xmrig | d8aa937b02fca9f2f47546959477e12e8e69472b74a39dc76a13dd769163a0cf

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 00:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
Size

2.2MB
MD5

0666bddf732b5f8812d4688c291bdb31
SHA1

0096df20297d1ffd5f4370a4fb8f21f89b48b569
SHA256

d8aa937b02fca9f2f47546959477e12e8e69472b74a39dc76a13dd769163a0cf
SHA512

0e7c4872858533a0f5f520f87e9fc22a1a33e1fbdf6f83a9722a576ad9017a0ee78c488863294efe63c794e676d66beae455d7bf422d44da18173a35caaaed93
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aD9J:NABy

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/2984-22-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/944-77-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/2612-332-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2516-109-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/1932-83-0x0000000003000000-0x00000000033F2000-memory.dmp	xmrig
behavioral1/memory/2616-57-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2604-49-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/1932-48-0x000000013FFE0000-0x00000001403D2000-memory.dmp	xmrig
behavioral1/memory/2228-12-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2612-2866-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/1500-3852-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/1020-3854-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/2228-3853-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2616-3866-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/944-3878-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/2516-3868-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2984-3870-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/2604-3869-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/2376-3867-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2228	pVzzamS.exe
944	YUqSYKZ.exe
2984	dKxSUbx.exe
2612	jjWWipL.exe
2516	IwrverJ.exe
2604	KODrrPh.exe
2616	GrjRdqE.exe
2376	YehIOXT.exe
1020	bktImzd.exe
1500	YbWuIyl.exe
1164	gxTfnWE.exe
1272	QVmYTXz.exe
2040	zMYTrtU.exe
1424	HDOALhH.exe
1040	dRDolJO.exe
2680	UBTeGlM.exe
784	NlSMOHA.exe
940	UNIRPtu.exe
2280	NGzZlRu.exe
792	jFymBca.exe
528	BpDvKiS.exe
2928	iyEFqFo.exe
1808	GOzAubB.exe
2092	gGBZhyM.exe
2484	bQPmaeg.exe
992	YICMIqe.exe
2924	pXTvxWP.exe
1316	LneBCvi.exe
2140	OCdnyYf.exe
2144	tYwXkEK.exe
876	THPOKkN.exe
1684	gblRWYm.exe
1764	fliWHix.exe
564	CHvCyFn.exe
2804	wxaZnyx.exe
1784	tkiNVQR.exe
1732	ohXRamm.exe
1752	BiOpAsi.exe
1380	SQfaKUP.exe
2464	tRnHipP.exe
1052	IAAioJt.exe
2100	ZydsREP.exe
1816	fwUOpBD.exe
1876	utllAXU.exe
1368	SJvrhjy.exe
1672	rzsZZOs.exe
2888	pTFrsSm.exe
2752	YbTJZeD.exe
2904	IQvmneW.exe
2748	sTlDyYF.exe
2076	OFsrFBw.exe
2072	ZSFClAU.exe
3024	gfiEjbU.exe
1284	ihNSIlp.exe
2012	NfSdFFL.exe
1980	neOOIZO.exe
1812	RkAmdFY.exe
2884	xfzJpUp.exe
1508	PcTrZQa.exe
1620	yLuDXYM.exe
1536	AuVPCCn.exe
1720	lNTISIH.exe
1632	hfvTsvQ.exe
2920	RLxruDr.exe

Loads dropped DLL 64 IoCs

pid	Process
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1932-1-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/files/0x000b000000014aec-3.dat	upx
behavioral1/files/0x0009000000014ec4-9.dat	upx
behavioral1/memory/944-14-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/files/0x0009000000014fe1-15.dat	upx
behavioral1/memory/2984-22-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/files/0x00070000000155e2-27.dat	upx
behavioral1/memory/2612-32-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x0009000000015264-56.dat	upx
behavioral1/files/0x0006000000018ae2-119.dat	upx
behavioral1/files/0x0006000000018b4a-142.dat	upx
behavioral1/memory/944-77-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/memory/2612-332-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x000500000001939b-194.dat	upx
behavioral1/files/0x000f0000000006fd-188.dat	upx
behavioral1/files/0x0005000000019333-185.dat	upx
behavioral1/files/0x00050000000192f4-175.dat	upx
behavioral1/files/0x0006000000018d06-167.dat	upx
behavioral1/files/0x0006000000018b96-157.dat	upx
behavioral1/files/0x0006000000018b6a-146.dat	upx
behavioral1/files/0x0006000000018b42-137.dat	upx
behavioral1/files/0x0006000000018b33-130.dat	upx
behavioral1/files/0x0006000000018ae8-123.dat	upx
behavioral1/memory/1500-118-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/files/0x00050000000186a0-115.dat	upx
behavioral1/memory/2516-109-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/files/0x000500000001868c-106.dat	upx
behavioral1/files/0x0006000000016e56-100.dat	upx
behavioral1/files/0x000600000001704f-98.dat	upx
behavioral1/files/0x0006000000016d89-91.dat	upx
behavioral1/files/0x0006000000016d4f-85.dat	upx
behavioral1/files/0x0006000000016d55-81.dat	upx
behavioral1/files/0x0006000000016d4a-74.dat	upx
behavioral1/memory/2376-65-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/files/0x0007000000016d36-64.dat	upx
behavioral1/memory/2516-40-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/files/0x000700000001560a-33.dat	upx
behavioral1/files/0x0005000000019368-193.dat	upx
behavioral1/files/0x000500000001931b-183.dat	upx
behavioral1/files/0x00050000000192c9-173.dat	upx
behavioral1/files/0x00080000000155d9-26.dat	upx
behavioral1/files/0x0006000000018ba2-163.dat	upx
behavioral1/files/0x0006000000018b73-154.dat	upx
behavioral1/files/0x0006000000018b37-135.dat	upx
behavioral1/files/0x0006000000018b15-128.dat	upx
behavioral1/files/0x0005000000018698-113.dat	upx
behavioral1/files/0x0006000000017090-105.dat	upx
behavioral1/files/0x0006000000016d84-90.dat	upx
behavioral1/memory/1020-89-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/files/0x0006000000016d41-72.dat	upx
behavioral1/memory/2616-57-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/files/0x0007000000015a2d-52.dat	upx
behavioral1/memory/2604-49-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/memory/1932-48-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/memory/2228-12-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2612-2866-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/1500-3852-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/1020-3854-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/2228-3853-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2616-3866-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/944-3878-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/memory/2516-3868-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/memory/2984-3870-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/2604-3869-0x000000013F250000-0x000000013F642000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HavcXZv.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\GNduuoR.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\eFWxtxn.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\QronLYE.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\xQgFHPg.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\ifAIVPP.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\CjtTkjq.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\szlFoil.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\UDYLwro.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\mFzaAJA.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\iabTAuq.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\rhlCkru.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\MgaGxbi.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\TysvTkf.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\iyEFqFo.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\BgQcsfO.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\fhJfNQN.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\tWDYDPV.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\ecSlgxy.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\IfyrDAB.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\jClFOmi.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\dVcIjpE.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\TdJgqud.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\wuFHBiw.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\crsMziA.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\gsRpTww.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\FfKcDrE.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\yzqLmPE.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\ntYzOXj.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\EfdtZyP.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\aNYOacG.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\OxLshXW.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\KFnrFpX.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\GDqPhSs.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\ZrsPKlt.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\SZOrlMe.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\WjIzVly.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\BbgPxqC.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\dzxuMiT.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\ECPalpp.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\OFPNdZb.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\WjUEFXM.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\pQdfHDf.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\pxldkTp.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\tRnHipP.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\SJvrhjy.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\aEZEFVH.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\sgpsjnH.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\BNCnuWe.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\vycouQi.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\KFWSCmc.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\kramxjU.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\lCpTDZY.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\FyCzhXm.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\wASOcro.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\eLlLhuJ.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\HzHRmcB.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\yVcynha.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\Kmsdofm.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\DbBRHpC.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\xPKcFPF.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\rboOYjs.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\XLnyOOY.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
File created	C:\Windows\System\IBodByh.exe	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1724	powershell.exe
1724	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
Token: SeDebugPrivilege	1724	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1724	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	29
PID 1932 wrote to memory of 1724	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	29
PID 1932 wrote to memory of 1724	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	29
PID 1932 wrote to memory of 2228	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	30
PID 1932 wrote to memory of 2228	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	30
PID 1932 wrote to memory of 2228	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	30
PID 1932 wrote to memory of 944	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	31
PID 1932 wrote to memory of 944	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	31
PID 1932 wrote to memory of 944	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	31
PID 1932 wrote to memory of 2984	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	32
PID 1932 wrote to memory of 2984	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	32
PID 1932 wrote to memory of 2984	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	32
PID 1932 wrote to memory of 2612	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	33
PID 1932 wrote to memory of 2612	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	33
PID 1932 wrote to memory of 2612	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	33
PID 1932 wrote to memory of 2516	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	34
PID 1932 wrote to memory of 2516	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	34
PID 1932 wrote to memory of 2516	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	34
PID 1932 wrote to memory of 2604	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	35
PID 1932 wrote to memory of 2604	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	35
PID 1932 wrote to memory of 2604	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	35
PID 1932 wrote to memory of 2616	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	36
PID 1932 wrote to memory of 2616	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	36
PID 1932 wrote to memory of 2616	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	36
PID 1932 wrote to memory of 1808	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	37
PID 1932 wrote to memory of 1808	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	37
PID 1932 wrote to memory of 1808	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	37
PID 1932 wrote to memory of 2376	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	38
PID 1932 wrote to memory of 2376	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	38
PID 1932 wrote to memory of 2376	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	38
PID 1932 wrote to memory of 2484	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	39
PID 1932 wrote to memory of 2484	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	39
PID 1932 wrote to memory of 2484	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	39
PID 1932 wrote to memory of 1020	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	40
PID 1932 wrote to memory of 1020	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	40
PID 1932 wrote to memory of 1020	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	40
PID 1932 wrote to memory of 1316	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	41
PID 1932 wrote to memory of 1316	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	41
PID 1932 wrote to memory of 1316	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	41
PID 1932 wrote to memory of 1500	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	42
PID 1932 wrote to memory of 1500	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	42
PID 1932 wrote to memory of 1500	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	42
PID 1932 wrote to memory of 876	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	43
PID 1932 wrote to memory of 876	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	43
PID 1932 wrote to memory of 876	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	43
PID 1932 wrote to memory of 1164	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	44
PID 1932 wrote to memory of 1164	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	44
PID 1932 wrote to memory of 1164	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	44
PID 1932 wrote to memory of 564	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	45
PID 1932 wrote to memory of 564	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	45
PID 1932 wrote to memory of 564	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	45
PID 1932 wrote to memory of 1272	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	46
PID 1932 wrote to memory of 1272	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	46
PID 1932 wrote to memory of 1272	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	46
PID 1932 wrote to memory of 1380	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	47
PID 1932 wrote to memory of 1380	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	47
PID 1932 wrote to memory of 1380	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	47
PID 1932 wrote to memory of 2040	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	48
PID 1932 wrote to memory of 2040	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	48
PID 1932 wrote to memory of 2040	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	48
PID 1932 wrote to memory of 1052	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	49
PID 1932 wrote to memory of 1052	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	49
PID 1932 wrote to memory of 1052	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	49
PID 1932 wrote to memory of 1424	1932	0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0666bddf732b5f8812d4688c291bdb31_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\System\pVzzamS.exe
  C:\Windows\System\pVzzamS.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\YUqSYKZ.exe
  C:\Windows\System\YUqSYKZ.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\dKxSUbx.exe
  C:\Windows\System\dKxSUbx.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\jjWWipL.exe
  C:\Windows\System\jjWWipL.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\IwrverJ.exe
  C:\Windows\System\IwrverJ.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\KODrrPh.exe
  C:\Windows\System\KODrrPh.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\GrjRdqE.exe
  C:\Windows\System\GrjRdqE.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\GOzAubB.exe
  C:\Windows\System\GOzAubB.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\YehIOXT.exe
  C:\Windows\System\YehIOXT.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\bQPmaeg.exe
  C:\Windows\System\bQPmaeg.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\bktImzd.exe
  C:\Windows\System\bktImzd.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\LneBCvi.exe
  C:\Windows\System\LneBCvi.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\YbWuIyl.exe
  C:\Windows\System\YbWuIyl.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\THPOKkN.exe
  C:\Windows\System\THPOKkN.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\gxTfnWE.exe
  C:\Windows\System\gxTfnWE.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\CHvCyFn.exe
  C:\Windows\System\CHvCyFn.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\QVmYTXz.exe
  C:\Windows\System\QVmYTXz.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\SQfaKUP.exe
  C:\Windows\System\SQfaKUP.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\zMYTrtU.exe
  C:\Windows\System\zMYTrtU.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\IAAioJt.exe
  C:\Windows\System\IAAioJt.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\HDOALhH.exe
  C:\Windows\System\HDOALhH.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\fwUOpBD.exe
  C:\Windows\System\fwUOpBD.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\dRDolJO.exe
  C:\Windows\System\dRDolJO.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\utllAXU.exe
  C:\Windows\System\utllAXU.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\UBTeGlM.exe
  C:\Windows\System\UBTeGlM.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\rzsZZOs.exe
  C:\Windows\System\rzsZZOs.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\NlSMOHA.exe
  C:\Windows\System\NlSMOHA.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\YbTJZeD.exe
  C:\Windows\System\YbTJZeD.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\UNIRPtu.exe
  C:\Windows\System\UNIRPtu.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\sTlDyYF.exe
  C:\Windows\System\sTlDyYF.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\NGzZlRu.exe
  C:\Windows\System\NGzZlRu.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\OFsrFBw.exe
  C:\Windows\System\OFsrFBw.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\jFymBca.exe
  C:\Windows\System\jFymBca.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\ZSFClAU.exe
  C:\Windows\System\ZSFClAU.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\BpDvKiS.exe
  C:\Windows\System\BpDvKiS.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\gfiEjbU.exe
  C:\Windows\System\gfiEjbU.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\iyEFqFo.exe
  C:\Windows\System\iyEFqFo.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\ihNSIlp.exe
  C:\Windows\System\ihNSIlp.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\gGBZhyM.exe
  C:\Windows\System\gGBZhyM.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\NfSdFFL.exe
  C:\Windows\System\NfSdFFL.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\YICMIqe.exe
  C:\Windows\System\YICMIqe.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\neOOIZO.exe
  C:\Windows\System\neOOIZO.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\pXTvxWP.exe
  C:\Windows\System\pXTvxWP.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\RkAmdFY.exe
  C:\Windows\System\RkAmdFY.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\OCdnyYf.exe
  C:\Windows\System\OCdnyYf.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\xfzJpUp.exe
  C:\Windows\System\xfzJpUp.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\tYwXkEK.exe
  C:\Windows\System\tYwXkEK.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\PcTrZQa.exe
  C:\Windows\System\PcTrZQa.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\gblRWYm.exe
  C:\Windows\System\gblRWYm.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\yLuDXYM.exe
  C:\Windows\System\yLuDXYM.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\fliWHix.exe
  C:\Windows\System\fliWHix.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\AuVPCCn.exe
  C:\Windows\System\AuVPCCn.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\wxaZnyx.exe
  C:\Windows\System\wxaZnyx.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\lNTISIH.exe
  C:\Windows\System\lNTISIH.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\tkiNVQR.exe
  C:\Windows\System\tkiNVQR.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\hfvTsvQ.exe
  C:\Windows\System\hfvTsvQ.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\ohXRamm.exe
  C:\Windows\System\ohXRamm.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\RLxruDr.exe
  C:\Windows\System\RLxruDr.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\BiOpAsi.exe
  C:\Windows\System\BiOpAsi.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\PzddiCP.exe
  C:\Windows\System\PzddiCP.exe
  2⤵
  PID:1556
- C:\Windows\System\tRnHipP.exe
  C:\Windows\System\tRnHipP.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\ladMJXV.exe
  C:\Windows\System\ladMJXV.exe
  2⤵
  PID:948
- C:\Windows\System\ZydsREP.exe
  C:\Windows\System\ZydsREP.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\LhnKpvG.exe
  C:\Windows\System\LhnKpvG.exe
  2⤵
  PID:592
- C:\Windows\System\SJvrhjy.exe
  C:\Windows\System\SJvrhjy.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\OEVpgfx.exe
  C:\Windows\System\OEVpgfx.exe
  2⤵
  PID:776
- C:\Windows\System\pTFrsSm.exe
  C:\Windows\System\pTFrsSm.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\yLMwtxK.exe
  C:\Windows\System\yLMwtxK.exe
  2⤵
  PID:1696
- C:\Windows\System\IQvmneW.exe
  C:\Windows\System\IQvmneW.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\sdOpRmm.exe
  C:\Windows\System\sdOpRmm.exe
  2⤵
  PID:1628
- C:\Windows\System\yvfvAYn.exe
  C:\Windows\System\yvfvAYn.exe
  2⤵
  PID:2632
- C:\Windows\System\XNHrlFx.exe
  C:\Windows\System\XNHrlFx.exe
  2⤵
  PID:568
- C:\Windows\System\GHqYDGT.exe
  C:\Windows\System\GHqYDGT.exe
  2⤵
  PID:580
- C:\Windows\System\jJfDVJE.exe
  C:\Windows\System\jJfDVJE.exe
  2⤵
  PID:3080
- C:\Windows\System\FAYwxYO.exe
  C:\Windows\System\FAYwxYO.exe
  2⤵
  PID:3116
- C:\Windows\System\fIwEPat.exe
  C:\Windows\System\fIwEPat.exe
  2⤵
  PID:3132
- C:\Windows\System\QRVwPWg.exe
  C:\Windows\System\QRVwPWg.exe
  2⤵
  PID:3148
- C:\Windows\System\BKaYZga.exe
  C:\Windows\System\BKaYZga.exe
  2⤵
  PID:3168
- C:\Windows\System\ysiTefV.exe
  C:\Windows\System\ysiTefV.exe
  2⤵
  PID:3196
- C:\Windows\System\aycghEx.exe
  C:\Windows\System\aycghEx.exe
  2⤵
  PID:3212
- C:\Windows\System\QOoujKg.exe
  C:\Windows\System\QOoujKg.exe
  2⤵
  PID:3232
- C:\Windows\System\wlUhFDC.exe
  C:\Windows\System\wlUhFDC.exe
  2⤵
  PID:3248
- C:\Windows\System\WdHGACX.exe
  C:\Windows\System\WdHGACX.exe
  2⤵
  PID:3264
- C:\Windows\System\wCGhrMs.exe
  C:\Windows\System\wCGhrMs.exe
  2⤵
  PID:3280
- C:\Windows\System\zvjhPIu.exe
  C:\Windows\System\zvjhPIu.exe
  2⤵
  PID:3296
- C:\Windows\System\MkVnlxR.exe
  C:\Windows\System\MkVnlxR.exe
  2⤵
  PID:3312
- C:\Windows\System\YjLymJT.exe
  C:\Windows\System\YjLymJT.exe
  2⤵
  PID:3328
- C:\Windows\System\sZCtqPI.exe
  C:\Windows\System\sZCtqPI.exe
  2⤵
  PID:3344
- C:\Windows\System\JsfSRCe.exe
  C:\Windows\System\JsfSRCe.exe
  2⤵
  PID:3372
- C:\Windows\System\uuKYJUw.exe
  C:\Windows\System\uuKYJUw.exe
  2⤵
  PID:3388
- C:\Windows\System\tjEOCzV.exe
  C:\Windows\System\tjEOCzV.exe
  2⤵
  PID:3404
- C:\Windows\System\szlFoil.exe
  C:\Windows\System\szlFoil.exe
  2⤵
  PID:3420
- C:\Windows\System\JsITaPU.exe
  C:\Windows\System\JsITaPU.exe
  2⤵
  PID:3444
- C:\Windows\System\aALKTxU.exe
  C:\Windows\System\aALKTxU.exe
  2⤵
  PID:3460
- C:\Windows\System\WSdtFPR.exe
  C:\Windows\System\WSdtFPR.exe
  2⤵
  PID:3476
- C:\Windows\System\rYlLvkV.exe
  C:\Windows\System\rYlLvkV.exe
  2⤵
  PID:3492
- C:\Windows\System\eAuicKa.exe
  C:\Windows\System\eAuicKa.exe
  2⤵
  PID:3508
- C:\Windows\System\zyNvWyB.exe
  C:\Windows\System\zyNvWyB.exe
  2⤵
  PID:3524
- C:\Windows\System\dmvRoGx.exe
  C:\Windows\System\dmvRoGx.exe
  2⤵
  PID:3548
- C:\Windows\System\iijSDnI.exe
  C:\Windows\System\iijSDnI.exe
  2⤵
  PID:3564
- C:\Windows\System\skCMuOI.exe
  C:\Windows\System\skCMuOI.exe
  2⤵
  PID:3580
- C:\Windows\System\HfgCyUr.exe
  C:\Windows\System\HfgCyUr.exe
  2⤵
  PID:3608
- C:\Windows\System\knaPiSJ.exe
  C:\Windows\System\knaPiSJ.exe
  2⤵
  PID:3624
- C:\Windows\System\CVWvlEx.exe
  C:\Windows\System\CVWvlEx.exe
  2⤵
  PID:3640
- C:\Windows\System\ayEzYDt.exe
  C:\Windows\System\ayEzYDt.exe
  2⤵
  PID:3656
- C:\Windows\System\ZRBMGaZ.exe
  C:\Windows\System\ZRBMGaZ.exe
  2⤵
  PID:3676
- C:\Windows\System\JlRgPeT.exe
  C:\Windows\System\JlRgPeT.exe
  2⤵
  PID:3696
- C:\Windows\System\pvgtolq.exe
  C:\Windows\System\pvgtolq.exe
  2⤵
  PID:3720
- C:\Windows\System\ykkMSxP.exe
  C:\Windows\System\ykkMSxP.exe
  2⤵
  PID:3740
- C:\Windows\System\MaLqaVc.exe
  C:\Windows\System\MaLqaVc.exe
  2⤵
  PID:3756
- C:\Windows\System\HavcXZv.exe
  C:\Windows\System\HavcXZv.exe
  2⤵
  PID:3776
- C:\Windows\System\GZTVQeD.exe
  C:\Windows\System\GZTVQeD.exe
  2⤵
  PID:3792
- C:\Windows\System\fKHxaqM.exe
  C:\Windows\System\fKHxaqM.exe
  2⤵
  PID:3816
- C:\Windows\System\REHoQsd.exe
  C:\Windows\System\REHoQsd.exe
  2⤵
  PID:3832
- C:\Windows\System\vGqXKlW.exe
  C:\Windows\System\vGqXKlW.exe
  2⤵
  PID:3848
- C:\Windows\System\XTvQdYv.exe
  C:\Windows\System\XTvQdYv.exe
  2⤵
  PID:3864
- C:\Windows\System\ubNeawX.exe
  C:\Windows\System\ubNeawX.exe
  2⤵
  PID:3884
- C:\Windows\System\hzbvdom.exe
  C:\Windows\System\hzbvdom.exe
  2⤵
  PID:3900
- C:\Windows\System\dOPnsqx.exe
  C:\Windows\System\dOPnsqx.exe
  2⤵
  PID:3920
- C:\Windows\System\PqcRncG.exe
  C:\Windows\System\PqcRncG.exe
  2⤵
  PID:3936
- C:\Windows\System\jlVZfcO.exe
  C:\Windows\System\jlVZfcO.exe
  2⤵
  PID:3952
- C:\Windows\System\RgSqJXz.exe
  C:\Windows\System\RgSqJXz.exe
  2⤵
  PID:3968
- C:\Windows\System\XGDvHDb.exe
  C:\Windows\System\XGDvHDb.exe
  2⤵
  PID:3992
- C:\Windows\System\brQJrMI.exe
  C:\Windows\System\brQJrMI.exe
  2⤵
  PID:4008
- C:\Windows\System\jgYbekr.exe
  C:\Windows\System\jgYbekr.exe
  2⤵
  PID:4024
- C:\Windows\System\nvNdBzu.exe
  C:\Windows\System\nvNdBzu.exe
  2⤵
  PID:4040
- C:\Windows\System\NlndZJm.exe
  C:\Windows\System\NlndZJm.exe
  2⤵
  PID:4056
- C:\Windows\System\KinPiRO.exe
  C:\Windows\System\KinPiRO.exe
  2⤵
  PID:4080
- C:\Windows\System\JzuQsZa.exe
  C:\Windows\System\JzuQsZa.exe
  2⤵
  PID:620
- C:\Windows\System\kIewTuk.exe
  C:\Windows\System\kIewTuk.exe
  2⤵
  PID:1528
- C:\Windows\System\BNCnuWe.exe
  C:\Windows\System\BNCnuWe.exe
  2⤵
  PID:1888
- C:\Windows\System\IEIQwFr.exe
  C:\Windows\System\IEIQwFr.exe
  2⤵
  PID:2732
- C:\Windows\System\XQUpyKZ.exe
  C:\Windows\System\XQUpyKZ.exe
  2⤵
  PID:2288
- C:\Windows\System\oFTVXhV.exe
  C:\Windows\System\oFTVXhV.exe
  2⤵
  PID:2272
- C:\Windows\System\TBHAjaj.exe
  C:\Windows\System\TBHAjaj.exe
  2⤵
  PID:2912
- C:\Windows\System\sLbfxVx.exe
  C:\Windows\System\sLbfxVx.exe
  2⤵
  PID:912
- C:\Windows\System\GyGepxA.exe
  C:\Windows\System\GyGepxA.exe
  2⤵
  PID:2944
- C:\Windows\System\zyoBbhK.exe
  C:\Windows\System\zyoBbhK.exe
  2⤵
  PID:2816
- C:\Windows\System\XMddObB.exe
  C:\Windows\System\XMddObB.exe
  2⤵
  PID:1984
- C:\Windows\System\BclWQsK.exe
  C:\Windows\System\BclWQsK.exe
  2⤵
  PID:3048
- C:\Windows\System\BLxiUoZ.exe
  C:\Windows\System\BLxiUoZ.exe
  2⤵
  PID:3156
- C:\Windows\System\WjUEFXM.exe
  C:\Windows\System\WjUEFXM.exe
  2⤵
  PID:3208
- C:\Windows\System\nFEOaIz.exe
  C:\Windows\System\nFEOaIz.exe
  2⤵
  PID:3308
- C:\Windows\System\nJDCihx.exe
  C:\Windows\System\nJDCihx.exe
  2⤵
  PID:3380
- C:\Windows\System\dwuInMu.exe
  C:\Windows\System\dwuInMu.exe
  2⤵
  PID:1832
- C:\Windows\System\YduALLx.exe
  C:\Windows\System\YduALLx.exe
  2⤵
  PID:3452
- C:\Windows\System\dBTREGZ.exe
  C:\Windows\System\dBTREGZ.exe
  2⤵
  PID:3592
- C:\Windows\System\WxrfpbM.exe
  C:\Windows\System\WxrfpbM.exe
  2⤵
  PID:3668
- C:\Windows\System\iHcIBVA.exe
  C:\Windows\System\iHcIBVA.exe
  2⤵
  PID:2772
- C:\Windows\System\eRaIwZV.exe
  C:\Windows\System\eRaIwZV.exe
  2⤵
  PID:3788
- C:\Windows\System\ZeGTLwR.exe
  C:\Windows\System\ZeGTLwR.exe
  2⤵
  PID:1260
- C:\Windows\System\CErMCYj.exe
  C:\Windows\System\CErMCYj.exe
  2⤵
  PID:3288
- C:\Windows\System\tQjttia.exe
  C:\Windows\System\tQjttia.exe
  2⤵
  PID:3804
- C:\Windows\System\UdWLrOI.exe
  C:\Windows\System\UdWLrOI.exe
  2⤵
  PID:3736
- C:\Windows\System\JFrkIkV.exe
  C:\Windows\System\JFrkIkV.exe
  2⤵
  PID:3620
- C:\Windows\System\VYyEffs.exe
  C:\Windows\System\VYyEffs.exe
  2⤵
  PID:3532
- C:\Windows\System\KCGlbby.exe
  C:\Windows\System\KCGlbby.exe
  2⤵
  PID:3468
- C:\Windows\System\ayRWNjA.exe
  C:\Windows\System\ayRWNjA.exe
  2⤵
  PID:2644
- C:\Windows\System\tTigGMw.exe
  C:\Windows\System\tTigGMw.exe
  2⤵
  PID:3180
- C:\Windows\System\gfYhXuw.exe
  C:\Windows\System\gfYhXuw.exe
  2⤵
  PID:3176
- C:\Windows\System\YlERHDv.exe
  C:\Windows\System\YlERHDv.exe
  2⤵
  PID:2832
- C:\Windows\System\xSvMNWa.exe
  C:\Windows\System\xSvMNWa.exe
  2⤵
  PID:1280
- C:\Windows\System\CDUYzbj.exe
  C:\Windows\System\CDUYzbj.exe
  2⤵
  PID:2184
- C:\Windows\System\vpvUaDq.exe
  C:\Windows\System\vpvUaDq.exe
  2⤵
  PID:2508
- C:\Windows\System\qeeYABc.exe
  C:\Windows\System\qeeYABc.exe
  2⤵
  PID:2068
- C:\Windows\System\fzhrxPK.exe
  C:\Windows\System\fzhrxPK.exe
  2⤵
  PID:1152
- C:\Windows\System\bBfanhk.exe
  C:\Windows\System\bBfanhk.exe
  2⤵
  PID:3004
- C:\Windows\System\rDHVOxK.exe
  C:\Windows\System\rDHVOxK.exe
  2⤵
  PID:3340
- C:\Windows\System\LKSdrvc.exe
  C:\Windows\System\LKSdrvc.exe
  2⤵
  PID:3256
- C:\Windows\System\jIkqnBX.exe
  C:\Windows\System\jIkqnBX.exe
  2⤵
  PID:3664
- C:\Windows\System\tjkJvYa.exe
  C:\Windows\System\tjkJvYa.exe
  2⤵
  PID:1704
- C:\Windows\System\ZjnOrJx.exe
  C:\Windows\System\ZjnOrJx.exe
  2⤵
  PID:3872
- C:\Windows\System\DtFgNcm.exe
  C:\Windows\System\DtFgNcm.exe
  2⤵
  PID:3912
- C:\Windows\System\WsrVUqt.exe
  C:\Windows\System\WsrVUqt.exe
  2⤵
  PID:3980
- C:\Windows\System\CGVZCRS.exe
  C:\Windows\System\CGVZCRS.exe
  2⤵
  PID:4020
- C:\Windows\System\tSkTcCb.exe
  C:\Windows\System\tSkTcCb.exe
  2⤵
  PID:4092
- C:\Windows\System\HnsQuYu.exe
  C:\Windows\System\HnsQuYu.exe
  2⤵
  PID:2460
- C:\Windows\System\wMqebNC.exe
  C:\Windows\System\wMqebNC.exe
  2⤵
  PID:276
- C:\Windows\System\CWCIqBu.exe
  C:\Windows\System\CWCIqBu.exe
  2⤵
  PID:3060
- C:\Windows\System\MZXrfLz.exe
  C:\Windows\System\MZXrfLz.exe
  2⤵
  PID:2648
- C:\Windows\System\ckBxvkh.exe
  C:\Windows\System\ckBxvkh.exe
  2⤵
  PID:3244
- C:\Windows\System\LDzhUsi.exe
  C:\Windows\System\LDzhUsi.exe
  2⤵
  PID:2492
- C:\Windows\System\zKcInry.exe
  C:\Windows\System\zKcInry.exe
  2⤵
  PID:3596
- C:\Windows\System\VxLXcmL.exe
  C:\Windows\System\VxLXcmL.exe
  2⤵
  PID:3716
- C:\Windows\System\XuKDRfc.exe
  C:\Windows\System\XuKDRfc.exe
  2⤵
  PID:1840
- C:\Windows\System\yVcynha.exe
  C:\Windows\System\yVcynha.exe
  2⤵
  PID:1572
- C:\Windows\System\peEOQjH.exe
  C:\Windows\System\peEOQjH.exe
  2⤵
  PID:2572
- C:\Windows\System\GxzbgiV.exe
  C:\Windows\System\GxzbgiV.exe
  2⤵
  PID:1768
- C:\Windows\System\MuWAYky.exe
  C:\Windows\System\MuWAYky.exe
  2⤵
  PID:2532
- C:\Windows\System\EOVJgCR.exe
  C:\Windows\System\EOVJgCR.exe
  2⤵
  PID:2408
- C:\Windows\System\XxzZqXG.exe
  C:\Windows\System\XxzZqXG.exe
  2⤵
  PID:1296
- C:\Windows\System\pLogJGl.exe
  C:\Windows\System\pLogJGl.exe
  2⤵
  PID:3012
- C:\Windows\System\KywJTJI.exe
  C:\Windows\System\KywJTJI.exe
  2⤵
  PID:1104
- C:\Windows\System\GngDTDa.exe
  C:\Windows\System\GngDTDa.exe
  2⤵
  PID:2008
- C:\Windows\System\qeDlmMK.exe
  C:\Windows\System\qeDlmMK.exe
  2⤵
  PID:2708
- C:\Windows\System\TfgyckZ.exe
  C:\Windows\System\TfgyckZ.exe
  2⤵
  PID:824
- C:\Windows\System\XfLIwME.exe
  C:\Windows\System\XfLIwME.exe
  2⤵
  PID:2020
- C:\Windows\System\XXgsWQk.exe
  C:\Windows\System\XXgsWQk.exe
  2⤵
  PID:1036
- C:\Windows\System\PsRTWXw.exe
  C:\Windows\System\PsRTWXw.exe
  2⤵
  PID:2544
- C:\Windows\System\FNNfQLD.exe
  C:\Windows\System\FNNfQLD.exe
  2⤵
  PID:3096
- C:\Windows\System\ISFXizO.exe
  C:\Windows\System\ISFXizO.exe
  2⤵
  PID:4032
- C:\Windows\System\ELuHnHo.exe
  C:\Windows\System\ELuHnHo.exe
  2⤵
  PID:4036
- C:\Windows\System\mcyrZEw.exe
  C:\Windows\System\mcyrZEw.exe
  2⤵
  PID:1664
- C:\Windows\System\pRpTZuU.exe
  C:\Windows\System\pRpTZuU.exe
  2⤵
  PID:2596
- C:\Windows\System\ZEWJoQO.exe
  C:\Windows\System\ZEWJoQO.exe
  2⤵
  PID:3088
- C:\Windows\System\UNZCoqr.exe
  C:\Windows\System\UNZCoqr.exe
  2⤵
  PID:2344
- C:\Windows\System\xnmkVxf.exe
  C:\Windows\System\xnmkVxf.exe
  2⤵
  PID:1340
- C:\Windows\System\IMnkqwt.exe
  C:\Windows\System\IMnkqwt.exe
  2⤵
  PID:1836
- C:\Windows\System\hkrsXal.exe
  C:\Windows\System\hkrsXal.exe
  2⤵
  PID:892
- C:\Windows\System\ztBQbxv.exe
  C:\Windows\System\ztBQbxv.exe
  2⤵
  PID:572
- C:\Windows\System\hRQIWjP.exe
  C:\Windows\System\hRQIWjP.exe
  2⤵
  PID:2896
- C:\Windows\System\qPcDDVF.exe
  C:\Windows\System\qPcDDVF.exe
  2⤵
  PID:3324
- C:\Windows\System\eebmhfe.exe
  C:\Windows\System\eebmhfe.exe
  2⤵
  PID:3764
- C:\Windows\System\LDlWnQC.exe
  C:\Windows\System\LDlWnQC.exe
  2⤵
  PID:3652
- C:\Windows\System\UDYLwro.exe
  C:\Windows\System\UDYLwro.exe
  2⤵
  PID:3400
- C:\Windows\System\wruRIQx.exe
  C:\Windows\System\wruRIQx.exe
  2⤵
  PID:2564
- C:\Windows\System\meOTYSi.exe
  C:\Windows\System\meOTYSi.exe
  2⤵
  PID:2468
- C:\Windows\System\uzaGkHK.exe
  C:\Windows\System\uzaGkHK.exe
  2⤵
  PID:3440
- C:\Windows\System\GfqfjDJ.exe
  C:\Windows\System\GfqfjDJ.exe
  2⤵
  PID:3540
- C:\Windows\System\lmetuiw.exe
  C:\Windows\System\lmetuiw.exe
  2⤵
  PID:3808
- C:\Windows\System\wAEwGoG.exe
  C:\Windows\System\wAEwGoG.exe
  2⤵
  PID:1996
- C:\Windows\System\zNhtujZ.exe
  C:\Windows\System\zNhtujZ.exe
  2⤵
  PID:1936
- C:\Windows\System\HGvhyWl.exe
  C:\Windows\System\HGvhyWl.exe
  2⤵
  PID:3880
- C:\Windows\System\lxcmldz.exe
  C:\Windows\System\lxcmldz.exe
  2⤵
  PID:3784
- C:\Windows\System\IfyrDAB.exe
  C:\Windows\System\IfyrDAB.exe
  2⤵
  PID:2980
- C:\Windows\System\zxpmDfp.exe
  C:\Windows\System\zxpmDfp.exe
  2⤵
  PID:3908
- C:\Windows\System\asWsERo.exe
  C:\Windows\System\asWsERo.exe
  2⤵
  PID:3396
- C:\Windows\System\dviwJqk.exe
  C:\Windows\System\dviwJqk.exe
  2⤵
  PID:2032
- C:\Windows\System\zTTIVuy.exe
  C:\Windows\System\zTTIVuy.exe
  2⤵
  PID:3712
- C:\Windows\System\sEpcvde.exe
  C:\Windows\System\sEpcvde.exe
  2⤵
  PID:476
- C:\Windows\System\gKbhQYn.exe
  C:\Windows\System\gKbhQYn.exe
  2⤵
  PID:2964
- C:\Windows\System\cxxvWrS.exe
  C:\Windows\System\cxxvWrS.exe
  2⤵
  PID:3488
- C:\Windows\System\nfLVnnl.exe
  C:\Windows\System\nfLVnnl.exe
  2⤵
  PID:3520
- C:\Windows\System\OyFZqiB.exe
  C:\Windows\System\OyFZqiB.exe
  2⤵
  PID:2592
- C:\Windows\System\BksfxnE.exe
  C:\Windows\System\BksfxnE.exe
  2⤵
  PID:2224
- C:\Windows\System\yVwenNV.exe
  C:\Windows\System\yVwenNV.exe
  2⤵
  PID:1824
- C:\Windows\System\PizuFpp.exe
  C:\Windows\System\PizuFpp.exe
  2⤵
  PID:548
- C:\Windows\System\VrZfJfu.exe
  C:\Windows\System\VrZfJfu.exe
  2⤵
  PID:1032
- C:\Windows\System\QHGgCKG.exe
  C:\Windows\System\QHGgCKG.exe
  2⤵
  PID:1600
- C:\Windows\System\UbOebzb.exe
  C:\Windows\System\UbOebzb.exe
  2⤵
  PID:2876
- C:\Windows\System\qKtVCyK.exe
  C:\Windows\System\qKtVCyK.exe
  2⤵
  PID:2416
- C:\Windows\System\LsesggN.exe
  C:\Windows\System\LsesggN.exe
  2⤵
  PID:2500
- C:\Windows\System\SZjedDF.exe
  C:\Windows\System\SZjedDF.exe
  2⤵
  PID:2628
- C:\Windows\System\EZThCNF.exe
  C:\Windows\System\EZThCNF.exe
  2⤵
  PID:1952
- C:\Windows\System\RNSAuRG.exe
  C:\Windows\System\RNSAuRG.exe
  2⤵
  PID:4072
- C:\Windows\System\TpTRoDU.exe
  C:\Windows\System\TpTRoDU.exe
  2⤵
  PID:1772
- C:\Windows\System\cwUDfQj.exe
  C:\Windows\System\cwUDfQj.exe
  2⤵
  PID:2176
- C:\Windows\System\PomenCn.exe
  C:\Windows\System\PomenCn.exe
  2⤵
  PID:3684
- C:\Windows\System\CwLIeIP.exe
  C:\Windows\System\CwLIeIP.exe
  2⤵
  PID:2848
- C:\Windows\System\uxkuCEk.exe
  C:\Windows\System\uxkuCEk.exe
  2⤵
  PID:2496
- C:\Windows\System\HVqlrFa.exe
  C:\Windows\System\HVqlrFa.exe
  2⤵
  PID:3092
- C:\Windows\System\ncUrpQo.exe
  C:\Windows\System\ncUrpQo.exe
  2⤵
  PID:2916
- C:\Windows\System\KEhyIPI.exe
  C:\Windows\System\KEhyIPI.exe
  2⤵
  PID:2444
- C:\Windows\System\XOHsAQB.exe
  C:\Windows\System\XOHsAQB.exe
  2⤵
  PID:3812
- C:\Windows\System\niXkWwX.exe
  C:\Windows\System\niXkWwX.exe
  2⤵
  PID:3124
- C:\Windows\System\AXPqKTH.exe
  C:\Windows\System\AXPqKTH.exe
  2⤵
  PID:4088
- C:\Windows\System\pbRkmWv.exe
  C:\Windows\System\pbRkmWv.exe
  2⤵
  PID:3204
- C:\Windows\System\ManoVlv.exe
  C:\Windows\System\ManoVlv.exe
  2⤵
  PID:2676
- C:\Windows\System\feeLxXZ.exe
  C:\Windows\System\feeLxXZ.exe
  2⤵
  PID:3416
- C:\Windows\System\VXyoXDs.exe
  C:\Windows\System\VXyoXDs.exe
  2⤵
  PID:2396
- C:\Windows\System\bKatAMO.exe
  C:\Windows\System\bKatAMO.exe
  2⤵
  PID:1420
- C:\Windows\System\vHcSsCJ.exe
  C:\Windows\System\vHcSsCJ.exe
  2⤵
  PID:2584
- C:\Windows\System\dxnklAm.exe
  C:\Windows\System\dxnklAm.exe
  2⤵
  PID:704
- C:\Windows\System\GfoERuZ.exe
  C:\Windows\System\GfoERuZ.exe
  2⤵
  PID:952
- C:\Windows\System\QIbTwJB.exe
  C:\Windows\System\QIbTwJB.exe
  2⤵
  PID:1884
- C:\Windows\System\IrGrxDV.exe
  C:\Windows\System\IrGrxDV.exe
  2⤵
  PID:2688
- C:\Windows\System\MjZhHyO.exe
  C:\Windows\System\MjZhHyO.exe
  2⤵
  PID:1828
- C:\Windows\System\HstjLLm.exe
  C:\Windows\System\HstjLLm.exe
  2⤵
  PID:1480
- C:\Windows\System\aJQdqiO.exe
  C:\Windows\System\aJQdqiO.exe
  2⤵
  PID:3352
- C:\Windows\System\hJhUAgr.exe
  C:\Windows\System\hJhUAgr.exe
  2⤵
  PID:2660
- C:\Windows\System\WfjQRZP.exe
  C:\Windows\System\WfjQRZP.exe
  2⤵
  PID:4004
- C:\Windows\System\hCrEccU.exe
  C:\Windows\System\hCrEccU.exe
  2⤵
  PID:3304
- C:\Windows\System\WFzTDnN.exe
  C:\Windows\System\WFzTDnN.exe
  2⤵
  PID:1728
- C:\Windows\System\ixphlNE.exe
  C:\Windows\System\ixphlNE.exe
  2⤵
  PID:520
- C:\Windows\System\dQCoKmf.exe
  C:\Windows\System\dQCoKmf.exe
  2⤵
  PID:3976
- C:\Windows\System\BpfKOyT.exe
  C:\Windows\System\BpfKOyT.exe
  2⤵
  PID:1948
- C:\Windows\System\OVOyfzu.exe
  C:\Windows\System\OVOyfzu.exe
  2⤵
  PID:3588
- C:\Windows\System\ugEMeHA.exe
  C:\Windows\System\ugEMeHA.exe
  2⤵
  PID:4104
- C:\Windows\System\KFWSCmc.exe
  C:\Windows\System\KFWSCmc.exe
  2⤵
  PID:4120
- C:\Windows\System\qpXqgEn.exe
  C:\Windows\System\qpXqgEn.exe
  2⤵
  PID:4136
- C:\Windows\System\aBwLQyo.exe
  C:\Windows\System\aBwLQyo.exe
  2⤵
  PID:4152
- C:\Windows\System\xFIDWlY.exe
  C:\Windows\System\xFIDWlY.exe
  2⤵
  PID:4168
- C:\Windows\System\OwTnRYf.exe
  C:\Windows\System\OwTnRYf.exe
  2⤵
  PID:4184
- C:\Windows\System\Xaltyud.exe
  C:\Windows\System\Xaltyud.exe
  2⤵
  PID:4200
- C:\Windows\System\aigMvnq.exe
  C:\Windows\System\aigMvnq.exe
  2⤵
  PID:4216
- C:\Windows\System\UeZrAgU.exe
  C:\Windows\System\UeZrAgU.exe
  2⤵
  PID:4232
- C:\Windows\System\WayRuuW.exe
  C:\Windows\System\WayRuuW.exe
  2⤵
  PID:4248
- C:\Windows\System\SodFVBQ.exe
  C:\Windows\System\SodFVBQ.exe
  2⤵
  PID:4264
- C:\Windows\System\DDGTmUl.exe
  C:\Windows\System\DDGTmUl.exe
  2⤵
  PID:4280
- C:\Windows\System\BHxVeyY.exe
  C:\Windows\System\BHxVeyY.exe
  2⤵
  PID:4296
- C:\Windows\System\TESIwhs.exe
  C:\Windows\System\TESIwhs.exe
  2⤵
  PID:4312
- C:\Windows\System\ySVuREU.exe
  C:\Windows\System\ySVuREU.exe
  2⤵
  PID:4328
- C:\Windows\System\dYtUotn.exe
  C:\Windows\System\dYtUotn.exe
  2⤵
  PID:4344
- C:\Windows\System\ISlbxTM.exe
  C:\Windows\System\ISlbxTM.exe
  2⤵
  PID:4360
- C:\Windows\System\nnzupPA.exe
  C:\Windows\System\nnzupPA.exe
  2⤵
  PID:4376
- C:\Windows\System\GWdaoDR.exe
  C:\Windows\System\GWdaoDR.exe
  2⤵
  PID:4392
- C:\Windows\System\gimYGnr.exe
  C:\Windows\System\gimYGnr.exe
  2⤵
  PID:4408
- C:\Windows\System\YonsnMV.exe
  C:\Windows\System\YonsnMV.exe
  2⤵
  PID:4460
- C:\Windows\System\GNduuoR.exe
  C:\Windows\System\GNduuoR.exe
  2⤵
  PID:4480
- C:\Windows\System\FlBtuFn.exe
  C:\Windows\System\FlBtuFn.exe
  2⤵
  PID:4500
- C:\Windows\System\oPCfAbm.exe
  C:\Windows\System\oPCfAbm.exe
  2⤵
  PID:4528
- C:\Windows\System\TrjYDXd.exe
  C:\Windows\System\TrjYDXd.exe
  2⤵
  PID:4544
- C:\Windows\System\YlzWBdf.exe
  C:\Windows\System\YlzWBdf.exe
  2⤵
  PID:4564
- C:\Windows\System\rfaVkax.exe
  C:\Windows\System\rfaVkax.exe
  2⤵
  PID:4584
- C:\Windows\System\eCstnrP.exe
  C:\Windows\System\eCstnrP.exe
  2⤵
  PID:4600
- C:\Windows\System\PILrvsE.exe
  C:\Windows\System\PILrvsE.exe
  2⤵
  PID:4616
- C:\Windows\System\FhCcCLD.exe
  C:\Windows\System\FhCcCLD.exe
  2⤵
  PID:4632
- C:\Windows\System\drOhoeA.exe
  C:\Windows\System\drOhoeA.exe
  2⤵
  PID:4648
- C:\Windows\System\fewYccG.exe
  C:\Windows\System\fewYccG.exe
  2⤵
  PID:4672
- C:\Windows\System\lgVbrGO.exe
  C:\Windows\System\lgVbrGO.exe
  2⤵
  PID:4696
- C:\Windows\System\GHrkKle.exe
  C:\Windows\System\GHrkKle.exe
  2⤵
  PID:4712
- C:\Windows\System\WSDdwry.exe
  C:\Windows\System\WSDdwry.exe
  2⤵
  PID:4732
- C:\Windows\System\mtGIYyH.exe
  C:\Windows\System\mtGIYyH.exe
  2⤵
  PID:4748
- C:\Windows\System\HdsKAJt.exe
  C:\Windows\System\HdsKAJt.exe
  2⤵
  PID:4764
- C:\Windows\System\OkmxgQo.exe
  C:\Windows\System\OkmxgQo.exe
  2⤵
  PID:4784
- C:\Windows\System\eNBrndf.exe
  C:\Windows\System\eNBrndf.exe
  2⤵
  PID:4800
- C:\Windows\System\zpJYDaZ.exe
  C:\Windows\System\zpJYDaZ.exe
  2⤵
  PID:4816
- C:\Windows\System\shcFkiu.exe
  C:\Windows\System\shcFkiu.exe
  2⤵
  PID:4832
- C:\Windows\System\qlmZDti.exe
  C:\Windows\System\qlmZDti.exe
  2⤵
  PID:4848
- C:\Windows\System\rbjlunI.exe
  C:\Windows\System\rbjlunI.exe
  2⤵
  PID:4864
- C:\Windows\System\eOpSeaf.exe
  C:\Windows\System\eOpSeaf.exe
  2⤵
  PID:4880
- C:\Windows\System\CUntGcQ.exe
  C:\Windows\System\CUntGcQ.exe
  2⤵
  PID:4896
- C:\Windows\System\buSpBsK.exe
  C:\Windows\System\buSpBsK.exe
  2⤵
  PID:4912
- C:\Windows\System\pNoAvBs.exe
  C:\Windows\System\pNoAvBs.exe
  2⤵
  PID:4928
- C:\Windows\System\DVnWdZO.exe
  C:\Windows\System\DVnWdZO.exe
  2⤵
  PID:4944
- C:\Windows\System\edPunkb.exe
  C:\Windows\System\edPunkb.exe
  2⤵
  PID:4964
- C:\Windows\System\tkDptcx.exe
  C:\Windows\System\tkDptcx.exe
  2⤵
  PID:4980
- C:\Windows\System\swsGLHy.exe
  C:\Windows\System\swsGLHy.exe
  2⤵
  PID:4996
- C:\Windows\System\GIYdiiy.exe
  C:\Windows\System\GIYdiiy.exe
  2⤵
  PID:5012
- C:\Windows\System\hCyexcp.exe
  C:\Windows\System\hCyexcp.exe
  2⤵
  PID:5028
- C:\Windows\System\eqdwuyv.exe
  C:\Windows\System\eqdwuyv.exe
  2⤵
  PID:5044
- C:\Windows\System\cQfVctC.exe
  C:\Windows\System\cQfVctC.exe
  2⤵
  PID:5064
- C:\Windows\System\OBzhRlN.exe
  C:\Windows\System\OBzhRlN.exe
  2⤵
  PID:5080
- C:\Windows\System\DqYjgaM.exe
  C:\Windows\System\DqYjgaM.exe
  2⤵
  PID:5096
- C:\Windows\System\NdvLoQJ.exe
  C:\Windows\System\NdvLoQJ.exe
  2⤵
  PID:5112
- C:\Windows\System\GAJHAuG.exe
  C:\Windows\System\GAJHAuG.exe
  2⤵
  PID:1800
- C:\Windows\System\qNqEAsq.exe
  C:\Windows\System\qNqEAsq.exe
  2⤵
  PID:2220
- C:\Windows\System\RYDSVuA.exe
  C:\Windows\System\RYDSVuA.exe
  2⤵
  PID:3276
- C:\Windows\System\IThtkCz.exe
  C:\Windows\System\IThtkCz.exe
  2⤵
  PID:3944
- C:\Windows\System\JxWsJcj.exe
  C:\Windows\System\JxWsJcj.exe
  2⤵
  PID:4132
- C:\Windows\System\aEXqHNe.exe
  C:\Windows\System\aEXqHNe.exe
  2⤵
  PID:4196
- C:\Windows\System\wJWcKaz.exe
  C:\Windows\System\wJWcKaz.exe
  2⤵
  PID:4256
- C:\Windows\System\NlObDsK.exe
  C:\Windows\System\NlObDsK.exe
  2⤵
  PID:4324
- C:\Windows\System\BDoEvew.exe
  C:\Windows\System\BDoEvew.exe
  2⤵
  PID:4384
- C:\Windows\System\QmBqHJi.exe
  C:\Windows\System\QmBqHJi.exe
  2⤵
  PID:4424
- C:\Windows\System\rXHwDAd.exe
  C:\Windows\System\rXHwDAd.exe
  2⤵
  PID:4444
- C:\Windows\System\LdCvhSR.exe
  C:\Windows\System\LdCvhSR.exe
  2⤵
  PID:4488
- C:\Windows\System\bQjwlRD.exe
  C:\Windows\System\bQjwlRD.exe
  2⤵
  PID:4540
- C:\Windows\System\bLAEjod.exe
  C:\Windows\System\bLAEjod.exe
  2⤵
  PID:4148
- C:\Windows\System\WhwMywr.exe
  C:\Windows\System\WhwMywr.exe
  2⤵
  PID:4212
- C:\Windows\System\DQdgLfJ.exe
  C:\Windows\System\DQdgLfJ.exe
  2⤵
  PID:4244
- C:\Windows\System\HVbYcox.exe
  C:\Windows\System\HVbYcox.exe
  2⤵
  PID:4336
- C:\Windows\System\rMaSyIZ.exe
  C:\Windows\System\rMaSyIZ.exe
  2⤵
  PID:4668
- C:\Windows\System\IFCgwHe.exe
  C:\Windows\System\IFCgwHe.exe
  2⤵
  PID:4744
- C:\Windows\System\IUaZJPD.exe
  C:\Windows\System\IUaZJPD.exe
  2⤵
  PID:4400
- C:\Windows\System\JXOkZDw.exe
  C:\Windows\System\JXOkZDw.exe
  2⤵
  PID:3772
- C:\Windows\System\rUIRANI.exe
  C:\Windows\System\rUIRANI.exe
  2⤵
  PID:300
- C:\Windows\System\NPvcIde.exe
  C:\Windows\System\NPvcIde.exe
  2⤵
  PID:2196
- C:\Windows\System\EPxyvdJ.exe
  C:\Windows\System\EPxyvdJ.exe
  2⤵
  PID:4692
- C:\Windows\System\zLVqYdM.exe
  C:\Windows\System\zLVqYdM.exe
  2⤵
  PID:4844
- C:\Windows\System\jClFOmi.exe
  C:\Windows\System\jClFOmi.exe
  2⤵
  PID:4468
- C:\Windows\System\zpKxyEp.exe
  C:\Windows\System\zpKxyEp.exe
  2⤵
  PID:2736
- C:\Windows\System\Kmsdofm.exe
  C:\Windows\System\Kmsdofm.exe
  2⤵
  PID:4520
- C:\Windows\System\judKVUR.exe
  C:\Windows\System\judKVUR.exe
  2⤵
  PID:4828
- C:\Windows\System\FfKSVDr.exe
  C:\Windows\System\FfKSVDr.exe
  2⤵
  PID:4624
- C:\Windows\System\GykPVnF.exe
  C:\Windows\System\GykPVnF.exe
  2⤵
  PID:4656
- C:\Windows\System\OOmGJBR.exe
  C:\Windows\System\OOmGJBR.exe
  2⤵
  PID:4724
- C:\Windows\System\neGSLrH.exe
  C:\Windows\System\neGSLrH.exe
  2⤵
  PID:4888
- C:\Windows\System\lwzIrMh.exe
  C:\Windows\System\lwzIrMh.exe
  2⤵
  PID:4892
- C:\Windows\System\irJmAem.exe
  C:\Windows\System\irJmAem.exe
  2⤵
  PID:4924
- C:\Windows\System\NkavlYQ.exe
  C:\Windows\System\NkavlYQ.exe
  2⤵
  PID:4992
- C:\Windows\System\oiBUTPQ.exe
  C:\Windows\System\oiBUTPQ.exe
  2⤵
  PID:5056
- C:\Windows\System\ZSHUPIG.exe
  C:\Windows\System\ZSHUPIG.exe
  2⤵
  PID:4936
- C:\Windows\System\WtaVHVC.exe
  C:\Windows\System\WtaVHVC.exe
  2⤵
  PID:4976
- C:\Windows\System\fkhdpJm.exe
  C:\Windows\System\fkhdpJm.exe
  2⤵
  PID:5036
- C:\Windows\System\EEtBIyI.exe
  C:\Windows\System\EEtBIyI.exe
  2⤵
  PID:5104
- C:\Windows\System\BbJKWbl.exe
  C:\Windows\System\BbJKWbl.exe
  2⤵
  PID:2716
- C:\Windows\System\jYhnkDG.exe
  C:\Windows\System\jYhnkDG.exe
  2⤵
  PID:3192
- C:\Windows\System\BjvpPNJ.exe
  C:\Windows\System\BjvpPNJ.exe
  2⤵
  PID:4440
- C:\Windows\System\OvtBoiI.exe
  C:\Windows\System\OvtBoiI.exe
  2⤵
  PID:4180
- C:\Windows\System\heCSzgF.exe
  C:\Windows\System\heCSzgF.exe
  2⤵
  PID:4452
- C:\Windows\System\kAtNHgQ.exe
  C:\Windows\System\kAtNHgQ.exe
  2⤵
  PID:4416
- C:\Windows\System\maxhfJp.exe
  C:\Windows\System\maxhfJp.exe
  2⤵
  PID:4276
- C:\Windows\System\GvvJfAs.exe
  C:\Windows\System\GvvJfAs.exe
  2⤵
  PID:4208
- C:\Windows\System\hKBedio.exe
  C:\Windows\System\hKBedio.exe
  2⤵
  PID:4640
- C:\Windows\System\JCgClCP.exe
  C:\Windows\System\JCgClCP.exe
  2⤵
  PID:2948
- C:\Windows\System\serdYin.exe
  C:\Windows\System\serdYin.exe
  2⤵
  PID:4476
- C:\Windows\System\HgxyTEB.exe
  C:\Windows\System\HgxyTEB.exe
  2⤵
  PID:4792
- C:\Windows\System\rPovlYC.exe
  C:\Windows\System\rPovlYC.exe
  2⤵
  PID:4876
- C:\Windows\System\PgtVROC.exe
  C:\Windows\System\PgtVROC.exe
  2⤵
  PID:1700
- C:\Windows\System\zYXAcQV.exe
  C:\Windows\System\zYXAcQV.exe
  2⤵
  PID:1776
- C:\Windows\System\tFhscxi.exe
  C:\Windows\System\tFhscxi.exe
  2⤵
  PID:5024
- C:\Windows\System\DxlmLrf.exe
  C:\Windows\System\DxlmLrf.exe
  2⤵
  PID:4592
- C:\Windows\System\aRUTDSA.exe
  C:\Windows\System\aRUTDSA.exe
  2⤵
  PID:268
- C:\Windows\System\tdKIonf.exe
  C:\Windows\System\tdKIonf.exe
  2⤵
  PID:4556
- C:\Windows\System\miVxulQ.exe
  C:\Windows\System\miVxulQ.exe
  2⤵
  PID:5052
- C:\Windows\System\HhgGvuv.exe
  C:\Windows\System\HhgGvuv.exe
  2⤵
  PID:3100
- C:\Windows\System\Ixmakwb.exe
  C:\Windows\System\Ixmakwb.exe
  2⤵
  PID:4508
- C:\Windows\System\mEOFUzT.exe
  C:\Windows\System\mEOFUzT.exe
  2⤵
  PID:4576
- C:\Windows\System\MqAISRn.exe
  C:\Windows\System\MqAISRn.exe
  2⤵
  PID:4708
- C:\Windows\System\wdMAcJd.exe
  C:\Windows\System\wdMAcJd.exe
  2⤵
  PID:4372
- C:\Windows\System\pnlUTco.exe
  C:\Windows\System\pnlUTco.exe
  2⤵
  PID:4456
- C:\Windows\System\YSpPsQZ.exe
  C:\Windows\System\YSpPsQZ.exe
  2⤵
  PID:4840
- C:\Windows\System\vzvwLFv.exe
  C:\Windows\System\vzvwLFv.exe
  2⤵
  PID:4112
- C:\Windows\System\iSNHeUR.exe
  C:\Windows\System\iSNHeUR.exe
  2⤵
  PID:3544
- C:\Windows\System\rtTyehr.exe
  C:\Windows\System\rtTyehr.exe
  2⤵
  PID:5008
- C:\Windows\System\LXyexWA.exe
  C:\Windows\System\LXyexWA.exe
  2⤵
  PID:4552
- C:\Windows\System\kZyePuf.exe
  C:\Windows\System\kZyePuf.exe
  2⤵
  PID:4904
- C:\Windows\System\jlyYjou.exe
  C:\Windows\System\jlyYjou.exe
  2⤵
  PID:4536
- C:\Windows\System\CgvxKZR.exe
  C:\Windows\System\CgvxKZR.exe
  2⤵
  PID:3572
- C:\Windows\System\PNJbwOS.exe
  C:\Windows\System\PNJbwOS.exe
  2⤵
  PID:4920
- C:\Windows\System\xfJllov.exe
  C:\Windows\System\xfJllov.exe
  2⤵
  PID:4128
- C:\Windows\System\JwqJsGz.exe
  C:\Windows\System\JwqJsGz.exe
  2⤵
  PID:4720
- C:\Windows\System\WGinETY.exe
  C:\Windows\System\WGinETY.exe
  2⤵
  PID:2080
- C:\Windows\System\nAylYnB.exe
  C:\Windows\System\nAylYnB.exe
  2⤵
  PID:4756
- C:\Windows\System\AnnrgHh.exe
  C:\Windows\System\AnnrgHh.exe
  2⤵
  PID:3432
- C:\Windows\System\FIlEtIL.exe
  C:\Windows\System\FIlEtIL.exe
  2⤵
  PID:5136
- C:\Windows\System\CvcMQVH.exe
  C:\Windows\System\CvcMQVH.exe
  2⤵
  PID:5152
- C:\Windows\System\BosDhKy.exe
  C:\Windows\System\BosDhKy.exe
  2⤵
  PID:5168
- C:\Windows\System\SZOrlMe.exe
  C:\Windows\System\SZOrlMe.exe
  2⤵
  PID:5184
- C:\Windows\System\hIUbbir.exe
  C:\Windows\System\hIUbbir.exe
  2⤵
  PID:5232
- C:\Windows\System\tthlLOi.exe
  C:\Windows\System\tthlLOi.exe
  2⤵
  PID:5248
- C:\Windows\System\XkeEAXk.exe
  C:\Windows\System\XkeEAXk.exe
  2⤵
  PID:5264
- C:\Windows\System\xgDjycZ.exe
  C:\Windows\System\xgDjycZ.exe
  2⤵
  PID:5284
- C:\Windows\System\Jlnuyxi.exe
  C:\Windows\System\Jlnuyxi.exe
  2⤵
  PID:5304
- C:\Windows\System\yevBAeH.exe
  C:\Windows\System\yevBAeH.exe
  2⤵
  PID:5320
- C:\Windows\System\bOTJlTp.exe
  C:\Windows\System\bOTJlTp.exe
  2⤵
  PID:5336
- C:\Windows\System\uRpOVuN.exe
  C:\Windows\System\uRpOVuN.exe
  2⤵
  PID:5352
- C:\Windows\System\ufrZotb.exe
  C:\Windows\System\ufrZotb.exe
  2⤵
  PID:5368
- C:\Windows\System\gNoBHSK.exe
  C:\Windows\System\gNoBHSK.exe
  2⤵
  PID:5384
- C:\Windows\System\mgptREI.exe
  C:\Windows\System\mgptREI.exe
  2⤵
  PID:5400
- C:\Windows\System\GuEKMhH.exe
  C:\Windows\System\GuEKMhH.exe
  2⤵
  PID:5456
- C:\Windows\System\CsZRogM.exe
  C:\Windows\System\CsZRogM.exe
  2⤵
  PID:5472
- C:\Windows\System\misarlq.exe
  C:\Windows\System\misarlq.exe
  2⤵
  PID:5488
- C:\Windows\System\ByjbTDY.exe
  C:\Windows\System\ByjbTDY.exe
  2⤵
  PID:5504
- C:\Windows\System\CKmlOsp.exe
  C:\Windows\System\CKmlOsp.exe
  2⤵
  PID:5556
- C:\Windows\System\AmcNoSI.exe
  C:\Windows\System\AmcNoSI.exe
  2⤵
  PID:5572
- C:\Windows\System\cjLtfHj.exe
  C:\Windows\System\cjLtfHj.exe
  2⤵
  PID:5588
- C:\Windows\System\RWektBb.exe
  C:\Windows\System\RWektBb.exe
  2⤵
  PID:5604
- C:\Windows\System\zqoOxLN.exe
  C:\Windows\System\zqoOxLN.exe
  2⤵
  PID:5624
- C:\Windows\System\mifXcsf.exe
  C:\Windows\System\mifXcsf.exe
  2⤵
  PID:5640
- C:\Windows\System\QbwtxrB.exe
  C:\Windows\System\QbwtxrB.exe
  2⤵
  PID:5668
- C:\Windows\System\vpUicYS.exe
  C:\Windows\System\vpUicYS.exe
  2⤵
  PID:5684
- C:\Windows\System\uEoBOWq.exe
  C:\Windows\System\uEoBOWq.exe
  2⤵
  PID:5700
- C:\Windows\System\PPIKSPp.exe
  C:\Windows\System\PPIKSPp.exe
  2⤵
  PID:5716
- C:\Windows\System\JxYbzdz.exe
  C:\Windows\System\JxYbzdz.exe
  2⤵
  PID:5732
- C:\Windows\System\xsWYcZe.exe
  C:\Windows\System\xsWYcZe.exe
  2⤵
  PID:5764
- C:\Windows\System\WqNgLas.exe
  C:\Windows\System\WqNgLas.exe
  2⤵
  PID:5788
- C:\Windows\System\XsjFtpy.exe
  C:\Windows\System\XsjFtpy.exe
  2⤵
  PID:5804
- C:\Windows\System\UkLleVu.exe
  C:\Windows\System\UkLleVu.exe
  2⤵
  PID:5820
- C:\Windows\System\pyddlST.exe
  C:\Windows\System\pyddlST.exe
  2⤵
  PID:5836
- C:\Windows\System\HxdnDxP.exe
  C:\Windows\System\HxdnDxP.exe
  2⤵
  PID:5852
- C:\Windows\System\vhLZTwq.exe
  C:\Windows\System\vhLZTwq.exe
  2⤵
  PID:5868
- C:\Windows\System\ttbXcfS.exe
  C:\Windows\System\ttbXcfS.exe
  2⤵
  PID:5888
- C:\Windows\System\bKaiccf.exe
  C:\Windows\System\bKaiccf.exe
  2⤵
  PID:5908
- C:\Windows\System\rdvzcqt.exe
  C:\Windows\System\rdvzcqt.exe
  2⤵
  PID:5924
- C:\Windows\System\hEJdpXK.exe
  C:\Windows\System\hEJdpXK.exe
  2⤵
  PID:5940
- C:\Windows\System\CwbUETi.exe
  C:\Windows\System\CwbUETi.exe
  2⤵
  PID:5956
- C:\Windows\System\gXQwcyG.exe
  C:\Windows\System\gXQwcyG.exe
  2⤵
  PID:5972
- C:\Windows\System\vKpRrmq.exe
  C:\Windows\System\vKpRrmq.exe
  2⤵
  PID:5988
- C:\Windows\System\kJGnvIt.exe
  C:\Windows\System\kJGnvIt.exe
  2⤵
  PID:6004
- C:\Windows\System\PqkXkZW.exe
  C:\Windows\System\PqkXkZW.exe
  2⤵
  PID:6020
- C:\Windows\System\uhUVoun.exe
  C:\Windows\System\uhUVoun.exe
  2⤵
  PID:6040
- C:\Windows\System\tXkdmnn.exe
  C:\Windows\System\tXkdmnn.exe
  2⤵
  PID:6056
- C:\Windows\System\YwdPpBg.exe
  C:\Windows\System\YwdPpBg.exe
  2⤵
  PID:6076
- C:\Windows\System\wuFqkta.exe
  C:\Windows\System\wuFqkta.exe
  2⤵
  PID:6092
- C:\Windows\System\gALlmAn.exe
  C:\Windows\System\gALlmAn.exe
  2⤵
  PID:6108
- C:\Windows\System\oPITCld.exe
  C:\Windows\System\oPITCld.exe
  2⤵
  PID:6124
- C:\Windows\System\aYAQaJD.exe
  C:\Windows\System\aYAQaJD.exe
  2⤵
  PID:2440
- C:\Windows\System\cujnmDd.exe
  C:\Windows\System\cujnmDd.exe
  2⤵
  PID:4524
- C:\Windows\System\SGNtGsY.exe
  C:\Windows\System\SGNtGsY.exe
  2⤵
  PID:5148
- C:\Windows\System\qmKRyki.exe
  C:\Windows\System\qmKRyki.exe
  2⤵
  PID:5220
- C:\Windows\System\ihpgjuj.exe
  C:\Windows\System\ihpgjuj.exe
  2⤵
  PID:5256
- C:\Windows\System\JBscXsQ.exe
  C:\Windows\System\JBscXsQ.exe
  2⤵
  PID:5280
- C:\Windows\System\sBNNocm.exe
  C:\Windows\System\sBNNocm.exe
  2⤵
  PID:5376
- C:\Windows\System\JcJJsuv.exe
  C:\Windows\System\JcJJsuv.exe
  2⤵
  PID:5344
- C:\Windows\System\HERvouI.exe
  C:\Windows\System\HERvouI.exe
  2⤵
  PID:4260
- C:\Windows\System\hEEJKPC.exe
  C:\Windows\System\hEEJKPC.exe
  2⤵
  PID:5444
- C:\Windows\System\tBjxtry.exe
  C:\Windows\System\tBjxtry.exe
  2⤵
  PID:5332
- C:\Windows\System\WovoTVM.exe
  C:\Windows\System\WovoTVM.exe
  2⤵
  PID:5392
- C:\Windows\System\mkLsVLO.exe
  C:\Windows\System\mkLsVLO.exe
  2⤵
  PID:5452
- C:\Windows\System\BVvgeNH.exe
  C:\Windows\System\BVvgeNH.exe
  2⤵
  PID:5512
- C:\Windows\System\ejrFnvP.exe
  C:\Windows\System\ejrFnvP.exe
  2⤵
  PID:5516
- C:\Windows\System\VlWqlmV.exe
  C:\Windows\System\VlWqlmV.exe
  2⤵
  PID:5544
- C:\Windows\System\AwhKEJu.exe
  C:\Windows\System\AwhKEJu.exe
  2⤵
  PID:5612
- C:\Windows\System\TEuHqDa.exe
  C:\Windows\System\TEuHqDa.exe
  2⤵
  PID:5692
- C:\Windows\System\gKzxmEM.exe
  C:\Windows\System\gKzxmEM.exe
  2⤵
  PID:5724
- C:\Windows\System\fUaQOlC.exe
  C:\Windows\System\fUaQOlC.exe
  2⤵
  PID:5756
- C:\Windows\System\gUpFKrH.exe
  C:\Windows\System\gUpFKrH.exe
  2⤵
  PID:5844
- C:\Windows\System\snkHjBt.exe
  C:\Windows\System\snkHjBt.exe
  2⤵
  PID:5832
- C:\Windows\System\YygWcBo.exe
  C:\Windows\System\YygWcBo.exe
  2⤵
  PID:5880
- C:\Windows\System\UFTNtEe.exe
  C:\Windows\System\UFTNtEe.exe
  2⤵
  PID:5864
- C:\Windows\System\nCVRVsd.exe
  C:\Windows\System\nCVRVsd.exe
  2⤵
  PID:5932
- C:\Windows\System\AbHpNJc.exe
  C:\Windows\System\AbHpNJc.exe
  2⤵
  PID:5996
- C:\Windows\System\kramxjU.exe
  C:\Windows\System\kramxjU.exe
  2⤵
  PID:6012
- C:\Windows\System\RVycnpj.exe
  C:\Windows\System\RVycnpj.exe
  2⤵
  PID:6028
- C:\Windows\System\ZhKFdww.exe
  C:\Windows\System\ZhKFdww.exe
  2⤵
  PID:6116
- C:\Windows\System\xQYDpPS.exe
  C:\Windows\System\xQYDpPS.exe
  2⤵
  PID:6068
- C:\Windows\System\pktgirz.exe
  C:\Windows\System\pktgirz.exe
  2⤵
  PID:4116
- C:\Windows\System\eFWxtxn.exe
  C:\Windows\System\eFWxtxn.exe
  2⤵
  PID:5164
- C:\Windows\System\iuuDYCd.exe
  C:\Windows\System\iuuDYCd.exe
  2⤵
  PID:5580
- C:\Windows\System\svavTlZ.exe
  C:\Windows\System\svavTlZ.exe
  2⤵
  PID:5464
- C:\Windows\System\WeCFdUi.exe
  C:\Windows\System\WeCFdUi.exe
  2⤵
  PID:5480
- C:\Windows\System\WjIzVly.exe
  C:\Windows\System\WjIzVly.exe
  2⤵
  PID:5540
- C:\Windows\System\RXYayMz.exe
  C:\Windows\System\RXYayMz.exe
  2⤵
  PID:5364
- C:\Windows\System\FiDkpho.exe
  C:\Windows\System\FiDkpho.exe
  2⤵
  PID:5500
- C:\Windows\System\WXLEDAF.exe
  C:\Windows\System\WXLEDAF.exe
  2⤵
  PID:5648
- C:\Windows\System\XReJMvZ.exe
  C:\Windows\System\XReJMvZ.exe
  2⤵
  PID:5652
- C:\Windows\System\xnECKjU.exe
  C:\Windows\System\xnECKjU.exe
  2⤵
  PID:5664
- C:\Windows\System\JkbMYnw.exe
  C:\Windows\System\JkbMYnw.exe
  2⤵
  PID:6168
- C:\Windows\System\SIuNllr.exe
  C:\Windows\System\SIuNllr.exe
  2⤵
  PID:6184
- C:\Windows\System\VRcdwru.exe
  C:\Windows\System\VRcdwru.exe
  2⤵
  PID:6200
- C:\Windows\System\nIByBwu.exe
  C:\Windows\System\nIByBwu.exe
  2⤵
  PID:6216
- C:\Windows\System\mxyLBxQ.exe
  C:\Windows\System\mxyLBxQ.exe
  2⤵
  PID:6232
- C:\Windows\System\CxRBjsq.exe
  C:\Windows\System\CxRBjsq.exe
  2⤵
  PID:6252
- C:\Windows\System\pQdfHDf.exe
  C:\Windows\System\pQdfHDf.exe
  2⤵
  PID:6268
- C:\Windows\System\DGXAnGs.exe
  C:\Windows\System\DGXAnGs.exe
  2⤵
  PID:6376
- C:\Windows\System\PnzvTUT.exe
  C:\Windows\System\PnzvTUT.exe
  2⤵
  PID:6392
- C:\Windows\System\mxAGHXd.exe
  C:\Windows\System\mxAGHXd.exe
  2⤵
  PID:6408
- C:\Windows\System\tVCGFXf.exe
  C:\Windows\System\tVCGFXf.exe
  2⤵
  PID:6424
- C:\Windows\System\CpHLvsW.exe
  C:\Windows\System\CpHLvsW.exe
  2⤵
  PID:6440
- C:\Windows\System\fzLmKRg.exe
  C:\Windows\System\fzLmKRg.exe
  2⤵
  PID:6456
- C:\Windows\System\rEjdqrA.exe
  C:\Windows\System\rEjdqrA.exe
  2⤵
  PID:6472
- C:\Windows\System\pXBqhel.exe
  C:\Windows\System\pXBqhel.exe
  2⤵
  PID:6488
- C:\Windows\System\dUYudcp.exe
  C:\Windows\System\dUYudcp.exe
  2⤵
  PID:6508
- C:\Windows\System\sAkvoSL.exe
  C:\Windows\System\sAkvoSL.exe
  2⤵
  PID:6524
- C:\Windows\System\vjJkQxo.exe
  C:\Windows\System\vjJkQxo.exe
  2⤵
  PID:6540
- C:\Windows\System\TbKjINT.exe
  C:\Windows\System\TbKjINT.exe
  2⤵
  PID:6556
- C:\Windows\System\ecekmlt.exe
  C:\Windows\System\ecekmlt.exe
  2⤵
  PID:6572
- C:\Windows\System\AAuVCLv.exe
  C:\Windows\System\AAuVCLv.exe
  2⤵
  PID:6588
- C:\Windows\System\lCpTDZY.exe
  C:\Windows\System\lCpTDZY.exe
  2⤵
  PID:6608
- C:\Windows\System\jIEdiCo.exe
  C:\Windows\System\jIEdiCo.exe
  2⤵
  PID:6624
- C:\Windows\System\zFEiVEA.exe
  C:\Windows\System\zFEiVEA.exe
  2⤵
  PID:6640
- C:\Windows\System\kBWbOsv.exe
  C:\Windows\System\kBWbOsv.exe
  2⤵
  PID:6656
- C:\Windows\System\EHGKsth.exe
  C:\Windows\System\EHGKsth.exe
  2⤵
  PID:6672
- C:\Windows\System\FfKcDrE.exe
  C:\Windows\System\FfKcDrE.exe
  2⤵
  PID:6688
- C:\Windows\System\GfoCTFV.exe
  C:\Windows\System\GfoCTFV.exe
  2⤵
  PID:6704
- C:\Windows\System\oFKGCdy.exe
  C:\Windows\System\oFKGCdy.exe
  2⤵
  PID:6720
- C:\Windows\System\JRHTOvV.exe
  C:\Windows\System\JRHTOvV.exe
  2⤵
  PID:6740
- C:\Windows\System\vbVgkEN.exe
  C:\Windows\System\vbVgkEN.exe
  2⤵
  PID:6756
- C:\Windows\System\dshllHc.exe
  C:\Windows\System\dshllHc.exe
  2⤵
  PID:6772
- C:\Windows\System\FDYJcxh.exe
  C:\Windows\System\FDYJcxh.exe
  2⤵
  PID:6788
- C:\Windows\System\tAfTmes.exe
  C:\Windows\System\tAfTmes.exe
  2⤵
  PID:6804
- C:\Windows\System\AEQJscC.exe
  C:\Windows\System\AEQJscC.exe
  2⤵
  PID:6820
- C:\Windows\System\BbgPxqC.exe
  C:\Windows\System\BbgPxqC.exe
  2⤵
  PID:6836
- C:\Windows\System\EajuuaT.exe
  C:\Windows\System\EajuuaT.exe
  2⤵
  PID:6852
- C:\Windows\System\fSzcnSU.exe
  C:\Windows\System\fSzcnSU.exe
  2⤵
  PID:6868
- C:\Windows\System\vnlnpzB.exe
  C:\Windows\System\vnlnpzB.exe
  2⤵
  PID:6884
- C:\Windows\System\eXohgSA.exe
  C:\Windows\System\eXohgSA.exe
  2⤵
  PID:6900
- C:\Windows\System\bpGFdYM.exe
  C:\Windows\System\bpGFdYM.exe
  2⤵
  PID:6916
- C:\Windows\System\EvuIEZp.exe
  C:\Windows\System\EvuIEZp.exe
  2⤵
  PID:6932
- C:\Windows\System\xIyacEK.exe
  C:\Windows\System\xIyacEK.exe
  2⤵
  PID:6948
- C:\Windows\System\GiNuWVW.exe
  C:\Windows\System\GiNuWVW.exe
  2⤵
  PID:6964
- C:\Windows\System\QHPFRiG.exe
  C:\Windows\System\QHPFRiG.exe
  2⤵
  PID:6980
- C:\Windows\System\ZiKLNVO.exe
  C:\Windows\System\ZiKLNVO.exe
  2⤵
  PID:6996
- C:\Windows\System\MTUWNSc.exe
  C:\Windows\System\MTUWNSc.exe
  2⤵
  PID:7012
- C:\Windows\System\slYJYdH.exe
  C:\Windows\System\slYJYdH.exe
  2⤵
  PID:7028
- C:\Windows\System\WaZMfwf.exe
  C:\Windows\System\WaZMfwf.exe
  2⤵
  PID:7044
- C:\Windows\System\hhLmpJq.exe
  C:\Windows\System\hhLmpJq.exe
  2⤵
  PID:7060
- C:\Windows\System\FrmyhDi.exe
  C:\Windows\System\FrmyhDi.exe
  2⤵
  PID:7076
- C:\Windows\System\nwKPKEl.exe
  C:\Windows\System\nwKPKEl.exe
  2⤵
  PID:7092
- C:\Windows\System\ZWaIcJt.exe
  C:\Windows\System\ZWaIcJt.exe
  2⤵
  PID:7108
- C:\Windows\System\mKYtIlG.exe
  C:\Windows\System\mKYtIlG.exe
  2⤵
  PID:7124
- C:\Windows\System\MZyUYxi.exe
  C:\Windows\System\MZyUYxi.exe
  2⤵
  PID:7140
- C:\Windows\System\gtstqry.exe
  C:\Windows\System\gtstqry.exe
  2⤵
  PID:7164
- C:\Windows\System\bUBQHKM.exe
  C:\Windows\System\bUBQHKM.exe
  2⤵
  PID:5536
- C:\Windows\System\tsmeEHN.exe
  C:\Windows\System\tsmeEHN.exe
  2⤵
  PID:5412
- C:\Windows\System\FPZNPBJ.exe
  C:\Windows\System\FPZNPBJ.exe
  2⤵
  PID:5316
- C:\Windows\System\bmsYYoz.exe
  C:\Windows\System\bmsYYoz.exe
  2⤵
  PID:5180
- C:\Windows\System\esAvbMu.exe
  C:\Windows\System\esAvbMu.exe
  2⤵
  PID:6212
- C:\Windows\System\BgLGBOs.exe
  C:\Windows\System\BgLGBOs.exe
  2⤵
  PID:5600
- C:\Windows\System\yBramyN.exe
  C:\Windows\System\yBramyN.exe
  2⤵
  PID:6120
- C:\Windows\System\XfVCFyZ.exe
  C:\Windows\System\XfVCFyZ.exe
  2⤵
  PID:5952
- C:\Windows\System\SZJQobd.exe
  C:\Windows\System\SZJQobd.exe
  2⤵
  PID:5440
- C:\Windows\System\FaalKQm.exe
  C:\Windows\System\FaalKQm.exe
  2⤵
  PID:5596
- C:\Windows\System\RXkKQxA.exe
  C:\Windows\System\RXkKQxA.exe
  2⤵
  PID:6368
- C:\Windows\System\cVmjBve.exe
  C:\Windows\System\cVmjBve.exe
  2⤵
  PID:6400
- C:\Windows\System\xubrunQ.exe
  C:\Windows\System\xubrunQ.exe
  2⤵
  PID:6468
- C:\Windows\System\YTtupQh.exe
  C:\Windows\System\YTtupQh.exe
  2⤵
  PID:6580
- C:\Windows\System\aQjKTgj.exe
  C:\Windows\System\aQjKTgj.exe
  2⤵
  PID:6812
- C:\Windows\System\MnoUSmN.exe
  C:\Windows\System\MnoUSmN.exe
  2⤵
  PID:6848
- C:\Windows\System\ybrKKIR.exe
  C:\Windows\System\ybrKKIR.exe
  2⤵
  PID:6668
- C:\Windows\System\yqZNLiV.exe
  C:\Windows\System\yqZNLiV.exe
  2⤵
  PID:6696
- C:\Windows\System\XVzCIPB.exe
  C:\Windows\System\XVzCIPB.exe
  2⤵
  PID:6896
- C:\Windows\System\YbNgmkD.exe
  C:\Windows\System\YbNgmkD.exe
  2⤵
  PID:6832
- C:\Windows\System\dVcIjpE.exe
  C:\Windows\System\dVcIjpE.exe
  2⤵
  PID:6908
- C:\Windows\System\SmzTqii.exe
  C:\Windows\System\SmzTqii.exe
  2⤵
  PID:6912
- C:\Windows\System\qSInXym.exe
  C:\Windows\System\qSInXym.exe
  2⤵
  PID:6976
- C:\Windows\System\CbgsyqB.exe
  C:\Windows\System\CbgsyqB.exe
  2⤵
  PID:7072
- C:\Windows\System\zQoBArF.exe
  C:\Windows\System\zQoBArF.exe
  2⤵
  PID:7056
- C:\Windows\System\OjdFwLa.exe
  C:\Windows\System\OjdFwLa.exe
  2⤵
  PID:5800
- C:\Windows\System\QkAtJal.exe
  C:\Windows\System\QkAtJal.exe
  2⤵
  PID:5776
- C:\Windows\System\StVQHhz.exe
  C:\Windows\System\StVQHhz.exe
  2⤵
  PID:5244
- C:\Windows\System\cCQxzuM.exe
  C:\Windows\System\cCQxzuM.exe
  2⤵
  PID:6208
- C:\Windows\System\pUdjZwA.exe
  C:\Windows\System\pUdjZwA.exe
  2⤵
  PID:5920
- C:\Windows\System\kHXRpmI.exe
  C:\Windows\System\kHXRpmI.exe
  2⤵
  PID:6288
- C:\Windows\System\bWSQWYg.exe
  C:\Windows\System\bWSQWYg.exe
  2⤵
  PID:6248
- C:\Windows\System\qJgSqyb.exe
  C:\Windows\System\qJgSqyb.exe
  2⤵
  PID:6284
- C:\Windows\System\QuHdaef.exe
  C:\Windows\System\QuHdaef.exe
  2⤵
  PID:6276
- C:\Windows\System\kckBOYN.exe
  C:\Windows\System\kckBOYN.exe
  2⤵
  PID:6064
- C:\Windows\System\EvhIUOI.exe
  C:\Windows\System\EvhIUOI.exe
  2⤵
  PID:5520
- C:\Windows\System\LFWyjjn.exe
  C:\Windows\System\LFWyjjn.exe
  2⤵
  PID:5212
- C:\Windows\System\KsBBbkL.exe
  C:\Windows\System\KsBBbkL.exe
  2⤵
  PID:5328
- C:\Windows\System\QPUdcOw.exe
  C:\Windows\System\QPUdcOw.exe
  2⤵
  PID:6048
- C:\Windows\System\QkmgBeL.exe
  C:\Windows\System\QkmgBeL.exe
  2⤵
  PID:6036
- C:\Windows\System\AJPEvUF.exe
  C:\Windows\System\AJPEvUF.exe
  2⤵
  PID:6480
- C:\Windows\System\nwOQDaQ.exe
  C:\Windows\System\nwOQDaQ.exe
  2⤵
  PID:6452
- C:\Windows\System\tpLKXdX.exe
  C:\Windows\System\tpLKXdX.exe
  2⤵
  PID:6584
- C:\Windows\System\RfFpVcn.exe
  C:\Windows\System\RfFpVcn.exe
  2⤵
  PID:6148
- C:\Windows\System\PngTcZV.exe
  C:\Windows\System\PngTcZV.exe
  2⤵
  PID:6164
- C:\Windows\System\QVUIBug.exe
  C:\Windows\System\QVUIBug.exe
  2⤵
  PID:6356
- C:\Windows\System\Wmjnhka.exe
  C:\Windows\System\Wmjnhka.exe
  2⤵
  PID:5272
- C:\Windows\System\FqTUllh.exe
  C:\Windows\System\FqTUllh.exe
  2⤵
  PID:6532
- C:\Windows\System\asxdgIT.exe
  C:\Windows\System\asxdgIT.exe
  2⤵
  PID:6616
- C:\Windows\System\ZVBPWic.exe
  C:\Windows\System\ZVBPWic.exe
  2⤵
  PID:6636
- C:\Windows\System\fYPUZwd.exe
  C:\Windows\System\fYPUZwd.exe
  2⤵
  PID:6712
- C:\Windows\System\ulRKavZ.exe
  C:\Windows\System\ulRKavZ.exe
  2⤵
  PID:6736
- C:\Windows\System\jvGncZK.exe
  C:\Windows\System\jvGncZK.exe
  2⤵
  PID:7040
- C:\Windows\System\eNYFQOz.exe
  C:\Windows\System\eNYFQOz.exe
  2⤵
  PID:6800
- C:\Windows\System\ejpmdEv.exe
  C:\Windows\System\ejpmdEv.exe
  2⤵
  PID:6892
- C:\Windows\System\pkJyObB.exe
  C:\Windows\System\pkJyObB.exe
  2⤵
  PID:6748
- C:\Windows\System\jzGCGTI.exe
  C:\Windows\System\jzGCGTI.exe
  2⤵
  PID:6880
- C:\Windows\System\HEDRNTZ.exe
  C:\Windows\System\HEDRNTZ.exe
  2⤵
  PID:5848
- C:\Windows\System\RJThcuY.exe
  C:\Windows\System\RJThcuY.exe
  2⤵
  PID:5784
- C:\Windows\System\WIBwDDX.exe
  C:\Windows\System\WIBwDDX.exe
  2⤵
  PID:6300
- C:\Windows\System\VMgWGOs.exe
  C:\Windows\System\VMgWGOs.exe
  2⤵
  PID:6596
- C:\Windows\System\qLcazNv.exe
  C:\Windows\System\qLcazNv.exe
  2⤵
  PID:5564
- C:\Windows\System\EmBOHYj.exe
  C:\Windows\System\EmBOHYj.exe
  2⤵
  PID:6652
- C:\Windows\System\PgoQqWS.exe
  C:\Windows\System\PgoQqWS.exe
  2⤵
  PID:6928
- C:\Windows\System\gATorTA.exe
  C:\Windows\System\gATorTA.exe
  2⤵
  PID:5828
- C:\Windows\System\SfwwMGp.exe
  C:\Windows\System\SfwwMGp.exe
  2⤵
  PID:5312
- C:\Windows\System\cgsLbTY.exe
  C:\Windows\System\cgsLbTY.exe
  2⤵
  PID:6548
- C:\Windows\System\OejluEx.exe
  C:\Windows\System\OejluEx.exe
  2⤵
  PID:6860
- C:\Windows\System\PWeLwJy.exe
  C:\Windows\System\PWeLwJy.exe
  2⤵
  PID:5980
- C:\Windows\System\wVAJBeS.exe
  C:\Windows\System\wVAJBeS.exe
  2⤵
  PID:7008
- C:\Windows\System\MSLfgyv.exe
  C:\Windows\System\MSLfgyv.exe
  2⤵
  PID:6956
- C:\Windows\System\afqvqRq.exe
  C:\Windows\System\afqvqRq.exe
  2⤵
  PID:6816
- C:\Windows\System\qbKmwsc.exe
  C:\Windows\System\qbKmwsc.exe
  2⤵
  PID:7176
- C:\Windows\System\CNtfYvK.exe
  C:\Windows\System\CNtfYvK.exe
  2⤵
  PID:7192
- C:\Windows\System\lJNoWQF.exe
  C:\Windows\System\lJNoWQF.exe
  2⤵
  PID:7208
- C:\Windows\System\osmBxZY.exe
  C:\Windows\System\osmBxZY.exe
  2⤵
  PID:7228
- C:\Windows\System\ArVfNjw.exe
  C:\Windows\System\ArVfNjw.exe
  2⤵
  PID:7244
- C:\Windows\System\hufgkhS.exe
  C:\Windows\System\hufgkhS.exe
  2⤵
  PID:7268
- C:\Windows\System\MacbvwJ.exe
  C:\Windows\System\MacbvwJ.exe
  2⤵
  PID:7288
- C:\Windows\System\kkWMCnK.exe
  C:\Windows\System\kkWMCnK.exe
  2⤵
  PID:7304
- C:\Windows\System\fhJfNQN.exe
  C:\Windows\System\fhJfNQN.exe
  2⤵
  PID:7324
- C:\Windows\System\ddaOrNi.exe
  C:\Windows\System\ddaOrNi.exe
  2⤵
  PID:7340
- C:\Windows\System\lExPikh.exe
  C:\Windows\System\lExPikh.exe
  2⤵
  PID:7356
- C:\Windows\System\FPqcAnZ.exe
  C:\Windows\System\FPqcAnZ.exe
  2⤵
  PID:7372
- C:\Windows\System\GDqPhSs.exe
  C:\Windows\System\GDqPhSs.exe
  2⤵
  PID:7388
- C:\Windows\System\FjpRUia.exe
  C:\Windows\System\FjpRUia.exe
  2⤵
  PID:7404
- C:\Windows\System\BKOKZRj.exe
  C:\Windows\System\BKOKZRj.exe
  2⤵
  PID:7452
- C:\Windows\System\AhxwQVn.exe
  C:\Windows\System\AhxwQVn.exe
  2⤵
  PID:7468
- C:\Windows\System\lSLuBnM.exe
  C:\Windows\System\lSLuBnM.exe
  2⤵
  PID:7484
- C:\Windows\System\AZVKMpJ.exe
  C:\Windows\System\AZVKMpJ.exe
  2⤵
  PID:7500
- C:\Windows\System\mIXgncD.exe
  C:\Windows\System\mIXgncD.exe
  2⤵
  PID:7516
- C:\Windows\System\xxEascq.exe
  C:\Windows\System\xxEascq.exe
  2⤵
  PID:7532
- C:\Windows\System\sHjtFIw.exe
  C:\Windows\System\sHjtFIw.exe
  2⤵
  PID:7556
- C:\Windows\System\FFKHaUz.exe
  C:\Windows\System\FFKHaUz.exe
  2⤵
  PID:7644
- C:\Windows\System\PfejsJd.exe
  C:\Windows\System\PfejsJd.exe
  2⤵
  PID:7832
- C:\Windows\System\wXkMlBH.exe
  C:\Windows\System\wXkMlBH.exe
  2⤵
  PID:7848
- C:\Windows\System\yzqLmPE.exe
  C:\Windows\System\yzqLmPE.exe
  2⤵
  PID:7868
- C:\Windows\System\SWgTUfK.exe
  C:\Windows\System\SWgTUfK.exe
  2⤵
  PID:7884
- C:\Windows\System\rgftXKC.exe
  C:\Windows\System\rgftXKC.exe
  2⤵
  PID:7900
- C:\Windows\System\QESQgwB.exe
  C:\Windows\System\QESQgwB.exe
  2⤵
  PID:7916
- C:\Windows\System\jBCaKaD.exe
  C:\Windows\System\jBCaKaD.exe
  2⤵
  PID:7932
- C:\Windows\System\zDlVaic.exe
  C:\Windows\System\zDlVaic.exe
  2⤵
  PID:7948
- C:\Windows\System\mJqdoPX.exe
  C:\Windows\System\mJqdoPX.exe
  2⤵
  PID:7964
- C:\Windows\System\uAdsTTC.exe
  C:\Windows\System\uAdsTTC.exe
  2⤵
  PID:8032
- C:\Windows\System\JYiOFmO.exe
  C:\Windows\System\JYiOFmO.exe
  2⤵
  PID:8048
- C:\Windows\System\fqFkEAE.exe
  C:\Windows\System\fqFkEAE.exe
  2⤵
  PID:8064
- C:\Windows\System\bpvccDw.exe
  C:\Windows\System\bpvccDw.exe
  2⤵
  PID:8080
- C:\Windows\System\IBodByh.exe
  C:\Windows\System\IBodByh.exe
  2⤵
  PID:8096
- C:\Windows\System\enKCYuz.exe
  C:\Windows\System\enKCYuz.exe
  2⤵
  PID:8116
- C:\Windows\System\WnaclkL.exe
  C:\Windows\System\WnaclkL.exe
  2⤵
  PID:8132
- C:\Windows\System\sLstNwI.exe
  C:\Windows\System\sLstNwI.exe
  2⤵
  PID:8148
- C:\Windows\System\vlQBQdR.exe
  C:\Windows\System\vlQBQdR.exe
  2⤵
  PID:8168
- C:\Windows\System\aEXIjUn.exe
  C:\Windows\System\aEXIjUn.exe
  2⤵
  PID:8184
- C:\Windows\System\pgDnUyb.exe
  C:\Windows\System\pgDnUyb.exe
  2⤵
  PID:7188
- C:\Windows\System\NzdDvuH.exe
  C:\Windows\System\NzdDvuH.exe
  2⤵
  PID:7184
- C:\Windows\System\kJfVnEa.exe
  C:\Windows\System\kJfVnEa.exe
  2⤵
  PID:7252
- C:\Windows\System\aXbrWNR.exe
  C:\Windows\System\aXbrWNR.exe
  2⤵
  PID:7296
- C:\Windows\System\rIczhBP.exe
  C:\Windows\System\rIczhBP.exe
  2⤵
  PID:7368
- C:\Windows\System\aEZEFVH.exe
  C:\Windows\System\aEZEFVH.exe
  2⤵
  PID:6352
- C:\Windows\System\PymghDt.exe
  C:\Windows\System\PymghDt.exe
  2⤵
  PID:7436
- C:\Windows\System\RVSqEVN.exe
  C:\Windows\System\RVSqEVN.exe
  2⤵
  PID:7024
- C:\Windows\System\oEGbVJo.exe
  C:\Windows\System\oEGbVJo.exe
  2⤵
  PID:7084
- C:\Windows\System\lvpwKjt.exe
  C:\Windows\System\lvpwKjt.exe
  2⤵
  PID:7156
- C:\Windows\System\vefogeT.exe
  C:\Windows\System\vefogeT.exe
  2⤵
  PID:7240
- C:\Windows\System\xJERyAl.exe
  C:\Windows\System\xJERyAl.exe
  2⤵
  PID:6032
- C:\Windows\System\HEGgZKs.exe
  C:\Windows\System\HEGgZKs.exe
  2⤵
  PID:7440
- C:\Windows\System\aiyivUo.exe
  C:\Windows\System\aiyivUo.exe
  2⤵
  PID:6280
- C:\Windows\System\KzJTgaR.exe
  C:\Windows\System\KzJTgaR.exe
  2⤵
  PID:7320
- C:\Windows\System\LUwmvQS.exe
  C:\Windows\System\LUwmvQS.exe
  2⤵
  PID:7352
- C:\Windows\System\hoqqAIL.exe
  C:\Windows\System\hoqqAIL.exe
  2⤵
  PID:7420
- C:\Windows\System\XkLvtmO.exe
  C:\Windows\System\XkLvtmO.exe
  2⤵
  PID:7416
- C:\Windows\System\zQewtHk.exe
  C:\Windows\System\zQewtHk.exe
  2⤵
  PID:7476
- C:\Windows\System\lDJPuTS.exe
  C:\Windows\System\lDJPuTS.exe
  2⤵
  PID:7568
- C:\Windows\System\MiLJiPe.exe
  C:\Windows\System\MiLJiPe.exe
  2⤵
  PID:7552
- C:\Windows\System\LNHGalB.exe
  C:\Windows\System\LNHGalB.exe
  2⤵
  PID:7608
- C:\Windows\System\gyRddnq.exe
  C:\Windows\System\gyRddnq.exe
  2⤵
  PID:7588
- C:\Windows\System\kfqHpnL.exe
  C:\Windows\System\kfqHpnL.exe
  2⤵
  PID:7844
- C:\Windows\System\xKeAZZz.exe
  C:\Windows\System\xKeAZZz.exe
  2⤵
  PID:7940
- C:\Windows\System\ZrsPKlt.exe
  C:\Windows\System\ZrsPKlt.exe
  2⤵
  PID:7996
- C:\Windows\System\GlNHpHX.exe
  C:\Windows\System\GlNHpHX.exe
  2⤵
  PID:7992
- C:\Windows\System\LjUgupr.exe
  C:\Windows\System\LjUgupr.exe
  2⤵
  PID:8020
- C:\Windows\System\LYtGVbX.exe
  C:\Windows\System\LYtGVbX.exe
  2⤵
  PID:8056
- C:\Windows\System\xGpKUss.exe
  C:\Windows\System\xGpKUss.exe
  2⤵
  PID:7656
- C:\Windows\System\FdVMRae.exe
  C:\Windows\System\FdVMRae.exe
  2⤵
  PID:7676
- C:\Windows\System\esvbNMy.exe
  C:\Windows\System\esvbNMy.exe
  2⤵
  PID:7696
- C:\Windows\System\BiBuHjQ.exe
  C:\Windows\System\BiBuHjQ.exe
  2⤵
  PID:7716
- C:\Windows\System\jfLEJaZ.exe
  C:\Windows\System\jfLEJaZ.exe
  2⤵
  PID:7740
- C:\Windows\System\kQHaeiQ.exe
  C:\Windows\System\kQHaeiQ.exe
  2⤵
  PID:7756
- C:\Windows\System\zstmyFn.exe
  C:\Windows\System\zstmyFn.exe
  2⤵
  PID:7772
- C:\Windows\System\sHTXUjm.exe
  C:\Windows\System\sHTXUjm.exe
  2⤵
  PID:7796
- C:\Windows\System\TkQcfsO.exe
  C:\Windows\System\TkQcfsO.exe
  2⤵
  PID:7812
- C:\Windows\System\tDMUVCJ.exe
  C:\Windows\System\tDMUVCJ.exe
  2⤵
  PID:7828
- C:\Windows\System\EVhixHo.exe
  C:\Windows\System\EVhixHo.exe
  2⤵
  PID:7892
- C:\Windows\System\YMjooOS.exe
  C:\Windows\System\YMjooOS.exe
  2⤵
  PID:7960
- C:\Windows\System\ofwUIfM.exe
  C:\Windows\System\ofwUIfM.exe
  2⤵
  PID:8076
- C:\Windows\System\FyCzhXm.exe
  C:\Windows\System\FyCzhXm.exe
  2⤵
  PID:8128
- C:\Windows\System\Ugzimzb.exe
  C:\Windows\System\Ugzimzb.exe
  2⤵
  PID:6716
- C:\Windows\System\qqgblKW.exe
  C:\Windows\System\qqgblKW.exe
  2⤵
  PID:7364
- C:\Windows\System\ctTVYAH.exe
  C:\Windows\System\ctTVYAH.exe
  2⤵
  PID:6828
- C:\Windows\System\QLsXOZm.exe
  C:\Windows\System\QLsXOZm.exe
  2⤵
  PID:6364
- C:\Windows\System\nveTOfy.exe
  C:\Windows\System\nveTOfy.exe
  2⤵
  PID:7264
- C:\Windows\System\nHPgSjO.exe
  C:\Windows\System\nHPgSjO.exe
  2⤵
  PID:6972
- C:\Windows\System\KcHTOOZ.exe
  C:\Windows\System\KcHTOOZ.exe
  2⤵
  PID:5904
- C:\Windows\System\bbSbdlu.exe
  C:\Windows\System\bbSbdlu.exe
  2⤵
  PID:5964
- C:\Windows\System\OgQTDIj.exe
  C:\Windows\System\OgQTDIj.exe
  2⤵
  PID:6604
- C:\Windows\System\FSCZLaZ.exe
  C:\Windows\System\FSCZLaZ.exe
  2⤵
  PID:5656
- C:\Windows\System\bcnPdkc.exe
  C:\Windows\System\bcnPdkc.exe
  2⤵
  PID:5260
- C:\Windows\System\kroQnhD.exe
  C:\Windows\System\kroQnhD.exe
  2⤵
  PID:5132
- C:\Windows\System\csYukkg.exe
  C:\Windows\System\csYukkg.exe
  2⤵
  PID:7284
- C:\Windows\System\RySDOHe.exe
  C:\Windows\System\RySDOHe.exe
  2⤵
  PID:7572
- C:\Windows\System\FEIHnPb.exe
  C:\Windows\System\FEIHnPb.exe
  2⤵
  PID:5660
- C:\Windows\System\NkjoNsp.exe
  C:\Windows\System\NkjoNsp.exe
  2⤵
  PID:6240
- C:\Windows\System\hDGpDsH.exe
  C:\Windows\System\hDGpDsH.exe
  2⤵
  PID:7564
- C:\Windows\System\nlJYzHR.exe
  C:\Windows\System\nlJYzHR.exe
  2⤵
  PID:7624
- C:\Windows\System\HxwqCIg.exe
  C:\Windows\System\HxwqCIg.exe
  2⤵
  PID:7628
- C:\Windows\System\mbuamjU.exe
  C:\Windows\System\mbuamjU.exe
  2⤵
  PID:7620
- C:\Windows\System\YeBdaTk.exe
  C:\Windows\System\YeBdaTk.exe
  2⤵
  PID:7908
- C:\Windows\System\ntYzOXj.exe
  C:\Windows\System\ntYzOXj.exe
  2⤵
  PID:8000
- C:\Windows\System\LlYeUZU.exe
  C:\Windows\System\LlYeUZU.exe
  2⤵
  PID:8092
- C:\Windows\System\gEFmTxP.exe
  C:\Windows\System\gEFmTxP.exe
  2⤵
  PID:7764
- C:\Windows\System\putiSqQ.exe
  C:\Windows\System\putiSqQ.exe
  2⤵
  PID:7704
- C:\Windows\System\ROmqJVq.exe
  C:\Windows\System\ROmqJVq.exe
  2⤵
  PID:7788
- C:\Windows\System\kLbJNSI.exe
  C:\Windows\System\kLbJNSI.exe
  2⤵
  PID:7792
- C:\Windows\System\gMtGXZQ.exe
  C:\Windows\System\gMtGXZQ.exe
  2⤵
  PID:7664
- C:\Windows\System\OxGxDGI.exe
  C:\Windows\System\OxGxDGI.exe
  2⤵
  PID:8040
- C:\Windows\System\XmQfmSV.exe
  C:\Windows\System\XmQfmSV.exe
  2⤵
  PID:6448
- C:\Windows\System\tpcoFpO.exe
  C:\Windows\System\tpcoFpO.exe
  2⤵
  PID:8072
- C:\Windows\System\beAvZNP.exe
  C:\Windows\System\beAvZNP.exe
  2⤵
  PID:7336
- C:\Windows\System\pSJYIwl.exe
  C:\Windows\System\pSJYIwl.exe
  2⤵
  PID:8176
- C:\Windows\System\fNIXtpQ.exe
  C:\Windows\System\fNIXtpQ.exe
  2⤵
  PID:7204
- C:\Windows\System\OaTUqDH.exe
  C:\Windows\System\OaTUqDH.exe
  2⤵
  PID:7088
- C:\Windows\System\chDQMVf.exe
  C:\Windows\System\chDQMVf.exe
  2⤵
  PID:7312
- C:\Windows\System\QronLYE.exe
  C:\Windows\System\QronLYE.exe
  2⤵
  PID:7492
- C:\Windows\System\DXPmFie.exe
  C:\Windows\System\DXPmFie.exe
  2⤵
  PID:7424
- C:\Windows\System\ScsSpPH.exe
  C:\Windows\System\ScsSpPH.exe
  2⤵
  PID:7412
- C:\Windows\System\roHWDaE.exe
  C:\Windows\System\roHWDaE.exe
  2⤵
  PID:5752
- C:\Windows\System\yEtkOLV.exe
  C:\Windows\System\yEtkOLV.exe
  2⤵
  PID:7752
- C:\Windows\System\vGKtaeO.exe
  C:\Windows\System\vGKtaeO.exe
  2⤵
  PID:7976
- C:\Windows\System\NJxEMPV.exe
  C:\Windows\System\NJxEMPV.exe
  2⤵
  PID:8108
- C:\Windows\System\TdJgqud.exe
  C:\Windows\System\TdJgqud.exe
  2⤵
  PID:7972
- C:\Windows\System\sgOLVDI.exe
  C:\Windows\System\sgOLVDI.exe
  2⤵
  PID:7688
- C:\Windows\System\PdDMakh.exe
  C:\Windows\System\PdDMakh.exe
  2⤵
  PID:8012
- C:\Windows\System\tgzmBEE.exe
  C:\Windows\System\tgzmBEE.exe
  2⤵
  PID:8160
- C:\Windows\System\uPTnBNf.exe
  C:\Windows\System\uPTnBNf.exe
  2⤵
  PID:7912
- C:\Windows\System\SPEhSgq.exe
  C:\Windows\System\SPEhSgq.exe
  2⤵
  PID:6600
- C:\Windows\System\cNBtcoK.exe
  C:\Windows\System\cNBtcoK.exe
  2⤵
  PID:7316
- C:\Windows\System\XnllQgA.exe
  C:\Windows\System\XnllQgA.exe
  2⤵
  PID:6436
- C:\Windows\System\mVqihnE.exe
  C:\Windows\System\mVqihnE.exe
  2⤵
  PID:8196
- C:\Windows\System\EZwyQzv.exe
  C:\Windows\System\EZwyQzv.exe
  2⤵
  PID:8212
- C:\Windows\System\wcctHlj.exe
  C:\Windows\System\wcctHlj.exe
  2⤵
  PID:8228
- C:\Windows\System\RGDmTLo.exe
  C:\Windows\System\RGDmTLo.exe
  2⤵
  PID:8244
- C:\Windows\System\yLCCdFg.exe
  C:\Windows\System\yLCCdFg.exe
  2⤵
  PID:8260
- C:\Windows\System\RByHlRZ.exe
  C:\Windows\System\RByHlRZ.exe
  2⤵
  PID:8408
- C:\Windows\System\AsLnHqV.exe
  C:\Windows\System\AsLnHqV.exe
  2⤵
  PID:8424
- C:\Windows\System\WwsgmKC.exe
  C:\Windows\System\WwsgmKC.exe
  2⤵
  PID:8440
- C:\Windows\System\bZrEHNK.exe
  C:\Windows\System\bZrEHNK.exe
  2⤵
  PID:8456
- C:\Windows\System\mqOEKiZ.exe
  C:\Windows\System\mqOEKiZ.exe
  2⤵
  PID:8472
- C:\Windows\System\OpdyhXz.exe
  C:\Windows\System\OpdyhXz.exe
  2⤵
  PID:8488
- C:\Windows\System\mvWcukr.exe
  C:\Windows\System\mvWcukr.exe
  2⤵
  PID:8504
- C:\Windows\System\skzLfBH.exe
  C:\Windows\System\skzLfBH.exe
  2⤵
  PID:8520
- C:\Windows\System\gJQnNXV.exe
  C:\Windows\System\gJQnNXV.exe
  2⤵
  PID:8536
- C:\Windows\System\KeHECyb.exe
  C:\Windows\System\KeHECyb.exe
  2⤵
  PID:8552
- C:\Windows\System\XxAFrbu.exe
  C:\Windows\System\XxAFrbu.exe
  2⤵
  PID:8568
- C:\Windows\System\JjkkFWX.exe
  C:\Windows\System\JjkkFWX.exe
  2⤵
  PID:8584
- C:\Windows\System\wcWZvjZ.exe
  C:\Windows\System\wcWZvjZ.exe
  2⤵
  PID:8600
- C:\Windows\System\drFEYWf.exe
  C:\Windows\System\drFEYWf.exe
  2⤵
  PID:8616
- C:\Windows\System\CzwdPEP.exe
  C:\Windows\System\CzwdPEP.exe
  2⤵
  PID:8648
- C:\Windows\System\scVMpdV.exe
  C:\Windows\System\scVMpdV.exe
  2⤵
  PID:8684
- C:\Windows\System\pDiAnfm.exe
  C:\Windows\System\pDiAnfm.exe
  2⤵
  PID:8700
- C:\Windows\System\akUxyss.exe
  C:\Windows\System\akUxyss.exe
  2⤵
  PID:8716
- C:\Windows\System\WanUFUv.exe
  C:\Windows\System\WanUFUv.exe
  2⤵
  PID:8736
- C:\Windows\System\XJJBtJs.exe
  C:\Windows\System\XJJBtJs.exe
  2⤵
  PID:8776
- C:\Windows\System\dHlJOFo.exe
  C:\Windows\System\dHlJOFo.exe
  2⤵
  PID:8820
- C:\Windows\System\yDTIXQI.exe
  C:\Windows\System\yDTIXQI.exe
  2⤵
  PID:8888
- C:\Windows\System\PjyWQJO.exe
  C:\Windows\System\PjyWQJO.exe
  2⤵
  PID:8908
- C:\Windows\System\xZodSpp.exe
  C:\Windows\System\xZodSpp.exe
  2⤵
  PID:8924
- C:\Windows\System\IzWcjYj.exe
  C:\Windows\System\IzWcjYj.exe
  2⤵
  PID:8940
- C:\Windows\System\hChOQMi.exe
  C:\Windows\System\hChOQMi.exe
  2⤵
  PID:8956
- C:\Windows\System\tFHezUQ.exe
  C:\Windows\System\tFHezUQ.exe
  2⤵
  PID:8976
- C:\Windows\System\ZthHGiC.exe
  C:\Windows\System\ZthHGiC.exe
  2⤵
  PID:8996
- C:\Windows\System\lKZdeSr.exe
  C:\Windows\System\lKZdeSr.exe
  2⤵
  PID:9012
- C:\Windows\System\uwkxgWd.exe
  C:\Windows\System\uwkxgWd.exe
  2⤵
  PID:9028
- C:\Windows\System\JQYHfqs.exe
  C:\Windows\System\JQYHfqs.exe
  2⤵
  PID:9044
- C:\Windows\System\GnqKkme.exe
  C:\Windows\System\GnqKkme.exe
  2⤵
  PID:9060
- C:\Windows\System\lRErAqF.exe
  C:\Windows\System\lRErAqF.exe
  2⤵
  PID:9076
- C:\Windows\System\WkkSebd.exe
  C:\Windows\System\WkkSebd.exe
  2⤵
  PID:9096
- C:\Windows\System\EfdtZyP.exe
  C:\Windows\System\EfdtZyP.exe
  2⤵
  PID:9112
- C:\Windows\System\iqhtSkn.exe
  C:\Windows\System\iqhtSkn.exe
  2⤵
  PID:9128
- C:\Windows\System\sLgvWQz.exe
  C:\Windows\System\sLgvWQz.exe
  2⤵
  PID:9148
- C:\Windows\System\gqSFKbr.exe
  C:\Windows\System\gqSFKbr.exe
  2⤵
  PID:9164
- C:\Windows\System\JuVQTVh.exe
  C:\Windows\System\JuVQTVh.exe
  2⤵
  PID:9180
- C:\Windows\System\ZXJUyLZ.exe
  C:\Windows\System\ZXJUyLZ.exe
  2⤵
  PID:9196
- C:\Windows\System\iuKsgRx.exe
  C:\Windows\System\iuKsgRx.exe
  2⤵
  PID:9212
- C:\Windows\System\gVYfvRb.exe
  C:\Windows\System\gVYfvRb.exe
  2⤵
  PID:852
- C:\Windows\System\wlYiWNX.exe
  C:\Windows\System\wlYiWNX.exe
  2⤵
  PID:6416
- C:\Windows\System\nvrAaMQ.exe
  C:\Windows\System\nvrAaMQ.exe
  2⤵
  PID:8224
- C:\Windows\System\fzMzsgk.exe
  C:\Windows\System\fzMzsgk.exe
  2⤵
  PID:844
- C:\Windows\System\WjeJFQm.exe
  C:\Windows\System\WjeJFQm.exe
  2⤵
  PID:8452
- C:\Windows\System\ZHNDEZD.exe
  C:\Windows\System\ZHNDEZD.exe
  2⤵
  PID:2300
- C:\Windows\System\dJArqwp.exe
  C:\Windows\System\dJArqwp.exe
  2⤵
  PID:8448
- C:\Windows\System\QlrqxBU.exe
  C:\Windows\System\QlrqxBU.exe
  2⤵
  PID:1584
- C:\Windows\System\zaTSMjK.exe
  C:\Windows\System\zaTSMjK.exe
  2⤵
  PID:1064
- C:\Windows\System\tbfMHSK.exe
  C:\Windows\System\tbfMHSK.exe
  2⤵
  PID:1304
- C:\Windows\System\FvifZfM.exe
  C:\Windows\System\FvifZfM.exe
  2⤵
  PID:1708
- C:\Windows\System\SbUVOSC.exe
  C:\Windows\System\SbUVOSC.exe
  2⤵
  PID:2004
- C:\Windows\System\mFzaAJA.exe
  C:\Windows\System\mFzaAJA.exe
  2⤵
  PID:1496
- C:\Windows\System\hRABJFq.exe
  C:\Windows\System\hRABJFq.exe
  2⤵
  PID:2392
- C:\Windows\System\pOkeaKc.exe
  C:\Windows\System\pOkeaKc.exe
  2⤵
  PID:8512
- C:\Windows\System\SWRXXxz.exe
  C:\Windows\System\SWRXXxz.exe
  2⤵
  PID:7748
- C:\Windows\System\KqCJmml.exe
  C:\Windows\System\KqCJmml.exe
  2⤵
  PID:8612
- C:\Windows\System\kOgeJsx.exe
  C:\Windows\System\kOgeJsx.exe
  2⤵
  PID:7224
- C:\Windows\System\ngHDIdS.exe
  C:\Windows\System\ngHDIdS.exe
  2⤵
  PID:7840
- C:\Windows\System\EzIzviK.exe
  C:\Windows\System\EzIzviK.exe
  2⤵
  PID:7428
- C:\Windows\System\dzxuMiT.exe
  C:\Windows\System\dzxuMiT.exe
  2⤵
  PID:8280
- C:\Windows\System\UMYFbVR.exe
  C:\Windows\System\UMYFbVR.exe
  2⤵
  PID:8164
- C:\Windows\System\pAkZQzC.exe
  C:\Windows\System\pAkZQzC.exe
  2⤵
  PID:8300
- C:\Windows\System\mSbnSIa.exe
  C:\Windows\System\mSbnSIa.exe
  2⤵
  PID:8312
- C:\Windows\System\LAUDbnO.exe
  C:\Windows\System\LAUDbnO.exe
  2⤵
  PID:8384
- C:\Windows\System\PZbPUAb.exe
  C:\Windows\System\PZbPUAb.exe
  2⤵
  PID:8324
- C:\Windows\System\ZqDyAJq.exe
  C:\Windows\System\ZqDyAJq.exe
  2⤵
  PID:8340
- C:\Windows\System\hAStTKH.exe
  C:\Windows\System\hAStTKH.exe
  2⤵
  PID:8364
- C:\Windows\System\esyeWwV.exe
  C:\Windows\System\esyeWwV.exe
  2⤵
  PID:8396
- C:\Windows\System\JSBBTbC.exe
  C:\Windows\System\JSBBTbC.exe
  2⤵
  PID:8320
- C:\Windows\System\ZQfRYLV.exe
  C:\Windows\System\ZQfRYLV.exe
  2⤵
  PID:8500
- C:\Windows\System\FVXRuFK.exe
  C:\Windows\System\FVXRuFK.exe
  2⤵
  PID:8592
- C:\Windows\System\fefWJbM.exe
  C:\Windows\System\fefWJbM.exe
  2⤵
  PID:8636
- C:\Windows\System\FunHHpa.exe
  C:\Windows\System\FunHHpa.exe
  2⤵
  PID:8628
- C:\Windows\System\qTahuQA.exe
  C:\Windows\System\qTahuQA.exe
  2⤵
  PID:8640
- C:\Windows\System\qDlSPrp.exe
  C:\Windows\System\qDlSPrp.exe
  2⤵
  PID:8800
- C:\Windows\System\GcfuLCi.exe
  C:\Windows\System\GcfuLCi.exe
  2⤵
  PID:8784
- C:\Windows\System\tWDYDPV.exe
  C:\Windows\System\tWDYDPV.exe
  2⤵
  PID:8904
- C:\Windows\System\GGrEayR.exe
  C:\Windows\System\GGrEayR.exe
  2⤵
  PID:8772
- C:\Windows\System\ZyGmZPD.exe
  C:\Windows\System\ZyGmZPD.exe
  2⤵
  PID:9040
- C:\Windows\System\cajqjLb.exe
  C:\Windows\System\cajqjLb.exe
  2⤵
  PID:9104
- C:\Windows\System\XIeQFce.exe
  C:\Windows\System\XIeQFce.exe
  2⤵
  PID:9140
- C:\Windows\System\KDGSWTA.exe
  C:\Windows\System\KDGSWTA.exe
  2⤵
  PID:2768
- C:\Windows\System\wuFHBiw.exe
  C:\Windows\System\wuFHBiw.exe
  2⤵
  PID:1472
- C:\Windows\System\squjJWA.exe
  C:\Windows\System\squjJWA.exe
  2⤵
  PID:1348
- C:\Windows\System\GuFyrcE.exe
  C:\Windows\System\GuFyrcE.exe
  2⤵
  PID:2296
- C:\Windows\System\qnxlGan.exe
  C:\Windows\System\qnxlGan.exe
  2⤵
  PID:8984
- C:\Windows\System\neYpatO.exe
  C:\Windows\System\neYpatO.exe
  2⤵
  PID:9120
- C:\Windows\System\zfLUuDX.exe
  C:\Windows\System\zfLUuDX.exe
  2⤵
  PID:9160
- C:\Windows\System\BTegzrO.exe
  C:\Windows\System\BTegzrO.exe
  2⤵
  PID:1072
- C:\Windows\System\ULdCEvg.exe
  C:\Windows\System\ULdCEvg.exe
  2⤵
  PID:8856
- C:\Windows\System\orBUVNK.exe
  C:\Windows\System\orBUVNK.exe
  2⤵
  PID:8484
- C:\Windows\System\pxrmDJI.exe
  C:\Windows\System\pxrmDJI.exe
  2⤵
  PID:8920
- C:\Windows\System\AaOEgtz.exe
  C:\Windows\System\AaOEgtz.exe
  2⤵
  PID:7672
- C:\Windows\System\OleVpiu.exe
  C:\Windows\System\OleVpiu.exe
  2⤵
  PID:9056
- C:\Windows\System\BgQcsfO.exe
  C:\Windows\System\BgQcsfO.exe
  2⤵
  PID:7348
- C:\Windows\System\ACbSujm.exe
  C:\Windows\System\ACbSujm.exe
  2⤵
  PID:7444
- C:\Windows\System\TSCXmmG.exe
  C:\Windows\System\TSCXmmG.exe
  2⤵
  PID:720
- C:\Windows\System\wnmpExY.exe
  C:\Windows\System\wnmpExY.exe
  2⤵
  PID:8864
- C:\Windows\System\dCWfZMg.exe
  C:\Windows\System\dCWfZMg.exe
  2⤵
  PID:8480
- C:\Windows\System\HDCLfza.exe
  C:\Windows\System\HDCLfza.exe
  2⤵
  PID:8288
- C:\Windows\System\FmeGbbM.exe
  C:\Windows\System\FmeGbbM.exe
  2⤵
  PID:8368
- C:\Windows\System\EmkLkRA.exe
  C:\Windows\System\EmkLkRA.exe
  2⤵
  PID:8348
- C:\Windows\System\GWFoCgc.exe
  C:\Windows\System\GWFoCgc.exe
  2⤵
  PID:8376
- C:\Windows\System\JJhPfLx.exe
  C:\Windows\System\JJhPfLx.exe
  2⤵
  PID:8204
- C:\Windows\System\pZXmazc.exe
  C:\Windows\System\pZXmazc.exe
  2⤵
  PID:7604
- C:\Windows\System\ukHayOI.exe
  C:\Windows\System\ukHayOI.exe
  2⤵
  PID:8624
- C:\Windows\System\ApWZUMY.exe
  C:\Windows\System\ApWZUMY.exe
  2⤵
  PID:8332
- C:\Windows\System\sNOKRRT.exe
  C:\Windows\System\sNOKRRT.exe
  2⤵
  PID:8272
- C:\Windows\System\xiUskOG.exe
  C:\Windows\System\xiUskOG.exe
  2⤵
  PID:8360
- C:\Windows\System\BsYmROT.exe
  C:\Windows\System\BsYmROT.exe
  2⤵
  PID:8808
- C:\Windows\System\yNdsuBF.exe
  C:\Windows\System\yNdsuBF.exe
  2⤵
  PID:8732
- C:\Windows\System\uWADcFY.exe
  C:\Windows\System\uWADcFY.exe
  2⤵
  PID:8712
- C:\Windows\System\TKIDljz.exe
  C:\Windows\System\TKIDljz.exe
  2⤵
  PID:9068
- C:\Windows\System\wpdfLJB.exe
  C:\Windows\System\wpdfLJB.exe
  2⤵
  PID:8936
- C:\Windows\System\igSODNZ.exe
  C:\Windows\System\igSODNZ.exe
  2⤵
  PID:8900
- C:\Windows\System\UPLjOHF.exe
  C:\Windows\System\UPLjOHF.exe
  2⤵
  PID:9036
- C:\Windows\System\lyxivnr.exe
  C:\Windows\System\lyxivnr.exe
  2⤵
  PID:8812
- C:\Windows\System\xwIPiHK.exe
  C:\Windows\System\xwIPiHK.exe
  2⤵
  PID:8972
- C:\Windows\System\lpviTzE.exe
  C:\Windows\System\lpviTzE.exe
  2⤵
  PID:8848
- C:\Windows\System\kPARKBD.exe
  C:\Windows\System\kPARKBD.exe
  2⤵
  PID:7508
- C:\Windows\System\vvqJaTr.exe
  C:\Windows\System\vvqJaTr.exe
  2⤵
  PID:9204
- C:\Windows\System\IwSSJZv.exe
  C:\Windows\System\IwSSJZv.exe
  2⤵
  PID:6516
- C:\Windows\System\xbrfrIm.exe
  C:\Windows\System\xbrfrIm.exe
  2⤵
  PID:2540
- C:\Windows\System\wASOcro.exe
  C:\Windows\System\wASOcro.exe
  2⤵
  PID:9192
- C:\Windows\System\SCScFIG.exe
  C:\Windows\System\SCScFIG.exe
  2⤵
  PID:2016
- C:\Windows\System\WCqHXxA.exe
  C:\Windows\System\WCqHXxA.exe
  2⤵
  PID:8268
- C:\Windows\System\ACehebG.exe
  C:\Windows\System\ACehebG.exe
  2⤵
  PID:8860
- C:\Windows\System\rzynaGT.exe
  C:\Windows\System\rzynaGT.exe
  2⤵
  PID:8696
- C:\Windows\System\HwGJbep.exe
  C:\Windows\System\HwGJbep.exe
  2⤵
  PID:8668
- C:\Windows\System\mztXfyp.exe
  C:\Windows\System\mztXfyp.exe
  2⤵
  PID:8868
- C:\Windows\System\vslpwEO.exe
  C:\Windows\System\vslpwEO.exe
  2⤵
  PID:9172
- C:\Windows\System\oMqMysd.exe
  C:\Windows\System\oMqMysd.exe
  2⤵
  PID:8788
- C:\Windows\System\DslGqsB.exe
  C:\Windows\System\DslGqsB.exe
  2⤵
  PID:8672
- C:\Windows\System\suCeSJp.exe
  C:\Windows\System\suCeSJp.exe
  2⤵
  PID:8308
- C:\Windows\System\BdCUatm.exe
  C:\Windows\System\BdCUatm.exe
  2⤵
  PID:8884
- C:\Windows\System\Umxhiab.exe
  C:\Windows\System\Umxhiab.exe
  2⤵
  PID:7200
- C:\Windows\System\IhiEffc.exe
  C:\Windows\System\IhiEffc.exe
  2⤵
  PID:8724
- C:\Windows\System\vGlvKVI.exe
  C:\Windows\System\vGlvKVI.exe
  2⤵
  PID:9136
- C:\Windows\System\uoraAiy.exe
  C:\Windows\System\uoraAiy.exe
  2⤵
  PID:9052
- C:\Windows\System\ECPalpp.exe
  C:\Windows\System\ECPalpp.exe
  2⤵
  PID:7860
- C:\Windows\System\hRqnYwu.exe
  C:\Windows\System\hRqnYwu.exe
  2⤵
  PID:9008
- C:\Windows\System\LRFOHCN.exe
  C:\Windows\System\LRFOHCN.exe
  2⤵
  PID:9124
- C:\Windows\System\dkDcgNg.exe
  C:\Windows\System\dkDcgNg.exe
  2⤵
  PID:8792
- C:\Windows\System\pXvQewF.exe
  C:\Windows\System\pXvQewF.exe
  2⤵
  PID:8876
- C:\Windows\System\aNYOacG.exe
  C:\Windows\System\aNYOacG.exe
  2⤵
  PID:8208
- C:\Windows\System\RNFEwWL.exe
  C:\Windows\System\RNFEwWL.exe
  2⤵
  PID:8180
- C:\Windows\System\toMTYnS.exe
  C:\Windows\System\toMTYnS.exe
  2⤵
  PID:8576
- C:\Windows\System\pnJFDXN.exe
  C:\Windows\System\pnJFDXN.exe
  2⤵
  PID:9092
- C:\Windows\System\UZFPxdp.exe
  C:\Windows\System\UZFPxdp.exe
  2⤵
  PID:8852
- C:\Windows\System\tQlsrvx.exe
  C:\Windows\System\tQlsrvx.exe
  2⤵
  PID:7544
- C:\Windows\System\ntDOrBI.exe
  C:\Windows\System\ntDOrBI.exe
  2⤵
  PID:8708
- C:\Windows\System\lHCyzXy.exe
  C:\Windows\System\lHCyzXy.exe
  2⤵
  PID:8392
- C:\Windows\System\jqXVoyx.exe
  C:\Windows\System\jqXVoyx.exe
  2⤵
  PID:9228
- C:\Windows\System\jYCwYOk.exe
  C:\Windows\System\jYCwYOk.exe
  2⤵
  PID:9244
- C:\Windows\System\VuMZxzL.exe
  C:\Windows\System\VuMZxzL.exe
  2⤵
  PID:9260
- C:\Windows\System\lLGRJEo.exe
  C:\Windows\System\lLGRJEo.exe
  2⤵
  PID:9284
- C:\Windows\System\DbBRHpC.exe
  C:\Windows\System\DbBRHpC.exe
  2⤵
  PID:9324
- C:\Windows\System\FUNiaWn.exe
  C:\Windows\System\FUNiaWn.exe
  2⤵
  PID:9340
- C:\Windows\System\oaNCKpV.exe
  C:\Windows\System\oaNCKpV.exe
  2⤵
  PID:9356
- C:\Windows\System\hLAPMwX.exe
  C:\Windows\System\hLAPMwX.exe
  2⤵
  PID:9372
- C:\Windows\System\jJXcHqb.exe
  C:\Windows\System\jJXcHqb.exe
  2⤵
  PID:9400
- C:\Windows\System\NIolAot.exe
  C:\Windows\System\NIolAot.exe
  2⤵
  PID:9420
- C:\Windows\System\cfbKEly.exe
  C:\Windows\System\cfbKEly.exe
  2⤵
  PID:9436
- C:\Windows\System\wGlGkLK.exe
  C:\Windows\System\wGlGkLK.exe
  2⤵
  PID:9452
- C:\Windows\System\eLlLhuJ.exe
  C:\Windows\System\eLlLhuJ.exe
  2⤵
  PID:9484
- C:\Windows\System\yrTWaTE.exe
  C:\Windows\System\yrTWaTE.exe
  2⤵
  PID:9500
- C:\Windows\System\zyiNWwB.exe
  C:\Windows\System\zyiNWwB.exe
  2⤵
  PID:9516
- C:\Windows\System\OxLshXW.exe
  C:\Windows\System\OxLshXW.exe
  2⤵
  PID:9548
- C:\Windows\System\Drdcepq.exe
  C:\Windows\System\Drdcepq.exe
  2⤵
  PID:9564
- C:\Windows\System\tpwQRdz.exe
  C:\Windows\System\tpwQRdz.exe
  2⤵
  PID:9692
- C:\Windows\System\kgAeVfa.exe
  C:\Windows\System\kgAeVfa.exe
  2⤵
  PID:9708
- C:\Windows\System\fwQGaqF.exe
  C:\Windows\System\fwQGaqF.exe
  2⤵
  PID:9724
- C:\Windows\System\xQgFHPg.exe
  C:\Windows\System\xQgFHPg.exe
  2⤵
  PID:9740
- C:\Windows\System\zFjkoMT.exe
  C:\Windows\System\zFjkoMT.exe
  2⤵
  PID:9756
- C:\Windows\System\XhtvsSl.exe
  C:\Windows\System\XhtvsSl.exe
  2⤵
  PID:9772
- C:\Windows\System\exzhLEh.exe
  C:\Windows\System\exzhLEh.exe
  2⤵
  PID:9788
- C:\Windows\System\zrsNIVq.exe
  C:\Windows\System\zrsNIVq.exe
  2⤵
  PID:9804
- C:\Windows\System\DjkbGVy.exe
  C:\Windows\System\DjkbGVy.exe
  2⤵
  PID:9820
- C:\Windows\System\haCGALy.exe
  C:\Windows\System\haCGALy.exe
  2⤵
  PID:9836
- C:\Windows\System\rmRjbMa.exe
  C:\Windows\System\rmRjbMa.exe
  2⤵
  PID:9852
- C:\Windows\System\uKsPUCE.exe
  C:\Windows\System\uKsPUCE.exe
  2⤵
  PID:9868
- C:\Windows\System\fTULDDB.exe
  C:\Windows\System\fTULDDB.exe
  2⤵
  PID:9884
- C:\Windows\System\RknllLz.exe
  C:\Windows\System\RknllLz.exe
  2⤵
  PID:9904
- C:\Windows\System\qwjafuE.exe
  C:\Windows\System\qwjafuE.exe
  2⤵
  PID:9936
- C:\Windows\System\cNzTPer.exe
  C:\Windows\System\cNzTPer.exe
  2⤵
  PID:9952
- C:\Windows\System\FfytkSL.exe
  C:\Windows\System\FfytkSL.exe
  2⤵
  PID:9968
- C:\Windows\System\RFyOfWT.exe
  C:\Windows\System\RFyOfWT.exe
  2⤵
  PID:9984
- C:\Windows\System\OnOVVUy.exe
  C:\Windows\System\OnOVVUy.exe
  2⤵
  PID:10004
- C:\Windows\System\FvdkNtq.exe
  C:\Windows\System\FvdkNtq.exe
  2⤵
  PID:10020
- C:\Windows\System\iOKESrA.exe
  C:\Windows\System\iOKESrA.exe
  2⤵
  PID:10040
- C:\Windows\System\aeSDDNl.exe
  C:\Windows\System\aeSDDNl.exe
  2⤵
  PID:10056
- C:\Windows\System\repVnWU.exe
  C:\Windows\System\repVnWU.exe
  2⤵
  PID:10072
- C:\Windows\System\khoJRgE.exe
  C:\Windows\System\khoJRgE.exe
  2⤵
  PID:10092
- C:\Windows\System\sEkeMer.exe
  C:\Windows\System\sEkeMer.exe
  2⤵
  PID:10108
- C:\Windows\System\XScLNnf.exe
  C:\Windows\System\XScLNnf.exe
  2⤵
  PID:10124
- C:\Windows\System\oKhhbsa.exe
  C:\Windows\System\oKhhbsa.exe
  2⤵
  PID:10148
- C:\Windows\System\xKOdzWO.exe
  C:\Windows\System\xKOdzWO.exe
  2⤵
  PID:10164
- C:\Windows\System\FhUKMmJ.exe
  C:\Windows\System\FhUKMmJ.exe
  2⤵
  PID:10180
- C:\Windows\System\mxrvvGW.exe
  C:\Windows\System\mxrvvGW.exe
  2⤵
  PID:10196
- C:\Windows\System\hBnAhXG.exe
  C:\Windows\System\hBnAhXG.exe
  2⤵
  PID:10212
- C:\Windows\System\WukMvVi.exe
  C:\Windows\System\WukMvVi.exe
  2⤵
  PID:10228
- C:\Windows\System\pFlhjCn.exe
  C:\Windows\System\pFlhjCn.exe
  2⤵
  PID:9268
- C:\Windows\System\RiYUJKE.exe
  C:\Windows\System\RiYUJKE.exe
  2⤵
  PID:9280
- C:\Windows\System\tjbiwHe.exe
  C:\Windows\System\tjbiwHe.exe
  2⤵
  PID:8532
- C:\Windows\System\NfyTEni.exe
  C:\Windows\System\NfyTEni.exe
  2⤵
  PID:9348
- C:\Windows\System\azJEcdT.exe
  C:\Windows\System\azJEcdT.exe
  2⤵
  PID:9388
- C:\Windows\System\JupoCpk.exe
  C:\Windows\System\JupoCpk.exe
  2⤵
  PID:9448
- C:\Windows\System\bghOTKC.exe
  C:\Windows\System\bghOTKC.exe
  2⤵
  PID:9496
- C:\Windows\System\zzKjzfY.exe
  C:\Windows\System\zzKjzfY.exe
  2⤵
  PID:9540
- C:\Windows\System\YTZjpTh.exe
  C:\Windows\System\YTZjpTh.exe
  2⤵
  PID:9432
- C:\Windows\System\tDmmTvJ.exe
  C:\Windows\System\tDmmTvJ.exe
  2⤵
  PID:9476
- C:\Windows\System\vdvaMwr.exe
  C:\Windows\System\vdvaMwr.exe
  2⤵
  PID:9572
- C:\Windows\System\irfUFbt.exe
  C:\Windows\System\irfUFbt.exe
  2⤵
  PID:9584
- C:\Windows\System\XVgpPvJ.exe
  C:\Windows\System\XVgpPvJ.exe
  2⤵
  PID:9600
- C:\Windows\System\TvfPWVN.exe
  C:\Windows\System\TvfPWVN.exe
  2⤵
  PID:9624
- C:\Windows\System\bERCWBF.exe
  C:\Windows\System\bERCWBF.exe
  2⤵
  PID:9588
- C:\Windows\System\jfkQFFB.exe
  C:\Windows\System\jfkQFFB.exe
  2⤵
  PID:9676
- C:\Windows\System\yAFcOeQ.exe
  C:\Windows\System\yAFcOeQ.exe
  2⤵
  PID:9732
- C:\Windows\System\EPtFxJc.exe
  C:\Windows\System\EPtFxJc.exe
  2⤵
  PID:9796
- C:\Windows\System\rmTbMLA.exe
  C:\Windows\System\rmTbMLA.exe
  2⤵
  PID:9860
- C:\Windows\System\txETobI.exe
  C:\Windows\System\txETobI.exe
  2⤵
  PID:9900
- C:\Windows\System\JtbKntm.exe
  C:\Windows\System\JtbKntm.exe
  2⤵
  PID:9656
- C:\Windows\System\crsMziA.exe
  C:\Windows\System\crsMziA.exe
  2⤵
  PID:10012
- C:\Windows\System\rUZoTHi.exe
  C:\Windows\System\rUZoTHi.exe
  2⤵
  PID:9720
- C:\Windows\System\mrCUfNp.exe
  C:\Windows\System\mrCUfNp.exe
  2⤵
  PID:10028
- C:\Windows\System\DMPiSIp.exe
  C:\Windows\System\DMPiSIp.exe
  2⤵
  PID:10116
- C:\Windows\System\BlTfXlh.exe
  C:\Windows\System\BlTfXlh.exe
  2⤵
  PID:10156
- C:\Windows\System\nPstZjY.exe
  C:\Windows\System\nPstZjY.exe
  2⤵
  PID:9684
- C:\Windows\System\KfsqZfO.exe
  C:\Windows\System\KfsqZfO.exe
  2⤵
  PID:9880
- C:\Windows\System\HBhfjop.exe
  C:\Windows\System\HBhfjop.exe
  2⤵
  PID:10068
- C:\Windows\System\HGzzFLi.exe
  C:\Windows\System\HGzzFLi.exe
  2⤵
  PID:10192
- C:\Windows\System\bAWtiwv.exe
  C:\Windows\System\bAWtiwv.exe
  2⤵
  PID:9932
- C:\Windows\System\omWJqfp.exe
  C:\Windows\System\omWJqfp.exe
  2⤵
  PID:10132
- C:\Windows\System\hmDKFpC.exe
  C:\Windows\System\hmDKFpC.exe
  2⤵
  PID:10204
- C:\Windows\System\ZNACemJ.exe
  C:\Windows\System\ZNACemJ.exe
  2⤵
  PID:9300
- C:\Windows\System\dBJtTyc.exe
  C:\Windows\System\dBJtTyc.exe
  2⤵
  PID:9380
- C:\Windows\System\MulQTzC.exe
  C:\Windows\System\MulQTzC.exe
  2⤵
  PID:9384
- C:\Windows\System\rrpFLtz.exe
  C:\Windows\System\rrpFLtz.exe
  2⤵
  PID:9316
- C:\Windows\System\plZCxoB.exe
  C:\Windows\System\plZCxoB.exe
  2⤵
  PID:9240
- C:\Windows\System\OkbcrCy.exe
  C:\Windows\System\OkbcrCy.exe
  2⤵
  PID:9532
- C:\Windows\System\tyzBbWi.exe
  C:\Windows\System\tyzBbWi.exe
  2⤵
  PID:9556
- C:\Windows\System\WotwsTZ.exe
  C:\Windows\System\WotwsTZ.exe
  2⤵
  PID:9608
- C:\Windows\System\ZaysldT.exe
  C:\Windows\System\ZaysldT.exe
  2⤵
  PID:9616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BpDvKiS.exe

Filesize
2.3MB

MD5
aa69b573c461691c3509c5d55367f783

SHA1
2a5344cd363128eea0d8f236f0e333c9633676c1

SHA256
f31f26c39f90733d899c5743a42fecfd83fbaa4d937217a8204e6e9828b75819

SHA512
d031f6c0a38bb4da240025a169cb4b6d3c277eb3c2b8c044cd5d072b3701f9a8b699b9fcde3ce993593f12cf9f76ecc86bcc211ff682cd8812602331525d8b86

Download Submit
C:\Windows\system\GOzAubB.exe

Filesize
2.2MB

MD5
7d15b481dc6180ea70f45e1ed13d7641

SHA1
b46ed8d9d84444f4e8c8736832fb7280cf3d1753

SHA256
75971e62617600eb9d8ffe6c0eb658f0d28f1b99e448d98cbec371fc9ad6e80b

SHA512
c2c43949a0d30e9ef94b0d126f15aeb183f0a5ed0c263b90dab587c59b3f43462c6a17e8e46e9d130b27df610663dc95ff14c52824fd2bca917caad3a41dc679

Download Submit
C:\Windows\system\GrjRdqE.exe

Filesize
2.2MB

MD5
e18b58ed547128d3d254c7f4a523dba9

SHA1
4a5e25707f6f406eda6e4c4b613fe40dfca3b1d1

SHA256
7e5acf6456c3d8c64a83182ecb48ca91ec9c98c9b9051803f66bd89df6e6edc1

SHA512
100db132e87dae9fd33c7a9f19b11c956d3e56e312594e18c0a4e2d39b2d675a8858217d7ae2b66c6457d43b9271d576ad0290448cb084fd66a49346a5e02566

Download Submit
C:\Windows\system\HDOALhH.exe

Filesize
2.2MB

MD5
94f615f3d7fd1323092a86005cd2ad2d

SHA1
1a659dbf07e067c711d93a1eb21c303a05024879

SHA256
d8302f4b81e84da96f2465c73535dc01c434e140fbfd9d57c2e2e2209f4f36d8

SHA512
9fab088f389b7b050b4b59ebfb9004a287fe78cfe2393690bda125fee08e23055b8d9404a93a875204b337ee9ef02eacc89a1e04ba285fadcce5098f3d43d1e5

Download Submit
C:\Windows\system\NGzZlRu.exe

Filesize
2.3MB

MD5
f8856f39d3984b4ffb9ee905e2437c5e

SHA1
d3d24357d0458bf34b60e04620aa125fa4a893e6

SHA256
5a50916377434c75650236c5d2e14bfa9a6f3baa99f0961ed3cbc5acf6352867

SHA512
10990f5dcc36770257f9980ed8b4fd63b75833311e326f132a7ab0177ed4ac8a8c48023ff0ab045ba03bf42fe263630bfaf8b7a1d6663fc7f2ae0d00308648f6

Download Submit
C:\Windows\system\NlSMOHA.exe

Filesize
2.3MB

MD5
6b56a6e18c44268dcd06f26b2d05376f

SHA1
bc6d1616b76cbda72c98210844e332945887b8c5

SHA256
69001ea818bd4c1ee8e1dec0b6e2a35f6dbd6170c4a22961654f758f80059c00

SHA512
867eef87c7b81fa1ae7f77825f9529b78f47986f317b1a1e8074897bca6042ca2044e459c8bd0ff0910096d2de26c3fd57b88a4bae39959cc5d5dce1c3570e95

Download Submit
C:\Windows\system\QVmYTXz.exe

Filesize
2.2MB

MD5
f7f95a99e8c7f5bb6f745440dc1bb6fc

SHA1
5c365c244d73959dfb402be88d0f3d226cb4af7b

SHA256
734759bc74f16997f1e1e798fd12864b7979e9f3d54283fe60783c14ee60b637

SHA512
636efc607d34fca16adfbd3ba0d5d16f45c1cb58167048b09a541298428fc48b21fea228aff3d4ecbb0064700fdce56468c430eb21cc41167b391b7d366e35b8

Download Submit
C:\Windows\system\UBTeGlM.exe

Filesize
2.2MB

MD5
a58144ba33900535e93785ede29fc182

SHA1
67baa20b5e6b7da73948b59e1ba80d493bd86ed3

SHA256
d76cd5d8a2a4390946aa58b84a9a72e9a14d5f8d740b0133938fa8cd2cb184a6

SHA512
f01c89b83ac0140add7a3d0c0d99d8a5aca6effa9faa96ece16baaf78e8370721b1de47ca7a2b64e9de581539aae80bd0f3c120d300487550ebe250bedf32d37

Download Submit
C:\Windows\system\UNIRPtu.exe

Filesize
2.3MB

MD5
7b607e3ec10390afbb26751903c12196

SHA1
661abf304a6cf0e0e096bfe6fccdb534b83a0118

SHA256
c3d1abdb976a8f00ecb3912e7a423dce63ef9f6f17d31ce31e27d3881a4bd815

SHA512
3637ccc866cd28eef69289b3d8e68819d3c0a8b536ee13d5c32885099b12024840a5292f796deb28e890282139160a50386270744df08bf6e8cde53d06604a30

Download Submit
C:\Windows\system\YbWuIyl.exe

Filesize
2.2MB

MD5
d863e205561f8db08318608aada986dd

SHA1
49f7bd43a8ab8992da3ed2b0dd70c31c4db28cae

SHA256
23c4e5acd58da3a000258fe9a37b7265d3263707e908a381d4eb388f08279524

SHA512
0a2ae8963b58d31d9a8c866d5a8e73d7d48ff3e11660b6dab145e898b70d6b2fde0da1ca0038d222d783a27b87e4bc03fca958fceb61ee1d21734e74717f45ab

Download Submit
C:\Windows\system\bktImzd.exe

Filesize
2.2MB

MD5
0fa764b560ba7035cf44312e43b3983e

SHA1
46962af9467b291dfc05d8d27eca237a019d32b8

SHA256
3a93b4f3ecff8fa53a5e2fe653fe27781c566cb633bc6ae173560181294953fa

SHA512
6d9572e2ecbad7079f633cca3648cd37b7172efd2898b2a2c5d2f57432a35b9a1dae0d7a3515590f7c7211cfa489a8f0b014aa621530b270ae1222586e7ab3cb

Download Submit
C:\Windows\system\gGBZhyM.exe

Filesize
2.3MB

MD5
b42f8a25916bb9a7db03df3479f41e4e

SHA1
d664616b64d6b2a30875c6d33ae48c92da06404f

SHA256
39298a85039435a06e9830bec2687c8bdfa1b4bebc2d8c9ce2f5508997898355

SHA512
0b583fd7c83dc413a52cefa7f71e30c59a3d19672a6b8132cb6a9ab2833ee6f4c843431ee0a93adf5e6492e5333bd1fcc491151dad6997de9a47b25ed5e0aad2

Download Submit
C:\Windows\system\gxTfnWE.exe

Filesize
2.2MB

MD5
93538e423a27ac368531e7890e4d2201

SHA1
52838963f55daf57d904665ea275d0ad14a97894

SHA256
5ef7f0f17add94bbb510cf60e03c9ecaa5cd9dee046f2544105dcbf768d37b1a

SHA512
68adf702493c96945b484f56ca507f537551c7cfb2649186ce1fb3601faea4a05bebdde2db0e5e48709479ba9cae186f011af8da4b605af6e3cf4ead28cbdc97

Download Submit
C:\Windows\system\iyEFqFo.exe

Filesize
2.3MB

MD5
ab982ace8709107fd85ee8572b0add63

SHA1
7a34bf67e36dae8919778519b8352ed0d23ebe9b

SHA256
bc39334f8657c69221a36b51f5212523b41ffa0b3e7010d86cfc40fa91735992

SHA512
84de6ef541cdde86b4ed3d81798ac917cfb2a89fd1fda084471079e8b3c52f7b9799fec74b6c4e18ccf6ccce2a0cbd53ee5a135ca0bd1af5a45eea2fa2e679fd

Download Submit
C:\Windows\system\jFymBca.exe

Filesize
2.3MB

MD5
8e24b4677a95f0f47b6eeceaa0feb08e

SHA1
b1e12b1aa63e93ff25bf2777e16468edacd8adc8

SHA256
8d969041c276110d3c4b6d27edae0473920e29c6b74adf197afce5a0575105f6

SHA512
e5466a9224e0009dcb03fe230342682c652746b7fa6d8b548c80dc08846f9fdd32de5dfe9fbd8e94963efa9778899ec7473a712f8d251b2dae09e2df20088101

Download Submit
C:\Windows\system\jjWWipL.exe

Filesize
2.2MB

MD5
4ebc68780acb3b7c8012093e59799417

SHA1
55f6c72a8e2ad75b6746ff3cc0713c732ce13a7e

SHA256
be6154a0537fdeadbb66516359d80ac702ac8c9fdd3798d215c8f594c2483c6c

SHA512
88e5b1346dd6539f7d96351ded5b29490086bb2e2e3e2d9871387d48a3495914be4ab343217ea10677975c82e0c03077df7f426bb38daee543f46d5fc903f2e4

Download Submit
C:\Windows\system\zMYTrtU.exe

Filesize
2.2MB

MD5
79f5cfef452532fe78adcf78e3188db9

SHA1
20715d6c148cf55aa0d9cdb459af067d10868f0e

SHA256
0390276a6e6088ee95b8ba5e07affc70c3b3d3491a5879f785c13e3fd2b08bcd

SHA512
cdd3dc6a84a50dc3b670d3dbcb84084fbd682e74ea0909191500f282a0f537e9d93eb0a10567ccc244cde02930c8f5968713a596f7e223a34409cdb9f91179c7

Download Submit
\Windows\system\CHvCyFn.exe

Filesize
2.2MB

MD5
9c84c80d0bf63c241e31204005e5f942

SHA1
144aeeca751ebca91fa0209106a656d54207a715

SHA256
bca93b30909bb034bec8ef10e06705638fae5a9d5d2b2149ce4a5b020c48a776

SHA512
668b63af2f771dbc3be8533485ea933515c91e0a428a0b3a30c394c8be58ffefb69d9a4f10389c21f5f0aacf5eafcceb558691b2cc9ff4dedff9e4b6cd218279

Download Submit
\Windows\system\IAAioJt.exe

Filesize
2.2MB

MD5
358efe2d856e492a6bce99c04f44774e

SHA1
d4c9e39ac3b32a26a3ad3b39afc596910ebc1e99

SHA256
dc1303b5767fbc415d60220c9495b03fb0f5b9e3bee7acda31554b30266d4cdb

SHA512
4ba2834b5fb8c2273caf97f26fd789535e456c9e0bf31f8d2e0d3b5b09faefc0627219bcacb555b9e4fcb169955f50f8fe72f729317e1a97009df4ad287eaacc

Download Submit
\Windows\system\IwrverJ.exe

Filesize
2.2MB

MD5
0dc0c7a4b4503f7b781c6d141d13b02e

SHA1
eb3116c72015865173dbab0cf500c0722b7637ce

SHA256
85d533221eb3b17d60f25d7045302e601f76343c93f496a7f4d7406fd219d6d6

SHA512
eed1e2f01866ea67539e908408be3101542a62cf474447504ac18cde11834448ead5c730fda490b508a3b00be60a06f8dfac903ba3ebc627d0967791ba52a7d0

Download Submit
\Windows\system\KODrrPh.exe

Filesize
2.2MB

MD5
627d16096ddc4a7166e95aa11da82ec3

SHA1
f200053a25f4fb580480b170afa7606a8e1775a8

SHA256
226140d1bed6553031c89d2254d5071a94742b832772dce099959d2d006b7f9a

SHA512
73c4d6011ae239f0337d69483c3d24c92647041a3d2f72f104303fd2258df5952c429bf1ab435ce9845f02befab836774bfb21b3bea7962a86768f97e3749417

Download Submit
\Windows\system\LneBCvi.exe

Filesize
2.2MB

MD5
051445384a254ecf26905d1bb18000f9

SHA1
a097ec0c617c306358221a042c88dde748dec18e

SHA256
dfed1d60fc43e937d4050bb6d2407841bad614b7988093b2d646338122041a91

SHA512
1ed7a1b3c7bc66fcea9a8ee11ed6a2435a9d5e3b5d7569fa0ac62646d31b5ea1091ccad7e46b31d67dd8873ba8d8c7bfd9bfe5024bf0a6f77949e5b67c682f81

Download Submit
\Windows\system\NfSdFFL.exe

Filesize
2.3MB

MD5
0448bf64aa2e608343006c73df08c35e

SHA1
2a2ebccc1d12074545df422298ee3289706c5510

SHA256
3dc7fc6ac9404e1ea2d24d8dfaef526c09288907b1a233fc98b32424ea7d26ae

SHA512
00c010eb51ac42265b03e6af254dbafe2ad148d7603fc81c9ad2161efeabd11bccf2258b82cc69fb5001cbbe3cbf4d6522ba0b2ab7202b7b87d1ac57b0e4910e

Download Submit
\Windows\system\OFsrFBw.exe

Filesize
2.3MB

MD5
6a7c24186249cbd8f1d94b4f2192fdf5

SHA1
ef6b1282763912c9ef8dc1fe6a7a4f03ead75ed7

SHA256
a5fc1336163b778535174e9488a5235b5ccc6076aa2416731f2823b8f1813a81

SHA512
62c7a7f2becf6bcae2e4a64e59c305f4459f30d3ac0d8ab7129f79896d2d808dbb98ee7334fd4b1676536eda72adcdb3e3b69418a420ad77444ec30753f85e04

Download Submit
\Windows\system\SQfaKUP.exe

Filesize
2.2MB

MD5
4f459f8d514dbe8ffd1d155e764b89b8

SHA1
be67b938eb230bd6627f0d1998af6bb34c773428

SHA256
cc9f4e9dc939ea585a683953ca4519e376e5fa088b84c146fc7de7ed0b8906ff

SHA512
b2d2f5b984fb60dbda09d65f26f52b77450f1d5fc662ea561f56cf79e02fe86d2456182190e0d42b37c33592e21b0c8236c901bf4edc2671be6f305a39e994a7

Download Submit
\Windows\system\THPOKkN.exe

Filesize
2.2MB

MD5
3b8ae17783ca5725d356a5ddc22faa08

SHA1
ee1be4e3ea220b01247e4226fbfcac52a3cfdfc5

SHA256
d765ab59d41a86e8fedaee8d3df7b9c686d0a8b4c639618ffedfba5d557a874b

SHA512
5e75a4f57776cfd97d8d183ac95d73feceedb16830380f02e5192f220a8647747641752fe906fc4ec84bf7c081bedfd30ba9d571cc16a13d141e3b0994542bf8

Download Submit
\Windows\system\YUqSYKZ.exe

Filesize
2.2MB

MD5
fc03f698852289392fe5972be8774439

SHA1
3b7e403ac0f5adbf465bc7b786f353c43ecacc67

SHA256
a15cda0688a95a15d3795c308b2852c03082785c5f65f1c503e9da5df81ea3db

SHA512
9aabf3d9c5d3da4071ddaed3cad22c0ecd05172999465dba055655a477578baeed6500e65626f83b460fdd4a4135b21d2e3fab25e9567f66c1889afc0638b79a

Download Submit
\Windows\system\YbTJZeD.exe

Filesize
2.3MB

MD5
3fd911a96394bc9353a9a7f1b6941628

SHA1
f8156fa49311359a831835ae639ba63358bf226f

SHA256
2617e422388966d2c23ca05172c829b2dded2670ed4e64ee40bba2ef975d4e4f

SHA512
1a2e50e4201cccbde854d257021906ae55ebaeb28e8ca2bd15aa3b33c49ac25455a11375a53b8b2f7e9e15e76aafab7d195d0e9ba2bacb96a4d26c1d7463ded1

Download Submit
\Windows\system\YehIOXT.exe

Filesize
2.2MB

MD5
5973db6f0ae88d88eec24713db933e6c

SHA1
54b6f05ffcf1601b160a5bf7e7597c924a485129

SHA256
4aeb7f449b0c7dda8165887979027dce3653cb41a5cbb90ba710a26915e87829

SHA512
f37323244522ee3c59d90d4b269ed0279312ab93583e3ea2da482b51ab19265cea3ba913b818a88f599e74677919c374a2f9af59ca10e86187eee8cd5fde4fef

Download Submit
\Windows\system\ZSFClAU.exe

Filesize
2.3MB

MD5
750f695d60dfd3f4fab1effa90352877

SHA1
f722a72c95ac9f20411f379c14e230d9d4711b85

SHA256
f2d78917c98a6f4942f64652b48b32b06c82b88a3921eebb7e4dcfea06cd0985

SHA512
d0a8244a98d5ceb8fbad12fa6b27a300605ac27578976577fb567ed9d682866b92355df42d080b995cad97f60e372c4464cd7729e2d47e01afd8537d5c63d443

Download Submit
\Windows\system\bQPmaeg.exe

Filesize
2.2MB

MD5
6a2a2f957081df5eadfcfb6b744f1b1e

SHA1
7db68be9de75fd6239cff2e7b6432c0f34f05924

SHA256
2175564b2a45727920d8c75e0fbe15112dbb8558087110196c40e7743d356b4e

SHA512
c2d042e38e62c7c8611dc1eda4ed5339b487c404c364f7a98abf885a98244895bc812089bf4a9eb1a0b814455068674cee3d5f232463a04229ebef9d0ca21d45

Download Submit
\Windows\system\dKxSUbx.exe

Filesize
2.2MB

MD5
84c588d22a5de0cf29b6a4da3d9000e0

SHA1
e6c01870d8c2be243108436a335478b3492152fe

SHA256
905ff96e1d12bb5a48c436dced25b825318b1fa700693cb6d370f00db878dfad

SHA512
e0ac4f6d0b8988bde8e8ba3724325956807b15a6021145447d1a53fd4c0838d029ec3b6e990348415d8e2680c959ebd666d135c96abfc8858d4eb7e83c05a9b6

Download Submit
\Windows\system\dRDolJO.exe

Filesize
2.2MB

MD5
6dd2b0f3d82cdd9f102662311926112a

SHA1
bb745fc40f32873d9a56f34e7527d2aa5046ba55

SHA256
c91ad246830cde92cad2a0ff6d9562660566d3ec80a762318bc42035112572cf

SHA512
172d3cd4cd4f9d360b5d6102ca739095063754c54e1406bf5ea3f4693ada7a80e7c3dca72672f5620c64ad2fce5479bdc524d10b43c2fe41bf3403c30bebfee9

Download Submit
\Windows\system\fwUOpBD.exe

Filesize
2.2MB

MD5
1ed3c707346cab73570595972ad1977b

SHA1
db0e81ef1c354487b94fe8d4c6cc5f2338630af7

SHA256
15b2e6684bb9181eeed45c8209c12ea637f979a8fb25a9f5aa1d1d5d4bb041a1

SHA512
f794e4263e04ec408cd7bfe43913d0a3fa92e2dad933e9f80e1f8001acc9adc5c98c7a0fa3eba4a7624daa8942684a161bb1c3642b6767551e97f76262915f99

Download Submit
\Windows\system\gfiEjbU.exe

Filesize
2.3MB

MD5
fcbaff70da5aa0270e56e5e0c1701b62

SHA1
52c820d42cd764fd4f8b4dc0c805b495b8ee8068

SHA256
f0a33a6d227fad67e3f5ede932aa4335ecc1495532f233fe121856c565df1636

SHA512
20430ced1278350ad03667848b6f802488c3d832f0e0b219fb1381bdc4c5e9600f74917ec3a7afca865e9672f5df334157a47b7b9277c575539267832cb0f840

Download Submit
\Windows\system\ihNSIlp.exe

Filesize
2.3MB

MD5
b6d24637c980f6e2d54aa103419de476

SHA1
e0a36fe29de15e9c9cb6ab626289b5293c65ee3c

SHA256
f7b16a74779c7db06ce2839ff680b842098730bb8a399316c1d2a9e1cb310d46

SHA512
60c5e64375ab32887c658f89124a4f078e923d1cca830263881fb18fece61f3d557983515c9ddf5e3cd81f9feda5db4888fbc570ba8d530de38137791e3c1b0f

Download Submit
\Windows\system\pVzzamS.exe

Filesize
2.2MB

MD5
168e87b28f844ba7c64264465ce10c28

SHA1
eb4ea91cbece4a24cb9282ee2106e69c65b6c7c3

SHA256
598122e3bd6d24f4e0ca6ab5d33890cc0b6105aac26f46a4916608f38363f34a

SHA512
def07aecba8096d64f49617fef886147291bf1d57a28fea68d4eae59c936212bc0921d822169f559e6e1ddfe20a8ae20e4e426c0d769f41d659eca990b5ad370

Download Submit
\Windows\system\rzsZZOs.exe

Filesize
2.2MB

MD5
84232f8db8c151a2a3e4f9fabf9e2cb9

SHA1
33e79d64bea29614da82d5cb1cd50b7c6332487f

SHA256
00e0f2c97ae7964f8535352b8d0169a1ced2b222477168388fae7cafd8be767e

SHA512
273b5c9e4b8009a116928e1a55f3531f73d93132f147eb3deb9605e9da05b7466685afed904223105b8253734a7af0ad9815f7c51a7fa12c2b4a1aba25910f33

Download Submit
\Windows\system\sTlDyYF.exe

Filesize
2.3MB

MD5
76856cd5a08b8d2bfb62d153b3e0306a

SHA1
3d15713ee0426c7679081025cd526a414635dcd7

SHA256
90a65f73cf465d10581daadf64e9a6f4852c03330931be511cddc2d58881a42f

SHA512
8ecc28bd702f68be54dd067d36216d0d81bdf7e83748ef8683bff7b3ecaf0dc9007c4eace371b61af9c6efd2e46e2e2ed0834c0d00a22798d9e7599aedd47a29

Download Submit
\Windows\system\utllAXU.exe

Filesize
2.2MB

MD5
2874642eb21a1d2181c3519e8d0519b5

SHA1
0a88443af6a2c63595334d5e2033c402036fc5c8

SHA256
3b0022eafc49eb98733fbd832add75b976504e545311fb1ea6fa16dca1d59819

SHA512
d3646ad9f8be8ff5d1748de430706294edd8e7910f91b1404a0586002e6c6eeff3969e3ad7b8c4c32ffcd687fd1b33452433a32a283b4bd5405a9859cbdeac48

Download Submit
memory/944-77-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/944-14-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/944-3878-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/1020-89-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/1020-3854-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/1500-3852-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/1500-118-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/1724-880-0x000000001B300000-0x000000001B5E2000-memory.dmp

Filesize
2.9MB

Download
memory/1724-1542-0x00000000024E0000-0x00000000024E8000-memory.dmp

Filesize
32KB

Download
memory/1932-31-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1932-48-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/1932-93-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/1932-21-0x0000000002D80000-0x0000000003172000-memory.dmp

Filesize
3.9MB

Download
memory/1932-44-0x0000000002D80000-0x0000000003172000-memory.dmp

Filesize
3.9MB

Download
memory/1932-114-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/1932-46-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/1932-59-0x0000000002D80000-0x0000000003172000-memory.dmp

Filesize
3.9MB

Download
memory/1932-8-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/1932-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1932-83-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/1932-58-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/1932-45-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/1932-1-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2228-3853-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2228-12-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2376-65-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2376-3867-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2516-3868-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2516-40-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2516-109-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2604-49-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2604-3869-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2612-2866-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-332-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-32-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-57-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2616-3866-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2984-22-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-3870-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download