xmrig | 34aafd4cdcc39447ef4d3c2f626bacd94ad03e8510aeb31c79b742ad517f7f5e

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
Size

1.9MB
MD5

0c4789c8a38e2c3827c33c1845a67e66
SHA1

5653d77fa4b28eb05f99bfda581683d73da5a82f
SHA256

34aafd4cdcc39447ef4d3c2f626bacd94ad03e8510aeb31c79b742ad517f7f5e
SHA512

d51fe20506bb7439cafdebe746a69730b4c47f782e98ee933e45e4f6d3f847b06457e3061f858b78d6ae876d38e35eb2aa13768e9a73067cb4691932d1991fc1
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlZ:NABg

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2088-15-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	xmrig
behavioral1/memory/2188-74-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/2196-67-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/380-63-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2276-54-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2732-41-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/1148-1179-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2260	WZWcNow.exe
2088	ihCGBcr.exe
2732	DuyUZzM.exe
2276	AbcTSIc.exe
380	lQGzQmy.exe
2196	JpGyIOr.exe
2188	DtYgtLo.exe
2624	ylMSQQq.exe
2892	fCHnnDU.exe
304	dBSIdBg.exe
2008	VawslWC.exe
2336	uOWcasT.exe
2596	XkrJFVx.exe
1984	lsHPLzf.exe
2924	ETluglw.exe
1272	OBzvuKE.exe
2696	zxoxFDC.exe
2520	SCHlKmg.exe
2540	BcQgovE.exe
2308	IKIhbXa.exe
2704	LcLAqDd.exe
992	mZsZjyT.exe
2192	wmUJQsu.exe
2028	ARBWBxv.exe
2036	sXdwTIH.exe
2860	vEHSBxL.exe
2900	ZXzGyNE.exe
2428	NbxGXjI.exe
2452	DPJkACR.exe
1412	NcZFDEL.exe
2916	wwgBYMM.exe
2512	zINqrUe.exe
1780	EQUJMDY.exe
1400	lAUelkH.exe
1592	NmeLgkP.exe
1276	FNZUZBB.exe
2948	LDKNVdy.exe
572	DayhJKC.exe
2884	tzcLHKV.exe
2772	oSUpbTk.exe
680	kHEQqfJ.exe
584	biHeSMX.exe
2968	wemCaRd.exe
836	zqcyKTN.exe
920	AOwRLpT.exe
2960	eIvDZIk.exe
1688	NuSZbaM.exe
1380	fWCWdyp.exe
2976	fyGJbjO.exe
908	wMcrptv.exe
1904	PbdCJAt.exe
1712	hZbwpEu.exe
1876	HzpbXWl.exe
1520	BybtWqX.exe
2616	ZLXVvQC.exe
2748	pzuWVjH.exe
2620	twiSzTe.exe
2688	YMDNCmu.exe
872	nobFhZJ.exe
2648	JohLTDU.exe
2304	rGmIAVH.exe
2744	DHiCfyy.exe
1640	DrheXgr.exe
528	IcLvWWo.exe

Loads dropped DLL 64 IoCs

pid	Process
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1148-0-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/files/0x000b0000000122ee-5.dat	upx
behavioral1/memory/2260-8-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/files/0x003700000001451d-9.dat	upx
behavioral1/files/0x00080000000146a7-20.dat	upx
behavioral1/memory/2088-15-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/files/0x00130000000054a8-38.dat	upx
behavioral1/files/0x0006000000015cd8-62.dat	upx
behavioral1/files/0x0006000000015d02-79.dat	upx
behavioral1/files/0x0006000000015d1e-86.dat	upx
behavioral1/files/0x0006000000015d89-94.dat	upx
behavioral1/files/0x0006000000015f40-111.dat	upx
behavioral1/files/0x00060000000167e8-146.dat	upx
behavioral1/files/0x0006000000016ca1-173.dat	upx
behavioral1/files/0x0006000000015cf5-190.dat	upx
behavioral1/files/0x0006000000016d01-186.dat	upx
behavioral1/files/0x0006000000015ce1-180.dat	upx
behavioral1/files/0x0006000000016ccd-176.dat	upx
behavioral1/files/0x0006000000016c5b-168.dat	upx
behavioral1/files/0x0006000000015cca-163.dat	upx
behavioral1/files/0x0006000000016c3a-158.dat	upx
behavioral1/files/0x0008000000014c0b-153.dat	upx
behavioral1/files/0x0006000000016a3a-148.dat	upx
behavioral1/files/0x00080000000148af-142.dat	upx
behavioral1/files/0x0006000000016591-139.dat	upx
behavioral1/files/0x000700000001474b-133.dat	upx
behavioral1/files/0x000600000001640f-129.dat	upx
behavioral1/files/0x0006000000016126-120.dat	upx
behavioral1/files/0x0006000000015fbb-112.dat	upx
behavioral1/memory/2624-102-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/files/0x0006000000015d99-97.dat	upx
behavioral1/files/0x0006000000015d28-89.dat	upx
behavioral1/files/0x0006000000015d13-83.dat	upx
behavioral1/files/0x0006000000016cf2-185.dat	upx
behavioral1/files/0x0006000000016c57-167.dat	upx
behavioral1/files/0x0037000000014525-156.dat	upx
behavioral1/files/0x000600000001650f-136.dat	upx
behavioral1/files/0x0006000000016228-127.dat	upx
behavioral1/files/0x0006000000016020-119.dat	upx
behavioral1/files/0x0006000000015ced-81.dat	upx
behavioral1/memory/2188-74-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/2196-67-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/380-63-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/files/0x0008000000015cc2-61.dat	upx
behavioral1/memory/2276-54-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/2732-41-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/files/0x0008000000014a29-39.dat	upx
behavioral1/memory/1148-1179-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NZXDSuD.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\PqRWrat.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\zTWDipD.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\rxySKOm.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\PeSJuRv.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\YpRcxGx.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\GjsNRrp.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\adSxrEt.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\RyIPVKS.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\gHslUna.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\UJfRhlF.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\UhjEBMr.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\GrkwmgI.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\ZqTDmpn.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\QyfglHy.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\qlbQHtm.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\CtISEOD.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\npWPMmG.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\PNRYOPB.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\REfZWui.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\ELCJkxu.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\fwsxKFn.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\daWaHWy.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\rmVTseq.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\WCiERTA.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\XAoIXAn.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\QIlkbFx.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\voKGArA.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\FqwCphK.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\jaOWtjn.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\SpjpvOt.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\ohZThVv.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\qkQnhaC.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\apQrcpI.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\DtGdwTI.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\MLDeHLf.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\ibbHBqi.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\eNTLZbw.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\KGEmXHT.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\mPxfReW.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\RqynoMR.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\SyJWpvs.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\qegjNnS.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\wgKSJNc.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\TKKJhZL.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\xNrfjuh.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\InneEzZ.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\nNLCsSR.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\SMzDaoa.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\JnfyMGD.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\EsnJXQw.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\faCCrcs.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\bDGdwsw.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\kHmGeeV.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\hPwiOdh.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\kobeHdn.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\LqGbejB.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\YAuLNER.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\nIRTRZr.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\gDfOPiO.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\fRUxkGz.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\ThgTyjj.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\wUqbZXv.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
File created	C:\Windows\System\WqbJFNX.exe	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2252	powershell.exe
2252	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
Token: SeDebugPrivilege	2252	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 2252	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	29
PID 1148 wrote to memory of 2252	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	29
PID 1148 wrote to memory of 2252	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	29
PID 1148 wrote to memory of 2260	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	30
PID 1148 wrote to memory of 2260	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	30
PID 1148 wrote to memory of 2260	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	30
PID 1148 wrote to memory of 2088	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	31
PID 1148 wrote to memory of 2088	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	31
PID 1148 wrote to memory of 2088	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	31
PID 1148 wrote to memory of 2732	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	32
PID 1148 wrote to memory of 2732	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	32
PID 1148 wrote to memory of 2732	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	32
PID 1148 wrote to memory of 2924	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	33
PID 1148 wrote to memory of 2924	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	33
PID 1148 wrote to memory of 2924	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	33
PID 1148 wrote to memory of 2276	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	34
PID 1148 wrote to memory of 2276	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	34
PID 1148 wrote to memory of 2276	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	34
PID 1148 wrote to memory of 2696	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	35
PID 1148 wrote to memory of 2696	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	35
PID 1148 wrote to memory of 2696	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	35
PID 1148 wrote to memory of 380	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	36
PID 1148 wrote to memory of 380	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	36
PID 1148 wrote to memory of 380	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	36
PID 1148 wrote to memory of 2540	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	37
PID 1148 wrote to memory of 2540	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	37
PID 1148 wrote to memory of 2540	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	37
PID 1148 wrote to memory of 2196	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	38
PID 1148 wrote to memory of 2196	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	38
PID 1148 wrote to memory of 2196	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	38
PID 1148 wrote to memory of 2704	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	39
PID 1148 wrote to memory of 2704	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	39
PID 1148 wrote to memory of 2704	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	39
PID 1148 wrote to memory of 2188	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	40
PID 1148 wrote to memory of 2188	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	40
PID 1148 wrote to memory of 2188	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	40
PID 1148 wrote to memory of 2028	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	41
PID 1148 wrote to memory of 2028	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	41
PID 1148 wrote to memory of 2028	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	41
PID 1148 wrote to memory of 2624	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	42
PID 1148 wrote to memory of 2624	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	42
PID 1148 wrote to memory of 2624	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	42
PID 1148 wrote to memory of 2860	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	43
PID 1148 wrote to memory of 2860	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	43
PID 1148 wrote to memory of 2860	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	43
PID 1148 wrote to memory of 2892	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	44
PID 1148 wrote to memory of 2892	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	44
PID 1148 wrote to memory of 2892	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	44
PID 1148 wrote to memory of 2900	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	45
PID 1148 wrote to memory of 2900	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	45
PID 1148 wrote to memory of 2900	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	45
PID 1148 wrote to memory of 304	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	46
PID 1148 wrote to memory of 304	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	46
PID 1148 wrote to memory of 304	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	46
PID 1148 wrote to memory of 2428	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	47
PID 1148 wrote to memory of 2428	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	47
PID 1148 wrote to memory of 2428	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	47
PID 1148 wrote to memory of 2008	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	48
PID 1148 wrote to memory of 2008	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	48
PID 1148 wrote to memory of 2008	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	48
PID 1148 wrote to memory of 2452	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	49
PID 1148 wrote to memory of 2452	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	49
PID 1148 wrote to memory of 2452	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	49
PID 1148 wrote to memory of 2336	1148	0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c4789c8a38e2c3827c33c1845a67e66_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\System\WZWcNow.exe
  C:\Windows\System\WZWcNow.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\ihCGBcr.exe
  C:\Windows\System\ihCGBcr.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\DuyUZzM.exe
  C:\Windows\System\DuyUZzM.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\ETluglw.exe
  C:\Windows\System\ETluglw.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\AbcTSIc.exe
  C:\Windows\System\AbcTSIc.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\zxoxFDC.exe
  C:\Windows\System\zxoxFDC.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\lQGzQmy.exe
  C:\Windows\System\lQGzQmy.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\BcQgovE.exe
  C:\Windows\System\BcQgovE.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\JpGyIOr.exe
  C:\Windows\System\JpGyIOr.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\LcLAqDd.exe
  C:\Windows\System\LcLAqDd.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\DtYgtLo.exe
  C:\Windows\System\DtYgtLo.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\ARBWBxv.exe
  C:\Windows\System\ARBWBxv.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\ylMSQQq.exe
  C:\Windows\System\ylMSQQq.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\vEHSBxL.exe
  C:\Windows\System\vEHSBxL.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\fCHnnDU.exe
  C:\Windows\System\fCHnnDU.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\ZXzGyNE.exe
  C:\Windows\System\ZXzGyNE.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\dBSIdBg.exe
  C:\Windows\System\dBSIdBg.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\NbxGXjI.exe
  C:\Windows\System\NbxGXjI.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\VawslWC.exe
  C:\Windows\System\VawslWC.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\DPJkACR.exe
  C:\Windows\System\DPJkACR.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\uOWcasT.exe
  C:\Windows\System\uOWcasT.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\NcZFDEL.exe
  C:\Windows\System\NcZFDEL.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\XkrJFVx.exe
  C:\Windows\System\XkrJFVx.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\zINqrUe.exe
  C:\Windows\System\zINqrUe.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\lsHPLzf.exe
  C:\Windows\System\lsHPLzf.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\NmeLgkP.exe
  C:\Windows\System\NmeLgkP.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\OBzvuKE.exe
  C:\Windows\System\OBzvuKE.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\tzcLHKV.exe
  C:\Windows\System\tzcLHKV.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\SCHlKmg.exe
  C:\Windows\System\SCHlKmg.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\oSUpbTk.exe
  C:\Windows\System\oSUpbTk.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\IKIhbXa.exe
  C:\Windows\System\IKIhbXa.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\kHEQqfJ.exe
  C:\Windows\System\kHEQqfJ.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\mZsZjyT.exe
  C:\Windows\System\mZsZjyT.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\biHeSMX.exe
  C:\Windows\System\biHeSMX.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\wmUJQsu.exe
  C:\Windows\System\wmUJQsu.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\zqcyKTN.exe
  C:\Windows\System\zqcyKTN.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\sXdwTIH.exe
  C:\Windows\System\sXdwTIH.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\AOwRLpT.exe
  C:\Windows\System\AOwRLpT.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\wwgBYMM.exe
  C:\Windows\System\wwgBYMM.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\eIvDZIk.exe
  C:\Windows\System\eIvDZIk.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\EQUJMDY.exe
  C:\Windows\System\EQUJMDY.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\NuSZbaM.exe
  C:\Windows\System\NuSZbaM.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\lAUelkH.exe
  C:\Windows\System\lAUelkH.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\fWCWdyp.exe
  C:\Windows\System\fWCWdyp.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\FNZUZBB.exe
  C:\Windows\System\FNZUZBB.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\fyGJbjO.exe
  C:\Windows\System\fyGJbjO.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\LDKNVdy.exe
  C:\Windows\System\LDKNVdy.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\wMcrptv.exe
  C:\Windows\System\wMcrptv.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\DayhJKC.exe
  C:\Windows\System\DayhJKC.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\PbdCJAt.exe
  C:\Windows\System\PbdCJAt.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\wemCaRd.exe
  C:\Windows\System\wemCaRd.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\hZbwpEu.exe
  C:\Windows\System\hZbwpEu.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\HzpbXWl.exe
  C:\Windows\System\HzpbXWl.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\BybtWqX.exe
  C:\Windows\System\BybtWqX.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\ZLXVvQC.exe
  C:\Windows\System\ZLXVvQC.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\pzuWVjH.exe
  C:\Windows\System\pzuWVjH.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\twiSzTe.exe
  C:\Windows\System\twiSzTe.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\nobFhZJ.exe
  C:\Windows\System\nobFhZJ.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\YMDNCmu.exe
  C:\Windows\System\YMDNCmu.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\JohLTDU.exe
  C:\Windows\System\JohLTDU.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\rGmIAVH.exe
  C:\Windows\System\rGmIAVH.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\DHiCfyy.exe
  C:\Windows\System\DHiCfyy.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\DrheXgr.exe
  C:\Windows\System\DrheXgr.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\IcLvWWo.exe
  C:\Windows\System\IcLvWWo.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\wnbPPkc.exe
  C:\Windows\System\wnbPPkc.exe
  2⤵
  PID:1596
- C:\Windows\System\MiTnpwh.exe
  C:\Windows\System\MiTnpwh.exe
  2⤵
  PID:2248
- C:\Windows\System\hExzKwA.exe
  C:\Windows\System\hExzKwA.exe
  2⤵
  PID:1504
- C:\Windows\System\EVeBFsU.exe
  C:\Windows\System\EVeBFsU.exe
  2⤵
  PID:2508
- C:\Windows\System\DlQdiTN.exe
  C:\Windows\System\DlQdiTN.exe
  2⤵
  PID:1356
- C:\Windows\System\kqltlmD.exe
  C:\Windows\System\kqltlmD.exe
  2⤵
  PID:1632
- C:\Windows\System\gFVyXco.exe
  C:\Windows\System\gFVyXco.exe
  2⤵
  PID:692
- C:\Windows\System\oxydmcc.exe
  C:\Windows\System\oxydmcc.exe
  2⤵
  PID:2564
- C:\Windows\System\pyIEVPg.exe
  C:\Windows\System\pyIEVPg.exe
  2⤵
  PID:3044
- C:\Windows\System\TtCYwSi.exe
  C:\Windows\System\TtCYwSi.exe
  2⤵
  PID:3016
- C:\Windows\System\bRAfXZy.exe
  C:\Windows\System\bRAfXZy.exe
  2⤵
  PID:2500
- C:\Windows\System\OAuFcex.exe
  C:\Windows\System\OAuFcex.exe
  2⤵
  PID:988
- C:\Windows\System\pdxTBCg.exe
  C:\Windows\System\pdxTBCg.exe
  2⤵
  PID:2056
- C:\Windows\System\aXKhWFw.exe
  C:\Windows\System\aXKhWFw.exe
  2⤵
  PID:1692
- C:\Windows\System\TYIMGMp.exe
  C:\Windows\System\TYIMGMp.exe
  2⤵
  PID:2904
- C:\Windows\System\MUASspQ.exe
  C:\Windows\System\MUASspQ.exe
  2⤵
  PID:484
- C:\Windows\System\FHINwxY.exe
  C:\Windows\System\FHINwxY.exe
  2⤵
  PID:1532
- C:\Windows\System\YQGlEGk.exe
  C:\Windows\System\YQGlEGk.exe
  2⤵
  PID:844
- C:\Windows\System\RzUaLme.exe
  C:\Windows\System\RzUaLme.exe
  2⤵
  PID:880
- C:\Windows\System\TzudBLn.exe
  C:\Windows\System\TzudBLn.exe
  2⤵
  PID:3060
- C:\Windows\System\hAhelmp.exe
  C:\Windows\System\hAhelmp.exe
  2⤵
  PID:1556
- C:\Windows\System\RBjWswU.exe
  C:\Windows\System\RBjWswU.exe
  2⤵
  PID:1804
- C:\Windows\System\ChbSmYH.exe
  C:\Windows\System\ChbSmYH.exe
  2⤵
  PID:756
- C:\Windows\System\ENSJiWg.exe
  C:\Windows\System\ENSJiWg.exe
  2⤵
  PID:948
- C:\Windows\System\iiLTSZx.exe
  C:\Windows\System\iiLTSZx.exe
  2⤵
  PID:2332
- C:\Windows\System\QAuOUQv.exe
  C:\Windows\System\QAuOUQv.exe
  2⤵
  PID:852
- C:\Windows\System\UaLRdGK.exe
  C:\Windows\System\UaLRdGK.exe
  2⤵
  PID:1784
- C:\Windows\System\fqDcUYX.exe
  C:\Windows\System\fqDcUYX.exe
  2⤵
  PID:1900
- C:\Windows\System\abzQWJA.exe
  C:\Windows\System\abzQWJA.exe
  2⤵
  PID:1588
- C:\Windows\System\bJquufe.exe
  C:\Windows\System\bJquufe.exe
  2⤵
  PID:2560
- C:\Windows\System\nXxeTIm.exe
  C:\Windows\System\nXxeTIm.exe
  2⤵
  PID:2720
- C:\Windows\System\wDfNnrW.exe
  C:\Windows\System\wDfNnrW.exe
  2⤵
  PID:3008
- C:\Windows\System\vhBlShQ.exe
  C:\Windows\System\vhBlShQ.exe
  2⤵
  PID:2712
- C:\Windows\System\RRiQUbY.exe
  C:\Windows\System\RRiQUbY.exe
  2⤵
  PID:2052
- C:\Windows\System\OmQFiEc.exe
  C:\Windows\System\OmQFiEc.exe
  2⤵
  PID:1916
- C:\Windows\System\rGVIUrC.exe
  C:\Windows\System\rGVIUrC.exe
  2⤵
  PID:2212
- C:\Windows\System\JCdILwg.exe
  C:\Windows\System\JCdILwg.exe
  2⤵
  PID:2376
- C:\Windows\System\JINVjHV.exe
  C:\Windows\System\JINVjHV.exe
  2⤵
  PID:2552
- C:\Windows\System\toAaVTB.exe
  C:\Windows\System\toAaVTB.exe
  2⤵
  PID:2780
- C:\Windows\System\ljttldG.exe
  C:\Windows\System\ljttldG.exe
  2⤵
  PID:1076
- C:\Windows\System\GcwFrQU.exe
  C:\Windows\System\GcwFrQU.exe
  2⤵
  PID:804
- C:\Windows\System\bgIsBCF.exe
  C:\Windows\System\bgIsBCF.exe
  2⤵
  PID:2080
- C:\Windows\System\vBqIGMN.exe
  C:\Windows\System\vBqIGMN.exe
  2⤵
  PID:2516
- C:\Windows\System\THNzLHu.exe
  C:\Windows\System\THNzLHu.exe
  2⤵
  PID:556
- C:\Windows\System\xMLzXKp.exe
  C:\Windows\System\xMLzXKp.exe
  2⤵
  PID:2204
- C:\Windows\System\QfsZKvu.exe
  C:\Windows\System\QfsZKvu.exe
  2⤵
  PID:2148
- C:\Windows\System\rRTpZcU.exe
  C:\Windows\System\rRTpZcU.exe
  2⤵
  PID:2472
- C:\Windows\System\NZXDSuD.exe
  C:\Windows\System\NZXDSuD.exe
  2⤵
  PID:612
- C:\Windows\System\GCMapxa.exe
  C:\Windows\System\GCMapxa.exe
  2⤵
  PID:2612
- C:\Windows\System\TyXirjj.exe
  C:\Windows\System\TyXirjj.exe
  2⤵
  PID:1048
- C:\Windows\System\JorFJVP.exe
  C:\Windows\System\JorFJVP.exe
  2⤵
  PID:3084
- C:\Windows\System\hqrVajd.exe
  C:\Windows\System\hqrVajd.exe
  2⤵
  PID:3104
- C:\Windows\System\xJvbaKb.exe
  C:\Windows\System\xJvbaKb.exe
  2⤵
  PID:3132
- C:\Windows\System\twlWYcs.exe
  C:\Windows\System\twlWYcs.exe
  2⤵
  PID:3148
- C:\Windows\System\SgZQuEP.exe
  C:\Windows\System\SgZQuEP.exe
  2⤵
  PID:3164
- C:\Windows\System\OuwVFYb.exe
  C:\Windows\System\OuwVFYb.exe
  2⤵
  PID:3184
- C:\Windows\System\fBTcIWX.exe
  C:\Windows\System\fBTcIWX.exe
  2⤵
  PID:3204
- C:\Windows\System\EfmOYKN.exe
  C:\Windows\System\EfmOYKN.exe
  2⤵
  PID:3220
- C:\Windows\System\ZxCebzD.exe
  C:\Windows\System\ZxCebzD.exe
  2⤵
  PID:3240
- C:\Windows\System\QqKWLhR.exe
  C:\Windows\System\QqKWLhR.exe
  2⤵
  PID:3256
- C:\Windows\System\wMvLJvV.exe
  C:\Windows\System\wMvLJvV.exe
  2⤵
  PID:3272
- C:\Windows\System\MtyghPb.exe
  C:\Windows\System\MtyghPb.exe
  2⤵
  PID:3288
- C:\Windows\System\xuSnoIE.exe
  C:\Windows\System\xuSnoIE.exe
  2⤵
  PID:3308
- C:\Windows\System\eVJTauN.exe
  C:\Windows\System\eVJTauN.exe
  2⤵
  PID:3328
- C:\Windows\System\IlEeWVO.exe
  C:\Windows\System\IlEeWVO.exe
  2⤵
  PID:3352
- C:\Windows\System\GLXdZZT.exe
  C:\Windows\System\GLXdZZT.exe
  2⤵
  PID:3368
- C:\Windows\System\DvWHJUg.exe
  C:\Windows\System\DvWHJUg.exe
  2⤵
  PID:3384
- C:\Windows\System\bpzGjvH.exe
  C:\Windows\System\bpzGjvH.exe
  2⤵
  PID:3400
- C:\Windows\System\ntXEZci.exe
  C:\Windows\System\ntXEZci.exe
  2⤵
  PID:3420
- C:\Windows\System\NBptFfp.exe
  C:\Windows\System\NBptFfp.exe
  2⤵
  PID:3440
- C:\Windows\System\WMzRDXn.exe
  C:\Windows\System\WMzRDXn.exe
  2⤵
  PID:3464
- C:\Windows\System\giNQskw.exe
  C:\Windows\System\giNQskw.exe
  2⤵
  PID:3492
- C:\Windows\System\xShrShA.exe
  C:\Windows\System\xShrShA.exe
  2⤵
  PID:3532
- C:\Windows\System\lXTCGub.exe
  C:\Windows\System\lXTCGub.exe
  2⤵
  PID:3548
- C:\Windows\System\bKqZvVM.exe
  C:\Windows\System\bKqZvVM.exe
  2⤵
  PID:3568
- C:\Windows\System\UBbXIjk.exe
  C:\Windows\System\UBbXIjk.exe
  2⤵
  PID:3584
- C:\Windows\System\eOLyMCK.exe
  C:\Windows\System\eOLyMCK.exe
  2⤵
  PID:3604
- C:\Windows\System\hAWHQtP.exe
  C:\Windows\System\hAWHQtP.exe
  2⤵
  PID:3620
- C:\Windows\System\DgFouKs.exe
  C:\Windows\System\DgFouKs.exe
  2⤵
  PID:3636
- C:\Windows\System\EaycBrx.exe
  C:\Windows\System\EaycBrx.exe
  2⤵
  PID:3656
- C:\Windows\System\MMStJKh.exe
  C:\Windows\System\MMStJKh.exe
  2⤵
  PID:3680
- C:\Windows\System\gWdlPxx.exe
  C:\Windows\System\gWdlPxx.exe
  2⤵
  PID:3696
- C:\Windows\System\DvzisJH.exe
  C:\Windows\System\DvzisJH.exe
  2⤵
  PID:3712
- C:\Windows\System\TCmuuIr.exe
  C:\Windows\System\TCmuuIr.exe
  2⤵
  PID:3728
- C:\Windows\System\hCBWnDb.exe
  C:\Windows\System\hCBWnDb.exe
  2⤵
  PID:3748
- C:\Windows\System\wIpPOom.exe
  C:\Windows\System\wIpPOom.exe
  2⤵
  PID:3764
- C:\Windows\System\oRIPAQX.exe
  C:\Windows\System\oRIPAQX.exe
  2⤵
  PID:3800
- C:\Windows\System\VSROHqf.exe
  C:\Windows\System\VSROHqf.exe
  2⤵
  PID:3832
- C:\Windows\System\BOegWgp.exe
  C:\Windows\System\BOegWgp.exe
  2⤵
  PID:3852
- C:\Windows\System\jYXSKeX.exe
  C:\Windows\System\jYXSKeX.exe
  2⤵
  PID:3872
- C:\Windows\System\PZxxWkj.exe
  C:\Windows\System\PZxxWkj.exe
  2⤵
  PID:3892
- C:\Windows\System\MnCUrLb.exe
  C:\Windows\System\MnCUrLb.exe
  2⤵
  PID:3912
- C:\Windows\System\kvlNNmM.exe
  C:\Windows\System\kvlNNmM.exe
  2⤵
  PID:3932
- C:\Windows\System\GjgZnsS.exe
  C:\Windows\System\GjgZnsS.exe
  2⤵
  PID:3952
- C:\Windows\System\pfznxGB.exe
  C:\Windows\System\pfznxGB.exe
  2⤵
  PID:3972
- C:\Windows\System\kwEonBs.exe
  C:\Windows\System\kwEonBs.exe
  2⤵
  PID:3992
- C:\Windows\System\znTAaAz.exe
  C:\Windows\System\znTAaAz.exe
  2⤵
  PID:4008
- C:\Windows\System\sEXHZQU.exe
  C:\Windows\System\sEXHZQU.exe
  2⤵
  PID:4024
- C:\Windows\System\dLqWPgS.exe
  C:\Windows\System\dLqWPgS.exe
  2⤵
  PID:4040
- C:\Windows\System\xcCNHxy.exe
  C:\Windows\System\xcCNHxy.exe
  2⤵
  PID:4060
- C:\Windows\System\nKGetLN.exe
  C:\Windows\System\nKGetLN.exe
  2⤵
  PID:4084
- C:\Windows\System\OpRAQep.exe
  C:\Windows\System\OpRAQep.exe
  2⤵
  PID:1628
- C:\Windows\System\ZKNrXCT.exe
  C:\Windows\System\ZKNrXCT.exe
  2⤵
  PID:2928
- C:\Windows\System\qumlsIh.exe
  C:\Windows\System\qumlsIh.exe
  2⤵
  PID:2360
- C:\Windows\System\nHjxnOH.exe
  C:\Windows\System\nHjxnOH.exe
  2⤵
  PID:1748
- C:\Windows\System\nCRBqMS.exe
  C:\Windows\System\nCRBqMS.exe
  2⤵
  PID:444
- C:\Windows\System\uWvcOSb.exe
  C:\Windows\System\uWvcOSb.exe
  2⤵
  PID:1708
- C:\Windows\System\uDEvxhM.exe
  C:\Windows\System\uDEvxhM.exe
  2⤵
  PID:1296
- C:\Windows\System\GPCPMiN.exe
  C:\Windows\System\GPCPMiN.exe
  2⤵
  PID:2060
- C:\Windows\System\hASdbDI.exe
  C:\Windows\System\hASdbDI.exe
  2⤵
  PID:2460
- C:\Windows\System\yqkRqAc.exe
  C:\Windows\System\yqkRqAc.exe
  2⤵
  PID:2752
- C:\Windows\System\cblAzKM.exe
  C:\Windows\System\cblAzKM.exe
  2⤵
  PID:3216
- C:\Windows\System\xsWBOgt.exe
  C:\Windows\System\xsWBOgt.exe
  2⤵
  PID:3324
- C:\Windows\System\HqAqAAt.exe
  C:\Windows\System\HqAqAAt.exe
  2⤵
  PID:1672
- C:\Windows\System\czntMHx.exe
  C:\Windows\System\czntMHx.exe
  2⤵
  PID:3392
- C:\Windows\System\BivFsyu.exe
  C:\Windows\System\BivFsyu.exe
  2⤵
  PID:1348
- C:\Windows\System\HInGHQl.exe
  C:\Windows\System\HInGHQl.exe
  2⤵
  PID:3428
- C:\Windows\System\MVqSGGc.exe
  C:\Windows\System\MVqSGGc.exe
  2⤵
  PID:1168
- C:\Windows\System\afsyrhe.exe
  C:\Windows\System\afsyrhe.exe
  2⤵
  PID:892
- C:\Windows\System\QmAfYkb.exe
  C:\Windows\System\QmAfYkb.exe
  2⤵
  PID:3036
- C:\Windows\System\YpFCPlm.exe
  C:\Windows\System\YpFCPlm.exe
  2⤵
  PID:3080
- C:\Windows\System\qWnuWGl.exe
  C:\Windows\System\qWnuWGl.exe
  2⤵
  PID:3540
- C:\Windows\System\aUXFoXN.exe
  C:\Windows\System\aUXFoXN.exe
  2⤵
  PID:3156
- C:\Windows\System\TjjIQEU.exe
  C:\Windows\System\TjjIQEU.exe
  2⤵
  PID:3200
- C:\Windows\System\HwWBKDP.exe
  C:\Windows\System\HwWBKDP.exe
  2⤵
  PID:3648
- C:\Windows\System\QPOyjQy.exe
  C:\Windows\System\QPOyjQy.exe
  2⤵
  PID:3688
- C:\Windows\System\bmYYyME.exe
  C:\Windows\System\bmYYyME.exe
  2⤵
  PID:3724
- C:\Windows\System\pqhcWGf.exe
  C:\Windows\System\pqhcWGf.exe
  2⤵
  PID:3756
- C:\Windows\System\IwdFSqO.exe
  C:\Windows\System\IwdFSqO.exe
  2⤵
  PID:3456
- C:\Windows\System\upxBMSS.exe
  C:\Windows\System\upxBMSS.exe
  2⤵
  PID:3304
- C:\Windows\System\jyhJAjQ.exe
  C:\Windows\System\jyhJAjQ.exe
  2⤵
  PID:3520
- C:\Windows\System\xRpMDiH.exe
  C:\Windows\System\xRpMDiH.exe
  2⤵
  PID:3412
- C:\Windows\System\fdDIXkn.exe
  C:\Windows\System\fdDIXkn.exe
  2⤵
  PID:3340
- C:\Windows\System\gwCoPUC.exe
  C:\Windows\System\gwCoPUC.exe
  2⤵
  PID:3560
- C:\Windows\System\gqqoQjp.exe
  C:\Windows\System\gqqoQjp.exe
  2⤵
  PID:3632
- C:\Windows\System\KAzNNOU.exe
  C:\Windows\System\KAzNNOU.exe
  2⤵
  PID:3676
- C:\Windows\System\cILRlTC.exe
  C:\Windows\System\cILRlTC.exe
  2⤵
  PID:3708
- C:\Windows\System\jueiOGw.exe
  C:\Windows\System\jueiOGw.exe
  2⤵
  PID:3828
- C:\Windows\System\FgycbRL.exe
  C:\Windows\System\FgycbRL.exe
  2⤵
  PID:3776
- C:\Windows\System\IwYpGZq.exe
  C:\Windows\System\IwYpGZq.exe
  2⤵
  PID:3792
- C:\Windows\System\vvkHySZ.exe
  C:\Windows\System\vvkHySZ.exe
  2⤵
  PID:2980
- C:\Windows\System\fkqQjVZ.exe
  C:\Windows\System\fkqQjVZ.exe
  2⤵
  PID:3864
- C:\Windows\System\xuxMMcR.exe
  C:\Windows\System\xuxMMcR.exe
  2⤵
  PID:3904
- C:\Windows\System\FQnIpwZ.exe
  C:\Windows\System\FQnIpwZ.exe
  2⤵
  PID:3948
- C:\Windows\System\ukQAOsx.exe
  C:\Windows\System\ukQAOsx.exe
  2⤵
  PID:3988
- C:\Windows\System\ZkTyuex.exe
  C:\Windows\System\ZkTyuex.exe
  2⤵
  PID:3924
- C:\Windows\System\elbnlKD.exe
  C:\Windows\System\elbnlKD.exe
  2⤵
  PID:1624
- C:\Windows\System\CLWeJeV.exe
  C:\Windows\System\CLWeJeV.exe
  2⤵
  PID:1444
- C:\Windows\System\OpRjQyZ.exe
  C:\Windows\System\OpRjQyZ.exe
  2⤵
  PID:656
- C:\Windows\System\TimLIZK.exe
  C:\Windows\System\TimLIZK.exe
  2⤵
  PID:2488
- C:\Windows\System\WIdrLRZ.exe
  C:\Windows\System\WIdrLRZ.exe
  2⤵
  PID:3180
- C:\Windows\System\zUukUlx.exe
  C:\Windows\System\zUukUlx.exe
  2⤵
  PID:2092
- C:\Windows\System\bNabHQD.exe
  C:\Windows\System\bNabHQD.exe
  2⤵
  PID:952
- C:\Windows\System\TTjcgnj.exe
  C:\Windows\System\TTjcgnj.exe
  2⤵
  PID:1268
- C:\Windows\System\TvtWKhB.exe
  C:\Windows\System\TvtWKhB.exe
  2⤵
  PID:2768
- C:\Windows\System\VPtYKqh.exe
  C:\Windows\System\VPtYKqh.exe
  2⤵
  PID:1448
- C:\Windows\System\HhtfXuB.exe
  C:\Windows\System\HhtfXuB.exe
  2⤵
  PID:812
- C:\Windows\System\nYudMyw.exe
  C:\Windows\System\nYudMyw.exe
  2⤵
  PID:2920
- C:\Windows\System\fltcYBm.exe
  C:\Windows\System\fltcYBm.exe
  2⤵
  PID:3196
- C:\Windows\System\FKnsCJJ.exe
  C:\Windows\System\FKnsCJJ.exe
  2⤵
  PID:3348
- C:\Windows\System\usoWzsM.exe
  C:\Windows\System\usoWzsM.exe
  2⤵
  PID:3448
- C:\Windows\System\ttCwivI.exe
  C:\Windows\System\ttCwivI.exe
  2⤵
  PID:3860
- C:\Windows\System\lwedfqY.exe
  C:\Windows\System\lwedfqY.exe
  2⤵
  PID:4016
- C:\Windows\System\PgvCzfT.exe
  C:\Windows\System\PgvCzfT.exe
  2⤵
  PID:2848
- C:\Windows\System\nGWyjsi.exe
  C:\Windows\System\nGWyjsi.exe
  2⤵
  PID:3280
- C:\Windows\System\ppGIOFj.exe
  C:\Windows\System\ppGIOFj.exe
  2⤵
  PID:3176
- C:\Windows\System\EAqDPGg.exe
  C:\Windows\System\EAqDPGg.exe
  2⤵
  PID:2936
- C:\Windows\System\sjQTzSL.exe
  C:\Windows\System\sjQTzSL.exe
  2⤵
  PID:2588
- C:\Windows\System\vJHNoxc.exe
  C:\Windows\System\vJHNoxc.exe
  2⤵
  PID:1736
- C:\Windows\System\MezkeRU.exe
  C:\Windows\System\MezkeRU.exe
  2⤵
  PID:2672
- C:\Windows\System\LIqiKqC.exe
  C:\Windows\System\LIqiKqC.exe
  2⤵
  PID:3124
- C:\Windows\System\QmPTZnp.exe
  C:\Windows\System\QmPTZnp.exe
  2⤵
  PID:1792
- C:\Windows\System\ZuckIJR.exe
  C:\Windows\System\ZuckIJR.exe
  2⤵
  PID:2300
- C:\Windows\System\QfIocot.exe
  C:\Windows\System\QfIocot.exe
  2⤵
  PID:3252
- C:\Windows\System\YaFAkRn.exe
  C:\Windows\System\YaFAkRn.exe
  2⤵
  PID:3644
- C:\Windows\System\naIWTAB.exe
  C:\Windows\System\naIWTAB.exe
  2⤵
  PID:1084
- C:\Windows\System\LkdJwgF.exe
  C:\Windows\System\LkdJwgF.exe
  2⤵
  PID:2636
- C:\Windows\System\BuuZBVo.exe
  C:\Windows\System\BuuZBVo.exe
  2⤵
  PID:3784
- C:\Windows\System\vngLWoj.exe
  C:\Windows\System\vngLWoj.exe
  2⤵
  PID:2368
- C:\Windows\System\bkEdwGx.exe
  C:\Windows\System\bkEdwGx.exe
  2⤵
  PID:300
- C:\Windows\System\nvdCQFX.exe
  C:\Windows\System\nvdCQFX.exe
  2⤵
  PID:576
- C:\Windows\System\KMEupGN.exe
  C:\Windows\System\KMEupGN.exe
  2⤵
  PID:3364
- C:\Windows\System\IFTZNif.exe
  C:\Windows\System\IFTZNif.exe
  2⤵
  PID:1656
- C:\Windows\System\jyuavGg.exe
  C:\Windows\System\jyuavGg.exe
  2⤵
  PID:2656
- C:\Windows\System\AvGEGVj.exe
  C:\Windows\System\AvGEGVj.exe
  2⤵
  PID:1112
- C:\Windows\System\ZrmGzoJ.exe
  C:\Windows\System\ZrmGzoJ.exe
  2⤵
  PID:2504
- C:\Windows\System\QfvdkZK.exe
  C:\Windows\System\QfvdkZK.exe
  2⤵
  PID:4056
- C:\Windows\System\ZjsiSAl.exe
  C:\Windows\System\ZjsiSAl.exe
  2⤵
  PID:3888
- C:\Windows\System\ibosFrZ.exe
  C:\Windows\System\ibosFrZ.exe
  2⤵
  PID:3740
- C:\Windows\System\bqSXHSj.exe
  C:\Windows\System\bqSXHSj.exe
  2⤵
  PID:3380
- C:\Windows\System\YqSwlNu.exe
  C:\Windows\System\YqSwlNu.exe
  2⤵
  PID:3720
- C:\Windows\System\hcHfwQQ.exe
  C:\Windows\System\hcHfwQQ.exe
  2⤵
  PID:1720
- C:\Windows\System\WDbToco.exe
  C:\Windows\System\WDbToco.exe
  2⤵
  PID:4080
- C:\Windows\System\nIJjvtc.exe
  C:\Windows\System\nIJjvtc.exe
  2⤵
  PID:2544
- C:\Windows\System\QKVtRoZ.exe
  C:\Windows\System\QKVtRoZ.exe
  2⤵
  PID:3960
- C:\Windows\System\CvutDmq.exe
  C:\Windows\System\CvutDmq.exe
  2⤵
  PID:2556
- C:\Windows\System\VhiLxCU.exe
  C:\Windows\System\VhiLxCU.exe
  2⤵
  PID:2788
- C:\Windows\System\PEjvVRp.exe
  C:\Windows\System\PEjvVRp.exe
  2⤵
  PID:2736
- C:\Windows\System\pHlOqbF.exe
  C:\Windows\System\pHlOqbF.exe
  2⤵
  PID:3316
- C:\Windows\System\siCwRzp.exe
  C:\Windows\System\siCwRzp.exe
  2⤵
  PID:2908
- C:\Windows\System\apcGJud.exe
  C:\Windows\System\apcGJud.exe
  2⤵
  PID:3824
- C:\Windows\System\YmIsmbx.exe
  C:\Windows\System\YmIsmbx.exe
  2⤵
  PID:1892
- C:\Windows\System\wmlrAcB.exe
  C:\Windows\System\wmlrAcB.exe
  2⤵
  PID:3816
- C:\Windows\System\mxzSsEb.exe
  C:\Windows\System\mxzSsEb.exe
  2⤵
  PID:3236
- C:\Windows\System\YCWpjLt.exe
  C:\Windows\System\YCWpjLt.exe
  2⤵
  PID:3376
- C:\Windows\System\jPHfGbc.exe
  C:\Windows\System\jPHfGbc.exe
  2⤵
  PID:3472
- C:\Windows\System\DXBWMkq.exe
  C:\Windows\System\DXBWMkq.exe
  2⤵
  PID:560
- C:\Windows\System\caTnlee.exe
  C:\Windows\System\caTnlee.exe
  2⤵
  PID:3556
- C:\Windows\System\LWaFctO.exe
  C:\Windows\System\LWaFctO.exe
  2⤵
  PID:2644
- C:\Windows\System\eXSucyn.exe
  C:\Windows\System\eXSucyn.exe
  2⤵
  PID:2548
- C:\Windows\System\oeXyoUZ.exe
  C:\Windows\System\oeXyoUZ.exe
  2⤵
  PID:2812
- C:\Windows\System\JtueYIX.exe
  C:\Windows\System\JtueYIX.exe
  2⤵
  PID:3000
- C:\Windows\System\wzAnwTN.exe
  C:\Windows\System\wzAnwTN.exe
  2⤵
  PID:284
- C:\Windows\System\SNFjHKN.exe
  C:\Windows\System\SNFjHKN.exe
  2⤵
  PID:1760
- C:\Windows\System\HDtwUHI.exe
  C:\Windows\System\HDtwUHI.exe
  2⤵
  PID:3940
- C:\Windows\System\NvRftwY.exe
  C:\Windows\System\NvRftwY.exe
  2⤵
  PID:1040
- C:\Windows\System\hMpMADU.exe
  C:\Windows\System\hMpMADU.exe
  2⤵
  PID:2152
- C:\Windows\System\cmAAPFl.exe
  C:\Windows\System\cmAAPFl.exe
  2⤵
  PID:2400
- C:\Windows\System\PXzLUBd.exe
  C:\Windows\System\PXzLUBd.exe
  2⤵
  PID:3116
- C:\Windows\System\kbwMaVw.exe
  C:\Windows\System\kbwMaVw.exe
  2⤵
  PID:3460
- C:\Windows\System\nanQvIY.exe
  C:\Windows\System\nanQvIY.exe
  2⤵
  PID:4076
- C:\Windows\System\QMtWENv.exe
  C:\Windows\System\QMtWENv.exe
  2⤵
  PID:4032
- C:\Windows\System\MoNkBMr.exe
  C:\Windows\System\MoNkBMr.exe
  2⤵
  PID:1100
- C:\Windows\System\COKvGSR.exe
  C:\Windows\System\COKvGSR.exe
  2⤵
  PID:4004
- C:\Windows\System\LjQxini.exe
  C:\Windows\System\LjQxini.exe
  2⤵
  PID:2072
- C:\Windows\System\PkNbglv.exe
  C:\Windows\System\PkNbglv.exe
  2⤵
  PID:3504
- C:\Windows\System\bXYXMgf.exe
  C:\Windows\System\bXYXMgf.exe
  2⤵
  PID:1336
- C:\Windows\System\HTfiBgn.exe
  C:\Windows\System\HTfiBgn.exe
  2⤵
  PID:784
- C:\Windows\System\mMTzYTn.exe
  C:\Windows\System\mMTzYTn.exe
  2⤵
  PID:3172
- C:\Windows\System\mTRWxmu.exe
  C:\Windows\System\mTRWxmu.exe
  2⤵
  PID:3772
- C:\Windows\System\LhDMTwm.exe
  C:\Windows\System\LhDMTwm.exe
  2⤵
  PID:3848
- C:\Windows\System\iNnIyId.exe
  C:\Windows\System\iNnIyId.exe
  2⤵
  PID:2180
- C:\Windows\System\gWfBwaJ.exe
  C:\Windows\System\gWfBwaJ.exe
  2⤵
  PID:2524
- C:\Windows\System\hQWeiWw.exe
  C:\Windows\System\hQWeiWw.exe
  2⤵
  PID:4100
- C:\Windows\System\YaMnfSy.exe
  C:\Windows\System\YaMnfSy.exe
  2⤵
  PID:4116
- C:\Windows\System\PJCzzFI.exe
  C:\Windows\System\PJCzzFI.exe
  2⤵
  PID:4176
- C:\Windows\System\uleUXfH.exe
  C:\Windows\System\uleUXfH.exe
  2⤵
  PID:4200
- C:\Windows\System\spSWFpt.exe
  C:\Windows\System\spSWFpt.exe
  2⤵
  PID:4220
- C:\Windows\System\gkDooRA.exe
  C:\Windows\System\gkDooRA.exe
  2⤵
  PID:4240
- C:\Windows\System\YTzFcEP.exe
  C:\Windows\System\YTzFcEP.exe
  2⤵
  PID:4260
- C:\Windows\System\gHMvDLW.exe
  C:\Windows\System\gHMvDLW.exe
  2⤵
  PID:4320
- C:\Windows\System\hVEBEDO.exe
  C:\Windows\System\hVEBEDO.exe
  2⤵
  PID:4336
- C:\Windows\System\UHKrXoF.exe
  C:\Windows\System\UHKrXoF.exe
  2⤵
  PID:4352
- C:\Windows\System\XqmmaKl.exe
  C:\Windows\System\XqmmaKl.exe
  2⤵
  PID:4368
- C:\Windows\System\mZxWAXr.exe
  C:\Windows\System\mZxWAXr.exe
  2⤵
  PID:4384
- C:\Windows\System\rXLGAbM.exe
  C:\Windows\System\rXLGAbM.exe
  2⤵
  PID:4400
- C:\Windows\System\PskFzNO.exe
  C:\Windows\System\PskFzNO.exe
  2⤵
  PID:4416
- C:\Windows\System\JrHJrpu.exe
  C:\Windows\System\JrHJrpu.exe
  2⤵
  PID:4432
- C:\Windows\System\cqIDYGc.exe
  C:\Windows\System\cqIDYGc.exe
  2⤵
  PID:4452
- C:\Windows\System\WlWrRQk.exe
  C:\Windows\System\WlWrRQk.exe
  2⤵
  PID:4524
- C:\Windows\System\LcbQwRE.exe
  C:\Windows\System\LcbQwRE.exe
  2⤵
  PID:4544
- C:\Windows\System\WdSosJC.exe
  C:\Windows\System\WdSosJC.exe
  2⤵
  PID:4564
- C:\Windows\System\YUEcmmq.exe
  C:\Windows\System\YUEcmmq.exe
  2⤵
  PID:4588
- C:\Windows\System\eCQYCMy.exe
  C:\Windows\System\eCQYCMy.exe
  2⤵
  PID:4604
- C:\Windows\System\kYcZSHx.exe
  C:\Windows\System\kYcZSHx.exe
  2⤵
  PID:4656
- C:\Windows\System\JnfyMGD.exe
  C:\Windows\System\JnfyMGD.exe
  2⤵
  PID:4676
- C:\Windows\System\CSxuaBx.exe
  C:\Windows\System\CSxuaBx.exe
  2⤵
  PID:4700
- C:\Windows\System\Lvshwbz.exe
  C:\Windows\System\Lvshwbz.exe
  2⤵
  PID:4716
- C:\Windows\System\lbDLVjG.exe
  C:\Windows\System\lbDLVjG.exe
  2⤵
  PID:4732
- C:\Windows\System\tUYhFfH.exe
  C:\Windows\System\tUYhFfH.exe
  2⤵
  PID:4748
- C:\Windows\System\sqUUZEP.exe
  C:\Windows\System\sqUUZEP.exe
  2⤵
  PID:4768
- C:\Windows\System\nuEQVTF.exe
  C:\Windows\System\nuEQVTF.exe
  2⤵
  PID:4784
- C:\Windows\System\fNirGmb.exe
  C:\Windows\System\fNirGmb.exe
  2⤵
  PID:4800
- C:\Windows\System\vRXeNZv.exe
  C:\Windows\System\vRXeNZv.exe
  2⤵
  PID:4816
- C:\Windows\System\TdUeUzA.exe
  C:\Windows\System\TdUeUzA.exe
  2⤵
  PID:4832
- C:\Windows\System\TfKoXzT.exe
  C:\Windows\System\TfKoXzT.exe
  2⤵
  PID:4848
- C:\Windows\System\CLLZcBq.exe
  C:\Windows\System\CLLZcBq.exe
  2⤵
  PID:4864
- C:\Windows\System\IjvCMVa.exe
  C:\Windows\System\IjvCMVa.exe
  2⤵
  PID:4880
- C:\Windows\System\IDUmKHK.exe
  C:\Windows\System\IDUmKHK.exe
  2⤵
  PID:4900
- C:\Windows\System\CLSVDeH.exe
  C:\Windows\System\CLSVDeH.exe
  2⤵
  PID:4916
- C:\Windows\System\wyVKRNC.exe
  C:\Windows\System\wyVKRNC.exe
  2⤵
  PID:4936
- C:\Windows\System\vSIipIm.exe
  C:\Windows\System\vSIipIm.exe
  2⤵
  PID:4952
- C:\Windows\System\ARCDTRM.exe
  C:\Windows\System\ARCDTRM.exe
  2⤵
  PID:4968
- C:\Windows\System\NlPmxTg.exe
  C:\Windows\System\NlPmxTg.exe
  2⤵
  PID:4984
- C:\Windows\System\UedSftC.exe
  C:\Windows\System\UedSftC.exe
  2⤵
  PID:5080
- C:\Windows\System\lyqqCFO.exe
  C:\Windows\System\lyqqCFO.exe
  2⤵
  PID:5096
- C:\Windows\System\ytmjdsQ.exe
  C:\Windows\System\ytmjdsQ.exe
  2⤵
  PID:5112
- C:\Windows\System\cKHBLPi.exe
  C:\Windows\System\cKHBLPi.exe
  2⤵
  PID:3416
- C:\Windows\System\WbtWIgW.exe
  C:\Windows\System\WbtWIgW.exe
  2⤵
  PID:840
- C:\Windows\System\wlhJMNw.exe
  C:\Windows\System\wlhJMNw.exe
  2⤵
  PID:2996
- C:\Windows\System\WrgqJbQ.exe
  C:\Windows\System\WrgqJbQ.exe
  2⤵
  PID:3944
- C:\Windows\System\rPcHtyX.exe
  C:\Windows\System\rPcHtyX.exe
  2⤵
  PID:1264
- C:\Windows\System\lqPgdCG.exe
  C:\Windows\System\lqPgdCG.exe
  2⤵
  PID:3232
- C:\Windows\System\whvGicm.exe
  C:\Windows\System\whvGicm.exe
  2⤵
  PID:3616
- C:\Windows\System\bBaQYwF.exe
  C:\Windows\System\bBaQYwF.exe
  2⤵
  PID:4108
- C:\Windows\System\LOQFxyZ.exe
  C:\Windows\System\LOQFxyZ.exe
  2⤵
  PID:4136
- C:\Windows\System\iqfigdR.exe
  C:\Windows\System\iqfigdR.exe
  2⤵
  PID:4152
- C:\Windows\System\hXWXhvK.exe
  C:\Windows\System\hXWXhvK.exe
  2⤵
  PID:4168
- C:\Windows\System\tBIjpSJ.exe
  C:\Windows\System\tBIjpSJ.exe
  2⤵
  PID:4392
- C:\Windows\System\XSbMeBF.exe
  C:\Windows\System\XSbMeBF.exe
  2⤵
  PID:4344
- C:\Windows\System\pQcmkOk.exe
  C:\Windows\System\pQcmkOk.exe
  2⤵
  PID:4408
- C:\Windows\System\JsAVJlF.exe
  C:\Windows\System\JsAVJlF.exe
  2⤵
  PID:4460
- C:\Windows\System\TSADFII.exe
  C:\Windows\System\TSADFII.exe
  2⤵
  PID:4480
- C:\Windows\System\KpQzKhA.exe
  C:\Windows\System\KpQzKhA.exe
  2⤵
  PID:4492
- C:\Windows\System\NUGjiAH.exe
  C:\Windows\System\NUGjiAH.exe
  2⤵
  PID:4520
- C:\Windows\System\pJWhMGu.exe
  C:\Windows\System\pJWhMGu.exe
  2⤵
  PID:4560
- C:\Windows\System\mBKGOcX.exe
  C:\Windows\System\mBKGOcX.exe
  2⤵
  PID:4584
- C:\Windows\System\WcyiAuM.exe
  C:\Windows\System\WcyiAuM.exe
  2⤵
  PID:2228
- C:\Windows\System\pbaYdCu.exe
  C:\Windows\System\pbaYdCu.exe
  2⤵
  PID:4628
- C:\Windows\System\olIGjMc.exe
  C:\Windows\System\olIGjMc.exe
  2⤵
  PID:4648
- C:\Windows\System\aOTWzBF.exe
  C:\Windows\System\aOTWzBF.exe
  2⤵
  PID:4668
- C:\Windows\System\aJqkPUO.exe
  C:\Windows\System\aJqkPUO.exe
  2⤵
  PID:4712
- C:\Windows\System\sSaDwKd.exe
  C:\Windows\System\sSaDwKd.exe
  2⤵
  PID:4780
- C:\Windows\System\wFtWTpB.exe
  C:\Windows\System\wFtWTpB.exe
  2⤵
  PID:4840
- C:\Windows\System\KMBBzlU.exe
  C:\Windows\System\KMBBzlU.exe
  2⤵
  PID:4860
- C:\Windows\System\xlFgFli.exe
  C:\Windows\System\xlFgFli.exe
  2⤵
  PID:4944
- C:\Windows\System\uYADSWU.exe
  C:\Windows\System\uYADSWU.exe
  2⤵
  PID:4908
- C:\Windows\System\HywprWX.exe
  C:\Windows\System\HywprWX.exe
  2⤵
  PID:4728
- C:\Windows\System\MdUYUOk.exe
  C:\Windows\System\MdUYUOk.exe
  2⤵
  PID:4932
- C:\Windows\System\VFtRBnl.exe
  C:\Windows\System\VFtRBnl.exe
  2⤵
  PID:4992
- C:\Windows\System\lLqOJSo.exe
  C:\Windows\System\lLqOJSo.exe
  2⤵
  PID:5012
- C:\Windows\System\uNKFuFC.exe
  C:\Windows\System\uNKFuFC.exe
  2⤵
  PID:5028
- C:\Windows\System\tzouOtq.exe
  C:\Windows\System\tzouOtq.exe
  2⤵
  PID:5056
- C:\Windows\System\LlPspMa.exe
  C:\Windows\System\LlPspMa.exe
  2⤵
  PID:4540
- C:\Windows\System\VpAaWFO.exe
  C:\Windows\System\VpAaWFO.exe
  2⤵
  PID:5076
- C:\Windows\System\ziqAaxE.exe
  C:\Windows\System\ziqAaxE.exe
  2⤵
  PID:4124
- C:\Windows\System\AtjknhU.exe
  C:\Windows\System\AtjknhU.exe
  2⤵
  PID:1700
- C:\Windows\System\QBaKDTw.exe
  C:\Windows\System\QBaKDTw.exe
  2⤵
  PID:2864
- C:\Windows\System\ZjePSGz.exe
  C:\Windows\System\ZjePSGz.exe
  2⤵
  PID:3964
- C:\Windows\System\JuHzcCy.exe
  C:\Windows\System\JuHzcCy.exe
  2⤵
  PID:868
- C:\Windows\System\JgSJiDu.exe
  C:\Windows\System\JgSJiDu.exe
  2⤵
  PID:1832
- C:\Windows\System\GLeKbBd.exe
  C:\Windows\System\GLeKbBd.exe
  2⤵
  PID:4188
- C:\Windows\System\xwWQNfX.exe
  C:\Windows\System\xwWQNfX.exe
  2⤵
  PID:4228
- C:\Windows\System\medAOWG.exe
  C:\Windows\System\medAOWG.exe
  2⤵
  PID:4256
- C:\Windows\System\TcPpdaL.exe
  C:\Windows\System\TcPpdaL.exe
  2⤵
  PID:4304
- C:\Windows\System\IykdTJC.exe
  C:\Windows\System\IykdTJC.exe
  2⤵
  PID:4428
- C:\Windows\System\HjEEoKf.exe
  C:\Windows\System\HjEEoKf.exe
  2⤵
  PID:4280
- C:\Windows\System\IaFajMY.exe
  C:\Windows\System\IaFajMY.exe
  2⤵
  PID:4360
- C:\Windows\System\swGaBCT.exe
  C:\Windows\System\swGaBCT.exe
  2⤵
  PID:4380
- C:\Windows\System\RWgFMzv.exe
  C:\Windows\System\RWgFMzv.exe
  2⤵
  PID:4440
- C:\Windows\System\vyubkoE.exe
  C:\Windows\System\vyubkoE.exe
  2⤵
  PID:4508
- C:\Windows\System\LjDSXHe.exe
  C:\Windows\System\LjDSXHe.exe
  2⤵
  PID:4556
- C:\Windows\System\oJlRiPR.exe
  C:\Windows\System\oJlRiPR.exe
  2⤵
  PID:4632
- C:\Windows\System\LzFxYHs.exe
  C:\Windows\System\LzFxYHs.exe
  2⤵
  PID:4692
- C:\Windows\System\UeotGAc.exe
  C:\Windows\System\UeotGAc.exe
  2⤵
  PID:4620
- C:\Windows\System\XefFFNb.exe
  C:\Windows\System\XefFFNb.exe
  2⤵
  PID:4532
- C:\Windows\System\OZdBNOo.exe
  C:\Windows\System\OZdBNOo.exe
  2⤵
  PID:4824
- C:\Windows\System\dVQpPnY.exe
  C:\Windows\System\dVQpPnY.exe
  2⤵
  PID:4708
- C:\Windows\System\FPfIJcc.exe
  C:\Windows\System\FPfIJcc.exe
  2⤵
  PID:4688
- C:\Windows\System\hgUxwAZ.exe
  C:\Windows\System\hgUxwAZ.exe
  2⤵
  PID:5000
- C:\Windows\System\UsfKIHU.exe
  C:\Windows\System\UsfKIHU.exe
  2⤵
  PID:4996
- C:\Windows\System\iOuUVqZ.exe
  C:\Windows\System\iOuUVqZ.exe
  2⤵
  PID:4652
- C:\Windows\System\GKhVFGb.exe
  C:\Windows\System\GKhVFGb.exe
  2⤵
  PID:5092
- C:\Windows\System\UzUgXOB.exe
  C:\Windows\System\UzUgXOB.exe
  2⤵
  PID:4148
- C:\Windows\System\xHLIHkC.exe
  C:\Windows\System\xHLIHkC.exe
  2⤵
  PID:4296
- C:\Windows\System\tvfCLHQ.exe
  C:\Windows\System\tvfCLHQ.exe
  2⤵
  PID:5020
- C:\Windows\System\DxCHAOu.exe
  C:\Windows\System\DxCHAOu.exe
  2⤵
  PID:4488
- C:\Windows\System\PRBVukn.exe
  C:\Windows\System\PRBVukn.exe
  2⤵
  PID:5108
- C:\Windows\System\GrkwmgI.exe
  C:\Windows\System\GrkwmgI.exe
  2⤵
  PID:5068
- C:\Windows\System\siJWqLL.exe
  C:\Windows\System\siJWqLL.exe
  2⤵
  PID:1060
- C:\Windows\System\OvhDszs.exe
  C:\Windows\System\OvhDszs.exe
  2⤵
  PID:4616
- C:\Windows\System\xtvhDGn.exe
  C:\Windows\System\xtvhDGn.exe
  2⤵
  PID:4192
- C:\Windows\System\xJCDicE.exe
  C:\Windows\System\xJCDicE.exe
  2⤵
  PID:4976
- C:\Windows\System\KiQwFQN.exe
  C:\Windows\System\KiQwFQN.exe
  2⤵
  PID:4196
- C:\Windows\System\YzKWjjW.exe
  C:\Windows\System\YzKWjjW.exe
  2⤵
  PID:4876
- C:\Windows\System\SHVDzyt.exe
  C:\Windows\System\SHVDzyt.exe
  2⤵
  PID:4888
- C:\Windows\System\sfJusGX.exe
  C:\Windows\System\sfJusGX.exe
  2⤵
  PID:4500
- C:\Windows\System\zLxWNGn.exe
  C:\Windows\System\zLxWNGn.exe
  2⤵
  PID:2868
- C:\Windows\System\rCGOPcu.exe
  C:\Windows\System\rCGOPcu.exe
  2⤵
  PID:4328
- C:\Windows\System\NOLZyHU.exe
  C:\Windows\System\NOLZyHU.exe
  2⤵
  PID:5136
- C:\Windows\System\OBXJKEK.exe
  C:\Windows\System\OBXJKEK.exe
  2⤵
  PID:5156
- C:\Windows\System\hCxUvir.exe
  C:\Windows\System\hCxUvir.exe
  2⤵
  PID:5172
- C:\Windows\System\WBWGyJX.exe
  C:\Windows\System\WBWGyJX.exe
  2⤵
  PID:5188
- C:\Windows\System\pITsETz.exe
  C:\Windows\System\pITsETz.exe
  2⤵
  PID:5204
- C:\Windows\System\qSVlcLG.exe
  C:\Windows\System\qSVlcLG.exe
  2⤵
  PID:5220
- C:\Windows\System\RpwwNCb.exe
  C:\Windows\System\RpwwNCb.exe
  2⤵
  PID:5240
- C:\Windows\System\AiYpyUM.exe
  C:\Windows\System\AiYpyUM.exe
  2⤵
  PID:5256
- C:\Windows\System\RvCaFSk.exe
  C:\Windows\System\RvCaFSk.exe
  2⤵
  PID:5272
- C:\Windows\System\lqdAHlz.exe
  C:\Windows\System\lqdAHlz.exe
  2⤵
  PID:5288
- C:\Windows\System\ZLmDwfn.exe
  C:\Windows\System\ZLmDwfn.exe
  2⤵
  PID:5304
- C:\Windows\System\tBNjQvi.exe
  C:\Windows\System\tBNjQvi.exe
  2⤵
  PID:5320
- C:\Windows\System\fRKYOTD.exe
  C:\Windows\System\fRKYOTD.exe
  2⤵
  PID:5340
- C:\Windows\System\gSUBtVY.exe
  C:\Windows\System\gSUBtVY.exe
  2⤵
  PID:5356
- C:\Windows\System\bbCBVJK.exe
  C:\Windows\System\bbCBVJK.exe
  2⤵
  PID:5376
- C:\Windows\System\LGUaswr.exe
  C:\Windows\System\LGUaswr.exe
  2⤵
  PID:5392
- C:\Windows\System\pHHfhXj.exe
  C:\Windows\System\pHHfhXj.exe
  2⤵
  PID:5412
- C:\Windows\System\DcOHLIk.exe
  C:\Windows\System\DcOHLIk.exe
  2⤵
  PID:5428
- C:\Windows\System\GNdNzaJ.exe
  C:\Windows\System\GNdNzaJ.exe
  2⤵
  PID:5444
- C:\Windows\System\EaMqPVB.exe
  C:\Windows\System\EaMqPVB.exe
  2⤵
  PID:5460
- C:\Windows\System\kKrUBFn.exe
  C:\Windows\System\kKrUBFn.exe
  2⤵
  PID:5476
- C:\Windows\System\iUxHOfk.exe
  C:\Windows\System\iUxHOfk.exe
  2⤵
  PID:5492
- C:\Windows\System\rVTSaNO.exe
  C:\Windows\System\rVTSaNO.exe
  2⤵
  PID:5508
- C:\Windows\System\BewYPaY.exe
  C:\Windows\System\BewYPaY.exe
  2⤵
  PID:5524
- C:\Windows\System\pDBukVh.exe
  C:\Windows\System\pDBukVh.exe
  2⤵
  PID:5540
- C:\Windows\System\tldFRou.exe
  C:\Windows\System\tldFRou.exe
  2⤵
  PID:5556
- C:\Windows\System\AFXevvX.exe
  C:\Windows\System\AFXevvX.exe
  2⤵
  PID:5572
- C:\Windows\System\SnHIXZo.exe
  C:\Windows\System\SnHIXZo.exe
  2⤵
  PID:5588
- C:\Windows\System\HvaRQhf.exe
  C:\Windows\System\HvaRQhf.exe
  2⤵
  PID:5604
- C:\Windows\System\BwCuvkV.exe
  C:\Windows\System\BwCuvkV.exe
  2⤵
  PID:5620
- C:\Windows\System\JuaZVeH.exe
  C:\Windows\System\JuaZVeH.exe
  2⤵
  PID:5636
- C:\Windows\System\usyFTfV.exe
  C:\Windows\System\usyFTfV.exe
  2⤵
  PID:5652
- C:\Windows\System\vTsksKy.exe
  C:\Windows\System\vTsksKy.exe
  2⤵
  PID:5668
- C:\Windows\System\XkyXVUK.exe
  C:\Windows\System\XkyXVUK.exe
  2⤵
  PID:5684
- C:\Windows\System\SQBiaXR.exe
  C:\Windows\System\SQBiaXR.exe
  2⤵
  PID:5700
- C:\Windows\System\KyPGjCz.exe
  C:\Windows\System\KyPGjCz.exe
  2⤵
  PID:5716
- C:\Windows\System\qZHuyOo.exe
  C:\Windows\System\qZHuyOo.exe
  2⤵
  PID:5732
- C:\Windows\System\LOivoIH.exe
  C:\Windows\System\LOivoIH.exe
  2⤵
  PID:5748
- C:\Windows\System\osiMlzJ.exe
  C:\Windows\System\osiMlzJ.exe
  2⤵
  PID:5768
- C:\Windows\System\TjDXgYE.exe
  C:\Windows\System\TjDXgYE.exe
  2⤵
  PID:5784
- C:\Windows\System\tixhpsU.exe
  C:\Windows\System\tixhpsU.exe
  2⤵
  PID:5800
- C:\Windows\System\GgehNaB.exe
  C:\Windows\System\GgehNaB.exe
  2⤵
  PID:5816
- C:\Windows\System\MBlouTX.exe
  C:\Windows\System\MBlouTX.exe
  2⤵
  PID:5832
- C:\Windows\System\aEKAnKf.exe
  C:\Windows\System\aEKAnKf.exe
  2⤵
  PID:5848
- C:\Windows\System\cYvwbAS.exe
  C:\Windows\System\cYvwbAS.exe
  2⤵
  PID:5864
- C:\Windows\System\GFFhfar.exe
  C:\Windows\System\GFFhfar.exe
  2⤵
  PID:5880
- C:\Windows\System\lnktvcg.exe
  C:\Windows\System\lnktvcg.exe
  2⤵
  PID:5896
- C:\Windows\System\FrpXuQB.exe
  C:\Windows\System\FrpXuQB.exe
  2⤵
  PID:5912
- C:\Windows\System\dtoBdWZ.exe
  C:\Windows\System\dtoBdWZ.exe
  2⤵
  PID:5928
- C:\Windows\System\NYwAIck.exe
  C:\Windows\System\NYwAIck.exe
  2⤵
  PID:5944
- C:\Windows\System\amHprNy.exe
  C:\Windows\System\amHprNy.exe
  2⤵
  PID:5960
- C:\Windows\System\nFfUDVr.exe
  C:\Windows\System\nFfUDVr.exe
  2⤵
  PID:5976
- C:\Windows\System\VEnDwEV.exe
  C:\Windows\System\VEnDwEV.exe
  2⤵
  PID:5992
- C:\Windows\System\kcyvpSO.exe
  C:\Windows\System\kcyvpSO.exe
  2⤵
  PID:6008
- C:\Windows\System\qKxxNKV.exe
  C:\Windows\System\qKxxNKV.exe
  2⤵
  PID:6024
- C:\Windows\System\mHzEGRG.exe
  C:\Windows\System\mHzEGRG.exe
  2⤵
  PID:6044
- C:\Windows\System\OkCkEAo.exe
  C:\Windows\System\OkCkEAo.exe
  2⤵
  PID:6060
- C:\Windows\System\utnsTFS.exe
  C:\Windows\System\utnsTFS.exe
  2⤵
  PID:6076
- C:\Windows\System\cCqDlpf.exe
  C:\Windows\System\cCqDlpf.exe
  2⤵
  PID:6092
- C:\Windows\System\cJOQlvD.exe
  C:\Windows\System\cJOQlvD.exe
  2⤵
  PID:6108
- C:\Windows\System\NNjsyoE.exe
  C:\Windows\System\NNjsyoE.exe
  2⤵
  PID:6132
- C:\Windows\System\HzuxgYY.exe
  C:\Windows\System\HzuxgYY.exe
  2⤵
  PID:5032
- C:\Windows\System\SKguZXS.exe
  C:\Windows\System\SKguZXS.exe
  2⤵
  PID:4376
- C:\Windows\System\EKmUxNw.exe
  C:\Windows\System\EKmUxNw.exe
  2⤵
  PID:4872
- C:\Windows\System\eQGWKey.exe
  C:\Windows\System\eQGWKey.exe
  2⤵
  PID:4312
- C:\Windows\System\HlvZGzl.exe
  C:\Windows\System\HlvZGzl.exe
  2⤵
  PID:5196
- C:\Windows\System\kLljvXt.exe
  C:\Windows\System\kLljvXt.exe
  2⤵
  PID:5236
- C:\Windows\System\FHUSiKU.exe
  C:\Windows\System\FHUSiKU.exe
  2⤵
  PID:5252
- C:\Windows\System\JCNqqKo.exe
  C:\Windows\System\JCNqqKo.exe
  2⤵
  PID:5184
- C:\Windows\System\lQqfbeZ.exe
  C:\Windows\System\lQqfbeZ.exe
  2⤵
  PID:5296
- C:\Windows\System\lawdRbZ.exe
  C:\Windows\System\lawdRbZ.exe
  2⤵
  PID:5364
- C:\Windows\System\WhLPsil.exe
  C:\Windows\System\WhLPsil.exe
  2⤵
  PID:4364
- C:\Windows\System\nSdCOoH.exe
  C:\Windows\System\nSdCOoH.exe
  2⤵
  PID:5436
- C:\Windows\System\pwLwpRK.exe
  C:\Windows\System\pwLwpRK.exe
  2⤵
  PID:4612
- C:\Windows\System\kobeHdn.exe
  C:\Windows\System\kobeHdn.exe
  2⤵
  PID:5016
- C:\Windows\System\trPCxCJ.exe
  C:\Windows\System\trPCxCJ.exe
  2⤵
  PID:4812
- C:\Windows\System\dnZSKxl.exe
  C:\Windows\System\dnZSKxl.exe
  2⤵
  PID:5228
- C:\Windows\System\jbzWbgC.exe
  C:\Windows\System\jbzWbgC.exe
  2⤵
  PID:5472
- C:\Windows\System\qeAGMOb.exe
  C:\Windows\System\qeAGMOb.exe
  2⤵
  PID:5504
- C:\Windows\System\TmOeQqN.exe
  C:\Windows\System\TmOeQqN.exe
  2⤵
  PID:5568
- C:\Windows\System\gGqWuYw.exe
  C:\Windows\System\gGqWuYw.exe
  2⤵
  PID:5284
- C:\Windows\System\uViiQIC.exe
  C:\Windows\System\uViiQIC.exe
  2⤵
  PID:5664
- C:\Windows\System\BPypNEX.exe
  C:\Windows\System\BPypNEX.exe
  2⤵
  PID:5452
- C:\Windows\System\cRSDAbU.exe
  C:\Windows\System\cRSDAbU.exe
  2⤵
  PID:5744
- C:\Windows\System\sIbImRR.exe
  C:\Windows\System\sIbImRR.exe
  2⤵
  PID:5612
- C:\Windows\System\LusypHK.exe
  C:\Windows\System\LusypHK.exe
  2⤵
  PID:5680
- C:\Windows\System\UphftqN.exe
  C:\Windows\System\UphftqN.exe
  2⤵
  PID:5780
- C:\Windows\System\cehxNvH.exe
  C:\Windows\System\cehxNvH.exe
  2⤵
  PID:5792
- C:\Windows\System\qwOevzM.exe
  C:\Windows\System\qwOevzM.exe
  2⤵
  PID:5856
- C:\Windows\System\TkrHzAL.exe
  C:\Windows\System\TkrHzAL.exe
  2⤵
  PID:5872
- C:\Windows\System\qBhBIyC.exe
  C:\Windows\System\qBhBIyC.exe
  2⤵
  PID:5924
- C:\Windows\System\NiKhFya.exe
  C:\Windows\System\NiKhFya.exe
  2⤵
  PID:5988
- C:\Windows\System\CqvLvJz.exe
  C:\Windows\System\CqvLvJz.exe
  2⤵
  PID:6056
- C:\Windows\System\OjtDZCh.exe
  C:\Windows\System\OjtDZCh.exe
  2⤵
  PID:6124
- C:\Windows\System\ovaGFxw.exe
  C:\Windows\System\ovaGFxw.exe
  2⤵
  PID:5908
- C:\Windows\System\AbMNAkZ.exe
  C:\Windows\System\AbMNAkZ.exe
  2⤵
  PID:5972
- C:\Windows\System\rxyMReY.exe
  C:\Windows\System\rxyMReY.exe
  2⤵
  PID:6036
- C:\Windows\System\edBDNlN.exe
  C:\Windows\System\edBDNlN.exe
  2⤵
  PID:6100
- C:\Windows\System\HhjasgN.exe
  C:\Windows\System\HhjasgN.exe
  2⤵
  PID:4484
- C:\Windows\System\RvHPhKi.exe
  C:\Windows\System\RvHPhKi.exe
  2⤵
  PID:5164
- C:\Windows\System\vSoaTqs.exe
  C:\Windows\System\vSoaTqs.exe
  2⤵
  PID:5148
- C:\Windows\System\aSIlTKf.exe
  C:\Windows\System\aSIlTKf.exe
  2⤵
  PID:4144
- C:\Windows\System\XpGjllK.exe
  C:\Windows\System\XpGjllK.exe
  2⤵
  PID:5468
- C:\Windows\System\tcylrtn.exe
  C:\Windows\System\tcylrtn.exe
  2⤵
  PID:5632
- C:\Windows\System\kHVmLqN.exe
  C:\Windows\System\kHVmLqN.exe
  2⤵
  PID:5740
- C:\Windows\System\WdpSdlS.exe
  C:\Windows\System\WdpSdlS.exe
  2⤵
  PID:5232
- C:\Windows\System\LPaKKML.exe
  C:\Windows\System\LPaKKML.exe
  2⤵
  PID:2112
- C:\Windows\System\RGoRgvJ.exe
  C:\Windows\System\RGoRgvJ.exe
  2⤵
  PID:5648
- C:\Windows\System\OTBiMcd.exe
  C:\Windows\System\OTBiMcd.exe
  2⤵
  PID:5956
- C:\Windows\System\vIOMEaA.exe
  C:\Windows\System\vIOMEaA.exe
  2⤵
  PID:5940
- C:\Windows\System\tAvYLsL.exe
  C:\Windows\System\tAvYLsL.exe
  2⤵
  PID:6072
- C:\Windows\System\XHdtpGC.exe
  C:\Windows\System\XHdtpGC.exe
  2⤵
  PID:5756
- C:\Windows\System\vwefCgy.exe
  C:\Windows\System\vwefCgy.exe
  2⤵
  PID:5168
- C:\Windows\System\jqrFIOm.exe
  C:\Windows\System\jqrFIOm.exe
  2⤵
  PID:5300
- C:\Windows\System\mXrzsbf.exe
  C:\Windows\System\mXrzsbf.exe
  2⤵
  PID:5132
- C:\Windows\System\fedeZac.exe
  C:\Windows\System\fedeZac.exe
  2⤵
  PID:5420
- C:\Windows\System\TGGUflO.exe
  C:\Windows\System\TGGUflO.exe
  2⤵
  PID:5724
- C:\Windows\System\FTtKmvV.exe
  C:\Windows\System\FTtKmvV.exe
  2⤵
  PID:5596
- C:\Windows\System\xibxYco.exe
  C:\Windows\System\xibxYco.exe
  2⤵
  PID:5488
- C:\Windows\System\BtsVQcG.exe
  C:\Windows\System\BtsVQcG.exe
  2⤵
  PID:5348
- C:\Windows\System\sDsNIFZ.exe
  C:\Windows\System\sDsNIFZ.exe
  2⤵
  PID:6088
- C:\Windows\System\kxpDTgB.exe
  C:\Windows\System\kxpDTgB.exe
  2⤵
  PID:6116
- C:\Windows\System\qzwLTKH.exe
  C:\Windows\System\qzwLTKH.exe
  2⤵
  PID:5372
- C:\Windows\System\RFQgPdp.exe
  C:\Windows\System\RFQgPdp.exe
  2⤵
  PID:5152
- C:\Windows\System\AGgSxOp.exe
  C:\Windows\System\AGgSxOp.exe
  2⤵
  PID:6020
- C:\Windows\System\eNTLZbw.exe
  C:\Windows\System\eNTLZbw.exe
  2⤵
  PID:4128
- C:\Windows\System\lhVUTVR.exe
  C:\Windows\System\lhVUTVR.exe
  2⤵
  PID:5760
- C:\Windows\System\QFXiwzT.exe
  C:\Windows\System\QFXiwzT.exe
  2⤵
  PID:4160
- C:\Windows\System\BurYGUU.exe
  C:\Windows\System\BurYGUU.exe
  2⤵
  PID:5600
- C:\Windows\System\ECIzhhp.exe
  C:\Windows\System\ECIzhhp.exe
  2⤵
  PID:5384
- C:\Windows\System\GvJNNsk.exe
  C:\Windows\System\GvJNNsk.exe
  2⤵
  PID:5712
- C:\Windows\System\ZeAcWOl.exe
  C:\Windows\System\ZeAcWOl.exe
  2⤵
  PID:5424
- C:\Windows\System\cqYTxig.exe
  C:\Windows\System\cqYTxig.exe
  2⤵
  PID:6164
- C:\Windows\System\WZIYuGe.exe
  C:\Windows\System\WZIYuGe.exe
  2⤵
  PID:6184
- C:\Windows\System\GEuUUje.exe
  C:\Windows\System\GEuUUje.exe
  2⤵
  PID:6200
- C:\Windows\System\MDugAdI.exe
  C:\Windows\System\MDugAdI.exe
  2⤵
  PID:6216
- C:\Windows\System\TyyhOWa.exe
  C:\Windows\System\TyyhOWa.exe
  2⤵
  PID:6232
- C:\Windows\System\qDHHzzB.exe
  C:\Windows\System\qDHHzzB.exe
  2⤵
  PID:6248
- C:\Windows\System\eLMgUEI.exe
  C:\Windows\System\eLMgUEI.exe
  2⤵
  PID:6264
- C:\Windows\System\CSECyoI.exe
  C:\Windows\System\CSECyoI.exe
  2⤵
  PID:6280
- C:\Windows\System\PjbVzUx.exe
  C:\Windows\System\PjbVzUx.exe
  2⤵
  PID:6300
- C:\Windows\System\KyyynMm.exe
  C:\Windows\System\KyyynMm.exe
  2⤵
  PID:6316
- C:\Windows\System\jaVlSRc.exe
  C:\Windows\System\jaVlSRc.exe
  2⤵
  PID:6332
- C:\Windows\System\PGwiVBl.exe
  C:\Windows\System\PGwiVBl.exe
  2⤵
  PID:6352
- C:\Windows\System\txUPvfV.exe
  C:\Windows\System\txUPvfV.exe
  2⤵
  PID:6368
- C:\Windows\System\uLUKUIY.exe
  C:\Windows\System\uLUKUIY.exe
  2⤵
  PID:6384
- C:\Windows\System\KHYhBOT.exe
  C:\Windows\System\KHYhBOT.exe
  2⤵
  PID:6400
- C:\Windows\System\BcZfvzz.exe
  C:\Windows\System\BcZfvzz.exe
  2⤵
  PID:6416
- C:\Windows\System\yRgLzPM.exe
  C:\Windows\System\yRgLzPM.exe
  2⤵
  PID:6436
- C:\Windows\System\MDqFefu.exe
  C:\Windows\System\MDqFefu.exe
  2⤵
  PID:6452
- C:\Windows\System\NCyWMJv.exe
  C:\Windows\System\NCyWMJv.exe
  2⤵
  PID:6472
- C:\Windows\System\PagBYor.exe
  C:\Windows\System\PagBYor.exe
  2⤵
  PID:6488
- C:\Windows\System\NqcwQLn.exe
  C:\Windows\System\NqcwQLn.exe
  2⤵
  PID:6508
- C:\Windows\System\xrqTFHw.exe
  C:\Windows\System\xrqTFHw.exe
  2⤵
  PID:6524
- C:\Windows\System\nwcsapv.exe
  C:\Windows\System\nwcsapv.exe
  2⤵
  PID:6540
- C:\Windows\System\kOzPKac.exe
  C:\Windows\System\kOzPKac.exe
  2⤵
  PID:6560
- C:\Windows\System\pkNsEuJ.exe
  C:\Windows\System\pkNsEuJ.exe
  2⤵
  PID:6616
- C:\Windows\System\PxsTxio.exe
  C:\Windows\System\PxsTxio.exe
  2⤵
  PID:6632
- C:\Windows\System\gZBARTh.exe
  C:\Windows\System\gZBARTh.exe
  2⤵
  PID:6648
- C:\Windows\System\qNmcVCI.exe
  C:\Windows\System\qNmcVCI.exe
  2⤵
  PID:6664
- C:\Windows\System\kXSuQSC.exe
  C:\Windows\System\kXSuQSC.exe
  2⤵
  PID:6680
- C:\Windows\System\mmxrTAY.exe
  C:\Windows\System\mmxrTAY.exe
  2⤵
  PID:6696
- C:\Windows\System\uMJeAmE.exe
  C:\Windows\System\uMJeAmE.exe
  2⤵
  PID:6712
- C:\Windows\System\BYcCilV.exe
  C:\Windows\System\BYcCilV.exe
  2⤵
  PID:6732
- C:\Windows\System\YyNRMGW.exe
  C:\Windows\System\YyNRMGW.exe
  2⤵
  PID:6748
- C:\Windows\System\TsSOXMp.exe
  C:\Windows\System\TsSOXMp.exe
  2⤵
  PID:6768
- C:\Windows\System\zrbNstA.exe
  C:\Windows\System\zrbNstA.exe
  2⤵
  PID:6784
- C:\Windows\System\CzVqIXL.exe
  C:\Windows\System\CzVqIXL.exe
  2⤵
  PID:6800
- C:\Windows\System\cdbKBbS.exe
  C:\Windows\System\cdbKBbS.exe
  2⤵
  PID:6816
- C:\Windows\System\smKuNer.exe
  C:\Windows\System\smKuNer.exe
  2⤵
  PID:6832
- C:\Windows\System\dAfYsie.exe
  C:\Windows\System\dAfYsie.exe
  2⤵
  PID:6848
- C:\Windows\System\ZFwUjWY.exe
  C:\Windows\System\ZFwUjWY.exe
  2⤵
  PID:6864
- C:\Windows\System\INzElNS.exe
  C:\Windows\System\INzElNS.exe
  2⤵
  PID:6884
- C:\Windows\System\rjPSKfr.exe
  C:\Windows\System\rjPSKfr.exe
  2⤵
  PID:6900
- C:\Windows\System\uGhwjjG.exe
  C:\Windows\System\uGhwjjG.exe
  2⤵
  PID:6916
- C:\Windows\System\gOOaNit.exe
  C:\Windows\System\gOOaNit.exe
  2⤵
  PID:6932
- C:\Windows\System\usDDmBD.exe
  C:\Windows\System\usDDmBD.exe
  2⤵
  PID:6952
- C:\Windows\System\eNgUPHg.exe
  C:\Windows\System\eNgUPHg.exe
  2⤵
  PID:6984
- C:\Windows\System\VbXZniO.exe
  C:\Windows\System\VbXZniO.exe
  2⤵
  PID:7000
- C:\Windows\System\FvKyWCx.exe
  C:\Windows\System\FvKyWCx.exe
  2⤵
  PID:7016
- C:\Windows\System\LuhFLak.exe
  C:\Windows\System\LuhFLak.exe
  2⤵
  PID:7036
- C:\Windows\System\xxgcbGW.exe
  C:\Windows\System\xxgcbGW.exe
  2⤵
  PID:7052
- C:\Windows\System\dsTftMe.exe
  C:\Windows\System\dsTftMe.exe
  2⤵
  PID:7072
- C:\Windows\System\HGnxkTo.exe
  C:\Windows\System\HGnxkTo.exe
  2⤵
  PID:7088
- C:\Windows\System\PjfUnxO.exe
  C:\Windows\System\PjfUnxO.exe
  2⤵
  PID:7104
- C:\Windows\System\XnuQiWs.exe
  C:\Windows\System\XnuQiWs.exe
  2⤵
  PID:7120
- C:\Windows\System\qkDOxgx.exe
  C:\Windows\System\qkDOxgx.exe
  2⤵
  PID:7136
- C:\Windows\System\bNAlnif.exe
  C:\Windows\System\bNAlnif.exe
  2⤵
  PID:7156
- C:\Windows\System\yVCeOtX.exe
  C:\Windows\System\yVCeOtX.exe
  2⤵
  PID:4928
- C:\Windows\System\wWNuQLV.exe
  C:\Windows\System\wWNuQLV.exe
  2⤵
  PID:4248
- C:\Windows\System\SlVbwvw.exe
  C:\Windows\System\SlVbwvw.exe
  2⤵
  PID:5536
- C:\Windows\System\rWPLwRk.exe
  C:\Windows\System\rWPLwRk.exe
  2⤵
  PID:6212
- C:\Windows\System\AhycdYK.exe
  C:\Windows\System\AhycdYK.exe
  2⤵
  PID:6308
- C:\Windows\System\jQsrDBo.exe
  C:\Windows\System\jQsrDBo.exe
  2⤵
  PID:6348
- C:\Windows\System\PqRWrat.exe
  C:\Windows\System\PqRWrat.exe
  2⤵
  PID:6412
- C:\Windows\System\idKvhgm.exe
  C:\Windows\System\idKvhgm.exe
  2⤵
  PID:6448
- C:\Windows\System\iJjItHd.exe
  C:\Windows\System\iJjItHd.exe
  2⤵
  PID:6520
- C:\Windows\System\jYSmzvR.exe
  C:\Windows\System\jYSmzvR.exe
  2⤵
  PID:5548
- C:\Windows\System\hqnILtT.exe
  C:\Windows\System\hqnILtT.exe
  2⤵
  PID:6324
- C:\Windows\System\gsduFZy.exe
  C:\Windows\System\gsduFZy.exe
  2⤵
  PID:4252
- C:\Windows\System\bONlVuG.exe
  C:\Windows\System\bONlVuG.exe
  2⤵
  PID:6504
- C:\Windows\System\IqhbvzU.exe
  C:\Windows\System\IqhbvzU.exe
  2⤵
  PID:6156
- C:\Windows\System\zVFuOYA.exe
  C:\Windows\System\zVFuOYA.exe
  2⤵
  PID:6288
- C:\Windows\System\pRjopVb.exe
  C:\Windows\System\pRjopVb.exe
  2⤵
  PID:6364
- C:\Windows\System\QSmaRHj.exe
  C:\Windows\System\QSmaRHj.exe
  2⤵
  PID:6424
- C:\Windows\System\bjKiLlE.exe
  C:\Windows\System\bjKiLlE.exe
  2⤵
  PID:6464
- C:\Windows\System\lCwqbgN.exe
  C:\Windows\System\lCwqbgN.exe
  2⤵
  PID:6536
- C:\Windows\System\OEKyzAr.exe
  C:\Windows\System\OEKyzAr.exe
  2⤵
  PID:6576
- C:\Windows\System\bFIZzKK.exe
  C:\Windows\System\bFIZzKK.exe
  2⤵
  PID:6592
- C:\Windows\System\fGEgSSu.exe
  C:\Windows\System\fGEgSSu.exe
  2⤵
  PID:5764
- C:\Windows\System\LGKpCBR.exe
  C:\Windows\System\LGKpCBR.exe
  2⤵
  PID:6676
- C:\Windows\System\rLDzZKe.exe
  C:\Windows\System\rLDzZKe.exe
  2⤵
  PID:6640
- C:\Windows\System\IERSaIS.exe
  C:\Windows\System\IERSaIS.exe
  2⤵
  PID:6704
- C:\Windows\System\cydHgXd.exe
  C:\Windows\System\cydHgXd.exe
  2⤵
  PID:6688
- C:\Windows\System\MDhXtSB.exe
  C:\Windows\System\MDhXtSB.exe
  2⤵
  PID:6728
- C:\Windows\System\AEmdciu.exe
  C:\Windows\System\AEmdciu.exe
  2⤵
  PID:6792
- C:\Windows\System\ZUZcFmy.exe
  C:\Windows\System\ZUZcFmy.exe
  2⤵
  PID:6856
- C:\Windows\System\xyMMBkl.exe
  C:\Windows\System\xyMMBkl.exe
  2⤵
  PID:6776
- C:\Windows\System\fCOftpi.exe
  C:\Windows\System\fCOftpi.exe
  2⤵
  PID:6908
- C:\Windows\System\duDjSoG.exe
  C:\Windows\System\duDjSoG.exe
  2⤵
  PID:6876
- C:\Windows\System\qlCZdDZ.exe
  C:\Windows\System\qlCZdDZ.exe
  2⤵
  PID:6976
- C:\Windows\System\OxQnumQ.exe
  C:\Windows\System\OxQnumQ.exe
  2⤵
  PID:6912
- C:\Windows\System\RnJkksa.exe
  C:\Windows\System\RnJkksa.exe
  2⤵
  PID:6944
- C:\Windows\System\OuNsktY.exe
  C:\Windows\System\OuNsktY.exe
  2⤵
  PID:7028
- C:\Windows\System\anlVHDM.exe
  C:\Windows\System\anlVHDM.exe
  2⤵
  PID:7060
- C:\Windows\System\YoYNVaU.exe
  C:\Windows\System\YoYNVaU.exe
  2⤵
  PID:7068
- C:\Windows\System\tWvmdwM.exe
  C:\Windows\System\tWvmdwM.exe
  2⤵
  PID:7144
- C:\Windows\System\fFDOufU.exe
  C:\Windows\System\fFDOufU.exe
  2⤵
  PID:5336
- C:\Windows\System\UUiEDTL.exe
  C:\Windows\System\UUiEDTL.exe
  2⤵
  PID:7128
- C:\Windows\System\QRvbZfR.exe
  C:\Windows\System\QRvbZfR.exe
  2⤵
  PID:5776
- C:\Windows\System\MeqAGdB.exe
  C:\Windows\System\MeqAGdB.exe
  2⤵
  PID:6276
- C:\Windows\System\uJgHFtN.exe
  C:\Windows\System\uJgHFtN.exe
  2⤵
  PID:5552
- C:\Windows\System\BIfHhik.exe
  C:\Windows\System\BIfHhik.exe
  2⤵
  PID:6496
- C:\Windows\System\DwdijKY.exe
  C:\Windows\System\DwdijKY.exe
  2⤵
  PID:6260
- C:\Windows\System\JjBuGcv.exe
  C:\Windows\System\JjBuGcv.exe
  2⤵
  PID:5824
- C:\Windows\System\aFmVygf.exe
  C:\Windows\System\aFmVygf.exe
  2⤵
  PID:5920
- C:\Windows\System\wNGqAGJ.exe
  C:\Windows\System\wNGqAGJ.exe
  2⤵
  PID:6432
- C:\Windows\System\OIBntko.exe
  C:\Windows\System\OIBntko.exe
  2⤵
  PID:6572
- C:\Windows\System\EVptZsl.exe
  C:\Windows\System\EVptZsl.exe
  2⤵
  PID:6780
- C:\Windows\System\VLqYZlO.exe
  C:\Windows\System\VLqYZlO.exe
  2⤵
  PID:6744
- C:\Windows\System\vAKoJFI.exe
  C:\Windows\System\vAKoJFI.exe
  2⤵
  PID:6872
- C:\Windows\System\mYQBNCX.exe
  C:\Windows\System\mYQBNCX.exe
  2⤵
  PID:6892
- C:\Windows\System\MBbiKZX.exe
  C:\Windows\System\MBbiKZX.exe
  2⤵
  PID:6880
- C:\Windows\System\MZFDSki.exe
  C:\Windows\System\MZFDSki.exe
  2⤵
  PID:7080
- C:\Windows\System\bJwucRZ.exe
  C:\Windows\System\bJwucRZ.exe
  2⤵
  PID:6824
- C:\Windows\System\QSaeKxq.exe
  C:\Windows\System\QSaeKxq.exe
  2⤵
  PID:6968
- C:\Windows\System\CdpzCrV.exe
  C:\Windows\System\CdpzCrV.exe
  2⤵
  PID:5280
- C:\Windows\System\EJBRJMM.exe
  C:\Windows\System\EJBRJMM.exe
  2⤵
  PID:7116
- C:\Windows\System\fcpMODz.exe
  C:\Windows\System\fcpMODz.exe
  2⤵
  PID:6208
- C:\Windows\System\LNJOQGo.exe
  C:\Windows\System\LNJOQGo.exe
  2⤵
  PID:4896
- C:\Windows\System\VvpsVOe.exe
  C:\Windows\System\VvpsVOe.exe
  2⤵
  PID:5352
- C:\Windows\System\WefoPdh.exe
  C:\Windows\System\WefoPdh.exe
  2⤵
  PID:6532
- C:\Windows\System\AfLzkUw.exe
  C:\Windows\System\AfLzkUw.exe
  2⤵
  PID:6588
- C:\Windows\System\FGaLvbF.exe
  C:\Windows\System\FGaLvbF.exe
  2⤵
  PID:6724
- C:\Windows\System\TGqcFjM.exe
  C:\Windows\System\TGqcFjM.exe
  2⤵
  PID:5440
- C:\Windows\System\hufRhww.exe
  C:\Windows\System\hufRhww.exe
  2⤵
  PID:6296
- C:\Windows\System\VsPCXfE.exe
  C:\Windows\System\VsPCXfE.exe
  2⤵
  PID:6812
- C:\Windows\System\QiCowUL.exe
  C:\Windows\System\QiCowUL.exe
  2⤵
  PID:6960
- C:\Windows\System\PbxEnZZ.exe
  C:\Windows\System\PbxEnZZ.exe
  2⤵
  PID:6256
- C:\Windows\System\oVvYumX.exe
  C:\Windows\System\oVvYumX.exe
  2⤵
  PID:6176
- C:\Windows\System\wPqFeUE.exe
  C:\Windows\System\wPqFeUE.exe
  2⤵
  PID:6740
- C:\Windows\System\YfjPdwm.exe
  C:\Windows\System\YfjPdwm.exe
  2⤵
  PID:7112
- C:\Windows\System\UdVWotl.exe
  C:\Windows\System\UdVWotl.exe
  2⤵
  PID:5404
- C:\Windows\System\MTFSLNV.exe
  C:\Windows\System\MTFSLNV.exe
  2⤵
  PID:6228
- C:\Windows\System\RTOrjZJ.exe
  C:\Windows\System\RTOrjZJ.exe
  2⤵
  PID:6940
- C:\Windows\System\YiSgvqD.exe
  C:\Windows\System\YiSgvqD.exe
  2⤵
  PID:6328
- C:\Windows\System\nOOoxpS.exe
  C:\Windows\System\nOOoxpS.exe
  2⤵
  PID:2680
- C:\Windows\System\ERsfHYa.exe
  C:\Windows\System\ERsfHYa.exe
  2⤵
  PID:7184
- C:\Windows\System\YUYAlWw.exe
  C:\Windows\System\YUYAlWw.exe
  2⤵
  PID:7200
- C:\Windows\System\UoJSFvQ.exe
  C:\Windows\System\UoJSFvQ.exe
  2⤵
  PID:7216
- C:\Windows\System\QLlNvsC.exe
  C:\Windows\System\QLlNvsC.exe
  2⤵
  PID:7232
- C:\Windows\System\wdFNntj.exe
  C:\Windows\System\wdFNntj.exe
  2⤵
  PID:7252
- C:\Windows\System\imRmWSj.exe
  C:\Windows\System\imRmWSj.exe
  2⤵
  PID:7268
- C:\Windows\System\RVyLUbF.exe
  C:\Windows\System\RVyLUbF.exe
  2⤵
  PID:7284
- C:\Windows\System\fgUAbVF.exe
  C:\Windows\System\fgUAbVF.exe
  2⤵
  PID:7300
- C:\Windows\System\LPDuzYq.exe
  C:\Windows\System\LPDuzYq.exe
  2⤵
  PID:7316
- C:\Windows\System\WLyBxXu.exe
  C:\Windows\System\WLyBxXu.exe
  2⤵
  PID:7332
- C:\Windows\System\HAQdLZy.exe
  C:\Windows\System\HAQdLZy.exe
  2⤵
  PID:7348
- C:\Windows\System\IaGldPM.exe
  C:\Windows\System\IaGldPM.exe
  2⤵
  PID:7364
- C:\Windows\System\pBMRdwj.exe
  C:\Windows\System\pBMRdwj.exe
  2⤵
  PID:7380
- C:\Windows\System\GjsNRrp.exe
  C:\Windows\System\GjsNRrp.exe
  2⤵
  PID:7396
- C:\Windows\System\dOkjlwD.exe
  C:\Windows\System\dOkjlwD.exe
  2⤵
  PID:7412
- C:\Windows\System\GCoZBSM.exe
  C:\Windows\System\GCoZBSM.exe
  2⤵
  PID:7432
- C:\Windows\System\fLgFWts.exe
  C:\Windows\System\fLgFWts.exe
  2⤵
  PID:7448
- C:\Windows\System\LgMBsVP.exe
  C:\Windows\System\LgMBsVP.exe
  2⤵
  PID:7464
- C:\Windows\System\ZswWcuL.exe
  C:\Windows\System\ZswWcuL.exe
  2⤵
  PID:7480
- C:\Windows\System\fqsaWLo.exe
  C:\Windows\System\fqsaWLo.exe
  2⤵
  PID:7496
- C:\Windows\System\WNXKQQv.exe
  C:\Windows\System\WNXKQQv.exe
  2⤵
  PID:7512
- C:\Windows\System\FmtNgsC.exe
  C:\Windows\System\FmtNgsC.exe
  2⤵
  PID:7528
- C:\Windows\System\avlVZub.exe
  C:\Windows\System\avlVZub.exe
  2⤵
  PID:7544
- C:\Windows\System\WiBJwLz.exe
  C:\Windows\System\WiBJwLz.exe
  2⤵
  PID:7560
- C:\Windows\System\WQlvOMf.exe
  C:\Windows\System\WQlvOMf.exe
  2⤵
  PID:7576
- C:\Windows\System\DJvXvRN.exe
  C:\Windows\System\DJvXvRN.exe
  2⤵
  PID:7592
- C:\Windows\System\rxpsbiv.exe
  C:\Windows\System\rxpsbiv.exe
  2⤵
  PID:7608
- C:\Windows\System\ipwZLLT.exe
  C:\Windows\System\ipwZLLT.exe
  2⤵
  PID:7624
- C:\Windows\System\OlvooXW.exe
  C:\Windows\System\OlvooXW.exe
  2⤵
  PID:7640
- C:\Windows\System\bHiJhIF.exe
  C:\Windows\System\bHiJhIF.exe
  2⤵
  PID:7656
- C:\Windows\System\XOjhkwV.exe
  C:\Windows\System\XOjhkwV.exe
  2⤵
  PID:7672
- C:\Windows\System\lJKfSzy.exe
  C:\Windows\System\lJKfSzy.exe
  2⤵
  PID:7688
- C:\Windows\System\AdGDcJO.exe
  C:\Windows\System\AdGDcJO.exe
  2⤵
  PID:7704
- C:\Windows\System\jsNHcov.exe
  C:\Windows\System\jsNHcov.exe
  2⤵
  PID:7720
- C:\Windows\System\UvLdKOb.exe
  C:\Windows\System\UvLdKOb.exe
  2⤵
  PID:7736
- C:\Windows\System\wUXkzwt.exe
  C:\Windows\System\wUXkzwt.exe
  2⤵
  PID:7752
- C:\Windows\System\wDvtrax.exe
  C:\Windows\System\wDvtrax.exe
  2⤵
  PID:7768
- C:\Windows\System\khqHcjZ.exe
  C:\Windows\System\khqHcjZ.exe
  2⤵
  PID:7784
- C:\Windows\System\mTJLPwV.exe
  C:\Windows\System\mTJLPwV.exe
  2⤵
  PID:7800
- C:\Windows\System\BDbHChu.exe
  C:\Windows\System\BDbHChu.exe
  2⤵
  PID:7816
- C:\Windows\System\QXuaptA.exe
  C:\Windows\System\QXuaptA.exe
  2⤵
  PID:7832
- C:\Windows\System\dGHfqnQ.exe
  C:\Windows\System\dGHfqnQ.exe
  2⤵
  PID:7848
- C:\Windows\System\XVVoJkA.exe
  C:\Windows\System\XVVoJkA.exe
  2⤵
  PID:7864
- C:\Windows\System\kEFAWxD.exe
  C:\Windows\System\kEFAWxD.exe
  2⤵
  PID:7880
- C:\Windows\System\cjbxLEG.exe
  C:\Windows\System\cjbxLEG.exe
  2⤵
  PID:7896
- C:\Windows\System\RJRCXTh.exe
  C:\Windows\System\RJRCXTh.exe
  2⤵
  PID:7912
- C:\Windows\System\kzFOptj.exe
  C:\Windows\System\kzFOptj.exe
  2⤵
  PID:7928
- C:\Windows\System\YFbTiBx.exe
  C:\Windows\System\YFbTiBx.exe
  2⤵
  PID:7944
- C:\Windows\System\XLHxGDn.exe
  C:\Windows\System\XLHxGDn.exe
  2⤵
  PID:7960
- C:\Windows\System\UEtPzwf.exe
  C:\Windows\System\UEtPzwf.exe
  2⤵
  PID:7976
- C:\Windows\System\pkUhwUa.exe
  C:\Windows\System\pkUhwUa.exe
  2⤵
  PID:7992
- C:\Windows\System\uvebAKX.exe
  C:\Windows\System\uvebAKX.exe
  2⤵
  PID:8012
- C:\Windows\System\WFYtvAR.exe
  C:\Windows\System\WFYtvAR.exe
  2⤵
  PID:8028
- C:\Windows\System\XsueVNK.exe
  C:\Windows\System\XsueVNK.exe
  2⤵
  PID:8044
- C:\Windows\System\ddyaAGz.exe
  C:\Windows\System\ddyaAGz.exe
  2⤵
  PID:8060
- C:\Windows\System\KzlxwAK.exe
  C:\Windows\System\KzlxwAK.exe
  2⤵
  PID:8076
- C:\Windows\System\IqeLflt.exe
  C:\Windows\System\IqeLflt.exe
  2⤵
  PID:8092
- C:\Windows\System\sTRZFqC.exe
  C:\Windows\System\sTRZFqC.exe
  2⤵
  PID:8108
- C:\Windows\System\TYtDkyZ.exe
  C:\Windows\System\TYtDkyZ.exe
  2⤵
  PID:8124
- C:\Windows\System\ZVqBVtX.exe
  C:\Windows\System\ZVqBVtX.exe
  2⤵
  PID:8140
- C:\Windows\System\rRUXuaP.exe
  C:\Windows\System\rRUXuaP.exe
  2⤵
  PID:8156
- C:\Windows\System\vQyyIaw.exe
  C:\Windows\System\vQyyIaw.exe
  2⤵
  PID:8176
- C:\Windows\System\VnYUGgn.exe
  C:\Windows\System\VnYUGgn.exe
  2⤵
  PID:7180
- C:\Windows\System\XdItdeL.exe
  C:\Windows\System\XdItdeL.exe
  2⤵
  PID:6840
- C:\Windows\System\tVLkBKd.exe
  C:\Windows\System\tVLkBKd.exe
  2⤵
  PID:7244
- C:\Windows\System\DkDhlfS.exe
  C:\Windows\System\DkDhlfS.exe
  2⤵
  PID:6972
- C:\Windows\System\wndJkNe.exe
  C:\Windows\System\wndJkNe.exe
  2⤵
  PID:7224
- C:\Windows\System\gMgpiUg.exe
  C:\Windows\System\gMgpiUg.exe
  2⤵
  PID:7260
- C:\Windows\System\lIQjLpl.exe
  C:\Windows\System\lIQjLpl.exe
  2⤵
  PID:7308
- C:\Windows\System\CXlsIOU.exe
  C:\Windows\System\CXlsIOU.exe
  2⤵
  PID:7340
- C:\Windows\System\FdndZWE.exe
  C:\Windows\System\FdndZWE.exe
  2⤵
  PID:7324
- C:\Windows\System\KlnnPyv.exe
  C:\Windows\System\KlnnPyv.exe
  2⤵
  PID:7444
- C:\Windows\System\jwuxEgp.exe
  C:\Windows\System\jwuxEgp.exe
  2⤵
  PID:7504
- C:\Windows\System\CvTHiug.exe
  C:\Windows\System\CvTHiug.exe
  2⤵
  PID:7420
- C:\Windows\System\ZobyzHE.exe
  C:\Windows\System\ZobyzHE.exe
  2⤵
  PID:7360
- C:\Windows\System\gYVZJWX.exe
  C:\Windows\System\gYVZJWX.exe
  2⤵
  PID:7600
- C:\Windows\System\MICwIYT.exe
  C:\Windows\System\MICwIYT.exe
  2⤵
  PID:7632
- C:\Windows\System\YusUYbp.exe
  C:\Windows\System\YusUYbp.exe
  2⤵
  PID:7696
- C:\Windows\System\nPicPuw.exe
  C:\Windows\System\nPicPuw.exe
  2⤵
  PID:7728
- C:\Windows\System\EFnsffE.exe
  C:\Windows\System\EFnsffE.exe
  2⤵
  PID:7764
- C:\Windows\System\itwskEq.exe
  C:\Windows\System\itwskEq.exe
  2⤵
  PID:7824
- C:\Windows\System\TeOdXLj.exe
  C:\Windows\System\TeOdXLj.exe
  2⤵
  PID:7524
- C:\Windows\System\WenCfEo.exe
  C:\Windows\System\WenCfEo.exe
  2⤵
  PID:7648
- C:\Windows\System\vmsuHVR.exe
  C:\Windows\System\vmsuHVR.exe
  2⤵
  PID:7588
- C:\Windows\System\FziNskE.exe
  C:\Windows\System\FziNskE.exe
  2⤵
  PID:7712
- C:\Windows\System\GzXDtro.exe
  C:\Windows\System\GzXDtro.exe
  2⤵
  PID:7776
- C:\Windows\System\KSgXZFT.exe
  C:\Windows\System\KSgXZFT.exe
  2⤵
  PID:7844
- C:\Windows\System\LBgjLTX.exe
  C:\Windows\System\LBgjLTX.exe
  2⤵
  PID:7904
- C:\Windows\System\iHlTYLD.exe
  C:\Windows\System\iHlTYLD.exe
  2⤵
  PID:7920
- C:\Windows\System\REAxIzC.exe
  C:\Windows\System\REAxIzC.exe
  2⤵
  PID:7940
- C:\Windows\System\SDPkquv.exe
  C:\Windows\System\SDPkquv.exe
  2⤵
  PID:6760
- C:\Windows\System\ZBQzjjZ.exe
  C:\Windows\System\ZBQzjjZ.exe
  2⤵
  PID:8052
- C:\Windows\System\kUrsTbR.exe
  C:\Windows\System\kUrsTbR.exe
  2⤵
  PID:8088
- C:\Windows\System\ymmBoVL.exe
  C:\Windows\System\ymmBoVL.exe
  2⤵
  PID:8036
- C:\Windows\System\gFuNBBP.exe
  C:\Windows\System\gFuNBBP.exe
  2⤵
  PID:8100
- C:\Windows\System\warkqiz.exe
  C:\Windows\System\warkqiz.exe
  2⤵
  PID:8072
- C:\Windows\System\TScbxcJ.exe
  C:\Windows\System\TScbxcJ.exe
  2⤵
  PID:7240
- C:\Windows\System\ylgkxvD.exe
  C:\Windows\System\ylgkxvD.exe
  2⤵
  PID:7280
- C:\Windows\System\SCRaHEA.exe
  C:\Windows\System\SCRaHEA.exe
  2⤵
  PID:7192
- C:\Windows\System\EYMNMzw.exe
  C:\Windows\System\EYMNMzw.exe
  2⤵
  PID:7540
- C:\Windows\System\reXtDHy.exe
  C:\Windows\System\reXtDHy.exe
  2⤵
  PID:7424
- C:\Windows\System\nHVEFLT.exe
  C:\Windows\System\nHVEFLT.exe
  2⤵
  PID:7196
- C:\Windows\System\tMsjcVU.exe
  C:\Windows\System\tMsjcVU.exe
  2⤵
  PID:7312
- C:\Windows\System\CyjMYWP.exe
  C:\Windows\System\CyjMYWP.exe
  2⤵
  PID:7392
- C:\Windows\System\tiCPjld.exe
  C:\Windows\System\tiCPjld.exe
  2⤵
  PID:7456
- C:\Windows\System\TiqXVbm.exe
  C:\Windows\System\TiqXVbm.exe
  2⤵
  PID:7616
- C:\Windows\System\ATdlOEc.exe
  C:\Windows\System\ATdlOEc.exe
  2⤵
  PID:7620
- C:\Windows\System\ozXbNty.exe
  C:\Windows\System\ozXbNty.exe
  2⤵
  PID:7680
- C:\Windows\System\LkKQmiO.exe
  C:\Windows\System\LkKQmiO.exe
  2⤵
  PID:7892
- C:\Windows\System\THniwPG.exe
  C:\Windows\System\THniwPG.exe
  2⤵
  PID:7744
- C:\Windows\System\fqgrNje.exe
  C:\Windows\System\fqgrNje.exe
  2⤵
  PID:7556
- C:\Windows\System\SpmIIBd.exe
  C:\Windows\System\SpmIIBd.exe
  2⤵
  PID:7872
- C:\Windows\System\UtCrEIR.exe
  C:\Windows\System\UtCrEIR.exe
  2⤵
  PID:7876
- C:\Windows\System\fPvfsJx.exe
  C:\Windows\System\fPvfsJx.exe
  2⤵
  PID:6224
- C:\Windows\System\spyOpZm.exe
  C:\Windows\System\spyOpZm.exe
  2⤵
  PID:7328
- C:\Windows\System\edHXHzT.exe
  C:\Windows\System\edHXHzT.exe
  2⤵
  PID:7276
- C:\Windows\System\DatCHMZ.exe
  C:\Windows\System\DatCHMZ.exe
  2⤵
  PID:1584
- C:\Windows\System\upQbNCA.exe
  C:\Windows\System\upQbNCA.exe
  2⤵
  PID:8148
- C:\Windows\System\XBoboWb.exe
  C:\Windows\System\XBoboWb.exe
  2⤵
  PID:8164
- C:\Windows\System\xxxZxMS.exe
  C:\Windows\System\xxxZxMS.exe
  2⤵
  PID:7248
- C:\Windows\System\oHaDnAq.exe
  C:\Windows\System\oHaDnAq.exe
  2⤵
  PID:7972
- C:\Windows\System\QWUFJda.exe
  C:\Windows\System\QWUFJda.exe
  2⤵
  PID:8024
- C:\Windows\System\tfAHgki.exe
  C:\Windows\System\tfAHgki.exe
  2⤵
  PID:8132
- C:\Windows\System\ehNHxSp.exe
  C:\Windows\System\ehNHxSp.exe
  2⤵
  PID:7856
- C:\Windows\System\JlHLDcn.exe
  C:\Windows\System\JlHLDcn.exe
  2⤵
  PID:8196
- C:\Windows\System\zSDbhyE.exe
  C:\Windows\System\zSDbhyE.exe
  2⤵
  PID:8216
- C:\Windows\System\ScVIocq.exe
  C:\Windows\System\ScVIocq.exe
  2⤵
  PID:8232
- C:\Windows\System\tjduWUR.exe
  C:\Windows\System\tjduWUR.exe
  2⤵
  PID:8248
- C:\Windows\System\zKVLqCg.exe
  C:\Windows\System\zKVLqCg.exe
  2⤵
  PID:8264
- C:\Windows\System\dXiVWUD.exe
  C:\Windows\System\dXiVWUD.exe
  2⤵
  PID:8280
- C:\Windows\System\fMRcMHm.exe
  C:\Windows\System\fMRcMHm.exe
  2⤵
  PID:8296
- C:\Windows\System\dCRChmK.exe
  C:\Windows\System\dCRChmK.exe
  2⤵
  PID:8312
- C:\Windows\System\pOqqxLJ.exe
  C:\Windows\System\pOqqxLJ.exe
  2⤵
  PID:8328
- C:\Windows\System\TFXLFwZ.exe
  C:\Windows\System\TFXLFwZ.exe
  2⤵
  PID:8344
- C:\Windows\System\FOGvesa.exe
  C:\Windows\System\FOGvesa.exe
  2⤵
  PID:8360
- C:\Windows\System\MMJlnrD.exe
  C:\Windows\System\MMJlnrD.exe
  2⤵
  PID:8376
- C:\Windows\System\ZZKfzDA.exe
  C:\Windows\System\ZZKfzDA.exe
  2⤵
  PID:8396
- C:\Windows\System\RjoBUic.exe
  C:\Windows\System\RjoBUic.exe
  2⤵
  PID:8412
- C:\Windows\System\abCjBBB.exe
  C:\Windows\System\abCjBBB.exe
  2⤵
  PID:8428
- C:\Windows\System\SEyXXnp.exe
  C:\Windows\System\SEyXXnp.exe
  2⤵
  PID:8444
- C:\Windows\System\zadLwbQ.exe
  C:\Windows\System\zadLwbQ.exe
  2⤵
  PID:8460
- C:\Windows\System\vmwQrGp.exe
  C:\Windows\System\vmwQrGp.exe
  2⤵
  PID:8476
- C:\Windows\System\SlSehrd.exe
  C:\Windows\System\SlSehrd.exe
  2⤵
  PID:8492
- C:\Windows\System\xbFZRlx.exe
  C:\Windows\System\xbFZRlx.exe
  2⤵
  PID:8508
- C:\Windows\System\CXutlHQ.exe
  C:\Windows\System\CXutlHQ.exe
  2⤵
  PID:8524
- C:\Windows\System\yDstomx.exe
  C:\Windows\System\yDstomx.exe
  2⤵
  PID:8540
- C:\Windows\System\PyHQvlS.exe
  C:\Windows\System\PyHQvlS.exe
  2⤵
  PID:8556
- C:\Windows\System\XSvDwuH.exe
  C:\Windows\System\XSvDwuH.exe
  2⤵
  PID:8576
- C:\Windows\System\zAdjqpy.exe
  C:\Windows\System\zAdjqpy.exe
  2⤵
  PID:8592
- C:\Windows\System\zUwzRhL.exe
  C:\Windows\System\zUwzRhL.exe
  2⤵
  PID:8608
- C:\Windows\System\TuxeAaC.exe
  C:\Windows\System\TuxeAaC.exe
  2⤵
  PID:8640
- C:\Windows\System\XvierPe.exe
  C:\Windows\System\XvierPe.exe
  2⤵
  PID:8656
- C:\Windows\System\TifYGkO.exe
  C:\Windows\System\TifYGkO.exe
  2⤵
  PID:8672
- C:\Windows\System\Sipzayd.exe
  C:\Windows\System\Sipzayd.exe
  2⤵
  PID:8688
- C:\Windows\System\AsOQnDy.exe
  C:\Windows\System\AsOQnDy.exe
  2⤵
  PID:8704
- C:\Windows\System\RidbvCq.exe
  C:\Windows\System\RidbvCq.exe
  2⤵
  PID:8720
- C:\Windows\System\ueKEAOC.exe
  C:\Windows\System\ueKEAOC.exe
  2⤵
  PID:8736
- C:\Windows\System\ifxXSQw.exe
  C:\Windows\System\ifxXSQw.exe
  2⤵
  PID:8752
- C:\Windows\System\PVwOsVA.exe
  C:\Windows\System\PVwOsVA.exe
  2⤵
  PID:8768
- C:\Windows\System\OFVxUOP.exe
  C:\Windows\System\OFVxUOP.exe
  2⤵
  PID:8784
- C:\Windows\System\oLZEytJ.exe
  C:\Windows\System\oLZEytJ.exe
  2⤵
  PID:8800
- C:\Windows\System\YSrhniM.exe
  C:\Windows\System\YSrhniM.exe
  2⤵
  PID:8816
- C:\Windows\System\miSDlzs.exe
  C:\Windows\System\miSDlzs.exe
  2⤵
  PID:8832
- C:\Windows\System\KoCMEAI.exe
  C:\Windows\System\KoCMEAI.exe
  2⤵
  PID:8848
- C:\Windows\System\wXslPlW.exe
  C:\Windows\System\wXslPlW.exe
  2⤵
  PID:8864
- C:\Windows\System\fNmGOPg.exe
  C:\Windows\System\fNmGOPg.exe
  2⤵
  PID:8880
- C:\Windows\System\QFmBrMb.exe
  C:\Windows\System\QFmBrMb.exe
  2⤵
  PID:8896
- C:\Windows\System\hxQIjTf.exe
  C:\Windows\System\hxQIjTf.exe
  2⤵
  PID:8912
- C:\Windows\System\virhxbL.exe
  C:\Windows\System\virhxbL.exe
  2⤵
  PID:8928
- C:\Windows\System\IJlGSvR.exe
  C:\Windows\System\IJlGSvR.exe
  2⤵
  PID:8944
- C:\Windows\System\JvcWsNa.exe
  C:\Windows\System\JvcWsNa.exe
  2⤵
  PID:8960
- C:\Windows\System\EPjTrIh.exe
  C:\Windows\System\EPjTrIh.exe
  2⤵
  PID:8980
- C:\Windows\System\pXAfCkI.exe
  C:\Windows\System\pXAfCkI.exe
  2⤵
  PID:8996
- C:\Windows\System\nxnjEsM.exe
  C:\Windows\System\nxnjEsM.exe
  2⤵
  PID:9012
- C:\Windows\System\iWyGwja.exe
  C:\Windows\System\iWyGwja.exe
  2⤵
  PID:9028
- C:\Windows\System\fUZmTlw.exe
  C:\Windows\System\fUZmTlw.exe
  2⤵
  PID:9044
- C:\Windows\System\bXDjFUT.exe
  C:\Windows\System\bXDjFUT.exe
  2⤵
  PID:9060
- C:\Windows\System\WRxSxnM.exe
  C:\Windows\System\WRxSxnM.exe
  2⤵
  PID:9076
- C:\Windows\System\XhEawIo.exe
  C:\Windows\System\XhEawIo.exe
  2⤵
  PID:9092
- C:\Windows\System\LwPRJPm.exe
  C:\Windows\System\LwPRJPm.exe
  2⤵
  PID:9108
- C:\Windows\System\KKeSjJb.exe
  C:\Windows\System\KKeSjJb.exe
  2⤵
  PID:9124
- C:\Windows\System\WqbJFNX.exe
  C:\Windows\System\WqbJFNX.exe
  2⤵
  PID:9140
- C:\Windows\System\LtQRWde.exe
  C:\Windows\System\LtQRWde.exe
  2⤵
  PID:9156
- C:\Windows\System\eOKlYJg.exe
  C:\Windows\System\eOKlYJg.exe
  2⤵
  PID:9172
- C:\Windows\System\qlRpXJA.exe
  C:\Windows\System\qlRpXJA.exe
  2⤵
  PID:9188
- C:\Windows\System\mTvFdsD.exe
  C:\Windows\System\mTvFdsD.exe
  2⤵
  PID:9204
- C:\Windows\System\TpSzRnW.exe
  C:\Windows\System\TpSzRnW.exe
  2⤵
  PID:8224
- C:\Windows\System\hOSJczO.exe
  C:\Windows\System\hOSJczO.exe
  2⤵
  PID:8172
- C:\Windows\System\uQjzgmN.exe
  C:\Windows\System\uQjzgmN.exe
  2⤵
  PID:7840
- C:\Windows\System\oNzSMsY.exe
  C:\Windows\System\oNzSMsY.exe
  2⤵
  PID:8152
- C:\Windows\System\xmznZXm.exe
  C:\Windows\System\xmznZXm.exe
  2⤵
  PID:8068
- C:\Windows\System\XYXaVSN.exe
  C:\Windows\System\XYXaVSN.exe
  2⤵
  PID:8208
- C:\Windows\System\SUAvhdz.exe
  C:\Windows\System\SUAvhdz.exe
  2⤵
  PID:8288
- C:\Windows\System\SdJqxxS.exe
  C:\Windows\System\SdJqxxS.exe
  2⤵
  PID:8352
- C:\Windows\System\JwBGZDt.exe
  C:\Windows\System\JwBGZDt.exe
  2⤵
  PID:8304
- C:\Windows\System\XhdOriH.exe
  C:\Windows\System\XhdOriH.exe
  2⤵
  PID:8340
- C:\Windows\System\QedbIVo.exe
  C:\Windows\System\QedbIVo.exe
  2⤵
  PID:8452
- C:\Windows\System\SrDkVIX.exe
  C:\Windows\System\SrDkVIX.exe
  2⤵
  PID:8468
- C:\Windows\System\PbScNUl.exe
  C:\Windows\System\PbScNUl.exe
  2⤵
  PID:8516
- C:\Windows\System\FZvHssi.exe
  C:\Windows\System\FZvHssi.exe
  2⤵
  PID:8520
- C:\Windows\System\ADEGWVY.exe
  C:\Windows\System\ADEGWVY.exe
  2⤵
  PID:8552
- C:\Windows\System\UdhzDiD.exe
  C:\Windows\System\UdhzDiD.exe
  2⤵
  PID:8504
- C:\Windows\System\elNsjIk.exe
  C:\Windows\System\elNsjIk.exe
  2⤵
  PID:8588
- C:\Windows\System\iESuFTw.exe
  C:\Windows\System\iESuFTw.exe
  2⤵
  PID:8620
- C:\Windows\System\RrnOQEL.exe
  C:\Windows\System\RrnOQEL.exe
  2⤵
  PID:8664
- C:\Windows\System\TfBKYXg.exe
  C:\Windows\System\TfBKYXg.exe
  2⤵
  PID:8728
- C:\Windows\System\vDAaqbD.exe
  C:\Windows\System\vDAaqbD.exe
  2⤵
  PID:8792
- C:\Windows\System\KDciVYt.exe
  C:\Windows\System\KDciVYt.exe
  2⤵
  PID:8860
- C:\Windows\System\XaWcqTP.exe
  C:\Windows\System\XaWcqTP.exe
  2⤵
  PID:8920
- C:\Windows\System\QuCcqGp.exe
  C:\Windows\System\QuCcqGp.exe
  2⤵
  PID:8988
- C:\Windows\System\bxDnwoE.exe
  C:\Windows\System\bxDnwoE.exe
  2⤵
  PID:9024
- C:\Windows\System\VTcxnRh.exe
  C:\Windows\System\VTcxnRh.exe
  2⤵
  PID:9088
- C:\Windows\System\gbQtRaL.exe
  C:\Windows\System\gbQtRaL.exe
  2⤵
  PID:9152
- C:\Windows\System\WBjZAlN.exe
  C:\Windows\System\WBjZAlN.exe
  2⤵
  PID:7664
- C:\Windows\System\peMbaLq.exe
  C:\Windows\System\peMbaLq.exe
  2⤵
  PID:8120
- C:\Windows\System\mzwMhcL.exe
  C:\Windows\System\mzwMhcL.exe
  2⤵
  PID:9068
- C:\Windows\System\VKfSmFy.exe
  C:\Windows\System\VKfSmFy.exe
  2⤵
  PID:7356
- C:\Windows\System\mLCoGqu.exe
  C:\Windows\System\mLCoGqu.exe
  2⤵
  PID:9200
- C:\Windows\System\xvoAhYC.exe
  C:\Windows\System\xvoAhYC.exe
  2⤵
  PID:8976
- C:\Windows\System\HzRBVwk.exe
  C:\Windows\System\HzRBVwk.exe
  2⤵
  PID:9008
- C:\Windows\System\LqGbejB.exe
  C:\Windows\System\LqGbejB.exe
  2⤵
  PID:9100
- C:\Windows\System\gwpjTya.exe
  C:\Windows\System\gwpjTya.exe
  2⤵
  PID:8812
- C:\Windows\System\GRfmTHq.exe
  C:\Windows\System\GRfmTHq.exe
  2⤵
  PID:8908
- C:\Windows\System\vDPRDXo.exe
  C:\Windows\System\vDPRDXo.exe
  2⤵
  PID:8260
- C:\Windows\System\dNTjxuY.exe
  C:\Windows\System\dNTjxuY.exe
  2⤵
  PID:8276
- C:\Windows\System\hEmFSmQ.exe
  C:\Windows\System\hEmFSmQ.exe
  2⤵
  PID:9132
- C:\Windows\System\amVrFnl.exe
  C:\Windows\System\amVrFnl.exe
  2⤵
  PID:7100
- C:\Windows\System\ZRKUYko.exe
  C:\Windows\System\ZRKUYko.exe
  2⤵
  PID:8572
- C:\Windows\System\dTllAHL.exe
  C:\Windows\System\dTllAHL.exe
  2⤵
  PID:8764
- C:\Windows\System\QLKWitK.exe
  C:\Windows\System\QLKWitK.exe
  2⤵
  PID:8636
- C:\Windows\System\ceuEWuO.exe
  C:\Windows\System\ceuEWuO.exe
  2⤵
  PID:8372
- C:\Windows\System\EGQASdY.exe
  C:\Windows\System\EGQASdY.exe
  2⤵
  PID:8532
- C:\Windows\System\remhtcU.exe
  C:\Windows\System\remhtcU.exe
  2⤵
  PID:8828
- C:\Windows\System\keJmfIG.exe
  C:\Windows\System\keJmfIG.exe
  2⤵
  PID:8952
- C:\Windows\System\NiTKPfC.exe
  C:\Windows\System\NiTKPfC.exe
  2⤵
  PID:8604
- C:\Windows\System\WTytxVY.exe
  C:\Windows\System\WTytxVY.exe
  2⤵
  PID:8648
- C:\Windows\System\bpnpnzR.exe
  C:\Windows\System\bpnpnzR.exe
  2⤵
  PID:9056
- C:\Windows\System\IsRyHlS.exe
  C:\Windows\System\IsRyHlS.exe
  2⤵
  PID:7520
- C:\Windows\System\vLpLnet.exe
  C:\Windows\System\vLpLnet.exe
  2⤵
  PID:8876
- C:\Windows\System\fBvDfCV.exe
  C:\Windows\System\fBvDfCV.exe
  2⤵
  PID:8716
- C:\Windows\System\bWGkliy.exe
  C:\Windows\System\bWGkliy.exe
  2⤵
  PID:8780
- C:\Windows\System\cRrRPRl.exe
  C:\Windows\System\cRrRPRl.exe
  2⤵
  PID:8244
- C:\Windows\System\ITOCkCY.exe
  C:\Windows\System\ITOCkCY.exe
  2⤵
  PID:7888
- C:\Windows\System\RvZguVS.exe
  C:\Windows\System\RvZguVS.exe
  2⤵
  PID:8568
- C:\Windows\System\dkPlhXr.exe
  C:\Windows\System\dkPlhXr.exe
  2⤵
  PID:8824
- C:\Windows\System\nglijKl.exe
  C:\Windows\System\nglijKl.exe
  2⤵
  PID:8336
- C:\Windows\System\nxSUUPG.exe
  C:\Windows\System\nxSUUPG.exe
  2⤵
  PID:8744
- C:\Windows\System\XqmlwOI.exe
  C:\Windows\System\XqmlwOI.exe
  2⤵
  PID:8856
- C:\Windows\System\ojKopkp.exe
  C:\Windows\System\ojKopkp.exe
  2⤵
  PID:9184
- C:\Windows\System\EDborkf.exe
  C:\Windows\System\EDborkf.exe
  2⤵
  PID:8188
- C:\Windows\System\LGoaHbY.exe
  C:\Windows\System\LGoaHbY.exe
  2⤵
  PID:7748
- C:\Windows\System\tcVGWSR.exe
  C:\Windows\System\tcVGWSR.exe
  2⤵
  PID:8384
- C:\Windows\System\zljWjZh.exe
  C:\Windows\System\zljWjZh.exe
  2⤵
  PID:8440
- C:\Windows\System\WoUSDKk.exe
  C:\Windows\System\WoUSDKk.exe
  2⤵
  PID:8548
- C:\Windows\System\RZkDVJp.exe
  C:\Windows\System\RZkDVJp.exe
  2⤵
  PID:8712
- C:\Windows\System\MnZSYxg.exe
  C:\Windows\System\MnZSYxg.exe
  2⤵
  PID:8684
- C:\Windows\System\SKKdIPP.exe
  C:\Windows\System\SKKdIPP.exe
  2⤵
  PID:9232
- C:\Windows\System\jldiNnD.exe
  C:\Windows\System\jldiNnD.exe
  2⤵
  PID:9248
- C:\Windows\System\uHdgXve.exe
  C:\Windows\System\uHdgXve.exe
  2⤵
  PID:9264
- C:\Windows\System\ncaynZV.exe
  C:\Windows\System\ncaynZV.exe
  2⤵
  PID:9280
- C:\Windows\System\PFkBETk.exe
  C:\Windows\System\PFkBETk.exe
  2⤵
  PID:9296
- C:\Windows\System\NSSDIkJ.exe
  C:\Windows\System\NSSDIkJ.exe
  2⤵
  PID:9312
- C:\Windows\System\iJFWLcY.exe
  C:\Windows\System\iJFWLcY.exe
  2⤵
  PID:9328
- C:\Windows\System\miuZmzq.exe
  C:\Windows\System\miuZmzq.exe
  2⤵
  PID:9344
- C:\Windows\System\AqprBZQ.exe
  C:\Windows\System\AqprBZQ.exe
  2⤵
  PID:9360
- C:\Windows\System\dezILfv.exe
  C:\Windows\System\dezILfv.exe
  2⤵
  PID:9376
- C:\Windows\System\NOhYjsF.exe
  C:\Windows\System\NOhYjsF.exe
  2⤵
  PID:9392
- C:\Windows\System\CYjXWms.exe
  C:\Windows\System\CYjXWms.exe
  2⤵
  PID:9408
- C:\Windows\System\uuukalJ.exe
  C:\Windows\System\uuukalJ.exe
  2⤵
  PID:9424
- C:\Windows\System\IdgOJbE.exe
  C:\Windows\System\IdgOJbE.exe
  2⤵
  PID:9440
- C:\Windows\System\YtowytF.exe
  C:\Windows\System\YtowytF.exe
  2⤵
  PID:9456
- C:\Windows\System\xGLzOvX.exe
  C:\Windows\System\xGLzOvX.exe
  2⤵
  PID:9472
- C:\Windows\System\JFYUCPl.exe
  C:\Windows\System\JFYUCPl.exe
  2⤵
  PID:9488
- C:\Windows\System\ljYLBGQ.exe
  C:\Windows\System\ljYLBGQ.exe
  2⤵
  PID:9504
- C:\Windows\System\mugpPvL.exe
  C:\Windows\System\mugpPvL.exe
  2⤵
  PID:9520
- C:\Windows\System\jUPetre.exe
  C:\Windows\System\jUPetre.exe
  2⤵
  PID:9536
- C:\Windows\System\cNzOmci.exe
  C:\Windows\System\cNzOmci.exe
  2⤵
  PID:9552
- C:\Windows\System\ajvMGwY.exe
  C:\Windows\System\ajvMGwY.exe
  2⤵
  PID:9568
- C:\Windows\System\ELCJkxu.exe
  C:\Windows\System\ELCJkxu.exe
  2⤵
  PID:9588
- C:\Windows\System\kOPVriG.exe
  C:\Windows\System\kOPVriG.exe
  2⤵
  PID:9604
- C:\Windows\System\cPxaqPa.exe
  C:\Windows\System\cPxaqPa.exe
  2⤵
  PID:9636
- C:\Windows\System\VzwdWGp.exe
  C:\Windows\System\VzwdWGp.exe
  2⤵
  PID:9652
- C:\Windows\System\xVObgud.exe
  C:\Windows\System\xVObgud.exe
  2⤵
  PID:9668
- C:\Windows\System\ttfcHJP.exe
  C:\Windows\System\ttfcHJP.exe
  2⤵
  PID:9684
- C:\Windows\System\CVWitUS.exe
  C:\Windows\System\CVWitUS.exe
  2⤵
  PID:9704
- C:\Windows\System\nJIAgHY.exe
  C:\Windows\System\nJIAgHY.exe
  2⤵
  PID:9720
- C:\Windows\System\XeVSNkk.exe
  C:\Windows\System\XeVSNkk.exe
  2⤵
  PID:9736
- C:\Windows\System\QgZNTYg.exe
  C:\Windows\System\QgZNTYg.exe
  2⤵
  PID:9752
- C:\Windows\System\oAkcTJY.exe
  C:\Windows\System\oAkcTJY.exe
  2⤵
  PID:9768
- C:\Windows\System\pGlEeGy.exe
  C:\Windows\System\pGlEeGy.exe
  2⤵
  PID:9784
- C:\Windows\System\REnXSDt.exe
  C:\Windows\System\REnXSDt.exe
  2⤵
  PID:9800
- C:\Windows\System\VDJKmzs.exe
  C:\Windows\System\VDJKmzs.exe
  2⤵
  PID:9816
- C:\Windows\System\ViWsTOX.exe
  C:\Windows\System\ViWsTOX.exe
  2⤵
  PID:9832
- C:\Windows\System\KjHjNRH.exe
  C:\Windows\System\KjHjNRH.exe
  2⤵
  PID:9848
- C:\Windows\System\FYQJwid.exe
  C:\Windows\System\FYQJwid.exe
  2⤵
  PID:9864
- C:\Windows\System\eVlnnIw.exe
  C:\Windows\System\eVlnnIw.exe
  2⤵
  PID:9880
- C:\Windows\System\fnozlUq.exe
  C:\Windows\System\fnozlUq.exe
  2⤵
  PID:9896
- C:\Windows\System\jGsRqlq.exe
  C:\Windows\System\jGsRqlq.exe
  2⤵
  PID:9912
- C:\Windows\System\IQHCnxI.exe
  C:\Windows\System\IQHCnxI.exe
  2⤵
  PID:9928
- C:\Windows\System\psypdNT.exe
  C:\Windows\System\psypdNT.exe
  2⤵
  PID:9944
- C:\Windows\System\gmqHtuo.exe
  C:\Windows\System\gmqHtuo.exe
  2⤵
  PID:9960
- C:\Windows\System\RwNyVoI.exe
  C:\Windows\System\RwNyVoI.exe
  2⤵
  PID:9976
- C:\Windows\System\BcGxVMJ.exe
  C:\Windows\System\BcGxVMJ.exe
  2⤵
  PID:9992
- C:\Windows\System\WCiERTA.exe
  C:\Windows\System\WCiERTA.exe
  2⤵
  PID:10008
- C:\Windows\System\Pazwkyg.exe
  C:\Windows\System\Pazwkyg.exe
  2⤵
  PID:10024
- C:\Windows\System\IMSAjDB.exe
  C:\Windows\System\IMSAjDB.exe
  2⤵
  PID:10040
- C:\Windows\System\FEgGFiv.exe
  C:\Windows\System\FEgGFiv.exe
  2⤵
  PID:10056
- C:\Windows\System\kPJNSLi.exe
  C:\Windows\System\kPJNSLi.exe
  2⤵
  PID:10072
- C:\Windows\System\LlYgMZN.exe
  C:\Windows\System\LlYgMZN.exe
  2⤵
  PID:10108
- C:\Windows\System\RDhDlCc.exe
  C:\Windows\System\RDhDlCc.exe
  2⤵
  PID:10124
- C:\Windows\System\xrrqpbi.exe
  C:\Windows\System\xrrqpbi.exe
  2⤵
  PID:10140
- C:\Windows\System\XsjxyoK.exe
  C:\Windows\System\XsjxyoK.exe
  2⤵
  PID:10156
- C:\Windows\System\sOyleyv.exe
  C:\Windows\System\sOyleyv.exe
  2⤵
  PID:10172
- C:\Windows\System\FGKHSAh.exe
  C:\Windows\System\FGKHSAh.exe
  2⤵
  PID:10188
- C:\Windows\System\XJjCKPr.exe
  C:\Windows\System\XJjCKPr.exe
  2⤵
  PID:10204
- C:\Windows\System\KumQvkr.exe
  C:\Windows\System\KumQvkr.exe
  2⤵
  PID:10220
- C:\Windows\System\CKPpigb.exe
  C:\Windows\System\CKPpigb.exe
  2⤵
  PID:10236
- C:\Windows\System\pcQMBac.exe
  C:\Windows\System\pcQMBac.exe
  2⤵
  PID:9228
- C:\Windows\System\egrdxdx.exe
  C:\Windows\System\egrdxdx.exe
  2⤵
  PID:9260
- C:\Windows\System\XBXWBFo.exe
  C:\Windows\System\XBXWBFo.exe
  2⤵
  PID:9324
- C:\Windows\System\fVNkaji.exe
  C:\Windows\System\fVNkaji.exe
  2⤵
  PID:9388
- C:\Windows\System\LjgFSiy.exe
  C:\Windows\System\LjgFSiy.exe
  2⤵
  PID:9104
- C:\Windows\System\XFFyyzc.exe
  C:\Windows\System\XFFyyzc.exe
  2⤵
  PID:9420
- C:\Windows\System\PkmRXvL.exe
  C:\Windows\System\PkmRXvL.exe
  2⤵
  PID:9272
- C:\Windows\System\UHryxTb.exe
  C:\Windows\System\UHryxTb.exe
  2⤵
  PID:9404
- C:\Windows\System\WiuPPCm.exe
  C:\Windows\System\WiuPPCm.exe
  2⤵
  PID:9484
- C:\Windows\System\eweRtVj.exe
  C:\Windows\System\eweRtVj.exe
  2⤵
  PID:9464
- C:\Windows\System\ZxJnuOZ.exe
  C:\Windows\System\ZxJnuOZ.exe
  2⤵
  PID:9436
- C:\Windows\System\BVUhWkc.exe
  C:\Windows\System\BVUhWkc.exe
  2⤵
  PID:9584
- C:\Windows\System\eZAkkFW.exe
  C:\Windows\System\eZAkkFW.exe
  2⤵
  PID:9560
- C:\Windows\System\URYcPxZ.exe
  C:\Windows\System\URYcPxZ.exe
  2⤵
  PID:9616
- C:\Windows\System\TqbmyHr.exe
  C:\Windows\System\TqbmyHr.exe
  2⤵
  PID:8972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ARBWBxv.exe

Filesize
1.9MB

MD5
928ae3d0c8c90201b0822441ec7cf8c4

SHA1
6168bdcdcaacf34201b673eadb35b8eb29ddb3d4

SHA256
d2afc464c52191fa808030f3a1a09951ef29641a9a0dfced936fcf1f8925d45d

SHA512
56eb1d54e27d7ac8bf25b2423544c9a4232dc0a39be710ca96364ec6eab501dee8d0cb063af5ab1c1446e5989b8bde0e5d2b077c7f3b55319be8849ca9410ce0

Download Submit
C:\Windows\system\AbcTSIc.exe

Filesize
1.9MB

MD5
0fb2911a82d8a32438f014f8a26fff38

SHA1
b568891a4a62f99dc00e45f50ddacc85fa7a511a

SHA256
f081806b7fa1645055d1c32f5b514a435723a05a085008b3b6e47fd060779d1a

SHA512
da53b4c85dcc3b44d410792dac046c63bd12b05cb96f297c4d86af4e57deb4972cdcf8aaa278d0d3f8ed014a069fe5633b3d3ab806e7717d7fdb46cddde6d870

Download Submit
C:\Windows\system\BcQgovE.exe

Filesize
1.9MB

MD5
1648ddecf43f2b0f73434bb718ce662b

SHA1
4b05187dd1ada34130fa3dd805926f96a15b72e2

SHA256
b0b11941f6efb726c1a8fa4a4d709f7e2a1440167b64d10536d602c821444cf9

SHA512
715d013f0a4d304e66147cc8757ff025b4ec564a11e0c11aa7ae45eb0374f9a2767fea70dc9ba70ef16be8de92e0e126735c274f6f16d9dd47ce13da8e8e30df

Download Submit
C:\Windows\system\DtYgtLo.exe

Filesize
1.9MB

MD5
29eca70d09b4bbe2feba8ea296c4514f

SHA1
05c147c47e925f0eece7e952f91dbe52b1fdfb5b

SHA256
48c3be7b4d8b1098501540b69a2aad61a15d44162c552e1ad250730cb899d95a

SHA512
5afdcbdddec4de1fe6c9ffb331f15c39597adf8aecd745aae4005c81f8cfd40d24523008c6a4526faf736e6999a24bc9766d5375991a2daa8181be39ef622238

Download Submit
C:\Windows\system\DuyUZzM.exe

Filesize
1.9MB

MD5
acec05aa6f191f02ce8e8808748a237e

SHA1
acb953b0ab9f0b657838c48f54b90546c706adf7

SHA256
6dc1d7454f48eaece1bd81f6a7912b1846eb57120ffc1fca3901ef93b1cf4aa9

SHA512
a5f581bcd7b6252039ca7cb70b17db36cf98fe93db405f0b27511f0838158fbe9bcc3b7de00034ec1d7b024dd18915e2ba18f3012ec34c1a1c3c6ba683c03e0b

Download Submit
C:\Windows\system\ETluglw.exe

Filesize
1.9MB

MD5
801503a1137fe06e59977837258ec4ae

SHA1
610086755aa72a441e3c84e46087133c82501b99

SHA256
0da37ff46c1c56495dc8e0067ee4a469b3145011ce2dcb725a85b8f57092af9a

SHA512
284ba5ad3f7ab918e3bbca8c8a8eb48a11f68402dafda82693b360fd2409bfd2b47b1325726857bffa729834ed2a92ed12fbdaf3ebc16307d0e45de47f9b5e61

Download Submit
C:\Windows\system\IKIhbXa.exe

Filesize
1.9MB

MD5
581909392c4c9fa42aa8bcbce994c6a1

SHA1
ccea0d8f3184733eac09cbc1292ece770a5daf94

SHA256
5167ac027c489c892a47a8f330d8f4ba5b1e002fe8524e1282967e694f4d6c93

SHA512
36d77962544648c7bfde14abde9ea5fd14e5fa6ce9fa329ecf51eb6f36e0d96aa5b5a95a396312c86075eee8c9a63168aaa9e064b7683e9444ccdafc6d4f08f6

Download Submit
C:\Windows\system\JpGyIOr.exe

Filesize
1.9MB

MD5
25051598ba6faeedfd2dadb9908e7710

SHA1
2030ba1c3c68e613b230207724e15b39d00bb904

SHA256
5b101870a0f3fe015b6b97ee1004b7db561f56682d7d71c7eed6b67004f43bf2

SHA512
29e6cb16a5a2a1a4163ae59ef9e699d89cc15f7de411e51f0ba2479f4110df15a1cd01392750a810adab1ee4444b9ceb089cfe2d7aa4e80021527ca75ed976a1

Download Submit
C:\Windows\system\LcLAqDd.exe

Filesize
1.9MB

MD5
70cb7f4ef2c57679049e9f5b1bbc8b32

SHA1
2590e2b96aa66182edac23de6d7eb0a777406abf

SHA256
98d2676f4dee1e77a606a391b11501b7b54932ff99cf324ae415bbd82f94f55e

SHA512
0820144e4095432af0ecd14e9f247e3e8e5b7ef5534af4d40838d3b92ad380818026d6c4dd5f9f8090ad7dfe57e06e40ac17ccc64cfd270664df18678d247bd6

Download Submit
C:\Windows\system\OBzvuKE.exe

Filesize
1.9MB

MD5
9d6a1b817b667835c1258239bb8825b9

SHA1
996fa194fc9ad6e8404725ec7fb66e5c3b50eb10

SHA256
b964f900de33d49fc291bb2fafa75d247ea0aec8bfd4a866087725fe738ccea1

SHA512
89a5d958e5cf81afc9d5b25727793cf5f215aab2ba97aa34ecdb4a09c5dcbce4de26f32a18b8db456051970f4e9998583b8123c6505af74fa4add8232cefb9c9

Download Submit
C:\Windows\system\SCHlKmg.exe

Filesize
1.9MB

MD5
e93fb2101a11d7d560341d1b2ca1620c

SHA1
7d4fd3c669d5277fbd19c3f89368376850c128eb

SHA256
5f25c87569d34536cb18ad321501b9cce5324e009d8e8956fb711e1450ec58e4

SHA512
ad7a071b5b68f6067d66c63412eb158151ad82902471505ebd5f3cfaf3ab7570586d61ca10af4acbc112e278a021954fadbeb14be7edaa5c49f7ae525a0a45a2

Download Submit
C:\Windows\system\WZWcNow.exe

Filesize
1.9MB

MD5
94f57ef8e6072e049c3642c7ffd26e2b

SHA1
f58b1a5e587be2c8617e215d3b1952a4c2f744b0

SHA256
a0ab6b88d7f25d5f75b32e0098060d60ceaaec0b833315cfbe7bf97a8a443be3

SHA512
0bf3f6a3a366e18bddf12d7ce4ad3d5f4eb51d48fd9aaea33017aada2c606f1d99de152b78f196ba021f1b2c1642b5a8da4d68239f5d660fac6ee5c42ffff641

Download Submit
C:\Windows\system\XkrJFVx.exe

Filesize
1.9MB

MD5
068d3a11ce9e5d9c5239f9423d6ad9eb

SHA1
e8daeefe50df972d33219b2aee826cc4b4aab881

SHA256
493025b70fe7a629b51d968db5f852961396b211c81c7db467c9fb51ebfbdf80

SHA512
4f2ee32dfca846d52d1de02e4208001a8cd7b178be78b134f46458fdc7547139ba869870f63aa5b6442e82ebe1476ca02e260de94280353fca34cd70d528d706

Download Submit
C:\Windows\system\lQGzQmy.exe

Filesize
1.9MB

MD5
5f3036141d4f8eec03f395ea15c87c96

SHA1
5e32058acbe5169147fffadb71d893f59b06c300

SHA256
519ebb9aba86c59b964ae912b1ae654f0d92ee9988685ae045e745f7668e3201

SHA512
4b6ee867e272d182a9bc913e03b1d9ad55657efee1231321c18e9b755a382a337745d57fd5f4f878b907adfc34da64700ca5cb6ffff750dfedf80820e2ccc9a9

Download Submit
C:\Windows\system\lsHPLzf.exe

Filesize
1.9MB

MD5
c8e9b4b86f6735322d67ae518ddd1297

SHA1
57d495a76a49055bca12916dca3f43b4c52b0b1c

SHA256
1982258755bb04cc8e7bd4418072cbd68607b7d080f534491188a8ac12e29100

SHA512
1f7d0a19e9f22977c0aa262b5dfa9665d7f3df0d62d210d9800cd5aca8b9f53b3eb4160c1e54e081956e02f5d2900544c01d0981eb9f4ec5cee404cddc2ed1e8

Download Submit
C:\Windows\system\mZsZjyT.exe

Filesize
1.9MB

MD5
d412a274b51ae64e830124e69b7f68f2

SHA1
5c3ecebbecad399b7b1290923733f54e7e8f783f

SHA256
c73a158edc8593df24880b028ba2171907e7b2721216ca5b8bfb6155168f02be

SHA512
f22e3c014fa5f14b2cb12528c27ead942aee12ab17b460388ea040195145cfab1030da43c67ed09496e0220af32468319d909cd8bf46eb21376c5f4107ce7d1e

Download Submit
C:\Windows\system\sXdwTIH.exe

Filesize
1.9MB

MD5
a9811be883d9e8ca102533edd94f2104

SHA1
0a9adf91630af648887ed1332fecc074ea85b2ca

SHA256
4703cfbb3919c8d544ef03383f615b1f7ef7e0121abbaf3c2c53eef07df54b02

SHA512
17f12f792996d024788c995d2d88fb1bc8d4e62e18c9812e6e73d495f0a2fa59d425e9516e423d0251bad82bc7513e2549524c4dbe487e57af4f401ae3b6bf22

Download Submit
C:\Windows\system\uOWcasT.exe

Filesize
1.9MB

MD5
de406c643b4f7f2ff1ea1d1aa25c4e4b

SHA1
1af77af4aaf675a98a032c9160d45b61c01eaf4d

SHA256
0ab78b287b210fb506935bc61bead737560b1b72d59e9347a85a3959c7587f7c

SHA512
d50331ac15ab34af8adac7fb77ddf4898daea89fec8c386dfabb6f4cf8066029ef4f34726c91bba090de9c5110e7ea86749d642c6960e4be54296dc6f65656d7

Download Submit
C:\Windows\system\vEHSBxL.exe

Filesize
1.9MB

MD5
6dd042fbb64ef58867c8ae426f6f1db2

SHA1
b88c16e7273c09e5b186a6f197180186f386cbd8

SHA256
cf12c3763bd5b26830c5d05514ce113873c1d0c0aa063956026500e941636bc7

SHA512
f0f0a9b1b211e1156cb93320c57aa8fa908886a16e5ecda879a1e5c725f0f01268894d7aeafca8e1ea91673d7039ffdb02731387b93df4fe5467a09544e5c037

Download Submit
C:\Windows\system\wmUJQsu.exe

Filesize
1.9MB

MD5
0796573199ceed90cacdff2c83d2a247

SHA1
b603de63907e06d6edd83dc3ca2c49140c1ebdd6

SHA256
a47e2ad093ea29dde5c9a4f4a3ab77fa096c10a08dee56b309860b9470a1f467

SHA512
86be8b969f88ee2de4fe5480461a5fb945b5d40c63c47d455deb2c6c6552a8fe8125f8445c59867a6048129052218496c3aeac47f96d8b578b15fcd367ba0bac

Download Submit
C:\Windows\system\ylMSQQq.exe

Filesize
1.9MB

MD5
16c29f28ace307c32d62158123042250

SHA1
f8df82429f0dc0564b89c054d4a874784c8bd8e4

SHA256
d0a2eeedfc7e3f596c6b65e22bdc36e824cd75c1c1cc51101a1eec2cb0abd082

SHA512
834fe64b181185aa1bc03bd9235526f2c982ef2c13e31622b0db0c362dd8ada1d4fc0b2ed2d8e32c1e08edc109011c22ff1773f949c94d84d2132e1fc281adc6

Download Submit
C:\Windows\system\zxoxFDC.exe

Filesize
1.9MB

MD5
1beb7501fab41c964c4c29d9df51c421

SHA1
dfaf91fa95cae59c1ac09f54755713566ba2af4c

SHA256
934f30af3ea7cc4030574004f41f2b50f3f131bdfeedbddb9619adcea253d8ca

SHA512
6f7d97001da165b2996d27a8dd4802b6996b33a67c01ccf99dec80d831c7f83b464d49740d4683bdbbed6ffc429fadf96f8b84dfed39b8adf2b9992293b98516

Download Submit
\Windows\system\AOwRLpT.exe

Filesize
1.9MB

MD5
6e185102f355ddcfbcf33bec7678f34b

SHA1
a53b221634a851fd287ff9b7975c0593484e7f59

SHA256
fb8c78cbec5d89cc34acafb8876acce295e479d87ffb0b886fe07c26183dc92a

SHA512
6445f42b258f103d8fe3f2a61c748b9c9401afc7feeda053b6b00db5a3fb78fb942772fddfe200dc13c28ee2e211d4076de7e40eb87bd75f0ec007896e14c306

Download Submit
\Windows\system\DPJkACR.exe

Filesize
1.9MB

MD5
69726318a3e68c25c6ff7060881b675d

SHA1
fdaea327deef43a13977adc2ac5633eb64028eb0

SHA256
98e2c33607309b5b5a76743f0d155e661fef1d942006d1a61ae63ded656af17e

SHA512
eea19259b3406fcfbcf5961a37e36566e702a30bf5d15cf2df2211fec97f5c2b8d5936f88809b151b55184b1e7151535eb61af58702fe2c04298cf2ffb5e721c

Download Submit
\Windows\system\NbxGXjI.exe

Filesize
1.9MB

MD5
fe13ecd5533db97be17e3af24a898631

SHA1
64204f0fe2ccea26b75f95b627f68f97701e87cd

SHA256
6c5316983c5f47c999a3dbb968c51a2a8ffe73bc7b7b852e8bce542f8cb75e08

SHA512
053c40b0f598789dc43f97d7561f0a1ce6c136eee69434908de03b8642aff5afa33f2b64fd6ee1bc3487938050d5e8d86f69c284c3ff4146d2b19e93aa47b419

Download Submit
\Windows\system\NcZFDEL.exe

Filesize
1.9MB

MD5
a4aa6b22bfb131998063ce7a288623d1

SHA1
943d88ec7fa01678808ca25495565276b92bce59

SHA256
2ebd079cff9bfa6630c86f253c0024c27b91171076aa3efc03b4e66c57ca804a

SHA512
a04f15cce544dc849e66312a001377b8c40e04077bd7b5e981a5d0746f882acfa459720bbc09b43de38c916c034b358fa30fe0382369cb11a143a0315353e6f0

Download Submit
\Windows\system\NmeLgkP.exe

Filesize
1.9MB

MD5
4ab4a021a149b5805e4024dd45f806eb

SHA1
aee50ee400993969368fc59e923bf7e717202376

SHA256
508b90825654e45d45ee96aa29e1b8661a68ebcfba3582d1d7f3f06d31ce46b4

SHA512
a25209131c22dabd97276dcba05577a9baa3305f673c88d60390024ae9489604804412668e9555e31d2f29424ddef3e7182eca1bad944747d79b27d9adb92821

Download Submit
\Windows\system\VawslWC.exe

Filesize
1.9MB

MD5
c700a72e68dc011d3eaba4d7a6aaa664

SHA1
10118ab294095e6131b115c63ccd40ae1a8a9e9c

SHA256
3ec3bcaacf8c75904eff8aa3c3dc5f8218bf44ab2142097f27e8a57abb8f45bc

SHA512
f802b8c5cf1a6d710b6eead48bca1f450f8873578b08b592b58b8463a85ca2c5a7e897356b8dab7d0623d1d5bca3381eb812ff95721ce2cc3254dd420cbf49a3

Download Submit
\Windows\system\ZXzGyNE.exe

Filesize
1.9MB

MD5
dca4ea68c96bfd1c0110f524adbfd2fb

SHA1
a3445ede08382ee4b022462aec3ac4147a4214e3

SHA256
b70cdc2f522fd7565dd2af1793e6e6aa1ff260761bd393982979375f487cabdf

SHA512
ed4f725409c2792e79238153a08182749be4f83f71795d24da79f196fbbb448f5619e376d6e398c5db296243309bd1e643e1b4f027eda4a2d083e8d2ae5ac2f2

Download Submit
\Windows\system\biHeSMX.exe

Filesize
1.9MB

MD5
b9d627d55e647fb74d8357019c81daa0

SHA1
a872217949be4566d960f6dd926380f9ce81be24

SHA256
8d9e865f850a32036c5e7a124f30a29afad3b8b6443611845787aa6c48470999

SHA512
46c5982829372b47d09cfa2c5c7484114c652fa03ba3b0bc944244b42d6bf0f0d262abf0bc70c83475c4437fed9ffd69f10ab093736aae0713b1612b9cb5359f

Download Submit
\Windows\system\dBSIdBg.exe

Filesize
1.9MB

MD5
d95d56d227ad365f045393b8dd6bb752

SHA1
37937b27ad29077ee98bfe3edb1120cac342018a

SHA256
93e369dde0e026eb791d0bf049bfa5bf1955bbb4fc5d05e5630a9a0bc5c4b23d

SHA512
6430e81846468637f5babcaddcd410d0280cca66d1390f24e74eb459236ad7059ee9c478df2b8dbf1d75f508a8d9a1d020f6290b8fc2040e6aa12351dc2da2d5

Download Submit
\Windows\system\fCHnnDU.exe

Filesize
1.9MB

MD5
a98eaf2f01029f260a6ce1623de8231b

SHA1
438402b45780a202d10cd8132b98940ac15bf357

SHA256
cfd01aeecffc45e6eb2791aada799a53a590b49a8968c6f5148f190c60a00fca

SHA512
723ec0d94f6e17c6735cbc2f4a639dab6eddc1e7a81e84e19a9e52dfc474cb982d2b1c4cf8eefa2d5aa247d3b12577538369e2a2028d22a32c9544aefafb9fa2

Download Submit
\Windows\system\ihCGBcr.exe

Filesize
1.9MB

MD5
013b2a6c6577f928c8c68a9f2409b434

SHA1
7d763f1067eae9167f2bde5a2a204dcb2f1c62b9

SHA256
ba1e7b4ea70e212f45d1cfa6733bc4ee52185f133be1413a2945c7b430b3a0de

SHA512
927192e4a4a155941a455417ea0f2489ecd4aa87f9187c3a75cf78c40faad9b4a8c10fa1620c565204516073db90d3b72fb09e2d698ff0555151cf47b2860198

Download Submit
\Windows\system\kHEQqfJ.exe

Filesize
1.9MB

MD5
007f27ae80af914f5c5d74fda68f6df1

SHA1
21eb1fedc20d04aa23ba3315643272cbcd8dfa13

SHA256
1b1bd4d49a6f2b4d524f3ca9143e7cb22285c174f9a091a5d948d2dfcebc3eae

SHA512
48ca9337675913062469b2f636d917b71413c865f06bc8a097fa278e7d2be750919720af2e6949ff17593e76199ef13db03e84e79c238d0a096b3930ec8088ba

Download Submit
\Windows\system\oSUpbTk.exe

Filesize
1.9MB

MD5
ff0a93700ccb5e950ed4ba974efecf64

SHA1
ad8ac37ba976a7d3224b740f6269b6fe11d4f0a6

SHA256
a4c8019e413bf830f06d9c614de3f5ff91e2104fd129afd60a45bff88ce0af7d

SHA512
21e4ef298681a131bc53ddb691f92b806438853d9d453b454ce1371c9644c94d4e03d44fc73e7fff591682078b8fc5c720ecf236e9e6f92a3adce6719cc7cc00

Download Submit
\Windows\system\tzcLHKV.exe

Filesize
1.9MB

MD5
0e22d0dca22af4100d276d3ff86be010

SHA1
e9ab3b7e1dfcf21792fb984079b3c236fe4ffa5a

SHA256
410b93d3ce4d707406e79e91285879b6b2b75b08c2ed747177490db1ca39d02f

SHA512
a49fcc487f31f26db9893033b8895b32179ec3f83d40112615883167c8db3fc74eac718e0083d0fc79e1fbbb19ad1c1d0a2c9438a5a7d56e0240db6d0eaa4b87

Download Submit
\Windows\system\zINqrUe.exe

Filesize
1.9MB

MD5
e2ed7a2e42654b3d2d48e9ac4a75d9b0

SHA1
f21adc1074b3fa09c73b585fb773ccd36970b448

SHA256
b6d5f22781de20c3d3e2f831a2f9f7343566ec38799ec38cab64f6bd6140de85

SHA512
b1f0011dc13f8cf68c6dc46c854827b0baddff1f215aa25f1a17a3da8fc1989a13dc187feae60e84a7ae6056dff3aa1f723695ab27703e5d197dc7522f4d7740

Download Submit
\Windows\system\zqcyKTN.exe

Filesize
1.9MB

MD5
ba737ba01ce2a1f76b5e187ab6908b70

SHA1
d620948c21c256e5c864ed92161e475e3f2623dc

SHA256
d7b574617e895333dd1f69e96dcf1c55cd4ab3e6d044503a7e690c73c27b4a0f

SHA512
67e0e7cd90350c52fb497b432c0c9818bbdf20250388bdecd65e3c717e9986b99bf1f1628cf3670de1e3489240b817e0d9652b894478c06683935d99f9319fef

Download Submit
memory/380-63-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/1148-76-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/1148-51-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/1148-101-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/1148-1179-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/1148-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1148-40-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/1148-103-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/1148-13-0x0000000003020000-0x0000000003412000-memory.dmp

Filesize
3.9MB

Download
memory/1148-7-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/1148-0-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/1148-44-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/1148-45-0x0000000003020000-0x0000000003412000-memory.dmp

Filesize
3.9MB

Download
memory/1148-66-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/1148-104-0x0000000003620000-0x0000000003A12000-memory.dmp

Filesize
3.9MB

Download
memory/2088-15-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-74-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2196-67-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2252-732-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download
memory/2252-46-0x0000000002D00000-0x0000000002D80000-memory.dmp

Filesize
512KB

Download
memory/2252-1004-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2260-8-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2276-54-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2624-102-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2732-41-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download