xmrig | a761c06379bc49f5f7e6407ba02591fb7b2378fdde8abf75f5c72c69a5a8e26f

Analysis

max time kernel
36s
max time network
37s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
Size

1.9MB
MD5

04724294f71b11d6dc6f56157d14fe21
SHA1

6d685c2bd426ad5ee5cb11e6d78caae44e393f75
SHA256

a761c06379bc49f5f7e6407ba02591fb7b2378fdde8abf75f5c72c69a5a8e26f
SHA512

787fd9ce25c9c1630e806edd8edd6c13de530cd651cbd655bc37d3b3ea80d716bb4a7505f3346a83e86a0d56a13c06e6e46eb1ef47cfa62e32664f8a367285c5
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlLdx:NABi

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2484-17-0x000000013F850000-0x000000013FC42000-memory.dmp	xmrig
behavioral1/memory/2628-40-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2980-83-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2428-82-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/2308-80-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2516-77-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2624-75-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2736-73-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig
behavioral1/memory/2512-71-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2484	WULgXmb.exe
2628	FKbggmD.exe
2512	ketJAJL.exe
2736	guUENVn.exe
2624	VyQObOB.exe
2516	deEdPSt.exe
2308	BRbqMuK.exe
2428	ZDnskPV.exe
2980	DFUTkml.exe
1608	eaquugE.exe
1580	YCrooFW.exe
1800	cnvZsgx.exe
272	fkoiJkc.exe
332	JXMaROu.exe
1808	JZGwibE.exe
2304	cdQdwlW.exe
864	lKIJDQL.exe
1184	hcNeJvy.exe
3056	IcDjTmB.exe
2704	HfIEYiE.exe
2256	zDqRFeT.exe
1264	hAQjNmP.exe
2320	JxqUsjK.exe
2996	BcJIslM.exe
556	noYONWz.exe
592	zBOYIOu.exe
624	tqtThna.exe
2672	xXaGurk.exe
1080	WuvioPx.exe
1584	jVhOTzc.exe
1884	zWLipvL.exe
2976	MNuwQyP.exe
1628	yyunRAl.exe
1304	APWMvCb.exe
1508	RsCctWA.exe
976	mUYqJxK.exe
1000	lQFLVeI.exe
3000	VjETELv.exe
1700	qNsPQTZ.exe
924	WFFrFud.exe
1568	XCQbeiY.exe
2212	Ysynyib.exe
2244	KwVsXqS.exe
2840	MPpWTcH.exe
3004	PbOZFvA.exe
2240	ciHZvAa.exe
2844	QzOHgRz.exe
276	HeMNYfA.exe
904	usqToTo.exe
2288	GMYEslN.exe
3044	IrlVmmq.exe
1504	XZtRknz.exe
1648	jgEoJgs.exe
2572	GVvgAno.exe
2504	cKouiYI.exe
2400	QsWfOPz.exe
2548	lqLcWVN.exe
2376	QeeeZEV.exe
2808	iDCgKVq.exe
2296	rMDnjSf.exe
2620	PyRVhAb.exe
2496	dwRxjeW.exe
1556	XLWIdiG.exe
2592	PGTuuUa.exe

Loads dropped DLL 64 IoCs

pid	Process
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3036-0-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/files/0x000b000000015d61-3.dat	upx
behavioral1/files/0x0034000000016122-9.dat	upx
behavioral1/files/0x0016000000005586-22.dat	upx
behavioral1/files/0x0008000000016a28-31.dat	upx
behavioral1/files/0x0007000000016c1f-34.dat	upx
behavioral1/memory/2484-17-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/files/0x0007000000016575-21.dat	upx
behavioral1/memory/2628-40-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/files/0x0007000000016d18-48.dat	upx
behavioral1/files/0x0006000000016d85-54.dat	upx
behavioral1/files/0x0008000000016c38-53.dat	upx
behavioral1/files/0x0006000000016da9-60.dat	upx
behavioral1/files/0x0006000000016e56-89.dat	upx
behavioral1/files/0x000600000001738c-111.dat	upx
behavioral1/files/0x00060000000173dc-122.dat	upx
behavioral1/files/0x000600000001748d-146.dat	upx
behavioral1/files/0x0005000000018674-166.dat	upx
behavioral1/files/0x000500000001877f-171.dat	upx
behavioral1/files/0x00050000000191dc-191.dat	upx
behavioral1/files/0x00050000000191d7-186.dat	upx
behavioral1/files/0x00060000000190bc-181.dat	upx
behavioral1/files/0x00060000000190b3-176.dat	upx
behavioral1/files/0x000d00000001865b-161.dat	upx
behavioral1/files/0x0006000000017510-151.dat	upx
behavioral1/files/0x000600000001864a-156.dat	upx
behavioral1/files/0x0006000000017472-141.dat	upx
behavioral1/files/0x00060000000173e7-131.dat	upx
behavioral1/files/0x000600000001745d-136.dat	upx
behavioral1/files/0x00060000000173df-126.dat	upx
behavioral1/files/0x00060000000173c5-116.dat	upx
behavioral1/files/0x000600000001737e-106.dat	upx
behavioral1/files/0x000600000001737b-101.dat	upx
behavioral1/files/0x0006000000016f7e-94.dat	upx
behavioral1/memory/2980-83-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2428-82-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2308-80-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2516-77-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2624-75-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2736-73-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/memory/2512-71-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/files/0x00330000000161ee-66.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TVUAUiV.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\IdPDNug.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\WqaTBlI.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\AwTiJTt.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\vnPiwEX.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\UCPzHoe.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\WYMmlbw.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\EIVjseb.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\NiBpNvp.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\YlgkUzX.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\XfPdbiW.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\QmsZBzg.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\ZSReWQL.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\AnYLKAo.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\rULuloo.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\FxtpBkt.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\mUYqJxK.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\CpGVYha.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\pYATqbB.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\sWFUTNt.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\YhHyjrY.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\hwvPXGN.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\HdBmhiT.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\IgPsKeD.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\aRFwDeQ.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\vDGxKPe.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\yCAZhWE.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\PbOZFvA.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\Utzqyrh.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\gWCcboD.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\mPoFhLv.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\mCyEjPW.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\xyJnIhU.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\ahMzOSN.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\BRbqMuK.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\PyRVhAb.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\ejNjJQt.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\CgggvSd.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\WxVfUKy.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\ByNPltH.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\kLpNeUA.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\MLlNhBt.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\AKFgjMv.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\TbRJLvp.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\HaPpUDG.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\imKNEpB.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\NlDkYHH.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\UbDoKCR.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\CVXywzT.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\wwTHuFO.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\ewtOBjv.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\OCYDyav.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\brNzTyI.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\dAIgFNU.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\WXHfsfe.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\NMetAfl.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\iYNHrSr.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\jrWMiCB.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\rzhiham.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\gDvTDSk.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\rFJjriH.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\AhXZkHV.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\YdOEhzR.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
File created	C:\Windows\System\MTycXPd.exe	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3052	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeLockMemoryPrivilege	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3052	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	29
PID 3036 wrote to memory of 3052	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	29
PID 3036 wrote to memory of 3052	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	29
PID 3036 wrote to memory of 2484	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	30
PID 3036 wrote to memory of 2484	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	30
PID 3036 wrote to memory of 2484	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	30
PID 3036 wrote to memory of 2628	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	31
PID 3036 wrote to memory of 2628	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	31
PID 3036 wrote to memory of 2628	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	31
PID 3036 wrote to memory of 2512	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	32
PID 3036 wrote to memory of 2512	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	32
PID 3036 wrote to memory of 2512	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	32
PID 3036 wrote to memory of 2736	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	33
PID 3036 wrote to memory of 2736	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	33
PID 3036 wrote to memory of 2736	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	33
PID 3036 wrote to memory of 2624	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	34
PID 3036 wrote to memory of 2624	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	34
PID 3036 wrote to memory of 2624	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	34
PID 3036 wrote to memory of 2516	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	35
PID 3036 wrote to memory of 2516	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	35
PID 3036 wrote to memory of 2516	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	35
PID 3036 wrote to memory of 2428	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	36
PID 3036 wrote to memory of 2428	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	36
PID 3036 wrote to memory of 2428	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	36
PID 3036 wrote to memory of 2308	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	37
PID 3036 wrote to memory of 2308	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	37
PID 3036 wrote to memory of 2308	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	37
PID 3036 wrote to memory of 2980	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	38
PID 3036 wrote to memory of 2980	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	38
PID 3036 wrote to memory of 2980	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	38
PID 3036 wrote to memory of 1608	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	39
PID 3036 wrote to memory of 1608	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	39
PID 3036 wrote to memory of 1608	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	39
PID 3036 wrote to memory of 1580	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	40
PID 3036 wrote to memory of 1580	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	40
PID 3036 wrote to memory of 1580	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	40
PID 3036 wrote to memory of 272	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	41
PID 3036 wrote to memory of 272	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	41
PID 3036 wrote to memory of 272	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	41
PID 3036 wrote to memory of 1800	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	42
PID 3036 wrote to memory of 1800	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	42
PID 3036 wrote to memory of 1800	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	42
PID 3036 wrote to memory of 332	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	43
PID 3036 wrote to memory of 332	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	43
PID 3036 wrote to memory of 332	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	43
PID 3036 wrote to memory of 1808	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	44
PID 3036 wrote to memory of 1808	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	44
PID 3036 wrote to memory of 1808	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	44
PID 3036 wrote to memory of 2304	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	45
PID 3036 wrote to memory of 2304	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	45
PID 3036 wrote to memory of 2304	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	45
PID 3036 wrote to memory of 864	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	46
PID 3036 wrote to memory of 864	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	46
PID 3036 wrote to memory of 864	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	46
PID 3036 wrote to memory of 1184	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	47
PID 3036 wrote to memory of 1184	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	47
PID 3036 wrote to memory of 1184	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	47
PID 3036 wrote to memory of 3056	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	48
PID 3036 wrote to memory of 3056	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	48
PID 3036 wrote to memory of 3056	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	48
PID 3036 wrote to memory of 2704	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	49
PID 3036 wrote to memory of 2704	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	49
PID 3036 wrote to memory of 2704	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	49
PID 3036 wrote to memory of 2256	3036	04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04724294f71b11d6dc6f56157d14fe21_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3052
- C:\Windows\System\WULgXmb.exe
  C:\Windows\System\WULgXmb.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\FKbggmD.exe
  C:\Windows\System\FKbggmD.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\ketJAJL.exe
  C:\Windows\System\ketJAJL.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\guUENVn.exe
  C:\Windows\System\guUENVn.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\VyQObOB.exe
  C:\Windows\System\VyQObOB.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\deEdPSt.exe
  C:\Windows\System\deEdPSt.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\ZDnskPV.exe
  C:\Windows\System\ZDnskPV.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\BRbqMuK.exe
  C:\Windows\System\BRbqMuK.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\DFUTkml.exe
  C:\Windows\System\DFUTkml.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\eaquugE.exe
  C:\Windows\System\eaquugE.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\YCrooFW.exe
  C:\Windows\System\YCrooFW.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\fkoiJkc.exe
  C:\Windows\System\fkoiJkc.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\cnvZsgx.exe
  C:\Windows\System\cnvZsgx.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\JXMaROu.exe
  C:\Windows\System\JXMaROu.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\JZGwibE.exe
  C:\Windows\System\JZGwibE.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\cdQdwlW.exe
  C:\Windows\System\cdQdwlW.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\lKIJDQL.exe
  C:\Windows\System\lKIJDQL.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\hcNeJvy.exe
  C:\Windows\System\hcNeJvy.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\IcDjTmB.exe
  C:\Windows\System\IcDjTmB.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\HfIEYiE.exe
  C:\Windows\System\HfIEYiE.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\zDqRFeT.exe
  C:\Windows\System\zDqRFeT.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\hAQjNmP.exe
  C:\Windows\System\hAQjNmP.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\JxqUsjK.exe
  C:\Windows\System\JxqUsjK.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\BcJIslM.exe
  C:\Windows\System\BcJIslM.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\noYONWz.exe
  C:\Windows\System\noYONWz.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\zBOYIOu.exe
  C:\Windows\System\zBOYIOu.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\tqtThna.exe
  C:\Windows\System\tqtThna.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\xXaGurk.exe
  C:\Windows\System\xXaGurk.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\WuvioPx.exe
  C:\Windows\System\WuvioPx.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\jVhOTzc.exe
  C:\Windows\System\jVhOTzc.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\zWLipvL.exe
  C:\Windows\System\zWLipvL.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\MNuwQyP.exe
  C:\Windows\System\MNuwQyP.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\yyunRAl.exe
  C:\Windows\System\yyunRAl.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\APWMvCb.exe
  C:\Windows\System\APWMvCb.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\RsCctWA.exe
  C:\Windows\System\RsCctWA.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\mUYqJxK.exe
  C:\Windows\System\mUYqJxK.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\lQFLVeI.exe
  C:\Windows\System\lQFLVeI.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\VjETELv.exe
  C:\Windows\System\VjETELv.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\qNsPQTZ.exe
  C:\Windows\System\qNsPQTZ.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\WFFrFud.exe
  C:\Windows\System\WFFrFud.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\XCQbeiY.exe
  C:\Windows\System\XCQbeiY.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\Ysynyib.exe
  C:\Windows\System\Ysynyib.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\KwVsXqS.exe
  C:\Windows\System\KwVsXqS.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\MPpWTcH.exe
  C:\Windows\System\MPpWTcH.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\PbOZFvA.exe
  C:\Windows\System\PbOZFvA.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\ciHZvAa.exe
  C:\Windows\System\ciHZvAa.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\QzOHgRz.exe
  C:\Windows\System\QzOHgRz.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\HeMNYfA.exe
  C:\Windows\System\HeMNYfA.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\usqToTo.exe
  C:\Windows\System\usqToTo.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\GMYEslN.exe
  C:\Windows\System\GMYEslN.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\IrlVmmq.exe
  C:\Windows\System\IrlVmmq.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\XZtRknz.exe
  C:\Windows\System\XZtRknz.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\jgEoJgs.exe
  C:\Windows\System\jgEoJgs.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\GVvgAno.exe
  C:\Windows\System\GVvgAno.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\cKouiYI.exe
  C:\Windows\System\cKouiYI.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\QsWfOPz.exe
  C:\Windows\System\QsWfOPz.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\lqLcWVN.exe
  C:\Windows\System\lqLcWVN.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\QeeeZEV.exe
  C:\Windows\System\QeeeZEV.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\iDCgKVq.exe
  C:\Windows\System\iDCgKVq.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\rMDnjSf.exe
  C:\Windows\System\rMDnjSf.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\PyRVhAb.exe
  C:\Windows\System\PyRVhAb.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\dwRxjeW.exe
  C:\Windows\System\dwRxjeW.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\XLWIdiG.exe
  C:\Windows\System\XLWIdiG.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\PGTuuUa.exe
  C:\Windows\System\PGTuuUa.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\QHsVilG.exe
  C:\Windows\System\QHsVilG.exe
  2⤵
  PID:2644
- C:\Windows\System\MxhCEqD.exe
  C:\Windows\System\MxhCEqD.exe
  2⤵
  PID:1904
- C:\Windows\System\UjjExzF.exe
  C:\Windows\System\UjjExzF.exe
  2⤵
  PID:2700
- C:\Windows\System\jZQqsmc.exe
  C:\Windows\System\jZQqsmc.exe
  2⤵
  PID:2580
- C:\Windows\System\aCxElWC.exe
  C:\Windows\System\aCxElWC.exe
  2⤵
  PID:1232
- C:\Windows\System\UkXkvhQ.exe
  C:\Windows\System\UkXkvhQ.exe
  2⤵
  PID:1256
- C:\Windows\System\fFXsBHP.exe
  C:\Windows\System\fFXsBHP.exe
  2⤵
  PID:2684
- C:\Windows\System\bFVpeAt.exe
  C:\Windows\System\bFVpeAt.exe
  2⤵
  PID:540
- C:\Windows\System\qSAgEAz.exe
  C:\Windows\System\qSAgEAz.exe
  2⤵
  PID:2756
- C:\Windows\System\tcGLRJn.exe
  C:\Windows\System\tcGLRJn.exe
  2⤵
  PID:604
- C:\Windows\System\BqydxmQ.exe
  C:\Windows\System\BqydxmQ.exe
  2⤵
  PID:1732
- C:\Windows\System\JgIsqwN.exe
  C:\Windows\System\JgIsqwN.exe
  2⤵
  PID:2676
- C:\Windows\System\fUQUpDG.exe
  C:\Windows\System\fUQUpDG.exe
  2⤵
  PID:2276
- C:\Windows\System\FWJskwa.exe
  C:\Windows\System\FWJskwa.exe
  2⤵
  PID:2008
- C:\Windows\System\rzzmGsj.exe
  C:\Windows\System\rzzmGsj.exe
  2⤵
  PID:2204
- C:\Windows\System\tCRsops.exe
  C:\Windows\System\tCRsops.exe
  2⤵
  PID:856
- C:\Windows\System\qCtzpJy.exe
  C:\Windows\System\qCtzpJy.exe
  2⤵
  PID:1696
- C:\Windows\System\flgWApr.exe
  C:\Windows\System\flgWApr.exe
  2⤵
  PID:1056
- C:\Windows\System\ZeTjJLJ.exe
  C:\Windows\System\ZeTjJLJ.exe
  2⤵
  PID:1944
- C:\Windows\System\fAvkdQQ.exe
  C:\Windows\System\fAvkdQQ.exe
  2⤵
  PID:700
- C:\Windows\System\XbOFVTl.exe
  C:\Windows\System\XbOFVTl.exe
  2⤵
  PID:2852
- C:\Windows\System\zPXOYYm.exe
  C:\Windows\System\zPXOYYm.exe
  2⤵
  PID:2784
- C:\Windows\System\KoHhSKK.exe
  C:\Windows\System\KoHhSKK.exe
  2⤵
  PID:1460
- C:\Windows\System\pGXZGMV.exe
  C:\Windows\System\pGXZGMV.exe
  2⤵
  PID:2084
- C:\Windows\System\TKtQZYe.exe
  C:\Windows\System\TKtQZYe.exe
  2⤵
  PID:2860
- C:\Windows\System\GrNFzRf.exe
  C:\Windows\System\GrNFzRf.exe
  2⤵
  PID:2208
- C:\Windows\System\CiwYvnu.exe
  C:\Windows\System\CiwYvnu.exe
  2⤵
  PID:1368
- C:\Windows\System\bQjAjTb.exe
  C:\Windows\System\bQjAjTb.exe
  2⤵
  PID:1532
- C:\Windows\System\YlgkUzX.exe
  C:\Windows\System\YlgkUzX.exe
  2⤵
  PID:2508
- C:\Windows\System\XlnCvBC.exe
  C:\Windows\System\XlnCvBC.exe
  2⤵
  PID:2404
- C:\Windows\System\oosxkTg.exe
  C:\Windows\System\oosxkTg.exe
  2⤵
  PID:2888
- C:\Windows\System\jrWMiCB.exe
  C:\Windows\System\jrWMiCB.exe
  2⤵
  PID:2408
- C:\Windows\System\rzhiham.exe
  C:\Windows\System\rzhiham.exe
  2⤵
  PID:2892
- C:\Windows\System\rgvGUiD.exe
  C:\Windows\System\rgvGUiD.exe
  2⤵
  PID:2412
- C:\Windows\System\BczfQQZ.exe
  C:\Windows\System\BczfQQZ.exe
  2⤵
  PID:1788
- C:\Windows\System\gxrGJBO.exe
  C:\Windows\System\gxrGJBO.exe
  2⤵
  PID:2348
- C:\Windows\System\NIPOqNv.exe
  C:\Windows\System\NIPOqNv.exe
  2⤵
  PID:1492
- C:\Windows\System\cYMdwFI.exe
  C:\Windows\System\cYMdwFI.exe
  2⤵
  PID:1856
- C:\Windows\System\lLcYwYc.exe
  C:\Windows\System\lLcYwYc.exe
  2⤵
  PID:1324
- C:\Windows\System\XFeKMUY.exe
  C:\Windows\System\XFeKMUY.exe
  2⤵
  PID:3008
- C:\Windows\System\kbgVQAi.exe
  C:\Windows\System\kbgVQAi.exe
  2⤵
  PID:2448
- C:\Windows\System\uSDqXZw.exe
  C:\Windows\System\uSDqXZw.exe
  2⤵
  PID:324
- C:\Windows\System\itAgMOG.exe
  C:\Windows\System\itAgMOG.exe
  2⤵
  PID:3068
- C:\Windows\System\LTRAjZe.exe
  C:\Windows\System\LTRAjZe.exe
  2⤵
  PID:452
- C:\Windows\System\undcHTZ.exe
  C:\Windows\System\undcHTZ.exe
  2⤵
  PID:660
- C:\Windows\System\NpHgMXH.exe
  C:\Windows\System\NpHgMXH.exe
  2⤵
  PID:1756
- C:\Windows\System\ezcbcth.exe
  C:\Windows\System\ezcbcth.exe
  2⤵
  PID:1468
- C:\Windows\System\SUBdYQs.exe
  C:\Windows\System\SUBdYQs.exe
  2⤵
  PID:2028
- C:\Windows\System\yNlLTDF.exe
  C:\Windows\System\yNlLTDF.exe
  2⤵
  PID:1076
- C:\Windows\System\JxBIZjW.exe
  C:\Windows\System\JxBIZjW.exe
  2⤵
  PID:576
- C:\Windows\System\RFkEiKa.exe
  C:\Windows\System\RFkEiKa.exe
  2⤵
  PID:2340
- C:\Windows\System\eghspoC.exe
  C:\Windows\System\eghspoC.exe
  2⤵
  PID:2908
- C:\Windows\System\ZuVpMfT.exe
  C:\Windows\System\ZuVpMfT.exe
  2⤵
  PID:2200
- C:\Windows\System\XZcOHYd.exe
  C:\Windows\System\XZcOHYd.exe
  2⤵
  PID:2116
- C:\Windows\System\btFtqkp.exe
  C:\Windows\System\btFtqkp.exe
  2⤵
  PID:2832
- C:\Windows\System\BGDUlWf.exe
  C:\Windows\System\BGDUlWf.exe
  2⤵
  PID:2260
- C:\Windows\System\qIAjxzd.exe
  C:\Windows\System\qIAjxzd.exe
  2⤵
  PID:2100
- C:\Windows\System\yEpVfNo.exe
  C:\Windows\System\yEpVfNo.exe
  2⤵
  PID:2000
- C:\Windows\System\yUfrzWI.exe
  C:\Windows\System\yUfrzWI.exe
  2⤵
  PID:872
- C:\Windows\System\GRoKCOH.exe
  C:\Windows\System\GRoKCOH.exe
  2⤵
  PID:588
- C:\Windows\System\RYEDTsV.exe
  C:\Windows\System\RYEDTsV.exe
  2⤵
  PID:2764
- C:\Windows\System\CkGxEMR.exe
  C:\Windows\System\CkGxEMR.exe
  2⤵
  PID:1712
- C:\Windows\System\nbwVNFt.exe
  C:\Windows\System\nbwVNFt.exe
  2⤵
  PID:2820
- C:\Windows\System\BZfMkOq.exe
  C:\Windows\System\BZfMkOq.exe
  2⤵
  PID:1916
- C:\Windows\System\segTeVC.exe
  C:\Windows\System\segTeVC.exe
  2⤵
  PID:2564
- C:\Windows\System\kisjaXP.exe
  C:\Windows\System\kisjaXP.exe
  2⤵
  PID:280
- C:\Windows\System\cDebVNu.exe
  C:\Windows\System\cDebVNu.exe
  2⤵
  PID:1268
- C:\Windows\System\YlYikqT.exe
  C:\Windows\System\YlYikqT.exe
  2⤵
  PID:1224
- C:\Windows\System\ljjZRzL.exe
  C:\Windows\System\ljjZRzL.exe
  2⤵
  PID:2724
- C:\Windows\System\xKBNfTL.exe
  C:\Windows\System\xKBNfTL.exe
  2⤵
  PID:2172
- C:\Windows\System\YjiKDtU.exe
  C:\Windows\System\YjiKDtU.exe
  2⤵
  PID:2292
- C:\Windows\System\wnsWbSB.exe
  C:\Windows\System\wnsWbSB.exe
  2⤵
  PID:1476
- C:\Windows\System\JHPekYu.exe
  C:\Windows\System\JHPekYu.exe
  2⤵
  PID:2252
- C:\Windows\System\NsRTKiG.exe
  C:\Windows\System\NsRTKiG.exe
  2⤵
  PID:1964
- C:\Windows\System\bhNCgka.exe
  C:\Windows\System\bhNCgka.exe
  2⤵
  PID:2696
- C:\Windows\System\ylZyQec.exe
  C:\Windows\System\ylZyQec.exe
  2⤵
  PID:1452
- C:\Windows\System\WbyqQOj.exe
  C:\Windows\System\WbyqQOj.exe
  2⤵
  PID:1152
- C:\Windows\System\UNhzAUU.exe
  C:\Windows\System\UNhzAUU.exe
  2⤵
  PID:1968
- C:\Windows\System\Utzqyrh.exe
  C:\Windows\System\Utzqyrh.exe
  2⤵
  PID:860
- C:\Windows\System\XgqCXdq.exe
  C:\Windows\System\XgqCXdq.exe
  2⤵
  PID:3064
- C:\Windows\System\ptOVANy.exe
  C:\Windows\System\ptOVANy.exe
  2⤵
  PID:2692
- C:\Windows\System\SwEKWCU.exe
  C:\Windows\System\SwEKWCU.exe
  2⤵
  PID:840
- C:\Windows\System\azJKTkd.exe
  C:\Windows\System\azJKTkd.exe
  2⤵
  PID:1108
- C:\Windows\System\JRxCisl.exe
  C:\Windows\System\JRxCisl.exe
  2⤵
  PID:2716
- C:\Windows\System\TqcEjri.exe
  C:\Windows\System\TqcEjri.exe
  2⤵
  PID:2824
- C:\Windows\System\XZdLncq.exe
  C:\Windows\System\XZdLncq.exe
  2⤵
  PID:2104
- C:\Windows\System\HXPcgEQ.exe
  C:\Windows\System\HXPcgEQ.exe
  2⤵
  PID:2520
- C:\Windows\System\avTtevl.exe
  C:\Windows\System\avTtevl.exe
  2⤵
  PID:2584
- C:\Windows\System\JQJMNzy.exe
  C:\Windows\System\JQJMNzy.exe
  2⤵
  PID:2168
- C:\Windows\System\qGkVpos.exe
  C:\Windows\System\qGkVpos.exe
  2⤵
  PID:772
- C:\Windows\System\sgOtHiW.exe
  C:\Windows\System\sgOtHiW.exe
  2⤵
  PID:2272
- C:\Windows\System\sClAhVk.exe
  C:\Windows\System\sClAhVk.exe
  2⤵
  PID:2188
- C:\Windows\System\aOyNGDd.exe
  C:\Windows\System\aOyNGDd.exe
  2⤵
  PID:2472
- C:\Windows\System\dVcKzsd.exe
  C:\Windows\System\dVcKzsd.exe
  2⤵
  PID:1360
- C:\Windows\System\ASoIYkd.exe
  C:\Windows\System\ASoIYkd.exe
  2⤵
  PID:2328
- C:\Windows\System\XfPdbiW.exe
  C:\Windows\System\XfPdbiW.exe
  2⤵
  PID:384
- C:\Windows\System\jdXnBON.exe
  C:\Windows\System\jdXnBON.exe
  2⤵
  PID:824
- C:\Windows\System\DAJizHf.exe
  C:\Windows\System\DAJizHf.exe
  2⤵
  PID:1660
- C:\Windows\System\tHBNdeC.exe
  C:\Windows\System\tHBNdeC.exe
  2⤵
  PID:1596
- C:\Windows\System\FPBYlsg.exe
  C:\Windows\System\FPBYlsg.exe
  2⤵
  PID:1912
- C:\Windows\System\qOmEFjK.exe
  C:\Windows\System\qOmEFjK.exe
  2⤵
  PID:2776
- C:\Windows\System\ZwFIheC.exe
  C:\Windows\System\ZwFIheC.exe
  2⤵
  PID:1748
- C:\Windows\System\TGHSkDm.exe
  C:\Windows\System\TGHSkDm.exe
  2⤵
  PID:2940
- C:\Windows\System\OCYDyav.exe
  C:\Windows\System\OCYDyav.exe
  2⤵
  PID:2388
- C:\Windows\System\kAHIzxq.exe
  C:\Windows\System\kAHIzxq.exe
  2⤵
  PID:2600
- C:\Windows\System\YjDLHgh.exe
  C:\Windows\System\YjDLHgh.exe
  2⤵
  PID:1928
- C:\Windows\System\iYNODBJ.exe
  C:\Windows\System\iYNODBJ.exe
  2⤵
  PID:1592
- C:\Windows\System\iIivPYu.exe
  C:\Windows\System\iIivPYu.exe
  2⤵
  PID:1408
- C:\Windows\System\xlSKzad.exe
  C:\Windows\System\xlSKzad.exe
  2⤵
  PID:1420
- C:\Windows\System\awHnKTh.exe
  C:\Windows\System\awHnKTh.exe
  2⤵
  PID:916
- C:\Windows\System\SnexhrC.exe
  C:\Windows\System\SnexhrC.exe
  2⤵
  PID:1436
- C:\Windows\System\KvsdZyY.exe
  C:\Windows\System\KvsdZyY.exe
  2⤵
  PID:1188
- C:\Windows\System\UOHoqWZ.exe
  C:\Windows\System\UOHoqWZ.exe
  2⤵
  PID:2284
- C:\Windows\System\MbokQYT.exe
  C:\Windows\System\MbokQYT.exe
  2⤵
  PID:544
- C:\Windows\System\DcQLsbS.exe
  C:\Windows\System\DcQLsbS.exe
  2⤵
  PID:292
- C:\Windows\System\bkxgvIi.exe
  C:\Windows\System\bkxgvIi.exe
  2⤵
  PID:1892
- C:\Windows\System\QOTpSJl.exe
  C:\Windows\System\QOTpSJl.exe
  2⤵
  PID:340
- C:\Windows\System\XCQJkwh.exe
  C:\Windows\System\XCQJkwh.exe
  2⤵
  PID:3080
- C:\Windows\System\ZVZAaTs.exe
  C:\Windows\System\ZVZAaTs.exe
  2⤵
  PID:3096
- C:\Windows\System\yJeICNb.exe
  C:\Windows\System\yJeICNb.exe
  2⤵
  PID:3112
- C:\Windows\System\dmAzrXe.exe
  C:\Windows\System\dmAzrXe.exe
  2⤵
  PID:3152
- C:\Windows\System\UwKCMCn.exe
  C:\Windows\System\UwKCMCn.exe
  2⤵
  PID:3168
- C:\Windows\System\ietlDcV.exe
  C:\Windows\System\ietlDcV.exe
  2⤵
  PID:3184
- C:\Windows\System\cShGDhY.exe
  C:\Windows\System\cShGDhY.exe
  2⤵
  PID:3200
- C:\Windows\System\MgGsfZi.exe
  C:\Windows\System\MgGsfZi.exe
  2⤵
  PID:3220
- C:\Windows\System\GgTWfRh.exe
  C:\Windows\System\GgTWfRh.exe
  2⤵
  PID:3236
- C:\Windows\System\CzaHxVt.exe
  C:\Windows\System\CzaHxVt.exe
  2⤵
  PID:3252
- C:\Windows\System\LOdycIe.exe
  C:\Windows\System\LOdycIe.exe
  2⤵
  PID:3268
- C:\Windows\System\XmpKigj.exe
  C:\Windows\System\XmpKigj.exe
  2⤵
  PID:3284
- C:\Windows\System\gYxDDfq.exe
  C:\Windows\System\gYxDDfq.exe
  2⤵
  PID:3300
- C:\Windows\System\dpHMLbq.exe
  C:\Windows\System\dpHMLbq.exe
  2⤵
  PID:3316
- C:\Windows\System\AsQGUXY.exe
  C:\Windows\System\AsQGUXY.exe
  2⤵
  PID:3332
- C:\Windows\System\YCMVXjM.exe
  C:\Windows\System\YCMVXjM.exe
  2⤵
  PID:3352
- C:\Windows\System\WFXSonh.exe
  C:\Windows\System\WFXSonh.exe
  2⤵
  PID:3368
- C:\Windows\System\nSeQOBm.exe
  C:\Windows\System\nSeQOBm.exe
  2⤵
  PID:3384
- C:\Windows\System\LsxTSZb.exe
  C:\Windows\System\LsxTSZb.exe
  2⤵
  PID:3400
- C:\Windows\System\mEONxWy.exe
  C:\Windows\System\mEONxWy.exe
  2⤵
  PID:3416
- C:\Windows\System\CNNidzx.exe
  C:\Windows\System\CNNidzx.exe
  2⤵
  PID:3436
- C:\Windows\System\mVDrzKv.exe
  C:\Windows\System\mVDrzKv.exe
  2⤵
  PID:3452
- C:\Windows\System\ixNWSjF.exe
  C:\Windows\System\ixNWSjF.exe
  2⤵
  PID:3468
- C:\Windows\System\WwFUNWb.exe
  C:\Windows\System\WwFUNWb.exe
  2⤵
  PID:3484
- C:\Windows\System\GoBAwuv.exe
  C:\Windows\System\GoBAwuv.exe
  2⤵
  PID:3500
- C:\Windows\System\HLfCTkA.exe
  C:\Windows\System\HLfCTkA.exe
  2⤵
  PID:3520
- C:\Windows\System\lluLQtn.exe
  C:\Windows\System\lluLQtn.exe
  2⤵
  PID:3540
- C:\Windows\System\vkqlMKo.exe
  C:\Windows\System\vkqlMKo.exe
  2⤵
  PID:3556
- C:\Windows\System\yFdhXcc.exe
  C:\Windows\System\yFdhXcc.exe
  2⤵
  PID:3572
- C:\Windows\System\sJVwShR.exe
  C:\Windows\System\sJVwShR.exe
  2⤵
  PID:3588
- C:\Windows\System\pjuEAOg.exe
  C:\Windows\System\pjuEAOg.exe
  2⤵
  PID:3608
- C:\Windows\System\wbnZlEu.exe
  C:\Windows\System\wbnZlEu.exe
  2⤵
  PID:3624
- C:\Windows\System\qYvlsnM.exe
  C:\Windows\System\qYvlsnM.exe
  2⤵
  PID:3640
- C:\Windows\System\uiwoTks.exe
  C:\Windows\System\uiwoTks.exe
  2⤵
  PID:3656
- C:\Windows\System\QmsZBzg.exe
  C:\Windows\System\QmsZBzg.exe
  2⤵
  PID:3672
- C:\Windows\System\KGdUuEU.exe
  C:\Windows\System\KGdUuEU.exe
  2⤵
  PID:3692
- C:\Windows\System\fXykNPd.exe
  C:\Windows\System\fXykNPd.exe
  2⤵
  PID:3708
- C:\Windows\System\PcMByqR.exe
  C:\Windows\System\PcMByqR.exe
  2⤵
  PID:3724
- C:\Windows\System\zzFNkIO.exe
  C:\Windows\System\zzFNkIO.exe
  2⤵
  PID:3740
- C:\Windows\System\RiCqwUu.exe
  C:\Windows\System\RiCqwUu.exe
  2⤵
  PID:3756
- C:\Windows\System\SyognuG.exe
  C:\Windows\System\SyognuG.exe
  2⤵
  PID:3772
- C:\Windows\System\uUMVUcl.exe
  C:\Windows\System\uUMVUcl.exe
  2⤵
  PID:3792
- C:\Windows\System\sytwbSk.exe
  C:\Windows\System\sytwbSk.exe
  2⤵
  PID:3808
- C:\Windows\System\FORlyoJ.exe
  C:\Windows\System\FORlyoJ.exe
  2⤵
  PID:3824
- C:\Windows\System\HmdqGwy.exe
  C:\Windows\System\HmdqGwy.exe
  2⤵
  PID:3840
- C:\Windows\System\zcFqwAS.exe
  C:\Windows\System\zcFqwAS.exe
  2⤵
  PID:4004
- C:\Windows\System\xsWbeYr.exe
  C:\Windows\System\xsWbeYr.exe
  2⤵
  PID:4028
- C:\Windows\System\vbXyTOV.exe
  C:\Windows\System\vbXyTOV.exe
  2⤵
  PID:4044
- C:\Windows\System\cdEgGlb.exe
  C:\Windows\System\cdEgGlb.exe
  2⤵
  PID:4060
- C:\Windows\System\cAehJQV.exe
  C:\Windows\System\cAehJQV.exe
  2⤵
  PID:4080
- C:\Windows\System\gVnLuxZ.exe
  C:\Windows\System\gVnLuxZ.exe
  2⤵
  PID:1060
- C:\Windows\System\LhmHKMb.exe
  C:\Windows\System\LhmHKMb.exe
  2⤵
  PID:3104
- C:\Windows\System\fCvEiHx.exe
  C:\Windows\System\fCvEiHx.exe
  2⤵
  PID:3128
- C:\Windows\System\DCLwENA.exe
  C:\Windows\System\DCLwENA.exe
  2⤵
  PID:3360
- C:\Windows\System\DIpXfeL.exe
  C:\Windows\System\DIpXfeL.exe
  2⤵
  PID:1272
- C:\Windows\System\tFwsOqp.exe
  C:\Windows\System\tFwsOqp.exe
  2⤵
  PID:3148
- C:\Windows\System\IYmExXu.exe
  C:\Windows\System\IYmExXu.exe
  2⤵
  PID:3180
- C:\Windows\System\NIAYWAr.exe
  C:\Windows\System\NIAYWAr.exe
  2⤵
  PID:3228
- C:\Windows\System\vNociQj.exe
  C:\Windows\System\vNociQj.exe
  2⤵
  PID:3308
- C:\Windows\System\FwJXyGF.exe
  C:\Windows\System\FwJXyGF.exe
  2⤵
  PID:3480
- C:\Windows\System\ELIqmCv.exe
  C:\Windows\System\ELIqmCv.exe
  2⤵
  PID:3292
- C:\Windows\System\phultcp.exe
  C:\Windows\System\phultcp.exe
  2⤵
  PID:3364
- C:\Windows\System\XDtyddj.exe
  C:\Windows\System\XDtyddj.exe
  2⤵
  PID:3428
- C:\Windows\System\EMgUbos.exe
  C:\Windows\System\EMgUbos.exe
  2⤵
  PID:3528
- C:\Windows\System\piHdIll.exe
  C:\Windows\System\piHdIll.exe
  2⤵
  PID:3568
- C:\Windows\System\VAawnPA.exe
  C:\Windows\System\VAawnPA.exe
  2⤵
  PID:3636
- C:\Windows\System\sjWrysK.exe
  C:\Windows\System\sjWrysK.exe
  2⤵
  PID:3704
- C:\Windows\System\zxwwjSZ.exe
  C:\Windows\System\zxwwjSZ.exe
  2⤵
  PID:3768
- C:\Windows\System\vnkHoPF.exe
  C:\Windows\System\vnkHoPF.exe
  2⤵
  PID:3140
- C:\Windows\System\TvlrJSC.exe
  C:\Windows\System\TvlrJSC.exe
  2⤵
  PID:3344
- C:\Windows\System\ZoSgIqY.exe
  C:\Windows\System\ZoSgIqY.exe
  2⤵
  PID:3476
- C:\Windows\System\DHscllD.exe
  C:\Windows\System\DHscllD.exe
  2⤵
  PID:3548
- C:\Windows\System\otXYqji.exe
  C:\Windows\System\otXYqji.exe
  2⤵
  PID:3584
- C:\Windows\System\bYoWpYc.exe
  C:\Windows\System\bYoWpYc.exe
  2⤵
  PID:3648
- C:\Windows\System\amwLgyR.exe
  C:\Windows\System\amwLgyR.exe
  2⤵
  PID:3688
- C:\Windows\System\hhFvkZT.exe
  C:\Windows\System\hhFvkZT.exe
  2⤵
  PID:3752
- C:\Windows\System\pJwqnsy.exe
  C:\Windows\System\pJwqnsy.exe
  2⤵
  PID:3816
- C:\Windows\System\CpGVYha.exe
  C:\Windows\System\CpGVYha.exe
  2⤵
  PID:3860
- C:\Windows\System\PPHDCzy.exe
  C:\Windows\System\PPHDCzy.exe
  2⤵
  PID:3876
- C:\Windows\System\nsVAkIk.exe
  C:\Windows\System\nsVAkIk.exe
  2⤵
  PID:3888
- C:\Windows\System\lPRZudE.exe
  C:\Windows\System\lPRZudE.exe
  2⤵
  PID:3904
- C:\Windows\System\hstshbu.exe
  C:\Windows\System\hstshbu.exe
  2⤵
  PID:3920
- C:\Windows\System\SmDHQDS.exe
  C:\Windows\System\SmDHQDS.exe
  2⤵
  PID:3936
- C:\Windows\System\OmRyKis.exe
  C:\Windows\System\OmRyKis.exe
  2⤵
  PID:3952
- C:\Windows\System\zNjhLUT.exe
  C:\Windows\System\zNjhLUT.exe
  2⤵
  PID:3972
- C:\Windows\System\lrmmzjU.exe
  C:\Windows\System\lrmmzjU.exe
  2⤵
  PID:3988
- C:\Windows\System\YOMXONk.exe
  C:\Windows\System\YOMXONk.exe
  2⤵
  PID:4016
- C:\Windows\System\jbPpCpL.exe
  C:\Windows\System\jbPpCpL.exe
  2⤵
  PID:4100
- C:\Windows\System\mTIFpSp.exe
  C:\Windows\System\mTIFpSp.exe
  2⤵
  PID:4116
- C:\Windows\System\ZhHUlvc.exe
  C:\Windows\System\ZhHUlvc.exe
  2⤵
  PID:4132
- C:\Windows\System\EonwItY.exe
  C:\Windows\System\EonwItY.exe
  2⤵
  PID:4148
- C:\Windows\System\jYmGEOQ.exe
  C:\Windows\System\jYmGEOQ.exe
  2⤵
  PID:4164
- C:\Windows\System\aZMnKyI.exe
  C:\Windows\System\aZMnKyI.exe
  2⤵
  PID:4180
- C:\Windows\System\rFutZGE.exe
  C:\Windows\System\rFutZGE.exe
  2⤵
  PID:4196
- C:\Windows\System\tAwIOTk.exe
  C:\Windows\System\tAwIOTk.exe
  2⤵
  PID:4212
- C:\Windows\System\OGdSINC.exe
  C:\Windows\System\OGdSINC.exe
  2⤵
  PID:4252
- C:\Windows\System\oyNUZUs.exe
  C:\Windows\System\oyNUZUs.exe
  2⤵
  PID:4268
- C:\Windows\System\sivBDiR.exe
  C:\Windows\System\sivBDiR.exe
  2⤵
  PID:4284
- C:\Windows\System\mqnsuKg.exe
  C:\Windows\System\mqnsuKg.exe
  2⤵
  PID:4300
- C:\Windows\System\dFlmQYo.exe
  C:\Windows\System\dFlmQYo.exe
  2⤵
  PID:4316
- C:\Windows\System\ILtbgmB.exe
  C:\Windows\System\ILtbgmB.exe
  2⤵
  PID:4336
- C:\Windows\System\DatoAGQ.exe
  C:\Windows\System\DatoAGQ.exe
  2⤵
  PID:4352
- C:\Windows\System\JZWDTKK.exe
  C:\Windows\System\JZWDTKK.exe
  2⤵
  PID:4368
- C:\Windows\System\lfcVogj.exe
  C:\Windows\System\lfcVogj.exe
  2⤵
  PID:4384
- C:\Windows\System\SCwWZll.exe
  C:\Windows\System\SCwWZll.exe
  2⤵
  PID:4400
- C:\Windows\System\yKrLBmi.exe
  C:\Windows\System\yKrLBmi.exe
  2⤵
  PID:4416
- C:\Windows\System\VOiKqyl.exe
  C:\Windows\System\VOiKqyl.exe
  2⤵
  PID:4432
- C:\Windows\System\ukrULMs.exe
  C:\Windows\System\ukrULMs.exe
  2⤵
  PID:4448
- C:\Windows\System\kuztbch.exe
  C:\Windows\System\kuztbch.exe
  2⤵
  PID:4464
- C:\Windows\System\wraWmqS.exe
  C:\Windows\System\wraWmqS.exe
  2⤵
  PID:4488
- C:\Windows\System\jprbQDo.exe
  C:\Windows\System\jprbQDo.exe
  2⤵
  PID:4504
- C:\Windows\System\JteWodv.exe
  C:\Windows\System\JteWodv.exe
  2⤵
  PID:4520
- C:\Windows\System\HJcdUzJ.exe
  C:\Windows\System\HJcdUzJ.exe
  2⤵
  PID:4536
- C:\Windows\System\TbRJLvp.exe
  C:\Windows\System\TbRJLvp.exe
  2⤵
  PID:4556
- C:\Windows\System\MiVrJvg.exe
  C:\Windows\System\MiVrJvg.exe
  2⤵
  PID:4572
- C:\Windows\System\QSIQuFK.exe
  C:\Windows\System\QSIQuFK.exe
  2⤵
  PID:4588
- C:\Windows\System\qzCcEeW.exe
  C:\Windows\System\qzCcEeW.exe
  2⤵
  PID:4604
- C:\Windows\System\lZXQQxr.exe
  C:\Windows\System\lZXQQxr.exe
  2⤵
  PID:4620
- C:\Windows\System\GBVptBr.exe
  C:\Windows\System\GBVptBr.exe
  2⤵
  PID:4640
- C:\Windows\System\WnMYAVd.exe
  C:\Windows\System\WnMYAVd.exe
  2⤵
  PID:4656
- C:\Windows\System\qnVCFkM.exe
  C:\Windows\System\qnVCFkM.exe
  2⤵
  PID:4672
- C:\Windows\System\GMyBsan.exe
  C:\Windows\System\GMyBsan.exe
  2⤵
  PID:4688
- C:\Windows\System\oBSedXS.exe
  C:\Windows\System\oBSedXS.exe
  2⤵
  PID:4796
- C:\Windows\System\BtzGXRo.exe
  C:\Windows\System\BtzGXRo.exe
  2⤵
  PID:4812
- C:\Windows\System\gWCcboD.exe
  C:\Windows\System\gWCcboD.exe
  2⤵
  PID:4828
- C:\Windows\System\AJimxdU.exe
  C:\Windows\System\AJimxdU.exe
  2⤵
  PID:4844
- C:\Windows\System\qSYcosL.exe
  C:\Windows\System\qSYcosL.exe
  2⤵
  PID:4860
- C:\Windows\System\cMCHGDO.exe
  C:\Windows\System\cMCHGDO.exe
  2⤵
  PID:4876
- C:\Windows\System\KDzTddY.exe
  C:\Windows\System\KDzTddY.exe
  2⤵
  PID:4892
- C:\Windows\System\kgxmRCq.exe
  C:\Windows\System\kgxmRCq.exe
  2⤵
  PID:4908
- C:\Windows\System\mDEydYV.exe
  C:\Windows\System\mDEydYV.exe
  2⤵
  PID:4924
- C:\Windows\System\ADPKmjR.exe
  C:\Windows\System\ADPKmjR.exe
  2⤵
  PID:4944
- C:\Windows\System\zHIHGQD.exe
  C:\Windows\System\zHIHGQD.exe
  2⤵
  PID:4960
- C:\Windows\System\JaePaYX.exe
  C:\Windows\System\JaePaYX.exe
  2⤵
  PID:4976
- C:\Windows\System\IOivxFY.exe
  C:\Windows\System\IOivxFY.exe
  2⤵
  PID:4992
- C:\Windows\System\brNzTyI.exe
  C:\Windows\System\brNzTyI.exe
  2⤵
  PID:5008
- C:\Windows\System\pxDnNsO.exe
  C:\Windows\System\pxDnNsO.exe
  2⤵
  PID:5024
- C:\Windows\System\jshPWFb.exe
  C:\Windows\System\jshPWFb.exe
  2⤵
  PID:5040
- C:\Windows\System\RTmjlJD.exe
  C:\Windows\System\RTmjlJD.exe
  2⤵
  PID:3076
- C:\Windows\System\dRcAtRM.exe
  C:\Windows\System\dRcAtRM.exe
  2⤵
  PID:4112
- C:\Windows\System\SsNxVpg.exe
  C:\Windows\System\SsNxVpg.exe
  2⤵
  PID:3212
- C:\Windows\System\wnusbDm.exe
  C:\Windows\System\wnusbDm.exe
  2⤵
  PID:3248
- C:\Windows\System\EDauQxe.exe
  C:\Windows\System\EDauQxe.exe
  2⤵
  PID:3512
- C:\Windows\System\AUtegBw.exe
  C:\Windows\System\AUtegBw.exe
  2⤵
  PID:3848
- C:\Windows\System\iWqkJyV.exe
  C:\Windows\System\iWqkJyV.exe
  2⤵
  PID:4156
- C:\Windows\System\iTDJakn.exe
  C:\Windows\System\iTDJakn.exe
  2⤵
  PID:3392
- C:\Windows\System\uGDKIpA.exe
  C:\Windows\System\uGDKIpA.exe
  2⤵
  PID:3464
- C:\Windows\System\srEboII.exe
  C:\Windows\System\srEboII.exe
  2⤵
  PID:4364
- C:\Windows\System\dfOiElB.exe
  C:\Windows\System\dfOiElB.exe
  2⤵
  PID:4392
- C:\Windows\System\poXQbZN.exe
  C:\Windows\System\poXQbZN.exe
  2⤵
  PID:4500
- C:\Windows\System\ljvFxRg.exe
  C:\Windows\System\ljvFxRg.exe
  2⤵
  PID:4668
- C:\Windows\System\owKZVVX.exe
  C:\Windows\System\owKZVVX.exe
  2⤵
  PID:4344
- C:\Windows\System\IHPkzwb.exe
  C:\Windows\System\IHPkzwb.exe
  2⤵
  PID:3700
- C:\Windows\System\GAmvjQX.exe
  C:\Windows\System\GAmvjQX.exe
  2⤵
  PID:3412
- C:\Windows\System\vdVEGxt.exe
  C:\Windows\System\vdVEGxt.exe
  2⤵
  PID:3680
- C:\Windows\System\ejNjJQt.exe
  C:\Windows\System\ejNjJQt.exe
  2⤵
  PID:4740
- C:\Windows\System\WmtwUEs.exe
  C:\Windows\System\WmtwUEs.exe
  2⤵
  PID:4036
- C:\Windows\System\ukMaCbG.exe
  C:\Windows\System\ukMaCbG.exe
  2⤵
  PID:4276
- C:\Windows\System\DWFFphu.exe
  C:\Windows\System\DWFFphu.exe
  2⤵
  PID:4444
- C:\Windows\System\hwzmHye.exe
  C:\Windows\System\hwzmHye.exe
  2⤵
  PID:4484
- C:\Windows\System\ohiLCiB.exe
  C:\Windows\System\ohiLCiB.exe
  2⤵
  PID:4548
- C:\Windows\System\gmvXnFP.exe
  C:\Windows\System\gmvXnFP.exe
  2⤵
  PID:4580
- C:\Windows\System\llEpmyn.exe
  C:\Windows\System\llEpmyn.exe
  2⤵
  PID:4648
- C:\Windows\System\bLcQeux.exe
  C:\Windows\System\bLcQeux.exe
  2⤵
  PID:4940
- C:\Windows\System\mUWoNVB.exe
  C:\Windows\System\mUWoNVB.exe
  2⤵
  PID:4824
- C:\Windows\System\jWvacKO.exe
  C:\Windows\System\jWvacKO.exe
  2⤵
  PID:5020
- C:\Windows\System\ynOWLGP.exe
  C:\Windows\System\ynOWLGP.exe
  2⤵
  PID:4852
- C:\Windows\System\JnHUKJH.exe
  C:\Windows\System\JnHUKJH.exe
  2⤵
  PID:5048
- C:\Windows\System\svYezbR.exe
  C:\Windows\System\svYezbR.exe
  2⤵
  PID:5000
- C:\Windows\System\ChaWaCs.exe
  C:\Windows\System\ChaWaCs.exe
  2⤵
  PID:4872
- C:\Windows\System\CgggvSd.exe
  C:\Windows\System\CgggvSd.exe
  2⤵
  PID:5004
- C:\Windows\System\OFdIJiv.exe
  C:\Windows\System\OFdIJiv.exe
  2⤵
  PID:240
- C:\Windows\System\ekmjGNQ.exe
  C:\Windows\System\ekmjGNQ.exe
  2⤵
  PID:5072
- C:\Windows\System\jACJHMO.exe
  C:\Windows\System\jACJHMO.exe
  2⤵
  PID:5092
- C:\Windows\System\zPcQWUy.exe
  C:\Windows\System\zPcQWUy.exe
  2⤵
  PID:5088
- C:\Windows\System\YCuabEU.exe
  C:\Windows\System\YCuabEU.exe
  2⤵
  PID:5116
- C:\Windows\System\kCDDvKg.exe
  C:\Windows\System\kCDDvKg.exe
  2⤵
  PID:3160
- C:\Windows\System\RJHPBpH.exe
  C:\Windows\System\RJHPBpH.exe
  2⤵
  PID:3896
- C:\Windows\System\QGQpbOp.exe
  C:\Windows\System\QGQpbOp.exe
  2⤵
  PID:3932
- C:\Windows\System\DIveORn.exe
  C:\Windows\System\DIveORn.exe
  2⤵
  PID:640
- C:\Windows\System\SiWXsFt.exe
  C:\Windows\System\SiWXsFt.exe
  2⤵
  PID:4108
- C:\Windows\System\PndYPtZ.exe
  C:\Windows\System\PndYPtZ.exe
  2⤵
  PID:4172
- C:\Windows\System\IyoLvOw.exe
  C:\Windows\System\IyoLvOw.exe
  2⤵
  PID:3448
- C:\Windows\System\nTCjcRB.exe
  C:\Windows\System\nTCjcRB.exe
  2⤵
  PID:4324
- C:\Windows\System\mPoFhLv.exe
  C:\Windows\System\mPoFhLv.exe
  2⤵
  PID:3668
- C:\Windows\System\GwfGHuA.exe
  C:\Windows\System\GwfGHuA.exe
  2⤵
  PID:4248
- C:\Windows\System\azlsnhg.exe
  C:\Windows\System\azlsnhg.exe
  2⤵
  PID:4532
- C:\Windows\System\DrduIeY.exe
  C:\Windows\System\DrduIeY.exe
  2⤵
  PID:4564
- C:\Windows\System\ZGNhOKu.exe
  C:\Windows\System\ZGNhOKu.exe
  2⤵
  PID:3964
- C:\Windows\System\krgqQDP.exe
  C:\Windows\System\krgqQDP.exe
  2⤵
  PID:4376
- C:\Windows\System\jyOTzWP.exe
  C:\Windows\System\jyOTzWP.exe
  2⤵
  PID:4628
- C:\Windows\System\demQUGH.exe
  C:\Windows\System\demQUGH.exe
  2⤵
  PID:4704
- C:\Windows\System\mAmljrQ.exe
  C:\Windows\System\mAmljrQ.exe
  2⤵
  PID:4756
- C:\Windows\System\CUEpETF.exe
  C:\Windows\System\CUEpETF.exe
  2⤵
  PID:4920
- C:\Windows\System\VZDPyrU.exe
  C:\Windows\System\VZDPyrU.exe
  2⤵
  PID:4968
- C:\Windows\System\LBeFvhU.exe
  C:\Windows\System\LBeFvhU.exe
  2⤵
  PID:4956
- C:\Windows\System\DKaWqNN.exe
  C:\Windows\System\DKaWqNN.exe
  2⤵
  PID:4616
- C:\Windows\System\cLdXSOn.exe
  C:\Windows\System\cLdXSOn.exe
  2⤵
  PID:5060
- C:\Windows\System\OoKCTeX.exe
  C:\Windows\System\OoKCTeX.exe
  2⤵
  PID:5112
- C:\Windows\System\XODhznI.exe
  C:\Windows\System\XODhznI.exe
  2⤵
  PID:4684
- C:\Windows\System\BiXsNXH.exe
  C:\Windows\System\BiXsNXH.exe
  2⤵
  PID:5076
- C:\Windows\System\ehuksoV.exe
  C:\Windows\System\ehuksoV.exe
  2⤵
  PID:1524
- C:\Windows\System\NHsaGbG.exe
  C:\Windows\System\NHsaGbG.exe
  2⤵
  PID:4916
- C:\Windows\System\clADYqa.exe
  C:\Windows\System\clADYqa.exe
  2⤵
  PID:2112
- C:\Windows\System\QCXqmCb.exe
  C:\Windows\System\QCXqmCb.exe
  2⤵
  PID:4144
- C:\Windows\System\HTwTZWq.exe
  C:\Windows\System\HTwTZWq.exe
  2⤵
  PID:3748
- C:\Windows\System\QKJGCpL.exe
  C:\Windows\System\QKJGCpL.exe
  2⤵
  PID:4792
- C:\Windows\System\FBSHnOH.exe
  C:\Windows\System\FBSHnOH.exe
  2⤵
  PID:3736
- C:\Windows\System\uZTNoYj.exe
  C:\Windows\System\uZTNoYj.exe
  2⤵
  PID:3720
- C:\Windows\System\xWlbaCW.exe
  C:\Windows\System\xWlbaCW.exe
  2⤵
  PID:4056
- C:\Windows\System\uFVgTwB.exe
  C:\Windows\System\uFVgTwB.exe
  2⤵
  PID:3280
- C:\Windows\System\JRZyzsO.exe
  C:\Windows\System\JRZyzsO.exe
  2⤵
  PID:3460
- C:\Windows\System\vUbLfOX.exe
  C:\Windows\System\vUbLfOX.exe
  2⤵
  PID:2476
- C:\Windows\System\ubNSNcJ.exe
  C:\Windows\System\ubNSNcJ.exe
  2⤵
  PID:4244
- C:\Windows\System\dvqQSkO.exe
  C:\Windows\System\dvqQSkO.exe
  2⤵
  PID:4460
- C:\Windows\System\dvGkCFa.exe
  C:\Windows\System\dvGkCFa.exe
  2⤵
  PID:4632
- C:\Windows\System\OLGnhRU.exe
  C:\Windows\System\OLGnhRU.exe
  2⤵
  PID:3836
- C:\Windows\System\NidWaAH.exe
  C:\Windows\System\NidWaAH.exe
  2⤵
  PID:4664
- C:\Windows\System\bAtvfiZ.exe
  C:\Windows\System\bAtvfiZ.exe
  2⤵
  PID:4544
- C:\Windows\System\nzdSfDI.exe
  C:\Windows\System\nzdSfDI.exe
  2⤵
  PID:4696
- C:\Windows\System\kKPxkaP.exe
  C:\Windows\System\kKPxkaP.exe
  2⤵
  PID:3852
- C:\Windows\System\CRBlCcx.exe
  C:\Windows\System\CRBlCcx.exe
  2⤵
  PID:4936
- C:\Windows\System\bXRntma.exe
  C:\Windows\System\bXRntma.exe
  2⤵
  PID:4476
- C:\Windows\System\YLYRMbt.exe
  C:\Windows\System\YLYRMbt.exe
  2⤵
  PID:5140
- C:\Windows\System\LAfpsbY.exe
  C:\Windows\System\LAfpsbY.exe
  2⤵
  PID:5156
- C:\Windows\System\XtKywoY.exe
  C:\Windows\System\XtKywoY.exe
  2⤵
  PID:5172
- C:\Windows\System\USqWpBN.exe
  C:\Windows\System\USqWpBN.exe
  2⤵
  PID:5188
- C:\Windows\System\syjENeY.exe
  C:\Windows\System\syjENeY.exe
  2⤵
  PID:5204
- C:\Windows\System\dAIgFNU.exe
  C:\Windows\System\dAIgFNU.exe
  2⤵
  PID:5220
- C:\Windows\System\AcLTfuF.exe
  C:\Windows\System\AcLTfuF.exe
  2⤵
  PID:5236
- C:\Windows\System\ZZaLbgG.exe
  C:\Windows\System\ZZaLbgG.exe
  2⤵
  PID:5252
- C:\Windows\System\qdQqAWz.exe
  C:\Windows\System\qdQqAWz.exe
  2⤵
  PID:5276
- C:\Windows\System\pPsHRjr.exe
  C:\Windows\System\pPsHRjr.exe
  2⤵
  PID:5292
- C:\Windows\System\wfdSEcp.exe
  C:\Windows\System\wfdSEcp.exe
  2⤵
  PID:5308
- C:\Windows\System\NNjUefp.exe
  C:\Windows\System\NNjUefp.exe
  2⤵
  PID:5404
- C:\Windows\System\wvydczZ.exe
  C:\Windows\System\wvydczZ.exe
  2⤵
  PID:5420
- C:\Windows\System\FAvQUDG.exe
  C:\Windows\System\FAvQUDG.exe
  2⤵
  PID:5484
- C:\Windows\System\yDajGXl.exe
  C:\Windows\System\yDajGXl.exe
  2⤵
  PID:5500
- C:\Windows\System\LRxqEPv.exe
  C:\Windows\System\LRxqEPv.exe
  2⤵
  PID:5516
- C:\Windows\System\XlIFsDS.exe
  C:\Windows\System\XlIFsDS.exe
  2⤵
  PID:5532
- C:\Windows\System\PvaqiXC.exe
  C:\Windows\System\PvaqiXC.exe
  2⤵
  PID:5548
- C:\Windows\System\OUJlYML.exe
  C:\Windows\System\OUJlYML.exe
  2⤵
  PID:5564
- C:\Windows\System\YDsjjMD.exe
  C:\Windows\System\YDsjjMD.exe
  2⤵
  PID:5580
- C:\Windows\System\ihguniZ.exe
  C:\Windows\System\ihguniZ.exe
  2⤵
  PID:5608
- C:\Windows\System\nTICfBd.exe
  C:\Windows\System\nTICfBd.exe
  2⤵
  PID:5624
- C:\Windows\System\KbUDtxD.exe
  C:\Windows\System\KbUDtxD.exe
  2⤵
  PID:5640
- C:\Windows\System\xPqPJei.exe
  C:\Windows\System\xPqPJei.exe
  2⤵
  PID:5660
- C:\Windows\System\NZBibNg.exe
  C:\Windows\System\NZBibNg.exe
  2⤵
  PID:5676
- C:\Windows\System\YCzitRY.exe
  C:\Windows\System\YCzitRY.exe
  2⤵
  PID:5692
- C:\Windows\System\pFwomxH.exe
  C:\Windows\System\pFwomxH.exe
  2⤵
  PID:5708
- C:\Windows\System\IfKEXTP.exe
  C:\Windows\System\IfKEXTP.exe
  2⤵
  PID:5728
- C:\Windows\System\UBaASBW.exe
  C:\Windows\System\UBaASBW.exe
  2⤵
  PID:5744
- C:\Windows\System\WhLlwIm.exe
  C:\Windows\System\WhLlwIm.exe
  2⤵
  PID:5760
- C:\Windows\System\IqHBlEd.exe
  C:\Windows\System\IqHBlEd.exe
  2⤵
  PID:5776
- C:\Windows\System\zuJYbNq.exe
  C:\Windows\System\zuJYbNq.exe
  2⤵
  PID:5796
- C:\Windows\System\SOLJIZg.exe
  C:\Windows\System\SOLJIZg.exe
  2⤵
  PID:5812
- C:\Windows\System\UVsRSrd.exe
  C:\Windows\System\UVsRSrd.exe
  2⤵
  PID:5828
- C:\Windows\System\SrnEXeH.exe
  C:\Windows\System\SrnEXeH.exe
  2⤵
  PID:5868
- C:\Windows\System\lFoEuvq.exe
  C:\Windows\System\lFoEuvq.exe
  2⤵
  PID:5884
- C:\Windows\System\RAxCEGf.exe
  C:\Windows\System\RAxCEGf.exe
  2⤵
  PID:5900
- C:\Windows\System\QPVEqTm.exe
  C:\Windows\System\QPVEqTm.exe
  2⤵
  PID:6056
- C:\Windows\System\vrNKsYL.exe
  C:\Windows\System\vrNKsYL.exe
  2⤵
  PID:6072
- C:\Windows\System\XSRrixD.exe
  C:\Windows\System\XSRrixD.exe
  2⤵
  PID:6092
- C:\Windows\System\ZHzCpfU.exe
  C:\Windows\System\ZHzCpfU.exe
  2⤵
  PID:6116
- C:\Windows\System\DPyJSYN.exe
  C:\Windows\System\DPyJSYN.exe
  2⤵
  PID:6136
- C:\Windows\System\LpjHbFM.exe
  C:\Windows\System\LpjHbFM.exe
  2⤵
  PID:5104
- C:\Windows\System\JExoVaU.exe
  C:\Windows\System\JExoVaU.exe
  2⤵
  PID:5036
- C:\Windows\System\RRvXPVy.exe
  C:\Windows\System\RRvXPVy.exe
  2⤵
  PID:4612
- C:\Windows\System\zdGTVjd.exe
  C:\Windows\System\zdGTVjd.exe
  2⤵
  PID:5152
- C:\Windows\System\rFQNOgJ.exe
  C:\Windows\System\rFQNOgJ.exe
  2⤵
  PID:3948
- C:\Windows\System\TePidfS.exe
  C:\Windows\System\TePidfS.exe
  2⤵
  PID:4240
- C:\Windows\System\uZFkcTf.exe
  C:\Windows\System\uZFkcTf.exe
  2⤵
  PID:3196
- C:\Windows\System\xkHrvsf.exe
  C:\Windows\System\xkHrvsf.exe
  2⤵
  PID:3912
- C:\Windows\System\PpLCrry.exe
  C:\Windows\System\PpLCrry.exe
  2⤵
  PID:3976
- C:\Windows\System\TmdmIje.exe
  C:\Windows\System\TmdmIje.exe
  2⤵
  PID:4312
- C:\Windows\System\FaHyXPV.exe
  C:\Windows\System\FaHyXPV.exe
  2⤵
  PID:5232
- C:\Windows\System\KOprVUM.exe
  C:\Windows\System\KOprVUM.exe
  2⤵
  PID:5168
- C:\Windows\System\HrRqmCZ.exe
  C:\Windows\System\HrRqmCZ.exe
  2⤵
  PID:5128
- C:\Windows\System\DkJAqJd.exe
  C:\Windows\System\DkJAqJd.exe
  2⤵
  PID:4752
- C:\Windows\System\spkejtt.exe
  C:\Windows\System\spkejtt.exe
  2⤵
  PID:5300
- C:\Windows\System\GOcokHe.exe
  C:\Windows\System\GOcokHe.exe
  2⤵
  PID:5328
- C:\Windows\System\PVnzCmE.exe
  C:\Windows\System\PVnzCmE.exe
  2⤵
  PID:4748
- C:\Windows\System\wNftbSJ.exe
  C:\Windows\System\wNftbSJ.exe
  2⤵
  PID:5180
- C:\Windows\System\InfDtNN.exe
  C:\Windows\System\InfDtNN.exe
  2⤵
  PID:5248
- C:\Windows\System\lIHwAYy.exe
  C:\Windows\System\lIHwAYy.exe
  2⤵
  PID:5336
- C:\Windows\System\XIjQYaL.exe
  C:\Windows\System\XIjQYaL.exe
  2⤵
  PID:5352
- C:\Windows\System\flhqVJb.exe
  C:\Windows\System\flhqVJb.exe
  2⤵
  PID:5368
- C:\Windows\System\fsqwgEY.exe
  C:\Windows\System\fsqwgEY.exe
  2⤵
  PID:5384
- C:\Windows\System\UPjTXWE.exe
  C:\Windows\System\UPjTXWE.exe
  2⤵
  PID:5320
- C:\Windows\System\wJFLJMu.exe
  C:\Windows\System\wJFLJMu.exe
  2⤵
  PID:5432
- C:\Windows\System\QOCfSBH.exe
  C:\Windows\System\QOCfSBH.exe
  2⤵
  PID:5436
- C:\Windows\System\LcZZBIN.exe
  C:\Windows\System\LcZZBIN.exe
  2⤵
  PID:5452
- C:\Windows\System\sqEwEQv.exe
  C:\Windows\System\sqEwEQv.exe
  2⤵
  PID:4708
- C:\Windows\System\NkkrQmC.exe
  C:\Windows\System\NkkrQmC.exe
  2⤵
  PID:5508
- C:\Windows\System\vfpUwIX.exe
  C:\Windows\System\vfpUwIX.exe
  2⤵
  PID:5572
- C:\Windows\System\TprbXnj.exe
  C:\Windows\System\TprbXnj.exe
  2⤵
  PID:5648
- C:\Windows\System\RoLJwpm.exe
  C:\Windows\System\RoLJwpm.exe
  2⤵
  PID:5720
- C:\Windows\System\EugnvoX.exe
  C:\Windows\System\EugnvoX.exe
  2⤵
  PID:5788
- C:\Windows\System\TwxYBTV.exe
  C:\Windows\System\TwxYBTV.exe
  2⤵
  PID:5560
- C:\Windows\System\dNWsXRs.exe
  C:\Windows\System\dNWsXRs.exe
  2⤵
  PID:5604
- C:\Windows\System\ErJENMI.exe
  C:\Windows\System\ErJENMI.exe
  2⤵
  PID:5672
- C:\Windows\System\ORdFkVw.exe
  C:\Windows\System\ORdFkVw.exe
  2⤵
  PID:5772
- C:\Windows\System\omFeoVA.exe
  C:\Windows\System\omFeoVA.exe
  2⤵
  PID:5824
- C:\Windows\System\vewTxWC.exe
  C:\Windows\System\vewTxWC.exe
  2⤵
  PID:5740
- C:\Windows\System\pYATqbB.exe
  C:\Windows\System\pYATqbB.exe
  2⤵
  PID:992
- C:\Windows\System\ZfDVIGE.exe
  C:\Windows\System\ZfDVIGE.exe
  2⤵
  PID:6020
- C:\Windows\System\eTCwqDc.exe
  C:\Windows\System\eTCwqDc.exe
  2⤵
  PID:6032
- C:\Windows\System\njeiReF.exe
  C:\Windows\System\njeiReF.exe
  2⤵
  PID:6048
- C:\Windows\System\gnvnooY.exe
  C:\Windows\System\gnvnooY.exe
  2⤵
  PID:6068
- C:\Windows\System\qZFmVlN.exe
  C:\Windows\System\qZFmVlN.exe
  2⤵
  PID:6128
- C:\Windows\System\FwhAJwe.exe
  C:\Windows\System\FwhAJwe.exe
  2⤵
  PID:6108
- C:\Windows\System\AamjFBq.exe
  C:\Windows\System\AamjFBq.exe
  2⤵
  PID:4228
- C:\Windows\System\ROJDTUr.exe
  C:\Windows\System\ROJDTUr.exe
  2⤵
  PID:4396
- C:\Windows\System\WywQuyL.exe
  C:\Windows\System\WywQuyL.exe
  2⤵
  PID:4192
- C:\Windows\System\bSVQOGM.exe
  C:\Windows\System\bSVQOGM.exe
  2⤵
  PID:4456
- C:\Windows\System\jPWnkmV.exe
  C:\Windows\System\jPWnkmV.exe
  2⤵
  PID:3508
- C:\Windows\System\peCgwOQ.exe
  C:\Windows\System\peCgwOQ.exe
  2⤵
  PID:1444
- C:\Windows\System\NggrUmb.exe
  C:\Windows\System\NggrUmb.exe
  2⤵
  PID:4076
- C:\Windows\System\mKfJfzO.exe
  C:\Windows\System\mKfJfzO.exe
  2⤵
  PID:4736
- C:\Windows\System\khiBXwR.exe
  C:\Windows\System\khiBXwR.exe
  2⤵
  PID:5392
- C:\Windows\System\pizqZdl.exe
  C:\Windows\System\pizqZdl.exe
  2⤵
  PID:5460
- C:\Windows\System\RvuhzMN.exe
  C:\Windows\System\RvuhzMN.exe
  2⤵
  PID:5344
- C:\Windows\System\CEDflPU.exe
  C:\Windows\System\CEDflPU.exe
  2⤵
  PID:5428
- C:\Windows\System\mfvrStV.exe
  C:\Windows\System\mfvrStV.exe
  2⤵
  PID:5472
- C:\Windows\System\dNKVssr.exe
  C:\Windows\System\dNKVssr.exe
  2⤵
  PID:5652
- C:\Windows\System\mUYQAuy.exe
  C:\Windows\System\mUYQAuy.exe
  2⤵
  PID:5444
- C:\Windows\System\qQZBhWQ.exe
  C:\Windows\System\qQZBhWQ.exe
  2⤵
  PID:5784
- C:\Windows\System\maAbCYr.exe
  C:\Windows\System\maAbCYr.exe
  2⤵
  PID:5496
- C:\Windows\System\ITtMcfJ.exe
  C:\Windows\System\ITtMcfJ.exe
  2⤵
  PID:5808
- C:\Windows\System\rWnbqYN.exe
  C:\Windows\System\rWnbqYN.exe
  2⤵
  PID:5768
- C:\Windows\System\fAbpGEq.exe
  C:\Windows\System\fAbpGEq.exe
  2⤵
  PID:5804
- C:\Windows\System\KplUyTw.exe
  C:\Windows\System\KplUyTw.exe
  2⤵
  PID:5856
- C:\Windows\System\KuTfHMW.exe
  C:\Windows\System\KuTfHMW.exe
  2⤵
  PID:5896
- C:\Windows\System\vWJKpLI.exe
  C:\Windows\System\vWJKpLI.exe
  2⤵
  PID:5840
- C:\Windows\System\EOlwZcq.exe
  C:\Windows\System\EOlwZcq.exe
  2⤵
  PID:5932
- C:\Windows\System\MHhDAQF.exe
  C:\Windows\System\MHhDAQF.exe
  2⤵
  PID:5948
- C:\Windows\System\XjrOIfN.exe
  C:\Windows\System\XjrOIfN.exe
  2⤵
  PID:5968
- C:\Windows\System\AghmlSA.exe
  C:\Windows\System\AghmlSA.exe
  2⤵
  PID:5984
- C:\Windows\System\QEeWpWX.exe
  C:\Windows\System\QEeWpWX.exe
  2⤵
  PID:6000
- C:\Windows\System\vggCaDm.exe
  C:\Windows\System\vggCaDm.exe
  2⤵
  PID:6028
- C:\Windows\System\WGVuyxh.exe
  C:\Windows\System\WGVuyxh.exe
  2⤵
  PID:6064
- C:\Windows\System\BqHWZUc.exe
  C:\Windows\System\BqHWZUc.exe
  2⤵
  PID:4596
- C:\Windows\System\HaPpUDG.exe
  C:\Windows\System\HaPpUDG.exe
  2⤵
  PID:3788
- C:\Windows\System\jssTtNf.exe
  C:\Windows\System\jssTtNf.exe
  2⤵
  PID:5360
- C:\Windows\System\EyiSAAJ.exe
  C:\Windows\System\EyiSAAJ.exe
  2⤵
  PID:6044
- C:\Windows\System\QwtJmRP.exe
  C:\Windows\System\QwtJmRP.exe
  2⤵
  PID:6112
- C:\Windows\System\BprKBPx.exe
  C:\Windows\System\BprKBPx.exe
  2⤵
  PID:3244
- C:\Windows\System\GXKccSX.exe
  C:\Windows\System\GXKccSX.exe
  2⤵
  PID:5324
- C:\Windows\System\kcxPhbM.exe
  C:\Windows\System\kcxPhbM.exe
  2⤵
  PID:5852
- C:\Windows\System\EBeWJkN.exe
  C:\Windows\System\EBeWJkN.exe
  2⤵
  PID:5464
- C:\Windows\System\Ivdyqxu.exe
  C:\Windows\System\Ivdyqxu.exe
  2⤵
  PID:5544
- C:\Windows\System\osCBKhv.exe
  C:\Windows\System\osCBKhv.exe
  2⤵
  PID:5636
- C:\Windows\System\kGjejnO.exe
  C:\Windows\System\kGjejnO.exe
  2⤵
  PID:5892
- C:\Windows\System\sNDsrqF.exe
  C:\Windows\System\sNDsrqF.exe
  2⤵
  PID:5964
- C:\Windows\System\lDjKGtN.exe
  C:\Windows\System\lDjKGtN.exe
  2⤵
  PID:5468
- C:\Windows\System\ZXbPRsf.exe
  C:\Windows\System\ZXbPRsf.exe
  2⤵
  PID:5380
- C:\Windows\System\cmyfFsG.exe
  C:\Windows\System\cmyfFsG.exe
  2⤵
  PID:5848
- C:\Windows\System\rDfzkLA.exe
  C:\Windows\System\rDfzkLA.exe
  2⤵
  PID:5916
- C:\Windows\System\PFgjSjW.exe
  C:\Windows\System\PFgjSjW.exe
  2⤵
  PID:5980
- C:\Windows\System\mXnXOMa.exe
  C:\Windows\System\mXnXOMa.exe
  2⤵
  PID:3868
- C:\Windows\System\TBWlkJn.exe
  C:\Windows\System\TBWlkJn.exe
  2⤵
  PID:4856
- C:\Windows\System\oRqefGO.exe
  C:\Windows\System\oRqefGO.exe
  2⤵
  PID:6104
- C:\Windows\System\jlELmol.exe
  C:\Windows\System\jlELmol.exe
  2⤵
  PID:5244
- C:\Windows\System\gDvTDSk.exe
  C:\Windows\System\gDvTDSk.exe
  2⤵
  PID:5148
- C:\Windows\System\bPJssNl.exe
  C:\Windows\System\bPJssNl.exe
  2⤵
  PID:5688
- C:\Windows\System\mktqloL.exe
  C:\Windows\System\mktqloL.exe
  2⤵
  PID:5996
- C:\Windows\System\pMQaUEU.exe
  C:\Windows\System\pMQaUEU.exe
  2⤵
  PID:5956
- C:\Windows\System\zttwQdn.exe
  C:\Windows\System\zttwQdn.exe
  2⤵
  PID:4516
- C:\Windows\System\OFmJnFV.exe
  C:\Windows\System\OFmJnFV.exe
  2⤵
  PID:5908
- C:\Windows\System\TqoJwSL.exe
  C:\Windows\System\TqoJwSL.exe
  2⤵
  PID:5212
- C:\Windows\System\PJuMgqJ.exe
  C:\Windows\System\PJuMgqJ.exe
  2⤵
  PID:2920
- C:\Windows\System\GdDjXrr.exe
  C:\Windows\System\GdDjXrr.exe
  2⤵
  PID:6156
- C:\Windows\System\SsYgkgK.exe
  C:\Windows\System\SsYgkgK.exe
  2⤵
  PID:6172
- C:\Windows\System\SxvfXCq.exe
  C:\Windows\System\SxvfXCq.exe
  2⤵
  PID:6188
- C:\Windows\System\PtKtxcw.exe
  C:\Windows\System\PtKtxcw.exe
  2⤵
  PID:6204
- C:\Windows\System\zhRYpJA.exe
  C:\Windows\System\zhRYpJA.exe
  2⤵
  PID:6220
- C:\Windows\System\VWSSdqE.exe
  C:\Windows\System\VWSSdqE.exe
  2⤵
  PID:6236
- C:\Windows\System\qXYAmhR.exe
  C:\Windows\System\qXYAmhR.exe
  2⤵
  PID:6252
- C:\Windows\System\XidGMtu.exe
  C:\Windows\System\XidGMtu.exe
  2⤵
  PID:6268
- C:\Windows\System\VVCKEtm.exe
  C:\Windows\System\VVCKEtm.exe
  2⤵
  PID:6284
- C:\Windows\System\rtiWfBb.exe
  C:\Windows\System\rtiWfBb.exe
  2⤵
  PID:6300
- C:\Windows\System\zMOxqrw.exe
  C:\Windows\System\zMOxqrw.exe
  2⤵
  PID:6316
- C:\Windows\System\fCAMpfQ.exe
  C:\Windows\System\fCAMpfQ.exe
  2⤵
  PID:6332
- C:\Windows\System\XKKgBjS.exe
  C:\Windows\System\XKKgBjS.exe
  2⤵
  PID:6440
- C:\Windows\System\gPUwZVd.exe
  C:\Windows\System\gPUwZVd.exe
  2⤵
  PID:6456
- C:\Windows\System\ewsvHDm.exe
  C:\Windows\System\ewsvHDm.exe
  2⤵
  PID:6472
- C:\Windows\System\zMLGene.exe
  C:\Windows\System\zMLGene.exe
  2⤵
  PID:6496
- C:\Windows\System\lqNCwns.exe
  C:\Windows\System\lqNCwns.exe
  2⤵
  PID:6512
- C:\Windows\System\IWcVsWg.exe
  C:\Windows\System\IWcVsWg.exe
  2⤵
  PID:6528
- C:\Windows\System\vIPxsBq.exe
  C:\Windows\System\vIPxsBq.exe
  2⤵
  PID:6544
- C:\Windows\System\YCnVRek.exe
  C:\Windows\System\YCnVRek.exe
  2⤵
  PID:6560
- C:\Windows\System\FvPWulf.exe
  C:\Windows\System\FvPWulf.exe
  2⤵
  PID:6576
- C:\Windows\System\nAoECYP.exe
  C:\Windows\System\nAoECYP.exe
  2⤵
  PID:6592
- C:\Windows\System\yHHoJqT.exe
  C:\Windows\System\yHHoJqT.exe
  2⤵
  PID:6608
- C:\Windows\System\JyPJznn.exe
  C:\Windows\System\JyPJznn.exe
  2⤵
  PID:6624
- C:\Windows\System\YhHyjrY.exe
  C:\Windows\System\YhHyjrY.exe
  2⤵
  PID:6644
- C:\Windows\System\qKSKAWg.exe
  C:\Windows\System\qKSKAWg.exe
  2⤵
  PID:6660
- C:\Windows\System\TUgXrtu.exe
  C:\Windows\System\TUgXrtu.exe
  2⤵
  PID:6676
- C:\Windows\System\QiSrlSl.exe
  C:\Windows\System\QiSrlSl.exe
  2⤵
  PID:6692
- C:\Windows\System\nkrGays.exe
  C:\Windows\System\nkrGays.exe
  2⤵
  PID:6708
- C:\Windows\System\XeXKlMk.exe
  C:\Windows\System\XeXKlMk.exe
  2⤵
  PID:6724
- C:\Windows\System\bnSbIPI.exe
  C:\Windows\System\bnSbIPI.exe
  2⤵
  PID:6752
- C:\Windows\System\jFkmbFU.exe
  C:\Windows\System\jFkmbFU.exe
  2⤵
  PID:6768
- C:\Windows\System\USNwneE.exe
  C:\Windows\System\USNwneE.exe
  2⤵
  PID:6784
- C:\Windows\System\eNXANLp.exe
  C:\Windows\System\eNXANLp.exe
  2⤵
  PID:6800
- C:\Windows\System\ssqxvnL.exe
  C:\Windows\System\ssqxvnL.exe
  2⤵
  PID:6820
- C:\Windows\System\bjsYuwZ.exe
  C:\Windows\System\bjsYuwZ.exe
  2⤵
  PID:6836
- C:\Windows\System\eexDrxx.exe
  C:\Windows\System\eexDrxx.exe
  2⤵
  PID:6852
- C:\Windows\System\pCjdYey.exe
  C:\Windows\System\pCjdYey.exe
  2⤵
  PID:6868
- C:\Windows\System\bDvhHDo.exe
  C:\Windows\System\bDvhHDo.exe
  2⤵
  PID:6884
- C:\Windows\System\nCgKykk.exe
  C:\Windows\System\nCgKykk.exe
  2⤵
  PID:6900
- C:\Windows\System\MzwODkn.exe
  C:\Windows\System\MzwODkn.exe
  2⤵
  PID:6916
- C:\Windows\System\LOswuZH.exe
  C:\Windows\System\LOswuZH.exe
  2⤵
  PID:6932
- C:\Windows\System\aAvXlBe.exe
  C:\Windows\System\aAvXlBe.exe
  2⤵
  PID:6948
- C:\Windows\System\RRAXXgD.exe
  C:\Windows\System\RRAXXgD.exe
  2⤵
  PID:6964
- C:\Windows\System\VKvxDLh.exe
  C:\Windows\System\VKvxDLh.exe
  2⤵
  PID:6980
- C:\Windows\System\rRfbnXO.exe
  C:\Windows\System\rRfbnXO.exe
  2⤵
  PID:7000
- C:\Windows\System\TOxXaSK.exe
  C:\Windows\System\TOxXaSK.exe
  2⤵
  PID:7016
- C:\Windows\System\CjOYYlS.exe
  C:\Windows\System\CjOYYlS.exe
  2⤵
  PID:7032
- C:\Windows\System\ymFzhqD.exe
  C:\Windows\System\ymFzhqD.exe
  2⤵
  PID:7048
- C:\Windows\System\cQxNFzZ.exe
  C:\Windows\System\cQxNFzZ.exe
  2⤵
  PID:7064
- C:\Windows\System\iTUmfXx.exe
  C:\Windows\System\iTUmfXx.exe
  2⤵
  PID:7084
- C:\Windows\System\WXHfsfe.exe
  C:\Windows\System\WXHfsfe.exe
  2⤵
  PID:7104
- C:\Windows\System\wzRGLFd.exe
  C:\Windows\System\wzRGLFd.exe
  2⤵
  PID:7120
- C:\Windows\System\gagBBTG.exe
  C:\Windows\System\gagBBTG.exe
  2⤵
  PID:7136
- C:\Windows\System\FAfJHTz.exe
  C:\Windows\System\FAfJHTz.exe
  2⤵
  PID:7152
- C:\Windows\System\fMoFxtQ.exe
  C:\Windows\System\fMoFxtQ.exe
  2⤵
  PID:6052
- C:\Windows\System\mRjEYVX.exe
  C:\Windows\System\mRjEYVX.exe
  2⤵
  PID:6352
- C:\Windows\System\QifGiTW.exe
  C:\Windows\System\QifGiTW.exe
  2⤵
  PID:6380
- C:\Windows\System\zWWVkfh.exe
  C:\Windows\System\zWWVkfh.exe
  2⤵
  PID:6384
- C:\Windows\System\QaIUtqF.exe
  C:\Windows\System\QaIUtqF.exe
  2⤵
  PID:6404
- C:\Windows\System\MGHgKFb.exe
  C:\Windows\System\MGHgKFb.exe
  2⤵
  PID:6228
- C:\Windows\System\NnDbokL.exe
  C:\Windows\System\NnDbokL.exe
  2⤵
  PID:6292
- C:\Windows\System\LVZXNcM.exe
  C:\Windows\System\LVZXNcM.exe
  2⤵
  PID:6328
- C:\Windows\System\yRAvQVt.exe
  C:\Windows\System\yRAvQVt.exe
  2⤵
  PID:6344
- C:\Windows\System\cjDWuPG.exe
  C:\Windows\System\cjDWuPG.exe
  2⤵
  PID:6492
- C:\Windows\System\lUTjiDZ.exe
  C:\Windows\System\lUTjiDZ.exe
  2⤵
  PID:6468
- C:\Windows\System\vbHbNmP.exe
  C:\Windows\System\vbHbNmP.exe
  2⤵
  PID:6540
- C:\Windows\System\ELwgtys.exe
  C:\Windows\System\ELwgtys.exe
  2⤵
  PID:6584
- C:\Windows\System\vFdQMVe.exe
  C:\Windows\System\vFdQMVe.exe
  2⤵
  PID:6604
- C:\Windows\System\cqchbWG.exe
  C:\Windows\System\cqchbWG.exe
  2⤵
  PID:6620
- C:\Windows\System\McDGMCU.exe
  C:\Windows\System\McDGMCU.exe
  2⤵
  PID:6688
- C:\Windows\System\HVLMcwv.exe
  C:\Windows\System\HVLMcwv.exe
  2⤵
  PID:6764
- C:\Windows\System\anejDuh.exe
  C:\Windows\System\anejDuh.exe
  2⤵
  PID:6828
- C:\Windows\System\vugvVnp.exe
  C:\Windows\System\vugvVnp.exe
  2⤵
  PID:6748
- C:\Windows\System\tnSNndZ.exe
  C:\Windows\System\tnSNndZ.exe
  2⤵
  PID:6732
- C:\Windows\System\TKhAmVT.exe
  C:\Windows\System\TKhAmVT.exe
  2⤵
  PID:6776
- C:\Windows\System\OwgyRjK.exe
  C:\Windows\System\OwgyRjK.exe
  2⤵
  PID:6812
- C:\Windows\System\KhenhsY.exe
  C:\Windows\System\KhenhsY.exe
  2⤵
  PID:6848
- C:\Windows\System\bUWyAcQ.exe
  C:\Windows\System\bUWyAcQ.exe
  2⤵
  PID:6928
- C:\Windows\System\kPtoiXr.exe
  C:\Windows\System\kPtoiXr.exe
  2⤵
  PID:7132
- C:\Windows\System\nFPuAKM.exe
  C:\Windows\System\nFPuAKM.exe
  2⤵
  PID:7144
- C:\Windows\System\eGgtYwo.exe
  C:\Windows\System\eGgtYwo.exe
  2⤵
  PID:6164
- C:\Windows\System\AplZufU.exe
  C:\Windows\System\AplZufU.exe
  2⤵
  PID:2036
- C:\Windows\System\ocSVSrg.exe
  C:\Windows\System\ocSVSrg.exe
  2⤵
  PID:6436
- C:\Windows\System\IHYpBzV.exe
  C:\Windows\System\IHYpBzV.exe
  2⤵
  PID:5972
- C:\Windows\System\FiCFcTH.exe
  C:\Windows\System\FiCFcTH.exe
  2⤵
  PID:6244
- C:\Windows\System\LoHumlr.exe
  C:\Windows\System\LoHumlr.exe
  2⤵
  PID:6308
- C:\Windows\System\zWMpNSU.exe
  C:\Windows\System\zWMpNSU.exe
  2⤵
  PID:6368
- C:\Windows\System\CJFNgAh.exe
  C:\Windows\System\CJFNgAh.exe
  2⤵
  PID:6396
- C:\Windows\System\LrHwbbQ.exe
  C:\Windows\System\LrHwbbQ.exe
  2⤵
  PID:6420
- C:\Windows\System\ddIWAwE.exe
  C:\Windows\System\ddIWAwE.exe
  2⤵
  PID:6360
- C:\Windows\System\qScQqDY.exe
  C:\Windows\System\qScQqDY.exe
  2⤵
  PID:7028
- C:\Windows\System\mCyEjPW.exe
  C:\Windows\System\mCyEjPW.exe
  2⤵
  PID:7100
- C:\Windows\System\WirMqrt.exe
  C:\Windows\System\WirMqrt.exe
  2⤵
  PID:6908
- C:\Windows\System\kGOKTCC.exe
  C:\Windows\System\kGOKTCC.exe
  2⤵
  PID:6976
- C:\Windows\System\lUpMxgg.exe
  C:\Windows\System\lUpMxgg.exe
  2⤵
  PID:7044
- C:\Windows\System\Xgejszs.exe
  C:\Windows\System\Xgejszs.exe
  2⤵
  PID:7164
- C:\Windows\System\TODBXtF.exe
  C:\Windows\System\TODBXtF.exe
  2⤵
  PID:5864
- C:\Windows\System\XfbjENm.exe
  C:\Windows\System\XfbjENm.exe
  2⤵
  PID:6760
- C:\Windows\System\BcOXNEl.exe
  C:\Windows\System\BcOXNEl.exe
  2⤵
  PID:6640
- C:\Windows\System\zykPDRX.exe
  C:\Windows\System\zykPDRX.exe
  2⤵
  PID:6480
- C:\Windows\System\puUxhrB.exe
  C:\Windows\System\puUxhrB.exe
  2⤵
  PID:6600
- C:\Windows\System\VONdAra.exe
  C:\Windows\System\VONdAra.exe
  2⤵
  PID:6808
- C:\Windows\System\qmjhFhv.exe
  C:\Windows\System\qmjhFhv.exe
  2⤵
  PID:6700
- C:\Windows\System\YkiuDgU.exe
  C:\Windows\System\YkiuDgU.exe
  2⤵
  PID:6992
- C:\Windows\System\HSVJxAA.exe
  C:\Windows\System\HSVJxAA.exe
  2⤵
  PID:7072
- C:\Windows\System\kdmHvvT.exe
  C:\Windows\System\kdmHvvT.exe
  2⤵
  PID:7076
- C:\Windows\System\oLzqStB.exe
  C:\Windows\System\oLzqStB.exe
  2⤵
  PID:6972
- C:\Windows\System\qWCFDQP.exe
  C:\Windows\System\qWCFDQP.exe
  2⤵
  PID:6940
- C:\Windows\System\tJmcMwj.exe
  C:\Windows\System\tJmcMwj.exe
  2⤵
  PID:6212
- C:\Windows\System\VOnGthF.exe
  C:\Windows\System\VOnGthF.exe
  2⤵
  PID:6260
- C:\Windows\System\kAjSlJD.exe
  C:\Windows\System\kAjSlJD.exe
  2⤵
  PID:6508
- C:\Windows\System\VdCjDqc.exe
  C:\Windows\System\VdCjDqc.exe
  2⤵
  PID:6280
- C:\Windows\System\aMieMnT.exe
  C:\Windows\System\aMieMnT.exe
  2⤵
  PID:6148
- C:\Windows\System\xGevckF.exe
  C:\Windows\System\xGevckF.exe
  2⤵
  PID:6452
- C:\Windows\System\ACJTHCr.exe
  C:\Windows\System\ACJTHCr.exe
  2⤵
  PID:6572
- C:\Windows\System\wGcIvyw.exe
  C:\Windows\System\wGcIvyw.exe
  2⤵
  PID:6960
- C:\Windows\System\rTiWKIK.exe
  C:\Windows\System\rTiWKIK.exe
  2⤵
  PID:6704
- C:\Windows\System\arBOHZW.exe
  C:\Windows\System\arBOHZW.exe
  2⤵
  PID:7228
- C:\Windows\System\sxKCrmH.exe
  C:\Windows\System\sxKCrmH.exe
  2⤵
  PID:7244
- C:\Windows\System\HkWCdWS.exe
  C:\Windows\System\HkWCdWS.exe
  2⤵
  PID:7260
- C:\Windows\System\pjCMrwX.exe
  C:\Windows\System\pjCMrwX.exe
  2⤵
  PID:7276
- C:\Windows\System\ACxUSGD.exe
  C:\Windows\System\ACxUSGD.exe
  2⤵
  PID:7292
- C:\Windows\System\KpqHCxP.exe
  C:\Windows\System\KpqHCxP.exe
  2⤵
  PID:7308
- C:\Windows\System\mGEgCwL.exe
  C:\Windows\System\mGEgCwL.exe
  2⤵
  PID:7324
- C:\Windows\System\bcBrGyf.exe
  C:\Windows\System\bcBrGyf.exe
  2⤵
  PID:7340
- C:\Windows\System\GtuiScm.exe
  C:\Windows\System\GtuiScm.exe
  2⤵
  PID:7360
- C:\Windows\System\BLXBDpR.exe
  C:\Windows\System\BLXBDpR.exe
  2⤵
  PID:7376
- C:\Windows\System\VRktelb.exe
  C:\Windows\System\VRktelb.exe
  2⤵
  PID:7396
- C:\Windows\System\QuDmcjv.exe
  C:\Windows\System\QuDmcjv.exe
  2⤵
  PID:7412
- C:\Windows\System\kPlHBfA.exe
  C:\Windows\System\kPlHBfA.exe
  2⤵
  PID:7428
- C:\Windows\System\fQtZiOR.exe
  C:\Windows\System\fQtZiOR.exe
  2⤵
  PID:7444
- C:\Windows\System\ssDflxc.exe
  C:\Windows\System\ssDflxc.exe
  2⤵
  PID:7460
- C:\Windows\System\hideWcd.exe
  C:\Windows\System\hideWcd.exe
  2⤵
  PID:7480
- C:\Windows\System\JpXBRRS.exe
  C:\Windows\System\JpXBRRS.exe
  2⤵
  PID:7496
- C:\Windows\System\MtDprHf.exe
  C:\Windows\System\MtDprHf.exe
  2⤵
  PID:7512
- C:\Windows\System\CFahYqJ.exe
  C:\Windows\System\CFahYqJ.exe
  2⤵
  PID:7528
- C:\Windows\System\zhsfZmq.exe
  C:\Windows\System\zhsfZmq.exe
  2⤵
  PID:7544
- C:\Windows\System\nLYdjTy.exe
  C:\Windows\System\nLYdjTy.exe
  2⤵
  PID:7560
- C:\Windows\System\ZCedZFs.exe
  C:\Windows\System\ZCedZFs.exe
  2⤵
  PID:7576
- C:\Windows\System\qNArMSd.exe
  C:\Windows\System\qNArMSd.exe
  2⤵
  PID:7592
- C:\Windows\System\vibHaIw.exe
  C:\Windows\System\vibHaIw.exe
  2⤵
  PID:7616
- C:\Windows\System\VUjLuUT.exe
  C:\Windows\System\VUjLuUT.exe
  2⤵
  PID:7632
- C:\Windows\System\XDERsrc.exe
  C:\Windows\System\XDERsrc.exe
  2⤵
  PID:7648
- C:\Windows\System\XsUvTfO.exe
  C:\Windows\System\XsUvTfO.exe
  2⤵
  PID:7664
- C:\Windows\System\ebibNqE.exe
  C:\Windows\System\ebibNqE.exe
  2⤵
  PID:7680
- C:\Windows\System\dRUcqeb.exe
  C:\Windows\System\dRUcqeb.exe
  2⤵
  PID:7700
- C:\Windows\System\PnIKPvb.exe
  C:\Windows\System\PnIKPvb.exe
  2⤵
  PID:7716
- C:\Windows\System\ccWbaYA.exe
  C:\Windows\System\ccWbaYA.exe
  2⤵
  PID:7732
- C:\Windows\System\KrAzAtg.exe
  C:\Windows\System\KrAzAtg.exe
  2⤵
  PID:7752
- C:\Windows\System\XtednfM.exe
  C:\Windows\System\XtednfM.exe
  2⤵
  PID:7768
- C:\Windows\System\isjUPBk.exe
  C:\Windows\System\isjUPBk.exe
  2⤵
  PID:7784
- C:\Windows\System\ShuJBof.exe
  C:\Windows\System\ShuJBof.exe
  2⤵
  PID:7864
- C:\Windows\System\MLlNhBt.exe
  C:\Windows\System\MLlNhBt.exe
  2⤵
  PID:7880
- C:\Windows\System\eYusnrC.exe
  C:\Windows\System\eYusnrC.exe
  2⤵
  PID:7900
- C:\Windows\System\TuExQNO.exe
  C:\Windows\System\TuExQNO.exe
  2⤵
  PID:7916
- C:\Windows\System\uWkpjtf.exe
  C:\Windows\System\uWkpjtf.exe
  2⤵
  PID:7932
- C:\Windows\System\PxaeUck.exe
  C:\Windows\System\PxaeUck.exe
  2⤵
  PID:7948
- C:\Windows\System\BBDNnvx.exe
  C:\Windows\System\BBDNnvx.exe
  2⤵
  PID:7964
- C:\Windows\System\ReyqFns.exe
  C:\Windows\System\ReyqFns.exe
  2⤵
  PID:7988
- C:\Windows\System\iOakOiK.exe
  C:\Windows\System\iOakOiK.exe
  2⤵
  PID:8004
- C:\Windows\System\ZMASkvV.exe
  C:\Windows\System\ZMASkvV.exe
  2⤵
  PID:8024
- C:\Windows\System\qUFILAo.exe
  C:\Windows\System\qUFILAo.exe
  2⤵
  PID:8040
- C:\Windows\System\qSrwUlP.exe
  C:\Windows\System\qSrwUlP.exe
  2⤵
  PID:8056
- C:\Windows\System\nkFtahc.exe
  C:\Windows\System\nkFtahc.exe
  2⤵
  PID:8072
- C:\Windows\System\LnVDHCy.exe
  C:\Windows\System\LnVDHCy.exe
  2⤵
  PID:8088
- C:\Windows\System\RBeaPiC.exe
  C:\Windows\System\RBeaPiC.exe
  2⤵
  PID:8104
- C:\Windows\System\lHHcouV.exe
  C:\Windows\System\lHHcouV.exe
  2⤵
  PID:8132
- C:\Windows\System\zQfaQTj.exe
  C:\Windows\System\zQfaQTj.exe
  2⤵
  PID:8152
- C:\Windows\System\fYglCSe.exe
  C:\Windows\System\fYglCSe.exe
  2⤵
  PID:8168
- C:\Windows\System\vUuiAtj.exe
  C:\Windows\System\vUuiAtj.exe
  2⤵
  PID:8188
- C:\Windows\System\imKNEpB.exe
  C:\Windows\System\imKNEpB.exe
  2⤵
  PID:6200
- C:\Windows\System\MMrglyp.exe
  C:\Windows\System\MMrglyp.exe
  2⤵
  PID:5540
- C:\Windows\System\hMFTREW.exe
  C:\Windows\System\hMFTREW.exe
  2⤵
  PID:7224
- C:\Windows\System\pCQTdye.exe
  C:\Windows\System\pCQTdye.exe
  2⤵
  PID:7272
- C:\Windows\System\LUtmBNo.exe
  C:\Windows\System\LUtmBNo.exe
  2⤵
  PID:7336
- C:\Windows\System\ekntpBb.exe
  C:\Windows\System\ekntpBb.exe
  2⤵
  PID:7404
- C:\Windows\System\PaoiVno.exe
  C:\Windows\System\PaoiVno.exe
  2⤵
  PID:7468
- C:\Windows\System\hrCMERp.exe
  C:\Windows\System\hrCMERp.exe
  2⤵
  PID:7536
- C:\Windows\System\sQLlTbb.exe
  C:\Windows\System\sQLlTbb.exe
  2⤵
  PID:7600
- C:\Windows\System\UGVpBoW.exe
  C:\Windows\System\UGVpBoW.exe
  2⤵
  PID:7284
- C:\Windows\System\VAEBfyM.exe
  C:\Windows\System\VAEBfyM.exe
  2⤵
  PID:7676
- C:\Windows\System\pamPAue.exe
  C:\Windows\System\pamPAue.exe
  2⤵
  PID:7744
- C:\Windows\System\hYOSEPl.exe
  C:\Windows\System\hYOSEPl.exe
  2⤵
  PID:7316
- C:\Windows\System\KyVsDRY.exe
  C:\Windows\System\KyVsDRY.exe
  2⤵
  PID:7384
- C:\Windows\System\SRfQaaL.exe
  C:\Windows\System\SRfQaaL.exe
  2⤵
  PID:7452
- C:\Windows\System\jcWyvJM.exe
  C:\Windows\System\jcWyvJM.exe
  2⤵
  PID:7492
- C:\Windows\System\WnpawTk.exe
  C:\Windows\System\WnpawTk.exe
  2⤵
  PID:7588
- C:\Windows\System\gTmeVcy.exe
  C:\Windows\System\gTmeVcy.exe
  2⤵
  PID:7748
- C:\Windows\System\gmGAZCM.exe
  C:\Windows\System\gmGAZCM.exe
  2⤵
  PID:7696
- C:\Windows\System\wYGOkeC.exe
  C:\Windows\System\wYGOkeC.exe
  2⤵
  PID:7796
- C:\Windows\System\tkQvccE.exe
  C:\Windows\System\tkQvccE.exe
  2⤵
  PID:7804
- C:\Windows\System\NnkaCpd.exe
  C:\Windows\System\NnkaCpd.exe
  2⤵
  PID:7824
- C:\Windows\System\gypwPvA.exe
  C:\Windows\System\gypwPvA.exe
  2⤵
  PID:7840
- C:\Windows\System\aaYBjcQ.exe
  C:\Windows\System\aaYBjcQ.exe
  2⤵
  PID:7856
- C:\Windows\System\JyCyYAQ.exe
  C:\Windows\System\JyCyYAQ.exe
  2⤵
  PID:7912
- C:\Windows\System\xxSRxCt.exe
  C:\Windows\System\xxSRxCt.exe
  2⤵
  PID:7980
- C:\Windows\System\dvxUCoL.exe
  C:\Windows\System\dvxUCoL.exe
  2⤵
  PID:8016
- C:\Windows\System\pGpVkao.exe
  C:\Windows\System\pGpVkao.exe
  2⤵
  PID:7860
- C:\Windows\System\mwMZMSY.exe
  C:\Windows\System\mwMZMSY.exe
  2⤵
  PID:7896
- C:\Windows\System\kkpUJDT.exe
  C:\Windows\System\kkpUJDT.exe
  2⤵
  PID:8052
- C:\Windows\System\EztTkFv.exe
  C:\Windows\System\EztTkFv.exe
  2⤵
  PID:8064
- C:\Windows\System\DJHkBlu.exe
  C:\Windows\System\DJHkBlu.exe
  2⤵
  PID:8068
- C:\Windows\System\KiHPwAr.exe
  C:\Windows\System\KiHPwAr.exe
  2⤵
  PID:8100
- C:\Windows\System\KAuniap.exe
  C:\Windows\System\KAuniap.exe
  2⤵
  PID:6276
- C:\Windows\System\KwMoUfq.exe
  C:\Windows\System\KwMoUfq.exe
  2⤵
  PID:7092
- C:\Windows\System\TVUAUiV.exe
  C:\Windows\System\TVUAUiV.exe
  2⤵
  PID:6656
- C:\Windows\System\WyNZFMw.exe
  C:\Windows\System\WyNZFMw.exe
  2⤵
  PID:6348
- C:\Windows\System\SbZBsXu.exe
  C:\Windows\System\SbZBsXu.exe
  2⤵
  PID:6988
- C:\Windows\System\qmhFWAL.exe
  C:\Windows\System\qmhFWAL.exe
  2⤵
  PID:6844
- C:\Windows\System\fTxfSpl.exe
  C:\Windows\System\fTxfSpl.exe
  2⤵
  PID:7040
- C:\Windows\System\JSxVdxf.exe
  C:\Windows\System\JSxVdxf.exe
  2⤵
  PID:7220
- C:\Windows\System\womghiK.exe
  C:\Windows\System\womghiK.exe
  2⤵
  PID:6504
- C:\Windows\System\FoduEIz.exe
  C:\Windows\System\FoduEIz.exe
  2⤵
  PID:7240
- C:\Windows\System\pCQNszE.exe
  C:\Windows\System\pCQNszE.exe
  2⤵
  PID:7216
- C:\Windows\System\CdkZPQQ.exe
  C:\Windows\System\CdkZPQQ.exe
  2⤵
  PID:7332
- C:\Windows\System\BCLTvmE.exe
  C:\Windows\System\BCLTvmE.exe
  2⤵
  PID:7508
- C:\Windows\System\OlldeHZ.exe
  C:\Windows\System\OlldeHZ.exe
  2⤵
  PID:6860
- C:\Windows\System\RNKGVSH.exe
  C:\Windows\System\RNKGVSH.exe
  2⤵
  PID:7612
- C:\Windows\System\DXFTiiJ.exe
  C:\Windows\System\DXFTiiJ.exe
  2⤵
  PID:7584
- C:\Windows\System\PpSRBTo.exe
  C:\Windows\System\PpSRBTo.exe
  2⤵
  PID:7556
- C:\Windows\System\vZAqbTg.exe
  C:\Windows\System\vZAqbTg.exe
  2⤵
  PID:7660
- C:\Windows\System\sRneTuJ.exe
  C:\Windows\System\sRneTuJ.exe
  2⤵
  PID:7792
- C:\Windows\System\lVengHD.exe
  C:\Windows\System\lVengHD.exe
  2⤵
  PID:7356
- C:\Windows\System\igRJhXF.exe
  C:\Windows\System\igRJhXF.exe
  2⤵
  PID:7760
- C:\Windows\System\fdylrhY.exe
  C:\Windows\System\fdylrhY.exe
  2⤵
  PID:7876
- C:\Windows\System\rkdYVfG.exe
  C:\Windows\System\rkdYVfG.exe
  2⤵
  PID:7888
- C:\Windows\System\pvjSMsD.exe
  C:\Windows\System\pvjSMsD.exe
  2⤵
  PID:7944
- C:\Windows\System\hwvPXGN.exe
  C:\Windows\System\hwvPXGN.exe
  2⤵
  PID:8000
- C:\Windows\System\YDRZRTM.exe
  C:\Windows\System\YDRZRTM.exe
  2⤵
  PID:8032
- C:\Windows\System\QkGZNmM.exe
  C:\Windows\System\QkGZNmM.exe
  2⤵
  PID:8128
- C:\Windows\System\xzJhELX.exe
  C:\Windows\System\xzJhELX.exe
  2⤵
  PID:8144
- C:\Windows\System\slMgJvg.exe
  C:\Windows\System\slMgJvg.exe
  2⤵
  PID:6616
- C:\Windows\System\YFUYOxv.exe
  C:\Windows\System\YFUYOxv.exe
  2⤵
  PID:6340
- C:\Windows\System\rKZtbvb.exe
  C:\Windows\System\rKZtbvb.exe
  2⤵
  PID:7268
- C:\Windows\System\qocuAKj.exe
  C:\Windows\System\qocuAKj.exe
  2⤵
  PID:7424
- C:\Windows\System\nsxmqca.exe
  C:\Windows\System\nsxmqca.exe
  2⤵
  PID:7728
- C:\Windows\System\ncsHPpH.exe
  C:\Windows\System\ncsHPpH.exe
  2⤵
  PID:7608
- C:\Windows\System\rvZFqRc.exe
  C:\Windows\System\rvZFqRc.exe
  2⤵
  PID:6568
- C:\Windows\System\mWhOQWA.exe
  C:\Windows\System\mWhOQWA.exe
  2⤵
  PID:7740
- C:\Windows\System\LAkTrBk.exe
  C:\Windows\System\LAkTrBk.exe
  2⤵
  PID:7836
- C:\Windows\System\GngNhLF.exe
  C:\Windows\System\GngNhLF.exe
  2⤵
  PID:7012
- C:\Windows\System\RKIYvmp.exe
  C:\Windows\System\RKIYvmp.exe
  2⤵
  PID:7692
- C:\Windows\System\HjsczFY.exe
  C:\Windows\System\HjsczFY.exe
  2⤵
  PID:8096
- C:\Windows\System\AlsiaNE.exe
  C:\Windows\System\AlsiaNE.exe
  2⤵
  PID:7924
- C:\Windows\System\qKdBOTI.exe
  C:\Windows\System\qKdBOTI.exe
  2⤵
  PID:6196
- C:\Windows\System\vlueKZk.exe
  C:\Windows\System\vlueKZk.exe
  2⤵
  PID:7504
- C:\Windows\System\fxnxoIv.exe
  C:\Windows\System\fxnxoIv.exe
  2⤵
  PID:7672
- C:\Windows\System\ohwQqmH.exe
  C:\Windows\System\ohwQqmH.exe
  2⤵
  PID:7712
- C:\Windows\System\kKlYccP.exe
  C:\Windows\System\kKlYccP.exe
  2⤵
  PID:7960
- C:\Windows\System\FExLuwt.exe
  C:\Windows\System\FExLuwt.exe
  2⤵
  PID:8140
- C:\Windows\System\RRfzaXC.exe
  C:\Windows\System\RRfzaXC.exe
  2⤵
  PID:7172
- C:\Windows\System\fTRsacF.exe
  C:\Windows\System\fTRsacF.exe
  2⤵
  PID:8196
- C:\Windows\System\rLeCoJj.exe
  C:\Windows\System\rLeCoJj.exe
  2⤵
  PID:8212
- C:\Windows\System\kYmULHH.exe
  C:\Windows\System\kYmULHH.exe
  2⤵
  PID:8228
- C:\Windows\System\NGOHIXg.exe
  C:\Windows\System\NGOHIXg.exe
  2⤵
  PID:8244
- C:\Windows\System\vpvQHrd.exe
  C:\Windows\System\vpvQHrd.exe
  2⤵
  PID:8260
- C:\Windows\System\VosRyLp.exe
  C:\Windows\System\VosRyLp.exe
  2⤵
  PID:8276
- C:\Windows\System\xyJnIhU.exe
  C:\Windows\System\xyJnIhU.exe
  2⤵
  PID:8292
- C:\Windows\System\tbGImhU.exe
  C:\Windows\System\tbGImhU.exe
  2⤵
  PID:8308
- C:\Windows\System\LIIfkCa.exe
  C:\Windows\System\LIIfkCa.exe
  2⤵
  PID:8324
- C:\Windows\System\nbVPbCa.exe
  C:\Windows\System\nbVPbCa.exe
  2⤵
  PID:8340
- C:\Windows\System\MbcWzhR.exe
  C:\Windows\System\MbcWzhR.exe
  2⤵
  PID:8356
- C:\Windows\System\INjIINL.exe
  C:\Windows\System\INjIINL.exe
  2⤵
  PID:8372
- C:\Windows\System\IqkFuLL.exe
  C:\Windows\System\IqkFuLL.exe
  2⤵
  PID:8388
- C:\Windows\System\BiIaKsg.exe
  C:\Windows\System\BiIaKsg.exe
  2⤵
  PID:8404
- C:\Windows\System\HaclGPe.exe
  C:\Windows\System\HaclGPe.exe
  2⤵
  PID:8420
- C:\Windows\System\uHrGkQX.exe
  C:\Windows\System\uHrGkQX.exe
  2⤵
  PID:8436
- C:\Windows\System\zVxLKeQ.exe
  C:\Windows\System\zVxLKeQ.exe
  2⤵
  PID:8452
- C:\Windows\System\sBkzCvp.exe
  C:\Windows\System\sBkzCvp.exe
  2⤵
  PID:8468
- C:\Windows\System\rFJjriH.exe
  C:\Windows\System\rFJjriH.exe
  2⤵
  PID:8484
- C:\Windows\System\RbMQFQs.exe
  C:\Windows\System\RbMQFQs.exe
  2⤵
  PID:8500
- C:\Windows\System\sSJQJoc.exe
  C:\Windows\System\sSJQJoc.exe
  2⤵
  PID:8516
- C:\Windows\System\agaqVmq.exe
  C:\Windows\System\agaqVmq.exe
  2⤵
  PID:8532
- C:\Windows\System\yrnsboP.exe
  C:\Windows\System\yrnsboP.exe
  2⤵
  PID:8548
- C:\Windows\System\BEfAsJJ.exe
  C:\Windows\System\BEfAsJJ.exe
  2⤵
  PID:8564
- C:\Windows\System\NlDkYHH.exe
  C:\Windows\System\NlDkYHH.exe
  2⤵
  PID:8580
- C:\Windows\System\jGCGUOP.exe
  C:\Windows\System\jGCGUOP.exe
  2⤵
  PID:8596
- C:\Windows\System\qQTfTBN.exe
  C:\Windows\System\qQTfTBN.exe
  2⤵
  PID:8612
- C:\Windows\System\SHaWKDQ.exe
  C:\Windows\System\SHaWKDQ.exe
  2⤵
  PID:8628
- C:\Windows\System\qWYdyvq.exe
  C:\Windows\System\qWYdyvq.exe
  2⤵
  PID:8644
- C:\Windows\System\VhyNxxB.exe
  C:\Windows\System\VhyNxxB.exe
  2⤵
  PID:8720
- C:\Windows\System\gcbjFBU.exe
  C:\Windows\System\gcbjFBU.exe
  2⤵
  PID:8928
- C:\Windows\System\lLBTJdy.exe
  C:\Windows\System\lLBTJdy.exe
  2⤵
  PID:8948
- C:\Windows\System\ECDMaQR.exe
  C:\Windows\System\ECDMaQR.exe
  2⤵
  PID:8992
- C:\Windows\System\Jxfuqce.exe
  C:\Windows\System\Jxfuqce.exe
  2⤵
  PID:9016
- C:\Windows\System\hFqAoME.exe
  C:\Windows\System\hFqAoME.exe
  2⤵
  PID:9032
- C:\Windows\System\SujfJSm.exe
  C:\Windows\System\SujfJSm.exe
  2⤵
  PID:9048
- C:\Windows\System\yThvsOy.exe
  C:\Windows\System\yThvsOy.exe
  2⤵
  PID:9064
- C:\Windows\System\qEnIdzH.exe
  C:\Windows\System\qEnIdzH.exe
  2⤵
  PID:9080
- C:\Windows\System\IdPDNug.exe
  C:\Windows\System\IdPDNug.exe
  2⤵
  PID:9096
- C:\Windows\System\nRDlxVM.exe
  C:\Windows\System\nRDlxVM.exe
  2⤵
  PID:9112
- C:\Windows\System\PSnEXrq.exe
  C:\Windows\System\PSnEXrq.exe
  2⤵
  PID:9128
- C:\Windows\System\UjpdUnY.exe
  C:\Windows\System\UjpdUnY.exe
  2⤵
  PID:9144
- C:\Windows\System\WEGxJQf.exe
  C:\Windows\System\WEGxJQf.exe
  2⤵
  PID:9160
- C:\Windows\System\yFtakMZ.exe
  C:\Windows\System\yFtakMZ.exe
  2⤵
  PID:9176
- C:\Windows\System\AZkLTCf.exe
  C:\Windows\System\AZkLTCf.exe
  2⤵
  PID:9192
- C:\Windows\System\erenNsb.exe
  C:\Windows\System\erenNsb.exe
  2⤵
  PID:9208
- C:\Windows\System\bxkKdaj.exe
  C:\Windows\System\bxkKdaj.exe
  2⤵
  PID:8208
- C:\Windows\System\ZaiYgly.exe
  C:\Windows\System\ZaiYgly.exe
  2⤵
  PID:7192
- C:\Windows\System\TyNPieG.exe
  C:\Windows\System\TyNPieG.exe
  2⤵
  PID:6924
- C:\Windows\System\oYiQtdd.exe
  C:\Windows\System\oYiQtdd.exe
  2⤵
  PID:8164
- C:\Windows\System\VEpcLpf.exe
  C:\Windows\System\VEpcLpf.exe
  2⤵
  PID:8268
- C:\Windows\System\WWDtgaw.exe
  C:\Windows\System\WWDtgaw.exe
  2⤵
  PID:7976
- C:\Windows\System\qLITLcG.exe
  C:\Windows\System\qLITLcG.exe
  2⤵
  PID:8256
- C:\Windows\System\VBmDLLC.exe
  C:\Windows\System\VBmDLLC.exe
  2⤵
  PID:8336
- C:\Windows\System\qLfvEDx.exe
  C:\Windows\System\qLfvEDx.exe
  2⤵
  PID:8368
- C:\Windows\System\pGhFgaW.exe
  C:\Windows\System\pGhFgaW.exe
  2⤵
  PID:8400
- C:\Windows\System\WWYiGnJ.exe
  C:\Windows\System\WWYiGnJ.exe
  2⤵
  PID:8464
- C:\Windows\System\NLaGMWt.exe
  C:\Windows\System\NLaGMWt.exe
  2⤵
  PID:8528
- C:\Windows\System\bNCCFOg.exe
  C:\Windows\System\bNCCFOg.exe
  2⤵
  PID:8592
- C:\Windows\System\elSsaxs.exe
  C:\Windows\System\elSsaxs.exe
  2⤵
  PID:8652
- C:\Windows\System\BvjCNVs.exe
  C:\Windows\System\BvjCNVs.exe
  2⤵
  PID:8476
- C:\Windows\System\veSnpSP.exe
  C:\Windows\System\veSnpSP.exe
  2⤵
  PID:8348
- C:\Windows\System\BeRQLjm.exe
  C:\Windows\System\BeRQLjm.exe
  2⤵
  PID:8384
- C:\Windows\System\rEpBulx.exe
  C:\Windows\System\rEpBulx.exe
  2⤵
  PID:8576
- C:\Windows\System\vJXRHMc.exe
  C:\Windows\System\vJXRHMc.exe
  2⤵
  PID:8660
- C:\Windows\System\VRyqzVY.exe
  C:\Windows\System\VRyqzVY.exe
  2⤵
  PID:8672
- C:\Windows\System\zwNKLRa.exe
  C:\Windows\System\zwNKLRa.exe
  2⤵
  PID:8684
- C:\Windows\System\SeanLrS.exe
  C:\Windows\System\SeanLrS.exe
  2⤵
  PID:8704
- C:\Windows\System\zUmzITj.exe
  C:\Windows\System\zUmzITj.exe
  2⤵
  PID:8728
- C:\Windows\System\qkatvci.exe
  C:\Windows\System\qkatvci.exe
  2⤵
  PID:8748
- C:\Windows\System\oljUMmP.exe
  C:\Windows\System\oljUMmP.exe
  2⤵
  PID:8764
- C:\Windows\System\pZKsVTW.exe
  C:\Windows\System\pZKsVTW.exe
  2⤵
  PID:8780
- C:\Windows\System\lyGLdfS.exe
  C:\Windows\System\lyGLdfS.exe
  2⤵
  PID:8796
- C:\Windows\System\wMJzQuu.exe
  C:\Windows\System\wMJzQuu.exe
  2⤵
  PID:8808
- C:\Windows\System\RtudbTX.exe
  C:\Windows\System\RtudbTX.exe
  2⤵
  PID:8824
- C:\Windows\System\HsHCbUP.exe
  C:\Windows\System\HsHCbUP.exe
  2⤵
  PID:8840
- C:\Windows\System\vVqmQdQ.exe
  C:\Windows\System\vVqmQdQ.exe
  2⤵
  PID:8860
- C:\Windows\System\TYxHqnh.exe
  C:\Windows\System\TYxHqnh.exe
  2⤵
  PID:8876
- C:\Windows\System\LYmOFSW.exe
  C:\Windows\System\LYmOFSW.exe
  2⤵
  PID:8896
- C:\Windows\System\svmzIKV.exe
  C:\Windows\System\svmzIKV.exe
  2⤵
  PID:8908
- C:\Windows\System\FlZllCu.exe
  C:\Windows\System\FlZllCu.exe
  2⤵
  PID:8956
- C:\Windows\System\ArYaZWW.exe
  C:\Windows\System\ArYaZWW.exe
  2⤵
  PID:8940
- C:\Windows\System\NmZaaUM.exe
  C:\Windows\System\NmZaaUM.exe
  2⤵
  PID:9012
- C:\Windows\System\JyAvbdg.exe
  C:\Windows\System\JyAvbdg.exe
  2⤵
  PID:8968
- C:\Windows\System\watkuoD.exe
  C:\Windows\System\watkuoD.exe
  2⤵
  PID:9076
- C:\Windows\System\MAEWbMF.exe
  C:\Windows\System\MAEWbMF.exe
  2⤵
  PID:8984
- C:\Windows\System\ChPVorY.exe
  C:\Windows\System\ChPVorY.exe
  2⤵
  PID:6796
- C:\Windows\System\QbYtzvw.exe
  C:\Windows\System\QbYtzvw.exe
  2⤵
  PID:9188
- C:\Windows\System\yteXBdR.exe
  C:\Windows\System\yteXBdR.exe
  2⤵
  PID:8320
- C:\Windows\System\UbDoKCR.exe
  C:\Windows\System\UbDoKCR.exe
  2⤵
  PID:8204
- C:\Windows\System\aJNpdlv.exe
  C:\Windows\System\aJNpdlv.exe
  2⤵
  PID:8524
- C:\Windows\System\LYSWzqw.exe
  C:\Windows\System\LYSWzqw.exe
  2⤵
  PID:8432
- C:\Windows\System\OjwFxdN.exe
  C:\Windows\System\OjwFxdN.exe
  2⤵
  PID:8588
- C:\Windows\System\IfpPrPU.exe
  C:\Windows\System\IfpPrPU.exe
  2⤵
  PID:8412
- C:\Windows\System\IFWaIVs.exe
  C:\Windows\System\IFWaIVs.exe
  2⤵
  PID:8540
- C:\Windows\System\KMsvoKg.exe
  C:\Windows\System\KMsvoKg.exe
  2⤵
  PID:8692
- C:\Windows\System\GohGVqe.exe
  C:\Windows\System\GohGVqe.exe
  2⤵
  PID:8508
- C:\Windows\System\rwgsKLt.exe
  C:\Windows\System\rwgsKLt.exe
  2⤵
  PID:8756
- C:\Windows\System\SotPGjY.exe
  C:\Windows\System\SotPGjY.exe
  2⤵
  PID:8868
- C:\Windows\System\LiaaBmh.exe
  C:\Windows\System\LiaaBmh.exe
  2⤵
  PID:8788
- C:\Windows\System\sZgzPHU.exe
  C:\Windows\System\sZgzPHU.exe
  2⤵
  PID:8964
- C:\Windows\System\hylRVtu.exe
  C:\Windows\System\hylRVtu.exe
  2⤵
  PID:9044
- C:\Windows\System\RFOaddN.exe
  C:\Windows\System\RFOaddN.exe
  2⤵
  PID:8980
- C:\Windows\System\LPntSNO.exe
  C:\Windows\System\LPntSNO.exe
  2⤵
  PID:8680
- C:\Windows\System\Sbtclry.exe
  C:\Windows\System\Sbtclry.exe
  2⤵
  PID:8852
- C:\Windows\System\CsxKjop.exe
  C:\Windows\System\CsxKjop.exe
  2⤵
  PID:9024
- C:\Windows\System\inqKlNM.exe
  C:\Windows\System\inqKlNM.exe
  2⤵
  PID:9072
- C:\Windows\System\rBOeadi.exe
  C:\Windows\System\rBOeadi.exe
  2⤵
  PID:9088
- C:\Windows\System\rSMHuXS.exe
  C:\Windows\System\rSMHuXS.exe
  2⤵
  PID:7352
- C:\Windows\System\YoFUvDE.exe
  C:\Windows\System\YoFUvDE.exe
  2⤵
  PID:9168
- C:\Windows\System\UPZPCUz.exe
  C:\Windows\System\UPZPCUz.exe
  2⤵
  PID:7832
- C:\Windows\System\PVwDIvO.exe
  C:\Windows\System\PVwDIvO.exe
  2⤵
  PID:8300
- C:\Windows\System\vaSDgIz.exe
  C:\Windows\System\vaSDgIz.exe
  2⤵
  PID:8288
- C:\Windows\System\AwTiJTt.exe
  C:\Windows\System\AwTiJTt.exe
  2⤵
  PID:8744
- C:\Windows\System\oghNdlF.exe
  C:\Windows\System\oghNdlF.exe
  2⤵
  PID:8332
- C:\Windows\System\TkKbsTk.exe
  C:\Windows\System\TkKbsTk.exe
  2⤵
  PID:8664
- C:\Windows\System\kmMcTBO.exe
  C:\Windows\System\kmMcTBO.exe
  2⤵
  PID:8636
- C:\Windows\System\gOFhQgb.exe
  C:\Windows\System\gOFhQgb.exe
  2⤵
  PID:9228
- C:\Windows\System\kCPGAws.exe
  C:\Windows\System\kCPGAws.exe
  2⤵
  PID:9244
- C:\Windows\System\VdaGZCu.exe
  C:\Windows\System\VdaGZCu.exe
  2⤵
  PID:9260
- C:\Windows\System\noiwcli.exe
  C:\Windows\System\noiwcli.exe
  2⤵
  PID:9276
- C:\Windows\System\DhOQMXH.exe
  C:\Windows\System\DhOQMXH.exe
  2⤵
  PID:9292
- C:\Windows\System\WwmDsxV.exe
  C:\Windows\System\WwmDsxV.exe
  2⤵
  PID:9308
- C:\Windows\System\xvXayPC.exe
  C:\Windows\System\xvXayPC.exe
  2⤵
  PID:9324
- C:\Windows\System\cWBYsiu.exe
  C:\Windows\System\cWBYsiu.exe
  2⤵
  PID:9340
- C:\Windows\System\DbXBEAW.exe
  C:\Windows\System\DbXBEAW.exe
  2⤵
  PID:9356
- C:\Windows\System\xyavQTC.exe
  C:\Windows\System\xyavQTC.exe
  2⤵
  PID:9372
- C:\Windows\System\HXqFpFq.exe
  C:\Windows\System\HXqFpFq.exe
  2⤵
  PID:9388
- C:\Windows\System\rVtRxEa.exe
  C:\Windows\System\rVtRxEa.exe
  2⤵
  PID:9404
- C:\Windows\System\anKuQvG.exe
  C:\Windows\System\anKuQvG.exe
  2⤵
  PID:9420
- C:\Windows\System\djEWGOj.exe
  C:\Windows\System\djEWGOj.exe
  2⤵
  PID:9436
- C:\Windows\System\AhXZkHV.exe
  C:\Windows\System\AhXZkHV.exe
  2⤵
  PID:9452
- C:\Windows\System\HSFjeWy.exe
  C:\Windows\System\HSFjeWy.exe
  2⤵
  PID:9468
- C:\Windows\System\AqMsrMe.exe
  C:\Windows\System\AqMsrMe.exe
  2⤵
  PID:9484
- C:\Windows\System\YaIMjrC.exe
  C:\Windows\System\YaIMjrC.exe
  2⤵
  PID:9500
- C:\Windows\System\fveUtkp.exe
  C:\Windows\System\fveUtkp.exe
  2⤵
  PID:9516
- C:\Windows\System\oxDHxoq.exe
  C:\Windows\System\oxDHxoq.exe
  2⤵
  PID:9536
- C:\Windows\System\MoYgFtc.exe
  C:\Windows\System\MoYgFtc.exe
  2⤵
  PID:9552
- C:\Windows\System\ECokzSX.exe
  C:\Windows\System\ECokzSX.exe
  2⤵
  PID:9568
- C:\Windows\System\ypBAQQK.exe
  C:\Windows\System\ypBAQQK.exe
  2⤵
  PID:9584
- C:\Windows\System\doQRvIX.exe
  C:\Windows\System\doQRvIX.exe
  2⤵
  PID:9600
- C:\Windows\System\qoTkxmZ.exe
  C:\Windows\System\qoTkxmZ.exe
  2⤵
  PID:9616
- C:\Windows\System\NBmbrsd.exe
  C:\Windows\System\NBmbrsd.exe
  2⤵
  PID:9632
- C:\Windows\System\xESgBXx.exe
  C:\Windows\System\xESgBXx.exe
  2⤵
  PID:9648
- C:\Windows\System\ryHPeuM.exe
  C:\Windows\System\ryHPeuM.exe
  2⤵
  PID:9664
- C:\Windows\System\YBcPgjp.exe
  C:\Windows\System\YBcPgjp.exe
  2⤵
  PID:9680
- C:\Windows\System\yvxPOoG.exe
  C:\Windows\System\yvxPOoG.exe
  2⤵
  PID:9696
- C:\Windows\System\mLKAkRb.exe
  C:\Windows\System\mLKAkRb.exe
  2⤵
  PID:9712
- C:\Windows\System\vlxycSc.exe
  C:\Windows\System\vlxycSc.exe
  2⤵
  PID:9728
- C:\Windows\System\ChspXjT.exe
  C:\Windows\System\ChspXjT.exe
  2⤵
  PID:9744
- C:\Windows\System\aiglHmV.exe
  C:\Windows\System\aiglHmV.exe
  2⤵
  PID:9760
- C:\Windows\System\VOIHPvx.exe
  C:\Windows\System\VOIHPvx.exe
  2⤵
  PID:9776
- C:\Windows\System\FrnJoDG.exe
  C:\Windows\System\FrnJoDG.exe
  2⤵
  PID:9792
- C:\Windows\System\DVfuvcs.exe
  C:\Windows\System\DVfuvcs.exe
  2⤵
  PID:9808
- C:\Windows\System\EXaNJPT.exe
  C:\Windows\System\EXaNJPT.exe
  2⤵
  PID:9824
- C:\Windows\System\hibyDyH.exe
  C:\Windows\System\hibyDyH.exe
  2⤵
  PID:9840
- C:\Windows\System\MMYmhNG.exe
  C:\Windows\System\MMYmhNG.exe
  2⤵
  PID:9856
- C:\Windows\System\IUdtbJX.exe
  C:\Windows\System\IUdtbJX.exe
  2⤵
  PID:9872
- C:\Windows\System\gQuteYU.exe
  C:\Windows\System\gQuteYU.exe
  2⤵
  PID:9888
- C:\Windows\System\qVjZkBU.exe
  C:\Windows\System\qVjZkBU.exe
  2⤵
  PID:9904
- C:\Windows\System\hpVcHNq.exe
  C:\Windows\System\hpVcHNq.exe
  2⤵
  PID:9920
- C:\Windows\System\WEKfjdy.exe
  C:\Windows\System\WEKfjdy.exe
  2⤵
  PID:9936
- C:\Windows\System\NUETENR.exe
  C:\Windows\System\NUETENR.exe
  2⤵
  PID:9952
- C:\Windows\System\dcelglr.exe
  C:\Windows\System\dcelglr.exe
  2⤵
  PID:9968
- C:\Windows\System\McWAIbN.exe
  C:\Windows\System\McWAIbN.exe
  2⤵
  PID:9984
- C:\Windows\System\JhYmEAU.exe
  C:\Windows\System\JhYmEAU.exe
  2⤵
  PID:10000
- C:\Windows\System\wPfHuou.exe
  C:\Windows\System\wPfHuou.exe
  2⤵
  PID:10016
- C:\Windows\System\CVXywzT.exe
  C:\Windows\System\CVXywzT.exe
  2⤵
  PID:10032
- C:\Windows\System\FpwvPgm.exe
  C:\Windows\System\FpwvPgm.exe
  2⤵
  PID:10148
- C:\Windows\System\HBEvvYc.exe
  C:\Windows\System\HBEvvYc.exe
  2⤵
  PID:10164
- C:\Windows\System\hPyopUi.exe
  C:\Windows\System\hPyopUi.exe
  2⤵
  PID:10188
- C:\Windows\System\hXpVDjD.exe
  C:\Windows\System\hXpVDjD.exe
  2⤵
  PID:10204
- C:\Windows\System\QXgcZCo.exe
  C:\Windows\System\QXgcZCo.exe
  2⤵
  PID:10236
- C:\Windows\System\jXiYjuM.exe
  C:\Windows\System\jXiYjuM.exe
  2⤵
  PID:8712
- C:\Windows\System\RrMqJaC.exe
  C:\Windows\System\RrMqJaC.exe
  2⤵
  PID:8224
- C:\Windows\System\DIdHiDN.exe
  C:\Windows\System\DIdHiDN.exe
  2⤵
  PID:1500
- C:\Windows\System\HdBmhiT.exe
  C:\Windows\System\HdBmhiT.exe
  2⤵
  PID:9268
- C:\Windows\System\zwVloXa.exe
  C:\Windows\System\zwVloXa.exe
  2⤵
  PID:9272
- C:\Windows\System\DdVKHKg.exe
  C:\Windows\System\DdVKHKg.exe
  2⤵
  PID:8696
- C:\Windows\System\QMvIasL.exe
  C:\Windows\System\QMvIasL.exe
  2⤵
  PID:9524
- C:\Windows\System\YuAmLsA.exe
  C:\Windows\System\YuAmLsA.exe
  2⤵
  PID:9428
- C:\Windows\System\gJGVwUL.exe
  C:\Windows\System\gJGVwUL.exe
  2⤵
  PID:8304
- C:\Windows\System\PoqzWxT.exe
  C:\Windows\System\PoqzWxT.exe
  2⤵
  PID:9708
- C:\Windows\System\ksukHDk.exe
  C:\Windows\System\ksukHDk.exe
  2⤵
  PID:9724
- C:\Windows\System\eZNWBff.exe
  C:\Windows\System\eZNWBff.exe
  2⤵
  PID:9800
- C:\Windows\System\ALzDIOo.exe
  C:\Windows\System\ALzDIOo.exe
  2⤵
  PID:9996
- C:\Windows\System\sYaKUOY.exe
  C:\Windows\System\sYaKUOY.exe
  2⤵
  PID:9980
- C:\Windows\System\ZSReWQL.exe
  C:\Windows\System\ZSReWQL.exe
  2⤵
  PID:10012
- C:\Windows\System\OxXnlGS.exe
  C:\Windows\System\OxXnlGS.exe
  2⤵
  PID:10048
- C:\Windows\System\Dizzqel.exe
  C:\Windows\System\Dizzqel.exe
  2⤵
  PID:10064
- C:\Windows\System\WguFnSO.exe
  C:\Windows\System\WguFnSO.exe
  2⤵
  PID:10084
- C:\Windows\System\ihbByPB.exe
  C:\Windows\System\ihbByPB.exe
  2⤵
  PID:10104
- C:\Windows\System\UjWYTEU.exe
  C:\Windows\System\UjWYTEU.exe
  2⤵
  PID:9348
- C:\Windows\System\JNZLdMm.exe
  C:\Windows\System\JNZLdMm.exe
  2⤵
  PID:9352
- C:\Windows\System\hfXKHsp.exe
  C:\Windows\System\hfXKHsp.exe
  2⤵
  PID:8772
- C:\Windows\System\yKvDsSz.exe
  C:\Windows\System\yKvDsSz.exe
  2⤵
  PID:8380
- C:\Windows\System\VJrxRKb.exe
  C:\Windows\System\VJrxRKb.exe
  2⤵
  PID:8640
- C:\Windows\System\OyRjNta.exe
  C:\Windows\System\OyRjNta.exe
  2⤵
  PID:9592
- C:\Windows\System\YoVXoEN.exe
  C:\Windows\System\YoVXoEN.exe
  2⤵
  PID:9444
- C:\Windows\System\HpxOZaz.exe
  C:\Windows\System\HpxOZaz.exe
  2⤵
  PID:9548
- C:\Windows\System\UfdlDRe.exe
  C:\Windows\System\UfdlDRe.exe
  2⤵
  PID:9336
- C:\Windows\System\CZrzUVg.exe
  C:\Windows\System\CZrzUVg.exe
  2⤵
  PID:9608
- C:\Windows\System\uUFEcAQ.exe
  C:\Windows\System\uUFEcAQ.exe
  2⤵
  PID:9672
- C:\Windows\System\CwBwMTx.exe
  C:\Windows\System\CwBwMTx.exe
  2⤵
  PID:9304
- C:\Windows\System\KbWcPSz.exe
  C:\Windows\System\KbWcPSz.exe
  2⤵
  PID:9332
- C:\Windows\System\tyjMOBl.exe
  C:\Windows\System\tyjMOBl.exe
  2⤵
  PID:9496
- C:\Windows\System\WogqQPE.exe
  C:\Windows\System\WogqQPE.exe
  2⤵
  PID:9460
- C:\Windows\System\xpRrWKS.exe
  C:\Windows\System\xpRrWKS.exe
  2⤵
  PID:9784
- C:\Windows\System\CWjQPWe.exe
  C:\Windows\System\CWjQPWe.exe
  2⤵
  PID:9880
- C:\Windows\System\BTPBJWd.exe
  C:\Windows\System\BTPBJWd.exe
  2⤵
  PID:9896
- C:\Windows\System\OQdVfmy.exe
  C:\Windows\System\OQdVfmy.exe
  2⤵
  PID:9932
- C:\Windows\System\PimtDaa.exe
  C:\Windows\System\PimtDaa.exe
  2⤵
  PID:9944
- C:\Windows\System\lJckHSe.exe
  C:\Windows\System\lJckHSe.exe
  2⤵
  PID:10092
- C:\Windows\System\IRiXSJt.exe
  C:\Windows\System\IRiXSJt.exe
  2⤵
  PID:9976
- C:\Windows\System\ecMItVJ.exe
  C:\Windows\System\ecMItVJ.exe
  2⤵
  PID:10144
- C:\Windows\System\BNsSTBk.exe
  C:\Windows\System\BNsSTBk.exe
  2⤵
  PID:10076
- C:\Windows\System\jvZfuxW.exe
  C:\Windows\System\jvZfuxW.exe
  2⤵
  PID:10124
- C:\Windows\System\JLzKiMa.exe
  C:\Windows\System\JLzKiMa.exe
  2⤵
  PID:10176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BRbqMuK.exe

Filesize
1.9MB

MD5
c5460d8dda19bc86b66b2ea1398e5932

SHA1
9ce474e9d74e0db5bdd6692b844444e95b2fe1f8

SHA256
2724861a239ab5e679c505071744ce36171e1ffd0fe588b9362a202b80dd8dbd

SHA512
334def0db09727cd131beb89df723a797f92092625462572abdc29c0a7921dc8a0847452ee3daad4b706b84f257c9e6911a50812642faeefe9c426b81b3fb6f5

Download Submit
C:\Windows\system\BcJIslM.exe

Filesize
1.9MB

MD5
b3f9e54abe3bec824d5da27221b5dddf

SHA1
372b508c6af95b416dfaa2add1ef3649883ec52a

SHA256
a1623b0a24e5f3a502a841a71e5c47c674c73eb3f7be136483a787f11a66691b

SHA512
b173ef793f8850ed40a5442726fc637444fc164307454f675a8ae972137213be1ef719328310fb719e3fddddbc22c74c19375e766b08bfa280708ea9795d9bfe

Download Submit
C:\Windows\system\DFUTkml.exe

Filesize
1.9MB

MD5
8e4a171af5467f816a2d007e3e3854d1

SHA1
0b19d4f628be20cfb3a2bdbdc70aac448f7ed661

SHA256
82fa812fa609b2477571a7c3196dc7f1a21f4dab755c43608c65a6f6d4deb1c6

SHA512
c4a40c2b4b1b5e64334ec7e37335a8ed224d3ddd09339c4323a0d399f074c79301356a4dfa2ee92fe6262c1b396f94b2603f97fe312577b782996eeda91ecf8f

Download Submit
C:\Windows\system\HfIEYiE.exe

Filesize
1.9MB

MD5
23963888615c0fc113b4dfec259209f0

SHA1
dfdf160a25b92ccb5cb1297b379c6dda63c88ec9

SHA256
132e485e7169e89b3c7ebcc0add0a85e09ec42068c70a9b40edd997afc927635

SHA512
3dbf5bf1f4cabce1e4a88cc92bb9b88bed98da59154d66118ee906b98cba81f459cbe36a7ce507f202e7f7a652c6625172ccbd91b82193bf3f9515db380d358f

Download Submit
C:\Windows\system\IcDjTmB.exe

Filesize
1.9MB

MD5
b5044d94366cd2024087d9aa699186df

SHA1
f37d357807fa40b55eecde3519a02cec2b9fa237

SHA256
18ffe125a691c402b7559cabf32072b77b7d4c4987df579597145451c41d4a35

SHA512
f26bb9e1fc11b133c261385d57b57308e4d89dec38e350a9acefba20e2e77a5109b2800728d04dc0b6990f0671b87e35788b5adbf6d241dcf69bb802a58e2e28

Download Submit
C:\Windows\system\JXMaROu.exe

Filesize
1.9MB

MD5
3882cede3503b8925bfc4239f2349d23

SHA1
4ff9d332d5842cd3893ff8566d88529dcf18b6e3

SHA256
1e0afdb76b672b9608724dc8b5f16991ea79ba8099442a1a139cd582bbb7b9c2

SHA512
3ccd52f97950f729baf37b3491277fd1aa546a4ca1a67f5c85ad1a88132cdf241c82f174a08974c30af6efd0316497713074dbf18818719c489cbf4663d2c396

Download Submit
C:\Windows\system\JZGwibE.exe

Filesize
1.9MB

MD5
2e3e80c2e7add4b454b8455a98f1ba59

SHA1
84ed4ebf46ec60ac530dd7a3ca389c8b820e104d

SHA256
2d15f3b6045ad124040b45cc8b00bbffc55f45593d397b5f5da15bdae3e8f896

SHA512
cdf532bedf0928cc62d7d839b83ce4f81f31437b1795246eeffe070e30b895bcb06e738ec13a98b01b7a1bec1b7b932884c06c215add20f395648d4596f7e29a

Download Submit
C:\Windows\system\JxqUsjK.exe

Filesize
1.9MB

MD5
4ba3dc073e3b13094d0c3a14cad98f68

SHA1
b0c141c05c4fccfc65598c8b3171b4fe17545d31

SHA256
40dbebc0fe84bd1d4ba279cdda0539483f5d3222647dbb8840fbbc6dd666afe8

SHA512
acbf954c1083c8e48cea844f4e5645bd95a3cef5c9e4eeb8a897ce34ba3d7e4d76a077ade431afa0cf8d66bd594ba446baf09dc7b622ae33ee896b5c5401288d

Download Submit
C:\Windows\system\MNuwQyP.exe

Filesize
1.9MB

MD5
7ec0e393e90287973a032adda2f01d4b

SHA1
0bf38f20f9f821abf1f239f893a0e09d47574676

SHA256
c2ec651e400d69493f459dd356a15d6c1effa33dd52b257230c40971924a2507

SHA512
6f753233796eefdee331f9acf6499bac543fbf9c940e7e412dd0d3aa2a59ec63d60d0781384c39dd5bed92b59b056c1aab1ff36f63a1fff6014b5deead24ae0c

Download Submit
C:\Windows\system\VyQObOB.exe

Filesize
1.9MB

MD5
36a18fa061434b1f0d47760ba918ec6a

SHA1
1268075278f7ce2b27365729533641d08cffc97b

SHA256
add353be4d9d1b73d8e2819635d6ec7bc09ed1f5013d00afe683b9a7ad890929

SHA512
3f1f017abf5439d6501e0d1075323112414c9a19165794ae79c5dc3c0b9aa52dbda023ee996481a117fc215b66b703fd9b27b5ad06c69ec522ed8b79e67bd9cb

Download Submit
C:\Windows\system\WuvioPx.exe

Filesize
1.9MB

MD5
34e3b151669907bfebc5a99b179cccaa

SHA1
00fe0b1bf8032e8e337fe5e5c7c08f6b9c9886d4

SHA256
ee0c487865971adad8b6dcef7347805e58444c715739f69aeed9cfb3141b83d7

SHA512
c6ccca95b89d7c66edefe347e38e1e0dda975819807c4d790edd9ec1bba0dca479ce7d05a3d6a567231174e46008b1a2db4f09699ad02a29f97b917330280fc6

Download Submit
C:\Windows\system\YCrooFW.exe

Filesize
1.9MB

MD5
a4e72cc3a5b76e3501f0cbb4295c5263

SHA1
69f3944b494e46385298409ca3685902c3822672

SHA256
79bb135362b69966056e9e53c76253d8d0b85aef2626f52269d61aba4a6af671

SHA512
d3aa8f13895c0f81a12d31f4bd038592059260dc07bc7af481b64c36a1cb01979f4cd97fe973711bd4dcf28af5347bf050884a9449baccd95c69f14333542912

Download Submit
C:\Windows\system\ZDnskPV.exe

Filesize
1.9MB

MD5
c49c874e5de2fc0dc0699fb01a93d8b1

SHA1
82ac6b8c47a511a95b103fac82c963f6735102f1

SHA256
dbd9b861395d8142da4e130c3e1ab33510a743cc70bc0bc3916bd97a5845cb97

SHA512
5fc93c83fd95a3b7d888acf1060bab95072a7c497a91971724d8cb6d09a77b228fa7ee2e90f6fbbf70350906e6f921b2a2828536e72fba55e4285d6fe883ec6b

Download Submit
C:\Windows\system\cdQdwlW.exe

Filesize
1.9MB

MD5
e8e30c3455b1cd03ba6c59be130376d8

SHA1
4f7f6d42d0cbcfe01c44168e0b971ad3ed91fed8

SHA256
259f1be99c4f82bfd18577f2d1bad0199e6ac1ac1c72e7498ff9afd36531be38

SHA512
b5ff39b0b7a93d02f77e0b7b02b75efbb7cafafb1a1d099452cb4b33f5d39fcb4e04af1bedb1142fe3eca5c9a7926b5a2c1d311ae9cea4c1f2276208e9432ef9

Download Submit
C:\Windows\system\cnvZsgx.exe

Filesize
1.9MB

MD5
ba89f3bfbdbb9362b22b06f8ad46b63a

SHA1
5f57083111e21446c3891da7b8266ad7afd735dc

SHA256
e4a3d41b201668ff9c6a84320cf8acbac17242b052722c28a78aec11d742434c

SHA512
c6a22bc380513643c3afcabbf12e84dbe7eee31f0b301b5424ba980801c4fa94de17bfc1a5293b902f4c2211b79beb59d5a794bd24a992d58e1383170e446488

Download Submit
C:\Windows\system\deEdPSt.exe

Filesize
1.9MB

MD5
75b227f2a9214e66bb5edc2e6f1cb767

SHA1
f2bc2dc461c07be5cfd5a36bc6e9fdef8a19effb

SHA256
250d89c3893d124dfdd37f1729eb84052103d34814d34a0a9566bfe0a424d671

SHA512
ce6b2e82271ff7f2ff7c93e8edbc07181acf607383c6cab9d19ef5e4277f25335f00939bf8614c052a03604d66844d8970dbbf141dcab5c33d601ae763b8e8a2

Download Submit
C:\Windows\system\eaquugE.exe

Filesize
1.9MB

MD5
a89f8cb4a50df1d14127f037ee61cbab

SHA1
98158e6b16121d956392fc41e0ea6ba659ba322f

SHA256
55402fa2bd4e96d6cc909a1aac5cdd6910390582d6cd881210f310d92aaf9807

SHA512
5354b5bc0918e8f59e5c354b2c52ceec07a7f45caca1a6564710758c880044059caea6ece96c149458d6ea3acf1984895b95d5bcdc3a2ae0bbfac98be75ec9aa

Download Submit
C:\Windows\system\hAQjNmP.exe

Filesize
1.9MB

MD5
d63811a8b5e5db95d8f96f7b654275ca

SHA1
f7f8d099691b3a07f89c3aa7a421533457c7d58c

SHA256
c0fc65b0fce625a6c9eedb4b1bc4e0d364528727c66cc6774d3a0e2885d96083

SHA512
a4757c1b457aa8d3a11fcc5961dc4aacaad01d1315550281840fac89f431df0c89a356b3bb4548a59dcaf82c08511bba08a1c30665a299e151e72779aa4b480c

Download Submit
C:\Windows\system\hcNeJvy.exe

Filesize
1.9MB

MD5
adcd80257741aad674e9de377a57574d

SHA1
b2f1e21252d1080142452d63fa92a90dd58f663c

SHA256
411967a120aab06cd9858e3c3bd1bb62abf6942c3d4a3cf6afa327adf0022a09

SHA512
143726a82f1f337921b56decd76163d6a1dbe07bb8846d8bc124471b0333eb926000a5b7f859474eaf1fe91926a6037f4396d8b14327854626891fb53d0c53d0

Download Submit
C:\Windows\system\jVhOTzc.exe

Filesize
1.9MB

MD5
a7e4c49e7a2f47f209321b281f9b8a68

SHA1
1046a0d526f8e162ae5bfa24dcee77a51a40aeb7

SHA256
76f0853d389676871171bf6f932d5cad5f34596e8603a7d9dd602f327b038038

SHA512
6b6ccb62e2f928a7f64a2c8f1607e59d84563543c2974d5518948cac5f9dcd557cb8775bc42255eebeb8ade6cb07f5fd220653344e07466b6ddd9e273ddfed87

Download Submit
C:\Windows\system\ketJAJL.exe

Filesize
1.9MB

MD5
f0eca69a6f9dfc69d08b1e5389e94930

SHA1
c7655b1cdba5147cbf6cdba5624a32b01480078d

SHA256
b7830c0e3b238980ef241139e7942d96bd670396d7e82183286715f1f509d63a

SHA512
6679e7dfc3233af73f60771a1f48abecd925ce02f62baa8c10bc50789571c15a616337ee04b9e80f3b9614db176410828a03898d120afb08bc8a921d6c8061ed

Download Submit
C:\Windows\system\lKIJDQL.exe

Filesize
1.9MB

MD5
f352a9a5dc7e5cf1b9c7f0187e994b56

SHA1
ed1d8ea214d860d01c932fcc296fdb3238523fa7

SHA256
ad22478d7a0eb465fb7a03373d8db3025b33b9882b94dd0c65e5d5711307aec0

SHA512
143d52ef89f819bd8b30f6bde38f8184597789272f68967c9ab7a92d7ea8cd77d470820184038770e16fc3f0bebca295a60e2d3827d1d8baad3a0d544c00d6b3

Download Submit
C:\Windows\system\noYONWz.exe

Filesize
1.9MB

MD5
d996cb40c9407363e35b98b16f300e9a

SHA1
304568edb290ce41b7ad1ac47d41a50bb7313e05

SHA256
cb5a8a229a973778444ee489af16e439459a90f613b835d7b07ffb7ee75fa79f

SHA512
0b17f69e59e223f09c4fd28e2d33f51b7de8b89161f623fe6573602f693e34f52221df09b88917c9a6a99bce66af5510ae3ff1a9028a162c8eee753e8b677578

Download Submit
C:\Windows\system\tqtThna.exe

Filesize
1.9MB

MD5
48f4d14745a1599c856f0c8a1c4e26dd

SHA1
c9c22557b5468c8813ea1302c76ad7088c049820

SHA256
436c3ae27a0c3a2a63c32edd60596883c14256c5de1a6a37e59e8f54193d9496

SHA512
d4f426e7e4f6351160bf8843b8d6c928f716b37a0a8c6f7a863789001c182e92ce7da7628328bd4c692568b9418dc01d0b313232913fa7fb5a8414cdf960067e

Download Submit
C:\Windows\system\xXaGurk.exe

Filesize
1.9MB

MD5
1eec5114306ee733b8111af2da3b4549

SHA1
44fbec75c8037924bc02e924f84c0ea7637bede2

SHA256
d31fe3f7a0e10aa7a6210bab8e64dae0fe28ac66b529a9b63a418dac12ba8486

SHA512
7dbfba8426b3ba4d7c1b6178bd22431bc1869a76fa345630b506fd6090ac5220d23b68af06d60a873b7565d31c40a1429faac4c8ae3514cd02c3201337e590c8

Download Submit
C:\Windows\system\zBOYIOu.exe

Filesize
1.9MB

MD5
fa58861a96627aae04d4a8a56b2c853b

SHA1
9659862616edf3c478096f0d650fb1ab383ba4c8

SHA256
81ffb046caa0ecb59f4cd6789ba6c80c2bd78bedf97c71c2e7cb5d4c20017663

SHA512
d83ba2286f3c918d8700bf54004613b061abafdcc3cd0854f4f4dd34eea5cd2c4c3b80fea27bf9cdec52649c33a4ad795cbbb13d8f049ec96fd20a1d7bd954e9

Download Submit
C:\Windows\system\zDqRFeT.exe

Filesize
1.9MB

MD5
cdf20b20b0672b1885cfa685675f8bd3

SHA1
a9b82b9d959730fbef1b707ce49a04a8b4640862

SHA256
a3df5da623b10c10e18ea381158ebf425f705677e1fe6476f7b548075aeaf37a

SHA512
373684a48e6af174c2914cfe030184205670aef80587337647f44783f25ca571cbd5ab7449acc3db060cbbedf31cd342a7cd95c066ee9ebdca700d258e99ceb9

Download Submit
C:\Windows\system\zWLipvL.exe

Filesize
1.9MB

MD5
ff8597c43dea681c9cdc1885047a7303

SHA1
7d081b05e38cf75bb0487e2f9c4cf425d86a82b8

SHA256
4498f67e6c90886d79f3dd9f1f353839c5a743f7d2558f043832780aadce9225

SHA512
282f0bce6e13f0ef9abdf8dc4ed27f39371e76c9c04ad842ef4cc79a364912dec1ddf46f84b88d0f355e6f50fa219f96e6f67cef33320797cc31eb184a47e031

Download Submit
\Windows\system\FKbggmD.exe

Filesize
1.9MB

MD5
6dae8cd1fd0c7c1ad2e55fa9e939cc87

SHA1
c48095d1cfed4ac146806071e4209cd2afc0aef1

SHA256
5d5cfeeeac7c8e37a8a3d9aa228f8bbbfcdff3f409e469ecf61f2fc42ad45eab

SHA512
52d868368e180b380c0ff17b5e66728e363aa9601abdb4f17508acda917483e014314ddb9f8b8644f8e87ee15b4d13d5e929bf3a82f281d0e46283fba370b4af

Download Submit
\Windows\system\WULgXmb.exe

Filesize
1.9MB

MD5
614979be0f7e8fadf73fc2f6e46e1959

SHA1
74205c0555ca67ee33016017aad4bd880d4cb48a

SHA256
ba5458d2687ed7b4a1fe3f16e10c05c2983db2e47135e3ee00d23da49846c4e8

SHA512
5daa8b75a428deac74cb27cc94c54976660523615903c685f586964c8f09ca34e0e99607de936e212673f732f9a62563e80e93c68df3cf5da6a637e01306706d

Download Submit
\Windows\system\fkoiJkc.exe

Filesize
1.9MB

MD5
e993723c80856e0062b5de35777aff0b

SHA1
f6c5b28dd627efc044592a5ec2ef61e73c510393

SHA256
3386bde78b0366db35a349cdd58fb61903c736de521240597d6687fc7dcdcd12

SHA512
694b723d53b800f98824537d93151e92e8f6278bbffc8fa098d73990caafe96e3a5258da24013cf6537233c0223b6a7d42ab7b19e6e2ec3e3320c914fc0f38b5

Download Submit
\Windows\system\guUENVn.exe

Filesize
1.9MB

MD5
5c4aad2d03a3a77e137777f189523ea7

SHA1
cadb547b032e180771fca00b4bdc974c3d94ad12

SHA256
d80e97be52771ea1393fc8a8f0bd7a054f814cab276b07ae38caf3d8711841e5

SHA512
9535bbf15f0f50a636bd9a925e7de74ceeeb139fe3d19837887eaf66e63369e9f938a1df691bcb8686ace73b767b692dcbd6180e6c391843926b800283a19333

Download Submit
memory/2308-80-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2428-82-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-17-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2512-71-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2516-77-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2624-75-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2628-40-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-73-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2980-83-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/3036-85-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-74-0x00000000030D0000-0x00000000034C2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/3036-84-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-72-0x00000000030D0000-0x00000000034C2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-8-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/3036-81-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/3036-0-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/3036-79-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/3036-87-0x00000000035C0000-0x00000000039B2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-86-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-76-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/3052-64-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/3052-65-0x0000000002DA0000-0x0000000002E20000-memory.dmp

Filesize
512KB

Download
memory/3052-78-0x0000000002DA0000-0x0000000002E20000-memory.dmp

Filesize
512KB

Download
memory/3052-35-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/3052-36-0x0000000002710000-0x0000000002718000-memory.dmp

Filesize
32KB

Download
memory/3052-70-0x0000000002DA0000-0x0000000002E20000-memory.dmp

Filesize
512KB

Download
memory/3052-69-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/3052-88-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download