xmrig | e06d6481c5e2811c20ec9f7a8f12e317785354d5b441c31b275f4ebc881d198d

Analysis

max time kernel
28s
max time network
27s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
Size

1.9MB
MD5

073780e99cce775f06742ce7037b1f93
SHA1

130d5672f44e4a03cfd5fe789544f5ff8a384deb
SHA256

e06d6481c5e2811c20ec9f7a8f12e317785354d5b441c31b275f4ebc881d198d
SHA512

63fa843d36d49d31f1534eea769c5abd62c0620e4026f394500bf0a0e018c6e9f527ffbcb5552e448b7cdcd1bb490f412d084f107d5918d54db12c91170f9473
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UAm:NABG

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/3060-13-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2796-52-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2512-69-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/2556-65-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	xmrig
behavioral1/memory/2672-64-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/2428-63-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2764-60-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2508-58-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	xmrig
behavioral1/memory/3060-1879-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2856-1876-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3060	pXTldKU.exe
2796	wvDxmYt.exe
2508	PodGeqS.exe
2764	dXksKVi.exe
2428	sWMQbZI.exe
2672	NUruPrQ.exe
2556	DmgkROb.exe
2512	rXqDNsR.exe
1472	zbznOlb.exe
2576	YDwybCC.exe
2628	QTqmeki.exe
1584	ZGWBJUO.exe
1972	weuLqei.exe
1884	eGmrPNx.exe
2168	gomrawf.exe
356	TlOIQSd.exe
1880	mXoCzYx.exe
2120	PnAHpJI.exe
2288	UWuIkDZ.exe
2732	bKkECNP.exe
1272	oWIcGun.exe
2912	gAjpBLy.exe
2072	XGibRAz.exe
1924	SJRGqTK.exe
2184	QNQgAdu.exe
3040	XGlWqda.exe
2024	TtikmMF.exe
664	jFnFVRy.exe
1920	ANjmamj.exe
1672	JlnuGeI.exe
2964	Rexysmj.exe
2352	fjJYFKB.exe
1464	bsFOLnv.exe
2060	EXVjnSX.exe
1752	dbSBRMn.exe
3008	xLmdExG.exe
1316	pIUCvKh.exe
2268	CUfJwte.exe
1616	OcfMBTn.exe
1264	iWJSrpo.exe
2348	KjGBIdI.exe
904	xddsPvH.exe
2236	IlipuDk.exe
2264	VsgCsSJ.exe
1180	igrFRnC.exe
1344	soWhQbF.exe
1676	PntPDGZ.exe
1500	iOvBFEI.exe
2920	BeWTLzG.exe
1528	zdqUOnM.exe
2660	WnkiZAK.exe
1196	amJowXG.exe
1536	JnpUDFW.exe
2464	KZXwStT.exe
1840	Vrehwsh.exe
2496	PDCtneK.exe
2460	oGMCxQm.exe
2644	RTLhToB.exe
2380	RcgJWyK.exe
1876	uIMnzCu.exe
2908	lKIHRLM.exe
1248	zcnYpEH.exe
1608	mwLyqIE.exe
2604	kzRDxZw.exe

Loads dropped DLL 64 IoCs

pid	Process
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2856-0-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/files/0x000a000000014f57-3.dat	upx
behavioral1/memory/3060-13-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/files/0x0034000000015662-15.dat	upx
behavioral1/files/0x0016000000005586-19.dat	upx
behavioral1/files/0x0007000000015ca8-27.dat	upx
behavioral1/files/0x0007000000015cc5-41.dat	upx
behavioral1/files/0x0008000000015c9a-40.dat	upx
behavioral1/files/0x0007000000015cb1-43.dat	upx
behavioral1/files/0x0009000000015ce3-46.dat	upx
behavioral1/memory/2796-52-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/files/0x0008000000016122-70.dat	upx
behavioral1/memory/2512-69-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/files/0x00060000000163eb-73.dat	upx
behavioral1/files/0x00060000000164ec-85.dat	upx
behavioral1/files/0x00060000000167bf-91.dat	upx
behavioral1/memory/1472-82-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/files/0x0006000000016c38-111.dat	upx
behavioral1/files/0x0006000000016c84-125.dat	upx
behavioral1/files/0x00340000000158d9-120.dat	upx
behavioral1/files/0x0006000000016d06-155.dat	upx
behavioral1/files/0x0006000000016d18-166.dat	upx
behavioral1/files/0x0006000000016da9-192.dat	upx
behavioral1/files/0x0006000000016d85-189.dat	upx
behavioral1/files/0x0006000000016d31-182.dat	upx
behavioral1/files/0x0006000000016d81-185.dat	upx
behavioral1/files/0x0006000000016d29-176.dat	upx
behavioral1/files/0x0006000000016d21-171.dat	upx
behavioral1/files/0x0006000000016d10-162.dat	upx
behavioral1/files/0x0006000000016cfd-152.dat	upx
behavioral1/files/0x0006000000016ced-142.dat	upx
behavioral1/files/0x0006000000016cf3-146.dat	upx
behavioral1/files/0x0006000000016cb5-131.dat	upx
behavioral1/files/0x0006000000016c30-119.dat	upx
behavioral1/files/0x0006000000016ce0-135.dat	upx
behavioral1/files/0x0006000000016a28-117.dat	upx
behavioral1/files/0x0006000000016575-106.dat	upx
behavioral1/files/0x0006000000016c1f-100.dat	upx
behavioral1/memory/2556-65-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/memory/2672-64-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/2428-63-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2764-60-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/2508-58-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	upx
behavioral1/memory/3060-1879-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2856-1876-0x000000013FE70000-0x0000000140262000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mXoCzYx.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\PntPDGZ.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\nJqCQDU.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\oFPMxYN.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\OfIJxuC.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\vYgyutk.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\zxnfrzV.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\UNxIUQQ.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\bcAXiAj.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\KxlbDmC.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\jENcIDv.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\pXTldKU.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\ukZhNXG.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\EeuUvtM.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\Wcourdh.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\wAGmCsR.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\iWAtIYp.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\OtmajsI.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\VuYIKFj.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\uRaCKGr.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\qOwUpDQ.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\kIESqFn.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\LNauViT.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\agIZAmV.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\LfnkLMV.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\WpoDVbC.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\Nrxtwzf.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\aKCQieA.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\kNNJlOT.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\zBkNnnI.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\kqZjQiY.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\MuuDRzT.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\hIgZqUk.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\GGkGQbC.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\XGibRAz.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\NjvxAgE.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\OWyamXj.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\kZiXdQh.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\OrtgOnv.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\SmUnTqE.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\TUKbyXZ.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\UKsvQhu.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\XHwSmiN.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\PjIkpzY.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\yVcXHSM.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\IdATcHG.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\lLdxjbQ.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\ttzNwLB.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\YOSUzAL.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\UtdYSSU.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\WkRdmuC.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\AtGUrTX.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\QqZttpI.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\dYcFCuM.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\amJowXG.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\QqPuCNi.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\RhPRLLW.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\inHESIU.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\GEwxzxU.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\CdlJAqH.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\RvAdMrW.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\JZvIGIl.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\xwTSHCp.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
File created	C:\Windows\System\syFNoOE.exe	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2956	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
Token: SeDebugPrivilege	2956	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2956	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	29
PID 2856 wrote to memory of 2956	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	29
PID 2856 wrote to memory of 2956	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	29
PID 2856 wrote to memory of 3060	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	30
PID 2856 wrote to memory of 3060	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	30
PID 2856 wrote to memory of 3060	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	30
PID 2856 wrote to memory of 2796	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	31
PID 2856 wrote to memory of 2796	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	31
PID 2856 wrote to memory of 2796	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	31
PID 2856 wrote to memory of 2508	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	32
PID 2856 wrote to memory of 2508	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	32
PID 2856 wrote to memory of 2508	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	32
PID 2856 wrote to memory of 2428	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	33
PID 2856 wrote to memory of 2428	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	33
PID 2856 wrote to memory of 2428	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	33
PID 2856 wrote to memory of 2764	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	34
PID 2856 wrote to memory of 2764	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	34
PID 2856 wrote to memory of 2764	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	34
PID 2856 wrote to memory of 2556	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	35
PID 2856 wrote to memory of 2556	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	35
PID 2856 wrote to memory of 2556	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	35
PID 2856 wrote to memory of 2672	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	36
PID 2856 wrote to memory of 2672	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	36
PID 2856 wrote to memory of 2672	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	36
PID 2856 wrote to memory of 2512	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	37
PID 2856 wrote to memory of 2512	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	37
PID 2856 wrote to memory of 2512	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	37
PID 2856 wrote to memory of 1472	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	38
PID 2856 wrote to memory of 1472	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	38
PID 2856 wrote to memory of 1472	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	38
PID 2856 wrote to memory of 2576	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	39
PID 2856 wrote to memory of 2576	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	39
PID 2856 wrote to memory of 2576	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	39
PID 2856 wrote to memory of 2628	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	40
PID 2856 wrote to memory of 2628	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	40
PID 2856 wrote to memory of 2628	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	40
PID 2856 wrote to memory of 1884	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	41
PID 2856 wrote to memory of 1884	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	41
PID 2856 wrote to memory of 1884	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	41
PID 2856 wrote to memory of 1584	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	42
PID 2856 wrote to memory of 1584	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	42
PID 2856 wrote to memory of 1584	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	42
PID 2856 wrote to memory of 356	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	43
PID 2856 wrote to memory of 356	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	43
PID 2856 wrote to memory of 356	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	43
PID 2856 wrote to memory of 1972	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	44
PID 2856 wrote to memory of 1972	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	44
PID 2856 wrote to memory of 1972	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	44
PID 2856 wrote to memory of 1880	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	45
PID 2856 wrote to memory of 1880	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	45
PID 2856 wrote to memory of 1880	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	45
PID 2856 wrote to memory of 2168	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	46
PID 2856 wrote to memory of 2168	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	46
PID 2856 wrote to memory of 2168	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	46
PID 2856 wrote to memory of 2120	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	47
PID 2856 wrote to memory of 2120	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	47
PID 2856 wrote to memory of 2120	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	47
PID 2856 wrote to memory of 2288	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	48
PID 2856 wrote to memory of 2288	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	48
PID 2856 wrote to memory of 2288	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	48
PID 2856 wrote to memory of 2732	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	49
PID 2856 wrote to memory of 2732	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	49
PID 2856 wrote to memory of 2732	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	49
PID 2856 wrote to memory of 1272	2856	073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\073780e99cce775f06742ce7037b1f93_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Windows\System\pXTldKU.exe
  C:\Windows\System\pXTldKU.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\wvDxmYt.exe
  C:\Windows\System\wvDxmYt.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\PodGeqS.exe
  C:\Windows\System\PodGeqS.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\sWMQbZI.exe
  C:\Windows\System\sWMQbZI.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\dXksKVi.exe
  C:\Windows\System\dXksKVi.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\DmgkROb.exe
  C:\Windows\System\DmgkROb.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\NUruPrQ.exe
  C:\Windows\System\NUruPrQ.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\rXqDNsR.exe
  C:\Windows\System\rXqDNsR.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\zbznOlb.exe
  C:\Windows\System\zbznOlb.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\YDwybCC.exe
  C:\Windows\System\YDwybCC.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\QTqmeki.exe
  C:\Windows\System\QTqmeki.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\eGmrPNx.exe
  C:\Windows\System\eGmrPNx.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\ZGWBJUO.exe
  C:\Windows\System\ZGWBJUO.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\TlOIQSd.exe
  C:\Windows\System\TlOIQSd.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\weuLqei.exe
  C:\Windows\System\weuLqei.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\mXoCzYx.exe
  C:\Windows\System\mXoCzYx.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\gomrawf.exe
  C:\Windows\System\gomrawf.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\PnAHpJI.exe
  C:\Windows\System\PnAHpJI.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\UWuIkDZ.exe
  C:\Windows\System\UWuIkDZ.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\bKkECNP.exe
  C:\Windows\System\bKkECNP.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\oWIcGun.exe
  C:\Windows\System\oWIcGun.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\gAjpBLy.exe
  C:\Windows\System\gAjpBLy.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\XGibRAz.exe
  C:\Windows\System\XGibRAz.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\SJRGqTK.exe
  C:\Windows\System\SJRGqTK.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\QNQgAdu.exe
  C:\Windows\System\QNQgAdu.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\XGlWqda.exe
  C:\Windows\System\XGlWqda.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\TtikmMF.exe
  C:\Windows\System\TtikmMF.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\jFnFVRy.exe
  C:\Windows\System\jFnFVRy.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\ANjmamj.exe
  C:\Windows\System\ANjmamj.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\JlnuGeI.exe
  C:\Windows\System\JlnuGeI.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\Rexysmj.exe
  C:\Windows\System\Rexysmj.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\bsFOLnv.exe
  C:\Windows\System\bsFOLnv.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\fjJYFKB.exe
  C:\Windows\System\fjJYFKB.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\pIUCvKh.exe
  C:\Windows\System\pIUCvKh.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\EXVjnSX.exe
  C:\Windows\System\EXVjnSX.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\KjGBIdI.exe
  C:\Windows\System\KjGBIdI.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\dbSBRMn.exe
  C:\Windows\System\dbSBRMn.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\xddsPvH.exe
  C:\Windows\System\xddsPvH.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\xLmdExG.exe
  C:\Windows\System\xLmdExG.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\IlipuDk.exe
  C:\Windows\System\IlipuDk.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\CUfJwte.exe
  C:\Windows\System\CUfJwte.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\VsgCsSJ.exe
  C:\Windows\System\VsgCsSJ.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\OcfMBTn.exe
  C:\Windows\System\OcfMBTn.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\igrFRnC.exe
  C:\Windows\System\igrFRnC.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\iWJSrpo.exe
  C:\Windows\System\iWJSrpo.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\soWhQbF.exe
  C:\Windows\System\soWhQbF.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\PntPDGZ.exe
  C:\Windows\System\PntPDGZ.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\BeWTLzG.exe
  C:\Windows\System\BeWTLzG.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\iOvBFEI.exe
  C:\Windows\System\iOvBFEI.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\zdqUOnM.exe
  C:\Windows\System\zdqUOnM.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\WnkiZAK.exe
  C:\Windows\System\WnkiZAK.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\amJowXG.exe
  C:\Windows\System\amJowXG.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\JnpUDFW.exe
  C:\Windows\System\JnpUDFW.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\KZXwStT.exe
  C:\Windows\System\KZXwStT.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\Vrehwsh.exe
  C:\Windows\System\Vrehwsh.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\PDCtneK.exe
  C:\Windows\System\PDCtneK.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\oGMCxQm.exe
  C:\Windows\System\oGMCxQm.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\RTLhToB.exe
  C:\Windows\System\RTLhToB.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\RcgJWyK.exe
  C:\Windows\System\RcgJWyK.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\uIMnzCu.exe
  C:\Windows\System\uIMnzCu.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\lKIHRLM.exe
  C:\Windows\System\lKIHRLM.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\kzRDxZw.exe
  C:\Windows\System\kzRDxZw.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\zcnYpEH.exe
  C:\Windows\System\zcnYpEH.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\vEaCUll.exe
  C:\Windows\System\vEaCUll.exe
  2⤵
  PID:2180
- C:\Windows\System\mwLyqIE.exe
  C:\Windows\System\mwLyqIE.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\NLsYFit.exe
  C:\Windows\System\NLsYFit.exe
  2⤵
  PID:1096
- C:\Windows\System\phJNxkg.exe
  C:\Windows\System\phJNxkg.exe
  2⤵
  PID:2864
- C:\Windows\System\slTARsd.exe
  C:\Windows\System\slTARsd.exe
  2⤵
  PID:2892
- C:\Windows\System\kBqhsXQ.exe
  C:\Windows\System\kBqhsXQ.exe
  2⤵
  PID:2480
- C:\Windows\System\Xsaipja.exe
  C:\Windows\System\Xsaipja.exe
  2⤵
  PID:268
- C:\Windows\System\sMDuRVP.exe
  C:\Windows\System\sMDuRVP.exe
  2⤵
  PID:2432
- C:\Windows\System\nzUKhmy.exe
  C:\Windows\System\nzUKhmy.exe
  2⤵
  PID:916
- C:\Windows\System\nrMtmdm.exe
  C:\Windows\System\nrMtmdm.exe
  2⤵
  PID:708
- C:\Windows\System\kpUUahs.exe
  C:\Windows\System\kpUUahs.exe
  2⤵
  PID:2980
- C:\Windows\System\DKyDliX.exe
  C:\Windows\System\DKyDliX.exe
  2⤵
  PID:624
- C:\Windows\System\QenYjSa.exe
  C:\Windows\System\QenYjSa.exe
  2⤵
  PID:2824
- C:\Windows\System\MgsXrau.exe
  C:\Windows\System\MgsXrau.exe
  2⤵
  PID:1912
- C:\Windows\System\StXaibq.exe
  C:\Windows\System\StXaibq.exe
  2⤵
  PID:2300
- C:\Windows\System\QKtzWMa.exe
  C:\Windows\System\QKtzWMa.exe
  2⤵
  PID:1792
- C:\Windows\System\dqgWFcQ.exe
  C:\Windows\System\dqgWFcQ.exe
  2⤵
  PID:1208
- C:\Windows\System\WeqbgWf.exe
  C:\Windows\System\WeqbgWf.exe
  2⤵
  PID:2172
- C:\Windows\System\eHGEqpS.exe
  C:\Windows\System\eHGEqpS.exe
  2⤵
  PID:2064
- C:\Windows\System\KpUnqJG.exe
  C:\Windows\System\KpUnqJG.exe
  2⤵
  PID:560
- C:\Windows\System\GMgltOa.exe
  C:\Windows\System\GMgltOa.exe
  2⤵
  PID:1640
- C:\Windows\System\DoSPxCO.exe
  C:\Windows\System\DoSPxCO.exe
  2⤵
  PID:1996
- C:\Windows\System\RYRfWjZ.exe
  C:\Windows\System\RYRfWjZ.exe
  2⤵
  PID:1644
- C:\Windows\System\gUHcNLw.exe
  C:\Windows\System\gUHcNLw.exe
  2⤵
  PID:2804
- C:\Windows\System\AlvkgPp.exe
  C:\Windows\System\AlvkgPp.exe
  2⤵
  PID:2656
- C:\Windows\System\WbKeSeG.exe
  C:\Windows\System\WbKeSeG.exe
  2⤵
  PID:2436
- C:\Windows\System\mtPLYDu.exe
  C:\Windows\System\mtPLYDu.exe
  2⤵
  PID:2708
- C:\Windows\System\xIvBAGI.exe
  C:\Windows\System\xIvBAGI.exe
  2⤵
  PID:1988
- C:\Windows\System\ubNWHaO.exe
  C:\Windows\System\ubNWHaO.exe
  2⤵
  PID:2916
- C:\Windows\System\csOXSmo.exe
  C:\Windows\System\csOXSmo.exe
  2⤵
  PID:2504
- C:\Windows\System\GIKJTpf.exe
  C:\Windows\System\GIKJTpf.exe
  2⤵
  PID:2160
- C:\Windows\System\WbAdlcI.exe
  C:\Windows\System\WbAdlcI.exe
  2⤵
  PID:860
- C:\Windows\System\SqFTqcC.exe
  C:\Windows\System\SqFTqcC.exe
  2⤵
  PID:1796
- C:\Windows\System\tpXOvJY.exe
  C:\Windows\System\tpXOvJY.exe
  2⤵
  PID:2276
- C:\Windows\System\fdVAwOa.exe
  C:\Windows\System\fdVAwOa.exe
  2⤵
  PID:2400
- C:\Windows\System\jFcEvSd.exe
  C:\Windows\System\jFcEvSd.exe
  2⤵
  PID:2724
- C:\Windows\System\ayLdzxV.exe
  C:\Windows\System\ayLdzxV.exe
  2⤵
  PID:1488
- C:\Windows\System\XttuDrM.exe
  C:\Windows\System\XttuDrM.exe
  2⤵
  PID:844
- C:\Windows\System\FUevbxx.exe
  C:\Windows\System\FUevbxx.exe
  2⤵
  PID:1836
- C:\Windows\System\ShiENHH.exe
  C:\Windows\System\ShiENHH.exe
  2⤵
  PID:2112
- C:\Windows\System\EeHnnDC.exe
  C:\Windows\System\EeHnnDC.exe
  2⤵
  PID:1292
- C:\Windows\System\ZiEWDIy.exe
  C:\Windows\System\ZiEWDIy.exe
  2⤵
  PID:2948
- C:\Windows\System\pmpUKBV.exe
  C:\Windows\System\pmpUKBV.exe
  2⤵
  PID:2816
- C:\Windows\System\AJcWBtC.exe
  C:\Windows\System\AJcWBtC.exe
  2⤵
  PID:1428
- C:\Windows\System\wjgkECB.exe
  C:\Windows\System\wjgkECB.exe
  2⤵
  PID:2540
- C:\Windows\System\iWiCHRt.exe
  C:\Windows\System\iWiCHRt.exe
  2⤵
  PID:1648
- C:\Windows\System\crkTVEg.exe
  C:\Windows\System\crkTVEg.exe
  2⤵
  PID:3088
- C:\Windows\System\LInAXKE.exe
  C:\Windows\System\LInAXKE.exe
  2⤵
  PID:3104
- C:\Windows\System\CFLziTD.exe
  C:\Windows\System\CFLziTD.exe
  2⤵
  PID:3120
- C:\Windows\System\UseKQkI.exe
  C:\Windows\System\UseKQkI.exe
  2⤵
  PID:3136
- C:\Windows\System\jibXFyO.exe
  C:\Windows\System\jibXFyO.exe
  2⤵
  PID:3164
- C:\Windows\System\xDdLdEb.exe
  C:\Windows\System\xDdLdEb.exe
  2⤵
  PID:3184
- C:\Windows\System\pMMevtd.exe
  C:\Windows\System\pMMevtd.exe
  2⤵
  PID:3200
- C:\Windows\System\nYEnJtf.exe
  C:\Windows\System\nYEnJtf.exe
  2⤵
  PID:3216
- C:\Windows\System\TSAyobK.exe
  C:\Windows\System\TSAyobK.exe
  2⤵
  PID:3252
- C:\Windows\System\wHspAXn.exe
  C:\Windows\System\wHspAXn.exe
  2⤵
  PID:3304
- C:\Windows\System\JZvIGIl.exe
  C:\Windows\System\JZvIGIl.exe
  2⤵
  PID:3320
- C:\Windows\System\oiicLFI.exe
  C:\Windows\System\oiicLFI.exe
  2⤵
  PID:3336
- C:\Windows\System\LNauViT.exe
  C:\Windows\System\LNauViT.exe
  2⤵
  PID:3352
- C:\Windows\System\iLvyoQj.exe
  C:\Windows\System\iLvyoQj.exe
  2⤵
  PID:3372
- C:\Windows\System\nlyUsKu.exe
  C:\Windows\System\nlyUsKu.exe
  2⤵
  PID:3388
- C:\Windows\System\GCuazym.exe
  C:\Windows\System\GCuazym.exe
  2⤵
  PID:3408
- C:\Windows\System\agIZAmV.exe
  C:\Windows\System\agIZAmV.exe
  2⤵
  PID:3452
- C:\Windows\System\suAwGXL.exe
  C:\Windows\System\suAwGXL.exe
  2⤵
  PID:3472
- C:\Windows\System\BaqXEvC.exe
  C:\Windows\System\BaqXEvC.exe
  2⤵
  PID:3500
- C:\Windows\System\LmTsYhH.exe
  C:\Windows\System\LmTsYhH.exe
  2⤵
  PID:3516
- C:\Windows\System\sSgYQIr.exe
  C:\Windows\System\sSgYQIr.exe
  2⤵
  PID:3532
- C:\Windows\System\FluwTem.exe
  C:\Windows\System\FluwTem.exe
  2⤵
  PID:3572
- C:\Windows\System\sYiayGc.exe
  C:\Windows\System\sYiayGc.exe
  2⤵
  PID:3664
- C:\Windows\System\hvrDdbX.exe
  C:\Windows\System\hvrDdbX.exe
  2⤵
  PID:3680
- C:\Windows\System\bwsqGiI.exe
  C:\Windows\System\bwsqGiI.exe
  2⤵
  PID:3700
- C:\Windows\System\TxwkgDJ.exe
  C:\Windows\System\TxwkgDJ.exe
  2⤵
  PID:3724
- C:\Windows\System\kqkakot.exe
  C:\Windows\System\kqkakot.exe
  2⤵
  PID:3744
- C:\Windows\System\zXpGIIr.exe
  C:\Windows\System\zXpGIIr.exe
  2⤵
  PID:3764
- C:\Windows\System\jCTWpgT.exe
  C:\Windows\System\jCTWpgT.exe
  2⤵
  PID:3788
- C:\Windows\System\IztEkJg.exe
  C:\Windows\System\IztEkJg.exe
  2⤵
  PID:3804
- C:\Windows\System\EjMfFlC.exe
  C:\Windows\System\EjMfFlC.exe
  2⤵
  PID:3824
- C:\Windows\System\JWsudCz.exe
  C:\Windows\System\JWsudCz.exe
  2⤵
  PID:3844
- C:\Windows\System\IuaPRQu.exe
  C:\Windows\System\IuaPRQu.exe
  2⤵
  PID:3864
- C:\Windows\System\IDVFHVU.exe
  C:\Windows\System\IDVFHVU.exe
  2⤵
  PID:3884
- C:\Windows\System\NMHZwpT.exe
  C:\Windows\System\NMHZwpT.exe
  2⤵
  PID:3900
- C:\Windows\System\UlDRUba.exe
  C:\Windows\System\UlDRUba.exe
  2⤵
  PID:3916
- C:\Windows\System\SeaaTut.exe
  C:\Windows\System\SeaaTut.exe
  2⤵
  PID:3944
- C:\Windows\System\WHoiAcD.exe
  C:\Windows\System\WHoiAcD.exe
  2⤵
  PID:3960
- C:\Windows\System\BeWodGY.exe
  C:\Windows\System\BeWodGY.exe
  2⤵
  PID:3988
- C:\Windows\System\ttzNwLB.exe
  C:\Windows\System\ttzNwLB.exe
  2⤵
  PID:4004
- C:\Windows\System\WBUulnY.exe
  C:\Windows\System\WBUulnY.exe
  2⤵
  PID:4020
- C:\Windows\System\tbJyvyf.exe
  C:\Windows\System\tbJyvyf.exe
  2⤵
  PID:4040
- C:\Windows\System\SobphDd.exe
  C:\Windows\System\SobphDd.exe
  2⤵
  PID:4064
- C:\Windows\System\sdAHOZN.exe
  C:\Windows\System\sdAHOZN.exe
  2⤵
  PID:4084
- C:\Windows\System\zSUJBFX.exe
  C:\Windows\System\zSUJBFX.exe
  2⤵
  PID:2360
- C:\Windows\System\cSnFeIM.exe
  C:\Windows\System\cSnFeIM.exe
  2⤵
  PID:2440
- C:\Windows\System\BHwBnif.exe
  C:\Windows\System\BHwBnif.exe
  2⤵
  PID:2444
- C:\Windows\System\HxjsSoC.exe
  C:\Windows\System\HxjsSoC.exe
  2⤵
  PID:2728
- C:\Windows\System\mnxWJKN.exe
  C:\Windows\System\mnxWJKN.exe
  2⤵
  PID:2936
- C:\Windows\System\flAuYRP.exe
  C:\Windows\System\flAuYRP.exe
  2⤵
  PID:960
- C:\Windows\System\nHrntyZ.exe
  C:\Windows\System\nHrntyZ.exe
  2⤵
  PID:3084
- C:\Windows\System\xbOxCcZ.exe
  C:\Windows\System\xbOxCcZ.exe
  2⤵
  PID:3156
- C:\Windows\System\umIlNkb.exe
  C:\Windows\System\umIlNkb.exe
  2⤵
  PID:2280
- C:\Windows\System\IjVtzEM.exe
  C:\Windows\System\IjVtzEM.exe
  2⤵
  PID:3232
- C:\Windows\System\WuBIlpz.exe
  C:\Windows\System\WuBIlpz.exe
  2⤵
  PID:3248
- C:\Windows\System\GfYIggl.exe
  C:\Windows\System\GfYIggl.exe
  2⤵
  PID:2424
- C:\Windows\System\BIOEFHy.exe
  C:\Windows\System\BIOEFHy.exe
  2⤵
  PID:3316
- C:\Windows\System\qEbCPBZ.exe
  C:\Windows\System\qEbCPBZ.exe
  2⤵
  PID:3384
- C:\Windows\System\zTWMYEd.exe
  C:\Windows\System\zTWMYEd.exe
  2⤵
  PID:3436
- C:\Windows\System\Ghmxbnt.exe
  C:\Windows\System\Ghmxbnt.exe
  2⤵
  PID:3480
- C:\Windows\System\Caaepui.exe
  C:\Windows\System\Caaepui.exe
  2⤵
  PID:3492
- C:\Windows\System\UKsvQhu.exe
  C:\Windows\System\UKsvQhu.exe
  2⤵
  PID:2760
- C:\Windows\System\rfquAVa.exe
  C:\Windows\System\rfquAVa.exe
  2⤵
  PID:1184
- C:\Windows\System\YSKPzzu.exe
  C:\Windows\System\YSKPzzu.exe
  2⤵
  PID:1424
- C:\Windows\System\EaXqrgl.exe
  C:\Windows\System\EaXqrgl.exe
  2⤵
  PID:2416
- C:\Windows\System\vBEqZVa.exe
  C:\Windows\System\vBEqZVa.exe
  2⤵
  PID:3172
- C:\Windows\System\OzzWcsk.exe
  C:\Windows\System\OzzWcsk.exe
  2⤵
  PID:2536
- C:\Windows\System\ukZhNXG.exe
  C:\Windows\System\ukZhNXG.exe
  2⤵
  PID:3592
- C:\Windows\System\gDPPgpZ.exe
  C:\Windows\System\gDPPgpZ.exe
  2⤵
  PID:2468
- C:\Windows\System\hrxUlCp.exe
  C:\Windows\System\hrxUlCp.exe
  2⤵
  PID:3608
- C:\Windows\System\kLousXW.exe
  C:\Windows\System\kLousXW.exe
  2⤵
  PID:3616
- C:\Windows\System\nJqCQDU.exe
  C:\Windows\System\nJqCQDU.exe
  2⤵
  PID:3540
- C:\Windows\System\UXNTEgI.exe
  C:\Windows\System\UXNTEgI.exe
  2⤵
  PID:3128
- C:\Windows\System\TAuzsNL.exe
  C:\Windows\System\TAuzsNL.exe
  2⤵
  PID:3208
- C:\Windows\System\oFPMxYN.exe
  C:\Windows\System\oFPMxYN.exe
  2⤵
  PID:2056
- C:\Windows\System\kfNsGQZ.exe
  C:\Windows\System\kfNsGQZ.exe
  2⤵
  PID:3276
- C:\Windows\System\meYLylW.exe
  C:\Windows\System\meYLylW.exe
  2⤵
  PID:3292
- C:\Windows\System\IscaCvV.exe
  C:\Windows\System\IscaCvV.exe
  2⤵
  PID:3332
- C:\Windows\System\wLpePll.exe
  C:\Windows\System\wLpePll.exe
  2⤵
  PID:3396
- C:\Windows\System\VNWhIyw.exe
  C:\Windows\System\VNWhIyw.exe
  2⤵
  PID:3464
- C:\Windows\System\cmoRhHk.exe
  C:\Windows\System\cmoRhHk.exe
  2⤵
  PID:3552
- C:\Windows\System\xJublem.exe
  C:\Windows\System\xJublem.exe
  2⤵
  PID:3568
- C:\Windows\System\EeuUvtM.exe
  C:\Windows\System\EeuUvtM.exe
  2⤵
  PID:340
- C:\Windows\System\HFdpMyg.exe
  C:\Windows\System\HFdpMyg.exe
  2⤵
  PID:3656
- C:\Windows\System\xtbYOER.exe
  C:\Windows\System\xtbYOER.exe
  2⤵
  PID:3696
- C:\Windows\System\zEHPsWq.exe
  C:\Windows\System\zEHPsWq.exe
  2⤵
  PID:2108
- C:\Windows\System\EpGJczG.exe
  C:\Windows\System\EpGJczG.exe
  2⤵
  PID:3732
- C:\Windows\System\LwzlXQu.exe
  C:\Windows\System\LwzlXQu.exe
  2⤵
  PID:1132
- C:\Windows\System\LlvVlNt.exe
  C:\Windows\System\LlvVlNt.exe
  2⤵
  PID:3752
- C:\Windows\System\deJFeYJ.exe
  C:\Windows\System\deJFeYJ.exe
  2⤵
  PID:3784
- C:\Windows\System\HQOlLcf.exe
  C:\Windows\System\HQOlLcf.exe
  2⤵
  PID:3812
- C:\Windows\System\vRzoUmL.exe
  C:\Windows\System\vRzoUmL.exe
  2⤵
  PID:3820
- C:\Windows\System\LahpjVq.exe
  C:\Windows\System\LahpjVq.exe
  2⤵
  PID:3852
- C:\Windows\System\jfmRHVC.exe
  C:\Windows\System\jfmRHVC.exe
  2⤵
  PID:3856
- C:\Windows\System\RWDPAPB.exe
  C:\Windows\System\RWDPAPB.exe
  2⤵
  PID:3876
- C:\Windows\System\LIkRSqt.exe
  C:\Windows\System\LIkRSqt.exe
  2⤵
  PID:3932
- C:\Windows\System\aAIdPjp.exe
  C:\Windows\System\aAIdPjp.exe
  2⤵
  PID:3912
- C:\Windows\System\UFtlVCy.exe
  C:\Windows\System\UFtlVCy.exe
  2⤵
  PID:2868
- C:\Windows\System\jqQBWiL.exe
  C:\Windows\System\jqQBWiL.exe
  2⤵
  PID:1784
- C:\Windows\System\FlQOJrs.exe
  C:\Windows\System\FlQOJrs.exe
  2⤵
  PID:1632
- C:\Windows\System\kgmrHUI.exe
  C:\Windows\System\kgmrHUI.exe
  2⤵
  PID:3972
- C:\Windows\System\HgIZRAq.exe
  C:\Windows\System\HgIZRAq.exe
  2⤵
  PID:4012
- C:\Windows\System\MWIVuFF.exe
  C:\Windows\System\MWIVuFF.exe
  2⤵
  PID:1604
- C:\Windows\System\jwmQaJI.exe
  C:\Windows\System\jwmQaJI.exe
  2⤵
  PID:4016
- C:\Windows\System\jHPstiB.exe
  C:\Windows\System\jHPstiB.exe
  2⤵
  PID:4032
- C:\Windows\System\xfgTjHJ.exe
  C:\Windows\System\xfgTjHJ.exe
  2⤵
  PID:1440
- C:\Windows\System\zqXHNtB.exe
  C:\Windows\System\zqXHNtB.exe
  2⤵
  PID:4080
- C:\Windows\System\mBnGMYL.exe
  C:\Windows\System\mBnGMYL.exe
  2⤵
  PID:1896
- C:\Windows\System\Jvzqmlg.exe
  C:\Windows\System\Jvzqmlg.exe
  2⤵
  PID:2688
- C:\Windows\System\VTqRgjU.exe
  C:\Windows\System\VTqRgjU.exe
  2⤵
  PID:2164
- C:\Windows\System\bwDGQVz.exe
  C:\Windows\System\bwDGQVz.exe
  2⤵
  PID:272
- C:\Windows\System\COrFxzI.exe
  C:\Windows\System\COrFxzI.exe
  2⤵
  PID:2520
- C:\Windows\System\dnhiUqB.exe
  C:\Windows\System\dnhiUqB.exe
  2⤵
  PID:2192
- C:\Windows\System\nREOIWx.exe
  C:\Windows\System\nREOIWx.exe
  2⤵
  PID:876
- C:\Windows\System\ZPEIQVJ.exe
  C:\Windows\System\ZPEIQVJ.exe
  2⤵
  PID:3116
- C:\Windows\System\lTSPDae.exe
  C:\Windows\System\lTSPDae.exe
  2⤵
  PID:3192
- C:\Windows\System\nWCrNyS.exe
  C:\Windows\System\nWCrNyS.exe
  2⤵
  PID:3228
- C:\Windows\System\qYJOOSL.exe
  C:\Windows\System\qYJOOSL.exe
  2⤵
  PID:2876
- C:\Windows\System\ZvLdQcB.exe
  C:\Windows\System\ZvLdQcB.exe
  2⤵
  PID:2772
- C:\Windows\System\ofAKhBH.exe
  C:\Windows\System\ofAKhBH.exe
  2⤵
  PID:2684
- C:\Windows\System\giYYJzK.exe
  C:\Windows\System\giYYJzK.exe
  2⤵
  PID:3420
- C:\Windows\System\KIFFflH.exe
  C:\Windows\System\KIFFflH.exe
  2⤵
  PID:1864
- C:\Windows\System\SvsKMaM.exe
  C:\Windows\System\SvsKMaM.exe
  2⤵
  PID:2008
- C:\Windows\System\YlgSacy.exe
  C:\Windows\System\YlgSacy.exe
  2⤵
  PID:1692
- C:\Windows\System\xxJpzHc.exe
  C:\Windows\System\xxJpzHc.exe
  2⤵
  PID:3180
- C:\Windows\System\VSukCRK.exe
  C:\Windows\System\VSukCRK.exe
  2⤵
  PID:4108
- C:\Windows\System\FQNCKDG.exe
  C:\Windows\System\FQNCKDG.exe
  2⤵
  PID:4128
- C:\Windows\System\LkhEiGL.exe
  C:\Windows\System\LkhEiGL.exe
  2⤵
  PID:4144
- C:\Windows\System\UHKADnJ.exe
  C:\Windows\System\UHKADnJ.exe
  2⤵
  PID:4164
- C:\Windows\System\eojPMDz.exe
  C:\Windows\System\eojPMDz.exe
  2⤵
  PID:4184
- C:\Windows\System\akdWxje.exe
  C:\Windows\System\akdWxje.exe
  2⤵
  PID:4392
- C:\Windows\System\jthPHUT.exe
  C:\Windows\System\jthPHUT.exe
  2⤵
  PID:4408
- C:\Windows\System\yymPGOZ.exe
  C:\Windows\System\yymPGOZ.exe
  2⤵
  PID:4436
- C:\Windows\System\HBQBoho.exe
  C:\Windows\System\HBQBoho.exe
  2⤵
  PID:4464
- C:\Windows\System\qjttujK.exe
  C:\Windows\System\qjttujK.exe
  2⤵
  PID:4508
- C:\Windows\System\ZQvAOeO.exe
  C:\Windows\System\ZQvAOeO.exe
  2⤵
  PID:4524
- C:\Windows\System\ceaSxgc.exe
  C:\Windows\System\ceaSxgc.exe
  2⤵
  PID:4540
- C:\Windows\System\FDRbfyD.exe
  C:\Windows\System\FDRbfyD.exe
  2⤵
  PID:4556
- C:\Windows\System\edSnfsJ.exe
  C:\Windows\System\edSnfsJ.exe
  2⤵
  PID:4572
- C:\Windows\System\raEWCWg.exe
  C:\Windows\System\raEWCWg.exe
  2⤵
  PID:4588
- C:\Windows\System\TOFBzSe.exe
  C:\Windows\System\TOFBzSe.exe
  2⤵
  PID:4604
- C:\Windows\System\wZYigvc.exe
  C:\Windows\System\wZYigvc.exe
  2⤵
  PID:4620
- C:\Windows\System\sWFCHEr.exe
  C:\Windows\System\sWFCHEr.exe
  2⤵
  PID:4636
- C:\Windows\System\qcRsRvn.exe
  C:\Windows\System\qcRsRvn.exe
  2⤵
  PID:4652
- C:\Windows\System\WpwErbF.exe
  C:\Windows\System\WpwErbF.exe
  2⤵
  PID:4668
- C:\Windows\System\VldDmkz.exe
  C:\Windows\System\VldDmkz.exe
  2⤵
  PID:4684
- C:\Windows\System\aaAZBJS.exe
  C:\Windows\System\aaAZBJS.exe
  2⤵
  PID:4704
- C:\Windows\System\HZewaOM.exe
  C:\Windows\System\HZewaOM.exe
  2⤵
  PID:4720
- C:\Windows\System\PKsbBtj.exe
  C:\Windows\System\PKsbBtj.exe
  2⤵
  PID:4736
- C:\Windows\System\mfOqtbB.exe
  C:\Windows\System\mfOqtbB.exe
  2⤵
  PID:4752
- C:\Windows\System\HyPDgTn.exe
  C:\Windows\System\HyPDgTn.exe
  2⤵
  PID:4768
- C:\Windows\System\UUdTfCC.exe
  C:\Windows\System\UUdTfCC.exe
  2⤵
  PID:4788
- C:\Windows\System\mfzphEw.exe
  C:\Windows\System\mfzphEw.exe
  2⤵
  PID:4804
- C:\Windows\System\TtnTVgA.exe
  C:\Windows\System\TtnTVgA.exe
  2⤵
  PID:4824
- C:\Windows\System\cyExNov.exe
  C:\Windows\System\cyExNov.exe
  2⤵
  PID:4840
- C:\Windows\System\inqwZnW.exe
  C:\Windows\System\inqwZnW.exe
  2⤵
  PID:4860
- C:\Windows\System\UFZnFvm.exe
  C:\Windows\System\UFZnFvm.exe
  2⤵
  PID:4876
- C:\Windows\System\DvGzdWl.exe
  C:\Windows\System\DvGzdWl.exe
  2⤵
  PID:4892
- C:\Windows\System\xZFuEIu.exe
  C:\Windows\System\xZFuEIu.exe
  2⤵
  PID:4908
- C:\Windows\System\fophjwn.exe
  C:\Windows\System\fophjwn.exe
  2⤵
  PID:4924
- C:\Windows\System\DfQGxGi.exe
  C:\Windows\System\DfQGxGi.exe
  2⤵
  PID:4940
- C:\Windows\System\vlmDOhJ.exe
  C:\Windows\System\vlmDOhJ.exe
  2⤵
  PID:4956
- C:\Windows\System\jqQZnOH.exe
  C:\Windows\System\jqQZnOH.exe
  2⤵
  PID:5032
- C:\Windows\System\CbSYYKA.exe
  C:\Windows\System\CbSYYKA.exe
  2⤵
  PID:5096
- C:\Windows\System\zBkNnnI.exe
  C:\Windows\System\zBkNnnI.exe
  2⤵
  PID:5112
- C:\Windows\System\aolcWxx.exe
  C:\Windows\System\aolcWxx.exe
  2⤵
  PID:3404
- C:\Windows\System\GvSBlbN.exe
  C:\Windows\System\GvSBlbN.exe
  2⤵
  PID:3496
- C:\Windows\System\cjEPPhh.exe
  C:\Windows\System\cjEPPhh.exe
  2⤵
  PID:3676
- C:\Windows\System\LfnkLMV.exe
  C:\Windows\System\LfnkLMV.exe
  2⤵
  PID:2364
- C:\Windows\System\pYrqsYB.exe
  C:\Windows\System\pYrqsYB.exe
  2⤵
  PID:2564
- C:\Windows\System\dnlxJgV.exe
  C:\Windows\System\dnlxJgV.exe
  2⤵
  PID:2152
- C:\Windows\System\DSvPUqM.exe
  C:\Windows\System\DSvPUqM.exe
  2⤵
  PID:2292
- C:\Windows\System\pjNIvzv.exe
  C:\Windows\System\pjNIvzv.exe
  2⤵
  PID:2528
- C:\Windows\System\EbzdlUc.exe
  C:\Windows\System\EbzdlUc.exe
  2⤵
  PID:896
- C:\Windows\System\lePOHLe.exe
  C:\Windows\System\lePOHLe.exe
  2⤵
  PID:1280
- C:\Windows\System\oOhqMWf.exe
  C:\Windows\System\oOhqMWf.exe
  2⤵
  PID:3348
- C:\Windows\System\RlGLKSo.exe
  C:\Windows\System\RlGLKSo.exe
  2⤵
  PID:3588
- C:\Windows\System\DVFTJxd.exe
  C:\Windows\System\DVFTJxd.exe
  2⤵
  PID:4136
- C:\Windows\System\drzxStO.exe
  C:\Windows\System\drzxStO.exe
  2⤵
  PID:4180
- C:\Windows\System\FEGPtQR.exe
  C:\Windows\System\FEGPtQR.exe
  2⤵
  PID:4092
- C:\Windows\System\KFGhxix.exe
  C:\Windows\System\KFGhxix.exe
  2⤵
  PID:4116
- C:\Windows\System\TYzzdxw.exe
  C:\Windows\System\TYzzdxw.exe
  2⤵
  PID:4196
- C:\Windows\System\xhyQAJB.exe
  C:\Windows\System\xhyQAJB.exe
  2⤵
  PID:2880
- C:\Windows\System\PLUACYh.exe
  C:\Windows\System\PLUACYh.exe
  2⤵
  PID:3264
- C:\Windows\System\rUGhCLF.exe
  C:\Windows\System\rUGhCLF.exe
  2⤵
  PID:3368
- C:\Windows\System\KZDLdMP.exe
  C:\Windows\System\KZDLdMP.exe
  2⤵
  PID:3548
- C:\Windows\System\oyxkQRo.exe
  C:\Windows\System\oyxkQRo.exe
  2⤵
  PID:3688
- C:\Windows\System\xWXuxJr.exe
  C:\Windows\System\xWXuxJr.exe
  2⤵
  PID:996
- C:\Windows\System\doOfVFK.exe
  C:\Windows\System\doOfVFK.exe
  2⤵
  PID:3880
- C:\Windows\System\cqDNInv.exe
  C:\Windows\System\cqDNInv.exe
  2⤵
  PID:348
- C:\Windows\System\LeYwiMx.exe
  C:\Windows\System\LeYwiMx.exe
  2⤵
  PID:3428
- C:\Windows\System\kaaGhuG.exe
  C:\Windows\System\kaaGhuG.exe
  2⤵
  PID:2932
- C:\Windows\System\nRGAlhQ.exe
  C:\Windows\System\nRGAlhQ.exe
  2⤵
  PID:4152
- C:\Windows\System\BoKTxoy.exe
  C:\Windows\System\BoKTxoy.exe
  2⤵
  PID:4200
- C:\Windows\System\xwTSHCp.exe
  C:\Windows\System\xwTSHCp.exe
  2⤵
  PID:4216
- C:\Windows\System\sfxGHxj.exe
  C:\Windows\System\sfxGHxj.exe
  2⤵
  PID:4252
- C:\Windows\System\qRrPcQt.exe
  C:\Windows\System\qRrPcQt.exe
  2⤵
  PID:4268
- C:\Windows\System\zLhabcv.exe
  C:\Windows\System\zLhabcv.exe
  2⤵
  PID:4284
- C:\Windows\System\QxKNebJ.exe
  C:\Windows\System\QxKNebJ.exe
  2⤵
  PID:4300
- C:\Windows\System\EyyXneN.exe
  C:\Windows\System\EyyXneN.exe
  2⤵
  PID:4316
- C:\Windows\System\QScPzYD.exe
  C:\Windows\System\QScPzYD.exe
  2⤵
  PID:4332
- C:\Windows\System\ODlNzOk.exe
  C:\Windows\System\ODlNzOk.exe
  2⤵
  PID:4372
- C:\Windows\System\ZMXHFiW.exe
  C:\Windows\System\ZMXHFiW.exe
  2⤵
  PID:4428
- C:\Windows\System\elsKZQG.exe
  C:\Windows\System\elsKZQG.exe
  2⤵
  PID:1548
- C:\Windows\System\CFUfPgC.exe
  C:\Windows\System\CFUfPgC.exe
  2⤵
  PID:2368
- C:\Windows\System\dtPHxkn.exe
  C:\Windows\System\dtPHxkn.exe
  2⤵
  PID:4488
- C:\Windows\System\DGlFheb.exe
  C:\Windows\System\DGlFheb.exe
  2⤵
  PID:4532
- C:\Windows\System\IOHfmFi.exe
  C:\Windows\System\IOHfmFi.exe
  2⤵
  PID:4596
- C:\Windows\System\XNxsYKC.exe
  C:\Windows\System\XNxsYKC.exe
  2⤵
  PID:4660
- C:\Windows\System\lugiRpf.exe
  C:\Windows\System\lugiRpf.exe
  2⤵
  PID:4728
- C:\Windows\System\xlRuvGZ.exe
  C:\Windows\System\xlRuvGZ.exe
  2⤵
  PID:4796
- C:\Windows\System\vSpZtci.exe
  C:\Windows\System\vSpZtci.exe
  2⤵
  PID:4868
- C:\Windows\System\GTgbqju.exe
  C:\Windows\System\GTgbqju.exe
  2⤵
  PID:4400
- C:\Windows\System\rUwdidC.exe
  C:\Windows\System\rUwdidC.exe
  2⤵
  PID:4580
- C:\Windows\System\WpoDVbC.exe
  C:\Windows\System\WpoDVbC.exe
  2⤵
  PID:4648
- C:\Windows\System\lsWpoGr.exe
  C:\Windows\System\lsWpoGr.exe
  2⤵
  PID:4812
- C:\Windows\System\dyXzzBW.exe
  C:\Windows\System\dyXzzBW.exe
  2⤵
  PID:4848
- C:\Windows\System\MpywZrt.exe
  C:\Windows\System\MpywZrt.exe
  2⤵
  PID:4948
- C:\Windows\System\qibFTSz.exe
  C:\Windows\System\qibFTSz.exe
  2⤵
  PID:4988
- C:\Windows\System\VLRHwzo.exe
  C:\Windows\System\VLRHwzo.exe
  2⤵
  PID:4936
- C:\Windows\System\vfkOCOb.exe
  C:\Windows\System\vfkOCOb.exe
  2⤵
  PID:1556
- C:\Windows\System\xqwgXJY.exe
  C:\Windows\System\xqwgXJY.exe
  2⤵
  PID:4980
- C:\Windows\System\wmRHPVK.exe
  C:\Windows\System\wmRHPVK.exe
  2⤵
  PID:2080
- C:\Windows\System\ZniYQCd.exe
  C:\Windows\System\ZniYQCd.exe
  2⤵
  PID:5024
- C:\Windows\System\EMkhakS.exe
  C:\Windows\System\EMkhakS.exe
  2⤵
  PID:5056
- C:\Windows\System\iNvnswk.exe
  C:\Windows\System\iNvnswk.exe
  2⤵
  PID:5072
- C:\Windows\System\cCCZcus.exe
  C:\Windows\System\cCCZcus.exe
  2⤵
  PID:5084
- C:\Windows\System\naxRNpz.exe
  C:\Windows\System\naxRNpz.exe
  2⤵
  PID:2488
- C:\Windows\System\IWYzfkY.exe
  C:\Windows\System\IWYzfkY.exe
  2⤵
  PID:3736
- C:\Windows\System\erWnTbw.exe
  C:\Windows\System\erWnTbw.exe
  2⤵
  PID:3068
- C:\Windows\System\IJuCOMW.exe
  C:\Windows\System\IJuCOMW.exe
  2⤵
  PID:2592
- C:\Windows\System\KlYettK.exe
  C:\Windows\System\KlYettK.exe
  2⤵
  PID:2204
- C:\Windows\System\TfDCeZQ.exe
  C:\Windows\System\TfDCeZQ.exe
  2⤵
  PID:3152
- C:\Windows\System\sGKobwI.exe
  C:\Windows\System\sGKobwI.exe
  2⤵
  PID:3240
- C:\Windows\System\pXRnVIT.exe
  C:\Windows\System\pXRnVIT.exe
  2⤵
  PID:1508
- C:\Windows\System\EIECxkr.exe
  C:\Windows\System\EIECxkr.exe
  2⤵
  PID:3364
- C:\Windows\System\buCZgZN.exe
  C:\Windows\System\buCZgZN.exe
  2⤵
  PID:2572
- C:\Windows\System\gjnqeKi.exe
  C:\Windows\System\gjnqeKi.exe
  2⤵
  PID:3580
- C:\Windows\System\HpkbEcQ.exe
  C:\Windows\System\HpkbEcQ.exe
  2⤵
  PID:3740
- C:\Windows\System\vKyrXHr.exe
  C:\Windows\System\vKyrXHr.exe
  2⤵
  PID:3260
- C:\Windows\System\EQjuVUy.exe
  C:\Windows\System\EQjuVUy.exe
  2⤵
  PID:3080
- C:\Windows\System\jLDHhHc.exe
  C:\Windows\System\jLDHhHc.exe
  2⤵
  PID:3488
- C:\Windows\System\jVFyArP.exe
  C:\Windows\System\jVFyArP.exe
  2⤵
  PID:4260
- C:\Windows\System\lFnFFkq.exe
  C:\Windows\System\lFnFFkq.exe
  2⤵
  PID:4324
- C:\Windows\System\rPSDdKY.exe
  C:\Windows\System\rPSDdKY.exe
  2⤵
  PID:4472
- C:\Windows\System\gLkAsSw.exe
  C:\Windows\System\gLkAsSw.exe
  2⤵
  PID:4564
- C:\Windows\System\TtdteuH.exe
  C:\Windows\System\TtdteuH.exe
  2⤵
  PID:4628
- C:\Windows\System\XuOyCMQ.exe
  C:\Windows\System\XuOyCMQ.exe
  2⤵
  PID:4760
- C:\Windows\System\WEkhVya.exe
  C:\Windows\System\WEkhVya.exe
  2⤵
  PID:4816
- C:\Windows\System\ZICSMDe.exe
  C:\Windows\System\ZICSMDe.exe
  2⤵
  PID:2640
- C:\Windows\System\bMwRMqo.exe
  C:\Windows\System\bMwRMqo.exe
  2⤵
  PID:4764
- C:\Windows\System\yBvszVt.exe
  C:\Windows\System\yBvszVt.exe
  2⤵
  PID:4776
- C:\Windows\System\bCPyWxx.exe
  C:\Windows\System\bCPyWxx.exe
  2⤵
  PID:4820
- C:\Windows\System\BMHDSap.exe
  C:\Windows\System\BMHDSap.exe
  2⤵
  PID:2872
- C:\Windows\System\IlgoLcK.exe
  C:\Windows\System\IlgoLcK.exe
  2⤵
  PID:4456
- C:\Windows\System\jrVDzjJ.exe
  C:\Windows\System\jrVDzjJ.exe
  2⤵
  PID:4992
- C:\Windows\System\asfWErl.exe
  C:\Windows\System\asfWErl.exe
  2⤵
  PID:5004
- C:\Windows\System\AlGQcgM.exe
  C:\Windows\System\AlGQcgM.exe
  2⤵
  PID:4984
- C:\Windows\System\RzefEnY.exe
  C:\Windows\System\RzefEnY.exe
  2⤵
  PID:5044
- C:\Windows\System\kiSwxtN.exe
  C:\Windows\System\kiSwxtN.exe
  2⤵
  PID:5040
- C:\Windows\System\IrXHlTd.exe
  C:\Windows\System\IrXHlTd.exe
  2⤵
  PID:1872
- C:\Windows\System\gspHaJj.exe
  C:\Windows\System\gspHaJj.exe
  2⤵
  PID:3780
- C:\Windows\System\OALYAum.exe
  C:\Windows\System\OALYAum.exe
  2⤵
  PID:3528
- C:\Windows\System\JQkrMzc.exe
  C:\Windows\System\JQkrMzc.exe
  2⤵
  PID:2100
- C:\Windows\System\reTSQSt.exe
  C:\Windows\System\reTSQSt.exe
  2⤵
  PID:4388
- C:\Windows\System\HLJORKB.exe
  C:\Windows\System\HLJORKB.exe
  2⤵
  PID:2544
- C:\Windows\System\dWjXXMI.exe
  C:\Windows\System\dWjXXMI.exe
  2⤵
  PID:2308
- C:\Windows\System\lydQdNq.exe
  C:\Windows\System\lydQdNq.exe
  2⤵
  PID:3612
- C:\Windows\System\CMCUMaL.exe
  C:\Windows\System\CMCUMaL.exe
  2⤵
  PID:3144
- C:\Windows\System\BoYbpCu.exe
  C:\Windows\System\BoYbpCu.exe
  2⤵
  PID:3508
- C:\Windows\System\rwGhNzu.exe
  C:\Windows\System\rwGhNzu.exe
  2⤵
  PID:3980
- C:\Windows\System\QqPuCNi.exe
  C:\Windows\System\QqPuCNi.exe
  2⤵
  PID:4444
- C:\Windows\System\MSXDRoI.exe
  C:\Windows\System\MSXDRoI.exe
  2⤵
  PID:2768
- C:\Windows\System\IwELRdd.exe
  C:\Windows\System\IwELRdd.exe
  2⤵
  PID:1980
- C:\Windows\System\dvoLRwo.exe
  C:\Windows\System\dvoLRwo.exe
  2⤵
  PID:2664
- C:\Windows\System\jRwQaiL.exe
  C:\Windows\System\jRwQaiL.exe
  2⤵
  PID:4312
- C:\Windows\System\nmrfcuG.exe
  C:\Windows\System\nmrfcuG.exe
  2⤵
  PID:4192
- C:\Windows\System\yFQQrYD.exe
  C:\Windows\System\yFQQrYD.exe
  2⤵
  PID:4296
- C:\Windows\System\glKKwZE.exe
  C:\Windows\System\glKKwZE.exe
  2⤵
  PID:4700
- C:\Windows\System\ZepfkWF.exe
  C:\Windows\System\ZepfkWF.exe
  2⤵
  PID:4548
- C:\Windows\System\nqQAjRa.exe
  C:\Windows\System\nqQAjRa.exe
  2⤵
  PID:4784
- C:\Windows\System\yalzntZ.exe
  C:\Windows\System\yalzntZ.exe
  2⤵
  PID:5016
- C:\Windows\System\SuSpUVQ.exe
  C:\Windows\System\SuSpUVQ.exe
  2⤵
  PID:5128
- C:\Windows\System\EIJYUvk.exe
  C:\Windows\System\EIJYUvk.exe
  2⤵
  PID:5144
- C:\Windows\System\kkWVXKM.exe
  C:\Windows\System\kkWVXKM.exe
  2⤵
  PID:5164
- C:\Windows\System\ZYNKBgA.exe
  C:\Windows\System\ZYNKBgA.exe
  2⤵
  PID:5180
- C:\Windows\System\rUxDvhJ.exe
  C:\Windows\System\rUxDvhJ.exe
  2⤵
  PID:5196
- C:\Windows\System\kqZjQiY.exe
  C:\Windows\System\kqZjQiY.exe
  2⤵
  PID:5212
- C:\Windows\System\xRtSUZs.exe
  C:\Windows\System\xRtSUZs.exe
  2⤵
  PID:5228
- C:\Windows\System\MuVhHKB.exe
  C:\Windows\System\MuVhHKB.exe
  2⤵
  PID:5244
- C:\Windows\System\LRPKBXW.exe
  C:\Windows\System\LRPKBXW.exe
  2⤵
  PID:5264
- C:\Windows\System\PNQPDfN.exe
  C:\Windows\System\PNQPDfN.exe
  2⤵
  PID:5280
- C:\Windows\System\PJHFzdl.exe
  C:\Windows\System\PJHFzdl.exe
  2⤵
  PID:5296
- C:\Windows\System\UqRjIvw.exe
  C:\Windows\System\UqRjIvw.exe
  2⤵
  PID:5312
- C:\Windows\System\hECeYUz.exe
  C:\Windows\System\hECeYUz.exe
  2⤵
  PID:5328
- C:\Windows\System\OWHlWHj.exe
  C:\Windows\System\OWHlWHj.exe
  2⤵
  PID:5348
- C:\Windows\System\Wcourdh.exe
  C:\Windows\System\Wcourdh.exe
  2⤵
  PID:5368
- C:\Windows\System\nCrLIrq.exe
  C:\Windows\System\nCrLIrq.exe
  2⤵
  PID:5384
- C:\Windows\System\WrApVNV.exe
  C:\Windows\System\WrApVNV.exe
  2⤵
  PID:5400
- C:\Windows\System\NfpzcwQ.exe
  C:\Windows\System\NfpzcwQ.exe
  2⤵
  PID:5416
- C:\Windows\System\aYRPsMB.exe
  C:\Windows\System\aYRPsMB.exe
  2⤵
  PID:5432
- C:\Windows\System\OtmajsI.exe
  C:\Windows\System\OtmajsI.exe
  2⤵
  PID:5448
- C:\Windows\System\MxxHalU.exe
  C:\Windows\System\MxxHalU.exe
  2⤵
  PID:5468
- C:\Windows\System\IYuhdtE.exe
  C:\Windows\System\IYuhdtE.exe
  2⤵
  PID:5484
- C:\Windows\System\SsVkduG.exe
  C:\Windows\System\SsVkduG.exe
  2⤵
  PID:5500
- C:\Windows\System\CNRtGFC.exe
  C:\Windows\System\CNRtGFC.exe
  2⤵
  PID:5516
- C:\Windows\System\OfSAyVJ.exe
  C:\Windows\System\OfSAyVJ.exe
  2⤵
  PID:5552
- C:\Windows\System\cwQWHnX.exe
  C:\Windows\System\cwQWHnX.exe
  2⤵
  PID:5572
- C:\Windows\System\REfhEoE.exe
  C:\Windows\System\REfhEoE.exe
  2⤵
  PID:5680
- C:\Windows\System\ASQyuMK.exe
  C:\Windows\System\ASQyuMK.exe
  2⤵
  PID:5696
- C:\Windows\System\alNYuSU.exe
  C:\Windows\System\alNYuSU.exe
  2⤵
  PID:5712
- C:\Windows\System\ygXgKMU.exe
  C:\Windows\System\ygXgKMU.exe
  2⤵
  PID:5728
- C:\Windows\System\sAwqNcu.exe
  C:\Windows\System\sAwqNcu.exe
  2⤵
  PID:5744
- C:\Windows\System\YsWclFD.exe
  C:\Windows\System\YsWclFD.exe
  2⤵
  PID:5760
- C:\Windows\System\wRGwHne.exe
  C:\Windows\System\wRGwHne.exe
  2⤵
  PID:5776
- C:\Windows\System\WAXXCcv.exe
  C:\Windows\System\WAXXCcv.exe
  2⤵
  PID:5792
- C:\Windows\System\mjapLCE.exe
  C:\Windows\System\mjapLCE.exe
  2⤵
  PID:5808
- C:\Windows\System\ftRRkOf.exe
  C:\Windows\System\ftRRkOf.exe
  2⤵
  PID:5824
- C:\Windows\System\BiYKGnm.exe
  C:\Windows\System\BiYKGnm.exe
  2⤵
  PID:5840
- C:\Windows\System\jrcZpSE.exe
  C:\Windows\System\jrcZpSE.exe
  2⤵
  PID:5856
- C:\Windows\System\wMYORbN.exe
  C:\Windows\System\wMYORbN.exe
  2⤵
  PID:5872
- C:\Windows\System\yvGzFcw.exe
  C:\Windows\System\yvGzFcw.exe
  2⤵
  PID:5888
- C:\Windows\System\PyFbEJo.exe
  C:\Windows\System\PyFbEJo.exe
  2⤵
  PID:5904
- C:\Windows\System\wHTUgxi.exe
  C:\Windows\System\wHTUgxi.exe
  2⤵
  PID:5920
- C:\Windows\System\wAdXPPn.exe
  C:\Windows\System\wAdXPPn.exe
  2⤵
  PID:5940
- C:\Windows\System\XEfdArw.exe
  C:\Windows\System\XEfdArw.exe
  2⤵
  PID:5956
- C:\Windows\System\fbFNfzG.exe
  C:\Windows\System\fbFNfzG.exe
  2⤵
  PID:5972
- C:\Windows\System\kNQehho.exe
  C:\Windows\System\kNQehho.exe
  2⤵
  PID:5988
- C:\Windows\System\GknLqkS.exe
  C:\Windows\System\GknLqkS.exe
  2⤵
  PID:6004
- C:\Windows\System\UNxIUQQ.exe
  C:\Windows\System\UNxIUQQ.exe
  2⤵
  PID:6020
- C:\Windows\System\bbRvcou.exe
  C:\Windows\System\bbRvcou.exe
  2⤵
  PID:6036
- C:\Windows\System\jzjkaNt.exe
  C:\Windows\System\jzjkaNt.exe
  2⤵
  PID:6056
- C:\Windows\System\sCnSQCt.exe
  C:\Windows\System\sCnSQCt.exe
  2⤵
  PID:6072
- C:\Windows\System\VuYIKFj.exe
  C:\Windows\System\VuYIKFj.exe
  2⤵
  PID:6088
- C:\Windows\System\mHwkqHH.exe
  C:\Windows\System\mHwkqHH.exe
  2⤵
  PID:6104
- C:\Windows\System\CGyuGJj.exe
  C:\Windows\System\CGyuGJj.exe
  2⤵
  PID:6128
- C:\Windows\System\gRVXBSu.exe
  C:\Windows\System\gRVXBSu.exe
  2⤵
  PID:5052
- C:\Windows\System\fjdunoa.exe
  C:\Windows\System\fjdunoa.exe
  2⤵
  PID:3564
- C:\Windows\System\zcyorvw.exe
  C:\Windows\System\zcyorvw.exe
  2⤵
  PID:4380
- C:\Windows\System\tkwSYXi.exe
  C:\Windows\System\tkwSYXi.exe
  2⤵
  PID:3832
- C:\Windows\System\GxITZrL.exe
  C:\Windows\System\GxITZrL.exe
  2⤵
  PID:2136
- C:\Windows\System\mRLMXsd.exe
  C:\Windows\System\mRLMXsd.exe
  2⤵
  PID:4212
- C:\Windows\System\vuoKJnd.exe
  C:\Windows\System\vuoKJnd.exe
  2⤵
  PID:4224
- C:\Windows\System\SjHpATb.exe
  C:\Windows\System\SjHpATb.exe
  2⤵
  PID:5136
- C:\Windows\System\ZfifYtN.exe
  C:\Windows\System\ZfifYtN.exe
  2⤵
  PID:5204
- C:\Windows\System\ywBsXig.exe
  C:\Windows\System\ywBsXig.exe
  2⤵
  PID:2884
- C:\Windows\System\kNnhZht.exe
  C:\Windows\System\kNnhZht.exe
  2⤵
  PID:4160
- C:\Windows\System\mmKPOFi.exe
  C:\Windows\System\mmKPOFi.exe
  2⤵
  PID:5048
- C:\Windows\System\GxqTkfq.exe
  C:\Windows\System\GxqTkfq.exe
  2⤵
  PID:4232
- C:\Windows\System\WlIweRt.exe
  C:\Windows\System\WlIweRt.exe
  2⤵
  PID:4340
- C:\Windows\System\eHyUovq.exe
  C:\Windows\System\eHyUovq.exe
  2⤵
  PID:5532
- C:\Windows\System\BDKbMXA.exe
  C:\Windows\System\BDKbMXA.exe
  2⤵
  PID:5008
- C:\Windows\System\lEWuoJW.exe
  C:\Windows\System\lEWuoJW.exe
  2⤵
  PID:4424
- C:\Windows\System\GxIWsnh.exe
  C:\Windows\System\GxIWsnh.exe
  2⤵
  PID:4856
- C:\Windows\System\gXvuVhQ.exe
  C:\Windows\System\gXvuVhQ.exe
  2⤵
  PID:5000
- C:\Windows\System\PmIIbzV.exe
  C:\Windows\System\PmIIbzV.exe
  2⤵
  PID:3652
- C:\Windows\System\rkZzxkL.exe
  C:\Windows\System\rkZzxkL.exe
  2⤵
  PID:3288
- C:\Windows\System\UjvqjHV.exe
  C:\Windows\System\UjvqjHV.exe
  2⤵
  PID:4664
- C:\Windows\System\iReQIkS.exe
  C:\Windows\System\iReQIkS.exe
  2⤵
  PID:5188
- C:\Windows\System\rPJMyua.exe
  C:\Windows\System\rPJMyua.exe
  2⤵
  PID:5540
- C:\Windows\System\NfCoycw.exe
  C:\Windows\System\NfCoycw.exe
  2⤵
  PID:5272
- C:\Windows\System\qyEEupq.exe
  C:\Windows\System\qyEEupq.exe
  2⤵
  PID:5304
- C:\Windows\System\xVqrwQL.exe
  C:\Windows\System\xVqrwQL.exe
  2⤵
  PID:5324
- C:\Windows\System\drPTIbt.exe
  C:\Windows\System\drPTIbt.exe
  2⤵
  PID:5580
- C:\Windows\System\WVTpjZI.exe
  C:\Windows\System\WVTpjZI.exe
  2⤵
  PID:5408
- C:\Windows\System\yvLfbwj.exe
  C:\Windows\System\yvLfbwj.exe
  2⤵
  PID:5508
- C:\Windows\System\hWntCkD.exe
  C:\Windows\System\hWntCkD.exe
  2⤵
  PID:5356
- C:\Windows\System\mtICXRN.exe
  C:\Windows\System\mtICXRN.exe
  2⤵
  PID:5496
- C:\Windows\System\MFoAcDt.exe
  C:\Windows\System\MFoAcDt.exe
  2⤵
  PID:5364
- C:\Windows\System\tVENcaG.exe
  C:\Windows\System\tVENcaG.exe
  2⤵
  PID:5424
- C:\Windows\System\zvtlHpL.exe
  C:\Windows\System\zvtlHpL.exe
  2⤵
  PID:1712
- C:\Windows\System\blucKGK.exe
  C:\Windows\System\blucKGK.exe
  2⤵
  PID:5480
- C:\Windows\System\YxkDXfZ.exe
  C:\Windows\System\YxkDXfZ.exe
  2⤵
  PID:5608
- C:\Windows\System\ZzSPMrQ.exe
  C:\Windows\System\ZzSPMrQ.exe
  2⤵
  PID:5632
- C:\Windows\System\cbGWYec.exe
  C:\Windows\System\cbGWYec.exe
  2⤵
  PID:5640
- C:\Windows\System\RtKShTl.exe
  C:\Windows\System\RtKShTl.exe
  2⤵
  PID:5660
- C:\Windows\System\mawGQBg.exe
  C:\Windows\System\mawGQBg.exe
  2⤵
  PID:5692
- C:\Windows\System\jUakwun.exe
  C:\Windows\System\jUakwun.exe
  2⤵
  PID:5756
- C:\Windows\System\uRaCKGr.exe
  C:\Windows\System\uRaCKGr.exe
  2⤵
  PID:5820
- C:\Windows\System\iRktHub.exe
  C:\Windows\System\iRktHub.exe
  2⤵
  PID:5880
- C:\Windows\System\MTvErjI.exe
  C:\Windows\System\MTvErjI.exe
  2⤵
  PID:5736
- C:\Windows\System\DuOWdYa.exe
  C:\Windows\System\DuOWdYa.exe
  2⤵
  PID:5916
- C:\Windows\System\OTpPihU.exe
  C:\Windows\System\OTpPihU.exe
  2⤵
  PID:5984
- C:\Windows\System\NGdmvpE.exe
  C:\Windows\System\NGdmvpE.exe
  2⤵
  PID:6012
- C:\Windows\System\LBhpYXj.exe
  C:\Windows\System\LBhpYXj.exe
  2⤵
  PID:6052
- C:\Windows\System\kqTJLir.exe
  C:\Windows\System\kqTJLir.exe
  2⤵
  PID:6120
- C:\Windows\System\KPuLYgZ.exe
  C:\Windows\System\KPuLYgZ.exe
  2⤵
  PID:4208
- C:\Windows\System\oguygDm.exe
  C:\Windows\System\oguygDm.exe
  2⤵
  PID:5172
- C:\Windows\System\xguznQt.exe
  C:\Windows\System\xguznQt.exe
  2⤵
  PID:5936
- C:\Windows\System\XHwSmiN.exe
  C:\Windows\System\XHwSmiN.exe
  2⤵
  PID:3380
- C:\Windows\System\YMozEII.exe
  C:\Windows\System\YMozEII.exe
  2⤵
  PID:5896
- C:\Windows\System\IgPttIE.exe
  C:\Windows\System\IgPttIE.exe
  2⤵
  PID:5836
- C:\Windows\System\JALGFpZ.exe
  C:\Windows\System\JALGFpZ.exe
  2⤵
  PID:5996
- C:\Windows\System\NALYRmp.exe
  C:\Windows\System\NALYRmp.exe
  2⤵
  PID:6096
- C:\Windows\System\TbGfJRV.exe
  C:\Windows\System\TbGfJRV.exe
  2⤵
  PID:3544
- C:\Windows\System\tCpvxsv.exe
  C:\Windows\System\tCpvxsv.exe
  2⤵
  PID:4360
- C:\Windows\System\YOSUzAL.exe
  C:\Windows\System\YOSUzAL.exe
  2⤵
  PID:5568
- C:\Windows\System\kYnNKOQ.exe
  C:\Windows\System\kYnNKOQ.exe
  2⤵
  PID:5320
- C:\Windows\System\gCCZtSz.exe
  C:\Windows\System\gCCZtSz.exe
  2⤵
  PID:5584
- C:\Windows\System\xdUVGXY.exe
  C:\Windows\System\xdUVGXY.exe
  2⤵
  PID:5628
- C:\Windows\System\oIQKSGm.exe
  C:\Windows\System\oIQKSGm.exe
  2⤵
  PID:5724
- C:\Windows\System\KIenOCG.exe
  C:\Windows\System\KIenOCG.exe
  2⤵
  PID:5124
- C:\Windows\System\zADWwrB.exe
  C:\Windows\System\zADWwrB.exe
  2⤵
  PID:5768
- C:\Windows\System\khIVAnp.exe
  C:\Windows\System\khIVAnp.exe
  2⤵
  PID:5772
- C:\Windows\System\THXYuwA.exe
  C:\Windows\System\THXYuwA.exe
  2⤵
  PID:4484
- C:\Windows\System\coNraeH.exe
  C:\Windows\System\coNraeH.exe
  2⤵
  PID:5832
- C:\Windows\System\MgfoDbA.exe
  C:\Windows\System\MgfoDbA.exe
  2⤵
  PID:5636
- C:\Windows\System\IIQIDOB.exe
  C:\Windows\System\IIQIDOB.exe
  2⤵
  PID:5672
- C:\Windows\System\TyIUzXL.exe
  C:\Windows\System\TyIUzXL.exe
  2⤵
  PID:5440
- C:\Windows\System\XAhDADh.exe
  C:\Windows\System\XAhDADh.exe
  2⤵
  PID:5392
- C:\Windows\System\rnLFGKn.exe
  C:\Windows\System\rnLFGKn.exe
  2⤵
  PID:5380
- C:\Windows\System\wpDEBfM.exe
  C:\Windows\System\wpDEBfM.exe
  2⤵
  PID:5912
- C:\Windows\System\iotCdyI.exe
  C:\Windows\System\iotCdyI.exe
  2⤵
  PID:6044
- C:\Windows\System\RhPRLLW.exe
  C:\Windows\System\RhPRLLW.exe
  2⤵
  PID:5964
- C:\Windows\System\JLLrzVd.exe
  C:\Windows\System\JLLrzVd.exe
  2⤵
  PID:6136
- C:\Windows\System\MEzTvVx.exe
  C:\Windows\System\MEzTvVx.exe
  2⤵
  PID:1212
- C:\Windows\System\hkYLZgJ.exe
  C:\Windows\System\hkYLZgJ.exe
  2⤵
  PID:3776
- C:\Windows\System\oJrkjjX.exe
  C:\Windows\System\oJrkjjX.exe
  2⤵
  PID:5460
- C:\Windows\System\OwNfVNT.exe
  C:\Windows\System\OwNfVNT.exe
  2⤵
  PID:4680
- C:\Windows\System\OcYvwrk.exe
  C:\Windows\System\OcYvwrk.exe
  2⤵
  PID:4228
- C:\Windows\System\JFFGcEN.exe
  C:\Windows\System\JFFGcEN.exe
  2⤵
  PID:1348
- C:\Windows\System\VkDSrJL.exe
  C:\Windows\System\VkDSrJL.exe
  2⤵
  PID:1568
- C:\Windows\System\PmXQuqg.exe
  C:\Windows\System\PmXQuqg.exe
  2⤵
  PID:5092
- C:\Windows\System\uadMyKU.exe
  C:\Windows\System\uadMyKU.exe
  2⤵
  PID:5156
- C:\Windows\System\rvhZKaz.exe
  C:\Windows\System\rvhZKaz.exe
  2⤵
  PID:5536
- C:\Windows\System\YAeIZup.exe
  C:\Windows\System\YAeIZup.exe
  2⤵
  PID:5560
- C:\Windows\System\mrvFKvG.exe
  C:\Windows\System\mrvFKvG.exe
  2⤵
  PID:776
- C:\Windows\System\UtdYSSU.exe
  C:\Windows\System\UtdYSSU.exe
  2⤵
  PID:5292
- C:\Windows\System\JNzLjyd.exe
  C:\Windows\System\JNzLjyd.exe
  2⤵
  PID:5852
- C:\Windows\System\fYbYHpa.exe
  C:\Windows\System\fYbYHpa.exe
  2⤵
  PID:6028
- C:\Windows\System\loOpcrQ.exe
  C:\Windows\System\loOpcrQ.exe
  2⤵
  PID:5376
- C:\Windows\System\ymxocFy.exe
  C:\Windows\System\ymxocFy.exe
  2⤵
  PID:5980
- C:\Windows\System\arrmjPO.exe
  C:\Windows\System\arrmjPO.exe
  2⤵
  PID:6140
- C:\Windows\System\POLjlJx.exe
  C:\Windows\System\POLjlJx.exe
  2⤵
  PID:5528
- C:\Windows\System\uPbnAaG.exe
  C:\Windows\System\uPbnAaG.exe
  2⤵
  PID:5708
- C:\Windows\System\deJVnTD.exe
  C:\Windows\System\deJVnTD.exe
  2⤵
  PID:5256
- C:\Windows\System\SkTJZfa.exe
  C:\Windows\System\SkTJZfa.exe
  2⤵
  PID:5252
- C:\Windows\System\bTjdaem.exe
  C:\Windows\System\bTjdaem.exe
  2⤵
  PID:5548
- C:\Windows\System\VWrxDEr.exe
  C:\Windows\System\VWrxDEr.exe
  2⤵
  PID:5676
- C:\Windows\System\DBwVsiG.exe
  C:\Windows\System\DBwVsiG.exe
  2⤵
  PID:5152
- C:\Windows\System\chUcLht.exe
  C:\Windows\System\chUcLht.exe
  2⤵
  PID:5788
- C:\Windows\System\RGjGYyt.exe
  C:\Windows\System\RGjGYyt.exe
  2⤵
  PID:5656
- C:\Windows\System\ilRsZOa.exe
  C:\Windows\System\ilRsZOa.exe
  2⤵
  PID:5864
- C:\Windows\System\aCelRoV.exe
  C:\Windows\System\aCelRoV.exe
  2⤵
  PID:6160
- C:\Windows\System\CabjYSR.exe
  C:\Windows\System\CabjYSR.exe
  2⤵
  PID:6180
- C:\Windows\System\lxuUWKN.exe
  C:\Windows\System\lxuUWKN.exe
  2⤵
  PID:6196
- C:\Windows\System\uKztcjx.exe
  C:\Windows\System\uKztcjx.exe
  2⤵
  PID:6212
- C:\Windows\System\kVMUYCx.exe
  C:\Windows\System\kVMUYCx.exe
  2⤵
  PID:6228
- C:\Windows\System\IUAlgmM.exe
  C:\Windows\System\IUAlgmM.exe
  2⤵
  PID:6244
- C:\Windows\System\JSxgaAh.exe
  C:\Windows\System\JSxgaAh.exe
  2⤵
  PID:6260
- C:\Windows\System\ngdoQIa.exe
  C:\Windows\System\ngdoQIa.exe
  2⤵
  PID:6276
- C:\Windows\System\TfsCrUw.exe
  C:\Windows\System\TfsCrUw.exe
  2⤵
  PID:6292
- C:\Windows\System\kjGrwCD.exe
  C:\Windows\System\kjGrwCD.exe
  2⤵
  PID:6308
- C:\Windows\System\tGPwbDT.exe
  C:\Windows\System\tGPwbDT.exe
  2⤵
  PID:6324
- C:\Windows\System\EqgAaRu.exe
  C:\Windows\System\EqgAaRu.exe
  2⤵
  PID:6340
- C:\Windows\System\ODpBRxt.exe
  C:\Windows\System\ODpBRxt.exe
  2⤵
  PID:6356
- C:\Windows\System\soTcihK.exe
  C:\Windows\System\soTcihK.exe
  2⤵
  PID:6372
- C:\Windows\System\xFdvfSq.exe
  C:\Windows\System\xFdvfSq.exe
  2⤵
  PID:6388
- C:\Windows\System\NaqQlfY.exe
  C:\Windows\System\NaqQlfY.exe
  2⤵
  PID:6408
- C:\Windows\System\iKHrKmr.exe
  C:\Windows\System\iKHrKmr.exe
  2⤵
  PID:6424
- C:\Windows\System\RGLaSyu.exe
  C:\Windows\System\RGLaSyu.exe
  2⤵
  PID:6444
- C:\Windows\System\kEYSJfJ.exe
  C:\Windows\System\kEYSJfJ.exe
  2⤵
  PID:6460
- C:\Windows\System\nHBUBge.exe
  C:\Windows\System\nHBUBge.exe
  2⤵
  PID:6476
- C:\Windows\System\OfIJxuC.exe
  C:\Windows\System\OfIJxuC.exe
  2⤵
  PID:6492
- C:\Windows\System\rBcrUyZ.exe
  C:\Windows\System\rBcrUyZ.exe
  2⤵
  PID:6508
- C:\Windows\System\gFYuXgk.exe
  C:\Windows\System\gFYuXgk.exe
  2⤵
  PID:6524
- C:\Windows\System\oYOYolK.exe
  C:\Windows\System\oYOYolK.exe
  2⤵
  PID:6540
- C:\Windows\System\KPhHqqN.exe
  C:\Windows\System\KPhHqqN.exe
  2⤵
  PID:6560
- C:\Windows\System\NkOcKXR.exe
  C:\Windows\System\NkOcKXR.exe
  2⤵
  PID:6576
- C:\Windows\System\riBnGcO.exe
  C:\Windows\System\riBnGcO.exe
  2⤵
  PID:6592
- C:\Windows\System\KvrNLzC.exe
  C:\Windows\System\KvrNLzC.exe
  2⤵
  PID:6608
- C:\Windows\System\dwjSOap.exe
  C:\Windows\System\dwjSOap.exe
  2⤵
  PID:6624
- C:\Windows\System\kxnDklX.exe
  C:\Windows\System\kxnDklX.exe
  2⤵
  PID:6644
- C:\Windows\System\jEysbeB.exe
  C:\Windows\System\jEysbeB.exe
  2⤵
  PID:6660
- C:\Windows\System\UIlibAC.exe
  C:\Windows\System\UIlibAC.exe
  2⤵
  PID:6676
- C:\Windows\System\JZFLjcf.exe
  C:\Windows\System\JZFLjcf.exe
  2⤵
  PID:6696
- C:\Windows\System\sLmmNxL.exe
  C:\Windows\System\sLmmNxL.exe
  2⤵
  PID:6712
- C:\Windows\System\pcTfgOE.exe
  C:\Windows\System\pcTfgOE.exe
  2⤵
  PID:6728
- C:\Windows\System\XkRlQmw.exe
  C:\Windows\System\XkRlQmw.exe
  2⤵
  PID:6744
- C:\Windows\System\ksSmiMu.exe
  C:\Windows\System\ksSmiMu.exe
  2⤵
  PID:6760
- C:\Windows\System\QNXucPw.exe
  C:\Windows\System\QNXucPw.exe
  2⤵
  PID:6776
- C:\Windows\System\ZiLZQKE.exe
  C:\Windows\System\ZiLZQKE.exe
  2⤵
  PID:6792
- C:\Windows\System\CEqPJyq.exe
  C:\Windows\System\CEqPJyq.exe
  2⤵
  PID:6808
- C:\Windows\System\SPlgUqi.exe
  C:\Windows\System\SPlgUqi.exe
  2⤵
  PID:6824
- C:\Windows\System\BWYQixA.exe
  C:\Windows\System\BWYQixA.exe
  2⤵
  PID:6840
- C:\Windows\System\wAGmCsR.exe
  C:\Windows\System\wAGmCsR.exe
  2⤵
  PID:6856
- C:\Windows\System\bdJWVYJ.exe
  C:\Windows\System\bdJWVYJ.exe
  2⤵
  PID:6872
- C:\Windows\System\zNInuvc.exe
  C:\Windows\System\zNInuvc.exe
  2⤵
  PID:6888
- C:\Windows\System\uTsPUss.exe
  C:\Windows\System\uTsPUss.exe
  2⤵
  PID:6904
- C:\Windows\System\urcOrqX.exe
  C:\Windows\System\urcOrqX.exe
  2⤵
  PID:6920
- C:\Windows\System\IYGLpQO.exe
  C:\Windows\System\IYGLpQO.exe
  2⤵
  PID:6936
- C:\Windows\System\UjEMunx.exe
  C:\Windows\System\UjEMunx.exe
  2⤵
  PID:6952
- C:\Windows\System\ppedetC.exe
  C:\Windows\System\ppedetC.exe
  2⤵
  PID:6968
- C:\Windows\System\qwqZuoG.exe
  C:\Windows\System\qwqZuoG.exe
  2⤵
  PID:6984
- C:\Windows\System\NoNLTxg.exe
  C:\Windows\System\NoNLTxg.exe
  2⤵
  PID:7004
- C:\Windows\System\AhpixeZ.exe
  C:\Windows\System\AhpixeZ.exe
  2⤵
  PID:7020
- C:\Windows\System\UePKNei.exe
  C:\Windows\System\UePKNei.exe
  2⤵
  PID:7036
- C:\Windows\System\tQXPCoP.exe
  C:\Windows\System\tQXPCoP.exe
  2⤵
  PID:7100
- C:\Windows\System\SOEQFAq.exe
  C:\Windows\System\SOEQFAq.exe
  2⤵
  PID:7120
- C:\Windows\System\bcAXiAj.exe
  C:\Windows\System\bcAXiAj.exe
  2⤵
  PID:7144
- C:\Windows\System\NPFgbgc.exe
  C:\Windows\System\NPFgbgc.exe
  2⤵
  PID:7160
- C:\Windows\System\QfjzDMx.exe
  C:\Windows\System\QfjzDMx.exe
  2⤵
  PID:5952
- C:\Windows\System\qVVfrVY.exe
  C:\Windows\System\qVVfrVY.exe
  2⤵
  PID:5140
- C:\Windows\System\WktjXaT.exe
  C:\Windows\System\WktjXaT.exe
  2⤵
  PID:6256
- C:\Windows\System\NhJoNEt.exe
  C:\Windows\System\NhJoNEt.exe
  2⤵
  PID:6320
- C:\Windows\System\TZgjGRH.exe
  C:\Windows\System\TZgjGRH.exe
  2⤵
  PID:1524
- C:\Windows\System\wkvqvyt.exe
  C:\Windows\System\wkvqvyt.exe
  2⤵
  PID:4052
- C:\Windows\System\lxgzVQO.exe
  C:\Windows\System\lxgzVQO.exe
  2⤵
  PID:6176
- C:\Windows\System\nsKurGG.exe
  C:\Windows\System\nsKurGG.exe
  2⤵
  PID:6240
- C:\Windows\System\YYoSqpt.exe
  C:\Windows\System\YYoSqpt.exe
  2⤵
  PID:6304
- C:\Windows\System\ONlCQQJ.exe
  C:\Windows\System\ONlCQQJ.exe
  2⤵
  PID:6368
- C:\Windows\System\RWvapjb.exe
  C:\Windows\System\RWvapjb.exe
  2⤵
  PID:6416
- C:\Windows\System\inHESIU.exe
  C:\Windows\System\inHESIU.exe
  2⤵
  PID:6380
- C:\Windows\System\uvHCftx.exe
  C:\Windows\System\uvHCftx.exe
  2⤵
  PID:6572
- C:\Windows\System\GEwxzxU.exe
  C:\Windows\System\GEwxzxU.exe
  2⤵
  PID:6640
- C:\Windows\System\uqMwPtl.exe
  C:\Windows\System\uqMwPtl.exe
  2⤵
  PID:6772
- C:\Windows\System\kugcsiS.exe
  C:\Windows\System\kugcsiS.exe
  2⤵
  PID:6864
- C:\Windows\System\dHGyoYF.exe
  C:\Windows\System\dHGyoYF.exe
  2⤵
  PID:6932
- C:\Windows\System\chAUTwt.exe
  C:\Windows\System\chAUTwt.exe
  2⤵
  PID:7000
- C:\Windows\System\RFBAJWv.exe
  C:\Windows\System\RFBAJWv.exe
  2⤵
  PID:7052
- C:\Windows\System\yNhHxQb.exe
  C:\Windows\System\yNhHxQb.exe
  2⤵
  PID:7080
- C:\Windows\System\lyzoUCU.exe
  C:\Windows\System\lyzoUCU.exe
  2⤵
  PID:7088
- C:\Windows\System\wIJwBaQ.exe
  C:\Windows\System\wIJwBaQ.exe
  2⤵
  PID:7116
- C:\Windows\System\MLPmonK.exe
  C:\Windows\System\MLPmonK.exe
  2⤵
  PID:2412
- C:\Windows\System\INgNVZi.exe
  C:\Windows\System\INgNVZi.exe
  2⤵
  PID:6316
- C:\Windows\System\BwgHxOj.exe
  C:\Windows\System\BwgHxOj.exe
  2⤵
  PID:6336
- C:\Windows\System\sFcRHiL.exe
  C:\Windows\System\sFcRHiL.exe
  2⤵
  PID:5336
- C:\Windows\System\contUWh.exe
  C:\Windows\System\contUWh.exe
  2⤵
  PID:6836
- C:\Windows\System\TKcGdBq.exe
  C:\Windows\System\TKcGdBq.exe
  2⤵
  PID:7180
- C:\Windows\System\eQePqIZ.exe
  C:\Windows\System\eQePqIZ.exe
  2⤵
  PID:7196
- C:\Windows\System\LGMVlPY.exe
  C:\Windows\System\LGMVlPY.exe
  2⤵
  PID:7212
- C:\Windows\System\QaTmmJh.exe
  C:\Windows\System\QaTmmJh.exe
  2⤵
  PID:7232
- C:\Windows\System\ZkHtSPY.exe
  C:\Windows\System\ZkHtSPY.exe
  2⤵
  PID:7248
- C:\Windows\System\VXsXxcN.exe
  C:\Windows\System\VXsXxcN.exe
  2⤵
  PID:7264
- C:\Windows\System\LgfHQmy.exe
  C:\Windows\System\LgfHQmy.exe
  2⤵
  PID:7280
- C:\Windows\System\yrtdgDR.exe
  C:\Windows\System\yrtdgDR.exe
  2⤵
  PID:7296
- C:\Windows\System\hGrACWC.exe
  C:\Windows\System\hGrACWC.exe
  2⤵
  PID:7312
- C:\Windows\System\aSojQdz.exe
  C:\Windows\System\aSojQdz.exe
  2⤵
  PID:7328
- C:\Windows\System\GsKWnMN.exe
  C:\Windows\System\GsKWnMN.exe
  2⤵
  PID:7344
- C:\Windows\System\OinAVMG.exe
  C:\Windows\System\OinAVMG.exe
  2⤵
  PID:7360
- C:\Windows\System\jhGBUif.exe
  C:\Windows\System\jhGBUif.exe
  2⤵
  PID:7376
- C:\Windows\System\DWvCkSu.exe
  C:\Windows\System\DWvCkSu.exe
  2⤵
  PID:7392
- C:\Windows\System\JiUdPLx.exe
  C:\Windows\System\JiUdPLx.exe
  2⤵
  PID:7408
- C:\Windows\System\yPTWFoU.exe
  C:\Windows\System\yPTWFoU.exe
  2⤵
  PID:7424
- C:\Windows\System\kXOUhwZ.exe
  C:\Windows\System\kXOUhwZ.exe
  2⤵
  PID:7440
- C:\Windows\System\WEcgOsQ.exe
  C:\Windows\System\WEcgOsQ.exe
  2⤵
  PID:7460
- C:\Windows\System\LPusQLO.exe
  C:\Windows\System\LPusQLO.exe
  2⤵
  PID:7476
- C:\Windows\System\MQjsMAq.exe
  C:\Windows\System\MQjsMAq.exe
  2⤵
  PID:7512
- C:\Windows\System\WuCrQLP.exe
  C:\Windows\System\WuCrQLP.exe
  2⤵
  PID:7528
- C:\Windows\System\QfjdBcY.exe
  C:\Windows\System\QfjdBcY.exe
  2⤵
  PID:7544
- C:\Windows\System\vYgyutk.exe
  C:\Windows\System\vYgyutk.exe
  2⤵
  PID:7560
- C:\Windows\System\lWCDyxI.exe
  C:\Windows\System\lWCDyxI.exe
  2⤵
  PID:7576
- C:\Windows\System\EpXYgdz.exe
  C:\Windows\System\EpXYgdz.exe
  2⤵
  PID:7596
- C:\Windows\System\wWPiCGL.exe
  C:\Windows\System\wWPiCGL.exe
  2⤵
  PID:7612
- C:\Windows\System\Mojyjxv.exe
  C:\Windows\System\Mojyjxv.exe
  2⤵
  PID:7628
- C:\Windows\System\jrXinQF.exe
  C:\Windows\System\jrXinQF.exe
  2⤵
  PID:7648
- C:\Windows\System\WXUswdA.exe
  C:\Windows\System\WXUswdA.exe
  2⤵
  PID:7664
- C:\Windows\System\SDDipHa.exe
  C:\Windows\System\SDDipHa.exe
  2⤵
  PID:7680
- C:\Windows\System\BggTYeP.exe
  C:\Windows\System\BggTYeP.exe
  2⤵
  PID:7696
- C:\Windows\System\ngHUeNz.exe
  C:\Windows\System\ngHUeNz.exe
  2⤵
  PID:7716
- C:\Windows\System\RuDogNp.exe
  C:\Windows\System\RuDogNp.exe
  2⤵
  PID:7736
- C:\Windows\System\XgkFuuz.exe
  C:\Windows\System\XgkFuuz.exe
  2⤵
  PID:7752
- C:\Windows\System\UgPCpTu.exe
  C:\Windows\System\UgPCpTu.exe
  2⤵
  PID:7768
- C:\Windows\System\xgAIGQG.exe
  C:\Windows\System\xgAIGQG.exe
  2⤵
  PID:7784
- C:\Windows\System\dQBOVaX.exe
  C:\Windows\System\dQBOVaX.exe
  2⤵
  PID:7800
- C:\Windows\System\GqllDOF.exe
  C:\Windows\System\GqllDOF.exe
  2⤵
  PID:7820
- C:\Windows\System\PKQfSyI.exe
  C:\Windows\System\PKQfSyI.exe
  2⤵
  PID:7840
- C:\Windows\System\jrIGajp.exe
  C:\Windows\System\jrIGajp.exe
  2⤵
  PID:7856
- C:\Windows\System\JLbWoCn.exe
  C:\Windows\System\JLbWoCn.exe
  2⤵
  PID:7872
- C:\Windows\System\slmdZXP.exe
  C:\Windows\System\slmdZXP.exe
  2⤵
  PID:7888
- C:\Windows\System\jFTFJgo.exe
  C:\Windows\System\jFTFJgo.exe
  2⤵
  PID:7904
- C:\Windows\System\wpaQTUG.exe
  C:\Windows\System\wpaQTUG.exe
  2⤵
  PID:7920
- C:\Windows\System\FVvibEU.exe
  C:\Windows\System\FVvibEU.exe
  2⤵
  PID:7940
- C:\Windows\System\JmNpuSa.exe
  C:\Windows\System\JmNpuSa.exe
  2⤵
  PID:7960
- C:\Windows\System\ueApNbH.exe
  C:\Windows\System\ueApNbH.exe
  2⤵
  PID:7976
- C:\Windows\System\wfDAqGR.exe
  C:\Windows\System\wfDAqGR.exe
  2⤵
  PID:7992
- C:\Windows\System\TEWEaZS.exe
  C:\Windows\System\TEWEaZS.exe
  2⤵
  PID:8008
- C:\Windows\System\rSmqqQI.exe
  C:\Windows\System\rSmqqQI.exe
  2⤵
  PID:8028
- C:\Windows\System\WXQZLoa.exe
  C:\Windows\System\WXQZLoa.exe
  2⤵
  PID:8044
- C:\Windows\System\VXokgZI.exe
  C:\Windows\System\VXokgZI.exe
  2⤵
  PID:8068
- C:\Windows\System\OzhNzCu.exe
  C:\Windows\System\OzhNzCu.exe
  2⤵
  PID:8084
- C:\Windows\System\OgnQRSQ.exe
  C:\Windows\System\OgnQRSQ.exe
  2⤵
  PID:8104
- C:\Windows\System\syFNoOE.exe
  C:\Windows\System\syFNoOE.exe
  2⤵
  PID:8120
- C:\Windows\System\jLoscBS.exe
  C:\Windows\System\jLoscBS.exe
  2⤵
  PID:8136
- C:\Windows\System\vUHZNWK.exe
  C:\Windows\System\vUHZNWK.exe
  2⤵
  PID:8156
- C:\Windows\System\QsGLSpe.exe
  C:\Windows\System\QsGLSpe.exe
  2⤵
  PID:8172
- C:\Windows\System\gempFmR.exe
  C:\Windows\System\gempFmR.exe
  2⤵
  PID:8188
- C:\Windows\System\MuuDRzT.exe
  C:\Windows\System\MuuDRzT.exe
  2⤵
  PID:6192
- C:\Windows\System\EXnTTqG.exe
  C:\Windows\System\EXnTTqG.exe
  2⤵
  PID:6152
- C:\Windows\System\NCKosqu.exe
  C:\Windows\System\NCKosqu.exe
  2⤵
  PID:6252
- C:\Windows\System\qMptvOz.exe
  C:\Windows\System\qMptvOz.exe
  2⤵
  PID:4356
- C:\Windows\System\opNByvA.exe
  C:\Windows\System\opNByvA.exe
  2⤵
  PID:6400
- C:\Windows\System\KxlbDmC.exe
  C:\Windows\System\KxlbDmC.exe
  2⤵
  PID:6484
- C:\Windows\System\oAxieUp.exe
  C:\Windows\System\oAxieUp.exe
  2⤵
  PID:2012
- C:\Windows\System\AkFPZPf.exe
  C:\Windows\System\AkFPZPf.exe
  2⤵
  PID:6584
- C:\Windows\System\myxsjKL.exe
  C:\Windows\System\myxsjKL.exe
  2⤵
  PID:6440
- C:\Windows\System\iHGlJfv.exe
  C:\Windows\System\iHGlJfv.exe
  2⤵
  PID:6688
- C:\Windows\System\jHKPfVV.exe
  C:\Windows\System\jHKPfVV.exe
  2⤵
  PID:7172
- C:\Windows\System\flcofFt.exe
  C:\Windows\System\flcofFt.exe
  2⤵
  PID:7208
- C:\Windows\System\qhCofBt.exe
  C:\Windows\System\qhCofBt.exe
  2⤵
  PID:6704
- C:\Windows\System\SQHjSiw.exe
  C:\Windows\System\SQHjSiw.exe
  2⤵
  PID:6948
- C:\Windows\System\OgPUynA.exe
  C:\Windows\System\OgPUynA.exe
  2⤵
  PID:6916
- C:\Windows\System\OXmXigN.exe
  C:\Windows\System\OXmXigN.exe
  2⤵
  PID:6852
- C:\Windows\System\LlGTCTn.exe
  C:\Windows\System\LlGTCTn.exe
  2⤵
  PID:6468
- C:\Windows\System\Mylkncn.exe
  C:\Windows\System\Mylkncn.exe
  2⤵
  PID:6536
- C:\Windows\System\fUJcILF.exe
  C:\Windows\System\fUJcILF.exe
  2⤵
  PID:6928
- C:\Windows\System\yCPSXGA.exe
  C:\Windows\System\yCPSXGA.exe
  2⤵
  PID:7076
- C:\Windows\System\KVLiIyS.exe
  C:\Windows\System\KVLiIyS.exe
  2⤵
  PID:6236
- C:\Windows\System\aOyIXho.exe
  C:\Windows\System\aOyIXho.exe
  2⤵
  PID:7224
- C:\Windows\System\eHVlhyy.exe
  C:\Windows\System\eHVlhyy.exe
  2⤵
  PID:7288
- C:\Windows\System\OusxnOf.exe
  C:\Windows\System\OusxnOf.exe
  2⤵
  PID:6944
- C:\Windows\System\rtOBTqo.exe
  C:\Windows\System\rtOBTqo.exe
  2⤵
  PID:6960
- C:\Windows\System\VxOVqeH.exe
  C:\Windows\System\VxOVqeH.exe
  2⤵
  PID:7304
- C:\Windows\System\mtvVEBX.exe
  C:\Windows\System\mtvVEBX.exe
  2⤵
  PID:7372
- C:\Windows\System\bdnYBNB.exe
  C:\Windows\System\bdnYBNB.exe
  2⤵
  PID:7388
- C:\Windows\System\dDSfVsZ.exe
  C:\Windows\System\dDSfVsZ.exe
  2⤵
  PID:7352
- C:\Windows\System\xkrDVwh.exe
  C:\Windows\System\xkrDVwh.exe
  2⤵
  PID:7420
- C:\Windows\System\druEzEi.exe
  C:\Windows\System\druEzEi.exe
  2⤵
  PID:7448
- C:\Windows\System\NjvxAgE.exe
  C:\Windows\System\NjvxAgE.exe
  2⤵
  PID:7504
- C:\Windows\System\hIgZqUk.exe
  C:\Windows\System\hIgZqUk.exe
  2⤵
  PID:7508
- C:\Windows\System\mhYaCqG.exe
  C:\Windows\System\mhYaCqG.exe
  2⤵
  PID:7604
- C:\Windows\System\clGggzr.exe
  C:\Windows\System\clGggzr.exe
  2⤵
  PID:7676
- C:\Windows\System\MGhyrmU.exe
  C:\Windows\System\MGhyrmU.exe
  2⤵
  PID:7712
- C:\Windows\System\QyQKOQr.exe
  C:\Windows\System\QyQKOQr.exe
  2⤵
  PID:7704
- C:\Windows\System\NwkklCq.exe
  C:\Windows\System\NwkklCq.exe
  2⤵
  PID:7816
- C:\Windows\System\NsRarga.exe
  C:\Windows\System\NsRarga.exe
  2⤵
  PID:7880
- C:\Windows\System\zddcNnL.exe
  C:\Windows\System\zddcNnL.exe
  2⤵
  PID:6720
- C:\Windows\System\OQhjgXf.exe
  C:\Windows\System\OQhjgXf.exe
  2⤵
  PID:7956
- C:\Windows\System\IxoFOuG.exe
  C:\Windows\System\IxoFOuG.exe
  2⤵
  PID:8016
- C:\Windows\System\hUCvgBa.exe
  C:\Windows\System\hUCvgBa.exe
  2⤵
  PID:8056
- C:\Windows\System\gpHQaGS.exe
  C:\Windows\System\gpHQaGS.exe
  2⤵
  PID:7588
- C:\Windows\System\lkipreM.exe
  C:\Windows\System\lkipreM.exe
  2⤵
  PID:7624
- C:\Windows\System\SRFqIQA.exe
  C:\Windows\System\SRFqIQA.exe
  2⤵
  PID:7724
- C:\Windows\System\uDdFmEt.exe
  C:\Windows\System\uDdFmEt.exe
  2⤵
  PID:7764
- C:\Windows\System\MuGcGbI.exe
  C:\Windows\System\MuGcGbI.exe
  2⤵
  PID:7828
- C:\Windows\System\qSWCeid.exe
  C:\Windows\System\qSWCeid.exe
  2⤵
  PID:8096
- C:\Windows\System\gmvtWST.exe
  C:\Windows\System\gmvtWST.exe
  2⤵
  PID:8132
- C:\Windows\System\YnovegP.exe
  C:\Windows\System\YnovegP.exe
  2⤵
  PID:7896
- C:\Windows\System\tAQWcqc.exe
  C:\Windows\System\tAQWcqc.exe
  2⤵
  PID:7936
- C:\Windows\System\AKzqeqs.exe
  C:\Windows\System\AKzqeqs.exe
  2⤵
  PID:8036
- C:\Windows\System\HNbzfFX.exe
  C:\Windows\System\HNbzfFX.exe
  2⤵
  PID:6220
- C:\Windows\System\zSVMXPu.exe
  C:\Windows\System\zSVMXPu.exe
  2⤵
  PID:6272
- C:\Windows\System\oNASpXh.exe
  C:\Windows\System\oNASpXh.exe
  2⤵
  PID:8152
- C:\Windows\System\bplasTq.exe
  C:\Windows\System\bplasTq.exe
  2⤵
  PID:6352
- C:\Windows\System\qIlxHYT.exe
  C:\Windows\System\qIlxHYT.exe
  2⤵
  PID:6168
- C:\Windows\System\tXOeFqc.exe
  C:\Windows\System\tXOeFqc.exe
  2⤵
  PID:6768
- C:\Windows\System\rPKckcd.exe
  C:\Windows\System\rPKckcd.exe
  2⤵
  PID:8180
- C:\Windows\System\JntMvtl.exe
  C:\Windows\System\JntMvtl.exe
  2⤵
  PID:5020
- C:\Windows\System\Nrxtwzf.exe
  C:\Windows\System\Nrxtwzf.exe
  2⤵
  PID:6752
- C:\Windows\System\jQaYZvG.exe
  C:\Windows\System\jQaYZvG.exe
  2⤵
  PID:6532
- C:\Windows\System\nzlhcgr.exe
  C:\Windows\System\nzlhcgr.exe
  2⤵
  PID:6632
- C:\Windows\System\xhPKGzr.exe
  C:\Windows\System\xhPKGzr.exe
  2⤵
  PID:6884
- C:\Windows\System\SBlRpTW.exe
  C:\Windows\System\SBlRpTW.exe
  2⤵
  PID:7256
- C:\Windows\System\qUvtSPe.exe
  C:\Windows\System\qUvtSPe.exe
  2⤵
  PID:7340
- C:\Windows\System\zFJGwCq.exe
  C:\Windows\System\zFJGwCq.exe
  2⤵
  PID:5652
- C:\Windows\System\OItJUhI.exe
  C:\Windows\System\OItJUhI.exe
  2⤵
  PID:7192
- C:\Windows\System\sRCnqLl.exe
  C:\Windows\System\sRCnqLl.exe
  2⤵
  PID:7404
- C:\Windows\System\VBpoImj.exe
  C:\Windows\System\VBpoImj.exe
  2⤵
  PID:7492
- C:\Windows\System\mNUZQAa.exe
  C:\Windows\System\mNUZQAa.exe
  2⤵
  PID:6788
- C:\Windows\System\PjIkpzY.exe
  C:\Windows\System\PjIkpzY.exe
  2⤵
  PID:7672
- C:\Windows\System\JmpWhxC.exe
  C:\Windows\System\JmpWhxC.exe
  2⤵
  PID:7568
- C:\Windows\System\IrCjxbm.exe
  C:\Windows\System\IrCjxbm.exe
  2⤵
  PID:7272
- C:\Windows\System\YwVDsSP.exe
  C:\Windows\System\YwVDsSP.exe
  2⤵
  PID:7500
- C:\Windows\System\XeVioEe.exe
  C:\Windows\System\XeVioEe.exe
  2⤵
  PID:7808
- C:\Windows\System\ijfEnFA.exe
  C:\Windows\System\ijfEnFA.exe
  2⤵
  PID:7884
- C:\Windows\System\QkpMiwk.exe
  C:\Windows\System\QkpMiwk.exe
  2⤵
  PID:7988
- C:\Windows\System\MKAkWCa.exe
  C:\Windows\System\MKAkWCa.exe
  2⤵
  PID:8092
- C:\Windows\System\jYeZkhP.exe
  C:\Windows\System\jYeZkhP.exe
  2⤵
  PID:7584
- C:\Windows\System\aKCQieA.exe
  C:\Windows\System\aKCQieA.exe
  2⤵
  PID:7968
- C:\Windows\System\YAiKfZh.exe
  C:\Windows\System\YAiKfZh.exe
  2⤵
  PID:7864
- C:\Windows\System\TmDaUYz.exe
  C:\Windows\System\TmDaUYz.exe
  2⤵
  PID:8112
- C:\Windows\System\jquSKoN.exe
  C:\Windows\System\jquSKoN.exe
  2⤵
  PID:7932
- C:\Windows\System\NCXWbpD.exe
  C:\Windows\System\NCXWbpD.exe
  2⤵
  PID:6616
- C:\Windows\System\yHDEriH.exe
  C:\Windows\System\yHDEriH.exe
  2⤵
  PID:6652
- C:\Windows\System\PfROdWQ.exe
  C:\Windows\System\PfROdWQ.exe
  2⤵
  PID:8148
- C:\Windows\System\JPJsfOu.exe
  C:\Windows\System\JPJsfOu.exe
  2⤵
  PID:6156
- C:\Windows\System\VXJgreU.exe
  C:\Windows\System\VXJgreU.exe
  2⤵
  PID:6820
- C:\Windows\System\OWyamXj.exe
  C:\Windows\System\OWyamXj.exe
  2⤵
  PID:7220
- C:\Windows\System\SDSdlIq.exe
  C:\Windows\System\SDSdlIq.exe
  2⤵
  PID:7456
- C:\Windows\System\vnxXLcS.exe
  C:\Windows\System\vnxXLcS.exe
  2⤵
  PID:7320
- C:\Windows\System\mxwbknq.exe
  C:\Windows\System\mxwbknq.exe
  2⤵
  PID:7496
- C:\Windows\System\ayakhSv.exe
  C:\Windows\System\ayakhSv.exe
  2⤵
  PID:7912
- C:\Windows\System\kZiXdQh.exe
  C:\Windows\System\kZiXdQh.exe
  2⤵
  PID:7984
- C:\Windows\System\DJMfiTJ.exe
  C:\Windows\System\DJMfiTJ.exe
  2⤵
  PID:7748
- C:\Windows\System\TOvpIEq.exe
  C:\Windows\System\TOvpIEq.exe
  2⤵
  PID:7524
- C:\Windows\System\IXlxKFx.exe
  C:\Windows\System\IXlxKFx.exe
  2⤵
  PID:7836
- C:\Windows\System\XJGCrpY.exe
  C:\Windows\System\XJGCrpY.exe
  2⤵
  PID:6520
- C:\Windows\System\CTzguhr.exe
  C:\Windows\System\CTzguhr.exe
  2⤵
  PID:8168
- C:\Windows\System\SOGzfDS.exe
  C:\Windows\System\SOGzfDS.exe
  2⤵
  PID:6288
- C:\Windows\System\yuzpmYU.exe
  C:\Windows\System\yuzpmYU.exe
  2⤵
  PID:6900
- C:\Windows\System\oWOeoFs.exe
  C:\Windows\System\oWOeoFs.exe
  2⤵
  PID:6568
- C:\Windows\System\raGYPtz.exe
  C:\Windows\System\raGYPtz.exe
  2⤵
  PID:6500
- C:\Windows\System\DFJETCG.exe
  C:\Windows\System\DFJETCG.exe
  2⤵
  PID:7156
- C:\Windows\System\CdlJAqH.exe
  C:\Windows\System\CdlJAqH.exe
  2⤵
  PID:6784
- C:\Windows\System\ocHcfpb.exe
  C:\Windows\System\ocHcfpb.exe
  2⤵
  PID:7692
- C:\Windows\System\VFXIBag.exe
  C:\Windows\System\VFXIBag.exe
  2⤵
  PID:8144
- C:\Windows\System\WQApTRn.exe
  C:\Windows\System\WQApTRn.exe
  2⤵
  PID:7276
- C:\Windows\System\uRsYRZa.exe
  C:\Windows\System\uRsYRZa.exe
  2⤵
  PID:7136
- C:\Windows\System\TCgOEoh.exe
  C:\Windows\System\TCgOEoh.exe
  2⤵
  PID:8204
- C:\Windows\System\goqzjIS.exe
  C:\Windows\System\goqzjIS.exe
  2⤵
  PID:8220
- C:\Windows\System\ieCNxRW.exe
  C:\Windows\System\ieCNxRW.exe
  2⤵
  PID:8236
- C:\Windows\System\AnahJXx.exe
  C:\Windows\System\AnahJXx.exe
  2⤵
  PID:8252
- C:\Windows\System\oTcpMAM.exe
  C:\Windows\System\oTcpMAM.exe
  2⤵
  PID:8268
- C:\Windows\System\yRpAiHb.exe
  C:\Windows\System\yRpAiHb.exe
  2⤵
  PID:8284
- C:\Windows\System\LIXgBcP.exe
  C:\Windows\System\LIXgBcP.exe
  2⤵
  PID:8300
- C:\Windows\System\TiGQhiC.exe
  C:\Windows\System\TiGQhiC.exe
  2⤵
  PID:8316
- C:\Windows\System\Dyejbgp.exe
  C:\Windows\System\Dyejbgp.exe
  2⤵
  PID:8332
- C:\Windows\System\NsuHItb.exe
  C:\Windows\System\NsuHItb.exe
  2⤵
  PID:8348
- C:\Windows\System\XMnWWfY.exe
  C:\Windows\System\XMnWWfY.exe
  2⤵
  PID:8364
- C:\Windows\System\qOwUpDQ.exe
  C:\Windows\System\qOwUpDQ.exe
  2⤵
  PID:8380
- C:\Windows\System\OdEqtsI.exe
  C:\Windows\System\OdEqtsI.exe
  2⤵
  PID:8396
- C:\Windows\System\OuCsauw.exe
  C:\Windows\System\OuCsauw.exe
  2⤵
  PID:8412
- C:\Windows\System\SgUXnUT.exe
  C:\Windows\System\SgUXnUT.exe
  2⤵
  PID:8428
- C:\Windows\System\WJfXqRd.exe
  C:\Windows\System\WJfXqRd.exe
  2⤵
  PID:8444
- C:\Windows\System\GynqPih.exe
  C:\Windows\System\GynqPih.exe
  2⤵
  PID:8460
- C:\Windows\System\xxMHCxm.exe
  C:\Windows\System\xxMHCxm.exe
  2⤵
  PID:8476
- C:\Windows\System\GpdUXKU.exe
  C:\Windows\System\GpdUXKU.exe
  2⤵
  PID:8492
- C:\Windows\System\wxXLcRi.exe
  C:\Windows\System\wxXLcRi.exe
  2⤵
  PID:8508
- C:\Windows\System\QariTYL.exe
  C:\Windows\System\QariTYL.exe
  2⤵
  PID:8524
- C:\Windows\System\hXgWyZh.exe
  C:\Windows\System\hXgWyZh.exe
  2⤵
  PID:8540
- C:\Windows\System\uDYcvUq.exe
  C:\Windows\System\uDYcvUq.exe
  2⤵
  PID:8556
- C:\Windows\System\CLxEgsA.exe
  C:\Windows\System\CLxEgsA.exe
  2⤵
  PID:8572
- C:\Windows\System\KZujvym.exe
  C:\Windows\System\KZujvym.exe
  2⤵
  PID:8588
- C:\Windows\System\fubOhfz.exe
  C:\Windows\System\fubOhfz.exe
  2⤵
  PID:8604
- C:\Windows\System\abunLNy.exe
  C:\Windows\System\abunLNy.exe
  2⤵
  PID:8620
- C:\Windows\System\yVcXHSM.exe
  C:\Windows\System\yVcXHSM.exe
  2⤵
  PID:8636
- C:\Windows\System\AYgQvaf.exe
  C:\Windows\System\AYgQvaf.exe
  2⤵
  PID:8652
- C:\Windows\System\eOvxWQY.exe
  C:\Windows\System\eOvxWQY.exe
  2⤵
  PID:8676
- C:\Windows\System\OrtgOnv.exe
  C:\Windows\System\OrtgOnv.exe
  2⤵
  PID:8692
- C:\Windows\System\jRdqzgL.exe
  C:\Windows\System\jRdqzgL.exe
  2⤵
  PID:8708
- C:\Windows\System\zTVAYxX.exe
  C:\Windows\System\zTVAYxX.exe
  2⤵
  PID:8724
- C:\Windows\System\PJiEovx.exe
  C:\Windows\System\PJiEovx.exe
  2⤵
  PID:8740
- C:\Windows\System\PBaMBCx.exe
  C:\Windows\System\PBaMBCx.exe
  2⤵
  PID:8756
- C:\Windows\System\bQZVOkF.exe
  C:\Windows\System\bQZVOkF.exe
  2⤵
  PID:8772
- C:\Windows\System\gMLsAGs.exe
  C:\Windows\System\gMLsAGs.exe
  2⤵
  PID:8788
- C:\Windows\System\RbQzDsF.exe
  C:\Windows\System\RbQzDsF.exe
  2⤵
  PID:8804
- C:\Windows\System\TkMGFTo.exe
  C:\Windows\System\TkMGFTo.exe
  2⤵
  PID:8820
- C:\Windows\System\WkRdmuC.exe
  C:\Windows\System\WkRdmuC.exe
  2⤵
  PID:8836
- C:\Windows\System\ZogDXou.exe
  C:\Windows\System\ZogDXou.exe
  2⤵
  PID:8852
- C:\Windows\System\KPUaBZK.exe
  C:\Windows\System\KPUaBZK.exe
  2⤵
  PID:8868
- C:\Windows\System\zxnfrzV.exe
  C:\Windows\System\zxnfrzV.exe
  2⤵
  PID:8884
- C:\Windows\System\Mzkykab.exe
  C:\Windows\System\Mzkykab.exe
  2⤵
  PID:8900
- C:\Windows\System\NuDHHSx.exe
  C:\Windows\System\NuDHHSx.exe
  2⤵
  PID:8916
- C:\Windows\System\ySvDWOg.exe
  C:\Windows\System\ySvDWOg.exe
  2⤵
  PID:8932
- C:\Windows\System\zqGOVpO.exe
  C:\Windows\System\zqGOVpO.exe
  2⤵
  PID:8948
- C:\Windows\System\elnudrD.exe
  C:\Windows\System\elnudrD.exe
  2⤵
  PID:8964
- C:\Windows\System\pyIyWxI.exe
  C:\Windows\System\pyIyWxI.exe
  2⤵
  PID:8980
- C:\Windows\System\NIuYoJK.exe
  C:\Windows\System\NIuYoJK.exe
  2⤵
  PID:8996
- C:\Windows\System\pyhnVgF.exe
  C:\Windows\System\pyhnVgF.exe
  2⤵
  PID:9012
- C:\Windows\System\lzSfQYc.exe
  C:\Windows\System\lzSfQYc.exe
  2⤵
  PID:9028
- C:\Windows\System\hFDJUQL.exe
  C:\Windows\System\hFDJUQL.exe
  2⤵
  PID:9044
- C:\Windows\System\HHFmtPM.exe
  C:\Windows\System\HHFmtPM.exe
  2⤵
  PID:9060
- C:\Windows\System\SmUnTqE.exe
  C:\Windows\System\SmUnTqE.exe
  2⤵
  PID:9076
- C:\Windows\System\ikCFmXE.exe
  C:\Windows\System\ikCFmXE.exe
  2⤵
  PID:9092
- C:\Windows\System\rVtYzDO.exe
  C:\Windows\System\rVtYzDO.exe
  2⤵
  PID:9108
- C:\Windows\System\IdATcHG.exe
  C:\Windows\System\IdATcHG.exe
  2⤵
  PID:9124
- C:\Windows\System\tkdnAsb.exe
  C:\Windows\System\tkdnAsb.exe
  2⤵
  PID:9140
- C:\Windows\System\dhrfkjl.exe
  C:\Windows\System\dhrfkjl.exe
  2⤵
  PID:9156
- C:\Windows\System\PIrjKLX.exe
  C:\Windows\System\PIrjKLX.exe
  2⤵
  PID:9172
- C:\Windows\System\uBqzaiU.exe
  C:\Windows\System\uBqzaiU.exe
  2⤵
  PID:9188
- C:\Windows\System\NFgNPIh.exe
  C:\Windows\System\NFgNPIh.exe
  2⤵
  PID:9204
- C:\Windows\System\jdQtVIW.exe
  C:\Windows\System\jdQtVIW.exe
  2⤵
  PID:7520
- C:\Windows\System\HtABYhD.exe
  C:\Windows\System\HtABYhD.exe
  2⤵
  PID:8004
- C:\Windows\System\qsmBGNt.exe
  C:\Windows\System\qsmBGNt.exe
  2⤵
  PID:8308
- C:\Windows\System\VMbgLyq.exe
  C:\Windows\System\VMbgLyq.exe
  2⤵
  PID:6456
- C:\Windows\System\NTfIQbQ.exe
  C:\Windows\System\NTfIQbQ.exe
  2⤵
  PID:8228
- C:\Windows\System\KwpKOxq.exe
  C:\Windows\System\KwpKOxq.exe
  2⤵
  PID:8292
- C:\Windows\System\pHaKJNf.exe
  C:\Windows\System\pHaKJNf.exe
  2⤵
  PID:8328
- C:\Windows\System\zgVjSzB.exe
  C:\Windows\System\zgVjSzB.exe
  2⤵
  PID:8052
- C:\Windows\System\TwKWVTo.exe
  C:\Windows\System\TwKWVTo.exe
  2⤵
  PID:8260
- C:\Windows\System\AyvxtqJ.exe
  C:\Windows\System\AyvxtqJ.exe
  2⤵
  PID:7660
- C:\Windows\System\qoIWTqO.exe
  C:\Windows\System\qoIWTqO.exe
  2⤵
  PID:6504
- C:\Windows\System\GzkvgHl.exe
  C:\Windows\System\GzkvgHl.exe
  2⤵
  PID:8452
- C:\Windows\System\gYhqtxB.exe
  C:\Windows\System\gYhqtxB.exe
  2⤵
  PID:8504
- C:\Windows\System\hdrFPUv.exe
  C:\Windows\System\hdrFPUv.exe
  2⤵
  PID:8568
- C:\Windows\System\YdsMUER.exe
  C:\Windows\System\YdsMUER.exe
  2⤵
  PID:8600
- C:\Windows\System\OKwXpDm.exe
  C:\Windows\System\OKwXpDm.exe
  2⤵
  PID:8520
- C:\Windows\System\QegQdFi.exe
  C:\Windows\System\QegQdFi.exe
  2⤵
  PID:8548
- C:\Windows\System\wFsXWKz.exe
  C:\Windows\System\wFsXWKz.exe
  2⤵
  PID:8616
- C:\Windows\System\EPayijI.exe
  C:\Windows\System\EPayijI.exe
  2⤵
  PID:6740
- C:\Windows\System\YlMvsii.exe
  C:\Windows\System\YlMvsii.exe
  2⤵
  PID:8732
- C:\Windows\System\wNZQWRD.exe
  C:\Windows\System\wNZQWRD.exe
  2⤵
  PID:8796
- C:\Windows\System\oJxXvyT.exe
  C:\Windows\System\oJxXvyT.exe
  2⤵
  PID:8860
- C:\Windows\System\ykJyQlK.exe
  C:\Windows\System\ykJyQlK.exe
  2⤵
  PID:8924
- C:\Windows\System\cNrcyLe.exe
  C:\Windows\System\cNrcyLe.exe
  2⤵
  PID:8988
- C:\Windows\System\mCCFBxj.exe
  C:\Windows\System\mCCFBxj.exe
  2⤵
  PID:8684
- C:\Windows\System\YAmFqZi.exe
  C:\Windows\System\YAmFqZi.exe
  2⤵
  PID:8940
- C:\Windows\System\sVfaXpZ.exe
  C:\Windows\System\sVfaXpZ.exe
  2⤵
  PID:8752
- C:\Windows\System\skZompn.exe
  C:\Windows\System\skZompn.exe
  2⤵
  PID:8844
- C:\Windows\System\lfeodKm.exe
  C:\Windows\System\lfeodKm.exe
  2⤵
  PID:8908
- C:\Windows\System\DJyHzmO.exe
  C:\Windows\System\DJyHzmO.exe
  2⤵
  PID:9004
- C:\Windows\System\ipbBnFf.exe
  C:\Windows\System\ipbBnFf.exe
  2⤵
  PID:9040
- C:\Windows\System\tsrlnhM.exe
  C:\Windows\System\tsrlnhM.exe
  2⤵
  PID:9072
- C:\Windows\System\lLdxjbQ.exe
  C:\Windows\System\lLdxjbQ.exe
  2⤵
  PID:9120
- C:\Windows\System\sEANXBR.exe
  C:\Windows\System\sEANXBR.exe
  2⤵
  PID:9184
- C:\Windows\System\SDbCBby.exe
  C:\Windows\System\SDbCBby.exe
  2⤵
  PID:9136
- C:\Windows\System\UDZnbUY.exe
  C:\Windows\System\UDZnbUY.exe
  2⤵
  PID:8372
- C:\Windows\System\rbbPhxW.exe
  C:\Windows\System\rbbPhxW.exe
  2⤵
  PID:9200
- C:\Windows\System\AHcRpCT.exe
  C:\Windows\System\AHcRpCT.exe
  2⤵
  PID:8244
- C:\Windows\System\GioPwAx.exe
  C:\Windows\System\GioPwAx.exe
  2⤵
  PID:8324
- C:\Windows\System\AOGccVX.exe
  C:\Windows\System\AOGccVX.exe
  2⤵
  PID:6436
- C:\Windows\System\ZngwWlg.exe
  C:\Windows\System\ZngwWlg.exe
  2⤵
  PID:8456
- C:\Windows\System\tAWkdOh.exe
  C:\Windows\System\tAWkdOh.exe
  2⤵
  PID:8564
- C:\Windows\System\oIxSgMM.exe
  C:\Windows\System\oIxSgMM.exe
  2⤵
  PID:8660
- C:\Windows\System\nBzKEGD.exe
  C:\Windows\System\nBzKEGD.exe
  2⤵
  PID:8472
- C:\Windows\System\LKMGZyd.exe
  C:\Windows\System\LKMGZyd.exe
  2⤵
  PID:8892
- C:\Windows\System\HGccGvi.exe
  C:\Windows\System\HGccGvi.exe
  2⤵
  PID:9020
- C:\Windows\System\fArvoQK.exe
  C:\Windows\System\fArvoQK.exe
  2⤵
  PID:8584
- C:\Windows\System\ngccXes.exe
  C:\Windows\System\ngccXes.exe
  2⤵
  PID:8784
- C:\Windows\System\ChQWOvO.exe
  C:\Windows\System\ChQWOvO.exe
  2⤵
  PID:9116
- C:\Windows\System\nzIhzTj.exe
  C:\Windows\System\nzIhzTj.exe
  2⤵
  PID:8876
- C:\Windows\System\nhAWAuY.exe
  C:\Windows\System\nhAWAuY.exe
  2⤵
  PID:8976
- C:\Windows\System\dVVGCgO.exe
  C:\Windows\System\dVVGCgO.exe
  2⤵
  PID:9180
- C:\Windows\System\AbtUKgX.exe
  C:\Windows\System\AbtUKgX.exe
  2⤵
  PID:8276
- C:\Windows\System\zqyFsRg.exe
  C:\Windows\System\zqyFsRg.exe
  2⤵
  PID:8408
- C:\Windows\System\caqptGR.exe
  C:\Windows\System\caqptGR.exe
  2⤵
  PID:9132
- C:\Windows\System\FbrqQta.exe
  C:\Windows\System\FbrqQta.exe
  2⤵
  PID:8632
- C:\Windows\System\WEZskmr.exe
  C:\Windows\System\WEZskmr.exe
  2⤵
  PID:8704
- C:\Windows\System\TUKbyXZ.exe
  C:\Windows\System\TUKbyXZ.exe
  2⤵
  PID:8960
- C:\Windows\System\AtGUrTX.exe
  C:\Windows\System\AtGUrTX.exe
  2⤵
  PID:7948
- C:\Windows\System\YnYmwDM.exe
  C:\Windows\System\YnYmwDM.exe
  2⤵
  PID:9068
- C:\Windows\System\aQIljeD.exe
  C:\Windows\System\aQIljeD.exe
  2⤵
  PID:9056
- C:\Windows\System\HuEzTIh.exe
  C:\Windows\System\HuEzTIh.exe
  2⤵
  PID:8748
- C:\Windows\System\aMvWvwd.exe
  C:\Windows\System\aMvWvwd.exe
  2⤵
  PID:8500
- C:\Windows\System\VvccAju.exe
  C:\Windows\System\VvccAju.exe
  2⤵
  PID:7868
- C:\Windows\System\bZNwzHw.exe
  C:\Windows\System\bZNwzHw.exe
  2⤵
  PID:6756
- C:\Windows\System\EDrYdoh.exe
  C:\Windows\System\EDrYdoh.exe
  2⤵
  PID:8720
- C:\Windows\System\cUYiGZk.exe
  C:\Windows\System\cUYiGZk.exe
  2⤵
  PID:8816
- C:\Windows\System\JGfIpsm.exe
  C:\Windows\System\JGfIpsm.exe
  2⤵
  PID:9036
- C:\Windows\System\ZduPyQv.exe
  C:\Windows\System\ZduPyQv.exe
  2⤵
  PID:8536
- C:\Windows\System\YZetiRv.exe
  C:\Windows\System\YZetiRv.exe
  2⤵
  PID:9220
- C:\Windows\System\qkBlQFz.exe
  C:\Windows\System\qkBlQFz.exe
  2⤵
  PID:9236
- C:\Windows\System\jxfEYsW.exe
  C:\Windows\System\jxfEYsW.exe
  2⤵
  PID:9252
- C:\Windows\System\ybIbWXC.exe
  C:\Windows\System\ybIbWXC.exe
  2⤵
  PID:9268
- C:\Windows\System\XdCeTgu.exe
  C:\Windows\System\XdCeTgu.exe
  2⤵
  PID:9284
- C:\Windows\System\zOWyPvc.exe
  C:\Windows\System\zOWyPvc.exe
  2⤵
  PID:9300
- C:\Windows\System\aBYgess.exe
  C:\Windows\System\aBYgess.exe
  2⤵
  PID:9316
- C:\Windows\System\YFIdsIu.exe
  C:\Windows\System\YFIdsIu.exe
  2⤵
  PID:9332
- C:\Windows\System\fSyjTzD.exe
  C:\Windows\System\fSyjTzD.exe
  2⤵
  PID:9348
- C:\Windows\System\vviweDV.exe
  C:\Windows\System\vviweDV.exe
  2⤵
  PID:9364
- C:\Windows\System\ORlhziH.exe
  C:\Windows\System\ORlhziH.exe
  2⤵
  PID:9380
- C:\Windows\System\iJtQVhy.exe
  C:\Windows\System\iJtQVhy.exe
  2⤵
  PID:9396
- C:\Windows\System\nTwsYOS.exe
  C:\Windows\System\nTwsYOS.exe
  2⤵
  PID:9412
- C:\Windows\System\YiobhMI.exe
  C:\Windows\System\YiobhMI.exe
  2⤵
  PID:9428
- C:\Windows\System\CDJmhDk.exe
  C:\Windows\System\CDJmhDk.exe
  2⤵
  PID:9444
- C:\Windows\System\mEWuLhE.exe
  C:\Windows\System\mEWuLhE.exe
  2⤵
  PID:9460
- C:\Windows\System\EILfafV.exe
  C:\Windows\System\EILfafV.exe
  2⤵
  PID:9476
- C:\Windows\System\xRhuBfz.exe
  C:\Windows\System\xRhuBfz.exe
  2⤵
  PID:9492
- C:\Windows\System\tMCduds.exe
  C:\Windows\System\tMCduds.exe
  2⤵
  PID:9508
- C:\Windows\System\mWwFAOO.exe
  C:\Windows\System\mWwFAOO.exe
  2⤵
  PID:9524
- C:\Windows\System\DCpIhZn.exe
  C:\Windows\System\DCpIhZn.exe
  2⤵
  PID:9540
- C:\Windows\System\kKcdbjR.exe
  C:\Windows\System\kKcdbjR.exe
  2⤵
  PID:9556
- C:\Windows\System\EEbJcWR.exe
  C:\Windows\System\EEbJcWR.exe
  2⤵
  PID:9572
- C:\Windows\System\iEGUaXo.exe
  C:\Windows\System\iEGUaXo.exe
  2⤵
  PID:9588
- C:\Windows\System\azaVIcY.exe
  C:\Windows\System\azaVIcY.exe
  2⤵
  PID:9604
- C:\Windows\System\QgyUnwO.exe
  C:\Windows\System\QgyUnwO.exe
  2⤵
  PID:9620
- C:\Windows\System\QqZttpI.exe
  C:\Windows\System\QqZttpI.exe
  2⤵
  PID:9636
- C:\Windows\System\znWDjpj.exe
  C:\Windows\System\znWDjpj.exe
  2⤵
  PID:9652
- C:\Windows\System\fIbzlWT.exe
  C:\Windows\System\fIbzlWT.exe
  2⤵
  PID:9668
- C:\Windows\System\eigqovS.exe
  C:\Windows\System\eigqovS.exe
  2⤵
  PID:9684
- C:\Windows\System\IxKLpmi.exe
  C:\Windows\System\IxKLpmi.exe
  2⤵
  PID:9700
- C:\Windows\System\OVwunrD.exe
  C:\Windows\System\OVwunrD.exe
  2⤵
  PID:9716
- C:\Windows\System\kvinTqZ.exe
  C:\Windows\System\kvinTqZ.exe
  2⤵
  PID:9732
- C:\Windows\System\shWwNWO.exe
  C:\Windows\System\shWwNWO.exe
  2⤵
  PID:9748
- C:\Windows\System\SSQMxrF.exe
  C:\Windows\System\SSQMxrF.exe
  2⤵
  PID:9764
- C:\Windows\System\kqYqcrx.exe
  C:\Windows\System\kqYqcrx.exe
  2⤵
  PID:9780
- C:\Windows\System\OzTeDlw.exe
  C:\Windows\System\OzTeDlw.exe
  2⤵
  PID:9796
- C:\Windows\System\UWdMdWe.exe
  C:\Windows\System\UWdMdWe.exe
  2⤵
  PID:9812
- C:\Windows\System\wlmJkRe.exe
  C:\Windows\System\wlmJkRe.exe
  2⤵
  PID:9828
- C:\Windows\System\DlOfiIq.exe
  C:\Windows\System\DlOfiIq.exe
  2⤵
  PID:9844
- C:\Windows\System\ZcBjnYK.exe
  C:\Windows\System\ZcBjnYK.exe
  2⤵
  PID:9860
- C:\Windows\System\FNdXBwW.exe
  C:\Windows\System\FNdXBwW.exe
  2⤵
  PID:9876
- C:\Windows\System\zYXfnrZ.exe
  C:\Windows\System\zYXfnrZ.exe
  2⤵
  PID:9892
- C:\Windows\System\eXzZZOP.exe
  C:\Windows\System\eXzZZOP.exe
  2⤵
  PID:9908
- C:\Windows\System\XGbYvvS.exe
  C:\Windows\System\XGbYvvS.exe
  2⤵
  PID:9924
- C:\Windows\System\gSvyxPm.exe
  C:\Windows\System\gSvyxPm.exe
  2⤵
  PID:9940
- C:\Windows\System\zjAlfOK.exe
  C:\Windows\System\zjAlfOK.exe
  2⤵
  PID:9956
- C:\Windows\System\deUuXZC.exe
  C:\Windows\System\deUuXZC.exe
  2⤵
  PID:9972
- C:\Windows\System\lYlMlGI.exe
  C:\Windows\System\lYlMlGI.exe
  2⤵
  PID:9988
- C:\Windows\System\wZpbvmH.exe
  C:\Windows\System\wZpbvmH.exe
  2⤵
  PID:10004
- C:\Windows\System\EJrfMrF.exe
  C:\Windows\System\EJrfMrF.exe
  2⤵
  PID:10020
- C:\Windows\System\axdpgwg.exe
  C:\Windows\System\axdpgwg.exe
  2⤵
  PID:10036
- C:\Windows\System\FdjtUnt.exe
  C:\Windows\System\FdjtUnt.exe
  2⤵
  PID:10052
- C:\Windows\System\kqhMXHD.exe
  C:\Windows\System\kqhMXHD.exe
  2⤵
  PID:10072
- C:\Windows\System\FYuhIHK.exe
  C:\Windows\System\FYuhIHK.exe
  2⤵
  PID:10088
- C:\Windows\System\gbXMeiC.exe
  C:\Windows\System\gbXMeiC.exe
  2⤵
  PID:10104
- C:\Windows\System\WwKdWca.exe
  C:\Windows\System\WwKdWca.exe
  2⤵
  PID:10120
- C:\Windows\System\GGkGQbC.exe
  C:\Windows\System\GGkGQbC.exe
  2⤵
  PID:10136
- C:\Windows\System\cyRRrVF.exe
  C:\Windows\System\cyRRrVF.exe
  2⤵
  PID:10152
- C:\Windows\System\KvuhvVF.exe
  C:\Windows\System\KvuhvVF.exe
  2⤵
  PID:10168
- C:\Windows\System\ExsAlzr.exe
  C:\Windows\System\ExsAlzr.exe
  2⤵
  PID:10184
- C:\Windows\System\ltihgMp.exe
  C:\Windows\System\ltihgMp.exe
  2⤵
  PID:10200
- C:\Windows\System\nXagaKr.exe
  C:\Windows\System\nXagaKr.exe
  2⤵
  PID:10216
- C:\Windows\System\yvURYOX.exe
  C:\Windows\System\yvURYOX.exe
  2⤵
  PID:10232
- C:\Windows\System\yQwOwBW.exe
  C:\Windows\System\yQwOwBW.exe
  2⤵
  PID:8972
- C:\Windows\System\pkHHjpt.exe
  C:\Windows\System\pkHHjpt.exe
  2⤵
  PID:9244
- C:\Windows\System\aouHfpt.exe
  C:\Windows\System\aouHfpt.exe
  2⤵
  PID:9292
- C:\Windows\System\UsSNlHq.exe
  C:\Windows\System\UsSNlHq.exe
  2⤵
  PID:9324
- C:\Windows\System\jsoncAo.exe
  C:\Windows\System\jsoncAo.exe
  2⤵
  PID:9312
- C:\Windows\System\wACRhGd.exe
  C:\Windows\System\wACRhGd.exe
  2⤵
  PID:9388
- C:\Windows\System\kCydoCm.exe
  C:\Windows\System\kCydoCm.exe
  2⤵
  PID:9424
- C:\Windows\System\lhOPLwB.exe
  C:\Windows\System\lhOPLwB.exe
  2⤵
  PID:9408
- C:\Windows\System\FkSzlJX.exe
  C:\Windows\System\FkSzlJX.exe
  2⤵
  PID:9472
- C:\Windows\System\wcyBvsP.exe
  C:\Windows\System\wcyBvsP.exe
  2⤵
  PID:9468
- C:\Windows\System\GFKRoET.exe
  C:\Windows\System\GFKRoET.exe
  2⤵
  PID:9580
- C:\Windows\System\nBIhnvZ.exe
  C:\Windows\System\nBIhnvZ.exe
  2⤵
  PID:9532
- C:\Windows\System\kACumom.exe
  C:\Windows\System\kACumom.exe
  2⤵
  PID:9596
- C:\Windows\System\zRXfhcW.exe
  C:\Windows\System\zRXfhcW.exe
  2⤵
  PID:9644
- C:\Windows\System\jtBJBlM.exe
  C:\Windows\System\jtBJBlM.exe
  2⤵
  PID:9648
- C:\Windows\System\RnioYea.exe
  C:\Windows\System\RnioYea.exe
  2⤵
  PID:9696
- C:\Windows\System\zJixNfH.exe
  C:\Windows\System\zJixNfH.exe
  2⤵
  PID:9744
- C:\Windows\System\xNQHhNu.exe
  C:\Windows\System\xNQHhNu.exe
  2⤵
  PID:9808
- C:\Windows\System\Gxidsnd.exe
  C:\Windows\System\Gxidsnd.exe
  2⤵
  PID:9868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ANjmamj.exe

Filesize
1.9MB

MD5
5e12ae3a6c292745afc03426f221bde4

SHA1
25a511b3387a8a8b28f13a838319c021751c8800

SHA256
b6e9e1f45d12894541a88d0f0728af4e72436df73df105580ed58a0abb250cde

SHA512
173ac7a525788411052bd746cf583d0a0938bf0d43767b8ee546ecdd785f28c772e3208386b743db01956959a5bad61bdbdb27d4fde2f4d54c6ff382f0c81513

Download Submit
C:\Windows\system\DmgkROb.exe

Filesize
1.9MB

MD5
8750c072089ffbdc9a57aa503809779b

SHA1
bd422190838b5cd3c05219be799109e4e057ac84

SHA256
88ae9e10ef835f92f5bd468fa3b32f270af42046b76104d3c294fb69684d966e

SHA512
dea410b1791def0da14f4376a24685b69c66561f22b8a7916db044d36d02508ea9d4fb2b2a276050f0590a3494527dbb0ab32984666bcea5c007426af0dc9bcc

Download Submit
C:\Windows\system\JlnuGeI.exe

Filesize
1.9MB

MD5
55efde12210453749a75e137da725327

SHA1
d628ddc4fb177705a207eb173bcd96babc8c7d2b

SHA256
bc9e138bdd1fb30291b2c517f89cf226c266c531422b3f4067c073465ff72949

SHA512
fc5993cd540a04407915a4527edf6a94fbb2d0c94e85adf0ed0c46227f3b4ad70ed945ceff182f4db81c7824e9b391e37ec5e0ed411047270577ed98668d39a6

Download Submit
C:\Windows\system\NUruPrQ.exe

Filesize
1.9MB

MD5
8f0f26b88a7a1c362b91b0fe36ffb479

SHA1
928f04bbc7f45936ad2eebf3e079890c183ac53e

SHA256
0aeb9372a542c5f3d4889047219238ef02ced466d375d257546b64d871922690

SHA512
6fcfd83d66a6262b676e696fcebe8071d8afe6976b5df73161147f94fa39715f199d18eb12ce171d2e373c91518f8ca5e5c41e56bc4ffe71e59c0fbf01e3c23a

Download Submit
C:\Windows\system\PnAHpJI.exe

Filesize
1.9MB

MD5
8840a5f46ed869311365abb31693fcac

SHA1
41b37f6e99857a58564641c7177a40cabbb91a2c

SHA256
6598dac79817d7d46acf185c1eb1678f99835d18e17c2de7dbbb52e18e639236

SHA512
bd3666488b60f6a02548cf237e8780b95efc1e53a820ce82d5036f927568376db4d17e79c5f6da4d53b68461cf97f3f9c3ce120750c7897071f0dceb4add2605

Download Submit
C:\Windows\system\QNQgAdu.exe

Filesize
1.9MB

MD5
8ac611bf16cfc303e2a93855a88a0d91

SHA1
86facc50c78b6d70abf995d72595fd6209704601

SHA256
650140d70d4d1ac2fdf139ea8c069e2bf4499109e810df13f03eb69612e33602

SHA512
ba18225f0189bfd50221e2a7f0ee76120ac746b904e6155e910e8fb384c8d0a5d5b7481368f78d8a4a7fbed3509f452e17bca7a75fcac7024df212f79b68b55d

Download Submit
C:\Windows\system\QTqmeki.exe

Filesize
1.9MB

MD5
5b8bc5b0e807d9b14e848f0fd5cff8a9

SHA1
ed44cfda40a743a7e57547f9d0d707f2ccbc3f48

SHA256
9b61034bcede0aa7d304e2951fac01d5e3720ba244069d252c5c24a43500b823

SHA512
006cbef88532bb29619b4b864adf2aca4e2df6d4c58b39da018d2edfea731c148c7995b42fa3cc42f4cac0d0c1afce33f469c6aebcc5de9c00ca3ce4c53ecd25

Download Submit
C:\Windows\system\Rexysmj.exe

Filesize
1.9MB

MD5
19252230715fdc97c47a2e52c4a95b0a

SHA1
b499ec83c7ed29508f693e4a6d3224dc88aeec35

SHA256
470713ba1d972ad4b2e30e9594c290f20bebd92793731b9c9d48097e1c3ffa14

SHA512
97e5b7840e5b2c6f8b1da9069192348f63b80b63e6a31b2cf8899c50af7a15a82a15db700c24b2c269ca5be4eb1158163d272a0712a11dd82c35f627e1a24b8b

Download Submit
C:\Windows\system\SJRGqTK.exe

Filesize
1.9MB

MD5
5df742db74709e0db11130bbbfe4cb52

SHA1
37c04ca227474d0916c39f723f74486a1a8ac442

SHA256
089364858a5825291cc008cc654282ec630f99c8643be07012414d0ca0bb8091

SHA512
3d83a9b3fc7eb6807c615d09836d29ae490b62290a8116678642a04910c1885ac4cd6075ca1946c10cb9db36700d8a28b0af084db237dd41dbc9f3796264d8de

Download Submit
C:\Windows\system\TlOIQSd.exe

Filesize
1.9MB

MD5
616b2e4cec6ee5f2a8f7d06a929ffeb8

SHA1
f6cfc42dff0c2719d6e94c8af6ee8dfc6f2be4cc

SHA256
16bb9abd4a78fdc90533b7315584b8d203569278a6cf8f832ba1583e8c56d7f3

SHA512
34af5dd7b9ff14d86b8c78ffc6db88cd57f0b443b35f06d2ca77fa37f2a249e276047274be18e3e68effd3657b541e18a0837f76e06d1ef87c8c75d5865dc6ea

Download Submit
C:\Windows\system\TtikmMF.exe

Filesize
1.9MB

MD5
15961ebb97d46de8c13f54b8e7d1ccf1

SHA1
d99d67b7146a92fdb34e61b464ad57becc7026d7

SHA256
848163d76eecc15c86d1c9ae54d53f97dddfde31b9e44e8d5f7ad440fc2b7a68

SHA512
9daf304dc9fb4ba4a263ee5982af0b0ae6ec749b7fcc3fda132cbd4275f3cc87b4bf92e2e8cc6bb830208d87eed5aa25e2764cc0aca4eeda410fda02fcecf79c

Download Submit
C:\Windows\system\UWuIkDZ.exe

Filesize
1.9MB

MD5
e6f96e5f7c0cc649073707abae2dff24

SHA1
719d0ce3f5f1d2ad22c3fd3c225c408beaf8d000

SHA256
a45a701399ddd0d813753c7c584e9471f216c73b22105ba214165935200931e8

SHA512
70d4742c0ceaf36b4844a32f95be83fa2b06c87565a47fcd306e3672de749f49afc385cf150f2fdf42c52dcf485ca9180c702d00f9790803ecb02231ecbcb32f

Download Submit
C:\Windows\system\XGibRAz.exe

Filesize
1.9MB

MD5
0aa6031bc24213d62cff3b8ffe6eb72d

SHA1
63a97183634e05eb57ec0ae5ac92d9b916e89cd1

SHA256
09993280902bd7381f219633da859a110cbabc67694deb89ff7972afdaf04f18

SHA512
c759bad785d7dc59a235085b6e2dfbdc282e8ab60e22bb8f6327be5683ba0424e0f0522052e5930e8debdbba15097f2a4593930c512009742bd15679bfd6289d

Download Submit
C:\Windows\system\XGlWqda.exe

Filesize
1.9MB

MD5
69d8071cf0743a4a631433037e6db849

SHA1
95bde8ed727413eca26a6002398951b89969f735

SHA256
628d0e37973d07e825a4fd2be40e818c0acf693d466c42486ec6d583a63f62ea

SHA512
ae14559620ff1f2faf753422ea86dedcf225aabfc627fcb5273c16fcb3fe32af1e00d521e3d179132d886fe12a11a49b901b5ce2a3cb8d5c1c845be2ad7b4ad9

Download Submit
C:\Windows\system\bKkECNP.exe

Filesize
1.9MB

MD5
73c5dc92aef071505a521f7a4fc9fac1

SHA1
f8411e48041ef7484de65fd3e3b6112414277655

SHA256
c4f3dbba800e221809170dabc639db8d29827e8630d3610e3112fc52f1cfbb21

SHA512
dde0b778d5a60ba333c5053edb783b6844b00192927f6ca305b870b5374e2895a0496114d87ccd023308cc766403c8feae5336036aa2a06b778d1dafee788a2d

Download Submit
C:\Windows\system\eGmrPNx.exe

Filesize
1.9MB

MD5
f656d333c7e5c20e77fd4f1a4aa9ee01

SHA1
3dd7186becbd7d79bc968168458fac5d16b9bae7

SHA256
c6cb003a4a5eea65ce6383c1e3e2cdcf38d158c6aaabf79a9053253002c5d686

SHA512
2315cc6c049c05d40a114b0b1cbfb1bace32e94428422564812e99472857ed49f0475ccf7a167cdc3994596572b2091c5f400a06a0af66198d0ebefe9cc4aa70

Download Submit
C:\Windows\system\gAjpBLy.exe

Filesize
1.9MB

MD5
3a79f38539c5901d43cada69d221211b

SHA1
3f4ad4de4d35e778dcccbe55225204cdac6e2f61

SHA256
6c56f7e8c4bb17020276f598a35fc94290db9d78c274feaec5940f7a5ea7362e

SHA512
a74748c33a6c02fc8883d2c6d9f2adcc92ec50f62e8deee77093e04e7d46731f77500e63f0c17b6cfaee89988ddd8aaac228aa406ce513aafa0f4c745f89c676

Download Submit
C:\Windows\system\gomrawf.exe

Filesize
1.9MB

MD5
b7b8222f7726adb25d0591024420c2e4

SHA1
831b1ccda3fd5380c0ecda3cb73f4f995a196e7a

SHA256
c6d5c679f520960d586c197fc0cee9cf7eea4a08cdaac1de07158e3fd7d51e66

SHA512
498c2247c188a71252b9c7da2a22c07c327f693fdc2603286dcb27f88d89e2e8a21556f6b945706147051ceb7a04b08f07698aa8addb82f0c23deb383316c4b4

Download Submit
C:\Windows\system\jFnFVRy.exe

Filesize
1.9MB

MD5
9366eee6eeae338baad2af433135b0ca

SHA1
679c6f91a8d8af82f84a26e5f6f821436c566ee3

SHA256
8e62c04690ee613d08d21217b8621e9fa66db36023bd2aa5e11b710fdf478bda

SHA512
4ae4fca772f2e5e3ef197c6fe10657410bdb398658797a28bc967a9bd5f9b1984080886303a8fbc2a4a9e0616a3f41a3dfcb3fbc3c5fdc5a7b10bbfa39247fd8

Download Submit
C:\Windows\system\mXoCzYx.exe

Filesize
1.9MB

MD5
96cab51288f8ff7346c7a387a1810e3a

SHA1
c2218df437d743f1f2f78b124f75d0569772834f

SHA256
484b3170c1737d245d260533fa519a0e6eb11e17d9924ef0814cc81f9340b42b

SHA512
4075020792c458cf539f1a7214fd6a5218e00f3112d8a1a9f3991d2c1f7e2dd45001448630ab5bfd979bc3b4270001f50a6643ad2d65ca3ab737a6bb8397004f

Download Submit
C:\Windows\system\oWIcGun.exe

Filesize
1.9MB

MD5
4f8adb63e399bd63328d75f4f01e6254

SHA1
8fa85ab9242193c437bc6d42a1d37d66920120ac

SHA256
44e375a1f3b84cc3343842edd69ac716dc1d44ed829588992cf98cacb8caf915

SHA512
13cf01b215dff955425ae8601f0ab78f306a7ca300e2185bbb5cae7853a3b26e6480bd250789964c734cc3b21ce82df8395c888eb3d67a68f29ba828a63d1c4e

Download Submit
C:\Windows\system\sWMQbZI.exe

Filesize
1.9MB

MD5
5c63c6d878ddcfc2ab3fcf0110045860

SHA1
b330c1d33369f866d0ad01e06d00a95e939c32e1

SHA256
1553d407522c3e508812cf043194ce24184c4d7f11a793a3fed14ca74f7c4fad

SHA512
93540ca82a37616738d5bc55672cb52f70abc9df57c40d45d1a5311758582558cadf0584860a74e488d2017d660f28576acac5e799eb689dd52c9179a9e05a65

Download Submit
C:\Windows\system\weuLqei.exe

Filesize
1.9MB

MD5
9cd018972e10216413dcdde96ae655d6

SHA1
801abaa545a8440453c840a3d3476325ec14c555

SHA256
8c9a7a76035c68da78bac58a53050d6a65b76e57783bf9e0b1ef6796e02b4c8c

SHA512
e25e39338c0edc73ee443d36268d711dff26c34749a47b9d7650640e1b0a6262c2c40c0a439cc692f452f7def5a144c1dd3509dfb79ef6ce0494ffe661ef7d2a

Download Submit
\Windows\system\PodGeqS.exe

Filesize
1.9MB

MD5
81d2a033fb00f5234f5cde8e9c6e3b77

SHA1
17d423269299f8724e1cc181b8859b7a5b715bf4

SHA256
c2cbf3a3eb0e3db8a15f5f0e74d69233b2ba4ab6fa861e1429b1ecf94f21a0a0

SHA512
1fe8e9f1e7906232f4f12d17d4401384e069b2b3da87bcbf7ce30be9a33ade67f100c55c2d344e79409b72021271b35c4c0812ba3ada266775d9f2a6907d0185

Download Submit
\Windows\system\YDwybCC.exe

Filesize
1.9MB

MD5
e14484e209f73f41ee11dce7ce38b5f3

SHA1
5bef042cc5673021148c7732bfa0d41c207fa237

SHA256
18841fbf7e039ef2b44e7ce147fbb3c4b2e239e6f6cb1703a0b844beb1f4d6c4

SHA512
389edaec6b7d8d9c94cc9f1190aac4cd3405de861cead0c663ea8dee21f104e08deb310367490b26ac9012930441fbf7cbbcf96a300e3c21fd84d38041d57881

Download Submit
\Windows\system\ZGWBJUO.exe

Filesize
1.9MB

MD5
0fdef7e7b916c97039ee700839ba0960

SHA1
19c430c1ecf7cd26d8b5326902074ed4b1df0064

SHA256
a76c588c95a5b957ce2f90fd9ce7b5f9d7087848aa8858f544d8f0a069d84959

SHA512
6c88562b56d42ea7a36d630b2c1309e91b4bfedef5eea76f7de70e05b31db070ab3e108e11ff0a568ffa4954ab21af7b3b42dbe4a02e51aaea6eaca311c96d9a

Download Submit
\Windows\system\bsFOLnv.exe

Filesize
1.9MB

MD5
b1090bf676fc8b0e24a827767dbeb53e

SHA1
145e484b90a93d90784b2c26c40cf513139881aa

SHA256
1a5658810bc36c701cdced62b2aab58f6d03aa31d69aae63a88371209aef31c8

SHA512
2b46521ee7976c83eef0dea4af565b2bd00941cc2c30f2d7e0073cd7cee71d78957dcc29d18c84c572e2fefead46878930b704178e605b8482fbd6a303a5708f

Download Submit
\Windows\system\dXksKVi.exe

Filesize
1.9MB

MD5
1b4f96f68111935f1e135b35c9255f36

SHA1
d22fb69b25a129ec02d481d509616ea4c31bab44

SHA256
358aa161d1f824e930ba0f5fe24e78ed4062b5c45553eed0c4aaaccff0bbbe8a

SHA512
749a3463f14ce69b1f26782539e7605a694600ecdcefc035de9c3287de8cdfcc3f7f219303ee893d9d86ffdd35bcb7876b1e3442e958d49e859f2754799b4936

Download Submit
\Windows\system\fjJYFKB.exe

Filesize
1.9MB

MD5
b27745e04c0e0dc1563b7c43aafc4d52

SHA1
cdab7acf4c5bcdd2b44c5786e3181bba9c0bc601

SHA256
41c0153e4ec6246129bd41f9cb1e701758523ac805564688dc0de76f72182192

SHA512
53b8dfe385b424d9d02d7a3d82fea5dcf2e011dea7835518c9a699d6b8c151d783201959e6d8e6d327d212060ad8903de51bcf68ceb9e8705b389d3367b593be

Download Submit
\Windows\system\pXTldKU.exe

Filesize
1.9MB

MD5
bdd12bd96df28dab9e09eaae4538edf9

SHA1
d5efc0affc356352aaae16c825d04ca6cd8866db

SHA256
817cd94e15a470c344c95e5a72db356ffec171efb9f7c913e8ae94299b79aba6

SHA512
9080382edc700f2510bbc0efefaf0165f4e6ca61388601f20eaeddd916342eec96097ee416d33df24343a28b4b71287d152cbe040535d819b325ae529bc10555

Download Submit
\Windows\system\rXqDNsR.exe

Filesize
1.9MB

MD5
e42fb9a3712db9a27cea2e7e539ac1ec

SHA1
48d3be4f42f5ae540123c668181ef73f6ecd5263

SHA256
441a68a8bf9cff2008c2f68db81d3e11087795b02a925a39151ee27a374ae87c

SHA512
af3fc9f13fe3c50cbe1573c6ef0e8af1a636426115275d2af2a465d954e589598bcda48044d119a5b788335f5ef1dfc06fa03ccc71c8a3a0d4cc8c43a23c7553

Download Submit
\Windows\system\wvDxmYt.exe

Filesize
1.9MB

MD5
8a877fca398b680c15cb930641d4e712

SHA1
07d53695f00f4b617cf331ffda9f858d69b01ce2

SHA256
d8bd25669e8c5010e4b62fbf5d5260caed4aeccdfd72469822a4247c1bb8057c

SHA512
b772edeadd7e285c4f87313b857805165bb8cbd66c5f3a59c77c7ba15cf65590b04a26558431c07236efbc7829f06c4d2ce8ae3ce1023b968d2205f49274982a

Download Submit
\Windows\system\zbznOlb.exe

Filesize
1.9MB

MD5
e7d87fcf0f8c596203f72a1a4bd15bba

SHA1
6b2552590cc1313fb90ef61227449849d267d181

SHA256
d4a2d9fa1769085d38abbfb19918f17dd1bb53d3fd46e9f73d1dc931dda15f15

SHA512
4d55cd148097cd5ae1761061f1806bb6961be5cf9059ac12e760f803d6976a626a59a01d3499e5548a202d1bda535a2e0ef2b8899b45a03f6b80b9f1b7f7d50d

Download Submit
memory/1472-82-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2428-63-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2508-58-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-69-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-65-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-64-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2764-60-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2796-52-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2856-77-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-62-0x0000000003340000-0x0000000003732000-memory.dmp

Filesize
3.9MB

Download
memory/2856-76-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2856-68-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2856-2277-0x0000000003340000-0x0000000003732000-memory.dmp

Filesize
3.9MB

Download
memory/2856-1876-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2856-1880-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-0-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2856-54-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-66-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-55-0x0000000003340000-0x0000000003732000-memory.dmp

Filesize
3.9MB

Download
memory/2856-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2856-59-0x0000000003340000-0x0000000003732000-memory.dmp

Filesize
3.9MB

Download
memory/2856-11-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-61-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-87-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/2956-14-0x0000000002E10000-0x0000000002E90000-memory.dmp

Filesize
512KB

Download
memory/2956-56-0x0000000002E10000-0x0000000002E90000-memory.dmp

Filesize
512KB

Download
memory/2956-22-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2956-67-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/2956-34-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2956-50-0x0000000002E10000-0x0000000002E90000-memory.dmp

Filesize
512KB

Download
memory/2956-49-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/3060-13-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/3060-1879-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download