xmrig | 1c77e6f5580aaecfbcd1b6bb04d7e4821168c279d5535d0e60e66021c97f5c45

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 17:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

015541e186f159092af55fb0442a215d_JaffaCakes118.exe
Size

1.9MB
MD5

015541e186f159092af55fb0442a215d
SHA1

da343ddff6eb683bf70e892993934f6834db21a1
SHA256

1c77e6f5580aaecfbcd1b6bb04d7e4821168c279d5535d0e60e66021c97f5c45
SHA512

049d613936170d9d57c6bcf15f682322f9c67215dad72d95782a93880d7c7eac373e754e918ffefba46be1f984de615beaf1b20f808a1b35d74b59d196f22f94
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl/jTK:NAB3

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 30 IoCs

miner

resource	yara_rule
behavioral1/memory/2516-19-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	xmrig
behavioral1/memory/2672-49-0x000000013FD50000-0x0000000140142000-memory.dmp	xmrig
behavioral1/memory/2492-39-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2576-37-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/556-66-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/1884-68-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2956-96-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2188-93-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/1400-90-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/1400-79-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	xmrig
behavioral1/memory/2012-64-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	xmrig
behavioral1/memory/1400-104-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	xmrig
behavioral1/memory/2840-426-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2772-425-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2548-424-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2316-422-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/1884-420-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2784-21-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2956-20-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2492-2235-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2316-2394-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/2012-2404-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	xmrig
behavioral1/memory/556-2411-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2956-2408-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2516-2419-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	xmrig
behavioral1/memory/2576-2422-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2672-2407-0x000000013FD50000-0x0000000140142000-memory.dmp	xmrig
behavioral1/memory/2784-2406-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2188-2405-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/1884-2403-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2784	QTwexTE.exe
2516	VzrUNUQ.exe
2956	LOAkJjP.exe
2576	WVdoqXV.exe
2492	ppjanrj.exe
2672	EdTvmtP.exe
2012	nSeoOvT.exe
1884	jyhTsyc.exe
556	jaasWGh.exe
2316	NIHGvXm.exe
2188	OBKEgXt.exe
2772	ZCXOVcD.exe
2548	PMZjsYS.exe
2840	hsuZBXr.exe
1088	KUwuZZt.exe
1648	qlWJEmj.exe
2392	wwBTmdi.exe
2632	bstZWTO.exe
2628	lGzoLba.exe
2280	XfaXYNE.exe
1144	BxTZjhG.exe
1100	tCBYgSk.exe
2428	QOkGnfQ.exe
2256	ekXPdmp.exe
2740	DoDvlJW.exe
336	SLsEEaC.exe
2136	oCwcBlM.exe
2084	PTlOchH.exe
3000	zPMrkZv.exe
2052	vXHSBhS.exe
3020	yjgyUyE.exe
3056	eYCicdp.exe
1544	hUQSqLO.exe
2192	EhWYFea.exe
1092	uzhNBsc.exe
1796	cHGYvhm.exe
1180	LKoVcWP.exe
460	UuOzGJu.exe
1828	siFNBHq.exe
2044	rYSZdZj.exe
2040	mEecBdo.exe
1064	ACCAOsA.exe
908	lsMMZea.exe
608	ZNFPXbf.exe
2984	DRxHRvE.exe
2216	TcleuoS.exe
1508	KPleowS.exe
940	pnUnSSl.exe
2056	WyEVPOz.exe
2896	UzmbhgF.exe
2108	yjJNvfv.exe
960	vHGnGdK.exe
708	GJaHbBO.exe
1684	WGGyzbK.exe
1892	ZbGwmVK.exe
2092	BCgARoY.exe
2088	JhXKSIa.exe
1584	MtwFBSj.exe
1708	JSaLzEk.exe
2872	MaUJdBp.exe
2144	lSpHnHU.exe
2484	KcnduUd.exe
2228	TpfMzKo.exe
2364	EVCRoxG.exe

Loads dropped DLL 64 IoCs

pid	Process
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1400-0-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/files/0x000b00000001560a-3.dat	upx
behavioral1/memory/2516-19-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/files/0x0009000000015c69-26.dat	upx
behavioral1/files/0x0007000000015c87-32.dat	upx
behavioral1/memory/2672-49-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/memory/2492-39-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2576-37-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/556-66-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/memory/1884-68-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/files/0x00050000000186a0-69.dat	upx
behavioral1/memory/2316-74-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/files/0x0006000000018b33-102.dat	upx
behavioral1/files/0x0006000000018ae8-100.dat	upx
behavioral1/memory/2956-96-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2188-93-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/files/0x0006000000018b15-89.dat	upx
behavioral1/memory/1400-79-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/files/0x0006000000018ae2-77.dat	upx
behavioral1/memory/2012-64-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx
behavioral1/files/0x0006000000018698-63.dat	upx
behavioral1/files/0x000f0000000006fd-62.dat	upx
behavioral1/files/0x0007000000015cb9-54.dat	upx
behavioral1/memory/1400-42-0x0000000002D50000-0x0000000003142000-memory.dmp	upx
behavioral1/memory/1400-104-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/files/0x0007000000015c7c-30.dat	upx
behavioral1/files/0x0006000000018b37-114.dat	upx
behavioral1/files/0x0006000000018b42-119.dat	upx
behavioral1/files/0x0006000000018b73-132.dat	upx
behavioral1/files/0x0006000000018b96-134.dat	upx
behavioral1/files/0x0005000000019377-168.dat	upx
behavioral1/memory/2840-426-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/memory/2772-425-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2548-424-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/2316-422-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/memory/1884-420-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/files/0x000500000001946b-184.dat	upx
behavioral1/files/0x0005000000019410-180.dat	upx
behavioral1/files/0x00050000000193b0-176.dat	upx
behavioral1/files/0x000500000001939b-172.dat	upx
behavioral1/files/0x0005000000019368-164.dat	upx
behavioral1/files/0x0005000000019333-160.dat	upx
behavioral1/files/0x000500000001931b-156.dat	upx
behavioral1/files/0x00050000000192f4-152.dat	upx
behavioral1/files/0x00050000000192c9-148.dat	upx
behavioral1/files/0x0006000000018d06-144.dat	upx
behavioral1/files/0x0006000000018ba2-140.dat	upx
behavioral1/files/0x0006000000018b6a-129.dat	upx
behavioral1/files/0x0006000000018b4a-124.dat	upx
behavioral1/memory/2784-21-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/2956-20-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/files/0x0029000000015c2f-8.dat	upx
behavioral1/files/0x0010000000015c3c-14.dat	upx
behavioral1/memory/2492-2235-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2316-2394-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/memory/2012-2404-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx
behavioral1/memory/556-2411-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/memory/2956-2408-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2516-2419-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/memory/2576-2422-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/2672-2407-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/memory/2784-2406-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/2188-2405-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/1884-2403-0x000000013F040000-0x000000013F432000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ijadEfk.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\UUwPJNe.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\VOSsDRM.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\cTWTjHn.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\bKzbDyS.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\ZuLvCJi.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\oHlWAmo.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\ySbRBYH.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\SIYBbPK.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\ttqfSyB.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\tXbBoVh.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\TpHWxbO.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\UVBwAMM.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\XsRoXLH.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\nvMFoqT.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\dNlGozj.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\zeHArkF.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\AmMnSoZ.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\HViRjgl.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\TMZuWzF.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\LImUsSe.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\xOPCENG.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\aehdxKp.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\bylnXBi.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\OtdvJRu.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\CNnDuQn.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\IgKwArB.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\OqbLEtb.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\ymqBXea.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\JSPvfwu.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\vzsonSU.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\HmqvshE.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\TaMvtfV.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\HLgUWRp.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\sJVyYIX.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\VnKmTjN.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\BhtACmc.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\pXKKYbF.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\AXPIyAF.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\YdMEllJ.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\fLWiEhX.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\rQaxIXu.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\RySqMvX.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\thnufHT.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\eiwKfXD.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\fWFHTjo.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\TlPmxfG.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\LZczbMn.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\PlwKQBc.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\QTwexTE.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\uzhNBsc.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\nspxkut.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\gOqqfPC.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\NdlYpVU.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\JhXKSIa.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\BouXhLA.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\yPrHLWS.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\NWxynvx.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\VJNJhnS.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\yTfKuTn.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\NUFSmlI.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\zcMpLTL.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\XHzgDZh.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\IKVgiLq.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1776	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
Token: SeDebugPrivilege	1776	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1776	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	29
PID 1400 wrote to memory of 1776	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	29
PID 1400 wrote to memory of 1776	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	29
PID 1400 wrote to memory of 2784	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	30
PID 1400 wrote to memory of 2784	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	30
PID 1400 wrote to memory of 2784	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	30
PID 1400 wrote to memory of 2956	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	31
PID 1400 wrote to memory of 2956	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	31
PID 1400 wrote to memory of 2956	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	31
PID 1400 wrote to memory of 2516	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	32
PID 1400 wrote to memory of 2516	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	32
PID 1400 wrote to memory of 2516	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	32
PID 1400 wrote to memory of 2576	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	33
PID 1400 wrote to memory of 2576	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	33
PID 1400 wrote to memory of 2576	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	33
PID 1400 wrote to memory of 2492	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	34
PID 1400 wrote to memory of 2492	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	34
PID 1400 wrote to memory of 2492	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	34
PID 1400 wrote to memory of 2672	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	35
PID 1400 wrote to memory of 2672	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	35
PID 1400 wrote to memory of 2672	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	35
PID 1400 wrote to memory of 2012	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	36
PID 1400 wrote to memory of 2012	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	36
PID 1400 wrote to memory of 2012	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	36
PID 1400 wrote to memory of 1884	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	37
PID 1400 wrote to memory of 1884	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	37
PID 1400 wrote to memory of 1884	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	37
PID 1400 wrote to memory of 556	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	38
PID 1400 wrote to memory of 556	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	38
PID 1400 wrote to memory of 556	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	38
PID 1400 wrote to memory of 2316	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	39
PID 1400 wrote to memory of 2316	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	39
PID 1400 wrote to memory of 2316	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	39
PID 1400 wrote to memory of 2188	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	40
PID 1400 wrote to memory of 2188	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	40
PID 1400 wrote to memory of 2188	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	40
PID 1400 wrote to memory of 2548	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	41
PID 1400 wrote to memory of 2548	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	41
PID 1400 wrote to memory of 2548	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	41
PID 1400 wrote to memory of 2772	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	42
PID 1400 wrote to memory of 2772	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	42
PID 1400 wrote to memory of 2772	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	42
PID 1400 wrote to memory of 2840	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	43
PID 1400 wrote to memory of 2840	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	43
PID 1400 wrote to memory of 2840	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	43
PID 1400 wrote to memory of 1088	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	44
PID 1400 wrote to memory of 1088	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	44
PID 1400 wrote to memory of 1088	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	44
PID 1400 wrote to memory of 1648	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	45
PID 1400 wrote to memory of 1648	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	45
PID 1400 wrote to memory of 1648	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	45
PID 1400 wrote to memory of 2392	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	46
PID 1400 wrote to memory of 2392	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	46
PID 1400 wrote to memory of 2392	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	46
PID 1400 wrote to memory of 2632	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	47
PID 1400 wrote to memory of 2632	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	47
PID 1400 wrote to memory of 2632	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	47
PID 1400 wrote to memory of 2628	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	48
PID 1400 wrote to memory of 2628	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	48
PID 1400 wrote to memory of 2628	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	48
PID 1400 wrote to memory of 2280	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	49
PID 1400 wrote to memory of 2280	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	49
PID 1400 wrote to memory of 2280	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	49
PID 1400 wrote to memory of 1144	1400	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\015541e186f159092af55fb0442a215d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\015541e186f159092af55fb0442a215d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\System\QTwexTE.exe
  C:\Windows\System\QTwexTE.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\LOAkJjP.exe
  C:\Windows\System\LOAkJjP.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\VzrUNUQ.exe
  C:\Windows\System\VzrUNUQ.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\WVdoqXV.exe
  C:\Windows\System\WVdoqXV.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\ppjanrj.exe
  C:\Windows\System\ppjanrj.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\EdTvmtP.exe
  C:\Windows\System\EdTvmtP.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\nSeoOvT.exe
  C:\Windows\System\nSeoOvT.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\jyhTsyc.exe
  C:\Windows\System\jyhTsyc.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\jaasWGh.exe
  C:\Windows\System\jaasWGh.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\NIHGvXm.exe
  C:\Windows\System\NIHGvXm.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\OBKEgXt.exe
  C:\Windows\System\OBKEgXt.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\PMZjsYS.exe
  C:\Windows\System\PMZjsYS.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\ZCXOVcD.exe
  C:\Windows\System\ZCXOVcD.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\hsuZBXr.exe
  C:\Windows\System\hsuZBXr.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\KUwuZZt.exe
  C:\Windows\System\KUwuZZt.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\qlWJEmj.exe
  C:\Windows\System\qlWJEmj.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\wwBTmdi.exe
  C:\Windows\System\wwBTmdi.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\bstZWTO.exe
  C:\Windows\System\bstZWTO.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\lGzoLba.exe
  C:\Windows\System\lGzoLba.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\XfaXYNE.exe
  C:\Windows\System\XfaXYNE.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\BxTZjhG.exe
  C:\Windows\System\BxTZjhG.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\tCBYgSk.exe
  C:\Windows\System\tCBYgSk.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\QOkGnfQ.exe
  C:\Windows\System\QOkGnfQ.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\ekXPdmp.exe
  C:\Windows\System\ekXPdmp.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\DoDvlJW.exe
  C:\Windows\System\DoDvlJW.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\SLsEEaC.exe
  C:\Windows\System\SLsEEaC.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\oCwcBlM.exe
  C:\Windows\System\oCwcBlM.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\PTlOchH.exe
  C:\Windows\System\PTlOchH.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\zPMrkZv.exe
  C:\Windows\System\zPMrkZv.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\vXHSBhS.exe
  C:\Windows\System\vXHSBhS.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\yjgyUyE.exe
  C:\Windows\System\yjgyUyE.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\eYCicdp.exe
  C:\Windows\System\eYCicdp.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\hUQSqLO.exe
  C:\Windows\System\hUQSqLO.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\EhWYFea.exe
  C:\Windows\System\EhWYFea.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\uzhNBsc.exe
  C:\Windows\System\uzhNBsc.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\cHGYvhm.exe
  C:\Windows\System\cHGYvhm.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\LKoVcWP.exe
  C:\Windows\System\LKoVcWP.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\UuOzGJu.exe
  C:\Windows\System\UuOzGJu.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\siFNBHq.exe
  C:\Windows\System\siFNBHq.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\rYSZdZj.exe
  C:\Windows\System\rYSZdZj.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\mEecBdo.exe
  C:\Windows\System\mEecBdo.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\ACCAOsA.exe
  C:\Windows\System\ACCAOsA.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\lsMMZea.exe
  C:\Windows\System\lsMMZea.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\ZNFPXbf.exe
  C:\Windows\System\ZNFPXbf.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\DRxHRvE.exe
  C:\Windows\System\DRxHRvE.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\TcleuoS.exe
  C:\Windows\System\TcleuoS.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\KPleowS.exe
  C:\Windows\System\KPleowS.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\pnUnSSl.exe
  C:\Windows\System\pnUnSSl.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\WyEVPOz.exe
  C:\Windows\System\WyEVPOz.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\UzmbhgF.exe
  C:\Windows\System\UzmbhgF.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\yjJNvfv.exe
  C:\Windows\System\yjJNvfv.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\vHGnGdK.exe
  C:\Windows\System\vHGnGdK.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\GJaHbBO.exe
  C:\Windows\System\GJaHbBO.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\WGGyzbK.exe
  C:\Windows\System\WGGyzbK.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\ZbGwmVK.exe
  C:\Windows\System\ZbGwmVK.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\BCgARoY.exe
  C:\Windows\System\BCgARoY.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\JhXKSIa.exe
  C:\Windows\System\JhXKSIa.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\MtwFBSj.exe
  C:\Windows\System\MtwFBSj.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\JSaLzEk.exe
  C:\Windows\System\JSaLzEk.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\MaUJdBp.exe
  C:\Windows\System\MaUJdBp.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\lSpHnHU.exe
  C:\Windows\System\lSpHnHU.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\KcnduUd.exe
  C:\Windows\System\KcnduUd.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\TpfMzKo.exe
  C:\Windows\System\TpfMzKo.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\EVCRoxG.exe
  C:\Windows\System\EVCRoxG.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\UVBwAMM.exe
  C:\Windows\System\UVBwAMM.exe
  2⤵
  PID:2408
- C:\Windows\System\SKjScnm.exe
  C:\Windows\System\SKjScnm.exe
  2⤵
  PID:2560
- C:\Windows\System\zkeJRDV.exe
  C:\Windows\System\zkeJRDV.exe
  2⤵
  PID:2904
- C:\Windows\System\ZBQSACz.exe
  C:\Windows\System\ZBQSACz.exe
  2⤵
  PID:2368
- C:\Windows\System\lxrpwSd.exe
  C:\Windows\System\lxrpwSd.exe
  2⤵
  PID:2472
- C:\Windows\System\TZawifI.exe
  C:\Windows\System\TZawifI.exe
  2⤵
  PID:2600
- C:\Windows\System\JSAIsaj.exe
  C:\Windows\System\JSAIsaj.exe
  2⤵
  PID:2804
- C:\Windows\System\iNJZadZ.exe
  C:\Windows\System\iNJZadZ.exe
  2⤵
  PID:1300
- C:\Windows\System\ZIggtCf.exe
  C:\Windows\System\ZIggtCf.exe
  2⤵
  PID:1968
- C:\Windows\System\NvkCCHo.exe
  C:\Windows\System\NvkCCHo.exe
  2⤵
  PID:864
- C:\Windows\System\QAPVcrc.exe
  C:\Windows\System\QAPVcrc.exe
  2⤵
  PID:2460
- C:\Windows\System\TBUFaHi.exe
  C:\Windows\System\TBUFaHi.exe
  2⤵
  PID:636
- C:\Windows\System\LpDbtlP.exe
  C:\Windows\System\LpDbtlP.exe
  2⤵
  PID:2816
- C:\Windows\System\VvpvwvB.exe
  C:\Windows\System\VvpvwvB.exe
  2⤵
  PID:2700
- C:\Windows\System\XeNauEU.exe
  C:\Windows\System\XeNauEU.exe
  2⤵
  PID:1620
- C:\Windows\System\iZpFINd.exe
  C:\Windows\System\iZpFINd.exe
  2⤵
  PID:2452
- C:\Windows\System\vUxMnGV.exe
  C:\Windows\System\vUxMnGV.exe
  2⤵
  PID:112
- C:\Windows\System\bDMWqOI.exe
  C:\Windows\System\bDMWqOI.exe
  2⤵
  PID:2476
- C:\Windows\System\PLEaZGo.exe
  C:\Windows\System\PLEaZGo.exe
  2⤵
  PID:1908
- C:\Windows\System\EPwGqNp.exe
  C:\Windows\System\EPwGqNp.exe
  2⤵
  PID:1340
- C:\Windows\System\VnKmTjN.exe
  C:\Windows\System\VnKmTjN.exe
  2⤵
  PID:1724
- C:\Windows\System\rpJlFPh.exe
  C:\Windows\System\rpJlFPh.exe
  2⤵
  PID:2664
- C:\Windows\System\KqlyYuB.exe
  C:\Windows\System\KqlyYuB.exe
  2⤵
  PID:2828
- C:\Windows\System\GtnJXQh.exe
  C:\Windows\System\GtnJXQh.exe
  2⤵
  PID:2232
- C:\Windows\System\dpPwrgF.exe
  C:\Windows\System\dpPwrgF.exe
  2⤵
  PID:2028
- C:\Windows\System\VtyNkHE.exe
  C:\Windows\System\VtyNkHE.exe
  2⤵
  PID:1688
- C:\Windows\System\VttKqen.exe
  C:\Windows\System\VttKqen.exe
  2⤵
  PID:564
- C:\Windows\System\bQSwFrU.exe
  C:\Windows\System\bQSwFrU.exe
  2⤵
  PID:1540
- C:\Windows\System\PhYUEVh.exe
  C:\Windows\System\PhYUEVh.exe
  2⤵
  PID:2156
- C:\Windows\System\Ohftbgd.exe
  C:\Windows\System\Ohftbgd.exe
  2⤵
  PID:1164
- C:\Windows\System\DIPZrQj.exe
  C:\Windows\System\DIPZrQj.exe
  2⤵
  PID:1720
- C:\Windows\System\nqAdHjw.exe
  C:\Windows\System\nqAdHjw.exe
  2⤵
  PID:2268
- C:\Windows\System\dMvICEo.exe
  C:\Windows\System\dMvICEo.exe
  2⤵
  PID:2972
- C:\Windows\System\pJXfLfY.exe
  C:\Windows\System\pJXfLfY.exe
  2⤵
  PID:1472
- C:\Windows\System\tWqbkXs.exe
  C:\Windows\System\tWqbkXs.exe
  2⤵
  PID:2940
- C:\Windows\System\QNiGrgX.exe
  C:\Windows\System\QNiGrgX.exe
  2⤵
  PID:1888
- C:\Windows\System\igkXOQq.exe
  C:\Windows\System\igkXOQq.exe
  2⤵
  PID:1316
- C:\Windows\System\AVupvXh.exe
  C:\Windows\System\AVupvXh.exe
  2⤵
  PID:2824
- C:\Windows\System\onfHrXR.exe
  C:\Windows\System\onfHrXR.exe
  2⤵
  PID:1156
- C:\Windows\System\vKsZVlL.exe
  C:\Windows\System\vKsZVlL.exe
  2⤵
  PID:3016
- C:\Windows\System\GmPLwyd.exe
  C:\Windows\System\GmPLwyd.exe
  2⤵
  PID:2892
- C:\Windows\System\faWciCP.exe
  C:\Windows\System\faWciCP.exe
  2⤵
  PID:888
- C:\Windows\System\LpUAhtP.exe
  C:\Windows\System\LpUAhtP.exe
  2⤵
  PID:2660
- C:\Windows\System\viuMlPv.exe
  C:\Windows\System\viuMlPv.exe
  2⤵
  PID:2116
- C:\Windows\System\QPgvLAq.exe
  C:\Windows\System\QPgvLAq.exe
  2⤵
  PID:1136
- C:\Windows\System\lfaIVwU.exe
  C:\Windows\System\lfaIVwU.exe
  2⤵
  PID:572
- C:\Windows\System\AUTWXvf.exe
  C:\Windows\System\AUTWXvf.exe
  2⤵
  PID:948
- C:\Windows\System\ttTPavo.exe
  C:\Windows\System\ttTPavo.exe
  2⤵
  PID:892
- C:\Windows\System\JFYbuBF.exe
  C:\Windows\System\JFYbuBF.exe
  2⤵
  PID:2076
- C:\Windows\System\OKHajYC.exe
  C:\Windows\System\OKHajYC.exe
  2⤵
  PID:2180
- C:\Windows\System\SjEtEfY.exe
  C:\Windows\System\SjEtEfY.exe
  2⤵
  PID:2456
- C:\Windows\System\kKhPJIh.exe
  C:\Windows\System\kKhPJIh.exe
  2⤵
  PID:2424
- C:\Windows\System\egBFEJS.exe
  C:\Windows\System\egBFEJS.exe
  2⤵
  PID:2480
- C:\Windows\System\JmfYOTh.exe
  C:\Windows\System\JmfYOTh.exe
  2⤵
  PID:2596
- C:\Windows\System\WjKHLNz.exe
  C:\Windows\System\WjKHLNz.exe
  2⤵
  PID:2716
- C:\Windows\System\DeyIZTX.exe
  C:\Windows\System\DeyIZTX.exe
  2⤵
  PID:2380
- C:\Windows\System\qyHykFd.exe
  C:\Windows\System\qyHykFd.exe
  2⤵
  PID:1388
- C:\Windows\System\OttiiFG.exe
  C:\Windows\System\OttiiFG.exe
  2⤵
  PID:1204
- C:\Windows\System\mfsQQrs.exe
  C:\Windows\System\mfsQQrs.exe
  2⤵
  PID:1236
- C:\Windows\System\rzZKCYe.exe
  C:\Windows\System\rzZKCYe.exe
  2⤵
  PID:2696
- C:\Windows\System\vnYLZfp.exe
  C:\Windows\System\vnYLZfp.exe
  2⤵
  PID:1988
- C:\Windows\System\cejfwQA.exe
  C:\Windows\System\cejfwQA.exe
  2⤵
  PID:2120
- C:\Windows\System\loHAvrG.exe
  C:\Windows\System\loHAvrG.exe
  2⤵
  PID:1732
- C:\Windows\System\twQvPNP.exe
  C:\Windows\System\twQvPNP.exe
  2⤵
  PID:2852
- C:\Windows\System\lMBXexv.exe
  C:\Windows\System\lMBXexv.exe
  2⤵
  PID:1664
- C:\Windows\System\UFOrUYz.exe
  C:\Windows\System\UFOrUYz.exe
  2⤵
  PID:2148
- C:\Windows\System\cXmwWuI.exe
  C:\Windows\System\cXmwWuI.exe
  2⤵
  PID:1980
- C:\Windows\System\hCxNGPO.exe
  C:\Windows\System\hCxNGPO.exe
  2⤵
  PID:1784
- C:\Windows\System\bMrLifU.exe
  C:\Windows\System\bMrLifU.exe
  2⤵
  PID:2296
- C:\Windows\System\jGjPVIt.exe
  C:\Windows\System\jGjPVIt.exe
  2⤵
  PID:2960
- C:\Windows\System\okdYuIK.exe
  C:\Windows\System\okdYuIK.exe
  2⤵
  PID:3060
- C:\Windows\System\nWViJtB.exe
  C:\Windows\System\nWViJtB.exe
  2⤵
  PID:1152
- C:\Windows\System\bzEuswM.exe
  C:\Windows\System\bzEuswM.exe
  2⤵
  PID:1444
- C:\Windows\System\YggyGoN.exe
  C:\Windows\System\YggyGoN.exe
  2⤵
  PID:1068
- C:\Windows\System\VvMdowa.exe
  C:\Windows\System\VvMdowa.exe
  2⤵
  PID:1716
- C:\Windows\System\FwYEUQa.exe
  C:\Windows\System\FwYEUQa.exe
  2⤵
  PID:880
- C:\Windows\System\VyfFRyw.exe
  C:\Windows\System\VyfFRyw.exe
  2⤵
  PID:3040
- C:\Windows\System\lalQTNb.exe
  C:\Windows\System\lalQTNb.exe
  2⤵
  PID:2172
- C:\Windows\System\GhwHqZg.exe
  C:\Windows\System\GhwHqZg.exe
  2⤵
  PID:2468
- C:\Windows\System\yfpFAAO.exe
  C:\Windows\System\yfpFAAO.exe
  2⤵
  PID:2404
- C:\Windows\System\QJinHZF.exe
  C:\Windows\System\QJinHZF.exe
  2⤵
  PID:2996
- C:\Windows\System\rIHfuis.exe
  C:\Windows\System\rIHfuis.exe
  2⤵
  PID:1972
- C:\Windows\System\QrSAkLs.exe
  C:\Windows\System\QrSAkLs.exe
  2⤵
  PID:372
- C:\Windows\System\pUsfrLm.exe
  C:\Windows\System\pUsfrLm.exe
  2⤵
  PID:2416
- C:\Windows\System\ZvBvUaq.exe
  C:\Windows\System\ZvBvUaq.exe
  2⤵
  PID:1928
- C:\Windows\System\zkTjSPK.exe
  C:\Windows\System\zkTjSPK.exe
  2⤵
  PID:3104
- C:\Windows\System\lWcTEnF.exe
  C:\Windows\System\lWcTEnF.exe
  2⤵
  PID:3192
- C:\Windows\System\thnufHT.exe
  C:\Windows\System\thnufHT.exe
  2⤵
  PID:3208
- C:\Windows\System\InmWBaP.exe
  C:\Windows\System\InmWBaP.exe
  2⤵
  PID:3224
- C:\Windows\System\iBLhqQg.exe
  C:\Windows\System\iBLhqQg.exe
  2⤵
  PID:3240
- C:\Windows\System\hbvPDrE.exe
  C:\Windows\System\hbvPDrE.exe
  2⤵
  PID:3256
- C:\Windows\System\hFpEpoZ.exe
  C:\Windows\System\hFpEpoZ.exe
  2⤵
  PID:3272
- C:\Windows\System\yRxaxNJ.exe
  C:\Windows\System\yRxaxNJ.exe
  2⤵
  PID:3288
- C:\Windows\System\zwaSMFw.exe
  C:\Windows\System\zwaSMFw.exe
  2⤵
  PID:3304
- C:\Windows\System\BFLmlAn.exe
  C:\Windows\System\BFLmlAn.exe
  2⤵
  PID:3320
- C:\Windows\System\nPuUOBm.exe
  C:\Windows\System\nPuUOBm.exe
  2⤵
  PID:3336
- C:\Windows\System\DWrAaLC.exe
  C:\Windows\System\DWrAaLC.exe
  2⤵
  PID:3352
- C:\Windows\System\UzcuNos.exe
  C:\Windows\System\UzcuNos.exe
  2⤵
  PID:3368
- C:\Windows\System\cBMpXXm.exe
  C:\Windows\System\cBMpXXm.exe
  2⤵
  PID:3384
- C:\Windows\System\UtMmZoo.exe
  C:\Windows\System\UtMmZoo.exe
  2⤵
  PID:3408
- C:\Windows\System\sAJdlaH.exe
  C:\Windows\System\sAJdlaH.exe
  2⤵
  PID:3424
- C:\Windows\System\NcsUErc.exe
  C:\Windows\System\NcsUErc.exe
  2⤵
  PID:3440
- C:\Windows\System\uFKDgWJ.exe
  C:\Windows\System\uFKDgWJ.exe
  2⤵
  PID:3456
- C:\Windows\System\mqqQvVO.exe
  C:\Windows\System\mqqQvVO.exe
  2⤵
  PID:3472
- C:\Windows\System\wRusuiv.exe
  C:\Windows\System\wRusuiv.exe
  2⤵
  PID:3488
- C:\Windows\System\OoTsGeo.exe
  C:\Windows\System\OoTsGeo.exe
  2⤵
  PID:3504
- C:\Windows\System\cRZkiQB.exe
  C:\Windows\System\cRZkiQB.exe
  2⤵
  PID:3520
- C:\Windows\System\DtKOCST.exe
  C:\Windows\System\DtKOCST.exe
  2⤵
  PID:3536
- C:\Windows\System\HHmuGNL.exe
  C:\Windows\System\HHmuGNL.exe
  2⤵
  PID:3552
- C:\Windows\System\hXiHXjS.exe
  C:\Windows\System\hXiHXjS.exe
  2⤵
  PID:3568
- C:\Windows\System\fijZZgZ.exe
  C:\Windows\System\fijZZgZ.exe
  2⤵
  PID:3584
- C:\Windows\System\stqfPRq.exe
  C:\Windows\System\stqfPRq.exe
  2⤵
  PID:3600
- C:\Windows\System\TAqTrkq.exe
  C:\Windows\System\TAqTrkq.exe
  2⤵
  PID:3616
- C:\Windows\System\YbQxGIt.exe
  C:\Windows\System\YbQxGIt.exe
  2⤵
  PID:3632
- C:\Windows\System\QyUYOPX.exe
  C:\Windows\System\QyUYOPX.exe
  2⤵
  PID:3648
- C:\Windows\System\CJmsoNE.exe
  C:\Windows\System\CJmsoNE.exe
  2⤵
  PID:3664
- C:\Windows\System\hmVtFKZ.exe
  C:\Windows\System\hmVtFKZ.exe
  2⤵
  PID:3680
- C:\Windows\System\NoyTpSc.exe
  C:\Windows\System\NoyTpSc.exe
  2⤵
  PID:3696
- C:\Windows\System\gPIbPUk.exe
  C:\Windows\System\gPIbPUk.exe
  2⤵
  PID:3712
- C:\Windows\System\YBUnHqg.exe
  C:\Windows\System\YBUnHqg.exe
  2⤵
  PID:3728
- C:\Windows\System\HItPtUD.exe
  C:\Windows\System\HItPtUD.exe
  2⤵
  PID:3744
- C:\Windows\System\XWXncgz.exe
  C:\Windows\System\XWXncgz.exe
  2⤵
  PID:3760
- C:\Windows\System\ymqBXea.exe
  C:\Windows\System\ymqBXea.exe
  2⤵
  PID:3780
- C:\Windows\System\yZHRuun.exe
  C:\Windows\System\yZHRuun.exe
  2⤵
  PID:3796
- C:\Windows\System\IOaWZTw.exe
  C:\Windows\System\IOaWZTw.exe
  2⤵
  PID:3812
- C:\Windows\System\kyFzRTq.exe
  C:\Windows\System\kyFzRTq.exe
  2⤵
  PID:3828
- C:\Windows\System\rbouDHT.exe
  C:\Windows\System\rbouDHT.exe
  2⤵
  PID:3844
- C:\Windows\System\JuSycFC.exe
  C:\Windows\System\JuSycFC.exe
  2⤵
  PID:3860
- C:\Windows\System\PIXcDIv.exe
  C:\Windows\System\PIXcDIv.exe
  2⤵
  PID:3876
- C:\Windows\System\hutnKKz.exe
  C:\Windows\System\hutnKKz.exe
  2⤵
  PID:3892
- C:\Windows\System\YAVAUad.exe
  C:\Windows\System\YAVAUad.exe
  2⤵
  PID:3908
- C:\Windows\System\WkUOWnx.exe
  C:\Windows\System\WkUOWnx.exe
  2⤵
  PID:3924
- C:\Windows\System\ZpoBhoG.exe
  C:\Windows\System\ZpoBhoG.exe
  2⤵
  PID:3944
- C:\Windows\System\RLKcjYe.exe
  C:\Windows\System\RLKcjYe.exe
  2⤵
  PID:3960
- C:\Windows\System\JSPvfwu.exe
  C:\Windows\System\JSPvfwu.exe
  2⤵
  PID:3976
- C:\Windows\System\MClvGJL.exe
  C:\Windows\System\MClvGJL.exe
  2⤵
  PID:3996
- C:\Windows\System\niGqOdh.exe
  C:\Windows\System\niGqOdh.exe
  2⤵
  PID:4012
- C:\Windows\System\CfBpzWf.exe
  C:\Windows\System\CfBpzWf.exe
  2⤵
  PID:4032
- C:\Windows\System\CUhUKKi.exe
  C:\Windows\System\CUhUKKi.exe
  2⤵
  PID:4064
- C:\Windows\System\HbvtMoe.exe
  C:\Windows\System\HbvtMoe.exe
  2⤵
  PID:4088
- C:\Windows\System\eiwKfXD.exe
  C:\Windows\System\eiwKfXD.exe
  2⤵
  PID:2620
- C:\Windows\System\PDoaUZF.exe
  C:\Windows\System\PDoaUZF.exe
  2⤵
  PID:2512
- C:\Windows\System\VlRySGr.exe
  C:\Windows\System\VlRySGr.exe
  2⤵
  PID:1332
- C:\Windows\System\kJkIyJE.exe
  C:\Windows\System\kJkIyJE.exe
  2⤵
  PID:1548
- C:\Windows\System\NLBjWiJ.exe
  C:\Windows\System\NLBjWiJ.exe
  2⤵
  PID:672
- C:\Windows\System\LImUsSe.exe
  C:\Windows\System\LImUsSe.exe
  2⤵
  PID:2100
- C:\Windows\System\kBopRQt.exe
  C:\Windows\System\kBopRQt.exe
  2⤵
  PID:3088
- C:\Windows\System\AaXynYr.exe
  C:\Windows\System\AaXynYr.exe
  2⤵
  PID:2104
- C:\Windows\System\rmAYTJC.exe
  C:\Windows\System\rmAYTJC.exe
  2⤵
  PID:2812
- C:\Windows\System\fnMzGVL.exe
  C:\Windows\System\fnMzGVL.exe
  2⤵
  PID:1904
- C:\Windows\System\qzZKELa.exe
  C:\Windows\System\qzZKELa.exe
  2⤵
  PID:1140
- C:\Windows\System\jDXfDfL.exe
  C:\Windows\System\jDXfDfL.exe
  2⤵
  PID:3136
- C:\Windows\System\QKXalXK.exe
  C:\Windows\System\QKXalXK.exe
  2⤵
  PID:3152
- C:\Windows\System\LcVWcSa.exe
  C:\Windows\System\LcVWcSa.exe
  2⤵
  PID:1896
- C:\Windows\System\EUJDGkD.exe
  C:\Windows\System\EUJDGkD.exe
  2⤵
  PID:764
- C:\Windows\System\HbeJEDK.exe
  C:\Windows\System\HbeJEDK.exe
  2⤵
  PID:3204
- C:\Windows\System\tfpjKev.exe
  C:\Windows\System\tfpjKev.exe
  2⤵
  PID:3176
- C:\Windows\System\dDTtpKT.exe
  C:\Windows\System\dDTtpKT.exe
  2⤵
  PID:3180
- C:\Windows\System\EnGESju.exe
  C:\Windows\System\EnGESju.exe
  2⤵
  PID:2276
- C:\Windows\System\bOpCLrq.exe
  C:\Windows\System\bOpCLrq.exe
  2⤵
  PID:3332
- C:\Windows\System\OTuyRmX.exe
  C:\Windows\System\OTuyRmX.exe
  2⤵
  PID:3360
- C:\Windows\System\LoJMRRf.exe
  C:\Windows\System\LoJMRRf.exe
  2⤵
  PID:1712
- C:\Windows\System\WeyaEfq.exe
  C:\Windows\System\WeyaEfq.exe
  2⤵
  PID:3316
- C:\Windows\System\aAQIzgt.exe
  C:\Windows\System\aAQIzgt.exe
  2⤵
  PID:3380
- C:\Windows\System\WvpLAeC.exe
  C:\Windows\System\WvpLAeC.exe
  2⤵
  PID:1404
- C:\Windows\System\nYAGrWj.exe
  C:\Windows\System\nYAGrWj.exe
  2⤵
  PID:1920
- C:\Windows\System\BPgQhbx.exe
  C:\Windows\System\BPgQhbx.exe
  2⤵
  PID:3416
- C:\Windows\System\UpYzyWj.exe
  C:\Windows\System\UpYzyWj.exe
  2⤵
  PID:1924
- C:\Windows\System\yZEScAM.exe
  C:\Windows\System\yZEScAM.exe
  2⤵
  PID:3532
- C:\Windows\System\ntvjoWQ.exe
  C:\Windows\System\ntvjoWQ.exe
  2⤵
  PID:3512
- C:\Windows\System\AQWjwIe.exe
  C:\Windows\System\AQWjwIe.exe
  2⤵
  PID:3560
- C:\Windows\System\ccgeavv.exe
  C:\Windows\System\ccgeavv.exe
  2⤵
  PID:3596
- C:\Windows\System\VvtpKTt.exe
  C:\Windows\System\VvtpKTt.exe
  2⤵
  PID:2004
- C:\Windows\System\BQjMwVE.exe
  C:\Windows\System\BQjMwVE.exe
  2⤵
  PID:3580
- C:\Windows\System\jgdMZbS.exe
  C:\Windows\System\jgdMZbS.exe
  2⤵
  PID:3688
- C:\Windows\System\yzqeFoN.exe
  C:\Windows\System\yzqeFoN.exe
  2⤵
  PID:576
- C:\Windows\System\VgDUQYg.exe
  C:\Windows\System\VgDUQYg.exe
  2⤵
  PID:3752
- C:\Windows\System\MupbLNO.exe
  C:\Windows\System\MupbLNO.exe
  2⤵
  PID:580
- C:\Windows\System\iMYDlkr.exe
  C:\Windows\System\iMYDlkr.exe
  2⤵
  PID:3736
- C:\Windows\System\ZdWwuWn.exe
  C:\Windows\System\ZdWwuWn.exe
  2⤵
  PID:3112
- C:\Windows\System\HaAKUPl.exe
  C:\Windows\System\HaAKUPl.exe
  2⤵
  PID:3824
- C:\Windows\System\iOcwqzb.exe
  C:\Windows\System\iOcwqzb.exe
  2⤵
  PID:3808
- C:\Windows\System\DtgZuJU.exe
  C:\Windows\System\DtgZuJU.exe
  2⤵
  PID:3840
- C:\Windows\System\UTuqviA.exe
  C:\Windows\System\UTuqviA.exe
  2⤵
  PID:3916
- C:\Windows\System\mHBSRae.exe
  C:\Windows\System\mHBSRae.exe
  2⤵
  PID:3956
- C:\Windows\System\zHFfLQS.exe
  C:\Windows\System\zHFfLQS.exe
  2⤵
  PID:3972
- C:\Windows\System\cJkNKSn.exe
  C:\Windows\System\cJkNKSn.exe
  2⤵
  PID:3940
- C:\Windows\System\Qrjpdvh.exe
  C:\Windows\System\Qrjpdvh.exe
  2⤵
  PID:4028
- C:\Windows\System\VMxotlN.exe
  C:\Windows\System\VMxotlN.exe
  2⤵
  PID:4048
- C:\Windows\System\cBRMlRR.exe
  C:\Windows\System\cBRMlRR.exe
  2⤵
  PID:4040
- C:\Windows\System\GAoJOtx.exe
  C:\Windows\System\GAoJOtx.exe
  2⤵
  PID:2552
- C:\Windows\System\AiBoJyz.exe
  C:\Windows\System\AiBoJyz.exe
  2⤵
  PID:2964
- C:\Windows\System\joWHztv.exe
  C:\Windows\System\joWHztv.exe
  2⤵
  PID:2220
- C:\Windows\System\iSAkYbE.exe
  C:\Windows\System\iSAkYbE.exe
  2⤵
  PID:2128
- C:\Windows\System\ItxzPSl.exe
  C:\Windows\System\ItxzPSl.exe
  2⤵
  PID:1600
- C:\Windows\System\VKpxqyw.exe
  C:\Windows\System\VKpxqyw.exe
  2⤵
  PID:3084
- C:\Windows\System\mJQCSRC.exe
  C:\Windows\System\mJQCSRC.exe
  2⤵
  PID:2820
- C:\Windows\System\DBXmomA.exe
  C:\Windows\System\DBXmomA.exe
  2⤵
  PID:2400
- C:\Windows\System\OkAnCTm.exe
  C:\Windows\System\OkAnCTm.exe
  2⤵
  PID:3160
- C:\Windows\System\XsRoXLH.exe
  C:\Windows\System\XsRoXLH.exe
  2⤵
  PID:3296
- C:\Windows\System\oKnLvZz.exe
  C:\Windows\System\oKnLvZz.exe
  2⤵
  PID:1604
- C:\Windows\System\LJWwVIg.exe
  C:\Windows\System\LJWwVIg.exe
  2⤵
  PID:2224
- C:\Windows\System\VAOAtov.exe
  C:\Windows\System\VAOAtov.exe
  2⤵
  PID:3188
- C:\Windows\System\CCgsImK.exe
  C:\Windows\System\CCgsImK.exe
  2⤵
  PID:3280
- C:\Windows\System\uFUSBeV.exe
  C:\Windows\System\uFUSBeV.exe
  2⤵
  PID:3140
- C:\Windows\System\yMoBxUP.exe
  C:\Windows\System\yMoBxUP.exe
  2⤵
  PID:3452
- C:\Windows\System\uCwzolT.exe
  C:\Windows\System\uCwzolT.exe
  2⤵
  PID:3528
- C:\Windows\System\uxUPlqY.exe
  C:\Windows\System\uxUPlqY.exe
  2⤵
  PID:3420
- C:\Windows\System\EVbZcid.exe
  C:\Windows\System\EVbZcid.exe
  2⤵
  PID:3516
- C:\Windows\System\hnxwTYS.exe
  C:\Windows\System\hnxwTYS.exe
  2⤵
  PID:3608
- C:\Windows\System\LyxijtB.exe
  C:\Windows\System\LyxijtB.exe
  2⤵
  PID:3548
- C:\Windows\System\XcDabDQ.exe
  C:\Windows\System\XcDabDQ.exe
  2⤵
  PID:3788
- C:\Windows\System\dEoQCsr.exe
  C:\Windows\System\dEoQCsr.exe
  2⤵
  PID:3768
- C:\Windows\System\tfnphxU.exe
  C:\Windows\System\tfnphxU.exe
  2⤵
  PID:2656
- C:\Windows\System\LdxHjaH.exe
  C:\Windows\System\LdxHjaH.exe
  2⤵
  PID:3628
- C:\Windows\System\lwUgZny.exe
  C:\Windows\System\lwUgZny.exe
  2⤵
  PID:3932
- C:\Windows\System\xNyfNaQ.exe
  C:\Windows\System\xNyfNaQ.exe
  2⤵
  PID:3936
- C:\Windows\System\vOPSIEW.exe
  C:\Windows\System\vOPSIEW.exe
  2⤵
  PID:3900
- C:\Windows\System\KUHranA.exe
  C:\Windows\System\KUHranA.exe
  2⤵
  PID:3856
- C:\Windows\System\DaiMXSL.exe
  C:\Windows\System\DaiMXSL.exe
  2⤵
  PID:4004
- C:\Windows\System\bVuDlPL.exe
  C:\Windows\System\bVuDlPL.exe
  2⤵
  PID:1992
- C:\Windows\System\IvHpgsK.exe
  C:\Windows\System\IvHpgsK.exe
  2⤵
  PID:2032
- C:\Windows\System\HmvZqlq.exe
  C:\Windows\System\HmvZqlq.exe
  2⤵
  PID:3096
- C:\Windows\System\dHfoeaE.exe
  C:\Windows\System\dHfoeaE.exe
  2⤵
  PID:3132
- C:\Windows\System\muDajit.exe
  C:\Windows\System\muDajit.exe
  2⤵
  PID:1188
- C:\Windows\System\ZTGamwL.exe
  C:\Windows\System\ZTGamwL.exe
  2⤵
  PID:3300
- C:\Windows\System\PRkDOvt.exe
  C:\Windows\System\PRkDOvt.exe
  2⤵
  PID:884
- C:\Windows\System\JVeUdCy.exe
  C:\Windows\System\JVeUdCy.exe
  2⤵
  PID:3496
- C:\Windows\System\ustYFur.exe
  C:\Windows\System\ustYFur.exe
  2⤵
  PID:3400
- C:\Windows\System\eEeMGLb.exe
  C:\Windows\System\eEeMGLb.exe
  2⤵
  PID:3592
- C:\Windows\System\ICMDUAR.exe
  C:\Windows\System\ICMDUAR.exe
  2⤵
  PID:3484
- C:\Windows\System\BTLZGPe.exe
  C:\Windows\System\BTLZGPe.exe
  2⤵
  PID:2124
- C:\Windows\System\xOPCENG.exe
  C:\Windows\System\xOPCENG.exe
  2⤵
  PID:2272
- C:\Windows\System\wEoiTWu.exe
  C:\Windows\System\wEoiTWu.exe
  2⤵
  PID:4080
- C:\Windows\System\LNYebpN.exe
  C:\Windows\System\LNYebpN.exe
  2⤵
  PID:2880
- C:\Windows\System\GssrtuT.exe
  C:\Windows\System\GssrtuT.exe
  2⤵
  PID:4008
- C:\Windows\System\vFTzMuq.exe
  C:\Windows\System\vFTzMuq.exe
  2⤵
  PID:1116
- C:\Windows\System\qpTqEGe.exe
  C:\Windows\System\qpTqEGe.exe
  2⤵
  PID:3264
- C:\Windows\System\FvKSOeI.exe
  C:\Windows\System\FvKSOeI.exe
  2⤵
  PID:3284
- C:\Windows\System\wVVgpTW.exe
  C:\Windows\System\wVVgpTW.exe
  2⤵
  PID:952
- C:\Windows\System\QBRffga.exe
  C:\Windows\System\QBRffga.exe
  2⤵
  PID:3756
- C:\Windows\System\YwelwGN.exe
  C:\Windows\System\YwelwGN.exe
  2⤵
  PID:3436
- C:\Windows\System\bkkuRqG.exe
  C:\Windows\System\bkkuRqG.exe
  2⤵
  PID:3988
- C:\Windows\System\aWPYjYa.exe
  C:\Windows\System\aWPYjYa.exe
  2⤵
  PID:3888
- C:\Windows\System\AhDSZlA.exe
  C:\Windows\System\AhDSZlA.exe
  2⤵
  PID:1560
- C:\Windows\System\QcASiDu.exe
  C:\Windows\System\QcASiDu.exe
  2⤵
  PID:3200
- C:\Windows\System\nXvsxlF.exe
  C:\Windows\System\nXvsxlF.exe
  2⤵
  PID:3872
- C:\Windows\System\nHAMvbd.exe
  C:\Windows\System\nHAMvbd.exe
  2⤵
  PID:4108
- C:\Windows\System\NzvKVrB.exe
  C:\Windows\System\NzvKVrB.exe
  2⤵
  PID:4124
- C:\Windows\System\rqbivpP.exe
  C:\Windows\System\rqbivpP.exe
  2⤵
  PID:4140
- C:\Windows\System\OxOVrfh.exe
  C:\Windows\System\OxOVrfh.exe
  2⤵
  PID:4156
- C:\Windows\System\OKuDTfW.exe
  C:\Windows\System\OKuDTfW.exe
  2⤵
  PID:4172
- C:\Windows\System\AtYfnKE.exe
  C:\Windows\System\AtYfnKE.exe
  2⤵
  PID:4188
- C:\Windows\System\SywHANc.exe
  C:\Windows\System\SywHANc.exe
  2⤵
  PID:4204
- C:\Windows\System\jtCmUuP.exe
  C:\Windows\System\jtCmUuP.exe
  2⤵
  PID:4220
- C:\Windows\System\etXhIkC.exe
  C:\Windows\System\etXhIkC.exe
  2⤵
  PID:4236
- C:\Windows\System\rldbHtD.exe
  C:\Windows\System\rldbHtD.exe
  2⤵
  PID:4364
- C:\Windows\System\hVboQOk.exe
  C:\Windows\System\hVboQOk.exe
  2⤵
  PID:4392
- C:\Windows\System\CfFtwnK.exe
  C:\Windows\System\CfFtwnK.exe
  2⤵
  PID:4408
- C:\Windows\System\MFExUEv.exe
  C:\Windows\System\MFExUEv.exe
  2⤵
  PID:4424
- C:\Windows\System\KYlXzPY.exe
  C:\Windows\System\KYlXzPY.exe
  2⤵
  PID:4452
- C:\Windows\System\XAiGIOJ.exe
  C:\Windows\System\XAiGIOJ.exe
  2⤵
  PID:4468
- C:\Windows\System\YoTJNdm.exe
  C:\Windows\System\YoTJNdm.exe
  2⤵
  PID:4492
- C:\Windows\System\CJpsGsl.exe
  C:\Windows\System\CJpsGsl.exe
  2⤵
  PID:4508
- C:\Windows\System\KvJCjTR.exe
  C:\Windows\System\KvJCjTR.exe
  2⤵
  PID:4524
- C:\Windows\System\XSbHtvi.exe
  C:\Windows\System\XSbHtvi.exe
  2⤵
  PID:4540
- C:\Windows\System\YWjCcHr.exe
  C:\Windows\System\YWjCcHr.exe
  2⤵
  PID:4556
- C:\Windows\System\jmXADfC.exe
  C:\Windows\System\jmXADfC.exe
  2⤵
  PID:4572
- C:\Windows\System\tGdXxNs.exe
  C:\Windows\System\tGdXxNs.exe
  2⤵
  PID:4588
- C:\Windows\System\KxPWVSx.exe
  C:\Windows\System\KxPWVSx.exe
  2⤵
  PID:4604
- C:\Windows\System\sfuJqyn.exe
  C:\Windows\System\sfuJqyn.exe
  2⤵
  PID:4620
- C:\Windows\System\DLjqBbf.exe
  C:\Windows\System\DLjqBbf.exe
  2⤵
  PID:4636
- C:\Windows\System\wYaltFt.exe
  C:\Windows\System\wYaltFt.exe
  2⤵
  PID:4652
- C:\Windows\System\ihUYDZQ.exe
  C:\Windows\System\ihUYDZQ.exe
  2⤵
  PID:4668
- C:\Windows\System\dFbPpPv.exe
  C:\Windows\System\dFbPpPv.exe
  2⤵
  PID:4684
- C:\Windows\System\MvunBNp.exe
  C:\Windows\System\MvunBNp.exe
  2⤵
  PID:4700
- C:\Windows\System\xYPsvVz.exe
  C:\Windows\System\xYPsvVz.exe
  2⤵
  PID:4716
- C:\Windows\System\sozMnBh.exe
  C:\Windows\System\sozMnBh.exe
  2⤵
  PID:4736
- C:\Windows\System\ijadEfk.exe
  C:\Windows\System\ijadEfk.exe
  2⤵
  PID:4752
- C:\Windows\System\ZUUAwEa.exe
  C:\Windows\System\ZUUAwEa.exe
  2⤵
  PID:4768
- C:\Windows\System\bNLnwgr.exe
  C:\Windows\System\bNLnwgr.exe
  2⤵
  PID:4788
- C:\Windows\System\OXdFdTA.exe
  C:\Windows\System\OXdFdTA.exe
  2⤵
  PID:4804
- C:\Windows\System\cmBbQCE.exe
  C:\Windows\System\cmBbQCE.exe
  2⤵
  PID:4820
- C:\Windows\System\glTZBqZ.exe
  C:\Windows\System\glTZBqZ.exe
  2⤵
  PID:4840
- C:\Windows\System\YVLHqeJ.exe
  C:\Windows\System\YVLHqeJ.exe
  2⤵
  PID:4856
- C:\Windows\System\VoEuzuF.exe
  C:\Windows\System\VoEuzuF.exe
  2⤵
  PID:4872
- C:\Windows\System\xxuqCNu.exe
  C:\Windows\System\xxuqCNu.exe
  2⤵
  PID:4892
- C:\Windows\System\bDGNNKY.exe
  C:\Windows\System\bDGNNKY.exe
  2⤵
  PID:4908
- C:\Windows\System\HBqvkCD.exe
  C:\Windows\System\HBqvkCD.exe
  2⤵
  PID:4924
- C:\Windows\System\GhPYRXO.exe
  C:\Windows\System\GhPYRXO.exe
  2⤵
  PID:4940
- C:\Windows\System\XjOnVJx.exe
  C:\Windows\System\XjOnVJx.exe
  2⤵
  PID:4956
- C:\Windows\System\ZuCJxPL.exe
  C:\Windows\System\ZuCJxPL.exe
  2⤵
  PID:4972
- C:\Windows\System\eIelrui.exe
  C:\Windows\System\eIelrui.exe
  2⤵
  PID:4988
- C:\Windows\System\GNSpEje.exe
  C:\Windows\System\GNSpEje.exe
  2⤵
  PID:5004
- C:\Windows\System\xhiQvGt.exe
  C:\Windows\System\xhiQvGt.exe
  2⤵
  PID:5020
- C:\Windows\System\unNYbhj.exe
  C:\Windows\System\unNYbhj.exe
  2⤵
  PID:5036
- C:\Windows\System\GSFwAUA.exe
  C:\Windows\System\GSFwAUA.exe
  2⤵
  PID:5052
- C:\Windows\System\IXFEvoF.exe
  C:\Windows\System\IXFEvoF.exe
  2⤵
  PID:5068
- C:\Windows\System\VlxRgWi.exe
  C:\Windows\System\VlxRgWi.exe
  2⤵
  PID:5084
- C:\Windows\System\NVuOEZs.exe
  C:\Windows\System\NVuOEZs.exe
  2⤵
  PID:5100
- C:\Windows\System\XhahKNY.exe
  C:\Windows\System\XhahKNY.exe
  2⤵
  PID:5116
- C:\Windows\System\Bzleglg.exe
  C:\Windows\System\Bzleglg.exe
  2⤵
  PID:4056
- C:\Windows\System\rCktZmu.exe
  C:\Windows\System\rCktZmu.exe
  2⤵
  PID:4116
- C:\Windows\System\gxFPVTS.exe
  C:\Windows\System\gxFPVTS.exe
  2⤵
  PID:3080
- C:\Windows\System\cSWUuyE.exe
  C:\Windows\System\cSWUuyE.exe
  2⤵
  PID:3660
- C:\Windows\System\LNbDysO.exe
  C:\Windows\System\LNbDysO.exe
  2⤵
  PID:4244
- C:\Windows\System\XvMwzRv.exe
  C:\Windows\System\XvMwzRv.exe
  2⤵
  PID:4196
- C:\Windows\System\PXDDzKN.exe
  C:\Windows\System\PXDDzKN.exe
  2⤵
  PID:4104
- C:\Windows\System\pDzaGww.exe
  C:\Windows\System\pDzaGww.exe
  2⤵
  PID:4280
- C:\Windows\System\AcGeOiK.exe
  C:\Windows\System\AcGeOiK.exe
  2⤵
  PID:4300
- C:\Windows\System\YaTJOvj.exe
  C:\Windows\System\YaTJOvj.exe
  2⤵
  PID:4316
- C:\Windows\System\FyXOgcJ.exe
  C:\Windows\System\FyXOgcJ.exe
  2⤵
  PID:4332
- C:\Windows\System\GbfgDev.exe
  C:\Windows\System\GbfgDev.exe
  2⤵
  PID:4348
- C:\Windows\System\NkxKhHa.exe
  C:\Windows\System\NkxKhHa.exe
  2⤵
  PID:4372
- C:\Windows\System\ntxNxQC.exe
  C:\Windows\System\ntxNxQC.exe
  2⤵
  PID:4416
- C:\Windows\System\ZSDygBz.exe
  C:\Windows\System\ZSDygBz.exe
  2⤵
  PID:4400
- C:\Windows\System\WECRNdV.exe
  C:\Windows\System\WECRNdV.exe
  2⤵
  PID:4436
- C:\Windows\System\xbwnWYI.exe
  C:\Windows\System\xbwnWYI.exe
  2⤵
  PID:4464
- C:\Windows\System\ZmeNByc.exe
  C:\Windows\System\ZmeNByc.exe
  2⤵
  PID:4536
- C:\Windows\System\wjCbsKr.exe
  C:\Windows\System\wjCbsKr.exe
  2⤵
  PID:4520
- C:\Windows\System\RahdtwD.exe
  C:\Windows\System\RahdtwD.exe
  2⤵
  PID:4580
- C:\Windows\System\ETuTJRG.exe
  C:\Windows\System\ETuTJRG.exe
  2⤵
  PID:4676
- C:\Windows\System\INpYxte.exe
  C:\Windows\System\INpYxte.exe
  2⤵
  PID:4632
- C:\Windows\System\tspvukS.exe
  C:\Windows\System\tspvukS.exe
  2⤵
  PID:4692
- C:\Windows\System\BhtACmc.exe
  C:\Windows\System\BhtACmc.exe
  2⤵
  PID:4744
- C:\Windows\System\jcHfwSe.exe
  C:\Windows\System\jcHfwSe.exe
  2⤵
  PID:4776
- C:\Windows\System\QHEBMJi.exe
  C:\Windows\System\QHEBMJi.exe
  2⤵
  PID:4600
- C:\Windows\System\ktuoxfd.exe
  C:\Windows\System\ktuoxfd.exe
  2⤵
  PID:4760
- C:\Windows\System\RcyuKEL.exe
  C:\Windows\System\RcyuKEL.exe
  2⤵
  PID:4828
- C:\Windows\System\CyohCPX.exe
  C:\Windows\System\CyohCPX.exe
  2⤵
  PID:4884
- C:\Windows\System\SEcRNyN.exe
  C:\Windows\System\SEcRNyN.exe
  2⤵
  PID:4920
- C:\Windows\System\EPQaVbH.exe
  C:\Windows\System\EPQaVbH.exe
  2⤵
  PID:4836
- C:\Windows\System\beSeewq.exe
  C:\Windows\System\beSeewq.exe
  2⤵
  PID:4964
- C:\Windows\System\nvMFoqT.exe
  C:\Windows\System\nvMFoqT.exe
  2⤵
  PID:5012
- C:\Windows\System\PIlVLCX.exe
  C:\Windows\System\PIlVLCX.exe
  2⤵
  PID:5000
- C:\Windows\System\TFPwqKg.exe
  C:\Windows\System\TFPwqKg.exe
  2⤵
  PID:5076
- C:\Windows\System\FEgXKLt.exe
  C:\Windows\System\FEgXKLt.exe
  2⤵
  PID:5108
- C:\Windows\System\DRobUUM.exe
  C:\Windows\System\DRobUUM.exe
  2⤵
  PID:5060
- C:\Windows\System\HwtrhOP.exe
  C:\Windows\System\HwtrhOP.exe
  2⤵
  PID:2836
- C:\Windows\System\yPrHLWS.exe
  C:\Windows\System\yPrHLWS.exe
  2⤵
  PID:4132
- C:\Windows\System\VLvntuM.exe
  C:\Windows\System\VLvntuM.exe
  2⤵
  PID:4212
- C:\Windows\System\QmuRQPH.exe
  C:\Windows\System\QmuRQPH.exe
  2⤵
  PID:4148
- C:\Windows\System\iyiJtWl.exe
  C:\Windows\System\iyiJtWl.exe
  2⤵
  PID:4308
- C:\Windows\System\tyBIcOh.exe
  C:\Windows\System\tyBIcOh.exe
  2⤵
  PID:4344
- C:\Windows\System\SFeHupa.exe
  C:\Windows\System\SFeHupa.exe
  2⤵
  PID:4404
- C:\Windows\System\EmDgfDB.exe
  C:\Windows\System\EmDgfDB.exe
  2⤵
  PID:4500
- C:\Windows\System\RCwqaZa.exe
  C:\Windows\System\RCwqaZa.exe
  2⤵
  PID:4420
- C:\Windows\System\KlbLFCC.exe
  C:\Windows\System\KlbLFCC.exe
  2⤵
  PID:4388
- C:\Windows\System\wPPrHMB.exe
  C:\Windows\System\wPPrHMB.exe
  2⤵
  PID:4484
- C:\Windows\System\CKDxFyI.exe
  C:\Windows\System\CKDxFyI.exe
  2⤵
  PID:4612
- C:\Windows\System\PlvCAcm.exe
  C:\Windows\System\PlvCAcm.exe
  2⤵
  PID:4628
- C:\Windows\System\guFSVDG.exe
  C:\Windows\System\guFSVDG.exe
  2⤵
  PID:4596
- C:\Windows\System\JJsWcsC.exe
  C:\Windows\System\JJsWcsC.exe
  2⤵
  PID:4904
- C:\Windows\System\PqMqISL.exe
  C:\Windows\System\PqMqISL.exe
  2⤵
  PID:4816
- C:\Windows\System\WAsjxDo.exe
  C:\Windows\System\WAsjxDo.exe
  2⤵
  PID:4996
- C:\Windows\System\zgEAoKc.exe
  C:\Windows\System\zgEAoKc.exe
  2⤵
  PID:4984
- C:\Windows\System\Iruhqfz.exe
  C:\Windows\System\Iruhqfz.exe
  2⤵
  PID:5032
- C:\Windows\System\DPJvliG.exe
  C:\Windows\System\DPJvliG.exe
  2⤵
  PID:3792
- C:\Windows\System\QiuuQAJ.exe
  C:\Windows\System\QiuuQAJ.exe
  2⤵
  PID:5096
- C:\Windows\System\hGcplgj.exe
  C:\Windows\System\hGcplgj.exe
  2⤵
  PID:4232
- C:\Windows\System\HgZDufy.exe
  C:\Windows\System\HgZDufy.exe
  2⤵
  PID:4480
- C:\Windows\System\DfCeopf.exe
  C:\Windows\System\DfCeopf.exe
  2⤵
  PID:4552
- C:\Windows\System\jvKLtsl.exe
  C:\Windows\System\jvKLtsl.exe
  2⤵
  PID:4440
- C:\Windows\System\NOGTlSs.exe
  C:\Windows\System\NOGTlSs.exe
  2⤵
  PID:4644
- C:\Windows\System\jshTWZd.exe
  C:\Windows\System\jshTWZd.exe
  2⤵
  PID:4852
- C:\Windows\System\IKVgiLq.exe
  C:\Windows\System\IKVgiLq.exe
  2⤵
  PID:4932
- C:\Windows\System\bSlWjyE.exe
  C:\Windows\System\bSlWjyE.exe
  2⤵
  PID:2496
- C:\Windows\System\gjhlrMI.exe
  C:\Windows\System\gjhlrMI.exe
  2⤵
  PID:5048
- C:\Windows\System\iIQKAju.exe
  C:\Windows\System\iIQKAju.exe
  2⤵
  PID:4340
- C:\Windows\System\xYVsOby.exe
  C:\Windows\System\xYVsOby.exe
  2⤵
  PID:4356
- C:\Windows\System\SEUyRgf.exe
  C:\Windows\System\SEUyRgf.exe
  2⤵
  PID:4184
- C:\Windows\System\aRtXaCc.exe
  C:\Windows\System\aRtXaCc.exe
  2⤵
  PID:4784
- C:\Windows\System\wDbtcnP.exe
  C:\Windows\System\wDbtcnP.exe
  2⤵
  PID:5144
- C:\Windows\System\EDRklbZ.exe
  C:\Windows\System\EDRklbZ.exe
  2⤵
  PID:5164
- C:\Windows\System\HpqcWcI.exe
  C:\Windows\System\HpqcWcI.exe
  2⤵
  PID:5180
- C:\Windows\System\CItQfyL.exe
  C:\Windows\System\CItQfyL.exe
  2⤵
  PID:5196
- C:\Windows\System\soFYZou.exe
  C:\Windows\System\soFYZou.exe
  2⤵
  PID:5212
- C:\Windows\System\bQbJbps.exe
  C:\Windows\System\bQbJbps.exe
  2⤵
  PID:5228
- C:\Windows\System\kjDsbaw.exe
  C:\Windows\System\kjDsbaw.exe
  2⤵
  PID:5244
- C:\Windows\System\FKFvQJd.exe
  C:\Windows\System\FKFvQJd.exe
  2⤵
  PID:5260
- C:\Windows\System\EeNSJYM.exe
  C:\Windows\System\EeNSJYM.exe
  2⤵
  PID:5276
- C:\Windows\System\JkqtjJf.exe
  C:\Windows\System\JkqtjJf.exe
  2⤵
  PID:5292
- C:\Windows\System\bQgtxgq.exe
  C:\Windows\System\bQgtxgq.exe
  2⤵
  PID:5308
- C:\Windows\System\oXhPBMy.exe
  C:\Windows\System\oXhPBMy.exe
  2⤵
  PID:5324
- C:\Windows\System\UkntrGv.exe
  C:\Windows\System\UkntrGv.exe
  2⤵
  PID:5340
- C:\Windows\System\yzdTuJS.exe
  C:\Windows\System\yzdTuJS.exe
  2⤵
  PID:5356
- C:\Windows\System\dNlGozj.exe
  C:\Windows\System\dNlGozj.exe
  2⤵
  PID:5372
- C:\Windows\System\jYszHeq.exe
  C:\Windows\System\jYszHeq.exe
  2⤵
  PID:5388
- C:\Windows\System\jdKgdNn.exe
  C:\Windows\System\jdKgdNn.exe
  2⤵
  PID:5404
- C:\Windows\System\FYXOOEE.exe
  C:\Windows\System\FYXOOEE.exe
  2⤵
  PID:5420
- C:\Windows\System\Fsfydky.exe
  C:\Windows\System\Fsfydky.exe
  2⤵
  PID:5436
- C:\Windows\System\djjgmOP.exe
  C:\Windows\System\djjgmOP.exe
  2⤵
  PID:5452
- C:\Windows\System\hKBYpUd.exe
  C:\Windows\System\hKBYpUd.exe
  2⤵
  PID:5468
- C:\Windows\System\FAZvHDy.exe
  C:\Windows\System\FAZvHDy.exe
  2⤵
  PID:5484
- C:\Windows\System\fzSLMeC.exe
  C:\Windows\System\fzSLMeC.exe
  2⤵
  PID:5504
- C:\Windows\System\rsoNGZs.exe
  C:\Windows\System\rsoNGZs.exe
  2⤵
  PID:5524
- C:\Windows\System\oMHmMQC.exe
  C:\Windows\System\oMHmMQC.exe
  2⤵
  PID:5544
- C:\Windows\System\tmnOKJt.exe
  C:\Windows\System\tmnOKJt.exe
  2⤵
  PID:5560
- C:\Windows\System\HXvTuZv.exe
  C:\Windows\System\HXvTuZv.exe
  2⤵
  PID:5576
- C:\Windows\System\ugnecJT.exe
  C:\Windows\System\ugnecJT.exe
  2⤵
  PID:5592
- C:\Windows\System\HkgqlDd.exe
  C:\Windows\System\HkgqlDd.exe
  2⤵
  PID:5608
- C:\Windows\System\yTfKuTn.exe
  C:\Windows\System\yTfKuTn.exe
  2⤵
  PID:5628
- C:\Windows\System\LUUjSit.exe
  C:\Windows\System\LUUjSit.exe
  2⤵
  PID:5644
- C:\Windows\System\VbeojdQ.exe
  C:\Windows\System\VbeojdQ.exe
  2⤵
  PID:5664
- C:\Windows\System\ghfDgvE.exe
  C:\Windows\System\ghfDgvE.exe
  2⤵
  PID:5680
- C:\Windows\System\NAPvojd.exe
  C:\Windows\System\NAPvojd.exe
  2⤵
  PID:5696
- C:\Windows\System\bGvDJly.exe
  C:\Windows\System\bGvDJly.exe
  2⤵
  PID:5712
- C:\Windows\System\MXhnNUy.exe
  C:\Windows\System\MXhnNUy.exe
  2⤵
  PID:5736
- C:\Windows\System\vukWHsZ.exe
  C:\Windows\System\vukWHsZ.exe
  2⤵
  PID:5752
- C:\Windows\System\pMhHqjb.exe
  C:\Windows\System\pMhHqjb.exe
  2⤵
  PID:5768
- C:\Windows\System\kWyyFCR.exe
  C:\Windows\System\kWyyFCR.exe
  2⤵
  PID:5784
- C:\Windows\System\JGJntsc.exe
  C:\Windows\System\JGJntsc.exe
  2⤵
  PID:5800
- C:\Windows\System\XskCtMb.exe
  C:\Windows\System\XskCtMb.exe
  2⤵
  PID:5816
- C:\Windows\System\JgBuGVs.exe
  C:\Windows\System\JgBuGVs.exe
  2⤵
  PID:5832
- C:\Windows\System\qxuXWVS.exe
  C:\Windows\System\qxuXWVS.exe
  2⤵
  PID:5848
- C:\Windows\System\QkAbHsz.exe
  C:\Windows\System\QkAbHsz.exe
  2⤵
  PID:5864
- C:\Windows\System\xJXinVU.exe
  C:\Windows\System\xJXinVU.exe
  2⤵
  PID:5880
- C:\Windows\System\SVizsOS.exe
  C:\Windows\System\SVizsOS.exe
  2⤵
  PID:5900
- C:\Windows\System\IMKzDtQ.exe
  C:\Windows\System\IMKzDtQ.exe
  2⤵
  PID:5916
- C:\Windows\System\lKlszgq.exe
  C:\Windows\System\lKlszgq.exe
  2⤵
  PID:5932
- C:\Windows\System\icrVfVj.exe
  C:\Windows\System\icrVfVj.exe
  2⤵
  PID:5948
- C:\Windows\System\eJVzZnV.exe
  C:\Windows\System\eJVzZnV.exe
  2⤵
  PID:5968
- C:\Windows\System\XCYiNgO.exe
  C:\Windows\System\XCYiNgO.exe
  2⤵
  PID:5984
- C:\Windows\System\EIrntgE.exe
  C:\Windows\System\EIrntgE.exe
  2⤵
  PID:6000
- C:\Windows\System\GKqoUfI.exe
  C:\Windows\System\GKqoUfI.exe
  2⤵
  PID:6016
- C:\Windows\System\pfUIvMv.exe
  C:\Windows\System\pfUIvMv.exe
  2⤵
  PID:6032
- C:\Windows\System\zMMJUGr.exe
  C:\Windows\System\zMMJUGr.exe
  2⤵
  PID:6048
- C:\Windows\System\ObdpGNB.exe
  C:\Windows\System\ObdpGNB.exe
  2⤵
  PID:6064
- C:\Windows\System\yWcguyM.exe
  C:\Windows\System\yWcguyM.exe
  2⤵
  PID:6080
- C:\Windows\System\lRbPULl.exe
  C:\Windows\System\lRbPULl.exe
  2⤵
  PID:6096
- C:\Windows\System\DnrotoS.exe
  C:\Windows\System\DnrotoS.exe
  2⤵
  PID:6112
- C:\Windows\System\TMhaaNk.exe
  C:\Windows\System\TMhaaNk.exe
  2⤵
  PID:6128
- C:\Windows\System\xTZShSF.exe
  C:\Windows\System\xTZShSF.exe
  2⤵
  PID:4724
- C:\Windows\System\imyRHLb.exe
  C:\Windows\System\imyRHLb.exe
  2⤵
  PID:5016
- C:\Windows\System\kIEsBck.exe
  C:\Windows\System\kIEsBck.exe
  2⤵
  PID:4228
- C:\Windows\System\dUFZoVA.exe
  C:\Windows\System\dUFZoVA.exe
  2⤵
  PID:4832
- C:\Windows\System\GSvUEHc.exe
  C:\Windows\System\GSvUEHc.exe
  2⤵
  PID:5176
- C:\Windows\System\WEcPjnF.exe
  C:\Windows\System\WEcPjnF.exe
  2⤵
  PID:5204
- C:\Windows\System\GZjYmcl.exe
  C:\Windows\System\GZjYmcl.exe
  2⤵
  PID:5240
- C:\Windows\System\OMUJHsj.exe
  C:\Windows\System\OMUJHsj.exe
  2⤵
  PID:5272
- C:\Windows\System\TtSFhcu.exe
  C:\Windows\System\TtSFhcu.exe
  2⤵
  PID:5224
- C:\Windows\System\kodkbbf.exe
  C:\Windows\System\kodkbbf.exe
  2⤵
  PID:5336
- C:\Windows\System\zPiTHBx.exe
  C:\Windows\System\zPiTHBx.exe
  2⤵
  PID:5320
- C:\Windows\System\XXmigwj.exe
  C:\Windows\System\XXmigwj.exe
  2⤵
  PID:5432
- C:\Windows\System\pSpnSUW.exe
  C:\Windows\System\pSpnSUW.exe
  2⤵
  PID:5492
- C:\Windows\System\aPPFgFD.exe
  C:\Windows\System\aPPFgFD.exe
  2⤵
  PID:5380
- C:\Windows\System\PvErUJt.exe
  C:\Windows\System\PvErUJt.exe
  2⤵
  PID:5416
- C:\Windows\System\sGokDco.exe
  C:\Windows\System\sGokDco.exe
  2⤵
  PID:5496
- C:\Windows\System\cXvKEWs.exe
  C:\Windows\System\cXvKEWs.exe
  2⤵
  PID:5448
- C:\Windows\System\LNhheGY.exe
  C:\Windows\System\LNhheGY.exe
  2⤵
  PID:5688
- C:\Windows\System\BYeXIqb.exe
  C:\Windows\System\BYeXIqb.exe
  2⤵
  PID:5600
- C:\Windows\System\mBicjAV.exe
  C:\Windows\System\mBicjAV.exe
  2⤵
  PID:5708
- C:\Windows\System\APHceJn.exe
  C:\Windows\System\APHceJn.exe
  2⤵
  PID:5656
- C:\Windows\System\sAgnwUm.exe
  C:\Windows\System\sAgnwUm.exe
  2⤵
  PID:5744
- C:\Windows\System\GZEItZb.exe
  C:\Windows\System\GZEItZb.exe
  2⤵
  PID:5724
- C:\Windows\System\twDnIGc.exe
  C:\Windows\System\twDnIGc.exe
  2⤵
  PID:5776
- C:\Windows\System\ONuIKmn.exe
  C:\Windows\System\ONuIKmn.exe
  2⤵
  PID:5812
- C:\Windows\System\aIeBasb.exe
  C:\Windows\System\aIeBasb.exe
  2⤵
  PID:5876
- C:\Windows\System\PlMRLbE.exe
  C:\Windows\System\PlMRLbE.exe
  2⤵
  PID:5796
- C:\Windows\System\zuFuKOI.exe
  C:\Windows\System\zuFuKOI.exe
  2⤵
  PID:5856
- C:\Windows\System\pdsZkRQ.exe
  C:\Windows\System\pdsZkRQ.exe
  2⤵
  PID:5944
- C:\Windows\System\xykAYfs.exe
  C:\Windows\System\xykAYfs.exe
  2⤵
  PID:5976
- C:\Windows\System\gSvexHb.exe
  C:\Windows\System\gSvexHb.exe
  2⤵
  PID:5960
- C:\Windows\System\ZrXnHMA.exe
  C:\Windows\System\ZrXnHMA.exe
  2⤵
  PID:6024
- C:\Windows\System\CpGqwZt.exe
  C:\Windows\System\CpGqwZt.exe
  2⤵
  PID:6072
- C:\Windows\System\xtDtpCb.exe
  C:\Windows\System\xtDtpCb.exe
  2⤵
  PID:6104
- C:\Windows\System\PcKyQiC.exe
  C:\Windows\System\PcKyQiC.exe
  2⤵
  PID:6136
- C:\Windows\System\CMLaDzd.exe
  C:\Windows\System\CMLaDzd.exe
  2⤵
  PID:5140
- C:\Windows\System\ixCBwJy.exe
  C:\Windows\System\ixCBwJy.exe
  2⤵
  PID:4812
- C:\Windows\System\TPmjEDq.exe
  C:\Windows\System\TPmjEDq.exe
  2⤵
  PID:5252
- C:\Windows\System\tODeYKQ.exe
  C:\Windows\System\tODeYKQ.exe
  2⤵
  PID:4664
- C:\Windows\System\OzqinLx.exe
  C:\Windows\System\OzqinLx.exe
  2⤵
  PID:5464
- C:\Windows\System\JQnuTOc.exe
  C:\Windows\System\JQnuTOc.exe
  2⤵
  PID:5400
- C:\Windows\System\qIDOyow.exe
  C:\Windows\System\qIDOyow.exe
  2⤵
  PID:5316
- C:\Windows\System\rItICfX.exe
  C:\Windows\System\rItICfX.exe
  2⤵
  PID:5476
- C:\Windows\System\hLhYAUK.exe
  C:\Windows\System\hLhYAUK.exe
  2⤵
  PID:5568
- C:\Windows\System\hEOpVsg.exe
  C:\Windows\System\hEOpVsg.exe
  2⤵
  PID:5516
- C:\Windows\System\oydJuur.exe
  C:\Windows\System\oydJuur.exe
  2⤵
  PID:5760
- C:\Windows\System\HSfxnqO.exe
  C:\Windows\System\HSfxnqO.exe
  2⤵
  PID:5692
- C:\Windows\System\jEHTFZB.exe
  C:\Windows\System\jEHTFZB.exe
  2⤵
  PID:5872
- C:\Windows\System\xaAoRYa.exe
  C:\Windows\System\xaAoRYa.exe
  2⤵
  PID:5828
- C:\Windows\System\NjzLGbn.exe
  C:\Windows\System\NjzLGbn.exe
  2⤵
  PID:5896
- C:\Windows\System\GeUOxZv.exe
  C:\Windows\System\GeUOxZv.exe
  2⤵
  PID:6008
- C:\Windows\System\hlziAJv.exe
  C:\Windows\System\hlziAJv.exe
  2⤵
  PID:5924
- C:\Windows\System\PgUhovc.exe
  C:\Windows\System\PgUhovc.exe
  2⤵
  PID:6056
- C:\Windows\System\NEsIIvh.exe
  C:\Windows\System\NEsIIvh.exe
  2⤵
  PID:5172
- C:\Windows\System\vwAIxva.exe
  C:\Windows\System\vwAIxva.exe
  2⤵
  PID:5136
- C:\Windows\System\uwJAtcX.exe
  C:\Windows\System\uwJAtcX.exe
  2⤵
  PID:4272
- C:\Windows\System\GBGLZbq.exe
  C:\Windows\System\GBGLZbq.exe
  2⤵
  PID:5348
- C:\Windows\System\uxZNWfV.exe
  C:\Windows\System\uxZNWfV.exe
  2⤵
  PID:5540
- C:\Windows\System\LoxDgBq.exe
  C:\Windows\System\LoxDgBq.exe
  2⤵
  PID:5624
- C:\Windows\System\YCFpuAm.exe
  C:\Windows\System\YCFpuAm.exe
  2⤵
  PID:5676
- C:\Windows\System\YGXxgPR.exe
  C:\Windows\System\YGXxgPR.exe
  2⤵
  PID:5844
- C:\Windows\System\XNLktWj.exe
  C:\Windows\System\XNLktWj.exe
  2⤵
  PID:6044
- C:\Windows\System\BcEchxQ.exe
  C:\Windows\System\BcEchxQ.exe
  2⤵
  PID:4868
- C:\Windows\System\NQNHyry.exe
  C:\Windows\System\NQNHyry.exe
  2⤵
  PID:6060
- C:\Windows\System\geYLpwD.exe
  C:\Windows\System\geYLpwD.exe
  2⤵
  PID:4712
- C:\Windows\System\WboqVab.exe
  C:\Windows\System\WboqVab.exe
  2⤵
  PID:5588
- C:\Windows\System\tDVJZIv.exe
  C:\Windows\System\tDVJZIv.exe
  2⤵
  PID:5748
- C:\Windows\System\GLDAZaH.exe
  C:\Windows\System\GLDAZaH.exe
  2⤵
  PID:5552
- C:\Windows\System\kzevpjz.exe
  C:\Windows\System\kzevpjz.exe
  2⤵
  PID:6124
- C:\Windows\System\JxgQIad.exe
  C:\Windows\System\JxgQIad.exe
  2⤵
  PID:5284
- C:\Windows\System\HJZCFCT.exe
  C:\Windows\System\HJZCFCT.exe
  2⤵
  PID:6164
- C:\Windows\System\GzbCnDZ.exe
  C:\Windows\System\GzbCnDZ.exe
  2⤵
  PID:6180
- C:\Windows\System\DnAQNch.exe
  C:\Windows\System\DnAQNch.exe
  2⤵
  PID:6196
- C:\Windows\System\MFkWLjV.exe
  C:\Windows\System\MFkWLjV.exe
  2⤵
  PID:6212
- C:\Windows\System\NLsBNcs.exe
  C:\Windows\System\NLsBNcs.exe
  2⤵
  PID:6228
- C:\Windows\System\aZdCSmF.exe
  C:\Windows\System\aZdCSmF.exe
  2⤵
  PID:6244
- C:\Windows\System\wtsUUYp.exe
  C:\Windows\System\wtsUUYp.exe
  2⤵
  PID:6264
- C:\Windows\System\sqeujIK.exe
  C:\Windows\System\sqeujIK.exe
  2⤵
  PID:6280
- C:\Windows\System\AmHimIz.exe
  C:\Windows\System\AmHimIz.exe
  2⤵
  PID:6300
- C:\Windows\System\mzbcyIT.exe
  C:\Windows\System\mzbcyIT.exe
  2⤵
  PID:6316
- C:\Windows\System\tCmNEcc.exe
  C:\Windows\System\tCmNEcc.exe
  2⤵
  PID:6332
- C:\Windows\System\nbhUyXU.exe
  C:\Windows\System\nbhUyXU.exe
  2⤵
  PID:6348
- C:\Windows\System\clqcxJd.exe
  C:\Windows\System\clqcxJd.exe
  2⤵
  PID:6364
- C:\Windows\System\qmZaCgV.exe
  C:\Windows\System\qmZaCgV.exe
  2⤵
  PID:6380
- C:\Windows\System\ZBoYsWW.exe
  C:\Windows\System\ZBoYsWW.exe
  2⤵
  PID:6396
- C:\Windows\System\ctIptzA.exe
  C:\Windows\System\ctIptzA.exe
  2⤵
  PID:6412
- C:\Windows\System\RfEtdtL.exe
  C:\Windows\System\RfEtdtL.exe
  2⤵
  PID:6428
- C:\Windows\System\hokKjen.exe
  C:\Windows\System\hokKjen.exe
  2⤵
  PID:6444
- C:\Windows\System\NkJVfaV.exe
  C:\Windows\System\NkJVfaV.exe
  2⤵
  PID:6460
- C:\Windows\System\fkgGOxK.exe
  C:\Windows\System\fkgGOxK.exe
  2⤵
  PID:6476
- C:\Windows\System\euNuLgR.exe
  C:\Windows\System\euNuLgR.exe
  2⤵
  PID:6492
- C:\Windows\System\gZBNVyt.exe
  C:\Windows\System\gZBNVyt.exe
  2⤵
  PID:6584
- C:\Windows\System\ANVUoXk.exe
  C:\Windows\System\ANVUoXk.exe
  2⤵
  PID:6740
- C:\Windows\System\pmrUQzL.exe
  C:\Windows\System\pmrUQzL.exe
  2⤵
  PID:6768
- C:\Windows\System\GFwXMLL.exe
  C:\Windows\System\GFwXMLL.exe
  2⤵
  PID:6792
- C:\Windows\System\KUvIwcD.exe
  C:\Windows\System\KUvIwcD.exe
  2⤵
  PID:6828
- C:\Windows\System\TeeUdjS.exe
  C:\Windows\System\TeeUdjS.exe
  2⤵
  PID:6848
- C:\Windows\System\DJmQVby.exe
  C:\Windows\System\DJmQVby.exe
  2⤵
  PID:6912
- C:\Windows\System\OKYpoaE.exe
  C:\Windows\System\OKYpoaE.exe
  2⤵
  PID:6964
- C:\Windows\System\PJymiYr.exe
  C:\Windows\System\PJymiYr.exe
  2⤵
  PID:6984
- C:\Windows\System\EozoZwS.exe
  C:\Windows\System\EozoZwS.exe
  2⤵
  PID:7000
- C:\Windows\System\GGsJGdc.exe
  C:\Windows\System\GGsJGdc.exe
  2⤵
  PID:7072
- C:\Windows\System\YjdajGN.exe
  C:\Windows\System\YjdajGN.exe
  2⤵
  PID:7128
- C:\Windows\System\nVXhzOu.exe
  C:\Windows\System\nVXhzOu.exe
  2⤵
  PID:6160
- C:\Windows\System\HKFgXiT.exe
  C:\Windows\System\HKFgXiT.exe
  2⤵
  PID:6176
- C:\Windows\System\RXGETmK.exe
  C:\Windows\System\RXGETmK.exe
  2⤵
  PID:6712
- C:\Windows\System\ZAUCwgj.exe
  C:\Windows\System\ZAUCwgj.exe
  2⤵
  PID:6844
- C:\Windows\System\iFzrSPI.exe
  C:\Windows\System\iFzrSPI.exe
  2⤵
  PID:6756
- C:\Windows\System\uqvolwu.exe
  C:\Windows\System\uqvolwu.exe
  2⤵
  PID:6872
- C:\Windows\System\VdSVJWb.exe
  C:\Windows\System\VdSVJWb.exe
  2⤵
  PID:6816
- C:\Windows\System\IsntvcG.exe
  C:\Windows\System\IsntvcG.exe
  2⤵
  PID:6888
- C:\Windows\System\tvGzFse.exe
  C:\Windows\System\tvGzFse.exe
  2⤵
  PID:6924
- C:\Windows\System\HYkQjet.exe
  C:\Windows\System\HYkQjet.exe
  2⤵
  PID:6468
- C:\Windows\System\WslzJNq.exe
  C:\Windows\System\WslzJNq.exe
  2⤵
  PID:6404
- C:\Windows\System\rirdVUA.exe
  C:\Windows\System\rirdVUA.exe
  2⤵
  PID:6572
- C:\Windows\System\ZlgBJYF.exe
  C:\Windows\System\ZlgBJYF.exe
  2⤵
  PID:6700
- C:\Windows\System\nSFEXGo.exe
  C:\Windows\System\nSFEXGo.exe
  2⤵
  PID:6288
- C:\Windows\System\CMpAOut.exe
  C:\Windows\System\CMpAOut.exe
  2⤵
  PID:6356
- C:\Windows\System\lWrDocz.exe
  C:\Windows\System\lWrDocz.exe
  2⤵
  PID:6960
- C:\Windows\System\iDEUvkJ.exe
  C:\Windows\System\iDEUvkJ.exe
  2⤵
  PID:7108
- C:\Windows\System\DlRXiVg.exe
  C:\Windows\System\DlRXiVg.exe
  2⤵
  PID:6776
- C:\Windows\System\yCfOvPG.exe
  C:\Windows\System\yCfOvPG.exe
  2⤵
  PID:6512
- C:\Windows\System\FOXgNBk.exe
  C:\Windows\System\FOXgNBk.exe
  2⤵
  PID:6508
- C:\Windows\System\spYzJof.exe
  C:\Windows\System\spYzJof.exe
  2⤵
  PID:6528
- C:\Windows\System\dmHlHpM.exe
  C:\Windows\System\dmHlHpM.exe
  2⤵
  PID:6504
- C:\Windows\System\WtJeRQK.exe
  C:\Windows\System\WtJeRQK.exe
  2⤵
  PID:6608
- C:\Windows\System\oabmpkL.exe
  C:\Windows\System\oabmpkL.exe
  2⤵
  PID:6628
- C:\Windows\System\mPFIrVa.exe
  C:\Windows\System\mPFIrVa.exe
  2⤵
  PID:6648
- C:\Windows\System\lCmWkhq.exe
  C:\Windows\System\lCmWkhq.exe
  2⤵
  PID:6692
- C:\Windows\System\CqSuATp.exe
  C:\Windows\System\CqSuATp.exe
  2⤵
  PID:7164
- C:\Windows\System\NslKztd.exe
  C:\Windows\System\NslKztd.exe
  2⤵
  PID:6420
- C:\Windows\System\QnbpuSP.exe
  C:\Windows\System\QnbpuSP.exe
  2⤵
  PID:6900
- C:\Windows\System\dXbNycE.exe
  C:\Windows\System\dXbNycE.exe
  2⤵
  PID:6892
- C:\Windows\System\pXKKYbF.exe
  C:\Windows\System\pXKKYbF.exe
  2⤵
  PID:6392
- C:\Windows\System\RnKCPzI.exe
  C:\Windows\System\RnKCPzI.exe
  2⤵
  PID:6724
- C:\Windows\System\htSrRfJ.exe
  C:\Windows\System\htSrRfJ.exe
  2⤵
  PID:6484
- C:\Windows\System\datFAho.exe
  C:\Windows\System\datFAho.exe
  2⤵
  PID:6568
- C:\Windows\System\bWOAhaZ.exe
  C:\Windows\System\bWOAhaZ.exe
  2⤵
  PID:6944
- C:\Windows\System\TtfrPgl.exe
  C:\Windows\System\TtfrPgl.exe
  2⤵
  PID:7032
- C:\Windows\System\VnHgETb.exe
  C:\Windows\System\VnHgETb.exe
  2⤵
  PID:6696
- C:\Windows\System\TfjdrNv.exe
  C:\Windows\System\TfjdrNv.exe
  2⤵
  PID:6956
- C:\Windows\System\PlHtiJi.exe
  C:\Windows\System\PlHtiJi.exe
  2⤵
  PID:6980
- C:\Windows\System\eyPvIeV.exe
  C:\Windows\System\eyPvIeV.exe
  2⤵
  PID:7068
- C:\Windows\System\AXPIyAF.exe
  C:\Windows\System\AXPIyAF.exe
  2⤵
  PID:7112
- C:\Windows\System\XWnFXGN.exe
  C:\Windows\System\XWnFXGN.exe
  2⤵
  PID:6188
- C:\Windows\System\OuFmvRa.exe
  C:\Windows\System\OuFmvRa.exe
  2⤵
  PID:6236
- C:\Windows\System\aJnlryt.exe
  C:\Windows\System\aJnlryt.exe
  2⤵
  PID:6500
- C:\Windows\System\zInDROw.exe
  C:\Windows\System\zInDROw.exe
  2⤵
  PID:6536
- C:\Windows\System\YsdjLLe.exe
  C:\Windows\System\YsdjLLe.exe
  2⤵
  PID:6612
- C:\Windows\System\VjCldpC.exe
  C:\Windows\System\VjCldpC.exe
  2⤵
  PID:6836
- C:\Windows\System\pRRfHEc.exe
  C:\Windows\System\pRRfHEc.exe
  2⤵
  PID:5892
- C:\Windows\System\vqREbTv.exe
  C:\Windows\System\vqREbTv.exe
  2⤵
  PID:6328
- C:\Windows\System\UcyEyGn.exe
  C:\Windows\System\UcyEyGn.exe
  2⤵
  PID:6376
- C:\Windows\System\fWFHTjo.exe
  C:\Windows\System\fWFHTjo.exe
  2⤵
  PID:6344
- C:\Windows\System\ImjLxOr.exe
  C:\Windows\System\ImjLxOr.exe
  2⤵
  PID:7092
- C:\Windows\System\akblgwq.exe
  C:\Windows\System\akblgwq.exe
  2⤵
  PID:6604
- C:\Windows\System\PUXOVRS.exe
  C:\Windows\System\PUXOVRS.exe
  2⤵
  PID:6564
- C:\Windows\System\vOZRISF.exe
  C:\Windows\System\vOZRISF.exe
  2⤵
  PID:6308
- C:\Windows\System\aBxZtdX.exe
  C:\Windows\System\aBxZtdX.exe
  2⤵
  PID:6296
- C:\Windows\System\XELVRRM.exe
  C:\Windows\System\XELVRRM.exe
  2⤵
  PID:7036
- C:\Windows\System\oQIIyDf.exe
  C:\Windows\System\oQIIyDf.exe
  2⤵
  PID:6452
- C:\Windows\System\YLWuXMT.exe
  C:\Windows\System\YLWuXMT.exe
  2⤵
  PID:6456
- C:\Windows\System\MSHskgZ.exe
  C:\Windows\System\MSHskgZ.exe
  2⤵
  PID:6864
- C:\Windows\System\RfXooLJ.exe
  C:\Windows\System\RfXooLJ.exe
  2⤵
  PID:7016
- C:\Windows\System\odLKgoV.exe
  C:\Windows\System\odLKgoV.exe
  2⤵
  PID:6192
- C:\Windows\System\zSDEgtO.exe
  C:\Windows\System\zSDEgtO.exe
  2⤵
  PID:6440
- C:\Windows\System\kgxFAMn.exe
  C:\Windows\System\kgxFAMn.exe
  2⤵
  PID:6152
- C:\Windows\System\jaoHXyx.exe
  C:\Windows\System\jaoHXyx.exe
  2⤵
  PID:6672
- C:\Windows\System\jBgjBdP.exe
  C:\Windows\System\jBgjBdP.exe
  2⤵
  PID:6548
- C:\Windows\System\kJJlmwj.exe
  C:\Windows\System\kJJlmwj.exe
  2⤵
  PID:6256
- C:\Windows\System\eQPAOuZ.exe
  C:\Windows\System\eQPAOuZ.exe
  2⤵
  PID:7048
- C:\Windows\System\AHDIfpS.exe
  C:\Windows\System\AHDIfpS.exe
  2⤵
  PID:7052
- C:\Windows\System\rjIefmz.exe
  C:\Windows\System\rjIefmz.exe
  2⤵
  PID:7140
- C:\Windows\System\jBqvDML.exe
  C:\Windows\System\jBqvDML.exe
  2⤵
  PID:6240
- C:\Windows\System\fyUbyGv.exe
  C:\Windows\System\fyUbyGv.exe
  2⤵
  PID:6708
- C:\Windows\System\bcpCayh.exe
  C:\Windows\System\bcpCayh.exe
  2⤵
  PID:6788
- C:\Windows\System\dOWtPzs.exe
  C:\Windows\System\dOWtPzs.exe
  2⤵
  PID:6868
- C:\Windows\System\XjnTwnw.exe
  C:\Windows\System\XjnTwnw.exe
  2⤵
  PID:6172
- C:\Windows\System\aWSQdhA.exe
  C:\Windows\System\aWSQdhA.exe
  2⤵
  PID:6948
- C:\Windows\System\LlKrpuH.exe
  C:\Windows\System\LlKrpuH.exe
  2⤵
  PID:6972
- C:\Windows\System\GHaHmed.exe
  C:\Windows\System\GHaHmed.exe
  2⤵
  PID:6360
- C:\Windows\System\HwgkEXl.exe
  C:\Windows\System\HwgkEXl.exe
  2⤵
  PID:6976
- C:\Windows\System\XIXoeAj.exe
  C:\Windows\System\XIXoeAj.exe
  2⤵
  PID:6252
- C:\Windows\System\iMHlWZJ.exe
  C:\Windows\System\iMHlWZJ.exe
  2⤵
  PID:6540
- C:\Windows\System\BFFNBGT.exe
  C:\Windows\System\BFFNBGT.exe
  2⤵
  PID:6472
- C:\Windows\System\SNkjETY.exe
  C:\Windows\System\SNkjETY.exe
  2⤵
  PID:6760
- C:\Windows\System\XrxVbdv.exe
  C:\Windows\System\XrxVbdv.exe
  2⤵
  PID:6632
- C:\Windows\System\VEdaHIc.exe
  C:\Windows\System\VEdaHIc.exe
  2⤵
  PID:7180
- C:\Windows\System\WnCyfrZ.exe
  C:\Windows\System\WnCyfrZ.exe
  2⤵
  PID:7196
- C:\Windows\System\CmSDAMF.exe
  C:\Windows\System\CmSDAMF.exe
  2⤵
  PID:7212
- C:\Windows\System\gggFciV.exe
  C:\Windows\System\gggFciV.exe
  2⤵
  PID:7228
- C:\Windows\System\mgCxBYs.exe
  C:\Windows\System\mgCxBYs.exe
  2⤵
  PID:7244
- C:\Windows\System\fGhXDIc.exe
  C:\Windows\System\fGhXDIc.exe
  2⤵
  PID:7268
- C:\Windows\System\YgkecMh.exe
  C:\Windows\System\YgkecMh.exe
  2⤵
  PID:7284
- C:\Windows\System\Bsubund.exe
  C:\Windows\System\Bsubund.exe
  2⤵
  PID:7300
- C:\Windows\System\fbhAKUb.exe
  C:\Windows\System\fbhAKUb.exe
  2⤵
  PID:7316
- C:\Windows\System\BeHvNir.exe
  C:\Windows\System\BeHvNir.exe
  2⤵
  PID:7332
- C:\Windows\System\CpHOTzB.exe
  C:\Windows\System\CpHOTzB.exe
  2⤵
  PID:7348
- C:\Windows\System\QYWbkLm.exe
  C:\Windows\System\QYWbkLm.exe
  2⤵
  PID:7364
- C:\Windows\System\GdhPwEz.exe
  C:\Windows\System\GdhPwEz.exe
  2⤵
  PID:7380
- C:\Windows\System\vhQHeOg.exe
  C:\Windows\System\vhQHeOg.exe
  2⤵
  PID:7396
- C:\Windows\System\xhdNsTK.exe
  C:\Windows\System\xhdNsTK.exe
  2⤵
  PID:7412
- C:\Windows\System\bVqdioU.exe
  C:\Windows\System\bVqdioU.exe
  2⤵
  PID:7428
- C:\Windows\System\mluQZKF.exe
  C:\Windows\System\mluQZKF.exe
  2⤵
  PID:7444
- C:\Windows\System\tDjlASP.exe
  C:\Windows\System\tDjlASP.exe
  2⤵
  PID:7464
- C:\Windows\System\UdyKohu.exe
  C:\Windows\System\UdyKohu.exe
  2⤵
  PID:7480
- C:\Windows\System\Craiobw.exe
  C:\Windows\System\Craiobw.exe
  2⤵
  PID:7496
- C:\Windows\System\xeOPMGx.exe
  C:\Windows\System\xeOPMGx.exe
  2⤵
  PID:7512
- C:\Windows\System\KjlUZmK.exe
  C:\Windows\System\KjlUZmK.exe
  2⤵
  PID:7528
- C:\Windows\System\RNIkhDz.exe
  C:\Windows\System\RNIkhDz.exe
  2⤵
  PID:7552
- C:\Windows\System\rMXKWij.exe
  C:\Windows\System\rMXKWij.exe
  2⤵
  PID:7568
- C:\Windows\System\lHflCYg.exe
  C:\Windows\System\lHflCYg.exe
  2⤵
  PID:7584
- C:\Windows\System\XnORPNp.exe
  C:\Windows\System\XnORPNp.exe
  2⤵
  PID:7600
- C:\Windows\System\AOSOwCw.exe
  C:\Windows\System\AOSOwCw.exe
  2⤵
  PID:7616
- C:\Windows\System\LMJepxh.exe
  C:\Windows\System\LMJepxh.exe
  2⤵
  PID:7632
- C:\Windows\System\VyOCBIK.exe
  C:\Windows\System\VyOCBIK.exe
  2⤵
  PID:7648
- C:\Windows\System\dcldRsy.exe
  C:\Windows\System\dcldRsy.exe
  2⤵
  PID:7664
- C:\Windows\System\eWDfeKD.exe
  C:\Windows\System\eWDfeKD.exe
  2⤵
  PID:7700
- C:\Windows\System\OAJEHJQ.exe
  C:\Windows\System\OAJEHJQ.exe
  2⤵
  PID:7748
- C:\Windows\System\lMqfFBf.exe
  C:\Windows\System\lMqfFBf.exe
  2⤵
  PID:7836
- C:\Windows\System\FNkQIcC.exe
  C:\Windows\System\FNkQIcC.exe
  2⤵
  PID:7872
- C:\Windows\System\twogqgE.exe
  C:\Windows\System\twogqgE.exe
  2⤵
  PID:8100
- C:\Windows\System\CiTpBHo.exe
  C:\Windows\System\CiTpBHo.exe
  2⤵
  PID:8116
- C:\Windows\System\qaYxUiv.exe
  C:\Windows\System\qaYxUiv.exe
  2⤵
  PID:8132
- C:\Windows\System\jjYymVr.exe
  C:\Windows\System\jjYymVr.exe
  2⤵
  PID:8148
- C:\Windows\System\AwSnOhK.exe
  C:\Windows\System\AwSnOhK.exe
  2⤵
  PID:8164
- C:\Windows\System\BWyKqmA.exe
  C:\Windows\System\BWyKqmA.exe
  2⤵
  PID:8180
- C:\Windows\System\ZmKomRG.exe
  C:\Windows\System\ZmKomRG.exe
  2⤵
  PID:7160
- C:\Windows\System\zeHArkF.exe
  C:\Windows\System\zeHArkF.exe
  2⤵
  PID:6600
- C:\Windows\System\JfppVQM.exe
  C:\Windows\System\JfppVQM.exe
  2⤵
  PID:6276
- C:\Windows\System\OmXxthF.exe
  C:\Windows\System\OmXxthF.exe
  2⤵
  PID:5236
- C:\Windows\System\LdddZDP.exe
  C:\Windows\System\LdddZDP.exe
  2⤵
  PID:7172
- C:\Windows\System\oNKEjDy.exe
  C:\Windows\System\oNKEjDy.exe
  2⤵
  PID:7204
- C:\Windows\System\WFvPhHy.exe
  C:\Windows\System\WFvPhHy.exe
  2⤵
  PID:7292
- C:\Windows\System\qBqaadi.exe
  C:\Windows\System\qBqaadi.exe
  2⤵
  PID:7360
- C:\Windows\System\YuyrQGg.exe
  C:\Windows\System\YuyrQGg.exe
  2⤵
  PID:7392
- C:\Windows\System\bHqcKjS.exe
  C:\Windows\System\bHqcKjS.exe
  2⤵
  PID:7240
- C:\Windows\System\SacqZSv.exe
  C:\Windows\System\SacqZSv.exe
  2⤵
  PID:7340
- C:\Windows\System\HBYvIKY.exe
  C:\Windows\System\HBYvIKY.exe
  2⤵
  PID:7404
- C:\Windows\System\nYZOwqR.exe
  C:\Windows\System\nYZOwqR.exe
  2⤵
  PID:7460
- C:\Windows\System\JJawnqW.exe
  C:\Windows\System\JJawnqW.exe
  2⤵
  PID:7580
- C:\Windows\System\TNZTNtb.exe
  C:\Windows\System\TNZTNtb.exe
  2⤵
  PID:7596
- C:\Windows\System\hXECzWF.exe
  C:\Windows\System\hXECzWF.exe
  2⤵
  PID:7660
- C:\Windows\System\WCfWIrV.exe
  C:\Windows\System\WCfWIrV.exe
  2⤵
  PID:7804
- C:\Windows\System\EvIaDCp.exe
  C:\Windows\System\EvIaDCp.exe
  2⤵
  PID:7696
- C:\Windows\System\ONNjAuB.exe
  C:\Windows\System\ONNjAuB.exe
  2⤵
  PID:7776
- C:\Windows\System\nAaSUyI.exe
  C:\Windows\System\nAaSUyI.exe
  2⤵
  PID:7808
- C:\Windows\System\KcrMVzj.exe
  C:\Windows\System\KcrMVzj.exe
  2⤵
  PID:7884
- C:\Windows\System\glLYPxd.exe
  C:\Windows\System\glLYPxd.exe
  2⤵
  PID:7932
- C:\Windows\System\kzyrfww.exe
  C:\Windows\System\kzyrfww.exe
  2⤵
  PID:7948
- C:\Windows\System\oCfBCOd.exe
  C:\Windows\System\oCfBCOd.exe
  2⤵
  PID:7964
- C:\Windows\System\aAoPoOl.exe
  C:\Windows\System\aAoPoOl.exe
  2⤵
  PID:7980
- C:\Windows\System\pQyFwSp.exe
  C:\Windows\System\pQyFwSp.exe
  2⤵
  PID:7996
- C:\Windows\System\IYYcuTo.exe
  C:\Windows\System\IYYcuTo.exe
  2⤵
  PID:8020
- C:\Windows\System\tbcSWnw.exe
  C:\Windows\System\tbcSWnw.exe
  2⤵
  PID:7868
- C:\Windows\System\NfCZIUd.exe
  C:\Windows\System\NfCZIUd.exe
  2⤵
  PID:7724
- C:\Windows\System\aHChEaz.exe
  C:\Windows\System\aHChEaz.exe
  2⤵
  PID:7736
- C:\Windows\System\GgOhter.exe
  C:\Windows\System\GgOhter.exe
  2⤵
  PID:8112
- C:\Windows\System\AHbDKlq.exe
  C:\Windows\System\AHbDKlq.exe
  2⤵
  PID:8176
- C:\Windows\System\rEKQgGz.exe
  C:\Windows\System\rEKQgGz.exe
  2⤵
  PID:8156
- C:\Windows\System\sYvgZwN.exe
  C:\Windows\System\sYvgZwN.exe
  2⤵
  PID:6580
- C:\Windows\System\QIhApRR.exe
  C:\Windows\System\QIhApRR.exe
  2⤵
  PID:7220
- C:\Windows\System\kvbOQZw.exe
  C:\Windows\System\kvbOQZw.exe
  2⤵
  PID:7356
- C:\Windows\System\brYrcxk.exe
  C:\Windows\System\brYrcxk.exe
  2⤵
  PID:7452
- C:\Windows\System\vBoDLFv.exe
  C:\Windows\System\vBoDLFv.exe
  2⤵
  PID:7524
- C:\Windows\System\iKUaYEW.exe
  C:\Windows\System\iKUaYEW.exe
  2⤵
  PID:7024
- C:\Windows\System\TQtnHVm.exe
  C:\Windows\System\TQtnHVm.exe
  2⤵
  PID:7308
- C:\Windows\System\QJDFFgT.exe
  C:\Windows\System\QJDFFgT.exe
  2⤵
  PID:7472
- C:\Windows\System\HSmoNNR.exe
  C:\Windows\System\HSmoNNR.exe
  2⤵
  PID:6660
- C:\Windows\System\xaHsdDO.exe
  C:\Windows\System\xaHsdDO.exe
  2⤵
  PID:7828
- C:\Windows\System\CsLyUyq.exe
  C:\Windows\System\CsLyUyq.exe
  2⤵
  PID:7592
- C:\Windows\System\pjNuabf.exe
  C:\Windows\System\pjNuabf.exe
  2⤵
  PID:7760
- C:\Windows\System\DQmvigW.exe
  C:\Windows\System\DQmvigW.exe
  2⤵
  PID:7692
- C:\Windows\System\aehdxKp.exe
  C:\Windows\System\aehdxKp.exe
  2⤵
  PID:7940
- C:\Windows\System\cVYiDsU.exe
  C:\Windows\System\cVYiDsU.exe
  2⤵
  PID:7904
- C:\Windows\System\hGpdHnY.exe
  C:\Windows\System\hGpdHnY.exe
  2⤵
  PID:7988
- C:\Windows\System\RIvcZUe.exe
  C:\Windows\System\RIvcZUe.exe
  2⤵
  PID:8008
- C:\Windows\System\zxcRCZW.exe
  C:\Windows\System\zxcRCZW.exe
  2⤵
  PID:7440
- C:\Windows\System\VPzTile.exe
  C:\Windows\System\VPzTile.exe
  2⤵
  PID:7824
- C:\Windows\System\BGsATXv.exe
  C:\Windows\System\BGsATXv.exe
  2⤵
  PID:7476
- C:\Windows\System\XZTnrcN.exe
  C:\Windows\System\XZTnrcN.exe
  2⤵
  PID:7564
- C:\Windows\System\sqNXBRx.exe
  C:\Windows\System\sqNXBRx.exe
  2⤵
  PID:8028
- C:\Windows\System\KJnYHcD.exe
  C:\Windows\System\KJnYHcD.exe
  2⤵
  PID:7012
- C:\Windows\System\dFoTmMp.exe
  C:\Windows\System\dFoTmMp.exe
  2⤵
  PID:7344
- C:\Windows\System\iAiqYLx.exe
  C:\Windows\System\iAiqYLx.exe
  2⤵
  PID:7176
- C:\Windows\System\ZOSkYQL.exe
  C:\Windows\System\ZOSkYQL.exe
  2⤵
  PID:8144
- C:\Windows\System\UrnPZPN.exe
  C:\Windows\System\UrnPZPN.exe
  2⤵
  PID:7608
- C:\Windows\System\tvkRUkZ.exe
  C:\Windows\System\tvkRUkZ.exe
  2⤵
  PID:7720
- C:\Windows\System\GGDBJGk.exe
  C:\Windows\System\GGDBJGk.exe
  2⤵
  PID:8272
- C:\Windows\System\fECIJLD.exe
  C:\Windows\System\fECIJLD.exe
  2⤵
  PID:8348
- C:\Windows\System\RDZcAEB.exe
  C:\Windows\System\RDZcAEB.exe
  2⤵
  PID:8384
- C:\Windows\System\mtMpiyA.exe
  C:\Windows\System\mtMpiyA.exe
  2⤵
  PID:8468
- C:\Windows\System\KkzBIwX.exe
  C:\Windows\System\KkzBIwX.exe
  2⤵
  PID:8484
- C:\Windows\System\LkoThqv.exe
  C:\Windows\System\LkoThqv.exe
  2⤵
  PID:8500
- C:\Windows\System\ARUyUQj.exe
  C:\Windows\System\ARUyUQj.exe
  2⤵
  PID:8516
- C:\Windows\System\BfuPfcC.exe
  C:\Windows\System\BfuPfcC.exe
  2⤵
  PID:8532
- C:\Windows\System\qxCTXXe.exe
  C:\Windows\System\qxCTXXe.exe
  2⤵
  PID:8588
- C:\Windows\System\mkKoumz.exe
  C:\Windows\System\mkKoumz.exe
  2⤵
  PID:8604
- C:\Windows\System\WihXDMU.exe
  C:\Windows\System\WihXDMU.exe
  2⤵
  PID:8700
- C:\Windows\System\oiKnrpe.exe
  C:\Windows\System\oiKnrpe.exe
  2⤵
  PID:8716
- C:\Windows\System\FBEKyiH.exe
  C:\Windows\System\FBEKyiH.exe
  2⤵
  PID:8732
- C:\Windows\System\SPNHdqH.exe
  C:\Windows\System\SPNHdqH.exe
  2⤵
  PID:8748
- C:\Windows\System\EdqQhwc.exe
  C:\Windows\System\EdqQhwc.exe
  2⤵
  PID:8764
- C:\Windows\System\vzsonSU.exe
  C:\Windows\System\vzsonSU.exe
  2⤵
  PID:8780
- C:\Windows\System\etUtyUl.exe
  C:\Windows\System\etUtyUl.exe
  2⤵
  PID:8796
- C:\Windows\System\iRXmTRh.exe
  C:\Windows\System\iRXmTRh.exe
  2⤵
  PID:8812
- C:\Windows\System\DETMWQQ.exe
  C:\Windows\System\DETMWQQ.exe
  2⤵
  PID:8828
- C:\Windows\System\WHyWyOv.exe
  C:\Windows\System\WHyWyOv.exe
  2⤵
  PID:8848
- C:\Windows\System\OxNAFjj.exe
  C:\Windows\System\OxNAFjj.exe
  2⤵
  PID:8864
- C:\Windows\System\WuAOwta.exe
  C:\Windows\System\WuAOwta.exe
  2⤵
  PID:8880
- C:\Windows\System\sUnKogR.exe
  C:\Windows\System\sUnKogR.exe
  2⤵
  PID:8896
- C:\Windows\System\YvOcKif.exe
  C:\Windows\System\YvOcKif.exe
  2⤵
  PID:8912
- C:\Windows\System\hnMhhDA.exe
  C:\Windows\System\hnMhhDA.exe
  2⤵
  PID:8968
- C:\Windows\System\yPQfrCv.exe
  C:\Windows\System\yPQfrCv.exe
  2⤵
  PID:9000
- C:\Windows\System\AcdtaPl.exe
  C:\Windows\System\AcdtaPl.exe
  2⤵
  PID:9016
- C:\Windows\System\JhdNEHK.exe
  C:\Windows\System\JhdNEHK.exe
  2⤵
  PID:9032
- C:\Windows\System\bGRZGaK.exe
  C:\Windows\System\bGRZGaK.exe
  2⤵
  PID:9132
- C:\Windows\System\CWFkYEj.exe
  C:\Windows\System\CWFkYEj.exe
  2⤵
  PID:9148
- C:\Windows\System\PfRofOn.exe
  C:\Windows\System\PfRofOn.exe
  2⤵
  PID:9168
- C:\Windows\System\LKPFsEj.exe
  C:\Windows\System\LKPFsEj.exe
  2⤵
  PID:9188
- C:\Windows\System\jNKxBHm.exe
  C:\Windows\System\jNKxBHm.exe
  2⤵
  PID:9204
- C:\Windows\System\fssgLlH.exe
  C:\Windows\System\fssgLlH.exe
  2⤵
  PID:2780
- C:\Windows\System\dkwPvsm.exe
  C:\Windows\System\dkwPvsm.exe
  2⤵
  PID:7676
- C:\Windows\System\IesiyVf.exe
  C:\Windows\System\IesiyVf.exe
  2⤵
  PID:8280
- C:\Windows\System\CkARXLQ.exe
  C:\Windows\System\CkARXLQ.exe
  2⤵
  PID:8296
- C:\Windows\System\HwKTXOF.exe
  C:\Windows\System\HwKTXOF.exe
  2⤵
  PID:8324
- C:\Windows\System\tSCmzKy.exe
  C:\Windows\System\tSCmzKy.exe
  2⤵
  PID:8124
- C:\Windows\System\bZgGqua.exe
  C:\Windows\System\bZgGqua.exe
  2⤵
  PID:8108
- C:\Windows\System\rpUIPGT.exe
  C:\Windows\System\rpUIPGT.exe
  2⤵
  PID:8340
- C:\Windows\System\bmLziqR.exe
  C:\Windows\System\bmLziqR.exe
  2⤵
  PID:8004
- C:\Windows\System\mWgHIft.exe
  C:\Windows\System\mWgHIft.exe
  2⤵
  PID:8032
- C:\Windows\System\kZrcIgZ.exe
  C:\Windows\System\kZrcIgZ.exe
  2⤵
  PID:7972
- C:\Windows\System\fgiIoXN.exe
  C:\Windows\System\fgiIoXN.exe
  2⤵
  PID:8200
- C:\Windows\System\YYeQdgC.exe
  C:\Windows\System\YYeQdgC.exe
  2⤵
  PID:8160
- C:\Windows\System\MGqEDkp.exe
  C:\Windows\System\MGqEDkp.exe
  2⤵
  PID:8044
- C:\Windows\System\cXRRaKL.exe
  C:\Windows\System\cXRRaKL.exe
  2⤵
  PID:7708
- C:\Windows\System\gSFxHRD.exe
  C:\Windows\System\gSFxHRD.exe
  2⤵
  PID:7544
- C:\Windows\System\zWNextm.exe
  C:\Windows\System\zWNextm.exe
  2⤵
  PID:7188
- C:\Windows\System\zNRBMeO.exe
  C:\Windows\System\zNRBMeO.exe
  2⤵
  PID:8360
- C:\Windows\System\JmZuaeM.exe
  C:\Windows\System\JmZuaeM.exe
  2⤵
  PID:8544
- C:\Windows\System\OMFKLTJ.exe
  C:\Windows\System\OMFKLTJ.exe
  2⤵
  PID:8572
- C:\Windows\System\cNoSXLc.exe
  C:\Windows\System\cNoSXLc.exe
  2⤵
  PID:8712
- C:\Windows\System\sgzmivz.exe
  C:\Windows\System\sgzmivz.exe
  2⤵
  PID:8744
- C:\Windows\System\JQRJPJe.exe
  C:\Windows\System\JQRJPJe.exe
  2⤵
  PID:8672
- C:\Windows\System\mvCbAQX.exe
  C:\Windows\System\mvCbAQX.exe
  2⤵
  PID:8840
- C:\Windows\System\pvHLiVk.exe
  C:\Windows\System\pvHLiVk.exe
  2⤵
  PID:8620
- C:\Windows\System\ystYQYU.exe
  C:\Windows\System\ystYQYU.exe
  2⤵
  PID:8820
- C:\Windows\System\zeYEKSq.exe
  C:\Windows\System\zeYEKSq.exe
  2⤵
  PID:8908
- C:\Windows\System\eegjcbR.exe
  C:\Windows\System\eegjcbR.exe
  2⤵
  PID:8644
- C:\Windows\System\OYGLVLq.exe
  C:\Windows\System\OYGLVLq.exe
  2⤵
  PID:8624
- C:\Windows\System\XpJKfhR.exe
  C:\Windows\System\XpJKfhR.exe
  2⤵
  PID:8892
- C:\Windows\System\vjdgJrQ.exe
  C:\Windows\System\vjdgJrQ.exe
  2⤵
  PID:8988
- C:\Windows\System\jqTyImN.exe
  C:\Windows\System\jqTyImN.exe
  2⤵
  PID:8936
- C:\Windows\System\tXiFSOS.exe
  C:\Windows\System\tXiFSOS.exe
  2⤵
  PID:8932
- C:\Windows\System\EckCEPD.exe
  C:\Windows\System\EckCEPD.exe
  2⤵
  PID:9008
- C:\Windows\System\oJfvFNb.exe
  C:\Windows\System\oJfvFNb.exe
  2⤵
  PID:9176
- C:\Windows\System\gOImqWQ.exe
  C:\Windows\System\gOImqWQ.exe
  2⤵
  PID:2760
- C:\Windows\System\jOivMaN.exe
  C:\Windows\System\jOivMaN.exe
  2⤵
  PID:8316
- C:\Windows\System\kleSnad.exe
  C:\Windows\System\kleSnad.exe
  2⤵
  PID:8320
- C:\Windows\System\PUMYrao.exe
  C:\Windows\System\PUMYrao.exe
  2⤵
  PID:7852
- C:\Windows\System\hqUfvmK.exe
  C:\Windows\System\hqUfvmK.exe
  2⤵
  PID:8236
- C:\Windows\System\OlpgsTG.exe
  C:\Windows\System\OlpgsTG.exe
  2⤵
  PID:9104
- C:\Windows\System\IBoAFgE.exe
  C:\Windows\System\IBoAFgE.exe
  2⤵
  PID:8960
- C:\Windows\System\WudMeON.exe
  C:\Windows\System\WudMeON.exe
  2⤵
  PID:9124
- C:\Windows\System\bylnXBi.exe
  C:\Windows\System\bylnXBi.exe
  2⤵
  PID:8268
- C:\Windows\System\LVfKJIT.exe
  C:\Windows\System\LVfKJIT.exe
  2⤵
  PID:8292
- C:\Windows\System\CdqWmlR.exe
  C:\Windows\System\CdqWmlR.exe
  2⤵
  PID:9164
- C:\Windows\System\qIwbrza.exe
  C:\Windows\System\qIwbrza.exe
  2⤵
  PID:9068
- C:\Windows\System\kZovIQc.exe
  C:\Windows\System\kZovIQc.exe
  2⤵
  PID:9088
- C:\Windows\System\AcFJTFQ.exe
  C:\Windows\System\AcFJTFQ.exe
  2⤵
  PID:7848
- C:\Windows\System\knWxKai.exe
  C:\Windows\System\knWxKai.exe
  2⤵
  PID:8332
- C:\Windows\System\ryssTUt.exe
  C:\Windows\System\ryssTUt.exe
  2⤵
  PID:8052
- C:\Windows\System\CiDOoIn.exe
  C:\Windows\System\CiDOoIn.exe
  2⤵
  PID:2080
- C:\Windows\System\EwNYDKW.exe
  C:\Windows\System\EwNYDKW.exe
  2⤵
  PID:2568
- C:\Windows\System\GkWMkPq.exe
  C:\Windows\System\GkWMkPq.exe
  2⤵
  PID:8240
- C:\Windows\System\RshzZJl.exe
  C:\Windows\System\RshzZJl.exe
  2⤵
  PID:8224
- C:\Windows\System\KpWcVjv.exe
  C:\Windows\System\KpWcVjv.exe
  2⤵
  PID:8260
- C:\Windows\System\PGSCAgo.exe
  C:\Windows\System\PGSCAgo.exe
  2⤵
  PID:7688
- C:\Windows\System\EpHFQqD.exe
  C:\Windows\System\EpHFQqD.exe
  2⤵
  PID:8524
- C:\Windows\System\ZbQdfis.exe
  C:\Windows\System\ZbQdfis.exe
  2⤵
  PID:8496
- C:\Windows\System\VwRYyyy.exe
  C:\Windows\System\VwRYyyy.exe
  2⤵
  PID:8460
- C:\Windows\System\CpgxQEG.exe
  C:\Windows\System\CpgxQEG.exe
  2⤵
  PID:8428
- C:\Windows\System\HXEELIp.exe
  C:\Windows\System\HXEELIp.exe
  2⤵
  PID:8444
- C:\Windows\System\RXPcWtg.exe
  C:\Windows\System\RXPcWtg.exe
  2⤵
  PID:8596
- C:\Windows\System\QDvrxyh.exe
  C:\Windows\System\QDvrxyh.exe
  2⤵
  PID:8708
- C:\Windows\System\LpqzLwF.exe
  C:\Windows\System\LpqzLwF.exe
  2⤵
  PID:8584
- C:\Windows\System\KIJqqfA.exe
  C:\Windows\System\KIJqqfA.exe
  2⤵
  PID:8656
- C:\Windows\System\PgxZXsL.exe
  C:\Windows\System\PgxZXsL.exe
  2⤵
  PID:8660
- C:\Windows\System\DOkmZLe.exe
  C:\Windows\System\DOkmZLe.exe
  2⤵
  PID:9024
- C:\Windows\System\coxkrOy.exe
  C:\Windows\System\coxkrOy.exe
  2⤵
  PID:8680
- C:\Windows\System\btIcRxg.exe
  C:\Windows\System\btIcRxg.exe
  2⤵
  PID:8696
- C:\Windows\System\DBbZcBv.exe
  C:\Windows\System\DBbZcBv.exe
  2⤵
  PID:8088
- C:\Windows\System\RmVPDyf.exe
  C:\Windows\System\RmVPDyf.exe
  2⤵
  PID:8692
- C:\Windows\System\mtSzwMZ.exe
  C:\Windows\System\mtSzwMZ.exe
  2⤵
  PID:8984
- C:\Windows\System\ImUQPlv.exe
  C:\Windows\System\ImUQPlv.exe
  2⤵
  PID:9144
- C:\Windows\System\UZNcCTc.exe
  C:\Windows\System\UZNcCTc.exe
  2⤵
  PID:9108
- C:\Windows\System\isSLPnH.exe
  C:\Windows\System\isSLPnH.exe
  2⤵
  PID:9120
- C:\Windows\System\cmHFcka.exe
  C:\Windows\System\cmHFcka.exe
  2⤵
  PID:8096
- C:\Windows\System\SBjXJMo.exe
  C:\Windows\System\SBjXJMo.exe
  2⤵
  PID:8216
- C:\Windows\System\PGFfrNB.exe
  C:\Windows\System\PGFfrNB.exe
  2⤵
  PID:8964
- C:\Windows\System\TEvEmdc.exe
  C:\Windows\System\TEvEmdc.exe
  2⤵
  PID:9156
- C:\Windows\System\OQFDDal.exe
  C:\Windows\System\OQFDDal.exe
  2⤵
  PID:9200
- C:\Windows\System\WHCBnMb.exe
  C:\Windows\System\WHCBnMb.exe
  2⤵
  PID:7576
- C:\Windows\System\jKPdNHJ.exe
  C:\Windows\System\jKPdNHJ.exe
  2⤵
  PID:9056
- C:\Windows\System\KKrQvTG.exe
  C:\Windows\System\KKrQvTG.exe
  2⤵
  PID:8068
- C:\Windows\System\WJPIHbr.exe
  C:\Windows\System\WJPIHbr.exe
  2⤵
  PID:1312
- C:\Windows\System\RBZvlQA.exe
  C:\Windows\System\RBZvlQA.exe
  2⤵
  PID:3036
- C:\Windows\System\QJvWAxD.exe
  C:\Windows\System\QJvWAxD.exe
  2⤵
  PID:8436
- C:\Windows\System\iZUMcuK.exe
  C:\Windows\System\iZUMcuK.exe
  2⤵
  PID:8728
- C:\Windows\System\qcxKjqq.exe
  C:\Windows\System\qcxKjqq.exe
  2⤵
  PID:8844
- C:\Windows\System\ZSIXmIv.exe
  C:\Windows\System\ZSIXmIv.exe
  2⤵
  PID:8380
- C:\Windows\System\xgXbZzo.exe
  C:\Windows\System\xgXbZzo.exe
  2⤵
  PID:8508
- C:\Windows\System\hfuQukM.exe
  C:\Windows\System\hfuQukM.exe
  2⤵
  PID:8804
- C:\Windows\System\EAoedUe.exe
  C:\Windows\System\EAoedUe.exe
  2⤵
  PID:8952
- C:\Windows\System\nEqHpmu.exe
  C:\Windows\System\nEqHpmu.exe
  2⤵
  PID:8664
- C:\Windows\System\INyHnWS.exe
  C:\Windows\System\INyHnWS.exe
  2⤵
  PID:7492
- C:\Windows\System\xrywpNa.exe
  C:\Windows\System\xrywpNa.exe
  2⤵
  PID:8084
- C:\Windows\System\bYbaspo.exe
  C:\Windows\System\bYbaspo.exe
  2⤵
  PID:8440
- C:\Windows\System\PLfTVzB.exe
  C:\Windows\System\PLfTVzB.exe
  2⤵
  PID:8836
- C:\Windows\System\nOZsUip.exe
  C:\Windows\System\nOZsUip.exe
  2⤵
  PID:8684
- C:\Windows\System\VylegIT.exe
  C:\Windows\System\VylegIT.exe
  2⤵
  PID:8264
- C:\Windows\System\sdqZyZU.exe
  C:\Windows\System\sdqZyZU.exe
  2⤵
  PID:8464
- C:\Windows\System\xlXqlvL.exe
  C:\Windows\System\xlXqlvL.exe
  2⤵
  PID:8628
- C:\Windows\System\LjJVUBQ.exe
  C:\Windows\System\LjJVUBQ.exe
  2⤵
  PID:8392
- C:\Windows\System\STBxyby.exe
  C:\Windows\System\STBxyby.exe
  2⤵
  PID:9196
- C:\Windows\System\mSIsfnM.exe
  C:\Windows\System\mSIsfnM.exe
  2⤵
  PID:8776
- C:\Windows\System\CzbwlJn.exe
  C:\Windows\System\CzbwlJn.exe
  2⤵
  PID:8772
- C:\Windows\System\lLOjgDn.exe
  C:\Windows\System\lLOjgDn.exe
  2⤵
  PID:8740
- C:\Windows\System\oubLNND.exe
  C:\Windows\System\oubLNND.exe
  2⤵
  PID:9048
- C:\Windows\System\yrvaoJn.exe
  C:\Windows\System\yrvaoJn.exe
  2⤵
  PID:9140
- C:\Windows\System\pWMHlli.exe
  C:\Windows\System\pWMHlli.exe
  2⤵
  PID:8412
- C:\Windows\System\gwMFcgR.exe
  C:\Windows\System\gwMFcgR.exe
  2⤵
  PID:7504
- C:\Windows\System\kZWLVrs.exe
  C:\Windows\System\kZWLVrs.exe
  2⤵
  PID:8204
- C:\Windows\System\haYfDli.exe
  C:\Windows\System\haYfDli.exe
  2⤵
  PID:1744
- C:\Windows\System\gpZbzNt.exe
  C:\Windows\System\gpZbzNt.exe
  2⤵
  PID:8092
- C:\Windows\System\hcTEMEP.exe
  C:\Windows\System\hcTEMEP.exe
  2⤵
  PID:9084
- C:\Windows\System\mGongWy.exe
  C:\Windows\System\mGongWy.exe
  2⤵
  PID:8492
- C:\Windows\System\qnVHRhP.exe
  C:\Windows\System\qnVHRhP.exe
  2⤵
  PID:9228
- C:\Windows\System\ddnTaCr.exe
  C:\Windows\System\ddnTaCr.exe
  2⤵
  PID:9248
- C:\Windows\System\uwFWMhp.exe
  C:\Windows\System\uwFWMhp.exe
  2⤵
  PID:9264
- C:\Windows\System\FnLIRvW.exe
  C:\Windows\System\FnLIRvW.exe
  2⤵
  PID:9280
- C:\Windows\System\iUoJXHT.exe
  C:\Windows\System\iUoJXHT.exe
  2⤵
  PID:9468
- C:\Windows\System\iEegSgX.exe
  C:\Windows\System\iEegSgX.exe
  2⤵
  PID:9556
- C:\Windows\System\GhJfKEN.exe
  C:\Windows\System\GhJfKEN.exe
  2⤵
  PID:9572
- C:\Windows\System\GEFWOjA.exe
  C:\Windows\System\GEFWOjA.exe
  2⤵
  PID:9592
- C:\Windows\System\SgRfUPR.exe
  C:\Windows\System\SgRfUPR.exe
  2⤵
  PID:9608
- C:\Windows\System\DQayCMk.exe
  C:\Windows\System\DQayCMk.exe
  2⤵
  PID:9624
- C:\Windows\System\SSonJPP.exe
  C:\Windows\System\SSonJPP.exe
  2⤵
  PID:9640
- C:\Windows\System\TizqgvJ.exe
  C:\Windows\System\TizqgvJ.exe
  2⤵
  PID:9656
- C:\Windows\System\auUFjLV.exe
  C:\Windows\System\auUFjLV.exe
  2⤵
  PID:9676
- C:\Windows\System\miiphfw.exe
  C:\Windows\System\miiphfw.exe
  2⤵
  PID:9920
- C:\Windows\System\CrAibNY.exe
  C:\Windows\System\CrAibNY.exe
  2⤵
  PID:9948
- C:\Windows\System\gfBjMTC.exe
  C:\Windows\System\gfBjMTC.exe
  2⤵
  PID:9964
- C:\Windows\System\xxGjfku.exe
  C:\Windows\System\xxGjfku.exe
  2⤵
  PID:9980
- C:\Windows\System\SirAXAu.exe
  C:\Windows\System\SirAXAu.exe
  2⤵
  PID:9996
- C:\Windows\System\pjrMMnq.exe
  C:\Windows\System\pjrMMnq.exe
  2⤵
  PID:10012
- C:\Windows\System\sowEVVz.exe
  C:\Windows\System\sowEVVz.exe
  2⤵
  PID:10076
- C:\Windows\System\xDBnoLr.exe
  C:\Windows\System\xDBnoLr.exe
  2⤵
  PID:10164
- C:\Windows\System\NFfMXUe.exe
  C:\Windows\System\NFfMXUe.exe
  2⤵
  PID:10200
- C:\Windows\System\hvIejxK.exe
  C:\Windows\System\hvIejxK.exe
  2⤵
  PID:10216
- C:\Windows\System\pzWNAnL.exe
  C:\Windows\System\pzWNAnL.exe
  2⤵
  PID:10236
- C:\Windows\System\FELEjXS.exe
  C:\Windows\System\FELEjXS.exe
  2⤵
  PID:8528
- C:\Windows\System\aQqImUn.exe
  C:\Windows\System\aQqImUn.exe
  2⤵
  PID:9092
- C:\Windows\System\szJlBFt.exe
  C:\Windows\System\szJlBFt.exe
  2⤵
  PID:9292
- C:\Windows\System\DAWgZnO.exe
  C:\Windows\System\DAWgZnO.exe
  2⤵
  PID:7944
- C:\Windows\System\BxBvCfG.exe
  C:\Windows\System\BxBvCfG.exe
  2⤵
  PID:9492
- C:\Windows\System\sAUMLwB.exe
  C:\Windows\System\sAUMLwB.exe
  2⤵
  PID:9520
- C:\Windows\System\OnDZjXB.exe
  C:\Windows\System\OnDZjXB.exe
  2⤵
  PID:9528
- C:\Windows\System\pbwdULK.exe
  C:\Windows\System\pbwdULK.exe
  2⤵
  PID:9384
- C:\Windows\System\kqroXau.exe
  C:\Windows\System\kqroXau.exe
  2⤵
  PID:9428
- C:\Windows\System\fGBRbYl.exe
  C:\Windows\System\fGBRbYl.exe
  2⤵
  PID:10144
- C:\Windows\System\ysUvBRD.exe
  C:\Windows\System\ysUvBRD.exe
  2⤵
  PID:9536
- C:\Windows\System\fUUzIqZ.exe
  C:\Windows\System\fUUzIqZ.exe
  2⤵
  PID:9716
- C:\Windows\System\BXbpqTi.exe
  C:\Windows\System\BXbpqTi.exe
  2⤵
  PID:9852
- C:\Windows\System\bPqvtVI.exe
  C:\Windows\System\bPqvtVI.exe
  2⤵
  PID:9872
- C:\Windows\System\FGfAriF.exe
  C:\Windows\System\FGfAriF.exe
  2⤵
  PID:9896
- C:\Windows\System\HLgUWRp.exe
  C:\Windows\System\HLgUWRp.exe
  2⤵
  PID:9912
- C:\Windows\System\EjUAQQd.exe
  C:\Windows\System\EjUAQQd.exe
  2⤵
  PID:9992
- C:\Windows\System\Anptuer.exe
  C:\Windows\System\Anptuer.exe
  2⤵
  PID:10032
- C:\Windows\System\ZKTuaSi.exe
  C:\Windows\System\ZKTuaSi.exe
  2⤵
  PID:10048
- C:\Windows\System\IMjAFqU.exe
  C:\Windows\System\IMjAFqU.exe
  2⤵
  PID:9700
- C:\Windows\System\gfLCQxz.exe
  C:\Windows\System\gfLCQxz.exe
  2⤵
  PID:2764
- C:\Windows\System\gRysTwQ.exe
  C:\Windows\System\gRysTwQ.exe
  2⤵
  PID:10208
- C:\Windows\System\vTpGmPn.exe
  C:\Windows\System\vTpGmPn.exe
  2⤵
  PID:9260
- C:\Windows\System\hkdjkiH.exe
  C:\Windows\System\hkdjkiH.exe
  2⤵
  PID:1492
- C:\Windows\System\SIYBbPK.exe
  C:\Windows\System\SIYBbPK.exe
  2⤵
  PID:10172
- C:\Windows\System\zhFdSXJ.exe
  C:\Windows\System\zhFdSXJ.exe
  2⤵
  PID:10176
- C:\Windows\System\rJLdGMR.exe
  C:\Windows\System\rJLdGMR.exe
  2⤵
  PID:9504
- C:\Windows\System\PxXEkMq.exe
  C:\Windows\System\PxXEkMq.exe
  2⤵
  PID:9272
- C:\Windows\System\YIbonlP.exe
  C:\Windows\System\YIbonlP.exe
  2⤵
  PID:9296
- C:\Windows\System\fTjEpec.exe
  C:\Windows\System\fTjEpec.exe
  2⤵
  PID:2868
- C:\Windows\System\xApQAui.exe
  C:\Windows\System\xApQAui.exe
  2⤵
  PID:9316
- C:\Windows\System\QIpgphD.exe
  C:\Windows\System\QIpgphD.exe
  2⤵
  PID:9684
- C:\Windows\System\dGiwGVk.exe
  C:\Windows\System\dGiwGVk.exe
  2⤵
  PID:9356
- C:\Windows\System\CrEFskP.exe
  C:\Windows\System\CrEFskP.exe
  2⤵
  PID:9372
- C:\Windows\System\sXYDnOG.exe
  C:\Windows\System\sXYDnOG.exe
  2⤵
  PID:9396
- C:\Windows\System\IzeYaJH.exe
  C:\Windows\System\IzeYaJH.exe
  2⤵
  PID:9412
- C:\Windows\System\CSmNAmS.exe
  C:\Windows\System\CSmNAmS.exe
  2⤵
  PID:10020
- C:\Windows\System\UJFzdYn.exe
  C:\Windows\System\UJFzdYn.exe
  2⤵
  PID:9668
- C:\Windows\System\JwYBvPy.exe
  C:\Windows\System\JwYBvPy.exe
  2⤵
  PID:9580
- C:\Windows\System\cgKANpS.exe
  C:\Windows\System\cgKANpS.exe
  2⤵
  PID:10004
- C:\Windows\System\tGeUGYX.exe
  C:\Windows\System\tGeUGYX.exe
  2⤵
  PID:9540
- C:\Windows\System\ZnKMwvp.exe
  C:\Windows\System\ZnKMwvp.exe
  2⤵
  PID:9944
- C:\Windows\System\pvZIsRQ.exe
  C:\Windows\System\pvZIsRQ.exe
  2⤵
  PID:10124
- C:\Windows\System\RmmKEUp.exe
  C:\Windows\System\RmmKEUp.exe
  2⤵
  PID:10064
- C:\Windows\System\ttGYGSs.exe
  C:\Windows\System\ttGYGSs.exe
  2⤵
  PID:9224
- C:\Windows\System\AmMnSoZ.exe
  C:\Windows\System\AmMnSoZ.exe
  2⤵
  PID:10192
- C:\Windows\System\JHEOEhz.exe
  C:\Windows\System\JHEOEhz.exe
  2⤵
  PID:9908
- C:\Windows\System\qDxNUFM.exe
  C:\Windows\System\qDxNUFM.exe
  2⤵
  PID:10060
- C:\Windows\System\MMcAScx.exe
  C:\Windows\System\MMcAScx.exe
  2⤵
  PID:8072
- C:\Windows\System\pSOVRIH.exe
  C:\Windows\System\pSOVRIH.exe
  2⤵
  PID:9236
- C:\Windows\System\hYVVMdo.exe
  C:\Windows\System\hYVVMdo.exe
  2⤵
  PID:10232
- C:\Windows\System\mmxzGkk.exe
  C:\Windows\System\mmxzGkk.exe
  2⤵
  PID:9308
- C:\Windows\System\EZnHBYU.exe
  C:\Windows\System\EZnHBYU.exe
  2⤵
  PID:9348
- C:\Windows\System\dLLkGgH.exe
  C:\Windows\System\dLLkGgH.exe
  2⤵
  PID:9452
- C:\Windows\System\zmZFrhA.exe
  C:\Windows\System\zmZFrhA.exe
  2⤵
  PID:9812
- C:\Windows\System\HHyGhAo.exe
  C:\Windows\System\HHyGhAo.exe
  2⤵
  PID:9800
- C:\Windows\System\IyhHCtP.exe
  C:\Windows\System\IyhHCtP.exe
  2⤵
  PID:9324
- C:\Windows\System\zfZVTgJ.exe
  C:\Windows\System\zfZVTgJ.exe
  2⤵
  PID:9744
- C:\Windows\System\uxzOErb.exe
  C:\Windows\System\uxzOErb.exe
  2⤵
  PID:936
- C:\Windows\System\UOhGXrz.exe
  C:\Windows\System\UOhGXrz.exe
  2⤵
  PID:9600
- C:\Windows\System\HHQrYzg.exe
  C:\Windows\System\HHQrYzg.exe
  2⤵
  PID:9772
- C:\Windows\System\KDLYEkY.exe
  C:\Windows\System\KDLYEkY.exe
  2⤵
  PID:9792
- C:\Windows\System\cQSKQFd.exe
  C:\Windows\System\cQSKQFd.exe
  2⤵
  PID:9828
- C:\Windows\System\ChaXaAy.exe
  C:\Windows\System\ChaXaAy.exe
  2⤵
  PID:9888
- C:\Windows\System\jEkFQYr.exe
  C:\Windows\System\jEkFQYr.exe
  2⤵
  PID:9880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BxTZjhG.exe

Filesize
1.9MB

MD5
1d5a4fcdcaced5895ae93e14488e7fd5

SHA1
3c4bb48533aa8b15c79abb162967b806c6055705

SHA256
34a9eff51e9a42c4b0970d6af1c64e7d7bb34a1e38120e6aace5510d8d86b9f3

SHA512
aab5f0c7231b2daabb890cbe4e52113b8dedaec9a8d58f3e54f30809c51cb732714c2257c13d4ae168961d4f8ef5253f55eec8efdd9a23152b8945138010cdf8

Download Submit
C:\Windows\system\DoDvlJW.exe

Filesize
1.9MB

MD5
b157c1bca90d7d8b42859598867dbb98

SHA1
3089d4e92a1fbdb0d68bc1d74b69f1e38b3b5adf

SHA256
6a83605e328d4c2b62718ce1a0a069016011829ed63e8e6ddbd5410e655634ac

SHA512
0af1afeb24c964fedcbb4533bd23bd90f3d538628a3ed847248c41541fcd5cf9bc8125917eddc54a6f61119ff58d6e88afc089a17706b8a8e0542afa13d3a12e

Download Submit
C:\Windows\system\KUwuZZt.exe

Filesize
1.9MB

MD5
8fd2a2a38b9c9fc33f7ffc09cefc1ec5

SHA1
2830f1ce34c2c912257f240cf24a14e75bdcd6a6

SHA256
520b92ccac744500de1cc2370bd890302861d6afeeb5b5cab9eb060a7e8f4505

SHA512
cfb644feef230ab15519d3852bc213bea05366562ceb5ce80ed0a1f9e6d03add03566ebef9bf81ad509f279dcd49f29eb2d1cfc215aa6d8d3dcdc9c5d23a4236

Download Submit
C:\Windows\system\LOAkJjP.exe

Filesize
1.9MB

MD5
b9604ce064aa280640e6f0c8feac344b

SHA1
bb599a26147106aa56c96a47474dbfa65a63f245

SHA256
175d89169b3830e9f272beb470a5e6fdc255a229cba3fadf7436525899d6d701

SHA512
56b9433f86f370ec3567b79a65bc77e01f2a3fdd309a06e92a3824c4bac53d9a6cd42167ffe1f74581e856d02790813150dc02d1c01c853cd216658113119789

Download Submit
C:\Windows\system\OBKEgXt.exe

Filesize
1.9MB

MD5
0fff37658332d6685623e0ef8c7b0c25

SHA1
3694b7c3206a101cd74c7192971dee8a672cc5d4

SHA256
928b6e5c4c228654903026311f70a1f6cae252596efe21c6221bae23107b529c

SHA512
a071d1726851fb4a6787933a3a066ab7ce387722883d6662ec9bdd61090968aa9900ad5607d457b7f59b01e3aec90c9ae7664dbd08190eb6802aaf92de775a8f

Download Submit
C:\Windows\system\PMZjsYS.exe

Filesize
1.9MB

MD5
e44cb1282c8d755a6fa20e62c0e11d79

SHA1
75dd97e225a5ed11196b50fa2c5ce03eaedde164

SHA256
2d35c6d4db687ac25051f4c0a8c34f4e59ed8f9b56af2ddb34950e7eec03223c

SHA512
e0b46e542fe72b1fc20dc59ab095ad912821b997f0fe119a81bbc68a750a9dff8acb2c7dabdb2fc9fc84f14203b7aabd9835156312d93b76a9865a45308ff692

Download Submit
C:\Windows\system\PTlOchH.exe

Filesize
1.9MB

MD5
15e2c7e9626f0755f80ecc00c3518545

SHA1
620656f89338c7b76fe0b4afb1d165194d3e13fc

SHA256
e17c0cfc733fe2a8f10368f88efb3ea8ce422803ed52d7a8703fbd4b50945823

SHA512
248a5e8b7325c3b12f57b5f14e0b9ac7d299d3708cc97e6db9f01b9301aa38f1b9c3fe566801a70016685a2d9c119724993efa2382e79d0d96b0cf8c13e2731c

Download Submit
C:\Windows\system\QOkGnfQ.exe

Filesize
1.9MB

MD5
11a4dcef23f9ddca71fc9bba012bca26

SHA1
69d8a8910f699c95886630f4ef497ed70c9e9aa5

SHA256
0e7595573091de3bff0491e181c867cdb607359399b556874839b7010f657045

SHA512
05f268e18cfc24c7296dbeb11421eacd2d222a2665be0d5448871dc6fb2f9de714a9739db742b9d16e047c067ddeccf971dc33645d482bb170b9099100a4602c

Download Submit
C:\Windows\system\SLsEEaC.exe

Filesize
1.9MB

MD5
6863aa17acce28779d1704e5d0205b9d

SHA1
0dd15b013dc737f7d30a7551b1b491bd8a4971c3

SHA256
edb5ecac939907bf3658ccae3fd5c70ecb7bb32d0409ce4c595aa454344311f5

SHA512
189227e339f3589b23fb027bb5958205f12395b2f1660c33fb6466196ec5289d7a84b5aca9334954b140218c7343c12e638067831c80258a1bef8a7cd20062a1

Download Submit
C:\Windows\system\VzrUNUQ.exe

Filesize
1.9MB

MD5
0269dafa2147d0ac2bc51d653e0cd9d7

SHA1
03a11b1961d02169abee49e83e773afea9236c06

SHA256
1bd149eff0b87183c87789963de82c3d2ccee757a1c9de7e2229028fd03a7d3e

SHA512
203bdec1ce49ae09c2c13ca585b7cc26c0b04b11138a5786f5f67a9864969634497b9c17bcc0c0977b3b2aaccd13016b7f7bf51ebc8727bce2f9a6f99d7243df

Download Submit
C:\Windows\system\WVdoqXV.exe

Filesize
1.9MB

MD5
e9536019d592534297ead93538ae5cb5

SHA1
de4bf5d7683e82c65ddf41bc1de200b777eae7db

SHA256
cdacefb3cc25cea84871c9aa7a766345af86fa30c6a378b1eb259fadb44278b7

SHA512
1dab362455a9f00a6ce3e497fa29a1032f1445d48b33f5d3ba708eaee582f0a88d37be6f7c8a35d9db1134a9af38c3aef3a0a4acd213f8b66e00507ed9f32f3b

Download Submit
C:\Windows\system\ZCXOVcD.exe

Filesize
1.9MB

MD5
80fdd6aefb95631e394fd4a83b65ebd7

SHA1
cbb99eecb208269ed7e0d7656524e1e81dc99fe2

SHA256
8049f376beac6c887311dc663f952284b1f730c3d40cca7d6dd3c55f8305b06e

SHA512
e0512bc77e54723c25c1e5d6c7f0aa4ac03c893a4466a5855bc42db8ae0166540acb0d599e307e9154ead148fd839048caf0de464cc1124610eab6dbc61e2240

Download Submit
C:\Windows\system\bstZWTO.exe

Filesize
1.9MB

MD5
627898df94b31a8a415ef602262b8862

SHA1
286bd90664aa50fe52f10f2a11ed1bed493e3b35

SHA256
7a9152a6ba9941e6e18e7e40afb05c2e86862821e3966741a2fa92089eddf7e9

SHA512
1fb268f8ae117e4a556e09a531377be90765f8fc73586ece7d87687f177667db0cdb4e8f79cadbdf277969afc7ce63ad2323ccc3ca59ccd6bb9bc1eab0b879e1

Download Submit
C:\Windows\system\eYCicdp.exe

Filesize
1.9MB

MD5
3b56e281053fe2eb6397aa772ce7cdd0

SHA1
6c942e18e5d2eed8e7891033ce43cc31eb440e99

SHA256
3eb2e83862473e8162b9ea40d3332ec2cfdd2fa23e392de7d61be1e97c512658

SHA512
ff53fe7ebe9c253e8d71ca8fa18a18d8756ead6084b31c95f526b3d64bc1706d81d7d41a8d288acf63c2acabbf3ad3575accbc7d1dac852f41dad4fde7c3d8f9

Download Submit
C:\Windows\system\ekXPdmp.exe

Filesize
1.9MB

MD5
582a5a62bbe8b05ab8036a977c9fdae9

SHA1
bb171c73e4c65ed425585a4fe1c2c0f877fb239f

SHA256
be5e3659ddbadf456c6a70f21a3e8d25932d6e77511f8e01aaaea37befd6a696

SHA512
701c27c9dd030686711a6f6f4801adc6bcd7a06d78af5b2338d0f4371b6f40da1237b8270e8963847fc1a270714c4bdcd6e3ba8278ed8ec3c5b9366df51288ac

Download Submit
C:\Windows\system\hsuZBXr.exe

Filesize
1.9MB

MD5
0574b88b9abb00b59655e3beb479414a

SHA1
c497b33df99ee9a58219f27163299b2990ff34a1

SHA256
ab8eeec61cf8bcbf266a392b6d5eb8a072f20389ab9f0dd6c3171d61ed3c7d4c

SHA512
9483358b66861a92a951debbf5d4bea0dbee36d4dc300594ac2cf380d580f5e6cbc7f2b4832412898139a09cc39511decd3bf4f68c503479eaab2d3e41efa8a7

Download Submit
C:\Windows\system\jaasWGh.exe

Filesize
1.9MB

MD5
f4f0ba332fb3459b88e4cd71fa277da7

SHA1
9ed6077a50d74ab1ef095c2680e6c76d1ad76e4e

SHA256
a7d45788ac5f55923f4d738c42188a996718857dd5fbfa3ca4ae67dedcf7469b

SHA512
d0392aba1ebeeb3cb6cd772c0556d9ef71961c748f3abb6372b488c83a0a8864d5394820ed532a16dc9248bfd8267c7b11172d2460e54babde7db90b352a2480

Download Submit
C:\Windows\system\jyhTsyc.exe

Filesize
1.9MB

MD5
6daa1c884f49bfc5f50ab659feb8dc1e

SHA1
dc9898d4aff11656d7c020e02d98bd8951703717

SHA256
f975eaabfd6f51d81ac56e5f35ef190d03b4d3c465c14ff9747d78fd85935cd0

SHA512
17073babe83f9a9c7fe2a656d00d3cead9fa052aa21852dfa0a1a4260467d5a4d4e12162ee1377ac8294f87c6f8cfd1c6d3e42ea3765bd3cf20d6bee9ffdbadf

Download Submit
C:\Windows\system\lGzoLba.exe

Filesize
1.9MB

MD5
e520b274f4a2fd2da98c62e3b11ce17c

SHA1
94575c27af44e913b7baa436e45a0f9fcaed9e88

SHA256
5ae2c9c7e6c66889cd7915e4b64f86bd27d54e3c18ff2f3e1922e35d11d01893

SHA512
69742d868122f69f8fa8eede13e23decf5f977023886986331a6dfb1b08634b8598bde0eff19a44892bfdb4e6709b8f43d63d303a855022d59803f959de40193

Download Submit
C:\Windows\system\nSeoOvT.exe

Filesize
1.9MB

MD5
065543c13b6b79f18aaa49fa5fcf9b39

SHA1
b4123f03f5c3c85aff601637509818fe3837ddee

SHA256
461b12eea557bbbffa704c20ffbfdecee5d17914ac2bb89da2d88a13d2116ad3

SHA512
6b2ed93096fe16fc0b6d2c5684a5c775dceaa70ebe72c942dc856c1081705913790128e000f251026529d84ee5bc5bbd6cb24e2726987fdff1095e58e3611f16

Download Submit
C:\Windows\system\oCwcBlM.exe

Filesize
1.9MB

MD5
d600c99400946ad1beef85bc8773b20f

SHA1
939efd06e249127301e911204c57dff435d68782

SHA256
710e4dad957c88df19a36038ebc981189d66d28f7c6f252a99b15e6e2bd34be9

SHA512
ef3e80934146c9cd4db33b4e3420ac0c20747908661186ea92a04fa839c9f2ebb16aa3a028e340dd49983bea41497d462c340fa8acd54e05cd30396705bb24c9

Download Submit
C:\Windows\system\ppjanrj.exe

Filesize
1.9MB

MD5
36ecdf8b506365bd0028c8a63bbc5d6e

SHA1
b9c747bd7697e643e880205c009fdab53eadb044

SHA256
c4fb38d144342c9c5f242485a7ea363ce5117f61509f4736873b17d9df864c0b

SHA512
e3a04666df4642fa43d4973a2ba741cae10505eeaaa5fb343b4f4e0365d0c5aafe76674358fb97762f1548294b32a85a803552956a6e24ca6e8eab26254e7fda

Download Submit
C:\Windows\system\qlWJEmj.exe

Filesize
1.9MB

MD5
0972d1e31c163ab0b1ae0e95a7c0c081

SHA1
f457178c4d9850bbc5f0d4538752b51cad029790

SHA256
e833ea5ce4497c4996345e1563934761b309a675205bb4f9beabda20dc9a28ed

SHA512
fe98729eb842994d8cf56bd1777f768f9caecb3020a3ebe5d2d5636cbe81263f23a755d0013c306a9b7afc847ae95f0a7f5e91f791cbb97edb60eac9c58185d4

Download Submit
C:\Windows\system\tCBYgSk.exe

Filesize
1.9MB

MD5
c750260e9016120738ffab0e65888d14

SHA1
ec48b3e4140f4dab3a1725352d22767cea8edcc8

SHA256
0ca83aa25cc58933c5ae4206dd57b24f5cedcaaf461454967042eb34d59e1881

SHA512
931b5714297f5eeb885d93bc08f6ff97d231bd5bfbfb0700fa4fa4e2ce68f821b90cbd13e0daf1954b95d65aa232d54181399d6dba47b786b2b1cdccfe798814

Download Submit
C:\Windows\system\vXHSBhS.exe

Filesize
1.9MB

MD5
3c9284c8fb15cfd7053a561d39031790

SHA1
3eab3f948f1a4f63f76c74199261a63a29481e19

SHA256
60444ee25d21767e1f84c74acf0f7584493863e93a6370fe29b497f906f0c995

SHA512
d50f98cc0f903112efdcf2047479ee2887a4b9f36d04669fa05f0d732affe77bd4bcf43f014183685af865e89b22f52f6b7fe2479b69729c2e7538cd8b9e2e3c

Download Submit
C:\Windows\system\wwBTmdi.exe

Filesize
1.9MB

MD5
ce6d32484bf744cf54bcd8ad95ed62b8

SHA1
b79b98fba1fdccd2b81219e22bf8a65ffcc975f7

SHA256
9f8d42e747aa87ecdc8f058a437509792f7b5f85395bc196c05381ac54b1d9b5

SHA512
8c629dbf33f1d2aa0d212eb6c001618ecd886bf6ec3000d00f1492d7c34c0f3deaac9308850ba7c113c81ce3db9e155941e8fa3a457747d919e610d5bbcbc122

Download Submit
C:\Windows\system\yjgyUyE.exe

Filesize
1.9MB

MD5
0c760a9ba3d964a88cb539dec37d937e

SHA1
1205538101262c370dcaacca8538b43861a9a315

SHA256
d6a0d4cc133f0d24aa9f7b2923d7546ac405988781edbc93f217a91985ee27c3

SHA512
03b5f81ace91389fe78f01fc1becd281cb242b562238069483964e8c93b5a37e23840bc99df5c4a6b169f3abfb8971925a7ccee9f6bbb1c81efdaab8c6229121

Download Submit
C:\Windows\system\zPMrkZv.exe

Filesize
1.9MB

MD5
49b357be173c75de72eeecd9fb19e4a8

SHA1
afde9d0d021a7f86bd0eccc44cb09dc643df4000

SHA256
e07d80dd7f4bc5a8c1a033bd269715928356312d6bdc5cdc0ae49cd687384ad7

SHA512
a9a473c0fe8e9fd282fef0528e4777cf7ba302182054944fdc4e480eed16d8cb83076f75c5c1764e521f006aa39822b6371b8239f24392a445c5612c1df794bc

Download Submit
\Windows\system\EdTvmtP.exe

Filesize
1.9MB

MD5
8c74766e919f4036bf74ade9e70ad9c8

SHA1
81ac9bd093a4f0e9d7519c58d7120c86837048c7

SHA256
de0e71dc55ab542d0e263c8edf0cf0c133626c8621c9601a7e40e273ad9df40d

SHA512
b7d1394944b530ed2f52c1ed566e50485202173ef0a03eb287906e36cfb2ce311ed5642f91f853fc8e7b2b09aae858795a6fe5cf51f4620a99e0d376a63ca85a

Download Submit
\Windows\system\NIHGvXm.exe

Filesize
1.9MB

MD5
dfd6ab4b4fc9906a776a40d4c99e1d6d

SHA1
991aa4846c30d151e3b82e700fcc9b854487d3ba

SHA256
acafd9c50f598704f87bde78dd43b2616c8d816a61b7ee0ffeffe2e5689bdc38

SHA512
cc4069973fe097d4c01ed57cdf5ee2ac583cf8fc4a3dcd8446938d36960250b1f1e6876239ee386d4c72ec85dc637148f01ff2adac62ce479a9cd4f6594af955

Download Submit
\Windows\system\QTwexTE.exe

Filesize
1.9MB

MD5
c98d24d8148aa63a1d276c4dfce2e48e

SHA1
53d8a9b0728313ed7f4cdb700ad0f49050b04612

SHA256
25057e5f360842985bd5a98582cb5b46531f0670c9f8ab1ac0e5c7d032d405c2

SHA512
42181c06fc1bf531a10bc3f754eaace5888c4de0ea038b2e61dcf1b9af0a3b147e817daedae4dc612d014ad0b31b32540ea2d38eb69c93c3e99764359394ba7a

Download Submit
\Windows\system\XfaXYNE.exe

Filesize
1.9MB

MD5
7f286c401a864a9695ba9692f363a8c9

SHA1
917477eda74117578ec05a2274c15db0637637a0

SHA256
220775a0a999339fe715c6ce671d5118e62a87c6f8653ed057a815cda378bb23

SHA512
ac82f007e2ded93a0448302091f18c039e9bf9d56ba1cd7de3407fee677a77050d41c376552a590847f27ac8d80f109dcc779a8b037b8db0c675d7d676427a37

Download Submit
memory/556-2411-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/556-66-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/1400-104-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/1400-79-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/1400-95-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/1400-0-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/1400-42-0x0000000002D50000-0x0000000003142000-memory.dmp

Filesize
3.9MB

Download
memory/1400-71-0x0000000002D50000-0x0000000003142000-memory.dmp

Filesize
3.9MB

Download
memory/1400-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1400-94-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/1400-97-0x0000000002D50000-0x0000000003142000-memory.dmp

Filesize
3.9MB

Download
memory/1400-41-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/1400-38-0x0000000002D50000-0x0000000003142000-memory.dmp

Filesize
3.9MB

Download
memory/1400-90-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/1400-18-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/1400-16-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/1400-36-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/1400-67-0x0000000002D50000-0x0000000003142000-memory.dmp

Filesize
3.9MB

Download
memory/1776-51-0x0000000002470000-0x0000000002478000-memory.dmp

Filesize
32KB

Download
memory/1776-50-0x000000001B220000-0x000000001B502000-memory.dmp

Filesize
2.9MB

Download
memory/1884-420-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/1884-2403-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/1884-68-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2012-64-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-2404-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-2405-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-93-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-74-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2316-2394-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2316-422-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2492-39-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2492-2235-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2516-19-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2516-2419-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-424-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2576-2422-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2576-37-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2672-49-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2672-2407-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2772-425-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2784-21-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2784-2406-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2840-426-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2956-96-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-2408-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-20-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download