xmrig | 36cd13f4d0ef6f741d1a40bcc036c5113d927edc3bceddf81f2b6aa561dba830

Analysis

max time kernel
13s
max time network
30s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
Size

2.3MB
MD5

0686e9327e1a0fbbe44087e1a4404151
SHA1

75c057b8d2b63cf9bfa16fdec25a31b1ebbed433
SHA256

36cd13f4d0ef6f741d1a40bcc036c5113d927edc3bceddf81f2b6aa561dba830
SHA512

e35d9e3ebb4bc45c9d147b00580a470a244ff32633a604ec8ece2f6a71112fb65781561f971f9471fa98f4540db55947b06b981e6fab9f801f35efbdbe59bd2a
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9okc:NAB1

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2724-36-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig
behavioral1/memory/2652-270-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2536-271-0x000000013F970000-0x000000013FD62000-memory.dmp	xmrig
behavioral1/memory/1928-120-0x0000000003050000-0x0000000003442000-memory.dmp	xmrig
behavioral1/memory/2676-119-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/1548-65-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/1928-64-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/1636-24-0x000000013FA40000-0x000000013FE32000-memory.dmp	xmrig
behavioral1/memory/3036-20-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1636	BCYsRWv.exe
3036	mNvwCSH.exe
2676	vVRRvtf.exe
2652	gghdyFr.exe
2724	bPCEAjU.exe
2536	ntVifQH.exe
2704	CEphpwa.exe
1548	zTCKqMj.exe
1372	xAXRbKL.exe
2908	GCosOht.exe
2964	gSeJvKg.exe
3020	LEiAsQr.exe
1308	ZdaaBMo.exe
1056	UHAykgr.exe
1648	fvvNqaO.exe
2412	EUiIgol.exe
1492	jGOTmEK.exe
2448	GiysNgS.exe
2780	lmAgMfF.exe
2896	GVcbptw.exe
1812	gWKNSvE.exe
632	ttPRaqf.exe
2608	suNjgHL.exe
1620	PGacVOq.exe
696	tXkHlHe.exe
2852	KGPMmuS.exe
2096	OrwSjsW.exe
2968	zYMPFYp.exe
1168	QdBXzJD.exe
1668	DMErxUa.exe
2032	gOKpSeA.exe
1556	TOmMzlQ.exe
2272	daGGrIs.exe
1572	uytcTKi.exe
2012	zmsjISp.exe
1320	gXYLGBk.exe
1012	JItMnjd.exe
2888	XPLRLpv.exe
668	VhAfCzE.exe
568	jprZXgS.exe
1804	dLvySHX.exe
1892	mIJRXCk.exe
1104	YFiVoqB.exe
2872	weMQRzT.exe
772	CJsMRwp.exe
2816	DlJHFvn.exe
2812	RwPvfVh.exe
2860	NgAetth.exe
3000	FxhBfOt.exe
1724	tCMIHwp.exe
1596	fLFwxbq.exe
2160	ywgdXYo.exe
2664	aQUTSxR.exe
2552	jnYaHAx.exe
2428	gMrTRum.exe
2800	DAkkppD.exe
1156	ucrVxex.exe
2924	uUnlOeL.exe
1084	lyyhcbf.exe
1484	lXZDyJm.exe
2068	RrPqoBB.exe
1664	xumkRvb.exe
1888	LuQDlUA.exe
2584	ikQMMEs.exe

Loads dropped DLL 64 IoCs

pid	Process
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1928-0-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/files/0x00080000000122cd-3.dat	upx
behavioral1/files/0x00080000000161e7-14.dat	upx
behavioral1/files/0x002d000000015eaf-5.dat	upx
behavioral1/files/0x002c000000015f6d-11.dat	upx
behavioral1/memory/2652-28-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/2676-26-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/files/0x000800000001630b-32.dat	upx
behavioral1/memory/2724-36-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/files/0x000500000001866d-112.dat	upx
behavioral1/files/0x0006000000018c0a-138.dat	upx
behavioral1/files/0x0006000000017052-144.dat	upx
behavioral1/files/0x0006000000018f3a-163.dat	upx
behavioral1/files/0x0005000000019215-189.dat	upx
behavioral1/files/0x000500000001922e-192.dat	upx
behavioral1/memory/2652-270-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/files/0x00050000000191ed-182.dat	upx
behavioral1/files/0x00060000000190b6-174.dat	upx
behavioral1/files/0x00050000000191a7-173.dat	upx
behavioral1/files/0x0006000000018c1a-169.dat	upx
behavioral1/memory/2536-271-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/files/0x0006000000019021-165.dat	upx
behavioral1/files/0x0005000000018778-159.dat	upx
behavioral1/files/0x000500000001866b-157.dat	upx
behavioral1/files/0x0006000000017556-155.dat	upx
behavioral1/files/0x000600000001747d-153.dat	upx
behavioral1/files/0x0006000000017456-151.dat	upx
behavioral1/files/0x00050000000191cd-179.dat	upx
behavioral1/files/0x0008000000016843-134.dat	upx
behavioral1/files/0x000900000001864e-126.dat	upx
behavioral1/files/0x000600000001749c-125.dat	upx
behavioral1/files/0x000600000001745e-124.dat	upx
behavioral1/files/0x00060000000173e0-123.dat	upx
behavioral1/files/0x00060000000173d5-122.dat	upx
behavioral1/files/0x0006000000016eb2-121.dat	upx
behavioral1/memory/2676-119-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/files/0x00060000000173d8-79.dat	upx
behavioral1/files/0x0006000000016e94-67.dat	upx
behavioral1/files/0x0007000000004e76-54.dat	upx
behavioral1/memory/2536-50-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/memory/1548-65-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/1928-64-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/files/0x0008000000016dbf-59.dat	upx
behavioral1/memory/2704-58-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/files/0x0007000000016572-43.dat	upx
behavioral1/memory/1636-24-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/memory/3036-20-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MAUWBNN.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\QdBXzJD.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\vSHxCsr.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\yAzKOrl.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\iBYbzzs.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\puxUvvY.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\rgPHrPl.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\Uodwhtt.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\SisQYje.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\rdJBipg.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\PJngFLw.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\yfsOxFb.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\uknlTcT.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\dlRZjGI.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\ohjqNNA.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\AWpvVJu.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\oAIWgMi.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\FHItLOT.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\DSzwVHw.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\tCMIHwp.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\tDRcRzr.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\QpStzJO.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\IkOZzOl.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\njWkOQB.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\TeAIOMg.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\rRbLqTO.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\VhAfCzE.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\aQUTSxR.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\QXLcNIM.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\RfeITLY.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\JeEMeux.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\CxMsATp.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\YDjXYmU.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\nZynWKk.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\nZoEEiL.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\dWNLucc.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\jefkgYe.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\aPYiwsn.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\kZkjvpm.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\gXYLGBk.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\UNnAPNZ.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\izdJFiG.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\lYzWytW.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\ODJHCgT.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\DVUPuHL.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\WykOKmY.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\PyNjPMR.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\HBuMLbB.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\nVnErPt.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\WQMRaMM.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\lJHXbyq.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\cjcYAOp.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\DfKIaIr.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\oROeaez.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\TRXJqwX.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\wJbYgrT.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\kEvkdgi.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\TOflwil.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\GVcbptw.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\ddHsqtb.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\RUndDav.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\WMurjbs.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\NmqZwzU.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
File created	C:\Windows\System\OWbpbty.exe	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2484	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
Token: SeDebugPrivilege	2484	powershell.exe
Token: SeLockMemoryPrivilege	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2484	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	29
PID 1928 wrote to memory of 2484	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	29
PID 1928 wrote to memory of 2484	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	29
PID 1928 wrote to memory of 1636	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	30
PID 1928 wrote to memory of 1636	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	30
PID 1928 wrote to memory of 1636	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	30
PID 1928 wrote to memory of 3036	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	31
PID 1928 wrote to memory of 3036	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	31
PID 1928 wrote to memory of 3036	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	31
PID 1928 wrote to memory of 2652	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	32
PID 1928 wrote to memory of 2652	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	32
PID 1928 wrote to memory of 2652	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	32
PID 1928 wrote to memory of 2676	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	33
PID 1928 wrote to memory of 2676	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	33
PID 1928 wrote to memory of 2676	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	33
PID 1928 wrote to memory of 2724	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	34
PID 1928 wrote to memory of 2724	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	34
PID 1928 wrote to memory of 2724	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	34
PID 1928 wrote to memory of 2536	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	35
PID 1928 wrote to memory of 2536	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	35
PID 1928 wrote to memory of 2536	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	35
PID 1928 wrote to memory of 2704	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	36
PID 1928 wrote to memory of 2704	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	36
PID 1928 wrote to memory of 2704	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	36
PID 1928 wrote to memory of 2412	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	37
PID 1928 wrote to memory of 2412	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	37
PID 1928 wrote to memory of 2412	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	37
PID 1928 wrote to memory of 1548	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	38
PID 1928 wrote to memory of 1548	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	38
PID 1928 wrote to memory of 1548	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	38
PID 1928 wrote to memory of 2448	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	39
PID 1928 wrote to memory of 2448	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	39
PID 1928 wrote to memory of 2448	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	39
PID 1928 wrote to memory of 1372	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	40
PID 1928 wrote to memory of 1372	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	40
PID 1928 wrote to memory of 1372	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	40
PID 1928 wrote to memory of 2780	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	41
PID 1928 wrote to memory of 2780	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	41
PID 1928 wrote to memory of 2780	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	41
PID 1928 wrote to memory of 2908	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	42
PID 1928 wrote to memory of 2908	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	42
PID 1928 wrote to memory of 2908	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	42
PID 1928 wrote to memory of 2896	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	43
PID 1928 wrote to memory of 2896	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	43
PID 1928 wrote to memory of 2896	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	43
PID 1928 wrote to memory of 2964	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	44
PID 1928 wrote to memory of 2964	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	44
PID 1928 wrote to memory of 2964	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	44
PID 1928 wrote to memory of 1812	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	45
PID 1928 wrote to memory of 1812	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	45
PID 1928 wrote to memory of 1812	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	45
PID 1928 wrote to memory of 3020	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	46
PID 1928 wrote to memory of 3020	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	46
PID 1928 wrote to memory of 3020	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	46
PID 1928 wrote to memory of 632	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	47
PID 1928 wrote to memory of 632	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	47
PID 1928 wrote to memory of 632	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	47
PID 1928 wrote to memory of 1308	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	48
PID 1928 wrote to memory of 1308	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	48
PID 1928 wrote to memory of 1308	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	48
PID 1928 wrote to memory of 2608	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	49
PID 1928 wrote to memory of 2608	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	49
PID 1928 wrote to memory of 2608	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	49
PID 1928 wrote to memory of 1056	1928	0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0686e9327e1a0fbbe44087e1a4404151_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2484
- C:\Windows\System\BCYsRWv.exe
  C:\Windows\System\BCYsRWv.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\mNvwCSH.exe
  C:\Windows\System\mNvwCSH.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\gghdyFr.exe
  C:\Windows\System\gghdyFr.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\vVRRvtf.exe
  C:\Windows\System\vVRRvtf.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\bPCEAjU.exe
  C:\Windows\System\bPCEAjU.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\ntVifQH.exe
  C:\Windows\System\ntVifQH.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\CEphpwa.exe
  C:\Windows\System\CEphpwa.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\EUiIgol.exe
  C:\Windows\System\EUiIgol.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\zTCKqMj.exe
  C:\Windows\System\zTCKqMj.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\GiysNgS.exe
  C:\Windows\System\GiysNgS.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\xAXRbKL.exe
  C:\Windows\System\xAXRbKL.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\lmAgMfF.exe
  C:\Windows\System\lmAgMfF.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\GCosOht.exe
  C:\Windows\System\GCosOht.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\GVcbptw.exe
  C:\Windows\System\GVcbptw.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\gSeJvKg.exe
  C:\Windows\System\gSeJvKg.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\gWKNSvE.exe
  C:\Windows\System\gWKNSvE.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\LEiAsQr.exe
  C:\Windows\System\LEiAsQr.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\ttPRaqf.exe
  C:\Windows\System\ttPRaqf.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\ZdaaBMo.exe
  C:\Windows\System\ZdaaBMo.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\suNjgHL.exe
  C:\Windows\System\suNjgHL.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\UHAykgr.exe
  C:\Windows\System\UHAykgr.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\PGacVOq.exe
  C:\Windows\System\PGacVOq.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\fvvNqaO.exe
  C:\Windows\System\fvvNqaO.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\tXkHlHe.exe
  C:\Windows\System\tXkHlHe.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\jGOTmEK.exe
  C:\Windows\System\jGOTmEK.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\OrwSjsW.exe
  C:\Windows\System\OrwSjsW.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\KGPMmuS.exe
  C:\Windows\System\KGPMmuS.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\gOKpSeA.exe
  C:\Windows\System\gOKpSeA.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\zYMPFYp.exe
  C:\Windows\System\zYMPFYp.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\TOmMzlQ.exe
  C:\Windows\System\TOmMzlQ.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\QdBXzJD.exe
  C:\Windows\System\QdBXzJD.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\daGGrIs.exe
  C:\Windows\System\daGGrIs.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\DMErxUa.exe
  C:\Windows\System\DMErxUa.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\uytcTKi.exe
  C:\Windows\System\uytcTKi.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\zmsjISp.exe
  C:\Windows\System\zmsjISp.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\gXYLGBk.exe
  C:\Windows\System\gXYLGBk.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\JItMnjd.exe
  C:\Windows\System\JItMnjd.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\XPLRLpv.exe
  C:\Windows\System\XPLRLpv.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\VhAfCzE.exe
  C:\Windows\System\VhAfCzE.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\jprZXgS.exe
  C:\Windows\System\jprZXgS.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\dLvySHX.exe
  C:\Windows\System\dLvySHX.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\mIJRXCk.exe
  C:\Windows\System\mIJRXCk.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\YFiVoqB.exe
  C:\Windows\System\YFiVoqB.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\weMQRzT.exe
  C:\Windows\System\weMQRzT.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\CJsMRwp.exe
  C:\Windows\System\CJsMRwp.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\DlJHFvn.exe
  C:\Windows\System\DlJHFvn.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\RwPvfVh.exe
  C:\Windows\System\RwPvfVh.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\NgAetth.exe
  C:\Windows\System\NgAetth.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\FxhBfOt.exe
  C:\Windows\System\FxhBfOt.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\tCMIHwp.exe
  C:\Windows\System\tCMIHwp.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\fLFwxbq.exe
  C:\Windows\System\fLFwxbq.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\ywgdXYo.exe
  C:\Windows\System\ywgdXYo.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\aQUTSxR.exe
  C:\Windows\System\aQUTSxR.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\jnYaHAx.exe
  C:\Windows\System\jnYaHAx.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\gMrTRum.exe
  C:\Windows\System\gMrTRum.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\DAkkppD.exe
  C:\Windows\System\DAkkppD.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\ucrVxex.exe
  C:\Windows\System\ucrVxex.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\uUnlOeL.exe
  C:\Windows\System\uUnlOeL.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\lyyhcbf.exe
  C:\Windows\System\lyyhcbf.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\lXZDyJm.exe
  C:\Windows\System\lXZDyJm.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\RrPqoBB.exe
  C:\Windows\System\RrPqoBB.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\LuQDlUA.exe
  C:\Windows\System\LuQDlUA.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\xumkRvb.exe
  C:\Windows\System\xumkRvb.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\zAxtgre.exe
  C:\Windows\System\zAxtgre.exe
  2⤵
  PID:1376
- C:\Windows\System\ikQMMEs.exe
  C:\Windows\System\ikQMMEs.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\qViCaLY.exe
  C:\Windows\System\qViCaLY.exe
  2⤵
  PID:2764
- C:\Windows\System\nZynWKk.exe
  C:\Windows\System\nZynWKk.exe
  2⤵
  PID:744
- C:\Windows\System\HBuMLbB.exe
  C:\Windows\System\HBuMLbB.exe
  2⤵
  PID:1756
- C:\Windows\System\kJmdkDh.exe
  C:\Windows\System\kJmdkDh.exe
  2⤵
  PID:1752
- C:\Windows\System\fNRKUgC.exe
  C:\Windows\System\fNRKUgC.exe
  2⤵
  PID:840
- C:\Windows\System\XNAEVPg.exe
  C:\Windows\System\XNAEVPg.exe
  2⤵
  PID:448
- C:\Windows\System\bpVrzTp.exe
  C:\Windows\System\bpVrzTp.exe
  2⤵
  PID:2284
- C:\Windows\System\yfsOxFb.exe
  C:\Windows\System\yfsOxFb.exe
  2⤵
  PID:1912
- C:\Windows\System\SxEyxNT.exe
  C:\Windows\System\SxEyxNT.exe
  2⤵
  PID:1760
- C:\Windows\System\NvEOjmd.exe
  C:\Windows\System\NvEOjmd.exe
  2⤵
  PID:2384
- C:\Windows\System\scGuqgb.exe
  C:\Windows\System\scGuqgb.exe
  2⤵
  PID:948
- C:\Windows\System\QOLmyQl.exe
  C:\Windows\System\QOLmyQl.exe
  2⤵
  PID:2876
- C:\Windows\System\zNRiBkV.exe
  C:\Windows\System\zNRiBkV.exe
  2⤵
  PID:2728
- C:\Windows\System\WPVyWmL.exe
  C:\Windows\System\WPVyWmL.exe
  2⤵
  PID:2320
- C:\Windows\System\uknlTcT.exe
  C:\Windows\System\uknlTcT.exe
  2⤵
  PID:2184
- C:\Windows\System\njWkOQB.exe
  C:\Windows\System\njWkOQB.exe
  2⤵
  PID:2504
- C:\Windows\System\YfCrmQB.exe
  C:\Windows\System\YfCrmQB.exe
  2⤵
  PID:2656
- C:\Windows\System\xOFJfYj.exe
  C:\Windows\System\xOFJfYj.exe
  2⤵
  PID:2792
- C:\Windows\System\cEQUGJr.exe
  C:\Windows\System\cEQUGJr.exe
  2⤵
  PID:2404
- C:\Windows\System\DbHIDLs.exe
  C:\Windows\System\DbHIDLs.exe
  2⤵
  PID:2772
- C:\Windows\System\yeOhdFu.exe
  C:\Windows\System\yeOhdFu.exe
  2⤵
  PID:2984
- C:\Windows\System\XlHdXkR.exe
  C:\Windows\System\XlHdXkR.exe
  2⤵
  PID:2568
- C:\Windows\System\zaHawLo.exe
  C:\Windows\System\zaHawLo.exe
  2⤵
  PID:2736
- C:\Windows\System\tLOkdUk.exe
  C:\Windows\System\tLOkdUk.exe
  2⤵
  PID:2980
- C:\Windows\System\TeAIOMg.exe
  C:\Windows\System\TeAIOMg.exe
  2⤵
  PID:2088
- C:\Windows\System\XcaYzQx.exe
  C:\Windows\System\XcaYzQx.exe
  2⤵
  PID:2644
- C:\Windows\System\nAoBcKY.exe
  C:\Windows\System\nAoBcKY.exe
  2⤵
  PID:468
- C:\Windows\System\vyIQwzy.exe
  C:\Windows\System\vyIQwzy.exe
  2⤵
  PID:2976
- C:\Windows\System\IbQEvHT.exe
  C:\Windows\System\IbQEvHT.exe
  2⤵
  PID:1608
- C:\Windows\System\HmtUJjK.exe
  C:\Windows\System\HmtUJjK.exe
  2⤵
  PID:1392
- C:\Windows\System\ddHsqtb.exe
  C:\Windows\System\ddHsqtb.exe
  2⤵
  PID:2600
- C:\Windows\System\rIGpAZG.exe
  C:\Windows\System\rIGpAZG.exe
  2⤵
  PID:2444
- C:\Windows\System\fZTPBQn.exe
  C:\Windows\System\fZTPBQn.exe
  2⤵
  PID:1404
- C:\Windows\System\GJgxazm.exe
  C:\Windows\System\GJgxazm.exe
  2⤵
  PID:2912
- C:\Windows\System\nVnErPt.exe
  C:\Windows\System\nVnErPt.exe
  2⤵
  PID:1992
- C:\Windows\System\cbBvbBf.exe
  C:\Windows\System\cbBvbBf.exe
  2⤵
  PID:600
- C:\Windows\System\alNXEdx.exe
  C:\Windows\System\alNXEdx.exe
  2⤵
  PID:2740
- C:\Windows\System\LCbTZLK.exe
  C:\Windows\System\LCbTZLK.exe
  2⤵
  PID:2496
- C:\Windows\System\GtxFPjm.exe
  C:\Windows\System\GtxFPjm.exe
  2⤵
  PID:2748
- C:\Windows\System\JDyLDFo.exe
  C:\Windows\System\JDyLDFo.exe
  2⤵
  PID:2464
- C:\Windows\System\ZwwVqey.exe
  C:\Windows\System\ZwwVqey.exe
  2⤵
  PID:2292
- C:\Windows\System\LpozYVb.exe
  C:\Windows\System\LpozYVb.exe
  2⤵
  PID:612
- C:\Windows\System\FTSzNJi.exe
  C:\Windows\System\FTSzNJi.exe
  2⤵
  PID:1748
- C:\Windows\System\gsSKKDN.exe
  C:\Windows\System\gsSKKDN.exe
  2⤵
  PID:2004
- C:\Windows\System\tNemkbp.exe
  C:\Windows\System\tNemkbp.exe
  2⤵
  PID:912
- C:\Windows\System\ODJHCgT.exe
  C:\Windows\System\ODJHCgT.exe
  2⤵
  PID:800
- C:\Windows\System\hSuYZou.exe
  C:\Windows\System\hSuYZou.exe
  2⤵
  PID:960
- C:\Windows\System\otHcVSS.exe
  C:\Windows\System\otHcVSS.exe
  2⤵
  PID:2844
- C:\Windows\System\MjKaxaL.exe
  C:\Windows\System\MjKaxaL.exe
  2⤵
  PID:1500
- C:\Windows\System\XkLuMfN.exe
  C:\Windows\System\XkLuMfN.exe
  2⤵
  PID:2152
- C:\Windows\System\qYVxZGM.exe
  C:\Windows\System\qYVxZGM.exe
  2⤵
  PID:2756
- C:\Windows\System\nZoEEiL.exe
  C:\Windows\System\nZoEEiL.exe
  2⤵
  PID:1872
- C:\Windows\System\dlRZjGI.exe
  C:\Windows\System\dlRZjGI.exe
  2⤵
  PID:1568
- C:\Windows\System\eWXwspO.exe
  C:\Windows\System\eWXwspO.exe
  2⤵
  PID:2200
- C:\Windows\System\MeyVNxI.exe
  C:\Windows\System\MeyVNxI.exe
  2⤵
  PID:2100
- C:\Windows\System\RVLqmTQ.exe
  C:\Windows\System\RVLqmTQ.exe
  2⤵
  PID:1200
- C:\Windows\System\QXLcNIM.exe
  C:\Windows\System\QXLcNIM.exe
  2⤵
  PID:3012
- C:\Windows\System\QtSDwnA.exe
  C:\Windows\System\QtSDwnA.exe
  2⤵
  PID:1248
- C:\Windows\System\dxsTyKX.exe
  C:\Windows\System\dxsTyKX.exe
  2⤵
  PID:868
- C:\Windows\System\mhuqcoi.exe
  C:\Windows\System\mhuqcoi.exe
  2⤵
  PID:2372
- C:\Windows\System\RfeITLY.exe
  C:\Windows\System\RfeITLY.exe
  2⤵
  PID:2744
- C:\Windows\System\UNnAPNZ.exe
  C:\Windows\System\UNnAPNZ.exe
  2⤵
  PID:2436
- C:\Windows\System\RUndDav.exe
  C:\Windows\System\RUndDav.exe
  2⤵
  PID:1952
- C:\Windows\System\BPcZnEj.exe
  C:\Windows\System\BPcZnEj.exe
  2⤵
  PID:1096
- C:\Windows\System\GyChSxB.exe
  C:\Windows\System\GyChSxB.exe
  2⤵
  PID:2544
- C:\Windows\System\WUxMwvI.exe
  C:\Windows\System\WUxMwvI.exe
  2⤵
  PID:2716
- C:\Windows\System\tpDoskZ.exe
  C:\Windows\System\tpDoskZ.exe
  2⤵
  PID:2340
- C:\Windows\System\NqnNXaV.exe
  C:\Windows\System\NqnNXaV.exe
  2⤵
  PID:1116
- C:\Windows\System\ycAsKzP.exe
  C:\Windows\System\ycAsKzP.exe
  2⤵
  PID:844
- C:\Windows\System\vSHxCsr.exe
  C:\Windows\System\vSHxCsr.exe
  2⤵
  PID:312
- C:\Windows\System\BwJKUGV.exe
  C:\Windows\System\BwJKUGV.exe
  2⤵
  PID:1632
- C:\Windows\System\wTjwsUR.exe
  C:\Windows\System\wTjwsUR.exe
  2⤵
  PID:320
- C:\Windows\System\DVUPuHL.exe
  C:\Windows\System\DVUPuHL.exe
  2⤵
  PID:2824
- C:\Windows\System\yAzKOrl.exe
  C:\Windows\System\yAzKOrl.exe
  2⤵
  PID:984
- C:\Windows\System\iNvSlDo.exe
  C:\Windows\System\iNvSlDo.exe
  2⤵
  PID:2084
- C:\Windows\System\KXgEgmp.exe
  C:\Windows\System\KXgEgmp.exe
  2⤵
  PID:1968
- C:\Windows\System\fqavudQ.exe
  C:\Windows\System\fqavudQ.exe
  2⤵
  PID:2940
- C:\Windows\System\FwdxRoL.exe
  C:\Windows\System\FwdxRoL.exe
  2⤵
  PID:2388
- C:\Windows\System\wPFhLZi.exe
  C:\Windows\System\wPFhLZi.exe
  2⤵
  PID:2952
- C:\Windows\System\llaaADF.exe
  C:\Windows\System\llaaADF.exe
  2⤵
  PID:2104
- C:\Windows\System\IDjMtHv.exe
  C:\Windows\System\IDjMtHv.exe
  2⤵
  PID:1512
- C:\Windows\System\FRqjrgm.exe
  C:\Windows\System\FRqjrgm.exe
  2⤵
  PID:2624
- C:\Windows\System\DiHOgzW.exe
  C:\Windows\System\DiHOgzW.exe
  2⤵
  PID:1600
- C:\Windows\System\exEGdHo.exe
  C:\Windows\System\exEGdHo.exe
  2⤵
  PID:564
- C:\Windows\System\XVZypHL.exe
  C:\Windows\System\XVZypHL.exe
  2⤵
  PID:1876
- C:\Windows\System\XTCjcRG.exe
  C:\Windows\System\XTCjcRG.exe
  2⤵
  PID:2348
- C:\Windows\System\FcwrdXF.exe
  C:\Windows\System\FcwrdXF.exe
  2⤵
  PID:2776
- C:\Windows\System\mwFHcrD.exe
  C:\Windows\System\mwFHcrD.exe
  2⤵
  PID:1520
- C:\Windows\System\gOgFxTm.exe
  C:\Windows\System\gOgFxTm.exe
  2⤵
  PID:2712
- C:\Windows\System\IJOUSPI.exe
  C:\Windows\System\IJOUSPI.exe
  2⤵
  PID:2072
- C:\Windows\System\BevSflG.exe
  C:\Windows\System\BevSflG.exe
  2⤵
  PID:2440
- C:\Windows\System\tDRcRzr.exe
  C:\Windows\System\tDRcRzr.exe
  2⤵
  PID:768
- C:\Windows\System\fEaWIjb.exe
  C:\Windows\System\fEaWIjb.exe
  2⤵
  PID:2524
- C:\Windows\System\SjczQsX.exe
  C:\Windows\System\SjczQsX.exe
  2⤵
  PID:3064
- C:\Windows\System\izdJFiG.exe
  C:\Windows\System\izdJFiG.exe
  2⤵
  PID:2408
- C:\Windows\System\RIohDgw.exe
  C:\Windows\System\RIohDgw.exe
  2⤵
  PID:1060
- C:\Windows\System\whKgRNH.exe
  C:\Windows\System\whKgRNH.exe
  2⤵
  PID:3080
- C:\Windows\System\ZHBmlHd.exe
  C:\Windows\System\ZHBmlHd.exe
  2⤵
  PID:3100
- C:\Windows\System\xTGbICA.exe
  C:\Windows\System\xTGbICA.exe
  2⤵
  PID:3116
- C:\Windows\System\UJAYxal.exe
  C:\Windows\System\UJAYxal.exe
  2⤵
  PID:3132
- C:\Windows\System\ACSbubh.exe
  C:\Windows\System\ACSbubh.exe
  2⤵
  PID:3152
- C:\Windows\System\wQlotNi.exe
  C:\Windows\System\wQlotNi.exe
  2⤵
  PID:3168
- C:\Windows\System\hXEDCHe.exe
  C:\Windows\System\hXEDCHe.exe
  2⤵
  PID:3184
- C:\Windows\System\wDcQMBb.exe
  C:\Windows\System\wDcQMBb.exe
  2⤵
  PID:3200
- C:\Windows\System\olcMvBI.exe
  C:\Windows\System\olcMvBI.exe
  2⤵
  PID:3216
- C:\Windows\System\PXwpOku.exe
  C:\Windows\System\PXwpOku.exe
  2⤵
  PID:3236
- C:\Windows\System\IxHLOtD.exe
  C:\Windows\System\IxHLOtD.exe
  2⤵
  PID:3252
- C:\Windows\System\ulKrNJY.exe
  C:\Windows\System\ulKrNJY.exe
  2⤵
  PID:3268
- C:\Windows\System\majjXBA.exe
  C:\Windows\System\majjXBA.exe
  2⤵
  PID:3284
- C:\Windows\System\VWOIhxe.exe
  C:\Windows\System\VWOIhxe.exe
  2⤵
  PID:3304
- C:\Windows\System\SDxVATj.exe
  C:\Windows\System\SDxVATj.exe
  2⤵
  PID:3320
- C:\Windows\System\puxUvvY.exe
  C:\Windows\System\puxUvvY.exe
  2⤵
  PID:3336
- C:\Windows\System\guGyNth.exe
  C:\Windows\System\guGyNth.exe
  2⤵
  PID:3356
- C:\Windows\System\sCnIWeg.exe
  C:\Windows\System\sCnIWeg.exe
  2⤵
  PID:3372
- C:\Windows\System\IdCKbGt.exe
  C:\Windows\System\IdCKbGt.exe
  2⤵
  PID:3388
- C:\Windows\System\dHGPdYV.exe
  C:\Windows\System\dHGPdYV.exe
  2⤵
  PID:3404
- C:\Windows\System\NmqZwzU.exe
  C:\Windows\System\NmqZwzU.exe
  2⤵
  PID:3420
- C:\Windows\System\eRGifTT.exe
  C:\Windows\System\eRGifTT.exe
  2⤵
  PID:3436
- C:\Windows\System\nnxKHpd.exe
  C:\Windows\System\nnxKHpd.exe
  2⤵
  PID:3452
- C:\Windows\System\gmmprLY.exe
  C:\Windows\System\gmmprLY.exe
  2⤵
  PID:3472
- C:\Windows\System\ARwbbCb.exe
  C:\Windows\System\ARwbbCb.exe
  2⤵
  PID:3488
- C:\Windows\System\zDnkXkh.exe
  C:\Windows\System\zDnkXkh.exe
  2⤵
  PID:3504
- C:\Windows\System\EMSJQCp.exe
  C:\Windows\System\EMSJQCp.exe
  2⤵
  PID:3520
- C:\Windows\System\QgiizLe.exe
  C:\Windows\System\QgiizLe.exe
  2⤵
  PID:3536
- C:\Windows\System\SUEynol.exe
  C:\Windows\System\SUEynol.exe
  2⤵
  PID:3552
- C:\Windows\System\WQMRaMM.exe
  C:\Windows\System\WQMRaMM.exe
  2⤵
  PID:3572
- C:\Windows\System\YaanItM.exe
  C:\Windows\System\YaanItM.exe
  2⤵
  PID:3588
- C:\Windows\System\LNrYihw.exe
  C:\Windows\System\LNrYihw.exe
  2⤵
  PID:3604
- C:\Windows\System\HeJmcul.exe
  C:\Windows\System\HeJmcul.exe
  2⤵
  PID:3620
- C:\Windows\System\CUVxtYD.exe
  C:\Windows\System\CUVxtYD.exe
  2⤵
  PID:3636
- C:\Windows\System\GBYpOKe.exe
  C:\Windows\System\GBYpOKe.exe
  2⤵
  PID:3652
- C:\Windows\System\HQiohic.exe
  C:\Windows\System\HQiohic.exe
  2⤵
  PID:3832
- C:\Windows\System\zXvucoe.exe
  C:\Windows\System\zXvucoe.exe
  2⤵
  PID:3848
- C:\Windows\System\GXdigHk.exe
  C:\Windows\System\GXdigHk.exe
  2⤵
  PID:3864
- C:\Windows\System\NJTckdR.exe
  C:\Windows\System\NJTckdR.exe
  2⤵
  PID:3892
- C:\Windows\System\QQBmoVR.exe
  C:\Windows\System\QQBmoVR.exe
  2⤵
  PID:3908
- C:\Windows\System\JclzTRO.exe
  C:\Windows\System\JclzTRO.exe
  2⤵
  PID:3924
- C:\Windows\System\AbnlXPa.exe
  C:\Windows\System\AbnlXPa.exe
  2⤵
  PID:3944
- C:\Windows\System\bDMLxMa.exe
  C:\Windows\System\bDMLxMa.exe
  2⤵
  PID:3960
- C:\Windows\System\RrLYFEI.exe
  C:\Windows\System\RrLYFEI.exe
  2⤵
  PID:3976
- C:\Windows\System\JCnIvkB.exe
  C:\Windows\System\JCnIvkB.exe
  2⤵
  PID:3992
- C:\Windows\System\shwcqVF.exe
  C:\Windows\System\shwcqVF.exe
  2⤵
  PID:4008
- C:\Windows\System\LZCvFeU.exe
  C:\Windows\System\LZCvFeU.exe
  2⤵
  PID:4024
- C:\Windows\System\qTtwDbe.exe
  C:\Windows\System\qTtwDbe.exe
  2⤵
  PID:4040
- C:\Windows\System\kJOQDFQ.exe
  C:\Windows\System\kJOQDFQ.exe
  2⤵
  PID:4060
- C:\Windows\System\eCkoSPE.exe
  C:\Windows\System\eCkoSPE.exe
  2⤵
  PID:4076
- C:\Windows\System\hsSaTSO.exe
  C:\Windows\System\hsSaTSO.exe
  2⤵
  PID:4092
- C:\Windows\System\nJHuZOf.exe
  C:\Windows\System\nJHuZOf.exe
  2⤵
  PID:3004
- C:\Windows\System\jhMJzGi.exe
  C:\Windows\System\jhMJzGi.exe
  2⤵
  PID:1260
- C:\Windows\System\ZmWGivJ.exe
  C:\Windows\System\ZmWGivJ.exe
  2⤵
  PID:3088
- C:\Windows\System\TUOQkEC.exe
  C:\Windows\System\TUOQkEC.exe
  2⤵
  PID:3128
- C:\Windows\System\yFwuIzk.exe
  C:\Windows\System\yFwuIzk.exe
  2⤵
  PID:2196
- C:\Windows\System\dQXZuHs.exe
  C:\Windows\System\dQXZuHs.exe
  2⤵
  PID:3300
- C:\Windows\System\mQsPAGC.exe
  C:\Windows\System\mQsPAGC.exe
  2⤵
  PID:3396
- C:\Windows\System\RVdEPCh.exe
  C:\Windows\System\RVdEPCh.exe
  2⤵
  PID:3468
- C:\Windows\System\vpsgyOr.exe
  C:\Windows\System\vpsgyOr.exe
  2⤵
  PID:3664
- C:\Windows\System\JeEMeux.exe
  C:\Windows\System\JeEMeux.exe
  2⤵
  PID:3232
- C:\Windows\System\rgPHrPl.exe
  C:\Windows\System\rgPHrPl.exe
  2⤵
  PID:3296
- C:\Windows\System\rONmNvE.exe
  C:\Windows\System\rONmNvE.exe
  2⤵
  PID:3716
- C:\Windows\System\TBtunFz.exe
  C:\Windows\System\TBtunFz.exe
  2⤵
  PID:3460
- C:\Windows\System\JwrRNjM.exe
  C:\Windows\System\JwrRNjM.exe
  2⤵
  PID:3568
- C:\Windows\System\BjYKYZJ.exe
  C:\Windows\System\BjYKYZJ.exe
  2⤵
  PID:3660
- C:\Windows\System\dWNLucc.exe
  C:\Windows\System\dWNLucc.exe
  2⤵
  PID:3692
- C:\Windows\System\UUIlOsG.exe
  C:\Windows\System\UUIlOsG.exe
  2⤵
  PID:3740
- C:\Windows\System\dMHIcDW.exe
  C:\Windows\System\dMHIcDW.exe
  2⤵
  PID:3772
- C:\Windows\System\ohjqNNA.exe
  C:\Windows\System\ohjqNNA.exe
  2⤵
  PID:3724
- C:\Windows\System\dXUIPya.exe
  C:\Windows\System\dXUIPya.exe
  2⤵
  PID:3752
- C:\Windows\System\WMurjbs.exe
  C:\Windows\System\WMurjbs.exe
  2⤵
  PID:3480
- C:\Windows\System\QpStzJO.exe
  C:\Windows\System\QpStzJO.exe
  2⤵
  PID:3512
- C:\Windows\System\TMluCyM.exe
  C:\Windows\System\TMluCyM.exe
  2⤵
  PID:3584
- C:\Windows\System\SisQYje.exe
  C:\Windows\System\SisQYje.exe
  2⤵
  PID:3644
- C:\Windows\System\GwjDHPc.exe
  C:\Windows\System\GwjDHPc.exe
  2⤵
  PID:2296
- C:\Windows\System\OWbpbty.exe
  C:\Windows\System\OWbpbty.exe
  2⤵
  PID:2820
- C:\Windows\System\ruDuGIr.exe
  C:\Windows\System\ruDuGIr.exe
  2⤵
  PID:3380
- C:\Windows\System\QqXdhOL.exe
  C:\Windows\System\QqXdhOL.exe
  2⤵
  PID:2516
- C:\Windows\System\xGipOTo.exe
  C:\Windows\System\xGipOTo.exe
  2⤵
  PID:2228
- C:\Windows\System\xEXKYMW.exe
  C:\Windows\System\xEXKYMW.exe
  2⤵
  PID:3108
- C:\Windows\System\VukheTq.exe
  C:\Windows\System\VukheTq.exe
  2⤵
  PID:3176
- C:\Windows\System\RdDYOtc.exe
  C:\Windows\System\RdDYOtc.exe
  2⤵
  PID:3244
- C:\Windows\System\zptRFmi.exe
  C:\Windows\System\zptRFmi.exe
  2⤵
  PID:3312
- C:\Windows\System\lYzWytW.exe
  C:\Windows\System\lYzWytW.exe
  2⤵
  PID:3384
- C:\Windows\System\GXVaYXm.exe
  C:\Windows\System\GXVaYXm.exe
  2⤵
  PID:3448
- C:\Windows\System\GGijsWm.exe
  C:\Windows\System\GGijsWm.exe
  2⤵
  PID:3824
- C:\Windows\System\JXFZSoe.exe
  C:\Windows\System\JXFZSoe.exe
  2⤵
  PID:3840
- C:\Windows\System\UYAUXwP.exe
  C:\Windows\System\UYAUXwP.exe
  2⤵
  PID:3876
- C:\Windows\System\cflpkpF.exe
  C:\Windows\System\cflpkpF.exe
  2⤵
  PID:3940
- C:\Windows\System\SCjjWEO.exe
  C:\Windows\System\SCjjWEO.exe
  2⤵
  PID:4004
- C:\Windows\System\iqgdhTe.exe
  C:\Windows\System\iqgdhTe.exe
  2⤵
  PID:2476
- C:\Windows\System\VdiVPwg.exe
  C:\Windows\System\VdiVPwg.exe
  2⤵
  PID:4108
- C:\Windows\System\evxDqmR.exe
  C:\Windows\System\evxDqmR.exe
  2⤵
  PID:4124
- C:\Windows\System\YemFUco.exe
  C:\Windows\System\YemFUco.exe
  2⤵
  PID:4140
- C:\Windows\System\wUareSC.exe
  C:\Windows\System\wUareSC.exe
  2⤵
  PID:4156
- C:\Windows\System\ZkkyEMC.exe
  C:\Windows\System\ZkkyEMC.exe
  2⤵
  PID:4172
- C:\Windows\System\LfyIpBW.exe
  C:\Windows\System\LfyIpBW.exe
  2⤵
  PID:4192
- C:\Windows\System\CxMsATp.exe
  C:\Windows\System\CxMsATp.exe
  2⤵
  PID:4208
- C:\Windows\System\ClfOlGT.exe
  C:\Windows\System\ClfOlGT.exe
  2⤵
  PID:4224
- C:\Windows\System\fbqavnu.exe
  C:\Windows\System\fbqavnu.exe
  2⤵
  PID:4240
- C:\Windows\System\TRXJqwX.exe
  C:\Windows\System\TRXJqwX.exe
  2⤵
  PID:4256
- C:\Windows\System\hFTlflY.exe
  C:\Windows\System\hFTlflY.exe
  2⤵
  PID:4272
- C:\Windows\System\CEXdcEe.exe
  C:\Windows\System\CEXdcEe.exe
  2⤵
  PID:4292
- C:\Windows\System\rRbLqTO.exe
  C:\Windows\System\rRbLqTO.exe
  2⤵
  PID:4308
- C:\Windows\System\OlZzDAm.exe
  C:\Windows\System\OlZzDAm.exe
  2⤵
  PID:4324
- C:\Windows\System\yIlkhTZ.exe
  C:\Windows\System\yIlkhTZ.exe
  2⤵
  PID:4340
- C:\Windows\System\wJbYgrT.exe
  C:\Windows\System\wJbYgrT.exe
  2⤵
  PID:4356
- C:\Windows\System\migaeJT.exe
  C:\Windows\System\migaeJT.exe
  2⤵
  PID:4376
- C:\Windows\System\tvitKDp.exe
  C:\Windows\System\tvitKDp.exe
  2⤵
  PID:4392
- C:\Windows\System\PJENijL.exe
  C:\Windows\System\PJENijL.exe
  2⤵
  PID:4408
- C:\Windows\System\VOUweyc.exe
  C:\Windows\System\VOUweyc.exe
  2⤵
  PID:4424
- C:\Windows\System\JaanHMN.exe
  C:\Windows\System\JaanHMN.exe
  2⤵
  PID:4440
- C:\Windows\System\ACZVPYa.exe
  C:\Windows\System\ACZVPYa.exe
  2⤵
  PID:4456
- C:\Windows\System\RbwbSDv.exe
  C:\Windows\System\RbwbSDv.exe
  2⤵
  PID:4472
- C:\Windows\System\vbDacyi.exe
  C:\Windows\System\vbDacyi.exe
  2⤵
  PID:4492
- C:\Windows\System\SsfZlMD.exe
  C:\Windows\System\SsfZlMD.exe
  2⤵
  PID:4508
- C:\Windows\System\FkIuNMZ.exe
  C:\Windows\System\FkIuNMZ.exe
  2⤵
  PID:4524
- C:\Windows\System\SNePbAu.exe
  C:\Windows\System\SNePbAu.exe
  2⤵
  PID:4540
- C:\Windows\System\JrXDBeT.exe
  C:\Windows\System\JrXDBeT.exe
  2⤵
  PID:4556
- C:\Windows\System\oprkqTF.exe
  C:\Windows\System\oprkqTF.exe
  2⤵
  PID:4572
- C:\Windows\System\YdLRkVg.exe
  C:\Windows\System\YdLRkVg.exe
  2⤵
  PID:4588
- C:\Windows\System\Eoybzta.exe
  C:\Windows\System\Eoybzta.exe
  2⤵
  PID:4604
- C:\Windows\System\RiVuFOD.exe
  C:\Windows\System\RiVuFOD.exe
  2⤵
  PID:4624
- C:\Windows\System\GjhcULh.exe
  C:\Windows\System\GjhcULh.exe
  2⤵
  PID:4640
- C:\Windows\System\Xtebzjh.exe
  C:\Windows\System\Xtebzjh.exe
  2⤵
  PID:4656
- C:\Windows\System\qjuppwK.exe
  C:\Windows\System\qjuppwK.exe
  2⤵
  PID:4672
- C:\Windows\System\bxGUzYZ.exe
  C:\Windows\System\bxGUzYZ.exe
  2⤵
  PID:4688
- C:\Windows\System\rdJBipg.exe
  C:\Windows\System\rdJBipg.exe
  2⤵
  PID:4704
- C:\Windows\System\qBohBCQ.exe
  C:\Windows\System\qBohBCQ.exe
  2⤵
  PID:4720
- C:\Windows\System\kEvkdgi.exe
  C:\Windows\System\kEvkdgi.exe
  2⤵
  PID:4736
- C:\Windows\System\BuFsSOT.exe
  C:\Windows\System\BuFsSOT.exe
  2⤵
  PID:4752
- C:\Windows\System\cpvyDRF.exe
  C:\Windows\System\cpvyDRF.exe
  2⤵
  PID:4768
- C:\Windows\System\WbBKFwQ.exe
  C:\Windows\System\WbBKFwQ.exe
  2⤵
  PID:4792
- C:\Windows\System\tCjlLVB.exe
  C:\Windows\System\tCjlLVB.exe
  2⤵
  PID:4808
- C:\Windows\System\uYDjxzO.exe
  C:\Windows\System\uYDjxzO.exe
  2⤵
  PID:4824
- C:\Windows\System\ZrdaZKz.exe
  C:\Windows\System\ZrdaZKz.exe
  2⤵
  PID:4840
- C:\Windows\System\HKIRiNG.exe
  C:\Windows\System\HKIRiNG.exe
  2⤵
  PID:4860
- C:\Windows\System\jQwPDIm.exe
  C:\Windows\System\jQwPDIm.exe
  2⤵
  PID:4876
- C:\Windows\System\BRWTseW.exe
  C:\Windows\System\BRWTseW.exe
  2⤵
  PID:4892
- C:\Windows\System\BGYcrHR.exe
  C:\Windows\System\BGYcrHR.exe
  2⤵
  PID:4908
- C:\Windows\System\npzNLdp.exe
  C:\Windows\System\npzNLdp.exe
  2⤵
  PID:4924
- C:\Windows\System\GLlQeNr.exe
  C:\Windows\System\GLlQeNr.exe
  2⤵
  PID:4940
- C:\Windows\System\sHnAyQm.exe
  C:\Windows\System\sHnAyQm.exe
  2⤵
  PID:4956
- C:\Windows\System\GfmkKbn.exe
  C:\Windows\System\GfmkKbn.exe
  2⤵
  PID:4972
- C:\Windows\System\PJngFLw.exe
  C:\Windows\System\PJngFLw.exe
  2⤵
  PID:4988
- C:\Windows\System\xFDnmRg.exe
  C:\Windows\System\xFDnmRg.exe
  2⤵
  PID:5004
- C:\Windows\System\jkyCvIz.exe
  C:\Windows\System\jkyCvIz.exe
  2⤵
  PID:5020
- C:\Windows\System\TOflwil.exe
  C:\Windows\System\TOflwil.exe
  2⤵
  PID:5036
- C:\Windows\System\MmsSRkD.exe
  C:\Windows\System\MmsSRkD.exe
  2⤵
  PID:5052
- C:\Windows\System\dHJaYCW.exe
  C:\Windows\System\dHJaYCW.exe
  2⤵
  PID:5068
- C:\Windows\System\RIrndEC.exe
  C:\Windows\System\RIrndEC.exe
  2⤵
  PID:5084
- C:\Windows\System\xSNROqS.exe
  C:\Windows\System\xSNROqS.exe
  2⤵
  PID:5100
- C:\Windows\System\chuoIqo.exe
  C:\Windows\System\chuoIqo.exe
  2⤵
  PID:5116
- C:\Windows\System\mFhPgQv.exe
  C:\Windows\System\mFhPgQv.exe
  2⤵
  PID:3364
- C:\Windows\System\xBzvNWK.exe
  C:\Windows\System\xBzvNWK.exe
  2⤵
  PID:3728
- C:\Windows\System\HjbJjCQ.exe
  C:\Windows\System\HjbJjCQ.exe
  2⤵
  PID:5124
- C:\Windows\System\BzpnOeg.exe
  C:\Windows\System\BzpnOeg.exe
  2⤵
  PID:5144
- C:\Windows\System\QBpyXHA.exe
  C:\Windows\System\QBpyXHA.exe
  2⤵
  PID:5160
- C:\Windows\System\HqBQfwC.exe
  C:\Windows\System\HqBQfwC.exe
  2⤵
  PID:5176
- C:\Windows\System\IkOZzOl.exe
  C:\Windows\System\IkOZzOl.exe
  2⤵
  PID:5192
- C:\Windows\System\sUBPomR.exe
  C:\Windows\System\sUBPomR.exe
  2⤵
  PID:5208
- C:\Windows\System\MuwXPmy.exe
  C:\Windows\System\MuwXPmy.exe
  2⤵
  PID:5224
- C:\Windows\System\hzCTcRa.exe
  C:\Windows\System\hzCTcRa.exe
  2⤵
  PID:5240
- C:\Windows\System\qvsuaFY.exe
  C:\Windows\System\qvsuaFY.exe
  2⤵
  PID:5256
- C:\Windows\System\uPJNOsP.exe
  C:\Windows\System\uPJNOsP.exe
  2⤵
  PID:5272
- C:\Windows\System\WKABsoL.exe
  C:\Windows\System\WKABsoL.exe
  2⤵
  PID:5288
- C:\Windows\System\MAUWBNN.exe
  C:\Windows\System\MAUWBNN.exe
  2⤵
  PID:5304
- C:\Windows\System\assdQpx.exe
  C:\Windows\System\assdQpx.exe
  2⤵
  PID:5324
- C:\Windows\System\VsZMylt.exe
  C:\Windows\System\VsZMylt.exe
  2⤵
  PID:5340
- C:\Windows\System\AWpvVJu.exe
  C:\Windows\System\AWpvVJu.exe
  2⤵
  PID:5356
- C:\Windows\System\YGNjyhy.exe
  C:\Windows\System\YGNjyhy.exe
  2⤵
  PID:5372
- C:\Windows\System\aPYiwsn.exe
  C:\Windows\System\aPYiwsn.exe
  2⤵
  PID:5388
- C:\Windows\System\BkpGcnm.exe
  C:\Windows\System\BkpGcnm.exe
  2⤵
  PID:5404
- C:\Windows\System\UrDFJYQ.exe
  C:\Windows\System\UrDFJYQ.exe
  2⤵
  PID:5420
- C:\Windows\System\jUilaDJ.exe
  C:\Windows\System\jUilaDJ.exe
  2⤵
  PID:5436
- C:\Windows\System\TUfNGzK.exe
  C:\Windows\System\TUfNGzK.exe
  2⤵
  PID:5452
- C:\Windows\System\SbuUzgA.exe
  C:\Windows\System\SbuUzgA.exe
  2⤵
  PID:5472
- C:\Windows\System\IlOtWrW.exe
  C:\Windows\System\IlOtWrW.exe
  2⤵
  PID:5488
- C:\Windows\System\pPxtGil.exe
  C:\Windows\System\pPxtGil.exe
  2⤵
  PID:5504
- C:\Windows\System\vkZWbsh.exe
  C:\Windows\System\vkZWbsh.exe
  2⤵
  PID:5520
- C:\Windows\System\pvnzUPe.exe
  C:\Windows\System\pvnzUPe.exe
  2⤵
  PID:5536
- C:\Windows\System\ydrykRu.exe
  C:\Windows\System\ydrykRu.exe
  2⤵
  PID:5552
- C:\Windows\System\ygllSaL.exe
  C:\Windows\System\ygllSaL.exe
  2⤵
  PID:5568
- C:\Windows\System\nzVjYUW.exe
  C:\Windows\System\nzVjYUW.exe
  2⤵
  PID:5584
- C:\Windows\System\oAIWgMi.exe
  C:\Windows\System\oAIWgMi.exe
  2⤵
  PID:5600
- C:\Windows\System\iunjkGt.exe
  C:\Windows\System\iunjkGt.exe
  2⤵
  PID:5616
- C:\Windows\System\JkzMypC.exe
  C:\Windows\System\JkzMypC.exe
  2⤵
  PID:5632
- C:\Windows\System\tZaVnhe.exe
  C:\Windows\System\tZaVnhe.exe
  2⤵
  PID:5652
- C:\Windows\System\FHItLOT.exe
  C:\Windows\System\FHItLOT.exe
  2⤵
  PID:5668
- C:\Windows\System\YfNQnpk.exe
  C:\Windows\System\YfNQnpk.exe
  2⤵
  PID:5684
- C:\Windows\System\BWyrtVv.exe
  C:\Windows\System\BWyrtVv.exe
  2⤵
  PID:5700
- C:\Windows\System\uglEjzr.exe
  C:\Windows\System\uglEjzr.exe
  2⤵
  PID:5716
- C:\Windows\System\QtuHdTT.exe
  C:\Windows\System\QtuHdTT.exe
  2⤵
  PID:5732
- C:\Windows\System\aHNakKm.exe
  C:\Windows\System\aHNakKm.exe
  2⤵
  PID:5748
- C:\Windows\System\WZZDkgA.exe
  C:\Windows\System\WZZDkgA.exe
  2⤵
  PID:5764
- C:\Windows\System\OPzCDRO.exe
  C:\Windows\System\OPzCDRO.exe
  2⤵
  PID:5784
- C:\Windows\System\jgSSLAZ.exe
  C:\Windows\System\jgSSLAZ.exe
  2⤵
  PID:5800
- C:\Windows\System\iizQaRU.exe
  C:\Windows\System\iizQaRU.exe
  2⤵
  PID:5988
- C:\Windows\System\Uodwhtt.exe
  C:\Windows\System\Uodwhtt.exe
  2⤵
  PID:6012
- C:\Windows\System\irSzSWQ.exe
  C:\Windows\System\irSzSWQ.exe
  2⤵
  PID:6028
- C:\Windows\System\ZPtsvQT.exe
  C:\Windows\System\ZPtsvQT.exe
  2⤵
  PID:6044
- C:\Windows\System\WykOKmY.exe
  C:\Windows\System\WykOKmY.exe
  2⤵
  PID:6060
- C:\Windows\System\iQTJfJl.exe
  C:\Windows\System\iQTJfJl.exe
  2⤵
  PID:6076
- C:\Windows\System\eDvkoEJ.exe
  C:\Windows\System\eDvkoEJ.exe
  2⤵
  PID:6092
- C:\Windows\System\qgvxRdB.exe
  C:\Windows\System\qgvxRdB.exe
  2⤵
  PID:6108
- C:\Windows\System\RCGigwa.exe
  C:\Windows\System\RCGigwa.exe
  2⤵
  PID:6124
- C:\Windows\System\BfvDCAZ.exe
  C:\Windows\System\BfvDCAZ.exe
  2⤵
  PID:6140
- C:\Windows\System\oROeaez.exe
  C:\Windows\System\oROeaez.exe
  2⤵
  PID:3732
- C:\Windows\System\yxfbCXO.exe
  C:\Windows\System\yxfbCXO.exe
  2⤵
  PID:3784
- C:\Windows\System\fGmvCom.exe
  C:\Windows\System\fGmvCom.exe
  2⤵
  PID:3808
- C:\Windows\System\eJhXwyw.exe
  C:\Windows\System\eJhXwyw.exe
  2⤵
  PID:1288
- C:\Windows\System\zLXAvdu.exe
  C:\Windows\System\zLXAvdu.exe
  2⤵
  PID:3712
- C:\Windows\System\oAOomoC.exe
  C:\Windows\System\oAOomoC.exe
  2⤵
  PID:2752
- C:\Windows\System\tydQOft.exe
  C:\Windows\System\tydQOft.exe
  2⤵
  PID:3280
- C:\Windows\System\PqVdYKn.exe
  C:\Windows\System\PqVdYKn.exe
  2⤵
  PID:3860
- C:\Windows\System\GBfJEYB.exe
  C:\Windows\System\GBfJEYB.exe
  2⤵
  PID:3932
- C:\Windows\System\iBYbzzs.exe
  C:\Windows\System\iBYbzzs.exe
  2⤵
  PID:2960
- C:\Windows\System\xshozyj.exe
  C:\Windows\System\xshozyj.exe
  2⤵
  PID:4200
- C:\Windows\System\cjcYAOp.exe
  C:\Windows\System\cjcYAOp.exe
  2⤵
  PID:4232
- C:\Windows\System\UQLzUuq.exe
  C:\Windows\System\UQLzUuq.exe
  2⤵
  PID:4332
- C:\Windows\System\PyNjPMR.exe
  C:\Windows\System\PyNjPMR.exe
  2⤵
  PID:4216
- C:\Windows\System\BtMalfv.exe
  C:\Windows\System\BtMalfv.exe
  2⤵
  PID:4280
- C:\Windows\System\JZnNMwI.exe
  C:\Windows\System\JZnNMwI.exe
  2⤵
  PID:4400
- C:\Windows\System\fydsFYp.exe
  C:\Windows\System\fydsFYp.exe
  2⤵
  PID:4352
- C:\Windows\System\mgudtcE.exe
  C:\Windows\System\mgudtcE.exe
  2⤵
  PID:4420
- C:\Windows\System\pfYsHnk.exe
  C:\Windows\System\pfYsHnk.exe
  2⤵
  PID:3956
- C:\Windows\System\dkmYKhJ.exe
  C:\Windows\System\dkmYKhJ.exe
  2⤵
  PID:4536
- C:\Windows\System\DfKIaIr.exe
  C:\Windows\System\DfKIaIr.exe
  2⤵
  PID:4600
- C:\Windows\System\skOmJFB.exe
  C:\Windows\System\skOmJFB.exe
  2⤵
  PID:4636
- C:\Windows\System\jefkgYe.exe
  C:\Windows\System\jefkgYe.exe
  2⤵
  PID:4728
- C:\Windows\System\UhBPrkC.exe
  C:\Windows\System\UhBPrkC.exe
  2⤵
  PID:4800
- C:\Windows\System\hJGjQwr.exe
  C:\Windows\System\hJGjQwr.exe
  2⤵
  PID:4868
- C:\Windows\System\tGrNrKg.exe
  C:\Windows\System\tGrNrKg.exe
  2⤵
  PID:4996
- C:\Windows\System\MYJvjcN.exe
  C:\Windows\System\MYJvjcN.exe
  2⤵
  PID:3224
- C:\Windows\System\hMkZHkU.exe
  C:\Windows\System\hMkZHkU.exe
  2⤵
  PID:5032
- C:\Windows\System\YDjXYmU.exe
  C:\Windows\System\YDjXYmU.exe
  2⤵
  PID:3888
- C:\Windows\System\bOuBmeN.exe
  C:\Windows\System\bOuBmeN.exe
  2⤵
  PID:4484
- C:\Windows\System\pLBJDSy.exe
  C:\Windows\System\pLBJDSy.exe
  2⤵
  PID:5188
- C:\Windows\System\TDZbudP.exe
  C:\Windows\System\TDZbudP.exe
  2⤵
  PID:5280
- C:\Windows\System\lJHXbyq.exe
  C:\Windows\System\lJHXbyq.exe
  2⤵
  PID:4520
- C:\Windows\System\FvZrWYS.exe
  C:\Windows\System\FvZrWYS.exe
  2⤵
  PID:5352
- C:\Windows\System\qIIkTEH.exe
  C:\Windows\System\qIIkTEH.exe
  2⤵
  PID:5416
- C:\Windows\System\jptziiz.exe
  C:\Windows\System\jptziiz.exe
  2⤵
  PID:5484
- C:\Windows\System\nsLkmlF.exe
  C:\Windows\System\nsLkmlF.exe
  2⤵
  PID:4584
- C:\Windows\System\DChJcou.exe
  C:\Windows\System\DChJcou.exe
  2⤵
  PID:4652
- C:\Windows\System\dyDXcJh.exe
  C:\Windows\System\dyDXcJh.exe
  2⤵
  PID:5644
- C:\Windows\System\WwMsVEa.exe
  C:\Windows\System\WwMsVEa.exe
  2⤵
  PID:4712
- C:\Windows\System\zBraBzz.exe
  C:\Windows\System\zBraBzz.exe
  2⤵
  PID:5772
- C:\Windows\System\SZEdWBN.exe
  C:\Windows\System\SZEdWBN.exe
  2⤵
  PID:3124
- C:\Windows\System\IFnBjxZ.exe
  C:\Windows\System\IFnBjxZ.exe
  2⤵
  PID:4744
- C:\Windows\System\TmzfPeg.exe
  C:\Windows\System\TmzfPeg.exe
  2⤵
  PID:3212
- C:\Windows\System\KYqphba.exe
  C:\Windows\System\KYqphba.exe
  2⤵
  PID:4132
- C:\Windows\System\HwqhETx.exe
  C:\Windows\System\HwqhETx.exe
  2⤵
  PID:4436
- C:\Windows\System\fruXSRc.exe
  C:\Windows\System\fruXSRc.exe
  2⤵
  PID:3988
- C:\Windows\System\qqLCuNC.exe
  C:\Windows\System\qqLCuNC.exe
  2⤵
  PID:4084
- C:\Windows\System\WTiQvYx.exe
  C:\Windows\System\WTiQvYx.exe
  2⤵
  PID:5316
- C:\Windows\System\ypilgGL.exe
  C:\Windows\System\ypilgGL.exe
  2⤵
  PID:3292
- C:\Windows\System\BvtFdig.exe
  C:\Windows\System\BvtFdig.exe
  2⤵
  PID:5812
- C:\Windows\System\qBbmMIE.exe
  C:\Windows\System\qBbmMIE.exe
  2⤵
  PID:2700
- C:\Windows\System\DSzwVHw.exe
  C:\Windows\System\DSzwVHw.exe
  2⤵
  PID:3760
- C:\Windows\System\kZkjvpm.exe
  C:\Windows\System\kZkjvpm.exe
  2⤵
  PID:3804
- C:\Windows\System\qpBKxOr.exe
  C:\Windows\System\qpBKxOr.exe
  2⤵
  PID:2468
- C:\Windows\System\EyZauiI.exe
  C:\Windows\System\EyZauiI.exe
  2⤵
  PID:2460
- C:\Windows\System\mCLGkDw.exe
  C:\Windows\System\mCLGkDw.exe
  2⤵
  PID:3208
- C:\Windows\System\wEMPBjE.exe
  C:\Windows\System\wEMPBjE.exe
  2⤵
  PID:5924
- C:\Windows\System\rdJbJwz.exe
  C:\Windows\System\rdJbJwz.exe
  2⤵
  PID:4164
- C:\Windows\System\JEDRGiL.exe
  C:\Windows\System\JEDRGiL.exe
  2⤵
  PID:5248
- C:\Windows\System\MUHrnCf.exe
  C:\Windows\System\MUHrnCf.exe
  2⤵
  PID:5820
- C:\Windows\System\InoTKgu.exe
  C:\Windows\System\InoTKgu.exe
  2⤵
  PID:5844
- C:\Windows\System\BwvonmG.exe
  C:\Windows\System\BwvonmG.exe
  2⤵
  PID:5864
- C:\Windows\System\TdJXtNz.exe
  C:\Windows\System\TdJXtNz.exe
  2⤵
  PID:5876
- C:\Windows\System\VEheiHL.exe
  C:\Windows\System\VEheiHL.exe
  2⤵
  PID:5048
- C:\Windows\System\kLyxrIJ.exe
  C:\Windows\System\kLyxrIJ.exe
  2⤵
  PID:5112
- C:\Windows\System\jUNDfUw.exe
  C:\Windows\System\jUNDfUw.exe
  2⤵
  PID:5136
- C:\Windows\System\WFHRWuN.exe
  C:\Windows\System\WFHRWuN.exe
  2⤵
  PID:5232
- C:\Windows\System\kHEPYzu.exe
  C:\Windows\System\kHEPYzu.exe
  2⤵
  PID:5300
- C:\Windows\System\CnbazsZ.exe
  C:\Windows\System\CnbazsZ.exe
  2⤵
  PID:5364
- C:\Windows\System\QbHgAGt.exe
  C:\Windows\System\QbHgAGt.exe
  2⤵
  PID:5428
- C:\Windows\System\wLfkwjb.exe
  C:\Windows\System\wLfkwjb.exe
  2⤵
  PID:5496
- C:\Windows\System\QsvVIAb.exe
  C:\Windows\System\QsvVIAb.exe
  2⤵
  PID:5532
- C:\Windows\System\OrOCvCU.exe
  C:\Windows\System\OrOCvCU.exe
  2⤵
  PID:5596
- C:\Windows\System\VPzhWyU.exe
  C:\Windows\System\VPzhWyU.exe
  2⤵
  PID:5664
- C:\Windows\System\fysNaYZ.exe
  C:\Windows\System\fysNaYZ.exe
  2⤵
  PID:5728
- C:\Windows\System\LmxRgQj.exe
  C:\Windows\System\LmxRgQj.exe
  2⤵
  PID:5792
- C:\Windows\System\TECFhuW.exe
  C:\Windows\System\TECFhuW.exe
  2⤵
  PID:6008
- C:\Windows\System\ywZMSrH.exe
  C:\Windows\System\ywZMSrH.exe
  2⤵
  PID:6072
- C:\Windows\System\jSBiqKA.exe
  C:\Windows\System\jSBiqKA.exe
  2⤵
  PID:3796
- C:\Windows\System\YlxyQJG.exe
  C:\Windows\System\YlxyQJG.exe
  2⤵
  PID:4072
- C:\Windows\System\FLzerao.exe
  C:\Windows\System\FLzerao.exe
  2⤵
  PID:3444
- C:\Windows\System\qbfPOKX.exe
  C:\Windows\System\qbfPOKX.exe
  2⤵
  PID:3856
- C:\Windows\System\DHPHHJc.exe
  C:\Windows\System\DHPHHJc.exe
  2⤵
  PID:4068
- C:\Windows\System\haPYJFt.exe
  C:\Windows\System\haPYJFt.exe
  2⤵
  PID:4288
- C:\Windows\System\lXnufsU.exe
  C:\Windows\System\lXnufsU.exe
  2⤵
  PID:4532
- C:\Windows\System\SxuuWWA.exe
  C:\Windows\System\SxuuWWA.exe
  2⤵
  PID:4696
- C:\Windows\System\VlVUXCd.exe
  C:\Windows\System\VlVUXCd.exe
  2⤵
  PID:4764
- C:\Windows\System\VGiJSUH.exe
  C:\Windows\System\VGiJSUH.exe
  2⤵
  PID:6120
- C:\Windows\System\IyoZhKh.exe
  C:\Windows\System\IyoZhKh.exe
  2⤵
  PID:4836
- C:\Windows\System\bIamSrF.exe
  C:\Windows\System\bIamSrF.exe
  2⤵
  PID:3352
- C:\Windows\System\FAiIoNj.exe
  C:\Windows\System\FAiIoNj.exe
  2⤵
  PID:5156
- C:\Windows\System\wTcdgyi.exe
  C:\Windows\System\wTcdgyi.exe
  2⤵
  PID:4320
- C:\Windows\System\bpjoMjG.exe
  C:\Windows\System\bpjoMjG.exe
  2⤵
  PID:4480
- C:\Windows\System\HiKqzSy.exe
  C:\Windows\System\HiKqzSy.exe
  2⤵
  PID:5096
- C:\Windows\System\AQkfLle.exe
  C:\Windows\System\AQkfLle.exe
  2⤵
  PID:5348
- C:\Windows\System\xBegfJD.exe
  C:\Windows\System\xBegfJD.exe
  2⤵
  PID:4832
- C:\Windows\System\CPdcocl.exe
  C:\Windows\System\CPdcocl.exe
  2⤵
  PID:4516
- C:\Windows\System\euyZBGl.exe
  C:\Windows\System\euyZBGl.exe
  2⤵
  PID:5412
- C:\Windows\System\JcsnmSi.exe
  C:\Windows\System\JcsnmSi.exe
  2⤵
  PID:5612
- C:\Windows\System\DZHUgPv.exe
  C:\Windows\System\DZHUgPv.exe
  2⤵
  PID:3684
- C:\Windows\System\EcLpqiA.exe
  C:\Windows\System\EcLpqiA.exe
  2⤵
  PID:4000
- C:\Windows\System\bLQDWuc.exe
  C:\Windows\System\bLQDWuc.exe
  2⤵
  PID:5916
- C:\Windows\System\CTRhNUG.exe
  C:\Windows\System\CTRhNUG.exe
  2⤵
  PID:5928
- C:\Windows\System\ARcOyav.exe
  C:\Windows\System\ARcOyav.exe
  2⤵
  PID:3748
- C:\Windows\System\RgIroKH.exe
  C:\Windows\System\RgIroKH.exe
  2⤵
  PID:4464
- C:\Windows\System\FghxRNc.exe
  C:\Windows\System\FghxRNc.exe
  2⤵
  PID:3872
- C:\Windows\System\wQbirxJ.exe
  C:\Windows\System\wQbirxJ.exe
  2⤵
  PID:5944
- C:\Windows\System\SqzdKPL.exe
  C:\Windows\System\SqzdKPL.exe
  2⤵
  PID:5680
- C:\Windows\System\TgoeDsG.exe
  C:\Windows\System\TgoeDsG.exe
  2⤵
  PID:5140
- C:\Windows\System\CIWpRmq.exe
  C:\Windows\System\CIWpRmq.exe
  2⤵
  PID:3780
- C:\Windows\System\ONbvovh.exe
  C:\Windows\System\ONbvovh.exe
  2⤵
  PID:5012
- C:\Windows\System\hAjRMSX.exe
  C:\Windows\System\hAjRMSX.exe
  2⤵
  PID:5108
- C:\Windows\System\dkTmYAV.exe
  C:\Windows\System\dkTmYAV.exe
  2⤵
  PID:5132
- C:\Windows\System\jjIOowU.exe
  C:\Windows\System\jjIOowU.exe
  2⤵
  PID:5336
- C:\Windows\System\JHiEtcI.exe
  C:\Windows\System\JHiEtcI.exe
  2⤵
  PID:5400
- C:\Windows\System\JAMyfkE.exe
  C:\Windows\System\JAMyfkE.exe
  2⤵
  PID:2992
- C:\Windows\System\qajdnBc.exe
  C:\Windows\System\qajdnBc.exe
  2⤵
  PID:5628
- C:\Windows\System\WSeGBQG.exe
  C:\Windows\System\WSeGBQG.exe
  2⤵
  PID:5724
- C:\Windows\System\qOxcsLk.exe
  C:\Windows\System\qOxcsLk.exe
  2⤵
  PID:5996
- C:\Windows\System\JXjvLvZ.exe
  C:\Windows\System\JXjvLvZ.exe
  2⤵
  PID:6136
- C:\Windows\System\UWPtRyF.exe
  C:\Windows\System\UWPtRyF.exe
  2⤵
  PID:1860
- C:\Windows\System\AZVrlbI.exe
  C:\Windows\System\AZVrlbI.exe
  2⤵
  PID:4368
- C:\Windows\System\HlSIUnL.exe
  C:\Windows\System\HlSIUnL.exe
  2⤵
  PID:3628
- C:\Windows\System\YYSBuSu.exe
  C:\Windows\System\YYSBuSu.exe
  2⤵
  PID:4904
- C:\Windows\System\MyPYmnA.exe
  C:\Windows\System\MyPYmnA.exe
  2⤵
  PID:4980
- C:\Windows\System\ApTBgWc.exe
  C:\Windows\System\ApTBgWc.exe
  2⤵
  PID:3148
- C:\Windows\System\aucrCAj.exe
  C:\Windows\System\aucrCAj.exe
  2⤵
  PID:4152
- C:\Windows\System\hldDlkg.exe
  C:\Windows\System\hldDlkg.exe
  2⤵
  PID:4348
- C:\Windows\System\EQJURPC.exe
  C:\Windows\System\EQJURPC.exe
  2⤵
  PID:4488
- C:\Windows\System\AKztZio.exe
  C:\Windows\System\AKztZio.exe
  2⤵
  PID:4700
- C:\Windows\System\YXOzWxx.exe
  C:\Windows\System\YXOzWxx.exe
  2⤵
  PID:5444
- C:\Windows\System\ZmJLDrA.exe
  C:\Windows\System\ZmJLDrA.exe
  2⤵
  PID:4716
- C:\Windows\System\HifarUU.exe
  C:\Windows\System\HifarUU.exe
  2⤵
  PID:3816
- C:\Windows\System\EpUpNgq.exe
  C:\Windows\System\EpUpNgq.exe
  2⤵
  PID:5976
- C:\Windows\System\aXtanpB.exe
  C:\Windows\System\aXtanpB.exe
  2⤵
  PID:2828
- C:\Windows\System\zcIKztx.exe
  C:\Windows\System\zcIKztx.exe
  2⤵
  PID:4780
- C:\Windows\System\SKuBDQm.exe
  C:\Windows\System\SKuBDQm.exe
  2⤵
  PID:4820
- C:\Windows\System\pdIkWuO.exe
  C:\Windows\System\pdIkWuO.exe
  2⤵
  PID:5888
- C:\Windows\System\RAwRZQL.exe
  C:\Windows\System\RAwRZQL.exe
  2⤵
  PID:5904
- C:\Windows\System\eaIYqDC.exe
  C:\Windows\System\eaIYqDC.exe
  2⤵
  PID:5932
- C:\Windows\System\hlVfvaZ.exe
  C:\Windows\System\hlVfvaZ.exe
  2⤵
  PID:1064
- C:\Windows\System\VniQFrI.exe
  C:\Windows\System\VniQFrI.exe
  2⤵
  PID:2788
- C:\Windows\System\LJfDhkm.exe
  C:\Windows\System\LJfDhkm.exe
  2⤵
  PID:4748
- C:\Windows\System\TIJanDY.exe
  C:\Windows\System\TIJanDY.exe
  2⤵
  PID:2140
- C:\Windows\System\jcCVrIu.exe
  C:\Windows\System\jcCVrIu.exe
  2⤵
  PID:5028
- C:\Windows\System\DsjGwGQ.exe
  C:\Windows\System\DsjGwGQ.exe
  2⤵
  PID:6160
- C:\Windows\System\OzkjwJj.exe
  C:\Windows\System\OzkjwJj.exe
  2⤵
  PID:6176
- C:\Windows\System\psHfKzO.exe
  C:\Windows\System\psHfKzO.exe
  2⤵
  PID:6192
- C:\Windows\System\DvNccHW.exe
  C:\Windows\System\DvNccHW.exe
  2⤵
  PID:6208
- C:\Windows\System\oCWmQdY.exe
  C:\Windows\System\oCWmQdY.exe
  2⤵
  PID:6224
- C:\Windows\System\ieSEBNT.exe
  C:\Windows\System\ieSEBNT.exe
  2⤵
  PID:6240
- C:\Windows\System\CEWbFNq.exe
  C:\Windows\System\CEWbFNq.exe
  2⤵
  PID:6260
- C:\Windows\System\NcDbzeT.exe
  C:\Windows\System\NcDbzeT.exe
  2⤵
  PID:6276
- C:\Windows\System\tDcqkeD.exe
  C:\Windows\System\tDcqkeD.exe
  2⤵
  PID:6292
- C:\Windows\System\UlZfILU.exe
  C:\Windows\System\UlZfILU.exe
  2⤵
  PID:6308
- C:\Windows\System\rBlKsFw.exe
  C:\Windows\System\rBlKsFw.exe
  2⤵
  PID:6328
- C:\Windows\System\husOrBr.exe
  C:\Windows\System\husOrBr.exe
  2⤵
  PID:6348
- C:\Windows\System\IhEaptb.exe
  C:\Windows\System\IhEaptb.exe
  2⤵
  PID:6364
- C:\Windows\System\UdyreZu.exe
  C:\Windows\System\UdyreZu.exe
  2⤵
  PID:6384
- C:\Windows\System\JRlpTBf.exe
  C:\Windows\System\JRlpTBf.exe
  2⤵
  PID:6400
- C:\Windows\System\hyBFuKV.exe
  C:\Windows\System\hyBFuKV.exe
  2⤵
  PID:6416
- C:\Windows\System\BsMlmLD.exe
  C:\Windows\System\BsMlmLD.exe
  2⤵
  PID:6448
- C:\Windows\System\WEVMTMV.exe
  C:\Windows\System\WEVMTMV.exe
  2⤵
  PID:6464
- C:\Windows\System\CkcBZRt.exe
  C:\Windows\System\CkcBZRt.exe
  2⤵
  PID:6488
- C:\Windows\System\RKCduvz.exe
  C:\Windows\System\RKCduvz.exe
  2⤵
  PID:6508
- C:\Windows\System\stWRRtG.exe
  C:\Windows\System\stWRRtG.exe
  2⤵
  PID:6524
- C:\Windows\System\rMoVDty.exe
  C:\Windows\System\rMoVDty.exe
  2⤵
  PID:6540
- C:\Windows\System\lKGMNxI.exe
  C:\Windows\System\lKGMNxI.exe
  2⤵
  PID:6560
- C:\Windows\System\SAwLaly.exe
  C:\Windows\System\SAwLaly.exe
  2⤵
  PID:6576
- C:\Windows\System\ydUwjpq.exe
  C:\Windows\System\ydUwjpq.exe
  2⤵
  PID:6592
- C:\Windows\System\PezOInD.exe
  C:\Windows\System\PezOInD.exe
  2⤵
  PID:6608
- C:\Windows\System\ockWlEh.exe
  C:\Windows\System\ockWlEh.exe
  2⤵
  PID:6624
- C:\Windows\System\cekaNSS.exe
  C:\Windows\System\cekaNSS.exe
  2⤵
  PID:6640
- C:\Windows\System\lhRnMeN.exe
  C:\Windows\System\lhRnMeN.exe
  2⤵
  PID:6656
- C:\Windows\System\OOUAomg.exe
  C:\Windows\System\OOUAomg.exe
  2⤵
  PID:6672
- C:\Windows\System\MaiVMfk.exe
  C:\Windows\System\MaiVMfk.exe
  2⤵
  PID:6692
- C:\Windows\System\TDcfRNu.exe
  C:\Windows\System\TDcfRNu.exe
  2⤵
  PID:6760
- C:\Windows\System\XJkCSKc.exe
  C:\Windows\System\XJkCSKc.exe
  2⤵
  PID:6832
- C:\Windows\System\HtNKaLR.exe
  C:\Windows\System\HtNKaLR.exe
  2⤵
  PID:6872
- C:\Windows\System\NmMCTCm.exe
  C:\Windows\System\NmMCTCm.exe
  2⤵
  PID:7148
- C:\Windows\System\VkESeMO.exe
  C:\Windows\System\VkESeMO.exe
  2⤵
  PID:5952
- C:\Windows\System\UmiWDFa.exe
  C:\Windows\System\UmiWDFa.exe
  2⤵
  PID:4984
- C:\Windows\System\pdTGNXc.exe
  C:\Windows\System\pdTGNXc.exe
  2⤵
  PID:5468
- C:\Windows\System\QagUBqx.exe
  C:\Windows\System\QagUBqx.exe
  2⤵
  PID:6020
- C:\Windows\System\DQCzmig.exe
  C:\Windows\System\DQCzmig.exe
  2⤵
  PID:4188
- C:\Windows\System\bPTrgiB.exe
  C:\Windows\System\bPTrgiB.exe
  2⤵
  PID:4268
- C:\Windows\System\kNgrnFN.exe
  C:\Windows\System\kNgrnFN.exe
  2⤵
  PID:5576
- C:\Windows\System\PglJtsz.exe
  C:\Windows\System\PglJtsz.exe
  2⤵
  PID:4784
- C:\Windows\System\VAFbMjX.exe
  C:\Windows\System\VAFbMjX.exe
  2⤵
  PID:5816
- C:\Windows\System\NyGYiMo.exe
  C:\Windows\System\NyGYiMo.exe
  2⤵
  PID:3432
- C:\Windows\System\aWayCXu.exe
  C:\Windows\System\aWayCXu.exe
  2⤵
  PID:6188
- C:\Windows\System\ZAGbyhU.exe
  C:\Windows\System\ZAGbyhU.exe
  2⤵
  PID:6252
- C:\Windows\System\WNjfvAd.exe
  C:\Windows\System\WNjfvAd.exe
  2⤵
  PID:6316
- C:\Windows\System\VmyzasT.exe
  C:\Windows\System\VmyzasT.exe
  2⤵
  PID:6432
- C:\Windows\System\gaRCPiP.exe
  C:\Windows\System\gaRCPiP.exe
  2⤵
  PID:6472
- C:\Windows\System\qNHIiNn.exe
  C:\Windows\System\qNHIiNn.exe
  2⤵
  PID:5836
- C:\Windows\System\ycUONtm.exe
  C:\Windows\System\ycUONtm.exe
  2⤵
  PID:6556
- C:\Windows\System\mnxPXcg.exe
  C:\Windows\System\mnxPXcg.exe
  2⤵
  PID:6680
- C:\Windows\System\tBoIRUe.exe
  C:\Windows\System\tBoIRUe.exe
  2⤵
  PID:6392
- C:\Windows\System\qrLuCvv.exe
  C:\Windows\System\qrLuCvv.exe
  2⤵
  PID:6616
- C:\Windows\System\FZiJgZi.exe
  C:\Windows\System\FZiJgZi.exe
  2⤵
  PID:6688
- C:\Windows\System\zNKLZGU.exe
  C:\Windows\System\zNKLZGU.exe
  2⤵
  PID:6636
- C:\Windows\System\BqvOESR.exe
  C:\Windows\System\BqvOESR.exe
  2⤵
  PID:5980
- C:\Windows\System\btLIJrM.exe
  C:\Windows\System\btLIJrM.exe
  2⤵
  PID:5264
- C:\Windows\System\scCxwdn.exe
  C:\Windows\System\scCxwdn.exe
  2⤵
  PID:5560
- C:\Windows\System\TarlEGe.exe
  C:\Windows\System\TarlEGe.exe
  2⤵
  PID:6100
- C:\Windows\System\MBneOHp.exe
  C:\Windows\System\MBneOHp.exe
  2⤵
  PID:6116
- C:\Windows\System\vKjFwQt.exe
  C:\Windows\System\vKjFwQt.exe
  2⤵
  PID:5252
- C:\Windows\System\kFtldXx.exe
  C:\Windows\System\kFtldXx.exe
  2⤵
  PID:4648
- C:\Windows\System\ELgLWWq.exe
  C:\Windows\System\ELgLWWq.exe
  2⤵
  PID:5740
- C:\Windows\System\nHlMGjP.exe
  C:\Windows\System\nHlMGjP.exe
  2⤵
  PID:5920
- C:\Windows\System\DWLvcnI.exe
  C:\Windows\System\DWLvcnI.exe
  2⤵
  PID:5840
- C:\Windows\System\rdpgoPY.exe
  C:\Windows\System\rdpgoPY.exe
  2⤵
  PID:6344
- C:\Windows\System\wvOTojF.exe
  C:\Windows\System\wvOTojF.exe
  2⤵
  PID:6408
- C:\Windows\System\TyBDJfV.exe
  C:\Windows\System\TyBDJfV.exe
  2⤵
  PID:6496
- C:\Windows\System\vMINGSg.exe
  C:\Windows\System\vMINGSg.exe
  2⤵
  PID:6720
- C:\Windows\System\qeuSKMz.exe
  C:\Windows\System\qeuSKMz.exe
  2⤵
  PID:6704
- C:\Windows\System\TUNeAhY.exe
  C:\Windows\System\TUNeAhY.exe
  2⤵
  PID:6744
- C:\Windows\System\zawrOzm.exe
  C:\Windows\System\zawrOzm.exe
  2⤵
  PID:6756
- C:\Windows\System\yXGtvSL.exe
  C:\Windows\System\yXGtvSL.exe
  2⤵
  PID:6788
- C:\Windows\System\owmjdHz.exe
  C:\Windows\System\owmjdHz.exe
  2⤵
  PID:6800
- C:\Windows\System\BEdDYTq.exe
  C:\Windows\System\BEdDYTq.exe
  2⤵
  PID:6844
- C:\Windows\System\QAHZrMt.exe
  C:\Windows\System\QAHZrMt.exe
  2⤵
  PID:6776
- C:\Windows\System\SHttWOU.exe
  C:\Windows\System\SHttWOU.exe
  2⤵
  PID:6888
- C:\Windows\System\iJSncOr.exe
  C:\Windows\System\iJSncOr.exe
  2⤵
  PID:6908
- C:\Windows\System\ZFBRWnA.exe
  C:\Windows\System\ZFBRWnA.exe
  2⤵
  PID:6904
- C:\Windows\System\agitsQe.exe
  C:\Windows\System\agitsQe.exe
  2⤵
  PID:6928
- C:\Windows\System\AjtnvUl.exe
  C:\Windows\System\AjtnvUl.exe
  2⤵
  PID:6956
- C:\Windows\System\gXaFqYh.exe
  C:\Windows\System\gXaFqYh.exe
  2⤵
  PID:6972
- C:\Windows\System\krGTBPA.exe
  C:\Windows\System\krGTBPA.exe
  2⤵
  PID:6968
- C:\Windows\System\VDUXYSZ.exe
  C:\Windows\System\VDUXYSZ.exe
  2⤵
  PID:7000
- C:\Windows\System\SylCuxA.exe
  C:\Windows\System\SylCuxA.exe
  2⤵
  PID:7016
- C:\Windows\System\qLUbKvH.exe
  C:\Windows\System\qLUbKvH.exe
  2⤵
  PID:7036
- C:\Windows\System\kplafhE.exe
  C:\Windows\System\kplafhE.exe
  2⤵
  PID:7052
- C:\Windows\System\JIKnZij.exe
  C:\Windows\System\JIKnZij.exe
  2⤵
  PID:7068
- C:\Windows\System\xKVxQbi.exe
  C:\Windows\System\xKVxQbi.exe
  2⤵
  PID:7088
- C:\Windows\System\heWBmUP.exe
  C:\Windows\System\heWBmUP.exe
  2⤵
  PID:7060
- C:\Windows\System\ayMfrbH.exe
  C:\Windows\System\ayMfrbH.exe
  2⤵
  PID:7132
- C:\Windows\System\cqSDTQu.exe
  C:\Windows\System\cqSDTQu.exe
  2⤵
  PID:7112
- C:\Windows\System\cznPeRG.exe
  C:\Windows\System\cznPeRG.exe
  2⤵
  PID:6984
- C:\Windows\System\fmsGPPM.exe
  C:\Windows\System\fmsGPPM.exe
  2⤵
  PID:5968
- C:\Windows\System\HqiNLdX.exe
  C:\Windows\System\HqiNLdX.exe
  2⤵
  PID:7156
- C:\Windows\System\kIQeQko.exe
  C:\Windows\System\kIQeQko.exe
  2⤵
  PID:5204
- C:\Windows\System\hpQzGjh.exe
  C:\Windows\System\hpQzGjh.exe
  2⤵
  PID:3676
- C:\Windows\System\UpTKfVz.exe
  C:\Windows\System\UpTKfVz.exe
  2⤵
  PID:5580
- C:\Windows\System\pbNYFYY.exe
  C:\Windows\System\pbNYFYY.exe
  2⤵
  PID:848
- C:\Windows\System\xRPOdoT.exe
  C:\Windows\System\xRPOdoT.exe
  2⤵
  PID:6444
- C:\Windows\System\wzvDZql.exe
  C:\Windows\System\wzvDZql.exe
  2⤵
  PID:6552
- C:\Windows\System\pSAvEZw.exe
  C:\Windows\System\pSAvEZw.exe
  2⤵
  PID:6428
- C:\Windows\System\KKiqilO.exe
  C:\Windows\System\KKiqilO.exe
  2⤵
  PID:6356
- C:\Windows\System\kDnkfKU.exe
  C:\Windows\System\kDnkfKU.exe
  2⤵
  PID:6548
- C:\Windows\System\AsYSawp.exe
  C:\Windows\System\AsYSawp.exe
  2⤵
  PID:6304
- C:\Windows\System\ujUGpLl.exe
  C:\Windows\System\ujUGpLl.exe
  2⤵
  PID:6536
- C:\Windows\System\lzFkRpa.exe
  C:\Windows\System\lzFkRpa.exe
  2⤵
  PID:6504
- C:\Windows\System\aldohrN.exe
  C:\Windows\System\aldohrN.exe
  2⤵
  PID:6572
- C:\Windows\System\ilBTuFN.exe
  C:\Windows\System\ilBTuFN.exe
  2⤵
  PID:4116
- C:\Windows\System\TyJIOnW.exe
  C:\Windows\System\TyJIOnW.exe
  2⤵
  PID:6700
- C:\Windows\System\QjHMFXG.exe
  C:\Windows\System\QjHMFXG.exe
  2⤵
  PID:6236
- C:\Windows\System\cAYWppH.exe
  C:\Windows\System\cAYWppH.exe
  2⤵
  PID:3564
- C:\Windows\System\JVjCiWw.exe
  C:\Windows\System\JVjCiWw.exe
  2⤵
  PID:4680
- C:\Windows\System\gDLxyvR.exe
  C:\Windows\System\gDLxyvR.exe
  2⤵
  PID:6376
- C:\Windows\System\flGpdKf.exe
  C:\Windows\System\flGpdKf.exe
  2⤵
  PID:6456
- C:\Windows\System\ddhkVXw.exe
  C:\Windows\System\ddhkVXw.exe
  2⤵
  PID:6740
- C:\Windows\System\qLAlXsF.exe
  C:\Windows\System\qLAlXsF.exe
  2⤵
  PID:6716
- C:\Windows\System\fVVyuHI.exe
  C:\Windows\System\fVVyuHI.exe
  2⤵
  PID:6840
- C:\Windows\System\RwttGWa.exe
  C:\Windows\System\RwttGWa.exe
  2⤵
  PID:6864
- C:\Windows\System\gUKggeO.exe
  C:\Windows\System\gUKggeO.exe
  2⤵
  PID:6964
- C:\Windows\System\ctOVohX.exe
  C:\Windows\System\ctOVohX.exe
  2⤵
  PID:7028
- C:\Windows\System\nJMxYNx.exe
  C:\Windows\System\nJMxYNx.exe
  2⤵
  PID:6804
- C:\Windows\System\TZwcUvS.exe
  C:\Windows\System\TZwcUvS.exe
  2⤵
  PID:6896
- C:\Windows\System\WkVKjRT.exe
  C:\Windows\System\WkVKjRT.exe
  2⤵
  PID:6880
- C:\Windows\System\LuyTfiW.exe
  C:\Windows\System\LuyTfiW.exe
  2⤵
  PID:7044
- C:\Windows\System\nanyvVu.exe
  C:\Windows\System\nanyvVu.exe
  2⤵
  PID:6932
- C:\Windows\System\TleUSjj.exe
  C:\Windows\System\TleUSjj.exe
  2⤵
  PID:7080
- C:\Windows\System\GHmfFDR.exe
  C:\Windows\System\GHmfFDR.exe
  2⤵
  PID:7120
- C:\Windows\System\YRPJyRt.exe
  C:\Windows\System\YRPJyRt.exe
  2⤵
  PID:6132
- C:\Windows\System\eZCwGUl.exe
  C:\Windows\System\eZCwGUl.exe
  2⤵
  PID:6288
- C:\Windows\System\KQhBoDI.exe
  C:\Windows\System\KQhBoDI.exe
  2⤵
  PID:5696
- C:\Windows\System\VXOZMyC.exe
  C:\Windows\System\VXOZMyC.exe
  2⤵
  PID:6396
- C:\Windows\System\aWQayYh.exe
  C:\Windows\System\aWQayYh.exe
  2⤵
  PID:6520
- C:\Windows\System\pNYfmYs.exe
  C:\Windows\System\pNYfmYs.exe
  2⤵
  PID:3680
- C:\Windows\System\ezPozVR.exe
  C:\Windows\System\ezPozVR.exe
  2⤵
  PID:6340
- C:\Windows\System\vTCVfga.exe
  C:\Windows\System\vTCVfga.exe
  2⤵
  PID:6380
- C:\Windows\System\elWoQJV.exe
  C:\Windows\System\elWoQJV.exe
  2⤵
  PID:3368
- C:\Windows\System\EpKwSML.exe
  C:\Windows\System\EpKwSML.exe
  2⤵
  PID:5396
- C:\Windows\System\AIZGfOv.exe
  C:\Windows\System\AIZGfOv.exe
  2⤵
  PID:6200
- C:\Windows\System\pZdXTQo.exe
  C:\Windows\System\pZdXTQo.exe
  2⤵
  PID:6780
- C:\Windows\System\PbPYPzT.exe
  C:\Windows\System\PbPYPzT.exe
  2⤵
  PID:1564
- C:\Windows\System\zginfoi.exe
  C:\Windows\System\zginfoi.exe
  2⤵
  PID:7064
- C:\Windows\System\NobbFXR.exe
  C:\Windows\System\NobbFXR.exe
  2⤵
  PID:6936
- C:\Windows\System\RNWMJuw.exe
  C:\Windows\System\RNWMJuw.exe
  2⤵
  PID:6856
- C:\Windows\System\kqGllej.exe
  C:\Windows\System\kqGllej.exe
  2⤵
  PID:7124
- C:\Windows\System\PBXzAhD.exe
  C:\Windows\System\PBXzAhD.exe
  2⤵
  PID:7160
- C:\Windows\System\iVPqOSJ.exe
  C:\Windows\System\iVPqOSJ.exe
  2⤵
  PID:5660
- C:\Windows\System\bUyZEzo.exe
  C:\Windows\System\bUyZEzo.exe
  2⤵
  PID:6500
- C:\Windows\System\BruyXVb.exe
  C:\Windows\System\BruyXVb.exe
  2⤵
  PID:5760
- C:\Windows\System\pqDtKie.exe
  C:\Windows\System\pqDtKie.exe
  2⤵
  PID:6708
- C:\Windows\System\KmPXWeu.exe
  C:\Windows\System\KmPXWeu.exe
  2⤵
  PID:7012
- C:\Windows\System\RCJeXXE.exe
  C:\Windows\System\RCJeXXE.exe
  2⤵
  PID:4168
- C:\Windows\System\wcFYPhT.exe
  C:\Windows\System\wcFYPhT.exe
  2⤵
  PID:6980
- C:\Windows\System\rMNDhWG.exe
  C:\Windows\System\rMNDhWG.exe
  2⤵
  PID:6336
- C:\Windows\System\KDTUTnB.exe
  C:\Windows\System\KDTUTnB.exe
  2⤵
  PID:4760
- C:\Windows\System\ewvClbH.exe
  C:\Windows\System\ewvClbH.exe
  2⤵
  PID:3096
- C:\Windows\System\cGRZzvS.exe
  C:\Windows\System\cGRZzvS.exe
  2⤵
  PID:6156
- C:\Windows\System\yxUJtcn.exe
  C:\Windows\System\yxUJtcn.exe
  2⤵
  PID:7100
- C:\Windows\System\cohUigi.exe
  C:\Windows\System\cohUigi.exe
  2⤵
  PID:6424
- C:\Windows\System\PqKXLfZ.exe
  C:\Windows\System\PqKXLfZ.exe
  2⤵
  PID:6248
- C:\Windows\System\TnzxXOH.exe
  C:\Windows\System\TnzxXOH.exe
  2⤵
  PID:7172
- C:\Windows\System\ZpfhrVU.exe
  C:\Windows\System\ZpfhrVU.exe
  2⤵
  PID:7188
- C:\Windows\System\BlRavAA.exe
  C:\Windows\System\BlRavAA.exe
  2⤵
  PID:7204
- C:\Windows\System\tgQqfty.exe
  C:\Windows\System\tgQqfty.exe
  2⤵
  PID:7220
- C:\Windows\System\UqwCkRN.exe
  C:\Windows\System\UqwCkRN.exe
  2⤵
  PID:7236
- C:\Windows\System\VNGRmbD.exe
  C:\Windows\System\VNGRmbD.exe
  2⤵
  PID:7252
- C:\Windows\System\xIvAzMv.exe
  C:\Windows\System\xIvAzMv.exe
  2⤵
  PID:7268
- C:\Windows\System\CYlavtE.exe
  C:\Windows\System\CYlavtE.exe
  2⤵
  PID:7284
- C:\Windows\System\EsWvmuG.exe
  C:\Windows\System\EsWvmuG.exe
  2⤵
  PID:7300
- C:\Windows\System\QZQsJTy.exe
  C:\Windows\System\QZQsJTy.exe
  2⤵
  PID:7320
- C:\Windows\System\XZvBVvZ.exe
  C:\Windows\System\XZvBVvZ.exe
  2⤵
  PID:7336
- C:\Windows\System\jFaqqjI.exe
  C:\Windows\System\jFaqqjI.exe
  2⤵
  PID:7352
- C:\Windows\System\sVeCNeE.exe
  C:\Windows\System\sVeCNeE.exe
  2⤵
  PID:7368
- C:\Windows\System\aHHWlEg.exe
  C:\Windows\System\aHHWlEg.exe
  2⤵
  PID:7384
- C:\Windows\System\WXeNzZB.exe
  C:\Windows\System\WXeNzZB.exe
  2⤵
  PID:7400
- C:\Windows\System\ViqrrbY.exe
  C:\Windows\System\ViqrrbY.exe
  2⤵
  PID:7416
- C:\Windows\System\vEoFDQf.exe
  C:\Windows\System\vEoFDQf.exe
  2⤵
  PID:7432
- C:\Windows\System\bFXfRYK.exe
  C:\Windows\System\bFXfRYK.exe
  2⤵
  PID:7448
- C:\Windows\System\eLOVfHR.exe
  C:\Windows\System\eLOVfHR.exe
  2⤵
  PID:7464
- C:\Windows\System\ezcoYeE.exe
  C:\Windows\System\ezcoYeE.exe
  2⤵
  PID:7480
- C:\Windows\System\GuSfWqP.exe
  C:\Windows\System\GuSfWqP.exe
  2⤵
  PID:7496
- C:\Windows\System\rAcBwkw.exe
  C:\Windows\System\rAcBwkw.exe
  2⤵
  PID:7512
- C:\Windows\System\sQOBWvY.exe
  C:\Windows\System\sQOBWvY.exe
  2⤵
  PID:7528
- C:\Windows\System\WeNvclM.exe
  C:\Windows\System\WeNvclM.exe
  2⤵
  PID:7544
- C:\Windows\System\GmYnoaH.exe
  C:\Windows\System\GmYnoaH.exe
  2⤵
  PID:7560
- C:\Windows\System\IwINbVT.exe
  C:\Windows\System\IwINbVT.exe
  2⤵
  PID:7576
- C:\Windows\System\upNbNug.exe
  C:\Windows\System\upNbNug.exe
  2⤵
  PID:7592
- C:\Windows\System\ItcQCwo.exe
  C:\Windows\System\ItcQCwo.exe
  2⤵
  PID:7608
- C:\Windows\System\YLHBNAv.exe
  C:\Windows\System\YLHBNAv.exe
  2⤵
  PID:7624
- C:\Windows\System\hIUMBgU.exe
  C:\Windows\System\hIUMBgU.exe
  2⤵
  PID:7640
- C:\Windows\System\GcawIrb.exe
  C:\Windows\System\GcawIrb.exe
  2⤵
  PID:7656
- C:\Windows\System\JoeyQRl.exe
  C:\Windows\System\JoeyQRl.exe
  2⤵
  PID:7672
- C:\Windows\System\PrWDZZz.exe
  C:\Windows\System\PrWDZZz.exe
  2⤵
  PID:7688
- C:\Windows\System\vztHjAu.exe
  C:\Windows\System\vztHjAu.exe
  2⤵
  PID:7704
- C:\Windows\System\rxYMZxN.exe
  C:\Windows\System\rxYMZxN.exe
  2⤵
  PID:7720
- C:\Windows\System\IHAWCJz.exe
  C:\Windows\System\IHAWCJz.exe
  2⤵
  PID:7736
- C:\Windows\System\QzOycCn.exe
  C:\Windows\System\QzOycCn.exe
  2⤵
  PID:7752
- C:\Windows\System\avOdTSH.exe
  C:\Windows\System\avOdTSH.exe
  2⤵
  PID:7768
- C:\Windows\System\GsyOdEZ.exe
  C:\Windows\System\GsyOdEZ.exe
  2⤵
  PID:7784
- C:\Windows\System\jEXzqoH.exe
  C:\Windows\System\jEXzqoH.exe
  2⤵
  PID:7800
- C:\Windows\System\yzCQVmQ.exe
  C:\Windows\System\yzCQVmQ.exe
  2⤵
  PID:7816
- C:\Windows\System\gfLHpOu.exe
  C:\Windows\System\gfLHpOu.exe
  2⤵
  PID:7832
- C:\Windows\System\GfGFGbd.exe
  C:\Windows\System\GfGFGbd.exe
  2⤵
  PID:7848
- C:\Windows\System\qsUcOfO.exe
  C:\Windows\System\qsUcOfO.exe
  2⤵
  PID:7864
- C:\Windows\System\Vuqnbsz.exe
  C:\Windows\System\Vuqnbsz.exe
  2⤵
  PID:7880
- C:\Windows\System\FzpfToH.exe
  C:\Windows\System\FzpfToH.exe
  2⤵
  PID:7896
- C:\Windows\System\nFqhOIG.exe
  C:\Windows\System\nFqhOIG.exe
  2⤵
  PID:7912
- C:\Windows\System\elCzsrU.exe
  C:\Windows\System\elCzsrU.exe
  2⤵
  PID:7928
- C:\Windows\System\ruGVMJb.exe
  C:\Windows\System\ruGVMJb.exe
  2⤵
  PID:7944
- C:\Windows\System\ueDZZeR.exe
  C:\Windows\System\ueDZZeR.exe
  2⤵
  PID:7960
- C:\Windows\System\rLHjfgv.exe
  C:\Windows\System\rLHjfgv.exe
  2⤵
  PID:7976
- C:\Windows\System\yTJvKcP.exe
  C:\Windows\System\yTJvKcP.exe
  2⤵
  PID:7992
- C:\Windows\System\fnhGecv.exe
  C:\Windows\System\fnhGecv.exe
  2⤵
  PID:8008
- C:\Windows\System\XGCoiAm.exe
  C:\Windows\System\XGCoiAm.exe
  2⤵
  PID:8024
- C:\Windows\System\ZFPzzSf.exe
  C:\Windows\System\ZFPzzSf.exe
  2⤵
  PID:8040
- C:\Windows\System\IogiyXb.exe
  C:\Windows\System\IogiyXb.exe
  2⤵
  PID:8056
- C:\Windows\System\eOpZMhL.exe
  C:\Windows\System\eOpZMhL.exe
  2⤵
  PID:8072
- C:\Windows\System\JkpojsG.exe
  C:\Windows\System\JkpojsG.exe
  2⤵
  PID:8092
- C:\Windows\System\QZNdMxy.exe
  C:\Windows\System\QZNdMxy.exe
  2⤵
  PID:8108
- C:\Windows\System\wIVvplR.exe
  C:\Windows\System\wIVvplR.exe
  2⤵
  PID:8124
- C:\Windows\System\evlKaBb.exe
  C:\Windows\System\evlKaBb.exe
  2⤵
  PID:8140
- C:\Windows\System\XVoWMzJ.exe
  C:\Windows\System\XVoWMzJ.exe
  2⤵
  PID:8156
- C:\Windows\System\xtepkGI.exe
  C:\Windows\System\xtepkGI.exe
  2⤵
  PID:8172
- C:\Windows\System\QlYtbEA.exe
  C:\Windows\System\QlYtbEA.exe
  2⤵
  PID:8188
- C:\Windows\System\YpXUYEa.exe
  C:\Windows\System\YpXUYEa.exe
  2⤵
  PID:7200
- C:\Windows\System\ZuJUVlR.exe
  C:\Windows\System\ZuJUVlR.exe
  2⤵
  PID:6284
- C:\Windows\System\YqouKXS.exe
  C:\Windows\System\YqouKXS.exe
  2⤵
  PID:7260
- C:\Windows\System\SVjtcuU.exe
  C:\Windows\System\SVjtcuU.exe
  2⤵
  PID:7296
- C:\Windows\System\RUSfdZo.exe
  C:\Windows\System\RUSfdZo.exe
  2⤵
  PID:7184
- C:\Windows\System\cnUPBGu.exe
  C:\Windows\System\cnUPBGu.exe
  2⤵
  PID:7248
- C:\Windows\System\xMhdWQv.exe
  C:\Windows\System\xMhdWQv.exe
  2⤵
  PID:7364
- C:\Windows\System\XFuJgCH.exe
  C:\Windows\System\XFuJgCH.exe
  2⤵
  PID:7380
- C:\Windows\System\bUsmUOb.exe
  C:\Windows\System\bUsmUOb.exe
  2⤵
  PID:7412
- C:\Windows\System\rwmpkHs.exe
  C:\Windows\System\rwmpkHs.exe
  2⤵
  PID:7456
- C:\Windows\System\AidnELC.exe
  C:\Windows\System\AidnELC.exe
  2⤵
  PID:7552
- C:\Windows\System\tDAWWqS.exe
  C:\Windows\System\tDAWWqS.exe
  2⤵
  PID:7588
- C:\Windows\System\XOQLazQ.exe
  C:\Windows\System\XOQLazQ.exe
  2⤵
  PID:7572
- C:\Windows\System\EURRlXv.exe
  C:\Windows\System\EURRlXv.exe
  2⤵
  PID:7600
- C:\Windows\System\GtbsUYD.exe
  C:\Windows\System\GtbsUYD.exe
  2⤵
  PID:7604
- C:\Windows\System\eBUNlKy.exe
  C:\Windows\System\eBUNlKy.exe
  2⤵
  PID:7652
- C:\Windows\System\DfQtwtb.exe
  C:\Windows\System\DfQtwtb.exe
  2⤵
  PID:7664
- C:\Windows\System\XBSozBg.exe
  C:\Windows\System\XBSozBg.exe
  2⤵
  PID:7728
- C:\Windows\System\ElaaTpr.exe
  C:\Windows\System\ElaaTpr.exe
  2⤵
  PID:7744
- C:\Windows\System\PcoKqVZ.exe
  C:\Windows\System\PcoKqVZ.exe
  2⤵
  PID:7780
- C:\Windows\System\YPdklQs.exe
  C:\Windows\System\YPdklQs.exe
  2⤵
  PID:7844
- C:\Windows\System\pIbYrnJ.exe
  C:\Windows\System\pIbYrnJ.exe
  2⤵
  PID:7876
- C:\Windows\System\TTZNtHp.exe
  C:\Windows\System\TTZNtHp.exe
  2⤵
  PID:7856
- C:\Windows\System\LpkPdhQ.exe
  C:\Windows\System\LpkPdhQ.exe
  2⤵
  PID:7904
- C:\Windows\System\oCRqFRO.exe
  C:\Windows\System\oCRqFRO.exe
  2⤵
  PID:7972
- C:\Windows\System\kdlcQtg.exe
  C:\Windows\System\kdlcQtg.exe
  2⤵
  PID:7924
- C:\Windows\System\UkpfaHD.exe
  C:\Windows\System\UkpfaHD.exe
  2⤵
  PID:7988
- C:\Windows\System\rEpRfHN.exe
  C:\Windows\System\rEpRfHN.exe
  2⤵
  PID:8068
- C:\Windows\System\ZLeNCGT.exe
  C:\Windows\System\ZLeNCGT.exe
  2⤵
  PID:8136
- C:\Windows\System\eRCspik.exe
  C:\Windows\System\eRCspik.exe
  2⤵
  PID:7196
- C:\Windows\System\laYfyYo.exe
  C:\Windows\System\laYfyYo.exe
  2⤵
  PID:6712
- C:\Windows\System\mJhnYZC.exe
  C:\Windows\System\mJhnYZC.exe
  2⤵
  PID:8152
- C:\Windows\System\xiVPcvj.exe
  C:\Windows\System\xiVPcvj.exe
  2⤵
  PID:8084
- C:\Windows\System\AsBcnwG.exe
  C:\Windows\System\AsBcnwG.exe
  2⤵
  PID:6684
- C:\Windows\System\rWLwrJD.exe
  C:\Windows\System\rWLwrJD.exe
  2⤵
  PID:7292
- C:\Windows\System\fdDzecP.exe
  C:\Windows\System\fdDzecP.exe
  2⤵
  PID:7344
- C:\Windows\System\URZlpIc.exe
  C:\Windows\System\URZlpIc.exe
  2⤵
  PID:7276
- C:\Windows\System\fWQjgCs.exe
  C:\Windows\System\fWQjgCs.exe
  2⤵
  PID:7408
- C:\Windows\System\zzYatvN.exe
  C:\Windows\System\zzYatvN.exe
  2⤵
  PID:7568
- C:\Windows\System\hWhmNze.exe
  C:\Windows\System\hWhmNze.exe
  2⤵
  PID:7536
- C:\Windows\System\MaSaLeQ.exe
  C:\Windows\System\MaSaLeQ.exe
  2⤵
  PID:7476
- C:\Windows\System\JEGiOtu.exe
  C:\Windows\System\JEGiOtu.exe
  2⤵
  PID:7712
- C:\Windows\System\OXuuXXg.exe
  C:\Windows\System\OXuuXXg.exe
  2⤵
  PID:7968
- C:\Windows\System\UWVsfnY.exe
  C:\Windows\System\UWVsfnY.exe
  2⤵
  PID:7984
- C:\Windows\System\MuLURlK.exe
  C:\Windows\System\MuLURlK.exe
  2⤵
  PID:7776
- C:\Windows\System\radFgyB.exe
  C:\Windows\System\radFgyB.exe
  2⤵
  PID:7840
- C:\Windows\System\kgfWmVW.exe
  C:\Windows\System\kgfWmVW.exe
  2⤵
  PID:7920
- C:\Windows\System\BuSQjJW.exe
  C:\Windows\System\BuSQjJW.exe
  2⤵
  PID:7056
- C:\Windows\System\RtemIDA.exe
  C:\Windows\System\RtemIDA.exe
  2⤵
  PID:8148
- C:\Windows\System\fdwuYQO.exe
  C:\Windows\System\fdwuYQO.exe
  2⤵
  PID:7392
- C:\Windows\System\mVGMkHD.exe
  C:\Windows\System\mVGMkHD.exe
  2⤵
  PID:7636
- C:\Windows\System\JhSzXpx.exe
  C:\Windows\System\JhSzXpx.exe
  2⤵
  PID:6988
- C:\Windows\System\vdCljMB.exe
  C:\Windows\System\vdCljMB.exe
  2⤵
  PID:7508
- C:\Windows\System\CaQYvcI.exe
  C:\Windows\System\CaQYvcI.exe
  2⤵
  PID:7940
- C:\Windows\System\xnZXTvU.exe
  C:\Windows\System\xnZXTvU.exe
  2⤵
  PID:7956
- C:\Windows\System\OzCKZQD.exe
  C:\Windows\System\OzCKZQD.exe
  2⤵
  PID:8064
- C:\Windows\System\rxJflfs.exe
  C:\Windows\System\rxJflfs.exe
  2⤵
  PID:8116
- C:\Windows\System\IfIMLyx.exe
  C:\Windows\System\IfIMLyx.exe
  2⤵
  PID:8020
- C:\Windows\System\tiDMeNs.exe
  C:\Windows\System\tiDMeNs.exe
  2⤵
  PID:7812
- C:\Windows\System\HiAogUi.exe
  C:\Windows\System\HiAogUi.exe
  2⤵
  PID:8168
- C:\Windows\System\PiiSsjH.exe
  C:\Windows\System\PiiSsjH.exe
  2⤵
  PID:7700
- C:\Windows\System\bATYTbU.exe
  C:\Windows\System\bATYTbU.exe
  2⤵
  PID:8196
- C:\Windows\System\DPdqNVm.exe
  C:\Windows\System\DPdqNVm.exe
  2⤵
  PID:8212
- C:\Windows\System\dPxsrbI.exe
  C:\Windows\System\dPxsrbI.exe
  2⤵
  PID:8228
- C:\Windows\System\jYJUWrK.exe
  C:\Windows\System\jYJUWrK.exe
  2⤵
  PID:8244
- C:\Windows\System\LhYhOFh.exe
  C:\Windows\System\LhYhOFh.exe
  2⤵
  PID:8260
- C:\Windows\System\FTWXiFp.exe
  C:\Windows\System\FTWXiFp.exe
  2⤵
  PID:8276
- C:\Windows\System\bYcbvfG.exe
  C:\Windows\System\bYcbvfG.exe
  2⤵
  PID:8292
- C:\Windows\System\jbyQKRe.exe
  C:\Windows\System\jbyQKRe.exe
  2⤵
  PID:8308
- C:\Windows\System\GOiKcvE.exe
  C:\Windows\System\GOiKcvE.exe
  2⤵
  PID:8324
- C:\Windows\System\KCVdnzD.exe
  C:\Windows\System\KCVdnzD.exe
  2⤵
  PID:8340
- C:\Windows\System\aHHFdZH.exe
  C:\Windows\System\aHHFdZH.exe
  2⤵
  PID:8356
- C:\Windows\System\pgFjyZz.exe
  C:\Windows\System\pgFjyZz.exe
  2⤵
  PID:8372
- C:\Windows\System\qKWNVDE.exe
  C:\Windows\System\qKWNVDE.exe
  2⤵
  PID:8388
- C:\Windows\System\UsPChOk.exe
  C:\Windows\System\UsPChOk.exe
  2⤵
  PID:8404
- C:\Windows\System\vEUehOo.exe
  C:\Windows\System\vEUehOo.exe
  2⤵
  PID:8420
- C:\Windows\System\xKcQhNL.exe
  C:\Windows\System\xKcQhNL.exe
  2⤵
  PID:8436
- C:\Windows\System\hyyySxh.exe
  C:\Windows\System\hyyySxh.exe
  2⤵
  PID:8452
- C:\Windows\System\uRxSfrt.exe
  C:\Windows\System\uRxSfrt.exe
  2⤵
  PID:8468
- C:\Windows\System\wkJBkgD.exe
  C:\Windows\System\wkJBkgD.exe
  2⤵
  PID:8484
- C:\Windows\System\qHvjGcR.exe
  C:\Windows\System\qHvjGcR.exe
  2⤵
  PID:8500
- C:\Windows\System\sTdVoXd.exe
  C:\Windows\System\sTdVoXd.exe
  2⤵
  PID:8516
- C:\Windows\System\ZQNlfOg.exe
  C:\Windows\System\ZQNlfOg.exe
  2⤵
  PID:8532
- C:\Windows\System\MuyMmQl.exe
  C:\Windows\System\MuyMmQl.exe
  2⤵
  PID:8548
- C:\Windows\System\hSTdhSM.exe
  C:\Windows\System\hSTdhSM.exe
  2⤵
  PID:8564
- C:\Windows\System\qPRRHMw.exe
  C:\Windows\System\qPRRHMw.exe
  2⤵
  PID:8580
- C:\Windows\System\HraYGgx.exe
  C:\Windows\System\HraYGgx.exe
  2⤵
  PID:8596
- C:\Windows\System\yHGMWAV.exe
  C:\Windows\System\yHGMWAV.exe
  2⤵
  PID:8612
- C:\Windows\System\sGvLmmF.exe
  C:\Windows\System\sGvLmmF.exe
  2⤵
  PID:8628
- C:\Windows\System\qxRyoKg.exe
  C:\Windows\System\qxRyoKg.exe
  2⤵
  PID:8644
- C:\Windows\System\MAgFICg.exe
  C:\Windows\System\MAgFICg.exe
  2⤵
  PID:8660
- C:\Windows\System\qZzZzKa.exe
  C:\Windows\System\qZzZzKa.exe
  2⤵
  PID:8676
- C:\Windows\System\IZulOMz.exe
  C:\Windows\System\IZulOMz.exe
  2⤵
  PID:8692
- C:\Windows\System\OWzcwye.exe
  C:\Windows\System\OWzcwye.exe
  2⤵
  PID:8708
- C:\Windows\System\ahkxqxv.exe
  C:\Windows\System\ahkxqxv.exe
  2⤵
  PID:8724
- C:\Windows\System\BtRwcfF.exe
  C:\Windows\System\BtRwcfF.exe
  2⤵
  PID:8740
- C:\Windows\System\usksAHw.exe
  C:\Windows\System\usksAHw.exe
  2⤵
  PID:8756
- C:\Windows\System\iKYuJpm.exe
  C:\Windows\System\iKYuJpm.exe
  2⤵
  PID:8772
- C:\Windows\System\JQVKlrz.exe
  C:\Windows\System\JQVKlrz.exe
  2⤵
  PID:8788
- C:\Windows\System\jNNydzb.exe
  C:\Windows\System\jNNydzb.exe
  2⤵
  PID:8804
- C:\Windows\System\MeJEgSs.exe
  C:\Windows\System\MeJEgSs.exe
  2⤵
  PID:8820
- C:\Windows\System\GlpjJZK.exe
  C:\Windows\System\GlpjJZK.exe
  2⤵
  PID:8836
- C:\Windows\System\cEiCgHs.exe
  C:\Windows\System\cEiCgHs.exe
  2⤵
  PID:8852
- C:\Windows\System\avSXNnz.exe
  C:\Windows\System\avSXNnz.exe
  2⤵
  PID:8868
- C:\Windows\System\hglhxXP.exe
  C:\Windows\System\hglhxXP.exe
  2⤵
  PID:8888
- C:\Windows\System\uDjfLvA.exe
  C:\Windows\System\uDjfLvA.exe
  2⤵
  PID:8904
- C:\Windows\System\dGpwEpS.exe
  C:\Windows\System\dGpwEpS.exe
  2⤵
  PID:8920
- C:\Windows\System\DpgbzfC.exe
  C:\Windows\System\DpgbzfC.exe
  2⤵
  PID:8936
- C:\Windows\System\zlKQGKZ.exe
  C:\Windows\System\zlKQGKZ.exe
  2⤵
  PID:8952
- C:\Windows\System\XKMYVHJ.exe
  C:\Windows\System\XKMYVHJ.exe
  2⤵
  PID:8968
- C:\Windows\System\XtCKgWF.exe
  C:\Windows\System\XtCKgWF.exe
  2⤵
  PID:8984
- C:\Windows\System\LPRqyOx.exe
  C:\Windows\System\LPRqyOx.exe
  2⤵
  PID:9000
- C:\Windows\System\VJJwYHe.exe
  C:\Windows\System\VJJwYHe.exe
  2⤵
  PID:9020
- C:\Windows\System\bGyFmFf.exe
  C:\Windows\System\bGyFmFf.exe
  2⤵
  PID:9036
- C:\Windows\System\wQeLmRk.exe
  C:\Windows\System\wQeLmRk.exe
  2⤵
  PID:9052
- C:\Windows\System\ZEtmyOn.exe
  C:\Windows\System\ZEtmyOn.exe
  2⤵
  PID:9068
- C:\Windows\System\bNEvzQo.exe
  C:\Windows\System\bNEvzQo.exe
  2⤵
  PID:9084
- C:\Windows\System\FpmtBGE.exe
  C:\Windows\System\FpmtBGE.exe
  2⤵
  PID:9100
- C:\Windows\System\JTgCCTk.exe
  C:\Windows\System\JTgCCTk.exe
  2⤵
  PID:9116
- C:\Windows\System\mFAEpAp.exe
  C:\Windows\System\mFAEpAp.exe
  2⤵
  PID:9132
- C:\Windows\System\aXEWyiq.exe
  C:\Windows\System\aXEWyiq.exe
  2⤵
  PID:9148
- C:\Windows\System\ovcQWcD.exe
  C:\Windows\System\ovcQWcD.exe
  2⤵
  PID:9164
- C:\Windows\System\tQglcog.exe
  C:\Windows\System\tQglcog.exe
  2⤵
  PID:9180
- C:\Windows\System\HWxcCru.exe
  C:\Windows\System\HWxcCru.exe
  2⤵
  PID:9196
- C:\Windows\System\erROxSj.exe
  C:\Windows\System\erROxSj.exe
  2⤵
  PID:9212
- C:\Windows\System\GIunUSk.exe
  C:\Windows\System\GIunUSk.exe
  2⤵
  PID:7504
- C:\Windows\System\ykNaEEA.exe
  C:\Windows\System\ykNaEEA.exe
  2⤵
  PID:8236
- C:\Windows\System\vCXMskR.exe
  C:\Windows\System\vCXMskR.exe
  2⤵
  PID:7244
- C:\Windows\System\lTwaIUE.exe
  C:\Windows\System\lTwaIUE.exe
  2⤵
  PID:7308
- C:\Windows\System\pXpOCKV.exe
  C:\Windows\System\pXpOCKV.exe
  2⤵
  PID:8272
- C:\Windows\System\cgkJXYZ.exe
  C:\Windows\System\cgkJXYZ.exe
  2⤵
  PID:8332
- C:\Windows\System\JlysdwU.exe
  C:\Windows\System\JlysdwU.exe
  2⤵
  PID:8320
- C:\Windows\System\tNXUQdh.exe
  C:\Windows\System\tNXUQdh.exe
  2⤵
  PID:8368
- C:\Windows\System\SFjrwHX.exe
  C:\Windows\System\SFjrwHX.exe
  2⤵
  PID:8428
- C:\Windows\System\gTLtXbW.exe
  C:\Windows\System\gTLtXbW.exe
  2⤵
  PID:8432
- C:\Windows\System\oMcybvU.exe
  C:\Windows\System\oMcybvU.exe
  2⤵
  PID:8492
- C:\Windows\System\VNWYEpY.exe
  C:\Windows\System\VNWYEpY.exe
  2⤵
  PID:8496
- C:\Windows\System\uiYQVsF.exe
  C:\Windows\System\uiYQVsF.exe
  2⤵
  PID:8560
- C:\Windows\System\mOkDCDd.exe
  C:\Windows\System\mOkDCDd.exe
  2⤵
  PID:8512
- C:\Windows\System\iCBFOyl.exe
  C:\Windows\System\iCBFOyl.exe
  2⤵
  PID:8572
- C:\Windows\System\hnSwsKJ.exe
  C:\Windows\System\hnSwsKJ.exe
  2⤵
  PID:8604
- C:\Windows\System\IXWLbkY.exe
  C:\Windows\System\IXWLbkY.exe
  2⤵
  PID:8668
- C:\Windows\System\boAQpCT.exe
  C:\Windows\System\boAQpCT.exe
  2⤵
  PID:8688
- C:\Windows\System\qjudgod.exe
  C:\Windows\System\qjudgod.exe
  2⤵
  PID:8784
- C:\Windows\System\MXDqNBg.exe
  C:\Windows\System\MXDqNBg.exe
  2⤵
  PID:8764
- C:\Windows\System\xLfkLkK.exe
  C:\Windows\System\xLfkLkK.exe
  2⤵
  PID:8796
- C:\Windows\System\wGwMjda.exe
  C:\Windows\System\wGwMjda.exe
  2⤵
  PID:8816
- C:\Windows\System\jTGZVbI.exe
  C:\Windows\System\jTGZVbI.exe
  2⤵
  PID:8864
- C:\Windows\System\EzKFRwt.exe
  C:\Windows\System\EzKFRwt.exe
  2⤵
  PID:8912
- C:\Windows\System\qPTnrPI.exe
  C:\Windows\System\qPTnrPI.exe
  2⤵
  PID:8900
- C:\Windows\System\PKQLWFO.exe
  C:\Windows\System\PKQLWFO.exe
  2⤵
  PID:9012
- C:\Windows\System\XiArVJY.exe
  C:\Windows\System\XiArVJY.exe
  2⤵
  PID:9048
- C:\Windows\System\bLkAQdP.exe
  C:\Windows\System\bLkAQdP.exe
  2⤵
  PID:9080
- C:\Windows\System\EiJvuCh.exe
  C:\Windows\System\EiJvuCh.exe
  2⤵
  PID:8992
- C:\Windows\System\TbEoqTX.exe
  C:\Windows\System\TbEoqTX.exe
  2⤵
  PID:9060
- C:\Windows\System\acXNyhm.exe
  C:\Windows\System\acXNyhm.exe
  2⤵
  PID:9140
- C:\Windows\System\GyQMMDi.exe
  C:\Windows\System\GyQMMDi.exe
  2⤵
  PID:9156
- C:\Windows\System\jILiNEt.exe
  C:\Windows\System\jILiNEt.exe
  2⤵
  PID:9176
- C:\Windows\System\HfBnkaP.exe
  C:\Windows\System\HfBnkaP.exe
  2⤵
  PID:8208
- C:\Windows\System\PqzzxHB.exe
  C:\Windows\System\PqzzxHB.exe
  2⤵
  PID:7492
- C:\Windows\System\JLmSJaD.exe
  C:\Windows\System\JLmSJaD.exe
  2⤵
  PID:7312
- C:\Windows\System\UbDGStR.exe
  C:\Windows\System\UbDGStR.exe
  2⤵
  PID:8256
- C:\Windows\System\alHgbng.exe
  C:\Windows\System\alHgbng.exe
  2⤵
  PID:8592
- C:\Windows\System\vjnpieW.exe
  C:\Windows\System\vjnpieW.exe
  2⤵
  PID:8416
- C:\Windows\System\koMlqYA.exe
  C:\Windows\System\koMlqYA.exe
  2⤵
  PID:8656
- C:\Windows\System\XXSAEZi.exe
  C:\Windows\System\XXSAEZi.exe
  2⤵
  PID:8704
- C:\Windows\System\lbzBmbE.exe
  C:\Windows\System\lbzBmbE.exe
  2⤵
  PID:8812
- C:\Windows\System\ZFmttVq.exe
  C:\Windows\System\ZFmttVq.exe
  2⤵
  PID:9076
- C:\Windows\System\sLwYYbP.exe
  C:\Windows\System\sLwYYbP.exe
  2⤵
  PID:8000
- C:\Windows\System\RMNICdv.exe
  C:\Windows\System\RMNICdv.exe
  2⤵
  PID:9208
- C:\Windows\System\bSUDRNh.exe
  C:\Windows\System\bSUDRNh.exe
  2⤵
  PID:8396
- C:\Windows\System\qLweRbX.exe
  C:\Windows\System\qLweRbX.exe
  2⤵
  PID:8556
- C:\Windows\System\vpSsiwz.exe
  C:\Windows\System\vpSsiwz.exe
  2⤵
  PID:8748
- C:\Windows\System\RiqIOhH.exe
  C:\Windows\System\RiqIOhH.exe
  2⤵
  PID:8848
- C:\Windows\System\ipPdhfZ.exe
  C:\Windows\System\ipPdhfZ.exe
  2⤵
  PID:9032
- C:\Windows\System\gcUFPNy.exe
  C:\Windows\System\gcUFPNy.exe
  2⤵
  PID:7828
- C:\Windows\System\ktIbdBD.exe
  C:\Windows\System\ktIbdBD.exe
  2⤵
  PID:8480
- C:\Windows\System\pteYHjw.exe
  C:\Windows\System\pteYHjw.exe
  2⤵
  PID:8832
- C:\Windows\System\leknBhX.exe
  C:\Windows\System\leknBhX.exe
  2⤵
  PID:8508
- C:\Windows\System\BqBlobh.exe
  C:\Windows\System\BqBlobh.exe
  2⤵
  PID:8352
- C:\Windows\System\EIcNmUu.exe
  C:\Windows\System\EIcNmUu.exe
  2⤵
  PID:8944
- C:\Windows\System\aNMEoKh.exe
  C:\Windows\System\aNMEoKh.exe
  2⤵
  PID:8960
- C:\Windows\System\ahFnzcJ.exe
  C:\Windows\System\ahFnzcJ.exe
  2⤵
  PID:9112
- C:\Windows\System\lkdHtGJ.exe
  C:\Windows\System\lkdHtGJ.exe
  2⤵
  PID:8716
- C:\Windows\System\EqvSANb.exe
  C:\Windows\System\EqvSANb.exe
  2⤵
  PID:8844
- C:\Windows\System\UypeILx.exe
  C:\Windows\System\UypeILx.exe
  2⤵
  PID:9124
- C:\Windows\System\DOKWuYV.exe
  C:\Windows\System\DOKWuYV.exe
  2⤵
  PID:8780
- C:\Windows\System\QMELmGG.exe
  C:\Windows\System\QMELmGG.exe
  2⤵
  PID:8736
- C:\Windows\System\FqSoBEq.exe
  C:\Windows\System\FqSoBEq.exe
  2⤵
  PID:8684
- C:\Windows\System\HXgYIwq.exe
  C:\Windows\System\HXgYIwq.exe
  2⤵
  PID:9224
- C:\Windows\System\NjjBCHJ.exe
  C:\Windows\System\NjjBCHJ.exe
  2⤵
  PID:9240
- C:\Windows\System\lhfaRww.exe
  C:\Windows\System\lhfaRww.exe
  2⤵
  PID:9256
- C:\Windows\System\ZpmwnAI.exe
  C:\Windows\System\ZpmwnAI.exe
  2⤵
  PID:9272
- C:\Windows\System\vaXlUzM.exe
  C:\Windows\System\vaXlUzM.exe
  2⤵
  PID:9288
- C:\Windows\System\POSwQls.exe
  C:\Windows\System\POSwQls.exe
  2⤵
  PID:9304
- C:\Windows\System\IcysCGK.exe
  C:\Windows\System\IcysCGK.exe
  2⤵
  PID:9320
- C:\Windows\System\cJPHWRv.exe
  C:\Windows\System\cJPHWRv.exe
  2⤵
  PID:9336
- C:\Windows\System\hQDMVML.exe
  C:\Windows\System\hQDMVML.exe
  2⤵
  PID:9352
- C:\Windows\System\qhiLCjN.exe
  C:\Windows\System\qhiLCjN.exe
  2⤵
  PID:9368
- C:\Windows\System\cSpwCaD.exe
  C:\Windows\System\cSpwCaD.exe
  2⤵
  PID:9384
- C:\Windows\System\jJnuAUf.exe
  C:\Windows\System\jJnuAUf.exe
  2⤵
  PID:9400
- C:\Windows\System\aBLzjsV.exe
  C:\Windows\System\aBLzjsV.exe
  2⤵
  PID:9416
- C:\Windows\System\rnpYoGu.exe
  C:\Windows\System\rnpYoGu.exe
  2⤵
  PID:9432
- C:\Windows\System\aLFbmiP.exe
  C:\Windows\System\aLFbmiP.exe
  2⤵
  PID:9448
- C:\Windows\System\NPdDVjb.exe
  C:\Windows\System\NPdDVjb.exe
  2⤵
  PID:9464
- C:\Windows\System\ixDCVqQ.exe
  C:\Windows\System\ixDCVqQ.exe
  2⤵
  PID:9480
- C:\Windows\System\QkalCVo.exe
  C:\Windows\System\QkalCVo.exe
  2⤵
  PID:9496
- C:\Windows\System\iiCPNal.exe
  C:\Windows\System\iiCPNal.exe
  2⤵
  PID:9512
- C:\Windows\System\APCJAkC.exe
  C:\Windows\System\APCJAkC.exe
  2⤵
  PID:9528
- C:\Windows\System\rxeXpqG.exe
  C:\Windows\System\rxeXpqG.exe
  2⤵
  PID:9544
- C:\Windows\System\eNvkRle.exe
  C:\Windows\System\eNvkRle.exe
  2⤵
  PID:9560
- C:\Windows\System\pGrxyKA.exe
  C:\Windows\System\pGrxyKA.exe
  2⤵
  PID:9576
- C:\Windows\System\fDyfHqk.exe
  C:\Windows\System\fDyfHqk.exe
  2⤵
  PID:9592
- C:\Windows\System\BXNdUsq.exe
  C:\Windows\System\BXNdUsq.exe
  2⤵
  PID:9608
- C:\Windows\System\tLcwVmx.exe
  C:\Windows\System\tLcwVmx.exe
  2⤵
  PID:9624
- C:\Windows\System\EcRqvMN.exe
  C:\Windows\System\EcRqvMN.exe
  2⤵
  PID:9640
- C:\Windows\System\kLUvSuG.exe
  C:\Windows\System\kLUvSuG.exe
  2⤵
  PID:9656
- C:\Windows\System\aOgjTjh.exe
  C:\Windows\System\aOgjTjh.exe
  2⤵
  PID:9672
- C:\Windows\System\xDyDNbb.exe
  C:\Windows\System\xDyDNbb.exe
  2⤵
  PID:9688
- C:\Windows\System\bJlIYgS.exe
  C:\Windows\System\bJlIYgS.exe
  2⤵
  PID:9704
- C:\Windows\System\GkIaold.exe
  C:\Windows\System\GkIaold.exe
  2⤵
  PID:9720
- C:\Windows\System\AeARGsO.exe
  C:\Windows\System\AeARGsO.exe
  2⤵
  PID:9736
- C:\Windows\System\kHnThbu.exe
  C:\Windows\System\kHnThbu.exe
  2⤵
  PID:9752
- C:\Windows\System\YXWLjGX.exe
  C:\Windows\System\YXWLjGX.exe
  2⤵
  PID:9768
- C:\Windows\System\rWAlOXn.exe
  C:\Windows\System\rWAlOXn.exe
  2⤵
  PID:9784
- C:\Windows\System\nqlZmSR.exe
  C:\Windows\System\nqlZmSR.exe
  2⤵
  PID:9800
- C:\Windows\System\mvtQzWz.exe
  C:\Windows\System\mvtQzWz.exe
  2⤵
  PID:9816
- C:\Windows\System\cIMbGue.exe
  C:\Windows\System\cIMbGue.exe
  2⤵
  PID:9832
- C:\Windows\System\thsurqU.exe
  C:\Windows\System\thsurqU.exe
  2⤵
  PID:9848
- C:\Windows\System\XfGDfcT.exe
  C:\Windows\System\XfGDfcT.exe
  2⤵
  PID:9864
- C:\Windows\System\ctxrqrm.exe
  C:\Windows\System\ctxrqrm.exe
  2⤵
  PID:9880
- C:\Windows\System\HXHUGqC.exe
  C:\Windows\System\HXHUGqC.exe
  2⤵
  PID:9896
- C:\Windows\System\iVLxkgk.exe
  C:\Windows\System\iVLxkgk.exe
  2⤵
  PID:9916
- C:\Windows\System\DzNkYYY.exe
  C:\Windows\System\DzNkYYY.exe
  2⤵
  PID:9932
- C:\Windows\System\rePHTfJ.exe
  C:\Windows\System\rePHTfJ.exe
  2⤵
  PID:9948
- C:\Windows\System\uLmvGIU.exe
  C:\Windows\System\uLmvGIU.exe
  2⤵
  PID:9964
- C:\Windows\System\wwMjIxB.exe
  C:\Windows\System\wwMjIxB.exe
  2⤵
  PID:9980
- C:\Windows\System\uVENMya.exe
  C:\Windows\System\uVENMya.exe
  2⤵
  PID:9996
- C:\Windows\System\OeNLdIs.exe
  C:\Windows\System\OeNLdIs.exe
  2⤵
  PID:10012
- C:\Windows\System\QxalvSE.exe
  C:\Windows\System\QxalvSE.exe
  2⤵
  PID:10028
- C:\Windows\System\OFDcWld.exe
  C:\Windows\System\OFDcWld.exe
  2⤵
  PID:10044
- C:\Windows\System\HaYeKts.exe
  C:\Windows\System\HaYeKts.exe
  2⤵
  PID:10060
- C:\Windows\System\clPMpnr.exe
  C:\Windows\System\clPMpnr.exe
  2⤵
  PID:10076
- C:\Windows\System\HavKllG.exe
  C:\Windows\System\HavKllG.exe
  2⤵
  PID:10092
- C:\Windows\System\tIFhAFw.exe
  C:\Windows\System\tIFhAFw.exe
  2⤵
  PID:10108
- C:\Windows\System\ylNjzIs.exe
  C:\Windows\System\ylNjzIs.exe
  2⤵
  PID:10124
- C:\Windows\System\YpXcPVI.exe
  C:\Windows\System\YpXcPVI.exe
  2⤵
  PID:10140
- C:\Windows\System\PbyzTSH.exe
  C:\Windows\System\PbyzTSH.exe
  2⤵
  PID:10156
- C:\Windows\System\NURDvVJ.exe
  C:\Windows\System\NURDvVJ.exe
  2⤵
  PID:10172
- C:\Windows\System\ZfxgwFT.exe
  C:\Windows\System\ZfxgwFT.exe
  2⤵
  PID:10188
- C:\Windows\System\MEKsePQ.exe
  C:\Windows\System\MEKsePQ.exe
  2⤵
  PID:10204
- C:\Windows\System\VQRaMSi.exe
  C:\Windows\System\VQRaMSi.exe
  2⤵
  PID:10220
- C:\Windows\System\FzUZjHl.exe
  C:\Windows\System\FzUZjHl.exe
  2⤵
  PID:10236
- C:\Windows\System\PHWtGDy.exe
  C:\Windows\System\PHWtGDy.exe
  2⤵
  PID:9268
- C:\Windows\System\ZAGHKCq.exe
  C:\Windows\System\ZAGHKCq.exe
  2⤵
  PID:9332
- C:\Windows\System\lsEkjdR.exe
  C:\Windows\System\lsEkjdR.exe
  2⤵
  PID:9396
- C:\Windows\System\FQPIneN.exe
  C:\Windows\System\FQPIneN.exe
  2⤵
  PID:9456
- C:\Windows\System\ToUstEb.exe
  C:\Windows\System\ToUstEb.exe
  2⤵
  PID:9192
- C:\Windows\System\cwUUJxY.exe
  C:\Windows\System\cwUUJxY.exe
  2⤵
  PID:9520
- C:\Windows\System\niPEmjP.exe
  C:\Windows\System\niPEmjP.exe
  2⤵
  PID:9252
- C:\Windows\System\ACrdOyI.exe
  C:\Windows\System\ACrdOyI.exe
  2⤵
  PID:9316
- C:\Windows\System\yLTLyAJ.exe
  C:\Windows\System\yLTLyAJ.exe
  2⤵
  PID:9092
- C:\Windows\System\gSTRoLU.exe
  C:\Windows\System\gSTRoLU.exe
  2⤵
  PID:8528
- C:\Windows\System\MghnlwQ.exe
  C:\Windows\System\MghnlwQ.exe
  2⤵
  PID:9616
- C:\Windows\System\suzCAQb.exe
  C:\Windows\System\suzCAQb.exe
  2⤵
  PID:9472
- C:\Windows\System\vhLsoZB.exe
  C:\Windows\System\vhLsoZB.exe
  2⤵
  PID:9444
- C:\Windows\System\mNGPPPW.exe
  C:\Windows\System\mNGPPPW.exe
  2⤵
  PID:9680
- C:\Windows\System\qGaokvP.exe
  C:\Windows\System\qGaokvP.exe
  2⤵
  PID:9744
- C:\Windows\System\KJNysBB.exe
  C:\Windows\System\KJNysBB.exe
  2⤵
  PID:9808
- C:\Windows\System\vXTtkyy.exe
  C:\Windows\System\vXTtkyy.exe
  2⤵
  PID:9572
- C:\Windows\System\yvAwxox.exe
  C:\Windows\System\yvAwxox.exe
  2⤵
  PID:8620
- C:\Windows\System\ZFbNOme.exe
  C:\Windows\System\ZFbNOme.exe
  2⤵
  PID:9696
- C:\Windows\System\nTYmrtc.exe
  C:\Windows\System\nTYmrtc.exe
  2⤵
  PID:9760
- C:\Windows\System\pRekqIG.exe
  C:\Windows\System\pRekqIG.exe
  2⤵
  PID:9824
- C:\Windows\System\DTRuaZX.exe
  C:\Windows\System\DTRuaZX.exe
  2⤵
  PID:9828
- C:\Windows\System\dDisOaf.exe
  C:\Windows\System\dDisOaf.exe
  2⤵
  PID:9940
- C:\Windows\System\HcIpAws.exe
  C:\Windows\System\HcIpAws.exe
  2⤵
  PID:10004
- C:\Windows\System\qHyhVva.exe
  C:\Windows\System\qHyhVva.exe
  2⤵
  PID:10068
- C:\Windows\System\DKFAujV.exe
  C:\Windows\System\DKFAujV.exe
  2⤵
  PID:10132
- C:\Windows\System\OfWTDxL.exe
  C:\Windows\System\OfWTDxL.exe
  2⤵
  PID:10196
- C:\Windows\System\cYFXahf.exe
  C:\Windows\System\cYFXahf.exe
  2⤵
  PID:9892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CEphpwa.exe

Filesize
2.3MB

MD5
796fee24f164452ba31911942cd4fdd4

SHA1
4f8271c9625082d294a6640e98af22340f641e96

SHA256
3b5fe07a6b72fd9ba39ea915e9252204e21674a2acd6ccb167a5b8178328fe9e

SHA512
b5a6a5cd91d8545aa1d450221131bb3900324526e213fd0425389d5421c92c92b700d4ce7670a517adc1ae21362473b040e43dafc7c459b0b73571faf5db08a9

Download Submit
C:\Windows\system\DMErxUa.exe

Filesize
2.3MB

MD5
a06de37ce5e3db940dda61fd931247cb

SHA1
3e3d4ee584fa02f7e296038f796baf83a1c7ec58

SHA256
bc226bf2f754c579549dfd5f1b2cb1608e5987d92e4e6b5c1d9892087fa99116

SHA512
ee2032613319eac5440feaa31524ff9318b1547618b43adcbf86904a2b201500ebd9bf488834f0ae416352ecca8225170de303b05df01a80304a98c99cb5579f

Download Submit
C:\Windows\system\EUiIgol.exe

Filesize
2.3MB

MD5
2ffa3d2e1635acfd46b38bacd0dbf51d

SHA1
38b562e72a4365933cebad0de47e5f310ed59c1b

SHA256
35cfbe49fe79932dbd371e5258baee69e4f3c9037d123f7230080798b2bc6bab

SHA512
3ec3492ea262bd64156239fba0be40db89a4b6d07829ac9d159279c4d3dc5f887e12106070835488a3b93aef2d0fe607ac4a393ea1152fe7087d37afe1aeef29

Download Submit
C:\Windows\system\GCosOht.exe

Filesize
2.3MB

MD5
ebd731288142ce2161bb1441d16b80da

SHA1
6c2902bde47bec330519b64bf15d875055711e6b

SHA256
9ded2f5cb22a851bcc09514a4e04da61b9a72d86294c05a193f8c5ec3daaea28

SHA512
90d3110850440ff698e762e14f8b5ce32e27b558121e91508d87a4ddd8d7dadba6d9359c7ad84fa5da37c6813983b4f7805f88c06f472a711c65585926d47559

Download Submit
C:\Windows\system\KGPMmuS.exe

Filesize
2.3MB

MD5
789076f3137f77cfa1a0ec1fe25bc7c6

SHA1
e3fcaf03dfcf84b3e8503fec1ff338b4917cf932

SHA256
e90679a740f21e003ac1cce54031acff936a3a0a839f0e40d7821c2991504819

SHA512
0a59d2f78246f3490f0f912bd097a433008f333c849056b79afe34f152e0236e022471d7c3216f388d1572bcb3464eb74e7694ee8e8d034a26184ef1b831b464

Download Submit
C:\Windows\system\LEiAsQr.exe

Filesize
2.3MB

MD5
8d5366852e579b4c8e1fb04fe1a2ed50

SHA1
6aeaf39d63e93d53eea637d9d60a97cf5d951dc4

SHA256
e390d97be2d11ecf536ba645d8dfce4bce3f022520ec6fcf51e087f252d4fb4f

SHA512
3eea1fce594bca72f224fb8ada213f1ed26dd1a54dfb61218053c38ba679292e987fbaeae5aa34eb9fda97379fb31d9a47d8b286961a0e32b55a597ab0e565a9

Download Submit
C:\Windows\system\OrwSjsW.exe

Filesize
2.3MB

MD5
fa8364ca331679d92041db8722343903

SHA1
0ad1c38ccafa8ef43fb11193271a99bf6ba5f3a5

SHA256
ecccf1f7fb85cc71803028f27163257050138d66c15fbed289771ea6a9bedf0c

SHA512
869db2078c7bdc5a46096eaa7df686fb8830d2c3897ed79d18e99e900d37bf3987ce498d296b2890bc40011bbdf91c803322ec3de7243384d36bee6567531b52

Download Submit
C:\Windows\system\PGacVOq.exe

Filesize
2.3MB

MD5
780a91ad0318ce3b0eb5d89fdd678719

SHA1
cb912cda826ecd52be1d72a959fdcd5a17abafd6

SHA256
96618a1fd6a8e0951a458ea7441c7485fe1ce51115ae6e3845a3eef874351744

SHA512
b7a51faadcb3ae81305de1127d5ba2d740274e19efe56fb67cd7b4a699e74423e822cb26553edf4e8ac764281bc6945ac00bb3f7326f30067531b0adb4330343

Download Submit
C:\Windows\system\QdBXzJD.exe

Filesize
2.3MB

MD5
0633d2d6b11626790685a01d4d85129f

SHA1
8027e917938c9ef17f0d22af081ff4f1c5ecc98d

SHA256
c3a5cbaf22748c9c925e8a4f95b1b3a1c95c2db7f43376aa29f37b925072244d

SHA512
9e250329b9989ab5dd43e56df7594945d1d755573ebb4f5af4ba3b5de5651dffda9f2e5d60dec82fdcffb85522083dbe28e067f8b0bf35aad3ff821e95d32d74

Download Submit
C:\Windows\system\UHAykgr.exe

Filesize
2.3MB

MD5
77baa0bd476d96147f8987951a39b192

SHA1
d72105739ae769e7c1928ebd8da06e7bbd02463c

SHA256
8efa98c1158b72f35db0c4b7a4819a053388817ee89340f5d29650bfc14f2ebd

SHA512
67a9a42114dbb8a7e4ff3b5260be65404017266e417f05a0c723204d338bfc2af259a2c8f0cb6c864f1d1ccf45ee8ff833f02a18468b89a05576b2b4169cc454

Download Submit
C:\Windows\system\ZdaaBMo.exe

Filesize
2.3MB

MD5
97b8347414ae0bff7645189786d19f5d

SHA1
abcb39e004df9be5bcfd8da94c26958f97b152d1

SHA256
8d3cf2ab57fd5bc739e46f05f4b9f11f24fbff508c493f067dc7488bd4a8447f

SHA512
1be8bc093f79a3b4b62a9fb828e4b38c5dbc944cb65da7c7a455a076efb2013060d5263fab2351e9b77756575e611a5f43bb0b89982ec849a9ccbb504314fd04

Download Submit
C:\Windows\system\bPCEAjU.exe

Filesize
2.3MB

MD5
13b85a3240c797e66671672f2e1f7a82

SHA1
04814fb24e8922c192db78f9805c00732cb7f5bf

SHA256
c1622f4cb2105a7392550a9f2dba2b180e737a12ec9aa9a55484e81e5550e693

SHA512
994ade55d76709c23e90970e851414a98c1eb820d41eb74b35334ccca546d713fe0e9c4d24796864edc0f67d2fc8aa57de1b466aeeab1a1f9f7676e89ce9bacd

Download Submit
C:\Windows\system\gSeJvKg.exe

Filesize
2.3MB

MD5
bb4b4e7ea0beb730ec5f4dc06fae8b81

SHA1
af5e3877d8f81581f1dc2a2cee347a642f1dd638

SHA256
5457dbfc039dc98e5c57fe689c7b73f06c933e59dc9a542bf7c3eddf558b9d5e

SHA512
ba8c8c4836bf6ac3ed39b914fa7082a8ef08e22bfb2cf2898e3e01243e9d3a1737b780db35920463803ff5b503270d564e8a045ded84959d3d8cac55eca09fe9

Download Submit
C:\Windows\system\gWKNSvE.exe

Filesize
2.3MB

MD5
8eb3c51cbbe9346022be7d56d5df48b5

SHA1
3eb6507977d2be595b60ed7e9e61b35cd4224304

SHA256
bd1488ad6fe8a1f7a4b793c6042da30ce574064497fa46b8a40716dc62f595e2

SHA512
7ff152720196f29817322158175b51e71ddafe4a977cf0810f216fbfa6c8ceec22cdceac9ff84d0d2b93098f1a54977a8055c51361e6e21d742daaf11985896d

Download Submit
C:\Windows\system\jGOTmEK.exe

Filesize
2.3MB

MD5
355f8dccd9fc309875e1b971a969137a

SHA1
8f7e5dd0073aeb87cf331dc99ebdd3d0f816ed71

SHA256
adfa32b670aefb55fe550c8f6b91bd5a94099bdceb2e3afba29c3db95fcc9cf1

SHA512
1cb1561fa26f4d2743bb6a344578c61c249f09761a56eb56355f275d7321e977b6fc53c694e55442f9ff435422b353ecbb9b73bc0740796d96dc930bec8c68e8

Download Submit
C:\Windows\system\lmAgMfF.exe

Filesize
2.3MB

MD5
fa9595c12bed5b24bbb3fe3348aafe8e

SHA1
e8d340bfb068328c5a87ea6385656f1375dee06b

SHA256
d09cd296214a7a51a182048e4a4887ff3c99c432fd1c28d5874b0fa108de6257

SHA512
d5618888dbe37e169ca92475bb6371d9d73010657431fc94f84c6658d1243bcf8124f9a4767a313584a30d4ce02bcae1cd88059b9df20677a96b57cdc3c4b86a

Download Submit
C:\Windows\system\mNvwCSH.exe

Filesize
2.3MB

MD5
4da8685a6850ad83789bd16ff8ab92e2

SHA1
ea69dc195c0c8be3a4cd8343df4fe3c0b49b752d

SHA256
99626a5764d870e54cc391e2f4b4c73aabb1fa15f5106b97d68c84b483c6ae9a

SHA512
f409b14634538ffb2dfc5df7e2afeb2bdebc7c55e42834d78fa8123b13dc20b748cc192bf86efa3796dc633a866ef6dc39a2cddfce502e740e6848caf430b2fb

Download Submit
C:\Windows\system\ntVifQH.exe

Filesize
2.3MB

MD5
e5492da7a526ba6c4de47acf5eec0a14

SHA1
28c8f0772ef7b18d27080710fe4eb4ac9f72685c

SHA256
623f016204770f15375516be5968928f2cef0e91fab4190bc14156fd8f36ee4b

SHA512
b7b8a064cfeaeaee09d91c0d1baee7d882fb65b68217200d4342b071fc9eedcde5e1440d69f4974936b69abc7d98f36c33f44c5376a65ef0d7e3b0c45c502f3d

Download Submit
C:\Windows\system\suNjgHL.exe

Filesize
2.3MB

MD5
9fccfd67a46d7a40047206fc29545e06

SHA1
e77a5dbb39798867982e69e526e520f5b8929e0c

SHA256
c5aed76616de09198f8c06d0b58e971f65373eb1c6c0ae7ec89cb7f0dbe0b2cc

SHA512
a989c26d722729c84250f2d2144dcb37f9560e4695649b0b14184c95a6b6dae049d7ec116ade65f0356914d8ce8a2884a59ee9476ad085db570080edeb9fdc88

Download Submit
C:\Windows\system\tXkHlHe.exe

Filesize
2.3MB

MD5
85c7a67726db607cc1614f0f5a24fdd7

SHA1
0b9488bd9ce97ee0e1c09e147dbc51bab98cd556

SHA256
2b456af2f5bcc51f073f635d7009fb73481f6a8b7af49706476ede7aef254f0b

SHA512
ea1809de6f0417091a61c08a2cece0849808531d0c5e630ecf4c6186fd1664e9df2b73706bad484ca9532561c02ff7a39cba8318e4ec23a52d70d86602c11655

Download Submit
C:\Windows\system\ttPRaqf.exe

Filesize
2.3MB

MD5
0c683a21dd85cbc254a19e95744d9280

SHA1
025ca2bb31276efb44ac73ed5db3f462348a24e3

SHA256
4a43628aeb10a9163231df4d9087742491bcc6bf68e130a3257705d06dbda73d

SHA512
60775e87361572654a4137132f956371fce878c319f3ae0cd695595a692bfb3f6c50bd180b61705013f82b163ef868d4dbddd700c41ccba40b0fb03a994e250a

Download Submit
C:\Windows\system\xAXRbKL.exe

Filesize
2.3MB

MD5
89e6bd306bc74c4ebc9154d3159f1a49

SHA1
5aad592e76aec3812852fdbce2c72eb428fa1f47

SHA256
933ae86346e18d1cd7e803c34ccf68edb2ce3980890d1b347d8a545a790445a2

SHA512
f0c4ed214f299d6c3c0148838afa9501df6da8b4d5c5eb0c2b09a53f476ff718308d2f99176c659101d1c570dbe72d331ccca3d22211ae4f0192d9a2752b7fc2

Download Submit
C:\Windows\system\zTCKqMj.exe

Filesize
2.3MB

MD5
20425866e396e162518918d388adfdc8

SHA1
f5dfe088ab4e9ec47b29e5fec740f169d7fcdcd7

SHA256
980d2e1e6434f06fee0a938bc1879f1cd1f07cd1f5e4d4745b3a252217f3f901

SHA512
804b953eaadb752e8f79193c345e334eb1eb05d2a1db0d95e5b5ea9dff77e22fc83f1f8fad6a535ee73939ba1b13e1c1edba5edb843719acb6ea32cc05dfc3bd

Download Submit
C:\Windows\system\zYMPFYp.exe

Filesize
2.3MB

MD5
7eb74dbd44fc1f3dc09438b71639f2df

SHA1
3ce82e3dab421d8bf5df4e9a64cf5ea34cf37e2f

SHA256
e484c8bf332a8037d3971dd2a00aa79dfd1730436188612f6232e2cab2e2723b

SHA512
1d1eb7debe69bb552968e9f6647cf02bd8de439f2041893eed1ceaeb3e3ce71b9e04a7add52c002b9cfabbbe94368d9d983f836a6ac3274469a14d4aedb38514

Download Submit
\Windows\system\BCYsRWv.exe

Filesize
2.3MB

MD5
2feb2ecb678724bc7d2bead07ec7d429

SHA1
4c052954c6410dd2a0eb7970c44e7492ad09cbd7

SHA256
3b25c2cf49f6165456965568d7dac75aa8178f2d8e59b4b18ae2f5b52d4ea126

SHA512
97c418470d64da1ca385ebf9924c1a3bc8416e7932685d4386bf3cb3d96797f59ad08e087980ac06bb288fbc4326005f18ef955a20ca81a481326b0aad8067e2

Download Submit
\Windows\system\GVcbptw.exe

Filesize
2.3MB

MD5
7c5e3786a0613455fa8930e8fefeacec

SHA1
475837e32bd1599d1bc30f3af1d20a672a6eb135

SHA256
e833558c7628e1d11a40cb185c8708db60ee05a326c4c8ef7cf9283998d83ef7

SHA512
aa91615c68ffaca17ddde56ba4499fb34844ff3ad4db312edf4d4eb9b5cb77b7bde896064783d1319e31e359e6b537b8b77f9795bd18ae938fa39948084fae34

Download Submit
\Windows\system\GiysNgS.exe

Filesize
2.3MB

MD5
112fe0daf4c4558a249212f5885ad632

SHA1
1a82867ea0390ad727c3241ee4185dbb0774621e

SHA256
49af500595e7aa9c5d379cac32ba2fe909f7521643ec5e1470f1b2eccf0a24af

SHA512
2f706c2bc47006a7114b51d3bffc376af631d6e15b9886576a4aec6734352a9e67aa5c11f584b8eec3621b86bcdab1f7646345c17c582f217afdd57e93d74e8b

Download Submit
\Windows\system\TOmMzlQ.exe

Filesize
2.3MB

MD5
7a2fe0021f7a29f0dfd4c00a997d5cc0

SHA1
4ff9a5248ebcc604cbd4dbc15a4d9169f50cafd4

SHA256
b9fb246b26e90be54aa5488a9c1c18ec8ee73aedca394d6048f2a176e9ee570b

SHA512
d21d379d213f48ec3534217c8aa93d4c1f2051a9dd0034cf0a41686da655d68b05630e15fe6781c31e3fc47ee9a785faa61c7f2db3305a782a36421d1e7c3870

Download Submit
\Windows\system\daGGrIs.exe

Filesize
2.3MB

MD5
df5b232ead29c051b6dd10a30ce7d091

SHA1
0365a18d77e9fd191f109e4799a87b2e2bf8026a

SHA256
6274b22c334b6b313ff26752a480c59d89fe4b0da7301971c184394fdc7dfc63

SHA512
49c75bfcaae67a0bed9c8061a6e0c9f29a743d685506b19e1c044b9ff495f289d69629b81d356a18298bdf5d2328432f3f929814024f762570fd5e49a74bd4e2

Download Submit
\Windows\system\fvvNqaO.exe

Filesize
2.3MB

MD5
8dafa8bfbb2021c08fe65e18f0d0c03c

SHA1
d353f9085d373684c747dd308074fa28bcc48630

SHA256
0b852a74f9f24ea76133ac648af5a84ea7210239e7b296881cfc53099274336a

SHA512
24757803e60614c7bea09e0091f66d63a0843229a80a6e9d75eb59649cb7a3baf43ef8ae8ff79d35a8d351b99480181437f388687f84a6e9ebe0728ff8172f9c

Download Submit
\Windows\system\gOKpSeA.exe

Filesize
2.3MB

MD5
2579d00abf26de3b6a6800deb46a2f1a

SHA1
1948d36d7fe5fb29758a46fb2db280c691dd1677

SHA256
ec596d6394a1e8c7cdc48913d695b0e0c73b309a32d35933a108f114fe17020e

SHA512
a6185d09fdb2e870527746beb32c05821f72166aba67a9bb0f2a48c99c54ec2b7394f3ac9f59c300f85c4f0912130c671789fd25221b6ce2655c6097227cc3f9

Download Submit
\Windows\system\gghdyFr.exe

Filesize
2.3MB

MD5
d4bbcc46df556ab152a13ad102e84962

SHA1
4ba990254e3eb4e8c45da7da00ffbf3cf844767c

SHA256
efea8145625422dd00fe8d447bdbb1fe7b21fe3107e4a93b8667b258e465da90

SHA512
abbb9b5f72bcb7fd839ed0a7d3fa83bce1be079de1e4624767ed6ad8f787b75d5be82ea54b59517f2ae50a55630eb71d666e84c0356cd6827f660874a55d484e

Download Submit
\Windows\system\uytcTKi.exe

Filesize
2.3MB

MD5
1669e9e5f89a9653ef54e7ff1a11defc

SHA1
bf396f37c061e2f2c0183fddac8b5102299d1be8

SHA256
0fe932369952003c69e0652f59b72f652dfebe7ccce2d077076740578b94466c

SHA512
4c83832b9df68c01cd8bd5943279c8800e9a5ca6b22819db87924834d44b4c22cbf00ade769e110d74c0b882cebc4d45ded2b377513f20e826c827a048aeefc2

Download Submit
\Windows\system\vVRRvtf.exe

Filesize
2.3MB

MD5
020c090481a8f704d95766cb849670db

SHA1
ab9b8fdc69782c35c15a8ac5a8e51800467d9190

SHA256
e0113f6c201bf7feb5c48da0eb747deb398217a4f5fdb8cff65d32f396c4ce83

SHA512
f0318039414a394035b1913bf0582a90dc8def10f5c79e8ae9d8e88625f17cddb5495b02587fde5af1505a29640e7d4319a14b1f77341ac3c5842249c7483506

Download Submit
memory/1548-65-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/1636-24-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/1928-83-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/1928-86-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/1928-120-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/1928-19-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/1928-21-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/1928-103-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/1928-97-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/1928-90-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/1928-22-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/1928-33-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/1928-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1928-51-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/1928-48-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/1928-0-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/1928-66-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/1928-60-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/1928-64-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2484-108-0x000000001B490000-0x000000001B772000-memory.dmp

Filesize
2.9MB

Download
memory/2484-118-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2536-50-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2536-271-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2652-270-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2652-28-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-26-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-119-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2704-58-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2724-36-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/3036-20-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download