xmrig | 2c1f3cdc5aa81a0f86e145d702752f9f7e6229aeeac48380f099670d14cce4b5

Analysis

max time kernel
32s
max time network
31s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
Size

1.9MB
MD5

0b4633969fb74371b862ea226a204360
SHA1

5fe27f03ad850a9b94ff1e15716d4647f2f14038
SHA256

2c1f3cdc5aa81a0f86e145d702752f9f7e6229aeeac48380f099670d14cce4b5
SHA512

df718ba6a216e880cc9b67013fc837a1cd283d0ce5514925d476177e80183d9fe6ab38971584d801553b6f4c9db033279a6af6b8e8681e4f9fa4d09cb9aad04c
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UA:NABZ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/1804-60-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2480-67-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/1828-70-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2808-84-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/2708-1033-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2732-358-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2520-69-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2636-65-0x000000013F690000-0x000000013FA82000-memory.dmp	xmrig
behavioral1/memory/2704-30-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2672-29-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2572-24-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1828	DwPDkVM.exe
2572	dGWeFZz.exe
2672	tTIBnEA.exe
2704	OtcKqWa.exe
2732	zEYQwbx.exe
2708	ywcVYSh.exe
2480	UpvqFUO.exe
2636	bfcKgpu.exe
2520	oGFZPsD.exe
2836	rcrLKdB.exe
2808	rEnEngo.exe
2940	aBfbsha.exe
1812	TRTUkOr.exe
2344	XBeNdoB.exe
1584	UpTfFuT.exe
1676	fjztFQt.exe
1876	eINmQDI.exe
2788	oVmXCXf.exe
1844	KbhdITg.exe
1232	uJHFYrm.exe
1792	LLJyowi.exe
1360	sybApgO.exe
2448	TlgHOhY.exe
1964	xXlHesK.exe
2648	AVepzYo.exe
1636	yjKAkpk.exe
2000	wFctiPX.exe
2052	reyiWLE.exe
2244	hYSwtgq.exe
2304	ePkvdzW.exe
1848	EGBuWjN.exe
412	YHgdDgz.exe
1540	IkKNWeN.exe
2012	KZybqfl.exe
1628	GlqzEtB.exe
1044	XnmESev.exe
2308	NmrOLnG.exe
1872	XcTtyIa.exe
852	kIxQBCC.exe
2916	toIRBEg.exe
840	LMwtNOe.exe
2312	TbBBINA.exe
572	HoNmRww.exe
3032	syDggLT.exe
888	MSzqVxO.exe
1784	EdgcKGr.exe
1824	IzDRisM.exe
3052	osRBvqS.exe
2192	BUijATJ.exe
1608	YJdKHSf.exe
1216	rrccrHZ.exe
2064	ozDQmTB.exe
2740	Mxtsryl.exe
2684	glLgDwm.exe
2580	aiNAcQF.exe
2500	NxBbzsK.exe
1644	eclFpNF.exe
2852	vnYZqXr.exe
832	RsqcDUH.exe
1588	DrsWqsn.exe
2780	sKYYQNx.exe
1832	JmfdUfl.exe
1036	WgrKlGM.exe
1480	ksGaSkf.exe

Loads dropped DLL 64 IoCs

pid	Process
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1804-0-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/files/0x000b000000014323-3.dat	upx
behavioral1/memory/1828-8-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/files/0x0035000000014588-10.dat	upx
behavioral1/files/0x00070000000149e1-16.dat	upx
behavioral1/files/0x0007000000014b10-31.dat	upx
behavioral1/files/0x001800000000558a-42.dat	upx
behavioral1/memory/2732-41-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/files/0x000a000000014dae-47.dat	upx
behavioral1/memory/1804-60-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/2480-67-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/1828-70-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/files/0x0006000000015cb0-78.dat	upx
behavioral1/memory/2808-84-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/files/0x0006000000015ce3-102.dat	upx
behavioral1/files/0x0006000000015cbd-89.dat	upx
behavioral1/files/0x0006000000015d44-120.dat	upx
behavioral1/files/0x0006000000015d4c-168.dat	upx
behavioral1/files/0x0006000000015fa7-151.dat	upx
behavioral1/memory/2708-1033-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2732-358-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/files/0x0006000000016813-191.dat	upx
behavioral1/files/0x000600000001654a-189.dat	upx
behavioral1/files/0x00060000000162c9-187.dat	upx
behavioral1/files/0x00060000000160cc-185.dat	upx
behavioral1/files/0x0035000000014662-183.dat	upx
behavioral1/files/0x0006000000015e6d-172.dat	upx
behavioral1/files/0x00060000000161b3-159.dat	upx
behavioral1/files/0x0006000000015d24-145.dat	upx
behavioral1/files/0x0006000000015e09-133.dat	upx
behavioral1/files/0x0006000000015cf5-119.dat	upx
behavioral1/files/0x0006000000015cd9-117.dat	upx
behavioral1/files/0x00060000000165f0-177.dat	upx
behavioral1/files/0x0006000000016476-163.dat	upx
behavioral1/files/0x0006000000015f3c-138.dat	upx
behavioral1/files/0x0006000000015d0c-111.dat	upx
behavioral1/memory/2940-95-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/files/0x0006000000015cce-93.dat	upx
behavioral1/files/0x0006000000015c9c-73.dat	upx
behavioral1/memory/2836-82-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2520-69-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/files/0x0007000000015c85-66.dat	upx
behavioral1/memory/2636-65-0x000000013F690000-0x000000013FA82000-memory.dmp	upx
behavioral1/files/0x0006000000015c93-59.dat	upx
behavioral1/memory/1804-44-0x00000000035A0000-0x0000000003992000-memory.dmp	upx
behavioral1/memory/2704-30-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/2672-29-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/memory/2572-24-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/files/0x000700000001480e-20.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NGVblxp.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\uXcjLqi.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\wIWNIKQ.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\JfpuUEt.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\uoCawgL.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\tFbRDcn.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\IkKNWeN.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\yeUMlfh.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\EawOUyM.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\vDJsnYX.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\IGTqucE.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\JRXdHjH.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\wJcSSsh.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\HmcHewK.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\FwRFvNH.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\WunnHXb.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\toIRBEg.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\RbuCTqR.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\NNAywsu.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\cQjKleE.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\DtAgJwA.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\BWaMIXM.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\saEzuUK.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\EYvermh.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\BLGNkxd.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\AvSIgOG.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\CQLrSRt.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\cBndilq.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\xsjLecH.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\QIUZhTu.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\NaRBPAi.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\pqPtllw.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\fdvWUZN.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\GmTnxCw.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\vtrNYZM.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\csiInxV.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\VTIcnax.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\XSwAeJl.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\SgxCglS.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\DzhhoUi.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\TlQjgIX.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\ToxEjkN.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\weocUMi.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\ANVPPvm.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\QBGFVHK.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\mbIrmiX.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\OUbwOXD.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\WpEhLkb.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\qXWboCe.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\NnBGllT.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\yMUFavE.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\XnmESev.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\WgrKlGM.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\EbHuYZx.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\OlnZvqN.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\jcAtKqi.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\DYorvul.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\BRXdcaM.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\pVEBWWV.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\BJGATMS.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\arCvcYZ.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\ibRLVUV.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\FzKEYyz.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
File created	C:\Windows\System\dGWeFZz.exe	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2256	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
Token: SeDebugPrivilege	2256	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2256	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	29
PID 1804 wrote to memory of 2256	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	29
PID 1804 wrote to memory of 2256	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	29
PID 1804 wrote to memory of 1828	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	30
PID 1804 wrote to memory of 1828	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	30
PID 1804 wrote to memory of 1828	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	30
PID 1804 wrote to memory of 2572	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	31
PID 1804 wrote to memory of 2572	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	31
PID 1804 wrote to memory of 2572	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	31
PID 1804 wrote to memory of 2672	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	32
PID 1804 wrote to memory of 2672	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	32
PID 1804 wrote to memory of 2672	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	32
PID 1804 wrote to memory of 2704	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	33
PID 1804 wrote to memory of 2704	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	33
PID 1804 wrote to memory of 2704	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	33
PID 1804 wrote to memory of 2732	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	34
PID 1804 wrote to memory of 2732	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	34
PID 1804 wrote to memory of 2732	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	34
PID 1804 wrote to memory of 2708	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	35
PID 1804 wrote to memory of 2708	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	35
PID 1804 wrote to memory of 2708	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	35
PID 1804 wrote to memory of 2480	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	36
PID 1804 wrote to memory of 2480	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	36
PID 1804 wrote to memory of 2480	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	36
PID 1804 wrote to memory of 2520	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	37
PID 1804 wrote to memory of 2520	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	37
PID 1804 wrote to memory of 2520	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	37
PID 1804 wrote to memory of 2636	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	38
PID 1804 wrote to memory of 2636	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	38
PID 1804 wrote to memory of 2636	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	38
PID 1804 wrote to memory of 2836	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	39
PID 1804 wrote to memory of 2836	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	39
PID 1804 wrote to memory of 2836	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	39
PID 1804 wrote to memory of 2808	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	40
PID 1804 wrote to memory of 2808	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	40
PID 1804 wrote to memory of 2808	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	40
PID 1804 wrote to memory of 2940	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	41
PID 1804 wrote to memory of 2940	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	41
PID 1804 wrote to memory of 2940	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	41
PID 1804 wrote to memory of 1812	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	42
PID 1804 wrote to memory of 1812	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	42
PID 1804 wrote to memory of 1812	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	42
PID 1804 wrote to memory of 1676	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	43
PID 1804 wrote to memory of 1676	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	43
PID 1804 wrote to memory of 1676	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	43
PID 1804 wrote to memory of 2344	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	44
PID 1804 wrote to memory of 2344	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	44
PID 1804 wrote to memory of 2344	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	44
PID 1804 wrote to memory of 1876	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	45
PID 1804 wrote to memory of 1876	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	45
PID 1804 wrote to memory of 1876	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	45
PID 1804 wrote to memory of 1584	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	46
PID 1804 wrote to memory of 1584	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	46
PID 1804 wrote to memory of 1584	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	46
PID 1804 wrote to memory of 1792	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	47
PID 1804 wrote to memory of 1792	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	47
PID 1804 wrote to memory of 1792	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	47
PID 1804 wrote to memory of 2788	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	48
PID 1804 wrote to memory of 2788	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	48
PID 1804 wrote to memory of 2788	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	48
PID 1804 wrote to memory of 2648	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	49
PID 1804 wrote to memory of 2648	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	49
PID 1804 wrote to memory of 2648	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	49
PID 1804 wrote to memory of 1844	1804	0b4633969fb74371b862ea226a204360_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0b4633969fb74371b862ea226a204360_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b4633969fb74371b862ea226a204360_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- C:\Windows\System\DwPDkVM.exe
  C:\Windows\System\DwPDkVM.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\dGWeFZz.exe
  C:\Windows\System\dGWeFZz.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\tTIBnEA.exe
  C:\Windows\System\tTIBnEA.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\OtcKqWa.exe
  C:\Windows\System\OtcKqWa.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\zEYQwbx.exe
  C:\Windows\System\zEYQwbx.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\ywcVYSh.exe
  C:\Windows\System\ywcVYSh.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\UpvqFUO.exe
  C:\Windows\System\UpvqFUO.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\oGFZPsD.exe
  C:\Windows\System\oGFZPsD.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\bfcKgpu.exe
  C:\Windows\System\bfcKgpu.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\rcrLKdB.exe
  C:\Windows\System\rcrLKdB.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\rEnEngo.exe
  C:\Windows\System\rEnEngo.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\aBfbsha.exe
  C:\Windows\System\aBfbsha.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\TRTUkOr.exe
  C:\Windows\System\TRTUkOr.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\fjztFQt.exe
  C:\Windows\System\fjztFQt.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\XBeNdoB.exe
  C:\Windows\System\XBeNdoB.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\eINmQDI.exe
  C:\Windows\System\eINmQDI.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\UpTfFuT.exe
  C:\Windows\System\UpTfFuT.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\LLJyowi.exe
  C:\Windows\System\LLJyowi.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\oVmXCXf.exe
  C:\Windows\System\oVmXCXf.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\AVepzYo.exe
  C:\Windows\System\AVepzYo.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\KbhdITg.exe
  C:\Windows\System\KbhdITg.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\yjKAkpk.exe
  C:\Windows\System\yjKAkpk.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\uJHFYrm.exe
  C:\Windows\System\uJHFYrm.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\reyiWLE.exe
  C:\Windows\System\reyiWLE.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\sybApgO.exe
  C:\Windows\System\sybApgO.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\hYSwtgq.exe
  C:\Windows\System\hYSwtgq.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\TlgHOhY.exe
  C:\Windows\System\TlgHOhY.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\ePkvdzW.exe
  C:\Windows\System\ePkvdzW.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\xXlHesK.exe
  C:\Windows\System\xXlHesK.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\EGBuWjN.exe
  C:\Windows\System\EGBuWjN.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\wFctiPX.exe
  C:\Windows\System\wFctiPX.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\YHgdDgz.exe
  C:\Windows\System\YHgdDgz.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\IkKNWeN.exe
  C:\Windows\System\IkKNWeN.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\KZybqfl.exe
  C:\Windows\System\KZybqfl.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\GlqzEtB.exe
  C:\Windows\System\GlqzEtB.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\XnmESev.exe
  C:\Windows\System\XnmESev.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\NmrOLnG.exe
  C:\Windows\System\NmrOLnG.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\XcTtyIa.exe
  C:\Windows\System\XcTtyIa.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\kIxQBCC.exe
  C:\Windows\System\kIxQBCC.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\toIRBEg.exe
  C:\Windows\System\toIRBEg.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\LMwtNOe.exe
  C:\Windows\System\LMwtNOe.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\TbBBINA.exe
  C:\Windows\System\TbBBINA.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\HoNmRww.exe
  C:\Windows\System\HoNmRww.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\EdgcKGr.exe
  C:\Windows\System\EdgcKGr.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\syDggLT.exe
  C:\Windows\System\syDggLT.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\osRBvqS.exe
  C:\Windows\System\osRBvqS.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\MSzqVxO.exe
  C:\Windows\System\MSzqVxO.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\BUijATJ.exe
  C:\Windows\System\BUijATJ.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\IzDRisM.exe
  C:\Windows\System\IzDRisM.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\rrccrHZ.exe
  C:\Windows\System\rrccrHZ.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\YJdKHSf.exe
  C:\Windows\System\YJdKHSf.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\ozDQmTB.exe
  C:\Windows\System\ozDQmTB.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\Mxtsryl.exe
  C:\Windows\System\Mxtsryl.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\glLgDwm.exe
  C:\Windows\System\glLgDwm.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\aiNAcQF.exe
  C:\Windows\System\aiNAcQF.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\NxBbzsK.exe
  C:\Windows\System\NxBbzsK.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\eclFpNF.exe
  C:\Windows\System\eclFpNF.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\vnYZqXr.exe
  C:\Windows\System\vnYZqXr.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\RsqcDUH.exe
  C:\Windows\System\RsqcDUH.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\DrsWqsn.exe
  C:\Windows\System\DrsWqsn.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\sKYYQNx.exe
  C:\Windows\System\sKYYQNx.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\JmfdUfl.exe
  C:\Windows\System\JmfdUfl.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\WgrKlGM.exe
  C:\Windows\System\WgrKlGM.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\ksGaSkf.exe
  C:\Windows\System\ksGaSkf.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\mOxbSLH.exe
  C:\Windows\System\mOxbSLH.exe
  2⤵
  PID:772
- C:\Windows\System\onWupHv.exe
  C:\Windows\System\onWupHv.exe
  2⤵
  PID:1152
- C:\Windows\System\FoJfEdT.exe
  C:\Windows\System\FoJfEdT.exe
  2⤵
  PID:312
- C:\Windows\System\kbFaIms.exe
  C:\Windows\System\kbFaIms.exe
  2⤵
  PID:1524
- C:\Windows\System\kqRFrfH.exe
  C:\Windows\System\kqRFrfH.exe
  2⤵
  PID:2104
- C:\Windows\System\YVeYANY.exe
  C:\Windows\System\YVeYANY.exe
  2⤵
  PID:1556
- C:\Windows\System\QCalhET.exe
  C:\Windows\System\QCalhET.exe
  2⤵
  PID:1776
- C:\Windows\System\pfCFUAD.exe
  C:\Windows\System\pfCFUAD.exe
  2⤵
  PID:2440
- C:\Windows\System\oPZIVgf.exe
  C:\Windows\System\oPZIVgf.exe
  2⤵
  PID:1344
- C:\Windows\System\ljxPNhR.exe
  C:\Windows\System\ljxPNhR.exe
  2⤵
  PID:1920
- C:\Windows\System\fqvxIGk.exe
  C:\Windows\System\fqvxIGk.exe
  2⤵
  PID:1040
- C:\Windows\System\vdsYRPb.exe
  C:\Windows\System\vdsYRPb.exe
  2⤵
  PID:1160
- C:\Windows\System\iDaPqOx.exe
  C:\Windows\System\iDaPqOx.exe
  2⤵
  PID:908
- C:\Windows\System\qfrxylB.exe
  C:\Windows\System\qfrxylB.exe
  2⤵
  PID:2184
- C:\Windows\System\TTShVJp.exe
  C:\Windows\System\TTShVJp.exe
  2⤵
  PID:3024
- C:\Windows\System\YFwvWuA.exe
  C:\Windows\System\YFwvWuA.exe
  2⤵
  PID:868
- C:\Windows\System\mdeUusg.exe
  C:\Windows\System\mdeUusg.exe
  2⤵
  PID:2288
- C:\Windows\System\yZqijhY.exe
  C:\Windows\System\yZqijhY.exe
  2⤵
  PID:1996
- C:\Windows\System\coSBUde.exe
  C:\Windows\System\coSBUde.exe
  2⤵
  PID:1800
- C:\Windows\System\mzSYcLV.exe
  C:\Windows\System\mzSYcLV.exe
  2⤵
  PID:2680
- C:\Windows\System\UUvNJRw.exe
  C:\Windows\System\UUvNJRw.exe
  2⤵
  PID:1580
- C:\Windows\System\OjNkyFu.exe
  C:\Windows\System\OjNkyFu.exe
  2⤵
  PID:2584
- C:\Windows\System\tJhGHJe.exe
  C:\Windows\System\tJhGHJe.exe
  2⤵
  PID:2640
- C:\Windows\System\mMceGTG.exe
  C:\Windows\System\mMceGTG.exe
  2⤵
  PID:2588
- C:\Windows\System\AeugFVE.exe
  C:\Windows\System\AeugFVE.exe
  2⤵
  PID:3036
- C:\Windows\System\OBCjAzp.exe
  C:\Windows\System\OBCjAzp.exe
  2⤵
  PID:2760
- C:\Windows\System\BBeoLjc.exe
  C:\Windows\System\BBeoLjc.exe
  2⤵
  PID:1708
- C:\Windows\System\qOYmtGi.exe
  C:\Windows\System\qOYmtGi.exe
  2⤵
  PID:1248
- C:\Windows\System\jWmxSDX.exe
  C:\Windows\System\jWmxSDX.exe
  2⤵
  PID:560
- C:\Windows\System\WFDDOqY.exe
  C:\Windows\System\WFDDOqY.exe
  2⤵
  PID:684
- C:\Windows\System\txqRpIx.exe
  C:\Windows\System\txqRpIx.exe
  2⤵
  PID:1880
- C:\Windows\System\wIjgDmL.exe
  C:\Windows\System\wIjgDmL.exe
  2⤵
  PID:2696
- C:\Windows\System\BUgYUrt.exe
  C:\Windows\System\BUgYUrt.exe
  2⤵
  PID:2516
- C:\Windows\System\kdjvHSz.exe
  C:\Windows\System\kdjvHSz.exe
  2⤵
  PID:2384
- C:\Windows\System\NeUZlny.exe
  C:\Windows\System\NeUZlny.exe
  2⤵
  PID:1900
- C:\Windows\System\jzEQuNm.exe
  C:\Windows\System\jzEQuNm.exe
  2⤵
  PID:1332
- C:\Windows\System\vtrNYZM.exe
  C:\Windows\System\vtrNYZM.exe
  2⤵
  PID:2240
- C:\Windows\System\iopndiD.exe
  C:\Windows\System\iopndiD.exe
  2⤵
  PID:920
- C:\Windows\System\oBCJeAX.exe
  C:\Windows\System\oBCJeAX.exe
  2⤵
  PID:3088
- C:\Windows\System\cBndilq.exe
  C:\Windows\System\cBndilq.exe
  2⤵
  PID:3104
- C:\Windows\System\gZbcXDh.exe
  C:\Windows\System\gZbcXDh.exe
  2⤵
  PID:3124
- C:\Windows\System\VQmbtHE.exe
  C:\Windows\System\VQmbtHE.exe
  2⤵
  PID:3140
- C:\Windows\System\zvlAApg.exe
  C:\Windows\System\zvlAApg.exe
  2⤵
  PID:3156
- C:\Windows\System\hRgjwVf.exe
  C:\Windows\System\hRgjwVf.exe
  2⤵
  PID:3172
- C:\Windows\System\OAnPJXU.exe
  C:\Windows\System\OAnPJXU.exe
  2⤵
  PID:3188
- C:\Windows\System\eoryZwW.exe
  C:\Windows\System\eoryZwW.exe
  2⤵
  PID:3204
- C:\Windows\System\RjQpIak.exe
  C:\Windows\System\RjQpIak.exe
  2⤵
  PID:3220
- C:\Windows\System\EbHuYZx.exe
  C:\Windows\System\EbHuYZx.exe
  2⤵
  PID:3244
- C:\Windows\System\nWCJOZe.exe
  C:\Windows\System\nWCJOZe.exe
  2⤵
  PID:3260
- C:\Windows\System\EIHzngy.exe
  C:\Windows\System\EIHzngy.exe
  2⤵
  PID:3276
- C:\Windows\System\zgPxpZc.exe
  C:\Windows\System\zgPxpZc.exe
  2⤵
  PID:3292
- C:\Windows\System\bXfBWlM.exe
  C:\Windows\System\bXfBWlM.exe
  2⤵
  PID:3308
- C:\Windows\System\TIKVpTJ.exe
  C:\Windows\System\TIKVpTJ.exe
  2⤵
  PID:3324
- C:\Windows\System\CMtaoQU.exe
  C:\Windows\System\CMtaoQU.exe
  2⤵
  PID:3364
- C:\Windows\System\dPVuFfs.exe
  C:\Windows\System\dPVuFfs.exe
  2⤵
  PID:3424
- C:\Windows\System\PDlmrAj.exe
  C:\Windows\System\PDlmrAj.exe
  2⤵
  PID:3444
- C:\Windows\System\WwqhJIX.exe
  C:\Windows\System\WwqhJIX.exe
  2⤵
  PID:3464
- C:\Windows\System\lpjnPdW.exe
  C:\Windows\System\lpjnPdW.exe
  2⤵
  PID:3492
- C:\Windows\System\UKgmldy.exe
  C:\Windows\System\UKgmldy.exe
  2⤵
  PID:3508
- C:\Windows\System\HXeyHhq.exe
  C:\Windows\System\HXeyHhq.exe
  2⤵
  PID:3524
- C:\Windows\System\BAGeUxw.exe
  C:\Windows\System\BAGeUxw.exe
  2⤵
  PID:3540
- C:\Windows\System\rlfQVzD.exe
  C:\Windows\System\rlfQVzD.exe
  2⤵
  PID:3556
- C:\Windows\System\ZvdtunQ.exe
  C:\Windows\System\ZvdtunQ.exe
  2⤵
  PID:3572
- C:\Windows\System\cHwfBtM.exe
  C:\Windows\System\cHwfBtM.exe
  2⤵
  PID:3592
- C:\Windows\System\FZThSPc.exe
  C:\Windows\System\FZThSPc.exe
  2⤵
  PID:3608
- C:\Windows\System\mbIrmiX.exe
  C:\Windows\System\mbIrmiX.exe
  2⤵
  PID:3644
- C:\Windows\System\mLQJBPK.exe
  C:\Windows\System\mLQJBPK.exe
  2⤵
  PID:3668
- C:\Windows\System\WdiMSlt.exe
  C:\Windows\System\WdiMSlt.exe
  2⤵
  PID:3692
- C:\Windows\System\CfRaaRq.exe
  C:\Windows\System\CfRaaRq.exe
  2⤵
  PID:3712
- C:\Windows\System\eoEpqQC.exe
  C:\Windows\System\eoEpqQC.exe
  2⤵
  PID:3732
- C:\Windows\System\btxvbAy.exe
  C:\Windows\System\btxvbAy.exe
  2⤵
  PID:3760
- C:\Windows\System\zcaykeE.exe
  C:\Windows\System\zcaykeE.exe
  2⤵
  PID:3780
- C:\Windows\System\VNiwzHN.exe
  C:\Windows\System\VNiwzHN.exe
  2⤵
  PID:3800
- C:\Windows\System\QJpyTFF.exe
  C:\Windows\System\QJpyTFF.exe
  2⤵
  PID:3820
- C:\Windows\System\sYKNVlQ.exe
  C:\Windows\System\sYKNVlQ.exe
  2⤵
  PID:3840
- C:\Windows\System\wqjgbHX.exe
  C:\Windows\System\wqjgbHX.exe
  2⤵
  PID:3856
- C:\Windows\System\rFUOLzM.exe
  C:\Windows\System\rFUOLzM.exe
  2⤵
  PID:3884
- C:\Windows\System\gDUgpQM.exe
  C:\Windows\System\gDUgpQM.exe
  2⤵
  PID:3900
- C:\Windows\System\CeDaWkx.exe
  C:\Windows\System\CeDaWkx.exe
  2⤵
  PID:3916
- C:\Windows\System\XVUspnE.exe
  C:\Windows\System\XVUspnE.exe
  2⤵
  PID:3932
- C:\Windows\System\LKNvARi.exe
  C:\Windows\System\LKNvARi.exe
  2⤵
  PID:3960
- C:\Windows\System\hdCByAP.exe
  C:\Windows\System\hdCByAP.exe
  2⤵
  PID:3976
- C:\Windows\System\SqeMeZl.exe
  C:\Windows\System\SqeMeZl.exe
  2⤵
  PID:3992
- C:\Windows\System\sSfMEVC.exe
  C:\Windows\System\sSfMEVC.exe
  2⤵
  PID:4008
- C:\Windows\System\oFLYdIs.exe
  C:\Windows\System\oFLYdIs.exe
  2⤵
  PID:4024
- C:\Windows\System\xwIKysu.exe
  C:\Windows\System\xwIKysu.exe
  2⤵
  PID:4040
- C:\Windows\System\nnCGAHU.exe
  C:\Windows\System\nnCGAHU.exe
  2⤵
  PID:4056
- C:\Windows\System\mtmpyYt.exe
  C:\Windows\System\mtmpyYt.exe
  2⤵
  PID:4072
- C:\Windows\System\gnFuqFi.exe
  C:\Windows\System\gnFuqFi.exe
  2⤵
  PID:2456
- C:\Windows\System\ZIAPCwQ.exe
  C:\Windows\System\ZIAPCwQ.exe
  2⤵
  PID:1624
- C:\Windows\System\yUbwDjo.exe
  C:\Windows\System\yUbwDjo.exe
  2⤵
  PID:2608
- C:\Windows\System\iCBrrII.exe
  C:\Windows\System\iCBrrII.exe
  2⤵
  PID:2712
- C:\Windows\System\mQRcSXB.exe
  C:\Windows\System\mQRcSXB.exe
  2⤵
  PID:2120
- C:\Windows\System\zpSrYDt.exe
  C:\Windows\System\zpSrYDt.exe
  2⤵
  PID:3228
- C:\Windows\System\GqYrZZO.exe
  C:\Windows\System\GqYrZZO.exe
  2⤵
  PID:3268
- C:\Windows\System\VMofnFx.exe
  C:\Windows\System\VMofnFx.exe
  2⤵
  PID:3332
- C:\Windows\System\aqqKCfM.exe
  C:\Windows\System\aqqKCfM.exe
  2⤵
  PID:2272
- C:\Windows\System\csiInxV.exe
  C:\Windows\System\csiInxV.exe
  2⤵
  PID:2828
- C:\Windows\System\dZVjyqU.exe
  C:\Windows\System\dZVjyqU.exe
  2⤵
  PID:1816
- C:\Windows\System\qtOhIkw.exe
  C:\Windows\System\qtOhIkw.exe
  2⤵
  PID:2776
- C:\Windows\System\iISZMJY.exe
  C:\Windows\System\iISZMJY.exe
  2⤵
  PID:1028
- C:\Windows\System\OxTnxov.exe
  C:\Windows\System\OxTnxov.exe
  2⤵
  PID:688
- C:\Windows\System\Lcgjwuu.exe
  C:\Windows\System\Lcgjwuu.exe
  2⤵
  PID:376
- C:\Windows\System\VhMCbrV.exe
  C:\Windows\System\VhMCbrV.exe
  2⤵
  PID:1988
- C:\Windows\System\dXOhVrD.exe
  C:\Windows\System\dXOhVrD.exe
  2⤵
  PID:2032
- C:\Windows\System\VvhtliN.exe
  C:\Windows\System\VvhtliN.exe
  2⤵
  PID:1600
- C:\Windows\System\RuKHGrx.exe
  C:\Windows\System\RuKHGrx.exe
  2⤵
  PID:3080
- C:\Windows\System\GzxEvca.exe
  C:\Windows\System\GzxEvca.exe
  2⤵
  PID:3148
- C:\Windows\System\mFieWZO.exe
  C:\Windows\System\mFieWZO.exe
  2⤵
  PID:3212
- C:\Windows\System\UIyiYJk.exe
  C:\Windows\System\UIyiYJk.exe
  2⤵
  PID:3284
- C:\Windows\System\uZRVkhI.exe
  C:\Windows\System\uZRVkhI.exe
  2⤵
  PID:3372
- C:\Windows\System\dRjZMgR.exe
  C:\Windows\System\dRjZMgR.exe
  2⤵
  PID:3436
- C:\Windows\System\WlWuHqu.exe
  C:\Windows\System\WlWuHqu.exe
  2⤵
  PID:3476
- C:\Windows\System\SUkvZXP.exe
  C:\Windows\System\SUkvZXP.exe
  2⤵
  PID:2716
- C:\Windows\System\cKDsyhe.exe
  C:\Windows\System\cKDsyhe.exe
  2⤵
  PID:3588
- C:\Windows\System\roExIKu.exe
  C:\Windows\System\roExIKu.exe
  2⤵
  PID:1056
- C:\Windows\System\wqKmkVh.exe
  C:\Windows\System\wqKmkVh.exe
  2⤵
  PID:3384
- C:\Windows\System\MvdTPzi.exe
  C:\Windows\System\MvdTPzi.exe
  2⤵
  PID:3400
- C:\Windows\System\zZtazGq.exe
  C:\Windows\System\zZtazGq.exe
  2⤵
  PID:3416
- C:\Windows\System\nkPyGOI.exe
  C:\Windows\System\nkPyGOI.exe
  2⤵
  PID:3628
- C:\Windows\System\eeYwjOk.exe
  C:\Windows\System\eeYwjOk.exe
  2⤵
  PID:3636
- C:\Windows\System\NeZkHsi.exe
  C:\Windows\System\NeZkHsi.exe
  2⤵
  PID:3460
- C:\Windows\System\qvlxQgv.exe
  C:\Windows\System\qvlxQgv.exe
  2⤵
  PID:1736
- C:\Windows\System\iMZxBhY.exe
  C:\Windows\System\iMZxBhY.exe
  2⤵
  PID:3684
- C:\Windows\System\HyvpMGc.exe
  C:\Windows\System\HyvpMGc.exe
  2⤵
  PID:3600
- C:\Windows\System\IxsREKY.exe
  C:\Windows\System\IxsREKY.exe
  2⤵
  PID:3656
- C:\Windows\System\IjvuFrq.exe
  C:\Windows\System\IjvuFrq.exe
  2⤵
  PID:2124
- C:\Windows\System\iQdsnWh.exe
  C:\Windows\System\iQdsnWh.exe
  2⤵
  PID:576
- C:\Windows\System\cMWxErQ.exe
  C:\Windows\System\cMWxErQ.exe
  2⤵
  PID:3872
- C:\Windows\System\ZJVTFKp.exe
  C:\Windows\System\ZJVTFKp.exe
  2⤵
  PID:2540
- C:\Windows\System\Rimjxnm.exe
  C:\Windows\System\Rimjxnm.exe
  2⤵
  PID:1984
- C:\Windows\System\LRFZDDg.exe
  C:\Windows\System\LRFZDDg.exe
  2⤵
  PID:1672
- C:\Windows\System\CLTkMXl.exe
  C:\Windows\System\CLTkMXl.exe
  2⤵
  PID:2568
- C:\Windows\System\jIOtRVT.exe
  C:\Windows\System\jIOtRVT.exe
  2⤵
  PID:3912
- C:\Windows\System\CoVnWeF.exe
  C:\Windows\System\CoVnWeF.exe
  2⤵
  PID:2472
- C:\Windows\System\vIsWJhB.exe
  C:\Windows\System\vIsWJhB.exe
  2⤵
  PID:3956
- C:\Windows\System\iEQbGBf.exe
  C:\Windows\System\iEQbGBf.exe
  2⤵
  PID:3988
- C:\Windows\System\VqXudTW.exe
  C:\Windows\System\VqXudTW.exe
  2⤵
  PID:4016
- C:\Windows\System\yAvCRta.exe
  C:\Windows\System\yAvCRta.exe
  2⤵
  PID:4048
- C:\Windows\System\IcuWfXB.exe
  C:\Windows\System\IcuWfXB.exe
  2⤵
  PID:380
- C:\Windows\System\iORxkds.exe
  C:\Windows\System\iORxkds.exe
  2⤵
  PID:1340
- C:\Windows\System\WMhcpHZ.exe
  C:\Windows\System\WMhcpHZ.exe
  2⤵
  PID:340
- C:\Windows\System\ZzRuhDr.exe
  C:\Windows\System\ZzRuhDr.exe
  2⤵
  PID:1612
- C:\Windows\System\JlMavch.exe
  C:\Windows\System\JlMavch.exe
  2⤵
  PID:848
- C:\Windows\System\IoZvIVg.exe
  C:\Windows\System\IoZvIVg.exe
  2⤵
  PID:3056
- C:\Windows\System\ihNNlvi.exe
  C:\Windows\System\ihNNlvi.exe
  2⤵
  PID:3196
- C:\Windows\System\GonwPim.exe
  C:\Windows\System\GonwPim.exe
  2⤵
  PID:2188
- C:\Windows\System\pWITtVt.exe
  C:\Windows\System\pWITtVt.exe
  2⤵
  PID:3304
- C:\Windows\System\GteUFBh.exe
  C:\Windows\System\GteUFBh.exe
  2⤵
  PID:3300
- C:\Windows\System\lBIaArM.exe
  C:\Windows\System\lBIaArM.exe
  2⤵
  PID:3356
- C:\Windows\System\xKJHDnJ.exe
  C:\Windows\System\xKJHDnJ.exe
  2⤵
  PID:2792
- C:\Windows\System\NmyUlic.exe
  C:\Windows\System\NmyUlic.exe
  2⤵
  PID:1212
- C:\Windows\System\MJaFdZW.exe
  C:\Windows\System\MJaFdZW.exe
  2⤵
  PID:2872
- C:\Windows\System\FrirIas.exe
  C:\Windows\System\FrirIas.exe
  2⤵
  PID:3484
- C:\Windows\System\IqDdbvU.exe
  C:\Windows\System\IqDdbvU.exe
  2⤵
  PID:1436
- C:\Windows\System\lfOneqh.exe
  C:\Windows\System\lfOneqh.exe
  2⤵
  PID:3532
- C:\Windows\System\navmCVb.exe
  C:\Windows\System\navmCVb.exe
  2⤵
  PID:2612
- C:\Windows\System\ExFdsLq.exe
  C:\Windows\System\ExFdsLq.exe
  2⤵
  PID:3256
- C:\Windows\System\zZGoCgK.exe
  C:\Windows\System\zZGoCgK.exe
  2⤵
  PID:1652
- C:\Windows\System\AzRHjIy.exe
  C:\Windows\System\AzRHjIy.exe
  2⤵
  PID:3624
- C:\Windows\System\nQZRDGV.exe
  C:\Windows\System\nQZRDGV.exe
  2⤵
  PID:3504
- C:\Windows\System\KrVgSuZ.exe
  C:\Windows\System\KrVgSuZ.exe
  2⤵
  PID:2168
- C:\Windows\System\PTEliOa.exe
  C:\Windows\System\PTEliOa.exe
  2⤵
  PID:1976
- C:\Windows\System\VTIcnax.exe
  C:\Windows\System\VTIcnax.exe
  2⤵
  PID:2632
- C:\Windows\System\rtAIUmH.exe
  C:\Windows\System\rtAIUmH.exe
  2⤵
  PID:3740
- C:\Windows\System\RbuCTqR.exe
  C:\Windows\System\RbuCTqR.exe
  2⤵
  PID:1968
- C:\Windows\System\WAGIoWv.exe
  C:\Windows\System\WAGIoWv.exe
  2⤵
  PID:2284
- C:\Windows\System\EYvermh.exe
  C:\Windows\System\EYvermh.exe
  2⤵
  PID:3408
- C:\Windows\System\xGjJmnc.exe
  C:\Windows\System\xGjJmnc.exe
  2⤵
  PID:3768
- C:\Windows\System\nSHjNSa.exe
  C:\Windows\System\nSHjNSa.exe
  2⤵
  PID:3772
- C:\Windows\System\sIPWoxL.exe
  C:\Windows\System\sIPWoxL.exe
  2⤵
  PID:3808
- C:\Windows\System\qRTzwdw.exe
  C:\Windows\System\qRTzwdw.exe
  2⤵
  PID:3664
- C:\Windows\System\vmsazss.exe
  C:\Windows\System\vmsazss.exe
  2⤵
  PID:3180
- C:\Windows\System\irRLVmN.exe
  C:\Windows\System\irRLVmN.exe
  2⤵
  PID:2700
- C:\Windows\System\OUbwOXD.exe
  C:\Windows\System\OUbwOXD.exe
  2⤵
  PID:3880
- C:\Windows\System\vGqRwsa.exe
  C:\Windows\System\vGqRwsa.exe
  2⤵
  PID:3948
- C:\Windows\System\NymSiqZ.exe
  C:\Windows\System\NymSiqZ.exe
  2⤵
  PID:3828
- C:\Windows\System\ejUzgHI.exe
  C:\Windows\System\ejUzgHI.exe
  2⤵
  PID:2424
- C:\Windows\System\ffSHPDV.exe
  C:\Windows\System\ffSHPDV.exe
  2⤵
  PID:3924
- C:\Windows\System\uPqHEHG.exe
  C:\Windows\System\uPqHEHG.exe
  2⤵
  PID:4004
- C:\Windows\System\yAkoRMW.exe
  C:\Windows\System\yAkoRMW.exe
  2⤵
  PID:4068
- C:\Windows\System\ljJmsMi.exe
  C:\Windows\System\ljJmsMi.exe
  2⤵
  PID:2076
- C:\Windows\System\xhuAKNa.exe
  C:\Windows\System\xhuAKNa.exe
  2⤵
  PID:3452
- C:\Windows\System\kcBxhYm.exe
  C:\Windows\System\kcBxhYm.exe
  2⤵
  PID:4088
- C:\Windows\System\xwitLLY.exe
  C:\Windows\System\xwitLLY.exe
  2⤵
  PID:652
- C:\Windows\System\ijOCapK.exe
  C:\Windows\System\ijOCapK.exe
  2⤵
  PID:3680
- C:\Windows\System\teUwBLU.exe
  C:\Windows\System\teUwBLU.exe
  2⤵
  PID:4108
- C:\Windows\System\FitBNUc.exe
  C:\Windows\System\FitBNUc.exe
  2⤵
  PID:4124
- C:\Windows\System\LvqDXUF.exe
  C:\Windows\System\LvqDXUF.exe
  2⤵
  PID:4140
- C:\Windows\System\NelYNQX.exe
  C:\Windows\System\NelYNQX.exe
  2⤵
  PID:4156
- C:\Windows\System\XsaJFyP.exe
  C:\Windows\System\XsaJFyP.exe
  2⤵
  PID:4172
- C:\Windows\System\yBgihQY.exe
  C:\Windows\System\yBgihQY.exe
  2⤵
  PID:4188
- C:\Windows\System\zhxorhu.exe
  C:\Windows\System\zhxorhu.exe
  2⤵
  PID:4208
- C:\Windows\System\lDlYVkS.exe
  C:\Windows\System\lDlYVkS.exe
  2⤵
  PID:4224
- C:\Windows\System\SknZtXD.exe
  C:\Windows\System\SknZtXD.exe
  2⤵
  PID:4240
- C:\Windows\System\EqMDlIq.exe
  C:\Windows\System\EqMDlIq.exe
  2⤵
  PID:4256
- C:\Windows\System\YqQJxum.exe
  C:\Windows\System\YqQJxum.exe
  2⤵
  PID:4272
- C:\Windows\System\kICauab.exe
  C:\Windows\System\kICauab.exe
  2⤵
  PID:4288
- C:\Windows\System\BJGATMS.exe
  C:\Windows\System\BJGATMS.exe
  2⤵
  PID:4304
- C:\Windows\System\MmBLRkb.exe
  C:\Windows\System\MmBLRkb.exe
  2⤵
  PID:4324
- C:\Windows\System\qkPTcdf.exe
  C:\Windows\System\qkPTcdf.exe
  2⤵
  PID:4340
- C:\Windows\System\zuAqnhE.exe
  C:\Windows\System\zuAqnhE.exe
  2⤵
  PID:4356
- C:\Windows\System\HsfvcDg.exe
  C:\Windows\System\HsfvcDg.exe
  2⤵
  PID:4372
- C:\Windows\System\QbieVGq.exe
  C:\Windows\System\QbieVGq.exe
  2⤵
  PID:4388
- C:\Windows\System\KJQgAYZ.exe
  C:\Windows\System\KJQgAYZ.exe
  2⤵
  PID:4404
- C:\Windows\System\QPabLRV.exe
  C:\Windows\System\QPabLRV.exe
  2⤵
  PID:4420
- C:\Windows\System\LQrsKNH.exe
  C:\Windows\System\LQrsKNH.exe
  2⤵
  PID:4440
- C:\Windows\System\MbiPoHW.exe
  C:\Windows\System\MbiPoHW.exe
  2⤵
  PID:4456
- C:\Windows\System\MDpGeds.exe
  C:\Windows\System\MDpGeds.exe
  2⤵
  PID:4476
- C:\Windows\System\tbSFDMe.exe
  C:\Windows\System\tbSFDMe.exe
  2⤵
  PID:4492
- C:\Windows\System\TlQjgIX.exe
  C:\Windows\System\TlQjgIX.exe
  2⤵
  PID:4508
- C:\Windows\System\eTGIPFW.exe
  C:\Windows\System\eTGIPFW.exe
  2⤵
  PID:4524
- C:\Windows\System\ZscTlza.exe
  C:\Windows\System\ZscTlza.exe
  2⤵
  PID:4540
- C:\Windows\System\EccsbMl.exe
  C:\Windows\System\EccsbMl.exe
  2⤵
  PID:4592
- C:\Windows\System\SOsynDB.exe
  C:\Windows\System\SOsynDB.exe
  2⤵
  PID:4636
- C:\Windows\System\dxgQItd.exe
  C:\Windows\System\dxgQItd.exe
  2⤵
  PID:4652
- C:\Windows\System\XUGzCzJ.exe
  C:\Windows\System\XUGzCzJ.exe
  2⤵
  PID:4668
- C:\Windows\System\fthzWlh.exe
  C:\Windows\System\fthzWlh.exe
  2⤵
  PID:4684
- C:\Windows\System\cTSWTpF.exe
  C:\Windows\System\cTSWTpF.exe
  2⤵
  PID:4700
- C:\Windows\System\QSQYjGx.exe
  C:\Windows\System\QSQYjGx.exe
  2⤵
  PID:4716
- C:\Windows\System\yeUMlfh.exe
  C:\Windows\System\yeUMlfh.exe
  2⤵
  PID:4732
- C:\Windows\System\lHlJFTI.exe
  C:\Windows\System\lHlJFTI.exe
  2⤵
  PID:4748
- C:\Windows\System\fRamJvk.exe
  C:\Windows\System\fRamJvk.exe
  2⤵
  PID:4768
- C:\Windows\System\MmXqzht.exe
  C:\Windows\System\MmXqzht.exe
  2⤵
  PID:4784
- C:\Windows\System\fQZmBsE.exe
  C:\Windows\System\fQZmBsE.exe
  2⤵
  PID:4800
- C:\Windows\System\BQmJdAR.exe
  C:\Windows\System\BQmJdAR.exe
  2⤵
  PID:4816
- C:\Windows\System\PdiDWHV.exe
  C:\Windows\System\PdiDWHV.exe
  2⤵
  PID:4832
- C:\Windows\System\EawOUyM.exe
  C:\Windows\System\EawOUyM.exe
  2⤵
  PID:4848
- C:\Windows\System\iuYgEkE.exe
  C:\Windows\System\iuYgEkE.exe
  2⤵
  PID:4864
- C:\Windows\System\wHeOTWu.exe
  C:\Windows\System\wHeOTWu.exe
  2⤵
  PID:4880
- C:\Windows\System\QJOHqBk.exe
  C:\Windows\System\QJOHqBk.exe
  2⤵
  PID:4896
- C:\Windows\System\YeSfyrZ.exe
  C:\Windows\System\YeSfyrZ.exe
  2⤵
  PID:4912
- C:\Windows\System\hDgKAZb.exe
  C:\Windows\System\hDgKAZb.exe
  2⤵
  PID:4928
- C:\Windows\System\uTrZwks.exe
  C:\Windows\System\uTrZwks.exe
  2⤵
  PID:4944
- C:\Windows\System\ZtqhFtl.exe
  C:\Windows\System\ZtqhFtl.exe
  2⤵
  PID:4960
- C:\Windows\System\ypVEWNE.exe
  C:\Windows\System\ypVEWNE.exe
  2⤵
  PID:4976
- C:\Windows\System\WpEhLkb.exe
  C:\Windows\System\WpEhLkb.exe
  2⤵
  PID:4992
- C:\Windows\System\UeJTUJk.exe
  C:\Windows\System\UeJTUJk.exe
  2⤵
  PID:5008
- C:\Windows\System\bYilyBB.exe
  C:\Windows\System\bYilyBB.exe
  2⤵
  PID:5024
- C:\Windows\System\LyPwwhc.exe
  C:\Windows\System\LyPwwhc.exe
  2⤵
  PID:5040
- C:\Windows\System\joLweJG.exe
  C:\Windows\System\joLweJG.exe
  2⤵
  PID:5060
- C:\Windows\System\QGSmeQO.exe
  C:\Windows\System\QGSmeQO.exe
  2⤵
  PID:5076
- C:\Windows\System\DAAaklc.exe
  C:\Windows\System\DAAaklc.exe
  2⤵
  PID:5092
- C:\Windows\System\AftHOyl.exe
  C:\Windows\System\AftHOyl.exe
  2⤵
  PID:5108
- C:\Windows\System\uwZyvcE.exe
  C:\Windows\System\uwZyvcE.exe
  2⤵
  PID:3796
- C:\Windows\System\JFWbiNY.exe
  C:\Windows\System\JFWbiNY.exe
  2⤵
  PID:1912
- C:\Windows\System\OlnZvqN.exe
  C:\Windows\System\OlnZvqN.exe
  2⤵
  PID:2620
- C:\Windows\System\DLJhgoQ.exe
  C:\Windows\System\DLJhgoQ.exe
  2⤵
  PID:1156
- C:\Windows\System\QoOQlPa.exe
  C:\Windows\System\QoOQlPa.exe
  2⤵
  PID:3200
- C:\Windows\System\QyVQmiv.exe
  C:\Windows\System\QyVQmiv.exe
  2⤵
  PID:2436
- C:\Windows\System\pxGvTft.exe
  C:\Windows\System\pxGvTft.exe
  2⤵
  PID:3868
- C:\Windows\System\QRJsHyD.exe
  C:\Windows\System\QRJsHyD.exe
  2⤵
  PID:764
- C:\Windows\System\UfUFrHG.exe
  C:\Windows\System\UfUFrHG.exe
  2⤵
  PID:2652
- C:\Windows\System\RVLNfVJ.exe
  C:\Windows\System\RVLNfVJ.exe
  2⤵
  PID:3836
- C:\Windows\System\pOWLHkC.exe
  C:\Windows\System\pOWLHkC.exe
  2⤵
  PID:3896
- C:\Windows\System\PZWbucq.exe
  C:\Windows\System\PZWbucq.exe
  2⤵
  PID:3584
- C:\Windows\System\dExQEXT.exe
  C:\Windows\System\dExQEXT.exe
  2⤵
  PID:4104
- C:\Windows\System\TsrlcCJ.exe
  C:\Windows\System\TsrlcCJ.exe
  2⤵
  PID:4200
- C:\Windows\System\RZaPsRE.exe
  C:\Windows\System\RZaPsRE.exe
  2⤵
  PID:4236
- C:\Windows\System\NsbwdUr.exe
  C:\Windows\System\NsbwdUr.exe
  2⤵
  PID:4368
- C:\Windows\System\cRkbLHa.exe
  C:\Windows\System\cRkbLHa.exe
  2⤵
  PID:4464
- C:\Windows\System\tCeGpqZ.exe
  C:\Windows\System\tCeGpqZ.exe
  2⤵
  PID:2604
- C:\Windows\System\XSwAeJl.exe
  C:\Windows\System\XSwAeJl.exe
  2⤵
  PID:4332
- C:\Windows\System\YsJbsdu.exe
  C:\Windows\System\YsJbsdu.exe
  2⤵
  PID:4428
- C:\Windows\System\mluSuRC.exe
  C:\Windows\System\mluSuRC.exe
  2⤵
  PID:4504
- C:\Windows\System\jNUWEVi.exe
  C:\Windows\System\jNUWEVi.exe
  2⤵
  PID:2488
- C:\Windows\System\NeFQgpD.exe
  C:\Windows\System\NeFQgpD.exe
  2⤵
  PID:3120
- C:\Windows\System\gEfEAoS.exe
  C:\Windows\System\gEfEAoS.exe
  2⤵
  PID:3720
- C:\Windows\System\AkdQslK.exe
  C:\Windows\System\AkdQslK.exe
  2⤵
  PID:1416
- C:\Windows\System\hzJrHyk.exe
  C:\Windows\System\hzJrHyk.exe
  2⤵
  PID:3748
- C:\Windows\System\FzuQpmO.exe
  C:\Windows\System\FzuQpmO.exe
  2⤵
  PID:2624
- C:\Windows\System\AhzsCzQ.exe
  C:\Windows\System\AhzsCzQ.exe
  2⤵
  PID:3984
- C:\Windows\System\ksurVjT.exe
  C:\Windows\System\ksurVjT.exe
  2⤵
  PID:3952
- C:\Windows\System\SJWghhe.exe
  C:\Windows\System\SJWghhe.exe
  2⤵
  PID:2036
- C:\Windows\System\mwzyEvE.exe
  C:\Windows\System\mwzyEvE.exe
  2⤵
  PID:4488
- C:\Windows\System\WpNjXde.exe
  C:\Windows\System\WpNjXde.exe
  2⤵
  PID:4572
- C:\Windows\System\uOsHgCg.exe
  C:\Windows\System\uOsHgCg.exe
  2⤵
  PID:4180
- C:\Windows\System\eBWskRJ.exe
  C:\Windows\System\eBWskRJ.exe
  2⤵
  PID:4248
- C:\Windows\System\EDrgxdn.exe
  C:\Windows\System\EDrgxdn.exe
  2⤵
  PID:4600
- C:\Windows\System\iYqYqNt.exe
  C:\Windows\System\iYqYqNt.exe
  2⤵
  PID:4348
- C:\Windows\System\VVETghq.exe
  C:\Windows\System\VVETghq.exe
  2⤵
  PID:4412
- C:\Windows\System\iGEnHtG.exe
  C:\Windows\System\iGEnHtG.exe
  2⤵
  PID:4520
- C:\Windows\System\xsjLecH.exe
  C:\Windows\System\xsjLecH.exe
  2⤵
  PID:4568
- C:\Windows\System\rqrwCiT.exe
  C:\Windows\System\rqrwCiT.exe
  2⤵
  PID:4604
- C:\Windows\System\KiXnoHF.exe
  C:\Windows\System\KiXnoHF.exe
  2⤵
  PID:4628
- C:\Windows\System\JCFjoea.exe
  C:\Windows\System\JCFjoea.exe
  2⤵
  PID:4616
- C:\Windows\System\HaivupN.exe
  C:\Windows\System\HaivupN.exe
  2⤵
  PID:4756
- C:\Windows\System\qnJNWsc.exe
  C:\Windows\System\qnJNWsc.exe
  2⤵
  PID:4824
- C:\Windows\System\jtVShmP.exe
  C:\Windows\System\jtVShmP.exe
  2⤵
  PID:4920
- C:\Windows\System\SthqMjx.exe
  C:\Windows\System\SthqMjx.exe
  2⤵
  PID:4952
- C:\Windows\System\YVTahVJ.exe
  C:\Windows\System\YVTahVJ.exe
  2⤵
  PID:4892
- C:\Windows\System\qzINXmC.exe
  C:\Windows\System\qzINXmC.exe
  2⤵
  PID:5020
- C:\Windows\System\CCrYXjd.exe
  C:\Windows\System\CCrYXjd.exe
  2⤵
  PID:5084
- C:\Windows\System\yHuFsdB.exe
  C:\Windows\System\yHuFsdB.exe
  2⤵
  PID:4648
- C:\Windows\System\yfJMNUW.exe
  C:\Windows\System\yfJMNUW.exe
  2⤵
  PID:3788
- C:\Windows\System\GcPYGEq.exe
  C:\Windows\System\GcPYGEq.exe
  2⤵
  PID:4744
- C:\Windows\System\JpZuTCp.exe
  C:\Windows\System\JpZuTCp.exe
  2⤵
  PID:4812
- C:\Windows\System\DgjbHyq.exe
  C:\Windows\System\DgjbHyq.exe
  2⤵
  PID:4876
- C:\Windows\System\gWgcDrM.exe
  C:\Windows\System\gWgcDrM.exe
  2⤵
  PID:4940
- C:\Windows\System\quwzWNH.exe
  C:\Windows\System\quwzWNH.exe
  2⤵
  PID:5004
- C:\Windows\System\ngTtrFu.exe
  C:\Windows\System\ngTtrFu.exe
  2⤵
  PID:5072
- C:\Windows\System\lOFIQXq.exe
  C:\Windows\System\lOFIQXq.exe
  2⤵
  PID:3864
- C:\Windows\System\yxlETmW.exe
  C:\Windows\System\yxlETmW.exe
  2⤵
  PID:1084
- C:\Windows\System\stPsnwS.exe
  C:\Windows\System\stPsnwS.exe
  2⤵
  PID:3100
- C:\Windows\System\NvIYEfu.exe
  C:\Windows\System\NvIYEfu.exe
  2⤵
  PID:1728
- C:\Windows\System\rnYiYPJ.exe
  C:\Windows\System\rnYiYPJ.exe
  2⤵
  PID:4204
- C:\Windows\System\xjQygJT.exe
  C:\Windows\System\xjQygJT.exe
  2⤵
  PID:4296
- C:\Windows\System\LrINABn.exe
  C:\Windows\System\LrINABn.exe
  2⤵
  PID:4472
- C:\Windows\System\scZvsii.exe
  C:\Windows\System\scZvsii.exe
  2⤵
  PID:3816
- C:\Windows\System\msvuyiN.exe
  C:\Windows\System\msvuyiN.exe
  2⤵
  PID:2960
- C:\Windows\System\HuVjGqf.exe
  C:\Windows\System\HuVjGqf.exe
  2⤵
  PID:4148
- C:\Windows\System\TxXFedg.exe
  C:\Windows\System\TxXFedg.exe
  2⤵
  PID:2824
- C:\Windows\System\LtttkqS.exe
  C:\Windows\System\LtttkqS.exe
  2⤵
  PID:2292
- C:\Windows\System\xhPrRtZ.exe
  C:\Windows\System\xhPrRtZ.exe
  2⤵
  PID:1764
- C:\Windows\System\DbueMNj.exe
  C:\Windows\System\DbueMNj.exe
  2⤵
  PID:3520
- C:\Windows\System\bdSgTnY.exe
  C:\Windows\System\bdSgTnY.exe
  2⤵
  PID:4536
- C:\Windows\System\nvVQdkj.exe
  C:\Windows\System\nvVQdkj.exe
  2⤵
  PID:3376
- C:\Windows\System\RQegiBK.exe
  C:\Windows\System\RQegiBK.exe
  2⤵
  PID:3480
- C:\Windows\System\mqiijeA.exe
  C:\Windows\System\mqiijeA.exe
  2⤵
  PID:1428
- C:\Windows\System\SsbJTBe.exe
  C:\Windows\System\SsbJTBe.exe
  2⤵
  PID:4220
- C:\Windows\System\HvKDLoj.exe
  C:\Windows\System\HvKDLoj.exe
  2⤵
  PID:4560
- C:\Windows\System\HhsqbGL.exe
  C:\Windows\System\HhsqbGL.exe
  2⤵
  PID:4620
- C:\Windows\System\NNAywsu.exe
  C:\Windows\System\NNAywsu.exe
  2⤵
  PID:4624
- C:\Windows\System\hHofiQG.exe
  C:\Windows\System\hHofiQG.exe
  2⤵
  PID:4796
- C:\Windows\System\ZOWNUNk.exe
  C:\Windows\System\ZOWNUNk.exe
  2⤵
  PID:4584
- C:\Windows\System\ptOItIu.exe
  C:\Windows\System\ptOItIu.exe
  2⤵
  PID:4792
- C:\Windows\System\BZmzeFj.exe
  C:\Windows\System\BZmzeFj.exe
  2⤵
  PID:5056
- C:\Windows\System\sZrovnJ.exe
  C:\Windows\System\sZrovnJ.exe
  2⤵
  PID:5116
- C:\Windows\System\RXWmrQj.exe
  C:\Windows\System\RXWmrQj.exe
  2⤵
  PID:4936
- C:\Windows\System\RALOtKx.exe
  C:\Windows\System\RALOtKx.exe
  2⤵
  PID:3876
- C:\Windows\System\gcOpilK.exe
  C:\Windows\System\gcOpilK.exe
  2⤵
  PID:2352
- C:\Windows\System\bhoItBo.exe
  C:\Windows\System\bhoItBo.exe
  2⤵
  PID:3132
- C:\Windows\System\vGuPofI.exe
  C:\Windows\System\vGuPofI.exe
  2⤵
  PID:1116
- C:\Windows\System\KMTSYGq.exe
  C:\Windows\System\KMTSYGq.exe
  2⤵
  PID:3892
- C:\Windows\System\TatOVzw.exe
  C:\Windows\System\TatOVzw.exe
  2⤵
  PID:4380
- C:\Windows\System\nGKaOwj.exe
  C:\Windows\System\nGKaOwj.exe
  2⤵
  PID:4608
- C:\Windows\System\klEfiVg.exe
  C:\Windows\System\klEfiVg.exe
  2⤵
  PID:4908
- C:\Windows\System\wCUMXwD.exe
  C:\Windows\System\wCUMXwD.exe
  2⤵
  PID:2952
- C:\Windows\System\fPBKQTK.exe
  C:\Windows\System\fPBKQTK.exe
  2⤵
  PID:2868
- C:\Windows\System\itphRzh.exe
  C:\Windows\System\itphRzh.exe
  2⤵
  PID:5128
- C:\Windows\System\AzjDrpj.exe
  C:\Windows\System\AzjDrpj.exe
  2⤵
  PID:5144
- C:\Windows\System\YWvSbEw.exe
  C:\Windows\System\YWvSbEw.exe
  2⤵
  PID:5168
- C:\Windows\System\sFcPRDY.exe
  C:\Windows\System\sFcPRDY.exe
  2⤵
  PID:5184
- C:\Windows\System\ROGXUWT.exe
  C:\Windows\System\ROGXUWT.exe
  2⤵
  PID:5200
- C:\Windows\System\sOKqomC.exe
  C:\Windows\System\sOKqomC.exe
  2⤵
  PID:5216
- C:\Windows\System\PSRXLew.exe
  C:\Windows\System\PSRXLew.exe
  2⤵
  PID:5232
- C:\Windows\System\IDDYZAl.exe
  C:\Windows\System\IDDYZAl.exe
  2⤵
  PID:5248
- C:\Windows\System\BKGyyRs.exe
  C:\Windows\System\BKGyyRs.exe
  2⤵
  PID:5264
- C:\Windows\System\IJFxWsR.exe
  C:\Windows\System\IJFxWsR.exe
  2⤵
  PID:5280
- C:\Windows\System\RyioFsu.exe
  C:\Windows\System\RyioFsu.exe
  2⤵
  PID:5296
- C:\Windows\System\XjihtuU.exe
  C:\Windows\System\XjihtuU.exe
  2⤵
  PID:5312
- C:\Windows\System\mndhprI.exe
  C:\Windows\System\mndhprI.exe
  2⤵
  PID:5328
- C:\Windows\System\fLCkOKY.exe
  C:\Windows\System\fLCkOKY.exe
  2⤵
  PID:5356
- C:\Windows\System\xMHPjjL.exe
  C:\Windows\System\xMHPjjL.exe
  2⤵
  PID:5400
- C:\Windows\System\LZqUYtV.exe
  C:\Windows\System\LZqUYtV.exe
  2⤵
  PID:5416
- C:\Windows\System\IgofThO.exe
  C:\Windows\System\IgofThO.exe
  2⤵
  PID:5432
- C:\Windows\System\kllIdTr.exe
  C:\Windows\System\kllIdTr.exe
  2⤵
  PID:5448
- C:\Windows\System\MMDODAr.exe
  C:\Windows\System\MMDODAr.exe
  2⤵
  PID:5464
- C:\Windows\System\AbOnqSQ.exe
  C:\Windows\System\AbOnqSQ.exe
  2⤵
  PID:5576
- C:\Windows\System\uxKMdfc.exe
  C:\Windows\System\uxKMdfc.exe
  2⤵
  PID:5736
- C:\Windows\System\YzIsFzO.exe
  C:\Windows\System\YzIsFzO.exe
  2⤵
  PID:5912
- C:\Windows\System\GgUxudp.exe
  C:\Windows\System\GgUxudp.exe
  2⤵
  PID:5940
- C:\Windows\System\ltEjPNY.exe
  C:\Windows\System\ltEjPNY.exe
  2⤵
  PID:5960
- C:\Windows\System\JkfcsHV.exe
  C:\Windows\System\JkfcsHV.exe
  2⤵
  PID:5980
- C:\Windows\System\xhxIiDG.exe
  C:\Windows\System\xhxIiDG.exe
  2⤵
  PID:5996
- C:\Windows\System\RvDwGFX.exe
  C:\Windows\System\RvDwGFX.exe
  2⤵
  PID:6012
- C:\Windows\System\KbQuOdd.exe
  C:\Windows\System\KbQuOdd.exe
  2⤵
  PID:6028
- C:\Windows\System\bXSPdbx.exe
  C:\Windows\System\bXSPdbx.exe
  2⤵
  PID:6048
- C:\Windows\System\arCvcYZ.exe
  C:\Windows\System\arCvcYZ.exe
  2⤵
  PID:6064
- C:\Windows\System\cQjKleE.exe
  C:\Windows\System\cQjKleE.exe
  2⤵
  PID:6080
- C:\Windows\System\IBzhsJQ.exe
  C:\Windows\System\IBzhsJQ.exe
  2⤵
  PID:6100
- C:\Windows\System\sRUCpfn.exe
  C:\Windows\System\sRUCpfn.exe
  2⤵
  PID:6116
- C:\Windows\System\jnTxUoh.exe
  C:\Windows\System\jnTxUoh.exe
  2⤵
  PID:5176
- C:\Windows\System\BDtkbZx.exe
  C:\Windows\System\BDtkbZx.exe
  2⤵
  PID:3184
- C:\Windows\System\MFAoaJr.exe
  C:\Windows\System\MFAoaJr.exe
  2⤵
  PID:4468
- C:\Windows\System\ZLwocGH.exe
  C:\Windows\System\ZLwocGH.exe
  2⤵
  PID:4164
- C:\Windows\System\BLGNkxd.exe
  C:\Windows\System\BLGNkxd.exe
  2⤵
  PID:4552
- C:\Windows\System\PSzJvJX.exe
  C:\Windows\System\PSzJvJX.exe
  2⤵
  PID:4452
- C:\Windows\System\nwdyoPi.exe
  C:\Windows\System\nwdyoPi.exe
  2⤵
  PID:4660
- C:\Windows\System\JiYzksl.exe
  C:\Windows\System\JiYzksl.exe
  2⤵
  PID:5068
- C:\Windows\System\EVsTUNN.exe
  C:\Windows\System\EVsTUNN.exe
  2⤵
  PID:2944
- C:\Windows\System\IdhmcJh.exe
  C:\Windows\System\IdhmcJh.exe
  2⤵
  PID:4808
- C:\Windows\System\gmPggWR.exe
  C:\Windows\System\gmPggWR.exe
  2⤵
  PID:5160
- C:\Windows\System\WKiqLWS.exe
  C:\Windows\System\WKiqLWS.exe
  2⤵
  PID:5224
- C:\Windows\System\YnnoHIh.exe
  C:\Windows\System\YnnoHIh.exe
  2⤵
  PID:5320
- C:\Windows\System\YsTHVOb.exe
  C:\Windows\System\YsTHVOb.exe
  2⤵
  PID:2600
- C:\Windows\System\ToxEjkN.exe
  C:\Windows\System\ToxEjkN.exe
  2⤵
  PID:2468
- C:\Windows\System\MLBrJiQ.exe
  C:\Windows\System\MLBrJiQ.exe
  2⤵
  PID:5440
- C:\Windows\System\PXjngve.exe
  C:\Windows\System\PXjngve.exe
  2⤵
  PID:5384
- C:\Windows\System\VpMnXmN.exe
  C:\Windows\System\VpMnXmN.exe
  2⤵
  PID:5396
- C:\Windows\System\vRxHgRo.exe
  C:\Windows\System\vRxHgRo.exe
  2⤵
  PID:5484
- C:\Windows\System\jmwJGfJ.exe
  C:\Windows\System\jmwJGfJ.exe
  2⤵
  PID:5504
- C:\Windows\System\cSrhZvf.exe
  C:\Windows\System\cSrhZvf.exe
  2⤵
  PID:5496
- C:\Windows\System\VVMbGcU.exe
  C:\Windows\System\VVMbGcU.exe
  2⤵
  PID:5548
- C:\Windows\System\tFKvFWy.exe
  C:\Windows\System\tFKvFWy.exe
  2⤵
  PID:5584
- C:\Windows\System\KUNHjZd.exe
  C:\Windows\System\KUNHjZd.exe
  2⤵
  PID:5560
- C:\Windows\System\FkFXThK.exe
  C:\Windows\System\FkFXThK.exe
  2⤵
  PID:5652
- C:\Windows\System\nmbzHRG.exe
  C:\Windows\System\nmbzHRG.exe
  2⤵
  PID:5668
- C:\Windows\System\UfqGfSk.exe
  C:\Windows\System\UfqGfSk.exe
  2⤵
  PID:5684
- C:\Windows\System\fVckvyW.exe
  C:\Windows\System\fVckvyW.exe
  2⤵
  PID:5700
- C:\Windows\System\TAykVCE.exe
  C:\Windows\System\TAykVCE.exe
  2⤵
  PID:5716
- C:\Windows\System\cilooMN.exe
  C:\Windows\System\cilooMN.exe
  2⤵
  PID:5724
- C:\Windows\System\VdBlswB.exe
  C:\Windows\System\VdBlswB.exe
  2⤵
  PID:5756
- C:\Windows\System\eVlwooL.exe
  C:\Windows\System\eVlwooL.exe
  2⤵
  PID:5920
- C:\Windows\System\YndbJze.exe
  C:\Windows\System\YndbJze.exe
  2⤵
  PID:5852
- C:\Windows\System\GwqvzjJ.exe
  C:\Windows\System\GwqvzjJ.exe
  2⤵
  PID:5900
- C:\Windows\System\RUVxuIr.exe
  C:\Windows\System\RUVxuIr.exe
  2⤵
  PID:5792
- C:\Windows\System\qzMLuxx.exe
  C:\Windows\System\qzMLuxx.exe
  2⤵
  PID:5812
- C:\Windows\System\aVJyZWV.exe
  C:\Windows\System\aVJyZWV.exe
  2⤵
  PID:5844
- C:\Windows\System\CBZkUoT.exe
  C:\Windows\System\CBZkUoT.exe
  2⤵
  PID:5868
- C:\Windows\System\VOZifBF.exe
  C:\Windows\System\VOZifBF.exe
  2⤵
  PID:5936
- C:\Windows\System\bgKiIDH.exe
  C:\Windows\System\bgKiIDH.exe
  2⤵
  PID:6036
- C:\Windows\System\HvqEdCR.exe
  C:\Windows\System\HvqEdCR.exe
  2⤵
  PID:6076
- C:\Windows\System\sUkCfIk.exe
  C:\Windows\System\sUkCfIk.exe
  2⤵
  PID:6020
- C:\Windows\System\arImhWu.exe
  C:\Windows\System\arImhWu.exe
  2⤵
  PID:5948
- C:\Windows\System\fbLVXvU.exe
  C:\Windows\System\fbLVXvU.exe
  2⤵
  PID:5992
- C:\Windows\System\mGYMFeM.exe
  C:\Windows\System\mGYMFeM.exe
  2⤵
  PID:6140
- C:\Windows\System\FPgMFIx.exe
  C:\Windows\System\FPgMFIx.exe
  2⤵
  PID:1320
- C:\Windows\System\QgEHHFC.exe
  C:\Windows\System\QgEHHFC.exe
  2⤵
  PID:5240
- C:\Windows\System\mzRPJzG.exe
  C:\Windows\System\mzRPJzG.exe
  2⤵
  PID:5152
- C:\Windows\System\nvxskFx.exe
  C:\Windows\System\nvxskFx.exe
  2⤵
  PID:5260
- C:\Windows\System\aHMBgFQ.exe
  C:\Windows\System\aHMBgFQ.exe
  2⤵
  PID:4988
- C:\Windows\System\JvrNVKw.exe
  C:\Windows\System\JvrNVKw.exe
  2⤵
  PID:5456
- C:\Windows\System\vIYJvDG.exe
  C:\Windows\System\vIYJvDG.exe
  2⤵
  PID:5480
- C:\Windows\System\jffDMrZ.exe
  C:\Windows\System\jffDMrZ.exe
  2⤵
  PID:5568
- C:\Windows\System\GfZwUWR.exe
  C:\Windows\System\GfZwUWR.exe
  2⤵
  PID:5884
- C:\Windows\System\rMfvgYs.exe
  C:\Windows\System\rMfvgYs.exe
  2⤵
  PID:5376
- C:\Windows\System\wfbMPdR.exe
  C:\Windows\System\wfbMPdR.exe
  2⤵
  PID:5692
- C:\Windows\System\VCVkJaf.exe
  C:\Windows\System\VCVkJaf.exe
  2⤵
  PID:5348
- C:\Windows\System\WWRKWii.exe
  C:\Windows\System\WWRKWii.exe
  2⤵
  PID:5460
- C:\Windows\System\NaRBPAi.exe
  C:\Windows\System\NaRBPAi.exe
  2⤵
  PID:5772
- C:\Windows\System\UUTbkkl.exe
  C:\Windows\System\UUTbkkl.exe
  2⤵
  PID:6060
- C:\Windows\System\fARnBJW.exe
  C:\Windows\System\fARnBJW.exe
  2⤵
  PID:5800
- C:\Windows\System\nXOXOGc.exe
  C:\Windows\System\nXOXOGc.exe
  2⤵
  PID:5856
- C:\Windows\System\djtRcDV.exe
  C:\Windows\System\djtRcDV.exe
  2⤵
  PID:5408
- C:\Windows\System\WwMYTbV.exe
  C:\Windows\System\WwMYTbV.exe
  2⤵
  PID:5976
- C:\Windows\System\AJULZEV.exe
  C:\Windows\System\AJULZEV.exe
  2⤵
  PID:5272
- C:\Windows\System\BcorWPL.exe
  C:\Windows\System\BcorWPL.exe
  2⤵
  PID:5956
- C:\Windows\System\MNPHwcC.exe
  C:\Windows\System\MNPHwcC.exe
  2⤵
  PID:4320
- C:\Windows\System\tDMQies.exe
  C:\Windows\System\tDMQies.exe
  2⤵
  PID:6124
- C:\Windows\System\TOLmLaz.exe
  C:\Windows\System\TOLmLaz.exe
  2⤵
  PID:5104
- C:\Windows\System\KDeHdtu.exe
  C:\Windows\System\KDeHdtu.exe
  2⤵
  PID:3412
- C:\Windows\System\lJPJxzN.exe
  C:\Windows\System\lJPJxzN.exe
  2⤵
  PID:4588
- C:\Windows\System\WhCImrI.exe
  C:\Windows\System\WhCImrI.exe
  2⤵
  PID:4396
- C:\Windows\System\KjeiGzc.exe
  C:\Windows\System\KjeiGzc.exe
  2⤵
  PID:5428
- C:\Windows\System\oHJFfHP.exe
  C:\Windows\System\oHJFfHP.exe
  2⤵
  PID:2976
- C:\Windows\System\FsJcfuw.exe
  C:\Windows\System\FsJcfuw.exe
  2⤵
  PID:4680
- C:\Windows\System\hLQcoNf.exe
  C:\Windows\System\hLQcoNf.exe
  2⤵
  PID:3168
- C:\Windows\System\Bllftry.exe
  C:\Windows\System\Bllftry.exe
  2⤵
  PID:1684
- C:\Windows\System\vDJsnYX.exe
  C:\Windows\System\vDJsnYX.exe
  2⤵
  PID:5472
- C:\Windows\System\ivQPpFg.exe
  C:\Windows\System\ivQPpFg.exe
  2⤵
  PID:5708
- C:\Windows\System\goqCykA.exe
  C:\Windows\System\goqCykA.exe
  2⤵
  PID:5932
- C:\Windows\System\rKyxELl.exe
  C:\Windows\System\rKyxELl.exe
  2⤵
  PID:5324
- C:\Windows\System\IihRCAT.exe
  C:\Windows\System\IihRCAT.exe
  2⤵
  PID:5832
- C:\Windows\System\QOYhnPQ.exe
  C:\Windows\System\QOYhnPQ.exe
  2⤵
  PID:4268
- C:\Windows\System\PVviMfC.exe
  C:\Windows\System\PVviMfC.exe
  2⤵
  PID:5600
- C:\Windows\System\DnYaNgp.exe
  C:\Windows\System\DnYaNgp.exe
  2⤵
  PID:5520
- C:\Windows\System\FSnnGnI.exe
  C:\Windows\System\FSnnGnI.exe
  2⤵
  PID:6112
- C:\Windows\System\kRUYvge.exe
  C:\Windows\System\kRUYvge.exe
  2⤵
  PID:6092
- C:\Windows\System\lXofrYh.exe
  C:\Windows\System\lXofrYh.exe
  2⤵
  PID:5988
- C:\Windows\System\HkmXqJd.exe
  C:\Windows\System\HkmXqJd.exe
  2⤵
  PID:6072
- C:\Windows\System\LJTKnfo.exe
  C:\Windows\System\LJTKnfo.exe
  2⤵
  PID:5876
- C:\Windows\System\dtCxmFH.exe
  C:\Windows\System\dtCxmFH.exe
  2⤵
  PID:5292
- C:\Windows\System\kggVXhm.exe
  C:\Windows\System\kggVXhm.exe
  2⤵
  PID:5536
- C:\Windows\System\qQSLVuz.exe
  C:\Windows\System\qQSLVuz.exe
  2⤵
  PID:6008
- C:\Windows\System\lORVJFb.exe
  C:\Windows\System\lORVJFb.exe
  2⤵
  PID:5752
- C:\Windows\System\MLwdIbY.exe
  C:\Windows\System\MLwdIbY.exe
  2⤵
  PID:4100
- C:\Windows\System\NnBGllT.exe
  C:\Windows\System\NnBGllT.exe
  2⤵
  PID:4280
- C:\Windows\System\uPdXPRq.exe
  C:\Windows\System\uPdXPRq.exe
  2⤵
  PID:5500
- C:\Windows\System\XgpFpdV.exe
  C:\Windows\System\XgpFpdV.exe
  2⤵
  PID:5676
- C:\Windows\System\NwiVJxJ.exe
  C:\Windows\System\NwiVJxJ.exe
  2⤵
  PID:5820
- C:\Windows\System\ZPVEvcM.exe
  C:\Windows\System\ZPVEvcM.exe
  2⤵
  PID:5880
- C:\Windows\System\bIgwIlS.exe
  C:\Windows\System\bIgwIlS.exe
  2⤵
  PID:5892
- C:\Windows\System\ukfsUIC.exe
  C:\Windows\System\ukfsUIC.exe
  2⤵
  PID:5904
- C:\Windows\System\XciDVkA.exe
  C:\Windows\System\XciDVkA.exe
  2⤵
  PID:2368
- C:\Windows\System\cXHcbwp.exe
  C:\Windows\System\cXHcbwp.exe
  2⤵
  PID:2556
- C:\Windows\System\xstTOdy.exe
  C:\Windows\System\xstTOdy.exe
  2⤵
  PID:4844
- C:\Windows\System\fKeHTRe.exe
  C:\Windows\System\fKeHTRe.exe
  2⤵
  PID:4400
- C:\Windows\System\tbSRvFj.exe
  C:\Windows\System\tbSRvFj.exe
  2⤵
  PID:3360
- C:\Windows\System\SyQcxBR.exe
  C:\Windows\System\SyQcxBR.exe
  2⤵
  PID:5508
- C:\Windows\System\ZaKJOJy.exe
  C:\Windows\System\ZaKJOJy.exe
  2⤵
  PID:5924
- C:\Windows\System\XtvKrKz.exe
  C:\Windows\System\XtvKrKz.exe
  2⤵
  PID:2504
- C:\Windows\System\Gyhuxzb.exe
  C:\Windows\System\Gyhuxzb.exe
  2⤵
  PID:5660
- C:\Windows\System\zXLNMpT.exe
  C:\Windows\System\zXLNMpT.exe
  2⤵
  PID:6152
- C:\Windows\System\UUvsKDE.exe
  C:\Windows\System\UUvsKDE.exe
  2⤵
  PID:6168
- C:\Windows\System\LPTuWWb.exe
  C:\Windows\System\LPTuWWb.exe
  2⤵
  PID:6184
- C:\Windows\System\GVZoNuX.exe
  C:\Windows\System\GVZoNuX.exe
  2⤵
  PID:6200
- C:\Windows\System\ibRLVUV.exe
  C:\Windows\System\ibRLVUV.exe
  2⤵
  PID:6216
- C:\Windows\System\hAGBwyP.exe
  C:\Windows\System\hAGBwyP.exe
  2⤵
  PID:6232
- C:\Windows\System\wJcSSsh.exe
  C:\Windows\System\wJcSSsh.exe
  2⤵
  PID:6248
- C:\Windows\System\GBVKcVF.exe
  C:\Windows\System\GBVKcVF.exe
  2⤵
  PID:6264
- C:\Windows\System\GcAVgaA.exe
  C:\Windows\System\GcAVgaA.exe
  2⤵
  PID:6280
- C:\Windows\System\HOEsIGE.exe
  C:\Windows\System\HOEsIGE.exe
  2⤵
  PID:6296
- C:\Windows\System\KmraHWA.exe
  C:\Windows\System\KmraHWA.exe
  2⤵
  PID:6312
- C:\Windows\System\cbuGlSf.exe
  C:\Windows\System\cbuGlSf.exe
  2⤵
  PID:6328
- C:\Windows\System\uZrXtqd.exe
  C:\Windows\System\uZrXtqd.exe
  2⤵
  PID:6344
- C:\Windows\System\knUpkwK.exe
  C:\Windows\System\knUpkwK.exe
  2⤵
  PID:6360
- C:\Windows\System\LyLnzEh.exe
  C:\Windows\System\LyLnzEh.exe
  2⤵
  PID:6376
- C:\Windows\System\fgZxXiv.exe
  C:\Windows\System\fgZxXiv.exe
  2⤵
  PID:6392
- C:\Windows\System\LhRxrAD.exe
  C:\Windows\System\LhRxrAD.exe
  2⤵
  PID:6408
- C:\Windows\System\CmPuFRR.exe
  C:\Windows\System\CmPuFRR.exe
  2⤵
  PID:6424
- C:\Windows\System\gurpXZs.exe
  C:\Windows\System\gurpXZs.exe
  2⤵
  PID:6440
- C:\Windows\System\cezcgWL.exe
  C:\Windows\System\cezcgWL.exe
  2⤵
  PID:6456
- C:\Windows\System\yjDRjud.exe
  C:\Windows\System\yjDRjud.exe
  2⤵
  PID:6472
- C:\Windows\System\wLstbbU.exe
  C:\Windows\System\wLstbbU.exe
  2⤵
  PID:6488
- C:\Windows\System\zDAyXja.exe
  C:\Windows\System\zDAyXja.exe
  2⤵
  PID:6504
- C:\Windows\System\sYnRMwJ.exe
  C:\Windows\System\sYnRMwJ.exe
  2⤵
  PID:6520
- C:\Windows\System\coNzDqR.exe
  C:\Windows\System\coNzDqR.exe
  2⤵
  PID:6536
- C:\Windows\System\qrTFDjo.exe
  C:\Windows\System\qrTFDjo.exe
  2⤵
  PID:6552
- C:\Windows\System\XuCrvlI.exe
  C:\Windows\System\XuCrvlI.exe
  2⤵
  PID:6568
- C:\Windows\System\dTDWgdS.exe
  C:\Windows\System\dTDWgdS.exe
  2⤵
  PID:6584
- C:\Windows\System\czAOvtA.exe
  C:\Windows\System\czAOvtA.exe
  2⤵
  PID:6600
- C:\Windows\System\acDQwKG.exe
  C:\Windows\System\acDQwKG.exe
  2⤵
  PID:6616
- C:\Windows\System\YgeVQbA.exe
  C:\Windows\System\YgeVQbA.exe
  2⤵
  PID:6632
- C:\Windows\System\nYaqnTg.exe
  C:\Windows\System\nYaqnTg.exe
  2⤵
  PID:6648
- C:\Windows\System\jLIToRn.exe
  C:\Windows\System\jLIToRn.exe
  2⤵
  PID:6664
- C:\Windows\System\BlcTscA.exe
  C:\Windows\System\BlcTscA.exe
  2⤵
  PID:6680
- C:\Windows\System\jFAickY.exe
  C:\Windows\System\jFAickY.exe
  2⤵
  PID:6700
- C:\Windows\System\xkkCMEa.exe
  C:\Windows\System\xkkCMEa.exe
  2⤵
  PID:6796
- C:\Windows\System\NHaHiwP.exe
  C:\Windows\System\NHaHiwP.exe
  2⤵
  PID:6896
- C:\Windows\System\NoCFSkq.exe
  C:\Windows\System\NoCFSkq.exe
  2⤵
  PID:6928
- C:\Windows\System\wKWoGAd.exe
  C:\Windows\System\wKWoGAd.exe
  2⤵
  PID:6944
- C:\Windows\System\lMxyRDj.exe
  C:\Windows\System\lMxyRDj.exe
  2⤵
  PID:6960
- C:\Windows\System\jsXexXD.exe
  C:\Windows\System\jsXexXD.exe
  2⤵
  PID:6976
- C:\Windows\System\ALWzQOd.exe
  C:\Windows\System\ALWzQOd.exe
  2⤵
  PID:6992
- C:\Windows\System\KtIjpFJ.exe
  C:\Windows\System\KtIjpFJ.exe
  2⤵
  PID:7008
- C:\Windows\System\xwIlTCB.exe
  C:\Windows\System\xwIlTCB.exe
  2⤵
  PID:7024
- C:\Windows\System\rmgjnNy.exe
  C:\Windows\System\rmgjnNy.exe
  2⤵
  PID:7040
- C:\Windows\System\ZpdRTNc.exe
  C:\Windows\System\ZpdRTNc.exe
  2⤵
  PID:7060
- C:\Windows\System\wQklxnq.exe
  C:\Windows\System\wQklxnq.exe
  2⤵
  PID:7076
- C:\Windows\System\GLBtPWo.exe
  C:\Windows\System\GLBtPWo.exe
  2⤵
  PID:7092
- C:\Windows\System\YWLxYkS.exe
  C:\Windows\System\YWLxYkS.exe
  2⤵
  PID:7108
- C:\Windows\System\ZJzDFwK.exe
  C:\Windows\System\ZJzDFwK.exe
  2⤵
  PID:7124
- C:\Windows\System\UUgygyb.exe
  C:\Windows\System\UUgygyb.exe
  2⤵
  PID:7144
- C:\Windows\System\FagbdEK.exe
  C:\Windows\System\FagbdEK.exe
  2⤵
  PID:7160
- C:\Windows\System\JixQUZD.exe
  C:\Windows\System\JixQUZD.exe
  2⤵
  PID:5444
- C:\Windows\System\ohQVdHa.exe
  C:\Windows\System\ohQVdHa.exe
  2⤵
  PID:6192
- C:\Windows\System\wVQJoEx.exe
  C:\Windows\System\wVQJoEx.exe
  2⤵
  PID:6256
- C:\Windows\System\bdWprPc.exe
  C:\Windows\System\bdWprPc.exe
  2⤵
  PID:6320
- C:\Windows\System\ZXAwkci.exe
  C:\Windows\System\ZXAwkci.exe
  2⤵
  PID:6384
- C:\Windows\System\foHCElk.exe
  C:\Windows\System\foHCElk.exe
  2⤵
  PID:5344
- C:\Windows\System\OiJVQoe.exe
  C:\Windows\System\OiJVQoe.exe
  2⤵
  PID:5664
- C:\Windows\System\LQUGmoC.exe
  C:\Windows\System\LQUGmoC.exe
  2⤵
  PID:6276
- C:\Windows\System\LcEEPHH.exe
  C:\Windows\System\LcEEPHH.exe
  2⤵
  PID:6340
- C:\Windows\System\rzVCAOD.exe
  C:\Windows\System\rzVCAOD.exe
  2⤵
  PID:6404
- C:\Windows\System\qXWboCe.exe
  C:\Windows\System\qXWboCe.exe
  2⤵
  PID:6176
- C:\Windows\System\qfEwjWZ.exe
  C:\Windows\System\qfEwjWZ.exe
  2⤵
  PID:6208
- C:\Windows\System\IMuJRls.exe
  C:\Windows\System\IMuJRls.exe
  2⤵
  PID:6464
- C:\Windows\System\bJNALPo.exe
  C:\Windows\System\bJNALPo.exe
  2⤵
  PID:6516
- C:\Windows\System\sgFBOOR.exe
  C:\Windows\System\sgFBOOR.exe
  2⤵
  PID:6580
- C:\Windows\System\HYbiHRI.exe
  C:\Windows\System\HYbiHRI.exe
  2⤵
  PID:6640
- C:\Windows\System\LVxMPGY.exe
  C:\Windows\System\LVxMPGY.exe
  2⤵
  PID:6560
- C:\Windows\System\zOqFegk.exe
  C:\Windows\System\zOqFegk.exe
  2⤵
  PID:6676
- C:\Windows\System\HDdJsLy.exe
  C:\Windows\System\HDdJsLy.exe
  2⤵
  PID:6708
- C:\Windows\System\rStSbHC.exe
  C:\Windows\System\rStSbHC.exe
  2⤵
  PID:6692
- C:\Windows\System\odlFCWx.exe
  C:\Windows\System\odlFCWx.exe
  2⤵
  PID:6716
- C:\Windows\System\ytJgicu.exe
  C:\Windows\System\ytJgicu.exe
  2⤵
  PID:6720
- C:\Windows\System\hCWAedx.exe
  C:\Windows\System\hCWAedx.exe
  2⤵
  PID:6748
- C:\Windows\System\yAbKAsO.exe
  C:\Windows\System\yAbKAsO.exe
  2⤵
  PID:6764
- C:\Windows\System\iFOPLhi.exe
  C:\Windows\System\iFOPLhi.exe
  2⤵
  PID:6780
- C:\Windows\System\AKgOFHN.exe
  C:\Windows\System\AKgOFHN.exe
  2⤵
  PID:6808
- C:\Windows\System\FsnzfHO.exe
  C:\Windows\System\FsnzfHO.exe
  2⤵
  PID:6824
- C:\Windows\System\skcJyuV.exe
  C:\Windows\System\skcJyuV.exe
  2⤵
  PID:6840
- C:\Windows\System\QGHPAbH.exe
  C:\Windows\System\QGHPAbH.exe
  2⤵
  PID:6860
- C:\Windows\System\vepwEbm.exe
  C:\Windows\System\vepwEbm.exe
  2⤵
  PID:6876
- C:\Windows\System\DqDVthU.exe
  C:\Windows\System\DqDVthU.exe
  2⤵
  PID:5696
- C:\Windows\System\bMjPNbP.exe
  C:\Windows\System\bMjPNbP.exe
  2⤵
  PID:6912
- C:\Windows\System\Bqopbrq.exe
  C:\Windows\System\Bqopbrq.exe
  2⤵
  PID:6920
- C:\Windows\System\NAvjsbL.exe
  C:\Windows\System\NAvjsbL.exe
  2⤵
  PID:7052
- C:\Windows\System\SKARpLu.exe
  C:\Windows\System\SKARpLu.exe
  2⤵
  PID:7048
- C:\Windows\System\AvSIgOG.exe
  C:\Windows\System\AvSIgOG.exe
  2⤵
  PID:7116
- C:\Windows\System\FhUlkUN.exe
  C:\Windows\System\FhUlkUN.exe
  2⤵
  PID:6288
- C:\Windows\System\MPaEIQM.exe
  C:\Windows\System\MPaEIQM.exe
  2⤵
  PID:6240
- C:\Windows\System\xWbTeyH.exe
  C:\Windows\System\xWbTeyH.exe
  2⤵
  PID:6148
- C:\Windows\System\mbSaWbT.exe
  C:\Windows\System\mbSaWbT.exe
  2⤵
  PID:6608
- C:\Windows\System\uvkMvva.exe
  C:\Windows\System\uvkMvva.exe
  2⤵
  PID:6688
- C:\Windows\System\GjiPlPs.exe
  C:\Windows\System\GjiPlPs.exe
  2⤵
  PID:6756
- C:\Windows\System\aJKvZPV.exe
  C:\Windows\System\aJKvZPV.exe
  2⤵
  PID:7004
- C:\Windows\System\ixDRpbk.exe
  C:\Windows\System\ixDRpbk.exe
  2⤵
  PID:7072
- C:\Windows\System\leLTMRF.exe
  C:\Windows\System\leLTMRF.exe
  2⤵
  PID:7132
- C:\Windows\System\ZbdaAro.exe
  C:\Windows\System\ZbdaAro.exe
  2⤵
  PID:6872
- C:\Windows\System\OIrseTj.exe
  C:\Windows\System\OIrseTj.exe
  2⤵
  PID:6972
- C:\Windows\System\JPxcrxa.exe
  C:\Windows\System\JPxcrxa.exe
  2⤵
  PID:7084
- C:\Windows\System\sxecwTl.exe
  C:\Windows\System\sxecwTl.exe
  2⤵
  PID:7136
- C:\Windows\System\nPUepcW.exe
  C:\Windows\System\nPUepcW.exe
  2⤵
  PID:6228
- C:\Windows\System\wULxdRm.exe
  C:\Windows\System\wULxdRm.exe
  2⤵
  PID:6416
- C:\Windows\System\PiNHCLR.exe
  C:\Windows\System\PiNHCLR.exe
  2⤵
  PID:6448
- C:\Windows\System\NWmikEj.exe
  C:\Windows\System\NWmikEj.exe
  2⤵
  PID:6432
- C:\Windows\System\KOZvGEB.exe
  C:\Windows\System\KOZvGEB.exe
  2⤵
  PID:6496
- C:\Windows\System\CORytdt.exe
  C:\Windows\System\CORytdt.exe
  2⤵
  PID:6532
- C:\Windows\System\ZkSAljV.exe
  C:\Windows\System\ZkSAljV.exe
  2⤵
  PID:7068
- C:\Windows\System\EcdZOXD.exe
  C:\Windows\System\EcdZOXD.exe
  2⤵
  PID:7120
- C:\Windows\System\jXZhiHg.exe
  C:\Windows\System\jXZhiHg.exe
  2⤵
  PID:6816
- C:\Windows\System\VqxaZTK.exe
  C:\Windows\System\VqxaZTK.exe
  2⤵
  PID:6916
- C:\Windows\System\NiGNNjd.exe
  C:\Windows\System\NiGNNjd.exe
  2⤵
  PID:6400
- C:\Windows\System\aVJrkbH.exe
  C:\Windows\System\aVJrkbH.exe
  2⤵
  PID:6768
- C:\Windows\System\qrdQiFz.exe
  C:\Windows\System\qrdQiFz.exe
  2⤵
  PID:6984
- C:\Windows\System\BylRKGk.exe
  C:\Windows\System\BylRKGk.exe
  2⤵
  PID:5828
- C:\Windows\System\AsTDfWB.exe
  C:\Windows\System\AsTDfWB.exe
  2⤵
  PID:6712
- C:\Windows\System\DRzUVDb.exe
  C:\Windows\System\DRzUVDb.exe
  2⤵
  PID:6528
- C:\Windows\System\JfBIsVg.exe
  C:\Windows\System\JfBIsVg.exe
  2⤵
  PID:6336
- C:\Windows\System\kaUZzKG.exe
  C:\Windows\System\kaUZzKG.exe
  2⤵
  PID:3396
- C:\Windows\System\gJIDIUJ.exe
  C:\Windows\System\gJIDIUJ.exe
  2⤵
  PID:6744
- C:\Windows\System\idJaTUu.exe
  C:\Windows\System\idJaTUu.exe
  2⤵
  PID:6436
- C:\Windows\System\ccTRtnr.exe
  C:\Windows\System\ccTRtnr.exe
  2⤵
  PID:7016
- C:\Windows\System\welGTKI.exe
  C:\Windows\System\welGTKI.exe
  2⤵
  PID:6244
- C:\Windows\System\pfTlbtM.exe
  C:\Windows\System\pfTlbtM.exe
  2⤵
  PID:7176
- C:\Windows\System\lRHsEvp.exe
  C:\Windows\System\lRHsEvp.exe
  2⤵
  PID:7292
- C:\Windows\System\FREswvK.exe
  C:\Windows\System\FREswvK.exe
  2⤵
  PID:7312
- C:\Windows\System\sXaUxaO.exe
  C:\Windows\System\sXaUxaO.exe
  2⤵
  PID:7332
- C:\Windows\System\nzuvBKE.exe
  C:\Windows\System\nzuvBKE.exe
  2⤵
  PID:7348
- C:\Windows\System\geRsYYz.exe
  C:\Windows\System\geRsYYz.exe
  2⤵
  PID:7364
- C:\Windows\System\DkFIFAM.exe
  C:\Windows\System\DkFIFAM.exe
  2⤵
  PID:7380
- C:\Windows\System\kudOYpK.exe
  C:\Windows\System\kudOYpK.exe
  2⤵
  PID:7400
- C:\Windows\System\bHWlOEw.exe
  C:\Windows\System\bHWlOEw.exe
  2⤵
  PID:7416
- C:\Windows\System\pqPtllw.exe
  C:\Windows\System\pqPtllw.exe
  2⤵
  PID:7432
- C:\Windows\System\RSnoWBP.exe
  C:\Windows\System\RSnoWBP.exe
  2⤵
  PID:7448
- C:\Windows\System\gnunNnU.exe
  C:\Windows\System\gnunNnU.exe
  2⤵
  PID:7464
- C:\Windows\System\qSwyqhc.exe
  C:\Windows\System\qSwyqhc.exe
  2⤵
  PID:7480
- C:\Windows\System\CQLrSRt.exe
  C:\Windows\System\CQLrSRt.exe
  2⤵
  PID:7496
- C:\Windows\System\bPpMMHN.exe
  C:\Windows\System\bPpMMHN.exe
  2⤵
  PID:7512
- C:\Windows\System\kUelKPI.exe
  C:\Windows\System\kUelKPI.exe
  2⤵
  PID:7528
- C:\Windows\System\YjmQSsj.exe
  C:\Windows\System\YjmQSsj.exe
  2⤵
  PID:7688
- C:\Windows\System\UTnjMdj.exe
  C:\Windows\System\UTnjMdj.exe
  2⤵
  PID:7704
- C:\Windows\System\ALthPdi.exe
  C:\Windows\System\ALthPdi.exe
  2⤵
  PID:7720
- C:\Windows\System\IxFArbM.exe
  C:\Windows\System\IxFArbM.exe
  2⤵
  PID:7736
- C:\Windows\System\lTOtADA.exe
  C:\Windows\System\lTOtADA.exe
  2⤵
  PID:7756
- C:\Windows\System\oElQYxl.exe
  C:\Windows\System\oElQYxl.exe
  2⤵
  PID:7776
- C:\Windows\System\URmKDWf.exe
  C:\Windows\System\URmKDWf.exe
  2⤵
  PID:7792
- C:\Windows\System\hiUnZxG.exe
  C:\Windows\System\hiUnZxG.exe
  2⤵
  PID:7812
- C:\Windows\System\mLEoMry.exe
  C:\Windows\System\mLEoMry.exe
  2⤵
  PID:7852
- C:\Windows\System\OYkJwxk.exe
  C:\Windows\System\OYkJwxk.exe
  2⤵
  PID:7872
- C:\Windows\System\yjqLHRl.exe
  C:\Windows\System\yjqLHRl.exe
  2⤵
  PID:7892
- C:\Windows\System\PcDbGDe.exe
  C:\Windows\System\PcDbGDe.exe
  2⤵
  PID:7908
- C:\Windows\System\igwcXVv.exe
  C:\Windows\System\igwcXVv.exe
  2⤵
  PID:7924
- C:\Windows\System\VLEAQBM.exe
  C:\Windows\System\VLEAQBM.exe
  2⤵
  PID:7944
- C:\Windows\System\vCkbZSN.exe
  C:\Windows\System\vCkbZSN.exe
  2⤵
  PID:7960
- C:\Windows\System\fbREKNp.exe
  C:\Windows\System\fbREKNp.exe
  2⤵
  PID:7980
- C:\Windows\System\xQhMuYS.exe
  C:\Windows\System\xQhMuYS.exe
  2⤵
  PID:7996
- C:\Windows\System\ZlpCWFk.exe
  C:\Windows\System\ZlpCWFk.exe
  2⤵
  PID:8012
- C:\Windows\System\SwOYMEx.exe
  C:\Windows\System\SwOYMEx.exe
  2⤵
  PID:8028
- C:\Windows\System\uNIEeUE.exe
  C:\Windows\System\uNIEeUE.exe
  2⤵
  PID:8048
- C:\Windows\System\ipacanB.exe
  C:\Windows\System\ipacanB.exe
  2⤵
  PID:8064
- C:\Windows\System\QzmkJIR.exe
  C:\Windows\System\QzmkJIR.exe
  2⤵
  PID:8080
- C:\Windows\System\mYkcDGk.exe
  C:\Windows\System\mYkcDGk.exe
  2⤵
  PID:8100
- C:\Windows\System\ExzQXWV.exe
  C:\Windows\System\ExzQXWV.exe
  2⤵
  PID:8120
- C:\Windows\System\FkGZHVO.exe
  C:\Windows\System\FkGZHVO.exe
  2⤵
  PID:8140
- C:\Windows\System\dyiSBLX.exe
  C:\Windows\System\dyiSBLX.exe
  2⤵
  PID:8156
- C:\Windows\System\dHHeODF.exe
  C:\Windows\System\dHHeODF.exe
  2⤵
  PID:8172
- C:\Windows\System\yqWpUTk.exe
  C:\Windows\System\yqWpUTk.exe
  2⤵
  PID:8188
- C:\Windows\System\CcDpjFr.exe
  C:\Windows\System\CcDpjFr.exe
  2⤵
  PID:7172
- C:\Windows\System\yledhtL.exe
  C:\Windows\System\yledhtL.exe
  2⤵
  PID:6660
- C:\Windows\System\NgXPoTS.exe
  C:\Windows\System\NgXPoTS.exe
  2⤵
  PID:5212
- C:\Windows\System\JRrMOxM.exe
  C:\Windows\System\JRrMOxM.exe
  2⤵
  PID:7216
- C:\Windows\System\xmstmPg.exe
  C:\Windows\System\xmstmPg.exe
  2⤵
  PID:7244
- C:\Windows\System\qsObZZZ.exe
  C:\Windows\System\qsObZZZ.exe
  2⤵
  PID:7260
- C:\Windows\System\YOyGvcS.exe
  C:\Windows\System\YOyGvcS.exe
  2⤵
  PID:7280
- C:\Windows\System\nyUGpnO.exe
  C:\Windows\System\nyUGpnO.exe
  2⤵
  PID:7308
- C:\Windows\System\BBIpHAm.exe
  C:\Windows\System\BBIpHAm.exe
  2⤵
  PID:7388
- C:\Windows\System\hyHnqpf.exe
  C:\Windows\System\hyHnqpf.exe
  2⤵
  PID:7328
- C:\Windows\System\lcJorKZ.exe
  C:\Windows\System\lcJorKZ.exe
  2⤵
  PID:7488
- C:\Windows\System\pthikmb.exe
  C:\Windows\System\pthikmb.exe
  2⤵
  PID:7460
- C:\Windows\System\XkfCTIv.exe
  C:\Windows\System\XkfCTIv.exe
  2⤵
  PID:7372
- C:\Windows\System\mmoQpSD.exe
  C:\Windows\System\mmoQpSD.exe
  2⤵
  PID:7472
- C:\Windows\System\CymVURF.exe
  C:\Windows\System\CymVURF.exe
  2⤵
  PID:7556
- C:\Windows\System\VyeGWZb.exe
  C:\Windows\System\VyeGWZb.exe
  2⤵
  PID:7568
- C:\Windows\System\zAdkRZj.exe
  C:\Windows\System\zAdkRZj.exe
  2⤵
  PID:7608
- C:\Windows\System\eTsWnCE.exe
  C:\Windows\System\eTsWnCE.exe
  2⤵
  PID:7620
- C:\Windows\System\mWDlKpC.exe
  C:\Windows\System\mWDlKpC.exe
  2⤵
  PID:7636
- C:\Windows\System\OABdgAN.exe
  C:\Windows\System\OABdgAN.exe
  2⤵
  PID:7700
- C:\Windows\System\HiHnaux.exe
  C:\Windows\System\HiHnaux.exe
  2⤵
  PID:7764
- C:\Windows\System\BJgdFAM.exe
  C:\Windows\System\BJgdFAM.exe
  2⤵
  PID:7712
- C:\Windows\System\DtAgJwA.exe
  C:\Windows\System\DtAgJwA.exe
  2⤵
  PID:7824
- C:\Windows\System\mWFONYW.exe
  C:\Windows\System\mWFONYW.exe
  2⤵
  PID:7884
- C:\Windows\System\iyTKuPX.exe
  C:\Windows\System\iyTKuPX.exe
  2⤵
  PID:7748
- C:\Windows\System\MloYIvQ.exe
  C:\Windows\System\MloYIvQ.exe
  2⤵
  PID:7820
- C:\Windows\System\djkRWtp.exe
  C:\Windows\System\djkRWtp.exe
  2⤵
  PID:7832
- C:\Windows\System\wpxufDp.exe
  C:\Windows\System\wpxufDp.exe
  2⤵
  PID:8128
- C:\Windows\System\fAtnAFv.exe
  C:\Windows\System\fAtnAFv.exe
  2⤵
  PID:7844
- C:\Windows\System\EjXnidh.exe
  C:\Windows\System\EjXnidh.exe
  2⤵
  PID:7784
- C:\Windows\System\LqgMgNA.exe
  C:\Windows\System\LqgMgNA.exe
  2⤵
  PID:7988
- C:\Windows\System\TngGSwa.exe
  C:\Windows\System\TngGSwa.exe
  2⤵
  PID:6732
- C:\Windows\System\jtaWlZz.exe
  C:\Windows\System\jtaWlZz.exe
  2⤵
  PID:7360
- C:\Windows\System\jTRHUMw.exe
  C:\Windows\System\jTRHUMw.exe
  2⤵
  PID:7800
- C:\Windows\System\tgwFuSU.exe
  C:\Windows\System\tgwFuSU.exe
  2⤵
  PID:7456
- C:\Windows\System\DnOrIci.exe
  C:\Windows\System\DnOrIci.exe
  2⤵
  PID:7424
- C:\Windows\System\pnNLtLH.exe
  C:\Windows\System\pnNLtLH.exe
  2⤵
  PID:7940
- C:\Windows\System\HlfbxCV.exe
  C:\Windows\System\HlfbxCV.exe
  2⤵
  PID:8004
- C:\Windows\System\AFeOfGq.exe
  C:\Windows\System\AFeOfGq.exe
  2⤵
  PID:8044
- C:\Windows\System\GBaUHUX.exe
  C:\Windows\System\GBaUHUX.exe
  2⤵
  PID:8116
- C:\Windows\System\ZNCtiCP.exe
  C:\Windows\System\ZNCtiCP.exe
  2⤵
  PID:8184
- C:\Windows\System\gEgrEyL.exe
  C:\Windows\System\gEgrEyL.exe
  2⤵
  PID:6772
- C:\Windows\System\kHVVaWB.exe
  C:\Windows\System\kHVVaWB.exe
  2⤵
  PID:6820
- C:\Windows\System\XfhffYP.exe
  C:\Windows\System\XfhffYP.exe
  2⤵
  PID:7188
- C:\Windows\System\FzKEYyz.exe
  C:\Windows\System\FzKEYyz.exe
  2⤵
  PID:7340
- C:\Windows\System\UFOSUJb.exe
  C:\Windows\System\UFOSUJb.exe
  2⤵
  PID:7520
- C:\Windows\System\KmtZUTV.exe
  C:\Windows\System\KmtZUTV.exe
  2⤵
  PID:7504
- C:\Windows\System\JmEeSoE.exe
  C:\Windows\System\JmEeSoE.exe
  2⤵
  PID:7576
- C:\Windows\System\aBkIKFx.exe
  C:\Windows\System\aBkIKFx.exe
  2⤵
  PID:7536
- C:\Windows\System\lCVZtJJ.exe
  C:\Windows\System\lCVZtJJ.exe
  2⤵
  PID:7624
- C:\Windows\System\MQACOpe.exe
  C:\Windows\System\MQACOpe.exe
  2⤵
  PID:7628
- C:\Windows\System\dVgUjQd.exe
  C:\Windows\System\dVgUjQd.exe
  2⤵
  PID:7632
- C:\Windows\System\ZuRpHEo.exe
  C:\Windows\System\ZuRpHEo.exe
  2⤵
  PID:7668
- C:\Windows\System\RjSQRwI.exe
  C:\Windows\System\RjSQRwI.exe
  2⤵
  PID:7676
- C:\Windows\System\BWaMIXM.exe
  C:\Windows\System\BWaMIXM.exe
  2⤵
  PID:7680
- C:\Windows\System\scgyHGK.exe
  C:\Windows\System\scgyHGK.exe
  2⤵
  PID:7788
- C:\Windows\System\gcwvjdn.exe
  C:\Windows\System\gcwvjdn.exe
  2⤵
  PID:8136
- C:\Windows\System\ShifceY.exe
  C:\Windows\System\ShifceY.exe
  2⤵
  PID:7956
- C:\Windows\System\RoCrlCC.exe
  C:\Windows\System\RoCrlCC.exe
  2⤵
  PID:7272
- C:\Windows\System\WHbHZra.exe
  C:\Windows\System\WHbHZra.exe
  2⤵
  PID:8164
- C:\Windows\System\FJkkFof.exe
  C:\Windows\System\FJkkFof.exe
  2⤵
  PID:7276
- C:\Windows\System\HmcHewK.exe
  C:\Windows\System\HmcHewK.exe
  2⤵
  PID:7936
- C:\Windows\System\KQvnsQC.exe
  C:\Windows\System\KQvnsQC.exe
  2⤵
  PID:7768
- C:\Windows\System\GHwSmXG.exe
  C:\Windows\System\GHwSmXG.exe
  2⤵
  PID:7212
- C:\Windows\System\oQInEnr.exe
  C:\Windows\System\oQInEnr.exe
  2⤵
  PID:7204
- C:\Windows\System\fdvWUZN.exe
  C:\Windows\System\fdvWUZN.exe
  2⤵
  PID:7972
- C:\Windows\System\aovkeAI.exe
  C:\Windows\System\aovkeAI.exe
  2⤵
  PID:8108
- C:\Windows\System\nUqfJoZ.exe
  C:\Windows\System\nUqfJoZ.exe
  2⤵
  PID:7596
- C:\Windows\System\EkfgnGl.exe
  C:\Windows\System\EkfgnGl.exe
  2⤵
  PID:8056
- C:\Windows\System\eQJaotf.exe
  C:\Windows\System\eQJaotf.exe
  2⤵
  PID:7524
- C:\Windows\System\iGoWWJb.exe
  C:\Windows\System\iGoWWJb.exe
  2⤵
  PID:7020
- C:\Windows\System\nOKPotz.exe
  C:\Windows\System\nOKPotz.exe
  2⤵
  PID:7508
- C:\Windows\System\cXitxLw.exe
  C:\Windows\System\cXitxLw.exe
  2⤵
  PID:7268
- C:\Windows\System\mxiNGyh.exe
  C:\Windows\System\mxiNGyh.exe
  2⤵
  PID:7716
- C:\Windows\System\ZcPVQFj.exe
  C:\Windows\System\ZcPVQFj.exe
  2⤵
  PID:8168
- C:\Windows\System\RlTVdoC.exe
  C:\Windows\System\RlTVdoC.exe
  2⤵
  PID:7356
- C:\Windows\System\NdTWEAA.exe
  C:\Windows\System\NdTWEAA.exe
  2⤵
  PID:6136
- C:\Windows\System\PrEFNSA.exe
  C:\Windows\System\PrEFNSA.exe
  2⤵
  PID:6880
- C:\Windows\System\KaAgxBp.exe
  C:\Windows\System\KaAgxBp.exe
  2⤵
  PID:7684
- C:\Windows\System\QADrMRB.exe
  C:\Windows\System\QADrMRB.exe
  2⤵
  PID:8076
- C:\Windows\System\YTkeKoZ.exe
  C:\Windows\System\YTkeKoZ.exe
  2⤵
  PID:7564
- C:\Windows\System\iSHpRAQ.exe
  C:\Windows\System\iSHpRAQ.exe
  2⤵
  PID:7592
- C:\Windows\System\JIsUOpF.exe
  C:\Windows\System\JIsUOpF.exe
  2⤵
  PID:7288
- C:\Windows\System\MLmWSQt.exe
  C:\Windows\System\MLmWSQt.exe
  2⤵
  PID:7236
- C:\Windows\System\YrXuOuE.exe
  C:\Windows\System\YrXuOuE.exe
  2⤵
  PID:7240
- C:\Windows\System\WIEtNuv.exe
  C:\Windows\System\WIEtNuv.exe
  2⤵
  PID:7828
- C:\Windows\System\YlFzAzx.exe
  C:\Windows\System\YlFzAzx.exe
  2⤵
  PID:6164
- C:\Windows\System\HRfoOjH.exe
  C:\Windows\System\HRfoOjH.exe
  2⤵
  PID:6888
- C:\Windows\System\nxiCipn.exe
  C:\Windows\System\nxiCipn.exe
  2⤵
  PID:8180
- C:\Windows\System\AOJjKNU.exe
  C:\Windows\System\AOJjKNU.exe
  2⤵
  PID:8036
- C:\Windows\System\BVpuOsG.exe
  C:\Windows\System\BVpuOsG.exe
  2⤵
  PID:7864
- C:\Windows\System\cBBfkIn.exe
  C:\Windows\System\cBBfkIn.exe
  2⤵
  PID:8196
- C:\Windows\System\TnabCdg.exe
  C:\Windows\System\TnabCdg.exe
  2⤵
  PID:8212
- C:\Windows\System\GqnQnqy.exe
  C:\Windows\System\GqnQnqy.exe
  2⤵
  PID:8228
- C:\Windows\System\AfWbrFV.exe
  C:\Windows\System\AfWbrFV.exe
  2⤵
  PID:8244
- C:\Windows\System\DBqNaGV.exe
  C:\Windows\System\DBqNaGV.exe
  2⤵
  PID:8260
- C:\Windows\System\NrKWAOu.exe
  C:\Windows\System\NrKWAOu.exe
  2⤵
  PID:8276
- C:\Windows\System\QcUNkhl.exe
  C:\Windows\System\QcUNkhl.exe
  2⤵
  PID:8292
- C:\Windows\System\NJOdnXg.exe
  C:\Windows\System\NJOdnXg.exe
  2⤵
  PID:8312
- C:\Windows\System\iobAgIq.exe
  C:\Windows\System\iobAgIq.exe
  2⤵
  PID:8328
- C:\Windows\System\ncMxVya.exe
  C:\Windows\System\ncMxVya.exe
  2⤵
  PID:8344
- C:\Windows\System\UyxHRIY.exe
  C:\Windows\System\UyxHRIY.exe
  2⤵
  PID:8360
- C:\Windows\System\LMMtleM.exe
  C:\Windows\System\LMMtleM.exe
  2⤵
  PID:8376
- C:\Windows\System\UduFCmi.exe
  C:\Windows\System\UduFCmi.exe
  2⤵
  PID:8392
- C:\Windows\System\OmFFMBf.exe
  C:\Windows\System\OmFFMBf.exe
  2⤵
  PID:8408
- C:\Windows\System\UYbYnrz.exe
  C:\Windows\System\UYbYnrz.exe
  2⤵
  PID:8424
- C:\Windows\System\xJPMwPo.exe
  C:\Windows\System\xJPMwPo.exe
  2⤵
  PID:8440
- C:\Windows\System\pGfZSeT.exe
  C:\Windows\System\pGfZSeT.exe
  2⤵
  PID:8456
- C:\Windows\System\kgcZKcf.exe
  C:\Windows\System\kgcZKcf.exe
  2⤵
  PID:8472
- C:\Windows\System\rVXWTeb.exe
  C:\Windows\System\rVXWTeb.exe
  2⤵
  PID:8488
- C:\Windows\System\SDZNPBQ.exe
  C:\Windows\System\SDZNPBQ.exe
  2⤵
  PID:8504
- C:\Windows\System\AWFlTfG.exe
  C:\Windows\System\AWFlTfG.exe
  2⤵
  PID:8520
- C:\Windows\System\cBnIwqn.exe
  C:\Windows\System\cBnIwqn.exe
  2⤵
  PID:8536
- C:\Windows\System\piCBQIB.exe
  C:\Windows\System\piCBQIB.exe
  2⤵
  PID:8552
- C:\Windows\System\OhneahQ.exe
  C:\Windows\System\OhneahQ.exe
  2⤵
  PID:8568
- C:\Windows\System\GpXfifA.exe
  C:\Windows\System\GpXfifA.exe
  2⤵
  PID:8584
- C:\Windows\System\cteLCrs.exe
  C:\Windows\System\cteLCrs.exe
  2⤵
  PID:8608
- C:\Windows\System\LMFrDBT.exe
  C:\Windows\System\LMFrDBT.exe
  2⤵
  PID:8624
- C:\Windows\System\cindmCP.exe
  C:\Windows\System\cindmCP.exe
  2⤵
  PID:8640
- C:\Windows\System\nafMzCC.exe
  C:\Windows\System\nafMzCC.exe
  2⤵
  PID:8656
- C:\Windows\System\bOUuYLB.exe
  C:\Windows\System\bOUuYLB.exe
  2⤵
  PID:8672
- C:\Windows\System\PQLhFDl.exe
  C:\Windows\System\PQLhFDl.exe
  2⤵
  PID:8688
- C:\Windows\System\VATOYcv.exe
  C:\Windows\System\VATOYcv.exe
  2⤵
  PID:8704
- C:\Windows\System\PlgPwEl.exe
  C:\Windows\System\PlgPwEl.exe
  2⤵
  PID:8720
- C:\Windows\System\wIWNIKQ.exe
  C:\Windows\System\wIWNIKQ.exe
  2⤵
  PID:8736
- C:\Windows\System\AlgVTSu.exe
  C:\Windows\System\AlgVTSu.exe
  2⤵
  PID:8752
- C:\Windows\System\XKvfsFx.exe
  C:\Windows\System\XKvfsFx.exe
  2⤵
  PID:8768
- C:\Windows\System\LklvVwu.exe
  C:\Windows\System\LklvVwu.exe
  2⤵
  PID:8784
- C:\Windows\System\vcYdcjm.exe
  C:\Windows\System\vcYdcjm.exe
  2⤵
  PID:8800
- C:\Windows\System\ATVpMgN.exe
  C:\Windows\System\ATVpMgN.exe
  2⤵
  PID:8816
- C:\Windows\System\FcZIrlW.exe
  C:\Windows\System\FcZIrlW.exe
  2⤵
  PID:8832
- C:\Windows\System\yJJRdul.exe
  C:\Windows\System\yJJRdul.exe
  2⤵
  PID:8848
- C:\Windows\System\jErxXMe.exe
  C:\Windows\System\jErxXMe.exe
  2⤵
  PID:8864
- C:\Windows\System\sWToaWi.exe
  C:\Windows\System\sWToaWi.exe
  2⤵
  PID:8880
- C:\Windows\System\TsSEWsn.exe
  C:\Windows\System\TsSEWsn.exe
  2⤵
  PID:8932
- C:\Windows\System\dBTIXXw.exe
  C:\Windows\System\dBTIXXw.exe
  2⤵
  PID:8948
- C:\Windows\System\AzeJHre.exe
  C:\Windows\System\AzeJHre.exe
  2⤵
  PID:8964
- C:\Windows\System\IUmJXan.exe
  C:\Windows\System\IUmJXan.exe
  2⤵
  PID:8980
- C:\Windows\System\vrxiklG.exe
  C:\Windows\System\vrxiklG.exe
  2⤵
  PID:8996
- C:\Windows\System\MyJGHua.exe
  C:\Windows\System\MyJGHua.exe
  2⤵
  PID:9012
- C:\Windows\System\YXDJjwL.exe
  C:\Windows\System\YXDJjwL.exe
  2⤵
  PID:9028
- C:\Windows\System\xnmeUHO.exe
  C:\Windows\System\xnmeUHO.exe
  2⤵
  PID:9044
- C:\Windows\System\mkGJAHj.exe
  C:\Windows\System\mkGJAHj.exe
  2⤵
  PID:9060
- C:\Windows\System\tyWMaSP.exe
  C:\Windows\System\tyWMaSP.exe
  2⤵
  PID:9076
- C:\Windows\System\qwqJKUw.exe
  C:\Windows\System\qwqJKUw.exe
  2⤵
  PID:9092
- C:\Windows\System\SHilFNc.exe
  C:\Windows\System\SHilFNc.exe
  2⤵
  PID:9108
- C:\Windows\System\bltreei.exe
  C:\Windows\System\bltreei.exe
  2⤵
  PID:9124
- C:\Windows\System\BzjFSYv.exe
  C:\Windows\System\BzjFSYv.exe
  2⤵
  PID:9140
- C:\Windows\System\dlAwEdS.exe
  C:\Windows\System\dlAwEdS.exe
  2⤵
  PID:9156
- C:\Windows\System\lrORVxs.exe
  C:\Windows\System\lrORVxs.exe
  2⤵
  PID:9172
- C:\Windows\System\RTKvRxx.exe
  C:\Windows\System\RTKvRxx.exe
  2⤵
  PID:9188
- C:\Windows\System\FewOWfh.exe
  C:\Windows\System\FewOWfh.exe
  2⤵
  PID:9204
- C:\Windows\System\lavNzYI.exe
  C:\Windows\System\lavNzYI.exe
  2⤵
  PID:8208
- C:\Windows\System\zPKjtuL.exe
  C:\Windows\System\zPKjtuL.exe
  2⤵
  PID:8272
- C:\Windows\System\eFlaKRZ.exe
  C:\Windows\System\eFlaKRZ.exe
  2⤵
  PID:8256
- C:\Windows\System\kvvHCYH.exe
  C:\Windows\System\kvvHCYH.exe
  2⤵
  PID:1576
- C:\Windows\System\iqalnxE.exe
  C:\Windows\System\iqalnxE.exe
  2⤵
  PID:8288
- C:\Windows\System\RBRuvlc.exe
  C:\Windows\System\RBRuvlc.exe
  2⤵
  PID:8352
- C:\Windows\System\AKRjPPs.exe
  C:\Windows\System\AKRjPPs.exe
  2⤵
  PID:8340
- C:\Windows\System\tHypudk.exe
  C:\Windows\System\tHypudk.exe
  2⤵
  PID:8404
- C:\Windows\System\tAxyqZi.exe
  C:\Windows\System\tAxyqZi.exe
  2⤵
  PID:8468
- C:\Windows\System\wGYltmB.exe
  C:\Windows\System\wGYltmB.exe
  2⤵
  PID:8448
- C:\Windows\System\LsmeQVQ.exe
  C:\Windows\System\LsmeQVQ.exe
  2⤵
  PID:8484
- C:\Windows\System\kJBLlAZ.exe
  C:\Windows\System\kJBLlAZ.exe
  2⤵
  PID:8532
- C:\Windows\System\nSYtkkE.exe
  C:\Windows\System\nSYtkkE.exe
  2⤵
  PID:8580
- C:\Windows\System\GLeQRDT.exe
  C:\Windows\System\GLeQRDT.exe
  2⤵
  PID:8564
- C:\Windows\System\WYuqAdV.exe
  C:\Windows\System\WYuqAdV.exe
  2⤵
  PID:8616
- C:\Windows\System\lDYSkZK.exe
  C:\Windows\System\lDYSkZK.exe
  2⤵
  PID:8664
- C:\Windows\System\BuCRFSk.exe
  C:\Windows\System\BuCRFSk.exe
  2⤵
  PID:8728
- C:\Windows\System\zaffPnZ.exe
  C:\Windows\System\zaffPnZ.exe
  2⤵
  PID:8792
- C:\Windows\System\LOoLnyj.exe
  C:\Windows\System\LOoLnyj.exe
  2⤵
  PID:8912
- C:\Windows\System\GypxDjF.exe
  C:\Windows\System\GypxDjF.exe
  2⤵
  PID:8940
- C:\Windows\System\OTzlKpd.exe
  C:\Windows\System\OTzlKpd.exe
  2⤵
  PID:8988
- C:\Windows\System\xsGHLnD.exe
  C:\Windows\System\xsGHLnD.exe
  2⤵
  PID:8972
- C:\Windows\System\JBCTfZe.exe
  C:\Windows\System\JBCTfZe.exe
  2⤵
  PID:9008
- C:\Windows\System\eujkPqg.exe
  C:\Windows\System\eujkPqg.exe
  2⤵
  PID:9088
- C:\Windows\System\PEYQGpf.exe
  C:\Windows\System\PEYQGpf.exe
  2⤵
  PID:9136
- C:\Windows\System\NXknUyY.exe
  C:\Windows\System\NXknUyY.exe
  2⤵
  PID:9104
- C:\Windows\System\myxlaWP.exe
  C:\Windows\System\myxlaWP.exe
  2⤵
  PID:9212
- C:\Windows\System\HhHbXcO.exe
  C:\Windows\System\HhHbXcO.exe
  2⤵
  PID:8204
- C:\Windows\System\vSPgXCf.exe
  C:\Windows\System\vSPgXCf.exe
  2⤵
  PID:8268
- C:\Windows\System\vQrlNTk.exe
  C:\Windows\System\vQrlNTk.exe
  2⤵
  PID:8384
- C:\Windows\System\LelBdYb.exe
  C:\Windows\System\LelBdYb.exe
  2⤵
  PID:8400
- C:\Windows\System\cHFSKaZ.exe
  C:\Windows\System\cHFSKaZ.exe
  2⤵
  PID:8480
- C:\Windows\System\ozrmorc.exe
  C:\Windows\System\ozrmorc.exe
  2⤵
  PID:8544
- C:\Windows\System\AgctbYu.exe
  C:\Windows\System\AgctbYu.exe
  2⤵
  PID:8604
- C:\Windows\System\XCCImva.exe
  C:\Windows\System\XCCImva.exe
  2⤵
  PID:8636
- C:\Windows\System\NRliBwD.exe
  C:\Windows\System\NRliBwD.exe
  2⤵
  PID:8700
- C:\Windows\System\TkJohfD.exe
  C:\Windows\System\TkJohfD.exe
  2⤵
  PID:8652
- C:\Windows\System\hjLPHxy.exe
  C:\Windows\System\hjLPHxy.exe
  2⤵
  PID:8748
- C:\Windows\System\PJcoxBU.exe
  C:\Windows\System\PJcoxBU.exe
  2⤵
  PID:8780
- C:\Windows\System\dnhVDWZ.exe
  C:\Windows\System\dnhVDWZ.exe
  2⤵
  PID:8856
- C:\Windows\System\Dfejgsm.exe
  C:\Windows\System\Dfejgsm.exe
  2⤵
  PID:8844
- C:\Windows\System\JZvrOGZ.exe
  C:\Windows\System\JZvrOGZ.exe
  2⤵
  PID:8960
- C:\Windows\System\GXfxPEM.exe
  C:\Windows\System\GXfxPEM.exe
  2⤵
  PID:9200
- C:\Windows\System\grhJYXz.exe
  C:\Windows\System\grhJYXz.exe
  2⤵
  PID:8600
- C:\Windows\System\CIswkhM.exe
  C:\Windows\System\CIswkhM.exe
  2⤵
  PID:8840
- C:\Windows\System\LkvvMoy.exe
  C:\Windows\System\LkvvMoy.exe
  2⤵
  PID:8776
- C:\Windows\System\AqNVsHW.exe
  C:\Windows\System\AqNVsHW.exe
  2⤵
  PID:8284
- C:\Windows\System\wPnBODW.exe
  C:\Windows\System\wPnBODW.exe
  2⤵
  PID:8452
- C:\Windows\System\JfpuUEt.exe
  C:\Windows\System\JfpuUEt.exe
  2⤵
  PID:9132
- C:\Windows\System\NcjPKdW.exe
  C:\Windows\System\NcjPKdW.exe
  2⤵
  PID:9020
- C:\Windows\System\eZJqouG.exe
  C:\Windows\System\eZJqouG.exe
  2⤵
  PID:9040
- C:\Windows\System\jcAtKqi.exe
  C:\Windows\System\jcAtKqi.exe
  2⤵
  PID:8712
- C:\Windows\System\BGQVMPN.exe
  C:\Windows\System\BGQVMPN.exe
  2⤵
  PID:8240
- C:\Windows\System\WNHfzOx.exe
  C:\Windows\System\WNHfzOx.exe
  2⤵
  PID:8372
- C:\Windows\System\NGlEFZM.exe
  C:\Windows\System\NGlEFZM.exe
  2⤵
  PID:7304
- C:\Windows\System\nsAuMAm.exe
  C:\Windows\System\nsAuMAm.exe
  2⤵
  PID:8388
- C:\Windows\System\mZHTSVH.exe
  C:\Windows\System\mZHTSVH.exe
  2⤵
  PID:9084
- C:\Windows\System\ZBjAOEl.exe
  C:\Windows\System\ZBjAOEl.exe
  2⤵
  PID:8632
- C:\Windows\System\iQjbFLD.exe
  C:\Windows\System\iQjbFLD.exe
  2⤵
  PID:9196
- C:\Windows\System\dkBvwLw.exe
  C:\Windows\System\dkBvwLw.exe
  2⤵
  PID:8716
- C:\Windows\System\pkOXTfS.exe
  C:\Windows\System\pkOXTfS.exe
  2⤵
  PID:9224
- C:\Windows\System\yoTKNZM.exe
  C:\Windows\System\yoTKNZM.exe
  2⤵
  PID:9240
- C:\Windows\System\mqcCHTj.exe
  C:\Windows\System\mqcCHTj.exe
  2⤵
  PID:9256
- C:\Windows\System\onjAVob.exe
  C:\Windows\System\onjAVob.exe
  2⤵
  PID:9272
- C:\Windows\System\BjsRDZJ.exe
  C:\Windows\System\BjsRDZJ.exe
  2⤵
  PID:9288
- C:\Windows\System\SWrinKF.exe
  C:\Windows\System\SWrinKF.exe
  2⤵
  PID:9304
- C:\Windows\System\tFzfCuH.exe
  C:\Windows\System\tFzfCuH.exe
  2⤵
  PID:9320
- C:\Windows\System\vBAtiIP.exe
  C:\Windows\System\vBAtiIP.exe
  2⤵
  PID:9336
- C:\Windows\System\QaUlkXS.exe
  C:\Windows\System\QaUlkXS.exe
  2⤵
  PID:9352
- C:\Windows\System\hiNwjNT.exe
  C:\Windows\System\hiNwjNT.exe
  2⤵
  PID:9368
- C:\Windows\System\EuEeSZh.exe
  C:\Windows\System\EuEeSZh.exe
  2⤵
  PID:9384
- C:\Windows\System\ksxomuk.exe
  C:\Windows\System\ksxomuk.exe
  2⤵
  PID:9400
- C:\Windows\System\uoCawgL.exe
  C:\Windows\System\uoCawgL.exe
  2⤵
  PID:9416
- C:\Windows\System\ZVZHTlM.exe
  C:\Windows\System\ZVZHTlM.exe
  2⤵
  PID:9432
- C:\Windows\System\ubgSwYu.exe
  C:\Windows\System\ubgSwYu.exe
  2⤵
  PID:9448
- C:\Windows\System\xTvzIav.exe
  C:\Windows\System\xTvzIav.exe
  2⤵
  PID:9464
- C:\Windows\System\QpxokYw.exe
  C:\Windows\System\QpxokYw.exe
  2⤵
  PID:9480
- C:\Windows\System\OOWBlsL.exe
  C:\Windows\System\OOWBlsL.exe
  2⤵
  PID:9496
- C:\Windows\System\wZxhobZ.exe
  C:\Windows\System\wZxhobZ.exe
  2⤵
  PID:9512
- C:\Windows\System\DhtjTVS.exe
  C:\Windows\System\DhtjTVS.exe
  2⤵
  PID:9528
- C:\Windows\System\dCOGOzm.exe
  C:\Windows\System\dCOGOzm.exe
  2⤵
  PID:9544
- C:\Windows\System\mVYlgFC.exe
  C:\Windows\System\mVYlgFC.exe
  2⤵
  PID:9560
- C:\Windows\System\odfdwBH.exe
  C:\Windows\System\odfdwBH.exe
  2⤵
  PID:9576
- C:\Windows\System\fSknVDS.exe
  C:\Windows\System\fSknVDS.exe
  2⤵
  PID:9596
- C:\Windows\System\vnnqbeq.exe
  C:\Windows\System\vnnqbeq.exe
  2⤵
  PID:9612
- C:\Windows\System\gbRIpqY.exe
  C:\Windows\System\gbRIpqY.exe
  2⤵
  PID:9628
- C:\Windows\System\IIUPosy.exe
  C:\Windows\System\IIUPosy.exe
  2⤵
  PID:9644
- C:\Windows\System\sstMiXo.exe
  C:\Windows\System\sstMiXo.exe
  2⤵
  PID:9660
- C:\Windows\System\weocUMi.exe
  C:\Windows\System\weocUMi.exe
  2⤵
  PID:9676
- C:\Windows\System\IhaSGwJ.exe
  C:\Windows\System\IhaSGwJ.exe
  2⤵
  PID:9692
- C:\Windows\System\EphptZm.exe
  C:\Windows\System\EphptZm.exe
  2⤵
  PID:9708
- C:\Windows\System\YPPVZEe.exe
  C:\Windows\System\YPPVZEe.exe
  2⤵
  PID:9724
- C:\Windows\System\hbhyJwN.exe
  C:\Windows\System\hbhyJwN.exe
  2⤵
  PID:9740
- C:\Windows\System\xLbgGdF.exe
  C:\Windows\System\xLbgGdF.exe
  2⤵
  PID:9756
- C:\Windows\System\RLDXKRP.exe
  C:\Windows\System\RLDXKRP.exe
  2⤵
  PID:9772
- C:\Windows\System\eziEqcS.exe
  C:\Windows\System\eziEqcS.exe
  2⤵
  PID:9792
- C:\Windows\System\bjRpQQQ.exe
  C:\Windows\System\bjRpQQQ.exe
  2⤵
  PID:9808
- C:\Windows\System\VRSjLTo.exe
  C:\Windows\System\VRSjLTo.exe
  2⤵
  PID:9824
- C:\Windows\System\DYorvul.exe
  C:\Windows\System\DYorvul.exe
  2⤵
  PID:9840
- C:\Windows\System\VWsPcPz.exe
  C:\Windows\System\VWsPcPz.exe
  2⤵
  PID:9856
- C:\Windows\System\ahdxsLJ.exe
  C:\Windows\System\ahdxsLJ.exe
  2⤵
  PID:9872
- C:\Windows\System\FwRFvNH.exe
  C:\Windows\System\FwRFvNH.exe
  2⤵
  PID:9888
- C:\Windows\System\fxyQctp.exe
  C:\Windows\System\fxyQctp.exe
  2⤵
  PID:9904
- C:\Windows\System\CmvuYNa.exe
  C:\Windows\System\CmvuYNa.exe
  2⤵
  PID:9920
- C:\Windows\System\VpieYaz.exe
  C:\Windows\System\VpieYaz.exe
  2⤵
  PID:9936
- C:\Windows\System\lJCWdLO.exe
  C:\Windows\System\lJCWdLO.exe
  2⤵
  PID:9952
- C:\Windows\System\oaWiUTk.exe
  C:\Windows\System\oaWiUTk.exe
  2⤵
  PID:9968
- C:\Windows\System\tqyHjnE.exe
  C:\Windows\System\tqyHjnE.exe
  2⤵
  PID:9984
- C:\Windows\System\YKBBHKG.exe
  C:\Windows\System\YKBBHKG.exe
  2⤵
  PID:10000
- C:\Windows\System\QBGFVHK.exe
  C:\Windows\System\QBGFVHK.exe
  2⤵
  PID:10016
- C:\Windows\System\YmsnkNT.exe
  C:\Windows\System\YmsnkNT.exe
  2⤵
  PID:10032
- C:\Windows\System\tIBaEwp.exe
  C:\Windows\System\tIBaEwp.exe
  2⤵
  PID:10048
- C:\Windows\System\IGOeJnV.exe
  C:\Windows\System\IGOeJnV.exe
  2⤵
  PID:10068
- C:\Windows\System\OqUoyPN.exe
  C:\Windows\System\OqUoyPN.exe
  2⤵
  PID:10084
- C:\Windows\System\TKfLPUq.exe
  C:\Windows\System\TKfLPUq.exe
  2⤵
  PID:10100
- C:\Windows\System\Gsrrjyo.exe
  C:\Windows\System\Gsrrjyo.exe
  2⤵
  PID:10116
- C:\Windows\System\jKiAKxB.exe
  C:\Windows\System\jKiAKxB.exe
  2⤵
  PID:10136
- C:\Windows\System\svLjyhk.exe
  C:\Windows\System\svLjyhk.exe
  2⤵
  PID:10156
- C:\Windows\System\gytdAWU.exe
  C:\Windows\System\gytdAWU.exe
  2⤵
  PID:10172
- C:\Windows\System\zIZXJjB.exe
  C:\Windows\System\zIZXJjB.exe
  2⤵
  PID:10188
- C:\Windows\System\sgXNpfP.exe
  C:\Windows\System\sgXNpfP.exe
  2⤵
  PID:10204
- C:\Windows\System\QIUZhTu.exe
  C:\Windows\System\QIUZhTu.exe
  2⤵
  PID:10220
- C:\Windows\System\qPBvFGk.exe
  C:\Windows\System\qPBvFGk.exe
  2⤵
  PID:10236
- C:\Windows\System\amQyLpk.exe
  C:\Windows\System\amQyLpk.exe
  2⤵
  PID:9428
- C:\Windows\System\hIgJwAR.exe
  C:\Windows\System\hIgJwAR.exe
  2⤵
  PID:9472
- C:\Windows\System\sVujFXm.exe
  C:\Windows\System\sVujFXm.exe
  2⤵
  PID:9572
- C:\Windows\System\WunnHXb.exe
  C:\Windows\System\WunnHXb.exe
  2⤵
  PID:9524
- C:\Windows\System\FLhycOm.exe
  C:\Windows\System\FLhycOm.exe
  2⤵
  PID:9608
- C:\Windows\System\arPcvKj.exe
  C:\Windows\System\arPcvKj.exe
  2⤵
  PID:9672
- C:\Windows\System\NGVblxp.exe
  C:\Windows\System\NGVblxp.exe
  2⤵
  PID:9736
- C:\Windows\System\pQUMxEP.exe
  C:\Windows\System\pQUMxEP.exe
  2⤵
  PID:9768
- C:\Windows\System\BRXdcaM.exe
  C:\Windows\System\BRXdcaM.exe
  2⤵
  PID:9832
- C:\Windows\System\LECAERX.exe
  C:\Windows\System\LECAERX.exe
  2⤵
  PID:9896
- C:\Windows\System\ITIOeJq.exe
  C:\Windows\System\ITIOeJq.exe
  2⤵
  PID:9788
- C:\Windows\System\YHwrpNG.exe
  C:\Windows\System\YHwrpNG.exe
  2⤵
  PID:9852
- C:\Windows\System\dIOPBvJ.exe
  C:\Windows\System\dIOPBvJ.exe
  2⤵
  PID:9748
- C:\Windows\System\xkGitoo.exe
  C:\Windows\System\xkGitoo.exe
  2⤵
  PID:9912
- C:\Windows\System\sVyLPIB.exe
  C:\Windows\System\sVyLPIB.exe
  2⤵
  PID:9948
- C:\Windows\System\fEhjcJf.exe
  C:\Windows\System\fEhjcJf.exe
  2⤵
  PID:10024
- C:\Windows\System\LvGqxQf.exe
  C:\Windows\System\LvGqxQf.exe
  2⤵
  PID:10064
- C:\Windows\System\kOyopMS.exe
  C:\Windows\System\kOyopMS.exe
  2⤵
  PID:10128
- C:\Windows\System\wwIlIKf.exe
  C:\Windows\System\wwIlIKf.exe
  2⤵
  PID:8928
- C:\Windows\System\GTNGvFT.exe
  C:\Windows\System\GTNGvFT.exe
  2⤵
  PID:9164
- C:\Windows\System\qtcEBTf.exe
  C:\Windows\System\qtcEBTf.exe
  2⤵
  PID:9264
- C:\Windows\System\rBNrTas.exe
  C:\Windows\System\rBNrTas.exe
  2⤵
  PID:9268
- C:\Windows\System\QNBsDzW.exe
  C:\Windows\System\QNBsDzW.exe
  2⤵
  PID:8224
- C:\Windows\System\xYNVhWn.exe
  C:\Windows\System\xYNVhWn.exe
  2⤵
  PID:9348
- C:\Windows\System\csUodvJ.exe
  C:\Windows\System\csUodvJ.exe
  2⤵
  PID:9380
- C:\Windows\System\EDbGiVi.exe
  C:\Windows\System\EDbGiVi.exe
  2⤵
  PID:9456
- C:\Windows\System\FsdBkuV.exe
  C:\Windows\System\FsdBkuV.exe
  2⤵
  PID:9412
- C:\Windows\System\bkaOUDV.exe
  C:\Windows\System\bkaOUDV.exe
  2⤵
  PID:9568
- C:\Windows\System\ZKZHqlH.exe
  C:\Windows\System\ZKZHqlH.exe
  2⤵
  PID:9704
- C:\Windows\System\KvXNBZn.exe
  C:\Windows\System\KvXNBZn.exe
  2⤵
  PID:9784
- C:\Windows\System\uZGkmsZ.exe
  C:\Windows\System\uZGkmsZ.exe
  2⤵
  PID:9640
- C:\Windows\System\fnQVUkm.exe
  C:\Windows\System\fnQVUkm.exe
  2⤵
  PID:9684
- C:\Windows\System\EaECFop.exe
  C:\Windows\System\EaECFop.exe
  2⤵
  PID:9816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AVepzYo.exe

Filesize
1.9MB

MD5
34373c5a03a00425f7f25f745a801ecd

SHA1
81bc7673abe14a74ae0f10f5b3adf773d112a193

SHA256
d6f42542ed198ee6c2f85e76e128a2a5c98e3fad29b79438a83efe53fbc293d7

SHA512
95f37ff35a01b34d48a27ee07e07688b2188f221cf1298d3b5913caee2447d537bf124a794e6474b732e28d0eef966348239b3f00f37d0b6b62cff68e820fbc9

Download Submit
C:\Windows\system\EGBuWjN.exe

Filesize
1.9MB

MD5
f6e4084a45d5c056561af726cb4159d7

SHA1
f05d251536f2b186edf4ab350c0ceb434e276caf

SHA256
351b427e5ecbe9aa2c7190a2e377e167a5c24192d33cc5642b1644383eba7946

SHA512
881caa09dd43d03c1c149c1de9ef44b8ac74cc321f19acff3682799791c23329b9bf9ab54495ac91a4435d09d53a683580ce774816fef9c34c68bf07a30f73dd

Download Submit
C:\Windows\system\KbhdITg.exe

Filesize
1.9MB

MD5
76f957b53273d00ad01db1850f1f50e4

SHA1
72d5df4e92be80af01caeb0d87dc1b0272a8deac

SHA256
deafccad4e37b76b7dfee35ed6398cfb3e54913f613a2a182b440ca4f07f7578

SHA512
47685870475d1d2be63fec8ab70496ec997d3b7061169d4c87dca01904d979c6f4cde410c0a2620a7f83385a04aaa363a4f714711cfe609f786ce2a5dc71aacb

Download Submit
C:\Windows\system\LLJyowi.exe

Filesize
1.9MB

MD5
c5c69befef06c446343874e983754cb5

SHA1
b47dcd6da107c866828fea7879a18cbfe04e4936

SHA256
67ade9de3d28692bac1aec334645346a772a30163c6b94f7d31cfa609f624645

SHA512
1a2c68c4a1132cb0bda078f6eea78f6ece50d168b559c9494301be5890a09097a1d569ad7a44858513bed9b1993979b406d58e19238b93146b1523dc51c971ac

Download Submit
C:\Windows\system\OtcKqWa.exe

Filesize
1.9MB

MD5
960bbb60865a3ec0a3d255f7987b5987

SHA1
ce09f8c2f6dc3a00746e2cfcafc5516241a3ba37

SHA256
c7a1cafeb65d2442f82f38f470d620524e7943d50eca60c8c2df88abe61be341

SHA512
58f65d4cacdca2a276060a1c54ca1c50ae3fa72343dafcf9ebc21f91b7f50aaa8fe9a99bec15cadc50b669d377bb3574c5cad5eaea6a54cd2bce29f12b76c25b

Download Submit
C:\Windows\system\TRTUkOr.exe

Filesize
1.9MB

MD5
b7a25c552e14fb84ad2136a3c797c603

SHA1
0dd95f97f61d3998685b73f27b48dee32cacf297

SHA256
9d44944514d8c2fb2ea4f1ce94d16217e38e4bfd9a1a9d9c2d9ef4d987b506e2

SHA512
411823e421efe52db8b84240f3e5257009bb009de8600d84ef922d2c32173470dd91e454035a372bd76c0ed5478423867114c0ba1f699d69735707136f25ed71

Download Submit
C:\Windows\system\TlgHOhY.exe

Filesize
1.9MB

MD5
7f979049d13e75c49444c7ed478bc1a1

SHA1
ad39c13e1374a76670b8cff72f86af62cb9507ec

SHA256
88d93d0a4ec31ddb455d610d0e3408920d833c0eeca256041df3039857a4a7a1

SHA512
8f13ebc4dd020b7dbe662439d8faf21fcff413c700efd8a78a5468f46f76c36aa906cb231381a538bea31b7c65d0a765d94ab833a5af5853ac8b5c6968678037

Download Submit
C:\Windows\system\UpTfFuT.exe

Filesize
1.9MB

MD5
3bb0bec4d3f3a14418dc7bb3854147b5

SHA1
722d9048f4d283f36a251fec00b81e25d4f6ab41

SHA256
d990b27142e1082f61d0fbda08cbf2420a5984c6cd5b5f27c7750c7534219af8

SHA512
832297880e3abb15137d1dbab1a01dea65e096fe4ef8c2b46c028f0fb95ecc5929b123320e57499708def1fce5f3198597828fbdb69512bafe373e3254f4dc71

Download Submit
C:\Windows\system\XBeNdoB.exe

Filesize
1.9MB

MD5
d45d9d6ea8cc31d741e6ed8984f5dc5d

SHA1
3001d87af105c32132c3dbebdd6abe9ce2298937

SHA256
425820b8680fdd91d73a54fd286c817a9f335d30ce650df83bd787f5fcd445fa

SHA512
922ef2274e3a626b433bfe9f20c24646b94d8942adc342e27d0daf3b731bd736836218c043ea7b1d7a39e97f55416af708b00395364f418e6c7ff582e3c25b6e

Download Submit
C:\Windows\system\YHgdDgz.exe

Filesize
1.9MB

MD5
bd010e28388a500cd3ffa5e59151b717

SHA1
78a605f718648f738c00043ef097997ca84b1640

SHA256
aea8c8152f82145cefe0cab2378ead76918e9a9574948344eda6dcc5fa6db018

SHA512
b1998a8900ecd8237635d98e660a06c3fbaf65ac0dc187c0fd6b06380fd57dfcc895debb27a8b5bf4688dace6f47e0b6a4aa5ec5b7314f975c9651a006764f3c

Download Submit
C:\Windows\system\aBfbsha.exe

Filesize
1.9MB

MD5
24957bcf06eb49a1e2331b440c376593

SHA1
41a2c793e15a0048417557247c6600bc07a15134

SHA256
f1aeebb748464972473c6daada084d6d278563dac6649ff8fd2ec7b0c6d9d005

SHA512
fc1c9d8b983fb020f7e31aab7d21e637d4fa8c3f96ec875fece55d546f166b694a12c2a72de1522829a6f46155ac503a98d39440dd3107aaef4975596b24dd78

Download Submit
C:\Windows\system\bfcKgpu.exe

Filesize
1.9MB

MD5
79eba0ea4b6ace55d7976b8c55fbff54

SHA1
8251d322f8d81d3450b85509fd3b571f7e863116

SHA256
bf3a1db1835e0cc1028a41939b6d9611574c165db5e9d75bcf87a0e47203448a

SHA512
64621ff495195cf1e5ca9217fcfbfb955e58d79bba11e227306f63d1761d226735e1e8ba7113b032e51acb54bfd2b262bd08dee0d9264251fc2769efe2981702

Download Submit
C:\Windows\system\eINmQDI.exe

Filesize
1.9MB

MD5
7df63ca4c2b7ae3203099eeb413adbb7

SHA1
7cf22c094a22feb8a4483bf2812b6ebc0fe79379

SHA256
2e69de583cf600b279d7dcc3c1da9f578de7b95dc648789d6bd1a626086b6606

SHA512
3e82ee02baf228d10e4d405d68a7bea5ef68535369f6e2b3e809e12c8dfe66475e5227266907a4e7b1a3d48d33d5a5d60afcf3ea8ce0ab0aaafb595e5d5ff3e9

Download Submit
C:\Windows\system\ePkvdzW.exe

Filesize
1.9MB

MD5
e01a90370d025e84d75daf1ef7981db0

SHA1
0c696470cf4ca1e5998aa64ecec028d8d9f78938

SHA256
f4105734a155a715d5c049a7627f8be7661d1a2c2fed8c3586ff4f3297ba5890

SHA512
2a4812228bb44a1dd879f6590e7943f8c0f92d5915f58e959bf5bcc9bd016a60ea1e540e18a872c795b979f418a2c88b25f9036cce3effd6c636f5d1310b3c5a

Download Submit
C:\Windows\system\fjztFQt.exe

Filesize
1.9MB

MD5
172bf67a98ad826c158b7f13281c84fd

SHA1
70feb54c6c569be6f2c52550323fd8b9a6ffb5be

SHA256
91200e705fcae73988f70c357dba86acc3da4cfa7ee41c6c55026d9f8a82f92b

SHA512
6ede1beb24fee823f68a462f1186c32d0ba9c19de66c092589b3ce18fb2b0e95b22b3f55496b323a2c822ccc1b9d9b1cc86952e18363bff72d40c2ec001ee787

Download Submit
C:\Windows\system\hYSwtgq.exe

Filesize
1.9MB

MD5
f173fd33d79a3709882c34cd64b5919a

SHA1
5f6856901bac5536c7bfa1e194fd4374cc218e92

SHA256
1d8d9ccf541154cae5083f8d7f56362f56b17d946a38a1581ecbf3e045956c53

SHA512
6f74a33f2a43a6c874e4f21dd48bd39725defdaddd03ea0af142b9065391aa1748f6bf30b4d25ec807c157e11dce0486215c61e34ceeb9df10e2c243896bae14

Download Submit
C:\Windows\system\oGFZPsD.exe

Filesize
1.9MB

MD5
b362778e210868c1eee3f4ac83c8a26a

SHA1
21e07932c9fea1c4b87a398afde23f8c34ae21f7

SHA256
93a45980467f84da63ccaddf07a4c8c841c4c6e37ae474f14818da3402fac2bd

SHA512
c3af463895796a84a931843b9457657fa7d6f52196d4f9c8523a48801869f1fce6fd5edcc5da941f1c12caee7b0c5c46830064a59dbcb7520923e068e19f5f17

Download Submit
C:\Windows\system\rEnEngo.exe

Filesize
1.9MB

MD5
c1307829631687d887f3e813389bfe1e

SHA1
12640ff4f6e7ad894beccd2215af6bcf675a6b95

SHA256
adc6a0c14e5cac9dcb3a03aad679ae7ee8a3f30fdd7e63d652cdbb1291a133ad

SHA512
33624aaca45f57987a3ee5430741d4bd362b7c5321c890461b435a922d300f2f4a693cd3e3595b24ad1a5caf91ac0ff1c7bf29e5ad1f671f9ba3fd0311b1aff8

Download Submit
C:\Windows\system\rcrLKdB.exe

Filesize
1.9MB

MD5
28d6959758f4e263c07da4ed53bfcd47

SHA1
f336bb9b1868235a4e6607cf2abf464b85744bce

SHA256
9ac2edb301f3a4b382821a01d49c57cdd12a473a6809554f45c6c77de259260f

SHA512
d0cd4e85535884e59ac1bedd93f5abcc62c0eccb8c28681e8f0ded99f744acf69f4dcc5964b63aad63f0ed4e3cdc473b5bd37211b548833f3d8bf5fc89c82d52

Download Submit
C:\Windows\system\reyiWLE.exe

Filesize
1.9MB

MD5
904f99d1733d241442da1f70bd3daa74

SHA1
f328be954bec1ce15c1642794118e4abac33d0f0

SHA256
d6ef8c64a9ac0585a424e8c6a7641d7d6ca1c86e04853451027fa2beaf43ebf2

SHA512
6363ecbddd93fbb75d30810412fcde427823240b5377006075006e12044b9906ae90cf4b9f73bf054cd450455f464d0f148423f76749e0fc3a03781ce2fd29e9

Download Submit
C:\Windows\system\sybApgO.exe

Filesize
1.9MB

MD5
15fdd945eea5d5418e1206105cfe022d

SHA1
09b5542a3ed2f08e7bf58278c772218b69286786

SHA256
5ba33bcdca260dc68537ef726b63f0843f62bb8f8f619fdcfc86b3ca7cb43691

SHA512
a9ab123ec393ee4587694a84c4cd178edd57177cc33e2f8abf32c02928e461adac9760b26710c1081873472b1a73186b7ccc25d68db2985d3d3e30fd587562f0

Download Submit
C:\Windows\system\tTIBnEA.exe

Filesize
1.9MB

MD5
a9a78efbded12c6daf12566696a2e182

SHA1
24f30d5bcbe9813efb3e6cea424d29e6d1ecb785

SHA256
4a40ab3a61d2fb9908d944eaed32f73e37c8bfde07f53cdd676399aca59e8169

SHA512
1f62dfbb1051d422aa757b58e411b916413c7e3378190b6eba790cd6cb4ed6be4b02d64017fed1cdb5333ee1225be453c5756d3dd43d28af8bb57b33434deebd

Download Submit
C:\Windows\system\uJHFYrm.exe

Filesize
1.9MB

MD5
203488841e0f89bab8684a5422ff3b3d

SHA1
16168ce0b45b49620c496aac8f6e7c6103609709

SHA256
6260f27f77d1e58d36bc763e29cbbbf657a2bd886a6ad085ef1776dfff36e4d0

SHA512
03fd5fe91f970d4a55523961abd2925d1d716d90cb139de7dbffdbfbb9b8ec7c0047832310b1790999614e6b99b4611d12f6147e97bf51539282e919d388bb8b

Download Submit
C:\Windows\system\wFctiPX.exe

Filesize
1.9MB

MD5
05937047c955120e4c816987ccce8483

SHA1
9f3160a40bd15a5df1745e74d8bd5d9052398886

SHA256
6d791cb105ccb85002355fc5764a26cfd2f0fb18996cc1d86cabc0d2a0873089

SHA512
9cfa077fc7b3a1fd9d8aa997b6df0e32ce572bb5dce5f9ac9ea7fe15201a37ced134a05562c690988cc562265488d3bfef138310a4c581bc0f0bd62fba2821dc

Download Submit
C:\Windows\system\xXlHesK.exe

Filesize
1.9MB

MD5
aa65191eb160d0987d96ac823696c209

SHA1
046749fdd8c23ee0bb249c31bfab0ade1c7b3329

SHA256
15845566d9536c310ded3b651eced3ac4d73264fd6c31b8085b5e72039fee725

SHA512
9871c26cbd9b1ecba63f4713c5e376b5a516d915e370b19dc9955f2f9bbe3f7f627093090d3fd56243023099d314928ffa1336e1a0ff030a7163e5f7a613acc9

Download Submit
C:\Windows\system\yjKAkpk.exe

Filesize
1.9MB

MD5
770a4dfaaa925e7ee8cf69ef5bbf1ed2

SHA1
711185962eef3d5e5ee2f8c00f8937e418a69fe4

SHA256
e2129608906ff2863f8a17214c3cb4b5ddec7df6b3cf0c1292202609da5cb147

SHA512
d36c53f6a294c631a19d5059e6e2d518b14e615467f04bfb997d377af5c59a9b974aa7d87f4bc5ef29c21a659b2b4a91092b543d28f754995684f39ebd56014a

Download Submit
\Windows\system\DwPDkVM.exe

Filesize
1.9MB

MD5
d902b89b4e8af3921b54a9c36d7a8e47

SHA1
30f77647263616c114cac925ee11633d19957822

SHA256
b5ac71b340267efee131f4c9f196bc2b445e1b00e04aa060c81cd87546e8bdcd

SHA512
74fcff15fc1fa7565490d5439b3bb1fa3404204db45cb292f42256366fa23d9e045fac1ea48ad5f14e3c19b0742d74cc2de4a8d9368c295e7393765993edf7aa

Download Submit
\Windows\system\UpvqFUO.exe

Filesize
1.9MB

MD5
60b8a48b959629082bad730007c76042

SHA1
4025bfbc9e41fde862734494facbd0c288ae28af

SHA256
e011acbb3d790ee0794f915a14ae51481d5eb7dfc718830405dfe80bd6f5daa2

SHA512
c93718ee0097471e540a1d786e8a23389b19998de0e5b1043da0673f480119e24cb1db56964c145388466c045a8a728cb2df84ee27dbcd19f48257586c19a5d4

Download Submit
\Windows\system\dGWeFZz.exe

Filesize
1.9MB

MD5
a29b3185e6799ebd791c1e2016022c78

SHA1
17e430e450193e39eb6214cb2eda4f32246f376e

SHA256
8071484e5c46b17d48a581fe2afcbb4283e367c5227f6f9ed87d89f16ab6c5dd

SHA512
cb5432791592670945446e9d0207d206b454bacf25a0adadfcf9c4878dff6262faa64ba1c9a1ca1bcfcf26fca704b94abfb0a0544805a282421a19dbbf646fab

Download Submit
\Windows\system\oVmXCXf.exe

Filesize
1.9MB

MD5
5f074f49fa0e9bca719cad9e41ab1a50

SHA1
c0064da11d281613420f6211e20577836b35c66c

SHA256
1b764de87163b059faead693b3a11c79a1172878109bc137c5e2793d336f5ac7

SHA512
26459cb509a0a6897be368dcc615c86e13cef446270d727ee59c32dab3c67495978cf7fdfb08e456f339cc3b47a5032e275afed68384d7c5142c5ff951b7d5ed

Download Submit
\Windows\system\ywcVYSh.exe

Filesize
1.9MB

MD5
7f78b115d17ce98c8849706e68261d7c

SHA1
f8b537a17113868eba7203ced3eca6748ab47fc3

SHA256
ebd29e37aeec43d9bac370c1c3ac49619292f9a2f2fd2d9348768648c228e26a

SHA512
19ce21949a0d8fd0e986e7c23caf6be3b9acca93732270c3d31daaac3b64b9106cbd26c1055ecb598f16d5f14206b12969065004117860abf8ec9ac32f2ac70b

Download Submit
\Windows\system\zEYQwbx.exe

Filesize
1.9MB

MD5
106133acb4ceeec4cbc1911555723ff2

SHA1
cf53b71554661d94ca6969db98da93e20750055b

SHA256
cdf045bca183a2858cd1f21a29d41b2095e9f4a5088358d5d95fa41d8d53f8db

SHA512
e7ec0e6d25a55a512a75877240395b830985c26e6aeaed6c536ccc880a86b6828c7cc6bdfa79863c1d2aad1cdea4aec1ea89d69f2926999ea3247a1bb6e6b695

Download Submit
memory/1804-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/1804-60-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/1804-22-0x00000000030F0000-0x00000000034E2000-memory.dmp

Filesize
3.9MB

Download
memory/1804-64-0x00000000035A0000-0x0000000003992000-memory.dmp

Filesize
3.9MB

Download
memory/1804-26-0x00000000030F0000-0x00000000034E2000-memory.dmp

Filesize
3.9MB

Download
memory/1804-81-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/1804-6-0x0000000002EC0000-0x00000000032B2000-memory.dmp

Filesize
3.9MB

Download
memory/1804-38-0x00000000030F0000-0x00000000034E2000-memory.dmp

Filesize
3.9MB

Download
memory/1804-94-0x00000000035A0000-0x0000000003992000-memory.dmp

Filesize
3.9MB

Download
memory/1804-44-0x00000000035A0000-0x0000000003992000-memory.dmp

Filesize
3.9MB

Download
memory/1804-83-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/1804-27-0x00000000030F0000-0x00000000034E2000-memory.dmp

Filesize
3.9MB

Download
memory/1804-0-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/1804-57-0x00000000035A0000-0x0000000003992000-memory.dmp

Filesize
3.9MB

Download
memory/1828-70-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/1828-8-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2256-79-0x0000000002040000-0x0000000002048000-memory.dmp

Filesize
32KB

Download
memory/2256-63-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2480-67-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2520-69-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-24-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2636-65-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/2672-29-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2704-30-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2708-1033-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2732-358-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2732-41-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2808-84-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2836-82-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-95-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download