xmrig | 003c54b4f411792ec32a28c0fda791f6c0b60377847c0e07da3c03254285afc2

Analysis

max time kernel
97s
max time network
113s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
Size

1.6MB
MD5

0bb0b26b8f85528ee1a90ff8512fef3c
SHA1

03f9e7ca71bfe6ab140ca0f33e27dcf1cfd471c9
SHA256

003c54b4f411792ec32a28c0fda791f6c0b60377847c0e07da3c03254285afc2
SHA512

e77e6058d84269e0b893201ee2b84b1e8c845e5ac3a6da28b29dcf378fb1f1f04a57dd750063c74ee192a50878287792eb8181f9ba8b647d4bc64bce6e42e290
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82Snn1:NABg

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral1/memory/2944-9-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2716-114-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2944-3072-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2560-3088-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig
behavioral1/memory/2548-3320-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2400-3678-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2944	RYljExA.exe
2716	focGped.exe
2560	jErmdyY.exe
2712	Znibhpc.exe
2548	UvshtAj.exe
2400	aHyIpPW.exe
2376	oRMcCYN.exe
2448	nxNhanl.exe
2792	kUaGvlm.exe
2796	WeTtoEJ.exe
804	cuBbOPE.exe
1472	HiJgwxb.exe
1648	PaAAUCG.exe
936	OcaRJyJ.exe
1364	xDgHpFT.exe
2432	RwVaFKf.exe
2632	uGYrnQg.exe
2636	YoLjWjA.exe
2280	yYkBWzY.exe
1228	ANZmNSD.exe
1800	VISiMlj.exe
2300	qYUJnrF.exe
752	JdxlEky.exe
1980	PROmJXp.exe
1656	VJufQlB.exe
1524	EfZTVLi.exe
852	khoWLfT.exe
2016	zZoyYhm.exe
2260	UDXauPE.exe
2552	EKmhjIr.exe
2732	moUjnGZ.exe
2116	GMlqABO.exe
268	EakyNSq.exe
1436	DasUYXI.exe
2040	yduJCfv.exe
2008	MmVPjcM.exe
2968	VYAVIeH.exe
2976	GnmTDAs.exe
2188	yAzlfpy.exe
1984	BVxPTYO.exe
1844	kIRgDGn.exe
928	NlOEiRd.exe
1544	SEhPNQF.exe
1288	eQWesVR.exe
1104	TbpDakt.exe
1724	AGUyfXl.exe
1068	yfaNyRK.exe
1828	fifdVdL.exe
1092	HknrPNs.exe
320	eTdXMco.exe
624	VXCHKNs.exe
2996	STdUmer.exe
820	yBNroyN.exe
868	wervxGo.exe
2164	vdFUToR.exe
1596	kGzXJal.exe
2648	KIKaLwE.exe
3048	JFFOnyt.exe
2568	hrTXAgp.exe
1220	lxRsbBe.exe
1164	oCoOYET.exe
3036	qpyyuqH.exe
860	xrCAjwq.exe
2600	EGKspGb.exe

Loads dropped DLL 64 IoCs

pid	Process
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2900-1-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/files/0x000e000000015a98-7.dat	upx
behavioral1/memory/2944-9-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/files/0x0029000000015c52-14.dat	upx
behavioral1/files/0x0009000000015c87-22.dat	upx
behavioral1/files/0x0007000000015cb9-29.dat	upx
behavioral1/files/0x0007000000015d88-32.dat	upx
behavioral1/files/0x0007000000015db4-37.dat	upx
behavioral1/files/0x0006000000018ae2-44.dat	upx
behavioral1/files/0x0006000000018b15-52.dat	upx
behavioral1/files/0x0006000000018b33-56.dat	upx
behavioral1/files/0x0006000000018b42-64.dat	upx
behavioral1/files/0x0006000000018b6a-70.dat	upx
behavioral1/files/0x0006000000018b73-76.dat	upx
behavioral1/files/0x0006000000018b96-80.dat	upx
behavioral1/files/0x0006000000018d06-88.dat	upx
behavioral1/files/0x00050000000192f4-97.dat	upx
behavioral1/files/0x0005000000019333-105.dat	upx
behavioral1/files/0x0005000000019473-158.dat	upx
behavioral1/files/0x000500000001946f-154.dat	upx
behavioral1/files/0x000500000001946b-150.dat	upx
behavioral1/files/0x0005000000019410-146.dat	upx
behavioral1/files/0x00050000000193b0-142.dat	upx
behavioral1/files/0x000500000001939b-138.dat	upx
behavioral1/files/0x0005000000019377-134.dat	upx
behavioral1/memory/2792-128-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2448-126-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2376-124-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2400-122-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/2548-120-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2712-118-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2560-116-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/memory/2716-114-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/files/0x0005000000019368-109.dat	upx
behavioral1/files/0x000500000001931b-101.dat	upx
behavioral1/files/0x00050000000192c9-92.dat	upx
behavioral1/files/0x0006000000018ba2-84.dat	upx
behavioral1/files/0x0006000000018b4a-68.dat	upx
behavioral1/files/0x0006000000018b37-60.dat	upx
behavioral1/files/0x0006000000018ae8-48.dat	upx
behavioral1/files/0x00080000000167db-40.dat	upx
behavioral1/files/0x000f0000000006fd-21.dat	upx
behavioral1/memory/2944-3072-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/2560-3088-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/memory/2548-3320-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2400-3678-0x000000013FE20000-0x0000000140212000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\alMJaMb.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\CbuntIC.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\QeFXOgb.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\EiUMiLW.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\tquWHTn.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\GFDeDbO.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\OcaRJyJ.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\IGxuBhe.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\uwdoUnO.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\FqJkHAY.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\nIHKPZi.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\rUNyixs.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\ZoxibiV.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\MFqBGat.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\HlICmvV.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\docksEj.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\aZWhBaA.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\UGNwtAr.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\UvylKGn.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\uWVWuvo.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\qEtqefy.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\rDNIFkp.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\RzjUvBb.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\wbsDeEp.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\TUIwRrR.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\rjGLfuy.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\buXuSRf.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\yAzlfpy.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\dmDwPPJ.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\uTBQByv.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\wervxGo.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\uGjbALg.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\vrcMKGc.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\qBBtWAF.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\RzbvLvC.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\lrgaKaJ.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\UDXauPE.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\KTrmSTZ.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\CWBYJGE.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\siIqVbu.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\SJJEFSV.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\Vfjwmkj.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\SpVNaYu.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\fjBweVH.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\QqsHwsY.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\OeEbPdW.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\nxNhanl.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\RRXFXat.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\AKvLPyG.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\HBxzyYd.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\WMVmvks.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\PfjAMhX.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\fVjpZud.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\SAXDoHA.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\jccdSLh.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\BdKfvLV.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\yBcJOci.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\eQWesVR.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\qBFyDOY.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\iqkaAZN.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\SXJZfAG.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\CmTSHFG.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\WPaDIwJ.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
File created	C:\Windows\System\KkFpZgn.exe	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2860	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
Token: SeDebugPrivilege	2860	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2860	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	29
PID 2900 wrote to memory of 2860	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	29
PID 2900 wrote to memory of 2860	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	29
PID 2900 wrote to memory of 2944	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	30
PID 2900 wrote to memory of 2944	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	30
PID 2900 wrote to memory of 2944	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	30
PID 2900 wrote to memory of 2716	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	31
PID 2900 wrote to memory of 2716	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	31
PID 2900 wrote to memory of 2716	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	31
PID 2900 wrote to memory of 2560	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	32
PID 2900 wrote to memory of 2560	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	32
PID 2900 wrote to memory of 2560	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	32
PID 2900 wrote to memory of 2712	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	33
PID 2900 wrote to memory of 2712	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	33
PID 2900 wrote to memory of 2712	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	33
PID 2900 wrote to memory of 2548	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	34
PID 2900 wrote to memory of 2548	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	34
PID 2900 wrote to memory of 2548	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	34
PID 2900 wrote to memory of 2400	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	35
PID 2900 wrote to memory of 2400	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	35
PID 2900 wrote to memory of 2400	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	35
PID 2900 wrote to memory of 2376	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	36
PID 2900 wrote to memory of 2376	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	36
PID 2900 wrote to memory of 2376	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	36
PID 2900 wrote to memory of 2448	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	37
PID 2900 wrote to memory of 2448	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	37
PID 2900 wrote to memory of 2448	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	37
PID 2900 wrote to memory of 2792	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	38
PID 2900 wrote to memory of 2792	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	38
PID 2900 wrote to memory of 2792	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	38
PID 2900 wrote to memory of 2796	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	39
PID 2900 wrote to memory of 2796	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	39
PID 2900 wrote to memory of 2796	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	39
PID 2900 wrote to memory of 804	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	40
PID 2900 wrote to memory of 804	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	40
PID 2900 wrote to memory of 804	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	40
PID 2900 wrote to memory of 1472	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	41
PID 2900 wrote to memory of 1472	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	41
PID 2900 wrote to memory of 1472	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	41
PID 2900 wrote to memory of 1648	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	42
PID 2900 wrote to memory of 1648	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	42
PID 2900 wrote to memory of 1648	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	42
PID 2900 wrote to memory of 936	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	43
PID 2900 wrote to memory of 936	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	43
PID 2900 wrote to memory of 936	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	43
PID 2900 wrote to memory of 1364	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	44
PID 2900 wrote to memory of 1364	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	44
PID 2900 wrote to memory of 1364	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	44
PID 2900 wrote to memory of 2432	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	45
PID 2900 wrote to memory of 2432	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	45
PID 2900 wrote to memory of 2432	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	45
PID 2900 wrote to memory of 2632	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	46
PID 2900 wrote to memory of 2632	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	46
PID 2900 wrote to memory of 2632	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	46
PID 2900 wrote to memory of 2636	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	47
PID 2900 wrote to memory of 2636	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	47
PID 2900 wrote to memory of 2636	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	47
PID 2900 wrote to memory of 2280	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	48
PID 2900 wrote to memory of 2280	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	48
PID 2900 wrote to memory of 2280	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	48
PID 2900 wrote to memory of 1228	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	49
PID 2900 wrote to memory of 1228	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	49
PID 2900 wrote to memory of 1228	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	49
PID 2900 wrote to memory of 1800	2900	0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0bb0b26b8f85528ee1a90ff8512fef3c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Windows\System\RYljExA.exe
  C:\Windows\System\RYljExA.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\focGped.exe
  C:\Windows\System\focGped.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\jErmdyY.exe
  C:\Windows\System\jErmdyY.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\Znibhpc.exe
  C:\Windows\System\Znibhpc.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\UvshtAj.exe
  C:\Windows\System\UvshtAj.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\aHyIpPW.exe
  C:\Windows\System\aHyIpPW.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\oRMcCYN.exe
  C:\Windows\System\oRMcCYN.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\nxNhanl.exe
  C:\Windows\System\nxNhanl.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\kUaGvlm.exe
  C:\Windows\System\kUaGvlm.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\WeTtoEJ.exe
  C:\Windows\System\WeTtoEJ.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\cuBbOPE.exe
  C:\Windows\System\cuBbOPE.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\HiJgwxb.exe
  C:\Windows\System\HiJgwxb.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\PaAAUCG.exe
  C:\Windows\System\PaAAUCG.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\OcaRJyJ.exe
  C:\Windows\System\OcaRJyJ.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\xDgHpFT.exe
  C:\Windows\System\xDgHpFT.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\RwVaFKf.exe
  C:\Windows\System\RwVaFKf.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\uGYrnQg.exe
  C:\Windows\System\uGYrnQg.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\YoLjWjA.exe
  C:\Windows\System\YoLjWjA.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\yYkBWzY.exe
  C:\Windows\System\yYkBWzY.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\ANZmNSD.exe
  C:\Windows\System\ANZmNSD.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\VISiMlj.exe
  C:\Windows\System\VISiMlj.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\qYUJnrF.exe
  C:\Windows\System\qYUJnrF.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\JdxlEky.exe
  C:\Windows\System\JdxlEky.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\PROmJXp.exe
  C:\Windows\System\PROmJXp.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\VJufQlB.exe
  C:\Windows\System\VJufQlB.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\EfZTVLi.exe
  C:\Windows\System\EfZTVLi.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\khoWLfT.exe
  C:\Windows\System\khoWLfT.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\zZoyYhm.exe
  C:\Windows\System\zZoyYhm.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\UDXauPE.exe
  C:\Windows\System\UDXauPE.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\EKmhjIr.exe
  C:\Windows\System\EKmhjIr.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\moUjnGZ.exe
  C:\Windows\System\moUjnGZ.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\GMlqABO.exe
  C:\Windows\System\GMlqABO.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\EakyNSq.exe
  C:\Windows\System\EakyNSq.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\DasUYXI.exe
  C:\Windows\System\DasUYXI.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\yduJCfv.exe
  C:\Windows\System\yduJCfv.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\MmVPjcM.exe
  C:\Windows\System\MmVPjcM.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\VYAVIeH.exe
  C:\Windows\System\VYAVIeH.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\GnmTDAs.exe
  C:\Windows\System\GnmTDAs.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\yAzlfpy.exe
  C:\Windows\System\yAzlfpy.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\BVxPTYO.exe
  C:\Windows\System\BVxPTYO.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\kIRgDGn.exe
  C:\Windows\System\kIRgDGn.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\NlOEiRd.exe
  C:\Windows\System\NlOEiRd.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\SEhPNQF.exe
  C:\Windows\System\SEhPNQF.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\eQWesVR.exe
  C:\Windows\System\eQWesVR.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\TbpDakt.exe
  C:\Windows\System\TbpDakt.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\AGUyfXl.exe
  C:\Windows\System\AGUyfXl.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\yfaNyRK.exe
  C:\Windows\System\yfaNyRK.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\fifdVdL.exe
  C:\Windows\System\fifdVdL.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\HknrPNs.exe
  C:\Windows\System\HknrPNs.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\eTdXMco.exe
  C:\Windows\System\eTdXMco.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\VXCHKNs.exe
  C:\Windows\System\VXCHKNs.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\STdUmer.exe
  C:\Windows\System\STdUmer.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\yBNroyN.exe
  C:\Windows\System\yBNroyN.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\lxRsbBe.exe
  C:\Windows\System\lxRsbBe.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\wervxGo.exe
  C:\Windows\System\wervxGo.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\oCoOYET.exe
  C:\Windows\System\oCoOYET.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\vdFUToR.exe
  C:\Windows\System\vdFUToR.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\qpyyuqH.exe
  C:\Windows\System\qpyyuqH.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\kGzXJal.exe
  C:\Windows\System\kGzXJal.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\xrCAjwq.exe
  C:\Windows\System\xrCAjwq.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\KIKaLwE.exe
  C:\Windows\System\KIKaLwE.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\EGKspGb.exe
  C:\Windows\System\EGKspGb.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\JFFOnyt.exe
  C:\Windows\System\JFFOnyt.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\IOjzFEJ.exe
  C:\Windows\System\IOjzFEJ.exe
  2⤵
  PID:2388
- C:\Windows\System\hrTXAgp.exe
  C:\Windows\System\hrTXAgp.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\EXsSttB.exe
  C:\Windows\System\EXsSttB.exe
  2⤵
  PID:1508
- C:\Windows\System\TMWhowg.exe
  C:\Windows\System\TMWhowg.exe
  2⤵
  PID:660
- C:\Windows\System\AVgFupl.exe
  C:\Windows\System\AVgFupl.exe
  2⤵
  PID:1144
- C:\Windows\System\rijPNkA.exe
  C:\Windows\System\rijPNkA.exe
  2⤵
  PID:1060
- C:\Windows\System\NGXniks.exe
  C:\Windows\System\NGXniks.exe
  2⤵
  PID:3052
- C:\Windows\System\ZKnzksT.exe
  C:\Windows\System\ZKnzksT.exe
  2⤵
  PID:2196
- C:\Windows\System\UKcYYkj.exe
  C:\Windows\System\UKcYYkj.exe
  2⤵
  PID:1548
- C:\Windows\System\SxWAuaL.exe
  C:\Windows\System\SxWAuaL.exe
  2⤵
  PID:1628
- C:\Windows\System\GTvezzk.exe
  C:\Windows\System\GTvezzk.exe
  2⤵
  PID:2024
- C:\Windows\System\orhPVtz.exe
  C:\Windows\System\orhPVtz.exe
  2⤵
  PID:892
- C:\Windows\System\uqHCEiC.exe
  C:\Windows\System\uqHCEiC.exe
  2⤵
  PID:2592
- C:\Windows\System\lBHyLSN.exe
  C:\Windows\System\lBHyLSN.exe
  2⤵
  PID:2168
- C:\Windows\System\OUEWrwn.exe
  C:\Windows\System\OUEWrwn.exe
  2⤵
  PID:2192
- C:\Windows\System\KpizSIH.exe
  C:\Windows\System\KpizSIH.exe
  2⤵
  PID:1732
- C:\Windows\System\sQgadCe.exe
  C:\Windows\System\sQgadCe.exe
  2⤵
  PID:2752
- C:\Windows\System\ohIyTjn.exe
  C:\Windows\System\ohIyTjn.exe
  2⤵
  PID:2216
- C:\Windows\System\UnltuUD.exe
  C:\Windows\System\UnltuUD.exe
  2⤵
  PID:532
- C:\Windows\System\TtXcHxx.exe
  C:\Windows\System\TtXcHxx.exe
  2⤵
  PID:3028
- C:\Windows\System\sKYyvXZ.exe
  C:\Windows\System\sKYyvXZ.exe
  2⤵
  PID:2484
- C:\Windows\System\eSntLOe.exe
  C:\Windows\System\eSntLOe.exe
  2⤵
  PID:2488
- C:\Windows\System\LoHTbDN.exe
  C:\Windows\System\LoHTbDN.exe
  2⤵
  PID:1080
- C:\Windows\System\tEfwqgv.exe
  C:\Windows\System\tEfwqgv.exe
  2⤵
  PID:2924
- C:\Windows\System\PZXCaam.exe
  C:\Windows\System\PZXCaam.exe
  2⤵
  PID:1340
- C:\Windows\System\TgMSyJV.exe
  C:\Windows\System\TgMSyJV.exe
  2⤵
  PID:1856
- C:\Windows\System\QYDiQdQ.exe
  C:\Windows\System\QYDiQdQ.exe
  2⤵
  PID:2640
- C:\Windows\System\vGoonIO.exe
  C:\Windows\System\vGoonIO.exe
  2⤵
  PID:2148
- C:\Windows\System\ljtExGw.exe
  C:\Windows\System\ljtExGw.exe
  2⤵
  PID:2320
- C:\Windows\System\MmhAwQn.exe
  C:\Windows\System\MmhAwQn.exe
  2⤵
  PID:1748
- C:\Windows\System\noKTdWX.exe
  C:\Windows\System\noKTdWX.exe
  2⤵
  PID:1248
- C:\Windows\System\ZaEHYBf.exe
  C:\Windows\System\ZaEHYBf.exe
  2⤵
  PID:940
- C:\Windows\System\eKxPnuD.exe
  C:\Windows\System\eKxPnuD.exe
  2⤵
  PID:1624
- C:\Windows\System\oIzZxBF.exe
  C:\Windows\System\oIzZxBF.exe
  2⤵
  PID:2676
- C:\Windows\System\UKOFFoI.exe
  C:\Windows\System\UKOFFoI.exe
  2⤵
  PID:2316
- C:\Windows\System\qivumrf.exe
  C:\Windows\System\qivumrf.exe
  2⤵
  PID:2044
- C:\Windows\System\SkReQwY.exe
  C:\Windows\System\SkReQwY.exe
  2⤵
  PID:2256
- C:\Windows\System\JqLyDSB.exe
  C:\Windows\System\JqLyDSB.exe
  2⤵
  PID:276
- C:\Windows\System\YZdGjmp.exe
  C:\Windows\System\YZdGjmp.exe
  2⤵
  PID:2684
- C:\Windows\System\QSmuOEc.exe
  C:\Windows\System\QSmuOEc.exe
  2⤵
  PID:932
- C:\Windows\System\qjevKrz.exe
  C:\Windows\System\qjevKrz.exe
  2⤵
  PID:2144
- C:\Windows\System\vbkIPBA.exe
  C:\Windows\System\vbkIPBA.exe
  2⤵
  PID:1620
- C:\Windows\System\SEKgXcZ.exe
  C:\Windows\System\SEKgXcZ.exe
  2⤵
  PID:1492
- C:\Windows\System\vfxqzSi.exe
  C:\Windows\System\vfxqzSi.exe
  2⤵
  PID:924
- C:\Windows\System\WqICqpY.exe
  C:\Windows\System\WqICqpY.exe
  2⤵
  PID:2652
- C:\Windows\System\QLjpaBc.exe
  C:\Windows\System\QLjpaBc.exe
  2⤵
  PID:2228
- C:\Windows\System\xnuRHXy.exe
  C:\Windows\System\xnuRHXy.exe
  2⤵
  PID:948
- C:\Windows\System\SkCdDBU.exe
  C:\Windows\System\SkCdDBU.exe
  2⤵
  PID:1612
- C:\Windows\System\PBedsUA.exe
  C:\Windows\System\PBedsUA.exe
  2⤵
  PID:368
- C:\Windows\System\JgLpuol.exe
  C:\Windows\System\JgLpuol.exe
  2⤵
  PID:2412
- C:\Windows\System\SaZaQuu.exe
  C:\Windows\System\SaZaQuu.exe
  2⤵
  PID:2408
- C:\Windows\System\WkAfsMw.exe
  C:\Windows\System\WkAfsMw.exe
  2⤵
  PID:2060
- C:\Windows\System\NUdoAkP.exe
  C:\Windows\System\NUdoAkP.exe
  2⤵
  PID:2700
- C:\Windows\System\RCKJVvx.exe
  C:\Windows\System\RCKJVvx.exe
  2⤵
  PID:2688
- C:\Windows\System\ZoxibiV.exe
  C:\Windows\System\ZoxibiV.exe
  2⤵
  PID:768
- C:\Windows\System\ZfAkhBZ.exe
  C:\Windows\System\ZfAkhBZ.exe
  2⤵
  PID:2356
- C:\Windows\System\ovkLXgP.exe
  C:\Windows\System\ovkLXgP.exe
  2⤵
  PID:2100
- C:\Windows\System\SKTxDUF.exe
  C:\Windows\System\SKTxDUF.exe
  2⤵
  PID:2672
- C:\Windows\System\rQZpoUi.exe
  C:\Windows\System\rQZpoUi.exe
  2⤵
  PID:872
- C:\Windows\System\uGHgAHB.exe
  C:\Windows\System\uGHgAHB.exe
  2⤵
  PID:1064
- C:\Windows\System\Yzarawg.exe
  C:\Windows\System\Yzarawg.exe
  2⤵
  PID:1684
- C:\Windows\System\KTrmSTZ.exe
  C:\Windows\System\KTrmSTZ.exe
  2⤵
  PID:1520
- C:\Windows\System\wlGzRzw.exe
  C:\Windows\System\wlGzRzw.exe
  2⤵
  PID:876
- C:\Windows\System\PTXVnmC.exe
  C:\Windows\System\PTXVnmC.exe
  2⤵
  PID:1572
- C:\Windows\System\mbbXGbn.exe
  C:\Windows\System\mbbXGbn.exe
  2⤵
  PID:2708
- C:\Windows\System\HxHmsFO.exe
  C:\Windows\System\HxHmsFO.exe
  2⤵
  PID:844
- C:\Windows\System\OAMtbLc.exe
  C:\Windows\System\OAMtbLc.exe
  2⤵
  PID:1216
- C:\Windows\System\TduTGyz.exe
  C:\Windows\System\TduTGyz.exe
  2⤵
  PID:2748
- C:\Windows\System\JGWELSQ.exe
  C:\Windows\System\JGWELSQ.exe
  2⤵
  PID:800
- C:\Windows\System\Vfjwmkj.exe
  C:\Windows\System\Vfjwmkj.exe
  2⤵
  PID:1344
- C:\Windows\System\tcMSuOo.exe
  C:\Windows\System\tcMSuOo.exe
  2⤵
  PID:1304
- C:\Windows\System\IGxuBhe.exe
  C:\Windows\System\IGxuBhe.exe
  2⤵
  PID:1212
- C:\Windows\System\sAoogAQ.exe
  C:\Windows\System\sAoogAQ.exe
  2⤵
  PID:2348
- C:\Windows\System\SNQrkXM.exe
  C:\Windows\System\SNQrkXM.exe
  2⤵
  PID:1812
- C:\Windows\System\RRXFXat.exe
  C:\Windows\System\RRXFXat.exe
  2⤵
  PID:2240
- C:\Windows\System\MFqBGat.exe
  C:\Windows\System\MFqBGat.exe
  2⤵
  PID:920
- C:\Windows\System\GJIDxwu.exe
  C:\Windows\System\GJIDxwu.exe
  2⤵
  PID:1704
- C:\Windows\System\KSMlvdz.exe
  C:\Windows\System\KSMlvdz.exe
  2⤵
  PID:2696
- C:\Windows\System\HTFPhux.exe
  C:\Windows\System\HTFPhux.exe
  2⤵
  PID:2628
- C:\Windows\System\txQcIho.exe
  C:\Windows\System\txQcIho.exe
  2⤵
  PID:280
- C:\Windows\System\eFXtHsE.exe
  C:\Windows\System\eFXtHsE.exe
  2⤵
  PID:2204
- C:\Windows\System\hcOUayn.exe
  C:\Windows\System\hcOUayn.exe
  2⤵
  PID:2616
- C:\Windows\System\UecRDjl.exe
  C:\Windows\System\UecRDjl.exe
  2⤵
  PID:2500
- C:\Windows\System\UgDhVuE.exe
  C:\Windows\System\UgDhVuE.exe
  2⤵
  PID:1652
- C:\Windows\System\hfVades.exe
  C:\Windows\System\hfVades.exe
  2⤵
  PID:1368
- C:\Windows\System\ztAWzWD.exe
  C:\Windows\System\ztAWzWD.exe
  2⤵
  PID:1700
- C:\Windows\System\WehRaQL.exe
  C:\Windows\System\WehRaQL.exe
  2⤵
  PID:1808
- C:\Windows\System\AKvLPyG.exe
  C:\Windows\System\AKvLPyG.exe
  2⤵
  PID:1640
- C:\Windows\System\rDNIFkp.exe
  C:\Windows\System\rDNIFkp.exe
  2⤵
  PID:2096
- C:\Windows\System\GqNIlXZ.exe
  C:\Windows\System\GqNIlXZ.exe
  2⤵
  PID:1504
- C:\Windows\System\XGbEZfd.exe
  C:\Windows\System\XGbEZfd.exe
  2⤵
  PID:2344
- C:\Windows\System\foklkws.exe
  C:\Windows\System\foklkws.exe
  2⤵
  PID:748
- C:\Windows\System\tPYGhhb.exe
  C:\Windows\System\tPYGhhb.exe
  2⤵
  PID:1600
- C:\Windows\System\gZDRUZH.exe
  C:\Windows\System\gZDRUZH.exe
  2⤵
  PID:1712
- C:\Windows\System\UMukeht.exe
  C:\Windows\System\UMukeht.exe
  2⤵
  PID:2004
- C:\Windows\System\vDPqElK.exe
  C:\Windows\System\vDPqElK.exe
  2⤵
  PID:572
- C:\Windows\System\WBZjDNP.exe
  C:\Windows\System\WBZjDNP.exe
  2⤵
  PID:3000
- C:\Windows\System\VmZVJyl.exe
  C:\Windows\System\VmZVJyl.exe
  2⤵
  PID:2308
- C:\Windows\System\ZLItMPP.exe
  C:\Windows\System\ZLItMPP.exe
  2⤵
  PID:1316
- C:\Windows\System\OLVNoWp.exe
  C:\Windows\System\OLVNoWp.exe
  2⤵
  PID:2516
- C:\Windows\System\NswJsed.exe
  C:\Windows\System\NswJsed.exe
  2⤵
  PID:1576
- C:\Windows\System\qJQNjBi.exe
  C:\Windows\System\qJQNjBi.exe
  2⤵
  PID:2620
- C:\Windows\System\IqrRTIz.exe
  C:\Windows\System\IqrRTIz.exe
  2⤵
  PID:2212
- C:\Windows\System\Qonrpkg.exe
  C:\Windows\System\Qonrpkg.exe
  2⤵
  PID:3076
- C:\Windows\System\alMJaMb.exe
  C:\Windows\System\alMJaMb.exe
  2⤵
  PID:3092
- C:\Windows\System\QAFZTxC.exe
  C:\Windows\System\QAFZTxC.exe
  2⤵
  PID:3108
- C:\Windows\System\nhmSyKk.exe
  C:\Windows\System\nhmSyKk.exe
  2⤵
  PID:3124
- C:\Windows\System\pUmfbvN.exe
  C:\Windows\System\pUmfbvN.exe
  2⤵
  PID:3140
- C:\Windows\System\WKYilNU.exe
  C:\Windows\System\WKYilNU.exe
  2⤵
  PID:3156
- C:\Windows\System\ioiJTJF.exe
  C:\Windows\System\ioiJTJF.exe
  2⤵
  PID:3176
- C:\Windows\System\QAuECMZ.exe
  C:\Windows\System\QAuECMZ.exe
  2⤵
  PID:3236
- C:\Windows\System\IsoSIun.exe
  C:\Windows\System\IsoSIun.exe
  2⤵
  PID:3252
- C:\Windows\System\TExitmf.exe
  C:\Windows\System\TExitmf.exe
  2⤵
  PID:3268
- C:\Windows\System\EiPsRxb.exe
  C:\Windows\System\EiPsRxb.exe
  2⤵
  PID:3284
- C:\Windows\System\arObKUX.exe
  C:\Windows\System\arObKUX.exe
  2⤵
  PID:3324
- C:\Windows\System\KDCSLbb.exe
  C:\Windows\System\KDCSLbb.exe
  2⤵
  PID:3348
- C:\Windows\System\gXIICXQ.exe
  C:\Windows\System\gXIICXQ.exe
  2⤵
  PID:3368
- C:\Windows\System\DbAkozM.exe
  C:\Windows\System\DbAkozM.exe
  2⤵
  PID:3384
- C:\Windows\System\nyscuEE.exe
  C:\Windows\System\nyscuEE.exe
  2⤵
  PID:3400
- C:\Windows\System\kGQxLJA.exe
  C:\Windows\System\kGQxLJA.exe
  2⤵
  PID:3416
- C:\Windows\System\jZgGGkF.exe
  C:\Windows\System\jZgGGkF.exe
  2⤵
  PID:3432
- C:\Windows\System\qhXxnEW.exe
  C:\Windows\System\qhXxnEW.exe
  2⤵
  PID:3448
- C:\Windows\System\UtpuzxZ.exe
  C:\Windows\System\UtpuzxZ.exe
  2⤵
  PID:3464
- C:\Windows\System\rOXfMbg.exe
  C:\Windows\System\rOXfMbg.exe
  2⤵
  PID:3480
- C:\Windows\System\gNMHshT.exe
  C:\Windows\System\gNMHshT.exe
  2⤵
  PID:3500
- C:\Windows\System\KsnYDlV.exe
  C:\Windows\System\KsnYDlV.exe
  2⤵
  PID:3516
- C:\Windows\System\pnlWJIK.exe
  C:\Windows\System\pnlWJIK.exe
  2⤵
  PID:3532
- C:\Windows\System\PYQVXWH.exe
  C:\Windows\System\PYQVXWH.exe
  2⤵
  PID:3548
- C:\Windows\System\YwDpRWc.exe
  C:\Windows\System\YwDpRWc.exe
  2⤵
  PID:3600
- C:\Windows\System\XKmSouY.exe
  C:\Windows\System\XKmSouY.exe
  2⤵
  PID:3644
- C:\Windows\System\SpVNaYu.exe
  C:\Windows\System\SpVNaYu.exe
  2⤵
  PID:3660
- C:\Windows\System\izurESw.exe
  C:\Windows\System\izurESw.exe
  2⤵
  PID:3680
- C:\Windows\System\TvObvor.exe
  C:\Windows\System\TvObvor.exe
  2⤵
  PID:3700
- C:\Windows\System\HlICmvV.exe
  C:\Windows\System\HlICmvV.exe
  2⤵
  PID:3724
- C:\Windows\System\TcqRGRP.exe
  C:\Windows\System\TcqRGRP.exe
  2⤵
  PID:3740
- C:\Windows\System\UJNliYy.exe
  C:\Windows\System\UJNliYy.exe
  2⤵
  PID:3756
- C:\Windows\System\cvwLBMP.exe
  C:\Windows\System\cvwLBMP.exe
  2⤵
  PID:3772
- C:\Windows\System\kAUeuuK.exe
  C:\Windows\System\kAUeuuK.exe
  2⤵
  PID:3788
- C:\Windows\System\gcgmZQd.exe
  C:\Windows\System\gcgmZQd.exe
  2⤵
  PID:3808
- C:\Windows\System\bErFJbK.exe
  C:\Windows\System\bErFJbK.exe
  2⤵
  PID:3836
- C:\Windows\System\YXXFlDy.exe
  C:\Windows\System\YXXFlDy.exe
  2⤵
  PID:3852
- C:\Windows\System\DAxKZnU.exe
  C:\Windows\System\DAxKZnU.exe
  2⤵
  PID:3896
- C:\Windows\System\qlUwuqT.exe
  C:\Windows\System\qlUwuqT.exe
  2⤵
  PID:3912
- C:\Windows\System\VtEkVTm.exe
  C:\Windows\System\VtEkVTm.exe
  2⤵
  PID:3928
- C:\Windows\System\szmRyaN.exe
  C:\Windows\System\szmRyaN.exe
  2⤵
  PID:3944
- C:\Windows\System\zyOHAnf.exe
  C:\Windows\System\zyOHAnf.exe
  2⤵
  PID:3960
- C:\Windows\System\EfvwqeK.exe
  C:\Windows\System\EfvwqeK.exe
  2⤵
  PID:3976
- C:\Windows\System\QXjdVDi.exe
  C:\Windows\System\QXjdVDi.exe
  2⤵
  PID:3992
- C:\Windows\System\QeBeyVb.exe
  C:\Windows\System\QeBeyVb.exe
  2⤵
  PID:4008
- C:\Windows\System\vFmxgKr.exe
  C:\Windows\System\vFmxgKr.exe
  2⤵
  PID:4028
- C:\Windows\System\HEyvBHZ.exe
  C:\Windows\System\HEyvBHZ.exe
  2⤵
  PID:4044
- C:\Windows\System\XnaOjoA.exe
  C:\Windows\System\XnaOjoA.exe
  2⤵
  PID:4060
- C:\Windows\System\qZkpeBj.exe
  C:\Windows\System\qZkpeBj.exe
  2⤵
  PID:4076
- C:\Windows\System\rnwbyrS.exe
  C:\Windows\System\rnwbyrS.exe
  2⤵
  PID:4092
- C:\Windows\System\atPTLXp.exe
  C:\Windows\System\atPTLXp.exe
  2⤵
  PID:2132
- C:\Windows\System\CEVDHHE.exe
  C:\Windows\System\CEVDHHE.exe
  2⤵
  PID:2496
- C:\Windows\System\CbuntIC.exe
  C:\Windows\System\CbuntIC.exe
  2⤵
  PID:1860
- C:\Windows\System\UHvQCQC.exe
  C:\Windows\System\UHvQCQC.exe
  2⤵
  PID:1140
- C:\Windows\System\DgQlEBb.exe
  C:\Windows\System\DgQlEBb.exe
  2⤵
  PID:3088
- C:\Windows\System\NgdecWy.exe
  C:\Windows\System\NgdecWy.exe
  2⤵
  PID:3152
- C:\Windows\System\ipqwYjW.exe
  C:\Windows\System\ipqwYjW.exe
  2⤵
  PID:3196
- C:\Windows\System\naxMRMJ.exe
  C:\Windows\System\naxMRMJ.exe
  2⤵
  PID:3212
- C:\Windows\System\ldUWIOw.exe
  C:\Windows\System\ldUWIOw.exe
  2⤵
  PID:2604
- C:\Windows\System\hioKjMp.exe
  C:\Windows\System\hioKjMp.exe
  2⤵
  PID:2208
- C:\Windows\System\DgpoEhu.exe
  C:\Windows\System\DgpoEhu.exe
  2⤵
  PID:2156
- C:\Windows\System\autjtwd.exe
  C:\Windows\System\autjtwd.exe
  2⤵
  PID:3232
- C:\Windows\System\pPrsDYx.exe
  C:\Windows\System\pPrsDYx.exe
  2⤵
  PID:3300
- C:\Windows\System\VpTtLxU.exe
  C:\Windows\System\VpTtLxU.exe
  2⤵
  PID:3308
- C:\Windows\System\yhXoFVa.exe
  C:\Windows\System\yhXoFVa.exe
  2⤵
  PID:2800
- C:\Windows\System\qBFyDOY.exe
  C:\Windows\System\qBFyDOY.exe
  2⤵
  PID:2828
- C:\Windows\System\cOYHrId.exe
  C:\Windows\System\cOYHrId.exe
  2⤵
  PID:3132
- C:\Windows\System\SJEmUDc.exe
  C:\Windows\System\SJEmUDc.exe
  2⤵
  PID:3244
- C:\Windows\System\tSCpXnk.exe
  C:\Windows\System\tSCpXnk.exe
  2⤵
  PID:2508
- C:\Windows\System\iqdoCdN.exe
  C:\Windows\System\iqdoCdN.exe
  2⤵
  PID:3424
- C:\Windows\System\sjAglzY.exe
  C:\Windows\System\sjAglzY.exe
  2⤵
  PID:3488
- C:\Windows\System\DnKGREX.exe
  C:\Windows\System\DnKGREX.exe
  2⤵
  PID:3564
- C:\Windows\System\bdBqvHN.exe
  C:\Windows\System\bdBqvHN.exe
  2⤵
  PID:3580
- C:\Windows\System\ZUZeDeW.exe
  C:\Windows\System\ZUZeDeW.exe
  2⤵
  PID:3596
- C:\Windows\System\pcHyOsv.exe
  C:\Windows\System\pcHyOsv.exe
  2⤵
  PID:3172
- C:\Windows\System\afAmkJY.exe
  C:\Windows\System\afAmkJY.exe
  2⤵
  PID:3332
- C:\Windows\System\qqNoLrF.exe
  C:\Windows\System\qqNoLrF.exe
  2⤵
  PID:3380
- C:\Windows\System\tiiSUvh.exe
  C:\Windows\System\tiiSUvh.exe
  2⤵
  PID:3336
- C:\Windows\System\OneypHN.exe
  C:\Windows\System\OneypHN.exe
  2⤵
  PID:3476
- C:\Windows\System\ZBuaGuT.exe
  C:\Windows\System\ZBuaGuT.exe
  2⤵
  PID:3544
- C:\Windows\System\uwdoUnO.exe
  C:\Windows\System\uwdoUnO.exe
  2⤵
  PID:3624
- C:\Windows\System\MwBGXGX.exe
  C:\Windows\System\MwBGXGX.exe
  2⤵
  PID:3636
- C:\Windows\System\tfNxAli.exe
  C:\Windows\System\tfNxAli.exe
  2⤵
  PID:3656
- C:\Windows\System\UgAByaC.exe
  C:\Windows\System\UgAByaC.exe
  2⤵
  PID:3668
- C:\Windows\System\iiNzCXL.exe
  C:\Windows\System\iiNzCXL.exe
  2⤵
  PID:3720
- C:\Windows\System\CWBYJGE.exe
  C:\Windows\System\CWBYJGE.exe
  2⤵
  PID:3796
- C:\Windows\System\pUuOMyM.exe
  C:\Windows\System\pUuOMyM.exe
  2⤵
  PID:3676
- C:\Windows\System\BEqsvQl.exe
  C:\Windows\System\BEqsvQl.exe
  2⤵
  PID:3784
- C:\Windows\System\lTAKdkU.exe
  C:\Windows\System\lTAKdkU.exe
  2⤵
  PID:3848
- C:\Windows\System\BOItHNL.exe
  C:\Windows\System\BOItHNL.exe
  2⤵
  PID:3824
- C:\Windows\System\uYLQUlD.exe
  C:\Windows\System\uYLQUlD.exe
  2⤵
  PID:3952
- C:\Windows\System\eSHxpiU.exe
  C:\Windows\System\eSHxpiU.exe
  2⤵
  PID:3908
- C:\Windows\System\LuJnDMO.exe
  C:\Windows\System\LuJnDMO.exe
  2⤵
  PID:3972
- C:\Windows\System\ZghvatW.exe
  C:\Windows\System\ZghvatW.exe
  2⤵
  PID:4040
- C:\Windows\System\fgsBGtc.exe
  C:\Windows\System\fgsBGtc.exe
  2⤵
  PID:2524
- C:\Windows\System\CMEZeHC.exe
  C:\Windows\System\CMEZeHC.exe
  2⤵
  PID:1680
- C:\Windows\System\gDNkASA.exe
  C:\Windows\System\gDNkASA.exe
  2⤵
  PID:3920
- C:\Windows\System\LfThnyR.exe
  C:\Windows\System\LfThnyR.exe
  2⤵
  PID:1784
- C:\Windows\System\PYltBJY.exe
  C:\Windows\System\PYltBJY.exe
  2⤵
  PID:3984
- C:\Windows\System\ecVbtvy.exe
  C:\Windows\System\ecVbtvy.exe
  2⤵
  PID:4088
- C:\Windows\System\DsBfJDr.exe
  C:\Windows\System\DsBfJDr.exe
  2⤵
  PID:3204
- C:\Windows\System\vHTChgv.exe
  C:\Windows\System\vHTChgv.exe
  2⤵
  PID:3188
- C:\Windows\System\vWqefTX.exe
  C:\Windows\System\vWqefTX.exe
  2⤵
  PID:2956
- C:\Windows\System\fruhhSk.exe
  C:\Windows\System\fruhhSk.exe
  2⤵
  PID:3320
- C:\Windows\System\xGXUbvA.exe
  C:\Windows\System\xGXUbvA.exe
  2⤵
  PID:3456
- C:\Windows\System\zbeyWBE.exe
  C:\Windows\System\zbeyWBE.exe
  2⤵
  PID:3148
- C:\Windows\System\rRuEvpl.exe
  C:\Windows\System\rRuEvpl.exe
  2⤵
  PID:3576
- C:\Windows\System\cLQyDiK.exe
  C:\Windows\System\cLQyDiK.exe
  2⤵
  PID:2536
- C:\Windows\System\ksPKXKm.exe
  C:\Windows\System\ksPKXKm.exe
  2⤵
  PID:1920
- C:\Windows\System\iqkaAZN.exe
  C:\Windows\System\iqkaAZN.exe
  2⤵
  PID:3444
- C:\Windows\System\RtdZEbE.exe
  C:\Windows\System\RtdZEbE.exe
  2⤵
  PID:3616
- C:\Windows\System\dnwaIgA.exe
  C:\Windows\System\dnwaIgA.exe
  2⤵
  PID:3732
- C:\Windows\System\oYHnAVn.exe
  C:\Windows\System\oYHnAVn.exe
  2⤵
  PID:3816
- C:\Windows\System\mXWioHc.exe
  C:\Windows\System\mXWioHc.exe
  2⤵
  PID:3588
- C:\Windows\System\MejhzrL.exe
  C:\Windows\System\MejhzrL.exe
  2⤵
  PID:3540
- C:\Windows\System\hQKsgeL.exe
  C:\Windows\System\hQKsgeL.exe
  2⤵
  PID:3844
- C:\Windows\System\VCehxJm.exe
  C:\Windows\System\VCehxJm.exe
  2⤵
  PID:3100
- C:\Windows\System\kRihFfg.exe
  C:\Windows\System\kRihFfg.exe
  2⤵
  PID:972
- C:\Windows\System\HbFTRGZ.exe
  C:\Windows\System\HbFTRGZ.exe
  2⤵
  PID:3572
- C:\Windows\System\SXJZfAG.exe
  C:\Windows\System\SXJZfAG.exe
  2⤵
  PID:4116
- C:\Windows\System\SaLDsJj.exe
  C:\Windows\System\SaLDsJj.exe
  2⤵
  PID:4132
- C:\Windows\System\jqgoMTy.exe
  C:\Windows\System\jqgoMTy.exe
  2⤵
  PID:4148
- C:\Windows\System\xwYWqwY.exe
  C:\Windows\System\xwYWqwY.exe
  2⤵
  PID:4164
- C:\Windows\System\smbxoZg.exe
  C:\Windows\System\smbxoZg.exe
  2⤵
  PID:4180
- C:\Windows\System\JgJzIxo.exe
  C:\Windows\System\JgJzIxo.exe
  2⤵
  PID:4196
- C:\Windows\System\xPKWFFT.exe
  C:\Windows\System\xPKWFFT.exe
  2⤵
  PID:4212
- C:\Windows\System\PWJnDNA.exe
  C:\Windows\System\PWJnDNA.exe
  2⤵
  PID:4228
- C:\Windows\System\YxJaqfA.exe
  C:\Windows\System\YxJaqfA.exe
  2⤵
  PID:4244
- C:\Windows\System\SFGWsyD.exe
  C:\Windows\System\SFGWsyD.exe
  2⤵
  PID:4264
- C:\Windows\System\nNLTaxf.exe
  C:\Windows\System\nNLTaxf.exe
  2⤵
  PID:4280
- C:\Windows\System\kJVFlEx.exe
  C:\Windows\System\kJVFlEx.exe
  2⤵
  PID:4300
- C:\Windows\System\aQnHTmI.exe
  C:\Windows\System\aQnHTmI.exe
  2⤵
  PID:4316
- C:\Windows\System\xJvRQZC.exe
  C:\Windows\System\xJvRQZC.exe
  2⤵
  PID:4332
- C:\Windows\System\zStEvXD.exe
  C:\Windows\System\zStEvXD.exe
  2⤵
  PID:4348
- C:\Windows\System\BiOPUWY.exe
  C:\Windows\System\BiOPUWY.exe
  2⤵
  PID:4372
- C:\Windows\System\PhCrFnj.exe
  C:\Windows\System\PhCrFnj.exe
  2⤵
  PID:4388
- C:\Windows\System\OSqIPwC.exe
  C:\Windows\System\OSqIPwC.exe
  2⤵
  PID:4404
- C:\Windows\System\AAVVdkh.exe
  C:\Windows\System\AAVVdkh.exe
  2⤵
  PID:4420
- C:\Windows\System\MqZQbkW.exe
  C:\Windows\System\MqZQbkW.exe
  2⤵
  PID:4436
- C:\Windows\System\CEMhCGo.exe
  C:\Windows\System\CEMhCGo.exe
  2⤵
  PID:4452
- C:\Windows\System\ZUpMYwT.exe
  C:\Windows\System\ZUpMYwT.exe
  2⤵
  PID:4468
- C:\Windows\System\PKxnOhM.exe
  C:\Windows\System\PKxnOhM.exe
  2⤵
  PID:4488
- C:\Windows\System\rACxDjW.exe
  C:\Windows\System\rACxDjW.exe
  2⤵
  PID:4504
- C:\Windows\System\PfjAMhX.exe
  C:\Windows\System\PfjAMhX.exe
  2⤵
  PID:4520
- C:\Windows\System\wQenbJq.exe
  C:\Windows\System\wQenbJq.exe
  2⤵
  PID:4536
- C:\Windows\System\YmmbylF.exe
  C:\Windows\System\YmmbylF.exe
  2⤵
  PID:4552
- C:\Windows\System\VCOVvtd.exe
  C:\Windows\System\VCOVvtd.exe
  2⤵
  PID:4568
- C:\Windows\System\QHmcZor.exe
  C:\Windows\System\QHmcZor.exe
  2⤵
  PID:4584
- C:\Windows\System\anRjXOD.exe
  C:\Windows\System\anRjXOD.exe
  2⤵
  PID:4604
- C:\Windows\System\JQjKJbl.exe
  C:\Windows\System\JQjKJbl.exe
  2⤵
  PID:4620
- C:\Windows\System\OdiZmKf.exe
  C:\Windows\System\OdiZmKf.exe
  2⤵
  PID:4640
- C:\Windows\System\cnYYuiw.exe
  C:\Windows\System\cnYYuiw.exe
  2⤵
  PID:4672
- C:\Windows\System\jzqYrda.exe
  C:\Windows\System\jzqYrda.exe
  2⤵
  PID:4688
- C:\Windows\System\UGkFKkr.exe
  C:\Windows\System\UGkFKkr.exe
  2⤵
  PID:4704
- C:\Windows\System\aPRFesS.exe
  C:\Windows\System\aPRFesS.exe
  2⤵
  PID:4728
- C:\Windows\System\wTIFuwO.exe
  C:\Windows\System\wTIFuwO.exe
  2⤵
  PID:4744
- C:\Windows\System\lxeqfUi.exe
  C:\Windows\System\lxeqfUi.exe
  2⤵
  PID:4760
- C:\Windows\System\LQvddSt.exe
  C:\Windows\System\LQvddSt.exe
  2⤵
  PID:4776
- C:\Windows\System\NksMCrJ.exe
  C:\Windows\System\NksMCrJ.exe
  2⤵
  PID:4792
- C:\Windows\System\OxeUyMH.exe
  C:\Windows\System\OxeUyMH.exe
  2⤵
  PID:4808
- C:\Windows\System\Dkubtgd.exe
  C:\Windows\System\Dkubtgd.exe
  2⤵
  PID:4824
- C:\Windows\System\cUNAhrg.exe
  C:\Windows\System\cUNAhrg.exe
  2⤵
  PID:4840
- C:\Windows\System\tFDfCFF.exe
  C:\Windows\System\tFDfCFF.exe
  2⤵
  PID:4856
- C:\Windows\System\UJkvHBQ.exe
  C:\Windows\System\UJkvHBQ.exe
  2⤵
  PID:4872
- C:\Windows\System\ooJxIFh.exe
  C:\Windows\System\ooJxIFh.exe
  2⤵
  PID:4888
- C:\Windows\System\kPxkqEF.exe
  C:\Windows\System\kPxkqEF.exe
  2⤵
  PID:4904
- C:\Windows\System\JqfAwMX.exe
  C:\Windows\System\JqfAwMX.exe
  2⤵
  PID:4920
- C:\Windows\System\fhICxCO.exe
  C:\Windows\System\fhICxCO.exe
  2⤵
  PID:4936
- C:\Windows\System\GmPZOuy.exe
  C:\Windows\System\GmPZOuy.exe
  2⤵
  PID:4952
- C:\Windows\System\wLTtcYN.exe
  C:\Windows\System\wLTtcYN.exe
  2⤵
  PID:4968
- C:\Windows\System\ykvmBCr.exe
  C:\Windows\System\ykvmBCr.exe
  2⤵
  PID:4984
- C:\Windows\System\UROCKAJ.exe
  C:\Windows\System\UROCKAJ.exe
  2⤵
  PID:5000
- C:\Windows\System\CeszMnL.exe
  C:\Windows\System\CeszMnL.exe
  2⤵
  PID:5016
- C:\Windows\System\SVXdNrW.exe
  C:\Windows\System\SVXdNrW.exe
  2⤵
  PID:5032
- C:\Windows\System\lBacanL.exe
  C:\Windows\System\lBacanL.exe
  2⤵
  PID:5048
- C:\Windows\System\wrohbZU.exe
  C:\Windows\System\wrohbZU.exe
  2⤵
  PID:5064
- C:\Windows\System\fRagwlr.exe
  C:\Windows\System\fRagwlr.exe
  2⤵
  PID:5080
- C:\Windows\System\efSuZkD.exe
  C:\Windows\System\efSuZkD.exe
  2⤵
  PID:5096
- C:\Windows\System\CnkNoig.exe
  C:\Windows\System\CnkNoig.exe
  2⤵
  PID:1740
- C:\Windows\System\bmgjmjN.exe
  C:\Windows\System\bmgjmjN.exe
  2⤵
  PID:4052
- C:\Windows\System\RsCXoSv.exe
  C:\Windows\System\RsCXoSv.exe
  2⤵
  PID:3936
- C:\Windows\System\zEHtytd.exe
  C:\Windows\System\zEHtytd.exe
  2⤵
  PID:4024
- C:\Windows\System\VBYZJEw.exe
  C:\Windows\System\VBYZJEw.exe
  2⤵
  PID:4056
- C:\Windows\System\IiMtnPD.exe
  C:\Windows\System\IiMtnPD.exe
  2⤵
  PID:1168
- C:\Windows\System\NFpNZxy.exe
  C:\Windows\System\NFpNZxy.exe
  2⤵
  PID:3032
- C:\Windows\System\VptceYc.exe
  C:\Windows\System\VptceYc.exe
  2⤵
  PID:3804
- C:\Windows\System\dpEcJVy.exe
  C:\Windows\System\dpEcJVy.exe
  2⤵
  PID:3592
- C:\Windows\System\CmTSHFG.exe
  C:\Windows\System\CmTSHFG.exe
  2⤵
  PID:1580
- C:\Windows\System\KCYiIiK.exe
  C:\Windows\System\KCYiIiK.exe
  2⤵
  PID:3280
- C:\Windows\System\BetgyWM.exe
  C:\Windows\System\BetgyWM.exe
  2⤵
  PID:1568
- C:\Windows\System\HVvrqXb.exe
  C:\Windows\System\HVvrqXb.exe
  2⤵
  PID:4100
- C:\Windows\System\YcmkfeV.exe
  C:\Windows\System\YcmkfeV.exe
  2⤵
  PID:4172
- C:\Windows\System\pvGaadn.exe
  C:\Windows\System\pvGaadn.exe
  2⤵
  PID:4124
- C:\Windows\System\QgwElJr.exe
  C:\Windows\System\QgwElJr.exe
  2⤵
  PID:4192
- C:\Windows\System\AAsmpoU.exe
  C:\Windows\System\AAsmpoU.exe
  2⤵
  PID:4272
- C:\Windows\System\boqScoQ.exe
  C:\Windows\System\boqScoQ.exe
  2⤵
  PID:4344
- C:\Windows\System\rLbuBdQ.exe
  C:\Windows\System\rLbuBdQ.exe
  2⤵
  PID:4368
- C:\Windows\System\riuzZFB.exe
  C:\Windows\System\riuzZFB.exe
  2⤵
  PID:4412
- C:\Windows\System\gsyHiic.exe
  C:\Windows\System\gsyHiic.exe
  2⤵
  PID:4512
- C:\Windows\System\WyYoVkQ.exe
  C:\Windows\System\WyYoVkQ.exe
  2⤵
  PID:4464
- C:\Windows\System\ptTQEHx.exe
  C:\Windows\System\ptTQEHx.exe
  2⤵
  PID:4396
- C:\Windows\System\AgUIvcx.exe
  C:\Windows\System\AgUIvcx.exe
  2⤵
  PID:4576
- C:\Windows\System\fSEfSTz.exe
  C:\Windows\System\fSEfSTz.exe
  2⤵
  PID:4616
- C:\Windows\System\miTKbKW.exe
  C:\Windows\System\miTKbKW.exe
  2⤵
  PID:4628
- C:\Windows\System\exfhwPG.exe
  C:\Windows\System\exfhwPG.exe
  2⤵
  PID:4660
- C:\Windows\System\QzgReea.exe
  C:\Windows\System\QzgReea.exe
  2⤵
  PID:4736
- C:\Windows\System\CzhzlYL.exe
  C:\Windows\System\CzhzlYL.exe
  2⤵
  PID:4768
- C:\Windows\System\fYbBqwb.exe
  C:\Windows\System\fYbBqwb.exe
  2⤵
  PID:4804
- C:\Windows\System\rRAVIOx.exe
  C:\Windows\System\rRAVIOx.exe
  2⤵
  PID:4868
- C:\Windows\System\JuSlNZQ.exe
  C:\Windows\System\JuSlNZQ.exe
  2⤵
  PID:4928
- C:\Windows\System\xGnorvz.exe
  C:\Windows\System\xGnorvz.exe
  2⤵
  PID:4788
- C:\Windows\System\InMWuNa.exe
  C:\Windows\System\InMWuNa.exe
  2⤵
  PID:4932
- C:\Windows\System\zSUzQKI.exe
  C:\Windows\System\zSUzQKI.exe
  2⤵
  PID:4912
- C:\Windows\System\MMKObuJ.exe
  C:\Windows\System\MMKObuJ.exe
  2⤵
  PID:4948
- C:\Windows\System\sRxxhLm.exe
  C:\Windows\System\sRxxhLm.exe
  2⤵
  PID:5028
- C:\Windows\System\dhMQlaz.exe
  C:\Windows\System\dhMQlaz.exe
  2⤵
  PID:5092
- C:\Windows\System\HIghnpb.exe
  C:\Windows\System\HIghnpb.exe
  2⤵
  PID:4980
- C:\Windows\System\QwzBFtT.exe
  C:\Windows\System\QwzBFtT.exe
  2⤵
  PID:3988
- C:\Windows\System\ukAIjnw.exe
  C:\Windows\System\ukAIjnw.exe
  2⤵
  PID:5116
- C:\Windows\System\vwSQmaU.exe
  C:\Windows\System\vwSQmaU.exe
  2⤵
  PID:2340
- C:\Windows\System\UvylKGn.exe
  C:\Windows\System\UvylKGn.exe
  2⤵
  PID:3968
- C:\Windows\System\cGeOhef.exe
  C:\Windows\System\cGeOhef.exe
  2⤵
  PID:3752
- C:\Windows\System\sqqTRNr.exe
  C:\Windows\System\sqqTRNr.exe
  2⤵
  PID:3764
- C:\Windows\System\viqMiJw.exe
  C:\Windows\System\viqMiJw.exe
  2⤵
  PID:3472
- C:\Windows\System\izAYDto.exe
  C:\Windows\System\izAYDto.exe
  2⤵
  PID:4220
- C:\Windows\System\zZKXdRM.exe
  C:\Windows\System\zZKXdRM.exe
  2⤵
  PID:4308
- C:\Windows\System\SjimRot.exe
  C:\Windows\System\SjimRot.exe
  2⤵
  PID:4260
- C:\Windows\System\msUtbbE.exe
  C:\Windows\System\msUtbbE.exe
  2⤵
  PID:3168
- C:\Windows\System\TINPLHL.exe
  C:\Windows\System\TINPLHL.exe
  2⤵
  PID:4160
- C:\Windows\System\nIcnyrC.exe
  C:\Windows\System\nIcnyrC.exe
  2⤵
  PID:3376
- C:\Windows\System\yamtsvf.exe
  C:\Windows\System\yamtsvf.exe
  2⤵
  PID:4256
- C:\Windows\System\siIqVbu.exe
  C:\Windows\System\siIqVbu.exe
  2⤵
  PID:4496
- C:\Windows\System\fjBweVH.exe
  C:\Windows\System\fjBweVH.exe
  2⤵
  PID:3304
- C:\Windows\System\DLcIKgc.exe
  C:\Windows\System\DLcIKgc.exe
  2⤵
  PID:4112
- C:\Windows\System\kIcroyP.exe
  C:\Windows\System\kIcroyP.exe
  2⤵
  PID:4740
- C:\Windows\System\vUEEfqb.exe
  C:\Windows\System\vUEEfqb.exe
  2⤵
  PID:4864
- C:\Windows\System\WWIncuU.exe
  C:\Windows\System\WWIncuU.exe
  2⤵
  PID:4612
- C:\Windows\System\BALmjIK.exe
  C:\Windows\System\BALmjIK.exe
  2⤵
  PID:4652
- C:\Windows\System\iojaAZn.exe
  C:\Windows\System\iojaAZn.exe
  2⤵
  PID:4296
- C:\Windows\System\AlHdHjE.exe
  C:\Windows\System\AlHdHjE.exe
  2⤵
  PID:4648
- C:\Windows\System\cXzembU.exe
  C:\Windows\System\cXzembU.exe
  2⤵
  PID:4976
- C:\Windows\System\UtZNmLK.exe
  C:\Windows\System\UtZNmLK.exe
  2⤵
  PID:588
- C:\Windows\System\UuiDwcD.exe
  C:\Windows\System\UuiDwcD.exe
  2⤵
  PID:4756
- C:\Windows\System\xwiHCsF.exe
  C:\Windows\System\xwiHCsF.exe
  2⤵
  PID:4848
- C:\Windows\System\nRviXtc.exe
  C:\Windows\System\nRviXtc.exe
  2⤵
  PID:4800
- C:\Windows\System\RFYCZOY.exe
  C:\Windows\System\RFYCZOY.exe
  2⤵
  PID:4680
- C:\Windows\System\wCeWhLo.exe
  C:\Windows\System\wCeWhLo.exe
  2⤵
  PID:3940
- C:\Windows\System\HftdlDU.exe
  C:\Windows\System\HftdlDU.exe
  2⤵
  PID:4564
- C:\Windows\System\vMQAHlp.exe
  C:\Windows\System\vMQAHlp.exe
  2⤵
  PID:5044
- C:\Windows\System\dXlchVy.exe
  C:\Windows\System\dXlchVy.exe
  2⤵
  PID:4416
- C:\Windows\System\VmZQCNT.exe
  C:\Windows\System\VmZQCNT.exe
  2⤵
  PID:5136
- C:\Windows\System\BEbOfEr.exe
  C:\Windows\System\BEbOfEr.exe
  2⤵
  PID:5152
- C:\Windows\System\QLZqHQN.exe
  C:\Windows\System\QLZqHQN.exe
  2⤵
  PID:5168
- C:\Windows\System\HaDQVqb.exe
  C:\Windows\System\HaDQVqb.exe
  2⤵
  PID:5184
- C:\Windows\System\FbfuZOj.exe
  C:\Windows\System\FbfuZOj.exe
  2⤵
  PID:5200
- C:\Windows\System\WvyBVOP.exe
  C:\Windows\System\WvyBVOP.exe
  2⤵
  PID:5216
- C:\Windows\System\cGGUlbR.exe
  C:\Windows\System\cGGUlbR.exe
  2⤵
  PID:5236
- C:\Windows\System\obsWYlL.exe
  C:\Windows\System\obsWYlL.exe
  2⤵
  PID:5252
- C:\Windows\System\AtqEfTF.exe
  C:\Windows\System\AtqEfTF.exe
  2⤵
  PID:5280
- C:\Windows\System\iRmcCeq.exe
  C:\Windows\System\iRmcCeq.exe
  2⤵
  PID:5296
- C:\Windows\System\DMqGimK.exe
  C:\Windows\System\DMqGimK.exe
  2⤵
  PID:5316
- C:\Windows\System\eYHUpqw.exe
  C:\Windows\System\eYHUpqw.exe
  2⤵
  PID:5344
- C:\Windows\System\xlgroEF.exe
  C:\Windows\System\xlgroEF.exe
  2⤵
  PID:5360
- C:\Windows\System\avxpRqG.exe
  C:\Windows\System\avxpRqG.exe
  2⤵
  PID:5376
- C:\Windows\System\klRWTOr.exe
  C:\Windows\System\klRWTOr.exe
  2⤵
  PID:5400
- C:\Windows\System\WPaDIwJ.exe
  C:\Windows\System\WPaDIwJ.exe
  2⤵
  PID:5416
- C:\Windows\System\dDrNnBn.exe
  C:\Windows\System\dDrNnBn.exe
  2⤵
  PID:5432
- C:\Windows\System\xeYBEpz.exe
  C:\Windows\System\xeYBEpz.exe
  2⤵
  PID:5448
- C:\Windows\System\kNUNQyZ.exe
  C:\Windows\System\kNUNQyZ.exe
  2⤵
  PID:5464
- C:\Windows\System\VxctLnP.exe
  C:\Windows\System\VxctLnP.exe
  2⤵
  PID:5488
- C:\Windows\System\SKzuPOt.exe
  C:\Windows\System\SKzuPOt.exe
  2⤵
  PID:5508
- C:\Windows\System\kARHXtg.exe
  C:\Windows\System\kARHXtg.exe
  2⤵
  PID:5524
- C:\Windows\System\IfzILyO.exe
  C:\Windows\System\IfzILyO.exe
  2⤵
  PID:5544
- C:\Windows\System\szoGnan.exe
  C:\Windows\System\szoGnan.exe
  2⤵
  PID:5560
- C:\Windows\System\IXpOlFA.exe
  C:\Windows\System\IXpOlFA.exe
  2⤵
  PID:5576
- C:\Windows\System\kEPyBxP.exe
  C:\Windows\System\kEPyBxP.exe
  2⤵
  PID:5596
- C:\Windows\System\ytxDxrC.exe
  C:\Windows\System\ytxDxrC.exe
  2⤵
  PID:5612
- C:\Windows\System\WpdsWBX.exe
  C:\Windows\System\WpdsWBX.exe
  2⤵
  PID:5628
- C:\Windows\System\pvGtqNC.exe
  C:\Windows\System\pvGtqNC.exe
  2⤵
  PID:5644
- C:\Windows\System\zSPAzfn.exe
  C:\Windows\System\zSPAzfn.exe
  2⤵
  PID:5664
- C:\Windows\System\ECjLNhP.exe
  C:\Windows\System\ECjLNhP.exe
  2⤵
  PID:5680
- C:\Windows\System\WiNVbzn.exe
  C:\Windows\System\WiNVbzn.exe
  2⤵
  PID:5708
- C:\Windows\System\JenZYgo.exe
  C:\Windows\System\JenZYgo.exe
  2⤵
  PID:5732
- C:\Windows\System\tDxkjTX.exe
  C:\Windows\System\tDxkjTX.exe
  2⤵
  PID:5748
- C:\Windows\System\tYVNlMR.exe
  C:\Windows\System\tYVNlMR.exe
  2⤵
  PID:5768
- C:\Windows\System\scBpHlr.exe
  C:\Windows\System\scBpHlr.exe
  2⤵
  PID:5784
- C:\Windows\System\orAvHlR.exe
  C:\Windows\System\orAvHlR.exe
  2⤵
  PID:5804
- C:\Windows\System\iGpIRYW.exe
  C:\Windows\System\iGpIRYW.exe
  2⤵
  PID:5828
- C:\Windows\System\ZqbbjBS.exe
  C:\Windows\System\ZqbbjBS.exe
  2⤵
  PID:5848
- C:\Windows\System\LFNriRp.exe
  C:\Windows\System\LFNriRp.exe
  2⤵
  PID:5868
- C:\Windows\System\IzZQlzI.exe
  C:\Windows\System\IzZQlzI.exe
  2⤵
  PID:5884
- C:\Windows\System\gzAaoUA.exe
  C:\Windows\System\gzAaoUA.exe
  2⤵
  PID:5900
- C:\Windows\System\PSetqvR.exe
  C:\Windows\System\PSetqvR.exe
  2⤵
  PID:5920
- C:\Windows\System\jjbNGKJ.exe
  C:\Windows\System\jjbNGKJ.exe
  2⤵
  PID:5936
- C:\Windows\System\bkIDEsE.exe
  C:\Windows\System\bkIDEsE.exe
  2⤵
  PID:5956
- C:\Windows\System\LWyPpBh.exe
  C:\Windows\System\LWyPpBh.exe
  2⤵
  PID:5972
- C:\Windows\System\vCrukjm.exe
  C:\Windows\System\vCrukjm.exe
  2⤵
  PID:5988
- C:\Windows\System\sRLbTlW.exe
  C:\Windows\System\sRLbTlW.exe
  2⤵
  PID:6004
- C:\Windows\System\KeBCmyC.exe
  C:\Windows\System\KeBCmyC.exe
  2⤵
  PID:6024
- C:\Windows\System\GcfsyXz.exe
  C:\Windows\System\GcfsyXz.exe
  2⤵
  PID:6040
- C:\Windows\System\jyWIcGd.exe
  C:\Windows\System\jyWIcGd.exe
  2⤵
  PID:6060
- C:\Windows\System\TtfKLkE.exe
  C:\Windows\System\TtfKLkE.exe
  2⤵
  PID:6076
- C:\Windows\System\lqGhOwX.exe
  C:\Windows\System\lqGhOwX.exe
  2⤵
  PID:6092
- C:\Windows\System\rrZxSqO.exe
  C:\Windows\System\rrZxSqO.exe
  2⤵
  PID:6112
- C:\Windows\System\OiEvtVR.exe
  C:\Windows\System\OiEvtVR.exe
  2⤵
  PID:6128
- C:\Windows\System\szboiil.exe
  C:\Windows\System\szboiil.exe
  2⤵
  PID:4916
- C:\Windows\System\hxVMotS.exe
  C:\Windows\System\hxVMotS.exe
  2⤵
  PID:5040
- C:\Windows\System\mMlaAsQ.exe
  C:\Windows\System\mMlaAsQ.exe
  2⤵
  PID:4700
- C:\Windows\System\bCQQqNm.exe
  C:\Windows\System\bCQQqNm.exe
  2⤵
  PID:5108
- C:\Windows\System\ACStxLq.exe
  C:\Windows\System\ACStxLq.exe
  2⤵
  PID:4144
- C:\Windows\System\ZXiANHs.exe
  C:\Windows\System\ZXiANHs.exe
  2⤵
  PID:3748
- C:\Windows\System\ZACxkxi.exe
  C:\Windows\System\ZACxkxi.exe
  2⤵
  PID:5160
- C:\Windows\System\BlDCvUh.exe
  C:\Windows\System\BlDCvUh.exe
  2⤵
  PID:5228
- C:\Windows\System\OhYQbzZ.exe
  C:\Windows\System\OhYQbzZ.exe
  2⤵
  PID:5268
- C:\Windows\System\MBLDFdf.exe
  C:\Windows\System\MBLDFdf.exe
  2⤵
  PID:5312
- C:\Windows\System\OkMzFre.exe
  C:\Windows\System\OkMzFre.exe
  2⤵
  PID:5180
- C:\Windows\System\AEdGyfB.exe
  C:\Windows\System\AEdGyfB.exe
  2⤵
  PID:5144
- C:\Windows\System\yLzGGxB.exe
  C:\Windows\System\yLzGGxB.exe
  2⤵
  PID:5212
- C:\Windows\System\RkxKLOU.exe
  C:\Windows\System\RkxKLOU.exe
  2⤵
  PID:5292
- C:\Windows\System\uwoDybd.exe
  C:\Windows\System\uwoDybd.exe
  2⤵
  PID:5424
- C:\Windows\System\abLRxFq.exe
  C:\Windows\System\abLRxFq.exe
  2⤵
  PID:5372
- C:\Windows\System\VsffSTo.exe
  C:\Windows\System\VsffSTo.exe
  2⤵
  PID:5340
- C:\Windows\System\PvGNyUZ.exe
  C:\Windows\System\PvGNyUZ.exe
  2⤵
  PID:5496
- C:\Windows\System\CnOjOna.exe
  C:\Windows\System\CnOjOna.exe
  2⤵
  PID:5532
- C:\Windows\System\kQjibhN.exe
  C:\Windows\System\kQjibhN.exe
  2⤵
  PID:5572
- C:\Windows\System\VDdryCn.exe
  C:\Windows\System\VDdryCn.exe
  2⤵
  PID:5636
- C:\Windows\System\IhVnKiu.exe
  C:\Windows\System\IhVnKiu.exe
  2⤵
  PID:5676
- C:\Windows\System\fKRiooo.exe
  C:\Windows\System\fKRiooo.exe
  2⤵
  PID:5552
- C:\Windows\System\uGjbALg.exe
  C:\Windows\System\uGjbALg.exe
  2⤵
  PID:5592
- C:\Windows\System\uhHGhyL.exe
  C:\Windows\System\uhHGhyL.exe
  2⤵
  PID:5688
- C:\Windows\System\fVjpZud.exe
  C:\Windows\System\fVjpZud.exe
  2⤵
  PID:5692
- C:\Windows\System\zmJKAzH.exe
  C:\Windows\System\zmJKAzH.exe
  2⤵
  PID:5756
- C:\Windows\System\lgoCcLd.exe
  C:\Windows\System\lgoCcLd.exe
  2⤵
  PID:5740
- C:\Windows\System\RYhUqCr.exe
  C:\Windows\System\RYhUqCr.exe
  2⤵
  PID:5780
- C:\Windows\System\MczgYSs.exe
  C:\Windows\System\MczgYSs.exe
  2⤵
  PID:5088
- C:\Windows\System\oXiVwet.exe
  C:\Windows\System\oXiVwet.exe
  2⤵
  PID:5856
- C:\Windows\System\mqmSvVx.exe
  C:\Windows\System\mqmSvVx.exe
  2⤵
  PID:5932
- C:\Windows\System\witHBUP.exe
  C:\Windows\System\witHBUP.exe
  2⤵
  PID:5896
- C:\Windows\System\PdQxdlw.exe
  C:\Windows\System\PdQxdlw.exe
  2⤵
  PID:5980
- C:\Windows\System\QjSYhkY.exe
  C:\Windows\System\QjSYhkY.exe
  2⤵
  PID:6056
- C:\Windows\System\vrcMKGc.exe
  C:\Windows\System\vrcMKGc.exe
  2⤵
  PID:6012
- C:\Windows\System\JrBNXfI.exe
  C:\Windows\System\JrBNXfI.exe
  2⤵
  PID:6088
- C:\Windows\System\SRqVofj.exe
  C:\Windows\System\SRqVofj.exe
  2⤵
  PID:4188
- C:\Windows\System\niJUCBX.exe
  C:\Windows\System\niJUCBX.exe
  2⤵
  PID:6104
- C:\Windows\System\MCDwUTJ.exe
  C:\Windows\System\MCDwUTJ.exe
  2⤵
  PID:6136
- C:\Windows\System\ODlpdid.exe
  C:\Windows\System\ODlpdid.exe
  2⤵
  PID:4380
- C:\Windows\System\gOrVUVf.exe
  C:\Windows\System\gOrVUVf.exe
  2⤵
  PID:5192
- C:\Windows\System\qfInSXy.exe
  C:\Windows\System\qfInSXy.exe
  2⤵
  PID:4684
- C:\Windows\System\PAeUgQv.exe
  C:\Windows\System\PAeUgQv.exe
  2⤵
  PID:5276
- C:\Windows\System\JohCmQD.exe
  C:\Windows\System\JohCmQD.exe
  2⤵
  PID:5356
- C:\Windows\System\fgUrZmI.exe
  C:\Windows\System\fgUrZmI.exe
  2⤵
  PID:5248
- C:\Windows\System\bVWcAsB.exe
  C:\Windows\System\bVWcAsB.exe
  2⤵
  PID:5460
- C:\Windows\System\nvTBMoC.exe
  C:\Windows\System\nvTBMoC.exe
  2⤵
  PID:5516
- C:\Windows\System\RISmeZC.exe
  C:\Windows\System\RISmeZC.exe
  2⤵
  PID:5480
- C:\Windows\System\NHNojsB.exe
  C:\Windows\System\NHNojsB.exe
  2⤵
  PID:6000
- C:\Windows\System\ZoEQeRu.exe
  C:\Windows\System\ZoEQeRu.exe
  2⤵
  PID:5608
- C:\Windows\System\FAHcMvN.exe
  C:\Windows\System\FAHcMvN.exe
  2⤵
  PID:5660
- C:\Windows\System\eqTZtra.exe
  C:\Windows\System\eqTZtra.exe
  2⤵
  PID:5892
- C:\Windows\System\KicBHNq.exe
  C:\Windows\System\KicBHNq.exe
  2⤵
  PID:5952
- C:\Windows\System\zpnZAEi.exe
  C:\Windows\System\zpnZAEi.exe
  2⤵
  PID:4288
- C:\Windows\System\TZiRfRU.exe
  C:\Windows\System\TZiRfRU.exe
  2⤵
  PID:5264
- C:\Windows\System\eftGkQW.exe
  C:\Windows\System\eftGkQW.exe
  2⤵
  PID:5568
- C:\Windows\System\UkjDtEA.exe
  C:\Windows\System\UkjDtEA.exe
  2⤵
  PID:5208
- C:\Windows\System\oRaemCu.exe
  C:\Windows\System\oRaemCu.exe
  2⤵
  PID:3780
- C:\Windows\System\SlLcoTA.exe
  C:\Windows\System\SlLcoTA.exe
  2⤵
  PID:5792
- C:\Windows\System\VzYbFvB.exe
  C:\Windows\System\VzYbFvB.exe
  2⤵
  PID:5796
- C:\Windows\System\GPLkzQI.exe
  C:\Windows\System\GPLkzQI.exe
  2⤵
  PID:5332
- C:\Windows\System\rsdMBqb.exe
  C:\Windows\System\rsdMBqb.exe
  2⤵
  PID:5392
- C:\Windows\System\jSlGqqv.exe
  C:\Windows\System\jSlGqqv.exe
  2⤵
  PID:5912
- C:\Windows\System\lHzUaXe.exe
  C:\Windows\System\lHzUaXe.exe
  2⤵
  PID:5700
- C:\Windows\System\GSgSzBC.exe
  C:\Windows\System\GSgSzBC.exe
  2⤵
  PID:5440
- C:\Windows\System\kJJgjHy.exe
  C:\Windows\System\kJJgjHy.exe
  2⤵
  PID:5304
- C:\Windows\System\gRTuUSM.exe
  C:\Windows\System\gRTuUSM.exe
  2⤵
  PID:5584
- C:\Windows\System\ZRkHyqW.exe
  C:\Windows\System\ZRkHyqW.exe
  2⤵
  PID:4428
- C:\Windows\System\kKdSsFp.exe
  C:\Windows\System\kKdSsFp.exe
  2⤵
  PID:5260
- C:\Windows\System\zkcRGPR.exe
  C:\Windows\System\zkcRGPR.exe
  2⤵
  PID:5132
- C:\Windows\System\nnPuJiZ.exe
  C:\Windows\System\nnPuJiZ.exe
  2⤵
  PID:6168
- C:\Windows\System\oRetEPx.exe
  C:\Windows\System\oRetEPx.exe
  2⤵
  PID:6188
- C:\Windows\System\mlJDhvd.exe
  C:\Windows\System\mlJDhvd.exe
  2⤵
  PID:6204
- C:\Windows\System\YAWXRMn.exe
  C:\Windows\System\YAWXRMn.exe
  2⤵
  PID:6220
- C:\Windows\System\xvQVQvt.exe
  C:\Windows\System\xvQVQvt.exe
  2⤵
  PID:6268
- C:\Windows\System\UJXGgXJ.exe
  C:\Windows\System\UJXGgXJ.exe
  2⤵
  PID:6292
- C:\Windows\System\GAXSBop.exe
  C:\Windows\System\GAXSBop.exe
  2⤵
  PID:6308
- C:\Windows\System\bBxBnSg.exe
  C:\Windows\System\bBxBnSg.exe
  2⤵
  PID:6328
- C:\Windows\System\UIVjkVC.exe
  C:\Windows\System\UIVjkVC.exe
  2⤵
  PID:6344
- C:\Windows\System\wdkpEeh.exe
  C:\Windows\System\wdkpEeh.exe
  2⤵
  PID:6360
- C:\Windows\System\WGiEHxX.exe
  C:\Windows\System\WGiEHxX.exe
  2⤵
  PID:6380
- C:\Windows\System\xmftwmi.exe
  C:\Windows\System\xmftwmi.exe
  2⤵
  PID:6396
- C:\Windows\System\LTivfIx.exe
  C:\Windows\System\LTivfIx.exe
  2⤵
  PID:6412
- C:\Windows\System\QjfEFFE.exe
  C:\Windows\System\QjfEFFE.exe
  2⤵
  PID:6428
- C:\Windows\System\UQlDjOQ.exe
  C:\Windows\System\UQlDjOQ.exe
  2⤵
  PID:6464
- C:\Windows\System\rFMzLIv.exe
  C:\Windows\System\rFMzLIv.exe
  2⤵
  PID:6480
- C:\Windows\System\Ycilykf.exe
  C:\Windows\System\Ycilykf.exe
  2⤵
  PID:6496
- C:\Windows\System\DmyGeBQ.exe
  C:\Windows\System\DmyGeBQ.exe
  2⤵
  PID:6516
- C:\Windows\System\NUDLNuG.exe
  C:\Windows\System\NUDLNuG.exe
  2⤵
  PID:6532
- C:\Windows\System\OAvFNpN.exe
  C:\Windows\System\OAvFNpN.exe
  2⤵
  PID:6552
- C:\Windows\System\irSrvwF.exe
  C:\Windows\System\irSrvwF.exe
  2⤵
  PID:6568
- C:\Windows\System\RBqIDRd.exe
  C:\Windows\System\RBqIDRd.exe
  2⤵
  PID:6588
- C:\Windows\System\rEGvhTE.exe
  C:\Windows\System\rEGvhTE.exe
  2⤵
  PID:6604
- C:\Windows\System\whxXBNc.exe
  C:\Windows\System\whxXBNc.exe
  2⤵
  PID:6620
- C:\Windows\System\fXmqEUT.exe
  C:\Windows\System\fXmqEUT.exe
  2⤵
  PID:6640
- C:\Windows\System\yAZVfvE.exe
  C:\Windows\System\yAZVfvE.exe
  2⤵
  PID:6656
- C:\Windows\System\eUDqypi.exe
  C:\Windows\System\eUDqypi.exe
  2⤵
  PID:6672
- C:\Windows\System\zuusfPv.exe
  C:\Windows\System\zuusfPv.exe
  2⤵
  PID:6688
- C:\Windows\System\NYbgFZr.exe
  C:\Windows\System\NYbgFZr.exe
  2⤵
  PID:6708
- C:\Windows\System\ObCYGEE.exe
  C:\Windows\System\ObCYGEE.exe
  2⤵
  PID:6728
- C:\Windows\System\auUdFQs.exe
  C:\Windows\System\auUdFQs.exe
  2⤵
  PID:6744
- C:\Windows\System\FqJkHAY.exe
  C:\Windows\System\FqJkHAY.exe
  2⤵
  PID:6760
- C:\Windows\System\IinzAxy.exe
  C:\Windows\System\IinzAxy.exe
  2⤵
  PID:6776
- C:\Windows\System\EDTqiqv.exe
  C:\Windows\System\EDTqiqv.exe
  2⤵
  PID:6792
- C:\Windows\System\aOQaVxF.exe
  C:\Windows\System\aOQaVxF.exe
  2⤵
  PID:6812
- C:\Windows\System\rXwbjaT.exe
  C:\Windows\System\rXwbjaT.exe
  2⤵
  PID:6828
- C:\Windows\System\UvuYSdB.exe
  C:\Windows\System\UvuYSdB.exe
  2⤵
  PID:6844
- C:\Windows\System\hQdhHBM.exe
  C:\Windows\System\hQdhHBM.exe
  2⤵
  PID:6864
- C:\Windows\System\TnubToc.exe
  C:\Windows\System\TnubToc.exe
  2⤵
  PID:6880
- C:\Windows\System\dnXACBU.exe
  C:\Windows\System\dnXACBU.exe
  2⤵
  PID:6896
- C:\Windows\System\ZtLwfeJ.exe
  C:\Windows\System\ZtLwfeJ.exe
  2⤵
  PID:6912
- C:\Windows\System\hWDeBLj.exe
  C:\Windows\System\hWDeBLj.exe
  2⤵
  PID:6928
- C:\Windows\System\FNyKfVk.exe
  C:\Windows\System\FNyKfVk.exe
  2⤵
  PID:6944
- C:\Windows\System\uBKJzwG.exe
  C:\Windows\System\uBKJzwG.exe
  2⤵
  PID:6968
- C:\Windows\System\ttuCuBB.exe
  C:\Windows\System\ttuCuBB.exe
  2⤵
  PID:6992
- C:\Windows\System\wLEYIgH.exe
  C:\Windows\System\wLEYIgH.exe
  2⤵
  PID:7012
- C:\Windows\System\rDcDuLh.exe
  C:\Windows\System\rDcDuLh.exe
  2⤵
  PID:7028
- C:\Windows\System\CTfGilv.exe
  C:\Windows\System\CTfGilv.exe
  2⤵
  PID:7044
- C:\Windows\System\HiZWYdN.exe
  C:\Windows\System\HiZWYdN.exe
  2⤵
  PID:7060
- C:\Windows\System\ablZYPq.exe
  C:\Windows\System\ablZYPq.exe
  2⤵
  PID:7080
- C:\Windows\System\NQOalGo.exe
  C:\Windows\System\NQOalGo.exe
  2⤵
  PID:7096
- C:\Windows\System\fbLiQhs.exe
  C:\Windows\System\fbLiQhs.exe
  2⤵
  PID:7112
- C:\Windows\System\SDbNXee.exe
  C:\Windows\System\SDbNXee.exe
  2⤵
  PID:7132
- C:\Windows\System\fOKnsJQ.exe
  C:\Windows\System\fOKnsJQ.exe
  2⤵
  PID:7148
- C:\Windows\System\MswzUhS.exe
  C:\Windows\System\MswzUhS.exe
  2⤵
  PID:7164
- C:\Windows\System\sgkpjTu.exe
  C:\Windows\System\sgkpjTu.exe
  2⤵
  PID:5836
- C:\Windows\System\IDLrZGZ.exe
  C:\Windows\System\IDLrZGZ.exe
  2⤵
  PID:6184
- C:\Windows\System\IvufZVG.exe
  C:\Windows\System\IvufZVG.exe
  2⤵
  PID:6148
- C:\Windows\System\nIHKPZi.exe
  C:\Windows\System\nIHKPZi.exe
  2⤵
  PID:6228
- C:\Windows\System\gbmHMVy.exe
  C:\Windows\System\gbmHMVy.exe
  2⤵
  PID:5024
- C:\Windows\System\bYcJGUo.exe
  C:\Windows\System\bYcJGUo.exe
  2⤵
  PID:5812
- C:\Windows\System\zhrvisF.exe
  C:\Windows\System\zhrvisF.exe
  2⤵
  PID:5800
- C:\Windows\System\ApLlzXz.exe
  C:\Windows\System\ApLlzXz.exe
  2⤵
  PID:6164
- C:\Windows\System\cXCBzjQ.exe
  C:\Windows\System\cXCBzjQ.exe
  2⤵
  PID:6252
- C:\Windows\System\tyDEprv.exe
  C:\Windows\System\tyDEprv.exe
  2⤵
  PID:6288
- C:\Windows\System\BEGxWoR.exe
  C:\Windows\System\BEGxWoR.exe
  2⤵
  PID:6300
- C:\Windows\System\cFgWTAm.exe
  C:\Windows\System\cFgWTAm.exe
  2⤵
  PID:6404
- C:\Windows\System\FlIcuZo.exe
  C:\Windows\System\FlIcuZo.exe
  2⤵
  PID:6448
- C:\Windows\System\cChpypy.exe
  C:\Windows\System\cChpypy.exe
  2⤵
  PID:6356
- C:\Windows\System\OUcgMsc.exe
  C:\Windows\System\OUcgMsc.exe
  2⤵
  PID:6388
- C:\Windows\System\pHGinuT.exe
  C:\Windows\System\pHGinuT.exe
  2⤵
  PID:6564
- C:\Windows\System\mcMbbSw.exe
  C:\Windows\System\mcMbbSw.exe
  2⤵
  PID:6420
- C:\Windows\System\KKjEAVo.exe
  C:\Windows\System\KKjEAVo.exe
  2⤵
  PID:6664
- C:\Windows\System\MUjmuyI.exe
  C:\Windows\System\MUjmuyI.exe
  2⤵
  PID:6696
- C:\Windows\System\cPLdpSM.exe
  C:\Windows\System\cPLdpSM.exe
  2⤵
  PID:6648
- C:\Windows\System\IiQtnxD.exe
  C:\Windows\System\IiQtnxD.exe
  2⤵
  PID:6800
- C:\Windows\System\HBxzyYd.exe
  C:\Windows\System\HBxzyYd.exe
  2⤵
  PID:6720
- C:\Windows\System\DYiUqYo.exe
  C:\Windows\System\DYiUqYo.exe
  2⤵
  PID:6472
- C:\Windows\System\hecvkrT.exe
  C:\Windows\System\hecvkrT.exe
  2⤵
  PID:6508
- C:\Windows\System\oHlZWNu.exe
  C:\Windows\System\oHlZWNu.exe
  2⤵
  PID:6584
- C:\Windows\System\FnKlmgZ.exe
  C:\Windows\System\FnKlmgZ.exe
  2⤵
  PID:6652
- C:\Windows\System\tKzdSJX.exe
  C:\Windows\System\tKzdSJX.exe
  2⤵
  PID:6836
- C:\Windows\System\awoPqBy.exe
  C:\Windows\System\awoPqBy.exe
  2⤵
  PID:6908
- C:\Windows\System\ESJOXtm.exe
  C:\Windows\System\ESJOXtm.exe
  2⤵
  PID:6856
- C:\Windows\System\KsDUGvz.exe
  C:\Windows\System\KsDUGvz.exe
  2⤵
  PID:6892
- C:\Windows\System\xGwTZLa.exe
  C:\Windows\System\xGwTZLa.exe
  2⤵
  PID:6976
- C:\Windows\System\RsQSKIs.exe
  C:\Windows\System\RsQSKIs.exe
  2⤵
  PID:7068
- C:\Windows\System\vvgFtZu.exe
  C:\Windows\System\vvgFtZu.exe
  2⤵
  PID:7040
- C:\Windows\System\XtysolQ.exe
  C:\Windows\System\XtysolQ.exe
  2⤵
  PID:6960
- C:\Windows\System\eVnjgMl.exe
  C:\Windows\System\eVnjgMl.exe
  2⤵
  PID:7024
- C:\Windows\System\gdbChMi.exe
  C:\Windows\System\gdbChMi.exe
  2⤵
  PID:7128
- C:\Windows\System\xLTvTJs.exe
  C:\Windows\System\xLTvTJs.exe
  2⤵
  PID:7104
- C:\Windows\System\lAINRei.exe
  C:\Windows\System\lAINRei.exe
  2⤵
  PID:7144
- C:\Windows\System\ETvQuAe.exe
  C:\Windows\System\ETvQuAe.exe
  2⤵
  PID:6276
- C:\Windows\System\buKNWxe.exe
  C:\Windows\System\buKNWxe.exe
  2⤵
  PID:4560
- C:\Windows\System\gQLlJUu.exe
  C:\Windows\System\gQLlJUu.exe
  2⤵
  PID:6260
- C:\Windows\System\TsYEzZh.exe
  C:\Windows\System\TsYEzZh.exe
  2⤵
  PID:6244
- C:\Windows\System\HOVqbwx.exe
  C:\Windows\System\HOVqbwx.exe
  2⤵
  PID:5588
- C:\Windows\System\wjNCIwp.exe
  C:\Windows\System\wjNCIwp.exe
  2⤵
  PID:6456
- C:\Windows\System\wxJOhFG.exe
  C:\Windows\System\wxJOhFG.exe
  2⤵
  PID:6376
- C:\Windows\System\tdpAQbl.exe
  C:\Windows\System\tdpAQbl.exe
  2⤵
  PID:6372
- C:\Windows\System\suqDqqh.exe
  C:\Windows\System\suqDqqh.exe
  2⤵
  PID:6560
- C:\Windows\System\IeLnhXg.exe
  C:\Windows\System\IeLnhXg.exe
  2⤵
  PID:6704
- C:\Windows\System\YIVAsTo.exe
  C:\Windows\System\YIVAsTo.exe
  2⤵
  PID:6392
- C:\Windows\System\jUfOwHW.exe
  C:\Windows\System\jUfOwHW.exe
  2⤵
  PID:6716
- C:\Windows\System\yrJqxJO.exe
  C:\Windows\System\yrJqxJO.exe
  2⤵
  PID:6628
- C:\Windows\System\uczawUz.exe
  C:\Windows\System\uczawUz.exe
  2⤵
  PID:6904
- C:\Windows\System\yULUhaN.exe
  C:\Windows\System\yULUhaN.exe
  2⤵
  PID:6952
- C:\Windows\System\KdrNkQZ.exe
  C:\Windows\System\KdrNkQZ.exe
  2⤵
  PID:6964
- C:\Windows\System\bMCAKEa.exe
  C:\Windows\System\bMCAKEa.exe
  2⤵
  PID:6752
- C:\Windows\System\eTheVnI.exe
  C:\Windows\System\eTheVnI.exe
  2⤵
  PID:7020
- C:\Windows\System\thJzVKR.exe
  C:\Windows\System\thJzVKR.exe
  2⤵
  PID:7088
- C:\Windows\System\WMVmvks.exe
  C:\Windows\System\WMVmvks.exe
  2⤵
  PID:7140
- C:\Windows\System\kjkhUwb.exe
  C:\Windows\System\kjkhUwb.exe
  2⤵
  PID:5864
- C:\Windows\System\GMOjzfr.exe
  C:\Windows\System\GMOjzfr.exe
  2⤵
  PID:6280
- C:\Windows\System\IODMrXs.exe
  C:\Windows\System\IODMrXs.exe
  2⤵
  PID:6368
- C:\Windows\System\AMRatRK.exe
  C:\Windows\System\AMRatRK.exe
  2⤵
  PID:6600
- C:\Windows\System\VWMlZba.exe
  C:\Windows\System\VWMlZba.exe
  2⤵
  PID:6684
- C:\Windows\System\svWCkwV.exe
  C:\Windows\System\svWCkwV.exe
  2⤵
  PID:7004
- C:\Windows\System\fnZFdKp.exe
  C:\Windows\System\fnZFdKp.exe
  2⤵
  PID:6444
- C:\Windows\System\ctWGFRd.exe
  C:\Windows\System\ctWGFRd.exe
  2⤵
  PID:6544
- C:\Windows\System\BKsLYgU.exe
  C:\Windows\System\BKsLYgU.exe
  2⤵
  PID:6512
- C:\Windows\System\TDcZBvo.exe
  C:\Windows\System\TDcZBvo.exe
  2⤵
  PID:6724
- C:\Windows\System\BmPcmeN.exe
  C:\Windows\System\BmPcmeN.exe
  2⤵
  PID:5128
- C:\Windows\System\saRQzDH.exe
  C:\Windows\System\saRQzDH.exe
  2⤵
  PID:7072
- C:\Windows\System\wuWFLaX.exe
  C:\Windows\System\wuWFLaX.exe
  2⤵
  PID:6264
- C:\Windows\System\CjQPmDJ.exe
  C:\Windows\System\CjQPmDJ.exe
  2⤵
  PID:6240
- C:\Windows\System\yluyQEE.exe
  C:\Windows\System\yluyQEE.exe
  2⤵
  PID:6612
- C:\Windows\System\yWlcCfg.exe
  C:\Windows\System\yWlcCfg.exe
  2⤵
  PID:6180
- C:\Windows\System\HXYmzuO.exe
  C:\Windows\System\HXYmzuO.exe
  2⤵
  PID:6888
- C:\Windows\System\CnYKPpm.exe
  C:\Windows\System\CnYKPpm.exe
  2⤵
  PID:6284
- C:\Windows\System\RoTIRFq.exe
  C:\Windows\System\RoTIRFq.exe
  2⤵
  PID:6576
- C:\Windows\System\UoFVMQQ.exe
  C:\Windows\System\UoFVMQQ.exe
  2⤵
  PID:7188
- C:\Windows\System\HBBNdYu.exe
  C:\Windows\System\HBBNdYu.exe
  2⤵
  PID:7204
- C:\Windows\System\RxZKEeG.exe
  C:\Windows\System\RxZKEeG.exe
  2⤵
  PID:7220
- C:\Windows\System\vbyFXWs.exe
  C:\Windows\System\vbyFXWs.exe
  2⤵
  PID:7236
- C:\Windows\System\LeieFMR.exe
  C:\Windows\System\LeieFMR.exe
  2⤵
  PID:7256
- C:\Windows\System\yHlYLAa.exe
  C:\Windows\System\yHlYLAa.exe
  2⤵
  PID:7272
- C:\Windows\System\uIxAuNg.exe
  C:\Windows\System\uIxAuNg.exe
  2⤵
  PID:7292
- C:\Windows\System\SAXDoHA.exe
  C:\Windows\System\SAXDoHA.exe
  2⤵
  PID:7308
- C:\Windows\System\BnaIyuK.exe
  C:\Windows\System\BnaIyuK.exe
  2⤵
  PID:7324
- C:\Windows\System\dTyZEhK.exe
  C:\Windows\System\dTyZEhK.exe
  2⤵
  PID:7348
- C:\Windows\System\xopLVNW.exe
  C:\Windows\System\xopLVNW.exe
  2⤵
  PID:7364
- C:\Windows\System\KIUKAjv.exe
  C:\Windows\System\KIUKAjv.exe
  2⤵
  PID:7384
- C:\Windows\System\qEGUvbZ.exe
  C:\Windows\System\qEGUvbZ.exe
  2⤵
  PID:7400
- C:\Windows\System\GSANyKS.exe
  C:\Windows\System\GSANyKS.exe
  2⤵
  PID:7416
- C:\Windows\System\vZqhVrg.exe
  C:\Windows\System\vZqhVrg.exe
  2⤵
  PID:7440
- C:\Windows\System\JOMBYBi.exe
  C:\Windows\System\JOMBYBi.exe
  2⤵
  PID:7456
- C:\Windows\System\HJWdVvk.exe
  C:\Windows\System\HJWdVvk.exe
  2⤵
  PID:7472
- C:\Windows\System\AxKAdUB.exe
  C:\Windows\System\AxKAdUB.exe
  2⤵
  PID:7492
- C:\Windows\System\jccdSLh.exe
  C:\Windows\System\jccdSLh.exe
  2⤵
  PID:7508
- C:\Windows\System\rjEfxKC.exe
  C:\Windows\System\rjEfxKC.exe
  2⤵
  PID:7528
- C:\Windows\System\HMHAVuw.exe
  C:\Windows\System\HMHAVuw.exe
  2⤵
  PID:7544
- C:\Windows\System\UGQNNxP.exe
  C:\Windows\System\UGQNNxP.exe
  2⤵
  PID:7564
- C:\Windows\System\yDQwBiG.exe
  C:\Windows\System\yDQwBiG.exe
  2⤵
  PID:7604
- C:\Windows\System\TpgXQBw.exe
  C:\Windows\System\TpgXQBw.exe
  2⤵
  PID:7624
- C:\Windows\System\CcbqcUP.exe
  C:\Windows\System\CcbqcUP.exe
  2⤵
  PID:7640
- C:\Windows\System\BdtjEbv.exe
  C:\Windows\System\BdtjEbv.exe
  2⤵
  PID:7656
- C:\Windows\System\uWVWuvo.exe
  C:\Windows\System\uWVWuvo.exe
  2⤵
  PID:7676
- C:\Windows\System\FaZNGaw.exe
  C:\Windows\System\FaZNGaw.exe
  2⤵
  PID:7692
- C:\Windows\System\CWFImhv.exe
  C:\Windows\System\CWFImhv.exe
  2⤵
  PID:7708
- C:\Windows\System\YsNHcWQ.exe
  C:\Windows\System\YsNHcWQ.exe
  2⤵
  PID:7724
- C:\Windows\System\WyPLYHU.exe
  C:\Windows\System\WyPLYHU.exe
  2⤵
  PID:7740
- C:\Windows\System\dpirIuE.exe
  C:\Windows\System\dpirIuE.exe
  2⤵
  PID:7756
- C:\Windows\System\NDugVOl.exe
  C:\Windows\System\NDugVOl.exe
  2⤵
  PID:7772
- C:\Windows\System\Ddgmiis.exe
  C:\Windows\System\Ddgmiis.exe
  2⤵
  PID:7788
- C:\Windows\System\Dgzjqjh.exe
  C:\Windows\System\Dgzjqjh.exe
  2⤵
  PID:7808
- C:\Windows\System\ahvwqLl.exe
  C:\Windows\System\ahvwqLl.exe
  2⤵
  PID:7828
- C:\Windows\System\ooQBjgm.exe
  C:\Windows\System\ooQBjgm.exe
  2⤵
  PID:7848
- C:\Windows\System\UkDpXZp.exe
  C:\Windows\System\UkDpXZp.exe
  2⤵
  PID:7872
- C:\Windows\System\BsBcvHo.exe
  C:\Windows\System\BsBcvHo.exe
  2⤵
  PID:7888
- C:\Windows\System\PQmVVgb.exe
  C:\Windows\System\PQmVVgb.exe
  2⤵
  PID:7904
- C:\Windows\System\xsfoxYz.exe
  C:\Windows\System\xsfoxYz.exe
  2⤵
  PID:7920
- C:\Windows\System\dbAGlDn.exe
  C:\Windows\System\dbAGlDn.exe
  2⤵
  PID:7936
- C:\Windows\System\GCKgLzD.exe
  C:\Windows\System\GCKgLzD.exe
  2⤵
  PID:7952
- C:\Windows\System\bpWhbZn.exe
  C:\Windows\System\bpWhbZn.exe
  2⤵
  PID:7972
- C:\Windows\System\Bbawzrp.exe
  C:\Windows\System\Bbawzrp.exe
  2⤵
  PID:7988
- C:\Windows\System\HmaRbFo.exe
  C:\Windows\System\HmaRbFo.exe
  2⤵
  PID:8008
- C:\Windows\System\zWqivnp.exe
  C:\Windows\System\zWqivnp.exe
  2⤵
  PID:8024
- C:\Windows\System\KHRZkNL.exe
  C:\Windows\System\KHRZkNL.exe
  2⤵
  PID:8044
- C:\Windows\System\sQePoVq.exe
  C:\Windows\System\sQePoVq.exe
  2⤵
  PID:8060
- C:\Windows\System\CLndIrj.exe
  C:\Windows\System\CLndIrj.exe
  2⤵
  PID:8076
- C:\Windows\System\CCMpIno.exe
  C:\Windows\System\CCMpIno.exe
  2⤵
  PID:8092
- C:\Windows\System\ElZxDVp.exe
  C:\Windows\System\ElZxDVp.exe
  2⤵
  PID:8108
- C:\Windows\System\sQWvLbw.exe
  C:\Windows\System\sQWvLbw.exe
  2⤵
  PID:8144
- C:\Windows\System\vEgfHYa.exe
  C:\Windows\System\vEgfHYa.exe
  2⤵
  PID:8160
- C:\Windows\System\DvJeElU.exe
  C:\Windows\System\DvJeElU.exe
  2⤵
  PID:8180
- C:\Windows\System\VKEYuGe.exe
  C:\Windows\System\VKEYuGe.exe
  2⤵
  PID:6984
- C:\Windows\System\GTwCkXU.exe
  C:\Windows\System\GTwCkXU.exe
  2⤵
  PID:6740
- C:\Windows\System\FYfZhLH.exe
  C:\Windows\System\FYfZhLH.exe
  2⤵
  PID:5336
- C:\Windows\System\GTPNoUY.exe
  C:\Windows\System\GTPNoUY.exe
  2⤵
  PID:7212
- C:\Windows\System\iDsKFqN.exe
  C:\Windows\System\iDsKFqN.exe
  2⤵
  PID:7244
- C:\Windows\System\fXeiMzj.exe
  C:\Windows\System\fXeiMzj.exe
  2⤵
  PID:6176
- C:\Windows\System\ipSanxc.exe
  C:\Windows\System\ipSanxc.exe
  2⤵
  PID:7316
- C:\Windows\System\cCQxoJA.exe
  C:\Windows\System\cCQxoJA.exe
  2⤵
  PID:7356
- C:\Windows\System\egiqqQI.exe
  C:\Windows\System\egiqqQI.exe
  2⤵
  PID:7372
- C:\Windows\System\SFEtpji.exe
  C:\Windows\System\SFEtpji.exe
  2⤵
  PID:7304
- C:\Windows\System\QWXXUTq.exe
  C:\Windows\System\QWXXUTq.exe
  2⤵
  PID:7408
- C:\Windows\System\XnWulvR.exe
  C:\Windows\System\XnWulvR.exe
  2⤵
  PID:7468
- C:\Windows\System\NVvQysl.exe
  C:\Windows\System\NVvQysl.exe
  2⤵
  PID:7552
- C:\Windows\System\EOGzASc.exe
  C:\Windows\System\EOGzASc.exe
  2⤵
  PID:7516
- C:\Windows\System\pxWWDii.exe
  C:\Windows\System\pxWWDii.exe
  2⤵
  PID:7576
- C:\Windows\System\YefRvnK.exe
  C:\Windows\System\YefRvnK.exe
  2⤵
  PID:7588
- C:\Windows\System\QeFXOgb.exe
  C:\Windows\System\QeFXOgb.exe
  2⤵
  PID:7700
- C:\Windows\System\BQNdtAM.exe
  C:\Windows\System\BQNdtAM.exe
  2⤵
  PID:7764
- C:\Windows\System\KCyIYOr.exe
  C:\Windows\System\KCyIYOr.exe
  2⤵
  PID:7648
- C:\Windows\System\ypIoNgb.exe
  C:\Windows\System\ypIoNgb.exe
  2⤵
  PID:7752
- C:\Windows\System\uYLEFTX.exe
  C:\Windows\System\uYLEFTX.exe
  2⤵
  PID:7716
- C:\Windows\System\DxHVutM.exe
  C:\Windows\System\DxHVutM.exe
  2⤵
  PID:7884
- C:\Windows\System\QgnUVRm.exe
  C:\Windows\System\QgnUVRm.exe
  2⤵
  PID:8168
- C:\Windows\System\HLpZqNZ.exe
  C:\Windows\System\HLpZqNZ.exe
  2⤵
  PID:7252
- C:\Windows\System\mLQjmbM.exe
  C:\Windows\System\mLQjmbM.exe
  2⤵
  PID:7264
- C:\Windows\System\thYaDcf.exe
  C:\Windows\System\thYaDcf.exe
  2⤵
  PID:8156
- C:\Windows\System\zVeneIf.exe
  C:\Windows\System\zVeneIf.exe
  2⤵
  PID:8188
- C:\Windows\System\gmepKPe.exe
  C:\Windows\System\gmepKPe.exe
  2⤵
  PID:7180
- C:\Windows\System\EDQOUoi.exe
  C:\Windows\System\EDQOUoi.exe
  2⤵
  PID:7284
- C:\Windows\System\zflHvWm.exe
  C:\Windows\System\zflHvWm.exe
  2⤵
  PID:7428
- C:\Windows\System\uuUneEK.exe
  C:\Windows\System\uuUneEK.exe
  2⤵
  PID:7480
- C:\Windows\System\optbULQ.exe
  C:\Windows\System\optbULQ.exe
  2⤵
  PID:7636
- C:\Windows\System\JjqSnxv.exe
  C:\Windows\System\JjqSnxv.exe
  2⤵
  PID:7452
- C:\Windows\System\tquWHTn.exe
  C:\Windows\System\tquWHTn.exe
  2⤵
  PID:7768
- C:\Windows\System\RzjUvBb.exe
  C:\Windows\System\RzjUvBb.exe
  2⤵
  PID:7880
- C:\Windows\System\mkwuqWA.exe
  C:\Windows\System\mkwuqWA.exe
  2⤵
  PID:7584
- C:\Windows\System\sbluqov.exe
  C:\Windows\System\sbluqov.exe
  2⤵
  PID:7912
- C:\Windows\System\gurVEUM.exe
  C:\Windows\System\gurVEUM.exe
  2⤵
  PID:7600
- C:\Windows\System\GdHsAiE.exe
  C:\Windows\System\GdHsAiE.exe
  2⤵
  PID:7268
- C:\Windows\System\vhSvrsy.exe
  C:\Windows\System\vhSvrsy.exe
  2⤵
  PID:6524
- C:\Windows\System\dRICGLd.exe
  C:\Windows\System\dRICGLd.exe
  2⤵
  PID:7800
- C:\Windows\System\uXqEOvZ.exe
  C:\Windows\System\uXqEOvZ.exe
  2⤵
  PID:7868
- C:\Windows\System\aJOAgBC.exe
  C:\Windows\System\aJOAgBC.exe
  2⤵
  PID:7968
- C:\Windows\System\kNmjWse.exe
  C:\Windows\System\kNmjWse.exe
  2⤵
  PID:8036
- C:\Windows\System\lwDszrq.exe
  C:\Windows\System\lwDszrq.exe
  2⤵
  PID:8132
- C:\Windows\System\BdKfvLV.exe
  C:\Windows\System\BdKfvLV.exe
  2⤵
  PID:7928
- C:\Windows\System\NXPdGSt.exe
  C:\Windows\System\NXPdGSt.exe
  2⤵
  PID:7984
- C:\Windows\System\FtHIbhj.exe
  C:\Windows\System\FtHIbhj.exe
  2⤵
  PID:7616
- C:\Windows\System\iZRYSJA.exe
  C:\Windows\System\iZRYSJA.exe
  2⤵
  PID:7196
- C:\Windows\System\BmqzBOh.exe
  C:\Windows\System\BmqzBOh.exe
  2⤵
  PID:7432
- C:\Windows\System\ePGLiRQ.exe
  C:\Windows\System\ePGLiRQ.exe
  2⤵
  PID:7672
- C:\Windows\System\QsVTNNk.exe
  C:\Windows\System\QsVTNNk.exe
  2⤵
  PID:8100
- C:\Windows\System\CNmmQha.exe
  C:\Windows\System\CNmmQha.exe
  2⤵
  PID:7376
- C:\Windows\System\vvnkxhW.exe
  C:\Windows\System\vvnkxhW.exe
  2⤵
  PID:7396
- C:\Windows\System\UgWkLYW.exe
  C:\Windows\System\UgWkLYW.exe
  2⤵
  PID:7996
- C:\Windows\System\HpTzRKh.exe
  C:\Windows\System\HpTzRKh.exe
  2⤵
  PID:7392
- C:\Windows\System\jQLzflF.exe
  C:\Windows\System\jQLzflF.exe
  2⤵
  PID:8196
- C:\Windows\System\xTJkaXv.exe
  C:\Windows\System\xTJkaXv.exe
  2⤵
  PID:8212
- C:\Windows\System\LKOrwHG.exe
  C:\Windows\System\LKOrwHG.exe
  2⤵
  PID:8228
- C:\Windows\System\docksEj.exe
  C:\Windows\System\docksEj.exe
  2⤵
  PID:8244
- C:\Windows\System\rCgpUaJ.exe
  C:\Windows\System\rCgpUaJ.exe
  2⤵
  PID:8260
- C:\Windows\System\klSbGlm.exe
  C:\Windows\System\klSbGlm.exe
  2⤵
  PID:8276
- C:\Windows\System\XqXLeJp.exe
  C:\Windows\System\XqXLeJp.exe
  2⤵
  PID:8292
- C:\Windows\System\aZWhBaA.exe
  C:\Windows\System\aZWhBaA.exe
  2⤵
  PID:8308
- C:\Windows\System\FAvFgme.exe
  C:\Windows\System\FAvFgme.exe
  2⤵
  PID:8324
- C:\Windows\System\WzdFJpV.exe
  C:\Windows\System\WzdFJpV.exe
  2⤵
  PID:8340
- C:\Windows\System\VHvbxje.exe
  C:\Windows\System\VHvbxje.exe
  2⤵
  PID:8380
- C:\Windows\System\DHkIumz.exe
  C:\Windows\System\DHkIumz.exe
  2⤵
  PID:8396
- C:\Windows\System\PrCfCZq.exe
  C:\Windows\System\PrCfCZq.exe
  2⤵
  PID:8412
- C:\Windows\System\PypbhRl.exe
  C:\Windows\System\PypbhRl.exe
  2⤵
  PID:8428
- C:\Windows\System\USKPrVa.exe
  C:\Windows\System\USKPrVa.exe
  2⤵
  PID:8444
- C:\Windows\System\NPxqrsd.exe
  C:\Windows\System\NPxqrsd.exe
  2⤵
  PID:8460
- C:\Windows\System\iwaykGc.exe
  C:\Windows\System\iwaykGc.exe
  2⤵
  PID:8476
- C:\Windows\System\qBBtWAF.exe
  C:\Windows\System\qBBtWAF.exe
  2⤵
  PID:8492
- C:\Windows\System\NFKMNmt.exe
  C:\Windows\System\NFKMNmt.exe
  2⤵
  PID:8508
- C:\Windows\System\HPyCCVV.exe
  C:\Windows\System\HPyCCVV.exe
  2⤵
  PID:8524
- C:\Windows\System\tyumxHP.exe
  C:\Windows\System\tyumxHP.exe
  2⤵
  PID:8540
- C:\Windows\System\Bomudfa.exe
  C:\Windows\System\Bomudfa.exe
  2⤵
  PID:8556
- C:\Windows\System\GeOQcOe.exe
  C:\Windows\System\GeOQcOe.exe
  2⤵
  PID:8572
- C:\Windows\System\JiJhbRv.exe
  C:\Windows\System\JiJhbRv.exe
  2⤵
  PID:8592
- C:\Windows\System\mGJJzFt.exe
  C:\Windows\System\mGJJzFt.exe
  2⤵
  PID:8608
- C:\Windows\System\ObzynkK.exe
  C:\Windows\System\ObzynkK.exe
  2⤵
  PID:8624
- C:\Windows\System\seTuGdy.exe
  C:\Windows\System\seTuGdy.exe
  2⤵
  PID:8660
- C:\Windows\System\UcXUMpb.exe
  C:\Windows\System\UcXUMpb.exe
  2⤵
  PID:8676
- C:\Windows\System\ArQhvbV.exe
  C:\Windows\System\ArQhvbV.exe
  2⤵
  PID:8692
- C:\Windows\System\fctIDKW.exe
  C:\Windows\System\fctIDKW.exe
  2⤵
  PID:8708
- C:\Windows\System\zaIQgsO.exe
  C:\Windows\System\zaIQgsO.exe
  2⤵
  PID:8728
- C:\Windows\System\PTkcEWo.exe
  C:\Windows\System\PTkcEWo.exe
  2⤵
  PID:8744
- C:\Windows\System\LtQHpFV.exe
  C:\Windows\System\LtQHpFV.exe
  2⤵
  PID:8760
- C:\Windows\System\JMJvFGW.exe
  C:\Windows\System\JMJvFGW.exe
  2⤵
  PID:8780
- C:\Windows\System\RiJQawk.exe
  C:\Windows\System\RiJQawk.exe
  2⤵
  PID:8796
- C:\Windows\System\GDAUhhI.exe
  C:\Windows\System\GDAUhhI.exe
  2⤵
  PID:8812
- C:\Windows\System\LOWUbvq.exe
  C:\Windows\System\LOWUbvq.exe
  2⤵
  PID:8832
- C:\Windows\System\nsrnTor.exe
  C:\Windows\System\nsrnTor.exe
  2⤵
  PID:8848
- C:\Windows\System\LoKRSwF.exe
  C:\Windows\System\LoKRSwF.exe
  2⤵
  PID:8864
- C:\Windows\System\FVTxzAU.exe
  C:\Windows\System\FVTxzAU.exe
  2⤵
  PID:8880
- C:\Windows\System\vjxuwUU.exe
  C:\Windows\System\vjxuwUU.exe
  2⤵
  PID:8896
- C:\Windows\System\eomLubF.exe
  C:\Windows\System\eomLubF.exe
  2⤵
  PID:8912
- C:\Windows\System\FrisYTV.exe
  C:\Windows\System\FrisYTV.exe
  2⤵
  PID:8932
- C:\Windows\System\MdhnKLr.exe
  C:\Windows\System\MdhnKLr.exe
  2⤵
  PID:8948
- C:\Windows\System\YPfLzAS.exe
  C:\Windows\System\YPfLzAS.exe
  2⤵
  PID:8964
- C:\Windows\System\LfSoDKD.exe
  C:\Windows\System\LfSoDKD.exe
  2⤵
  PID:8980
- C:\Windows\System\mOIwMeh.exe
  C:\Windows\System\mOIwMeh.exe
  2⤵
  PID:8996
- C:\Windows\System\EyBNuYu.exe
  C:\Windows\System\EyBNuYu.exe
  2⤵
  PID:9012
- C:\Windows\System\UmqbNKV.exe
  C:\Windows\System\UmqbNKV.exe
  2⤵
  PID:9052
- C:\Windows\System\AjEsPIe.exe
  C:\Windows\System\AjEsPIe.exe
  2⤵
  PID:9072
- C:\Windows\System\JaxHTXe.exe
  C:\Windows\System\JaxHTXe.exe
  2⤵
  PID:9088
- C:\Windows\System\zJvbLbN.exe
  C:\Windows\System\zJvbLbN.exe
  2⤵
  PID:9104
- C:\Windows\System\JrNxgJo.exe
  C:\Windows\System\JrNxgJo.exe
  2⤵
  PID:9120
- C:\Windows\System\RfFjkyP.exe
  C:\Windows\System\RfFjkyP.exe
  2⤵
  PID:9136
- C:\Windows\System\rmyCAsV.exe
  C:\Windows\System\rmyCAsV.exe
  2⤵
  PID:9152
- C:\Windows\System\MTejlyS.exe
  C:\Windows\System\MTejlyS.exe
  2⤵
  PID:9168
- C:\Windows\System\KkFpZgn.exe
  C:\Windows\System\KkFpZgn.exe
  2⤵
  PID:9184
- C:\Windows\System\TrkKKwj.exe
  C:\Windows\System\TrkKKwj.exe
  2⤵
  PID:7524
- C:\Windows\System\Xkpycuf.exe
  C:\Windows\System\Xkpycuf.exe
  2⤵
  PID:7964
- C:\Windows\System\bRWZvgd.exe
  C:\Windows\System\bRWZvgd.exe
  2⤵
  PID:7228
- C:\Windows\System\GzcYFCW.exe
  C:\Windows\System\GzcYFCW.exe
  2⤵
  PID:7632
- C:\Windows\System\hUtWhKF.exe
  C:\Windows\System\hUtWhKF.exe
  2⤵
  PID:7448
- C:\Windows\System\StpUOgJ.exe
  C:\Windows\System\StpUOgJ.exe
  2⤵
  PID:8088
- C:\Windows\System\zBwbkwr.exe
  C:\Windows\System\zBwbkwr.exe
  2⤵
  PID:8240
- C:\Windows\System\zzZAgcB.exe
  C:\Windows\System\zzZAgcB.exe
  2⤵
  PID:8336
- C:\Windows\System\gKbWTmU.exe
  C:\Windows\System\gKbWTmU.exe
  2⤵
  PID:8424
- C:\Windows\System\XhOTeCk.exe
  C:\Windows\System\XhOTeCk.exe
  2⤵
  PID:8256
- C:\Windows\System\KwTQbOA.exe
  C:\Windows\System\KwTQbOA.exe
  2⤵
  PID:8356
- C:\Windows\System\LqFSZcK.exe
  C:\Windows\System\LqFSZcK.exe
  2⤵
  PID:8520
- C:\Windows\System\rmSszpq.exe
  C:\Windows\System\rmSszpq.exe
  2⤵
  PID:8320
- C:\Windows\System\QqsHwsY.exe
  C:\Windows\System\QqsHwsY.exe
  2⤵
  PID:8500
- C:\Windows\System\BDUGvFO.exe
  C:\Windows\System\BDUGvFO.exe
  2⤵
  PID:8436
- C:\Windows\System\QeytXpl.exe
  C:\Windows\System\QeytXpl.exe
  2⤵
  PID:8504
- C:\Windows\System\UGNwtAr.exe
  C:\Windows\System\UGNwtAr.exe
  2⤵
  PID:8584
- C:\Windows\System\lIFzXSE.exe
  C:\Windows\System\lIFzXSE.exe
  2⤵
  PID:8536
- C:\Windows\System\KyBDHJA.exe
  C:\Windows\System\KyBDHJA.exe
  2⤵
  PID:8740
- C:\Windows\System\OumkiRc.exe
  C:\Windows\System\OumkiRc.exe
  2⤵
  PID:8924
- C:\Windows\System\DhotXje.exe
  C:\Windows\System\DhotXje.exe
  2⤵
  PID:8992
- C:\Windows\System\maIMzWd.exe
  C:\Windows\System\maIMzWd.exe
  2⤵
  PID:9084
- C:\Windows\System\JIyFMCk.exe
  C:\Windows\System\JIyFMCk.exe
  2⤵
  PID:9044
- C:\Windows\System\pObFATv.exe
  C:\Windows\System\pObFATv.exe
  2⤵
  PID:9132
- C:\Windows\System\cUMumut.exe
  C:\Windows\System\cUMumut.exe
  2⤵
  PID:7896
- C:\Windows\System\BFtubgH.exe
  C:\Windows\System\BFtubgH.exe
  2⤵
  PID:8052
- C:\Windows\System\wbsDeEp.exe
  C:\Windows\System\wbsDeEp.exe
  2⤵
  PID:8376
- C:\Windows\System\iOkNcft.exe
  C:\Windows\System\iOkNcft.exe
  2⤵
  PID:8124
- C:\Windows\System\VvnnUfb.exe
  C:\Windows\System\VvnnUfb.exe
  2⤵
  PID:7780
- C:\Windows\System\VSgmkiG.exe
  C:\Windows\System\VSgmkiG.exe
  2⤵
  PID:8532
- C:\Windows\System\mHJWEpv.exe
  C:\Windows\System\mHJWEpv.exe
  2⤵
  PID:8604
- C:\Windows\System\nDhlAYF.exe
  C:\Windows\System\nDhlAYF.exe
  2⤵
  PID:7960
- C:\Windows\System\tCMDVpN.exe
  C:\Windows\System\tCMDVpN.exe
  2⤵
  PID:8684
- C:\Windows\System\ZUNOpkt.exe
  C:\Windows\System\ZUNOpkt.exe
  2⤵
  PID:8072
- C:\Windows\System\hnIhMuI.exe
  C:\Windows\System\hnIhMuI.exe
  2⤵
  PID:8392
- C:\Windows\System\zJfPsBb.exe
  C:\Windows\System\zJfPsBb.exe
  2⤵
  PID:8332
- C:\Windows\System\bAnBVjG.exe
  C:\Windows\System\bAnBVjG.exe
  2⤵
  PID:8484
- C:\Windows\System\pjMUDlH.exe
  C:\Windows\System\pjMUDlH.exe
  2⤵
  PID:8284
- C:\Windows\System\DbbgMJe.exe
  C:\Windows\System\DbbgMJe.exe
  2⤵
  PID:8404
- C:\Windows\System\gIRgyyw.exe
  C:\Windows\System\gIRgyyw.exe
  2⤵
  PID:8668
- C:\Windows\System\viQwmNx.exe
  C:\Windows\System\viQwmNx.exe
  2⤵
  PID:8820
- C:\Windows\System\PYGUaqT.exe
  C:\Windows\System\PYGUaqT.exe
  2⤵
  PID:8648
- C:\Windows\System\mwUjYXm.exe
  C:\Windows\System\mwUjYXm.exe
  2⤵
  PID:8772
- C:\Windows\System\wACTCoE.exe
  C:\Windows\System\wACTCoE.exe
  2⤵
  PID:8828
- C:\Windows\System\SvKeZCK.exe
  C:\Windows\System\SvKeZCK.exe
  2⤵
  PID:9028
- C:\Windows\System\hWXXWJI.exe
  C:\Windows\System\hWXXWJI.exe
  2⤵
  PID:9180
- C:\Windows\System\GCqtFfL.exe
  C:\Windows\System\GCqtFfL.exe
  2⤵
  PID:8652
- C:\Windows\System\QwkdqSc.exe
  C:\Windows\System\QwkdqSc.exe
  2⤵
  PID:8360
- C:\Windows\System\kAGJgkP.exe
  C:\Windows\System\kAGJgkP.exe
  2⤵
  PID:8756
- C:\Windows\System\BsKdffq.exe
  C:\Windows\System\BsKdffq.exe
  2⤵
  PID:2140
- C:\Windows\System\MKUvtdI.exe
  C:\Windows\System\MKUvtdI.exe
  2⤵
  PID:8876
- C:\Windows\System\OeEbPdW.exe
  C:\Windows\System\OeEbPdW.exe
  2⤵
  PID:9232
- C:\Windows\System\kBtCUXF.exe
  C:\Windows\System\kBtCUXF.exe
  2⤵
  PID:9252
- C:\Windows\System\QNIRIky.exe
  C:\Windows\System\QNIRIky.exe
  2⤵
  PID:9268
- C:\Windows\System\NUhtrME.exe
  C:\Windows\System\NUhtrME.exe
  2⤵
  PID:9320
- C:\Windows\System\QJVDxVP.exe
  C:\Windows\System\QJVDxVP.exe
  2⤵
  PID:9336
- C:\Windows\System\EaNtbHU.exe
  C:\Windows\System\EaNtbHU.exe
  2⤵
  PID:9352
- C:\Windows\System\nwBBgUN.exe
  C:\Windows\System\nwBBgUN.exe
  2⤵
  PID:9368
- C:\Windows\System\TtmkDqP.exe
  C:\Windows\System\TtmkDqP.exe
  2⤵
  PID:9384
- C:\Windows\System\sdjCZPm.exe
  C:\Windows\System\sdjCZPm.exe
  2⤵
  PID:9400
- C:\Windows\System\VHYhvwf.exe
  C:\Windows\System\VHYhvwf.exe
  2⤵
  PID:9416
- C:\Windows\System\CbHKeDS.exe
  C:\Windows\System\CbHKeDS.exe
  2⤵
  PID:9464
- C:\Windows\System\ryezRmK.exe
  C:\Windows\System\ryezRmK.exe
  2⤵
  PID:9504
- C:\Windows\System\tjpFVTk.exe
  C:\Windows\System\tjpFVTk.exe
  2⤵
  PID:9524
- C:\Windows\System\jAwheTC.exe
  C:\Windows\System\jAwheTC.exe
  2⤵
  PID:9540
- C:\Windows\System\oqFeEKw.exe
  C:\Windows\System\oqFeEKw.exe
  2⤵
  PID:9556
- C:\Windows\System\QuLEgQq.exe
  C:\Windows\System\QuLEgQq.exe
  2⤵
  PID:9572
- C:\Windows\System\sBVGmkq.exe
  C:\Windows\System\sBVGmkq.exe
  2⤵
  PID:9588
- C:\Windows\System\rDfauKC.exe
  C:\Windows\System\rDfauKC.exe
  2⤵
  PID:9604
- C:\Windows\System\aeSEoZg.exe
  C:\Windows\System\aeSEoZg.exe
  2⤵
  PID:9620
- C:\Windows\System\iqKEdKV.exe
  C:\Windows\System\iqKEdKV.exe
  2⤵
  PID:9688
- C:\Windows\System\IqMnVLA.exe
  C:\Windows\System\IqMnVLA.exe
  2⤵
  PID:9708
- C:\Windows\System\lcQDcVK.exe
  C:\Windows\System\lcQDcVK.exe
  2⤵
  PID:9724
- C:\Windows\System\LyTdiUR.exe
  C:\Windows\System\LyTdiUR.exe
  2⤵
  PID:9740
- C:\Windows\System\UBwryBo.exe
  C:\Windows\System\UBwryBo.exe
  2⤵
  PID:9756
- C:\Windows\System\oKVbOnA.exe
  C:\Windows\System\oKVbOnA.exe
  2⤵
  PID:9772
- C:\Windows\System\alcEeJo.exe
  C:\Windows\System\alcEeJo.exe
  2⤵
  PID:9788
- C:\Windows\System\ftBctDp.exe
  C:\Windows\System\ftBctDp.exe
  2⤵
  PID:9808
- C:\Windows\System\YLHpzES.exe
  C:\Windows\System\YLHpzES.exe
  2⤵
  PID:9824
- C:\Windows\System\DidXsmW.exe
  C:\Windows\System\DidXsmW.exe
  2⤵
  PID:9840
- C:\Windows\System\TUIwRrR.exe
  C:\Windows\System\TUIwRrR.exe
  2⤵
  PID:9860
- C:\Windows\System\tpTBTgg.exe
  C:\Windows\System\tpTBTgg.exe
  2⤵
  PID:9880
- C:\Windows\System\SJPFYNI.exe
  C:\Windows\System\SJPFYNI.exe
  2⤵
  PID:9896
- C:\Windows\System\jlAVhvq.exe
  C:\Windows\System\jlAVhvq.exe
  2⤵
  PID:9920
- C:\Windows\System\beLaSnh.exe
  C:\Windows\System\beLaSnh.exe
  2⤵
  PID:9940
- C:\Windows\System\HJRtCks.exe
  C:\Windows\System\HJRtCks.exe
  2⤵
  PID:10032
- C:\Windows\System\WuleybW.exe
  C:\Windows\System\WuleybW.exe
  2⤵
  PID:10084
- C:\Windows\System\cxAVpQA.exe
  C:\Windows\System\cxAVpQA.exe
  2⤵
  PID:10100
- C:\Windows\System\bvjWWNx.exe
  C:\Windows\System\bvjWWNx.exe
  2⤵
  PID:10116
- C:\Windows\System\BOhPTsT.exe
  C:\Windows\System\BOhPTsT.exe
  2⤵
  PID:10132
- C:\Windows\System\Lyprewe.exe
  C:\Windows\System\Lyprewe.exe
  2⤵
  PID:10148
- C:\Windows\System\dmdTnNw.exe
  C:\Windows\System\dmdTnNw.exe
  2⤵
  PID:10168
- C:\Windows\System\FHYCMXW.exe
  C:\Windows\System\FHYCMXW.exe
  2⤵
  PID:10184
- C:\Windows\System\axBoLAf.exe
  C:\Windows\System\axBoLAf.exe
  2⤵
  PID:10200
- C:\Windows\System\LBNemNp.exe
  C:\Windows\System\LBNemNp.exe
  2⤵
  PID:10224
- C:\Windows\System\wluHgLs.exe
  C:\Windows\System\wluHgLs.exe
  2⤵
  PID:7688
- C:\Windows\System\dksgrXk.exe
  C:\Windows\System\dksgrXk.exe
  2⤵
  PID:8752
- C:\Windows\System\lvbYemN.exe
  C:\Windows\System\lvbYemN.exe
  2⤵
  PID:2184
- C:\Windows\System\CxnyTVC.exe
  C:\Windows\System\CxnyTVC.exe
  2⤵
  PID:2420
- C:\Windows\System\JvhxYjx.exe
  C:\Windows\System\JvhxYjx.exe
  2⤵
  PID:8084
- C:\Windows\System\SJJEFSV.exe
  C:\Windows\System\SJJEFSV.exe
  2⤵
  PID:9144
- C:\Windows\System\cfrYdKE.exe
  C:\Windows\System\cfrYdKE.exe
  2⤵
  PID:9116
- C:\Windows\System\KlILSQz.exe
  C:\Windows\System\KlILSQz.exe
  2⤵
  PID:8352
- C:\Windows\System\MdHsRWf.exe
  C:\Windows\System\MdHsRWf.exe
  2⤵
  PID:9476
- C:\Windows\System\nviiXym.exe
  C:\Windows\System\nviiXym.exe
  2⤵
  PID:8904
- C:\Windows\System\VbfJRwd.exe
  C:\Windows\System\VbfJRwd.exe
  2⤵
  PID:9032
- C:\Windows\System\rjGLfuy.exe
  C:\Windows\System\rjGLfuy.exe
  2⤵
  PID:2556
- C:\Windows\System\XVSZExu.exe
  C:\Windows\System\XVSZExu.exe
  2⤵
  PID:9260
- C:\Windows\System\JeWiNck.exe
  C:\Windows\System\JeWiNck.exe
  2⤵
  PID:9448
- C:\Windows\System\BXehSrt.exe
  C:\Windows\System\BXehSrt.exe
  2⤵
  PID:9552
- C:\Windows\System\ewRQcSp.exe
  C:\Windows\System\ewRQcSp.exe
  2⤵
  PID:9636
- C:\Windows\System\pzoeKEz.exe
  C:\Windows\System\pzoeKEz.exe
  2⤵
  PID:9360
- C:\Windows\System\UAYKmuF.exe
  C:\Windows\System\UAYKmuF.exe
  2⤵
  PID:9652
- C:\Windows\System\dmDwPPJ.exe
  C:\Windows\System\dmDwPPJ.exe
  2⤵
  PID:9444
- C:\Windows\System\luyMswp.exe
  C:\Windows\System\luyMswp.exe
  2⤵
  PID:9704
- C:\Windows\System\NMMMGHv.exe
  C:\Windows\System\NMMMGHv.exe
  2⤵
  PID:9796
- C:\Windows\System\qEtqefy.exe
  C:\Windows\System\qEtqefy.exe
  2⤵
  PID:9820
- C:\Windows\System\LUzvbjv.exe
  C:\Windows\System\LUzvbjv.exe
  2⤵
  PID:9848
- C:\Windows\System\FvprCPa.exe
  C:\Windows\System\FvprCPa.exe
  2⤵
  PID:9888
- C:\Windows\System\nkFkbPE.exe
  C:\Windows\System\nkFkbPE.exe
  2⤵
  PID:9832
- C:\Windows\System\iUZpfWn.exe
  C:\Windows\System\iUZpfWn.exe
  2⤵
  PID:9936
- C:\Windows\System\QwxhbMC.exe
  C:\Windows\System\QwxhbMC.exe
  2⤵
  PID:9316
- C:\Windows\System\ZnNdaTb.exe
  C:\Windows\System\ZnNdaTb.exe
  2⤵
  PID:10192
- C:\Windows\System\QxDCZDN.exe
  C:\Windows\System\QxDCZDN.exe
  2⤵
  PID:9240
- C:\Windows\System\Vzotkxh.exe
  C:\Windows\System\Vzotkxh.exe
  2⤵
  PID:2540
- C:\Windows\System\jArqLgT.exe
  C:\Windows\System\jArqLgT.exe
  2⤵
  PID:8420
- C:\Windows\System\BCCuHae.exe
  C:\Windows\System\BCCuHae.exe
  2⤵
  PID:4636
- C:\Windows\System\QAuarph.exe
  C:\Windows\System\QAuarph.exe
  2⤵
  PID:8956
- C:\Windows\System\YTjYCUm.exe
  C:\Windows\System\YTjYCUm.exe
  2⤵
  PID:9376
- C:\Windows\System\Aauheqk.exe
  C:\Windows\System\Aauheqk.exe
  2⤵
  PID:9308
- C:\Windows\System\vplfhBc.exe
  C:\Windows\System\vplfhBc.exe
  2⤵
  PID:2740
- C:\Windows\System\gGQoLnf.exe
  C:\Windows\System\gGQoLnf.exe
  2⤵
  PID:8644
- C:\Windows\System\xuGshxP.exe
  C:\Windows\System\xuGshxP.exe
  2⤵
  PID:8172
- C:\Windows\System\cRLESDU.exe
  C:\Windows\System\cRLESDU.exe
  2⤵
  PID:9312
- C:\Windows\System\VgRYbeB.exe
  C:\Windows\System\VgRYbeB.exe
  2⤵
  PID:9596
- C:\Windows\System\TvEMhJl.exe
  C:\Windows\System\TvEMhJl.exe
  2⤵
  PID:9332
- C:\Windows\System\PIjZFqJ.exe
  C:\Windows\System\PIjZFqJ.exe
  2⤵
  PID:9392
- C:\Windows\System\HHhqzZw.exe
  C:\Windows\System\HHhqzZw.exe
  2⤵
  PID:9516
- C:\Windows\System\hgofwZu.exe
  C:\Windows\System\hgofwZu.exe
  2⤵
  PID:9628
- C:\Windows\System\gZYfara.exe
  C:\Windows\System\gZYfara.exe
  2⤵
  PID:8808
- C:\Windows\System\NVRhOfO.exe
  C:\Windows\System\NVRhOfO.exe
  2⤵
  PID:8656
- C:\Windows\System\ogDQjoV.exe
  C:\Windows\System\ogDQjoV.exe
  2⤵
  PID:9644
- C:\Windows\System\qHeulDF.exe
  C:\Windows\System\qHeulDF.exe
  2⤵
  PID:9676
- C:\Windows\System\WXhXCXu.exe
  C:\Windows\System\WXhXCXu.exe
  2⤵
  PID:9428
- C:\Windows\System\vFtjhUQ.exe
  C:\Windows\System\vFtjhUQ.exe
  2⤵
  PID:9440
- C:\Windows\System\AIJGopf.exe
  C:\Windows\System\AIJGopf.exe
  2⤵
  PID:9700
- C:\Windows\System\UKdYpbe.exe
  C:\Windows\System\UKdYpbe.exe
  2⤵
  PID:9912
- C:\Windows\System\dvdmNtN.exe
  C:\Windows\System\dvdmNtN.exe
  2⤵
  PID:9856
- C:\Windows\System\GQLBUfT.exe
  C:\Windows\System\GQLBUfT.exe
  2⤵
  PID:10052
- C:\Windows\System\xHpSlcc.exe
  C:\Windows\System\xHpSlcc.exe
  2⤵
  PID:10072
- C:\Windows\System\aOXRSPf.exe
  C:\Windows\System\aOXRSPf.exe
  2⤵
  PID:9288
- C:\Windows\System\jpGQwLY.exe
  C:\Windows\System\jpGQwLY.exe
  2⤵
  PID:10020
- C:\Windows\System\PMcremJ.exe
  C:\Windows\System\PMcremJ.exe
  2⤵
  PID:9968
- C:\Windows\System\wklOUwG.exe
  C:\Windows\System\wklOUwG.exe
  2⤵
  PID:10124
- C:\Windows\System\jYVsxBo.exe
  C:\Windows\System\jYVsxBo.exe
  2⤵
  PID:10164
- C:\Windows\System\KQMmxHX.exe
  C:\Windows\System\KQMmxHX.exe
  2⤵
  PID:8304
- C:\Windows\System\MkCvhdY.exe
  C:\Windows\System\MkCvhdY.exe
  2⤵
  PID:2080
- C:\Windows\System\wsQfijF.exe
  C:\Windows\System\wsQfijF.exe
  2⤵
  PID:9600
- C:\Windows\System\jcdcmgu.exe
  C:\Windows\System\jcdcmgu.exe
  2⤵
  PID:9488
- C:\Windows\System\MQncpAu.exe
  C:\Windows\System\MQncpAu.exe
  2⤵
  PID:9408
- C:\Windows\System\TZqJdSg.exe
  C:\Windows\System\TZqJdSg.exe
  2⤵
  PID:9532
- C:\Windows\System\RjmodrJ.exe
  C:\Windows\System\RjmodrJ.exe
  2⤵
  PID:9564
- C:\Windows\System\umhjBwl.exe
  C:\Windows\System\umhjBwl.exe
  2⤵
  PID:8856
- C:\Windows\System\TrSPxHI.exe
  C:\Windows\System\TrSPxHI.exe
  2⤵
  PID:9036
- C:\Windows\System\qDFlDVr.exe
  C:\Windows\System\qDFlDVr.exe
  2⤵
  PID:9520
- C:\Windows\System\gqNgTpu.exe
  C:\Windows\System\gqNgTpu.exe
  2⤵
  PID:8004
- C:\Windows\System\NYVoNOe.exe
  C:\Windows\System\NYVoNOe.exe
  2⤵
  PID:9432
- C:\Windows\System\fuZiCKr.exe
  C:\Windows\System\fuZiCKr.exe
  2⤵
  PID:10044
- C:\Windows\System\YLfDMTX.exe
  C:\Windows\System\YLfDMTX.exe
  2⤵
  PID:9720
- C:\Windows\System\LXoMwEV.exe
  C:\Windows\System\LXoMwEV.exe
  2⤵
  PID:9768
- C:\Windows\System\yKcTRzu.exe
  C:\Windows\System\yKcTRzu.exe
  2⤵
  PID:9456
- C:\Windows\System\rxfMCMo.exe
  C:\Windows\System\rxfMCMo.exe
  2⤵
  PID:10080
- C:\Windows\System\LKGVyAV.exe
  C:\Windows\System\LKGVyAV.exe
  2⤵
  PID:9988
- C:\Windows\System\mPEMleG.exe
  C:\Windows\System\mPEMleG.exe
  2⤵
  PID:9948
- C:\Windows\System\SkokEXi.exe
  C:\Windows\System\SkokEXi.exe
  2⤵
  PID:9996
- C:\Windows\System\FWlJLss.exe
  C:\Windows\System\FWlJLss.exe
  2⤵
  PID:10128
- C:\Windows\System\hLVzHhQ.exe
  C:\Windows\System\hLVzHhQ.exe
  2⤵
  PID:1616
- C:\Windows\System\sxkuBSj.exe
  C:\Windows\System\sxkuBSj.exe
  2⤵
  PID:9048
- C:\Windows\System\UVfVrLX.exe
  C:\Windows\System\UVfVrLX.exe
  2⤵
  PID:8908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ANZmNSD.exe

Filesize
1.6MB

MD5
c7a2468204ed6efd267aa886192eabc0

SHA1
6d4b568b0e2c0ad6d61282f6786a17aa54176065

SHA256
94962723935e9b8c45cc55fdd1dc41e61d03b5e11f1f8ed6b6a635276bb2a69e

SHA512
b9a0c6d0584801d727a58cfd11f8caec9622dd5a522d8ebce392358e0e274b6c110b9c9baf258f8159126918c972c873f449761a76e8b81cbc23dcc6313e1092

Download Submit
C:\Windows\system\EKmhjIr.exe

Filesize
1.6MB

MD5
0dfecdba7036740a76455e2720e044bb

SHA1
6dfb3bdc64bc6025e021c97666b4e039b1967412

SHA256
83737a2ea3a8760de61e3d392ce47f23a7deadd4f560f089bed2d4c1ac98a9c5

SHA512
c1f4dc3538de983c57853c342f6883f521d524873807b829cc8252df61b05ca544704de44ca53dc90f2216d6a998acf176fa9be537b0a6ad1a1efda01aca5a0f

Download Submit
C:\Windows\system\EfZTVLi.exe

Filesize
1.6MB

MD5
a2b5f66e645a74e64c342667d8a35f14

SHA1
dfc5c799aaade3ba4b84e0c6ed6da4a05cc6c8a1

SHA256
194c5a930de3d0c37fef23c03f70644c92e2d99ff0b325c3b9c27d329069e4f5

SHA512
c66950250f338968d8bd13b9cd0de50417641ebb4faee3d563ecb857c659c275e73b02b6a013fb03cc7770649372b00ad0a9938553223c26a7ab3e03c2df988c

Download Submit
C:\Windows\system\GMlqABO.exe

Filesize
1.6MB

MD5
12ea507b0874ed6993b9ac1f7e503721

SHA1
92e8a8db9f0223a1df7cf47146ea4c12eb29e8f1

SHA256
90fd76a3b91afc0d0d01edebca877140d764d5a49e4f3a0574a14cb36f520818

SHA512
34ff3794ce55af86a9c6ad768636caaf0b4a17c9d102da018e547b455092648992be5e1f8163a6b540d8f930a4917809595aeca36d4a25bafa34dcfdca96ec85

Download Submit
C:\Windows\system\HiJgwxb.exe

Filesize
1.6MB

MD5
58c9b2d2bef5d80eb653f69073feee35

SHA1
3fa6c7ff4b6ea8cffb5b610a513c3f5792da6542

SHA256
95358f31e47b269db441a76fa820e3389d7702a29c442db5161649297290a5e9

SHA512
1a9520d8508806e0a9f0351f37362dba8b3ffe3d654337f1823609d63f62f2a081bc4eec1eaa5db2e2b284d264965ad3b6b8918185af0e32f2d8f31149730256

Download Submit
C:\Windows\system\JdxlEky.exe

Filesize
1.6MB

MD5
2b48d0201f66c481c7a16e2d7f412d11

SHA1
dc21f5f8202c13e0f73ac1a9be7d603b2a3f51bc

SHA256
39f9726d25dbd542f61fb965d6cfbab2fcbfefd164b11afcff8c97cfe4b4aaa4

SHA512
68d175ec3f43db1a5e8af066ef4a7e0bc2bef60c4713808a9088c3ad8b739fc957c77242b6acf9bf879c8fc05b5564f3f4a12dcf2002f904e91f460d51c54e7a

Download Submit
C:\Windows\system\OcaRJyJ.exe

Filesize
1.6MB

MD5
e2af51eb4423fe274ff791c63d29b4a6

SHA1
6b0e668d9643cbc756baabe95e1ab88e577738ee

SHA256
ae6f8e14165e72c855079b7aaddd11fbc6d7dd7a79e63743dcff7f151e0de768

SHA512
c2c9d80141ed54bd53ebfdb02217c168b7918c66c0d6418c4c42d908fb2bc7fcf0dfb364f935e9da732dfe77dde928f37dc07c4be132fc70fb1045db8be2c781

Download Submit
C:\Windows\system\PROmJXp.exe

Filesize
1.6MB

MD5
dd3d6f88904aac460a9c954c00d7c4d8

SHA1
7e9a3901b4ac0e96fabcbfe899d24e479b4ac6e6

SHA256
ba90869f28636966e3af43a9d49d33555fbd22f04402c2ad37d1d8358e5e482f

SHA512
1db5f9b65c791d265a211ee8bd8f7a1dc6b1e10d286bcc9a8012090b043dc773b8f938959ec548fe9d389d109e5d8b1eae0c5539a86b7a8cc69180f9733eeef5

Download Submit
C:\Windows\system\PaAAUCG.exe

Filesize
1.6MB

MD5
1f7e8857389ca7b9e2af70effde68555

SHA1
c5b0eaefc17017773fd1cee01345be736644266b

SHA256
aef5db0fe2ee7538b72d1614fa3e4fe49d85d1cfc0a11d593089a10e2a583196

SHA512
dcd240369e12683f64e6dad08a354c2f9c34766f5341a0c045062f172d8873cbc283678613644b87bc1ced72f6157659abe5bedac20ca143f42240faac07434a

Download Submit
C:\Windows\system\RYljExA.exe

Filesize
1.6MB

MD5
1a8f7aa34b897d385707db1f951efc07

SHA1
5ef3a4b4c40754453eeead11c2a7237c71f122e8

SHA256
5529cc43c2917f4bb6a282ffce6058920b82d77331697c142f0d2410b66aeda1

SHA512
dfa090f52815353f945c2c1df78e25c0155da324deb6fa9919bf9bf3a1c6ffc209f7a99f2443eb0a4cd8d7cceb5f56188d0acdb90d9da4963cdae697894ee1c9

Download Submit
C:\Windows\system\UDXauPE.exe

Filesize
1.6MB

MD5
60b21eb00ad6423378e0cfc537e53a3c

SHA1
b2a670dbca2421d8d6a4133f2cdbd770dd8bee4b

SHA256
7066ef881ae420dcefeae17b6f2c26566c3436fb1a8b2799a775412da4363173

SHA512
2ebf0c32f5939b23af5a5eca0a921cd99599d29a01dd72bf05c378b42e308ff5467c4bd8ef31dc09262e675bf500fdfb26f4032e263d02fbbce8f7540fc79b01

Download Submit
C:\Windows\system\UvshtAj.exe

Filesize
1.6MB

MD5
e67bd2be2a85fa7688e82c658a8d542b

SHA1
9f8876fb30ac02db9fdf2527332604735a772fa5

SHA256
0bf23d6b28b4e8997bc10db44e2be1ed8b1170a93e2b0fbe87be72414b580833

SHA512
9aac2a7bdb93545b8a96a66f2402c9c4505f0f888d77aec2fcba55a61abd0742f4bda56360f89009bdece4a4ca75a93a6c8edcd26c2f915012f9477c8c7b4662

Download Submit
C:\Windows\system\VISiMlj.exe

Filesize
1.6MB

MD5
9f3a6609a52f582efe25f01096383974

SHA1
34d724ac2d2f8e16519b57a13d8b161bbee5c017

SHA256
e54f6e66ce5d14d48b5a16a1a4a99cc223c201dc65b95f7221ad6aa0042b8afc

SHA512
5c49aedcb2f25e1b8590dd4e2fef9db39643a118e93b02678449bc493c8161db25f8d942f67ea98e468b0febd75e80a1c9caa8e8a1bd394b70a686beb5e41626

Download Submit
C:\Windows\system\VJufQlB.exe

Filesize
1.6MB

MD5
c75ec5cc082c54625652126a8172c915

SHA1
558a0f18c48384b0ce5885a75e2c3ddccca830d8

SHA256
de3d5f50bb19aa13727fa37869135433c54d577484575812fc0db891bfc18368

SHA512
b1d1a73cc84a999fa5e5b87ec217a668a4fc7bc8e87e317e94bbbbad496237b8f4b37b7b9fe5a61cc673fc4283d1fcde99aed1502a0f05613f5f63ef38ced79b

Download Submit
C:\Windows\system\WeTtoEJ.exe

Filesize
1.6MB

MD5
e7431c84a3bd61737925f7e68fc9ea07

SHA1
287643759dace1e390707e0376f3863b7bb77799

SHA256
ae02fed77f8f5e06f2e5de7ce422fbd39a2e31c5ad34029e2968c923d9b222bc

SHA512
dc0a11f8f63fc3cd594ed50c2bc6c3dbb3db905a7c95c2a685af02727c4ad76b22d932161e52158a98c6f0706edbb9788221a34fa0a45af17cdbb7094ff73b3f

Download Submit
C:\Windows\system\YoLjWjA.exe

Filesize
1.6MB

MD5
dc5be3ebe85dda2b3eda47e3e61831bd

SHA1
f8c793e324cba9e4eb7dfcd4464a4c66e4479d40

SHA256
0642f3c4871c88de0bb1dbba8331895888dd6c79a4a9bfe1f20cef435ce2309e

SHA512
9780cc19391146ed6a510e303878756a0d4dcf0cef6b5e7ae16531b17ff68dd6d66659fc56a7fe4f82aa0a01c5427839427be6bec60c8d289d43ac1585f7204a

Download Submit
C:\Windows\system\aHyIpPW.exe

Filesize
1.6MB

MD5
0e8e24bf1ded020f239e3386e8750c51

SHA1
90125f701c5514f4f8c43877a55919f20c2795d8

SHA256
bc141eeb9aeb552cc957c0edc1a8f122aa7a57d258372364478fc6c4898c28e6

SHA512
87683c32be96497236d7c3144ba12369e19173f1f61d90324ff4a85f9a120d574c47dee718c2409fa1eda06f8fc5571a38ebbb200daa94e888c5711ae063a11d

Download Submit
C:\Windows\system\cuBbOPE.exe

Filesize
1.6MB

MD5
9cfe39d2e6ef57fc09e1defe28f201bc

SHA1
d4bb0080bca0fad5a02a182f7ca849af69ffff1b

SHA256
bb837a12a2b7712cf7795bd17b2cab809194c251cc8f9af2ac1f45c2fc2f1915

SHA512
a1ebc9715f0f3c940e17d8690ec8726459f9737d0596224ae1626686d64698f478f54db4691d16b8716bf240e31e78dd8c1881a0a074b678d055fb9b200ef372

Download Submit
C:\Windows\system\jErmdyY.exe

Filesize
1.6MB

MD5
475976079fdbec75f672148d37953586

SHA1
dae17ef1e75e55ec918fc4a845107f4e982e4aa8

SHA256
fbdfde69ef6a08cc478a0cf8266b56fca5c4f83bb9af7caae432ca7b4bd31e40

SHA512
1cf1f4e38d9327f548b8130c59045af3124e20e20e6b174a6da26aa9090cff5298635de45a3dea7621c948368052a8320b2244cc2a96d3d88c070cf6460a2586

Download Submit
C:\Windows\system\kUaGvlm.exe

Filesize
1.6MB

MD5
34c4a8176cdd09f05098590c847bcc2d

SHA1
99ffec2c92c2888c26ed9028696e9df5415b41ac

SHA256
3d1c70b9cb5125dee34e41577674ac33545a4ceee77660fec5ddd39ef26e807f

SHA512
6b238ef6205b99402ad8e598f6ae46cb705a9c1cc8299bf8516da48568c706ac4790de40fd727ed991c105aeaa482c197c8781d3a77bce553c6c89b776f2152d

Download Submit
C:\Windows\system\khoWLfT.exe

Filesize
1.6MB

MD5
8a7980f66739ea6a75584188d7260d8d

SHA1
8c3ada1619c26c3f2d2bf25e258e7aa6e55061ce

SHA256
44c3fa98985b39dcb9811d03a891e7be93942423f0dfe5df5b3cf62bc5a4f4a7

SHA512
13c812fd8912d79b5bf4c597298f69b4ec392319f9ffe00c4d69c84ec90692f1d99a233f8e3f6a96ded8e739da42956e130bd69fbc81aef68d8888444e180326

Download Submit
C:\Windows\system\moUjnGZ.exe

Filesize
1.6MB

MD5
be9bad37a81f91bfd003f38df922dca0

SHA1
57b6d94bcd62248fb9828165f0a3039009d7eed9

SHA256
335cb3361661c93fad6ea715c7dbf96296f863d64bd05402e863d409cff6d205

SHA512
29f9ec9003a09c0d69ab9d08ab99aa26cf392e3a0c065e3af74f196199fcf19aa54af153ea17ed6b4105e9596ef6f5684cfe74ad0812723f26e9a2faa6672490

Download Submit
C:\Windows\system\nxNhanl.exe

Filesize
1.6MB

MD5
3a65219789cecc3f90515da46da24a44

SHA1
bd68a6cd20be897bb2dcdba7c86a5975e60f52ee

SHA256
f847b5d44dc318090ef2dd1ee8b710d549fb7e58b2afe437db68b7c185623932

SHA512
2a63602aeb61f2867b5f65a2ceba9360bbb1e8b11cc19960dad34e48dc36b8c029906f18909b57333676a73cf6c50505f3e943ac36e6d4a79016e577c9cd15e1

Download Submit
C:\Windows\system\oRMcCYN.exe

Filesize
1.6MB

MD5
62cfe2152928c93c165f2ca3de014cc4

SHA1
1dd455b41dc78f53845a4b695f5ca49db98c3998

SHA256
3c263e67e2552b1e45b6f581b39e4b79b14a5b08bd8fa04c7e204144820b9bf9

SHA512
bf964672d95f1f62cab91dcd783d39558f4cf13dfb87094cbe24482062077e8436c93f4fb01ea7656d8c4f9d8ab164e20a5f54e8f3389bfeae29758488935652

Download Submit
C:\Windows\system\qYUJnrF.exe

Filesize
1.6MB

MD5
9b8be8dcc7f6192b543185ee416f389d

SHA1
a12b4fd4d7831bb8745df7e82c99f7ce734b6f22

SHA256
49976f1ba41d124d08835967c25496d4dc5e1f6f1d5329837ca4c08da0d34426

SHA512
00f137a9b9db84d7888d688b6d52a69161430ec83e96dbb0b278e9a332e74912059a4ca2e856e35596da9bd09e18e96d3c147e4b21eb063de8c2874aa516769e

Download Submit
C:\Windows\system\uGYrnQg.exe

Filesize
1.6MB

MD5
341d3a24c324cf83540ec81a64520937

SHA1
a823fd1ff4cdfcbd1df013e57824b96f6e2c5021

SHA256
164b78bd799a13eede263a4ded9945dae1866027bf07161197b0c7b09dedce12

SHA512
0cee4806a2570deb1d35e4a855a15cd247384399b873f052aeaaebc2a994b2491b5a0dbc9d4fb13f88ee5f3a23717097587704139a44fead23d2a136e78953e2

Download Submit
C:\Windows\system\xDgHpFT.exe

Filesize
1.6MB

MD5
019be745db71ac18c27cd46d958ec838

SHA1
708a5e3d3be962e2fddec8cd867d3d8dd50b3d6c

SHA256
97f7786ab1e12a2bf26eb08f10dba147e868a4f9e23657ca2eed9dedc5be0470

SHA512
d6015f5c80622aec673a4843dea5c89576c9e710a3c4df0c45ee17d6225dafb403fe23e4244a8e61fe225a3d75f9bebd7d2d1edae39e7c8e3965693daddd9b08

Download Submit
C:\Windows\system\yYkBWzY.exe

Filesize
1.6MB

MD5
3d316cb7d543c976d2eb23b06db4a84f

SHA1
ada6d2b267c2603a699e343e3c5559bcd577c752

SHA256
4567e9e8dd76798067db7aa59b1d6c9dff7d28ad45f3efaf975da4a7b913789c

SHA512
198cabca8aca5bf9ed83229f744f840f2162bfe52d1f6e75521cd1e1ddf358abbc888722c6c7c1285a8b57dae318cafb7b2b01b3012e2a79049be25da08bdf1d

Download Submit
C:\Windows\system\zZoyYhm.exe

Filesize
1.6MB

MD5
8e42fe29d79f4d731d234675a6f4c12f

SHA1
69c7dd7c2b4775b65d9e11aa9faaa2abdba56afe

SHA256
d7d1c9bae472592c974cf4aba6dffbc8eed888167f3a3eb1ce935c9fffb302ed

SHA512
b0cbd7684f9fbd59759772f78f127ed39f6a960aac604b7434c017093a1cc5e5caf513683a127e5d7b22b608c658833faca584bb805dcf3ca4c40549c205cf84

Download Submit
\Windows\system\RwVaFKf.exe

Filesize
1.6MB

MD5
2797b48f1cc193a0800bfc3fb7e1f9c6

SHA1
41723c0fa7c5fa2d815649deae61c284ee67100c

SHA256
8ac26c6ff41cac6d9ef9ecd20f541a0e598fa55f86796e55e1e7580ed6356a80

SHA512
ba887400b49d54bedc8f3887a75c4830a0802fec92c7c4e8ccc7580da168391a2c8a3777b62bf84165dbcd9d38b7d752cea81928a19a29548b16a94dddb368e2

Download Submit
\Windows\system\Znibhpc.exe

Filesize
1.6MB

MD5
bca88f1018cdb53726b3735b82933527

SHA1
280f7ba40aa26776cd1059dd95056deaf85eed32

SHA256
395d463874a4f2ff64d58129ba8b129906d2fb2282c48907d5e8d4dc32ecc89c

SHA512
e2b9ff885c19dcdc02dec4c89a882f1ee0709c11bf121369ff3c06cd43e65b24d1d1cd0de35ed49c7c8743d7ca33bc696ed1708d58d4052866650e1ef311a9c7

Download Submit
\Windows\system\focGped.exe

Filesize
1.6MB

MD5
caadc2b960bdd1512f1508f8fc3ea215

SHA1
50c0d5a75a09a8ecd716418f119b4cbd9ab8fd2a

SHA256
4c278c04e7bfd6f44f6d89ede8f479c9dbfb9389641ec12aeb0e67e7f3359641

SHA512
d4b5337354aafad7aee3d64ffa80b1056d292a269ddc6a193069bf277e826a2ab20cb520c26bf4c59638cb02d8b00cd4c32ca63f7aaddf36e4289a1d9dee780b

Download Submit
memory/2376-124-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2400-122-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2400-3678-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2448-126-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-3320-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2548-120-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2560-116-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2560-3088-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2712-118-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-114-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2792-128-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2860-461-0x000007FEF44F0000-0x000007FEF4E8D000-memory.dmp

Filesize
9.6MB

Download
memory/2860-241-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/2860-130-0x000007FEF44F0000-0x000007FEF4E8D000-memory.dmp

Filesize
9.6MB

Download
memory/2860-94-0x000000001B4F0000-0x000000001B7D2000-memory.dmp

Filesize
2.9MB

Download
memory/2860-112-0x0000000002530000-0x00000000025B0000-memory.dmp

Filesize
512KB

Download
memory/2860-111-0x0000000002530000-0x00000000025B0000-memory.dmp

Filesize
512KB

Download
memory/2860-110-0x000007FEF44F0000-0x000007FEF4E8D000-memory.dmp

Filesize
9.6MB

Download
memory/2900-1-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2900-4-0x00000000029B0000-0x0000000002DA2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-113-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-115-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-127-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2900-121-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2900-117-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-119-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-123-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-129-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-0-0x0000000000170000-0x0000000000180000-memory.dmp

Filesize
64KB

Download
memory/2900-125-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-9-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2944-3072-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download