xmrig | 761f0cea271fa0e363096006837fc3c816393b65ff8a078d27e4f116cdb457cb

Analysis

max time kernel
34s
max time network
30s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 00:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
Size

1.9MB
MD5

065dd8fbdfc56e8c2bb8719f9e120325
SHA1

c17a9d1865062c05175d2c71c6abb110d0db419f
SHA256

761f0cea271fa0e363096006837fc3c816393b65ff8a078d27e4f116cdb457cb
SHA512

d8bdb9586af50c4eb8bcf33fedf529361e138136cd846e5a7d197d4adc36272881dc94c0e4a9054cd06aacb317da8c5b246a056e3e4b99e8f10e8606f48e5ac5
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlTjv:NABw

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2728-270-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/2460-259-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2604-239-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2508-276-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2416-275-0x0000000003530000-0x0000000003922000-memory.dmp	xmrig
behavioral1/memory/2616-274-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2672-237-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/2476-272-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2692-268-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2416-254-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2004-13-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2004	NSXgAel.exe
2672	uwxlOrj.exe
2604	dyihSPS.exe
2460	PXnmTOp.exe
2692	nYnUjEj.exe
2728	DSZdExx.exe
2476	XNGYlEn.exe
2616	xGYMFQU.exe
2508	sJiRola.exe
2448	wRStzTz.exe
2516	poEVDhk.exe
2964	JREBuAv.exe
1408	odvICpP.exe
2208	sdzJfQw.exe
2812	WADuUqf.exe
2768	TEvqllD.exe
2936	jtLvReA.exe
1684	GLywJbH.exe
2776	mzITZqL.exe
2740	OTfcaTC.exe
1196	JpywRhM.exe
2764	gTsZWXg.exe
1592	taciSWg.exe
2436	GCjZVyY.exe
1792	iCzaxMl.exe
2736	nhqApAc.exe
2092	LVAYxFn.exe
1380	qzgwpiZ.exe
536	XzLNtem.exe
1480	BLZIsqg.exe
2948	PZhznRq.exe
2424	hdYoECt.exe
412	iJbRMxk.exe
1108	wIQCXOZ.exe
2116	ZBJHvMl.exe
1372	VfXKyvo.exe
1040	qlzECTQ.exe
1316	tbQjrfZ.exe
360	AwwKBwy.exe
1324	RkhWopm.exe
1776	hBczHku.exe
688	UNvFdjh.exe
2384	AMxrkQZ.exe
2100	vLrXlEG.exe
1820	PrVwgEt.exe
280	oeCYyTa.exe
1980	IKeAxCR.exe
1800	UbOjByw.exe
948	uHWBhiw.exe
1016	QXfrnGN.exe
2352	kbryzIx.exe
1928	bvtzEis.exe
2008	sIAkXof.exe
2184	vRxukiM.exe
2404	ACJRobf.exe
3044	nNeNPHX.exe
1604	efavUVB.exe
996	FKFvfUp.exe
560	RWKMzii.exe
2696	nmnqZje.exe
2152	EhtzUuC.exe
2932	qOLYVnu.exe
2024	ewzAYRc.exe
3008	kYMmZAA.exe

Loads dropped DLL 64 IoCs

pid	Process
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2416-0-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/files/0x000c000000015cce-3.dat	upx
behavioral1/files/0x002a000000015d4c-15.dat	upx
behavioral1/files/0x001800000000558a-17.dat	upx
behavioral1/files/0x00080000000160cc-26.dat	upx
behavioral1/files/0x00070000000161b3-30.dat	upx
behavioral1/files/0x000900000001654a-38.dat	upx
behavioral1/files/0x00070000000165f0-41.dat	upx
behavioral1/files/0x0006000000016d1f-49.dat	upx
behavioral1/files/0x0006000000016d36-59.dat	upx
behavioral1/files/0x0006000000016db3-74.dat	upx
behavioral1/files/0x00060000000175ac-140.dat	upx
behavioral1/files/0x00060000000173e5-133.dat	upx
behavioral1/memory/2728-270-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/2460-259-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2604-239-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2508-276-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2616-274-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2672-237-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/2476-272-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/memory/2692-268-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/files/0x000500000001874c-168.dat	upx
behavioral1/files/0x0005000000018700-159.dat	upx
behavioral1/files/0x000500000001874a-162.dat	upx
behavioral1/files/0x0009000000018640-147.dat	upx
behavioral1/files/0x00060000000175b8-145.dat	upx
behavioral1/files/0x00050000000186c1-141.dat	upx
behavioral1/files/0x0006000000016fe8-80.dat	upx
behavioral1/files/0x00050000000186d3-150.dat	upx
behavioral1/files/0x000500000001865a-136.dat	upx
behavioral1/files/0x001500000001863c-125.dat	upx
behavioral1/files/0x00060000000175b2-110.dat	upx
behavioral1/files/0x000600000001744c-101.dat	upx
behavioral1/files/0x000600000001739d-100.dat	upx
behavioral1/files/0x0006000000016e78-78.dat	upx
behavioral1/files/0x0006000000016da4-70.dat	upx
behavioral1/files/0x0006000000016d9f-66.dat	upx
behavioral1/files/0x0006000000016d3a-62.dat	upx
behavioral1/files/0x0006000000016d32-53.dat	upx
behavioral1/files/0x0006000000016d16-45.dat	upx
behavioral1/files/0x00070000000162c9-33.dat	upx
behavioral1/memory/2004-13-0x000000013F880000-0x000000013FC72000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vPZJNDv.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\EVBiKKC.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\fIJLBsD.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\NetXNwV.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\igVQKst.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\qOGYkVk.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\uwxlOrj.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\VAmrZng.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\sVgNQft.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\rJKkigR.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\MwCqMKh.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\AfHAvGF.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\CKoVOeg.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\KcvROlI.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\PCrudwF.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\SmKSQLt.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\awlxYsg.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\szvYmWG.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\uubuUhE.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\HpWNqbF.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\VzMCQXM.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\sENNbLd.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\FkGjFEd.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\jtlOQUM.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\UykpCEn.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\UtsVVfp.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\YJUpNGi.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\MNjYNbK.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\StzPHhw.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\eOiFcDV.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\sIAkXof.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\mFTWevF.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\oSLvDUu.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\HQXCMWe.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\ZBJHvMl.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\mWtHlqh.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\gkVWnVM.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\XVOtgno.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\QdcqlzI.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\LMJKYQU.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\nMnpMzE.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\iCzaxMl.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\BCPNOlx.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\EsXCmYU.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\nBVtVuf.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\hTZYmFr.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\SipEpge.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\GiPZYZZ.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\rcfRdkC.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\OUToYvh.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\IAIuhff.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\bTnLtVD.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\iTYwgCM.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\ZdXcbSr.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\UAvEgiD.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\MKzXoCI.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\DBfBlYK.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\CBNnoOA.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\ZeaDldH.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\bzgExLS.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\EtOnOHI.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\NeAKGPc.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\yUZOrwG.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
File created	C:\Windows\System\hEbdpZB.exe	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2216	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
Token: SeDebugPrivilege	2216	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2216	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	29
PID 2416 wrote to memory of 2216	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	29
PID 2416 wrote to memory of 2216	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	29
PID 2416 wrote to memory of 2004	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	30
PID 2416 wrote to memory of 2004	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	30
PID 2416 wrote to memory of 2004	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	30
PID 2416 wrote to memory of 2672	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	31
PID 2416 wrote to memory of 2672	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	31
PID 2416 wrote to memory of 2672	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	31
PID 2416 wrote to memory of 2604	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	32
PID 2416 wrote to memory of 2604	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	32
PID 2416 wrote to memory of 2604	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	32
PID 2416 wrote to memory of 2460	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	33
PID 2416 wrote to memory of 2460	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	33
PID 2416 wrote to memory of 2460	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	33
PID 2416 wrote to memory of 2692	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	34
PID 2416 wrote to memory of 2692	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	34
PID 2416 wrote to memory of 2692	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	34
PID 2416 wrote to memory of 2728	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	35
PID 2416 wrote to memory of 2728	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	35
PID 2416 wrote to memory of 2728	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	35
PID 2416 wrote to memory of 2476	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	36
PID 2416 wrote to memory of 2476	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	36
PID 2416 wrote to memory of 2476	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	36
PID 2416 wrote to memory of 2616	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	37
PID 2416 wrote to memory of 2616	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	37
PID 2416 wrote to memory of 2616	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	37
PID 2416 wrote to memory of 2508	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	38
PID 2416 wrote to memory of 2508	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	38
PID 2416 wrote to memory of 2508	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	38
PID 2416 wrote to memory of 2448	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	39
PID 2416 wrote to memory of 2448	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	39
PID 2416 wrote to memory of 2448	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	39
PID 2416 wrote to memory of 2516	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	40
PID 2416 wrote to memory of 2516	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	40
PID 2416 wrote to memory of 2516	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	40
PID 2416 wrote to memory of 2964	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	41
PID 2416 wrote to memory of 2964	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	41
PID 2416 wrote to memory of 2964	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	41
PID 2416 wrote to memory of 1408	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	42
PID 2416 wrote to memory of 1408	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	42
PID 2416 wrote to memory of 1408	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	42
PID 2416 wrote to memory of 2208	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	43
PID 2416 wrote to memory of 2208	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	43
PID 2416 wrote to memory of 2208	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	43
PID 2416 wrote to memory of 2812	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	44
PID 2416 wrote to memory of 2812	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	44
PID 2416 wrote to memory of 2812	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	44
PID 2416 wrote to memory of 2768	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	45
PID 2416 wrote to memory of 2768	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	45
PID 2416 wrote to memory of 2768	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	45
PID 2416 wrote to memory of 2936	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	46
PID 2416 wrote to memory of 2936	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	46
PID 2416 wrote to memory of 2936	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	46
PID 2416 wrote to memory of 2764	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	47
PID 2416 wrote to memory of 2764	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	47
PID 2416 wrote to memory of 2764	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	47
PID 2416 wrote to memory of 1684	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	48
PID 2416 wrote to memory of 1684	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	48
PID 2416 wrote to memory of 1684	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	48
PID 2416 wrote to memory of 1592	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	49
PID 2416 wrote to memory of 1592	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	49
PID 2416 wrote to memory of 1592	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	49
PID 2416 wrote to memory of 2776	2416	065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\065dd8fbdfc56e8c2bb8719f9e120325_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\System\NSXgAel.exe
  C:\Windows\System\NSXgAel.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\uwxlOrj.exe
  C:\Windows\System\uwxlOrj.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\dyihSPS.exe
  C:\Windows\System\dyihSPS.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\PXnmTOp.exe
  C:\Windows\System\PXnmTOp.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\nYnUjEj.exe
  C:\Windows\System\nYnUjEj.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\DSZdExx.exe
  C:\Windows\System\DSZdExx.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\XNGYlEn.exe
  C:\Windows\System\XNGYlEn.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\xGYMFQU.exe
  C:\Windows\System\xGYMFQU.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\sJiRola.exe
  C:\Windows\System\sJiRola.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\wRStzTz.exe
  C:\Windows\System\wRStzTz.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\poEVDhk.exe
  C:\Windows\System\poEVDhk.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\JREBuAv.exe
  C:\Windows\System\JREBuAv.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\odvICpP.exe
  C:\Windows\System\odvICpP.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\sdzJfQw.exe
  C:\Windows\System\sdzJfQw.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\WADuUqf.exe
  C:\Windows\System\WADuUqf.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\TEvqllD.exe
  C:\Windows\System\TEvqllD.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\jtLvReA.exe
  C:\Windows\System\jtLvReA.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\gTsZWXg.exe
  C:\Windows\System\gTsZWXg.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\GLywJbH.exe
  C:\Windows\System\GLywJbH.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\taciSWg.exe
  C:\Windows\System\taciSWg.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\mzITZqL.exe
  C:\Windows\System\mzITZqL.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\iCzaxMl.exe
  C:\Windows\System\iCzaxMl.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\OTfcaTC.exe
  C:\Windows\System\OTfcaTC.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\nhqApAc.exe
  C:\Windows\System\nhqApAc.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\JpywRhM.exe
  C:\Windows\System\JpywRhM.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\LVAYxFn.exe
  C:\Windows\System\LVAYxFn.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\GCjZVyY.exe
  C:\Windows\System\GCjZVyY.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\XzLNtem.exe
  C:\Windows\System\XzLNtem.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\qzgwpiZ.exe
  C:\Windows\System\qzgwpiZ.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\BLZIsqg.exe
  C:\Windows\System\BLZIsqg.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\PZhznRq.exe
  C:\Windows\System\PZhznRq.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\hdYoECt.exe
  C:\Windows\System\hdYoECt.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\iJbRMxk.exe
  C:\Windows\System\iJbRMxk.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\wIQCXOZ.exe
  C:\Windows\System\wIQCXOZ.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\ZBJHvMl.exe
  C:\Windows\System\ZBJHvMl.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\qlzECTQ.exe
  C:\Windows\System\qlzECTQ.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\VfXKyvo.exe
  C:\Windows\System\VfXKyvo.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\hBczHku.exe
  C:\Windows\System\hBczHku.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\tbQjrfZ.exe
  C:\Windows\System\tbQjrfZ.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\oeCYyTa.exe
  C:\Windows\System\oeCYyTa.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\AwwKBwy.exe
  C:\Windows\System\AwwKBwy.exe
  2⤵
  - Executes dropped EXE
  PID:360
- C:\Windows\System\UbOjByw.exe
  C:\Windows\System\UbOjByw.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\RkhWopm.exe
  C:\Windows\System\RkhWopm.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\uHWBhiw.exe
  C:\Windows\System\uHWBhiw.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\UNvFdjh.exe
  C:\Windows\System\UNvFdjh.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\QXfrnGN.exe
  C:\Windows\System\QXfrnGN.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\AMxrkQZ.exe
  C:\Windows\System\AMxrkQZ.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\kbryzIx.exe
  C:\Windows\System\kbryzIx.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\vLrXlEG.exe
  C:\Windows\System\vLrXlEG.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\bvtzEis.exe
  C:\Windows\System\bvtzEis.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\PrVwgEt.exe
  C:\Windows\System\PrVwgEt.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\sIAkXof.exe
  C:\Windows\System\sIAkXof.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\IKeAxCR.exe
  C:\Windows\System\IKeAxCR.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\vRxukiM.exe
  C:\Windows\System\vRxukiM.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\ACJRobf.exe
  C:\Windows\System\ACJRobf.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\nNeNPHX.exe
  C:\Windows\System\nNeNPHX.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\efavUVB.exe
  C:\Windows\System\efavUVB.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\FKFvfUp.exe
  C:\Windows\System\FKFvfUp.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\RWKMzii.exe
  C:\Windows\System\RWKMzii.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\VNWPGMY.exe
  C:\Windows\System\VNWPGMY.exe
  2⤵
  PID:2864
- C:\Windows\System\nmnqZje.exe
  C:\Windows\System\nmnqZje.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\ULlEstV.exe
  C:\Windows\System\ULlEstV.exe
  2⤵
  PID:320
- C:\Windows\System\EhtzUuC.exe
  C:\Windows\System\EhtzUuC.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\dkKSwCE.exe
  C:\Windows\System\dkKSwCE.exe
  2⤵
  PID:3004
- C:\Windows\System\qOLYVnu.exe
  C:\Windows\System\qOLYVnu.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\QZFyLuo.exe
  C:\Windows\System\QZFyLuo.exe
  2⤵
  PID:2520
- C:\Windows\System\ewzAYRc.exe
  C:\Windows\System\ewzAYRc.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\wROonEt.exe
  C:\Windows\System\wROonEt.exe
  2⤵
  PID:1816
- C:\Windows\System\kYMmZAA.exe
  C:\Windows\System\kYMmZAA.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\eoevIWY.exe
  C:\Windows\System\eoevIWY.exe
  2⤵
  PID:2640
- C:\Windows\System\BewsBYF.exe
  C:\Windows\System\BewsBYF.exe
  2⤵
  PID:1248
- C:\Windows\System\rcfRdkC.exe
  C:\Windows\System\rcfRdkC.exe
  2⤵
  PID:800
- C:\Windows\System\jgPycxy.exe
  C:\Windows\System\jgPycxy.exe
  2⤵
  PID:2272
- C:\Windows\System\qpFwABS.exe
  C:\Windows\System\qpFwABS.exe
  2⤵
  PID:1504
- C:\Windows\System\pnjZUYU.exe
  C:\Windows\System\pnjZUYU.exe
  2⤵
  PID:2888
- C:\Windows\System\kDKmobd.exe
  C:\Windows\System\kDKmobd.exe
  2⤵
  PID:480
- C:\Windows\System\GEKhXdk.exe
  C:\Windows\System\GEKhXdk.exe
  2⤵
  PID:2420
- C:\Windows\System\MJTBdsh.exe
  C:\Windows\System\MJTBdsh.exe
  2⤵
  PID:1136
- C:\Windows\System\AaDNoDq.exe
  C:\Windows\System\AaDNoDq.exe
  2⤵
  PID:2084
- C:\Windows\System\qOrKrgs.exe
  C:\Windows\System\qOrKrgs.exe
  2⤵
  PID:2596
- C:\Windows\System\MVQTUIs.exe
  C:\Windows\System\MVQTUIs.exe
  2⤵
  PID:2488
- C:\Windows\System\VsHFEAW.exe
  C:\Windows\System\VsHFEAW.exe
  2⤵
  PID:676
- C:\Windows\System\QwfNFEB.exe
  C:\Windows\System\QwfNFEB.exe
  2⤵
  PID:2808
- C:\Windows\System\YCtqyXB.exe
  C:\Windows\System\YCtqyXB.exe
  2⤵
  PID:900
- C:\Windows\System\EuDkHWf.exe
  C:\Windows\System\EuDkHWf.exe
  2⤵
  PID:2844
- C:\Windows\System\YEhSzOH.exe
  C:\Windows\System\YEhSzOH.exe
  2⤵
  PID:2572
- C:\Windows\System\pgzgpAD.exe
  C:\Windows\System\pgzgpAD.exe
  2⤵
  PID:1308
- C:\Windows\System\swLBmWz.exe
  C:\Windows\System\swLBmWz.exe
  2⤵
  PID:2340
- C:\Windows\System\YQswsbw.exe
  C:\Windows\System\YQswsbw.exe
  2⤵
  PID:2828
- C:\Windows\System\wmzosdJ.exe
  C:\Windows\System\wmzosdJ.exe
  2⤵
  PID:2108
- C:\Windows\System\KTLeFKW.exe
  C:\Windows\System\KTLeFKW.exe
  2⤵
  PID:1700
- C:\Windows\System\jyCtqyA.exe
  C:\Windows\System\jyCtqyA.exe
  2⤵
  PID:612
- C:\Windows\System\bHGNfbQ.exe
  C:\Windows\System\bHGNfbQ.exe
  2⤵
  PID:2536
- C:\Windows\System\pcnJFnN.exe
  C:\Windows\System\pcnJFnN.exe
  2⤵
  PID:2912
- C:\Windows\System\JzlZPev.exe
  C:\Windows\System\JzlZPev.exe
  2⤵
  PID:552
- C:\Windows\System\ZmxNuSK.exe
  C:\Windows\System\ZmxNuSK.exe
  2⤵
  PID:2928
- C:\Windows\System\JqnxrZF.exe
  C:\Windows\System\JqnxrZF.exe
  2⤵
  PID:1320
- C:\Windows\System\eEbMHST.exe
  C:\Windows\System\eEbMHST.exe
  2⤵
  PID:2032
- C:\Windows\System\NHSMUyP.exe
  C:\Windows\System\NHSMUyP.exe
  2⤵
  PID:2576
- C:\Windows\System\SogDFdc.exe
  C:\Windows\System\SogDFdc.exe
  2⤵
  PID:2472
- C:\Windows\System\zYObilX.exe
  C:\Windows\System\zYObilX.exe
  2⤵
  PID:1624
- C:\Windows\System\NlgYGgs.exe
  C:\Windows\System\NlgYGgs.exe
  2⤵
  PID:2976
- C:\Windows\System\fXSqbbR.exe
  C:\Windows\System\fXSqbbR.exe
  2⤵
  PID:2412
- C:\Windows\System\WssfqQw.exe
  C:\Windows\System\WssfqQw.exe
  2⤵
  PID:2680
- C:\Windows\System\qLmdNZA.exe
  C:\Windows\System\qLmdNZA.exe
  2⤵
  PID:2204
- C:\Windows\System\HQXCMWe.exe
  C:\Windows\System\HQXCMWe.exe
  2⤵
  PID:2568
- C:\Windows\System\KEyprWB.exe
  C:\Windows\System\KEyprWB.exe
  2⤵
  PID:2268
- C:\Windows\System\ItUcoOs.exe
  C:\Windows\System\ItUcoOs.exe
  2⤵
  PID:2540
- C:\Windows\System\GvqkSWv.exe
  C:\Windows\System\GvqkSWv.exe
  2⤵
  PID:240
- C:\Windows\System\XGPKuuQ.exe
  C:\Windows\System\XGPKuuQ.exe
  2⤵
  PID:620
- C:\Windows\System\UcvCgXD.exe
  C:\Windows\System\UcvCgXD.exe
  2⤵
  PID:336
- C:\Windows\System\zBgdjdM.exe
  C:\Windows\System\zBgdjdM.exe
  2⤵
  PID:1868
- C:\Windows\System\KwLmPth.exe
  C:\Windows\System\KwLmPth.exe
  2⤵
  PID:1972
- C:\Windows\System\fHoxuju.exe
  C:\Windows\System\fHoxuju.exe
  2⤵
  PID:2180
- C:\Windows\System\ciKzdVn.exe
  C:\Windows\System\ciKzdVn.exe
  2⤵
  PID:2720
- C:\Windows\System\FFbwCHY.exe
  C:\Windows\System\FFbwCHY.exe
  2⤵
  PID:2528
- C:\Windows\System\fGTEqIU.exe
  C:\Windows\System\fGTEqIU.exe
  2⤵
  PID:908
- C:\Windows\System\nYWyyrh.exe
  C:\Windows\System\nYWyyrh.exe
  2⤵
  PID:2356
- C:\Windows\System\DblbNNO.exe
  C:\Windows\System\DblbNNO.exe
  2⤵
  PID:2200
- C:\Windows\System\SLzbJxu.exe
  C:\Windows\System\SLzbJxu.exe
  2⤵
  PID:2632
- C:\Windows\System\hXAOMHr.exe
  C:\Windows\System\hXAOMHr.exe
  2⤵
  PID:2856
- C:\Windows\System\IEOXoSl.exe
  C:\Windows\System\IEOXoSl.exe
  2⤵
  PID:1988
- C:\Windows\System\JkWAcIz.exe
  C:\Windows\System\JkWAcIz.exe
  2⤵
  PID:1840
- C:\Windows\System\ksNqxpw.exe
  C:\Windows\System\ksNqxpw.exe
  2⤵
  PID:2256
- C:\Windows\System\vwxkTAM.exe
  C:\Windows\System\vwxkTAM.exe
  2⤵
  PID:2716
- C:\Windows\System\oXTjzjf.exe
  C:\Windows\System\oXTjzjf.exe
  2⤵
  PID:2020
- C:\Windows\System\gUoNOKf.exe
  C:\Windows\System\gUoNOKf.exe
  2⤵
  PID:1576
- C:\Windows\System\yytPksI.exe
  C:\Windows\System\yytPksI.exe
  2⤵
  PID:1656
- C:\Windows\System\vixRDSS.exe
  C:\Windows\System\vixRDSS.exe
  2⤵
  PID:1036
- C:\Windows\System\FDcNQZm.exe
  C:\Windows\System\FDcNQZm.exe
  2⤵
  PID:1388
- C:\Windows\System\mwnPhvL.exe
  C:\Windows\System\mwnPhvL.exe
  2⤵
  PID:2884
- C:\Windows\System\umZElAs.exe
  C:\Windows\System\umZElAs.exe
  2⤵
  PID:1680
- C:\Windows\System\HZlabcp.exe
  C:\Windows\System\HZlabcp.exe
  2⤵
  PID:1876
- C:\Windows\System\oaJoaFS.exe
  C:\Windows\System\oaJoaFS.exe
  2⤵
  PID:2588
- C:\Windows\System\TDzlHpa.exe
  C:\Windows\System\TDzlHpa.exe
  2⤵
  PID:1724
- C:\Windows\System\YlhZmdw.exe
  C:\Windows\System\YlhZmdw.exe
  2⤵
  PID:3084
- C:\Windows\System\mWtHlqh.exe
  C:\Windows\System\mWtHlqh.exe
  2⤵
  PID:3100
- C:\Windows\System\KPDrxwX.exe
  C:\Windows\System\KPDrxwX.exe
  2⤵
  PID:3116
- C:\Windows\System\vjKDeLp.exe
  C:\Windows\System\vjKDeLp.exe
  2⤵
  PID:3144
- C:\Windows\System\fIJLBsD.exe
  C:\Windows\System\fIJLBsD.exe
  2⤵
  PID:3160
- C:\Windows\System\DhYRgcq.exe
  C:\Windows\System\DhYRgcq.exe
  2⤵
  PID:3176
- C:\Windows\System\noACZVN.exe
  C:\Windows\System\noACZVN.exe
  2⤵
  PID:3192
- C:\Windows\System\KfRQnBY.exe
  C:\Windows\System\KfRQnBY.exe
  2⤵
  PID:3208
- C:\Windows\System\TdpTNbm.exe
  C:\Windows\System\TdpTNbm.exe
  2⤵
  PID:3224
- C:\Windows\System\FZraJPL.exe
  C:\Windows\System\FZraJPL.exe
  2⤵
  PID:3240
- C:\Windows\System\xnlpmwV.exe
  C:\Windows\System\xnlpmwV.exe
  2⤵
  PID:3256
- C:\Windows\System\UykpCEn.exe
  C:\Windows\System\UykpCEn.exe
  2⤵
  PID:3276
- C:\Windows\System\bNCutRZ.exe
  C:\Windows\System\bNCutRZ.exe
  2⤵
  PID:3292
- C:\Windows\System\dbiXlOR.exe
  C:\Windows\System\dbiXlOR.exe
  2⤵
  PID:3308
- C:\Windows\System\DaUDwpc.exe
  C:\Windows\System\DaUDwpc.exe
  2⤵
  PID:3324
- C:\Windows\System\QmrFHbU.exe
  C:\Windows\System\QmrFHbU.exe
  2⤵
  PID:3340
- C:\Windows\System\vBkMTji.exe
  C:\Windows\System\vBkMTji.exe
  2⤵
  PID:3356
- C:\Windows\System\QbHJleD.exe
  C:\Windows\System\QbHJleD.exe
  2⤵
  PID:3388
- C:\Windows\System\sFhjXSw.exe
  C:\Windows\System\sFhjXSw.exe
  2⤵
  PID:3408
- C:\Windows\System\rpFdMrB.exe
  C:\Windows\System\rpFdMrB.exe
  2⤵
  PID:3428
- C:\Windows\System\qlmSKEK.exe
  C:\Windows\System\qlmSKEK.exe
  2⤵
  PID:3444
- C:\Windows\System\WkjotPn.exe
  C:\Windows\System\WkjotPn.exe
  2⤵
  PID:3464
- C:\Windows\System\iQqOlFp.exe
  C:\Windows\System\iQqOlFp.exe
  2⤵
  PID:3480
- C:\Windows\System\OUKjURE.exe
  C:\Windows\System\OUKjURE.exe
  2⤵
  PID:3500
- C:\Windows\System\AcKiQJh.exe
  C:\Windows\System\AcKiQJh.exe
  2⤵
  PID:3516
- C:\Windows\System\kQLGBus.exe
  C:\Windows\System\kQLGBus.exe
  2⤵
  PID:3544
- C:\Windows\System\GKiNgZd.exe
  C:\Windows\System\GKiNgZd.exe
  2⤵
  PID:3564
- C:\Windows\System\syWwWnb.exe
  C:\Windows\System\syWwWnb.exe
  2⤵
  PID:3580
- C:\Windows\System\tjWOGfL.exe
  C:\Windows\System\tjWOGfL.exe
  2⤵
  PID:3596
- C:\Windows\System\LGcbPyC.exe
  C:\Windows\System\LGcbPyC.exe
  2⤵
  PID:3612
- C:\Windows\System\aZxCPSy.exe
  C:\Windows\System\aZxCPSy.exe
  2⤵
  PID:3632
- C:\Windows\System\BAedKtP.exe
  C:\Windows\System\BAedKtP.exe
  2⤵
  PID:3648
- C:\Windows\System\VLiQXsn.exe
  C:\Windows\System\VLiQXsn.exe
  2⤵
  PID:3664
- C:\Windows\System\hBMowoF.exe
  C:\Windows\System\hBMowoF.exe
  2⤵
  PID:3680
- C:\Windows\System\cWzHLaZ.exe
  C:\Windows\System\cWzHLaZ.exe
  2⤵
  PID:3700
- C:\Windows\System\JlrnfSY.exe
  C:\Windows\System\JlrnfSY.exe
  2⤵
  PID:3716
- C:\Windows\System\DCIzeED.exe
  C:\Windows\System\DCIzeED.exe
  2⤵
  PID:3732
- C:\Windows\System\NGcZXeO.exe
  C:\Windows\System\NGcZXeO.exe
  2⤵
  PID:3748
- C:\Windows\System\TtyCXMt.exe
  C:\Windows\System\TtyCXMt.exe
  2⤵
  PID:3780
- C:\Windows\System\AnfGGER.exe
  C:\Windows\System\AnfGGER.exe
  2⤵
  PID:3804
- C:\Windows\System\VVZWgmF.exe
  C:\Windows\System\VVZWgmF.exe
  2⤵
  PID:3820
- C:\Windows\System\dicerPo.exe
  C:\Windows\System\dicerPo.exe
  2⤵
  PID:3836
- C:\Windows\System\CRxRwva.exe
  C:\Windows\System\CRxRwva.exe
  2⤵
  PID:3856
- C:\Windows\System\vUmkJiS.exe
  C:\Windows\System\vUmkJiS.exe
  2⤵
  PID:3876
- C:\Windows\System\TKzhLJP.exe
  C:\Windows\System\TKzhLJP.exe
  2⤵
  PID:3896
- C:\Windows\System\FbLHqJg.exe
  C:\Windows\System\FbLHqJg.exe
  2⤵
  PID:3912
- C:\Windows\System\UQLAqde.exe
  C:\Windows\System\UQLAqde.exe
  2⤵
  PID:3932
- C:\Windows\System\SYqXLct.exe
  C:\Windows\System\SYqXLct.exe
  2⤵
  PID:3948
- C:\Windows\System\MfvcqOv.exe
  C:\Windows\System\MfvcqOv.exe
  2⤵
  PID:3964
- C:\Windows\System\NeAKGPc.exe
  C:\Windows\System\NeAKGPc.exe
  2⤵
  PID:3984
- C:\Windows\System\ssNNRIq.exe
  C:\Windows\System\ssNNRIq.exe
  2⤵
  PID:4000
- C:\Windows\System\MuHSVKV.exe
  C:\Windows\System\MuHSVKV.exe
  2⤵
  PID:4016
- C:\Windows\System\ECmSaEL.exe
  C:\Windows\System\ECmSaEL.exe
  2⤵
  PID:4036
- C:\Windows\System\ZwVhlYZ.exe
  C:\Windows\System\ZwVhlYZ.exe
  2⤵
  PID:4056
- C:\Windows\System\pTaSbCY.exe
  C:\Windows\System\pTaSbCY.exe
  2⤵
  PID:4072
- C:\Windows\System\cLITPLv.exe
  C:\Windows\System\cLITPLv.exe
  2⤵
  PID:4088
- C:\Windows\System\ppDDMgt.exe
  C:\Windows\System\ppDDMgt.exe
  2⤵
  PID:1616
- C:\Windows\System\YxMeASp.exe
  C:\Windows\System\YxMeASp.exe
  2⤵
  PID:1996
- C:\Windows\System\gsmzJEp.exe
  C:\Windows\System\gsmzJEp.exe
  2⤵
  PID:632
- C:\Windows\System\jmiwLQP.exe
  C:\Windows\System\jmiwLQP.exe
  2⤵
  PID:3076
- C:\Windows\System\jTKPkKD.exe
  C:\Windows\System\jTKPkKD.exe
  2⤵
  PID:2512
- C:\Windows\System\IAIuhff.exe
  C:\Windows\System\IAIuhff.exe
  2⤵
  PID:356
- C:\Windows\System\fDZjueH.exe
  C:\Windows\System\fDZjueH.exe
  2⤵
  PID:1788
- C:\Windows\System\xXjuqMC.exe
  C:\Windows\System\xXjuqMC.exe
  2⤵
  PID:2500
- C:\Windows\System\WnyvadA.exe
  C:\Windows\System\WnyvadA.exe
  2⤵
  PID:3152
- C:\Windows\System\NcgIdGr.exe
  C:\Windows\System\NcgIdGr.exe
  2⤵
  PID:3092
- C:\Windows\System\sepbqKM.exe
  C:\Windows\System\sepbqKM.exe
  2⤵
  PID:3136
- C:\Windows\System\zGQcbdb.exe
  C:\Windows\System\zGQcbdb.exe
  2⤵
  PID:3168
- C:\Windows\System\pqRMjGI.exe
  C:\Windows\System\pqRMjGI.exe
  2⤵
  PID:3220
- C:\Windows\System\NLVIpDq.exe
  C:\Windows\System\NLVIpDq.exe
  2⤵
  PID:3200
- C:\Windows\System\jznAkEI.exe
  C:\Windows\System\jznAkEI.exe
  2⤵
  PID:3264
- C:\Windows\System\szbQglZ.exe
  C:\Windows\System\szbQglZ.exe
  2⤵
  PID:3320
- C:\Windows\System\CFrULSu.exe
  C:\Windows\System\CFrULSu.exe
  2⤵
  PID:3268
- C:\Windows\System\CICHwYV.exe
  C:\Windows\System\CICHwYV.exe
  2⤵
  PID:2544
- C:\Windows\System\aEyWQTe.exe
  C:\Windows\System\aEyWQTe.exe
  2⤵
  PID:3396
- C:\Windows\System\mCUMrpP.exe
  C:\Windows\System\mCUMrpP.exe
  2⤵
  PID:3372
- C:\Windows\System\LcZDxhJ.exe
  C:\Windows\System\LcZDxhJ.exe
  2⤵
  PID:2972
- C:\Windows\System\jNTBENQ.exe
  C:\Windows\System\jNTBENQ.exe
  2⤵
  PID:3476
- C:\Windows\System\uPwcXWY.exe
  C:\Windows\System\uPwcXWY.exe
  2⤵
  PID:3460
- C:\Windows\System\Pbhvqrc.exe
  C:\Windows\System\Pbhvqrc.exe
  2⤵
  PID:3496
- C:\Windows\System\coYqdIL.exe
  C:\Windows\System\coYqdIL.exe
  2⤵
  PID:3488
- C:\Windows\System\YiHnYHt.exe
  C:\Windows\System\YiHnYHt.exe
  2⤵
  PID:3552
- C:\Windows\System\NeuxadM.exe
  C:\Windows\System\NeuxadM.exe
  2⤵
  PID:3592
- C:\Windows\System\fQvzUry.exe
  C:\Windows\System\fQvzUry.exe
  2⤵
  PID:3656
- C:\Windows\System\SzTkscL.exe
  C:\Windows\System\SzTkscL.exe
  2⤵
  PID:3536
- C:\Windows\System\kjrKjro.exe
  C:\Windows\System\kjrKjro.exe
  2⤵
  PID:3608
- C:\Windows\System\GUmkHps.exe
  C:\Windows\System\GUmkHps.exe
  2⤵
  PID:3728
- C:\Windows\System\gkVWnVM.exe
  C:\Windows\System\gkVWnVM.exe
  2⤵
  PID:2652
- C:\Windows\System\goRxPnc.exe
  C:\Windows\System\goRxPnc.exe
  2⤵
  PID:3772
- C:\Windows\System\fttctSX.exe
  C:\Windows\System\fttctSX.exe
  2⤵
  PID:3740
- C:\Windows\System\UtsVVfp.exe
  C:\Windows\System\UtsVVfp.exe
  2⤵
  PID:2128
- C:\Windows\System\cSwWcVE.exe
  C:\Windows\System\cSwWcVE.exe
  2⤵
  PID:3848
- C:\Windows\System\NetXNwV.exe
  C:\Windows\System\NetXNwV.exe
  2⤵
  PID:3788
- C:\Windows\System\JJxuXHo.exe
  C:\Windows\System\JJxuXHo.exe
  2⤵
  PID:672
- C:\Windows\System\nAXdqey.exe
  C:\Windows\System\nAXdqey.exe
  2⤵
  PID:3872
- C:\Windows\System\HAfdDNR.exe
  C:\Windows\System\HAfdDNR.exe
  2⤵
  PID:3996
- C:\Windows\System\PwmHXAH.exe
  C:\Windows\System\PwmHXAH.exe
  2⤵
  PID:3792
- C:\Windows\System\UrfUlIV.exe
  C:\Windows\System\UrfUlIV.exe
  2⤵
  PID:3832
- C:\Windows\System\nOuHOWR.exe
  C:\Windows\System\nOuHOWR.exe
  2⤵
  PID:3980
- C:\Windows\System\qQibGGN.exe
  C:\Windows\System\qQibGGN.exe
  2⤵
  PID:2296
- C:\Windows\System\uzMLtGC.exe
  C:\Windows\System\uzMLtGC.exe
  2⤵
  PID:1748
- C:\Windows\System\fPFtEMq.exe
  C:\Windows\System\fPFtEMq.exe
  2⤵
  PID:1132
- C:\Windows\System\yUZOrwG.exe
  C:\Windows\System\yUZOrwG.exe
  2⤵
  PID:3216
- C:\Windows\System\oVcqSry.exe
  C:\Windows\System\oVcqSry.exe
  2⤵
  PID:3352
- C:\Windows\System\xGwtQHz.exe
  C:\Windows\System\xGwtQHz.exe
  2⤵
  PID:3336
- C:\Windows\System\MKWDFyd.exe
  C:\Windows\System\MKWDFyd.exe
  2⤵
  PID:2880
- C:\Windows\System\yJasuqX.exe
  C:\Windows\System\yJasuqX.exe
  2⤵
  PID:3300
- C:\Windows\System\xTmkOSC.exe
  C:\Windows\System\xTmkOSC.exe
  2⤵
  PID:3368
- C:\Windows\System\EnwOzvK.exe
  C:\Windows\System\EnwOzvK.exe
  2⤵
  PID:3976
- C:\Windows\System\BriwWGd.exe
  C:\Windows\System\BriwWGd.exe
  2⤵
  PID:4048
- C:\Windows\System\BHCFwdh.exe
  C:\Windows\System\BHCFwdh.exe
  2⤵
  PID:3908
- C:\Windows\System\RpsHwBK.exe
  C:\Windows\System\RpsHwBK.exe
  2⤵
  PID:960
- C:\Windows\System\YgKnESQ.exe
  C:\Windows\System\YgKnESQ.exe
  2⤵
  PID:1864
- C:\Windows\System\dEVGTND.exe
  C:\Windows\System\dEVGTND.exe
  2⤵
  PID:3252
- C:\Windows\System\XiMyKqB.exe
  C:\Windows\System\XiMyKqB.exe
  2⤵
  PID:3492
- C:\Windows\System\wjWzrQY.exe
  C:\Windows\System\wjWzrQY.exe
  2⤵
  PID:284
- C:\Windows\System\coIONIV.exe
  C:\Windows\System\coIONIV.exe
  2⤵
  PID:3724
- C:\Windows\System\WqJgPEC.exe
  C:\Windows\System\WqJgPEC.exe
  2⤵
  PID:2988
- C:\Windows\System\KnHbenh.exe
  C:\Windows\System\KnHbenh.exe
  2⤵
  PID:3776
- C:\Windows\System\wpRzRWz.exe
  C:\Windows\System\wpRzRWz.exe
  2⤵
  PID:3864
- C:\Windows\System\bqIRctT.exe
  C:\Windows\System\bqIRctT.exe
  2⤵
  PID:3844
- C:\Windows\System\hktoHoH.exe
  C:\Windows\System\hktoHoH.exe
  2⤵
  PID:3920
- C:\Windows\System\tOEouud.exe
  C:\Windows\System\tOEouud.exe
  2⤵
  PID:3628
- C:\Windows\System\fuMLFxp.exe
  C:\Windows\System\fuMLFxp.exe
  2⤵
  PID:3108
- C:\Windows\System\ZYroPlg.exe
  C:\Windows\System\ZYroPlg.exe
  2⤵
  PID:704
- C:\Windows\System\zVLUUOf.exe
  C:\Windows\System\zVLUUOf.exe
  2⤵
  PID:3904
- C:\Windows\System\KsBOkpb.exe
  C:\Windows\System\KsBOkpb.exe
  2⤵
  PID:3316
- C:\Windows\System\naBApUh.exe
  C:\Windows\System\naBApUh.exe
  2⤵
  PID:2468
- C:\Windows\System\TPaojkw.exe
  C:\Windows\System\TPaojkw.exe
  2⤵
  PID:2428
- C:\Windows\System\INYTDbB.exe
  C:\Windows\System\INYTDbB.exe
  2⤵
  PID:3712
- C:\Windows\System\YjCvDfP.exe
  C:\Windows\System\YjCvDfP.exe
  2⤵
  PID:3828
- C:\Windows\System\pSxkJOP.exe
  C:\Windows\System\pSxkJOP.exe
  2⤵
  PID:2712
- C:\Windows\System\QOGTESZ.exe
  C:\Windows\System\QOGTESZ.exe
  2⤵
  PID:4012
- C:\Windows\System\CHiduWO.exe
  C:\Windows\System\CHiduWO.exe
  2⤵
  PID:3128
- C:\Windows\System\GVnPQIH.exe
  C:\Windows\System\GVnPQIH.exe
  2⤵
  PID:1640
- C:\Windows\System\iEaUnaq.exe
  C:\Windows\System\iEaUnaq.exe
  2⤵
  PID:3440
- C:\Windows\System\bDUTCMC.exe
  C:\Windows\System\bDUTCMC.exe
  2⤵
  PID:1012
- C:\Windows\System\vCHgiiu.exe
  C:\Windows\System\vCHgiiu.exe
  2⤵
  PID:3756
- C:\Windows\System\GnGPezX.exe
  C:\Windows\System\GnGPezX.exe
  2⤵
  PID:2648
- C:\Windows\System\CELhQBY.exe
  C:\Windows\System\CELhQBY.exe
  2⤵
  PID:3132
- C:\Windows\System\mHNFEjT.exe
  C:\Windows\System\mHNFEjT.exe
  2⤵
  PID:1740
- C:\Windows\System\spASWgU.exe
  C:\Windows\System\spASWgU.exe
  2⤵
  PID:3644
- C:\Windows\System\xXFTgxn.exe
  C:\Windows\System\xXFTgxn.exe
  2⤵
  PID:3020
- C:\Windows\System\DrPNstL.exe
  C:\Windows\System\DrPNstL.exe
  2⤵
  PID:1956
- C:\Windows\System\LwjrmNd.exe
  C:\Windows\System\LwjrmNd.exe
  2⤵
  PID:1444
- C:\Windows\System\gQBZKti.exe
  C:\Windows\System\gQBZKti.exe
  2⤵
  PID:2852
- C:\Windows\System\hEbdpZB.exe
  C:\Windows\System\hEbdpZB.exe
  2⤵
  PID:2872
- C:\Windows\System\BCLTDOY.exe
  C:\Windows\System\BCLTDOY.exe
  2⤵
  PID:3532
- C:\Windows\System\KNRLklz.exe
  C:\Windows\System\KNRLklz.exe
  2⤵
  PID:3640
- C:\Windows\System\jjunZrS.exe
  C:\Windows\System\jjunZrS.exe
  2⤵
  PID:1560
- C:\Windows\System\zInOCDS.exe
  C:\Windows\System\zInOCDS.exe
  2⤵
  PID:2136
- C:\Windows\System\mpgutLY.exe
  C:\Windows\System\mpgutLY.exe
  2⤵
  PID:2580
- C:\Windows\System\jKQDdxd.exe
  C:\Windows\System\jKQDdxd.exe
  2⤵
  PID:2160
- C:\Windows\System\ixIurCt.exe
  C:\Windows\System\ixIurCt.exe
  2⤵
  PID:3800
- C:\Windows\System\MOZbyNm.exe
  C:\Windows\System\MOZbyNm.exe
  2⤵
  PID:944
- C:\Windows\System\TcqrClu.exe
  C:\Windows\System\TcqrClu.exe
  2⤵
  PID:3688
- C:\Windows\System\EhdzOmC.exe
  C:\Windows\System\EhdzOmC.exe
  2⤵
  PID:3992
- C:\Windows\System\qLirocC.exe
  C:\Windows\System\qLirocC.exe
  2⤵
  PID:4068
- C:\Windows\System\oTPxEzy.exe
  C:\Windows\System\oTPxEzy.exe
  2⤵
  PID:4080
- C:\Windows\System\ZPRdmqq.exe
  C:\Windows\System\ZPRdmqq.exe
  2⤵
  PID:2040
- C:\Windows\System\WbmSYvo.exe
  C:\Windows\System\WbmSYvo.exe
  2⤵
  PID:4116
- C:\Windows\System\TgAEEGM.exe
  C:\Windows\System\TgAEEGM.exe
  2⤵
  PID:4132
- C:\Windows\System\UsceBZa.exe
  C:\Windows\System\UsceBZa.exe
  2⤵
  PID:4148
- C:\Windows\System\hhBuaef.exe
  C:\Windows\System\hhBuaef.exe
  2⤵
  PID:4164
- C:\Windows\System\JUeHPLM.exe
  C:\Windows\System\JUeHPLM.exe
  2⤵
  PID:4180
- C:\Windows\System\nGdnZLj.exe
  C:\Windows\System\nGdnZLj.exe
  2⤵
  PID:4196
- C:\Windows\System\GLNmIVa.exe
  C:\Windows\System\GLNmIVa.exe
  2⤵
  PID:4212
- C:\Windows\System\IvCrMXW.exe
  C:\Windows\System\IvCrMXW.exe
  2⤵
  PID:4228
- C:\Windows\System\HpyIojG.exe
  C:\Windows\System\HpyIojG.exe
  2⤵
  PID:4244
- C:\Windows\System\jrltSQW.exe
  C:\Windows\System\jrltSQW.exe
  2⤵
  PID:4260
- C:\Windows\System\tGKqMxu.exe
  C:\Windows\System\tGKqMxu.exe
  2⤵
  PID:4276
- C:\Windows\System\YncPDFY.exe
  C:\Windows\System\YncPDFY.exe
  2⤵
  PID:4292
- C:\Windows\System\qXHoskU.exe
  C:\Windows\System\qXHoskU.exe
  2⤵
  PID:4308
- C:\Windows\System\nrYEPnc.exe
  C:\Windows\System\nrYEPnc.exe
  2⤵
  PID:4324
- C:\Windows\System\epZUDbM.exe
  C:\Windows\System\epZUDbM.exe
  2⤵
  PID:4340
- C:\Windows\System\kFHXqYz.exe
  C:\Windows\System\kFHXqYz.exe
  2⤵
  PID:4356
- C:\Windows\System\vPZJNDv.exe
  C:\Windows\System\vPZJNDv.exe
  2⤵
  PID:4372
- C:\Windows\System\FOPyJQS.exe
  C:\Windows\System\FOPyJQS.exe
  2⤵
  PID:4388
- C:\Windows\System\XVOtgno.exe
  C:\Windows\System\XVOtgno.exe
  2⤵
  PID:4404
- C:\Windows\System\nlkGxqo.exe
  C:\Windows\System\nlkGxqo.exe
  2⤵
  PID:4420
- C:\Windows\System\kljzWaP.exe
  C:\Windows\System\kljzWaP.exe
  2⤵
  PID:4440
- C:\Windows\System\QdcqlzI.exe
  C:\Windows\System\QdcqlzI.exe
  2⤵
  PID:4456
- C:\Windows\System\emADPCR.exe
  C:\Windows\System\emADPCR.exe
  2⤵
  PID:4472
- C:\Windows\System\YrLTuXG.exe
  C:\Windows\System\YrLTuXG.exe
  2⤵
  PID:4488
- C:\Windows\System\PUomJZn.exe
  C:\Windows\System\PUomJZn.exe
  2⤵
  PID:4504
- C:\Windows\System\aOeCAMp.exe
  C:\Windows\System\aOeCAMp.exe
  2⤵
  PID:4520
- C:\Windows\System\lBxsjoD.exe
  C:\Windows\System\lBxsjoD.exe
  2⤵
  PID:4536
- C:\Windows\System\NrqZrqk.exe
  C:\Windows\System\NrqZrqk.exe
  2⤵
  PID:4552
- C:\Windows\System\bYCpDad.exe
  C:\Windows\System\bYCpDad.exe
  2⤵
  PID:4568
- C:\Windows\System\NvBgHNk.exe
  C:\Windows\System\NvBgHNk.exe
  2⤵
  PID:4584
- C:\Windows\System\FUrdRJr.exe
  C:\Windows\System\FUrdRJr.exe
  2⤵
  PID:4600
- C:\Windows\System\emzndGA.exe
  C:\Windows\System\emzndGA.exe
  2⤵
  PID:4616
- C:\Windows\System\VwRMUQq.exe
  C:\Windows\System\VwRMUQq.exe
  2⤵
  PID:4632
- C:\Windows\System\jGZNHNR.exe
  C:\Windows\System\jGZNHNR.exe
  2⤵
  PID:4648
- C:\Windows\System\ntihJsT.exe
  C:\Windows\System\ntihJsT.exe
  2⤵
  PID:4664
- C:\Windows\System\GXdOCEH.exe
  C:\Windows\System\GXdOCEH.exe
  2⤵
  PID:4680
- C:\Windows\System\LbcyqnI.exe
  C:\Windows\System\LbcyqnI.exe
  2⤵
  PID:4696
- C:\Windows\System\pZVEYUg.exe
  C:\Windows\System\pZVEYUg.exe
  2⤵
  PID:4712
- C:\Windows\System\GcXuPOY.exe
  C:\Windows\System\GcXuPOY.exe
  2⤵
  PID:4728
- C:\Windows\System\cwnpwNp.exe
  C:\Windows\System\cwnpwNp.exe
  2⤵
  PID:4744
- C:\Windows\System\iTYwgCM.exe
  C:\Windows\System\iTYwgCM.exe
  2⤵
  PID:4760
- C:\Windows\System\YJUpNGi.exe
  C:\Windows\System\YJUpNGi.exe
  2⤵
  PID:4776
- C:\Windows\System\kniyMdy.exe
  C:\Windows\System\kniyMdy.exe
  2⤵
  PID:4792
- C:\Windows\System\ZwOVxkq.exe
  C:\Windows\System\ZwOVxkq.exe
  2⤵
  PID:4808
- C:\Windows\System\iBWLsmw.exe
  C:\Windows\System\iBWLsmw.exe
  2⤵
  PID:4824
- C:\Windows\System\fyrdZSh.exe
  C:\Windows\System\fyrdZSh.exe
  2⤵
  PID:4840
- C:\Windows\System\gcjxDyB.exe
  C:\Windows\System\gcjxDyB.exe
  2⤵
  PID:4856
- C:\Windows\System\qDDYHEd.exe
  C:\Windows\System\qDDYHEd.exe
  2⤵
  PID:4872
- C:\Windows\System\MOdKoxs.exe
  C:\Windows\System\MOdKoxs.exe
  2⤵
  PID:4888
- C:\Windows\System\caXcNtb.exe
  C:\Windows\System\caXcNtb.exe
  2⤵
  PID:4904
- C:\Windows\System\vkSrtwX.exe
  C:\Windows\System\vkSrtwX.exe
  2⤵
  PID:4920
- C:\Windows\System\ExbyPCz.exe
  C:\Windows\System\ExbyPCz.exe
  2⤵
  PID:4936
- C:\Windows\System\iCdqPsW.exe
  C:\Windows\System\iCdqPsW.exe
  2⤵
  PID:4952
- C:\Windows\System\VpxewCN.exe
  C:\Windows\System\VpxewCN.exe
  2⤵
  PID:4968
- C:\Windows\System\MPVONqU.exe
  C:\Windows\System\MPVONqU.exe
  2⤵
  PID:4984
- C:\Windows\System\FBFWBWW.exe
  C:\Windows\System\FBFWBWW.exe
  2⤵
  PID:5000
- C:\Windows\System\XZGXoDb.exe
  C:\Windows\System\XZGXoDb.exe
  2⤵
  PID:5016
- C:\Windows\System\yVkZzhG.exe
  C:\Windows\System\yVkZzhG.exe
  2⤵
  PID:5032
- C:\Windows\System\zYKXgns.exe
  C:\Windows\System\zYKXgns.exe
  2⤵
  PID:5048
- C:\Windows\System\EcLiECN.exe
  C:\Windows\System\EcLiECN.exe
  2⤵
  PID:5064
- C:\Windows\System\wnGlRCa.exe
  C:\Windows\System\wnGlRCa.exe
  2⤵
  PID:5080
- C:\Windows\System\sulzkwN.exe
  C:\Windows\System\sulzkwN.exe
  2⤵
  PID:5100
- C:\Windows\System\BFPtzOZ.exe
  C:\Windows\System\BFPtzOZ.exe
  2⤵
  PID:4104
- C:\Windows\System\sWQuUlO.exe
  C:\Windows\System\sWQuUlO.exe
  2⤵
  PID:4144
- C:\Windows\System\MPpbxSj.exe
  C:\Windows\System\MPpbxSj.exe
  2⤵
  PID:4236
- C:\Windows\System\SpGCNhm.exe
  C:\Windows\System\SpGCNhm.exe
  2⤵
  PID:4268
- C:\Windows\System\cbmPNwR.exe
  C:\Windows\System\cbmPNwR.exe
  2⤵
  PID:4304
- C:\Windows\System\zLGoWxW.exe
  C:\Windows\System\zLGoWxW.exe
  2⤵
  PID:2624
- C:\Windows\System\MIMVvtN.exe
  C:\Windows\System\MIMVvtN.exe
  2⤵
  PID:4332
- C:\Windows\System\hXgoXVp.exe
  C:\Windows\System\hXgoXVp.exe
  2⤵
  PID:4160
- C:\Windows\System\adGMgsx.exe
  C:\Windows\System\adGMgsx.exe
  2⤵
  PID:4288
- C:\Windows\System\cJdoUVR.exe
  C:\Windows\System\cJdoUVR.exe
  2⤵
  PID:4352
- C:\Windows\System\kSsJVfH.exe
  C:\Windows\System\kSsJVfH.exe
  2⤵
  PID:4428
- C:\Windows\System\zHdjASG.exe
  C:\Windows\System\zHdjASG.exe
  2⤵
  PID:4436
- C:\Windows\System\iFBnWAR.exe
  C:\Windows\System\iFBnWAR.exe
  2⤵
  PID:4500
- C:\Windows\System\hqiQwtm.exe
  C:\Windows\System\hqiQwtm.exe
  2⤵
  PID:4564
- C:\Windows\System\sTbbkCh.exe
  C:\Windows\System\sTbbkCh.exe
  2⤵
  PID:4628
- C:\Windows\System\bmdWcrf.exe
  C:\Windows\System\bmdWcrf.exe
  2⤵
  PID:4692
- C:\Windows\System\vrKzWqe.exe
  C:\Windows\System\vrKzWqe.exe
  2⤵
  PID:4756
- C:\Windows\System\slsBXYj.exe
  C:\Windows\System\slsBXYj.exe
  2⤵
  PID:4820
- C:\Windows\System\XgPKTru.exe
  C:\Windows\System\XgPKTru.exe
  2⤵
  PID:4884
- C:\Windows\System\dkeIWRk.exe
  C:\Windows\System\dkeIWRk.exe
  2⤵
  PID:1488
- C:\Windows\System\SqzzxEx.exe
  C:\Windows\System\SqzzxEx.exe
  2⤵
  PID:4548
- C:\Windows\System\UBBJmDi.exe
  C:\Windows\System\UBBJmDi.exe
  2⤵
  PID:2996
- C:\Windows\System\EOHguqo.exe
  C:\Windows\System\EOHguqo.exe
  2⤵
  PID:4864
- C:\Windows\System\xKiPYqA.exe
  C:\Windows\System\xKiPYqA.exe
  2⤵
  PID:4800
- C:\Windows\System\zxnNSio.exe
  C:\Windows\System\zxnNSio.exe
  2⤵
  PID:4736
- C:\Windows\System\sBmrptE.exe
  C:\Windows\System\sBmrptE.exe
  2⤵
  PID:4672
- C:\Windows\System\VwIWpsz.exe
  C:\Windows\System\VwIWpsz.exe
  2⤵
  PID:4580
- C:\Windows\System\oAsBLJZ.exe
  C:\Windows\System\oAsBLJZ.exe
  2⤵
  PID:4512
- C:\Windows\System\evQqEai.exe
  C:\Windows\System\evQqEai.exe
  2⤵
  PID:4448
- C:\Windows\System\FFSupyf.exe
  C:\Windows\System\FFSupyf.exe
  2⤵
  PID:4380
- C:\Windows\System\pMGfNNt.exe
  C:\Windows\System\pMGfNNt.exe
  2⤵
  PID:5012
- C:\Windows\System\sLmMVjC.exe
  C:\Windows\System\sLmMVjC.exe
  2⤵
  PID:5108
- C:\Windows\System\MwCqMKh.exe
  C:\Windows\System\MwCqMKh.exe
  2⤵
  PID:768
- C:\Windows\System\ItDffmF.exe
  C:\Windows\System\ItDffmF.exe
  2⤵
  PID:4176
- C:\Windows\System\CDwKUWR.exe
  C:\Windows\System\CDwKUWR.exe
  2⤵
  PID:5024
- C:\Windows\System\ObfphGx.exe
  C:\Windows\System\ObfphGx.exe
  2⤵
  PID:4172
- C:\Windows\System\rCRdilg.exe
  C:\Windows\System\rCRdilg.exe
  2⤵
  PID:4128
- C:\Windows\System\QeADsNt.exe
  C:\Windows\System\QeADsNt.exe
  2⤵
  PID:5056
- C:\Windows\System\CXfRDya.exe
  C:\Windows\System\CXfRDya.exe
  2⤵
  PID:5096
- C:\Windows\System\CQQjFSP.exe
  C:\Windows\System\CQQjFSP.exe
  2⤵
  PID:4316
- C:\Windows\System\upFRLeV.exe
  C:\Windows\System\upFRLeV.exe
  2⤵
  PID:4256
- C:\Windows\System\ynATQCg.exe
  C:\Windows\System\ynATQCg.exe
  2⤵
  PID:4348
- C:\Windows\System\ANTBXMn.exe
  C:\Windows\System\ANTBXMn.exe
  2⤵
  PID:4468
- C:\Windows\System\GujkfgV.exe
  C:\Windows\System\GujkfgV.exe
  2⤵
  PID:4592
- C:\Windows\System\QsEMyoO.exe
  C:\Windows\System\QsEMyoO.exe
  2⤵
  PID:4724
- C:\Windows\System\ZtjfSbV.exe
  C:\Windows\System\ZtjfSbV.exe
  2⤵
  PID:4852
- C:\Windows\System\mLYqrvt.exe
  C:\Windows\System\mLYqrvt.exe
  2⤵
  PID:4948
- C:\Windows\System\AeSTYRP.exe
  C:\Windows\System\AeSTYRP.exe
  2⤵
  PID:4932
- C:\Windows\System\jkWtYou.exe
  C:\Windows\System\jkWtYou.exe
  2⤵
  PID:4868
- C:\Windows\System\afQgJFD.exe
  C:\Windows\System\afQgJFD.exe
  2⤵
  PID:4804
- C:\Windows\System\nRGoitt.exe
  C:\Windows\System\nRGoitt.exe
  2⤵
  PID:4608
- C:\Windows\System\pofUPnu.exe
  C:\Windows\System\pofUPnu.exe
  2⤵
  PID:4544
- C:\Windows\System\HupFMjC.exe
  C:\Windows\System\HupFMjC.exe
  2⤵
  PID:5008
- C:\Windows\System\GxSrblS.exe
  C:\Windows\System\GxSrblS.exe
  2⤵
  PID:4384
- C:\Windows\System\iPFlLUQ.exe
  C:\Windows\System\iPFlLUQ.exe
  2⤵
  PID:5072
- C:\Windows\System\UNGsWFJ.exe
  C:\Windows\System\UNGsWFJ.exe
  2⤵
  PID:5076
- C:\Windows\System\dusZRjg.exe
  C:\Windows\System\dusZRjg.exe
  2⤵
  PID:5092
- C:\Windows\System\zUnLmPz.exe
  C:\Windows\System\zUnLmPz.exe
  2⤵
  PID:2068
- C:\Windows\System\yKKGSdW.exe
  C:\Windows\System\yKKGSdW.exe
  2⤵
  PID:4816
- C:\Windows\System\FRxMRFK.exe
  C:\Windows\System\FRxMRFK.exe
  2⤵
  PID:1368
- C:\Windows\System\LgNvNZP.exe
  C:\Windows\System\LgNvNZP.exe
  2⤵
  PID:2804
- C:\Windows\System\nqztuCu.exe
  C:\Windows\System\nqztuCu.exe
  2⤵
  PID:4284
- C:\Windows\System\cklbDrN.exe
  C:\Windows\System\cklbDrN.exe
  2⤵
  PID:4208
- C:\Windows\System\xmQCNkB.exe
  C:\Windows\System\xmQCNkB.exe
  2⤵
  PID:4124
- C:\Windows\System\uXFplaL.exe
  C:\Windows\System\uXFplaL.exe
  2⤵
  PID:3060
- C:\Windows\System\SpEQDhJ.exe
  C:\Windows\System\SpEQDhJ.exe
  2⤵
  PID:2960
- C:\Windows\System\wVTSKxu.exe
  C:\Windows\System\wVTSKxu.exe
  2⤵
  PID:5132
- C:\Windows\System\CxFzUyD.exe
  C:\Windows\System\CxFzUyD.exe
  2⤵
  PID:5148
- C:\Windows\System\VAmrZng.exe
  C:\Windows\System\VAmrZng.exe
  2⤵
  PID:5164
- C:\Windows\System\OzPgCML.exe
  C:\Windows\System\OzPgCML.exe
  2⤵
  PID:5180
- C:\Windows\System\XgQLAhx.exe
  C:\Windows\System\XgQLAhx.exe
  2⤵
  PID:5196
- C:\Windows\System\lBSQIDI.exe
  C:\Windows\System\lBSQIDI.exe
  2⤵
  PID:5212
- C:\Windows\System\CyFGNsb.exe
  C:\Windows\System\CyFGNsb.exe
  2⤵
  PID:5228
- C:\Windows\System\tfturkn.exe
  C:\Windows\System\tfturkn.exe
  2⤵
  PID:5244
- C:\Windows\System\WIMEmeg.exe
  C:\Windows\System\WIMEmeg.exe
  2⤵
  PID:5260
- C:\Windows\System\yHypRXl.exe
  C:\Windows\System\yHypRXl.exe
  2⤵
  PID:5276
- C:\Windows\System\dljSVSd.exe
  C:\Windows\System\dljSVSd.exe
  2⤵
  PID:5292
- C:\Windows\System\VRDEBEe.exe
  C:\Windows\System\VRDEBEe.exe
  2⤵
  PID:5308
- C:\Windows\System\WzrKmKt.exe
  C:\Windows\System\WzrKmKt.exe
  2⤵
  PID:5324
- C:\Windows\System\dOeUhnw.exe
  C:\Windows\System\dOeUhnw.exe
  2⤵
  PID:5352
- C:\Windows\System\cxEbazq.exe
  C:\Windows\System\cxEbazq.exe
  2⤵
  PID:5368
- C:\Windows\System\EVBiKKC.exe
  C:\Windows\System\EVBiKKC.exe
  2⤵
  PID:5384
- C:\Windows\System\RKDVFqf.exe
  C:\Windows\System\RKDVFqf.exe
  2⤵
  PID:5400
- C:\Windows\System\SmKSQLt.exe
  C:\Windows\System\SmKSQLt.exe
  2⤵
  PID:5416
- C:\Windows\System\PgcYLVn.exe
  C:\Windows\System\PgcYLVn.exe
  2⤵
  PID:5432
- C:\Windows\System\DGmKALg.exe
  C:\Windows\System\DGmKALg.exe
  2⤵
  PID:5448
- C:\Windows\System\ALcSjHX.exe
  C:\Windows\System\ALcSjHX.exe
  2⤵
  PID:5464
- C:\Windows\System\vBbayZo.exe
  C:\Windows\System\vBbayZo.exe
  2⤵
  PID:5480
- C:\Windows\System\QknTIMG.exe
  C:\Windows\System\QknTIMG.exe
  2⤵
  PID:5524
- C:\Windows\System\BCPNOlx.exe
  C:\Windows\System\BCPNOlx.exe
  2⤵
  PID:5544
- C:\Windows\System\ceOoisl.exe
  C:\Windows\System\ceOoisl.exe
  2⤵
  PID:5560
- C:\Windows\System\KCIZIYJ.exe
  C:\Windows\System\KCIZIYJ.exe
  2⤵
  PID:5576
- C:\Windows\System\mFTWevF.exe
  C:\Windows\System\mFTWevF.exe
  2⤵
  PID:5592
- C:\Windows\System\rlOOPGQ.exe
  C:\Windows\System\rlOOPGQ.exe
  2⤵
  PID:5612
- C:\Windows\System\LAbFJZE.exe
  C:\Windows\System\LAbFJZE.exe
  2⤵
  PID:5628
- C:\Windows\System\WgCVItM.exe
  C:\Windows\System\WgCVItM.exe
  2⤵
  PID:5644
- C:\Windows\System\ncPHUSD.exe
  C:\Windows\System\ncPHUSD.exe
  2⤵
  PID:5660
- C:\Windows\System\TDInvvG.exe
  C:\Windows\System\TDInvvG.exe
  2⤵
  PID:5680
- C:\Windows\System\NMRXttp.exe
  C:\Windows\System\NMRXttp.exe
  2⤵
  PID:5696
- C:\Windows\System\BXfFJEk.exe
  C:\Windows\System\BXfFJEk.exe
  2⤵
  PID:5712
- C:\Windows\System\KPjpoee.exe
  C:\Windows\System\KPjpoee.exe
  2⤵
  PID:5728
- C:\Windows\System\FrLquZQ.exe
  C:\Windows\System\FrLquZQ.exe
  2⤵
  PID:5748
- C:\Windows\System\mLIpOjk.exe
  C:\Windows\System\mLIpOjk.exe
  2⤵
  PID:5764
- C:\Windows\System\hRWofkq.exe
  C:\Windows\System\hRWofkq.exe
  2⤵
  PID:5780
- C:\Windows\System\CTpRGTJ.exe
  C:\Windows\System\CTpRGTJ.exe
  2⤵
  PID:5800
- C:\Windows\System\IjDldMG.exe
  C:\Windows\System\IjDldMG.exe
  2⤵
  PID:5816
- C:\Windows\System\vERYydf.exe
  C:\Windows\System\vERYydf.exe
  2⤵
  PID:5832
- C:\Windows\System\QArfHHI.exe
  C:\Windows\System\QArfHHI.exe
  2⤵
  PID:5852
- C:\Windows\System\KfisxGv.exe
  C:\Windows\System\KfisxGv.exe
  2⤵
  PID:5872
- C:\Windows\System\AfHAvGF.exe
  C:\Windows\System\AfHAvGF.exe
  2⤵
  PID:5892
- C:\Windows\System\yoYmYOl.exe
  C:\Windows\System\yoYmYOl.exe
  2⤵
  PID:5908
- C:\Windows\System\ICUUXOO.exe
  C:\Windows\System\ICUUXOO.exe
  2⤵
  PID:5924
- C:\Windows\System\OIfNDjP.exe
  C:\Windows\System\OIfNDjP.exe
  2⤵
  PID:5940
- C:\Windows\System\dHSAFMf.exe
  C:\Windows\System\dHSAFMf.exe
  2⤵
  PID:5956
- C:\Windows\System\FqGEwYW.exe
  C:\Windows\System\FqGEwYW.exe
  2⤵
  PID:5976
- C:\Windows\System\ptzEqKF.exe
  C:\Windows\System\ptzEqKF.exe
  2⤵
  PID:5992
- C:\Windows\System\JdXBMdf.exe
  C:\Windows\System\JdXBMdf.exe
  2⤵
  PID:6008
- C:\Windows\System\LXgTjrA.exe
  C:\Windows\System\LXgTjrA.exe
  2⤵
  PID:6024
- C:\Windows\System\LffSuCF.exe
  C:\Windows\System\LffSuCF.exe
  2⤵
  PID:6040
- C:\Windows\System\CmTpBDW.exe
  C:\Windows\System\CmTpBDW.exe
  2⤵
  PID:6056
- C:\Windows\System\CQceHWE.exe
  C:\Windows\System\CQceHWE.exe
  2⤵
  PID:6072
- C:\Windows\System\xHeIyCY.exe
  C:\Windows\System\xHeIyCY.exe
  2⤵
  PID:6088
- C:\Windows\System\LZWzhSr.exe
  C:\Windows\System\LZWzhSr.exe
  2⤵
  PID:6104
- C:\Windows\System\BRTwhzq.exe
  C:\Windows\System\BRTwhzq.exe
  2⤵
  PID:6120
- C:\Windows\System\CKoVOeg.exe
  C:\Windows\System\CKoVOeg.exe
  2⤵
  PID:6136
- C:\Windows\System\wRDJUCj.exe
  C:\Windows\System\wRDJUCj.exe
  2⤵
  PID:4204
- C:\Windows\System\IKZxGCE.exe
  C:\Windows\System\IKZxGCE.exe
  2⤵
  PID:5128
- C:\Windows\System\clKTuMP.exe
  C:\Windows\System\clKTuMP.exe
  2⤵
  PID:4768
- C:\Windows\System\PQQWhMQ.exe
  C:\Windows\System\PQQWhMQ.exe
  2⤵
  PID:4368
- C:\Windows\System\lniaknj.exe
  C:\Windows\System\lniaknj.exe
  2⤵
  PID:5208
- C:\Windows\System\WwQEbTn.exe
  C:\Windows\System\WwQEbTn.exe
  2⤵
  PID:5360
- C:\Windows\System\JVZutBw.exe
  C:\Windows\System\JVZutBw.exe
  2⤵
  PID:5300
- C:\Windows\System\lLqeMBh.exe
  C:\Windows\System\lLqeMBh.exe
  2⤵
  PID:5424
- C:\Windows\System\QtTDiCQ.exe
  C:\Windows\System\QtTDiCQ.exe
  2⤵
  PID:4112
- C:\Windows\System\qXVNszY.exe
  C:\Windows\System\qXVNszY.exe
  2⤵
  PID:5144
- C:\Windows\System\HIImGQd.exe
  C:\Windows\System\HIImGQd.exe
  2⤵
  PID:5412
- C:\Windows\System\CUhItOx.exe
  C:\Windows\System\CUhItOx.exe
  2⤵
  PID:5492
- C:\Windows\System\loSRXpw.exe
  C:\Windows\System\loSRXpw.exe
  2⤵
  PID:5476
- C:\Windows\System\XoMXGZu.exe
  C:\Windows\System\XoMXGZu.exe
  2⤵
  PID:5516
- C:\Windows\System\eSZAQVr.exe
  C:\Windows\System\eSZAQVr.exe
  2⤵
  PID:5588
- C:\Windows\System\OvhPrsL.exe
  C:\Windows\System\OvhPrsL.exe
  2⤵
  PID:5652
- C:\Windows\System\jXHOjiu.exe
  C:\Windows\System\jXHOjiu.exe
  2⤵
  PID:5720
- C:\Windows\System\cqliiXc.exe
  C:\Windows\System\cqliiXc.exe
  2⤵
  PID:5760
- C:\Windows\System\pLdbmDW.exe
  C:\Windows\System\pLdbmDW.exe
  2⤵
  PID:5824
- C:\Windows\System\NrjjMFG.exe
  C:\Windows\System\NrjjMFG.exe
  2⤵
  PID:5860
- C:\Windows\System\TIodjWz.exe
  C:\Windows\System\TIodjWz.exe
  2⤵
  PID:5904
- C:\Windows\System\qqvGHGV.exe
  C:\Windows\System\qqvGHGV.exe
  2⤵
  PID:5972
- C:\Windows\System\GbfclnB.exe
  C:\Windows\System\GbfclnB.exe
  2⤵
  PID:5640
- C:\Windows\System\DUzzlpy.exe
  C:\Windows\System\DUzzlpy.exe
  2⤵
  PID:5704
- C:\Windows\System\wBaFaUo.exe
  C:\Windows\System\wBaFaUo.exe
  2⤵
  PID:5744
- C:\Windows\System\BkmxrGq.exe
  C:\Windows\System\BkmxrGq.exe
  2⤵
  PID:5812
- C:\Windows\System\MNjYNbK.exe
  C:\Windows\System\MNjYNbK.exe
  2⤵
  PID:5880
- C:\Windows\System\hqcirbL.exe
  C:\Windows\System\hqcirbL.exe
  2⤵
  PID:6004
- C:\Windows\System\pHAuFWV.exe
  C:\Windows\System\pHAuFWV.exe
  2⤵
  PID:6096
- C:\Windows\System\vZMBPfw.exe
  C:\Windows\System\vZMBPfw.exe
  2⤵
  PID:5124
- C:\Windows\System\XPZaHtY.exe
  C:\Windows\System\XPZaHtY.exe
  2⤵
  PID:5948
- C:\Windows\System\DyBCPoW.exe
  C:\Windows\System\DyBCPoW.exe
  2⤵
  PID:5984
- C:\Windows\System\rnRgZRK.exe
  C:\Windows\System\rnRgZRK.exe
  2⤵
  PID:6048
- C:\Windows\System\pTxIoHC.exe
  C:\Windows\System\pTxIoHC.exe
  2⤵
  PID:5600
- C:\Windows\System\GnOOneB.exe
  C:\Windows\System\GnOOneB.exe
  2⤵
  PID:5252
- C:\Windows\System\aIgYnnQ.exe
  C:\Windows\System\aIgYnnQ.exe
  2⤵
  PID:4944
- C:\Windows\System\VhiTCah.exe
  C:\Windows\System\VhiTCah.exe
  2⤵
  PID:6084
- C:\Windows\System\CeeizPm.exe
  C:\Windows\System\CeeizPm.exe
  2⤵
  PID:5160
- C:\Windows\System\xDvKPTW.exe
  C:\Windows\System\xDvKPTW.exe
  2⤵
  PID:5188
- C:\Windows\System\mDAHSuJ.exe
  C:\Windows\System\mDAHSuJ.exe
  2⤵
  PID:4964
- C:\Windows\System\Ytoswhj.exe
  C:\Windows\System\Ytoswhj.exe
  2⤵
  PID:5392
- C:\Windows\System\hulOzVs.exe
  C:\Windows\System\hulOzVs.exe
  2⤵
  PID:5920
- C:\Windows\System\bTnLtVD.exe
  C:\Windows\System\bTnLtVD.exe
  2⤵
  PID:4880
- C:\Windows\System\eMRqLiw.exe
  C:\Windows\System\eMRqLiw.exe
  2⤵
  PID:5504
- C:\Windows\System\jOXshEL.exe
  C:\Windows\System\jOXshEL.exe
  2⤵
  PID:5176
- C:\Windows\System\FtyJQWo.exe
  C:\Windows\System\FtyJQWo.exe
  2⤵
  PID:5624
- C:\Windows\System\dRcWcMd.exe
  C:\Windows\System\dRcWcMd.exe
  2⤵
  PID:5756
- C:\Windows\System\aYrHngx.exe
  C:\Windows\System\aYrHngx.exe
  2⤵
  PID:5672
- C:\Windows\System\FInkAse.exe
  C:\Windows\System\FInkAse.exe
  2⤵
  PID:5556
- C:\Windows\System\aBkGHqQ.exe
  C:\Windows\System\aBkGHqQ.exe
  2⤵
  PID:6032
- C:\Windows\System\FZVLiAq.exe
  C:\Windows\System\FZVLiAq.exe
  2⤵
  PID:5380
- C:\Windows\System\xftKhBu.exe
  C:\Windows\System\xftKhBu.exe
  2⤵
  PID:5864
- C:\Windows\System\NWSNrgf.exe
  C:\Windows\System\NWSNrgf.exe
  2⤵
  PID:5736
- C:\Windows\System\EtOnOHI.exe
  C:\Windows\System\EtOnOHI.exe
  2⤵
  PID:6132
- C:\Windows\System\iiJdsfe.exe
  C:\Windows\System\iiJdsfe.exe
  2⤵
  PID:3768
- C:\Windows\System\tmQXIDc.exe
  C:\Windows\System\tmQXIDc.exe
  2⤵
  PID:5088
- C:\Windows\System\NDiKrBS.exe
  C:\Windows\System\NDiKrBS.exe
  2⤵
  PID:1704
- C:\Windows\System\vkGbWuW.exe
  C:\Windows\System\vkGbWuW.exe
  2⤵
  PID:5224
- C:\Windows\System\eNbsIhc.exe
  C:\Windows\System\eNbsIhc.exe
  2⤵
  PID:5460
- C:\Windows\System\riGLfiK.exe
  C:\Windows\System\riGLfiK.exe
  2⤵
  PID:5620
- C:\Windows\System\wiWHImY.exe
  C:\Windows\System\wiWHImY.exe
  2⤵
  PID:5964
- C:\Windows\System\uxykEic.exe
  C:\Windows\System\uxykEic.exe
  2⤵
  PID:2800
- C:\Windows\System\tMGFnCo.exe
  C:\Windows\System\tMGFnCo.exe
  2⤵
  PID:6064
- C:\Windows\System\zRxZMOV.exe
  C:\Windows\System\zRxZMOV.exe
  2⤵
  PID:5848
- C:\Windows\System\XNtdPFG.exe
  C:\Windows\System\XNtdPFG.exe
  2⤵
  PID:5536
- C:\Windows\System\wnVtsPl.exe
  C:\Windows\System\wnVtsPl.exe
  2⤵
  PID:5288
- C:\Windows\System\VFLfPja.exe
  C:\Windows\System\VFLfPja.exe
  2⤵
  PID:5508
- C:\Windows\System\tiXwzcV.exe
  C:\Windows\System\tiXwzcV.exe
  2⤵
  PID:6016
- C:\Windows\System\sVgNQft.exe
  C:\Windows\System\sVgNQft.exe
  2⤵
  PID:6020
- C:\Windows\System\qyoZEJs.exe
  C:\Windows\System\qyoZEJs.exe
  2⤵
  PID:5572
- C:\Windows\System\BdixchH.exe
  C:\Windows\System\BdixchH.exe
  2⤵
  PID:6160
- C:\Windows\System\frJvcPH.exe
  C:\Windows\System\frJvcPH.exe
  2⤵
  PID:6176
- C:\Windows\System\YYecuEq.exe
  C:\Windows\System\YYecuEq.exe
  2⤵
  PID:6192
- C:\Windows\System\GCPkXKq.exe
  C:\Windows\System\GCPkXKq.exe
  2⤵
  PID:6208
- C:\Windows\System\cWYLEtS.exe
  C:\Windows\System\cWYLEtS.exe
  2⤵
  PID:6224
- C:\Windows\System\CApXXOJ.exe
  C:\Windows\System\CApXXOJ.exe
  2⤵
  PID:6240
- C:\Windows\System\igVQKst.exe
  C:\Windows\System\igVQKst.exe
  2⤵
  PID:6256
- C:\Windows\System\NiTzrom.exe
  C:\Windows\System\NiTzrom.exe
  2⤵
  PID:6272
- C:\Windows\System\idEMBZM.exe
  C:\Windows\System\idEMBZM.exe
  2⤵
  PID:6288
- C:\Windows\System\pjRrGGa.exe
  C:\Windows\System\pjRrGGa.exe
  2⤵
  PID:6304
- C:\Windows\System\qiqnYYk.exe
  C:\Windows\System\qiqnYYk.exe
  2⤵
  PID:6320
- C:\Windows\System\GNoaMif.exe
  C:\Windows\System\GNoaMif.exe
  2⤵
  PID:6336
- C:\Windows\System\PzUmbCN.exe
  C:\Windows\System\PzUmbCN.exe
  2⤵
  PID:6352
- C:\Windows\System\TsrExNO.exe
  C:\Windows\System\TsrExNO.exe
  2⤵
  PID:6368
- C:\Windows\System\zPYUmrF.exe
  C:\Windows\System\zPYUmrF.exe
  2⤵
  PID:6384
- C:\Windows\System\YrWnBEQ.exe
  C:\Windows\System\YrWnBEQ.exe
  2⤵
  PID:6400
- C:\Windows\System\bDODExZ.exe
  C:\Windows\System\bDODExZ.exe
  2⤵
  PID:6416
- C:\Windows\System\AWOluEG.exe
  C:\Windows\System\AWOluEG.exe
  2⤵
  PID:6432
- C:\Windows\System\QiErxMN.exe
  C:\Windows\System\QiErxMN.exe
  2⤵
  PID:6448
- C:\Windows\System\FwOgwWQ.exe
  C:\Windows\System\FwOgwWQ.exe
  2⤵
  PID:6464
- C:\Windows\System\bGWVYRR.exe
  C:\Windows\System\bGWVYRR.exe
  2⤵
  PID:6480
- C:\Windows\System\agGFcsr.exe
  C:\Windows\System\agGFcsr.exe
  2⤵
  PID:6496
- C:\Windows\System\KcvROlI.exe
  C:\Windows\System\KcvROlI.exe
  2⤵
  PID:6512
- C:\Windows\System\HWAIoNw.exe
  C:\Windows\System\HWAIoNw.exe
  2⤵
  PID:6528
- C:\Windows\System\tUPDNPG.exe
  C:\Windows\System\tUPDNPG.exe
  2⤵
  PID:6544
- C:\Windows\System\HcDEJZY.exe
  C:\Windows\System\HcDEJZY.exe
  2⤵
  PID:6560
- C:\Windows\System\FTbYQAZ.exe
  C:\Windows\System\FTbYQAZ.exe
  2⤵
  PID:6576
- C:\Windows\System\rZlgBKP.exe
  C:\Windows\System\rZlgBKP.exe
  2⤵
  PID:6592
- C:\Windows\System\kcgNqvy.exe
  C:\Windows\System\kcgNqvy.exe
  2⤵
  PID:6608
- C:\Windows\System\ejeSMVL.exe
  C:\Windows\System\ejeSMVL.exe
  2⤵
  PID:6624
- C:\Windows\System\onFtnLw.exe
  C:\Windows\System\onFtnLw.exe
  2⤵
  PID:6640
- C:\Windows\System\VWWcclh.exe
  C:\Windows\System\VWWcclh.exe
  2⤵
  PID:6656
- C:\Windows\System\NPJbYwr.exe
  C:\Windows\System\NPJbYwr.exe
  2⤵
  PID:6672
- C:\Windows\System\tYAbsmm.exe
  C:\Windows\System\tYAbsmm.exe
  2⤵
  PID:6688
- C:\Windows\System\AZdhfFg.exe
  C:\Windows\System\AZdhfFg.exe
  2⤵
  PID:6704
- C:\Windows\System\NdIsqxk.exe
  C:\Windows\System\NdIsqxk.exe
  2⤵
  PID:6720
- C:\Windows\System\CvLFTqO.exe
  C:\Windows\System\CvLFTqO.exe
  2⤵
  PID:6736
- C:\Windows\System\edmoOWa.exe
  C:\Windows\System\edmoOWa.exe
  2⤵
  PID:6752
- C:\Windows\System\iQIEqZr.exe
  C:\Windows\System\iQIEqZr.exe
  2⤵
  PID:6768
- C:\Windows\System\gvDFjKq.exe
  C:\Windows\System\gvDFjKq.exe
  2⤵
  PID:6784
- C:\Windows\System\neaeIbS.exe
  C:\Windows\System\neaeIbS.exe
  2⤵
  PID:6800
- C:\Windows\System\ErflSpl.exe
  C:\Windows\System\ErflSpl.exe
  2⤵
  PID:6816
- C:\Windows\System\YCGOaKx.exe
  C:\Windows\System\YCGOaKx.exe
  2⤵
  PID:6832
- C:\Windows\System\vyyvlwB.exe
  C:\Windows\System\vyyvlwB.exe
  2⤵
  PID:6848
- C:\Windows\System\YlydtdE.exe
  C:\Windows\System\YlydtdE.exe
  2⤵
  PID:6864
- C:\Windows\System\hODjIod.exe
  C:\Windows\System\hODjIod.exe
  2⤵
  PID:6880
- C:\Windows\System\hBKSHWd.exe
  C:\Windows\System\hBKSHWd.exe
  2⤵
  PID:6896
- C:\Windows\System\ehYNVOg.exe
  C:\Windows\System\ehYNVOg.exe
  2⤵
  PID:6912
- C:\Windows\System\izkjgWT.exe
  C:\Windows\System\izkjgWT.exe
  2⤵
  PID:6928
- C:\Windows\System\jQoUolP.exe
  C:\Windows\System\jQoUolP.exe
  2⤵
  PID:6944
- C:\Windows\System\pQOUjbd.exe
  C:\Windows\System\pQOUjbd.exe
  2⤵
  PID:6960
- C:\Windows\System\YgqkFjd.exe
  C:\Windows\System\YgqkFjd.exe
  2⤵
  PID:6976
- C:\Windows\System\MNBKqjr.exe
  C:\Windows\System\MNBKqjr.exe
  2⤵
  PID:6992
- C:\Windows\System\gkwASco.exe
  C:\Windows\System\gkwASco.exe
  2⤵
  PID:7008
- C:\Windows\System\DBfBlYK.exe
  C:\Windows\System\DBfBlYK.exe
  2⤵
  PID:7024
- C:\Windows\System\sSYabTq.exe
  C:\Windows\System\sSYabTq.exe
  2⤵
  PID:7040
- C:\Windows\System\VXKeQPR.exe
  C:\Windows\System\VXKeQPR.exe
  2⤵
  PID:7056
- C:\Windows\System\lKyVGPA.exe
  C:\Windows\System\lKyVGPA.exe
  2⤵
  PID:7072
- C:\Windows\System\ZYGndMJ.exe
  C:\Windows\System\ZYGndMJ.exe
  2⤵
  PID:7156
- C:\Windows\System\xzjVDVi.exe
  C:\Windows\System\xzjVDVi.exe
  2⤵
  PID:6236
- C:\Windows\System\UGHBgKd.exe
  C:\Windows\System\UGHBgKd.exe
  2⤵
  PID:6552
- C:\Windows\System\OKojvac.exe
  C:\Windows\System\OKojvac.exe
  2⤵
  PID:6508
- C:\Windows\System\vjoxWlp.exe
  C:\Windows\System\vjoxWlp.exe
  2⤵
  PID:6476
- C:\Windows\System\sAPklTv.exe
  C:\Windows\System\sAPklTv.exe
  2⤵
  PID:6572
- C:\Windows\System\QRQBSbe.exe
  C:\Windows\System\QRQBSbe.exe
  2⤵
  PID:6636
- C:\Windows\System\iRqDIZy.exe
  C:\Windows\System\iRqDIZy.exe
  2⤵
  PID:6792
- C:\Windows\System\OlcUGGC.exe
  C:\Windows\System\OlcUGGC.exe
  2⤵
  PID:6940
- C:\Windows\System\ZdXcbSr.exe
  C:\Windows\System\ZdXcbSr.exe
  2⤵
  PID:6920
- C:\Windows\System\uRAvSaB.exe
  C:\Windows\System\uRAvSaB.exe
  2⤵
  PID:6892
- C:\Windows\System\GhrXLbd.exe
  C:\Windows\System\GhrXLbd.exe
  2⤵
  PID:6984
- C:\Windows\System\vxYACcc.exe
  C:\Windows\System\vxYACcc.exe
  2⤵
  PID:6924
- C:\Windows\System\qxVThSj.exe
  C:\Windows\System\qxVThSj.exe
  2⤵
  PID:7016
- C:\Windows\System\ioBlIqU.exe
  C:\Windows\System\ioBlIqU.exe
  2⤵
  PID:7112
- C:\Windows\System\fgIaczq.exe
  C:\Windows\System\fgIaczq.exe
  2⤵
  PID:7136
- C:\Windows\System\cvxLaWz.exe
  C:\Windows\System\cvxLaWz.exe
  2⤵
  PID:6328
- C:\Windows\System\InYbBLI.exe
  C:\Windows\System\InYbBLI.exe
  2⤵
  PID:6252
- C:\Windows\System\cMGbABl.exe
  C:\Windows\System\cMGbABl.exe
  2⤵
  PID:6332
- C:\Windows\System\UNdOHjI.exe
  C:\Windows\System\UNdOHjI.exe
  2⤵
  PID:6348
- C:\Windows\System\jiNIfuJ.exe
  C:\Windows\System\jiNIfuJ.exe
  2⤵
  PID:6424
- C:\Windows\System\VzMCQXM.exe
  C:\Windows\System\VzMCQXM.exe
  2⤵
  PID:6492
- C:\Windows\System\MgpzxsT.exe
  C:\Windows\System\MgpzxsT.exe
  2⤵
  PID:6584
- C:\Windows\System\jNbtJUv.exe
  C:\Windows\System\jNbtJUv.exe
  2⤵
  PID:6408
- C:\Windows\System\psGQrbv.exe
  C:\Windows\System\psGQrbv.exe
  2⤵
  PID:6716
- C:\Windows\System\aziocQV.exe
  C:\Windows\System\aziocQV.exe
  2⤵
  PID:6536
- C:\Windows\System\gCtEfTl.exe
  C:\Windows\System\gCtEfTl.exe
  2⤵
  PID:6904
- C:\Windows\System\gxphMru.exe
  C:\Windows\System\gxphMru.exe
  2⤵
  PID:6796
- C:\Windows\System\rYXctmb.exe
  C:\Windows\System\rYXctmb.exe
  2⤵
  PID:7036
- C:\Windows\System\xZcCBDN.exe
  C:\Windows\System\xZcCBDN.exe
  2⤵
  PID:6604
- C:\Windows\System\rgOkoHX.exe
  C:\Windows\System\rgOkoHX.exe
  2⤵
  PID:6728
- C:\Windows\System\NAHsXRj.exe
  C:\Windows\System\NAHsXRj.exe
  2⤵
  PID:6444
- C:\Windows\System\GQMkyfq.exe
  C:\Windows\System\GQMkyfq.exe
  2⤵
  PID:6780
- C:\Windows\System\BghEkLD.exe
  C:\Windows\System\BghEkLD.exe
  2⤵
  PID:6844
- C:\Windows\System\ICGDWcg.exe
  C:\Windows\System\ICGDWcg.exe
  2⤵
  PID:7120
- C:\Windows\System\OlmlrRy.exe
  C:\Windows\System\OlmlrRy.exe
  2⤵
  PID:7068
- C:\Windows\System\fVZmJVS.exe
  C:\Windows\System\fVZmJVS.exe
  2⤵
  PID:7152
- C:\Windows\System\DUtdtOU.exe
  C:\Windows\System\DUtdtOU.exe
  2⤵
  PID:5792
- C:\Windows\System\YmkBuvf.exe
  C:\Windows\System\YmkBuvf.exe
  2⤵
  PID:5472
- C:\Windows\System\OXgKuNv.exe
  C:\Windows\System\OXgKuNv.exe
  2⤵
  PID:1484
- C:\Windows\System\TDoRVlP.exe
  C:\Windows\System\TDoRVlP.exe
  2⤵
  PID:5344
- C:\Windows\System\oLAKsOD.exe
  C:\Windows\System\oLAKsOD.exe
  2⤵
  PID:6220
- C:\Windows\System\YlyuVaN.exe
  C:\Windows\System\YlyuVaN.exe
  2⤵
  PID:5568
- C:\Windows\System\HBZiPcb.exe
  C:\Windows\System\HBZiPcb.exe
  2⤵
  PID:6344
- C:\Windows\System\weKwyMC.exe
  C:\Windows\System\weKwyMC.exe
  2⤵
  PID:6396
- C:\Windows\System\WzuwLul.exe
  C:\Windows\System\WzuwLul.exe
  2⤵
  PID:6620
- C:\Windows\System\NaFPTPe.exe
  C:\Windows\System\NaFPTPe.exe
  2⤵
  PID:6888
- C:\Windows\System\tzCVxiB.exe
  C:\Windows\System\tzCVxiB.exe
  2⤵
  PID:6524
- C:\Windows\System\EFnTjUY.exe
  C:\Windows\System\EFnTjUY.exe
  2⤵
  PID:7148
- C:\Windows\System\XqUkkcP.exe
  C:\Windows\System\XqUkkcP.exe
  2⤵
  PID:7032
- C:\Windows\System\CXRRspX.exe
  C:\Windows\System\CXRRspX.exe
  2⤵
  PID:6456
- C:\Windows\System\hMrpmgO.exe
  C:\Windows\System\hMrpmgO.exe
  2⤵
  PID:6764
- C:\Windows\System\RbrwKqb.exe
  C:\Windows\System\RbrwKqb.exe
  2⤵
  PID:7124
- C:\Windows\System\OTqpbcN.exe
  C:\Windows\System\OTqpbcN.exe
  2⤵
  PID:7004
- C:\Windows\System\vXwVGqf.exe
  C:\Windows\System\vXwVGqf.exe
  2⤵
  PID:6296
- C:\Windows\System\UAvEgiD.exe
  C:\Windows\System\UAvEgiD.exe
  2⤵
  PID:6684
- C:\Windows\System\sbdUwYB.exe
  C:\Windows\System\sbdUwYB.exe
  2⤵
  PID:7048
- C:\Windows\System\QzPbuGk.exe
  C:\Windows\System\QzPbuGk.exe
  2⤵
  PID:6668
- C:\Windows\System\EsXCmYU.exe
  C:\Windows\System\EsXCmYU.exe
  2⤵
  PID:6312
- C:\Windows\System\aRUDTkB.exe
  C:\Windows\System\aRUDTkB.exe
  2⤵
  PID:7144
- C:\Windows\System\CXKdrzE.exe
  C:\Windows\System\CXKdrzE.exe
  2⤵
  PID:6200
- C:\Windows\System\fGxUyPa.exe
  C:\Windows\System\fGxUyPa.exe
  2⤵
  PID:6412
- C:\Windows\System\hlYciWS.exe
  C:\Windows\System\hlYciWS.exe
  2⤵
  PID:6616
- C:\Windows\System\WhKTUbn.exe
  C:\Windows\System\WhKTUbn.exe
  2⤵
  PID:7100
- C:\Windows\System\YwvLkay.exe
  C:\Windows\System\YwvLkay.exe
  2⤵
  PID:7108
- C:\Windows\System\RDyJZRu.exe
  C:\Windows\System\RDyJZRu.exe
  2⤵
  PID:6540
- C:\Windows\System\FZSmWdK.exe
  C:\Windows\System\FZSmWdK.exe
  2⤵
  PID:5376
- C:\Windows\System\YnfqFkr.exe
  C:\Windows\System\YnfqFkr.exe
  2⤵
  PID:6216
- C:\Windows\System\eoRBigR.exe
  C:\Windows\System\eoRBigR.exe
  2⤵
  PID:6268
- C:\Windows\System\JFCqPkj.exe
  C:\Windows\System\JFCqPkj.exe
  2⤵
  PID:7172
- C:\Windows\System\AkcFqHY.exe
  C:\Windows\System\AkcFqHY.exe
  2⤵
  PID:7188
- C:\Windows\System\kVXpcqa.exe
  C:\Windows\System\kVXpcqa.exe
  2⤵
  PID:7212
- C:\Windows\System\mfFfnTj.exe
  C:\Windows\System\mfFfnTj.exe
  2⤵
  PID:7232
- C:\Windows\System\VAPAxNM.exe
  C:\Windows\System\VAPAxNM.exe
  2⤵
  PID:7248
- C:\Windows\System\LVnlcyN.exe
  C:\Windows\System\LVnlcyN.exe
  2⤵
  PID:7268
- C:\Windows\System\nJOwxCk.exe
  C:\Windows\System\nJOwxCk.exe
  2⤵
  PID:7284
- C:\Windows\System\nBVtVuf.exe
  C:\Windows\System\nBVtVuf.exe
  2⤵
  PID:7300
- C:\Windows\System\ZlWFuIh.exe
  C:\Windows\System\ZlWFuIh.exe
  2⤵
  PID:7320
- C:\Windows\System\GirWZdY.exe
  C:\Windows\System\GirWZdY.exe
  2⤵
  PID:7336
- C:\Windows\System\OXLMXwX.exe
  C:\Windows\System\OXLMXwX.exe
  2⤵
  PID:7352
- C:\Windows\System\QVKJPET.exe
  C:\Windows\System\QVKJPET.exe
  2⤵
  PID:7372
- C:\Windows\System\HJypfVl.exe
  C:\Windows\System\HJypfVl.exe
  2⤵
  PID:7396
- C:\Windows\System\XOPjtna.exe
  C:\Windows\System\XOPjtna.exe
  2⤵
  PID:7412
- C:\Windows\System\WFfUEzJ.exe
  C:\Windows\System\WFfUEzJ.exe
  2⤵
  PID:7436
- C:\Windows\System\PMXELOM.exe
  C:\Windows\System\PMXELOM.exe
  2⤵
  PID:7552
- C:\Windows\System\ELaQKJt.exe
  C:\Windows\System\ELaQKJt.exe
  2⤵
  PID:7684
- C:\Windows\System\kYKMENl.exe
  C:\Windows\System\kYKMENl.exe
  2⤵
  PID:7700
- C:\Windows\System\xmIQfLx.exe
  C:\Windows\System\xmIQfLx.exe
  2⤵
  PID:7716
- C:\Windows\System\ZcXrRGa.exe
  C:\Windows\System\ZcXrRGa.exe
  2⤵
  PID:7736
- C:\Windows\System\vvQEGcy.exe
  C:\Windows\System\vvQEGcy.exe
  2⤵
  PID:7784
- C:\Windows\System\jzyaawG.exe
  C:\Windows\System\jzyaawG.exe
  2⤵
  PID:7816
- C:\Windows\System\dSROaPp.exe
  C:\Windows\System\dSROaPp.exe
  2⤵
  PID:7844
- C:\Windows\System\HssgqQE.exe
  C:\Windows\System\HssgqQE.exe
  2⤵
  PID:7868
- C:\Windows\System\tBLfGxD.exe
  C:\Windows\System\tBLfGxD.exe
  2⤵
  PID:8088
- C:\Windows\System\ZMeKawv.exe
  C:\Windows\System\ZMeKawv.exe
  2⤵
  PID:8164
- C:\Windows\System\dNibpkj.exe
  C:\Windows\System\dNibpkj.exe
  2⤵
  PID:8180
- C:\Windows\System\YPcitqr.exe
  C:\Windows\System\YPcitqr.exe
  2⤵
  PID:6460
- C:\Windows\System\AiXJgGn.exe
  C:\Windows\System\AiXJgGn.exe
  2⤵
  PID:6168
- C:\Windows\System\iOrfRQI.exe
  C:\Windows\System\iOrfRQI.exe
  2⤵
  PID:7200
- C:\Windows\System\VLTxobB.exe
  C:\Windows\System\VLTxobB.exe
  2⤵
  PID:7244
- C:\Windows\System\PWXxmhg.exe
  C:\Windows\System\PWXxmhg.exe
  2⤵
  PID:5316
- C:\Windows\System\arbkbfJ.exe
  C:\Windows\System\arbkbfJ.exe
  2⤵
  PID:7180
- C:\Windows\System\cNoEnjP.exe
  C:\Windows\System\cNoEnjP.exe
  2⤵
  PID:7228
- C:\Windows\System\xryMMUq.exe
  C:\Windows\System\xryMMUq.exe
  2⤵
  PID:7888
- C:\Windows\System\oSLvDUu.exe
  C:\Windows\System\oSLvDUu.exe
  2⤵
  PID:7916
- C:\Windows\System\MeRIbph.exe
  C:\Windows\System\MeRIbph.exe
  2⤵
  PID:7932
- C:\Windows\System\blRmXup.exe
  C:\Windows\System\blRmXup.exe
  2⤵
  PID:7952
- C:\Windows\System\DZYJikD.exe
  C:\Windows\System\DZYJikD.exe
  2⤵
  PID:7980
- C:\Windows\System\nUJlsNs.exe
  C:\Windows\System\nUJlsNs.exe
  2⤵
  PID:7996
- C:\Windows\System\mAFSeym.exe
  C:\Windows\System\mAFSeym.exe
  2⤵
  PID:8012
- C:\Windows\System\fOltHFx.exe
  C:\Windows\System\fOltHFx.exe
  2⤵
  PID:8032
- C:\Windows\System\nJwkUPi.exe
  C:\Windows\System\nJwkUPi.exe
  2⤵
  PID:8084
- C:\Windows\System\IOwPJNt.exe
  C:\Windows\System\IOwPJNt.exe
  2⤵
  PID:8124
- C:\Windows\System\ECICZxP.exe
  C:\Windows\System\ECICZxP.exe
  2⤵
  PID:8116
- C:\Windows\System\eynATem.exe
  C:\Windows\System\eynATem.exe
  2⤵
  PID:8172
- C:\Windows\System\QvoEVmr.exe
  C:\Windows\System\QvoEVmr.exe
  2⤵
  PID:8148
- C:\Windows\System\ltiTCXo.exe
  C:\Windows\System\ltiTCXo.exe
  2⤵
  PID:8188
- C:\Windows\System\szvYmWG.exe
  C:\Windows\System\szvYmWG.exe
  2⤵
  PID:7220
- C:\Windows\System\MiGwPzP.exe
  C:\Windows\System\MiGwPzP.exe
  2⤵
  PID:4980
- C:\Windows\System\CWeLEXI.exe
  C:\Windows\System\CWeLEXI.exe
  2⤵
  PID:7240
- C:\Windows\System\cwAyIxT.exe
  C:\Windows\System\cwAyIxT.exe
  2⤵
  PID:7328
- C:\Windows\System\tiBttnG.exe
  C:\Windows\System\tiBttnG.exe
  2⤵
  PID:7368
- C:\Windows\System\CndKthC.exe
  C:\Windows\System\CndKthC.exe
  2⤵
  PID:7308
- C:\Windows\System\nKZqtFJ.exe
  C:\Windows\System\nKZqtFJ.exe
  2⤵
  PID:7344
- C:\Windows\System\wkFJzFx.exe
  C:\Windows\System\wkFJzFx.exe
  2⤵
  PID:7392
- C:\Windows\System\cniUeuL.exe
  C:\Windows\System\cniUeuL.exe
  2⤵
  PID:7432
- C:\Windows\System\tDvPXKm.exe
  C:\Windows\System\tDvPXKm.exe
  2⤵
  PID:7424
- C:\Windows\System\uptXqiw.exe
  C:\Windows\System\uptXqiw.exe
  2⤵
  PID:7476
- C:\Windows\System\StzPHhw.exe
  C:\Windows\System\StzPHhw.exe
  2⤵
  PID:7488
- C:\Windows\System\uLyGpHB.exe
  C:\Windows\System\uLyGpHB.exe
  2⤵
  PID:7508
- C:\Windows\System\MmQibzI.exe
  C:\Windows\System\MmQibzI.exe
  2⤵
  PID:7520
- C:\Windows\System\uvCypNE.exe
  C:\Windows\System\uvCypNE.exe
  2⤵
  PID:7756
- C:\Windows\System\FZrmfkH.exe
  C:\Windows\System\FZrmfkH.exe
  2⤵
  PID:7836
- C:\Windows\System\TTEnggc.exe
  C:\Windows\System\TTEnggc.exe
  2⤵
  PID:7904
- C:\Windows\System\UacqbwJ.exe
  C:\Windows\System\UacqbwJ.exe
  2⤵
  PID:7796
- C:\Windows\System\pKISEDb.exe
  C:\Windows\System\pKISEDb.exe
  2⤵
  PID:8004
- C:\Windows\System\ILiQnIw.exe
  C:\Windows\System\ILiQnIw.exe
  2⤵
  PID:8064
- C:\Windows\System\dmRtKRb.exe
  C:\Windows\System\dmRtKRb.exe
  2⤵
  PID:7908
- C:\Windows\System\aXwVqiC.exe
  C:\Windows\System\aXwVqiC.exe
  2⤵
  PID:8152
- C:\Windows\System\fFOJyTx.exe
  C:\Windows\System\fFOJyTx.exe
  2⤵
  PID:6172
- C:\Windows\System\UQWCuWx.exe
  C:\Windows\System\UQWCuWx.exe
  2⤵
  PID:7360
- C:\Windows\System\uwCGDls.exe
  C:\Windows\System\uwCGDls.exe
  2⤵
  PID:7420
- C:\Windows\System\aItckyC.exe
  C:\Windows\System\aItckyC.exe
  2⤵
  PID:7500
- C:\Windows\System\MEhMuIN.exe
  C:\Windows\System\MEhMuIN.exe
  2⤵
  PID:7540
- C:\Windows\System\WZLudth.exe
  C:\Windows\System\WZLudth.exe
  2⤵
  PID:7544
- C:\Windows\System\lvUzLNN.exe
  C:\Windows\System\lvUzLNN.exe
  2⤵
  PID:7576
- C:\Windows\System\PGbJzZU.exe
  C:\Windows\System\PGbJzZU.exe
  2⤵
  PID:7592
- C:\Windows\System\YRujLEK.exe
  C:\Windows\System\YRujLEK.exe
  2⤵
  PID:7480
- C:\Windows\System\buaJUsL.exe
  C:\Windows\System\buaJUsL.exe
  2⤵
  PID:7608
- C:\Windows\System\FuyMFfQ.exe
  C:\Windows\System\FuyMFfQ.exe
  2⤵
  PID:7628
- C:\Windows\System\RvwheIR.exe
  C:\Windows\System\RvwheIR.exe
  2⤵
  PID:6600
- C:\Windows\System\EMEORaV.exe
  C:\Windows\System\EMEORaV.exe
  2⤵
  PID:7632
- C:\Windows\System\CNQJERy.exe
  C:\Windows\System\CNQJERy.exe
  2⤵
  PID:7696
- C:\Windows\System\TKPCuxN.exe
  C:\Windows\System\TKPCuxN.exe
  2⤵
  PID:7660
- C:\Windows\System\clbKtpo.exe
  C:\Windows\System\clbKtpo.exe
  2⤵
  PID:7656
- C:\Windows\System\jjrPalC.exe
  C:\Windows\System\jjrPalC.exe
  2⤵
  PID:7388
- C:\Windows\System\AgakOsx.exe
  C:\Windows\System\AgakOsx.exe
  2⤵
  PID:7484
- C:\Windows\System\IDhGknu.exe
  C:\Windows\System\IDhGknu.exe
  2⤵
  PID:7676
- C:\Windows\System\EsnBOzq.exe
  C:\Windows\System\EsnBOzq.exe
  2⤵
  PID:7760
- C:\Windows\System\rsNxvYt.exe
  C:\Windows\System\rsNxvYt.exe
  2⤵
  PID:7792
- C:\Windows\System\dvXmIYG.exe
  C:\Windows\System\dvXmIYG.exe
  2⤵
  PID:7976
- C:\Windows\System\qXhGQSd.exe
  C:\Windows\System\qXhGQSd.exe
  2⤵
  PID:7804
- C:\Windows\System\KEeikUw.exe
  C:\Windows\System\KEeikUw.exe
  2⤵
  PID:7612
- C:\Windows\System\FREZATO.exe
  C:\Windows\System\FREZATO.exe
  2⤵
  PID:7668
- C:\Windows\System\eaNYhGA.exe
  C:\Windows\System\eaNYhGA.exe
  2⤵
  PID:7264
- C:\Windows\System\QAoiAoC.exe
  C:\Windows\System\QAoiAoC.exe
  2⤵
  PID:8132
- C:\Windows\System\sTVTOJx.exe
  C:\Windows\System\sTVTOJx.exe
  2⤵
  PID:7644
- C:\Windows\System\KdwUeGm.exe
  C:\Windows\System\KdwUeGm.exe
  2⤵
  PID:7468
- C:\Windows\System\oftbmra.exe
  C:\Windows\System\oftbmra.exe
  2⤵
  PID:7560
- C:\Windows\System\sTbwhOq.exe
  C:\Windows\System\sTbwhOq.exe
  2⤵
  PID:7296
- C:\Windows\System\JeGcpCn.exe
  C:\Windows\System\JeGcpCn.exe
  2⤵
  PID:7724
- C:\Windows\System\wZpYINK.exe
  C:\Windows\System\wZpYINK.exe
  2⤵
  PID:7824
- C:\Windows\System\eBJjMAO.exe
  C:\Windows\System\eBJjMAO.exe
  2⤵
  PID:7780
- C:\Windows\System\QUjyhtb.exe
  C:\Windows\System\QUjyhtb.exe
  2⤵
  PID:7940
- C:\Windows\System\CefPdsb.exe
  C:\Windows\System\CefPdsb.exe
  2⤵
  PID:7800
- C:\Windows\System\sENNbLd.exe
  C:\Windows\System\sENNbLd.exe
  2⤵
  PID:7988
- C:\Windows\System\ldVRDKL.exe
  C:\Windows\System\ldVRDKL.exe
  2⤵
  PID:8080
- C:\Windows\System\whVpRrO.exe
  C:\Windows\System\whVpRrO.exe
  2⤵
  PID:7224
- C:\Windows\System\MvFWvSD.exe
  C:\Windows\System\MvFWvSD.exe
  2⤵
  PID:7600
- C:\Windows\System\wsyHDiH.exe
  C:\Windows\System\wsyHDiH.exe
  2⤵
  PID:7900
- C:\Windows\System\uyyWpKU.exe
  C:\Windows\System\uyyWpKU.exe
  2⤵
  PID:7280
- C:\Windows\System\kIrWcbd.exe
  C:\Windows\System\kIrWcbd.exe
  2⤵
  PID:7588
- C:\Windows\System\duAPpnF.exe
  C:\Windows\System\duAPpnF.exe
  2⤵
  PID:7856
- C:\Windows\System\LFXIJnW.exe
  C:\Windows\System\LFXIJnW.exe
  2⤵
  PID:7944
- C:\Windows\System\bSWYlGu.exe
  C:\Windows\System\bSWYlGu.exe
  2⤵
  PID:8060
- C:\Windows\System\WlIReBj.exe
  C:\Windows\System\WlIReBj.exe
  2⤵
  PID:8024
- C:\Windows\System\CBNnoOA.exe
  C:\Windows\System\CBNnoOA.exe
  2⤵
  PID:8144
- C:\Windows\System\dCbZSoU.exe
  C:\Windows\System\dCbZSoU.exe
  2⤵
  PID:7648
- C:\Windows\System\EuuNuTq.exe
  C:\Windows\System\EuuNuTq.exe
  2⤵
  PID:8200
- C:\Windows\System\MOdLtGp.exe
  C:\Windows\System\MOdLtGp.exe
  2⤵
  PID:8216
- C:\Windows\System\pkCCeEl.exe
  C:\Windows\System\pkCCeEl.exe
  2⤵
  PID:8236
- C:\Windows\System\jvPegRq.exe
  C:\Windows\System\jvPegRq.exe
  2⤵
  PID:8252
- C:\Windows\System\iRCUNaD.exe
  C:\Windows\System\iRCUNaD.exe
  2⤵
  PID:8268
- C:\Windows\System\GSDgbSD.exe
  C:\Windows\System\GSDgbSD.exe
  2⤵
  PID:8288
- C:\Windows\System\pQNwRlP.exe
  C:\Windows\System\pQNwRlP.exe
  2⤵
  PID:8308
- C:\Windows\System\kzuWYfJ.exe
  C:\Windows\System\kzuWYfJ.exe
  2⤵
  PID:8324
- C:\Windows\System\wOOLkKt.exe
  C:\Windows\System\wOOLkKt.exe
  2⤵
  PID:8340
- C:\Windows\System\weUaGlr.exe
  C:\Windows\System\weUaGlr.exe
  2⤵
  PID:8356
- C:\Windows\System\ctenLfN.exe
  C:\Windows\System\ctenLfN.exe
  2⤵
  PID:8432
- C:\Windows\System\fwTaRPJ.exe
  C:\Windows\System\fwTaRPJ.exe
  2⤵
  PID:8448
- C:\Windows\System\YNpUYkH.exe
  C:\Windows\System\YNpUYkH.exe
  2⤵
  PID:8464
- C:\Windows\System\VDTjwqG.exe
  C:\Windows\System\VDTjwqG.exe
  2⤵
  PID:8480
- C:\Windows\System\WnetIFY.exe
  C:\Windows\System\WnetIFY.exe
  2⤵
  PID:8496
- C:\Windows\System\wIIiYBm.exe
  C:\Windows\System\wIIiYBm.exe
  2⤵
  PID:8512
- C:\Windows\System\lPRAprq.exe
  C:\Windows\System\lPRAprq.exe
  2⤵
  PID:8528
- C:\Windows\System\FcSBNCg.exe
  C:\Windows\System\FcSBNCg.exe
  2⤵
  PID:8544
- C:\Windows\System\uVOSGgI.exe
  C:\Windows\System\uVOSGgI.exe
  2⤵
  PID:8560
- C:\Windows\System\sWWPFQQ.exe
  C:\Windows\System\sWWPFQQ.exe
  2⤵
  PID:8624
- C:\Windows\System\rretXaX.exe
  C:\Windows\System\rretXaX.exe
  2⤵
  PID:8648
- C:\Windows\System\UcoyKzv.exe
  C:\Windows\System\UcoyKzv.exe
  2⤵
  PID:8664
- C:\Windows\System\eIaeUfQ.exe
  C:\Windows\System\eIaeUfQ.exe
  2⤵
  PID:8688
- C:\Windows\System\SJjPEWR.exe
  C:\Windows\System\SJjPEWR.exe
  2⤵
  PID:8704
- C:\Windows\System\sPaDkQs.exe
  C:\Windows\System\sPaDkQs.exe
  2⤵
  PID:8720
- C:\Windows\System\wuSfoon.exe
  C:\Windows\System\wuSfoon.exe
  2⤵
  PID:8748
- C:\Windows\System\PCrudwF.exe
  C:\Windows\System\PCrudwF.exe
  2⤵
  PID:8768
- C:\Windows\System\CZfHDYa.exe
  C:\Windows\System\CZfHDYa.exe
  2⤵
  PID:8792
- C:\Windows\System\KQrijrj.exe
  C:\Windows\System\KQrijrj.exe
  2⤵
  PID:8808
- C:\Windows\System\YEHLQwI.exe
  C:\Windows\System\YEHLQwI.exe
  2⤵
  PID:8824
- C:\Windows\System\EeLpVJz.exe
  C:\Windows\System\EeLpVJz.exe
  2⤵
  PID:8840
- C:\Windows\System\BPpdYxr.exe
  C:\Windows\System\BPpdYxr.exe
  2⤵
  PID:8856
- C:\Windows\System\KbpdgKQ.exe
  C:\Windows\System\KbpdgKQ.exe
  2⤵
  PID:8872
- C:\Windows\System\JWKYhQW.exe
  C:\Windows\System\JWKYhQW.exe
  2⤵
  PID:8888
- C:\Windows\System\OghNcgB.exe
  C:\Windows\System\OghNcgB.exe
  2⤵
  PID:8908
- C:\Windows\System\QlDONzX.exe
  C:\Windows\System\QlDONzX.exe
  2⤵
  PID:8924
- C:\Windows\System\oliJrxp.exe
  C:\Windows\System\oliJrxp.exe
  2⤵
  PID:8944
- C:\Windows\System\hlxQFQP.exe
  C:\Windows\System\hlxQFQP.exe
  2⤵
  PID:8996
- C:\Windows\System\hvBwYUq.exe
  C:\Windows\System\hvBwYUq.exe
  2⤵
  PID:9012
- C:\Windows\System\xjbdhkq.exe
  C:\Windows\System\xjbdhkq.exe
  2⤵
  PID:9028
- C:\Windows\System\hTZYmFr.exe
  C:\Windows\System\hTZYmFr.exe
  2⤵
  PID:9044
- C:\Windows\System\rmwDKId.exe
  C:\Windows\System\rmwDKId.exe
  2⤵
  PID:9060
- C:\Windows\System\sefnzlr.exe
  C:\Windows\System\sefnzlr.exe
  2⤵
  PID:9076
- C:\Windows\System\qIdXZFj.exe
  C:\Windows\System\qIdXZFj.exe
  2⤵
  PID:9096
- C:\Windows\System\JpyuthI.exe
  C:\Windows\System\JpyuthI.exe
  2⤵
  PID:9112
- C:\Windows\System\gFqcJJz.exe
  C:\Windows\System\gFqcJJz.exe
  2⤵
  PID:9128
- C:\Windows\System\BsbNIxV.exe
  C:\Windows\System\BsbNIxV.exe
  2⤵
  PID:9144
- C:\Windows\System\hUzwLwp.exe
  C:\Windows\System\hUzwLwp.exe
  2⤵
  PID:9160
- C:\Windows\System\WyPhqMm.exe
  C:\Windows\System\WyPhqMm.exe
  2⤵
  PID:9180
- C:\Windows\System\wpwwFsu.exe
  C:\Windows\System\wpwwFsu.exe
  2⤵
  PID:9196
- C:\Windows\System\oRxZaBM.exe
  C:\Windows\System\oRxZaBM.exe
  2⤵
  PID:9212
- C:\Windows\System\HpWNqbF.exe
  C:\Windows\System\HpWNqbF.exe
  2⤵
  PID:7624
- C:\Windows\System\kesydny.exe
  C:\Windows\System\kesydny.exe
  2⤵
  PID:8244
- C:\Windows\System\xAPofIB.exe
  C:\Windows\System\xAPofIB.exe
  2⤵
  PID:8284
- C:\Windows\System\YKeqvlx.exe
  C:\Windows\System\YKeqvlx.exe
  2⤵
  PID:7492
- C:\Windows\System\oSxjLwX.exe
  C:\Windows\System\oSxjLwX.exe
  2⤵
  PID:8044
- C:\Windows\System\eIXCNeH.exe
  C:\Windows\System\eIXCNeH.exe
  2⤵
  PID:8380
- C:\Windows\System\KvuafgZ.exe
  C:\Windows\System\KvuafgZ.exe
  2⤵
  PID:8332
- C:\Windows\System\ORAPWMm.exe
  C:\Windows\System\ORAPWMm.exe
  2⤵
  PID:8096
- C:\Windows\System\mSgzJrp.exe
  C:\Windows\System\mSgzJrp.exe
  2⤵
  PID:8076
- C:\Windows\System\AmDIyeF.exe
  C:\Windows\System\AmDIyeF.exe
  2⤵
  PID:7972
- C:\Windows\System\vLddhMD.exe
  C:\Windows\System\vLddhMD.exe
  2⤵
  PID:8224
- C:\Windows\System\dIsIzms.exe
  C:\Windows\System\dIsIzms.exe
  2⤵
  PID:7536
- C:\Windows\System\jCOpNcj.exe
  C:\Windows\System\jCOpNcj.exe
  2⤵
  PID:8388
- C:\Windows\System\PXcznQV.exe
  C:\Windows\System\PXcznQV.exe
  2⤵
  PID:8416
- C:\Windows\System\mGQkVsc.exe
  C:\Windows\System\mGQkVsc.exe
  2⤵
  PID:8440
- C:\Windows\System\uufCTXb.exe
  C:\Windows\System\uufCTXb.exe
  2⤵
  PID:8476
- C:\Windows\System\KGAkKop.exe
  C:\Windows\System\KGAkKop.exe
  2⤵
  PID:8540
- C:\Windows\System\vJQdZUn.exe
  C:\Windows\System\vJQdZUn.exe
  2⤵
  PID:8456
- C:\Windows\System\ziyToik.exe
  C:\Windows\System\ziyToik.exe
  2⤵
  PID:8580
- C:\Windows\System\psSFKew.exe
  C:\Windows\System\psSFKew.exe
  2⤵
  PID:8596
- C:\Windows\System\yOMjgbt.exe
  C:\Windows\System\yOMjgbt.exe
  2⤵
  PID:8612
- C:\Windows\System\omyWiCG.exe
  C:\Windows\System\omyWiCG.exe
  2⤵
  PID:8520
- C:\Windows\System\HrooYJu.exe
  C:\Windows\System\HrooYJu.exe
  2⤵
  PID:8640
- C:\Windows\System\AmVRBno.exe
  C:\Windows\System\AmVRBno.exe
  2⤵
  PID:7732
- C:\Windows\System\HppsFrt.exe
  C:\Windows\System\HppsFrt.exe
  2⤵
  PID:8696
- C:\Windows\System\fQsjRsP.exe
  C:\Windows\System\fQsjRsP.exe
  2⤵
  PID:8728
- C:\Windows\System\JQfVRhc.exe
  C:\Windows\System\JQfVRhc.exe
  2⤵
  PID:8740
- C:\Windows\System\ldeXvIb.exe
  C:\Windows\System\ldeXvIb.exe
  2⤵
  PID:8776
- C:\Windows\System\RjaVdNu.exe
  C:\Windows\System\RjaVdNu.exe
  2⤵
  PID:8788
- C:\Windows\System\bypGbiu.exe
  C:\Windows\System\bypGbiu.exe
  2⤵
  PID:8884
- C:\Windows\System\eOQbePR.exe
  C:\Windows\System\eOQbePR.exe
  2⤵
  PID:8952
- C:\Windows\System\fyvxFUh.exe
  C:\Windows\System\fyvxFUh.exe
  2⤵
  PID:8800
- C:\Windows\System\yOSIhQE.exe
  C:\Windows\System\yOSIhQE.exe
  2⤵
  PID:8904
- C:\Windows\System\tGlvtyu.exe
  C:\Windows\System\tGlvtyu.exe
  2⤵
  PID:8968
- C:\Windows\System\bFECnil.exe
  C:\Windows\System\bFECnil.exe
  2⤵
  PID:8900
- C:\Windows\System\fHcqqMk.exe
  C:\Windows\System\fHcqqMk.exe
  2⤵
  PID:8676
- C:\Windows\System\QEhHDjE.exe
  C:\Windows\System\QEhHDjE.exe
  2⤵
  PID:9008
- C:\Windows\System\ckHdBJd.exe
  C:\Windows\System\ckHdBJd.exe
  2⤵
  PID:9120
- C:\Windows\System\mHEsOhs.exe
  C:\Windows\System\mHEsOhs.exe
  2⤵
  PID:9092
- C:\Windows\System\ohnRPiU.exe
  C:\Windows\System\ohnRPiU.exe
  2⤵
  PID:9168
- C:\Windows\System\eKFymmP.exe
  C:\Windows\System\eKFymmP.exe
  2⤵
  PID:9040
- C:\Windows\System\EVRdhZJ.exe
  C:\Windows\System\EVRdhZJ.exe
  2⤵
  PID:9124
- C:\Windows\System\imYWYNZ.exe
  C:\Windows\System\imYWYNZ.exe
  2⤵
  PID:7812
- C:\Windows\System\hvqfYxQ.exe
  C:\Windows\System\hvqfYxQ.exe
  2⤵
  PID:8280
- C:\Windows\System\yfFTIin.exe
  C:\Windows\System\yfFTIin.exe
  2⤵
  PID:9208
- C:\Windows\System\XJJundD.exe
  C:\Windows\System\XJJundD.exe
  2⤵
  PID:7968
- C:\Windows\System\AESBXww.exe
  C:\Windows\System\AESBXww.exe
  2⤵
  PID:8368
- C:\Windows\System\QLZdIuj.exe
  C:\Windows\System\QLZdIuj.exe
  2⤵
  PID:8232
- C:\Windows\System\STPJfxf.exe
  C:\Windows\System\STPJfxf.exe
  2⤵
  PID:8348
- C:\Windows\System\xBLDiOS.exe
  C:\Windows\System\xBLDiOS.exe
  2⤵
  PID:8352
- C:\Windows\System\cRengMI.exe
  C:\Windows\System\cRengMI.exe
  2⤵
  PID:8576
- C:\Windows\System\hcjYgbl.exe
  C:\Windows\System\hcjYgbl.exe
  2⤵
  PID:7584
- C:\Windows\System\pMLbFua.exe
  C:\Windows\System\pMLbFua.exe
  2⤵
  PID:8552
- C:\Windows\System\lbhgCaS.exe
  C:\Windows\System\lbhgCaS.exe
  2⤵
  PID:8572
- C:\Windows\System\ZacKIoZ.exe
  C:\Windows\System\ZacKIoZ.exe
  2⤵
  PID:8404
- C:\Windows\System\xzSjyyP.exe
  C:\Windows\System\xzSjyyP.exe
  2⤵
  PID:8620
- C:\Windows\System\HORBDGl.exe
  C:\Windows\System\HORBDGl.exe
  2⤵
  PID:8672
- C:\Windows\System\hROkETS.exe
  C:\Windows\System\hROkETS.exe
  2⤵
  PID:8656
- C:\Windows\System\AWqoCta.exe
  C:\Windows\System\AWqoCta.exe
  2⤵
  PID:8684
- C:\Windows\System\rJKkigR.exe
  C:\Windows\System\rJKkigR.exe
  2⤵
  PID:8868
- C:\Windows\System\JnKlNxj.exe
  C:\Windows\System\JnKlNxj.exe
  2⤵
  PID:8700
- C:\Windows\System\ZLJriFK.exe
  C:\Windows\System\ZLJriFK.exe
  2⤵
  PID:9084
- C:\Windows\System\DjkiQPi.exe
  C:\Windows\System\DjkiQPi.exe
  2⤵
  PID:7960
- C:\Windows\System\nAdVsAR.exe
  C:\Windows\System\nAdVsAR.exe
  2⤵
  PID:8880
- C:\Windows\System\YICMJfq.exe
  C:\Windows\System\YICMJfq.exe
  2⤵
  PID:8940
- C:\Windows\System\akiKjjq.exe
  C:\Windows\System\akiKjjq.exe
  2⤵
  PID:9056
- C:\Windows\System\yvSovKW.exe
  C:\Windows\System\yvSovKW.exe
  2⤵
  PID:7948
- C:\Windows\System\eamhiwQ.exe
  C:\Windows\System\eamhiwQ.exe
  2⤵
  PID:9204
- C:\Windows\System\kjezqvl.exe
  C:\Windows\System\kjezqvl.exe
  2⤵
  PID:8536
- C:\Windows\System\bBJbAIu.exe
  C:\Windows\System\bBJbAIu.exe
  2⤵
  PID:8472
- C:\Windows\System\fTApyVn.exe
  C:\Windows\System\fTApyVn.exe
  2⤵
  PID:8592
- C:\Windows\System\HXkocrn.exe
  C:\Windows\System\HXkocrn.exe
  2⤵
  PID:8832
- C:\Windows\System\DVEquTJ.exe
  C:\Windows\System\DVEquTJ.exe
  2⤵
  PID:9072
- C:\Windows\System\LEbSGKi.exe
  C:\Windows\System\LEbSGKi.exe
  2⤵
  PID:8936
- C:\Windows\System\YlTmuaO.exe
  C:\Windows\System\YlTmuaO.exe
  2⤵
  PID:8384
- C:\Windows\System\SofXvuJ.exe
  C:\Windows\System\SofXvuJ.exe
  2⤵
  PID:9172
- C:\Windows\System\AqaiaWw.exe
  C:\Windows\System\AqaiaWw.exe
  2⤵
  PID:8636
- C:\Windows\System\izTlCKj.exe
  C:\Windows\System\izTlCKj.exe
  2⤵
  PID:7672
- C:\Windows\System\yEmYkrs.exe
  C:\Windows\System\yEmYkrs.exe
  2⤵
  PID:9104
- C:\Windows\System\SOxqmdo.exe
  C:\Windows\System\SOxqmdo.exe
  2⤵
  PID:8264
- C:\Windows\System\QTNUUfN.exe
  C:\Windows\System\QTNUUfN.exe
  2⤵
  PID:8756
- C:\Windows\System\QQlEgBh.exe
  C:\Windows\System\QQlEgBh.exe
  2⤵
  PID:8424
- C:\Windows\System\kotSSdF.exe
  C:\Windows\System\kotSSdF.exe
  2⤵
  PID:8276
- C:\Windows\System\eOiFcDV.exe
  C:\Windows\System\eOiFcDV.exe
  2⤵
  PID:8820
- C:\Windows\System\IFWMjBo.exe
  C:\Windows\System\IFWMjBo.exe
  2⤵
  PID:9236
- C:\Windows\System\kZjQOYy.exe
  C:\Windows\System\kZjQOYy.exe
  2⤵
  PID:9252
- C:\Windows\System\HanZmRu.exe
  C:\Windows\System\HanZmRu.exe
  2⤵
  PID:9388
- C:\Windows\System\tIpMRCa.exe
  C:\Windows\System\tIpMRCa.exe
  2⤵
  PID:9404
- C:\Windows\System\mjjBuXh.exe
  C:\Windows\System\mjjBuXh.exe
  2⤵
  PID:9420
- C:\Windows\System\DxusWAh.exe
  C:\Windows\System\DxusWAh.exe
  2⤵
  PID:9436
- C:\Windows\System\RdAUoGl.exe
  C:\Windows\System\RdAUoGl.exe
  2⤵
  PID:9456
- C:\Windows\System\vEhodfH.exe
  C:\Windows\System\vEhodfH.exe
  2⤵
  PID:9472
- C:\Windows\System\aymsbWe.exe
  C:\Windows\System\aymsbWe.exe
  2⤵
  PID:9492
- C:\Windows\System\oZjtyyJ.exe
  C:\Windows\System\oZjtyyJ.exe
  2⤵
  PID:9508
- C:\Windows\System\qlCAsEz.exe
  C:\Windows\System\qlCAsEz.exe
  2⤵
  PID:9524
- C:\Windows\System\TLtVziZ.exe
  C:\Windows\System\TLtVziZ.exe
  2⤵
  PID:9540
- C:\Windows\System\ubtoQPe.exe
  C:\Windows\System\ubtoQPe.exe
  2⤵
  PID:9556
- C:\Windows\System\OXjUPaX.exe
  C:\Windows\System\OXjUPaX.exe
  2⤵
  PID:9580
- C:\Windows\System\GyCqerT.exe
  C:\Windows\System\GyCqerT.exe
  2⤵
  PID:9596
- C:\Windows\System\apuIQda.exe
  C:\Windows\System\apuIQda.exe
  2⤵
  PID:9612
- C:\Windows\System\irovgwa.exe
  C:\Windows\System\irovgwa.exe
  2⤵
  PID:9628
- C:\Windows\System\JpqYVAB.exe
  C:\Windows\System\JpqYVAB.exe
  2⤵
  PID:9648
- C:\Windows\System\hSetVty.exe
  C:\Windows\System\hSetVty.exe
  2⤵
  PID:9664
- C:\Windows\System\hscseKm.exe
  C:\Windows\System\hscseKm.exe
  2⤵
  PID:9684
- C:\Windows\System\UOrrFTq.exe
  C:\Windows\System\UOrrFTq.exe
  2⤵
  PID:9720
- C:\Windows\System\QTDnUrp.exe
  C:\Windows\System\QTDnUrp.exe
  2⤵
  PID:9736
- C:\Windows\System\XsSBDDq.exe
  C:\Windows\System\XsSBDDq.exe
  2⤵
  PID:9752
- C:\Windows\System\xHkHYpV.exe
  C:\Windows\System\xHkHYpV.exe
  2⤵
  PID:9768
- C:\Windows\System\UzCGetO.exe
  C:\Windows\System\UzCGetO.exe
  2⤵
  PID:9788
- C:\Windows\System\QErJBSR.exe
  C:\Windows\System\QErJBSR.exe
  2⤵
  PID:9804
- C:\Windows\System\kuCwVcD.exe
  C:\Windows\System\kuCwVcD.exe
  2⤵
  PID:9820
- C:\Windows\System\fVxieef.exe
  C:\Windows\System\fVxieef.exe
  2⤵
  PID:9836
- C:\Windows\System\rzvLBAI.exe
  C:\Windows\System\rzvLBAI.exe
  2⤵
  PID:9876
- C:\Windows\System\UuIQlLk.exe
  C:\Windows\System\UuIQlLk.exe
  2⤵
  PID:9892
- C:\Windows\System\TSomhVn.exe
  C:\Windows\System\TSomhVn.exe
  2⤵
  PID:9908
- C:\Windows\System\wKRLgKh.exe
  C:\Windows\System\wKRLgKh.exe
  2⤵
  PID:9928
- C:\Windows\System\KRtNPLI.exe
  C:\Windows\System\KRtNPLI.exe
  2⤵
  PID:9944
- C:\Windows\System\ACPNfEn.exe
  C:\Windows\System\ACPNfEn.exe
  2⤵
  PID:9960
- C:\Windows\System\JwegWPS.exe
  C:\Windows\System\JwegWPS.exe
  2⤵
  PID:9976
- C:\Windows\System\NtTwntz.exe
  C:\Windows\System\NtTwntz.exe
  2⤵
  PID:9992
- C:\Windows\System\fEEdyUQ.exe
  C:\Windows\System\fEEdyUQ.exe
  2⤵
  PID:10016
- C:\Windows\System\WvGpnQK.exe
  C:\Windows\System\WvGpnQK.exe
  2⤵
  PID:10032
- C:\Windows\System\sPoJyWZ.exe
  C:\Windows\System\sPoJyWZ.exe
  2⤵
  PID:10048
- C:\Windows\System\EqJOJyq.exe
  C:\Windows\System\EqJOJyq.exe
  2⤵
  PID:10064
- C:\Windows\System\WheuITX.exe
  C:\Windows\System\WheuITX.exe
  2⤵
  PID:10084
- C:\Windows\System\cnJrlEl.exe
  C:\Windows\System\cnJrlEl.exe
  2⤵
  PID:10100
- C:\Windows\System\XTHBsBP.exe
  C:\Windows\System\XTHBsBP.exe
  2⤵
  PID:10116
- C:\Windows\System\RHSdJJM.exe
  C:\Windows\System\RHSdJJM.exe
  2⤵
  PID:10132
- C:\Windows\System\PgUlluQ.exe
  C:\Windows\System\PgUlluQ.exe
  2⤵
  PID:10152
- C:\Windows\System\FbYsNjP.exe
  C:\Windows\System\FbYsNjP.exe
  2⤵
  PID:10168
- C:\Windows\System\PSXUhpX.exe
  C:\Windows\System\PSXUhpX.exe
  2⤵
  PID:10184
- C:\Windows\System\WUZCaTd.exe
  C:\Windows\System\WUZCaTd.exe
  2⤵
  PID:10212
- C:\Windows\System\hoHQGzi.exe
  C:\Windows\System\hoHQGzi.exe
  2⤵
  PID:10232
- C:\Windows\System\vtwwFIP.exe
  C:\Windows\System\vtwwFIP.exe
  2⤵
  PID:9232
- C:\Windows\System\xZuXVWN.exe
  C:\Windows\System\xZuXVWN.exe
  2⤵
  PID:8984
- C:\Windows\System\dqmNZXi.exe
  C:\Windows\System\dqmNZXi.exe
  2⤵
  PID:8072
- C:\Windows\System\aNqiSzG.exe
  C:\Windows\System\aNqiSzG.exe
  2⤵
  PID:9340
- C:\Windows\System\AriDLVA.exe
  C:\Windows\System\AriDLVA.exe
  2⤵
  PID:9356
- C:\Windows\System\uvNXatt.exe
  C:\Windows\System\uvNXatt.exe
  2⤵
  PID:9372
- C:\Windows\System\sbAovtb.exe
  C:\Windows\System\sbAovtb.exe
  2⤵
  PID:9480
- C:\Windows\System\OSovKyF.exe
  C:\Windows\System\OSovKyF.exe
  2⤵
  PID:9448
- C:\Windows\System\pHzPmRt.exe
  C:\Windows\System\pHzPmRt.exe
  2⤵
  PID:9400
- C:\Windows\System\ILXqIBB.exe
  C:\Windows\System\ILXqIBB.exe
  2⤵
  PID:9516
- C:\Windows\System\TvYbcjc.exe
  C:\Windows\System\TvYbcjc.exe
  2⤵
  PID:9572
- C:\Windows\System\zaYPjla.exe
  C:\Windows\System\zaYPjla.exe
  2⤵
  PID:9536
- C:\Windows\System\OQFiraj.exe
  C:\Windows\System\OQFiraj.exe
  2⤵
  PID:9592
- C:\Windows\System\lbuBuJo.exe
  C:\Windows\System\lbuBuJo.exe
  2⤵
  PID:9656
- C:\Windows\System\upALWYE.exe
  C:\Windows\System\upALWYE.exe
  2⤵
  PID:9680
- C:\Windows\System\WQanUky.exe
  C:\Windows\System\WQanUky.exe
  2⤵
  PID:9640
- C:\Windows\System\XlRkxvx.exe
  C:\Windows\System\XlRkxvx.exe
  2⤵
  PID:9968
- C:\Windows\System\GXNgYYg.exe
  C:\Windows\System\GXNgYYg.exe
  2⤵
  PID:10012
- C:\Windows\System\pJaIAxj.exe
  C:\Windows\System\pJaIAxj.exe
  2⤵
  PID:10076
- C:\Windows\System\OOPRPWT.exe
  C:\Windows\System\OOPRPWT.exe
  2⤵
  PID:10140
- C:\Windows\System\mgHQPcf.exe
  C:\Windows\System\mgHQPcf.exe
  2⤵
  PID:9920
- C:\Windows\System\qmWwVFt.exe
  C:\Windows\System\qmWwVFt.exe
  2⤵
  PID:9988
- C:\Windows\System\SQbHAmB.exe
  C:\Windows\System\SQbHAmB.exe
  2⤵
  PID:10060
- C:\Windows\System\jIKTgpU.exe
  C:\Windows\System\jIKTgpU.exe
  2⤵
  PID:10180
- C:\Windows\System\ljFhfQI.exe
  C:\Windows\System\ljFhfQI.exe
  2⤵
  PID:10220
- C:\Windows\System\bKLnSgj.exe
  C:\Windows\System\bKLnSgj.exe
  2⤵
  PID:10128
- C:\Windows\System\UQwdjRc.exe
  C:\Windows\System\UQwdjRc.exe
  2⤵
  PID:8304
- C:\Windows\System\MKzXoCI.exe
  C:\Windows\System\MKzXoCI.exe
  2⤵
  PID:9328
- C:\Windows\System\spowWNF.exe
  C:\Windows\System\spowWNF.exe
  2⤵
  PID:9444
- C:\Windows\System\VCZTfRj.exe
  C:\Windows\System\VCZTfRj.exe
  2⤵
  PID:9564
- C:\Windows\System\IDaJGaB.exe
  C:\Windows\System\IDaJGaB.exe
  2⤵
  PID:9380
- C:\Windows\System\Mtkdfsj.exe
  C:\Windows\System\Mtkdfsj.exe
  2⤵
  PID:9504
- C:\Windows\System\ihGHTAM.exe
  C:\Windows\System\ihGHTAM.exe
  2⤵
  PID:9676
- C:\Windows\System\rbPbxaF.exe
  C:\Windows\System\rbPbxaF.exe
  2⤵
  PID:9708
- C:\Windows\System\rCuTMDj.exe
  C:\Windows\System\rCuTMDj.exe
  2⤵
  PID:9784
- C:\Windows\System\AHvjblm.exe
  C:\Windows\System\AHvjblm.exe
  2⤵
  PID:9844
- C:\Windows\System\yfYbvcZ.exe
  C:\Windows\System\yfYbvcZ.exe
  2⤵
  PID:9732
- C:\Windows\System\QZdsHni.exe
  C:\Windows\System\QZdsHni.exe
  2⤵
  PID:9796
- C:\Windows\System\LMJKYQU.exe
  C:\Windows\System\LMJKYQU.exe
  2⤵
  PID:9864
- C:\Windows\System\HawqOxw.exe
  C:\Windows\System\HawqOxw.exe
  2⤵
  PID:9904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BLZIsqg.exe

Filesize
1.9MB

MD5
51f8d26f29710c46b4a44adbedef2128

SHA1
1c474f4f07840e55f974c9ee1e57474b39635df4

SHA256
6e4d17555dbf425ece99f93e046b623fb965063a9fe82b70a4344da8a36748e2

SHA512
1b1295d4fd34a0a8bf3c6e9eafbb3a561552a56106a3d408d1f8410c4ec0dce58e539ef74b2a85ff7975c35b99f4b1a6ff7df9dff472f9c29691280a5a6f12af

Download Submit
C:\Windows\system\DSZdExx.exe

Filesize
1.9MB

MD5
22d173996bccdac3d807fb56fb12a3d4

SHA1
577f7bb4e8d9811e3368d79f74bb541dcc5a8676

SHA256
e72eac1936c8cbfb12cbd7c9073187264e5d2555274857213c10ee0a373d93bd

SHA512
634c15c864b2e6ae8f33eade3725644cb9f455ee152d368efe4a07b46bc5c4d3b65ef8afe151ce93fa785f7d6bd661a3815f5944bad24faf14651235189be275

Download Submit
C:\Windows\system\GCjZVyY.exe

Filesize
1.9MB

MD5
5c72af4cf98108115449b6000d05fefc

SHA1
11de261c62714a9edd26d9d37a159b5a926814da

SHA256
4489db9c61f6103ac3aaaca99c547099a3261909426fdc82faec695d3fd9d239

SHA512
facd3ca8a229a55df01842dc27d5331ac9a9049e3efdb6bb66907ab6142d878f3cd06068e07d374d3a558638d8ecb9808052942f035237a14f948d08ed2567fc

Download Submit
C:\Windows\system\GLywJbH.exe

Filesize
1.9MB

MD5
7e832bc21342ff3608d9b9e30d5646f7

SHA1
7db6c46a8e51b338d6c699cbdca020183bcc0d47

SHA256
60d8da51e4eb62fc83a3fd63c6ceef443fea5f36f2dff7f358ba49d5e321ca1e

SHA512
3e7657b164147e7deb2a869076271205d86405471f7d88d37aee663e92e4c7b8dfed72b9a3ca9dae54b402a602e4c0274621f79a3c6af33c6675de2c9a081abd

Download Submit
C:\Windows\system\JREBuAv.exe

Filesize
1.9MB

MD5
1e7efcc6c0b9827461ef0319327b3d0b

SHA1
4de96490363a5e61fa6384de7f1977060dda019a

SHA256
94a3ecf8fbd2199665518100f5acb65e8bf3ea7f1cb8c99aef1fbc2ec7303dba

SHA512
fcfd3b7d68d93c9126773c3071008c65aa4eb340a123851d3e5f04554ea2a9a3753dd11ab957cd5cdf57d653c3f55d4e854b62237abfefad926071407e7cdfa1

Download Submit
C:\Windows\system\JpywRhM.exe

Filesize
1.9MB

MD5
c3fd3347b0810a3702a4ce939f5b9b41

SHA1
1065cad8632a026ab92ba76669e00293ecfe898f

SHA256
2f0443440d3a943eed04852726d1d8d5c32388e22059149770a62709a6e0aaa8

SHA512
79a844e9c120da9ec5788856cf63bb2935338b13066b863b397a09b176d5365283d9247d26b70367f7b94b183b1780b50a2df7bdc721e046223d5926e8a45702

Download Submit
C:\Windows\system\LVAYxFn.exe

Filesize
1.9MB

MD5
1673ea86d1e3f09f51387917116e3df5

SHA1
334993265e83c7a3896e210896efd90c90ce5f3d

SHA256
38159f11938ed0170c3ea7a800c7dc473af8909caf48fb33a594019d2630da2f

SHA512
a8e09a752071cfbfe16ab9e1ca87ceaf8844b609c0181fb1eb621f238732de25d9bd2e9db94737fc3adda39ff6416f535c31512ce443f024e0170b8380905b85

Download Submit
C:\Windows\system\OTfcaTC.exe

Filesize
1.9MB

MD5
3405b910ae0070ed3c1cdfdd9fe323ee

SHA1
e0c09bb7f93f76b7eeb5640323288e6ceb7bffea

SHA256
f3c67d2aa375a04ae3bdcf241dc41bd68417cd05de73a4b845c37b332396a468

SHA512
39e6f92a67efa47d596c031bb91f0073c3fe44557410d1409566b64c5a28540274a778db7a4dc2a017aabe2af82cd34260694e2315ac9e098e3fb02430033a58

Download Submit
C:\Windows\system\PXnmTOp.exe

Filesize
1.9MB

MD5
8e5ba942d9c0f53bdbf6d0fef7d30561

SHA1
9a675a5dc8642941e212c405c7507195a8fe4a64

SHA256
6616bcfc0c596651e842081a6caaff5fdbd418943565235fee18583c51a3de94

SHA512
0d1f689f58d96cd9bc6e06ae8a64910386faac30c5adc929df6d8b77baaec624e870c1a070f7fa0e32e3320db6edc64911c1e4aa6581e7f5844ad72aebd89b3e

Download Submit
C:\Windows\system\PZhznRq.exe

Filesize
1.9MB

MD5
1ccbfbe280f7c51cd68d86d382d9aed3

SHA1
e370ccaec55dcba5c1651ae8933a1125eca23ba2

SHA256
913c93b6465c9e01bd55e67f5eff16436257fe9e6a59f439abe284ebb6286b6b

SHA512
c444dd34ce6b02df8d7a6a6635969098dc46866f63ef491d7c1151589ab787b1cff43c4b5226a1c91972679f7b284c9fc6ed0e527423f041c871ebd097d3e25b

Download Submit
C:\Windows\system\TEvqllD.exe

Filesize
1.9MB

MD5
0277e93c8b3e4b66f12657f6e8bdb56e

SHA1
23adbab15effe5fd00fd8655259e1610335e192b

SHA256
2e987ab823a8aa46303e44f5719023c985e1fd7eaf0293dfc0aeabda93962b92

SHA512
73b0b876d5844e31aa6092baacc3d639d0bd98ddc67a6d5bb8b3239429ff28e7a177e47a70890709f711216effb30dc40f2bf136e746495415f3dd45cc7deeaf

Download Submit
C:\Windows\system\WADuUqf.exe

Filesize
1.9MB

MD5
1824b85a5074d64dee37be48ecd9e054

SHA1
c12b207f2c8cf1b98e19e15a1b82ab8131f0555e

SHA256
192b2357180b68e471484e29768f46fca009d3ae14d87702ae95c6f3b4874125

SHA512
a6da77e2b6a3db40dd6237f63d9dd208cc63617ffee925129725ae882c70c9fe3dffc53727057049894b8fd9ef9755e86f737af7ffd5ddd65b87678717f211db

Download Submit
C:\Windows\system\XNGYlEn.exe

Filesize
1.9MB

MD5
c306c644b74275b5b8f609fc2270eb29

SHA1
ff33a162785b37a77ac477318d75202bcdee3135

SHA256
a64345c01e001e1ff6aadf2bb794d82898dafc99ab445861f6c42bc9fa02c4ad

SHA512
1e24821f0a2120dbdab4533ccc9f957ee90a2cd8adfd26ab83b7f822f9b6eeb4d7d815624605c5bbf719a4f0bd2e4555326be137573baea86c9b9e157fb34128

Download Submit
C:\Windows\system\dyihSPS.exe

Filesize
1.9MB

MD5
cf14498b092d5ba3e9a605ebd34aea26

SHA1
5995fe8f9d39255346b475eff7943ee01481e692

SHA256
aca21d5a7caec7344824b2697f4618af58b7148bceba625d301c54b64ea89092

SHA512
de534b3ab4baed435cc1d6b11663c5a55505d7fd61b59ec3111a4a4fffbd05b157f43bf1332d2a445c9fbdc7f2662fb2071fd9464fba42f7977b3c9682785295

Download Submit
C:\Windows\system\hdYoECt.exe

Filesize
1.9MB

MD5
bae06dd1a8804a3558776ae15868b06b

SHA1
cfa7dbdff69c99d0cf0efed60a9e009cb9b08e99

SHA256
4b80d7152e8414e292e8c92bbb69a9c2cc9f79ecf43ac08225550314559effbe

SHA512
676c15ac1c99fd0278ae30d0042fbb99c813b1e3c4cd3c0970c330415044a773e32d040439ff56bb76ab7e61002c0ab02903c15202ad38209b07f55cb4b521b2

Download Submit
C:\Windows\system\iCzaxMl.exe

Filesize
1.9MB

MD5
a781f8ba71c02a1502eabe30205ab8ff

SHA1
436e46366504eb509707db9850f78f2c0504f905

SHA256
654037c2132ad832155e932f5933b841a8fc02fa6d3d44b75a221afc0a859bc2

SHA512
bcf774eada2d6305b759e47a495b84e00165990a520e24cd52f88b63d3cd088b37668a174066f327206fcb99c4f0d229c08f6cbb12b7db871b56a800a79862aa

Download Submit
C:\Windows\system\jtLvReA.exe

Filesize
1.9MB

MD5
491b71c63b93160fbce912258334ac20

SHA1
e6af5ee6585af38216139c8eecb5bd40500d5071

SHA256
7d627003eca157eb855e4d764945731643adc968bfc19e23d22a4c5546b22d99

SHA512
d70295e7f1f0e2bf3cbe49fccc2c3ab1a0f717988b873619b60ccc8dabe5a78717da3089e165805ee18e67e33bac1a5d3af58038580cf7717c800d2dd30d0093

Download Submit
C:\Windows\system\mzITZqL.exe

Filesize
1.9MB

MD5
de82b00a2924a402123710560237e2fc

SHA1
a4d17063aa998f2ca4d227d0a9c11ec4407fa61c

SHA256
4fc0e3b1897d73806cb84b8ecd9a70e047aef20ca5af02b5b1580a640fd32ed3

SHA512
32683751d8d7884f4e0803f3d6f6c343e65f47a017dea244d0b34ab6ac01be009db6229881117dad7bbc8ebbc13484e1db8b02e3c9b6838b2a2accbf8de9b6d2

Download Submit
C:\Windows\system\nYnUjEj.exe

Filesize
1.9MB

MD5
424ff139e15e1f55f55542156d036b1f

SHA1
b6de49f4b9fcdbb8554d2cdd820a1d15f1a56bfd

SHA256
9dfbd234cdcc118763e7d17c7d1ae4f8bbbd47dc07777926a3dff42b747e8b4e

SHA512
8ef77875398ffef7006886e0d6d14fe9a48d919254f95689598703326374e0d10b67711904603c9083595784d653cf0680d29bbe28303af939764d60946420fe

Download Submit
C:\Windows\system\nhqApAc.exe

Filesize
1.9MB

MD5
5c6e54f97f61742a0ec817e87887ad84

SHA1
63237dfc2e08084cfa8adf55fb42dd138abf13c3

SHA256
f6e22b615c9f042d8fa0f5a46755e9c752d3f1ea6bc703d521082b01f63ef362

SHA512
6ec5b2bb60f8af7fbe1768d346fc0f396d3923c67c99a316b1e3e57bc54e255e7b58c353dc34a1f44826bd5d961ec351cbeb1ae287ca03a47f02281a35bfba11

Download Submit
C:\Windows\system\odvICpP.exe

Filesize
1.9MB

MD5
d4a36ca5399bfd6243c95407fa93784e

SHA1
335e0e3bc9565a40106119c61bea13d03ec5d381

SHA256
796f4d60d602416b0008c7744abbaa83e44c2972c7234cef454474cf7dce1569

SHA512
835eeb5eed49540efe375bd54c99726d3160ea2bee7ddd6bba005a90b3185ef347dd1007d78d22d8575f97a11379781948d94e7092adb6ee6426b7f0e37ef93d

Download Submit
C:\Windows\system\poEVDhk.exe

Filesize
1.9MB

MD5
f17a8c79f4553ca8542466cfbf34771a

SHA1
d4672df9efd636df7fda8d1caa2b4a9ed5a9bef6

SHA256
b909e3279e5790cee5637b9a481e30f98bbaf2d66b1a7ce27f9757b6b7af6441

SHA512
5c5b00e9c479a75904ae79f58e72c829db4ebda2f5e3662d1efdbe2208a63d409461fd977a9b765ec0c6374b2b94200346caff94d68edb632ff8a9c0b5350916

Download Submit
C:\Windows\system\qzgwpiZ.exe

Filesize
1.9MB

MD5
0c67963087d279d92595253d50807002

SHA1
09bb8d581955fc395d7447412e304ece82ed62d0

SHA256
4b13ca46f1fb67d24c83e8922448894155ff4d6db3f11fe59d0fdf363982c3b3

SHA512
3850711556dfdbed63ff6eabbe48b3ab3213f0da96014a29af878c7f690c5e2be76ac9a6290c17120af32aa3e92e3604cf126079169ec9c7ca5d4d3d7de23f9a

Download Submit
C:\Windows\system\sJiRola.exe

Filesize
1.9MB

MD5
b7563d7755d4c8cf2f53660d2889bad5

SHA1
5e7a15a37eda495c1ca973a8284c10229c0ec02f

SHA256
550a628d6c3b4ff37c24ffe517bcf77a736ceb83cabaa7c7261111cd84d06079

SHA512
67c3116f823bd5a1369925ff9e5124345cedad43ddcda2a04c43e4c10b2f52764ac6767748d7955cf452e30f4e1de74e1a5c4e914afaa2a12dde2bfead188abb

Download Submit
C:\Windows\system\sdzJfQw.exe

Filesize
1.9MB

MD5
6df14d7e35e2e21cf611898aabba977b

SHA1
1918d130c1bc721ae020bbe689af82cdbc751d82

SHA256
8ee2354b825bea9c97869c0131d9b5da34425bb8ebd4753771c9a1a7f0926cf4

SHA512
76226bfea33b4bf7e759cbb081ad2aad509fc2553fc95c735a9485abde34c019b0eb1467077acccedf51894e29b3d939b4a8c21d4ee3403e7a8041ed7dc9af61

Download Submit
C:\Windows\system\taciSWg.exe

Filesize
1.9MB

MD5
7fc37088f3233d38ccbdaa55d69b463d

SHA1
2f707db0ca1af9478cb3cc2e566f818f02a8622d

SHA256
693942d1f9a0fb31a58fc21bbf03aa49d4bb5ccfb26875003dac2e682bee204f

SHA512
9b66562e34b0e3781b3475ec04cc58046e8312d4670af56cb6e3e899bf62d7b5cb5d93db9bd5d93307498daa44e58d573718abe0287c4593aea20ee49e713093

Download Submit
C:\Windows\system\wRStzTz.exe

Filesize
1.9MB

MD5
4fead86d84f5bac74d892c01a6f5b251

SHA1
1b6496b3189a6ee083e3bf7a39ee8d7cb537c841

SHA256
8633297cc520191cf20e49439b2af631e94215adcece251dcf479dbcdbe3a93d

SHA512
9d39d8826a9a86202b127ed6cb9a26a2383abb7c89122cc3210b54228e210df4a85462525730ee5b82f1a7e377fba399962fde0a309420c2e8400133aa9cc27a

Download Submit
C:\Windows\system\xGYMFQU.exe

Filesize
1.9MB

MD5
ead6974d4013a8128bc82399da260174

SHA1
59debc23a89c5e47b99f70b8aa8f9e43edff5f3b

SHA256
1e8425b010151cc4dfb0709581ef8f4e3458c289b3993f702a911bd2baa7b38e

SHA512
3b7373ffe62ebf56d16ba453c77063d47756368b083b3e50dadf966057b38011da71f5eb396bbde2dfaadf1dd5302ccf9c539fea81c223c444a8ce851e91422a

Download Submit
\Windows\system\NSXgAel.exe

Filesize
1.9MB

MD5
9c1af31ca1426ddef347290a9e823326

SHA1
3ac1d99d70c09db4b87ad4c50a2857cfb2daaff9

SHA256
29647751e1d4d4167ee83935ceec357ceca561864f31b32eb6d1838f7f35627b

SHA512
fd6339ba67912f091acdcd5d3999af541166d95e2b0b21949f080a980f6263923a9aa112a08e03f136e077d09278bc5c6890794769d19e4642c55cf9ac021e07

Download Submit
\Windows\system\XzLNtem.exe

Filesize
1.9MB

MD5
f0d1a54fee575c5df5c6c09905c9997b

SHA1
752d0386fb9ff1a8fd4b93922f2a13a319bc7c33

SHA256
81f29ba9596928d81d003165f9932db114386c614ab0128db591e9a589775707

SHA512
3dfb0d133b7770763c9e4947ca0933434e768f1c5316bc0e04c917e643d94789160cda72f9979107b36ddc3c152662ade41aee89f641c567603bc44f489d4b05

Download Submit
\Windows\system\gTsZWXg.exe

Filesize
1.9MB

MD5
d7d05b6fded548c0284cdbbae2807446

SHA1
4d5ecf48ccac040538a71173eb540e84fd58d212

SHA256
db3bf8bd9ba875c383bad1b6736541b143ffcbd44024d4a465f11de2a32f225a

SHA512
27a302ea0c2dbb5ded229c0ddfdcda683afd01e029e1ba955bfd7a2d73827710615cec3b8ea75e3ba94ef1e1bf34b48f9bf17d9ed072001d987a78ebb0982533

Download Submit
\Windows\system\uwxlOrj.exe

Filesize
1.9MB

MD5
32e7b78ae61bff4326e9b8381b9cb536

SHA1
931014f038718bfebb460cf0cee01c44e52153cd

SHA256
78e419de607622ecce78a4db4f4a9178718d7c3157421f5a925ef84b40621f62

SHA512
efcdd172c8dccbf1e3b7aa27d21d7e1047d72f548f946dab4aa76a2077cf27e2d60c56938ed6ffd5c2804ddcb1789068214020955d8fe386a0794f5f4653330c

Download Submit
memory/2004-13-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2216-85-0x0000000002620000-0x0000000002628000-memory.dmp

Filesize
32KB

Download
memory/2216-235-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Filesize
9.6MB

Download
memory/2216-55-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2216-14-0x0000000002D70000-0x0000000002DF0000-memory.dmp

Filesize
512KB

Download
memory/2216-737-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Filesize
9.6MB

Download
memory/2216-278-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Filesize
9.6MB

Download
memory/2216-236-0x0000000002D70000-0x0000000002DF0000-memory.dmp

Filesize
512KB

Download
memory/2416-238-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2416-0-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2416-269-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2416-279-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2416-275-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2416-264-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2416-277-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2416-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2416-271-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2416-12-0x0000000002EA0000-0x0000000003292000-memory.dmp

Filesize
3.9MB

Download
memory/2416-254-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-273-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2460-259-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-272-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2508-276-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2604-239-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2616-274-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2672-237-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2692-268-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2728-270-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download