xmrig | a255cce6e1276a5fd066d675917a641db8f40b2f0abaa01fbe4d864b6725e5fd

Analysis

max time kernel
37s
max time network
37s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
Size

1.9MB
MD5

04671ca5646e3be595c34e8e2f62b027
SHA1

4b989aa5c0300bb2fc7dae73effdc637f5667ae7
SHA256

a255cce6e1276a5fd066d675917a641db8f40b2f0abaa01fbe4d864b6725e5fd
SHA512

4e8d7acfd9e6a5fac2f264835d3b06c8e9425bdeef23c5e5581273033304bcf200ee89c04094136fd1fb7974f17a1016fbcc6f68b44fb2a14570750b99b81258
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UX:NABQ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2644-13-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2588-87-0x000000013F640000-0x000000013FA32000-memory.dmp	xmrig
behavioral1/memory/2440-81-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2024-101-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2820-99-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/1888-97-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2428-95-0x000000013F730000-0x000000013FB22000-memory.dmp	xmrig
behavioral1/memory/2584-93-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/3068-78-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2644	CJHbnBl.exe
3068	DTBhpun.exe
2440	zTFmHMm.exe
2588	zpjPTkC.exe
2584	srUEotI.exe
2428	WXslMwP.exe
1888	dSuyMSG.exe
2820	OowVUlI.exe
2024	oMnpPPj.exe
2304	AQTnhkK.exe
1724	JSSTUhQ.exe
112	GoYrXXt.exe
2148	Gqkiasu.exe
108	IDuRqfR.exe
1652	vwbDAfq.exe
1748	qutLwBc.exe
1732	hkbzHam.exe
692	mGdyydk.exe
600	mJocEeM.exe
1608	jYNrcaV.exe
1276	QMCfyAY.exe
1248	dQestpu.exe
2112	ASpkLMe.exe
2356	gsqECvu.exe
1792	GuLmkQa.exe
1992	ORWySGX.exe
2708	LdFRRfk.exe
1568	STkYmyK.exe
860	wBBeiNd.exe
288	YWDyEmQ.exe
312	Hvvrtwj.exe
3032	UkpvqDy.exe
2368	UcWySCx.exe
1640	LdCnYWo.exe
1884	wKJawSt.exe
1716	xRNQjYY.exe
1328	HojtHLw.exe
1756	tbRdldU.exe
916	IUAmAqn.exe
2496	UDzHONq.exe
568	ZQxztuc.exe
696	lKDBQgC.exe
3016	JuftOhE.exe
1996	IsBGqaB.exe
1380	LJelXwz.exe
828	egdPpfa.exe
3000	cgqNIpk.exe
2068	qdRyTru.exe
1960	nripmQd.exe
1908	HUZUMXE.exe
1444	WeEgtcy.exe
896	yQEcsdN.exe
1964	PoyVPmT.exe
3056	allKZFT.exe
1512	sJNHZtx.exe
3004	oMVBivc.exe
2556	ULuOnRA.exe
2552	soLqdcJ.exe
2680	hAdBOnB.exe
2448	Fwakcrq.exe
292	apowiwu.exe
2824	PSZmgym.exe
2212	cseuCAp.exe
2488	arJswhZ.exe

Loads dropped DLL 64 IoCs

pid	Process
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2604-1-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/files/0x000b000000015d59-3.dat	upx
behavioral1/memory/2644-13-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/files/0x002f000000016122-18.dat	upx
behavioral1/files/0x0008000000016d81-44.dat	upx
behavioral1/files/0x0009000000016c38-41.dat	upx
behavioral1/files/0x0006000000016da9-52.dat	upx
behavioral1/files/0x0006000000016e56-56.dat	upx
behavioral1/files/0x0006000000016f7e-60.dat	upx
behavioral1/memory/2588-87-0x000000013F640000-0x000000013FA32000-memory.dmp	upx
behavioral1/files/0x00060000000173c5-115.dat	upx
behavioral1/files/0x00060000000173df-119.dat	upx
behavioral1/files/0x000600000001745d-130.dat	upx
behavioral1/files/0x0006000000017472-139.dat	upx
behavioral1/files/0x00050000000191fd-189.dat	upx
behavioral1/files/0x000500000001920f-186.dat	upx
behavioral1/files/0x00050000000191dc-180.dat	upx
behavioral1/files/0x0006000000017510-174.dat	upx
behavioral1/files/0x00060000000190bc-171.dat	upx
behavioral1/files/0x000500000001877f-164.dat	upx
behavioral1/files/0x000d00000001865b-155.dat	upx
behavioral1/files/0x000500000001921a-191.dat	upx
behavioral1/files/0x00050000000191d7-178.dat	upx
behavioral1/files/0x00060000000190b3-168.dat	upx
behavioral1/files/0x0005000000018674-161.dat	upx
behavioral1/files/0x000600000001864a-152.dat	upx
behavioral1/files/0x000600000001748d-144.dat	upx
behavioral1/files/0x002f0000000161ee-133.dat	upx
behavioral1/files/0x00060000000173e7-123.dat	upx
behavioral1/files/0x00060000000173dc-113.dat	upx
behavioral1/files/0x000600000001737e-82.dat	upx
behavioral1/memory/2440-81-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2024-101-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2820-99-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/1888-97-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2428-95-0x000000013F730000-0x000000013FB22000-memory.dmp	upx
behavioral1/memory/2584-93-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/files/0x000600000001738c-90.dat	upx
behavioral1/memory/3068-78-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/files/0x000600000001737b-64.dat	upx
behavioral1/files/0x0006000000016d85-48.dat	upx
behavioral1/files/0x000a000000016c30-37.dat	upx
behavioral1/files/0x0007000000016c1f-34.dat	upx
behavioral1/files/0x0008000000016a28-26.dat	upx
behavioral1/files/0x0016000000005586-24.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lhsGXhl.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\kgZaYnA.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\outHMOh.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\KtAjMSV.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\BTpXuQQ.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\wpvLssp.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\cBUwGbQ.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\eWJWWhF.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\pGuprBW.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\pAHbZbH.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\DRjmPCm.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\aOrprmh.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\LkPVEiC.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\vvUpsrD.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\CyPWiHa.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\VVCqrUL.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\vKiUEdK.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\clchLDZ.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\fGWItpU.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\bJbsIFV.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\vXLdNam.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\tqdhYIa.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\BVrxhjo.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\qFywmVM.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\pFNzqMR.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\PxxtNWX.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\BHsDTbg.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\gJBqswk.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\fSkyqrx.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\xZoKJVX.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\QhbDvtS.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\YwAfOgq.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\KSRfqVx.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\LcSYdDL.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\ByVFUHo.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\cZtISOh.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\bFAKZNV.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\IMFLVwd.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\tAUsNqf.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\RxSwsJq.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\ITeYSvl.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\COsCUEc.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\nvzLoUA.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\QKuCOdX.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\GydhfEZ.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\ZpuIXDZ.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\qKTNpEm.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\eWBraYT.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\gNzSvxL.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\CpmTYng.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\NOsTKkC.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\EjgPLcB.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\qkehWsG.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\BtorWDI.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\ljRUxWt.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\JLntJNv.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\dgqfQrX.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\lWmegsB.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\imYvoiI.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\ZcaqShK.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\JKTVmnk.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\hqYQqKd.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\xIMuOSb.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\fhdolRN.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2904	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
Token: SeDebugPrivilege	2904	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2904	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	29
PID 2604 wrote to memory of 2904	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	29
PID 2604 wrote to memory of 2904	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	29
PID 2604 wrote to memory of 2644	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	30
PID 2604 wrote to memory of 2644	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	30
PID 2604 wrote to memory of 2644	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	30
PID 2604 wrote to memory of 3068	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	31
PID 2604 wrote to memory of 3068	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	31
PID 2604 wrote to memory of 3068	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	31
PID 2604 wrote to memory of 2440	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	32
PID 2604 wrote to memory of 2440	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	32
PID 2604 wrote to memory of 2440	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	32
PID 2604 wrote to memory of 2588	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	33
PID 2604 wrote to memory of 2588	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	33
PID 2604 wrote to memory of 2588	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	33
PID 2604 wrote to memory of 2584	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	34
PID 2604 wrote to memory of 2584	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	34
PID 2604 wrote to memory of 2584	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	34
PID 2604 wrote to memory of 2428	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	35
PID 2604 wrote to memory of 2428	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	35
PID 2604 wrote to memory of 2428	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	35
PID 2604 wrote to memory of 1888	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	36
PID 2604 wrote to memory of 1888	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	36
PID 2604 wrote to memory of 1888	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	36
PID 2604 wrote to memory of 2820	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	37
PID 2604 wrote to memory of 2820	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	37
PID 2604 wrote to memory of 2820	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	37
PID 2604 wrote to memory of 2024	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	38
PID 2604 wrote to memory of 2024	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	38
PID 2604 wrote to memory of 2024	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	38
PID 2604 wrote to memory of 2304	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	39
PID 2604 wrote to memory of 2304	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	39
PID 2604 wrote to memory of 2304	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	39
PID 2604 wrote to memory of 1724	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	40
PID 2604 wrote to memory of 1724	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	40
PID 2604 wrote to memory of 1724	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	40
PID 2604 wrote to memory of 112	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	41
PID 2604 wrote to memory of 112	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	41
PID 2604 wrote to memory of 112	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	41
PID 2604 wrote to memory of 2148	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	42
PID 2604 wrote to memory of 2148	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	42
PID 2604 wrote to memory of 2148	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	42
PID 2604 wrote to memory of 1652	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	43
PID 2604 wrote to memory of 1652	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	43
PID 2604 wrote to memory of 1652	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	43
PID 2604 wrote to memory of 108	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	44
PID 2604 wrote to memory of 108	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	44
PID 2604 wrote to memory of 108	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	44
PID 2604 wrote to memory of 1732	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	45
PID 2604 wrote to memory of 1732	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	45
PID 2604 wrote to memory of 1732	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	45
PID 2604 wrote to memory of 1748	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	46
PID 2604 wrote to memory of 1748	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	46
PID 2604 wrote to memory of 1748	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	46
PID 2604 wrote to memory of 692	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	47
PID 2604 wrote to memory of 692	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	47
PID 2604 wrote to memory of 692	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	47
PID 2604 wrote to memory of 600	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	48
PID 2604 wrote to memory of 600	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	48
PID 2604 wrote to memory of 600	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	48
PID 2604 wrote to memory of 1608	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	49
PID 2604 wrote to memory of 1608	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	49
PID 2604 wrote to memory of 1608	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	49
PID 2604 wrote to memory of 1276	2604	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- C:\Windows\System\CJHbnBl.exe
  C:\Windows\System\CJHbnBl.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\DTBhpun.exe
  C:\Windows\System\DTBhpun.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\zTFmHMm.exe
  C:\Windows\System\zTFmHMm.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\zpjPTkC.exe
  C:\Windows\System\zpjPTkC.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\srUEotI.exe
  C:\Windows\System\srUEotI.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\WXslMwP.exe
  C:\Windows\System\WXslMwP.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\dSuyMSG.exe
  C:\Windows\System\dSuyMSG.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\OowVUlI.exe
  C:\Windows\System\OowVUlI.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\oMnpPPj.exe
  C:\Windows\System\oMnpPPj.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\AQTnhkK.exe
  C:\Windows\System\AQTnhkK.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\JSSTUhQ.exe
  C:\Windows\System\JSSTUhQ.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\GoYrXXt.exe
  C:\Windows\System\GoYrXXt.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\Gqkiasu.exe
  C:\Windows\System\Gqkiasu.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\vwbDAfq.exe
  C:\Windows\System\vwbDAfq.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\IDuRqfR.exe
  C:\Windows\System\IDuRqfR.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\hkbzHam.exe
  C:\Windows\System\hkbzHam.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\qutLwBc.exe
  C:\Windows\System\qutLwBc.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\mGdyydk.exe
  C:\Windows\System\mGdyydk.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\mJocEeM.exe
  C:\Windows\System\mJocEeM.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\jYNrcaV.exe
  C:\Windows\System\jYNrcaV.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\QMCfyAY.exe
  C:\Windows\System\QMCfyAY.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\dQestpu.exe
  C:\Windows\System\dQestpu.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\ASpkLMe.exe
  C:\Windows\System\ASpkLMe.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\LdFRRfk.exe
  C:\Windows\System\LdFRRfk.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\gsqECvu.exe
  C:\Windows\System\gsqECvu.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\UkpvqDy.exe
  C:\Windows\System\UkpvqDy.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\GuLmkQa.exe
  C:\Windows\System\GuLmkQa.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\UcWySCx.exe
  C:\Windows\System\UcWySCx.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\ORWySGX.exe
  C:\Windows\System\ORWySGX.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\LdCnYWo.exe
  C:\Windows\System\LdCnYWo.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\STkYmyK.exe
  C:\Windows\System\STkYmyK.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\wKJawSt.exe
  C:\Windows\System\wKJawSt.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\wBBeiNd.exe
  C:\Windows\System\wBBeiNd.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\xRNQjYY.exe
  C:\Windows\System\xRNQjYY.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\YWDyEmQ.exe
  C:\Windows\System\YWDyEmQ.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\HojtHLw.exe
  C:\Windows\System\HojtHLw.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\Hvvrtwj.exe
  C:\Windows\System\Hvvrtwj.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\tbRdldU.exe
  C:\Windows\System\tbRdldU.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\IUAmAqn.exe
  C:\Windows\System\IUAmAqn.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\UDzHONq.exe
  C:\Windows\System\UDzHONq.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\ZQxztuc.exe
  C:\Windows\System\ZQxztuc.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\lKDBQgC.exe
  C:\Windows\System\lKDBQgC.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\JuftOhE.exe
  C:\Windows\System\JuftOhE.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\IsBGqaB.exe
  C:\Windows\System\IsBGqaB.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\LJelXwz.exe
  C:\Windows\System\LJelXwz.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\egdPpfa.exe
  C:\Windows\System\egdPpfa.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\cgqNIpk.exe
  C:\Windows\System\cgqNIpk.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\qdRyTru.exe
  C:\Windows\System\qdRyTru.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\nripmQd.exe
  C:\Windows\System\nripmQd.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\HUZUMXE.exe
  C:\Windows\System\HUZUMXE.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\WeEgtcy.exe
  C:\Windows\System\WeEgtcy.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\yQEcsdN.exe
  C:\Windows\System\yQEcsdN.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\PoyVPmT.exe
  C:\Windows\System\PoyVPmT.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\allKZFT.exe
  C:\Windows\System\allKZFT.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\sJNHZtx.exe
  C:\Windows\System\sJNHZtx.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\oMVBivc.exe
  C:\Windows\System\oMVBivc.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\ULuOnRA.exe
  C:\Windows\System\ULuOnRA.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\soLqdcJ.exe
  C:\Windows\System\soLqdcJ.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\hAdBOnB.exe
  C:\Windows\System\hAdBOnB.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\Fwakcrq.exe
  C:\Windows\System\Fwakcrq.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\apowiwu.exe
  C:\Windows\System\apowiwu.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\PSZmgym.exe
  C:\Windows\System\PSZmgym.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\cseuCAp.exe
  C:\Windows\System\cseuCAp.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\arJswhZ.exe
  C:\Windows\System\arJswhZ.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\RgpiLdk.exe
  C:\Windows\System\RgpiLdk.exe
  2⤵
  PID:1544
- C:\Windows\System\mwPHVFr.exe
  C:\Windows\System\mwPHVFr.exe
  2⤵
  PID:320
- C:\Windows\System\jPYipEd.exe
  C:\Windows\System\jPYipEd.exe
  2⤵
  PID:1612
- C:\Windows\System\KpwYeGY.exe
  C:\Windows\System\KpwYeGY.exe
  2⤵
  PID:300
- C:\Windows\System\bLqsHdH.exe
  C:\Windows\System\bLqsHdH.exe
  2⤵
  PID:2380
- C:\Windows\System\GacxRGL.exe
  C:\Windows\System\GacxRGL.exe
  2⤵
  PID:1616
- C:\Windows\System\vonjjeo.exe
  C:\Windows\System\vonjjeo.exe
  2⤵
  PID:1864
- C:\Windows\System\itFNlsQ.exe
  C:\Windows\System\itFNlsQ.exe
  2⤵
  PID:2344
- C:\Windows\System\toBtWLQ.exe
  C:\Windows\System\toBtWLQ.exe
  2⤵
  PID:948
- C:\Windows\System\hOPbUba.exe
  C:\Windows\System\hOPbUba.exe
  2⤵
  PID:1372
- C:\Windows\System\VKJduwZ.exe
  C:\Windows\System\VKJduwZ.exe
  2⤵
  PID:2308
- C:\Windows\System\oyCoyJO.exe
  C:\Windows\System\oyCoyJO.exe
  2⤵
  PID:2760
- C:\Windows\System\fGFyAOy.exe
  C:\Windows\System\fGFyAOy.exe
  2⤵
  PID:1216
- C:\Windows\System\gnOiXNn.exe
  C:\Windows\System\gnOiXNn.exe
  2⤵
  PID:2864
- C:\Windows\System\PxxtNWX.exe
  C:\Windows\System\PxxtNWX.exe
  2⤵
  PID:2200
- C:\Windows\System\yQqmnLW.exe
  C:\Windows\System\yQqmnLW.exe
  2⤵
  PID:1476
- C:\Windows\System\AcxgALm.exe
  C:\Windows\System\AcxgALm.exe
  2⤵
  PID:2324
- C:\Windows\System\RVBIKRf.exe
  C:\Windows\System\RVBIKRf.exe
  2⤵
  PID:2696
- C:\Windows\System\vtvqXgQ.exe
  C:\Windows\System\vtvqXgQ.exe
  2⤵
  PID:1912
- C:\Windows\System\CpmTYng.exe
  C:\Windows\System\CpmTYng.exe
  2⤵
  PID:1308
- C:\Windows\System\dGBuEbh.exe
  C:\Windows\System\dGBuEbh.exe
  2⤵
  PID:1076
- C:\Windows\System\krEOCts.exe
  C:\Windows\System\krEOCts.exe
  2⤵
  PID:2776
- C:\Windows\System\uQyIyrX.exe
  C:\Windows\System\uQyIyrX.exe
  2⤵
  PID:3052
- C:\Windows\System\eYdluqT.exe
  C:\Windows\System\eYdluqT.exe
  2⤵
  PID:2772
- C:\Windows\System\tUPjZSj.exe
  C:\Windows\System\tUPjZSj.exe
  2⤵
  PID:2756
- C:\Windows\System\OEhbSfi.exe
  C:\Windows\System\OEhbSfi.exe
  2⤵
  PID:1712
- C:\Windows\System\XVBojBj.exe
  C:\Windows\System\XVBojBj.exe
  2⤵
  PID:2592
- C:\Windows\System\iSMpWuS.exe
  C:\Windows\System\iSMpWuS.exe
  2⤵
  PID:2360
- C:\Windows\System\rnNjocS.exe
  C:\Windows\System\rnNjocS.exe
  2⤵
  PID:1484
- C:\Windows\System\dtQFAGh.exe
  C:\Windows\System\dtQFAGh.exe
  2⤵
  PID:1016
- C:\Windows\System\snxJZPO.exe
  C:\Windows\System\snxJZPO.exe
  2⤵
  PID:1556
- C:\Windows\System\cDmUimz.exe
  C:\Windows\System\cDmUimz.exe
  2⤵
  PID:2784
- C:\Windows\System\fRFXXqs.exe
  C:\Windows\System\fRFXXqs.exe
  2⤵
  PID:2160
- C:\Windows\System\iUqsxCM.exe
  C:\Windows\System\iUqsxCM.exe
  2⤵
  PID:2236
- C:\Windows\System\FQBlQVj.exe
  C:\Windows\System\FQBlQVj.exe
  2⤵
  PID:1936
- C:\Windows\System\iMSXUaR.exe
  C:\Windows\System\iMSXUaR.exe
  2⤵
  PID:2492
- C:\Windows\System\BjlHHwY.exe
  C:\Windows\System\BjlHHwY.exe
  2⤵
  PID:1440
- C:\Windows\System\pTzuQYv.exe
  C:\Windows\System\pTzuQYv.exe
  2⤵
  PID:2808
- C:\Windows\System\EEVDOOp.exe
  C:\Windows\System\EEVDOOp.exe
  2⤵
  PID:1532
- C:\Windows\System\YuIVlrG.exe
  C:\Windows\System\YuIVlrG.exe
  2⤵
  PID:2568
- C:\Windows\System\UzjamiP.exe
  C:\Windows\System\UzjamiP.exe
  2⤵
  PID:2424
- C:\Windows\System\CMUFbfw.exe
  C:\Windows\System\CMUFbfw.exe
  2⤵
  PID:2468
- C:\Windows\System\gubrXxn.exe
  C:\Windows\System\gubrXxn.exe
  2⤵
  PID:1692
- C:\Windows\System\cokyAPv.exe
  C:\Windows\System\cokyAPv.exe
  2⤵
  PID:2648
- C:\Windows\System\WGZvHpD.exe
  C:\Windows\System\WGZvHpD.exe
  2⤵
  PID:1620
- C:\Windows\System\NisWIQs.exe
  C:\Windows\System\NisWIQs.exe
  2⤵
  PID:1604
- C:\Windows\System\uSnCYqh.exe
  C:\Windows\System\uSnCYqh.exe
  2⤵
  PID:1524
- C:\Windows\System\SpdmiAo.exe
  C:\Windows\System\SpdmiAo.exe
  2⤵
  PID:868
- C:\Windows\System\NOsTKkC.exe
  C:\Windows\System\NOsTKkC.exe
  2⤵
  PID:2656
- C:\Windows\System\jtdsBhT.exe
  C:\Windows\System\jtdsBhT.exe
  2⤵
  PID:2768
- C:\Windows\System\ZvPRvpP.exe
  C:\Windows\System\ZvPRvpP.exe
  2⤵
  PID:2828
- C:\Windows\System\SSLNZkq.exe
  C:\Windows\System\SSLNZkq.exe
  2⤵
  PID:2328
- C:\Windows\System\LdbEhFO.exe
  C:\Windows\System\LdbEhFO.exe
  2⤵
  PID:2032
- C:\Windows\System\ZpuIXDZ.exe
  C:\Windows\System\ZpuIXDZ.exe
  2⤵
  PID:1696
- C:\Windows\System\sKxyuEX.exe
  C:\Windows\System\sKxyuEX.exe
  2⤵
  PID:604
- C:\Windows\System\TJEbdhA.exe
  C:\Windows\System\TJEbdhA.exe
  2⤵
  PID:2744
- C:\Windows\System\buPDNDO.exe
  C:\Windows\System\buPDNDO.exe
  2⤵
  PID:3036
- C:\Windows\System\eIYnhZM.exe
  C:\Windows\System\eIYnhZM.exe
  2⤵
  PID:560
- C:\Windows\System\UHsQMQk.exe
  C:\Windows\System\UHsQMQk.exe
  2⤵
  PID:1040
- C:\Windows\System\BHsDTbg.exe
  C:\Windows\System\BHsDTbg.exe
  2⤵
  PID:2172
- C:\Windows\System\EriGOeK.exe
  C:\Windows\System\EriGOeK.exe
  2⤵
  PID:1220
- C:\Windows\System\DlbbWSc.exe
  C:\Windows\System\DlbbWSc.exe
  2⤵
  PID:1584
- C:\Windows\System\lhdZOLw.exe
  C:\Windows\System\lhdZOLw.exe
  2⤵
  PID:2800
- C:\Windows\System\QbfbmVa.exe
  C:\Windows\System\QbfbmVa.exe
  2⤵
  PID:2932
- C:\Windows\System\QkDANwl.exe
  C:\Windows\System\QkDANwl.exe
  2⤵
  PID:2676
- C:\Windows\System\Hgjxler.exe
  C:\Windows\System\Hgjxler.exe
  2⤵
  PID:1916
- C:\Windows\System\hKFeKhY.exe
  C:\Windows\System\hKFeKhY.exe
  2⤵
  PID:2504
- C:\Windows\System\UKiePis.exe
  C:\Windows\System\UKiePis.exe
  2⤵
  PID:556
- C:\Windows\System\IWWoqCj.exe
  C:\Windows\System\IWWoqCj.exe
  2⤵
  PID:1456
- C:\Windows\System\eCEnRTZ.exe
  C:\Windows\System\eCEnRTZ.exe
  2⤵
  PID:1980
- C:\Windows\System\tPkufak.exe
  C:\Windows\System\tPkufak.exe
  2⤵
  PID:2464
- C:\Windows\System\fmFCqAw.exe
  C:\Windows\System\fmFCqAw.exe
  2⤵
  PID:2176
- C:\Windows\System\qqvwSfs.exe
  C:\Windows\System\qqvwSfs.exe
  2⤵
  PID:2272
- C:\Windows\System\FbxbusO.exe
  C:\Windows\System\FbxbusO.exe
  2⤵
  PID:2576
- C:\Windows\System\TSyDLoT.exe
  C:\Windows\System\TSyDLoT.exe
  2⤵
  PID:640
- C:\Windows\System\mkhPftO.exe
  C:\Windows\System\mkhPftO.exe
  2⤵
  PID:1548
- C:\Windows\System\rgjXWKm.exe
  C:\Windows\System\rgjXWKm.exe
  2⤵
  PID:1672
- C:\Windows\System\NspTgGz.exe
  C:\Windows\System\NspTgGz.exe
  2⤵
  PID:2336
- C:\Windows\System\lHwqGgT.exe
  C:\Windows\System\lHwqGgT.exe
  2⤵
  PID:2004
- C:\Windows\System\lnXNmNW.exe
  C:\Windows\System\lnXNmNW.exe
  2⤵
  PID:2364
- C:\Windows\System\mrmTVLi.exe
  C:\Windows\System\mrmTVLi.exe
  2⤵
  PID:984
- C:\Windows\System\JbESGer.exe
  C:\Windows\System\JbESGer.exe
  2⤵
  PID:2416
- C:\Windows\System\nIWZnPx.exe
  C:\Windows\System\nIWZnPx.exe
  2⤵
  PID:1572
- C:\Windows\System\pczmDwN.exe
  C:\Windows\System\pczmDwN.exe
  2⤵
  PID:2164
- C:\Windows\System\ECXJaMn.exe
  C:\Windows\System\ECXJaMn.exe
  2⤵
  PID:2672
- C:\Windows\System\emTxtbN.exe
  C:\Windows\System\emTxtbN.exe
  2⤵
  PID:1464
- C:\Windows\System\sXnSreu.exe
  C:\Windows\System\sXnSreu.exe
  2⤵
  PID:2376
- C:\Windows\System\OSIdTPr.exe
  C:\Windows\System\OSIdTPr.exe
  2⤵
  PID:2408
- C:\Windows\System\GCgDGsW.exe
  C:\Windows\System\GCgDGsW.exe
  2⤵
  PID:2192
- C:\Windows\System\aAjQmdD.exe
  C:\Windows\System\aAjQmdD.exe
  2⤵
  PID:2560
- C:\Windows\System\NuGTdbg.exe
  C:\Windows\System\NuGTdbg.exe
  2⤵
  PID:2704
- C:\Windows\System\csuSHmN.exe
  C:\Windows\System\csuSHmN.exe
  2⤵
  PID:1580
- C:\Windows\System\qzePSou.exe
  C:\Windows\System\qzePSou.exe
  2⤵
  PID:776
- C:\Windows\System\NerVNWQ.exe
  C:\Windows\System\NerVNWQ.exe
  2⤵
  PID:1704
- C:\Windows\System\thXdNPA.exe
  C:\Windows\System\thXdNPA.exe
  2⤵
  PID:1292
- C:\Windows\System\daVjMnp.exe
  C:\Windows\System\daVjMnp.exe
  2⤵
  PID:2332
- C:\Windows\System\SBmxlnt.exe
  C:\Windows\System\SBmxlnt.exe
  2⤵
  PID:2712
- C:\Windows\System\oKKAPhU.exe
  C:\Windows\System\oKKAPhU.exe
  2⤵
  PID:448
- C:\Windows\System\LsGrDsX.exe
  C:\Windows\System\LsGrDsX.exe
  2⤵
  PID:1448
- C:\Windows\System\cKCHZgl.exe
  C:\Windows\System\cKCHZgl.exe
  2⤵
  PID:2444
- C:\Windows\System\UKfryOW.exe
  C:\Windows\System\UKfryOW.exe
  2⤵
  PID:2080
- C:\Windows\System\gkCJUjd.exe
  C:\Windows\System\gkCJUjd.exe
  2⤵
  PID:2180
- C:\Windows\System\AijhFVP.exe
  C:\Windows\System\AijhFVP.exe
  2⤵
  PID:2316
- C:\Windows\System\GcrXMqL.exe
  C:\Windows\System\GcrXMqL.exe
  2⤵
  PID:2936
- C:\Windows\System\PXBrFlg.exe
  C:\Windows\System\PXBrFlg.exe
  2⤵
  PID:1412
- C:\Windows\System\McUcxMn.exe
  C:\Windows\System\McUcxMn.exe
  2⤵
  PID:2608
- C:\Windows\System\kJJBZCT.exe
  C:\Windows\System\kJJBZCT.exe
  2⤵
  PID:1128
- C:\Windows\System\sRbkgnx.exe
  C:\Windows\System\sRbkgnx.exe
  2⤵
  PID:1984
- C:\Windows\System\GjTBHaU.exe
  C:\Windows\System\GjTBHaU.exe
  2⤵
  PID:3088
- C:\Windows\System\AJAKzZR.exe
  C:\Windows\System\AJAKzZR.exe
  2⤵
  PID:3104
- C:\Windows\System\kdpBRpg.exe
  C:\Windows\System\kdpBRpg.exe
  2⤵
  PID:3120
- C:\Windows\System\IDcller.exe
  C:\Windows\System\IDcller.exe
  2⤵
  PID:3136
- C:\Windows\System\LpXXQCe.exe
  C:\Windows\System\LpXXQCe.exe
  2⤵
  PID:3152
- C:\Windows\System\sIjsrQf.exe
  C:\Windows\System\sIjsrQf.exe
  2⤵
  PID:3168
- C:\Windows\System\BjMhrXY.exe
  C:\Windows\System\BjMhrXY.exe
  2⤵
  PID:3188
- C:\Windows\System\UNzlZOz.exe
  C:\Windows\System\UNzlZOz.exe
  2⤵
  PID:3204
- C:\Windows\System\wlOzaKC.exe
  C:\Windows\System\wlOzaKC.exe
  2⤵
  PID:3220
- C:\Windows\System\sZvZfnN.exe
  C:\Windows\System\sZvZfnN.exe
  2⤵
  PID:3236
- C:\Windows\System\noiDmJw.exe
  C:\Windows\System\noiDmJw.exe
  2⤵
  PID:3252
- C:\Windows\System\gJBqswk.exe
  C:\Windows\System\gJBqswk.exe
  2⤵
  PID:3268
- C:\Windows\System\KntrkFb.exe
  C:\Windows\System\KntrkFb.exe
  2⤵
  PID:3288
- C:\Windows\System\AIvIoff.exe
  C:\Windows\System\AIvIoff.exe
  2⤵
  PID:3304
- C:\Windows\System\BgOLSaM.exe
  C:\Windows\System\BgOLSaM.exe
  2⤵
  PID:3320
- C:\Windows\System\VYqDLGp.exe
  C:\Windows\System\VYqDLGp.exe
  2⤵
  PID:3340
- C:\Windows\System\kFypGkq.exe
  C:\Windows\System\kFypGkq.exe
  2⤵
  PID:3356
- C:\Windows\System\ZgaeytV.exe
  C:\Windows\System\ZgaeytV.exe
  2⤵
  PID:3372
- C:\Windows\System\CXpBfge.exe
  C:\Windows\System\CXpBfge.exe
  2⤵
  PID:3388
- C:\Windows\System\kGzBwfa.exe
  C:\Windows\System\kGzBwfa.exe
  2⤵
  PID:3404
- C:\Windows\System\CluUcyq.exe
  C:\Windows\System\CluUcyq.exe
  2⤵
  PID:3424
- C:\Windows\System\WUnfgvA.exe
  C:\Windows\System\WUnfgvA.exe
  2⤵
  PID:3440
- C:\Windows\System\oYJnCHo.exe
  C:\Windows\System\oYJnCHo.exe
  2⤵
  PID:3456
- C:\Windows\System\hNQXqCz.exe
  C:\Windows\System\hNQXqCz.exe
  2⤵
  PID:3472
- C:\Windows\System\pRBsgoX.exe
  C:\Windows\System\pRBsgoX.exe
  2⤵
  PID:3488
- C:\Windows\System\JAlvCXT.exe
  C:\Windows\System\JAlvCXT.exe
  2⤵
  PID:3504
- C:\Windows\System\bDXMBUC.exe
  C:\Windows\System\bDXMBUC.exe
  2⤵
  PID:3524
- C:\Windows\System\lhsGXhl.exe
  C:\Windows\System\lhsGXhl.exe
  2⤵
  PID:3540
- C:\Windows\System\vcdgspa.exe
  C:\Windows\System\vcdgspa.exe
  2⤵
  PID:3560
- C:\Windows\System\WjOGcpE.exe
  C:\Windows\System\WjOGcpE.exe
  2⤵
  PID:3580
- C:\Windows\System\DQxtweh.exe
  C:\Windows\System\DQxtweh.exe
  2⤵
  PID:3596
- C:\Windows\System\PLVwWJI.exe
  C:\Windows\System\PLVwWJI.exe
  2⤵
  PID:3612
- C:\Windows\System\cqZTXqz.exe
  C:\Windows\System\cqZTXqz.exe
  2⤵
  PID:3628
- C:\Windows\System\KSRfqVx.exe
  C:\Windows\System\KSRfqVx.exe
  2⤵
  PID:3644
- C:\Windows\System\nWcqxFS.exe
  C:\Windows\System\nWcqxFS.exe
  2⤵
  PID:3804
- C:\Windows\System\aNLFJor.exe
  C:\Windows\System\aNLFJor.exe
  2⤵
  PID:3824
- C:\Windows\System\vkvZsnZ.exe
  C:\Windows\System\vkvZsnZ.exe
  2⤵
  PID:3844
- C:\Windows\System\LcSYdDL.exe
  C:\Windows\System\LcSYdDL.exe
  2⤵
  PID:3872
- C:\Windows\System\PiODBYq.exe
  C:\Windows\System\PiODBYq.exe
  2⤵
  PID:3888
- C:\Windows\System\EPKOnXY.exe
  C:\Windows\System\EPKOnXY.exe
  2⤵
  PID:3904
- C:\Windows\System\ANTcHJB.exe
  C:\Windows\System\ANTcHJB.exe
  2⤵
  PID:3920
- C:\Windows\System\ZjOrGZx.exe
  C:\Windows\System\ZjOrGZx.exe
  2⤵
  PID:3936
- C:\Windows\System\FwAqBfY.exe
  C:\Windows\System\FwAqBfY.exe
  2⤵
  PID:3952
- C:\Windows\System\QYpNgEr.exe
  C:\Windows\System\QYpNgEr.exe
  2⤵
  PID:3968
- C:\Windows\System\KRGqgqM.exe
  C:\Windows\System\KRGqgqM.exe
  2⤵
  PID:3984
- C:\Windows\System\kjoBUDw.exe
  C:\Windows\System\kjoBUDw.exe
  2⤵
  PID:4000
- C:\Windows\System\dQVuXZy.exe
  C:\Windows\System\dQVuXZy.exe
  2⤵
  PID:4020
- C:\Windows\System\VQASSUT.exe
  C:\Windows\System\VQASSUT.exe
  2⤵
  PID:4036
- C:\Windows\System\CiynDtS.exe
  C:\Windows\System\CiynDtS.exe
  2⤵
  PID:4052
- C:\Windows\System\mAyrMwi.exe
  C:\Windows\System\mAyrMwi.exe
  2⤵
  PID:4068
- C:\Windows\System\dQVarqW.exe
  C:\Windows\System\dQVarqW.exe
  2⤵
  PID:4084
- C:\Windows\System\ItyhGJN.exe
  C:\Windows\System\ItyhGJN.exe
  2⤵
  PID:1688
- C:\Windows\System\APjiKGA.exe
  C:\Windows\System\APjiKGA.exe
  2⤵
  PID:576
- C:\Windows\System\TDdAMhi.exe
  C:\Windows\System\TDdAMhi.exe
  2⤵
  PID:788
- C:\Windows\System\AIVyRxY.exe
  C:\Windows\System\AIVyRxY.exe
  2⤵
  PID:3084
- C:\Windows\System\RlbptBL.exe
  C:\Windows\System\RlbptBL.exe
  2⤵
  PID:3148
- C:\Windows\System\JkHHEkJ.exe
  C:\Windows\System\JkHHEkJ.exe
  2⤵
  PID:3216
- C:\Windows\System\LeZuuUW.exe
  C:\Windows\System\LeZuuUW.exe
  2⤵
  PID:3284
- C:\Windows\System\DhqmCzK.exe
  C:\Windows\System\DhqmCzK.exe
  2⤵
  PID:3380
- C:\Windows\System\BhsCSSY.exe
  C:\Windows\System\BhsCSSY.exe
  2⤵
  PID:3448
- C:\Windows\System\SJEqSXn.exe
  C:\Windows\System\SJEqSXn.exe
  2⤵
  PID:2420
- C:\Windows\System\cczELKH.exe
  C:\Windows\System\cczELKH.exe
  2⤵
  PID:3332
- C:\Windows\System\uLiDVIj.exe
  C:\Windows\System\uLiDVIj.exe
  2⤵
  PID:3096
- C:\Windows\System\LbDQRjk.exe
  C:\Windows\System\LbDQRjk.exe
  2⤵
  PID:3484
- C:\Windows\System\smAwyNN.exe
  C:\Windows\System\smAwyNN.exe
  2⤵
  PID:3160
- C:\Windows\System\qWAhZQo.exe
  C:\Windows\System\qWAhZQo.exe
  2⤵
  PID:3232
- C:\Windows\System\NhrqUoC.exe
  C:\Windows\System\NhrqUoC.exe
  2⤵
  PID:3336
- C:\Windows\System\HAtVkBC.exe
  C:\Windows\System\HAtVkBC.exe
  2⤵
  PID:3432
- C:\Windows\System\AbylYHk.exe
  C:\Windows\System\AbylYHk.exe
  2⤵
  PID:3536
- C:\Windows\System\XLVcoIX.exe
  C:\Windows\System\XLVcoIX.exe
  2⤵
  PID:3576
- C:\Windows\System\SDsCMOB.exe
  C:\Windows\System\SDsCMOB.exe
  2⤵
  PID:3640
- C:\Windows\System\fSkyqrx.exe
  C:\Windows\System\fSkyqrx.exe
  2⤵
  PID:3184
- C:\Windows\System\vjsGDUz.exe
  C:\Windows\System\vjsGDUz.exe
  2⤵
  PID:3588
- C:\Windows\System\imYvoiI.exe
  C:\Windows\System\imYvoiI.exe
  2⤵
  PID:3660
- C:\Windows\System\vzEuDKY.exe
  C:\Windows\System\vzEuDKY.exe
  2⤵
  PID:3776
- C:\Windows\System\PgyMKoU.exe
  C:\Windows\System\PgyMKoU.exe
  2⤵
  PID:3856
- C:\Windows\System\gwHVVKy.exe
  C:\Windows\System\gwHVVKy.exe
  2⤵
  PID:3880
- C:\Windows\System\Neldzmr.exe
  C:\Windows\System\Neldzmr.exe
  2⤵
  PID:3944
- C:\Windows\System\kdmuglY.exe
  C:\Windows\System\kdmuglY.exe
  2⤵
  PID:3980
- C:\Windows\System\YLNOdgI.exe
  C:\Windows\System\YLNOdgI.exe
  2⤵
  PID:4044
- C:\Windows\System\VaiLRDm.exe
  C:\Windows\System\VaiLRDm.exe
  2⤵
  PID:4076
- C:\Windows\System\vJyAwHE.exe
  C:\Windows\System\vJyAwHE.exe
  2⤵
  PID:2260
- C:\Windows\System\KvuolhD.exe
  C:\Windows\System\KvuolhD.exe
  2⤵
  PID:3212
- C:\Windows\System\GIOwCec.exe
  C:\Windows\System\GIOwCec.exe
  2⤵
  PID:3568
- C:\Windows\System\IzKlZjs.exe
  C:\Windows\System\IzKlZjs.exe
  2⤵
  PID:3128
- C:\Windows\System\mKkNXeu.exe
  C:\Windows\System\mKkNXeu.exe
  2⤵
  PID:4064
- C:\Windows\System\plrQrSJ.exe
  C:\Windows\System\plrQrSJ.exe
  2⤵
  PID:3400
- C:\Windows\System\HsjeSwN.exe
  C:\Windows\System\HsjeSwN.exe
  2⤵
  PID:3624
- C:\Windows\System\NTeEtbk.exe
  C:\Windows\System\NTeEtbk.exe
  2⤵
  PID:3328
- C:\Windows\System\ouPVRii.exe
  C:\Windows\System\ouPVRii.exe
  2⤵
  PID:3416
- C:\Windows\System\MkmzQKb.exe
  C:\Windows\System\MkmzQKb.exe
  2⤵
  PID:3248
- C:\Windows\System\qkhGXYf.exe
  C:\Windows\System\qkhGXYf.exe
  2⤵
  PID:3228
- C:\Windows\System\rUpewbH.exe
  C:\Windows\System\rUpewbH.exe
  2⤵
  PID:3296
- C:\Windows\System\pOuaaDW.exe
  C:\Windows\System\pOuaaDW.exe
  2⤵
  PID:3724
- C:\Windows\System\ctTnpMP.exe
  C:\Windows\System\ctTnpMP.exe
  2⤵
  PID:3740
- C:\Windows\System\AnxXucl.exe
  C:\Windows\System\AnxXucl.exe
  2⤵
  PID:3532
- C:\Windows\System\iHlgEAd.exe
  C:\Windows\System\iHlgEAd.exe
  2⤵
  PID:3516
- C:\Windows\System\alipLAm.exe
  C:\Windows\System\alipLAm.exe
  2⤵
  PID:3668
- C:\Windows\System\kDNBVGr.exe
  C:\Windows\System\kDNBVGr.exe
  2⤵
  PID:3680
- C:\Windows\System\AqNgnsd.exe
  C:\Windows\System\AqNgnsd.exe
  2⤵
  PID:3756
- C:\Windows\System\ABkAwqH.exe
  C:\Windows\System\ABkAwqH.exe
  2⤵
  PID:3704
- C:\Windows\System\PFHeIio.exe
  C:\Windows\System\PFHeIio.exe
  2⤵
  PID:3768
- C:\Windows\System\eThmYhI.exe
  C:\Windows\System\eThmYhI.exe
  2⤵
  PID:3664
- C:\Windows\System\ikZFFxW.exe
  C:\Windows\System\ikZFFxW.exe
  2⤵
  PID:3836
- C:\Windows\System\ygHoTMc.exe
  C:\Windows\System\ygHoTMc.exe
  2⤵
  PID:3916
- C:\Windows\System\PlabcWk.exe
  C:\Windows\System\PlabcWk.exe
  2⤵
  PID:4112
- C:\Windows\System\mRmgxcp.exe
  C:\Windows\System\mRmgxcp.exe
  2⤵
  PID:4128
- C:\Windows\System\kgZaYnA.exe
  C:\Windows\System\kgZaYnA.exe
  2⤵
  PID:4144
- C:\Windows\System\uRULMqR.exe
  C:\Windows\System\uRULMqR.exe
  2⤵
  PID:4160
- C:\Windows\System\jtcinHm.exe
  C:\Windows\System\jtcinHm.exe
  2⤵
  PID:4180
- C:\Windows\System\iAbxtBp.exe
  C:\Windows\System\iAbxtBp.exe
  2⤵
  PID:4196
- C:\Windows\System\axwnfCI.exe
  C:\Windows\System\axwnfCI.exe
  2⤵
  PID:4212
- C:\Windows\System\khxEkHH.exe
  C:\Windows\System\khxEkHH.exe
  2⤵
  PID:4228
- C:\Windows\System\uvlvRKq.exe
  C:\Windows\System\uvlvRKq.exe
  2⤵
  PID:4248
- C:\Windows\System\hUMaiQW.exe
  C:\Windows\System\hUMaiQW.exe
  2⤵
  PID:4264
- C:\Windows\System\dLLwEIM.exe
  C:\Windows\System\dLLwEIM.exe
  2⤵
  PID:4280
- C:\Windows\System\yeRlvdO.exe
  C:\Windows\System\yeRlvdO.exe
  2⤵
  PID:4296
- C:\Windows\System\gzKpFyM.exe
  C:\Windows\System\gzKpFyM.exe
  2⤵
  PID:4376
- C:\Windows\System\qjzIDDd.exe
  C:\Windows\System\qjzIDDd.exe
  2⤵
  PID:4432
- C:\Windows\System\OtsZCZQ.exe
  C:\Windows\System\OtsZCZQ.exe
  2⤵
  PID:4452
- C:\Windows\System\fRujRYM.exe
  C:\Windows\System\fRujRYM.exe
  2⤵
  PID:4536
- C:\Windows\System\qdKtepF.exe
  C:\Windows\System\qdKtepF.exe
  2⤵
  PID:4552
- C:\Windows\System\WUJFEFZ.exe
  C:\Windows\System\WUJFEFZ.exe
  2⤵
  PID:4572
- C:\Windows\System\aCBoRTy.exe
  C:\Windows\System\aCBoRTy.exe
  2⤵
  PID:4588
- C:\Windows\System\gzkrdNC.exe
  C:\Windows\System\gzkrdNC.exe
  2⤵
  PID:4612
- C:\Windows\System\tiYAttj.exe
  C:\Windows\System\tiYAttj.exe
  2⤵
  PID:4628
- C:\Windows\System\uUCNGfQ.exe
  C:\Windows\System\uUCNGfQ.exe
  2⤵
  PID:4648
- C:\Windows\System\CarukJz.exe
  C:\Windows\System\CarukJz.exe
  2⤵
  PID:4664
- C:\Windows\System\DMTmFuL.exe
  C:\Windows\System\DMTmFuL.exe
  2⤵
  PID:4680
- C:\Windows\System\kTpGYia.exe
  C:\Windows\System\kTpGYia.exe
  2⤵
  PID:4696
- C:\Windows\System\uaCxxSz.exe
  C:\Windows\System\uaCxxSz.exe
  2⤵
  PID:4712
- C:\Windows\System\IBNMiuy.exe
  C:\Windows\System\IBNMiuy.exe
  2⤵
  PID:4752
- C:\Windows\System\ttWZpgV.exe
  C:\Windows\System\ttWZpgV.exe
  2⤵
  PID:4768
- C:\Windows\System\MRwFNiw.exe
  C:\Windows\System\MRwFNiw.exe
  2⤵
  PID:4788
- C:\Windows\System\CtDnsWU.exe
  C:\Windows\System\CtDnsWU.exe
  2⤵
  PID:4804
- C:\Windows\System\xTFSInP.exe
  C:\Windows\System\xTFSInP.exe
  2⤵
  PID:4836
- C:\Windows\System\EuERobY.exe
  C:\Windows\System\EuERobY.exe
  2⤵
  PID:4852
- C:\Windows\System\zgTYjtO.exe
  C:\Windows\System\zgTYjtO.exe
  2⤵
  PID:4868
- C:\Windows\System\NrOzynS.exe
  C:\Windows\System\NrOzynS.exe
  2⤵
  PID:4892
- C:\Windows\System\gyhDEmW.exe
  C:\Windows\System\gyhDEmW.exe
  2⤵
  PID:4908
- C:\Windows\System\enqdMWs.exe
  C:\Windows\System\enqdMWs.exe
  2⤵
  PID:4924
- C:\Windows\System\fkCaJmX.exe
  C:\Windows\System\fkCaJmX.exe
  2⤵
  PID:4944
- C:\Windows\System\gNmZNuF.exe
  C:\Windows\System\gNmZNuF.exe
  2⤵
  PID:4960
- C:\Windows\System\jKleUBa.exe
  C:\Windows\System\jKleUBa.exe
  2⤵
  PID:4980
- C:\Windows\System\YLMurLn.exe
  C:\Windows\System\YLMurLn.exe
  2⤵
  PID:5000
- C:\Windows\System\RTanrsW.exe
  C:\Windows\System\RTanrsW.exe
  2⤵
  PID:5028
- C:\Windows\System\KnDdKhC.exe
  C:\Windows\System\KnDdKhC.exe
  2⤵
  PID:5060
- C:\Windows\System\xdgXvqi.exe
  C:\Windows\System\xdgXvqi.exe
  2⤵
  PID:5092
- C:\Windows\System\izSlIXi.exe
  C:\Windows\System\izSlIXi.exe
  2⤵
  PID:3712
- C:\Windows\System\wgxTiqk.exe
  C:\Windows\System\wgxTiqk.exe
  2⤵
  PID:304
- C:\Windows\System\YqxMfWi.exe
  C:\Windows\System\YqxMfWi.exe
  2⤵
  PID:3900
- C:\Windows\System\cxyIsmB.exe
  C:\Windows\System\cxyIsmB.exe
  2⤵
  PID:3760
- C:\Windows\System\KDaQTHd.exe
  C:\Windows\System\KDaQTHd.exe
  2⤵
  PID:4012
- C:\Windows\System\eWtqlVR.exe
  C:\Windows\System\eWtqlVR.exe
  2⤵
  PID:3928
- C:\Windows\System\xyxVazX.exe
  C:\Windows\System\xyxVazX.exe
  2⤵
  PID:3368
- C:\Windows\System\LKIrTwS.exe
  C:\Windows\System\LKIrTwS.exe
  2⤵
  PID:1520
- C:\Windows\System\bFBSVAn.exe
  C:\Windows\System\bFBSVAn.exe
  2⤵
  PID:3520
- C:\Windows\System\FtVqrHs.exe
  C:\Windows\System\FtVqrHs.exe
  2⤵
  PID:928
- C:\Windows\System\iiIZlgu.exe
  C:\Windows\System\iiIZlgu.exe
  2⤵
  PID:3752
- C:\Windows\System\xduEAGB.exe
  C:\Windows\System\xduEAGB.exe
  2⤵
  PID:4168
- C:\Windows\System\mfHAYjA.exe
  C:\Windows\System\mfHAYjA.exe
  2⤵
  PID:4272
- C:\Windows\System\WtHNoeR.exe
  C:\Windows\System\WtHNoeR.exe
  2⤵
  PID:3992
- C:\Windows\System\ldvxuJf.exe
  C:\Windows\System\ldvxuJf.exe
  2⤵
  PID:4124
- C:\Windows\System\gCHMZRf.exe
  C:\Windows\System\gCHMZRf.exe
  2⤵
  PID:4192
- C:\Windows\System\dQPFqob.exe
  C:\Windows\System\dQPFqob.exe
  2⤵
  PID:4260
- C:\Windows\System\tsWEeuR.exe
  C:\Windows\System\tsWEeuR.exe
  2⤵
  PID:4352
- C:\Windows\System\aTThOob.exe
  C:\Windows\System\aTThOob.exe
  2⤵
  PID:2312
- C:\Windows\System\IKwdQDD.exe
  C:\Windows\System\IKwdQDD.exe
  2⤵
  PID:4384
- C:\Windows\System\SlkfEjY.exe
  C:\Windows\System\SlkfEjY.exe
  2⤵
  PID:4408
- C:\Windows\System\EEmcfbs.exe
  C:\Windows\System\EEmcfbs.exe
  2⤵
  PID:4412
- C:\Windows\System\zYZEbzd.exe
  C:\Windows\System\zYZEbzd.exe
  2⤵
  PID:4440
- C:\Windows\System\lovCkLS.exe
  C:\Windows\System\lovCkLS.exe
  2⤵
  PID:4480
- C:\Windows\System\iGDaOic.exe
  C:\Windows\System\iGDaOic.exe
  2⤵
  PID:4488
- C:\Windows\System\UWivxAp.exe
  C:\Windows\System\UWivxAp.exe
  2⤵
  PID:308
- C:\Windows\System\dbncGmd.exe
  C:\Windows\System\dbncGmd.exe
  2⤵
  PID:4504
- C:\Windows\System\qjkrRLD.exe
  C:\Windows\System\qjkrRLD.exe
  2⤵
  PID:4520
- C:\Windows\System\MLqBIis.exe
  C:\Windows\System\MLqBIis.exe
  2⤵
  PID:4560
- C:\Windows\System\yEKWLXS.exe
  C:\Windows\System\yEKWLXS.exe
  2⤵
  PID:4692
- C:\Windows\System\hFAkLWc.exe
  C:\Windows\System\hFAkLWc.exe
  2⤵
  PID:4656
- C:\Windows\System\zkxrJJh.exe
  C:\Windows\System\zkxrJJh.exe
  2⤵
  PID:4724
- C:\Windows\System\cuMiLrr.exe
  C:\Windows\System\cuMiLrr.exe
  2⤵
  PID:4800
- C:\Windows\System\XKNBNwS.exe
  C:\Windows\System\XKNBNwS.exe
  2⤵
  PID:4740
- C:\Windows\System\Zporpye.exe
  C:\Windows\System\Zporpye.exe
  2⤵
  PID:4780
- C:\Windows\System\TPVDRIf.exe
  C:\Windows\System\TPVDRIf.exe
  2⤵
  PID:4824
- C:\Windows\System\TBDEetk.exe
  C:\Windows\System\TBDEetk.exe
  2⤵
  PID:4860
- C:\Windows\System\FhODvtq.exe
  C:\Windows\System\FhODvtq.exe
  2⤵
  PID:4888
- C:\Windows\System\wFhBQxq.exe
  C:\Windows\System\wFhBQxq.exe
  2⤵
  PID:4932
- C:\Windows\System\lJEnWtl.exe
  C:\Windows\System\lJEnWtl.exe
  2⤵
  PID:4920
- C:\Windows\System\uKkftRn.exe
  C:\Windows\System\uKkftRn.exe
  2⤵
  PID:4988
- C:\Windows\System\ZYooatc.exe
  C:\Windows\System\ZYooatc.exe
  2⤵
  PID:5012
- C:\Windows\System\kwMzKEC.exe
  C:\Windows\System\kwMzKEC.exe
  2⤵
  PID:5024
- C:\Windows\System\gWAyBnI.exe
  C:\Windows\System\gWAyBnI.exe
  2⤵
  PID:4528
- C:\Windows\System\UalJrTi.exe
  C:\Windows\System\UalJrTi.exe
  2⤵
  PID:5084
- C:\Windows\System\ymDFMsT.exe
  C:\Windows\System\ymDFMsT.exe
  2⤵
  PID:5104
- C:\Windows\System\fASzgPS.exe
  C:\Windows\System\fASzgPS.exe
  2⤵
  PID:3468
- C:\Windows\System\nMvkcoL.exe
  C:\Windows\System\nMvkcoL.exe
  2⤵
  PID:3812
- C:\Windows\System\VgjQQLl.exe
  C:\Windows\System\VgjQQLl.exe
  2⤵
  PID:4048
- C:\Windows\System\qKTNpEm.exe
  C:\Windows\System\qKTNpEm.exe
  2⤵
  PID:3280
- C:\Windows\System\TLwQwXe.exe
  C:\Windows\System\TLwQwXe.exe
  2⤵
  PID:4304
- C:\Windows\System\jaHwQeH.exe
  C:\Windows\System\jaHwQeH.exe
  2⤵
  PID:3672
- C:\Windows\System\jHjRszW.exe
  C:\Windows\System\jHjRszW.exe
  2⤵
  PID:3748
- C:\Windows\System\hUFbsnW.exe
  C:\Windows\System\hUFbsnW.exe
  2⤵
  PID:4120
- C:\Windows\System\kYiXiCT.exe
  C:\Windows\System\kYiXiCT.exe
  2⤵
  PID:4256
- C:\Windows\System\GXSRywI.exe
  C:\Windows\System\GXSRywI.exe
  2⤵
  PID:4388
- C:\Windows\System\outHMOh.exe
  C:\Windows\System\outHMOh.exe
  2⤵
  PID:4512
- C:\Windows\System\OMmPvUk.exe
  C:\Windows\System\OMmPvUk.exe
  2⤵
  PID:4472
- C:\Windows\System\qjjoWHr.exe
  C:\Windows\System\qjjoWHr.exe
  2⤵
  PID:4516
- C:\Windows\System\JeZNVmf.exe
  C:\Windows\System\JeZNVmf.exe
  2⤵
  PID:4580
- C:\Windows\System\cOwEmpZ.exe
  C:\Windows\System\cOwEmpZ.exe
  2⤵
  PID:4608
- C:\Windows\System\vKiUEdK.exe
  C:\Windows\System\vKiUEdK.exe
  2⤵
  PID:4620
- C:\Windows\System\WUZvLfU.exe
  C:\Windows\System\WUZvLfU.exe
  2⤵
  PID:4468
- C:\Windows\System\eesxsKh.exe
  C:\Windows\System\eesxsKh.exe
  2⤵
  PID:4736
- C:\Windows\System\nbLHczm.exe
  C:\Windows\System\nbLHczm.exe
  2⤵
  PID:4820
- C:\Windows\System\ABMewzj.exe
  C:\Windows\System\ABMewzj.exe
  2⤵
  PID:4936
- C:\Windows\System\QVJRrgw.exe
  C:\Windows\System\QVJRrgw.exe
  2⤵
  PID:5048
- C:\Windows\System\EPujgrf.exe
  C:\Windows\System\EPujgrf.exe
  2⤵
  PID:5020
- C:\Windows\System\ZDlxAVw.exe
  C:\Windows\System\ZDlxAVw.exe
  2⤵
  PID:3116
- C:\Windows\System\BXAsvuu.exe
  C:\Windows\System\BXAsvuu.exe
  2⤵
  PID:3732
- C:\Windows\System\lyddgfm.exe
  C:\Windows\System\lyddgfm.exe
  2⤵
  PID:4776
- C:\Windows\System\jDrrbVp.exe
  C:\Windows\System\jDrrbVp.exe
  2⤵
  PID:5068
- C:\Windows\System\HvaFEIN.exe
  C:\Windows\System\HvaFEIN.exe
  2⤵
  PID:1196
- C:\Windows\System\LeGzUgf.exe
  C:\Windows\System\LeGzUgf.exe
  2⤵
  PID:3592
- C:\Windows\System\KKMXBVO.exe
  C:\Windows\System\KKMXBVO.exe
  2⤵
  PID:3420
- C:\Windows\System\dMfIrTH.exe
  C:\Windows\System\dMfIrTH.exe
  2⤵
  PID:3820
- C:\Windows\System\gipdliL.exe
  C:\Windows\System\gipdliL.exe
  2⤵
  PID:4328
- C:\Windows\System\luhDUgj.exe
  C:\Windows\System\luhDUgj.exe
  2⤵
  PID:4900
- C:\Windows\System\xgZTqgh.exe
  C:\Windows\System\xgZTqgh.exe
  2⤵
  PID:4640
- C:\Windows\System\hpnAjXa.exe
  C:\Windows\System\hpnAjXa.exe
  2⤵
  PID:4952
- C:\Windows\System\FQOdCSS.exe
  C:\Windows\System\FQOdCSS.exe
  2⤵
  PID:5008
- C:\Windows\System\obbrAcX.exe
  C:\Windows\System\obbrAcX.exe
  2⤵
  PID:4672
- C:\Windows\System\ouIcHQi.exe
  C:\Windows\System\ouIcHQi.exe
  2⤵
  PID:4816
- C:\Windows\System\lphYJoG.exe
  C:\Windows\System\lphYJoG.exe
  2⤵
  PID:4492
- C:\Windows\System\TOticMQ.exe
  C:\Windows\System\TOticMQ.exe
  2⤵
  PID:4624
- C:\Windows\System\ZQEQxSw.exe
  C:\Windows\System\ZQEQxSw.exe
  2⤵
  PID:5112
- C:\Windows\System\XjEniKD.exe
  C:\Windows\System\XjEniKD.exe
  2⤵
  PID:4104
- C:\Windows\System\IPIHnAE.exe
  C:\Windows\System\IPIHnAE.exe
  2⤵
  PID:2968
- C:\Windows\System\KYrjdpC.exe
  C:\Windows\System\KYrjdpC.exe
  2⤵
  PID:4460
- C:\Windows\System\KmGELGU.exe
  C:\Windows\System\KmGELGU.exe
  2⤵
  PID:4500
- C:\Windows\System\eCmvvBl.exe
  C:\Windows\System\eCmvvBl.exe
  2⤵
  PID:4532
- C:\Windows\System\KWkdBmJ.exe
  C:\Windows\System\KWkdBmJ.exe
  2⤵
  PID:4424
- C:\Windows\System\doWVkOi.exe
  C:\Windows\System\doWVkOi.exe
  2⤵
  PID:4884
- C:\Windows\System\lBTazrL.exe
  C:\Windows\System\lBTazrL.exe
  2⤵
  PID:4848
- C:\Windows\System\NrMAqae.exe
  C:\Windows\System\NrMAqae.exe
  2⤵
  PID:3652
- C:\Windows\System\zEfSxma.exe
  C:\Windows\System\zEfSxma.exe
  2⤵
  PID:4660
- C:\Windows\System\BTTJMMH.exe
  C:\Windows\System\BTTJMMH.exe
  2⤵
  PID:4208
- C:\Windows\System\bQwltwN.exe
  C:\Windows\System\bQwltwN.exe
  2⤵
  PID:888
- C:\Windows\System\OmTiXqF.exe
  C:\Windows\System\OmTiXqF.exe
  2⤵
  PID:4224
- C:\Windows\System\fBoPljZ.exe
  C:\Windows\System\fBoPljZ.exe
  2⤵
  PID:1744
- C:\Windows\System\ZpzErPA.exe
  C:\Windows\System\ZpzErPA.exe
  2⤵
  PID:4448
- C:\Windows\System\rHsKSUf.exe
  C:\Windows\System\rHsKSUf.exe
  2⤵
  PID:4176
- C:\Windows\System\mDyEeVq.exe
  C:\Windows\System\mDyEeVq.exe
  2⤵
  PID:4156
- C:\Windows\System\lQlFIhc.exe
  C:\Windows\System\lQlFIhc.exe
  2⤵
  PID:4312
- C:\Windows\System\Pbdtqha.exe
  C:\Windows\System\Pbdtqha.exe
  2⤵
  PID:3720
- C:\Windows\System\ZZuJSvC.exe
  C:\Windows\System\ZZuJSvC.exe
  2⤵
  PID:5040
- C:\Windows\System\jzApSxY.exe
  C:\Windows\System\jzApSxY.exe
  2⤵
  PID:4636
- C:\Windows\System\PrCZXTf.exe
  C:\Windows\System\PrCZXTf.exe
  2⤵
  PID:2964
- C:\Windows\System\feqoVxt.exe
  C:\Windows\System\feqoVxt.exe
  2⤵
  PID:4172
- C:\Windows\System\PGVmbJi.exe
  C:\Windows\System\PGVmbJi.exe
  2⤵
  PID:5136
- C:\Windows\System\UPWSUzw.exe
  C:\Windows\System\UPWSUzw.exe
  2⤵
  PID:5152
- C:\Windows\System\jvogCeE.exe
  C:\Windows\System\jvogCeE.exe
  2⤵
  PID:5168
- C:\Windows\System\JMgZFOj.exe
  C:\Windows\System\JMgZFOj.exe
  2⤵
  PID:5188
- C:\Windows\System\qegGhkM.exe
  C:\Windows\System\qegGhkM.exe
  2⤵
  PID:5204
- C:\Windows\System\VcodDVu.exe
  C:\Windows\System\VcodDVu.exe
  2⤵
  PID:5220
- C:\Windows\System\EtBcekR.exe
  C:\Windows\System\EtBcekR.exe
  2⤵
  PID:5236
- C:\Windows\System\TzdQbZJ.exe
  C:\Windows\System\TzdQbZJ.exe
  2⤵
  PID:5252
- C:\Windows\System\SRtQisd.exe
  C:\Windows\System\SRtQisd.exe
  2⤵
  PID:5268
- C:\Windows\System\KCxUoYa.exe
  C:\Windows\System\KCxUoYa.exe
  2⤵
  PID:5284
- C:\Windows\System\xDzQvIi.exe
  C:\Windows\System\xDzQvIi.exe
  2⤵
  PID:5304
- C:\Windows\System\BTpXuQQ.exe
  C:\Windows\System\BTpXuQQ.exe
  2⤵
  PID:5320
- C:\Windows\System\zMgMxqy.exe
  C:\Windows\System\zMgMxqy.exe
  2⤵
  PID:5336
- C:\Windows\System\KGwjfmB.exe
  C:\Windows\System\KGwjfmB.exe
  2⤵
  PID:5352
- C:\Windows\System\bMumMlS.exe
  C:\Windows\System\bMumMlS.exe
  2⤵
  PID:5372
- C:\Windows\System\iMkHkIg.exe
  C:\Windows\System\iMkHkIg.exe
  2⤵
  PID:5388
- C:\Windows\System\IOokDUF.exe
  C:\Windows\System\IOokDUF.exe
  2⤵
  PID:5404
- C:\Windows\System\VTMEDtJ.exe
  C:\Windows\System\VTMEDtJ.exe
  2⤵
  PID:5424
- C:\Windows\System\tZfUgwY.exe
  C:\Windows\System\tZfUgwY.exe
  2⤵
  PID:5440
- C:\Windows\System\EhwUKZp.exe
  C:\Windows\System\EhwUKZp.exe
  2⤵
  PID:5456
- C:\Windows\System\ZNpwKxu.exe
  C:\Windows\System\ZNpwKxu.exe
  2⤵
  PID:5472
- C:\Windows\System\qITaWjT.exe
  C:\Windows\System\qITaWjT.exe
  2⤵
  PID:5492
- C:\Windows\System\EqPAJXB.exe
  C:\Windows\System\EqPAJXB.exe
  2⤵
  PID:5508
- C:\Windows\System\WWKhYHy.exe
  C:\Windows\System\WWKhYHy.exe
  2⤵
  PID:5524
- C:\Windows\System\PlIlzzx.exe
  C:\Windows\System\PlIlzzx.exe
  2⤵
  PID:5544
- C:\Windows\System\JSqXNub.exe
  C:\Windows\System\JSqXNub.exe
  2⤵
  PID:5560
- C:\Windows\System\QzEYaKQ.exe
  C:\Windows\System\QzEYaKQ.exe
  2⤵
  PID:5576
- C:\Windows\System\qWLCcLW.exe
  C:\Windows\System\qWLCcLW.exe
  2⤵
  PID:5592
- C:\Windows\System\vfZnxun.exe
  C:\Windows\System\vfZnxun.exe
  2⤵
  PID:5608
- C:\Windows\System\skSJwTb.exe
  C:\Windows\System\skSJwTb.exe
  2⤵
  PID:5624
- C:\Windows\System\dkhlQHM.exe
  C:\Windows\System\dkhlQHM.exe
  2⤵
  PID:5644
- C:\Windows\System\YIQalPK.exe
  C:\Windows\System\YIQalPK.exe
  2⤵
  PID:5660
- C:\Windows\System\QhjHtso.exe
  C:\Windows\System\QhjHtso.exe
  2⤵
  PID:5752
- C:\Windows\System\GcboTen.exe
  C:\Windows\System\GcboTen.exe
  2⤵
  PID:5768
- C:\Windows\System\kbVQNeB.exe
  C:\Windows\System\kbVQNeB.exe
  2⤵
  PID:5788
- C:\Windows\System\pRFDMmP.exe
  C:\Windows\System\pRFDMmP.exe
  2⤵
  PID:5804
- C:\Windows\System\IkANqma.exe
  C:\Windows\System\IkANqma.exe
  2⤵
  PID:5820
- C:\Windows\System\zhjbAgG.exe
  C:\Windows\System\zhjbAgG.exe
  2⤵
  PID:5836
- C:\Windows\System\WqFlbcY.exe
  C:\Windows\System\WqFlbcY.exe
  2⤵
  PID:5852
- C:\Windows\System\CuUWLCR.exe
  C:\Windows\System\CuUWLCR.exe
  2⤵
  PID:5872
- C:\Windows\System\OdRPskG.exe
  C:\Windows\System\OdRPskG.exe
  2⤵
  PID:5888
- C:\Windows\System\LsgrPsk.exe
  C:\Windows\System\LsgrPsk.exe
  2⤵
  PID:5904
- C:\Windows\System\FFbkCfr.exe
  C:\Windows\System\FFbkCfr.exe
  2⤵
  PID:5920
- C:\Windows\System\VHEiKHP.exe
  C:\Windows\System\VHEiKHP.exe
  2⤵
  PID:5940
- C:\Windows\System\eWqqchc.exe
  C:\Windows\System\eWqqchc.exe
  2⤵
  PID:5956
- C:\Windows\System\EjgPLcB.exe
  C:\Windows\System\EjgPLcB.exe
  2⤵
  PID:5972
- C:\Windows\System\myhdmJm.exe
  C:\Windows\System\myhdmJm.exe
  2⤵
  PID:5988
- C:\Windows\System\EgZeQDN.exe
  C:\Windows\System\EgZeQDN.exe
  2⤵
  PID:6004
- C:\Windows\System\oQABBiU.exe
  C:\Windows\System\oQABBiU.exe
  2⤵
  PID:6024
- C:\Windows\System\cWNCeyt.exe
  C:\Windows\System\cWNCeyt.exe
  2⤵
  PID:6040
- C:\Windows\System\sLXpGRo.exe
  C:\Windows\System\sLXpGRo.exe
  2⤵
  PID:6056
- C:\Windows\System\ilCSvMN.exe
  C:\Windows\System\ilCSvMN.exe
  2⤵
  PID:6072
- C:\Windows\System\ZatClQt.exe
  C:\Windows\System\ZatClQt.exe
  2⤵
  PID:6092
- C:\Windows\System\ByVFUHo.exe
  C:\Windows\System\ByVFUHo.exe
  2⤵
  PID:6108
- C:\Windows\System\DdTWXka.exe
  C:\Windows\System\DdTWXka.exe
  2⤵
  PID:6124
- C:\Windows\System\UEiJIeB.exe
  C:\Windows\System\UEiJIeB.exe
  2⤵
  PID:6140
- C:\Windows\System\cZtISOh.exe
  C:\Windows\System\cZtISOh.exe
  2⤵
  PID:5196
- C:\Windows\System\UKrBpvA.exe
  C:\Windows\System\UKrBpvA.exe
  2⤵
  PID:5292
- C:\Windows\System\fuKYFZE.exe
  C:\Windows\System\fuKYFZE.exe
  2⤵
  PID:5108
- C:\Windows\System\EoDQhUc.exe
  C:\Windows\System\EoDQhUc.exe
  2⤵
  PID:5368
- C:\Windows\System\ICPdvRQ.exe
  C:\Windows\System\ICPdvRQ.exe
  2⤵
  PID:5464
- C:\Windows\System\rdYLBsn.exe
  C:\Windows\System\rdYLBsn.exe
  2⤵
  PID:5504
- C:\Windows\System\clchLDZ.exe
  C:\Windows\System\clchLDZ.exe
  2⤵
  PID:5296
- C:\Windows\System\LaxLvpt.exe
  C:\Windows\System\LaxLvpt.exe
  2⤵
  PID:2100
- C:\Windows\System\UXkVrtQ.exe
  C:\Windows\System\UXkVrtQ.exe
  2⤵
  PID:5632
- C:\Windows\System\EsDwerp.exe
  C:\Windows\System\EsDwerp.exe
  2⤵
  PID:5680
- C:\Windows\System\FtcAHyG.exe
  C:\Windows\System\FtcAHyG.exe
  2⤵
  PID:4564
- C:\Windows\System\duCDnME.exe
  C:\Windows\System\duCDnME.exe
  2⤵
  PID:5216
- C:\Windows\System\LFnCQdz.exe
  C:\Windows\System\LFnCQdz.exe
  2⤵
  PID:5312
- C:\Windows\System\ZcaqShK.exe
  C:\Windows\System\ZcaqShK.exe
  2⤵
  PID:5412
- C:\Windows\System\Zqoyhur.exe
  C:\Windows\System\Zqoyhur.exe
  2⤵
  PID:5704
- C:\Windows\System\IydIjnc.exe
  C:\Windows\System\IydIjnc.exe
  2⤵
  PID:5728
- C:\Windows\System\eWBraYT.exe
  C:\Windows\System\eWBraYT.exe
  2⤵
  PID:5480
- C:\Windows\System\YqdsMeM.exe
  C:\Windows\System\YqdsMeM.exe
  2⤵
  PID:5520
- C:\Windows\System\PvOXIdN.exe
  C:\Windows\System\PvOXIdN.exe
  2⤵
  PID:5616
- C:\Windows\System\ilituCq.exe
  C:\Windows\System\ilituCq.exe
  2⤵
  PID:5176
- C:\Windows\System\yDlNauA.exe
  C:\Windows\System\yDlNauA.exe
  2⤵
  PID:5748
- C:\Windows\System\fHnvfuw.exe
  C:\Windows\System\fHnvfuw.exe
  2⤵
  PID:5316
- C:\Windows\System\JjHVAMY.exe
  C:\Windows\System\JjHVAMY.exe
  2⤵
  PID:5760
- C:\Windows\System\WuRmdYb.exe
  C:\Windows\System\WuRmdYb.exe
  2⤵
  PID:5880
- C:\Windows\System\FjJGjHP.exe
  C:\Windows\System\FjJGjHP.exe
  2⤵
  PID:5864
- C:\Windows\System\MzHEwCU.exe
  C:\Windows\System\MzHEwCU.exe
  2⤵
  PID:5832
- C:\Windows\System\NkYAJgU.exe
  C:\Windows\System\NkYAJgU.exe
  2⤵
  PID:5952
- C:\Windows\System\xAGmujy.exe
  C:\Windows\System\xAGmujy.exe
  2⤵
  PID:6020
- C:\Windows\System\MYOPTsO.exe
  C:\Windows\System\MYOPTsO.exe
  2⤵
  PID:6080
- C:\Windows\System\CSEAVCq.exe
  C:\Windows\System\CSEAVCq.exe
  2⤵
  PID:6088
- C:\Windows\System\UqYcgaJ.exe
  C:\Windows\System\UqYcgaJ.exe
  2⤵
  PID:6116
- C:\Windows\System\YRaqZbC.exe
  C:\Windows\System\YRaqZbC.exe
  2⤵
  PID:6132
- C:\Windows\System\YsIEgrD.exe
  C:\Windows\System\YsIEgrD.exe
  2⤵
  PID:5432
- C:\Windows\System\FIknfQn.exe
  C:\Windows\System\FIknfQn.exe
  2⤵
  PID:5600
- C:\Windows\System\PnfRVOd.exe
  C:\Windows\System\PnfRVOd.exe
  2⤵
  PID:5360
- C:\Windows\System\JWlZCyZ.exe
  C:\Windows\System\JWlZCyZ.exe
  2⤵
  PID:5668
- C:\Windows\System\UGkjJBM.exe
  C:\Windows\System\UGkjJBM.exe
  2⤵
  PID:5276
- C:\Windows\System\MSOkziI.exe
  C:\Windows\System\MSOkziI.exe
  2⤵
  PID:5708
- C:\Windows\System\sdIhHfI.exe
  C:\Windows\System\sdIhHfI.exe
  2⤵
  PID:5452
- C:\Windows\System\dFTjsOi.exe
  C:\Windows\System\dFTjsOi.exe
  2⤵
  PID:5816
- C:\Windows\System\jEqZoTD.exe
  C:\Windows\System\jEqZoTD.exe
  2⤵
  PID:5948
- C:\Windows\System\BxviZzW.exe
  C:\Windows\System\BxviZzW.exe
  2⤵
  PID:6012
- C:\Windows\System\NpqoGbS.exe
  C:\Windows\System\NpqoGbS.exe
  2⤵
  PID:6036
- C:\Windows\System\wjCCzRk.exe
  C:\Windows\System\wjCCzRk.exe
  2⤵
  PID:5996
- C:\Windows\System\eNzsHBJ.exe
  C:\Windows\System\eNzsHBJ.exe
  2⤵
  PID:5300
- C:\Windows\System\kOZyVrS.exe
  C:\Windows\System\kOZyVrS.exe
  2⤵
  PID:5400
- C:\Windows\System\DTLwgSh.exe
  C:\Windows\System\DTLwgSh.exe
  2⤵
  PID:6100
- C:\Windows\System\SpFSuZa.exe
  C:\Windows\System\SpFSuZa.exe
  2⤵
  PID:5328
- C:\Windows\System\uQQXhqn.exe
  C:\Windows\System\uQQXhqn.exe
  2⤵
  PID:5248
- C:\Windows\System\nixitpP.exe
  C:\Windows\System\nixitpP.exe
  2⤵
  PID:5676
- C:\Windows\System\LOmZxKW.exe
  C:\Windows\System\LOmZxKW.exe
  2⤵
  PID:5184
- C:\Windows\System\vwFPocS.exe
  C:\Windows\System\vwFPocS.exe
  2⤵
  PID:5588
- C:\Windows\System\owMHmpV.exe
  C:\Windows\System\owMHmpV.exe
  2⤵
  PID:5744
- C:\Windows\System\UkUCPgS.exe
  C:\Windows\System\UkUCPgS.exe
  2⤵
  PID:5784
- C:\Windows\System\uvbjlvl.exe
  C:\Windows\System\uvbjlvl.exe
  2⤵
  PID:5144
- C:\Windows\System\IjObrdU.exe
  C:\Windows\System\IjObrdU.exe
  2⤵
  PID:3696
- C:\Windows\System\CMreUkr.exe
  C:\Windows\System\CMreUkr.exe
  2⤵
  PID:5160
- C:\Windows\System\DKWGcgE.exe
  C:\Windows\System\DKWGcgE.exe
  2⤵
  PID:5132
- C:\Windows\System\ElqsFZW.exe
  C:\Windows\System\ElqsFZW.exe
  2⤵
  PID:5684
- C:\Windows\System\KxLCzzW.exe
  C:\Windows\System\KxLCzzW.exe
  2⤵
  PID:5724
- C:\Windows\System\BHwvoGx.exe
  C:\Windows\System\BHwvoGx.exe
  2⤵
  PID:5652
- C:\Windows\System\JaRZxdr.exe
  C:\Windows\System\JaRZxdr.exe
  2⤵
  PID:5936
- C:\Windows\System\TZiLHlZ.exe
  C:\Windows\System\TZiLHlZ.exe
  2⤵
  PID:5868
- C:\Windows\System\BlPaIqr.exe
  C:\Windows\System\BlPaIqr.exe
  2⤵
  PID:5812
- C:\Windows\System\KxYAwEj.exe
  C:\Windows\System\KxYAwEj.exe
  2⤵
  PID:5148
- C:\Windows\System\eXtRKhd.exe
  C:\Windows\System\eXtRKhd.exe
  2⤵
  PID:6148
- C:\Windows\System\LyEzRfF.exe
  C:\Windows\System\LyEzRfF.exe
  2⤵
  PID:6164
- C:\Windows\System\ATVeiKN.exe
  C:\Windows\System\ATVeiKN.exe
  2⤵
  PID:6180
- C:\Windows\System\gNzSvxL.exe
  C:\Windows\System\gNzSvxL.exe
  2⤵
  PID:6196
- C:\Windows\System\OfmegPS.exe
  C:\Windows\System\OfmegPS.exe
  2⤵
  PID:6212
- C:\Windows\System\uhvUxqy.exe
  C:\Windows\System\uhvUxqy.exe
  2⤵
  PID:6240
- C:\Windows\System\xBjCIpm.exe
  C:\Windows\System\xBjCIpm.exe
  2⤵
  PID:6256
- C:\Windows\System\wpvLssp.exe
  C:\Windows\System\wpvLssp.exe
  2⤵
  PID:6272
- C:\Windows\System\bOxEJpw.exe
  C:\Windows\System\bOxEJpw.exe
  2⤵
  PID:6288
- C:\Windows\System\cKfAAbE.exe
  C:\Windows\System\cKfAAbE.exe
  2⤵
  PID:6304
- C:\Windows\System\QBIMHFP.exe
  C:\Windows\System\QBIMHFP.exe
  2⤵
  PID:6320
- C:\Windows\System\yYNvXrb.exe
  C:\Windows\System\yYNvXrb.exe
  2⤵
  PID:6336
- C:\Windows\System\TPfjxpX.exe
  C:\Windows\System\TPfjxpX.exe
  2⤵
  PID:6352
- C:\Windows\System\xIMuOSb.exe
  C:\Windows\System\xIMuOSb.exe
  2⤵
  PID:6368
- C:\Windows\System\cBUwGbQ.exe
  C:\Windows\System\cBUwGbQ.exe
  2⤵
  PID:6384
- C:\Windows\System\yRmhYvP.exe
  C:\Windows\System\yRmhYvP.exe
  2⤵
  PID:6400
- C:\Windows\System\JiilhqF.exe
  C:\Windows\System\JiilhqF.exe
  2⤵
  PID:6420
- C:\Windows\System\uyrydmh.exe
  C:\Windows\System\uyrydmh.exe
  2⤵
  PID:6436
- C:\Windows\System\GoklnmC.exe
  C:\Windows\System\GoklnmC.exe
  2⤵
  PID:6456
- C:\Windows\System\nhMfDbv.exe
  C:\Windows\System\nhMfDbv.exe
  2⤵
  PID:6472
- C:\Windows\System\pfsyLfE.exe
  C:\Windows\System\pfsyLfE.exe
  2⤵
  PID:6488
- C:\Windows\System\eWJWWhF.exe
  C:\Windows\System\eWJWWhF.exe
  2⤵
  PID:6504
- C:\Windows\System\fnGJiEi.exe
  C:\Windows\System\fnGJiEi.exe
  2⤵
  PID:6520
- C:\Windows\System\xZoKJVX.exe
  C:\Windows\System\xZoKJVX.exe
  2⤵
  PID:6536
- C:\Windows\System\XMzdnTy.exe
  C:\Windows\System\XMzdnTy.exe
  2⤵
  PID:6552
- C:\Windows\System\DKATsUR.exe
  C:\Windows\System\DKATsUR.exe
  2⤵
  PID:6568
- C:\Windows\System\dgdeDQm.exe
  C:\Windows\System\dgdeDQm.exe
  2⤵
  PID:6588
- C:\Windows\System\QedKMQf.exe
  C:\Windows\System\QedKMQf.exe
  2⤵
  PID:6644
- C:\Windows\System\PLkhjzK.exe
  C:\Windows\System\PLkhjzK.exe
  2⤵
  PID:6660
- C:\Windows\System\MnKqwFP.exe
  C:\Windows\System\MnKqwFP.exe
  2⤵
  PID:6676
- C:\Windows\System\bykjREG.exe
  C:\Windows\System\bykjREG.exe
  2⤵
  PID:6692
- C:\Windows\System\REBsfKc.exe
  C:\Windows\System\REBsfKc.exe
  2⤵
  PID:6712
- C:\Windows\System\EbWenaN.exe
  C:\Windows\System\EbWenaN.exe
  2⤵
  PID:6732
- C:\Windows\System\jtxWPmS.exe
  C:\Windows\System\jtxWPmS.exe
  2⤵
  PID:6748
- C:\Windows\System\HbXJGPQ.exe
  C:\Windows\System\HbXJGPQ.exe
  2⤵
  PID:6764
- C:\Windows\System\fhdolRN.exe
  C:\Windows\System\fhdolRN.exe
  2⤵
  PID:6780
- C:\Windows\System\VHaWWzN.exe
  C:\Windows\System\VHaWWzN.exe
  2⤵
  PID:6796
- C:\Windows\System\EfXyINi.exe
  C:\Windows\System\EfXyINi.exe
  2⤵
  PID:6908
- C:\Windows\System\HuEQXtT.exe
  C:\Windows\System\HuEQXtT.exe
  2⤵
  PID:6924
- C:\Windows\System\VdGqgmF.exe
  C:\Windows\System\VdGqgmF.exe
  2⤵
  PID:6940
- C:\Windows\System\dvzHNvZ.exe
  C:\Windows\System\dvzHNvZ.exe
  2⤵
  PID:6956
- C:\Windows\System\rlCZyYG.exe
  C:\Windows\System\rlCZyYG.exe
  2⤵
  PID:6972
- C:\Windows\System\XSeMjMG.exe
  C:\Windows\System\XSeMjMG.exe
  2⤵
  PID:7004
- C:\Windows\System\KtAjMSV.exe
  C:\Windows\System\KtAjMSV.exe
  2⤵
  PID:7020
- C:\Windows\System\TnxlGSX.exe
  C:\Windows\System\TnxlGSX.exe
  2⤵
  PID:7040
- C:\Windows\System\XJVuRxw.exe
  C:\Windows\System\XJVuRxw.exe
  2⤵
  PID:7056
- C:\Windows\System\FPNWNdl.exe
  C:\Windows\System\FPNWNdl.exe
  2⤵
  PID:7072
- C:\Windows\System\iXLtPav.exe
  C:\Windows\System\iXLtPav.exe
  2⤵
  PID:7088
- C:\Windows\System\alqDJZx.exe
  C:\Windows\System\alqDJZx.exe
  2⤵
  PID:7104
- C:\Windows\System\TOqWfGW.exe
  C:\Windows\System\TOqWfGW.exe
  2⤵
  PID:7124
- C:\Windows\System\WOKTIgY.exe
  C:\Windows\System\WOKTIgY.exe
  2⤵
  PID:7140
- C:\Windows\System\vSEZmLq.exe
  C:\Windows\System\vSEZmLq.exe
  2⤵
  PID:7156
- C:\Windows\System\esLSPGI.exe
  C:\Windows\System\esLSPGI.exe
  2⤵
  PID:5776
- C:\Windows\System\ZtGbyJH.exe
  C:\Windows\System\ZtGbyJH.exe
  2⤵
  PID:5280
- C:\Windows\System\qFywmVM.exe
  C:\Windows\System\qFywmVM.exe
  2⤵
  PID:4544
- C:\Windows\System\lFOpAtQ.exe
  C:\Windows\System\lFOpAtQ.exe
  2⤵
  PID:6188
- C:\Windows\System\tgEQkiF.exe
  C:\Windows\System\tgEQkiF.exe
  2⤵
  PID:6232
- C:\Windows\System\MGDTNCt.exe
  C:\Windows\System\MGDTNCt.exe
  2⤵
  PID:5380
- C:\Windows\System\iVgrZaZ.exe
  C:\Windows\System\iVgrZaZ.exe
  2⤵
  PID:5932
- C:\Windows\System\WyjUrRP.exe
  C:\Windows\System\WyjUrRP.exe
  2⤵
  PID:6000
- C:\Windows\System\fMgkRcj.exe
  C:\Windows\System\fMgkRcj.exe
  2⤵
  PID:6204
- C:\Windows\System\KzPBwVn.exe
  C:\Windows\System\KzPBwVn.exe
  2⤵
  PID:6252
- C:\Windows\System\XCTTbkJ.exe
  C:\Windows\System\XCTTbkJ.exe
  2⤵
  PID:6328
- C:\Windows\System\TmPaUQf.exe
  C:\Windows\System\TmPaUQf.exe
  2⤵
  PID:6392
- C:\Windows\System\jYXSBit.exe
  C:\Windows\System\jYXSBit.exe
  2⤵
  PID:6432
- C:\Windows\System\UeGyeqy.exe
  C:\Windows\System\UeGyeqy.exe
  2⤵
  PID:6344
- C:\Windows\System\dHACdrp.exe
  C:\Windows\System\dHACdrp.exe
  2⤵
  PID:6412
- C:\Windows\System\aTxqalm.exe
  C:\Windows\System\aTxqalm.exe
  2⤵
  PID:6464
- C:\Windows\System\qkehWsG.exe
  C:\Windows\System\qkehWsG.exe
  2⤵
  PID:6528
- C:\Windows\System\nybZoQy.exe
  C:\Windows\System\nybZoQy.exe
  2⤵
  PID:6564
- C:\Windows\System\oznZJjL.exe
  C:\Windows\System\oznZJjL.exe
  2⤵
  PID:6576
- C:\Windows\System\RsXyHGA.exe
  C:\Windows\System\RsXyHGA.exe
  2⤵
  PID:6580
- C:\Windows\System\OoLlCTO.exe
  C:\Windows\System\OoLlCTO.exe
  2⤵
  PID:6612
- C:\Windows\System\yWsRcVH.exe
  C:\Windows\System\yWsRcVH.exe
  2⤵
  PID:6700
- C:\Windows\System\HosfgBR.exe
  C:\Windows\System\HosfgBR.exe
  2⤵
  PID:6744
- C:\Windows\System\XdukWCn.exe
  C:\Windows\System\XdukWCn.exe
  2⤵
  PID:6808
- C:\Windows\System\veDFfzU.exe
  C:\Windows\System\veDFfzU.exe
  2⤵
  PID:6824
- C:\Windows\System\VnBoFup.exe
  C:\Windows\System\VnBoFup.exe
  2⤵
  PID:6652
- C:\Windows\System\FrFkoTw.exe
  C:\Windows\System\FrFkoTw.exe
  2⤵
  PID:6724
- C:\Windows\System\iFvonxK.exe
  C:\Windows\System\iFvonxK.exe
  2⤵
  PID:6836
- C:\Windows\System\eYYpQSs.exe
  C:\Windows\System\eYYpQSs.exe
  2⤵
  PID:6856
- C:\Windows\System\ybTBNVt.exe
  C:\Windows\System\ybTBNVt.exe
  2⤵
  PID:6872
- C:\Windows\System\qoVEqWd.exe
  C:\Windows\System\qoVEqWd.exe
  2⤵
  PID:6884
- C:\Windows\System\pGuprBW.exe
  C:\Windows\System\pGuprBW.exe
  2⤵
  PID:6892
- C:\Windows\System\KCdSalM.exe
  C:\Windows\System\KCdSalM.exe
  2⤵
  PID:6952
- C:\Windows\System\zLsuOSM.exe
  C:\Windows\System\zLsuOSM.exe
  2⤵
  PID:6932
- C:\Windows\System\OOptXnD.exe
  C:\Windows\System\OOptXnD.exe
  2⤵
  PID:6984
- C:\Windows\System\VVnIZee.exe
  C:\Windows\System\VVnIZee.exe
  2⤵
  PID:7052
- C:\Windows\System\pKXwXKW.exe
  C:\Windows\System\pKXwXKW.exe
  2⤵
  PID:7112
- C:\Windows\System\jvPOcVO.exe
  C:\Windows\System\jvPOcVO.exe
  2⤵
  PID:7036
- C:\Windows\System\llgxOgJ.exe
  C:\Windows\System\llgxOgJ.exe
  2⤵
  PID:6160
- C:\Windows\System\evyFlNY.exe
  C:\Windows\System\evyFlNY.exe
  2⤵
  PID:6228
- C:\Windows\System\irWeilv.exe
  C:\Windows\System\irWeilv.exe
  2⤵
  PID:7000
- C:\Windows\System\DFUlOyg.exe
  C:\Windows\System\DFUlOyg.exe
  2⤵
  PID:6084
- C:\Windows\System\RCyQYOW.exe
  C:\Windows\System\RCyQYOW.exe
  2⤵
  PID:7064
- C:\Windows\System\qNPTHkY.exe
  C:\Windows\System\qNPTHkY.exe
  2⤵
  PID:5516
- C:\Windows\System\fTkCgai.exe
  C:\Windows\System\fTkCgai.exe
  2⤵
  PID:6548
- C:\Windows\System\drWvBbT.exe
  C:\Windows\System\drWvBbT.exe
  2⤵
  PID:6632
- C:\Windows\System\NuKJvkk.exe
  C:\Windows\System\NuKJvkk.exe
  2⤵
  PID:6672
- C:\Windows\System\gPUBwiW.exe
  C:\Windows\System\gPUBwiW.exe
  2⤵
  PID:6776
- C:\Windows\System\AQQBgME.exe
  C:\Windows\System\AQQBgME.exe
  2⤵
  PID:6756
- C:\Windows\System\CyPWiHa.exe
  C:\Windows\System\CyPWiHa.exe
  2⤵
  PID:6860
- C:\Windows\System\IpQZSRp.exe
  C:\Windows\System\IpQZSRp.exe
  2⤵
  PID:6740
- C:\Windows\System\zqOkqfa.exe
  C:\Windows\System\zqOkqfa.exe
  2⤵
  PID:6936
- C:\Windows\System\EiHaXCG.exe
  C:\Windows\System\EiHaXCG.exe
  2⤵
  PID:7120
- C:\Windows\System\zlcBiDY.exe
  C:\Windows\System\zlcBiDY.exe
  2⤵
  PID:6968
- C:\Windows\System\GjogWac.exe
  C:\Windows\System\GjogWac.exe
  2⤵
  PID:7080
- C:\Windows\System\wIgyhrl.exe
  C:\Windows\System\wIgyhrl.exe
  2⤵
  PID:5364
- C:\Windows\System\LDQxKCJ.exe
  C:\Windows\System\LDQxKCJ.exe
  2⤵
  PID:7132
- C:\Windows\System\HFQtVWq.exe
  C:\Windows\System\HFQtVWq.exe
  2⤵
  PID:5916
- C:\Windows\System\IYYybSz.exe
  C:\Windows\System\IYYybSz.exe
  2⤵
  PID:6220
- C:\Windows\System\CwyaziN.exe
  C:\Windows\System\CwyaziN.exe
  2⤵
  PID:6248
- C:\Windows\System\FyoNjcq.exe
  C:\Windows\System\FyoNjcq.exe
  2⤵
  PID:6316
- C:\Windows\System\sSWrJQf.exe
  C:\Windows\System\sSWrJQf.exe
  2⤵
  PID:6560
- C:\Windows\System\IYJUmUI.exe
  C:\Windows\System\IYJUmUI.exe
  2⤵
  PID:6500
- C:\Windows\System\EugrDBY.exe
  C:\Windows\System\EugrDBY.exe
  2⤵
  PID:6428
- C:\Windows\System\ZzxaycP.exe
  C:\Windows\System\ZzxaycP.exe
  2⤵
  PID:6376
- C:\Windows\System\nBtiRJf.exe
  C:\Windows\System\nBtiRJf.exe
  2⤵
  PID:6988
- C:\Windows\System\iqEiFxh.exe
  C:\Windows\System\iqEiFxh.exe
  2⤵
  PID:6804
- C:\Windows\System\bztKrec.exe
  C:\Windows\System\bztKrec.exe
  2⤵
  PID:6996
- C:\Windows\System\vmHVlrN.exe
  C:\Windows\System\vmHVlrN.exe
  2⤵
  PID:6876
- C:\Windows\System\nvzLoUA.exe
  C:\Windows\System\nvzLoUA.exe
  2⤵
  PID:7100
- C:\Windows\System\urFPZvP.exe
  C:\Windows\System\urFPZvP.exe
  2⤵
  PID:6360
- C:\Windows\System\FJnlWtg.exe
  C:\Windows\System\FJnlWtg.exe
  2⤵
  PID:6916
- C:\Windows\System\fGWItpU.exe
  C:\Windows\System\fGWItpU.exe
  2⤵
  PID:7176
- C:\Windows\System\pSomLgv.exe
  C:\Windows\System\pSomLgv.exe
  2⤵
  PID:7192
- C:\Windows\System\MOtozyw.exe
  C:\Windows\System\MOtozyw.exe
  2⤵
  PID:7208
- C:\Windows\System\zrHidQq.exe
  C:\Windows\System\zrHidQq.exe
  2⤵
  PID:7224
- C:\Windows\System\LyCRtSD.exe
  C:\Windows\System\LyCRtSD.exe
  2⤵
  PID:7240
- C:\Windows\System\fiqVhOE.exe
  C:\Windows\System\fiqVhOE.exe
  2⤵
  PID:7256
- C:\Windows\System\wIzAdvz.exe
  C:\Windows\System\wIzAdvz.exe
  2⤵
  PID:7272
- C:\Windows\System\pJKPiDW.exe
  C:\Windows\System\pJKPiDW.exe
  2⤵
  PID:7312
- C:\Windows\System\vrSHUOT.exe
  C:\Windows\System\vrSHUOT.exe
  2⤵
  PID:7328
- C:\Windows\System\bLbbNFU.exe
  C:\Windows\System\bLbbNFU.exe
  2⤵
  PID:7344
- C:\Windows\System\RsagWCJ.exe
  C:\Windows\System\RsagWCJ.exe
  2⤵
  PID:7408
- C:\Windows\System\wYYUobi.exe
  C:\Windows\System\wYYUobi.exe
  2⤵
  PID:7424
- C:\Windows\System\lEWdBHq.exe
  C:\Windows\System\lEWdBHq.exe
  2⤵
  PID:7440
- C:\Windows\System\YRPZkNP.exe
  C:\Windows\System\YRPZkNP.exe
  2⤵
  PID:7456
- C:\Windows\System\VtLQztK.exe
  C:\Windows\System\VtLQztK.exe
  2⤵
  PID:7472
- C:\Windows\System\NSGJlOw.exe
  C:\Windows\System\NSGJlOw.exe
  2⤵
  PID:7488
- C:\Windows\System\kLReZia.exe
  C:\Windows\System\kLReZia.exe
  2⤵
  PID:7504
- C:\Windows\System\tHuIhNS.exe
  C:\Windows\System\tHuIhNS.exe
  2⤵
  PID:7520
- C:\Windows\System\LzBkHlW.exe
  C:\Windows\System\LzBkHlW.exe
  2⤵
  PID:7556
- C:\Windows\System\qzdezyD.exe
  C:\Windows\System\qzdezyD.exe
  2⤵
  PID:7572
- C:\Windows\System\CDyflVe.exe
  C:\Windows\System\CDyflVe.exe
  2⤵
  PID:7588
- C:\Windows\System\ooGcdCO.exe
  C:\Windows\System\ooGcdCO.exe
  2⤵
  PID:7608
- C:\Windows\System\iGkFTVL.exe
  C:\Windows\System\iGkFTVL.exe
  2⤵
  PID:7624
- C:\Windows\System\pvuqAMT.exe
  C:\Windows\System\pvuqAMT.exe
  2⤵
  PID:7640
- C:\Windows\System\MFcSNAh.exe
  C:\Windows\System\MFcSNAh.exe
  2⤵
  PID:7656
- C:\Windows\System\XNPPzGq.exe
  C:\Windows\System\XNPPzGq.exe
  2⤵
  PID:7672
- C:\Windows\System\GljgQaw.exe
  C:\Windows\System\GljgQaw.exe
  2⤵
  PID:7688
- C:\Windows\System\lerIKKn.exe
  C:\Windows\System\lerIKKn.exe
  2⤵
  PID:7704
- C:\Windows\System\bFAKZNV.exe
  C:\Windows\System\bFAKZNV.exe
  2⤵
  PID:7720
- C:\Windows\System\IrwaTco.exe
  C:\Windows\System\IrwaTco.exe
  2⤵
  PID:7736
- C:\Windows\System\kzItnTS.exe
  C:\Windows\System\kzItnTS.exe
  2⤵
  PID:7752
- C:\Windows\System\qgOoxEa.exe
  C:\Windows\System\qgOoxEa.exe
  2⤵
  PID:7768
- C:\Windows\System\yabIDMI.exe
  C:\Windows\System\yabIDMI.exe
  2⤵
  PID:7784
- C:\Windows\System\BtorWDI.exe
  C:\Windows\System\BtorWDI.exe
  2⤵
  PID:7800
- C:\Windows\System\Maxprtg.exe
  C:\Windows\System\Maxprtg.exe
  2⤵
  PID:7816
- C:\Windows\System\aEpRJty.exe
  C:\Windows\System\aEpRJty.exe
  2⤵
  PID:7832
- C:\Windows\System\pgYszCa.exe
  C:\Windows\System\pgYszCa.exe
  2⤵
  PID:7848
- C:\Windows\System\ZHRxnBV.exe
  C:\Windows\System\ZHRxnBV.exe
  2⤵
  PID:7864
- C:\Windows\System\vFCKWoQ.exe
  C:\Windows\System\vFCKWoQ.exe
  2⤵
  PID:7884
- C:\Windows\System\eYnBHxN.exe
  C:\Windows\System\eYnBHxN.exe
  2⤵
  PID:7900
- C:\Windows\System\wPIAKuT.exe
  C:\Windows\System\wPIAKuT.exe
  2⤵
  PID:7932
- C:\Windows\System\JynYxfG.exe
  C:\Windows\System\JynYxfG.exe
  2⤵
  PID:7948
- C:\Windows\System\dgqfQrX.exe
  C:\Windows\System\dgqfQrX.exe
  2⤵
  PID:8092
- C:\Windows\System\dxnhdQZ.exe
  C:\Windows\System\dxnhdQZ.exe
  2⤵
  PID:8108
- C:\Windows\System\zLYfqEa.exe
  C:\Windows\System\zLYfqEa.exe
  2⤵
  PID:8124
- C:\Windows\System\loBuabS.exe
  C:\Windows\System\loBuabS.exe
  2⤵
  PID:8140
- C:\Windows\System\xQenhnQ.exe
  C:\Windows\System\xQenhnQ.exe
  2⤵
  PID:8156
- C:\Windows\System\vXLdNam.exe
  C:\Windows\System\vXLdNam.exe
  2⤵
  PID:8172
- C:\Windows\System\FCqMNzr.exe
  C:\Windows\System\FCqMNzr.exe
  2⤵
  PID:8188
- C:\Windows\System\DqraaKa.exe
  C:\Windows\System\DqraaKa.exe
  2⤵
  PID:6444
- C:\Windows\System\qQeyCcz.exe
  C:\Windows\System\qQeyCcz.exe
  2⤵
  PID:6640
- C:\Windows\System\BWbIUlm.exe
  C:\Windows\System\BWbIUlm.exe
  2⤵
  PID:6684
- C:\Windows\System\jPWuaDR.exe
  C:\Windows\System\jPWuaDR.exe
  2⤵
  PID:6448
- C:\Windows\System\HYMIXvE.exe
  C:\Windows\System\HYMIXvE.exe
  2⤵
  PID:7220
- C:\Windows\System\tAUsNqf.exe
  C:\Windows\System\tAUsNqf.exe
  2⤵
  PID:7284
- C:\Windows\System\PeKASpC.exe
  C:\Windows\System\PeKASpC.exe
  2⤵
  PID:7304
- C:\Windows\System\KhVOJku.exe
  C:\Windows\System\KhVOJku.exe
  2⤵
  PID:6380
- C:\Windows\System\KpICdtm.exe
  C:\Windows\System\KpICdtm.exe
  2⤵
  PID:6848
- C:\Windows\System\PTNLzji.exe
  C:\Windows\System\PTNLzji.exe
  2⤵
  PID:5964
- C:\Windows\System\YqxtXxz.exe
  C:\Windows\System\YqxtXxz.exe
  2⤵
  PID:7232
- C:\Windows\System\FqmbQLf.exe
  C:\Windows\System\FqmbQLf.exe
  2⤵
  PID:7336
- C:\Windows\System\zOenvLs.exe
  C:\Windows\System\zOenvLs.exe
  2⤵
  PID:7352
- C:\Windows\System\RVMtCEY.exe
  C:\Windows\System\RVMtCEY.exe
  2⤵
  PID:7368
- C:\Windows\System\tPXuIaG.exe
  C:\Windows\System\tPXuIaG.exe
  2⤵
  PID:7392
- C:\Windows\System\cruTRDC.exe
  C:\Windows\System\cruTRDC.exe
  2⤵
  PID:7604
- C:\Windows\System\EuplnuD.exe
  C:\Windows\System\EuplnuD.exe
  2⤵
  PID:7668
- C:\Windows\System\JBKlaKQ.exe
  C:\Windows\System\JBKlaKQ.exe
  2⤵
  PID:7696
- C:\Windows\System\jOTsQSD.exe
  C:\Windows\System\jOTsQSD.exe
  2⤵
  PID:7544
- C:\Windows\System\YeenrVw.exe
  C:\Windows\System\YeenrVw.exe
  2⤵
  PID:7732
- C:\Windows\System\fsxBtDn.exe
  C:\Windows\System\fsxBtDn.exe
  2⤵
  PID:7648
- C:\Windows\System\MqTdHmn.exe
  C:\Windows\System\MqTdHmn.exe
  2⤵
  PID:7760
- C:\Windows\System\GhOcAuz.exe
  C:\Windows\System\GhOcAuz.exe
  2⤵
  PID:7796
- C:\Windows\System\WyzaiNo.exe
  C:\Windows\System\WyzaiNo.exe
  2⤵
  PID:7780
- C:\Windows\System\HSEYHtp.exe
  C:\Windows\System\HSEYHtp.exe
  2⤵
  PID:7860
- C:\Windows\System\UBYkqez.exe
  C:\Windows\System\UBYkqez.exe
  2⤵
  PID:7908
- C:\Windows\System\syJTGbi.exe
  C:\Windows\System\syJTGbi.exe
  2⤵
  PID:7916
- C:\Windows\System\MJePhLR.exe
  C:\Windows\System\MJePhLR.exe
  2⤵
  PID:7808
- C:\Windows\System\NYSCAtP.exe
  C:\Windows\System\NYSCAtP.exe
  2⤵
  PID:8060
- C:\Windows\System\wPYkEfh.exe
  C:\Windows\System\wPYkEfh.exe
  2⤵
  PID:8076
- C:\Windows\System\hSMGbkx.exe
  C:\Windows\System\hSMGbkx.exe
  2⤵
  PID:8100
- C:\Windows\System\WfekLid.exe
  C:\Windows\System\WfekLid.exe
  2⤵
  PID:8164
- C:\Windows\System\tQLTPKa.exe
  C:\Windows\System\tQLTPKa.exe
  2⤵
  PID:6900
- C:\Windows\System\HDksckj.exe
  C:\Windows\System\HDksckj.exe
  2⤵
  PID:7300
- C:\Windows\System\txYmOjP.exe
  C:\Windows\System\txYmOjP.exe
  2⤵
  PID:8120
- C:\Windows\System\zmNjHvf.exe
  C:\Windows\System\zmNjHvf.exe
  2⤵
  PID:7340
- C:\Windows\System\Ikjjkzs.exe
  C:\Windows\System\Ikjjkzs.exe
  2⤵
  PID:7252
- C:\Windows\System\pAHbZbH.exe
  C:\Windows\System\pAHbZbH.exe
  2⤵
  PID:7372
- C:\Windows\System\KKaIHUH.exe
  C:\Windows\System\KKaIHUH.exe
  2⤵
  PID:7280
- C:\Windows\System\HvZuMxC.exe
  C:\Windows\System\HvZuMxC.exe
  2⤵
  PID:8184
- C:\Windows\System\HhjvGRm.exe
  C:\Windows\System\HhjvGRm.exe
  2⤵
  PID:6496
- C:\Windows\System\ILHzYKJ.exe
  C:\Windows\System\ILHzYKJ.exe
  2⤵
  PID:7416
- C:\Windows\System\EPvCNVz.exe
  C:\Windows\System\EPvCNVz.exe
  2⤵
  PID:7452
- C:\Windows\System\MJCRpqH.exe
  C:\Windows\System\MJCRpqH.exe
  2⤵
  PID:7432
- C:\Windows\System\beoRxEm.exe
  C:\Windows\System\beoRxEm.exe
  2⤵
  PID:7636
- C:\Windows\System\DatMhZy.exe
  C:\Windows\System\DatMhZy.exe
  2⤵
  PID:7684
- C:\Windows\System\TfZrlHB.exe
  C:\Windows\System\TfZrlHB.exe
  2⤵
  PID:7716
- C:\Windows\System\AoLOZde.exe
  C:\Windows\System\AoLOZde.exe
  2⤵
  PID:7960
- C:\Windows\System\MJznHqD.exe
  C:\Windows\System\MJznHqD.exe
  2⤵
  PID:7972
- C:\Windows\System\ktgCyBi.exe
  C:\Windows\System\ktgCyBi.exe
  2⤵
  PID:7992
- C:\Windows\System\CrfoRVy.exe
  C:\Windows\System\CrfoRVy.exe
  2⤵
  PID:8008
- C:\Windows\System\ziMVopM.exe
  C:\Windows\System\ziMVopM.exe
  2⤵
  PID:8020
- C:\Windows\System\WjnCwRQ.exe
  C:\Windows\System\WjnCwRQ.exe
  2⤵
  PID:8044
- C:\Windows\System\kKShnqm.exe
  C:\Windows\System\kKShnqm.exe
  2⤵
  PID:8052
- C:\Windows\System\lwQuewg.exe
  C:\Windows\System\lwQuewg.exe
  2⤵
  PID:8088
- C:\Windows\System\SNDfcaC.exe
  C:\Windows\System\SNDfcaC.exe
  2⤵
  PID:6468
- C:\Windows\System\nwUoeLI.exe
  C:\Windows\System\nwUoeLI.exe
  2⤵
  PID:7296
- C:\Windows\System\NavcWVd.exe
  C:\Windows\System\NavcWVd.exe
  2⤵
  PID:7188
- C:\Windows\System\ehNHzgL.exe
  C:\Windows\System\ehNHzgL.exe
  2⤵
  PID:7136
- C:\Windows\System\pciarRA.exe
  C:\Windows\System\pciarRA.exe
  2⤵
  PID:5468
- C:\Windows\System\Qiliyko.exe
  C:\Windows\System\Qiliyko.exe
  2⤵
  PID:8152
- C:\Windows\System\XPxfvCO.exe
  C:\Windows\System\XPxfvCO.exe
  2⤵
  PID:7400
- C:\Windows\System\fMJYxGc.exe
  C:\Windows\System\fMJYxGc.exe
  2⤵
  PID:7632
- C:\Windows\System\UgSkNqu.exe
  C:\Windows\System\UgSkNqu.exe
  2⤵
  PID:7464
- C:\Windows\System\CsbqcyG.exe
  C:\Windows\System\CsbqcyG.exe
  2⤵
  PID:7748
- C:\Windows\System\tgOGLwb.exe
  C:\Windows\System\tgOGLwb.exe
  2⤵
  PID:7996
- C:\Windows\System\gxQdTfB.exe
  C:\Windows\System\gxQdTfB.exe
  2⤵
  PID:8072
- C:\Windows\System\VVCqrUL.exe
  C:\Windows\System\VVCqrUL.exe
  2⤵
  PID:7380
- C:\Windows\System\YWhuQiW.exe
  C:\Windows\System\YWhuQiW.exe
  2⤵
  PID:8148
- C:\Windows\System\OtDqWgF.exe
  C:\Windows\System\OtDqWgF.exe
  2⤵
  PID:7536
- C:\Windows\System\PFuqqGy.exe
  C:\Windows\System\PFuqqGy.exe
  2⤵
  PID:7548
- C:\Windows\System\MmAmTNa.exe
  C:\Windows\System\MmAmTNa.exe
  2⤵
  PID:7856
- C:\Windows\System\oLlVyPw.exe
  C:\Windows\System\oLlVyPw.exe
  2⤵
  PID:7944
- C:\Windows\System\ybpBxiY.exe
  C:\Windows\System\ybpBxiY.exe
  2⤵
  PID:7988
- C:\Windows\System\lWmegsB.exe
  C:\Windows\System\lWmegsB.exe
  2⤵
  PID:7564
- C:\Windows\System\KjiMAus.exe
  C:\Windows\System\KjiMAus.exe
  2⤵
  PID:6620
- C:\Windows\System\EdbSRXF.exe
  C:\Windows\System\EdbSRXF.exe
  2⤵
  PID:7912
- C:\Windows\System\gdXwBbn.exe
  C:\Windows\System\gdXwBbn.exe
  2⤵
  PID:7652
- C:\Windows\System\IMFLVwd.exe
  C:\Windows\System\IMFLVwd.exe
  2⤵
  PID:7568
- C:\Windows\System\nmBbsqU.exe
  C:\Windows\System\nmBbsqU.exe
  2⤵
  PID:8116
- C:\Windows\System\mPDilvk.exe
  C:\Windows\System\mPDilvk.exe
  2⤵
  PID:7584
- C:\Windows\System\pwGKsjE.exe
  C:\Windows\System\pwGKsjE.exe
  2⤵
  PID:6992
- C:\Windows\System\vbZsRcf.exe
  C:\Windows\System\vbZsRcf.exe
  2⤵
  PID:7500
- C:\Windows\System\QfaPKkg.exe
  C:\Windows\System\QfaPKkg.exe
  2⤵
  PID:7896
- C:\Windows\System\RxSwsJq.exe
  C:\Windows\System\RxSwsJq.exe
  2⤵
  PID:8036
- C:\Windows\System\nBwrGwL.exe
  C:\Windows\System\nBwrGwL.exe
  2⤵
  PID:7364
- C:\Windows\System\sRAZDKo.exe
  C:\Windows\System\sRAZDKo.exe
  2⤵
  PID:7268
- C:\Windows\System\jIAVAhC.exe
  C:\Windows\System\jIAVAhC.exe
  2⤵
  PID:8200
- C:\Windows\System\DmxAftA.exe
  C:\Windows\System\DmxAftA.exe
  2⤵
  PID:8216
- C:\Windows\System\IwAfNne.exe
  C:\Windows\System\IwAfNne.exe
  2⤵
  PID:8232
- C:\Windows\System\XEHVODe.exe
  C:\Windows\System\XEHVODe.exe
  2⤵
  PID:8248
- C:\Windows\System\CDukXGD.exe
  C:\Windows\System\CDukXGD.exe
  2⤵
  PID:8264
- C:\Windows\System\fxDTPng.exe
  C:\Windows\System\fxDTPng.exe
  2⤵
  PID:8280
- C:\Windows\System\pmpVexP.exe
  C:\Windows\System\pmpVexP.exe
  2⤵
  PID:8296
- C:\Windows\System\CxVvsOf.exe
  C:\Windows\System\CxVvsOf.exe
  2⤵
  PID:8312
- C:\Windows\System\XTauITc.exe
  C:\Windows\System\XTauITc.exe
  2⤵
  PID:8328
- C:\Windows\System\ITeYSvl.exe
  C:\Windows\System\ITeYSvl.exe
  2⤵
  PID:8344
- C:\Windows\System\BCSoukS.exe
  C:\Windows\System\BCSoukS.exe
  2⤵
  PID:8360
- C:\Windows\System\TsHfKmu.exe
  C:\Windows\System\TsHfKmu.exe
  2⤵
  PID:8376
- C:\Windows\System\OgAansy.exe
  C:\Windows\System\OgAansy.exe
  2⤵
  PID:8392
- C:\Windows\System\WAnfflq.exe
  C:\Windows\System\WAnfflq.exe
  2⤵
  PID:8408
- C:\Windows\System\EkbExYG.exe
  C:\Windows\System\EkbExYG.exe
  2⤵
  PID:8424
- C:\Windows\System\xBvOXyN.exe
  C:\Windows\System\xBvOXyN.exe
  2⤵
  PID:8440
- C:\Windows\System\VrFavaE.exe
  C:\Windows\System\VrFavaE.exe
  2⤵
  PID:8456
- C:\Windows\System\nVEEmfV.exe
  C:\Windows\System\nVEEmfV.exe
  2⤵
  PID:8472
- C:\Windows\System\cAyTfHr.exe
  C:\Windows\System\cAyTfHr.exe
  2⤵
  PID:8488
- C:\Windows\System\facCxbC.exe
  C:\Windows\System\facCxbC.exe
  2⤵
  PID:8504
- C:\Windows\System\dfsXibL.exe
  C:\Windows\System\dfsXibL.exe
  2⤵
  PID:8520
- C:\Windows\System\fknVMMJ.exe
  C:\Windows\System\fknVMMJ.exe
  2⤵
  PID:8536
- C:\Windows\System\mrShofJ.exe
  C:\Windows\System\mrShofJ.exe
  2⤵
  PID:8552
- C:\Windows\System\uqCGJEY.exe
  C:\Windows\System\uqCGJEY.exe
  2⤵
  PID:8568
- C:\Windows\System\YmxPCeM.exe
  C:\Windows\System\YmxPCeM.exe
  2⤵
  PID:8584
- C:\Windows\System\WDUuydE.exe
  C:\Windows\System\WDUuydE.exe
  2⤵
  PID:8600
- C:\Windows\System\vmdkUbw.exe
  C:\Windows\System\vmdkUbw.exe
  2⤵
  PID:8616
- C:\Windows\System\ugfJTIS.exe
  C:\Windows\System\ugfJTIS.exe
  2⤵
  PID:8632
- C:\Windows\System\BhgAWuF.exe
  C:\Windows\System\BhgAWuF.exe
  2⤵
  PID:8648
- C:\Windows\System\lqoLRaE.exe
  C:\Windows\System\lqoLRaE.exe
  2⤵
  PID:8664
- C:\Windows\System\hIIGZQa.exe
  C:\Windows\System\hIIGZQa.exe
  2⤵
  PID:8680
- C:\Windows\System\nsnjEJb.exe
  C:\Windows\System\nsnjEJb.exe
  2⤵
  PID:8696
- C:\Windows\System\CPJixXn.exe
  C:\Windows\System\CPJixXn.exe
  2⤵
  PID:8712
- C:\Windows\System\EqCqhKZ.exe
  C:\Windows\System\EqCqhKZ.exe
  2⤵
  PID:8728
- C:\Windows\System\qvXOEhR.exe
  C:\Windows\System\qvXOEhR.exe
  2⤵
  PID:8744
- C:\Windows\System\nmvIFPn.exe
  C:\Windows\System\nmvIFPn.exe
  2⤵
  PID:8760
- C:\Windows\System\PHskymh.exe
  C:\Windows\System\PHskymh.exe
  2⤵
  PID:8776
- C:\Windows\System\VbLjNqk.exe
  C:\Windows\System\VbLjNqk.exe
  2⤵
  PID:8796
- C:\Windows\System\MygxWuP.exe
  C:\Windows\System\MygxWuP.exe
  2⤵
  PID:8812
- C:\Windows\System\KYdYBzD.exe
  C:\Windows\System\KYdYBzD.exe
  2⤵
  PID:8828
- C:\Windows\System\pNtUIKi.exe
  C:\Windows\System\pNtUIKi.exe
  2⤵
  PID:8844
- C:\Windows\System\pWMwVEP.exe
  C:\Windows\System\pWMwVEP.exe
  2⤵
  PID:8860
- C:\Windows\System\JTIPlBk.exe
  C:\Windows\System\JTIPlBk.exe
  2⤵
  PID:8876
- C:\Windows\System\zoFIgMX.exe
  C:\Windows\System\zoFIgMX.exe
  2⤵
  PID:8892
- C:\Windows\System\PRtLqdM.exe
  C:\Windows\System\PRtLqdM.exe
  2⤵
  PID:8908
- C:\Windows\System\KKwzRXN.exe
  C:\Windows\System\KKwzRXN.exe
  2⤵
  PID:8924
- C:\Windows\System\nLTuFpV.exe
  C:\Windows\System\nLTuFpV.exe
  2⤵
  PID:8940
- C:\Windows\System\hTpspYd.exe
  C:\Windows\System\hTpspYd.exe
  2⤵
  PID:8956
- C:\Windows\System\cGVeWDq.exe
  C:\Windows\System\cGVeWDq.exe
  2⤵
  PID:8972
- C:\Windows\System\tWJVeNA.exe
  C:\Windows\System\tWJVeNA.exe
  2⤵
  PID:8988
- C:\Windows\System\vhLWHuv.exe
  C:\Windows\System\vhLWHuv.exe
  2⤵
  PID:9004
- C:\Windows\System\WjDusCp.exe
  C:\Windows\System\WjDusCp.exe
  2⤵
  PID:9020
- C:\Windows\System\zRXXSso.exe
  C:\Windows\System\zRXXSso.exe
  2⤵
  PID:9036
- C:\Windows\System\LbfeTob.exe
  C:\Windows\System\LbfeTob.exe
  2⤵
  PID:9052
- C:\Windows\System\GSKSyGd.exe
  C:\Windows\System\GSKSyGd.exe
  2⤵
  PID:9068
- C:\Windows\System\fRqITbp.exe
  C:\Windows\System\fRqITbp.exe
  2⤵
  PID:9084
- C:\Windows\System\QhbDvtS.exe
  C:\Windows\System\QhbDvtS.exe
  2⤵
  PID:9100
- C:\Windows\System\HlSihwd.exe
  C:\Windows\System\HlSihwd.exe
  2⤵
  PID:9116
- C:\Windows\System\iNogjxN.exe
  C:\Windows\System\iNogjxN.exe
  2⤵
  PID:9132
- C:\Windows\System\ygirPxm.exe
  C:\Windows\System\ygirPxm.exe
  2⤵
  PID:9148
- C:\Windows\System\zFXAnpe.exe
  C:\Windows\System\zFXAnpe.exe
  2⤵
  PID:9164
- C:\Windows\System\ZSmUjsa.exe
  C:\Windows\System\ZSmUjsa.exe
  2⤵
  PID:9184
- C:\Windows\System\CClfnaN.exe
  C:\Windows\System\CClfnaN.exe
  2⤵
  PID:7600
- C:\Windows\System\RIpqZjK.exe
  C:\Windows\System\RIpqZjK.exe
  2⤵
  PID:8304
- C:\Windows\System\CFDAFvA.exe
  C:\Windows\System\CFDAFvA.exe
  2⤵
  PID:8320
- C:\Windows\System\rPLRRXS.exe
  C:\Windows\System\rPLRRXS.exe
  2⤵
  PID:8260
- C:\Windows\System\KiHzhiy.exe
  C:\Windows\System\KiHzhiy.exe
  2⤵
  PID:7712
- C:\Windows\System\hoVtABz.exe
  C:\Windows\System\hoVtABz.exe
  2⤵
  PID:8324
- C:\Windows\System\UjCCisv.exe
  C:\Windows\System\UjCCisv.exe
  2⤵
  PID:8336
- C:\Windows\System\eSereNG.exe
  C:\Windows\System\eSereNG.exe
  2⤵
  PID:8384
- C:\Windows\System\XvypGNj.exe
  C:\Windows\System\XvypGNj.exe
  2⤵
  PID:8420
- C:\Windows\System\enwNqya.exe
  C:\Windows\System\enwNqya.exe
  2⤵
  PID:8496
- C:\Windows\System\EaEXEFw.exe
  C:\Windows\System\EaEXEFw.exe
  2⤵
  PID:8560
- C:\Windows\System\uixWsIu.exe
  C:\Windows\System\uixWsIu.exe
  2⤵
  PID:8656
- C:\Windows\System\tYGNjVV.exe
  C:\Windows\System\tYGNjVV.exe
  2⤵
  PID:8660
- C:\Windows\System\aZDTThv.exe
  C:\Windows\System\aZDTThv.exe
  2⤵
  PID:8720
- C:\Windows\System\COsCUEc.exe
  C:\Windows\System\COsCUEc.exe
  2⤵
  PID:8484
- C:\Windows\System\RqmnyJh.exe
  C:\Windows\System\RqmnyJh.exe
  2⤵
  PID:8788
- C:\Windows\System\PooTCxw.exe
  C:\Windows\System\PooTCxw.exe
  2⤵
  PID:8852
- C:\Windows\System\SCwdaoz.exe
  C:\Windows\System\SCwdaoz.exe
  2⤵
  PID:8708
- C:\Windows\System\grYetZT.exe
  C:\Windows\System\grYetZT.exe
  2⤵
  PID:8772
- C:\Windows\System\SiNYIcr.exe
  C:\Windows\System\SiNYIcr.exe
  2⤵
  PID:8416
- C:\Windows\System\upYHDKO.exe
  C:\Windows\System\upYHDKO.exe
  2⤵
  PID:8984
- C:\Windows\System\JOKhvQo.exe
  C:\Windows\System\JOKhvQo.exe
  2⤵
  PID:8644
- C:\Windows\System\WZjPVHm.exe
  C:\Windows\System\WZjPVHm.exe
  2⤵
  PID:8736
- C:\Windows\System\JqolNCx.exe
  C:\Windows\System\JqolNCx.exe
  2⤵
  PID:8516
- C:\Windows\System\AkcoWHG.exe
  C:\Windows\System\AkcoWHG.exe
  2⤵
  PID:9048
- C:\Windows\System\nwyKgmA.exe
  C:\Windows\System\nwyKgmA.exe
  2⤵
  PID:8936
- C:\Windows\System\pqypqgv.exe
  C:\Windows\System\pqypqgv.exe
  2⤵
  PID:8996
- C:\Windows\System\nKVSOvH.exe
  C:\Windows\System\nKVSOvH.exe
  2⤵
  PID:8932
- C:\Windows\System\uTZZORL.exe
  C:\Windows\System\uTZZORL.exe
  2⤵
  PID:8868
- C:\Windows\System\JKTVmnk.exe
  C:\Windows\System\JKTVmnk.exe
  2⤵
  PID:8964
- C:\Windows\System\KWuROPM.exe
  C:\Windows\System\KWuROPM.exe
  2⤵
  PID:9032
- C:\Windows\System\xUTtCIQ.exe
  C:\Windows\System\xUTtCIQ.exe
  2⤵
  PID:9096
- C:\Windows\System\xHduhNu.exe
  C:\Windows\System\xHduhNu.exe
  2⤵
  PID:8212
- C:\Windows\System\umZNmLf.exe
  C:\Windows\System\umZNmLf.exe
  2⤵
  PID:8276
- C:\Windows\System\rIShqtD.exe
  C:\Windows\System\rIShqtD.exe
  2⤵
  PID:9200
- C:\Windows\System\OaBbyoc.exe
  C:\Windows\System\OaBbyoc.exe
  2⤵
  PID:7876
- C:\Windows\System\ljRUxWt.exe
  C:\Windows\System\ljRUxWt.exe
  2⤵
  PID:8256
- C:\Windows\System\LVqPCty.exe
  C:\Windows\System\LVqPCty.exe
  2⤵
  PID:8372
- C:\Windows\System\snfHatI.exe
  C:\Windows\System\snfHatI.exe
  2⤵
  PID:8692
- C:\Windows\System\TjcEYVk.exe
  C:\Windows\System\TjcEYVk.exe
  2⤵
  PID:8920
- C:\Windows\System\hDIyrsH.exe
  C:\Windows\System\hDIyrsH.exe
  2⤵
  PID:8952
- C:\Windows\System\qgXzsNe.exe
  C:\Windows\System\qgXzsNe.exe
  2⤵
  PID:8804
- C:\Windows\System\EZOICaW.exe
  C:\Windows\System\EZOICaW.exe
  2⤵
  PID:8872
- C:\Windows\System\THxkvGU.exe
  C:\Windows\System\THxkvGU.exe
  2⤵
  PID:8808
- C:\Windows\System\cIOztWF.exe
  C:\Windows\System\cIOztWF.exe
  2⤵
  PID:9264
- C:\Windows\System\ZeLNbRk.exe
  C:\Windows\System\ZeLNbRk.exe
  2⤵
  PID:9280
- C:\Windows\System\QKuCOdX.exe
  C:\Windows\System\QKuCOdX.exe
  2⤵
  PID:9296
- C:\Windows\System\CWehSWI.exe
  C:\Windows\System\CWehSWI.exe
  2⤵
  PID:9312
- C:\Windows\System\Mmgslto.exe
  C:\Windows\System\Mmgslto.exe
  2⤵
  PID:9328
- C:\Windows\System\EtrrYTO.exe
  C:\Windows\System\EtrrYTO.exe
  2⤵
  PID:9348
- C:\Windows\System\KaBSPmb.exe
  C:\Windows\System\KaBSPmb.exe
  2⤵
  PID:9368
- C:\Windows\System\OOTQOSj.exe
  C:\Windows\System\OOTQOSj.exe
  2⤵
  PID:9604
- C:\Windows\System\NDYssfS.exe
  C:\Windows\System\NDYssfS.exe
  2⤵
  PID:9620
- C:\Windows\System\OCBzMfr.exe
  C:\Windows\System\OCBzMfr.exe
  2⤵
  PID:9640
- C:\Windows\System\fUAAWOC.exe
  C:\Windows\System\fUAAWOC.exe
  2⤵
  PID:9660
- C:\Windows\System\IQOKRjd.exe
  C:\Windows\System\IQOKRjd.exe
  2⤵
  PID:9676
- C:\Windows\System\osmjgMF.exe
  C:\Windows\System\osmjgMF.exe
  2⤵
  PID:9696
- C:\Windows\System\JMhaEwN.exe
  C:\Windows\System\JMhaEwN.exe
  2⤵
  PID:9712
- C:\Windows\System\CcTfRLW.exe
  C:\Windows\System\CcTfRLW.exe
  2⤵
  PID:9728
- C:\Windows\System\NlFLOPo.exe
  C:\Windows\System\NlFLOPo.exe
  2⤵
  PID:9744
- C:\Windows\System\tqdhYIa.exe
  C:\Windows\System\tqdhYIa.exe
  2⤵
  PID:9760
- C:\Windows\System\RqNPXFb.exe
  C:\Windows\System\RqNPXFb.exe
  2⤵
  PID:9780
- C:\Windows\System\GgUcySb.exe
  C:\Windows\System\GgUcySb.exe
  2⤵
  PID:9796
- C:\Windows\System\mZlTdYe.exe
  C:\Windows\System\mZlTdYe.exe
  2⤵
  PID:9812
- C:\Windows\System\QfHmyfJ.exe
  C:\Windows\System\QfHmyfJ.exe
  2⤵
  PID:9832
- C:\Windows\System\CGATfGg.exe
  C:\Windows\System\CGATfGg.exe
  2⤵
  PID:9848
- C:\Windows\System\iKBolJE.exe
  C:\Windows\System\iKBolJE.exe
  2⤵
  PID:9908
- C:\Windows\System\aqOsMdP.exe
  C:\Windows\System\aqOsMdP.exe
  2⤵
  PID:9928
- C:\Windows\System\aUlngda.exe
  C:\Windows\System\aUlngda.exe
  2⤵
  PID:9944
- C:\Windows\System\EtdHLHA.exe
  C:\Windows\System\EtdHLHA.exe
  2⤵
  PID:9960
- C:\Windows\System\JDQnrNy.exe
  C:\Windows\System\JDQnrNy.exe
  2⤵
  PID:9980
- C:\Windows\System\YigUZds.exe
  C:\Windows\System\YigUZds.exe
  2⤵
  PID:9996
- C:\Windows\System\gIBCAFT.exe
  C:\Windows\System\gIBCAFT.exe
  2⤵
  PID:10012
- C:\Windows\System\CoiODKd.exe
  C:\Windows\System\CoiODKd.exe
  2⤵
  PID:10028
- C:\Windows\System\kUBKNtk.exe
  C:\Windows\System\kUBKNtk.exe
  2⤵
  PID:10044
- C:\Windows\System\xfgTqvN.exe
  C:\Windows\System\xfgTqvN.exe
  2⤵
  PID:10060
- C:\Windows\System\eCQtkEE.exe
  C:\Windows\System\eCQtkEE.exe
  2⤵
  PID:10076
- C:\Windows\System\oXfCyHL.exe
  C:\Windows\System\oXfCyHL.exe
  2⤵
  PID:10092
- C:\Windows\System\BlRsvvM.exe
  C:\Windows\System\BlRsvvM.exe
  2⤵
  PID:10108
- C:\Windows\System\ZDTqoaJ.exe
  C:\Windows\System\ZDTqoaJ.exe
  2⤵
  PID:10124
- C:\Windows\System\BSVEBgw.exe
  C:\Windows\System\BSVEBgw.exe
  2⤵
  PID:10140
- C:\Windows\System\QjXTsMi.exe
  C:\Windows\System\QjXTsMi.exe
  2⤵
  PID:10156
- C:\Windows\System\EKNWOga.exe
  C:\Windows\System\EKNWOga.exe
  2⤵
  PID:10172
- C:\Windows\System\NJDWcFH.exe
  C:\Windows\System\NJDWcFH.exe
  2⤵
  PID:10188
- C:\Windows\System\dYQLOiW.exe
  C:\Windows\System\dYQLOiW.exe
  2⤵
  PID:7744
- C:\Windows\System\YHMpHBg.exe
  C:\Windows\System\YHMpHBg.exe
  2⤵
  PID:8904
- C:\Windows\System\yZadRCj.exe
  C:\Windows\System\yZadRCj.exe
  2⤵
  PID:9212
- C:\Windows\System\BGkVDlF.exe
  C:\Windows\System\BGkVDlF.exe
  2⤵
  PID:8068
- C:\Windows\System\eDSNBne.exe
  C:\Windows\System\eDSNBne.exe
  2⤵
  PID:8432
- C:\Windows\System\FZFJvRY.exe
  C:\Windows\System\FZFJvRY.exe
  2⤵
  PID:8452
- C:\Windows\System\UmtXHkv.exe
  C:\Windows\System\UmtXHkv.exe
  2⤵
  PID:8824
- C:\Windows\System\YOzUksa.exe
  C:\Windows\System\YOzUksa.exe
  2⤵
  PID:8676
- C:\Windows\System\wTXDExj.exe
  C:\Windows\System\wTXDExj.exe
  2⤵
  PID:9076
- C:\Windows\System\Mxnauwk.exe
  C:\Windows\System\Mxnauwk.exe
  2⤵
  PID:9228
- C:\Windows\System\vvXovou.exe
  C:\Windows\System\vvXovou.exe
  2⤵
  PID:9244
- C:\Windows\System\DJFbuSQ.exe
  C:\Windows\System\DJFbuSQ.exe
  2⤵
  PID:8464
- C:\Windows\System\WjLUWqr.exe
  C:\Windows\System\WjLUWqr.exe
  2⤵
  PID:9276
- C:\Windows\System\aUumLhs.exe
  C:\Windows\System\aUumLhs.exe
  2⤵
  PID:9340
- C:\Windows\System\SzVIrwZ.exe
  C:\Windows\System\SzVIrwZ.exe
  2⤵
  PID:9360
- C:\Windows\System\LjwJcBO.exe
  C:\Windows\System\LjwJcBO.exe
  2⤵
  PID:9292
- C:\Windows\System\ROKZCYx.exe
  C:\Windows\System\ROKZCYx.exe
  2⤵
  PID:9416
- C:\Windows\System\bUVxEvg.exe
  C:\Windows\System\bUVxEvg.exe
  2⤵
  PID:9384
- C:\Windows\System\OwLNogX.exe
  C:\Windows\System\OwLNogX.exe
  2⤵
  PID:9400
- C:\Windows\System\XynBmdg.exe
  C:\Windows\System\XynBmdg.exe
  2⤵
  PID:9428
- C:\Windows\System\CFNFpNW.exe
  C:\Windows\System\CFNFpNW.exe
  2⤵
  PID:9560
- C:\Windows\System\HLpfutl.exe
  C:\Windows\System\HLpfutl.exe
  2⤵
  PID:9576
- C:\Windows\System\wluIoUD.exe
  C:\Windows\System\wluIoUD.exe
  2⤵
  PID:9628
- C:\Windows\System\qAXWqrj.exe
  C:\Windows\System\qAXWqrj.exe
  2⤵
  PID:9708
- C:\Windows\System\jNOoGVn.exe
  C:\Windows\System\jNOoGVn.exe
  2⤵
  PID:9772
- C:\Windows\System\GUGcPkv.exe
  C:\Windows\System\GUGcPkv.exe
  2⤵
  PID:9840
- C:\Windows\System\JgLIMIJ.exe
  C:\Windows\System\JgLIMIJ.exe
  2⤵
  PID:9720
- C:\Windows\System\HparSdc.exe
  C:\Windows\System\HparSdc.exe
  2⤵
  PID:9788
- C:\Windows\System\UPecfMl.exe
  C:\Windows\System\UPecfMl.exe
  2⤵
  PID:9864
- C:\Windows\System\lNvFunH.exe
  C:\Windows\System\lNvFunH.exe
  2⤵
  PID:9860
- C:\Windows\System\pwEadft.exe
  C:\Windows\System\pwEadft.exe
  2⤵
  PID:9916
- C:\Windows\System\zXdhlKV.exe
  C:\Windows\System\zXdhlKV.exe
  2⤵
  PID:10020
- C:\Windows\System\RArKlRy.exe
  C:\Windows\System\RArKlRy.exe
  2⤵
  PID:10056
- C:\Windows\System\GNYjHXl.exe
  C:\Windows\System\GNYjHXl.exe
  2⤵
  PID:10116
- C:\Windows\System\rYeDfWH.exe
  C:\Windows\System\rYeDfWH.exe
  2⤵
  PID:10072
- C:\Windows\System\zcDmyiv.exe
  C:\Windows\System\zcDmyiv.exe
  2⤵
  PID:10132
- C:\Windows\System\KszVQFk.exe
  C:\Windows\System\KszVQFk.exe
  2⤵
  PID:10168
- C:\Windows\System\MuTvkyi.exe
  C:\Windows\System\MuTvkyi.exe
  2⤵
  PID:7388
- C:\Windows\System\BFGTfVK.exe
  C:\Windows\System\BFGTfVK.exe
  2⤵
  PID:10216
- C:\Windows\System\KxlyFGF.exe
  C:\Windows\System\KxlyFGF.exe
  2⤵
  PID:10232
- C:\Windows\System\pFNzqMR.exe
  C:\Windows\System\pFNzqMR.exe
  2⤵
  PID:8596
- C:\Windows\System\siPKQQz.exe
  C:\Windows\System\siPKQQz.exe
  2⤵
  PID:8608
- C:\Windows\System\psyvqlu.exe
  C:\Windows\System\psyvqlu.exe
  2⤵
  PID:8292
- C:\Windows\System\dgWrbGn.exe
  C:\Windows\System\dgWrbGn.exe
  2⤵
  PID:9324
- C:\Windows\System\uauzWKk.exe
  C:\Windows\System\uauzWKk.exe
  2⤵
  PID:9436
- C:\Windows\System\CvCZYxr.exe
  C:\Windows\System\CvCZYxr.exe
  2⤵
  PID:9392
- C:\Windows\System\gRlfORf.exe
  C:\Windows\System\gRlfORf.exe
  2⤵
  PID:9424
- C:\Windows\System\UBxKZWm.exe
  C:\Windows\System\UBxKZWm.exe
  2⤵
  PID:9440
- C:\Windows\System\btxLreP.exe
  C:\Windows\System\btxLreP.exe
  2⤵
  PID:9452
- C:\Windows\System\hmsTkUD.exe
  C:\Windows\System\hmsTkUD.exe
  2⤵
  PID:9468
- C:\Windows\System\KguBCOT.exe
  C:\Windows\System\KguBCOT.exe
  2⤵
  PID:9484
- C:\Windows\System\upFWLCP.exe
  C:\Windows\System\upFWLCP.exe
  2⤵
  PID:9492
- C:\Windows\System\ovYifsQ.exe
  C:\Windows\System\ovYifsQ.exe
  2⤵
  PID:9516
- C:\Windows\System\VUfITsp.exe
  C:\Windows\System\VUfITsp.exe
  2⤵
  PID:9528
- C:\Windows\System\BFsgpJB.exe
  C:\Windows\System\BFsgpJB.exe
  2⤵
  PID:9548
- C:\Windows\System\CNUqDJU.exe
  C:\Windows\System\CNUqDJU.exe
  2⤵
  PID:9584
- C:\Windows\System\FymyULt.exe
  C:\Windows\System\FymyULt.exe
  2⤵
  PID:9668
- C:\Windows\System\tFMqfQW.exe
  C:\Windows\System\tFMqfQW.exe
  2⤵
  PID:9752
- C:\Windows\System\sRCVQOf.exe
  C:\Windows\System\sRCVQOf.exe
  2⤵
  PID:9616
- C:\Windows\System\YEjqafx.exe
  C:\Windows\System\YEjqafx.exe
  2⤵
  PID:9740
- C:\Windows\System\zJXcyvz.exe
  C:\Windows\System\zJXcyvz.exe
  2⤵
  PID:9652
- C:\Windows\System\kvNVrpN.exe
  C:\Windows\System\kvNVrpN.exe
  2⤵
  PID:9956
- C:\Windows\System\WQdafhi.exe
  C:\Windows\System\WQdafhi.exe
  2⤵
  PID:9892
- C:\Windows\System\QkROhcq.exe
  C:\Windows\System\QkROhcq.exe
  2⤵
  PID:8272
- C:\Windows\System\pnPjQnO.exe
  C:\Windows\System\pnPjQnO.exe
  2⤵
  PID:9992
- C:\Windows\System\ZFrgEAO.exe
  C:\Windows\System\ZFrgEAO.exe
  2⤵
  PID:10040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AQTnhkK.exe

Filesize
1.9MB

MD5
e39baa1e00d62a06f1eaf20d4e54070a

SHA1
1ab0d074e91012bde4401f206416d16e7c4480d3

SHA256
5b2431d4911d0e1b64bf7600d20f9d828d92f4e8ab850b2cd0a122e4aa2b325c

SHA512
18375b205f36b7924cc389d86f229607792859ad304c4d6051bc7b466313f29b89c368e82c6db7c5110362e80557d30968fb113c0a8045bbc9f18a7ff55b431e

Download Submit
C:\Windows\system\ASpkLMe.exe

Filesize
1.9MB

MD5
3b5e09b548d8c99e37d2980c36d5bb44

SHA1
949daad8032393bc11436986110f675308f8e13b

SHA256
4844c066e4469e2976cc68c74b7d8ac04f493cf5aa82de40e632be172dc0d670

SHA512
d62edca29880d61afc4b6b565fee08febc978ade77912f8157e34ce35e74d30678c03ba30b1df72473be96feab45c7117a4f0f0ddd1e62d881dd2ce47ed02c79

Download Submit
C:\Windows\system\DTBhpun.exe

Filesize
1.9MB

MD5
1f7b6375400ac281c59f6ee948174bcf

SHA1
103e4ae5371159c30016cec4945610a9cae1b6d5

SHA256
56bee6ec4461744b44e12743e3efa3d3e0e9c0cfcbd719b18bb43a74bd4c9264

SHA512
0af0ca0c15f14305366cd1423475c238a0dbe2289ac58fcea3c521151fcbce5162a153b767918ba30a4df0287dfb3b85842c3e4e1badf8dc79c6518a9023dc01

Download Submit
C:\Windows\system\GoYrXXt.exe

Filesize
1.9MB

MD5
ad8b5927cdad339d4bf0e0bd57b34ad8

SHA1
1b024a5edf17aa1666a231fb54156e9f1879f9ea

SHA256
e6b0263363ba9093c65569d0168a607c3f3234f8408cd61f8e260469aba28159

SHA512
897eb6925a88040aeaaec94c4fb116a33016628fafe42d1035363a15480feec1990d55a82d4b74eee762d3d093df81aa582bf505d0fb2b621f96ae4ecd3145fe

Download Submit
C:\Windows\system\Gqkiasu.exe

Filesize
1.9MB

MD5
a9b932401400deae151a7c98a0d17f45

SHA1
8713cf25f132739e9bde958e30ff61977bc78f25

SHA256
83a2448426974a6674abc30c1af3c4828dda64b6d073612ca0af82d42bc0a0fa

SHA512
18e0ce39f90fb76c8c452179929b039f7d83879197daed4dd3798ae8ac61ba9f90182b4b4321c026f3a4e77d15377ee8b8881a40c177f6895a97720d0c53ce3b

Download Submit
C:\Windows\system\GuLmkQa.exe

Filesize
1.9MB

MD5
9e9f2273be40b39212ff5f72c1dfb8d5

SHA1
edc946cc84449e075d4b77f6773ab0c71e8db781

SHA256
b1c18a0df3cf398f0e50b60f52a5da78dc3d2a952e0a3169a58f908ac23f947e

SHA512
de6f967ac9bb0ad33cdab682d131997f3512e9b5cd6b64f4e1b46409a279afe26abf56d2f95734f881b508c249fb0bb6693786439caa474af0883148c962a874

Download Submit
C:\Windows\system\IDuRqfR.exe

Filesize
1.9MB

MD5
a5777f1cad22295eeefc83b752ce0c4d

SHA1
c4341222326d3a85582f90110941dc5157d6167c

SHA256
0db6f2cea1c7c23562571f4d0fa8079ebfa880f25994a217548c4c1a4b17cd1b

SHA512
007613e0f6ac815c3065985dc0bfa39e8e03055173c0edfff6534e59f5cee1e740cb35673cf023549f9c24225c3bfd02a49a121cd4d047ec088a5d4875f52d64

Download Submit
C:\Windows\system\JSSTUhQ.exe

Filesize
1.9MB

MD5
62cba8447c84ced8381187e723904aac

SHA1
a145039ca8db732594edb4beecdd7f0ce0c353b4

SHA256
6d4f67ba11b805e8b388249268bc9e2f3c15508a98fa865db6239dda97caaa9e

SHA512
056842b429675bb1e31b1681bf5af1ac3a1558ac363043f11e5ab192807b3e6cef615fcf09170e9d7db479d1d14c6e2c1b92e0331a2d24716cf50ada0c18ecba

Download Submit
C:\Windows\system\LdFRRfk.exe

Filesize
1.9MB

MD5
ee3b4f2d0458c9b666edf8260c141485

SHA1
d9edf4bff07d6e16e5d7f476756c3b3f68bd1f7b

SHA256
16633fd8ab29e873c4b0ec0d053dc6d54e08a6437287fbe70c6e58a8312f9245

SHA512
fe08e438283f9455afdb7b3e7b4c9cff894bcf6ff6a7ea4659b4c0fb6fdae4c1e6389ab917917ef19a79b9aa5ec4c4311ff7da898e52eafac56215373e8cc378

Download Submit
C:\Windows\system\ORWySGX.exe

Filesize
1.9MB

MD5
635daaf7293eabe19459ce34d5f0e9a1

SHA1
c5a02041085600cb86e84e3e51334f1faab86006

SHA256
6c5e316c9d6e7dee24cbe369c632dc3d2302738d22a9712cff6eee7439517c46

SHA512
10895fb4ccd5939429bf8924e5bd7337658d15b95e0cc9305b565029bcfdc2047e040446a0e3425f681dc37f9816e8247fca60b6dc65f6f62210aae748ad6cc8

Download Submit
C:\Windows\system\OowVUlI.exe

Filesize
1.9MB

MD5
6d3d5126b49980e8a4deb75b39f51cec

SHA1
159c4d26e8b1efef0a558df170f78026e8a8066a

SHA256
f4efb52aa08e6ce48e1cac5efcf148cdcaf07099115cc44f36c527947279f829

SHA512
09165805482767f8b9c41a80b4e44281410d265ee3a7d65b866dd6a7d9529eb3c397263f955797e1a54efc14c5e31ff305226ee831b707894591cf5aadb44a7d

Download Submit
C:\Windows\system\QMCfyAY.exe

Filesize
1.9MB

MD5
8ae3038abb9e32c1a9cdf4d6d98284b6

SHA1
170d5622bfda4ce320d2429730dbc32957c58198

SHA256
b192fbe2c915283ecfad056448dd941a2150a05ef6586681eb5059b62354d5fa

SHA512
1ab5610935054901eba0637875069919795166f95fedd5e24dbb6423d3c340df0dd7cf7fa7510a3dd19555277238754e19eef7f3560cb3b2138584c2d402fa51

Download Submit
C:\Windows\system\STkYmyK.exe

Filesize
1.9MB

MD5
8009c4a0caa1c7e744b282b1c392f19b

SHA1
08ab965ab01f23e7551e6f5c3387d90fa7171aa3

SHA256
4f949d6f03d974520845144b27a8cd6d87e5b7582e5f8b5a46db0f6cd6115a94

SHA512
e4b9a5f9f7589f8bb45becdb746e99fc0ef9ea4cab6643ef46a92be960fa877a8efc8d5671b966b298dc9ff10990bc42ed3d170c6a73c55e1c187260eddaecd5

Download Submit
C:\Windows\system\WXslMwP.exe

Filesize
1.9MB

MD5
43f7dfb2056455708809ce69d18db5b5

SHA1
3d4879eb93f8ef20809a9d69d62b4d9b3a915846

SHA256
2fb9ded0d908459e75e280fcf4d6ec75555554ccebf2c41937821b5e8984901a

SHA512
749d844d3dca036f1746f8f49c34923e8df71579d7470ed28f8a04aace2382f2e6d4c17f418a1f28823f3d572cc9186fa02ae856fdd34c984f72b760d6bc2fa5

Download Submit
C:\Windows\system\dQestpu.exe

Filesize
1.9MB

MD5
b4eb71a42636c9eaa1fb96e5e3c6243f

SHA1
94da907b1caed9e7f1da9110461f5438cb412e96

SHA256
5ab64c8a089ae0dfc6cb5f9784e6e2f1bbe7dd407512fe48a60f8958426f5f2f

SHA512
bdbfddf5eaa8084f8ff1895021d30ca225aa511e5a201d23ab33a15ba2859d0cdb95c8d22ce2fc99cfeea670db915681364d28e4b8f55e0a28fe35df428bc8bc

Download Submit
C:\Windows\system\dSuyMSG.exe

Filesize
1.9MB

MD5
d8bf67605885abac9df63aebf8169981

SHA1
a0030c327a25b191ccd151534779afbf97a8966b

SHA256
45b86143ecd3623ea24114ef4b4e8429457c96f718f5bfb804c4c93814379766

SHA512
35960f0b5959d56c734f750453655b1126ddcc035e282218adf9f027d772b3826d51ae22d793303e23f9e4a91eab9ebe9791469d55389ec7ed49c20b890b4ced

Download Submit
C:\Windows\system\gsqECvu.exe

Filesize
1.9MB

MD5
695019d5fb1c83aee4dbda24e3c80c65

SHA1
546edf3055c14e3e6e9068e2d9eec0b43418105a

SHA256
54daf2227bf74814863cda0326d26d4bc348001c7789b3144d92bf63bcd3ce76

SHA512
6a377431e7db57c3adc1fb2e8df28049e5b5ad508566af6dbbb5d7f0606146a69acd46b1c503876fb7e623eb40f0a68e234e29384a9de9ebfd0fb96de8eadcb4

Download Submit
C:\Windows\system\hkbzHam.exe

Filesize
1.9MB

MD5
4a5fef3c2fc0a9e070860d5d930b7bf5

SHA1
749ddae24f4ad0195d8f6ce6f41a7116c90341c8

SHA256
2177d981c3703dd323b76c72c5b72a51d673fc392f6ea95268287876c10355a5

SHA512
9f113fa9d7947f10e7b636ce3a93ada7ee19c7e67e21b8600b17776bee68d2198285b6fb3fe7ef8d92b2dc64cc010bd4f9a101a083e8db322d7e20d6b494406e

Download Submit
C:\Windows\system\jYNrcaV.exe

Filesize
1.9MB

MD5
5d8e9faa4d6e993363b511ea73a19d97

SHA1
4a97fa8dd4edb5d89450ff55cf3b86a94a0d1294

SHA256
be3c95bd673e9a71a45aeadae41d9d17a1a0c54d56d14b2a92cec7813766a9d9

SHA512
ff56894351e74e1cd9a3aea628ca87ec4880b581bbb693c24292fed91460b6c85f6b9e33e933e0e7da5b712a5edafca85a8501cf3e006eabc082d1744e5c5fd0

Download Submit
C:\Windows\system\mGdyydk.exe

Filesize
1.9MB

MD5
fc3aa677cdc351c8ff8325489b178fc5

SHA1
766009c9400f1a6145fb2d046bec91b9a7d4989a

SHA256
fa80729bd4f00dddbe371dbfaf1ef891ee6aa8ffa26d3a456c8c086c00316bc5

SHA512
1809dc456d7e958acf4fd2198d9275c41cec764ddafe7898e60b5cd4914224d631218f4eaef8fc9167b43cfeeed85f0ca80cd3158542677c31f11443a18be36a

Download Submit
C:\Windows\system\mJocEeM.exe

Filesize
1.9MB

MD5
272f5d966b176b940b2745137dcb621f

SHA1
a93ff7a3c431c79d93cf24a2ce883aca5016f834

SHA256
3d50a4530ec359bbbb1bdd403290f3009ea020b0d77aaf1c65cf806ad79b6e10

SHA512
18fe415c1cc1065d3a99304887b4282b838ffe66054bcb94f211bd41164bead830a05ce8fde8f493e37b9165b0c4c92ef4e9c619f1a0f69aa8e7863c0017d4fb

Download Submit
C:\Windows\system\oMnpPPj.exe

Filesize
1.9MB

MD5
e3a4f98175cf32f923e9a304189e2ad2

SHA1
d960cfe6cbb340d50d55377f43a7c8af65ebd679

SHA256
6b8c414e17059dbff97a68e9fb1bd82f5f4a2bdb939f604595e6294a4d124305

SHA512
9bd7e9fb54b85db7ff2d9dfc39709379666c09ecbedaa9f163ede2533aa1cfd17f5ba23dc05a307bf75de00a5a91156ffb103a0737f6a6d7ddb610ac05ff4e9a

Download Submit
C:\Windows\system\qutLwBc.exe

Filesize
1.9MB

MD5
61c14f1a01f0c060b66eb6931f82ce39

SHA1
308564f8a686c41e531d330e1f30f3124fd1e19f

SHA256
7b239cf574cedb243fd7b1a7223dc6e96bc885bf61cfa77cc1971b8c2491b51d

SHA512
57c43aa5b246b44c1a6c47171ba1eab60873fc75704d04f9c2ce0d5e9b2cd06a82badb9dad22364de28e5d87874c5c382536f0b1b2a79b34c3694e84b83a1c26

Download Submit
C:\Windows\system\srUEotI.exe

Filesize
1.9MB

MD5
a88388a8b4d3d4b59601888c3f0a7ab9

SHA1
8736322e1ee564d032bd4afc810884d971c96999

SHA256
d6553c5e9df64e6ea18ae8e0888e686e4ad67529c60274eec0415ac7db1c2301

SHA512
31251db21165a8c4604939b0d22fc15731218d3d77b63e3ad7098f74837a4f8030aa0293932f8cef47dddcfb94020c715d93dba46a41dda2b704e3e141dd1a69

Download Submit
C:\Windows\system\wBBeiNd.exe

Filesize
1.9MB

MD5
20c09535e9d99de8dff41c626b7e75f2

SHA1
798fb27e548aefd8da95bcbe6ae2b8fd31a38647

SHA256
b7e3813a356d95327787e435fc73f8d23888d251003188c08aeb3539b99cf5f4

SHA512
7fc75abbd8e3d243644ae0a889afccd2e7f0803b0bf50551cf90998b193a1bc4c6c6a841b8bf9dec1b1d0f927e4fd2f31608066b1e78460db2dc8f500e8d0e44

Download Submit
C:\Windows\system\zTFmHMm.exe

Filesize
1.9MB

MD5
e637ec389e0d5892e9e81e3d987b6303

SHA1
af33f0524edc020467c9711c2212063e0c6c51db

SHA256
5403d0b71b58e2dcba2b8b30a610aaa24180bd7bd2ad3c43b29cd091913ce376

SHA512
45a12dfca3e0a00c84faa234ebe23824d584cd7baf696b7ceb18917df552f06f9f6162d20644b922ae7fa6aaf46328648c7027a4f9c094e4da11124facebb933

Download Submit
C:\Windows\system\zpjPTkC.exe

Filesize
1.9MB

MD5
e860af783bc66dca6f6fb857a734ce78

SHA1
7381dc8b8c9b3434e4e70dfb5c5ac9e88b5af093

SHA256
21df619adc228826a144c9e6c9720b51139f472501bc4cc7be2f905f84f4808e

SHA512
c90883781a747f0ac4d4912f3ea1541bba5f92423ba28ca2661007738f1beeab3638110de79b59dd8bc279f4147cc3cbff2dd49398108a2ee63ef3cbeb58d385

Download Submit
\Windows\system\CJHbnBl.exe

Filesize
1.9MB

MD5
4eb834d9d79c4f149e57a288f70aa7c9

SHA1
4a812a5d618d95be751e9660a48a70b7b1c83511

SHA256
afafe3f94c24d424cf33d7a738ee721ac695bd086714a2be03f06ecf176a2403

SHA512
5769291d837d5828d5e616d349b4842ad540350e86ba8f985906d6bf1e4fe6900fd2b02bc51e289f0c5069dd45941fa9acb81e58c4ec54773621e34988329fa7

Download Submit
\Windows\system\LdCnYWo.exe

Filesize
1.9MB

MD5
3b747997a24b137977493483214137af

SHA1
362a5274ad62b1e00acc47daa7ecacb833dff675

SHA256
7dc185ef97da74e2ea49a4cb29c2b365ac30891a0c4154de225c330fef28fa28

SHA512
a5a6a29e73dffbc778a7505f4bbb2dabe3a00f8e3367949d86daae1999f285105afcd45d3159b861a0896d930306cf6e8cf5e514140b30e525c6dcd7e6bdcb5d

Download Submit
\Windows\system\UcWySCx.exe

Filesize
1.9MB

MD5
f86ea6cdff43ed3b23f76abc365bd89e

SHA1
6e6a75f7db9e47692e218638dfcd671a8c481dc5

SHA256
79e6aa08176800191082e371370a19c25dbff108a2efa645352e98a797edf480

SHA512
b78395b116b386189e788780029919378f0d139ba0bf26bcef619b96d4fb9892082c5f019b7ba0312142bda95a576d0e9ef361800af592102660114be5b48f42

Download Submit
\Windows\system\UkpvqDy.exe

Filesize
1.9MB

MD5
57f09bf2c6996df498a5074a0bffca46

SHA1
385fbfba2026b7346f3dc7e981853948c7cbb98d

SHA256
ad7027492509935dd6f93ca4f80c327f49b070a3c2bc313f665b1d76db9a5fa4

SHA512
fefb36b8e049f8e985c3db85b860e6a68c6d50441ff5b70f8a1e143449d221bdd44e47d00d4d1204cf50a61cf2e60d409dc0446edb2017080cc049dcbbba27a1

Download Submit
\Windows\system\YWDyEmQ.exe

Filesize
1.9MB

MD5
0dd99e813471365ae3b9b88881fd6d3e

SHA1
6521321609e3731c74fc248ee4eb3a609971de37

SHA256
a71a85088893a08cfeb3f82932efc14686d8c8b23691b641eb7bace87175b433

SHA512
bc5fc746db88674ada1e04ab3e8b1f5fabd79a7c7fe7f59ff3cd87d45c553090d286a50f1b4b55b59fbaed31c9022dc835142c4684b233e5b58b137b2437b5e7

Download Submit
\Windows\system\vwbDAfq.exe

Filesize
1.9MB

MD5
48226498167282b350dc10d044f5a895

SHA1
5d39ac7b55facc919ccfdd2db559b457fc57361e

SHA256
2e96945a87003a5b393b5b39343ccc13365d6a4a831b6d09bf6dc7ad3ce702f3

SHA512
79335e2cf4decda6fdf1b63c359bbb32e7098fe4de72e8ce91fa51a68af53f9fc49027ca69cbb99b7e47090f8881bc1ea513403ed1a17335ddf729290550ad86

Download Submit
\Windows\system\wKJawSt.exe

Filesize
1.9MB

MD5
361f41a8889b812f83a49891fdc151f7

SHA1
a821009e54848336932922abae07483b24f6f77d

SHA256
c8c4980392a18aa3b607c4e34db8ec82c4f7cae613dbcb973b7129ed02ac25e2

SHA512
d03abe4a2cf976b8b64780c422d10d17318b9bd8380db372244e9456172da5ade571aa14d4d7bdeeedab2fcbb584846d07aede8d7905adc9cba77be17df77df1

Download Submit
\Windows\system\xRNQjYY.exe

Filesize
1.9MB

MD5
b3d966e71c80c05eb28b3035d2353105

SHA1
87a0da2a4ceb29586522ce9110396aa6e3c2ee29

SHA256
c585ad8678df13cc881e8c40376f96dfe63705b80fbdb5da4fa3e436fedca255

SHA512
d389ca73367c91436de4f91c5942a82a597b7a89229953ded0b3dc723266d319e187b6ee04f784849c355c12f022e089a781562bd76c7d2fe01dc53cee7b53f9

Download Submit
memory/1888-97-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2024-101-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2428-95-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2440-81-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-93-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2588-87-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2604-80-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2604-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2604-79-0x0000000003580000-0x0000000003972000-memory.dmp

Filesize
3.9MB

Download
memory/2604-98-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2604-102-0x0000000003580000-0x0000000003972000-memory.dmp

Filesize
3.9MB

Download
memory/2604-96-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-100-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2604-105-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2604-92-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2604-91-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2604-12-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2604-1-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-13-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2820-99-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2904-103-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

Filesize
9.6MB

Download
memory/2904-74-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

Filesize
9.6MB

Download
memory/2904-392-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

Filesize
9.6MB

Download
memory/2904-36-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/2904-14-0x0000000001DD0000-0x0000000001E50000-memory.dmp

Filesize
512KB

Download
memory/2904-28-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2904-89-0x0000000001DD0000-0x0000000001E50000-memory.dmp

Filesize
512KB

Download
memory/2904-104-0x0000000001DD0000-0x0000000001E50000-memory.dmp

Filesize
512KB

Download
memory/3068-78-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download