xmrig | 6b9dc8abde1a811ace4a219770a5370190c42d96cfcb54e08533009c7904621a

Analysis

max time kernel
34s
max time network
34s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
Size

1.9MB
MD5

058f662496114544a10d9377ee0b7224
SHA1

568bfd16f185aab8baa66b9103ad3fdb835dc737
SHA256

6b9dc8abde1a811ace4a219770a5370190c42d96cfcb54e08533009c7904621a
SHA512

a816ebad037f7cdeacd6dcac51319e2eb6038c580e2ea9a247c3e56ed2fca21e35db5cb14a9ef1a12c1b687cbef6f87722a56cfce190460345fa206c9d4ef80c
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1v:NABQ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2544-23-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/2704-102-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2492-98-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/2608-96-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2624-94-0x000000013FA40000-0x000000013FE32000-memory.dmp	xmrig
behavioral1/memory/2820-93-0x00000000030B0000-0x00000000034A2000-memory.dmp	xmrig
behavioral1/memory/2728-92-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2560-88-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/2192-82-0x000000013F260000-0x000000013F652000-memory.dmp	xmrig
behavioral1/memory/2648-56-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2544	eWNLpsp.exe
2648	yqxBwDy.exe
2704	aDoSWZI.exe
2192	TWobcFw.exe
2560	pQCBKfj.exe
2728	amXkXHe.exe
2624	APoXQdn.exe
2608	TokKplS.exe
2492	ogFaVCO.exe
2432	hfMTsfg.exe
2556	QhaofXF.exe
2252	QsJeKpv.exe
768	GUVEaXi.exe
2236	HOmxSGK.exe
820	eQHMEgQ.exe
2348	yXiwZyg.exe
1020	YpmccsT.exe
2004	yuDPkZQ.exe
2044	QxgOJba.exe
1632	YZMssTi.exe
692	pqdOOyF.exe
448	GQuUOlP.exe
592	KthRECY.exe
2336	tYHVYmZ.exe
284	JKeJASz.exe
2388	fOAIVKN.exe
2800	ykCnXuS.exe
1636	RhFsHvl.exe
1104	vwnsFCQ.exe
1324	dNgiJOI.exe
2664	mrguwem.exe
2228	GvObEOW.exe
2392	kADcmxL.exe
3040	qiVNZab.exe
2972	hWDMjpB.exe
2976	DZVhQNh.exe
1044	jvzzrlJ.exe
1784	vtICVys.exe
860	iazXjCJ.exe
972	hYBPZwL.exe
776	DcvNEDe.exe
1972	SlyogvH.exe
1816	bvoFnUw.exe
1792	ksuxAdP.exe
1016	ftxWSeE.exe
2056	HTwCnsw.exe
3036	ybKVZDV.exe
2080	HDLWjcL.exe
1736	UTBZfiW.exe
1548	LlXFyjJ.exe
3056	kDJTknP.exe
2904	KJpRbYp.exe
788	eLwmeCt.exe
1756	qdNqNGa.exe
1456	HgKcNgT.exe
1688	EEZhiPS.exe
2408	tJAdOru.exe
2824	vahUeVO.exe
1608	otgHmyY.exe
1604	ciBxzpB.exe
2988	WkvZfBm.exe
2580	qdHixnW.exe
2672	BYzzLNp.exe
2720	RVDEUWC.exe

Loads dropped DLL 64 IoCs

pid	Process
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2820-0-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/files/0x000c00000001225d-7.dat	upx
behavioral1/files/0x0016000000005586-12.dat	upx
behavioral1/files/0x0009000000016122-24.dat	upx
behavioral1/files/0x00070000000164ec-32.dat	upx
behavioral1/memory/2544-23-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/files/0x0007000000016575-36.dat	upx
behavioral1/files/0x0006000000016d31-48.dat	upx
behavioral1/files/0x0006000000016d81-50.dat	upx
behavioral1/files/0x0006000000016d29-44.dat	upx
behavioral1/files/0x0008000000016d21-40.dat	upx
behavioral1/files/0x00070000000161ee-20.dat	upx
behavioral1/files/0x00070000000163eb-28.dat	upx
behavioral1/files/0x0031000000015d9c-110.dat	upx
behavioral1/files/0x000600000001737e-115.dat	upx
behavioral1/files/0x000600000001745d-139.dat	upx
behavioral1/files/0x000500000001877f-167.dat	upx
behavioral1/files/0x00060000000190b3-171.dat	upx
behavioral1/files/0x0005000000018674-163.dat	upx
behavioral1/files/0x000d00000001865b-159.dat	upx
behavioral1/files/0x000600000001864a-155.dat	upx
behavioral1/files/0x000600000001748d-148.dat	upx
behavioral1/files/0x0006000000017510-151.dat	upx
behavioral1/files/0x00060000000173df-131.dat	upx
behavioral1/files/0x0006000000017472-143.dat	upx
behavioral1/files/0x00060000000173e7-135.dat	upx
behavioral1/files/0x00060000000173dc-128.dat	upx
behavioral1/files/0x00060000000173c5-123.dat	upx
behavioral1/files/0x000600000001738c-119.dat	upx
behavioral1/files/0x0006000000016e56-107.dat	upx
behavioral1/files/0x0006000000016d85-106.dat	upx
behavioral1/files/0x000600000001737b-103.dat	upx
behavioral1/memory/2704-102-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/2492-98-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/2608-96-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2624-94-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/memory/2728-92-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2560-88-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/memory/2192-82-0x000000013F260000-0x000000013F652000-memory.dmp	upx
behavioral1/files/0x0006000000016f7e-81.dat	upx
behavioral1/files/0x0006000000016da9-80.dat	upx
behavioral1/memory/2648-56-0x000000013F090000-0x000000013F482000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LzHyZvm.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\fRUaenY.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\AxdcySh.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\pjTSDoi.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\uLePqBi.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\qeLjmaH.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\DcvNEDe.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\wfWLmtI.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\XwCCEEu.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\iXbHWbA.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\wAzhnnK.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\jxVwWGw.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\EEZhiPS.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\HBqOFCB.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\YtfSuUc.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\zBeAcNh.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\QwiMesw.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\IJXMkqm.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\PAMCYYd.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\NEcNTvZ.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\lVewSUF.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\SJvIquF.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\iJWWGKf.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\mTpHFal.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\zcngIuY.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\vkNpQba.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\bjgSQJi.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\obaDEXT.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\ULpDwEh.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\YYqbcwH.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\iCFdRjX.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\XJjnXQw.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\rjnDsQl.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\RAAOfXG.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\YlhSxhe.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\oEnMZKB.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\JOwCSqw.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\eiJwkQG.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\zaiWzOL.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\rIqkipt.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\aOaWREq.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\xBfMbzT.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\OuzujFy.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\kYCyVKw.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\FYreIbq.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\ZOtKAaH.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\WoNSirb.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\yqxBwDy.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\YeGhhLB.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\CADWATc.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\pqBbpDl.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\xXoiwfE.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\PkaWUyX.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\YZMssTi.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\hORANGl.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\yMSiaGU.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\ypVFBIn.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\uRtZtaX.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\jegkSpU.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\LueJNzB.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\MNKwnVK.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\SWVzTMp.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\eQHMEgQ.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
File created	C:\Windows\System\WUFXGCW.exe	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2892	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
Token: SeDebugPrivilege	2892	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2892	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	29
PID 2820 wrote to memory of 2892	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	29
PID 2820 wrote to memory of 2892	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	29
PID 2820 wrote to memory of 2544	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	30
PID 2820 wrote to memory of 2544	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	30
PID 2820 wrote to memory of 2544	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	30
PID 2820 wrote to memory of 2648	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	31
PID 2820 wrote to memory of 2648	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	31
PID 2820 wrote to memory of 2648	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	31
PID 2820 wrote to memory of 2704	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	32
PID 2820 wrote to memory of 2704	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	32
PID 2820 wrote to memory of 2704	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	32
PID 2820 wrote to memory of 2560	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	33
PID 2820 wrote to memory of 2560	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	33
PID 2820 wrote to memory of 2560	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	33
PID 2820 wrote to memory of 2192	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	34
PID 2820 wrote to memory of 2192	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	34
PID 2820 wrote to memory of 2192	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	34
PID 2820 wrote to memory of 2728	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	35
PID 2820 wrote to memory of 2728	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	35
PID 2820 wrote to memory of 2728	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	35
PID 2820 wrote to memory of 2624	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	36
PID 2820 wrote to memory of 2624	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	36
PID 2820 wrote to memory of 2624	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	36
PID 2820 wrote to memory of 2608	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	37
PID 2820 wrote to memory of 2608	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	37
PID 2820 wrote to memory of 2608	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	37
PID 2820 wrote to memory of 2492	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	38
PID 2820 wrote to memory of 2492	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	38
PID 2820 wrote to memory of 2492	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	38
PID 2820 wrote to memory of 2432	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	39
PID 2820 wrote to memory of 2432	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	39
PID 2820 wrote to memory of 2432	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	39
PID 2820 wrote to memory of 2556	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	40
PID 2820 wrote to memory of 2556	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	40
PID 2820 wrote to memory of 2556	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	40
PID 2820 wrote to memory of 2236	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	41
PID 2820 wrote to memory of 2236	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	41
PID 2820 wrote to memory of 2236	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	41
PID 2820 wrote to memory of 2252	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	42
PID 2820 wrote to memory of 2252	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	42
PID 2820 wrote to memory of 2252	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	42
PID 2820 wrote to memory of 820	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	43
PID 2820 wrote to memory of 820	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	43
PID 2820 wrote to memory of 820	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	43
PID 2820 wrote to memory of 768	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	44
PID 2820 wrote to memory of 768	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	44
PID 2820 wrote to memory of 768	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	44
PID 2820 wrote to memory of 1020	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	45
PID 2820 wrote to memory of 1020	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	45
PID 2820 wrote to memory of 1020	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	45
PID 2820 wrote to memory of 2348	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	46
PID 2820 wrote to memory of 2348	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	46
PID 2820 wrote to memory of 2348	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	46
PID 2820 wrote to memory of 2004	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	47
PID 2820 wrote to memory of 2004	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	47
PID 2820 wrote to memory of 2004	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	47
PID 2820 wrote to memory of 2044	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	48
PID 2820 wrote to memory of 2044	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	48
PID 2820 wrote to memory of 2044	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	48
PID 2820 wrote to memory of 1632	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	49
PID 2820 wrote to memory of 1632	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	49
PID 2820 wrote to memory of 1632	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	49
PID 2820 wrote to memory of 692	2820	058f662496114544a10d9377ee0b7224_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\058f662496114544a10d9377ee0b7224_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\058f662496114544a10d9377ee0b7224_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\System\eWNLpsp.exe
  C:\Windows\System\eWNLpsp.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\yqxBwDy.exe
  C:\Windows\System\yqxBwDy.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\aDoSWZI.exe
  C:\Windows\System\aDoSWZI.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\pQCBKfj.exe
  C:\Windows\System\pQCBKfj.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\TWobcFw.exe
  C:\Windows\System\TWobcFw.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\amXkXHe.exe
  C:\Windows\System\amXkXHe.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\APoXQdn.exe
  C:\Windows\System\APoXQdn.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\TokKplS.exe
  C:\Windows\System\TokKplS.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\ogFaVCO.exe
  C:\Windows\System\ogFaVCO.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\hfMTsfg.exe
  C:\Windows\System\hfMTsfg.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\QhaofXF.exe
  C:\Windows\System\QhaofXF.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\HOmxSGK.exe
  C:\Windows\System\HOmxSGK.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\QsJeKpv.exe
  C:\Windows\System\QsJeKpv.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\eQHMEgQ.exe
  C:\Windows\System\eQHMEgQ.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\GUVEaXi.exe
  C:\Windows\System\GUVEaXi.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\YpmccsT.exe
  C:\Windows\System\YpmccsT.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\yXiwZyg.exe
  C:\Windows\System\yXiwZyg.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\yuDPkZQ.exe
  C:\Windows\System\yuDPkZQ.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\QxgOJba.exe
  C:\Windows\System\QxgOJba.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\YZMssTi.exe
  C:\Windows\System\YZMssTi.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\pqdOOyF.exe
  C:\Windows\System\pqdOOyF.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\GQuUOlP.exe
  C:\Windows\System\GQuUOlP.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\KthRECY.exe
  C:\Windows\System\KthRECY.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\tYHVYmZ.exe
  C:\Windows\System\tYHVYmZ.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\JKeJASz.exe
  C:\Windows\System\JKeJASz.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\fOAIVKN.exe
  C:\Windows\System\fOAIVKN.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\ykCnXuS.exe
  C:\Windows\System\ykCnXuS.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\RhFsHvl.exe
  C:\Windows\System\RhFsHvl.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\vwnsFCQ.exe
  C:\Windows\System\vwnsFCQ.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\dNgiJOI.exe
  C:\Windows\System\dNgiJOI.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\mrguwem.exe
  C:\Windows\System\mrguwem.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\GvObEOW.exe
  C:\Windows\System\GvObEOW.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\kADcmxL.exe
  C:\Windows\System\kADcmxL.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\qiVNZab.exe
  C:\Windows\System\qiVNZab.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\hWDMjpB.exe
  C:\Windows\System\hWDMjpB.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\DZVhQNh.exe
  C:\Windows\System\DZVhQNh.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\jvzzrlJ.exe
  C:\Windows\System\jvzzrlJ.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\vtICVys.exe
  C:\Windows\System\vtICVys.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\iazXjCJ.exe
  C:\Windows\System\iazXjCJ.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\hYBPZwL.exe
  C:\Windows\System\hYBPZwL.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\DcvNEDe.exe
  C:\Windows\System\DcvNEDe.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\SlyogvH.exe
  C:\Windows\System\SlyogvH.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\bvoFnUw.exe
  C:\Windows\System\bvoFnUw.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\ksuxAdP.exe
  C:\Windows\System\ksuxAdP.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\ftxWSeE.exe
  C:\Windows\System\ftxWSeE.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\HTwCnsw.exe
  C:\Windows\System\HTwCnsw.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\ybKVZDV.exe
  C:\Windows\System\ybKVZDV.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\HDLWjcL.exe
  C:\Windows\System\HDLWjcL.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\UTBZfiW.exe
  C:\Windows\System\UTBZfiW.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\LlXFyjJ.exe
  C:\Windows\System\LlXFyjJ.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\kDJTknP.exe
  C:\Windows\System\kDJTknP.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\KJpRbYp.exe
  C:\Windows\System\KJpRbYp.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\eLwmeCt.exe
  C:\Windows\System\eLwmeCt.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\qdNqNGa.exe
  C:\Windows\System\qdNqNGa.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\HgKcNgT.exe
  C:\Windows\System\HgKcNgT.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\EEZhiPS.exe
  C:\Windows\System\EEZhiPS.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\tJAdOru.exe
  C:\Windows\System\tJAdOru.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\vahUeVO.exe
  C:\Windows\System\vahUeVO.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\otgHmyY.exe
  C:\Windows\System\otgHmyY.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\ciBxzpB.exe
  C:\Windows\System\ciBxzpB.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\WkvZfBm.exe
  C:\Windows\System\WkvZfBm.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\qdHixnW.exe
  C:\Windows\System\qdHixnW.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\BYzzLNp.exe
  C:\Windows\System\BYzzLNp.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\RVDEUWC.exe
  C:\Windows\System\RVDEUWC.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\GIVOegH.exe
  C:\Windows\System\GIVOegH.exe
  2⤵
  PID:2876
- C:\Windows\System\UhrOSvd.exe
  C:\Windows\System\UhrOSvd.exe
  2⤵
  PID:2548
- C:\Windows\System\miNkMcy.exe
  C:\Windows\System\miNkMcy.exe
  2⤵
  PID:2468
- C:\Windows\System\NSzuzZQ.exe
  C:\Windows\System\NSzuzZQ.exe
  2⤵
  PID:1660
- C:\Windows\System\gQDbyCN.exe
  C:\Windows\System\gQDbyCN.exe
  2⤵
  PID:312
- C:\Windows\System\fROgBWt.exe
  C:\Windows\System\fROgBWt.exe
  2⤵
  PID:2496
- C:\Windows\System\mQljzMx.exe
  C:\Windows\System\mQljzMx.exe
  2⤵
  PID:2424
- C:\Windows\System\bNSITGy.exe
  C:\Windows\System\bNSITGy.exe
  2⤵
  PID:1256
- C:\Windows\System\fLqvyfq.exe
  C:\Windows\System\fLqvyfq.exe
  2⤵
  PID:404
- C:\Windows\System\KRDDGSU.exe
  C:\Windows\System\KRDDGSU.exe
  2⤵
  PID:1308
- C:\Windows\System\LHYbSqL.exe
  C:\Windows\System\LHYbSqL.exe
  2⤵
  PID:2028
- C:\Windows\System\MjdViMg.exe
  C:\Windows\System\MjdViMg.exe
  2⤵
  PID:488
- C:\Windows\System\QMQWeBH.exe
  C:\Windows\System\QMQWeBH.exe
  2⤵
  PID:600
- C:\Windows\System\QEnVlYA.exe
  C:\Windows\System\QEnVlYA.exe
  2⤵
  PID:384
- C:\Windows\System\IJacXPj.exe
  C:\Windows\System\IJacXPj.exe
  2⤵
  PID:2968
- C:\Windows\System\FYreIbq.exe
  C:\Windows\System\FYreIbq.exe
  2⤵
  PID:2808
- C:\Windows\System\fDWaxJR.exe
  C:\Windows\System\fDWaxJR.exe
  2⤵
  PID:1492
- C:\Windows\System\DocKnJR.exe
  C:\Windows\System\DocKnJR.exe
  2⤵
  PID:108
- C:\Windows\System\VsrYnzw.exe
  C:\Windows\System\VsrYnzw.exe
  2⤵
  PID:712
- C:\Windows\System\SfskaSR.exe
  C:\Windows\System\SfskaSR.exe
  2⤵
  PID:2964
- C:\Windows\System\JSCLEpn.exe
  C:\Windows\System\JSCLEpn.exe
  2⤵
  PID:1532
- C:\Windows\System\MVKarCq.exe
  C:\Windows\System\MVKarCq.exe
  2⤵
  PID:1676
- C:\Windows\System\xqYsYtG.exe
  C:\Windows\System\xqYsYtG.exe
  2⤵
  PID:1616
- C:\Windows\System\UddWMir.exe
  C:\Windows\System\UddWMir.exe
  2⤵
  PID:1216
- C:\Windows\System\cxRNMYS.exe
  C:\Windows\System\cxRNMYS.exe
  2⤵
  PID:1652
- C:\Windows\System\UjTEGhU.exe
  C:\Windows\System\UjTEGhU.exe
  2⤵
  PID:2376
- C:\Windows\System\ZOtKAaH.exe
  C:\Windows\System\ZOtKAaH.exe
  2⤵
  PID:872
- C:\Windows\System\UWunXxw.exe
  C:\Windows\System\UWunXxw.exe
  2⤵
  PID:2812
- C:\Windows\System\ukEWXVu.exe
  C:\Windows\System\ukEWXVu.exe
  2⤵
  PID:1948
- C:\Windows\System\JQOCBec.exe
  C:\Windows\System\JQOCBec.exe
  2⤵
  PID:896
- C:\Windows\System\AuVUQdW.exe
  C:\Windows\System\AuVUQdW.exe
  2⤵
  PID:2324
- C:\Windows\System\hUqOhjZ.exe
  C:\Windows\System\hUqOhjZ.exe
  2⤵
  PID:1600
- C:\Windows\System\PFmFrQp.exe
  C:\Windows\System\PFmFrQp.exe
  2⤵
  PID:1448
- C:\Windows\System\wxjUQKQ.exe
  C:\Windows\System\wxjUQKQ.exe
  2⤵
  PID:2576
- C:\Windows\System\JItFyuw.exe
  C:\Windows\System\JItFyuw.exe
  2⤵
  PID:2568
- C:\Windows\System\aRefVvW.exe
  C:\Windows\System\aRefVvW.exe
  2⤵
  PID:2956
- C:\Windows\System\KKArINq.exe
  C:\Windows\System\KKArINq.exe
  2⤵
  PID:2456
- C:\Windows\System\buvozkY.exe
  C:\Windows\System\buvozkY.exe
  2⤵
  PID:1252
- C:\Windows\System\pYlDNjd.exe
  C:\Windows\System\pYlDNjd.exe
  2⤵
  PID:2040
- C:\Windows\System\BCTZltp.exe
  C:\Windows\System\BCTZltp.exe
  2⤵
  PID:1620
- C:\Windows\System\nNeOmHo.exe
  C:\Windows\System\nNeOmHo.exe
  2⤵
  PID:2656
- C:\Windows\System\pkAFeYG.exe
  C:\Windows\System\pkAFeYG.exe
  2⤵
  PID:1960
- C:\Windows\System\wrJNsmN.exe
  C:\Windows\System\wrJNsmN.exe
  2⤵
  PID:268
- C:\Windows\System\vvTcagP.exe
  C:\Windows\System\vvTcagP.exe
  2⤵
  PID:2788
- C:\Windows\System\qaIQovm.exe
  C:\Windows\System\qaIQovm.exe
  2⤵
  PID:1904
- C:\Windows\System\mjWSJeW.exe
  C:\Windows\System\mjWSJeW.exe
  2⤵
  PID:1140
- C:\Windows\System\bPLaiLi.exe
  C:\Windows\System\bPLaiLi.exe
  2⤵
  PID:1372
- C:\Windows\System\OAzMLhS.exe
  C:\Windows\System\OAzMLhS.exe
  2⤵
  PID:1040
- C:\Windows\System\IOVMHgQ.exe
  C:\Windows\System\IOVMHgQ.exe
  2⤵
  PID:916
- C:\Windows\System\ordaXPA.exe
  C:\Windows\System\ordaXPA.exe
  2⤵
  PID:3000
- C:\Windows\System\NWZYTpa.exe
  C:\Windows\System\NWZYTpa.exe
  2⤵
  PID:996
- C:\Windows\System\IiBvRXx.exe
  C:\Windows\System\IiBvRXx.exe
  2⤵
  PID:2076
- C:\Windows\System\LdPfsMH.exe
  C:\Windows\System\LdPfsMH.exe
  2⤵
  PID:2180
- C:\Windows\System\HNIZWzW.exe
  C:\Windows\System\HNIZWzW.exe
  2⤵
  PID:2464
- C:\Windows\System\jSSGTtM.exe
  C:\Windows\System\jSSGTtM.exe
  2⤵
  PID:2216
- C:\Windows\System\HsrYvcJ.exe
  C:\Windows\System\HsrYvcJ.exe
  2⤵
  PID:2860
- C:\Windows\System\CJxhAak.exe
  C:\Windows\System\CJxhAak.exe
  2⤵
  PID:1444
- C:\Windows\System\SJvIquF.exe
  C:\Windows\System\SJvIquF.exe
  2⤵
  PID:1752
- C:\Windows\System\NJROetk.exe
  C:\Windows\System\NJROetk.exe
  2⤵
  PID:3048
- C:\Windows\System\UUkzFkm.exe
  C:\Windows\System\UUkzFkm.exe
  2⤵
  PID:1984
- C:\Windows\System\dLBtCmp.exe
  C:\Windows\System\dLBtCmp.exe
  2⤵
  PID:636
- C:\Windows\System\SZTRnRU.exe
  C:\Windows\System\SZTRnRU.exe
  2⤵
  PID:1564
- C:\Windows\System\Pugufjq.exe
  C:\Windows\System\Pugufjq.exe
  2⤵
  PID:2776
- C:\Windows\System\CchMVil.exe
  C:\Windows\System\CchMVil.exe
  2⤵
  PID:2552
- C:\Windows\System\orzBXDq.exe
  C:\Windows\System\orzBXDq.exe
  2⤵
  PID:1612
- C:\Windows\System\bQmjSlo.exe
  C:\Windows\System\bQmjSlo.exe
  2⤵
  PID:1692
- C:\Windows\System\KoIDFKH.exe
  C:\Windows\System\KoIDFKH.exe
  2⤵
  PID:2816
- C:\Windows\System\fuglpfj.exe
  C:\Windows\System\fuglpfj.exe
  2⤵
  PID:3080
- C:\Windows\System\eimrKlW.exe
  C:\Windows\System\eimrKlW.exe
  2⤵
  PID:3096
- C:\Windows\System\qZgIHwV.exe
  C:\Windows\System\qZgIHwV.exe
  2⤵
  PID:3112
- C:\Windows\System\ujZmTDf.exe
  C:\Windows\System\ujZmTDf.exe
  2⤵
  PID:3128
- C:\Windows\System\bLNYElC.exe
  C:\Windows\System\bLNYElC.exe
  2⤵
  PID:3144
- C:\Windows\System\LFLbmRS.exe
  C:\Windows\System\LFLbmRS.exe
  2⤵
  PID:3160
- C:\Windows\System\AOgAPyv.exe
  C:\Windows\System\AOgAPyv.exe
  2⤵
  PID:3176
- C:\Windows\System\KQHHmbo.exe
  C:\Windows\System\KQHHmbo.exe
  2⤵
  PID:3192
- C:\Windows\System\caMDiRA.exe
  C:\Windows\System\caMDiRA.exe
  2⤵
  PID:3208
- C:\Windows\System\vBffRrC.exe
  C:\Windows\System\vBffRrC.exe
  2⤵
  PID:3224
- C:\Windows\System\URixNzw.exe
  C:\Windows\System\URixNzw.exe
  2⤵
  PID:3240
- C:\Windows\System\wgaboeW.exe
  C:\Windows\System\wgaboeW.exe
  2⤵
  PID:3256
- C:\Windows\System\iTqBHvj.exe
  C:\Windows\System\iTqBHvj.exe
  2⤵
  PID:3272
- C:\Windows\System\GdWiiTb.exe
  C:\Windows\System\GdWiiTb.exe
  2⤵
  PID:3288
- C:\Windows\System\pWSlZGh.exe
  C:\Windows\System\pWSlZGh.exe
  2⤵
  PID:3304
- C:\Windows\System\KHXvmqI.exe
  C:\Windows\System\KHXvmqI.exe
  2⤵
  PID:3320
- C:\Windows\System\rjnDsQl.exe
  C:\Windows\System\rjnDsQl.exe
  2⤵
  PID:3336
- C:\Windows\System\oqwIlXc.exe
  C:\Windows\System\oqwIlXc.exe
  2⤵
  PID:3352
- C:\Windows\System\vMFrRkW.exe
  C:\Windows\System\vMFrRkW.exe
  2⤵
  PID:3368
- C:\Windows\System\uwdqQIZ.exe
  C:\Windows\System\uwdqQIZ.exe
  2⤵
  PID:3384
- C:\Windows\System\DRHofAR.exe
  C:\Windows\System\DRHofAR.exe
  2⤵
  PID:3400
- C:\Windows\System\GSIEZlX.exe
  C:\Windows\System\GSIEZlX.exe
  2⤵
  PID:3416
- C:\Windows\System\KwXgRJW.exe
  C:\Windows\System\KwXgRJW.exe
  2⤵
  PID:3432
- C:\Windows\System\gjAdbjP.exe
  C:\Windows\System\gjAdbjP.exe
  2⤵
  PID:3448
- C:\Windows\System\JwaoPWA.exe
  C:\Windows\System\JwaoPWA.exe
  2⤵
  PID:3464
- C:\Windows\System\EXzQILP.exe
  C:\Windows\System\EXzQILP.exe
  2⤵
  PID:3480
- C:\Windows\System\CxvgaJt.exe
  C:\Windows\System\CxvgaJt.exe
  2⤵
  PID:3496
- C:\Windows\System\xPKssQE.exe
  C:\Windows\System\xPKssQE.exe
  2⤵
  PID:3512
- C:\Windows\System\XlqiAeA.exe
  C:\Windows\System\XlqiAeA.exe
  2⤵
  PID:3528
- C:\Windows\System\NngxoHZ.exe
  C:\Windows\System\NngxoHZ.exe
  2⤵
  PID:3544
- C:\Windows\System\jsKvFpY.exe
  C:\Windows\System\jsKvFpY.exe
  2⤵
  PID:3560
- C:\Windows\System\FuYuUUC.exe
  C:\Windows\System\FuYuUUC.exe
  2⤵
  PID:3576
- C:\Windows\System\rIqkipt.exe
  C:\Windows\System\rIqkipt.exe
  2⤵
  PID:3592
- C:\Windows\System\WOyPnCm.exe
  C:\Windows\System\WOyPnCm.exe
  2⤵
  PID:3608
- C:\Windows\System\hORANGl.exe
  C:\Windows\System\hORANGl.exe
  2⤵
  PID:3624
- C:\Windows\System\SbXZzcz.exe
  C:\Windows\System\SbXZzcz.exe
  2⤵
  PID:3640
- C:\Windows\System\JjbOLBa.exe
  C:\Windows\System\JjbOLBa.exe
  2⤵
  PID:3656
- C:\Windows\System\EDNOduf.exe
  C:\Windows\System\EDNOduf.exe
  2⤵
  PID:3692
- C:\Windows\System\xrbidTB.exe
  C:\Windows\System\xrbidTB.exe
  2⤵
  PID:3784
- C:\Windows\System\djPJQqC.exe
  C:\Windows\System\djPJQqC.exe
  2⤵
  PID:3804
- C:\Windows\System\zTvaovl.exe
  C:\Windows\System\zTvaovl.exe
  2⤵
  PID:3884
- C:\Windows\System\eGQnEtj.exe
  C:\Windows\System\eGQnEtj.exe
  2⤵
  PID:3908
- C:\Windows\System\ThrVsHa.exe
  C:\Windows\System\ThrVsHa.exe
  2⤵
  PID:3924
- C:\Windows\System\WoKGzyV.exe
  C:\Windows\System\WoKGzyV.exe
  2⤵
  PID:3940
- C:\Windows\System\NdEXJJv.exe
  C:\Windows\System\NdEXJJv.exe
  2⤵
  PID:3960
- C:\Windows\System\aTkOguX.exe
  C:\Windows\System\aTkOguX.exe
  2⤵
  PID:3980
- C:\Windows\System\NtToJxd.exe
  C:\Windows\System\NtToJxd.exe
  2⤵
  PID:4008
- C:\Windows\System\zolRUgN.exe
  C:\Windows\System\zolRUgN.exe
  2⤵
  PID:4028
- C:\Windows\System\bxsnXix.exe
  C:\Windows\System\bxsnXix.exe
  2⤵
  PID:4044
- C:\Windows\System\luDcfMw.exe
  C:\Windows\System\luDcfMw.exe
  2⤵
  PID:4064
- C:\Windows\System\lHTbsEu.exe
  C:\Windows\System\lHTbsEu.exe
  2⤵
  PID:4080
- C:\Windows\System\ytlzgGq.exe
  C:\Windows\System\ytlzgGq.exe
  2⤵
  PID:1404
- C:\Windows\System\qUGUDnc.exe
  C:\Windows\System\qUGUDnc.exe
  2⤵
  PID:2136
- C:\Windows\System\BLhPCxP.exe
  C:\Windows\System\BLhPCxP.exe
  2⤵
  PID:2712
- C:\Windows\System\SICQYGK.exe
  C:\Windows\System\SICQYGK.exe
  2⤵
  PID:3248
- C:\Windows\System\GgHCkJw.exe
  C:\Windows\System\GgHCkJw.exe
  2⤵
  PID:3280
- C:\Windows\System\eDynkrc.exe
  C:\Windows\System\eDynkrc.exe
  2⤵
  PID:3312
- C:\Windows\System\nydWEwA.exe
  C:\Windows\System\nydWEwA.exe
  2⤵
  PID:3344
- C:\Windows\System\NyNXmic.exe
  C:\Windows\System\NyNXmic.exe
  2⤵
  PID:3348
- C:\Windows\System\iOIHvCE.exe
  C:\Windows\System\iOIHvCE.exe
  2⤵
  PID:2484
- C:\Windows\System\WbIobcn.exe
  C:\Windows\System\WbIobcn.exe
  2⤵
  PID:3408
- C:\Windows\System\twpaACW.exe
  C:\Windows\System\twpaACW.exe
  2⤵
  PID:2480
- C:\Windows\System\dGmxoEp.exe
  C:\Windows\System\dGmxoEp.exe
  2⤵
  PID:3472
- C:\Windows\System\mVjuLcn.exe
  C:\Windows\System\mVjuLcn.exe
  2⤵
  PID:3492
- C:\Windows\System\jfUjWUi.exe
  C:\Windows\System\jfUjWUi.exe
  2⤵
  PID:3520
- C:\Windows\System\rzTAIRl.exe
  C:\Windows\System\rzTAIRl.exe
  2⤵
  PID:3536
- C:\Windows\System\rfRJeav.exe
  C:\Windows\System\rfRJeav.exe
  2⤵
  PID:3568
- C:\Windows\System\oAXbTqP.exe
  C:\Windows\System\oAXbTqP.exe
  2⤵
  PID:2532
- C:\Windows\System\HoOUApN.exe
  C:\Windows\System\HoOUApN.exe
  2⤵
  PID:3620
- C:\Windows\System\OETquyX.exe
  C:\Windows\System\OETquyX.exe
  2⤵
  PID:1552
- C:\Windows\System\NzhuJQx.exe
  C:\Windows\System\NzhuJQx.exe
  2⤵
  PID:1096
- C:\Windows\System\ZyMEpys.exe
  C:\Windows\System\ZyMEpys.exe
  2⤵
  PID:3688
- C:\Windows\System\lPlwSGo.exe
  C:\Windows\System\lPlwSGo.exe
  2⤵
  PID:1148
- C:\Windows\System\ztPQeex.exe
  C:\Windows\System\ztPQeex.exe
  2⤵
  PID:1964
- C:\Windows\System\WUFXGCW.exe
  C:\Windows\System\WUFXGCW.exe
  2⤵
  PID:1556
- C:\Windows\System\KgJIdSt.exe
  C:\Windows\System\KgJIdSt.exe
  2⤵
  PID:3776
- C:\Windows\System\jypsdao.exe
  C:\Windows\System\jypsdao.exe
  2⤵
  PID:576
- C:\Windows\System\LcYsOVf.exe
  C:\Windows\System\LcYsOVf.exe
  2⤵
  PID:3812
- C:\Windows\System\SzZRcUE.exe
  C:\Windows\System\SzZRcUE.exe
  2⤵
  PID:3796
- C:\Windows\System\DCUSlOc.exe
  C:\Windows\System\DCUSlOc.exe
  2⤵
  PID:540
- C:\Windows\System\ZxCFejF.exe
  C:\Windows\System\ZxCFejF.exe
  2⤵
  PID:3832
- C:\Windows\System\UBOuXpl.exe
  C:\Windows\System\UBOuXpl.exe
  2⤵
  PID:2692
- C:\Windows\System\FBXOWRm.exe
  C:\Windows\System\FBXOWRm.exe
  2⤵
  PID:2856
- C:\Windows\System\SYOWojN.exe
  C:\Windows\System\SYOWojN.exe
  2⤵
  PID:3856
- C:\Windows\System\ShzCjkV.exe
  C:\Windows\System\ShzCjkV.exe
  2⤵
  PID:3872
- C:\Windows\System\OEWtlyF.exe
  C:\Windows\System\OEWtlyF.exe
  2⤵
  PID:3892
- C:\Windows\System\HdFpaML.exe
  C:\Windows\System\HdFpaML.exe
  2⤵
  PID:3932
- C:\Windows\System\vkNpQba.exe
  C:\Windows\System\vkNpQba.exe
  2⤵
  PID:3976
- C:\Windows\System\AMWUPXc.exe
  C:\Windows\System\AMWUPXc.exe
  2⤵
  PID:3992
- C:\Windows\System\GenEOlg.exe
  C:\Windows\System\GenEOlg.exe
  2⤵
  PID:4036
- C:\Windows\System\aMbhTow.exe
  C:\Windows\System\aMbhTow.exe
  2⤵
  PID:2224
- C:\Windows\System\jGCPURS.exe
  C:\Windows\System\jGCPURS.exe
  2⤵
  PID:4056
- C:\Windows\System\yisnyHq.exe
  C:\Windows\System\yisnyHq.exe
  2⤵
  PID:1880
- C:\Windows\System\kOWjimB.exe
  C:\Windows\System\kOWjimB.exe
  2⤵
  PID:3232
- C:\Windows\System\JqjMApv.exe
  C:\Windows\System\JqjMApv.exe
  2⤵
  PID:3360
- C:\Windows\System\ZvBfPrU.exe
  C:\Windows\System\ZvBfPrU.exe
  2⤵
  PID:3456
- C:\Windows\System\mYyXUGm.exe
  C:\Windows\System\mYyXUGm.exe
  2⤵
  PID:3700
- C:\Windows\System\KBBUUhh.exe
  C:\Windows\System\KBBUUhh.exe
  2⤵
  PID:1952
- C:\Windows\System\RfJHYMz.exe
  C:\Windows\System\RfJHYMz.exe
  2⤵
  PID:2708
- C:\Windows\System\NZzaoZJ.exe
  C:\Windows\System\NZzaoZJ.exe
  2⤵
  PID:3720
- C:\Windows\System\lcsVXWj.exe
  C:\Windows\System\lcsVXWj.exe
  2⤵
  PID:3076
- C:\Windows\System\QHiIXZj.exe
  C:\Windows\System\QHiIXZj.exe
  2⤵
  PID:2652
- C:\Windows\System\glGkzgj.exe
  C:\Windows\System\glGkzgj.exe
  2⤵
  PID:3672
- C:\Windows\System\aOaWREq.exe
  C:\Windows\System\aOaWREq.exe
  2⤵
  PID:2356
- C:\Windows\System\yMSiaGU.exe
  C:\Windows\System\yMSiaGU.exe
  2⤵
  PID:3648
- C:\Windows\System\NutqKZr.exe
  C:\Windows\System\NutqKZr.exe
  2⤵
  PID:1968
- C:\Windows\System\GdLirQy.exe
  C:\Windows\System\GdLirQy.exe
  2⤵
  PID:3136
- C:\Windows\System\zYlkoBV.exe
  C:\Windows\System\zYlkoBV.exe
  2⤵
  PID:2700
- C:\Windows\System\AmqrZmw.exe
  C:\Windows\System\AmqrZmw.exe
  2⤵
  PID:3172
- C:\Windows\System\SxiWInv.exe
  C:\Windows\System\SxiWInv.exe
  2⤵
  PID:2880
- C:\Windows\System\zGTiKMO.exe
  C:\Windows\System\zGTiKMO.exe
  2⤵
  PID:3268
- C:\Windows\System\AbDPXFK.exe
  C:\Windows\System\AbDPXFK.exe
  2⤵
  PID:856
- C:\Windows\System\ZhiWKgy.exe
  C:\Windows\System\ZhiWKgy.exe
  2⤵
  PID:2364
- C:\Windows\System\vzxHRGz.exe
  C:\Windows\System\vzxHRGz.exe
  2⤵
  PID:1800
- C:\Windows\System\maYQRxz.exe
  C:\Windows\System\maYQRxz.exe
  2⤵
  PID:2804
- C:\Windows\System\eWEeCTI.exe
  C:\Windows\System\eWEeCTI.exe
  2⤵
  PID:3844
- C:\Windows\System\xEjlQbr.exe
  C:\Windows\System\xEjlQbr.exe
  2⤵
  PID:3760
- C:\Windows\System\qGhnhkf.exe
  C:\Windows\System\qGhnhkf.exe
  2⤵
  PID:1956
- C:\Windows\System\STepwnn.exe
  C:\Windows\System\STepwnn.exe
  2⤵
  PID:3792
- C:\Windows\System\LzHyZvm.exe
  C:\Windows\System\LzHyZvm.exe
  2⤵
  PID:3712
- C:\Windows\System\esOKeiA.exe
  C:\Windows\System\esOKeiA.exe
  2⤵
  PID:3800
- C:\Windows\System\iRBMrzC.exe
  C:\Windows\System\iRBMrzC.exe
  2⤵
  PID:3900
- C:\Windows\System\WpTXRjd.exe
  C:\Windows\System\WpTXRjd.exe
  2⤵
  PID:3952
- C:\Windows\System\YwQDvjv.exe
  C:\Windows\System\YwQDvjv.exe
  2⤵
  PID:3948
- C:\Windows\System\PRwlcLk.exe
  C:\Windows\System\PRwlcLk.exe
  2⤵
  PID:3880
- C:\Windows\System\DqmOxgD.exe
  C:\Windows\System\DqmOxgD.exe
  2⤵
  PID:4076
- C:\Windows\System\DRrzEhW.exe
  C:\Windows\System\DRrzEhW.exe
  2⤵
  PID:3300
- C:\Windows\System\bjgSQJi.exe
  C:\Windows\System\bjgSQJi.exe
  2⤵
  PID:4000
- C:\Windows\System\dunMUdn.exe
  C:\Windows\System\dunMUdn.exe
  2⤵
  PID:3460
- C:\Windows\System\JIMVYfU.exe
  C:\Windows\System\JIMVYfU.exe
  2⤵
  PID:1872
- C:\Windows\System\PvetIYu.exe
  C:\Windows\System\PvetIYu.exe
  2⤵
  PID:3092
- C:\Windows\System\EuqMnFA.exe
  C:\Windows\System\EuqMnFA.exe
  2⤵
  PID:3772
- C:\Windows\System\zMPZRrL.exe
  C:\Windows\System\zMPZRrL.exe
  2⤵
  PID:2852
- C:\Windows\System\mwaPvSq.exe
  C:\Windows\System\mwaPvSq.exe
  2⤵
  PID:1068
- C:\Windows\System\PPzsmry.exe
  C:\Windows\System\PPzsmry.exe
  2⤵
  PID:3252
- C:\Windows\System\YfGpFvn.exe
  C:\Windows\System\YfGpFvn.exe
  2⤵
  PID:624
- C:\Windows\System\xZKQrju.exe
  C:\Windows\System\xZKQrju.exe
  2⤵
  PID:2360
- C:\Windows\System\WoNSirb.exe
  C:\Windows\System\WoNSirb.exe
  2⤵
  PID:3752
- C:\Windows\System\XVOwDRl.exe
  C:\Windows\System\XVOwDRl.exe
  2⤵
  PID:3488
- C:\Windows\System\OWHTvMp.exe
  C:\Windows\System\OWHTvMp.exe
  2⤵
  PID:2732
- C:\Windows\System\AYVEQBJ.exe
  C:\Windows\System\AYVEQBJ.exe
  2⤵
  PID:3768
- C:\Windows\System\iJWWGKf.exe
  C:\Windows\System\iJWWGKf.exe
  2⤵
  PID:3828
- C:\Windows\System\PcCqqZX.exe
  C:\Windows\System\PcCqqZX.exe
  2⤵
  PID:3716
- C:\Windows\System\NUGONMP.exe
  C:\Windows\System\NUGONMP.exe
  2⤵
  PID:1056
- C:\Windows\System\WssdJBb.exe
  C:\Windows\System\WssdJBb.exe
  2⤵
  PID:3972
- C:\Windows\System\ocOFwGs.exe
  C:\Windows\System\ocOFwGs.exe
  2⤵
  PID:2628
- C:\Windows\System\xHEUgZg.exe
  C:\Windows\System\xHEUgZg.exe
  2⤵
  PID:2452
- C:\Windows\System\kiCtsKf.exe
  C:\Windows\System\kiCtsKf.exe
  2⤵
  PID:3120
- C:\Windows\System\yRwFiNR.exe
  C:\Windows\System\yRwFiNR.exe
  2⤵
  PID:1932
- C:\Windows\System\Zwrhunr.exe
  C:\Windows\System\Zwrhunr.exe
  2⤵
  PID:4072
- C:\Windows\System\BtIWxvj.exe
  C:\Windows\System\BtIWxvj.exe
  2⤵
  PID:3216
- C:\Windows\System\iRDBzXQ.exe
  C:\Windows\System\iRDBzXQ.exe
  2⤵
  PID:3604
- C:\Windows\System\pyoaUYa.exe
  C:\Windows\System\pyoaUYa.exe
  2⤵
  PID:3664
- C:\Windows\System\xwHYDur.exe
  C:\Windows\System\xwHYDur.exe
  2⤵
  PID:1928
- C:\Windows\System\MYGpgvn.exe
  C:\Windows\System\MYGpgvn.exe
  2⤵
  PID:3840
- C:\Windows\System\wXlYovm.exe
  C:\Windows\System\wXlYovm.exe
  2⤵
  PID:2528
- C:\Windows\System\uOSAqha.exe
  C:\Windows\System\uOSAqha.exe
  2⤵
  PID:3988
- C:\Windows\System\Woyhnwb.exe
  C:\Windows\System\Woyhnwb.exe
  2⤵
  PID:1052
- C:\Windows\System\UcBUZrG.exe
  C:\Windows\System\UcBUZrG.exe
  2⤵
  PID:3736
- C:\Windows\System\uMeWdRx.exe
  C:\Windows\System\uMeWdRx.exe
  2⤵
  PID:1656
- C:\Windows\System\bCENpTf.exe
  C:\Windows\System\bCENpTf.exe
  2⤵
  PID:4108
- C:\Windows\System\CUpOsuz.exe
  C:\Windows\System\CUpOsuz.exe
  2⤵
  PID:4124
- C:\Windows\System\TBtpbJe.exe
  C:\Windows\System\TBtpbJe.exe
  2⤵
  PID:4140
- C:\Windows\System\ywbJjBN.exe
  C:\Windows\System\ywbJjBN.exe
  2⤵
  PID:4156
- C:\Windows\System\GMiMVwK.exe
  C:\Windows\System\GMiMVwK.exe
  2⤵
  PID:4172
- C:\Windows\System\NQvImvg.exe
  C:\Windows\System\NQvImvg.exe
  2⤵
  PID:4188
- C:\Windows\System\IwbiTGk.exe
  C:\Windows\System\IwbiTGk.exe
  2⤵
  PID:4204
- C:\Windows\System\fknUpPg.exe
  C:\Windows\System\fknUpPg.exe
  2⤵
  PID:4220
- C:\Windows\System\nDUhABs.exe
  C:\Windows\System\nDUhABs.exe
  2⤵
  PID:4236
- C:\Windows\System\NxvaSzD.exe
  C:\Windows\System\NxvaSzD.exe
  2⤵
  PID:4252
- C:\Windows\System\wfWLmtI.exe
  C:\Windows\System\wfWLmtI.exe
  2⤵
  PID:4268
- C:\Windows\System\SsLxVvO.exe
  C:\Windows\System\SsLxVvO.exe
  2⤵
  PID:4292
- C:\Windows\System\ziVsUcP.exe
  C:\Windows\System\ziVsUcP.exe
  2⤵
  PID:4308
- C:\Windows\System\ABMwUhE.exe
  C:\Windows\System\ABMwUhE.exe
  2⤵
  PID:4324
- C:\Windows\System\szUpZKm.exe
  C:\Windows\System\szUpZKm.exe
  2⤵
  PID:4340
- C:\Windows\System\ypVFBIn.exe
  C:\Windows\System\ypVFBIn.exe
  2⤵
  PID:4356
- C:\Windows\System\JvPYIBB.exe
  C:\Windows\System\JvPYIBB.exe
  2⤵
  PID:4372
- C:\Windows\System\REDiJxC.exe
  C:\Windows\System\REDiJxC.exe
  2⤵
  PID:4388
- C:\Windows\System\ZbJHfFW.exe
  C:\Windows\System\ZbJHfFW.exe
  2⤵
  PID:4404
- C:\Windows\System\REBpIHU.exe
  C:\Windows\System\REBpIHU.exe
  2⤵
  PID:4420
- C:\Windows\System\UbAGoRc.exe
  C:\Windows\System\UbAGoRc.exe
  2⤵
  PID:4436
- C:\Windows\System\CeXvwyF.exe
  C:\Windows\System\CeXvwyF.exe
  2⤵
  PID:4452
- C:\Windows\System\FJnLule.exe
  C:\Windows\System\FJnLule.exe
  2⤵
  PID:4468
- C:\Windows\System\AKPXvbQ.exe
  C:\Windows\System\AKPXvbQ.exe
  2⤵
  PID:4484
- C:\Windows\System\FqqEMYg.exe
  C:\Windows\System\FqqEMYg.exe
  2⤵
  PID:4500
- C:\Windows\System\QPmKZgb.exe
  C:\Windows\System\QPmKZgb.exe
  2⤵
  PID:4516
- C:\Windows\System\ReImEkv.exe
  C:\Windows\System\ReImEkv.exe
  2⤵
  PID:4532
- C:\Windows\System\njSCEBP.exe
  C:\Windows\System\njSCEBP.exe
  2⤵
  PID:4548
- C:\Windows\System\FXuHfIV.exe
  C:\Windows\System\FXuHfIV.exe
  2⤵
  PID:4564
- C:\Windows\System\UueAvyJ.exe
  C:\Windows\System\UueAvyJ.exe
  2⤵
  PID:4580
- C:\Windows\System\CKluejq.exe
  C:\Windows\System\CKluejq.exe
  2⤵
  PID:4596
- C:\Windows\System\XjyHDDc.exe
  C:\Windows\System\XjyHDDc.exe
  2⤵
  PID:4612
- C:\Windows\System\NLRHZSd.exe
  C:\Windows\System\NLRHZSd.exe
  2⤵
  PID:4628
- C:\Windows\System\DRfTubd.exe
  C:\Windows\System\DRfTubd.exe
  2⤵
  PID:4652
- C:\Windows\System\goRAPhp.exe
  C:\Windows\System\goRAPhp.exe
  2⤵
  PID:4668
- C:\Windows\System\KGzOvbv.exe
  C:\Windows\System\KGzOvbv.exe
  2⤵
  PID:4684
- C:\Windows\System\MluiIWg.exe
  C:\Windows\System\MluiIWg.exe
  2⤵
  PID:4700
- C:\Windows\System\pOMDQTG.exe
  C:\Windows\System\pOMDQTG.exe
  2⤵
  PID:4716
- C:\Windows\System\NHTPVMb.exe
  C:\Windows\System\NHTPVMb.exe
  2⤵
  PID:4732
- C:\Windows\System\sjFfQdS.exe
  C:\Windows\System\sjFfQdS.exe
  2⤵
  PID:4748
- C:\Windows\System\vNCqvfw.exe
  C:\Windows\System\vNCqvfw.exe
  2⤵
  PID:4772
- C:\Windows\System\qUocbOo.exe
  C:\Windows\System\qUocbOo.exe
  2⤵
  PID:4796
- C:\Windows\System\hjDzUUC.exe
  C:\Windows\System\hjDzUUC.exe
  2⤵
  PID:4812
- C:\Windows\System\IqxSgHH.exe
  C:\Windows\System\IqxSgHH.exe
  2⤵
  PID:4828
- C:\Windows\System\BOTZhvY.exe
  C:\Windows\System\BOTZhvY.exe
  2⤵
  PID:4844
- C:\Windows\System\zkzWXnx.exe
  C:\Windows\System\zkzWXnx.exe
  2⤵
  PID:4860
- C:\Windows\System\phXvWXR.exe
  C:\Windows\System\phXvWXR.exe
  2⤵
  PID:4880
- C:\Windows\System\WqZPTkR.exe
  C:\Windows\System\WqZPTkR.exe
  2⤵
  PID:4896
- C:\Windows\System\hVhEsSq.exe
  C:\Windows\System\hVhEsSq.exe
  2⤵
  PID:4912
- C:\Windows\System\UGjIzwv.exe
  C:\Windows\System\UGjIzwv.exe
  2⤵
  PID:4932
- C:\Windows\System\HyopSlo.exe
  C:\Windows\System\HyopSlo.exe
  2⤵
  PID:4956
- C:\Windows\System\PNNugIx.exe
  C:\Windows\System\PNNugIx.exe
  2⤵
  PID:4972
- C:\Windows\System\BkCQbss.exe
  C:\Windows\System\BkCQbss.exe
  2⤵
  PID:4988
- C:\Windows\System\xBfMbzT.exe
  C:\Windows\System\xBfMbzT.exe
  2⤵
  PID:5008
- C:\Windows\System\nhvMnhe.exe
  C:\Windows\System\nhvMnhe.exe
  2⤵
  PID:5024
- C:\Windows\System\JKmmQWJ.exe
  C:\Windows\System\JKmmQWJ.exe
  2⤵
  PID:5060
- C:\Windows\System\tFJTsQB.exe
  C:\Windows\System\tFJTsQB.exe
  2⤵
  PID:5084
- C:\Windows\System\ITJEOYC.exe
  C:\Windows\System\ITJEOYC.exe
  2⤵
  PID:5100
- C:\Windows\System\YdtzxNE.exe
  C:\Windows\System\YdtzxNE.exe
  2⤵
  PID:5116
- C:\Windows\System\ntvwxwr.exe
  C:\Windows\System\ntvwxwr.exe
  2⤵
  PID:3852
- C:\Windows\System\tGuWAJi.exe
  C:\Windows\System\tGuWAJi.exe
  2⤵
  PID:3744
- C:\Windows\System\GHyAlqO.exe
  C:\Windows\System\GHyAlqO.exe
  2⤵
  PID:4168
- C:\Windows\System\SqbqQOn.exe
  C:\Windows\System\SqbqQOn.exe
  2⤵
  PID:1584
- C:\Windows\System\yBFJRMF.exe
  C:\Windows\System\yBFJRMF.exe
  2⤵
  PID:3200
- C:\Windows\System\XJmGvLZ.exe
  C:\Windows\System\XJmGvLZ.exe
  2⤵
  PID:3108
- C:\Windows\System\auzBlhQ.exe
  C:\Windows\System\auzBlhQ.exe
  2⤵
  PID:2716
- C:\Windows\System\glpJOqj.exe
  C:\Windows\System\glpJOqj.exe
  2⤵
  PID:2944
- C:\Windows\System\hIqjRlm.exe
  C:\Windows\System\hIqjRlm.exe
  2⤵
  PID:4260
- C:\Windows\System\itCcONV.exe
  C:\Windows\System\itCcONV.exe
  2⤵
  PID:4120
- C:\Windows\System\JbfHJVu.exe
  C:\Windows\System\JbfHJVu.exe
  2⤵
  PID:4184
- C:\Windows\System\IVhStCk.exe
  C:\Windows\System\IVhStCk.exe
  2⤵
  PID:4276
- C:\Windows\System\lHIebQG.exe
  C:\Windows\System\lHIebQG.exe
  2⤵
  PID:4332
- C:\Windows\System\CYuTbni.exe
  C:\Windows\System\CYuTbni.exe
  2⤵
  PID:4400
- C:\Windows\System\ZEergzx.exe
  C:\Windows\System\ZEergzx.exe
  2⤵
  PID:4464
- C:\Windows\System\XeQJFxT.exe
  C:\Windows\System\XeQJFxT.exe
  2⤵
  PID:4560
- C:\Windows\System\EHIJbiM.exe
  C:\Windows\System\EHIJbiM.exe
  2⤵
  PID:4620
- C:\Windows\System\qyJJYle.exe
  C:\Windows\System\qyJJYle.exe
  2⤵
  PID:4636
- C:\Windows\System\MiAWBdC.exe
  C:\Windows\System\MiAWBdC.exe
  2⤵
  PID:4448
- C:\Windows\System\OvSgSEO.exe
  C:\Windows\System\OvSgSEO.exe
  2⤵
  PID:4540
- C:\Windows\System\nyVEsgK.exe
  C:\Windows\System\nyVEsgK.exe
  2⤵
  PID:4576
- C:\Windows\System\XfkILbo.exe
  C:\Windows\System\XfkILbo.exe
  2⤵
  PID:4352
- C:\Windows\System\TczFPuA.exe
  C:\Windows\System\TczFPuA.exe
  2⤵
  PID:4692
- C:\Windows\System\CZtxVpC.exe
  C:\Windows\System\CZtxVpC.exe
  2⤵
  PID:4728
- C:\Windows\System\WoqdDjJ.exe
  C:\Windows\System\WoqdDjJ.exe
  2⤵
  PID:4744
- C:\Windows\System\ICecaVg.exe
  C:\Windows\System\ICecaVg.exe
  2⤵
  PID:4676
- C:\Windows\System\bdJQXUT.exe
  C:\Windows\System\bdJQXUT.exe
  2⤵
  PID:4804
- C:\Windows\System\tKBRbWF.exe
  C:\Windows\System\tKBRbWF.exe
  2⤵
  PID:4868
- C:\Windows\System\pkJkrsl.exe
  C:\Windows\System\pkJkrsl.exe
  2⤵
  PID:4908
- C:\Windows\System\dflMTyG.exe
  C:\Windows\System\dflMTyG.exe
  2⤵
  PID:4944
- C:\Windows\System\DBFBtHj.exe
  C:\Windows\System\DBFBtHj.exe
  2⤵
  PID:4792
- C:\Windows\System\qpwfTYK.exe
  C:\Windows\System\qpwfTYK.exe
  2⤵
  PID:5016
- C:\Windows\System\ZMoLEyR.exe
  C:\Windows\System\ZMoLEyR.exe
  2⤵
  PID:4888
- C:\Windows\System\ORkhIno.exe
  C:\Windows\System\ORkhIno.exe
  2⤵
  PID:4928
- C:\Windows\System\TgpBMMd.exe
  C:\Windows\System\TgpBMMd.exe
  2⤵
  PID:5004
- C:\Windows\System\hcYurAR.exe
  C:\Windows\System\hcYurAR.exe
  2⤵
  PID:5044
- C:\Windows\System\YUxcwPS.exe
  C:\Windows\System\YUxcwPS.exe
  2⤵
  PID:5068
- C:\Windows\System\MVOZDaE.exe
  C:\Windows\System\MVOZDaE.exe
  2⤵
  PID:5080
- C:\Windows\System\NVPeDMu.exe
  C:\Windows\System\NVPeDMu.exe
  2⤵
  PID:964
- C:\Windows\System\THkWmmG.exe
  C:\Windows\System\THkWmmG.exe
  2⤵
  PID:4228
- C:\Windows\System\XrnMTdC.exe
  C:\Windows\System\XrnMTdC.exe
  2⤵
  PID:2012
- C:\Windows\System\QwiMesw.exe
  C:\Windows\System\QwiMesw.exe
  2⤵
  PID:4524
- C:\Windows\System\GqSNdfu.exe
  C:\Windows\System\GqSNdfu.exe
  2⤵
  PID:4528
- C:\Windows\System\DDLCebj.exe
  C:\Windows\System\DDLCebj.exe
  2⤵
  PID:4480
- C:\Windows\System\DnJFxMz.exe
  C:\Windows\System\DnJFxMz.exe
  2⤵
  PID:5124
- C:\Windows\System\XHMrUnE.exe
  C:\Windows\System\XHMrUnE.exe
  2⤵
  PID:5140
- C:\Windows\System\uXjPCav.exe
  C:\Windows\System\uXjPCav.exe
  2⤵
  PID:5156
- C:\Windows\System\qnntZWT.exe
  C:\Windows\System\qnntZWT.exe
  2⤵
  PID:5172
- C:\Windows\System\hjNzWMO.exe
  C:\Windows\System\hjNzWMO.exe
  2⤵
  PID:5188
- C:\Windows\System\OEGiBqm.exe
  C:\Windows\System\OEGiBqm.exe
  2⤵
  PID:5204
- C:\Windows\System\TIjELwb.exe
  C:\Windows\System\TIjELwb.exe
  2⤵
  PID:5220
- C:\Windows\System\PRdxAWd.exe
  C:\Windows\System\PRdxAWd.exe
  2⤵
  PID:5236
- C:\Windows\System\wzllYJG.exe
  C:\Windows\System\wzllYJG.exe
  2⤵
  PID:5252
- C:\Windows\System\KklumLr.exe
  C:\Windows\System\KklumLr.exe
  2⤵
  PID:5268
- C:\Windows\System\cVSkgLQ.exe
  C:\Windows\System\cVSkgLQ.exe
  2⤵
  PID:5284
- C:\Windows\System\XQQIAxQ.exe
  C:\Windows\System\XQQIAxQ.exe
  2⤵
  PID:5300
- C:\Windows\System\JRzakBx.exe
  C:\Windows\System\JRzakBx.exe
  2⤵
  PID:5316
- C:\Windows\System\FjBZWYm.exe
  C:\Windows\System\FjBZWYm.exe
  2⤵
  PID:5332
- C:\Windows\System\zFqNTjE.exe
  C:\Windows\System\zFqNTjE.exe
  2⤵
  PID:5352
- C:\Windows\System\lBkfOUY.exe
  C:\Windows\System\lBkfOUY.exe
  2⤵
  PID:5368
- C:\Windows\System\NiDMkmO.exe
  C:\Windows\System\NiDMkmO.exe
  2⤵
  PID:5384
- C:\Windows\System\quSzRMt.exe
  C:\Windows\System\quSzRMt.exe
  2⤵
  PID:5400
- C:\Windows\System\TQhZzrE.exe
  C:\Windows\System\TQhZzrE.exe
  2⤵
  PID:5416
- C:\Windows\System\qliEGLV.exe
  C:\Windows\System\qliEGLV.exe
  2⤵
  PID:5432
- C:\Windows\System\fRQfBpV.exe
  C:\Windows\System\fRQfBpV.exe
  2⤵
  PID:5448
- C:\Windows\System\IJXMkqm.exe
  C:\Windows\System\IJXMkqm.exe
  2⤵
  PID:5464
- C:\Windows\System\cjxCizC.exe
  C:\Windows\System\cjxCizC.exe
  2⤵
  PID:5480
- C:\Windows\System\hzvwufD.exe
  C:\Windows\System\hzvwufD.exe
  2⤵
  PID:5496
- C:\Windows\System\vpcsvAQ.exe
  C:\Windows\System\vpcsvAQ.exe
  2⤵
  PID:5512
- C:\Windows\System\YeGhhLB.exe
  C:\Windows\System\YeGhhLB.exe
  2⤵
  PID:5528
- C:\Windows\System\GUtoYpw.exe
  C:\Windows\System\GUtoYpw.exe
  2⤵
  PID:5544
- C:\Windows\System\WjvgEjI.exe
  C:\Windows\System\WjvgEjI.exe
  2⤵
  PID:5560
- C:\Windows\System\LigMbxX.exe
  C:\Windows\System\LigMbxX.exe
  2⤵
  PID:5576
- C:\Windows\System\bYyQcru.exe
  C:\Windows\System\bYyQcru.exe
  2⤵
  PID:5592
- C:\Windows\System\nTRxgPG.exe
  C:\Windows\System\nTRxgPG.exe
  2⤵
  PID:5608
- C:\Windows\System\UfFRxrT.exe
  C:\Windows\System\UfFRxrT.exe
  2⤵
  PID:5624
- C:\Windows\System\WJXFHmI.exe
  C:\Windows\System\WJXFHmI.exe
  2⤵
  PID:5640
- C:\Windows\System\XmKDRlI.exe
  C:\Windows\System\XmKDRlI.exe
  2⤵
  PID:5656
- C:\Windows\System\BDzchQL.exe
  C:\Windows\System\BDzchQL.exe
  2⤵
  PID:5672
- C:\Windows\System\VjKbYJr.exe
  C:\Windows\System\VjKbYJr.exe
  2⤵
  PID:5696
- C:\Windows\System\nrQnUXj.exe
  C:\Windows\System\nrQnUXj.exe
  2⤵
  PID:5748
- C:\Windows\System\ZtmmjTc.exe
  C:\Windows\System\ZtmmjTc.exe
  2⤵
  PID:5764
- C:\Windows\System\DJPuiCl.exe
  C:\Windows\System\DJPuiCl.exe
  2⤵
  PID:5780
- C:\Windows\System\osBhthM.exe
  C:\Windows\System\osBhthM.exe
  2⤵
  PID:5808
- C:\Windows\System\pvucKOt.exe
  C:\Windows\System\pvucKOt.exe
  2⤵
  PID:5824
- C:\Windows\System\PYDbyDF.exe
  C:\Windows\System\PYDbyDF.exe
  2⤵
  PID:5840
- C:\Windows\System\VcsBToW.exe
  C:\Windows\System\VcsBToW.exe
  2⤵
  PID:5856
- C:\Windows\System\JOkeDNO.exe
  C:\Windows\System\JOkeDNO.exe
  2⤵
  PID:5872
- C:\Windows\System\NFGRdaT.exe
  C:\Windows\System\NFGRdaT.exe
  2⤵
  PID:5896
- C:\Windows\System\wdaeGyg.exe
  C:\Windows\System\wdaeGyg.exe
  2⤵
  PID:5912
- C:\Windows\System\uRtZtaX.exe
  C:\Windows\System\uRtZtaX.exe
  2⤵
  PID:5928
- C:\Windows\System\BsFgdff.exe
  C:\Windows\System\BsFgdff.exe
  2⤵
  PID:5948
- C:\Windows\System\jOAGuvA.exe
  C:\Windows\System\jOAGuvA.exe
  2⤵
  PID:5964
- C:\Windows\System\MIATFoc.exe
  C:\Windows\System\MIATFoc.exe
  2⤵
  PID:5980
- C:\Windows\System\aHNdrIz.exe
  C:\Windows\System\aHNdrIz.exe
  2⤵
  PID:5996
- C:\Windows\System\FlnPiAi.exe
  C:\Windows\System\FlnPiAi.exe
  2⤵
  PID:6012
- C:\Windows\System\hXpTleL.exe
  C:\Windows\System\hXpTleL.exe
  2⤵
  PID:6028
- C:\Windows\System\HaAMbDz.exe
  C:\Windows\System\HaAMbDz.exe
  2⤵
  PID:6044
- C:\Windows\System\scApOZZ.exe
  C:\Windows\System\scApOZZ.exe
  2⤵
  PID:6060
- C:\Windows\System\nRcmtNv.exe
  C:\Windows\System\nRcmtNv.exe
  2⤵
  PID:6076
- C:\Windows\System\xYSGjsK.exe
  C:\Windows\System\xYSGjsK.exe
  2⤵
  PID:6092
- C:\Windows\System\IsepZeo.exe
  C:\Windows\System\IsepZeo.exe
  2⤵
  PID:6108
- C:\Windows\System\oJcNNja.exe
  C:\Windows\System\oJcNNja.exe
  2⤵
  PID:6124
- C:\Windows\System\hwemZew.exe
  C:\Windows\System\hwemZew.exe
  2⤵
  PID:3704
- C:\Windows\System\pSTsgaK.exe
  C:\Windows\System\pSTsgaK.exe
  2⤵
  PID:4768
- C:\Windows\System\VgHLBeb.exe
  C:\Windows\System\VgHLBeb.exe
  2⤵
  PID:4948
- C:\Windows\System\BfODmaE.exe
  C:\Windows\System\BfODmaE.exe
  2⤵
  PID:4248
- C:\Windows\System\pqBbpDl.exe
  C:\Windows\System\pqBbpDl.exe
  2⤵
  PID:4920
- C:\Windows\System\freAUSI.exe
  C:\Windows\System\freAUSI.exe
  2⤵
  PID:5056
- C:\Windows\System\puCfgLp.exe
  C:\Windows\System\puCfgLp.exe
  2⤵
  PID:5096
- C:\Windows\System\mtQbEIH.exe
  C:\Windows\System\mtQbEIH.exe
  2⤵
  PID:5136
- C:\Windows\System\ophKWze.exe
  C:\Windows\System\ophKWze.exe
  2⤵
  PID:5228
- C:\Windows\System\PSViDOt.exe
  C:\Windows\System\PSViDOt.exe
  2⤵
  PID:5292
- C:\Windows\System\ARSISXA.exe
  C:\Windows\System\ARSISXA.exe
  2⤵
  PID:4592
- C:\Windows\System\QeCykoP.exe
  C:\Windows\System\QeCykoP.exe
  2⤵
  PID:4092
- C:\Windows\System\dtZLocV.exe
  C:\Windows\System\dtZLocV.exe
  2⤵
  PID:4152
- C:\Windows\System\CMXjejD.exe
  C:\Windows\System\CMXjejD.exe
  2⤵
  PID:4432
- C:\Windows\System\hQEyFME.exe
  C:\Windows\System\hQEyFME.exe
  2⤵
  PID:4416
- C:\Windows\System\cWBtrJt.exe
  C:\Windows\System\cWBtrJt.exe
  2⤵
  PID:4660
- C:\Windows\System\hLmiqcl.exe
  C:\Windows\System\hLmiqcl.exe
  2⤵
  PID:4712
- C:\Windows\System\RcFRprh.exe
  C:\Windows\System\RcFRprh.exe
  2⤵
  PID:4984
- C:\Windows\System\ARhdnmH.exe
  C:\Windows\System\ARhdnmH.exe
  2⤵
  PID:4996
- C:\Windows\System\MJcZBaD.exe
  C:\Windows\System\MJcZBaD.exe
  2⤵
  PID:3732
- C:\Windows\System\XwCCEEu.exe
  C:\Windows\System\XwCCEEu.exe
  2⤵
  PID:4368
- C:\Windows\System\MZwaFsx.exe
  C:\Windows\System\MZwaFsx.exe
  2⤵
  PID:5148
- C:\Windows\System\ixeBxjC.exe
  C:\Windows\System\ixeBxjC.exe
  2⤵
  PID:5212
- C:\Windows\System\ueJnysl.exe
  C:\Windows\System\ueJnysl.exe
  2⤵
  PID:5276
- C:\Windows\System\ySfjPtM.exe
  C:\Windows\System\ySfjPtM.exe
  2⤵
  PID:5312
- C:\Windows\System\TOFkCGA.exe
  C:\Windows\System\TOFkCGA.exe
  2⤵
  PID:5392
- C:\Windows\System\soNvSFw.exe
  C:\Windows\System\soNvSFw.exe
  2⤵
  PID:5456
- C:\Windows\System\wpPfMJz.exe
  C:\Windows\System\wpPfMJz.exe
  2⤵
  PID:5520
- C:\Windows\System\EUUqdmj.exe
  C:\Windows\System\EUUqdmj.exe
  2⤵
  PID:5584
- C:\Windows\System\gdJALKW.exe
  C:\Windows\System\gdJALKW.exe
  2⤵
  PID:5648
- C:\Windows\System\AASHjjB.exe
  C:\Windows\System\AASHjjB.exe
  2⤵
  PID:5688
- C:\Windows\System\yCBreGM.exe
  C:\Windows\System\yCBreGM.exe
  2⤵
  PID:5760
- C:\Windows\System\fukBwfP.exe
  C:\Windows\System\fukBwfP.exe
  2⤵
  PID:5380
- C:\Windows\System\WehbVoe.exe
  C:\Windows\System\WehbVoe.exe
  2⤵
  PID:5444
- C:\Windows\System\zEExVej.exe
  C:\Windows\System\zEExVej.exe
  2⤵
  PID:5508
- C:\Windows\System\ndvKjkG.exe
  C:\Windows\System\ndvKjkG.exe
  2⤵
  PID:5572
- C:\Windows\System\MgtqLSZ.exe
  C:\Windows\System\MgtqLSZ.exe
  2⤵
  PID:5664
- C:\Windows\System\USisNWE.exe
  C:\Windows\System\USisNWE.exe
  2⤵
  PID:5708
- C:\Windows\System\aWBecGY.exe
  C:\Windows\System\aWBecGY.exe
  2⤵
  PID:5724
- C:\Windows\System\hNwOPiH.exe
  C:\Windows\System\hNwOPiH.exe
  2⤵
  PID:5740
- C:\Windows\System\MNivIdo.exe
  C:\Windows\System\MNivIdo.exe
  2⤵
  PID:5816
- C:\Windows\System\dZDcelw.exe
  C:\Windows\System\dZDcelw.exe
  2⤵
  PID:2864
- C:\Windows\System\hQFRXSd.exe
  C:\Windows\System\hQFRXSd.exe
  2⤵
  PID:5836
- C:\Windows\System\weecjWB.exe
  C:\Windows\System\weecjWB.exe
  2⤵
  PID:5936
- C:\Windows\System\SDNFyPd.exe
  C:\Windows\System\SDNFyPd.exe
  2⤵
  PID:5920
- C:\Windows\System\fkEoNhj.exe
  C:\Windows\System\fkEoNhj.exe
  2⤵
  PID:5944
- C:\Windows\System\NjioFUb.exe
  C:\Windows\System\NjioFUb.exe
  2⤵
  PID:6036
- C:\Windows\System\rMuuVUW.exe
  C:\Windows\System\rMuuVUW.exe
  2⤵
  PID:5992
- C:\Windows\System\uryxNcw.exe
  C:\Windows\System\uryxNcw.exe
  2⤵
  PID:6068
- C:\Windows\System\OBwTTmX.exe
  C:\Windows\System\OBwTTmX.exe
  2⤵
  PID:6132
- C:\Windows\System\DXnpcJz.exe
  C:\Windows\System\DXnpcJz.exe
  2⤵
  PID:4136
- C:\Windows\System\cWpQRzw.exe
  C:\Windows\System\cWpQRzw.exe
  2⤵
  PID:5200
- C:\Windows\System\dVJUaTM.exe
  C:\Windows\System\dVJUaTM.exe
  2⤵
  PID:4216
- C:\Windows\System\JwoYHTD.exe
  C:\Windows\System\JwoYHTD.exe
  2⤵
  PID:4760
- C:\Windows\System\cwppsJI.exe
  C:\Windows\System\cwppsJI.exe
  2⤵
  PID:5036
- C:\Windows\System\pcVFLWh.exe
  C:\Windows\System\pcVFLWh.exe
  2⤵
  PID:4320
- C:\Windows\System\yjtqynT.exe
  C:\Windows\System\yjtqynT.exe
  2⤵
  PID:3824
- C:\Windows\System\njpiVbL.exe
  C:\Windows\System\njpiVbL.exe
  2⤵
  PID:6056
- C:\Windows\System\tDgzcxR.exe
  C:\Windows\System\tDgzcxR.exe
  2⤵
  PID:6120
- C:\Windows\System\nJhTwKP.exe
  C:\Windows\System\nJhTwKP.exe
  2⤵
  PID:3764
- C:\Windows\System\aJaLeFk.exe
  C:\Windows\System\aJaLeFk.exe
  2⤵
  PID:1644
- C:\Windows\System\mUPcMTq.exe
  C:\Windows\System\mUPcMTq.exe
  2⤵
  PID:5340
- C:\Windows\System\TCmMDNZ.exe
  C:\Windows\System\TCmMDNZ.exe
  2⤵
  PID:5552
- C:\Windows\System\CAuJyvl.exe
  C:\Windows\System\CAuJyvl.exe
  2⤵
  PID:5348
- C:\Windows\System\tKaZMmY.exe
  C:\Windows\System\tKaZMmY.exe
  2⤵
  PID:5600
- C:\Windows\System\azRTQTw.exe
  C:\Windows\System\azRTQTw.exe
  2⤵
  PID:5772
- C:\Windows\System\SnZSfjW.exe
  C:\Windows\System\SnZSfjW.exe
  2⤵
  PID:5832
- C:\Windows\System\WOiKzRM.exe
  C:\Windows\System\WOiKzRM.exe
  2⤵
  PID:5412
- C:\Windows\System\zpQDKtT.exe
  C:\Windows\System\zpQDKtT.exe
  2⤵
  PID:5852
- C:\Windows\System\SPEgpUc.exe
  C:\Windows\System\SPEgpUc.exe
  2⤵
  PID:5892
- C:\Windows\System\xrrxNmL.exe
  C:\Windows\System\xrrxNmL.exe
  2⤵
  PID:5736
- C:\Windows\System\OjCDIzB.exe
  C:\Windows\System\OjCDIzB.exe
  2⤵
  PID:5756
- C:\Windows\System\NQAJMBV.exe
  C:\Windows\System\NQAJMBV.exe
  2⤵
  PID:5620
- C:\Windows\System\AfbRlPO.exe
  C:\Windows\System\AfbRlPO.exe
  2⤵
  PID:5244
- C:\Windows\System\FavTyNQ.exe
  C:\Windows\System\FavTyNQ.exe
  2⤵
  PID:5248
- C:\Windows\System\AZISlYA.exe
  C:\Windows\System\AZISlYA.exe
  2⤵
  PID:5940
- C:\Windows\System\jByvGGI.exe
  C:\Windows\System\jByvGGI.exe
  2⤵
  PID:4836
- C:\Windows\System\sFiRPIK.exe
  C:\Windows\System\sFiRPIK.exe
  2⤵
  PID:4820
- C:\Windows\System\mWuBgkO.exe
  C:\Windows\System\mWuBgkO.exe
  2⤵
  PID:5260
- C:\Windows\System\tgFuYrd.exe
  C:\Windows\System\tgFuYrd.exe
  2⤵
  PID:1856
- C:\Windows\System\xXoiwfE.exe
  C:\Windows\System\xXoiwfE.exe
  2⤵
  PID:5264
- C:\Windows\System\jYluVzD.exe
  C:\Windows\System\jYluVzD.exe
  2⤵
  PID:4856
- C:\Windows\System\ILHzaCz.exe
  C:\Windows\System\ILHzaCz.exe
  2⤵
  PID:5476
- C:\Windows\System\zYtHeVi.exe
  C:\Windows\System\zYtHeVi.exe
  2⤵
  PID:5504
- C:\Windows\System\FnuyQPO.exe
  C:\Windows\System\FnuyQPO.exe
  2⤵
  PID:5888
- C:\Windows\System\UxTVNvA.exe
  C:\Windows\System\UxTVNvA.exe
  2⤵
  PID:4904
- C:\Windows\System\ANdGKql.exe
  C:\Windows\System\ANdGKql.exe
  2⤵
  PID:5884
- C:\Windows\System\BTOarbZ.exe
  C:\Windows\System\BTOarbZ.exe
  2⤵
  PID:5440
- C:\Windows\System\YYLBRWI.exe
  C:\Windows\System\YYLBRWI.exe
  2⤵
  PID:5976
- C:\Windows\System\wRsUviI.exe
  C:\Windows\System\wRsUviI.exe
  2⤵
  PID:5360
- C:\Windows\System\PjRniuN.exe
  C:\Windows\System\PjRniuN.exe
  2⤵
  PID:4572
- C:\Windows\System\CNMjqlV.exe
  C:\Windows\System\CNMjqlV.exe
  2⤵
  PID:5428
- C:\Windows\System\HFyGjqW.exe
  C:\Windows\System\HFyGjqW.exe
  2⤵
  PID:5848
- C:\Windows\System\tUDJpqz.exe
  C:\Windows\System\tUDJpqz.exe
  2⤵
  PID:5052
- C:\Windows\System\eoZHpur.exe
  C:\Windows\System\eoZHpur.exe
  2⤵
  PID:4756
- C:\Windows\System\HXdPCuD.exe
  C:\Windows\System\HXdPCuD.exe
  2⤵
  PID:5492
- C:\Windows\System\yDhVvzX.exe
  C:\Windows\System\yDhVvzX.exe
  2⤵
  PID:5616
- C:\Windows\System\IENZkfD.exe
  C:\Windows\System\IENZkfD.exe
  2⤵
  PID:4724
- C:\Windows\System\obaDEXT.exe
  C:\Windows\System\obaDEXT.exe
  2⤵
  PID:4824
- C:\Windows\System\uZZZKlM.exe
  C:\Windows\System\uZZZKlM.exe
  2⤵
  PID:4604
- C:\Windows\System\dFDTvvr.exe
  C:\Windows\System\dFDTvvr.exe
  2⤵
  PID:6156
- C:\Windows\System\igrwNkT.exe
  C:\Windows\System\igrwNkT.exe
  2⤵
  PID:6172
- C:\Windows\System\bIgorzo.exe
  C:\Windows\System\bIgorzo.exe
  2⤵
  PID:6188
- C:\Windows\System\NjLtwKP.exe
  C:\Windows\System\NjLtwKP.exe
  2⤵
  PID:6204
- C:\Windows\System\GROOPMu.exe
  C:\Windows\System\GROOPMu.exe
  2⤵
  PID:6220
- C:\Windows\System\Igxwsix.exe
  C:\Windows\System\Igxwsix.exe
  2⤵
  PID:6236
- C:\Windows\System\wXIXWXN.exe
  C:\Windows\System\wXIXWXN.exe
  2⤵
  PID:6252
- C:\Windows\System\iEQRTNf.exe
  C:\Windows\System\iEQRTNf.exe
  2⤵
  PID:6268
- C:\Windows\System\QLPvZGm.exe
  C:\Windows\System\QLPvZGm.exe
  2⤵
  PID:6284
- C:\Windows\System\RtnpvDU.exe
  C:\Windows\System\RtnpvDU.exe
  2⤵
  PID:6300
- C:\Windows\System\RMUAoEe.exe
  C:\Windows\System\RMUAoEe.exe
  2⤵
  PID:6316
- C:\Windows\System\mTpHFal.exe
  C:\Windows\System\mTpHFal.exe
  2⤵
  PID:6332
- C:\Windows\System\enXmvnD.exe
  C:\Windows\System\enXmvnD.exe
  2⤵
  PID:6348
- C:\Windows\System\BGOXmcH.exe
  C:\Windows\System\BGOXmcH.exe
  2⤵
  PID:6364
- C:\Windows\System\HVVVNuE.exe
  C:\Windows\System\HVVVNuE.exe
  2⤵
  PID:6380
- C:\Windows\System\gFUaYIa.exe
  C:\Windows\System\gFUaYIa.exe
  2⤵
  PID:6396
- C:\Windows\System\yFDwtIE.exe
  C:\Windows\System\yFDwtIE.exe
  2⤵
  PID:6412
- C:\Windows\System\yVZkhOW.exe
  C:\Windows\System\yVZkhOW.exe
  2⤵
  PID:6428
- C:\Windows\System\XhhFnCJ.exe
  C:\Windows\System\XhhFnCJ.exe
  2⤵
  PID:6444
- C:\Windows\System\dpXFNZb.exe
  C:\Windows\System\dpXFNZb.exe
  2⤵
  PID:6460
- C:\Windows\System\xqHvhmS.exe
  C:\Windows\System\xqHvhmS.exe
  2⤵
  PID:6476
- C:\Windows\System\oRQbKjQ.exe
  C:\Windows\System\oRQbKjQ.exe
  2⤵
  PID:6492
- C:\Windows\System\WAmjUcp.exe
  C:\Windows\System\WAmjUcp.exe
  2⤵
  PID:6508
- C:\Windows\System\pzmAaTO.exe
  C:\Windows\System\pzmAaTO.exe
  2⤵
  PID:6524
- C:\Windows\System\NylpNuU.exe
  C:\Windows\System\NylpNuU.exe
  2⤵
  PID:6540
- C:\Windows\System\zrRLPbN.exe
  C:\Windows\System\zrRLPbN.exe
  2⤵
  PID:6556
- C:\Windows\System\MNFyBAT.exe
  C:\Windows\System\MNFyBAT.exe
  2⤵
  PID:6572
- C:\Windows\System\wvOCJRL.exe
  C:\Windows\System\wvOCJRL.exe
  2⤵
  PID:6588
- C:\Windows\System\fWayfWU.exe
  C:\Windows\System\fWayfWU.exe
  2⤵
  PID:6604
- C:\Windows\System\RlbwJXL.exe
  C:\Windows\System\RlbwJXL.exe
  2⤵
  PID:6620
- C:\Windows\System\PioWnds.exe
  C:\Windows\System\PioWnds.exe
  2⤵
  PID:6636
- C:\Windows\System\ajoRcYM.exe
  C:\Windows\System\ajoRcYM.exe
  2⤵
  PID:6652
- C:\Windows\System\hXsppsA.exe
  C:\Windows\System\hXsppsA.exe
  2⤵
  PID:6668
- C:\Windows\System\uqrhhpz.exe
  C:\Windows\System\uqrhhpz.exe
  2⤵
  PID:6684
- C:\Windows\System\cRIKiJa.exe
  C:\Windows\System\cRIKiJa.exe
  2⤵
  PID:6700
- C:\Windows\System\yVuYxke.exe
  C:\Windows\System\yVuYxke.exe
  2⤵
  PID:6716
- C:\Windows\System\sAlrlmi.exe
  C:\Windows\System\sAlrlmi.exe
  2⤵
  PID:6732
- C:\Windows\System\rldJDcw.exe
  C:\Windows\System\rldJDcw.exe
  2⤵
  PID:6748
- C:\Windows\System\zSRegBU.exe
  C:\Windows\System\zSRegBU.exe
  2⤵
  PID:6764
- C:\Windows\System\KydUmzW.exe
  C:\Windows\System\KydUmzW.exe
  2⤵
  PID:6780
- C:\Windows\System\RAAOfXG.exe
  C:\Windows\System\RAAOfXG.exe
  2⤵
  PID:6796
- C:\Windows\System\Wddsuet.exe
  C:\Windows\System\Wddsuet.exe
  2⤵
  PID:6812
- C:\Windows\System\KVriUAq.exe
  C:\Windows\System\KVriUAq.exe
  2⤵
  PID:6828
- C:\Windows\System\JFvjwsI.exe
  C:\Windows\System\JFvjwsI.exe
  2⤵
  PID:6844
- C:\Windows\System\wqVBuuf.exe
  C:\Windows\System\wqVBuuf.exe
  2⤵
  PID:6860
- C:\Windows\System\AuYqKcm.exe
  C:\Windows\System\AuYqKcm.exe
  2⤵
  PID:6876
- C:\Windows\System\oBNZLQO.exe
  C:\Windows\System\oBNZLQO.exe
  2⤵
  PID:6892
- C:\Windows\System\kwWwPkj.exe
  C:\Windows\System\kwWwPkj.exe
  2⤵
  PID:6908
- C:\Windows\System\XNafVDi.exe
  C:\Windows\System\XNafVDi.exe
  2⤵
  PID:6924
- C:\Windows\System\AImxnEd.exe
  C:\Windows\System\AImxnEd.exe
  2⤵
  PID:6940
- C:\Windows\System\LbHJfls.exe
  C:\Windows\System\LbHJfls.exe
  2⤵
  PID:6956
- C:\Windows\System\wDRVugA.exe
  C:\Windows\System\wDRVugA.exe
  2⤵
  PID:6972
- C:\Windows\System\pMSeyrF.exe
  C:\Windows\System\pMSeyrF.exe
  2⤵
  PID:6988
- C:\Windows\System\DibDwJJ.exe
  C:\Windows\System\DibDwJJ.exe
  2⤵
  PID:7004
- C:\Windows\System\PZdkhoG.exe
  C:\Windows\System\PZdkhoG.exe
  2⤵
  PID:7020
- C:\Windows\System\jjIBIGh.exe
  C:\Windows\System\jjIBIGh.exe
  2⤵
  PID:7036
- C:\Windows\System\OFxVTgc.exe
  C:\Windows\System\OFxVTgc.exe
  2⤵
  PID:7056
- C:\Windows\System\CQKCuDf.exe
  C:\Windows\System\CQKCuDf.exe
  2⤵
  PID:7072
- C:\Windows\System\OuzujFy.exe
  C:\Windows\System\OuzujFy.exe
  2⤵
  PID:7088
- C:\Windows\System\zcngIuY.exe
  C:\Windows\System\zcngIuY.exe
  2⤵
  PID:7104
- C:\Windows\System\DuocWLY.exe
  C:\Windows\System\DuocWLY.exe
  2⤵
  PID:7120
- C:\Windows\System\wHoqXJo.exe
  C:\Windows\System\wHoqXJo.exe
  2⤵
  PID:7136
- C:\Windows\System\BdmFUyS.exe
  C:\Windows\System\BdmFUyS.exe
  2⤵
  PID:7152
- C:\Windows\System\WXZLZGf.exe
  C:\Windows\System\WXZLZGf.exe
  2⤵
  PID:5788
- C:\Windows\System\JtVtdJL.exe
  C:\Windows\System\JtVtdJL.exe
  2⤵
  PID:6180
- C:\Windows\System\wAxFcnC.exe
  C:\Windows\System\wAxFcnC.exe
  2⤵
  PID:5680
- C:\Windows\System\nbCwyHC.exe
  C:\Windows\System\nbCwyHC.exe
  2⤵
  PID:5684
- C:\Windows\System\RJLMPci.exe
  C:\Windows\System\RJLMPci.exe
  2⤵
  PID:6196
- C:\Windows\System\mOErHSR.exe
  C:\Windows\System\mOErHSR.exe
  2⤵
  PID:6276
- C:\Windows\System\KhHmqSc.exe
  C:\Windows\System\KhHmqSc.exe
  2⤵
  PID:6340
- C:\Windows\System\kVJbvWk.exe
  C:\Windows\System\kVJbvWk.exe
  2⤵
  PID:6404
- C:\Windows\System\fQRFBlK.exe
  C:\Windows\System\fQRFBlK.exe
  2⤵
  PID:6392
- C:\Windows\System\WOlZPQx.exe
  C:\Windows\System\WOlZPQx.exe
  2⤵
  PID:6504
- C:\Windows\System\fRwXfBI.exe
  C:\Windows\System\fRwXfBI.exe
  2⤵
  PID:6568
- C:\Windows\System\QCtvLYa.exe
  C:\Windows\System\QCtvLYa.exe
  2⤵
  PID:6360
- C:\Windows\System\sthtIRI.exe
  C:\Windows\System\sthtIRI.exe
  2⤵
  PID:6420
- C:\Windows\System\HsUPZZM.exe
  C:\Windows\System\HsUPZZM.exe
  2⤵
  PID:6628
- C:\Windows\System\vcLfhvd.exe
  C:\Windows\System\vcLfhvd.exe
  2⤵
  PID:6424
- C:\Windows\System\bWYurAN.exe
  C:\Windows\System\bWYurAN.exe
  2⤵
  PID:6452
- C:\Windows\System\iimWDIZ.exe
  C:\Windows\System\iimWDIZ.exe
  2⤵
  PID:6552
- C:\Windows\System\aiWdKvE.exe
  C:\Windows\System\aiWdKvE.exe
  2⤵
  PID:6548
- C:\Windows\System\ENvkOhz.exe
  C:\Windows\System\ENvkOhz.exe
  2⤵
  PID:6660
- C:\Windows\System\wPVUeGT.exe
  C:\Windows\System\wPVUeGT.exe
  2⤵
  PID:6724
- C:\Windows\System\YWOziub.exe
  C:\Windows\System\YWOziub.exe
  2⤵
  PID:6760
- C:\Windows\System\nzbXJhl.exe
  C:\Windows\System\nzbXJhl.exe
  2⤵
  PID:6648
- C:\Windows\System\qoijrSy.exe
  C:\Windows\System\qoijrSy.exe
  2⤵
  PID:6776
- C:\Windows\System\sYlYtZe.exe
  C:\Windows\System\sYlYtZe.exe
  2⤵
  PID:6708
- C:\Windows\System\sAVbgTO.exe
  C:\Windows\System\sAVbgTO.exe
  2⤵
  PID:6884
- C:\Windows\System\tyYDaxw.exe
  C:\Windows\System\tyYDaxw.exe
  2⤵
  PID:6948
- C:\Windows\System\QGNrVGr.exe
  C:\Windows\System\QGNrVGr.exe
  2⤵
  PID:6984
- C:\Windows\System\DdqfDHz.exe
  C:\Windows\System\DdqfDHz.exe
  2⤵
  PID:6964
- C:\Windows\System\XuCLuFR.exe
  C:\Windows\System\XuCLuFR.exe
  2⤵
  PID:7048
- C:\Windows\System\LLeevJt.exe
  C:\Windows\System\LLeevJt.exe
  2⤵
  PID:7028
- C:\Windows\System\ONMoigu.exe
  C:\Windows\System\ONMoigu.exe
  2⤵
  PID:6968
- C:\Windows\System\wgQHpco.exe
  C:\Windows\System\wgQHpco.exe
  2⤵
  PID:7084
- C:\Windows\System\HBqOFCB.exe
  C:\Windows\System\HBqOFCB.exe
  2⤵
  PID:7068
- C:\Windows\System\gtFvjCE.exe
  C:\Windows\System\gtFvjCE.exe
  2⤵
  PID:6116
- C:\Windows\System\eYwuSvh.exe
  C:\Windows\System\eYwuSvh.exe
  2⤵
  PID:6248
- C:\Windows\System\MhvyrDL.exe
  C:\Windows\System\MhvyrDL.exe
  2⤵
  PID:6472
- C:\Windows\System\XiuplrP.exe
  C:\Windows\System\XiuplrP.exe
  2⤵
  PID:6600
- C:\Windows\System\tPpMzCc.exe
  C:\Windows\System\tPpMzCc.exe
  2⤵
  PID:7132
- C:\Windows\System\TBmdJMg.exe
  C:\Windows\System\TBmdJMg.exe
  2⤵
  PID:6212
- C:\Windows\System\NeYyQqz.exe
  C:\Windows\System\NeYyQqz.exe
  2⤵
  PID:6440
- C:\Windows\System\uJKBneB.exe
  C:\Windows\System\uJKBneB.exe
  2⤵
  PID:6564
- C:\Windows\System\bzrDZdL.exe
  C:\Windows\System\bzrDZdL.exe
  2⤵
  PID:6228
- C:\Windows\System\gBywbtu.exe
  C:\Windows\System\gBywbtu.exe
  2⤵
  PID:6820
- C:\Windows\System\HmoSDEn.exe
  C:\Windows\System\HmoSDEn.exe
  2⤵
  PID:6516
- C:\Windows\System\ityWBKK.exe
  C:\Windows\System\ityWBKK.exe
  2⤵
  PID:6788
- C:\Windows\System\sdpzFIA.exe
  C:\Windows\System\sdpzFIA.exe
  2⤵
  PID:5796
- C:\Windows\System\qpHJzIy.exe
  C:\Windows\System\qpHJzIy.exe
  2⤵
  PID:6292
- C:\Windows\System\UCxbzjR.exe
  C:\Windows\System\UCxbzjR.exe
  2⤵
  PID:6712
- C:\Windows\System\CRxcQCI.exe
  C:\Windows\System\CRxcQCI.exe
  2⤵
  PID:7052
- C:\Windows\System\yzPkJgV.exe
  C:\Windows\System\yzPkJgV.exe
  2⤵
  PID:6376
- C:\Windows\System\EKjxbSS.exe
  C:\Windows\System\EKjxbSS.exe
  2⤵
  PID:6312
- C:\Windows\System\pKkQoPZ.exe
  C:\Windows\System\pKkQoPZ.exe
  2⤵
  PID:6484
- C:\Windows\System\gsYkgmS.exe
  C:\Windows\System\gsYkgmS.exe
  2⤵
  PID:7044
- C:\Windows\System\DaYdsHP.exe
  C:\Windows\System\DaYdsHP.exe
  2⤵
  PID:6904
- C:\Windows\System\gsZkNBU.exe
  C:\Windows\System\gsZkNBU.exe
  2⤵
  PID:6520
- C:\Windows\System\nDjxFEB.exe
  C:\Windows\System\nDjxFEB.exe
  2⤵
  PID:6872
- C:\Windows\System\NWrWaaZ.exe
  C:\Windows\System\NWrWaaZ.exe
  2⤵
  PID:7116
- C:\Windows\System\dgOCVzp.exe
  C:\Windows\System\dgOCVzp.exe
  2⤵
  PID:6856
- C:\Windows\System\rCOsoqX.exe
  C:\Windows\System\rCOsoqX.exe
  2⤵
  PID:7144
- C:\Windows\System\QGxUSDO.exe
  C:\Windows\System\QGxUSDO.exe
  2⤵
  PID:6868
- C:\Windows\System\AkeGwBZ.exe
  C:\Windows\System\AkeGwBZ.exe
  2⤵
  PID:7180
- C:\Windows\System\ymrNmiq.exe
  C:\Windows\System\ymrNmiq.exe
  2⤵
  PID:7196
- C:\Windows\System\KXjpyXG.exe
  C:\Windows\System\KXjpyXG.exe
  2⤵
  PID:7212
- C:\Windows\System\OjzYfzx.exe
  C:\Windows\System\OjzYfzx.exe
  2⤵
  PID:7228
- C:\Windows\System\xeovhCn.exe
  C:\Windows\System\xeovhCn.exe
  2⤵
  PID:7244
- C:\Windows\System\ethXCJf.exe
  C:\Windows\System\ethXCJf.exe
  2⤵
  PID:7260
- C:\Windows\System\uBEyMwf.exe
  C:\Windows\System\uBEyMwf.exe
  2⤵
  PID:7276
- C:\Windows\System\YwbHpkB.exe
  C:\Windows\System\YwbHpkB.exe
  2⤵
  PID:7292
- C:\Windows\System\aakIkwQ.exe
  C:\Windows\System\aakIkwQ.exe
  2⤵
  PID:7308
- C:\Windows\System\sSGDehW.exe
  C:\Windows\System\sSGDehW.exe
  2⤵
  PID:7324
- C:\Windows\System\GgDXsvo.exe
  C:\Windows\System\GgDXsvo.exe
  2⤵
  PID:7340
- C:\Windows\System\YTuHCiD.exe
  C:\Windows\System\YTuHCiD.exe
  2⤵
  PID:7356
- C:\Windows\System\GNxsegF.exe
  C:\Windows\System\GNxsegF.exe
  2⤵
  PID:7372
- C:\Windows\System\wktUing.exe
  C:\Windows\System\wktUing.exe
  2⤵
  PID:7388
- C:\Windows\System\tQxdpeb.exe
  C:\Windows\System\tQxdpeb.exe
  2⤵
  PID:7404
- C:\Windows\System\QWBInLk.exe
  C:\Windows\System\QWBInLk.exe
  2⤵
  PID:7420
- C:\Windows\System\PQGIoeF.exe
  C:\Windows\System\PQGIoeF.exe
  2⤵
  PID:7436
- C:\Windows\System\fTPOkjN.exe
  C:\Windows\System\fTPOkjN.exe
  2⤵
  PID:7452
- C:\Windows\System\agkdwcL.exe
  C:\Windows\System\agkdwcL.exe
  2⤵
  PID:7468
- C:\Windows\System\PAMCYYd.exe
  C:\Windows\System\PAMCYYd.exe
  2⤵
  PID:7484
- C:\Windows\System\SxXdjVd.exe
  C:\Windows\System\SxXdjVd.exe
  2⤵
  PID:7500
- C:\Windows\System\fNqrZnC.exe
  C:\Windows\System\fNqrZnC.exe
  2⤵
  PID:7516
- C:\Windows\System\yOaMlTv.exe
  C:\Windows\System\yOaMlTv.exe
  2⤵
  PID:7532
- C:\Windows\System\nYftZui.exe
  C:\Windows\System\nYftZui.exe
  2⤵
  PID:7552
- C:\Windows\System\jeWhopj.exe
  C:\Windows\System\jeWhopj.exe
  2⤵
  PID:7568
- C:\Windows\System\yCjCsfy.exe
  C:\Windows\System\yCjCsfy.exe
  2⤵
  PID:7584
- C:\Windows\System\WNPlMRh.exe
  C:\Windows\System\WNPlMRh.exe
  2⤵
  PID:7600
- C:\Windows\System\yUtldcJ.exe
  C:\Windows\System\yUtldcJ.exe
  2⤵
  PID:7616
- C:\Windows\System\aVkpOrf.exe
  C:\Windows\System\aVkpOrf.exe
  2⤵
  PID:7636
- C:\Windows\System\YlhSxhe.exe
  C:\Windows\System\YlhSxhe.exe
  2⤵
  PID:7652
- C:\Windows\System\RhSPsJU.exe
  C:\Windows\System\RhSPsJU.exe
  2⤵
  PID:7668
- C:\Windows\System\wDXKGlP.exe
  C:\Windows\System\wDXKGlP.exe
  2⤵
  PID:7684
- C:\Windows\System\WcshNCV.exe
  C:\Windows\System\WcshNCV.exe
  2⤵
  PID:7700
- C:\Windows\System\BTYRqEc.exe
  C:\Windows\System\BTYRqEc.exe
  2⤵
  PID:7716
- C:\Windows\System\leMmDcv.exe
  C:\Windows\System\leMmDcv.exe
  2⤵
  PID:7732
- C:\Windows\System\pCucJBs.exe
  C:\Windows\System\pCucJBs.exe
  2⤵
  PID:7748
- C:\Windows\System\LFvWPoT.exe
  C:\Windows\System\LFvWPoT.exe
  2⤵
  PID:7764
- C:\Windows\System\yTgRmAX.exe
  C:\Windows\System\yTgRmAX.exe
  2⤵
  PID:7780
- C:\Windows\System\mzWDKjy.exe
  C:\Windows\System\mzWDKjy.exe
  2⤵
  PID:7796
- C:\Windows\System\rnBAIBY.exe
  C:\Windows\System\rnBAIBY.exe
  2⤵
  PID:7812
- C:\Windows\System\HvLErji.exe
  C:\Windows\System\HvLErji.exe
  2⤵
  PID:7828
- C:\Windows\System\sLEDJWn.exe
  C:\Windows\System\sLEDJWn.exe
  2⤵
  PID:7844
- C:\Windows\System\iimzLIc.exe
  C:\Windows\System\iimzLIc.exe
  2⤵
  PID:7860
- C:\Windows\System\iWMWKKZ.exe
  C:\Windows\System\iWMWKKZ.exe
  2⤵
  PID:7876
- C:\Windows\System\AxqZwdO.exe
  C:\Windows\System\AxqZwdO.exe
  2⤵
  PID:7892
- C:\Windows\System\VJLMONc.exe
  C:\Windows\System\VJLMONc.exe
  2⤵
  PID:7908
- C:\Windows\System\OIANOPT.exe
  C:\Windows\System\OIANOPT.exe
  2⤵
  PID:7924
- C:\Windows\System\HtThGTZ.exe
  C:\Windows\System\HtThGTZ.exe
  2⤵
  PID:7940
- C:\Windows\System\zdOZtOH.exe
  C:\Windows\System\zdOZtOH.exe
  2⤵
  PID:7956
- C:\Windows\System\XbsLrKW.exe
  C:\Windows\System\XbsLrKW.exe
  2⤵
  PID:7972
- C:\Windows\System\jaxOYsk.exe
  C:\Windows\System\jaxOYsk.exe
  2⤵
  PID:7988
- C:\Windows\System\wDabRHy.exe
  C:\Windows\System\wDabRHy.exe
  2⤵
  PID:8004
- C:\Windows\System\kZwemcv.exe
  C:\Windows\System\kZwemcv.exe
  2⤵
  PID:8020
- C:\Windows\System\BFiasfP.exe
  C:\Windows\System\BFiasfP.exe
  2⤵
  PID:8036
- C:\Windows\System\UERipeG.exe
  C:\Windows\System\UERipeG.exe
  2⤵
  PID:8052
- C:\Windows\System\GnwApdX.exe
  C:\Windows\System\GnwApdX.exe
  2⤵
  PID:8068
- C:\Windows\System\vkxBYFH.exe
  C:\Windows\System\vkxBYFH.exe
  2⤵
  PID:8084
- C:\Windows\System\cGtzaze.exe
  C:\Windows\System\cGtzaze.exe
  2⤵
  PID:8100
- C:\Windows\System\AgOUqob.exe
  C:\Windows\System\AgOUqob.exe
  2⤵
  PID:8116
- C:\Windows\System\fFVKoSE.exe
  C:\Windows\System\fFVKoSE.exe
  2⤵
  PID:8132
- C:\Windows\System\meZxsNr.exe
  C:\Windows\System\meZxsNr.exe
  2⤵
  PID:8148
- C:\Windows\System\VUbHBlJ.exe
  C:\Windows\System\VUbHBlJ.exe
  2⤵
  PID:8164
- C:\Windows\System\VZEjpzt.exe
  C:\Windows\System\VZEjpzt.exe
  2⤵
  PID:8180
- C:\Windows\System\YDpoYpX.exe
  C:\Windows\System\YDpoYpX.exe
  2⤵
  PID:6840
- C:\Windows\System\NpqACtd.exe
  C:\Windows\System\NpqACtd.exe
  2⤵
  PID:6260
- C:\Windows\System\bIRBpFF.exe
  C:\Windows\System\bIRBpFF.exe
  2⤵
  PID:7224
- C:\Windows\System\GusHFJq.exe
  C:\Windows\System\GusHFJq.exe
  2⤵
  PID:7288
- C:\Windows\System\DNBDxxq.exe
  C:\Windows\System\DNBDxxq.exe
  2⤵
  PID:7160
- C:\Windows\System\VGrOMmk.exe
  C:\Windows\System\VGrOMmk.exe
  2⤵
  PID:7268
- C:\Windows\System\iQWGpHu.exe
  C:\Windows\System\iQWGpHu.exe
  2⤵
  PID:6920
- C:\Windows\System\ItkQbPk.exe
  C:\Windows\System\ItkQbPk.exe
  2⤵
  PID:7164
- C:\Windows\System\YWzYovh.exe
  C:\Windows\System\YWzYovh.exe
  2⤵
  PID:7172
- C:\Windows\System\KPmYHVV.exe
  C:\Windows\System\KPmYHVV.exe
  2⤵
  PID:6324
- C:\Windows\System\pubZavv.exe
  C:\Windows\System\pubZavv.exe
  2⤵
  PID:7380
- C:\Windows\System\YYbCCCJ.exe
  C:\Windows\System\YYbCCCJ.exe
  2⤵
  PID:7368
- C:\Windows\System\EcVAHsM.exe
  C:\Windows\System\EcVAHsM.exe
  2⤵
  PID:7416
- C:\Windows\System\bQklzSq.exe
  C:\Windows\System\bQklzSq.exe
  2⤵
  PID:7480
- C:\Windows\System\DTqXUfm.exe
  C:\Windows\System\DTqXUfm.exe
  2⤵
  PID:7464
- C:\Windows\System\kggsdoy.exe
  C:\Windows\System\kggsdoy.exe
  2⤵
  PID:7540
- C:\Windows\System\zTIUWGu.exe
  C:\Windows\System\zTIUWGu.exe
  2⤵
  PID:7580
- C:\Windows\System\iSsHTNO.exe
  C:\Windows\System\iSsHTNO.exe
  2⤵
  PID:7592
- C:\Windows\System\hrCjfxP.exe
  C:\Windows\System\hrCjfxP.exe
  2⤵
  PID:7596
- C:\Windows\System\cqLtrWz.exe
  C:\Windows\System\cqLtrWz.exe
  2⤵
  PID:7644
- C:\Windows\System\csdIeZs.exe
  C:\Windows\System\csdIeZs.exe
  2⤵
  PID:7708
- C:\Windows\System\wJkTeoW.exe
  C:\Windows\System\wJkTeoW.exe
  2⤵
  PID:7772
- C:\Windows\System\XZzBKRc.exe
  C:\Windows\System\XZzBKRc.exe
  2⤵
  PID:7836
- C:\Windows\System\laXZmSv.exe
  C:\Windows\System\laXZmSv.exe
  2⤵
  PID:7660
- C:\Windows\System\gCZdEKi.exe
  C:\Windows\System\gCZdEKi.exe
  2⤵
  PID:7724
- C:\Windows\System\vdkLVaW.exe
  C:\Windows\System\vdkLVaW.exe
  2⤵
  PID:7632
- C:\Windows\System\oiCLEJI.exe
  C:\Windows\System\oiCLEJI.exe
  2⤵
  PID:7756
- C:\Windows\System\tkACygd.exe
  C:\Windows\System\tkACygd.exe
  2⤵
  PID:7888
- C:\Windows\System\QLOLGpn.exe
  C:\Windows\System\QLOLGpn.exe
  2⤵
  PID:7916
- C:\Windows\System\tJWWFmp.exe
  C:\Windows\System\tJWWFmp.exe
  2⤵
  PID:7948
- C:\Windows\System\jMfpGzM.exe
  C:\Windows\System\jMfpGzM.exe
  2⤵
  PID:7996
- C:\Windows\System\nLQAOLA.exe
  C:\Windows\System\nLQAOLA.exe
  2⤵
  PID:8032
- C:\Windows\System\jvTHArd.exe
  C:\Windows\System\jvTHArd.exe
  2⤵
  PID:8096
- C:\Windows\System\limzqFh.exe
  C:\Windows\System\limzqFh.exe
  2⤵
  PID:8080
- C:\Windows\System\BjNGOLA.exe
  C:\Windows\System\BjNGOLA.exe
  2⤵
  PID:8016
- C:\Windows\System\WGfnYvB.exe
  C:\Windows\System\WGfnYvB.exe
  2⤵
  PID:8160
- C:\Windows\System\mIIdDMD.exe
  C:\Windows\System\mIIdDMD.exe
  2⤵
  PID:8140
- C:\Windows\System\QevwEuv.exe
  C:\Windows\System\QevwEuv.exe
  2⤵
  PID:7192
- C:\Windows\System\ZsXtcRS.exe
  C:\Windows\System\ZsXtcRS.exe
  2⤵
  PID:7284
- C:\Windows\System\qoQWjYK.exe
  C:\Windows\System\qoQWjYK.exe
  2⤵
  PID:7332
- C:\Windows\System\bafARLr.exe
  C:\Windows\System\bafARLr.exe
  2⤵
  PID:7100
- C:\Windows\System\UUaGctR.exe
  C:\Windows\System\UUaGctR.exe
  2⤵
  PID:7336
- C:\Windows\System\lRLVXyP.exe
  C:\Windows\System\lRLVXyP.exe
  2⤵
  PID:7384
- C:\Windows\System\EaeIBEd.exe
  C:\Windows\System\EaeIBEd.exe
  2⤵
  PID:7548
- C:\Windows\System\JRaweyi.exe
  C:\Windows\System\JRaweyi.exe
  2⤵
  PID:7680
- C:\Windows\System\ELYPqvP.exe
  C:\Windows\System\ELYPqvP.exe
  2⤵
  PID:7904
- C:\Windows\System\gYIZAev.exe
  C:\Windows\System\gYIZAev.exe
  2⤵
  PID:7496
- C:\Windows\System\lDvaDdn.exe
  C:\Windows\System\lDvaDdn.exe
  2⤵
  PID:7448
- C:\Windows\System\IJCeyOo.exe
  C:\Windows\System\IJCeyOo.exe
  2⤵
  PID:7868
- C:\Windows\System\sVvEqTb.exe
  C:\Windows\System\sVvEqTb.exe
  2⤵
  PID:7612
- C:\Windows\System\MiiayQR.exe
  C:\Windows\System\MiiayQR.exe
  2⤵
  PID:7856
- C:\Windows\System\JQmSFHi.exe
  C:\Windows\System\JQmSFHi.exe
  2⤵
  PID:7952
- C:\Windows\System\ZszTYRb.exe
  C:\Windows\System\ZszTYRb.exe
  2⤵
  PID:8012
- C:\Windows\System\rByjUpb.exe
  C:\Windows\System\rByjUpb.exe
  2⤵
  PID:8028
- C:\Windows\System\PymowMQ.exe
  C:\Windows\System\PymowMQ.exe
  2⤵
  PID:7220
- C:\Windows\System\AeUvxYJ.exe
  C:\Windows\System\AeUvxYJ.exe
  2⤵
  PID:7348
- C:\Windows\System\IeDIHCy.exe
  C:\Windows\System\IeDIHCy.exe
  2⤵
  PID:6756
- C:\Windows\System\rbvJNfI.exe
  C:\Windows\System\rbvJNfI.exe
  2⤵
  PID:6980
- C:\Windows\System\HfxnIzH.exe
  C:\Windows\System\HfxnIzH.exe
  2⤵
  PID:7628
- C:\Windows\System\iFCaTeI.exe
  C:\Windows\System\iFCaTeI.exe
  2⤵
  PID:7808
- C:\Windows\System\HmBIsZi.exe
  C:\Windows\System\HmBIsZi.exe
  2⤵
  PID:7964
- C:\Windows\System\ohXffBa.exe
  C:\Windows\System\ohXffBa.exe
  2⤵
  PID:7744
- C:\Windows\System\greRXPE.exe
  C:\Windows\System\greRXPE.exe
  2⤵
  PID:8112
- C:\Windows\System\KvCmcVj.exe
  C:\Windows\System\KvCmcVj.exe
  2⤵
  PID:6996
- C:\Windows\System\GlBjLHB.exe
  C:\Windows\System\GlBjLHB.exe
  2⤵
  PID:6744
- C:\Windows\System\KYIDSDU.exe
  C:\Windows\System\KYIDSDU.exe
  2⤵
  PID:7476
- C:\Windows\System\fUWMZnN.exe
  C:\Windows\System\fUWMZnN.exe
  2⤵
  PID:8204
- C:\Windows\System\UyVAwGy.exe
  C:\Windows\System\UyVAwGy.exe
  2⤵
  PID:8220
- C:\Windows\System\xzoTYIj.exe
  C:\Windows\System\xzoTYIj.exe
  2⤵
  PID:8236
- C:\Windows\System\MtIvwFq.exe
  C:\Windows\System\MtIvwFq.exe
  2⤵
  PID:8252
- C:\Windows\System\jAMdVKo.exe
  C:\Windows\System\jAMdVKo.exe
  2⤵
  PID:8268
- C:\Windows\System\CVifArg.exe
  C:\Windows\System\CVifArg.exe
  2⤵
  PID:8284
- C:\Windows\System\mbCQIja.exe
  C:\Windows\System\mbCQIja.exe
  2⤵
  PID:8300
- C:\Windows\System\XDpdwkd.exe
  C:\Windows\System\XDpdwkd.exe
  2⤵
  PID:8316
- C:\Windows\System\vBDOWcS.exe
  C:\Windows\System\vBDOWcS.exe
  2⤵
  PID:8332
- C:\Windows\System\QeWABeX.exe
  C:\Windows\System\QeWABeX.exe
  2⤵
  PID:8348
- C:\Windows\System\EBJpDAN.exe
  C:\Windows\System\EBJpDAN.exe
  2⤵
  PID:8364
- C:\Windows\System\nNeYFUY.exe
  C:\Windows\System\nNeYFUY.exe
  2⤵
  PID:8380
- C:\Windows\System\xMXTcRX.exe
  C:\Windows\System\xMXTcRX.exe
  2⤵
  PID:8396
- C:\Windows\System\WPvrHnv.exe
  C:\Windows\System\WPvrHnv.exe
  2⤵
  PID:8412
- C:\Windows\System\AyuDyhS.exe
  C:\Windows\System\AyuDyhS.exe
  2⤵
  PID:8428
- C:\Windows\System\dQEbPpe.exe
  C:\Windows\System\dQEbPpe.exe
  2⤵
  PID:8444
- C:\Windows\System\AZwwxWP.exe
  C:\Windows\System\AZwwxWP.exe
  2⤵
  PID:8460
- C:\Windows\System\bFZIijs.exe
  C:\Windows\System\bFZIijs.exe
  2⤵
  PID:8476
- C:\Windows\System\QNwGDgL.exe
  C:\Windows\System\QNwGDgL.exe
  2⤵
  PID:8492
- C:\Windows\System\EiLnKAh.exe
  C:\Windows\System\EiLnKAh.exe
  2⤵
  PID:8508
- C:\Windows\System\oEpjxhQ.exe
  C:\Windows\System\oEpjxhQ.exe
  2⤵
  PID:8524
- C:\Windows\System\TWgLqOm.exe
  C:\Windows\System\TWgLqOm.exe
  2⤵
  PID:8540
- C:\Windows\System\QBWIEOA.exe
  C:\Windows\System\QBWIEOA.exe
  2⤵
  PID:8556
- C:\Windows\System\HhOfEwY.exe
  C:\Windows\System\HhOfEwY.exe
  2⤵
  PID:8572
- C:\Windows\System\ckIXYCb.exe
  C:\Windows\System\ckIXYCb.exe
  2⤵
  PID:8588
- C:\Windows\System\OAQqbiy.exe
  C:\Windows\System\OAQqbiy.exe
  2⤵
  PID:8604
- C:\Windows\System\WqhOyLU.exe
  C:\Windows\System\WqhOyLU.exe
  2⤵
  PID:8620
- C:\Windows\System\jGPJXhc.exe
  C:\Windows\System\jGPJXhc.exe
  2⤵
  PID:8636
- C:\Windows\System\fvyllup.exe
  C:\Windows\System\fvyllup.exe
  2⤵
  PID:8652
- C:\Windows\System\wNvueOP.exe
  C:\Windows\System\wNvueOP.exe
  2⤵
  PID:8668
- C:\Windows\System\EROYThY.exe
  C:\Windows\System\EROYThY.exe
  2⤵
  PID:8684
- C:\Windows\System\kYCyVKw.exe
  C:\Windows\System\kYCyVKw.exe
  2⤵
  PID:8704
- C:\Windows\System\YqSGeZZ.exe
  C:\Windows\System\YqSGeZZ.exe
  2⤵
  PID:8720
- C:\Windows\System\didbxeh.exe
  C:\Windows\System\didbxeh.exe
  2⤵
  PID:8736
- C:\Windows\System\shEEPBl.exe
  C:\Windows\System\shEEPBl.exe
  2⤵
  PID:8752
- C:\Windows\System\sJqdirU.exe
  C:\Windows\System\sJqdirU.exe
  2⤵
  PID:8768
- C:\Windows\System\cBMVwXT.exe
  C:\Windows\System\cBMVwXT.exe
  2⤵
  PID:8784
- C:\Windows\System\neQgjfO.exe
  C:\Windows\System\neQgjfO.exe
  2⤵
  PID:8800
- C:\Windows\System\iHUcPAz.exe
  C:\Windows\System\iHUcPAz.exe
  2⤵
  PID:8816
- C:\Windows\System\QgOmeRL.exe
  C:\Windows\System\QgOmeRL.exe
  2⤵
  PID:8832
- C:\Windows\System\pkhadyY.exe
  C:\Windows\System\pkhadyY.exe
  2⤵
  PID:8848
- C:\Windows\System\LaUPsfU.exe
  C:\Windows\System\LaUPsfU.exe
  2⤵
  PID:8864
- C:\Windows\System\vgsVRRe.exe
  C:\Windows\System\vgsVRRe.exe
  2⤵
  PID:8880
- C:\Windows\System\mfiIbtW.exe
  C:\Windows\System\mfiIbtW.exe
  2⤵
  PID:8896
- C:\Windows\System\SlTLptu.exe
  C:\Windows\System\SlTLptu.exe
  2⤵
  PID:8912
- C:\Windows\System\zOwLeyu.exe
  C:\Windows\System\zOwLeyu.exe
  2⤵
  PID:8928
- C:\Windows\System\QfAaCIs.exe
  C:\Windows\System\QfAaCIs.exe
  2⤵
  PID:8944
- C:\Windows\System\pZlMGOT.exe
  C:\Windows\System\pZlMGOT.exe
  2⤵
  PID:8960
- C:\Windows\System\jPfUlFR.exe
  C:\Windows\System\jPfUlFR.exe
  2⤵
  PID:8976
- C:\Windows\System\KESESWd.exe
  C:\Windows\System\KESESWd.exe
  2⤵
  PID:8992
- C:\Windows\System\xwObKBT.exe
  C:\Windows\System\xwObKBT.exe
  2⤵
  PID:9008
- C:\Windows\System\wULvlTY.exe
  C:\Windows\System\wULvlTY.exe
  2⤵
  PID:9024
- C:\Windows\System\iXbHWbA.exe
  C:\Windows\System\iXbHWbA.exe
  2⤵
  PID:9040
- C:\Windows\System\RUgxIkM.exe
  C:\Windows\System\RUgxIkM.exe
  2⤵
  PID:9056
- C:\Windows\System\AeSKcUC.exe
  C:\Windows\System\AeSKcUC.exe
  2⤵
  PID:9072
- C:\Windows\System\vOGnJCb.exe
  C:\Windows\System\vOGnJCb.exe
  2⤵
  PID:9088
- C:\Windows\System\AhpCGfU.exe
  C:\Windows\System\AhpCGfU.exe
  2⤵
  PID:9104
- C:\Windows\System\tINPpZa.exe
  C:\Windows\System\tINPpZa.exe
  2⤵
  PID:9120
- C:\Windows\System\zPGnDqj.exe
  C:\Windows\System\zPGnDqj.exe
  2⤵
  PID:9136
- C:\Windows\System\RNvEdvB.exe
  C:\Windows\System\RNvEdvB.exe
  2⤵
  PID:9152
- C:\Windows\System\MpxHswH.exe
  C:\Windows\System\MpxHswH.exe
  2⤵
  PID:9168
- C:\Windows\System\AAuyVVI.exe
  C:\Windows\System\AAuyVVI.exe
  2⤵
  PID:9184
- C:\Windows\System\eKDBRdN.exe
  C:\Windows\System\eKDBRdN.exe
  2⤵
  PID:9200
- C:\Windows\System\PkaWUyX.exe
  C:\Windows\System\PkaWUyX.exe
  2⤵
  PID:7460
- C:\Windows\System\wZuRldq.exe
  C:\Windows\System\wZuRldq.exe
  2⤵
  PID:8232
- C:\Windows\System\gDBfnXE.exe
  C:\Windows\System\gDBfnXE.exe
  2⤵
  PID:8296
- C:\Windows\System\OsUoNum.exe
  C:\Windows\System\OsUoNum.exe
  2⤵
  PID:7820
- C:\Windows\System\FphYIQx.exe
  C:\Windows\System\FphYIQx.exe
  2⤵
  PID:8280
- C:\Windows\System\Iqbakzp.exe
  C:\Windows\System\Iqbakzp.exe
  2⤵
  PID:8176
- C:\Windows\System\osIqnRn.exe
  C:\Windows\System\osIqnRn.exe
  2⤵
  PID:8076
- C:\Windows\System\tsobTCo.exe
  C:\Windows\System\tsobTCo.exe
  2⤵
  PID:8360
- C:\Windows\System\ULpDwEh.exe
  C:\Windows\System\ULpDwEh.exe
  2⤵
  PID:8172
- C:\Windows\System\XpjKOOy.exe
  C:\Windows\System\XpjKOOy.exe
  2⤵
  PID:8340
- C:\Windows\System\zOgdXFu.exe
  C:\Windows\System\zOgdXFu.exe
  2⤵
  PID:8408
- C:\Windows\System\AiPHgVt.exe
  C:\Windows\System\AiPHgVt.exe
  2⤵
  PID:8472
- C:\Windows\System\oDITamM.exe
  C:\Windows\System\oDITamM.exe
  2⤵
  PID:8388
- C:\Windows\System\guGjapj.exe
  C:\Windows\System\guGjapj.exe
  2⤵
  PID:8536
- C:\Windows\System\FZknMBw.exe
  C:\Windows\System\FZknMBw.exe
  2⤵
  PID:8600
- C:\Windows\System\brUUFfy.exe
  C:\Windows\System\brUUFfy.exe
  2⤵
  PID:8660
- C:\Windows\System\gpVESzd.exe
  C:\Windows\System\gpVESzd.exe
  2⤵
  PID:8484
- C:\Windows\System\KUczYnr.exe
  C:\Windows\System\KUczYnr.exe
  2⤵
  PID:8548
- C:\Windows\System\FKrqVMm.exe
  C:\Windows\System\FKrqVMm.exe
  2⤵
  PID:8676
- C:\Windows\System\UlbhCRI.exe
  C:\Windows\System\UlbhCRI.exe
  2⤵
  PID:8648
- C:\Windows\System\XeByiDk.exe
  C:\Windows\System\XeByiDk.exe
  2⤵
  PID:8716
- C:\Windows\System\BfpbzGc.exe
  C:\Windows\System\BfpbzGc.exe
  2⤵
  PID:8748
- C:\Windows\System\hNjVXZz.exe
  C:\Windows\System\hNjVXZz.exe
  2⤵
  PID:8764
- C:\Windows\System\JWidnVO.exe
  C:\Windows\System\JWidnVO.exe
  2⤵
  PID:8812
- C:\Windows\System\fkirVQN.exe
  C:\Windows\System\fkirVQN.exe
  2⤵
  PID:8872
- C:\Windows\System\CTdyYYf.exe
  C:\Windows\System\CTdyYYf.exe
  2⤵
  PID:8892
- C:\Windows\System\RyWwUYc.exe
  C:\Windows\System\RyWwUYc.exe
  2⤵
  PID:8952
- C:\Windows\System\tdANYiN.exe
  C:\Windows\System\tdANYiN.exe
  2⤵
  PID:8920
- C:\Windows\System\nxzPyQd.exe
  C:\Windows\System\nxzPyQd.exe
  2⤵
  PID:8984
- C:\Windows\System\XdvqnTt.exe
  C:\Windows\System\XdvqnTt.exe
  2⤵
  PID:9004
- C:\Windows\System\COnsITO.exe
  C:\Windows\System\COnsITO.exe
  2⤵
  PID:9020
- C:\Windows\System\scEHeiE.exe
  C:\Windows\System\scEHeiE.exe
  2⤵
  PID:9068
- C:\Windows\System\vprSfkN.exe
  C:\Windows\System\vprSfkN.exe
  2⤵
  PID:9132
- C:\Windows\System\EeNpejj.exe
  C:\Windows\System\EeNpejj.exe
  2⤵
  PID:9160
- C:\Windows\System\iZHqahV.exe
  C:\Windows\System\iZHqahV.exe
  2⤵
  PID:9164
- C:\Windows\System\ZyJXKba.exe
  C:\Windows\System\ZyJXKba.exe
  2⤵
  PID:9196
- C:\Windows\System\eiJwkQG.exe
  C:\Windows\System\eiJwkQG.exe
  2⤵
  PID:7236
- C:\Windows\System\zyZNCek.exe
  C:\Windows\System\zyZNCek.exe
  2⤵
  PID:8264
- C:\Windows\System\XjJoZgY.exe
  C:\Windows\System\XjJoZgY.exe
  2⤵
  PID:8064
- C:\Windows\System\fqsesZz.exe
  C:\Windows\System\fqsesZz.exe
  2⤵
  PID:8312
- C:\Windows\System\NIPSKyo.exe
  C:\Windows\System\NIPSKyo.exe
  2⤵
  PID:8372
- C:\Windows\System\mxtFPtK.exe
  C:\Windows\System\mxtFPtK.exe
  2⤵
  PID:8424
- C:\Windows\System\MdGNySg.exe
  C:\Windows\System\MdGNySg.exe
  2⤵
  PID:8532
- C:\Windows\System\ZLsQFtV.exe
  C:\Windows\System\ZLsQFtV.exe
  2⤵
  PID:8456
- C:\Windows\System\LgHkJDa.exe
  C:\Windows\System\LgHkJDa.exe
  2⤵
  PID:8520
- C:\Windows\System\tjeGIKM.exe
  C:\Windows\System\tjeGIKM.exe
  2⤵
  PID:8584
- C:\Windows\System\uUtqkwI.exe
  C:\Windows\System\uUtqkwI.exe
  2⤵
  PID:8760
- C:\Windows\System\WOpVVCJ.exe
  C:\Windows\System\WOpVVCJ.exe
  2⤵
  PID:9032
- C:\Windows\System\KgYhcnB.exe
  C:\Windows\System\KgYhcnB.exe
  2⤵
  PID:9116
- C:\Windows\System\odbYcli.exe
  C:\Windows\System\odbYcli.exe
  2⤵
  PID:9128
- C:\Windows\System\FqNVXVy.exe
  C:\Windows\System\FqNVXVy.exe
  2⤵
  PID:8828
- C:\Windows\System\yAzceXa.exe
  C:\Windows\System\yAzceXa.exe
  2⤵
  PID:8844
- C:\Windows\System\wAzhnnK.exe
  C:\Windows\System\wAzhnnK.exe
  2⤵
  PID:9080
- C:\Windows\System\dfoDjrY.exe
  C:\Windows\System\dfoDjrY.exe
  2⤵
  PID:9180
- C:\Windows\System\RNJschR.exe
  C:\Windows\System\RNJschR.exe
  2⤵
  PID:7968
- C:\Windows\System\jMzuCAn.exe
  C:\Windows\System\jMzuCAn.exe
  2⤵
  PID:8248
- C:\Windows\System\iRORvuK.exe
  C:\Windows\System\iRORvuK.exe
  2⤵
  PID:8632
- C:\Windows\System\baLIcVH.exe
  C:\Windows\System\baLIcVH.exe
  2⤵
  PID:8404
- C:\Windows\System\vZjrOmt.exe
  C:\Windows\System\vZjrOmt.exe
  2⤵
  PID:8516
- C:\Windows\System\fAwHYID.exe
  C:\Windows\System\fAwHYID.exe
  2⤵
  PID:8696
- C:\Windows\System\wivrciG.exe
  C:\Windows\System\wivrciG.exe
  2⤵
  PID:7740
- C:\Windows\System\AoOuSyw.exe
  C:\Windows\System\AoOuSyw.exe
  2⤵
  PID:8972
- C:\Windows\System\KqSHojA.exe
  C:\Windows\System\KqSHojA.exe
  2⤵
  PID:8228
- C:\Windows\System\pwxRsaZ.exe
  C:\Windows\System\pwxRsaZ.exe
  2⤵
  PID:8276
- C:\Windows\System\IvyilHE.exe
  C:\Windows\System\IvyilHE.exe
  2⤵
  PID:9100
- C:\Windows\System\skhVxHZ.exe
  C:\Windows\System\skhVxHZ.exe
  2⤵
  PID:8596
- C:\Windows\System\zejwmoL.exe
  C:\Windows\System\zejwmoL.exe
  2⤵
  PID:9000
- C:\Windows\System\QsyRNRt.exe
  C:\Windows\System\QsyRNRt.exe
  2⤵
  PID:9236
- C:\Windows\System\wWFrMnB.exe
  C:\Windows\System\wWFrMnB.exe
  2⤵
  PID:9252
- C:\Windows\System\pNTPZRd.exe
  C:\Windows\System\pNTPZRd.exe
  2⤵
  PID:9296
- C:\Windows\System\nfsWYYt.exe
  C:\Windows\System\nfsWYYt.exe
  2⤵
  PID:9312
- C:\Windows\System\okakjpM.exe
  C:\Windows\System\okakjpM.exe
  2⤵
  PID:9328
- C:\Windows\System\RDuxxuD.exe
  C:\Windows\System\RDuxxuD.exe
  2⤵
  PID:9416
- C:\Windows\System\uHddKPm.exe
  C:\Windows\System\uHddKPm.exe
  2⤵
  PID:9456
- C:\Windows\System\XfpIWwq.exe
  C:\Windows\System\XfpIWwq.exe
  2⤵
  PID:9472
- C:\Windows\System\FHdukAg.exe
  C:\Windows\System\FHdukAg.exe
  2⤵
  PID:9488
- C:\Windows\System\TXwwwgE.exe
  C:\Windows\System\TXwwwgE.exe
  2⤵
  PID:9516
- C:\Windows\System\qXLoOOv.exe
  C:\Windows\System\qXLoOOv.exe
  2⤵
  PID:9532
- C:\Windows\System\APeQGco.exe
  C:\Windows\System\APeQGco.exe
  2⤵
  PID:9548
- C:\Windows\System\UxwodpE.exe
  C:\Windows\System\UxwodpE.exe
  2⤵
  PID:9564
- C:\Windows\System\zWuVnuz.exe
  C:\Windows\System\zWuVnuz.exe
  2⤵
  PID:9580
- C:\Windows\System\mhIoTEh.exe
  C:\Windows\System\mhIoTEh.exe
  2⤵
  PID:9632
- C:\Windows\System\VFkGANd.exe
  C:\Windows\System\VFkGANd.exe
  2⤵
  PID:9648
- C:\Windows\System\NEcNTvZ.exe
  C:\Windows\System\NEcNTvZ.exe
  2⤵
  PID:9664
- C:\Windows\System\rHPkudt.exe
  C:\Windows\System\rHPkudt.exe
  2⤵
  PID:9684
- C:\Windows\System\SJtDqRn.exe
  C:\Windows\System\SJtDqRn.exe
  2⤵
  PID:9700
- C:\Windows\System\ckfcngM.exe
  C:\Windows\System\ckfcngM.exe
  2⤵
  PID:9716
- C:\Windows\System\dtFdjXa.exe
  C:\Windows\System\dtFdjXa.exe
  2⤵
  PID:9732
- C:\Windows\System\GWCvYJu.exe
  C:\Windows\System\GWCvYJu.exe
  2⤵
  PID:9748
- C:\Windows\System\mExvZoc.exe
  C:\Windows\System\mExvZoc.exe
  2⤵
  PID:9764
- C:\Windows\System\ORktemo.exe
  C:\Windows\System\ORktemo.exe
  2⤵
  PID:9780
- C:\Windows\System\znxFsYp.exe
  C:\Windows\System\znxFsYp.exe
  2⤵
  PID:9796
- C:\Windows\System\JVnQkuS.exe
  C:\Windows\System\JVnQkuS.exe
  2⤵
  PID:9812
- C:\Windows\System\uIYLaCQ.exe
  C:\Windows\System\uIYLaCQ.exe
  2⤵
  PID:9828
- C:\Windows\System\cDcjcdz.exe
  C:\Windows\System\cDcjcdz.exe
  2⤵
  PID:9844
- C:\Windows\System\mlKgxrp.exe
  C:\Windows\System\mlKgxrp.exe
  2⤵
  PID:9860
- C:\Windows\System\maxOmIW.exe
  C:\Windows\System\maxOmIW.exe
  2⤵
  PID:9876
- C:\Windows\System\fzIyKde.exe
  C:\Windows\System\fzIyKde.exe
  2⤵
  PID:9892
- C:\Windows\System\ixPrrfa.exe
  C:\Windows\System\ixPrrfa.exe
  2⤵
  PID:9908
- C:\Windows\System\vPfPObX.exe
  C:\Windows\System\vPfPObX.exe
  2⤵
  PID:9924
- C:\Windows\System\WBiWKtN.exe
  C:\Windows\System\WBiWKtN.exe
  2⤵
  PID:9944
- C:\Windows\System\quYKaEj.exe
  C:\Windows\System\quYKaEj.exe
  2⤵
  PID:9960
- C:\Windows\System\oQTEdSC.exe
  C:\Windows\System\oQTEdSC.exe
  2⤵
  PID:9976
- C:\Windows\System\CifeapV.exe
  C:\Windows\System\CifeapV.exe
  2⤵
  PID:9992
- C:\Windows\System\mQwiBxo.exe
  C:\Windows\System\mQwiBxo.exe
  2⤵
  PID:10008
- C:\Windows\System\iHJWhze.exe
  C:\Windows\System\iHJWhze.exe
  2⤵
  PID:10024
- C:\Windows\System\cJiaNpt.exe
  C:\Windows\System\cJiaNpt.exe
  2⤵
  PID:10040
- C:\Windows\System\LBpLYaU.exe
  C:\Windows\System\LBpLYaU.exe
  2⤵
  PID:10056
- C:\Windows\System\pjTSDoi.exe
  C:\Windows\System\pjTSDoi.exe
  2⤵
  PID:10072
- C:\Windows\System\QnzWVcE.exe
  C:\Windows\System\QnzWVcE.exe
  2⤵
  PID:10088
- C:\Windows\System\NGXJjUC.exe
  C:\Windows\System\NGXJjUC.exe
  2⤵
  PID:10104
- C:\Windows\System\evZCVEj.exe
  C:\Windows\System\evZCVEj.exe
  2⤵
  PID:10120
- C:\Windows\System\XzATQJL.exe
  C:\Windows\System\XzATQJL.exe
  2⤵
  PID:10136
- C:\Windows\System\nJfHfaB.exe
  C:\Windows\System\nJfHfaB.exe
  2⤵
  PID:10152
- C:\Windows\System\qCDBhHI.exe
  C:\Windows\System\qCDBhHI.exe
  2⤵
  PID:10168
- C:\Windows\System\GLwiUWA.exe
  C:\Windows\System\GLwiUWA.exe
  2⤵
  PID:10184
- C:\Windows\System\puGuZQB.exe
  C:\Windows\System\puGuZQB.exe
  2⤵
  PID:10200
- C:\Windows\System\YPYHNsa.exe
  C:\Windows\System\YPYHNsa.exe
  2⤵
  PID:10216
- C:\Windows\System\CVwjDrp.exe
  C:\Windows\System\CVwjDrp.exe
  2⤵
  PID:10232
- C:\Windows\System\nEwKjRR.exe
  C:\Windows\System\nEwKjRR.exe
  2⤵
  PID:8504
- C:\Windows\System\SUzwXxk.exe
  C:\Windows\System\SUzwXxk.exe
  2⤵
  PID:8904
- C:\Windows\System\wkdpiYn.exe
  C:\Windows\System\wkdpiYn.exe
  2⤵
  PID:8700
- C:\Windows\System\jndtwEV.exe
  C:\Windows\System\jndtwEV.exe
  2⤵
  PID:9260
- C:\Windows\System\IEXzPQe.exe
  C:\Windows\System\IEXzPQe.exe
  2⤵
  PID:9284
- C:\Windows\System\JSKpTsB.exe
  C:\Windows\System\JSKpTsB.exe
  2⤵
  PID:9308
- C:\Windows\System\bhcGXld.exe
  C:\Windows\System\bhcGXld.exe
  2⤵
  PID:9396
- C:\Windows\System\QrMAZaz.exe
  C:\Windows\System\QrMAZaz.exe
  2⤵
  PID:9428
- C:\Windows\System\uDqQjij.exe
  C:\Windows\System\uDqQjij.exe
  2⤵
  PID:9448
- C:\Windows\System\xZObjWY.exe
  C:\Windows\System\xZObjWY.exe
  2⤵
  PID:9496
- C:\Windows\System\JgnftEV.exe
  C:\Windows\System\JgnftEV.exe
  2⤵
  PID:9504
- C:\Windows\System\PnuFGUf.exe
  C:\Windows\System\PnuFGUf.exe
  2⤵
  PID:9540
- C:\Windows\System\GFYjKJz.exe
  C:\Windows\System\GFYjKJz.exe
  2⤵
  PID:9868
- C:\Windows\System\ddokIhn.exe
  C:\Windows\System\ddokIhn.exe
  2⤵
  PID:9856
- C:\Windows\System\SDAYIBE.exe
  C:\Windows\System\SDAYIBE.exe
  2⤵
  PID:9644
- C:\Windows\System\ZmcOjlW.exe
  C:\Windows\System\ZmcOjlW.exe
  2⤵
  PID:9744
- C:\Windows\System\cZiQmnk.exe
  C:\Windows\System\cZiQmnk.exe
  2⤵
  PID:9740
- C:\Windows\System\qetotCV.exe
  C:\Windows\System\qetotCV.exe
  2⤵
  PID:9508
- C:\Windows\System\fieqnrQ.exe
  C:\Windows\System\fieqnrQ.exe
  2⤵
  PID:9728
- C:\Windows\System\aCNukiX.exe
  C:\Windows\System\aCNukiX.exe
  2⤵
  PID:9364
- C:\Windows\System\lDwlpAy.exe
  C:\Windows\System\lDwlpAy.exe
  2⤵
  PID:9840
- C:\Windows\System\dJQjaFl.exe
  C:\Windows\System\dJQjaFl.exe
  2⤵
  PID:9792
- C:\Windows\System\ZsgmsJx.exe
  C:\Windows\System\ZsgmsJx.exe
  2⤵
  PID:9776
- C:\Windows\System\vdtVHoD.exe
  C:\Windows\System\vdtVHoD.exe
  2⤵
  PID:9956
- C:\Windows\System\XdcLpzf.exe
  C:\Windows\System\XdcLpzf.exe
  2⤵
  PID:9972
- C:\Windows\System\GulDHDN.exe
  C:\Windows\System\GulDHDN.exe
  2⤵
  PID:10048
- C:\Windows\System\lssAWUM.exe
  C:\Windows\System\lssAWUM.exe
  2⤵
  PID:10116
- C:\Windows\System\rRIBUtd.exe
  C:\Windows\System\rRIBUtd.exe
  2⤵
  PID:10032
- C:\Windows\System\isKdezk.exe
  C:\Windows\System\isKdezk.exe
  2⤵
  PID:10212
- C:\Windows\System\WxIourb.exe
  C:\Windows\System\WxIourb.exe
  2⤵
  PID:10160
- C:\Windows\System\zTLbIdB.exe
  C:\Windows\System\zTLbIdB.exe
  2⤵
  PID:8644
- C:\Windows\System\aygQsCk.exe
  C:\Windows\System\aygQsCk.exe
  2⤵
  PID:10036
- C:\Windows\System\jxsMzxz.exe
  C:\Windows\System\jxsMzxz.exe
  2⤵
  PID:10192
- C:\Windows\System\jlQIdUh.exe
  C:\Windows\System\jlQIdUh.exe
  2⤵
  PID:9244
- C:\Windows\System\ADwSVVq.exe
  C:\Windows\System\ADwSVVq.exe
  2⤵
  PID:9560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\APoXQdn.exe

Filesize
1.9MB

MD5
881ac7488a8edf12245511cf2fe5e154

SHA1
45711edbc6d20ce37af03f299564b0cec3a9c4b0

SHA256
5de1daedd524bc0117d35d01f967b1647bb136f609138755c1d22665eeb2245b

SHA512
57d20e363da93620854cda2d2f3d90dfe001521066758a9807ebcef11b2ab651ec3af97a1b5f6a2bc669dc2589990a4b6dcd1d26e1e6cc787eac639139bcb911

Download Submit
C:\Windows\system\GQuUOlP.exe

Filesize
1.9MB

MD5
dc9572aec4b670bfc66f9b48bfdfa566

SHA1
a1a423d909ebc62c4071f52d5d0406950c16ba8d

SHA256
2c43c6a81e182cceaec606f2d0e8bfb78d1f50769f531bbd4d99fb250cc69b25

SHA512
d680755fc75c5830541d18231c0228f004fb5807338a3700a337aad29165a62c3a67a276350473d0d75d50c08b48a0e251c77ff3b3298960fb26bc9e5f0deffa

Download Submit
C:\Windows\system\GUVEaXi.exe

Filesize
1.9MB

MD5
614dd144d3c3e11cb65c99db70fdedea

SHA1
7c05b6bb8982323c45cce275cb9669190c863d83

SHA256
f58d775afa718ce8f3197bc531cecc568937922ac6e0063124e2ea0350437605

SHA512
1599f925ec55da81ff6922a5cef0b54cff3c694ec213305828b83fa75208f98623fbe305e9a1606a282b430bf0d77b7a497b7af603dfabefc8ae9fff96e57bf3

Download Submit
C:\Windows\system\GvObEOW.exe

Filesize
1.9MB

MD5
c656fbc41d4db0c537b17c2b61ac5bff

SHA1
c56a9be7ae476c0b244d85476f39c5cf0bd768f9

SHA256
6fcfe002d71032fc690ef051f143c600bc4b28e320272eef2a64fdc7f4f16e03

SHA512
a006180eb38822ab0ff5b5408b0614a7ad5e60eab2a547c8f42c027aeeaeba9663f7726e316127ff956ab863826325053d8beb0db9503ce33b85fc4b98064ad1

Download Submit
C:\Windows\system\HOmxSGK.exe

Filesize
1.9MB

MD5
9c249bebd86d03bbfba08727bad4314c

SHA1
53b120e23947e88d3609cc99025c682c8f705f56

SHA256
0c94697cc3b694599c37949e60cfe646fb1c0eb5c66699df0f0b6f9d7fe3c394

SHA512
c926b0813f6eee6144bf4430be3f14780c5fd0ef5696d793518b783e59005f6490a3eae2fa61b97c97900ee82a629c282313e8dac0e416b83afbcb908fefb4a0

Download Submit
C:\Windows\system\JKeJASz.exe

Filesize
1.9MB

MD5
c6aca4af36d5e9b2468162bab610af5f

SHA1
8107beb5516b66fc1eb444a5ce4770bbd60c5b58

SHA256
bd7deff8a1c8091c2bd874f60c9d9f93c25cc48f56c53aa9a016f07508e61641

SHA512
667957e9abbead0cefa91d4816946aee1b32f8b0b9e77f2c9d515f88583ebc86861a83341a837c7c478bab67d63af90322c36fa9628b03d3a6799fac84dc13dd

Download Submit
C:\Windows\system\KthRECY.exe

Filesize
1.9MB

MD5
d76f41fe7b87e9c0bd7ac99d17baefad

SHA1
b45bbf49f0605afa24882ecdecfac03bd9424f63

SHA256
ed20a900e99bfd2746f157a027fcbd84c39dffb4bbafaab10595977941c7fc38

SHA512
eb2e60d43f4368737058572ca722949245121948dd1b624d0c42f3439900efad6ba09d836f13e8fbea869e146ffdc0968e17ee64b2dacc49b2e824d73217eedd

Download Submit
C:\Windows\system\QsJeKpv.exe

Filesize
1.9MB

MD5
185668e6b38221fda929d9595a74cec1

SHA1
8b388613482770d237f6f1dbc23393bd268c9eae

SHA256
28e0e10db304e9e90c857aca047379da6dee04861a92e2e3e9aed83fd3a9cd27

SHA512
dc9c399ffb539c6eab5eee543fcb92153d869cd76cd41fb86f022f267cd93a70d8d934d53c6cf50bd1d82f0c8437810e4f4b49298346617d30a4ac93d2df51c9

Download Submit
C:\Windows\system\QxgOJba.exe

Filesize
1.9MB

MD5
2dbbdcab8fa02d9f76f0c123d6ec8bb9

SHA1
60d05df09dd25ab6e2c0cf8f4cc0c202de21922c

SHA256
6287188b81be9373acc7a0f34dea1e89f7aba776b58479ff9681f38a70308830

SHA512
529b41ebf189126043b6031258a3a553b192109d5da0824d3afd982c4924179895176e573debf82f369a9561129cb42a9ca6cae4301b09d44a187a613ad5fd0b

Download Submit
C:\Windows\system\RhFsHvl.exe

Filesize
1.9MB

MD5
439de59b11f29aa9b446a4c7e00a4b5a

SHA1
a3613dba9015b565dad3619c243fec3e9a94a2e6

SHA256
670a7b9ab40545f69689b04c71bf28e753136ec92ea60f145b0d69cf303b3222

SHA512
267cfc09cbc1da75f529217f7b25ec120c5405fd3723a4ca8aa155fc2bd13cd963a202efe1f65e403192f004a88036f8d260b805f0de65c21f018f4868cb84a2

Download Submit
C:\Windows\system\TWobcFw.exe

Filesize
1.9MB

MD5
122054af0b874a2e3236f8ca37702939

SHA1
28c8d2c594174141abba39a571064f30b58cc7ca

SHA256
3725b87912eff6b3ea153af831fa8cf984fb5ea550790a7e2bc375f3460fab85

SHA512
c9f64aa028d765fedbdc46d96096863260753c13aa4d375ff5bb1dd76179c3c72f77c975713016e3224bc08a2e22dc2511559fb959311eb7984c7df8d5ae5ae8

Download Submit
C:\Windows\system\TokKplS.exe

Filesize
1.9MB

MD5
73fe7e895654443a3b1f25d8d422f8d6

SHA1
1b8daa28db1595652f15cad7455c77159994eea9

SHA256
33cbcdc53e485c5c718044e3bc690cef05e671e74d2adadf382f09e3dc402efc

SHA512
46210664b4d05c0e1c6cef708a20ced90ea6de975ff7132abac6a15a7695877df61ded0980f5837db680c21e23c99930ddef74de9665d3b8df13caf657a4b521

Download Submit
C:\Windows\system\YZMssTi.exe

Filesize
1.9MB

MD5
b8f07abd3fb2321fed35da81d1dc69c7

SHA1
7f9ec5c5f33f538cb986277fedd62186d368959f

SHA256
40358ddc253b12dd20e7cf610737453b2b7204aa983a5da03cc2bd05be643363

SHA512
679789ea197cbb1c572e96cbc5aa615cb5950ddc23daa04e0a07dcde03f93b443df273c02a6a1cf146d3027b976f24d0ed43035f38f8a364b7460e85fd679c0a

Download Submit
C:\Windows\system\aDoSWZI.exe

Filesize
1.9MB

MD5
c1b752569741335f97fba93031885c85

SHA1
a6f326c739036c29fd527be013078509a875a715

SHA256
94c3b9aac199990747c5eebc3f9098695df52020c9280b3f6d8d1514349d31a6

SHA512
315f24d8391cb4223f32120b9d83841c3eadb9d255ae48a9bfc552ff01e39f47104509a9cc26c3b0279c703b7de1463cb0a135483d141bf4d2cb3da9198e5124

Download Submit
C:\Windows\system\amXkXHe.exe

Filesize
1.9MB

MD5
c038358c4000cf7c7544b34f535fd36d

SHA1
8e9f0ad59e570f66efd8b0c83c44609da1452203

SHA256
3646916f6c0ffe952db6946c31c51d9776dae1a6ca09166ae8b9ae1ecd9cea75

SHA512
9b404bf450117d0c5ba7a301b55e54ad30ecfce4e5c6063d57df49d4603fa6475af1077de8ef453a355c182eacf590698e6148d7c4e1c4d2889f71652d9f6a2a

Download Submit
C:\Windows\system\dNgiJOI.exe

Filesize
1.9MB

MD5
ed5d174c0cab177122ac25cc68c420f8

SHA1
644a6ea68df83c9840acfc1f062615db192cd7b5

SHA256
d0b33ce7feae4cb02a43f4654a9f8d3b0fb358168c48948adbf33851cc4c6aaf

SHA512
6245dc35bad76c309d00edcf8fa726ace9fc8ba346a48d03729d151d44b0c638505dcc4e03e11049c4e7e2aa299312ba972c2c7a10f419de4d0d51dcb423928d

Download Submit
C:\Windows\system\eQHMEgQ.exe

Filesize
1.9MB

MD5
625899e9417d879786c50efec8d68ea6

SHA1
f3ce228dce048d01743304400850d283bee399af

SHA256
c6c07167434e839f0bffb963f4c835e74e7a0d7560d118a40fce09bd8ca566ec

SHA512
3946dc0c4def933678009c74647a874c453a1659e87fab70ff66071222205dbfae38d8311f2d98f58c8878d11be24f276c9540d73b087a932b371462f653a0b1

Download Submit
C:\Windows\system\fOAIVKN.exe

Filesize
1.9MB

MD5
ac1fa77a00d548e2098c758460a2891e

SHA1
caa61dd86f7c53d01b492556b5b15fe496b6e743

SHA256
7a97f2147e3931d7256442a29ee45a845c1e73998e662e0e44819af02cd77020

SHA512
c676152a11a01ff59eecbe6232355d04330ce9d132e6bd785d8b37d772115d40780a6e80a43b041763da309236ff23dae691666eb564e7c2f7c3322ffc4056d4

Download Submit
C:\Windows\system\hfMTsfg.exe

Filesize
1.9MB

MD5
f08b4d830d1d8d267ccc9b3fc0640f01

SHA1
7d4c54bea885e9384e86d9de687c420cbb3904fe

SHA256
8bc3cf34639b625ff2763158399319a8b536793f3115a7733c5bd2d7709735de

SHA512
2630ffbc72dcd10c53bb4ca00df964e41575dd636da9361d8e25519a84917c8d961b524e3b8c42a64a62595d4c5e46c2816341a7bb56abfd8540b7c59a224447

Download Submit
C:\Windows\system\mrguwem.exe

Filesize
1.9MB

MD5
89a35e452ae4401ae35f317f5f9ccf60

SHA1
ff150e7daa768bea6df7ac74a6693900c4a25a15

SHA256
8851a3bb746478f282dd30aec6e6e8d08241769bf0cbb95c295c838902d3b1c8

SHA512
afcf66a1487970629d4e3e039a6a800b0854b10067cac06de127f02c537740d51ea3aecf658f1a60442f23400ec335c625dea5b0f46d866297396b7a4fb4cc83

Download Submit
C:\Windows\system\ogFaVCO.exe

Filesize
1.9MB

MD5
9539fb386bedbe8d7c01bb1351b25d48

SHA1
65e2fba56a97ef3ee824a3e9c5b219b9f6bfc7bb

SHA256
73eb6558af64ee08ee39f8415220fcc6933f5424c2ad5834716787fefee3028c

SHA512
415e15b74c20d15e35082d0d9174a0c64204f90dfa2705b37b3de36bd3d7e0f70e43636ec33256ce49e792bed514634af6b7e74213f9dc16d99e9aef5b6a2e46

Download Submit
C:\Windows\system\pqdOOyF.exe

Filesize
1.9MB

MD5
d785de83187fedfd8f4984608ffdc2ef

SHA1
a4b81b8358b65b8bc6adbacee051aef3261aa492

SHA256
4fe9be3ca9faea24732990e4bf0877b1dc19a57a0a3941fc1f191ee5091d9d8c

SHA512
acb6d869c09c055b2cbc377dd17680c9fec0ef3f7033c23fa493007ebcd4b1d5524abb9bbdd98706ea1b40941a88626a6e8c6d3978bfe25f13ed43de7430ca3e

Download Submit
C:\Windows\system\tYHVYmZ.exe

Filesize
1.9MB

MD5
672e32c00215e89b138141a1bc250ee9

SHA1
2846e83f90457de10609a901cfea1791d7d1d184

SHA256
822bede91591dc323b1bcd377bfb1f6fd50d9819f45ed825eb997b28d9f534b9

SHA512
1bc6accab4746b8fff47ba8429d3fcdc7426722839ee5f36d0861e8daf184cf864ba377ae8bed71a341ff8f3263817bd973db5583ee11f126045defe85320fe3

Download Submit
C:\Windows\system\vwnsFCQ.exe

Filesize
1.9MB

MD5
2fe8edfdc007c2046bff1d8734805f0f

SHA1
b064464a583d4839d475e2e93ab316e8a2aa56d9

SHA256
1804a8490a97b04e01ef6eb76787f048c8d5ff35dad8292418ac385645047f3a

SHA512
f2a1339c70f46c3fff301734f01f803cd965bdfb657136cb474325d118f4909719166114e1faa742afba124ec12dba47a36b1016d98ca7451767d986c6329764

Download Submit
C:\Windows\system\yXiwZyg.exe

Filesize
1.9MB

MD5
b08717426a6dedbe8b5d60e3a8cf6f81

SHA1
49039d1ea55eb8b6c8d2e76f2d5a714dc60156fd

SHA256
3ade12b8bcf4db8f62d27392ac3e805509236ec6e5b364bef7361f3d97703287

SHA512
553b9a6d14d6cc9d0dc6050afbb89abfea4c5b0371ecfb948006d0f26d61781c8460f946a212950cb4727c7152e19d10e5fbf686f2291387242a5e9c47e39c64

Download Submit
C:\Windows\system\ykCnXuS.exe

Filesize
1.9MB

MD5
75063d8293661feeeef50ea8c7558831

SHA1
cb4cbc6c73fb9d078dcd23312db57f9c4f97bff2

SHA256
d2277e367af681ceee084a68ee94f8af9ed29b48f8ac6df3618d205b82b2ca7b

SHA512
78a23dc64ff431f5c6cd4f6085e752575d830df7165da954281a163c4f45cf3021bcc4d7cd80c88d68fd9c606ef28a9d3955fdc7d7aeaf7ebb1cf871f828c49e

Download Submit
C:\Windows\system\yuDPkZQ.exe

Filesize
1.9MB

MD5
0d043232cc6e4fa3ad9a85125f0157c2

SHA1
7dea61e03e26c175f59f0c1cd5890e61103a7329

SHA256
4568489e4ca3393c69058fae474eae57581af66e67ec10ab9267cca5b028f1cf

SHA512
eda5f81d74f58dc6b0e19f578a9861895da943a87a42429330def70ce0b94fe186387bde8e30e06c3b5279d82e758e14e7d9d970db97b8f54d922511e3968373

Download Submit
\Windows\system\QhaofXF.exe

Filesize
1.9MB

MD5
e43d3db537801ff29cc99f3a6b1519d8

SHA1
ce5905c0bf640823f79fabbc0daeed544c1b88ea

SHA256
9a4f84751693f2ee0ce128e4435112cb414e9f2a443a37c66be9809ba316f083

SHA512
a8728b87f9df2e0820ada2749a3e2c5a45f4edfadf0a64f3fcb5b4f260793eba4d2e5df3824d797892aba09ca9bd1e0be02199617d7a30c8da9606fa4022addc

Download Submit
\Windows\system\YpmccsT.exe

Filesize
1.9MB

MD5
f3e6a1cc32c1bcde7e706a5a81e7ffec

SHA1
637f056b412cec03d72eda095d7afaf6c9f06455

SHA256
a332ded2325ae3c34a63d6f6c07723194d26322ad494f82a86f2d5e8f862f2eb

SHA512
28dd1f2595f6f3e5c40cd05495b26d95ae2d4859547f94e16d2f29ddc8191eb19eaeb3c306208febe242e6144b75d3d620ae72dee15bdf1e39a4ad731416ffe6

Download Submit
\Windows\system\eWNLpsp.exe

Filesize
1.9MB

MD5
79dec729d765e58e5c0f75c658098f89

SHA1
60e21c58652360130a8e8d2f957a2ffe27f7a100

SHA256
0540dd317a73d1aa7019a3c96cab5640214946b9b0dd295a8178fb4d8d266fde

SHA512
90eb93c96677b4a7665f4ac1c1ce7c4f5d724c244b974e509cdeb3d0b132431bc9bf179fe85a06f36af4f1c1b8250226fd80415f145e41157155cd89c3d76878

Download Submit
\Windows\system\pQCBKfj.exe

Filesize
1.9MB

MD5
97653e5e3f6b0cf6fc6416c506c12f3f

SHA1
4751d5eda28560723645696ffe4ab54b355acd3e

SHA256
3aa98388ceb79aa18ef52034588cdea18a49c27bb74b0ddd342a46e0c6c09c86

SHA512
6eb07a515d73f41c0f34b5358ee23099765f94fe1ab54919788907e318d6cea2627c90a9b37b28099b6141837101910d9e02ddd1b064331e7e36e1d1ca045091

Download Submit
\Windows\system\yqxBwDy.exe

Filesize
1.9MB

MD5
354e922a3b249347a42a339b3dd7018f

SHA1
6d0bdc4d8b45c48f157bfb9e9c4bafac8b7d9bb0

SHA256
751bd058ee4a54abff2f2a807040c79382fc81ad2fc0c7f5f54740a683fe0496

SHA512
7ed6c8ceb5160dc7ca7ab53048ca50b7643c5bd6658cc3de1d0bdfbd911d98ec2ba46b196ffa3c1af8abdb9d6f420e911548be992d67300c0c874437fa6f2ae7

Download Submit
memory/2192-82-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/2492-98-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2544-23-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2560-88-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2608-96-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-94-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2648-56-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2704-102-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2728-92-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2820-97-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2820-57-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-99-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-78-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/2820-55-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2820-0-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-95-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-101-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2820-93-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-14-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2820-91-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2820-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2892-100-0x000007FEF5A40000-0x000007FEF63DD000-memory.dmp

Filesize
9.6MB

Download
memory/2892-51-0x000000001B790000-0x000000001BA72000-memory.dmp

Filesize
2.9MB

Download
memory/2892-54-0x00000000023A0000-0x0000000002420000-memory.dmp

Filesize
512KB

Download
memory/2892-53-0x00000000023A0000-0x0000000002420000-memory.dmp

Filesize
512KB

Download
memory/2892-61-0x0000000001E50000-0x0000000001E58000-memory.dmp

Filesize
32KB

Download
memory/2892-526-0x000007FEF5A40000-0x000007FEF63DD000-memory.dmp

Filesize
9.6MB

Download
memory/2892-52-0x000007FEF5A40000-0x000007FEF63DD000-memory.dmp

Filesize
9.6MB

Download