xmrig | 12699238a279b14efc4aa3f1df29e0d6baf14670379ce2c391bd1451ad1c684c

Analysis

max time kernel
31s
max time network
30s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
Size

1.4MB
MD5

0bda63546ed8e2722779790a1a897bbd
SHA1

2d43842721f9668afcf8641afbe72c18b8e54b67
SHA256

12699238a279b14efc4aa3f1df29e0d6baf14670379ce2c391bd1451ad1c684c
SHA512

49602e6b3b4a6b500de6672c6aea897b5ce6da8271f5bea6eb72aa22402fe5e1ad2000fc5571fb8d2be476092776d3ff02d7f4140bcb1680e53fb8abd5bf27da
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/Vx+wp:Lz071uv4BPMkibTIA5CJQwp

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/1192-9-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2548-18-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2588-21-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2460-200-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2552-198-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2604-196-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2804-192-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	xmrig
behavioral1/memory/2764-190-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2836-188-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1192	ATKPwMe.exe
2548	QiMMvyD.exe
2588	ClOMbVZ.exe
2836	vLgYmcK.exe
2764	zQFoliZ.exe
2804	xpgJqjT.exe
2604	PHcZTLC.exe
2552	BxqwXEL.exe
2460	GhzCfpp.exe
2560	SoIDEpO.exe
2404	dfDEkGu.exe
628	QsJnTCw.exe
2528	ENticNg.exe
2676	jzMOirL.exe
2796	myhYVSx.exe
2820	kbBYUqg.exe
1432	cPotjsu.exe
1300	UmXIMOG.exe
884	mkCColT.exe
2224	huxSXIl.exe
1504	wZXtCkv.exe
640	eCVFvwn.exe
2668	ldBCeDL.exe
684	cPTylXR.exe
548	xUeilrY.exe
288	hrTEdFA.exe
2928	VodrMrL.exe
3056	aThvUum.exe
2868	xJEFVzl.exe
1096	KDLitdv.exe
2948	PPehdBi.exe
1016	vIZCmcl.exe
2848	SHHEthI.exe
1724	aoFiPhl.exe
992	RcBnIfg.exe
1864	YjoEihG.exe
3004	MxcGLLn.exe
1088	nPqqXWa.exe
2200	IzdIHPw.exe
1128	WWdphYj.exe
1756	VAVFOxu.exe
1248	ThvHcVP.exe
772	oHlhywP.exe
576	wrozRzU.exe
1956	wfGLVSw.exe
2088	JMStwxt.exe
2000	xMxGnqc.exe
1804	nTOCltD.exe
2412	VZTqlDP.exe
1700	PsImdZH.exe
2568	ENcGEub.exe
2476	FhLoxve.exe
1752	dllHPSg.exe
2188	NGOVFWk.exe
2776	PuwJIEs.exe
2508	NydmZqX.exe
2192	HCXtAwh.exe
1568	ENLqCLW.exe
2956	fNACqiR.exe
604	jheCHtZ.exe
1828	IgLAHtl.exe
3040	eCdGTzD.exe
1308	GUMHAjH.exe
1612	GeEoTjE.exe

Loads dropped DLL 64 IoCs

pid	Process
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1948-0-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/files/0x000b000000014b27-3.dat	upx
behavioral1/memory/1192-9-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/files/0x000800000001567f-19.dat	upx
behavioral1/memory/2548-18-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2588-21-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/files/0x0036000000015653-13.dat	upx
behavioral1/files/0x0007000000004e76-34.dat	upx
behavioral1/files/0x0006000000015eaf-52.dat	upx
behavioral1/files/0x0006000000015fe9-63.dat	upx
behavioral1/files/0x00060000000161e7-72.dat	upx
behavioral1/files/0x00060000000164b2-83.dat	upx
behavioral1/files/0x000600000001661c-93.dat	upx
behavioral1/files/0x0006000000016572-88.dat	upx
behavioral1/files/0x0006000000016c4a-108.dat	upx
behavioral1/files/0x0006000000016d26-140.dat	upx
behavioral1/files/0x0006000000016d90-153.dat	upx
behavioral1/files/0x0006000000016d3a-144.dat	upx
behavioral1/files/0x0006000000016e94-169.dat	upx
behavioral1/files/0x0006000000016dbb-162.dat	upx
behavioral1/files/0x0006000000016d1e-139.dat	upx
behavioral1/memory/2460-200-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2552-198-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2604-196-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/files/0x0006000000016ce4-128.dat	upx
behavioral1/memory/2804-192-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/memory/2764-190-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2836-188-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/files/0x0006000000016dbf-166.dat	upx
behavioral1/files/0x0006000000016da7-160.dat	upx
behavioral1/files/0x0006000000016d7e-151.dat	upx
behavioral1/files/0x0006000000016d0d-132.dat	upx
behavioral1/files/0x0006000000016cb7-123.dat	upx
behavioral1/files/0x0006000000016c6b-118.dat	upx
behavioral1/files/0x0006000000016c63-113.dat	upx
behavioral1/files/0x0006000000016843-98.dat	upx
behavioral1/files/0x0006000000016a9a-102.dat	upx
behavioral1/files/0x000600000001630b-78.dat	upx
behavioral1/files/0x0006000000016117-68.dat	upx
behavioral1/files/0x0006000000015f6d-59.dat	upx
behavioral1/files/0x0007000000015e3a-48.dat	upx
behavioral1/files/0x0008000000015cba-38.dat	upx
behavioral1/files/0x0009000000015ce1-43.dat	upx
behavioral1/files/0x0007000000015be6-29.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XvIWhwA.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\kdSTQUQ.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\CBIMLem.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\VZTqlDP.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\DQOVrTS.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\lAhRAkm.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\mLMGICu.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\AnVETvJ.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\eCVFvwn.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\MqBHfYn.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\sYnGVsw.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\lUveLvk.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\AhxuUXB.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\ATFqnzE.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\MtFVeqG.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\sYnqeVI.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\coqgWtN.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\nwewTGQ.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\NatYAjV.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\jMncWtG.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\gQnGYpD.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\cHELvpw.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\AwZEICj.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\GhzCfpp.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\blGnpvO.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\SfApbAG.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\PJqcnXh.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\ASZbOCI.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\hihyuOX.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\VfNcZKB.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\ZZOUiwI.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\PvqyqJh.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\KkYdUxh.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\UaDSdbL.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\LqtTbAT.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\bjYEKBU.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\ATKPwMe.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\Kwmyuup.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\BROiCgs.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\qCFRWzu.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\rKwcaKF.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\JbUuIfk.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\ZcvQOcP.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\opBobvL.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\EjgLRgZ.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\iCBPPgF.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\hBJWeeL.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\kaqyeSu.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\idgdfEC.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\IdQAOKd.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\uRelcuR.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\PlMAcWt.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\qiyfnEq.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\zeeaqIa.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\LmJdQRv.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\txswsTO.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\huxSXIl.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\hrTEdFA.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\YnnnEyX.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\myhYVSx.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\eyzaaXf.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\XtNJfho.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\giOvymy.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
File created	C:\Windows\System\oLAIgPm.exe	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1964	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeLockMemoryPrivilege	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1964	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	29
PID 1948 wrote to memory of 1964	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	29
PID 1948 wrote to memory of 1964	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	29
PID 1948 wrote to memory of 1192	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	30
PID 1948 wrote to memory of 1192	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	30
PID 1948 wrote to memory of 1192	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	30
PID 1948 wrote to memory of 2548	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	31
PID 1948 wrote to memory of 2548	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	31
PID 1948 wrote to memory of 2548	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	31
PID 1948 wrote to memory of 2588	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	32
PID 1948 wrote to memory of 2588	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	32
PID 1948 wrote to memory of 2588	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	32
PID 1948 wrote to memory of 2836	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	33
PID 1948 wrote to memory of 2836	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	33
PID 1948 wrote to memory of 2836	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	33
PID 1948 wrote to memory of 2764	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	34
PID 1948 wrote to memory of 2764	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	34
PID 1948 wrote to memory of 2764	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	34
PID 1948 wrote to memory of 2804	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	35
PID 1948 wrote to memory of 2804	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	35
PID 1948 wrote to memory of 2804	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	35
PID 1948 wrote to memory of 2604	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	36
PID 1948 wrote to memory of 2604	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	36
PID 1948 wrote to memory of 2604	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	36
PID 1948 wrote to memory of 2552	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	37
PID 1948 wrote to memory of 2552	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	37
PID 1948 wrote to memory of 2552	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	37
PID 1948 wrote to memory of 2460	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	38
PID 1948 wrote to memory of 2460	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	38
PID 1948 wrote to memory of 2460	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	38
PID 1948 wrote to memory of 2560	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	39
PID 1948 wrote to memory of 2560	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	39
PID 1948 wrote to memory of 2560	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	39
PID 1948 wrote to memory of 2404	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	40
PID 1948 wrote to memory of 2404	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	40
PID 1948 wrote to memory of 2404	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	40
PID 1948 wrote to memory of 628	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	41
PID 1948 wrote to memory of 628	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	41
PID 1948 wrote to memory of 628	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	41
PID 1948 wrote to memory of 2528	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	42
PID 1948 wrote to memory of 2528	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	42
PID 1948 wrote to memory of 2528	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	42
PID 1948 wrote to memory of 2676	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	43
PID 1948 wrote to memory of 2676	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	43
PID 1948 wrote to memory of 2676	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	43
PID 1948 wrote to memory of 2796	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	44
PID 1948 wrote to memory of 2796	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	44
PID 1948 wrote to memory of 2796	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	44
PID 1948 wrote to memory of 2820	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	45
PID 1948 wrote to memory of 2820	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	45
PID 1948 wrote to memory of 2820	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	45
PID 1948 wrote to memory of 1432	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	46
PID 1948 wrote to memory of 1432	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	46
PID 1948 wrote to memory of 1432	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	46
PID 1948 wrote to memory of 1300	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	47
PID 1948 wrote to memory of 1300	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	47
PID 1948 wrote to memory of 1300	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	47
PID 1948 wrote to memory of 884	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	48
PID 1948 wrote to memory of 884	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	48
PID 1948 wrote to memory of 884	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	48
PID 1948 wrote to memory of 2224	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	49
PID 1948 wrote to memory of 2224	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	49
PID 1948 wrote to memory of 2224	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	49
PID 1948 wrote to memory of 1504	1948	0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0bda63546ed8e2722779790a1a897bbd_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\System\ATKPwMe.exe
  C:\Windows\System\ATKPwMe.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\QiMMvyD.exe
  C:\Windows\System\QiMMvyD.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\ClOMbVZ.exe
  C:\Windows\System\ClOMbVZ.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\vLgYmcK.exe
  C:\Windows\System\vLgYmcK.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\zQFoliZ.exe
  C:\Windows\System\zQFoliZ.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\xpgJqjT.exe
  C:\Windows\System\xpgJqjT.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\PHcZTLC.exe
  C:\Windows\System\PHcZTLC.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\BxqwXEL.exe
  C:\Windows\System\BxqwXEL.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\GhzCfpp.exe
  C:\Windows\System\GhzCfpp.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\SoIDEpO.exe
  C:\Windows\System\SoIDEpO.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\dfDEkGu.exe
  C:\Windows\System\dfDEkGu.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\QsJnTCw.exe
  C:\Windows\System\QsJnTCw.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\ENticNg.exe
  C:\Windows\System\ENticNg.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\jzMOirL.exe
  C:\Windows\System\jzMOirL.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\myhYVSx.exe
  C:\Windows\System\myhYVSx.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\kbBYUqg.exe
  C:\Windows\System\kbBYUqg.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\cPotjsu.exe
  C:\Windows\System\cPotjsu.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\UmXIMOG.exe
  C:\Windows\System\UmXIMOG.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\mkCColT.exe
  C:\Windows\System\mkCColT.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\huxSXIl.exe
  C:\Windows\System\huxSXIl.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\wZXtCkv.exe
  C:\Windows\System\wZXtCkv.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\eCVFvwn.exe
  C:\Windows\System\eCVFvwn.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\ldBCeDL.exe
  C:\Windows\System\ldBCeDL.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\cPTylXR.exe
  C:\Windows\System\cPTylXR.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\xUeilrY.exe
  C:\Windows\System\xUeilrY.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\hrTEdFA.exe
  C:\Windows\System\hrTEdFA.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\VodrMrL.exe
  C:\Windows\System\VodrMrL.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\xJEFVzl.exe
  C:\Windows\System\xJEFVzl.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\aThvUum.exe
  C:\Windows\System\aThvUum.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\SHHEthI.exe
  C:\Windows\System\SHHEthI.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\KDLitdv.exe
  C:\Windows\System\KDLitdv.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\YjoEihG.exe
  C:\Windows\System\YjoEihG.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\PPehdBi.exe
  C:\Windows\System\PPehdBi.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\nPqqXWa.exe
  C:\Windows\System\nPqqXWa.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\vIZCmcl.exe
  C:\Windows\System\vIZCmcl.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\WWdphYj.exe
  C:\Windows\System\WWdphYj.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\aoFiPhl.exe
  C:\Windows\System\aoFiPhl.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\VAVFOxu.exe
  C:\Windows\System\VAVFOxu.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\RcBnIfg.exe
  C:\Windows\System\RcBnIfg.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\ThvHcVP.exe
  C:\Windows\System\ThvHcVP.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\MxcGLLn.exe
  C:\Windows\System\MxcGLLn.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\oHlhywP.exe
  C:\Windows\System\oHlhywP.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\IzdIHPw.exe
  C:\Windows\System\IzdIHPw.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\wrozRzU.exe
  C:\Windows\System\wrozRzU.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\wfGLVSw.exe
  C:\Windows\System\wfGLVSw.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\JMStwxt.exe
  C:\Windows\System\JMStwxt.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\xMxGnqc.exe
  C:\Windows\System\xMxGnqc.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\dllHPSg.exe
  C:\Windows\System\dllHPSg.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\nTOCltD.exe
  C:\Windows\System\nTOCltD.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\AMhpCEN.exe
  C:\Windows\System\AMhpCEN.exe
  2⤵
  PID:1940
- C:\Windows\System\VZTqlDP.exe
  C:\Windows\System\VZTqlDP.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\sPZqZOU.exe
  C:\Windows\System\sPZqZOU.exe
  2⤵
  PID:1596
- C:\Windows\System\PsImdZH.exe
  C:\Windows\System\PsImdZH.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\BqEzEPI.exe
  C:\Windows\System\BqEzEPI.exe
  2⤵
  PID:2624
- C:\Windows\System\ENcGEub.exe
  C:\Windows\System\ENcGEub.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\orZeAWJ.exe
  C:\Windows\System\orZeAWJ.exe
  2⤵
  PID:2580
- C:\Windows\System\FhLoxve.exe
  C:\Windows\System\FhLoxve.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\eHLjMpU.exe
  C:\Windows\System\eHLjMpU.exe
  2⤵
  PID:2504
- C:\Windows\System\NGOVFWk.exe
  C:\Windows\System\NGOVFWk.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\TZvUqGR.exe
  C:\Windows\System\TZvUqGR.exe
  2⤵
  PID:2436
- C:\Windows\System\PuwJIEs.exe
  C:\Windows\System\PuwJIEs.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\vanMxqL.exe
  C:\Windows\System\vanMxqL.exe
  2⤵
  PID:2484
- C:\Windows\System\NydmZqX.exe
  C:\Windows\System\NydmZqX.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\Cbhdasy.exe
  C:\Windows\System\Cbhdasy.exe
  2⤵
  PID:2784
- C:\Windows\System\HCXtAwh.exe
  C:\Windows\System\HCXtAwh.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\oTPlhjb.exe
  C:\Windows\System\oTPlhjb.exe
  2⤵
  PID:1668
- C:\Windows\System\ENLqCLW.exe
  C:\Windows\System\ENLqCLW.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\pUwDEbj.exe
  C:\Windows\System\pUwDEbj.exe
  2⤵
  PID:1600
- C:\Windows\System\fNACqiR.exe
  C:\Windows\System\fNACqiR.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\lNLHkyl.exe
  C:\Windows\System\lNLHkyl.exe
  2⤵
  PID:324
- C:\Windows\System\jheCHtZ.exe
  C:\Windows\System\jheCHtZ.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\jSQCfAm.exe
  C:\Windows\System\jSQCfAm.exe
  2⤵
  PID:2268
- C:\Windows\System\IgLAHtl.exe
  C:\Windows\System\IgLAHtl.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\OOJuarr.exe
  C:\Windows\System\OOJuarr.exe
  2⤵
  PID:456
- C:\Windows\System\eCdGTzD.exe
  C:\Windows\System\eCdGTzD.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\MgrAgay.exe
  C:\Windows\System\MgrAgay.exe
  2⤵
  PID:492
- C:\Windows\System\GUMHAjH.exe
  C:\Windows\System\GUMHAjH.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\kDhjjOf.exe
  C:\Windows\System\kDhjjOf.exe
  2⤵
  PID:2992
- C:\Windows\System\GeEoTjE.exe
  C:\Windows\System\GeEoTjE.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\DQOVrTS.exe
  C:\Windows\System\DQOVrTS.exe
  2⤵
  PID:3024
- C:\Windows\System\MUbKPjY.exe
  C:\Windows\System\MUbKPjY.exe
  2⤵
  PID:2028
- C:\Windows\System\wLOTgEp.exe
  C:\Windows\System\wLOTgEp.exe
  2⤵
  PID:1792
- C:\Windows\System\aeYBzmM.exe
  C:\Windows\System\aeYBzmM.exe
  2⤵
  PID:2488
- C:\Windows\System\aZIezso.exe
  C:\Windows\System\aZIezso.exe
  2⤵
  PID:2744
- C:\Windows\System\fCBhMHN.exe
  C:\Windows\System\fCBhMHN.exe
  2⤵
  PID:1780
- C:\Windows\System\qCFRWzu.exe
  C:\Windows\System\qCFRWzu.exe
  2⤵
  PID:2932
- C:\Windows\System\EYtYzin.exe
  C:\Windows\System\EYtYzin.exe
  2⤵
  PID:1996
- C:\Windows\System\WHizQgn.exe
  C:\Windows\System\WHizQgn.exe
  2⤵
  PID:1048
- C:\Windows\System\BMdzuYa.exe
  C:\Windows\System\BMdzuYa.exe
  2⤵
  PID:2092
- C:\Windows\System\iCBPPgF.exe
  C:\Windows\System\iCBPPgF.exe
  2⤵
  PID:2540
- C:\Windows\System\AUcFPVA.exe
  C:\Windows\System\AUcFPVA.exe
  2⤵
  PID:2900
- C:\Windows\System\XJgRfZd.exe
  C:\Windows\System\XJgRfZd.exe
  2⤵
  PID:1560
- C:\Windows\System\lOILTUx.exe
  C:\Windows\System\lOILTUx.exe
  2⤵
  PID:2812
- C:\Windows\System\pnesjFB.exe
  C:\Windows\System\pnesjFB.exe
  2⤵
  PID:2916
- C:\Windows\System\EsPsXNW.exe
  C:\Windows\System\EsPsXNW.exe
  2⤵
  PID:2004
- C:\Windows\System\ayhGTpd.exe
  C:\Windows\System\ayhGTpd.exe
  2⤵
  PID:1444
- C:\Windows\System\ryJGimf.exe
  C:\Windows\System\ryJGimf.exe
  2⤵
  PID:448
- C:\Windows\System\lCvnkWa.exe
  C:\Windows\System\lCvnkWa.exe
  2⤵
  PID:2276
- C:\Windows\System\PlMAcWt.exe
  C:\Windows\System\PlMAcWt.exe
  2⤵
  PID:2492
- C:\Windows\System\cgXrOkf.exe
  C:\Windows\System\cgXrOkf.exe
  2⤵
  PID:2332
- C:\Windows\System\ahBvpCy.exe
  C:\Windows\System\ahBvpCy.exe
  2⤵
  PID:2272
- C:\Windows\System\hBJWeeL.exe
  C:\Windows\System\hBJWeeL.exe
  2⤵
  PID:3088
- C:\Windows\System\gpTWYMg.exe
  C:\Windows\System\gpTWYMg.exe
  2⤵
  PID:3104
- C:\Windows\System\vXIdHFl.exe
  C:\Windows\System\vXIdHFl.exe
  2⤵
  PID:3120
- C:\Windows\System\RuolKzU.exe
  C:\Windows\System\RuolKzU.exe
  2⤵
  PID:3136
- C:\Windows\System\blGnpvO.exe
  C:\Windows\System\blGnpvO.exe
  2⤵
  PID:3152
- C:\Windows\System\imLocNn.exe
  C:\Windows\System\imLocNn.exe
  2⤵
  PID:3168
- C:\Windows\System\TdqBafn.exe
  C:\Windows\System\TdqBafn.exe
  2⤵
  PID:3184
- C:\Windows\System\MAoBgPP.exe
  C:\Windows\System\MAoBgPP.exe
  2⤵
  PID:3200
- C:\Windows\System\RyZolzx.exe
  C:\Windows\System\RyZolzx.exe
  2⤵
  PID:3216
- C:\Windows\System\SNpxroF.exe
  C:\Windows\System\SNpxroF.exe
  2⤵
  PID:3232
- C:\Windows\System\taMZqMe.exe
  C:\Windows\System\taMZqMe.exe
  2⤵
  PID:3248
- C:\Windows\System\EuvNumw.exe
  C:\Windows\System\EuvNumw.exe
  2⤵
  PID:3264
- C:\Windows\System\mTLtRhU.exe
  C:\Windows\System\mTLtRhU.exe
  2⤵
  PID:3280
- C:\Windows\System\oMkhsbM.exe
  C:\Windows\System\oMkhsbM.exe
  2⤵
  PID:3296
- C:\Windows\System\enSJnUC.exe
  C:\Windows\System\enSJnUC.exe
  2⤵
  PID:3312
- C:\Windows\System\PcSVxCe.exe
  C:\Windows\System\PcSVxCe.exe
  2⤵
  PID:3328
- C:\Windows\System\OXljwvx.exe
  C:\Windows\System\OXljwvx.exe
  2⤵
  PID:3344
- C:\Windows\System\VqAYSRw.exe
  C:\Windows\System\VqAYSRw.exe
  2⤵
  PID:3360
- C:\Windows\System\giOvymy.exe
  C:\Windows\System\giOvymy.exe
  2⤵
  PID:3376
- C:\Windows\System\gjmnpAY.exe
  C:\Windows\System\gjmnpAY.exe
  2⤵
  PID:3392
- C:\Windows\System\TuJILxL.exe
  C:\Windows\System\TuJILxL.exe
  2⤵
  PID:3408
- C:\Windows\System\rhlJAlP.exe
  C:\Windows\System\rhlJAlP.exe
  2⤵
  PID:3424
- C:\Windows\System\kgjthTN.exe
  C:\Windows\System\kgjthTN.exe
  2⤵
  PID:3440
- C:\Windows\System\PvqyqJh.exe
  C:\Windows\System\PvqyqJh.exe
  2⤵
  PID:3456
- C:\Windows\System\qFFmXqR.exe
  C:\Windows\System\qFFmXqR.exe
  2⤵
  PID:3472
- C:\Windows\System\kbqjBEM.exe
  C:\Windows\System\kbqjBEM.exe
  2⤵
  PID:3488
- C:\Windows\System\APvtsty.exe
  C:\Windows\System\APvtsty.exe
  2⤵
  PID:3504
- C:\Windows\System\oaYFkPI.exe
  C:\Windows\System\oaYFkPI.exe
  2⤵
  PID:3520
- C:\Windows\System\gQnGYpD.exe
  C:\Windows\System\gQnGYpD.exe
  2⤵
  PID:3536
- C:\Windows\System\idgdfEC.exe
  C:\Windows\System\idgdfEC.exe
  2⤵
  PID:3552
- C:\Windows\System\kDeBXct.exe
  C:\Windows\System\kDeBXct.exe
  2⤵
  PID:3568
- C:\Windows\System\XvIWhwA.exe
  C:\Windows\System\XvIWhwA.exe
  2⤵
  PID:3584
- C:\Windows\System\aXknfAp.exe
  C:\Windows\System\aXknfAp.exe
  2⤵
  PID:3600
- C:\Windows\System\JJDesOp.exe
  C:\Windows\System\JJDesOp.exe
  2⤵
  PID:3616
- C:\Windows\System\JqENWmY.exe
  C:\Windows\System\JqENWmY.exe
  2⤵
  PID:3632
- C:\Windows\System\jMncWtG.exe
  C:\Windows\System\jMncWtG.exe
  2⤵
  PID:3648
- C:\Windows\System\lUveLvk.exe
  C:\Windows\System\lUveLvk.exe
  2⤵
  PID:3664
- C:\Windows\System\zADEVus.exe
  C:\Windows\System\zADEVus.exe
  2⤵
  PID:3680
- C:\Windows\System\VpQnCCe.exe
  C:\Windows\System\VpQnCCe.exe
  2⤵
  PID:3696
- C:\Windows\System\BHwdCet.exe
  C:\Windows\System\BHwdCet.exe
  2⤵
  PID:3712
- C:\Windows\System\bRoHMIf.exe
  C:\Windows\System\bRoHMIf.exe
  2⤵
  PID:3728
- C:\Windows\System\thhypLg.exe
  C:\Windows\System\thhypLg.exe
  2⤵
  PID:3744
- C:\Windows\System\uIVpgxW.exe
  C:\Windows\System\uIVpgxW.exe
  2⤵
  PID:3760
- C:\Windows\System\nwewTGQ.exe
  C:\Windows\System\nwewTGQ.exe
  2⤵
  PID:3776
- C:\Windows\System\wcaECff.exe
  C:\Windows\System\wcaECff.exe
  2⤵
  PID:3792
- C:\Windows\System\KkYdUxh.exe
  C:\Windows\System\KkYdUxh.exe
  2⤵
  PID:3808
- C:\Windows\System\dFfgIkp.exe
  C:\Windows\System\dFfgIkp.exe
  2⤵
  PID:3824
- C:\Windows\System\eaIbQNC.exe
  C:\Windows\System\eaIbQNC.exe
  2⤵
  PID:3840
- C:\Windows\System\VXdwMdO.exe
  C:\Windows\System\VXdwMdO.exe
  2⤵
  PID:3856
- C:\Windows\System\QExHYoF.exe
  C:\Windows\System\QExHYoF.exe
  2⤵
  PID:3872
- C:\Windows\System\MneGlyv.exe
  C:\Windows\System\MneGlyv.exe
  2⤵
  PID:3888
- C:\Windows\System\XAjXOtQ.exe
  C:\Windows\System\XAjXOtQ.exe
  2⤵
  PID:3904
- C:\Windows\System\vwYPjRO.exe
  C:\Windows\System\vwYPjRO.exe
  2⤵
  PID:3920
- C:\Windows\System\WeoIMlF.exe
  C:\Windows\System\WeoIMlF.exe
  2⤵
  PID:3936
- C:\Windows\System\rKwcaKF.exe
  C:\Windows\System\rKwcaKF.exe
  2⤵
  PID:3952
- C:\Windows\System\PZJIgsC.exe
  C:\Windows\System\PZJIgsC.exe
  2⤵
  PID:3968
- C:\Windows\System\CZIbBkj.exe
  C:\Windows\System\CZIbBkj.exe
  2⤵
  PID:3984
- C:\Windows\System\YdCtJZe.exe
  C:\Windows\System\YdCtJZe.exe
  2⤵
  PID:4000
- C:\Windows\System\kBTdljz.exe
  C:\Windows\System\kBTdljz.exe
  2⤵
  PID:4016
- C:\Windows\System\JbUuIfk.exe
  C:\Windows\System\JbUuIfk.exe
  2⤵
  PID:4032
- C:\Windows\System\LNaQmwd.exe
  C:\Windows\System\LNaQmwd.exe
  2⤵
  PID:4048
- C:\Windows\System\cHELvpw.exe
  C:\Windows\System\cHELvpw.exe
  2⤵
  PID:4064
- C:\Windows\System\ZcvQOcP.exe
  C:\Windows\System\ZcvQOcP.exe
  2⤵
  PID:4080
- C:\Windows\System\CjlRJge.exe
  C:\Windows\System\CjlRJge.exe
  2⤵
  PID:2800
- C:\Windows\System\LogCSKq.exe
  C:\Windows\System\LogCSKq.exe
  2⤵
  PID:3084
- C:\Windows\System\pTbHlKc.exe
  C:\Windows\System\pTbHlKc.exe
  2⤵
  PID:3148
- C:\Windows\System\zZOBxNe.exe
  C:\Windows\System\zZOBxNe.exe
  2⤵
  PID:3212
- C:\Windows\System\TyTOOrt.exe
  C:\Windows\System\TyTOOrt.exe
  2⤵
  PID:3276
- C:\Windows\System\fXhJfvk.exe
  C:\Windows\System\fXhJfvk.exe
  2⤵
  PID:3340
- C:\Windows\System\HDmBKdR.exe
  C:\Windows\System\HDmBKdR.exe
  2⤵
  PID:3404
- C:\Windows\System\fNGOArP.exe
  C:\Windows\System\fNGOArP.exe
  2⤵
  PID:3468
- C:\Windows\System\BtnAKpV.exe
  C:\Windows\System\BtnAKpV.exe
  2⤵
  PID:3532
- C:\Windows\System\SqMoexK.exe
  C:\Windows\System\SqMoexK.exe
  2⤵
  PID:3596
- C:\Windows\System\yRcXgqQ.exe
  C:\Windows\System\yRcXgqQ.exe
  2⤵
  PID:3660
- C:\Windows\System\QSrBlnA.exe
  C:\Windows\System\QSrBlnA.exe
  2⤵
  PID:3724
- C:\Windows\System\wyPHgfG.exe
  C:\Windows\System\wyPHgfG.exe
  2⤵
  PID:3788
- C:\Windows\System\kaqyeSu.exe
  C:\Windows\System\kaqyeSu.exe
  2⤵
  PID:3852
- C:\Windows\System\ecuVwwZ.exe
  C:\Windows\System\ecuVwwZ.exe
  2⤵
  PID:3916
- C:\Windows\System\SwqnmRJ.exe
  C:\Windows\System\SwqnmRJ.exe
  2⤵
  PID:3980
- C:\Windows\System\exKUqAY.exe
  C:\Windows\System\exKUqAY.exe
  2⤵
  PID:4044
- C:\Windows\System\CtHdFAI.exe
  C:\Windows\System\CtHdFAI.exe
  2⤵
  PID:3080
- C:\Windows\System\RyLFzbu.exe
  C:\Windows\System\RyLFzbu.exe
  2⤵
  PID:3336
- C:\Windows\System\jLFmqnO.exe
  C:\Windows\System\jLFmqnO.exe
  2⤵
  PID:3436
- C:\Windows\System\pTksWYT.exe
  C:\Windows\System\pTksWYT.exe
  2⤵
  PID:2592
- C:\Windows\System\AhxuUXB.exe
  C:\Windows\System\AhxuUXB.exe
  2⤵
  PID:3848
- C:\Windows\System\Kwmyuup.exe
  C:\Windows\System\Kwmyuup.exe
  2⤵
  PID:4112
- C:\Windows\System\vEmJMAS.exe
  C:\Windows\System\vEmJMAS.exe
  2⤵
  PID:4128
- C:\Windows\System\owxPuAW.exe
  C:\Windows\System\owxPuAW.exe
  2⤵
  PID:4144
- C:\Windows\System\qynOhVv.exe
  C:\Windows\System\qynOhVv.exe
  2⤵
  PID:4160
- C:\Windows\System\RmvrJmb.exe
  C:\Windows\System\RmvrJmb.exe
  2⤵
  PID:4176
- C:\Windows\System\qiyfnEq.exe
  C:\Windows\System\qiyfnEq.exe
  2⤵
  PID:4192
- C:\Windows\System\rfkIAac.exe
  C:\Windows\System\rfkIAac.exe
  2⤵
  PID:4208
- C:\Windows\System\IdQAOKd.exe
  C:\Windows\System\IdQAOKd.exe
  2⤵
  PID:4224
- C:\Windows\System\coqgWtN.exe
  C:\Windows\System\coqgWtN.exe
  2⤵
  PID:4240
- C:\Windows\System\ibcVdyp.exe
  C:\Windows\System\ibcVdyp.exe
  2⤵
  PID:4256
- C:\Windows\System\cAlRWbC.exe
  C:\Windows\System\cAlRWbC.exe
  2⤵
  PID:4272
- C:\Windows\System\hzFuxHy.exe
  C:\Windows\System\hzFuxHy.exe
  2⤵
  PID:4288
- C:\Windows\System\lbvxMnq.exe
  C:\Windows\System\lbvxMnq.exe
  2⤵
  PID:4304
- C:\Windows\System\npBhTSU.exe
  C:\Windows\System\npBhTSU.exe
  2⤵
  PID:4320
- C:\Windows\System\YqdvykJ.exe
  C:\Windows\System\YqdvykJ.exe
  2⤵
  PID:4336
- C:\Windows\System\BROiCgs.exe
  C:\Windows\System\BROiCgs.exe
  2⤵
  PID:4352
- C:\Windows\System\RJbPAiH.exe
  C:\Windows\System\RJbPAiH.exe
  2⤵
  PID:4368
- C:\Windows\System\hnohEOX.exe
  C:\Windows\System\hnohEOX.exe
  2⤵
  PID:4384
- C:\Windows\System\opBobvL.exe
  C:\Windows\System\opBobvL.exe
  2⤵
  PID:4400
- C:\Windows\System\DAmlVux.exe
  C:\Windows\System\DAmlVux.exe
  2⤵
  PID:4416
- C:\Windows\System\uBOjXfV.exe
  C:\Windows\System\uBOjXfV.exe
  2⤵
  PID:4432
- C:\Windows\System\tktXDxt.exe
  C:\Windows\System\tktXDxt.exe
  2⤵
  PID:4448
- C:\Windows\System\PxTGHFJ.exe
  C:\Windows\System\PxTGHFJ.exe
  2⤵
  PID:4464
- C:\Windows\System\pFkFWjA.exe
  C:\Windows\System\pFkFWjA.exe
  2⤵
  PID:4480
- C:\Windows\System\XtNJfho.exe
  C:\Windows\System\XtNJfho.exe
  2⤵
  PID:4496
- C:\Windows\System\SbUpJrC.exe
  C:\Windows\System\SbUpJrC.exe
  2⤵
  PID:5052
- C:\Windows\System\SfApbAG.exe
  C:\Windows\System\SfApbAG.exe
  2⤵
  PID:4412
- C:\Windows\System\eyzaaXf.exe
  C:\Windows\System\eyzaaXf.exe
  2⤵
  PID:4476
- C:\Windows\System\PCsKySj.exe
  C:\Windows\System\PCsKySj.exe
  2⤵
  PID:2424
- C:\Windows\System\iKbwkuj.exe
  C:\Windows\System\iKbwkuj.exe
  2⤵
  PID:968
- C:\Windows\System\THoGfNI.exe
  C:\Windows\System\THoGfNI.exe
  2⤵
  PID:1876
- C:\Windows\System\EjgLRgZ.exe
  C:\Windows\System\EjgLRgZ.exe
  2⤵
  PID:4508
- C:\Windows\System\pRBvbLM.exe
  C:\Windows\System\pRBvbLM.exe
  2⤵
  PID:2120
- C:\Windows\System\dNKupCr.exe
  C:\Windows\System\dNKupCr.exe
  2⤵
  PID:1880
- C:\Windows\System\WLmKzJG.exe
  C:\Windows\System\WLmKzJG.exe
  2⤵
  PID:1764
- C:\Windows\System\FoJNIDu.exe
  C:\Windows\System\FoJNIDu.exe
  2⤵
  PID:1588
- C:\Windows\System\uNxEEZj.exe
  C:\Windows\System\uNxEEZj.exe
  2⤵
  PID:1540
- C:\Windows\System\qEDdSfB.exe
  C:\Windows\System\qEDdSfB.exe
  2⤵
  PID:2068
- C:\Windows\System\JJtYiLb.exe
  C:\Windows\System\JJtYiLb.exe
  2⤵
  PID:716
- C:\Windows\System\ZYtCLHX.exe
  C:\Windows\System\ZYtCLHX.exe
  2⤵
  PID:2700
- C:\Windows\System\IUFrNNT.exe
  C:\Windows\System\IUFrNNT.exe
  2⤵
  PID:2100
- C:\Windows\System\PJqcnXh.exe
  C:\Windows\System\PJqcnXh.exe
  2⤵
  PID:1500
- C:\Windows\System\vkaHLxa.exe
  C:\Windows\System\vkaHLxa.exe
  2⤵
  PID:4536
- C:\Windows\System\PwzUzGB.exe
  C:\Windows\System\PwzUzGB.exe
  2⤵
  PID:4548
- C:\Windows\System\VcfHBTK.exe
  C:\Windows\System\VcfHBTK.exe
  2⤵
  PID:4564
- C:\Windows\System\rStdgcS.exe
  C:\Windows\System\rStdgcS.exe
  2⤵
  PID:4580
- C:\Windows\System\ASZbOCI.exe
  C:\Windows\System\ASZbOCI.exe
  2⤵
  PID:4596
- C:\Windows\System\IYITXRi.exe
  C:\Windows\System\IYITXRi.exe
  2⤵
  PID:4612
- C:\Windows\System\RxmjeKa.exe
  C:\Windows\System\RxmjeKa.exe
  2⤵
  PID:4628
- C:\Windows\System\SulpSzY.exe
  C:\Windows\System\SulpSzY.exe
  2⤵
  PID:4644
- C:\Windows\System\yZTvltX.exe
  C:\Windows\System\yZTvltX.exe
  2⤵
  PID:4660
- C:\Windows\System\GIqUIHU.exe
  C:\Windows\System\GIqUIHU.exe
  2⤵
  PID:4676
- C:\Windows\System\kdSTQUQ.exe
  C:\Windows\System\kdSTQUQ.exe
  2⤵
  PID:4692
- C:\Windows\System\bxIoVId.exe
  C:\Windows\System\bxIoVId.exe
  2⤵
  PID:4712
- C:\Windows\System\lUqwuAV.exe
  C:\Windows\System\lUqwuAV.exe
  2⤵
  PID:4728
- C:\Windows\System\qZWgdin.exe
  C:\Windows\System\qZWgdin.exe
  2⤵
  PID:4744
- C:\Windows\System\ATFqnzE.exe
  C:\Windows\System\ATFqnzE.exe
  2⤵
  PID:4780
- C:\Windows\System\hfhvMCV.exe
  C:\Windows\System\hfhvMCV.exe
  2⤵
  PID:4776
- C:\Windows\System\mgWpWsS.exe
  C:\Windows\System\mgWpWsS.exe
  2⤵
  PID:4796
- C:\Windows\System\oNXORIf.exe
  C:\Windows\System\oNXORIf.exe
  2⤵
  PID:4812
- C:\Windows\System\XGyZxZd.exe
  C:\Windows\System\XGyZxZd.exe
  2⤵
  PID:4828
- C:\Windows\System\bhUBMGN.exe
  C:\Windows\System\bhUBMGN.exe
  2⤵
  PID:4844
- C:\Windows\System\UcxADEX.exe
  C:\Windows\System\UcxADEX.exe
  2⤵
  PID:1920
- C:\Windows\System\xDWxfzO.exe
  C:\Windows\System\xDWxfzO.exe
  2⤵
  PID:4864
- C:\Windows\System\keEvGcu.exe
  C:\Windows\System\keEvGcu.exe
  2⤵
  PID:4880
- C:\Windows\System\MFQobgB.exe
  C:\Windows\System\MFQobgB.exe
  2⤵
  PID:4900
- C:\Windows\System\lAhRAkm.exe
  C:\Windows\System\lAhRAkm.exe
  2⤵
  PID:4908
- C:\Windows\System\ccIlYPj.exe
  C:\Windows\System\ccIlYPj.exe
  2⤵
  PID:4924
- C:\Windows\System\UaDSdbL.exe
  C:\Windows\System\UaDSdbL.exe
  2⤵
  PID:4940
- C:\Windows\System\JUSodoQ.exe
  C:\Windows\System\JUSodoQ.exe
  2⤵
  PID:4952
- C:\Windows\System\AOfRkoS.exe
  C:\Windows\System\AOfRkoS.exe
  2⤵
  PID:4968
- C:\Windows\System\ZaeXiPb.exe
  C:\Windows\System\ZaeXiPb.exe
  2⤵
  PID:4984
- C:\Windows\System\rTGInZj.exe
  C:\Windows\System\rTGInZj.exe
  2⤵
  PID:2756
- C:\Windows\System\NatYAjV.exe
  C:\Windows\System\NatYAjV.exe
  2⤵
  PID:2468
- C:\Windows\System\UhPihZD.exe
  C:\Windows\System\UhPihZD.exe
  2⤵
  PID:2056
- C:\Windows\System\OQBAggQ.exe
  C:\Windows\System\OQBAggQ.exe
  2⤵
  PID:4088
- C:\Windows\System\gmCuRIM.exe
  C:\Windows\System\gmCuRIM.exe
  2⤵
  PID:1616
- C:\Windows\System\pFyRZjA.exe
  C:\Windows\System\pFyRZjA.exe
  2⤵
  PID:672
- C:\Windows\System\gaHhyTk.exe
  C:\Windows\System\gaHhyTk.exe
  2⤵
  PID:2440
- C:\Windows\System\yyeLPbj.exe
  C:\Windows\System\yyeLPbj.exe
  2⤵
  PID:504
- C:\Windows\System\PKgvBwG.exe
  C:\Windows\System\PKgvBwG.exe
  2⤵
  PID:1824
- C:\Windows\System\fHfdOZo.exe
  C:\Windows\System\fHfdOZo.exe
  2⤵
  PID:3132
- C:\Windows\System\LYvTxmg.exe
  C:\Windows\System\LYvTxmg.exe
  2⤵
  PID:3256
- C:\Windows\System\isgGKso.exe
  C:\Windows\System\isgGKso.exe
  2⤵
  PID:3320
- C:\Windows\System\hihyuOX.exe
  C:\Windows\System\hihyuOX.exe
  2⤵
  PID:3384
- C:\Windows\System\tbuBJnw.exe
  C:\Windows\System\tbuBJnw.exe
  2⤵
  PID:3448
- C:\Windows\System\WDcKTnW.exe
  C:\Windows\System\WDcKTnW.exe
  2⤵
  PID:3512
- C:\Windows\System\hZWHcGd.exe
  C:\Windows\System\hZWHcGd.exe
  2⤵
  PID:3576
- C:\Windows\System\nWfulvX.exe
  C:\Windows\System\nWfulvX.exe
  2⤵
  PID:3640
- C:\Windows\System\VfNcZKB.exe
  C:\Windows\System\VfNcZKB.exe
  2⤵
  PID:3704
- C:\Windows\System\ZeVjLsc.exe
  C:\Windows\System\ZeVjLsc.exe
  2⤵
  PID:3768
- C:\Windows\System\JHFONVV.exe
  C:\Windows\System\JHFONVV.exe
  2⤵
  PID:3832
- C:\Windows\System\MqBHfYn.exe
  C:\Windows\System\MqBHfYn.exe
  2⤵
  PID:3896
- C:\Windows\System\MmZsCcR.exe
  C:\Windows\System\MmZsCcR.exe
  2⤵
  PID:3960
- C:\Windows\System\tbNngpg.exe
  C:\Windows\System\tbNngpg.exe
  2⤵
  PID:4056
- C:\Windows\System\ZZOUiwI.exe
  C:\Windows\System\ZZOUiwI.exe
  2⤵
  PID:3144
- C:\Windows\System\YnnnEyX.exe
  C:\Windows\System\YnnnEyX.exe
  2⤵
  PID:3400
- C:\Windows\System\JJsioiS.exe
  C:\Windows\System\JJsioiS.exe
  2⤵
  PID:3656
- C:\Windows\System\NllhkES.exe
  C:\Windows\System\NllhkES.exe
  2⤵
  PID:3912
- C:\Windows\System\LxmOaRW.exe
  C:\Windows\System\LxmOaRW.exe
  2⤵
  PID:3308
- C:\Windows\System\zeeaqIa.exe
  C:\Windows\System\zeeaqIa.exe
  2⤵
  PID:4136
- C:\Windows\System\ZWbFtUd.exe
  C:\Windows\System\ZWbFtUd.exe
  2⤵
  PID:4204
- C:\Windows\System\LtKNMof.exe
  C:\Windows\System\LtKNMof.exe
  2⤵
  PID:4268
- C:\Windows\System\kaeleoR.exe
  C:\Windows\System\kaeleoR.exe
  2⤵
  PID:4360
- C:\Windows\System\htDHpEZ.exe
  C:\Windows\System\htDHpEZ.exe
  2⤵
  PID:4424
- C:\Windows\System\QEIOkeY.exe
  C:\Windows\System\QEIOkeY.exe
  2⤵
  PID:4488
- C:\Windows\System\UQhaTPl.exe
  C:\Windows\System\UQhaTPl.exe
  2⤵
  PID:5060
- C:\Windows\System\OmodEaG.exe
  C:\Windows\System\OmodEaG.exe
  2⤵
  PID:5076
- C:\Windows\System\iuhWOjx.exe
  C:\Windows\System\iuhWOjx.exe
  2⤵
  PID:1620
- C:\Windows\System\TzttCkG.exe
  C:\Windows\System\TzttCkG.exe
  2⤵
  PID:2124
- C:\Windows\System\ClGxyRI.exe
  C:\Windows\System\ClGxyRI.exe
  2⤵
  PID:5084
- C:\Windows\System\MJNSdBG.exe
  C:\Windows\System\MJNSdBG.exe
  2⤵
  PID:5100
- C:\Windows\System\LqgwhVL.exe
  C:\Windows\System\LqgwhVL.exe
  2⤵
  PID:5116
- C:\Windows\System\ftILYuf.exe
  C:\Windows\System\ftILYuf.exe
  2⤵
  PID:1732
- C:\Windows\System\CxASjyr.exe
  C:\Windows\System\CxASjyr.exe
  2⤵
  PID:3820
- C:\Windows\System\sYnGVsw.exe
  C:\Windows\System\sYnGVsw.exe
  2⤵
  PID:4156
- C:\Windows\System\ckzdENU.exe
  C:\Windows\System\ckzdENU.exe
  2⤵
  PID:348
- C:\Windows\System\WJRlvml.exe
  C:\Windows\System\WJRlvml.exe
  2⤵
  PID:2036
- C:\Windows\System\lPRQgst.exe
  C:\Windows\System\lPRQgst.exe
  2⤵
  PID:2996
- C:\Windows\System\tDXabrT.exe
  C:\Windows\System\tDXabrT.exe
  2⤵
  PID:4576
- C:\Windows\System\LqtTbAT.exe
  C:\Windows\System\LqtTbAT.exe
  2⤵
  PID:4640
- C:\Windows\System\FPfavDu.exe
  C:\Windows\System\FPfavDu.exe
  2⤵
  PID:4704
- C:\Windows\System\VIElIBS.exe
  C:\Windows\System\VIElIBS.exe
  2⤵
  PID:1604
- C:\Windows\System\QKWyeHQ.exe
  C:\Windows\System\QKWyeHQ.exe
  2⤵
  PID:4736
- C:\Windows\System\XhHzCKF.exe
  C:\Windows\System\XhHzCKF.exe
  2⤵
  PID:4772
- C:\Windows\System\sWtRMmj.exe
  C:\Windows\System\sWtRMmj.exe
  2⤵
  PID:4840
- C:\Windows\System\xvtXTsU.exe
  C:\Windows\System\xvtXTsU.exe
  2⤵
  PID:4892
- C:\Windows\System\TZwchQG.exe
  C:\Windows\System\TZwchQG.exe
  2⤵
  PID:3164
- C:\Windows\System\nketIkC.exe
  C:\Windows\System\nketIkC.exe
  2⤵
  PID:4380
- C:\Windows\System\cdqOacw.exe
  C:\Windows\System\cdqOacw.exe
  2⤵
  PID:336
- C:\Windows\System\mjWMglt.exe
  C:\Windows\System\mjWMglt.exe
  2⤵
  PID:4872
- C:\Windows\System\tAkbKVo.exe
  C:\Windows\System\tAkbKVo.exe
  2⤵
  PID:4820
- C:\Windows\System\KgGUqtM.exe
  C:\Windows\System\KgGUqtM.exe
  2⤵
  PID:5020
- C:\Windows\System\XejnJOO.exe
  C:\Windows\System\XejnJOO.exe
  2⤵
  PID:1928
- C:\Windows\System\fPhOgSE.exe
  C:\Windows\System\fPhOgSE.exe
  2⤵
  PID:2260
- C:\Windows\System\ZmSScbo.exe
  C:\Windows\System\ZmSScbo.exe
  2⤵
  PID:2884
- C:\Windows\System\uufQWiI.exe
  C:\Windows\System\uufQWiI.exe
  2⤵
  PID:2172
- C:\Windows\System\LJtJTwG.exe
  C:\Windows\System\LJtJTwG.exe
  2⤵
  PID:4588
- C:\Windows\System\dCeXmvX.exe
  C:\Windows\System\dCeXmvX.exe
  2⤵
  PID:4656
- C:\Windows\System\KvEwGaT.exe
  C:\Windows\System\KvEwGaT.exe
  2⤵
  PID:4724
- C:\Windows\System\cnIqRQs.exe
  C:\Windows\System\cnIqRQs.exe
  2⤵
  PID:4960
- C:\Windows\System\DftaOuP.exe
  C:\Windows\System\DftaOuP.exe
  2⤵
  PID:4992
- C:\Windows\System\eTQlmWd.exe
  C:\Windows\System\eTQlmWd.exe
  2⤵
  PID:5012
- C:\Windows\System\WLMZWvN.exe
  C:\Windows\System\WLMZWvN.exe
  2⤵
  PID:5040
- C:\Windows\System\tnunpng.exe
  C:\Windows\System\tnunpng.exe
  2⤵
  PID:4760
- C:\Windows\System\DNpoYEH.exe
  C:\Windows\System\DNpoYEH.exe
  2⤵
  PID:2452
- C:\Windows\System\tlbbueQ.exe
  C:\Windows\System\tlbbueQ.exe
  2⤵
  PID:2052
- C:\Windows\System\IiVNQVE.exe
  C:\Windows\System\IiVNQVE.exe
  2⤵
  PID:1692
- C:\Windows\System\iSgYQBb.exe
  C:\Windows\System\iSgYQBb.exe
  2⤵
  PID:2496
- C:\Windows\System\UKpEEiN.exe
  C:\Windows\System\UKpEEiN.exe
  2⤵
  PID:4028
- C:\Windows\System\DzMFPFd.exe
  C:\Windows\System\DzMFPFd.exe
  2⤵
  PID:2648
- C:\Windows\System\SpuVFWR.exe
  C:\Windows\System\SpuVFWR.exe
  2⤵
  PID:1536
- C:\Windows\System\UmqExXF.exe
  C:\Windows\System\UmqExXF.exe
  2⤵
  PID:2788
- C:\Windows\System\zstHKdl.exe
  C:\Windows\System\zstHKdl.exe
  2⤵
  PID:2392
- C:\Windows\System\pGUXSWm.exe
  C:\Windows\System\pGUXSWm.exe
  2⤵
  PID:544
- C:\Windows\System\uRelcuR.exe
  C:\Windows\System\uRelcuR.exe
  2⤵
  PID:2852
- C:\Windows\System\XjeCVtj.exe
  C:\Windows\System\XjeCVtj.exe
  2⤵
  PID:840
- C:\Windows\System\SAMUJvP.exe
  C:\Windows\System\SAMUJvP.exe
  2⤵
  PID:2524
- C:\Windows\System\pQoLdZi.exe
  C:\Windows\System\pQoLdZi.exe
  2⤵
  PID:2752
- C:\Windows\System\mLMGICu.exe
  C:\Windows\System\mLMGICu.exe
  2⤵
  PID:1960
- C:\Windows\System\HZSHPPc.exe
  C:\Windows\System\HZSHPPc.exe
  2⤵
  PID:1408
- C:\Windows\System\AwZEICj.exe
  C:\Windows\System\AwZEICj.exe
  2⤵
  PID:1292
- C:\Windows\System\wjBAYwh.exe
  C:\Windows\System\wjBAYwh.exe
  2⤵
  PID:3352
- C:\Windows\System\zIBdErH.exe
  C:\Windows\System\zIBdErH.exe
  2⤵
  PID:3736
- C:\Windows\System\uUnThnN.exe
  C:\Windows\System\uUnThnN.exe
  2⤵
  PID:3992
- C:\Windows\System\HMJWuyw.exe
  C:\Windows\System\HMJWuyw.exe
  2⤵
  PID:3224
- C:\Windows\System\AnVETvJ.exe
  C:\Windows\System\AnVETvJ.exe
  2⤵
  PID:4108
- C:\Windows\System\GYkVDud.exe
  C:\Windows\System\GYkVDud.exe
  2⤵
  PID:4396
- C:\Windows\System\dVyAsMi.exe
  C:\Windows\System\dVyAsMi.exe
  2⤵
  PID:4444
- C:\Windows\System\ftaXBYY.exe
  C:\Windows\System\ftaXBYY.exe
  2⤵
  PID:5112
- C:\Windows\System\MtFVeqG.exe
  C:\Windows\System\MtFVeqG.exe
  2⤵
  PID:2732
- C:\Windows\System\LmJdQRv.exe
  C:\Windows\System\LmJdQRv.exe
  2⤵
  PID:4636
- C:\Windows\System\mZbLbDJ.exe
  C:\Windows\System\mZbLbDJ.exe
  2⤵
  PID:2076
- C:\Windows\System\sYnqeVI.exe
  C:\Windows\System\sYnqeVI.exe
  2⤵
  PID:4408
- C:\Windows\System\PJXvKvR.exe
  C:\Windows\System\PJXvKvR.exe
  2⤵
  PID:4976
- C:\Windows\System\MBXOhui.exe
  C:\Windows\System\MBXOhui.exe
  2⤵
  PID:5000
- C:\Windows\System\NWffmBW.exe
  C:\Windows\System\NWffmBW.exe
  2⤵
  PID:4980
- C:\Windows\System\WOyTnoG.exe
  C:\Windows\System\WOyTnoG.exe
  2⤵
  PID:4788
- C:\Windows\System\TYiSjtW.exe
  C:\Windows\System\TYiSjtW.exe
  2⤵
  PID:5008
- C:\Windows\System\kZEzWdA.exe
  C:\Windows\System\kZEzWdA.exe
  2⤵
  PID:4456
- C:\Windows\System\uMcrFmS.exe
  C:\Windows\System\uMcrFmS.exe
  2⤵
  PID:5096
- C:\Windows\System\KokqwSk.exe
  C:\Windows\System\KokqwSk.exe
  2⤵
  PID:4152
- C:\Windows\System\DMuOrnP.exe
  C:\Windows\System\DMuOrnP.exe
  2⤵
  PID:3416
- C:\Windows\System\jNyAOiq.exe
  C:\Windows\System\jNyAOiq.exe
  2⤵
  PID:3128
- C:\Windows\System\GMzpyiY.exe
  C:\Windows\System\GMzpyiY.exe
  2⤵
  PID:4560
- C:\Windows\System\vFZbWvo.exe
  C:\Windows\System\vFZbWvo.exe
  2⤵
  PID:5068
- C:\Windows\System\BTDLngm.exe
  C:\Windows\System\BTDLngm.exe
  2⤵
  PID:3420
- C:\Windows\System\CBIMLem.exe
  C:\Windows\System\CBIMLem.exe
  2⤵
  PID:4920
- C:\Windows\System\txswsTO.exe
  C:\Windows\System\txswsTO.exe
  2⤵
  PID:3800
- C:\Windows\System\AWqVDQV.exe
  C:\Windows\System\AWqVDQV.exe
  2⤵
  PID:4092
- C:\Windows\System\oLAIgPm.exe
  C:\Windows\System\oLAIgPm.exe
  2⤵
  PID:4040
- C:\Windows\System\IezwEyy.exe
  C:\Windows\System\IezwEyy.exe
  2⤵
  PID:3976
- C:\Windows\System\SdysJql.exe
  C:\Windows\System\SdysJql.exe
  2⤵
  PID:4348
- C:\Windows\System\VWquxQJ.exe
  C:\Windows\System\VWquxQJ.exe
  2⤵
  PID:4504
- C:\Windows\System\bjYEKBU.exe
  C:\Windows\System\bjYEKBU.exe
  2⤵
  PID:4680
- C:\Windows\System\IpvLNzx.exe
  C:\Windows\System\IpvLNzx.exe
  2⤵
  PID:296
- C:\Windows\System\ejMgWJq.exe
  C:\Windows\System\ejMgWJq.exe
  2⤵
  PID:2980
- C:\Windows\System\aEJinZL.exe
  C:\Windows\System\aEJinZL.exe
  2⤵
  PID:1200
- C:\Windows\System\AROQMMA.exe
  C:\Windows\System\AROQMMA.exe
  2⤵
  PID:1644
- C:\Windows\System\mhqqIIc.exe
  C:\Windows\System\mhqqIIc.exe
  2⤵
  PID:2680
- C:\Windows\System\kwsFfxp.exe
  C:\Windows\System\kwsFfxp.exe
  2⤵
  PID:4944
- C:\Windows\System\zDYCmcx.exe
  C:\Windows\System\zDYCmcx.exe
  2⤵
  PID:856
- C:\Windows\System\WSKJiYj.exe
  C:\Windows\System\WSKJiYj.exe
  2⤵
  PID:1564
- C:\Windows\System\QvjzxvP.exe
  C:\Windows\System\QvjzxvP.exe
  2⤵
  PID:3868
- C:\Windows\System\fJGJCME.exe
  C:\Windows\System\fJGJCME.exe
  2⤵
  PID:3608
- C:\Windows\System\RuNLJed.exe
  C:\Windows\System\RuNLJed.exe
  2⤵
  PID:2696
- C:\Windows\System\WSwQKYG.exe
  C:\Windows\System\WSwQKYG.exe
  2⤵
  PID:1968
- C:\Windows\System\yfOTTRm.exe
  C:\Windows\System\yfOTTRm.exe
  2⤵
  PID:2140
- C:\Windows\System\zHxkfxd.exe
  C:\Windows\System\zHxkfxd.exe
  2⤵
  PID:1360
- C:\Windows\System\VgOynOf.exe
  C:\Windows\System\VgOynOf.exe
  2⤵
  PID:3672
- C:\Windows\System\ReEodgP.exe
  C:\Windows\System\ReEodgP.exe
  2⤵
  PID:3628
- C:\Windows\System\fuxrhSh.exe
  C:\Windows\System\fuxrhSh.exe
  2⤵
  PID:3484
- C:\Windows\System\RSSNbIT.exe
  C:\Windows\System\RSSNbIT.exe
  2⤵
  PID:4236
- C:\Windows\System\sFoDizi.exe
  C:\Windows\System\sFoDizi.exe
  2⤵
  PID:4700
- C:\Windows\System\lFDCbKh.exe
  C:\Windows\System\lFDCbKh.exe
  2⤵
  PID:4172
- C:\Windows\System\iJfooLD.exe
  C:\Windows\System\iJfooLD.exe
  2⤵
  PID:5108
- C:\Windows\System\hrGOHQP.exe
  C:\Windows\System\hrGOHQP.exe
  2⤵
  PID:2936
- C:\Windows\System\eDnXQvd.exe
  C:\Windows\System\eDnXQvd.exe
  2⤵
  PID:4332
- C:\Windows\System\VpXbzGY.exe
  C:\Windows\System\VpXbzGY.exe
  2⤵
  PID:3932
- C:\Windows\System\Zhmvjbp.exe
  C:\Windows\System\Zhmvjbp.exe
  2⤵
  PID:4824
- C:\Windows\System\NiCQHSZ.exe
  C:\Windows\System\NiCQHSZ.exe
  2⤵
  PID:5024
- C:\Windows\System\dLwkngk.exe
  C:\Windows\System\dLwkngk.exe
  2⤵
  PID:1312
- C:\Windows\System\LEfReMl.exe
  C:\Windows\System\LEfReMl.exe
  2⤵
  PID:2748
- C:\Windows\System\EwwEBFi.exe
  C:\Windows\System\EwwEBFi.exe
  2⤵
  PID:1640
- C:\Windows\System\yKTQcWB.exe
  C:\Windows\System\yKTQcWB.exe
  2⤵
  PID:4748
- C:\Windows\System\MvZyvWM.exe
  C:\Windows\System\MvZyvWM.exe
  2⤵
  PID:3676
- C:\Windows\System\fMSDhnj.exe
  C:\Windows\System\fMSDhnj.exe
  2⤵
  PID:5028
- C:\Windows\System\MkoCPlW.exe
  C:\Windows\System\MkoCPlW.exe
  2⤵
  PID:5128
- C:\Windows\System\yFHSjCS.exe
  C:\Windows\System\yFHSjCS.exe
  2⤵
  PID:5144
- C:\Windows\System\WWbzVPD.exe
  C:\Windows\System\WWbzVPD.exe
  2⤵
  PID:5160
- C:\Windows\System\WiEWhnP.exe
  C:\Windows\System\WiEWhnP.exe
  2⤵
  PID:5176
- C:\Windows\System\VRjBuCx.exe
  C:\Windows\System\VRjBuCx.exe
  2⤵
  PID:5192
- C:\Windows\System\CFCVUFx.exe
  C:\Windows\System\CFCVUFx.exe
  2⤵
  PID:5208
- C:\Windows\System\ArLWOuJ.exe
  C:\Windows\System\ArLWOuJ.exe
  2⤵
  PID:5224
- C:\Windows\System\pdiFqHn.exe
  C:\Windows\System\pdiFqHn.exe
  2⤵
  PID:5240
- C:\Windows\System\NHZHVYu.exe
  C:\Windows\System\NHZHVYu.exe
  2⤵
  PID:5256
- C:\Windows\System\gqELEzu.exe
  C:\Windows\System\gqELEzu.exe
  2⤵
  PID:5272
- C:\Windows\System\coNIoxO.exe
  C:\Windows\System\coNIoxO.exe
  2⤵
  PID:5288
- C:\Windows\System\OzGjGFX.exe
  C:\Windows\System\OzGjGFX.exe
  2⤵
  PID:5304
- C:\Windows\System\cqKHrZI.exe
  C:\Windows\System\cqKHrZI.exe
  2⤵
  PID:5320
- C:\Windows\System\nryWtjJ.exe
  C:\Windows\System\nryWtjJ.exe
  2⤵
  PID:5336
- C:\Windows\System\jwaypXL.exe
  C:\Windows\System\jwaypXL.exe
  2⤵
  PID:5352
- C:\Windows\System\pnxzlql.exe
  C:\Windows\System\pnxzlql.exe
  2⤵
  PID:5368
- C:\Windows\System\bzvKAyi.exe
  C:\Windows\System\bzvKAyi.exe
  2⤵
  PID:5384
- C:\Windows\System\jlbrezV.exe
  C:\Windows\System\jlbrezV.exe
  2⤵
  PID:5400
- C:\Windows\System\eSwPeor.exe
  C:\Windows\System\eSwPeor.exe
  2⤵
  PID:5416
- C:\Windows\System\rPfWFPN.exe
  C:\Windows\System\rPfWFPN.exe
  2⤵
  PID:5432
- C:\Windows\System\qaFckWE.exe
  C:\Windows\System\qaFckWE.exe
  2⤵
  PID:5448
- C:\Windows\System\pOmInyZ.exe
  C:\Windows\System\pOmInyZ.exe
  2⤵
  PID:5464
- C:\Windows\System\IhdXGME.exe
  C:\Windows\System\IhdXGME.exe
  2⤵
  PID:5480
- C:\Windows\System\xOvtJsY.exe
  C:\Windows\System\xOvtJsY.exe
  2⤵
  PID:5504
- C:\Windows\System\fCChnhp.exe
  C:\Windows\System\fCChnhp.exe
  2⤵
  PID:5520
- C:\Windows\System\CCnDycA.exe
  C:\Windows\System\CCnDycA.exe
  2⤵
  PID:5540
- C:\Windows\System\EyZOEMJ.exe
  C:\Windows\System\EyZOEMJ.exe
  2⤵
  PID:5556
- C:\Windows\System\OpezKKK.exe
  C:\Windows\System\OpezKKK.exe
  2⤵
  PID:5572
- C:\Windows\System\djktKPU.exe
  C:\Windows\System\djktKPU.exe
  2⤵
  PID:5588
- C:\Windows\System\hPrcDWQ.exe
  C:\Windows\System\hPrcDWQ.exe
  2⤵
  PID:5604
- C:\Windows\System\lYeAdzr.exe
  C:\Windows\System\lYeAdzr.exe
  2⤵
  PID:5620
- C:\Windows\System\EesQnyd.exe
  C:\Windows\System\EesQnyd.exe
  2⤵
  PID:5636
- C:\Windows\System\IoZGrFI.exe
  C:\Windows\System\IoZGrFI.exe
  2⤵
  PID:5652
- C:\Windows\System\wICSbeh.exe
  C:\Windows\System\wICSbeh.exe
  2⤵
  PID:5668
- C:\Windows\System\UVIefbP.exe
  C:\Windows\System\UVIefbP.exe
  2⤵
  PID:5684
- C:\Windows\System\cxTCFFB.exe
  C:\Windows\System\cxTCFFB.exe
  2⤵
  PID:5700
- C:\Windows\System\DtUeCPH.exe
  C:\Windows\System\DtUeCPH.exe
  2⤵
  PID:5716
- C:\Windows\System\fmDLexI.exe
  C:\Windows\System\fmDLexI.exe
  2⤵
  PID:5732
- C:\Windows\System\FqGINwN.exe
  C:\Windows\System\FqGINwN.exe
  2⤵
  PID:5748
- C:\Windows\System\TdLjTmx.exe
  C:\Windows\System\TdLjTmx.exe
  2⤵
  PID:5764
- C:\Windows\System\YZIVMkd.exe
  C:\Windows\System\YZIVMkd.exe
  2⤵
  PID:5780
- C:\Windows\System\MpuKnIK.exe
  C:\Windows\System\MpuKnIK.exe
  2⤵
  PID:5796
- C:\Windows\System\coWxqUK.exe
  C:\Windows\System\coWxqUK.exe
  2⤵
  PID:5812
- C:\Windows\System\sXrJKiF.exe
  C:\Windows\System\sXrJKiF.exe
  2⤵
  PID:5828
- C:\Windows\System\PnKySha.exe
  C:\Windows\System\PnKySha.exe
  2⤵
  PID:5844
- C:\Windows\System\NwqWjTF.exe
  C:\Windows\System\NwqWjTF.exe
  2⤵
  PID:5860
- C:\Windows\System\FCnHFFc.exe
  C:\Windows\System\FCnHFFc.exe
  2⤵
  PID:5876
- C:\Windows\System\ofBJKHZ.exe
  C:\Windows\System\ofBJKHZ.exe
  2⤵
  PID:5892
- C:\Windows\System\YQzXjuj.exe
  C:\Windows\System\YQzXjuj.exe
  2⤵
  PID:5908
- C:\Windows\System\HZnQJic.exe
  C:\Windows\System\HZnQJic.exe
  2⤵
  PID:5924
- C:\Windows\System\nTlXVSy.exe
  C:\Windows\System\nTlXVSy.exe
  2⤵
  PID:5940
- C:\Windows\System\uttmAMz.exe
  C:\Windows\System\uttmAMz.exe
  2⤵
  PID:5956
- C:\Windows\System\rkhzsnZ.exe
  C:\Windows\System\rkhzsnZ.exe
  2⤵
  PID:5972
- C:\Windows\System\aendOCf.exe
  C:\Windows\System\aendOCf.exe
  2⤵
  PID:5988
- C:\Windows\System\kkRjdZH.exe
  C:\Windows\System\kkRjdZH.exe
  2⤵
  PID:6004
- C:\Windows\System\ZHYPmHE.exe
  C:\Windows\System\ZHYPmHE.exe
  2⤵
  PID:6020
- C:\Windows\System\fPJrpYn.exe
  C:\Windows\System\fPJrpYn.exe
  2⤵
  PID:6036
- C:\Windows\System\kCOlVaQ.exe
  C:\Windows\System\kCOlVaQ.exe
  2⤵
  PID:6052
- C:\Windows\System\nZCyCno.exe
  C:\Windows\System\nZCyCno.exe
  2⤵
  PID:6068
- C:\Windows\System\cdxODjF.exe
  C:\Windows\System\cdxODjF.exe
  2⤵
  PID:6084
- C:\Windows\System\tRFPcvv.exe
  C:\Windows\System\tRFPcvv.exe
  2⤵
  PID:6100
- C:\Windows\System\VLoeIuJ.exe
  C:\Windows\System\VLoeIuJ.exe
  2⤵
  PID:6116
- C:\Windows\System\DlQOONC.exe
  C:\Windows\System\DlQOONC.exe
  2⤵
  PID:6132
- C:\Windows\System\qtIQIPL.exe
  C:\Windows\System\qtIQIPL.exe
  2⤵
  PID:4608
- C:\Windows\System\cWGXeil.exe
  C:\Windows\System\cWGXeil.exe
  2⤵
  PID:2616
- C:\Windows\System\JKWMqYo.exe
  C:\Windows\System\JKWMqYo.exe
  2⤵
  PID:1520
- C:\Windows\System\hnLimlx.exe
  C:\Windows\System\hnLimlx.exe
  2⤵
  PID:3372
- C:\Windows\System\DLGvLOS.exe
  C:\Windows\System\DLGvLOS.exe
  2⤵
  PID:5172
- C:\Windows\System\onMSDzv.exe
  C:\Windows\System\onMSDzv.exe
  2⤵
  PID:5364
- C:\Windows\System\XREDSMl.exe
  C:\Windows\System\XREDSMl.exe
  2⤵
  PID:4672
- C:\Windows\System\XbyUDAI.exe
  C:\Windows\System\XbyUDAI.exe
  2⤵
  PID:5264
- C:\Windows\System\uoXKliw.exe
  C:\Windows\System\uoXKliw.exe
  2⤵
  PID:5476
- C:\Windows\System\GuYQyua.exe
  C:\Windows\System\GuYQyua.exe
  2⤵
  PID:5568
- C:\Windows\System\URwJxLc.exe
  C:\Windows\System\URwJxLc.exe
  2⤵
  PID:5660
- C:\Windows\System\cglvAeX.exe
  C:\Windows\System\cglvAeX.exe
  2⤵
  PID:5756
- C:\Windows\System\PuBKWvr.exe
  C:\Windows\System\PuBKWvr.exe
  2⤵
  PID:5788
- C:\Windows\System\Rpqoneq.exe
  C:\Windows\System\Rpqoneq.exe
  2⤵
  PID:5772
- C:\Windows\System\NefCuKb.exe
  C:\Windows\System\NefCuKb.exe
  2⤵
  PID:5808
- C:\Windows\System\OsCIsls.exe
  C:\Windows\System\OsCIsls.exe
  2⤵
  PID:2024
- C:\Windows\System\aqBtxQD.exe
  C:\Windows\System\aqBtxQD.exe
  2⤵
  PID:5220
- C:\Windows\System\jICoyCJ.exe
  C:\Windows\System\jICoyCJ.exe
  2⤵
  PID:5280
- C:\Windows\System\JdqtyXp.exe
  C:\Windows\System\JdqtyXp.exe
  2⤵
  PID:5348
- C:\Windows\System\dIRGPvA.exe
  C:\Windows\System\dIRGPvA.exe
  2⤵
  PID:5328
- C:\Windows\System\BnqWIhV.exe
  C:\Windows\System\BnqWIhV.exe
  2⤵
  PID:5360
- C:\Windows\System\VLWHUgm.exe
  C:\Windows\System\VLWHUgm.exe
  2⤵
  PID:328
- C:\Windows\System\oohzKAB.exe
  C:\Windows\System\oohzKAB.exe
  2⤵
  PID:4392
- C:\Windows\System\zmRaRzo.exe
  C:\Windows\System\zmRaRzo.exe
  2⤵
  PID:1952
- C:\Windows\System\FYNYJfK.exe
  C:\Windows\System\FYNYJfK.exe
  2⤵
  PID:1768
- C:\Windows\System\hwLhdoV.exe
  C:\Windows\System\hwLhdoV.exe
  2⤵
  PID:5124
- C:\Windows\System\MyCmkds.exe
  C:\Windows\System\MyCmkds.exe
  2⤵
  PID:5216
- C:\Windows\System\ZiJoqxV.exe
  C:\Windows\System\ZiJoqxV.exe
  2⤵
  PID:5396
- C:\Windows\System\dJrWrtH.exe
  C:\Windows\System\dJrWrtH.exe
  2⤵
  PID:5472
- C:\Windows\System\PsZGapW.exe
  C:\Windows\System\PsZGapW.exe
  2⤵
  PID:5600
- C:\Windows\System\drKYDzt.exe
  C:\Windows\System\drKYDzt.exe
  2⤵
  PID:5552
- C:\Windows\System\CZcSwmy.exe
  C:\Windows\System\CZcSwmy.exe
  2⤵
  PID:5532
- C:\Windows\System\FslEmxK.exe
  C:\Windows\System\FslEmxK.exe
  2⤵
  PID:5692
- C:\Windows\System\fpuYOip.exe
  C:\Windows\System\fpuYOip.exe
  2⤵
  PID:5696
- C:\Windows\System\TTWbsiC.exe
  C:\Windows\System\TTWbsiC.exe
  2⤵
  PID:5708
- C:\Windows\System\TDsGttD.exe
  C:\Windows\System\TDsGttD.exe
  2⤵
  PID:5676
- C:\Windows\System\OXKyRuT.exe
  C:\Windows\System\OXKyRuT.exe
  2⤵
  PID:5804
- C:\Windows\System\EHTPKDd.exe
  C:\Windows\System\EHTPKDd.exe
  2⤵
  PID:5872
- C:\Windows\System\uXnhYvP.exe
  C:\Windows\System\uXnhYvP.exe
  2⤵
  PID:5968
- C:\Windows\System\erAyBPO.exe
  C:\Windows\System\erAyBPO.exe
  2⤵
  PID:5888
- C:\Windows\System\IRGSLVP.exe
  C:\Windows\System\IRGSLVP.exe
  2⤵
  PID:5904
- C:\Windows\System\tpcZTUv.exe
  C:\Windows\System\tpcZTUv.exe
  2⤵
  PID:6012
- C:\Windows\System\XnOCkvl.exe
  C:\Windows\System\XnOCkvl.exe
  2⤵
  PID:6044
- C:\Windows\System\GexcKkj.exe
  C:\Windows\System\GexcKkj.exe
  2⤵
  PID:6112
- C:\Windows\System\EBlVykl.exe
  C:\Windows\System\EBlVykl.exe
  2⤵
  PID:2388
- C:\Windows\System\jvitDvp.exe
  C:\Windows\System\jvitDvp.exe
  2⤵
  PID:6060
- C:\Windows\System\vvHYFMV.exe
  C:\Windows\System\vvHYFMV.exe
  2⤵
  PID:5168
- C:\Windows\System\LoWmQSf.exe
  C:\Windows\System\LoWmQSf.exe
  2⤵
  PID:6096
- C:\Windows\System\fMgnBom.exe
  C:\Windows\System\fMgnBom.exe
  2⤵
  PID:2108
- C:\Windows\System\oLSTxqf.exe
  C:\Windows\System\oLSTxqf.exe
  2⤵
  PID:5316
- C:\Windows\System\ulnWckX.exe
  C:\Windows\System\ulnWckX.exe
  2⤵
  PID:5184
- C:\Windows\System\DZSXLOR.exe
  C:\Windows\System\DZSXLOR.exe
  2⤵
  PID:5528
- C:\Windows\System\qeqBBQR.exe
  C:\Windows\System\qeqBBQR.exe
  2⤵
  PID:5380
- C:\Windows\System\obIgzPy.exe
  C:\Windows\System\obIgzPy.exe
  2⤵
  PID:5776
- C:\Windows\System\nStRsPi.exe
  C:\Windows\System\nStRsPi.exe
  2⤵
  PID:5920
- C:\Windows\System\IyHZyCn.exe
  C:\Windows\System\IyHZyCn.exe
  2⤵
  PID:6140
- C:\Windows\System\RtaITin.exe
  C:\Windows\System\RtaITin.exe
  2⤵
  PID:592
- C:\Windows\System\WSHeJIm.exe
  C:\Windows\System\WSHeJIm.exe
  2⤵
  PID:2336
- C:\Windows\System\ecUZLrw.exe
  C:\Windows\System\ecUZLrw.exe
  2⤵
  PID:5252
- C:\Windows\System\KvMMMbj.exe
  C:\Windows\System\KvMMMbj.exe
  2⤵
  PID:4592
- C:\Windows\System\bLCqBhW.exe
  C:\Windows\System\bLCqBhW.exe
  2⤵
  PID:5460
- C:\Windows\System\jJfeZFi.exe
  C:\Windows\System\jJfeZFi.exe
  2⤵
  PID:2084
- C:\Windows\System\UMfkVok.exe
  C:\Windows\System\UMfkVok.exe
  2⤵
  PID:6092
- C:\Windows\System\UcnAOjy.exe
  C:\Windows\System\UcnAOjy.exe
  2⤵
  PID:5628
- C:\Windows\System\WZzNGIA.exe
  C:\Windows\System\WZzNGIA.exe
  2⤵
  PID:5948
- C:\Windows\System\SCSRNbS.exe
  C:\Windows\System\SCSRNbS.exe
  2⤵
  PID:5824
- C:\Windows\System\iqgcNyr.exe
  C:\Windows\System\iqgcNyr.exe
  2⤵
  PID:6064
- C:\Windows\System\gEwwJwt.exe
  C:\Windows\System\gEwwJwt.exe
  2⤵
  PID:3592
- C:\Windows\System\hCXmuQz.exe
  C:\Windows\System\hCXmuQz.exe
  2⤵
  PID:5680
- C:\Windows\System\fTVrfHB.exe
  C:\Windows\System\fTVrfHB.exe
  2⤵
  PID:6108
- C:\Windows\System\gASijlP.exe
  C:\Windows\System\gASijlP.exe
  2⤵
  PID:6156
- C:\Windows\System\hllBFSX.exe
  C:\Windows\System\hllBFSX.exe
  2⤵
  PID:6172
- C:\Windows\System\zDzTVnX.exe
  C:\Windows\System\zDzTVnX.exe
  2⤵
  PID:6188
- C:\Windows\System\duKbHQb.exe
  C:\Windows\System\duKbHQb.exe
  2⤵
  PID:6208
- C:\Windows\System\iiriCCn.exe
  C:\Windows\System\iiriCCn.exe
  2⤵
  PID:6228
- C:\Windows\System\JgeCToH.exe
  C:\Windows\System\JgeCToH.exe
  2⤵
  PID:6244
- C:\Windows\System\mLajHcn.exe
  C:\Windows\System\mLajHcn.exe
  2⤵
  PID:6272
- C:\Windows\System\mpjBCUX.exe
  C:\Windows\System\mpjBCUX.exe
  2⤵
  PID:6288
- C:\Windows\System\zOdDVwf.exe
  C:\Windows\System\zOdDVwf.exe
  2⤵
  PID:6304
- C:\Windows\System\wihcSyv.exe
  C:\Windows\System\wihcSyv.exe
  2⤵
  PID:6320
- C:\Windows\System\XVbzjMo.exe
  C:\Windows\System\XVbzjMo.exe
  2⤵
  PID:6336
- C:\Windows\System\iebYAqB.exe
  C:\Windows\System\iebYAqB.exe
  2⤵
  PID:6352
- C:\Windows\System\qGcSXHa.exe
  C:\Windows\System\qGcSXHa.exe
  2⤵
  PID:6368
- C:\Windows\System\RuPMmIN.exe
  C:\Windows\System\RuPMmIN.exe
  2⤵
  PID:6384
- C:\Windows\System\FJJQWYC.exe
  C:\Windows\System\FJJQWYC.exe
  2⤵
  PID:6400
- C:\Windows\System\EsrEyEr.exe
  C:\Windows\System\EsrEyEr.exe
  2⤵
  PID:6416
- C:\Windows\System\DdaLvDM.exe
  C:\Windows\System\DdaLvDM.exe
  2⤵
  PID:6432
- C:\Windows\System\IhDfMmm.exe
  C:\Windows\System\IhDfMmm.exe
  2⤵
  PID:6448
- C:\Windows\System\lePbcjD.exe
  C:\Windows\System\lePbcjD.exe
  2⤵
  PID:6464
- C:\Windows\System\uAanmGP.exe
  C:\Windows\System\uAanmGP.exe
  2⤵
  PID:6484
- C:\Windows\System\dSASeYg.exe
  C:\Windows\System\dSASeYg.exe
  2⤵
  PID:6500
- C:\Windows\System\yWqqLwj.exe
  C:\Windows\System\yWqqLwj.exe
  2⤵
  PID:6516
- C:\Windows\System\XOkbErg.exe
  C:\Windows\System\XOkbErg.exe
  2⤵
  PID:6532
- C:\Windows\System\JMEgsYu.exe
  C:\Windows\System\JMEgsYu.exe
  2⤵
  PID:6548
- C:\Windows\System\IIdAuVW.exe
  C:\Windows\System\IIdAuVW.exe
  2⤵
  PID:6564
- C:\Windows\System\azSCYca.exe
  C:\Windows\System\azSCYca.exe
  2⤵
  PID:6580
- C:\Windows\System\XnypyFd.exe
  C:\Windows\System\XnypyFd.exe
  2⤵
  PID:6596
- C:\Windows\System\IsnMNPi.exe
  C:\Windows\System\IsnMNPi.exe
  2⤵
  PID:6612
- C:\Windows\System\GfqXplH.exe
  C:\Windows\System\GfqXplH.exe
  2⤵
  PID:6628
- C:\Windows\System\qfGXemh.exe
  C:\Windows\System\qfGXemh.exe
  2⤵
  PID:6644
- C:\Windows\System\RGhkaKy.exe
  C:\Windows\System\RGhkaKy.exe
  2⤵
  PID:6660
- C:\Windows\System\xqfdxVL.exe
  C:\Windows\System\xqfdxVL.exe
  2⤵
  PID:6676
- C:\Windows\System\hQlgYyV.exe
  C:\Windows\System\hQlgYyV.exe
  2⤵
  PID:6692
- C:\Windows\System\odUaAjU.exe
  C:\Windows\System\odUaAjU.exe
  2⤵
  PID:6708
- C:\Windows\System\JcqiRCo.exe
  C:\Windows\System\JcqiRCo.exe
  2⤵
  PID:6724
- C:\Windows\System\aiQYGsX.exe
  C:\Windows\System\aiQYGsX.exe
  2⤵
  PID:6740
- C:\Windows\System\YiIwyeh.exe
  C:\Windows\System\YiIwyeh.exe
  2⤵
  PID:6756
- C:\Windows\System\lnwTfKm.exe
  C:\Windows\System\lnwTfKm.exe
  2⤵
  PID:6772
- C:\Windows\System\aIGUvRK.exe
  C:\Windows\System\aIGUvRK.exe
  2⤵
  PID:6788
- C:\Windows\System\oigtbGo.exe
  C:\Windows\System\oigtbGo.exe
  2⤵
  PID:6804
- C:\Windows\System\qLmLdeL.exe
  C:\Windows\System\qLmLdeL.exe
  2⤵
  PID:6820
- C:\Windows\System\EUFjvIq.exe
  C:\Windows\System\EUFjvIq.exe
  2⤵
  PID:6836
- C:\Windows\System\vEAZqnr.exe
  C:\Windows\System\vEAZqnr.exe
  2⤵
  PID:6852
- C:\Windows\System\doDJjuD.exe
  C:\Windows\System\doDJjuD.exe
  2⤵
  PID:6868
- C:\Windows\System\AbnebeT.exe
  C:\Windows\System\AbnebeT.exe
  2⤵
  PID:6884
- C:\Windows\System\HvVtXIX.exe
  C:\Windows\System\HvVtXIX.exe
  2⤵
  PID:6900
- C:\Windows\System\nQnSJdk.exe
  C:\Windows\System\nQnSJdk.exe
  2⤵
  PID:6916
- C:\Windows\System\hxsUwyy.exe
  C:\Windows\System\hxsUwyy.exe
  2⤵
  PID:6932
- C:\Windows\System\gdBZxdB.exe
  C:\Windows\System\gdBZxdB.exe
  2⤵
  PID:6948
- C:\Windows\System\yxDiAff.exe
  C:\Windows\System\yxDiAff.exe
  2⤵
  PID:6964
- C:\Windows\System\pzVejrC.exe
  C:\Windows\System\pzVejrC.exe
  2⤵
  PID:6980
- C:\Windows\System\UesrMYN.exe
  C:\Windows\System\UesrMYN.exe
  2⤵
  PID:6996
- C:\Windows\System\BIBnheF.exe
  C:\Windows\System\BIBnheF.exe
  2⤵
  PID:7012
- C:\Windows\System\hkAOYgt.exe
  C:\Windows\System\hkAOYgt.exe
  2⤵
  PID:7028
- C:\Windows\System\bnysSbt.exe
  C:\Windows\System\bnysSbt.exe
  2⤵
  PID:7048
- C:\Windows\System\xlOboio.exe
  C:\Windows\System\xlOboio.exe
  2⤵
  PID:7064
- C:\Windows\System\AMLzxna.exe
  C:\Windows\System\AMLzxna.exe
  2⤵
  PID:7080
- C:\Windows\System\vlUSiGy.exe
  C:\Windows\System\vlUSiGy.exe
  2⤵
  PID:7096
- C:\Windows\System\FBPymXz.exe
  C:\Windows\System\FBPymXz.exe
  2⤵
  PID:7112
- C:\Windows\System\ybefbIU.exe
  C:\Windows\System\ybefbIU.exe
  2⤵
  PID:7128
- C:\Windows\System\NPJwQcH.exe
  C:\Windows\System\NPJwQcH.exe
  2⤵
  PID:7144
- C:\Windows\System\rEGQXFt.exe
  C:\Windows\System\rEGQXFt.exe
  2⤵
  PID:7160
- C:\Windows\System\eiHQJzN.exe
  C:\Windows\System\eiHQJzN.exe
  2⤵
  PID:6180
- C:\Windows\System\mkkFEoK.exe
  C:\Windows\System\mkkFEoK.exe
  2⤵
  PID:6164
- C:\Windows\System\ljGlCvE.exe
  C:\Windows\System\ljGlCvE.exe
  2⤵
  PID:816
- C:\Windows\System\IszMayP.exe
  C:\Windows\System\IszMayP.exe
  2⤵
  PID:5440
- C:\Windows\System\xunBoFZ.exe
  C:\Windows\System\xunBoFZ.exe
  2⤵
  PID:5980
- C:\Windows\System\SNLKQyh.exe
  C:\Windows\System\SNLKQyh.exe
  2⤵
  PID:5296
- C:\Windows\System\GwBGPog.exe
  C:\Windows\System\GwBGPog.exe
  2⤵
  PID:6016
- C:\Windows\System\ubkJvIC.exe
  C:\Windows\System\ubkJvIC.exe
  2⤵
  PID:6168
- C:\Windows\System\oJPrfhV.exe
  C:\Windows\System\oJPrfhV.exe
  2⤵
  PID:6220
- C:\Windows\System\rQWICUr.exe
  C:\Windows\System\rQWICUr.exe
  2⤵
  PID:6240
- C:\Windows\System\qhYoKaf.exe
  C:\Windows\System\qhYoKaf.exe
  2⤵
  PID:6268
- C:\Windows\System\DpUTFzL.exe
  C:\Windows\System\DpUTFzL.exe
  2⤵
  PID:6300
- C:\Windows\System\Bzplfuw.exe
  C:\Windows\System\Bzplfuw.exe
  2⤵
  PID:6360
- C:\Windows\System\OFoHmaW.exe
  C:\Windows\System\OFoHmaW.exe
  2⤵
  PID:6424
- C:\Windows\System\gQZWEmB.exe
  C:\Windows\System\gQZWEmB.exe
  2⤵
  PID:6428
- C:\Windows\System\BTzMPLQ.exe
  C:\Windows\System\BTzMPLQ.exe
  2⤵
  PID:6528
- C:\Windows\System\vgnwJeg.exe
  C:\Windows\System\vgnwJeg.exe
  2⤵
  PID:6588
- C:\Windows\System\nYqNaNi.exe
  C:\Windows\System\nYqNaNi.exe
  2⤵
  PID:6440
- C:\Windows\System\iSwvGoK.exe
  C:\Windows\System\iSwvGoK.exe
  2⤵
  PID:6312
- C:\Windows\System\jGpfExR.exe
  C:\Windows\System\jGpfExR.exe
  2⤵
  PID:6688
- C:\Windows\System\lASPcsT.exe
  C:\Windows\System\lASPcsT.exe
  2⤵
  PID:6748
- C:\Windows\System\wptzbjN.exe
  C:\Windows\System\wptzbjN.exe
  2⤵
  PID:6784
- C:\Windows\System\DNNyVsS.exe
  C:\Windows\System\DNNyVsS.exe
  2⤵
  PID:6348
- C:\Windows\System\WhFdawF.exe
  C:\Windows\System\WhFdawF.exe
  2⤵
  PID:6476
- C:\Windows\System\vlTLGtD.exe
  C:\Windows\System\vlTLGtD.exe
  2⤵
  PID:6880
- C:\Windows\System\bwjisOW.exe
  C:\Windows\System\bwjisOW.exe
  2⤵
  PID:6944
- C:\Windows\System\bgBlLBy.exe
  C:\Windows\System\bgBlLBy.exe
  2⤵
  PID:7008
- C:\Windows\System\kSfsYLD.exe
  C:\Windows\System\kSfsYLD.exe
  2⤵
  PID:6544
- C:\Windows\System\YRJnRvY.exe
  C:\Windows\System\YRJnRvY.exe
  2⤵
  PID:7036
- C:\Windows\System\YYqbsfg.exe
  C:\Windows\System\YYqbsfg.exe
  2⤵
  PID:6860
- C:\Windows\System\atkCuVC.exe
  C:\Windows\System\atkCuVC.exe
  2⤵
  PID:6672
- C:\Windows\System\ZHspcMq.exe
  C:\Windows\System\ZHspcMq.exe
  2⤵
  PID:6892
- C:\Windows\System\TTTlXeO.exe
  C:\Windows\System\TTTlXeO.exe
  2⤵
  PID:6928
- C:\Windows\System\CoQjKtj.exe
  C:\Windows\System\CoQjKtj.exe
  2⤵
  PID:6764
- C:\Windows\System\VBvkFMV.exe
  C:\Windows\System\VBvkFMV.exe
  2⤵
  PID:7056
- C:\Windows\System\lBQoAlj.exe
  C:\Windows\System\lBQoAlj.exe
  2⤵
  PID:6896
- C:\Windows\System\KmemkhD.exe
  C:\Windows\System\KmemkhD.exe
  2⤵
  PID:6992
- C:\Windows\System\Ipvtigj.exe
  C:\Windows\System\Ipvtigj.exe
  2⤵
  PID:7092
- C:\Windows\System\fjGlrlG.exe
  C:\Windows\System\fjGlrlG.exe
  2⤵
  PID:5516
- C:\Windows\System\QMYLvkt.exe
  C:\Windows\System\QMYLvkt.exe
  2⤵
  PID:6148
- C:\Windows\System\CmOxXCo.exe
  C:\Windows\System\CmOxXCo.exe
  2⤵
  PID:5156
- C:\Windows\System\ZxzWRuF.exe
  C:\Windows\System\ZxzWRuF.exe
  2⤵
  PID:5868
- C:\Windows\System\wxtKTGQ.exe
  C:\Windows\System\wxtKTGQ.exe
  2⤵
  PID:5300
- C:\Windows\System\eGynZpy.exe
  C:\Windows\System\eGynZpy.exe
  2⤵
  PID:5564
- C:\Windows\System\ewFQiXO.exe
  C:\Windows\System\ewFQiXO.exe
  2⤵
  PID:5312
- C:\Windows\System\hGrpJdV.exe
  C:\Windows\System\hGrpJdV.exe
  2⤵
  PID:6560
- C:\Windows\System\nmVOyjg.exe
  C:\Windows\System\nmVOyjg.exe
  2⤵
  PID:6652
- C:\Windows\System\fIhGZjQ.exe
  C:\Windows\System\fIhGZjQ.exe
  2⤵
  PID:6720
- C:\Windows\System\ytSSald.exe
  C:\Windows\System\ytSSald.exe
  2⤵
  PID:6876
- C:\Windows\System\OzpWLui.exe
  C:\Windows\System\OzpWLui.exe
  2⤵
  PID:1556
- C:\Windows\System\ZvVFXAm.exe
  C:\Windows\System\ZvVFXAm.exe
  2⤵
  PID:6668
- C:\Windows\System\izKpRsk.exe
  C:\Windows\System\izKpRsk.exe
  2⤵
  PID:6796
- C:\Windows\System\mxxMwNg.exe
  C:\Windows\System\mxxMwNg.exe
  2⤵
  PID:6960
- C:\Windows\System\npJDHTi.exe
  C:\Windows\System\npJDHTi.exe
  2⤵
  PID:5632
- C:\Windows\System\PdGvIyL.exe
  C:\Windows\System\PdGvIyL.exe
  2⤵
  PID:6260
- C:\Windows\System\HFdxeET.exe
  C:\Windows\System\HFdxeET.exe
  2⤵
  PID:7076
- C:\Windows\System\CFRxopM.exe
  C:\Windows\System\CFRxopM.exe
  2⤵
  PID:7152
- C:\Windows\System\zdmfNgx.exe
  C:\Windows\System\zdmfNgx.exe
  2⤵
  PID:6328
- C:\Windows\System\DgonzIE.exe
  C:\Windows\System\DgonzIE.exe
  2⤵
  PID:6252
- C:\Windows\System\cTcCOPo.exe
  C:\Windows\System\cTcCOPo.exe
  2⤵
  PID:6344
- C:\Windows\System\FZBogAt.exe
  C:\Windows\System\FZBogAt.exe
  2⤵
  PID:6736
- C:\Windows\System\oOuLTML.exe
  C:\Windows\System\oOuLTML.exe
  2⤵
  PID:7060
- C:\Windows\System\nmJlHxg.exe
  C:\Windows\System\nmJlHxg.exe
  2⤵
  PID:6800
- C:\Windows\System\ywJwasM.exe
  C:\Windows\System\ywJwasM.exe
  2⤵
  PID:6816
- C:\Windows\System\tPjRkcg.exe
  C:\Windows\System\tPjRkcg.exe
  2⤵
  PID:7108
- C:\Windows\System\RwDYYGe.exe
  C:\Windows\System\RwDYYGe.exe
  2⤵
  PID:6408
- C:\Windows\System\LaXZyfF.exe
  C:\Windows\System\LaXZyfF.exe
  2⤵
  PID:6216
- C:\Windows\System\WRVqkDF.exe
  C:\Windows\System\WRVqkDF.exe
  2⤵
  PID:7184
- C:\Windows\System\WcUEpQX.exe
  C:\Windows\System\WcUEpQX.exe
  2⤵
  PID:7200
- C:\Windows\System\CUTuWkN.exe
  C:\Windows\System\CUTuWkN.exe
  2⤵
  PID:7216
- C:\Windows\System\QPvxVnh.exe
  C:\Windows\System\QPvxVnh.exe
  2⤵
  PID:7232
- C:\Windows\System\rObqmGg.exe
  C:\Windows\System\rObqmGg.exe
  2⤵
  PID:7252
- C:\Windows\System\XCXikCw.exe
  C:\Windows\System\XCXikCw.exe
  2⤵
  PID:7268
- C:\Windows\System\kGRzZhe.exe
  C:\Windows\System\kGRzZhe.exe
  2⤵
  PID:7284
- C:\Windows\System\soRZhze.exe
  C:\Windows\System\soRZhze.exe
  2⤵
  PID:7300
- C:\Windows\System\FxJcEwY.exe
  C:\Windows\System\FxJcEwY.exe
  2⤵
  PID:7316
- C:\Windows\System\yoRBetb.exe
  C:\Windows\System\yoRBetb.exe
  2⤵
  PID:7332
- C:\Windows\System\xCYVYFo.exe
  C:\Windows\System\xCYVYFo.exe
  2⤵
  PID:7348
- C:\Windows\System\pUVRxNg.exe
  C:\Windows\System\pUVRxNg.exe
  2⤵
  PID:7364
- C:\Windows\System\RoXISLD.exe
  C:\Windows\System\RoXISLD.exe
  2⤵
  PID:7380
- C:\Windows\System\EmAzsMH.exe
  C:\Windows\System\EmAzsMH.exe
  2⤵
  PID:7396
- C:\Windows\System\iMCXksp.exe
  C:\Windows\System\iMCXksp.exe
  2⤵
  PID:7412
- C:\Windows\System\RqXkLyz.exe
  C:\Windows\System\RqXkLyz.exe
  2⤵
  PID:7428
- C:\Windows\System\IAaacEV.exe
  C:\Windows\System\IAaacEV.exe
  2⤵
  PID:7448
- C:\Windows\System\uVrUifj.exe
  C:\Windows\System\uVrUifj.exe
  2⤵
  PID:7464
- C:\Windows\System\xIvfcJx.exe
  C:\Windows\System\xIvfcJx.exe
  2⤵
  PID:7480
- C:\Windows\System\gJJAffh.exe
  C:\Windows\System\gJJAffh.exe
  2⤵
  PID:7496
- C:\Windows\System\jAMsXTG.exe
  C:\Windows\System\jAMsXTG.exe
  2⤵
  PID:7512
- C:\Windows\System\tuSJQfT.exe
  C:\Windows\System\tuSJQfT.exe
  2⤵
  PID:7528
- C:\Windows\System\NYomyQR.exe
  C:\Windows\System\NYomyQR.exe
  2⤵
  PID:7544
- C:\Windows\System\rHnrivM.exe
  C:\Windows\System\rHnrivM.exe
  2⤵
  PID:7560
- C:\Windows\System\cvflAIe.exe
  C:\Windows\System\cvflAIe.exe
  2⤵
  PID:7576
- C:\Windows\System\mmNeaqe.exe
  C:\Windows\System\mmNeaqe.exe
  2⤵
  PID:7592
- C:\Windows\System\pBpIjLQ.exe
  C:\Windows\System\pBpIjLQ.exe
  2⤵
  PID:7608
- C:\Windows\System\AROrXky.exe
  C:\Windows\System\AROrXky.exe
  2⤵
  PID:7624
- C:\Windows\System\QLwnpzn.exe
  C:\Windows\System\QLwnpzn.exe
  2⤵
  PID:7640
- C:\Windows\System\LqMFEOE.exe
  C:\Windows\System\LqMFEOE.exe
  2⤵
  PID:7656
- C:\Windows\System\fuyGsSr.exe
  C:\Windows\System\fuyGsSr.exe
  2⤵
  PID:7672
- C:\Windows\System\kZCUdrR.exe
  C:\Windows\System\kZCUdrR.exe
  2⤵
  PID:7688
- C:\Windows\System\HnmqbcL.exe
  C:\Windows\System\HnmqbcL.exe
  2⤵
  PID:7704
- C:\Windows\System\AYEzKiy.exe
  C:\Windows\System\AYEzKiy.exe
  2⤵
  PID:7720
- C:\Windows\System\UCUxZnh.exe
  C:\Windows\System\UCUxZnh.exe
  2⤵
  PID:7736
- C:\Windows\System\IhjBkLo.exe
  C:\Windows\System\IhjBkLo.exe
  2⤵
  PID:7756
- C:\Windows\System\bVmwwdj.exe
  C:\Windows\System\bVmwwdj.exe
  2⤵
  PID:7776
- C:\Windows\System\xdeVYST.exe
  C:\Windows\System\xdeVYST.exe
  2⤵
  PID:7792
- C:\Windows\System\CEHzwwC.exe
  C:\Windows\System\CEHzwwC.exe
  2⤵
  PID:7808
- C:\Windows\System\XwySkfd.exe
  C:\Windows\System\XwySkfd.exe
  2⤵
  PID:7828
- C:\Windows\System\nOjqYFc.exe
  C:\Windows\System\nOjqYFc.exe
  2⤵
  PID:7844
- C:\Windows\System\mXokzlV.exe
  C:\Windows\System\mXokzlV.exe
  2⤵
  PID:7860
- C:\Windows\System\rWrMXgU.exe
  C:\Windows\System\rWrMXgU.exe
  2⤵
  PID:7876
- C:\Windows\System\hbDzWIG.exe
  C:\Windows\System\hbDzWIG.exe
  2⤵
  PID:7892
- C:\Windows\System\kZehdYJ.exe
  C:\Windows\System\kZehdYJ.exe
  2⤵
  PID:7908
- C:\Windows\System\AbRNXYu.exe
  C:\Windows\System\AbRNXYu.exe
  2⤵
  PID:7924
- C:\Windows\System\PFQQdsU.exe
  C:\Windows\System\PFQQdsU.exe
  2⤵
  PID:7940
- C:\Windows\System\DCLrLuH.exe
  C:\Windows\System\DCLrLuH.exe
  2⤵
  PID:7956
- C:\Windows\System\EmhHHUH.exe
  C:\Windows\System\EmhHHUH.exe
  2⤵
  PID:7972
- C:\Windows\System\yaiTQJc.exe
  C:\Windows\System\yaiTQJc.exe
  2⤵
  PID:7988
- C:\Windows\System\VVFOPnV.exe
  C:\Windows\System\VVFOPnV.exe
  2⤵
  PID:8004
- C:\Windows\System\PICrCFP.exe
  C:\Windows\System\PICrCFP.exe
  2⤵
  PID:8020
- C:\Windows\System\KNDpmhn.exe
  C:\Windows\System\KNDpmhn.exe
  2⤵
  PID:8036
- C:\Windows\System\zkvhtet.exe
  C:\Windows\System\zkvhtet.exe
  2⤵
  PID:8052
- C:\Windows\System\twAFgfO.exe
  C:\Windows\System\twAFgfO.exe
  2⤵
  PID:8068
- C:\Windows\System\XTeHLjE.exe
  C:\Windows\System\XTeHLjE.exe
  2⤵
  PID:8084
- C:\Windows\System\rfkYeVn.exe
  C:\Windows\System\rfkYeVn.exe
  2⤵
  PID:8100
- C:\Windows\System\wcXTUai.exe
  C:\Windows\System\wcXTUai.exe
  2⤵
  PID:8116
- C:\Windows\System\lyoeusL.exe
  C:\Windows\System\lyoeusL.exe
  2⤵
  PID:8132
- C:\Windows\System\emkOyJy.exe
  C:\Windows\System\emkOyJy.exe
  2⤵
  PID:8148
- C:\Windows\System\tMGIwxK.exe
  C:\Windows\System\tMGIwxK.exe
  2⤵
  PID:8164
- C:\Windows\System\CXpErCr.exe
  C:\Windows\System\CXpErCr.exe
  2⤵
  PID:8180
- C:\Windows\System\AjwLGKR.exe
  C:\Windows\System\AjwLGKR.exe
  2⤵
  PID:7192
- C:\Windows\System\IsZahBY.exe
  C:\Windows\System\IsZahBY.exe
  2⤵
  PID:7228
- C:\Windows\System\lbJHaPQ.exe
  C:\Windows\System\lbJHaPQ.exe
  2⤵
  PID:7024
- C:\Windows\System\XGzTQeX.exe
  C:\Windows\System\XGzTQeX.exe
  2⤵
  PID:6412
- C:\Windows\System\rGqufVh.exe
  C:\Windows\System\rGqufVh.exe
  2⤵
  PID:6480
- C:\Windows\System\kxXeepU.exe
  C:\Windows\System\kxXeepU.exe
  2⤵
  PID:6396
- C:\Windows\System\YcfnWBN.exe
  C:\Windows\System\YcfnWBN.exe
  2⤵
  PID:7072
- C:\Windows\System\ZnaXIOH.exe
  C:\Windows\System\ZnaXIOH.exe
  2⤵
  PID:6956
- C:\Windows\System\lpyeCYV.exe
  C:\Windows\System\lpyeCYV.exe
  2⤵
  PID:7180
- C:\Windows\System\vySMPdJ.exe
  C:\Windows\System\vySMPdJ.exe
  2⤵
  PID:7248
- C:\Windows\System\YMpFTJK.exe
  C:\Windows\System\YMpFTJK.exe
  2⤵
  PID:7276
- C:\Windows\System\MhalONR.exe
  C:\Windows\System\MhalONR.exe
  2⤵
  PID:7392
- C:\Windows\System\OVvqWjf.exe
  C:\Windows\System\OVvqWjf.exe
  2⤵
  PID:7456
- C:\Windows\System\QykuDMd.exe
  C:\Windows\System\QykuDMd.exe
  2⤵
  PID:7372
- C:\Windows\System\WJdRzhx.exe
  C:\Windows\System\WJdRzhx.exe
  2⤵
  PID:7552
- C:\Windows\System\iAlpbJf.exe
  C:\Windows\System\iAlpbJf.exe
  2⤵
  PID:7408
- C:\Windows\System\iLfVNtX.exe
  C:\Windows\System\iLfVNtX.exe
  2⤵
  PID:7472
- C:\Windows\System\JKQivOX.exe
  C:\Windows\System\JKQivOX.exe
  2⤵
  PID:7312
- C:\Windows\System\HcCfjaC.exe
  C:\Windows\System\HcCfjaC.exe
  2⤵
  PID:7444
- C:\Windows\System\qidhTYV.exe
  C:\Windows\System\qidhTYV.exe
  2⤵
  PID:7632
- C:\Windows\System\IhJdGdi.exe
  C:\Windows\System\IhJdGdi.exe
  2⤵
  PID:7716
- C:\Windows\System\nbIsdqd.exe
  C:\Windows\System\nbIsdqd.exe
  2⤵
  PID:7784
- C:\Windows\System\YqQoqua.exe
  C:\Windows\System\YqQoqua.exe
  2⤵
  PID:7540
- C:\Windows\System\lIcehcY.exe
  C:\Windows\System\lIcehcY.exe
  2⤵
  PID:7700
- C:\Windows\System\PvKNXVP.exe
  C:\Windows\System\PvKNXVP.exe
  2⤵
  PID:7764
- C:\Windows\System\LrOOrvm.exe
  C:\Windows\System\LrOOrvm.exe
  2⤵
  PID:7668
- C:\Windows\System\DiblUeJ.exe
  C:\Windows\System\DiblUeJ.exe
  2⤵
  PID:7804
- C:\Windows\System\QrWRJMb.exe
  C:\Windows\System\QrWRJMb.exe
  2⤵
  PID:7856
- C:\Windows\System\cMTgeXY.exe
  C:\Windows\System\cMTgeXY.exe
  2⤵
  PID:7868
- C:\Windows\System\oazvgCW.exe
  C:\Windows\System\oazvgCW.exe
  2⤵
  PID:7872
- C:\Windows\System\wTpikVL.exe
  C:\Windows\System\wTpikVL.exe
  2⤵
  PID:7936
- C:\Windows\System\ZmYMVdy.exe
  C:\Windows\System\ZmYMVdy.exe
  2⤵
  PID:8012
- C:\Windows\System\YfduhNa.exe
  C:\Windows\System\YfduhNa.exe
  2⤵
  PID:8044
- C:\Windows\System\kVDhHbd.exe
  C:\Windows\System\kVDhHbd.exe
  2⤵
  PID:8028
- C:\Windows\System\oKkuTOo.exe
  C:\Windows\System\oKkuTOo.exe
  2⤵
  PID:8080
- C:\Windows\System\JuHAbAB.exe
  C:\Windows\System\JuHAbAB.exe
  2⤵
  PID:8096
- C:\Windows\System\ygREliQ.exe
  C:\Windows\System\ygREliQ.exe
  2⤵
  PID:8128
- C:\Windows\System\MuzjqJj.exe
  C:\Windows\System\MuzjqJj.exe
  2⤵
  PID:8160
- C:\Windows\System\SFRBkrA.exe
  C:\Windows\System\SFRBkrA.exe
  2⤵
  PID:7292
- C:\Windows\System\iVNExSw.exe
  C:\Windows\System\iVNExSw.exe
  2⤵
  PID:6392
- C:\Windows\System\Hahtmsu.exe
  C:\Windows\System\Hahtmsu.exe
  2⤵
  PID:7140
- C:\Windows\System\WiMvOeJ.exe
  C:\Windows\System\WiMvOeJ.exe
  2⤵
  PID:6512
- C:\Windows\System\BjzkHKz.exe
  C:\Windows\System\BjzkHKz.exe
  2⤵
  PID:7212
- C:\Windows\System\yKnYftn.exe
  C:\Windows\System\yKnYftn.exe
  2⤵
  PID:7324
- C:\Windows\System\jUJmlDg.exe
  C:\Windows\System\jUJmlDg.exe
  2⤵
  PID:7492
- C:\Windows\System\leQUhMF.exe
  C:\Windows\System\leQUhMF.exe
  2⤵
  PID:7344
- C:\Windows\System\klMQnzA.exe
  C:\Windows\System\klMQnzA.exe
  2⤵
  PID:7520
- C:\Windows\System\DiDWsMt.exe
  C:\Windows\System\DiDWsMt.exe
  2⤵
  PID:7424
- C:\Windows\System\ZiTjobq.exe
  C:\Windows\System\ZiTjobq.exe
  2⤵
  PID:7572
- C:\Windows\System\gPWVGIT.exe
  C:\Windows\System\gPWVGIT.exe
  2⤵
  PID:7508
- C:\Windows\System\QOGThke.exe
  C:\Windows\System\QOGThke.exe
  2⤵
  PID:7664
- C:\Windows\System\DvsnVjk.exe
  C:\Windows\System\DvsnVjk.exe
  2⤵
  PID:7836
- C:\Windows\System\VKTXOVM.exe
  C:\Windows\System\VKTXOVM.exe
  2⤵
  PID:7980
- C:\Windows\System\JZRVVzz.exe
  C:\Windows\System\JZRVVzz.exe
  2⤵
  PID:7800
- C:\Windows\System\VZudQnX.exe
  C:\Windows\System\VZudQnX.exe
  2⤵
  PID:7916
- C:\Windows\System\iVZTbHO.exe
  C:\Windows\System\iVZTbHO.exe
  2⤵
  PID:8172
- C:\Windows\System\jrCbJtm.exe
  C:\Windows\System\jrCbJtm.exe
  2⤵
  PID:7260
- C:\Windows\System\XGtIZPY.exe
  C:\Windows\System\XGtIZPY.exe
  2⤵
  PID:7340
- C:\Windows\System\MBjBOyX.exe
  C:\Windows\System\MBjBOyX.exe
  2⤵
  PID:7964
- C:\Windows\System\sjTHiWX.exe
  C:\Windows\System\sjTHiWX.exe
  2⤵
  PID:8060
- C:\Windows\System\vsFrpbk.exe
  C:\Windows\System\vsFrpbk.exe
  2⤵
  PID:6608
- C:\Windows\System\XUXRGOu.exe
  C:\Windows\System\XUXRGOu.exe
  2⤵
  PID:7536
- C:\Windows\System\MEzxUfM.exe
  C:\Windows\System\MEzxUfM.exe
  2⤵
  PID:7488
- C:\Windows\System\FozKmbN.exe
  C:\Windows\System\FozKmbN.exe
  2⤵
  PID:6684
- C:\Windows\System\rmeLmMM.exe
  C:\Windows\System\rmeLmMM.exe
  2⤵
  PID:7748
- C:\Windows\System\imwjzgz.exe
  C:\Windows\System\imwjzgz.exe
  2⤵
  PID:7588
- C:\Windows\System\HfweQvA.exe
  C:\Windows\System\HfweQvA.exe
  2⤵
  PID:7920
- C:\Windows\System\NkyWBNf.exe
  C:\Windows\System\NkyWBNf.exe
  2⤵
  PID:7616
- C:\Windows\System\KlZQdhP.exe
  C:\Windows\System\KlZQdhP.exe
  2⤵
  PID:7524
- C:\Windows\System\XczpoCY.exe
  C:\Windows\System\XczpoCY.exe
  2⤵
  PID:8140
- C:\Windows\System\hSEwpuO.exe
  C:\Windows\System\hSEwpuO.exe
  2⤵
  PID:7388
- C:\Windows\System\oLNHByw.exe
  C:\Windows\System\oLNHByw.exe
  2⤵
  PID:8048
- C:\Windows\System\mXMSJha.exe
  C:\Windows\System\mXMSJha.exe
  2⤵
  PID:7752
- C:\Windows\System\mgIzyNC.exe
  C:\Windows\System\mgIzyNC.exe
  2⤵
  PID:6200
- C:\Windows\System\OEtHahq.exe
  C:\Windows\System\OEtHahq.exe
  2⤵
  PID:8196
- C:\Windows\System\OOYRFYa.exe
  C:\Windows\System\OOYRFYa.exe
  2⤵
  PID:8212
- C:\Windows\System\VmdZlqU.exe
  C:\Windows\System\VmdZlqU.exe
  2⤵
  PID:8228
- C:\Windows\System\xFCBoKC.exe
  C:\Windows\System\xFCBoKC.exe
  2⤵
  PID:8248
- C:\Windows\System\aRDGGNS.exe
  C:\Windows\System\aRDGGNS.exe
  2⤵
  PID:8264
- C:\Windows\System\PtQGCWJ.exe
  C:\Windows\System\PtQGCWJ.exe
  2⤵
  PID:8284
- C:\Windows\System\lGxgfjw.exe
  C:\Windows\System\lGxgfjw.exe
  2⤵
  PID:8300
- C:\Windows\System\UKpMQMP.exe
  C:\Windows\System\UKpMQMP.exe
  2⤵
  PID:8316
- C:\Windows\System\wpNjDIo.exe
  C:\Windows\System\wpNjDIo.exe
  2⤵
  PID:8332
- C:\Windows\System\HDYPayz.exe
  C:\Windows\System\HDYPayz.exe
  2⤵
  PID:8348
- C:\Windows\System\pYZZYen.exe
  C:\Windows\System\pYZZYen.exe
  2⤵
  PID:8364
- C:\Windows\System\cqLskVK.exe
  C:\Windows\System\cqLskVK.exe
  2⤵
  PID:8380
- C:\Windows\System\GUWZUUV.exe
  C:\Windows\System\GUWZUUV.exe
  2⤵
  PID:8396
- C:\Windows\System\DsVdLpz.exe
  C:\Windows\System\DsVdLpz.exe
  2⤵
  PID:8412
- C:\Windows\System\JaJWZDF.exe
  C:\Windows\System\JaJWZDF.exe
  2⤵
  PID:8428
- C:\Windows\System\zWhFqYY.exe
  C:\Windows\System\zWhFqYY.exe
  2⤵
  PID:8444
- C:\Windows\System\PyZsMTa.exe
  C:\Windows\System\PyZsMTa.exe
  2⤵
  PID:8460
- C:\Windows\System\WURxCir.exe
  C:\Windows\System\WURxCir.exe
  2⤵
  PID:8476
- C:\Windows\System\iRcnqea.exe
  C:\Windows\System\iRcnqea.exe
  2⤵
  PID:8492
- C:\Windows\System\LVXZqIQ.exe
  C:\Windows\System\LVXZqIQ.exe
  2⤵
  PID:8508
- C:\Windows\System\DCzCxju.exe
  C:\Windows\System\DCzCxju.exe
  2⤵
  PID:8524
- C:\Windows\System\eknpCYO.exe
  C:\Windows\System\eknpCYO.exe
  2⤵
  PID:8540
- C:\Windows\System\ioaGMCA.exe
  C:\Windows\System\ioaGMCA.exe
  2⤵
  PID:8556
- C:\Windows\System\zVVifBz.exe
  C:\Windows\System\zVVifBz.exe
  2⤵
  PID:8572
- C:\Windows\System\TblMnvH.exe
  C:\Windows\System\TblMnvH.exe
  2⤵
  PID:8588
- C:\Windows\System\LQbGJgq.exe
  C:\Windows\System\LQbGJgq.exe
  2⤵
  PID:8604
- C:\Windows\System\TEVBYco.exe
  C:\Windows\System\TEVBYco.exe
  2⤵
  PID:8620
- C:\Windows\System\lDiQYSD.exe
  C:\Windows\System\lDiQYSD.exe
  2⤵
  PID:8636
- C:\Windows\System\ZRNPePY.exe
  C:\Windows\System\ZRNPePY.exe
  2⤵
  PID:8652
- C:\Windows\System\UoCBGaJ.exe
  C:\Windows\System\UoCBGaJ.exe
  2⤵
  PID:8668
- C:\Windows\System\wbDDOCZ.exe
  C:\Windows\System\wbDDOCZ.exe
  2⤵
  PID:8684
- C:\Windows\System\wgrgbSg.exe
  C:\Windows\System\wgrgbSg.exe
  2⤵
  PID:8700
- C:\Windows\System\GOakfhv.exe
  C:\Windows\System\GOakfhv.exe
  2⤵
  PID:8716
- C:\Windows\System\uZgdpSY.exe
  C:\Windows\System\uZgdpSY.exe
  2⤵
  PID:8732
- C:\Windows\System\pzjqYJZ.exe
  C:\Windows\System\pzjqYJZ.exe
  2⤵
  PID:8748
- C:\Windows\System\venbwop.exe
  C:\Windows\System\venbwop.exe
  2⤵
  PID:8764
- C:\Windows\System\URHgAXv.exe
  C:\Windows\System\URHgAXv.exe
  2⤵
  PID:8780
- C:\Windows\System\tMMtBuJ.exe
  C:\Windows\System\tMMtBuJ.exe
  2⤵
  PID:8796
- C:\Windows\System\KzoGikK.exe
  C:\Windows\System\KzoGikK.exe
  2⤵
  PID:8812
- C:\Windows\System\iByPXxK.exe
  C:\Windows\System\iByPXxK.exe
  2⤵
  PID:8828
- C:\Windows\System\LxPbPIH.exe
  C:\Windows\System\LxPbPIH.exe
  2⤵
  PID:8844
- C:\Windows\System\TbELxmj.exe
  C:\Windows\System\TbELxmj.exe
  2⤵
  PID:8860
- C:\Windows\System\TJxzWoc.exe
  C:\Windows\System\TJxzWoc.exe
  2⤵
  PID:8876
- C:\Windows\System\ZnPZASF.exe
  C:\Windows\System\ZnPZASF.exe
  2⤵
  PID:8892
- C:\Windows\System\NVmPJAu.exe
  C:\Windows\System\NVmPJAu.exe
  2⤵
  PID:8908
- C:\Windows\System\sQZglUR.exe
  C:\Windows\System\sQZglUR.exe
  2⤵
  PID:8924
- C:\Windows\System\VaiidUQ.exe
  C:\Windows\System\VaiidUQ.exe
  2⤵
  PID:8940
- C:\Windows\System\ztWhpdq.exe
  C:\Windows\System\ztWhpdq.exe
  2⤵
  PID:8956
- C:\Windows\System\AgpVivM.exe
  C:\Windows\System\AgpVivM.exe
  2⤵
  PID:8972
- C:\Windows\System\oiobucD.exe
  C:\Windows\System\oiobucD.exe
  2⤵
  PID:8988
- C:\Windows\System\oAaLtby.exe
  C:\Windows\System\oAaLtby.exe
  2⤵
  PID:9004
- C:\Windows\System\XQUTBKK.exe
  C:\Windows\System\XQUTBKK.exe
  2⤵
  PID:9020
- C:\Windows\System\grxPWjM.exe
  C:\Windows\System\grxPWjM.exe
  2⤵
  PID:9036
- C:\Windows\System\qibehgH.exe
  C:\Windows\System\qibehgH.exe
  2⤵
  PID:9052
- C:\Windows\System\vNJnIvl.exe
  C:\Windows\System\vNJnIvl.exe
  2⤵
  PID:9068
- C:\Windows\System\cTcEmZd.exe
  C:\Windows\System\cTcEmZd.exe
  2⤵
  PID:9084
- C:\Windows\System\zNXgiDx.exe
  C:\Windows\System\zNXgiDx.exe
  2⤵
  PID:9100
- C:\Windows\System\TxHLZde.exe
  C:\Windows\System\TxHLZde.exe
  2⤵
  PID:9116
- C:\Windows\System\AhzwLKx.exe
  C:\Windows\System\AhzwLKx.exe
  2⤵
  PID:9132
- C:\Windows\System\wwFfyDJ.exe
  C:\Windows\System\wwFfyDJ.exe
  2⤵
  PID:9148
- C:\Windows\System\KsTyWJV.exe
  C:\Windows\System\KsTyWJV.exe
  2⤵
  PID:9164
- C:\Windows\System\CImZuNy.exe
  C:\Windows\System\CImZuNy.exe
  2⤵
  PID:9180
- C:\Windows\System\DYWTizT.exe
  C:\Windows\System\DYWTizT.exe
  2⤵
  PID:9196
- C:\Windows\System\tOomYyu.exe
  C:\Windows\System\tOomYyu.exe
  2⤵
  PID:9212
- C:\Windows\System\iRkBFYi.exe
  C:\Windows\System\iRkBFYi.exe
  2⤵
  PID:8236
- C:\Windows\System\AzPzeQL.exe
  C:\Windows\System\AzPzeQL.exe
  2⤵
  PID:8272
- C:\Windows\System\mASynUO.exe
  C:\Windows\System\mASynUO.exe
  2⤵
  PID:8280
- C:\Windows\System\YPnYCkx.exe
  C:\Windows\System\YPnYCkx.exe
  2⤵
  PID:8292
- C:\Windows\System\PhjgAWe.exe
  C:\Windows\System\PhjgAWe.exe
  2⤵
  PID:8340
- C:\Windows\System\CvytZLT.exe
  C:\Windows\System\CvytZLT.exe
  2⤵
  PID:8372
- C:\Windows\System\JtwkUOM.exe
  C:\Windows\System\JtwkUOM.exe
  2⤵
  PID:8436
- C:\Windows\System\sdwvEHN.exe
  C:\Windows\System\sdwvEHN.exe
  2⤵
  PID:8472
- C:\Windows\System\ookyPRb.exe
  C:\Windows\System\ookyPRb.exe
  2⤵
  PID:8420
- C:\Windows\System\IjUGLqL.exe
  C:\Windows\System\IjUGLqL.exe
  2⤵
  PID:8424
- C:\Windows\System\sIkVZWS.exe
  C:\Windows\System\sIkVZWS.exe
  2⤵
  PID:8516
- C:\Windows\System\HPYKHPM.exe
  C:\Windows\System\HPYKHPM.exe
  2⤵
  PID:8568
- C:\Windows\System\DhZOXXY.exe
  C:\Windows\System\DhZOXXY.exe
  2⤵
  PID:8584
- C:\Windows\System\QpVvlpi.exe
  C:\Windows\System\QpVvlpi.exe
  2⤵
  PID:8648
- C:\Windows\System\vsZLGvR.exe
  C:\Windows\System\vsZLGvR.exe
  2⤵
  PID:8660
- C:\Windows\System\LsSFHfQ.exe
  C:\Windows\System\LsSFHfQ.exe
  2⤵
  PID:8712
- C:\Windows\System\yYaxczr.exe
  C:\Windows\System\yYaxczr.exe
  2⤵
  PID:8696
- C:\Windows\System\QQIdCrq.exe
  C:\Windows\System\QQIdCrq.exe
  2⤵
  PID:8740
- C:\Windows\System\VMwAxpx.exe
  C:\Windows\System\VMwAxpx.exe
  2⤵
  PID:8808
- C:\Windows\System\MlKKXKM.exe
  C:\Windows\System\MlKKXKM.exe
  2⤵
  PID:8804
- C:\Windows\System\LdyiokE.exe
  C:\Windows\System\LdyiokE.exe
  2⤵
  PID:8792
- C:\Windows\System\EXRFbTH.exe
  C:\Windows\System\EXRFbTH.exe
  2⤵
  PID:8824
- C:\Windows\System\vdbjxwp.exe
  C:\Windows\System\vdbjxwp.exe
  2⤵
  PID:8904
- C:\Windows\System\LsXdCxo.exe
  C:\Windows\System\LsXdCxo.exe
  2⤵
  PID:8916
- C:\Windows\System\YNZhzdu.exe
  C:\Windows\System\YNZhzdu.exe
  2⤵
  PID:8968
- C:\Windows\System\dhZltJm.exe
  C:\Windows\System\dhZltJm.exe
  2⤵
  PID:8980
- C:\Windows\System\qpFJYKi.exe
  C:\Windows\System\qpFJYKi.exe
  2⤵
  PID:9016
- C:\Windows\System\ZvRAJbF.exe
  C:\Windows\System\ZvRAJbF.exe
  2⤵
  PID:9060
- C:\Windows\System\MUyuOhf.exe
  C:\Windows\System\MUyuOhf.exe
  2⤵
  PID:9156
- C:\Windows\System\JPLhHZg.exe
  C:\Windows\System\JPLhHZg.exe
  2⤵
  PID:9080
- C:\Windows\System\mZOmMhD.exe
  C:\Windows\System\mZOmMhD.exe
  2⤵
  PID:9192
- C:\Windows\System\TZfeygK.exe
  C:\Windows\System\TZfeygK.exe
  2⤵
  PID:7636
- C:\Windows\System\hilWyhI.exe
  C:\Windows\System\hilWyhI.exe
  2⤵
  PID:8308
- C:\Windows\System\GnxmBVg.exe
  C:\Windows\System\GnxmBVg.exe
  2⤵
  PID:8404
- C:\Windows\System\RYUNiPz.exe
  C:\Windows\System\RYUNiPz.exe
  2⤵
  PID:8256
- C:\Windows\System\TMyccsb.exe
  C:\Windows\System\TMyccsb.exe
  2⤵
  PID:8468
- C:\Windows\System\VpQUSxN.exe
  C:\Windows\System\VpQUSxN.exe
  2⤵
  PID:8532
- C:\Windows\System\lSogTZS.exe
  C:\Windows\System\lSogTZS.exe
  2⤵
  PID:8408
- C:\Windows\System\sAWypmy.exe
  C:\Windows\System\sAWypmy.exe
  2⤵
  PID:8456
- C:\Windows\System\UWfHFDc.exe
  C:\Windows\System\UWfHFDc.exe
  2⤵
  PID:8580
- C:\Windows\System\bknclrl.exe
  C:\Windows\System\bknclrl.exe
  2⤵
  PID:8724
- C:\Windows\System\YTYIDTK.exe
  C:\Windows\System\YTYIDTK.exe
  2⤵
  PID:8840
- C:\Windows\System\HymKOSu.exe
  C:\Windows\System\HymKOSu.exe
  2⤵
  PID:8888
- C:\Windows\System\PTMdyAc.exe
  C:\Windows\System\PTMdyAc.exe
  2⤵
  PID:9092
- C:\Windows\System\IFTYbmQ.exe
  C:\Windows\System\IFTYbmQ.exe
  2⤵
  PID:8692
- C:\Windows\System\TANzzQl.exe
  C:\Windows\System\TANzzQl.exe
  2⤵
  PID:8836
- C:\Windows\System\ngzljEq.exe
  C:\Windows\System\ngzljEq.exe
  2⤵
  PID:9012
- C:\Windows\System\HLDfLRI.exe
  C:\Windows\System\HLDfLRI.exe
  2⤵
  PID:9188
- C:\Windows\System\VpuDyTL.exe
  C:\Windows\System\VpuDyTL.exe
  2⤵
  PID:8932
- C:\Windows\System\wUOLdfW.exe
  C:\Windows\System\wUOLdfW.exe
  2⤵
  PID:8244
- C:\Windows\System\jpVOUlq.exe
  C:\Windows\System\jpVOUlq.exe
  2⤵
  PID:9204
- C:\Windows\System\JxBrpxs.exe
  C:\Windows\System\JxBrpxs.exe
  2⤵
  PID:8548
- C:\Windows\System\TBhuOsU.exe
  C:\Windows\System\TBhuOsU.exe
  2⤵
  PID:8776
- C:\Windows\System\CffhkAq.exe
  C:\Windows\System\CffhkAq.exe
  2⤵
  PID:8504
- C:\Windows\System\LAFcAsq.exe
  C:\Windows\System\LAFcAsq.exe
  2⤵
  PID:9076
- C:\Windows\System\pYyjzgu.exe
  C:\Windows\System\pYyjzgu.exe
  2⤵
  PID:9048
- C:\Windows\System\JABUQuX.exe
  C:\Windows\System\JABUQuX.exe
  2⤵
  PID:7888
- C:\Windows\System\RChcCDY.exe
  C:\Windows\System\RChcCDY.exe
  2⤵
  PID:8356
- C:\Windows\System\gEznBxt.exe
  C:\Windows\System\gEznBxt.exe
  2⤵
  PID:8392
- C:\Windows\System\mjvEbsf.exe
  C:\Windows\System\mjvEbsf.exe
  2⤵
  PID:8964
- C:\Windows\System\AhGlhRs.exe
  C:\Windows\System\AhGlhRs.exe
  2⤵
  PID:9232
- C:\Windows\System\uLmSHki.exe
  C:\Windows\System\uLmSHki.exe
  2⤵
  PID:9248
- C:\Windows\System\ZBPddHj.exe
  C:\Windows\System\ZBPddHj.exe
  2⤵
  PID:9264
- C:\Windows\System\AHlLEVK.exe
  C:\Windows\System\AHlLEVK.exe
  2⤵
  PID:9280
- C:\Windows\System\cFCZdUs.exe
  C:\Windows\System\cFCZdUs.exe
  2⤵
  PID:9296
- C:\Windows\System\WbjgxxO.exe
  C:\Windows\System\WbjgxxO.exe
  2⤵
  PID:9312
- C:\Windows\System\JfjHqhY.exe
  C:\Windows\System\JfjHqhY.exe
  2⤵
  PID:9328
- C:\Windows\System\VxAhzpN.exe
  C:\Windows\System\VxAhzpN.exe
  2⤵
  PID:9344
- C:\Windows\System\zNsXLkC.exe
  C:\Windows\System\zNsXLkC.exe
  2⤵
  PID:9360
- C:\Windows\System\nqAfVfv.exe
  C:\Windows\System\nqAfVfv.exe
  2⤵
  PID:9376
- C:\Windows\System\wjxoagY.exe
  C:\Windows\System\wjxoagY.exe
  2⤵
  PID:9392
- C:\Windows\System\kAnHGMb.exe
  C:\Windows\System\kAnHGMb.exe
  2⤵
  PID:9408
- C:\Windows\System\FBBrvmc.exe
  C:\Windows\System\FBBrvmc.exe
  2⤵
  PID:9424
- C:\Windows\System\RPpFSgL.exe
  C:\Windows\System\RPpFSgL.exe
  2⤵
  PID:9440
- C:\Windows\System\tpXubqf.exe
  C:\Windows\System\tpXubqf.exe
  2⤵
  PID:9456
- C:\Windows\System\EudKmws.exe
  C:\Windows\System\EudKmws.exe
  2⤵
  PID:9472
- C:\Windows\System\YzFwpkR.exe
  C:\Windows\System\YzFwpkR.exe
  2⤵
  PID:9492
- C:\Windows\System\eVkcDVG.exe
  C:\Windows\System\eVkcDVG.exe
  2⤵
  PID:9508
- C:\Windows\System\SKOYYQc.exe
  C:\Windows\System\SKOYYQc.exe
  2⤵
  PID:9524
- C:\Windows\System\POEBaXv.exe
  C:\Windows\System\POEBaXv.exe
  2⤵
  PID:9540
- C:\Windows\System\iIPZFnK.exe
  C:\Windows\System\iIPZFnK.exe
  2⤵
  PID:9556
- C:\Windows\System\ekwCrBl.exe
  C:\Windows\System\ekwCrBl.exe
  2⤵
  PID:9572
- C:\Windows\System\bQXYBDp.exe
  C:\Windows\System\bQXYBDp.exe
  2⤵
  PID:9588
- C:\Windows\System\rbhNtkg.exe
  C:\Windows\System\rbhNtkg.exe
  2⤵
  PID:9604
- C:\Windows\System\qryrdeZ.exe
  C:\Windows\System\qryrdeZ.exe
  2⤵
  PID:9620
- C:\Windows\System\EQOXRlt.exe
  C:\Windows\System\EQOXRlt.exe
  2⤵
  PID:9636
- C:\Windows\System\BhaUUMN.exe
  C:\Windows\System\BhaUUMN.exe
  2⤵
  PID:9652
- C:\Windows\System\nDPnGqh.exe
  C:\Windows\System\nDPnGqh.exe
  2⤵
  PID:9672
- C:\Windows\System\TJVNHab.exe
  C:\Windows\System\TJVNHab.exe
  2⤵
  PID:9688
- C:\Windows\System\bNXcscq.exe
  C:\Windows\System\bNXcscq.exe
  2⤵
  PID:9704
- C:\Windows\System\Tkbrgko.exe
  C:\Windows\System\Tkbrgko.exe
  2⤵
  PID:9720
- C:\Windows\System\TwaSbYX.exe
  C:\Windows\System\TwaSbYX.exe
  2⤵
  PID:9736
- C:\Windows\System\sUARAcl.exe
  C:\Windows\System\sUARAcl.exe
  2⤵
  PID:9752
- C:\Windows\System\ExLXokk.exe
  C:\Windows\System\ExLXokk.exe
  2⤵
  PID:9768
- C:\Windows\System\fCjmNmV.exe
  C:\Windows\System\fCjmNmV.exe
  2⤵
  PID:9784
- C:\Windows\System\nXhMXUz.exe
  C:\Windows\System\nXhMXUz.exe
  2⤵
  PID:9800
- C:\Windows\System\zsusBEK.exe
  C:\Windows\System\zsusBEK.exe
  2⤵
  PID:9816
- C:\Windows\System\qpABfFD.exe
  C:\Windows\System\qpABfFD.exe
  2⤵
  PID:9832
- C:\Windows\System\rqsftMq.exe
  C:\Windows\System\rqsftMq.exe
  2⤵
  PID:9848
- C:\Windows\System\avQdcjd.exe
  C:\Windows\System\avQdcjd.exe
  2⤵
  PID:9868
- C:\Windows\System\mQhVPgq.exe
  C:\Windows\System\mQhVPgq.exe
  2⤵
  PID:9884
- C:\Windows\System\HnvVsTU.exe
  C:\Windows\System\HnvVsTU.exe
  2⤵
  PID:9900
- C:\Windows\System\eIJjfzB.exe
  C:\Windows\System\eIJjfzB.exe
  2⤵
  PID:9916
- C:\Windows\System\lLBvKHG.exe
  C:\Windows\System\lLBvKHG.exe
  2⤵
  PID:9932
- C:\Windows\System\qqqdLuc.exe
  C:\Windows\System\qqqdLuc.exe
  2⤵
  PID:9948
- C:\Windows\System\dvORXJb.exe
  C:\Windows\System\dvORXJb.exe
  2⤵
  PID:9964
- C:\Windows\System\ydmrebN.exe
  C:\Windows\System\ydmrebN.exe
  2⤵
  PID:9980
- C:\Windows\System\vEEOlZM.exe
  C:\Windows\System\vEEOlZM.exe
  2⤵
  PID:9996
- C:\Windows\System\AEpCwFl.exe
  C:\Windows\System\AEpCwFl.exe
  2⤵
  PID:10012
- C:\Windows\System\BSwKagi.exe
  C:\Windows\System\BSwKagi.exe
  2⤵
  PID:10028
- C:\Windows\System\SGBZCyr.exe
  C:\Windows\System\SGBZCyr.exe
  2⤵
  PID:10044
- C:\Windows\System\PlSWUaV.exe
  C:\Windows\System\PlSWUaV.exe
  2⤵
  PID:10060
- C:\Windows\System\dPqYTve.exe
  C:\Windows\System\dPqYTve.exe
  2⤵
  PID:10076
- C:\Windows\System\peVpZQE.exe
  C:\Windows\System\peVpZQE.exe
  2⤵
  PID:10092
- C:\Windows\System\fAEDEEW.exe
  C:\Windows\System\fAEDEEW.exe
  2⤵
  PID:10108
- C:\Windows\System\RoxmRxf.exe
  C:\Windows\System\RoxmRxf.exe
  2⤵
  PID:10124
- C:\Windows\System\vzmhAvO.exe
  C:\Windows\System\vzmhAvO.exe
  2⤵
  PID:10140
- C:\Windows\System\bkavcUP.exe
  C:\Windows\System\bkavcUP.exe
  2⤵
  PID:10156
- C:\Windows\System\fyGWCnl.exe
  C:\Windows\System\fyGWCnl.exe
  2⤵
  PID:10176
- C:\Windows\System\npsKuwK.exe
  C:\Windows\System\npsKuwK.exe
  2⤵
  PID:10192
- C:\Windows\System\VJNrqRy.exe
  C:\Windows\System\VJNrqRy.exe
  2⤵
  PID:10208
- C:\Windows\System\DPMWyLp.exe
  C:\Windows\System\DPMWyLp.exe
  2⤵
  PID:10224
- C:\Windows\System\aHDlbBe.exe
  C:\Windows\System\aHDlbBe.exe
  2⤵
  PID:8948
- C:\Windows\System\TewwNpy.exe
  C:\Windows\System\TewwNpy.exe
  2⤵
  PID:8984
- C:\Windows\System\tqfVuXS.exe
  C:\Windows\System\tqfVuXS.exe
  2⤵
  PID:9228
- C:\Windows\System\cvKWFvi.exe
  C:\Windows\System\cvKWFvi.exe
  2⤵
  PID:9244
- C:\Windows\System\mCsjWxF.exe
  C:\Windows\System\mCsjWxF.exe
  2⤵
  PID:9304
- C:\Windows\System\zgfDKSF.exe
  C:\Windows\System\zgfDKSF.exe
  2⤵
  PID:9324
- C:\Windows\System\gFuwQPO.exe
  C:\Windows\System\gFuwQPO.exe
  2⤵
  PID:9352
- C:\Windows\System\IGkzOBB.exe
  C:\Windows\System\IGkzOBB.exe
  2⤵
  PID:9420
- C:\Windows\System\nFKCMbw.exe
  C:\Windows\System\nFKCMbw.exe
  2⤵
  PID:9340
- C:\Windows\System\JlsEZve.exe
  C:\Windows\System\JlsEZve.exe
  2⤵
  PID:8276
- C:\Windows\System\QIyGVFc.exe
  C:\Windows\System\QIyGVFc.exe
  2⤵
  PID:9468
- C:\Windows\System\SINzUfX.exe
  C:\Windows\System\SINzUfX.exe
  2⤵
  PID:9368
- C:\Windows\System\ERWJbTC.exe
  C:\Windows\System\ERWJbTC.exe
  2⤵
  PID:9552
- C:\Windows\System\UzEDirw.exe
  C:\Windows\System\UzEDirw.exe
  2⤵
  PID:9536
- C:\Windows\System\lHSWEXe.exe
  C:\Windows\System\lHSWEXe.exe
  2⤵
  PID:9596
- C:\Windows\System\qebhnzq.exe
  C:\Windows\System\qebhnzq.exe
  2⤵
  PID:9644
- C:\Windows\System\FZYLxxY.exe
  C:\Windows\System\FZYLxxY.exe
  2⤵
  PID:9660
- C:\Windows\System\QqdZlqY.exe
  C:\Windows\System\QqdZlqY.exe
  2⤵
  PID:9696
- C:\Windows\System\inKTVSi.exe
  C:\Windows\System\inKTVSi.exe
  2⤵
  PID:9732
- C:\Windows\System\PNnQitk.exe
  C:\Windows\System\PNnQitk.exe
  2⤵
  PID:9796
- C:\Windows\System\cshKBfz.exe
  C:\Windows\System\cshKBfz.exe
  2⤵
  PID:9860
- C:\Windows\System\vgDaMdO.exe
  C:\Windows\System\vgDaMdO.exe
  2⤵
  PID:9924
- C:\Windows\System\xdrTNvW.exe
  C:\Windows\System\xdrTNvW.exe
  2⤵
  PID:9748
- C:\Windows\System\IMmITAi.exe
  C:\Windows\System\IMmITAi.exe
  2⤵
  PID:9776
- C:\Windows\System\DKRfVOS.exe
  C:\Windows\System\DKRfVOS.exe
  2⤵
  PID:9840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BxqwXEL.exe

Filesize
1.4MB

MD5
a4b37573bc5fddebcb0c52d8a338a663

SHA1
81dc871105aa9b6cfe6c01ea26e0a9c47007168a

SHA256
3a37f54244f327fa772d9369efd729e402c27cdfcbe2a23dbe489907e8bdc036

SHA512
05010f0669997030db328f175ef87eab473afa6a6000f8f7206b9a2e38bb154ffa1f46c0fd6018545620f12303d75425cb07b73602b34c990255439c358a8dd3

Download Submit
C:\Windows\system\ClOMbVZ.exe

Filesize
1.4MB

MD5
124c8a1b7747f0ef2766142d79da75aa

SHA1
f4d8af054a868731460b515f54d05232e8e193ad

SHA256
3e0d89db6448e1928a4e9946c995de822202853839d303a252e7558577934156

SHA512
725d1a8503a44e23e55a68b59db6cc48b8268921c2caf12d256b9482524243a2f6bf9f1be1b61f7f08ecf74485f8575fc81a88254a03ad7572954e27d878e2a0

Download Submit
C:\Windows\system\ENticNg.exe

Filesize
1.4MB

MD5
59c22c19fcddb7257cf204d6250d4119

SHA1
1647e4572d59fa899c4676e43b08a93d365a8898

SHA256
804fb7b3db009f66bde2db8e3816d1698495d5d244ecd3271c8aa7d08b80cef9

SHA512
8788b6d6bd80bd057035711e027c3b41d7434cf6a35fc77dd06a9e29a8b3239b03a616d1ba4238dcd925b6bb008f0f3a125cfeedc9477b752d714c0d0a7590d0

Download Submit
C:\Windows\system\GhzCfpp.exe

Filesize
1.4MB

MD5
ef6f11f6ad8ff0918af16c8800c6efcb

SHA1
5dcdbb82d77f21459b5c24c82a7de49e8b76855d

SHA256
9a40995995bda2087de5d6307bd5dcb7495a0642405c1fbc4bb67e3a34a60a3b

SHA512
f1c87448a23f77f6ab0ebb2ea515814940af28e7e0fd2ff47ff1a8248ad2c875dea3377e0ee0ae299426e3bbfce8035d7aaca2b3f7095ba2a437c3637baaba39

Download Submit
C:\Windows\system\KDLitdv.exe

Filesize
1.4MB

MD5
9de7ee196129522aeee3d7284b854edf

SHA1
5b6fe14ac7541007decb4b4b48e04b622459c20d

SHA256
0bad6d47df3a10a759291e19fe7ff26b05f7d16b5955c8e1a11876ea7a92c39d

SHA512
63fea2966498acc2b9864f9032de293e1a8b0cd1f46dea7dd7ff43b9a7e8349aedf415595a9d822831591a25d2bb3ad134e36240f9d05f109b65ce7c52e4e15c

Download Submit
C:\Windows\system\PHcZTLC.exe

Filesize
1.4MB

MD5
c46069734b93b5a603cb6f7a69997fef

SHA1
903b0133d2aa4790578c223342b38e69f9e1eea9

SHA256
6f4ff6c603adcf6427a3f08679fce350b099aa75159d9f0be0027f8dae2b9d9c

SHA512
566d173024a727c907580510f0ae83c3ff2b71c15ceea4cfc5a4b6db6f59cc434582c1745a7e0dfa8f997b4fd2e290ced4fb8959cc27a5db7e11b022165d704c

Download Submit
C:\Windows\system\QiMMvyD.exe

Filesize
1.4MB

MD5
662c96451e9fd85e32be2cc18be98a70

SHA1
52580801c2bbc440737ab59060f825a3c727c0cf

SHA256
49913b8b679a30c1b8fa735cef2ca06451424340bf34affa1b9760df5983e223

SHA512
4e0565f706e0041364793ede03a55333eaeb147c3cf98c2897b89cf6af788d7e2b7d4a8f6a79ac9489c69ce474646df23e4a363579a7fa104d488a8ac5c00fce

Download Submit
C:\Windows\system\QsJnTCw.exe

Filesize
1.4MB

MD5
f528848ef5a6f7b8646900cc6517b902

SHA1
be81a96a899a312afc65411969f60321b50b8fd4

SHA256
bedd1f2db7c217162e7f73e12061183de01ee4c38043b048d6801c36ae0685e7

SHA512
0dd2846123be2a1c9ce6a0418b9b318858cdc0107eb33d1cb43d2006a38ca95fd78bab7ce4cb7a6c2133a01ad085da7b8514ffacde75d6ecc8985397e0b67b0c

Download Submit
C:\Windows\system\SoIDEpO.exe

Filesize
1.4MB

MD5
a1c1af34206a33fb698bb57c06c5f655

SHA1
a4ee6baa751764ac2e9fa363ad23c8a3eb96b170

SHA256
4abf3b1a32e1735d1215e8f5882b44140f9eb3a5ddf7a49e089f0cddf5244c8c

SHA512
d9dfdab44356f0f390e90127207c31c58f4559b67bf91a1cc778c243d6cc2310b9e754f1f2291ea26c506cfc13a06f5d62b0498d783c16ac7841b2bd24158bdf

Download Submit
C:\Windows\system\UmXIMOG.exe

Filesize
1.4MB

MD5
023e251138a5dc5c8370c7a8013ab28b

SHA1
f75f1934d772c6cc961494d6f61558e9e3e03485

SHA256
ee5bcc73a47bdfec9d3b846d2011417498a1356da672c8e142e7d4d44f309c5e

SHA512
a2df3aff358c636b872edf1de3c81ac7dff941ebc558c2413754fdb33aa19e5cae2950ae8b7a3a0bf99b116c06edbafd65e08270d9b11fc87cde4674140a6190

Download Submit
C:\Windows\system\aThvUum.exe

Filesize
1.4MB

MD5
b58465672d446b56e64c79f340abcbee

SHA1
f2146dfc8d91ed6262b0bbf2114bc41304451a7e

SHA256
35b7cb6fb337d2918192c52c29b643ff56ee42c36076e1aa7a31592b01c9217c

SHA512
9dcd69b260d3c4e54a7e8bd87aae92b1c77e054eef1e68df3e299139635b38d1f5dbe54228372adf7d1df5576d8c86eab88954fba7de1d810b1975d99d53326c

Download Submit
C:\Windows\system\cPTylXR.exe

Filesize
1.4MB

MD5
2c07ea029ffbf3dd184600b83bc98d5c

SHA1
56828f2765227511e0ecb7faf9b0a80fb69b0e2e

SHA256
343980dba9977bb8b93f9a9463e0774267e117997b90f0e1627729ce0a32086d

SHA512
59f170402118541938503461ee6ff879e35bd05b2a89e6e2c8d86a67a4dd993af1a50af75fdfd38a993c9d781da538ff01adacd112c93772ca7600f00a492190

Download Submit
C:\Windows\system\cPotjsu.exe

Filesize
1.4MB

MD5
448fec800642d3eda23f2e7d1556acec

SHA1
aa90436682def3064d98d81b0bdfd7db3b271f73

SHA256
400a25608e20fff20e83b9ecd6d8b1889d60f4e50f6714571e3f3374bb3567d4

SHA512
31ee2980c13a018eb7e1ba245075293bcdf088659d128bd104393b56651952ca958040aa386be70283e64f025f7e2f91fbb60c890ddeeb9eb6a9e6e22e157b28

Download Submit
C:\Windows\system\dfDEkGu.exe

Filesize
1.4MB

MD5
9028c64f5262dfb3c72126d5f93401bf

SHA1
a58c3b06062e55d82e9597ebf3208294cd8610fc

SHA256
068088fb2542e0677aec0e73674bc38fedeb6cd6fae13ddafa5759041ce9ef06

SHA512
a91fc1455a870c46c72096be2bf1c6d1e63c5ca1ded90459d87db086d3c1dca3045ca618d077ecdcf186fd40949811d185e4968d7dcb8bf3dcf15a0e349ce20c

Download Submit
C:\Windows\system\eCVFvwn.exe

Filesize
1.4MB

MD5
6089ff3115790103dd088d654d94a159

SHA1
2e3fbffe87f4b6ae5d1f6318ba27bc8d5d53abeb

SHA256
468ea8f1447340dfea1db5a278a39e7b036d33fd128e1b99861f600a5a63cfaf

SHA512
26e7f64c5b4076478286c724657d05f09c0fbcd2ec826a67377ea9d205cbb60b0521da85a2a6e52b082a084b2b891d09caf1f0817f19a8d24737b14ee30ed070

Download Submit
C:\Windows\system\hrTEdFA.exe

Filesize
1.4MB

MD5
27d91d9178dd62d109f3ef7fc5b3ea3c

SHA1
88545f1f02aa3155ff8e092f43cecef43ee71294

SHA256
b1d2a1a6356b24f480fa02bffd594e13ed37713e1dc70f85390fedd5088146d5

SHA512
81b6877f40e8964efcd61a0c87f7be3d3012dd0d0bec7cf1661d15d571eb6b1113ca6657cc404d7c433ff1b2aee61f00481d51fb40f8c495aae9c11fe0645d62

Download Submit
C:\Windows\system\huxSXIl.exe

Filesize
1.4MB

MD5
bdd4e91cf7bac09fa9a58cbcd3f6db19

SHA1
34457b50f2f0155993180dc4df339e55a290f34c

SHA256
fcb598ac516891e9e1d51e0351bb83efadbf4228aaaeb878e812b59940600fbf

SHA512
c47ac0b1f61a56cb26e1285ffbbeedcaded4f21eb45af85e2a827cbff4a0a4388def743ccd3f138410651552277dcdb7428980a485f6b4663b93a1edfc07ca27

Download Submit
C:\Windows\system\jzMOirL.exe

Filesize
1.4MB

MD5
b6ba224b77d3865a5fbdc213c170d335

SHA1
a155740ea1fd8db0779df94fb41bf06359ad1b21

SHA256
e0b5d9ec72a78ce6e1cf5494421ff6b70419ca2b872342273865d0f467d6f4d5

SHA512
820c6d33817cb4ac6a8a7e7a9c21fe860eae17426001ea90e99af02bc24c37abbb81ebe2c6ab5664cfbaecda6d146b6d4c4d5ba6acefd4b91c070d97a97a05e9

Download Submit
C:\Windows\system\kbBYUqg.exe

Filesize
1.4MB

MD5
825ecfc0fb8f513086c8ea7893e025c4

SHA1
578bee76671a55271d105a27f74a9f8909b641de

SHA256
0b56b56c6db08f6c05001a4f4965f90140012038d8f984640734879fcb66f108

SHA512
e49be33310e893f4a49168caaeffd9973aab4ed27394e1ebf506df783598e53d4f7e14cc4334d96ab23fb392b8fd6a70830072d1e75289293eaae6d68c9e4159

Download Submit
C:\Windows\system\ldBCeDL.exe

Filesize
1.4MB

MD5
dcd319834bdc94187062b37af7ed8e09

SHA1
246c9b5ceaa3ce873acfbc986659d32fca0936fc

SHA256
103ae411bf54164125113d1802fee7a76c79fdf2aeacd965cb8a0328c47a1d3f

SHA512
af72906ffb6a22dee814ef8580307641b313e26192945c5171f9ce63607d9506979b27799d0e6cf882a51493ea93dfa416900e72c12e3a14b95f9f5b69373a03

Download Submit
C:\Windows\system\mkCColT.exe

Filesize
1.4MB

MD5
e2448c196302cc893c427e500b0e702b

SHA1
00e476f7483c769562c6f095e106315be7989705

SHA256
4978c043ecd477595c106dfebeeb46dbaa249798c657e25c21a771d957afb3a4

SHA512
ef42e4ac6c5fe70622971ea47f6c33ba62a8b5311feb13a7f057c4385c69d045b053160a72f23cd3e1fe0ed07534464b11e40d4f54c86482ddaa833388d59b5e

Download Submit
C:\Windows\system\myhYVSx.exe

Filesize
1.4MB

MD5
f0e05042a092dc56592a4b7344941fb9

SHA1
1375c7a543c45304e7db043f373fc1ba7da182d5

SHA256
517f13e57ac48311288d1a6ec96021b5f7c7123a9c0916cbdbd001d613be15d4

SHA512
55bef1c693dade7ca58893ba08ee2a2036be39f6b693f77516eae69eaa7f43c516221475b1586b0ad47469bff37595063583a3b38308e43e273bfeb2591a6f0b

Download Submit
C:\Windows\system\vLgYmcK.exe

Filesize
1.4MB

MD5
04a05a00750741c1a004560a171dd23a

SHA1
419f7d31e1ef5253fdc3135dcd7ea3644280e3f1

SHA256
453b330157e28c84a58e659d0d24cc10a6c953107873d551e205b277ee633d3a

SHA512
1898a9eb1b1704fcd24045ae2c3d883f0b776dd52870d29956887d9ccbf6df259c911f894fafe065cf7528fa185c5acddfecb861c7deb8525cc9a32bdc7d869c

Download Submit
C:\Windows\system\wZXtCkv.exe

Filesize
1.4MB

MD5
7fa1c606aa33f4e4c250eae2fd495cbc

SHA1
64c9d1e36ad67d343a44e49788d9b868299aabe1

SHA256
c8bc3a72b31382e03539c472eaf68ce978ea1c39eddbd66144650e60661ba5b4

SHA512
8c0006ca8a3abb589566a949f5e7f5da9a99190a146e2baca5be247084bcd4bf4802857630871d0c6b83ff01d3936169986a046c0d964cb5b9a41972dd0321cb

Download Submit
C:\Windows\system\xUeilrY.exe

Filesize
1.4MB

MD5
b65c73cb966bb1a9b882f1404e4d5b02

SHA1
3cfae5728bc17389b3a5e6438583a395a36a1478

SHA256
9bdc4a3a1fcbe838aaf9a259f6557d8436e286e30de1445046b6d54fab32854a

SHA512
28fe3b2dee834cada89c8b4622aea06f83873833268a73bc8b0d27ea1d4cd51b2f14beac54f545f7a8c263c34395ef694ec24df66e55d356de1f48af9b244c62

Download Submit
C:\Windows\system\xpgJqjT.exe

Filesize
1.4MB

MD5
5fe5f2d93b0aeeb2733dff5d24fe94e1

SHA1
611c3beed8d411caa056b9bb50dce25a3541122d

SHA256
5cd2e3f1cf3edf4a1b5aac766b1181d596c5c2b057812c850ba85399991c7154

SHA512
3f7467fc0bfc6f4da822d06a35321bb680abcb41142702fdf73c4246d0fb8e213078867e252b48296472b5cf7028c688d205eacea918efc909ee20a18457fa8c

Download Submit
C:\Windows\system\zQFoliZ.exe

Filesize
1.4MB

MD5
546ea0ffe3ffad926980a591c7241f7d

SHA1
e557e3edcb150e7317237f0e27ae541210fb87e7

SHA256
1a47eb55eda6d37606e3df4382c516e9946cb316cf4471f2b0ace77de502850b

SHA512
ccdd162ec107d3b892e9777f872d8fac4831a76a71a4183f174e0fe62e60d6d55afacc1f6a7ef16ee6b5c96133565ed1d05d5321ec7db41e727fde8fa2a3f4f4

Download Submit
\Windows\system\ATKPwMe.exe

Filesize
1.4MB

MD5
cd8536f0383b90d01fb0df36d2c63bad

SHA1
aace918a7515f67dc1784a0feebc7719a90294c9

SHA256
91e606a2dd506eac52acf81289f9795a6b39b2c04f8e455a268af5ce6ec5998c

SHA512
48794c1a5f9d483e19a359bafc7a68155137c4717e95bbfad8c8e3c5a8373be1a2da9b617ed2b4f36c9b2bb4daf60aed63fb91802b0959f486cf17b3c4dca417

Download Submit
\Windows\system\PPehdBi.exe

Filesize
1.4MB

MD5
d5423693360db1b55e2f028d410a0456

SHA1
7a041f29d4fdaadebe721db0427917b972e8f9c7

SHA256
024eb5ccf21df8d32637136c1eec91f28b1579e649babfcd8717b43a317bf436

SHA512
003a250c881af8bfbc7fae84ec64b32e6c1bb06c77d3968dc71f3538b83bca4758afeae46179a883478b59757faab65c22b61f33f4d5f23e818c4763dd3652f4

Download Submit
\Windows\system\SHHEthI.exe

Filesize
1.4MB

MD5
c4fe623bc2d49cbf99aff832bb1761c6

SHA1
24a9efc2eb7c757b4e273aba586b2c12735357d7

SHA256
f31c8e8e1d58efd631773c19dd4940128aae7f47c52c3d8dc711f16699b8800b

SHA512
9ee45d00bf51c545e4727e9542a1c02ea364068d711668a28cedc2983c12d6214dcbd21b6b8258f4cbb79c84af66e1b69748e7c7d2d8faebca90eabed0bf8ab3

Download Submit
\Windows\system\VodrMrL.exe

Filesize
1.4MB

MD5
731c95dc4931785d0bd331c763d712ed

SHA1
a19ef944fe194694f3d2b989713d79f0dedc1d50

SHA256
f09a93e9a14ae17c4e9b54d7a2a7adbc0bf2da3262e73ed06f0c22d74ba755e0

SHA512
ea9060876e39bfd38a8b2c8bfa72d80b3a7382e227d12fba45b8d30a047dfe1c5680bac4a04cb041ce5bde486cd70b6c8f617dc1c5e1a72e472681517f144e71

Download Submit
\Windows\system\YjoEihG.exe

Filesize
1.4MB

MD5
ec7c821d3b299907fa7acf7cee3ea537

SHA1
47b2e64d51c9376643b5dd18ea06d9f4e723a2a8

SHA256
d23baf12caf681069894771b0fd248e1d912b226679c8f784884d21cc27a27e8

SHA512
b8a1536747ae3305ffd516d92205131e08ecbd6e77dd161278b7ed19e8e9eab6e44e09e0a90269bd1b9620b2f9ff8095aec801ecb28e643ce56400d89abc7a90

Download Submit
\Windows\system\nPqqXWa.exe

Filesize
1.4MB

MD5
fab520a73d72d8fc47e38643d73c3293

SHA1
e265180380825bad01dab683faccac808bb304b2

SHA256
7bf6a73fd1bc23579f6f28a2d99fa2488126c027f65da05209203f08fb5122e2

SHA512
8baa6705a1f19014b9ca3cddd366f312e7247e5088ff87c7a16a75e0bffcbd186f147fdd86f7e86209c53c9a036e79bacfef297a8d674bf7f068feda8a997950

Download Submit
\Windows\system\xJEFVzl.exe

Filesize
1.4MB

MD5
a8d35753e47762fd7bae329cdf3b4f77

SHA1
563f8e7c8ef804c6042ba9210ce26b238d9f17a7

SHA256
893739762120f3cd00576be5a330dd82a53c4b0a4e8c988085c725503de03bf5

SHA512
7e42a8d54ff448e58db9155a75b2151c0badf5bb1e09e2f138dcba75a118d08c9f50df4609dbd90b29e0ab8bf62fa2706786a95c0de6cdf414f15f1cc97cf376

Download Submit
memory/1192-9-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/1948-201-0x0000000002DB0000-0x00000000031A2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-0-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/1948-187-0x0000000002DB0000-0x00000000031A2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-199-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/1948-197-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-189-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/1948-191-0x0000000002DB0000-0x00000000031A2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-8-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/1948-193-0x0000000002DB0000-0x00000000031A2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-1-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/1964-235-0x0000000001F60000-0x0000000001F68000-memory.dmp

Filesize
32KB

Download
memory/1964-184-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/1964-232-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/1964-185-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/1964-186-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/2460-200-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2548-18-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2552-198-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-21-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2604-196-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2764-190-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2804-192-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-188-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download