xmrig | d7fa01281398b842507a9493e22f65cb40b9098c024d2720ebafbf6e4f07021a

Analysis

max time kernel
96s
max time network
94s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
Size

1.9MB
MD5

0158856e5f93b80c6af9d86291d1f98a
SHA1

9779130689636df3755ec8a7482213089035db8f
SHA256

d7fa01281398b842507a9493e22f65cb40b9098c024d2720ebafbf6e4f07021a
SHA512

6fd4cd0071ab43e58ea716e90ca2ab747500170e802babc0c07b479432db34085373bba5cf64f0d3518063f5801c6ed53180ddbfd2c7a2d04cc6aeaa75494ef2
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Ul:NABa

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

resource	yara_rule
behavioral1/memory/2740-13-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2704-49-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2396-83-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2976-81-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/1076-78-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2476-38-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/2448-36-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/3060-34-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig
behavioral1/memory/3060-343-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig
behavioral1/memory/3048-227-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/2396-2853-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2740-3075-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2476-3074-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/2448-3070-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2976-3710-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2740	PtkNIqj.exe
3060	qADQxAL.exe
2448	FrdxJQD.exe
2476	fnuxCEm.exe
2704	hTJFqND.exe
2976	rRgnxgV.exe
2396	psfIXoV.exe
1076	XsDTiFc.exe
1104	DSUTzjQ.exe
1944	aBkLESN.exe
1708	fPvJqKI.exe
2828	SRpTsfz.exe
1324	PDoDJOe.exe
1936	BTAAfUU.exe
1428	TajQpkz.exe
1456	MuvufVh.exe
1824	XarlXgm.exe
2652	adafvKK.exe
1864	JObNaBJ.exe
2672	HuwGDGc.exe
2664	QAHWUna.exe
1032	QHMzltl.exe
1840	ETKGWLN.exe
1048	qjGAoPK.exe
1756	cRQNNGF.exe
2256	qnxHEGS.exe
1844	ZloCUjE.exe
1552	YSRfOub.exe
1648	jyDaBnr.exe
2176	LUcywWM.exe
1476	VYRMGYB.exe
1592	ZmloKoo.exe
3064	gTKioVw.exe
2884	BaBAciq.exe
1912	BPAsVzF.exe
1108	qtOkdAr.exe
1344	lBCQBRM.exe
1528	lVfRivS.exe
2640	pVBHXSj.exe
2792	BZvbYyB.exe
1376	RtKBNRS.exe
2084	uKSGmZi.exe
1880	QGrPyWA.exe
1400	OgrkJjX.exe
2896	vTSKrWY.exe
1280	lYNDtoC.exe
320	urYjiBj.exe
892	BDHISbg.exe
1692	dTACBwy.exe
2228	ScgvigQ.exe
2236	KawZdQM.exe
1636	eIxdGbo.exe
1764	hZQuaJe.exe
1724	CtmYRIo.exe
2916	bTCRKWF.exe
2348	ckgRgph.exe
2016	LkfdYoL.exe
1740	EJMByKs.exe
2248	dYnHBiJ.exe
1876	FinaKRX.exe
2924	VSYvwVN.exe
1572	ShigUKs.exe
1568	gsNmSFc.exe
2572	fyCQDOF.exe

Loads dropped DLL 64 IoCs

pid	Process
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3048-0-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/files/0x0009000000014909-9.dat	upx
behavioral1/memory/2740-13-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-14.dat	upx
behavioral1/files/0x000e000000014e3d-24.dat	upx
behavioral1/files/0x0008000000015264-43.dat	upx
behavioral1/files/0x00070000000155d4-41.dat	upx
behavioral1/memory/2704-49-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/files/0x000900000001560a-55.dat	upx
behavioral1/files/0x0006000000016d01-65.dat	upx
behavioral1/memory/2396-83-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/files/0x0006000000016d24-82.dat	upx
behavioral1/memory/2976-81-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/files/0x0009000000015cb9-57.dat	upx
behavioral1/memory/1076-78-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/files/0x0006000000016d11-71.dat	upx
behavioral1/files/0x0007000000016cf0-64.dat	upx
behavioral1/memory/2476-38-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/memory/2448-36-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/3060-34-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/files/0x0007000000015364-31.dat	upx
behavioral1/files/0x0006000000016d36-91.dat	upx
behavioral1/files/0x0006000000016d41-97.dat	upx
behavioral1/files/0x0006000000016d4a-100.dat	upx
behavioral1/files/0x0006000000016d55-110.dat	upx
behavioral1/files/0x0006000000016d4f-109.dat	upx
behavioral1/files/0x0006000000016d84-115.dat	upx
behavioral1/files/0x0006000000016e56-125.dat	upx
behavioral1/files/0x000500000001868c-137.dat	upx
behavioral1/files/0x00050000000186a0-145.dat	upx
behavioral1/files/0x0006000000018ae8-153.dat	upx
behavioral1/files/0x0006000000018b33-161.dat	upx
behavioral1/memory/3060-343-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/memory/3048-227-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/files/0x0006000000018b4a-173.dat	upx
behavioral1/files/0x0006000000018b42-169.dat	upx
behavioral1/files/0x0006000000018b37-165.dat	upx
behavioral1/files/0x0006000000018b15-157.dat	upx
behavioral1/files/0x0006000000018ae2-149.dat	upx
behavioral1/files/0x0005000000018698-141.dat	upx
behavioral1/files/0x0006000000017090-133.dat	upx
behavioral1/files/0x000600000001704f-129.dat	upx
behavioral1/files/0x0006000000016d89-120.dat	upx
behavioral1/memory/2396-2853-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2740-3075-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/2476-3074-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/memory/2448-3070-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2976-3710-0x000000013FE80000-0x0000000140272000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UEqmcgt.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\soXcCpi.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\yczxUHm.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\QDsxPDt.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\ecCiyPB.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\IgfgjnD.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\nCXOYsp.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\yesoqED.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\AZBIroq.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\muEzqgu.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\XkdOiNR.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\MWUQyNp.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\bVPBvXa.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\uWWXaIz.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\mxqajUq.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\qAupExT.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\jpNUFWD.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\pRVvAAU.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\hcNAtpX.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\TWIrnxq.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\EWEmgUN.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\DSUTzjQ.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\bZsSHCS.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\zqMBCUS.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\gNLMezS.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\pxHSMNf.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\gPuilqG.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\lYEiCDF.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\DNgzjpq.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\VqzenyP.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\qYrZoWi.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\dYnHBiJ.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\kzOvDPu.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\iHvLjch.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\QIlbLFh.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\UJPtgQT.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\ZWFWmCo.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\EYSFAZB.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\utKYodK.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\RwSeVjK.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\CfCgYOB.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\PnPdezo.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\fAlrUdl.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\pZnmUPJ.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\pRaQIqJ.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\DNiDuRS.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\XnGVhLV.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\DkHvsjK.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\jKVLHqA.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\DUJmhQe.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\GwlzBVb.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\HYQUZcC.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\XkakXwr.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\jhVLCJi.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\wCbRcGm.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\rdJMpzf.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\QYlohwX.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\DiVCYMI.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\hHcTtZe.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\ZDMkBKl.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\BDhHZSb.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\JVcQOLH.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\UrFMXKy.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\NesjoTi.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3012	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
Token: SeDebugPrivilege	3012	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 3012	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	29
PID 3048 wrote to memory of 3012	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	29
PID 3048 wrote to memory of 3012	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	29
PID 3048 wrote to memory of 2740	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	30
PID 3048 wrote to memory of 2740	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	30
PID 3048 wrote to memory of 2740	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	30
PID 3048 wrote to memory of 3060	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	31
PID 3048 wrote to memory of 3060	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	31
PID 3048 wrote to memory of 3060	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2448	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	32
PID 3048 wrote to memory of 2448	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	32
PID 3048 wrote to memory of 2448	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	32
PID 3048 wrote to memory of 2704	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	33
PID 3048 wrote to memory of 2704	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	33
PID 3048 wrote to memory of 2704	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	33
PID 3048 wrote to memory of 2476	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	34
PID 3048 wrote to memory of 2476	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	34
PID 3048 wrote to memory of 2476	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	34
PID 3048 wrote to memory of 2976	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	35
PID 3048 wrote to memory of 2976	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	35
PID 3048 wrote to memory of 2976	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	35
PID 3048 wrote to memory of 2396	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	36
PID 3048 wrote to memory of 2396	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	36
PID 3048 wrote to memory of 2396	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	36
PID 3048 wrote to memory of 1944	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	37
PID 3048 wrote to memory of 1944	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	37
PID 3048 wrote to memory of 1944	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	37
PID 3048 wrote to memory of 1076	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	38
PID 3048 wrote to memory of 1076	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	38
PID 3048 wrote to memory of 1076	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	38
PID 3048 wrote to memory of 1708	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	39
PID 3048 wrote to memory of 1708	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	39
PID 3048 wrote to memory of 1708	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	39
PID 3048 wrote to memory of 1104	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	40
PID 3048 wrote to memory of 1104	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	40
PID 3048 wrote to memory of 1104	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	40
PID 3048 wrote to memory of 2828	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	41
PID 3048 wrote to memory of 2828	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	41
PID 3048 wrote to memory of 2828	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	41
PID 3048 wrote to memory of 1324	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	42
PID 3048 wrote to memory of 1324	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	42
PID 3048 wrote to memory of 1324	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	42
PID 3048 wrote to memory of 1936	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	43
PID 3048 wrote to memory of 1936	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	43
PID 3048 wrote to memory of 1936	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	43
PID 3048 wrote to memory of 1428	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	44
PID 3048 wrote to memory of 1428	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	44
PID 3048 wrote to memory of 1428	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	44
PID 3048 wrote to memory of 1456	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	45
PID 3048 wrote to memory of 1456	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	45
PID 3048 wrote to memory of 1456	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	45
PID 3048 wrote to memory of 1824	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	46
PID 3048 wrote to memory of 1824	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	46
PID 3048 wrote to memory of 1824	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	46
PID 3048 wrote to memory of 1864	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	47
PID 3048 wrote to memory of 1864	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	47
PID 3048 wrote to memory of 1864	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	47
PID 3048 wrote to memory of 2652	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	48
PID 3048 wrote to memory of 2652	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	48
PID 3048 wrote to memory of 2652	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	48
PID 3048 wrote to memory of 2672	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	49
PID 3048 wrote to memory of 2672	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	49
PID 3048 wrote to memory of 2672	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	49
PID 3048 wrote to memory of 2664	3048	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- C:\Windows\System\PtkNIqj.exe
  C:\Windows\System\PtkNIqj.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\qADQxAL.exe
  C:\Windows\System\qADQxAL.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\FrdxJQD.exe
  C:\Windows\System\FrdxJQD.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\hTJFqND.exe
  C:\Windows\System\hTJFqND.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\fnuxCEm.exe
  C:\Windows\System\fnuxCEm.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\rRgnxgV.exe
  C:\Windows\System\rRgnxgV.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\psfIXoV.exe
  C:\Windows\System\psfIXoV.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\aBkLESN.exe
  C:\Windows\System\aBkLESN.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\XsDTiFc.exe
  C:\Windows\System\XsDTiFc.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\fPvJqKI.exe
  C:\Windows\System\fPvJqKI.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\DSUTzjQ.exe
  C:\Windows\System\DSUTzjQ.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\SRpTsfz.exe
  C:\Windows\System\SRpTsfz.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\PDoDJOe.exe
  C:\Windows\System\PDoDJOe.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\BTAAfUU.exe
  C:\Windows\System\BTAAfUU.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\TajQpkz.exe
  C:\Windows\System\TajQpkz.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\MuvufVh.exe
  C:\Windows\System\MuvufVh.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\XarlXgm.exe
  C:\Windows\System\XarlXgm.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\JObNaBJ.exe
  C:\Windows\System\JObNaBJ.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\adafvKK.exe
  C:\Windows\System\adafvKK.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\HuwGDGc.exe
  C:\Windows\System\HuwGDGc.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\QAHWUna.exe
  C:\Windows\System\QAHWUna.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\QHMzltl.exe
  C:\Windows\System\QHMzltl.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\ETKGWLN.exe
  C:\Windows\System\ETKGWLN.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\qjGAoPK.exe
  C:\Windows\System\qjGAoPK.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\cRQNNGF.exe
  C:\Windows\System\cRQNNGF.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\qnxHEGS.exe
  C:\Windows\System\qnxHEGS.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\ZloCUjE.exe
  C:\Windows\System\ZloCUjE.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\YSRfOub.exe
  C:\Windows\System\YSRfOub.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\jyDaBnr.exe
  C:\Windows\System\jyDaBnr.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\LUcywWM.exe
  C:\Windows\System\LUcywWM.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\VYRMGYB.exe
  C:\Windows\System\VYRMGYB.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\ZmloKoo.exe
  C:\Windows\System\ZmloKoo.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\gTKioVw.exe
  C:\Windows\System\gTKioVw.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\BaBAciq.exe
  C:\Windows\System\BaBAciq.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\BPAsVzF.exe
  C:\Windows\System\BPAsVzF.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\qtOkdAr.exe
  C:\Windows\System\qtOkdAr.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\lBCQBRM.exe
  C:\Windows\System\lBCQBRM.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\lVfRivS.exe
  C:\Windows\System\lVfRivS.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\pVBHXSj.exe
  C:\Windows\System\pVBHXSj.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\BZvbYyB.exe
  C:\Windows\System\BZvbYyB.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\RtKBNRS.exe
  C:\Windows\System\RtKBNRS.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\uKSGmZi.exe
  C:\Windows\System\uKSGmZi.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\QGrPyWA.exe
  C:\Windows\System\QGrPyWA.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\OgrkJjX.exe
  C:\Windows\System\OgrkJjX.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\vTSKrWY.exe
  C:\Windows\System\vTSKrWY.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\lYNDtoC.exe
  C:\Windows\System\lYNDtoC.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\urYjiBj.exe
  C:\Windows\System\urYjiBj.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\BDHISbg.exe
  C:\Windows\System\BDHISbg.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\dTACBwy.exe
  C:\Windows\System\dTACBwy.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\ScgvigQ.exe
  C:\Windows\System\ScgvigQ.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\KawZdQM.exe
  C:\Windows\System\KawZdQM.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\eIxdGbo.exe
  C:\Windows\System\eIxdGbo.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\hZQuaJe.exe
  C:\Windows\System\hZQuaJe.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\CtmYRIo.exe
  C:\Windows\System\CtmYRIo.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\bTCRKWF.exe
  C:\Windows\System\bTCRKWF.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\ckgRgph.exe
  C:\Windows\System\ckgRgph.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\LkfdYoL.exe
  C:\Windows\System\LkfdYoL.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\EJMByKs.exe
  C:\Windows\System\EJMByKs.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\dYnHBiJ.exe
  C:\Windows\System\dYnHBiJ.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\FinaKRX.exe
  C:\Windows\System\FinaKRX.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\VSYvwVN.exe
  C:\Windows\System\VSYvwVN.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\ShigUKs.exe
  C:\Windows\System\ShigUKs.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\gsNmSFc.exe
  C:\Windows\System\gsNmSFc.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\fyCQDOF.exe
  C:\Windows\System\fyCQDOF.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\fJnWeFg.exe
  C:\Windows\System\fJnWeFg.exe
  2⤵
  PID:2716
- C:\Windows\System\XCWNKop.exe
  C:\Windows\System\XCWNKop.exe
  2⤵
  PID:2720
- C:\Windows\System\bNqxQWD.exe
  C:\Windows\System\bNqxQWD.exe
  2⤵
  PID:2808
- C:\Windows\System\dyjnPCK.exe
  C:\Windows\System\dyjnPCK.exe
  2⤵
  PID:2520
- C:\Windows\System\PHBPilK.exe
  C:\Windows\System\PHBPilK.exe
  2⤵
  PID:2556
- C:\Windows\System\gvhGGHh.exe
  C:\Windows\System\gvhGGHh.exe
  2⤵
  PID:2748
- C:\Windows\System\xjdpvRr.exe
  C:\Windows\System\xjdpvRr.exe
  2⤵
  PID:268
- C:\Windows\System\owDRQIy.exe
  C:\Windows\System\owDRQIy.exe
  2⤵
  PID:2400
- C:\Windows\System\lSpkcHA.exe
  C:\Windows\System\lSpkcHA.exe
  2⤵
  PID:2432
- C:\Windows\System\wgCNWuN.exe
  C:\Windows\System\wgCNWuN.exe
  2⤵
  PID:1772
- C:\Windows\System\zrYtOpE.exe
  C:\Windows\System\zrYtOpE.exe
  2⤵
  PID:1640
- C:\Windows\System\OpLITDy.exe
  C:\Windows\System\OpLITDy.exe
  2⤵
  PID:2568
- C:\Windows\System\EYDzEiu.exe
  C:\Windows\System\EYDzEiu.exe
  2⤵
  PID:1956
- C:\Windows\System\fxiuDxp.exe
  C:\Windows\System\fxiuDxp.exe
  2⤵
  PID:1728
- C:\Windows\System\IIuvcml.exe
  C:\Windows\System\IIuvcml.exe
  2⤵
  PID:2620
- C:\Windows\System\OOsVUlx.exe
  C:\Windows\System\OOsVUlx.exe
  2⤵
  PID:572
- C:\Windows\System\mVmPAWQ.exe
  C:\Windows\System\mVmPAWQ.exe
  2⤵
  PID:2484
- C:\Windows\System\sOjZneE.exe
  C:\Windows\System\sOjZneE.exe
  2⤵
  PID:2472
- C:\Windows\System\CDpvgXE.exe
  C:\Windows\System\CDpvgXE.exe
  2⤵
  PID:2192
- C:\Windows\System\QXIedYl.exe
  C:\Windows\System\QXIedYl.exe
  2⤵
  PID:1992
- C:\Windows\System\mxqajUq.exe
  C:\Windows\System\mxqajUq.exe
  2⤵
  PID:2764
- C:\Windows\System\nxYWRjF.exe
  C:\Windows\System\nxYWRjF.exe
  2⤵
  PID:2492
- C:\Windows\System\ADKAKLY.exe
  C:\Windows\System\ADKAKLY.exe
  2⤵
  PID:1580
- C:\Windows\System\MJWVrmA.exe
  C:\Windows\System\MJWVrmA.exe
  2⤵
  PID:2940
- C:\Windows\System\awMDQbn.exe
  C:\Windows\System\awMDQbn.exe
  2⤵
  PID:1336
- C:\Windows\System\XQdztRh.exe
  C:\Windows\System\XQdztRh.exe
  2⤵
  PID:2648
- C:\Windows\System\BhKMFvv.exe
  C:\Windows\System\BhKMFvv.exe
  2⤵
  PID:2012
- C:\Windows\System\gPplNtQ.exe
  C:\Windows\System\gPplNtQ.exe
  2⤵
  PID:2480
- C:\Windows\System\chmwnoQ.exe
  C:\Windows\System\chmwnoQ.exe
  2⤵
  PID:696
- C:\Windows\System\dUjVVHn.exe
  C:\Windows\System\dUjVVHn.exe
  2⤵
  PID:2300
- C:\Windows\System\VCUvDYY.exe
  C:\Windows\System\VCUvDYY.exe
  2⤵
  PID:1768
- C:\Windows\System\aDixqXA.exe
  C:\Windows\System\aDixqXA.exe
  2⤵
  PID:2868
- C:\Windows\System\kJbKmPc.exe
  C:\Windows\System\kJbKmPc.exe
  2⤵
  PID:2268
- C:\Windows\System\iDHBfqr.exe
  C:\Windows\System\iDHBfqr.exe
  2⤵
  PID:2876
- C:\Windows\System\PoHzaNR.exe
  C:\Windows\System\PoHzaNR.exe
  2⤵
  PID:992
- C:\Windows\System\CCClGAA.exe
  C:\Windows\System\CCClGAA.exe
  2⤵
  PID:952
- C:\Windows\System\Ttyvloa.exe
  C:\Windows\System\Ttyvloa.exe
  2⤵
  PID:1808
- C:\Windows\System\JRRWsVM.exe
  C:\Windows\System\JRRWsVM.exe
  2⤵
  PID:1932
- C:\Windows\System\PbzVxMt.exe
  C:\Windows\System\PbzVxMt.exe
  2⤵
  PID:1748
- C:\Windows\System\UjRYYId.exe
  C:\Windows\System\UjRYYId.exe
  2⤵
  PID:1604
- C:\Windows\System\oKobegi.exe
  C:\Windows\System\oKobegi.exe
  2⤵
  PID:1340
- C:\Windows\System\lIRsNTl.exe
  C:\Windows\System\lIRsNTl.exe
  2⤵
  PID:852
- C:\Windows\System\ygELRyL.exe
  C:\Windows\System\ygELRyL.exe
  2⤵
  PID:636
- C:\Windows\System\LcRFajH.exe
  C:\Windows\System\LcRFajH.exe
  2⤵
  PID:2384
- C:\Windows\System\ErHOzub.exe
  C:\Windows\System\ErHOzub.exe
  2⤵
  PID:2356
- C:\Windows\System\ojqVcOd.exe
  C:\Windows\System\ojqVcOd.exe
  2⤵
  PID:528
- C:\Windows\System\aXVIZeI.exe
  C:\Windows\System\aXVIZeI.exe
  2⤵
  PID:2240
- C:\Windows\System\CEypqcO.exe
  C:\Windows\System\CEypqcO.exe
  2⤵
  PID:588
- C:\Windows\System\TxJWbIy.exe
  C:\Windows\System\TxJWbIy.exe
  2⤵
  PID:900
- C:\Windows\System\aszbMhC.exe
  C:\Windows\System\aszbMhC.exe
  2⤵
  PID:2352
- C:\Windows\System\qAupExT.exe
  C:\Windows\System\qAupExT.exe
  2⤵
  PID:1544
- C:\Windows\System\GaPrkko.exe
  C:\Windows\System\GaPrkko.exe
  2⤵
  PID:2416
- C:\Windows\System\iToIMMH.exe
  C:\Windows\System\iToIMMH.exe
  2⤵
  PID:1672
- C:\Windows\System\cxwVaFv.exe
  C:\Windows\System\cxwVaFv.exe
  2⤵
  PID:2904
- C:\Windows\System\wTRYBXI.exe
  C:\Windows\System\wTRYBXI.exe
  2⤵
  PID:1352
- C:\Windows\System\uRDCIvb.exe
  C:\Windows\System\uRDCIvb.exe
  2⤵
  PID:2460
- C:\Windows\System\GayspnN.exe
  C:\Windows\System\GayspnN.exe
  2⤵
  PID:2712
- C:\Windows\System\TfxrZOR.exe
  C:\Windows\System\TfxrZOR.exe
  2⤵
  PID:820
- C:\Windows\System\YJmDEAB.exe
  C:\Windows\System\YJmDEAB.exe
  2⤵
  PID:1232
- C:\Windows\System\qXmlrBB.exe
  C:\Windows\System\qXmlrBB.exe
  2⤵
  PID:2812
- C:\Windows\System\qxadwWV.exe
  C:\Windows\System\qxadwWV.exe
  2⤵
  PID:1716
- C:\Windows\System\oRhgroU.exe
  C:\Windows\System\oRhgroU.exe
  2⤵
  PID:2328
- C:\Windows\System\jwywjYC.exe
  C:\Windows\System\jwywjYC.exe
  2⤵
  PID:2308
- C:\Windows\System\WhEqGwy.exe
  C:\Windows\System\WhEqGwy.exe
  2⤵
  PID:1820
- C:\Windows\System\qIqhAav.exe
  C:\Windows\System\qIqhAav.exe
  2⤵
  PID:1112
- C:\Windows\System\UWvuaIO.exe
  C:\Windows\System\UWvuaIO.exe
  2⤵
  PID:2780
- C:\Windows\System\eZrgKpr.exe
  C:\Windows\System\eZrgKpr.exe
  2⤵
  PID:876
- C:\Windows\System\YAUSAxS.exe
  C:\Windows\System\YAUSAxS.exe
  2⤵
  PID:1752
- C:\Windows\System\clOpxmh.exe
  C:\Windows\System\clOpxmh.exe
  2⤵
  PID:2784
- C:\Windows\System\XppiYVf.exe
  C:\Windows\System\XppiYVf.exe
  2⤵
  PID:2196
- C:\Windows\System\VWbzMTV.exe
  C:\Windows\System\VWbzMTV.exe
  2⤵
  PID:1656
- C:\Windows\System\raMjmab.exe
  C:\Windows\System\raMjmab.exe
  2⤵
  PID:3036
- C:\Windows\System\iHvLjch.exe
  C:\Windows\System\iHvLjch.exe
  2⤵
  PID:2708
- C:\Windows\System\RLeNcCe.exe
  C:\Windows\System\RLeNcCe.exe
  2⤵
  PID:1060
- C:\Windows\System\HhfeZDI.exe
  C:\Windows\System\HhfeZDI.exe
  2⤵
  PID:2576
- C:\Windows\System\FZlyKMi.exe
  C:\Windows\System\FZlyKMi.exe
  2⤵
  PID:1444
- C:\Windows\System\ukjidaR.exe
  C:\Windows\System\ukjidaR.exe
  2⤵
  PID:1152
- C:\Windows\System\PsTYZRB.exe
  C:\Windows\System\PsTYZRB.exe
  2⤵
  PID:772
- C:\Windows\System\nvpPTRZ.exe
  C:\Windows\System\nvpPTRZ.exe
  2⤵
  PID:2776
- C:\Windows\System\ZAvzsYc.exe
  C:\Windows\System\ZAvzsYc.exe
  2⤵
  PID:1608
- C:\Windows\System\kBBmlKb.exe
  C:\Windows\System\kBBmlKb.exe
  2⤵
  PID:592
- C:\Windows\System\INIZKjm.exe
  C:\Windows\System\INIZKjm.exe
  2⤵
  PID:2404
- C:\Windows\System\KwBrcxT.exe
  C:\Windows\System\KwBrcxT.exe
  2⤵
  PID:2496
- C:\Windows\System\QTXusbU.exe
  C:\Windows\System\QTXusbU.exe
  2⤵
  PID:2724
- C:\Windows\System\ZkytsVF.exe
  C:\Windows\System\ZkytsVF.exe
  2⤵
  PID:848
- C:\Windows\System\RPIqrrX.exe
  C:\Windows\System\RPIqrrX.exe
  2⤵
  PID:1036
- C:\Windows\System\rOpDzhc.exe
  C:\Windows\System\rOpDzhc.exe
  2⤵
  PID:2824
- C:\Windows\System\vNDBIxp.exe
  C:\Windows\System\vNDBIxp.exe
  2⤵
  PID:2372
- C:\Windows\System\zSODXHO.exe
  C:\Windows\System\zSODXHO.exe
  2⤵
  PID:2092
- C:\Windows\System\JSeHwzD.exe
  C:\Windows\System\JSeHwzD.exe
  2⤵
  PID:1140
- C:\Windows\System\OgqdnbR.exe
  C:\Windows\System\OgqdnbR.exe
  2⤵
  PID:1360
- C:\Windows\System\yojYImC.exe
  C:\Windows\System\yojYImC.exe
  2⤵
  PID:1272
- C:\Windows\System\tvTaRdc.exe
  C:\Windows\System\tvTaRdc.exe
  2⤵
  PID:112
- C:\Windows\System\lvBdyaM.exe
  C:\Windows\System\lvBdyaM.exe
  2⤵
  PID:2736
- C:\Windows\System\LtvTuuQ.exe
  C:\Windows\System\LtvTuuQ.exe
  2⤵
  PID:1884
- C:\Windows\System\bPskMfr.exe
  C:\Windows\System\bPskMfr.exe
  2⤵
  PID:2864
- C:\Windows\System\KXArBfV.exe
  C:\Windows\System\KXArBfV.exe
  2⤵
  PID:2184
- C:\Windows\System\nyrpwSx.exe
  C:\Windows\System\nyrpwSx.exe
  2⤵
  PID:1560
- C:\Windows\System\qgAqNoc.exe
  C:\Windows\System\qgAqNoc.exe
  2⤵
  PID:2468
- C:\Windows\System\AmdaYCT.exe
  C:\Windows\System\AmdaYCT.exe
  2⤵
  PID:2688
- C:\Windows\System\eUMuuvb.exe
  C:\Windows\System\eUMuuvb.exe
  2⤵
  PID:1812
- C:\Windows\System\jxfwCuo.exe
  C:\Windows\System\jxfwCuo.exe
  2⤵
  PID:580
- C:\Windows\System\zCFbAHU.exe
  C:\Windows\System\zCFbAHU.exe
  2⤵
  PID:2508
- C:\Windows\System\fkQlgBi.exe
  C:\Windows\System\fkQlgBi.exe
  2⤵
  PID:2788
- C:\Windows\System\PMSevmt.exe
  C:\Windows\System\PMSevmt.exe
  2⤵
  PID:1508
- C:\Windows\System\ZJixrCU.exe
  C:\Windows\System\ZJixrCU.exe
  2⤵
  PID:1252
- C:\Windows\System\lYEiCDF.exe
  C:\Windows\System\lYEiCDF.exe
  2⤵
  PID:912
- C:\Windows\System\DQjAbWo.exe
  C:\Windows\System\DQjAbWo.exe
  2⤵
  PID:3140
- C:\Windows\System\COfMKqK.exe
  C:\Windows\System\COfMKqK.exe
  2⤵
  PID:3164
- C:\Windows\System\RdQgEal.exe
  C:\Windows\System\RdQgEal.exe
  2⤵
  PID:3180
- C:\Windows\System\YYuXEUj.exe
  C:\Windows\System\YYuXEUj.exe
  2⤵
  PID:3216
- C:\Windows\System\szSsWBT.exe
  C:\Windows\System\szSsWBT.exe
  2⤵
  PID:3248
- C:\Windows\System\ceSAYDY.exe
  C:\Windows\System\ceSAYDY.exe
  2⤵
  PID:3276
- C:\Windows\System\HurSlnI.exe
  C:\Windows\System\HurSlnI.exe
  2⤵
  PID:3300
- C:\Windows\System\iYlUZmB.exe
  C:\Windows\System\iYlUZmB.exe
  2⤵
  PID:3340
- C:\Windows\System\NJkfzOe.exe
  C:\Windows\System\NJkfzOe.exe
  2⤵
  PID:3360
- C:\Windows\System\YYpUkLA.exe
  C:\Windows\System\YYpUkLA.exe
  2⤵
  PID:3384
- C:\Windows\System\qJpIvsk.exe
  C:\Windows\System\qJpIvsk.exe
  2⤵
  PID:3400
- C:\Windows\System\cyMLMuJ.exe
  C:\Windows\System\cyMLMuJ.exe
  2⤵
  PID:3416
- C:\Windows\System\VEHxnOg.exe
  C:\Windows\System\VEHxnOg.exe
  2⤵
  PID:3436
- C:\Windows\System\ExldGUR.exe
  C:\Windows\System\ExldGUR.exe
  2⤵
  PID:3456
- C:\Windows\System\fPrkwzd.exe
  C:\Windows\System\fPrkwzd.exe
  2⤵
  PID:3476
- C:\Windows\System\npOuKqJ.exe
  C:\Windows\System\npOuKqJ.exe
  2⤵
  PID:3492
- C:\Windows\System\BgksNPE.exe
  C:\Windows\System\BgksNPE.exe
  2⤵
  PID:3512
- C:\Windows\System\vxKLuaJ.exe
  C:\Windows\System\vxKLuaJ.exe
  2⤵
  PID:3528
- C:\Windows\System\aUDQjUi.exe
  C:\Windows\System\aUDQjUi.exe
  2⤵
  PID:3548
- C:\Windows\System\sVjiWBd.exe
  C:\Windows\System\sVjiWBd.exe
  2⤵
  PID:3564
- C:\Windows\System\KSrvQlP.exe
  C:\Windows\System\KSrvQlP.exe
  2⤵
  PID:3580
- C:\Windows\System\YkNtvqf.exe
  C:\Windows\System\YkNtvqf.exe
  2⤵
  PID:3596
- C:\Windows\System\NQOWsUv.exe
  C:\Windows\System\NQOWsUv.exe
  2⤵
  PID:3612
- C:\Windows\System\hQjCTve.exe
  C:\Windows\System\hQjCTve.exe
  2⤵
  PID:3632
- C:\Windows\System\azpduig.exe
  C:\Windows\System\azpduig.exe
  2⤵
  PID:3648
- C:\Windows\System\qZZZODE.exe
  C:\Windows\System\qZZZODE.exe
  2⤵
  PID:3668
- C:\Windows\System\ZzAzbgi.exe
  C:\Windows\System\ZzAzbgi.exe
  2⤵
  PID:3688
- C:\Windows\System\qZRKRge.exe
  C:\Windows\System\qZRKRge.exe
  2⤵
  PID:3704
- C:\Windows\System\XWOPanr.exe
  C:\Windows\System\XWOPanr.exe
  2⤵
  PID:3720
- C:\Windows\System\CtlSOOI.exe
  C:\Windows\System\CtlSOOI.exe
  2⤵
  PID:3740
- C:\Windows\System\HFTYpOK.exe
  C:\Windows\System\HFTYpOK.exe
  2⤵
  PID:3760
- C:\Windows\System\gSbHlBQ.exe
  C:\Windows\System\gSbHlBQ.exe
  2⤵
  PID:3776
- C:\Windows\System\CVyRCox.exe
  C:\Windows\System\CVyRCox.exe
  2⤵
  PID:3792
- C:\Windows\System\EhdAiGk.exe
  C:\Windows\System\EhdAiGk.exe
  2⤵
  PID:3812
- C:\Windows\System\qTscjum.exe
  C:\Windows\System\qTscjum.exe
  2⤵
  PID:3828
- C:\Windows\System\ZZkMWnC.exe
  C:\Windows\System\ZZkMWnC.exe
  2⤵
  PID:3848
- C:\Windows\System\JAIcTMX.exe
  C:\Windows\System\JAIcTMX.exe
  2⤵
  PID:3864
- C:\Windows\System\kBsWIov.exe
  C:\Windows\System\kBsWIov.exe
  2⤵
  PID:3884
- C:\Windows\System\JyLzsQU.exe
  C:\Windows\System\JyLzsQU.exe
  2⤵
  PID:3900
- C:\Windows\System\GXzViOJ.exe
  C:\Windows\System\GXzViOJ.exe
  2⤵
  PID:3916
- C:\Windows\System\SwGdzJI.exe
  C:\Windows\System\SwGdzJI.exe
  2⤵
  PID:3932
- C:\Windows\System\BCgvUec.exe
  C:\Windows\System\BCgvUec.exe
  2⤵
  PID:3948
- C:\Windows\System\SlkvkFe.exe
  C:\Windows\System\SlkvkFe.exe
  2⤵
  PID:3968
- C:\Windows\System\RuoIAui.exe
  C:\Windows\System\RuoIAui.exe
  2⤵
  PID:3984
- C:\Windows\System\qgWQlHC.exe
  C:\Windows\System\qgWQlHC.exe
  2⤵
  PID:4000
- C:\Windows\System\OhpYyBC.exe
  C:\Windows\System\OhpYyBC.exe
  2⤵
  PID:4016
- C:\Windows\System\bzhlFhJ.exe
  C:\Windows\System\bzhlFhJ.exe
  2⤵
  PID:4036
- C:\Windows\System\Dwbptzf.exe
  C:\Windows\System\Dwbptzf.exe
  2⤵
  PID:4052
- C:\Windows\System\zRmJMOy.exe
  C:\Windows\System\zRmJMOy.exe
  2⤵
  PID:4068
- C:\Windows\System\CrKzQiY.exe
  C:\Windows\System\CrKzQiY.exe
  2⤵
  PID:4084
- C:\Windows\System\HXvygfy.exe
  C:\Windows\System\HXvygfy.exe
  2⤵
  PID:1012
- C:\Windows\System\vAplQuK.exe
  C:\Windows\System\vAplQuK.exe
  2⤵
  PID:1828
- C:\Windows\System\VhQzGuW.exe
  C:\Windows\System\VhQzGuW.exe
  2⤵
  PID:1192
- C:\Windows\System\fxZWwGo.exe
  C:\Windows\System\fxZWwGo.exe
  2⤵
  PID:3124
- C:\Windows\System\FscknKZ.exe
  C:\Windows\System\FscknKZ.exe
  2⤵
  PID:3080
- C:\Windows\System\qdGDPGH.exe
  C:\Windows\System\qdGDPGH.exe
  2⤵
  PID:3096
- C:\Windows\System\pDUwbLU.exe
  C:\Windows\System\pDUwbLU.exe
  2⤵
  PID:3112
- C:\Windows\System\mlIcDGM.exe
  C:\Windows\System\mlIcDGM.exe
  2⤵
  PID:1796
- C:\Windows\System\klAIRUm.exe
  C:\Windows\System\klAIRUm.exe
  2⤵
  PID:2920
- C:\Windows\System\ylPDQVi.exe
  C:\Windows\System\ylPDQVi.exe
  2⤵
  PID:2080
- C:\Windows\System\sHJRiXS.exe
  C:\Windows\System\sHJRiXS.exe
  2⤵
  PID:1644
- C:\Windows\System\QOnfsNx.exe
  C:\Windows\System\QOnfsNx.exe
  2⤵
  PID:2676
- C:\Windows\System\tPgRvkW.exe
  C:\Windows\System\tPgRvkW.exe
  2⤵
  PID:2376
- C:\Windows\System\VxscWLa.exe
  C:\Windows\System\VxscWLa.exe
  2⤵
  PID:3172
- C:\Windows\System\agMkazc.exe
  C:\Windows\System\agMkazc.exe
  2⤵
  PID:3228
- C:\Windows\System\Bakawqd.exe
  C:\Windows\System\Bakawqd.exe
  2⤵
  PID:3244
- C:\Windows\System\ZkBcIxD.exe
  C:\Windows\System\ZkBcIxD.exe
  2⤵
  PID:3292
- C:\Windows\System\ekKGQND.exe
  C:\Windows\System\ekKGQND.exe
  2⤵
  PID:3352
- C:\Windows\System\Ksbywvg.exe
  C:\Windows\System\Ksbywvg.exe
  2⤵
  PID:3160
- C:\Windows\System\rgnyvss.exe
  C:\Windows\System\rgnyvss.exe
  2⤵
  PID:3208
- C:\Windows\System\QuxkQsu.exe
  C:\Windows\System\QuxkQsu.exe
  2⤵
  PID:3264
- C:\Windows\System\LauuQUb.exe
  C:\Windows\System\LauuQUb.exe
  2⤵
  PID:3316
- C:\Windows\System\PkVQjbJ.exe
  C:\Windows\System\PkVQjbJ.exe
  2⤵
  PID:3368
- C:\Windows\System\WScMDiF.exe
  C:\Windows\System\WScMDiF.exe
  2⤵
  PID:3396
- C:\Windows\System\BtPgylu.exe
  C:\Windows\System\BtPgylu.exe
  2⤵
  PID:3432
- C:\Windows\System\Lefkzns.exe
  C:\Windows\System\Lefkzns.exe
  2⤵
  PID:3472
- C:\Windows\System\NdYIxVN.exe
  C:\Windows\System\NdYIxVN.exe
  2⤵
  PID:3412
- C:\Windows\System\dDbGADO.exe
  C:\Windows\System\dDbGADO.exe
  2⤵
  PID:3576
- C:\Windows\System\cMrkRPt.exe
  C:\Windows\System\cMrkRPt.exe
  2⤵
  PID:3448
- C:\Windows\System\LiwkHlN.exe
  C:\Windows\System\LiwkHlN.exe
  2⤵
  PID:3560
- C:\Windows\System\bNLZfjQ.exe
  C:\Windows\System\bNLZfjQ.exe
  2⤵
  PID:3484
- C:\Windows\System\ZNHXLLg.exe
  C:\Windows\System\ZNHXLLg.exe
  2⤵
  PID:3656
- C:\Windows\System\RIpyjup.exe
  C:\Windows\System\RIpyjup.exe
  2⤵
  PID:3684
- C:\Windows\System\spPudxq.exe
  C:\Windows\System\spPudxq.exe
  2⤵
  PID:3748
- C:\Windows\System\iQIMNPo.exe
  C:\Windows\System\iQIMNPo.exe
  2⤵
  PID:3736
- C:\Windows\System\MIAqvzR.exe
  C:\Windows\System\MIAqvzR.exe
  2⤵
  PID:3788
- C:\Windows\System\UZSodpk.exe
  C:\Windows\System\UZSodpk.exe
  2⤵
  PID:3772
- C:\Windows\System\ZooLCih.exe
  C:\Windows\System\ZooLCih.exe
  2⤵
  PID:3824
- C:\Windows\System\iOSOBpQ.exe
  C:\Windows\System\iOSOBpQ.exe
  2⤵
  PID:3840
- C:\Windows\System\MfhNqAr.exe
  C:\Windows\System\MfhNqAr.exe
  2⤵
  PID:3896
- C:\Windows\System\hdfFemq.exe
  C:\Windows\System\hdfFemq.exe
  2⤵
  PID:3880
- C:\Windows\System\boruvjc.exe
  C:\Windows\System\boruvjc.exe
  2⤵
  PID:3872
- C:\Windows\System\gMCWBpb.exe
  C:\Windows\System\gMCWBpb.exe
  2⤵
  PID:3960
- C:\Windows\System\QDGHunJ.exe
  C:\Windows\System\QDGHunJ.exe
  2⤵
  PID:4032
- C:\Windows\System\GkaWVXi.exe
  C:\Windows\System\GkaWVXi.exe
  2⤵
  PID:4092
- C:\Windows\System\KJYbtsk.exe
  C:\Windows\System\KJYbtsk.exe
  2⤵
  PID:3980
- C:\Windows\System\yxvRTON.exe
  C:\Windows\System\yxvRTON.exe
  2⤵
  PID:3076
- C:\Windows\System\vFVVkai.exe
  C:\Windows\System\vFVVkai.exe
  2⤵
  PID:4076
- C:\Windows\System\QmpJheY.exe
  C:\Windows\System\QmpJheY.exe
  2⤵
  PID:3104
- C:\Windows\System\ecCiyPB.exe
  C:\Windows\System\ecCiyPB.exe
  2⤵
  PID:2452
- C:\Windows\System\JTrokHd.exe
  C:\Windows\System\JTrokHd.exe
  2⤵
  PID:4080
- C:\Windows\System\HRfoCMV.exe
  C:\Windows\System\HRfoCMV.exe
  2⤵
  PID:904
- C:\Windows\System\jpstlJe.exe
  C:\Windows\System\jpstlJe.exe
  2⤵
  PID:3288
- C:\Windows\System\fcaPfMe.exe
  C:\Windows\System\fcaPfMe.exe
  2⤵
  PID:3156
- C:\Windows\System\jxJcrZO.exe
  C:\Windows\System\jxJcrZO.exe
  2⤵
  PID:1496
- C:\Windows\System\JVcQOLH.exe
  C:\Windows\System\JVcQOLH.exe
  2⤵
  PID:2424
- C:\Windows\System\xPrxvRL.exe
  C:\Windows\System\xPrxvRL.exe
  2⤵
  PID:1600
- C:\Windows\System\RqupukK.exe
  C:\Windows\System\RqupukK.exe
  2⤵
  PID:3324
- C:\Windows\System\ZoCifWD.exe
  C:\Windows\System\ZoCifWD.exe
  2⤵
  PID:1540
- C:\Windows\System\scPSqls.exe
  C:\Windows\System\scPSqls.exe
  2⤵
  PID:3504
- C:\Windows\System\uWWXaIz.exe
  C:\Windows\System\uWWXaIz.exe
  2⤵
  PID:3572
- C:\Windows\System\NLShBnc.exe
  C:\Windows\System\NLShBnc.exe
  2⤵
  PID:2008
- C:\Windows\System\KygGtHj.exe
  C:\Windows\System\KygGtHj.exe
  2⤵
  PID:3620
- C:\Windows\System\MJmPDnr.exe
  C:\Windows\System\MJmPDnr.exe
  2⤵
  PID:3752
- C:\Windows\System\UrFMXKy.exe
  C:\Windows\System\UrFMXKy.exe
  2⤵
  PID:3768
- C:\Windows\System\SCzfYht.exe
  C:\Windows\System\SCzfYht.exe
  2⤵
  PID:3928
- C:\Windows\System\IZmxmKs.exe
  C:\Windows\System\IZmxmKs.exe
  2⤵
  PID:4064
- C:\Windows\System\qDhRcvp.exe
  C:\Windows\System\qDhRcvp.exe
  2⤵
  PID:3108
- C:\Windows\System\APTmuPG.exe
  C:\Windows\System\APTmuPG.exe
  2⤵
  PID:2804
- C:\Windows\System\utKYodK.exe
  C:\Windows\System\utKYodK.exe
  2⤵
  PID:4012
- C:\Windows\System\gcHUapL.exe
  C:\Windows\System\gcHUapL.exe
  2⤵
  PID:3520
- C:\Windows\System\XkdOiNR.exe
  C:\Windows\System\XkdOiNR.exe
  2⤵
  PID:3860
- C:\Windows\System\oZBtdNm.exe
  C:\Windows\System\oZBtdNm.exe
  2⤵
  PID:3660
- C:\Windows\System\EIIAklt.exe
  C:\Windows\System\EIIAklt.exe
  2⤵
  PID:3152
- C:\Windows\System\wQsAmpu.exe
  C:\Windows\System\wQsAmpu.exe
  2⤵
  PID:2756
- C:\Windows\System\vEoQLnm.exe
  C:\Windows\System\vEoQLnm.exe
  2⤵
  PID:2088
- C:\Windows\System\OMYZmvn.exe
  C:\Windows\System\OMYZmvn.exe
  2⤵
  PID:1136
- C:\Windows\System\ltPyJDA.exe
  C:\Windows\System\ltPyJDA.exe
  2⤵
  PID:3200
- C:\Windows\System\LwphxWp.exe
  C:\Windows\System\LwphxWp.exe
  2⤵
  PID:3204
- C:\Windows\System\wdSvIeX.exe
  C:\Windows\System\wdSvIeX.exe
  2⤵
  PID:3544
- C:\Windows\System\gPuilqG.exe
  C:\Windows\System\gPuilqG.exe
  2⤵
  PID:4060
- C:\Windows\System\KFSPhQB.exe
  C:\Windows\System\KFSPhQB.exe
  2⤵
  PID:2224
- C:\Windows\System\kIDUoxs.exe
  C:\Windows\System\kIDUoxs.exe
  2⤵
  PID:2952
- C:\Windows\System\tybeWPV.exe
  C:\Windows\System\tybeWPV.exe
  2⤵
  PID:3628
- C:\Windows\System\yMcNiRj.exe
  C:\Windows\System\yMcNiRj.exe
  2⤵
  PID:3996
- C:\Windows\System\wCowqRc.exe
  C:\Windows\System\wCowqRc.exe
  2⤵
  PID:2872
- C:\Windows\System\bjKxfuy.exe
  C:\Windows\System\bjKxfuy.exe
  2⤵
  PID:1964
- C:\Windows\System\sbETtNO.exe
  C:\Windows\System\sbETtNO.exe
  2⤵
  PID:1588
- C:\Windows\System\MmYRYcG.exe
  C:\Windows\System\MmYRYcG.exe
  2⤵
  PID:3712
- C:\Windows\System\RrNiwnA.exe
  C:\Windows\System\RrNiwnA.exe
  2⤵
  PID:3424
- C:\Windows\System\RUcKpEJ.exe
  C:\Windows\System\RUcKpEJ.exe
  2⤵
  PID:3956
- C:\Windows\System\ASFNGoZ.exe
  C:\Windows\System\ASFNGoZ.exe
  2⤵
  PID:4112
- C:\Windows\System\hcEzEEE.exe
  C:\Windows\System\hcEzEEE.exe
  2⤵
  PID:4128
- C:\Windows\System\fyIFSfY.exe
  C:\Windows\System\fyIFSfY.exe
  2⤵
  PID:4144
- C:\Windows\System\AmIcaJO.exe
  C:\Windows\System\AmIcaJO.exe
  2⤵
  PID:4160
- C:\Windows\System\bayHzdj.exe
  C:\Windows\System\bayHzdj.exe
  2⤵
  PID:4176
- C:\Windows\System\MsTpMra.exe
  C:\Windows\System\MsTpMra.exe
  2⤵
  PID:4192
- C:\Windows\System\bCXfleQ.exe
  C:\Windows\System\bCXfleQ.exe
  2⤵
  PID:4208
- C:\Windows\System\zFLHYUM.exe
  C:\Windows\System\zFLHYUM.exe
  2⤵
  PID:4224
- C:\Windows\System\rMCADjM.exe
  C:\Windows\System\rMCADjM.exe
  2⤵
  PID:4240
- C:\Windows\System\LzgqJZs.exe
  C:\Windows\System\LzgqJZs.exe
  2⤵
  PID:4256
- C:\Windows\System\ufbzgQD.exe
  C:\Windows\System\ufbzgQD.exe
  2⤵
  PID:4272
- C:\Windows\System\dtPkwfp.exe
  C:\Windows\System\dtPkwfp.exe
  2⤵
  PID:4288
- C:\Windows\System\DnLjcSZ.exe
  C:\Windows\System\DnLjcSZ.exe
  2⤵
  PID:4304
- C:\Windows\System\oHCUKmh.exe
  C:\Windows\System\oHCUKmh.exe
  2⤵
  PID:4320
- C:\Windows\System\CHcXezU.exe
  C:\Windows\System\CHcXezU.exe
  2⤵
  PID:4336
- C:\Windows\System\tHElLHO.exe
  C:\Windows\System\tHElLHO.exe
  2⤵
  PID:4352
- C:\Windows\System\lJLdrZP.exe
  C:\Windows\System\lJLdrZP.exe
  2⤵
  PID:4368
- C:\Windows\System\dqTbrwt.exe
  C:\Windows\System\dqTbrwt.exe
  2⤵
  PID:4384
- C:\Windows\System\ZGgFvGX.exe
  C:\Windows\System\ZGgFvGX.exe
  2⤵
  PID:4404
- C:\Windows\System\shkLoCD.exe
  C:\Windows\System\shkLoCD.exe
  2⤵
  PID:4420
- C:\Windows\System\jqnSKyE.exe
  C:\Windows\System\jqnSKyE.exe
  2⤵
  PID:4436
- C:\Windows\System\cteLxch.exe
  C:\Windows\System\cteLxch.exe
  2⤵
  PID:4452
- C:\Windows\System\tLApHxu.exe
  C:\Windows\System\tLApHxu.exe
  2⤵
  PID:4468
- C:\Windows\System\WjvXsXA.exe
  C:\Windows\System\WjvXsXA.exe
  2⤵
  PID:4484
- C:\Windows\System\YpZimeR.exe
  C:\Windows\System\YpZimeR.exe
  2⤵
  PID:4500
- C:\Windows\System\VWyiovT.exe
  C:\Windows\System\VWyiovT.exe
  2⤵
  PID:4516
- C:\Windows\System\pHTYjZQ.exe
  C:\Windows\System\pHTYjZQ.exe
  2⤵
  PID:4532
- C:\Windows\System\zaHsbry.exe
  C:\Windows\System\zaHsbry.exe
  2⤵
  PID:4548
- C:\Windows\System\KzpRXpx.exe
  C:\Windows\System\KzpRXpx.exe
  2⤵
  PID:4564
- C:\Windows\System\XZRRqTC.exe
  C:\Windows\System\XZRRqTC.exe
  2⤵
  PID:4580
- C:\Windows\System\HjgglEH.exe
  C:\Windows\System\HjgglEH.exe
  2⤵
  PID:4596
- C:\Windows\System\mywnlBE.exe
  C:\Windows\System\mywnlBE.exe
  2⤵
  PID:4612
- C:\Windows\System\Jnlanzc.exe
  C:\Windows\System\Jnlanzc.exe
  2⤵
  PID:4628
- C:\Windows\System\pzMERHV.exe
  C:\Windows\System\pzMERHV.exe
  2⤵
  PID:4644
- C:\Windows\System\MjbPTMF.exe
  C:\Windows\System\MjbPTMF.exe
  2⤵
  PID:4660
- C:\Windows\System\IDhRmOS.exe
  C:\Windows\System\IDhRmOS.exe
  2⤵
  PID:4676
- C:\Windows\System\XesuwcS.exe
  C:\Windows\System\XesuwcS.exe
  2⤵
  PID:4692
- C:\Windows\System\gPvsnPM.exe
  C:\Windows\System\gPvsnPM.exe
  2⤵
  PID:4708
- C:\Windows\System\AdNnwJi.exe
  C:\Windows\System\AdNnwJi.exe
  2⤵
  PID:4724
- C:\Windows\System\TDmSQCK.exe
  C:\Windows\System\TDmSQCK.exe
  2⤵
  PID:4740
- C:\Windows\System\wFFexFz.exe
  C:\Windows\System\wFFexFz.exe
  2⤵
  PID:4756
- C:\Windows\System\XBQoTXa.exe
  C:\Windows\System\XBQoTXa.exe
  2⤵
  PID:4772
- C:\Windows\System\HSXUzYw.exe
  C:\Windows\System\HSXUzYw.exe
  2⤵
  PID:4788
- C:\Windows\System\jpNUFWD.exe
  C:\Windows\System\jpNUFWD.exe
  2⤵
  PID:4808
- C:\Windows\System\kKECMdh.exe
  C:\Windows\System\kKECMdh.exe
  2⤵
  PID:4828
- C:\Windows\System\vZyGRYT.exe
  C:\Windows\System\vZyGRYT.exe
  2⤵
  PID:4844
- C:\Windows\System\FDJpNrx.exe
  C:\Windows\System\FDJpNrx.exe
  2⤵
  PID:4860
- C:\Windows\System\WbFqNnh.exe
  C:\Windows\System\WbFqNnh.exe
  2⤵
  PID:4876
- C:\Windows\System\RitzCTJ.exe
  C:\Windows\System\RitzCTJ.exe
  2⤵
  PID:4892
- C:\Windows\System\EqKLwaA.exe
  C:\Windows\System\EqKLwaA.exe
  2⤵
  PID:4908
- C:\Windows\System\SQjeGMV.exe
  C:\Windows\System\SQjeGMV.exe
  2⤵
  PID:4924
- C:\Windows\System\agBTsLf.exe
  C:\Windows\System\agBTsLf.exe
  2⤵
  PID:4940
- C:\Windows\System\oyaSOWl.exe
  C:\Windows\System\oyaSOWl.exe
  2⤵
  PID:4956
- C:\Windows\System\SyulXsX.exe
  C:\Windows\System\SyulXsX.exe
  2⤵
  PID:4972
- C:\Windows\System\EWyhexh.exe
  C:\Windows\System\EWyhexh.exe
  2⤵
  PID:4988
- C:\Windows\System\MpvpAWE.exe
  C:\Windows\System\MpvpAWE.exe
  2⤵
  PID:5004
- C:\Windows\System\SNTnyZP.exe
  C:\Windows\System\SNTnyZP.exe
  2⤵
  PID:5020
- C:\Windows\System\sENOrnY.exe
  C:\Windows\System\sENOrnY.exe
  2⤵
  PID:5036
- C:\Windows\System\yQMsDDx.exe
  C:\Windows\System\yQMsDDx.exe
  2⤵
  PID:5052
- C:\Windows\System\CSmMwHc.exe
  C:\Windows\System\CSmMwHc.exe
  2⤵
  PID:5072
- C:\Windows\System\vyjxBVK.exe
  C:\Windows\System\vyjxBVK.exe
  2⤵
  PID:5088
- C:\Windows\System\hqojceA.exe
  C:\Windows\System\hqojceA.exe
  2⤵
  PID:5104
- C:\Windows\System\dzfaBQK.exe
  C:\Windows\System\dzfaBQK.exe
  2⤵
  PID:3260
- C:\Windows\System\NesjoTi.exe
  C:\Windows\System\NesjoTi.exe
  2⤵
  PID:4152
- C:\Windows\System\SluxFnu.exe
  C:\Windows\System\SluxFnu.exe
  2⤵
  PID:4124
- C:\Windows\System\DHTOfFU.exe
  C:\Windows\System\DHTOfFU.exe
  2⤵
  PID:4024
- C:\Windows\System\cbSFkmX.exe
  C:\Windows\System\cbSFkmX.exe
  2⤵
  PID:2992
- C:\Windows\System\HkCDCum.exe
  C:\Windows\System\HkCDCum.exe
  2⤵
  PID:4200
- C:\Windows\System\ndnBCWK.exe
  C:\Windows\System\ndnBCWK.exe
  2⤵
  PID:4204
- C:\Windows\System\tUshGpo.exe
  C:\Windows\System\tUshGpo.exe
  2⤵
  PID:4284
- C:\Windows\System\cvChtmQ.exe
  C:\Windows\System\cvChtmQ.exe
  2⤵
  PID:4268
- C:\Windows\System\sgXFSaA.exe
  C:\Windows\System\sgXFSaA.exe
  2⤵
  PID:4412
- C:\Windows\System\ABoHENV.exe
  C:\Windows\System\ABoHENV.exe
  2⤵
  PID:4360
- C:\Windows\System\eUovrOM.exe
  C:\Windows\System\eUovrOM.exe
  2⤵
  PID:4264
- C:\Windows\System\nXTyRjB.exe
  C:\Windows\System\nXTyRjB.exe
  2⤵
  PID:4448
- C:\Windows\System\OsbTgiQ.exe
  C:\Windows\System\OsbTgiQ.exe
  2⤵
  PID:4508
- C:\Windows\System\CpzRlDz.exe
  C:\Windows\System\CpzRlDz.exe
  2⤵
  PID:4544
- C:\Windows\System\aeQoSHZ.exe
  C:\Windows\System\aeQoSHZ.exe
  2⤵
  PID:4604
- C:\Windows\System\EGsWlOR.exe
  C:\Windows\System\EGsWlOR.exe
  2⤵
  PID:4636
- C:\Windows\System\PejLEBp.exe
  C:\Windows\System\PejLEBp.exe
  2⤵
  PID:4672
- C:\Windows\System\xnjQMWn.exe
  C:\Windows\System\xnjQMWn.exe
  2⤵
  PID:3624
- C:\Windows\System\pRVvAAU.exe
  C:\Windows\System\pRVvAAU.exe
  2⤵
  PID:4768
- C:\Windows\System\EiAbbZV.exe
  C:\Windows\System\EiAbbZV.exe
  2⤵
  PID:4800
- C:\Windows\System\BdAlKcu.exe
  C:\Windows\System\BdAlKcu.exe
  2⤵
  PID:4784
- C:\Windows\System\LWKBOay.exe
  C:\Windows\System\LWKBOay.exe
  2⤵
  PID:4900
- C:\Windows\System\jEmScQf.exe
  C:\Windows\System\jEmScQf.exe
  2⤵
  PID:4748
- C:\Windows\System\PmlStpw.exe
  C:\Windows\System\PmlStpw.exe
  2⤵
  PID:4888
- C:\Windows\System\cecpbHN.exe
  C:\Windows\System\cecpbHN.exe
  2⤵
  PID:4920
- C:\Windows\System\AlqBWfb.exe
  C:\Windows\System\AlqBWfb.exe
  2⤵
  PID:4916
- C:\Windows\System\IJOFeFz.exe
  C:\Windows\System\IJOFeFz.exe
  2⤵
  PID:4980
- C:\Windows\System\soGIdfF.exe
  C:\Windows\System\soGIdfF.exe
  2⤵
  PID:5000
- C:\Windows\System\NHhSkrj.exe
  C:\Windows\System\NHhSkrj.exe
  2⤵
  PID:5068
- C:\Windows\System\sLogrmn.exe
  C:\Windows\System\sLogrmn.exe
  2⤵
  PID:4028
- C:\Windows\System\LAAumsG.exe
  C:\Windows\System\LAAumsG.exe
  2⤵
  PID:5044
- C:\Windows\System\JPewwfm.exe
  C:\Windows\System\JPewwfm.exe
  2⤵
  PID:5112
- C:\Windows\System\HXMAxcI.exe
  C:\Windows\System\HXMAxcI.exe
  2⤵
  PID:2820
- C:\Windows\System\gmiygMx.exe
  C:\Windows\System\gmiygMx.exe
  2⤵
  PID:4140
- C:\Windows\System\ZjIwiCO.exe
  C:\Windows\System\ZjIwiCO.exe
  2⤵
  PID:4280
- C:\Windows\System\rWddNhq.exe
  C:\Windows\System\rWddNhq.exe
  2⤵
  PID:3976
- C:\Windows\System\lgyhAwT.exe
  C:\Windows\System\lgyhAwT.exe
  2⤵
  PID:4332
- C:\Windows\System\egzksVd.exe
  C:\Windows\System\egzksVd.exe
  2⤵
  PID:4172
- C:\Windows\System\DPwsPPP.exe
  C:\Windows\System\DPwsPPP.exe
  2⤵
  PID:4444
- C:\Windows\System\toufYsB.exe
  C:\Windows\System\toufYsB.exe
  2⤵
  PID:4556
- C:\Windows\System\Tfvupqs.exe
  C:\Windows\System\Tfvupqs.exe
  2⤵
  PID:3556
- C:\Windows\System\ZnJLGaf.exe
  C:\Windows\System\ZnJLGaf.exe
  2⤵
  PID:4624
- C:\Windows\System\nUWtiUq.exe
  C:\Windows\System\nUWtiUq.exe
  2⤵
  PID:4764
- C:\Windows\System\BufOxrG.exe
  C:\Windows\System\BufOxrG.exe
  2⤵
  PID:4904
- C:\Windows\System\nKHKawc.exe
  C:\Windows\System\nKHKawc.exe
  2⤵
  PID:4592
- C:\Windows\System\JtwFcEJ.exe
  C:\Windows\System\JtwFcEJ.exe
  2⤵
  PID:4856
- C:\Windows\System\YSGZSNG.exe
  C:\Windows\System\YSGZSNG.exe
  2⤵
  PID:4720
- C:\Windows\System\UryEqDI.exe
  C:\Windows\System\UryEqDI.exe
  2⤵
  PID:5096
- C:\Windows\System\gEXPHWg.exe
  C:\Windows\System\gEXPHWg.exe
  2⤵
  PID:4952
- C:\Windows\System\eotSBQW.exe
  C:\Windows\System\eotSBQW.exe
  2⤵
  PID:5012
- C:\Windows\System\ajthowp.exe
  C:\Windows\System\ajthowp.exe
  2⤵
  PID:3536
- C:\Windows\System\rosOyZh.exe
  C:\Windows\System\rosOyZh.exe
  2⤵
  PID:4316
- C:\Windows\System\tlRKMmP.exe
  C:\Windows\System\tlRKMmP.exe
  2⤵
  PID:4344
- C:\Windows\System\EEcmwKj.exe
  C:\Windows\System\EEcmwKj.exe
  2⤵
  PID:4736
- C:\Windows\System\uVioxlG.exe
  C:\Windows\System\uVioxlG.exe
  2⤵
  PID:4480
- C:\Windows\System\RrlkgUW.exe
  C:\Windows\System\RrlkgUW.exe
  2⤵
  PID:4656
- C:\Windows\System\kNedZIM.exe
  C:\Windows\System\kNedZIM.exe
  2⤵
  PID:4968
- C:\Windows\System\aDSVesE.exe
  C:\Windows\System\aDSVesE.exe
  2⤵
  PID:4804
- C:\Windows\System\PWAtWEV.exe
  C:\Windows\System\PWAtWEV.exe
  2⤵
  PID:4716
- C:\Windows\System\RAagzRO.exe
  C:\Windows\System\RAagzRO.exe
  2⤵
  PID:5016
- C:\Windows\System\vtuAdew.exe
  C:\Windows\System\vtuAdew.exe
  2⤵
  PID:4380
- C:\Windows\System\jziKkBJ.exe
  C:\Windows\System\jziKkBJ.exe
  2⤵
  PID:4704
- C:\Windows\System\peIqsVj.exe
  C:\Windows\System\peIqsVj.exe
  2⤵
  PID:4120
- C:\Windows\System\sfsSuoy.exe
  C:\Windows\System\sfsSuoy.exe
  2⤵
  PID:5124
- C:\Windows\System\KWjrNCR.exe
  C:\Windows\System\KWjrNCR.exe
  2⤵
  PID:5140
- C:\Windows\System\GQECdlg.exe
  C:\Windows\System\GQECdlg.exe
  2⤵
  PID:5156
- C:\Windows\System\FTUXYGO.exe
  C:\Windows\System\FTUXYGO.exe
  2⤵
  PID:5172
- C:\Windows\System\RHhopYx.exe
  C:\Windows\System\RHhopYx.exe
  2⤵
  PID:5188
- C:\Windows\System\FZTzWxs.exe
  C:\Windows\System\FZTzWxs.exe
  2⤵
  PID:5204
- C:\Windows\System\eaBTDjB.exe
  C:\Windows\System\eaBTDjB.exe
  2⤵
  PID:5220
- C:\Windows\System\lMxyUpY.exe
  C:\Windows\System\lMxyUpY.exe
  2⤵
  PID:5236
- C:\Windows\System\gwNoSrS.exe
  C:\Windows\System\gwNoSrS.exe
  2⤵
  PID:5252
- C:\Windows\System\KyFLSMz.exe
  C:\Windows\System\KyFLSMz.exe
  2⤵
  PID:5268
- C:\Windows\System\MBNfaZg.exe
  C:\Windows\System\MBNfaZg.exe
  2⤵
  PID:5284
- C:\Windows\System\zbFroCX.exe
  C:\Windows\System\zbFroCX.exe
  2⤵
  PID:5300
- C:\Windows\System\dqdpoiX.exe
  C:\Windows\System\dqdpoiX.exe
  2⤵
  PID:5316
- C:\Windows\System\KEbUFMQ.exe
  C:\Windows\System\KEbUFMQ.exe
  2⤵
  PID:5332
- C:\Windows\System\SOAyxhB.exe
  C:\Windows\System\SOAyxhB.exe
  2⤵
  PID:5348
- C:\Windows\System\bEmGIvm.exe
  C:\Windows\System\bEmGIvm.exe
  2⤵
  PID:5364
- C:\Windows\System\IqRhhYA.exe
  C:\Windows\System\IqRhhYA.exe
  2⤵
  PID:5380
- C:\Windows\System\BWYDXIM.exe
  C:\Windows\System\BWYDXIM.exe
  2⤵
  PID:5396
- C:\Windows\System\rhDUCNx.exe
  C:\Windows\System\rhDUCNx.exe
  2⤵
  PID:5412
- C:\Windows\System\yPSmEJr.exe
  C:\Windows\System\yPSmEJr.exe
  2⤵
  PID:5428
- C:\Windows\System\XLrFPPg.exe
  C:\Windows\System\XLrFPPg.exe
  2⤵
  PID:5448
- C:\Windows\System\NGwFYob.exe
  C:\Windows\System\NGwFYob.exe
  2⤵
  PID:5464
- C:\Windows\System\oMCwRbD.exe
  C:\Windows\System\oMCwRbD.exe
  2⤵
  PID:5480
- C:\Windows\System\YDSDdqW.exe
  C:\Windows\System\YDSDdqW.exe
  2⤵
  PID:5496
- C:\Windows\System\jdSXjXg.exe
  C:\Windows\System\jdSXjXg.exe
  2⤵
  PID:5512
- C:\Windows\System\KaMXQHv.exe
  C:\Windows\System\KaMXQHv.exe
  2⤵
  PID:5528
- C:\Windows\System\jiIyjpm.exe
  C:\Windows\System\jiIyjpm.exe
  2⤵
  PID:5544
- C:\Windows\System\LLLMjOM.exe
  C:\Windows\System\LLLMjOM.exe
  2⤵
  PID:5560
- C:\Windows\System\vIDAelh.exe
  C:\Windows\System\vIDAelh.exe
  2⤵
  PID:5576
- C:\Windows\System\xgjkyty.exe
  C:\Windows\System\xgjkyty.exe
  2⤵
  PID:5592
- C:\Windows\System\qxJrxMU.exe
  C:\Windows\System\qxJrxMU.exe
  2⤵
  PID:5608
- C:\Windows\System\euevuuI.exe
  C:\Windows\System\euevuuI.exe
  2⤵
  PID:5624
- C:\Windows\System\tnvoYQa.exe
  C:\Windows\System\tnvoYQa.exe
  2⤵
  PID:5644
- C:\Windows\System\EOtDwwX.exe
  C:\Windows\System\EOtDwwX.exe
  2⤵
  PID:5660
- C:\Windows\System\mtrTGCl.exe
  C:\Windows\System\mtrTGCl.exe
  2⤵
  PID:5676
- C:\Windows\System\CEarmNS.exe
  C:\Windows\System\CEarmNS.exe
  2⤵
  PID:5692
- C:\Windows\System\PPNOhhW.exe
  C:\Windows\System\PPNOhhW.exe
  2⤵
  PID:5708
- C:\Windows\System\YOrCHkZ.exe
  C:\Windows\System\YOrCHkZ.exe
  2⤵
  PID:5724
- C:\Windows\System\GwoeyXn.exe
  C:\Windows\System\GwoeyXn.exe
  2⤵
  PID:5740
- C:\Windows\System\cAAqfwI.exe
  C:\Windows\System\cAAqfwI.exe
  2⤵
  PID:5756
- C:\Windows\System\MQbxWoG.exe
  C:\Windows\System\MQbxWoG.exe
  2⤵
  PID:5772
- C:\Windows\System\zlaJZKy.exe
  C:\Windows\System\zlaJZKy.exe
  2⤵
  PID:5788
- C:\Windows\System\ZmUqoVw.exe
  C:\Windows\System\ZmUqoVw.exe
  2⤵
  PID:5804
- C:\Windows\System\oeeYVVF.exe
  C:\Windows\System\oeeYVVF.exe
  2⤵
  PID:5820
- C:\Windows\System\zMDYiir.exe
  C:\Windows\System\zMDYiir.exe
  2⤵
  PID:5836
- C:\Windows\System\jMlByFH.exe
  C:\Windows\System\jMlByFH.exe
  2⤵
  PID:5852
- C:\Windows\System\cPSQvUc.exe
  C:\Windows\System\cPSQvUc.exe
  2⤵
  PID:5868
- C:\Windows\System\PCKZDwy.exe
  C:\Windows\System\PCKZDwy.exe
  2⤵
  PID:5884
- C:\Windows\System\lmiFQVD.exe
  C:\Windows\System\lmiFQVD.exe
  2⤵
  PID:5900
- C:\Windows\System\bznDrIO.exe
  C:\Windows\System\bznDrIO.exe
  2⤵
  PID:5916
- C:\Windows\System\aylvJxJ.exe
  C:\Windows\System\aylvJxJ.exe
  2⤵
  PID:5932
- C:\Windows\System\hOKSvrO.exe
  C:\Windows\System\hOKSvrO.exe
  2⤵
  PID:5948
- C:\Windows\System\VGIYNRd.exe
  C:\Windows\System\VGIYNRd.exe
  2⤵
  PID:5964
- C:\Windows\System\adhqtzN.exe
  C:\Windows\System\adhqtzN.exe
  2⤵
  PID:5980
- C:\Windows\System\iZQgMXM.exe
  C:\Windows\System\iZQgMXM.exe
  2⤵
  PID:5996
- C:\Windows\System\dJJdgoK.exe
  C:\Windows\System\dJJdgoK.exe
  2⤵
  PID:6012
- C:\Windows\System\NUoEqZo.exe
  C:\Windows\System\NUoEqZo.exe
  2⤵
  PID:6028
- C:\Windows\System\czqMCHL.exe
  C:\Windows\System\czqMCHL.exe
  2⤵
  PID:6044
- C:\Windows\System\gViYzSK.exe
  C:\Windows\System\gViYzSK.exe
  2⤵
  PID:6060
- C:\Windows\System\vDwMwiV.exe
  C:\Windows\System\vDwMwiV.exe
  2⤵
  PID:6076
- C:\Windows\System\IGVrpjS.exe
  C:\Windows\System\IGVrpjS.exe
  2⤵
  PID:6092
- C:\Windows\System\zZFxfji.exe
  C:\Windows\System\zZFxfji.exe
  2⤵
  PID:6108
- C:\Windows\System\weMfeYB.exe
  C:\Windows\System\weMfeYB.exe
  2⤵
  PID:6124
- C:\Windows\System\XDEKIfX.exe
  C:\Windows\System\XDEKIfX.exe
  2⤵
  PID:6140
- C:\Windows\System\tYdvpqL.exe
  C:\Windows\System\tYdvpqL.exe
  2⤵
  PID:5136
- C:\Windows\System\MvHGhtx.exe
  C:\Windows\System\MvHGhtx.exe
  2⤵
  PID:4560
- C:\Windows\System\lwJMVkM.exe
  C:\Windows\System\lwJMVkM.exe
  2⤵
  PID:5164
- C:\Windows\System\gxWAvTh.exe
  C:\Windows\System\gxWAvTh.exe
  2⤵
  PID:5168
- C:\Windows\System\glVvIHH.exe
  C:\Windows\System\glVvIHH.exe
  2⤵
  PID:5228
- C:\Windows\System\inTxTxr.exe
  C:\Windows\System\inTxTxr.exe
  2⤵
  PID:5232
- C:\Windows\System\jKpoyNf.exe
  C:\Windows\System\jKpoyNf.exe
  2⤵
  PID:5248
- C:\Windows\System\XpVMLUy.exe
  C:\Windows\System\XpVMLUy.exe
  2⤵
  PID:5296
- C:\Windows\System\qachkPZ.exe
  C:\Windows\System\qachkPZ.exe
  2⤵
  PID:5312
- C:\Windows\System\hBNQSmH.exe
  C:\Windows\System\hBNQSmH.exe
  2⤵
  PID:5360
- C:\Windows\System\nCiRwPI.exe
  C:\Windows\System\nCiRwPI.exe
  2⤵
  PID:5392
- C:\Windows\System\DkHvsjK.exe
  C:\Windows\System\DkHvsjK.exe
  2⤵
  PID:5424
- C:\Windows\System\oHFyKhs.exe
  C:\Windows\System\oHFyKhs.exe
  2⤵
  PID:5460
- C:\Windows\System\BfiFOAS.exe
  C:\Windows\System\BfiFOAS.exe
  2⤵
  PID:5440
- C:\Windows\System\TkziLDy.exe
  C:\Windows\System\TkziLDy.exe
  2⤵
  PID:5504
- C:\Windows\System\GXYMVah.exe
  C:\Windows\System\GXYMVah.exe
  2⤵
  PID:5476
- C:\Windows\System\rRBOlzZ.exe
  C:\Windows\System\rRBOlzZ.exe
  2⤵
  PID:5572
- C:\Windows\System\oEjbxOD.exe
  C:\Windows\System\oEjbxOD.exe
  2⤵
  PID:5620
- C:\Windows\System\jDHSQeA.exe
  C:\Windows\System\jDHSQeA.exe
  2⤵
  PID:5632
- C:\Windows\System\DLHxiKV.exe
  C:\Windows\System\DLHxiKV.exe
  2⤵
  PID:5672
- C:\Windows\System\wCbRcGm.exe
  C:\Windows\System\wCbRcGm.exe
  2⤵
  PID:5716
- C:\Windows\System\nDwizCV.exe
  C:\Windows\System\nDwizCV.exe
  2⤵
  PID:5752
- C:\Windows\System\hsdxGHQ.exe
  C:\Windows\System\hsdxGHQ.exe
  2⤵
  PID:5812
- C:\Windows\System\YWhEyST.exe
  C:\Windows\System\YWhEyST.exe
  2⤵
  PID:5796
- C:\Windows\System\itXWiny.exe
  C:\Windows\System\itXWiny.exe
  2⤵
  PID:5732
- C:\Windows\System\pptfkzM.exe
  C:\Windows\System\pptfkzM.exe
  2⤵
  PID:5908
- C:\Windows\System\kukwIqf.exe
  C:\Windows\System\kukwIqf.exe
  2⤵
  PID:5864
- C:\Windows\System\DWamukI.exe
  C:\Windows\System\DWamukI.exe
  2⤵
  PID:6004
- C:\Windows\System\itlOVXN.exe
  C:\Windows\System\itlOVXN.exe
  2⤵
  PID:6008
- C:\Windows\System\BSwYdVv.exe
  C:\Windows\System\BSwYdVv.exe
  2⤵
  PID:6036
- C:\Windows\System\ZJHhaGe.exe
  C:\Windows\System\ZJHhaGe.exe
  2⤵
  PID:5992
- C:\Windows\System\opLCfbE.exe
  C:\Windows\System\opLCfbE.exe
  2⤵
  PID:6056
- C:\Windows\System\IswmJKc.exe
  C:\Windows\System\IswmJKc.exe
  2⤵
  PID:6104
- C:\Windows\System\jjomJfr.exe
  C:\Windows\System\jjomJfr.exe
  2⤵
  PID:6116
- C:\Windows\System\SgISdTF.exe
  C:\Windows\System\SgISdTF.exe
  2⤵
  PID:5060
- C:\Windows\System\bXBdJAC.exe
  C:\Windows\System\bXBdJAC.exe
  2⤵
  PID:4780
- C:\Windows\System\zmGiTmS.exe
  C:\Windows\System\zmGiTmS.exe
  2⤵
  PID:5216
- C:\Windows\System\KsQEKiB.exe
  C:\Windows\System\KsQEKiB.exe
  2⤵
  PID:5280
- C:\Windows\System\LbHOzAd.exe
  C:\Windows\System\LbHOzAd.exe
  2⤵
  PID:5376
- C:\Windows\System\HYQUZcC.exe
  C:\Windows\System\HYQUZcC.exe
  2⤵
  PID:5520
- C:\Windows\System\arYUkTM.exe
  C:\Windows\System\arYUkTM.exe
  2⤵
  PID:5552
- C:\Windows\System\IhCowGr.exe
  C:\Windows\System\IhCowGr.exe
  2⤵
  PID:5556
- C:\Windows\System\KMbWiGj.exe
  C:\Windows\System\KMbWiGj.exe
  2⤵
  PID:5636
- C:\Windows\System\ZCcfKGk.exe
  C:\Windows\System\ZCcfKGk.exe
  2⤵
  PID:5656
- C:\Windows\System\iIeKpdM.exe
  C:\Windows\System\iIeKpdM.exe
  2⤵
  PID:5688
- C:\Windows\System\JNOFoIw.exe
  C:\Windows\System\JNOFoIw.exe
  2⤵
  PID:5844
- C:\Windows\System\vqKVAEz.exe
  C:\Windows\System\vqKVAEz.exe
  2⤵
  PID:5892
- C:\Windows\System\RrZmupU.exe
  C:\Windows\System\RrZmupU.exe
  2⤵
  PID:5972
- C:\Windows\System\SyduHpZ.exe
  C:\Windows\System\SyduHpZ.exe
  2⤵
  PID:5944
- C:\Windows\System\iFQrmKV.exe
  C:\Windows\System\iFQrmKV.exe
  2⤵
  PID:6052
- C:\Windows\System\kstNqzp.exe
  C:\Windows\System\kstNqzp.exe
  2⤵
  PID:6120
- C:\Windows\System\UrxCoPK.exe
  C:\Windows\System\UrxCoPK.exe
  2⤵
  PID:4588
- C:\Windows\System\YbhaKqp.exe
  C:\Windows\System\YbhaKqp.exe
  2⤵
  PID:5264
- C:\Windows\System\hCEviCk.exe
  C:\Windows\System\hCEviCk.exe
  2⤵
  PID:5568
- C:\Windows\System\nVxVfrY.exe
  C:\Windows\System\nVxVfrY.exe
  2⤵
  PID:5244
- C:\Windows\System\WkYnDyw.exe
  C:\Windows\System\WkYnDyw.exe
  2⤵
  PID:5960
- C:\Windows\System\vKiFZNZ.exe
  C:\Windows\System\vKiFZNZ.exe
  2⤵
  PID:5328
- C:\Windows\System\FGUeRpe.exe
  C:\Windows\System\FGUeRpe.exe
  2⤵
  PID:5616
- C:\Windows\System\IEMVZxx.exe
  C:\Windows\System\IEMVZxx.exe
  2⤵
  PID:5876
- C:\Windows\System\ztyNpEJ.exe
  C:\Windows\System\ztyNpEJ.exe
  2⤵
  PID:6024
- C:\Windows\System\IHeJqhO.exe
  C:\Windows\System\IHeJqhO.exe
  2⤵
  PID:5472
- C:\Windows\System\OskgGfR.exe
  C:\Windows\System\OskgGfR.exe
  2⤵
  PID:5588
- C:\Windows\System\hnjmeko.exe
  C:\Windows\System\hnjmeko.exe
  2⤵
  PID:5212
- C:\Windows\System\QIzfKqa.exe
  C:\Windows\System\QIzfKqa.exe
  2⤵
  PID:5640
- C:\Windows\System\FAiGISa.exe
  C:\Windows\System\FAiGISa.exe
  2⤵
  PID:5912
- C:\Windows\System\HvNoMRw.exe
  C:\Windows\System\HvNoMRw.exe
  2⤵
  PID:6156
- C:\Windows\System\fTpvKWh.exe
  C:\Windows\System\fTpvKWh.exe
  2⤵
  PID:6172
- C:\Windows\System\waKYlkb.exe
  C:\Windows\System\waKYlkb.exe
  2⤵
  PID:6188
- C:\Windows\System\KhMgGuF.exe
  C:\Windows\System\KhMgGuF.exe
  2⤵
  PID:6204
- C:\Windows\System\VNUrJgo.exe
  C:\Windows\System\VNUrJgo.exe
  2⤵
  PID:6220
- C:\Windows\System\TcKQFKU.exe
  C:\Windows\System\TcKQFKU.exe
  2⤵
  PID:6236
- C:\Windows\System\MFRbjZx.exe
  C:\Windows\System\MFRbjZx.exe
  2⤵
  PID:6252
- C:\Windows\System\rDSWSJi.exe
  C:\Windows\System\rDSWSJi.exe
  2⤵
  PID:6268
- C:\Windows\System\cemgjJx.exe
  C:\Windows\System\cemgjJx.exe
  2⤵
  PID:6284
- C:\Windows\System\EObriHO.exe
  C:\Windows\System\EObriHO.exe
  2⤵
  PID:6300
- C:\Windows\System\lTgZGcx.exe
  C:\Windows\System\lTgZGcx.exe
  2⤵
  PID:6316
- C:\Windows\System\baCfKht.exe
  C:\Windows\System\baCfKht.exe
  2⤵
  PID:6332
- C:\Windows\System\mqtQwKq.exe
  C:\Windows\System\mqtQwKq.exe
  2⤵
  PID:6348
- C:\Windows\System\QRnloIP.exe
  C:\Windows\System\QRnloIP.exe
  2⤵
  PID:6364
- C:\Windows\System\ritwEGO.exe
  C:\Windows\System\ritwEGO.exe
  2⤵
  PID:6380
- C:\Windows\System\BVQEqcT.exe
  C:\Windows\System\BVQEqcT.exe
  2⤵
  PID:6396
- C:\Windows\System\gBTOJZQ.exe
  C:\Windows\System\gBTOJZQ.exe
  2⤵
  PID:6412
- C:\Windows\System\PBCknqp.exe
  C:\Windows\System\PBCknqp.exe
  2⤵
  PID:6428
- C:\Windows\System\xVDOugP.exe
  C:\Windows\System\xVDOugP.exe
  2⤵
  PID:6444
- C:\Windows\System\hcNAtpX.exe
  C:\Windows\System\hcNAtpX.exe
  2⤵
  PID:6460
- C:\Windows\System\EfjQLDN.exe
  C:\Windows\System\EfjQLDN.exe
  2⤵
  PID:6476
- C:\Windows\System\IPoGiop.exe
  C:\Windows\System\IPoGiop.exe
  2⤵
  PID:6492
- C:\Windows\System\XqUTMgK.exe
  C:\Windows\System\XqUTMgK.exe
  2⤵
  PID:6508
- C:\Windows\System\wIzJBOx.exe
  C:\Windows\System\wIzJBOx.exe
  2⤵
  PID:6524
- C:\Windows\System\pmrPKnB.exe
  C:\Windows\System\pmrPKnB.exe
  2⤵
  PID:6540
- C:\Windows\System\gjxrKAp.exe
  C:\Windows\System\gjxrKAp.exe
  2⤵
  PID:6556
- C:\Windows\System\IEfMISM.exe
  C:\Windows\System\IEfMISM.exe
  2⤵
  PID:6584
- C:\Windows\System\HFEDneZ.exe
  C:\Windows\System\HFEDneZ.exe
  2⤵
  PID:6600
- C:\Windows\System\jvJBQcN.exe
  C:\Windows\System\jvJBQcN.exe
  2⤵
  PID:6616
- C:\Windows\System\onPSycW.exe
  C:\Windows\System\onPSycW.exe
  2⤵
  PID:6632
- C:\Windows\System\wUUSpSF.exe
  C:\Windows\System\wUUSpSF.exe
  2⤵
  PID:6648
- C:\Windows\System\BdoKqzE.exe
  C:\Windows\System\BdoKqzE.exe
  2⤵
  PID:6664
- C:\Windows\System\JGZcxLl.exe
  C:\Windows\System\JGZcxLl.exe
  2⤵
  PID:6684
- C:\Windows\System\pwUSUij.exe
  C:\Windows\System\pwUSUij.exe
  2⤵
  PID:6700
- C:\Windows\System\ltlvfHy.exe
  C:\Windows\System\ltlvfHy.exe
  2⤵
  PID:6720
- C:\Windows\System\BnhpYLt.exe
  C:\Windows\System\BnhpYLt.exe
  2⤵
  PID:6736
- C:\Windows\System\rGMXeGL.exe
  C:\Windows\System\rGMXeGL.exe
  2⤵
  PID:6752
- C:\Windows\System\wkvqrCe.exe
  C:\Windows\System\wkvqrCe.exe
  2⤵
  PID:6768
- C:\Windows\System\eZswOab.exe
  C:\Windows\System\eZswOab.exe
  2⤵
  PID:6784
- C:\Windows\System\yesoqED.exe
  C:\Windows\System\yesoqED.exe
  2⤵
  PID:6800
- C:\Windows\System\akMpBqv.exe
  C:\Windows\System\akMpBqv.exe
  2⤵
  PID:6816
- C:\Windows\System\PHJPNaE.exe
  C:\Windows\System\PHJPNaE.exe
  2⤵
  PID:6840
- C:\Windows\System\fUrJJeS.exe
  C:\Windows\System\fUrJJeS.exe
  2⤵
  PID:6860
- C:\Windows\System\CeeSuod.exe
  C:\Windows\System\CeeSuod.exe
  2⤵
  PID:6876
- C:\Windows\System\hHjCilz.exe
  C:\Windows\System\hHjCilz.exe
  2⤵
  PID:6892
- C:\Windows\System\ykXyxUe.exe
  C:\Windows\System\ykXyxUe.exe
  2⤵
  PID:6916
- C:\Windows\System\OgcdwwE.exe
  C:\Windows\System\OgcdwwE.exe
  2⤵
  PID:6936
- C:\Windows\System\VmdgCsA.exe
  C:\Windows\System\VmdgCsA.exe
  2⤵
  PID:6952
- C:\Windows\System\iUPewRm.exe
  C:\Windows\System\iUPewRm.exe
  2⤵
  PID:6968
- C:\Windows\System\MrQAbXO.exe
  C:\Windows\System\MrQAbXO.exe
  2⤵
  PID:6984
- C:\Windows\System\kupFMiO.exe
  C:\Windows\System\kupFMiO.exe
  2⤵
  PID:7000
- C:\Windows\System\DmnDSfA.exe
  C:\Windows\System\DmnDSfA.exe
  2⤵
  PID:7020
- C:\Windows\System\rDvuIoF.exe
  C:\Windows\System\rDvuIoF.exe
  2⤵
  PID:7036
- C:\Windows\System\GCvlwEx.exe
  C:\Windows\System\GCvlwEx.exe
  2⤵
  PID:7056
- C:\Windows\System\aAbqDtE.exe
  C:\Windows\System\aAbqDtE.exe
  2⤵
  PID:7072
- C:\Windows\System\YvUHdWX.exe
  C:\Windows\System\YvUHdWX.exe
  2⤵
  PID:7088
- C:\Windows\System\PIHHvPk.exe
  C:\Windows\System\PIHHvPk.exe
  2⤵
  PID:7124
- C:\Windows\System\onTyDfm.exe
  C:\Windows\System\onTyDfm.exe
  2⤵
  PID:7140
- C:\Windows\System\keyeQuY.exe
  C:\Windows\System\keyeQuY.exe
  2⤵
  PID:7160
- C:\Windows\System\JqseFce.exe
  C:\Windows\System\JqseFce.exe
  2⤵
  PID:5780
- C:\Windows\System\vELTNgW.exe
  C:\Windows\System\vELTNgW.exe
  2⤵
  PID:6148
- C:\Windows\System\TCXhJYq.exe
  C:\Windows\System\TCXhJYq.exe
  2⤵
  PID:6184
- C:\Windows\System\zYuWMkq.exe
  C:\Windows\System\zYuWMkq.exe
  2⤵
  PID:6216
- C:\Windows\System\LpSlTcn.exe
  C:\Windows\System\LpSlTcn.exe
  2⤵
  PID:6228
- C:\Windows\System\uNopJBv.exe
  C:\Windows\System\uNopJBv.exe
  2⤵
  PID:6264
- C:\Windows\System\EyVXoKA.exe
  C:\Windows\System\EyVXoKA.exe
  2⤵
  PID:6296
- C:\Windows\System\cJjLSFx.exe
  C:\Windows\System\cJjLSFx.exe
  2⤵
  PID:6308
- C:\Windows\System\efYRChS.exe
  C:\Windows\System\efYRChS.exe
  2⤵
  PID:6516
- C:\Windows\System\vOUrHtq.exe
  C:\Windows\System\vOUrHtq.exe
  2⤵
  PID:6420
- C:\Windows\System\hvuzyoq.exe
  C:\Windows\System\hvuzyoq.exe
  2⤵
  PID:6340
- C:\Windows\System\QapEvMa.exe
  C:\Windows\System\QapEvMa.exe
  2⤵
  PID:6404
- C:\Windows\System\fhktdxw.exe
  C:\Windows\System\fhktdxw.exe
  2⤵
  PID:6472
- C:\Windows\System\QOdjsbQ.exe
  C:\Windows\System\QOdjsbQ.exe
  2⤵
  PID:6536
- C:\Windows\System\MTDvqxu.exe
  C:\Windows\System\MTDvqxu.exe
  2⤵
  PID:6628
- C:\Windows\System\XgujHFM.exe
  C:\Windows\System\XgujHFM.exe
  2⤵
  PID:6484
- C:\Windows\System\OPFXNgJ.exe
  C:\Windows\System\OPFXNgJ.exe
  2⤵
  PID:6644
- C:\Windows\System\GSwvmiP.exe
  C:\Windows\System\GSwvmiP.exe
  2⤵
  PID:6692
- C:\Windows\System\CcpMTyQ.exe
  C:\Windows\System\CcpMTyQ.exe
  2⤵
  PID:6732
- C:\Windows\System\bNOZjAc.exe
  C:\Windows\System\bNOZjAc.exe
  2⤵
  PID:6792
- C:\Windows\System\dozHAcz.exe
  C:\Windows\System\dozHAcz.exe
  2⤵
  PID:6832
- C:\Windows\System\AHUFsrG.exe
  C:\Windows\System\AHUFsrG.exe
  2⤵
  PID:6812
- C:\Windows\System\lQZcDvU.exe
  C:\Windows\System\lQZcDvU.exe
  2⤵
  PID:6924
- C:\Windows\System\fpDfypt.exe
  C:\Windows\System\fpDfypt.exe
  2⤵
  PID:6976
- C:\Windows\System\mcIOQos.exe
  C:\Windows\System\mcIOQos.exe
  2⤵
  PID:6960
- C:\Windows\System\MweLfqH.exe
  C:\Windows\System\MweLfqH.exe
  2⤵
  PID:6992
- C:\Windows\System\SjeCggR.exe
  C:\Windows\System\SjeCggR.exe
  2⤵
  PID:7016
- C:\Windows\System\omaWSky.exe
  C:\Windows\System\omaWSky.exe
  2⤵
  PID:7048
- C:\Windows\System\YETqVee.exe
  C:\Windows\System\YETqVee.exe
  2⤵
  PID:7084
- C:\Windows\System\BZcevcB.exe
  C:\Windows\System\BZcevcB.exe
  2⤵
  PID:280
- C:\Windows\System\fAlrUdl.exe
  C:\Windows\System\fAlrUdl.exe
  2⤵
  PID:7132
- C:\Windows\System\RrWIIkT.exe
  C:\Windows\System\RrWIIkT.exe
  2⤵
  PID:5748
- C:\Windows\System\AKWYQYQ.exe
  C:\Windows\System\AKWYQYQ.exe
  2⤵
  PID:5784
- C:\Windows\System\XVWDDMs.exe
  C:\Windows\System\XVWDDMs.exe
  2⤵
  PID:6200
- C:\Windows\System\kbcaQKv.exe
  C:\Windows\System\kbcaQKv.exe
  2⤵
  PID:6212
- C:\Windows\System\jKVLHqA.exe
  C:\Windows\System\jKVLHqA.exe
  2⤵
  PID:6408
- C:\Windows\System\dxQeMmB.exe
  C:\Windows\System\dxQeMmB.exe
  2⤵
  PID:6328
- C:\Windows\System\ZbzFsCM.exe
  C:\Windows\System\ZbzFsCM.exe
  2⤵
  PID:6260
- C:\Windows\System\jDUjsrb.exe
  C:\Windows\System\jDUjsrb.exe
  2⤵
  PID:6388
- C:\Windows\System\UJMTnGS.exe
  C:\Windows\System\UJMTnGS.exe
  2⤵
  PID:6548
- C:\Windows\System\WmCTYIM.exe
  C:\Windows\System\WmCTYIM.exe
  2⤵
  PID:6376
- C:\Windows\System\uXPkjAO.exe
  C:\Windows\System\uXPkjAO.exe
  2⤵
  PID:6660
- C:\Windows\System\CfZRxYT.exe
  C:\Windows\System\CfZRxYT.exe
  2⤵
  PID:6852
- C:\Windows\System\fBglhmw.exe
  C:\Windows\System\fBglhmw.exe
  2⤵
  PID:6568
- C:\Windows\System\dashlDo.exe
  C:\Windows\System\dashlDo.exe
  2⤵
  PID:7108
- C:\Windows\System\cocqELP.exe
  C:\Windows\System\cocqELP.exe
  2⤵
  PID:6908
- C:\Windows\System\GKwKxzm.exe
  C:\Windows\System\GKwKxzm.exe
  2⤵
  PID:6168
- C:\Windows\System\pJwGjMp.exe
  C:\Windows\System\pJwGjMp.exe
  2⤵
  PID:6596
- C:\Windows\System\WSQxrcp.exe
  C:\Windows\System\WSQxrcp.exe
  2⤵
  PID:6488
- C:\Windows\System\pwzoRAP.exe
  C:\Windows\System\pwzoRAP.exe
  2⤵
  PID:7120
- C:\Windows\System\iIeezoA.exe
  C:\Windows\System\iIeezoA.exe
  2⤵
  PID:6696
- C:\Windows\System\uVDIYyR.exe
  C:\Windows\System\uVDIYyR.exe
  2⤵
  PID:6760
- C:\Windows\System\GpoYGEF.exe
  C:\Windows\System\GpoYGEF.exe
  2⤵
  PID:7100
- C:\Windows\System\bWDbsQI.exe
  C:\Windows\System\bWDbsQI.exe
  2⤵
  PID:7112
- C:\Windows\System\EBPIeFy.exe
  C:\Windows\System\EBPIeFy.exe
  2⤵
  PID:7008
- C:\Windows\System\JzDQnxx.exe
  C:\Windows\System\JzDQnxx.exe
  2⤵
  PID:6292
- C:\Windows\System\PiPvggb.exe
  C:\Windows\System\PiPvggb.exe
  2⤵
  PID:7032
- C:\Windows\System\cICOvoA.exe
  C:\Windows\System\cICOvoA.exe
  2⤵
  PID:6360
- C:\Windows\System\ZZQhcVZ.exe
  C:\Windows\System\ZZQhcVZ.exe
  2⤵
  PID:6728
- C:\Windows\System\tfKLECN.exe
  C:\Windows\System\tfKLECN.exe
  2⤵
  PID:6888
- C:\Windows\System\UVKHtan.exe
  C:\Windows\System\UVKHtan.exe
  2⤵
  PID:7152
- C:\Windows\System\uxoLbSC.exe
  C:\Windows\System\uxoLbSC.exe
  2⤵
  PID:7064
- C:\Windows\System\peRRirh.exe
  C:\Windows\System\peRRirh.exe
  2⤵
  PID:7148
- C:\Windows\System\KcbKaIj.exe
  C:\Windows\System\KcbKaIj.exe
  2⤵
  PID:6624
- C:\Windows\System\uKcizaB.exe
  C:\Windows\System\uKcizaB.exe
  2⤵
  PID:7176
- C:\Windows\System\zjdgBYY.exe
  C:\Windows\System\zjdgBYY.exe
  2⤵
  PID:7192
- C:\Windows\System\lPyKCcA.exe
  C:\Windows\System\lPyKCcA.exe
  2⤵
  PID:7208
- C:\Windows\System\eJFuaEL.exe
  C:\Windows\System\eJFuaEL.exe
  2⤵
  PID:7224
- C:\Windows\System\VueGPEt.exe
  C:\Windows\System\VueGPEt.exe
  2⤵
  PID:7240
- C:\Windows\System\KipyNEp.exe
  C:\Windows\System\KipyNEp.exe
  2⤵
  PID:7256
- C:\Windows\System\uWNNOsJ.exe
  C:\Windows\System\uWNNOsJ.exe
  2⤵
  PID:7272
- C:\Windows\System\JBWdVCa.exe
  C:\Windows\System\JBWdVCa.exe
  2⤵
  PID:7288
- C:\Windows\System\egRhqQb.exe
  C:\Windows\System\egRhqQb.exe
  2⤵
  PID:7308
- C:\Windows\System\soXcCpi.exe
  C:\Windows\System\soXcCpi.exe
  2⤵
  PID:7324
- C:\Windows\System\nFmuxeK.exe
  C:\Windows\System\nFmuxeK.exe
  2⤵
  PID:7340
- C:\Windows\System\irMdUQJ.exe
  C:\Windows\System\irMdUQJ.exe
  2⤵
  PID:7356
- C:\Windows\System\ZemwIPE.exe
  C:\Windows\System\ZemwIPE.exe
  2⤵
  PID:7372
- C:\Windows\System\NbJFzya.exe
  C:\Windows\System\NbJFzya.exe
  2⤵
  PID:7388
- C:\Windows\System\KMXgeeP.exe
  C:\Windows\System\KMXgeeP.exe
  2⤵
  PID:7404
- C:\Windows\System\yrpfqyC.exe
  C:\Windows\System\yrpfqyC.exe
  2⤵
  PID:7420
- C:\Windows\System\DLKuzLF.exe
  C:\Windows\System\DLKuzLF.exe
  2⤵
  PID:7436
- C:\Windows\System\peKkGAS.exe
  C:\Windows\System\peKkGAS.exe
  2⤵
  PID:7452
- C:\Windows\System\cVdJJBE.exe
  C:\Windows\System\cVdJJBE.exe
  2⤵
  PID:7468
- C:\Windows\System\esnXjhN.exe
  C:\Windows\System\esnXjhN.exe
  2⤵
  PID:7484
- C:\Windows\System\oEyjGOp.exe
  C:\Windows\System\oEyjGOp.exe
  2⤵
  PID:7516
- C:\Windows\System\hMoilGH.exe
  C:\Windows\System\hMoilGH.exe
  2⤵
  PID:7548
- C:\Windows\System\JWUVbWU.exe
  C:\Windows\System\JWUVbWU.exe
  2⤵
  PID:7564
- C:\Windows\System\WIGPAuq.exe
  C:\Windows\System\WIGPAuq.exe
  2⤵
  PID:7580
- C:\Windows\System\xBxIykF.exe
  C:\Windows\System\xBxIykF.exe
  2⤵
  PID:7596
- C:\Windows\System\KdwHEqb.exe
  C:\Windows\System\KdwHEqb.exe
  2⤵
  PID:7620
- C:\Windows\System\utFlyVF.exe
  C:\Windows\System\utFlyVF.exe
  2⤵
  PID:7656
- C:\Windows\System\gdpHhDI.exe
  C:\Windows\System\gdpHhDI.exe
  2⤵
  PID:7672
- C:\Windows\System\zDGAKld.exe
  C:\Windows\System\zDGAKld.exe
  2⤵
  PID:7688
- C:\Windows\System\KCVQzEZ.exe
  C:\Windows\System\KCVQzEZ.exe
  2⤵
  PID:7712
- C:\Windows\System\ohFUTsq.exe
  C:\Windows\System\ohFUTsq.exe
  2⤵
  PID:7732
- C:\Windows\System\nVWEcKe.exe
  C:\Windows\System\nVWEcKe.exe
  2⤵
  PID:7752
- C:\Windows\System\pOdgPiH.exe
  C:\Windows\System\pOdgPiH.exe
  2⤵
  PID:7768
- C:\Windows\System\LzaSHXi.exe
  C:\Windows\System\LzaSHXi.exe
  2⤵
  PID:7784
- C:\Windows\System\pmzxNgf.exe
  C:\Windows\System\pmzxNgf.exe
  2⤵
  PID:7800
- C:\Windows\System\stNJmpc.exe
  C:\Windows\System\stNJmpc.exe
  2⤵
  PID:7816
- C:\Windows\System\XGUDuoQ.exe
  C:\Windows\System\XGUDuoQ.exe
  2⤵
  PID:7832
- C:\Windows\System\haHhleW.exe
  C:\Windows\System\haHhleW.exe
  2⤵
  PID:7860
- C:\Windows\System\DjTZRex.exe
  C:\Windows\System\DjTZRex.exe
  2⤵
  PID:7876
- C:\Windows\System\PiMTFOR.exe
  C:\Windows\System\PiMTFOR.exe
  2⤵
  PID:7896
- C:\Windows\System\JoYNDqX.exe
  C:\Windows\System\JoYNDqX.exe
  2⤵
  PID:7912
- C:\Windows\System\UJPtgQT.exe
  C:\Windows\System\UJPtgQT.exe
  2⤵
  PID:7928
- C:\Windows\System\dERTCCg.exe
  C:\Windows\System\dERTCCg.exe
  2⤵
  PID:7944
- C:\Windows\System\WizrYUM.exe
  C:\Windows\System\WizrYUM.exe
  2⤵
  PID:7960
- C:\Windows\System\XWXHhkn.exe
  C:\Windows\System\XWXHhkn.exe
  2⤵
  PID:7976
- C:\Windows\System\jLVZzLb.exe
  C:\Windows\System\jLVZzLb.exe
  2⤵
  PID:7992
- C:\Windows\System\wFhtNqa.exe
  C:\Windows\System\wFhtNqa.exe
  2⤵
  PID:8008
- C:\Windows\System\QfCPslu.exe
  C:\Windows\System\QfCPslu.exe
  2⤵
  PID:8024
- C:\Windows\System\qRvcqbd.exe
  C:\Windows\System\qRvcqbd.exe
  2⤵
  PID:8040
- C:\Windows\System\XaTEoBl.exe
  C:\Windows\System\XaTEoBl.exe
  2⤵
  PID:8056
- C:\Windows\System\PWapBIe.exe
  C:\Windows\System\PWapBIe.exe
  2⤵
  PID:8072
- C:\Windows\System\cetgIRc.exe
  C:\Windows\System\cetgIRc.exe
  2⤵
  PID:8088
- C:\Windows\System\SBCszDD.exe
  C:\Windows\System\SBCszDD.exe
  2⤵
  PID:8104
- C:\Windows\System\wtmALCJ.exe
  C:\Windows\System\wtmALCJ.exe
  2⤵
  PID:8120
- C:\Windows\System\CkNJYSf.exe
  C:\Windows\System\CkNJYSf.exe
  2⤵
  PID:8136
- C:\Windows\System\WnGZsJo.exe
  C:\Windows\System\WnGZsJo.exe
  2⤵
  PID:8152
- C:\Windows\System\vlFiNim.exe
  C:\Windows\System\vlFiNim.exe
  2⤵
  PID:8168
- C:\Windows\System\wxwWKlg.exe
  C:\Windows\System\wxwWKlg.exe
  2⤵
  PID:8184
- C:\Windows\System\ZTKYqCU.exe
  C:\Windows\System\ZTKYqCU.exe
  2⤵
  PID:7200
- C:\Windows\System\uPAAtmU.exe
  C:\Windows\System\uPAAtmU.exe
  2⤵
  PID:7264
- C:\Windows\System\iPfLKPA.exe
  C:\Windows\System\iPfLKPA.exe
  2⤵
  PID:7248
- C:\Windows\System\tPfbuow.exe
  C:\Windows\System\tPfbuow.exe
  2⤵
  PID:7252
- C:\Windows\System\aNGwRNh.exe
  C:\Windows\System\aNGwRNh.exe
  2⤵
  PID:7332
- C:\Windows\System\QNSZiuW.exe
  C:\Windows\System\QNSZiuW.exe
  2⤵
  PID:7396
- C:\Windows\System\kBCVohI.exe
  C:\Windows\System\kBCVohI.exe
  2⤵
  PID:7380
- C:\Windows\System\WPvNCON.exe
  C:\Windows\System\WPvNCON.exe
  2⤵
  PID:7448
- C:\Windows\System\snerXcS.exe
  C:\Windows\System\snerXcS.exe
  2⤵
  PID:7492
- C:\Windows\System\SSnGZaX.exe
  C:\Windows\System\SSnGZaX.exe
  2⤵
  PID:7524
- C:\Windows\System\tnqsISo.exe
  C:\Windows\System\tnqsISo.exe
  2⤵
  PID:7572
- C:\Windows\System\igkOckP.exe
  C:\Windows\System\igkOckP.exe
  2⤵
  PID:7632
- C:\Windows\System\QCkTJMD.exe
  C:\Windows\System\QCkTJMD.exe
  2⤵
  PID:7612
- C:\Windows\System\bYHaTAD.exe
  C:\Windows\System\bYHaTAD.exe
  2⤵
  PID:7604
- C:\Windows\System\DGosngQ.exe
  C:\Windows\System\DGosngQ.exe
  2⤵
  PID:7664
- C:\Windows\System\LXKOVqU.exe
  C:\Windows\System\LXKOVqU.exe
  2⤵
  PID:7704
- C:\Windows\System\eBZzLUP.exe
  C:\Windows\System\eBZzLUP.exe
  2⤵
  PID:7684
- C:\Windows\System\bPfQxct.exe
  C:\Windows\System\bPfQxct.exe
  2⤵
  PID:7764
- C:\Windows\System\yczxUHm.exe
  C:\Windows\System\yczxUHm.exe
  2⤵
  PID:7776
- C:\Windows\System\SrTmgAz.exe
  C:\Windows\System\SrTmgAz.exe
  2⤵
  PID:7828
- C:\Windows\System\wBSWzEu.exe
  C:\Windows\System\wBSWzEu.exe
  2⤵
  PID:7808
- C:\Windows\System\htHzUvf.exe
  C:\Windows\System\htHzUvf.exe
  2⤵
  PID:7872
- C:\Windows\System\scsYrTt.exe
  C:\Windows\System\scsYrTt.exe
  2⤵
  PID:7936
- C:\Windows\System\yyEOZob.exe
  C:\Windows\System\yyEOZob.exe
  2⤵
  PID:7984
- C:\Windows\System\XsOSerj.exe
  C:\Windows\System\XsOSerj.exe
  2⤵
  PID:8016
- C:\Windows\System\snPCnjG.exe
  C:\Windows\System\snPCnjG.exe
  2⤵
  PID:8052
- C:\Windows\System\BABUhlM.exe
  C:\Windows\System\BABUhlM.exe
  2⤵
  PID:8100
- C:\Windows\System\nfNWepc.exe
  C:\Windows\System\nfNWepc.exe
  2⤵
  PID:8112
- C:\Windows\System\lRmSoUi.exe
  C:\Windows\System\lRmSoUi.exe
  2⤵
  PID:8148
- C:\Windows\System\GIuGdML.exe
  C:\Windows\System\GIuGdML.exe
  2⤵
  PID:7172
- C:\Windows\System\TpwNuna.exe
  C:\Windows\System\TpwNuna.exe
  2⤵
  PID:7320
- C:\Windows\System\vKuwBpU.exe
  C:\Windows\System\vKuwBpU.exe
  2⤵
  PID:7232
- C:\Windows\System\uCighuc.exe
  C:\Windows\System\uCighuc.exe
  2⤵
  PID:7216
- C:\Windows\System\SZrhhbU.exe
  C:\Windows\System\SZrhhbU.exe
  2⤵
  PID:7316
- C:\Windows\System\ZTpfLKV.exe
  C:\Windows\System\ZTpfLKV.exe
  2⤵
  PID:7444
- C:\Windows\System\nGZNNJU.exe
  C:\Windows\System\nGZNNJU.exe
  2⤵
  PID:7528
- C:\Windows\System\wesqzly.exe
  C:\Windows\System\wesqzly.exe
  2⤵
  PID:7644
- C:\Windows\System\WVTChxo.exe
  C:\Windows\System\WVTChxo.exe
  2⤵
  PID:7680
- C:\Windows\System\nINvNJi.exe
  C:\Windows\System\nINvNJi.exe
  2⤵
  PID:7576
- C:\Windows\System\VlSOYsl.exe
  C:\Windows\System\VlSOYsl.exe
  2⤵
  PID:7560
- C:\Windows\System\qLQEciC.exe
  C:\Windows\System\qLQEciC.exe
  2⤵
  PID:7416
- C:\Windows\System\UFqdFLi.exe
  C:\Windows\System\UFqdFLi.exe
  2⤵
  PID:7748
- C:\Windows\System\QvrmBvl.exe
  C:\Windows\System\QvrmBvl.exe
  2⤵
  PID:7812
- C:\Windows\System\GbsYxiA.exe
  C:\Windows\System\GbsYxiA.exe
  2⤵
  PID:7840
- C:\Windows\System\KvrwSro.exe
  C:\Windows\System\KvrwSro.exe
  2⤵
  PID:8036
- C:\Windows\System\fqRSzpI.exe
  C:\Windows\System\fqRSzpI.exe
  2⤵
  PID:7300
- C:\Windows\System\ATBBgrd.exe
  C:\Windows\System\ATBBgrd.exe
  2⤵
  PID:7352
- C:\Windows\System\YkaMlqR.exe
  C:\Windows\System\YkaMlqR.exe
  2⤵
  PID:8176
- C:\Windows\System\kruUJUA.exe
  C:\Windows\System\kruUJUA.exe
  2⤵
  PID:7480
- C:\Windows\System\sHibEYh.exe
  C:\Windows\System\sHibEYh.exe
  2⤵
  PID:7796
- C:\Windows\System\btSDJos.exe
  C:\Windows\System\btSDJos.exe
  2⤵
  PID:8020
- C:\Windows\System\TQwEggX.exe
  C:\Windows\System\TQwEggX.exe
  2⤵
  PID:7296
- C:\Windows\System\VYzOCYY.exe
  C:\Windows\System\VYzOCYY.exe
  2⤵
  PID:8096
- C:\Windows\System\ksiuTSM.exe
  C:\Windows\System\ksiuTSM.exe
  2⤵
  PID:7412
- C:\Windows\System\MpQBLnd.exe
  C:\Windows\System\MpQBLnd.exe
  2⤵
  PID:7464
- C:\Windows\System\TgrUYtI.exe
  C:\Windows\System\TgrUYtI.exe
  2⤵
  PID:7728
- C:\Windows\System\dGYfNtY.exe
  C:\Windows\System\dGYfNtY.exe
  2⤵
  PID:7348
- C:\Windows\System\tLDiMHc.exe
  C:\Windows\System\tLDiMHc.exe
  2⤵
  PID:7184
- C:\Windows\System\JxpucMD.exe
  C:\Windows\System\JxpucMD.exe
  2⤵
  PID:7956
- C:\Windows\System\iHxoFJN.exe
  C:\Windows\System\iHxoFJN.exe
  2⤵
  PID:7892
- C:\Windows\System\yrLEvox.exe
  C:\Windows\System\yrLEvox.exe
  2⤵
  PID:7368
- C:\Windows\System\EYHBcEv.exe
  C:\Windows\System\EYHBcEv.exe
  2⤵
  PID:7504
- C:\Windows\System\leNkBng.exe
  C:\Windows\System\leNkBng.exe
  2⤵
  PID:7924
- C:\Windows\System\uyyQaNW.exe
  C:\Windows\System\uyyQaNW.exe
  2⤵
  PID:8144
- C:\Windows\System\pmVxrDI.exe
  C:\Windows\System\pmVxrDI.exe
  2⤵
  PID:7884
- C:\Windows\System\SLhXPUg.exe
  C:\Windows\System\SLhXPUg.exe
  2⤵
  PID:7848
- C:\Windows\System\nAsNEvj.exe
  C:\Windows\System\nAsNEvj.exe
  2⤵
  PID:8196
- C:\Windows\System\gLDukXW.exe
  C:\Windows\System\gLDukXW.exe
  2⤵
  PID:8212
- C:\Windows\System\JwHxhVX.exe
  C:\Windows\System\JwHxhVX.exe
  2⤵
  PID:8232
- C:\Windows\System\DAevhVo.exe
  C:\Windows\System\DAevhVo.exe
  2⤵
  PID:8248
- C:\Windows\System\zOiwvze.exe
  C:\Windows\System\zOiwvze.exe
  2⤵
  PID:8264
- C:\Windows\System\nPxUDWC.exe
  C:\Windows\System\nPxUDWC.exe
  2⤵
  PID:8280
- C:\Windows\System\YFHzpFg.exe
  C:\Windows\System\YFHzpFg.exe
  2⤵
  PID:8300
- C:\Windows\System\ewdYxuI.exe
  C:\Windows\System\ewdYxuI.exe
  2⤵
  PID:8316
- C:\Windows\System\nExDhSG.exe
  C:\Windows\System\nExDhSG.exe
  2⤵
  PID:8332
- C:\Windows\System\XUIIdAN.exe
  C:\Windows\System\XUIIdAN.exe
  2⤵
  PID:8348
- C:\Windows\System\ACnvcuH.exe
  C:\Windows\System\ACnvcuH.exe
  2⤵
  PID:8364
- C:\Windows\System\pJCGcav.exe
  C:\Windows\System\pJCGcav.exe
  2⤵
  PID:8384
- C:\Windows\System\cLRaYLA.exe
  C:\Windows\System\cLRaYLA.exe
  2⤵
  PID:8400
- C:\Windows\System\ZBhBZRz.exe
  C:\Windows\System\ZBhBZRz.exe
  2⤵
  PID:8416
- C:\Windows\System\JYZwgib.exe
  C:\Windows\System\JYZwgib.exe
  2⤵
  PID:8432
- C:\Windows\System\XEKoERb.exe
  C:\Windows\System\XEKoERb.exe
  2⤵
  PID:8452
- C:\Windows\System\NigbxOR.exe
  C:\Windows\System\NigbxOR.exe
  2⤵
  PID:8468
- C:\Windows\System\AZTfNbt.exe
  C:\Windows\System\AZTfNbt.exe
  2⤵
  PID:8484
- C:\Windows\System\HqKNAtu.exe
  C:\Windows\System\HqKNAtu.exe
  2⤵
  PID:8500
- C:\Windows\System\tcVuhZw.exe
  C:\Windows\System\tcVuhZw.exe
  2⤵
  PID:8516
- C:\Windows\System\SgUpqHg.exe
  C:\Windows\System\SgUpqHg.exe
  2⤵
  PID:8532
- C:\Windows\System\SWlNSXV.exe
  C:\Windows\System\SWlNSXV.exe
  2⤵
  PID:8548
- C:\Windows\System\bpJVZFz.exe
  C:\Windows\System\bpJVZFz.exe
  2⤵
  PID:8564
- C:\Windows\System\ESrWwUp.exe
  C:\Windows\System\ESrWwUp.exe
  2⤵
  PID:8580
- C:\Windows\System\pZnmUPJ.exe
  C:\Windows\System\pZnmUPJ.exe
  2⤵
  PID:8600
- C:\Windows\System\pkYywgh.exe
  C:\Windows\System\pkYywgh.exe
  2⤵
  PID:8624
- C:\Windows\System\WEcRKUV.exe
  C:\Windows\System\WEcRKUV.exe
  2⤵
  PID:8640
- C:\Windows\System\CLIwgeg.exe
  C:\Windows\System\CLIwgeg.exe
  2⤵
  PID:8660
- C:\Windows\System\fgQJBSC.exe
  C:\Windows\System\fgQJBSC.exe
  2⤵
  PID:8680
- C:\Windows\System\GwcDIqa.exe
  C:\Windows\System\GwcDIqa.exe
  2⤵
  PID:8696
- C:\Windows\System\udIFkYP.exe
  C:\Windows\System\udIFkYP.exe
  2⤵
  PID:8716
- C:\Windows\System\sZwUZKN.exe
  C:\Windows\System\sZwUZKN.exe
  2⤵
  PID:8740
- C:\Windows\System\tDQDtpq.exe
  C:\Windows\System\tDQDtpq.exe
  2⤵
  PID:8756
- C:\Windows\System\lbqFyeY.exe
  C:\Windows\System\lbqFyeY.exe
  2⤵
  PID:8772
- C:\Windows\System\GfzFYFa.exe
  C:\Windows\System\GfzFYFa.exe
  2⤵
  PID:8808
- C:\Windows\System\tXHUGfa.exe
  C:\Windows\System\tXHUGfa.exe
  2⤵
  PID:8836
- C:\Windows\System\OsTVOYo.exe
  C:\Windows\System\OsTVOYo.exe
  2⤵
  PID:8852
- C:\Windows\System\hXNnyTl.exe
  C:\Windows\System\hXNnyTl.exe
  2⤵
  PID:8868
- C:\Windows\System\wBidKUy.exe
  C:\Windows\System\wBidKUy.exe
  2⤵
  PID:8884
- C:\Windows\System\bkBpdii.exe
  C:\Windows\System\bkBpdii.exe
  2⤵
  PID:8900
- C:\Windows\System\clCpFEj.exe
  C:\Windows\System\clCpFEj.exe
  2⤵
  PID:8916
- C:\Windows\System\vnvqzWp.exe
  C:\Windows\System\vnvqzWp.exe
  2⤵
  PID:8932
- C:\Windows\System\DDBsDGx.exe
  C:\Windows\System\DDBsDGx.exe
  2⤵
  PID:8948
- C:\Windows\System\DNgzjpq.exe
  C:\Windows\System\DNgzjpq.exe
  2⤵
  PID:8976
- C:\Windows\System\btitbUX.exe
  C:\Windows\System\btitbUX.exe
  2⤵
  PID:8992
- C:\Windows\System\nygzwDx.exe
  C:\Windows\System\nygzwDx.exe
  2⤵
  PID:9008
- C:\Windows\System\TsNYrGY.exe
  C:\Windows\System\TsNYrGY.exe
  2⤵
  PID:9024
- C:\Windows\System\pgAfcmD.exe
  C:\Windows\System\pgAfcmD.exe
  2⤵
  PID:9048
- C:\Windows\System\aRNzmdW.exe
  C:\Windows\System\aRNzmdW.exe
  2⤵
  PID:9064
- C:\Windows\System\fLgWftu.exe
  C:\Windows\System\fLgWftu.exe
  2⤵
  PID:9080
- C:\Windows\System\ATgrgsj.exe
  C:\Windows\System\ATgrgsj.exe
  2⤵
  PID:9096
- C:\Windows\System\ICcsNYF.exe
  C:\Windows\System\ICcsNYF.exe
  2⤵
  PID:9112
- C:\Windows\System\KUjmIqU.exe
  C:\Windows\System\KUjmIqU.exe
  2⤵
  PID:9128
- C:\Windows\System\CqmKBap.exe
  C:\Windows\System\CqmKBap.exe
  2⤵
  PID:9144
- C:\Windows\System\bIIVIRt.exe
  C:\Windows\System\bIIVIRt.exe
  2⤵
  PID:9164
- C:\Windows\System\oYBlFXm.exe
  C:\Windows\System\oYBlFXm.exe
  2⤵
  PID:9180
- C:\Windows\System\zarxqfV.exe
  C:\Windows\System\zarxqfV.exe
  2⤵
  PID:9200
- C:\Windows\System\sXnrFAm.exe
  C:\Windows\System\sXnrFAm.exe
  2⤵
  PID:8276
- C:\Windows\System\RKljDhB.exe
  C:\Windows\System\RKljDhB.exe
  2⤵
  PID:8260
- C:\Windows\System\PUCtbYd.exe
  C:\Windows\System\PUCtbYd.exe
  2⤵
  PID:7640
- C:\Windows\System\WVGGjxW.exe
  C:\Windows\System\WVGGjxW.exe
  2⤵
  PID:8288
- C:\Windows\System\jbMHnfd.exe
  C:\Windows\System\jbMHnfd.exe
  2⤵
  PID:8204
- C:\Windows\System\SMyOnky.exe
  C:\Windows\System\SMyOnky.exe
  2⤵
  PID:8324
- C:\Windows\System\wvTiGzm.exe
  C:\Windows\System\wvTiGzm.exe
  2⤵
  PID:8308
- C:\Windows\System\LyJrGxT.exe
  C:\Windows\System\LyJrGxT.exe
  2⤵
  PID:8424
- C:\Windows\System\FWNbkCf.exe
  C:\Windows\System\FWNbkCf.exe
  2⤵
  PID:8428
- C:\Windows\System\rrsTenP.exe
  C:\Windows\System\rrsTenP.exe
  2⤵
  PID:8448
- C:\Windows\System\ylwoHHu.exe
  C:\Windows\System\ylwoHHu.exe
  2⤵
  PID:8476
- C:\Windows\System\yyfpVGM.exe
  C:\Windows\System\yyfpVGM.exe
  2⤵
  PID:8540
- C:\Windows\System\zHuEhwu.exe
  C:\Windows\System\zHuEhwu.exe
  2⤵
  PID:8560
- C:\Windows\System\QciSzRd.exe
  C:\Windows\System\QciSzRd.exe
  2⤵
  PID:8576
- C:\Windows\System\EtSbBFu.exe
  C:\Windows\System\EtSbBFu.exe
  2⤵
  PID:8648
- C:\Windows\System\sxYLbFR.exe
  C:\Windows\System\sxYLbFR.exe
  2⤵
  PID:8632
- C:\Windows\System\NbaaBsa.exe
  C:\Windows\System\NbaaBsa.exe
  2⤵
  PID:8672
- C:\Windows\System\reGgoqN.exe
  C:\Windows\System\reGgoqN.exe
  2⤵
  PID:8748
- C:\Windows\System\jAiJvvf.exe
  C:\Windows\System\jAiJvvf.exe
  2⤵
  PID:8688
- C:\Windows\System\CpITzfs.exe
  C:\Windows\System\CpITzfs.exe
  2⤵
  PID:8764
- C:\Windows\System\VDIqOTY.exe
  C:\Windows\System\VDIqOTY.exe
  2⤵
  PID:8728
- C:\Windows\System\uACLTIb.exe
  C:\Windows\System\uACLTIb.exe
  2⤵
  PID:8784
- C:\Windows\System\RSYdOUC.exe
  C:\Windows\System\RSYdOUC.exe
  2⤵
  PID:8960
- C:\Windows\System\kYAuWSa.exe
  C:\Windows\System\kYAuWSa.exe
  2⤵
  PID:8892
- C:\Windows\System\bZsSHCS.exe
  C:\Windows\System\bZsSHCS.exe
  2⤵
  PID:8928
- C:\Windows\System\eXUVycY.exe
  C:\Windows\System\eXUVycY.exe
  2⤵
  PID:8988
- C:\Windows\System\eiWgQSx.exe
  C:\Windows\System\eiWgQSx.exe
  2⤵
  PID:8912
- C:\Windows\System\URRdMaP.exe
  C:\Windows\System\URRdMaP.exe
  2⤵
  PID:9060
- C:\Windows\System\EOWpXTJ.exe
  C:\Windows\System\EOWpXTJ.exe
  2⤵
  PID:8132
- C:\Windows\System\QsOIDEq.exe
  C:\Windows\System\QsOIDEq.exe
  2⤵
  PID:9120
- C:\Windows\System\yluvdDm.exe
  C:\Windows\System\yluvdDm.exe
  2⤵
  PID:9072
- C:\Windows\System\QVgClXD.exe
  C:\Windows\System\QVgClXD.exe
  2⤵
  PID:9104
- C:\Windows\System\oroVSvJ.exe
  C:\Windows\System\oroVSvJ.exe
  2⤵
  PID:9156
- C:\Windows\System\zHeNkVW.exe
  C:\Windows\System\zHeNkVW.exe
  2⤵
  PID:7908
- C:\Windows\System\PnPdezo.exe
  C:\Windows\System\PnPdezo.exe
  2⤵
  PID:8272
- C:\Windows\System\HsygrKt.exe
  C:\Windows\System\HsygrKt.exe
  2⤵
  PID:8396
- C:\Windows\System\kVhCWtz.exe
  C:\Windows\System\kVhCWtz.exe
  2⤵
  PID:8340
- C:\Windows\System\bNAZtBe.exe
  C:\Windows\System\bNAZtBe.exe
  2⤵
  PID:9212
- C:\Windows\System\HhlhWbo.exe
  C:\Windows\System\HhlhWbo.exe
  2⤵
  PID:8360
- C:\Windows\System\IPDtzqC.exe
  C:\Windows\System\IPDtzqC.exe
  2⤵
  PID:8524
- C:\Windows\System\ozZQdvW.exe
  C:\Windows\System\ozZQdvW.exe
  2⤵
  PID:8572
- C:\Windows\System\DweWFqN.exe
  C:\Windows\System\DweWFqN.exe
  2⤵
  PID:8668
- C:\Windows\System\wffxtek.exe
  C:\Windows\System\wffxtek.exe
  2⤵
  PID:8712
- C:\Windows\System\lzTWdHK.exe
  C:\Windows\System\lzTWdHK.exe
  2⤵
  PID:8732
- C:\Windows\System\IxweIUE.exe
  C:\Windows\System\IxweIUE.exe
  2⤵
  PID:8792
- C:\Windows\System\rWaavTg.exe
  C:\Windows\System\rWaavTg.exe
  2⤵
  PID:8864
- C:\Windows\System\szhjirA.exe
  C:\Windows\System\szhjirA.exe
  2⤵
  PID:8844
- C:\Windows\System\nmlyREz.exe
  C:\Windows\System\nmlyREz.exe
  2⤵
  PID:9056
- C:\Windows\System\NgsUImW.exe
  C:\Windows\System\NgsUImW.exe
  2⤵
  PID:8460
- C:\Windows\System\srUVODD.exe
  C:\Windows\System\srUVODD.exe
  2⤵
  PID:8080
- C:\Windows\System\lZdABNw.exe
  C:\Windows\System\lZdABNw.exe
  2⤵
  PID:8356
- C:\Windows\System\UUJomql.exe
  C:\Windows\System\UUJomql.exe
  2⤵
  PID:9208
- C:\Windows\System\REnEXhr.exe
  C:\Windows\System\REnEXhr.exe
  2⤵
  PID:8724
- C:\Windows\System\oTZXAkQ.exe
  C:\Windows\System\oTZXAkQ.exe
  2⤵
  PID:9092
- C:\Windows\System\lpWpVjQ.exe
  C:\Windows\System\lpWpVjQ.exe
  2⤵
  PID:9192
- C:\Windows\System\rFjRAZu.exe
  C:\Windows\System\rFjRAZu.exe
  2⤵
  PID:8492
- C:\Windows\System\gECPhmo.exe
  C:\Windows\System\gECPhmo.exe
  2⤵
  PID:8860
- C:\Windows\System\KWoueGs.exe
  C:\Windows\System\KWoueGs.exe
  2⤵
  PID:9036
- C:\Windows\System\przKCFu.exe
  C:\Windows\System\przKCFu.exe
  2⤵
  PID:8444
- C:\Windows\System\UZXKqif.exe
  C:\Windows\System\UZXKqif.exe
  2⤵
  PID:8208
- C:\Windows\System\AkNoSeg.exe
  C:\Windows\System\AkNoSeg.exe
  2⤵
  PID:8408
- C:\Windows\System\iRVJlme.exe
  C:\Windows\System\iRVJlme.exe
  2⤵
  PID:8816
- C:\Windows\System\euGpjNq.exe
  C:\Windows\System\euGpjNq.exe
  2⤵
  PID:8924
- C:\Windows\System\jqcVsUo.exe
  C:\Windows\System\jqcVsUo.exe
  2⤵
  PID:9152
- C:\Windows\System\ECeiMAq.exe
  C:\Windows\System\ECeiMAq.exe
  2⤵
  PID:8956
- C:\Windows\System\vhSskMD.exe
  C:\Windows\System\vhSskMD.exe
  2⤵
  PID:8828
- C:\Windows\System\SdGIQcn.exe
  C:\Windows\System\SdGIQcn.exe
  2⤵
  PID:8256
- C:\Windows\System\VrQiACA.exe
  C:\Windows\System\VrQiACA.exe
  2⤵
  PID:7856
- C:\Windows\System\qtBrADy.exe
  C:\Windows\System\qtBrADy.exe
  2⤵
  PID:8676
- C:\Windows\System\vIJCdeF.exe
  C:\Windows\System\vIJCdeF.exe
  2⤵
  PID:8608
- C:\Windows\System\hHcTtZe.exe
  C:\Windows\System\hHcTtZe.exe
  2⤵
  PID:8612
- C:\Windows\System\RVpvlFO.exe
  C:\Windows\System\RVpvlFO.exe
  2⤵
  PID:8908
- C:\Windows\System\OGdQvpP.exe
  C:\Windows\System\OGdQvpP.exe
  2⤵
  PID:8636
- C:\Windows\System\DiVCYMI.exe
  C:\Windows\System\DiVCYMI.exe
  2⤵
  PID:8240
- C:\Windows\System\npUZrSA.exe
  C:\Windows\System\npUZrSA.exe
  2⤵
  PID:9224
- C:\Windows\System\lrdCWBW.exe
  C:\Windows\System\lrdCWBW.exe
  2⤵
  PID:9240
- C:\Windows\System\NwvxPkT.exe
  C:\Windows\System\NwvxPkT.exe
  2⤵
  PID:9256
- C:\Windows\System\lCvwTed.exe
  C:\Windows\System\lCvwTed.exe
  2⤵
  PID:9272
- C:\Windows\System\pXsUaxu.exe
  C:\Windows\System\pXsUaxu.exe
  2⤵
  PID:9288
- C:\Windows\System\AHqxSxt.exe
  C:\Windows\System\AHqxSxt.exe
  2⤵
  PID:9304
- C:\Windows\System\HvBXbMr.exe
  C:\Windows\System\HvBXbMr.exe
  2⤵
  PID:9320
- C:\Windows\System\NWIWNxg.exe
  C:\Windows\System\NWIWNxg.exe
  2⤵
  PID:9336
- C:\Windows\System\zmvchNX.exe
  C:\Windows\System\zmvchNX.exe
  2⤵
  PID:9352
- C:\Windows\System\geYDcCH.exe
  C:\Windows\System\geYDcCH.exe
  2⤵
  PID:9368
- C:\Windows\System\MuKfTjC.exe
  C:\Windows\System\MuKfTjC.exe
  2⤵
  PID:9384
- C:\Windows\System\iGpaxvu.exe
  C:\Windows\System\iGpaxvu.exe
  2⤵
  PID:9400
- C:\Windows\System\lPmLuqL.exe
  C:\Windows\System\lPmLuqL.exe
  2⤵
  PID:9416
- C:\Windows\System\IelWkhV.exe
  C:\Windows\System\IelWkhV.exe
  2⤵
  PID:9432
- C:\Windows\System\uzbttxW.exe
  C:\Windows\System\uzbttxW.exe
  2⤵
  PID:9448
- C:\Windows\System\fUbKwpQ.exe
  C:\Windows\System\fUbKwpQ.exe
  2⤵
  PID:9464
- C:\Windows\System\zqMBCUS.exe
  C:\Windows\System\zqMBCUS.exe
  2⤵
  PID:9480
- C:\Windows\System\bFkRESm.exe
  C:\Windows\System\bFkRESm.exe
  2⤵
  PID:9496
- C:\Windows\System\JGHLImC.exe
  C:\Windows\System\JGHLImC.exe
  2⤵
  PID:9512
- C:\Windows\System\tqcqAyg.exe
  C:\Windows\System\tqcqAyg.exe
  2⤵
  PID:9528
- C:\Windows\System\IJVqbkV.exe
  C:\Windows\System\IJVqbkV.exe
  2⤵
  PID:9544
- C:\Windows\System\OJGKxRP.exe
  C:\Windows\System\OJGKxRP.exe
  2⤵
  PID:9564
- C:\Windows\System\vsmqGqN.exe
  C:\Windows\System\vsmqGqN.exe
  2⤵
  PID:9580
- C:\Windows\System\GuXnPNd.exe
  C:\Windows\System\GuXnPNd.exe
  2⤵
  PID:9596
- C:\Windows\System\VWpZOJD.exe
  C:\Windows\System\VWpZOJD.exe
  2⤵
  PID:9616
- C:\Windows\System\UKNqDud.exe
  C:\Windows\System\UKNqDud.exe
  2⤵
  PID:9632
- C:\Windows\System\tPSLSOQ.exe
  C:\Windows\System\tPSLSOQ.exe
  2⤵
  PID:9648
- C:\Windows\System\FUmJhKM.exe
  C:\Windows\System\FUmJhKM.exe
  2⤵
  PID:9664
- C:\Windows\System\ymSWPiU.exe
  C:\Windows\System\ymSWPiU.exe
  2⤵
  PID:9680
- C:\Windows\System\FDpLKpP.exe
  C:\Windows\System\FDpLKpP.exe
  2⤵
  PID:9696
- C:\Windows\System\jlBHoIF.exe
  C:\Windows\System\jlBHoIF.exe
  2⤵
  PID:9712
- C:\Windows\System\XJcPSRB.exe
  C:\Windows\System\XJcPSRB.exe
  2⤵
  PID:9728
- C:\Windows\System\tOahSYW.exe
  C:\Windows\System\tOahSYW.exe
  2⤵
  PID:9744
- C:\Windows\System\tPZavek.exe
  C:\Windows\System\tPZavek.exe
  2⤵
  PID:9760
- C:\Windows\System\SnXZDTj.exe
  C:\Windows\System\SnXZDTj.exe
  2⤵
  PID:9776
- C:\Windows\System\WhQNmiL.exe
  C:\Windows\System\WhQNmiL.exe
  2⤵
  PID:9792
- C:\Windows\System\YXHejPG.exe
  C:\Windows\System\YXHejPG.exe
  2⤵
  PID:9808
- C:\Windows\System\ArDwmeo.exe
  C:\Windows\System\ArDwmeo.exe
  2⤵
  PID:9824
- C:\Windows\System\oQKMsPb.exe
  C:\Windows\System\oQKMsPb.exe
  2⤵
  PID:9840
- C:\Windows\System\qbSsVDr.exe
  C:\Windows\System\qbSsVDr.exe
  2⤵
  PID:9856
- C:\Windows\System\iDEsSJS.exe
  C:\Windows\System\iDEsSJS.exe
  2⤵
  PID:9872
- C:\Windows\System\smOResu.exe
  C:\Windows\System\smOResu.exe
  2⤵
  PID:9888
- C:\Windows\System\dvAOayq.exe
  C:\Windows\System\dvAOayq.exe
  2⤵
  PID:9908
- C:\Windows\System\VFfdvHD.exe
  C:\Windows\System\VFfdvHD.exe
  2⤵
  PID:9924
- C:\Windows\System\TWIrnxq.exe
  C:\Windows\System\TWIrnxq.exe
  2⤵
  PID:9940
- C:\Windows\System\LuJnaff.exe
  C:\Windows\System\LuJnaff.exe
  2⤵
  PID:9956
- C:\Windows\System\JDSDyLn.exe
  C:\Windows\System\JDSDyLn.exe
  2⤵
  PID:9972
- C:\Windows\System\CmMCBCT.exe
  C:\Windows\System\CmMCBCT.exe
  2⤵
  PID:9988
- C:\Windows\System\bWgPdbm.exe
  C:\Windows\System\bWgPdbm.exe
  2⤵
  PID:10004
- C:\Windows\System\THhhASR.exe
  C:\Windows\System\THhhASR.exe
  2⤵
  PID:10020
- C:\Windows\System\YTcQAnc.exe
  C:\Windows\System\YTcQAnc.exe
  2⤵
  PID:10036
- C:\Windows\System\hvkkBSW.exe
  C:\Windows\System\hvkkBSW.exe
  2⤵
  PID:10052
- C:\Windows\System\LTPGCNj.exe
  C:\Windows\System\LTPGCNj.exe
  2⤵
  PID:10068
- C:\Windows\System\hWBmDTR.exe
  C:\Windows\System\hWBmDTR.exe
  2⤵
  PID:10084
- C:\Windows\System\bybDVPl.exe
  C:\Windows\System\bybDVPl.exe
  2⤵
  PID:10100
- C:\Windows\System\ooHGlpz.exe
  C:\Windows\System\ooHGlpz.exe
  2⤵
  PID:10116
- C:\Windows\System\WtAOYQd.exe
  C:\Windows\System\WtAOYQd.exe
  2⤵
  PID:10132
- C:\Windows\System\EWEmgUN.exe
  C:\Windows\System\EWEmgUN.exe
  2⤵
  PID:10148
- C:\Windows\System\YyCBxmV.exe
  C:\Windows\System\YyCBxmV.exe
  2⤵
  PID:10164
- C:\Windows\System\BGypCXT.exe
  C:\Windows\System\BGypCXT.exe
  2⤵
  PID:10180
- C:\Windows\System\BUMZBpf.exe
  C:\Windows\System\BUMZBpf.exe
  2⤵
  PID:10196
- C:\Windows\System\KXJcAwh.exe
  C:\Windows\System\KXJcAwh.exe
  2⤵
  PID:10212
- C:\Windows\System\jJiIIET.exe
  C:\Windows\System\jJiIIET.exe
  2⤵
  PID:10228
- C:\Windows\System\OaBqeyD.exe
  C:\Windows\System\OaBqeyD.exe
  2⤵
  PID:9236
- C:\Windows\System\fmtoWFp.exe
  C:\Windows\System\fmtoWFp.exe
  2⤵
  PID:9264
- C:\Windows\System\SGpChAL.exe
  C:\Windows\System\SGpChAL.exe
  2⤵
  PID:9280
- C:\Windows\System\SorfCmN.exe
  C:\Windows\System\SorfCmN.exe
  2⤵
  PID:9360
- C:\Windows\System\SqxqNrS.exe
  C:\Windows\System\SqxqNrS.exe
  2⤵
  PID:9396
- C:\Windows\System\UscVEMU.exe
  C:\Windows\System\UscVEMU.exe
  2⤵
  PID:9316
- C:\Windows\System\GYIflMM.exe
  C:\Windows\System\GYIflMM.exe
  2⤵
  PID:9456
- C:\Windows\System\GqrTMlH.exe
  C:\Windows\System\GqrTMlH.exe
  2⤵
  PID:9408
- C:\Windows\System\teCxOFd.exe
  C:\Windows\System\teCxOFd.exe
  2⤵
  PID:9488
- C:\Windows\System\vxDedbT.exe
  C:\Windows\System\vxDedbT.exe
  2⤵
  PID:9524
- C:\Windows\System\kldzEqi.exe
  C:\Windows\System\kldzEqi.exe
  2⤵
  PID:9560
- C:\Windows\System\aAvyVUu.exe
  C:\Windows\System\aAvyVUu.exe
  2⤵
  PID:9588
- C:\Windows\System\gXSISZZ.exe
  C:\Windows\System\gXSISZZ.exe
  2⤵
  PID:9576
- C:\Windows\System\xczGGBi.exe
  C:\Windows\System\xczGGBi.exe
  2⤵
  PID:9628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DSUTzjQ.exe

Filesize
1.9MB

MD5
0b975581bae5ee114b423832f085d322

SHA1
8c04966ad75fb89e8d55749085874ee605b1e6b6

SHA256
9815ca6b2e65526dd78c580653b6bf6e08c222ec577021cb889b559c24ca1bec

SHA512
4ecfb79913ea55df5ca9671ff3746e5e32445a7a000b1d7b6d39e96f6237b56ad073144e3f0aa7875ce31ad04c2bc15eb0a42aa02133e130dd5119229c9dd3a7

Download Submit
C:\Windows\system\ETKGWLN.exe

Filesize
1.9MB

MD5
0c62662bcd15c5d6b1176b1a97a2e5de

SHA1
5b7c5ba067c80d0b666930426a56371a7744a7fa

SHA256
b304ec2b1dcdad561f8bcf8268ed39bcfbe9de19ba0218c96cbc9448e9ada008

SHA512
d49438cf5b016fe4cc2c6cbf2686cb1bfce2db3fd2590e4ac2b3994ee3fb9a94d5633f8a71fa6f4435c7ed4ea1c589a2d33a60e5e827e82a2c63e128e55440ef

Download Submit
C:\Windows\system\FrdxJQD.exe

Filesize
1.9MB

MD5
6d401df1c9603a10e248ad5cc11a18e3

SHA1
56e26cadc60cf80df3d90ed160ba6d7a5fdd6606

SHA256
59cc2a3661175de291aa9e5116a94ea57f2783afe41e2c3d7cb2e85365196e2a

SHA512
7bd2a830653eb23240cbedcbed2e2a73185b01e550ae6ed1626a861da6bc096cff844a2650720568390bbf8ad4a1a5c511084f59c9e61869e89543e034196a72

Download Submit
C:\Windows\system\HuwGDGc.exe

Filesize
1.9MB

MD5
5f2a6ee26dd543d009986b5d1305adc5

SHA1
521845bcdba25b4032dbfb0e9d7fa49e091e83f5

SHA256
24aa6bbb4b90d0d31938d02a6349622404c4a232dc1763de5d2b06c03bcace0d

SHA512
cf43234d38dd9c62f51e1ec1d0bd8e5402f3cd4853c55f403af705fc9b2919415d96e13bd39dc3839741cae02ac72cf3401b1e2957de1c13b42d7e69b2ed28c3

Download Submit
C:\Windows\system\LUcywWM.exe

Filesize
1.9MB

MD5
cfd3ecfd3bf086b4e41885da16fbe1d8

SHA1
0cbd5c561f1c0d7a229359b8ba72417534715bc0

SHA256
d6d06a188d860dab3398abdd280fbc2291847ff302e30bd7c3df7436d6e69292

SHA512
b094fb24203e1de4c22e5c4b86c1cd14233a97535ef5ea1e94a468fe5c722d2780398be1da2ab40664342f119b417c3150799bd7c52f494aa0ef7bf70bf05318

Download Submit
C:\Windows\system\MuvufVh.exe

Filesize
1.9MB

MD5
87c5b7d718f13396dba58290498e3ff1

SHA1
0b67e06813484b5bf25d1e507eac435c6ec87e32

SHA256
0fb353c54df2227154b7dda05fd43ec4ccb50b758408e02f4019c6130d0c9c09

SHA512
f5480cf04ab719974a09496090ebaa51be910376902eaa80a1b8e487a647d812bfc081d0d9eebd636f4132504cd350b4e964bc1c69ff6e06df4607b55e270a33

Download Submit
C:\Windows\system\PtkNIqj.exe

Filesize
1.9MB

MD5
56dde4c68e57fe55001b6d1670809dd3

SHA1
132bfdd3a58d7d1f4507e3a0f1f27fd5bb4650b0

SHA256
ebd7bc5ace83cdeddf10cee95a925f3c5884c9dd3c9460f8a66c51cf2bb88e28

SHA512
24eea313a7226377b6bdc5b4a44fdde87ddb0fd340c35c1855dfa96007fbd8a0fa5ec8dc50a3259abb6f57112257e30ac5956285af122fc0c9972e764271d2d8

Download Submit
C:\Windows\system\QAHWUna.exe

Filesize
1.9MB

MD5
914ccf33a5cca80e9a225c4ea7698908

SHA1
0ec09519fb91d06d5823e34ff4a3287e2eeeed4d

SHA256
5aac361a25e4773e7778402a048b7f194ddd286782e543aa95126c9f20a584d0

SHA512
5982ba4a94681070513a26f9f8bde6ea1dc7fed1fecbb40191f7f317a0e2c96ff6e06033c9a62cbb821bd9dd325d76aff71e52bc23c062760c925969b1d8abf9

Download Submit
C:\Windows\system\QHMzltl.exe

Filesize
1.9MB

MD5
d977741bd3e1bc23229580aef4f43532

SHA1
2cec0cf5b37c853f54ab3b7f42fffa8fae0c9573

SHA256
e437ddffad9741c0ea63b4bbd6fa1db1cc7fe730199b09d2d9120272fd297b8c

SHA512
d254fa61a896b87a45db6132cd81ac2493b1b223ed9024fa2deb0a323c6f3dfee1741d61f5dac594fc5e38a92586f566a879cfe3589c1a523a313e5850be4d18

Download Submit
C:\Windows\system\VYRMGYB.exe

Filesize
1.9MB

MD5
c7f3e12b94927795e2c1bbea12e53222

SHA1
608bdd968424f5123437e39dfe7f4713edbba866

SHA256
2a600e34a11e94dbbf02b8c5fb2975867a0ad99883dbc89cea428ba112a19433

SHA512
998131b25fa8cfedda814051c7c75ba4dac91c8948895f3dcab57c89e33f69eaf68c0f2d1d3429da808d721e6f131e5f1451e5038e760249faaf2f059109933b

Download Submit
C:\Windows\system\XsDTiFc.exe

Filesize
1.9MB

MD5
117e8cb35a6e0c91b824e2e6deef3bd2

SHA1
bae91500d46221d1ead7781e0ff057a5d2ecfe1a

SHA256
640761140a3725829e95794c9afe6067185011f2bf00ea73080bcbbc6733dab4

SHA512
5e2edcae507df8fcda5407e69e5e3ac3f6bf1df2f311fb3435077ba0ebd7e14b276d27602d63859867c22e72cc023228b51ced9f2597a07e8819e6543f1a5bf6

Download Submit
C:\Windows\system\YSRfOub.exe

Filesize
1.9MB

MD5
8a714907422b107dc116c2d8a1ae0ccb

SHA1
e1c23948ef43900cb66a8c07f218cf4b8c32bf2e

SHA256
cf384dd8e4b762c8d455c276079e6b93f3580315fcdba5a1fd0b0b5cfe49eb00

SHA512
bd610c191c3b7e14af252bddf6cc32a81f752264f09c49e4188d9ef4c5eb512c06ac475aa81114ed3aa721ca281073eaf76b3fd5f5fd5aeae789c8a499dd60e4

Download Submit
C:\Windows\system\ZloCUjE.exe

Filesize
1.9MB

MD5
a269012a72e2eefac2abb5ec11a2f761

SHA1
0508e0ed2e7ccd9f8ef39c5d4f7483e78f363617

SHA256
3730009fe412ad15baf5b1be39f9bba5e693059ef6850ddf841e9c1e8adad440

SHA512
ed5d082313a087dfedd8b2dc0706119c330b6d0f090dedfd27e71e4b74b8d159ab1254146cd8bcbfa2009f68460f56ba608148198ad75304df9da50134b9f077

Download Submit
C:\Windows\system\ZmloKoo.exe

Filesize
1.9MB

MD5
359bdb244b36a4bc826617caf3abc683

SHA1
f20a7a412412f20db79468bb322bf1e973930dcd

SHA256
263cdddca9be4cd41bd37d11af063c897d30472f50d47d203e72a71dc42f4f17

SHA512
5ce9e5726150399c925fc922dc65a6d24dcc3f6224285079c1aa0560cb860f65d895b2af19174ea789f9ff4818d6a98ed3971b8b31e3353bda5c55381853a050

Download Submit
C:\Windows\system\adafvKK.exe

Filesize
1.9MB

MD5
b1538b3524473b555cc8e466a36db621

SHA1
ca7364f6248c0994e855529a730b1dfe663daf4b

SHA256
dbe52e1e7ea801ad6f647624dcb8f20bca4bc49ec15e74ca91786a27f343102d

SHA512
a2132de5cd9193d227fc6b3ffe8168d2e6cb6cc29a374845cae70cebcaedd2e4a80f6044d6a29d04dd8372ae354046bb388d238c14dc5cb021762c3097880e2b

Download Submit
C:\Windows\system\cRQNNGF.exe

Filesize
1.9MB

MD5
1db0ce6fc3752de1108e3eaaeafd8332

SHA1
e45d8cff87fcbc9694b042da07da8ac3b72624e0

SHA256
23ab9308a75d371fedd11aa3a8f4b3c3af2fa3943981731ea49cac1cfd4de160

SHA512
6e8f6f5ea3742a2b4a5ee67f42fa3b45b7e14e2f8493f66d316cfc647270bfa5cd3ae5426035de837d8124f97ea0410e0af2c4c3c2fdf3e541d10fc4c5718502

Download Submit
C:\Windows\system\fnuxCEm.exe

Filesize
1.9MB

MD5
d5849860a79c373f1806de7e0352205e

SHA1
fb194182819d23a5f5bbd019ab151ecb91bee2c9

SHA256
b569020cbe0c3f5b8e5c2fc5dce766a412ddd7ebda301434f5757f7ff8d2f1ba

SHA512
45ca889cf093621280185d345cfd889cb13b4cbfab06309748e5bb2834d831cf86838ccf5a426af56827ea68994123a6501780b78ccc943d271ddffec72c4134

Download Submit
C:\Windows\system\hTJFqND.exe

Filesize
1.9MB

MD5
b244f35523d3bc00868e86a83e81ba73

SHA1
98aaeaba6e2c2138b08ab00c5b22282103caabdf

SHA256
7f3a008fee7c5e4ab7428eeb5c7e8616ade010f6f71ca5601c308534b7f801f0

SHA512
c8d9791373413e6f74804e3841138c89429c308240ddb791b23b1b147e6cf8592bc013e0bdabe08744b85a3d5bae79e1c079061355ec1bd2d2d0ea66f9d1ce55

Download Submit
C:\Windows\system\jyDaBnr.exe

Filesize
1.9MB

MD5
2557459172ead770753ea1aae4454604

SHA1
0cccc99d80b84bf0892780befe55314bcfce3839

SHA256
7818b8cdec1b43086a641a820f93aee55b2181078b7d21bbe4c8e4494938d561

SHA512
5b9891a23defedb0723d1d31c6516ce91b2f696f25d32dac056c75b9f80f0436b16ea46f7a3070ffd334d6ef11b4d0a8e3bd52e87b4bbd25388450f02d1453e1

Download Submit
C:\Windows\system\psfIXoV.exe

Filesize
1.9MB

MD5
0975504ff5a2b27816482e1f5dd4628d

SHA1
b24ff3eec302b45a48e76c72553dc4778128c7ba

SHA256
1a8438b5b99ff0f3d24bccd017465f6737591ceae62181f64047415f7f4527cd

SHA512
4ebda1b38ad268a97f30a99f5485b187c3a22d507fea7ffe5130d7e6daf9dc3d9359f782ea41f3670475213e6e211e7850a511a47a9564bb3385222d43695861

Download Submit
C:\Windows\system\qjGAoPK.exe

Filesize
1.9MB

MD5
7b8de6564d7cb092f80b527bc13f1357

SHA1
33ad25e32289c65ef6188f6316266988f1495a94

SHA256
435343cac6e70edab4d75a376aa32cccf3d48a5d2127397c22fd64f80fd5c71a

SHA512
c11e23554f8815dda97ed773f5fdf9442aed0da160d299fa960f4b4e0644d4d1cd12f0eeb9b731df0c8452c727b1e3cdf0a5be26b4c0ece1bf886e32cf6f8a09

Download Submit
C:\Windows\system\qnxHEGS.exe

Filesize
1.9MB

MD5
ff34b15f69f5400e9554e5647c38cf36

SHA1
2a5764cfc24fe992c3ced5bbb1653f766a5f9eb4

SHA256
9a110f1d1d22f0cfdd7d47049cfb4d922b680f1801be1a47e39d7135c308913a

SHA512
f11be59d62d0f36951c3cf7e6ed6fbf5e2a0f491a95ef859ad5266a9842058cb6385e7e058bdf833db5caf3a931c2f657fe22e39f2ab1ccecdb73f9ef038cbde

Download Submit
\Windows\system\BTAAfUU.exe

Filesize
1.9MB

MD5
501974d1d20a94ff84584811321cffc8

SHA1
9c60125a58a984df9c454feac832031827376cd0

SHA256
9e5acfb0b99aa428ddc4fc0221da3ef34579c3c7f605067b80585c3ef73fcc8f

SHA512
7643d80152833fc7aeb8dac9184174fb51df76d79b3f5c20b12699cfe54c871e8d6c1a4a3b8214658267d694dc1415c11431bfe30a80d5bfec95b3c1cf21f0bc

Download Submit
\Windows\system\JObNaBJ.exe

Filesize
1.9MB

MD5
80027124f23bd7b2ffbd056d69489223

SHA1
d7a7815c5a3a60fe3247f904033568a5c3e18fc7

SHA256
58722ac6a671c456477b94328a2906a97ac8fe57d545bc62069dec5fb3cc240e

SHA512
0926811a70792430e3292f14b28e23bd31c8a379aa4fe366c1ac7e46c31644157b46910652be9e97b19608d3652512521ac3e61661c61adda94b163a15b5e1ea

Download Submit
\Windows\system\PDoDJOe.exe

Filesize
1.9MB

MD5
76a975dd4d32e10fbbca39357e36c3ef

SHA1
493131e6cd0cfefe43def337c7670358ff513218

SHA256
17013116d103f42ba8ec53ec5d823cbcfa48cf6583365f5c70e606ee25597053

SHA512
05651cbd578b4938764267406dd52ca3e48e39c4a5b29b13f3c3a5021e4b850f56899fe948b63760fae28420b4ff020ec91ced42b54ccf6a532b19d0fce3d134

Download Submit
\Windows\system\SRpTsfz.exe

Filesize
1.9MB

MD5
2a27b6717f5b70bbaf4375e2cee8b6e3

SHA1
e7612668759b7c1c6c9329f0af2f0d1c066f896a

SHA256
55323d9a4298f19f1f38912604df6004f85c7faa4525ea154609178ae68eeb5c

SHA512
5754c90ef434ca389e26340770c5ac1d4ea987097ec0c49aaa05500c6c855204258f65db2b26ee02d4bcc2894f75c43d8dd5adb1690bc8c74c651636d5850cde

Download Submit
\Windows\system\TajQpkz.exe

Filesize
1.9MB

MD5
07a6b5551b5c8238d07be2c5e6f68749

SHA1
509346e5772c36d287953db29817a1e889a14c2a

SHA256
ddb768152ab38f136468ea2af7ffea333b347a3f72d35ee6bb29780528f262c0

SHA512
b383ed0daf977099fd74a4bbc593adc1d6d97e554c325f220ae12428664a8b8df6431a1ceaa5ace62c5e65c30d8bfba7ec1d50ae113925991133abff2da9d95b

Download Submit
\Windows\system\XarlXgm.exe

Filesize
1.9MB

MD5
936cd42442be0b216839d17f7743be9b

SHA1
8c6d50c0da2ed85520c63a3679cf4ea624627e0a

SHA256
81ddcabc35bbff80d344d404201c07e90b44e0914bee3fc5aa1db5499dcfe1d6

SHA512
3997fddced0412a6150e872b1c5bc532fd6d724b363df665d7dce571c37bdf816a765e50601799fbf7012d8a4645e5f34f9811977c3bf85a746bb7efe51240d9

Download Submit
\Windows\system\aBkLESN.exe

Filesize
1.9MB

MD5
496e18a10b208d62881c47e3b6ca777c

SHA1
38dcdcd216e19c0018ec57f08a1146b79e783ef4

SHA256
61d751a64b1b86b00ce6f3892371cb6e7a0c52115fdc8aa7e07b75483ef72f16

SHA512
664a567129565593ae0b0938c5a5e88d438f8121cabcfc010ac87346a0eb0529afd33be13da9c12277af09aab5560b169363cc3eadcd83f03eb1d60427b6e8a8

Download Submit
\Windows\system\fPvJqKI.exe

Filesize
1.9MB

MD5
b4fc04f8c0f18072fef7985674360dac

SHA1
586808554d660097d96e7ef3288b08d6436f4987

SHA256
44841252393aa8b63b1fb280c6f5c4856c5e7c9ad082ca92efac93aa5ea30b91

SHA512
642e3b4decd941f06957b457192bfbb119aea2606fb3aa10d601469d4baffba5d448b5fc2a7ea24af8d1cf6e6137a186735079d22495d0da45036ceaa78a9927

Download Submit
\Windows\system\qADQxAL.exe

Filesize
1.9MB

MD5
bafdcaf29b1772ffcc35c4b0a555beb5

SHA1
27e85af1b39b16c275c95c15ee55bb568bdb75e2

SHA256
eec867b9b53d56b9ff6ff893b1b0bae36b01ca9b7cf2c7caf379e52a797fb4f5

SHA512
92d89977de4527434304a4f5814c6b11a1a9cf492a916d1b0dce92a2770d0ae6c600930f0878c55a78c02fc9446c7263c8e3e3fd5bef953bd2bfcbc97f12723d

Download Submit
\Windows\system\rRgnxgV.exe

Filesize
1.9MB

MD5
63581da820981a0444e11507127c3534

SHA1
0f6e996fea37070a96c62c740e1fbcd2cd96c435

SHA256
729e07c4dd15cf31088715fb61016d08a3dcdbc4088dde852281261d49067ce9

SHA512
a50374dd3f57f4113c9bcd5e1b2383c7d4ab6861fe9969b944328fddd4062a34d3a1520822968631db5c1e94b404658b15d354986cb7e13c8737b2e0016a4073

Download Submit
memory/1076-78-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2396-83-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2396-2853-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2448-3070-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2448-36-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2476-3074-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-38-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2704-49-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-13-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2740-3075-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2976-3710-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2976-81-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/3012-22-0x00000000025F0000-0x0000000002670000-memory.dmp

Filesize
512KB

Download
memory/3012-18-0x000007FEF4F50000-0x000007FEF58ED000-memory.dmp

Filesize
9.6MB

Download
memory/3012-76-0x00000000025F0000-0x0000000002670000-memory.dmp

Filesize
512KB

Download
memory/3012-85-0x000007FEF4F50000-0x000007FEF58ED000-memory.dmp

Filesize
9.6MB

Download
memory/3012-52-0x00000000024E0000-0x00000000024E8000-memory.dmp

Filesize
32KB

Download
memory/3012-51-0x000000001B370000-0x000000001B652000-memory.dmp

Filesize
2.9MB

Download
memory/3012-32-0x00000000025F0000-0x0000000002670000-memory.dmp

Filesize
512KB

Download
memory/3048-39-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/3048-72-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/3048-227-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/3048-48-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/3048-35-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/3048-80-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/3048-79-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/3048-77-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/3048-12-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/3048-1-0x0000000000090000-0x00000000000A0000-memory.dmp

Filesize
64KB

Download
memory/3048-0-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/3048-40-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/3048-37-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/3060-34-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/3060-343-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download