xmrig | 605ea6465985d6f5406104563313cb0a721b41ba7c1bd385cea93163f3887782

Analysis

max time kernel
17s
max time network
19s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
Size

2.2MB
MD5

06d3e20f43bb657bff3304a23ba4b746
SHA1

103975a35d34f7cb778f30cb92b2d68e7e61ee49
SHA256

605ea6465985d6f5406104563313cb0a721b41ba7c1bd385cea93163f3887782
SHA512

6316d941bed439e2cfdfff00b12b28d094ebc957b8bec27d5263936f178e8e97b1c044866d4a92977a6c5a3c7d7970c37422efb981a1efc363e5db6bad5b61de
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfWe:NABy

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2664-15-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/2684-88-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2924-414-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2564-1114-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2788-99-0x000000013FE40000-0x0000000140232000-memory.dmp	xmrig
behavioral1/memory/2732-95-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/712-85-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/2052-81-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2888-80-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2564	UilQgvH.exe
2664	oSwKWLE.exe
2528	OjhSFwm.exe
2704	SorrTDl.exe
2600	SNobaJI.exe
2476	vuIrkgc.exe
2888	CymeMGX.exe
2052	JjyRANp.exe
712	mqjpGGF.exe
2684	nMKIdKF.exe
2732	WEozruB.exe
2788	unxHWtC.exe
1044	qVqVvIJ.exe
1624	jMZdwoG.exe
1508	buuAFJZ.exe
284	wuxcplb.exe
2384	xQKrcHn.exe
1216	tixvImV.exe
2256	zJyKLUS.exe
2516	EVVUIRz.exe
1628	ZxCkwiC.exe
2772	zoewMjP.exe
2400	wAebuqM.exe
692	FglqEPV.exe
1428	DqRHenN.exe
2216	KcjvGDk.exe
1720	MjuTsPC.exe
2840	hezldac.exe
3004	jWrmCRR.exe
624	RSXHLlk.exe
496	QVDuzuL.exe
2292	UgKcfCN.exe
976	hoeIpFi.exe
2392	lJSpUqe.exe
992	WyPQOKW.exe
3036	egHEFRO.exe
1604	CAxLseF.exe
1816	UYbIDSY.exe
2284	EMbHjOz.exe
1020	uIcIyXO.exe
2092	NovGHtv.exe
2260	xhleHVM.exe
2356	noEaLMs.exe
2380	WdgXsTY.exe
2156	bIXkotW.exe
1444	SfbPOgf.exe
1796	pRxYgTP.exe
1536	IRboWks.exe
2820	UTKnxKv.exe
3044	rSXMRUC.exe
1896	BiPFgmd.exe
996	YtlxBCS.exe
2088	gnxcwmF.exe
908	TBoIDpx.exe
1776	owFaOjo.exe
2484	GExzRxi.exe
2780	ccTfbgO.exe
1532	wRXFIqs.exe
2632	SqtMgGC.exe
1636	WFVrARM.exe
1608	seTgSMz.exe
2024	KsKgWXn.exe
2824	rPWaPsm.exe
1968	FsRnKwV.exe

Loads dropped DLL 64 IoCs

pid	Process
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2924-1-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/files/0x000f000000012331-5.dat	upx
behavioral1/memory/2664-15-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/files/0x0007000000014183-20.dat	upx
behavioral1/memory/2528-21-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/files/0x000700000001418c-23.dat	upx
behavioral1/memory/2704-38-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/files/0x000700000001431b-46.dat	upx
behavioral1/memory/2476-47-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/files/0x0006000000014b1c-59.dat	upx
behavioral1/files/0x0008000000014a60-54.dat	upx
behavioral1/files/0x000600000001507a-87.dat	upx
behavioral1/memory/2684-88-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/files/0x00060000000150d9-105.dat	upx
behavioral1/files/0x00060000000153ee-116.dat	upx
behavioral1/files/0x0006000000015083-100.dat	upx
behavioral1/files/0x00060000000158d9-126.dat	upx
behavioral1/files/0x0006000000015cc5-161.dat	upx
behavioral1/files/0x0006000000015ce3-170.dat	upx
behavioral1/files/0x0006000000015b50-136.dat	upx
behavioral1/files/0x0006000000015cb1-154.dat	upx
behavioral1/files/0x0006000000015cd2-187.dat	upx
behavioral1/files/0x0006000000015d0a-182.dat	upx
behavioral1/files/0x0006000000015cee-174.dat	upx
behavioral1/files/0x0006000000015c9a-167.dat	upx
behavioral1/files/0x0006000000015d21-190.dat	upx
behavioral1/files/0x0006000000015cf8-181.dat	upx
behavioral1/memory/2924-414-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2564-1114-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/files/0x0032000000013adc-130.dat	upx
behavioral1/files/0x0006000000015ca8-152.dat	upx
behavioral1/files/0x0006000000015b85-141.dat	upx
behavioral1/files/0x0006000000015ae3-135.dat	upx
behavioral1/files/0x0006000000015662-121.dat	upx
behavioral1/memory/2788-99-0x000000013FE40000-0x0000000140232000-memory.dmp	upx
behavioral1/memory/2732-95-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/files/0x000600000001565a-114.dat	upx
behavioral1/memory/712-85-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/files/0x0006000000014f57-82.dat	upx
behavioral1/memory/2052-81-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2888-80-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/files/0x0006000000014c2d-71.dat	upx
behavioral1/files/0x0006000000014bd7-66.dat	upx
behavioral1/files/0x0016000000005586-51.dat	upx
behavioral1/memory/2600-43-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/files/0x0007000000014251-35.dat	upx
behavioral1/files/0x0032000000013a88-11.dat	upx
behavioral1/memory/2564-8-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XeERZXc.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\pwsVwme.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\DqtZEmu.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\nICEQpG.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\uHqYdfN.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\ILSGecx.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\iRliwiK.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\SVUlAop.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\oBBZDmB.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\apImMcw.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\HeSvbuH.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\WEozruB.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\BxjXwRv.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\ioIPUNr.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\Emvacdr.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\MCqXXdx.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\OMVZupx.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\WSwpTwk.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\bIXkotW.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\seTgSMz.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\oOZwUfa.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\DJvIDKH.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\KpkRVop.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\sBRLsqw.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\btrVEJn.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\rLsEKSU.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\bBcfnNb.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\sDHbUAW.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\jYuMTjK.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\sHBMsAB.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\RdGoeyB.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\LuBbxNd.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\uIcIyXO.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\mmDbdkx.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\eNNXtdc.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\GUPhajh.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\LZJJakK.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\GRSuXok.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\jRKSGEO.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\AuyBxqT.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\DghlUTC.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\jFeKkcX.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\jyBfPbH.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\qihmvWc.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\wFwhhaR.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\oWXevot.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\EnKLxky.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\VDdliQF.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\OwNVclt.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\MYOujXJ.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\iBwtnMx.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\leSNVks.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\aXyVYgd.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\RMaBuGL.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\JJAnMtP.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\OsVBuiH.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\iTuEumw.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\ThOfGJu.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\BXitpdg.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\YvlGXPE.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\qjYRbba.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\unxHWtC.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\XQeerOc.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
File created	C:\Windows\System\pUszVAO.exe	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2908	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
Token: SeDebugPrivilege	2908	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2908	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	29
PID 2924 wrote to memory of 2908	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	29
PID 2924 wrote to memory of 2908	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	29
PID 2924 wrote to memory of 2564	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	30
PID 2924 wrote to memory of 2564	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	30
PID 2924 wrote to memory of 2564	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	30
PID 2924 wrote to memory of 2664	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	31
PID 2924 wrote to memory of 2664	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	31
PID 2924 wrote to memory of 2664	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	31
PID 2924 wrote to memory of 2528	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	32
PID 2924 wrote to memory of 2528	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	32
PID 2924 wrote to memory of 2528	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	32
PID 2924 wrote to memory of 2704	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	33
PID 2924 wrote to memory of 2704	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	33
PID 2924 wrote to memory of 2704	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	33
PID 2924 wrote to memory of 2600	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	34
PID 2924 wrote to memory of 2600	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	34
PID 2924 wrote to memory of 2600	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	34
PID 2924 wrote to memory of 2476	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	35
PID 2924 wrote to memory of 2476	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	35
PID 2924 wrote to memory of 2476	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	35
PID 2924 wrote to memory of 2888	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	36
PID 2924 wrote to memory of 2888	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	36
PID 2924 wrote to memory of 2888	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	36
PID 2924 wrote to memory of 2052	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	37
PID 2924 wrote to memory of 2052	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	37
PID 2924 wrote to memory of 2052	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	37
PID 2924 wrote to memory of 712	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	38
PID 2924 wrote to memory of 712	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	38
PID 2924 wrote to memory of 712	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	38
PID 2924 wrote to memory of 2684	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	39
PID 2924 wrote to memory of 2684	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	39
PID 2924 wrote to memory of 2684	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	39
PID 2924 wrote to memory of 2732	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	40
PID 2924 wrote to memory of 2732	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	40
PID 2924 wrote to memory of 2732	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	40
PID 2924 wrote to memory of 2788	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	41
PID 2924 wrote to memory of 2788	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	41
PID 2924 wrote to memory of 2788	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	41
PID 2924 wrote to memory of 1044	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	42
PID 2924 wrote to memory of 1044	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	42
PID 2924 wrote to memory of 1044	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	42
PID 2924 wrote to memory of 1624	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	43
PID 2924 wrote to memory of 1624	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	43
PID 2924 wrote to memory of 1624	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	43
PID 2924 wrote to memory of 1508	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	44
PID 2924 wrote to memory of 1508	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	44
PID 2924 wrote to memory of 1508	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	44
PID 2924 wrote to memory of 2384	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	45
PID 2924 wrote to memory of 2384	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	45
PID 2924 wrote to memory of 2384	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	45
PID 2924 wrote to memory of 284	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	46
PID 2924 wrote to memory of 284	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	46
PID 2924 wrote to memory of 284	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	46
PID 2924 wrote to memory of 1216	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	47
PID 2924 wrote to memory of 1216	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	47
PID 2924 wrote to memory of 1216	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	47
PID 2924 wrote to memory of 2256	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	48
PID 2924 wrote to memory of 2256	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	48
PID 2924 wrote to memory of 2256	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	48
PID 2924 wrote to memory of 2516	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	49
PID 2924 wrote to memory of 2516	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	49
PID 2924 wrote to memory of 2516	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	49
PID 2924 wrote to memory of 1628	2924	06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06d3e20f43bb657bff3304a23ba4b746_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\Windows\System\UilQgvH.exe
  C:\Windows\System\UilQgvH.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\oSwKWLE.exe
  C:\Windows\System\oSwKWLE.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\OjhSFwm.exe
  C:\Windows\System\OjhSFwm.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\SorrTDl.exe
  C:\Windows\System\SorrTDl.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\SNobaJI.exe
  C:\Windows\System\SNobaJI.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\vuIrkgc.exe
  C:\Windows\System\vuIrkgc.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\CymeMGX.exe
  C:\Windows\System\CymeMGX.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\JjyRANp.exe
  C:\Windows\System\JjyRANp.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\mqjpGGF.exe
  C:\Windows\System\mqjpGGF.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\nMKIdKF.exe
  C:\Windows\System\nMKIdKF.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\WEozruB.exe
  C:\Windows\System\WEozruB.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\unxHWtC.exe
  C:\Windows\System\unxHWtC.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\qVqVvIJ.exe
  C:\Windows\System\qVqVvIJ.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\jMZdwoG.exe
  C:\Windows\System\jMZdwoG.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\buuAFJZ.exe
  C:\Windows\System\buuAFJZ.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\xQKrcHn.exe
  C:\Windows\System\xQKrcHn.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\wuxcplb.exe
  C:\Windows\System\wuxcplb.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\tixvImV.exe
  C:\Windows\System\tixvImV.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\zJyKLUS.exe
  C:\Windows\System\zJyKLUS.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\EVVUIRz.exe
  C:\Windows\System\EVVUIRz.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\ZxCkwiC.exe
  C:\Windows\System\ZxCkwiC.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\wAebuqM.exe
  C:\Windows\System\wAebuqM.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\zoewMjP.exe
  C:\Windows\System\zoewMjP.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\KcjvGDk.exe
  C:\Windows\System\KcjvGDk.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\FglqEPV.exe
  C:\Windows\System\FglqEPV.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\hezldac.exe
  C:\Windows\System\hezldac.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\DqRHenN.exe
  C:\Windows\System\DqRHenN.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\RSXHLlk.exe
  C:\Windows\System\RSXHLlk.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\MjuTsPC.exe
  C:\Windows\System\MjuTsPC.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\lJSpUqe.exe
  C:\Windows\System\lJSpUqe.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\jWrmCRR.exe
  C:\Windows\System\jWrmCRR.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\WyPQOKW.exe
  C:\Windows\System\WyPQOKW.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\QVDuzuL.exe
  C:\Windows\System\QVDuzuL.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\egHEFRO.exe
  C:\Windows\System\egHEFRO.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\UgKcfCN.exe
  C:\Windows\System\UgKcfCN.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\CAxLseF.exe
  C:\Windows\System\CAxLseF.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\hoeIpFi.exe
  C:\Windows\System\hoeIpFi.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\UYbIDSY.exe
  C:\Windows\System\UYbIDSY.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\EMbHjOz.exe
  C:\Windows\System\EMbHjOz.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\uIcIyXO.exe
  C:\Windows\System\uIcIyXO.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\NovGHtv.exe
  C:\Windows\System\NovGHtv.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\rSXMRUC.exe
  C:\Windows\System\rSXMRUC.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\xhleHVM.exe
  C:\Windows\System\xhleHVM.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\BiPFgmd.exe
  C:\Windows\System\BiPFgmd.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\noEaLMs.exe
  C:\Windows\System\noEaLMs.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\YtlxBCS.exe
  C:\Windows\System\YtlxBCS.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\WdgXsTY.exe
  C:\Windows\System\WdgXsTY.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\gnxcwmF.exe
  C:\Windows\System\gnxcwmF.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\bIXkotW.exe
  C:\Windows\System\bIXkotW.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\TBoIDpx.exe
  C:\Windows\System\TBoIDpx.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\SfbPOgf.exe
  C:\Windows\System\SfbPOgf.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\owFaOjo.exe
  C:\Windows\System\owFaOjo.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\pRxYgTP.exe
  C:\Windows\System\pRxYgTP.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\wRXFIqs.exe
  C:\Windows\System\wRXFIqs.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\IRboWks.exe
  C:\Windows\System\IRboWks.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\SqtMgGC.exe
  C:\Windows\System\SqtMgGC.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\UTKnxKv.exe
  C:\Windows\System\UTKnxKv.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\JYkryzQ.exe
  C:\Windows\System\JYkryzQ.exe
  2⤵
  PID:2920
- C:\Windows\System\GExzRxi.exe
  C:\Windows\System\GExzRxi.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\AuXEhOb.exe
  C:\Windows\System\AuXEhOb.exe
  2⤵
  PID:2720
- C:\Windows\System\ccTfbgO.exe
  C:\Windows\System\ccTfbgO.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\UBRLETw.exe
  C:\Windows\System\UBRLETw.exe
  2⤵
  PID:1588
- C:\Windows\System\WFVrARM.exe
  C:\Windows\System\WFVrARM.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\JWjnDGj.exe
  C:\Windows\System\JWjnDGj.exe
  2⤵
  PID:2304
- C:\Windows\System\seTgSMz.exe
  C:\Windows\System\seTgSMz.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\JhaoctQ.exe
  C:\Windows\System\JhaoctQ.exe
  2⤵
  PID:2372
- C:\Windows\System\KsKgWXn.exe
  C:\Windows\System\KsKgWXn.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\ddyymlc.exe
  C:\Windows\System\ddyymlc.exe
  2⤵
  PID:2252
- C:\Windows\System\rPWaPsm.exe
  C:\Windows\System\rPWaPsm.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\VUygZIE.exe
  C:\Windows\System\VUygZIE.exe
  2⤵
  PID:2020
- C:\Windows\System\FsRnKwV.exe
  C:\Windows\System\FsRnKwV.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\JngUbVc.exe
  C:\Windows\System\JngUbVc.exe
  2⤵
  PID:3028
- C:\Windows\System\thvxYpm.exe
  C:\Windows\System\thvxYpm.exe
  2⤵
  PID:2072
- C:\Windows\System\ERcsyGI.exe
  C:\Windows\System\ERcsyGI.exe
  2⤵
  PID:2404
- C:\Windows\System\bKDymPa.exe
  C:\Windows\System\bKDymPa.exe
  2⤵
  PID:816
- C:\Windows\System\DagZSdD.exe
  C:\Windows\System\DagZSdD.exe
  2⤵
  PID:2108
- C:\Windows\System\DghlUTC.exe
  C:\Windows\System\DghlUTC.exe
  2⤵
  PID:2008
- C:\Windows\System\GsUZHme.exe
  C:\Windows\System\GsUZHme.exe
  2⤵
  PID:2324
- C:\Windows\System\LJqfhzB.exe
  C:\Windows\System\LJqfhzB.exe
  2⤵
  PID:1224
- C:\Windows\System\gUAsKpv.exe
  C:\Windows\System\gUAsKpv.exe
  2⤵
  PID:1644
- C:\Windows\System\cZupdsP.exe
  C:\Windows\System\cZupdsP.exe
  2⤵
  PID:972
- C:\Windows\System\fuDJHYK.exe
  C:\Windows\System\fuDJHYK.exe
  2⤵
  PID:1420
- C:\Windows\System\OwNVclt.exe
  C:\Windows\System\OwNVclt.exe
  2⤵
  PID:1060
- C:\Windows\System\ynKZqfZ.exe
  C:\Windows\System\ynKZqfZ.exe
  2⤵
  PID:1808
- C:\Windows\System\mrfutIE.exe
  C:\Windows\System\mrfutIE.exe
  2⤵
  PID:2220
- C:\Windows\System\SVUlAop.exe
  C:\Windows\System\SVUlAop.exe
  2⤵
  PID:1672
- C:\Windows\System\gujgQDV.exe
  C:\Windows\System\gujgQDV.exe
  2⤵
  PID:2748
- C:\Windows\System\OpZgSrj.exe
  C:\Windows\System\OpZgSrj.exe
  2⤵
  PID:2556
- C:\Windows\System\NzBoYwW.exe
  C:\Windows\System\NzBoYwW.exe
  2⤵
  PID:780
- C:\Windows\System\ghDGVCF.exe
  C:\Windows\System\ghDGVCF.exe
  2⤵
  PID:2672
- C:\Windows\System\aPRabcQ.exe
  C:\Windows\System\aPRabcQ.exe
  2⤵
  PID:1540
- C:\Windows\System\vNDjIsf.exe
  C:\Windows\System\vNDjIsf.exe
  2⤵
  PID:1660
- C:\Windows\System\xfJetKA.exe
  C:\Windows\System\xfJetKA.exe
  2⤵
  PID:2432
- C:\Windows\System\aemkCKg.exe
  C:\Windows\System\aemkCKg.exe
  2⤵
  PID:2848
- C:\Windows\System\IlXDOom.exe
  C:\Windows\System\IlXDOom.exe
  2⤵
  PID:1712
- C:\Windows\System\oOZwUfa.exe
  C:\Windows\System\oOZwUfa.exe
  2⤵
  PID:3088
- C:\Windows\System\PVOLGvt.exe
  C:\Windows\System\PVOLGvt.exe
  2⤵
  PID:3104
- C:\Windows\System\sDHbUAW.exe
  C:\Windows\System\sDHbUAW.exe
  2⤵
  PID:3120
- C:\Windows\System\YtNaenZ.exe
  C:\Windows\System\YtNaenZ.exe
  2⤵
  PID:3160
- C:\Windows\System\soGJXEH.exe
  C:\Windows\System\soGJXEH.exe
  2⤵
  PID:3176
- C:\Windows\System\MgEqccZ.exe
  C:\Windows\System\MgEqccZ.exe
  2⤵
  PID:3192
- C:\Windows\System\xuzJAnb.exe
  C:\Windows\System\xuzJAnb.exe
  2⤵
  PID:3260
- C:\Windows\System\kUqLkqx.exe
  C:\Windows\System\kUqLkqx.exe
  2⤵
  PID:3280
- C:\Windows\System\qFogysz.exe
  C:\Windows\System\qFogysz.exe
  2⤵
  PID:3296
- C:\Windows\System\ZpLxiLA.exe
  C:\Windows\System\ZpLxiLA.exe
  2⤵
  PID:3312
- C:\Windows\System\OlGjlra.exe
  C:\Windows\System\OlGjlra.exe
  2⤵
  PID:3328
- C:\Windows\System\weUrZxW.exe
  C:\Windows\System\weUrZxW.exe
  2⤵
  PID:3352
- C:\Windows\System\uzadGYj.exe
  C:\Windows\System\uzadGYj.exe
  2⤵
  PID:3368
- C:\Windows\System\vztWVVE.exe
  C:\Windows\System\vztWVVE.exe
  2⤵
  PID:3384
- C:\Windows\System\JTwzaer.exe
  C:\Windows\System\JTwzaer.exe
  2⤵
  PID:3404
- C:\Windows\System\hgiqvaP.exe
  C:\Windows\System\hgiqvaP.exe
  2⤵
  PID:3452
- C:\Windows\System\JWHUxFn.exe
  C:\Windows\System\JWHUxFn.exe
  2⤵
  PID:3552
- C:\Windows\System\jHpxroU.exe
  C:\Windows\System\jHpxroU.exe
  2⤵
  PID:3568
- C:\Windows\System\ZhwznoN.exe
  C:\Windows\System\ZhwznoN.exe
  2⤵
  PID:3584
- C:\Windows\System\kMoHUSS.exe
  C:\Windows\System\kMoHUSS.exe
  2⤵
  PID:3600
- C:\Windows\System\BxjXwRv.exe
  C:\Windows\System\BxjXwRv.exe
  2⤵
  PID:3616
- C:\Windows\System\UeuQwlJ.exe
  C:\Windows\System\UeuQwlJ.exe
  2⤵
  PID:3632
- C:\Windows\System\dlyvpoX.exe
  C:\Windows\System\dlyvpoX.exe
  2⤵
  PID:3648
- C:\Windows\System\NBKFYnn.exe
  C:\Windows\System\NBKFYnn.exe
  2⤵
  PID:3664
- C:\Windows\System\XgJThPk.exe
  C:\Windows\System\XgJThPk.exe
  2⤵
  PID:3680
- C:\Windows\System\pgGIyiA.exe
  C:\Windows\System\pgGIyiA.exe
  2⤵
  PID:3696
- C:\Windows\System\ZesjwDm.exe
  C:\Windows\System\ZesjwDm.exe
  2⤵
  PID:3712
- C:\Windows\System\jfytNWK.exe
  C:\Windows\System\jfytNWK.exe
  2⤵
  PID:3728
- C:\Windows\System\CzOqtHr.exe
  C:\Windows\System\CzOqtHr.exe
  2⤵
  PID:3744
- C:\Windows\System\VkZCihj.exe
  C:\Windows\System\VkZCihj.exe
  2⤵
  PID:3760
- C:\Windows\System\iLFnvBW.exe
  C:\Windows\System\iLFnvBW.exe
  2⤵
  PID:3776
- C:\Windows\System\GyPDYUP.exe
  C:\Windows\System\GyPDYUP.exe
  2⤵
  PID:3792
- C:\Windows\System\GZUGgvk.exe
  C:\Windows\System\GZUGgvk.exe
  2⤵
  PID:3808
- C:\Windows\System\dGHRVnb.exe
  C:\Windows\System\dGHRVnb.exe
  2⤵
  PID:3824
- C:\Windows\System\CRMNDmb.exe
  C:\Windows\System\CRMNDmb.exe
  2⤵
  PID:3840
- C:\Windows\System\aGskuWK.exe
  C:\Windows\System\aGskuWK.exe
  2⤵
  PID:3856
- C:\Windows\System\yZocBcw.exe
  C:\Windows\System\yZocBcw.exe
  2⤵
  PID:3872
- C:\Windows\System\LNJcJee.exe
  C:\Windows\System\LNJcJee.exe
  2⤵
  PID:3888
- C:\Windows\System\AmmiGde.exe
  C:\Windows\System\AmmiGde.exe
  2⤵
  PID:3904
- C:\Windows\System\iJYtszf.exe
  C:\Windows\System\iJYtszf.exe
  2⤵
  PID:3920
- C:\Windows\System\oEOIHwY.exe
  C:\Windows\System\oEOIHwY.exe
  2⤵
  PID:3936
- C:\Windows\System\ZYOxpmm.exe
  C:\Windows\System\ZYOxpmm.exe
  2⤵
  PID:3952
- C:\Windows\System\NHMqBQm.exe
  C:\Windows\System\NHMqBQm.exe
  2⤵
  PID:3968
- C:\Windows\System\jhvnGWp.exe
  C:\Windows\System\jhvnGWp.exe
  2⤵
  PID:3984
- C:\Windows\System\URaLVGe.exe
  C:\Windows\System\URaLVGe.exe
  2⤵
  PID:4000
- C:\Windows\System\HrxuiVy.exe
  C:\Windows\System\HrxuiVy.exe
  2⤵
  PID:4016
- C:\Windows\System\EQXWyln.exe
  C:\Windows\System\EQXWyln.exe
  2⤵
  PID:4032
- C:\Windows\System\RYlHwiC.exe
  C:\Windows\System\RYlHwiC.exe
  2⤵
  PID:4048
- C:\Windows\System\CxDnRkz.exe
  C:\Windows\System\CxDnRkz.exe
  2⤵
  PID:4064
- C:\Windows\System\ugteArD.exe
  C:\Windows\System\ugteArD.exe
  2⤵
  PID:4080
- C:\Windows\System\qTChsQK.exe
  C:\Windows\System\qTChsQK.exe
  2⤵
  PID:2968
- C:\Windows\System\lZdGbVT.exe
  C:\Windows\System\lZdGbVT.exe
  2⤵
  PID:1940
- C:\Windows\System\irlfwBH.exe
  C:\Windows\System\irlfwBH.exe
  2⤵
  PID:1964
- C:\Windows\System\PaNmQNo.exe
  C:\Windows\System\PaNmQNo.exe
  2⤵
  PID:2448
- C:\Windows\System\yVEAZqv.exe
  C:\Windows\System\yVEAZqv.exe
  2⤵
  PID:2500
- C:\Windows\System\HPegkoc.exe
  C:\Windows\System\HPegkoc.exe
  2⤵
  PID:1584
- C:\Windows\System\bbwUsVg.exe
  C:\Windows\System\bbwUsVg.exe
  2⤵
  PID:2944
- C:\Windows\System\bRBqPHE.exe
  C:\Windows\System\bRBqPHE.exe
  2⤵
  PID:2640
- C:\Windows\System\eifhDhx.exe
  C:\Windows\System\eifhDhx.exe
  2⤵
  PID:2700
- C:\Windows\System\kFeHRQF.exe
  C:\Windows\System\kFeHRQF.exe
  2⤵
  PID:2428
- C:\Windows\System\qUlDSjK.exe
  C:\Windows\System\qUlDSjK.exe
  2⤵
  PID:2648
- C:\Windows\System\ncpvVMw.exe
  C:\Windows\System\ncpvVMw.exe
  2⤵
  PID:3080
- C:\Windows\System\dRReiji.exe
  C:\Windows\System\dRReiji.exe
  2⤵
  PID:3168
- C:\Windows\System\vOFcqBz.exe
  C:\Windows\System\vOFcqBz.exe
  2⤵
  PID:3208
- C:\Windows\System\qfuSjot.exe
  C:\Windows\System\qfuSjot.exe
  2⤵
  PID:3224
- C:\Windows\System\nQDfTaj.exe
  C:\Windows\System\nQDfTaj.exe
  2⤵
  PID:3240
- C:\Windows\System\VfsVALs.exe
  C:\Windows\System\VfsVALs.exe
  2⤵
  PID:3256
- C:\Windows\System\zzNLCLv.exe
  C:\Windows\System\zzNLCLv.exe
  2⤵
  PID:3320
- C:\Windows\System\AzdzmEN.exe
  C:\Windows\System\AzdzmEN.exe
  2⤵
  PID:3464
- C:\Windows\System\GaPnFpG.exe
  C:\Windows\System\GaPnFpG.exe
  2⤵
  PID:3472
- C:\Windows\System\nLhLMdP.exe
  C:\Windows\System\nLhLMdP.exe
  2⤵
  PID:716
- C:\Windows\System\KfjmPDP.exe
  C:\Windows\System\KfjmPDP.exe
  2⤵
  PID:2616
- C:\Windows\System\xGFRPln.exe
  C:\Windows\System\xGFRPln.exe
  2⤵
  PID:2116
- C:\Windows\System\elhbRed.exe
  C:\Windows\System\elhbRed.exe
  2⤵
  PID:1512
- C:\Windows\System\EulUvhm.exe
  C:\Windows\System\EulUvhm.exe
  2⤵
  PID:2460
- C:\Windows\System\ioIPUNr.exe
  C:\Windows\System\ioIPUNr.exe
  2⤵
  PID:1132
- C:\Windows\System\RXfFXwO.exe
  C:\Windows\System\RXfFXwO.exe
  2⤵
  PID:1652
- C:\Windows\System\PoDpclb.exe
  C:\Windows\System\PoDpclb.exe
  2⤵
  PID:1556
- C:\Windows\System\zopSHQY.exe
  C:\Windows\System\zopSHQY.exe
  2⤵
  PID:2456
- C:\Windows\System\qPGSqJq.exe
  C:\Windows\System\qPGSqJq.exe
  2⤵
  PID:2676
- C:\Windows\System\BtCSKWL.exe
  C:\Windows\System\BtCSKWL.exe
  2⤵
  PID:644
- C:\Windows\System\DoiOmcy.exe
  C:\Windows\System\DoiOmcy.exe
  2⤵
  PID:3128
- C:\Windows\System\DPtsAqM.exe
  C:\Windows\System\DPtsAqM.exe
  2⤵
  PID:3140
- C:\Windows\System\jFeKkcX.exe
  C:\Windows\System\jFeKkcX.exe
  2⤵
  PID:1560
- C:\Windows\System\cFsQxgI.exe
  C:\Windows\System\cFsQxgI.exe
  2⤵
  PID:3188
- C:\Windows\System\CncTZNy.exe
  C:\Windows\System\CncTZNy.exe
  2⤵
  PID:3276
- C:\Windows\System\kNEirTv.exe
  C:\Windows\System\kNEirTv.exe
  2⤵
  PID:3340
- C:\Windows\System\lgVHpOi.exe
  C:\Windows\System\lgVHpOi.exe
  2⤵
  PID:3412
- C:\Windows\System\rvCsLXM.exe
  C:\Windows\System\rvCsLXM.exe
  2⤵
  PID:3424
- C:\Windows\System\scdIvkS.exe
  C:\Windows\System\scdIvkS.exe
  2⤵
  PID:3444
- C:\Windows\System\qlZAwOy.exe
  C:\Windows\System\qlZAwOy.exe
  2⤵
  PID:604
- C:\Windows\System\rrvFbeB.exe
  C:\Windows\System\rrvFbeB.exe
  2⤵
  PID:1972
- C:\Windows\System\yHkAswK.exe
  C:\Windows\System\yHkAswK.exe
  2⤵
  PID:3576
- C:\Windows\System\GWzNiBf.exe
  C:\Windows\System\GWzNiBf.exe
  2⤵
  PID:3592
- C:\Windows\System\ecLwphp.exe
  C:\Windows\System\ecLwphp.exe
  2⤵
  PID:3612
- C:\Windows\System\DjOoUWa.exe
  C:\Windows\System\DjOoUWa.exe
  2⤵
  PID:3644
- C:\Windows\System\xFrHajp.exe
  C:\Windows\System\xFrHajp.exe
  2⤵
  PID:3676
- C:\Windows\System\RMaBuGL.exe
  C:\Windows\System\RMaBuGL.exe
  2⤵
  PID:3692
- C:\Windows\System\PGXgZOE.exe
  C:\Windows\System\PGXgZOE.exe
  2⤵
  PID:3736
- C:\Windows\System\toSpHrM.exe
  C:\Windows\System\toSpHrM.exe
  2⤵
  PID:3768
- C:\Windows\System\FUAWTUZ.exe
  C:\Windows\System\FUAWTUZ.exe
  2⤵
  PID:3784
- C:\Windows\System\EJXDNXl.exe
  C:\Windows\System\EJXDNXl.exe
  2⤵
  PID:1412
- C:\Windows\System\NmKguAX.exe
  C:\Windows\System\NmKguAX.exe
  2⤵
  PID:2308
- C:\Windows\System\dOtbJHF.exe
  C:\Windows\System\dOtbJHF.exe
  2⤵
  PID:3848
- C:\Windows\System\oGFnFGk.exe
  C:\Windows\System\oGFnFGk.exe
  2⤵
  PID:3880
- C:\Windows\System\jCzeWwL.exe
  C:\Windows\System\jCzeWwL.exe
  2⤵
  PID:3900
- C:\Windows\System\BOrOqOS.exe
  C:\Windows\System\BOrOqOS.exe
  2⤵
  PID:792
- C:\Windows\System\nOYlgVU.exe
  C:\Windows\System\nOYlgVU.exe
  2⤵
  PID:3960
- C:\Windows\System\vSydogp.exe
  C:\Windows\System\vSydogp.exe
  2⤵
  PID:3964
- C:\Windows\System\jkhemXM.exe
  C:\Windows\System\jkhemXM.exe
  2⤵
  PID:2960
- C:\Windows\System\mLTvJkh.exe
  C:\Windows\System\mLTvJkh.exe
  2⤵
  PID:4024
- C:\Windows\System\FlHfPnz.exe
  C:\Windows\System\FlHfPnz.exe
  2⤵
  PID:4056
- C:\Windows\System\IbmFmFR.exe
  C:\Windows\System\IbmFmFR.exe
  2⤵
  PID:4088
- C:\Windows\System\mBgIqsv.exe
  C:\Windows\System\mBgIqsv.exe
  2⤵
  PID:1620
- C:\Windows\System\nltArok.exe
  C:\Windows\System\nltArok.exe
  2⤵
  PID:2296
- C:\Windows\System\vPFunsQ.exe
  C:\Windows\System\vPFunsQ.exe
  2⤵
  PID:1368
- C:\Windows\System\vLfcVty.exe
  C:\Windows\System\vLfcVty.exe
  2⤵
  PID:924
- C:\Windows\System\jajMAxO.exe
  C:\Windows\System\jajMAxO.exe
  2⤵
  PID:2768
- C:\Windows\System\zJTOCKV.exe
  C:\Windows\System\zJTOCKV.exe
  2⤵
  PID:2480
- C:\Windows\System\zDTDDyo.exe
  C:\Windows\System\zDTDDyo.exe
  2⤵
  PID:1932
- C:\Windows\System\rXfCnLA.exe
  C:\Windows\System\rXfCnLA.exe
  2⤵
  PID:1684
- C:\Windows\System\bvLlOXX.exe
  C:\Windows\System\bvLlOXX.exe
  2⤵
  PID:3236
- C:\Windows\System\YXgSWkz.exe
  C:\Windows\System\YXgSWkz.exe
  2⤵
  PID:3248
- C:\Windows\System\SocfmEp.exe
  C:\Windows\System\SocfmEp.exe
  2⤵
  PID:3400
- C:\Windows\System\nZezzHu.exe
  C:\Windows\System\nZezzHu.exe
  2⤵
  PID:3360
- C:\Windows\System\wuWuqtP.exe
  C:\Windows\System\wuWuqtP.exe
  2⤵
  PID:2536
- C:\Windows\System\VcTVvNd.exe
  C:\Windows\System\VcTVvNd.exe
  2⤵
  PID:2812
- C:\Windows\System\PeCxmOg.exe
  C:\Windows\System\PeCxmOg.exe
  2⤵
  PID:2928
- C:\Windows\System\gJlqYUb.exe
  C:\Windows\System\gJlqYUb.exe
  2⤵
  PID:580
- C:\Windows\System\murHVSe.exe
  C:\Windows\System\murHVSe.exe
  2⤵
  PID:860
- C:\Windows\System\SdJVqgA.exe
  C:\Windows\System\SdJVqgA.exe
  2⤵
  PID:3132
- C:\Windows\System\mKOSkio.exe
  C:\Windows\System\mKOSkio.exe
  2⤵
  PID:3308
- C:\Windows\System\mOyFgVc.exe
  C:\Windows\System\mOyFgVc.exe
  2⤵
  PID:3448
- C:\Windows\System\EcWFcuO.exe
  C:\Windows\System\EcWFcuO.exe
  2⤵
  PID:2948
- C:\Windows\System\yrFlMon.exe
  C:\Windows\System\yrFlMon.exe
  2⤵
  PID:3672
- C:\Windows\System\mRYCHeS.exe
  C:\Windows\System\mRYCHeS.exe
  2⤵
  PID:2248
- C:\Windows\System\AVitdwy.exe
  C:\Windows\System\AVitdwy.exe
  2⤵
  PID:3868
- C:\Windows\System\FZdSAfC.exe
  C:\Windows\System\FZdSAfC.exe
  2⤵
  PID:2584
- C:\Windows\System\OsZLGDb.exe
  C:\Windows\System\OsZLGDb.exe
  2⤵
  PID:1956
- C:\Windows\System\gvdVozf.exe
  C:\Windows\System\gvdVozf.exe
  2⤵
  PID:3232
- C:\Windows\System\FSPhgoZ.exe
  C:\Windows\System\FSPhgoZ.exe
  2⤵
  PID:1116
- C:\Windows\System\jpmxAop.exe
  C:\Windows\System\jpmxAop.exe
  2⤵
  PID:1668
- C:\Windows\System\ytZdfWe.exe
  C:\Windows\System\ytZdfWe.exe
  2⤵
  PID:484
- C:\Windows\System\oEByteJ.exe
  C:\Windows\System\oEByteJ.exe
  2⤵
  PID:2012
- C:\Windows\System\QyyXqXf.exe
  C:\Windows\System\QyyXqXf.exe
  2⤵
  PID:3944
- C:\Windows\System\SxyTFpN.exe
  C:\Windows\System\SxyTFpN.exe
  2⤵
  PID:3992
- C:\Windows\System\BBuQMvx.exe
  C:\Windows\System\BBuQMvx.exe
  2⤵
  PID:4040
- C:\Windows\System\tIhetdO.exe
  C:\Windows\System\tIhetdO.exe
  2⤵
  PID:4076
- C:\Windows\System\oZvOmwF.exe
  C:\Windows\System\oZvOmwF.exe
  2⤵
  PID:3800
- C:\Windows\System\kCKZMVa.exe
  C:\Windows\System\kCKZMVa.exe
  2⤵
  PID:3932
- C:\Windows\System\oQElYHr.exe
  C:\Windows\System\oQElYHr.exe
  2⤵
  PID:2988
- C:\Windows\System\ZKltSHq.exe
  C:\Windows\System\ZKltSHq.exe
  2⤵
  PID:876
- C:\Windows\System\nvvXnGM.exe
  C:\Windows\System\nvvXnGM.exe
  2⤵
  PID:3220
- C:\Windows\System\EbSFsCN.exe
  C:\Windows\System\EbSFsCN.exe
  2⤵
  PID:1996
- C:\Windows\System\NVasSoy.exe
  C:\Windows\System\NVasSoy.exe
  2⤵
  PID:1460
- C:\Windows\System\qllAGRG.exe
  C:\Windows\System\qllAGRG.exe
  2⤵
  PID:1228
- C:\Windows\System\jyBfPbH.exe
  C:\Windows\System\jyBfPbH.exe
  2⤵
  PID:3148
- C:\Windows\System\jYihAjx.exe
  C:\Windows\System\jYihAjx.exe
  2⤵
  PID:2244
- C:\Windows\System\bcIRXGI.exe
  C:\Windows\System\bcIRXGI.exe
  2⤵
  PID:4104
- C:\Windows\System\eXpJHwy.exe
  C:\Windows\System\eXpJHwy.exe
  2⤵
  PID:4120
- C:\Windows\System\lxleCvI.exe
  C:\Windows\System\lxleCvI.exe
  2⤵
  PID:4136
- C:\Windows\System\OiDFEKs.exe
  C:\Windows\System\OiDFEKs.exe
  2⤵
  PID:4152
- C:\Windows\System\QEKlPBE.exe
  C:\Windows\System\QEKlPBE.exe
  2⤵
  PID:4168
- C:\Windows\System\MUhhVwA.exe
  C:\Windows\System\MUhhVwA.exe
  2⤵
  PID:4184
- C:\Windows\System\WqflByy.exe
  C:\Windows\System\WqflByy.exe
  2⤵
  PID:4200
- C:\Windows\System\LqPNKri.exe
  C:\Windows\System\LqPNKri.exe
  2⤵
  PID:4216
- C:\Windows\System\TCbCiYy.exe
  C:\Windows\System\TCbCiYy.exe
  2⤵
  PID:4232
- C:\Windows\System\hdcAvQV.exe
  C:\Windows\System\hdcAvQV.exe
  2⤵
  PID:4248
- C:\Windows\System\yWxDEbu.exe
  C:\Windows\System\yWxDEbu.exe
  2⤵
  PID:4264
- C:\Windows\System\fWPTnfd.exe
  C:\Windows\System\fWPTnfd.exe
  2⤵
  PID:4280
- C:\Windows\System\YnUYQHt.exe
  C:\Windows\System\YnUYQHt.exe
  2⤵
  PID:4296
- C:\Windows\System\fQleAzd.exe
  C:\Windows\System\fQleAzd.exe
  2⤵
  PID:4312
- C:\Windows\System\AfJsXkc.exe
  C:\Windows\System\AfJsXkc.exe
  2⤵
  PID:4328
- C:\Windows\System\nGSDDDd.exe
  C:\Windows\System\nGSDDDd.exe
  2⤵
  PID:4344
- C:\Windows\System\DJvIDKH.exe
  C:\Windows\System\DJvIDKH.exe
  2⤵
  PID:4360
- C:\Windows\System\mmDbdkx.exe
  C:\Windows\System\mmDbdkx.exe
  2⤵
  PID:4376
- C:\Windows\System\tWytYxt.exe
  C:\Windows\System\tWytYxt.exe
  2⤵
  PID:4392
- C:\Windows\System\jZFhVRN.exe
  C:\Windows\System\jZFhVRN.exe
  2⤵
  PID:4408
- C:\Windows\System\Bwcozjk.exe
  C:\Windows\System\Bwcozjk.exe
  2⤵
  PID:4424
- C:\Windows\System\dfWHBbj.exe
  C:\Windows\System\dfWHBbj.exe
  2⤵
  PID:4440
- C:\Windows\System\umwqeJl.exe
  C:\Windows\System\umwqeJl.exe
  2⤵
  PID:4456
- C:\Windows\System\mXiFusf.exe
  C:\Windows\System\mXiFusf.exe
  2⤵
  PID:4472
- C:\Windows\System\qsJlDnv.exe
  C:\Windows\System\qsJlDnv.exe
  2⤵
  PID:4488
- C:\Windows\System\gPbLOdw.exe
  C:\Windows\System\gPbLOdw.exe
  2⤵
  PID:4504
- C:\Windows\System\yPrXcMj.exe
  C:\Windows\System\yPrXcMj.exe
  2⤵
  PID:4520
- C:\Windows\System\cMnIAcC.exe
  C:\Windows\System\cMnIAcC.exe
  2⤵
  PID:4536
- C:\Windows\System\iWexKdY.exe
  C:\Windows\System\iWexKdY.exe
  2⤵
  PID:4552
- C:\Windows\System\noKcgDw.exe
  C:\Windows\System\noKcgDw.exe
  2⤵
  PID:4568
- C:\Windows\System\NuWnfBD.exe
  C:\Windows\System\NuWnfBD.exe
  2⤵
  PID:4584
- C:\Windows\System\ENrwRqR.exe
  C:\Windows\System\ENrwRqR.exe
  2⤵
  PID:4600
- C:\Windows\System\fWThbdx.exe
  C:\Windows\System\fWThbdx.exe
  2⤵
  PID:4616
- C:\Windows\System\cOyWllO.exe
  C:\Windows\System\cOyWllO.exe
  2⤵
  PID:4632
- C:\Windows\System\NJYMLXj.exe
  C:\Windows\System\NJYMLXj.exe
  2⤵
  PID:4648
- C:\Windows\System\JouriPh.exe
  C:\Windows\System\JouriPh.exe
  2⤵
  PID:4664
- C:\Windows\System\yvfHtxw.exe
  C:\Windows\System\yvfHtxw.exe
  2⤵
  PID:4680
- C:\Windows\System\ZrnnjRI.exe
  C:\Windows\System\ZrnnjRI.exe
  2⤵
  PID:4696
- C:\Windows\System\ZErgGnw.exe
  C:\Windows\System\ZErgGnw.exe
  2⤵
  PID:4712
- C:\Windows\System\KkyKcmJ.exe
  C:\Windows\System\KkyKcmJ.exe
  2⤵
  PID:4728
- C:\Windows\System\wHQzcsk.exe
  C:\Windows\System\wHQzcsk.exe
  2⤵
  PID:4744
- C:\Windows\System\bSjqGJV.exe
  C:\Windows\System\bSjqGJV.exe
  2⤵
  PID:4760
- C:\Windows\System\idkDWLT.exe
  C:\Windows\System\idkDWLT.exe
  2⤵
  PID:4776
- C:\Windows\System\OrdAvkx.exe
  C:\Windows\System\OrdAvkx.exe
  2⤵
  PID:4792
- C:\Windows\System\YPaprHI.exe
  C:\Windows\System\YPaprHI.exe
  2⤵
  PID:4808
- C:\Windows\System\xwbFDkB.exe
  C:\Windows\System\xwbFDkB.exe
  2⤵
  PID:4824
- C:\Windows\System\uNldRuN.exe
  C:\Windows\System\uNldRuN.exe
  2⤵
  PID:4840
- C:\Windows\System\zbloKih.exe
  C:\Windows\System\zbloKih.exe
  2⤵
  PID:4856
- C:\Windows\System\EkENPac.exe
  C:\Windows\System\EkENPac.exe
  2⤵
  PID:4872
- C:\Windows\System\BkyafAm.exe
  C:\Windows\System\BkyafAm.exe
  2⤵
  PID:4888
- C:\Windows\System\MYOujXJ.exe
  C:\Windows\System\MYOujXJ.exe
  2⤵
  PID:4908
- C:\Windows\System\iBwtnMx.exe
  C:\Windows\System\iBwtnMx.exe
  2⤵
  PID:4924
- C:\Windows\System\KpkRVop.exe
  C:\Windows\System\KpkRVop.exe
  2⤵
  PID:4940
- C:\Windows\System\ekkpMNx.exe
  C:\Windows\System\ekkpMNx.exe
  2⤵
  PID:4956
- C:\Windows\System\dLtLTRL.exe
  C:\Windows\System\dLtLTRL.exe
  2⤵
  PID:4972
- C:\Windows\System\WCFIVXZ.exe
  C:\Windows\System\WCFIVXZ.exe
  2⤵
  PID:4988
- C:\Windows\System\pnDIVNk.exe
  C:\Windows\System\pnDIVNk.exe
  2⤵
  PID:5004
- C:\Windows\System\wztSvtz.exe
  C:\Windows\System\wztSvtz.exe
  2⤵
  PID:5020
- C:\Windows\System\WgZpFpq.exe
  C:\Windows\System\WgZpFpq.exe
  2⤵
  PID:5036
- C:\Windows\System\fpiCMCZ.exe
  C:\Windows\System\fpiCMCZ.exe
  2⤵
  PID:5052
- C:\Windows\System\FeAGKdo.exe
  C:\Windows\System\FeAGKdo.exe
  2⤵
  PID:5068
- C:\Windows\System\KcYgfju.exe
  C:\Windows\System\KcYgfju.exe
  2⤵
  PID:5084
- C:\Windows\System\noQxpYc.exe
  C:\Windows\System\noQxpYc.exe
  2⤵
  PID:5100
- C:\Windows\System\HkVjAhu.exe
  C:\Windows\System\HkVjAhu.exe
  2⤵
  PID:5116
- C:\Windows\System\CgPHNfX.exe
  C:\Windows\System\CgPHNfX.exe
  2⤵
  PID:584
- C:\Windows\System\aOOSzDi.exe
  C:\Windows\System\aOOSzDi.exe
  2⤵
  PID:3836
- C:\Windows\System\AjVkAVl.exe
  C:\Windows\System\AjVkAVl.exe
  2⤵
  PID:3852
- C:\Windows\System\oDTKtcq.exe
  C:\Windows\System\oDTKtcq.exe
  2⤵
  PID:4192
- C:\Windows\System\AriYsof.exe
  C:\Windows\System\AriYsof.exe
  2⤵
  PID:4224
- C:\Windows\System\ORITNYb.exe
  C:\Windows\System\ORITNYb.exe
  2⤵
  PID:4260
- C:\Windows\System\UXFDDow.exe
  C:\Windows\System\UXFDDow.exe
  2⤵
  PID:3560
- C:\Windows\System\jUvxdDu.exe
  C:\Windows\System\jUvxdDu.exe
  2⤵
  PID:668
- C:\Windows\System\XFIkGcd.exe
  C:\Windows\System\XFIkGcd.exe
  2⤵
  PID:280
- C:\Windows\System\XQeerOc.exe
  C:\Windows\System\XQeerOc.exe
  2⤵
  PID:4008
- C:\Windows\System\NOtepHe.exe
  C:\Windows\System\NOtepHe.exe
  2⤵
  PID:3980
- C:\Windows\System\NGKfjXY.exe
  C:\Windows\System\NGKfjXY.exe
  2⤵
  PID:3468
- C:\Windows\System\EotFQfT.exe
  C:\Windows\System\EotFQfT.exe
  2⤵
  PID:2612
- C:\Windows\System\ejrKVIg.exe
  C:\Windows\System\ejrKVIg.exe
  2⤵
  PID:3396
- C:\Windows\System\PDXqaEc.exe
  C:\Windows\System\PDXqaEc.exe
  2⤵
  PID:4320
- C:\Windows\System\WVDHezB.exe
  C:\Windows\System\WVDHezB.exe
  2⤵
  PID:4356
- C:\Windows\System\FWRiFoq.exe
  C:\Windows\System\FWRiFoq.exe
  2⤵
  PID:4420
- C:\Windows\System\JWeTfHU.exe
  C:\Windows\System\JWeTfHU.exe
  2⤵
  PID:4512
- C:\Windows\System\DCnPgUp.exe
  C:\Windows\System\DCnPgUp.exe
  2⤵
  PID:4544
- C:\Windows\System\eZhXLIC.exe
  C:\Windows\System\eZhXLIC.exe
  2⤵
  PID:4612
- C:\Windows\System\eNNXtdc.exe
  C:\Windows\System\eNNXtdc.exe
  2⤵
  PID:4208
- C:\Windows\System\iXYjhcg.exe
  C:\Windows\System\iXYjhcg.exe
  2⤵
  PID:4276
- C:\Windows\System\ygTDyLJ.exe
  C:\Windows\System\ygTDyLJ.exe
  2⤵
  PID:4308
- C:\Windows\System\iOJbZqj.exe
  C:\Windows\System\iOJbZqj.exe
  2⤵
  PID:4340
- C:\Windows\System\Shdsopi.exe
  C:\Windows\System\Shdsopi.exe
  2⤵
  PID:3068
- C:\Windows\System\opqrtSx.exe
  C:\Windows\System\opqrtSx.exe
  2⤵
  PID:448
- C:\Windows\System\qZjNeMA.exe
  C:\Windows\System\qZjNeMA.exe
  2⤵
  PID:4404
- C:\Windows\System\PTOuqrV.exe
  C:\Windows\System\PTOuqrV.exe
  2⤵
  PID:4704
- C:\Windows\System\nSYykOH.exe
  C:\Windows\System\nSYykOH.exe
  2⤵
  PID:4768
- C:\Windows\System\RxdAzQJ.exe
  C:\Windows\System\RxdAzQJ.exe
  2⤵
  PID:4800
- C:\Windows\System\ZtBQUwB.exe
  C:\Windows\System\ZtBQUwB.exe
  2⤵
  PID:4112
- C:\Windows\System\stIjxRN.exe
  C:\Windows\System\stIjxRN.exe
  2⤵
  PID:4148
- C:\Windows\System\jqOMjRB.exe
  C:\Windows\System\jqOMjRB.exe
  2⤵
  PID:4720
- C:\Windows\System\YNxjAZB.exe
  C:\Windows\System\YNxjAZB.exe
  2⤵
  PID:4528
- C:\Windows\System\ehMAsRa.exe
  C:\Windows\System\ehMAsRa.exe
  2⤵
  PID:4560
- C:\Windows\System\DcTQLlN.exe
  C:\Windows\System\DcTQLlN.exe
  2⤵
  PID:2652
- C:\Windows\System\CnVTDhW.exe
  C:\Windows\System\CnVTDhW.exe
  2⤵
  PID:4836
- C:\Windows\System\bsRmUaO.exe
  C:\Windows\System\bsRmUaO.exe
  2⤵
  PID:4900
- C:\Windows\System\GtezwaE.exe
  C:\Windows\System\GtezwaE.exe
  2⤵
  PID:4964
- C:\Windows\System\bEDlGRG.exe
  C:\Windows\System\bEDlGRG.exe
  2⤵
  PID:5028
- C:\Windows\System\fFuVrdp.exe
  C:\Windows\System\fFuVrdp.exe
  2⤵
  PID:5092
- C:\Windows\System\eDgGkCS.exe
  C:\Windows\System\eDgGkCS.exe
  2⤵
  PID:1320
- C:\Windows\System\pWHmvRr.exe
  C:\Windows\System\pWHmvRr.exe
  2⤵
  PID:2900
- C:\Windows\System\UVnTZaz.exe
  C:\Windows\System\UVnTZaz.exe
  2⤵
  PID:2344
- C:\Windows\System\ZPzROvP.exe
  C:\Windows\System\ZPzROvP.exe
  2⤵
  PID:4292
- C:\Windows\System\qNxfjlG.exe
  C:\Windows\System\qNxfjlG.exe
  2⤵
  PID:2620
- C:\Windows\System\WOiSBxy.exe
  C:\Windows\System\WOiSBxy.exe
  2⤵
  PID:3292
- C:\Windows\System\ujtROTg.exe
  C:\Windows\System\ujtROTg.exe
  2⤵
  PID:4516
- C:\Windows\System\bbdsfjU.exe
  C:\Windows\System\bbdsfjU.exe
  2⤵
  PID:4644
- C:\Windows\System\KYaTtUP.exe
  C:\Windows\System\KYaTtUP.exe
  2⤵
  PID:4852
- C:\Windows\System\qCnbSyx.exe
  C:\Windows\System\qCnbSyx.exe
  2⤵
  PID:1580
- C:\Windows\System\clpWMzJ.exe
  C:\Windows\System\clpWMzJ.exe
  2⤵
  PID:4692
- C:\Windows\System\TOXNffU.exe
  C:\Windows\System\TOXNffU.exe
  2⤵
  PID:4804
- C:\Windows\System\QMIdQgS.exe
  C:\Windows\System\QMIdQgS.exe
  2⤵
  PID:4752
- C:\Windows\System\BFaBIwd.exe
  C:\Windows\System\BFaBIwd.exe
  2⤵
  PID:4820
- C:\Windows\System\XXRhjJi.exe
  C:\Windows\System\XXRhjJi.exe
  2⤵
  PID:4952
- C:\Windows\System\pUszVAO.exe
  C:\Windows\System\pUszVAO.exe
  2⤵
  PID:5016
- C:\Windows\System\IzfEwoM.exe
  C:\Windows\System\IzfEwoM.exe
  2⤵
  PID:5080
- C:\Windows\System\dGsgMyG.exe
  C:\Windows\System\dGsgMyG.exe
  2⤵
  PID:3216
- C:\Windows\System\iONyEHp.exe
  C:\Windows\System\iONyEHp.exe
  2⤵
  PID:4256
- C:\Windows\System\slSmbdR.exe
  C:\Windows\System\slSmbdR.exe
  2⤵
  PID:784
- C:\Windows\System\IzLTFJJ.exe
  C:\Windows\System\IzLTFJJ.exe
  2⤵
  PID:2588
- C:\Windows\System\TtRzjda.exe
  C:\Windows\System\TtRzjda.exe
  2⤵
  PID:4480
- C:\Windows\System\XtFbBiy.exe
  C:\Windows\System\XtFbBiy.exe
  2⤵
  PID:4272
- C:\Windows\System\amhAfik.exe
  C:\Windows\System\amhAfik.exe
  2⤵
  PID:1680
- C:\Windows\System\shygFHT.exe
  C:\Windows\System\shygFHT.exe
  2⤵
  PID:4144
- C:\Windows\System\fbdbfrh.exe
  C:\Windows\System\fbdbfrh.exe
  2⤵
  PID:4596
- C:\Windows\System\gjiaNbw.exe
  C:\Windows\System\gjiaNbw.exe
  2⤵
  PID:4896
- C:\Windows\System\QLPhSFc.exe
  C:\Windows\System\QLPhSFc.exe
  2⤵
  PID:5096
- C:\Windows\System\QDkYXPx.exe
  C:\Windows\System\QDkYXPx.exe
  2⤵
  PID:3996
- C:\Windows\System\LcJyYEv.exe
  C:\Windows\System\LcJyYEv.exe
  2⤵
  PID:5136
- C:\Windows\System\CkEHqRt.exe
  C:\Windows\System\CkEHqRt.exe
  2⤵
  PID:5152
- C:\Windows\System\NPzmFSJ.exe
  C:\Windows\System\NPzmFSJ.exe
  2⤵
  PID:5168
- C:\Windows\System\rubIcNd.exe
  C:\Windows\System\rubIcNd.exe
  2⤵
  PID:5184
- C:\Windows\System\fgKvkLe.exe
  C:\Windows\System\fgKvkLe.exe
  2⤵
  PID:5200
- C:\Windows\System\ktzkTsn.exe
  C:\Windows\System\ktzkTsn.exe
  2⤵
  PID:5216
- C:\Windows\System\vHeQhOT.exe
  C:\Windows\System\vHeQhOT.exe
  2⤵
  PID:5232
- C:\Windows\System\VLZzwAO.exe
  C:\Windows\System\VLZzwAO.exe
  2⤵
  PID:5248
- C:\Windows\System\vOTZUOV.exe
  C:\Windows\System\vOTZUOV.exe
  2⤵
  PID:5264
- C:\Windows\System\lJmpDiD.exe
  C:\Windows\System\lJmpDiD.exe
  2⤵
  PID:5280
- C:\Windows\System\haKbejO.exe
  C:\Windows\System\haKbejO.exe
  2⤵
  PID:5296
- C:\Windows\System\RBrQxzv.exe
  C:\Windows\System\RBrQxzv.exe
  2⤵
  PID:5312
- C:\Windows\System\bkoCCvW.exe
  C:\Windows\System\bkoCCvW.exe
  2⤵
  PID:5328
- C:\Windows\System\TYjMcIh.exe
  C:\Windows\System\TYjMcIh.exe
  2⤵
  PID:5344
- C:\Windows\System\qeiHoCB.exe
  C:\Windows\System\qeiHoCB.exe
  2⤵
  PID:5360
- C:\Windows\System\nIOVKJt.exe
  C:\Windows\System\nIOVKJt.exe
  2⤵
  PID:5376
- C:\Windows\System\MdpZjem.exe
  C:\Windows\System\MdpZjem.exe
  2⤵
  PID:5392
- C:\Windows\System\BNxLiIF.exe
  C:\Windows\System\BNxLiIF.exe
  2⤵
  PID:5408
- C:\Windows\System\ViQgMgy.exe
  C:\Windows\System\ViQgMgy.exe
  2⤵
  PID:5424
- C:\Windows\System\lfMLbsj.exe
  C:\Windows\System\lfMLbsj.exe
  2⤵
  PID:5440
- C:\Windows\System\tYUtyTQ.exe
  C:\Windows\System\tYUtyTQ.exe
  2⤵
  PID:5456
- C:\Windows\System\sWcJMSu.exe
  C:\Windows\System\sWcJMSu.exe
  2⤵
  PID:5472
- C:\Windows\System\svGlgip.exe
  C:\Windows\System\svGlgip.exe
  2⤵
  PID:5488
- C:\Windows\System\JzheIBx.exe
  C:\Windows\System\JzheIBx.exe
  2⤵
  PID:5504
- C:\Windows\System\ewmwIPL.exe
  C:\Windows\System\ewmwIPL.exe
  2⤵
  PID:5520
- C:\Windows\System\omzEzcE.exe
  C:\Windows\System\omzEzcE.exe
  2⤵
  PID:5536
- C:\Windows\System\kvfXirN.exe
  C:\Windows\System\kvfXirN.exe
  2⤵
  PID:5552
- C:\Windows\System\ECiYiCR.exe
  C:\Windows\System\ECiYiCR.exe
  2⤵
  PID:5568
- C:\Windows\System\fPYvuDP.exe
  C:\Windows\System\fPYvuDP.exe
  2⤵
  PID:5584
- C:\Windows\System\OkLdPtW.exe
  C:\Windows\System\OkLdPtW.exe
  2⤵
  PID:5600
- C:\Windows\System\dkMBpkq.exe
  C:\Windows\System\dkMBpkq.exe
  2⤵
  PID:5616
- C:\Windows\System\pTfornf.exe
  C:\Windows\System\pTfornf.exe
  2⤵
  PID:5632
- C:\Windows\System\sNPFhCl.exe
  C:\Windows\System\sNPFhCl.exe
  2⤵
  PID:5648
- C:\Windows\System\oiEytPG.exe
  C:\Windows\System\oiEytPG.exe
  2⤵
  PID:5664
- C:\Windows\System\jvffyIj.exe
  C:\Windows\System\jvffyIj.exe
  2⤵
  PID:5680
- C:\Windows\System\GqUmaYW.exe
  C:\Windows\System\GqUmaYW.exe
  2⤵
  PID:5696
- C:\Windows\System\yoOInaC.exe
  C:\Windows\System\yoOInaC.exe
  2⤵
  PID:5712
- C:\Windows\System\YpfSmuf.exe
  C:\Windows\System\YpfSmuf.exe
  2⤵
  PID:5728
- C:\Windows\System\pIdmmBs.exe
  C:\Windows\System\pIdmmBs.exe
  2⤵
  PID:5744
- C:\Windows\System\nYoIAQK.exe
  C:\Windows\System\nYoIAQK.exe
  2⤵
  PID:5760
- C:\Windows\System\PHmKBJr.exe
  C:\Windows\System\PHmKBJr.exe
  2⤵
  PID:5776
- C:\Windows\System\Ebxsbzy.exe
  C:\Windows\System\Ebxsbzy.exe
  2⤵
  PID:5792
- C:\Windows\System\fJevmxI.exe
  C:\Windows\System\fJevmxI.exe
  2⤵
  PID:5808
- C:\Windows\System\SqpfSgA.exe
  C:\Windows\System\SqpfSgA.exe
  2⤵
  PID:5824
- C:\Windows\System\BalWrQI.exe
  C:\Windows\System\BalWrQI.exe
  2⤵
  PID:5840
- C:\Windows\System\nLdcCEW.exe
  C:\Windows\System\nLdcCEW.exe
  2⤵
  PID:5856
- C:\Windows\System\oIirsex.exe
  C:\Windows\System\oIirsex.exe
  2⤵
  PID:5872
- C:\Windows\System\ACpQeXN.exe
  C:\Windows\System\ACpQeXN.exe
  2⤵
  PID:5888
- C:\Windows\System\lGBXoPs.exe
  C:\Windows\System\lGBXoPs.exe
  2⤵
  PID:5904
- C:\Windows\System\oBBZDmB.exe
  C:\Windows\System\oBBZDmB.exe
  2⤵
  PID:5920
- C:\Windows\System\WkUuBHE.exe
  C:\Windows\System\WkUuBHE.exe
  2⤵
  PID:5936
- C:\Windows\System\CSsnsgu.exe
  C:\Windows\System\CSsnsgu.exe
  2⤵
  PID:5952
- C:\Windows\System\IOfNFrO.exe
  C:\Windows\System\IOfNFrO.exe
  2⤵
  PID:5968
- C:\Windows\System\sTKzXRt.exe
  C:\Windows\System\sTKzXRt.exe
  2⤵
  PID:5984
- C:\Windows\System\eYBFRwE.exe
  C:\Windows\System\eYBFRwE.exe
  2⤵
  PID:6000
- C:\Windows\System\zIfgldK.exe
  C:\Windows\System\zIfgldK.exe
  2⤵
  PID:6016
- C:\Windows\System\aeqOJDs.exe
  C:\Windows\System\aeqOJDs.exe
  2⤵
  PID:6032
- C:\Windows\System\yTiaYWU.exe
  C:\Windows\System\yTiaYWU.exe
  2⤵
  PID:6048
- C:\Windows\System\QMGucLZ.exe
  C:\Windows\System\QMGucLZ.exe
  2⤵
  PID:6064
- C:\Windows\System\YqARoFh.exe
  C:\Windows\System\YqARoFh.exe
  2⤵
  PID:6080
- C:\Windows\System\lDVkEkg.exe
  C:\Windows\System\lDVkEkg.exe
  2⤵
  PID:6096
- C:\Windows\System\OCDLNjv.exe
  C:\Windows\System\OCDLNjv.exe
  2⤵
  PID:6112
- C:\Windows\System\jYVYxes.exe
  C:\Windows\System\jYVYxes.exe
  2⤵
  PID:6128
- C:\Windows\System\uPdabxp.exe
  C:\Windows\System\uPdabxp.exe
  2⤵
  PID:1764
- C:\Windows\System\JPIxxVC.exe
  C:\Windows\System\JPIxxVC.exe
  2⤵
  PID:5060
- C:\Windows\System\NoyrUHy.exe
  C:\Windows\System\NoyrUHy.exe
  2⤵
  PID:1468
- C:\Windows\System\ttNUANp.exe
  C:\Windows\System\ttNUANp.exe
  2⤵
  PID:4176
- C:\Windows\System\kHzvUGK.exe
  C:\Windows\System\kHzvUGK.exe
  2⤵
  PID:4784
- C:\Windows\System\Emvacdr.exe
  C:\Windows\System\Emvacdr.exe
  2⤵
  PID:1568
- C:\Windows\System\VQPhSeL.exe
  C:\Windows\System\VQPhSeL.exe
  2⤵
  PID:4452
- C:\Windows\System\pjEcooG.exe
  C:\Windows\System\pjEcooG.exe
  2⤵
  PID:4496
- C:\Windows\System\PQkmwPj.exe
  C:\Windows\System\PQkmwPj.exe
  2⤵
  PID:5132
- C:\Windows\System\VEKPpkn.exe
  C:\Windows\System\VEKPpkn.exe
  2⤵
  PID:5196
- C:\Windows\System\XeERZXc.exe
  C:\Windows\System\XeERZXc.exe
  2⤵
  PID:5260
- C:\Windows\System\WWhlrXC.exe
  C:\Windows\System\WWhlrXC.exe
  2⤵
  PID:5324
- C:\Windows\System\zTXAGXb.exe
  C:\Windows\System\zTXAGXb.exe
  2⤵
  PID:4388
- C:\Windows\System\YGiNBZD.exe
  C:\Windows\System\YGiNBZD.exe
  2⤵
  PID:5372
- C:\Windows\System\pmYGhRY.exe
  C:\Windows\System\pmYGhRY.exe
  2⤵
  PID:5340
- C:\Windows\System\XxfyxPC.exe
  C:\Windows\System\XxfyxPC.exe
  2⤵
  PID:4920
- C:\Windows\System\kfhkdJU.exe
  C:\Windows\System\kfhkdJU.exe
  2⤵
  PID:5076
- C:\Windows\System\kiaHOSD.exe
  C:\Windows\System\kiaHOSD.exe
  2⤵
  PID:2592
- C:\Windows\System\vamOlUm.exe
  C:\Windows\System\vamOlUm.exe
  2⤵
  PID:4772
- C:\Windows\System\AOJPkZT.exe
  C:\Windows\System\AOJPkZT.exe
  2⤵
  PID:3348
- C:\Windows\System\PAsnhul.exe
  C:\Windows\System\PAsnhul.exe
  2⤵
  PID:5180
- C:\Windows\System\nYyskyv.exe
  C:\Windows\System\nYyskyv.exe
  2⤵
  PID:5244
- C:\Windows\System\KQhYJbD.exe
  C:\Windows\System\KQhYJbD.exe
  2⤵
  PID:5308
- C:\Windows\System\UpOiGxK.exe
  C:\Windows\System\UpOiGxK.exe
  2⤵
  PID:5448
- C:\Windows\System\WjpurVn.exe
  C:\Windows\System\WjpurVn.exe
  2⤵
  PID:5512
- C:\Windows\System\pCFdPYd.exe
  C:\Windows\System\pCFdPYd.exe
  2⤵
  PID:5576
- C:\Windows\System\TpaUvlq.exe
  C:\Windows\System\TpaUvlq.exe
  2⤵
  PID:1112
- C:\Windows\System\uOjnhen.exe
  C:\Windows\System\uOjnhen.exe
  2⤵
  PID:1920
- C:\Windows\System\vbVOhQF.exe
  C:\Windows\System\vbVOhQF.exe
  2⤵
  PID:5612
- C:\Windows\System\fClctTA.exe
  C:\Windows\System\fClctTA.exe
  2⤵
  PID:1912
- C:\Windows\System\SSaCvNH.exe
  C:\Windows\System\SSaCvNH.exe
  2⤵
  PID:1752
- C:\Windows\System\tmwiiiZ.exe
  C:\Windows\System\tmwiiiZ.exe
  2⤵
  PID:5436
- C:\Windows\System\zrmDvOL.exe
  C:\Windows\System\zrmDvOL.exe
  2⤵
  PID:5496
- C:\Windows\System\JETslnG.exe
  C:\Windows\System\JETslnG.exe
  2⤵
  PID:5592
- C:\Windows\System\UFqJWRV.exe
  C:\Windows\System\UFqJWRV.exe
  2⤵
  PID:5656
- C:\Windows\System\KgWtRre.exe
  C:\Windows\System\KgWtRre.exe
  2⤵
  PID:2868
- C:\Windows\System\khHKsjw.exe
  C:\Windows\System\khHKsjw.exe
  2⤵
  PID:2752
- C:\Windows\System\ArStYaf.exe
  C:\Windows\System\ArStYaf.exe
  2⤵
  PID:5784
- C:\Windows\System\eRmRDHP.exe
  C:\Windows\System\eRmRDHP.exe
  2⤵
  PID:5752
- C:\Windows\System\qeImIXF.exe
  C:\Windows\System\qeImIXF.exe
  2⤵
  PID:5848
- C:\Windows\System\DvXCMng.exe
  C:\Windows\System\DvXCMng.exe
  2⤵
  PID:5912
- C:\Windows\System\pDQPAHJ.exe
  C:\Windows\System\pDQPAHJ.exe
  2⤵
  PID:5976
- C:\Windows\System\KJWdmSG.exe
  C:\Windows\System\KJWdmSG.exe
  2⤵
  PID:6012
- C:\Windows\System\NiwLpUs.exe
  C:\Windows\System\NiwLpUs.exe
  2⤵
  PID:5708
- C:\Windows\System\qcaLXlf.exe
  C:\Windows\System\qcaLXlf.exe
  2⤵
  PID:5768
- C:\Windows\System\LMjzdVW.exe
  C:\Windows\System\LMjzdVW.exe
  2⤵
  PID:5832
- C:\Windows\System\gETWXtX.exe
  C:\Windows\System\gETWXtX.exe
  2⤵
  PID:5896
- C:\Windows\System\ILSGecx.exe
  C:\Windows\System\ILSGecx.exe
  2⤵
  PID:5960
- C:\Windows\System\tOSVGYY.exe
  C:\Windows\System\tOSVGYY.exe
  2⤵
  PID:6040
- C:\Windows\System\kdrJPMw.exe
  C:\Windows\System\kdrJPMw.exe
  2⤵
  PID:6028
- C:\Windows\System\UQunsuY.exe
  C:\Windows\System\UQunsuY.exe
  2⤵
  PID:1616
- C:\Windows\System\sgLFkoD.exe
  C:\Windows\System\sgLFkoD.exe
  2⤵
  PID:6056
- C:\Windows\System\VkLlIKl.exe
  C:\Windows\System\VkLlIKl.exe
  2⤵
  PID:2320
- C:\Windows\System\iaXJYXH.exe
  C:\Windows\System\iaXJYXH.exe
  2⤵
  PID:6092
- C:\Windows\System\LamgPwG.exe
  C:\Windows\System\LamgPwG.exe
  2⤵
  PID:6124
- C:\Windows\System\txFtGry.exe
  C:\Windows\System\txFtGry.exe
  2⤵
  PID:5228
- C:\Windows\System\VSTbPJa.exe
  C:\Windows\System\VSTbPJa.exe
  2⤵
  PID:5336
- C:\Windows\System\qlcxSTn.exe
  C:\Windows\System\qlcxSTn.exe
  2⤵
  PID:1520
- C:\Windows\System\uyHnAVR.exe
  C:\Windows\System\uyHnAVR.exe
  2⤵
  PID:5276
- C:\Windows\System\LkBDRcb.exe
  C:\Windows\System\LkBDRcb.exe
  2⤵
  PID:5580
- C:\Windows\System\BuJvlAE.exe
  C:\Windows\System\BuJvlAE.exe
  2⤵
  PID:528
- C:\Windows\System\DMPImQm.exe
  C:\Windows\System\DMPImQm.exe
  2⤵
  PID:5112
- C:\Windows\System\yMvERoT.exe
  C:\Windows\System\yMvERoT.exe
  2⤵
  PID:5164
- C:\Windows\System\KLzhfNG.exe
  C:\Windows\System\KLzhfNG.exe
  2⤵
  PID:4724
- C:\Windows\System\HLmCwKw.exe
  C:\Windows\System\HLmCwKw.exe
  2⤵
  PID:5544
- C:\Windows\System\MGSYOrq.exe
  C:\Windows\System\MGSYOrq.exe
  2⤵
  PID:5212
- C:\Windows\System\TxoVcMG.exe
  C:\Windows\System\TxoVcMG.exe
  2⤵
  PID:5468
- C:\Windows\System\mxlmSiS.exe
  C:\Windows\System\mxlmSiS.exe
  2⤵
  PID:1728
- C:\Windows\System\nDZRfAY.exe
  C:\Windows\System\nDZRfAY.exe
  2⤵
  PID:3364
- C:\Windows\System\ReNjOHw.exe
  C:\Windows\System\ReNjOHw.exe
  2⤵
  PID:5404
- C:\Windows\System\TNBalBf.exe
  C:\Windows\System\TNBalBf.exe
  2⤵
  PID:2724
- C:\Windows\System\jwDnFhc.exe
  C:\Windows\System\jwDnFhc.exe
  2⤵
  PID:6008
- C:\Windows\System\imsUaJb.exe
  C:\Windows\System\imsUaJb.exe
  2⤵
  PID:5688
- C:\Windows\System\UCQGGkp.exe
  C:\Windows\System\UCQGGkp.exe
  2⤵
  PID:5740
- C:\Windows\System\FxIfVck.exe
  C:\Windows\System\FxIfVck.exe
  2⤵
  PID:6024
- C:\Windows\System\xQvGkxf.exe
  C:\Windows\System\xQvGkxf.exe
  2⤵
  PID:5996
- C:\Windows\System\ngONjlI.exe
  C:\Windows\System\ngONjlI.exe
  2⤵
  PID:6140
- C:\Windows\System\vSAFmdi.exe
  C:\Windows\System\vSAFmdi.exe
  2⤵
  PID:5672
- C:\Windows\System\lXLoWEo.exe
  C:\Windows\System\lXLoWEo.exe
  2⤵
  PID:5928
- C:\Windows\System\TsZHsax.exe
  C:\Windows\System\TsZHsax.exe
  2⤵
  PID:6104
- C:\Windows\System\krQWasd.exe
  C:\Windows\System\krQWasd.exe
  2⤵
  PID:6120
- C:\Windows\System\JxFRKzB.exe
  C:\Windows\System\JxFRKzB.exe
  2⤵
  PID:5356
- C:\Windows\System\mzznxkq.exe
  C:\Windows\System\mzznxkq.exe
  2⤵
  PID:4468
- C:\Windows\System\qihmvWc.exe
  C:\Windows\System\qihmvWc.exe
  2⤵
  PID:3884
- C:\Windows\System\DoDcXiQ.exe
  C:\Windows\System\DoDcXiQ.exe
  2⤵
  PID:4240
- C:\Windows\System\ppwVojs.exe
  C:\Windows\System\ppwVojs.exe
  2⤵
  PID:5012
- C:\Windows\System\apUAGMs.exe
  C:\Windows\System\apUAGMs.exe
  2⤵
  PID:5320
- C:\Windows\System\QguuVfp.exe
  C:\Windows\System\QguuVfp.exe
  2⤵
  PID:2836
- C:\Windows\System\KruQQkA.exe
  C:\Windows\System\KruQQkA.exe
  2⤵
  PID:5704
- C:\Windows\System\mDXuOuJ.exe
  C:\Windows\System\mDXuOuJ.exe
  2⤵
  PID:4352
- C:\Windows\System\iRliwiK.exe
  C:\Windows\System\iRliwiK.exe
  2⤵
  PID:2496
- C:\Windows\System\bcBWflh.exe
  C:\Windows\System\bcBWflh.exe
  2⤵
  PID:5756
- C:\Windows\System\jzwvyAS.exe
  C:\Windows\System\jzwvyAS.exe
  2⤵
  PID:5944
- C:\Windows\System\beTarPa.exe
  C:\Windows\System\beTarPa.exe
  2⤵
  PID:5128
- C:\Windows\System\sknPvqR.exe
  C:\Windows\System\sknPvqR.exe
  2⤵
  PID:1744
- C:\Windows\System\wxgMMHH.exe
  C:\Windows\System\wxgMMHH.exe
  2⤵
  PID:1260
- C:\Windows\System\sUCsZVd.exe
  C:\Windows\System\sUCsZVd.exe
  2⤵
  PID:2668
- C:\Windows\System\KqSHueE.exe
  C:\Windows\System\KqSHueE.exe
  2⤵
  PID:2540
- C:\Windows\System\VBUSBlW.exe
  C:\Windows\System\VBUSBlW.exe
  2⤵
  PID:1496
- C:\Windows\System\ZsPgPwx.exe
  C:\Windows\System\ZsPgPwx.exe
  2⤵
  PID:1484
- C:\Windows\System\MHoDufO.exe
  C:\Windows\System\MHoDufO.exe
  2⤵
  PID:4500
- C:\Windows\System\NvOvjVr.exe
  C:\Windows\System\NvOvjVr.exe
  2⤵
  PID:1244
- C:\Windows\System\RQcpwNU.exe
  C:\Windows\System\RQcpwNU.exe
  2⤵
  PID:5608
- C:\Windows\System\iiTgUgD.exe
  C:\Windows\System\iiTgUgD.exe
  2⤵
  PID:4880
- C:\Windows\System\zonPcpU.exe
  C:\Windows\System\zonPcpU.exe
  2⤵
  PID:5884
- C:\Windows\System\JtFknBz.exe
  C:\Windows\System\JtFknBz.exe
  2⤵
  PID:6160
- C:\Windows\System\cwkMrxF.exe
  C:\Windows\System\cwkMrxF.exe
  2⤵
  PID:6176
- C:\Windows\System\FWFSkoF.exe
  C:\Windows\System\FWFSkoF.exe
  2⤵
  PID:6192
- C:\Windows\System\hBaoUMu.exe
  C:\Windows\System\hBaoUMu.exe
  2⤵
  PID:6208
- C:\Windows\System\laeOsee.exe
  C:\Windows\System\laeOsee.exe
  2⤵
  PID:6224
- C:\Windows\System\jFAMrUh.exe
  C:\Windows\System\jFAMrUh.exe
  2⤵
  PID:6240
- C:\Windows\System\XYeUZdz.exe
  C:\Windows\System\XYeUZdz.exe
  2⤵
  PID:6256
- C:\Windows\System\dmgAvNU.exe
  C:\Windows\System\dmgAvNU.exe
  2⤵
  PID:6272
- C:\Windows\System\IgfrSRw.exe
  C:\Windows\System\IgfrSRw.exe
  2⤵
  PID:6288
- C:\Windows\System\EQkiHRl.exe
  C:\Windows\System\EQkiHRl.exe
  2⤵
  PID:6304
- C:\Windows\System\RvopjOe.exe
  C:\Windows\System\RvopjOe.exe
  2⤵
  PID:6320
- C:\Windows\System\yypXzAA.exe
  C:\Windows\System\yypXzAA.exe
  2⤵
  PID:6336
- C:\Windows\System\skwbkqo.exe
  C:\Windows\System\skwbkqo.exe
  2⤵
  PID:6352
- C:\Windows\System\LhsqVgA.exe
  C:\Windows\System\LhsqVgA.exe
  2⤵
  PID:6368
- C:\Windows\System\PWtMcRG.exe
  C:\Windows\System\PWtMcRG.exe
  2⤵
  PID:6384
- C:\Windows\System\rdtceUA.exe
  C:\Windows\System\rdtceUA.exe
  2⤵
  PID:6400
- C:\Windows\System\jYuMTjK.exe
  C:\Windows\System\jYuMTjK.exe
  2⤵
  PID:6416
- C:\Windows\System\AmVyyIZ.exe
  C:\Windows\System\AmVyyIZ.exe
  2⤵
  PID:6432
- C:\Windows\System\RUjNlKN.exe
  C:\Windows\System\RUjNlKN.exe
  2⤵
  PID:6448
- C:\Windows\System\wOhYnUL.exe
  C:\Windows\System\wOhYnUL.exe
  2⤵
  PID:6464
- C:\Windows\System\ZTtSevy.exe
  C:\Windows\System\ZTtSevy.exe
  2⤵
  PID:6480
- C:\Windows\System\DapVFKD.exe
  C:\Windows\System\DapVFKD.exe
  2⤵
  PID:6496
- C:\Windows\System\tXBRGoA.exe
  C:\Windows\System\tXBRGoA.exe
  2⤵
  PID:6512
- C:\Windows\System\QpkRvDt.exe
  C:\Windows\System\QpkRvDt.exe
  2⤵
  PID:6528
- C:\Windows\System\MoyfCey.exe
  C:\Windows\System\MoyfCey.exe
  2⤵
  PID:6544
- C:\Windows\System\VQWdZYh.exe
  C:\Windows\System\VQWdZYh.exe
  2⤵
  PID:6560
- C:\Windows\System\odQFczc.exe
  C:\Windows\System\odQFczc.exe
  2⤵
  PID:6576
- C:\Windows\System\DPRTXKq.exe
  C:\Windows\System\DPRTXKq.exe
  2⤵
  PID:6592
- C:\Windows\System\CrsnOgv.exe
  C:\Windows\System\CrsnOgv.exe
  2⤵
  PID:6608
- C:\Windows\System\jaeIwGA.exe
  C:\Windows\System\jaeIwGA.exe
  2⤵
  PID:6624
- C:\Windows\System\NqTAEic.exe
  C:\Windows\System\NqTAEic.exe
  2⤵
  PID:6640
- C:\Windows\System\TygnmLR.exe
  C:\Windows\System\TygnmLR.exe
  2⤵
  PID:6656
- C:\Windows\System\RScNzVw.exe
  C:\Windows\System\RScNzVw.exe
  2⤵
  PID:6672
- C:\Windows\System\fEIoWQG.exe
  C:\Windows\System\fEIoWQG.exe
  2⤵
  PID:6688
- C:\Windows\System\iykgIQs.exe
  C:\Windows\System\iykgIQs.exe
  2⤵
  PID:6704
- C:\Windows\System\EFvJjYJ.exe
  C:\Windows\System\EFvJjYJ.exe
  2⤵
  PID:6720
- C:\Windows\System\bPTrMdM.exe
  C:\Windows\System\bPTrMdM.exe
  2⤵
  PID:6736
- C:\Windows\System\avxiuLw.exe
  C:\Windows\System\avxiuLw.exe
  2⤵
  PID:6752
- C:\Windows\System\WFsaUhf.exe
  C:\Windows\System\WFsaUhf.exe
  2⤵
  PID:6768
- C:\Windows\System\QPEnMWF.exe
  C:\Windows\System\QPEnMWF.exe
  2⤵
  PID:6784
- C:\Windows\System\gUbrxyU.exe
  C:\Windows\System\gUbrxyU.exe
  2⤵
  PID:6800
- C:\Windows\System\IKFufHE.exe
  C:\Windows\System\IKFufHE.exe
  2⤵
  PID:6816
- C:\Windows\System\FMYuiRe.exe
  C:\Windows\System\FMYuiRe.exe
  2⤵
  PID:6832
- C:\Windows\System\tHgkIfE.exe
  C:\Windows\System\tHgkIfE.exe
  2⤵
  PID:6848
- C:\Windows\System\LLLoxIE.exe
  C:\Windows\System\LLLoxIE.exe
  2⤵
  PID:6864
- C:\Windows\System\bianfXb.exe
  C:\Windows\System\bianfXb.exe
  2⤵
  PID:6880
- C:\Windows\System\gcTnaQD.exe
  C:\Windows\System\gcTnaQD.exe
  2⤵
  PID:6896
- C:\Windows\System\xJXUqDY.exe
  C:\Windows\System\xJXUqDY.exe
  2⤵
  PID:6912
- C:\Windows\System\dzEjFek.exe
  C:\Windows\System\dzEjFek.exe
  2⤵
  PID:6928
- C:\Windows\System\FhaiPSt.exe
  C:\Windows\System\FhaiPSt.exe
  2⤵
  PID:6944
- C:\Windows\System\JNreVWj.exe
  C:\Windows\System\JNreVWj.exe
  2⤵
  PID:6960
- C:\Windows\System\tfJJQQz.exe
  C:\Windows\System\tfJJQQz.exe
  2⤵
  PID:6976
- C:\Windows\System\OLdfSOs.exe
  C:\Windows\System\OLdfSOs.exe
  2⤵
  PID:6992
- C:\Windows\System\EtrYCho.exe
  C:\Windows\System\EtrYCho.exe
  2⤵
  PID:7008
- C:\Windows\System\mNJpgQg.exe
  C:\Windows\System\mNJpgQg.exe
  2⤵
  PID:7024
- C:\Windows\System\xGaAZPG.exe
  C:\Windows\System\xGaAZPG.exe
  2⤵
  PID:7040
- C:\Windows\System\Kzcbmeb.exe
  C:\Windows\System\Kzcbmeb.exe
  2⤵
  PID:7056
- C:\Windows\System\syDmRsK.exe
  C:\Windows\System\syDmRsK.exe
  2⤵
  PID:7072
- C:\Windows\System\XPouFWt.exe
  C:\Windows\System\XPouFWt.exe
  2⤵
  PID:7088
- C:\Windows\System\FnAnDxM.exe
  C:\Windows\System\FnAnDxM.exe
  2⤵
  PID:7104
- C:\Windows\System\GdjjjLN.exe
  C:\Windows\System\GdjjjLN.exe
  2⤵
  PID:7120
- C:\Windows\System\mmcEZEB.exe
  C:\Windows\System\mmcEZEB.exe
  2⤵
  PID:7136
- C:\Windows\System\uyjcJEd.exe
  C:\Windows\System\uyjcJEd.exe
  2⤵
  PID:7152
- C:\Windows\System\aKApreE.exe
  C:\Windows\System\aKApreE.exe
  2⤵
  PID:5464
- C:\Windows\System\jjFNWpK.exe
  C:\Windows\System\jjFNWpK.exe
  2⤵
  PID:5800
- C:\Windows\System\KkHyZfG.exe
  C:\Windows\System\KkHyZfG.exe
  2⤵
  PID:5804
- C:\Windows\System\HdhuShf.exe
  C:\Windows\System\HdhuShf.exe
  2⤵
  PID:5816
- C:\Windows\System\txtRknx.exe
  C:\Windows\System\txtRknx.exe
  2⤵
  PID:6152
- C:\Windows\System\SltMyNR.exe
  C:\Windows\System\SltMyNR.exe
  2⤵
  PID:6204
- C:\Windows\System\HgLCzkM.exe
  C:\Windows\System\HgLCzkM.exe
  2⤵
  PID:6264
- C:\Windows\System\HVDpSFs.exe
  C:\Windows\System\HVDpSFs.exe
  2⤵
  PID:6332
- C:\Windows\System\FjCVCIk.exe
  C:\Windows\System\FjCVCIk.exe
  2⤵
  PID:6396
- C:\Windows\System\uHrZhMZ.exe
  C:\Windows\System\uHrZhMZ.exe
  2⤵
  PID:6456
- C:\Windows\System\YeuAkcE.exe
  C:\Windows\System\YeuAkcE.exe
  2⤵
  PID:6348
- C:\Windows\System\bVgwepy.exe
  C:\Windows\System\bVgwepy.exe
  2⤵
  PID:6524
- C:\Windows\System\FSWGagM.exe
  C:\Windows\System\FSWGagM.exe
  2⤵
  PID:6248
- C:\Windows\System\qHhPikT.exe
  C:\Windows\System\qHhPikT.exe
  2⤵
  PID:6552
- C:\Windows\System\lbVvMdr.exe
  C:\Windows\System\lbVvMdr.exe
  2⤵
  PID:6188
- C:\Windows\System\wxGgLBJ.exe
  C:\Windows\System\wxGgLBJ.exe
  2⤵
  PID:6556
- C:\Windows\System\MCqXXdx.exe
  C:\Windows\System\MCqXXdx.exe
  2⤵
  PID:6616
- C:\Windows\System\vSOfEFX.exe
  C:\Windows\System\vSOfEFX.exe
  2⤵
  PID:6620
- C:\Windows\System\PzjOypL.exe
  C:\Windows\System\PzjOypL.exe
  2⤵
  PID:6444
- C:\Windows\System\cjETZew.exe
  C:\Windows\System\cjETZew.exe
  2⤵
  PID:6652
- C:\Windows\System\lpzugNC.exe
  C:\Windows\System\lpzugNC.exe
  2⤵
  PID:6716
- C:\Windows\System\WLbmMSQ.exe
  C:\Windows\System\WLbmMSQ.exe
  2⤵
  PID:6748
- C:\Windows\System\dmqiEtM.exe
  C:\Windows\System\dmqiEtM.exe
  2⤵
  PID:6780
- C:\Windows\System\fbVrGyv.exe
  C:\Windows\System\fbVrGyv.exe
  2⤵
  PID:6700
- C:\Windows\System\NjXaXKC.exe
  C:\Windows\System\NjXaXKC.exe
  2⤵
  PID:6812
- C:\Windows\System\HREiiOn.exe
  C:\Windows\System\HREiiOn.exe
  2⤵
  PID:6840
- C:\Windows\System\vkOkovS.exe
  C:\Windows\System\vkOkovS.exe
  2⤵
  PID:6876
- C:\Windows\System\JfKjady.exe
  C:\Windows\System\JfKjady.exe
  2⤵
  PID:6796
- C:\Windows\System\Vtpayip.exe
  C:\Windows\System\Vtpayip.exe
  2⤵
  PID:6908
- C:\Windows\System\vFkkTYx.exe
  C:\Windows\System\vFkkTYx.exe
  2⤵
  PID:6924
- C:\Windows\System\FdiRaXO.exe
  C:\Windows\System\FdiRaXO.exe
  2⤵
  PID:7004
- C:\Windows\System\PRTAodD.exe
  C:\Windows\System\PRTAodD.exe
  2⤵
  PID:6984
- C:\Windows\System\lCVVTzy.exe
  C:\Windows\System\lCVVTzy.exe
  2⤵
  PID:7068
- C:\Windows\System\YODMUrH.exe
  C:\Windows\System\YODMUrH.exe
  2⤵
  PID:7100
- C:\Windows\System\AJIStoj.exe
  C:\Windows\System\AJIStoj.exe
  2⤵
  PID:7160
- C:\Windows\System\sXLmwQy.exe
  C:\Windows\System\sXLmwQy.exe
  2⤵
  PID:2544
- C:\Windows\System\XsnajZD.exe
  C:\Windows\System\XsnajZD.exe
  2⤵
  PID:6364
- C:\Windows\System\GZjEgoc.exe
  C:\Windows\System\GZjEgoc.exe
  2⤵
  PID:7148
- C:\Windows\System\xqqYmAZ.exe
  C:\Windows\System\xqqYmAZ.exe
  2⤵
  PID:7112
- C:\Windows\System\FrwneqT.exe
  C:\Windows\System\FrwneqT.exe
  2⤵
  PID:7052
- C:\Windows\System\XdFNTzc.exe
  C:\Windows\System\XdFNTzc.exe
  2⤵
  PID:6476
- C:\Windows\System\ZBPhstf.exe
  C:\Windows\System\ZBPhstf.exe
  2⤵
  PID:6584
- C:\Windows\System\RGXXvlV.exe
  C:\Windows\System\RGXXvlV.exe
  2⤵
  PID:6172
- C:\Windows\System\iZhRdIQ.exe
  C:\Windows\System\iZhRdIQ.exe
  2⤵
  PID:6216
- C:\Windows\System\FZwpdhw.exe
  C:\Windows\System\FZwpdhw.exe
  2⤵
  PID:6220
- C:\Windows\System\MmOtrQe.exe
  C:\Windows\System\MmOtrQe.exe
  2⤵
  PID:6684
- C:\Windows\System\uJWyjnt.exe
  C:\Windows\System\uJWyjnt.exe
  2⤵
  PID:6604
- C:\Windows\System\DGMrQYH.exe
  C:\Windows\System\DGMrQYH.exe
  2⤵
  PID:6744
- C:\Windows\System\kYdyRIT.exe
  C:\Windows\System\kYdyRIT.exe
  2⤵
  PID:6824
- C:\Windows\System\hbwQHiB.exe
  C:\Windows\System\hbwQHiB.exe
  2⤵
  PID:6728
- C:\Windows\System\fnuQrda.exe
  C:\Windows\System\fnuQrda.exe
  2⤵
  PID:6972
- C:\Windows\System\xqHGnhu.exe
  C:\Windows\System\xqHGnhu.exe
  2⤵
  PID:6936
- C:\Windows\System\wlkjNtd.exe
  C:\Windows\System\wlkjNtd.exe
  2⤵
  PID:7036
- C:\Windows\System\lZYGKrM.exe
  C:\Windows\System\lZYGKrM.exe
  2⤵
  PID:7132
- C:\Windows\System\alBxphr.exe
  C:\Windows\System\alBxphr.exe
  2⤵
  PID:6344
- C:\Windows\System\AifLxzr.exe
  C:\Windows\System\AifLxzr.exe
  2⤵
  PID:6168
- C:\Windows\System\tpHaOkR.exe
  C:\Windows\System\tpHaOkR.exe
  2⤵
  PID:6440
- C:\Windows\System\voUeBay.exe
  C:\Windows\System\voUeBay.exe
  2⤵
  PID:6764
- C:\Windows\System\AUDjLDF.exe
  C:\Windows\System\AUDjLDF.exe
  2⤵
  PID:6888
- C:\Windows\System\OpfBrxS.exe
  C:\Windows\System\OpfBrxS.exe
  2⤵
  PID:6536
- C:\Windows\System\EnXQvrI.exe
  C:\Windows\System\EnXQvrI.exe
  2⤵
  PID:6076
- C:\Windows\System\eoxylRq.exe
  C:\Windows\System\eoxylRq.exe
  2⤵
  PID:6568
- C:\Windows\System\AvfTNYz.exe
  C:\Windows\System\AvfTNYz.exe
  2⤵
  PID:6632
- C:\Windows\System\RUjPEvZ.exe
  C:\Windows\System\RUjPEvZ.exe
  2⤵
  PID:7096
- C:\Windows\System\WNhariK.exe
  C:\Windows\System\WNhariK.exe
  2⤵
  PID:6940
- C:\Windows\System\PtnmAhm.exe
  C:\Windows\System\PtnmAhm.exe
  2⤵
  PID:2904
- C:\Windows\System\bRuJVgr.exe
  C:\Windows\System\bRuJVgr.exe
  2⤵
  PID:6792
- C:\Windows\System\qzsCbrx.exe
  C:\Windows\System\qzsCbrx.exe
  2⤵
  PID:7176
- C:\Windows\System\DYWuQop.exe
  C:\Windows\System\DYWuQop.exe
  2⤵
  PID:7192
- C:\Windows\System\DmFvNgH.exe
  C:\Windows\System\DmFvNgH.exe
  2⤵
  PID:7208
- C:\Windows\System\JHekLRb.exe
  C:\Windows\System\JHekLRb.exe
  2⤵
  PID:7224
- C:\Windows\System\yItXNJc.exe
  C:\Windows\System\yItXNJc.exe
  2⤵
  PID:7240
- C:\Windows\System\AeFVLji.exe
  C:\Windows\System\AeFVLji.exe
  2⤵
  PID:7256
- C:\Windows\System\BwogUEa.exe
  C:\Windows\System\BwogUEa.exe
  2⤵
  PID:7272
- C:\Windows\System\LwJkSBW.exe
  C:\Windows\System\LwJkSBW.exe
  2⤵
  PID:7288
- C:\Windows\System\iGvYtSf.exe
  C:\Windows\System\iGvYtSf.exe
  2⤵
  PID:7304
- C:\Windows\System\ZuJwVQM.exe
  C:\Windows\System\ZuJwVQM.exe
  2⤵
  PID:7320
- C:\Windows\System\TKPpByl.exe
  C:\Windows\System\TKPpByl.exe
  2⤵
  PID:7336
- C:\Windows\System\pQJVaQS.exe
  C:\Windows\System\pQJVaQS.exe
  2⤵
  PID:7352
- C:\Windows\System\VlAzUhH.exe
  C:\Windows\System\VlAzUhH.exe
  2⤵
  PID:7368
- C:\Windows\System\JDNQJmN.exe
  C:\Windows\System\JDNQJmN.exe
  2⤵
  PID:7384
- C:\Windows\System\nLpiMUT.exe
  C:\Windows\System\nLpiMUT.exe
  2⤵
  PID:7400
- C:\Windows\System\ZiDynes.exe
  C:\Windows\System\ZiDynes.exe
  2⤵
  PID:7416
- C:\Windows\System\gVTBdbz.exe
  C:\Windows\System\gVTBdbz.exe
  2⤵
  PID:7432
- C:\Windows\System\ffwMFfr.exe
  C:\Windows\System\ffwMFfr.exe
  2⤵
  PID:7448
- C:\Windows\System\bfegozm.exe
  C:\Windows\System\bfegozm.exe
  2⤵
  PID:7464
- C:\Windows\System\SuabTdV.exe
  C:\Windows\System\SuabTdV.exe
  2⤵
  PID:7480
- C:\Windows\System\NVwCYDC.exe
  C:\Windows\System\NVwCYDC.exe
  2⤵
  PID:7496
- C:\Windows\System\BXitpdg.exe
  C:\Windows\System\BXitpdg.exe
  2⤵
  PID:7512
- C:\Windows\System\SdeWRzt.exe
  C:\Windows\System\SdeWRzt.exe
  2⤵
  PID:7528
- C:\Windows\System\osiItxC.exe
  C:\Windows\System\osiItxC.exe
  2⤵
  PID:7544
- C:\Windows\System\TlWuXJB.exe
  C:\Windows\System\TlWuXJB.exe
  2⤵
  PID:7560
- C:\Windows\System\tCHEEXt.exe
  C:\Windows\System\tCHEEXt.exe
  2⤵
  PID:7576
- C:\Windows\System\vEzUuTd.exe
  C:\Windows\System\vEzUuTd.exe
  2⤵
  PID:7592
- C:\Windows\System\gwcnkqE.exe
  C:\Windows\System\gwcnkqE.exe
  2⤵
  PID:7608
- C:\Windows\System\ABIlZwk.exe
  C:\Windows\System\ABIlZwk.exe
  2⤵
  PID:7624
- C:\Windows\System\GUPhajh.exe
  C:\Windows\System\GUPhajh.exe
  2⤵
  PID:7640
- C:\Windows\System\IAgvcyf.exe
  C:\Windows\System\IAgvcyf.exe
  2⤵
  PID:7656
- C:\Windows\System\BmCLGam.exe
  C:\Windows\System\BmCLGam.exe
  2⤵
  PID:7672
- C:\Windows\System\sHBMsAB.exe
  C:\Windows\System\sHBMsAB.exe
  2⤵
  PID:7692
- C:\Windows\System\ArOHPaZ.exe
  C:\Windows\System\ArOHPaZ.exe
  2⤵
  PID:7708
- C:\Windows\System\VUbueXD.exe
  C:\Windows\System\VUbueXD.exe
  2⤵
  PID:7724
- C:\Windows\System\uAObehn.exe
  C:\Windows\System\uAObehn.exe
  2⤵
  PID:7740
- C:\Windows\System\wvEbCva.exe
  C:\Windows\System\wvEbCva.exe
  2⤵
  PID:7756
- C:\Windows\System\rQHlJcp.exe
  C:\Windows\System\rQHlJcp.exe
  2⤵
  PID:7772
- C:\Windows\System\PiyMuCD.exe
  C:\Windows\System\PiyMuCD.exe
  2⤵
  PID:7788
- C:\Windows\System\mDSKUSI.exe
  C:\Windows\System\mDSKUSI.exe
  2⤵
  PID:7804
- C:\Windows\System\gippDVb.exe
  C:\Windows\System\gippDVb.exe
  2⤵
  PID:7820
- C:\Windows\System\OqPJtRR.exe
  C:\Windows\System\OqPJtRR.exe
  2⤵
  PID:7836
- C:\Windows\System\dHqojen.exe
  C:\Windows\System\dHqojen.exe
  2⤵
  PID:7852
- C:\Windows\System\XIFSzEp.exe
  C:\Windows\System\XIFSzEp.exe
  2⤵
  PID:7868
- C:\Windows\System\aUeNkkK.exe
  C:\Windows\System\aUeNkkK.exe
  2⤵
  PID:7884
- C:\Windows\System\vIgizEY.exe
  C:\Windows\System\vIgizEY.exe
  2⤵
  PID:7900
- C:\Windows\System\mRuVBrm.exe
  C:\Windows\System\mRuVBrm.exe
  2⤵
  PID:7916
- C:\Windows\System\NyUwerS.exe
  C:\Windows\System\NyUwerS.exe
  2⤵
  PID:7932
- C:\Windows\System\OapCRUu.exe
  C:\Windows\System\OapCRUu.exe
  2⤵
  PID:7948
- C:\Windows\System\leSNVks.exe
  C:\Windows\System\leSNVks.exe
  2⤵
  PID:7964
- C:\Windows\System\kVHLYge.exe
  C:\Windows\System\kVHLYge.exe
  2⤵
  PID:7980
- C:\Windows\System\RwymAWL.exe
  C:\Windows\System\RwymAWL.exe
  2⤵
  PID:7996
- C:\Windows\System\mcVQYqQ.exe
  C:\Windows\System\mcVQYqQ.exe
  2⤵
  PID:8012
- C:\Windows\System\ddgGYkT.exe
  C:\Windows\System\ddgGYkT.exe
  2⤵
  PID:8028
- C:\Windows\System\RrjlYQy.exe
  C:\Windows\System\RrjlYQy.exe
  2⤵
  PID:8044
- C:\Windows\System\TMbfrVu.exe
  C:\Windows\System\TMbfrVu.exe
  2⤵
  PID:8060
- C:\Windows\System\LSIcclX.exe
  C:\Windows\System\LSIcclX.exe
  2⤵
  PID:8076
- C:\Windows\System\EiwMgmY.exe
  C:\Windows\System\EiwMgmY.exe
  2⤵
  PID:8092
- C:\Windows\System\GXPiBOy.exe
  C:\Windows\System\GXPiBOy.exe
  2⤵
  PID:8108
- C:\Windows\System\obJnlpa.exe
  C:\Windows\System\obJnlpa.exe
  2⤵
  PID:8124
- C:\Windows\System\wzkLslQ.exe
  C:\Windows\System\wzkLslQ.exe
  2⤵
  PID:8140
- C:\Windows\System\serpVqz.exe
  C:\Windows\System\serpVqz.exe
  2⤵
  PID:8156
- C:\Windows\System\kRjrOLy.exe
  C:\Windows\System\kRjrOLy.exe
  2⤵
  PID:8172
- C:\Windows\System\UYpjvTJ.exe
  C:\Windows\System\UYpjvTJ.exe
  2⤵
  PID:8188
- C:\Windows\System\OVhGlbU.exe
  C:\Windows\System\OVhGlbU.exe
  2⤵
  PID:7220
- C:\Windows\System\OmOXIaS.exe
  C:\Windows\System\OmOXIaS.exe
  2⤵
  PID:7284
- C:\Windows\System\gfaplxP.exe
  C:\Windows\System\gfaplxP.exe
  2⤵
  PID:7348
- C:\Windows\System\hleHLjj.exe
  C:\Windows\System\hleHLjj.exe
  2⤵
  PID:7412
- C:\Windows\System\wsTjZza.exe
  C:\Windows\System\wsTjZza.exe
  2⤵
  PID:7476
- C:\Windows\System\zVNCJhX.exe
  C:\Windows\System\zVNCJhX.exe
  2⤵
  PID:7540
- C:\Windows\System\ikdWSBd.exe
  C:\Windows\System\ikdWSBd.exe
  2⤵
  PID:7604
- C:\Windows\System\mgoTiGj.exe
  C:\Windows\System\mgoTiGj.exe
  2⤵
  PID:7636
- C:\Windows\System\HuAsHjY.exe
  C:\Windows\System\HuAsHjY.exe
  2⤵
  PID:7664
- C:\Windows\System\LVnjrWZ.exe
  C:\Windows\System\LVnjrWZ.exe
  2⤵
  PID:7396
- C:\Windows\System\UDdVmKN.exe
  C:\Windows\System\UDdVmKN.exe
  2⤵
  PID:7700
- C:\Windows\System\vgDabby.exe
  C:\Windows\System\vgDabby.exe
  2⤵
  PID:7116
- C:\Windows\System\iCykTkI.exe
  C:\Windows\System\iCykTkI.exe
  2⤵
  PID:7732
- C:\Windows\System\SxYcamj.exe
  C:\Windows\System\SxYcamj.exe
  2⤵
  PID:7460
- C:\Windows\System\aXyVYgd.exe
  C:\Windows\System\aXyVYgd.exe
  2⤵
  PID:7032
- C:\Windows\System\GtazuhT.exe
  C:\Windows\System\GtazuhT.exe
  2⤵
  PID:7264
- C:\Windows\System\KnVvcYb.exe
  C:\Windows\System\KnVvcYb.exe
  2⤵
  PID:7364
- C:\Windows\System\rAnGRak.exe
  C:\Windows\System\rAnGRak.exe
  2⤵
  PID:7520
- C:\Windows\System\IRSIdTq.exe
  C:\Windows\System\IRSIdTq.exe
  2⤵
  PID:7588
- C:\Windows\System\YclhVvX.exe
  C:\Windows\System\YclhVvX.exe
  2⤵
  PID:7736
- C:\Windows\System\GwJMQTz.exe
  C:\Windows\System\GwJMQTz.exe
  2⤵
  PID:7748
- C:\Windows\System\JkSCoOu.exe
  C:\Windows\System\JkSCoOu.exe
  2⤵
  PID:7780
- C:\Windows\System\gEOlURH.exe
  C:\Windows\System\gEOlURH.exe
  2⤵
  PID:7828
- C:\Windows\System\RiqDELI.exe
  C:\Windows\System\RiqDELI.exe
  2⤵
  PID:7892
- C:\Windows\System\ieBtQKI.exe
  C:\Windows\System\ieBtQKI.exe
  2⤵
  PID:7956
- C:\Windows\System\STzbeNN.exe
  C:\Windows\System\STzbeNN.exe
  2⤵
  PID:7816
- C:\Windows\System\rNchGRs.exe
  C:\Windows\System\rNchGRs.exe
  2⤵
  PID:8056
- C:\Windows\System\hGdkqqv.exe
  C:\Windows\System\hGdkqqv.exe
  2⤵
  PID:8120
- C:\Windows\System\AyVYsqw.exe
  C:\Windows\System\AyVYsqw.exe
  2⤵
  PID:8184
- C:\Windows\System\qzRLPGf.exe
  C:\Windows\System\qzRLPGf.exe
  2⤵
  PID:7408
- C:\Windows\System\WiIiUbw.exe
  C:\Windows\System\WiIiUbw.exe
  2⤵
  PID:6588
- C:\Windows\System\apImMcw.exe
  C:\Windows\System\apImMcw.exe
  2⤵
  PID:7844
- C:\Windows\System\hmlGPrs.exe
  C:\Windows\System\hmlGPrs.exe
  2⤵
  PID:7456
- C:\Windows\System\ulTUmxQ.exe
  C:\Windows\System\ulTUmxQ.exe
  2⤵
  PID:7492
- C:\Windows\System\TUQvGko.exe
  C:\Windows\System\TUQvGko.exe
  2⤵
  PID:7940
- C:\Windows\System\tSMBBUB.exe
  C:\Windows\System\tSMBBUB.exe
  2⤵
  PID:7864
- C:\Windows\System\CvMUfTE.exe
  C:\Windows\System\CvMUfTE.exe
  2⤵
  PID:8116
- C:\Windows\System\dkBcYDO.exe
  C:\Windows\System\dkBcYDO.exe
  2⤵
  PID:7876
- C:\Windows\System\PeAWYPP.exe
  C:\Windows\System\PeAWYPP.exe
  2⤵
  PID:8164
- C:\Windows\System\HeSvbuH.exe
  C:\Windows\System\HeSvbuH.exe
  2⤵
  PID:7924
- C:\Windows\System\IFYZprf.exe
  C:\Windows\System\IFYZprf.exe
  2⤵
  PID:7972
- C:\Windows\System\QPoCdBC.exe
  C:\Windows\System\QPoCdBC.exe
  2⤵
  PID:8036
- C:\Windows\System\SEnFZoj.exe
  C:\Windows\System\SEnFZoj.exe
  2⤵
  PID:8100
- C:\Windows\System\VlPaLmt.exe
  C:\Windows\System\VlPaLmt.exe
  2⤵
  PID:8168
- C:\Windows\System\VUoRGzc.exe
  C:\Windows\System\VUoRGzc.exe
  2⤵
  PID:7344
- C:\Windows\System\GhkxeIj.exe
  C:\Windows\System\GhkxeIj.exe
  2⤵
  PID:7200
- C:\Windows\System\CrrSnyI.exe
  C:\Windows\System\CrrSnyI.exe
  2⤵
  PID:7236
- C:\Windows\System\WiqOFgB.exe
  C:\Windows\System\WiqOFgB.exe
  2⤵
  PID:7360
- C:\Windows\System\pYmuqwL.exe
  C:\Windows\System\pYmuqwL.exe
  2⤵
  PID:8024
- C:\Windows\System\sfDHGAL.exe
  C:\Windows\System\sfDHGAL.exe
  2⤵
  PID:7812
- C:\Windows\System\SRTKAkw.exe
  C:\Windows\System\SRTKAkw.exe
  2⤵
  PID:5624
- C:\Windows\System\KSeomoL.exe
  C:\Windows\System\KSeomoL.exe
  2⤵
  PID:7648
- C:\Windows\System\zsIftDR.exe
  C:\Windows\System\zsIftDR.exe
  2⤵
  PID:8088
- C:\Windows\System\hjzYRrU.exe
  C:\Windows\System\hjzYRrU.exe
  2⤵
  PID:8004
- C:\Windows\System\CeoNzfr.exe
  C:\Windows\System\CeoNzfr.exe
  2⤵
  PID:7472
- C:\Windows\System\pwsVwme.exe
  C:\Windows\System\pwsVwme.exe
  2⤵
  PID:7300
- C:\Windows\System\RfgiAGl.exe
  C:\Windows\System\RfgiAGl.exe
  2⤵
  PID:7928
- C:\Windows\System\mRYBAPA.exe
  C:\Windows\System\mRYBAPA.exe
  2⤵
  PID:8072
- C:\Windows\System\ZYulWxU.exe
  C:\Windows\System\ZYulWxU.exe
  2⤵
  PID:8068
- C:\Windows\System\aXlDQoF.exe
  C:\Windows\System\aXlDQoF.exe
  2⤵
  PID:7784
- C:\Windows\System\SjelmTZ.exe
  C:\Windows\System\SjelmTZ.exe
  2⤵
  PID:7848
- C:\Windows\System\HHdiAYi.exe
  C:\Windows\System\HHdiAYi.exe
  2⤵
  PID:7912
- C:\Windows\System\zAPAsWv.exe
  C:\Windows\System\zAPAsWv.exe
  2⤵
  PID:7380
- C:\Windows\System\ovNveDf.exe
  C:\Windows\System\ovNveDf.exe
  2⤵
  PID:8204
- C:\Windows\System\lxRGaYU.exe
  C:\Windows\System\lxRGaYU.exe
  2⤵
  PID:8220
- C:\Windows\System\nbgozJP.exe
  C:\Windows\System\nbgozJP.exe
  2⤵
  PID:8236
- C:\Windows\System\cKbgLyC.exe
  C:\Windows\System\cKbgLyC.exe
  2⤵
  PID:8252
- C:\Windows\System\eyeBmbQ.exe
  C:\Windows\System\eyeBmbQ.exe
  2⤵
  PID:8268
- C:\Windows\System\zISmPIn.exe
  C:\Windows\System\zISmPIn.exe
  2⤵
  PID:8284
- C:\Windows\System\OORmZWC.exe
  C:\Windows\System\OORmZWC.exe
  2⤵
  PID:8300
- C:\Windows\System\BscpUUH.exe
  C:\Windows\System\BscpUUH.exe
  2⤵
  PID:8316
- C:\Windows\System\JJAnMtP.exe
  C:\Windows\System\JJAnMtP.exe
  2⤵
  PID:8332
- C:\Windows\System\upoMkmi.exe
  C:\Windows\System\upoMkmi.exe
  2⤵
  PID:8348
- C:\Windows\System\iTgSZBT.exe
  C:\Windows\System\iTgSZBT.exe
  2⤵
  PID:8364
- C:\Windows\System\AyEPVpU.exe
  C:\Windows\System\AyEPVpU.exe
  2⤵
  PID:8380
- C:\Windows\System\KfIUdYS.exe
  C:\Windows\System\KfIUdYS.exe
  2⤵
  PID:8396
- C:\Windows\System\jMtPEiL.exe
  C:\Windows\System\jMtPEiL.exe
  2⤵
  PID:8412
- C:\Windows\System\qpPOTiA.exe
  C:\Windows\System\qpPOTiA.exe
  2⤵
  PID:8428
- C:\Windows\System\CeSgPVz.exe
  C:\Windows\System\CeSgPVz.exe
  2⤵
  PID:8444
- C:\Windows\System\oWXevot.exe
  C:\Windows\System\oWXevot.exe
  2⤵
  PID:8460
- C:\Windows\System\WXBNfDU.exe
  C:\Windows\System\WXBNfDU.exe
  2⤵
  PID:8476
- C:\Windows\System\YECMpeV.exe
  C:\Windows\System\YECMpeV.exe
  2⤵
  PID:8492
- C:\Windows\System\UomiPXE.exe
  C:\Windows\System\UomiPXE.exe
  2⤵
  PID:8508
- C:\Windows\System\TSWSDhi.exe
  C:\Windows\System\TSWSDhi.exe
  2⤵
  PID:8524
- C:\Windows\System\woagKTW.exe
  C:\Windows\System\woagKTW.exe
  2⤵
  PID:8540
- C:\Windows\System\ZmCFSDu.exe
  C:\Windows\System\ZmCFSDu.exe
  2⤵
  PID:8556
- C:\Windows\System\PSoZjpu.exe
  C:\Windows\System\PSoZjpu.exe
  2⤵
  PID:8572
- C:\Windows\System\FmgYIDe.exe
  C:\Windows\System\FmgYIDe.exe
  2⤵
  PID:8588
- C:\Windows\System\vufYtHg.exe
  C:\Windows\System\vufYtHg.exe
  2⤵
  PID:8604
- C:\Windows\System\JHSGMwy.exe
  C:\Windows\System\JHSGMwy.exe
  2⤵
  PID:8620
- C:\Windows\System\WiZJQuG.exe
  C:\Windows\System\WiZJQuG.exe
  2⤵
  PID:8636
- C:\Windows\System\vrpuzvb.exe
  C:\Windows\System\vrpuzvb.exe
  2⤵
  PID:8652
- C:\Windows\System\VZnCBzb.exe
  C:\Windows\System\VZnCBzb.exe
  2⤵
  PID:8668
- C:\Windows\System\yawDpED.exe
  C:\Windows\System\yawDpED.exe
  2⤵
  PID:8684
- C:\Windows\System\GrvSvQJ.exe
  C:\Windows\System\GrvSvQJ.exe
  2⤵
  PID:8700
- C:\Windows\System\mVmWUYd.exe
  C:\Windows\System\mVmWUYd.exe
  2⤵
  PID:8716
- C:\Windows\System\McsMhOw.exe
  C:\Windows\System\McsMhOw.exe
  2⤵
  PID:8732
- C:\Windows\System\OiaNhQw.exe
  C:\Windows\System\OiaNhQw.exe
  2⤵
  PID:8748
- C:\Windows\System\yFeebYp.exe
  C:\Windows\System\yFeebYp.exe
  2⤵
  PID:8764
- C:\Windows\System\gKwHYYc.exe
  C:\Windows\System\gKwHYYc.exe
  2⤵
  PID:8780
- C:\Windows\System\BgaguyQ.exe
  C:\Windows\System\BgaguyQ.exe
  2⤵
  PID:8796
- C:\Windows\System\MCDUgKs.exe
  C:\Windows\System\MCDUgKs.exe
  2⤵
  PID:8812
- C:\Windows\System\EdkVBqI.exe
  C:\Windows\System\EdkVBqI.exe
  2⤵
  PID:8828
- C:\Windows\System\vpyuXpf.exe
  C:\Windows\System\vpyuXpf.exe
  2⤵
  PID:8844
- C:\Windows\System\OsVBuiH.exe
  C:\Windows\System\OsVBuiH.exe
  2⤵
  PID:8860
- C:\Windows\System\ZisLduE.exe
  C:\Windows\System\ZisLduE.exe
  2⤵
  PID:8876
- C:\Windows\System\KDlgFJZ.exe
  C:\Windows\System\KDlgFJZ.exe
  2⤵
  PID:8892
- C:\Windows\System\dCbFeBu.exe
  C:\Windows\System\dCbFeBu.exe
  2⤵
  PID:8908
- C:\Windows\System\HpvzVck.exe
  C:\Windows\System\HpvzVck.exe
  2⤵
  PID:8928
- C:\Windows\System\gHjuuTZ.exe
  C:\Windows\System\gHjuuTZ.exe
  2⤵
  PID:8944
- C:\Windows\System\LMeAsmi.exe
  C:\Windows\System\LMeAsmi.exe
  2⤵
  PID:8960
- C:\Windows\System\HIVjTRK.exe
  C:\Windows\System\HIVjTRK.exe
  2⤵
  PID:8976
- C:\Windows\System\piqfOeI.exe
  C:\Windows\System\piqfOeI.exe
  2⤵
  PID:8992
- C:\Windows\System\sLjphlH.exe
  C:\Windows\System\sLjphlH.exe
  2⤵
  PID:9008
- C:\Windows\System\YPAwSMv.exe
  C:\Windows\System\YPAwSMv.exe
  2⤵
  PID:9024
- C:\Windows\System\UcctQHI.exe
  C:\Windows\System\UcctQHI.exe
  2⤵
  PID:9040
- C:\Windows\System\olLgvgg.exe
  C:\Windows\System\olLgvgg.exe
  2⤵
  PID:9056
- C:\Windows\System\sJdwziL.exe
  C:\Windows\System\sJdwziL.exe
  2⤵
  PID:9072
- C:\Windows\System\vkEVKjs.exe
  C:\Windows\System\vkEVKjs.exe
  2⤵
  PID:9088
- C:\Windows\System\wOVRnys.exe
  C:\Windows\System\wOVRnys.exe
  2⤵
  PID:9104
- C:\Windows\System\BeTlBtv.exe
  C:\Windows\System\BeTlBtv.exe
  2⤵
  PID:9120
- C:\Windows\System\qunGPdV.exe
  C:\Windows\System\qunGPdV.exe
  2⤵
  PID:9136
- C:\Windows\System\ZmmexEt.exe
  C:\Windows\System\ZmmexEt.exe
  2⤵
  PID:9152
- C:\Windows\System\NJYKffp.exe
  C:\Windows\System\NJYKffp.exe
  2⤵
  PID:9168
- C:\Windows\System\UIYqCnh.exe
  C:\Windows\System\UIYqCnh.exe
  2⤵
  PID:9184
- C:\Windows\System\FJkFBCY.exe
  C:\Windows\System\FJkFBCY.exe
  2⤵
  PID:9200
- C:\Windows\System\frxidml.exe
  C:\Windows\System\frxidml.exe
  2⤵
  PID:8196
- C:\Windows\System\QAmJTlz.exe
  C:\Windows\System\QAmJTlz.exe
  2⤵
  PID:8152
- C:\Windows\System\hxjHCVA.exe
  C:\Windows\System\hxjHCVA.exe
  2⤵
  PID:7800
- C:\Windows\System\OMVZupx.exe
  C:\Windows\System\OMVZupx.exe
  2⤵
  PID:8180
- C:\Windows\System\cOtuTGg.exe
  C:\Windows\System\cOtuTGg.exe
  2⤵
  PID:8244
- C:\Windows\System\ZKssMDh.exe
  C:\Windows\System\ZKssMDh.exe
  2⤵
  PID:8292
- C:\Windows\System\YKuyjlX.exe
  C:\Windows\System\YKuyjlX.exe
  2⤵
  PID:8280
- C:\Windows\System\MwiXeqY.exe
  C:\Windows\System\MwiXeqY.exe
  2⤵
  PID:8360
- C:\Windows\System\xuVflzf.exe
  C:\Windows\System\xuVflzf.exe
  2⤵
  PID:8424
- C:\Windows\System\rjlJbYF.exe
  C:\Windows\System\rjlJbYF.exe
  2⤵
  PID:8340
- C:\Windows\System\GfOketB.exe
  C:\Windows\System\GfOketB.exe
  2⤵
  PID:8376
- C:\Windows\System\okfZmJR.exe
  C:\Windows\System\okfZmJR.exe
  2⤵
  PID:8456
- C:\Windows\System\AlAsFMu.exe
  C:\Windows\System\AlAsFMu.exe
  2⤵
  PID:8488
- C:\Windows\System\nVPOhib.exe
  C:\Windows\System\nVPOhib.exe
  2⤵
  PID:8580
- C:\Windows\System\bcAgisI.exe
  C:\Windows\System\bcAgisI.exe
  2⤵
  PID:8504
- C:\Windows\System\WSwpTwk.exe
  C:\Windows\System\WSwpTwk.exe
  2⤵
  PID:8596
- C:\Windows\System\sANsGMq.exe
  C:\Windows\System\sANsGMq.exe
  2⤵
  PID:8628
- C:\Windows\System\dAEzpyy.exe
  C:\Windows\System\dAEzpyy.exe
  2⤵
  PID:8632
- C:\Windows\System\DGobBTa.exe
  C:\Windows\System\DGobBTa.exe
  2⤵
  PID:8708
- C:\Windows\System\PvuGhcr.exe
  C:\Windows\System\PvuGhcr.exe
  2⤵
  PID:8772
- C:\Windows\System\UcjrPeN.exe
  C:\Windows\System\UcjrPeN.exe
  2⤵
  PID:8836
- C:\Windows\System\EndsUxp.exe
  C:\Windows\System\EndsUxp.exe
  2⤵
  PID:8724
- C:\Windows\System\ElYbNxV.exe
  C:\Windows\System\ElYbNxV.exe
  2⤵
  PID:8792
- C:\Windows\System\QxHetrU.exe
  C:\Windows\System\QxHetrU.exe
  2⤵
  PID:8868
- C:\Windows\System\ksmEdyt.exe
  C:\Windows\System\ksmEdyt.exe
  2⤵
  PID:8852
- C:\Windows\System\ROJPhrZ.exe
  C:\Windows\System\ROJPhrZ.exe
  2⤵
  PID:8904
- C:\Windows\System\OZjftCV.exe
  C:\Windows\System\OZjftCV.exe
  2⤵
  PID:8968
- C:\Windows\System\FaIlZFD.exe
  C:\Windows\System\FaIlZFD.exe
  2⤵
  PID:8988
- C:\Windows\System\FpTjcvS.exe
  C:\Windows\System\FpTjcvS.exe
  2⤵
  PID:9032
- C:\Windows\System\gnPQQNz.exe
  C:\Windows\System\gnPQQNz.exe
  2⤵
  PID:9016
- C:\Windows\System\REWaYPY.exe
  C:\Windows\System\REWaYPY.exe
  2⤵
  PID:9080
- C:\Windows\System\aEbdttH.exe
  C:\Windows\System\aEbdttH.exe
  2⤵
  PID:8920
- C:\Windows\System\Pfktifn.exe
  C:\Windows\System\Pfktifn.exe
  2⤵
  PID:9144
- C:\Windows\System\aehVWkA.exe
  C:\Windows\System\aehVWkA.exe
  2⤵
  PID:9192
- C:\Windows\System\JBmKQiM.exe
  C:\Windows\System\JBmKQiM.exe
  2⤵
  PID:8132
- C:\Windows\System\sqZboZQ.exe
  C:\Windows\System\sqZboZQ.exe
  2⤵
  PID:7316
- C:\Windows\System\nQoLVQk.exe
  C:\Windows\System\nQoLVQk.exe
  2⤵
  PID:9176
- C:\Windows\System\SOMqHZU.exe
  C:\Windows\System\SOMqHZU.exe
  2⤵
  PID:7668
- C:\Windows\System\iXgtOFz.exe
  C:\Windows\System\iXgtOFz.exe
  2⤵
  PID:8452
- C:\Windows\System\GUOPTUZ.exe
  C:\Windows\System\GUOPTUZ.exe
  2⤵
  PID:8520
- C:\Windows\System\cvzkfey.exe
  C:\Windows\System\cvzkfey.exe
  2⤵
  PID:8648
- C:\Windows\System\fGcYFfr.exe
  C:\Windows\System\fGcYFfr.exe
  2⤵
  PID:8692
- C:\Windows\System\xudVbWU.exe
  C:\Windows\System\xudVbWU.exe
  2⤵
  PID:8840
- C:\Windows\System\ztyoQVv.exe
  C:\Windows\System\ztyoQVv.exe
  2⤵
  PID:8276
- C:\Windows\System\uXTiqWe.exe
  C:\Windows\System\uXTiqWe.exe
  2⤵
  PID:8472
- C:\Windows\System\fGqpkev.exe
  C:\Windows\System\fGqpkev.exe
  2⤵
  PID:8500
- C:\Windows\System\JinXuRj.exe
  C:\Windows\System\JinXuRj.exe
  2⤵
  PID:8760
- C:\Windows\System\aycIhhS.exe
  C:\Windows\System\aycIhhS.exe
  2⤵
  PID:9064
- C:\Windows\System\BvQlNbp.exe
  C:\Windows\System\BvQlNbp.exe
  2⤵
  PID:8568
- C:\Windows\System\sigNWMW.exe
  C:\Windows\System\sigNWMW.exe
  2⤵
  PID:9004
- C:\Windows\System\nzQPPIN.exe
  C:\Windows\System\nzQPPIN.exe
  2⤵
  PID:9020
- C:\Windows\System\udxLJbb.exe
  C:\Windows\System\udxLJbb.exe
  2⤵
  PID:9128
- C:\Windows\System\GBVLNWa.exe
  C:\Windows\System\GBVLNWa.exe
  2⤵
  PID:9180
- C:\Windows\System\YkNrtrq.exe
  C:\Windows\System\YkNrtrq.exe
  2⤵
  PID:8436
- C:\Windows\System\tqAbXMF.exe
  C:\Windows\System\tqAbXMF.exe
  2⤵
  PID:9148
- C:\Windows\System\LxxCjvB.exe
  C:\Windows\System\LxxCjvB.exe
  2⤵
  PID:8740
- C:\Windows\System\HVmAEIO.exe
  C:\Windows\System\HVmAEIO.exe
  2⤵
  PID:8484
- C:\Windows\System\CNUzbpR.exe
  C:\Windows\System\CNUzbpR.exe
  2⤵
  PID:8612
- C:\Windows\System\nVVVJEm.exe
  C:\Windows\System\nVVVJEm.exe
  2⤵
  PID:8344
- C:\Windows\System\XygnSMD.exe
  C:\Windows\System\XygnSMD.exe
  2⤵
  PID:8804
- C:\Windows\System\nhClCyJ.exe
  C:\Windows\System\nhClCyJ.exe
  2⤵
  PID:9096
- C:\Windows\System\yXyuSkd.exe
  C:\Windows\System\yXyuSkd.exe
  2⤵
  PID:8408
- C:\Windows\System\mqThrro.exe
  C:\Windows\System\mqThrro.exe
  2⤵
  PID:8232
- C:\Windows\System\ChMnEmI.exe
  C:\Windows\System\ChMnEmI.exe
  2⤵
  PID:8744
- C:\Windows\System\NUhLSnj.exe
  C:\Windows\System\NUhLSnj.exe
  2⤵
  PID:8808
- C:\Windows\System\wFwhhaR.exe
  C:\Windows\System\wFwhhaR.exe
  2⤵
  PID:9084
- C:\Windows\System\uskvqgF.exe
  C:\Windows\System\uskvqgF.exe
  2⤵
  PID:8924
- C:\Windows\System\mTlOIbs.exe
  C:\Windows\System\mTlOIbs.exe
  2⤵
  PID:8616
- C:\Windows\System\nbvuNRA.exe
  C:\Windows\System\nbvuNRA.exe
  2⤵
  PID:9232
- C:\Windows\System\RuQzXFD.exe
  C:\Windows\System\RuQzXFD.exe
  2⤵
  PID:9248
- C:\Windows\System\KVWpMBF.exe
  C:\Windows\System\KVWpMBF.exe
  2⤵
  PID:9264
- C:\Windows\System\ybwTtil.exe
  C:\Windows\System\ybwTtil.exe
  2⤵
  PID:9280
- C:\Windows\System\PUJmGcL.exe
  C:\Windows\System\PUJmGcL.exe
  2⤵
  PID:9296
- C:\Windows\System\pSOyoqR.exe
  C:\Windows\System\pSOyoqR.exe
  2⤵
  PID:9312
- C:\Windows\System\gtDsDyQ.exe
  C:\Windows\System\gtDsDyQ.exe
  2⤵
  PID:9328
- C:\Windows\System\eYtsHWQ.exe
  C:\Windows\System\eYtsHWQ.exe
  2⤵
  PID:9344
- C:\Windows\System\YFAWrmS.exe
  C:\Windows\System\YFAWrmS.exe
  2⤵
  PID:9360
- C:\Windows\System\RDakyJh.exe
  C:\Windows\System\RDakyJh.exe
  2⤵
  PID:9376
- C:\Windows\System\ucEPCYt.exe
  C:\Windows\System\ucEPCYt.exe
  2⤵
  PID:9392
- C:\Windows\System\agBfIdK.exe
  C:\Windows\System\agBfIdK.exe
  2⤵
  PID:9408
- C:\Windows\System\HhyjVjp.exe
  C:\Windows\System\HhyjVjp.exe
  2⤵
  PID:9424
- C:\Windows\System\xDNfJbp.exe
  C:\Windows\System\xDNfJbp.exe
  2⤵
  PID:9440
- C:\Windows\System\GRSuXok.exe
  C:\Windows\System\GRSuXok.exe
  2⤵
  PID:9456
- C:\Windows\System\EReNACm.exe
  C:\Windows\System\EReNACm.exe
  2⤵
  PID:9472
- C:\Windows\System\HuBhtUZ.exe
  C:\Windows\System\HuBhtUZ.exe
  2⤵
  PID:9488
- C:\Windows\System\bLnaCWp.exe
  C:\Windows\System\bLnaCWp.exe
  2⤵
  PID:9508
- C:\Windows\System\lMGDdCt.exe
  C:\Windows\System\lMGDdCt.exe
  2⤵
  PID:9524
- C:\Windows\System\PFJRxKa.exe
  C:\Windows\System\PFJRxKa.exe
  2⤵
  PID:9540
- C:\Windows\System\qkaQbzK.exe
  C:\Windows\System\qkaQbzK.exe
  2⤵
  PID:9556
- C:\Windows\System\BfQIwlM.exe
  C:\Windows\System\BfQIwlM.exe
  2⤵
  PID:9572
- C:\Windows\System\XPBuhCW.exe
  C:\Windows\System\XPBuhCW.exe
  2⤵
  PID:9588
- C:\Windows\System\gMpcqCd.exe
  C:\Windows\System\gMpcqCd.exe
  2⤵
  PID:9604
- C:\Windows\System\MUqbhWZ.exe
  C:\Windows\System\MUqbhWZ.exe
  2⤵
  PID:9620
- C:\Windows\System\NWgKUAk.exe
  C:\Windows\System\NWgKUAk.exe
  2⤵
  PID:9636
- C:\Windows\System\sBRLsqw.exe
  C:\Windows\System\sBRLsqw.exe
  2⤵
  PID:9652
- C:\Windows\System\OGDVORc.exe
  C:\Windows\System\OGDVORc.exe
  2⤵
  PID:9668
- C:\Windows\System\NWcxUCR.exe
  C:\Windows\System\NWcxUCR.exe
  2⤵
  PID:9684
- C:\Windows\System\txtDxju.exe
  C:\Windows\System\txtDxju.exe
  2⤵
  PID:9700
- C:\Windows\System\gFmRagq.exe
  C:\Windows\System\gFmRagq.exe
  2⤵
  PID:9716
- C:\Windows\System\fxywmDN.exe
  C:\Windows\System\fxywmDN.exe
  2⤵
  PID:9732
- C:\Windows\System\RPfWKPJ.exe
  C:\Windows\System\RPfWKPJ.exe
  2⤵
  PID:9748
- C:\Windows\System\lZFtRTM.exe
  C:\Windows\System\lZFtRTM.exe
  2⤵
  PID:9764
- C:\Windows\System\DeSlwyB.exe
  C:\Windows\System\DeSlwyB.exe
  2⤵
  PID:9780
- C:\Windows\System\HkakXgp.exe
  C:\Windows\System\HkakXgp.exe
  2⤵
  PID:9796
- C:\Windows\System\kxEXjPY.exe
  C:\Windows\System\kxEXjPY.exe
  2⤵
  PID:9812
- C:\Windows\System\LLtLlht.exe
  C:\Windows\System\LLtLlht.exe
  2⤵
  PID:9828
- C:\Windows\System\CHblcAZ.exe
  C:\Windows\System\CHblcAZ.exe
  2⤵
  PID:9844
- C:\Windows\System\WXPRzRS.exe
  C:\Windows\System\WXPRzRS.exe
  2⤵
  PID:9860
- C:\Windows\System\icxxVBR.exe
  C:\Windows\System\icxxVBR.exe
  2⤵
  PID:9876
- C:\Windows\System\CxHpXLh.exe
  C:\Windows\System\CxHpXLh.exe
  2⤵
  PID:9892
- C:\Windows\System\fZLNoRB.exe
  C:\Windows\System\fZLNoRB.exe
  2⤵
  PID:9908
- C:\Windows\System\DqtZEmu.exe
  C:\Windows\System\DqtZEmu.exe
  2⤵
  PID:9924
- C:\Windows\System\xyxTytN.exe
  C:\Windows\System\xyxTytN.exe
  2⤵
  PID:9940
- C:\Windows\System\ACgSGPR.exe
  C:\Windows\System\ACgSGPR.exe
  2⤵
  PID:9956
- C:\Windows\System\jIxrnYU.exe
  C:\Windows\System\jIxrnYU.exe
  2⤵
  PID:9972
- C:\Windows\System\ifNqcek.exe
  C:\Windows\System\ifNqcek.exe
  2⤵
  PID:9988
- C:\Windows\System\jNTFBzj.exe
  C:\Windows\System\jNTFBzj.exe
  2⤵
  PID:10004
- C:\Windows\System\KMBRaJk.exe
  C:\Windows\System\KMBRaJk.exe
  2⤵
  PID:10020
- C:\Windows\System\ppcxwjl.exe
  C:\Windows\System\ppcxwjl.exe
  2⤵
  PID:10036
- C:\Windows\System\iqRHUYS.exe
  C:\Windows\System\iqRHUYS.exe
  2⤵
  PID:10052
- C:\Windows\System\MxEImDI.exe
  C:\Windows\System\MxEImDI.exe
  2⤵
  PID:10068
- C:\Windows\System\bheHxzJ.exe
  C:\Windows\System\bheHxzJ.exe
  2⤵
  PID:10084
- C:\Windows\System\evhEFVS.exe
  C:\Windows\System\evhEFVS.exe
  2⤵
  PID:10100
- C:\Windows\System\WiPAVIW.exe
  C:\Windows\System\WiPAVIW.exe
  2⤵
  PID:10116
- C:\Windows\System\KiHmoPz.exe
  C:\Windows\System\KiHmoPz.exe
  2⤵
  PID:10132
- C:\Windows\System\pgensGS.exe
  C:\Windows\System\pgensGS.exe
  2⤵
  PID:10148
- C:\Windows\System\bmzyGNB.exe
  C:\Windows\System\bmzyGNB.exe
  2⤵
  PID:10164
- C:\Windows\System\MasaEuj.exe
  C:\Windows\System\MasaEuj.exe
  2⤵
  PID:10180
- C:\Windows\System\ARdhqhK.exe
  C:\Windows\System\ARdhqhK.exe
  2⤵
  PID:10196
- C:\Windows\System\jcaXxuK.exe
  C:\Windows\System\jcaXxuK.exe
  2⤵
  PID:10212
- C:\Windows\System\RKAIqEu.exe
  C:\Windows\System\RKAIqEu.exe
  2⤵
  PID:10228
- C:\Windows\System\oazUWxX.exe
  C:\Windows\System\oazUWxX.exe
  2⤵
  PID:8264
- C:\Windows\System\rFGEwEv.exe
  C:\Windows\System\rFGEwEv.exe
  2⤵
  PID:9276
- C:\Windows\System\LQTtNLV.exe
  C:\Windows\System\LQTtNLV.exe
  2⤵
  PID:9336
- C:\Windows\System\TaDiHkm.exe
  C:\Windows\System\TaDiHkm.exe
  2⤵
  PID:9368
- C:\Windows\System\jPGFSgQ.exe
  C:\Windows\System\jPGFSgQ.exe
  2⤵
  PID:9288
- C:\Windows\System\rFQhvBv.exe
  C:\Windows\System\rFQhvBv.exe
  2⤵
  PID:9352
- C:\Windows\System\yyIVDnZ.exe
  C:\Windows\System\yyIVDnZ.exe
  2⤵
  PID:9356
- C:\Windows\System\AVDtHAU.exe
  C:\Windows\System\AVDtHAU.exe
  2⤵
  PID:9404
- C:\Windows\System\nUhvExg.exe
  C:\Windows\System\nUhvExg.exe
  2⤵
  PID:9468
- C:\Windows\System\nrdfGXJ.exe
  C:\Windows\System\nrdfGXJ.exe
  2⤵
  PID:9420
- C:\Windows\System\FTCuKNf.exe
  C:\Windows\System\FTCuKNf.exe
  2⤵
  PID:9504
- C:\Windows\System\OWxxnYc.exe
  C:\Windows\System\OWxxnYc.exe
  2⤵
  PID:9536
- C:\Windows\System\tHGnqir.exe
  C:\Windows\System\tHGnqir.exe
  2⤵
  PID:9552
- C:\Windows\System\IeWbrvt.exe
  C:\Windows\System\IeWbrvt.exe
  2⤵
  PID:9600
- C:\Windows\System\tPARqQX.exe
  C:\Windows\System\tPARqQX.exe
  2⤵
  PID:9632
- C:\Windows\System\nnqcVze.exe
  C:\Windows\System\nnqcVze.exe
  2⤵
  PID:9696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CymeMGX.exe

Filesize
2.2MB

MD5
7d3d4bf73786af30d452f2981e4e746c

SHA1
4605580c0f478acb545e3977e82d4bf7f7af6d4c

SHA256
567e594c12bbc30aca4a2e0cc01f8392238d376b1811f0f38b5a658b04b8a26b

SHA512
ae05d002aa59c580950c7b6e6a2e2b78fd2e511e848c7a58f420e8a5564f9cde251a8375175d6c11cfd50501290d5f95e94fb58fa3e5ebc3c2ca2fdf07afcd79

Download Submit
C:\Windows\system\DqRHenN.exe

Filesize
2.2MB

MD5
e37c1691be0138ba77055181422e7983

SHA1
33ce12cc8cedb6c01739faabf0d4264064142c38

SHA256
6e4c1f03ffe4b494854ff3178210706cf17206f9a7aa6b501d20fa680ff1de95

SHA512
f5f8d94fe2a4d1b08e5d782270a580bf371b5b66b0fc5011ee104e9990c8b90635dc634d297206861e7e621fe210a41084fc4a97bdb218cb42fdeecfdb89450a

Download Submit
C:\Windows\system\EVVUIRz.exe

Filesize
2.2MB

MD5
c026509d8d49e133018dca71a36cf9a1

SHA1
bbd80bcf1c86d4ca6f5e9dc45741bdd74ca5d5f7

SHA256
53692f21512ae82687ee2aefdced3e7ddec59cf15109e4fa0363881471b77119

SHA512
02d88b5819bfef5b9e6d3eacc5ce801737909d90366647919988ab2293eb8ade726b7c61b2151b3ae8a00cb7140dad4c342b660bb355b24ee8c9d18b0a1c1380

Download Submit
C:\Windows\system\FglqEPV.exe

Filesize
2.2MB

MD5
95d918f73d36458997261b68a398a901

SHA1
b15278c1050caa341fc19d8d5d75fe42b51fa967

SHA256
7c4f52ab6a0c6329028de1c4ee9dcdd433a45aee31da841cd953cd7b9a1c9bfe

SHA512
3693322dfd2d6c7feb741fedf77f44e5acda9b4fb146a61592b7bab8ee2f14107f96e35b0707f6427990b510cd4a74cbbb67fa758d51da838f43ade59175cceb

Download Submit
C:\Windows\system\JjyRANp.exe

Filesize
2.2MB

MD5
5b65d8bcf56c5721033c131ebf1e2f2d

SHA1
e453843ca675a9e008704706fec0e118ac58acf4

SHA256
245f8aad8b18815c16154312d1849b3bdc9730e59f48cfe1ece4ff05adaeb171

SHA512
c9f929703e59a8549f7d7ee74276d4ec5033296a6e6204b72e7fd0b84336040b3753eb61e37a98ae946e95ba0681875e3e61e33d706ddb089b010629aebbfc0b

Download Submit
C:\Windows\system\KcjvGDk.exe

Filesize
2.2MB

MD5
fcfdf1194e3ad0b502307ee313e829a3

SHA1
6a22a72fbe3497596b05c2b5798554fc2f6b9d4f

SHA256
1ca239cdf061057757ede29c51b5e7c767c05865f34eb38aeae3bd86b75d60f5

SHA512
6524fd39d58f46e63dfd052fff5cb0ec7e4ca996027f081b1e3423af4e3965567bc4a6e6035f2680686a29e684cbbb46a9e740e0b6882ddde1bf37253454bca4

Download Submit
C:\Windows\system\MjuTsPC.exe

Filesize
2.2MB

MD5
ad26a1b4f24a81a70420e0f0a6268e92

SHA1
f01b86bd1a497c7801bc693dced98cf01c8e7b54

SHA256
12e18298566cded44a0ea4f8f0b6bd5429d2886fc90ac50bcd5c50eb9d31e625

SHA512
402b40664a8886aa7e61a07345b924991b2af238a590229424c24dd732e7e3ad857a5902565715e3e217b96ab16009291357b931f8f7d1a503c994813fcdb0eb

Download Submit
C:\Windows\system\OjhSFwm.exe

Filesize
2.2MB

MD5
09f6431918aef52c8b6f859b9e6a98d2

SHA1
d7706716497cf3affb32dee3baf3ebe252f07287

SHA256
bd6b0a43900d1afb59baa1e6c25d8e449b9fd7ecbb19217fe517732f745eb046

SHA512
8a7a4706f62a558f6fa5ba164597ee365c3ff28ae2408e290baa960da97d79a385ad9380a3a13a303e7de531a6f9c28472b0af8d05fe319216bd3fd8ffed6285

Download Submit
C:\Windows\system\QVDuzuL.exe

Filesize
2.2MB

MD5
170ac33b69738653826bdc774e3addf8

SHA1
0a57d0b70c2fdcc87f464ad5a26acb403089386c

SHA256
8591c21e9b35b6bf1f3459240fcc6346f370691a4c22c0f712fcc327ebdc7d06

SHA512
033e1807ce424e63735841f87128079db4309baad307dec1191af26f5af823894b87f94dc7a7f0341eee81e7219d1583c9844f7b983d984601885b05f401fe26

Download Submit
C:\Windows\system\RSXHLlk.exe

Filesize
2.2MB

MD5
5ac6f93b76397f093728cf12d2c6a408

SHA1
66c60193d9b95feaa2bf02fade978a34add5cc86

SHA256
0c6d0b4f4f9b1e38df080319786976e53e6cb9a3c8af7e7986a10a2f96e9619c

SHA512
9681ef2f8d5c7179d25282ff4587e1d01d847903f898101e0b94ee74f074a6915725e5fd2b402c46398928bec69e7b6ab5497b84cbb669b5185900878c82887a

Download Submit
C:\Windows\system\SNobaJI.exe

Filesize
2.2MB

MD5
7c97b7e3f06891d5cee6d82409e4eedb

SHA1
2fe609eb77d85fdbf3191e90d98d7397bdca2bf1

SHA256
78bd0c85e7f9a4148ca41c4a6b7133a5b0a1152f27e12654e2d51b360719cc3d

SHA512
eb0e814644d4bd050bc442de324604b802b08db5ac0a772491afc9ec7cd5208934a2c84cb6aba78be613a19a66cba0a4d57d52e1e8adc95ee837a26ef77da4e6

Download Submit
C:\Windows\system\UilQgvH.exe

Filesize
2.2MB

MD5
bf87dea081aae0545509a3f655ed8f40

SHA1
68a5ab41ca17102f903946de3cb68ae9d72d4675

SHA256
cd671dd95fcc47c204b81aaf35d2863f64d9ebe672719ad5ad0411bfa772f113

SHA512
96949e2644dab0fe2a0f4856fccd2f061adf182f30d06e01fce8718aa05709c0efbe63df5432c1ad16a9b6379c87c980403447537aee8ea520b0f10c1d2b00d6

Download Submit
C:\Windows\system\WEozruB.exe

Filesize
2.2MB

MD5
5114c2ba1d8836d669724af1c84b1164

SHA1
5087ffcce6497526bb873ee4ba796498fdb79669

SHA256
3cb59d9990b0b4c03cef93158dfdcaf7bc3b99075a655dfe8f6774137f73f15e

SHA512
bd80db194e66db9c97f54b5c663cb999f0f8929e4f8687164fa4e713ebfb13e56dc1e11cca0c8be6f086d49ae80dc5d44d7976f9f05eb0370810e46e18031ae9

Download Submit
C:\Windows\system\ZxCkwiC.exe

Filesize
2.2MB

MD5
88adc754b8eebabdf1782f5f0001c734

SHA1
b6377f80f6f9c0288c8957c790d58db32e27fbfe

SHA256
17db5b328c05375596fa12efd904037d3f31661c0fd0f09ef367b43284cb0e16

SHA512
c52e992a749011db30aa9ac54987b9f5231ea426ed5dfe0c3487c797fada20deee873815e0c80ce3521aea5407ee08e40bb3cd88a10682d354fe0a145828eba1

Download Submit
C:\Windows\system\buuAFJZ.exe

Filesize
2.2MB

MD5
d766b00714233696e5ee05f91b6ad5e1

SHA1
449f5a8ac2a64fd3d7353f1abed68b4ce40c6276

SHA256
4e7ed24d7b21ee8b5bdefd4181916501a9d37d145f2e643a909a6983ffa2eacd

SHA512
38cb8a7360d696ba959d84d6347f7d4ad4b1edc4bf090efff7aab1dd3e9caaa82ac44137353a73aaa61ec83b7113c096428235382d52a7449d0f420aba03c3fe

Download Submit
C:\Windows\system\jMZdwoG.exe

Filesize
2.2MB

MD5
21d77da854b3b9a13032c805d5874b08

SHA1
0e51fc2fb8b308bd6e49d34054bfc94400aa0766

SHA256
392531a0ee44c24aed3f565af201f176f2a5ada2a775794aa65ec8e710c93d52

SHA512
fa80e0dca60e9da6e76970b55eb41bd38b321ce97f3d046cd7765da84a4ac50b2fc466e7b8319b4b9ecd9be3e8e1e8a2978ebe1d50aea7a1379e680cca77b63b

Download Submit
C:\Windows\system\jWrmCRR.exe

Filesize
2.2MB

MD5
9f1a3b867b9623ca3ede6f899fb5a54d

SHA1
eb12b4b53516759bb88c81d1da20daa0ba74b418

SHA256
b082aaa7338412ecb91534b86ae0a4c1bbbd0f3e4014686e05548e27eab91475

SHA512
c6fdb78a9533bd82ae6d599a287a613e55f0ac6fdb99192c774ab8bb165ba432b5afec2a32fdea9de01a00aa300c445c4bdd113b24869d2f58c6e471e177c698

Download Submit
C:\Windows\system\mqjpGGF.exe

Filesize
2.2MB

MD5
b91ca9e3a7726d9727e23212a522c9c5

SHA1
0cd0d49c0cd7d413499f46318bcc2e0d4ead5ff8

SHA256
ad4c693856aa53ebfa88f41fb7027366f48b122b17b56bad5195fcf151bee5c7

SHA512
e8adcdce01939fa85b29eed2372fdc056c52a7ff070e6123c91994ee08701ae1f422f423d4f5119bf88941ebec50b5c11f69e447310f0d4e52769febf0b5e0c8

Download Submit
C:\Windows\system\nMKIdKF.exe

Filesize
2.2MB

MD5
55cdec8021e3515a00496f3b43b9942e

SHA1
4c0dc0311874a0eaf4c79c79c820082438957c7d

SHA256
2ccac62a4eafc6848c55a61743b15fe6cfe5f4b8349e48b1649f3222055ba1e3

SHA512
5d9f3b676d8c179e5a449dacefbfa3d0712344f381892c979e391ad076ecb0ffbbde69b7736673c71c4b6e0d12cb8845d00ae8281022773d01a966bcd3831e90

Download Submit
C:\Windows\system\oSwKWLE.exe

Filesize
2.2MB

MD5
30d01d6b921fd777a8cfd4e193b46113

SHA1
ab1fcd7ab1cbe2fdbd8af2ad0b9060bf9eb851a8

SHA256
656f8caf47cafa0f268c64129706ef3a3f9723bce9814b1601ce61f5cff87d6d

SHA512
9021c80f55d27a6f7fee95b12c5ddf1b132da116b36bed383c98467ca71aac29e41e4631d06ef36676ddcdafd30b5998702a15b47fc4af6451312ee50febc3d7

Download Submit
C:\Windows\system\tixvImV.exe

Filesize
2.2MB

MD5
b97e3b17dd3ddef0afe95d52c9f75539

SHA1
d185ebbb78365a1942bcc2b19fb5f3bc5d7cc8c7

SHA256
044fbfce555c4bc31056b96912fdba9fd8d16222a4d1d872791d927581e17cca

SHA512
96bc933f799ed12bb4c90023be4c31263a018d990ae9a66fb2edd37f8733872fa1bae37ce8b9e7184b98954fa383d00d19d5ec53703cddff93628388e63d6e01

Download Submit
C:\Windows\system\unxHWtC.exe

Filesize
2.2MB

MD5
2c738860ea23247aa61fba458b931acc

SHA1
d0bb46b214f40cfb580e6448e8c715c8424e3b1b

SHA256
6d23142a524a73dec20974ac81cfb7e2b0461eb9ae1d77e04efd0db161929544

SHA512
3a42b5c0b70c479bbae683e00bbc9d5dc2db0d7bf70a45a24cce73b22be1fe2fd64c4a14ff40eceba3067a7a8705976a156de28290ccf847b25c9c5c057d6ec6

Download Submit
C:\Windows\system\vuIrkgc.exe

Filesize
2.2MB

MD5
762e26f7c7902f6ed3dc35a8435dbc0a

SHA1
b202a3e3b0ada727afc23fc13e61399b48428219

SHA256
d15d881392b65b8ba3832a409a484437c7fda49705d67d61ef3ef920226b7c47

SHA512
0c6b083384273f6c18efc2682fddd8cee829f8e658b9631b1cd9c4400fcdb8f3b547489f3db39d12f38045fe4bde335e3b06aabae33e14f84c0ac447c5ad521d

Download Submit
C:\Windows\system\wuxcplb.exe

Filesize
2.2MB

MD5
47b5a7fb87f92caa7194db863a3ad438

SHA1
8f9e47c1c6d7f77f9ffcb4536cb27f04ab2518ad

SHA256
9125f2aca03c8ae6ae6ea935ff3bfd490de8daaa9b3cbea88308002c5f0cbf85

SHA512
588a8e0e00086855dd375629c25eef7e04b96b94206fe045d412869aa3d8d05b703f932bcfee6bd265d9e00c431a3a5a0dd4925e4cc7bbdc3330b47d29ad6961

Download Submit
C:\Windows\system\xQKrcHn.exe

Filesize
2.2MB

MD5
8d618fce80de1c7a0ccef72ed0448d85

SHA1
f60d0e08395b0407a9849d06f7c9104062bb816c

SHA256
cdebdf31d8da331dd16c30da94be0ed319c33f045cfe3407965a3d0c54e9fda7

SHA512
6ca9b53d8e98467c6d1318e69651a411e4c278bd554569a48f0df47b02476d88eb476e14c77d7c7c64fe85abfc303961c29740f7d66f072ed3d2079dffeaf2c6

Download Submit
C:\Windows\system\zJyKLUS.exe

Filesize
2.2MB

MD5
173468d4d19119fe313d736134dba156

SHA1
b6e6215a02b1b5c17b727c269b9b6dc245c1cfc2

SHA256
ebf497d286828bbde6424f1a961bf66a555f23a42d293250e3f69eae26d4b6af

SHA512
8a963c864a6293bf12448946fd23f6d71b39a3688734527ef9f1adfbf4c0bcb10e2f8d788628e7ee20f40b2c868180c767f93a7c8a7cec25ab23a2a5dac845a3

Download Submit
C:\Windows\system\zeGFqmI.exe

Filesize
18B

MD5
0f74d26e324b3e4ca82621930feb3f71

SHA1
51c6fa90586c9009cc733bd2843df60120221d7c

SHA256
fd7091421895dbcf3ff7ed5b13b38b3963999338b6384ef6aea7e3d35f76533b

SHA512
4138922aed63819f2a910844c95c594cb337f1a54724135c8e61e94f0fb0e215db86c537da9be91f8c7625d109830aca6217c6d58a22b0f4be237d3c65bc9b67

Download Submit
C:\Windows\system\zoewMjP.exe

Filesize
2.2MB

MD5
384e1f9be3abbf52cec13f02e1ab45e6

SHA1
4bdc4cac2a6cbcd70589fd8744568bfeddcdb08e

SHA256
4aeda7ffa6fd05e7d09a7c17a4d70580363186efdd20a0271d137bfe958e8714

SHA512
e9dfef0e564fa5da07f8de6e16dab86b8678f48b1ac67b7662c34217bd9a462c2836bc9080d7f13e298f9f81a012f6c61f90be1903148986a2aa322ac7eaef77

Download Submit
\Windows\system\SorrTDl.exe

Filesize
2.2MB

MD5
8bfbc0e96aedb93e1a77507b5893b9ee

SHA1
2bf3859870183fc1de64003d425c4835e1ceafd6

SHA256
d9b8155997ef0b2c524dfa37af8320c6a5cde4bb120c11aa8e96cacea4f46b4e

SHA512
51cb3e99f6531b050a49185d8b5e7d60b17c58b3ea2da36dbcea513757c15723390eb9b1f50b673a5c5cca6f3a3c51f8a3b98f31d3f8cfa298732a815506f648

Download Submit
\Windows\system\WyPQOKW.exe

Filesize
2.2MB

MD5
d8e7777e560b78c59145551d6b814c5d

SHA1
0cf1ddedc784d649e44c9d312ac771223e58fe45

SHA256
60052316a8a9227c6ae0875c20cce422a8829c3f2ac5a5cb65ae0b6e14620670

SHA512
946a2715a0fe323f5230669bb484699f72d1fee841b398170b53bf1782f4e5f3def7c9654ed4194392b9a35ad37d77493802d798b0685592319a352e6ac0844c

Download Submit
\Windows\system\hezldac.exe

Filesize
2.2MB

MD5
224049122d75d2864f6e1c218b11bf75

SHA1
ffec6f1741dc8f9f52741713170f77934cb0e196

SHA256
21990456252bb22409c1f6e9f95503ec4d5c09080820e709a555e9f79d3d4715

SHA512
143ef9d7ef1e960461b63306c8ae88330066642383bdcec3f5fd3d2241810de11cc3e3d674aaf266c3ac15e7636faf3f36e873bd89d5ff49ac4d1adb76fe52ac

Download Submit
\Windows\system\lJSpUqe.exe

Filesize
2.2MB

MD5
d9f2a925f51382bbd52f79c42374c2fa

SHA1
b69e635f7e6f2c0a37709874a61c3bd75d21a1e5

SHA256
2c51708663672621d369e298d3adeabafb0ba30d0a7f45144ff2ce66072a6dde

SHA512
31ffe7991b604f208a35dcc48b9d4f8bcedb316b0ed12bae370ef4b9f7cf6a9e1a685aa0c1a43713035a320477a53e578a63e9bf5d04974501f0c0fb354d7613

Download Submit
\Windows\system\qVqVvIJ.exe

Filesize
2.2MB

MD5
32f13492cb8f1a7ad483870b0574c1b3

SHA1
0849e5b9498f971b1bb7143a52804d75d9697086

SHA256
f06286b3de77f69d4bea49a3f324973751d5b11e2160a3344112974ad295a8f2

SHA512
1ff322f04da11b59def7601cda7686602962582e2b76d506b3f352a7ffad08cdfe90e61043234aafb99d870854a1c78588e071cfc064ac527335aa5a302acb2e

Download Submit
\Windows\system\wAebuqM.exe

Filesize
2.2MB

MD5
9cb16a0147c8708d6a7d89362b375e3e

SHA1
11c5540d3fbddab72284255912f9aa26b1f79534

SHA256
6ca6527b7ac8b743b9d95fc5c517a0bec363882109a1dc94b684ede3bd295628

SHA512
57ac0b122d8b16d31916ec72bd49ed6c885df4bd985f2ab14ab0773da875a804752c21da0de97a495eac6f8b84e6c017a317cea295eb9cf26415fd54d24b3120

Download Submit
memory/712-85-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2052-81-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2476-47-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-21-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2564-1114-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2564-8-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2600-43-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-15-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2684-88-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2704-38-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2732-95-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2788-99-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/2888-80-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2908-76-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/2908-68-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2924-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2924-19-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2924-414-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2924-86-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2924-79-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2924-96-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2924-98-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2924-36-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2924-45-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-91-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-40-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-13-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2924-83-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-1113-0x0000000002E60000-0x0000000003252000-memory.dmp

Filesize
3.9MB

Download
memory/2924-7-0x0000000002E60000-0x0000000003252000-memory.dmp

Filesize
3.9MB

Download
memory/2924-1-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download