xmrig | 5250e8fe2801d05638a6bec3a2d0bdc7c116f74f0a321467b1fe1109ee7665d7

Analysis

max time kernel
12s
max time network
27s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
Size

2.2MB
MD5

0563e0cc382192bef9be40d6ca5bb752
SHA1

25c809e95618e4277220fdf180cd0d9435180039
SHA256

5250e8fe2801d05638a6bec3a2d0bdc7c116f74f0a321467b1fe1109ee7665d7
SHA512

adb96a4f8f4d9d70e116bf369627329bfdd36d475661294c7ffa88e068321ade67dd0a47819cec5edd916d4942c0f14caacd47ebf77a3e902cc49a6095445c98
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cbRr:NABF

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2560-13-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/2420-82-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/1752-99-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2456-95-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/1588-92-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/2548-91-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2708-87-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2448-84-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2560	UJeWkAL.exe
2420	nYxdwLz.exe
2448	jvbvIgO.exe
2708	BWuXmiz.exe
2548	nsEASmG.exe
1588	aiPMxOA.exe
2456	TqKpJdY.exe
1752	jiXYdqF.exe
3020	RYsOkLr.exe
1652	gKnncie.exe
1388	qoGnwDl.exe
2848	jTmTKas.exe
1572	tCRBzKh.exe
2656	pnnfGIh.exe
1676	KrThdik.exe
2732	MMgNvtt.exe
2356	jWNQHXO.exe
1592	zfzKGRk.exe
1236	yGSJfVo.exe
2120	BuRDTKo.exe
2508	APrrvub.exe
1992	quXlGlO.exe
2064	ykLTPEp.exe
600	wsSBqLj.exe
772	jvMHwDQ.exe
3048	vEnTkGZ.exe
1148	bUhxvfO.exe
572	vwOblHq.exe
1000	vvfaElX.exe
656	XbITjVg.exe
1908	MPwFJyO.exe
1188	iwBDYfZ.exe
2092	uxqwkUT.exe
624	HWXVxDz.exe
1612	BmSCcCp.exe
1200	jKcjxfQ.exe
940	gRORgRX.exe
320	IGdnhZY.exe
2796	vZtlDWJ.exe
908	DMroEYF.exe
2232	COUNEbG.exe
2212	TlrhzjQ.exe
2032	uPAPJqs.exe
2992	mcPCaRo.exe
2004	WztvGls.exe
2792	JydthME.exe
2920	emklUZa.exe
2932	gsOgTnA.exe
2804	bmkSPki.exe
2156	mfRiLmK.exe
2184	jSavrPJ.exe
1672	RxDHUgy.exe
2204	BgwVHwb.exe
2988	NQVxGTA.exe
2624	HvWiVXk.exe
2524	TifBNWG.exe
2584	DnLjeHL.exe
2532	pWPVPyv.exe
636	BlNPyZw.exe
2300	znpZRFb.exe
1536	LjdpgPD.exe
2316	ByfidAr.exe
2836	UjFKPgb.exe
2628	jaMbwQj.exe

Loads dropped DLL 64 IoCs

pid	Process
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1888-0-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/files/0x00080000000122bf-3.dat	upx
behavioral1/memory/2560-13-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/files/0x0036000000014b10-15.dat	upx
behavioral1/files/0x001800000000558a-19.dat	upx
behavioral1/files/0x00070000000153d9-27.dat	upx
behavioral1/files/0x00080000000153c7-26.dat	upx
behavioral1/files/0x000700000001540d-35.dat	upx
behavioral1/files/0x00070000000155f6-41.dat	upx
behavioral1/files/0x0009000000015cf5-44.dat	upx
behavioral1/files/0x0006000000015d0c-48.dat	upx
behavioral1/files/0x0006000000015d44-56.dat	upx
behavioral1/files/0x0006000000015e09-68.dat	upx
behavioral1/files/0x0006000000015d4c-76.dat	upx
behavioral1/files/0x0006000000015d24-74.dat	upx
behavioral1/files/0x0006000000015e6d-70.dat	upx
behavioral1/memory/2420-82-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/files/0x0006000000015f3c-106.dat	upx
behavioral1/files/0x0035000000014b36-108.dat	upx
behavioral1/files/0x00060000000161b3-118.dat	upx
behavioral1/files/0x0006000000015fa7-111.dat	upx
behavioral1/files/0x00060000000162c9-131.dat	upx
behavioral1/files/0x000600000001654a-137.dat	upx
behavioral1/files/0x00060000000160cc-129.dat	upx
behavioral1/files/0x0006000000016476-135.dat	upx
behavioral1/files/0x0006000000016c3a-164.dat	upx
behavioral1/files/0x0006000000016ce4-181.dat	upx
behavioral1/files/0x0006000000016cb2-188.dat	upx
behavioral1/files/0x0006000000016cf5-187.dat	upx
behavioral1/files/0x0006000000016c1d-178.dat	upx
behavioral1/files/0x0006000000016c42-166.dat	upx
behavioral1/files/0x0006000000016c8c-171.dat	upx
behavioral1/files/0x0006000000016a6f-156.dat	upx
behavioral1/files/0x0006000000016813-152.dat	upx
behavioral1/files/0x00060000000165f0-145.dat	upx
behavioral1/memory/1752-99-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/memory/2456-95-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/memory/1588-92-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/2548-91-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2708-87-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/memory/2448-84-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MqfLqpX.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\dhKJhTX.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\iDtjKTU.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\lsymxis.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\RugZgTr.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\gLezsqQ.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\lUWgyPS.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\pFIPevc.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\vEnTkGZ.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\IuFhkEC.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\azWYmaj.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\EvegQzw.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\jRlKhcQ.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\oqWnAql.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\GpWsDdh.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\gsOgTnA.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\vATTcMH.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\PwapXGD.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\XdGWimB.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\GAXPUEP.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\eeIKsbS.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\coYpTZI.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\lwDpUTl.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\LrqhQSh.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\uRDDexa.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\glsdjWk.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\wjgNhXc.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\PtlouAI.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\zyfDzlM.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\mYhYlXe.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\mbedmiB.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\IKEOMmv.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\SoXNPMu.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\RptcpRU.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\QMJehlA.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\LgRhzMD.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\idpYopi.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\wcpuZJC.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\fqGzGmn.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\FfdQXty.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\HyUnCjt.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\ibTrFRL.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\bFkbBMx.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\WxtlPHo.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\bJWLDUr.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\pgDarkh.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\AeQBOid.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\fBGfMkR.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\iMeSpNC.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\AKiFhNU.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\SXdWnqM.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\WTkhcOw.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\WrovmlR.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\saRKwgh.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\vaisAEP.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\pYYBasW.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\jwtRCgb.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\XCPyUfv.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\RBBQBKj.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\SnMlByl.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\oRsvisQ.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\FpAOOnV.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\jLJrYsM.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
File created	C:\Windows\System\ZlHKgBk.exe	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2900	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
Token: SeDebugPrivilege	2900	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2900	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	29
PID 1888 wrote to memory of 2900	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	29
PID 1888 wrote to memory of 2900	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	29
PID 1888 wrote to memory of 2560	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	30
PID 1888 wrote to memory of 2560	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	30
PID 1888 wrote to memory of 2560	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	30
PID 1888 wrote to memory of 2420	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	31
PID 1888 wrote to memory of 2420	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	31
PID 1888 wrote to memory of 2420	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	31
PID 1888 wrote to memory of 2448	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	32
PID 1888 wrote to memory of 2448	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	32
PID 1888 wrote to memory of 2448	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	32
PID 1888 wrote to memory of 2708	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	33
PID 1888 wrote to memory of 2708	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	33
PID 1888 wrote to memory of 2708	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	33
PID 1888 wrote to memory of 2548	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	34
PID 1888 wrote to memory of 2548	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	34
PID 1888 wrote to memory of 2548	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	34
PID 1888 wrote to memory of 1588	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	35
PID 1888 wrote to memory of 1588	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	35
PID 1888 wrote to memory of 1588	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	35
PID 1888 wrote to memory of 2456	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	36
PID 1888 wrote to memory of 2456	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	36
PID 1888 wrote to memory of 2456	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	36
PID 1888 wrote to memory of 1752	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	37
PID 1888 wrote to memory of 1752	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	37
PID 1888 wrote to memory of 1752	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	37
PID 1888 wrote to memory of 3020	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	38
PID 1888 wrote to memory of 3020	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	38
PID 1888 wrote to memory of 3020	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	38
PID 1888 wrote to memory of 2848	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	39
PID 1888 wrote to memory of 2848	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	39
PID 1888 wrote to memory of 2848	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	39
PID 1888 wrote to memory of 1652	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	40
PID 1888 wrote to memory of 1652	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	40
PID 1888 wrote to memory of 1652	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	40
PID 1888 wrote to memory of 1572	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	41
PID 1888 wrote to memory of 1572	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	41
PID 1888 wrote to memory of 1572	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	41
PID 1888 wrote to memory of 1388	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	42
PID 1888 wrote to memory of 1388	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	42
PID 1888 wrote to memory of 1388	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	42
PID 1888 wrote to memory of 2656	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	43
PID 1888 wrote to memory of 2656	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	43
PID 1888 wrote to memory of 2656	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	43
PID 1888 wrote to memory of 1676	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	44
PID 1888 wrote to memory of 1676	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	44
PID 1888 wrote to memory of 1676	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	44
PID 1888 wrote to memory of 1592	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	45
PID 1888 wrote to memory of 1592	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	45
PID 1888 wrote to memory of 1592	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	45
PID 1888 wrote to memory of 2732	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	46
PID 1888 wrote to memory of 2732	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	46
PID 1888 wrote to memory of 2732	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	46
PID 1888 wrote to memory of 1236	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	47
PID 1888 wrote to memory of 1236	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	47
PID 1888 wrote to memory of 1236	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	47
PID 1888 wrote to memory of 2356	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	48
PID 1888 wrote to memory of 2356	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	48
PID 1888 wrote to memory of 2356	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	48
PID 1888 wrote to memory of 2120	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	49
PID 1888 wrote to memory of 2120	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	49
PID 1888 wrote to memory of 2120	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	49
PID 1888 wrote to memory of 2508	1888	0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0563e0cc382192bef9be40d6ca5bb752_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\System\UJeWkAL.exe
  C:\Windows\System\UJeWkAL.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\nYxdwLz.exe
  C:\Windows\System\nYxdwLz.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\jvbvIgO.exe
  C:\Windows\System\jvbvIgO.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\BWuXmiz.exe
  C:\Windows\System\BWuXmiz.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\nsEASmG.exe
  C:\Windows\System\nsEASmG.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\aiPMxOA.exe
  C:\Windows\System\aiPMxOA.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\TqKpJdY.exe
  C:\Windows\System\TqKpJdY.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\jiXYdqF.exe
  C:\Windows\System\jiXYdqF.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\RYsOkLr.exe
  C:\Windows\System\RYsOkLr.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\jTmTKas.exe
  C:\Windows\System\jTmTKas.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\gKnncie.exe
  C:\Windows\System\gKnncie.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\tCRBzKh.exe
  C:\Windows\System\tCRBzKh.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\qoGnwDl.exe
  C:\Windows\System\qoGnwDl.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\pnnfGIh.exe
  C:\Windows\System\pnnfGIh.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\KrThdik.exe
  C:\Windows\System\KrThdik.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\zfzKGRk.exe
  C:\Windows\System\zfzKGRk.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\MMgNvtt.exe
  C:\Windows\System\MMgNvtt.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\yGSJfVo.exe
  C:\Windows\System\yGSJfVo.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\jWNQHXO.exe
  C:\Windows\System\jWNQHXO.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\BuRDTKo.exe
  C:\Windows\System\BuRDTKo.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\APrrvub.exe
  C:\Windows\System\APrrvub.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\quXlGlO.exe
  C:\Windows\System\quXlGlO.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\ykLTPEp.exe
  C:\Windows\System\ykLTPEp.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\wsSBqLj.exe
  C:\Windows\System\wsSBqLj.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\jvMHwDQ.exe
  C:\Windows\System\jvMHwDQ.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\vwOblHq.exe
  C:\Windows\System\vwOblHq.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\vEnTkGZ.exe
  C:\Windows\System\vEnTkGZ.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\XbITjVg.exe
  C:\Windows\System\XbITjVg.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\bUhxvfO.exe
  C:\Windows\System\bUhxvfO.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\MPwFJyO.exe
  C:\Windows\System\MPwFJyO.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\vvfaElX.exe
  C:\Windows\System\vvfaElX.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\iwBDYfZ.exe
  C:\Windows\System\iwBDYfZ.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\uxqwkUT.exe
  C:\Windows\System\uxqwkUT.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\HWXVxDz.exe
  C:\Windows\System\HWXVxDz.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\BmSCcCp.exe
  C:\Windows\System\BmSCcCp.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\jKcjxfQ.exe
  C:\Windows\System\jKcjxfQ.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\gRORgRX.exe
  C:\Windows\System\gRORgRX.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\IGdnhZY.exe
  C:\Windows\System\IGdnhZY.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\vZtlDWJ.exe
  C:\Windows\System\vZtlDWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\DMroEYF.exe
  C:\Windows\System\DMroEYF.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\COUNEbG.exe
  C:\Windows\System\COUNEbG.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\TlrhzjQ.exe
  C:\Windows\System\TlrhzjQ.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\uPAPJqs.exe
  C:\Windows\System\uPAPJqs.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\mcPCaRo.exe
  C:\Windows\System\mcPCaRo.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\WztvGls.exe
  C:\Windows\System\WztvGls.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\JydthME.exe
  C:\Windows\System\JydthME.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\emklUZa.exe
  C:\Windows\System\emklUZa.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\gsOgTnA.exe
  C:\Windows\System\gsOgTnA.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\bmkSPki.exe
  C:\Windows\System\bmkSPki.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\mfRiLmK.exe
  C:\Windows\System\mfRiLmK.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\jSavrPJ.exe
  C:\Windows\System\jSavrPJ.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\BgwVHwb.exe
  C:\Windows\System\BgwVHwb.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\RxDHUgy.exe
  C:\Windows\System\RxDHUgy.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\NQVxGTA.exe
  C:\Windows\System\NQVxGTA.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\HvWiVXk.exe
  C:\Windows\System\HvWiVXk.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\TifBNWG.exe
  C:\Windows\System\TifBNWG.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\DnLjeHL.exe
  C:\Windows\System\DnLjeHL.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\pWPVPyv.exe
  C:\Windows\System\pWPVPyv.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\BlNPyZw.exe
  C:\Windows\System\BlNPyZw.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\znpZRFb.exe
  C:\Windows\System\znpZRFb.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\LjdpgPD.exe
  C:\Windows\System\LjdpgPD.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\ByfidAr.exe
  C:\Windows\System\ByfidAr.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\UjFKPgb.exe
  C:\Windows\System\UjFKPgb.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\jaMbwQj.exe
  C:\Windows\System\jaMbwQj.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\PSbGpoq.exe
  C:\Windows\System\PSbGpoq.exe
  2⤵
  PID:1340
- C:\Windows\System\IUsrekB.exe
  C:\Windows\System\IUsrekB.exe
  2⤵
  PID:1764
- C:\Windows\System\IuFhkEC.exe
  C:\Windows\System\IuFhkEC.exe
  2⤵
  PID:1952
- C:\Windows\System\LdjJQRN.exe
  C:\Windows\System\LdjJQRN.exe
  2⤵
  PID:2784
- C:\Windows\System\FmbAWgN.exe
  C:\Windows\System\FmbAWgN.exe
  2⤵
  PID:1708
- C:\Windows\System\BTkzKkw.exe
  C:\Windows\System\BTkzKkw.exe
  2⤵
  PID:2780
- C:\Windows\System\sjfplyp.exe
  C:\Windows\System\sjfplyp.exe
  2⤵
  PID:2060
- C:\Windows\System\usAQeJh.exe
  C:\Windows\System\usAQeJh.exe
  2⤵
  PID:1436
- C:\Windows\System\mwTuyku.exe
  C:\Windows\System\mwTuyku.exe
  2⤵
  PID:956
- C:\Windows\System\eItpkef.exe
  C:\Windows\System\eItpkef.exe
  2⤵
  PID:704
- C:\Windows\System\xrQTTfH.exe
  C:\Windows\System\xrQTTfH.exe
  2⤵
  PID:2912
- C:\Windows\System\QKtUakZ.exe
  C:\Windows\System\QKtUakZ.exe
  2⤵
  PID:1636
- C:\Windows\System\zfoMvgw.exe
  C:\Windows\System\zfoMvgw.exe
  2⤵
  PID:2224
- C:\Windows\System\QCmxrtc.exe
  C:\Windows\System\QCmxrtc.exe
  2⤵
  PID:2484
- C:\Windows\System\GugnfSn.exe
  C:\Windows\System\GugnfSn.exe
  2⤵
  PID:1300
- C:\Windows\System\MilZNSb.exe
  C:\Windows\System\MilZNSb.exe
  2⤵
  PID:1480
- C:\Windows\System\jKbGbdY.exe
  C:\Windows\System\jKbGbdY.exe
  2⤵
  PID:1560
- C:\Windows\System\ebdqmzd.exe
  C:\Windows\System\ebdqmzd.exe
  2⤵
  PID:2752
- C:\Windows\System\hwNyBSQ.exe
  C:\Windows\System\hwNyBSQ.exe
  2⤵
  PID:1964
- C:\Windows\System\tIDtGUs.exe
  C:\Windows\System\tIDtGUs.exe
  2⤵
  PID:1656
- C:\Windows\System\rlyhvkA.exe
  C:\Windows\System\rlyhvkA.exe
  2⤵
  PID:3008
- C:\Windows\System\toJPGXH.exe
  C:\Windows\System\toJPGXH.exe
  2⤵
  PID:616
- C:\Windows\System\fHvWKzw.exe
  C:\Windows\System\fHvWKzw.exe
  2⤵
  PID:2272
- C:\Windows\System\EkHDIzO.exe
  C:\Windows\System\EkHDIzO.exe
  2⤵
  PID:2440
- C:\Windows\System\kNmKNxM.exe
  C:\Windows\System\kNmKNxM.exe
  2⤵
  PID:1548
- C:\Windows\System\RvGcIKp.exe
  C:\Windows\System\RvGcIKp.exe
  2⤵
  PID:1448
- C:\Windows\System\EbyaRKO.exe
  C:\Windows\System\EbyaRKO.exe
  2⤵
  PID:1052
- C:\Windows\System\jFbhpNy.exe
  C:\Windows\System\jFbhpNy.exe
  2⤵
  PID:2652
- C:\Windows\System\CgXgmCI.exe
  C:\Windows\System\CgXgmCI.exe
  2⤵
  PID:2868
- C:\Windows\System\ULdWxhm.exe
  C:\Windows\System\ULdWxhm.exe
  2⤵
  PID:2408
- C:\Windows\System\XCPyUfv.exe
  C:\Windows\System\XCPyUfv.exe
  2⤵
  PID:1472
- C:\Windows\System\QgjDzxS.exe
  C:\Windows\System\QgjDzxS.exe
  2⤵
  PID:2876
- C:\Windows\System\HSFRQrB.exe
  C:\Windows\System\HSFRQrB.exe
  2⤵
  PID:2140
- C:\Windows\System\zzYyaZl.exe
  C:\Windows\System\zzYyaZl.exe
  2⤵
  PID:2240
- C:\Windows\System\hZHKLHx.exe
  C:\Windows\System\hZHKLHx.exe
  2⤵
  PID:2588
- C:\Windows\System\qpbTVnk.exe
  C:\Windows\System\qpbTVnk.exe
  2⤵
  PID:2320
- C:\Windows\System\uRvWimM.exe
  C:\Windows\System\uRvWimM.exe
  2⤵
  PID:2340
- C:\Windows\System\ovEohWL.exe
  C:\Windows\System\ovEohWL.exe
  2⤵
  PID:1268
- C:\Windows\System\PwapXGD.exe
  C:\Windows\System\PwapXGD.exe
  2⤵
  PID:1800
- C:\Windows\System\MrPXlQO.exe
  C:\Windows\System\MrPXlQO.exe
  2⤵
  PID:532
- C:\Windows\System\ubcMbGq.exe
  C:\Windows\System\ubcMbGq.exe
  2⤵
  PID:2124
- C:\Windows\System\etDECfV.exe
  C:\Windows\System\etDECfV.exe
  2⤵
  PID:588
- C:\Windows\System\JKCrtzf.exe
  C:\Windows\System\JKCrtzf.exe
  2⤵
  PID:2116
- C:\Windows\System\YiXdBKt.exe
  C:\Windows\System\YiXdBKt.exe
  2⤵
  PID:1496
- C:\Windows\System\ajuSQMj.exe
  C:\Windows\System\ajuSQMj.exe
  2⤵
  PID:1332
- C:\Windows\System\ASkjnsw.exe
  C:\Windows\System\ASkjnsw.exe
  2⤵
  PID:1760
- C:\Windows\System\PXzlVCd.exe
  C:\Windows\System\PXzlVCd.exe
  2⤵
  PID:2472
- C:\Windows\System\aqxULPV.exe
  C:\Windows\System\aqxULPV.exe
  2⤵
  PID:2948
- C:\Windows\System\QMJehlA.exe
  C:\Windows\System\QMJehlA.exe
  2⤵
  PID:1304
- C:\Windows\System\ZRPpNuL.exe
  C:\Windows\System\ZRPpNuL.exe
  2⤵
  PID:1660
- C:\Windows\System\jkNMRki.exe
  C:\Windows\System\jkNMRki.exe
  2⤵
  PID:2068
- C:\Windows\System\CtMMsLu.exe
  C:\Windows\System\CtMMsLu.exe
  2⤵
  PID:1272
- C:\Windows\System\kpzJaaG.exe
  C:\Windows\System\kpzJaaG.exe
  2⤵
  PID:2088
- C:\Windows\System\RBBQBKj.exe
  C:\Windows\System\RBBQBKj.exe
  2⤵
  PID:2536
- C:\Windows\System\PgpRoxc.exe
  C:\Windows\System\PgpRoxc.exe
  2⤵
  PID:2840
- C:\Windows\System\TSbeCcZ.exe
  C:\Windows\System\TSbeCcZ.exe
  2⤵
  PID:2164
- C:\Windows\System\UOChYQQ.exe
  C:\Windows\System\UOChYQQ.exe
  2⤵
  PID:1732
- C:\Windows\System\YoUrAMQ.exe
  C:\Windows\System\YoUrAMQ.exe
  2⤵
  PID:2772
- C:\Windows\System\ODEfUcD.exe
  C:\Windows\System\ODEfUcD.exe
  2⤵
  PID:2880
- C:\Windows\System\nSzXjzC.exe
  C:\Windows\System\nSzXjzC.exe
  2⤵
  PID:2488
- C:\Windows\System\pgDarkh.exe
  C:\Windows\System\pgDarkh.exe
  2⤵
  PID:2424
- C:\Windows\System\JEYbiek.exe
  C:\Windows\System\JEYbiek.exe
  2⤵
  PID:2480
- C:\Windows\System\hJyzGiy.exe
  C:\Windows\System\hJyzGiy.exe
  2⤵
  PID:2748
- C:\Windows\System\qUjMAhq.exe
  C:\Windows\System\qUjMAhq.exe
  2⤵
  PID:2052
- C:\Windows\System\VOYOUPn.exe
  C:\Windows\System\VOYOUPn.exe
  2⤵
  PID:2684
- C:\Windows\System\ndkmjfv.exe
  C:\Windows\System\ndkmjfv.exe
  2⤵
  PID:852
- C:\Windows\System\fpUEynm.exe
  C:\Windows\System\fpUEynm.exe
  2⤵
  PID:800
- C:\Windows\System\wocqYNQ.exe
  C:\Windows\System\wocqYNQ.exe
  2⤵
  PID:1972
- C:\Windows\System\wERBdEI.exe
  C:\Windows\System\wERBdEI.exe
  2⤵
  PID:1384
- C:\Windows\System\nWZaNNa.exe
  C:\Windows\System\nWZaNNa.exe
  2⤵
  PID:1724
- C:\Windows\System\jrwZFUk.exe
  C:\Windows\System\jrwZFUk.exe
  2⤵
  PID:2376
- C:\Windows\System\JTPBeOq.exe
  C:\Windows\System\JTPBeOq.exe
  2⤵
  PID:1772
- C:\Windows\System\KTHpiFz.exe
  C:\Windows\System\KTHpiFz.exe
  2⤵
  PID:2668
- C:\Windows\System\hLWtddX.exe
  C:\Windows\System\hLWtddX.exe
  2⤵
  PID:3064
- C:\Windows\System\YlXzGPQ.exe
  C:\Windows\System\YlXzGPQ.exe
  2⤵
  PID:1932
- C:\Windows\System\KkEyFzE.exe
  C:\Windows\System\KkEyFzE.exe
  2⤵
  PID:2236
- C:\Windows\System\FrUqNtn.exe
  C:\Windows\System\FrUqNtn.exe
  2⤵
  PID:880
- C:\Windows\System\DzIzxYR.exe
  C:\Windows\System\DzIzxYR.exe
  2⤵
  PID:2700
- C:\Windows\System\hPytiPY.exe
  C:\Windows\System\hPytiPY.exe
  2⤵
  PID:1056
- C:\Windows\System\uaaazqu.exe
  C:\Windows\System\uaaazqu.exe
  2⤵
  PID:2592
- C:\Windows\System\dPiEbKC.exe
  C:\Windows\System\dPiEbKC.exe
  2⤵
  PID:2672
- C:\Windows\System\jhOkHAC.exe
  C:\Windows\System\jhOkHAC.exe
  2⤵
  PID:2744
- C:\Windows\System\wOHpSRZ.exe
  C:\Windows\System\wOHpSRZ.exe
  2⤵
  PID:2944
- C:\Windows\System\AxoGpQi.exe
  C:\Windows\System\AxoGpQi.exe
  2⤵
  PID:2476
- C:\Windows\System\DzncOBC.exe
  C:\Windows\System\DzncOBC.exe
  2⤵
  PID:1740
- C:\Windows\System\vEogjmR.exe
  C:\Windows\System\vEogjmR.exe
  2⤵
  PID:1608
- C:\Windows\System\wZOFxTA.exe
  C:\Windows\System\wZOFxTA.exe
  2⤵
  PID:1556
- C:\Windows\System\iUTepxO.exe
  C:\Windows\System\iUTepxO.exe
  2⤵
  PID:1528
- C:\Windows\System\ltRksxv.exe
  C:\Windows\System\ltRksxv.exe
  2⤵
  PID:2144
- C:\Windows\System\IUUDHjJ.exe
  C:\Windows\System\IUUDHjJ.exe
  2⤵
  PID:3076
- C:\Windows\System\qTvelcj.exe
  C:\Windows\System\qTvelcj.exe
  2⤵
  PID:3092
- C:\Windows\System\qZiKjez.exe
  C:\Windows\System\qZiKjez.exe
  2⤵
  PID:3108
- C:\Windows\System\iaIsdwa.exe
  C:\Windows\System\iaIsdwa.exe
  2⤵
  PID:3124
- C:\Windows\System\UzPLjiN.exe
  C:\Windows\System\UzPLjiN.exe
  2⤵
  PID:3140
- C:\Windows\System\mYbGiBk.exe
  C:\Windows\System\mYbGiBk.exe
  2⤵
  PID:3160
- C:\Windows\System\EUOJcOD.exe
  C:\Windows\System\EUOJcOD.exe
  2⤵
  PID:3176
- C:\Windows\System\XxojtTB.exe
  C:\Windows\System\XxojtTB.exe
  2⤵
  PID:3192
- C:\Windows\System\AMAYjqr.exe
  C:\Windows\System\AMAYjqr.exe
  2⤵
  PID:3208
- C:\Windows\System\mYhYlXe.exe
  C:\Windows\System\mYhYlXe.exe
  2⤵
  PID:3224
- C:\Windows\System\dqSuPTP.exe
  C:\Windows\System\dqSuPTP.exe
  2⤵
  PID:3240
- C:\Windows\System\JyhZrKB.exe
  C:\Windows\System\JyhZrKB.exe
  2⤵
  PID:3256
- C:\Windows\System\kubJSZM.exe
  C:\Windows\System\kubJSZM.exe
  2⤵
  PID:3272
- C:\Windows\System\eFmlHGb.exe
  C:\Windows\System\eFmlHGb.exe
  2⤵
  PID:3288
- C:\Windows\System\GCceEWq.exe
  C:\Windows\System\GCceEWq.exe
  2⤵
  PID:3304
- C:\Windows\System\ioQPHVw.exe
  C:\Windows\System\ioQPHVw.exe
  2⤵
  PID:3320
- C:\Windows\System\DGdAUdD.exe
  C:\Windows\System\DGdAUdD.exe
  2⤵
  PID:3336
- C:\Windows\System\AXbwViG.exe
  C:\Windows\System\AXbwViG.exe
  2⤵
  PID:3352
- C:\Windows\System\OWysZvl.exe
  C:\Windows\System\OWysZvl.exe
  2⤵
  PID:3368
- C:\Windows\System\eUtHeSu.exe
  C:\Windows\System\eUtHeSu.exe
  2⤵
  PID:3384
- C:\Windows\System\GtLgKNa.exe
  C:\Windows\System\GtLgKNa.exe
  2⤵
  PID:3400
- C:\Windows\System\AIvpbjZ.exe
  C:\Windows\System\AIvpbjZ.exe
  2⤵
  PID:3420
- C:\Windows\System\YEztXXS.exe
  C:\Windows\System\YEztXXS.exe
  2⤵
  PID:3436
- C:\Windows\System\LrqhQSh.exe
  C:\Windows\System\LrqhQSh.exe
  2⤵
  PID:3456
- C:\Windows\System\IQzGvYA.exe
  C:\Windows\System\IQzGvYA.exe
  2⤵
  PID:3476
- C:\Windows\System\IWvCyIc.exe
  C:\Windows\System\IWvCyIc.exe
  2⤵
  PID:3492
- C:\Windows\System\bNDzuKT.exe
  C:\Windows\System\bNDzuKT.exe
  2⤵
  PID:3508
- C:\Windows\System\peBBXeh.exe
  C:\Windows\System\peBBXeh.exe
  2⤵
  PID:3524
- C:\Windows\System\hkSGENQ.exe
  C:\Windows\System\hkSGENQ.exe
  2⤵
  PID:3540
- C:\Windows\System\TrpscHd.exe
  C:\Windows\System\TrpscHd.exe
  2⤵
  PID:3556
- C:\Windows\System\DWmQfIU.exe
  C:\Windows\System\DWmQfIU.exe
  2⤵
  PID:3576
- C:\Windows\System\sQZTXFQ.exe
  C:\Windows\System\sQZTXFQ.exe
  2⤵
  PID:3592
- C:\Windows\System\XTTLdFS.exe
  C:\Windows\System\XTTLdFS.exe
  2⤵
  PID:3608
- C:\Windows\System\RFOAmCL.exe
  C:\Windows\System\RFOAmCL.exe
  2⤵
  PID:3624
- C:\Windows\System\iQqEmTI.exe
  C:\Windows\System\iQqEmTI.exe
  2⤵
  PID:3640
- C:\Windows\System\DWvSlLj.exe
  C:\Windows\System\DWvSlLj.exe
  2⤵
  PID:3656
- C:\Windows\System\QEmTIZA.exe
  C:\Windows\System\QEmTIZA.exe
  2⤵
  PID:3672
- C:\Windows\System\uWwhSle.exe
  C:\Windows\System\uWwhSle.exe
  2⤵
  PID:3688
- C:\Windows\System\qeMifRN.exe
  C:\Windows\System\qeMifRN.exe
  2⤵
  PID:3704
- C:\Windows\System\LgRhzMD.exe
  C:\Windows\System\LgRhzMD.exe
  2⤵
  PID:3724
- C:\Windows\System\LvXfPNV.exe
  C:\Windows\System\LvXfPNV.exe
  2⤵
  PID:3740
- C:\Windows\System\OUOtEAH.exe
  C:\Windows\System\OUOtEAH.exe
  2⤵
  PID:3756
- C:\Windows\System\McKXsux.exe
  C:\Windows\System\McKXsux.exe
  2⤵
  PID:3772
- C:\Windows\System\kbwtMvL.exe
  C:\Windows\System\kbwtMvL.exe
  2⤵
  PID:3788
- C:\Windows\System\YdyBgkd.exe
  C:\Windows\System\YdyBgkd.exe
  2⤵
  PID:3804
- C:\Windows\System\ylBtarh.exe
  C:\Windows\System\ylBtarh.exe
  2⤵
  PID:3820
- C:\Windows\System\qDIkJBu.exe
  C:\Windows\System\qDIkJBu.exe
  2⤵
  PID:3836
- C:\Windows\System\VZfQybG.exe
  C:\Windows\System\VZfQybG.exe
  2⤵
  PID:3852
- C:\Windows\System\mqMeJmW.exe
  C:\Windows\System\mqMeJmW.exe
  2⤵
  PID:3868
- C:\Windows\System\crdqnRh.exe
  C:\Windows\System\crdqnRh.exe
  2⤵
  PID:3888
- C:\Windows\System\AeQBOid.exe
  C:\Windows\System\AeQBOid.exe
  2⤵
  PID:3904
- C:\Windows\System\pMOdase.exe
  C:\Windows\System\pMOdase.exe
  2⤵
  PID:3920
- C:\Windows\System\xQvUNTo.exe
  C:\Windows\System\xQvUNTo.exe
  2⤵
  PID:3936
- C:\Windows\System\MqfLqpX.exe
  C:\Windows\System\MqfLqpX.exe
  2⤵
  PID:3952
- C:\Windows\System\ZnoUrNS.exe
  C:\Windows\System\ZnoUrNS.exe
  2⤵
  PID:3968
- C:\Windows\System\aSNxJMy.exe
  C:\Windows\System\aSNxJMy.exe
  2⤵
  PID:3984
- C:\Windows\System\pIRzQnb.exe
  C:\Windows\System\pIRzQnb.exe
  2⤵
  PID:4000
- C:\Windows\System\gYQLTiK.exe
  C:\Windows\System\gYQLTiK.exe
  2⤵
  PID:4016
- C:\Windows\System\OAhDlze.exe
  C:\Windows\System\OAhDlze.exe
  2⤵
  PID:4032
- C:\Windows\System\oGzhYJj.exe
  C:\Windows\System\oGzhYJj.exe
  2⤵
  PID:4048
- C:\Windows\System\oPTAxWp.exe
  C:\Windows\System\oPTAxWp.exe
  2⤵
  PID:4064
- C:\Windows\System\zdKQysD.exe
  C:\Windows\System\zdKQysD.exe
  2⤵
  PID:4080
- C:\Windows\System\BAIIVPh.exe
  C:\Windows\System\BAIIVPh.exe
  2⤵
  PID:2620
- C:\Windows\System\xZkprlw.exe
  C:\Windows\System\xZkprlw.exe
  2⤵
  PID:3068
- C:\Windows\System\sNBjVjg.exe
  C:\Windows\System\sNBjVjg.exe
  2⤵
  PID:2856
- C:\Windows\System\GcecUFJ.exe
  C:\Windows\System\GcecUFJ.exe
  2⤵
  PID:1904
- C:\Windows\System\IMEXfEl.exe
  C:\Windows\System\IMEXfEl.exe
  2⤵
  PID:2188
- C:\Windows\System\QcLvHpV.exe
  C:\Windows\System\QcLvHpV.exe
  2⤵
  PID:1580
- C:\Windows\System\Swpnavl.exe
  C:\Windows\System\Swpnavl.exe
  2⤵
  PID:1160
- C:\Windows\System\IMmpUYA.exe
  C:\Windows\System\IMmpUYA.exe
  2⤵
  PID:3044
- C:\Windows\System\ssMRlJB.exe
  C:\Windows\System\ssMRlJB.exe
  2⤵
  PID:2724
- C:\Windows\System\qrLobov.exe
  C:\Windows\System\qrLobov.exe
  2⤵
  PID:2112
- C:\Windows\System\rGOgKVB.exe
  C:\Windows\System\rGOgKVB.exe
  2⤵
  PID:3136
- C:\Windows\System\Uguciyi.exe
  C:\Windows\System\Uguciyi.exe
  2⤵
  PID:2596
- C:\Windows\System\DCCFeEj.exe
  C:\Windows\System\DCCFeEj.exe
  2⤵
  PID:2788
- C:\Windows\System\eXGxbQz.exe
  C:\Windows\System\eXGxbQz.exe
  2⤵
  PID:2936
- C:\Windows\System\fTiZQbv.exe
  C:\Windows\System\fTiZQbv.exe
  2⤵
  PID:2344
- C:\Windows\System\sBzdNCZ.exe
  C:\Windows\System\sBzdNCZ.exe
  2⤵
  PID:1940
- C:\Windows\System\pmAArbm.exe
  C:\Windows\System\pmAArbm.exe
  2⤵
  PID:3248
- C:\Windows\System\kqcWDNF.exe
  C:\Windows\System\kqcWDNF.exe
  2⤵
  PID:3280
- C:\Windows\System\QbFCKuI.exe
  C:\Windows\System\QbFCKuI.exe
  2⤵
  PID:3172
- C:\Windows\System\ZnBEMYd.exe
  C:\Windows\System\ZnBEMYd.exe
  2⤵
  PID:3236
- C:\Windows\System\DAuGeBD.exe
  C:\Windows\System\DAuGeBD.exe
  2⤵
  PID:3312
- C:\Windows\System\cNvVXXJ.exe
  C:\Windows\System\cNvVXXJ.exe
  2⤵
  PID:3376
- C:\Windows\System\HTZZmaK.exe
  C:\Windows\System\HTZZmaK.exe
  2⤵
  PID:3300
- C:\Windows\System\cvrYFNv.exe
  C:\Windows\System\cvrYFNv.exe
  2⤵
  PID:3332
- C:\Windows\System\suycNdY.exe
  C:\Windows\System\suycNdY.exe
  2⤵
  PID:3428
- C:\Windows\System\qarstEs.exe
  C:\Windows\System\qarstEs.exe
  2⤵
  PID:3468
- C:\Windows\System\FfdQXty.exe
  C:\Windows\System\FfdQXty.exe
  2⤵
  PID:1696
- C:\Windows\System\XdGWimB.exe
  C:\Windows\System\XdGWimB.exe
  2⤵
  PID:3588
- C:\Windows\System\KYLatHW.exe
  C:\Windows\System\KYLatHW.exe
  2⤵
  PID:3648
- C:\Windows\System\WjpmDtV.exe
  C:\Windows\System\WjpmDtV.exe
  2⤵
  PID:3712
- C:\Windows\System\veHNRRc.exe
  C:\Windows\System\veHNRRc.exe
  2⤵
  PID:1820
- C:\Windows\System\yodCuGl.exe
  C:\Windows\System\yodCuGl.exe
  2⤵
  PID:3784
- C:\Windows\System\czWcqKU.exe
  C:\Windows\System\czWcqKU.exe
  2⤵
  PID:3812
- C:\Windows\System\LkosffW.exe
  C:\Windows\System\LkosffW.exe
  2⤵
  PID:3816
- C:\Windows\System\gKdUgJj.exe
  C:\Windows\System\gKdUgJj.exe
  2⤵
  PID:3916
- C:\Windows\System\VMaKPaa.exe
  C:\Windows\System\VMaKPaa.exe
  2⤵
  PID:3532
- C:\Windows\System\jQJhjPT.exe
  C:\Windows\System\jQJhjPT.exe
  2⤵
  PID:3572
- C:\Windows\System\MoQvbBO.exe
  C:\Windows\System\MoQvbBO.exe
  2⤵
  PID:3636
- C:\Windows\System\WXwfQwx.exe
  C:\Windows\System\WXwfQwx.exe
  2⤵
  PID:1576
- C:\Windows\System\JyKqXgx.exe
  C:\Windows\System\JyKqXgx.exe
  2⤵
  PID:4008
- C:\Windows\System\eJrLxsR.exe
  C:\Windows\System\eJrLxsR.exe
  2⤵
  PID:3700
- C:\Windows\System\fVGTPpI.exe
  C:\Windows\System\fVGTPpI.exe
  2⤵
  PID:3768
- C:\Windows\System\gRwKCNI.exe
  C:\Windows\System\gRwKCNI.exe
  2⤵
  PID:3832
- C:\Windows\System\LQKoJgP.exe
  C:\Windows\System\LQKoJgP.exe
  2⤵
  PID:3900
- C:\Windows\System\YnnAZzt.exe
  C:\Windows\System\YnnAZzt.exe
  2⤵
  PID:3964
- C:\Windows\System\xnqGZdv.exe
  C:\Windows\System\xnqGZdv.exe
  2⤵
  PID:4028
- C:\Windows\System\ExjDRHM.exe
  C:\Windows\System\ExjDRHM.exe
  2⤵
  PID:2428
- C:\Windows\System\ELWoVKA.exe
  C:\Windows\System\ELWoVKA.exe
  2⤵
  PID:2864
- C:\Windows\System\EHDIPUL.exe
  C:\Windows\System\EHDIPUL.exe
  2⤵
  PID:3204
- C:\Windows\System\XlPGjdD.exe
  C:\Windows\System\XlPGjdD.exe
  2⤵
  PID:4092
- C:\Windows\System\EZhJIea.exe
  C:\Windows\System\EZhJIea.exe
  2⤵
  PID:3040
- C:\Windows\System\NGYuUKW.exe
  C:\Windows\System\NGYuUKW.exe
  2⤵
  PID:3116
- C:\Windows\System\QpgHQbI.exe
  C:\Windows\System\QpgHQbI.exe
  2⤵
  PID:3328
- C:\Windows\System\NhfnLeO.exe
  C:\Windows\System\NhfnLeO.exe
  2⤵
  PID:476
- C:\Windows\System\mbedmiB.exe
  C:\Windows\System\mbedmiB.exe
  2⤵
  PID:2152
- C:\Windows\System\FVNQwUA.exe
  C:\Windows\System\FVNQwUA.exe
  2⤵
  PID:3216
- C:\Windows\System\xDJgQWN.exe
  C:\Windows\System\xDJgQWN.exe
  2⤵
  PID:3264
- C:\Windows\System\WTkhcOw.exe
  C:\Windows\System\WTkhcOw.exe
  2⤵
  PID:3652
- C:\Windows\System\sPnVMdU.exe
  C:\Windows\System\sPnVMdU.exe
  2⤵
  PID:1688
- C:\Windows\System\RsWibJw.exe
  C:\Windows\System\RsWibJw.exe
  2⤵
  PID:3364
- C:\Windows\System\LGDIDkQ.exe
  C:\Windows\System\LGDIDkQ.exe
  2⤵
  PID:3980
- C:\Windows\System\HyUnCjt.exe
  C:\Windows\System\HyUnCjt.exe
  2⤵
  PID:3864
- C:\Windows\System\gEKAUqI.exe
  C:\Windows\System\gEKAUqI.exe
  2⤵
  PID:3880
- C:\Windows\System\mQqiYxY.exe
  C:\Windows\System\mQqiYxY.exe
  2⤵
  PID:3620
- C:\Windows\System\pKsWELx.exe
  C:\Windows\System\pKsWELx.exe
  2⤵
  PID:3564
- C:\Windows\System\AuXzEVy.exe
  C:\Windows\System\AuXzEVy.exe
  2⤵
  PID:3668
- C:\Windows\System\NnLemyk.exe
  C:\Windows\System\NnLemyk.exe
  2⤵
  PID:4060
- C:\Windows\System\uRDDexa.exe
  C:\Windows\System\uRDDexa.exe
  2⤵
  PID:1776
- C:\Windows\System\etPYwuS.exe
  C:\Windows\System\etPYwuS.exe
  2⤵
  PID:1744
- C:\Windows\System\bGgqAkf.exe
  C:\Windows\System\bGgqAkf.exe
  2⤵
  PID:3084
- C:\Windows\System\oVPjKcI.exe
  C:\Windows\System\oVPjKcI.exe
  2⤵
  PID:3396
- C:\Windows\System\dTGQwYS.exe
  C:\Windows\System\dTGQwYS.exe
  2⤵
  PID:3500
- C:\Windows\System\llAOVze.exe
  C:\Windows\System\llAOVze.exe
  2⤵
  PID:2288
- C:\Windows\System\gDmMiec.exe
  C:\Windows\System\gDmMiec.exe
  2⤵
  PID:3736
- C:\Windows\System\HUOmVbY.exe
  C:\Windows\System\HUOmVbY.exe
  2⤵
  PID:2292
- C:\Windows\System\LFJJLjT.exe
  C:\Windows\System\LFJJLjT.exe
  2⤵
  PID:3412
- C:\Windows\System\kVKkiia.exe
  C:\Windows\System\kVKkiia.exe
  2⤵
  PID:2728
- C:\Windows\System\nNRDiNE.exe
  C:\Windows\System\nNRDiNE.exe
  2⤵
  PID:3348
- C:\Windows\System\wfppbPA.exe
  C:\Windows\System\wfppbPA.exe
  2⤵
  PID:3284
- C:\Windows\System\xnYEQAG.exe
  C:\Windows\System\xnYEQAG.exe
  2⤵
  PID:3504
- C:\Windows\System\iifPZrj.exe
  C:\Windows\System\iifPZrj.exe
  2⤵
  PID:3912
- C:\Windows\System\OAQAJqT.exe
  C:\Windows\System\OAQAJqT.exe
  2⤵
  PID:4112
- C:\Windows\System\XtTublW.exe
  C:\Windows\System\XtTublW.exe
  2⤵
  PID:4128
- C:\Windows\System\KRagCsN.exe
  C:\Windows\System\KRagCsN.exe
  2⤵
  PID:4148
- C:\Windows\System\zlSLVrP.exe
  C:\Windows\System\zlSLVrP.exe
  2⤵
  PID:4168
- C:\Windows\System\zySqKWw.exe
  C:\Windows\System\zySqKWw.exe
  2⤵
  PID:4192
- C:\Windows\System\QzAerPo.exe
  C:\Windows\System\QzAerPo.exe
  2⤵
  PID:4208
- C:\Windows\System\DMiPtcb.exe
  C:\Windows\System\DMiPtcb.exe
  2⤵
  PID:4224
- C:\Windows\System\lmEBTGt.exe
  C:\Windows\System\lmEBTGt.exe
  2⤵
  PID:4240
- C:\Windows\System\ofduKyR.exe
  C:\Windows\System\ofduKyR.exe
  2⤵
  PID:4256
- C:\Windows\System\zWSIGIb.exe
  C:\Windows\System\zWSIGIb.exe
  2⤵
  PID:4272
- C:\Windows\System\WNMElDL.exe
  C:\Windows\System\WNMElDL.exe
  2⤵
  PID:4296
- C:\Windows\System\dhKJhTX.exe
  C:\Windows\System\dhKJhTX.exe
  2⤵
  PID:4312
- C:\Windows\System\xVUSOfc.exe
  C:\Windows\System\xVUSOfc.exe
  2⤵
  PID:4328
- C:\Windows\System\lbdTqmi.exe
  C:\Windows\System\lbdTqmi.exe
  2⤵
  PID:4344
- C:\Windows\System\ZgSgUtz.exe
  C:\Windows\System\ZgSgUtz.exe
  2⤵
  PID:4364
- C:\Windows\System\jRlKhcQ.exe
  C:\Windows\System\jRlKhcQ.exe
  2⤵
  PID:4396
- C:\Windows\System\OPvFsuy.exe
  C:\Windows\System\OPvFsuy.exe
  2⤵
  PID:4416
- C:\Windows\System\aGcTPSR.exe
  C:\Windows\System\aGcTPSR.exe
  2⤵
  PID:4432
- C:\Windows\System\WrovmlR.exe
  C:\Windows\System\WrovmlR.exe
  2⤵
  PID:4448
- C:\Windows\System\sbMewrJ.exe
  C:\Windows\System\sbMewrJ.exe
  2⤵
  PID:4464
- C:\Windows\System\RfchTqQ.exe
  C:\Windows\System\RfchTqQ.exe
  2⤵
  PID:4480
- C:\Windows\System\fBGfMkR.exe
  C:\Windows\System\fBGfMkR.exe
  2⤵
  PID:4500
- C:\Windows\System\QMsjOgO.exe
  C:\Windows\System\QMsjOgO.exe
  2⤵
  PID:4516
- C:\Windows\System\QJcxvCY.exe
  C:\Windows\System\QJcxvCY.exe
  2⤵
  PID:4532
- C:\Windows\System\vNoulav.exe
  C:\Windows\System\vNoulav.exe
  2⤵
  PID:4548
- C:\Windows\System\WYzzwoS.exe
  C:\Windows\System\WYzzwoS.exe
  2⤵
  PID:4564
- C:\Windows\System\htYMFbY.exe
  C:\Windows\System\htYMFbY.exe
  2⤵
  PID:4580
- C:\Windows\System\idpYopi.exe
  C:\Windows\System\idpYopi.exe
  2⤵
  PID:4596
- C:\Windows\System\jPOQitX.exe
  C:\Windows\System\jPOQitX.exe
  2⤵
  PID:4612
- C:\Windows\System\ztUtbjE.exe
  C:\Windows\System\ztUtbjE.exe
  2⤵
  PID:4628
- C:\Windows\System\tWvvUBm.exe
  C:\Windows\System\tWvvUBm.exe
  2⤵
  PID:4644
- C:\Windows\System\DMAOxBw.exe
  C:\Windows\System\DMAOxBw.exe
  2⤵
  PID:4664
- C:\Windows\System\cUTQCwz.exe
  C:\Windows\System\cUTQCwz.exe
  2⤵
  PID:4680
- C:\Windows\System\nNUhSxh.exe
  C:\Windows\System\nNUhSxh.exe
  2⤵
  PID:4696
- C:\Windows\System\oOKnfiQ.exe
  C:\Windows\System\oOKnfiQ.exe
  2⤵
  PID:4712
- C:\Windows\System\oIAIaDB.exe
  C:\Windows\System\oIAIaDB.exe
  2⤵
  PID:4728
- C:\Windows\System\yfZKWeJ.exe
  C:\Windows\System\yfZKWeJ.exe
  2⤵
  PID:4744
- C:\Windows\System\qQZBLio.exe
  C:\Windows\System\qQZBLio.exe
  2⤵
  PID:4760
- C:\Windows\System\KRvkivU.exe
  C:\Windows\System\KRvkivU.exe
  2⤵
  PID:4776
- C:\Windows\System\qlzNXis.exe
  C:\Windows\System\qlzNXis.exe
  2⤵
  PID:4792
- C:\Windows\System\ikgibVc.exe
  C:\Windows\System\ikgibVc.exe
  2⤵
  PID:4812
- C:\Windows\System\BHWDzue.exe
  C:\Windows\System\BHWDzue.exe
  2⤵
  PID:4828
- C:\Windows\System\DEHaFwq.exe
  C:\Windows\System\DEHaFwq.exe
  2⤵
  PID:4844
- C:\Windows\System\ciBkqNw.exe
  C:\Windows\System\ciBkqNw.exe
  2⤵
  PID:4860
- C:\Windows\System\CewfGgb.exe
  C:\Windows\System\CewfGgb.exe
  2⤵
  PID:4876
- C:\Windows\System\vgCYoPF.exe
  C:\Windows\System\vgCYoPF.exe
  2⤵
  PID:4892
- C:\Windows\System\jxDEfPH.exe
  C:\Windows\System\jxDEfPH.exe
  2⤵
  PID:4908
- C:\Windows\System\SMFfahA.exe
  C:\Windows\System\SMFfahA.exe
  2⤵
  PID:4924
- C:\Windows\System\azWYmaj.exe
  C:\Windows\System\azWYmaj.exe
  2⤵
  PID:4940
- C:\Windows\System\HRsRizj.exe
  C:\Windows\System\HRsRizj.exe
  2⤵
  PID:4956
- C:\Windows\System\EvegQzw.exe
  C:\Windows\System\EvegQzw.exe
  2⤵
  PID:4972
- C:\Windows\System\KBadvRQ.exe
  C:\Windows\System\KBadvRQ.exe
  2⤵
  PID:4988
- C:\Windows\System\uBjowyZ.exe
  C:\Windows\System\uBjowyZ.exe
  2⤵
  PID:5008
- C:\Windows\System\lgVPzbp.exe
  C:\Windows\System\lgVPzbp.exe
  2⤵
  PID:5024
- C:\Windows\System\moCLlQa.exe
  C:\Windows\System\moCLlQa.exe
  2⤵
  PID:5040
- C:\Windows\System\InrtsMz.exe
  C:\Windows\System\InrtsMz.exe
  2⤵
  PID:5056
- C:\Windows\System\VKuUqQG.exe
  C:\Windows\System\VKuUqQG.exe
  2⤵
  PID:5072
- C:\Windows\System\HjshzjO.exe
  C:\Windows\System\HjshzjO.exe
  2⤵
  PID:5088
- C:\Windows\System\wifwePQ.exe
  C:\Windows\System\wifwePQ.exe
  2⤵
  PID:5104
- C:\Windows\System\IepOLgL.exe
  C:\Windows\System\IepOLgL.exe
  2⤵
  PID:564
- C:\Windows\System\iMeSpNC.exe
  C:\Windows\System\iMeSpNC.exe
  2⤵
  PID:2432
- C:\Windows\System\RugZgTr.exe
  C:\Windows\System\RugZgTr.exe
  2⤵
  PID:3604
- C:\Windows\System\CIiDQGE.exe
  C:\Windows\System\CIiDQGE.exe
  2⤵
  PID:4144
- C:\Windows\System\XHTcixg.exe
  C:\Windows\System\XHTcixg.exe
  2⤵
  PID:3800
- C:\Windows\System\XEQqYjE.exe
  C:\Windows\System\XEQqYjE.exe
  2⤵
  PID:3552
- C:\Windows\System\uvDzHTk.exe
  C:\Windows\System\uvDzHTk.exe
  2⤵
  PID:1456
- C:\Windows\System\BWIvLXw.exe
  C:\Windows\System\BWIvLXw.exe
  2⤵
  PID:3488
- C:\Windows\System\ahKJQiK.exe
  C:\Windows\System\ahKJQiK.exe
  2⤵
  PID:4120
- C:\Windows\System\vRAEFPc.exe
  C:\Windows\System\vRAEFPc.exe
  2⤵
  PID:4176
- C:\Windows\System\HOXTuyd.exe
  C:\Windows\System\HOXTuyd.exe
  2⤵
  PID:4220
- C:\Windows\System\BoeJqve.exe
  C:\Windows\System\BoeJqve.exe
  2⤵
  PID:4188
- C:\Windows\System\uewbbFv.exe
  C:\Windows\System\uewbbFv.exe
  2⤵
  PID:4320
- C:\Windows\System\ZrmsExE.exe
  C:\Windows\System\ZrmsExE.exe
  2⤵
  PID:4232
- C:\Windows\System\mDEaReA.exe
  C:\Windows\System\mDEaReA.exe
  2⤵
  PID:4268
- C:\Windows\System\LRLEzLx.exe
  C:\Windows\System\LRLEzLx.exe
  2⤵
  PID:4336
- C:\Windows\System\TNSXaxe.exe
  C:\Windows\System\TNSXaxe.exe
  2⤵
  PID:4360
- C:\Windows\System\tYMiwjY.exe
  C:\Windows\System\tYMiwjY.exe
  2⤵
  PID:4444
- C:\Windows\System\dXqIRvJ.exe
  C:\Windows\System\dXqIRvJ.exe
  2⤵
  PID:4476
- C:\Windows\System\efKOPKn.exe
  C:\Windows\System\efKOPKn.exe
  2⤵
  PID:4540
- C:\Windows\System\TzSZbkj.exe
  C:\Windows\System\TzSZbkj.exe
  2⤵
  PID:4572
- C:\Windows\System\XVqKrqU.exe
  C:\Windows\System\XVqKrqU.exe
  2⤵
  PID:4636
- C:\Windows\System\trOUAzn.exe
  C:\Windows\System\trOUAzn.exe
  2⤵
  PID:4456
- C:\Windows\System\sHcQJfx.exe
  C:\Windows\System\sHcQJfx.exe
  2⤵
  PID:4496
- C:\Windows\System\AVPmjcY.exe
  C:\Windows\System\AVPmjcY.exe
  2⤵
  PID:4672
- C:\Windows\System\TKiaLpn.exe
  C:\Windows\System\TKiaLpn.exe
  2⤵
  PID:4736
- C:\Windows\System\weQmqAH.exe
  C:\Windows\System\weQmqAH.exe
  2⤵
  PID:4800
- C:\Windows\System\OZevtEt.exe
  C:\Windows\System\OZevtEt.exe
  2⤵
  PID:4588
- C:\Windows\System\glsdjWk.exe
  C:\Windows\System\glsdjWk.exe
  2⤵
  PID:4808
- C:\Windows\System\mXpMwFZ.exe
  C:\Windows\System\mXpMwFZ.exe
  2⤵
  PID:4660
- C:\Windows\System\SnMlByl.exe
  C:\Windows\System\SnMlByl.exe
  2⤵
  PID:4720
- C:\Windows\System\saRKwgh.exe
  C:\Windows\System\saRKwgh.exe
  2⤵
  PID:4904
- C:\Windows\System\AmPcLce.exe
  C:\Windows\System\AmPcLce.exe
  2⤵
  PID:4784
- C:\Windows\System\OgIAagW.exe
  C:\Windows\System\OgIAagW.exe
  2⤵
  PID:4964
- C:\Windows\System\KLlayXy.exe
  C:\Windows\System\KLlayXy.exe
  2⤵
  PID:4820
- C:\Windows\System\pxYqlyx.exe
  C:\Windows\System\pxYqlyx.exe
  2⤵
  PID:4884
- C:\Windows\System\nZjSCYI.exe
  C:\Windows\System\nZjSCYI.exe
  2⤵
  PID:4980
- C:\Windows\System\hdMSZQJ.exe
  C:\Windows\System\hdMSZQJ.exe
  2⤵
  PID:5032
- C:\Windows\System\oqWnAql.exe
  C:\Windows\System\oqWnAql.exe
  2⤵
  PID:5052
- C:\Windows\System\fSuTykK.exe
  C:\Windows\System\fSuTykK.exe
  2⤵
  PID:5096
- C:\Windows\System\blcZutw.exe
  C:\Windows\System\blcZutw.exe
  2⤵
  PID:3452
- C:\Windows\System\BWyvspl.exe
  C:\Windows\System\BWyvspl.exe
  2⤵
  PID:3156
- C:\Windows\System\BYQmmPq.exe
  C:\Windows\System\BYQmmPq.exe
  2⤵
  PID:5112
- C:\Windows\System\RlJRamZ.exe
  C:\Windows\System\RlJRamZ.exe
  2⤵
  PID:4024
- C:\Windows\System\dPUklZc.exe
  C:\Windows\System\dPUklZc.exe
  2⤵
  PID:3104
- C:\Windows\System\YbTRMAq.exe
  C:\Windows\System\YbTRMAq.exe
  2⤵
  PID:4160
- C:\Windows\System\HgAERdv.exe
  C:\Windows\System\HgAERdv.exe
  2⤵
  PID:4604
- C:\Windows\System\aIeEbME.exe
  C:\Windows\System\aIeEbME.exe
  2⤵
  PID:4488
- C:\Windows\System\faHoyji.exe
  C:\Windows\System\faHoyji.exe
  2⤵
  PID:4556
- C:\Windows\System\TftYOYE.exe
  C:\Windows\System\TftYOYE.exe
  2⤵
  PID:4216
- C:\Windows\System\lfJvZRA.exe
  C:\Windows\System\lfJvZRA.exe
  2⤵
  PID:4264
- C:\Windows\System\kVLCTxE.exe
  C:\Windows\System\kVLCTxE.exe
  2⤵
  PID:4528
- C:\Windows\System\lKxxQeM.exe
  C:\Windows\System\lKxxQeM.exe
  2⤵
  PID:4900
- C:\Windows\System\vaisAEP.exe
  C:\Windows\System\vaisAEP.exe
  2⤵
  PID:4856
- C:\Windows\System\zoKbdDb.exe
  C:\Windows\System\zoKbdDb.exe
  2⤵
  PID:4936
- C:\Windows\System\SVTfcIp.exe
  C:\Windows\System\SVTfcIp.exe
  2⤵
  PID:4544
- C:\Windows\System\mIlFeJZ.exe
  C:\Windows\System\mIlFeJZ.exe
  2⤵
  PID:4640
- C:\Windows\System\TFEnAXU.exe
  C:\Windows\System\TFEnAXU.exe
  2⤵
  PID:5048
- C:\Windows\System\dWzuxRb.exe
  C:\Windows\System\dWzuxRb.exe
  2⤵
  PID:4136
- C:\Windows\System\FJWRbdg.exe
  C:\Windows\System\FJWRbdg.exe
  2⤵
  PID:4624
- C:\Windows\System\MlPpSzZ.exe
  C:\Windows\System\MlPpSzZ.exe
  2⤵
  PID:4752
- C:\Windows\System\VMhgDyT.exe
  C:\Windows\System\VMhgDyT.exe
  2⤵
  PID:4324
- C:\Windows\System\BXwSjiV.exe
  C:\Windows\System\BXwSjiV.exe
  2⤵
  PID:4708
- C:\Windows\System\tPCNdiV.exe
  C:\Windows\System\tPCNdiV.exe
  2⤵
  PID:4560
- C:\Windows\System\rGJIhbd.exe
  C:\Windows\System\rGJIhbd.exe
  2⤵
  PID:4292
- C:\Windows\System\iDtjKTU.exe
  C:\Windows\System\iDtjKTU.exe
  2⤵
  PID:5080
- C:\Windows\System\dzwgRQx.exe
  C:\Windows\System\dzwgRQx.exe
  2⤵
  PID:5084
- C:\Windows\System\NsTpeYZ.exe
  C:\Windows\System\NsTpeYZ.exe
  2⤵
  PID:4656
- C:\Windows\System\eJFWfCV.exe
  C:\Windows\System\eJFWfCV.exe
  2⤵
  PID:5020
- C:\Windows\System\HPRjZpW.exe
  C:\Windows\System\HPRjZpW.exe
  2⤵
  PID:4692
- C:\Windows\System\TyheuTp.exe
  C:\Windows\System\TyheuTp.exe
  2⤵
  PID:4356
- C:\Windows\System\RVdzLVk.exe
  C:\Windows\System\RVdzLVk.exe
  2⤵
  PID:4428
- C:\Windows\System\FAWuFey.exe
  C:\Windows\System\FAWuFey.exe
  2⤵
  PID:4852
- C:\Windows\System\owDfPET.exe
  C:\Windows\System\owDfPET.exe
  2⤵
  PID:4508
- C:\Windows\System\ibTrFRL.exe
  C:\Windows\System\ibTrFRL.exe
  2⤵
  PID:4984
- C:\Windows\System\CDHjtHa.exe
  C:\Windows\System\CDHjtHa.exe
  2⤵
  PID:4424
- C:\Windows\System\hiZPPnc.exe
  C:\Windows\System\hiZPPnc.exe
  2⤵
  PID:4768
- C:\Windows\System\RBcCQBJ.exe
  C:\Windows\System\RBcCQBJ.exe
  2⤵
  PID:4380
- C:\Windows\System\iUJpCTS.exe
  C:\Windows\System\iUJpCTS.exe
  2⤵
  PID:3616
- C:\Windows\System\hSJpdZL.exe
  C:\Windows\System\hSJpdZL.exe
  2⤵
  PID:5000
- C:\Windows\System\oUKgRPw.exe
  C:\Windows\System\oUKgRPw.exe
  2⤵
  PID:5136
- C:\Windows\System\avrRhGA.exe
  C:\Windows\System\avrRhGA.exe
  2⤵
  PID:5160
- C:\Windows\System\hBrSVlv.exe
  C:\Windows\System\hBrSVlv.exe
  2⤵
  PID:5180
- C:\Windows\System\OkGTsux.exe
  C:\Windows\System\OkGTsux.exe
  2⤵
  PID:5196
- C:\Windows\System\IKEOMmv.exe
  C:\Windows\System\IKEOMmv.exe
  2⤵
  PID:5212
- C:\Windows\System\UpZOWaA.exe
  C:\Windows\System\UpZOWaA.exe
  2⤵
  PID:5228
- C:\Windows\System\lsymxis.exe
  C:\Windows\System\lsymxis.exe
  2⤵
  PID:5244
- C:\Windows\System\DMHIwDt.exe
  C:\Windows\System\DMHIwDt.exe
  2⤵
  PID:5260
- C:\Windows\System\rlKinem.exe
  C:\Windows\System\rlKinem.exe
  2⤵
  PID:5276
- C:\Windows\System\rWPACHJ.exe
  C:\Windows\System\rWPACHJ.exe
  2⤵
  PID:5292
- C:\Windows\System\vRKxxmD.exe
  C:\Windows\System\vRKxxmD.exe
  2⤵
  PID:5308
- C:\Windows\System\nAEDJNu.exe
  C:\Windows\System\nAEDJNu.exe
  2⤵
  PID:5324
- C:\Windows\System\AlhCjYQ.exe
  C:\Windows\System\AlhCjYQ.exe
  2⤵
  PID:5340
- C:\Windows\System\McrVAkN.exe
  C:\Windows\System\McrVAkN.exe
  2⤵
  PID:5356
- C:\Windows\System\ejzEOqL.exe
  C:\Windows\System\ejzEOqL.exe
  2⤵
  PID:5372
- C:\Windows\System\sdzRGMq.exe
  C:\Windows\System\sdzRGMq.exe
  2⤵
  PID:5388
- C:\Windows\System\pBRAMbU.exe
  C:\Windows\System\pBRAMbU.exe
  2⤵
  PID:5404
- C:\Windows\System\edhKBdS.exe
  C:\Windows\System\edhKBdS.exe
  2⤵
  PID:5420
- C:\Windows\System\sLvveUH.exe
  C:\Windows\System\sLvveUH.exe
  2⤵
  PID:5436
- C:\Windows\System\QeqQvTb.exe
  C:\Windows\System\QeqQvTb.exe
  2⤵
  PID:5452
- C:\Windows\System\EPpPdKh.exe
  C:\Windows\System\EPpPdKh.exe
  2⤵
  PID:5468
- C:\Windows\System\oRsvisQ.exe
  C:\Windows\System\oRsvisQ.exe
  2⤵
  PID:5488
- C:\Windows\System\RcNbISt.exe
  C:\Windows\System\RcNbISt.exe
  2⤵
  PID:5504
- C:\Windows\System\sPnMIpf.exe
  C:\Windows\System\sPnMIpf.exe
  2⤵
  PID:5520
- C:\Windows\System\llomgvu.exe
  C:\Windows\System\llomgvu.exe
  2⤵
  PID:5536
- C:\Windows\System\NVsZyTo.exe
  C:\Windows\System\NVsZyTo.exe
  2⤵
  PID:5552
- C:\Windows\System\bjjBakd.exe
  C:\Windows\System\bjjBakd.exe
  2⤵
  PID:5568
- C:\Windows\System\ULbdDXZ.exe
  C:\Windows\System\ULbdDXZ.exe
  2⤵
  PID:5584
- C:\Windows\System\cirRmyw.exe
  C:\Windows\System\cirRmyw.exe
  2⤵
  PID:5600
- C:\Windows\System\SoXNPMu.exe
  C:\Windows\System\SoXNPMu.exe
  2⤵
  PID:5616
- C:\Windows\System\FpAOOnV.exe
  C:\Windows\System\FpAOOnV.exe
  2⤵
  PID:5632
- C:\Windows\System\HZGQcIq.exe
  C:\Windows\System\HZGQcIq.exe
  2⤵
  PID:5648
- C:\Windows\System\iXVITdX.exe
  C:\Windows\System\iXVITdX.exe
  2⤵
  PID:5664
- C:\Windows\System\kdBsBKK.exe
  C:\Windows\System\kdBsBKK.exe
  2⤵
  PID:5680
- C:\Windows\System\GkBmErZ.exe
  C:\Windows\System\GkBmErZ.exe
  2⤵
  PID:5696
- C:\Windows\System\owXzUFj.exe
  C:\Windows\System\owXzUFj.exe
  2⤵
  PID:5712
- C:\Windows\System\MtLUsmI.exe
  C:\Windows\System\MtLUsmI.exe
  2⤵
  PID:5728
- C:\Windows\System\bUhQwLM.exe
  C:\Windows\System\bUhQwLM.exe
  2⤵
  PID:5744
- C:\Windows\System\wTXmwxj.exe
  C:\Windows\System\wTXmwxj.exe
  2⤵
  PID:5760
- C:\Windows\System\GAXPUEP.exe
  C:\Windows\System\GAXPUEP.exe
  2⤵
  PID:5780
- C:\Windows\System\lKBQuhI.exe
  C:\Windows\System\lKBQuhI.exe
  2⤵
  PID:5796
- C:\Windows\System\dtrUqCL.exe
  C:\Windows\System\dtrUqCL.exe
  2⤵
  PID:5812
- C:\Windows\System\suNQNpU.exe
  C:\Windows\System\suNQNpU.exe
  2⤵
  PID:5828
- C:\Windows\System\wPyLCKE.exe
  C:\Windows\System\wPyLCKE.exe
  2⤵
  PID:5844
- C:\Windows\System\MItTPdr.exe
  C:\Windows\System\MItTPdr.exe
  2⤵
  PID:5860
- C:\Windows\System\JYFzxJC.exe
  C:\Windows\System\JYFzxJC.exe
  2⤵
  PID:5876
- C:\Windows\System\EsGMzcw.exe
  C:\Windows\System\EsGMzcw.exe
  2⤵
  PID:5892
- C:\Windows\System\cKLLXzK.exe
  C:\Windows\System\cKLLXzK.exe
  2⤵
  PID:5908
- C:\Windows\System\pQJBRjG.exe
  C:\Windows\System\pQJBRjG.exe
  2⤵
  PID:5924
- C:\Windows\System\LDKSHYi.exe
  C:\Windows\System\LDKSHYi.exe
  2⤵
  PID:5940
- C:\Windows\System\QnHzwVM.exe
  C:\Windows\System\QnHzwVM.exe
  2⤵
  PID:5960
- C:\Windows\System\calvkwQ.exe
  C:\Windows\System\calvkwQ.exe
  2⤵
  PID:5976
- C:\Windows\System\JrWzWRu.exe
  C:\Windows\System\JrWzWRu.exe
  2⤵
  PID:5992
- C:\Windows\System\GAdQucP.exe
  C:\Windows\System\GAdQucP.exe
  2⤵
  PID:6008
- C:\Windows\System\NyVqYvj.exe
  C:\Windows\System\NyVqYvj.exe
  2⤵
  PID:6024
- C:\Windows\System\uEstvtM.exe
  C:\Windows\System\uEstvtM.exe
  2⤵
  PID:6040
- C:\Windows\System\mJfSrjw.exe
  C:\Windows\System\mJfSrjw.exe
  2⤵
  PID:6056
- C:\Windows\System\rXBEtLT.exe
  C:\Windows\System\rXBEtLT.exe
  2⤵
  PID:6072
- C:\Windows\System\sjSyids.exe
  C:\Windows\System\sjSyids.exe
  2⤵
  PID:6088
- C:\Windows\System\jVTlYgJ.exe
  C:\Windows\System\jVTlYgJ.exe
  2⤵
  PID:6104
- C:\Windows\System\iXpZyzq.exe
  C:\Windows\System\iXpZyzq.exe
  2⤵
  PID:6120
- C:\Windows\System\UyVPpCZ.exe
  C:\Windows\System\UyVPpCZ.exe
  2⤵
  PID:6140
- C:\Windows\System\YRkePOw.exe
  C:\Windows\System\YRkePOw.exe
  2⤵
  PID:4104
- C:\Windows\System\MPRjlqZ.exe
  C:\Windows\System\MPRjlqZ.exe
  2⤵
  PID:5148
- C:\Windows\System\EFuyglf.exe
  C:\Windows\System\EFuyglf.exe
  2⤵
  PID:5192
- C:\Windows\System\wjgNhXc.exe
  C:\Windows\System\wjgNhXc.exe
  2⤵
  PID:5284
- C:\Windows\System\ctxymnH.exe
  C:\Windows\System\ctxymnH.exe
  2⤵
  PID:5176
- C:\Windows\System\mUjguge.exe
  C:\Windows\System\mUjguge.exe
  2⤵
  PID:5240
- C:\Windows\System\aNlcwbT.exe
  C:\Windows\System\aNlcwbT.exe
  2⤵
  PID:5380
- C:\Windows\System\EclarHG.exe
  C:\Windows\System\EclarHG.exe
  2⤵
  PID:5304
- C:\Windows\System\eePutUW.exe
  C:\Windows\System\eePutUW.exe
  2⤵
  PID:5444
- C:\Windows\System\QBDRhWd.exe
  C:\Windows\System\QBDRhWd.exe
  2⤵
  PID:5484
- C:\Windows\System\KjNxQNm.exe
  C:\Windows\System\KjNxQNm.exe
  2⤵
  PID:5544
- C:\Windows\System\jLJrYsM.exe
  C:\Windows\System\jLJrYsM.exe
  2⤵
  PID:5432
- C:\Windows\System\OnsQdTl.exe
  C:\Windows\System\OnsQdTl.exe
  2⤵
  PID:5576
- C:\Windows\System\DmGrvTe.exe
  C:\Windows\System\DmGrvTe.exe
  2⤵
  PID:5612
- C:\Windows\System\FjVJqJz.exe
  C:\Windows\System\FjVJqJz.exe
  2⤵
  PID:5592
- C:\Windows\System\kwVGBLb.exe
  C:\Windows\System\kwVGBLb.exe
  2⤵
  PID:5464
- C:\Windows\System\wcpuZJC.exe
  C:\Windows\System\wcpuZJC.exe
  2⤵
  PID:5708
- C:\Windows\System\BjPWTyf.exe
  C:\Windows\System\BjPWTyf.exe
  2⤵
  PID:5740
- C:\Windows\System\ZzvzKfs.exe
  C:\Windows\System\ZzvzKfs.exe
  2⤵
  PID:5660
- C:\Windows\System\UrTarei.exe
  C:\Windows\System\UrTarei.exe
  2⤵
  PID:5720
- C:\Windows\System\MTQInKR.exe
  C:\Windows\System\MTQInKR.exe
  2⤵
  PID:5752
- C:\Windows\System\albaikT.exe
  C:\Windows\System\albaikT.exe
  2⤵
  PID:5804
- C:\Windows\System\eeIKsbS.exe
  C:\Windows\System\eeIKsbS.exe
  2⤵
  PID:5872
- C:\Windows\System\fkAEIBu.exe
  C:\Windows\System\fkAEIBu.exe
  2⤵
  PID:5936
- C:\Windows\System\kyeUcFR.exe
  C:\Windows\System\kyeUcFR.exe
  2⤵
  PID:6004
- C:\Windows\System\pRnqhxx.exe
  C:\Windows\System\pRnqhxx.exe
  2⤵
  PID:5856
- C:\Windows\System\aPZuSpZ.exe
  C:\Windows\System\aPZuSpZ.exe
  2⤵
  PID:6100
- C:\Windows\System\WxtlPHo.exe
  C:\Windows\System\WxtlPHo.exe
  2⤵
  PID:5952
- C:\Windows\System\gcStIKn.exe
  C:\Windows\System\gcStIKn.exe
  2⤵
  PID:6016
- C:\Windows\System\GoiQULv.exe
  C:\Windows\System\GoiQULv.exe
  2⤵
  PID:6084
- C:\Windows\System\xSsPbWM.exe
  C:\Windows\System\xSsPbWM.exe
  2⤵
  PID:1428
- C:\Windows\System\PJnUGxY.exe
  C:\Windows\System\PJnUGxY.exe
  2⤵
  PID:5984
- C:\Windows\System\VHyuCQT.exe
  C:\Windows\System\VHyuCQT.exe
  2⤵
  PID:5188
- C:\Windows\System\EvtKQmc.exe
  C:\Windows\System\EvtKQmc.exe
  2⤵
  PID:5144
- C:\Windows\System\vIXrtsZ.exe
  C:\Windows\System\vIXrtsZ.exe
  2⤵
  PID:5236
- C:\Windows\System\vHTFnnQ.exe
  C:\Windows\System\vHTFnnQ.exe
  2⤵
  PID:5332
- C:\Windows\System\rQQRjyU.exe
  C:\Windows\System\rQQRjyU.exe
  2⤵
  PID:5400
- C:\Windows\System\jhkbmwJ.exe
  C:\Windows\System\jhkbmwJ.exe
  2⤵
  PID:5412
- C:\Windows\System\ZlHKgBk.exe
  C:\Windows\System\ZlHKgBk.exe
  2⤵
  PID:5560
- C:\Windows\System\jkdkuWP.exe
  C:\Windows\System\jkdkuWP.exe
  2⤵
  PID:5500
- C:\Windows\System\toqLdbz.exe
  C:\Windows\System\toqLdbz.exe
  2⤵
  PID:5624
- C:\Windows\System\HcEFOSd.exe
  C:\Windows\System\HcEFOSd.exe
  2⤵
  PID:5724
- C:\Windows\System\qiMcoOB.exe
  C:\Windows\System\qiMcoOB.exe
  2⤵
  PID:5692
- C:\Windows\System\UzYeYUV.exe
  C:\Windows\System\UzYeYUV.exe
  2⤵
  PID:5836
- C:\Windows\System\mlHnlNE.exe
  C:\Windows\System\mlHnlNE.exe
  2⤵
  PID:5932
- C:\Windows\System\lVjUaIH.exe
  C:\Windows\System\lVjUaIH.exe
  2⤵
  PID:6132
- C:\Windows\System\GYCLjZF.exe
  C:\Windows\System\GYCLjZF.exe
  2⤵
  PID:5884
- C:\Windows\System\XbFiNVr.exe
  C:\Windows\System\XbFiNVr.exe
  2⤵
  PID:5948
- C:\Windows\System\VZzZfES.exe
  C:\Windows\System\VZzZfES.exe
  2⤵
  PID:5132
- C:\Windows\System\EhzHoGD.exe
  C:\Windows\System\EhzHoGD.exe
  2⤵
  PID:6020
- C:\Windows\System\PpqaZTh.exe
  C:\Windows\System\PpqaZTh.exe
  2⤵
  PID:6048
- C:\Windows\System\lTOquLU.exe
  C:\Windows\System\lTOquLU.exe
  2⤵
  PID:5676
- C:\Windows\System\HGHSEvu.exe
  C:\Windows\System\HGHSEvu.exe
  2⤵
  PID:5704
- C:\Windows\System\GnOlEMc.exe
  C:\Windows\System\GnOlEMc.exe
  2⤵
  PID:5904
- C:\Windows\System\iOwQMgv.exe
  C:\Windows\System\iOwQMgv.exe
  2⤵
  PID:5476
- C:\Windows\System\IMahwne.exe
  C:\Windows\System\IMahwne.exe
  2⤵
  PID:6128
- C:\Windows\System\suYwZgF.exe
  C:\Windows\System\suYwZgF.exe
  2⤵
  PID:6064
- C:\Windows\System\VQJgpAM.exe
  C:\Windows\System\VQJgpAM.exe
  2⤵
  PID:5208
- C:\Windows\System\XIbnNgJ.exe
  C:\Windows\System\XIbnNgJ.exe
  2⤵
  PID:5204
- C:\Windows\System\azhbpYf.exe
  C:\Windows\System\azhbpYf.exe
  2⤵
  PID:5368
- C:\Windows\System\puVpkle.exe
  C:\Windows\System\puVpkle.exe
  2⤵
  PID:5688
- C:\Windows\System\OtnCARy.exe
  C:\Windows\System\OtnCARy.exe
  2⤵
  PID:5868
- C:\Windows\System\bNsMwbc.exe
  C:\Windows\System\bNsMwbc.exe
  2⤵
  PID:6152
- C:\Windows\System\uFDkyXC.exe
  C:\Windows\System\uFDkyXC.exe
  2⤵
  PID:6168
- C:\Windows\System\STxBjEy.exe
  C:\Windows\System\STxBjEy.exe
  2⤵
  PID:6184
- C:\Windows\System\oNvQhRb.exe
  C:\Windows\System\oNvQhRb.exe
  2⤵
  PID:6200
- C:\Windows\System\XFSTVpV.exe
  C:\Windows\System\XFSTVpV.exe
  2⤵
  PID:6216
- C:\Windows\System\IQvTlgY.exe
  C:\Windows\System\IQvTlgY.exe
  2⤵
  PID:6232
- C:\Windows\System\uVbfoWu.exe
  C:\Windows\System\uVbfoWu.exe
  2⤵
  PID:6252
- C:\Windows\System\AjnFkmY.exe
  C:\Windows\System\AjnFkmY.exe
  2⤵
  PID:6268
- C:\Windows\System\pJtYTDI.exe
  C:\Windows\System\pJtYTDI.exe
  2⤵
  PID:6284
- C:\Windows\System\zKsqhof.exe
  C:\Windows\System\zKsqhof.exe
  2⤵
  PID:6300
- C:\Windows\System\dMfzshR.exe
  C:\Windows\System\dMfzshR.exe
  2⤵
  PID:6316
- C:\Windows\System\tXeUlQZ.exe
  C:\Windows\System\tXeUlQZ.exe
  2⤵
  PID:6332
- C:\Windows\System\PtlouAI.exe
  C:\Windows\System\PtlouAI.exe
  2⤵
  PID:6352
- C:\Windows\System\FANABHT.exe
  C:\Windows\System\FANABHT.exe
  2⤵
  PID:6368
- C:\Windows\System\XvfuuaV.exe
  C:\Windows\System\XvfuuaV.exe
  2⤵
  PID:6384
- C:\Windows\System\qjtWeBL.exe
  C:\Windows\System\qjtWeBL.exe
  2⤵
  PID:6400
- C:\Windows\System\QdWVYxf.exe
  C:\Windows\System\QdWVYxf.exe
  2⤵
  PID:6416
- C:\Windows\System\tWiXDXD.exe
  C:\Windows\System\tWiXDXD.exe
  2⤵
  PID:6432
- C:\Windows\System\DZshEvx.exe
  C:\Windows\System\DZshEvx.exe
  2⤵
  PID:6448
- C:\Windows\System\ATeJwPw.exe
  C:\Windows\System\ATeJwPw.exe
  2⤵
  PID:6468
- C:\Windows\System\EPhSBjG.exe
  C:\Windows\System\EPhSBjG.exe
  2⤵
  PID:6484
- C:\Windows\System\iCTjYkr.exe
  C:\Windows\System\iCTjYkr.exe
  2⤵
  PID:6500
- C:\Windows\System\glOkagW.exe
  C:\Windows\System\glOkagW.exe
  2⤵
  PID:6516
- C:\Windows\System\gwFfeKF.exe
  C:\Windows\System\gwFfeKF.exe
  2⤵
  PID:6532
- C:\Windows\System\KJKWejs.exe
  C:\Windows\System\KJKWejs.exe
  2⤵
  PID:6548
- C:\Windows\System\thtgXuy.exe
  C:\Windows\System\thtgXuy.exe
  2⤵
  PID:6568
- C:\Windows\System\rIeDrmt.exe
  C:\Windows\System\rIeDrmt.exe
  2⤵
  PID:6584
- C:\Windows\System\IvVSNHb.exe
  C:\Windows\System\IvVSNHb.exe
  2⤵
  PID:6600
- C:\Windows\System\uQJbxJH.exe
  C:\Windows\System\uQJbxJH.exe
  2⤵
  PID:6616
- C:\Windows\System\cqcqHuQ.exe
  C:\Windows\System\cqcqHuQ.exe
  2⤵
  PID:6632
- C:\Windows\System\NguASxO.exe
  C:\Windows\System\NguASxO.exe
  2⤵
  PID:6648
- C:\Windows\System\rDQTvZr.exe
  C:\Windows\System\rDQTvZr.exe
  2⤵
  PID:6668
- C:\Windows\System\zyfDzlM.exe
  C:\Windows\System\zyfDzlM.exe
  2⤵
  PID:6684
- C:\Windows\System\PkfvKml.exe
  C:\Windows\System\PkfvKml.exe
  2⤵
  PID:6700
- C:\Windows\System\mmKXdvt.exe
  C:\Windows\System\mmKXdvt.exe
  2⤵
  PID:6720
- C:\Windows\System\LqbZUTe.exe
  C:\Windows\System\LqbZUTe.exe
  2⤵
  PID:6736
- C:\Windows\System\gThhsgG.exe
  C:\Windows\System\gThhsgG.exe
  2⤵
  PID:6752
- C:\Windows\System\PaLPIuf.exe
  C:\Windows\System\PaLPIuf.exe
  2⤵
  PID:6768
- C:\Windows\System\zPkvYhF.exe
  C:\Windows\System\zPkvYhF.exe
  2⤵
  PID:6788
- C:\Windows\System\RptcpRU.exe
  C:\Windows\System\RptcpRU.exe
  2⤵
  PID:6804
- C:\Windows\System\iqdtrmV.exe
  C:\Windows\System\iqdtrmV.exe
  2⤵
  PID:6820
- C:\Windows\System\hPYXwtx.exe
  C:\Windows\System\hPYXwtx.exe
  2⤵
  PID:6840
- C:\Windows\System\gwTNuCr.exe
  C:\Windows\System\gwTNuCr.exe
  2⤵
  PID:6860
- C:\Windows\System\NsElwPT.exe
  C:\Windows\System\NsElwPT.exe
  2⤵
  PID:6876
- C:\Windows\System\XMIXjvE.exe
  C:\Windows\System\XMIXjvE.exe
  2⤵
  PID:6892
- C:\Windows\System\lkkmwRY.exe
  C:\Windows\System\lkkmwRY.exe
  2⤵
  PID:6912
- C:\Windows\System\jjalHCZ.exe
  C:\Windows\System\jjalHCZ.exe
  2⤵
  PID:6928
- C:\Windows\System\KxHxLXn.exe
  C:\Windows\System\KxHxLXn.exe
  2⤵
  PID:6944
- C:\Windows\System\VENUfJn.exe
  C:\Windows\System\VENUfJn.exe
  2⤵
  PID:6960
- C:\Windows\System\ZpVZCKC.exe
  C:\Windows\System\ZpVZCKC.exe
  2⤵
  PID:6980
- C:\Windows\System\WCJylDl.exe
  C:\Windows\System\WCJylDl.exe
  2⤵
  PID:6996
- C:\Windows\System\tIxwIBY.exe
  C:\Windows\System\tIxwIBY.exe
  2⤵
  PID:7012
- C:\Windows\System\bJWLDUr.exe
  C:\Windows\System\bJWLDUr.exe
  2⤵
  PID:7028
- C:\Windows\System\IknIVdq.exe
  C:\Windows\System\IknIVdq.exe
  2⤵
  PID:7048
- C:\Windows\System\InqgZyt.exe
  C:\Windows\System\InqgZyt.exe
  2⤵
  PID:7064
- C:\Windows\System\TjwSowP.exe
  C:\Windows\System\TjwSowP.exe
  2⤵
  PID:7080
- C:\Windows\System\siNDKIA.exe
  C:\Windows\System\siNDKIA.exe
  2⤵
  PID:7096
- C:\Windows\System\tHbpAPr.exe
  C:\Windows\System\tHbpAPr.exe
  2⤵
  PID:7112
- C:\Windows\System\IDIoxpQ.exe
  C:\Windows\System\IDIoxpQ.exe
  2⤵
  PID:7128
- C:\Windows\System\coYpTZI.exe
  C:\Windows\System\coYpTZI.exe
  2⤵
  PID:7144
- C:\Windows\System\LfPyJdk.exe
  C:\Windows\System\LfPyJdk.exe
  2⤵
  PID:7160
- C:\Windows\System\vATTcMH.exe
  C:\Windows\System\vATTcMH.exe
  2⤵
  PID:5788
- C:\Windows\System\FvpIqGP.exe
  C:\Windows\System\FvpIqGP.exe
  2⤵
  PID:6192
- C:\Windows\System\tnsnSbR.exe
  C:\Windows\System\tnsnSbR.exe
  2⤵
  PID:6260
- C:\Windows\System\pYYBasW.exe
  C:\Windows\System\pYYBasW.exe
  2⤵
  PID:6160
- C:\Windows\System\grxsBse.exe
  C:\Windows\System\grxsBse.exe
  2⤵
  PID:5768
- C:\Windows\System\qGEZGcw.exe
  C:\Windows\System\qGEZGcw.exe
  2⤵
  PID:6176
- C:\Windows\System\lwDpUTl.exe
  C:\Windows\System\lwDpUTl.exe
  2⤵
  PID:6296
- C:\Windows\System\ubnrvVA.exe
  C:\Windows\System\ubnrvVA.exe
  2⤵
  PID:6328
- C:\Windows\System\MJkSnuA.exe
  C:\Windows\System\MJkSnuA.exe
  2⤵
  PID:6312
- C:\Windows\System\ELgPrCm.exe
  C:\Windows\System\ELgPrCm.exe
  2⤵
  PID:6348
- C:\Windows\System\KIcBokV.exe
  C:\Windows\System\KIcBokV.exe
  2⤵
  PID:6428
- C:\Windows\System\RCiGGxY.exe
  C:\Windows\System\RCiGGxY.exe
  2⤵
  PID:6424
- C:\Windows\System\FecxHal.exe
  C:\Windows\System\FecxHal.exe
  2⤵
  PID:6492
- C:\Windows\System\oMCjeET.exe
  C:\Windows\System\oMCjeET.exe
  2⤵
  PID:6408
- C:\Windows\System\YOaogQN.exe
  C:\Windows\System\YOaogQN.exe
  2⤵
  PID:6476
- C:\Windows\System\bFkbBMx.exe
  C:\Windows\System\bFkbBMx.exe
  2⤵
  PID:6544
- C:\Windows\System\oikPRRC.exe
  C:\Windows\System\oikPRRC.exe
  2⤵
  PID:6612
- C:\Windows\System\EyNHwJj.exe
  C:\Windows\System\EyNHwJj.exe
  2⤵
  PID:6680
- C:\Windows\System\VerFaYz.exe
  C:\Windows\System\VerFaYz.exe
  2⤵
  PID:6660
- C:\Windows\System\ffCINkr.exe
  C:\Windows\System\ffCINkr.exe
  2⤵
  PID:6692
- C:\Windows\System\ATIsCoJ.exe
  C:\Windows\System\ATIsCoJ.exe
  2⤵
  PID:6728
- C:\Windows\System\SjKZybA.exe
  C:\Windows\System\SjKZybA.exe
  2⤵
  PID:6796
- C:\Windows\System\vyztjTK.exe
  C:\Windows\System\vyztjTK.exe
  2⤵
  PID:6836
- C:\Windows\System\OyUApkP.exe
  C:\Windows\System\OyUApkP.exe
  2⤵
  PID:6872
- C:\Windows\System\CRKqdez.exe
  C:\Windows\System\CRKqdez.exe
  2⤵
  PID:6816
- C:\Windows\System\LVgYhLp.exe
  C:\Windows\System\LVgYhLp.exe
  2⤵
  PID:6884
- C:\Windows\System\QVDAzlF.exe
  C:\Windows\System\QVDAzlF.exe
  2⤵
  PID:6936
- C:\Windows\System\GpWsDdh.exe
  C:\Windows\System\GpWsDdh.exe
  2⤵
  PID:7008
- C:\Windows\System\tZuUTdA.exe
  C:\Windows\System\tZuUTdA.exe
  2⤵
  PID:7072
- C:\Windows\System\YcjjphB.exe
  C:\Windows\System\YcjjphB.exe
  2⤵
  PID:6956
- C:\Windows\System\AFmIkMp.exe
  C:\Windows\System\AFmIkMp.exe
  2⤵
  PID:6988
- C:\Windows\System\dUKKyVX.exe
  C:\Windows\System\dUKKyVX.exe
  2⤵
  PID:5480
- C:\Windows\System\DHNSeLY.exe
  C:\Windows\System\DHNSeLY.exe
  2⤵
  PID:7092
- C:\Windows\System\gvKDxEo.exe
  C:\Windows\System\gvKDxEo.exe
  2⤵
  PID:6228
- C:\Windows\System\LdPaYzd.exe
  C:\Windows\System\LdPaYzd.exe
  2⤵
  PID:6148
- C:\Windows\System\SapVhmM.exe
  C:\Windows\System\SapVhmM.exe
  2⤵
  PID:6308
- C:\Windows\System\KhnBIss.exe
  C:\Windows\System\KhnBIss.exe
  2⤵
  PID:5608
- C:\Windows\System\QlAWAFz.exe
  C:\Windows\System\QlAWAFz.exe
  2⤵
  PID:6376
- C:\Windows\System\HNalqWx.exe
  C:\Windows\System\HNalqWx.exe
  2⤵
  PID:6240
- C:\Windows\System\UJfwBcd.exe
  C:\Windows\System\UJfwBcd.exe
  2⤵
  PID:6412
- C:\Windows\System\EptXkYR.exe
  C:\Windows\System\EptXkYR.exe
  2⤵
  PID:6556
- C:\Windows\System\tUUdKNc.exe
  C:\Windows\System\tUUdKNc.exe
  2⤵
  PID:6608
- C:\Windows\System\HciQOuK.exe
  C:\Windows\System\HciQOuK.exe
  2⤵
  PID:6716
- C:\Windows\System\RLmNZOt.exe
  C:\Windows\System\RLmNZOt.exe
  2⤵
  PID:6812
- C:\Windows\System\zIEKfug.exe
  C:\Windows\System\zIEKfug.exe
  2⤵
  PID:6908
- C:\Windows\System\AKiFhNU.exe
  C:\Windows\System\AKiFhNU.exe
  2⤵
  PID:6924
- C:\Windows\System\RZSSlSh.exe
  C:\Windows\System\RZSSlSh.exe
  2⤵
  PID:7088
- C:\Windows\System\rGXVStm.exe
  C:\Windows\System\rGXVStm.exe
  2⤵
  PID:6644
- C:\Windows\System\WWubQEc.exe
  C:\Windows\System\WWubQEc.exe
  2⤵
  PID:6580
- C:\Windows\System\XztKVjo.exe
  C:\Windows\System\XztKVjo.exe
  2⤵
  PID:6596
- C:\Windows\System\qXsWRyq.exe
  C:\Windows\System\qXsWRyq.exe
  2⤵
  PID:7060
- C:\Windows\System\CtiPlml.exe
  C:\Windows\System\CtiPlml.exe
  2⤵
  PID:7108
- C:\Windows\System\uRlbDnL.exe
  C:\Windows\System\uRlbDnL.exe
  2⤵
  PID:6828
- C:\Windows\System\YtWWiEI.exe
  C:\Windows\System\YtWWiEI.exe
  2⤵
  PID:7044
- C:\Windows\System\bhUgLCd.exe
  C:\Windows\System\bhUgLCd.exe
  2⤵
  PID:7056
- C:\Windows\System\HHKbFxq.exe
  C:\Windows\System\HHKbFxq.exe
  2⤵
  PID:6208
- C:\Windows\System\oaTgjit.exe
  C:\Windows\System\oaTgjit.exe
  2⤵
  PID:6564
- C:\Windows\System\BziGnRP.exe
  C:\Windows\System\BziGnRP.exe
  2⤵
  PID:6656
- C:\Windows\System\XdKrypt.exe
  C:\Windows\System\XdKrypt.exe
  2⤵
  PID:6480
- C:\Windows\System\rKUgvMe.exe
  C:\Windows\System\rKUgvMe.exe
  2⤵
  PID:6900
- C:\Windows\System\lQnJRny.exe
  C:\Windows\System\lQnJRny.exe
  2⤵
  PID:6524
- C:\Windows\System\ehTNlEG.exe
  C:\Windows\System\ehTNlEG.exe
  2⤵
  PID:6952
- C:\Windows\System\wSqPwRg.exe
  C:\Windows\System\wSqPwRg.exe
  2⤵
  PID:7004
- C:\Windows\System\ewoivjN.exe
  C:\Windows\System\ewoivjN.exe
  2⤵
  PID:5824
- C:\Windows\System\ASrVHvP.exe
  C:\Windows\System\ASrVHvP.exe
  2⤵
  PID:6760
- C:\Windows\System\gfcfGjK.exe
  C:\Windows\System\gfcfGjK.exe
  2⤵
  PID:7184
- C:\Windows\System\vBsQBRe.exe
  C:\Windows\System\vBsQBRe.exe
  2⤵
  PID:7200
- C:\Windows\System\pbSvexI.exe
  C:\Windows\System\pbSvexI.exe
  2⤵
  PID:7220
- C:\Windows\System\gcfgdbT.exe
  C:\Windows\System\gcfgdbT.exe
  2⤵
  PID:7236
- C:\Windows\System\aJdzIIi.exe
  C:\Windows\System\aJdzIIi.exe
  2⤵
  PID:7256
- C:\Windows\System\YMGVmwY.exe
  C:\Windows\System\YMGVmwY.exe
  2⤵
  PID:7272
- C:\Windows\System\Dkjvilu.exe
  C:\Windows\System\Dkjvilu.exe
  2⤵
  PID:7288
- C:\Windows\System\mDHTFsV.exe
  C:\Windows\System\mDHTFsV.exe
  2⤵
  PID:7304
- C:\Windows\System\gLezsqQ.exe
  C:\Windows\System\gLezsqQ.exe
  2⤵
  PID:7320
- C:\Windows\System\jwtRCgb.exe
  C:\Windows\System\jwtRCgb.exe
  2⤵
  PID:7336
- C:\Windows\System\SXdWnqM.exe
  C:\Windows\System\SXdWnqM.exe
  2⤵
  PID:7352
- C:\Windows\System\OlIoTku.exe
  C:\Windows\System\OlIoTku.exe
  2⤵
  PID:7368
- C:\Windows\System\xXaPXBt.exe
  C:\Windows\System\xXaPXBt.exe
  2⤵
  PID:7384
- C:\Windows\System\IxBuLWN.exe
  C:\Windows\System\IxBuLWN.exe
  2⤵
  PID:7400
- C:\Windows\System\HrYxeQf.exe
  C:\Windows\System\HrYxeQf.exe
  2⤵
  PID:7416
- C:\Windows\System\sdFXpdV.exe
  C:\Windows\System\sdFXpdV.exe
  2⤵
  PID:7436
- C:\Windows\System\MzoBTxg.exe
  C:\Windows\System\MzoBTxg.exe
  2⤵
  PID:7452
- C:\Windows\System\CIOMXAU.exe
  C:\Windows\System\CIOMXAU.exe
  2⤵
  PID:7468
- C:\Windows\System\cOUvNVM.exe
  C:\Windows\System\cOUvNVM.exe
  2⤵
  PID:7484
- C:\Windows\System\qKnseuR.exe
  C:\Windows\System\qKnseuR.exe
  2⤵
  PID:7500
- C:\Windows\System\fqGzGmn.exe
  C:\Windows\System\fqGzGmn.exe
  2⤵
  PID:7516
- C:\Windows\System\IbmDKRv.exe
  C:\Windows\System\IbmDKRv.exe
  2⤵
  PID:7532
- C:\Windows\System\LomGXKJ.exe
  C:\Windows\System\LomGXKJ.exe
  2⤵
  PID:7548
- C:\Windows\System\nFDWQKH.exe
  C:\Windows\System\nFDWQKH.exe
  2⤵
  PID:7568
- C:\Windows\System\lUWgyPS.exe
  C:\Windows\System\lUWgyPS.exe
  2⤵
  PID:7588
- C:\Windows\System\wUZRFRv.exe
  C:\Windows\System\wUZRFRv.exe
  2⤵
  PID:7604
- C:\Windows\System\saowkZH.exe
  C:\Windows\System\saowkZH.exe
  2⤵
  PID:7620
- C:\Windows\System\VznoUrp.exe
  C:\Windows\System\VznoUrp.exe
  2⤵
  PID:7636
- C:\Windows\System\iHHimUq.exe
  C:\Windows\System\iHHimUq.exe
  2⤵
  PID:7660
- C:\Windows\System\pFIPevc.exe
  C:\Windows\System\pFIPevc.exe
  2⤵
  PID:7676
- C:\Windows\System\UWvVwth.exe
  C:\Windows\System\UWvVwth.exe
  2⤵
  PID:7692
- C:\Windows\System\bZlOwrs.exe
  C:\Windows\System\bZlOwrs.exe
  2⤵
  PID:7708
- C:\Windows\System\PoBxyIw.exe
  C:\Windows\System\PoBxyIw.exe
  2⤵
  PID:7724
- C:\Windows\System\TiNRRyh.exe
  C:\Windows\System\TiNRRyh.exe
  2⤵
  PID:7800
- C:\Windows\System\GcwUrOA.exe
  C:\Windows\System\GcwUrOA.exe
  2⤵
  PID:8000
- C:\Windows\System\spLDGLk.exe
  C:\Windows\System\spLDGLk.exe
  2⤵
  PID:8016
- C:\Windows\System\ocQjmdF.exe
  C:\Windows\System\ocQjmdF.exe
  2⤵
  PID:8032
- C:\Windows\System\IYzsoAj.exe
  C:\Windows\System\IYzsoAj.exe
  2⤵
  PID:8048
- C:\Windows\System\PVOWWZi.exe
  C:\Windows\System\PVOWWZi.exe
  2⤵
  PID:8064
- C:\Windows\System\mdtdLlj.exe
  C:\Windows\System\mdtdLlj.exe
  2⤵
  PID:8080
- C:\Windows\System\PIoTNue.exe
  C:\Windows\System\PIoTNue.exe
  2⤵
  PID:8096
- C:\Windows\System\fZXjPXZ.exe
  C:\Windows\System\fZXjPXZ.exe
  2⤵
  PID:8112
- C:\Windows\System\xUkzqAK.exe
  C:\Windows\System\xUkzqAK.exe
  2⤵
  PID:8128
- C:\Windows\System\zhYRsKS.exe
  C:\Windows\System\zhYRsKS.exe
  2⤵
  PID:8144
- C:\Windows\System\VUsWkOM.exe
  C:\Windows\System\VUsWkOM.exe
  2⤵
  PID:8160
- C:\Windows\System\pyGlOkE.exe
  C:\Windows\System\pyGlOkE.exe
  2⤵
  PID:8176
- C:\Windows\System\LmXfPop.exe
  C:\Windows\System\LmXfPop.exe
  2⤵
  PID:6764
- C:\Windows\System\NNNzHOn.exe
  C:\Windows\System\NNNzHOn.exe
  2⤵
  PID:6444
- C:\Windows\System\POzfhBa.exe
  C:\Windows\System\POzfhBa.exe
  2⤵
  PID:7232
- C:\Windows\System\BhJexGS.exe
  C:\Windows\System\BhJexGS.exe
  2⤵
  PID:7328
- C:\Windows\System\TLNorTP.exe
  C:\Windows\System\TLNorTP.exe
  2⤵
  PID:7360
- C:\Windows\System\dHZFGNi.exe
  C:\Windows\System\dHZFGNi.exe
  2⤵
  PID:7424
- C:\Windows\System\onhnPYQ.exe
  C:\Windows\System\onhnPYQ.exe
  2⤵
  PID:7464
- C:\Windows\System\KlmEZFf.exe
  C:\Windows\System\KlmEZFf.exe
  2⤵
  PID:7524
- C:\Windows\System\CEDrNnA.exe
  C:\Windows\System\CEDrNnA.exe
  2⤵
  PID:7596
- C:\Windows\System\WMRJQRn.exe
  C:\Windows\System\WMRJQRn.exe
  2⤵
  PID:7668
- C:\Windows\System\YSqXaJP.exe
  C:\Windows\System\YSqXaJP.exe
  2⤵
  PID:7700
- C:\Windows\System\aicHhDM.exe
  C:\Windows\System\aicHhDM.exe
  2⤵
  PID:6540
- C:\Windows\System\QLhDKuH.exe
  C:\Windows\System\QLhDKuH.exe
  2⤵
  PID:7020
- C:\Windows\System\BsAJqwL.exe
  C:\Windows\System\BsAJqwL.exe
  2⤵
  PID:7216
- C:\Windows\System\sXwwTuk.exe
  C:\Windows\System\sXwwTuk.exe
  2⤵
  PID:7280
- C:\Windows\System\CTdUsEk.exe
  C:\Windows\System\CTdUsEk.exe
  2⤵
  PID:7344
- C:\Windows\System\TLdZBus.exe
  C:\Windows\System\TLdZBus.exe
  2⤵
  PID:7412
- C:\Windows\System\DMKllgH.exe
  C:\Windows\System\DMKllgH.exe
  2⤵
  PID:7480
- C:\Windows\System\uechsFf.exe
  C:\Windows\System\uechsFf.exe
  2⤵
  PID:7576
- C:\Windows\System\zQNIoUq.exe
  C:\Windows\System\zQNIoUq.exe
  2⤵
  PID:7644
- C:\Windows\System\BCvPBwz.exe
  C:\Windows\System\BCvPBwz.exe
  2⤵
  PID:7684
- C:\Windows\System\MMCUfxH.exe
  C:\Windows\System\MMCUfxH.exe
  2⤵
  PID:7732
- C:\Windows\System\klhOBRU.exe
  C:\Windows\System\klhOBRU.exe
  2⤵
  PID:7748
- C:\Windows\System\vcaGbPm.exe
  C:\Windows\System\vcaGbPm.exe
  2⤵
  PID:7756
- C:\Windows\System\AMAjumu.exe
  C:\Windows\System\AMAjumu.exe
  2⤵
  PID:7784
- C:\Windows\System\VxMVicV.exe
  C:\Windows\System\VxMVicV.exe
  2⤵
  PID:7812
- C:\Windows\System\beEeRnZ.exe
  C:\Windows\System\beEeRnZ.exe
  2⤵
  PID:7820
- C:\Windows\System\Xniwkos.exe
  C:\Windows\System\Xniwkos.exe
  2⤵
  PID:7832
- C:\Windows\System\tVnusSF.exe
  C:\Windows\System\tVnusSF.exe
  2⤵
  PID:7852
- C:\Windows\System\LTsqZkF.exe
  C:\Windows\System\LTsqZkF.exe
  2⤵
  PID:7864
- C:\Windows\System\yAMaUuY.exe
  C:\Windows\System\yAMaUuY.exe
  2⤵
  PID:7888
- C:\Windows\System\kFuutsB.exe
  C:\Windows\System\kFuutsB.exe
  2⤵
  PID:7876
- C:\Windows\System\KssTfFo.exe
  C:\Windows\System\KssTfFo.exe
  2⤵
  PID:7896
- C:\Windows\System\VAgdbwY.exe
  C:\Windows\System\VAgdbwY.exe
  2⤵
  PID:7916
- C:\Windows\System\HcnizVS.exe
  C:\Windows\System\HcnizVS.exe
  2⤵
  PID:7936
- C:\Windows\System\XBIWJkw.exe
  C:\Windows\System\XBIWJkw.exe
  2⤵
  PID:7952
- C:\Windows\System\qmYlgoQ.exe
  C:\Windows\System\qmYlgoQ.exe
  2⤵
  PID:7972
- C:\Windows\System\sQRjYET.exe
  C:\Windows\System\sQRjYET.exe
  2⤵
  PID:7988
- C:\Windows\System\ptwPOfu.exe
  C:\Windows\System\ptwPOfu.exe
  2⤵
  PID:8028
- C:\Windows\System\aUvnACF.exe
  C:\Windows\System\aUvnACF.exe
  2⤵
  PID:8056
- C:\Windows\System\gIpsdkW.exe
  C:\Windows\System\gIpsdkW.exe
  2⤵
  PID:240
- C:\Windows\System\NWicDxQ.exe
  C:\Windows\System\NWicDxQ.exe
  2⤵
  PID:1204
- C:\Windows\System\GaQvMDN.exe
  C:\Windows\System\GaQvMDN.exe
  2⤵
  PID:8120
- C:\Windows\System\vqjpRBr.exe
  C:\Windows\System\vqjpRBr.exe
  2⤵
  PID:8152
- C:\Windows\System\XPoFXtk.exe
  C:\Windows\System\XPoFXtk.exe
  2⤵
  PID:6560
- C:\Windows\System\QcgMbfP.exe
  C:\Windows\System\QcgMbfP.exe
  2⤵
  PID:6848
- C:\Windows\System\dgtxCJS.exe
  C:\Windows\System\dgtxCJS.exe
  2⤵
  PID:7264
- C:\Windows\System\bhJgwtq.exe
  C:\Windows\System\bhJgwtq.exe
  2⤵
  PID:7396
- C:\Windows\System\ljXUCmt.exe
  C:\Windows\System\ljXUCmt.exe
  2⤵
  PID:7528
- C:\Windows\System\EviFxyx.exe
  C:\Windows\System\EviFxyx.exe
  2⤵
  PID:7628
- C:\Windows\System\VUFrIQq.exe
  C:\Windows\System\VUFrIQq.exe
  2⤵
  PID:6744
- C:\Windows\System\VhQPztX.exe
  C:\Windows\System\VhQPztX.exe
  2⤵
  PID:7212
- C:\Windows\System\zyelMsA.exe
  C:\Windows\System\zyelMsA.exe
  2⤵
  PID:7316
- C:\Windows\System\xUPQyyL.exe
  C:\Windows\System\xUPQyyL.exe
  2⤵
  PID:7476
- C:\Windows\System\olTRjUT.exe
  C:\Windows\System\olTRjUT.exe
  2⤵
  PID:7512
- C:\Windows\System\ylvwwtu.exe
  C:\Windows\System\ylvwwtu.exe
  2⤵
  PID:7656
- C:\Windows\System\xwFLZCh.exe
  C:\Windows\System\xwFLZCh.exe
  2⤵
  PID:7776
- C:\Windows\System\JGcEBcS.exe
  C:\Windows\System\JGcEBcS.exe
  2⤵
  PID:7780
- C:\Windows\System\QKAwtnt.exe
  C:\Windows\System\QKAwtnt.exe
  2⤵
  PID:7824
- C:\Windows\System\vhIbSZn.exe
  C:\Windows\System\vhIbSZn.exe
  2⤵
  PID:7860
- C:\Windows\System\KfljSNG.exe
  C:\Windows\System\KfljSNG.exe
  2⤵
  PID:7908
- C:\Windows\System\LXAvdwm.exe
  C:\Windows\System\LXAvdwm.exe
  2⤵
  PID:7836
- C:\Windows\System\YjTaepA.exe
  C:\Windows\System\YjTaepA.exe
  2⤵
  PID:8044
- C:\Windows\System\yBcVVZK.exe
  C:\Windows\System\yBcVVZK.exe
  2⤵
  PID:8188
- C:\Windows\System\hsjRhjT.exe
  C:\Windows\System\hsjRhjT.exe
  2⤵
  PID:7848
- C:\Windows\System\oJDjJuO.exe
  C:\Windows\System\oJDjJuO.exe
  2⤵
  PID:7632
- C:\Windows\System\uoCYiIB.exe
  C:\Windows\System\uoCYiIB.exe
  2⤵
  PID:1912
- C:\Windows\System\DlRaGbl.exe
  C:\Windows\System\DlRaGbl.exe
  2⤵
  PID:7752
- C:\Windows\System\BtCigyq.exe
  C:\Windows\System\BtCigyq.exe
  2⤵
  PID:7872
- C:\Windows\System\BdOCirI.exe
  C:\Windows\System\BdOCirI.exe
  2⤵
  PID:8200
- C:\Windows\System\wPOZybT.exe
  C:\Windows\System\wPOZybT.exe
  2⤵
  PID:8216
- C:\Windows\System\XHSnvIR.exe
  C:\Windows\System\XHSnvIR.exe
  2⤵
  PID:8232
- C:\Windows\System\AIrWOqT.exe
  C:\Windows\System\AIrWOqT.exe
  2⤵
  PID:8248
- C:\Windows\System\AXtjIbW.exe
  C:\Windows\System\AXtjIbW.exe
  2⤵
  PID:8264
- C:\Windows\System\nzLorxu.exe
  C:\Windows\System\nzLorxu.exe
  2⤵
  PID:8280
- C:\Windows\System\JpGHVtZ.exe
  C:\Windows\System\JpGHVtZ.exe
  2⤵
  PID:8296
- C:\Windows\System\BBITdWp.exe
  C:\Windows\System\BBITdWp.exe
  2⤵
  PID:8312
- C:\Windows\System\EyNwdKD.exe
  C:\Windows\System\EyNwdKD.exe
  2⤵
  PID:8328
- C:\Windows\System\kaXdNGT.exe
  C:\Windows\System\kaXdNGT.exe
  2⤵
  PID:8344
- C:\Windows\System\FGnZvNh.exe
  C:\Windows\System\FGnZvNh.exe
  2⤵
  PID:8360
- C:\Windows\System\BJSkkOx.exe
  C:\Windows\System\BJSkkOx.exe
  2⤵
  PID:8376
- C:\Windows\System\XWWqxUs.exe
  C:\Windows\System\XWWqxUs.exe
  2⤵
  PID:8392
- C:\Windows\System\EDgjyIa.exe
  C:\Windows\System\EDgjyIa.exe
  2⤵
  PID:8412
- C:\Windows\System\LXuwNcv.exe
  C:\Windows\System\LXuwNcv.exe
  2⤵
  PID:8428
- C:\Windows\System\bHhlESN.exe
  C:\Windows\System\bHhlESN.exe
  2⤵
  PID:8444
- C:\Windows\System\TKggFBR.exe
  C:\Windows\System\TKggFBR.exe
  2⤵
  PID:8460
- C:\Windows\System\PCiTKWC.exe
  C:\Windows\System\PCiTKWC.exe
  2⤵
  PID:8476
- C:\Windows\System\coZdHJt.exe
  C:\Windows\System\coZdHJt.exe
  2⤵
  PID:8492
- C:\Windows\System\LaIPrEA.exe
  C:\Windows\System\LaIPrEA.exe
  2⤵
  PID:8508
- C:\Windows\System\oMUeOOy.exe
  C:\Windows\System\oMUeOOy.exe
  2⤵
  PID:8528
- C:\Windows\System\ycKBsxQ.exe
  C:\Windows\System\ycKBsxQ.exe
  2⤵
  PID:8544
- C:\Windows\System\icTnXwP.exe
  C:\Windows\System\icTnXwP.exe
  2⤵
  PID:8560
- C:\Windows\System\hAKdcYq.exe
  C:\Windows\System\hAKdcYq.exe
  2⤵
  PID:8576
- C:\Windows\System\ufkUPXm.exe
  C:\Windows\System\ufkUPXm.exe
  2⤵
  PID:8592
- C:\Windows\System\RZxSLZK.exe
  C:\Windows\System\RZxSLZK.exe
  2⤵
  PID:8608
- C:\Windows\System\itBzKcu.exe
  C:\Windows\System\itBzKcu.exe
  2⤵
  PID:8624
- C:\Windows\System\wwoRinS.exe
  C:\Windows\System\wwoRinS.exe
  2⤵
  PID:8640
- C:\Windows\System\XINZZSM.exe
  C:\Windows\System\XINZZSM.exe
  2⤵
  PID:8656
- C:\Windows\System\ajCjlqv.exe
  C:\Windows\System\ajCjlqv.exe
  2⤵
  PID:8672
- C:\Windows\System\DcTvMdm.exe
  C:\Windows\System\DcTvMdm.exe
  2⤵
  PID:8688
- C:\Windows\System\ZTOkefQ.exe
  C:\Windows\System\ZTOkefQ.exe
  2⤵
  PID:8704
- C:\Windows\System\gpvrGao.exe
  C:\Windows\System\gpvrGao.exe
  2⤵
  PID:8720
- C:\Windows\System\ZdsRSrm.exe
  C:\Windows\System\ZdsRSrm.exe
  2⤵
  PID:8736
- C:\Windows\System\FOCQtaL.exe
  C:\Windows\System\FOCQtaL.exe
  2⤵
  PID:8752
- C:\Windows\System\rjHywTc.exe
  C:\Windows\System\rjHywTc.exe
  2⤵
  PID:8768
- C:\Windows\System\EPuXkWJ.exe
  C:\Windows\System\EPuXkWJ.exe
  2⤵
  PID:8784
- C:\Windows\System\vLGKjAm.exe
  C:\Windows\System\vLGKjAm.exe
  2⤵
  PID:8800
- C:\Windows\System\snRtKFu.exe
  C:\Windows\System\snRtKFu.exe
  2⤵
  PID:8816
- C:\Windows\System\TJCQeeW.exe
  C:\Windows\System\TJCQeeW.exe
  2⤵
  PID:8832
- C:\Windows\System\DcJnOPX.exe
  C:\Windows\System\DcJnOPX.exe
  2⤵
  PID:8848
- C:\Windows\System\JtdrhwX.exe
  C:\Windows\System\JtdrhwX.exe
  2⤵
  PID:8864
- C:\Windows\System\XtrDVag.exe
  C:\Windows\System\XtrDVag.exe
  2⤵
  PID:8880
- C:\Windows\System\OyoTmIT.exe
  C:\Windows\System\OyoTmIT.exe
  2⤵
  PID:8896
- C:\Windows\System\PehVhvJ.exe
  C:\Windows\System\PehVhvJ.exe
  2⤵
  PID:8912
- C:\Windows\System\GTZQWxK.exe
  C:\Windows\System\GTZQWxK.exe
  2⤵
  PID:8928
- C:\Windows\System\bnDkTpI.exe
  C:\Windows\System\bnDkTpI.exe
  2⤵
  PID:8944
- C:\Windows\System\VoxLtBN.exe
  C:\Windows\System\VoxLtBN.exe
  2⤵
  PID:8960
- C:\Windows\System\thsurqU.exe
  C:\Windows\System\thsurqU.exe
  2⤵
  PID:8976
- C:\Windows\System\uCbpyGp.exe
  C:\Windows\System\uCbpyGp.exe
  2⤵
  PID:8992
- C:\Windows\System\huYdUwx.exe
  C:\Windows\System\huYdUwx.exe
  2⤵
  PID:9008
- C:\Windows\System\qCrlNkC.exe
  C:\Windows\System\qCrlNkC.exe
  2⤵
  PID:9024
- C:\Windows\System\WvEFbqJ.exe
  C:\Windows\System\WvEFbqJ.exe
  2⤵
  PID:9040
- C:\Windows\System\oDoJCZD.exe
  C:\Windows\System\oDoJCZD.exe
  2⤵
  PID:9056
- C:\Windows\System\hXhiKcj.exe
  C:\Windows\System\hXhiKcj.exe
  2⤵
  PID:9072
- C:\Windows\System\MCrMJsH.exe
  C:\Windows\System\MCrMJsH.exe
  2⤵
  PID:9088
- C:\Windows\System\SBQdcmQ.exe
  C:\Windows\System\SBQdcmQ.exe
  2⤵
  PID:9104
- C:\Windows\System\XWliLMN.exe
  C:\Windows\System\XWliLMN.exe
  2⤵
  PID:9124
- C:\Windows\System\dbYHjUR.exe
  C:\Windows\System\dbYHjUR.exe
  2⤵
  PID:9140
- C:\Windows\System\uBPblHG.exe
  C:\Windows\System\uBPblHG.exe
  2⤵
  PID:9156
- C:\Windows\System\VBbGyRG.exe
  C:\Windows\System\VBbGyRG.exe
  2⤵
  PID:9172
- C:\Windows\System\DYlJYnb.exe
  C:\Windows\System\DYlJYnb.exe
  2⤵
  PID:9188
- C:\Windows\System\JTiyDkm.exe
  C:\Windows\System\JTiyDkm.exe
  2⤵
  PID:9204
- C:\Windows\System\NktmUPk.exe
  C:\Windows\System\NktmUPk.exe
  2⤵
  PID:7564
- C:\Windows\System\rtKgQOH.exe
  C:\Windows\System\rtKgQOH.exe
  2⤵
  PID:8196
- C:\Windows\System\WHdGJke.exe
  C:\Windows\System\WHdGJke.exe
  2⤵
  PID:8224
- C:\Windows\System\IxwLnFn.exe
  C:\Windows\System\IxwLnFn.exe
  2⤵
  PID:8292
- C:\Windows\System\RqQCoNB.exe
  C:\Windows\System\RqQCoNB.exe
  2⤵
  PID:7580
- C:\Windows\System\MubwbkQ.exe
  C:\Windows\System\MubwbkQ.exe
  2⤵
  PID:2860
- C:\Windows\System\VGfVMSW.exe
  C:\Windows\System\VGfVMSW.exe
  2⤵
  PID:8356
- C:\Windows\System\iDYTSYV.exe
  C:\Windows\System\iDYTSYV.exe
  2⤵
  PID:7892
- C:\Windows\System\TrplUVf.exe
  C:\Windows\System\TrplUVf.exe
  2⤵
  PID:8240
- C:\Windows\System\mjXHJwc.exe
  C:\Windows\System\mjXHJwc.exe
  2⤵
  PID:8304
- C:\Windows\System\wZsbKBu.exe
  C:\Windows\System\wZsbKBu.exe
  2⤵
  PID:8336
- C:\Windows\System\BEaBNVN.exe
  C:\Windows\System\BEaBNVN.exe
  2⤵
  PID:8340
- C:\Windows\System\BSXCNKw.exe
  C:\Windows\System\BSXCNKw.exe
  2⤵
  PID:7844
- C:\Windows\System\EqtttPA.exe
  C:\Windows\System\EqtttPA.exe
  2⤵
  PID:7196
- C:\Windows\System\wrUMZcH.exe
  C:\Windows\System\wrUMZcH.exe
  2⤵
  PID:7496
- C:\Windows\System\PEzvjcC.exe
  C:\Windows\System\PEzvjcC.exe
  2⤵
  PID:7312
- C:\Windows\System\KzqgyGU.exe
  C:\Windows\System\KzqgyGU.exe
  2⤵
  PID:7380
- C:\Windows\System\JKDXMBl.exe
  C:\Windows\System\JKDXMBl.exe
  2⤵
  PID:8424
- C:\Windows\System\rPSmxlB.exe
  C:\Windows\System\rPSmxlB.exe
  2⤵
  PID:8524
- C:\Windows\System\BlNtSWg.exe
  C:\Windows\System\BlNtSWg.exe
  2⤵
  PID:8556
- C:\Windows\System\GvlWWjh.exe
  C:\Windows\System\GvlWWjh.exe
  2⤵
  PID:8620
- C:\Windows\System\Rcdftoi.exe
  C:\Windows\System\Rcdftoi.exe
  2⤵
  PID:8436
- C:\Windows\System\sgVvTDU.exe
  C:\Windows\System\sgVvTDU.exe
  2⤵
  PID:8568
- C:\Windows\System\MXsOXxQ.exe
  C:\Windows\System\MXsOXxQ.exe
  2⤵
  PID:8632
- C:\Windows\System\ZPolCxG.exe
  C:\Windows\System\ZPolCxG.exe
  2⤵
  PID:8572
- C:\Windows\System\dalyioZ.exe
  C:\Windows\System\dalyioZ.exe
  2⤵
  PID:8500
- C:\Windows\System\tqHPqSZ.exe
  C:\Windows\System\tqHPqSZ.exe
  2⤵
  PID:8744
- C:\Windows\System\mebCSSq.exe
  C:\Windows\System\mebCSSq.exe
  2⤵
  PID:8776
- C:\Windows\System\pfgmiBz.exe
  C:\Windows\System\pfgmiBz.exe
  2⤵
  PID:8840
- C:\Windows\System\CMQKxqb.exe
  C:\Windows\System\CMQKxqb.exe
  2⤵
  PID:8904
- C:\Windows\System\noBTgnK.exe
  C:\Windows\System\noBTgnK.exe
  2⤵
  PID:8860
- C:\Windows\System\KuyRITa.exe
  C:\Windows\System\KuyRITa.exe
  2⤵
  PID:8796
- C:\Windows\System\FoSosIR.exe
  C:\Windows\System\FoSosIR.exe
  2⤵
  PID:8940
- C:\Windows\System\kYGFCOC.exe
  C:\Windows\System\kYGFCOC.exe
  2⤵
  PID:8924
- C:\Windows\System\VNOEYKt.exe
  C:\Windows\System\VNOEYKt.exe
  2⤵
  PID:8824
- C:\Windows\System\hMPXpUI.exe
  C:\Windows\System\hMPXpUI.exe
  2⤵
  PID:9000
- C:\Windows\System\etuKtrB.exe
  C:\Windows\System\etuKtrB.exe
  2⤵
  PID:9032
- C:\Windows\System\wdKxdyl.exe
  C:\Windows\System\wdKxdyl.exe
  2⤵
  PID:9052
- C:\Windows\System\ySNpHtt.exe
  C:\Windows\System\ySNpHtt.exe
  2⤵
  PID:9048
- C:\Windows\System\RijRHXW.exe
  C:\Windows\System\RijRHXW.exe
  2⤵
  PID:9116
- C:\Windows\System\MviFfPU.exe
  C:\Windows\System\MviFfPU.exe
  2⤵
  PID:9168
- C:\Windows\System\YzeBrri.exe
  C:\Windows\System\YzeBrri.exe
  2⤵
  PID:9184
- C:\Windows\System\WbbGHvA.exe
  C:\Windows\System\WbbGHvA.exe
  2⤵
  PID:7768
- C:\Windows\System\zHcXoBb.exe
  C:\Windows\System\zHcXoBb.exe
  2⤵
  PID:7992
- C:\Windows\System\GBuRvuz.exe
  C:\Windows\System\GBuRvuz.exe
  2⤵
  PID:8276
- C:\Windows\System\HKPOZrB.exe
  C:\Windows\System\HKPOZrB.exe
  2⤵
  PID:8208
- C:\Windows\System\SkxWCvx.exe
  C:\Windows\System\SkxWCvx.exe
  2⤵
  PID:8320
- C:\Windows\System\Xraurum.exe
  C:\Windows\System\Xraurum.exe
  2⤵
  PID:8156
- C:\Windows\System\FsXLwNK.exe
  C:\Windows\System\FsXLwNK.exe
  2⤵
  PID:8372
- C:\Windows\System\BlQilKb.exe
  C:\Windows\System\BlQilKb.exe
  2⤵
  PID:8172
- C:\Windows\System\kryuaaY.exe
  C:\Windows\System\kryuaaY.exe
  2⤵
  PID:8420
- C:\Windows\System\RfUtnyr.exe
  C:\Windows\System\RfUtnyr.exe
  2⤵
  PID:8680
- C:\Windows\System\TaaCijp.exe
  C:\Windows\System\TaaCijp.exe
  2⤵
  PID:8716
- C:\Windows\System\TJTssLz.exe
  C:\Windows\System\TJTssLz.exe
  2⤵
  PID:8876
- C:\Windows\System\MnYVwAf.exe
  C:\Windows\System\MnYVwAf.exe
  2⤵
  PID:8972
- C:\Windows\System\XYWYLgZ.exe
  C:\Windows\System\XYWYLgZ.exe
  2⤵
  PID:9064
- C:\Windows\System\QJkTcnA.exe
  C:\Windows\System\QJkTcnA.exe
  2⤵
  PID:8600
- C:\Windows\System\pdxjkJM.exe
  C:\Windows\System\pdxjkJM.exe
  2⤵
  PID:8488
- C:\Windows\System\YaMlXFS.exe
  C:\Windows\System\YaMlXFS.exe
  2⤵
  PID:8712
- C:\Windows\System\RnSLleD.exe
  C:\Windows\System\RnSLleD.exe
  2⤵
  PID:8892
- C:\Windows\System\vhbEhkc.exe
  C:\Windows\System\vhbEhkc.exe
  2⤵
  PID:9068
- C:\Windows\System\fuNqyTh.exe
  C:\Windows\System\fuNqyTh.exe
  2⤵
  PID:9180
- C:\Windows\System\Anohbvr.exe
  C:\Windows\System\Anohbvr.exe
  2⤵
  PID:7788
- C:\Windows\System\tkAlGqh.exe
  C:\Windows\System\tkAlGqh.exe
  2⤵
  PID:8352
- C:\Windows\System\STWnjMr.exe
  C:\Windows\System\STWnjMr.exe
  2⤵
  PID:9080
- C:\Windows\System\IPTMCaF.exe
  C:\Windows\System\IPTMCaF.exe
  2⤵
  PID:8136
- C:\Windows\System\ZkKrDsi.exe
  C:\Windows\System\ZkKrDsi.exe
  2⤵
  PID:7928
- C:\Windows\System\bkpALck.exe
  C:\Windows\System\bkpALck.exe
  2⤵
  PID:7792
- C:\Windows\System\ZjtADlx.exe
  C:\Windows\System\ZjtADlx.exe
  2⤵
  PID:8872
- C:\Windows\System\VCvayjb.exe
  C:\Windows\System\VCvayjb.exe
  2⤵
  PID:8808
- C:\Windows\System\mhrJXsE.exe
  C:\Windows\System\mhrJXsE.exe
  2⤵
  PID:8952
- C:\Windows\System\LsLblAq.exe
  C:\Windows\System\LsLblAq.exe
  2⤵
  PID:8760
- C:\Windows\System\HVUkNvh.exe
  C:\Windows\System\HVUkNvh.exe
  2⤵
  PID:9020
- C:\Windows\System\GrwtfHA.exe
  C:\Windows\System\GrwtfHA.exe
  2⤵
  PID:7948
- C:\Windows\System\CqLHyaZ.exe
  C:\Windows\System\CqLHyaZ.exe
  2⤵
  PID:8404
- C:\Windows\System\WMgyWgm.exe
  C:\Windows\System\WMgyWgm.exe
  2⤵
  PID:7968
- C:\Windows\System\YKUUiiV.exe
  C:\Windows\System\YKUUiiV.exe
  2⤵
  PID:8636
- C:\Windows\System\amJtsEp.exe
  C:\Windows\System\amJtsEp.exe
  2⤵
  PID:8652
- C:\Windows\System\EpQNucz.exe
  C:\Windows\System\EpQNucz.exe
  2⤵
  PID:8764
- C:\Windows\System\dkQzPhg.exe
  C:\Windows\System\dkQzPhg.exe
  2⤵
  PID:9212
- C:\Windows\System\ChhJXdO.exe
  C:\Windows\System\ChhJXdO.exe
  2⤵
  PID:7208
- C:\Windows\System\OCVNVev.exe
  C:\Windows\System\OCVNVev.exe
  2⤵
  PID:8400
- C:\Windows\System\ARrKMuP.exe
  C:\Windows\System\ARrKMuP.exe
  2⤵
  PID:1516
- C:\Windows\System\YHsTRdD.exe
  C:\Windows\System\YHsTRdD.exe
  2⤵
  PID:9240
- C:\Windows\System\EOyAduv.exe
  C:\Windows\System\EOyAduv.exe
  2⤵
  PID:9256
- C:\Windows\System\PQJDrTX.exe
  C:\Windows\System\PQJDrTX.exe
  2⤵
  PID:9276
- C:\Windows\System\MfTecuf.exe
  C:\Windows\System\MfTecuf.exe
  2⤵
  PID:9292
- C:\Windows\System\qWCMBnf.exe
  C:\Windows\System\qWCMBnf.exe
  2⤵
  PID:9308
- C:\Windows\System\DzQzURT.exe
  C:\Windows\System\DzQzURT.exe
  2⤵
  PID:9324
- C:\Windows\System\mvpnzlO.exe
  C:\Windows\System\mvpnzlO.exe
  2⤵
  PID:9340
- C:\Windows\System\iRgHguI.exe
  C:\Windows\System\iRgHguI.exe
  2⤵
  PID:9356
- C:\Windows\System\CUaGdQf.exe
  C:\Windows\System\CUaGdQf.exe
  2⤵
  PID:9372
- C:\Windows\System\tsQDake.exe
  C:\Windows\System\tsQDake.exe
  2⤵
  PID:9388
- C:\Windows\System\nBRBldL.exe
  C:\Windows\System\nBRBldL.exe
  2⤵
  PID:9404
- C:\Windows\System\DIInLKb.exe
  C:\Windows\System\DIInLKb.exe
  2⤵
  PID:9420
- C:\Windows\System\EeWWGps.exe
  C:\Windows\System\EeWWGps.exe
  2⤵
  PID:9540
- C:\Windows\System\WFdnRHW.exe
  C:\Windows\System\WFdnRHW.exe
  2⤵
  PID:9684
- C:\Windows\System\PigwLeb.exe
  C:\Windows\System\PigwLeb.exe
  2⤵
  PID:9772
- C:\Windows\System\eamIZnN.exe
  C:\Windows\System\eamIZnN.exe
  2⤵
  PID:9804
- C:\Windows\System\ujGDIVu.exe
  C:\Windows\System\ujGDIVu.exe
  2⤵
  PID:9820
- C:\Windows\System\EltPzHE.exe
  C:\Windows\System\EltPzHE.exe
  2⤵
  PID:9836
- C:\Windows\System\CPPnFoK.exe
  C:\Windows\System\CPPnFoK.exe
  2⤵
  PID:9856
- C:\Windows\System\NTPjYbz.exe
  C:\Windows\System\NTPjYbz.exe
  2⤵
  PID:9872
- C:\Windows\System\upKoaZx.exe
  C:\Windows\System\upKoaZx.exe
  2⤵
  PID:9888
- C:\Windows\System\KyUHoSa.exe
  C:\Windows\System\KyUHoSa.exe
  2⤵
  PID:9904
- C:\Windows\System\dIgrdJj.exe
  C:\Windows\System\dIgrdJj.exe
  2⤵
  PID:9920
- C:\Windows\System\oJEeNsV.exe
  C:\Windows\System\oJEeNsV.exe
  2⤵
  PID:9936
- C:\Windows\System\JNXFTzy.exe
  C:\Windows\System\JNXFTzy.exe
  2⤵
  PID:9952
- C:\Windows\System\hdbHhuS.exe
  C:\Windows\System\hdbHhuS.exe
  2⤵
  PID:9968
- C:\Windows\System\bqbOIqa.exe
  C:\Windows\System\bqbOIqa.exe
  2⤵
  PID:9996
- C:\Windows\System\JIZOrFV.exe
  C:\Windows\System\JIZOrFV.exe
  2⤵
  PID:10012
- C:\Windows\System\HqtqxvX.exe
  C:\Windows\System\HqtqxvX.exe
  2⤵
  PID:10028
- C:\Windows\System\RwHReji.exe
  C:\Windows\System\RwHReji.exe
  2⤵
  PID:10044
- C:\Windows\System\ogpbATZ.exe
  C:\Windows\System\ogpbATZ.exe
  2⤵
  PID:10060
- C:\Windows\System\EqrBIpH.exe
  C:\Windows\System\EqrBIpH.exe
  2⤵
  PID:10116
- C:\Windows\System\LiapdWu.exe
  C:\Windows\System\LiapdWu.exe
  2⤵
  PID:10132
- C:\Windows\System\uNtugiH.exe
  C:\Windows\System\uNtugiH.exe
  2⤵
  PID:10148
- C:\Windows\System\eAnAvSC.exe
  C:\Windows\System\eAnAvSC.exe
  2⤵
  PID:10164
- C:\Windows\System\GpdVInB.exe
  C:\Windows\System\GpdVInB.exe
  2⤵
  PID:10180
- C:\Windows\System\cIYipMZ.exe
  C:\Windows\System\cIYipMZ.exe
  2⤵
  PID:10196
- C:\Windows\System\clDoRrt.exe
  C:\Windows\System\clDoRrt.exe
  2⤵
  PID:10216
- C:\Windows\System\uEJgZsC.exe
  C:\Windows\System\uEJgZsC.exe
  2⤵
  PID:10232
- C:\Windows\System\lWaBPoP.exe
  C:\Windows\System\lWaBPoP.exe
  2⤵
  PID:9232
- C:\Windows\System\dvWshPK.exe
  C:\Windows\System\dvWshPK.exe
  2⤵
  PID:9304
- C:\Windows\System\XjLsGZY.exe
  C:\Windows\System\XjLsGZY.exe
  2⤵
  PID:9224
- C:\Windows\System\OvSIezB.exe
  C:\Windows\System\OvSIezB.exe
  2⤵
  PID:9396
- C:\Windows\System\oIkFYzJ.exe
  C:\Windows\System\oIkFYzJ.exe
  2⤵
  PID:8408
- C:\Windows\System\pwNMWwn.exe
  C:\Windows\System\pwNMWwn.exe
  2⤵
  PID:9320
- C:\Windows\System\EbWyZHa.exe
  C:\Windows\System\EbWyZHa.exe
  2⤵
  PID:9288
- C:\Windows\System\YxnFZCB.exe
  C:\Windows\System\YxnFZCB.exe
  2⤵
  PID:9384
- C:\Windows\System\Jhuzkzu.exe
  C:\Windows\System\Jhuzkzu.exe
  2⤵
  PID:9456
- C:\Windows\System\CPTPKGb.exe
  C:\Windows\System\CPTPKGb.exe
  2⤵
  PID:9476
- C:\Windows\System\pPWrgdn.exe
  C:\Windows\System\pPWrgdn.exe
  2⤵
  PID:9488
- C:\Windows\System\LXNpndK.exe
  C:\Windows\System\LXNpndK.exe
  2⤵
  PID:9508
- C:\Windows\System\meYNuqJ.exe
  C:\Windows\System\meYNuqJ.exe
  2⤵
  PID:9536
- C:\Windows\System\qvpqAEG.exe
  C:\Windows\System\qvpqAEG.exe
  2⤵
  PID:9560
- C:\Windows\System\MpiFNEj.exe
  C:\Windows\System\MpiFNEj.exe
  2⤵
  PID:9572
- C:\Windows\System\HtSnNPK.exe
  C:\Windows\System\HtSnNPK.exe
  2⤵
  PID:9588
- C:\Windows\System\ZGMYBSk.exe
  C:\Windows\System\ZGMYBSk.exe
  2⤵
  PID:9608
- C:\Windows\System\cosVjFj.exe
  C:\Windows\System\cosVjFj.exe
  2⤵
  PID:9624
- C:\Windows\System\XQROpsZ.exe
  C:\Windows\System\XQROpsZ.exe
  2⤵
  PID:9632
- C:\Windows\System\CyUXnoS.exe
  C:\Windows\System\CyUXnoS.exe
  2⤵
  PID:9660
- C:\Windows\System\DOFqLkQ.exe
  C:\Windows\System\DOFqLkQ.exe
  2⤵
  PID:9672
- C:\Windows\System\qSddLXk.exe
  C:\Windows\System\qSddLXk.exe
  2⤵
  PID:9700
- C:\Windows\System\zDKPvSt.exe
  C:\Windows\System\zDKPvSt.exe
  2⤵
  PID:9716
- C:\Windows\System\iUUAffU.exe
  C:\Windows\System\iUUAffU.exe
  2⤵
  PID:9740
- C:\Windows\System\PsfExHC.exe
  C:\Windows\System\PsfExHC.exe
  2⤵
  PID:9736
- C:\Windows\System\QiVfePW.exe
  C:\Windows\System\QiVfePW.exe
  2⤵
  PID:9768
- C:\Windows\System\ZFHjKFo.exe
  C:\Windows\System\ZFHjKFo.exe
  2⤵
  PID:9852
- C:\Windows\System\rxXwoWg.exe
  C:\Windows\System\rxXwoWg.exe
  2⤵
  PID:9916
- C:\Windows\System\cJifyyI.exe
  C:\Windows\System\cJifyyI.exe
  2⤵
  PID:9980
- C:\Windows\System\CXjiEuc.exe
  C:\Windows\System\CXjiEuc.exe
  2⤵
  PID:10020
- C:\Windows\System\CoaPaHk.exe
  C:\Windows\System\CoaPaHk.exe
  2⤵
  PID:10056
- C:\Windows\System\rzZkErh.exe
  C:\Windows\System\rzZkErh.exe
  2⤵
  PID:10004
- C:\Windows\System\IfrrMRL.exe
  C:\Windows\System\IfrrMRL.exe
  2⤵
  PID:10076
- C:\Windows\System\DPjonog.exe
  C:\Windows\System\DPjonog.exe
  2⤵
  PID:10128
- C:\Windows\System\YkFsYPz.exe
  C:\Windows\System\YkFsYPz.exe
  2⤵
  PID:10188
- C:\Windows\System\QjQmQjj.exe
  C:\Windows\System\QjQmQjj.exe
  2⤵
  PID:9272
- C:\Windows\System\jbXqkUC.exe
  C:\Windows\System\jbXqkUC.exe
  2⤵
  PID:9832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\APrrvub.exe

Filesize
2.2MB

MD5
4b8740a512d349359bc08c2cd585c791

SHA1
faf049e7ac05a7f34716992ad3807b14a6bab4cd

SHA256
6a35005fd3b6553e5801acb8a859b9cc78d710420732d882de6350de967fdc6a

SHA512
9f9056feeb42761cbe9a31181ee475d651527c0e778796369a0eb2e249d8b670f75ce6763ecb5afce173b926fb44d7045f75cee58db51f311f8027b2512e575c

Download Submit
C:\Windows\system\BWuXmiz.exe

Filesize
2.2MB

MD5
db7d4e0cb9a6e5f6b666608d8c2b9907

SHA1
acbeb4c5d45bd84ca01eb015745d8fdec5df98e0

SHA256
104dce4f9fdd0d77a5f325c47466e2d1af038c94ed4f62b9e9d8fb24e1945f4f

SHA512
406934b8a9e14d75b7baeb7fbf4e229143d6cb5aa3b2b16d696037889ebd50370cd896b0039ddd264fc2b9926d2fe0e5d99aa603bdb7ec75f99a871bb33a9540

Download Submit
C:\Windows\system\BuRDTKo.exe

Filesize
2.2MB

MD5
4f1d5ae79e93157e0539b278e19e62be

SHA1
333c85ca3b8a6bc2e75dbfbc0a82fe6f03914830

SHA256
bb905af1970e19814d91987a7e8e9c82fca028c5690a8e3273548f2ea7903d06

SHA512
49134427ab02b6a2965f253d63179206520a2cca519bfdb887f31edbd0cb86d948f665faa7bc1eeca0ee3ece0945e1d2c8fddbb621d52d05a5f4e65af09879cd

Download Submit
C:\Windows\system\KrThdik.exe

Filesize
2.2MB

MD5
a58dc27e59336a7f835929a6655dd4f5

SHA1
7ad1e76bd09cf786dfb7b4e69e86bf5b2c8c3c27

SHA256
2c4a98517727953ece019df731af2ade32883bcf48a9195cc8b43c90fb0a9753

SHA512
cb8c67d7bfed1864b82968eb851245ba95c1bffc3e8c64bccc9a90b97ec47154e4541bc81f6c058650b0b854c8968b5fb41f5559d892e6be901fbf2fec1d1e1e

Download Submit
C:\Windows\system\MPwFJyO.exe

Filesize
2.2MB

MD5
8ff13f8d8c20d02032db8c1e646306de

SHA1
10ba59276034840033b705fbdf04bed1b44f844c

SHA256
10d23e18ac72967dbfed941fccd0df4d741976976ffe91c6197693907a37e0b9

SHA512
feeb9f2c56952860bddd7cfa9f80571f8f2b7b45c0b75698a007013c5189a5a5ebf01255a84629dfe1719fac41434e0eaa89852efdfcc762f60d394da87f6e1f

Download Submit
C:\Windows\system\TqKpJdY.exe

Filesize
2.2MB

MD5
fd5a73152a70a9038c0e83f618500754

SHA1
fcfc902591a7c51bdfebf7bdd4d233130cd94f68

SHA256
5b74850298f20c08693a35b20dc92e1f99b48d6c7a318a5f12d65a90417def24

SHA512
aaed4f96c3fa3b555da0f2ae34dd52bd647119a6b1d68e0a7021922b11d956206827cf4fa7bf10d23f2fde8a6144144851d24e72a7f15322f73f61a1a6ad86b2

Download Submit
C:\Windows\system\aiPMxOA.exe

Filesize
2.2MB

MD5
9edf722f11b4acafeb0e72c3f6d1464b

SHA1
d98e6d02a30821ccba45c8b2bb43ce2654135bf9

SHA256
61e6b1a174dc2784338cf0c44e4fea712fa08819598a5fe8f5dcc3851522056a

SHA512
9892e4b0a0b9a4ea2fd96b2a663a0b55da97d65caaa3da2778308496a7fd104aea4a59ffe9dcad4eabd3b2a6e62722a4965abc0ea5ff6b52104440bd42adff8c

Download Submit
C:\Windows\system\bUhxvfO.exe

Filesize
2.2MB

MD5
41431b879e2dc635c49b7f159a6f2ddb

SHA1
9f5d2b262cb39bd2e6fe67a7578436a65a13e47c

SHA256
7f445a8e13c5e1dd20398daa7f707da3c1c91da2a2e12b75dcdd97adc760a79b

SHA512
497c1a4982a6115ec13231792c05c97e15528afde2e75fe8d91b642baab0e9d6d29d85b5ccbc0bd4d211da759d87f5035fa3b673b4be689e7eefbb4be3e13a1c

Download Submit
C:\Windows\system\jTmTKas.exe

Filesize
2.2MB

MD5
a759ef387934696ffd8e92a209b96b91

SHA1
1b3ca7bdb3e266693c97d1242d6194b77d10a6cb

SHA256
b0c0c663ff183444b36f5a64a36b0601755b03b9008de64c5b1d98e917775acc

SHA512
155b977bfda9a7961dbf58d4237b3100acc3f9978b99d6295018510326c365488213f884a00523a7106c0b888128a49c84998c901a6b38bf31c4031e577f164f

Download Submit
C:\Windows\system\jvMHwDQ.exe

Filesize
2.2MB

MD5
b5e118801d67a33b91a5089493a5fb57

SHA1
1cce4e5045d361ef8bd6076c00eac4c13b8735ec

SHA256
302fe8731f53ccfe4f99ee2d7d68730a9cf477f5af7ed7a31ae0479caaf984b9

SHA512
bcb37ea3fbcc522a73798a0eeaacde056b2b908fba0c80836494ed6ddc1b6956da942d53b91ba701d92e012757f57c0ba27518d973217d6a7b6bf67e44cdf90d

Download Submit
C:\Windows\system\qoGnwDl.exe

Filesize
2.2MB

MD5
6de3afaaad7ff48a491b0d10c50afec2

SHA1
0910547fd0ff091efa723be007f1c584290040bb

SHA256
7ef03c8f219c4ff997ed206cd22aeec29948f32aeb1626b865fc254c60e40188

SHA512
f60bcd00c5e8ff8e1de2dd0211869c45f05237d35e4735f26caccd73098899eb4463db2d0a0a89101b6691073840292126c2264dae141c69d0ff45f279b1afc9

Download Submit
C:\Windows\system\tCRBzKh.exe

Filesize
2.2MB

MD5
9dad4fac2efb26b5f199f505de3906bc

SHA1
ee974233b132695134bedc913660194500918457

SHA256
64a10abdabba7f30d6aac3d0fac84ebabf2677d165c8cf26ecaa114c861ed190

SHA512
d17c78c5b5757ba7f8cbd5401c04a12c01f6fe877daffe5a26e8703886864a7cb2f1b73573ea4158d91b13ddea2ce1c8355201d9a2138e8f0ca0d886723415cf

Download Submit
C:\Windows\system\vEnTkGZ.exe

Filesize
2.2MB

MD5
7955d1d2a1e78ee7082f0947d1b6ccbc

SHA1
680e564f5d31d4630a00c299715260308e54159b

SHA256
a6ab3e56fb8e4289d5ee8845fc9a5696e1748e247525e55ffe761b6edebb76e9

SHA512
351c36c426dfd6a0c4817d2b0a9e759157069c72308183c0a9ba897700bc0dcf0496f39aca0f5ccb1073df4b5f90f87799775f5ceaa9d8827f70c88cfcc18861

Download Submit
C:\Windows\system\vvfaElX.exe

Filesize
2.2MB

MD5
1ad5f2aacb72e60b3cd3534cf25b65bf

SHA1
00045fd560663b1a0e720e5212880c5ba779c346

SHA256
9b45ae9d901ee926407f18907eb08fd81179f86a8c11e2a1e3c956e50dcaa4c4

SHA512
ab8d784d94375322b6c342a8d40afa1433944bdef7f3ec43cb3fcd3d3968993d5649bf26e8dce5916645654b12eb5643b5cd3ee03dfd2164cb11681a626b4dd3

Download Submit
C:\Windows\system\vwOblHq.exe

Filesize
2.2MB

MD5
c044c3018e39143c6e1ac443fb0abb9b

SHA1
fd79c6f9629b64a4f7cf8a4ccb0bbfa0b547e3a2

SHA256
81f05e85e84282bec09eafae7a3be57d1c5230308784aa83a544fd18bbe00365

SHA512
bb605b6fdb612285ddafb198a0185631d7cfe0119f8d4991b882dcd13e15e3bbfd83f32dd4bb55b568f9a695ecf3d12c04d8c953dc505486032e4a37f60441d8

Download Submit
C:\Windows\system\wsSBqLj.exe

Filesize
2.2MB

MD5
0bdce68e76abcdefca282eca818ac35d

SHA1
1752e9edf74af9fe1e2a6b35ec6ad288b518d7bf

SHA256
16b6b49fdeeedc7cc34d16c0012674d368913fc4bc4ebda3d090dabf9fab62dd

SHA512
a0d7f33f884b588dc06fcd844d65a04c536210128ede673578359b8759828669086e6bd3552206d56a416fe44ebbfbaf083323dae09484abdde7992d690d116e

Download Submit
C:\Windows\system\yGSJfVo.exe

Filesize
2.2MB

MD5
56ccc17127d1ab1c581ffc47f5dc9f1d

SHA1
28825214b7f955133f04769e801a1a041f1377c1

SHA256
81bbdecc928e420ddf2c59ac262ba1840593c8e014010edbc803041d1bb180b4

SHA512
572a5c8aaa45502c3c01be8649296bee938519cedfbbe3042a6839ff6c1f48ed526632357c6b71a880d23e8c69482e645c3aa860606d62be587d41eb9d195c30

Download Submit
C:\Windows\system\ykLTPEp.exe

Filesize
2.2MB

MD5
eb74015943222598d070bb9285c74bad

SHA1
3637334dbfede590bb682b643286ca3fb63c18e1

SHA256
5b9dc40b7e8906bb0d0f9d5383613d8cdbb13b8cee89c9d22bbcf5cea999a1f7

SHA512
7a0f215ade77ce40fc2b25ea279af6e2a67737cf294164d92fd2fa5b37c473d368428b8c89d2d615ba4934a9f4cf56af88826303ae66108f1cb46df10ab949e5

Download Submit
\Windows\system\MMgNvtt.exe

Filesize
2.2MB

MD5
f659c837173e4ec26b740557fad932f4

SHA1
0ba07193505f8232d5e05db954c79585d12b0c30

SHA256
5459ab4d23880fc3371360998f74b6ef999c54f565f9b6f9650a8ee5df018f90

SHA512
110439959a9637f5b1424877c559ca9e9b42130faaea3c9801801c670e061f98428295194d76851268ccdc0666978c86f8399a6e793da138028265dd9035b782

Download Submit
\Windows\system\RYsOkLr.exe

Filesize
2.2MB

MD5
acff8a1dbf16816768b2f38661fe87c4

SHA1
3fc8f478e97e8382179105a70473b4a7b295648d

SHA256
8b52fa243eb59512225bf02f34f0e19d13bddbe333ca1b2aa4c5606bf6fe0487

SHA512
84b63aebcfa3e63d271703eb72745f9faa48fee7fc8abacb91aa076b2b4fb3ecdb920c36202ca715faaec3a791546e4d7ec594bd7de0f3a4aa2f858a5b7a8086

Download Submit
\Windows\system\UJeWkAL.exe

Filesize
2.2MB

MD5
168f9f38a31f38d0914d7d5fa46eb57e

SHA1
404e8a710a28c306b58928899d45d34bf0a50347

SHA256
595463ef3ad5126a0254f60a13ed3e2da7a34600a58c7de9ab5cfdb4fa5ba0b1

SHA512
7afd7d946c26873db3e5eb46656186e5ec58764cb7c7166fcdf5b06f36fbdd514c2eba8c5961ea4e1bbd5bae5878afb0dd0c414854dec10322f49e1256f10803

Download Submit
\Windows\system\XbITjVg.exe

Filesize
2.2MB

MD5
66453de3b3a53d8f32eba2ad223cab62

SHA1
8429656e72f7e08ffa3b7a10ec3200445d085006

SHA256
eb19f7adda366ef99ce7704e00e00eac5b3638b19cd65bf0d28b7b6ca3a93239

SHA512
f033b5cecb3e51b9650c12cd5e226f92cf3b0d5e7878809cb62cfb1b48cce189d5a6c359719dc5410478358fecd6308fd9c84efb6b931a58724330f24e06548a

Download Submit
\Windows\system\gKnncie.exe

Filesize
2.2MB

MD5
d6af8d2b87c5d40ce7bf61a0efbb27fa

SHA1
5f000e9be4d298373aa969d4ce2da6d20cfb14b2

SHA256
50cd5be957cf226e4ffa8d0cfbec2a05b9acdb696822f53a82e5add0aacddd36

SHA512
9407bb4560b745a23d44fdd30552016f7c1282f1b226e9e3940450d8abfa803339e28a09191cfac9ba3198a0f52c75f71f0a4443d20073b26047f153bb6c9f24

Download Submit
\Windows\system\iwBDYfZ.exe

Filesize
2.2MB

MD5
4821a8064ea74ff8d90ec8e0f0a15f0a

SHA1
30c6f9226bca1be99db4abcc8286dbb7c935b0dc

SHA256
cf7488db03a9707246b6afe9a8334b130745e8111f0962a08ccda47393e523ee

SHA512
a71c8d2053869f6e2d45d26cb4e30b08d1fa7b86948f09a19eab7a9eb1599c0f84365cf0066d77d71b211e78232775fdab7c29556256b008c0cf2c50278664f4

Download Submit
\Windows\system\jWNQHXO.exe

Filesize
2.2MB

MD5
c3762a0a3fa1491798bd00e2aeb7701e

SHA1
ace0e1e2a60c978f9a4c95b84d050b1582a65c42

SHA256
23cb34320c34718527181da56d46da2456c6109a9bf395fb6d1096f7baec6aab

SHA512
cf6ed891b61c711f6ca90b7dc15eef079eedfd5f83543d87cfd91eec381f7f5b4fd267fbcdc13843b05442c75f8f5bd4f0f406d1941ba588beb860df3a2d51c7

Download Submit
\Windows\system\jiXYdqF.exe

Filesize
2.2MB

MD5
89b9edff9dc8befa0208e9d37ab0b75d

SHA1
f732319ed2a0c929a159ccbf44238f42ecef9885

SHA256
f51017462724fc9fc35e880a2f7f762e2d88e9761cff3111ecfab99f4b1482b9

SHA512
5af65af931fcbdcec0a16d6ca1e7ef2d8c340e04b6d4bb913d7375f5f16e8d80f6794f44b448c157e25831d3f7bfccbb1b55b77fa9a6e180211031353f1d5fd6

Download Submit
\Windows\system\jvbvIgO.exe

Filesize
2.2MB

MD5
9fdbf7a9f0faae37a844f4ad39a218dc

SHA1
41628ac5b229845f5481b900946144bb4f948f29

SHA256
211b8ad746384af49ad5904aea8c15bedf2c6307717f2bb0f758eb984aac3c1b

SHA512
928943ae4f7ed1f30de88252f8bdf40391ca98fd4110c6f154c404d2ce845b14e486d9ced9448792885a04731aca202137ebfe272a2f4ccc4b2407c04f5be501

Download Submit
\Windows\system\nYxdwLz.exe

Filesize
2.2MB

MD5
5753859df641bd3ca29a5b4e7b989358

SHA1
5646ea7996f31345f3cbd132ef7fbf585beeb697

SHA256
cd34a9d02bd61b049469d6651c0d2f1b6954197252c5949943d155db4934f5c1

SHA512
2c40598fc48621be0defc8320c7ae84c02a254cdf02d90223330c49dc36dfd2be4778157d255953bf875833bd537823b8970b3dc8d6bd51ed2e4f15e9279c65c

Download Submit
\Windows\system\nsEASmG.exe

Filesize
2.2MB

MD5
602f27fefa38ff9d9c1b780968959bb3

SHA1
5fdb8426d0bb6160140350620ecc43aa26760f5c

SHA256
b4231d4c2a3333c4bb1b0b86df09f4bbed2ebfc2754376dc3fc668aa889264e8

SHA512
a18864ff39b014efd575e9a772b1f2696db551f4ce64e6bd06883874c924ad9cbb0f503049e4082fc79aa88d99bb5dbebdc1f94e604720e833aa8fba48845d4e

Download Submit
\Windows\system\pnnfGIh.exe

Filesize
2.2MB

MD5
f944d1dd9d80a520e72bfabdea3888bc

SHA1
fe378d49f451f4f0ae937969d7c2889600b5b28c

SHA256
947a5d5ede6d440341fbea0cb0867e9862fa8704e1b970bc8ef4e23008348680

SHA512
daf74a3574f3add66db6c0600034f7879862533b39599430590db7f49a821f1c23962f594b0d4f60544ec400b8cfb3bc4c8c0d84625a2ce6d255b2d7952de0e7

Download Submit
\Windows\system\quXlGlO.exe

Filesize
2.2MB

MD5
e835660d97921a616f5062c07aefc135

SHA1
aa63cb5c5494529744bef64a829ae45c3ebad737

SHA256
558709faf3b5bb8660b21e95efbb4ccf90cbe272a7cfa9610cbcad2b0d582fd9

SHA512
f77af8507577a29a0dc15ad66856116e0849b5db2a520364bf99b759f956727b34a008fdc636218942670fdb9d165917311e9059a89ea2945c01c62e84fd18c8

Download Submit
\Windows\system\zfzKGRk.exe

Filesize
2.2MB

MD5
e28ef299e4b714d71acf54360b73e38a

SHA1
b717286ea81dbcb38500848663e7179eba1a758d

SHA256
4cf376c71af329aa561a9a28467f29c118ec9746fef48cb2e6696e717a78a331

SHA512
fec2484f72f61c2f85247873fad566932251a22d2e8ea454c7005ef793b5ba3071b8cc7dd457d7bdab354720a23c1ccdb7bf3b609c1c3d22963e62e6e1839333

Download Submit
memory/1588-92-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/1752-99-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/1888-102-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/1888-100-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1888-83-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/1888-88-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/1888-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1888-94-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1888-12-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/1888-96-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/1888-97-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/1888-89-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1888-98-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/1888-0-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/1888-85-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2420-82-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2448-84-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2456-95-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2548-91-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-13-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2708-87-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2900-117-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

Filesize
9.6MB

Download
memory/2900-93-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download
memory/2900-79-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download
memory/2900-14-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download
memory/2900-78-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

Filesize
9.6MB

Download
memory/2900-37-0x000000001B7D0000-0x000000001BAB2000-memory.dmp

Filesize
2.9MB

Download
memory/2900-101-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

Filesize
9.6MB

Download
memory/2900-46-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download