqRxf.exe
  C:\Windows\System\aQxqRxf.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\XEyqHfC.exe
  C:\Windows\System\XEyqHfC.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\EjMOTkH.exe
  C:\Windows\System\EjMOTkH.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\KPBfrKg.exe
  C:\Windows\System\KPBfrKg.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\nmVUzNa.exe
  C:\Windows\System\nmVUzNa.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\aZnJbRM.exe
  C:\Windows\System\aZnJbRM.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\tDGHLpi.exe
  C:\Windows\System\tDGHLpi.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\FZJlDWI.exe
  C:\Windows\System\FZJlDWI.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\cSuCyOZ.exe
  C:\Windows\System\cSuCyOZ.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\iwOlkPv.exe
  C:\Windows\System\iwOlkPv.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\uguWsAP.exe
  C:\Windows\System\uguWsAP.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\zVrFLXM.exe
  C:\Windows\System\zVrFLXM.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\PuwiKVu.exe
  C:\Windows\System\PuwiKVu.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\ZcOijDq.exe
  C:\Windows\System\ZcOijDq.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\HkMjBQy.exe
  C:\Windows\System\HkMjBQy.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\mQDKQvb.exe
  C:\Windows\System\mQDKQvb.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\bFVfWSd.exe
  C:\Windows\System\bFVfWSd.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\HaAMgLK.exe
  C:\Windows\System\HaAMgLK.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\UnSsWho.exe
  C:\Windows\System\UnSsWho.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\SnnAiFS.exe
  C:\Windows\System\SnnAiFS.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\XQQLPDV.exe
  C:\Windows\System\XQQLPDV.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\UGScCwu.exe
  C:\Windows\System\UGScCwu.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\ZFvCjBQ.exe
  C:\Windows\System\ZFvCjBQ.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\HPjRtmc.exe
  C:\Windows\System\HPjRtmc.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\CFGFWLl.exe
  C:\Windows\System\CFGFWLl.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\djZVWYd.exe
  C:\Windows\System\djZVWYd.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\BdXRtNB.exe
  C:\Windows\System\BdXRtNB.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\puYOPGC.exe
  C:\Windows\System\puYOPGC.exe
  2⤵
  PID:3012
- C:\Windows\System\EmsEHID.exe
  C:\Windows\System\EmsEHID.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\oFJONxR.exe
  C:\Windows\System\oFJONxR.exe
  2⤵
  PID:2144
- C:\Windows\System\qTyFwHH.exe
  C:\Windows\System\qTyFwHH.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\JzAZeVY.exe
  C:\Windows\System\JzAZeVY.exe
  2⤵
  PID:2976
- C:\Windows\System\HjDjHCx.exe
  C:\Windows\System\HjDjHCx.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\woxVRCJ.exe
  C:\Windows\System\woxVRCJ.exe
  2⤵
  PID:708
- C:\Windows\System\lyxXxGK.exe
  C:\Windows\System\lyxXxGK.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\QOWslXQ.exe
  C:\Windows\System\QOWslXQ.exe
  2⤵
  PID:896
- C:\Windows\System\ezhFFwP.exe
  C:\Windows\System\ezhFFwP.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\NBvwNVh.exe
  C:\Windows\System\NBvwNVh.exe
  2⤵
  PID:2020
- C:\Windows\System\weRGwhR.exe
  C:\Windows\System\weRGwhR.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\enWdHGJ.exe
  C:\Windows\System\enWdHGJ.exe
  2⤵
  PID:1680
- C:\Windows\System\JpeCEcG.exe
  C:\Windows\System\JpeCEcG.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\GEGUXRa.exe
  C:\Windows\System\GEGUXRa.exe
  2⤵
  PID:1712
- C:\Windows\System\IoqNdWs.exe
  C:\Windows\System\IoqNdWs.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\LGrSMCc.exe
  C:\Windows\System\LGrSMCc.exe
  2⤵
  PID:2608
- C:\Windows\System\jtdYmGD.exe
  C:\Windows\System\jtdYmGD.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\lqVdjlu.exe
  C:\Windows\System\lqVdjlu.exe
  2⤵
  PID:2612
- C:\Windows\System\ISYGzML.exe
  C:\Windows\System\ISYGzML.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\TMjhKeW.exe
  C:\Windows\System\TMjhKeW.exe
  2⤵
  PID:2900
- C:\Windows\System\oJPevDS.exe
  C:\Windows\System\oJPevDS.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\VATDDSG.exe
  C:\Windows\System\VATDDSG.exe
  2⤵
  PID:3048
- C:\Windows\System\VMSrYXc.exe
  C:\Windows\System\VMSrYXc.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\jsEPrKb.exe
  C:\Windows\System\jsEPrKb.exe
  2⤵
  PID:2000
- C:\Windows\System\MlUzlIg.exe
  C:\Windows\System\MlUzlIg.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\rwfdIRJ.exe
  C:\Windows\System\rwfdIRJ.exe
  2⤵
  PID:2840
- C:\Windows\System\bdPzKRZ.exe
  C:\Windows\System\bdPzKRZ.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\APQOJjC.exe
  C:\Windows\System\APQOJjC.exe
  2⤵
  PID:2004
- C:\Windows\System\QavdPSs.exe
  C:\Windows\System\QavdPSs.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\eWWrSUF.exe
  C:\Windows\System\eWWrSUF.exe
  2⤵
  PID:412
- C:\Windows\System\jqWPlqi.exe
  C:\Windows\System\jqWPlqi.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\TfdXJvs.exe
  C:\Windows\System\TfdXJvs.exe
  2⤵
  PID:1552
- C:\Windows\System\UBVgaDs.exe
  C:\Windows\System\UBVgaDs.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\INZIEUv.exe
  C:\Windows\System\INZIEUv.exe
  2⤵
  PID:2228
- C:\Windows\System\BVUxahH.exe
  C:\Windows\System\BVUxahH.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\MGddNAd.exe
  C:\Windows\System\MGddNAd.exe
  2⤵
  PID:3028
- C:\Windows\System\ZFfYQbt.exe
  C:\Windows\System\ZFfYQbt.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\AABSlNs.exe
  C:\Windows\System\AABSlNs.exe
  2⤵
  PID:1648
- C:\Windows\System\qZfOWxG.exe
  C:\Windows\System\qZfOWxG.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\PJrdMwi.exe
  C:\Windows\System\PJrdMwi.exe
  2⤵
  PID:2768
- C:\Windows\System\ConcgEE.exe
  C:\Windows\System\ConcgEE.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\VnnYEag.exe
  C:\Windows\System\VnnYEag.exe
  2⤵
  PID:1504
- C:\Windows\System\iqYINzL.exe
  C:\Windows\System\iqYINzL.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\LRFnKLD.exe
  C:\Windows\System\LRFnKLD.exe
  2⤵
  PID:2572
- C:\Windows\System\EjsGeeV.exe
  C:\Windows\System\EjsGeeV.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\ywtOlLp.exe
  C:\Windows\System\ywtOlLp.exe
  2⤵
  PID:1584
- C:\Windows\System\MILRPto.exe
  C:\Windows\System\MILRPto.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\PFuIPlm.exe
  C:\Windows\System\PFuIPlm.exe
  2⤵
  PID:2728
- C:\Windows\System\oZlgdBl.exe
  C:\Windows\System\oZlgdBl.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\xCOkRGX.exe
  C:\Windows\System\xCOkRGX.exe
  2⤵
  PID:1244
- C:\Windows\System\zXguIAu.exe
  C:\Windows\System\zXguIAu.exe
  2⤵
  PID:3020
- C:\Windows\System\LAYyOck.exe
  C:\Windows\System\LAYyOck.exe
  2⤵
  PID:2380
- C:\Windows\System\gOuPJtt.exe
  C:\Windows\System\gOuPJtt.exe
  2⤵
  PID:2760
- C:\Windows\System\rXtmtiw.exe
  C:\Windows\System\rXtmtiw.exe
  2⤵
  PID:2640
- C:\Windows\System\pEmJKdu.exe
  C:\Windows\System\pEmJKdu.exe
  2⤵
  PID:2776
- C:\Windows\System\jUnGmeB.exe
  C:\Windows\System\jUnGmeB.exe
  2⤵
  PID:1948
- C:\Windows\System\LYJOLJF.exe
  C:\Windows\System\LYJOLJF.exe
  2⤵
  PID:2836
- C:\Windows\System\yGjDpcB.exe
  C:\Windows\System\yGjDpcB.exe
  2⤵
  PID:1292
- C:\Windows\System\PEpQAlS.exe
  C:\Windows\System\PEpQAlS.exe
  2⤵
  PID:2356
- C:\Windows\System\UGEcxQX.exe
  C:\Windows\System\UGEcxQX.exe
  2⤵
  PID:624
- C:\Windows\System\BzRcGNA.exe
  C:\Windows\System\BzRcGNA.exe
  2⤵
  PID:3084
- C:\Windows\System\UNvJeLl.exe
  C:\Windows\System\UNvJeLl.exe
  2⤵
  PID:3100
- C:\Windows\System\ZggUZVV.exe
  C:\Windows\System\ZggUZVV.exe
  2⤵
  PID:3116
- C:\Windows\System\kQODAKg.exe
  C:\Windows\System\kQODAKg.exe
  2⤵
  PID:3132
- C:\Windows\System\jYSuOaE.exe
  C:\Windows\System\jYSuOaE.exe
  2⤵
  PID:3148
- C:\Windows\System\dtEIKcH.exe
  C:\Windows\System\dtEIKcH.exe
  2⤵
  PID:3164
- C:\Windows\System\ONQAijc.exe
  C:\Windows\System\ONQAijc.exe
  2⤵
  PID:3180
- C:\Windows\System\ASdIslb.exe
  C:\Windows\System\ASdIslb.exe
  2⤵
  PID:3196
- C:\Windows\System\fSKOPwW.exe
  C:\Windows\System\fSKOPwW.exe
  2⤵
  PID:3212
- C:\Windows\System\ikioDMS.exe
  C:\Windows\System\ikioDMS.exe
  2⤵
  PID:3228
- C:\Windows\System\DtwXtBe.exe
  C:\Windows\System\DtwXtBe.exe
  2⤵
  PID:3244
- C:\Windows\System\MoydqyS.exe
  C:\Windows\System\MoydqyS.exe
  2⤵
  PID:3260
- C:\Windows\System\ZCnkati.exe
  C:\Windows\System\ZCnkati.exe
  2⤵
  PID:3276
- C:\Windows\System\QpLMAGS.exe
  C:\Windows\System\QpLMAGS.exe
  2⤵
  PID:3292
- C:\Windows\System\ygccunD.exe
  C:\Windows\System\ygccunD.exe
  2⤵
  PID:3308
- C:\Windows\System\TkueHKF.exe
  C:\Windows\System\TkueHKF.exe
  2⤵
  PID:3324
- C:\Windows\System\gqnNzNa.exe
  C:\Windows\System\gqnNzNa.exe
  2⤵
  PID:3340
- C:\Windows\System\dJpJYLS.exe
  C:\Windows\System\dJpJYLS.exe
  2⤵
  PID:3356
- C:\Windows\System\UEBWvTV.exe
  C:\Windows\System\UEBWvTV.exe
  2⤵
  PID:3372
- C:\Windows\System\UIIKpbQ.exe
  C:\Windows\System\UIIKpbQ.exe
  2⤵
  PID:3388
- C:\Windows\System\KsMAntB.exe
  C:\Windows\System\KsMAntB.exe
  2⤵
  PID:3404
- C:\Windows\System\cLMuUuf.exe
  C:\Windows\System\cLMuUuf.exe
  2⤵
  PID:3420
- C:\Windows\System\XlfEGxf.exe
  C:\Windows\System\XlfEGxf.exe
  2⤵
  PID:3436
- C:\Windows\System\iwWXmbG.exe
  C:\Windows\System\iwWXmbG.exe
  2⤵
  PID:3452
- C:\Windows\System\dsBWPBk.exe
  C:\Windows\System\dsBWPBk.exe
  2⤵
  PID:3468
- C:\Windows\System\qUaTaFH.exe
  C:\Windows\System\qUaTaFH.exe
  2⤵
  PID:3488
- C:\Windows\System\tnrEVXP.exe
  C:\Windows\System\tnrEVXP.exe
  2⤵
  PID:3504
- C:\Windows\System\XuLgeNn.exe
  C:\Windows\System\XuLgeNn.exe
  2⤵
  PID:3520
- C:\Windows\System\TyyJuQd.exe
  C:\Windows\System\TyyJuQd.exe
  2⤵
  PID:3536
- C:\Windows\System\CalRdsL.exe
  C:\Windows\System\CalRdsL.exe
  2⤵
  PID:3552
- C:\Windows\System\OrFyUkt.exe
  C:\Windows\System\OrFyUkt.exe
  2⤵
  PID:3568
- C:\Windows\System\doptBXS.exe
  C:\Windows\System\doptBXS.exe
  2⤵
  PID:3584
- C:\Windows\System\hpIyLVj.exe
  C:\Windows\System\hpIyLVj.exe
  2⤵
  PID:3600
- C:\Windows\System\heQTyhm.exe
  C:\Windows\System\heQTyhm.exe
  2⤵
  PID:3616
- C:\Windows\System\BneAXzl.exe
  C:\Windows\System\BneAXzl.exe
  2⤵
  PID:3632
- C:\Windows\System\ozbaMXs.exe
  C:\Windows\System\ozbaMXs.exe
  2⤵
  PID:3652
- C:\Windows\System\NfcgPJc.exe
  C:\Windows\System\NfcgPJc.exe
  2⤵
  PID:3668
- C:\Windows\System\rOilEQh.exe
  C:\Windows\System\rOilEQh.exe
  2⤵
  PID:3684
- C:\Windows\System\XXJnYmc.exe
  C:\Windows\System\XXJnYmc.exe
  2⤵
  PID:3700
- C:\Windows\System\JkYSBED.exe
  C:\Windows\System\JkYSBED.exe
  2⤵
  PID:3716
- C:\Windows\System\luHcqYH.exe
  C:\Windows\System\luHcqYH.exe
  2⤵
  PID:3732
- C:\Windows\System\PPgChfb.exe
  C:\Windows\System\PPgChfb.exe
  2⤵
  PID:3748
- C:\Windows\System\vNrCvSX.exe
  C:\Windows\System\vNrCvSX.exe
  2⤵
  PID:3764
- C:\Windows\System\eYWJYoA.exe
  C:\Windows\System\eYWJYoA.exe
  2⤵
  PID:3788
- C:\Windows\System\sNtPPkt.exe
  C:\Windows\System\sNtPPkt.exe
  2⤵
  PID:3816
- C:\Windows\System\FBExduw.exe
  C:\Windows\System\FBExduw.exe
  2⤵
  PID:3840
- C:\Windows\System\kPILZkz.exe
  C:\Windows\System\kPILZkz.exe
  2⤵
  PID:3856
- C:\Windows\System\scVgOKY.exe
  C:\Windows\System\scVgOKY.exe
  2⤵
  PID:3872
- C:\Windows\System\qIIAEtK.exe
  C:\Windows\System\qIIAEtK.exe
  2⤵
  PID:3888
- C:\Windows\System\EDUCKYC.exe
  C:\Windows\System\EDUCKYC.exe
  2⤵
  PID:3904
- C:\Windows\System\CHAkgeE.exe
  C:\Windows\System\CHAkgeE.exe
  2⤵
  PID:3920
- C:\Windows\System\dyosOFk.exe
  C:\Windows\System\dyosOFk.exe
  2⤵
  PID:3936
- C:\Windows\System\EYzGoEP.exe
  C:\Windows\System\EYzGoEP.exe
  2⤵
  PID:3956
- C:\Windows\System\mvcIGcQ.exe
  C:\Windows\System\mvcIGcQ.exe
  2⤵
  PID:3976
- C:\Windows\System\MvePzzi.exe
  C:\Windows\System\MvePzzi.exe
  2⤵
  PID:3992
- C:\Windows\System\MwYQwyn.exe
  C:\Windows\System\MwYQwyn.exe
  2⤵
  PID:4008
- C:\Windows\System\VwlsOSK.exe
  C:\Windows\System\VwlsOSK.exe
  2⤵
  PID:4024
- C:\Windows\System\HyakKiI.exe
  C:\Windows\System\HyakKiI.exe
  2⤵
  PID:4040
- C:\Windows\System\AonCMzH.exe
  C:\Windows\System\AonCMzH.exe
  2⤵
  PID:4056
- C:\Windows\System\mWtOVyY.exe
  C:\Windows\System\mWtOVyY.exe
  2⤵
  PID:4072
- C:\Windows\System\mCqghvj.exe
  C:\Windows\System\mCqghvj.exe
  2⤵
  PID:4092
- C:\Windows\System\yqqbsLF.exe
  C:\Windows\System\yqqbsLF.exe
  2⤵
  PID:3016
- C:\Windows\System\eVEEAXR.exe
  C:\Windows\System\eVEEAXR.exe
  2⤵
  PID:2148
- C:\Windows\System\vASyuif.exe
  C:\Windows\System\vASyuif.exe
  2⤵
  PID:808
- C:\Windows\System\JVtIyNj.exe
  C:\Windows\System\JVtIyNj.exe
  2⤵
  PID:4108
- C:\Windows\System\XBdpbGv.exe
  C:\Windows\System\XBdpbGv.exe
  2⤵
  PID:4124
- C:\Windows\System\ZpWiJqv.exe
  C:\Windows\System\ZpWiJqv.exe
  2⤵
  PID:4140
- C:\Windows\System\pHhvhZq.exe
  C:\Windows\System\pHhvhZq.exe
  2⤵
  PID:4156
- C:\Windows\System\JNwXGZo.exe
  C:\Windows\System\JNwXGZo.exe
  2⤵
  PID:4176
- C:\Windows\System\eSwouJZ.exe
  C:\Windows\System\eSwouJZ.exe
  2⤵
  PID:4192
- C:\Windows\System\rkRJTlV.exe
  C:\Windows\System\rkRJTlV.exe
  2⤵
  PID:4208
- C:\Windows\System\rcCzGdF.exe
  C:\Windows\System\rcCzGdF.exe
  2⤵
  PID:4224
- C:\Windows\System\AiquPsC.exe
  C:\Windows\System\AiquPsC.exe
  2⤵
  PID:4240
- C:\Windows\System\LufVVXg.exe
  C:\Windows\System\LufVVXg.exe
  2⤵
  PID:4256
- C:\Windows\System\nmIXysE.exe
  C:\Windows\System\nmIXysE.exe
  2⤵
  PID:4272
- C:\Windows\System\VclPWDI.exe
  C:\Windows\System\VclPWDI.exe
  2⤵
  PID:4288
- C:\Windows\System\iIlIdMQ.exe
  C:\Windows\System\iIlIdMQ.exe
  2⤵
  PID:4340
- C:\Windows\System\cxOGChM.exe
  C:\Windows\System\cxOGChM.exe
  2⤵
  PID:4360
- C:\Windows\System\ECVscoy.exe
  C:\Windows\System\ECVscoy.exe
  2⤵
  PID:4388
- C:\Windows\System\gsqIDSr.exe
  C:\Windows\System\gsqIDSr.exe
  2⤵
  PID:4700
- C:\Windows\System\RTieRqP.exe
  C:\Windows\System\RTieRqP.exe
  2⤵
  PID:4716
- C:\Windows\System\nlMmeCn.exe
  C:\Windows\System\nlMmeCn.exe
  2⤵
  PID:4732
- C:\Windows\System\LNAnWhn.exe
  C:\Windows\System\LNAnWhn.exe
  2⤵
  PID:4748
- C:\Windows\System\SfLDybQ.exe
  C:\Windows\System\SfLDybQ.exe
  2⤵
  PID:4764
- C:\Windows\System\XNkbJFp.exe
  C:\Windows\System\XNkbJFp.exe
  2⤵
  PID:4784
- C:\Windows\System\QyRAJJR.exe
  C:\Windows\System\QyRAJJR.exe
  2⤵
  PID:4800
- C:\Windows\System\qFobEej.exe
  C:\Windows\System\qFobEej.exe
  2⤵
  PID:4816
- C:\Windows\System\gPQjjdI.exe
  C:\Windows\System\gPQjjdI.exe
  2⤵
  PID:4832
- C:\Windows\System\fQhIOtT.exe
  C:\Windows\System\fQhIOtT.exe
  2⤵
  PID:4848
- C:\Windows\System\DTGjupX.exe
  C:\Windows\System\DTGjupX.exe
  2⤵
  PID:4864
- C:\Windows\System\goDRruc.exe
  C:\Windows\System\goDRruc.exe
  2⤵
  PID:4880
- C:\Windows\System\EAsfZCG.exe
  C:\Windows\System\EAsfZCG.exe
  2⤵
  PID:4896
- C:\Windows\System\WivDYFo.exe
  C:\Windows\System\WivDYFo.exe
  2⤵
  PID:4916
- C:\Windows\System\WtpqtaR.exe
  C:\Windows\System\WtpqtaR.exe
  2⤵
  PID:4932
- C:\Windows\System\WuyjaZW.exe
  C:\Windows\System\WuyjaZW.exe
  2⤵
  PID:4948
- C:\Windows\System\QfubTor.exe
  C:\Windows\System\QfubTor.exe
  2⤵
  PID:4964
- C:\Windows\System\YMshabf.exe
  C:\Windows\System\YMshabf.exe
  2⤵
  PID:4980
- C:\Windows\System\wziaMau.exe
  C:\Windows\System\wziaMau.exe
  2⤵
  PID:4996
- C:\Windows\System\VIRUTgX.exe
  C:\Windows\System\VIRUTgX.exe
  2⤵
  PID:5012
- C:\Windows\System\hArqPNU.exe
  C:\Windows\System\hArqPNU.exe
  2⤵
  PID:5032
- C:\Windows\System\kTETWtD.exe
  C:\Windows\System\kTETWtD.exe
  2⤵
  PID:5048
- C:\Windows\System\zLqMEHc.exe
  C:\Windows\System\zLqMEHc.exe
  2⤵
  PID:5064
- C:\Windows\System\vGtLEiR.exe
  C:\Windows\System\vGtLEiR.exe
  2⤵
  PID:5080
- C:\Windows\System\xKDnbBL.exe
  C:\Windows\System\xKDnbBL.exe
  2⤵
  PID:5096
- C:\Windows\System\rAgNzfa.exe
  C:\Windows\System\rAgNzfa.exe
  2⤵
  PID:5112
- C:\Windows\System\ioEmCKl.exe
  C:\Windows\System\ioEmCKl.exe
  2⤵
  PID:2136
- C:\Windows\System\bADSYse.exe
  C:\Windows\System\bADSYse.exe
  2⤵
  PID:3096
- C:\Windows\System\NHTGUDD.exe
  C:\Windows\System\NHTGUDD.exe
  2⤵
  PID:860
- C:\Windows\System\BsMiaYA.exe
  C:\Windows\System\BsMiaYA.exe
  2⤵
  PID:3220
- C:\Windows\System\WfkoENH.exe
  C:\Windows\System\WfkoENH.exe
  2⤵
  PID:3284
- C:\Windows\System\vjizxEk.exe
  C:\Windows\System\vjizxEk.exe
  2⤵
  PID:3316
- C:\Windows\System\YNVpWZj.exe
  C:\Windows\System\YNVpWZj.exe
  2⤵
  PID:3380
- C:\Windows\System\VvzkarC.exe
  C:\Windows\System\VvzkarC.exe
  2⤵
  PID:3444
- C:\Windows\System\ZMnHlGJ.exe
  C:\Windows\System\ZMnHlGJ.exe
  2⤵
  PID:3484
- C:\Windows\System\CsxWxIa.exe
  C:\Windows\System\CsxWxIa.exe
  2⤵
  PID:3548
- C:\Windows\System\QbkywIO.exe
  C:\Windows\System\QbkywIO.exe
  2⤵
  PID:3612
- C:\Windows\System\bFcrpJO.exe
  C:\Windows\System\bFcrpJO.exe
  2⤵
  PID:3900
- C:\Windows\System\xicNytO.exe
  C:\Windows\System\xicNytO.exe
  2⤵
  PID:3972
- C:\Windows\System\mDWlNND.exe
  C:\Windows\System\mDWlNND.exe
  2⤵
  PID:4036
- C:\Windows\System\QCxzsUo.exe
  C:\Windows\System\QCxzsUo.exe
  2⤵
  PID:1700
- C:\Windows\System\gaeeLui.exe
  C:\Windows\System\gaeeLui.exe
  2⤵
  PID:4120
- C:\Windows\System\NUIxhHy.exe
  C:\Windows\System\NUIxhHy.exe
  2⤵
  PID:4188
- C:\Windows\System\TbrfLZd.exe
  C:\Windows\System\TbrfLZd.exe
  2⤵
  PID:4252
- C:\Windows\System\NwBcXts.exe
  C:\Windows\System\NwBcXts.exe
  2⤵
  PID:2692
- C:\Windows\System\rvcCXKM.exe
  C:\Windows\System\rvcCXKM.exe
  2⤵
  PID:1092
- C:\Windows\System\KHrNVUB.exe
  C:\Windows\System\KHrNVUB.exe
  2⤵
  PID:2192
- C:\Windows\System\TKWmrXI.exe
  C:\Windows\System\TKWmrXI.exe
  2⤵
  PID:4408
- C:\Windows\System\OxbwAVh.exe
  C:\Windows\System\OxbwAVh.exe
  2⤵
  PID:4424
- C:\Windows\System\yAMeEYa.exe
  C:\Windows\System\yAMeEYa.exe
  2⤵
  PID:4444
- C:\Windows\System\WcTQlmn.exe
  C:\Windows\System\WcTQlmn.exe
  2⤵
  PID:4460
- C:\Windows\System\HQrdvLk.exe
  C:\Windows\System\HQrdvLk.exe
  2⤵
  PID:4476
- C:\Windows\System\nyGAhzQ.exe
  C:\Windows\System\nyGAhzQ.exe
  2⤵
  PID:4492
- C:\Windows\System\mhphbcu.exe
  C:\Windows\System\mhphbcu.exe
  2⤵
  PID:4508
- C:\Windows\System\dUPFNCk.exe
  C:\Windows\System\dUPFNCk.exe
  2⤵
  PID:4528
- C:\Windows\System\aXLUIem.exe
  C:\Windows\System\aXLUIem.exe
  2⤵
  PID:4544
- C:\Windows\System\kNraaHc.exe
  C:\Windows\System\kNraaHc.exe
  2⤵
  PID:4560
- C:\Windows\System\CmFICGn.exe
  C:\Windows\System\CmFICGn.exe
  2⤵
  PID:4576
- C:\Windows\System\bDZXwCp.exe
  C:\Windows\System\bDZXwCp.exe
  2⤵
  PID:4592
- C:\Windows\System\uvLLMxI.exe
  C:\Windows\System\uvLLMxI.exe
  2⤵
  PID:4604
- C:\Windows\System\bPtXpQD.exe
  C:\Windows\System\bPtXpQD.exe
  2⤵
  PID:4612
- C:\Windows\System\DFwbpbY.exe
  C:\Windows\System\DFwbpbY.exe
  2⤵
  PID:4624
- C:\Windows\System\OaqxLby.exe
  C:\Windows\System\OaqxLby.exe
  2⤵
  PID:2652
- C:\Windows\System\sikdufN.exe
  C:\Windows\System\sikdufN.exe
  2⤵
  PID:2548
- C:\Windows\System\rmyYMwD.exe
  C:\Windows\System\rmyYMwD.exe
  2⤵
  PID:4644
- C:\Windows\System\muXQzkX.exe
  C:\Windows\System\muXQzkX.exe
  2⤵
  PID:4652
- C:\Windows\System\LEziqyr.exe
  C:\Windows\System\LEziqyr.exe
  2⤵
  PID:2992
- C:\Windows\System\degnSUI.exe
  C:\Windows\System\degnSUI.exe
  2⤵
  PID:2856
- C:\Windows\System\KaQdWRd.exe
  C:\Windows\System\KaQdWRd.exe
  2⤵
  PID:2516
- C:\Windows\System\UOIOIGA.exe
  C:\Windows\System\UOIOIGA.exe
  2⤵
  PID:2696
- C:\Windows\System\xcMgVHK.exe
  C:\Windows\System\xcMgVHK.exe
  2⤵
  PID:3812
- C:\Windows\System\rNvgVYk.exe
  C:\Windows\System\rNvgVYk.exe
  2⤵
  PID:3948
- C:\Windows\System\iZvgSrg.exe
  C:\Windows\System\iZvgSrg.exe
  2⤵
  PID:3988
- C:\Windows\System\ztwzFpl.exe
  C:\Windows\System\ztwzFpl.exe
  2⤵
  PID:4048
- C:\Windows\System\LYNCYqA.exe
  C:\Windows\System\LYNCYqA.exe
  2⤵
  PID:2404
- C:\Windows\System\vgYBPTU.exe
  C:\Windows\System\vgYBPTU.exe
  2⤵
  PID:4324
- C:\Windows\System\WDLIHmC.exe
  C:\Windows\System\WDLIHmC.exe
  2⤵
  PID:5088
- C:\Windows\System\PktBbee.exe
  C:\Windows\System\PktBbee.exe
  2⤵
  PID:5020
- C:\Windows\System\OgDtAaS.exe
  C:\Windows\System\OgDtAaS.exe
  2⤵
  PID:4760
- C:\Windows\System\XZYBTlH.exe
  C:\Windows\System\XZYBTlH.exe
  2⤵
  PID:4828
- C:\Windows\System\eWPYada.exe
  C:\Windows\System\eWPYada.exe
  2⤵
  PID:4892
- C:\Windows\System\bDmiAgW.exe
  C:\Windows\System\bDmiAgW.exe
  2⤵
  PID:4956
- C:\Windows\System\BAIpOQj.exe
  C:\Windows\System\BAIpOQj.exe
  2⤵
  PID:5056
- C:\Windows\System\Jfcwvxm.exe
  C:\Windows\System\Jfcwvxm.exe
  2⤵
  PID:1352
- C:\Windows\System\UWqkUOA.exe
  C:\Windows\System\UWqkUOA.exe
  2⤵
  PID:3252
- C:\Windows\System\nKompow.exe
  C:\Windows\System\nKompow.exe
  2⤵
  PID:3476
- C:\Windows\System\AVUAWNC.exe
  C:\Windows\System\AVUAWNC.exe
  2⤵
  PID:1728
- C:\Windows\System\ceDMxNT.exe
  C:\Windows\System\ceDMxNT.exe
  2⤵
  PID:3964
- C:\Windows\System\syOzVLu.exe
  C:\Windows\System\syOzVLu.exe
  2⤵
  PID:4152
- C:\Windows\System\RPsAnlQ.exe
  C:\Windows\System\RPsAnlQ.exe
  2⤵
  PID:4356
- C:\Windows\System\YNXVkux.exe
  C:\Windows\System\YNXVkux.exe
  2⤵
  PID:2016
- C:\Windows\System\GyChHej.exe
  C:\Windows\System\GyChHej.exe
  2⤵
  PID:5124
- C:\Windows\System\hvvpuZR.exe
  C:\Windows\System\hvvpuZR.exe
  2⤵
  PID:5140
- C:\Windows\System\duiJayp.exe
  C:\Windows\System\duiJayp.exe
  2⤵
  PID:5156
- C:\Windows\System\oGSAXub.exe
  C:\Windows\System\oGSAXub.exe
  2⤵
  PID:5172
- C:\Windows\System\opKdHzh.exe
  C:\Windows\System\opKdHzh.exe
  2⤵
  PID:5188
- C:\Windows\System\LkadkEo.exe
  C:\Windows\System\LkadkEo.exe
  2⤵
  PID:5204
- C:\Windows\System\ZlHRvTC.exe
  C:\Windows\System\ZlHRvTC.exe
  2⤵
  PID:5220
- C:\Windows\System\qIWrVkS.exe
  C:\Windows\System\qIWrVkS.exe
  2⤵
  PID:5236
- C:\Windows\System\uLXAgLC.exe
  C:\Windows\System\uLXAgLC.exe
  2⤵
  PID:5252
- C:\Windows\System\sVaBOKw.exe
  C:\Windows\System\sVaBOKw.exe
  2⤵
  PID:5268
- C:\Windows\System\uMikTqf.exe
  C:\Windows\System\uMikTqf.exe
  2⤵
  PID:5284
- C:\Windows\System\IdubKQX.exe
  C:\Windows\System\IdubKQX.exe
  2⤵
  PID:5300
- C:\Windows\System\JoIZNBn.exe
  C:\Windows\System\JoIZNBn.exe
  2⤵
  PID:5316
- C:\Windows\System\TjPddLz.exe
  C:\Windows\System\TjPddLz.exe
  2⤵
  PID:5344
- C:\Windows\System\AZSWHlj.exe
  C:\Windows\System\AZSWHlj.exe
  2⤵
  PID:5372
- C:\Windows\System\vxlSGwr.exe
  C:\Windows\System\vxlSGwr.exe
  2⤵
  PID:5388
- C:\Windows\System\AEIHTAZ.exe
  C:\Windows\System\AEIHTAZ.exe
  2⤵
  PID:5404
- C:\Windows\System\WEPHJOf.exe
  C:\Windows\System\WEPHJOf.exe
  2⤵
  PID:5432
- C:\Windows\System\UDVIndm.exe
  C:\Windows\System\UDVIndm.exe
  2⤵
  PID:5448
- C:\Windows\System\XAWZxcN.exe
  C:\Windows\System\XAWZxcN.exe
  2⤵
  PID:5464
- C:\Windows\System\sLyNKaT.exe
  C:\Windows\System\sLyNKaT.exe
  2⤵
  PID:5480
- C:\Windows\System\cpgVgZi.exe
  C:\Windows\System\cpgVgZi.exe
  2⤵
  PID:5500
- C:\Windows\System\wYtemKe.exe
  C:\Windows\System\wYtemKe.exe
  2⤵
  PID:5516
- C:\Windows\System\rWZroey.exe
  C:\Windows\System\rWZroey.exe
  2⤵
  PID:5532
- C:\Windows\System\wbVnKBm.exe
  C:\Windows\System\wbVnKBm.exe
  2⤵
  PID:5548
- C:\Windows\System\DyOfcvr.exe
  C:\Windows\System\DyOfcvr.exe
  2⤵
  PID:5564
- C:\Windows\System\anXFRZG.exe
  C:\Windows\System\anXFRZG.exe
  2⤵
  PID:5580
- C:\Windows\System\FKsYHhi.exe
  C:\Windows\System\FKsYHhi.exe
  2⤵
  PID:5596
- C:\Windows\System\NfUsbGj.exe
  C:\Windows\System\NfUsbGj.exe
  2⤵
  PID:5616
- C:\Windows\System\NZEEABS.exe
  C:\Windows\System\NZEEABS.exe
  2⤵
  PID:5632
- C:\Windows\System\pzesfQv.exe
  C:\Windows\System\pzesfQv.exe
  2⤵
  PID:5648
- C:\Windows\System\jKSQIqg.exe
  C:\Windows\System\jKSQIqg.exe
  2⤵
  PID:5664
- C:\Windows\System\tKjakpS.exe
  C:\Windows\System\tKjakpS.exe
  2⤵
  PID:5680
- C:\Windows\System\CUstLLi.exe
  C:\Windows\System\CUstLLi.exe
  2⤵
  PID:5696
- C:\Windows\System\fcvpmme.exe
  C:\Windows\System\fcvpmme.exe
  2⤵
  PID:5712
- C:\Windows\System\YENKQPU.exe
  C:\Windows\System\YENKQPU.exe
  2⤵
  PID:5736
- C:\Windows\System\RhhIqJZ.exe
  C:\Windows\System\RhhIqJZ.exe
  2⤵
  PID:5756
- C:\Windows\System\GrTRLRN.exe
  C:\Windows\System\GrTRLRN.exe
  2⤵
  PID:5772
- C:\Windows\System\oFzoDWj.exe
  C:\Windows\System\oFzoDWj.exe
  2⤵
  PID:5792
- C:\Windows\System\AlPdWjd.exe
  C:\Windows\System\AlPdWjd.exe
  2⤵
  PID:5808
- C:\Windows\System\qhPHTzn.exe
  C:\Windows\System\qhPHTzn.exe
  2⤵
  PID:5824
- C:\Windows\System\maTuBCR.exe
  C:\Windows\System\maTuBCR.exe
  2⤵
  PID:5840
- C:\Windows\System\YQEBNHs.exe
  C:\Windows\System\YQEBNHs.exe
  2⤵
  PID:5860
- C:\Windows\System\fMZmQkc.exe
  C:\Windows\System\fMZmQkc.exe
  2⤵
  PID:5876
- C:\Windows\System\VytPJKQ.exe
  C:\Windows\System\VytPJKQ.exe
  2⤵
  PID:5892
- C:\Windows\System\yxzcJOi.exe
  C:\Windows\System\yxzcJOi.exe
  2⤵
  PID:5908
- C:\Windows\System\ziwMuHY.exe
  C:\Windows\System\ziwMuHY.exe
  2⤵
  PID:5924
- C:\Windows\System\XIVFTXD.exe
  C:\Windows\System\XIVFTXD.exe
  2⤵
  PID:5940
- C:\Windows\System\EaRJXoq.exe
  C:\Windows\System\EaRJXoq.exe
  2⤵
  PID:5956
- C:\Windows\System\ZywywJd.exe
  C:\Windows\System\ZywywJd.exe
  2⤵
  PID:5972
- C:\Windows\System\wpaPrXR.exe
  C:\Windows\System\wpaPrXR.exe
  2⤵
  PID:5992
- C:\Windows\System\YsMGGeA.exe
  C:\Windows\System\YsMGGeA.exe
  2⤵
  PID:6124
- C:\Windows\System\KpNOTvo.exe
  C:\Windows\System\KpNOTvo.exe
  2⤵
  PID:4712
- C:\Windows\System\AWZaCXs.exe
  C:\Windows\System\AWZaCXs.exe
  2⤵
  PID:4808
- C:\Windows\System\knyxJbJ.exe
  C:\Windows\System\knyxJbJ.exe
  2⤵
  PID:976
- C:\Windows\System\CTmIKnb.exe
  C:\Windows\System\CTmIKnb.exe
  2⤵
  PID:4944
- C:\Windows\System\EwQMkcw.exe
  C:\Windows\System\EwQMkcw.exe
  2⤵
  PID:4972
- C:\Windows\System\AomodqV.exe
  C:\Windows\System\AomodqV.exe
  2⤵
  PID:4860
- C:\Windows\System\MLQhCpz.exe
  C:\Windows\System\MLQhCpz.exe
  2⤵
  PID:5164
- C:\Windows\System\SQnGwZV.exe
  C:\Windows\System\SQnGwZV.exe
  2⤵
  PID:5264
- C:\Windows\System\uKLcgSM.exe
  C:\Windows\System\uKLcgSM.exe
  2⤵
  PID:5380
- C:\Windows\System\qRhHFRr.exe
  C:\Windows\System\qRhHFRr.exe
  2⤵
  PID:5528
- C:\Windows\System\VjOMyGT.exe
  C:\Windows\System\VjOMyGT.exe
  2⤵
  PID:5592
- C:\Windows\System\pbjYjfX.exe
  C:\Windows\System\pbjYjfX.exe
  2⤵
  PID:5492
- C:\Windows\System\QiWkTSy.exe
  C:\Windows\System\QiWkTSy.exe
  2⤵
  PID:5728
- C:\Windows\System\bccSkpo.exe
  C:\Windows\System\bccSkpo.exe
  2⤵
  PID:5964
- C:\Windows\System\QrRvkgw.exe
  C:\Windows\System\QrRvkgw.exe
  2⤵
  PID:5900
- C:\Windows\System\fWdKVyr.exe
  C:\Windows\System\fWdKVyr.exe
  2⤵
  PID:5324
- C:\Windows\System\pbJhdEn.exe
  C:\Windows\System\pbJhdEn.exe
  2⤵
  PID:2464
- C:\Windows\System\lHySoEn.exe
  C:\Windows\System\lHySoEn.exe
  2⤵
  PID:5340
- C:\Windows\System\mJKkPFz.exe
  C:\Windows\System\mJKkPFz.exe
  2⤵
  PID:6004
- C:\Windows\System\FvVCmHl.exe
  C:\Windows\System\FvVCmHl.exe
  2⤵
  PID:6028
- C:\Windows\System\Vypmbfo.exe
  C:\Windows\System\Vypmbfo.exe
  2⤵
  PID:6056
- C:\Windows\System\lnWuuSb.exe
  C:\Windows\System\lnWuuSb.exe
  2⤵
  PID:6072
- C:\Windows\System\XGIJOzX.exe
  C:\Windows\System\XGIJOzX.exe
  2⤵
  PID:4068
- C:\Windows\System\NNaMQGR.exe
  C:\Windows\System\NNaMQGR.exe
  2⤵
  PID:4724
- C:\Windows\System\tdJHVjf.exe
  C:\Windows\System\tdJHVjf.exe
  2⤵
  PID:2676
- C:\Windows\System\heITXOI.exe
  C:\Windows\System\heITXOI.exe
  2⤵
  PID:6108
- C:\Windows\System\FxjYSio.exe
  C:\Windows\System\FxjYSio.exe
  2⤵
  PID:2392
- C:\Windows\System\vQDPjpt.exe
  C:\Windows\System\vQDPjpt.exe
  2⤵
  PID:2064
- C:\Windows\System\BAxjkro.exe
  C:\Windows\System\BAxjkro.exe
  2⤵
  PID:1612
- C:\Windows\System\AbXoROv.exe
  C:\Windows\System\AbXoROv.exe
  2⤵
  PID:2160
- C:\Windows\System\dNnZAdH.exe
  C:\Windows\System\dNnZAdH.exe
  2⤵
  PID:3076
- C:\Windows\System\SugSRzJ.exe
  C:\Windows\System\SugSRzJ.exe
  2⤵
  PID:3140
- C:\Windows\System\TpDeXMb.exe
  C:\Windows\System\TpDeXMb.exe
  2⤵
  PID:3204
- C:\Windows\System\OjeaIFF.exe
  C:\Windows\System\OjeaIFF.exe
  2⤵
  PID:3268
- C:\Windows\System\TJEjCyh.exe
  C:\Windows\System\TJEjCyh.exe
  2⤵
  PID:3332
- C:\Windows\System\HDnVgvC.exe
  C:\Windows\System\HDnVgvC.exe
  2⤵
  PID:3368
- C:\Windows\System\FIuYCcj.exe
  C:\Windows\System\FIuYCcj.exe
  2⤵
  PID:3460
- C:\Windows\System\Trgsqal.exe
  C:\Windows\System\Trgsqal.exe
  2⤵
  PID:3528
- C:\Windows\System\JgpSwZE.exe
  C:\Windows\System\JgpSwZE.exe
  2⤵
  PID:3592
- C:\Windows\System\aBvVFqR.exe
  C:\Windows\System\aBvVFqR.exe
  2⤵
  PID:3660
- C:\Windows\System\KgzuKIV.exe
  C:\Windows\System\KgzuKIV.exe
  2⤵
  PID:3724
- C:\Windows\System\xTBBSHl.exe
  C:\Windows\System\xTBBSHl.exe
  2⤵
  PID:3796
- C:\Windows\System\hRpJYgQ.exe
  C:\Windows\System\hRpJYgQ.exe
  2⤵
  PID:868
- C:\Windows\System\Zcsomzp.exe
  C:\Windows\System\Zcsomzp.exe
  2⤵
  PID:2076
- C:\Windows\System\iXngEfm.exe
  C:\Windows\System\iXngEfm.exe
  2⤵
  PID:4904
- C:\Windows\System\iQBIhMg.exe
  C:\Windows\System\iQBIhMg.exe
  2⤵
  PID:6092
- C:\Windows\System\BCdjQCO.exe
  C:\Windows\System\BCdjQCO.exe
  2⤵
  PID:1620
- C:\Windows\System\kaypfmi.exe
  C:\Windows\System\kaypfmi.exe
  2⤵
  PID:2080
- C:\Windows\System\HipcpxY.exe
  C:\Windows\System\HipcpxY.exe
  2⤵
  PID:4404
- C:\Windows\System\APXszMx.exe
  C:\Windows\System\APXszMx.exe
  2⤵
  PID:4440
- C:\Windows\System\gIwKGGI.exe
  C:\Windows\System\gIwKGGI.exe
  2⤵
  PID:4540
- C:\Windows\System\DeuFnAZ.exe
  C:\Windows\System\DeuFnAZ.exe
  2⤵
  PID:4572
- C:\Windows\System\KajyRPt.exe
  C:\Windows\System\KajyRPt.exe
  2⤵
  PID:2540
- C:\Windows\System\gfUTGOa.exe
  C:\Windows\System\gfUTGOa.exe
  2⤵
  PID:3880
- C:\Windows\System\HSsDGFr.exe
  C:\Windows\System\HSsDGFr.exe
  2⤵
  PID:4132
- C:\Windows\System\qUlBuDy.exe
  C:\Windows\System\qUlBuDy.exe
  2⤵
  PID:4796
- C:\Windows\System\QIoUVyl.exe
  C:\Windows\System\QIoUVyl.exe
  2⤵
  PID:5092
- C:\Windows\System\SoenayC.exe
  C:\Windows\System\SoenayC.exe
  2⤵
  PID:3932
- C:\Windows\System\VYrLnzz.exe
  C:\Windows\System\VYrLnzz.exe
  2⤵
  PID:5148
- C:\Windows\System\lqMQmhN.exe
  C:\Windows\System\lqMQmhN.exe
  2⤵
  PID:5180
- C:\Windows\System\QQyhZZB.exe
  C:\Windows\System\QQyhZZB.exe
  2⤵
  PID:4348
- C:\Windows\System\aLnmIOp.exe
  C:\Windows\System\aLnmIOp.exe
  2⤵
  PID:5248
- C:\Windows\System\DoYIJWT.exe
  C:\Windows\System\DoYIJWT.exe
  2⤵
  PID:5312
- C:\Windows\System\vsmwnfu.exe
  C:\Windows\System\vsmwnfu.exe
  2⤵
  PID:4456
- C:\Windows\System\tNkzewO.exe
  C:\Windows\System\tNkzewO.exe
  2⤵
  PID:5368
- C:\Windows\System\dSyOrOs.exe
  C:\Windows\System\dSyOrOs.exe
  2⤵
  PID:5444
- C:\Windows\System\mQsBlod.exe
  C:\Windows\System\mQsBlod.exe
  2⤵
  PID:5512
- C:\Windows\System\aNsSKOg.exe
  C:\Windows\System\aNsSKOg.exe
  2⤵
  PID:5576
- C:\Windows\System\aRUXzXj.exe
  C:\Windows\System\aRUXzXj.exe
  2⤵
  PID:5640
- C:\Windows\System\MXNVUEx.exe
  C:\Windows\System\MXNVUEx.exe
  2⤵
  PID:5704
- C:\Windows\System\RoQjoSQ.exe
  C:\Windows\System\RoQjoSQ.exe
  2⤵
  PID:5752
- C:\Windows\System\CLtWtUk.exe
  C:\Windows\System\CLtWtUk.exe
  2⤵
  PID:5816
- C:\Windows\System\lzckOxW.exe
  C:\Windows\System\lzckOxW.exe
  2⤵
  PID:5856
- C:\Windows\System\QmxTicl.exe
  C:\Windows\System\QmxTicl.exe
  2⤵
  PID:5920
- C:\Windows\System\OnbydZe.exe
  C:\Windows\System\OnbydZe.exe
  2⤵
  PID:5988
- C:\Windows\System\hMCeDYr.exe
  C:\Windows\System\hMCeDYr.exe
  2⤵
  PID:6140
- C:\Windows\System\BBCroxL.exe
  C:\Windows\System\BBCroxL.exe
  2⤵
  PID:3808
- C:\Windows\System\CJMUNIn.exe
  C:\Windows\System\CJMUNIn.exe
  2⤵
  PID:5004
- C:\Windows\System\GmQtPmB.exe
  C:\Windows\System\GmQtPmB.exe
  2⤵
  PID:3916
- C:\Windows\System\DzLOywf.exe
  C:\Windows\System\DzLOywf.exe
  2⤵
  PID:2504
- C:\Windows\System\UiVqiEw.exe
  C:\Windows\System\UiVqiEw.exe
  2⤵
  PID:952
- C:\Windows\System\zEvlINU.exe
  C:\Windows\System\zEvlINU.exe
  2⤵
  PID:2216
- C:\Windows\System\YkGBOXf.exe
  C:\Windows\System\YkGBOXf.exe
  2⤵
  PID:2752
- C:\Windows\System\wthpYqS.exe
  C:\Windows\System\wthpYqS.exe
  2⤵
  PID:5076
- C:\Windows\System\GyGvwXJ.exe
  C:\Windows\System\GyGvwXJ.exe
  2⤵
  PID:5104
- C:\Windows\System\nWsVKBJ.exe
  C:\Windows\System\nWsVKBJ.exe
  2⤵
  PID:452
- C:\Windows\System\kbaNqSN.exe
  C:\Windows\System\kbaNqSN.exe
  2⤵
  PID:3188
- C:\Windows\System\edFmWDr.exe
  C:\Windows\System\edFmWDr.exe
  2⤵
  PID:2040
- C:\Windows\System\XPLOohw.exe
  C:\Windows\System\XPLOohw.exe
  2⤵
  PID:3544
- C:\Windows\System\KkRpmub.exe
  C:\Windows\System\KkRpmub.exe
  2⤵
  PID:2832
- C:\Windows\System\DxzLUWJ.exe
  C:\Windows\System\DxzLUWJ.exe
  2⤵
  PID:2052
- C:\Windows\System\veBgtPa.exe
  C:\Windows\System\veBgtPa.exe
  2⤵
  PID:3644
- C:\Windows\System\ZmymqnZ.exe
  C:\Windows\System\ZmymqnZ.exe
  2⤵
  PID:4020
- C:\Windows\System\LkxXphv.exe
  C:\Windows\System\LkxXphv.exe
  2⤵
  PID:3740
- C:\Windows\System\ceRGGap.exe
  C:\Windows\System\ceRGGap.exe
  2⤵
  PID:864
- C:\Windows\System\lVjZwkZ.exe
  C:\Windows\System\lVjZwkZ.exe
  2⤵
  PID:3744
- C:\Windows\System\DEzloMu.exe
  C:\Windows\System\DEzloMu.exe
  2⤵
  PID:3780
- C:\Windows\System\SjLHiqt.exe
  C:\Windows\System\SjLHiqt.exe
  2⤵
  PID:3784
- C:\Windows\System\EmuWyBZ.exe
  C:\Windows\System\EmuWyBZ.exe
  2⤵
  PID:784
- C:\Windows\System\juOrpdZ.exe
  C:\Windows\System\juOrpdZ.exe
  2⤵
  PID:4136
- C:\Windows\System\AToxnzO.exe
  C:\Windows\System\AToxnzO.exe
  2⤵
  PID:2716
- C:\Windows\System\sQDmjgk.exe
  C:\Windows\System\sQDmjgk.exe
  2⤵
  PID:2800
- C:\Windows\System\gzsqBzA.exe
  C:\Windows\System\gzsqBzA.exe
  2⤵
  PID:2812
- C:\Windows\System\YNwbBiU.exe
  C:\Windows\System\YNwbBiU.exe
  2⤵
  PID:4204
- C:\Windows\System\gNIOwVr.exe
  C:\Windows\System\gNIOwVr.exe
  2⤵
  PID:4232
- C:\Windows\System\TjrbVvT.exe
  C:\Windows\System\TjrbVvT.exe
  2⤵
  PID:2732
- C:\Windows\System\jwWAsKt.exe
  C:\Windows\System\jwWAsKt.exe
  2⤵
  PID:4300
- C:\Windows\System\rNiJptV.exe
  C:\Windows\System\rNiJptV.exe
  2⤵
  PID:5136
- C:\Windows\System\fDDDJto.exe
  C:\Windows\System\fDDDJto.exe
  2⤵
  PID:4352
- C:\Windows\System\bCXZZMP.exe
  C:\Windows\System\bCXZZMP.exe
  2⤵
  PID:5456
- C:\Windows\System\rnoFnTs.exe
  C:\Windows\System\rnoFnTs.exe
  2⤵
  PID:5168
- C:\Windows\System\VFFRaUk.exe
  C:\Windows\System\VFFRaUk.exe
  2⤵
  PID:5800
- C:\Windows\System\iXOCckT.exe
  C:\Windows\System\iXOCckT.exe
  2⤵
  PID:5660
- C:\Windows\System\NtoQnPP.exe
  C:\Windows\System\NtoQnPP.exe
  2⤵
  PID:5904
- C:\Windows\System\tRsZJQN.exe
  C:\Windows\System\tRsZJQN.exe
  2⤵
  PID:4524
- C:\Windows\System\JwScKCs.exe
  C:\Windows\System\JwScKCs.exe
  2⤵
  PID:5868
- C:\Windows\System\uizhdTc.exe
  C:\Windows\System\uizhdTc.exe
  2⤵
  PID:4220
- C:\Windows\System\SkjHoQK.exe
  C:\Windows\System\SkjHoQK.exe
  2⤵
  PID:4452
- C:\Windows\System\NeghJkA.exe
  C:\Windows\System\NeghJkA.exe
  2⤵
  PID:5428
- C:\Windows\System\aMSKrJc.exe
  C:\Windows\System\aMSKrJc.exe
  2⤵
  PID:6020
- C:\Windows\System\EGqxgIR.exe
  C:\Windows\System\EGqxgIR.exe
  2⤵
  PID:6032
- C:\Windows\System\stJLozY.exe
  C:\Windows\System\stJLozY.exe
  2⤵
  PID:6048
- C:\Windows\System\DvETTKa.exe
  C:\Windows\System\DvETTKa.exe
  2⤵
  PID:6088
- C:\Windows\System\qoIOLkd.exe
  C:\Windows\System\qoIOLkd.exe
  2⤵
  PID:6100
- C:\Windows\System\EvXMArr.exe
  C:\Windows\System\EvXMArr.exe
  2⤵
  PID:2468
- C:\Windows\System\XfQnLKx.exe
  C:\Windows\System\XfQnLKx.exe
  2⤵
  PID:1688
- C:\Windows\System\KbqgrFn.exe
  C:\Windows\System\KbqgrFn.exe
  2⤵
  PID:2500
- C:\Windows\System\LVvfIkh.exe
  C:\Windows\System\LVvfIkh.exe
  2⤵
  PID:3108
- C:\Windows\System\FCRXsYH.exe
  C:\Windows\System\FCRXsYH.exe
  2⤵
  PID:2552
- C:\Windows\System\NroLJli.exe
  C:\Windows\System\NroLJli.exe
  2⤵
  PID:5280
- C:\Windows\System\JGUepIN.exe
  C:\Windows\System\JGUepIN.exe
  2⤵
  PID:5476
- C:\Windows\System\pFDYkqI.exe
  C:\Windows\System\pFDYkqI.exe
  2⤵
  PID:4320
- C:\Windows\System\rQguyCF.exe
  C:\Windows\System\rQguyCF.exe
  2⤵
  PID:5152
- C:\Windows\System\GLakvJK.exe
  C:\Windows\System\GLakvJK.exe
  2⤵
  PID:5748
- C:\Windows\System\VCsdPEg.exe
  C:\Windows\System\VCsdPEg.exe
  2⤵
  PID:2512
- C:\Windows\System\OHmrZZf.exe
  C:\Windows\System\OHmrZZf.exe
  2⤵
  PID:2780
- C:\Windows\System\CRYPPgr.exe
  C:\Windows\System\CRYPPgr.exe
  2⤵
  PID:4772
- C:\Windows\System\YycKgPu.exe
  C:\Windows\System\YycKgPu.exe
  2⤵
  PID:5440
- C:\Windows\System\wUBWCDt.exe
  C:\Windows\System\wUBWCDt.exe
  2⤵
  PID:5676
- C:\Windows\System\IwqIsyp.exe
  C:\Windows\System\IwqIsyp.exe
  2⤵
  PID:4552
- C:\Windows\System\FeOReum.exe
  C:\Windows\System\FeOReum.exe
  2⤵
  PID:2904
- C:\Windows\System\qrKsFdu.exe
  C:\Windows\System\qrKsFdu.exe
  2⤵
  PID:4584
- C:\Windows\System\UkDDKNQ.exe
  C:\Windows\System\UkDDKNQ.exe
  2⤵
  PID:2972
- C:\Windows\System\NQIfaps.exe
  C:\Windows\System\NQIfaps.exe
  2⤵
  PID:4516
- C:\Windows\System\jxwZiSl.exe
  C:\Windows\System\jxwZiSl.exe
  2⤵
  PID:2872
- C:\Windows\System\sbztdGb.exe
  C:\Windows\System\sbztdGb.exe
  2⤵
  PID:4636
- C:\Windows\System\DxJbcuU.exe
  C:\Windows\System\DxJbcuU.exe
  2⤵
  PID:3984
- C:\Windows\System\yZscjSJ.exe
  C:\Windows\System\yZscjSJ.exe
  2⤵
  PID:2808
- C:\Windows\System\LakcCQT.exe
  C:\Windows\System\LakcCQT.exe
  2⤵
  PID:4084
- C:\Windows\System\CCtZwzY.exe
  C:\Windows\System\CCtZwzY.exe
  2⤵
  PID:4992
- C:\Windows\System\nzdsXZU.exe
  C:\Windows\System\nzdsXZU.exe
  2⤵
  PID:3824
- C:\Windows\System\hiShySJ.exe
  C:\Windows\System\hiShySJ.exe
  2⤵
  PID:2788
- C:\Windows\System\GSIrbxJ.exe
  C:\Windows\System\GSIrbxJ.exe
  2⤵
  PID:1872
- C:\Windows\System\qdrCabF.exe
  C:\Windows\System\qdrCabF.exe
  2⤵
  PID:5460
- C:\Windows\System\WipVmwO.exe
  C:\Windows\System\WipVmwO.exe
  2⤵
  PID:5932
- C:\Windows\System\aPKcVmJ.exe
  C:\Windows\System\aPKcVmJ.exe
  2⤵
  PID:880
- C:\Windows\System\wbLhJnw.exe
  C:\Windows\System\wbLhJnw.exe
  2⤵
  PID:3580
- C:\Windows\System\zBdnISP.exe
  C:\Windows\System\zBdnISP.exe
  2⤵
  PID:1768
- C:\Windows\System\KWzrVji.exe
  C:\Windows\System\KWzrVji.exe
  2⤵
  PID:4164
- C:\Windows\System\qIdmSkt.exe
  C:\Windows\System\qIdmSkt.exe
  2⤵
  PID:4316
- C:\Windows\System\QEdVIHF.exe
  C:\Windows\System\QEdVIHF.exe
  2⤵
  PID:5588
- C:\Windows\System\tmJzwwA.exe
  C:\Windows\System\tmJzwwA.exe
  2⤵
  PID:1608
- C:\Windows\System\RINqRzl.exe
  C:\Windows\System\RINqRzl.exe
  2⤵
  PID:6064
- C:\Windows\System\ZHQBArO.exe
  C:\Windows\System\ZHQBArO.exe
  2⤵
  PID:6068
- C:\Windows\System\DxWWpTC.exe
  C:\Windows\System\DxWWpTC.exe
  2⤵
  PID:6104
- C:\Windows\System\vuJBIwj.exe
  C:\Windows\System\vuJBIwj.exe
  2⤵
  PID:2028
- C:\Windows\System\hxStqxL.exe
  C:\Windows\System\hxStqxL.exe
  2⤵
  PID:2568
- C:\Windows\System\vhjDxtj.exe
  C:\Windows\System\vhjDxtj.exe
  2⤵
  PID:6116
- C:\Windows\System\brjPllQ.exe
  C:\Windows\System\brjPllQ.exe
  2⤵
  PID:3560
- C:\Windows\System\mTEoiqj.exe
  C:\Windows\System\mTEoiqj.exe
  2⤵
  PID:1104
- C:\Windows\System\xPmsnDK.exe
  C:\Windows\System\xPmsnDK.exe
  2⤵
  PID:2448
- C:\Windows\System\AMzFdbK.exe
  C:\Windows\System\AMzFdbK.exe
  2⤵
  PID:3304
- C:\Windows\System\PuXxMQZ.exe
  C:\Windows\System\PuXxMQZ.exe
  2⤵
  PID:2480
- C:\Windows\System\uAwUNvi.exe
  C:\Windows\System\uAwUNvi.exe
  2⤵
  PID:4384
- C:\Windows\System\hOzSAgp.exe
  C:\Windows\System\hOzSAgp.exe
  2⤵
  PID:4824
- C:\Windows\System\XcqXTBW.exe
  C:\Windows\System\XcqXTBW.exe
  2⤵
  PID:4500
- C:\Windows\System\XYOeNuH.exe
  C:\Windows\System\XYOeNuH.exe
  2⤵
  PID:5364
- C:\Windows\System\xGpvNfk.exe
  C:\Windows\System\xGpvNfk.exe
  2⤵
  PID:5612
- C:\Windows\System\TiOSPph.exe
  C:\Windows\System\TiOSPph.exe
  2⤵
  PID:5788
- C:\Windows\System\eVBuygw.exe
  C:\Windows\System\eVBuygw.exe
  2⤵
  PID:5916
- C:\Windows\System\QlXMxwN.exe
  C:\Windows\System\QlXMxwN.exe
  2⤵
  PID:2876
- C:\Windows\System\emVscNr.exe
  C:\Windows\System\emVscNr.exe
  2⤵
  PID:5984
- C:\Windows\System\WtQzpvT.exe
  C:\Windows\System\WtQzpvT.exe
  2⤵
  PID:936
- C:\Windows\System\IeaYUyy.exe
  C:\Windows\System\IeaYUyy.exe
  2⤵
  PID:600
- C:\Windows\System\xJlVBeq.exe
  C:\Windows\System\xJlVBeq.exe
  2⤵
  PID:3868
- C:\Windows\System\WNthqQt.exe
  C:\Windows\System\WNthqQt.exe
  2⤵
  PID:5720
- C:\Windows\System\nyOxqoN.exe
  C:\Windows\System\nyOxqoN.exe
  2⤵
  PID:5656
- C:\Windows\System\bEgICLb.exe
  C:\Windows\System\bEgICLb.exe
  2⤵
  PID:1132
- C:\Windows\System\zKArnSj.exe
  C:\Windows\System\zKArnSj.exe
  2⤵
  PID:3912
- C:\Windows\System\WVEqGpp.exe
  C:\Windows\System\WVEqGpp.exe
  2⤵
  PID:832
- C:\Windows\System\ovQpfwY.exe
  C:\Windows\System\ovQpfwY.exe
  2⤵
  PID:1316
- C:\Windows\System\VbpVXvf.exe
  C:\Windows\System\VbpVXvf.exe
  2⤵
  PID:2712
- C:\Windows\System\DIAouep.exe
  C:\Windows\System\DIAouep.exe
  2⤵
  PID:4756
- C:\Windows\System\wUyDwFy.exe
  C:\Windows\System\wUyDwFy.exe
  2⤵
  PID:4116
- C:\Windows\System\JwPOvjp.exe
  C:\Windows\System\JwPOvjp.exe
  2⤵
  PID:6000
- C:\Windows\System\LoeFzjq.exe
  C:\Windows\System\LoeFzjq.exe
  2⤵
  PID:4640
- C:\Windows\System\EBMVjGp.exe
  C:\Windows\System\EBMVjGp.exe
  2⤵
  PID:3772
- C:\Windows\System\GnRZdFL.exe
  C:\Windows\System\GnRZdFL.exe
  2⤵
  PID:5416
- C:\Windows\System\QAUrvCp.exe
  C:\Windows\System\QAUrvCp.exe
  2⤵
  PID:4032
- C:\Windows\System\svIKACW.exe
  C:\Windows\System\svIKACW.exe
  2⤵
  PID:4332
- C:\Windows\System\bXzfQAt.exe
  C:\Windows\System\bXzfQAt.exe
  2⤵
  PID:2704
- C:\Windows\System\wFolvkt.exe
  C:\Windows\System\wFolvkt.exe
  2⤵
  PID:5744
- C:\Windows\System\PxFTDPc.exe
  C:\Windows\System\PxFTDPc.exe
  2⤵
  PID:1692
- C:\Windows\System\yvKeKoe.exe
  C:\Windows\System\yvKeKoe.exe
  2⤵
  PID:5980
- C:\Windows\System\FqXLRrE.exe
  C:\Windows\System\FqXLRrE.exe
  2⤵
  PID:5132
- C:\Windows\System\bOShcyN.exe
  C:\Windows\System\bOShcyN.exe
  2⤵
  PID:3692
- C:\Windows\System\hcSMTVG.exe
  C:\Windows\System\hcSMTVG.exe
  2⤵
  PID:2204
- C:\Windows\System\weGiZNk.exe
  C:\Windows\System\weGiZNk.exe
  2⤵
  PID:4312
- C:\Windows\System\klQNZfr.exe
  C:\Windows\System\klQNZfr.exe
  2⤵
  PID:5888
- C:\Windows\System\HGQgMUp.exe
  C:\Windows\System\HGQgMUp.exe
  2⤵
  PID:2024
- C:\Windows\System\UGuKVpx.exe
  C:\Windows\System\UGuKVpx.exe
  2⤵
  PID:3172
- C:\Windows\System\jHEXDzD.exe
  C:\Windows\System\jHEXDzD.exe
  2⤵
  PID:6156
- C:\Windows\System\IQywJZf.exe
  C:\Windows\System\IQywJZf.exe
  2⤵
  PID:6172
- C:\Windows\System\fKbnCDL.exe
  C:\Windows\System\fKbnCDL.exe
  2⤵
  PID:6188
- C:\Windows\System\iRnwZoq.exe
  C:\Windows\System\iRnwZoq.exe
  2⤵
  PID:6204
- C:\Windows\System\djcaSgL.exe
  C:\Windows\System\djcaSgL.exe
  2⤵
  PID:6220
- C:\Windows\System\pxiFYjd.exe
  C:\Windows\System\pxiFYjd.exe
  2⤵
  PID:6236
- C:\Windows\System\FAwWAUU.exe
  C:\Windows\System\FAwWAUU.exe
  2⤵
  PID:6252
- C:\Windows\System\CgJXWaH.exe
  C:\Windows\System\CgJXWaH.exe
  2⤵
  PID:6268
- C:\Windows\System\oCEPeSK.exe
  C:\Windows\System\oCEPeSK.exe
  2⤵
  PID:6284
- C:\Windows\System\TbFYuYN.exe
  C:\Windows\System\TbFYuYN.exe
  2⤵
  PID:6300
- C:\Windows\System\cCQZxqv.exe
  C:\Windows\System\cCQZxqv.exe
  2⤵
  PID:6316
- C:\Windows\System\oYhPJBp.exe
  C:\Windows\System\oYhPJBp.exe
  2⤵
  PID:6332
- C:\Windows\System\EIIsfGy.exe
  C:\Windows\System\EIIsfGy.exe
  2⤵
  PID:6348
- C:\Windows\System\WoqDrNF.exe
  C:\Windows\System\WoqDrNF.exe
  2⤵
  PID:6364
- C:\Windows\System\YMzfIWV.exe
  C:\Windows\System\YMzfIWV.exe
  2⤵
  PID:6380
- C:\Windows\System\wyCZDTh.exe
  C:\Windows\System\wyCZDTh.exe
  2⤵
  PID:6396
- C:\Windows\System\zjfObex.exe
  C:\Windows\System\zjfObex.exe
  2⤵
  PID:6412
- C:\Windows\System\lWwqMgW.exe
  C:\Windows\System\lWwqMgW.exe
  2⤵
  PID:6428
- C:\Windows\System\bFdrXTK.exe
  C:\Windows\System\bFdrXTK.exe
  2⤵
  PID:6444
- C:\Windows\System\aCAhlcv.exe
  C:\Windows\System\aCAhlcv.exe
  2⤵
  PID:6460
- C:\Windows\System\PFkBjjK.exe
  C:\Windows\System\PFkBjjK.exe
  2⤵
  PID:6476
- C:\Windows\System\HZgexHO.exe
  C:\Windows\System\HZgexHO.exe
  2⤵
  PID:6492
- C:\Windows\System\XpqUwDJ.exe
  C:\Windows\System\XpqUwDJ.exe
  2⤵
  PID:6508
- C:\Windows\System\FSvaNPn.exe
  C:\Windows\System\FSvaNPn.exe
  2⤵
  PID:6524
- C:\Windows\System\oKZUWNB.exe
  C:\Windows\System\oKZUWNB.exe
  2⤵
  PID:6540
- C:\Windows\System\qzIOMzn.exe
  C:\Windows\System\qzIOMzn.exe
  2⤵
  PID:6556
- C:\Windows\System\tnjwntF.exe
  C:\Windows\System\tnjwntF.exe
  2⤵
  PID:6572
- C:\Windows\System\tMePFSn.exe
  C:\Windows\System\tMePFSn.exe
  2⤵
  PID:6588
- C:\Windows\System\isCHMkN.exe
  C:\Windows\System\isCHMkN.exe
  2⤵
  PID:6604
- C:\Windows\System\oLcjeqa.exe
  C:\Windows\System\oLcjeqa.exe
  2⤵
  PID:6620
- C:\Windows\System\tOeasfq.exe
  C:\Windows\System\tOeasfq.exe
  2⤵
  PID:6636
- C:\Windows\System\eHWEglm.exe
  C:\Windows\System\eHWEglm.exe
  2⤵
  PID:6652
- C:\Windows\System\TBlZnbO.exe
  C:\Windows\System\TBlZnbO.exe
  2⤵
  PID:6668
- C:\Windows\System\yrTifmR.exe
  C:\Windows\System\yrTifmR.exe
  2⤵
  PID:6684
- C:\Windows\System\TlUjPJU.exe
  C:\Windows\System\TlUjPJU.exe
  2⤵
  PID:6700
- C:\Windows\System\TKFwKLk.exe
  C:\Windows\System\TKFwKLk.exe
  2⤵
  PID:6716
- C:\Windows\System\WPckrBo.exe
  C:\Windows\System\WPckrBo.exe
  2⤵
  PID:6732
- C:\Windows\System\jpvayVb.exe
  C:\Windows\System\jpvayVb.exe
  2⤵
  PID:6748
- C:\Windows\System\bghwaFf.exe
  C:\Windows\System\bghwaFf.exe
  2⤵
  PID:6764
- C:\Windows\System\AmXQoZA.exe
  C:\Windows\System\AmXQoZA.exe
  2⤵
  PID:6780
- C:\Windows\System\LuYNdvn.exe
  C:\Windows\System\LuYNdvn.exe
  2⤵
  PID:6796
- C:\Windows\System\MfRpIux.exe
  C:\Windows\System\MfRpIux.exe
  2⤵
  PID:6812
- C:\Windows\System\ODSjnyx.exe
  C:\Windows\System\ODSjnyx.exe
  2⤵
  PID:6828
- C:\Windows\System\VveFYsQ.exe
  C:\Windows\System\VveFYsQ.exe
  2⤵
  PID:6844
- C:\Windows\System\bpqYSBJ.exe
  C:\Windows\System\bpqYSBJ.exe
  2⤵
  PID:6860
- C:\Windows\System\qPKCWza.exe
  C:\Windows\System\qPKCWza.exe
  2⤵
  PID:6876
- C:\Windows\System\Wnkrouw.exe
  C:\Windows\System\Wnkrouw.exe
  2⤵
  PID:6892
- C:\Windows\System\WWbLFBd.exe
  C:\Windows\System\WWbLFBd.exe
  2⤵
  PID:6908
- C:\Windows\System\VmsfDgq.exe
  C:\Windows\System\VmsfDgq.exe
  2⤵
  PID:6924
- C:\Windows\System\blAHFvf.exe
  C:\Windows\System\blAHFvf.exe
  2⤵
  PID:6940
- C:\Windows\System\ufuDurE.exe
  C:\Windows\System\ufuDurE.exe
  2⤵
  PID:6956
- C:\Windows\System\OQBowpV.exe
  C:\Windows\System\OQBowpV.exe
  2⤵
  PID:6972
- C:\Windows\System\fkwqWER.exe
  C:\Windows\System\fkwqWER.exe
  2⤵
  PID:6988
- C:\Windows\System\GdTAwMb.exe
  C:\Windows\System\GdTAwMb.exe
  2⤵
  PID:7004
- C:\Windows\System\ayrLPoq.exe
  C:\Windows\System\ayrLPoq.exe
  2⤵
  PID:7020
- C:\Windows\System\LnwajmT.exe
  C:\Windows\System\LnwajmT.exe
  2⤵
  PID:7036
- C:\Windows\System\sUKneLw.exe
  C:\Windows\System\sUKneLw.exe
  2⤵
  PID:7052
- C:\Windows\System\Pxrwlwr.exe
  C:\Windows\System\Pxrwlwr.exe
  2⤵
  PID:7068
- C:\Windows\System\pxYhigg.exe
  C:\Windows\System\pxYhigg.exe
  2⤵
  PID:7084
- C:\Windows\System\FIBtdtJ.exe
  C:\Windows\System\FIBtdtJ.exe
  2⤵
  PID:7100
- C:\Windows\System\TQCqEQg.exe
  C:\Windows\System\TQCqEQg.exe
  2⤵
  PID:7116
- C:\Windows\System\aNbTXvd.exe
  C:\Windows\System\aNbTXvd.exe
  2⤵
  PID:7132
- C:\Windows\System\uOdWjLd.exe
  C:\Windows\System\uOdWjLd.exe
  2⤵
  PID:7148
- C:\Windows\System\pQZEWqe.exe
  C:\Windows\System\pQZEWqe.exe
  2⤵
  PID:7164
- C:\Windows\System\TAUZYAi.exe
  C:\Windows\System\TAUZYAi.exe
  2⤵
  PID:6044
- C:\Windows\System\zhEwZva.exe
  C:\Windows\System\zhEwZva.exe
  2⤵
  PID:4016
- C:\Windows\System\IXofzyG.exe
  C:\Windows\System\IXofzyG.exe
  2⤵
  PID:4688
- C:\Windows\System\MlRHFgW.exe
  C:\Windows\System\MlRHFgW.exe
  2⤵
  PID:2600
- C:\Windows\System\mKJZFYp.exe
  C:\Windows\System\mKJZFYp.exe
  2⤵
  PID:620
- C:\Windows\System\qRbBcYK.exe
  C:\Windows\System\qRbBcYK.exe
  2⤵
  PID:6184
- C:\Windows\System\sKKbqey.exe
  C:\Windows\System\sKKbqey.exe
  2⤵
  PID:3564
- C:\Windows\System\QmLsqpc.exe
  C:\Windows\System\QmLsqpc.exe
  2⤵
  PID:3944
- C:\Windows\System\WUCGzex.exe
  C:\Windows\System\WUCGzex.exe
  2⤵
  PID:2660
- C:\Windows\System\ExaKfWU.exe
  C:\Windows\System\ExaKfWU.exe
  2⤵
  PID:6228
- C:\Windows\System\DZxkjof.exe
  C:\Windows\System\DZxkjof.exe
  2⤵
  PID:6212
- C:\Windows\System\gsbmDni.exe
  C:\Windows\System\gsbmDni.exe
  2⤵
  PID:6276
- C:\Windows\System\blCULTK.exe
  C:\Windows\System\blCULTK.exe
  2⤵
  PID:6340
- C:\Windows\System\tJIGNtF.exe
  C:\Windows\System\tJIGNtF.exe
  2⤵
  PID:6292
- C:\Windows\System\BRFeBUZ.exe
  C:\Windows\System\BRFeBUZ.exe
  2⤵
  PID:6360
- C:\Windows\System\khyAVel.exe
  C:\Windows\System\khyAVel.exe
  2⤵
  PID:6436
- C:\Windows\System\keabkNG.exe
  C:\Windows\System\keabkNG.exe
  2⤵
  PID:6420
- C:\Windows\System\OWmChdj.exe
  C:\Windows\System\OWmChdj.exe
  2⤵
  PID:6468
- C:\Windows\System\nAYKWNB.exe
  C:\Windows\System\nAYKWNB.exe
  2⤵
  PID:2624
- C:\Windows\System\lxPEpbO.exe
  C:\Windows\System\lxPEpbO.exe
  2⤵
  PID:6488
- C:\Windows\System\IfcQBHu.exe
  C:\Windows\System\IfcQBHu.exe
  2⤵
  PID:6504
- C:\Windows\System\wsTysUs.exe
  C:\Windows\System\wsTysUs.exe
  2⤵
  PID:6516
- C:\Windows\System\TpYduEZ.exe
  C:\Windows\System\TpYduEZ.exe
  2⤵
  PID:6600
- C:\Windows\System\RPvWDKJ.exe
  C:\Windows\System\RPvWDKJ.exe
  2⤵
  PID:6632
- C:\Windows\System\TuIbodH.exe
  C:\Windows\System\TuIbodH.exe
  2⤵
  PID:6628
- C:\Windows\System\cDEUBnU.exe
  C:\Windows\System\cDEUBnU.exe
  2⤵
  PID:6724
- C:\Windows\System\eaBGpFh.exe
  C:\Windows\System\eaBGpFh.exe
  2⤵
  PID:6756
- C:\Windows\System\csuscVU.exe
  C:\Windows\System\csuscVU.exe
  2⤵
  PID:6712
- C:\Windows\System\bNjAMtz.exe
  C:\Windows\System\bNjAMtz.exe
  2⤵
  PID:6808
- C:\Windows\System\jxPWSZu.exe
  C:\Windows\System\jxPWSZu.exe
  2⤵
  PID:6872
- C:\Windows\System\fgXwZQv.exe
  C:\Windows\System\fgXwZQv.exe
  2⤵
  PID:6936
- C:\Windows\System\KhUlogn.exe
  C:\Windows\System\KhUlogn.exe
  2⤵
  PID:6820
- C:\Windows\System\bMNOkfP.exe
  C:\Windows\System\bMNOkfP.exe
  2⤵
  PID:6884
- C:\Windows\System\DfXktIr.exe
  C:\Windows\System\DfXktIr.exe
  2⤵
  PID:6948
- C:\Windows\System\JsqLqDF.exe
  C:\Windows\System\JsqLqDF.exe
  2⤵
  PID:6980
- C:\Windows\System\umVZQTr.exe
  C:\Windows\System\umVZQTr.exe
  2⤵
  PID:7064
- C:\Windows\System\WKIaCGf.exe
  C:\Windows\System\WKIaCGf.exe
  2⤵
  PID:7128
- C:\Windows\System\HNnZyQs.exe
  C:\Windows\System\HNnZyQs.exe
  2⤵
  PID:5572
- C:\Windows\System\nVEmzrA.exe
  C:\Windows\System\nVEmzrA.exe
  2⤵
  PID:6180
- C:\Windows\System\OzfRdwz.exe
  C:\Windows\System\OzfRdwz.exe
  2⤵
  PID:6152
- C:\Windows\System\dHEmZbd.exe
  C:\Windows\System\dHEmZbd.exe
  2⤵
  PID:6344
- C:\Windows\System\VrPjvid.exe
  C:\Windows\System\VrPjvid.exe
  2⤵
  PID:6456
- C:\Windows\System\fVVtIZJ.exe
  C:\Windows\System\fVVtIZJ.exe
  2⤵
  PID:6536
- C:\Windows\System\FlFkudP.exe
  C:\Windows\System\FlFkudP.exe
  2⤵
  PID:7012
- C:\Windows\System\TERkDpM.exe
  C:\Windows\System\TERkDpM.exe
  2⤵
  PID:6740
- C:\Windows\System\VWRPyfo.exe
  C:\Windows\System\VWRPyfo.exe
  2⤵
  PID:6308
- C:\Windows\System\PluCezo.exe
  C:\Windows\System\PluCezo.exe
  2⤵
  PID:7076
- C:\Windows\System\FaqpeFp.exe
  C:\Windows\System\FaqpeFp.exe
  2⤵
  PID:7144
- C:\Windows\System\xSnjtqY.exe
  C:\Windows\System\xSnjtqY.exe
  2⤵
  PID:3776
- C:\Windows\System\iMEpIcg.exe
  C:\Windows\System\iMEpIcg.exe
  2⤵
  PID:2748
- C:\Windows\System\nVtDvIt.exe
  C:\Windows\System\nVtDvIt.exe
  2⤵
  PID:7044
- C:\Windows\System\rGmdSJu.exe
  C:\Windows\System\rGmdSJu.exe
  2⤵
  PID:5672
- C:\Windows\System\LujMguM.exe
  C:\Windows\System\LujMguM.exe
  2⤵
  PID:2184
- C:\Windows\System\xFFjSyp.exe
  C:\Windows\System\xFFjSyp.exe
  2⤵
  PID:6328
- C:\Windows\System\UenddGq.exe
  C:\Windows\System\UenddGq.exe
  2⤵
  PID:6596
- C:\Windows\System\QGQiiwj.exe
  C:\Windows\System\QGQiiwj.exe
  2⤵
  PID:6932
- C:\Windows\System\IcaEnjl.exe
  C:\Windows\System\IcaEnjl.exe
  2⤵
  PID:6916
- C:\Windows\System\JWbBKnh.exe
  C:\Windows\System\JWbBKnh.exe
  2⤵
  PID:7060
- C:\Windows\System\AcIpgeP.exe
  C:\Windows\System\AcIpgeP.exe
  2⤵
  PID:4940
- C:\Windows\System\zFApdiz.exe
  C:\Windows\System\zFApdiz.exe
  2⤵
  PID:6648
- C:\Windows\System\ALBMpZB.exe
  C:\Windows\System\ALBMpZB.exe
  2⤵
  PID:7108
- C:\Windows\System\tvwrFZS.exe
  C:\Windows\System\tvwrFZS.exe
  2⤵
  PID:7140
- C:\Windows\System\gWCxsSG.exe
  C:\Windows\System\gWCxsSG.exe
  2⤵
  PID:6612
- C:\Windows\System\AiCDtif.exe
  C:\Windows\System\AiCDtif.exe
  2⤵
  PID:6904
- C:\Windows\System\OQsaTKY.exe
  C:\Windows\System\OQsaTKY.exe
  2⤵
  PID:6484
- C:\Windows\System\xgXEXlL.exe
  C:\Windows\System\xgXEXlL.exe
  2⤵
  PID:7176
- C:\Windows\System\PtTkbXV.exe
  C:\Windows\System\PtTkbXV.exe
  2⤵
  PID:7192
- C:\Windows\System\ZxoCNBd.exe
  C:\Windows\System\ZxoCNBd.exe
  2⤵
  PID:7208
- C:\Windows\System\wAAiUTU.exe
  C:\Windows\System\wAAiUTU.exe
  2⤵
  PID:7224
- C:\Windows\System\ktCfEUw.exe
  C:\Windows\System\ktCfEUw.exe
  2⤵
  PID:7240
- C:\Windows\System\anobupm.exe
  C:\Windows\System\anobupm.exe
  2⤵
  PID:7256
- C:\Windows\System\mYHpgwV.exe
  C:\Windows\System\mYHpgwV.exe
  2⤵
  PID:7272
- C:\Windows\System\OgJpmTS.exe
  C:\Windows\System\OgJpmTS.exe
  2⤵
  PID:7288
- C:\Windows\System\liowCNN.exe
  C:\Windows\System\liowCNN.exe
  2⤵
  PID:7304
- C:\Windows\System\mgHGjVg.exe
  C:\Windows\System\mgHGjVg.exe
  2⤵
  PID:7320
- C:\Windows\System\sEWyleR.exe
  C:\Windows\System\sEWyleR.exe
  2⤵
  PID:7336
- C:\Windows\System\TyChyXr.exe
  C:\Windows\System\TyChyXr.exe
  2⤵
  PID:7352
- C:\Windows\System\mqlHWsh.exe
  C:\Windows\System\mqlHWsh.exe
  2⤵
  PID:7368
- C:\Windows\System\CAnOvoG.exe
  C:\Windows\System\CAnOvoG.exe
  2⤵
  PID:7384
- C:\Windows\System\FYkiFLF.exe
  C:\Windows\System\FYkiFLF.exe
  2⤵
  PID:7400
- C:\Windows\System\okZoepx.exe
  C:\Windows\System\okZoepx.exe
  2⤵
  PID:7416
- C:\Windows\System\iYdmjyi.exe
  C:\Windows\System\iYdmjyi.exe
  2⤵
  PID:7432
- C:\Windows\System\ZDQGsVE.exe
  C:\Windows\System\ZDQGsVE.exe
  2⤵
  PID:7448
- C:\Windows\System\crtKpzC.exe
  C:\Windows\System\crtKpzC.exe
  2⤵
  PID:7464
- C:\Windows\System\nlRFWRh.exe
  C:\Windows\System\nlRFWRh.exe
  2⤵
  PID:7480
- C:\Windows\System\CghEWbK.exe
  C:\Windows\System\CghEWbK.exe
  2⤵
  PID:7496
- C:\Windows\System\SdmgWiY.exe
  C:\Windows\System\SdmgWiY.exe
  2⤵
  PID:7512
- C:\Windows\System\bExrDDe.exe
  C:\Windows\System\bExrDDe.exe
  2⤵
  PID:7528
- C:\Windows\System\BBSSvdP.exe
  C:\Windows\System\BBSSvdP.exe
  2⤵
  PID:7544
- C:\Windows\System\SuNovDT.exe
  C:\Windows\System\SuNovDT.exe
  2⤵
  PID:7560
- C:\Windows\System\cesymPY.exe
  C:\Windows\System\cesymPY.exe
  2⤵
  PID:7576
- C:\Windows\System\HzFgwwD.exe
  C:\Windows\System\HzFgwwD.exe
  2⤵
  PID:7592
- C:\Windows\System\QePvHJy.exe
  C:\Windows\System\QePvHJy.exe
  2⤵
  PID:7608
- C:\Windows\System\KtxCxSG.exe
  C:\Windows\System\KtxCxSG.exe
  2⤵
  PID:7624
- C:\Windows\System\pJYHipi.exe
  C:\Windows\System\pJYHipi.exe
  2⤵
  PID:7644
- C:\Windows\System\bEcOXdx.exe
  C:\Windows\System\bEcOXdx.exe
  2⤵
  PID:7660
- C:\Windows\System\JtJsYzO.exe
  C:\Windows\System\JtJsYzO.exe
  2⤵
  PID:7676
- C:\Windows\System\rmfNhjr.exe
  C:\Windows\System\rmfNhjr.exe
  2⤵
  PID:7692
- C:\Windows\System\EwuFPYa.exe
  C:\Windows\System\EwuFPYa.exe
  2⤵
  PID:7708
- C:\Windows\System\tVGdTZc.exe
  C:\Windows\System\tVGdTZc.exe
  2⤵
  PID:7724
- C:\Windows\System\eBaVLXd.exe
  C:\Windows\System\eBaVLXd.exe
  2⤵
  PID:7740
- C:\Windows\System\jOFqNBp.exe
  C:\Windows\System\jOFqNBp.exe
  2⤵
  PID:7756
- C:\Windows\System\fdUkief.exe
  C:\Windows\System\fdUkief.exe
  2⤵
  PID:7772
- C:\Windows\System\xskIlZr.exe
  C:\Windows\System\xskIlZr.exe
  2⤵
  PID:7788
- C:\Windows\System\fTMPHgR.exe
  C:\Windows\System\fTMPHgR.exe
  2⤵
  PID:7804
- C:\Windows\System\BBYlqjs.exe
  C:\Windows\System\BBYlqjs.exe
  2⤵
  PID:7820
- C:\Windows\System\xAHNnwy.exe
  C:\Windows\System\xAHNnwy.exe
  2⤵
  PID:7836
- C:\Windows\System\sCXjlmj.exe
  C:\Windows\System\sCXjlmj.exe
  2⤵
  PID:7852
- C:\Windows\System\nTiGEkD.exe
  C:\Windows\System\nTiGEkD.exe
  2⤵
  PID:7868
- C:\Windows\System\mFrxBRa.exe
  C:\Windows\System\mFrxBRa.exe
  2⤵
  PID:7884
- C:\Windows\System\TywRkoK.exe
  C:\Windows\System\TywRkoK.exe
  2⤵
  PID:7900
- C:\Windows\System\wljNCEl.exe
  C:\Windows\System\wljNCEl.exe
  2⤵
  PID:7916
- C:\Windows\System\NpaUPkh.exe
  C:\Windows\System\NpaUPkh.exe
  2⤵
  PID:7932
- C:\Windows\System\rZsCYPW.exe
  C:\Windows\System\rZsCYPW.exe
  2⤵
  PID:7948
- C:\Windows\System\OXHMObK.exe
  C:\Windows\System\OXHMObK.exe
  2⤵
  PID:7968
- C:\Windows\System\EgWVKRi.exe
  C:\Windows\System\EgWVKRi.exe
  2⤵
  PID:7984
- C:\Windows\System\QQnoQSU.exe
  C:\Windows\System\QQnoQSU.exe
  2⤵
  PID:8000
- C:\Windows\System\uxOkkzP.exe
  C:\Windows\System\uxOkkzP.exe
  2⤵
  PID:8016
- C:\Windows\System\Vxnjfsz.exe
  C:\Windows\System\Vxnjfsz.exe
  2⤵
  PID:8036
- C:\Windows\System\HNPQgRe.exe
  C:\Windows\System\HNPQgRe.exe
  2⤵
  PID:8052
- C:\Windows\System\YOSBMXY.exe
  C:\Windows\System\YOSBMXY.exe
  2⤵
  PID:8068
- C:\Windows\System\yCYSNxt.exe
  C:\Windows\System\yCYSNxt.exe
  2⤵
  PID:8088
- C:\Windows\System\QZvQQuD.exe
  C:\Windows\System\QZvQQuD.exe
  2⤵
  PID:8104
- C:\Windows\System\WKkFpMr.exe
  C:\Windows\System\WKkFpMr.exe
  2⤵
  PID:8120
- C:\Windows\System\ebtAOYq.exe
  C:\Windows\System\ebtAOYq.exe
  2⤵
  PID:8136
- C:\Windows\System\ioDchGQ.exe
  C:\Windows\System\ioDchGQ.exe
  2⤵
  PID:8152
- C:\Windows\System\lwfaqeu.exe
  C:\Windows\System\lwfaqeu.exe
  2⤵
  PID:8168
- C:\Windows\System\ouinsYA.exe
  C:\Windows\System\ouinsYA.exe
  2⤵
  PID:8184
- C:\Windows\System\gvITTto.exe
  C:\Windows\System\gvITTto.exe
  2⤵
  PID:7032
- C:\Windows\System\fSxUVdG.exe
  C:\Windows\System\fSxUVdG.exe
  2⤵
  PID:7096
- C:\Windows\System\eDwvyjY.exe
  C:\Windows\System\eDwvyjY.exe
  2⤵
  PID:908
- C:\Windows\System\pnrEzON.exe
  C:\Windows\System\pnrEzON.exe
  2⤵
  PID:7268
- C:\Windows\System\QclQJFu.exe
  C:\Windows\System\QclQJFu.exe
  2⤵
  PID:6248
- C:\Windows\System\jKXODvB.exe
  C:\Windows\System\jKXODvB.exe
  2⤵
  PID:6424
- C:\Windows\System\SWCmrYk.exe
  C:\Windows\System\SWCmrYk.exe
  2⤵
  PID:6260
- C:\Windows\System\OUlduJj.exe
  C:\Windows\System\OUlduJj.exe
  2⤵
  PID:6804
- C:\Windows\System\ZrDcKce.exe
  C:\Windows\System\ZrDcKce.exe
  2⤵
  PID:6548
- C:\Windows\System\QWVCaId.exe
  C:\Windows\System\QWVCaId.exe
  2⤵
  PID:7280
- C:\Windows\System\ffMkqNo.exe
  C:\Windows\System\ffMkqNo.exe
  2⤵
  PID:6568
- C:\Windows\System\bKcpZSH.exe
  C:\Windows\System\bKcpZSH.exe
  2⤵
  PID:7184
- C:\Windows\System\cgZstdM.exe
  C:\Windows\System\cgZstdM.exe
  2⤵
  PID:7312
- C:\Windows\System\DMjOuat.exe
  C:\Windows\System\DMjOuat.exe
  2⤵
  PID:7344
- C:\Windows\System\yuNAaMd.exe
  C:\Windows\System\yuNAaMd.exe
  2⤵
  PID:7412
- C:\Windows\System\jtfxMPx.exe
  C:\Windows\System\jtfxMPx.exe
  2⤵
  PID:7408
- C:\Windows\System\bgUQViy.exe
  C:\Windows\System\bgUQViy.exe
  2⤵
  PID:7460
- C:\Windows\System\FcfhZVD.exe
  C:\Windows\System\FcfhZVD.exe
  2⤵
  PID:7520
- C:\Windows\System\QAugNgP.exe
  C:\Windows\System\QAugNgP.exe
  2⤵
  PID:7508
- C:\Windows\System\KYworPx.exe
  C:\Windows\System\KYworPx.exe
  2⤵
  PID:7556
- C:\Windows\System\iDNIevt.exe
  C:\Windows\System\iDNIevt.exe
  2⤵
  PID:7572
- C:\Windows\System\mosIUZN.exe
  C:\Windows\System\mosIUZN.exe
  2⤵
  PID:7620
- C:\Windows\System\diEMLAU.exe
  C:\Windows\System\diEMLAU.exe
  2⤵
  PID:7652
- C:\Windows\System\uZoGbqP.exe
  C:\Windows\System\uZoGbqP.exe
  2⤵
  PID:7672
- C:\Windows\System\unckPlZ.exe
  C:\Windows\System\unckPlZ.exe
  2⤵
  PID:7736
- C:\Windows\System\KjtJGpw.exe
  C:\Windows\System\KjtJGpw.exe
  2⤵
  PID:7752
- C:\Windows\System\rzhLuFI.exe
  C:\Windows\System\rzhLuFI.exe
  2⤵
  PID:7812
- C:\Windows\System\YZNYsUv.exe
  C:\Windows\System\YZNYsUv.exe
  2⤵
  PID:7768
- C:\Windows\System\WEcPdUZ.exe
  C:\Windows\System\WEcPdUZ.exe
  2⤵
  PID:7860
- C:\Windows\System\PFSIzzS.exe
  C:\Windows\System\PFSIzzS.exe
  2⤵
  PID:7864
- C:\Windows\System\msRUAsj.exe
  C:\Windows\System\msRUAsj.exe
  2⤵
  PID:7928
- C:\Windows\System\hfjuNlS.exe
  C:\Windows\System\hfjuNlS.exe
  2⤵
  PID:8024
- C:\Windows\System\rFxBgMD.exe
  C:\Windows\System\rFxBgMD.exe
  2⤵
  PID:8028
- C:\Windows\System\WrgrSaI.exe
  C:\Windows\System\WrgrSaI.exe
  2⤵
  PID:7912
- C:\Windows\System\xNodUPj.exe
  C:\Windows\System\xNodUPj.exe
  2⤵
  PID:8044
- C:\Windows\System\rWrRruD.exe
  C:\Windows\System\rWrRruD.exe
  2⤵
  PID:7940
- C:\Windows\System\oFKKseE.exe
  C:\Windows\System\oFKKseE.exe
  2⤵
  PID:8144
- C:\Windows\System\prNkYJi.exe
  C:\Windows\System\prNkYJi.exe
  2⤵
  PID:8180
- C:\Windows\System\RzsxJOM.exe
  C:\Windows\System\RzsxJOM.exe
  2⤵
  PID:7200
- C:\Windows\System\JdXcUeO.exe
  C:\Windows\System\JdXcUeO.exe
  2⤵
  PID:6744
- C:\Windows\System\wRpvxSA.exe
  C:\Windows\System\wRpvxSA.exe
  2⤵
  PID:6792
- C:\Windows\System\tWSOiUY.exe
  C:\Windows\System\tWSOiUY.exe
  2⤵
  PID:6264
- C:\Windows\System\oYjrehW.exe
  C:\Windows\System\oYjrehW.exe
  2⤵
  PID:8164
- C:\Windows\System\ztiqFcJ.exe
  C:\Windows\System\ztiqFcJ.exe
  2⤵
  PID:1932
- C:\Windows\System\NjFCEJO.exe
  C:\Windows\System\NjFCEJO.exe
  2⤵
  PID:8096
- C:\Windows\System\QuuAjeo.exe
  C:\Windows\System\QuuAjeo.exe
  2⤵
  PID:8160
- C:\Windows\System\fJmAsHX.exe
  C:\Windows\System\fJmAsHX.exe
  2⤵
  PID:7248
- C:\Windows\System\FWaPNhF.exe
  C:\Windows\System\FWaPNhF.exe
  2⤵
  PID:7252
- C:\Windows\System\zOmICHb.exe
  C:\Windows\System\zOmICHb.exe
  2⤵
  PID:7552
- C:\Windows\System\QBxXWNC.exe
  C:\Windows\System\QBxXWNC.exe
  2⤵
  PID:7540
- C:\Windows\System\NquzkpH.exe
  C:\Windows\System\NquzkpH.exe
  2⤵
  PID:7748
- C:\Windows\System\DkzNGus.exe
  C:\Windows\System\DkzNGus.exe
  2⤵
  PID:7964
- C:\Windows\System\CLehQEX.exe
  C:\Windows\System\CLehQEX.exe
  2⤵
  PID:8076
- C:\Windows\System\stNnNaq.exe
  C:\Windows\System\stNnNaq.exe
  2⤵
  PID:7992
- C:\Windows\System\VGTQnXG.exe
  C:\Windows\System\VGTQnXG.exe
  2⤵
  PID:7600
- C:\Windows\System\OpswBwO.exe
  C:\Windows\System\OpswBwO.exe
  2⤵
  PID:7476
- C:\Windows\System\DXvpXgp.exe
  C:\Windows\System\DXvpXgp.exe
  2⤵
  PID:6692
- C:\Windows\System\uxpmxxf.exe
  C:\Windows\System\uxpmxxf.exe
  2⤵
  PID:7784
- C:\Windows\System\GCXEgIu.exe
  C:\Windows\System\GCXEgIu.exe
  2⤵
  PID:7924
- C:\Windows\System\PZkNmKt.exe
  C:\Windows\System\PZkNmKt.exe
  2⤵
  PID:7392
- C:\Windows\System\VnYFyiH.exe
  C:\Windows\System\VnYFyiH.exe
  2⤵
  PID:8100
- C:\Windows\System\LvwjFBi.exe
  C:\Windows\System\LvwjFBi.exe
  2⤵
  PID:7848
- C:\Windows\System\ehNcRGs.exe
  C:\Windows\System\ehNcRGs.exe
  2⤵
  PID:7236
- C:\Windows\System\xBLuKdq.exe
  C:\Windows\System\xBLuKdq.exe
  2⤵
  PID:7720
- C:\Windows\System\yssgTgG.exe
  C:\Windows\System\yssgTgG.exe
  2⤵
  PID:7424
- C:\Windows\System\vrfvhUz.exe
  C:\Windows\System\vrfvhUz.exe
  2⤵
  PID:6244
- C:\Windows\System\PevroaU.exe
  C:\Windows\System\PevroaU.exe
  2⤵
  PID:7488
- C:\Windows\System\BbiWyIb.exe
  C:\Windows\System\BbiWyIb.exe
  2⤵
  PID:7908
- C:\Windows\System\MYlLtZV.exe
  C:\Windows\System\MYlLtZV.exe
  2⤵
  PID:8176
- C:\Windows\System\wUOvUYi.exe
  C:\Windows\System\wUOvUYi.exe
  2⤵
  PID:7896
- C:\Windows\System\egsBFgI.exe
  C:\Windows\System\egsBFgI.exe
  2⤵
  PID:7616
- C:\Windows\System\fkeqTUh.exe
  C:\Windows\System\fkeqTUh.exe
  2⤵
  PID:7380
- C:\Windows\System\sRFqnuH.exe
  C:\Windows\System\sRFqnuH.exe
  2⤵
  PID:7428
- C:\Windows\System\XwLfXXy.exe
  C:\Windows\System\XwLfXXy.exe
  2⤵
  PID:8208
- C:\Windows\System\djvhQLJ.exe
  C:\Windows\System\djvhQLJ.exe
  2⤵
  PID:8224
- C:\Windows\System\lODfJai.exe
  C:\Windows\System\lODfJai.exe
  2⤵
  PID:8240
- C:\Windows\System\nixReON.exe
  C:\Windows\System\nixReON.exe
  2⤵
  PID:8256
- C:\Windows\System\CygfyaN.exe
  C:\Windows\System\CygfyaN.exe
  2⤵
  PID:8272
- C:\Windows\System\NCcvKZH.exe
  C:\Windows\System\NCcvKZH.exe
  2⤵
  PID:8288
- C:\Windows\System\uuNtPCF.exe
  C:\Windows\System\uuNtPCF.exe
  2⤵
  PID:8304
- C:\Windows\System\BvnQlvG.exe
  C:\Windows\System\BvnQlvG.exe
  2⤵
  PID:8320
- C:\Windows\System\QMKMVQD.exe
  C:\Windows\System\QMKMVQD.exe
  2⤵
  PID:8336
- C:\Windows\System\EBjQNhO.exe
  C:\Windows\System\EBjQNhO.exe
  2⤵
  PID:8352
- C:\Windows\System\ffjeiIu.exe
  C:\Windows\System\ffjeiIu.exe
  2⤵
  PID:8368
- C:\Windows\System\frTsVvU.exe
  C:\Windows\System\frTsVvU.exe
  2⤵
  PID:8384
- C:\Windows\System\mRKhoiv.exe
  C:\Windows\System\mRKhoiv.exe
  2⤵
  PID:8400
- C:\Windows\System\bveribT.exe
  C:\Windows\System\bveribT.exe
  2⤵
  PID:8416
- C:\Windows\System\OzCHKMR.exe
  C:\Windows\System\OzCHKMR.exe
  2⤵
  PID:8432
- C:\Windows\System\yXLGdeN.exe
  C:\Windows\System\yXLGdeN.exe
  2⤵
  PID:8448
- C:\Windows\System\uLudWSj.exe
  C:\Windows\System\uLudWSj.exe
  2⤵
  PID:8464
- C:\Windows\System\rwdahFD.exe
  C:\Windows\System\rwdahFD.exe
  2⤵
  PID:8480
- C:\Windows\System\VpMQitS.exe
  C:\Windows\System\VpMQitS.exe
  2⤵
  PID:8496
- C:\Windows\System\yHodbag.exe
  C:\Windows\System\yHodbag.exe
  2⤵
  PID:8512
- C:\Windows\System\pSoIgZu.exe
  C:\Windows\System\pSoIgZu.exe
  2⤵
  PID:8528
- C:\Windows\System\BeqWQGi.exe
  C:\Windows\System\BeqWQGi.exe
  2⤵
  PID:8544
- C:\Windows\System\dLbDmvv.exe
  C:\Windows\System\dLbDmvv.exe
  2⤵
  PID:8560
- C:\Windows\System\UPJidZu.exe
  C:\Windows\System\UPJidZu.exe
  2⤵
  PID:8576
- C:\Windows\System\szAjQHV.exe
  C:\Windows\System\szAjQHV.exe
  2⤵
  PID:8592
- C:\Windows\System\aKUOIBB.exe
  C:\Windows\System\aKUOIBB.exe
  2⤵
  PID:8608
- C:\Windows\System\YSoxoht.exe
  C:\Windows\System\YSoxoht.exe
  2⤵
  PID:8624
- C:\Windows\System\DttwojK.exe
  C:\Windows\System\DttwojK.exe
  2⤵
  PID:8640
- C:\Windows\System\oxrzFDM.exe
  C:\Windows\System\oxrzFDM.exe
  2⤵
  PID:8660
- C:\Windows\System\yMAuxCz.exe
  C:\Windows\System\yMAuxCz.exe
  2⤵
  PID:8676
- C:\Windows\System\vwtGHZi.exe
  C:\Windows\System\vwtGHZi.exe
  2⤵
  PID:8692
- C:\Windows\System\QmVPlEA.exe
  C:\Windows\System\QmVPlEA.exe
  2⤵
  PID:8708
- C:\Windows\System\DZYXwiT.exe
  C:\Windows\System\DZYXwiT.exe
  2⤵
  PID:8724
- C:\Windows\System\ZhtCgML.exe
  C:\Windows\System\ZhtCgML.exe
  2⤵
  PID:8740
- C:\Windows\System\ArIMmXG.exe
  C:\Windows\System\ArIMmXG.exe
  2⤵
  PID:8756
- C:\Windows\System\YcfYXmx.exe
  C:\Windows\System\YcfYXmx.exe
  2⤵
  PID:8772
- C:\Windows\System\MOcpMhO.exe
  C:\Windows\System\MOcpMhO.exe
  2⤵
  PID:8788
- C:\Windows\System\hadmFuB.exe
  C:\Windows\System\hadmFuB.exe
  2⤵
  PID:8804
- C:\Windows\System\bHbvDBC.exe
  C:\Windows\System\bHbvDBC.exe
  2⤵
  PID:8820
- C:\Windows\System\JqVrrPn.exe
  C:\Windows\System\JqVrrPn.exe
  2⤵
  PID:8836
- C:\Windows\System\wopUAMt.exe
  C:\Windows\System\wopUAMt.exe
  2⤵
  PID:8852
- C:\Windows\System\GlAAOuB.exe
  C:\Windows\System\GlAAOuB.exe
  2⤵
  PID:8868
- C:\Windows\System\uWsEknc.exe
  C:\Windows\System\uWsEknc.exe
  2⤵
  PID:8884
- C:\Windows\System\OGPAyCH.exe
  C:\Windows\System\OGPAyCH.exe
  2⤵
  PID:8900
- C:\Windows\System\Hjlnlgk.exe
  C:\Windows\System\Hjlnlgk.exe
  2⤵
  PID:8916
- C:\Windows\System\pCbBYSw.exe
  C:\Windows\System\pCbBYSw.exe
  2⤵
  PID:8932
- C:\Windows\System\rBLmZxu.exe
  C:\Windows\System\rBLmZxu.exe
  2⤵
  PID:8948
- C:\Windows\System\FzHtbJA.exe
  C:\Windows\System\FzHtbJA.exe
  2⤵
  PID:8964
- C:\Windows\System\pCueZVP.exe
  C:\Windows\System\pCueZVP.exe
  2⤵
  PID:8980
- C:\Windows\System\NLqJHOO.exe
  C:\Windows\System\NLqJHOO.exe
  2⤵
  PID:8996
- C:\Windows\System\baTUlpV.exe
  C:\Windows\System\baTUlpV.exe
  2⤵
  PID:9016
- C:\Windows\System\tININHk.exe
  C:\Windows\System\tININHk.exe
  2⤵
  PID:9032
- C:\Windows\System\RGIsYrF.exe
  C:\Windows\System\RGIsYrF.exe
  2⤵
  PID:9048
- C:\Windows\System\VASJZsw.exe
  C:\Windows\System\VASJZsw.exe
  2⤵
  PID:9068
- C:\Windows\System\rWbprRz.exe
  C:\Windows\System\rWbprRz.exe
  2⤵
  PID:9084
- C:\Windows\System\mbBxxIW.exe
  C:\Windows\System\mbBxxIW.exe
  2⤵
  PID:9100
- C:\Windows\System\TiyZxlG.exe
  C:\Windows\System\TiyZxlG.exe
  2⤵
  PID:9120
- C:\Windows\System\tpwFisT.exe
  C:\Windows\System\tpwFisT.exe
  2⤵
  PID:9136
- C:\Windows\System\bGBfmfA.exe
  C:\Windows\System\bGBfmfA.exe
  2⤵
  PID:9152
- C:\Windows\System\qtONpAY.exe
  C:\Windows\System\qtONpAY.exe
  2⤵
  PID:9168
- C:\Windows\System\NDUpBbE.exe
  C:\Windows\System\NDUpBbE.exe
  2⤵
  PID:9184
- C:\Windows\System\ZIOoIYi.exe
  C:\Windows\System\ZIOoIYi.exe
  2⤵
  PID:9200
- C:\Windows\System\JtYtXju.exe
  C:\Windows\System\JtYtXju.exe
  2⤵
  PID:7716
- C:\Windows\System\OtcMuNH.exe
  C:\Windows\System\OtcMuNH.exe
  2⤵
  PID:8128
- C:\Windows\System\xppcFEy.exe
  C:\Windows\System\xppcFEy.exe
  2⤵
  PID:8112
- C:\Windows\System\QoJjKgt.exe
  C:\Windows\System\QoJjKgt.exe
  2⤵
  PID:7220
- C:\Windows\System\uCKRbrE.exe
  C:\Windows\System\uCKRbrE.exe
  2⤵
  PID:7976
- C:\Windows\System\qhTHDpK.exe
  C:\Windows\System\qhTHDpK.exe
  2⤵
  PID:8312
- C:\Windows\System\CWjxEld.exe
  C:\Windows\System\CWjxEld.exe
  2⤵
  PID:8284
- C:\Windows\System\DtWpEGK.exe
  C:\Windows\System\DtWpEGK.exe
  2⤵
  PID:8268
- C:\Windows\System\zjloJLW.exe
  C:\Windows\System\zjloJLW.exe
  2⤵
  PID:8316
- C:\Windows\System\DIvviNc.exe
  C:\Windows\System\DIvviNc.exe
  2⤵
  PID:8360
- C:\Windows\System\FKQriDF.exe
  C:\Windows\System\FKQriDF.exe
  2⤵
  PID:8424
- C:\Windows\System\GeyyMJa.exe
  C:\Windows\System\GeyyMJa.exe
  2⤵
  PID:8380
- C:\Windows\System\kZOAvmN.exe
  C:\Windows\System\kZOAvmN.exe
  2⤵
  PID:8476
- C:\Windows\System\pWfpchE.exe
  C:\Windows\System\pWfpchE.exe
  2⤵
  PID:8460
- C:\Windows\System\MrCgwZl.exe
  C:\Windows\System\MrCgwZl.exe
  2⤵
  PID:8524
- C:\Windows\System\giUqFTr.exe
  C:\Windows\System\giUqFTr.exe
  2⤵
  PID:8584
- C:\Windows\System\QWSJIRj.exe
  C:\Windows\System\QWSJIRj.exe
  2⤵
  PID:8568
- C:\Windows\System\uOdgLgT.exe
  C:\Windows\System\uOdgLgT.exe
  2⤵
  PID:8600
- C:\Windows\System\AWXBjlw.exe
  C:\Windows\System\AWXBjlw.exe
  2⤵
  PID:8648
- C:\Windows\System\IuDSIbH.exe
  C:\Windows\System\IuDSIbH.exe
  2⤵
  PID:8688
- C:\Windows\System\pUwDamM.exe
  C:\Windows\System\pUwDamM.exe
  2⤵
  PID:8748
- C:\Windows\System\LqelLyn.exe
  C:\Windows\System\LqelLyn.exe
  2⤵
  PID:8732
- C:\Windows\System\EfkCNXy.exe
  C:\Windows\System\EfkCNXy.exe
  2⤵
  PID:8796
- C:\Windows\System\cvgOhan.exe
  C:\Windows\System\cvgOhan.exe
  2⤵
  PID:8864
- C:\Windows\System\asCZvEN.exe
  C:\Windows\System\asCZvEN.exe
  2⤵
  PID:8816
- C:\Windows\System\EYyqAHb.exe
  C:\Windows\System\EYyqAHb.exe
  2⤵
  PID:8880
- C:\Windows\System\tqRYoPf.exe
  C:\Windows\System\tqRYoPf.exe
  2⤵
  PID:8944
- C:\Windows\System\ZceFnCO.exe
  C:\Windows\System\ZceFnCO.exe
  2⤵
  PID:8976
- C:\Windows\System\sAVIjsY.exe
  C:\Windows\System\sAVIjsY.exe
  2⤵
  PID:8896
- C:\Windows\System\MaBEbwp.exe
  C:\Windows\System\MaBEbwp.exe
  2⤵
  PID:9040
- C:\Windows\System\zAEhlAV.exe
  C:\Windows\System\zAEhlAV.exe
  2⤵
  PID:9108
- C:\Windows\System\jIZnbXA.exe
  C:\Windows\System\jIZnbXA.exe
  2⤵
  PID:8992
- C:\Windows\System\NDIWhKm.exe
  C:\Windows\System\NDIWhKm.exe
  2⤵
  PID:9092
- C:\Windows\System\smmryzn.exe
  C:\Windows\System\smmryzn.exe
  2⤵
  PID:9148
- C:\Windows\System\AsCsiwH.exe
  C:\Windows\System\AsCsiwH.exe
  2⤵
  PID:9160
- C:\Windows\System\CSNzdfA.exe
  C:\Windows\System\CSNzdfA.exe
  2⤵
  PID:9196
- C:\Windows\System\pjbSYac.exe
  C:\Windows\System\pjbSYac.exe
  2⤵
  PID:7732
- C:\Windows\System\khCrqQY.exe
  C:\Windows\System\khCrqQY.exe
  2⤵
  PID:8204
- C:\Windows\System\YMokUXt.exe
  C:\Windows\System\YMokUXt.exe
  2⤵
  PID:8132
- C:\Windows\System\fXzIjZm.exe
  C:\Windows\System\fXzIjZm.exe
  2⤵
  PID:8396
- C:\Windows\System\ehyswUW.exe
  C:\Windows\System\ehyswUW.exe
  2⤵
  PID:8520
- C:\Windows\System\yRwXpjK.exe
  C:\Windows\System\yRwXpjK.exe
  2⤵
  PID:8236
- C:\Windows\System\jFqUvwa.exe
  C:\Windows\System\jFqUvwa.exe
  2⤵
  PID:8376
- C:\Windows\System\cRcOzVW.exe
  C:\Windows\System\cRcOzVW.exe
  2⤵
  PID:8504
- C:\Windows\System\ILVQnZm.exe
  C:\Windows\System\ILVQnZm.exe
  2⤵
  PID:8704
- C:\Windows\System\ePSokin.exe
  C:\Windows\System\ePSokin.exe
  2⤵
  PID:8456
- C:\Windows\System\oxsNRpj.exe
  C:\Windows\System\oxsNRpj.exe
  2⤵
  PID:8828
- C:\Windows\System\TMoJJyI.exe
  C:\Windows\System\TMoJJyI.exe
  2⤵
  PID:8940
- C:\Windows\System\xSUxtJF.exe
  C:\Windows\System\xSUxtJF.exe
  2⤵
  PID:9076
- C:\Windows\System\aVIkonR.exe
  C:\Windows\System\aVIkonR.exe
  2⤵
  PID:9060
- C:\Windows\System\TubNDOh.exe
  C:\Windows\System\TubNDOh.exe
  2⤵
  PID:9132
- C:\Windows\System\oGHsceC.exe
  C:\Windows\System\oGHsceC.exe
  2⤵
  PID:8252
- C:\Windows\System\mODfkcz.exe
  C:\Windows\System\mODfkcz.exe
  2⤵
  PID:9044
- C:\Windows\System\ThIALPV.exe
  C:\Windows\System\ThIALPV.exe
  2⤵
  PID:8720
- C:\Windows\System\tGRWqIf.exe
  C:\Windows\System\tGRWqIf.exe
  2⤵
  PID:9024
- C:\Windows\System\XaoOudH.exe
  C:\Windows\System\XaoOudH.exe
  2⤵
  PID:9164
- C:\Windows\System\yDAjnTF.exe
  C:\Windows\System\yDAjnTF.exe
  2⤵
  PID:8332
- C:\Windows\System\GuZdwEA.exe
  C:\Windows\System\GuZdwEA.exe
  2⤵
  PID:8344
- C:\Windows\System\msxLbuD.exe
  C:\Windows\System\msxLbuD.exe
  2⤵
  PID:8768
- C:\Windows\System\URHxSjT.exe
  C:\Windows\System\URHxSjT.exe
  2⤵
  PID:9180
- C:\Windows\System\dcoUzGj.exe
  C:\Windows\System\dcoUzGj.exe
  2⤵
  PID:8912
- C:\Windows\System\JGmALav.exe
  C:\Windows\System\JGmALav.exe
  2⤵
  PID:8928
- C:\Windows\System\ninZZOJ.exe
  C:\Windows\System\ninZZOJ.exe
  2⤵
  PID:8812
- C:\Windows\System\vvIPIFa.exe
  C:\Windows\System\vvIPIFa.exe
  2⤵
  PID:9012
- C:\Windows\System\MetBvvo.exe
  C:\Windows\System\MetBvvo.exe
  2⤵
  PID:8656
- C:\Windows\System\PQHdBMk.exe
  C:\Windows\System\PQHdBMk.exe
  2⤵
  PID:8784
- C:\Windows\System\qVbwUJk.exe
  C:\Windows\System\qVbwUJk.exe
  2⤵
  PID:9004
- C:\Windows\System\QmUuDAG.exe
  C:\Windows\System\QmUuDAG.exe
  2⤵
  PID:7668
- C:\Windows\System\yYprKFk.exe
  C:\Windows\System\yYprKFk.exe
  2⤵
  PID:9228
- C:\Windows\System\TFIzXLb.exe
  C:\Windows\System\TFIzXLb.exe
  2⤵
  PID:9244
- C:\Windows\System\HhAUiiB.exe
  C:\Windows\System\HhAUiiB.exe
  2⤵
  PID:9260
- C:\Windows\System\dDtiSYg.exe
  C:\Windows\System\dDtiSYg.exe
  2⤵
  PID:9276
- C:\Windows\System\wpMLCzX.exe
  C:\Windows\System\wpMLCzX.exe
  2⤵
  PID:9292
- C:\Windows\System\fYGqkgD.exe
  C:\Windows\System\fYGqkgD.exe
  2⤵
  PID:9308
- C:\Windows\System\yaLlQkU.exe
  C:\Windows\System\yaLlQkU.exe
  2⤵
  PID:9324
- C:\Windows\System\wlKpSYN.exe
  C:\Windows\System\wlKpSYN.exe
  2⤵
  PID:9340
- C:\Windows\System\LxZVshS.exe
  C:\Windows\System\LxZVshS.exe
  2⤵
  PID:9356
- C:\Windows\System\ADhVhuk.exe
  C:\Windows\System\ADhVhuk.exe
  2⤵
  PID:9372
- C:\Windows\System\fpQVbvU.exe
  C:\Windows\System\fpQVbvU.exe
  2⤵
  PID:9388
- C:\Windows\System\bYmEhru.exe
  C:\Windows\System\bYmEhru.exe
  2⤵
  PID:9404
- C:\Windows\System\aCJllZB.exe
  C:\Windows\System\aCJllZB.exe
  2⤵
  PID:9420
- C:\Windows\System\tYcNbDz.exe
  C:\Windows\System\tYcNbDz.exe
  2⤵
  PID:9436
- C:\Windows\System\GnwEeYv.exe
  C:\Windows\System\GnwEeYv.exe
  2⤵
  PID:9452
- C:\Windows\System\utGQRhX.exe
  C:\Windows\System\utGQRhX.exe
  2⤵
  PID:9468
- C:\Windows\System\IhElabP.exe
  C:\Windows\System\IhElabP.exe
  2⤵
  PID:9484
- C:\Windows\System\dKCGHxW.exe
  C:\Windows\System\dKCGHxW.exe
  2⤵
  PID:9500
- C:\Windows\System\EdLBgbb.exe
  C:\Windows\System\EdLBgbb.exe
  2⤵
  PID:9516
- C:\Windows\System\eiSfOGT.exe
  C:\Windows\System\eiSfOGT.exe
  2⤵
  PID:9532
- C:\Windows\System\HxaiPsP.exe
  C:\Windows\System\HxaiPsP.exe
  2⤵
  PID:9548
- C:\Windows\System\gASCvCq.exe
  C:\Windows\System\gASCvCq.exe
  2⤵
  PID:9564
- C:\Windows\System\FLuIwtn.exe
  C:\Windows\System\FLuIwtn.exe
  2⤵
  PID:9580
- C:\Windows\System\ouHhFlU.exe
  C:\Windows\System\ouHhFlU.exe
  2⤵
  PID:9596
- C:\Windows\System\TdinqPe.exe
  C:\Windows\System\TdinqPe.exe
  2⤵
  PID:9612
- C:\Windows\System\FQMedys.exe
  C:\Windows\System\FQMedys.exe
  2⤵
  PID:9628
- C:\Windows\System\NrKghYn.exe
  C:\Windows\System\NrKghYn.exe
  2⤵
  PID:9644
- C:\Windows\System\XKJTqMn.exe
  C:\Windows\System\XKJTqMn.exe
  2⤵
  PID:9660
- C:\Windows\System\BauzxyS.exe
  C:\Windows\System\BauzxyS.exe
  2⤵
  PID:9676
- C:\Windows\System\SkDKUzX.exe
  C:\Windows\System\SkDKUzX.exe
  2⤵
  PID:9692
- C:\Windows\System\pYEkuoa.exe
  C:\Windows\System\pYEkuoa.exe
  2⤵
  PID:9708
- C:\Windows\System\tvclWvF.exe
  C:\Windows\System\tvclWvF.exe
  2⤵
  PID:9724
- C:\Windows\System\BjKEcqx.exe
  C:\Windows\System\BjKEcqx.exe
  2⤵
  PID:9740
- C:\Windows\System\RjQMzGj.exe
  C:\Windows\System\RjQMzGj.exe
  2⤵
  PID:9760
- C:\Windows\System\lOKRjgH.exe
  C:\Windows\System\lOKRjgH.exe
  2⤵
  PID:9776
- C:\Windows\System\MCGtqBF.exe
  C:\Windows\System\MCGtqBF.exe
  2⤵
  PID:9792
- C:\Windows\System\uTnmFlf.exe
  C:\Windows\System\uTnmFlf.exe
  2⤵
  PID:9808
- C:\Windows\System\OawhkgL.exe
  C:\Windows\System\OawhkgL.exe
  2⤵
  PID:9824
- C:\Windows\System\aJvUwxN.exe
  C:\Windows\System\aJvUwxN.exe
  2⤵
  PID:9840
- C:\Windows\System\PJeOPLc.exe
  C:\Windows\System\PJeOPLc.exe
  2⤵
  PID:9856
- C:\Windows\System\pDWrbgS.exe
  C:\Windows\System\pDWrbgS.exe
  2⤵
  PID:9872
- C:\Windows\System\QfLjxUT.exe
  C:\Windows\System\QfLjxUT.exe
  2⤵
  PID:9888
- C:\Windows\System\xPFkLod.exe
  C:\Windows\System\xPFkLod.exe
  2⤵
  PID:9904
- C:\Windows\System\VdUWoiK.exe
  C:\Windows\System\VdUWoiK.exe
  2⤵
  PID:9920
- C:\Windows\System\rkYVfop.exe
  C:\Windows\System\rkYVfop.exe
  2⤵
  PID:9940
- C:\Windows\System\aCVnzKk.exe
  C:\Windows\System\aCVnzKk.exe
  2⤵
  PID:9956
- C:\Windows\System\dFAJSnm.exe
  C:\Windows\System\dFAJSnm.exe
  2⤵
  PID:9972
- C:\Windows\System\NomNJkS.exe
  C:\Windows\System\NomNJkS.exe
  2⤵
  PID:9992
- C:\Windows\System\VFjatQv.exe
  C:\Windows\System\VFjatQv.exe
  2⤵
  PID:10008
- C:\Windows\System\tPFOAJm.exe
  C:\Windows\System\tPFOAJm.exe
  2⤵
  PID:10028
- C:\Windows\System\aelSXfx.exe
  C:\Windows\System\aelSXfx.exe
  2⤵
  PID:10044
- C:\Windows\System\hTmulwL.exe
  C:\Windows\System\hTmulwL.exe
  2⤵
  PID:10060
- C:\Windows\System\iAQGOAq.exe
  C:\Windows\System\iAQGOAq.exe
  2⤵
  PID:10076
- C:\Windows\System\BHGtgpc.exe
  C:\Windows\System\BHGtgpc.exe
  2⤵
  PID:10104
- C:\Windows\System\EtsJycn.exe
  C:\Windows\System\EtsJycn.exe
  2⤵
  PID:10120
- C:\Windows\System\tuluGKG.exe
  C:\Windows\System\tuluGKG.exe
  2⤵
  PID:10136
- C:\Windows\System\KMbxxWz.exe
  C:\Windows\System\KMbxxWz.exe
  2⤵
  PID:10152
- C:\Windows\System\IIrANyC.exe
  C:\Windows\System\IIrANyC.exe
  2⤵
  PID:10168
- C:\Windows\System\DxRHJzr.exe
  C:\Windows\System\DxRHJzr.exe
  2⤵
  PID:10184
- C:\Windows\System\lZHtVvw.exe
  C:\Windows\System\lZHtVvw.exe
  2⤵
  PID:10200
- C:\Windows\System\MMETpje.exe
  C:\Windows\System\MMETpje.exe
  2⤵
  PID:10216
- C:\Windows\System\XeOGqws.exe
  C:\Windows\System\XeOGqws.exe
  2⤵
  PID:10232
- C:\Windows\System\qDhcYak.exe
  C:\Windows\System\qDhcYak.exe
  2⤵
  PID:8408
- C:\Windows\System\VUNseWj.exe
  C:\Windows\System\VUNseWj.exe
  2⤵
  PID:9128
- C:\Windows\System\VAgpePJ.exe
  C:\Windows\System\VAgpePJ.exe
  2⤵
  PID:8556
- C:\Windows\System\cdyhWoQ.exe
  C:\Windows\System\cdyhWoQ.exe
  2⤵
  PID:9284
- C:\Windows\System\hmjZPmC.exe
  C:\Windows\System\hmjZPmC.exe
  2⤵
  PID:9316
- C:\Windows\System\VnTYGeg.exe
  C:\Windows\System\VnTYGeg.exe
  2⤵
  PID:9380
- C:\Windows\System\zYcJauH.exe
  C:\Windows\System\zYcJauH.exe
  2⤵
  PID:9304
- C:\Windows\System\TPqlYbZ.exe
  C:\Windows\System\TPqlYbZ.exe
  2⤵
  PID:9444
- C:\Windows\System\aCavDUe.exe
  C:\Windows\System\aCavDUe.exe
  2⤵
  PID:9400
- C:\Windows\System\cnVRAxJ.exe
  C:\Windows\System\cnVRAxJ.exe
  2⤵
  PID:9460
- C:\Windows\System\pAJVHoe.exe
  C:\Windows\System\pAJVHoe.exe
  2⤵
  PID:9492
- C:\Windows\System\McRGOyI.exe
  C:\Windows\System\McRGOyI.exe
  2⤵
  PID:9544
- C:\Windows\System\moAvxUT.exe
  C:\Windows\System\moAvxUT.exe
  2⤵
  PID:9608
- C:\Windows\System\jYRGjcL.exe
  C:\Windows\System\jYRGjcL.exe
  2⤵
  PID:9668
- C:\Windows\System\hWxyFfD.exe
  C:\Windows\System\hWxyFfD.exe
  2⤵
  PID:9732
- C:\Windows\System\ykPeouh.exe
  C:\Windows\System\ykPeouh.exe
  2⤵
  PID:9556
- C:\Windows\System\nHdzlUd.exe
  C:\Windows\System\nHdzlUd.exe
  2⤵
  PID:9800
- C:\Windows\System\aMwcCcD.exe
  C:\Windows\System\aMwcCcD.exe
  2⤵
  PID:9684
- C:\Windows\System\CywUjek.exe
  C:\Windows\System\CywUjek.exe
  2⤵
  PID:9624
- C:\Windows\System\UuMpdGh.exe
  C:\Windows\System\UuMpdGh.exe
  2⤵
  PID:9716
- C:\Windows\System\xgbxvFT.exe
  C:\Windows\System\xgbxvFT.exe
  2⤵
  PID:9788
- C:\Windows\System\sALDtfw.exe
  C:\Windows\System\sALDtfw.exe
  2⤵
  PID:9820
- C:\Windows\System\OTdQduY.exe
  C:\Windows\System\OTdQduY.exe
  2⤵
  PID:9880
- C:\Windows\System\yWjWgGH.exe
  C:\Windows\System\yWjWgGH.exe
  2⤵
  PID:9932
- C:\Windows\System\NTrwhvm.exe
  C:\Windows\System\NTrwhvm.exe
  2⤵
  PID:10000
- C:\Windows\System\ZZdLKDO.exe
  C:\Windows\System\ZZdLKDO.exe
  2⤵
  PID:10068
- C:\Windows\System\FprejvW.exe
  C:\Windows\System\FprejvW.exe
  2⤵
  PID:9948
- C:\Windows\System\vGQeLAz.exe
  C:\Windows\System\vGQeLAz.exe
  2⤵
  PID:10056
- C:\Windows\System\rbDUAGx.exe
  C:\Windows\System\rbDUAGx.exe
  2⤵
  PID:9988
- C:\Windows\System\yjWnKCF.exe
  C:\Windows\System\yjWnKCF.exe
  2⤵
  PID:10092
- C:\Windows\System\uKeGpVy.exe
  C:\Windows\System\uKeGpVy.exe
  2⤵
  PID:10116
- C:\Windows\System\chohjvW.exe
  C:\Windows\System\chohjvW.exe
  2⤵
  PID:10144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FZJlDWI.exe

Filesize
1.9MB

MD5
113ca4fb894c8ca867e2cd07b5d8b283

SHA1
047d105ea71f63fdac5ebe359b02301070c528ba

SHA256
91aa9f387cd9c8f94d4055299f043c2411410257f0a73ef2d1e297649e1b461a

SHA512
be95de03a3b6dae42d6bb29d0053830cdc062c08be3f844a5ec905d1c3a2e0c17226aab8b6f41a2c4f0fb7eb341ba71059062a69b53f193cfe66ea338984ef06

Download Submit
C:\Windows\system\HdDNjOx.exe

Filesize
1.9MB

MD5
83d8db1fd1d003c57f7df3c7998d6a02

SHA1
291609adba071eeb605d7c0d309a76e41e1f2579

SHA256
604364aeff3d3ad38266d66b93fe8b578fb13d7991d34f723957faa34a193d74

SHA512
781b3d11919668d47d46f48e74aa58fd38e265244232576ec88a9fb6c0eabed937c34b1a9635a4554a32af39d7a67cd6fb9096e310702e6e68791a0ba650ffaf

Download Submit
C:\Windows\system\HkMjBQy.exe

Filesize
1.9MB

MD5
222c1a52f5c5dda33ea9a997ceac41aa

SHA1
e6156f51ec4d85a07c33300968c46c3cc213749b

SHA256
8f370bfbaf8c3a4c3bdb5aa4ec1cf3bbe406748dbcb4a2a4848660f59d3530e9

SHA512
92507380a6f7d164023a34ac5893ddfdcb5e82eac15bdae210784bb9946004798a94ed3a226576db9241135e83a6cfdc2b0cadc632a175a85e777069d8461a88

Download Submit
C:\Windows\system\IvtqxeU.exe

Filesize
1.9MB

MD5
8e304deae7d220b7653d3cfad171acdc

SHA1
366a0584231477ef392fc6fff6df2350a35ba97f

SHA256
ff1c6668124a4cbc8b8ebd7db32cc7ecc1a1b343eae30b0ab206887682254dfd

SHA512
b8c46ac32ce4261282d73e4fea1be8dada10035b02e9e015e342a436e6ed1da7cbb4fe45abde0eaa6f9f2831036fe327e31bcda1bc6a7b79cfc7960a2222f3e4

Download Submit
C:\Windows\system\KPBfrKg.exe

Filesize
1.9MB

MD5
5b27f245df787f7c7787598f7f0f90fb

SHA1
6eba15258d124e97494b00ef3eb42b03a455c54f

SHA256
d4db65b7a013d12d14acf75648f31e334f5b23a65dc62511dd95f61672e6ea5d

SHA512
aac3d00238d32db7ad218e5a2366011148d905792c4df7c561eca23448f4bc6e2fdf4da744e141dc2892e66cdeeab4fb59063045b6bc235ea1788677b83e5f81

Download Submit
C:\Windows\system\NOfaIyd.exe

Filesize
1.9MB

MD5
ef6fa19b8f6db66871515ec7536d6403

SHA1
76427cda4864fd49133f474204bbcfe63910258c

SHA256
48a0388b61efedda9e538803ac51661a14824c5565fd5d08e318627d8921819c

SHA512
db6cf3c45c2b24b0dcf1b88c1f98a73f39aad6ab9bf694089fda9d70fbb36fcc2ed4e7f568424e4773d8196488e01d39796b207cedbf6e6b6bbcfb26c50bb32d

Download Submit
C:\Windows\system\PHZgbDm.exe

Filesize
1.9MB

MD5
76a52390709ffdd46698824cd8e50aaa

SHA1
c9f99cacc6fda1222c6c52f897a7c9035c143924

SHA256
173c2e0b22288f6a62e58e61f8f38ad7015c80bcbd16bd236cc51e4a1d5974f3

SHA512
0b956c03510b2dfa18f971ee457e7b389b27b9ff62a0396663fa84ad3a63be9f84e8fd4565ec9a272c20818e57350e0e47fe1e52db7d8b7a702d7b0e4c9cb84c

Download Submit
C:\Windows\system\PuwiKVu.exe

Filesize
1.9MB

MD5
f12e6687dfed16e432d940eff7b9579e

SHA1
9444ac12a2a9236e8daf5925b85f4a63170a7590

SHA256
5d2c9ce836a7876c455c8bd2509a5c84842b5e8d63e12d04faa295b2bbd701f2

SHA512
ec573b8489cd7e9107d6c3803f3600cb25b66458c031cb53b1e11b8365949d181a4f0dbf8aff03bef44e8a834772553a3fa2b1530f103cda7b71de4ba996d84f

Download Submit
C:\Windows\system\UnSsWho.exe

Filesize
1.9MB

MD5
53b25ea797e80e39c2d2ab3a6452aee5

SHA1
21d597ef3b545e8ef4a84a752b09df5451d73a14

SHA256
13b570ceabefb91b173af1c3d91296ad67dc95598ed5a9cab41e4ddb481eec2d

SHA512
ab91592b262bea3abcf556dfde1a3f013f1fa78ddebea509c077fc95b0182ef691310273debe023af99354c6f3ef1059730fde6d4d8de54677d8e76a5a43d8f2

Download Submit
C:\Windows\system\WlxRDuI.exe

Filesize
1.9MB

MD5
69d0ed008a52da700a87621e4ca0db0f

SHA1
55bc454b69b9794e1f042dd8bde7812b213ea3cd

SHA256
01b201254738f9c06b65ed6df58d9f1e4d8e4ae4ac692c81793a862d8e4c70f4

SHA512
51cc8535fb683ddd1cb460905b529c706e24cd782b88ed5de9f17fae8dd880d9e1cc4c67768b15379cd8ef2cc0c7788d23df2e6e17b7a0d779abf83f440133ab

Download Submit
C:\Windows\system\XEyqHfC.exe

Filesize
1.9MB

MD5
175d9e77b885cfa41a65f6e51d5fcbf2

SHA1
2dcaf307307c9d58d32677db03b4bf61df448531

SHA256
bcbff2cb0435557a5bd467f2e4da8f2a6edcf45ccd6e5ed88b53759995ce0d2e

SHA512
859f1956d224e74bcc63933d12b67895bc818567f34bf4f8819b1e3cd79ee41921d02745b61de9b8d42f133861c6bb2e72566b330367ef2d3dac1e1b4bf2ce5a

Download Submit
C:\Windows\system\ZcOijDq.exe

Filesize
1.9MB

MD5
3cdd42dcba183763b694d1b88eaa35a9

SHA1
ed0f25c74874059784c6a33321aa326a6e5790bb

SHA256
4568ff864d87442ebb49144b6c60ab0d0bdab0b471f8591c0738bc55132be0a9

SHA512
72519c8b656a758913c35876c6fe4e6a9633f588148fc0605f98df8678e5cc28642c106a2c4ebc1b4728949b7983d925c7c772758421429f2de85a560a7d80bc

Download Submit
C:\Windows\system\aQxqRxf.exe

Filesize
1.9MB

MD5
fce11682099e802c9b7062ec05a97cba

SHA1
ed4a0b4f0d7774e925673be6a39ab69e2d6681e1

SHA256
990fd86098e2623515b9a260967909419c4dadc0d3a069e1ff5e6ef2b9289c57

SHA512
d5f9718e67ce356c8c7505520c12ab21428a8513531fc22d1569cb4ce4444f780949684037dda33ae0d23328415e8e9454bbb556640643bac7fcede90df047a0

Download Submit
C:\Windows\system\aZnJbRM.exe

Filesize
1.9MB

MD5
7572ae4bb292088bb87e0f4ddca1b13d

SHA1
e5a6667dcfe1be3b68b068aed0e6a375c52bafeb

SHA256
598139f7c8360044945be63f14e04f513ddfe564c6ab26d55ef8e20e82b5f7c9

SHA512
0155ca24b089a636c39be799803d79385c9f16c96450bfa6b7f72e2ea22725fabe99db19fa27794a60c223425ff353821420d1516ff694a727d12ee63601d0f4

Download Submit
C:\Windows\system\bFVfWSd.exe

Filesize
1.9MB

MD5
4f37ff89c02a14ee897e3e5e61a73e69

SHA1
7f70d865bd6e43f54b28938b8215d1552290db36

SHA256
99fa614127cb3c46c3dcf96602ce93c26ce7fde33623f32d693934cb0c4ab0d9

SHA512
6242a0c11a58e78eb81083914c057157f39255b0cf376ea81df980e352a933ea6c40cd94ee9e98a8cf3a24667d0f33376efb0382e1b160c54d83e9e5059848dc

Download Submit
C:\Windows\system\cSuCyOZ.exe

Filesize
1.9MB

MD5
a4f81457065abe1e785f360a904bb52a

SHA1
176cee9584af442bcae05941d031f626d26be8bb

SHA256
83f25cc185eab50cb80baa06d76eb6f8e006a1e6f09df63a02d2783468b0bb03

SHA512
d67edbd322cd17420a377e133a77c117114e9e3eb87efbeaa2258f4706f14daf0c69bc0bacd8cbb0ce4c567baaaba29abd4be236423fc4b9f964a0987c18587a

Download Submit
C:\Windows\system\daszDoC.exe

Filesize
1.9MB

MD5
92c4581bdbd70b647620ed2ce77d3181

SHA1
94f43d9fe7149646dbd0b540aa4a3454480a772b

SHA256
0962f7f45ad453a9dd1944dbf87f70e0d992b90ef74a3c57b6afe0f4f17e8640

SHA512
87462ac3f5c3e46c01c1c5d142aac6c1adb3a03875f12d5c76c44aba8c78a5de2accd0027c321c25fbd8eebefe8526ca4158226ef7cf71700fd036c8b9f5fff5

Download Submit
C:\Windows\system\eDLoPMs.exe

Filesize
1.9MB

MD5
56fdf7711ec046bd99e98946de37d2fc

SHA1
f0de0e343f4fb7e3e276cd5b4169ac603cd3ae24

SHA256
f3e8291f57bc00cbba411164603d99e611c1e558f0d56f3c37fa0d8030b5bd2b

SHA512
0ea35ebda4f7aa75595209785dddbb51000c92155c52732513fb062f30afad238ef82085c5a2b2ea9975b7c6d5ccab8da938644d1cb34e99d41a7209c4f3a010

Download Submit
C:\Windows\system\iwOlkPv.exe

Filesize
1.9MB

MD5
b3f7c08b199a3ca3e4f9d66cc91725c9

SHA1
6b606db750836615f07f2d183d28805709a97725

SHA256
7ff138e92d766a0447677cedb5f54e2ab6ed8f906444834ff65a0fe9baef0b07

SHA512
6fc3dbc39a814c34ec84c908dbce2996e4469bde4fd84f30a0eeee6e2496fd59d5afda3b84e7038a97c0aaf361a3ee723980884a8caf447eb929acdbfffbf369

Download Submit
C:\Windows\system\mQDKQvb.exe

Filesize
1.9MB

MD5
10b537d4dd01654c5d50ccbbb3572814

SHA1
78cbabab1b4ee1952aa86a50d649451fa00f72e9

SHA256
9152412b792dc291ae6d49527ea9a386686b446466fcdcfeef4dee9347364f73

SHA512
f4c93d7f903f2b32c9e5de39c703f1a3dac3f9ce39c722d074675e35452320d3cb869e131a0ca2b4b2710ede098e48b1bd4853f9bbcd68deadeaa90c5bf001cd

Download Submit
C:\Windows\system\mlTEikh.exe

Filesize
1.9MB

MD5
563e8440a789d2236fb5874320e4e2e6

SHA1
a408969115db85a9f354fb8f8330011efae86d7d

SHA256
1974985e599dff176c1ecc8b175e3b49955746b330479e31e6e9e0ca6879e626

SHA512
aaf83579d33166fde1223c56e88cd2210c0693eb0269cdd6a1837a1b1af82c52d25adc22750ad4f4b00bfb2210e39419117ccbf9463b67ad076b58fe3cc6370e

Download Submit
C:\Windows\system\tDGHLpi.exe

Filesize
1.9MB

MD5
5dec0e75ef6c534676b1106b055d35e6

SHA1
f8af0c2392c744d72c0c7ad2b850a7ef3c8e0885

SHA256
ad4a9c26c1054758dd3d7c59cf8391cc635679d7e27c2177c01090979c3847c4

SHA512
b9deb842061b3b73060a66231811c5a2b22cd2147361db4c28d21b686e5e7e790729fdec04d6ca3da2eddd7d9dc2d3953b777b98e058d4bd38c72599e62f5e3d

Download Submit
C:\Windows\system\uguWsAP.exe

Filesize
1.9MB

MD5
18400ef2e9f3c7e8404d00b807e1e33b

SHA1
f7e56536737154ecf599f6952f1e7ded2c79adf3

SHA256
699ae0cd9bbe3c58617a13727b70182b70c335624062aacabe949f57cb157a49

SHA512
e3c11ab6983cf3e79af2908bf198c589d689c04e3d005a0943324681296b701ce2ff5d2e9b7dc4b3cc034988a15dcf93e8799bd44006a1429912f1712945f899

Download Submit
C:\Windows\system\ynjJOVM.exe

Filesize
1.9MB

MD5
e150cb011f6ba8c0e00cd682ecd9bc80

SHA1
27ce23861cfad10a59fae5811cfdd3fac7790770

SHA256
1620e96bedc5e38b109ab60912c8343979800ecf69b7ba67b889b025b9b05390

SHA512
b981afd06c59f58e8f3bd030621825dda73af410d3c18594d5c153567c6d40b246e09c5a6aed3d2421298f97f5c83203e4f26780e57b78a85ca79449161401fb

Download Submit
C:\Windows\system\zVrFLXM.exe

Filesize
1.9MB

MD5
fed9a6ce8ebdf4b8ffcc6edf4f558c54

SHA1
10bbce49928583c1b0e939851c7b22b87e503702

SHA256
714bf75aa7cc3fa17897b37e386e11be6ff619cc7354d2197f74df4c246df06a

SHA512
18bc2b65074a7904c8e6bd4aeb6281215c47290577cfcb4625594391806c00bf567c786bab42d64b0b8d9dc3ffc9accfb11d29079f98ffefcd039577ffcff52d

Download Submit
\Windows\system\EjMOTkH.exe

Filesize
1.9MB

MD5
3cc9b816529dd73f216b70d713f404dc

SHA1
5168e772081e4f9e7306d537d333687c9e137fba

SHA256
32ef0f72745eb48cabc2d40c9e215b3aa033a162b19901732a86aa6b8f15a9e4

SHA512
da6fddb173d31294800b3a885d422ab5c408ab04c53cd3d7aefbd3d0a0c9fb2efce3b07b3f94f182fa60ab6ab4295231e05d0eed8b26d2758c9503c2f72a74da

Download Submit
\Windows\system\HaAMgLK.exe

Filesize
1.9MB

MD5
3365fa8cfef2c1c3d585c3e815bb9597

SHA1
7d1fcd7c324aa8f9a265891f56689482406faec1

SHA256
2170ace2b6211e0983e78a8bd141ae7f2adc1a7b37365679930ca82fa4619371

SHA512
09f3ad34577139ace8b7b7e9386b348037cd6abb52ea729e6524da84d5894d87ca64081e2ed3f104e0ad647d3627d4ab5554dd4cb8252d3514259aab8b1c8af6

Download Submit
\Windows\system\SnnAiFS.exe

Filesize
1.9MB

MD5
b507d0334c53d89fad2265337a7e7012

SHA1
44b4086b7c5372da5b025e4017a5adf385af6e78

SHA256
580cec3f48882318ae6620525ff66df03db21405c0dc8d1c4aec00a4ef16c922

SHA512
8781ecb504e2596b0c0a74d4692dd7234857ad6979ed07a5302df74a167915d7c6a6b02e29fee9b3979816e9eaa38eeb8012cc0ee91198087438ba03a1f304d3

Download Submit
\Windows\system\TlzMSIB.exe

Filesize
1.9MB

MD5
6917b8c3252e4b47a12e8a5e353845e6

SHA1
521b9283d39a1588712de24fe5ee2c612fcd51f2

SHA256
87788360a6cd33001966db5fb2336f82431c74fd2ae7b18209b6f30df6f8a3bb

SHA512
fec05caac538bf9d372aeee3c0427f6345223c644e6f019306a8e3605e787c4b75fd261cf46d763a2df3dc72be5bcb85e10098702e5acef5e40c09cb142779fc

Download Submit
\Windows\system\nmVUzNa.exe

Filesize
1.9MB

MD5
64e2de41091948944be88345448d1e13

SHA1
0e4dc7e6075b48126b8ddeae635c6c5c5db29a95

SHA256
db577324caf1c944e995768b1010c3677ea02cff4b706607b34cb840a351c97f

SHA512
7436fad81293d9d019ff5bd15ecac8a8a33df80451fa31602d332b9e9249abd804ecbf4a6db915f6b06ebf02713a4e5ac455bc1491a2edc48253b75fa80af091

Download Submit
\Windows\system\rexEGNh.exe

Filesize
1.9MB

MD5
8fe8405d95513569d91135e5cae0ff0a

SHA1
e37638574bc73c2359b8c0ff408ae15fa69938df

SHA256
7d432a236e3a776c716ddc097e484af9d51513ebc3ff952875f80521f13acc0c

SHA512
a2991172cdb68217c862c03dfc853e108c4506f80512fe49ba99656cbf88498f48e53c9727e55e2c33811860ec3b359f21a71dc872a0fcab8d85628fd89e6d04

Download Submit
\Windows\system\wODsBtF.exe

Filesize
1.9MB

MD5
96c113c9c121e748cbf0d4fa0822fe54

SHA1
edd75ba94e09ffc8452b1824dfb0522ad36fff8a

SHA256
9b1619bc98ecc2fa53024c8803cdf5c81151df8149aa04eaa3b10cd124824bb0

SHA512
cbbed56d646b8416335a797ef831b054ea3688c76cc76168e63f9eb20b7f9d940924f54654605140dc60165769dcc7bd4492ca3ce43b7620de1ae8d07197ad17

Download Submit
memory/1836-38-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/1840-36-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2088-150-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/2088-146-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/2200-91-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2264-46-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2264-45-0x0000000002F20000-0x0000000003312000-memory.dmp

Filesize
3.9MB

Download
memory/2264-95-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2264-2-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2264-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2264-27-0x0000000002590000-0x0000000002982000-memory.dmp

Filesize
3.9MB

Download
memory/2264-96-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2264-53-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2264-66-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2264-97-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2264-92-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2264-40-0x0000000002F20000-0x0000000003312000-memory.dmp

Filesize
3.9MB

Download
memory/2264-94-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2264-79-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2264-49-0x0000000002F20000-0x0000000003312000-memory.dmp

Filesize
3.9MB

Download
memory/2264-48-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2292-52-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2496-72-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2544-83-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2588-54-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2596-51-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-50-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2700-55-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download