xmrig | 5e2907b4098b1bc509f67991bb3a4812f5cd668851a94bfbb20750675a599643

Analysis

max time kernel
20s
max time network
33s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
Size

2.1MB
MD5

02ea39e6fa38e0d55cf84a8355e9bb12
SHA1

15cd9b277927bbee9a2a2d10c3fad17912fa67bb
SHA256

5e2907b4098b1bc509f67991bb3a4812f5cd668851a94bfbb20750675a599643
SHA512

fcd9dd84290146cc9bb57d81cd2966576f2f2e6718894b1536f298ae10e6ca27bf8f74ff3d54325d33bae3cde8fed8439c3e4d384f3b7ab3678a163009389005
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr6:NABh

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral1/memory/2572-89-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	xmrig
behavioral1/memory/2348-91-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/1412-95-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/1964-77-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2832-55-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2676-18-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2676	rBUYeIc.exe
2832	jnZceMU.exe
2776	WawoGLT.exe
2660	ElzTLio.exe
2560	gOelbBf.exe
1964	gYLHiEc.exe
2572	fcNiMsS.exe
2348	eOrbdZa.exe
1412	DcwaVik.exe
2764	AyLzeyH.exe
2080	XwOBAbO.exe
2724	OcwGWSK.exe
2988	fQBSOUm.exe
340	pJYgJTn.exe
3036	fElinTn.exe
2220	pRtodtm.exe
2064	hhyiGgg.exe
2628	LZewDwJ.exe
1316	cELIgmL.exe
2584	iJynjSL.exe
2828	RMbnwHB.exe
1820	ABZLUTa.exe
1948	pTdoSUT.exe
2912	TooSEJZ.exe
1216	FFbqHfr.exe
1028	hEajCIQ.exe
1100	MXwgtCv.exe
2420	UwBBHRH.exe
812	mDmCAyx.exe
1484	xCQMhRq.exe
1812	OXipUxJ.exe
408	Egvulwo.exe
2264	uHrWFuJ.exe
1368	GkPXcMU.exe
280	noGZOJC.exe
1092	OTSWbSJ.exe
1880	jUehAnM.exe
840	LetPSic.exe
692	DXqnkPN.exe
2208	fjjsGnT.exe
2940	ncFfDFo.exe
2948	XzPxNUu.exe
2300	gpkrYrO.exe
1048	tTeAjYh.exe
2808	QXQrDPO.exe
2548	xNRmaJT.exe
2480	rwTiHsD.exe
2728	IrBVwAR.exe
1720	oxeycKp.exe
1448	BcBuqah.exe
2708	UkPekjL.exe
2540	ixrCAUh.exe
2344	TNSeZVl.exe
2060	WmQxxSp.exe
2916	zcikKMF.exe
576	thFCpbJ.exe
988	pMdAXKe.exe
1904	JsYJBOl.exe
1312	AsRzZoZ.exe
2464	IzyIkOa.exe
2680	hIRmxEj.exe
2636	OlYnHDp.exe
2968	EVKHKRH.exe
3100	fdYqFcO.exe

Loads dropped DLL 64 IoCs

pid	Process
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000013a15-17.dat	upx
behavioral1/files/0x000a000000013abd-34.dat	upx
behavioral1/files/0x0008000000013a65-23.dat	upx
behavioral1/files/0x0007000000014525-52.dat	upx
behavioral1/files/0x00060000000145d4-68.dat	upx
behavioral1/files/0x0006000000014730-66.dat	upx
behavioral1/files/0x000600000001475f-87.dat	upx
behavioral1/memory/2572-89-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/memory/2348-91-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/1412-95-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/files/0x00060000000145c9-98.dat	upx
behavioral1/files/0x0006000000014a29-105.dat	upx
behavioral1/files/0x0006000000015077-121.dat	upx
behavioral1/files/0x0006000000014c0b-126.dat	upx
behavioral1/files/0x000600000001543a-147.dat	upx
behavioral1/files/0x0006000000015a15-157.dat	upx
behavioral1/files/0x0006000000015c91-173.dat	upx
behavioral1/files/0x0006000000015b37-159.dat	upx
behavioral1/files/0x00060000000155e8-152.dat	upx
behavioral1/files/0x000600000001523e-142.dat	upx
behavioral1/files/0x0006000000015b72-163.dat	upx
behavioral1/files/0x00060000000150aa-133.dat	upx
behavioral1/files/0x003900000001340e-137.dat	upx
behavioral1/files/0x0006000000014d0f-118.dat	upx
behavioral1/files/0x0006000000014fac-115.dat	upx
behavioral1/files/0x00060000000148af-110.dat	upx
behavioral1/files/0x000600000001474b-70.dat	upx
behavioral1/files/0x00060000000146a7-62.dat	upx
behavioral1/memory/2560-51-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/2660-47-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2776-42-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/files/0x00130000000054a8-37.dat	upx
behavioral1/files/0x0008000000013a85-82.dat	upx
behavioral1/memory/1964-77-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2832-55-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/files/0x00090000000134f5-22.dat	upx
behavioral1/files/0x000b00000001227c-21.dat	upx
behavioral1/files/0x0039000000013362-13.dat	upx
behavioral1/memory/2676-18-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/1740-0-0x000000013F590000-0x000000013F982000-memory.dmp	upx
behavioral1/files/0x0006000000015bb5-166.dat	upx
behavioral1/files/0x0006000000015c9b-185.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hIRmxEj.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\kZarWbk.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\CpFiHJL.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\OOqxfwJ.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\GuPUuhf.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\yYRCUmM.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\vCRSxTj.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\SJEUBKw.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\HreIDNw.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\cQxhRmH.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\QxANkTe.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\UwBBHRH.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\CMsMloA.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\AgzbdUl.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\moXGBbx.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\DuSfQLD.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\aPEmnck.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\pryWbyX.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\AOsoYEJ.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\mLLoJHR.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\OCCQhKg.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\sinRmPm.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\VvUTFPr.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\wolRInI.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\DVPULBR.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\IooZOQj.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\VgjmwpE.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\dVJSyvu.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\EaMIzqu.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\WkujWPw.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\oYFTDWT.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\zQPRgjf.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\rgWRIwv.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\bdimzrW.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\nEaCswO.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\UNagiHU.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\vOlBVAR.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\hhDHCRe.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\vEUfves.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\rERviZf.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\ZAWwACt.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\reznsJF.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\ZWyExpl.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\VdtCQjw.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\cIxqqXC.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\PZcgVUz.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\hvsDSXr.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\TxDGyao.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\LHBawzF.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\qUtzFJP.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\WHLzZAn.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\ZMMoZmC.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\WIFTCnZ.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\DhLQnin.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\DfERRds.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\OlYnHDp.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\UGrhhew.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\nmxKTXb.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\DHrJrCf.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\uGGyuQI.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\QVlgQsm.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\SUKEHuf.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\pLjWyDN.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
File created	C:\Windows\System\lofegBv.exe	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2304	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
Token: SeDebugPrivilege	2304	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2304	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	29
PID 1740 wrote to memory of 2304	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	29
PID 1740 wrote to memory of 2304	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	29
PID 1740 wrote to memory of 2832	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	30
PID 1740 wrote to memory of 2832	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	30
PID 1740 wrote to memory of 2832	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	30
PID 1740 wrote to memory of 2676	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	31
PID 1740 wrote to memory of 2676	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	31
PID 1740 wrote to memory of 2676	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	31
PID 1740 wrote to memory of 2776	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	32
PID 1740 wrote to memory of 2776	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	32
PID 1740 wrote to memory of 2776	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	32
PID 1740 wrote to memory of 1964	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	33
PID 1740 wrote to memory of 1964	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	33
PID 1740 wrote to memory of 1964	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	33
PID 1740 wrote to memory of 2660	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	34
PID 1740 wrote to memory of 2660	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	34
PID 1740 wrote to memory of 2660	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	34
PID 1740 wrote to memory of 2764	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	35
PID 1740 wrote to memory of 2764	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	35
PID 1740 wrote to memory of 2764	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	35
PID 1740 wrote to memory of 2560	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	36
PID 1740 wrote to memory of 2560	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	36
PID 1740 wrote to memory of 2560	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	36
PID 1740 wrote to memory of 2724	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	37
PID 1740 wrote to memory of 2724	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	37
PID 1740 wrote to memory of 2724	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	37
PID 1740 wrote to memory of 2572	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	38
PID 1740 wrote to memory of 2572	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	38
PID 1740 wrote to memory of 2572	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	38
PID 1740 wrote to memory of 2988	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	39
PID 1740 wrote to memory of 2988	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	39
PID 1740 wrote to memory of 2988	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	39
PID 1740 wrote to memory of 2348	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	40
PID 1740 wrote to memory of 2348	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	40
PID 1740 wrote to memory of 2348	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	40
PID 1740 wrote to memory of 340	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	41
PID 1740 wrote to memory of 340	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	41
PID 1740 wrote to memory of 340	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	41
PID 1740 wrote to memory of 1412	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	42
PID 1740 wrote to memory of 1412	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	42
PID 1740 wrote to memory of 1412	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	42
PID 1740 wrote to memory of 3036	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	43
PID 1740 wrote to memory of 3036	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	43
PID 1740 wrote to memory of 3036	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	43
PID 1740 wrote to memory of 2080	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	44
PID 1740 wrote to memory of 2080	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	44
PID 1740 wrote to memory of 2080	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	44
PID 1740 wrote to memory of 2064	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	45
PID 1740 wrote to memory of 2064	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	45
PID 1740 wrote to memory of 2064	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	45
PID 1740 wrote to memory of 2220	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	46
PID 1740 wrote to memory of 2220	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	46
PID 1740 wrote to memory of 2220	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	46
PID 1740 wrote to memory of 2584	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	47
PID 1740 wrote to memory of 2584	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	47
PID 1740 wrote to memory of 2584	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	47
PID 1740 wrote to memory of 2628	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	48
PID 1740 wrote to memory of 2628	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	48
PID 1740 wrote to memory of 2628	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	48
PID 1740 wrote to memory of 2828	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	49
PID 1740 wrote to memory of 2828	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	49
PID 1740 wrote to memory of 2828	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	49
PID 1740 wrote to memory of 1316	1740	02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02ea39e6fa38e0d55cf84a8355e9bb12_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\System\jnZceMU.exe
  C:\Windows\System\jnZceMU.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\rBUYeIc.exe
  C:\Windows\System\rBUYeIc.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\WawoGLT.exe
  C:\Windows\System\WawoGLT.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\gYLHiEc.exe
  C:\Windows\System\gYLHiEc.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\ElzTLio.exe
  C:\Windows\System\ElzTLio.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\AyLzeyH.exe
  C:\Windows\System\AyLzeyH.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\gOelbBf.exe
  C:\Windows\System\gOelbBf.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\OcwGWSK.exe
  C:\Windows\System\OcwGWSK.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\fcNiMsS.exe
  C:\Windows\System\fcNiMsS.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\fQBSOUm.exe
  C:\Windows\System\fQBSOUm.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\eOrbdZa.exe
  C:\Windows\System\eOrbdZa.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\pJYgJTn.exe
  C:\Windows\System\pJYgJTn.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\DcwaVik.exe
  C:\Windows\System\DcwaVik.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\fElinTn.exe
  C:\Windows\System\fElinTn.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\XwOBAbO.exe
  C:\Windows\System\XwOBAbO.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\hhyiGgg.exe
  C:\Windows\System\hhyiGgg.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\pRtodtm.exe
  C:\Windows\System\pRtodtm.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\iJynjSL.exe
  C:\Windows\System\iJynjSL.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\LZewDwJ.exe
  C:\Windows\System\LZewDwJ.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\RMbnwHB.exe
  C:\Windows\System\RMbnwHB.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\cELIgmL.exe
  C:\Windows\System\cELIgmL.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\ABZLUTa.exe
  C:\Windows\System\ABZLUTa.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\pTdoSUT.exe
  C:\Windows\System\pTdoSUT.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\TooSEJZ.exe
  C:\Windows\System\TooSEJZ.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\FFbqHfr.exe
  C:\Windows\System\FFbqHfr.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\mDmCAyx.exe
  C:\Windows\System\mDmCAyx.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\hEajCIQ.exe
  C:\Windows\System\hEajCIQ.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\xCQMhRq.exe
  C:\Windows\System\xCQMhRq.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\MXwgtCv.exe
  C:\Windows\System\MXwgtCv.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\OXipUxJ.exe
  C:\Windows\System\OXipUxJ.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\UwBBHRH.exe
  C:\Windows\System\UwBBHRH.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\Egvulwo.exe
  C:\Windows\System\Egvulwo.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\uHrWFuJ.exe
  C:\Windows\System\uHrWFuJ.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\AdRiFkj.exe
  C:\Windows\System\AdRiFkj.exe
  2⤵
  PID:1156
- C:\Windows\System\GkPXcMU.exe
  C:\Windows\System\GkPXcMU.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\ZpxYzpO.exe
  C:\Windows\System\ZpxYzpO.exe
  2⤵
  PID:1672
- C:\Windows\System\noGZOJC.exe
  C:\Windows\System\noGZOJC.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\feoQMws.exe
  C:\Windows\System\feoQMws.exe
  2⤵
  PID:1280
- C:\Windows\System\OTSWbSJ.exe
  C:\Windows\System\OTSWbSJ.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\OXcAFRS.exe
  C:\Windows\System\OXcAFRS.exe
  2⤵
  PID:1884
- C:\Windows\System\jUehAnM.exe
  C:\Windows\System\jUehAnM.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\cirRMTJ.exe
  C:\Windows\System\cirRMTJ.exe
  2⤵
  PID:1860
- C:\Windows\System\LetPSic.exe
  C:\Windows\System\LetPSic.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\OMvdDGJ.exe
  C:\Windows\System\OMvdDGJ.exe
  2⤵
  PID:1004
- C:\Windows\System\DXqnkPN.exe
  C:\Windows\System\DXqnkPN.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\INzgoOW.exe
  C:\Windows\System\INzgoOW.exe
  2⤵
  PID:3044
- C:\Windows\System\fjjsGnT.exe
  C:\Windows\System\fjjsGnT.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\vCRSxTj.exe
  C:\Windows\System\vCRSxTj.exe
  2⤵
  PID:1764
- C:\Windows\System\ncFfDFo.exe
  C:\Windows\System\ncFfDFo.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\moXGBbx.exe
  C:\Windows\System\moXGBbx.exe
  2⤵
  PID:1712
- C:\Windows\System\XzPxNUu.exe
  C:\Windows\System\XzPxNUu.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\SxZtdfR.exe
  C:\Windows\System\SxZtdfR.exe
  2⤵
  PID:1508
- C:\Windows\System\gpkrYrO.exe
  C:\Windows\System\gpkrYrO.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\WBEAWLX.exe
  C:\Windows\System\WBEAWLX.exe
  2⤵
  PID:3048
- C:\Windows\System\tTeAjYh.exe
  C:\Windows\System\tTeAjYh.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\yyQGzlU.exe
  C:\Windows\System\yyQGzlU.exe
  2⤵
  PID:2308
- C:\Windows\System\QXQrDPO.exe
  C:\Windows\System\QXQrDPO.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\vupqKFv.exe
  C:\Windows\System\vupqKFv.exe
  2⤵
  PID:2816
- C:\Windows\System\xNRmaJT.exe
  C:\Windows\System\xNRmaJT.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\GqWTelF.exe
  C:\Windows\System\GqWTelF.exe
  2⤵
  PID:2672
- C:\Windows\System\rwTiHsD.exe
  C:\Windows\System\rwTiHsD.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\oYFTDWT.exe
  C:\Windows\System\oYFTDWT.exe
  2⤵
  PID:1844
- C:\Windows\System\IrBVwAR.exe
  C:\Windows\System\IrBVwAR.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\qUtzFJP.exe
  C:\Windows\System\qUtzFJP.exe
  2⤵
  PID:1604
- C:\Windows\System\oxeycKp.exe
  C:\Windows\System\oxeycKp.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\ksgQdci.exe
  C:\Windows\System\ksgQdci.exe
  2⤵
  PID:2156
- C:\Windows\System\BcBuqah.exe
  C:\Windows\System\BcBuqah.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\ROxeXnI.exe
  C:\Windows\System\ROxeXnI.exe
  2⤵
  PID:2956
- C:\Windows\System\UkPekjL.exe
  C:\Windows\System\UkPekjL.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\JWLyCMX.exe
  C:\Windows\System\JWLyCMX.exe
  2⤵
  PID:1848
- C:\Windows\System\ixrCAUh.exe
  C:\Windows\System\ixrCAUh.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\HSQBWWj.exe
  C:\Windows\System\HSQBWWj.exe
  2⤵
  PID:2588
- C:\Windows\System\TNSeZVl.exe
  C:\Windows\System\TNSeZVl.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\aHMqoXE.exe
  C:\Windows\System\aHMqoXE.exe
  2⤵
  PID:1944
- C:\Windows\System\WmQxxSp.exe
  C:\Windows\System\WmQxxSp.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\ipsCHtY.exe
  C:\Windows\System\ipsCHtY.exe
  2⤵
  PID:2960
- C:\Windows\System\zcikKMF.exe
  C:\Windows\System\zcikKMF.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\inFruTE.exe
  C:\Windows\System\inFruTE.exe
  2⤵
  PID:2852
- C:\Windows\System\thFCpbJ.exe
  C:\Windows\System\thFCpbJ.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\lbcfgMp.exe
  C:\Windows\System\lbcfgMp.exe
  2⤵
  PID:1768
- C:\Windows\System\pMdAXKe.exe
  C:\Windows\System\pMdAXKe.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\rzKPqbM.exe
  C:\Windows\System\rzKPqbM.exe
  2⤵
  PID:2760
- C:\Windows\System\JsYJBOl.exe
  C:\Windows\System\JsYJBOl.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\MTmmcHi.exe
  C:\Windows\System\MTmmcHi.exe
  2⤵
  PID:3040
- C:\Windows\System\AsRzZoZ.exe
  C:\Windows\System\AsRzZoZ.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\BioNlQR.exe
  C:\Windows\System\BioNlQR.exe
  2⤵
  PID:292
- C:\Windows\System\IzyIkOa.exe
  C:\Windows\System\IzyIkOa.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\FRzaFeu.exe
  C:\Windows\System\FRzaFeu.exe
  2⤵
  PID:2876
- C:\Windows\System\hIRmxEj.exe
  C:\Windows\System\hIRmxEj.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\XhFYMHM.exe
  C:\Windows\System\XhFYMHM.exe
  2⤵
  PID:3012
- C:\Windows\System\OlYnHDp.exe
  C:\Windows\System\OlYnHDp.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\zQPRgjf.exe
  C:\Windows\System\zQPRgjf.exe
  2⤵
  PID:1868
- C:\Windows\System\EVKHKRH.exe
  C:\Windows\System\EVKHKRH.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\BkGqQsv.exe
  C:\Windows\System\BkGqQsv.exe
  2⤵
  PID:3084
- C:\Windows\System\fdYqFcO.exe
  C:\Windows\System\fdYqFcO.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\MJsjrlU.exe
  C:\Windows\System\MJsjrlU.exe
  2⤵
  PID:3116
- C:\Windows\System\tHMPuUb.exe
  C:\Windows\System\tHMPuUb.exe
  2⤵
  PID:3132
- C:\Windows\System\rgWRIwv.exe
  C:\Windows\System\rgWRIwv.exe
  2⤵
  PID:3148
- C:\Windows\System\UyNFnwM.exe
  C:\Windows\System\UyNFnwM.exe
  2⤵
  PID:3164
- C:\Windows\System\gJTlrAk.exe
  C:\Windows\System\gJTlrAk.exe
  2⤵
  PID:3180
- C:\Windows\System\gklqZEx.exe
  C:\Windows\System\gklqZEx.exe
  2⤵
  PID:3196
- C:\Windows\System\GhcScll.exe
  C:\Windows\System\GhcScll.exe
  2⤵
  PID:3212
- C:\Windows\System\DuSfQLD.exe
  C:\Windows\System\DuSfQLD.exe
  2⤵
  PID:3228
- C:\Windows\System\DtZAsuZ.exe
  C:\Windows\System\DtZAsuZ.exe
  2⤵
  PID:3244
- C:\Windows\System\KTuGyCG.exe
  C:\Windows\System\KTuGyCG.exe
  2⤵
  PID:3260
- C:\Windows\System\IuBnMgv.exe
  C:\Windows\System\IuBnMgv.exe
  2⤵
  PID:3276
- C:\Windows\System\cQtnfls.exe
  C:\Windows\System\cQtnfls.exe
  2⤵
  PID:3292
- C:\Windows\System\XZpjmVw.exe
  C:\Windows\System\XZpjmVw.exe
  2⤵
  PID:3308
- C:\Windows\System\SXqJQKD.exe
  C:\Windows\System\SXqJQKD.exe
  2⤵
  PID:3324
- C:\Windows\System\LZJujgf.exe
  C:\Windows\System\LZJujgf.exe
  2⤵
  PID:3340
- C:\Windows\System\YbTwuvb.exe
  C:\Windows\System\YbTwuvb.exe
  2⤵
  PID:3356
- C:\Windows\System\UGrhhew.exe
  C:\Windows\System\UGrhhew.exe
  2⤵
  PID:3372
- C:\Windows\System\hZlyBGZ.exe
  C:\Windows\System\hZlyBGZ.exe
  2⤵
  PID:3388
- C:\Windows\System\hBgXEtd.exe
  C:\Windows\System\hBgXEtd.exe
  2⤵
  PID:3404
- C:\Windows\System\kZarWbk.exe
  C:\Windows\System\kZarWbk.exe
  2⤵
  PID:3420
- C:\Windows\System\KTsfkuU.exe
  C:\Windows\System\KTsfkuU.exe
  2⤵
  PID:3436
- C:\Windows\System\heVpTXI.exe
  C:\Windows\System\heVpTXI.exe
  2⤵
  PID:3452
- C:\Windows\System\JIoxywk.exe
  C:\Windows\System\JIoxywk.exe
  2⤵
  PID:3468
- C:\Windows\System\TUWaiAT.exe
  C:\Windows\System\TUWaiAT.exe
  2⤵
  PID:3484
- C:\Windows\System\nmxKTXb.exe
  C:\Windows\System\nmxKTXb.exe
  2⤵
  PID:3500
- C:\Windows\System\ZvPdSWp.exe
  C:\Windows\System\ZvPdSWp.exe
  2⤵
  PID:3516
- C:\Windows\System\oRgiIUX.exe
  C:\Windows\System\oRgiIUX.exe
  2⤵
  PID:3532
- C:\Windows\System\ffiheTM.exe
  C:\Windows\System\ffiheTM.exe
  2⤵
  PID:3548
- C:\Windows\System\kRoNyMJ.exe
  C:\Windows\System\kRoNyMJ.exe
  2⤵
  PID:3564
- C:\Windows\System\qbmxYkB.exe
  C:\Windows\System\qbmxYkB.exe
  2⤵
  PID:3580
- C:\Windows\System\wmztoXI.exe
  C:\Windows\System\wmztoXI.exe
  2⤵
  PID:3596
- C:\Windows\System\svAsRuN.exe
  C:\Windows\System\svAsRuN.exe
  2⤵
  PID:3612
- C:\Windows\System\vmVGBEb.exe
  C:\Windows\System\vmVGBEb.exe
  2⤵
  PID:3628
- C:\Windows\System\lwsBwHA.exe
  C:\Windows\System\lwsBwHA.exe
  2⤵
  PID:3644
- C:\Windows\System\lizLHBM.exe
  C:\Windows\System\lizLHBM.exe
  2⤵
  PID:3660
- C:\Windows\System\qlwBoaK.exe
  C:\Windows\System\qlwBoaK.exe
  2⤵
  PID:3676
- C:\Windows\System\poLriKK.exe
  C:\Windows\System\poLriKK.exe
  2⤵
  PID:3692
- C:\Windows\System\LpklBRO.exe
  C:\Windows\System\LpklBRO.exe
  2⤵
  PID:3708
- C:\Windows\System\ucwgcdC.exe
  C:\Windows\System\ucwgcdC.exe
  2⤵
  PID:3724
- C:\Windows\System\TSZJCOG.exe
  C:\Windows\System\TSZJCOG.exe
  2⤵
  PID:3740
- C:\Windows\System\jrnwdEw.exe
  C:\Windows\System\jrnwdEw.exe
  2⤵
  PID:3756
- C:\Windows\System\WQktMVz.exe
  C:\Windows\System\WQktMVz.exe
  2⤵
  PID:3772
- C:\Windows\System\yMlyxGX.exe
  C:\Windows\System\yMlyxGX.exe
  2⤵
  PID:3788
- C:\Windows\System\AOsoYEJ.exe
  C:\Windows\System\AOsoYEJ.exe
  2⤵
  PID:3804
- C:\Windows\System\evYZLSW.exe
  C:\Windows\System\evYZLSW.exe
  2⤵
  PID:3820
- C:\Windows\System\pLjWyDN.exe
  C:\Windows\System\pLjWyDN.exe
  2⤵
  PID:3836
- C:\Windows\System\YwZmuLs.exe
  C:\Windows\System\YwZmuLs.exe
  2⤵
  PID:3852
- C:\Windows\System\TjCycmC.exe
  C:\Windows\System\TjCycmC.exe
  2⤵
  PID:3868
- C:\Windows\System\ftNYOBX.exe
  C:\Windows\System\ftNYOBX.exe
  2⤵
  PID:3884
- C:\Windows\System\iXCOrpR.exe
  C:\Windows\System\iXCOrpR.exe
  2⤵
  PID:3900
- C:\Windows\System\RcYARRH.exe
  C:\Windows\System\RcYARRH.exe
  2⤵
  PID:3916
- C:\Windows\System\dWdfOyo.exe
  C:\Windows\System\dWdfOyo.exe
  2⤵
  PID:3932
- C:\Windows\System\yYyPNyj.exe
  C:\Windows\System\yYyPNyj.exe
  2⤵
  PID:3948
- C:\Windows\System\CcSTlDv.exe
  C:\Windows\System\CcSTlDv.exe
  2⤵
  PID:3964
- C:\Windows\System\eHYggjv.exe
  C:\Windows\System\eHYggjv.exe
  2⤵
  PID:3980
- C:\Windows\System\WZgSwkv.exe
  C:\Windows\System\WZgSwkv.exe
  2⤵
  PID:3996
- C:\Windows\System\RhiPlxk.exe
  C:\Windows\System\RhiPlxk.exe
  2⤵
  PID:4012
- C:\Windows\System\mEzkVIt.exe
  C:\Windows\System\mEzkVIt.exe
  2⤵
  PID:4028
- C:\Windows\System\ZCfOHgA.exe
  C:\Windows\System\ZCfOHgA.exe
  2⤵
  PID:4044
- C:\Windows\System\VoovFcW.exe
  C:\Windows\System\VoovFcW.exe
  2⤵
  PID:4060
- C:\Windows\System\crrfJAm.exe
  C:\Windows\System\crrfJAm.exe
  2⤵
  PID:4076
- C:\Windows\System\GLqWYmo.exe
  C:\Windows\System\GLqWYmo.exe
  2⤵
  PID:4092
- C:\Windows\System\EKOJOzo.exe
  C:\Windows\System\EKOJOzo.exe
  2⤵
  PID:2736
- C:\Windows\System\xgDcUaC.exe
  C:\Windows\System\xgDcUaC.exe
  2⤵
  PID:1276
- C:\Windows\System\ZgTglPx.exe
  C:\Windows\System\ZgTglPx.exe
  2⤵
  PID:2000
- C:\Windows\System\LVaplEr.exe
  C:\Windows\System\LVaplEr.exe
  2⤵
  PID:2792
- C:\Windows\System\reWdKuA.exe
  C:\Windows\System\reWdKuA.exe
  2⤵
  PID:2616
- C:\Windows\System\cqeEqxk.exe
  C:\Windows\System\cqeEqxk.exe
  2⤵
  PID:3112
- C:\Windows\System\qeJJdKP.exe
  C:\Windows\System\qeJJdKP.exe
  2⤵
  PID:3176
- C:\Windows\System\vLanAxt.exe
  C:\Windows\System\vLanAxt.exe
  2⤵
  PID:3240
- C:\Windows\System\FhdypaB.exe
  C:\Windows\System\FhdypaB.exe
  2⤵
  PID:3304
- C:\Windows\System\ZLuXPDi.exe
  C:\Windows\System\ZLuXPDi.exe
  2⤵
  PID:3368
- C:\Windows\System\tttfLIJ.exe
  C:\Windows\System\tttfLIJ.exe
  2⤵
  PID:3432
- C:\Windows\System\KeeqKPn.exe
  C:\Windows\System\KeeqKPn.exe
  2⤵
  PID:1300
- C:\Windows\System\hddlPCj.exe
  C:\Windows\System\hddlPCj.exe
  2⤵
  PID:3528
- C:\Windows\System\WtAPcqM.exe
  C:\Windows\System\WtAPcqM.exe
  2⤵
  PID:2712
- C:\Windows\System\wHUPSIi.exe
  C:\Windows\System\wHUPSIi.exe
  2⤵
  PID:3652
- C:\Windows\System\TyozMVb.exe
  C:\Windows\System\TyozMVb.exe
  2⤵
  PID:3716
- C:\Windows\System\NCkSkca.exe
  C:\Windows\System\NCkSkca.exe
  2⤵
  PID:3780
- C:\Windows\System\ksQDUSR.exe
  C:\Windows\System\ksQDUSR.exe
  2⤵
  PID:3024
- C:\Windows\System\nSLgdOi.exe
  C:\Windows\System\nSLgdOi.exe
  2⤵
  PID:3848
- C:\Windows\System\reznsJF.exe
  C:\Windows\System\reznsJF.exe
  2⤵
  PID:3912
- C:\Windows\System\mKwrLwy.exe
  C:\Windows\System\mKwrLwy.exe
  2⤵
  PID:3976
- C:\Windows\System\uSUVUjm.exe
  C:\Windows\System\uSUVUjm.exe
  2⤵
  PID:1236
- C:\Windows\System\jinDkxW.exe
  C:\Windows\System\jinDkxW.exe
  2⤵
  PID:4068
- C:\Windows\System\jbVSZQf.exe
  C:\Windows\System\jbVSZQf.exe
  2⤵
  PID:1124
- C:\Windows\System\vcgwHvP.exe
  C:\Windows\System\vcgwHvP.exe
  2⤵
  PID:3144
- C:\Windows\System\VKqVmrH.exe
  C:\Windows\System\VKqVmrH.exe
  2⤵
  PID:4112
- C:\Windows\System\ytNrDPD.exe
  C:\Windows\System\ytNrDPD.exe
  2⤵
  PID:4128
- C:\Windows\System\wHgAzfL.exe
  C:\Windows\System\wHgAzfL.exe
  2⤵
  PID:4144
- C:\Windows\System\HoNmZcQ.exe
  C:\Windows\System\HoNmZcQ.exe
  2⤵
  PID:4160
- C:\Windows\System\DYJPZmx.exe
  C:\Windows\System\DYJPZmx.exe
  2⤵
  PID:4176
- C:\Windows\System\xlqpoqH.exe
  C:\Windows\System\xlqpoqH.exe
  2⤵
  PID:4192
- C:\Windows\System\bAAcpdp.exe
  C:\Windows\System\bAAcpdp.exe
  2⤵
  PID:4208
- C:\Windows\System\foWZSQA.exe
  C:\Windows\System\foWZSQA.exe
  2⤵
  PID:4224
- C:\Windows\System\kQsZXTH.exe
  C:\Windows\System\kQsZXTH.exe
  2⤵
  PID:4240
- C:\Windows\System\BfXdBYU.exe
  C:\Windows\System\BfXdBYU.exe
  2⤵
  PID:4256
- C:\Windows\System\xYqnBfu.exe
  C:\Windows\System\xYqnBfu.exe
  2⤵
  PID:4272
- C:\Windows\System\pwcHYHH.exe
  C:\Windows\System\pwcHYHH.exe
  2⤵
  PID:4288
- C:\Windows\System\VtOfbQh.exe
  C:\Windows\System\VtOfbQh.exe
  2⤵
  PID:4304
- C:\Windows\System\BYmRzTn.exe
  C:\Windows\System\BYmRzTn.exe
  2⤵
  PID:4320
- C:\Windows\System\OuFZNlq.exe
  C:\Windows\System\OuFZNlq.exe
  2⤵
  PID:4336
- C:\Windows\System\iKFTIRP.exe
  C:\Windows\System\iKFTIRP.exe
  2⤵
  PID:4352
- C:\Windows\System\IzEWyPV.exe
  C:\Windows\System\IzEWyPV.exe
  2⤵
  PID:4368
- C:\Windows\System\QTQQkSK.exe
  C:\Windows\System\QTQQkSK.exe
  2⤵
  PID:4384
- C:\Windows\System\lofegBv.exe
  C:\Windows\System\lofegBv.exe
  2⤵
  PID:4400
- C:\Windows\System\FRZaqXi.exe
  C:\Windows\System\FRZaqXi.exe
  2⤵
  PID:4416
- C:\Windows\System\bdimzrW.exe
  C:\Windows\System\bdimzrW.exe
  2⤵
  PID:4432
- C:\Windows\System\DilaIeU.exe
  C:\Windows\System\DilaIeU.exe
  2⤵
  PID:4448
- C:\Windows\System\gOvMKIz.exe
  C:\Windows\System\gOvMKIz.exe
  2⤵
  PID:4464
- C:\Windows\System\ilRATlb.exe
  C:\Windows\System\ilRATlb.exe
  2⤵
  PID:4480
- C:\Windows\System\ZWyExpl.exe
  C:\Windows\System\ZWyExpl.exe
  2⤵
  PID:4496
- C:\Windows\System\HRcJgAd.exe
  C:\Windows\System\HRcJgAd.exe
  2⤵
  PID:4512
- C:\Windows\System\WHLzZAn.exe
  C:\Windows\System\WHLzZAn.exe
  2⤵
  PID:4528
- C:\Windows\System\ZklZEpe.exe
  C:\Windows\System\ZklZEpe.exe
  2⤵
  PID:4544
- C:\Windows\System\KLdkDnF.exe
  C:\Windows\System\KLdkDnF.exe
  2⤵
  PID:4560
- C:\Windows\System\UmiTYoW.exe
  C:\Windows\System\UmiTYoW.exe
  2⤵
  PID:4576
- C:\Windows\System\lWpyeaf.exe
  C:\Windows\System\lWpyeaf.exe
  2⤵
  PID:4592
- C:\Windows\System\yKBukaY.exe
  C:\Windows\System\yKBukaY.exe
  2⤵
  PID:4608
- C:\Windows\System\APHzRBX.exe
  C:\Windows\System\APHzRBX.exe
  2⤵
  PID:4624
- C:\Windows\System\jofrZVG.exe
  C:\Windows\System\jofrZVG.exe
  2⤵
  PID:4640
- C:\Windows\System\dJmUzvi.exe
  C:\Windows\System\dJmUzvi.exe
  2⤵
  PID:4656
- C:\Windows\System\UTsxCjV.exe
  C:\Windows\System\UTsxCjV.exe
  2⤵
  PID:4672
- C:\Windows\System\SrGkmNs.exe
  C:\Windows\System\SrGkmNs.exe
  2⤵
  PID:4688
- C:\Windows\System\mjwEPLk.exe
  C:\Windows\System\mjwEPLk.exe
  2⤵
  PID:4704
- C:\Windows\System\yFJFJHe.exe
  C:\Windows\System\yFJFJHe.exe
  2⤵
  PID:4720
- C:\Windows\System\PtTBJhL.exe
  C:\Windows\System\PtTBJhL.exe
  2⤵
  PID:4736
- C:\Windows\System\mLLoJHR.exe
  C:\Windows\System\mLLoJHR.exe
  2⤵
  PID:4752
- C:\Windows\System\oGBpvRS.exe
  C:\Windows\System\oGBpvRS.exe
  2⤵
  PID:4768
- C:\Windows\System\BjJalAL.exe
  C:\Windows\System\BjJalAL.exe
  2⤵
  PID:4784
- C:\Windows\System\VHhZzVF.exe
  C:\Windows\System\VHhZzVF.exe
  2⤵
  PID:4800
- C:\Windows\System\WihLobA.exe
  C:\Windows\System\WihLobA.exe
  2⤵
  PID:4816
- C:\Windows\System\cgMzlnW.exe
  C:\Windows\System\cgMzlnW.exe
  2⤵
  PID:4832
- C:\Windows\System\UCJxanV.exe
  C:\Windows\System\UCJxanV.exe
  2⤵
  PID:4848
- C:\Windows\System\DHrJrCf.exe
  C:\Windows\System\DHrJrCf.exe
  2⤵
  PID:4864
- C:\Windows\System\SpHZvNx.exe
  C:\Windows\System\SpHZvNx.exe
  2⤵
  PID:4880
- C:\Windows\System\FpUnCfl.exe
  C:\Windows\System\FpUnCfl.exe
  2⤵
  PID:4896
- C:\Windows\System\EuTULIv.exe
  C:\Windows\System\EuTULIv.exe
  2⤵
  PID:4912
- C:\Windows\System\VzILSZL.exe
  C:\Windows\System\VzILSZL.exe
  2⤵
  PID:4928
- C:\Windows\System\uVRIdMd.exe
  C:\Windows\System\uVRIdMd.exe
  2⤵
  PID:4944
- C:\Windows\System\IXjGkpz.exe
  C:\Windows\System\IXjGkpz.exe
  2⤵
  PID:4960
- C:\Windows\System\ZscVgKK.exe
  C:\Windows\System\ZscVgKK.exe
  2⤵
  PID:4976
- C:\Windows\System\rkPUfUk.exe
  C:\Windows\System\rkPUfUk.exe
  2⤵
  PID:4992
- C:\Windows\System\rZNMEEW.exe
  C:\Windows\System\rZNMEEW.exe
  2⤵
  PID:5008
- C:\Windows\System\rUazsvI.exe
  C:\Windows\System\rUazsvI.exe
  2⤵
  PID:5024
- C:\Windows\System\RBMWAsw.exe
  C:\Windows\System\RBMWAsw.exe
  2⤵
  PID:5040
- C:\Windows\System\VaiYCob.exe
  C:\Windows\System\VaiYCob.exe
  2⤵
  PID:5056
- C:\Windows\System\WPVWpUB.exe
  C:\Windows\System\WPVWpUB.exe
  2⤵
  PID:5072
- C:\Windows\System\CLAeare.exe
  C:\Windows\System\CLAeare.exe
  2⤵
  PID:5088
- C:\Windows\System\PPozHiP.exe
  C:\Windows\System\PPozHiP.exe
  2⤵
  PID:5104
- C:\Windows\System\xKxQiip.exe
  C:\Windows\System\xKxQiip.exe
  2⤵
  PID:3172
- C:\Windows\System\fhjrkai.exe
  C:\Windows\System\fhjrkai.exe
  2⤵
  PID:3428
- C:\Windows\System\ywrXPvL.exe
  C:\Windows\System\ywrXPvL.exe
  2⤵
  PID:3624
- C:\Windows\System\gNdZmwv.exe
  C:\Windows\System\gNdZmwv.exe
  2⤵
  PID:2284
- C:\Windows\System\ISQatyN.exe
  C:\Windows\System\ISQatyN.exe
  2⤵
  PID:4040
- C:\Windows\System\hIXGwSD.exe
  C:\Windows\System\hIXGwSD.exe
  2⤵
  PID:4124
- C:\Windows\System\SdxHDMx.exe
  C:\Windows\System\SdxHDMx.exe
  2⤵
  PID:4188
- C:\Windows\System\KVYkGLF.exe
  C:\Windows\System\KVYkGLF.exe
  2⤵
  PID:4252
- C:\Windows\System\eDVPKof.exe
  C:\Windows\System\eDVPKof.exe
  2⤵
  PID:4316
- C:\Windows\System\sagdvAz.exe
  C:\Windows\System\sagdvAz.exe
  2⤵
  PID:4380
- C:\Windows\System\xrNRAiW.exe
  C:\Windows\System\xrNRAiW.exe
  2⤵
  PID:4440
- C:\Windows\System\JStncrm.exe
  C:\Windows\System\JStncrm.exe
  2⤵
  PID:4504
- C:\Windows\System\qAUjqLi.exe
  C:\Windows\System\qAUjqLi.exe
  2⤵
  PID:4540
- C:\Windows\System\aFTmNKA.exe
  C:\Windows\System\aFTmNKA.exe
  2⤵
  PID:4600
- C:\Windows\System\FMhrygT.exe
  C:\Windows\System\FMhrygT.exe
  2⤵
  PID:4636
- C:\Windows\System\kCAMZNj.exe
  C:\Windows\System\kCAMZNj.exe
  2⤵
  PID:4696
- C:\Windows\System\KyrEaUj.exe
  C:\Windows\System\KyrEaUj.exe
  2⤵
  PID:2972
- C:\Windows\System\RVbxDky.exe
  C:\Windows\System\RVbxDky.exe
  2⤵
  PID:316
- C:\Windows\System\beYDyyZ.exe
  C:\Windows\System\beYDyyZ.exe
  2⤵
  PID:4796
- C:\Windows\System\TtasyrW.exe
  C:\Windows\System\TtasyrW.exe
  2⤵
  PID:2900
- C:\Windows\System\NATuHFH.exe
  C:\Windows\System\NATuHFH.exe
  2⤵
  PID:4892
- C:\Windows\System\YjaxOnr.exe
  C:\Windows\System\YjaxOnr.exe
  2⤵
  PID:4924
- C:\Windows\System\CSaqjBM.exe
  C:\Windows\System\CSaqjBM.exe
  2⤵
  PID:4956
- C:\Windows\System\FHZSKFF.exe
  C:\Windows\System\FHZSKFF.exe
  2⤵
  PID:704
- C:\Windows\System\IILHHKt.exe
  C:\Windows\System\IILHHKt.exe
  2⤵
  PID:2416
- C:\Windows\System\eKUgrmI.exe
  C:\Windows\System\eKUgrmI.exe
  2⤵
  PID:5020
- C:\Windows\System\odybJvM.exe
  C:\Windows\System\odybJvM.exe
  2⤵
  PID:5080
- C:\Windows\System\CxhpNyb.exe
  C:\Windows\System\CxhpNyb.exe
  2⤵
  PID:5116
- C:\Windows\System\KbAyyVF.exe
  C:\Windows\System\KbAyyVF.exe
  2⤵
  PID:4036
- C:\Windows\System\AvjiMoa.exe
  C:\Windows\System\AvjiMoa.exe
  2⤵
  PID:1220
- C:\Windows\System\NFOwhlX.exe
  C:\Windows\System\NFOwhlX.exe
  2⤵
  PID:4412
- C:\Windows\System\uYWSNHb.exe
  C:\Windows\System\uYWSNHb.exe
  2⤵
  PID:4536
- C:\Windows\System\uGGyuQI.exe
  C:\Windows\System\uGGyuQI.exe
  2⤵
  PID:764
- C:\Windows\System\CTCVIFl.exe
  C:\Windows\System\CTCVIFl.exe
  2⤵
  PID:2976
- C:\Windows\System\OCCQhKg.exe
  C:\Windows\System\OCCQhKg.exe
  2⤵
  PID:4792
- C:\Windows\System\pXduTGe.exe
  C:\Windows\System\pXduTGe.exe
  2⤵
  PID:4952
- C:\Windows\System\yKzbsDr.exe
  C:\Windows\System\yKzbsDr.exe
  2⤵
  PID:5052
- C:\Windows\System\IooZOQj.exe
  C:\Windows\System\IooZOQj.exe
  2⤵
  PID:2164
- C:\Windows\System\qMKUAWd.exe
  C:\Windows\System\qMKUAWd.exe
  2⤵
  PID:4764
- C:\Windows\System\vpboZWI.exe
  C:\Windows\System\vpboZWI.exe
  2⤵
  PID:1916
- C:\Windows\System\KwcEOvR.exe
  C:\Windows\System\KwcEOvR.exe
  2⤵
  PID:5140
- C:\Windows\System\UAMzATP.exe
  C:\Windows\System\UAMzATP.exe
  2⤵
  PID:5156
- C:\Windows\System\BourEhY.exe
  C:\Windows\System\BourEhY.exe
  2⤵
  PID:5176
- C:\Windows\System\ffEdHXA.exe
  C:\Windows\System\ffEdHXA.exe
  2⤵
  PID:5192
- C:\Windows\System\trexEBT.exe
  C:\Windows\System\trexEBT.exe
  2⤵
  PID:5768
- C:\Windows\System\FdzqCmW.exe
  C:\Windows\System\FdzqCmW.exe
  2⤵
  PID:5796
- C:\Windows\System\hvsDSXr.exe
  C:\Windows\System\hvsDSXr.exe
  2⤵
  PID:5916
- C:\Windows\System\OPsigzu.exe
  C:\Windows\System\OPsigzu.exe
  2⤵
  PID:6136
- C:\Windows\System\UZFRDFV.exe
  C:\Windows\System\UZFRDFV.exe
  2⤵
  PID:5136
- C:\Windows\System\KkQBKDC.exe
  C:\Windows\System\KkQBKDC.exe
  2⤵
  PID:2236
- C:\Windows\System\ebVCZXW.exe
  C:\Windows\System\ebVCZXW.exe
  2⤵
  PID:1304
- C:\Windows\System\moEISgp.exe
  C:\Windows\System\moEISgp.exe
  2⤵
  PID:1932
- C:\Windows\System\dMyuICP.exe
  C:\Windows\System\dMyuICP.exe
  2⤵
  PID:2752
- C:\Windows\System\sppdqDD.exe
  C:\Windows\System\sppdqDD.exe
  2⤵
  PID:2280
- C:\Windows\System\bPGvkyK.exe
  C:\Windows\System\bPGvkyK.exe
  2⤵
  PID:1408
- C:\Windows\System\VRocEsb.exe
  C:\Windows\System\VRocEsb.exe
  2⤵
  PID:2524
- C:\Windows\System\YIqZrXF.exe
  C:\Windows\System\YIqZrXF.exe
  2⤵
  PID:2092
- C:\Windows\System\zYfLlEm.exe
  C:\Windows\System\zYfLlEm.exe
  2⤵
  PID:584
- C:\Windows\System\dFLnntf.exe
  C:\Windows\System\dFLnntf.exe
  2⤵
  PID:1888
- C:\Windows\System\DpDTuBm.exe
  C:\Windows\System\DpDTuBm.exe
  2⤵
  PID:1252
- C:\Windows\System\NVbagdF.exe
  C:\Windows\System\NVbagdF.exe
  2⤵
  PID:3064
- C:\Windows\System\giBIqPM.exe
  C:\Windows\System\giBIqPM.exe
  2⤵
  PID:3128
- C:\Windows\System\mERTNYp.exe
  C:\Windows\System\mERTNYp.exe
  2⤵
  PID:3192
- C:\Windows\System\JbwZhyr.exe
  C:\Windows\System\JbwZhyr.exe
  2⤵
  PID:3768
- C:\Windows\System\HEjDTbi.exe
  C:\Windows\System\HEjDTbi.exe
  2⤵
  PID:5280
- C:\Windows\System\VdtCQjw.exe
  C:\Windows\System\VdtCQjw.exe
  2⤵
  PID:5324
- C:\Windows\System\oZcEKxA.exe
  C:\Windows\System\oZcEKxA.exe
  2⤵
  PID:5356
- C:\Windows\System\jYTUKsf.exe
  C:\Windows\System\jYTUKsf.exe
  2⤵
  PID:5380
- C:\Windows\System\mHzTqov.exe
  C:\Windows\System\mHzTqov.exe
  2⤵
  PID:5408
- C:\Windows\System\AMkEKXG.exe
  C:\Windows\System\AMkEKXG.exe
  2⤵
  PID:5424
- C:\Windows\System\uvdjIkF.exe
  C:\Windows\System\uvdjIkF.exe
  2⤵
  PID:5440
- C:\Windows\System\qJHbenF.exe
  C:\Windows\System\qJHbenF.exe
  2⤵
  PID:5460
- C:\Windows\System\AoVfEuk.exe
  C:\Windows\System\AoVfEuk.exe
  2⤵
  PID:5476
- C:\Windows\System\rNJTZcu.exe
  C:\Windows\System\rNJTZcu.exe
  2⤵
  PID:5500
- C:\Windows\System\CelwncU.exe
  C:\Windows\System\CelwncU.exe
  2⤵
  PID:5516
- C:\Windows\System\QIRtNtZ.exe
  C:\Windows\System\QIRtNtZ.exe
  2⤵
  PID:5536
- C:\Windows\System\QIObHjq.exe
  C:\Windows\System\QIObHjq.exe
  2⤵
  PID:5552
- C:\Windows\System\kzKhGmT.exe
  C:\Windows\System\kzKhGmT.exe
  2⤵
  PID:5580
- C:\Windows\System\QWduJvC.exe
  C:\Windows\System\QWduJvC.exe
  2⤵
  PID:5600
- C:\Windows\System\jxRsVvQ.exe
  C:\Windows\System\jxRsVvQ.exe
  2⤵
  PID:5620
- C:\Windows\System\urmsRDV.exe
  C:\Windows\System\urmsRDV.exe
  2⤵
  PID:5644
- C:\Windows\System\hFTySzT.exe
  C:\Windows\System\hFTySzT.exe
  2⤵
  PID:5664
- C:\Windows\System\vADbdzg.exe
  C:\Windows\System\vADbdzg.exe
  2⤵
  PID:5680
- C:\Windows\System\FjqZKto.exe
  C:\Windows\System\FjqZKto.exe
  2⤵
  PID:5712
- C:\Windows\System\aPEmnck.exe
  C:\Windows\System\aPEmnck.exe
  2⤵
  PID:5728
- C:\Windows\System\CoawshJ.exe
  C:\Windows\System\CoawshJ.exe
  2⤵
  PID:5748
- C:\Windows\System\yHkQrIW.exe
  C:\Windows\System\yHkQrIW.exe
  2⤵
  PID:3108
- C:\Windows\System\AUNldYI.exe
  C:\Windows\System\AUNldYI.exe
  2⤵
  PID:3364
- C:\Windows\System\FkVlQXI.exe
  C:\Windows\System\FkVlQXI.exe
  2⤵
  PID:5812
- C:\Windows\System\nsKafPl.exe
  C:\Windows\System\nsKafPl.exe
  2⤵
  PID:5828
- C:\Windows\System\XUvEyoT.exe
  C:\Windows\System\XUvEyoT.exe
  2⤵
  PID:5844
- C:\Windows\System\BbspSAJ.exe
  C:\Windows\System\BbspSAJ.exe
  2⤵
  PID:5860
- C:\Windows\System\JCOrkzF.exe
  C:\Windows\System\JCOrkzF.exe
  2⤵
  PID:5876
- C:\Windows\System\VWAotPc.exe
  C:\Windows\System\VWAotPc.exe
  2⤵
  PID:5892
- C:\Windows\System\DhLQnin.exe
  C:\Windows\System\DhLQnin.exe
  2⤵
  PID:5896
- C:\Windows\System\VoWthdj.exe
  C:\Windows\System\VoWthdj.exe
  2⤵
  PID:5904
- C:\Windows\System\ZMMoZmC.exe
  C:\Windows\System\ZMMoZmC.exe
  2⤵
  PID:4008
- C:\Windows\System\nEaCswO.exe
  C:\Windows\System\nEaCswO.exe
  2⤵
  PID:5912
- C:\Windows\System\bjgdYQT.exe
  C:\Windows\System\bjgdYQT.exe
  2⤵
  PID:4204
- C:\Windows\System\cvRfgTZ.exe
  C:\Windows\System\cvRfgTZ.exe
  2⤵
  PID:4428
- C:\Windows\System\NVQNWwx.exe
  C:\Windows\System\NVQNWwx.exe
  2⤵
  PID:4332
- C:\Windows\System\spMVPYa.exe
  C:\Windows\System\spMVPYa.exe
  2⤵
  PID:4268
- C:\Windows\System\DfERRds.exe
  C:\Windows\System\DfERRds.exe
  2⤵
  PID:4520
- C:\Windows\System\CwQMdaD.exe
  C:\Windows\System\CwQMdaD.exe
  2⤵
  PID:4524
- C:\Windows\System\QOnVYrm.exe
  C:\Windows\System\QOnVYrm.exe
  2⤵
  PID:4808
- C:\Windows\System\tmpoFCY.exe
  C:\Windows\System\tmpoFCY.exe
  2⤵
  PID:4840
- C:\Windows\System\fNlQVez.exe
  C:\Windows\System\fNlQVez.exe
  2⤵
  PID:4968
- C:\Windows\System\wocCfdV.exe
  C:\Windows\System\wocCfdV.exe
  2⤵
  PID:5000
- C:\Windows\System\POVmxKh.exe
  C:\Windows\System\POVmxKh.exe
  2⤵
  PID:5068
- C:\Windows\System\erTBTCs.exe
  C:\Windows\System\erTBTCs.exe
  2⤵
  PID:3300
- C:\Windows\System\SwpWpaf.exe
  C:\Windows\System\SwpWpaf.exe
  2⤵
  PID:1980
- C:\Windows\System\OENcFPk.exe
  C:\Windows\System\OENcFPk.exe
  2⤵
  PID:4348
- C:\Windows\System\SJEUBKw.exe
  C:\Windows\System\SJEUBKw.exe
  2⤵
  PID:808
- C:\Windows\System\msWTWAV.exe
  C:\Windows\System\msWTWAV.exe
  2⤵
  PID:4732
- C:\Windows\System\CpFiHJL.exe
  C:\Windows\System\CpFiHJL.exe
  2⤵
  PID:4588
- C:\Windows\System\kvvqeAy.exe
  C:\Windows\System\kvvqeAy.exe
  2⤵
  PID:4620
- C:\Windows\System\UNagiHU.exe
  C:\Windows\System\UNagiHU.exe
  2⤵
  PID:696
- C:\Windows\System\rwItKbd.exe
  C:\Windows\System\rwItKbd.exe
  2⤵
  PID:4156
- C:\Windows\System\GFqdBqU.exe
  C:\Windows\System\GFqdBqU.exe
  2⤵
  PID:2860
- C:\Windows\System\yFCebIk.exe
  C:\Windows\System\yFCebIk.exe
  2⤵
  PID:4888
- C:\Windows\System\dEDPtpo.exe
  C:\Windows\System\dEDPtpo.exe
  2⤵
  PID:2252
- C:\Windows\System\ZUFpgRc.exe
  C:\Windows\System\ZUFpgRc.exe
  2⤵
  PID:2256
- C:\Windows\System\luzGaQD.exe
  C:\Windows\System\luzGaQD.exe
  2⤵
  PID:5188
- C:\Windows\System\ECyLmyG.exe
  C:\Windows\System\ECyLmyG.exe
  2⤵
  PID:5788
- C:\Windows\System\bTaTOsn.exe
  C:\Windows\System\bTaTOsn.exe
  2⤵
  PID:5932
- C:\Windows\System\TxDGyao.exe
  C:\Windows\System\TxDGyao.exe
  2⤵
  PID:5948
- C:\Windows\System\FvydrwG.exe
  C:\Windows\System\FvydrwG.exe
  2⤵
  PID:5972
- C:\Windows\System\hVoHCOA.exe
  C:\Windows\System\hVoHCOA.exe
  2⤵
  PID:5988
- C:\Windows\System\IQxQZwe.exe
  C:\Windows\System\IQxQZwe.exe
  2⤵
  PID:6016
- C:\Windows\System\mXHwtIs.exe
  C:\Windows\System\mXHwtIs.exe
  2⤵
  PID:6032
- C:\Windows\System\UWwdpvG.exe
  C:\Windows\System\UWwdpvG.exe
  2⤵
  PID:6048
- C:\Windows\System\GUFmMPk.exe
  C:\Windows\System\GUFmMPk.exe
  2⤵
  PID:6068
- C:\Windows\System\enUrisl.exe
  C:\Windows\System\enUrisl.exe
  2⤵
  PID:1920
- C:\Windows\System\QOPTUuR.exe
  C:\Windows\System\QOPTUuR.exe
  2⤵
  PID:5128
- C:\Windows\System\HmpVvsr.exe
  C:\Windows\System\HmpVvsr.exe
  2⤵
  PID:1780
- C:\Windows\System\cIxqqXC.exe
  C:\Windows\System\cIxqqXC.exe
  2⤵
  PID:1528
- C:\Windows\System\iqhNvwI.exe
  C:\Windows\System\iqhNvwI.exe
  2⤵
  PID:2720
- C:\Windows\System\ZZHuQfM.exe
  C:\Windows\System\ZZHuQfM.exe
  2⤵
  PID:1824
- C:\Windows\System\uEzEiHX.exe
  C:\Windows\System\uEzEiHX.exe
  2⤵
  PID:2184
- C:\Windows\System\Pbhdfjv.exe
  C:\Windows\System\Pbhdfjv.exe
  2⤵
  PID:2108
- C:\Windows\System\wjHETZP.exe
  C:\Windows\System\wjHETZP.exe
  2⤵
  PID:2896
- C:\Windows\System\DlMsErz.exe
  C:\Windows\System\DlMsErz.exe
  2⤵
  PID:2648
- C:\Windows\System\jRGfbGv.exe
  C:\Windows\System\jRGfbGv.exe
  2⤵
  PID:2812
- C:\Windows\System\UvWMAiK.exe
  C:\Windows\System\UvWMAiK.exe
  2⤵
  PID:2744
- C:\Windows\System\pFtFpwi.exe
  C:\Windows\System\pFtFpwi.exe
  2⤵
  PID:1788
- C:\Windows\System\dKnFHKe.exe
  C:\Windows\System\dKnFHKe.exe
  2⤵
  PID:1572
- C:\Windows\System\tiIPTxL.exe
  C:\Windows\System\tiIPTxL.exe
  2⤵
  PID:3188
- C:\Windows\System\HreIDNw.exe
  C:\Windows\System\HreIDNw.exe
  2⤵
  PID:5212
- C:\Windows\System\FtYXPwl.exe
  C:\Windows\System\FtYXPwl.exe
  2⤵
  PID:3252
- C:\Windows\System\GsLaSUo.exe
  C:\Windows\System\GsLaSUo.exe
  2⤵
  PID:3832
- C:\Windows\System\NuOINNT.exe
  C:\Windows\System\NuOINNT.exe
  2⤵
  PID:3864
- C:\Windows\System\kPJLkcv.exe
  C:\Windows\System\kPJLkcv.exe
  2⤵
  PID:3960
- C:\Windows\System\ydzsSKL.exe
  C:\Windows\System\ydzsSKL.exe
  2⤵
  PID:4052
- C:\Windows\System\UWVDhGA.exe
  C:\Windows\System\UWVDhGA.exe
  2⤵
  PID:484
- C:\Windows\System\MOaafuj.exe
  C:\Windows\System\MOaafuj.exe
  2⤵
  PID:3080
- C:\Windows\System\ELzscgD.exe
  C:\Windows\System\ELzscgD.exe
  2⤵
  PID:5224
- C:\Windows\System\STHplqy.exe
  C:\Windows\System\STHplqy.exe
  2⤵
  PID:3576
- C:\Windows\System\PwfyRTm.exe
  C:\Windows\System\PwfyRTm.exe
  2⤵
  PID:3604
- C:\Windows\System\POBKLdy.exe
  C:\Windows\System\POBKLdy.exe
  2⤵
  PID:3732
- C:\Windows\System\lARpcgs.exe
  C:\Windows\System\lARpcgs.exe
  2⤵
  PID:3476
- C:\Windows\System\IWukGai.exe
  C:\Windows\System\IWukGai.exe
  2⤵
  PID:3352
- C:\Windows\System\sinRmPm.exe
  C:\Windows\System\sinRmPm.exe
  2⤵
  PID:552
- C:\Windows\System\RjZuGbX.exe
  C:\Windows\System\RjZuGbX.exe
  2⤵
  PID:3636
- C:\Windows\System\CTiySPy.exe
  C:\Windows\System\CTiySPy.exe
  2⤵
  PID:5256
- C:\Windows\System\lTBAszP.exe
  C:\Windows\System\lTBAszP.exe
  2⤵
  PID:5272
- C:\Windows\System\tVWyiVZ.exe
  C:\Windows\System\tVWyiVZ.exe
  2⤵
  PID:5296
- C:\Windows\System\zayUZKW.exe
  C:\Windows\System\zayUZKW.exe
  2⤵
  PID:2580
- C:\Windows\System\XHbnZDa.exe
  C:\Windows\System\XHbnZDa.exe
  2⤵
  PID:5340
- C:\Windows\System\mkxQUOB.exe
  C:\Windows\System\mkxQUOB.exe
  2⤵
  PID:5292
- C:\Windows\System\lofLHBz.exe
  C:\Windows\System\lofLHBz.exe
  2⤵
  PID:2556
- C:\Windows\System\TJDmZYi.exe
  C:\Windows\System\TJDmZYi.exe
  2⤵
  PID:5372
- C:\Windows\System\xaIFECc.exe
  C:\Windows\System\xaIFECc.exe
  2⤵
  PID:5532
- C:\Windows\System\ihsWyMg.exe
  C:\Windows\System\ihsWyMg.exe
  2⤵
  PID:5564
- C:\Windows\System\oALEIra.exe
  C:\Windows\System\oALEIra.exe
  2⤵
  PID:5508
- C:\Windows\System\zpGqlkO.exe
  C:\Windows\System\zpGqlkO.exe
  2⤵
  PID:5636
- C:\Windows\System\UbweKse.exe
  C:\Windows\System\UbweKse.exe
  2⤵
  PID:5656
- C:\Windows\System\PZcgVUz.exe
  C:\Windows\System\PZcgVUz.exe
  2⤵
  PID:5676
- C:\Windows\System\aVVgXcw.exe
  C:\Windows\System\aVVgXcw.exe
  2⤵
  PID:5720
- C:\Windows\System\KafSwjB.exe
  C:\Windows\System\KafSwjB.exe
  2⤵
  PID:5752
- C:\Windows\System\eHVKYWO.exe
  C:\Windows\System\eHVKYWO.exe
  2⤵
  PID:5764
- C:\Windows\System\cIJrsiy.exe
  C:\Windows\System\cIJrsiy.exe
  2⤵
  PID:3460
- C:\Windows\System\IVJWugI.exe
  C:\Windows\System\IVJWugI.exe
  2⤵
  PID:3684
- C:\Windows\System\VgjmwpE.exe
  C:\Windows\System\VgjmwpE.exe
  2⤵
  PID:4168
- C:\Windows\System\hEuBaMB.exe
  C:\Windows\System\hEuBaMB.exe
  2⤵
  PID:5824
- C:\Windows\System\aacEsSS.exe
  C:\Windows\System\aacEsSS.exe
  2⤵
  PID:5884
- C:\Windows\System\IJAwMkZ.exe
  C:\Windows\System\IJAwMkZ.exe
  2⤵
  PID:4680
- C:\Windows\System\iVOqZYX.exe
  C:\Windows\System\iVOqZYX.exe
  2⤵
  PID:5036
- C:\Windows\System\FhdtkOp.exe
  C:\Windows\System\FhdtkOp.exe
  2⤵
  PID:1900
- C:\Windows\System\SgIIvTC.exe
  C:\Windows\System\SgIIvTC.exe
  2⤵
  PID:3028
- C:\Windows\System\sXsROfB.exe
  C:\Windows\System\sXsROfB.exe
  2⤵
  PID:4108
- C:\Windows\System\XeoGNzf.exe
  C:\Windows\System\XeoGNzf.exe
  2⤵
  PID:4936
- C:\Windows\System\OOqxfwJ.exe
  C:\Windows\System\OOqxfwJ.exe
  2⤵
  PID:4556
- C:\Windows\System\dhMoVsc.exe
  C:\Windows\System\dhMoVsc.exe
  2⤵
  PID:4236
- C:\Windows\System\mBKkAMP.exe
  C:\Windows\System\mBKkAMP.exe
  2⤵
  PID:348
- C:\Windows\System\NuWecHg.exe
  C:\Windows\System\NuWecHg.exe
  2⤵
  PID:5808
- C:\Windows\System\kxYWndU.exe
  C:\Windows\System\kxYWndU.exe
  2⤵
  PID:1076
- C:\Windows\System\XTbgldI.exe
  C:\Windows\System\XTbgldI.exe
  2⤵
  PID:4488
- C:\Windows\System\rwReyRV.exe
  C:\Windows\System\rwReyRV.exe
  2⤵
  PID:2272
- C:\Windows\System\SvzOLXQ.exe
  C:\Windows\System\SvzOLXQ.exe
  2⤵
  PID:2596
- C:\Windows\System\cqZmudk.exe
  C:\Windows\System\cqZmudk.exe
  2⤵
  PID:1660
- C:\Windows\System\bceJYtP.exe
  C:\Windows\System\bceJYtP.exe
  2⤵
  PID:4460
- C:\Windows\System\EvRUtVp.exe
  C:\Windows\System\EvRUtVp.exe
  2⤵
  PID:3700
- C:\Windows\System\OqhHUUH.exe
  C:\Windows\System\OqhHUUH.exe
  2⤵
  PID:2424
- C:\Windows\System\agmLPIb.exe
  C:\Windows\System\agmLPIb.exe
  2⤵
  PID:6132
- C:\Windows\System\uVfgwkE.exe
  C:\Windows\System\uVfgwkE.exe
  2⤵
  PID:2772
- C:\Windows\System\wRQcExg.exe
  C:\Windows\System\wRQcExg.exe
  2⤵
  PID:5940
- C:\Windows\System\eVrGaEv.exe
  C:\Windows\System\eVrGaEv.exe
  2⤵
  PID:6024
- C:\Windows\System\qogvnGl.exe
  C:\Windows\System\qogvnGl.exe
  2⤵
  PID:5168
- C:\Windows\System\IUNlcFa.exe
  C:\Windows\System\IUNlcFa.exe
  2⤵
  PID:2360
- C:\Windows\System\VvUTFPr.exe
  C:\Windows\System\VvUTFPr.exe
  2⤵
  PID:5924
- C:\Windows\System\NucbYQw.exe
  C:\Windows\System\NucbYQw.exe
  2⤵
  PID:5964
- C:\Windows\System\hTkqmJv.exe
  C:\Windows\System\hTkqmJv.exe
  2⤵
  PID:5956
- C:\Windows\System\aKuUGFX.exe
  C:\Windows\System\aKuUGFX.exe
  2⤵
  PID:2188
- C:\Windows\System\wzQtIbv.exe
  C:\Windows\System\wzQtIbv.exe
  2⤵
  PID:5928
- C:\Windows\System\EdmiFSf.exe
  C:\Windows\System\EdmiFSf.exe
  2⤵
  PID:2180
- C:\Windows\System\WybiHkL.exe
  C:\Windows\System\WybiHkL.exe
  2⤵
  PID:2804
- C:\Windows\System\CzrmfRk.exe
  C:\Windows\System\CzrmfRk.exe
  2⤵
  PID:2568
- C:\Windows\System\UuohIdO.exe
  C:\Windows\System\UuohIdO.exe
  2⤵
  PID:2488
- C:\Windows\System\ifwEjNs.exe
  C:\Windows\System\ifwEjNs.exe
  2⤵
  PID:3828
- C:\Windows\System\icbVBAf.exe
  C:\Windows\System\icbVBAf.exe
  2⤵
  PID:3956
- C:\Windows\System\UYKynWE.exe
  C:\Windows\System\UYKynWE.exe
  2⤵
  PID:5220
- C:\Windows\System\vOlBVAR.exe
  C:\Windows\System\vOlBVAR.exe
  2⤵
  PID:3572
- C:\Windows\System\UgMKxIk.exe
  C:\Windows\System\UgMKxIk.exe
  2⤵
  PID:2528
- C:\Windows\System\fzLRvpi.exe
  C:\Windows\System\fzLRvpi.exe
  2⤵
  PID:5288
- C:\Windows\System\fyFPFVF.exe
  C:\Windows\System\fyFPFVF.exe
  2⤵
  PID:2260
- C:\Windows\System\lVoGWoQ.exe
  C:\Windows\System\lVoGWoQ.exe
  2⤵
  PID:1800
- C:\Windows\System\liJbdjo.exe
  C:\Windows\System\liJbdjo.exe
  2⤵
  PID:2444
- C:\Windows\System\NVXiPTZ.exe
  C:\Windows\System\NVXiPTZ.exe
  2⤵
  PID:4024
- C:\Windows\System\HjwnpqH.exe
  C:\Windows\System\HjwnpqH.exe
  2⤵
  PID:3508
- C:\Windows\System\Vknvyby.exe
  C:\Windows\System\Vknvyby.exe
  2⤵
  PID:3412
- C:\Windows\System\eDWyOyO.exe
  C:\Windows\System\eDWyOyO.exe
  2⤵
  PID:2640
- C:\Windows\System\NsMbJVj.exe
  C:\Windows\System\NsMbJVj.exe
  2⤵
  PID:5264
- C:\Windows\System\jrpiqFj.exe
  C:\Windows\System\jrpiqFj.exe
  2⤵
  PID:5316
- C:\Windows\System\JktkCep.exe
  C:\Windows\System\JktkCep.exe
  2⤵
  PID:5336
- C:\Windows\System\IcQUNbq.exe
  C:\Windows\System\IcQUNbq.exe
  2⤵
  PID:5352
- C:\Windows\System\dVJSyvu.exe
  C:\Windows\System\dVJSyvu.exe
  2⤵
  PID:5368
- C:\Windows\System\mONeOTH.exe
  C:\Windows\System\mONeOTH.exe
  2⤵
  PID:5400
- C:\Windows\System\EIMntSB.exe
  C:\Windows\System\EIMntSB.exe
  2⤵
  PID:5448
- C:\Windows\System\rkToLab.exe
  C:\Windows\System\rkToLab.exe
  2⤵
  PID:5488
- C:\Windows\System\veeMfvJ.exe
  C:\Windows\System\veeMfvJ.exe
  2⤵
  PID:5468
- C:\Windows\System\zLsXGgn.exe
  C:\Windows\System\zLsXGgn.exe
  2⤵
  PID:5544
- C:\Windows\System\VMwaGzJ.exe
  C:\Windows\System\VMwaGzJ.exe
  2⤵
  PID:5572
- C:\Windows\System\tuJyWHs.exe
  C:\Windows\System\tuJyWHs.exe
  2⤵
  PID:5608
- C:\Windows\System\TIVkYXI.exe
  C:\Windows\System\TIVkYXI.exe
  2⤵
  PID:5236
- C:\Windows\System\NTjKpxI.exe
  C:\Windows\System\NTjKpxI.exe
  2⤵
  PID:5868
- C:\Windows\System\ayJbZCw.exe
  C:\Windows\System\ayJbZCw.exe
  2⤵
  PID:4200
- C:\Windows\System\wolRInI.exe
  C:\Windows\System\wolRInI.exe
  2⤵
  PID:4828
- C:\Windows\System\KyWvkVc.exe
  C:\Windows\System\KyWvkVc.exe
  2⤵
  PID:4220
- C:\Windows\System\aAtfFzm.exe
  C:\Windows\System\aAtfFzm.exe
  2⤵
  PID:5696
- C:\Windows\System\KwYdmeU.exe
  C:\Windows\System\KwYdmeU.exe
  2⤵
  PID:2404
- C:\Windows\System\NgPCrKo.exe
  C:\Windows\System\NgPCrKo.exe
  2⤵
  PID:4396
- C:\Windows\System\hcaYftW.exe
  C:\Windows\System\hcaYftW.exe
  2⤵
  PID:2732
- C:\Windows\System\rwJOkgu.exe
  C:\Windows\System\rwJOkgu.exe
  2⤵
  PID:4552
- C:\Windows\System\zEDDqYa.exe
  C:\Windows\System\zEDDqYa.exe
  2⤵
  PID:4312
- C:\Windows\System\ZvvBCVd.exe
  C:\Windows\System\ZvvBCVd.exe
  2⤵
  PID:5740
- C:\Windows\System\sLTLAjn.exe
  C:\Windows\System\sLTLAjn.exe
  2⤵
  PID:1476
- C:\Windows\System\JXbtbfw.exe
  C:\Windows\System\JXbtbfw.exe
  2⤵
  PID:4648
- C:\Windows\System\nlJGBHR.exe
  C:\Windows\System\nlJGBHR.exe
  2⤵
  PID:580
- C:\Windows\System\YNTHisz.exe
  C:\Windows\System\YNTHisz.exe
  2⤵
  PID:2472
- C:\Windows\System\LonPkGv.exe
  C:\Windows\System\LonPkGv.exe
  2⤵
  PID:1352
- C:\Windows\System\uJWJMbT.exe
  C:\Windows\System\uJWJMbT.exe
  2⤵
  PID:748
- C:\Windows\System\zklpruO.exe
  C:\Windows\System\zklpruO.exe
  2⤵
  PID:6056
- C:\Windows\System\CMsMloA.exe
  C:\Windows\System\CMsMloA.exe
  2⤵
  PID:2328
- C:\Windows\System\JToeBoK.exe
  C:\Windows\System\JToeBoK.exe
  2⤵
  PID:3800
- C:\Windows\System\pcYzKBg.exe
  C:\Windows\System\pcYzKBg.exe
  2⤵
  PID:3448
- C:\Windows\System\GJEYPKE.exe
  C:\Windows\System\GJEYPKE.exe
  2⤵
  PID:3992
- C:\Windows\System\daNTOqT.exe
  C:\Windows\System\daNTOqT.exe
  2⤵
  PID:5232
- C:\Windows\System\gujPVDK.exe
  C:\Windows\System\gujPVDK.exe
  2⤵
  PID:3924
- C:\Windows\System\ieFZsHe.exe
  C:\Windows\System\ieFZsHe.exe
  2⤵
  PID:5308
- C:\Windows\System\bpPzpwC.exe
  C:\Windows\System\bpPzpwC.exe
  2⤵
  PID:5348
- C:\Windows\System\QiVsvRx.exe
  C:\Windows\System\QiVsvRx.exe
  2⤵
  PID:5456
- C:\Windows\System\WkujWPw.exe
  C:\Windows\System\WkujWPw.exe
  2⤵
  PID:2296
- C:\Windows\System\upqLcog.exe
  C:\Windows\System\upqLcog.exe
  2⤵
  PID:5612
- C:\Windows\System\gSOGFUH.exe
  C:\Windows\System\gSOGFUH.exe
  2⤵
  PID:5736
- C:\Windows\System\eeCbVoN.exe
  C:\Windows\System\eeCbVoN.exe
  2⤵
  PID:6004
- C:\Windows\System\dhNxWIJ.exe
  C:\Windows\System\dhNxWIJ.exe
  2⤵
  PID:5096
- C:\Windows\System\xufdlzW.exe
  C:\Windows\System\xufdlzW.exe
  2⤵
  PID:2312
- C:\Windows\System\PaDgNof.exe
  C:\Windows\System\PaDgNof.exe
  2⤵
  PID:4140
- C:\Windows\System\qupaeVG.exe
  C:\Windows\System\qupaeVG.exe
  2⤵
  PID:5980
- C:\Windows\System\akHxtOn.exe
  C:\Windows\System\akHxtOn.exe
  2⤵
  PID:1424
- C:\Windows\System\SiHmtTU.exe
  C:\Windows\System\SiHmtTU.exe
  2⤵
  PID:5652
- C:\Windows\System\UfAZVLr.exe
  C:\Windows\System\UfAZVLr.exe
  2⤵
  PID:4744
- C:\Windows\System\dUNFfth.exe
  C:\Windows\System\dUNFfth.exe
  2⤵
  PID:5784
- C:\Windows\System\EaMIzqu.exe
  C:\Windows\System\EaMIzqu.exe
  2⤵
  PID:2652
- C:\Windows\System\gwEIDvK.exe
  C:\Windows\System\gwEIDvK.exe
  2⤵
  PID:5692
- C:\Windows\System\kSqngDl.exe
  C:\Windows\System\kSqngDl.exe
  2⤵
  PID:5628
- C:\Windows\System\YQPMwGI.exe
  C:\Windows\System\YQPMwGI.exe
  2⤵
  PID:4476
- C:\Windows\System\GJLdJWo.exe
  C:\Windows\System\GJLdJWo.exe
  2⤵
  PID:4300
- C:\Windows\System\RSNzVQf.exe
  C:\Windows\System\RSNzVQf.exe
  2⤵
  PID:4668
- C:\Windows\System\NhihDpJ.exe
  C:\Windows\System\NhihDpJ.exe
  2⤵
  PID:1912
- C:\Windows\System\jpHYrdJ.exe
  C:\Windows\System\jpHYrdJ.exe
  2⤵
  PID:2700
- C:\Windows\System\GsxdpmX.exe
  C:\Windows\System\GsxdpmX.exe
  2⤵
  PID:2120
- C:\Windows\System\rTtGeva.exe
  C:\Windows\System\rTtGeva.exe
  2⤵
  PID:1036
- C:\Windows\System\dzzQZOD.exe
  C:\Windows\System\dzzQZOD.exe
  2⤵
  PID:3316
- C:\Windows\System\ltGJFaB.exe
  C:\Windows\System\ltGJFaB.exe
  2⤵
  PID:3688
- C:\Windows\System\BFMjQwj.exe
  C:\Windows\System\BFMjQwj.exe
  2⤵
  PID:2536
- C:\Windows\System\cQxhRmH.exe
  C:\Windows\System\cQxhRmH.exe
  2⤵
  PID:5420
- C:\Windows\System\xiYDDTB.exe
  C:\Windows\System\xiYDDTB.exe
  2⤵
  PID:3844
- C:\Windows\System\vSvmxMy.exe
  C:\Windows\System\vSvmxMy.exe
  2⤵
  PID:5112
- C:\Windows\System\ZRrqDiq.exe
  C:\Windows\System\ZRrqDiq.exe
  2⤵
  PID:5376
- C:\Windows\System\NPInxUo.exe
  C:\Windows\System\NPInxUo.exe
  2⤵
  PID:5496
- C:\Windows\System\GoNDVBR.exe
  C:\Windows\System\GoNDVBR.exe
  2⤵
  PID:5592
- C:\Windows\System\rwOpvyq.exe
  C:\Windows\System\rwOpvyq.exe
  2⤵
  PID:2372
- C:\Windows\System\gobSHut.exe
  C:\Windows\System\gobSHut.exe
  2⤵
  PID:5672
- C:\Windows\System\jmRwlbn.exe
  C:\Windows\System\jmRwlbn.exe
  2⤵
  PID:5524
- C:\Windows\System\IvgDHGc.exe
  C:\Windows\System\IvgDHGc.exe
  2⤵
  PID:1616
- C:\Windows\System\xmMqHQv.exe
  C:\Windows\System\xmMqHQv.exe
  2⤵
  PID:828
- C:\Windows\System\widIlEN.exe
  C:\Windows\System\widIlEN.exe
  2⤵
  PID:2656
- C:\Windows\System\pxLsCaQ.exe
  C:\Windows\System\pxLsCaQ.exe
  2⤵
  PID:5856
- C:\Windows\System\DqnxsmM.exe
  C:\Windows\System\DqnxsmM.exe
  2⤵
  PID:5216
- C:\Windows\System\Ctfamkd.exe
  C:\Windows\System\Ctfamkd.exe
  2⤵
  PID:4972
- C:\Windows\System\AEMuOkG.exe
  C:\Windows\System\AEMuOkG.exe
  2⤵
  PID:6152
- C:\Windows\System\ScPAQiG.exe
  C:\Windows\System\ScPAQiG.exe
  2⤵
  PID:6168
- C:\Windows\System\MPspOkC.exe
  C:\Windows\System\MPspOkC.exe
  2⤵
  PID:6184
- C:\Windows\System\aSPCANm.exe
  C:\Windows\System\aSPCANm.exe
  2⤵
  PID:6200
- C:\Windows\System\ZRaGcLu.exe
  C:\Windows\System\ZRaGcLu.exe
  2⤵
  PID:6220
- C:\Windows\System\yfoTFFS.exe
  C:\Windows\System\yfoTFFS.exe
  2⤵
  PID:6236
- C:\Windows\System\XElFdfQ.exe
  C:\Windows\System\XElFdfQ.exe
  2⤵
  PID:6252
- C:\Windows\System\XRTmsir.exe
  C:\Windows\System\XRTmsir.exe
  2⤵
  PID:6268
- C:\Windows\System\FLfxMbC.exe
  C:\Windows\System\FLfxMbC.exe
  2⤵
  PID:6284
- C:\Windows\System\GuPUuhf.exe
  C:\Windows\System\GuPUuhf.exe
  2⤵
  PID:6304
- C:\Windows\System\vuxmDVJ.exe
  C:\Windows\System\vuxmDVJ.exe
  2⤵
  PID:6320
- C:\Windows\System\FrOgECm.exe
  C:\Windows\System\FrOgECm.exe
  2⤵
  PID:6336
- C:\Windows\System\IXIzfGR.exe
  C:\Windows\System\IXIzfGR.exe
  2⤵
  PID:6352
- C:\Windows\System\TrnGDec.exe
  C:\Windows\System\TrnGDec.exe
  2⤵
  PID:6368
- C:\Windows\System\UkdMkjr.exe
  C:\Windows\System\UkdMkjr.exe
  2⤵
  PID:6384
- C:\Windows\System\VOSxEhb.exe
  C:\Windows\System\VOSxEhb.exe
  2⤵
  PID:6400
- C:\Windows\System\LHBawzF.exe
  C:\Windows\System\LHBawzF.exe
  2⤵
  PID:6416
- C:\Windows\System\VhPUekQ.exe
  C:\Windows\System\VhPUekQ.exe
  2⤵
  PID:6432
- C:\Windows\System\zhfGXye.exe
  C:\Windows\System\zhfGXye.exe
  2⤵
  PID:6448
- C:\Windows\System\ZCfzXBY.exe
  C:\Windows\System\ZCfzXBY.exe
  2⤵
  PID:6464
- C:\Windows\System\yYRCUmM.exe
  C:\Windows\System\yYRCUmM.exe
  2⤵
  PID:6480
- C:\Windows\System\XaylbkR.exe
  C:\Windows\System\XaylbkR.exe
  2⤵
  PID:6496
- C:\Windows\System\kEtGtcs.exe
  C:\Windows\System\kEtGtcs.exe
  2⤵
  PID:6512
- C:\Windows\System\JEcYtdW.exe
  C:\Windows\System\JEcYtdW.exe
  2⤵
  PID:6528
- C:\Windows\System\IoqoMRA.exe
  C:\Windows\System\IoqoMRA.exe
  2⤵
  PID:6544
- C:\Windows\System\oaLvxrF.exe
  C:\Windows\System\oaLvxrF.exe
  2⤵
  PID:6560
- C:\Windows\System\LCYQrMO.exe
  C:\Windows\System\LCYQrMO.exe
  2⤵
  PID:6576
- C:\Windows\System\hhDHCRe.exe
  C:\Windows\System\hhDHCRe.exe
  2⤵
  PID:6592
- C:\Windows\System\CLwmxCh.exe
  C:\Windows\System\CLwmxCh.exe
  2⤵
  PID:6608
- C:\Windows\System\dKzxQeV.exe
  C:\Windows\System\dKzxQeV.exe
  2⤵
  PID:6624
- C:\Windows\System\cbFsCWr.exe
  C:\Windows\System\cbFsCWr.exe
  2⤵
  PID:6640
- C:\Windows\System\UTuQJQL.exe
  C:\Windows\System\UTuQJQL.exe
  2⤵
  PID:6656
- C:\Windows\System\DVPULBR.exe
  C:\Windows\System\DVPULBR.exe
  2⤵
  PID:6672
- C:\Windows\System\umXYQYb.exe
  C:\Windows\System\umXYQYb.exe
  2⤵
  PID:6688
- C:\Windows\System\QVlgQsm.exe
  C:\Windows\System\QVlgQsm.exe
  2⤵
  PID:6704
- C:\Windows\System\XHEfuOD.exe
  C:\Windows\System\XHEfuOD.exe
  2⤵
  PID:6720
- C:\Windows\System\ehRVSQH.exe
  C:\Windows\System\ehRVSQH.exe
  2⤵
  PID:6736
- C:\Windows\System\eXxFoWc.exe
  C:\Windows\System\eXxFoWc.exe
  2⤵
  PID:6752
- C:\Windows\System\fqxCPOx.exe
  C:\Windows\System\fqxCPOx.exe
  2⤵
  PID:6768
- C:\Windows\System\borodze.exe
  C:\Windows\System\borodze.exe
  2⤵
  PID:6784
- C:\Windows\System\zzKVvkX.exe
  C:\Windows\System\zzKVvkX.exe
  2⤵
  PID:6800
- C:\Windows\System\fwRxLlw.exe
  C:\Windows\System\fwRxLlw.exe
  2⤵
  PID:6816
- C:\Windows\System\szwiiAc.exe
  C:\Windows\System\szwiiAc.exe
  2⤵
  PID:6832
- C:\Windows\System\iKsFRbT.exe
  C:\Windows\System\iKsFRbT.exe
  2⤵
  PID:6848
- C:\Windows\System\MEjKQkw.exe
  C:\Windows\System\MEjKQkw.exe
  2⤵
  PID:6864
- C:\Windows\System\dyllvwj.exe
  C:\Windows\System\dyllvwj.exe
  2⤵
  PID:6880
- C:\Windows\System\wEuCoqg.exe
  C:\Windows\System\wEuCoqg.exe
  2⤵
  PID:6896
- C:\Windows\System\gUaXVwv.exe
  C:\Windows\System\gUaXVwv.exe
  2⤵
  PID:6912
- C:\Windows\System\jZTbvFh.exe
  C:\Windows\System\jZTbvFh.exe
  2⤵
  PID:6928
- C:\Windows\System\xRtfGzG.exe
  C:\Windows\System\xRtfGzG.exe
  2⤵
  PID:6944
- C:\Windows\System\owQQGfI.exe
  C:\Windows\System\owQQGfI.exe
  2⤵
  PID:6960
- C:\Windows\System\EPtgVJL.exe
  C:\Windows\System\EPtgVJL.exe
  2⤵
  PID:6976
- C:\Windows\System\xfxvhsV.exe
  C:\Windows\System\xfxvhsV.exe
  2⤵
  PID:6992
- C:\Windows\System\xbrwtll.exe
  C:\Windows\System\xbrwtll.exe
  2⤵
  PID:7008
- C:\Windows\System\NSAixmm.exe
  C:\Windows\System\NSAixmm.exe
  2⤵
  PID:7024
- C:\Windows\System\DQFUQGh.exe
  C:\Windows\System\DQFUQGh.exe
  2⤵
  PID:7040
- C:\Windows\System\fJDoHXd.exe
  C:\Windows\System\fJDoHXd.exe
  2⤵
  PID:7056
- C:\Windows\System\zWLLptB.exe
  C:\Windows\System\zWLLptB.exe
  2⤵
  PID:7072
- C:\Windows\System\TEJFJPK.exe
  C:\Windows\System\TEJFJPK.exe
  2⤵
  PID:7088
- C:\Windows\System\PMzvLtP.exe
  C:\Windows\System\PMzvLtP.exe
  2⤵
  PID:7104
- C:\Windows\System\slNTgzh.exe
  C:\Windows\System\slNTgzh.exe
  2⤵
  PID:7120
- C:\Windows\System\BBCzjYL.exe
  C:\Windows\System\BBCzjYL.exe
  2⤵
  PID:7136
- C:\Windows\System\AVwuPGs.exe
  C:\Windows\System\AVwuPGs.exe
  2⤵
  PID:7156
- C:\Windows\System\wryuuRy.exe
  C:\Windows\System\wryuuRy.exe
  2⤵
  PID:3348
- C:\Windows\System\QxANkTe.exe
  C:\Windows\System\QxANkTe.exe
  2⤵
  PID:6176
- C:\Windows\System\ORyLgdT.exe
  C:\Windows\System\ORyLgdT.exe
  2⤵
  PID:6216
- C:\Windows\System\BQtHbYr.exe
  C:\Windows\System\BQtHbYr.exe
  2⤵
  PID:6280
- C:\Windows\System\snVuhgo.exe
  C:\Windows\System\snVuhgo.exe
  2⤵
  PID:6344
- C:\Windows\System\pSQiGEw.exe
  C:\Windows\System\pSQiGEw.exe
  2⤵
  PID:6408
- C:\Windows\System\SKShpwT.exe
  C:\Windows\System\SKShpwT.exe
  2⤵
  PID:6444
- C:\Windows\System\kICUITb.exe
  C:\Windows\System\kICUITb.exe
  2⤵
  PID:6504
- C:\Windows\System\pJTGwDz.exe
  C:\Windows\System\pJTGwDz.exe
  2⤵
  PID:6328
- C:\Windows\System\SJlrwwt.exe
  C:\Windows\System\SJlrwwt.exe
  2⤵
  PID:6360
- C:\Windows\System\trEuWKh.exe
  C:\Windows\System\trEuWKh.exe
  2⤵
  PID:6164
- C:\Windows\System\SUKEHuf.exe
  C:\Windows\System\SUKEHuf.exe
  2⤵
  PID:6364
- C:\Windows\System\rUwWphG.exe
  C:\Windows\System\rUwWphG.exe
  2⤵
  PID:6428
- C:\Windows\System\yIUBzuR.exe
  C:\Windows\System\yIUBzuR.exe
  2⤵
  PID:6492
- C:\Windows\System\xnKjOyg.exe
  C:\Windows\System\xnKjOyg.exe
  2⤵
  PID:6584
- C:\Windows\System\ETewheJ.exe
  C:\Windows\System\ETewheJ.exe
  2⤵
  PID:6648
- C:\Windows\System\MeJwuCE.exe
  C:\Windows\System\MeJwuCE.exe
  2⤵
  PID:6684
- C:\Windows\System\kLKSnEZ.exe
  C:\Windows\System\kLKSnEZ.exe
  2⤵
  PID:6572
- C:\Windows\System\WQymMzm.exe
  C:\Windows\System\WQymMzm.exe
  2⤵
  PID:6632
- C:\Windows\System\hmLfZJK.exe
  C:\Windows\System\hmLfZJK.exe
  2⤵
  PID:6696
- C:\Windows\System\GZwvJdN.exe
  C:\Windows\System\GZwvJdN.exe
  2⤵
  PID:6760
- C:\Windows\System\jMUGxwE.exe
  C:\Windows\System\jMUGxwE.exe
  2⤵
  PID:6824
- C:\Windows\System\GRiGGzk.exe
  C:\Windows\System\GRiGGzk.exe
  2⤵
  PID:6888
- C:\Windows\System\KmdKpli.exe
  C:\Windows\System\KmdKpli.exe
  2⤵
  PID:6952
- C:\Windows\System\XcrtyBC.exe
  C:\Windows\System\XcrtyBC.exe
  2⤵
  PID:7016
- C:\Windows\System\bPFodEo.exe
  C:\Windows\System\bPFodEo.exe
  2⤵
  PID:7052
- C:\Windows\System\uVNFoNI.exe
  C:\Windows\System\uVNFoNI.exe
  2⤵
  PID:7144
- C:\Windows\System\JQHwqTE.exe
  C:\Windows\System\JQHwqTE.exe
  2⤵
  PID:6840
- C:\Windows\System\CvDUqMN.exe
  C:\Windows\System\CvDUqMN.exe
  2⤵
  PID:6972
- C:\Windows\System\iffeMbc.exe
  C:\Windows\System\iffeMbc.exe
  2⤵
  PID:6844
- C:\Windows\System\WIFTCnZ.exe
  C:\Windows\System\WIFTCnZ.exe
  2⤵
  PID:6876
- C:\Windows\System\jIdfSio.exe
  C:\Windows\System\jIdfSio.exe
  2⤵
  PID:6936
- C:\Windows\System\xeTIRCq.exe
  C:\Windows\System\xeTIRCq.exe
  2⤵
  PID:7064
- C:\Windows\System\tqUfgGS.exe
  C:\Windows\System\tqUfgGS.exe
  2⤵
  PID:7032
- C:\Windows\System\ZUUohMc.exe
  C:\Windows\System\ZUUohMc.exe
  2⤵
  PID:6276
- C:\Windows\System\ngGtgss.exe
  C:\Windows\System\ngGtgss.exe
  2⤵
  PID:6440
- C:\Windows\System\ueeudYi.exe
  C:\Windows\System\ueeudYi.exe
  2⤵
  PID:6476
- C:\Windows\System\MRTcQRv.exe
  C:\Windows\System\MRTcQRv.exe
  2⤵
  PID:6296
- C:\Windows\System\NVMDAxo.exe
  C:\Windows\System\NVMDAxo.exe
  2⤵
  PID:6616
- C:\Windows\System\DRXAaHy.exe
  C:\Windows\System\DRXAaHy.exe
  2⤵
  PID:6664
- C:\Windows\System\rSnnvzQ.exe
  C:\Windows\System\rSnnvzQ.exe
  2⤵
  PID:6920
- C:\Windows\System\CrDaZAH.exe
  C:\Windows\System\CrDaZAH.exe
  2⤵
  PID:6160
- C:\Windows\System\pryWbyX.exe
  C:\Windows\System\pryWbyX.exe
  2⤵
  PID:4652
- C:\Windows\System\IZTtbPO.exe
  C:\Windows\System\IZTtbPO.exe
  2⤵
  PID:6524
- C:\Windows\System\fnbiuvx.exe
  C:\Windows\System\fnbiuvx.exe
  2⤵
  PID:6552
- C:\Windows\System\ZJjNBNE.exe
  C:\Windows\System\ZJjNBNE.exe
  2⤵
  PID:6604
- C:\Windows\System\AFAEDrU.exe
  C:\Windows\System\AFAEDrU.exe
  2⤵
  PID:7116
- C:\Windows\System\oxLnqci.exe
  C:\Windows\System\oxLnqci.exe
  2⤵
  PID:7096
- C:\Windows\System\vEUfves.exe
  C:\Windows\System\vEUfves.exe
  2⤵
  PID:6908
- C:\Windows\System\icBfxqz.exe
  C:\Windows\System\icBfxqz.exe
  2⤵
  PID:6260
- C:\Windows\System\pgrioDc.exe
  C:\Windows\System\pgrioDc.exe
  2⤵
  PID:6744
- C:\Windows\System\EXxbPiK.exe
  C:\Windows\System\EXxbPiK.exe
  2⤵
  PID:6396
- C:\Windows\System\KTdKPUt.exe
  C:\Windows\System\KTdKPUt.exe
  2⤵
  PID:7132
- C:\Windows\System\sJsLEua.exe
  C:\Windows\System\sJsLEua.exe
  2⤵
  PID:7048
- C:\Windows\System\CxgVowa.exe
  C:\Windows\System\CxgVowa.exe
  2⤵
  PID:7172
- C:\Windows\System\yQxKVUr.exe
  C:\Windows\System\yQxKVUr.exe
  2⤵
  PID:7192
- C:\Windows\System\SeYtzdC.exe
  C:\Windows\System\SeYtzdC.exe
  2⤵
  PID:7208
- C:\Windows\System\btdLblm.exe
  C:\Windows\System\btdLblm.exe
  2⤵
  PID:7224
- C:\Windows\System\bXhIXTu.exe
  C:\Windows\System\bXhIXTu.exe
  2⤵
  PID:7240
- C:\Windows\System\NGmGhET.exe
  C:\Windows\System\NGmGhET.exe
  2⤵
  PID:7256
- C:\Windows\System\mmgvzYr.exe
  C:\Windows\System\mmgvzYr.exe
  2⤵
  PID:7272
- C:\Windows\System\QCrQNer.exe
  C:\Windows\System\QCrQNer.exe
  2⤵
  PID:7288
- C:\Windows\System\MRDrvvv.exe
  C:\Windows\System\MRDrvvv.exe
  2⤵
  PID:7304
- C:\Windows\System\MEIfRwe.exe
  C:\Windows\System\MEIfRwe.exe
  2⤵
  PID:7320
- C:\Windows\System\drNXbgF.exe
  C:\Windows\System\drNXbgF.exe
  2⤵
  PID:7336
- C:\Windows\System\OsHglkm.exe
  C:\Windows\System\OsHglkm.exe
  2⤵
  PID:7352
- C:\Windows\System\lDyYeeM.exe
  C:\Windows\System\lDyYeeM.exe
  2⤵
  PID:7368
- C:\Windows\System\uVnXaMK.exe
  C:\Windows\System\uVnXaMK.exe
  2⤵
  PID:7384
- C:\Windows\System\UjSiypT.exe
  C:\Windows\System\UjSiypT.exe
  2⤵
  PID:7400
- C:\Windows\System\wJWdKpS.exe
  C:\Windows\System\wJWdKpS.exe
  2⤵
  PID:7416
- C:\Windows\System\AgzbdUl.exe
  C:\Windows\System\AgzbdUl.exe
  2⤵
  PID:7432
- C:\Windows\System\gGBWOsu.exe
  C:\Windows\System\gGBWOsu.exe
  2⤵
  PID:7448
- C:\Windows\System\alsXlLx.exe
  C:\Windows\System\alsXlLx.exe
  2⤵
  PID:7464
- C:\Windows\System\qrplrmh.exe
  C:\Windows\System\qrplrmh.exe
  2⤵
  PID:7480
- C:\Windows\System\VAtOFim.exe
  C:\Windows\System\VAtOFim.exe
  2⤵
  PID:7496
- C:\Windows\System\pjYxMfB.exe
  C:\Windows\System\pjYxMfB.exe
  2⤵
  PID:7512
- C:\Windows\System\rERviZf.exe
  C:\Windows\System\rERviZf.exe
  2⤵
  PID:7528
- C:\Windows\System\CZCCZEw.exe
  C:\Windows\System\CZCCZEw.exe
  2⤵
  PID:7544
- C:\Windows\System\FLIwUfa.exe
  C:\Windows\System\FLIwUfa.exe
  2⤵
  PID:7560
- C:\Windows\System\oNHjBaE.exe
  C:\Windows\System\oNHjBaE.exe
  2⤵
  PID:7576
- C:\Windows\System\yithUND.exe
  C:\Windows\System\yithUND.exe
  2⤵
  PID:7592
- C:\Windows\System\OlwyxSJ.exe
  C:\Windows\System\OlwyxSJ.exe
  2⤵
  PID:7608
- C:\Windows\System\aPJbHMf.exe
  C:\Windows\System\aPJbHMf.exe
  2⤵
  PID:7624
- C:\Windows\System\FcIhEIV.exe
  C:\Windows\System\FcIhEIV.exe
  2⤵
  PID:7640
- C:\Windows\System\tTYMReb.exe
  C:\Windows\System\tTYMReb.exe
  2⤵
  PID:7656
- C:\Windows\System\ABPxfyj.exe
  C:\Windows\System\ABPxfyj.exe
  2⤵
  PID:7672
- C:\Windows\System\eQIjBWv.exe
  C:\Windows\System\eQIjBWv.exe
  2⤵
  PID:7688
- C:\Windows\System\CTMeEzy.exe
  C:\Windows\System\CTMeEzy.exe
  2⤵
  PID:7708
- C:\Windows\System\ksDpDLM.exe
  C:\Windows\System\ksDpDLM.exe
  2⤵
  PID:7728
- C:\Windows\System\EIiYPlJ.exe
  C:\Windows\System\EIiYPlJ.exe
  2⤵
  PID:7752
- C:\Windows\System\boXBlqe.exe
  C:\Windows\System\boXBlqe.exe
  2⤵
  PID:7772
- C:\Windows\System\TOniPhA.exe
  C:\Windows\System\TOniPhA.exe
  2⤵
  PID:7788
- C:\Windows\System\ssZwKfD.exe
  C:\Windows\System\ssZwKfD.exe
  2⤵
  PID:7808
- C:\Windows\System\OoaoKsd.exe
  C:\Windows\System\OoaoKsd.exe
  2⤵
  PID:7852
- C:\Windows\System\WOBskde.exe
  C:\Windows\System\WOBskde.exe
  2⤵
  PID:7872
- C:\Windows\System\zIQmzyq.exe
  C:\Windows\System\zIQmzyq.exe
  2⤵
  PID:7888
- C:\Windows\System\vuMLQHl.exe
  C:\Windows\System\vuMLQHl.exe
  2⤵
  PID:7908
- C:\Windows\System\KhRmZHN.exe
  C:\Windows\System\KhRmZHN.exe
  2⤵
  PID:7924
- C:\Windows\System\sqiacXr.exe
  C:\Windows\System\sqiacXr.exe
  2⤵
  PID:8068
- C:\Windows\System\KcsYVLF.exe
  C:\Windows\System\KcsYVLF.exe
  2⤵
  PID:8084
- C:\Windows\System\qfyYocR.exe
  C:\Windows\System\qfyYocR.exe
  2⤵
  PID:8100
- C:\Windows\System\JzRVaxR.exe
  C:\Windows\System\JzRVaxR.exe
  2⤵
  PID:8116
- C:\Windows\System\BeytjOg.exe
  C:\Windows\System\BeytjOg.exe
  2⤵
  PID:8136
- C:\Windows\System\mzoPcIj.exe
  C:\Windows\System\mzoPcIj.exe
  2⤵
  PID:8156
- C:\Windows\System\yJYHISP.exe
  C:\Windows\System\yJYHISP.exe
  2⤵
  PID:8172
- C:\Windows\System\OqXmCJj.exe
  C:\Windows\System\OqXmCJj.exe
  2⤵
  PID:8188
- C:\Windows\System\qjIBsqB.exe
  C:\Windows\System\qjIBsqB.exe
  2⤵
  PID:6872
- C:\Windows\System\TtjzJNH.exe
  C:\Windows\System\TtjzJNH.exe
  2⤵
  PID:6856
- C:\Windows\System\dfVkzME.exe
  C:\Windows\System\dfVkzME.exe
  2⤵
  PID:6796
- C:\Windows\System\KrSqINC.exe
  C:\Windows\System\KrSqINC.exe
  2⤵
  PID:7112
- C:\Windows\System\hKGXHve.exe
  C:\Windows\System\hKGXHve.exe
  2⤵
  PID:6904
- C:\Windows\System\ZAWwACt.exe
  C:\Windows\System\ZAWwACt.exe
  2⤵
  PID:6556
- C:\Windows\System\NVZdOfj.exe
  C:\Windows\System\NVZdOfj.exe
  2⤵
  PID:7084
- C:\Windows\System\TmxDLNt.exe
  C:\Windows\System\TmxDLNt.exe
  2⤵
  PID:5208
- C:\Windows\System\lsNwJKY.exe
  C:\Windows\System\lsNwJKY.exe
  2⤵
  PID:7236
- C:\Windows\System\mIqtBMe.exe
  C:\Windows\System\mIqtBMe.exe
  2⤵
  PID:7268
- C:\Windows\System\qroQWon.exe
  C:\Windows\System\qroQWon.exe
  2⤵
  PID:7300
- C:\Windows\System\LhsBSHP.exe
  C:\Windows\System\LhsBSHP.exe
  2⤵
  PID:7328
- C:\Windows\System\JTfOagM.exe
  C:\Windows\System\JTfOagM.exe
  2⤵
  PID:3336
- C:\Windows\System\JEmGgvw.exe
  C:\Windows\System\JEmGgvw.exe
  2⤵
  PID:7412
- C:\Windows\System\FeIITPN.exe
  C:\Windows\System\FeIITPN.exe
  2⤵
  PID:7504
- C:\Windows\System\wgZhCIT.exe
  C:\Windows\System\wgZhCIT.exe
  2⤵
  PID:7396
- C:\Windows\System\CFTsfMy.exe
  C:\Windows\System\CFTsfMy.exe
  2⤵
  PID:7460
- C:\Windows\System\XdkVnXK.exe
  C:\Windows\System\XdkVnXK.exe
  2⤵
  PID:7524
- C:\Windows\System\XyLsbgV.exe
  C:\Windows\System\XyLsbgV.exe
  2⤵
  PID:7588
- C:\Windows\System\IblOXMU.exe
  C:\Windows\System\IblOXMU.exe
  2⤵
  PID:7636
- C:\Windows\System\AxTGLvM.exe
  C:\Windows\System\AxTGLvM.exe
  2⤵
  PID:7600
- C:\Windows\System\hlWVPLI.exe
  C:\Windows\System\hlWVPLI.exe
  2⤵
  PID:7680
- C:\Windows\System\SXBjqza.exe
  C:\Windows\System\SXBjqza.exe
  2⤵
  PID:7724
- C:\Windows\System\BnxzuGr.exe
  C:\Windows\System\BnxzuGr.exe
  2⤵
  PID:7796
- C:\Windows\System\geOXCrf.exe
  C:\Windows\System\geOXCrf.exe
  2⤵
  PID:7868
- C:\Windows\System\eUtBunc.exe
  C:\Windows\System\eUtBunc.exe
  2⤵
  PID:7932
- C:\Windows\System\tGKzbHv.exe
  C:\Windows\System\tGKzbHv.exe
  2⤵
  PID:7704
- C:\Windows\System\HJBhsYJ.exe
  C:\Windows\System\HJBhsYJ.exe
  2⤵
  PID:7748
- C:\Windows\System\MIuxYZz.exe
  C:\Windows\System\MIuxYZz.exe
  2⤵
  PID:7844
- C:\Windows\System\JgnFcbS.exe
  C:\Windows\System\JgnFcbS.exe
  2⤵
  PID:7916
- C:\Windows\System\qOZHcxO.exe
  C:\Windows\System\qOZHcxO.exe
  2⤵
  PID:7940
- C:\Windows\System\vodIuVi.exe
  C:\Windows\System\vodIuVi.exe
  2⤵
  PID:7956
- C:\Windows\System\wLTAZmh.exe
  C:\Windows\System\wLTAZmh.exe
  2⤵
  PID:7972
- C:\Windows\System\ETeHDOd.exe
  C:\Windows\System\ETeHDOd.exe
  2⤵
  PID:7988
- C:\Windows\System\UjYZPTQ.exe
  C:\Windows\System\UjYZPTQ.exe
  2⤵
  PID:8004
- C:\Windows\System\XQQMFmd.exe
  C:\Windows\System\XQQMFmd.exe
  2⤵
  PID:8020
- C:\Windows\System\fGRtJSA.exe
  C:\Windows\System\fGRtJSA.exe
  2⤵
  PID:8040
- C:\Windows\System\DuyzYvH.exe
  C:\Windows\System\DuyzYvH.exe
  2⤵
  PID:8052
- C:\Windows\System\AYBgxPi.exe
  C:\Windows\System\AYBgxPi.exe
  2⤵
  PID:8076
- C:\Windows\System\lPqKXaS.exe
  C:\Windows\System\lPqKXaS.exe
  2⤵
  PID:8148
- C:\Windows\System\SjtmYJz.exe
  C:\Windows\System\SjtmYJz.exe
  2⤵
  PID:7216
- C:\Windows\System\KXFexGH.exe
  C:\Windows\System\KXFexGH.exe
  2⤵
  PID:8096
- C:\Windows\System\eIakiQu.exe
  C:\Windows\System\eIakiQu.exe
  2⤵
  PID:6232
- C:\Windows\System\tsruryd.exe
  C:\Windows\System\tsruryd.exe
  2⤵
  PID:8164
- C:\Windows\System\kBZMTWE.exe
  C:\Windows\System\kBZMTWE.exe
  2⤵
  PID:6600
- C:\Windows\System\bYqFnnm.exe
  C:\Windows\System\bYqFnnm.exe
  2⤵
  PID:6208
- C:\Windows\System\UWQjbxR.exe
  C:\Windows\System\UWQjbxR.exe
  2⤵
  PID:7280
- C:\Windows\System\rNyZsXr.exe
  C:\Windows\System\rNyZsXr.exe
  2⤵
  PID:6860
- C:\Windows\System\IFOPozf.exe
  C:\Windows\System\IFOPozf.exe
  2⤵
  PID:7296
- C:\Windows\System\ZtPOhCe.exe
  C:\Windows\System\ZtPOhCe.exe
  2⤵
  PID:7540
- C:\Windows\System\YQWZWcH.exe
  C:\Windows\System\YQWZWcH.exe
  2⤵
  PID:7472
- C:\Windows\System\OCKMdbd.exe
  C:\Windows\System\OCKMdbd.exe
  2⤵
  PID:7620
- C:\Windows\System\PKdpOXP.exe
  C:\Windows\System\PKdpOXP.exe
  2⤵
  PID:7764
- C:\Windows\System\tbiWuzo.exe
  C:\Windows\System\tbiWuzo.exe
  2⤵
  PID:7904
- C:\Windows\System\PTrjzre.exe
  C:\Windows\System\PTrjzre.exe
  2⤵
  PID:7716
- C:\Windows\System\UXQFCyE.exe
  C:\Windows\System\UXQFCyE.exe
  2⤵
  PID:7840
- C:\Windows\System\jycHciO.exe
  C:\Windows\System\jycHciO.exe
  2⤵
  PID:7880
- C:\Windows\System\oVqlBqI.exe
  C:\Windows\System\oVqlBqI.exe
  2⤵
  PID:7784
- C:\Windows\System\pEJaOYV.exe
  C:\Windows\System\pEJaOYV.exe
  2⤵
  PID:8016
- C:\Windows\System\xpcUfUu.exe
  C:\Windows\System\xpcUfUu.exe
  2⤵
  PID:7964
- C:\Windows\System\wiGbrHk.exe
  C:\Windows\System\wiGbrHk.exe
  2⤵
  PID:8036
- C:\Windows\System\VcTyKfm.exe
  C:\Windows\System\VcTyKfm.exe
  2⤵
  PID:8112
- C:\Windows\System\wdiexQK.exe
  C:\Windows\System\wdiexQK.exe
  2⤵
  PID:7248
- C:\Windows\System\oxCfvPg.exe
  C:\Windows\System\oxCfvPg.exe
  2⤵
  PID:6212
- C:\Windows\System\fsaCTtJ.exe
  C:\Windows\System\fsaCTtJ.exe
  2⤵
  PID:7408
- C:\Windows\System\FyzeZiq.exe
  C:\Windows\System\FyzeZiq.exe
  2⤵
  PID:7344
- C:\Windows\System\GyqGDSg.exe
  C:\Windows\System\GyqGDSg.exe
  2⤵
  PID:7020
- C:\Windows\System\ujbWYkP.exe
  C:\Windows\System\ujbWYkP.exe
  2⤵
  PID:7652
- C:\Windows\System\PrOGPIA.exe
  C:\Windows\System\PrOGPIA.exe
  2⤵
  PID:7456
- C:\Windows\System\pPJCuih.exe
  C:\Windows\System\pPJCuih.exe
  2⤵
  PID:7632
- C:\Windows\System\DbUJzrc.exe
  C:\Windows\System\DbUJzrc.exe
  2⤵
  PID:7864
- C:\Windows\System\JPQHwRk.exe
  C:\Windows\System\JPQHwRk.exe
  2⤵
  PID:7968
- C:\Windows\System\YZLIecb.exe
  C:\Windows\System\YZLIecb.exe
  2⤵
  PID:6264
- C:\Windows\System\ctPQFZl.exe
  C:\Windows\System\ctPQFZl.exe
  2⤵
  PID:7476
- C:\Windows\System\EhabMky.exe
  C:\Windows\System\EhabMky.exe
  2⤵
  PID:8128
- C:\Windows\System\WqAldjJ.exe
  C:\Windows\System\WqAldjJ.exe
  2⤵
  PID:8012
- C:\Windows\System\OFdPcVz.exe
  C:\Windows\System\OFdPcVz.exe
  2⤵
  PID:8180
- C:\Windows\System\BkQpTrL.exe
  C:\Windows\System\BkQpTrL.exe
  2⤵
  PID:7204
- C:\Windows\System\LadNZgP.exe
  C:\Windows\System\LadNZgP.exe
  2⤵
  PID:7948
- C:\Windows\System\QbZIVgN.exe
  C:\Windows\System\QbZIVgN.exe
  2⤵
  PID:8208
- C:\Windows\System\ttflcwM.exe
  C:\Windows\System\ttflcwM.exe
  2⤵
  PID:8224
- C:\Windows\System\dNDiuuY.exe
  C:\Windows\System\dNDiuuY.exe
  2⤵
  PID:8248
- C:\Windows\System\SOiwuqm.exe
  C:\Windows\System\SOiwuqm.exe
  2⤵
  PID:8264
- C:\Windows\System\HWjrDRn.exe
  C:\Windows\System\HWjrDRn.exe
  2⤵
  PID:8280
- C:\Windows\System\GHelyRu.exe
  C:\Windows\System\GHelyRu.exe
  2⤵
  PID:8296
- C:\Windows\System\LOfOUPK.exe
  C:\Windows\System\LOfOUPK.exe
  2⤵
  PID:8312
- C:\Windows\System\nVSEHxf.exe
  C:\Windows\System\nVSEHxf.exe
  2⤵
  PID:8332
- C:\Windows\System\Spdjelg.exe
  C:\Windows\System\Spdjelg.exe
  2⤵
  PID:8348
- C:\Windows\System\WaqBTjs.exe
  C:\Windows\System\WaqBTjs.exe
  2⤵
  PID:8364
- C:\Windows\System\HIAZNll.exe
  C:\Windows\System\HIAZNll.exe
  2⤵
  PID:8380
- C:\Windows\System\YZUfzyf.exe
  C:\Windows\System\YZUfzyf.exe
  2⤵
  PID:8396
- C:\Windows\System\VWkLzPQ.exe
  C:\Windows\System\VWkLzPQ.exe
  2⤵
  PID:8412
- C:\Windows\System\dcAHHPi.exe
  C:\Windows\System\dcAHHPi.exe
  2⤵
  PID:8428
- C:\Windows\System\vwYUSCa.exe
  C:\Windows\System\vwYUSCa.exe
  2⤵
  PID:8444
- C:\Windows\System\TlzYQfy.exe
  C:\Windows\System\TlzYQfy.exe
  2⤵
  PID:8460
- C:\Windows\System\elzixCL.exe
  C:\Windows\System\elzixCL.exe
  2⤵
  PID:8476
- C:\Windows\System\CyFwTcm.exe
  C:\Windows\System\CyFwTcm.exe
  2⤵
  PID:8492
- C:\Windows\System\ucIUYlQ.exe
  C:\Windows\System\ucIUYlQ.exe
  2⤵
  PID:8508
- C:\Windows\System\XmGmPpK.exe
  C:\Windows\System\XmGmPpK.exe
  2⤵
  PID:8524
- C:\Windows\System\ToTwSbB.exe
  C:\Windows\System\ToTwSbB.exe
  2⤵
  PID:8540
- C:\Windows\System\egoaLBb.exe
  C:\Windows\System\egoaLBb.exe
  2⤵
  PID:8556
- C:\Windows\System\TWTuUqr.exe
  C:\Windows\System\TWTuUqr.exe
  2⤵
  PID:8572
- C:\Windows\System\VbytfBi.exe
  C:\Windows\System\VbytfBi.exe
  2⤵
  PID:8588
- C:\Windows\System\TomeQig.exe
  C:\Windows\System\TomeQig.exe
  2⤵
  PID:8604
- C:\Windows\System\RtOfDpl.exe
  C:\Windows\System\RtOfDpl.exe
  2⤵
  PID:8620
- C:\Windows\System\yHHgYOD.exe
  C:\Windows\System\yHHgYOD.exe
  2⤵
  PID:8636
- C:\Windows\System\dUvFOwJ.exe
  C:\Windows\System\dUvFOwJ.exe
  2⤵
  PID:8652
- C:\Windows\System\ODLtZFF.exe
  C:\Windows\System\ODLtZFF.exe
  2⤵
  PID:8668
- C:\Windows\System\EagFNMN.exe
  C:\Windows\System\EagFNMN.exe
  2⤵
  PID:8684
- C:\Windows\System\KbqVKfO.exe
  C:\Windows\System\KbqVKfO.exe
  2⤵
  PID:8700
- C:\Windows\System\pFFMsdU.exe
  C:\Windows\System\pFFMsdU.exe
  2⤵
  PID:8716
- C:\Windows\System\LRBNkFV.exe
  C:\Windows\System\LRBNkFV.exe
  2⤵
  PID:8732
- C:\Windows\System\UHqUIWb.exe
  C:\Windows\System\UHqUIWb.exe
  2⤵
  PID:8748
- C:\Windows\System\KCMMxLI.exe
  C:\Windows\System\KCMMxLI.exe
  2⤵
  PID:8764
- C:\Windows\System\BXymdWT.exe
  C:\Windows\System\BXymdWT.exe
  2⤵
  PID:8780
- C:\Windows\System\FWrqRiA.exe
  C:\Windows\System\FWrqRiA.exe
  2⤵
  PID:8796
- C:\Windows\System\luXmTzN.exe
  C:\Windows\System\luXmTzN.exe
  2⤵
  PID:8812
- C:\Windows\System\YZOyeCL.exe
  C:\Windows\System\YZOyeCL.exe
  2⤵
  PID:8828
- C:\Windows\System\QNmWVzN.exe
  C:\Windows\System\QNmWVzN.exe
  2⤵
  PID:8844
- C:\Windows\System\PlGkOBI.exe
  C:\Windows\System\PlGkOBI.exe
  2⤵
  PID:8860
- C:\Windows\System\RTXxSTL.exe
  C:\Windows\System\RTXxSTL.exe
  2⤵
  PID:8880
- C:\Windows\System\yYJQKDi.exe
  C:\Windows\System\yYJQKDi.exe
  2⤵
  PID:8900
- C:\Windows\System\YgDNIuV.exe
  C:\Windows\System\YgDNIuV.exe
  2⤵
  PID:8916
- C:\Windows\System\atgKRuS.exe
  C:\Windows\System\atgKRuS.exe
  2⤵
  PID:8932
- C:\Windows\System\cSWRCGR.exe
  C:\Windows\System\cSWRCGR.exe
  2⤵
  PID:8952
- C:\Windows\System\vsVdYns.exe
  C:\Windows\System\vsVdYns.exe
  2⤵
  PID:8968
- C:\Windows\System\yKYuNqL.exe
  C:\Windows\System\yKYuNqL.exe
  2⤵
  PID:8988
- C:\Windows\System\IPDbrCO.exe
  C:\Windows\System\IPDbrCO.exe
  2⤵
  PID:9004
- C:\Windows\System\LmVtHrg.exe
  C:\Windows\System\LmVtHrg.exe
  2⤵
  PID:9020
- C:\Windows\System\jnkkGWw.exe
  C:\Windows\System\jnkkGWw.exe
  2⤵
  PID:9036
- C:\Windows\System\TIFzDZQ.exe
  C:\Windows\System\TIFzDZQ.exe
  2⤵
  PID:9052
- C:\Windows\System\ivMzyHC.exe
  C:\Windows\System\ivMzyHC.exe
  2⤵
  PID:9068
- C:\Windows\System\zeAOeaz.exe
  C:\Windows\System\zeAOeaz.exe
  2⤵
  PID:9084
- C:\Windows\System\lBdQjnh.exe
  C:\Windows\System\lBdQjnh.exe
  2⤵
  PID:9100
- C:\Windows\System\wPnDCWo.exe
  C:\Windows\System\wPnDCWo.exe
  2⤵
  PID:9116
- C:\Windows\System\VcZkSlw.exe
  C:\Windows\System\VcZkSlw.exe
  2⤵
  PID:9132
- C:\Windows\System\LHmSmOp.exe
  C:\Windows\System\LHmSmOp.exe
  2⤵
  PID:9148
- C:\Windows\System\GIuyqRv.exe
  C:\Windows\System\GIuyqRv.exe
  2⤵
  PID:9164
- C:\Windows\System\HXGpOqq.exe
  C:\Windows\System\HXGpOqq.exe
  2⤵
  PID:9180
- C:\Windows\System\MMdHleH.exe
  C:\Windows\System\MMdHleH.exe
  2⤵
  PID:9196
- C:\Windows\System\YxWQOza.exe
  C:\Windows\System\YxWQOza.exe
  2⤵
  PID:9212
- C:\Windows\System\XLKZJsp.exe
  C:\Windows\System\XLKZJsp.exe
  2⤵
  PID:1568
- C:\Windows\System\tLaUdUs.exe
  C:\Windows\System\tLaUdUs.exe
  2⤵
  PID:8032
- C:\Windows\System\FknWPeA.exe
  C:\Windows\System\FknWPeA.exe
  2⤵
  PID:8064
- C:\Windows\System\PNvhDeY.exe
  C:\Windows\System\PNvhDeY.exe
  2⤵
  PID:8220
- C:\Windows\System\aiCqzsB.exe
  C:\Windows\System\aiCqzsB.exe
  2⤵
  PID:8304
- C:\Windows\System\SNXliEB.exe
  C:\Windows\System\SNXliEB.exe
  2⤵
  PID:7900
- C:\Windows\System\mSqWsxN.exe
  C:\Windows\System\mSqWsxN.exe
  2⤵
  PID:8320
- C:\Windows\System\BgfRRrE.exe
  C:\Windows\System\BgfRRrE.exe
  2⤵
  PID:8340
- C:\Windows\System\QlLAiQC.exe
  C:\Windows\System\QlLAiQC.exe
  2⤵
  PID:8404
- C:\Windows\System\nITAVla.exe
  C:\Windows\System\nITAVla.exe
  2⤵
  PID:8468
- C:\Windows\System\IvMayRO.exe
  C:\Windows\System\IvMayRO.exe
  2⤵
  PID:8532
- C:\Windows\System\gQIoyGZ.exe
  C:\Windows\System\gQIoyGZ.exe
  2⤵
  PID:8564
- C:\Windows\System\qdbDwSE.exe
  C:\Windows\System\qdbDwSE.exe
  2⤵
  PID:8356
- C:\Windows\System\luhQrjf.exe
  C:\Windows\System\luhQrjf.exe
  2⤵
  PID:8420
- C:\Windows\System\fsMkQNd.exe
  C:\Windows\System\fsMkQNd.exe
  2⤵
  PID:8456
- C:\Windows\System\QrohaPK.exe
  C:\Windows\System\QrohaPK.exe
  2⤵
  PID:8580
- C:\Windows\System\AobLziz.exe
  C:\Windows\System\AobLziz.exe
  2⤵
  PID:8632
- C:\Windows\System\HsxcyAt.exe
  C:\Windows\System\HsxcyAt.exe
  2⤵
  PID:8664
- C:\Windows\System\uobpjDV.exe
  C:\Windows\System\uobpjDV.exe
  2⤵
  PID:8728
- C:\Windows\System\tjYGKmb.exe
  C:\Windows\System\tjYGKmb.exe
  2⤵
  PID:8644
- C:\Windows\System\ofTOyWV.exe
  C:\Windows\System\ofTOyWV.exe
  2⤵
  PID:8676
- C:\Windows\System\nAeEDNB.exe
  C:\Windows\System\nAeEDNB.exe
  2⤵
  PID:8744
- C:\Windows\System\nlSvtPU.exe
  C:\Windows\System\nlSvtPU.exe
  2⤵
  PID:8824
- C:\Windows\System\idmgoyu.exe
  C:\Windows\System\idmgoyu.exe
  2⤵
  PID:8888
- C:\Windows\System\NKjiDFn.exe
  C:\Windows\System\NKjiDFn.exe
  2⤵
  PID:8928
- C:\Windows\System\affYGVC.exe
  C:\Windows\System\affYGVC.exe
  2⤵
  PID:8908
- C:\Windows\System\lotbVDe.exe
  C:\Windows\System\lotbVDe.exe
  2⤵
  PID:8996
- C:\Windows\System\ssIKDbO.exe
  C:\Windows\System\ssIKDbO.exe
  2⤵
  PID:8836
- C:\Windows\System\mgqlQay.exe
  C:\Windows\System\mgqlQay.exe
  2⤵
  PID:8976
- C:\Windows\System\NDnlJIZ.exe
  C:\Windows\System\NDnlJIZ.exe
  2⤵
  PID:9028
- C:\Windows\System\mTkWEMf.exe
  C:\Windows\System\mTkWEMf.exe
  2⤵
  PID:8144
- C:\Windows\System\NGOvTyL.exe
  C:\Windows\System\NGOvTyL.exe
  2⤵
  PID:9092
- C:\Windows\System\baJqMVg.exe
  C:\Windows\System\baJqMVg.exe
  2⤵
  PID:9156
- C:\Windows\System\wxWWOla.exe
  C:\Windows\System\wxWWOla.exe
  2⤵
  PID:9076
- C:\Windows\System\BoCywpI.exe
  C:\Windows\System\BoCywpI.exe
  2⤵
  PID:8200
- C:\Windows\System\UOablVd.exe
  C:\Windows\System\UOablVd.exe
  2⤵
  PID:8236
- C:\Windows\System\DgxwXKE.exe
  C:\Windows\System\DgxwXKE.exe
  2⤵
  PID:8272
- C:\Windows\System\caEvoJg.exe
  C:\Windows\System\caEvoJg.exe
  2⤵
  PID:9176
- C:\Windows\System\DetWcQh.exe
  C:\Windows\System\DetWcQh.exe
  2⤵
  PID:8256
- C:\Windows\System\BpXAskD.exe
  C:\Windows\System\BpXAskD.exe
  2⤵
  PID:8504
- C:\Windows\System\lytOVZK.exe
  C:\Windows\System\lytOVZK.exe
  2⤵
  PID:8292
- C:\Windows\System\whJLcZv.exe
  C:\Windows\System\whJLcZv.exe
  2⤵
  PID:8440
- C:\Windows\System\FqmcKmI.exe
  C:\Windows\System\FqmcKmI.exe
  2⤵
  PID:8328
- C:\Windows\System\LJTiuoK.exe
  C:\Windows\System\LJTiuoK.exe
  2⤵
  PID:8600
- C:\Windows\System\wLtpMwz.exe
  C:\Windows\System\wLtpMwz.exe
  2⤵
  PID:8724
- C:\Windows\System\KnHbqhe.exe
  C:\Windows\System\KnHbqhe.exe
  2⤵
  PID:8820
- C:\Windows\System\ONodxEp.exe
  C:\Windows\System\ONodxEp.exe
  2⤵
  PID:8964
- C:\Windows\System\tMrUsmH.exe
  C:\Windows\System\tMrUsmH.exe
  2⤵
  PID:9064
- C:\Windows\System\uIBYFoc.exe
  C:\Windows\System\uIBYFoc.exe
  2⤵
  PID:8712
- C:\Windows\System\kETdSmf.exe
  C:\Windows\System\kETdSmf.exe
  2⤵
  PID:8660
- C:\Windows\System\Fczkouw.exe
  C:\Windows\System\Fczkouw.exe
  2⤵
  PID:8808
- C:\Windows\System\HJQWuNW.exe
  C:\Windows\System\HJQWuNW.exe
  2⤵
  PID:9012
- C:\Windows\System\tKGIaFB.exe
  C:\Windows\System\tKGIaFB.exe
  2⤵
  PID:9192
- C:\Windows\System\jxTFbZh.exe
  C:\Windows\System\jxTFbZh.exe
  2⤵
  PID:7604
- C:\Windows\System\qJtnKMU.exe
  C:\Windows\System\qJtnKMU.exe
  2⤵
  PID:8548
- C:\Windows\System\MxOpcdP.exe
  C:\Windows\System\MxOpcdP.exe
  2⤵
  PID:9144
- C:\Windows\System\IixGoNN.exe
  C:\Windows\System\IixGoNN.exe
  2⤵
  PID:8376
- C:\Windows\System\lAvnroP.exe
  C:\Windows\System\lAvnroP.exe
  2⤵
  PID:8388
- C:\Windows\System\vTdEGDt.exe
  C:\Windows\System\vTdEGDt.exe
  2⤵
  PID:8628
- C:\Windows\System\emWufGV.exe
  C:\Windows\System\emWufGV.exe
  2⤵
  PID:8960
- C:\Windows\System\EggWhNT.exe
  C:\Windows\System\EggWhNT.exe
  2⤵
  PID:8708
- C:\Windows\System\wMdMoZW.exe
  C:\Windows\System\wMdMoZW.exe
  2⤵
  PID:9188
- C:\Windows\System\qXSjfob.exe
  C:\Windows\System\qXSjfob.exe
  2⤵
  PID:8584
- C:\Windows\System\tsxBIOe.exe
  C:\Windows\System\tsxBIOe.exe
  2⤵
  PID:8288
- C:\Windows\System\GNKKTPd.exe
  C:\Windows\System\GNKKTPd.exe
  2⤵
  PID:8436
- C:\Windows\System\nqsxaYs.exe
  C:\Windows\System\nqsxaYs.exe
  2⤵
  PID:9060
- C:\Windows\System\bNTdBUf.exe
  C:\Windows\System\bNTdBUf.exe
  2⤵
  PID:8488
- C:\Windows\System\ZTrifRE.exe
  C:\Windows\System\ZTrifRE.exe
  2⤵
  PID:7744
- C:\Windows\System\OcZPNlg.exe
  C:\Windows\System\OcZPNlg.exe
  2⤵
  PID:9124
- C:\Windows\System\sniuwYM.exe
  C:\Windows\System\sniuwYM.exe
  2⤵
  PID:9220
- C:\Windows\System\hbyHXJG.exe
  C:\Windows\System\hbyHXJG.exe
  2⤵
  PID:9236
- C:\Windows\System\apvcMDj.exe
  C:\Windows\System\apvcMDj.exe
  2⤵
  PID:9252
- C:\Windows\System\eYViySx.exe
  C:\Windows\System\eYViySx.exe
  2⤵
  PID:9268
- C:\Windows\System\fcNqFdr.exe
  C:\Windows\System\fcNqFdr.exe
  2⤵
  PID:9284
- C:\Windows\System\snuaavt.exe
  C:\Windows\System\snuaavt.exe
  2⤵
  PID:9300
- C:\Windows\System\SaCKKIs.exe
  C:\Windows\System\SaCKKIs.exe
  2⤵
  PID:9316
- C:\Windows\System\azDjayS.exe
  C:\Windows\System\azDjayS.exe
  2⤵
  PID:9332
- C:\Windows\System\DzJMiUp.exe
  C:\Windows\System\DzJMiUp.exe
  2⤵
  PID:9348
- C:\Windows\System\hcJKTKV.exe
  C:\Windows\System\hcJKTKV.exe
  2⤵
  PID:9364
- C:\Windows\System\kZPgkXu.exe
  C:\Windows\System\kZPgkXu.exe
  2⤵
  PID:9380
- C:\Windows\System\KvsKkAN.exe
  C:\Windows\System\KvsKkAN.exe
  2⤵
  PID:9396
- C:\Windows\System\qltSSsu.exe
  C:\Windows\System\qltSSsu.exe
  2⤵
  PID:9412
- C:\Windows\System\kKjQdez.exe
  C:\Windows\System\kKjQdez.exe
  2⤵
  PID:9428
- C:\Windows\System\qhAKXLK.exe
  C:\Windows\System\qhAKXLK.exe
  2⤵
  PID:9444
- C:\Windows\System\GKbzyzp.exe
  C:\Windows\System\GKbzyzp.exe
  2⤵
  PID:9460
- C:\Windows\System\SkmGzGo.exe
  C:\Windows\System\SkmGzGo.exe
  2⤵
  PID:9476
- C:\Windows\System\erCQyOR.exe
  C:\Windows\System\erCQyOR.exe
  2⤵
  PID:9492
- C:\Windows\System\llPyMoK.exe
  C:\Windows\System\llPyMoK.exe
  2⤵
  PID:9508
- C:\Windows\System\kEuqmdw.exe
  C:\Windows\System\kEuqmdw.exe
  2⤵
  PID:9524
- C:\Windows\System\rYhdkBk.exe
  C:\Windows\System\rYhdkBk.exe
  2⤵
  PID:9540
- C:\Windows\System\CjeTWux.exe
  C:\Windows\System\CjeTWux.exe
  2⤵
  PID:9556
- C:\Windows\System\OveLtRS.exe
  C:\Windows\System\OveLtRS.exe
  2⤵
  PID:9572
- C:\Windows\System\NTlIexj.exe
  C:\Windows\System\NTlIexj.exe
  2⤵
  PID:9588
- C:\Windows\System\emhKZCW.exe
  C:\Windows\System\emhKZCW.exe
  2⤵
  PID:9604
- C:\Windows\System\JJWBFSV.exe
  C:\Windows\System\JJWBFSV.exe
  2⤵
  PID:9620
- C:\Windows\System\kpzsYid.exe
  C:\Windows\System\kpzsYid.exe
  2⤵
  PID:9636
- C:\Windows\System\dbyaqsl.exe
  C:\Windows\System\dbyaqsl.exe
  2⤵
  PID:9656
- C:\Windows\System\sSRiyQj.exe
  C:\Windows\System\sSRiyQj.exe
  2⤵
  PID:9676
- C:\Windows\System\YKaDwak.exe
  C:\Windows\System\YKaDwak.exe
  2⤵
  PID:9692
- C:\Windows\System\IKHnVKl.exe
  C:\Windows\System\IKHnVKl.exe
  2⤵
  PID:9708
- C:\Windows\System\QHveuFS.exe
  C:\Windows\System\QHveuFS.exe
  2⤵
  PID:9724
- C:\Windows\System\pnZUuZN.exe
  C:\Windows\System\pnZUuZN.exe
  2⤵
  PID:9740
- C:\Windows\System\WbvoDcl.exe
  C:\Windows\System\WbvoDcl.exe
  2⤵
  PID:9756
- C:\Windows\System\vvvKACn.exe
  C:\Windows\System\vvvKACn.exe
  2⤵
  PID:9772
- C:\Windows\System\wHymreX.exe
  C:\Windows\System\wHymreX.exe
  2⤵
  PID:9788
- C:\Windows\System\oFVmsfI.exe
  C:\Windows\System\oFVmsfI.exe
  2⤵
  PID:9804
- C:\Windows\System\UuVQWUZ.exe
  C:\Windows\System\UuVQWUZ.exe
  2⤵
  PID:9820
- C:\Windows\System\ckLtjAA.exe
  C:\Windows\System\ckLtjAA.exe
  2⤵
  PID:9836
- C:\Windows\System\RsmZRoe.exe
  C:\Windows\System\RsmZRoe.exe
  2⤵
  PID:9852
- C:\Windows\System\NpaeLJM.exe
  C:\Windows\System\NpaeLJM.exe
  2⤵
  PID:9868
- C:\Windows\System\pfVTqAu.exe
  C:\Windows\System\pfVTqAu.exe
  2⤵
  PID:9884
- C:\Windows\System\VaoWmXy.exe
  C:\Windows\System\VaoWmXy.exe
  2⤵
  PID:9900
- C:\Windows\System\bKwHaeE.exe
  C:\Windows\System\bKwHaeE.exe
  2⤵
  PID:9916
- C:\Windows\System\dvOyMuB.exe
  C:\Windows\System\dvOyMuB.exe
  2⤵
  PID:9936
- C:\Windows\System\QgyNbjz.exe
  C:\Windows\System\QgyNbjz.exe
  2⤵
  PID:9952
- C:\Windows\System\zaYthNy.exe
  C:\Windows\System\zaYthNy.exe
  2⤵
  PID:9968
- C:\Windows\System\zuIWGsM.exe
  C:\Windows\System\zuIWGsM.exe
  2⤵
  PID:9984
- C:\Windows\System\gRTTGyy.exe
  C:\Windows\System\gRTTGyy.exe
  2⤵
  PID:10000
- C:\Windows\System\JcgJLNA.exe
  C:\Windows\System\JcgJLNA.exe
  2⤵
  PID:10016
- C:\Windows\System\wnyZHKv.exe
  C:\Windows\System\wnyZHKv.exe
  2⤵
  PID:10032
- C:\Windows\System\sSPQwYX.exe
  C:\Windows\System\sSPQwYX.exe
  2⤵
  PID:10048
- C:\Windows\System\FJPeVdJ.exe
  C:\Windows\System\FJPeVdJ.exe
  2⤵
  PID:10064
- C:\Windows\System\mqbdnvm.exe
  C:\Windows\System\mqbdnvm.exe
  2⤵
  PID:10080
- C:\Windows\System\lrPdduI.exe
  C:\Windows\System\lrPdduI.exe
  2⤵
  PID:10096
- C:\Windows\System\ttUcuvG.exe
  C:\Windows\System\ttUcuvG.exe
  2⤵
  PID:10112
- C:\Windows\System\bQHblCv.exe
  C:\Windows\System\bQHblCv.exe
  2⤵
  PID:10128
- C:\Windows\System\zrEtjtu.exe
  C:\Windows\System\zrEtjtu.exe
  2⤵
  PID:10144
- C:\Windows\System\OffnVmP.exe
  C:\Windows\System\OffnVmP.exe
  2⤵
  PID:10164
- C:\Windows\System\rHRCZeZ.exe
  C:\Windows\System\rHRCZeZ.exe
  2⤵
  PID:10180
- C:\Windows\System\gZTlRau.exe
  C:\Windows\System\gZTlRau.exe
  2⤵
  PID:10196
- C:\Windows\System\kJaoDLP.exe
  C:\Windows\System\kJaoDLP.exe
  2⤵
  PID:10212
- C:\Windows\System\eRBWJCi.exe
  C:\Windows\System\eRBWJCi.exe
  2⤵
  PID:10228
- C:\Windows\System\bjCaRBi.exe
  C:\Windows\System\bjCaRBi.exe
  2⤵
  PID:8940
- C:\Windows\System\jMQLvQI.exe
  C:\Windows\System\jMQLvQI.exe
  2⤵
  PID:9232
- C:\Windows\System\vNzPMvV.exe
  C:\Windows\System\vNzPMvV.exe
  2⤵
  PID:9296
- C:\Windows\System\dwqAiXW.exe
  C:\Windows\System\dwqAiXW.exe
  2⤵
  PID:9308
- C:\Windows\System\ZWOYLBO.exe
  C:\Windows\System\ZWOYLBO.exe
  2⤵
  PID:9328
- C:\Windows\System\SFfieVv.exe
  C:\Windows\System\SFfieVv.exe
  2⤵
  PID:9388
- C:\Windows\System\OGKKhNg.exe
  C:\Windows\System\OGKKhNg.exe
  2⤵
  PID:9408
- C:\Windows\System\nKsqAex.exe
  C:\Windows\System\nKsqAex.exe
  2⤵
  PID:9440
- C:\Windows\System\ZKkiBBP.exe
  C:\Windows\System\ZKkiBBP.exe
  2⤵
  PID:9472
- C:\Windows\System\XvftVvD.exe
  C:\Windows\System\XvftVvD.exe
  2⤵
  PID:9500
- C:\Windows\System\qMmrnGX.exe
  C:\Windows\System\qMmrnGX.exe
  2⤵
  PID:9532
- C:\Windows\System\eTtKaBn.exe
  C:\Windows\System\eTtKaBn.exe
  2⤵
  PID:9584
- C:\Windows\System\ZFNmJnX.exe
  C:\Windows\System\ZFNmJnX.exe
  2⤵
  PID:9644
- C:\Windows\System\tjoqIIq.exe
  C:\Windows\System\tjoqIIq.exe
  2⤵
  PID:9600
- C:\Windows\System\kQwnTeO.exe
  C:\Windows\System\kQwnTeO.exe
  2⤵
  PID:9688
- C:\Windows\System\cQhIFDL.exe
  C:\Windows\System\cQhIFDL.exe
  2⤵
  PID:9704
- C:\Windows\System\HjIKjbz.exe
  C:\Windows\System\HjIKjbz.exe
  2⤵
  PID:9784
- C:\Windows\System\mIXYCcs.exe
  C:\Windows\System\mIXYCcs.exe
  2⤵
  PID:9848
- C:\Windows\System\GHSCIsd.exe
  C:\Windows\System\GHSCIsd.exe
  2⤵
  PID:9912
- C:\Windows\System\BdKngzz.exe
  C:\Windows\System\BdKngzz.exe
  2⤵
  PID:9732
- C:\Windows\System\FCASELq.exe
  C:\Windows\System\FCASELq.exe
  2⤵
  PID:9800
- C:\Windows\System\gLYpyMB.exe
  C:\Windows\System\gLYpyMB.exe
  2⤵
  PID:9864
- C:\Windows\System\QxyMqCw.exe
  C:\Windows\System\QxyMqCw.exe
  2⤵
  PID:9932
- C:\Windows\System\lUsSQPM.exe
  C:\Windows\System\lUsSQPM.exe
  2⤵
  PID:9964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ABZLUTa.exe

Filesize
2.1MB

MD5
a9ae112467c18657d6c4e4243971d3e7

SHA1
eb1cadd02c2ec4a3421e1574c71ba7bd4737c6f1

SHA256
c45dc9c8cb182108b53e2cf9b66f18a28e3c3c2d40eeacdaeb510e9b3f7c6749

SHA512
95be7bff7c6183fce7b13b637dd903c5f73bbb9d6f84a158d56c1d00edde2cd93a7716285d248a0cb7a9d68d9950a5e5208970807c8713068349d868ae76e20a

Download Submit
C:\Windows\system\AyLzeyH.exe

Filesize
2.1MB

MD5
f7cb4b29c51fbd5a69de1cd3bb6014d6

SHA1
8e67595b36a15beaa3cd6c9cdb9e695439193f5d

SHA256
ae84ee0acda11b2bfd5d70ede5ca10cd5bb5bef42096457ca82a980fd3d1c232

SHA512
0025b9deac6ea897b743c531a88109eff73119a40142a3bcee0f0f503a88240d77914f98f02db178abc950cf980401c3a7d38f4e0ac9efaf5749532937b0ff41

Download Submit
C:\Windows\system\Egvulwo.exe

Filesize
2.1MB

MD5
98586d84971a6ac380e780533c693a88

SHA1
a5a584744993595201ce1d6cda74a2de66a19fa8

SHA256
53e3ff13ad20a832d863e1aaf5b4f2b9836319025c20b08c9772d5ed46ae8b2e

SHA512
d826845a4c46b73fdf499205a6ae54a4a5b4de9ca7804df25f45e8b862e486079593045ed7bb33493f7d6f1a171e22503d5d58f5de62203586ddcc59bb5a24a3

Download Submit
C:\Windows\system\FFbqHfr.exe

Filesize
2.1MB

MD5
c5c075e3eac7de14706faa1542cad14c

SHA1
0b6e4318585b975627d37fd0c4d1d35894482553

SHA256
9c4122ecdd154b7367b317ba6a4c416c3ef023d1d44b7a31cabf2cff45fbc090

SHA512
0d704f0bdfa08c1d7f899651131cfa36d8a783870b134f78703b77783275306b63e08d876639f9c2585023341e2f8bce2a9545e4148c5f9b36fdf76e50e5e6d1

Download Submit
C:\Windows\system\LZewDwJ.exe

Filesize
2.1MB

MD5
27eb03f71b86dbd8af693d8416a2cafc

SHA1
05904ae90e9145adfce9232b4d11f75a24726af4

SHA256
93de537a642d3a95c6a9901547ca4ef0775242a4ee49315220d6e4bd0a58906b

SHA512
e8f70cf7db34b8495c8a6a56a64ee8abee5b5258ebbcc7354bff3a1920b06b8556422037373ae228316c1f5d2061145924829ae4c203d8b4db3ff3ff192b7a9c

Download Submit
C:\Windows\system\TooSEJZ.exe

Filesize
2.1MB

MD5
82cf6455fb4c2413b3f171be72ae27ad

SHA1
bf64845320324b6fa0162cc2f2d3668dcf3d33d7

SHA256
062b4c830f97559924d62f7ce4473c7f6c01800798e0cf48958b9c10e5a8a31a

SHA512
46653035ca0c4fc47ea7bfa60da984a21e32abd4de07d6f7870387f7a27ed6336dde255c6a8ba8ee2a8d21aaab0be1da2cb1f354dd5ac0d36708364f0e6072a2

Download Submit
C:\Windows\system\UwBBHRH.exe

Filesize
2.1MB

MD5
150bf81b1f9637d43f502e9dec830222

SHA1
a929705d1b135cc6bff8bff386487eb7c70c542e

SHA256
d571b2e2ccf7a96dfaf6ad80a67d067b2f2bdad2563c5de08be108787f3da40f

SHA512
4690d22564376f5a64239b951ee8f446f0d11a6d37e626de72e15aee2a1c70f8534f62c7bc94695c6791b339804268552c310ecce783eec602985531302d7a58

Download Submit
C:\Windows\system\WawoGLT.exe

Filesize
2.1MB

MD5
fee99614d954046155fa1a8ad87c616f

SHA1
1c69ed52b52dd54fece9cb95c1daa07edd11f659

SHA256
a292cf656c63c3fdc592e2247743f54a1d792276e0f40726e96933dbacdbb77c

SHA512
fbfb9d63dc0cc23a304ed58763d04d671880e8683da7f765b26d27ec54de995bbdcbbe6060cbef2b0998d22e2352536f0278d11d69dcc9e933e7bf7721f4db0e

Download Submit
C:\Windows\system\XwOBAbO.exe

Filesize
2.1MB

MD5
39639c9be08869b1d76f85b41ca93dd7

SHA1
13a23f771373746f938e2fc462dd88f2b6955151

SHA256
53c9267f4d4e04987c79d6df1f907498aa0e6087fc3a2b31049f8b60265cad36

SHA512
09a14059138cce4e8a46aadf57ccc224577ededc64644c856ffb41391dec50fd1125ce7445b0aea37303eb16e98eefd1b98016901ad34626120b055f49f36428

Download Submit
C:\Windows\system\cELIgmL.exe

Filesize
2.1MB

MD5
99a4d1f103a169099591de645bd2b61a

SHA1
a136ea71e957319306e0dd7d327c3425c0a2964d

SHA256
2ba7bba32af3517fe9abaea41d81582d72e57449193b1649e32dda6fdb536a97

SHA512
7dd146126e80a9542916560b83ec86ca2b79fa2eee24e3c5d780609d4a863de0b567275ff57243d4eee9da73d3e1afe162eeb2235bd0bd4ed22f849c42003d44

Download Submit
C:\Windows\system\eOrbdZa.exe

Filesize
2.1MB

MD5
782db4bb9839637291cafbcbbf3753be

SHA1
be7e57111b3d94304352f81d1872bf1a95233133

SHA256
b1d5138bd6ef7d3f7cfedf1a7d2918ae6e4619577bcc87471ba7cdf6efb3639e

SHA512
7bdececd59c8d359eca20f87000d66d08715c264d13a84166d1ba3f9cc1ac9b60832c21d4199afe1df3ace7d99cc1f1a17f436396d6e0316ce8d4dbe876422dc

Download Submit
C:\Windows\system\fQBSOUm.exe

Filesize
2.1MB

MD5
fb8807df8e864b3b2be97f5b9a2802e7

SHA1
90fb87c92c90e5e3d3500867e5d70826cda075bf

SHA256
292f7d660d592bc968318e215cf69bb16f8e15ad68aca8e1bf5344a717b4e6fe

SHA512
c8e38525397d899cbaae99ad5eb0505f6f4e80871c2ba142a7119257fdd86043b9d70e4142f897acaa6186ecd123eeb42e63db5be4f90843f1839c32e103eca7

Download Submit
C:\Windows\system\hEajCIQ.exe

Filesize
2.1MB

MD5
1360c8908b822c0df53d514c70ac49c1

SHA1
642731976f88c4ef5b6fa8eb69a6ef708bf20f03

SHA256
52510ee466932b514e52cad151377011cea9ab5d891c3a095c1a4b81d6802a1d

SHA512
6346f246f1e2cdc68046bad2c299c930784c833b2f3a745c91d21d5b98d045bf84bddf67e714ffaef2b0ec61cf98bf51eba39b73cd82fdbec55a5fa598552f4f

Download Submit
C:\Windows\system\hhyiGgg.exe

Filesize
2.1MB

MD5
5d23896d7203ad72be69bd8cd4576d35

SHA1
1a55df386fdd1d56d38beacdc6dac51c5f805666

SHA256
e013ff6736a1ffe3c8c8fae78b9de477edecbc99940184ac2c8ee5d2d07437d8

SHA512
2477ff461d62e41a74aa93d1e623a1aeab8f97b074c56de561dd892434d8e6f1be144f8d445e303c35e611075816931e6b14ec43e7c9a5d6f529fa39a5c41c33

Download Submit
C:\Windows\system\iJynjSL.exe

Filesize
2.1MB

MD5
48d1571be5943cc200c3a3b3b39b5597

SHA1
ac41641325eb6d641d93628992453dbd26ece809

SHA256
5233d82c47ebe51b26709013faf3cfd207f5f7809fa73a213b07d20c60476b45

SHA512
5eb75dff776f6770fa1d2ae54c759d764b8f9a56ac50cc5f5b388c2b53f5f08ccaaf6a0b2f5ef993a64cef09e2c6abc92251a8797f39de1b1eb4840397b83737

Download Submit
C:\Windows\system\jnZceMU.exe

Filesize
2.1MB

MD5
21154268c9816b00bc6836ca99f89012

SHA1
1bf824196b6fc79930ee7123c56dc67fa47900d3

SHA256
f3efbd21c470feae6c28f7aa8b987c4c369c0dadabc8b17fdd53de62a4792494

SHA512
b6808441867cd58afd99191b8e526ba47d01dcef75c71dbc5ae34d434fdd4f15afbd217f559418e3017a9f9eb15cbe25d26840e0774932dc68cc5375b9b978b3

Download Submit
C:\Windows\system\pRtodtm.exe

Filesize
2.1MB

MD5
9d3fac1516ff1270f5ef6df68e5262ac

SHA1
35226ef860e2ec6643dbad4547272c50d667f3bc

SHA256
ab9cd7fb13144ad32c6f33bb0342d870a562bd3f4af0343dbdb381f84b8c1bfe

SHA512
89f4be125870327e950bad7df95b891bd3377ca8ea1848b30463a79018871f3e01d565a33eecc5a1ffadacc438a20f388a9542817a32fa6925932b836c6f6522

Download Submit
C:\Windows\system\pTdoSUT.exe

Filesize
2.1MB

MD5
85b85c6a8622c3d80e7e887a3057a202

SHA1
0863560f8c63e654bbda18b9109b5ce7426d2fc1

SHA256
59c6a563ec11bb7b8c391d0f110060181011c6e30b8fff2ef195ca8c456fe11d

SHA512
08eeff31825263a148a1eafa8ac59151d800cd2f6b02d8bac15b6fa00e14c27e77afa13be938e71ac8f6c70b2ab066a28026f75db0069eacb79130393d3334ce

Download Submit
C:\Windows\system\rBUYeIc.exe

Filesize
2.1MB

MD5
b5dcc3893ba558c313c7f1172b72aeef

SHA1
a276ef094c1d56ca411e5a58dfd14c3d989122d7

SHA256
b235843e133f32b21f1a90b16a511e3757e061f025c382702877cea03d2967a2

SHA512
4874f55603378d1400e80e59e4bdb2080eefb6e02261a88c4945f0acc256ab50f0d51129ab1efb358e61d6552b05c8a7bcf573f2cad5eeb792e0d913ab054a13

Download Submit
\Windows\system\DcwaVik.exe

Filesize
2.1MB

MD5
1735aff1138811d6c1b9d8aa4d1b7c4d

SHA1
cc3bed219b23c25e9b46b23ffa9593cf505939ad

SHA256
855bcedca8c4812b96453a1c13daac196a453c4d04c55205ba720cfa5b8fd4d2

SHA512
3eb8b6cddedb9be889265adcac4fbcf3ede80ef61d3a7806e5a90f1485087157b5cd9913c63e735de7e4ad79a0ec1a46ebf906cb0899c313a2a4a39391809b02

Download Submit
\Windows\system\ElzTLio.exe

Filesize
2.1MB

MD5
714d97a2ec1e878558540ce29b5e5723

SHA1
b13eefdedaa7a507479eb32805dbdeb93b71e89f

SHA256
3e8bdd201f5d2f4a2825118106c212d2fb4ea66f3bad61f7780d32b3a3cb397b

SHA512
fe70c2ff3481c0c62a4bdbb9e76e165df519d1fa039fc6e276caf2dabbdfdf43dca4596612c0b7b0e208a55e9ab36e32d2ad333b469435a3d02f68580334762a

Download Submit
\Windows\system\MXwgtCv.exe

Filesize
2.1MB

MD5
5a64ade6e611af65af98f301e4705aca

SHA1
5a9edd95bb61080969f39338c43391397f7dfde1

SHA256
e6428fdfd2f7c54d5c23f9b4e746815de2056e6064c9576d73681d63113cdd11

SHA512
534818c6359536c8ee5d5125bf889b71c96b97b943cea010c562e16b4c7d1c3ee03fdada51c82195f8d510fe729ea883ccf1cc26fc04dfc285d0efbb831834a4

Download Submit
\Windows\system\OXipUxJ.exe

Filesize
2.1MB

MD5
5fbd49830d934edb853002b295dfb20a

SHA1
55e8cfb6d4dbc78f777a2a39b21a7114f673fae3

SHA256
7aa5a1366be7c0582e799a730b62ebfaf309a5a0e627be1ab30b68c9a236578c

SHA512
a7f326cfe92f39690617f77dc96ea7ed81ed3605bc2ebf26d574d571356168a51a42f665a03e790d1053670354fdc035b3b27cdbed743bb711d24802b4c32db4

Download Submit
\Windows\system\OcwGWSK.exe

Filesize
2.1MB

MD5
15250d7af1ab920b0d1421094491a0c9

SHA1
127f7d4a09df18c8a63808da82a1675a773667e7

SHA256
03205ef08d68099d4c2100dabf0e34abc6224f120c21b499d3e3833c33fafff2

SHA512
36f27f1327db40779f8987fe05091ce5202107dcc22e7d067a5922c81edf2ffeb75c06e42ea771098c06b5e05612935eb9770ec8bafc1ca9881e04dea622ded0

Download Submit
\Windows\system\RMbnwHB.exe

Filesize
2.1MB

MD5
650f1648672c25a991c95aa5b596744d

SHA1
2e50fa2e97a0b8fec48d8e065b84b2c1db8f0f82

SHA256
6befb3faf314a65621541585a6537d6e5adcc9c0ef53f0e1979a6f9e7a415f31

SHA512
4d38aa2135dbac79f602abdb31de7f7467b8d31a54ae8429ee8dc65fa382522ec585bd5367c3572c5f3deb4fd7458411a219bba48771f73a083ad5c3d50f6709

Download Submit
\Windows\system\fElinTn.exe

Filesize
2.1MB

MD5
f61801ce6dd742d792c4a9367f88cbf2

SHA1
74802223131daf3943b962592bb13b889d3cb1e5

SHA256
5d204d9d36e6e111dba2b16431b88b3560ccb4a8fa6af86675cc2b67ab44602e

SHA512
a5283eeb5ccc44195ff562d9ef7ae6c52231e7ce06b327478dd9ad080246ab449b0ea06186ff5a59c0e31bb0b54ddc6d8cac4a5f4ba23a5ea23008793b87c41b

Download Submit
\Windows\system\fcNiMsS.exe

Filesize
2.1MB

MD5
10dc3a321d14106356a4fc41ee4b9151

SHA1
cedd0326714037d08b83e5a0b823b4d2179ea57b

SHA256
a6440cce53f41336366aa8d1563e8105777c510a62ff246757f92d49974bf506

SHA512
280e066929f4792b7a18c48939f463e89ed86ba36c0761befadf9f85a62b954f2c9a8ee908672ceb5f18a6aecf814abee64d9aa6d47dd15f479d7844eebf2e2e

Download Submit
\Windows\system\gOelbBf.exe

Filesize
2.1MB

MD5
eaef3de615db848cdecc4e418940b9f4

SHA1
c08164ecfe936fd17707d94e17c06dd5f2ef3545

SHA256
cb5af07322acff890d92510aa7b6913b1228614a6bb76227acdd8b9c25e760b3

SHA512
6eabe4f5b69fa5d6b514cfbb57d45080e035d8b9a9801d3907fc92988d0f5662e9a96a92781f84c2a293d92c5376f7d11a5fa41cdc42faeddf070ae9b6a65218

Download Submit
\Windows\system\gYLHiEc.exe

Filesize
2.1MB

MD5
84e587fed0b2c04c08e799d66cc51f07

SHA1
0fb28a632053a136c4626ed0088410c647c5d74c

SHA256
3b153c3c8d4e3bfff55512ec14db4a26d9c29a71106955a26889abe526872c1b

SHA512
bf6e5b856b662c0c53fe5869ba8b2fcae627d27c640b7bd17b2d60c7a5963d1662b0f3b1e3a7af569a637a71871579b7b334119d37744652a92fe50ecc28c086

Download Submit
\Windows\system\mDmCAyx.exe

Filesize
2.1MB

MD5
1e2ea4099d6d2a30c8b1cb4a3cab9606

SHA1
493bfed233bda44c3c135416d808854cf00cf62b

SHA256
49bb64ba4403e9f5248e8fb57a9de47825adf4625cd90a1c375e5305b6331860

SHA512
52af17cbe634aacd2a6192f8fafc4ac5a0f8b4c541eecf39eb59d6e8aac7fdd1db6a85f83e43b4903b9aaae0e8a7482eca7d089aed6ce3d1407b0f0e8b38206e

Download Submit
\Windows\system\pJYgJTn.exe

Filesize
2.1MB

MD5
107bfe76816319c564425356c7f1caae

SHA1
5541ace0fb1adcfc73b9bf85e11ce7db82a1d80a

SHA256
3f0a81468d562205111d10291d75ca14320e70b94749f59424acc4d40b8f9c58

SHA512
2e1b9dae4343b6d786b85102392653b48c171bd057175d9652660a761a8b64951533d3f3743947033049ad72545e03a7f8394740d5e39abd2dad0ce4f76d3de3

Download Submit
\Windows\system\xCQMhRq.exe

Filesize
2.1MB

MD5
c15f410f15018b3dbc8c3779216e3a9d

SHA1
30813c946507619337aa4fb515cdd28ddd76d046

SHA256
b8fee6ef98cae61c6bdc373c1824305b3eb24287be553eabae4f322446e840ed

SHA512
4c381999acbda41fff3e9c22f1e79a58b7838db2b24de822a29dbe5494253ecc1ebad420912ccf2f27e36c7e424bedb3f348134b9fe78c02c829ed8ed9cc1faf

Download Submit
memory/1412-95-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/1740-93-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/1740-6-0x0000000002CD0000-0x00000000030C2000-memory.dmp

Filesize
3.9MB

Download
memory/1740-16-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/1740-92-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/1740-24-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/1740-0-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/1740-46-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/1740-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1740-14-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/1740-94-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/1740-90-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/1740-88-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/1964-77-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2304-150-0x000000001B770000-0x000000001BA52000-memory.dmp

Filesize
2.9MB

Download
memory/2304-151-0x0000000001EC0000-0x0000000001EC8000-memory.dmp

Filesize
32KB

Download
memory/2348-91-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-51-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2572-89-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-47-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2676-18-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2776-42-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2832-55-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download