xmrig | 457937d4693c6185db52de9d60c08163792241ff130d344037e9deb7fe6a10c6

Analysis

max time kernel
135s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
Size

2.2MB
MD5

0c4dd5acce8af0c0304c7997ca7efb3a
SHA1

13188a9b5df84552d5379e5323d7f2b8cf27de2e
SHA256

457937d4693c6185db52de9d60c08163792241ff130d344037e9deb7fe6a10c6
SHA512

31367e06b93c9c33341fad075e99db91794882b5bcd07025042c5f22bf0f7ca123b8b08cfed1bc641cf4684bd1a3727e81aeeae900991e04b12ca0e415bd69df
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr8+Phm:NABh

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2564-9-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2596-64-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/1332-93-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2000-88-0x000000013F420000-0x000000013F812000-memory.dmp	xmrig
behavioral1/memory/2536-84-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/2560-83-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/3024-80-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/1724-76-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2436-74-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2556-71-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/1872-92-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/1724-5144-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2536-5139-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/2560-5127-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2752-5126-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2564-5125-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2596-5121-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2436-5162-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/1872-5198-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/3024-5176-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2556-5174-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/2000-5173-0x000000013F420000-0x000000013F812000-memory.dmp	xmrig
behavioral1/memory/1332-5472-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2564	yWoKXLn.exe
2752	zHhJmsK.exe
2560	egFYdzU.exe
2596	CLdJFWI.exe
2536	pgaZaIc.exe
2556	NqzzVmQ.exe
2436	XjWdljO.exe
1724	ZgWrHUs.exe
3024	OflAuDb.exe
2000	HGOQoTx.exe
1872	KeunoLI.exe
1332	HUrTypk.exe
1720	eVcwUCa.exe
1228	PEQlRwv.exe
1208	tMMOmES.exe
1176	AjdUaIP.exe
2476	lWxpKry.exe
2032	xiRYdUN.exe
2456	UtEfwfO.exe
2708	VFVqWzf.exe
1120	TdasPTD.exe
1124	QNebLPH.exe
1856	UqSKcUh.exe
2124	PkajJzH.exe
596	HZNDJhB.exe
808	WTjTtCv.exe
296	zZnWOld.exe
648	KKIMoDS.exe
1796	vpJJbvU.exe
1760	XTPmKRC.exe
1564	gsjdLbo.exe
2868	lywfrJj.exe
2004	IONhaxy.exe
1684	HDkzcVw.exe
3064	JVVJpPe.exe
2080	cwGyFyU.exe
1976	EpwyQxn.exe
1004	qOevZYI.exe
1892	cDsNRmI.exe
1712	rJPXMym.exe
964	ZTGtWhS.exe
108	xyIpCTk.exe
376	tSXHbtu.exe
544	BIZdDYV.exe
860	WbbPeLO.exe
932	tNmGMMb.exe
2920	WycvdhK.exe
568	eEAnrlk.exe
2744	gnfQUyZ.exe
1036	SDsNyGf.exe
2296	WYRcctZ.exe
1896	ZnzsQAk.exe
2228	IRFZyxV.exe
2940	DeVwBOH.exe
1528	TJlVSfA.exe
2696	XSkulqo.exe
1440	mXBNRxn.exe
896	CkFcJTR.exe
2036	eDTtXJk.exe
2732	wPJOuTq.exe
1536	FwMfMKA.exe
2780	zQihoUa.exe
3040	hbQnUJI.exe
2552	wOXGXkQ.exe

Loads dropped DLL 64 IoCs

pid	Process
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1736-2-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/files/0x000b0000000144e8-6.dat	upx
behavioral1/memory/2564-9-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/files/0x0007000000014b18-16.dat	upx
behavioral1/memory/2752-28-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/files/0x0007000000014e71-43.dat	upx
behavioral1/files/0x0008000000014bbc-39.dat	upx
behavioral1/files/0x0008000000015cff-49.dat	upx
behavioral1/files/0x000900000001535e-47.dat	upx
behavioral1/files/0x000e0000000054ab-32.dat	upx
behavioral1/files/0x0008000000014a9a-31.dat	upx
behavioral1/memory/2596-64-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/files/0x0006000000015d4e-59.dat	upx
behavioral1/files/0x0006000000015d56-65.dat	upx
behavioral1/files/0x0006000000015d5f-91.dat	upx
behavioral1/memory/1332-93-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2000-88-0x000000013F420000-0x000000013F812000-memory.dmp	upx
behavioral1/files/0x0006000000015d42-85.dat	upx
behavioral1/files/0x0006000000015d6b-103.dat	upx
behavioral1/files/0x0006000000015ecc-123.dat	upx
behavioral1/files/0x0006000000016c5e-171.dat	upx
behavioral1/files/0x0006000000016c44-167.dat	upx
behavioral1/files/0x0006000000016adc-163.dat	upx
behavioral1/files/0x0006000000016851-159.dat	upx
behavioral1/files/0x0006000000016616-155.dat	upx
behavioral1/files/0x000600000001658a-151.dat	upx
behavioral1/files/0x00060000000164aa-147.dat	upx
behavioral1/files/0x000600000001630a-143.dat	upx
behavioral1/files/0x000600000001621e-139.dat	upx
behavioral1/files/0x000600000001610f-135.dat	upx
behavioral1/files/0x0006000000015fe5-131.dat	upx
behavioral1/files/0x0006000000015f65-127.dat	upx
behavioral1/files/0x0006000000015e32-119.dat	upx
behavioral1/files/0x0006000000015d93-115.dat	upx
behavioral1/files/0x0006000000015d87-111.dat	upx
behavioral1/files/0x0006000000015d7f-107.dat	upx
behavioral1/files/0x003500000001471a-99.dat	upx
behavioral1/memory/2536-84-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/2560-83-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/3024-80-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/1724-76-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/2436-74-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2556-71-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/1872-92-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/files/0x0035000000014712-13.dat	upx
behavioral1/memory/1724-5144-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/2536-5139-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/2560-5127-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2752-5126-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/2564-5125-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2596-5121-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2436-5162-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/1872-5198-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/3024-5176-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2556-5174-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/2000-5173-0x000000013F420000-0x000000013F812000-memory.dmp	upx
behavioral1/memory/1332-5472-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kDbRqRi.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\ZIlLZwQ.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\eIBVnGD.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\LnBMtoR.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\TGZTEpS.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\PBohfUv.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\yKtlLkG.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\wNDaYNn.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\WnCzGOa.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\oIeMclY.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\QZCbZQj.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\QrloQoy.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\PUyOzvk.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\wUDPiTJ.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\rmgwUJs.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\ZLFMfmw.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\HNPVVXS.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\ETANaBn.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\ihjSowr.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\DeVwBOH.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\QuaaVnH.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\qFwitKa.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\ItwFtqX.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\xtrQxDP.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\ZZuuKxF.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\KQkhEAW.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\oJAVbdY.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\ZjQOLLo.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\bgaAmce.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\KsERFpb.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\rPcFvwM.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\qBEOYLx.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\LXiNwMy.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\QGiUqYY.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\JycCIWb.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\GHoYXgQ.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\QHlEMnw.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\vCKZdrN.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\WeKFxYS.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\DuvijoZ.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\PbOXiyD.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\XJKHZTM.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\JowKWpp.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\CqMluiu.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\UmjGurD.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\sTDXfJr.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\mkauDoJ.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\ZJxLqOX.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\UVIaFPy.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\qPQWtrF.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\RULWYqa.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\lYjRyMy.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\gGRuAkP.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\xbhpfzU.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\OUONufV.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\ODIEIDb.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\jtzsKrb.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\mgOsLAw.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\skDHujA.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\BsbobUM.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\clKZCCb.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\rFmZILF.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\IONhaxy.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
File created	C:\Windows\System\htaxUiF.exe	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2020	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
Token: SeDebugPrivilege	2020	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2020	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	29
PID 1736 wrote to memory of 2020	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	29
PID 1736 wrote to memory of 2020	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	29
PID 1736 wrote to memory of 2564	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	30
PID 1736 wrote to memory of 2564	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	30
PID 1736 wrote to memory of 2564	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	30
PID 1736 wrote to memory of 2752	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	31
PID 1736 wrote to memory of 2752	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	31
PID 1736 wrote to memory of 2752	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	31
PID 1736 wrote to memory of 2560	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	32
PID 1736 wrote to memory of 2560	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	32
PID 1736 wrote to memory of 2560	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	32
PID 1736 wrote to memory of 2536	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	33
PID 1736 wrote to memory of 2536	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	33
PID 1736 wrote to memory of 2536	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	33
PID 1736 wrote to memory of 2596	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	34
PID 1736 wrote to memory of 2596	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	34
PID 1736 wrote to memory of 2596	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	34
PID 1736 wrote to memory of 2556	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	35
PID 1736 wrote to memory of 2556	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	35
PID 1736 wrote to memory of 2556	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	35
PID 1736 wrote to memory of 2436	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	36
PID 1736 wrote to memory of 2436	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	36
PID 1736 wrote to memory of 2436	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	36
PID 1736 wrote to memory of 1724	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	37
PID 1736 wrote to memory of 1724	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	37
PID 1736 wrote to memory of 1724	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	37
PID 1736 wrote to memory of 3024	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	38
PID 1736 wrote to memory of 3024	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	38
PID 1736 wrote to memory of 3024	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	38
PID 1736 wrote to memory of 1872	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	39
PID 1736 wrote to memory of 1872	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	39
PID 1736 wrote to memory of 1872	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	39
PID 1736 wrote to memory of 2000	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	40
PID 1736 wrote to memory of 2000	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	40
PID 1736 wrote to memory of 2000	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	40
PID 1736 wrote to memory of 1332	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	41
PID 1736 wrote to memory of 1332	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	41
PID 1736 wrote to memory of 1332	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	41
PID 1736 wrote to memory of 1720	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	42
PID 1736 wrote to memory of 1720	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	42
PID 1736 wrote to memory of 1720	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	42
PID 1736 wrote to memory of 1228	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	43
PID 1736 wrote to memory of 1228	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	43
PID 1736 wrote to memory of 1228	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	43
PID 1736 wrote to memory of 1208	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	44
PID 1736 wrote to memory of 1208	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	44
PID 1736 wrote to memory of 1208	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	44
PID 1736 wrote to memory of 1176	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	45
PID 1736 wrote to memory of 1176	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	45
PID 1736 wrote to memory of 1176	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	45
PID 1736 wrote to memory of 2476	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	46
PID 1736 wrote to memory of 2476	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	46
PID 1736 wrote to memory of 2476	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	46
PID 1736 wrote to memory of 2032	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	47
PID 1736 wrote to memory of 2032	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	47
PID 1736 wrote to memory of 2032	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	47
PID 1736 wrote to memory of 2456	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	48
PID 1736 wrote to memory of 2456	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	48
PID 1736 wrote to memory of 2456	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	48
PID 1736 wrote to memory of 2708	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	49
PID 1736 wrote to memory of 2708	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	49
PID 1736 wrote to memory of 2708	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	49
PID 1736 wrote to memory of 1120	1736	0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c4dd5acce8af0c0304c7997ca7efb3a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Windows\System\yWoKXLn.exe
  C:\Windows\System\yWoKXLn.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\zHhJmsK.exe
  C:\Windows\System\zHhJmsK.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\egFYdzU.exe
  C:\Windows\System\egFYdzU.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\pgaZaIc.exe
  C:\Windows\System\pgaZaIc.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\CLdJFWI.exe
  C:\Windows\System\CLdJFWI.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\NqzzVmQ.exe
  C:\Windows\System\NqzzVmQ.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\XjWdljO.exe
  C:\Windows\System\XjWdljO.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\ZgWrHUs.exe
  C:\Windows\System\ZgWrHUs.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\OflAuDb.exe
  C:\Windows\System\OflAuDb.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\KeunoLI.exe
  C:\Windows\System\KeunoLI.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\HGOQoTx.exe
  C:\Windows\System\HGOQoTx.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\HUrTypk.exe
  C:\Windows\System\HUrTypk.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\eVcwUCa.exe
  C:\Windows\System\eVcwUCa.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\PEQlRwv.exe
  C:\Windows\System\PEQlRwv.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\tMMOmES.exe
  C:\Windows\System\tMMOmES.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\AjdUaIP.exe
  C:\Windows\System\AjdUaIP.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\lWxpKry.exe
  C:\Windows\System\lWxpKry.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\xiRYdUN.exe
  C:\Windows\System\xiRYdUN.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\UtEfwfO.exe
  C:\Windows\System\UtEfwfO.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\VFVqWzf.exe
  C:\Windows\System\VFVqWzf.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\TdasPTD.exe
  C:\Windows\System\TdasPTD.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\QNebLPH.exe
  C:\Windows\System\QNebLPH.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\UqSKcUh.exe
  C:\Windows\System\UqSKcUh.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\PkajJzH.exe
  C:\Windows\System\PkajJzH.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\HZNDJhB.exe
  C:\Windows\System\HZNDJhB.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\WTjTtCv.exe
  C:\Windows\System\WTjTtCv.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\zZnWOld.exe
  C:\Windows\System\zZnWOld.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\KKIMoDS.exe
  C:\Windows\System\KKIMoDS.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\vpJJbvU.exe
  C:\Windows\System\vpJJbvU.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\XTPmKRC.exe
  C:\Windows\System\XTPmKRC.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\gsjdLbo.exe
  C:\Windows\System\gsjdLbo.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\lywfrJj.exe
  C:\Windows\System\lywfrJj.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\IONhaxy.exe
  C:\Windows\System\IONhaxy.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\HDkzcVw.exe
  C:\Windows\System\HDkzcVw.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\JVVJpPe.exe
  C:\Windows\System\JVVJpPe.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\cwGyFyU.exe
  C:\Windows\System\cwGyFyU.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\EpwyQxn.exe
  C:\Windows\System\EpwyQxn.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\qOevZYI.exe
  C:\Windows\System\qOevZYI.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\cDsNRmI.exe
  C:\Windows\System\cDsNRmI.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\rJPXMym.exe
  C:\Windows\System\rJPXMym.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\ZTGtWhS.exe
  C:\Windows\System\ZTGtWhS.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\xyIpCTk.exe
  C:\Windows\System\xyIpCTk.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\tSXHbtu.exe
  C:\Windows\System\tSXHbtu.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\BIZdDYV.exe
  C:\Windows\System\BIZdDYV.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\WbbPeLO.exe
  C:\Windows\System\WbbPeLO.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\tNmGMMb.exe
  C:\Windows\System\tNmGMMb.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\WycvdhK.exe
  C:\Windows\System\WycvdhK.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\eEAnrlk.exe
  C:\Windows\System\eEAnrlk.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\gnfQUyZ.exe
  C:\Windows\System\gnfQUyZ.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\SDsNyGf.exe
  C:\Windows\System\SDsNyGf.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\WYRcctZ.exe
  C:\Windows\System\WYRcctZ.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\ZnzsQAk.exe
  C:\Windows\System\ZnzsQAk.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\IRFZyxV.exe
  C:\Windows\System\IRFZyxV.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\DeVwBOH.exe
  C:\Windows\System\DeVwBOH.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\TJlVSfA.exe
  C:\Windows\System\TJlVSfA.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\XSkulqo.exe
  C:\Windows\System\XSkulqo.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\mXBNRxn.exe
  C:\Windows\System\mXBNRxn.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\CkFcJTR.exe
  C:\Windows\System\CkFcJTR.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\eDTtXJk.exe
  C:\Windows\System\eDTtXJk.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\wPJOuTq.exe
  C:\Windows\System\wPJOuTq.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\FwMfMKA.exe
  C:\Windows\System\FwMfMKA.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\zQihoUa.exe
  C:\Windows\System\zQihoUa.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\hbQnUJI.exe
  C:\Windows\System\hbQnUJI.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\wOXGXkQ.exe
  C:\Windows\System\wOXGXkQ.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\tZEFkyK.exe
  C:\Windows\System\tZEFkyK.exe
  2⤵
  PID:2736
- C:\Windows\System\jWlkpOz.exe
  C:\Windows\System\jWlkpOz.exe
  2⤵
  PID:2540
- C:\Windows\System\mRnRRnW.exe
  C:\Windows\System\mRnRRnW.exe
  2⤵
  PID:2444
- C:\Windows\System\NzlxtQK.exe
  C:\Windows\System\NzlxtQK.exe
  2⤵
  PID:2472
- C:\Windows\System\AhEoqfp.exe
  C:\Windows\System\AhEoqfp.exe
  2⤵
  PID:2816
- C:\Windows\System\rpXCuta.exe
  C:\Windows\System\rpXCuta.exe
  2⤵
  PID:1040
- C:\Windows\System\jxouarf.exe
  C:\Windows\System\jxouarf.exe
  2⤵
  PID:1928
- C:\Windows\System\pnksqye.exe
  C:\Windows\System\pnksqye.exe
  2⤵
  PID:2172
- C:\Windows\System\cnrJojf.exe
  C:\Windows\System\cnrJojf.exe
  2⤵
  PID:1376
- C:\Windows\System\TmyqxXG.exe
  C:\Windows\System\TmyqxXG.exe
  2⤵
  PID:2612
- C:\Windows\System\UVwsyqr.exe
  C:\Windows\System\UVwsyqr.exe
  2⤵
  PID:1600
- C:\Windows\System\iNADJUL.exe
  C:\Windows\System\iNADJUL.exe
  2⤵
  PID:2040
- C:\Windows\System\jUTdHAv.exe
  C:\Windows\System\jUTdHAv.exe
  2⤵
  PID:1700
- C:\Windows\System\EipRyLy.exe
  C:\Windows\System\EipRyLy.exe
  2⤵
  PID:2704
- C:\Windows\System\DNmciXZ.exe
  C:\Windows\System\DNmciXZ.exe
  2⤵
  PID:2400
- C:\Windows\System\OSKZNKH.exe
  C:\Windows\System\OSKZNKH.exe
  2⤵
  PID:3000
- C:\Windows\System\XhqTmbU.exe
  C:\Windows\System\XhqTmbU.exe
  2⤵
  PID:1008
- C:\Windows\System\PRfaJzQ.exe
  C:\Windows\System\PRfaJzQ.exe
  2⤵
  PID:1412
- C:\Windows\System\NgOqTyX.exe
  C:\Windows\System\NgOqTyX.exe
  2⤵
  PID:2380
- C:\Windows\System\mebnZCh.exe
  C:\Windows\System\mebnZCh.exe
  2⤵
  PID:2572
- C:\Windows\System\zGgCpAZ.exe
  C:\Windows\System\zGgCpAZ.exe
  2⤵
  PID:444
- C:\Windows\System\OQideLI.exe
  C:\Windows\System\OQideLI.exe
  2⤵
  PID:3012
- C:\Windows\System\ydNvwCO.exe
  C:\Windows\System\ydNvwCO.exe
  2⤵
  PID:1296
- C:\Windows\System\VczoJBO.exe
  C:\Windows\System\VczoJBO.exe
  2⤵
  PID:1708
- C:\Windows\System\aqsAGbR.exe
  C:\Windows\System\aqsAGbR.exe
  2⤵
  PID:1556
- C:\Windows\System\SAofIvb.exe
  C:\Windows\System\SAofIvb.exe
  2⤵
  PID:872
- C:\Windows\System\IaJLWpR.exe
  C:\Windows\System\IaJLWpR.exe
  2⤵
  PID:2636
- C:\Windows\System\mgOsLAw.exe
  C:\Windows\System\mgOsLAw.exe
  2⤵
  PID:2440
- C:\Windows\System\LwPpyzq.exe
  C:\Windows\System\LwPpyzq.exe
  2⤵
  PID:2012
- C:\Windows\System\RykGeCw.exe
  C:\Windows\System\RykGeCw.exe
  2⤵
  PID:2088
- C:\Windows\System\WJpeuOG.exe
  C:\Windows\System\WJpeuOG.exe
  2⤵
  PID:1752
- C:\Windows\System\skDHujA.exe
  C:\Windows\System\skDHujA.exe
  2⤵
  PID:2504
- C:\Windows\System\ALbjzro.exe
  C:\Windows\System\ALbjzro.exe
  2⤵
  PID:2244
- C:\Windows\System\hQffaHS.exe
  C:\Windows\System\hQffaHS.exe
  2⤵
  PID:1732
- C:\Windows\System\llOcBjV.exe
  C:\Windows\System\llOcBjV.exe
  2⤵
  PID:2880
- C:\Windows\System\FtcPHGq.exe
  C:\Windows\System\FtcPHGq.exe
  2⤵
  PID:1544
- C:\Windows\System\XLZpAUP.exe
  C:\Windows\System\XLZpAUP.exe
  2⤵
  PID:2668
- C:\Windows\System\DaguZei.exe
  C:\Windows\System\DaguZei.exe
  2⤵
  PID:2672
- C:\Windows\System\wVaAvHS.exe
  C:\Windows\System\wVaAvHS.exe
  2⤵
  PID:2416
- C:\Windows\System\WHVCuIB.exe
  C:\Windows\System\WHVCuIB.exe
  2⤵
  PID:1868
- C:\Windows\System\QyAMtqQ.exe
  C:\Windows\System\QyAMtqQ.exe
  2⤵
  PID:3088
- C:\Windows\System\XKbEhQx.exe
  C:\Windows\System\XKbEhQx.exe
  2⤵
  PID:3104
- C:\Windows\System\jqGCbJn.exe
  C:\Windows\System\jqGCbJn.exe
  2⤵
  PID:3120
- C:\Windows\System\IpaHwPS.exe
  C:\Windows\System\IpaHwPS.exe
  2⤵
  PID:3136
- C:\Windows\System\qBqtwaT.exe
  C:\Windows\System\qBqtwaT.exe
  2⤵
  PID:3152
- C:\Windows\System\CzwHevb.exe
  C:\Windows\System\CzwHevb.exe
  2⤵
  PID:3168
- C:\Windows\System\GtMFDHp.exe
  C:\Windows\System\GtMFDHp.exe
  2⤵
  PID:3184
- C:\Windows\System\pQrYrhj.exe
  C:\Windows\System\pQrYrhj.exe
  2⤵
  PID:3200
- C:\Windows\System\ssWqzJT.exe
  C:\Windows\System\ssWqzJT.exe
  2⤵
  PID:3216
- C:\Windows\System\HpWpmhr.exe
  C:\Windows\System\HpWpmhr.exe
  2⤵
  PID:3232
- C:\Windows\System\WazRvQb.exe
  C:\Windows\System\WazRvQb.exe
  2⤵
  PID:3248
- C:\Windows\System\Ztvaalv.exe
  C:\Windows\System\Ztvaalv.exe
  2⤵
  PID:3264
- C:\Windows\System\UjkLhkF.exe
  C:\Windows\System\UjkLhkF.exe
  2⤵
  PID:3280
- C:\Windows\System\vCcirgc.exe
  C:\Windows\System\vCcirgc.exe
  2⤵
  PID:3296
- C:\Windows\System\gslFQFu.exe
  C:\Windows\System\gslFQFu.exe
  2⤵
  PID:3312
- C:\Windows\System\tIltkRQ.exe
  C:\Windows\System\tIltkRQ.exe
  2⤵
  PID:3328
- C:\Windows\System\xHRoMzM.exe
  C:\Windows\System\xHRoMzM.exe
  2⤵
  PID:3344
- C:\Windows\System\baDUCGE.exe
  C:\Windows\System\baDUCGE.exe
  2⤵
  PID:3360
- C:\Windows\System\whHEZzf.exe
  C:\Windows\System\whHEZzf.exe
  2⤵
  PID:3376
- C:\Windows\System\IhjFCdi.exe
  C:\Windows\System\IhjFCdi.exe
  2⤵
  PID:3392
- C:\Windows\System\UaqUTJS.exe
  C:\Windows\System\UaqUTJS.exe
  2⤵
  PID:3408
- C:\Windows\System\xjdTttS.exe
  C:\Windows\System\xjdTttS.exe
  2⤵
  PID:3424
- C:\Windows\System\RClwdPi.exe
  C:\Windows\System\RClwdPi.exe
  2⤵
  PID:3440
- C:\Windows\System\VKQGDQf.exe
  C:\Windows\System\VKQGDQf.exe
  2⤵
  PID:3456
- C:\Windows\System\XbJYfrw.exe
  C:\Windows\System\XbJYfrw.exe
  2⤵
  PID:3472
- C:\Windows\System\ZynJXwG.exe
  C:\Windows\System\ZynJXwG.exe
  2⤵
  PID:3488
- C:\Windows\System\BsoVBGo.exe
  C:\Windows\System\BsoVBGo.exe
  2⤵
  PID:3504
- C:\Windows\System\BFBiOzH.exe
  C:\Windows\System\BFBiOzH.exe
  2⤵
  PID:3520
- C:\Windows\System\boHyUwD.exe
  C:\Windows\System\boHyUwD.exe
  2⤵
  PID:3536
- C:\Windows\System\lHgsJWI.exe
  C:\Windows\System\lHgsJWI.exe
  2⤵
  PID:3552
- C:\Windows\System\fbrcJhr.exe
  C:\Windows\System\fbrcJhr.exe
  2⤵
  PID:3568
- C:\Windows\System\rkyQNfa.exe
  C:\Windows\System\rkyQNfa.exe
  2⤵
  PID:3584
- C:\Windows\System\TCayMJj.exe
  C:\Windows\System\TCayMJj.exe
  2⤵
  PID:3600
- C:\Windows\System\pLOpWFJ.exe
  C:\Windows\System\pLOpWFJ.exe
  2⤵
  PID:3616
- C:\Windows\System\bauKXkm.exe
  C:\Windows\System\bauKXkm.exe
  2⤵
  PID:3632
- C:\Windows\System\VeWYvVR.exe
  C:\Windows\System\VeWYvVR.exe
  2⤵
  PID:3648
- C:\Windows\System\CJCMSnE.exe
  C:\Windows\System\CJCMSnE.exe
  2⤵
  PID:3664
- C:\Windows\System\NEfdlQj.exe
  C:\Windows\System\NEfdlQj.exe
  2⤵
  PID:3680
- C:\Windows\System\pBkCwoE.exe
  C:\Windows\System\pBkCwoE.exe
  2⤵
  PID:3696
- C:\Windows\System\CffeHZQ.exe
  C:\Windows\System\CffeHZQ.exe
  2⤵
  PID:3712
- C:\Windows\System\egXNDop.exe
  C:\Windows\System\egXNDop.exe
  2⤵
  PID:3728
- C:\Windows\System\HyAYABM.exe
  C:\Windows\System\HyAYABM.exe
  2⤵
  PID:3744
- C:\Windows\System\UxgkFcB.exe
  C:\Windows\System\UxgkFcB.exe
  2⤵
  PID:3760
- C:\Windows\System\sKBVjiv.exe
  C:\Windows\System\sKBVjiv.exe
  2⤵
  PID:3776
- C:\Windows\System\wxkznIn.exe
  C:\Windows\System\wxkznIn.exe
  2⤵
  PID:3792
- C:\Windows\System\ZqTPIgg.exe
  C:\Windows\System\ZqTPIgg.exe
  2⤵
  PID:3808
- C:\Windows\System\jAlduBl.exe
  C:\Windows\System\jAlduBl.exe
  2⤵
  PID:3824
- C:\Windows\System\lpksoID.exe
  C:\Windows\System\lpksoID.exe
  2⤵
  PID:3840
- C:\Windows\System\WeQleCo.exe
  C:\Windows\System\WeQleCo.exe
  2⤵
  PID:3856
- C:\Windows\System\lnHSnQs.exe
  C:\Windows\System\lnHSnQs.exe
  2⤵
  PID:3872
- C:\Windows\System\jUvaFpC.exe
  C:\Windows\System\jUvaFpC.exe
  2⤵
  PID:3888
- C:\Windows\System\quhpwiG.exe
  C:\Windows\System\quhpwiG.exe
  2⤵
  PID:3904
- C:\Windows\System\IlUEWmg.exe
  C:\Windows\System\IlUEWmg.exe
  2⤵
  PID:3920
- C:\Windows\System\rZwiIsF.exe
  C:\Windows\System\rZwiIsF.exe
  2⤵
  PID:3936
- C:\Windows\System\cewbqrs.exe
  C:\Windows\System\cewbqrs.exe
  2⤵
  PID:3952
- C:\Windows\System\SlBuQJh.exe
  C:\Windows\System\SlBuQJh.exe
  2⤵
  PID:3968
- C:\Windows\System\prnHlWS.exe
  C:\Windows\System\prnHlWS.exe
  2⤵
  PID:3984
- C:\Windows\System\ezhCJgF.exe
  C:\Windows\System\ezhCJgF.exe
  2⤵
  PID:4000
- C:\Windows\System\fKPOJKI.exe
  C:\Windows\System\fKPOJKI.exe
  2⤵
  PID:4016
- C:\Windows\System\vVygzTS.exe
  C:\Windows\System\vVygzTS.exe
  2⤵
  PID:4032
- C:\Windows\System\ovayQuE.exe
  C:\Windows\System\ovayQuE.exe
  2⤵
  PID:4048
- C:\Windows\System\fiztzab.exe
  C:\Windows\System\fiztzab.exe
  2⤵
  PID:4064
- C:\Windows\System\oqdpbVA.exe
  C:\Windows\System\oqdpbVA.exe
  2⤵
  PID:4080
- C:\Windows\System\LmrsxBl.exe
  C:\Windows\System\LmrsxBl.exe
  2⤵
  PID:2852
- C:\Windows\System\eFkkWQl.exe
  C:\Windows\System\eFkkWQl.exe
  2⤵
  PID:1660
- C:\Windows\System\KQkhEAW.exe
  C:\Windows\System\KQkhEAW.exe
  2⤵
  PID:1808
- C:\Windows\System\HIVsGVI.exe
  C:\Windows\System\HIVsGVI.exe
  2⤵
  PID:856
- C:\Windows\System\DBEOCtV.exe
  C:\Windows\System\DBEOCtV.exe
  2⤵
  PID:1640
- C:\Windows\System\gsbxfMN.exe
  C:\Windows\System\gsbxfMN.exe
  2⤵
  PID:2396
- C:\Windows\System\DZCeiRS.exe
  C:\Windows\System\DZCeiRS.exe
  2⤵
  PID:1776
- C:\Windows\System\CLeHsWv.exe
  C:\Windows\System\CLeHsWv.exe
  2⤵
  PID:836
- C:\Windows\System\WWNTkxP.exe
  C:\Windows\System\WWNTkxP.exe
  2⤵
  PID:2748
- C:\Windows\System\JIWkwhk.exe
  C:\Windows\System\JIWkwhk.exe
  2⤵
  PID:1280
- C:\Windows\System\SZTjdoz.exe
  C:\Windows\System\SZTjdoz.exe
  2⤵
  PID:960
- C:\Windows\System\taUISOy.exe
  C:\Windows\System\taUISOy.exe
  2⤵
  PID:900
- C:\Windows\System\lgggTpM.exe
  C:\Windows\System\lgggTpM.exe
  2⤵
  PID:2256
- C:\Windows\System\qjjnFOz.exe
  C:\Windows\System\qjjnFOz.exe
  2⤵
  PID:2784
- C:\Windows\System\UurcoQD.exe
  C:\Windows\System\UurcoQD.exe
  2⤵
  PID:1548
- C:\Windows\System\NXNFHpH.exe
  C:\Windows\System\NXNFHpH.exe
  2⤵
  PID:2484
- C:\Windows\System\YYBWUvd.exe
  C:\Windows\System\YYBWUvd.exe
  2⤵
  PID:2588
- C:\Windows\System\NPKcJPF.exe
  C:\Windows\System\NPKcJPF.exe
  2⤵
  PID:3100
- C:\Windows\System\XyMefJk.exe
  C:\Windows\System\XyMefJk.exe
  2⤵
  PID:2808
- C:\Windows\System\UsZbSwX.exe
  C:\Windows\System\UsZbSwX.exe
  2⤵
  PID:3160
- C:\Windows\System\cunMFLV.exe
  C:\Windows\System\cunMFLV.exe
  2⤵
  PID:3180
- C:\Windows\System\tiiJjgV.exe
  C:\Windows\System\tiiJjgV.exe
  2⤵
  PID:3224
- C:\Windows\System\olACMQJ.exe
  C:\Windows\System\olACMQJ.exe
  2⤵
  PID:3244
- C:\Windows\System\VsCZRjE.exe
  C:\Windows\System\VsCZRjE.exe
  2⤵
  PID:3292
- C:\Windows\System\fbgcQYn.exe
  C:\Windows\System\fbgcQYn.exe
  2⤵
  PID:3308
- C:\Windows\System\aRMIwNm.exe
  C:\Windows\System\aRMIwNm.exe
  2⤵
  PID:3352
- C:\Windows\System\BEtteNB.exe
  C:\Windows\System\BEtteNB.exe
  2⤵
  PID:3372
- C:\Windows\System\CggAtxR.exe
  C:\Windows\System\CggAtxR.exe
  2⤵
  PID:3416
- C:\Windows\System\MTHQOif.exe
  C:\Windows\System\MTHQOif.exe
  2⤵
  PID:3436
- C:\Windows\System\JhBPqcj.exe
  C:\Windows\System\JhBPqcj.exe
  2⤵
  PID:3468
- C:\Windows\System\IxCYmco.exe
  C:\Windows\System\IxCYmco.exe
  2⤵
  PID:3500
- C:\Windows\System\cwrWKQV.exe
  C:\Windows\System\cwrWKQV.exe
  2⤵
  PID:3532
- C:\Windows\System\uinLngi.exe
  C:\Windows\System\uinLngi.exe
  2⤵
  PID:3576
- C:\Windows\System\xtCkXod.exe
  C:\Windows\System\xtCkXod.exe
  2⤵
  PID:3592
- C:\Windows\System\qGdGPcd.exe
  C:\Windows\System\qGdGPcd.exe
  2⤵
  PID:3624
- C:\Windows\System\ghuPplm.exe
  C:\Windows\System\ghuPplm.exe
  2⤵
  PID:3656
- C:\Windows\System\EiQRrHW.exe
  C:\Windows\System\EiQRrHW.exe
  2⤵
  PID:3688
- C:\Windows\System\QXTylhD.exe
  C:\Windows\System\QXTylhD.exe
  2⤵
  PID:3720
- C:\Windows\System\maeySSc.exe
  C:\Windows\System\maeySSc.exe
  2⤵
  PID:3752
- C:\Windows\System\vlchUSm.exe
  C:\Windows\System\vlchUSm.exe
  2⤵
  PID:2428
- C:\Windows\System\IKGlGqa.exe
  C:\Windows\System\IKGlGqa.exe
  2⤵
  PID:2656
- C:\Windows\System\VeWkbjW.exe
  C:\Windows\System\VeWkbjW.exe
  2⤵
  PID:3816
- C:\Windows\System\VIBbUAM.exe
  C:\Windows\System\VIBbUAM.exe
  2⤵
  PID:3848
- C:\Windows\System\pMsQYpl.exe
  C:\Windows\System\pMsQYpl.exe
  2⤵
  PID:3880
- C:\Windows\System\aShLjFQ.exe
  C:\Windows\System\aShLjFQ.exe
  2⤵
  PID:3900
- C:\Windows\System\vxMfJQH.exe
  C:\Windows\System\vxMfJQH.exe
  2⤵
  PID:3912
- C:\Windows\System\rrtVnab.exe
  C:\Windows\System\rrtVnab.exe
  2⤵
  PID:3948
- C:\Windows\System\ImSEfJU.exe
  C:\Windows\System\ImSEfJU.exe
  2⤵
  PID:4008
- C:\Windows\System\sbbTQaY.exe
  C:\Windows\System\sbbTQaY.exe
  2⤵
  PID:4024
- C:\Windows\System\taKgYjr.exe
  C:\Windows\System\taKgYjr.exe
  2⤵
  PID:4060
- C:\Windows\System\BfOLasK.exe
  C:\Windows\System\BfOLasK.exe
  2⤵
  PID:4092
- C:\Windows\System\jsvbpdI.exe
  C:\Windows\System\jsvbpdI.exe
  2⤵
  PID:2204
- C:\Windows\System\SnVeUtn.exe
  C:\Windows\System\SnVeUtn.exe
  2⤵
  PID:796
- C:\Windows\System\EsIyyxM.exe
  C:\Windows\System\EsIyyxM.exe
  2⤵
  PID:496
- C:\Windows\System\qrAjdLB.exe
  C:\Windows\System\qrAjdLB.exe
  2⤵
  PID:2996
- C:\Windows\System\aqMlNal.exe
  C:\Windows\System\aqMlNal.exe
  2⤵
  PID:3020
- C:\Windows\System\CbbIDrH.exe
  C:\Windows\System\CbbIDrH.exe
  2⤵
  PID:4112
- C:\Windows\System\WbEjJTb.exe
  C:\Windows\System\WbEjJTb.exe
  2⤵
  PID:4128
- C:\Windows\System\dwCogyN.exe
  C:\Windows\System\dwCogyN.exe
  2⤵
  PID:4144
- C:\Windows\System\etmudAJ.exe
  C:\Windows\System\etmudAJ.exe
  2⤵
  PID:4160
- C:\Windows\System\dtqpmhC.exe
  C:\Windows\System\dtqpmhC.exe
  2⤵
  PID:4176
- C:\Windows\System\PlRmAcW.exe
  C:\Windows\System\PlRmAcW.exe
  2⤵
  PID:4192
- C:\Windows\System\IacxPHj.exe
  C:\Windows\System\IacxPHj.exe
  2⤵
  PID:4208
- C:\Windows\System\pUShFZA.exe
  C:\Windows\System\pUShFZA.exe
  2⤵
  PID:4224
- C:\Windows\System\VHLQsKy.exe
  C:\Windows\System\VHLQsKy.exe
  2⤵
  PID:4240
- C:\Windows\System\hUBoudN.exe
  C:\Windows\System\hUBoudN.exe
  2⤵
  PID:4256
- C:\Windows\System\YAEZfJN.exe
  C:\Windows\System\YAEZfJN.exe
  2⤵
  PID:4272
- C:\Windows\System\VoMACYD.exe
  C:\Windows\System\VoMACYD.exe
  2⤵
  PID:4288
- C:\Windows\System\GBLFnMz.exe
  C:\Windows\System\GBLFnMz.exe
  2⤵
  PID:4304
- C:\Windows\System\xhRJOqg.exe
  C:\Windows\System\xhRJOqg.exe
  2⤵
  PID:4320
- C:\Windows\System\BaJdAYY.exe
  C:\Windows\System\BaJdAYY.exe
  2⤵
  PID:4336
- C:\Windows\System\qBEOYLx.exe
  C:\Windows\System\qBEOYLx.exe
  2⤵
  PID:4356
- C:\Windows\System\JaSOEtb.exe
  C:\Windows\System\JaSOEtb.exe
  2⤵
  PID:4372
- C:\Windows\System\KsHTTqv.exe
  C:\Windows\System\KsHTTqv.exe
  2⤵
  PID:4388
- C:\Windows\System\UqXEdyw.exe
  C:\Windows\System\UqXEdyw.exe
  2⤵
  PID:4404
- C:\Windows\System\ZbsKdjO.exe
  C:\Windows\System\ZbsKdjO.exe
  2⤵
  PID:4424
- C:\Windows\System\sFzTqqB.exe
  C:\Windows\System\sFzTqqB.exe
  2⤵
  PID:4440
- C:\Windows\System\HEAmGMV.exe
  C:\Windows\System\HEAmGMV.exe
  2⤵
  PID:4456
- C:\Windows\System\AiYziWi.exe
  C:\Windows\System\AiYziWi.exe
  2⤵
  PID:4472
- C:\Windows\System\fRnOpaH.exe
  C:\Windows\System\fRnOpaH.exe
  2⤵
  PID:4488
- C:\Windows\System\pmgyolE.exe
  C:\Windows\System\pmgyolE.exe
  2⤵
  PID:4504
- C:\Windows\System\QqoQUFR.exe
  C:\Windows\System\QqoQUFR.exe
  2⤵
  PID:4520
- C:\Windows\System\MLBeAbg.exe
  C:\Windows\System\MLBeAbg.exe
  2⤵
  PID:4540
- C:\Windows\System\SJLUEyD.exe
  C:\Windows\System\SJLUEyD.exe
  2⤵
  PID:4556
- C:\Windows\System\cLPgNIv.exe
  C:\Windows\System\cLPgNIv.exe
  2⤵
  PID:4572
- C:\Windows\System\gHqfDnp.exe
  C:\Windows\System\gHqfDnp.exe
  2⤵
  PID:4588
- C:\Windows\System\GPZNOJv.exe
  C:\Windows\System\GPZNOJv.exe
  2⤵
  PID:4604
- C:\Windows\System\RmZsOcM.exe
  C:\Windows\System\RmZsOcM.exe
  2⤵
  PID:4760
- C:\Windows\System\kyPVtAw.exe
  C:\Windows\System\kyPVtAw.exe
  2⤵
  PID:4776
- C:\Windows\System\FvbsIFu.exe
  C:\Windows\System\FvbsIFu.exe
  2⤵
  PID:4796
- C:\Windows\System\DcOQZqe.exe
  C:\Windows\System\DcOQZqe.exe
  2⤵
  PID:4812
- C:\Windows\System\dCXGlfi.exe
  C:\Windows\System\dCXGlfi.exe
  2⤵
  PID:4836
- C:\Windows\System\IlduzYD.exe
  C:\Windows\System\IlduzYD.exe
  2⤵
  PID:4852
- C:\Windows\System\BTqLpwM.exe
  C:\Windows\System\BTqLpwM.exe
  2⤵
  PID:4868
- C:\Windows\System\PqVIlEk.exe
  C:\Windows\System\PqVIlEk.exe
  2⤵
  PID:4884
- C:\Windows\System\stAhFpP.exe
  C:\Windows\System\stAhFpP.exe
  2⤵
  PID:4900
- C:\Windows\System\ImDZqxY.exe
  C:\Windows\System\ImDZqxY.exe
  2⤵
  PID:4916
- C:\Windows\System\sTDXfJr.exe
  C:\Windows\System\sTDXfJr.exe
  2⤵
  PID:4932
- C:\Windows\System\JebxMqK.exe
  C:\Windows\System\JebxMqK.exe
  2⤵
  PID:4948
- C:\Windows\System\vpafzCP.exe
  C:\Windows\System\vpafzCP.exe
  2⤵
  PID:4964
- C:\Windows\System\fCgXAzm.exe
  C:\Windows\System\fCgXAzm.exe
  2⤵
  PID:4980
- C:\Windows\System\PfIWfKe.exe
  C:\Windows\System\PfIWfKe.exe
  2⤵
  PID:4996
- C:\Windows\System\YnKflur.exe
  C:\Windows\System\YnKflur.exe
  2⤵
  PID:5012
- C:\Windows\System\iZxMPiD.exe
  C:\Windows\System\iZxMPiD.exe
  2⤵
  PID:5028
- C:\Windows\System\BKVaYAS.exe
  C:\Windows\System\BKVaYAS.exe
  2⤵
  PID:5044
- C:\Windows\System\AfVLZLx.exe
  C:\Windows\System\AfVLZLx.exe
  2⤵
  PID:5060
- C:\Windows\System\iIMGQhO.exe
  C:\Windows\System\iIMGQhO.exe
  2⤵
  PID:5076
- C:\Windows\System\wEQoLfN.exe
  C:\Windows\System\wEQoLfN.exe
  2⤵
  PID:5092
- C:\Windows\System\ciaTpYp.exe
  C:\Windows\System\ciaTpYp.exe
  2⤵
  PID:5108
- C:\Windows\System\pnXtnoE.exe
  C:\Windows\System\pnXtnoE.exe
  2⤵
  PID:1864
- C:\Windows\System\aphtxDJ.exe
  C:\Windows\System\aphtxDJ.exe
  2⤵
  PID:3084
- C:\Windows\System\GUZDWwa.exe
  C:\Windows\System\GUZDWwa.exe
  2⤵
  PID:3288
- C:\Windows\System\oHioYLP.exe
  C:\Windows\System\oHioYLP.exe
  2⤵
  PID:772
- C:\Windows\System\pJsqEVI.exe
  C:\Windows\System\pJsqEVI.exe
  2⤵
  PID:1936
- C:\Windows\System\sJAzlhm.exe
  C:\Windows\System\sJAzlhm.exe
  2⤵
  PID:3128
- C:\Windows\System\iqmkZkc.exe
  C:\Windows\System\iqmkZkc.exe
  2⤵
  PID:3256
- C:\Windows\System\aMWkNLS.exe
  C:\Windows\System\aMWkNLS.exe
  2⤵
  PID:4788
- C:\Windows\System\GkMuaHp.exe
  C:\Windows\System\GkMuaHp.exe
  2⤵
  PID:3420
- C:\Windows\System\AphkYhN.exe
  C:\Windows\System\AphkYhN.exe
  2⤵
  PID:3560
- C:\Windows\System\cKmUauZ.exe
  C:\Windows\System\cKmUauZ.exe
  2⤵
  PID:3660
- C:\Windows\System\MrPoNMz.exe
  C:\Windows\System\MrPoNMz.exe
  2⤵
  PID:268
- C:\Windows\System\nCSfwmb.exe
  C:\Windows\System\nCSfwmb.exe
  2⤵
  PID:3148
- C:\Windows\System\yOPwTye.exe
  C:\Windows\System\yOPwTye.exe
  2⤵
  PID:3784
- C:\Windows\System\wKRRxyP.exe
  C:\Windows\System\wKRRxyP.exe
  2⤵
  PID:2836
- C:\Windows\System\nofACtd.exe
  C:\Windows\System\nofACtd.exe
  2⤵
  PID:3980
- C:\Windows\System\wUoNsKF.exe
  C:\Windows\System\wUoNsKF.exe
  2⤵
  PID:4044
- C:\Windows\System\hpGFNWa.exe
  C:\Windows\System\hpGFNWa.exe
  2⤵
  PID:2932
- C:\Windows\System\ZFofxPQ.exe
  C:\Windows\System\ZFofxPQ.exe
  2⤵
  PID:4136
- C:\Windows\System\GaLXvms.exe
  C:\Windows\System\GaLXvms.exe
  2⤵
  PID:4200
- C:\Windows\System\kyCpnOQ.exe
  C:\Windows\System\kyCpnOQ.exe
  2⤵
  PID:4264
- C:\Windows\System\MNQoKVs.exe
  C:\Windows\System\MNQoKVs.exe
  2⤵
  PID:4332
- C:\Windows\System\yVJXGTm.exe
  C:\Windows\System\yVJXGTm.exe
  2⤵
  PID:4400
- C:\Windows\System\StEqWdR.exe
  C:\Windows\System\StEqWdR.exe
  2⤵
  PID:4468
- C:\Windows\System\rIVqBLo.exe
  C:\Windows\System\rIVqBLo.exe
  2⤵
  PID:4532
- C:\Windows\System\KzKRFJZ.exe
  C:\Windows\System\KzKRFJZ.exe
  2⤵
  PID:4600
- C:\Windows\System\WXgGxeK.exe
  C:\Windows\System\WXgGxeK.exe
  2⤵
  PID:4808
- C:\Windows\System\XvyPVEh.exe
  C:\Windows\System\XvyPVEh.exe
  2⤵
  PID:1996
- C:\Windows\System\HXxbEdS.exe
  C:\Windows\System\HXxbEdS.exe
  2⤵
  PID:3708
- C:\Windows\System\vcSQVvT.exe
  C:\Windows\System\vcSQVvT.exe
  2⤵
  PID:4876
- C:\Windows\System\nWcOcsr.exe
  C:\Windows\System\nWcOcsr.exe
  2⤵
  PID:4940
- C:\Windows\System\xfyazoE.exe
  C:\Windows\System\xfyazoE.exe
  2⤵
  PID:5004
- C:\Windows\System\BrIbeWJ.exe
  C:\Windows\System\BrIbeWJ.exe
  2⤵
  PID:5068
- C:\Windows\System\dVCPXds.exe
  C:\Windows\System\dVCPXds.exe
  2⤵
  PID:3788
- C:\Windows\System\IvCwNZn.exe
  C:\Windows\System\IvCwNZn.exe
  2⤵
  PID:3276
- C:\Windows\System\hViFkSH.exe
  C:\Windows\System\hViFkSH.exe
  2⤵
  PID:2144
- C:\Windows\System\gZbShsE.exe
  C:\Windows\System\gZbShsE.exe
  2⤵
  PID:3452
- C:\Windows\System\ASkSVxW.exe
  C:\Windows\System\ASkSVxW.exe
  2⤵
  PID:2688
- C:\Windows\System\KbonWaR.exe
  C:\Windows\System\KbonWaR.exe
  2⤵
  PID:3928
- C:\Windows\System\sQVoLas.exe
  C:\Windows\System\sQVoLas.exe
  2⤵
  PID:4028
- C:\Windows\System\dvJpPGT.exe
  C:\Windows\System\dvJpPGT.exe
  2⤵
  PID:992
- C:\Windows\System\oFftGXw.exe
  C:\Windows\System\oFftGXw.exe
  2⤵
  PID:1800
- C:\Windows\System\yIZvmXP.exe
  C:\Windows\System\yIZvmXP.exe
  2⤵
  PID:3320
- C:\Windows\System\bSwNpHm.exe
  C:\Windows\System\bSwNpHm.exe
  2⤵
  PID:4188
- C:\Windows\System\UhgJtfm.exe
  C:\Windows\System\UhgJtfm.exe
  2⤵
  PID:3736
- C:\Windows\System\PZGWonA.exe
  C:\Windows\System\PZGWonA.exe
  2⤵
  PID:3916
- C:\Windows\System\GFRmVpc.exe
  C:\Windows\System\GFRmVpc.exe
  2⤵
  PID:4168
- C:\Windows\System\QONUirl.exe
  C:\Windows\System\QONUirl.exe
  2⤵
  PID:4328
- C:\Windows\System\HvaJzHi.exe
  C:\Windows\System\HvaJzHi.exe
  2⤵
  PID:4596
- C:\Windows\System\GTBpSCK.exe
  C:\Windows\System\GTBpSCK.exe
  2⤵
  PID:4848
- C:\Windows\System\hWapGzk.exe
  C:\Windows\System\hWapGzk.exe
  2⤵
  PID:5104
- C:\Windows\System\wfWBlhi.exe
  C:\Windows\System\wfWBlhi.exe
  2⤵
  PID:3116
- C:\Windows\System\HleWCMs.exe
  C:\Windows\System\HleWCMs.exe
  2⤵
  PID:1028
- C:\Windows\System\ickzNEE.exe
  C:\Windows\System\ickzNEE.exe
  2⤵
  PID:4216
- C:\Windows\System\NvxBsTd.exe
  C:\Windows\System\NvxBsTd.exe
  2⤵
  PID:5024
- C:\Windows\System\aqFZsAR.exe
  C:\Windows\System\aqFZsAR.exe
  2⤵
  PID:4284
- C:\Windows\System\BEMdPgj.exe
  C:\Windows\System\BEMdPgj.exe
  2⤵
  PID:4380
- C:\Windows\System\VULlSoa.exe
  C:\Windows\System\VULlSoa.exe
  2⤵
  PID:4412
- C:\Windows\System\oRvsDHY.exe
  C:\Windows\System\oRvsDHY.exe
  2⤵
  PID:4452
- C:\Windows\System\XYrrrhS.exe
  C:\Windows\System\XYrrrhS.exe
  2⤵
  PID:4516
- C:\Windows\System\LkirqNf.exe
  C:\Windows\System\LkirqNf.exe
  2⤵
  PID:4584
- C:\Windows\System\BqDPcPZ.exe
  C:\Windows\System\BqDPcPZ.exe
  2⤵
  PID:4624
- C:\Windows\System\mCrFfkr.exe
  C:\Windows\System\mCrFfkr.exe
  2⤵
  PID:4640
- C:\Windows\System\OVIutiw.exe
  C:\Windows\System\OVIutiw.exe
  2⤵
  PID:4232
- C:\Windows\System\wngSSwL.exe
  C:\Windows\System\wngSSwL.exe
  2⤵
  PID:4668
- C:\Windows\System\ReFhJpn.exe
  C:\Windows\System\ReFhJpn.exe
  2⤵
  PID:4684
- C:\Windows\System\nGQHXfK.exe
  C:\Windows\System\nGQHXfK.exe
  2⤵
  PID:4700
- C:\Windows\System\jRkIoMb.exe
  C:\Windows\System\jRkIoMb.exe
  2⤵
  PID:4712
- C:\Windows\System\ZMUiuhx.exe
  C:\Windows\System\ZMUiuhx.exe
  2⤵
  PID:4732
- C:\Windows\System\gJVyswy.exe
  C:\Windows\System\gJVyswy.exe
  2⤵
  PID:4748
- C:\Windows\System\TxhuVCk.exe
  C:\Windows\System\TxhuVCk.exe
  2⤵
  PID:4784
- C:\Windows\System\LkcfBWp.exe
  C:\Windows\System\LkcfBWp.exe
  2⤵
  PID:5088
- C:\Windows\System\zuqlyuL.exe
  C:\Windows\System\zuqlyuL.exe
  2⤵
  PID:2756
- C:\Windows\System\LHrDNEr.exe
  C:\Windows\System\LHrDNEr.exe
  2⤵
  PID:3384
- C:\Windows\System\GZITksk.exe
  C:\Windows\System\GZITksk.exe
  2⤵
  PID:4892
- C:\Windows\System\goLzcBE.exe
  C:\Windows\System\goLzcBE.exe
  2⤵
  PID:1716
- C:\Windows\System\UOVNNfn.exe
  C:\Windows\System\UOVNNfn.exe
  2⤵
  PID:4928
- C:\Windows\System\BeSbGPx.exe
  C:\Windows\System\BeSbGPx.exe
  2⤵
  PID:4960
- C:\Windows\System\sIHalMe.exe
  C:\Windows\System\sIHalMe.exe
  2⤵
  PID:2640
- C:\Windows\System\ZLWTUDf.exe
  C:\Windows\System\ZLWTUDf.exe
  2⤵
  PID:4804
- C:\Windows\System\DtJahzi.exe
  C:\Windows\System\DtJahzi.exe
  2⤵
  PID:4912
- C:\Windows\System\pAAWxGk.exe
  C:\Windows\System\pAAWxGk.exe
  2⤵
  PID:1292
- C:\Windows\System\KdfVwue.exe
  C:\Windows\System\KdfVwue.exe
  2⤵
  PID:3868
- C:\Windows\System\dCZYOmb.exe
  C:\Windows\System\dCZYOmb.exe
  2⤵
  PID:4124
- C:\Windows\System\mktvryW.exe
  C:\Windows\System\mktvryW.exe
  2⤵
  PID:1244
- C:\Windows\System\jwbaBEx.exe
  C:\Windows\System\jwbaBEx.exe
  2⤵
  PID:4344
- C:\Windows\System\lQFhquf.exe
  C:\Windows\System\lQFhquf.exe
  2⤵
  PID:2644
- C:\Windows\System\xYJyLji.exe
  C:\Windows\System\xYJyLji.exe
  2⤵
  PID:4568
- C:\Windows\System\MoofEYq.exe
  C:\Windows\System\MoofEYq.exe
  2⤵
  PID:4316
- C:\Windows\System\gcwlTra.exe
  C:\Windows\System\gcwlTra.exe
  2⤵
  PID:4756
- C:\Windows\System\PYYvYmx.exe
  C:\Windows\System\PYYvYmx.exe
  2⤵
  PID:4664
- C:\Windows\System\uKCyCfY.exe
  C:\Windows\System\uKCyCfY.exe
  2⤵
  PID:1160
- C:\Windows\System\YmEQPGQ.exe
  C:\Windows\System\YmEQPGQ.exe
  2⤵
  PID:4184
- C:\Windows\System\xFgThFm.exe
  C:\Windows\System\xFgThFm.exe
  2⤵
  PID:3528
- C:\Windows\System\gPiNXld.exe
  C:\Windows\System\gPiNXld.exe
  2⤵
  PID:3704
- C:\Windows\System\JAyzaNr.exe
  C:\Windows\System\JAyzaNr.exe
  2⤵
  PID:4280
- C:\Windows\System\Cfsbqri.exe
  C:\Windows\System\Cfsbqri.exe
  2⤵
  PID:4512
- C:\Windows\System\awZreiZ.exe
  C:\Windows\System\awZreiZ.exe
  2⤵
  PID:4652
- C:\Windows\System\ucOmbyp.exe
  C:\Windows\System\ucOmbyp.exe
  2⤵
  PID:4708
- C:\Windows\System\KNUGsnr.exe
  C:\Windows\System\KNUGsnr.exe
  2⤵
  PID:4832
- C:\Windows\System\UQXHsBK.exe
  C:\Windows\System\UQXHsBK.exe
  2⤵
  PID:2908
- C:\Windows\System\xaOAuGR.exe
  C:\Windows\System\xaOAuGR.exe
  2⤵
  PID:2044
- C:\Windows\System\MMslQTA.exe
  C:\Windows\System\MMslQTA.exe
  2⤵
  PID:2200
- C:\Windows\System\ZUsNEap.exe
  C:\Windows\System\ZUsNEap.exe
  2⤵
  PID:3836
- C:\Windows\System\YPnBHbO.exe
  C:\Windows\System\YPnBHbO.exe
  2⤵
  PID:2872
- C:\Windows\System\frehMPE.exe
  C:\Windows\System\frehMPE.exe
  2⤵
  PID:2324
- C:\Windows\System\SdyCMYm.exe
  C:\Windows\System\SdyCMYm.exe
  2⤵
  PID:4396
- C:\Windows\System\MQSPiSJ.exe
  C:\Windows\System\MQSPiSJ.exe
  2⤵
  PID:3644
- C:\Windows\System\nFRmxKl.exe
  C:\Windows\System\nFRmxKl.exe
  2⤵
  PID:4908
- C:\Windows\System\FcFOLHu.exe
  C:\Windows\System\FcFOLHu.exe
  2⤵
  PID:700
- C:\Windows\System\FKKtVHU.exe
  C:\Windows\System\FKKtVHU.exe
  2⤵
  PID:2152
- C:\Windows\System\pnWgQfv.exe
  C:\Windows\System\pnWgQfv.exe
  2⤵
  PID:1012
- C:\Windows\System\gJtNFOV.exe
  C:\Windows\System\gJtNFOV.exe
  2⤵
  PID:4636
- C:\Windows\System\kELiWxM.exe
  C:\Windows\System\kELiWxM.exe
  2⤵
  PID:3756
- C:\Windows\System\ByZyWrZ.exe
  C:\Windows\System\ByZyWrZ.exe
  2⤵
  PID:4384
- C:\Windows\System\CGcUhNi.exe
  C:\Windows\System\CGcUhNi.exe
  2⤵
  PID:1584
- C:\Windows\System\CPtKrcI.exe
  C:\Windows\System\CPtKrcI.exe
  2⤵
  PID:5040
- C:\Windows\System\ycsUjxX.exe
  C:\Windows\System\ycsUjxX.exe
  2⤵
  PID:5136
- C:\Windows\System\RzqmTrg.exe
  C:\Windows\System\RzqmTrg.exe
  2⤵
  PID:5152
- C:\Windows\System\eVbQPkH.exe
  C:\Windows\System\eVbQPkH.exe
  2⤵
  PID:5168
- C:\Windows\System\ZEvTyIx.exe
  C:\Windows\System\ZEvTyIx.exe
  2⤵
  PID:5184
- C:\Windows\System\HMBoKbw.exe
  C:\Windows\System\HMBoKbw.exe
  2⤵
  PID:5200
- C:\Windows\System\OEDFtif.exe
  C:\Windows\System\OEDFtif.exe
  2⤵
  PID:5216
- C:\Windows\System\ccktKxA.exe
  C:\Windows\System\ccktKxA.exe
  2⤵
  PID:5232
- C:\Windows\System\qdMssVh.exe
  C:\Windows\System\qdMssVh.exe
  2⤵
  PID:5248
- C:\Windows\System\pRdzQcy.exe
  C:\Windows\System\pRdzQcy.exe
  2⤵
  PID:5264
- C:\Windows\System\WVJGGIx.exe
  C:\Windows\System\WVJGGIx.exe
  2⤵
  PID:5280
- C:\Windows\System\ksHvnlS.exe
  C:\Windows\System\ksHvnlS.exe
  2⤵
  PID:5296
- C:\Windows\System\uYupIjq.exe
  C:\Windows\System\uYupIjq.exe
  2⤵
  PID:5312
- C:\Windows\System\MWjJvcf.exe
  C:\Windows\System\MWjJvcf.exe
  2⤵
  PID:5328
- C:\Windows\System\lDxgqZa.exe
  C:\Windows\System\lDxgqZa.exe
  2⤵
  PID:5344
- C:\Windows\System\TxZOMhg.exe
  C:\Windows\System\TxZOMhg.exe
  2⤵
  PID:5360
- C:\Windows\System\VuBCvHA.exe
  C:\Windows\System\VuBCvHA.exe
  2⤵
  PID:5376
- C:\Windows\System\bCFfHrc.exe
  C:\Windows\System\bCFfHrc.exe
  2⤵
  PID:5392
- C:\Windows\System\nmvMRpy.exe
  C:\Windows\System\nmvMRpy.exe
  2⤵
  PID:5408
- C:\Windows\System\zoYumqP.exe
  C:\Windows\System\zoYumqP.exe
  2⤵
  PID:5424
- C:\Windows\System\hmUKiHS.exe
  C:\Windows\System\hmUKiHS.exe
  2⤵
  PID:5440
- C:\Windows\System\yQnZckF.exe
  C:\Windows\System\yQnZckF.exe
  2⤵
  PID:5456
- C:\Windows\System\VsgnNrm.exe
  C:\Windows\System\VsgnNrm.exe
  2⤵
  PID:5472
- C:\Windows\System\SrVVDtu.exe
  C:\Windows\System\SrVVDtu.exe
  2⤵
  PID:5488
- C:\Windows\System\lsxijNN.exe
  C:\Windows\System\lsxijNN.exe
  2⤵
  PID:5504
- C:\Windows\System\CApcBfk.exe
  C:\Windows\System\CApcBfk.exe
  2⤵
  PID:5520
- C:\Windows\System\LEXKdCK.exe
  C:\Windows\System\LEXKdCK.exe
  2⤵
  PID:5536
- C:\Windows\System\PKJyRns.exe
  C:\Windows\System\PKJyRns.exe
  2⤵
  PID:5552
- C:\Windows\System\YDeWhMz.exe
  C:\Windows\System\YDeWhMz.exe
  2⤵
  PID:5568
- C:\Windows\System\KfIwssO.exe
  C:\Windows\System\KfIwssO.exe
  2⤵
  PID:5584
- C:\Windows\System\vpafwnc.exe
  C:\Windows\System\vpafwnc.exe
  2⤵
  PID:5600
- C:\Windows\System\jcbsNKf.exe
  C:\Windows\System\jcbsNKf.exe
  2⤵
  PID:5616
- C:\Windows\System\tStJZzs.exe
  C:\Windows\System\tStJZzs.exe
  2⤵
  PID:5632
- C:\Windows\System\btpSdTn.exe
  C:\Windows\System\btpSdTn.exe
  2⤵
  PID:5648
- C:\Windows\System\lwxtCst.exe
  C:\Windows\System\lwxtCst.exe
  2⤵
  PID:5664
- C:\Windows\System\wrMcubd.exe
  C:\Windows\System\wrMcubd.exe
  2⤵
  PID:5680
- C:\Windows\System\vCbOrZs.exe
  C:\Windows\System\vCbOrZs.exe
  2⤵
  PID:5696
- C:\Windows\System\KgzaDPB.exe
  C:\Windows\System\KgzaDPB.exe
  2⤵
  PID:5712
- C:\Windows\System\HhOgewA.exe
  C:\Windows\System\HhOgewA.exe
  2⤵
  PID:5728
- C:\Windows\System\oaEMDtx.exe
  C:\Windows\System\oaEMDtx.exe
  2⤵
  PID:5744
- C:\Windows\System\dJpRgNx.exe
  C:\Windows\System\dJpRgNx.exe
  2⤵
  PID:5760
- C:\Windows\System\NLuMtdT.exe
  C:\Windows\System\NLuMtdT.exe
  2⤵
  PID:5776
- C:\Windows\System\nhIHLVo.exe
  C:\Windows\System\nhIHLVo.exe
  2⤵
  PID:5792
- C:\Windows\System\VYcPTqx.exe
  C:\Windows\System\VYcPTqx.exe
  2⤵
  PID:5808
- C:\Windows\System\VFiKXMP.exe
  C:\Windows\System\VFiKXMP.exe
  2⤵
  PID:5824
- C:\Windows\System\jWKYvIl.exe
  C:\Windows\System\jWKYvIl.exe
  2⤵
  PID:5840
- C:\Windows\System\wRMBDQn.exe
  C:\Windows\System\wRMBDQn.exe
  2⤵
  PID:5856
- C:\Windows\System\ekENpQZ.exe
  C:\Windows\System\ekENpQZ.exe
  2⤵
  PID:5872
- C:\Windows\System\EbkeajT.exe
  C:\Windows\System\EbkeajT.exe
  2⤵
  PID:5888
- C:\Windows\System\xgktUjp.exe
  C:\Windows\System\xgktUjp.exe
  2⤵
  PID:5904
- C:\Windows\System\QRUSybd.exe
  C:\Windows\System\QRUSybd.exe
  2⤵
  PID:5920
- C:\Windows\System\xwwLbLF.exe
  C:\Windows\System\xwwLbLF.exe
  2⤵
  PID:5936
- C:\Windows\System\VCRQMBJ.exe
  C:\Windows\System\VCRQMBJ.exe
  2⤵
  PID:5952
- C:\Windows\System\OAqHcsD.exe
  C:\Windows\System\OAqHcsD.exe
  2⤵
  PID:5968
- C:\Windows\System\PGAWAaQ.exe
  C:\Windows\System\PGAWAaQ.exe
  2⤵
  PID:5984
- C:\Windows\System\cIaUjwW.exe
  C:\Windows\System\cIaUjwW.exe
  2⤵
  PID:6000
- C:\Windows\System\vaUhPDj.exe
  C:\Windows\System\vaUhPDj.exe
  2⤵
  PID:6016
- C:\Windows\System\xUPxazP.exe
  C:\Windows\System\xUPxazP.exe
  2⤵
  PID:6032
- C:\Windows\System\qBCChYc.exe
  C:\Windows\System\qBCChYc.exe
  2⤵
  PID:6048
- C:\Windows\System\FMPfAmU.exe
  C:\Windows\System\FMPfAmU.exe
  2⤵
  PID:6064
- C:\Windows\System\ScgdcBV.exe
  C:\Windows\System\ScgdcBV.exe
  2⤵
  PID:6080
- C:\Windows\System\kUBADaB.exe
  C:\Windows\System\kUBADaB.exe
  2⤵
  PID:6096
- C:\Windows\System\mmeHrpY.exe
  C:\Windows\System\mmeHrpY.exe
  2⤵
  PID:6112
- C:\Windows\System\bvaNchf.exe
  C:\Windows\System\bvaNchf.exe
  2⤵
  PID:6128
- C:\Windows\System\JcqDpej.exe
  C:\Windows\System\JcqDpej.exe
  2⤵
  PID:4864
- C:\Windows\System\faszUOM.exe
  C:\Windows\System\faszUOM.exe
  2⤵
  PID:3612
- C:\Windows\System\uYjRNbN.exe
  C:\Windows\System\uYjRNbN.exe
  2⤵
  PID:4252
- C:\Windows\System\BsbobUM.exe
  C:\Windows\System\BsbobUM.exe
  2⤵
  PID:4744
- C:\Windows\System\LYtslxw.exe
  C:\Windows\System\LYtslxw.exe
  2⤵
  PID:2332
- C:\Windows\System\VcIzTkp.exe
  C:\Windows\System\VcIzTkp.exe
  2⤵
  PID:4632
- C:\Windows\System\lXzSybB.exe
  C:\Windows\System\lXzSybB.exe
  2⤵
  PID:4728
- C:\Windows\System\jBEPtaj.exe
  C:\Windows\System\jBEPtaj.exe
  2⤵
  PID:3212
- C:\Windows\System\iGbtQOG.exe
  C:\Windows\System\iGbtQOG.exe
  2⤵
  PID:3852
- C:\Windows\System\oWKFkFv.exe
  C:\Windows\System\oWKFkFv.exe
  2⤵
  PID:4156
- C:\Windows\System\bOydZol.exe
  C:\Windows\System\bOydZol.exe
  2⤵
  PID:5132
- C:\Windows\System\ruzEzNk.exe
  C:\Windows\System\ruzEzNk.exe
  2⤵
  PID:5196
- C:\Windows\System\uCuTvBa.exe
  C:\Windows\System\uCuTvBa.exe
  2⤵
  PID:3548
- C:\Windows\System\bzeuTuz.exe
  C:\Windows\System\bzeuTuz.exe
  2⤵
  PID:5244
- C:\Windows\System\zcTxDoS.exe
  C:\Windows\System\zcTxDoS.exe
  2⤵
  PID:5180
- C:\Windows\System\CuhfNqO.exe
  C:\Windows\System\CuhfNqO.exe
  2⤵
  PID:5240
- C:\Windows\System\Vdjvluv.exe
  C:\Windows\System\Vdjvluv.exe
  2⤵
  PID:5308
- C:\Windows\System\gIwDjSe.exe
  C:\Windows\System\gIwDjSe.exe
  2⤵
  PID:5368
- C:\Windows\System\glDQFWZ.exe
  C:\Windows\System\glDQFWZ.exe
  2⤵
  PID:5464
- C:\Windows\System\gokOegV.exe
  C:\Windows\System\gokOegV.exe
  2⤵
  PID:1604
- C:\Windows\System\hHtGTVH.exe
  C:\Windows\System\hHtGTVH.exe
  2⤵
  PID:5532
- C:\Windows\System\YxARRTu.exe
  C:\Windows\System\YxARRTu.exe
  2⤵
  PID:5356
- C:\Windows\System\QXYLZcv.exe
  C:\Windows\System\QXYLZcv.exe
  2⤵
  PID:5560
- C:\Windows\System\qEPByJR.exe
  C:\Windows\System\qEPByJR.exe
  2⤵
  PID:5592
- C:\Windows\System\LXiNwMy.exe
  C:\Windows\System\LXiNwMy.exe
  2⤵
  PID:5628
- C:\Windows\System\CnDAcCZ.exe
  C:\Windows\System\CnDAcCZ.exe
  2⤵
  PID:2508
- C:\Windows\System\PSzBKTH.exe
  C:\Windows\System\PSzBKTH.exe
  2⤵
  PID:5720
- C:\Windows\System\CtpDYkt.exe
  C:\Windows\System\CtpDYkt.exe
  2⤵
  PID:5512
- C:\Windows\System\osapata.exe
  C:\Windows\System\osapata.exe
  2⤵
  PID:5420
- C:\Windows\System\UtRCYMi.exe
  C:\Windows\System\UtRCYMi.exe
  2⤵
  PID:5640
- C:\Windows\System\AxUrXhZ.exe
  C:\Windows\System\AxUrXhZ.exe
  2⤵
  PID:2360
- C:\Windows\System\Cscvtyx.exe
  C:\Windows\System\Cscvtyx.exe
  2⤵
  PID:5544
- C:\Windows\System\FTjsBNZ.exe
  C:\Windows\System\FTjsBNZ.exe
  2⤵
  PID:5608
- C:\Windows\System\VPJIsaW.exe
  C:\Windows\System\VPJIsaW.exe
  2⤵
  PID:5676
- C:\Windows\System\kKfgmek.exe
  C:\Windows\System\kKfgmek.exe
  2⤵
  PID:2768
- C:\Windows\System\EiwCYUQ.exe
  C:\Windows\System\EiwCYUQ.exe
  2⤵
  PID:5772
- C:\Windows\System\QOYYLBI.exe
  C:\Windows\System\QOYYLBI.exe
  2⤵
  PID:5820
- C:\Windows\System\csqcOhw.exe
  C:\Windows\System\csqcOhw.exe
  2⤵
  PID:2388
- C:\Windows\System\AhxZSDW.exe
  C:\Windows\System\AhxZSDW.exe
  2⤵
  PID:5868
- C:\Windows\System\IYuVcju.exe
  C:\Windows\System\IYuVcju.exe
  2⤵
  PID:5884
- C:\Windows\System\XPySgxO.exe
  C:\Windows\System\XPySgxO.exe
  2⤵
  PID:5944
- C:\Windows\System\nyyYWix.exe
  C:\Windows\System\nyyYWix.exe
  2⤵
  PID:6008
- C:\Windows\System\kVBXeVB.exe
  C:\Windows\System\kVBXeVB.exe
  2⤵
  PID:5900
- C:\Windows\System\dVTJCyq.exe
  C:\Windows\System\dVTJCyq.exe
  2⤵
  PID:6056
- C:\Windows\System\igATwMC.exe
  C:\Windows\System\igATwMC.exe
  2⤵
  PID:5964
- C:\Windows\System\scjFast.exe
  C:\Windows\System\scjFast.exe
  2⤵
  PID:6028
- C:\Windows\System\GKSIZYj.exe
  C:\Windows\System\GKSIZYj.exe
  2⤵
  PID:6104
- C:\Windows\System\MMsgtUs.exe
  C:\Windows\System\MMsgtUs.exe
  2⤵
  PID:4296
- C:\Windows\System\otHxhfI.exe
  C:\Windows\System\otHxhfI.exe
  2⤵
  PID:1620
- C:\Windows\System\rbBMdkj.exe
  C:\Windows\System\rbBMdkj.exe
  2⤵
  PID:4236
- C:\Windows\System\iVqxdvi.exe
  C:\Windows\System\iVqxdvi.exe
  2⤵
  PID:1420
- C:\Windows\System\yfVFAqz.exe
  C:\Windows\System\yfVFAqz.exe
  2⤵
  PID:4120
- C:\Windows\System\lWNdAay.exe
  C:\Windows\System\lWNdAay.exe
  2⤵
  PID:1032
- C:\Windows\System\ltHoyrq.exe
  C:\Windows\System\ltHoyrq.exe
  2⤵
  PID:4552
- C:\Windows\System\nGPPKiU.exe
  C:\Windows\System\nGPPKiU.exe
  2⤵
  PID:5192
- C:\Windows\System\FFBbhqH.exe
  C:\Windows\System\FFBbhqH.exe
  2⤵
  PID:5400
- C:\Windows\System\uaQUHVo.exe
  C:\Windows\System\uaQUHVo.exe
  2⤵
  PID:5436
- C:\Windows\System\AiBuuKc.exe
  C:\Windows\System\AiBuuKc.exe
  2⤵
  PID:5416
- C:\Windows\System\NiWyCNa.exe
  C:\Windows\System\NiWyCNa.exe
  2⤵
  PID:5624
- C:\Windows\System\tsSoexX.exe
  C:\Windows\System\tsSoexX.exe
  2⤵
  PID:1884
- C:\Windows\System\qtRLjci.exe
  C:\Windows\System\qtRLjci.exe
  2⤵
  PID:3056
- C:\Windows\System\nYlHzFV.exe
  C:\Windows\System\nYlHzFV.exe
  2⤵
  PID:5324
- C:\Windows\System\jasUnYO.exe
  C:\Windows\System\jasUnYO.exe
  2⤵
  PID:5672
- C:\Windows\System\tVyFPMt.exe
  C:\Windows\System\tVyFPMt.exe
  2⤵
  PID:5516
- C:\Windows\System\wZUIfBh.exe
  C:\Windows\System\wZUIfBh.exe
  2⤵
  PID:3048
- C:\Windows\System\uhSBabl.exe
  C:\Windows\System\uhSBabl.exe
  2⤵
  PID:5580
- C:\Windows\System\mLMzvXW.exe
  C:\Windows\System\mLMzvXW.exe
  2⤵
  PID:5816
- C:\Windows\System\BubxtbV.exe
  C:\Windows\System\BubxtbV.exe
  2⤵
  PID:5864
- C:\Windows\System\vjWnhBE.exe
  C:\Windows\System\vjWnhBE.exe
  2⤵
  PID:6044
- C:\Windows\System\bsRjXSx.exe
  C:\Windows\System\bsRjXSx.exe
  2⤵
  PID:6092
- C:\Windows\System\kxFMxNb.exe
  C:\Windows\System\kxFMxNb.exe
  2⤵
  PID:2148
- C:\Windows\System\nczvsVK.exe
  C:\Windows\System\nczvsVK.exe
  2⤵
  PID:1852
- C:\Windows\System\BqHzzNx.exe
  C:\Windows\System\BqHzzNx.exe
  2⤵
  PID:1572
- C:\Windows\System\lAiWtlZ.exe
  C:\Windows\System\lAiWtlZ.exe
  2⤵
  PID:5164
- C:\Windows\System\DpDmJge.exe
  C:\Windows\System\DpDmJge.exe
  2⤵
  PID:5976
- C:\Windows\System\tkEeNAU.exe
  C:\Windows\System\tkEeNAU.exe
  2⤵
  PID:5996
- C:\Windows\System\QrlfpAs.exe
  C:\Windows\System\QrlfpAs.exe
  2⤵
  PID:1668
- C:\Windows\System\CyyUZRW.exe
  C:\Windows\System\CyyUZRW.exe
  2⤵
  PID:1944
- C:\Windows\System\xceqONY.exe
  C:\Windows\System\xceqONY.exe
  2⤵
  PID:536
- C:\Windows\System\LZlTBmh.exe
  C:\Windows\System\LZlTBmh.exe
  2⤵
  PID:1360
- C:\Windows\System\pSGoufR.exe
  C:\Windows\System\pSGoufR.exe
  2⤵
  PID:1460
- C:\Windows\System\HlOSPNi.exe
  C:\Windows\System\HlOSPNi.exe
  2⤵
  PID:5688
- C:\Windows\System\rBTDdIZ.exe
  C:\Windows\System\rBTDdIZ.exe
  2⤵
  PID:5740
- C:\Windows\System\gLqHoEJ.exe
  C:\Windows\System\gLqHoEJ.exe
  2⤵
  PID:5708
- C:\Windows\System\kilRbWw.exe
  C:\Windows\System\kilRbWw.exe
  2⤵
  PID:5292
- C:\Windows\System\bKhRIuO.exe
  C:\Windows\System\bKhRIuO.exe
  2⤵
  PID:5576
- C:\Windows\System\eVWVizj.exe
  C:\Windows\System\eVWVizj.exe
  2⤵
  PID:5912
- C:\Windows\System\tWQEOFN.exe
  C:\Windows\System\tWQEOFN.exe
  2⤵
  PID:1480
- C:\Windows\System\ERxUTqH.exe
  C:\Windows\System\ERxUTqH.exe
  2⤵
  PID:2164
- C:\Windows\System\nkYXnKP.exe
  C:\Windows\System\nkYXnKP.exe
  2⤵
  PID:6076
- C:\Windows\System\ldymCIh.exe
  C:\Windows\System\ldymCIh.exe
  2⤵
  PID:800
- C:\Windows\System\wrTztSs.exe
  C:\Windows\System\wrTztSs.exe
  2⤵
  PID:6040
- C:\Windows\System\BBpeTxa.exe
  C:\Windows\System\BBpeTxa.exe
  2⤵
  PID:2392
- C:\Windows\System\pzEZbli.exe
  C:\Windows\System\pzEZbli.exe
  2⤵
  PID:6124
- C:\Windows\System\FtKPYCB.exe
  C:\Windows\System\FtKPYCB.exe
  2⤵
  PID:5256
- C:\Windows\System\fpssghP.exe
  C:\Windows\System\fpssghP.exe
  2⤵
  PID:640
- C:\Windows\System\AfJXrOk.exe
  C:\Windows\System\AfJXrOk.exe
  2⤵
  PID:2604
- C:\Windows\System\CDmKQpG.exe
  C:\Windows\System\CDmKQpG.exe
  2⤵
  PID:5340
- C:\Windows\System\pGptffo.exe
  C:\Windows\System\pGptffo.exe
  2⤵
  PID:6152
- C:\Windows\System\EchJbzK.exe
  C:\Windows\System\EchJbzK.exe
  2⤵
  PID:6168
- C:\Windows\System\LfdcypN.exe
  C:\Windows\System\LfdcypN.exe
  2⤵
  PID:6184
- C:\Windows\System\aMsOHMS.exe
  C:\Windows\System\aMsOHMS.exe
  2⤵
  PID:6200
- C:\Windows\System\VRBDTov.exe
  C:\Windows\System\VRBDTov.exe
  2⤵
  PID:6216
- C:\Windows\System\GsqJmxg.exe
  C:\Windows\System\GsqJmxg.exe
  2⤵
  PID:6232
- C:\Windows\System\AJlhNWF.exe
  C:\Windows\System\AJlhNWF.exe
  2⤵
  PID:6248
- C:\Windows\System\bcmCSOE.exe
  C:\Windows\System\bcmCSOE.exe
  2⤵
  PID:6264
- C:\Windows\System\niweOlS.exe
  C:\Windows\System\niweOlS.exe
  2⤵
  PID:6280
- C:\Windows\System\CtTvEDy.exe
  C:\Windows\System\CtTvEDy.exe
  2⤵
  PID:6296
- C:\Windows\System\liBPUcT.exe
  C:\Windows\System\liBPUcT.exe
  2⤵
  PID:6312
- C:\Windows\System\huNvzuz.exe
  C:\Windows\System\huNvzuz.exe
  2⤵
  PID:6328
- C:\Windows\System\MSRARSj.exe
  C:\Windows\System\MSRARSj.exe
  2⤵
  PID:6344
- C:\Windows\System\wJbRSYn.exe
  C:\Windows\System\wJbRSYn.exe
  2⤵
  PID:6360
- C:\Windows\System\ISXAHNL.exe
  C:\Windows\System\ISXAHNL.exe
  2⤵
  PID:6376
- C:\Windows\System\LtxqPhB.exe
  C:\Windows\System\LtxqPhB.exe
  2⤵
  PID:6392
- C:\Windows\System\varYnuM.exe
  C:\Windows\System\varYnuM.exe
  2⤵
  PID:6408
- C:\Windows\System\ninkDql.exe
  C:\Windows\System\ninkDql.exe
  2⤵
  PID:6424
- C:\Windows\System\GnRlhfs.exe
  C:\Windows\System\GnRlhfs.exe
  2⤵
  PID:6440
- C:\Windows\System\wpuriEn.exe
  C:\Windows\System\wpuriEn.exe
  2⤵
  PID:6456
- C:\Windows\System\sOswbkk.exe
  C:\Windows\System\sOswbkk.exe
  2⤵
  PID:6472
- C:\Windows\System\JkoZmEi.exe
  C:\Windows\System\JkoZmEi.exe
  2⤵
  PID:6488
- C:\Windows\System\GuZrFts.exe
  C:\Windows\System\GuZrFts.exe
  2⤵
  PID:6504
- C:\Windows\System\YeFuphe.exe
  C:\Windows\System\YeFuphe.exe
  2⤵
  PID:6520
- C:\Windows\System\TnFJXux.exe
  C:\Windows\System\TnFJXux.exe
  2⤵
  PID:6536
- C:\Windows\System\agjpizO.exe
  C:\Windows\System\agjpizO.exe
  2⤵
  PID:6552
- C:\Windows\System\xYevdGF.exe
  C:\Windows\System\xYevdGF.exe
  2⤵
  PID:6568
- C:\Windows\System\eYyqpFE.exe
  C:\Windows\System\eYyqpFE.exe
  2⤵
  PID:6584
- C:\Windows\System\IJiWZRc.exe
  C:\Windows\System\IJiWZRc.exe
  2⤵
  PID:6600
- C:\Windows\System\xBeEnbQ.exe
  C:\Windows\System\xBeEnbQ.exe
  2⤵
  PID:6616
- C:\Windows\System\PqPWKqy.exe
  C:\Windows\System\PqPWKqy.exe
  2⤵
  PID:6632
- C:\Windows\System\YdASUbQ.exe
  C:\Windows\System\YdASUbQ.exe
  2⤵
  PID:6648
- C:\Windows\System\obnkJal.exe
  C:\Windows\System\obnkJal.exe
  2⤵
  PID:6664
- C:\Windows\System\xQsOWTF.exe
  C:\Windows\System\xQsOWTF.exe
  2⤵
  PID:6680
- C:\Windows\System\xDicIxh.exe
  C:\Windows\System\xDicIxh.exe
  2⤵
  PID:6696
- C:\Windows\System\BLPgJuJ.exe
  C:\Windows\System\BLPgJuJ.exe
  2⤵
  PID:6712
- C:\Windows\System\THnzyBk.exe
  C:\Windows\System\THnzyBk.exe
  2⤵
  PID:6728
- C:\Windows\System\DsJWAlz.exe
  C:\Windows\System\DsJWAlz.exe
  2⤵
  PID:6744
- C:\Windows\System\ZSQmbdw.exe
  C:\Windows\System\ZSQmbdw.exe
  2⤵
  PID:6760
- C:\Windows\System\YoCWphN.exe
  C:\Windows\System\YoCWphN.exe
  2⤵
  PID:6776
- C:\Windows\System\ZBifhkw.exe
  C:\Windows\System\ZBifhkw.exe
  2⤵
  PID:6792
- C:\Windows\System\QGiUqYY.exe
  C:\Windows\System\QGiUqYY.exe
  2⤵
  PID:6808
- C:\Windows\System\ElDfEKf.exe
  C:\Windows\System\ElDfEKf.exe
  2⤵
  PID:6824
- C:\Windows\System\tCzmdpU.exe
  C:\Windows\System\tCzmdpU.exe
  2⤵
  PID:6844
- C:\Windows\System\LhCBnHV.exe
  C:\Windows\System\LhCBnHV.exe
  2⤵
  PID:6860
- C:\Windows\System\WVzhyeG.exe
  C:\Windows\System\WVzhyeG.exe
  2⤵
  PID:6876
- C:\Windows\System\OIyikta.exe
  C:\Windows\System\OIyikta.exe
  2⤵
  PID:6892
- C:\Windows\System\ovofyTj.exe
  C:\Windows\System\ovofyTj.exe
  2⤵
  PID:6908
- C:\Windows\System\VvOoCtC.exe
  C:\Windows\System\VvOoCtC.exe
  2⤵
  PID:6924
- C:\Windows\System\RuIgARA.exe
  C:\Windows\System\RuIgARA.exe
  2⤵
  PID:6944
- C:\Windows\System\JycCIWb.exe
  C:\Windows\System\JycCIWb.exe
  2⤵
  PID:6960
- C:\Windows\System\iSMKhst.exe
  C:\Windows\System\iSMKhst.exe
  2⤵
  PID:6976
- C:\Windows\System\VnpyRAj.exe
  C:\Windows\System\VnpyRAj.exe
  2⤵
  PID:6992
- C:\Windows\System\tuMZhFW.exe
  C:\Windows\System\tuMZhFW.exe
  2⤵
  PID:7008
- C:\Windows\System\iusUdNL.exe
  C:\Windows\System\iusUdNL.exe
  2⤵
  PID:7024
- C:\Windows\System\XfMUnJi.exe
  C:\Windows\System\XfMUnJi.exe
  2⤵
  PID:7040
- C:\Windows\System\GaBaDUI.exe
  C:\Windows\System\GaBaDUI.exe
  2⤵
  PID:7056
- C:\Windows\System\jsSpkzv.exe
  C:\Windows\System\jsSpkzv.exe
  2⤵
  PID:7072
- C:\Windows\System\VFMmTRT.exe
  C:\Windows\System\VFMmTRT.exe
  2⤵
  PID:7088
- C:\Windows\System\OETlIQZ.exe
  C:\Windows\System\OETlIQZ.exe
  2⤵
  PID:7104
- C:\Windows\System\KUlXDDE.exe
  C:\Windows\System\KUlXDDE.exe
  2⤵
  PID:7120
- C:\Windows\System\rbbYUzv.exe
  C:\Windows\System\rbbYUzv.exe
  2⤵
  PID:7136
- C:\Windows\System\PsBrvbP.exe
  C:\Windows\System\PsBrvbP.exe
  2⤵
  PID:7152
- C:\Windows\System\xEpNYjD.exe
  C:\Windows\System\xEpNYjD.exe
  2⤵
  PID:4680
- C:\Windows\System\InupXMZ.exe
  C:\Windows\System\InupXMZ.exe
  2⤵
  PID:5832
- C:\Windows\System\cqXwxkA.exe
  C:\Windows\System\cqXwxkA.exe
  2⤵
  PID:6192
- C:\Windows\System\EqRnuIu.exe
  C:\Windows\System\EqRnuIu.exe
  2⤵
  PID:6256
- C:\Windows\System\YLWFKRD.exe
  C:\Windows\System\YLWFKRD.exe
  2⤵
  PID:6212
- C:\Windows\System\GpCODzI.exe
  C:\Windows\System\GpCODzI.exe
  2⤵
  PID:1568
- C:\Windows\System\etKnDSA.exe
  C:\Windows\System\etKnDSA.exe
  2⤵
  PID:6260
- C:\Windows\System\OPpzhaH.exe
  C:\Windows\System\OPpzhaH.exe
  2⤵
  PID:6308
- C:\Windows\System\VHpTDWU.exe
  C:\Windows\System\VHpTDWU.exe
  2⤵
  PID:6368
- C:\Windows\System\UKTMFYN.exe
  C:\Windows\System\UKTMFYN.exe
  2⤵
  PID:6432
- C:\Windows\System\nIvpnCS.exe
  C:\Windows\System\nIvpnCS.exe
  2⤵
  PID:6468
- C:\Windows\System\qNpetkA.exe
  C:\Windows\System\qNpetkA.exe
  2⤵
  PID:6356
- C:\Windows\System\vDFKLdR.exe
  C:\Windows\System\vDFKLdR.exe
  2⤵
  PID:6388
- C:\Windows\System\uOmhktO.exe
  C:\Windows\System\uOmhktO.exe
  2⤵
  PID:6516
- C:\Windows\System\WkBEmjI.exe
  C:\Windows\System\WkBEmjI.exe
  2⤵
  PID:6596
- C:\Windows\System\ZbXtuAi.exe
  C:\Windows\System\ZbXtuAi.exe
  2⤵
  PID:6420
- C:\Windows\System\mAsutlh.exe
  C:\Windows\System\mAsutlh.exe
  2⤵
  PID:6576
- C:\Windows\System\tAsYJNw.exe
  C:\Windows\System\tAsYJNw.exe
  2⤵
  PID:6484
- C:\Windows\System\slyTAZa.exe
  C:\Windows\System\slyTAZa.exe
  2⤵
  PID:6692
- C:\Windows\System\qzfQlAj.exe
  C:\Windows\System\qzfQlAj.exe
  2⤵
  PID:6756
- C:\Windows\System\nthWtyI.exe
  C:\Windows\System\nthWtyI.exe
  2⤵
  PID:6784
- C:\Windows\System\RupGJDD.exe
  C:\Windows\System\RupGJDD.exe
  2⤵
  PID:6644
- C:\Windows\System\WhRufdC.exe
  C:\Windows\System\WhRufdC.exe
  2⤵
  PID:6704
- C:\Windows\System\ZqzPdnX.exe
  C:\Windows\System\ZqzPdnX.exe
  2⤵
  PID:6772
- C:\Windows\System\PfpVdgN.exe
  C:\Windows\System\PfpVdgN.exe
  2⤵
  PID:6852
- C:\Windows\System\TrKCbaF.exe
  C:\Windows\System\TrKCbaF.exe
  2⤵
  PID:6840
- C:\Windows\System\PfkroKJ.exe
  C:\Windows\System\PfkroKJ.exe
  2⤵
  PID:6920
- C:\Windows\System\KgieQbM.exe
  C:\Windows\System\KgieQbM.exe
  2⤵
  PID:6988
- C:\Windows\System\hTfKxmj.exe
  C:\Windows\System\hTfKxmj.exe
  2⤵
  PID:7052
- C:\Windows\System\BkmBtUZ.exe
  C:\Windows\System\BkmBtUZ.exe
  2⤵
  PID:7036
- C:\Windows\System\QztlfVA.exe
  C:\Windows\System\QztlfVA.exe
  2⤵
  PID:6940
- C:\Windows\System\TGDonFf.exe
  C:\Windows\System\TGDonFf.exe
  2⤵
  PID:7004
- C:\Windows\System\ETFBBPw.exe
  C:\Windows\System\ETFBBPw.exe
  2⤵
  PID:7112
- C:\Windows\System\spVXwNl.exe
  C:\Windows\System\spVXwNl.exe
  2⤵
  PID:6160
- C:\Windows\System\hGrPYwn.exe
  C:\Windows\System\hGrPYwn.exe
  2⤵
  PID:6228
- C:\Windows\System\lplEUko.exe
  C:\Windows\System\lplEUko.exe
  2⤵
  PID:6304
- C:\Windows\System\zCRpBUv.exe
  C:\Windows\System\zCRpBUv.exe
  2⤵
  PID:6164
- C:\Windows\System\WczudCg.exe
  C:\Windows\System\WczudCg.exe
  2⤵
  PID:6384
- C:\Windows\System\IiiPzYe.exe
  C:\Windows\System\IiiPzYe.exe
  2⤵
  PID:7132
- C:\Windows\System\Yhjxekq.exe
  C:\Windows\System\Yhjxekq.exe
  2⤵
  PID:5564
- C:\Windows\System\euwcGZG.exe
  C:\Windows\System\euwcGZG.exe
  2⤵
  PID:6324
- C:\Windows\System\WTFywvz.exe
  C:\Windows\System\WTFywvz.exe
  2⤵
  PID:6464
- C:\Windows\System\CvifRxD.exe
  C:\Windows\System\CvifRxD.exe
  2⤵
  PID:6272
- C:\Windows\System\PhNYjTy.exe
  C:\Windows\System\PhNYjTy.exe
  2⤵
  PID:6592
- C:\Windows\System\ZhNFArt.exe
  C:\Windows\System\ZhNFArt.exe
  2⤵
  PID:6580
- C:\Windows\System\xobwTnu.exe
  C:\Windows\System\xobwTnu.exe
  2⤵
  PID:6640
- C:\Windows\System\TvkeHFr.exe
  C:\Windows\System\TvkeHFr.exe
  2⤵
  PID:6676
- C:\Windows\System\yBHcVBy.exe
  C:\Windows\System\yBHcVBy.exe
  2⤵
  PID:6836
- C:\Windows\System\UfcjSBx.exe
  C:\Windows\System\UfcjSBx.exe
  2⤵
  PID:7032
- C:\Windows\System\NahMGmA.exe
  C:\Windows\System\NahMGmA.exe
  2⤵
  PID:7144
- C:\Windows\System\qEkKKEb.exe
  C:\Windows\System\qEkKKEb.exe
  2⤵
  PID:7020
- C:\Windows\System\PxKmlrO.exe
  C:\Windows\System\PxKmlrO.exe
  2⤵
  PID:7148
- C:\Windows\System\eWgbFvT.exe
  C:\Windows\System\eWgbFvT.exe
  2⤵
  PID:6208
- C:\Windows\System\AIBNzpG.exe
  C:\Windows\System\AIBNzpG.exe
  2⤵
  PID:6416
- C:\Windows\System\wHLxwoV.exe
  C:\Windows\System\wHLxwoV.exe
  2⤵
  PID:4696
- C:\Windows\System\sMxkUNF.exe
  C:\Windows\System\sMxkUNF.exe
  2⤵
  PID:6548
- C:\Windows\System\JHfULDS.exe
  C:\Windows\System\JHfULDS.exe
  2⤵
  PID:6176
- C:\Windows\System\JQypIcd.exe
  C:\Windows\System\JQypIcd.exe
  2⤵
  PID:6820
- C:\Windows\System\CZJvBpU.exe
  C:\Windows\System\CZJvBpU.exe
  2⤵
  PID:6972
- C:\Windows\System\jqxIUkF.exe
  C:\Windows\System\jqxIUkF.exe
  2⤵
  PID:7080
- C:\Windows\System\cBbNTQi.exe
  C:\Windows\System\cBbNTQi.exe
  2⤵
  PID:7160
- C:\Windows\System\rSmMALC.exe
  C:\Windows\System\rSmMALC.exe
  2⤵
  PID:7100
- C:\Windows\System\RAWvrNU.exe
  C:\Windows\System\RAWvrNU.exe
  2⤵
  PID:6148
- C:\Windows\System\XApYRPt.exe
  C:\Windows\System\XApYRPt.exe
  2⤵
  PID:6768
- C:\Windows\System\NDfQQQm.exe
  C:\Windows\System\NDfQQQm.exe
  2⤵
  PID:6612
- C:\Windows\System\dqiEYdI.exe
  C:\Windows\System\dqiEYdI.exe
  2⤵
  PID:7172
- C:\Windows\System\AHuwIzI.exe
  C:\Windows\System\AHuwIzI.exe
  2⤵
  PID:7188
- C:\Windows\System\wPMdeYx.exe
  C:\Windows\System\wPMdeYx.exe
  2⤵
  PID:7204
- C:\Windows\System\Khdgbjz.exe
  C:\Windows\System\Khdgbjz.exe
  2⤵
  PID:7220
- C:\Windows\System\fdRipHn.exe
  C:\Windows\System\fdRipHn.exe
  2⤵
  PID:7236
- C:\Windows\System\QMFPZnB.exe
  C:\Windows\System\QMFPZnB.exe
  2⤵
  PID:7252
- C:\Windows\System\sQiPnPF.exe
  C:\Windows\System\sQiPnPF.exe
  2⤵
  PID:7268
- C:\Windows\System\GfPyTtN.exe
  C:\Windows\System\GfPyTtN.exe
  2⤵
  PID:7284
- C:\Windows\System\bCGQFbV.exe
  C:\Windows\System\bCGQFbV.exe
  2⤵
  PID:7300
- C:\Windows\System\DryFRSA.exe
  C:\Windows\System\DryFRSA.exe
  2⤵
  PID:7316
- C:\Windows\System\ehYTaby.exe
  C:\Windows\System\ehYTaby.exe
  2⤵
  PID:7332
- C:\Windows\System\sUOpcCl.exe
  C:\Windows\System\sUOpcCl.exe
  2⤵
  PID:7352
- C:\Windows\System\wecuIiY.exe
  C:\Windows\System\wecuIiY.exe
  2⤵
  PID:7368
- C:\Windows\System\mdujrqP.exe
  C:\Windows\System\mdujrqP.exe
  2⤵
  PID:7384
- C:\Windows\System\FIdBYpA.exe
  C:\Windows\System\FIdBYpA.exe
  2⤵
  PID:7400
- C:\Windows\System\mkauDoJ.exe
  C:\Windows\System\mkauDoJ.exe
  2⤵
  PID:7416
- C:\Windows\System\GdIzwEV.exe
  C:\Windows\System\GdIzwEV.exe
  2⤵
  PID:7432
- C:\Windows\System\JnTjDwq.exe
  C:\Windows\System\JnTjDwq.exe
  2⤵
  PID:7448
- C:\Windows\System\EYdtyMc.exe
  C:\Windows\System\EYdtyMc.exe
  2⤵
  PID:7464
- C:\Windows\System\GJKqhKs.exe
  C:\Windows\System\GJKqhKs.exe
  2⤵
  PID:7480
- C:\Windows\System\SRMtqkq.exe
  C:\Windows\System\SRMtqkq.exe
  2⤵
  PID:7496
- C:\Windows\System\GLqNBGX.exe
  C:\Windows\System\GLqNBGX.exe
  2⤵
  PID:7512
- C:\Windows\System\NxCMUXW.exe
  C:\Windows\System\NxCMUXW.exe
  2⤵
  PID:7528
- C:\Windows\System\QqTuxyO.exe
  C:\Windows\System\QqTuxyO.exe
  2⤵
  PID:7544
- C:\Windows\System\gUXigSu.exe
  C:\Windows\System\gUXigSu.exe
  2⤵
  PID:7560
- C:\Windows\System\XGuZUTG.exe
  C:\Windows\System\XGuZUTG.exe
  2⤵
  PID:7576
- C:\Windows\System\lWhcztd.exe
  C:\Windows\System\lWhcztd.exe
  2⤵
  PID:7592
- C:\Windows\System\pCOCHyo.exe
  C:\Windows\System\pCOCHyo.exe
  2⤵
  PID:7608
- C:\Windows\System\TjTtXMp.exe
  C:\Windows\System\TjTtXMp.exe
  2⤵
  PID:7624
- C:\Windows\System\BWPhKfh.exe
  C:\Windows\System\BWPhKfh.exe
  2⤵
  PID:7640
- C:\Windows\System\HdMDyBO.exe
  C:\Windows\System\HdMDyBO.exe
  2⤵
  PID:7660
- C:\Windows\System\yTQffLt.exe
  C:\Windows\System\yTQffLt.exe
  2⤵
  PID:7680
- C:\Windows\System\rBfFngm.exe
  C:\Windows\System\rBfFngm.exe
  2⤵
  PID:7696
- C:\Windows\System\JbftxHJ.exe
  C:\Windows\System\JbftxHJ.exe
  2⤵
  PID:7712
- C:\Windows\System\PAkXgfb.exe
  C:\Windows\System\PAkXgfb.exe
  2⤵
  PID:7728
- C:\Windows\System\dxlHjnV.exe
  C:\Windows\System\dxlHjnV.exe
  2⤵
  PID:7744
- C:\Windows\System\pGEuSKj.exe
  C:\Windows\System\pGEuSKj.exe
  2⤵
  PID:7764
- C:\Windows\System\zinjjXB.exe
  C:\Windows\System\zinjjXB.exe
  2⤵
  PID:7784
- C:\Windows\System\wQihLXD.exe
  C:\Windows\System\wQihLXD.exe
  2⤵
  PID:7800
- C:\Windows\System\ZBJVfQU.exe
  C:\Windows\System\ZBJVfQU.exe
  2⤵
  PID:7816
- C:\Windows\System\wDaPgOM.exe
  C:\Windows\System\wDaPgOM.exe
  2⤵
  PID:7832
- C:\Windows\System\pUHzNgR.exe
  C:\Windows\System\pUHzNgR.exe
  2⤵
  PID:7848
- C:\Windows\System\jGqFawH.exe
  C:\Windows\System\jGqFawH.exe
  2⤵
  PID:7864
- C:\Windows\System\BEklATF.exe
  C:\Windows\System\BEklATF.exe
  2⤵
  PID:7884
- C:\Windows\System\kUdbRBB.exe
  C:\Windows\System\kUdbRBB.exe
  2⤵
  PID:7900
- C:\Windows\System\HPBCfMu.exe
  C:\Windows\System\HPBCfMu.exe
  2⤵
  PID:7916
- C:\Windows\System\zeqUQni.exe
  C:\Windows\System\zeqUQni.exe
  2⤵
  PID:7932
- C:\Windows\System\VcsyKuB.exe
  C:\Windows\System\VcsyKuB.exe
  2⤵
  PID:7948
- C:\Windows\System\WfiPvaD.exe
  C:\Windows\System\WfiPvaD.exe
  2⤵
  PID:7964
- C:\Windows\System\bbhYudo.exe
  C:\Windows\System\bbhYudo.exe
  2⤵
  PID:7980
- C:\Windows\System\YAPcBfL.exe
  C:\Windows\System\YAPcBfL.exe
  2⤵
  PID:7996
- C:\Windows\System\tViBCQR.exe
  C:\Windows\System\tViBCQR.exe
  2⤵
  PID:8012
- C:\Windows\System\HRCQCNj.exe
  C:\Windows\System\HRCQCNj.exe
  2⤵
  PID:8028
- C:\Windows\System\lqKQsao.exe
  C:\Windows\System\lqKQsao.exe
  2⤵
  PID:8044
- C:\Windows\System\ZhHpVvH.exe
  C:\Windows\System\ZhHpVvH.exe
  2⤵
  PID:8060
- C:\Windows\System\FMVrGlj.exe
  C:\Windows\System\FMVrGlj.exe
  2⤵
  PID:8076
- C:\Windows\System\VwCmtQT.exe
  C:\Windows\System\VwCmtQT.exe
  2⤵
  PID:8092
- C:\Windows\System\cGiycEx.exe
  C:\Windows\System\cGiycEx.exe
  2⤵
  PID:8108
- C:\Windows\System\rNNumko.exe
  C:\Windows\System\rNNumko.exe
  2⤵
  PID:8124
- C:\Windows\System\talGkvD.exe
  C:\Windows\System\talGkvD.exe
  2⤵
  PID:8140
- C:\Windows\System\oBnqHQo.exe
  C:\Windows\System\oBnqHQo.exe
  2⤵
  PID:8156
- C:\Windows\System\FGPkTzi.exe
  C:\Windows\System\FGPkTzi.exe
  2⤵
  PID:8172
- C:\Windows\System\yfzxqsS.exe
  C:\Windows\System\yfzxqsS.exe
  2⤵
  PID:8188
- C:\Windows\System\YYJtYSN.exe
  C:\Windows\System\YYJtYSN.exe
  2⤵
  PID:6404
- C:\Windows\System\NCNlctf.exe
  C:\Windows\System\NCNlctf.exe
  2⤵
  PID:7084
- C:\Windows\System\gYmEWjz.exe
  C:\Windows\System\gYmEWjz.exe
  2⤵
  PID:7200
- C:\Windows\System\BVqpiOm.exe
  C:\Windows\System\BVqpiOm.exe
  2⤵
  PID:7232
- C:\Windows\System\UcWxeUS.exe
  C:\Windows\System\UcWxeUS.exe
  2⤵
  PID:7296
- C:\Windows\System\McIyKtC.exe
  C:\Windows\System\McIyKtC.exe
  2⤵
  PID:7360
- C:\Windows\System\EgjjeYC.exe
  C:\Windows\System\EgjjeYC.exe
  2⤵
  PID:7456
- C:\Windows\System\eREzbRi.exe
  C:\Windows\System\eREzbRi.exe
  2⤵
  PID:7520
- C:\Windows\System\UloxQQo.exe
  C:\Windows\System\UloxQQo.exe
  2⤵
  PID:7340
- C:\Windows\System\cdLLBmB.exe
  C:\Windows\System\cdLLBmB.exe
  2⤵
  PID:7556
- C:\Windows\System\QqNBxcC.exe
  C:\Windows\System\QqNBxcC.exe
  2⤵
  PID:7312
- C:\Windows\System\vbqvzim.exe
  C:\Windows\System\vbqvzim.exe
  2⤵
  PID:7408
- C:\Windows\System\yAktgJt.exe
  C:\Windows\System\yAktgJt.exe
  2⤵
  PID:7476
- C:\Windows\System\PBTcPQd.exe
  C:\Windows\System\PBTcPQd.exe
  2⤵
  PID:7568
- C:\Windows\System\YzebcNu.exe
  C:\Windows\System\YzebcNu.exe
  2⤵
  PID:7616
- C:\Windows\System\qVIvYvI.exe
  C:\Windows\System\qVIvYvI.exe
  2⤵
  PID:7600
- C:\Windows\System\ouDnpnL.exe
  C:\Windows\System\ouDnpnL.exe
  2⤵
  PID:7692
- C:\Windows\System\FanhDyC.exe
  C:\Windows\System\FanhDyC.exe
  2⤵
  PID:7760
- C:\Windows\System\GBwgMCt.exe
  C:\Windows\System\GBwgMCt.exe
  2⤵
  PID:7824
- C:\Windows\System\EmGBbXp.exe
  C:\Windows\System\EmGBbXp.exe
  2⤵
  PID:7704
- C:\Windows\System\agMiIsb.exe
  C:\Windows\System\agMiIsb.exe
  2⤵
  PID:7776
- C:\Windows\System\XYwoxer.exe
  C:\Windows\System\XYwoxer.exe
  2⤵
  PID:7828
- C:\Windows\System\QvqzeCp.exe
  C:\Windows\System\QvqzeCp.exe
  2⤵
  PID:7860
- C:\Windows\System\lLnlwsH.exe
  C:\Windows\System\lLnlwsH.exe
  2⤵
  PID:7880
- C:\Windows\System\TKJiQAc.exe
  C:\Windows\System\TKJiQAc.exe
  2⤵
  PID:7912
- C:\Windows\System\IvnMZNI.exe
  C:\Windows\System\IvnMZNI.exe
  2⤵
  PID:7988
- C:\Windows\System\sJmcuZG.exe
  C:\Windows\System\sJmcuZG.exe
  2⤵
  PID:7976
- C:\Windows\System\qGrZbhn.exe
  C:\Windows\System\qGrZbhn.exe
  2⤵
  PID:8008
- C:\Windows\System\tInvHzZ.exe
  C:\Windows\System\tInvHzZ.exe
  2⤵
  PID:8036
- C:\Windows\System\gNBNjWI.exe
  C:\Windows\System\gNBNjWI.exe
  2⤵
  PID:8116
- C:\Windows\System\gTEIOpA.exe
  C:\Windows\System\gTEIOpA.exe
  2⤵
  PID:8180
- C:\Windows\System\atKzIbR.exe
  C:\Windows\System\atKzIbR.exe
  2⤵
  PID:8136
- C:\Windows\System\yZfHuWz.exe
  C:\Windows\System\yZfHuWz.exe
  2⤵
  PID:6916
- C:\Windows\System\revSViI.exe
  C:\Windows\System\revSViI.exe
  2⤵
  PID:7196
- C:\Windows\System\FIAkUoK.exe
  C:\Windows\System\FIAkUoK.exe
  2⤵
  PID:7228
- C:\Windows\System\EhGFQGw.exe
  C:\Windows\System\EhGFQGw.exe
  2⤵
  PID:7492
- C:\Windows\System\YryJLoa.exe
  C:\Windows\System\YryJLoa.exe
  2⤵
  PID:7376
- C:\Windows\System\oCqqpit.exe
  C:\Windows\System\oCqqpit.exe
  2⤵
  PID:7524
- C:\Windows\System\IHPGXJB.exe
  C:\Windows\System\IHPGXJB.exe
  2⤵
  PID:7652
- C:\Windows\System\ILnmKpQ.exe
  C:\Windows\System\ILnmKpQ.exe
  2⤵
  PID:7584
- C:\Windows\System\bSCJoHD.exe
  C:\Windows\System\bSCJoHD.exe
  2⤵
  PID:7588
- C:\Windows\System\cIznEch.exe
  C:\Windows\System\cIznEch.exe
  2⤵
  PID:7740
- C:\Windows\System\QVATYtG.exe
  C:\Windows\System\QVATYtG.exe
  2⤵
  PID:8040
- C:\Windows\System\uRJcaNh.exe
  C:\Windows\System\uRJcaNh.exe
  2⤵
  PID:7424
- C:\Windows\System\casFvQJ.exe
  C:\Windows\System\casFvQJ.exe
  2⤵
  PID:7648
- C:\Windows\System\KzVUoUY.exe
  C:\Windows\System\KzVUoUY.exe
  2⤵
  PID:7972
- C:\Windows\System\EctEIKG.exe
  C:\Windows\System\EctEIKG.exe
  2⤵
  PID:7792
- C:\Windows\System\fiVvJqo.exe
  C:\Windows\System\fiVvJqo.exe
  2⤵
  PID:8052
- C:\Windows\System\onnXmPx.exe
  C:\Windows\System\onnXmPx.exe
  2⤵
  PID:7440
- C:\Windows\System\CKycwuz.exe
  C:\Windows\System\CKycwuz.exe
  2⤵
  PID:7244
- C:\Windows\System\NMErlnd.exe
  C:\Windows\System\NMErlnd.exe
  2⤵
  PID:7908
- C:\Windows\System\fOkuyCl.exe
  C:\Windows\System\fOkuyCl.exe
  2⤵
  PID:7856
- C:\Windows\System\dIMkOWB.exe
  C:\Windows\System\dIMkOWB.exe
  2⤵
  PID:2844
- C:\Windows\System\HyEfweM.exe
  C:\Windows\System\HyEfweM.exe
  2⤵
  PID:2776
- C:\Windows\System\sbjJodp.exe
  C:\Windows\System\sbjJodp.exe
  2⤵
  PID:7992
- C:\Windows\System\TpSLFHw.exe
  C:\Windows\System\TpSLFHw.exe
  2⤵
  PID:7812
- C:\Windows\System\DAbgyvB.exe
  C:\Windows\System\DAbgyvB.exe
  2⤵
  PID:7956
- C:\Windows\System\AKuZuzJ.exe
  C:\Windows\System\AKuZuzJ.exe
  2⤵
  PID:7960
- C:\Windows\System\rLoBSep.exe
  C:\Windows\System\rLoBSep.exe
  2⤵
  PID:8196
- C:\Windows\System\BxlFfmM.exe
  C:\Windows\System\BxlFfmM.exe
  2⤵
  PID:8212
- C:\Windows\System\naQTnmP.exe
  C:\Windows\System\naQTnmP.exe
  2⤵
  PID:8228
- C:\Windows\System\KDaxkaM.exe
  C:\Windows\System\KDaxkaM.exe
  2⤵
  PID:8244
- C:\Windows\System\XNIgbRJ.exe
  C:\Windows\System\XNIgbRJ.exe
  2⤵
  PID:8260
- C:\Windows\System\uuujELC.exe
  C:\Windows\System\uuujELC.exe
  2⤵
  PID:8276
- C:\Windows\System\ZyRtsHu.exe
  C:\Windows\System\ZyRtsHu.exe
  2⤵
  PID:8292
- C:\Windows\System\mknVZpE.exe
  C:\Windows\System\mknVZpE.exe
  2⤵
  PID:8308
- C:\Windows\System\wNwiusa.exe
  C:\Windows\System\wNwiusa.exe
  2⤵
  PID:8324
- C:\Windows\System\VJDkWNf.exe
  C:\Windows\System\VJDkWNf.exe
  2⤵
  PID:8340
- C:\Windows\System\fefBvJA.exe
  C:\Windows\System\fefBvJA.exe
  2⤵
  PID:8356
- C:\Windows\System\FypHoJL.exe
  C:\Windows\System\FypHoJL.exe
  2⤵
  PID:8372
- C:\Windows\System\bqtMcwF.exe
  C:\Windows\System\bqtMcwF.exe
  2⤵
  PID:8388
- C:\Windows\System\gFTsZWu.exe
  C:\Windows\System\gFTsZWu.exe
  2⤵
  PID:8404
- C:\Windows\System\tJQaRLT.exe
  C:\Windows\System\tJQaRLT.exe
  2⤵
  PID:8420
- C:\Windows\System\ARDshYn.exe
  C:\Windows\System\ARDshYn.exe
  2⤵
  PID:8436
- C:\Windows\System\VstFjsK.exe
  C:\Windows\System\VstFjsK.exe
  2⤵
  PID:8452
- C:\Windows\System\XLkxJBy.exe
  C:\Windows\System\XLkxJBy.exe
  2⤵
  PID:8468
- C:\Windows\System\MVDGWpM.exe
  C:\Windows\System\MVDGWpM.exe
  2⤵
  PID:8484
- C:\Windows\System\dwjPYIK.exe
  C:\Windows\System\dwjPYIK.exe
  2⤵
  PID:8500
- C:\Windows\System\hcpTpcK.exe
  C:\Windows\System\hcpTpcK.exe
  2⤵
  PID:8516
- C:\Windows\System\HxYFWwM.exe
  C:\Windows\System\HxYFWwM.exe
  2⤵
  PID:8532
- C:\Windows\System\tuvwXSa.exe
  C:\Windows\System\tuvwXSa.exe
  2⤵
  PID:8548
- C:\Windows\System\OCBOGkJ.exe
  C:\Windows\System\OCBOGkJ.exe
  2⤵
  PID:8564
- C:\Windows\System\PXbRolI.exe
  C:\Windows\System\PXbRolI.exe
  2⤵
  PID:8580
- C:\Windows\System\qyWvMHM.exe
  C:\Windows\System\qyWvMHM.exe
  2⤵
  PID:8596
- C:\Windows\System\VrOnpXh.exe
  C:\Windows\System\VrOnpXh.exe
  2⤵
  PID:8612
- C:\Windows\System\VjVUxST.exe
  C:\Windows\System\VjVUxST.exe
  2⤵
  PID:8628
- C:\Windows\System\EhNUYGw.exe
  C:\Windows\System\EhNUYGw.exe
  2⤵
  PID:8644
- C:\Windows\System\NOszDys.exe
  C:\Windows\System\NOszDys.exe
  2⤵
  PID:8660
- C:\Windows\System\olGkMqK.exe
  C:\Windows\System\olGkMqK.exe
  2⤵
  PID:8676
- C:\Windows\System\GYelKQH.exe
  C:\Windows\System\GYelKQH.exe
  2⤵
  PID:8692
- C:\Windows\System\dHaMXpe.exe
  C:\Windows\System\dHaMXpe.exe
  2⤵
  PID:8708
- C:\Windows\System\ZTIgKuy.exe
  C:\Windows\System\ZTIgKuy.exe
  2⤵
  PID:8724
- C:\Windows\System\QXEdVVQ.exe
  C:\Windows\System\QXEdVVQ.exe
  2⤵
  PID:8740
- C:\Windows\System\yKZVlNC.exe
  C:\Windows\System\yKZVlNC.exe
  2⤵
  PID:8756
- C:\Windows\System\JVUpuyg.exe
  C:\Windows\System\JVUpuyg.exe
  2⤵
  PID:8772
- C:\Windows\System\KoJrTLT.exe
  C:\Windows\System\KoJrTLT.exe
  2⤵
  PID:8788
- C:\Windows\System\EcGWolC.exe
  C:\Windows\System\EcGWolC.exe
  2⤵
  PID:8804
- C:\Windows\System\qRjtQID.exe
  C:\Windows\System\qRjtQID.exe
  2⤵
  PID:8820
- C:\Windows\System\RIucdjG.exe
  C:\Windows\System\RIucdjG.exe
  2⤵
  PID:8836
- C:\Windows\System\zouBooe.exe
  C:\Windows\System\zouBooe.exe
  2⤵
  PID:8852
- C:\Windows\System\ChoUxDl.exe
  C:\Windows\System\ChoUxDl.exe
  2⤵
  PID:8868
- C:\Windows\System\vXFfOlK.exe
  C:\Windows\System\vXFfOlK.exe
  2⤵
  PID:8888
- C:\Windows\System\AOVjqbv.exe
  C:\Windows\System\AOVjqbv.exe
  2⤵
  PID:8904
- C:\Windows\System\wddrHYj.exe
  C:\Windows\System\wddrHYj.exe
  2⤵
  PID:8920
- C:\Windows\System\uxGjJBD.exe
  C:\Windows\System\uxGjJBD.exe
  2⤵
  PID:8936
- C:\Windows\System\HXXCwGQ.exe
  C:\Windows\System\HXXCwGQ.exe
  2⤵
  PID:8952
- C:\Windows\System\XBnYFYy.exe
  C:\Windows\System\XBnYFYy.exe
  2⤵
  PID:9024
- C:\Windows\System\aNQGFaJ.exe
  C:\Windows\System\aNQGFaJ.exe
  2⤵
  PID:9040
- C:\Windows\System\kEOKUfX.exe
  C:\Windows\System\kEOKUfX.exe
  2⤵
  PID:9056
- C:\Windows\System\hxRRCBy.exe
  C:\Windows\System\hxRRCBy.exe
  2⤵
  PID:9072
- C:\Windows\System\HfMtdtH.exe
  C:\Windows\System\HfMtdtH.exe
  2⤵
  PID:9088
- C:\Windows\System\YiGkArO.exe
  C:\Windows\System\YiGkArO.exe
  2⤵
  PID:9104
- C:\Windows\System\OjNTjIK.exe
  C:\Windows\System\OjNTjIK.exe
  2⤵
  PID:9120
- C:\Windows\System\EmeAtSN.exe
  C:\Windows\System\EmeAtSN.exe
  2⤵
  PID:9136
- C:\Windows\System\qWfbBrR.exe
  C:\Windows\System\qWfbBrR.exe
  2⤵
  PID:9152
- C:\Windows\System\ghTRcxo.exe
  C:\Windows\System\ghTRcxo.exe
  2⤵
  PID:9168
- C:\Windows\System\sLzDEax.exe
  C:\Windows\System\sLzDEax.exe
  2⤵
  PID:9184
- C:\Windows\System\KWsvcBM.exe
  C:\Windows\System\KWsvcBM.exe
  2⤵
  PID:9200
- C:\Windows\System\dZXBELv.exe
  C:\Windows\System\dZXBELv.exe
  2⤵
  PID:6832
- C:\Windows\System\SpSJzZp.exe
  C:\Windows\System\SpSJzZp.exe
  2⤵
  PID:8024
- C:\Windows\System\ztjIigg.exe
  C:\Windows\System\ztjIigg.exe
  2⤵
  PID:8204
- C:\Windows\System\Nthojyt.exe
  C:\Windows\System\Nthojyt.exe
  2⤵
  PID:8240
- C:\Windows\System\HnrhpIU.exe
  C:\Windows\System\HnrhpIU.exe
  2⤵
  PID:8256
- C:\Windows\System\dfwwIxO.exe
  C:\Windows\System\dfwwIxO.exe
  2⤵
  PID:8364
- C:\Windows\System\dObJlkj.exe
  C:\Windows\System\dObJlkj.exe
  2⤵
  PID:8428
- C:\Windows\System\ocqgnbw.exe
  C:\Windows\System\ocqgnbw.exe
  2⤵
  PID:8492
- C:\Windows\System\bXXGMWd.exe
  C:\Windows\System\bXXGMWd.exe
  2⤵
  PID:8620
- C:\Windows\System\ehamtPO.exe
  C:\Windows\System\ehamtPO.exe
  2⤵
  PID:8528
- C:\Windows\System\VeBDUPU.exe
  C:\Windows\System\VeBDUPU.exe
  2⤵
  PID:8748
- C:\Windows\System\mUUbqRK.exe
  C:\Windows\System\mUUbqRK.exe
  2⤵
  PID:8812
- C:\Windows\System\hBSHEfI.exe
  C:\Windows\System\hBSHEfI.exe
  2⤵
  PID:8844
- C:\Windows\System\CmTlCvl.exe
  C:\Windows\System\CmTlCvl.exe
  2⤵
  PID:7180
- C:\Windows\System\mXKzmdF.exe
  C:\Windows\System\mXKzmdF.exe
  2⤵
  PID:7892
- C:\Windows\System\agzoMas.exe
  C:\Windows\System\agzoMas.exe
  2⤵
  PID:8416
- C:\Windows\System\nOZRGUV.exe
  C:\Windows\System\nOZRGUV.exe
  2⤵
  PID:9472
- C:\Windows\System\iRsxVzJ.exe
  C:\Windows\System\iRsxVzJ.exe
  2⤵
  PID:9616
- C:\Windows\System\feLtSpE.exe
  C:\Windows\System\feLtSpE.exe
  2⤵
  PID:9668
- C:\Windows\System\BjzISuH.exe
  C:\Windows\System\BjzISuH.exe
  2⤵
  PID:9756
- C:\Windows\System\qSXSDVG.exe
  C:\Windows\System\qSXSDVG.exe
  2⤵
  PID:10028
- C:\Windows\System\gscimbQ.exe
  C:\Windows\System\gscimbQ.exe
  2⤵
  PID:10044
- C:\Windows\System\uUTTavu.exe
  C:\Windows\System\uUTTavu.exe
  2⤵
  PID:10064
- C:\Windows\System\wfAOPad.exe
  C:\Windows\System\wfAOPad.exe
  2⤵
  PID:10080
- C:\Windows\System\MBcVSaM.exe
  C:\Windows\System\MBcVSaM.exe
  2⤵
  PID:10100
- C:\Windows\System\MdmEjBI.exe
  C:\Windows\System\MdmEjBI.exe
  2⤵
  PID:10116
- C:\Windows\System\IvHnlRu.exe
  C:\Windows\System\IvHnlRu.exe
  2⤵
  PID:10132
- C:\Windows\System\dLWBNdx.exe
  C:\Windows\System\dLWBNdx.exe
  2⤵
  PID:10148
- C:\Windows\System\pkznJmN.exe
  C:\Windows\System\pkznJmN.exe
  2⤵
  PID:10164
- C:\Windows\System\GINopCT.exe
  C:\Windows\System\GINopCT.exe
  2⤵
  PID:10180
- C:\Windows\System\NVSEwEq.exe
  C:\Windows\System\NVSEwEq.exe
  2⤵
  PID:10196
- C:\Windows\System\KZjRgAj.exe
  C:\Windows\System\KZjRgAj.exe
  2⤵
  PID:10216
- C:\Windows\System\KwPfGeY.exe
  C:\Windows\System\KwPfGeY.exe
  2⤵
  PID:10232
- C:\Windows\System\tgPCUan.exe
  C:\Windows\System\tgPCUan.exe
  2⤵
  PID:9580
- C:\Windows\System\fIyKcbq.exe
  C:\Windows\System\fIyKcbq.exe
  2⤵
  PID:9564
- C:\Windows\System\GKRBALg.exe
  C:\Windows\System\GKRBALg.exe
  2⤵
  PID:9548
- C:\Windows\System\PRMMGLg.exe
  C:\Windows\System\PRMMGLg.exe
  2⤵
  PID:9520
- C:\Windows\System\CRQVxuW.exe
  C:\Windows\System\CRQVxuW.exe
  2⤵
  PID:9500
- C:\Windows\System\QUqEqCP.exe
  C:\Windows\System\QUqEqCP.exe
  2⤵
  PID:9484
- C:\Windows\System\PcFjqPD.exe
  C:\Windows\System\PcFjqPD.exe
  2⤵
  PID:9604
- C:\Windows\System\gqHgPvo.exe
  C:\Windows\System\gqHgPvo.exe
  2⤵
  PID:9680
- C:\Windows\System\afWUZos.exe
  C:\Windows\System\afWUZos.exe
  2⤵
  PID:9696
- C:\Windows\System\gRjcaLq.exe
  C:\Windows\System\gRjcaLq.exe
  2⤵
  PID:9712
- C:\Windows\System\iBWLrJf.exe
  C:\Windows\System\iBWLrJf.exe
  2⤵
  PID:9728
- C:\Windows\System\GoNAILy.exe
  C:\Windows\System\GoNAILy.exe
  2⤵
  PID:9744
- C:\Windows\System\XoWYQaJ.exe
  C:\Windows\System\XoWYQaJ.exe
  2⤵
  PID:10036
- C:\Windows\System\ZqQQuTc.exe
  C:\Windows\System\ZqQQuTc.exe
  2⤵
  PID:2840
- C:\Windows\System\XDhFudW.exe
  C:\Windows\System\XDhFudW.exe
  2⤵
  PID:8304
- C:\Windows\System\GWTLmhB.exe
  C:\Windows\System\GWTLmhB.exe
  2⤵
  PID:8220
- C:\Windows\System\wrwYbYa.exe
  C:\Windows\System\wrwYbYa.exe
  2⤵
  PID:8316
- C:\Windows\System\spVMqrk.exe
  C:\Windows\System\spVMqrk.exe
  2⤵
  PID:8384
- C:\Windows\System\AIuPRfk.exe
  C:\Windows\System\AIuPRfk.exe
  2⤵
  PID:8476
- C:\Windows\System\bdPVkUm.exe
  C:\Windows\System\bdPVkUm.exe
  2⤵
  PID:9220
- C:\Windows\System\JjaiEyp.exe
  C:\Windows\System\JjaiEyp.exe
  2⤵
  PID:9392
- C:\Windows\System\YiFkbkN.exe
  C:\Windows\System\YiFkbkN.exe
  2⤵
  PID:8640
- C:\Windows\System\jcjOCcn.exe
  C:\Windows\System\jcjOCcn.exe
  2⤵
  PID:8764
- C:\Windows\System\dTeUfSx.exe
  C:\Windows\System\dTeUfSx.exe
  2⤵
  PID:8828
- C:\Windows\System\VtwNeau.exe
  C:\Windows\System\VtwNeau.exe
  2⤵
  PID:8880
- C:\Windows\System\mtuFrwZ.exe
  C:\Windows\System\mtuFrwZ.exe
  2⤵
  PID:9052
- C:\Windows\System\lolSudD.exe
  C:\Windows\System\lolSudD.exe
  2⤵
  PID:9132
- C:\Windows\System\ADzjAsc.exe
  C:\Windows\System\ADzjAsc.exe
  2⤵
  PID:9164
- C:\Windows\System\QpuENEI.exe
  C:\Windows\System\QpuENEI.exe
  2⤵
  PID:9780
- C:\Windows\System\ANYHIgA.exe
  C:\Windows\System\ANYHIgA.exe
  2⤵
  PID:9820
- C:\Windows\System\dGQUSiH.exe
  C:\Windows\System\dGQUSiH.exe
  2⤵
  PID:9868
- C:\Windows\System\gNnDAYC.exe
  C:\Windows\System\gNnDAYC.exe
  2⤵
  PID:9908
- C:\Windows\System\kxvsCQc.exe
  C:\Windows\System\kxvsCQc.exe
  2⤵
  PID:9956
- C:\Windows\System\ZLTSzBZ.exe
  C:\Windows\System\ZLTSzBZ.exe
  2⤵
  PID:10004
- C:\Windows\System\FKiVkcy.exe
  C:\Windows\System\FKiVkcy.exe
  2⤵
  PID:8668
- C:\Windows\System\mHAaThS.exe
  C:\Windows\System\mHAaThS.exe
  2⤵
  PID:10208
- C:\Windows\System\PiFRazV.exe
  C:\Windows\System\PiFRazV.exe
  2⤵
  PID:8864
- C:\Windows\System\LREQoPV.exe
  C:\Windows\System\LREQoPV.exe
  2⤵
  PID:7444
- C:\Windows\System\VtXHBJn.exe
  C:\Windows\System\VtXHBJn.exe
  2⤵
  PID:8896
- C:\Windows\System\RiWfkvG.exe
  C:\Windows\System\RiWfkvG.exe
  2⤵
  PID:9016
- C:\Windows\System\ukHFYBg.exe
  C:\Windows\System\ukHFYBg.exe
  2⤵
  PID:9032
- C:\Windows\System\Cscchwu.exe
  C:\Windows\System\Cscchwu.exe
  2⤵
  PID:9048
- C:\Windows\System\bJJYLwx.exe
  C:\Windows\System\bJJYLwx.exe
  2⤵
  PID:9144
- C:\Windows\System\xBaedYY.exe
  C:\Windows\System\xBaedYY.exe
  2⤵
  PID:9196
- C:\Windows\System\atntipR.exe
  C:\Windows\System\atntipR.exe
  2⤵
  PID:9208
- C:\Windows\System\okmhkGG.exe
  C:\Windows\System\okmhkGG.exe
  2⤵
  PID:8272
- C:\Windows\System\QelqvtQ.exe
  C:\Windows\System\QelqvtQ.exe
  2⤵
  PID:2684
- C:\Windows\System\ODIEIDb.exe
  C:\Windows\System\ODIEIDb.exe
  2⤵
  PID:7324
- C:\Windows\System\kNZrcXn.exe
  C:\Windows\System\kNZrcXn.exe
  2⤵
  PID:8560
- C:\Windows\System\QRKrfji.exe
  C:\Windows\System\QRKrfji.exe
  2⤵
  PID:8624
- C:\Windows\System\xChvqfr.exe
  C:\Windows\System\xChvqfr.exe
  2⤵
  PID:8848
- C:\Windows\System\QkNUBUN.exe
  C:\Windows\System\QkNUBUN.exe
  2⤵
  PID:8148
- C:\Windows\System\EbEewtr.exe
  C:\Windows\System\EbEewtr.exe
  2⤵
  PID:8332
- C:\Windows\System\sAotYCn.exe
  C:\Windows\System\sAotYCn.exe
  2⤵
  PID:9284
- C:\Windows\System\PBeKYhE.exe
  C:\Windows\System\PBeKYhE.exe
  2⤵
  PID:10192
- C:\Windows\System\UpRyjXS.exe
  C:\Windows\System\UpRyjXS.exe
  2⤵
  PID:9420
- C:\Windows\System\ZkAnNla.exe
  C:\Windows\System\ZkAnNla.exe
  2⤵
  PID:9444
- C:\Windows\System\VilZELD.exe
  C:\Windows\System\VilZELD.exe
  2⤵
  PID:9628
- C:\Windows\System\SKOngaf.exe
  C:\Windows\System\SKOngaf.exe
  2⤵
  PID:9664
- C:\Windows\System\uhsyNoa.exe
  C:\Windows\System\uhsyNoa.exe
  2⤵
  PID:9776
- C:\Windows\System\lcPcmcM.exe
  C:\Windows\System\lcPcmcM.exe
  2⤵
  PID:9804
- C:\Windows\System\RzMydaG.exe
  C:\Windows\System\RzMydaG.exe
  2⤵
  PID:9828
- C:\Windows\System\szmihbm.exe
  C:\Windows\System\szmihbm.exe
  2⤵
  PID:9852
- C:\Windows\System\eRslshG.exe
  C:\Windows\System\eRslshG.exe
  2⤵
  PID:9880
- C:\Windows\System\aRblvcO.exe
  C:\Windows\System\aRblvcO.exe
  2⤵
  PID:9900
- C:\Windows\System\ZKmxdMf.exe
  C:\Windows\System\ZKmxdMf.exe
  2⤵
  PID:9924
- C:\Windows\System\Ntavldt.exe
  C:\Windows\System\Ntavldt.exe
  2⤵
  PID:9952
- C:\Windows\System\oLvluua.exe
  C:\Windows\System\oLvluua.exe
  2⤵
  PID:9976
- C:\Windows\System\BSMeFGH.exe
  C:\Windows\System\BSMeFGH.exe
  2⤵
  PID:10000
- C:\Windows\System\kOqvcXd.exe
  C:\Windows\System\kOqvcXd.exe
  2⤵
  PID:10024
- C:\Windows\System\VVeNBJP.exe
  C:\Windows\System\VVeNBJP.exe
  2⤵
  PID:9552
- C:\Windows\System\tnRrTMu.exe
  C:\Windows\System\tnRrTMu.exe
  2⤵
  PID:9596
- C:\Windows\System\OBkelno.exe
  C:\Windows\System\OBkelno.exe
  2⤵
  PID:9720
- C:\Windows\System\SjTMNVs.exe
  C:\Windows\System\SjTMNVs.exe
  2⤵
  PID:1504
- C:\Windows\System\xUwXymh.exe
  C:\Windows\System\xUwXymh.exe
  2⤵
  PID:8444
- C:\Windows\System\KERRhIk.exe
  C:\Windows\System\KERRhIk.exe
  2⤵
  PID:10228
- C:\Windows\System\miZBwfZ.exe
  C:\Windows\System\miZBwfZ.exe
  2⤵
  PID:9536
- C:\Windows\System\orQwEBe.exe
  C:\Windows\System\orQwEBe.exe
  2⤵
  PID:9488
- C:\Windows\System\abrfvHa.exe
  C:\Windows\System\abrfvHa.exe
  2⤵
  PID:9708
- C:\Windows\System\ZlYdmGB.exe
  C:\Windows\System\ZlYdmGB.exe
  2⤵
  PID:7636
- C:\Windows\System\FAQTwvn.exe
  C:\Windows\System\FAQTwvn.exe
  2⤵
  PID:8700
- C:\Windows\System\wrXbPRG.exe
  C:\Windows\System\wrXbPRG.exe
  2⤵
  PID:8544
- C:\Windows\System\eOkvJVx.exe
  C:\Windows\System\eOkvJVx.exe
  2⤵
  PID:10144
- C:\Windows\System\CAozORo.exe
  C:\Windows\System\CAozORo.exe
  2⤵
  PID:9252
- C:\Windows\System\CbkVgNK.exe
  C:\Windows\System\CbkVgNK.exe
  2⤵
  PID:9304
- C:\Windows\System\MLECoKt.exe
  C:\Windows\System\MLECoKt.exe
  2⤵
  PID:9276
- C:\Windows\System\Oiuwcgj.exe
  C:\Windows\System\Oiuwcgj.exe
  2⤵
  PID:9316
- C:\Windows\System\xVnmcIk.exe
  C:\Windows\System\xVnmcIk.exe
  2⤵
  PID:9328
- C:\Windows\System\KhzvdmO.exe
  C:\Windows\System\KhzvdmO.exe
  2⤵
  PID:9264
- C:\Windows\System\sheukMB.exe
  C:\Windows\System\sheukMB.exe
  2⤵
  PID:9380
- C:\Windows\System\TwOfnsr.exe
  C:\Windows\System\TwOfnsr.exe
  2⤵
  PID:7844
- C:\Windows\System\ZLtYBYi.exe
  C:\Windows\System\ZLtYBYi.exe
  2⤵
  PID:9660
- C:\Windows\System\dfUhiym.exe
  C:\Windows\System\dfUhiym.exe
  2⤵
  PID:9944
- C:\Windows\System\sjKzWTN.exe
  C:\Windows\System\sjKzWTN.exe
  2⤵
  PID:10096
- C:\Windows\System\NGyamcK.exe
  C:\Windows\System\NGyamcK.exe
  2⤵
  PID:9632
- C:\Windows\System\hbKcgNS.exe
  C:\Windows\System\hbKcgNS.exe
  2⤵
  PID:9980
- C:\Windows\System\qMhUkMa.exe
  C:\Windows\System\qMhUkMa.exe
  2⤵
  PID:9436
- C:\Windows\System\GwWrnqW.exe
  C:\Windows\System\GwWrnqW.exe
  2⤵
  PID:8800
- C:\Windows\System\mgfNCqU.exe
  C:\Windows\System\mgfNCqU.exe
  2⤵
  PID:8832
- C:\Windows\System\lyxvnjH.exe
  C:\Windows\System\lyxvnjH.exe
  2⤵
  PID:8948
- C:\Windows\System\wgOsPUM.exe
  C:\Windows\System\wgOsPUM.exe
  2⤵
  PID:9020
- C:\Windows\System\lFyXuTD.exe
  C:\Windows\System\lFyXuTD.exe
  2⤵
  PID:9100
- C:\Windows\System\PGBLJAx.exe
  C:\Windows\System\PGBLJAx.exe
  2⤵
  PID:2632
- C:\Windows\System\VSkHsHJ.exe
  C:\Windows\System\VSkHsHJ.exe
  2⤵
  PID:8448
- C:\Windows\System\eeZFVFy.exe
  C:\Windows\System\eeZFVFy.exe
  2⤵
  PID:9240
- C:\Windows\System\FfmotXy.exe
  C:\Windows\System\FfmotXy.exe
  2⤵
  PID:9432
- C:\Windows\System\ncggBXd.exe
  C:\Windows\System\ncggBXd.exe
  2⤵
  PID:9768
- C:\Windows\System\mtHVTHg.exe
  C:\Windows\System\mtHVTHg.exe
  2⤵
  PID:9848
- C:\Windows\System\oaykXmV.exe
  C:\Windows\System\oaykXmV.exe
  2⤵
  PID:9892
- C:\Windows\System\XtnXYIq.exe
  C:\Windows\System\XtnXYIq.exe
  2⤵
  PID:9988
- C:\Windows\System\eIBVnGD.exe
  C:\Windows\System\eIBVnGD.exe
  2⤵
  PID:9964
- C:\Windows\System\LmfmyqJ.exe
  C:\Windows\System\LmfmyqJ.exe
  2⤵
  PID:9916
- C:\Windows\System\yooSYsc.exe
  C:\Windows\System\yooSYsc.exe
  2⤵
  PID:10016
- C:\Windows\System\juIIpxt.exe
  C:\Windows\System\juIIpxt.exe
  2⤵
  PID:10156
- C:\Windows\System\jHzkKgI.exe
  C:\Windows\System\jHzkKgI.exe
  2⤵
  PID:9492
- C:\Windows\System\lZpyGsL.exe
  C:\Windows\System\lZpyGsL.exe
  2⤵
  PID:8288
- C:\Windows\System\iQWgNvz.exe
  C:\Windows\System\iQWgNvz.exe
  2⤵
  PID:8400
- C:\Windows\System\GnCfoYT.exe
  C:\Windows\System\GnCfoYT.exe
  2⤵
  PID:8524
- C:\Windows\System\WSdKbed.exe
  C:\Windows\System\WSdKbed.exe
  2⤵
  PID:8592
- C:\Windows\System\bduBFAW.exe
  C:\Windows\System\bduBFAW.exe
  2⤵
  PID:9652
- C:\Windows\System\uLDLRav.exe
  C:\Windows\System\uLDLRav.exe
  2⤵
  PID:7264
- C:\Windows\System\kDbRqRi.exe
  C:\Windows\System\kDbRqRi.exe
  2⤵
  PID:8512
- C:\Windows\System\SepHPDl.exe
  C:\Windows\System\SepHPDl.exe
  2⤵
  PID:9704
- C:\Windows\System\kuaRrER.exe
  C:\Windows\System\kuaRrER.exe
  2⤵
  PID:10248
- C:\Windows\System\NtJSgKS.exe
  C:\Windows\System\NtJSgKS.exe
  2⤵
  PID:10264
- C:\Windows\System\htaxUiF.exe
  C:\Windows\System\htaxUiF.exe
  2⤵
  PID:10280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AjdUaIP.exe

Filesize
2.2MB

MD5
9655a65904700c6a49cefa03dad93c79

SHA1
19004127e47c817e146d4e8eaef6a914be2590db

SHA256
f43170345f5c21f7942ca68501ed50ae10e92de3a9ab8df17c8ff588bb3874b7

SHA512
0a4cd9672e68b09922bcfa7fd26624083579918be358ec5dd619344b31a2654864d2324b8cfbbe177a49f422bd605b0065a01fc576c74c268e3a536ff9ada78f

Download Submit
C:\Windows\system\CLdJFWI.exe

Filesize
2.2MB

MD5
7fd96a2b636445a34bf61bc10704bb2c

SHA1
0a2fdd00f9be206cb96f0918886ad5f63e355fea

SHA256
b9c1f3fe98c1a9234a56c358b75c7631a725bf10e0641b2bf55cb1bd0539e068

SHA512
e6ed7912039535432b656149307cd70527dd8bd09cdf9bf4bb5b755bedcf78abb0c5a502c58ad12d6cc726cbf077091d3574fa9f3af27e07e3f8a89a128ef141

Download Submit
C:\Windows\system\HZNDJhB.exe

Filesize
2.2MB

MD5
860332613b279a87b467b5f7bc1066f2

SHA1
16890f0d3edd976ef777d633b6d43b6b12cf72dd

SHA256
e8f2dad2b77ae24aa57680a95f93ded3eb6f31181899158f141a820b4a18c11f

SHA512
5cb4ddb25223e1406fb30cfff7b38e8b057cdf89a202063b6bc2f0acf7735457c57a4c9d36c6ffda685e7ff0715cf8ff35c6dfd9eb4b9cd7715f39a6e220cf37

Download Submit
C:\Windows\system\KKIMoDS.exe

Filesize
2.2MB

MD5
3f4851be6954688a92685355c075b130

SHA1
3699a1b233530bbf8d9d1182409ca5e6559efcd3

SHA256
63710cc723d27e907ff9d54950ac4752889424ea6adf6bc076ebe538fc1eccb3

SHA512
189756449cac3440fdfbd8efc3928609670aa8d872e8676c020b3ac51cb0ea9596cd221497920c7ef4a272d881e704b201ccdf7063fc5570c7ba3b99061ebace

Download Submit
C:\Windows\system\KeunoLI.exe

Filesize
2.2MB

MD5
e0cfd1b87ece9d0550933677347ee48e

SHA1
c358e89f42b7012d56c4de687250f91018b74cda

SHA256
c28a7b536e5db9263c0cec667e048c6ec39af7ffa6685a8b0aa2ea3519bbcf6c

SHA512
c2ad4579861b3f59f04947cd60d4d213f56f9d8725aa960cff1490711ac0f58d403bcb12e754c5a784e8d1dcdf80bdf318f9df88b9bb023ac7b686069ed81333

Download Submit
C:\Windows\system\NqzzVmQ.exe

Filesize
2.2MB

MD5
8f54aab2117b2790506e40af5b23fc2c

SHA1
15f447537bef35d0e3d2395d5542e37a95d82105

SHA256
4a9f51b6ed1d4379f9abd3175b4f828ef8acc480ee511b33b39e33410dfcad13

SHA512
57f986ae7a4f5d490eb13f8012ec552b15e8c2097219484277bc2ece329ad02014e9664398e227239a2db42f9a65b96f308cbc9a002ac102e815c337c31c27e9

Download Submit
C:\Windows\system\PEQlRwv.exe

Filesize
2.2MB

MD5
01769329ab15376c0640376d4a50397d

SHA1
648709426d8599e71341b05b229aea8024a74469

SHA256
87fa56bd7a2f31cf003353b8e811175030d132f716d682a15a69d3ac0bb017cc

SHA512
c652d938e2817a1c9cacd302069071d5fcfc1561875b8497bf5d0993ae48be820b2dad0c120bf67ee2282bf7a9687e790d91a2f4f1e4df4f3b0857e07a5c5429

Download Submit
C:\Windows\system\PkajJzH.exe

Filesize
2.2MB

MD5
4d972d4b9c57180b044507d0c3e933c3

SHA1
c27e0cc4e65d53ba27363a68f9b56af3b14dd0b5

SHA256
b8d812a969dab90609ba746c5ca6e61feca21a3db97e7141c366142492fd3377

SHA512
5603e5a58e2c480c5ef195cd19462ba73a368e3f0cc04ccb6931aea6aefd619f2e0a50b546dbad6b73dc9a7ac9b1d88aad496eb05ad9a83e67c64298c2769ba6

Download Submit
C:\Windows\system\QNebLPH.exe

Filesize
2.2MB

MD5
0a7c24983acca247bcc6c4e4c68a5b12

SHA1
9cf18dc7b975db81ad38a984be1e47dc2f34ab68

SHA256
e9c25f730c3a301cf6a169d943ca110d8b20e0c27aaa8f3e6f68add939ec8441

SHA512
12b63da0165e31de42202b8ce9bfeef0fc2ffe3bd55eea88074e18a18c413c27287dd2c9a0c714e01ca6ba94f6b1fa2dc1eef3533480be2b2b073c827ece1659

Download Submit
C:\Windows\system\TdasPTD.exe

Filesize
2.2MB

MD5
ac4844a883d81de91129f1d8884030ec

SHA1
363d5465b5199516aca7341dd4c6a5b7b86a6bdb

SHA256
e87c49417a06f14f3d8511457dcae12fa6d398b8568bc68743b58ba9f527c012

SHA512
6931538f5d4548d16090740224aa987ca05a1e84ceaba8cb954fb74a34b82f834e4a753bd5e95cc44b0e0ca32b2c5fd9cbd56f75a47dd998f4defdf56dd3e48d

Download Submit
C:\Windows\system\UqSKcUh.exe

Filesize
2.2MB

MD5
657baeb953b7182eeb66b549bda626f1

SHA1
5879b287a25fd0fd86b6853aa89b791c4ad27a67

SHA256
eb787bd540dd5af56d51cac824a1e190871430e853e18e13ebf610305f46b019

SHA512
a6f848c8359cd7e881285b0d1bceccdd7d695e4141cf89ca6ea2a1a2ab8a860f4a14aa58779569c468033ac74d2b0717b2c8d863328b734e621c37edb3f140b3

Download Submit
C:\Windows\system\UtEfwfO.exe

Filesize
2.2MB

MD5
e95deddf757a790c77f0e742ee67e8b6

SHA1
c0e14c0834dbca524b22d29befc1b2e113669326

SHA256
1ee57f9a5cd7aedb86a90f8835277ad2c8f14aa3bbc148d259ca69f0c4068716

SHA512
fec96420ab6f224b8595b162d59c5e22b5e9451eb2291514eca861f77f3bd92e874ccdc47c07a1bb72d0afdff975b3695e0b02bd85dfc0906f20aa14913d859a

Download Submit
C:\Windows\system\VFVqWzf.exe

Filesize
2.2MB

MD5
1ab767b69662dab71eec3200fdd03fc6

SHA1
af1552cdf80a2ec4c5679a92de52d0d23f9a399d

SHA256
3f829dd974eae2026cf3dd78851b4a75b52f0cacb580a5e2a5b65f22f6cae816

SHA512
a8191b81e5f98961463ef36b63ed1ba716425b818b5e954a1b37375a91ff8ded0cd9aad3055e42a4c63b45100c0b801653dc21afd5f5f96ee3b1133072f3946f

Download Submit
C:\Windows\system\WTjTtCv.exe

Filesize
2.2MB

MD5
d892c7cf6393a96d3caa247148df1908

SHA1
e2dba7641d663c65fad6b4cf5e0c41c6269d2407

SHA256
2908e8d46a9db65157d719e9e5a65e257bd16dc241c08041b8c634be7354f525

SHA512
c81a0d72f94fc68e41954d5a9ad2590b7d49521e94560868409bbf2610b69fa4a690f0a366e62a909513bb9bb59ff05117b4b26f33bdfd4dce264ab20f9e597e

Download Submit
C:\Windows\system\XTPmKRC.exe

Filesize
2.2MB

MD5
e47d60dd6387fcd82323d7abc21744be

SHA1
cc6f4b33166b4acaf520048b4562aefea8cf90bb

SHA256
783f9c41b2b81f296217c92ce1496f96775e9388569564edbdbcbcee66d0547e

SHA512
123b0997a60a10b1745deac93a536fad7e33eea7566caf8cc59407eb7407e3fbaf272d225d9b840e6e0e5eb480bd34093d1798f0e14cd63972d4f90fc17be203

Download Submit
C:\Windows\system\XjWdljO.exe

Filesize
2.2MB

MD5
f70a248a095daab3d985e97fd79bf024

SHA1
028124c1488c19f1cad30c718502f1122f0c69be

SHA256
27381ba481db502b318250a544d835795e9fc3c30f9c30b6b3402cb1cb55760e

SHA512
af7a6be86ca3f19e22e879d5e6d3cf330b01bf0572fa9ec1bc9ba068162ee263bc5a63d59a6543791ba6dc97ff465aeed7a6bf942032b1a882db8d15a22e00ee

Download Submit
C:\Windows\system\ZgWrHUs.exe

Filesize
2.2MB

MD5
c169b4b05b36da73522128dc8fea43b0

SHA1
ef25de1b910c0f3f80820689423534b6a5016cde

SHA256
6fd012b432d891b093000a723e07108e06828415a3f8e3631ce99d937258772d

SHA512
6117e3aa3858c747bfc0dd3b87c1f071aab898b234607819284ffbc91ec9755aa4285ec37b47c3d89ae54aa098d358abd4cae88a810f6936108d59b3f8132bfe

Download Submit
C:\Windows\system\egFYdzU.exe

Filesize
2.2MB

MD5
95687577d2be8b8ae71568e64d61366d

SHA1
f11c882800f87d456ffae96604bd06f6678cc415

SHA256
7367816390d0fcbaf219faf69c6429f20d499f57f3b0b4832cb8db159b39da73

SHA512
f00b76f7957094aeffb1c508e6da1dc72ae84d94e498213fd1a653c224025dff6515a8572538b77474bb8c04e8d99b641155b7834560b69f1b84be45a86a0b39

Download Submit
C:\Windows\system\gsjdLbo.exe

Filesize
2.2MB

MD5
580cb95bfbbf0199ce149f8733397bab

SHA1
5fe81fa351fe99d3e4c2d89c282b9664c44877a4

SHA256
d55ac8f4874d0664105fe8db9ca1becd5ab0b50434c149d9a829396488ef1c03

SHA512
23bbd600ee3bd8b578c01e930e192147ccf9aecaa710ca7347b033ecf8847c334e1d13fd0216c37b26762532883e33dbc967e53cd1ce138cf3a697f9df4ec881

Download Submit
C:\Windows\system\hKNAZiE.exe

Filesize
8B

MD5
408407fe49e2a1bd1de2fb4f4e1c1e4e

SHA1
6781f0ed16b9f9a0e8a861848782ae1a9b183885

SHA256
413c20c52ba69478c63daee39bcd70926f09cbc71ce3aa1577802440938b324a

SHA512
51204da6f17b6725f4e9b8b9381f34a7ed365926b3780a3bfe9e8d70ab81ec8caad96b3f0838e87a0f0c0c6baeed1ea2ea2f5c7ee1fa6a13b720a1ec69c3f3fd

Download Submit
C:\Windows\system\lWxpKry.exe

Filesize
2.2MB

MD5
2fa6a1e0a9daf1e525cab4ec6cbed969

SHA1
f9917a8d86fad065605ca9591fff40d5239ec4f2

SHA256
a3a2cdf4b7433781dd6516aaf9cbef25002b05699b2bdb38479807d99f1f58f7

SHA512
e6178aab2df26b00d5ff2feb2dc02b7716f7c6c25dbb8a3e6d83266c13c24cfd78b972373834808dd2dc3a217f9a009a7638d72d5126725ab8ece21cef87eedd

Download Submit
C:\Windows\system\lywfrJj.exe

Filesize
2.2MB

MD5
12153e7bef2ed59ae0d3cb518c22e108

SHA1
7caa9c7f1da0b3d1b8fe60eb2eefa810b7bd2016

SHA256
0db382eba2ef0ac3608cf4415d1cd4cdb67fd3f6073dc85a3d81d0a413b80649

SHA512
c2bf6634522cdec66d0eaaad51e83e12192410605f5f2f9697ef924d2ef529434d7323d5e5100499976f0d1513b5414335504e20899c3ded5e3265a177d1cc36

Download Submit
C:\Windows\system\pgaZaIc.exe

Filesize
2.2MB

MD5
0edbdc1d2bc782a8a5eec1acf7dd56d1

SHA1
9b1d837bcc719510a651da8f4866f3f25a5236fb

SHA256
47a323fd8f338969ab29a03288548396739c63f3485e5ad610a45b24a639e9fd

SHA512
46e23c8c94a7e7f2f1ba04e21ad51b9430e6bade08ca376bdcdf1e3ad2787c9ee7c7cb604312f5e6276a5329428a953cc6cba40535cea2b2b7922ea711d2c66a

Download Submit
C:\Windows\system\tMMOmES.exe

Filesize
2.2MB

MD5
c37b6c4d2dde8f89bff9757b4ae17304

SHA1
55e22bf1bcce498084f7690160931779a1852d74

SHA256
aed807f2567c0c71596393ea4568aaab1435d137cdf61d1c8f18f6577c409e10

SHA512
a781e8cf951ea87a71fb78b0f23e5fee16c827bb2738ca04c947587fc214a5d6291949e87c8d2ebc5c3a2c9e4ee7259caf4cf038668bb134fd840cee4a3d3bb9

Download Submit
C:\Windows\system\vpJJbvU.exe

Filesize
2.2MB

MD5
db3b534524ebcb30082c1406990438d6

SHA1
82ca04d8260a272c1e7334c2945e2c16493cf09e

SHA256
1e37229ec94b97313eab27947aba15d5906a3b108ad67757544dd1e0ace0b16a

SHA512
98268889e37e4ffa51d599132e12a5efe66fe15f22eb343bce1ce94f54ec0a46dc63cf19502dcecbccd0eaa02405e830b94766b85de2a97913720b7c13002ea1

Download Submit
C:\Windows\system\xiRYdUN.exe

Filesize
2.2MB

MD5
323129e93bd7b493faa2baa77025b947

SHA1
7f235fa75c86268f177cecf22ded52ae681887a2

SHA256
e242258861310dcfd9edf48a14b00c72e7be366c370e7b225e631689835a59db

SHA512
18b3240edca3f300260adeffa3970291934987020aaaab5eeb0bfb060ff5d5cc8cfe341df7f0a45e7b58990fd370b6123820739e5444196eb6ad36f44e04a53b

Download Submit
C:\Windows\system\yWoKXLn.exe

Filesize
2.2MB

MD5
0842dc72a7ecc4ee5361d2c93d13a968

SHA1
9c5170268eaa6bac8fe0ff900ac2e69ebcd38881

SHA256
7acf7438b0df6548521d656087c5607e4c91ea146868398e0427dec5cfe95244

SHA512
79824816670fd2fd66112582fe87e6e4ed602f73890d9a85891cfd8d77f50f0c80e866d52816aa6926e54557b6f09134376a8d8127aa7f36a8e9a2b12b33a277

Download Submit
C:\Windows\system\zHhJmsK.exe

Filesize
2.2MB

MD5
7713bbce54456b9b24e2541203e70eac

SHA1
251ec6f7b97c0222dc822dcd1305e4e15e8170d5

SHA256
f01966fb2af8b6e549d355ce4ba046a2d618b5e3d7e52e14e161320cbeffbd85

SHA512
ffd7606b9d0f72480924a3e4fc21e6c8e71e87c7f16d659dc6dd6978c46f96233ecc9a55acd747652cf17328b7fdd74c1acadca150e8e8cd7f7d3dc5621d5a48

Download Submit
C:\Windows\system\zZnWOld.exe

Filesize
2.2MB

MD5
ae1756a2f9bf368892725d0435d00ec3

SHA1
e714f69b2bb25072001c20c9795e82431380de7c

SHA256
ed98b98890e909d711840bb078831da6115e985e7ff32e8d6437de6cf09f5584

SHA512
d4ef58c9fb996709ea2585370bf08ed99d0c3e5acc6189c7140c61fc7266e00197b0ac66950ad1f2fdd565faeae457cfdadbdd02af668125a44c55bb47f79c4c

Download Submit
\Windows\system\HGOQoTx.exe

Filesize
2.2MB

MD5
72cd60e270acb287cd3f3e3c8079a09e

SHA1
e1eee34ce0677b62081b09f70752052a0a89e51a

SHA256
e1fa4b458e70a35c6e3f79a8f8ef5acfe82eaa06a353b23d18694443fc2cc3c2

SHA512
ddeccca9f53d1ac3e0d2c5066a4ea9b246661e35eb8947907a1ed91f60d38e84224cb6d4c89cd7413a4aa2544cb707db8522c615cda85e8e636624b56914ac2b

Download Submit
\Windows\system\HUrTypk.exe

Filesize
2.2MB

MD5
355172f98f05d9faa68baf8b81c0feca

SHA1
98bd6bc2af72fa2bc39b0e83878b2b14b1495474

SHA256
cee883b8f7fb65232fcae43218cbb2b38b44b0132219cf301f672101b1feb022

SHA512
6ef3400dd175100ecdccef5c0817eb494130b861a5bce7d61a210427e66787ff858c8ac693339a9ee911c71897913c7b0583e205bfc3856cc138aa6ce074258f

Download Submit
\Windows\system\OflAuDb.exe

Filesize
2.2MB

MD5
d5247e88a1519f031d3ec882acb52136

SHA1
02c4cd25adb0c5f1008d7bd6be7c18b86ea7a826

SHA256
eae45d5c2365d7d3c976acfa82c9cc7362070568292dbab5b7433c4affe1177a

SHA512
d907239812e0aafdaf68998609d386abae0d483bb7a6ee7c9f07f63c31ca3a82f99d44804541a40115be1410283b580f587f44563e412473f9006abd41cf98c2

Download Submit
\Windows\system\eVcwUCa.exe

Filesize
2.2MB

MD5
61fbf98a806f6db85fda60a190ce18a3

SHA1
6f5ddf8bbe0e31ca52778663ed5607df37403fa2

SHA256
7f9efe18ec211fe47b797fa7fb9cb96426c735eef3167a87aed21a06b3dc9ea3

SHA512
f601069d2b0ee36aa606de102e497380c105e2bc29d5c50c8cd63073481995788bbc7dd6106c4ca3a31de6c09dc0aa3a62f4d526216dee08662df9101bc78e01

Download Submit
memory/1332-5472-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/1332-93-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/1724-76-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/1724-5144-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/1736-8-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/1736-77-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/1736-87-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/1736-52-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/1736-75-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/1736-0-0x0000000000490000-0x00000000004A0000-memory.dmp

Filesize
64KB

Download
memory/1736-86-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/1736-2-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/1736-21-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/1736-72-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/1736-81-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/1736-82-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/1736-79-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/1872-92-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/1872-5198-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2000-88-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/2000-5173-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/2020-66-0x0000000001FE0000-0x0000000001FE8000-memory.dmp

Filesize
32KB

Download
memory/2020-50-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2020-51-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Filesize
9.6MB

Download
memory/2020-2046-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Filesize
9.6MB

Download
memory/2020-37-0x000007FEF5C5E000-0x000007FEF5C5F000-memory.dmp

Filesize
4KB

Download
memory/2436-5162-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2436-74-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2536-84-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2536-5139-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2556-71-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2556-5174-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2560-83-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2560-5127-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2564-5125-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2564-9-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2596-5121-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2596-64-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2752-5126-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2752-28-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/3024-5176-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/3024-80-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download