xmrig | bf0eec6dc38b376a9b3b959b133630c92b0e806c65a08577a1de5d0b11be1a94

Analysis

max time kernel
34s
max time network
32s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
Size

2.8MB
MD5

03e90fe7bcb073d66e1cefc7f5da8dd4
SHA1

cedc8abfac389c44be8604289b065a08351b5bcb
SHA256

bf0eec6dc38b376a9b3b959b133630c92b0e806c65a08577a1de5d0b11be1a94
SHA512

7cc46219807b9a6a223944382a3eb0342040d49123789c5f5643a5aad098237f74ffa63388a581155277f0f9035e00f6d8aeca7e2f83e14f3ad902f595ea01e5
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5O1xsRH:NAB5

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 4 IoCs

miner

resource	yara_rule
behavioral1/memory/2248-321-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2604-76-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2580-53-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/2556-672-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2556	ciuTnvD.exe
1636	TkVoDJZ.exe
2680	NIWTATJ.exe
2176	TMxdASp.exe
2864	lmFRKhI.exe
2580	YOqaZly.exe
2740	dAInKNa.exe
2584	OeHFNKE.exe
2604	vLMycCm.exe
1540	KIOvApW.exe
2696	dLlsGCe.exe
2804	RRLyVOI.exe
2460	CUuKETj.exe
2524	LaoqZxW.exe
2800	laNnUjV.exe
1780	zVwceQv.exe
1412	ciOvEfh.exe
1312	ygQjcnE.exe
2832	ruOZdiX.exe
1248	EYyZrNZ.exe
2836	dTsjnwd.exe
2036	uErdDqL.exe
2820	kqwbLWf.exe
1800	XtMNVRD.exe
532	IktsVQH.exe
1032	yeXIjjZ.exe
292	hwGWhqD.exe
2816	CGUposx.exe
1172	fptwUqk.exe
1428	RZMNZee.exe
2100	ODwOWOq.exe
2128	gTdSJhN.exe
1212	THYRbIz.exe
752	FWSDMtN.exe
2112	rMVjhHM.exe
804	RLIkteV.exe
1136	cGvAzMO.exe
1568	dgtXaip.exe
2136	VNAaPGj.exe
2920	fbHIllw.exe
1968	OlTXZjq.exe
1424	NALHdRe.exe
1704	WPZysoT.exe
3048	xwcWyjh.exe
1624	kdRZxWs.exe
2328	XyvZpFj.exe
2728	PHBnpRK.exe
2472	wuoDoeE.exe
2380	xxSKYzK.exe
996	gbRRdSB.exe
1772	kSfdAPT.exe
1028	gvYKLEn.exe
2988	vYDjOgK.exe
2016	qlhEkYV.exe
1408	NgkUlzQ.exe
2660	BEnlaIr.exe
1288	rqeRWkA.exe
2140	vWlNCHC.exe
2884	UMXzQak.exe
2684	LcmqSVz.exe
2440	uziTbxX.exe
1880	DkfnFUN.exe
1676	sgadgwr.exe
3096	pyrlBvs.exe

Loads dropped DLL 64 IoCs

pid	Process
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2248-1-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/files/0x000900000001344f-10.dat	upx
behavioral1/files/0x002f00000001325f-11.dat	upx
behavioral1/memory/1636-14-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/memory/2556-13-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/files/0x0007000000012120-6.dat	upx
behavioral1/memory/2680-20-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx
behavioral1/files/0x0008000000013a15-27.dat	upx
behavioral1/files/0x0008000000013f4b-38.dat	upx
behavioral1/files/0x0008000000013a85-31.dat	upx
behavioral1/files/0x00060000000146a7-64.dat	upx
behavioral1/files/0x000600000001474b-71.dat	upx
behavioral1/files/0x00090000000134f5-21.dat	upx
behavioral1/files/0x0006000000014c0b-106.dat	upx
behavioral1/files/0x0007000000014fac-118.dat	upx
behavioral1/files/0x000600000001543a-135.dat	upx
behavioral1/memory/2248-321-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/files/0x0006000000015cca-186.dat	upx
behavioral1/files/0x0006000000015ca9-180.dat	upx
behavioral1/files/0x0006000000015c91-168.dat	upx
behavioral1/files/0x0006000000015bb5-163.dat	upx
behavioral1/files/0x0006000000015b72-158.dat	upx
behavioral1/files/0x0006000000015b37-153.dat	upx
behavioral1/files/0x0006000000015a15-148.dat	upx
behavioral1/files/0x00060000000155e8-143.dat	upx
behavioral1/files/0x00060000000150aa-130.dat	upx
behavioral1/files/0x000600000001523e-128.dat	upx
behavioral1/files/0x0006000000015077-124.dat	upx
behavioral1/files/0x00130000000054a8-114.dat	upx
behavioral1/files/0x000600000001475f-102.dat	upx
behavioral1/files/0x0006000000014730-99.dat	upx
behavioral1/files/0x00060000000145d4-92.dat	upx
behavioral1/files/0x0006000000014a29-88.dat	upx
behavioral1/memory/2604-76-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/files/0x000a000000013b02-63.dat	upx
behavioral1/memory/2584-61-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/memory/2740-60-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/files/0x0008000000013a65-59.dat	upx
behavioral1/memory/2580-53-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/memory/2864-52-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/memory/2176-49-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/1540-86-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/files/0x00060000000148af-84.dat	upx
behavioral1/files/0x0006000000015cc2-183.dat	upx
behavioral1/files/0x0006000000015c9b-173.dat	upx
behavioral1/memory/2556-672-0x000000013F290000-0x000000013F682000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zPFVkIS.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\OrLdzfu.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\ferIRXx.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\XkRKgJp.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\ymhmstG.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\QsZZJNb.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\SRSOera.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\zVwceQv.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\oHAksLS.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\tuglTxF.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\tNxFhrK.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\gIVzitF.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\nLKnavL.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\STyLuZf.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\VpPptoX.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\QywOlrG.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\VgIyKUw.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\oNAndsM.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\nyGbMRi.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\RYgyeNR.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\XUhvQqy.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\mwukYMQ.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\ogVtCtg.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\PodPzTi.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\WQYWIVQ.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\pPNGWsu.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\DrvCthf.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\irKsZwX.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\BKNCUym.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\aQPMlQE.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\Ymsgxyk.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\ASVsANX.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\mqrAKEy.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\qFTYMKi.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\KITaIvI.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\zUSehTR.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\dhAgnCc.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\MDIwVHL.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\tSTWGiq.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\npwuaPw.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\GSOTqaB.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\uErdDqL.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\XyvZpFj.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\pAniPPZ.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\uPwBanX.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\zdgMOWj.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\rQgBqgR.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\KpGDtdQ.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\ZwjCKXZ.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\vLMycCm.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\nCyCwcM.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\dbbNXOm.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\ENjgAbz.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\vCZthXr.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\hMYShDF.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\JOkoPcq.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\FNyMvIl.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\dgtXaip.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\wuoDoeE.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\RwTwDzH.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\iBjhTRj.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\jbUcqZq.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\OlJMbuz.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
File created	C:\Windows\System\CUuKETj.exe	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2772	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
Token: SeDebugPrivilege	2772	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2772	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	29
PID 2248 wrote to memory of 2772	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	29
PID 2248 wrote to memory of 2772	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	29
PID 2248 wrote to memory of 2556	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2556	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2556	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	30
PID 2248 wrote to memory of 1636	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	31
PID 2248 wrote to memory of 1636	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	31
PID 2248 wrote to memory of 1636	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	31
PID 2248 wrote to memory of 2680	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	32
PID 2248 wrote to memory of 2680	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	32
PID 2248 wrote to memory of 2680	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	32
PID 2248 wrote to memory of 2740	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	33
PID 2248 wrote to memory of 2740	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	33
PID 2248 wrote to memory of 2740	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	33
PID 2248 wrote to memory of 2176	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	34
PID 2248 wrote to memory of 2176	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	34
PID 2248 wrote to memory of 2176	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	34
PID 2248 wrote to memory of 2584	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	35
PID 2248 wrote to memory of 2584	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	35
PID 2248 wrote to memory of 2584	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	35
PID 2248 wrote to memory of 2864	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	36
PID 2248 wrote to memory of 2864	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	36
PID 2248 wrote to memory of 2864	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	36
PID 2248 wrote to memory of 2604	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	37
PID 2248 wrote to memory of 2604	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	37
PID 2248 wrote to memory of 2604	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	37
PID 2248 wrote to memory of 2580	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	38
PID 2248 wrote to memory of 2580	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	38
PID 2248 wrote to memory of 2580	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	38
PID 2248 wrote to memory of 2460	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	39
PID 2248 wrote to memory of 2460	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	39
PID 2248 wrote to memory of 2460	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	39
PID 2248 wrote to memory of 1540	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	40
PID 2248 wrote to memory of 1540	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	40
PID 2248 wrote to memory of 1540	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	40
PID 2248 wrote to memory of 2524	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	41
PID 2248 wrote to memory of 2524	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	41
PID 2248 wrote to memory of 2524	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	41
PID 2248 wrote to memory of 2696	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	42
PID 2248 wrote to memory of 2696	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	42
PID 2248 wrote to memory of 2696	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	42
PID 2248 wrote to memory of 2800	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	43
PID 2248 wrote to memory of 2800	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	43
PID 2248 wrote to memory of 2800	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	43
PID 2248 wrote to memory of 2804	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	44
PID 2248 wrote to memory of 2804	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	44
PID 2248 wrote to memory of 2804	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	44
PID 2248 wrote to memory of 1412	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	45
PID 2248 wrote to memory of 1412	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	45
PID 2248 wrote to memory of 1412	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	45
PID 2248 wrote to memory of 1780	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	46
PID 2248 wrote to memory of 1780	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	46
PID 2248 wrote to memory of 1780	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	46
PID 2248 wrote to memory of 1312	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	47
PID 2248 wrote to memory of 1312	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	47
PID 2248 wrote to memory of 1312	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	47
PID 2248 wrote to memory of 2832	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	48
PID 2248 wrote to memory of 2832	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	48
PID 2248 wrote to memory of 2832	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	48
PID 2248 wrote to memory of 1248	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	49
PID 2248 wrote to memory of 1248	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	49
PID 2248 wrote to memory of 1248	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	49
PID 2248 wrote to memory of 2836	2248	03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03e90fe7bcb073d66e1cefc7f5da8dd4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Windows\System\ciuTnvD.exe
  C:\Windows\System\ciuTnvD.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\TkVoDJZ.exe
  C:\Windows\System\TkVoDJZ.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\NIWTATJ.exe
  C:\Windows\System\NIWTATJ.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\dAInKNa.exe
  C:\Windows\System\dAInKNa.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\TMxdASp.exe
  C:\Windows\System\TMxdASp.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\OeHFNKE.exe
  C:\Windows\System\OeHFNKE.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\lmFRKhI.exe
  C:\Windows\System\lmFRKhI.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\vLMycCm.exe
  C:\Windows\System\vLMycCm.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\YOqaZly.exe
  C:\Windows\System\YOqaZly.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\CUuKETj.exe
  C:\Windows\System\CUuKETj.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\KIOvApW.exe
  C:\Windows\System\KIOvApW.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\LaoqZxW.exe
  C:\Windows\System\LaoqZxW.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\dLlsGCe.exe
  C:\Windows\System\dLlsGCe.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\laNnUjV.exe
  C:\Windows\System\laNnUjV.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\RRLyVOI.exe
  C:\Windows\System\RRLyVOI.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\ciOvEfh.exe
  C:\Windows\System\ciOvEfh.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\zVwceQv.exe
  C:\Windows\System\zVwceQv.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\ygQjcnE.exe
  C:\Windows\System\ygQjcnE.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\ruOZdiX.exe
  C:\Windows\System\ruOZdiX.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\EYyZrNZ.exe
  C:\Windows\System\EYyZrNZ.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\dTsjnwd.exe
  C:\Windows\System\dTsjnwd.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\kqwbLWf.exe
  C:\Windows\System\kqwbLWf.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\uErdDqL.exe
  C:\Windows\System\uErdDqL.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\XtMNVRD.exe
  C:\Windows\System\XtMNVRD.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\IktsVQH.exe
  C:\Windows\System\IktsVQH.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\yeXIjjZ.exe
  C:\Windows\System\yeXIjjZ.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\hwGWhqD.exe
  C:\Windows\System\hwGWhqD.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\CGUposx.exe
  C:\Windows\System\CGUposx.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\fptwUqk.exe
  C:\Windows\System\fptwUqk.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\RZMNZee.exe
  C:\Windows\System\RZMNZee.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\ODwOWOq.exe
  C:\Windows\System\ODwOWOq.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\CXRwejR.exe
  C:\Windows\System\CXRwejR.exe
  2⤵
  PID:492
- C:\Windows\System\gTdSJhN.exe
  C:\Windows\System\gTdSJhN.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\oXFszzd.exe
  C:\Windows\System\oXFszzd.exe
  2⤵
  PID:2904
- C:\Windows\System\THYRbIz.exe
  C:\Windows\System\THYRbIz.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\bxaOWsx.exe
  C:\Windows\System\bxaOWsx.exe
  2⤵
  PID:748
- C:\Windows\System\FWSDMtN.exe
  C:\Windows\System\FWSDMtN.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\lGnPvQa.exe
  C:\Windows\System\lGnPvQa.exe
  2⤵
  PID:1532
- C:\Windows\System\rMVjhHM.exe
  C:\Windows\System\rMVjhHM.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\zPFVkIS.exe
  C:\Windows\System\zPFVkIS.exe
  2⤵
  PID:1868
- C:\Windows\System\RLIkteV.exe
  C:\Windows\System\RLIkteV.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\dGrusCg.exe
  C:\Windows\System\dGrusCg.exe
  2⤵
  PID:892
- C:\Windows\System\cGvAzMO.exe
  C:\Windows\System\cGvAzMO.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\rLlzmEd.exe
  C:\Windows\System\rLlzmEd.exe
  2⤵
  PID:776
- C:\Windows\System\dgtXaip.exe
  C:\Windows\System\dgtXaip.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\eVbBJUi.exe
  C:\Windows\System\eVbBJUi.exe
  2⤵
  PID:2276
- C:\Windows\System\VNAaPGj.exe
  C:\Windows\System\VNAaPGj.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\uQmPFAw.exe
  C:\Windows\System\uQmPFAw.exe
  2⤵
  PID:564
- C:\Windows\System\fbHIllw.exe
  C:\Windows\System\fbHIllw.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\nCyCwcM.exe
  C:\Windows\System\nCyCwcM.exe
  2⤵
  PID:2060
- C:\Windows\System\OlTXZjq.exe
  C:\Windows\System\OlTXZjq.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\zedVNgP.exe
  C:\Windows\System\zedVNgP.exe
  2⤵
  PID:2260
- C:\Windows\System\NALHdRe.exe
  C:\Windows\System\NALHdRe.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\mRgidTO.exe
  C:\Windows\System\mRgidTO.exe
  2⤵
  PID:1588
- C:\Windows\System\WPZysoT.exe
  C:\Windows\System\WPZysoT.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\sUKTyqb.exe
  C:\Windows\System\sUKTyqb.exe
  2⤵
  PID:2244
- C:\Windows\System\xwcWyjh.exe
  C:\Windows\System\xwcWyjh.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\NNaprQK.exe
  C:\Windows\System\NNaprQK.exe
  2⤵
  PID:1516
- C:\Windows\System\kdRZxWs.exe
  C:\Windows\System\kdRZxWs.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\qrZFGtC.exe
  C:\Windows\System\qrZFGtC.exe
  2⤵
  PID:2216
- C:\Windows\System\XyvZpFj.exe
  C:\Windows\System\XyvZpFj.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\oUwdYzT.exe
  C:\Windows\System\oUwdYzT.exe
  2⤵
  PID:2464
- C:\Windows\System\PHBnpRK.exe
  C:\Windows\System\PHBnpRK.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\yflBlny.exe
  C:\Windows\System\yflBlny.exe
  2⤵
  PID:872
- C:\Windows\System\wuoDoeE.exe
  C:\Windows\System\wuoDoeE.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\WpKflUf.exe
  C:\Windows\System\WpKflUf.exe
  2⤵
  PID:2408
- C:\Windows\System\xxSKYzK.exe
  C:\Windows\System\xxSKYzK.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\mPJTEzl.exe
  C:\Windows\System\mPJTEzl.exe
  2⤵
  PID:2532
- C:\Windows\System\gbRRdSB.exe
  C:\Windows\System\gbRRdSB.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\ovodVik.exe
  C:\Windows\System\ovodVik.exe
  2⤵
  PID:2796
- C:\Windows\System\kSfdAPT.exe
  C:\Windows\System\kSfdAPT.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\GBgxVPC.exe
  C:\Windows\System\GBgxVPC.exe
  2⤵
  PID:1536
- C:\Windows\System\gvYKLEn.exe
  C:\Windows\System\gvYKLEn.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\GIydKBG.exe
  C:\Windows\System\GIydKBG.exe
  2⤵
  PID:2364
- C:\Windows\System\vYDjOgK.exe
  C:\Windows\System\vYDjOgK.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\WxoCYbX.exe
  C:\Windows\System\WxoCYbX.exe
  2⤵
  PID:1020
- C:\Windows\System\qlhEkYV.exe
  C:\Windows\System\qlhEkYV.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\xSrXzqI.exe
  C:\Windows\System\xSrXzqI.exe
  2⤵
  PID:2840
- C:\Windows\System\NgkUlzQ.exe
  C:\Windows\System\NgkUlzQ.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\zipRlda.exe
  C:\Windows\System\zipRlda.exe
  2⤵
  PID:2844
- C:\Windows\System\BEnlaIr.exe
  C:\Windows\System\BEnlaIr.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\YBKQwVX.exe
  C:\Windows\System\YBKQwVX.exe
  2⤵
  PID:2376
- C:\Windows\System\rqeRWkA.exe
  C:\Windows\System\rqeRWkA.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\RHijBaI.exe
  C:\Windows\System\RHijBaI.exe
  2⤵
  PID:1672
- C:\Windows\System\vWlNCHC.exe
  C:\Windows\System\vWlNCHC.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\bgiDCSt.exe
  C:\Windows\System\bgiDCSt.exe
  2⤵
  PID:2208
- C:\Windows\System\UMXzQak.exe
  C:\Windows\System\UMXzQak.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\VrmXIqt.exe
  C:\Windows\System\VrmXIqt.exe
  2⤵
  PID:3064
- C:\Windows\System\LcmqSVz.exe
  C:\Windows\System\LcmqSVz.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\RQmsMaz.exe
  C:\Windows\System\RQmsMaz.exe
  2⤵
  PID:2192
- C:\Windows\System\uziTbxX.exe
  C:\Windows\System\uziTbxX.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\oVWVeUI.exe
  C:\Windows\System\oVWVeUI.exe
  2⤵
  PID:1204
- C:\Windows\System\DkfnFUN.exe
  C:\Windows\System\DkfnFUN.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\zwfaXyj.exe
  C:\Windows\System\zwfaXyj.exe
  2⤵
  PID:780
- C:\Windows\System\sgadgwr.exe
  C:\Windows\System\sgadgwr.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\WCdQMwg.exe
  C:\Windows\System\WCdQMwg.exe
  2⤵
  PID:3080
- C:\Windows\System\pyrlBvs.exe
  C:\Windows\System\pyrlBvs.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\SDHHFDJ.exe
  C:\Windows\System\SDHHFDJ.exe
  2⤵
  PID:3112
- C:\Windows\System\ZLVJbxX.exe
  C:\Windows\System\ZLVJbxX.exe
  2⤵
  PID:3128
- C:\Windows\System\qGgRLRO.exe
  C:\Windows\System\qGgRLRO.exe
  2⤵
  PID:3148
- C:\Windows\System\vPVtTZG.exe
  C:\Windows\System\vPVtTZG.exe
  2⤵
  PID:3164
- C:\Windows\System\Dpsbivc.exe
  C:\Windows\System\Dpsbivc.exe
  2⤵
  PID:3180
- C:\Windows\System\JpcRMDt.exe
  C:\Windows\System\JpcRMDt.exe
  2⤵
  PID:3196
- C:\Windows\System\NBiUpPV.exe
  C:\Windows\System\NBiUpPV.exe
  2⤵
  PID:3212
- C:\Windows\System\ABGBzvu.exe
  C:\Windows\System\ABGBzvu.exe
  2⤵
  PID:3228
- C:\Windows\System\RwTwDzH.exe
  C:\Windows\System\RwTwDzH.exe
  2⤵
  PID:3244
- C:\Windows\System\qQEfiOX.exe
  C:\Windows\System\qQEfiOX.exe
  2⤵
  PID:3260
- C:\Windows\System\xDvnGQg.exe
  C:\Windows\System\xDvnGQg.exe
  2⤵
  PID:3276
- C:\Windows\System\lmCzAVm.exe
  C:\Windows\System\lmCzAVm.exe
  2⤵
  PID:3292
- C:\Windows\System\NZzpwsE.exe
  C:\Windows\System\NZzpwsE.exe
  2⤵
  PID:3308
- C:\Windows\System\MjufCyM.exe
  C:\Windows\System\MjufCyM.exe
  2⤵
  PID:3324
- C:\Windows\System\iZNfPhq.exe
  C:\Windows\System\iZNfPhq.exe
  2⤵
  PID:3340
- C:\Windows\System\PQGIoQA.exe
  C:\Windows\System\PQGIoQA.exe
  2⤵
  PID:3356
- C:\Windows\System\oKdHlGG.exe
  C:\Windows\System\oKdHlGG.exe
  2⤵
  PID:3372
- C:\Windows\System\JIUomZK.exe
  C:\Windows\System\JIUomZK.exe
  2⤵
  PID:3388
- C:\Windows\System\STyLuZf.exe
  C:\Windows\System\STyLuZf.exe
  2⤵
  PID:3404
- C:\Windows\System\ndjnGbU.exe
  C:\Windows\System\ndjnGbU.exe
  2⤵
  PID:3420
- C:\Windows\System\OODqmTC.exe
  C:\Windows\System\OODqmTC.exe
  2⤵
  PID:3436
- C:\Windows\System\XHfASmP.exe
  C:\Windows\System\XHfASmP.exe
  2⤵
  PID:3452
- C:\Windows\System\YyxxFMo.exe
  C:\Windows\System\YyxxFMo.exe
  2⤵
  PID:3468
- C:\Windows\System\opfwYyp.exe
  C:\Windows\System\opfwYyp.exe
  2⤵
  PID:3484
- C:\Windows\System\dJkXCNh.exe
  C:\Windows\System\dJkXCNh.exe
  2⤵
  PID:3500
- C:\Windows\System\uxNzsMQ.exe
  C:\Windows\System\uxNzsMQ.exe
  2⤵
  PID:3516
- C:\Windows\System\YGZzhrE.exe
  C:\Windows\System\YGZzhrE.exe
  2⤵
  PID:3532
- C:\Windows\System\FQCZlHm.exe
  C:\Windows\System\FQCZlHm.exe
  2⤵
  PID:3548
- C:\Windows\System\bQaPfxH.exe
  C:\Windows\System\bQaPfxH.exe
  2⤵
  PID:3564
- C:\Windows\System\nXvBaGx.exe
  C:\Windows\System\nXvBaGx.exe
  2⤵
  PID:3580
- C:\Windows\System\XQAztbF.exe
  C:\Windows\System\XQAztbF.exe
  2⤵
  PID:3596
- C:\Windows\System\ETiOcQV.exe
  C:\Windows\System\ETiOcQV.exe
  2⤵
  PID:3612
- C:\Windows\System\IQkmqUp.exe
  C:\Windows\System\IQkmqUp.exe
  2⤵
  PID:3628
- C:\Windows\System\jRFWYJc.exe
  C:\Windows\System\jRFWYJc.exe
  2⤵
  PID:3644
- C:\Windows\System\HCzhnkD.exe
  C:\Windows\System\HCzhnkD.exe
  2⤵
  PID:3660
- C:\Windows\System\eqUayUi.exe
  C:\Windows\System\eqUayUi.exe
  2⤵
  PID:3676
- C:\Windows\System\sgRErQj.exe
  C:\Windows\System\sgRErQj.exe
  2⤵
  PID:3692
- C:\Windows\System\KINbUNo.exe
  C:\Windows\System\KINbUNo.exe
  2⤵
  PID:3708
- C:\Windows\System\vevgVyj.exe
  C:\Windows\System\vevgVyj.exe
  2⤵
  PID:3724
- C:\Windows\System\vtElymi.exe
  C:\Windows\System\vtElymi.exe
  2⤵
  PID:3740
- C:\Windows\System\LQtVgAe.exe
  C:\Windows\System\LQtVgAe.exe
  2⤵
  PID:3756
- C:\Windows\System\SnbTfgw.exe
  C:\Windows\System\SnbTfgw.exe
  2⤵
  PID:3772
- C:\Windows\System\sZVrRgZ.exe
  C:\Windows\System\sZVrRgZ.exe
  2⤵
  PID:3788
- C:\Windows\System\pKYluEk.exe
  C:\Windows\System\pKYluEk.exe
  2⤵
  PID:3804
- C:\Windows\System\oHAksLS.exe
  C:\Windows\System\oHAksLS.exe
  2⤵
  PID:3820
- C:\Windows\System\NVdQXLD.exe
  C:\Windows\System\NVdQXLD.exe
  2⤵
  PID:3836
- C:\Windows\System\DYLDtdQ.exe
  C:\Windows\System\DYLDtdQ.exe
  2⤵
  PID:3852
- C:\Windows\System\XkmgEDk.exe
  C:\Windows\System\XkmgEDk.exe
  2⤵
  PID:3868
- C:\Windows\System\oJbmNQg.exe
  C:\Windows\System\oJbmNQg.exe
  2⤵
  PID:3884
- C:\Windows\System\RElmiDK.exe
  C:\Windows\System\RElmiDK.exe
  2⤵
  PID:3900
- C:\Windows\System\iffIFaa.exe
  C:\Windows\System\iffIFaa.exe
  2⤵
  PID:3916
- C:\Windows\System\qYwsRXo.exe
  C:\Windows\System\qYwsRXo.exe
  2⤵
  PID:3932
- C:\Windows\System\lIpLGpF.exe
  C:\Windows\System\lIpLGpF.exe
  2⤵
  PID:3948
- C:\Windows\System\VlnjHOE.exe
  C:\Windows\System\VlnjHOE.exe
  2⤵
  PID:3964
- C:\Windows\System\MtqeQEc.exe
  C:\Windows\System\MtqeQEc.exe
  2⤵
  PID:3980
- C:\Windows\System\FSDChle.exe
  C:\Windows\System\FSDChle.exe
  2⤵
  PID:3996
- C:\Windows\System\FBTweVS.exe
  C:\Windows\System\FBTweVS.exe
  2⤵
  PID:4012
- C:\Windows\System\EwlfwOr.exe
  C:\Windows\System\EwlfwOr.exe
  2⤵
  PID:4028
- C:\Windows\System\FVNVjeG.exe
  C:\Windows\System\FVNVjeG.exe
  2⤵
  PID:4044
- C:\Windows\System\PmYiJDm.exe
  C:\Windows\System\PmYiJDm.exe
  2⤵
  PID:4060
- C:\Windows\System\iBjhTRj.exe
  C:\Windows\System\iBjhTRj.exe
  2⤵
  PID:4076
- C:\Windows\System\OvsZUFo.exe
  C:\Windows\System\OvsZUFo.exe
  2⤵
  PID:4092
- C:\Windows\System\EEQYayD.exe
  C:\Windows\System\EEQYayD.exe
  2⤵
  PID:1664
- C:\Windows\System\DGFGoNG.exe
  C:\Windows\System\DGFGoNG.exe
  2⤵
  PID:1548
- C:\Windows\System\OivyyTl.exe
  C:\Windows\System\OivyyTl.exe
  2⤵
  PID:3136
- C:\Windows\System\SeSUzvL.exe
  C:\Windows\System\SeSUzvL.exe
  2⤵
  PID:3204
- C:\Windows\System\dwCKlGV.exe
  C:\Windows\System\dwCKlGV.exe
  2⤵
  PID:3268
- C:\Windows\System\dfHsqZn.exe
  C:\Windows\System\dfHsqZn.exe
  2⤵
  PID:3332
- C:\Windows\System\KkaxuVo.exe
  C:\Windows\System\KkaxuVo.exe
  2⤵
  PID:3396
- C:\Windows\System\zHhIMqe.exe
  C:\Windows\System\zHhIMqe.exe
  2⤵
  PID:3460
- C:\Windows\System\YVyYVCo.exe
  C:\Windows\System\YVyYVCo.exe
  2⤵
  PID:3524
- C:\Windows\System\AQzMPrp.exe
  C:\Windows\System\AQzMPrp.exe
  2⤵
  PID:3588
- C:\Windows\System\bdMOzZj.exe
  C:\Windows\System\bdMOzZj.exe
  2⤵
  PID:3652
- C:\Windows\System\qtXBlZo.exe
  C:\Windows\System\qtXBlZo.exe
  2⤵
  PID:3716
- C:\Windows\System\YYGmoGK.exe
  C:\Windows\System\YYGmoGK.exe
  2⤵
  PID:3780
- C:\Windows\System\KnOMxVc.exe
  C:\Windows\System\KnOMxVc.exe
  2⤵
  PID:2744
- C:\Windows\System\VPjUabh.exe
  C:\Windows\System\VPjUabh.exe
  2⤵
  PID:3880
- C:\Windows\System\hOXvOmQ.exe
  C:\Windows\System\hOXvOmQ.exe
  2⤵
  PID:3940
- C:\Windows\System\blWiNoN.exe
  C:\Windows\System\blWiNoN.exe
  2⤵
  PID:3976
- C:\Windows\System\SjJeovb.exe
  C:\Windows\System\SjJeovb.exe
  2⤵
  PID:4040
- C:\Windows\System\LGPhEOw.exe
  C:\Windows\System\LGPhEOw.exe
  2⤵
  PID:4108
- C:\Windows\System\JOkoPcq.exe
  C:\Windows\System\JOkoPcq.exe
  2⤵
  PID:4124
- C:\Windows\System\tOLiMBm.exe
  C:\Windows\System\tOLiMBm.exe
  2⤵
  PID:4140
- C:\Windows\System\wFmYmim.exe
  C:\Windows\System\wFmYmim.exe
  2⤵
  PID:4156
- C:\Windows\System\PwikhFP.exe
  C:\Windows\System\PwikhFP.exe
  2⤵
  PID:4172
- C:\Windows\System\sANRyLi.exe
  C:\Windows\System\sANRyLi.exe
  2⤵
  PID:4188
- C:\Windows\System\isbwIWZ.exe
  C:\Windows\System\isbwIWZ.exe
  2⤵
  PID:4204
- C:\Windows\System\OrLdzfu.exe
  C:\Windows\System\OrLdzfu.exe
  2⤵
  PID:4220
- C:\Windows\System\mwZViPc.exe
  C:\Windows\System\mwZViPc.exe
  2⤵
  PID:4236
- C:\Windows\System\pAniPPZ.exe
  C:\Windows\System\pAniPPZ.exe
  2⤵
  PID:4252
- C:\Windows\System\VyufaTx.exe
  C:\Windows\System\VyufaTx.exe
  2⤵
  PID:4268
- C:\Windows\System\pCcwBfl.exe
  C:\Windows\System\pCcwBfl.exe
  2⤵
  PID:4284
- C:\Windows\System\BVITglD.exe
  C:\Windows\System\BVITglD.exe
  2⤵
  PID:4300
- C:\Windows\System\qkSpUTD.exe
  C:\Windows\System\qkSpUTD.exe
  2⤵
  PID:4316
- C:\Windows\System\ecqpgHN.exe
  C:\Windows\System\ecqpgHN.exe
  2⤵
  PID:4332
- C:\Windows\System\jmNedZH.exe
  C:\Windows\System\jmNedZH.exe
  2⤵
  PID:4348
- C:\Windows\System\nHisLVb.exe
  C:\Windows\System\nHisLVb.exe
  2⤵
  PID:4364
- C:\Windows\System\aQzlvPP.exe
  C:\Windows\System\aQzlvPP.exe
  2⤵
  PID:4380
- C:\Windows\System\wDpescP.exe
  C:\Windows\System\wDpescP.exe
  2⤵
  PID:4396
- C:\Windows\System\pYxLDLk.exe
  C:\Windows\System\pYxLDLk.exe
  2⤵
  PID:4412
- C:\Windows\System\tuglTxF.exe
  C:\Windows\System\tuglTxF.exe
  2⤵
  PID:4428
- C:\Windows\System\Ymsgxyk.exe
  C:\Windows\System\Ymsgxyk.exe
  2⤵
  PID:4444
- C:\Windows\System\dyUbVyg.exe
  C:\Windows\System\dyUbVyg.exe
  2⤵
  PID:4460
- C:\Windows\System\eBQFjUV.exe
  C:\Windows\System\eBQFjUV.exe
  2⤵
  PID:4476
- C:\Windows\System\WjyehMX.exe
  C:\Windows\System\WjyehMX.exe
  2⤵
  PID:4492
- C:\Windows\System\fyaEcap.exe
  C:\Windows\System\fyaEcap.exe
  2⤵
  PID:4508
- C:\Windows\System\qiKnLEb.exe
  C:\Windows\System\qiKnLEb.exe
  2⤵
  PID:4524
- C:\Windows\System\ZjBhblA.exe
  C:\Windows\System\ZjBhblA.exe
  2⤵
  PID:4540
- C:\Windows\System\bJLkCLC.exe
  C:\Windows\System\bJLkCLC.exe
  2⤵
  PID:4556
- C:\Windows\System\hGLPaKM.exe
  C:\Windows\System\hGLPaKM.exe
  2⤵
  PID:4572
- C:\Windows\System\BerlsuD.exe
  C:\Windows\System\BerlsuD.exe
  2⤵
  PID:4588
- C:\Windows\System\sdGdgJN.exe
  C:\Windows\System\sdGdgJN.exe
  2⤵
  PID:4604
- C:\Windows\System\lpygkgs.exe
  C:\Windows\System\lpygkgs.exe
  2⤵
  PID:4620
- C:\Windows\System\pCufHrd.exe
  C:\Windows\System\pCufHrd.exe
  2⤵
  PID:4636
- C:\Windows\System\LcpnDlu.exe
  C:\Windows\System\LcpnDlu.exe
  2⤵
  PID:4652
- C:\Windows\System\XCmPXgr.exe
  C:\Windows\System\XCmPXgr.exe
  2⤵
  PID:4668
- C:\Windows\System\cYhwsTU.exe
  C:\Windows\System\cYhwsTU.exe
  2⤵
  PID:4684
- C:\Windows\System\OaQsgJW.exe
  C:\Windows\System\OaQsgJW.exe
  2⤵
  PID:4700
- C:\Windows\System\xulUCjM.exe
  C:\Windows\System\xulUCjM.exe
  2⤵
  PID:4716
- C:\Windows\System\LthUCEr.exe
  C:\Windows\System\LthUCEr.exe
  2⤵
  PID:4732
- C:\Windows\System\YeCIzWy.exe
  C:\Windows\System\YeCIzWy.exe
  2⤵
  PID:4748
- C:\Windows\System\EcOkVcQ.exe
  C:\Windows\System\EcOkVcQ.exe
  2⤵
  PID:4764
- C:\Windows\System\atYWBEC.exe
  C:\Windows\System\atYWBEC.exe
  2⤵
  PID:4780
- C:\Windows\System\aXDiCLs.exe
  C:\Windows\System\aXDiCLs.exe
  2⤵
  PID:4796
- C:\Windows\System\cqYDtgy.exe
  C:\Windows\System\cqYDtgy.exe
  2⤵
  PID:4812
- C:\Windows\System\wibsiRn.exe
  C:\Windows\System\wibsiRn.exe
  2⤵
  PID:4828
- C:\Windows\System\ASVsANX.exe
  C:\Windows\System\ASVsANX.exe
  2⤵
  PID:4844
- C:\Windows\System\snEewiW.exe
  C:\Windows\System\snEewiW.exe
  2⤵
  PID:4860
- C:\Windows\System\QwKhmpi.exe
  C:\Windows\System\QwKhmpi.exe
  2⤵
  PID:4876
- C:\Windows\System\UhgwOWM.exe
  C:\Windows\System\UhgwOWM.exe
  2⤵
  PID:4892
- C:\Windows\System\IYZxxWS.exe
  C:\Windows\System\IYZxxWS.exe
  2⤵
  PID:4908
- C:\Windows\System\GHMDorx.exe
  C:\Windows\System\GHMDorx.exe
  2⤵
  PID:4924
- C:\Windows\System\cxdAMpL.exe
  C:\Windows\System\cxdAMpL.exe
  2⤵
  PID:4940
- C:\Windows\System\FOuKORR.exe
  C:\Windows\System\FOuKORR.exe
  2⤵
  PID:4956
- C:\Windows\System\CRFjcPQ.exe
  C:\Windows\System\CRFjcPQ.exe
  2⤵
  PID:4972
- C:\Windows\System\SQempeO.exe
  C:\Windows\System\SQempeO.exe
  2⤵
  PID:4988
- C:\Windows\System\zaBEOzU.exe
  C:\Windows\System\zaBEOzU.exe
  2⤵
  PID:5004
- C:\Windows\System\EClMUFv.exe
  C:\Windows\System\EClMUFv.exe
  2⤵
  PID:5020
- C:\Windows\System\RuWvXwT.exe
  C:\Windows\System\RuWvXwT.exe
  2⤵
  PID:5036
- C:\Windows\System\VGBwaLO.exe
  C:\Windows\System\VGBwaLO.exe
  2⤵
  PID:5052
- C:\Windows\System\rSIdZJo.exe
  C:\Windows\System\rSIdZJo.exe
  2⤵
  PID:5068
- C:\Windows\System\PSSwssT.exe
  C:\Windows\System\PSSwssT.exe
  2⤵
  PID:5084
- C:\Windows\System\BQOLqXQ.exe
  C:\Windows\System\BQOLqXQ.exe
  2⤵
  PID:5100
- C:\Windows\System\RuByPUF.exe
  C:\Windows\System\RuByPUF.exe
  2⤵
  PID:5116
- C:\Windows\System\rtgHgvj.exe
  C:\Windows\System\rtgHgvj.exe
  2⤵
  PID:2568
- C:\Windows\System\gwPRHNT.exe
  C:\Windows\System\gwPRHNT.exe
  2⤵
  PID:3240
- C:\Windows\System\IiRYQfH.exe
  C:\Windows\System\IiRYQfH.exe
  2⤵
  PID:3496
- C:\Windows\System\tkPRjaB.exe
  C:\Windows\System\tkPRjaB.exe
  2⤵
  PID:3752
- C:\Windows\System\rcdtuXY.exe
  C:\Windows\System\rcdtuXY.exe
  2⤵
  PID:3972
- C:\Windows\System\lPQggfE.exe
  C:\Windows\System\lPQggfE.exe
  2⤵
  PID:4136
- C:\Windows\System\ycQCjar.exe
  C:\Windows\System\ycQCjar.exe
  2⤵
  PID:4200
- C:\Windows\System\cvTZwIL.exe
  C:\Windows\System\cvTZwIL.exe
  2⤵
  PID:4264
- C:\Windows\System\NykPwew.exe
  C:\Windows\System\NykPwew.exe
  2⤵
  PID:4328
- C:\Windows\System\mqrAKEy.exe
  C:\Windows\System\mqrAKEy.exe
  2⤵
  PID:4392
- C:\Windows\System\qXUFBaQ.exe
  C:\Windows\System\qXUFBaQ.exe
  2⤵
  PID:4456
- C:\Windows\System\uPgPlDK.exe
  C:\Windows\System\uPgPlDK.exe
  2⤵
  PID:4520
- C:\Windows\System\vXbNPVt.exe
  C:\Windows\System\vXbNPVt.exe
  2⤵
  PID:4580
- C:\Windows\System\WylzRib.exe
  C:\Windows\System\WylzRib.exe
  2⤵
  PID:4644
- C:\Windows\System\SXjrkdx.exe
  C:\Windows\System\SXjrkdx.exe
  2⤵
  PID:4708
- C:\Windows\System\GmAtoCV.exe
  C:\Windows\System\GmAtoCV.exe
  2⤵
  PID:4772
- C:\Windows\System\TFWjMnW.exe
  C:\Windows\System\TFWjMnW.exe
  2⤵
  PID:4808
- C:\Windows\System\fGjFyTK.exe
  C:\Windows\System\fGjFyTK.exe
  2⤵
  PID:4872
- C:\Windows\System\FGQgDAi.exe
  C:\Windows\System\FGQgDAi.exe
  2⤵
  PID:4904
- C:\Windows\System\PodPzTi.exe
  C:\Windows\System\PodPzTi.exe
  2⤵
  PID:4964
- C:\Windows\System\NyqQUqN.exe
  C:\Windows\System\NyqQUqN.exe
  2⤵
  PID:5028
- C:\Windows\System\OyLGIKq.exe
  C:\Windows\System\OyLGIKq.exe
  2⤵
  PID:5092
- C:\Windows\System\thYnUjO.exe
  C:\Windows\System\thYnUjO.exe
  2⤵
  PID:3368
- C:\Windows\System\VhsUqEe.exe
  C:\Windows\System\VhsUqEe.exe
  2⤵
  PID:4168
- C:\Windows\System\uNSSZKo.exe
  C:\Windows\System\uNSSZKo.exe
  2⤵
  PID:4424
- C:\Windows\System\hEbddJU.exe
  C:\Windows\System\hEbddJU.exe
  2⤵
  PID:5136
- C:\Windows\System\klQpcfn.exe
  C:\Windows\System\klQpcfn.exe
  2⤵
  PID:5152
- C:\Windows\System\KCNConF.exe
  C:\Windows\System\KCNConF.exe
  2⤵
  PID:5168
- C:\Windows\System\yFmSeXM.exe
  C:\Windows\System\yFmSeXM.exe
  2⤵
  PID:5184
- C:\Windows\System\sNqTbww.exe
  C:\Windows\System\sNqTbww.exe
  2⤵
  PID:5200
- C:\Windows\System\MbifnEH.exe
  C:\Windows\System\MbifnEH.exe
  2⤵
  PID:5216
- C:\Windows\System\NrmQJaI.exe
  C:\Windows\System\NrmQJaI.exe
  2⤵
  PID:5232
- C:\Windows\System\QfwqglC.exe
  C:\Windows\System\QfwqglC.exe
  2⤵
  PID:5248
- C:\Windows\System\mbKsWIQ.exe
  C:\Windows\System\mbKsWIQ.exe
  2⤵
  PID:5268
- C:\Windows\System\kDrbGHE.exe
  C:\Windows\System\kDrbGHE.exe
  2⤵
  PID:5284
- C:\Windows\System\WnuedmC.exe
  C:\Windows\System\WnuedmC.exe
  2⤵
  PID:5300
- C:\Windows\System\dGBfvom.exe
  C:\Windows\System\dGBfvom.exe
  2⤵
  PID:5316
- C:\Windows\System\aNulafX.exe
  C:\Windows\System\aNulafX.exe
  2⤵
  PID:5332
- C:\Windows\System\YeviNco.exe
  C:\Windows\System\YeviNco.exe
  2⤵
  PID:5348
- C:\Windows\System\oRkQcTa.exe
  C:\Windows\System\oRkQcTa.exe
  2⤵
  PID:5364
- C:\Windows\System\IahAzUu.exe
  C:\Windows\System\IahAzUu.exe
  2⤵
  PID:5380
- C:\Windows\System\ScqYWDW.exe
  C:\Windows\System\ScqYWDW.exe
  2⤵
  PID:5396
- C:\Windows\System\jHBVslw.exe
  C:\Windows\System\jHBVslw.exe
  2⤵
  PID:5412
- C:\Windows\System\Goctpsz.exe
  C:\Windows\System\Goctpsz.exe
  2⤵
  PID:5428
- C:\Windows\System\RtCGRBj.exe
  C:\Windows\System\RtCGRBj.exe
  2⤵
  PID:5444
- C:\Windows\System\dHPFBQw.exe
  C:\Windows\System\dHPFBQw.exe
  2⤵
  PID:5460
- C:\Windows\System\BSEEZCM.exe
  C:\Windows\System\BSEEZCM.exe
  2⤵
  PID:5476
- C:\Windows\System\tKMXFWo.exe
  C:\Windows\System\tKMXFWo.exe
  2⤵
  PID:5492
- C:\Windows\System\ANzULbY.exe
  C:\Windows\System\ANzULbY.exe
  2⤵
  PID:5508
- C:\Windows\System\nfKABuV.exe
  C:\Windows\System\nfKABuV.exe
  2⤵
  PID:5524
- C:\Windows\System\mRgCehP.exe
  C:\Windows\System\mRgCehP.exe
  2⤵
  PID:5540
- C:\Windows\System\UVnNaZb.exe
  C:\Windows\System\UVnNaZb.exe
  2⤵
  PID:5556
- C:\Windows\System\WQYWIVQ.exe
  C:\Windows\System\WQYWIVQ.exe
  2⤵
  PID:5572
- C:\Windows\System\aynZaST.exe
  C:\Windows\System\aynZaST.exe
  2⤵
  PID:5592
- C:\Windows\System\pLKWUUE.exe
  C:\Windows\System\pLKWUUE.exe
  2⤵
  PID:5608
- C:\Windows\System\NhMiFcz.exe
  C:\Windows\System\NhMiFcz.exe
  2⤵
  PID:5624
- C:\Windows\System\AZojccN.exe
  C:\Windows\System\AZojccN.exe
  2⤵
  PID:5640
- C:\Windows\System\vlOmSep.exe
  C:\Windows\System\vlOmSep.exe
  2⤵
  PID:5656
- C:\Windows\System\rhmdQcK.exe
  C:\Windows\System\rhmdQcK.exe
  2⤵
  PID:5672
- C:\Windows\System\dOOdHdd.exe
  C:\Windows\System\dOOdHdd.exe
  2⤵
  PID:5688
- C:\Windows\System\iSaICmu.exe
  C:\Windows\System\iSaICmu.exe
  2⤵
  PID:5704
- C:\Windows\System\gzdYgOQ.exe
  C:\Windows\System\gzdYgOQ.exe
  2⤵
  PID:5720
- C:\Windows\System\mugPzkA.exe
  C:\Windows\System\mugPzkA.exe
  2⤵
  PID:5736
- C:\Windows\System\szagTtx.exe
  C:\Windows\System\szagTtx.exe
  2⤵
  PID:5752
- C:\Windows\System\ZDjlvsb.exe
  C:\Windows\System\ZDjlvsb.exe
  2⤵
  PID:5768
- C:\Windows\System\UYICajx.exe
  C:\Windows\System\UYICajx.exe
  2⤵
  PID:5784
- C:\Windows\System\qnEwmRz.exe
  C:\Windows\System\qnEwmRz.exe
  2⤵
  PID:5800
- C:\Windows\System\lCrGHnR.exe
  C:\Windows\System\lCrGHnR.exe
  2⤵
  PID:5816
- C:\Windows\System\TwejwAz.exe
  C:\Windows\System\TwejwAz.exe
  2⤵
  PID:5832
- C:\Windows\System\paspLXo.exe
  C:\Windows\System\paspLXo.exe
  2⤵
  PID:5848
- C:\Windows\System\LTTwpnK.exe
  C:\Windows\System\LTTwpnK.exe
  2⤵
  PID:5864
- C:\Windows\System\hHUeLIa.exe
  C:\Windows\System\hHUeLIa.exe
  2⤵
  PID:5880
- C:\Windows\System\SoKujKo.exe
  C:\Windows\System\SoKujKo.exe
  2⤵
  PID:5896
- C:\Windows\System\pPrDcdo.exe
  C:\Windows\System\pPrDcdo.exe
  2⤵
  PID:5912
- C:\Windows\System\axOuJVu.exe
  C:\Windows\System\axOuJVu.exe
  2⤵
  PID:5928
- C:\Windows\System\xGDHpdv.exe
  C:\Windows\System\xGDHpdv.exe
  2⤵
  PID:5944
- C:\Windows\System\oDHijkV.exe
  C:\Windows\System\oDHijkV.exe
  2⤵
  PID:5960
- C:\Windows\System\hilfrFW.exe
  C:\Windows\System\hilfrFW.exe
  2⤵
  PID:5976
- C:\Windows\System\wxaRKYy.exe
  C:\Windows\System\wxaRKYy.exe
  2⤵
  PID:5992
- C:\Windows\System\szEeYBp.exe
  C:\Windows\System\szEeYBp.exe
  2⤵
  PID:6008
- C:\Windows\System\FiNbUeq.exe
  C:\Windows\System\FiNbUeq.exe
  2⤵
  PID:6024
- C:\Windows\System\RbSBNUJ.exe
  C:\Windows\System\RbSBNUJ.exe
  2⤵
  PID:6040
- C:\Windows\System\dhAgnCc.exe
  C:\Windows\System\dhAgnCc.exe
  2⤵
  PID:6056
- C:\Windows\System\RAsoLJA.exe
  C:\Windows\System\RAsoLJA.exe
  2⤵
  PID:6072
- C:\Windows\System\Qnqkedc.exe
  C:\Windows\System\Qnqkedc.exe
  2⤵
  PID:6088
- C:\Windows\System\TLzDQJn.exe
  C:\Windows\System\TLzDQJn.exe
  2⤵
  PID:6104
- C:\Windows\System\XbLizeN.exe
  C:\Windows\System\XbLizeN.exe
  2⤵
  PID:6120
- C:\Windows\System\LXaQmop.exe
  C:\Windows\System\LXaQmop.exe
  2⤵
  PID:6136
- C:\Windows\System\ciUKSUR.exe
  C:\Windows\System\ciUKSUR.exe
  2⤵
  PID:904
- C:\Windows\System\VpPptoX.exe
  C:\Windows\System\VpPptoX.exe
  2⤵
  PID:4776
- C:\Windows\System\dBDRJVW.exe
  C:\Windows\System\dBDRJVW.exe
  2⤵
  PID:4996
- C:\Windows\System\mJwqkmO.exe
  C:\Windows\System\mJwqkmO.exe
  2⤵
  PID:4296
- C:\Windows\System\UZaOEGm.exe
  C:\Windows\System\UZaOEGm.exe
  2⤵
  PID:5176
- C:\Windows\System\bldCFNi.exe
  C:\Windows\System\bldCFNi.exe
  2⤵
  PID:5212
- C:\Windows\System\uPwBanX.exe
  C:\Windows\System\uPwBanX.exe
  2⤵
  PID:5280
- C:\Windows\System\BaYdcKW.exe
  C:\Windows\System\BaYdcKW.exe
  2⤵
  PID:5312
- C:\Windows\System\xxYYLEA.exe
  C:\Windows\System\xxYYLEA.exe
  2⤵
  PID:5372
- C:\Windows\System\RPNJyWk.exe
  C:\Windows\System\RPNJyWk.exe
  2⤵
  PID:2784
- C:\Windows\System\ICKSuNx.exe
  C:\Windows\System\ICKSuNx.exe
  2⤵
  PID:1572
- C:\Windows\System\aiVUXGG.exe
  C:\Windows\System\aiVUXGG.exe
  2⤵
  PID:5472
- C:\Windows\System\nxxRklC.exe
  C:\Windows\System\nxxRklC.exe
  2⤵
  PID:5536
- C:\Windows\System\GukDeTD.exe
  C:\Windows\System\GukDeTD.exe
  2⤵
  PID:5604
- C:\Windows\System\sBvBvRN.exe
  C:\Windows\System\sBvBvRN.exe
  2⤵
  PID:5668
- C:\Windows\System\FifSrEA.exe
  C:\Windows\System\FifSrEA.exe
  2⤵
  PID:5732
- C:\Windows\System\tkaBDCv.exe
  C:\Windows\System\tkaBDCv.exe
  2⤵
  PID:1476
- C:\Windows\System\letFiTE.exe
  C:\Windows\System\letFiTE.exe
  2⤵
  PID:5824
- C:\Windows\System\PKdTxZa.exe
  C:\Windows\System\PKdTxZa.exe
  2⤵
  PID:5888
- C:\Windows\System\wvJJZbe.exe
  C:\Windows\System\wvJJZbe.exe
  2⤵
  PID:5952
- C:\Windows\System\PZUAKOv.exe
  C:\Windows\System\PZUAKOv.exe
  2⤵
  PID:2896
- C:\Windows\System\GlMFyKs.exe
  C:\Windows\System\GlMFyKs.exe
  2⤵
  PID:6016
- C:\Windows\System\ferIRXx.exe
  C:\Windows\System\ferIRXx.exe
  2⤵
  PID:6048
- C:\Windows\System\RtInINa.exe
  C:\Windows\System\RtInINa.exe
  2⤵
  PID:6084
- C:\Windows\System\xGnXLvO.exe
  C:\Windows\System\xGnXLvO.exe
  2⤵
  PID:676
- C:\Windows\System\hnaQzYb.exe
  C:\Windows\System\hnaQzYb.exe
  2⤵
  PID:2764
- C:\Windows\System\QywOlrG.exe
  C:\Windows\System\QywOlrG.exe
  2⤵
  PID:5148
- C:\Windows\System\HDJUklu.exe
  C:\Windows\System\HDJUklu.exe
  2⤵
  PID:5276
- C:\Windows\System\zXMeGBw.exe
  C:\Windows\System\zXMeGBw.exe
  2⤵
  PID:5344
- C:\Windows\System\nISrLXT.exe
  C:\Windows\System\nISrLXT.exe
  2⤵
  PID:5504
- C:\Windows\System\thyyjnN.exe
  C:\Windows\System\thyyjnN.exe
  2⤵
  PID:940
- C:\Windows\System\jbUcqZq.exe
  C:\Windows\System\jbUcqZq.exe
  2⤵
  PID:5764
- C:\Windows\System\HoexaZH.exe
  C:\Windows\System\HoexaZH.exe
  2⤵
  PID:3144
- C:\Windows\System\jDhVFEh.exe
  C:\Windows\System\jDhVFEh.exe
  2⤵
  PID:2316
- C:\Windows\System\ctfWDMU.exe
  C:\Windows\System\ctfWDMU.exe
  2⤵
  PID:1396
- C:\Windows\System\zYyefVM.exe
  C:\Windows\System\zYyefVM.exe
  2⤵
  PID:2552
- C:\Windows\System\MXENgGf.exe
  C:\Windows\System\MXENgGf.exe
  2⤵
  PID:896
- C:\Windows\System\pxkZFTg.exe
  C:\Windows\System\pxkZFTg.exe
  2⤵
  PID:6156
- C:\Windows\System\wINPwOk.exe
  C:\Windows\System\wINPwOk.exe
  2⤵
  PID:6172
- C:\Windows\System\mwvwQNQ.exe
  C:\Windows\System\mwvwQNQ.exe
  2⤵
  PID:6188
- C:\Windows\System\wdgDqcs.exe
  C:\Windows\System\wdgDqcs.exe
  2⤵
  PID:6204
- C:\Windows\System\tssLFFn.exe
  C:\Windows\System\tssLFFn.exe
  2⤵
  PID:6220
- C:\Windows\System\MRLOyOK.exe
  C:\Windows\System\MRLOyOK.exe
  2⤵
  PID:6236
- C:\Windows\System\KvCnyBp.exe
  C:\Windows\System\KvCnyBp.exe
  2⤵
  PID:6252
- C:\Windows\System\qyjYEsF.exe
  C:\Windows\System\qyjYEsF.exe
  2⤵
  PID:6268
- C:\Windows\System\drkZDVn.exe
  C:\Windows\System\drkZDVn.exe
  2⤵
  PID:6284
- C:\Windows\System\uWYLbVB.exe
  C:\Windows\System\uWYLbVB.exe
  2⤵
  PID:6300
- C:\Windows\System\WNuBsXP.exe
  C:\Windows\System\WNuBsXP.exe
  2⤵
  PID:6316
- C:\Windows\System\JcKAdwG.exe
  C:\Windows\System\JcKAdwG.exe
  2⤵
  PID:6332
- C:\Windows\System\pPNGWsu.exe
  C:\Windows\System\pPNGWsu.exe
  2⤵
  PID:6348
- C:\Windows\System\OlJMbuz.exe
  C:\Windows\System\OlJMbuz.exe
  2⤵
  PID:6364
- C:\Windows\System\GdtfccI.exe
  C:\Windows\System\GdtfccI.exe
  2⤵
  PID:6380
- C:\Windows\System\ZXHodGJ.exe
  C:\Windows\System\ZXHodGJ.exe
  2⤵
  PID:6396
- C:\Windows\System\vOWKmuo.exe
  C:\Windows\System\vOWKmuo.exe
  2⤵
  PID:6412
- C:\Windows\System\LCYkhQw.exe
  C:\Windows\System\LCYkhQw.exe
  2⤵
  PID:6428
- C:\Windows\System\fhMMaUH.exe
  C:\Windows\System\fhMMaUH.exe
  2⤵
  PID:6444
- C:\Windows\System\peKiryz.exe
  C:\Windows\System\peKiryz.exe
  2⤵
  PID:6460
- C:\Windows\System\dbbNXOm.exe
  C:\Windows\System\dbbNXOm.exe
  2⤵
  PID:6476
- C:\Windows\System\oNAndsM.exe
  C:\Windows\System\oNAndsM.exe
  2⤵
  PID:6492
- C:\Windows\System\ekxBiPw.exe
  C:\Windows\System\ekxBiPw.exe
  2⤵
  PID:6508
- C:\Windows\System\DMGcDMp.exe
  C:\Windows\System\DMGcDMp.exe
  2⤵
  PID:6524
- C:\Windows\System\MpzqWXn.exe
  C:\Windows\System\MpzqWXn.exe
  2⤵
  PID:6540
- C:\Windows\System\yRECGBs.exe
  C:\Windows\System\yRECGBs.exe
  2⤵
  PID:6556
- C:\Windows\System\dGsPkbI.exe
  C:\Windows\System\dGsPkbI.exe
  2⤵
  PID:6572
- C:\Windows\System\cStTOwM.exe
  C:\Windows\System\cStTOwM.exe
  2⤵
  PID:6588
- C:\Windows\System\WdmiRJT.exe
  C:\Windows\System\WdmiRJT.exe
  2⤵
  PID:6604
- C:\Windows\System\mZCDRCb.exe
  C:\Windows\System\mZCDRCb.exe
  2⤵
  PID:6620
- C:\Windows\System\HrlrwmL.exe
  C:\Windows\System\HrlrwmL.exe
  2⤵
  PID:6636
- C:\Windows\System\qDjQbga.exe
  C:\Windows\System\qDjQbga.exe
  2⤵
  PID:6652
- C:\Windows\System\huhHtqE.exe
  C:\Windows\System\huhHtqE.exe
  2⤵
  PID:6668
- C:\Windows\System\wONIoHz.exe
  C:\Windows\System\wONIoHz.exe
  2⤵
  PID:6684
- C:\Windows\System\hOtxsqq.exe
  C:\Windows\System\hOtxsqq.exe
  2⤵
  PID:6700
- C:\Windows\System\najbJHW.exe
  C:\Windows\System\najbJHW.exe
  2⤵
  PID:6716
- C:\Windows\System\xyqWJtx.exe
  C:\Windows\System\xyqWJtx.exe
  2⤵
  PID:6732
- C:\Windows\System\nnGbNlh.exe
  C:\Windows\System\nnGbNlh.exe
  2⤵
  PID:6748
- C:\Windows\System\ENjgAbz.exe
  C:\Windows\System\ENjgAbz.exe
  2⤵
  PID:6764
- C:\Windows\System\UFHEfAt.exe
  C:\Windows\System\UFHEfAt.exe
  2⤵
  PID:6780
- C:\Windows\System\iPCHXkZ.exe
  C:\Windows\System\iPCHXkZ.exe
  2⤵
  PID:6796
- C:\Windows\System\iXOvgUy.exe
  C:\Windows\System\iXOvgUy.exe
  2⤵
  PID:6812
- C:\Windows\System\uIUHdZB.exe
  C:\Windows\System\uIUHdZB.exe
  2⤵
  PID:6828
- C:\Windows\System\UCSlPCE.exe
  C:\Windows\System\UCSlPCE.exe
  2⤵
  PID:6844
- C:\Windows\System\aQWCWkT.exe
  C:\Windows\System\aQWCWkT.exe
  2⤵
  PID:6860
- C:\Windows\System\bKrmYUS.exe
  C:\Windows\System\bKrmYUS.exe
  2⤵
  PID:6876
- C:\Windows\System\PajNACq.exe
  C:\Windows\System\PajNACq.exe
  2⤵
  PID:6892
- C:\Windows\System\nyGbMRi.exe
  C:\Windows\System\nyGbMRi.exe
  2⤵
  PID:6908
- C:\Windows\System\KNpCMfr.exe
  C:\Windows\System\KNpCMfr.exe
  2⤵
  PID:6924
- C:\Windows\System\zdgMOWj.exe
  C:\Windows\System\zdgMOWj.exe
  2⤵
  PID:6940
- C:\Windows\System\tNxFhrK.exe
  C:\Windows\System\tNxFhrK.exe
  2⤵
  PID:6956
- C:\Windows\System\ThaqaMV.exe
  C:\Windows\System\ThaqaMV.exe
  2⤵
  PID:6972
- C:\Windows\System\jrhkZGC.exe
  C:\Windows\System\jrhkZGC.exe
  2⤵
  PID:6988
- C:\Windows\System\GBJfaxn.exe
  C:\Windows\System\GBJfaxn.exe
  2⤵
  PID:7004
- C:\Windows\System\BXBDZuq.exe
  C:\Windows\System\BXBDZuq.exe
  2⤵
  PID:7020
- C:\Windows\System\MDIwVHL.exe
  C:\Windows\System\MDIwVHL.exe
  2⤵
  PID:7036
- C:\Windows\System\MCZveHG.exe
  C:\Windows\System\MCZveHG.exe
  2⤵
  PID:7052
- C:\Windows\System\vCZthXr.exe
  C:\Windows\System\vCZthXr.exe
  2⤵
  PID:7068
- C:\Windows\System\dPsLRZz.exe
  C:\Windows\System\dPsLRZz.exe
  2⤵
  PID:7084
- C:\Windows\System\sdSIYXu.exe
  C:\Windows\System\sdSIYXu.exe
  2⤵
  PID:7100
- C:\Windows\System\WpvMWsV.exe
  C:\Windows\System\WpvMWsV.exe
  2⤵
  PID:7116
- C:\Windows\System\ReAyPbF.exe
  C:\Windows\System\ReAyPbF.exe
  2⤵
  PID:7132
- C:\Windows\System\bptHPKk.exe
  C:\Windows\System\bptHPKk.exe
  2⤵
  PID:7148
- C:\Windows\System\qFTYMKi.exe
  C:\Windows\System\qFTYMKi.exe
  2⤵
  PID:7164
- C:\Windows\System\FxIlcrK.exe
  C:\Windows\System\FxIlcrK.exe
  2⤵
  PID:6196
- C:\Windows\System\DdZPkIJ.exe
  C:\Windows\System\DdZPkIJ.exe
  2⤵
  PID:6260
- C:\Windows\System\cPlnzIm.exe
  C:\Windows\System\cPlnzIm.exe
  2⤵
  PID:6324
- C:\Windows\System\dtpuQsZ.exe
  C:\Windows\System\dtpuQsZ.exe
  2⤵
  PID:6388
- C:\Windows\System\JCSNAxu.exe
  C:\Windows\System\JCSNAxu.exe
  2⤵
  PID:6456
- C:\Windows\System\hYziraz.exe
  C:\Windows\System\hYziraz.exe
  2⤵
  PID:6520
- C:\Windows\System\BAzkRsy.exe
  C:\Windows\System\BAzkRsy.exe
  2⤵
  PID:6552
- C:\Windows\System\hMYShDF.exe
  C:\Windows\System\hMYShDF.exe
  2⤵
  PID:6616
- C:\Windows\System\pdpKOPF.exe
  C:\Windows\System\pdpKOPF.exe
  2⤵
  PID:1808
- C:\Windows\System\XkRKgJp.exe
  C:\Windows\System\XkRKgJp.exe
  2⤵
  PID:6648
- C:\Windows\System\OnEeaFv.exe
  C:\Windows\System\OnEeaFv.exe
  2⤵
  PID:6712
- C:\Windows\System\pTVDSuP.exe
  C:\Windows\System\pTVDSuP.exe
  2⤵
  PID:6776
- C:\Windows\System\qSFxcAK.exe
  C:\Windows\System\qSFxcAK.exe
  2⤵
  PID:6840
- C:\Windows\System\WpBNjjC.exe
  C:\Windows\System\WpBNjjC.exe
  2⤵
  PID:6904
- C:\Windows\System\cbVLLci.exe
  C:\Windows\System\cbVLLci.exe
  2⤵
  PID:6968
- C:\Windows\System\aZopMzT.exe
  C:\Windows\System\aZopMzT.exe
  2⤵
  PID:7032
- C:\Windows\System\KITaIvI.exe
  C:\Windows\System\KITaIvI.exe
  2⤵
  PID:7096
- C:\Windows\System\AaMqvpK.exe
  C:\Windows\System\AaMqvpK.exe
  2⤵
  PID:7160
- C:\Windows\System\cABBxeB.exe
  C:\Windows\System\cABBxeB.exe
  2⤵
  PID:6360
- C:\Windows\System\LNSZbco.exe
  C:\Windows\System\LNSZbco.exe
  2⤵
  PID:7180
- C:\Windows\System\DrvCthf.exe
  C:\Windows\System\DrvCthf.exe
  2⤵
  PID:7196
- C:\Windows\System\wXVjZNn.exe
  C:\Windows\System\wXVjZNn.exe
  2⤵
  PID:7212
- C:\Windows\System\MCNvdXo.exe
  C:\Windows\System\MCNvdXo.exe
  2⤵
  PID:7228
- C:\Windows\System\aXPFQOp.exe
  C:\Windows\System\aXPFQOp.exe
  2⤵
  PID:7908
- C:\Windows\System\gIVzitF.exe
  C:\Windows\System\gIVzitF.exe
  2⤵
  PID:7924
- C:\Windows\System\HFYFAKY.exe
  C:\Windows\System\HFYFAKY.exe
  2⤵
  PID:7944
- C:\Windows\System\KSGMrNQ.exe
  C:\Windows\System\KSGMrNQ.exe
  2⤵
  PID:7960
- C:\Windows\System\aBtLpND.exe
  C:\Windows\System\aBtLpND.exe
  2⤵
  PID:7976
- C:\Windows\System\aIbPQPf.exe
  C:\Windows\System\aIbPQPf.exe
  2⤵
  PID:7992
- C:\Windows\System\nLKnavL.exe
  C:\Windows\System\nLKnavL.exe
  2⤵
  PID:8008
- C:\Windows\System\xbBcIYm.exe
  C:\Windows\System\xbBcIYm.exe
  2⤵
  PID:8176
- C:\Windows\System\cSIAEhs.exe
  C:\Windows\System\cSIAEhs.exe
  2⤵
  PID:3284
- C:\Windows\System\UYqCHRb.exe
  C:\Windows\System\UYqCHRb.exe
  2⤵
  PID:3448
- C:\Windows\System\RYgyeNR.exe
  C:\Windows\System\RYgyeNR.exe
  2⤵
  PID:3636
- C:\Windows\System\dHoGSIN.exe
  C:\Windows\System\dHoGSIN.exe
  2⤵
  PID:3700
- C:\Windows\System\jChtYAC.exe
  C:\Windows\System\jChtYAC.exe
  2⤵
  PID:3736
- C:\Windows\System\XUhvQqy.exe
  C:\Windows\System\XUhvQqy.exe
  2⤵
  PID:3828
- C:\Windows\System\KpGDtdQ.exe
  C:\Windows\System\KpGDtdQ.exe
  2⤵
  PID:3892
- C:\Windows\System\jPofhEw.exe
  C:\Windows\System\jPofhEw.exe
  2⤵
  PID:3956
- C:\Windows\System\NbMmjPz.exe
  C:\Windows\System\NbMmjPz.exe
  2⤵
  PID:4052
- C:\Windows\System\SRSOera.exe
  C:\Windows\System\SRSOera.exe
  2⤵
  PID:924
- C:\Windows\System\VgIyKUw.exe
  C:\Windows\System\VgIyKUw.exe
  2⤵
  PID:3300
- C:\Windows\System\TnIdAwt.exe
  C:\Windows\System\TnIdAwt.exe
  2⤵
  PID:3556
- C:\Windows\System\xTcyjMm.exe
  C:\Windows\System\xTcyjMm.exe
  2⤵
  PID:6516
- C:\Windows\System\FlCThTC.exe
  C:\Windows\System\FlCThTC.exe
  2⤵
  PID:7256
- C:\Windows\System\qzoMYzU.exe
  C:\Windows\System\qzoMYzU.exe
  2⤵
  PID:7272
- C:\Windows\System\YvNFGLm.exe
  C:\Windows\System\YvNFGLm.exe
  2⤵
  PID:7288
- C:\Windows\System\cExxEUr.exe
  C:\Windows\System\cExxEUr.exe
  2⤵
  PID:7304
- C:\Windows\System\WRCeAXN.exe
  C:\Windows\System\WRCeAXN.exe
  2⤵
  PID:7320
- C:\Windows\System\FHsROxd.exe
  C:\Windows\System\FHsROxd.exe
  2⤵
  PID:7336
- C:\Windows\System\RbqRPIo.exe
  C:\Windows\System\RbqRPIo.exe
  2⤵
  PID:7352
- C:\Windows\System\XEDahWs.exe
  C:\Windows\System\XEDahWs.exe
  2⤵
  PID:7368
- C:\Windows\System\wKuZWyd.exe
  C:\Windows\System\wKuZWyd.exe
  2⤵
  PID:7384
- C:\Windows\System\fhOjxlv.exe
  C:\Windows\System\fhOjxlv.exe
  2⤵
  PID:7400
- C:\Windows\System\UvknSoe.exe
  C:\Windows\System\UvknSoe.exe
  2⤵
  PID:7416
- C:\Windows\System\BZaZBsk.exe
  C:\Windows\System\BZaZBsk.exe
  2⤵
  PID:7432
- C:\Windows\System\oaMNWef.exe
  C:\Windows\System\oaMNWef.exe
  2⤵
  PID:7448
- C:\Windows\System\rKuVjAt.exe
  C:\Windows\System\rKuVjAt.exe
  2⤵
  PID:7464
- C:\Windows\System\SjVxtRL.exe
  C:\Windows\System\SjVxtRL.exe
  2⤵
  PID:7480
- C:\Windows\System\KKtipuJ.exe
  C:\Windows\System\KKtipuJ.exe
  2⤵
  PID:7500
- C:\Windows\System\SpXrjgp.exe
  C:\Windows\System\SpXrjgp.exe
  2⤵
  PID:7516
- C:\Windows\System\lpGDZRo.exe
  C:\Windows\System\lpGDZRo.exe
  2⤵
  PID:7532
- C:\Windows\System\FNyMvIl.exe
  C:\Windows\System\FNyMvIl.exe
  2⤵
  PID:7548
- C:\Windows\System\XVmxCwc.exe
  C:\Windows\System\XVmxCwc.exe
  2⤵
  PID:7564
- C:\Windows\System\dpNDZaD.exe
  C:\Windows\System\dpNDZaD.exe
  2⤵
  PID:7580
- C:\Windows\System\poAMUcm.exe
  C:\Windows\System\poAMUcm.exe
  2⤵
  PID:7596
- C:\Windows\System\tDIzQaa.exe
  C:\Windows\System\tDIzQaa.exe
  2⤵
  PID:7612
- C:\Windows\System\IgkQHpy.exe
  C:\Windows\System\IgkQHpy.exe
  2⤵
  PID:7676
- C:\Windows\System\agnafWV.exe
  C:\Windows\System\agnafWV.exe
  2⤵
  PID:7692
- C:\Windows\System\SpLsGhD.exe
  C:\Windows\System\SpLsGhD.exe
  2⤵
  PID:7708
- C:\Windows\System\lwOVsco.exe
  C:\Windows\System\lwOVsco.exe
  2⤵
  PID:7724
- C:\Windows\System\QcbfoZw.exe
  C:\Windows\System\QcbfoZw.exe
  2⤵
  PID:7740
- C:\Windows\System\ggTapUp.exe
  C:\Windows\System\ggTapUp.exe
  2⤵
  PID:7756
- C:\Windows\System\xNHYRFt.exe
  C:\Windows\System\xNHYRFt.exe
  2⤵
  PID:7776
- C:\Windows\System\PTTqyaK.exe
  C:\Windows\System\PTTqyaK.exe
  2⤵
  PID:7788
- C:\Windows\System\KOuSYaS.exe
  C:\Windows\System\KOuSYaS.exe
  2⤵
  PID:7804
- C:\Windows\System\eNogRth.exe
  C:\Windows\System\eNogRth.exe
  2⤵
  PID:7820
- C:\Windows\System\prBvgnY.exe
  C:\Windows\System\prBvgnY.exe
  2⤵
  PID:7836
- C:\Windows\System\HdYbdmZ.exe
  C:\Windows\System\HdYbdmZ.exe
  2⤵
  PID:7852
- C:\Windows\System\irKsZwX.exe
  C:\Windows\System\irKsZwX.exe
  2⤵
  PID:7868
- C:\Windows\System\onJtePG.exe
  C:\Windows\System\onJtePG.exe
  2⤵
  PID:4660
- C:\Windows\System\HCvZFns.exe
  C:\Windows\System\HCvZFns.exe
  2⤵
  PID:4888
- C:\Windows\System\iUzRHat.exe
  C:\Windows\System\iUzRHat.exe
  2⤵
  PID:5012
- C:\Windows\System\CnhxmWa.exe
  C:\Windows\System\CnhxmWa.exe
  2⤵
  PID:3624
- C:\Windows\System\iCuuCRw.exe
  C:\Windows\System\iCuuCRw.exe
  2⤵
  PID:4612
- C:\Windows\System\DRPOKxk.exe
  C:\Windows\System\DRPOKxk.exe
  2⤵
  PID:5060
- C:\Windows\System\UnjogHQ.exe
  C:\Windows\System\UnjogHQ.exe
  2⤵
  PID:5256
- C:\Windows\System\hbEEIHc.exe
  C:\Windows\System\hbEEIHc.exe
  2⤵
  PID:5548
- C:\Windows\System\kUmWrlu.exe
  C:\Windows\System\kUmWrlu.exe
  2⤵
  PID:5744
- C:\Windows\System\yNnRKzB.exe
  C:\Windows\System\yNnRKzB.exe
  2⤵
  PID:5904
- C:\Windows\System\XjlTJWA.exe
  C:\Windows\System\XjlTJWA.exe
  2⤵
  PID:4676
- C:\Windows\System\xozQALe.exe
  C:\Windows\System\xozQALe.exe
  2⤵
  PID:5404
- C:\Windows\System\qqXoTfM.exe
  C:\Windows\System\qqXoTfM.exe
  2⤵
  PID:336
- C:\Windows\System\ryCFwvF.exe
  C:\Windows\System\ryCFwvF.exe
  2⤵
  PID:1228
- C:\Windows\System\tvXxLKN.exe
  C:\Windows\System\tvXxLKN.exe
  2⤵
  PID:6180
- C:\Windows\System\dapzeRZ.exe
  C:\Windows\System\dapzeRZ.exe
  2⤵
  PID:6644
- C:\Windows\System\lPDDSEa.exe
  C:\Windows\System\lPDDSEa.exe
  2⤵
  PID:6900
- C:\Windows\System\zhVZEPS.exe
  C:\Windows\System\zhVZEPS.exe
  2⤵
  PID:7156
- C:\Windows\System\tSTWGiq.exe
  C:\Windows\System\tSTWGiq.exe
  2⤵
  PID:7208
- C:\Windows\System\kJNElmC.exe
  C:\Windows\System\kJNElmC.exe
  2⤵
  PID:4260
- C:\Windows\System\viwFSnk.exe
  C:\Windows\System\viwFSnk.exe
  2⤵
  PID:7896
- C:\Windows\System\twuwKYt.exe
  C:\Windows\System\twuwKYt.exe
  2⤵
  PID:8004
- C:\Windows\System\ZwjCKXZ.exe
  C:\Windows\System\ZwjCKXZ.exe
  2⤵
  PID:3016
- C:\Windows\System\RpjuBZn.exe
  C:\Windows\System\RpjuBZn.exe
  2⤵
  PID:1680
- C:\Windows\System\ltOWPBJ.exe
  C:\Windows\System\ltOWPBJ.exe
  2⤵
  PID:4868
- C:\Windows\System\mpkJyQD.exe
  C:\Windows\System\mpkJyQD.exe
  2⤵
  PID:7988
- C:\Windows\System\HodGAjj.exe
  C:\Windows\System\HodGAjj.exe
  2⤵
  PID:3816
- C:\Windows\System\AgBLOSp.exe
  C:\Windows\System\AgBLOSp.exe
  2⤵
  PID:4036
- C:\Windows\System\ZRcIouu.exe
  C:\Windows\System\ZRcIouu.exe
  2⤵
  PID:4152
- C:\Windows\System\NmDAKwm.exe
  C:\Windows\System\NmDAKwm.exe
  2⤵
  PID:4216
- C:\Windows\System\eINpctH.exe
  C:\Windows\System\eINpctH.exe
  2⤵
  PID:4280
- C:\Windows\System\kDJlCiz.exe
  C:\Windows\System\kDJlCiz.exe
  2⤵
  PID:4344
- C:\Windows\System\OOBTeHp.exe
  C:\Windows\System\OOBTeHp.exe
  2⤵
  PID:6424
- C:\Windows\System\hsOOpiY.exe
  C:\Windows\System\hsOOpiY.exe
  2⤵
  PID:6680
- C:\Windows\System\EiwLXYi.exe
  C:\Windows\System\EiwLXYi.exe
  2⤵
  PID:4440
- C:\Windows\System\VCPGwdY.exe
  C:\Windows\System\VCPGwdY.exe
  2⤵
  PID:4504
- C:\Windows\System\eIuVkXF.exe
  C:\Windows\System\eIuVkXF.exe
  2⤵
  PID:4568
- C:\Windows\System\ozoRoxW.exe
  C:\Windows\System\ozoRoxW.exe
  2⤵
  PID:4632
- C:\Windows\System\oaiuunX.exe
  C:\Windows\System\oaiuunX.exe
  2⤵
  PID:4728
- C:\Windows\System\ZHbXIZU.exe
  C:\Windows\System\ZHbXIZU.exe
  2⤵
  PID:4792
- C:\Windows\System\QTYZYUA.exe
  C:\Windows\System\QTYZYUA.exe
  2⤵
  PID:4488
- C:\Windows\System\AlKtZuA.exe
  C:\Windows\System\AlKtZuA.exe
  2⤵
  PID:2044
- C:\Windows\System\vBSODXq.exe
  C:\Windows\System\vBSODXq.exe
  2⤵
  PID:5484
- C:\Windows\System\Kauhavd.exe
  C:\Windows\System\Kauhavd.exe
  2⤵
  PID:5552
- C:\Windows\System\HNKzEeb.exe
  C:\Windows\System\HNKzEeb.exe
  2⤵
  PID:5652
- C:\Windows\System\RQdKIDu.exe
  C:\Windows\System\RQdKIDu.exe
  2⤵
  PID:5748
- C:\Windows\System\npZJOzy.exe
  C:\Windows\System\npZJOzy.exe
  2⤵
  PID:5844
- C:\Windows\System\ENSFlas.exe
  C:\Windows\System\ENSFlas.exe
  2⤵
  PID:5940
- C:\Windows\System\BjbcHAj.exe
  C:\Windows\System\BjbcHAj.exe
  2⤵
  PID:6036
- C:\Windows\System\YzAtLNF.exe
  C:\Windows\System\YzAtLNF.exe
  2⤵
  PID:6100
- C:\Windows\System\LgfqDfN.exe
  C:\Windows\System\LgfqDfN.exe
  2⤵
  PID:5308
- C:\Windows\System\grRPELk.exe
  C:\Windows\System\grRPELk.exe
  2⤵
  PID:1132
- C:\Windows\System\QRvjhAp.exe
  C:\Windows\System\QRvjhAp.exe
  2⤵
  PID:6212
- C:\Windows\System\LKwBOgN.exe
  C:\Windows\System\LKwBOgN.exe
  2⤵
  PID:6312
- C:\Windows\System\nmpSeSi.exe
  C:\Windows\System\nmpSeSi.exe
  2⤵
  PID:6376
- C:\Windows\System\qFWqRyV.exe
  C:\Windows\System\qFWqRyV.exe
  2⤵
  PID:6440
- C:\Windows\System\bEJjHDY.exe
  C:\Windows\System\bEJjHDY.exe
  2⤵
  PID:4616
- C:\Windows\System\pxdvumK.exe
  C:\Windows\System\pxdvumK.exe
  2⤵
  PID:5392
- C:\Windows\System\XIXYrfw.exe
  C:\Windows\System\XIXYrfw.exe
  2⤵
  PID:6504
- C:\Windows\System\BwDRRjh.exe
  C:\Windows\System\BwDRRjh.exe
  2⤵
  PID:6568
- C:\Windows\System\jGyrirq.exe
  C:\Windows\System\jGyrirq.exe
  2⤵
  PID:6632
- C:\Windows\System\QmKADSR.exe
  C:\Windows\System\QmKADSR.exe
  2⤵
  PID:6696
- C:\Windows\System\BVRLfQx.exe
  C:\Windows\System\BVRLfQx.exe
  2⤵
  PID:6760
- C:\Windows\System\qzABYra.exe
  C:\Windows\System\qzABYra.exe
  2⤵
  PID:7224
- C:\Windows\System\FjUpzSQ.exe
  C:\Windows\System\FjUpzSQ.exe
  2⤵
  PID:7092
- C:\Windows\System\zFwnuvc.exe
  C:\Windows\System\zFwnuvc.exe
  2⤵
  PID:6852
- C:\Windows\System\fhyyKSH.exe
  C:\Windows\System\fhyyKSH.exe
  2⤵
  PID:6948
- C:\Windows\System\udiAMus.exe
  C:\Windows\System\udiAMus.exe
  2⤵
  PID:7012
- C:\Windows\System\rXziHfD.exe
  C:\Windows\System\rXziHfD.exe
  2⤵
  PID:7076
- C:\Windows\System\pFhnJgQ.exe
  C:\Windows\System\pFhnJgQ.exe
  2⤵
  PID:7140
- C:\Windows\System\JIUBqxu.exe
  C:\Windows\System\JIUBqxu.exe
  2⤵
  PID:6168
- C:\Windows\System\zUSehTR.exe
  C:\Windows\System\zUSehTR.exe
  2⤵
  PID:8020
- C:\Windows\System\oeBripx.exe
  C:\Windows\System\oeBripx.exe
  2⤵
  PID:8036
- C:\Windows\System\uUEhAWa.exe
  C:\Windows\System\uUEhAWa.exe
  2⤵
  PID:8052
- C:\Windows\System\cRhBnya.exe
  C:\Windows\System\cRhBnya.exe
  2⤵
  PID:8104
- C:\Windows\System\hJspXuy.exe
  C:\Windows\System\hJspXuy.exe
  2⤵
  PID:1660
- C:\Windows\System\tnVmWnl.exe
  C:\Windows\System\tnVmWnl.exe
  2⤵
  PID:2572
- C:\Windows\System\PifuZNH.exe
  C:\Windows\System\PifuZNH.exe
  2⤵
  PID:5080
- C:\Windows\System\LvACOiY.exe
  C:\Windows\System\LvACOiY.exe
  2⤵
  PID:5924
- C:\Windows\System\erELLQl.exe
  C:\Windows\System\erELLQl.exe
  2⤵
  PID:5244
- C:\Windows\System\bHtKTmL.exe
  C:\Windows\System\bHtKTmL.exe
  2⤵
  PID:5636
- C:\Windows\System\XaNMJzV.exe
  C:\Windows\System\XaNMJzV.exe
  2⤵
  PID:6248
- C:\Windows\System\nmKMzGS.exe
  C:\Windows\System\nmKMzGS.exe
  2⤵
  PID:2304
- C:\Windows\System\fXQinhy.exe
  C:\Windows\System\fXQinhy.exe
  2⤵
  PID:7984
- C:\Windows\System\BKNCUym.exe
  C:\Windows\System\BKNCUym.exe
  2⤵
  PID:8072
- C:\Windows\System\wwojdGV.exe
  C:\Windows\System\wwojdGV.exe
  2⤵
  PID:8088
- C:\Windows\System\npwuaPw.exe
  C:\Windows\System\npwuaPw.exe
  2⤵
  PID:7064
- C:\Windows\System\NYyQUha.exe
  C:\Windows\System\NYyQUha.exe
  2⤵
  PID:8120
- C:\Windows\System\zZCtBLr.exe
  C:\Windows\System\zZCtBLr.exe
  2⤵
  PID:8136
- C:\Windows\System\xMHkbfO.exe
  C:\Windows\System\xMHkbfO.exe
  2⤵
  PID:8152
- C:\Windows\System\uhjcKpU.exe
  C:\Windows\System\uhjcKpU.exe
  2⤵
  PID:8168
- C:\Windows\System\wvAMwRV.exe
  C:\Windows\System\wvAMwRV.exe
  2⤵
  PID:1784
- C:\Windows\System\nEJVXjT.exe
  C:\Windows\System\nEJVXjT.exe
  2⤵
  PID:2388
- C:\Windows\System\gpmWSpt.exe
  C:\Windows\System\gpmWSpt.exe
  2⤵
  PID:2724
- C:\Windows\System\rQgBqgR.exe
  C:\Windows\System\rQgBqgR.exe
  2⤵
  PID:1820
- C:\Windows\System\IXajWnd.exe
  C:\Windows\System\IXajWnd.exe
  2⤵
  PID:2228
- C:\Windows\System\BJozxRk.exe
  C:\Windows\System\BJozxRk.exe
  2⤵
  PID:2124
- C:\Windows\System\mUvmgMg.exe
  C:\Windows\System\mUvmgMg.exe
  2⤵
  PID:1468
- C:\Windows\System\niHIRQh.exe
  C:\Windows\System\niHIRQh.exe
  2⤵
  PID:1608
- C:\Windows\System\NrKVvRF.exe
  C:\Windows\System\NrKVvRF.exe
  2⤵
  PID:1444
- C:\Windows\System\ymhmstG.exe
  C:\Windows\System\ymhmstG.exe
  2⤵
  PID:1640
- C:\Windows\System\sRataUQ.exe
  C:\Windows\System\sRataUQ.exe
  2⤵
  PID:2540
- C:\Windows\System\KUuiiQZ.exe
  C:\Windows\System\KUuiiQZ.exe
  2⤵
  PID:1756
- C:\Windows\System\BPaggRi.exe
  C:\Windows\System\BPaggRi.exe
  2⤵
  PID:2152
- C:\Windows\System\MVZvsRq.exe
  C:\Windows\System\MVZvsRq.exe
  2⤵
  PID:1552
- C:\Windows\System\AMZJaSL.exe
  C:\Windows\System\AMZJaSL.exe
  2⤵
  PID:1616
- C:\Windows\System\fgFMWho.exe
  C:\Windows\System\fgFMWho.exe
  2⤵
  PID:2448
- C:\Windows\System\DdDMzdW.exe
  C:\Windows\System\DdDMzdW.exe
  2⤵
  PID:1224
- C:\Windows\System\eAECpFN.exe
  C:\Windows\System\eAECpFN.exe
  2⤵
  PID:1576
- C:\Windows\System\JdUIdXz.exe
  C:\Windows\System\JdUIdXz.exe
  2⤵
  PID:2160
- C:\Windows\System\oMEasnQ.exe
  C:\Windows\System\oMEasnQ.exe
  2⤵
  PID:2984
- C:\Windows\System\RbXaGrY.exe
  C:\Windows\System\RbXaGrY.exe
  2⤵
  PID:3316
- C:\Windows\System\QShyOyJ.exe
  C:\Windows\System\QShyOyJ.exe
  2⤵
  PID:2144
- C:\Windows\System\oVkxagH.exe
  C:\Windows\System\oVkxagH.exe
  2⤵
  PID:3508
- C:\Windows\System\nKfjvoX.exe
  C:\Windows\System\nKfjvoX.exe
  2⤵
  PID:3540
- C:\Windows\System\OtWeOfv.exe
  C:\Windows\System\OtWeOfv.exe
  2⤵
  PID:3604
- C:\Windows\System\khlFTMq.exe
  C:\Windows\System\khlFTMq.exe
  2⤵
  PID:3764
- C:\Windows\System\PBenQln.exe
  C:\Windows\System\PBenQln.exe
  2⤵
  PID:4024
- C:\Windows\System\mwukYMQ.exe
  C:\Windows\System\mwukYMQ.exe
  2⤵
  PID:3992
- C:\Windows\System\gPNzHza.exe
  C:\Windows\System\gPNzHza.exe
  2⤵
  PID:7268
- C:\Windows\System\hhgnWeh.exe
  C:\Windows\System\hhgnWeh.exe
  2⤵
  PID:1632
- C:\Windows\System\qMVrGlE.exe
  C:\Windows\System\qMVrGlE.exe
  2⤵
  PID:3800
- C:\Windows\System\WqnwSeQ.exe
  C:\Windows\System\WqnwSeQ.exe
  2⤵
  PID:3428
- C:\Windows\System\GVZMJdc.exe
  C:\Windows\System\GVZMJdc.exe
  2⤵
  PID:7252
- C:\Windows\System\ZbCPaqD.exe
  C:\Windows\System\ZbCPaqD.exe
  2⤵
  PID:7360
- C:\Windows\System\WGULwAY.exe
  C:\Windows\System\WGULwAY.exe
  2⤵
  PID:7424
- C:\Windows\System\khdjBXt.exe
  C:\Windows\System\khdjBXt.exe
  2⤵
  PID:7348
- C:\Windows\System\pkTwYyc.exe
  C:\Windows\System\pkTwYyc.exe
  2⤵
  PID:7412
- C:\Windows\System\aQPMlQE.exe
  C:\Windows\System\aQPMlQE.exe
  2⤵
  PID:7488
- C:\Windows\System\JCtOPvw.exe
  C:\Windows\System\JCtOPvw.exe
  2⤵
  PID:7444
- C:\Windows\System\ogVtCtg.exe
  C:\Windows\System\ogVtCtg.exe
  2⤵
  PID:7508
- C:\Windows\System\JZSkvrb.exe
  C:\Windows\System\JZSkvrb.exe
  2⤵
  PID:7540
- C:\Windows\System\OoPbUBO.exe
  C:\Windows\System\OoPbUBO.exe
  2⤵
  PID:7576
- C:\Windows\System\HeIydzz.exe
  C:\Windows\System\HeIydzz.exe
  2⤵
  PID:7624
- C:\Windows\System\gvEfgwI.exe
  C:\Windows\System\gvEfgwI.exe
  2⤵
  PID:7636
- C:\Windows\System\NHltkCB.exe
  C:\Windows\System\NHltkCB.exe
  2⤵
  PID:7652
- C:\Windows\System\zUYqzIb.exe
  C:\Windows\System\zUYqzIb.exe
  2⤵
  PID:7668
- C:\Windows\System\AuYRdOo.exe
  C:\Windows\System\AuYRdOo.exe
  2⤵
  PID:7688
- C:\Windows\System\llJMEBf.exe
  C:\Windows\System\llJMEBf.exe
  2⤵
  PID:2132
- C:\Windows\System\kqDOeuj.exe
  C:\Windows\System\kqDOeuj.exe
  2⤵
  PID:5420
- C:\Windows\System\tQiztIk.exe
  C:\Windows\System\tQiztIk.exe
  2⤵
  PID:7800
- C:\Windows\System\qotQOfi.exe
  C:\Windows\System\qotQOfi.exe
  2⤵
  PID:7832
- C:\Windows\System\eFEUpzo.exe
  C:\Windows\System\eFEUpzo.exe
  2⤵
  PID:3812
- C:\Windows\System\WNbGISo.exe
  C:\Windows\System\WNbGISo.exe
  2⤵
  PID:4948
- C:\Windows\System\YgvrRHj.exe
  C:\Windows\System\YgvrRHj.exe
  2⤵
  PID:5108
- C:\Windows\System\UhYCqUI.exe
  C:\Windows\System\UhYCqUI.exe
  2⤵
  PID:7796
- C:\Windows\System\GSOTqaB.exe
  C:\Windows\System\GSOTqaB.exe
  2⤵
  PID:7752
- C:\Windows\System\oMGFwFv.exe
  C:\Windows\System\oMGFwFv.exe
  2⤵
  PID:5452
- C:\Windows\System\jKgIFut.exe
  C:\Windows\System\jKgIFut.exe
  2⤵
  PID:6128
- C:\Windows\System\SxaZSDX.exe
  C:\Windows\System\SxaZSDX.exe
  2⤵
  PID:2700
- C:\Windows\System\QsZZJNb.exe
  C:\Windows\System\QsZZJNb.exe
  2⤵
  PID:4388
- C:\Windows\System\lVKcuZY.exe
  C:\Windows\System\lVKcuZY.exe
  2⤵
  PID:5792
- C:\Windows\System\FjLKpLk.exe
  C:\Windows\System\FjLKpLk.exe
  2⤵
  PID:7176
- C:\Windows\System\xvMbrCO.exe
  C:\Windows\System\xvMbrCO.exe
  2⤵
  PID:6772
- C:\Windows\System\uUmlKCT.exe
  C:\Windows\System\uUmlKCT.exe
  2⤵
  PID:7940
- C:\Windows\System\dxexPuB.exe
  C:\Windows\System\dxexPuB.exe
  2⤵
  PID:2676
- C:\Windows\System\uGJzpQN.exe
  C:\Windows\System\uGJzpQN.exe
  2⤵
  PID:2516
- C:\Windows\System\Smuqvok.exe
  C:\Windows\System\Smuqvok.exe
  2⤵
  PID:6936
- C:\Windows\System\EThBMIb.exe
  C:\Windows\System\EThBMIb.exe
  2⤵
  PID:2072
- C:\Windows\System\TFnLTjW.exe
  C:\Windows\System\TFnLTjW.exe
  2⤵
  PID:4008
- C:\Windows\System\skrtOvh.exe
  C:\Windows\System\skrtOvh.exe
  2⤵
  PID:4276
- C:\Windows\System\lbOXzPQ.exe
  C:\Windows\System\lbOXzPQ.exe
  2⤵
  PID:4436
- C:\Windows\System\ZTLWADw.exe
  C:\Windows\System\ZTLWADw.exe
  2⤵
  PID:4312
- C:\Windows\System\mrrpVfe.exe
  C:\Windows\System\mrrpVfe.exe
  2⤵
  PID:4920
- C:\Windows\System\jGeqZIn.exe
  C:\Windows\System\jGeqZIn.exe
  2⤵
  PID:684
- C:\Windows\System\gMprNJY.exe
  C:\Windows\System\gMprNJY.exe
  2⤵
  PID:4628
- C:\Windows\System\yZhRupj.exe
  C:\Windows\System\yZhRupj.exe
  2⤵
  PID:5520
- C:\Windows\System\JANOFjE.exe
  C:\Windows\System\JANOFjE.exe
  2⤵
  PID:5684
- C:\Windows\System\XMyoiac.exe
  C:\Windows\System\XMyoiac.exe
  2⤵
  PID:5936
- C:\Windows\System\odKpLqX.exe
  C:\Windows\System\odKpLqX.exe
  2⤵
  PID:6276
- C:\Windows\System\EgrEUCQ.exe
  C:\Windows\System\EgrEUCQ.exe
  2⤵
  PID:6408
- C:\Windows\System\SshDnzz.exe
  C:\Windows\System\SshDnzz.exe
  2⤵
  PID:5260
- C:\Windows\System\TGAlBFL.exe
  C:\Windows\System\TGAlBFL.exe
  2⤵
  PID:6344
- C:\Windows\System\ELAvkOO.exe
  C:\Windows\System\ELAvkOO.exe
  2⤵
  PID:6004
- C:\Windows\System\yCBLPBS.exe
  C:\Windows\System\yCBLPBS.exe
  2⤵
  PID:5296
- C:\Windows\System\pKsSxzF.exe
  C:\Windows\System\pKsSxzF.exe
  2⤵
  PID:6664
- C:\Windows\System\HmzOQee.exe
  C:\Windows\System\HmzOQee.exe
  2⤵
  PID:6500
- C:\Windows\System\eKuGFbD.exe
  C:\Windows\System\eKuGFbD.exe
  2⤵
  PID:6756
- C:\Windows\System\oaYOEXf.exe
  C:\Windows\System\oaYOEXf.exe
  2⤵
  PID:6964
- C:\Windows\System\RqZdbkj.exe
  C:\Windows\System\RqZdbkj.exe
  2⤵
  PID:7048
- C:\Windows\System\GwWLEYL.exe
  C:\Windows\System\GwWLEYL.exe
  2⤵
  PID:6820
- C:\Windows\System\LkogYWe.exe
  C:\Windows\System\LkogYWe.exe
  2⤵
  PID:6420
- C:\Windows\System\YdBdaQA.exe
  C:\Windows\System\YdBdaQA.exe
  2⤵
  PID:8188
- C:\Windows\System\dGRiLOk.exe
  C:\Windows\System\dGRiLOk.exe
  2⤵
  PID:2288
- C:\Windows\System\rHkFrpF.exe
  C:\Windows\System\rHkFrpF.exe
  2⤵
  PID:1260
- C:\Windows\System\BiMuKdu.exe
  C:\Windows\System\BiMuKdu.exe
  2⤵
  PID:8064
- C:\Windows\System\BGYavNe.exe
  C:\Windows\System\BGYavNe.exe
  2⤵
  PID:5796
- C:\Windows\System\xJfzJsJ.exe
  C:\Windows\System\xJfzJsJ.exe
  2⤵
  PID:2536
- C:\Windows\System\RLNOeyE.exe
  C:\Windows\System\RLNOeyE.exe
  2⤵
  PID:8080
- C:\Windows\System\IXCACxC.exe
  C:\Windows\System\IXCACxC.exe
  2⤵
  PID:8112
- C:\Windows\System\JbEkOEJ.exe
  C:\Windows\System\JbEkOEJ.exe
  2⤵
  PID:8128
- C:\Windows\System\RKmdiPY.exe
  C:\Windows\System\RKmdiPY.exe
  2⤵
  PID:2420
- C:\Windows\System\zKHpNGf.exe
  C:\Windows\System\zKHpNGf.exe
  2⤵
  PID:3056
- C:\Windows\System\BLEZgBM.exe
  C:\Windows\System\BLEZgBM.exe
  2⤵
  PID:1296
- C:\Windows\System\MHEDQoA.exe
  C:\Windows\System\MHEDQoA.exe
  2⤵
  PID:1776
- C:\Windows\System\BZtQAFL.exe
  C:\Windows\System\BZtQAFL.exe
  2⤵
  PID:2332
- C:\Windows\System\yoCcohV.exe
  C:\Windows\System\yoCcohV.exe
  2⤵
  PID:1752
- C:\Windows\System\ZoXzLEd.exe
  C:\Windows\System\ZoXzLEd.exe
  2⤵
  PID:5588
- C:\Windows\System\RSqtpgm.exe
  C:\Windows\System\RSqtpgm.exe
  2⤵
  PID:2980
- C:\Windows\System\yWUrwQn.exe
  C:\Windows\System\yWUrwQn.exe
  2⤵
  PID:1604
- C:\Windows\System\SswcBCs.exe
  C:\Windows\System\SswcBCs.exe
  2⤵
  PID:476
- C:\Windows\System\cDGCqTe.exe
  C:\Windows\System\cDGCqTe.exe
  2⤵
  PID:2404
- C:\Windows\System\FlyJyLC.exe
  C:\Windows\System\FlyJyLC.exe
  2⤵
  PID:3572
- C:\Windows\System\bKpjgEB.exe
  C:\Windows\System\bKpjgEB.exe
  2⤵
  PID:3688
- C:\Windows\System\yPaNXHX.exe
  C:\Windows\System\yPaNXHX.exe
  2⤵
  PID:3416
- C:\Windows\System\pmPlGsd.exe
  C:\Windows\System\pmPlGsd.exe
  2⤵
  PID:3684
- C:\Windows\System\EOWxrNR.exe
  C:\Windows\System\EOWxrNR.exe
  2⤵
  PID:3796
- C:\Windows\System\iImWQIh.exe
  C:\Windows\System\iImWQIh.exe
  2⤵
  PID:7332
- C:\Windows\System\NzinFfp.exe
  C:\Windows\System\NzinFfp.exe
  2⤵
  PID:7428
- C:\Windows\System\roWRTuc.exe
  C:\Windows\System\roWRTuc.exe
  2⤵
  PID:7588
- C:\Windows\System\ognFSJz.exe
  C:\Windows\System\ognFSJz.exe
  2⤵
  PID:7396
- C:\Windows\System\qBWsdKx.exe
  C:\Windows\System\qBWsdKx.exe
  2⤵
  PID:7476
- C:\Windows\System\IlLNXLV.exe
  C:\Windows\System\IlLNXLV.exe
  2⤵
  PID:7592
- C:\Windows\System\UfsMZbA.exe
  C:\Windows\System\UfsMZbA.exe
  2⤵
  PID:7648
- C:\Windows\System\KPwpJjz.exe
  C:\Windows\System\KPwpJjz.exe
  2⤵
  PID:7664
- C:\Windows\System\sfmiEtw.exe
  C:\Windows\System\sfmiEtw.exe
  2⤵
  PID:7748
- C:\Windows\System\HilVfDY.exe
  C:\Windows\System\HilVfDY.exe
  2⤵
  PID:7492
- C:\Windows\System\PFsiLef.exe
  C:\Windows\System\PFsiLef.exe
  2⤵
  PID:2756
- C:\Windows\System\BQlccaB.exe
  C:\Windows\System\BQlccaB.exe
  2⤵
  PID:7780
- C:\Windows\System\JrbuBLp.exe
  C:\Windows\System\JrbuBLp.exe
  2⤵
  PID:4232
- C:\Windows\System\jAvQPTb.exe
  C:\Windows\System\jAvQPTb.exe
  2⤵
  PID:7028
- C:\Windows\System\cLKwaPp.exe
  C:\Windows\System\cLKwaPp.exe
  2⤵
  PID:7936
- C:\Windows\System\QxtuNha.exe
  C:\Windows\System\QxtuNha.exe
  2⤵
  PID:984
- C:\Windows\System\OPRxuym.exe
  C:\Windows\System\OPRxuym.exe
  2⤵
  PID:4248
- C:\Windows\System\nVHJNgN.exe
  C:\Windows\System\nVHJNgN.exe
  2⤵
  PID:4788
- C:\Windows\System\ROIwGDl.exe
  C:\Windows\System\ROIwGDl.exe
  2⤵
  PID:5908
- C:\Windows\System\rRuPhpx.exe
  C:\Windows\System\rRuPhpx.exe
  2⤵
  PID:6372
- C:\Windows\System\VqDpypI.exe
  C:\Windows\System\VqDpypI.exe
  2⤵
  PID:6232
- C:\Windows\System\WGejBEl.exe
  C:\Windows\System\WGejBEl.exe
  2⤵
  PID:8048
- C:\Windows\System\EtFTGqi.exe
  C:\Windows\System\EtFTGqi.exe
  2⤵
  PID:5160
- C:\Windows\System\zSbhtEC.exe
  C:\Windows\System\zSbhtEC.exe
  2⤵
  PID:7968
- C:\Windows\System\YGcbZFj.exe
  C:\Windows\System\YGcbZFj.exe
  2⤵
  PID:4404
- C:\Windows\System\CMUyltE.exe
  C:\Windows\System\CMUyltE.exe
  2⤵
  PID:5700
- C:\Windows\System\zaJucUo.exe
  C:\Windows\System\zaJucUo.exe
  2⤵
  PID:6628
- C:\Windows\System\HRffTGS.exe
  C:\Windows\System\HRffTGS.exe
  2⤵
  PID:4472
- C:\Windows\System\rZzanDR.exe
  C:\Windows\System\rZzanDR.exe
  2⤵
  PID:5812
- C:\Windows\System\GvPtZuy.exe
  C:\Windows\System\GvPtZuy.exe
  2⤵
  PID:2748
- C:\Windows\System\bqxFkRn.exe
  C:\Windows\System\bqxFkRn.exe
  2⤵
  PID:7108
- C:\Windows\System\ivltxjN.exe
  C:\Windows\System\ivltxjN.exe
  2⤵
  PID:1492
- C:\Windows\System\VlSIdSS.exe
  C:\Windows\System\VlSIdSS.exe
  2⤵
  PID:3236
- C:\Windows\System\BLPxjWm.exe
  C:\Windows\System\BLPxjWm.exe
  2⤵
  PID:8148
- C:\Windows\System\KGzrvYj.exe
  C:\Windows\System\KGzrvYj.exe
  2⤵
  PID:8132
- C:\Windows\System\EOpDUiV.exe
  C:\Windows\System\EOpDUiV.exe
  2⤵
  PID:1700
- C:\Windows\System\jauvvlv.exe
  C:\Windows\System\jauvvlv.exe
  2⤵
  PID:2672
- C:\Windows\System\RPGEBBR.exe
  C:\Windows\System\RPGEBBR.exe
  2⤵
  PID:2528
- C:\Windows\System\jdvLBKd.exe
  C:\Windows\System\jdvLBKd.exe
  2⤵
  PID:1464
- C:\Windows\System\OZMzbNs.exe
  C:\Windows\System\OZMzbNs.exe
  2⤵
  PID:1856
- C:\Windows\System\iuugxFi.exe
  C:\Windows\System\iuugxFi.exe
  2⤵
  PID:7660
- C:\Windows\System\NnYRJGM.exe
  C:\Windows\System\NnYRJGM.exe
  2⤵
  PID:7864
- C:\Windows\System\KrpNtet.exe
  C:\Windows\System\KrpNtet.exe
  2⤵
  PID:4500
- C:\Windows\System\kOpOhKY.exe
  C:\Windows\System\kOpOhKY.exe
  2⤵
  PID:5600
- C:\Windows\System\torONQu.exe
  C:\Windows\System\torONQu.exe
  2⤵
  PID:6148
- C:\Windows\System\nqjWezz.exe
  C:\Windows\System\nqjWezz.exe
  2⤵
  PID:5132
- C:\Windows\System\eJMMVWS.exe
  C:\Windows\System\eJMMVWS.exe
  2⤵
  PID:1352
- C:\Windows\System\PJBoHCr.exe
  C:\Windows\System\PJBoHCr.exe
  2⤵
  PID:7716
- C:\Windows\System\nliIucI.exe
  C:\Windows\System\nliIucI.exe
  2⤵
  PID:7632
- C:\Windows\System\jZwAqWE.exe
  C:\Windows\System\jZwAqWE.exe
  2⤵
  PID:7932
- C:\Windows\System\WrtkYnG.exe
  C:\Windows\System\WrtkYnG.exe
  2⤵
  PID:4852
- C:\Windows\System\koxyAhj.exe
  C:\Windows\System\koxyAhj.exe
  2⤵
  PID:6472
- C:\Windows\System\aQqwWcX.exe
  C:\Windows\System\aQqwWcX.exe
  2⤵
  PID:6872
- C:\Windows\System\YnHREqZ.exe
  C:\Windows\System\YnHREqZ.exe
  2⤵
  PID:5648
- C:\Windows\System\nbHLfYB.exe
  C:\Windows\System\nbHLfYB.exe
  2⤵
  PID:8044
- C:\Windows\System\DkfmWZN.exe
  C:\Windows\System\DkfmWZN.exe
  2⤵
  PID:2876
- C:\Windows\System\bHcTySw.exe
  C:\Windows\System\bHcTySw.exe
  2⤵
  PID:1500
- C:\Windows\System\lMQbhXr.exe
  C:\Windows\System\lMQbhXr.exe
  2⤵
  PID:1768
- C:\Windows\System\tHbuqBd.exe
  C:\Windows\System\tHbuqBd.exe
  2⤵
  PID:1524
- C:\Windows\System\UfwpqVM.exe
  C:\Windows\System\UfwpqVM.exe
  2⤵
  PID:1400
- C:\Windows\System\VhaNtqH.exe
  C:\Windows\System\VhaNtqH.exe
  2⤵
  PID:304
- C:\Windows\System\yqkqcrO.exe
  C:\Windows\System\yqkqcrO.exe
  2⤵
  PID:3768
- C:\Windows\System\kCGYngi.exe
  C:\Windows\System\kCGYngi.exe
  2⤵
  PID:3176
- C:\Windows\System\mfTPpgH.exe
  C:\Windows\System\mfTPpgH.exe
  2⤵
  PID:7380
- C:\Windows\System\qprhBwc.exe
  C:\Windows\System\qprhBwc.exe
  2⤵
  PID:7560
- C:\Windows\System\VuSwbue.exe
  C:\Windows\System\VuSwbue.exe
  2⤵
  PID:6096
- C:\Windows\System\jKuhzFA.exe
  C:\Windows\System\jKuhzFA.exe
  2⤵
  PID:7112
- C:\Windows\System\iXlWEMH.exe
  C:\Windows\System\iXlWEMH.exe
  2⤵
  PID:5076
- C:\Windows\System\OYdrlVA.exe
  C:\Windows\System\OYdrlVA.exe
  2⤵
  PID:6308
- C:\Windows\System\KjAbnRp.exe
  C:\Windows\System\KjAbnRp.exe
  2⤵
  PID:1432
- C:\Windows\System\ZvMGNmE.exe
  C:\Windows\System\ZvMGNmE.exe
  2⤵
  PID:764
- C:\Windows\System\Fohtkmb.exe
  C:\Windows\System\Fohtkmb.exe
  2⤵
  PID:5128
- C:\Windows\System\TZLHZLb.exe
  C:\Windows\System\TZLHZLb.exe
  2⤵
  PID:5620
- C:\Windows\System\ByouGCC.exe
  C:\Windows\System\ByouGCC.exe
  2⤵
  PID:3928
- C:\Windows\System\iWbqWvk.exe
  C:\Windows\System\iWbqWvk.exe
  2⤵
  PID:2544
- C:\Windows\System\zNZdXZa.exe
  C:\Windows\System\zNZdXZa.exe
  2⤵
  PID:3384
- C:\Windows\System\WIXvOGu.exe
  C:\Windows\System\WIXvOGu.exe
  2⤵
  PID:7812
- C:\Windows\System\qoYKYLZ.exe
  C:\Windows\System\qoYKYLZ.exe
  2⤵
  PID:5616
- C:\Windows\System\eajofNh.exe
  C:\Windows\System\eajofNh.exe
  2⤵
  PID:7528
- C:\Windows\System\BuMiyXm.exe
  C:\Windows\System\BuMiyXm.exe
  2⤵
  PID:7628
- C:\Windows\System\trDCyFd.exe
  C:\Windows\System\trDCyFd.exe
  2⤵
  PID:3444
- C:\Windows\System\tXwPlEL.exe
  C:\Windows\System\tXwPlEL.exe
  2⤵
  PID:8200
- C:\Windows\System\rDtVQtn.exe
  C:\Windows\System\rDtVQtn.exe
  2⤵
  PID:8216
- C:\Windows\System\NUfBEVZ.exe
  C:\Windows\System\NUfBEVZ.exe
  2⤵
  PID:8236
- C:\Windows\System\JFFVANb.exe
  C:\Windows\System\JFFVANb.exe
  2⤵
  PID:8256
- C:\Windows\System\PchItyz.exe
  C:\Windows\System\PchItyz.exe
  2⤵
  PID:8276
- C:\Windows\System\nnKllWX.exe
  C:\Windows\System\nnKllWX.exe
  2⤵
  PID:8296
- C:\Windows\System\KtbtoTR.exe
  C:\Windows\System\KtbtoTR.exe
  2⤵
  PID:8312
- C:\Windows\System\PhUOFiK.exe
  C:\Windows\System\PhUOFiK.exe
  2⤵
  PID:8328
- C:\Windows\System\oprjNAe.exe
  C:\Windows\System\oprjNAe.exe
  2⤵
  PID:8344
- C:\Windows\System\SmkmsuB.exe
  C:\Windows\System\SmkmsuB.exe
  2⤵
  PID:8360
- C:\Windows\System\LPbATtY.exe
  C:\Windows\System\LPbATtY.exe
  2⤵
  PID:8376
- C:\Windows\System\JdLqqUj.exe
  C:\Windows\System\JdLqqUj.exe
  2⤵
  PID:8392
- C:\Windows\System\CUtFMAe.exe
  C:\Windows\System\CUtFMAe.exe
  2⤵
  PID:8408
- C:\Windows\System\xeiVaLw.exe
  C:\Windows\System\xeiVaLw.exe
  2⤵
  PID:8428
- C:\Windows\System\IHvqKrd.exe
  C:\Windows\System\IHvqKrd.exe
  2⤵
  PID:8444
- C:\Windows\System\Jmokbwh.exe
  C:\Windows\System\Jmokbwh.exe
  2⤵
  PID:8460
- C:\Windows\System\ThHpPQg.exe
  C:\Windows\System\ThHpPQg.exe
  2⤵
  PID:8480
- C:\Windows\System\bCONtJM.exe
  C:\Windows\System\bCONtJM.exe
  2⤵
  PID:8500
- C:\Windows\System\joLGpbX.exe
  C:\Windows\System\joLGpbX.exe
  2⤵
  PID:8516
- C:\Windows\System\tpCzrEr.exe
  C:\Windows\System\tpCzrEr.exe
  2⤵
  PID:8532
- C:\Windows\System\KAcyCEQ.exe
  C:\Windows\System\KAcyCEQ.exe
  2⤵
  PID:8548
- C:\Windows\System\KfSgAAJ.exe
  C:\Windows\System\KfSgAAJ.exe
  2⤵
  PID:8564
- C:\Windows\System\DwthIzA.exe
  C:\Windows\System\DwthIzA.exe
  2⤵
  PID:8580
- C:\Windows\System\XcXzsru.exe
  C:\Windows\System\XcXzsru.exe
  2⤵
  PID:8596
- C:\Windows\System\WUNXRuB.exe
  C:\Windows\System\WUNXRuB.exe
  2⤵
  PID:8612
- C:\Windows\System\wAFQxsZ.exe
  C:\Windows\System\wAFQxsZ.exe
  2⤵
  PID:8628
- C:\Windows\System\GLzUdLM.exe
  C:\Windows\System\GLzUdLM.exe
  2⤵
  PID:8648
- C:\Windows\System\TOyVcVX.exe
  C:\Windows\System\TOyVcVX.exe
  2⤵
  PID:8664
- C:\Windows\System\fkLhuqy.exe
  C:\Windows\System\fkLhuqy.exe
  2⤵
  PID:8684
- C:\Windows\System\PZwtzZh.exe
  C:\Windows\System\PZwtzZh.exe
  2⤵
  PID:8700
- C:\Windows\System\HmNtkxR.exe
  C:\Windows\System\HmNtkxR.exe
  2⤵
  PID:8716
- C:\Windows\System\aFnizQB.exe
  C:\Windows\System\aFnizQB.exe
  2⤵
  PID:8732
- C:\Windows\System\XKdxtVU.exe
  C:\Windows\System\XKdxtVU.exe
  2⤵
  PID:8748
- C:\Windows\System\wmVcMDM.exe
  C:\Windows\System\wmVcMDM.exe
  2⤵
  PID:8764
- C:\Windows\System\zKaQhKo.exe
  C:\Windows\System\zKaQhKo.exe
  2⤵
  PID:8784
- C:\Windows\System\xpagPoY.exe
  C:\Windows\System\xpagPoY.exe
  2⤵
  PID:8804
- C:\Windows\System\flbeHQK.exe
  C:\Windows\System\flbeHQK.exe
  2⤵
  PID:8820
- C:\Windows\System\oMYUYMH.exe
  C:\Windows\System\oMYUYMH.exe
  2⤵
  PID:8844
- C:\Windows\System\TFXsvTN.exe
  C:\Windows\System\TFXsvTN.exe
  2⤵
  PID:8860
- C:\Windows\System\AUlNOmc.exe
  C:\Windows\System\AUlNOmc.exe
  2⤵
  PID:8880
- C:\Windows\System\fiJleTB.exe
  C:\Windows\System\fiJleTB.exe
  2⤵
  PID:8904
- C:\Windows\System\QqrCGwN.exe
  C:\Windows\System\QqrCGwN.exe
  2⤵
  PID:8976
- C:\Windows\System\jGmnDBJ.exe
  C:\Windows\System\jGmnDBJ.exe
  2⤵
  PID:8992
- C:\Windows\System\AHJaXml.exe
  C:\Windows\System\AHJaXml.exe
  2⤵
  PID:9008
- C:\Windows\System\iItIBHK.exe
  C:\Windows\System\iItIBHK.exe
  2⤵
  PID:9024
- C:\Windows\System\aiWNmcd.exe
  C:\Windows\System\aiWNmcd.exe
  2⤵
  PID:9040
- C:\Windows\System\eiHgCId.exe
  C:\Windows\System\eiHgCId.exe
  2⤵
  PID:9056
- C:\Windows\System\FGvGjAL.exe
  C:\Windows\System\FGvGjAL.exe
  2⤵
  PID:9072
- C:\Windows\System\BDOwHMh.exe
  C:\Windows\System\BDOwHMh.exe
  2⤵
  PID:9088
- C:\Windows\System\WHRATVN.exe
  C:\Windows\System\WHRATVN.exe
  2⤵
  PID:9104
- C:\Windows\System\wDnocVd.exe
  C:\Windows\System\wDnocVd.exe
  2⤵
  PID:9124
- C:\Windows\System\IziOlEH.exe
  C:\Windows\System\IziOlEH.exe
  2⤵
  PID:9140
- C:\Windows\System\CEjNcsK.exe
  C:\Windows\System\CEjNcsK.exe
  2⤵
  PID:9156
- C:\Windows\System\qHXeSFe.exe
  C:\Windows\System\qHXeSFe.exe
  2⤵
  PID:9172
- C:\Windows\System\vhlRXjo.exe
  C:\Windows\System\vhlRXjo.exe
  2⤵
  PID:9188
- C:\Windows\System\OJBxbIc.exe
  C:\Windows\System\OJBxbIc.exe
  2⤵
  PID:9204
- C:\Windows\System\SPHVbEG.exe
  C:\Windows\System\SPHVbEG.exe
  2⤵
  PID:4552
- C:\Windows\System\EmAZlqm.exe
  C:\Windows\System\EmAZlqm.exe
  2⤵
  PID:8224
- C:\Windows\System\ZLpVTwF.exe
  C:\Windows\System\ZLpVTwF.exe
  2⤵
  PID:8268
- C:\Windows\System\EYFQneA.exe
  C:\Windows\System\EYFQneA.exe
  2⤵
  PID:8340
- C:\Windows\System\uogAGgY.exe
  C:\Windows\System\uogAGgY.exe
  2⤵
  PID:8404
- C:\Windows\System\PqpPtuP.exe
  C:\Windows\System\PqpPtuP.exe
  2⤵
  PID:4744
- C:\Windows\System\wrJPWne.exe
  C:\Windows\System\wrJPWne.exe
  2⤵
  PID:2280
- C:\Windows\System\ngCcYiB.exe
  C:\Windows\System\ngCcYiB.exe
  2⤵
  PID:7392
- C:\Windows\System\vWqzLTt.exe
  C:\Windows\System\vWqzLTt.exe
  2⤵
  PID:8212
- C:\Windows\System\WQpHlnB.exe
  C:\Windows\System\WQpHlnB.exe
  2⤵
  PID:8284
- C:\Windows\System\KhsWMtD.exe
  C:\Windows\System\KhsWMtD.exe
  2⤵
  PID:8324
- C:\Windows\System\PSLNkim.exe
  C:\Windows\System\PSLNkim.exe
  2⤵
  PID:8420
- C:\Windows\System\ZqmRAsW.exe
  C:\Windows\System\ZqmRAsW.exe
  2⤵
  PID:8496
- C:\Windows\System\OenutST.exe
  C:\Windows\System\OenutST.exe
  2⤵
  PID:8524
- C:\Windows\System\HYKVLcB.exe
  C:\Windows\System\HYKVLcB.exe
  2⤵
  PID:8592
- C:\Windows\System\dJFrUSv.exe
  C:\Windows\System\dJFrUSv.exe
  2⤵
  PID:8660
- C:\Windows\System\OwelUhI.exe
  C:\Windows\System\OwelUhI.exe
  2⤵
  PID:8756
- C:\Windows\System\AcZbsOf.exe
  C:\Windows\System\AcZbsOf.exe
  2⤵
  PID:8760
- C:\Windows\System\CiLWpXn.exe
  C:\Windows\System\CiLWpXn.exe
  2⤵
  PID:8828
- C:\Windows\System\llipOmq.exe
  C:\Windows\System\llipOmq.exe
  2⤵
  PID:8872
- C:\Windows\System\XftArMG.exe
  C:\Windows\System\XftArMG.exe
  2⤵
  PID:8928
- C:\Windows\System\DfQXmTL.exe
  C:\Windows\System\DfQXmTL.exe
  2⤵
  PID:8940
- C:\Windows\System\bywgwLS.exe
  C:\Windows\System\bywgwLS.exe
  2⤵
  PID:8544
- C:\Windows\System\cYgWulC.exe
  C:\Windows\System\cYgWulC.exe
  2⤵
  PID:8772
- C:\Windows\System\VAToZmZ.exe
  C:\Windows\System\VAToZmZ.exe
  2⤵
  PID:8968
- C:\Windows\System\akxiTct.exe
  C:\Windows\System\akxiTct.exe
  2⤵
  PID:9016
- C:\Windows\System\buFDTgX.exe
  C:\Windows\System\buFDTgX.exe
  2⤵
  PID:8972
- C:\Windows\System\yXtCvwx.exe
  C:\Windows\System\yXtCvwx.exe
  2⤵
  PID:9000
- C:\Windows\System\hFpkSkf.exe
  C:\Windows\System\hFpkSkf.exe
  2⤵
  PID:9068
- C:\Windows\System\VGHPwCR.exe
  C:\Windows\System\VGHPwCR.exe
  2⤵
  PID:9152
- C:\Windows\System\pPsTACd.exe
  C:\Windows\System\pPsTACd.exe
  2⤵
  PID:7240
- C:\Windows\System\vqNJRgV.exe
  C:\Windows\System\vqNJRgV.exe
  2⤵
  PID:9132
- C:\Windows\System\LxiHzCl.exe
  C:\Windows\System\LxiHzCl.exe
  2⤵
  PID:8196
- C:\Windows\System\oPcofbN.exe
  C:\Windows\System\oPcofbN.exe
  2⤵
  PID:9164
- C:\Windows\System\cemwmnS.exe
  C:\Windows\System\cemwmnS.exe
  2⤵
  PID:8588
- C:\Windows\System\aQXdbsx.exe
  C:\Windows\System\aQXdbsx.exe
  2⤵
  PID:9136
- C:\Windows\System\wFyZQeF.exe
  C:\Windows\System\wFyZQeF.exe
  2⤵
  PID:8252
- C:\Windows\System\IhwRuwr.exe
  C:\Windows\System\IhwRuwr.exe
  2⤵
  PID:8948
- C:\Windows\System\YWkeQhD.exe
  C:\Windows\System\YWkeQhD.exe
  2⤵
  PID:7264
- C:\Windows\System\wrMtqbh.exe
  C:\Windows\System\wrMtqbh.exe
  2⤵
  PID:8336
- C:\Windows\System\zUDUCUW.exe
  C:\Windows\System\zUDUCUW.exe
  2⤵
  PID:8912
- C:\Windows\System\xJwrHQG.exe
  C:\Windows\System\xJwrHQG.exe
  2⤵
  PID:8728
- C:\Windows\System\nZnckNv.exe
  C:\Windows\System\nZnckNv.exe
  2⤵
  PID:8436
- C:\Windows\System\GKwEANZ.exe
  C:\Windows\System\GKwEANZ.exe
  2⤵
  PID:8852
- C:\Windows\System\gXpzfHL.exe
  C:\Windows\System\gXpzfHL.exe
  2⤵
  PID:8964
- C:\Windows\System\NdxvDXk.exe
  C:\Windows\System\NdxvDXk.exe
  2⤵
  PID:7544
- C:\Windows\System\oRVGTHp.exe
  C:\Windows\System\oRVGTHp.exe
  2⤵
  PID:8352
- C:\Windows\System\oHmJHWi.exe
  C:\Windows\System\oHmJHWi.exe
  2⤵
  PID:8916
- C:\Windows\System\BtOVVWW.exe
  C:\Windows\System\BtOVVWW.exe
  2⤵
  PID:8384
- C:\Windows\System\sRxbeFl.exe
  C:\Windows\System\sRxbeFl.exe
  2⤵
  PID:9148
- C:\Windows\System\OuxjCpk.exe
  C:\Windows\System\OuxjCpk.exe
  2⤵
  PID:8320
- C:\Windows\System\dMzgQyp.exe
  C:\Windows\System\dMzgQyp.exe
  2⤵
  PID:9224
- C:\Windows\System\thJKWJL.exe
  C:\Windows\System\thJKWJL.exe
  2⤵
  PID:9244
- C:\Windows\System\QECYOmM.exe
  C:\Windows\System\QECYOmM.exe
  2⤵
  PID:9264
- C:\Windows\System\gZpavNw.exe
  C:\Windows\System\gZpavNw.exe
  2⤵
  PID:9280
- C:\Windows\System\wpFhTbU.exe
  C:\Windows\System\wpFhTbU.exe
  2⤵
  PID:9296
- C:\Windows\System\gxLSgCc.exe
  C:\Windows\System\gxLSgCc.exe
  2⤵
  PID:9312
- C:\Windows\System\lfOreOb.exe
  C:\Windows\System\lfOreOb.exe
  2⤵
  PID:9328
- C:\Windows\System\dFlIxpz.exe
  C:\Windows\System\dFlIxpz.exe
  2⤵
  PID:9344
- C:\Windows\System\jJutZpi.exe
  C:\Windows\System\jJutZpi.exe
  2⤵
  PID:9364
- C:\Windows\System\kIFcYYw.exe
  C:\Windows\System\kIFcYYw.exe
  2⤵
  PID:9380
- C:\Windows\System\nBkYWKP.exe
  C:\Windows\System\nBkYWKP.exe
  2⤵
  PID:9400
- C:\Windows\System\tFoFFgd.exe
  C:\Windows\System\tFoFFgd.exe
  2⤵
  PID:9416
- C:\Windows\System\wmXKjxQ.exe
  C:\Windows\System\wmXKjxQ.exe
  2⤵
  PID:9432
- C:\Windows\System\fFnGCFK.exe
  C:\Windows\System\fFnGCFK.exe
  2⤵
  PID:9456
- C:\Windows\System\yZYVYqN.exe
  C:\Windows\System\yZYVYqN.exe
  2⤵
  PID:9472
- C:\Windows\System\zeOOSxP.exe
  C:\Windows\System\zeOOSxP.exe
  2⤵
  PID:9488
- C:\Windows\System\kypmYzH.exe
  C:\Windows\System\kypmYzH.exe
  2⤵
  PID:9516
- C:\Windows\System\IrOyGWQ.exe
  C:\Windows\System\IrOyGWQ.exe
  2⤵
  PID:9532
- C:\Windows\System\UDXrNiI.exe
  C:\Windows\System\UDXrNiI.exe
  2⤵
  PID:9548
- C:\Windows\System\QqdUaXH.exe
  C:\Windows\System\QqdUaXH.exe
  2⤵
  PID:9568
- C:\Windows\System\FKqdoXN.exe
  C:\Windows\System\FKqdoXN.exe
  2⤵
  PID:9584
- C:\Windows\System\cOsdORc.exe
  C:\Windows\System\cOsdORc.exe
  2⤵
  PID:9600
- C:\Windows\System\QYHYzns.exe
  C:\Windows\System\QYHYzns.exe
  2⤵
  PID:9616
- C:\Windows\System\LmyZeNM.exe
  C:\Windows\System\LmyZeNM.exe
  2⤵
  PID:9632
- C:\Windows\System\LbOyhvK.exe
  C:\Windows\System\LbOyhvK.exe
  2⤵
  PID:9656
- C:\Windows\System\RzGqrkO.exe
  C:\Windows\System\RzGqrkO.exe
  2⤵
  PID:9676
- C:\Windows\System\EWQhyUe.exe
  C:\Windows\System\EWQhyUe.exe
  2⤵
  PID:9692
- C:\Windows\System\pdHFdCq.exe
  C:\Windows\System\pdHFdCq.exe
  2⤵
  PID:9708
- C:\Windows\System\jSLmcSi.exe
  C:\Windows\System\jSLmcSi.exe
  2⤵
  PID:9724
- C:\Windows\System\IveuXOQ.exe
  C:\Windows\System\IveuXOQ.exe
  2⤵
  PID:9744
- C:\Windows\System\XScDkTW.exe
  C:\Windows\System\XScDkTW.exe
  2⤵
  PID:9760
- C:\Windows\System\hroHNkW.exe
  C:\Windows\System\hroHNkW.exe
  2⤵
  PID:9776
- C:\Windows\System\rEzhgai.exe
  C:\Windows\System\rEzhgai.exe
  2⤵
  PID:9792
- C:\Windows\System\fKgsmIb.exe
  C:\Windows\System\fKgsmIb.exe
  2⤵
  PID:9808
- C:\Windows\System\hxzPDzk.exe
  C:\Windows\System\hxzPDzk.exe
  2⤵
  PID:9824
- C:\Windows\System\HcHaVpn.exe
  C:\Windows\System\HcHaVpn.exe
  2⤵
  PID:9844
- C:\Windows\System\qYTuviK.exe
  C:\Windows\System\qYTuviK.exe
  2⤵
  PID:9860
- C:\Windows\System\apYhBzR.exe
  C:\Windows\System\apYhBzR.exe
  2⤵
  PID:9876
- C:\Windows\System\raJLEQf.exe
  C:\Windows\System\raJLEQf.exe
  2⤵
  PID:9892
- C:\Windows\System\COQjLEB.exe
  C:\Windows\System\COQjLEB.exe
  2⤵
  PID:9908
- C:\Windows\System\MwmBbGz.exe
  C:\Windows\System\MwmBbGz.exe
  2⤵
  PID:9924
- C:\Windows\System\JQIHaZv.exe
  C:\Windows\System\JQIHaZv.exe
  2⤵
  PID:9940
- C:\Windows\System\PrbYPQP.exe
  C:\Windows\System\PrbYPQP.exe
  2⤵
  PID:9964
- C:\Windows\System\oQCtYmH.exe
  C:\Windows\System\oQCtYmH.exe
  2⤵
  PID:9980
- C:\Windows\System\POsUoYe.exe
  C:\Windows\System\POsUoYe.exe
  2⤵
  PID:9996
- C:\Windows\System\AsUCaEY.exe
  C:\Windows\System\AsUCaEY.exe
  2⤵
  PID:10016
- C:\Windows\System\OqBIebW.exe
  C:\Windows\System\OqBIebW.exe
  2⤵
  PID:10032
- C:\Windows\System\GOCfqOv.exe
  C:\Windows\System\GOCfqOv.exe
  2⤵
  PID:10048
- C:\Windows\System\HkngubA.exe
  C:\Windows\System\HkngubA.exe
  2⤵
  PID:10064
- C:\Windows\System\XRcZbGJ.exe
  C:\Windows\System\XRcZbGJ.exe
  2⤵
  PID:10080
- C:\Windows\System\lbMWyhn.exe
  C:\Windows\System\lbMWyhn.exe
  2⤵
  PID:10096
- C:\Windows\System\rppjsGi.exe
  C:\Windows\System\rppjsGi.exe
  2⤵
  PID:10112
- C:\Windows\System\yZGbCNg.exe
  C:\Windows\System\yZGbCNg.exe
  2⤵
  PID:10128
- C:\Windows\System\yyJugGD.exe
  C:\Windows\System\yyJugGD.exe
  2⤵
  PID:10144
- C:\Windows\System\vituLyV.exe
  C:\Windows\System\vituLyV.exe
  2⤵
  PID:10160
- C:\Windows\System\VRBuZcl.exe
  C:\Windows\System\VRBuZcl.exe
  2⤵
  PID:10176
- C:\Windows\System\tPFBkcn.exe
  C:\Windows\System\tPFBkcn.exe
  2⤵
  PID:10192
- C:\Windows\System\DjekxzF.exe
  C:\Windows\System\DjekxzF.exe
  2⤵
  PID:10208
- C:\Windows\System\xnPFnBE.exe
  C:\Windows\System\xnPFnBE.exe
  2⤵
  PID:10224
- C:\Windows\System\XUpAHPS.exe
  C:\Windows\System\XUpAHPS.exe
  2⤵
  PID:8508
- C:\Windows\System\gzUbmxP.exe
  C:\Windows\System\gzUbmxP.exe
  2⤵
  PID:8572
- C:\Windows\System\KlBPCll.exe
  C:\Windows\System\KlBPCll.exe
  2⤵
  PID:8644
- C:\Windows\System\eKyYhme.exe
  C:\Windows\System\eKyYhme.exe
  2⤵
  PID:8708
- C:\Windows\System\JjlNqkW.exe
  C:\Windows\System\JjlNqkW.exe
  2⤵
  PID:8896
- C:\Windows\System\fUglcwJ.exe
  C:\Windows\System\fUglcwJ.exe
  2⤵
  PID:9032
- C:\Windows\System\FJnYXoY.exe
  C:\Windows\System\FJnYXoY.exe
  2⤵
  PID:4132
- C:\Windows\System\uzyZIkl.exe
  C:\Windows\System\uzyZIkl.exe
  2⤵
  PID:8308
- C:\Windows\System\QTisszb.exe
  C:\Windows\System\QTisszb.exe
  2⤵
  PID:8248
- C:\Windows\System\LNLrJln.exe
  C:\Windows\System\LNLrJln.exe
  2⤵
  PID:8800
- C:\Windows\System\zIYiCys.exe
  C:\Windows\System\zIYiCys.exe
  2⤵
  PID:8740
- C:\Windows\System\HqivNhV.exe
  C:\Windows\System\HqivNhV.exe
  2⤵
  PID:8984
- C:\Windows\System\ZXJvYtL.exe
  C:\Windows\System\ZXJvYtL.exe
  2⤵
  PID:8388
- C:\Windows\System\sCFpkja.exe
  C:\Windows\System\sCFpkja.exe
  2⤵
  PID:9256
- C:\Windows\System\TzqeUui.exe
  C:\Windows\System\TzqeUui.exe
  2⤵
  PID:9288
- C:\Windows\System\ncNUTHm.exe
  C:\Windows\System\ncNUTHm.exe
  2⤵
  PID:8472
- C:\Windows\System\aAaZXTH.exe
  C:\Windows\System\aAaZXTH.exe
  2⤵
  PID:9272
- C:\Windows\System\mlegowb.exe
  C:\Windows\System\mlegowb.exe
  2⤵
  PID:9336
- C:\Windows\System\TtDWSxv.exe
  C:\Windows\System\TtDWSxv.exe
  2⤵
  PID:9408
- C:\Windows\System\PTPpiKA.exe
  C:\Windows\System\PTPpiKA.exe
  2⤵
  PID:9448
- C:\Windows\System\oCIaOCX.exe
  C:\Windows\System\oCIaOCX.exe
  2⤵
  PID:9528
- C:\Windows\System\CRAEhFy.exe
  C:\Windows\System\CRAEhFy.exe
  2⤵
  PID:9592
- C:\Windows\System\EBLMHKl.exe
  C:\Windows\System\EBLMHKl.exe
  2⤵
  PID:9664
- C:\Windows\System\MReKKhL.exe
  C:\Windows\System\MReKKhL.exe
  2⤵
  PID:9704
- C:\Windows\System\qZQBCdl.exe
  C:\Windows\System\qZQBCdl.exe
  2⤵
  PID:9768
- C:\Windows\System\uNyLlHD.exe
  C:\Windows\System\uNyLlHD.exe
  2⤵
  PID:9832
- C:\Windows\System\ZEaeHqX.exe
  C:\Windows\System\ZEaeHqX.exe
  2⤵
  PID:9904
- C:\Windows\System\ffDCInX.exe
  C:\Windows\System\ffDCInX.exe
  2⤵
  PID:9500
- C:\Windows\System\EhFqprs.exe
  C:\Windows\System\EhFqprs.exe
  2⤵
  PID:10008
- C:\Windows\System\AmNmVLi.exe
  C:\Windows\System\AmNmVLi.exe
  2⤵
  PID:9396
- C:\Windows\System\SvoICoK.exe
  C:\Windows\System\SvoICoK.exe
  2⤵
  PID:9684
- C:\Windows\System\ezupyNj.exe
  C:\Windows\System\ezupyNj.exe
  2⤵
  PID:9852
- C:\Windows\System\RerZvtv.exe
  C:\Windows\System\RerZvtv.exe
  2⤵
  PID:9468
- C:\Windows\System\NlJvqEZ.exe
  C:\Windows\System\NlJvqEZ.exe
  2⤵
  PID:9544
- C:\Windows\System\lcrZFGi.exe
  C:\Windows\System\lcrZFGi.exe
  2⤵
  PID:9644
- C:\Windows\System\sPPUjZh.exe
  C:\Windows\System\sPPUjZh.exe
  2⤵
  PID:9784
- C:\Windows\System\jgOyuRL.exe
  C:\Windows\System\jgOyuRL.exe
  2⤵
  PID:9920
- C:\Windows\System\iuDFLCi.exe
  C:\Windows\System\iuDFLCi.exe
  2⤵
  PID:10056
- C:\Windows\System\QHVIQad.exe
  C:\Windows\System\QHVIQad.exe
  2⤵
  PID:10072
- C:\Windows\System\GdCVCbp.exe
  C:\Windows\System\GdCVCbp.exe
  2⤵
  PID:10092
- C:\Windows\System\WyqcFkY.exe
  C:\Windows\System\WyqcFkY.exe
  2⤵
  PID:10168
- C:\Windows\System\lUUsaZl.exe
  C:\Windows\System\lUUsaZl.exe
  2⤵
  PID:10232
- C:\Windows\System\XCqEDXD.exe
  C:\Windows\System\XCqEDXD.exe
  2⤵
  PID:10120
- C:\Windows\System\BLhpRJi.exe
  C:\Windows\System\BLhpRJi.exe
  2⤵
  PID:9184
- C:\Windows\System\orcERPP.exe
  C:\Windows\System\orcERPP.exe
  2⤵
  PID:8656
- C:\Windows\System\TpORysV.exe
  C:\Windows\System\TpORysV.exe
  2⤵
  PID:10188
- C:\Windows\System\PXOtNnU.exe
  C:\Windows\System\PXOtNnU.exe
  2⤵
  PID:8680
- C:\Windows\System\NURjKYc.exe
  C:\Windows\System\NURjKYc.exe
  2⤵
  PID:8492
- C:\Windows\System\GdPbwgm.exe
  C:\Windows\System\GdPbwgm.exe
  2⤵
  PID:9260
- C:\Windows\System\HfjqwPW.exe
  C:\Windows\System\HfjqwPW.exe
  2⤵
  PID:9084
- C:\Windows\System\IwLOfmB.exe
  C:\Windows\System\IwLOfmB.exe
  2⤵
  PID:9200
- C:\Windows\System\VUtcIsX.exe
  C:\Windows\System\VUtcIsX.exe
  2⤵
  PID:8440
- C:\Windows\System\rXSzepr.exe
  C:\Windows\System\rXSzepr.exe
  2⤵
  PID:9308
- C:\Windows\System\asKkUMM.exe
  C:\Windows\System\asKkUMM.exe
  2⤵
  PID:9480
- C:\Windows\System\LFcxJUO.exe
  C:\Windows\System\LFcxJUO.exe
  2⤵
  PID:9560
- C:\Windows\System\VGueYOO.exe
  C:\Windows\System\VGueYOO.exe
  2⤵
  PID:9740
- C:\Windows\System\ondwnEO.exe
  C:\Windows\System\ondwnEO.exe
  2⤵
  PID:9800
- C:\Windows\System\jlhLwDC.exe
  C:\Windows\System\jlhLwDC.exe
  2⤵
  PID:9872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CGUposx.exe

Filesize
2.8MB

MD5
495b6bb951ebd6699b2eda8299d407c1

SHA1
451dc90f22630eb50ba29e9bbe599f1281d7e8a3

SHA256
6aea65d1fe1f6b4482af677aea47f84fefe5cfe112aeea6365865a590fdd8846

SHA512
e683e54c9cdb3324d45fbba9a3d6582c00c85c20d9dada1c68cffea7f86afd367bf454a2793655b86e05d1b7953dc0d03877ffbe449a67722f373ad4f18aff39

Download Submit
C:\Windows\system\CUuKETj.exe

Filesize
2.8MB

MD5
d6b377d0b297bfaeb6dc49a2edadc038

SHA1
a0aa97fc5026f77841d1237f269b907d40c9bf85

SHA256
70f07c225f7bd9be56bf91900e60dcbc005256020c5ebe4efbbe795a51f1314c

SHA512
a2ad7fc3c0c885c333116159f0c91df693366580b905731b7ac1585f6c01158e8048a78423f0c3bed3b44ba7efcd23dd8403a663e555b5b24c0fae6339decabf

Download Submit
C:\Windows\system\EYyZrNZ.exe

Filesize
2.8MB

MD5
69622deaa92d20f6768f7398b0ca3e4e

SHA1
95ee3f001d4ab6c2078d77017a93a1a7b242dfe0

SHA256
b839547c7224c931695e855a666843d778748f5147152a0da7b9e65565a4b06b

SHA512
85f59764ab311dacf9da9b3109543e85f501f092b53e3e8e47020eaf84e160c03dfbdf81d87586d77533232a0142f5bbeba3dc633f13a6708cbf07804744eac1

Download Submit
C:\Windows\system\IktsVQH.exe

Filesize
2.8MB

MD5
d68fc22e2e83bbac897c5d8eed9737bd

SHA1
6f17dedb5a502b7c94a7e0390db84438abddc6e5

SHA256
e88f8407d6b816934a3bf12fa85ed2a116d8f8473a887bad1198120d8ede5e1e

SHA512
dd141b56522642f49b27b9d2233ee3cf4e92b8fe9ba9404380cd4537bd4b85ab073328e72d92b5025ef9fb89c5f599f4fc7d30d3aafbf507499ee7633c14094f

Download Submit
C:\Windows\system\LaoqZxW.exe

Filesize
2.8MB

MD5
f666a47b783dd04c06069bdad24c1b4b

SHA1
5d31d2009f2be643a3c447496ec366872556b061

SHA256
35fe0defb8b9a7409d6c984cb347d3f4ed8e549a927bdf1a84a8611196a7d5e7

SHA512
63d57b18bad530d03c23859686d30d8094880303b804a7b600ca5912a7f9a4ee4e13a8c93f05e53c5b3c52fea4bd017f5660c56853863a604b8ba95b95e9c1d5

Download Submit
C:\Windows\system\NIWTATJ.exe

Filesize
2.8MB

MD5
2a37c87d7fa745ac705c73b463901cfc

SHA1
910bb2b56327cedb07915ec8bc1a53536a6f2926

SHA256
426b3986fa368dc794f86000126f91d537f1feaaee573901a6f6478fc06ca2d2

SHA512
ed1f84957c550dbd1ac2da97d847e9f05416160c9091bf6c7c9b257ab39151f8ba5c6ef011743d1ec1ac54d6b77eeb9e74704a71d238e2ba669f6dbe7bda50d0

Download Submit
C:\Windows\system\ODwOWOq.exe

Filesize
2.8MB

MD5
b291f5e8fce6823a57dc62e4d2b7f0e7

SHA1
c9e6a790360680c4e8a7fd8731f5415488041150

SHA256
26ee0a5390029d85b20fcfd5aa6817a27597a41bdce3571b383b152856fe571a

SHA512
5863956cd40a5c8c681346ecfd05aff048682882c78edff5172f9128042c9707d76dffdfd4783d9012bd60bd87ffdcb39f99cfa99c195e6bc763eecbb24208e1

Download Submit
C:\Windows\system\OeHFNKE.exe

Filesize
2.8MB

MD5
5324e28bf7a3444baebcff512b0b701b

SHA1
ed8cef8a32779c7d91491343226ea3e0e5a2aa8e

SHA256
53ee2e7a8aeabddf6a5dacc4783d19335f9d003c1ed9ce25c40b17913e3c70e2

SHA512
0d1eb3760f75a81d044b70c00b6a4d1aca25e2f288cbb75ca2010b5e8e28303b45c63a117f446533814407f1b624e7b2a1b12aceb217f6f79f69a16e29723349

Download Submit
C:\Windows\system\RRLyVOI.exe

Filesize
2.8MB

MD5
b3f1d34f29a1ec758cdb0ac1f3b4a7ab

SHA1
cf9ce456cfc24770e46103f773ffbdaa5c2a088d

SHA256
e13756e58de2ccd949655e25d72c1bc112aa6667b451f0b8c9c6c4c25f87deac

SHA512
8eaef9ec4d1fffed81d94b239d9c423c9b48682afacda6c526f5e2faa5c977ee5c9fd6503c0b14ade699cd84e955a49087780f0684dc600700036c31beef04a0

Download Submit
C:\Windows\system\RZMNZee.exe

Filesize
2.8MB

MD5
6a1db10992090ab847cee7a6c502cf87

SHA1
092ed2cba192ea6b9e84fe1311f0714241ed63cc

SHA256
0942ebe13cd64aea32f9fa07ed043347151b5ca2524769fa300c6fff82fb5bdd

SHA512
cf07792acb7781c103b0beef751f6eb04dc17af208b6194cb89241f7c1875c9b025bae458d6d41a5d1906e4e418796509d0c9df52f1fef2206a9c53f90ca0b4e

Download Submit
C:\Windows\system\TMxdASp.exe

Filesize
2.8MB

MD5
059970d3b97e53fb8330cb5e9cc113a6

SHA1
eadf6e26dafc3f561aafb59ecf712eb72923e7d6

SHA256
2fd7bfb32b9b44e75205e877fa3212804ad267a3ae1fe25e91ba7f58fb50e1aa

SHA512
b0ab0538d279d084419e7a7f7268311510d422699f7fcc5d45f4c6195dfeb66f9afc365cb69bf777695c3a71c6282b31c0fc2e7a77e4f5ee2df44edbe31323cb

Download Submit
C:\Windows\system\TkVoDJZ.exe

Filesize
2.8MB

MD5
378969cb70983df20b9cd6beee19ca64

SHA1
f23f30902676d306d983ca0c4732b85b76f3eaa5

SHA256
32ed3441fe4a33a9a26155a4a06a873d0dcf29e09e0d9f1291f7ef8fd348a35c

SHA512
7a7f8b3f8f3596452c13c5a1ed3a478adacdfbe5827e1ad88f9bee5cd4439bfd15a2871a29e9c579578078aa069a4afd79588766d682a7266355fbe9e6ee926c

Download Submit
C:\Windows\system\XtMNVRD.exe

Filesize
2.8MB

MD5
c3bf6949512a00f32ab54d89689e105d

SHA1
e8bca6fd72ad40bcfbdc3d17b6b443bcf354af43

SHA256
b6c596e99e7f8dfbbc6caa230a7c1a7d12bdfc53bd7439f0f4ae20dea7478f0a

SHA512
1c027fe1b918dabae746fa680f6fdb6ee85d68e3848a4e632a57b1f9f17fe8487ea78a7c0481aabdf0852960a46369e988201c76737b2be9cbe4f3215edf3718

Download Submit
C:\Windows\system\ciuTnvD.exe

Filesize
2.8MB

MD5
262995c032d08c5d26ccb69a581d6247

SHA1
fd7f0b58d89e2925b84773501cfaee6fc888fb32

SHA256
99b0cef6fe1776e29c2dcc848279deec8f5fe22d64ac9e2bd2aeeabe41c1c025

SHA512
bdd418c1910bc924be3f687a5435489e7b479a1f0c3e475ed46cd60637ce93ec58b73bf0103d711db4a8f08c01349fb91b3501220db9d78be08eb352bf90ee28

Download Submit
C:\Windows\system\dTsjnwd.exe

Filesize
2.8MB

MD5
34de6deadd2ed82cf0a9acee481dd21c

SHA1
c3931a100b213e78af42dae5cc3db4d82ed3ad99

SHA256
d3d2f478af3506ba62858e467d3369b337985c9012c3280e982390da0baf5483

SHA512
b99b99c17a141a2172661409706e935e3e31dc8993f269f8b596d8d79c2c6181083f0662064fec832eb4662b787190c28498252524224b9599388fc264a74e28

Download Submit
C:\Windows\system\fptwUqk.exe

Filesize
2.8MB

MD5
ba1c2cd681152a13ed4f32ab00ffb987

SHA1
8587f806b17376e2ed2c944f6619cef24f32648a

SHA256
dd0b2a8e08a39d1e026cd179ff5553307646b1711429edb4cb72ed0e33098a7c

SHA512
51f21be631b30f9c7235074a2f6b78b4407226bb388e1f3cccae2cc4b1316c35d4b06bc44d512917f87bd1179513647d52b43f42820c821b156244ce932ed39c

Download Submit
C:\Windows\system\hwGWhqD.exe

Filesize
2.8MB

MD5
e9feb3478ba6fb616e519f9cac725ed9

SHA1
d2817fd152f5fe4f92bc01bf13e3b44cd4542813

SHA256
5f4262917e32637bf18543275efa6fcfa56d9c3376be471bbcb832559dc7eead

SHA512
ca87986b5211c0dedd5239c448e31c76abd234722a24e6bf01b901df320561b3f1360936cfce2227d77ceb94958489cd8c642db976210b369108420a16e8ade3

Download Submit
C:\Windows\system\laNnUjV.exe

Filesize
2.8MB

MD5
a9d348faaced3cfad6edb4bb6ebbb034

SHA1
b8aa22fd5bf27e52bccf5ffcd3b8fd0f9c5a9e19

SHA256
5aa4629dfebc9e207e822ebb44d6efcc147f10422e536740d7f58a7142363d4f

SHA512
4a221465972abfaed793f5480f5ddf8b0fc9269589bf32fab67d5be10564966dadb6d216ffe7372aa94faeb818a40a57d60a433aea54f45634bc190b131d6187

Download Submit
C:\Windows\system\ruOZdiX.exe

Filesize
2.8MB

MD5
7d8d2a304a7b3ea1b73eb0a8513960e5

SHA1
3eb4593310b9d409fb17844f0f12deb108cbfde5

SHA256
1e4dadd9ea6fa33952b103aa928aa7baa088ca53c1b861c02b38df89117d6e93

SHA512
88880c88f530edf5489691e2ab1d4c457cc4285b0fcbf26c0eca715e964fb8265528117c368144b8b91214e11d3311ac68ffbeb3e1905fc54985d477eb2b0b18

Download Submit
C:\Windows\system\uErdDqL.exe

Filesize
2.8MB

MD5
b825981e97b639056eec27d8599c341f

SHA1
21e2772a0c25e92b946c537effa32715eb90b911

SHA256
165d6268b82a8c762603a0f0a9cdeec418217ba781c172391734c6252f3f78f2

SHA512
8c7bdf5e40c4f55acf8ebb547640d28f69eb419b19a1ad8c1e152c4931cdb5139adcc36d0b569a64b2a7bf6534496b63904fe2fb544290bd7c509ac0dd488af6

Download Submit
C:\Windows\system\vLMycCm.exe

Filesize
2.8MB

MD5
d7740fb12c541e83cff959b0237a64df

SHA1
bbdf334d071d6f01142f1ab627e65dce9caa1182

SHA256
60d9ccafc658d208ce2b598730773997854bb086ae2d35de7e6e1b37451912b3

SHA512
33bcd8c82842e25053574f3f8aba5c5f7697d8fec135ae539cb5e54f2b17d84b87ead0df978e1aeff5924003b42f881f67fb34299cce5530305d1220f6c74ddc

Download Submit
C:\Windows\system\yeXIjjZ.exe

Filesize
2.8MB

MD5
1eded328875087dec32351a525107ca6

SHA1
bfeba928ee8ae220e7d883721f6716981a42e165

SHA256
3f8d92126895ba9ca6aa30ba9a2c103ffe1caa520bdc00b95a3ac667ee5c5011

SHA512
b192e7aa178b8ca6871c48b8b32d0ebfb89130c6203ea6cd0c0cdc34d81da92ceb9d7274d9b56714a3daeebe08a4698153f40bee84931c76fc7cc10ad3ebff6a

Download Submit
C:\Windows\system\ygQjcnE.exe

Filesize
2.8MB

MD5
c9e9307534daf5bf64fd833ef095ad11

SHA1
7dea628193c0d38f22db9337a061b1ddd7458d83

SHA256
4401466eb409222c2ec1cc7ad35f0ec917b7f483d2b48839051bea0b40c1671b

SHA512
384c69d019f7b2d902b039b97a4b9699991f816276dfc1925d7f90ebb6d460459b8fe39e34316a784ed6b6da9aa2a30d8b93c8e9ea54d60cbbfcbbfc88281562

Download Submit
C:\Windows\system\zVwceQv.exe

Filesize
2.8MB

MD5
621d252293fc5b5f5ae984265ff27288

SHA1
d22fd81f3115657ba557e01c8d3d9a8dc03fb4b5

SHA256
5cee6e2ed1f113f4afc34c9a35dd35876f2707a9e84a2b6083a268c2b4d021f8

SHA512
5ce319522bbdc3e4bb8706a1f2c314deab9f694125fd5c1a8b0c7585917b27a737f0c5a32f65d6b2e67afdfd3eeb93f5072807b31218de7db0faa20f7820686a

Download Submit
\Windows\system\CXRwejR.exe

Filesize
2.8MB

MD5
d803ec3d1d1ceedbf3e4a98de5033f0f

SHA1
b8ad676c8fa3d4bcd0ae524813b49f0e2b0d4093

SHA256
c7205864c6ae80ecab10ca6f551c7f6c0d1b1eddf592b417c5da6bb339966c5e

SHA512
fe01d220eb7ac3e54cd428ed721a1c165eccb8df56ea829e5f81bf5ae001078fd556902fdf96c53af7078308ef730353767648b3b48d9d84225aac46a86a334c

Download Submit
\Windows\system\KIOvApW.exe

Filesize
2.8MB

MD5
3bb2ac1b68be166a3cfb50433cc4c6f8

SHA1
d07c250dadfc2998c9a3547e610506be32c37331

SHA256
9205dca9ff5bf802b1b0f12ea941016547ee96f6ef24a0ca322c90cbeb03c238

SHA512
02bfd1803116327caf0160e6c3f41461d1ced63a8c44570b74d734e66b03e23510f805150373eed39d5cd75891bd7895956ec104a5c0b11ad59f126b9a9dcd81

Download Submit
\Windows\system\YOqaZly.exe

Filesize
2.8MB

MD5
05ae0a85af57c90a9d5cafd54f2a37a3

SHA1
af436a52de682fb822fc0651505cc6b2247d9147

SHA256
151ff629e3fff6ad5e07455923fcf0502c8f0fb0d005f548d50f8e5a0ba22665

SHA512
be1e588fc090946fc2e6d018805362d0a177242272adfb9b11011f505396c67fb1f6456756314d14c3fc886fdf72e5df1b22e701434fb22a836d66a51b573526

Download Submit
\Windows\system\ciOvEfh.exe

Filesize
2.8MB

MD5
f5ab6b1a21b5a9ea7a0a441245e998bb

SHA1
df1c98b618b9fa7b7485255c15754e09f09d3444

SHA256
67bd0a0f6a4a1d597c0b3114877b14599518d15828cbac34e81c039929200c8a

SHA512
57b032bf6d13964b447f0cc322b65f88a4b5c441165935334d43267e5114f102810563c6230295d3dff0ff9860ef9540f09d2170f4473b7d7906f58a2609f4e8

Download Submit
\Windows\system\dAInKNa.exe

Filesize
2.8MB

MD5
2bdc0b127167880b4e6cb040300a336d

SHA1
4496fecd1dd5bbb37b68223596f485f06f9cd9ff

SHA256
95fd7b4a16010f314c4b78c90e6de604ff9594ce6fa60ac3e40444fb53e91a4c

SHA512
aa49b7540649135b0a3ed49e1f2ea3911c0c736bfe1ccf8c0ed17158e887b2a3a3a86984cf24f45517837a45937747b82cac2278599228ba5810fc94f00412a6

Download Submit
\Windows\system\dLlsGCe.exe

Filesize
2.8MB

MD5
e2ddee128635326ef2759800a7df484b

SHA1
b289fd82a4ca4e1194dfb95b161d64810c8b583d

SHA256
cb4db8b812feb50e199bfad738a99c4521936193ef4428709f1c6b3ddd7a701c

SHA512
99d888dcdc0a8c4f8d06bd7882ce9a3abc6998f5200c0e8cb74d8f4b1e89a75742b164dec726c7404d5c1f8fce35e6f11ee1ddc8d69ef870ce2bffce9a1ad180

Download Submit
\Windows\system\gTdSJhN.exe

Filesize
2.8MB

MD5
5ceeb2d3aad26867611a68dad7d2b2ec

SHA1
b124d168d52901094580e4da547d00e9e3efbd24

SHA256
8b3f39bc68a4cd811d0aace3ff415993194e82dba85784f6d1e31311d5bd5013

SHA512
217696cf579491c226787115e1da9604403bac224c36da5d6f7c0fc0ef738c9eeeae55b8ec6a3bf2073dfd2a36fcc3b150e76d42307664355ce2d841e136cb87

Download Submit
\Windows\system\kqwbLWf.exe

Filesize
2.8MB

MD5
8ab7c249ee377f8bd7c99ec854bd7dc3

SHA1
3b62e38512b13675193d3248ced63095904be9c3

SHA256
33b3db756b820f3844016f9e8f35f18014cecc8ad180b23517503d56a20c149b

SHA512
c78d1fe4f4a37196f836b6805fd4a8df583422903fa0012ef00f2e428f55612178c286f1b83a45b60bcc1814cbc81e88e877b8bfc763d75552e3967b36c819b1

Download Submit
\Windows\system\lmFRKhI.exe

Filesize
2.8MB

MD5
aa3fcc53aaf4b7b39685fc296134eb27

SHA1
24bfdfe371edde217f0e05ea0abc21292193c7dd

SHA256
a16f75cdda79b7fe3c9797ab1ca3641641b8894f58960bca25bced0c83aa770e

SHA512
c858a4ba988f9f8791c38856473361ea2e045bdb0cd44519d5c2ac75004495b7cd3be3af1cee9516e439c011986995fa9750e5b1a515c398edfdcd5cfe4f2858

Download Submit
memory/1540-86-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/1636-14-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2176-49-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2248-91-0x0000000003810000-0x0000000003C02000-memory.dmp

Filesize
3.9MB

Download
memory/2248-85-0x0000000003810000-0x0000000003C02000-memory.dmp

Filesize
3.9MB

Download
memory/2248-7-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2248-81-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-1-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-16-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2248-321-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-15-0x0000000003300000-0x00000000036F2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-57-0x0000000003810000-0x0000000003C02000-memory.dmp

Filesize
3.9MB

Download
memory/2248-54-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/2248-47-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2248-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2248-51-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2556-672-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2556-13-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2580-53-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2584-61-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2604-76-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2680-20-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-60-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2772-176-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/2772-177-0x0000000002A80000-0x0000000002A88000-memory.dmp

Filesize
32KB

Download
memory/2864-52-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download