xmrig | c204a13dc017d0fbbde9be61cc2f8abb7689974c4b137bab96d1fefcd1c8fe61

Analysis

max time kernel
20s
max time network
21s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 08:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
Size

2.3MB
MD5

074740a43d85864ee32cf2cdf44e73b0
SHA1

3cb934784b3d1d8a95a102f9698a6b76feb93aa2
SHA256

c204a13dc017d0fbbde9be61cc2f8abb7689974c4b137bab96d1fefcd1c8fe61
SHA512

71575c14650911bb1e77ac34df1517275027001c7afbbb6ad20fed989a8fb0754c524ec6ca9e720fac04f25b9e49e4953637f0f05fff531650e64024022a012f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cRbW:NABE

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2684-23-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2552-26-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/2616-33-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig
behavioral1/memory/1476-49-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/2012-85-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/380-74-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2520-61-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2408-58-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig
behavioral1/memory/2468-67-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/3056-28-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2552	TUAEjvU.exe
2684	iUyknmT.exe
3056	PmrUIIR.exe
2616	ofZWCPD.exe
1476	FMqNTpo.exe
2520	nsoiYCF.exe
2408	OWCCwPR.exe
2468	uKQBbCs.exe
380	ZRWoJBW.exe
2796	oFGQzpz.exe
2824	vFIrgoO.exe
2964	WRwduVI.exe
2380	kwMAWPz.exe
1256	pinxWIS.exe
2664	vwjbNlL.exe
2792	otKduPs.exe
356	rPCWKDw.exe
1532	gsknLzp.exe
2036	nDXwjmK.exe
1608	XXnXwxg.exe
2348	NexeJAO.exe
1056	BmqMEjf.exe
2644	ARxcNBt.exe
1800	ILmEwIF.exe
2368	pcnDgrd.exe
1628	FSDBRaI.exe
1948	wnmkwKM.exe
1696	nkyhSSX.exe
1572	avMUGkX.exe
2060	MqeedQF.exe
2888	gWQxeyI.exe
2160	IWzSgfq.exe
1624	BeVMUkL.exe
400	vVuUrec.exe
1200	iDRcsBK.exe
884	SEoBFPp.exe
3000	fGPdxdY.exe
1984	DzLuRYw.exe
3052	gjRTelt.exe
1520	IPlywQC.exe
2432	MqDWncz.exe
2688	dwMPFce.exe
2932	OGmfsvy.exe
2640	jViWygp.exe
2504	ArRXsdP.exe
2908	MEEcjKz.exe
2388	tcgjwew.exe
2844	wMKSydC.exe
312	lKQBKgZ.exe
2712	rXvZRlH.exe
1552	VZrlsTe.exe
3096	nwbaTWq.exe
3128	NESHYea.exe
3160	QgzKiCF.exe
3192	niDxXYo.exe
3224	spPGQsh.exe
3256	awSaODF.exe
3288	gYAtAKx.exe
3320	PJTquOS.exe
3352	rqodezp.exe
3384	SozLKjk.exe
3416	uPNdTAN.exe
3448	uiOiaGU.exe
3480	rdFVYGn.exe

Loads dropped DLL 64 IoCs

pid	Process
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2012-0-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x000b00000001430e-4.dat	upx
behavioral1/files/0x000700000001470b-17.dat	upx
behavioral1/memory/2684-23-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/2552-26-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/memory/2616-33-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/files/0x001400000000549e-37.dat	upx
behavioral1/memory/1476-49-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/files/0x0006000000015c7c-51.dat	upx
behavioral1/files/0x0006000000015c86-68.dat	upx
behavioral1/files/0x0006000000015cb9-86.dat	upx
behavioral1/files/0x0006000000015cca-97.dat	upx
behavioral1/files/0x0006000000015cec-103.dat	upx
behavioral1/files/0x0006000000015d06-113.dat	upx
behavioral1/files/0x0006000000015cdb-135.dat	upx
behavioral1/files/0x0006000000016525-168.dat	upx
behavioral1/files/0x0006000000016c26-185.dat	upx
behavioral1/files/0x0006000000016a45-177.dat	upx
behavioral1/files/0x0006000000016597-169.dat	upx
behavioral1/files/0x0006000000016411-161.dat	upx
behavioral1/files/0x0006000000015cf7-156.dat	upx
behavioral1/files/0x00060000000160f8-152.dat	upx
behavioral1/files/0x003400000001450b-143.dat	upx
behavioral1/files/0x0006000000015cc1-89.dat	upx
behavioral1/files/0x0006000000015f1b-136.dat	upx
behavioral1/memory/2012-85-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x0006000000015ca5-84.dat	upx
behavioral1/files/0x0006000000015cad-81.dat	upx
behavioral1/memory/380-74-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/files/0x0006000000015c9c-73.dat	upx
behavioral1/memory/2520-61-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2408-58-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/files/0x0007000000015c6d-56.dat	upx
behavioral1/files/0x000a000000014b12-54.dat	upx
behavioral1/files/0x0006000000015d5d-118.dat	upx
behavioral1/files/0x0006000000016c2e-190.dat	upx
behavioral1/files/0x0006000000016c17-183.dat	upx
behavioral1/files/0x00060000000167ef-175.dat	upx
behavioral1/files/0x0006000000016277-160.dat	upx
behavioral1/files/0x0006000000016056-150.dat	upx
behavioral1/files/0x0006000000015f9e-142.dat	upx
behavioral1/files/0x0006000000015d6e-132.dat	upx
behavioral1/memory/2824-98-0x000000013F270000-0x000000013F662000-memory.dmp	upx
behavioral1/memory/2796-69-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/memory/2468-67-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/files/0x0007000000014817-40.dat	upx
behavioral1/memory/3056-28-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/files/0x0007000000014701-24.dat	upx
behavioral1/files/0x00350000000144e9-16.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dWWuVNe.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\gCoYhFl.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\fNrSiZO.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\JYJEMbW.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\pyxaygn.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\hBVvqzE.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\AyYBwHt.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\kyexatw.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\ffqnbJP.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\RdKZHCA.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\yFVRPFt.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\VWiobuI.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\XnwEFwc.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\MzRHBqH.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\RAwLUGO.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\iebOqIk.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\RNcYEDi.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\DzZyfGp.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\bQsEnBg.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\PwHZYJT.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\YoSdpsp.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\QlWTyOU.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\XNaMWuY.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\cXqEKrS.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\SDNLMcA.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\NkPblHq.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\EWIXhtT.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\gNeSbLv.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\OyhjTem.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\qFBosbC.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\jRNANsL.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\FwFpGst.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\kWAaoUi.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\PTqgLqI.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\gajKwgo.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\iZZUJBx.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\ERdmAYu.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\NeZmndm.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\lLliyGS.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\Qeasjzl.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\aMKXaYg.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\ofZWCPD.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\OGmfsvy.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\BrbuiHa.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\yZAcKSh.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\tUiODjz.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\rEtErAS.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\cKyLVfP.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\CSPftRc.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\mswZUtn.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\DzLuRYw.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\DwQXmPj.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\NcSnSyW.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\XXFTizJ.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\ONZlOjM.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\bQjlSTc.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\ElruBxA.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\aPADTEt.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\AGSBbfC.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\aLWSXTj.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\QGoKlSJ.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\vAsSfSP.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\xIEjTfM.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
File created	C:\Windows\System\WRwduVI.exe	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2728	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
Token: SeDebugPrivilege	2728	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2728	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	29
PID 2012 wrote to memory of 2728	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	29
PID 2012 wrote to memory of 2728	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	29
PID 2012 wrote to memory of 3056	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	30
PID 2012 wrote to memory of 3056	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	30
PID 2012 wrote to memory of 3056	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	30
PID 2012 wrote to memory of 2552	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	31
PID 2012 wrote to memory of 2552	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	31
PID 2012 wrote to memory of 2552	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	31
PID 2012 wrote to memory of 2616	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	32
PID 2012 wrote to memory of 2616	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	32
PID 2012 wrote to memory of 2616	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	32
PID 2012 wrote to memory of 2684	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	33
PID 2012 wrote to memory of 2684	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	33
PID 2012 wrote to memory of 2684	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	33
PID 2012 wrote to memory of 1476	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	34
PID 2012 wrote to memory of 1476	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	34
PID 2012 wrote to memory of 1476	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	34
PID 2012 wrote to memory of 2520	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	35
PID 2012 wrote to memory of 2520	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	35
PID 2012 wrote to memory of 2520	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	35
PID 2012 wrote to memory of 2408	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	36
PID 2012 wrote to memory of 2408	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	36
PID 2012 wrote to memory of 2408	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	36
PID 2012 wrote to memory of 2468	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	37
PID 2012 wrote to memory of 2468	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	37
PID 2012 wrote to memory of 2468	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	37
PID 2012 wrote to memory of 380	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	38
PID 2012 wrote to memory of 380	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	38
PID 2012 wrote to memory of 380	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	38
PID 2012 wrote to memory of 2796	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	39
PID 2012 wrote to memory of 2796	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	39
PID 2012 wrote to memory of 2796	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	39
PID 2012 wrote to memory of 2792	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	40
PID 2012 wrote to memory of 2792	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	40
PID 2012 wrote to memory of 2792	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	40
PID 2012 wrote to memory of 2824	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	41
PID 2012 wrote to memory of 2824	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	41
PID 2012 wrote to memory of 2824	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	41
PID 2012 wrote to memory of 356	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	42
PID 2012 wrote to memory of 356	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	42
PID 2012 wrote to memory of 356	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	42
PID 2012 wrote to memory of 2964	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	43
PID 2012 wrote to memory of 2964	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	43
PID 2012 wrote to memory of 2964	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	43
PID 2012 wrote to memory of 1532	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	44
PID 2012 wrote to memory of 1532	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	44
PID 2012 wrote to memory of 1532	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	44
PID 2012 wrote to memory of 2380	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	45
PID 2012 wrote to memory of 2380	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	45
PID 2012 wrote to memory of 2380	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	45
PID 2012 wrote to memory of 1608	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	46
PID 2012 wrote to memory of 1608	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	46
PID 2012 wrote to memory of 1608	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	46
PID 2012 wrote to memory of 1256	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	47
PID 2012 wrote to memory of 1256	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	47
PID 2012 wrote to memory of 1256	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	47
PID 2012 wrote to memory of 2644	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	48
PID 2012 wrote to memory of 2644	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	48
PID 2012 wrote to memory of 2644	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	48
PID 2012 wrote to memory of 2664	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	49
PID 2012 wrote to memory of 2664	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	49
PID 2012 wrote to memory of 2664	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	49
PID 2012 wrote to memory of 1496	2012	074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\074740a43d85864ee32cf2cdf44e73b0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\System\PmrUIIR.exe
  C:\Windows\System\PmrUIIR.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\TUAEjvU.exe
  C:\Windows\System\TUAEjvU.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\ofZWCPD.exe
  C:\Windows\System\ofZWCPD.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\iUyknmT.exe
  C:\Windows\System\iUyknmT.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\FMqNTpo.exe
  C:\Windows\System\FMqNTpo.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\nsoiYCF.exe
  C:\Windows\System\nsoiYCF.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\OWCCwPR.exe
  C:\Windows\System\OWCCwPR.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\uKQBbCs.exe
  C:\Windows\System\uKQBbCs.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\ZRWoJBW.exe
  C:\Windows\System\ZRWoJBW.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\oFGQzpz.exe
  C:\Windows\System\oFGQzpz.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\otKduPs.exe
  C:\Windows\System\otKduPs.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\vFIrgoO.exe
  C:\Windows\System\vFIrgoO.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\rPCWKDw.exe
  C:\Windows\System\rPCWKDw.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\WRwduVI.exe
  C:\Windows\System\WRwduVI.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\gsknLzp.exe
  C:\Windows\System\gsknLzp.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\kwMAWPz.exe
  C:\Windows\System\kwMAWPz.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\XXnXwxg.exe
  C:\Windows\System\XXnXwxg.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\pinxWIS.exe
  C:\Windows\System\pinxWIS.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\ARxcNBt.exe
  C:\Windows\System\ARxcNBt.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\vwjbNlL.exe
  C:\Windows\System\vwjbNlL.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\kfjQKcw.exe
  C:\Windows\System\kfjQKcw.exe
  2⤵
  PID:1496
- C:\Windows\System\nDXwjmK.exe
  C:\Windows\System\nDXwjmK.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\JkkpLHa.exe
  C:\Windows\System\JkkpLHa.exe
  2⤵
  PID:1924
- C:\Windows\System\NexeJAO.exe
  C:\Windows\System\NexeJAO.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\nGIewQy.exe
  C:\Windows\System\nGIewQy.exe
  2⤵
  PID:2196
- C:\Windows\System\BmqMEjf.exe
  C:\Windows\System\BmqMEjf.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\WwxLGzs.exe
  C:\Windows\System\WwxLGzs.exe
  2⤵
  PID:932
- C:\Windows\System\ILmEwIF.exe
  C:\Windows\System\ILmEwIF.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\yZYVUME.exe
  C:\Windows\System\yZYVUME.exe
  2⤵
  PID:1704
- C:\Windows\System\pcnDgrd.exe
  C:\Windows\System\pcnDgrd.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\QNkautW.exe
  C:\Windows\System\QNkautW.exe
  2⤵
  PID:916
- C:\Windows\System\FSDBRaI.exe
  C:\Windows\System\FSDBRaI.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\vhOKBBn.exe
  C:\Windows\System\vhOKBBn.exe
  2⤵
  PID:1108
- C:\Windows\System\wnmkwKM.exe
  C:\Windows\System\wnmkwKM.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\kQRrjru.exe
  C:\Windows\System\kQRrjru.exe
  2⤵
  PID:2788
- C:\Windows\System\nkyhSSX.exe
  C:\Windows\System\nkyhSSX.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\FIQVLLt.exe
  C:\Windows\System\FIQVLLt.exe
  2⤵
  PID:948
- C:\Windows\System\avMUGkX.exe
  C:\Windows\System\avMUGkX.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\xhLnQcV.exe
  C:\Windows\System\xhLnQcV.exe
  2⤵
  PID:2304
- C:\Windows\System\MqeedQF.exe
  C:\Windows\System\MqeedQF.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\UqIzZvT.exe
  C:\Windows\System\UqIzZvT.exe
  2⤵
  PID:1676
- C:\Windows\System\gWQxeyI.exe
  C:\Windows\System\gWQxeyI.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\wqpZRgJ.exe
  C:\Windows\System\wqpZRgJ.exe
  2⤵
  PID:744
- C:\Windows\System\IWzSgfq.exe
  C:\Windows\System\IWzSgfq.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\XSrOcne.exe
  C:\Windows\System\XSrOcne.exe
  2⤵
  PID:2840
- C:\Windows\System\BeVMUkL.exe
  C:\Windows\System\BeVMUkL.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\kkLNPke.exe
  C:\Windows\System\kkLNPke.exe
  2⤵
  PID:1708
- C:\Windows\System\vVuUrec.exe
  C:\Windows\System\vVuUrec.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\sJxFKwG.exe
  C:\Windows\System\sJxFKwG.exe
  2⤵
  PID:1736
- C:\Windows\System\iDRcsBK.exe
  C:\Windows\System\iDRcsBK.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\xknGdNp.exe
  C:\Windows\System\xknGdNp.exe
  2⤵
  PID:840
- C:\Windows\System\SEoBFPp.exe
  C:\Windows\System\SEoBFPp.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\csiyqID.exe
  C:\Windows\System\csiyqID.exe
  2⤵
  PID:1788
- C:\Windows\System\fGPdxdY.exe
  C:\Windows\System\fGPdxdY.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\ArUjZCA.exe
  C:\Windows\System\ArUjZCA.exe
  2⤵
  PID:1884
- C:\Windows\System\DzLuRYw.exe
  C:\Windows\System\DzLuRYw.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\kmGMMDo.exe
  C:\Windows\System\kmGMMDo.exe
  2⤵
  PID:2604
- C:\Windows\System\gjRTelt.exe
  C:\Windows\System\gjRTelt.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\yFVRPFt.exe
  C:\Windows\System\yFVRPFt.exe
  2⤵
  PID:2548
- C:\Windows\System\IPlywQC.exe
  C:\Windows\System\IPlywQC.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\OlNcYbH.exe
  C:\Windows\System\OlNcYbH.exe
  2⤵
  PID:1640
- C:\Windows\System\MqDWncz.exe
  C:\Windows\System\MqDWncz.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\xNGcZLU.exe
  C:\Windows\System\xNGcZLU.exe
  2⤵
  PID:2596
- C:\Windows\System\dwMPFce.exe
  C:\Windows\System\dwMPFce.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\msJFjKy.exe
  C:\Windows\System\msJFjKy.exe
  2⤵
  PID:2496
- C:\Windows\System\OGmfsvy.exe
  C:\Windows\System\OGmfsvy.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\shfsZdf.exe
  C:\Windows\System\shfsZdf.exe
  2⤵
  PID:332
- C:\Windows\System\jViWygp.exe
  C:\Windows\System\jViWygp.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\PiWXPhX.exe
  C:\Windows\System\PiWXPhX.exe
  2⤵
  PID:2632
- C:\Windows\System\ArRXsdP.exe
  C:\Windows\System\ArRXsdP.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\iUwJCzS.exe
  C:\Windows\System\iUwJCzS.exe
  2⤵
  PID:2068
- C:\Windows\System\MEEcjKz.exe
  C:\Windows\System\MEEcjKz.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\rVLhWfn.exe
  C:\Windows\System\rVLhWfn.exe
  2⤵
  PID:2120
- C:\Windows\System\tcgjwew.exe
  C:\Windows\System\tcgjwew.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\OyhjTem.exe
  C:\Windows\System\OyhjTem.exe
  2⤵
  PID:320
- C:\Windows\System\wMKSydC.exe
  C:\Windows\System\wMKSydC.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\XQWaiun.exe
  C:\Windows\System\XQWaiun.exe
  2⤵
  PID:2004
- C:\Windows\System\lKQBKgZ.exe
  C:\Windows\System\lKQBKgZ.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\SzFGByn.exe
  C:\Windows\System\SzFGByn.exe
  2⤵
  PID:2092
- C:\Windows\System\rXvZRlH.exe
  C:\Windows\System\rXvZRlH.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\jPaqNgD.exe
  C:\Windows\System\jPaqNgD.exe
  2⤵
  PID:2448
- C:\Windows\System\VZrlsTe.exe
  C:\Windows\System\VZrlsTe.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\XRAhIQC.exe
  C:\Windows\System\XRAhIQC.exe
  2⤵
  PID:3080
- C:\Windows\System\nwbaTWq.exe
  C:\Windows\System\nwbaTWq.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\ydfxDmF.exe
  C:\Windows\System\ydfxDmF.exe
  2⤵
  PID:3112
- C:\Windows\System\NESHYea.exe
  C:\Windows\System\NESHYea.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\nVJYspR.exe
  C:\Windows\System\nVJYspR.exe
  2⤵
  PID:3144
- C:\Windows\System\QgzKiCF.exe
  C:\Windows\System\QgzKiCF.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\kdzfrAq.exe
  C:\Windows\System\kdzfrAq.exe
  2⤵
  PID:3176
- C:\Windows\System\niDxXYo.exe
  C:\Windows\System\niDxXYo.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\rvPPtaq.exe
  C:\Windows\System\rvPPtaq.exe
  2⤵
  PID:3208
- C:\Windows\System\spPGQsh.exe
  C:\Windows\System\spPGQsh.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\bGGCuDO.exe
  C:\Windows\System\bGGCuDO.exe
  2⤵
  PID:3240
- C:\Windows\System\awSaODF.exe
  C:\Windows\System\awSaODF.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\ObinFUn.exe
  C:\Windows\System\ObinFUn.exe
  2⤵
  PID:3272
- C:\Windows\System\gYAtAKx.exe
  C:\Windows\System\gYAtAKx.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\GNJJdGr.exe
  C:\Windows\System\GNJJdGr.exe
  2⤵
  PID:3304
- C:\Windows\System\PJTquOS.exe
  C:\Windows\System\PJTquOS.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\glSpshW.exe
  C:\Windows\System\glSpshW.exe
  2⤵
  PID:3336
- C:\Windows\System\rqodezp.exe
  C:\Windows\System\rqodezp.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\NfIIvhF.exe
  C:\Windows\System\NfIIvhF.exe
  2⤵
  PID:3368
- C:\Windows\System\SozLKjk.exe
  C:\Windows\System\SozLKjk.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\DYesAaC.exe
  C:\Windows\System\DYesAaC.exe
  2⤵
  PID:3400
- C:\Windows\System\uPNdTAN.exe
  C:\Windows\System\uPNdTAN.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\Mjouoex.exe
  C:\Windows\System\Mjouoex.exe
  2⤵
  PID:3432
- C:\Windows\System\uiOiaGU.exe
  C:\Windows\System\uiOiaGU.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\wopIhBh.exe
  C:\Windows\System\wopIhBh.exe
  2⤵
  PID:3464
- C:\Windows\System\rdFVYGn.exe
  C:\Windows\System\rdFVYGn.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\faOehrJ.exe
  C:\Windows\System\faOehrJ.exe
  2⤵
  PID:3496
- C:\Windows\System\uzhBWUp.exe
  C:\Windows\System\uzhBWUp.exe
  2⤵
  PID:3512
- C:\Windows\System\ddpGNaT.exe
  C:\Windows\System\ddpGNaT.exe
  2⤵
  PID:3528
- C:\Windows\System\cRnWZSJ.exe
  C:\Windows\System\cRnWZSJ.exe
  2⤵
  PID:3544
- C:\Windows\System\QzybbZc.exe
  C:\Windows\System\QzybbZc.exe
  2⤵
  PID:3560
- C:\Windows\System\jJMbAMC.exe
  C:\Windows\System\jJMbAMC.exe
  2⤵
  PID:3576
- C:\Windows\System\kUIbisC.exe
  C:\Windows\System\kUIbisC.exe
  2⤵
  PID:3592
- C:\Windows\System\lXyaczr.exe
  C:\Windows\System\lXyaczr.exe
  2⤵
  PID:3608
- C:\Windows\System\ZbzKeUF.exe
  C:\Windows\System\ZbzKeUF.exe
  2⤵
  PID:3624
- C:\Windows\System\tBErmBU.exe
  C:\Windows\System\tBErmBU.exe
  2⤵
  PID:3640
- C:\Windows\System\AtVXERY.exe
  C:\Windows\System\AtVXERY.exe
  2⤵
  PID:3656
- C:\Windows\System\uRkCEXf.exe
  C:\Windows\System\uRkCEXf.exe
  2⤵
  PID:3672
- C:\Windows\System\GJdyBrZ.exe
  C:\Windows\System\GJdyBrZ.exe
  2⤵
  PID:3688
- C:\Windows\System\VkuKUYE.exe
  C:\Windows\System\VkuKUYE.exe
  2⤵
  PID:3704
- C:\Windows\System\pREqmah.exe
  C:\Windows\System\pREqmah.exe
  2⤵
  PID:3720
- C:\Windows\System\oUqoiAm.exe
  C:\Windows\System\oUqoiAm.exe
  2⤵
  PID:3736
- C:\Windows\System\vZTmbOd.exe
  C:\Windows\System\vZTmbOd.exe
  2⤵
  PID:3752
- C:\Windows\System\vaJmMho.exe
  C:\Windows\System\vaJmMho.exe
  2⤵
  PID:3768
- C:\Windows\System\Ttvkldr.exe
  C:\Windows\System\Ttvkldr.exe
  2⤵
  PID:3784
- C:\Windows\System\qwWucyR.exe
  C:\Windows\System\qwWucyR.exe
  2⤵
  PID:3800
- C:\Windows\System\tadzPqh.exe
  C:\Windows\System\tadzPqh.exe
  2⤵
  PID:3816
- C:\Windows\System\hrhFsvL.exe
  C:\Windows\System\hrhFsvL.exe
  2⤵
  PID:3832
- C:\Windows\System\YYvifAr.exe
  C:\Windows\System\YYvifAr.exe
  2⤵
  PID:3848
- C:\Windows\System\fNrSiZO.exe
  C:\Windows\System\fNrSiZO.exe
  2⤵
  PID:3864
- C:\Windows\System\ibXcWxN.exe
  C:\Windows\System\ibXcWxN.exe
  2⤵
  PID:3880
- C:\Windows\System\kOWFBTy.exe
  C:\Windows\System\kOWFBTy.exe
  2⤵
  PID:3896
- C:\Windows\System\WnHbuSn.exe
  C:\Windows\System\WnHbuSn.exe
  2⤵
  PID:3912
- C:\Windows\System\rotvSBO.exe
  C:\Windows\System\rotvSBO.exe
  2⤵
  PID:3928
- C:\Windows\System\ASoIDHp.exe
  C:\Windows\System\ASoIDHp.exe
  2⤵
  PID:3944
- C:\Windows\System\ZRbRzgS.exe
  C:\Windows\System\ZRbRzgS.exe
  2⤵
  PID:3960
- C:\Windows\System\BdasKJA.exe
  C:\Windows\System\BdasKJA.exe
  2⤵
  PID:3976
- C:\Windows\System\diLxxBc.exe
  C:\Windows\System\diLxxBc.exe
  2⤵
  PID:3992
- C:\Windows\System\fHEiFCO.exe
  C:\Windows\System\fHEiFCO.exe
  2⤵
  PID:4008
- C:\Windows\System\smPeHNg.exe
  C:\Windows\System\smPeHNg.exe
  2⤵
  PID:4024
- C:\Windows\System\SfBGTLv.exe
  C:\Windows\System\SfBGTLv.exe
  2⤵
  PID:4040
- C:\Windows\System\OEghPrp.exe
  C:\Windows\System\OEghPrp.exe
  2⤵
  PID:4056
- C:\Windows\System\Wbpbeog.exe
  C:\Windows\System\Wbpbeog.exe
  2⤵
  PID:4072
- C:\Windows\System\mzFbWei.exe
  C:\Windows\System\mzFbWei.exe
  2⤵
  PID:4088
- C:\Windows\System\XzAWykD.exe
  C:\Windows\System\XzAWykD.exe
  2⤵
  PID:1684
- C:\Windows\System\ZdzxqJr.exe
  C:\Windows\System\ZdzxqJr.exe
  2⤵
  PID:552
- C:\Windows\System\tVKLXwx.exe
  C:\Windows\System\tVKLXwx.exe
  2⤵
  PID:3040
- C:\Windows\System\KhNqatc.exe
  C:\Windows\System\KhNqatc.exe
  2⤵
  PID:3076
- C:\Windows\System\QPjchiG.exe
  C:\Windows\System\QPjchiG.exe
  2⤵
  PID:3140
- C:\Windows\System\ApvtHBj.exe
  C:\Windows\System\ApvtHBj.exe
  2⤵
  PID:3204
- C:\Windows\System\WhDNiVY.exe
  C:\Windows\System\WhDNiVY.exe
  2⤵
  PID:3268
- C:\Windows\System\yIaFRda.exe
  C:\Windows\System\yIaFRda.exe
  2⤵
  PID:3332
- C:\Windows\System\EzcyrNb.exe
  C:\Windows\System\EzcyrNb.exe
  2⤵
  PID:3396
- C:\Windows\System\uazxJBS.exe
  C:\Windows\System\uazxJBS.exe
  2⤵
  PID:3460
- C:\Windows\System\lKmbHmU.exe
  C:\Windows\System\lKmbHmU.exe
  2⤵
  PID:3524
- C:\Windows\System\aIELBmH.exe
  C:\Windows\System\aIELBmH.exe
  2⤵
  PID:3588
- C:\Windows\System\bEseNWt.exe
  C:\Windows\System\bEseNWt.exe
  2⤵
  PID:3652
- C:\Windows\System\ARLRDHy.exe
  C:\Windows\System\ARLRDHy.exe
  2⤵
  PID:3716
- C:\Windows\System\jNHWmFM.exe
  C:\Windows\System\jNHWmFM.exe
  2⤵
  PID:3780
- C:\Windows\System\zNVLTKy.exe
  C:\Windows\System\zNVLTKy.exe
  2⤵
  PID:3840
- C:\Windows\System\BglmPsu.exe
  C:\Windows\System\BglmPsu.exe
  2⤵
  PID:3904
- C:\Windows\System\yVmjGqc.exe
  C:\Windows\System\yVmjGqc.exe
  2⤵
  PID:3968
- C:\Windows\System\uJazdHl.exe
  C:\Windows\System\uJazdHl.exe
  2⤵
  PID:4032
- C:\Windows\System\atRDPYO.exe
  C:\Windows\System\atRDPYO.exe
  2⤵
  PID:1680
- C:\Windows\System\jyMueut.exe
  C:\Windows\System\jyMueut.exe
  2⤵
  PID:3108
- C:\Windows\System\pmVnvvz.exe
  C:\Windows\System\pmVnvvz.exe
  2⤵
  PID:3364
- C:\Windows\System\GDBhQvU.exe
  C:\Windows\System\GDBhQvU.exe
  2⤵
  PID:3520
- C:\Windows\System\qwCBNxP.exe
  C:\Windows\System\qwCBNxP.exe
  2⤵
  PID:3748
- C:\Windows\System\uETLrmM.exe
  C:\Windows\System\uETLrmM.exe
  2⤵
  PID:4000
- C:\Windows\System\RUiWhzx.exe
  C:\Windows\System\RUiWhzx.exe
  2⤵
  PID:4112
- C:\Windows\System\wcbeZTU.exe
  C:\Windows\System\wcbeZTU.exe
  2⤵
  PID:4128
- C:\Windows\System\aEELRWA.exe
  C:\Windows\System\aEELRWA.exe
  2⤵
  PID:4144
- C:\Windows\System\JDzZICy.exe
  C:\Windows\System\JDzZICy.exe
  2⤵
  PID:4160
- C:\Windows\System\CgZsKnF.exe
  C:\Windows\System\CgZsKnF.exe
  2⤵
  PID:4176
- C:\Windows\System\iFTqgtw.exe
  C:\Windows\System\iFTqgtw.exe
  2⤵
  PID:4192
- C:\Windows\System\IiRBbcq.exe
  C:\Windows\System\IiRBbcq.exe
  2⤵
  PID:4208
- C:\Windows\System\YlnONnv.exe
  C:\Windows\System\YlnONnv.exe
  2⤵
  PID:4224
- C:\Windows\System\DxsIDhm.exe
  C:\Windows\System\DxsIDhm.exe
  2⤵
  PID:4240
- C:\Windows\System\mozklkr.exe
  C:\Windows\System\mozklkr.exe
  2⤵
  PID:4256
- C:\Windows\System\dkcFYeE.exe
  C:\Windows\System\dkcFYeE.exe
  2⤵
  PID:4272
- C:\Windows\System\GDSwozi.exe
  C:\Windows\System\GDSwozi.exe
  2⤵
  PID:4288
- C:\Windows\System\mUrEyFw.exe
  C:\Windows\System\mUrEyFw.exe
  2⤵
  PID:4304
- C:\Windows\System\yNgZryc.exe
  C:\Windows\System\yNgZryc.exe
  2⤵
  PID:4320
- C:\Windows\System\qDaLGwn.exe
  C:\Windows\System\qDaLGwn.exe
  2⤵
  PID:4336
- C:\Windows\System\EemfnvQ.exe
  C:\Windows\System\EemfnvQ.exe
  2⤵
  PID:4352
- C:\Windows\System\MSSApHk.exe
  C:\Windows\System\MSSApHk.exe
  2⤵
  PID:4368
- C:\Windows\System\tcdiBNq.exe
  C:\Windows\System\tcdiBNq.exe
  2⤵
  PID:4384
- C:\Windows\System\EWPAFZn.exe
  C:\Windows\System\EWPAFZn.exe
  2⤵
  PID:4400
- C:\Windows\System\DEnNlCM.exe
  C:\Windows\System\DEnNlCM.exe
  2⤵
  PID:4416
- C:\Windows\System\UWZHVAb.exe
  C:\Windows\System\UWZHVAb.exe
  2⤵
  PID:4432
- C:\Windows\System\hcOaEYd.exe
  C:\Windows\System\hcOaEYd.exe
  2⤵
  PID:4448
- C:\Windows\System\KKSGXzE.exe
  C:\Windows\System\KKSGXzE.exe
  2⤵
  PID:4464
- C:\Windows\System\RiMGAeH.exe
  C:\Windows\System\RiMGAeH.exe
  2⤵
  PID:4480
- C:\Windows\System\JuKGyfH.exe
  C:\Windows\System\JuKGyfH.exe
  2⤵
  PID:4496
- C:\Windows\System\NVFZHem.exe
  C:\Windows\System\NVFZHem.exe
  2⤵
  PID:4512
- C:\Windows\System\zxKnyfU.exe
  C:\Windows\System\zxKnyfU.exe
  2⤵
  PID:4528
- C:\Windows\System\juJNxvj.exe
  C:\Windows\System\juJNxvj.exe
  2⤵
  PID:4544
- C:\Windows\System\uGJEPdt.exe
  C:\Windows\System\uGJEPdt.exe
  2⤵
  PID:4560
- C:\Windows\System\QvcBaNB.exe
  C:\Windows\System\QvcBaNB.exe
  2⤵
  PID:4576
- C:\Windows\System\XDgGNpL.exe
  C:\Windows\System\XDgGNpL.exe
  2⤵
  PID:4592
- C:\Windows\System\peZBkIp.exe
  C:\Windows\System\peZBkIp.exe
  2⤵
  PID:4608
- C:\Windows\System\zpkqMjL.exe
  C:\Windows\System\zpkqMjL.exe
  2⤵
  PID:4624
- C:\Windows\System\ckjFmiA.exe
  C:\Windows\System\ckjFmiA.exe
  2⤵
  PID:4640
- C:\Windows\System\NzmhpUM.exe
  C:\Windows\System\NzmhpUM.exe
  2⤵
  PID:4656
- C:\Windows\System\pWdLGKg.exe
  C:\Windows\System\pWdLGKg.exe
  2⤵
  PID:4672
- C:\Windows\System\KIDkTdo.exe
  C:\Windows\System\KIDkTdo.exe
  2⤵
  PID:4688
- C:\Windows\System\sTvUcrr.exe
  C:\Windows\System\sTvUcrr.exe
  2⤵
  PID:4704
- C:\Windows\System\nmYJKlS.exe
  C:\Windows\System\nmYJKlS.exe
  2⤵
  PID:4720
- C:\Windows\System\bcCpKDn.exe
  C:\Windows\System\bcCpKDn.exe
  2⤵
  PID:4736
- C:\Windows\System\yZjuSWl.exe
  C:\Windows\System\yZjuSWl.exe
  2⤵
  PID:4752
- C:\Windows\System\AjOXpbk.exe
  C:\Windows\System\AjOXpbk.exe
  2⤵
  PID:4768
- C:\Windows\System\hSfQExU.exe
  C:\Windows\System\hSfQExU.exe
  2⤵
  PID:4784
- C:\Windows\System\MZgqfUN.exe
  C:\Windows\System\MZgqfUN.exe
  2⤵
  PID:4800
- C:\Windows\System\wfJXOQA.exe
  C:\Windows\System\wfJXOQA.exe
  2⤵
  PID:4816
- C:\Windows\System\IpOJnpM.exe
  C:\Windows\System\IpOJnpM.exe
  2⤵
  PID:4832
- C:\Windows\System\SZKMOPC.exe
  C:\Windows\System\SZKMOPC.exe
  2⤵
  PID:4848
- C:\Windows\System\uSqAoMQ.exe
  C:\Windows\System\uSqAoMQ.exe
  2⤵
  PID:4864
- C:\Windows\System\KYDJuRk.exe
  C:\Windows\System\KYDJuRk.exe
  2⤵
  PID:4880
- C:\Windows\System\rfsLyhZ.exe
  C:\Windows\System\rfsLyhZ.exe
  2⤵
  PID:4896
- C:\Windows\System\hLSFlur.exe
  C:\Windows\System\hLSFlur.exe
  2⤵
  PID:4912
- C:\Windows\System\LyyRBpZ.exe
  C:\Windows\System\LyyRBpZ.exe
  2⤵
  PID:4928
- C:\Windows\System\oMzYoTO.exe
  C:\Windows\System\oMzYoTO.exe
  2⤵
  PID:4944
- C:\Windows\System\zZJUvqX.exe
  C:\Windows\System\zZJUvqX.exe
  2⤵
  PID:4960
- C:\Windows\System\UHRYDyr.exe
  C:\Windows\System\UHRYDyr.exe
  2⤵
  PID:4976
- C:\Windows\System\ukhGdip.exe
  C:\Windows\System\ukhGdip.exe
  2⤵
  PID:4992
- C:\Windows\System\IcbKPkR.exe
  C:\Windows\System\IcbKPkR.exe
  2⤵
  PID:5008
- C:\Windows\System\kwdBWZZ.exe
  C:\Windows\System\kwdBWZZ.exe
  2⤵
  PID:5024
- C:\Windows\System\AOHxZLa.exe
  C:\Windows\System\AOHxZLa.exe
  2⤵
  PID:5040
- C:\Windows\System\iNioAkN.exe
  C:\Windows\System\iNioAkN.exe
  2⤵
  PID:5056
- C:\Windows\System\RDwIdni.exe
  C:\Windows\System\RDwIdni.exe
  2⤵
  PID:5072
- C:\Windows\System\LQJmcqZ.exe
  C:\Windows\System\LQJmcqZ.exe
  2⤵
  PID:5088
- C:\Windows\System\BUkUWBx.exe
  C:\Windows\System\BUkUWBx.exe
  2⤵
  PID:5104
- C:\Windows\System\gWjZMPL.exe
  C:\Windows\System\gWjZMPL.exe
  2⤵
  PID:4004
- C:\Windows\System\tzzHKSp.exe
  C:\Windows\System\tzzHKSp.exe
  2⤵
  PID:3492
- C:\Windows\System\JYJEMbW.exe
  C:\Windows\System\JYJEMbW.exe
  2⤵
  PID:4124
- C:\Windows\System\AdyupqB.exe
  C:\Windows\System\AdyupqB.exe
  2⤵
  PID:4188
- C:\Windows\System\rEtErAS.exe
  C:\Windows\System\rEtErAS.exe
  2⤵
  PID:4252
- C:\Windows\System\sNoMmXJ.exe
  C:\Windows\System\sNoMmXJ.exe
  2⤵
  PID:4316
- C:\Windows\System\HTDafzR.exe
  C:\Windows\System\HTDafzR.exe
  2⤵
  PID:2412
- C:\Windows\System\hwTrcDC.exe
  C:\Windows\System\hwTrcDC.exe
  2⤵
  PID:4440
- C:\Windows\System\YEsdrPz.exe
  C:\Windows\System\YEsdrPz.exe
  2⤵
  PID:4504
- C:\Windows\System\XYFjXNT.exe
  C:\Windows\System\XYFjXNT.exe
  2⤵
  PID:2540
- C:\Windows\System\kPQGiUc.exe
  C:\Windows\System\kPQGiUc.exe
  2⤵
  PID:2076
- C:\Windows\System\MDAZjiD.exe
  C:\Windows\System\MDAZjiD.exe
  2⤵
  PID:4636
- C:\Windows\System\XFfaAHq.exe
  C:\Windows\System\XFfaAHq.exe
  2⤵
  PID:4696
- C:\Windows\System\DqwuOkG.exe
  C:\Windows\System\DqwuOkG.exe
  2⤵
  PID:4760
- C:\Windows\System\NZTJlyk.exe
  C:\Windows\System\NZTJlyk.exe
  2⤵
  PID:4824
- C:\Windows\System\IdPPqjO.exe
  C:\Windows\System\IdPPqjO.exe
  2⤵
  PID:2404
- C:\Windows\System\pyxaygn.exe
  C:\Windows\System\pyxaygn.exe
  2⤵
  PID:4924
- C:\Windows\System\dgpQpHz.exe
  C:\Windows\System\dgpQpHz.exe
  2⤵
  PID:4988
- C:\Windows\System\PUSRtAP.exe
  C:\Windows\System\PUSRtAP.exe
  2⤵
  PID:5052
- C:\Windows\System\stVCTvM.exe
  C:\Windows\System\stVCTvM.exe
  2⤵
  PID:5116
- C:\Windows\System\GsKXRkv.exe
  C:\Windows\System\GsKXRkv.exe
  2⤵
  PID:4220
- C:\Windows\System\DmuzCTS.exe
  C:\Windows\System\DmuzCTS.exe
  2⤵
  PID:4472
- C:\Windows\System\dGKbmMD.exe
  C:\Windows\System\dGKbmMD.exe
  2⤵
  PID:2588
- C:\Windows\System\yTUCcUc.exe
  C:\Windows\System\yTUCcUc.exe
  2⤵
  PID:5180
- C:\Windows\System\vubWHwq.exe
  C:\Windows\System\vubWHwq.exe
  2⤵
  PID:5196
- C:\Windows\System\yWOAvEX.exe
  C:\Windows\System\yWOAvEX.exe
  2⤵
  PID:5212
- C:\Windows\System\VWiobuI.exe
  C:\Windows\System\VWiobuI.exe
  2⤵
  PID:5228
- C:\Windows\System\VsSvXqW.exe
  C:\Windows\System\VsSvXqW.exe
  2⤵
  PID:5244
- C:\Windows\System\clPkenA.exe
  C:\Windows\System\clPkenA.exe
  2⤵
  PID:5260
- C:\Windows\System\KaSVjhT.exe
  C:\Windows\System\KaSVjhT.exe
  2⤵
  PID:5276
- C:\Windows\System\TUAewJz.exe
  C:\Windows\System\TUAewJz.exe
  2⤵
  PID:5292
- C:\Windows\System\tMmHSPz.exe
  C:\Windows\System\tMmHSPz.exe
  2⤵
  PID:5308
- C:\Windows\System\qFBosbC.exe
  C:\Windows\System\qFBosbC.exe
  2⤵
  PID:5324
- C:\Windows\System\FkxggQE.exe
  C:\Windows\System\FkxggQE.exe
  2⤵
  PID:5340
- C:\Windows\System\WfEfCDq.exe
  C:\Windows\System\WfEfCDq.exe
  2⤵
  PID:5356
- C:\Windows\System\oYxRjxa.exe
  C:\Windows\System\oYxRjxa.exe
  2⤵
  PID:5372
- C:\Windows\System\PmopSPH.exe
  C:\Windows\System\PmopSPH.exe
  2⤵
  PID:5388
- C:\Windows\System\raESmAW.exe
  C:\Windows\System\raESmAW.exe
  2⤵
  PID:5404
- C:\Windows\System\kzFHbMP.exe
  C:\Windows\System\kzFHbMP.exe
  2⤵
  PID:5420
- C:\Windows\System\RMFWFJR.exe
  C:\Windows\System\RMFWFJR.exe
  2⤵
  PID:5436
- C:\Windows\System\LSxwNPT.exe
  C:\Windows\System\LSxwNPT.exe
  2⤵
  PID:5452
- C:\Windows\System\iieIWlR.exe
  C:\Windows\System\iieIWlR.exe
  2⤵
  PID:5468
- C:\Windows\System\snkKVJT.exe
  C:\Windows\System\snkKVJT.exe
  2⤵
  PID:5484
- C:\Windows\System\nnlqzwF.exe
  C:\Windows\System\nnlqzwF.exe
  2⤵
  PID:5500
- C:\Windows\System\ivYIqpN.exe
  C:\Windows\System\ivYIqpN.exe
  2⤵
  PID:5516
- C:\Windows\System\NEIxjON.exe
  C:\Windows\System\NEIxjON.exe
  2⤵
  PID:5532
- C:\Windows\System\sFMpsWh.exe
  C:\Windows\System\sFMpsWh.exe
  2⤵
  PID:5548
- C:\Windows\System\yXoGRpT.exe
  C:\Windows\System\yXoGRpT.exe
  2⤵
  PID:5564
- C:\Windows\System\cHaJHgN.exe
  C:\Windows\System\cHaJHgN.exe
  2⤵
  PID:5580
- C:\Windows\System\RaquAzV.exe
  C:\Windows\System\RaquAzV.exe
  2⤵
  PID:5596
- C:\Windows\System\eHPFEoy.exe
  C:\Windows\System\eHPFEoy.exe
  2⤵
  PID:5612
- C:\Windows\System\qHnEhBw.exe
  C:\Windows\System\qHnEhBw.exe
  2⤵
  PID:5628
- C:\Windows\System\BrbuiHa.exe
  C:\Windows\System\BrbuiHa.exe
  2⤵
  PID:5644
- C:\Windows\System\YyxWrkG.exe
  C:\Windows\System\YyxWrkG.exe
  2⤵
  PID:5660
- C:\Windows\System\eBbvpuw.exe
  C:\Windows\System\eBbvpuw.exe
  2⤵
  PID:5676
- C:\Windows\System\dHCQFTD.exe
  C:\Windows\System\dHCQFTD.exe
  2⤵
  PID:5692
- C:\Windows\System\MrPSCxU.exe
  C:\Windows\System\MrPSCxU.exe
  2⤵
  PID:5708
- C:\Windows\System\QyFScMH.exe
  C:\Windows\System\QyFScMH.exe
  2⤵
  PID:5724
- C:\Windows\System\uiuaxsA.exe
  C:\Windows\System\uiuaxsA.exe
  2⤵
  PID:5740
- C:\Windows\System\dDVnTAE.exe
  C:\Windows\System\dDVnTAE.exe
  2⤵
  PID:5756
- C:\Windows\System\IwzYvwr.exe
  C:\Windows\System\IwzYvwr.exe
  2⤵
  PID:5772
- C:\Windows\System\pWTAPaY.exe
  C:\Windows\System\pWTAPaY.exe
  2⤵
  PID:5788
- C:\Windows\System\fpUYFQA.exe
  C:\Windows\System\fpUYFQA.exe
  2⤵
  PID:5804
- C:\Windows\System\iebOqIk.exe
  C:\Windows\System\iebOqIk.exe
  2⤵
  PID:5820
- C:\Windows\System\PPgKslJ.exe
  C:\Windows\System\PPgKslJ.exe
  2⤵
  PID:5836
- C:\Windows\System\oinisYv.exe
  C:\Windows\System\oinisYv.exe
  2⤵
  PID:5852
- C:\Windows\System\TqYCyQg.exe
  C:\Windows\System\TqYCyQg.exe
  2⤵
  PID:5868
- C:\Windows\System\RiFOipU.exe
  C:\Windows\System\RiFOipU.exe
  2⤵
  PID:5884
- C:\Windows\System\oOSJHoz.exe
  C:\Windows\System\oOSJHoz.exe
  2⤵
  PID:5900
- C:\Windows\System\HDGkMgJ.exe
  C:\Windows\System\HDGkMgJ.exe
  2⤵
  PID:5916
- C:\Windows\System\mVLPhiU.exe
  C:\Windows\System\mVLPhiU.exe
  2⤵
  PID:5932
- C:\Windows\System\sFWDoel.exe
  C:\Windows\System\sFWDoel.exe
  2⤵
  PID:5968
- C:\Windows\System\VtGjjSz.exe
  C:\Windows\System\VtGjjSz.exe
  2⤵
  PID:5996
- C:\Windows\System\uLCfXXO.exe
  C:\Windows\System\uLCfXXO.exe
  2⤵
  PID:6012
- C:\Windows\System\OAOrGFR.exe
  C:\Windows\System\OAOrGFR.exe
  2⤵
  PID:6028
- C:\Windows\System\RmwmGsz.exe
  C:\Windows\System\RmwmGsz.exe
  2⤵
  PID:6044
- C:\Windows\System\avjhZYf.exe
  C:\Windows\System\avjhZYf.exe
  2⤵
  PID:6060
- C:\Windows\System\cKyLVfP.exe
  C:\Windows\System\cKyLVfP.exe
  2⤵
  PID:6076
- C:\Windows\System\ehyWthO.exe
  C:\Windows\System\ehyWthO.exe
  2⤵
  PID:6092
- C:\Windows\System\fEtXkvw.exe
  C:\Windows\System\fEtXkvw.exe
  2⤵
  PID:6108
- C:\Windows\System\xkNZlGV.exe
  C:\Windows\System\xkNZlGV.exe
  2⤵
  PID:6124
- C:\Windows\System\aOZmNKF.exe
  C:\Windows\System\aOZmNKF.exe
  2⤵
  PID:6140
- C:\Windows\System\XnwEFwc.exe
  C:\Windows\System\XnwEFwc.exe
  2⤵
  PID:5020
- C:\Windows\System\aGaKyya.exe
  C:\Windows\System\aGaKyya.exe
  2⤵
  PID:4572
- C:\Windows\System\LQpWuJr.exe
  C:\Windows\System\LQpWuJr.exe
  2⤵
  PID:5220
- C:\Windows\System\agVjhJb.exe
  C:\Windows\System\agVjhJb.exe
  2⤵
  PID:5256
- C:\Windows\System\bpCQMzG.exe
  C:\Windows\System\bpCQMzG.exe
  2⤵
  PID:5320
- C:\Windows\System\EqdtDwk.exe
  C:\Windows\System\EqdtDwk.exe
  2⤵
  PID:5380
- C:\Windows\System\tQIZZzM.exe
  C:\Windows\System\tQIZZzM.exe
  2⤵
  PID:5416
- C:\Windows\System\ijduNLQ.exe
  C:\Windows\System\ijduNLQ.exe
  2⤵
  PID:5448
- C:\Windows\System\yREDeHx.exe
  C:\Windows\System\yREDeHx.exe
  2⤵
  PID:5512
- C:\Windows\System\xTlQKKT.exe
  C:\Windows\System\xTlQKKT.exe
  2⤵
  PID:5576
- C:\Windows\System\zcslzQS.exe
  C:\Windows\System\zcslzQS.exe
  2⤵
  PID:5640
- C:\Windows\System\CooUtol.exe
  C:\Windows\System\CooUtol.exe
  2⤵
  PID:1604
- C:\Windows\System\MNbUUbK.exe
  C:\Windows\System\MNbUUbK.exe
  2⤵
  PID:5732
- C:\Windows\System\UMKitFb.exe
  C:\Windows\System\UMKitFb.exe
  2⤵
  PID:5768
- C:\Windows\System\jrbWbHO.exe
  C:\Windows\System\jrbWbHO.exe
  2⤵
  PID:5832
- C:\Windows\System\BfJLseb.exe
  C:\Windows\System\BfJLseb.exe
  2⤵
  PID:1172
- C:\Windows\System\NhWVRvr.exe
  C:\Windows\System\NhWVRvr.exe
  2⤵
  PID:1236
- C:\Windows\System\ehXOexV.exe
  C:\Windows\System\ehXOexV.exe
  2⤵
  PID:1576
- C:\Windows\System\TmXFXfb.exe
  C:\Windows\System\TmXFXfb.exe
  2⤵
  PID:2948
- C:\Windows\System\oFWbMvY.exe
  C:\Windows\System\oFWbMvY.exe
  2⤵
  PID:896
- C:\Windows\System\mfPHCLZ.exe
  C:\Windows\System\mfPHCLZ.exe
  2⤵
  PID:2820
- C:\Windows\System\AbXauoM.exe
  C:\Windows\System\AbXauoM.exe
  2⤵
  PID:2768
- C:\Windows\System\xzqRjKC.exe
  C:\Windows\System\xzqRjKC.exe
  2⤵
  PID:5944
- C:\Windows\System\QXVyeLf.exe
  C:\Windows\System\QXVyeLf.exe
  2⤵
  PID:6036
- C:\Windows\System\hunctAq.exe
  C:\Windows\System\hunctAq.exe
  2⤵
  PID:6100
- C:\Windows\System\YdmlLFg.exe
  C:\Windows\System\YdmlLFg.exe
  2⤵
  PID:5864
- C:\Windows\System\jRNANsL.exe
  C:\Windows\System\jRNANsL.exe
  2⤵
  PID:2200
- C:\Windows\System\bPVtzBC.exe
  C:\Windows\System\bPVtzBC.exe
  2⤵
  PID:3124
- C:\Windows\System\XlzXlOo.exe
  C:\Windows\System\XlzXlOo.exe
  2⤵
  PID:3188
- C:\Windows\System\LkXTfqH.exe
  C:\Windows\System\LkXTfqH.exe
  2⤵
  PID:3252
- C:\Windows\System\YGXJMHR.exe
  C:\Windows\System\YGXJMHR.exe
  2⤵
  PID:3316
- C:\Windows\System\jMxkTWj.exe
  C:\Windows\System\jMxkTWj.exe
  2⤵
  PID:3380
- C:\Windows\System\RNcYEDi.exe
  C:\Windows\System\RNcYEDi.exe
  2⤵
  PID:3444
- C:\Windows\System\dkEAKGX.exe
  C:\Windows\System\dkEAKGX.exe
  2⤵
  PID:3508
- C:\Windows\System\WZovHDB.exe
  C:\Windows\System\WZovHDB.exe
  2⤵
  PID:3572
- C:\Windows\System\OhBPaAZ.exe
  C:\Windows\System\OhBPaAZ.exe
  2⤵
  PID:3636
- C:\Windows\System\fdFHjbC.exe
  C:\Windows\System\fdFHjbC.exe
  2⤵
  PID:3700
- C:\Windows\System\nllfuzL.exe
  C:\Windows\System\nllfuzL.exe
  2⤵
  PID:3764
- C:\Windows\System\CQmIxrD.exe
  C:\Windows\System\CQmIxrD.exe
  2⤵
  PID:3828
- C:\Windows\System\vhdEiqT.exe
  C:\Windows\System\vhdEiqT.exe
  2⤵
  PID:3892
- C:\Windows\System\pGZWPbi.exe
  C:\Windows\System\pGZWPbi.exe
  2⤵
  PID:3956
- C:\Windows\System\oNaHtnH.exe
  C:\Windows\System\oNaHtnH.exe
  2⤵
  PID:4020
- C:\Windows\System\tzlRyaS.exe
  C:\Windows\System\tzlRyaS.exe
  2⤵
  PID:4084
- C:\Windows\System\KfFHvmS.exe
  C:\Windows\System\KfFHvmS.exe
  2⤵
  PID:2748
- C:\Windows\System\aynPvzg.exe
  C:\Windows\System\aynPvzg.exe
  2⤵
  PID:3328
- C:\Windows\System\DyQLBsW.exe
  C:\Windows\System\DyQLBsW.exe
  2⤵
  PID:3584
- C:\Windows\System\WdnOiyD.exe
  C:\Windows\System\WdnOiyD.exe
  2⤵
  PID:3648
- C:\Windows\System\JJvdfPH.exe
  C:\Windows\System\JJvdfPH.exe
  2⤵
  PID:4268
- C:\Windows\System\SPhPmUN.exe
  C:\Windows\System\SPhPmUN.exe
  2⤵
  PID:4328
- C:\Windows\System\QjLoPVM.exe
  C:\Windows\System\QjLoPVM.exe
  2⤵
  PID:4396
- C:\Windows\System\zILPYzn.exe
  C:\Windows\System\zILPYzn.exe
  2⤵
  PID:4460
- C:\Windows\System\GEobpgl.exe
  C:\Windows\System\GEobpgl.exe
  2⤵
  PID:4524
- C:\Windows\System\YoSdpsp.exe
  C:\Windows\System\YoSdpsp.exe
  2⤵
  PID:4588
- C:\Windows\System\XLkrvCD.exe
  C:\Windows\System\XLkrvCD.exe
  2⤵
  PID:4652
- C:\Windows\System\jFdVGKK.exe
  C:\Windows\System\jFdVGKK.exe
  2⤵
  PID:4716
- C:\Windows\System\EKHhoLS.exe
  C:\Windows\System\EKHhoLS.exe
  2⤵
  PID:4808
- C:\Windows\System\xYKzhiW.exe
  C:\Windows\System\xYKzhiW.exe
  2⤵
  PID:4844
- C:\Windows\System\NuXsmQt.exe
  C:\Windows\System\NuXsmQt.exe
  2⤵
  PID:4908
- C:\Windows\System\EhUqSoq.exe
  C:\Windows\System\EhUqSoq.exe
  2⤵
  PID:4972
- C:\Windows\System\eACvWmk.exe
  C:\Windows\System\eACvWmk.exe
  2⤵
  PID:5036
- C:\Windows\System\WFooNSG.exe
  C:\Windows\System\WFooNSG.exe
  2⤵
  PID:5100
- C:\Windows\System\mKqWtjO.exe
  C:\Windows\System\mKqWtjO.exe
  2⤵
  PID:4184
- C:\Windows\System\DwQXmPj.exe
  C:\Windows\System\DwQXmPj.exe
  2⤵
  PID:4536
- C:\Windows\System\lpoxODz.exe
  C:\Windows\System\lpoxODz.exe
  2⤵
  PID:2484
- C:\Windows\System\bQjlSTc.exe
  C:\Windows\System\bQjlSTc.exe
  2⤵
  PID:4956
- C:\Windows\System\HuPTtYB.exe
  C:\Windows\System\HuPTtYB.exe
  2⤵
  PID:4348
- C:\Windows\System\QAoKggQ.exe
  C:\Windows\System\QAoKggQ.exe
  2⤵
  PID:5204
- C:\Windows\System\FwFpGst.exe
  C:\Windows\System\FwFpGst.exe
  2⤵
  PID:5268
- C:\Windows\System\wbRfuvr.exe
  C:\Windows\System\wbRfuvr.exe
  2⤵
  PID:6104
- C:\Windows\System\ufKoahE.exe
  C:\Windows\System\ufKoahE.exe
  2⤵
  PID:5224
- C:\Windows\System\EMmvCyf.exe
  C:\Windows\System\EMmvCyf.exe
  2⤵
  PID:2656
- C:\Windows\System\UIzuDgj.exe
  C:\Windows\System\UIzuDgj.exe
  2⤵
  PID:5572
- C:\Windows\System\zeTAHbF.exe
  C:\Windows\System\zeTAHbF.exe
  2⤵
  PID:5764
- C:\Windows\System\rPsuZwx.exe
  C:\Windows\System\rPsuZwx.exe
  2⤵
  PID:7020
- C:\Windows\System\hvxSBPS.exe
  C:\Windows\System\hvxSBPS.exe
  2⤵
  PID:7036
- C:\Windows\System\zIRjicf.exe
  C:\Windows\System\zIRjicf.exe
  2⤵
  PID:7044
- C:\Windows\System\QaCcQEr.exe
  C:\Windows\System\QaCcQEr.exe
  2⤵
  PID:7060
- C:\Windows\System\jdUkXjP.exe
  C:\Windows\System\jdUkXjP.exe
  2⤵
  PID:7080
- C:\Windows\System\QezMteG.exe
  C:\Windows\System\QezMteG.exe
  2⤵
  PID:7096
- C:\Windows\System\MzRHBqH.exe
  C:\Windows\System\MzRHBqH.exe
  2⤵
  PID:7116
- C:\Windows\System\MEKhrDd.exe
  C:\Windows\System\MEKhrDd.exe
  2⤵
  PID:7132
- C:\Windows\System\LjNMBuK.exe
  C:\Windows\System\LjNMBuK.exe
  2⤵
  PID:7148
- C:\Windows\System\qCSpQUu.exe
  C:\Windows\System\qCSpQUu.exe
  2⤵
  PID:7164
- C:\Windows\System\KbegElB.exe
  C:\Windows\System\KbegElB.exe
  2⤵
  PID:5992
- C:\Windows\System\coggyEo.exe
  C:\Windows\System\coggyEo.exe
  2⤵
  PID:6056
- C:\Windows\System\PJLFukf.exe
  C:\Windows\System\PJLFukf.exe
  2⤵
  PID:4892
- C:\Windows\System\LdAybWW.exe
  C:\Windows\System\LdAybWW.exe
  2⤵
  PID:5288
- C:\Windows\System\RAwLUGO.exe
  C:\Windows\System\RAwLUGO.exe
  2⤵
  PID:5508
- C:\Windows\System\mycKLSo.exe
  C:\Windows\System\mycKLSo.exe
  2⤵
  PID:2144
- C:\Windows\System\XKrdjQd.exe
  C:\Windows\System\XKrdjQd.exe
  2⤵
  PID:2988
- C:\Windows\System\efEtdlT.exe
  C:\Windows\System\efEtdlT.exe
  2⤵
  PID:2192
- C:\Windows\System\howFmgX.exe
  C:\Windows\System\howFmgX.exe
  2⤵
  PID:2216
- C:\Windows\System\sVdWDIo.exe
  C:\Windows\System\sVdWDIo.exe
  2⤵
  PID:2528
- C:\Windows\System\RbMTHQH.exe
  C:\Windows\System\RbMTHQH.exe
  2⤵
  PID:3120
- C:\Windows\System\fLmFlDJ.exe
  C:\Windows\System\fLmFlDJ.exe
  2⤵
  PID:5300
- C:\Windows\System\jbsMGgG.exe
  C:\Windows\System\jbsMGgG.exe
  2⤵
  PID:5364
- C:\Windows\System\WNKFfLm.exe
  C:\Windows\System\WNKFfLm.exe
  2⤵
  PID:5400
- C:\Windows\System\UYVejVc.exe
  C:\Windows\System\UYVejVc.exe
  2⤵
  PID:5492
- C:\Windows\System\hDpKGFV.exe
  C:\Windows\System\hDpKGFV.exe
  2⤵
  PID:2700
- C:\Windows\System\YemnvpV.exe
  C:\Windows\System\YemnvpV.exe
  2⤵
  PID:3016
- C:\Windows\System\bmegCTm.exe
  C:\Windows\System\bmegCTm.exe
  2⤵
  PID:5880
- C:\Windows\System\BFFAOEW.exe
  C:\Windows\System\BFFAOEW.exe
  2⤵
  PID:2680
- C:\Windows\System\BwzBbqd.exe
  C:\Windows\System\BwzBbqd.exe
  2⤵
  PID:3376
- C:\Windows\System\YsqOkuM.exe
  C:\Windows\System\YsqOkuM.exe
  2⤵
  PID:2516
- C:\Windows\System\Ugqdbht.exe
  C:\Windows\System\Ugqdbht.exe
  2⤵
  PID:2112
- C:\Windows\System\CSPftRc.exe
  C:\Windows\System\CSPftRc.exe
  2⤵
  PID:4136
- C:\Windows\System\wrpbiDX.exe
  C:\Windows\System\wrpbiDX.exe
  2⤵
  PID:4200
- C:\Windows\System\ffQZFqr.exe
  C:\Windows\System\ffQZFqr.exe
  2⤵
  PID:4392
- C:\Windows\System\fnuTpVe.exe
  C:\Windows\System\fnuTpVe.exe
  2⤵
  PID:1536
- C:\Windows\System\RQubSsH.exe
  C:\Windows\System\RQubSsH.exe
  2⤵
  PID:3632
- C:\Windows\System\mCHlLAB.exe
  C:\Windows\System\mCHlLAB.exe
  2⤵
  PID:5588
- C:\Windows\System\tUSKmYA.exe
  C:\Windows\System\tUSKmYA.exe
  2⤵
  PID:5624
- C:\Windows\System\dFkXUpG.exe
  C:\Windows\System\dFkXUpG.exe
  2⤵
  PID:5688
- C:\Windows\System\mYNiUcy.exe
  C:\Windows\System\mYNiUcy.exe
  2⤵
  PID:3888
- C:\Windows\System\eqEepno.exe
  C:\Windows\System\eqEepno.exe
  2⤵
  PID:4904
- C:\Windows\System\njBxhJI.exe
  C:\Windows\System\njBxhJI.exe
  2⤵
  PID:5084
- C:\Windows\System\xeFdtov.exe
  C:\Windows\System\xeFdtov.exe
  2⤵
  PID:6136
- C:\Windows\System\yISSQqi.exe
  C:\Windows\System\yISSQqi.exe
  2⤵
  PID:4296
- C:\Windows\System\ZvXpXKB.exe
  C:\Windows\System\ZvXpXKB.exe
  2⤵
  PID:5780
- C:\Windows\System\gJvzGCg.exe
  C:\Windows\System\gJvzGCg.exe
  2⤵
  PID:7040
- C:\Windows\System\FNQqaaa.exe
  C:\Windows\System\FNQqaaa.exe
  2⤵
  PID:5908
- C:\Windows\System\QlWTyOU.exe
  C:\Windows\System\QlWTyOU.exe
  2⤵
  PID:3184
- C:\Windows\System\NzDvsSq.exe
  C:\Windows\System\NzDvsSq.exe
  2⤵
  PID:3412
- C:\Windows\System\gUUOrJE.exe
  C:\Windows\System\gUUOrJE.exe
  2⤵
  PID:3668
- C:\Windows\System\RRtAZNH.exe
  C:\Windows\System\RRtAZNH.exe
  2⤵
  PID:3824
- C:\Windows\System\OmAkNLI.exe
  C:\Windows\System\OmAkNLI.exe
  2⤵
  PID:4080
- C:\Windows\System\lbXwtVt.exe
  C:\Windows\System\lbXwtVt.exe
  2⤵
  PID:7108
- C:\Windows\System\rDeJLyo.exe
  C:\Windows\System\rDeJLyo.exe
  2⤵
  PID:2904
- C:\Windows\System\TPpOffY.exe
  C:\Windows\System\TPpOffY.exe
  2⤵
  PID:4064
- C:\Windows\System\naXhdUj.exe
  C:\Windows\System\naXhdUj.exe
  2⤵
  PID:1980
- C:\Windows\System\KsCTzNw.exe
  C:\Windows\System\KsCTzNw.exe
  2⤵
  PID:7144
- C:\Windows\System\SHzfTvm.exe
  C:\Windows\System\SHzfTvm.exe
  2⤵
  PID:5928
- C:\Windows\System\XmsDauq.exe
  C:\Windows\System\XmsDauq.exe
  2⤵
  PID:4632
- C:\Windows\System\BjShXFX.exe
  C:\Windows\System\BjShXFX.exe
  2⤵
  PID:7104
- C:\Windows\System\buasNlp.exe
  C:\Windows\System\buasNlp.exe
  2⤵
  PID:4584
- C:\Windows\System\hZBveXH.exe
  C:\Windows\System\hZBveXH.exe
  2⤵
  PID:4968
- C:\Windows\System\FpIhzId.exe
  C:\Windows\System\FpIhzId.exe
  2⤵
  PID:4408
- C:\Windows\System\xnXaJBh.exe
  C:\Windows\System\xnXaJBh.exe
  2⤵
  PID:4792
- C:\Windows\System\ZCaNDFo.exe
  C:\Windows\System\ZCaNDFo.exe
  2⤵
  PID:7124
- C:\Windows\System\pnPZSYk.exe
  C:\Windows\System\pnPZSYk.exe
  2⤵
  PID:5736
- C:\Windows\System\WftMQGu.exe
  C:\Windows\System\WftMQGu.exe
  2⤵
  PID:7052
- C:\Windows\System\LEnaTFb.exe
  C:\Windows\System\LEnaTFb.exe
  2⤵
  PID:6116
- C:\Windows\System\CkoxVqG.exe
  C:\Windows\System\CkoxVqG.exe
  2⤵
  PID:544
- C:\Windows\System\pCcxjNF.exe
  C:\Windows\System\pCcxjNF.exe
  2⤵
  PID:1264
- C:\Windows\System\jOgUPMB.exe
  C:\Windows\System\jOgUPMB.exe
  2⤵
  PID:5188
- C:\Windows\System\qEmXZWt.exe
  C:\Windows\System\qEmXZWt.exe
  2⤵
  PID:2532
- C:\Windows\System\jCEbtcF.exe
  C:\Windows\System\jCEbtcF.exe
  2⤵
  PID:1404
- C:\Windows\System\gfvTfMe.exe
  C:\Windows\System\gfvTfMe.exe
  2⤵
  PID:2660
- C:\Windows\System\gkpGmfN.exe
  C:\Windows\System\gkpGmfN.exe
  2⤵
  PID:748
- C:\Windows\System\XBBMAUd.exe
  C:\Windows\System\XBBMAUd.exe
  2⤵
  PID:2868
- C:\Windows\System\xeJOCeQ.exe
  C:\Windows\System\xeJOCeQ.exe
  2⤵
  PID:1636
- C:\Windows\System\MBWwiYv.exe
  C:\Windows\System\MBWwiYv.exe
  2⤵
  PID:1052
- C:\Windows\System\IFzXfBv.exe
  C:\Windows\System\IFzXfBv.exe
  2⤵
  PID:1132
- C:\Windows\System\ZkAjghr.exe
  C:\Windows\System\ZkAjghr.exe
  2⤵
  PID:2708
- C:\Windows\System\AFALdsg.exe
  C:\Windows\System\AFALdsg.exe
  2⤵
  PID:3604
- C:\Windows\System\onAjArj.exe
  C:\Windows\System\onAjArj.exe
  2⤵
  PID:4360
- C:\Windows\System\ZBmeOti.exe
  C:\Windows\System\ZBmeOti.exe
  2⤵
  PID:2636
- C:\Windows\System\DALbvyC.exe
  C:\Windows\System\DALbvyC.exe
  2⤵
  PID:808
- C:\Windows\System\Uyvrceg.exe
  C:\Windows\System\Uyvrceg.exe
  2⤵
  PID:4168
- C:\Windows\System\ihqoKsg.exe
  C:\Windows\System\ihqoKsg.exe
  2⤵
  PID:5524
- C:\Windows\System\ifaptyi.exe
  C:\Windows\System\ifaptyi.exe
  2⤵
  PID:5620
- C:\Windows\System\pQtERSa.exe
  C:\Windows\System\pQtERSa.exe
  2⤵
  PID:5560
- C:\Windows\System\bdxSMRI.exe
  C:\Windows\System\bdxSMRI.exe
  2⤵
  PID:7008
- C:\Windows\System\GioeKaf.exe
  C:\Windows\System\GioeKaf.exe
  2⤵
  PID:5812
- C:\Windows\System\GKjSygP.exe
  C:\Windows\System\GKjSygP.exe
  2⤵
  PID:4876
- C:\Windows\System\AknKghZ.exe
  C:\Windows\System\AknKghZ.exe
  2⤵
  PID:5752
- C:\Windows\System\tliasZG.exe
  C:\Windows\System\tliasZG.exe
  2⤵
  PID:3156
- C:\Windows\System\tTuBTsg.exe
  C:\Windows\System\tTuBTsg.exe
  2⤵
  PID:4052
- C:\Windows\System\oogoPMn.exe
  C:\Windows\System\oogoPMn.exe
  2⤵
  PID:3264
- C:\Windows\System\zAItNNj.exe
  C:\Windows\System\zAItNNj.exe
  2⤵
  PID:2872
- C:\Windows\System\OuyvbNe.exe
  C:\Windows\System\OuyvbNe.exe
  2⤵
  PID:5544
- C:\Windows\System\hBVvqzE.exe
  C:\Windows\System\hBVvqzE.exe
  2⤵
  PID:4812
- C:\Windows\System\mJhkQAZ.exe
  C:\Windows\System\mJhkQAZ.exe
  2⤵
  PID:1348
- C:\Windows\System\TtuCOEh.exe
  C:\Windows\System\TtuCOEh.exe
  2⤵
  PID:5336
- C:\Windows\System\mdtvLtz.exe
  C:\Windows\System\mdtvLtz.exe
  2⤵
  PID:2372
- C:\Windows\System\oMaIKIO.exe
  C:\Windows\System\oMaIKIO.exe
  2⤵
  PID:1308
- C:\Windows\System\haZCaBP.exe
  C:\Windows\System\haZCaBP.exe
  2⤵
  PID:2620
- C:\Windows\System\PGSODkG.exe
  C:\Windows\System\PGSODkG.exe
  2⤵
  PID:4156
- C:\Windows\System\SscanKe.exe
  C:\Windows\System\SscanKe.exe
  2⤵
  PID:4232
- C:\Windows\System\zkDifqD.exe
  C:\Windows\System\zkDifqD.exe
  2⤵
  PID:6068
- C:\Windows\System\ENMRiLT.exe
  C:\Windows\System\ENMRiLT.exe
  2⤵
  PID:5556
- C:\Windows\System\anXfkek.exe
  C:\Windows\System\anXfkek.exe
  2⤵
  PID:3796
- C:\Windows\System\oLecUaY.exe
  C:\Windows\System\oLecUaY.exe
  2⤵
  PID:3940
- C:\Windows\System\HsHDoPo.exe
  C:\Windows\System\HsHDoPo.exe
  2⤵
  PID:5096
- C:\Windows\System\FhkQCbm.exe
  C:\Windows\System\FhkQCbm.exe
  2⤵
  PID:1792
- C:\Windows\System\VtAnniV.exe
  C:\Windows\System\VtAnniV.exe
  2⤵
  PID:2044
- C:\Windows\System\gKbKHCU.exe
  C:\Windows\System\gKbKHCU.exe
  2⤵
  PID:2784
- C:\Windows\System\baLsNcQ.exe
  C:\Windows\System\baLsNcQ.exe
  2⤵
  PID:2564
- C:\Windows\System\rOnYiuq.exe
  C:\Windows\System\rOnYiuq.exe
  2⤵
  PID:4648
- C:\Windows\System\LsbxgLp.exe
  C:\Windows\System\LsbxgLp.exe
  2⤵
  PID:2968
- C:\Windows\System\cTtYYzC.exe
  C:\Windows\System\cTtYYzC.exe
  2⤵
  PID:5656
- C:\Windows\System\PFwyOrC.exe
  C:\Windows\System\PFwyOrC.exe
  2⤵
  PID:3568
- C:\Windows\System\kpLGxiU.exe
  C:\Windows\System\kpLGxiU.exe
  2⤵
  PID:5896
- C:\Windows\System\NCUUlzV.exe
  C:\Windows\System\NCUUlzV.exe
  2⤵
  PID:7092
- C:\Windows\System\UQsumsh.exe
  C:\Windows\System\UQsumsh.exe
  2⤵
  PID:1612
- C:\Windows\System\TEeEJCG.exe
  C:\Windows\System\TEeEJCG.exe
  2⤵
  PID:1184
- C:\Windows\System\pMWbGKC.exe
  C:\Windows\System\pMWbGKC.exe
  2⤵
  PID:4428
- C:\Windows\System\MsaGKqK.exe
  C:\Windows\System\MsaGKqK.exe
  2⤵
  PID:4940
- C:\Windows\System\XTnUjEi.exe
  C:\Windows\System\XTnUjEi.exe
  2⤵
  PID:4456
- C:\Windows\System\IDTlpIl.exe
  C:\Windows\System\IDTlpIl.exe
  2⤵
  PID:1120
- C:\Windows\System\zOTRWFd.exe
  C:\Windows\System\zOTRWFd.exe
  2⤵
  PID:1456
- C:\Windows\System\IWeqFUS.exe
  C:\Windows\System\IWeqFUS.exe
  2⤵
  PID:3712
- C:\Windows\System\kyexatw.exe
  C:\Windows\System\kyexatw.exe
  2⤵
  PID:5684
- C:\Windows\System\nwOiRhB.exe
  C:\Windows\System\nwOiRhB.exe
  2⤵
  PID:1044
- C:\Windows\System\vwrWKfm.exe
  C:\Windows\System\vwrWKfm.exe
  2⤵
  PID:4776
- C:\Windows\System\kGMbyPa.exe
  C:\Windows\System\kGMbyPa.exe
  2⤵
  PID:1440
- C:\Windows\System\RoXdkml.exe
  C:\Windows\System\RoXdkml.exe
  2⤵
  PID:5876
- C:\Windows\System\pGTrxSw.exe
  C:\Windows\System\pGTrxSw.exe
  2⤵
  PID:852
- C:\Windows\System\ninjtFa.exe
  C:\Windows\System\ninjtFa.exe
  2⤵
  PID:5192
- C:\Windows\System\IpXXCjh.exe
  C:\Windows\System\IpXXCjh.exe
  2⤵
  PID:3952
- C:\Windows\System\fOOVwpz.exe
  C:\Windows\System\fOOVwpz.exe
  2⤵
  PID:1240
- C:\Windows\System\seyCpfm.exe
  C:\Windows\System\seyCpfm.exe
  2⤵
  PID:7172
- C:\Windows\System\OxtVswE.exe
  C:\Windows\System\OxtVswE.exe
  2⤵
  PID:7196
- C:\Windows\System\ALEJOwi.exe
  C:\Windows\System\ALEJOwi.exe
  2⤵
  PID:7212
- C:\Windows\System\UFrhsmT.exe
  C:\Windows\System\UFrhsmT.exe
  2⤵
  PID:7228
- C:\Windows\System\CKPSsHB.exe
  C:\Windows\System\CKPSsHB.exe
  2⤵
  PID:7244
- C:\Windows\System\vKnymEc.exe
  C:\Windows\System\vKnymEc.exe
  2⤵
  PID:7260
- C:\Windows\System\yOESxUD.exe
  C:\Windows\System\yOESxUD.exe
  2⤵
  PID:7276
- C:\Windows\System\porKmBD.exe
  C:\Windows\System\porKmBD.exe
  2⤵
  PID:7292
- C:\Windows\System\nQOhEPf.exe
  C:\Windows\System\nQOhEPf.exe
  2⤵
  PID:7308
- C:\Windows\System\zSTDhvS.exe
  C:\Windows\System\zSTDhvS.exe
  2⤵
  PID:7324
- C:\Windows\System\ajLxQhJ.exe
  C:\Windows\System\ajLxQhJ.exe
  2⤵
  PID:7340
- C:\Windows\System\JwBFlWP.exe
  C:\Windows\System\JwBFlWP.exe
  2⤵
  PID:7356
- C:\Windows\System\kAkqSnT.exe
  C:\Windows\System\kAkqSnT.exe
  2⤵
  PID:7372
- C:\Windows\System\gXkEFmR.exe
  C:\Windows\System\gXkEFmR.exe
  2⤵
  PID:7388
- C:\Windows\System\xJNQsVu.exe
  C:\Windows\System\xJNQsVu.exe
  2⤵
  PID:7404
- C:\Windows\System\YgtXADH.exe
  C:\Windows\System\YgtXADH.exe
  2⤵
  PID:7420
- C:\Windows\System\CIRZYXm.exe
  C:\Windows\System\CIRZYXm.exe
  2⤵
  PID:7436
- C:\Windows\System\nHHmaQP.exe
  C:\Windows\System\nHHmaQP.exe
  2⤵
  PID:7452
- C:\Windows\System\gIXeJSk.exe
  C:\Windows\System\gIXeJSk.exe
  2⤵
  PID:7468
- C:\Windows\System\FEeirUM.exe
  C:\Windows\System\FEeirUM.exe
  2⤵
  PID:7484
- C:\Windows\System\nTFqjcJ.exe
  C:\Windows\System\nTFqjcJ.exe
  2⤵
  PID:7504
- C:\Windows\System\VuzplPY.exe
  C:\Windows\System\VuzplPY.exe
  2⤵
  PID:7520
- C:\Windows\System\iiIEtWL.exe
  C:\Windows\System\iiIEtWL.exe
  2⤵
  PID:7536
- C:\Windows\System\CZKLkSu.exe
  C:\Windows\System\CZKLkSu.exe
  2⤵
  PID:7552
- C:\Windows\System\PcLjKnV.exe
  C:\Windows\System\PcLjKnV.exe
  2⤵
  PID:7568
- C:\Windows\System\VOjGoSC.exe
  C:\Windows\System\VOjGoSC.exe
  2⤵
  PID:7584
- C:\Windows\System\yrIRowl.exe
  C:\Windows\System\yrIRowl.exe
  2⤵
  PID:7600
- C:\Windows\System\sqdpZjo.exe
  C:\Windows\System\sqdpZjo.exe
  2⤵
  PID:7616
- C:\Windows\System\lDsfvaz.exe
  C:\Windows\System\lDsfvaz.exe
  2⤵
  PID:7636
- C:\Windows\System\qtncpaP.exe
  C:\Windows\System\qtncpaP.exe
  2⤵
  PID:7652
- C:\Windows\System\WDPTqrD.exe
  C:\Windows\System\WDPTqrD.exe
  2⤵
  PID:7668
- C:\Windows\System\yzDcSLK.exe
  C:\Windows\System\yzDcSLK.exe
  2⤵
  PID:7684
- C:\Windows\System\dUfWcnl.exe
  C:\Windows\System\dUfWcnl.exe
  2⤵
  PID:7700
- C:\Windows\System\GoyHvTR.exe
  C:\Windows\System\GoyHvTR.exe
  2⤵
  PID:7716
- C:\Windows\System\XYVAGaV.exe
  C:\Windows\System\XYVAGaV.exe
  2⤵
  PID:7736
- C:\Windows\System\nxLDKOm.exe
  C:\Windows\System\nxLDKOm.exe
  2⤵
  PID:7752
- C:\Windows\System\sjHwDdl.exe
  C:\Windows\System\sjHwDdl.exe
  2⤵
  PID:7772
- C:\Windows\System\yLRFZcd.exe
  C:\Windows\System\yLRFZcd.exe
  2⤵
  PID:7788
- C:\Windows\System\dZewxgA.exe
  C:\Windows\System\dZewxgA.exe
  2⤵
  PID:7804
- C:\Windows\System\OUZZPpY.exe
  C:\Windows\System\OUZZPpY.exe
  2⤵
  PID:7820
- C:\Windows\System\rSbyjfL.exe
  C:\Windows\System\rSbyjfL.exe
  2⤵
  PID:7836
- C:\Windows\System\nSwqsyq.exe
  C:\Windows\System\nSwqsyq.exe
  2⤵
  PID:7852
- C:\Windows\System\cIkFdjC.exe
  C:\Windows\System\cIkFdjC.exe
  2⤵
  PID:7868
- C:\Windows\System\rNgjZIT.exe
  C:\Windows\System\rNgjZIT.exe
  2⤵
  PID:7884
- C:\Windows\System\SkacMeq.exe
  C:\Windows\System\SkacMeq.exe
  2⤵
  PID:7900
- C:\Windows\System\eQodPaD.exe
  C:\Windows\System\eQodPaD.exe
  2⤵
  PID:7920
- C:\Windows\System\CnXgirO.exe
  C:\Windows\System\CnXgirO.exe
  2⤵
  PID:7936
- C:\Windows\System\EwyFKVP.exe
  C:\Windows\System\EwyFKVP.exe
  2⤵
  PID:7952
- C:\Windows\System\UmMgTRn.exe
  C:\Windows\System\UmMgTRn.exe
  2⤵
  PID:7968
- C:\Windows\System\drxVOlw.exe
  C:\Windows\System\drxVOlw.exe
  2⤵
  PID:7984
- C:\Windows\System\YIVKEXo.exe
  C:\Windows\System\YIVKEXo.exe
  2⤵
  PID:8000
- C:\Windows\System\cReXgjz.exe
  C:\Windows\System\cReXgjz.exe
  2⤵
  PID:8016
- C:\Windows\System\SQNodfZ.exe
  C:\Windows\System\SQNodfZ.exe
  2⤵
  PID:8032
- C:\Windows\System\KJUUXyg.exe
  C:\Windows\System\KJUUXyg.exe
  2⤵
  PID:8048
- C:\Windows\System\DGYIqgN.exe
  C:\Windows\System\DGYIqgN.exe
  2⤵
  PID:8068
- C:\Windows\System\qpiONmx.exe
  C:\Windows\System\qpiONmx.exe
  2⤵
  PID:8100
- C:\Windows\System\meTeqVJ.exe
  C:\Windows\System\meTeqVJ.exe
  2⤵
  PID:8116
- C:\Windows\System\LyltfKs.exe
  C:\Windows\System\LyltfKs.exe
  2⤵
  PID:8132
- C:\Windows\System\xWynUFQ.exe
  C:\Windows\System\xWynUFQ.exe
  2⤵
  PID:8148
- C:\Windows\System\pCMwWCA.exe
  C:\Windows\System\pCMwWCA.exe
  2⤵
  PID:8164
- C:\Windows\System\EFmLssN.exe
  C:\Windows\System\EFmLssN.exe
  2⤵
  PID:8180
- C:\Windows\System\kDgNGBq.exe
  C:\Windows\System\kDgNGBq.exe
  2⤵
  PID:3936
- C:\Windows\System\droFzbv.exe
  C:\Windows\System\droFzbv.exe
  2⤵
  PID:5460
- C:\Windows\System\iCwdSxy.exe
  C:\Windows\System\iCwdSxy.exe
  2⤵
  PID:5352
- C:\Windows\System\HGWolGu.exe
  C:\Windows\System\HGWolGu.exe
  2⤵
  PID:5464
- C:\Windows\System\Aytdpjw.exe
  C:\Windows\System\Aytdpjw.exe
  2⤵
  PID:7236
- C:\Windows\System\BTtuykg.exe
  C:\Windows\System\BTtuykg.exe
  2⤵
  PID:7192
- C:\Windows\System\QCOPIex.exe
  C:\Windows\System\QCOPIex.exe
  2⤵
  PID:7332
- C:\Windows\System\vwhlotF.exe
  C:\Windows\System\vwhlotF.exe
  2⤵
  PID:7396
- C:\Windows\System\uddxsPV.exe
  C:\Windows\System\uddxsPV.exe
  2⤵
  PID:7460
- C:\Windows\System\RzgqneU.exe
  C:\Windows\System\RzgqneU.exe
  2⤵
  PID:7496
- C:\Windows\System\kOOuYpH.exe
  C:\Windows\System\kOOuYpH.exe
  2⤵
  PID:7252
- C:\Windows\System\LTGWquS.exe
  C:\Windows\System\LTGWquS.exe
  2⤵
  PID:7596
- C:\Windows\System\leAlpDP.exe
  C:\Windows\System\leAlpDP.exe
  2⤵
  PID:7288
- C:\Windows\System\NEtbBXv.exe
  C:\Windows\System\NEtbBXv.exe
  2⤵
  PID:7512
- C:\Windows\System\KTRWOCm.exe
  C:\Windows\System\KTRWOCm.exe
  2⤵
  PID:7664
- C:\Windows\System\suCZHHP.exe
  C:\Windows\System\suCZHHP.exe
  2⤵
  PID:7728
- C:\Windows\System\mqfvgOI.exe
  C:\Windows\System\mqfvgOI.exe
  2⤵
  PID:7608
- C:\Windows\System\DxlIQbr.exe
  C:\Windows\System\DxlIQbr.exe
  2⤵
  PID:7384
- C:\Windows\System\AyYBwHt.exe
  C:\Windows\System\AyYBwHt.exe
  2⤵
  PID:7448
- C:\Windows\System\SgrmREQ.exe
  C:\Windows\System\SgrmREQ.exe
  2⤵
  PID:7544
- C:\Windows\System\rwHGbav.exe
  C:\Windows\System\rwHGbav.exe
  2⤵
  PID:7644
- C:\Windows\System\QrklIrq.exe
  C:\Windows\System\QrklIrq.exe
  2⤵
  PID:7708
- C:\Windows\System\yuEpNDF.exe
  C:\Windows\System\yuEpNDF.exe
  2⤵
  PID:7748
- C:\Windows\System\pOREDSz.exe
  C:\Windows\System\pOREDSz.exe
  2⤵
  PID:7828
- C:\Windows\System\OzRKJax.exe
  C:\Windows\System\OzRKJax.exe
  2⤵
  PID:7896
- C:\Windows\System\MskcSCV.exe
  C:\Windows\System\MskcSCV.exe
  2⤵
  PID:7928
- C:\Windows\System\tBJNOFA.exe
  C:\Windows\System\tBJNOFA.exe
  2⤵
  PID:7848
- C:\Windows\System\zKDTwvd.exe
  C:\Windows\System\zKDTwvd.exe
  2⤵
  PID:7992
- C:\Windows\System\KgQigex.exe
  C:\Windows\System\KgQigex.exe
  2⤵
  PID:7916
- C:\Windows\System\CMziJVm.exe
  C:\Windows\System\CMziJVm.exe
  2⤵
  PID:8012
- C:\Windows\System\NFeRGVs.exe
  C:\Windows\System\NFeRGVs.exe
  2⤵
  PID:8008
- C:\Windows\System\FTDrcSp.exe
  C:\Windows\System\FTDrcSp.exe
  2⤵
  PID:8044
- C:\Windows\System\XGXtYnz.exe
  C:\Windows\System\XGXtYnz.exe
  2⤵
  PID:8080
- C:\Windows\System\URDBVMK.exe
  C:\Windows\System\URDBVMK.exe
  2⤵
  PID:8176
- C:\Windows\System\ElruBxA.exe
  C:\Windows\System\ElruBxA.exe
  2⤵
  PID:8084
- C:\Windows\System\LFwODMH.exe
  C:\Windows\System\LFwODMH.exe
  2⤵
  PID:7268
- C:\Windows\System\vTcmtNs.exe
  C:\Windows\System\vTcmtNs.exe
  2⤵
  PID:7368
- C:\Windows\System\sENxzCe.exe
  C:\Windows\System\sENxzCe.exe
  2⤵
  PID:7564
- C:\Windows\System\DRlNQWc.exe
  C:\Windows\System\DRlNQWc.exe
  2⤵
  PID:7696
- C:\Windows\System\ITeqKyo.exe
  C:\Windows\System\ITeqKyo.exe
  2⤵
  PID:7352
- C:\Windows\System\rXLSmVg.exe
  C:\Windows\System\rXLSmVg.exe
  2⤵
  PID:7204
- C:\Windows\System\rFIands.exe
  C:\Windows\System\rFIands.exe
  2⤵
  PID:2816
- C:\Windows\System\TXgiHJZ.exe
  C:\Windows\System\TXgiHJZ.exe
  2⤵
  PID:7068
- C:\Windows\System\IEqqjzG.exe
  C:\Windows\System\IEqqjzG.exe
  2⤵
  PID:7480
- C:\Windows\System\dTYwmjc.exe
  C:\Windows\System\dTYwmjc.exe
  2⤵
  PID:7140
- C:\Windows\System\ievEcMa.exe
  C:\Windows\System\ievEcMa.exe
  2⤵
  PID:2580
- C:\Windows\System\nmtdwGY.exe
  C:\Windows\System\nmtdwGY.exe
  2⤵
  PID:7780
- C:\Windows\System\MTTAEkf.exe
  C:\Windows\System\MTTAEkf.exe
  2⤵
  PID:2812
- C:\Windows\System\QZaLjCK.exe
  C:\Windows\System\QZaLjCK.exe
  2⤵
  PID:7816
- C:\Windows\System\KoDRoNw.exe
  C:\Windows\System\KoDRoNw.exe
  2⤵
  PID:7876
- C:\Windows\System\vxHuyhI.exe
  C:\Windows\System\vxHuyhI.exe
  2⤵
  PID:8056
- C:\Windows\System\SrynDAS.exe
  C:\Windows\System\SrynDAS.exe
  2⤵
  PID:7892
- C:\Windows\System\dCGFruE.exe
  C:\Windows\System\dCGFruE.exe
  2⤵
  PID:7976
- C:\Windows\System\ImFwNFW.exe
  C:\Windows\System\ImFwNFW.exe
  2⤵
  PID:8112
- C:\Windows\System\BqzCfyg.exe
  C:\Windows\System\BqzCfyg.exe
  2⤵
  PID:6052
- C:\Windows\System\nBGsixK.exe
  C:\Windows\System\nBGsixK.exe
  2⤵
  PID:7300
- C:\Windows\System\CjmXrjX.exe
  C:\Windows\System\CjmXrjX.exe
  2⤵
  PID:8124
- C:\Windows\System\MOZGzny.exe
  C:\Windows\System\MOZGzny.exe
  2⤵
  PID:8160
- C:\Windows\System\ORhUCGH.exe
  C:\Windows\System\ORhUCGH.exe
  2⤵
  PID:2668
- C:\Windows\System\hjixpeF.exe
  C:\Windows\System\hjixpeF.exe
  2⤵
  PID:2124
- C:\Windows\System\NoGhGbU.exe
  C:\Windows\System\NoGhGbU.exe
  2⤵
  PID:7860
- C:\Windows\System\jnveYUH.exe
  C:\Windows\System\jnveYUH.exe
  2⤵
  PID:7444
- C:\Windows\System\FmiaiuG.exe
  C:\Windows\System\FmiaiuG.exe
  2⤵
  PID:8144
- C:\Windows\System\htwHQpc.exe
  C:\Windows\System\htwHQpc.exe
  2⤵
  PID:7812
- C:\Windows\System\GbLqGGq.exe
  C:\Windows\System\GbLqGGq.exe
  2⤵
  PID:8092
- C:\Windows\System\gtwrNdv.exe
  C:\Windows\System\gtwrNdv.exe
  2⤵
  PID:2576
- C:\Windows\System\jbZSabi.exe
  C:\Windows\System\jbZSabi.exe
  2⤵
  PID:7560
- C:\Windows\System\EIpwQFe.exe
  C:\Windows\System\EIpwQFe.exe
  2⤵
  PID:7680
- C:\Windows\System\bHpacVC.exe
  C:\Windows\System\bHpacVC.exe
  2⤵
  PID:8156
- C:\Windows\System\OeIFMEh.exe
  C:\Windows\System\OeIFMEh.exe
  2⤵
  PID:8076
- C:\Windows\System\hNnkPqb.exe
  C:\Windows\System\hNnkPqb.exe
  2⤵
  PID:7844
- C:\Windows\System\elmqXdH.exe
  C:\Windows\System\elmqXdH.exe
  2⤵
  PID:7944
- C:\Windows\System\eOkfVOK.exe
  C:\Windows\System\eOkfVOK.exe
  2⤵
  PID:7500
- C:\Windows\System\ztPraVH.exe
  C:\Windows\System\ztPraVH.exe
  2⤵
  PID:7576
- C:\Windows\System\yZAcKSh.exe
  C:\Windows\System\yZAcKSh.exe
  2⤵
  PID:8208
- C:\Windows\System\wlfuQxN.exe
  C:\Windows\System\wlfuQxN.exe
  2⤵
  PID:8224
- C:\Windows\System\EbVMaea.exe
  C:\Windows\System\EbVMaea.exe
  2⤵
  PID:8240
- C:\Windows\System\xbtYgBW.exe
  C:\Windows\System\xbtYgBW.exe
  2⤵
  PID:8256
- C:\Windows\System\lpXeIux.exe
  C:\Windows\System\lpXeIux.exe
  2⤵
  PID:8276
- C:\Windows\System\rVPxVxN.exe
  C:\Windows\System\rVPxVxN.exe
  2⤵
  PID:8292
- C:\Windows\System\BqcRFKr.exe
  C:\Windows\System\BqcRFKr.exe
  2⤵
  PID:8312
- C:\Windows\System\ASUSUmm.exe
  C:\Windows\System\ASUSUmm.exe
  2⤵
  PID:8328
- C:\Windows\System\CAjMIqw.exe
  C:\Windows\System\CAjMIqw.exe
  2⤵
  PID:8344
- C:\Windows\System\GCKnpVu.exe
  C:\Windows\System\GCKnpVu.exe
  2⤵
  PID:8360
- C:\Windows\System\KlLEsCa.exe
  C:\Windows\System\KlLEsCa.exe
  2⤵
  PID:8376
- C:\Windows\System\lQbkikM.exe
  C:\Windows\System\lQbkikM.exe
  2⤵
  PID:8392
- C:\Windows\System\ANjvtTl.exe
  C:\Windows\System\ANjvtTl.exe
  2⤵
  PID:8408
- C:\Windows\System\lqwesrT.exe
  C:\Windows\System\lqwesrT.exe
  2⤵
  PID:8424
- C:\Windows\System\wJYGgdy.exe
  C:\Windows\System\wJYGgdy.exe
  2⤵
  PID:8440
- C:\Windows\System\gajKwgo.exe
  C:\Windows\System\gajKwgo.exe
  2⤵
  PID:8456
- C:\Windows\System\uFRjUSf.exe
  C:\Windows\System\uFRjUSf.exe
  2⤵
  PID:8472
- C:\Windows\System\WyMOxkR.exe
  C:\Windows\System\WyMOxkR.exe
  2⤵
  PID:8488
- C:\Windows\System\ZyCqFgh.exe
  C:\Windows\System\ZyCqFgh.exe
  2⤵
  PID:8504
- C:\Windows\System\CLgLJZC.exe
  C:\Windows\System\CLgLJZC.exe
  2⤵
  PID:8520
- C:\Windows\System\wCpVZDF.exe
  C:\Windows\System\wCpVZDF.exe
  2⤵
  PID:8536
- C:\Windows\System\cjxsyAY.exe
  C:\Windows\System\cjxsyAY.exe
  2⤵
  PID:8552
- C:\Windows\System\dJoiRAq.exe
  C:\Windows\System\dJoiRAq.exe
  2⤵
  PID:8568
- C:\Windows\System\hHzgFXW.exe
  C:\Windows\System\hHzgFXW.exe
  2⤵
  PID:8584
- C:\Windows\System\BTGORGc.exe
  C:\Windows\System\BTGORGc.exe
  2⤵
  PID:8600
- C:\Windows\System\OwTYpaM.exe
  C:\Windows\System\OwTYpaM.exe
  2⤵
  PID:8616
- C:\Windows\System\OeNCMWl.exe
  C:\Windows\System\OeNCMWl.exe
  2⤵
  PID:8632
- C:\Windows\System\jpWUDGf.exe
  C:\Windows\System\jpWUDGf.exe
  2⤵
  PID:8648
- C:\Windows\System\gTtFcmh.exe
  C:\Windows\System\gTtFcmh.exe
  2⤵
  PID:8664
- C:\Windows\System\LClRHZZ.exe
  C:\Windows\System\LClRHZZ.exe
  2⤵
  PID:8780
- C:\Windows\System\qNkRhbH.exe
  C:\Windows\System\qNkRhbH.exe
  2⤵
  PID:8816
- C:\Windows\System\gRNSWjC.exe
  C:\Windows\System\gRNSWjC.exe
  2⤵
  PID:8832
- C:\Windows\System\imSIHoM.exe
  C:\Windows\System\imSIHoM.exe
  2⤵
  PID:8848
- C:\Windows\System\ZFaONGh.exe
  C:\Windows\System\ZFaONGh.exe
  2⤵
  PID:8868
- C:\Windows\System\CIBQhnQ.exe
  C:\Windows\System\CIBQhnQ.exe
  2⤵
  PID:8888
- C:\Windows\System\UTHXLQC.exe
  C:\Windows\System\UTHXLQC.exe
  2⤵
  PID:8904
- C:\Windows\System\YJTbShY.exe
  C:\Windows\System\YJTbShY.exe
  2⤵
  PID:8920
- C:\Windows\System\wBkUcDu.exe
  C:\Windows\System\wBkUcDu.exe
  2⤵
  PID:8936
- C:\Windows\System\XNaMWuY.exe
  C:\Windows\System\XNaMWuY.exe
  2⤵
  PID:8952
- C:\Windows\System\ohGYKiw.exe
  C:\Windows\System\ohGYKiw.exe
  2⤵
  PID:8968
- C:\Windows\System\whAMnOm.exe
  C:\Windows\System\whAMnOm.exe
  2⤵
  PID:8984
- C:\Windows\System\NufVOIm.exe
  C:\Windows\System\NufVOIm.exe
  2⤵
  PID:9000
- C:\Windows\System\qxIpFph.exe
  C:\Windows\System\qxIpFph.exe
  2⤵
  PID:9016
- C:\Windows\System\iaXGlKQ.exe
  C:\Windows\System\iaXGlKQ.exe
  2⤵
  PID:9032
- C:\Windows\System\zFlkIZk.exe
  C:\Windows\System\zFlkIZk.exe
  2⤵
  PID:9048
- C:\Windows\System\Kjiyrct.exe
  C:\Windows\System\Kjiyrct.exe
  2⤵
  PID:9064
- C:\Windows\System\immYRdS.exe
  C:\Windows\System\immYRdS.exe
  2⤵
  PID:9080
- C:\Windows\System\MWeytlY.exe
  C:\Windows\System\MWeytlY.exe
  2⤵
  PID:9096
- C:\Windows\System\BRkfyYc.exe
  C:\Windows\System\BRkfyYc.exe
  2⤵
  PID:9112
- C:\Windows\System\qqGcQKB.exe
  C:\Windows\System\qqGcQKB.exe
  2⤵
  PID:9128
- C:\Windows\System\ORnuBGd.exe
  C:\Windows\System\ORnuBGd.exe
  2⤵
  PID:9144
- C:\Windows\System\OrcgDmc.exe
  C:\Windows\System\OrcgDmc.exe
  2⤵
  PID:9160
- C:\Windows\System\ukJvpWI.exe
  C:\Windows\System\ukJvpWI.exe
  2⤵
  PID:9188
- C:\Windows\System\pRaVUEB.exe
  C:\Windows\System\pRaVUEB.exe
  2⤵
  PID:7960
- C:\Windows\System\ItrGlvF.exe
  C:\Windows\System\ItrGlvF.exe
  2⤵
  PID:8284
- C:\Windows\System\CrAPrVc.exe
  C:\Windows\System\CrAPrVc.exe
  2⤵
  PID:8128
- C:\Windows\System\fnGYyDd.exe
  C:\Windows\System\fnGYyDd.exe
  2⤵
  PID:8356
- C:\Windows\System\VpoVNVq.exe
  C:\Windows\System\VpoVNVq.exe
  2⤵
  PID:7676
- C:\Windows\System\GwkBLAm.exe
  C:\Windows\System\GwkBLAm.exe
  2⤵
  PID:8204
- C:\Windows\System\BuMsNUV.exe
  C:\Windows\System\BuMsNUV.exe
  2⤵
  PID:7760
- C:\Windows\System\qeOdIvA.exe
  C:\Windows\System\qeOdIvA.exe
  2⤵
  PID:8432
- C:\Windows\System\IjWkYfi.exe
  C:\Windows\System\IjWkYfi.exe
  2⤵
  PID:8484
- C:\Windows\System\yRxEwib.exe
  C:\Windows\System\yRxEwib.exe
  2⤵
  PID:8516
- C:\Windows\System\EQjVFbo.exe
  C:\Windows\System\EQjVFbo.exe
  2⤵
  PID:8660
- C:\Windows\System\DAOatKt.exe
  C:\Windows\System\DAOatKt.exe
  2⤵
  PID:8696
- C:\Windows\System\dMuZQxU.exe
  C:\Windows\System\dMuZQxU.exe
  2⤵
  PID:8712
- C:\Windows\System\DMlJreD.exe
  C:\Windows\System\DMlJreD.exe
  2⤵
  PID:8748
- C:\Windows\System\KRiMdQo.exe
  C:\Windows\System\KRiMdQo.exe
  2⤵
  PID:8724
- C:\Windows\System\oNWVquX.exe
  C:\Windows\System\oNWVquX.exe
  2⤵
  PID:8772
- C:\Windows\System\ZcQuPOh.exe
  C:\Windows\System\ZcQuPOh.exe
  2⤵
  PID:8804
- C:\Windows\System\ABzphWJ.exe
  C:\Windows\System\ABzphWJ.exe
  2⤵
  PID:8800
- C:\Windows\System\znXNkMX.exe
  C:\Windows\System\znXNkMX.exe
  2⤵
  PID:8876
- C:\Windows\System\GHiFyih.exe
  C:\Windows\System\GHiFyih.exe
  2⤵
  PID:8900
- C:\Windows\System\ficrDXf.exe
  C:\Windows\System\ficrDXf.exe
  2⤵
  PID:8960
- C:\Windows\System\XeWjOkm.exe
  C:\Windows\System\XeWjOkm.exe
  2⤵
  PID:8916
- C:\Windows\System\GTgZnBu.exe
  C:\Windows\System\GTgZnBu.exe
  2⤵
  PID:8980
- C:\Windows\System\GrkwAmB.exe
  C:\Windows\System\GrkwAmB.exe
  2⤵
  PID:9012
- C:\Windows\System\fVKSWtB.exe
  C:\Windows\System\fVKSWtB.exe
  2⤵
  PID:9060
- C:\Windows\System\rSsFutT.exe
  C:\Windows\System\rSsFutT.exe
  2⤵
  PID:9076
- C:\Windows\System\zEKMLEN.exe
  C:\Windows\System\zEKMLEN.exe
  2⤵
  PID:9140
- C:\Windows\System\PJQvsZs.exe
  C:\Windows\System\PJQvsZs.exe
  2⤵
  PID:9152
- C:\Windows\System\jUkotkd.exe
  C:\Windows\System\jUkotkd.exe
  2⤵
  PID:9180
- C:\Windows\System\crLIWgP.exe
  C:\Windows\System\crLIWgP.exe
  2⤵
  PID:9208
- C:\Windows\System\PcLanyG.exe
  C:\Windows\System\PcLanyG.exe
  2⤵
  PID:8464
- C:\Windows\System\LdWorVh.exe
  C:\Windows\System\LdWorVh.exe
  2⤵
  PID:8612
- C:\Windows\System\ZzvaIcR.exe
  C:\Windows\System\ZzvaIcR.exe
  2⤵
  PID:8744
- C:\Windows\System\HiPZJRG.exe
  C:\Windows\System\HiPZJRG.exe
  2⤵
  PID:9196
- C:\Windows\System\EFLYScs.exe
  C:\Windows\System\EFLYScs.exe
  2⤵
  PID:8480
- C:\Windows\System\QGoKlSJ.exe
  C:\Windows\System\QGoKlSJ.exe
  2⤵
  PID:8760
- C:\Windows\System\VGkeGHO.exe
  C:\Windows\System\VGkeGHO.exe
  2⤵
  PID:9072
- C:\Windows\System\kZGbzVL.exe
  C:\Windows\System\kZGbzVL.exe
  2⤵
  PID:8372
- C:\Windows\System\hBZCWyo.exe
  C:\Windows\System\hBZCWyo.exe
  2⤵
  PID:8824
- C:\Windows\System\CLCBPnu.exe
  C:\Windows\System\CLCBPnu.exe
  2⤵
  PID:8964
- C:\Windows\System\IqbVrSL.exe
  C:\Windows\System\IqbVrSL.exe
  2⤵
  PID:9056
- C:\Windows\System\Ihigwci.exe
  C:\Windows\System\Ihigwci.exe
  2⤵
  PID:8716
- C:\Windows\System\shyzmAp.exe
  C:\Windows\System\shyzmAp.exe
  2⤵
  PID:8220
- C:\Windows\System\QUQDREJ.exe
  C:\Windows\System\QUQDREJ.exe
  2⤵
  PID:9176
- C:\Windows\System\SbbdTSA.exe
  C:\Windows\System\SbbdTSA.exe
  2⤵
  PID:8340
- C:\Windows\System\GgElloF.exe
  C:\Windows\System\GgElloF.exe
  2⤵
  PID:8108
- C:\Windows\System\zJJUcRy.exe
  C:\Windows\System\zJJUcRy.exe
  2⤵
  PID:8400
- C:\Windows\System\xBjXXDk.exe
  C:\Windows\System\xBjXXDk.exe
  2⤵
  PID:8404
- C:\Windows\System\foJqItr.exe
  C:\Windows\System\foJqItr.exe
  2⤵
  PID:8468
- C:\Windows\System\LbvEUqS.exe
  C:\Windows\System\LbvEUqS.exe
  2⤵
  PID:8496
- C:\Windows\System\FWsfBph.exe
  C:\Windows\System\FWsfBph.exe
  2⤵
  PID:8896
- C:\Windows\System\IKJfRaN.exe
  C:\Windows\System\IKJfRaN.exe
  2⤵
  PID:9008
- C:\Windows\System\ZoZXfjF.exe
  C:\Windows\System\ZoZXfjF.exe
  2⤵
  PID:8596
- C:\Windows\System\vYlmUmI.exe
  C:\Windows\System\vYlmUmI.exe
  2⤵
  PID:8688
- C:\Windows\System\TUvwPnJ.exe
  C:\Windows\System\TUvwPnJ.exe
  2⤵
  PID:8692
- C:\Windows\System\qxZAthw.exe
  C:\Windows\System\qxZAthw.exe
  2⤵
  PID:8564
- C:\Windows\System\QtXkZmu.exe
  C:\Windows\System\QtXkZmu.exe
  2⤵
  PID:2016
- C:\Windows\System\fUTFiSM.exe
  C:\Windows\System\fUTFiSM.exe
  2⤵
  PID:8420
- C:\Windows\System\SiTvAcw.exe
  C:\Windows\System\SiTvAcw.exe
  2⤵
  PID:9156
- C:\Windows\System\TZXIYpq.exe
  C:\Windows\System\TZXIYpq.exe
  2⤵
  PID:9172
- C:\Windows\System\KgwJFDg.exe
  C:\Windows\System\KgwJFDg.exe
  2⤵
  PID:8320
- C:\Windows\System\GnscxXQ.exe
  C:\Windows\System\GnscxXQ.exe
  2⤵
  PID:8336
- C:\Windows\System\NJstJpO.exe
  C:\Windows\System\NJstJpO.exe
  2⤵
  PID:8548
- C:\Windows\System\jNbbmWy.exe
  C:\Windows\System\jNbbmWy.exe
  2⤵
  PID:8864
- C:\Windows\System\XBjEQVD.exe
  C:\Windows\System\XBjEQVD.exe
  2⤵
  PID:8756
- C:\Windows\System\LycVCIY.exe
  C:\Windows\System\LycVCIY.exe
  2⤵
  PID:8948
- C:\Windows\System\PJwcSgv.exe
  C:\Windows\System\PJwcSgv.exe
  2⤵
  PID:8300
- C:\Windows\System\Wcionlw.exe
  C:\Windows\System\Wcionlw.exe
  2⤵
  PID:8200
- C:\Windows\System\mUKwFAl.exe
  C:\Windows\System\mUKwFAl.exe
  2⤵
  PID:9232
- C:\Windows\System\XdvVyWj.exe
  C:\Windows\System\XdvVyWj.exe
  2⤵
  PID:9248
- C:\Windows\System\kJuidxu.exe
  C:\Windows\System\kJuidxu.exe
  2⤵
  PID:9264
- C:\Windows\System\nSmMEPt.exe
  C:\Windows\System\nSmMEPt.exe
  2⤵
  PID:9284
- C:\Windows\System\JRryhPP.exe
  C:\Windows\System\JRryhPP.exe
  2⤵
  PID:9300
- C:\Windows\System\ISMJptH.exe
  C:\Windows\System\ISMJptH.exe
  2⤵
  PID:9316
- C:\Windows\System\bapctmG.exe
  C:\Windows\System\bapctmG.exe
  2⤵
  PID:9332
- C:\Windows\System\aHgGhHf.exe
  C:\Windows\System\aHgGhHf.exe
  2⤵
  PID:9348
- C:\Windows\System\DeygiJq.exe
  C:\Windows\System\DeygiJq.exe
  2⤵
  PID:9364
- C:\Windows\System\sBQuhRl.exe
  C:\Windows\System\sBQuhRl.exe
  2⤵
  PID:9380
- C:\Windows\System\Pcprmjx.exe
  C:\Windows\System\Pcprmjx.exe
  2⤵
  PID:9396
- C:\Windows\System\PrnfuOE.exe
  C:\Windows\System\PrnfuOE.exe
  2⤵
  PID:9412
- C:\Windows\System\dLoYGtT.exe
  C:\Windows\System\dLoYGtT.exe
  2⤵
  PID:9428
- C:\Windows\System\YOrVAOr.exe
  C:\Windows\System\YOrVAOr.exe
  2⤵
  PID:9444
- C:\Windows\System\douRpUB.exe
  C:\Windows\System\douRpUB.exe
  2⤵
  PID:9460
- C:\Windows\System\tyQSQdH.exe
  C:\Windows\System\tyQSQdH.exe
  2⤵
  PID:9476
- C:\Windows\System\pIquvso.exe
  C:\Windows\System\pIquvso.exe
  2⤵
  PID:9492
- C:\Windows\System\LTpzNAr.exe
  C:\Windows\System\LTpzNAr.exe
  2⤵
  PID:9512
- C:\Windows\System\tUiODjz.exe
  C:\Windows\System\tUiODjz.exe
  2⤵
  PID:9528
- C:\Windows\System\VbLgWql.exe
  C:\Windows\System\VbLgWql.exe
  2⤵
  PID:9544
- C:\Windows\System\QZQjIKA.exe
  C:\Windows\System\QZQjIKA.exe
  2⤵
  PID:9560
- C:\Windows\System\yZyHqoj.exe
  C:\Windows\System\yZyHqoj.exe
  2⤵
  PID:9576
- C:\Windows\System\pOtTGnw.exe
  C:\Windows\System\pOtTGnw.exe
  2⤵
  PID:9592
- C:\Windows\System\thKEPOX.exe
  C:\Windows\System\thKEPOX.exe
  2⤵
  PID:9608
- C:\Windows\System\MIwlLto.exe
  C:\Windows\System\MIwlLto.exe
  2⤵
  PID:9624
- C:\Windows\System\YdfLQbP.exe
  C:\Windows\System\YdfLQbP.exe
  2⤵
  PID:9640
- C:\Windows\System\UzHJYnJ.exe
  C:\Windows\System\UzHJYnJ.exe
  2⤵
  PID:9656
- C:\Windows\System\nDImEMA.exe
  C:\Windows\System\nDImEMA.exe
  2⤵
  PID:9672
- C:\Windows\System\tTkiMOE.exe
  C:\Windows\System\tTkiMOE.exe
  2⤵
  PID:9688
- C:\Windows\System\GRPcPiE.exe
  C:\Windows\System\GRPcPiE.exe
  2⤵
  PID:9704
- C:\Windows\System\ubWWTjc.exe
  C:\Windows\System\ubWWTjc.exe
  2⤵
  PID:9720
- C:\Windows\System\yRrQPvA.exe
  C:\Windows\System\yRrQPvA.exe
  2⤵
  PID:9736
- C:\Windows\System\dWWuVNe.exe
  C:\Windows\System\dWWuVNe.exe
  2⤵
  PID:9752
- C:\Windows\System\EYvxfFv.exe
  C:\Windows\System\EYvxfFv.exe
  2⤵
  PID:9768
- C:\Windows\System\cmWIzHI.exe
  C:\Windows\System\cmWIzHI.exe
  2⤵
  PID:9784
- C:\Windows\System\oatEEYv.exe
  C:\Windows\System\oatEEYv.exe
  2⤵
  PID:9800
- C:\Windows\System\YGJjJGH.exe
  C:\Windows\System\YGJjJGH.exe
  2⤵
  PID:9816
- C:\Windows\System\EDRqRuP.exe
  C:\Windows\System\EDRqRuP.exe
  2⤵
  PID:9832
- C:\Windows\System\nNjkKTC.exe
  C:\Windows\System\nNjkKTC.exe
  2⤵
  PID:9848
- C:\Windows\System\hfhHqXP.exe
  C:\Windows\System\hfhHqXP.exe
  2⤵
  PID:9864
- C:\Windows\System\UYeKvqO.exe
  C:\Windows\System\UYeKvqO.exe
  2⤵
  PID:9880
- C:\Windows\System\RJMXBYQ.exe
  C:\Windows\System\RJMXBYQ.exe
  2⤵
  PID:9896
- C:\Windows\System\rKBtrpp.exe
  C:\Windows\System\rKBtrpp.exe
  2⤵
  PID:9912
- C:\Windows\System\vYtbmhr.exe
  C:\Windows\System\vYtbmhr.exe
  2⤵
  PID:9928
- C:\Windows\System\kwBdStF.exe
  C:\Windows\System\kwBdStF.exe
  2⤵
  PID:9944
- C:\Windows\System\vuWogyI.exe
  C:\Windows\System\vuWogyI.exe
  2⤵
  PID:9960
- C:\Windows\System\lfDYNxh.exe
  C:\Windows\System\lfDYNxh.exe
  2⤵
  PID:9976
- C:\Windows\System\TTxvvAy.exe
  C:\Windows\System\TTxvvAy.exe
  2⤵
  PID:9992
- C:\Windows\System\FbgzjTA.exe
  C:\Windows\System\FbgzjTA.exe
  2⤵
  PID:10008
- C:\Windows\System\qLltDiM.exe
  C:\Windows\System\qLltDiM.exe
  2⤵
  PID:10024
- C:\Windows\System\KEIcrdK.exe
  C:\Windows\System\KEIcrdK.exe
  2⤵
  PID:10040
- C:\Windows\System\FgDYEMQ.exe
  C:\Windows\System\FgDYEMQ.exe
  2⤵
  PID:10056
- C:\Windows\System\lfvwAeI.exe
  C:\Windows\System\lfvwAeI.exe
  2⤵
  PID:10072
- C:\Windows\System\RAuACEu.exe
  C:\Windows\System\RAuACEu.exe
  2⤵
  PID:10088
- C:\Windows\System\kPwpHxS.exe
  C:\Windows\System\kPwpHxS.exe
  2⤵
  PID:10104
- C:\Windows\System\vJJxyfF.exe
  C:\Windows\System\vJJxyfF.exe
  2⤵
  PID:10120
- C:\Windows\System\wrUCwwv.exe
  C:\Windows\System\wrUCwwv.exe
  2⤵
  PID:10136
- C:\Windows\System\olsgZvg.exe
  C:\Windows\System\olsgZvg.exe
  2⤵
  PID:10152
- C:\Windows\System\lNJKJnL.exe
  C:\Windows\System\lNJKJnL.exe
  2⤵
  PID:10168
- C:\Windows\System\RzqXmGH.exe
  C:\Windows\System\RzqXmGH.exe
  2⤵
  PID:10184
- C:\Windows\System\ldxwGFi.exe
  C:\Windows\System\ldxwGFi.exe
  2⤵
  PID:10200
- C:\Windows\System\CQgzmGH.exe
  C:\Windows\System\CQgzmGH.exe
  2⤵
  PID:10216
- C:\Windows\System\uffOaEf.exe
  C:\Windows\System\uffOaEf.exe
  2⤵
  PID:10232
- C:\Windows\System\ftGsYyi.exe
  C:\Windows\System\ftGsYyi.exe
  2⤵
  PID:9256
- C:\Windows\System\oUlaYgL.exe
  C:\Windows\System\oUlaYgL.exe
  2⤵
  PID:9296
- C:\Windows\System\TuOdOOO.exe
  C:\Windows\System\TuOdOOO.exe
  2⤵
  PID:9360
- C:\Windows\System\DdyzzZW.exe
  C:\Windows\System\DdyzzZW.exe
  2⤵
  PID:9424
- C:\Windows\System\aPADTEt.exe
  C:\Windows\System\aPADTEt.exe
  2⤵
  PID:9456
- C:\Windows\System\YGKGHJK.exe
  C:\Windows\System\YGKGHJK.exe
  2⤵
  PID:8812
- C:\Windows\System\tZxsiNz.exe
  C:\Windows\System\tZxsiNz.exe
  2⤵
  PID:9272
- C:\Windows\System\QQMMOoK.exe
  C:\Windows\System\QQMMOoK.exe
  2⤵
  PID:8884
- C:\Windows\System\IeNbdfi.exe
  C:\Windows\System\IeNbdfi.exe
  2⤵
  PID:8672
- C:\Windows\System\KugNXhU.exe
  C:\Windows\System\KugNXhU.exe
  2⤵
  PID:8708
- C:\Windows\System\IiHpwqZ.exe
  C:\Windows\System\IiHpwqZ.exe
  2⤵
  PID:8352
- C:\Windows\System\dOFhdxm.exe
  C:\Windows\System\dOFhdxm.exe
  2⤵
  PID:8792
- C:\Windows\System\DDJExnF.exe
  C:\Windows\System\DDJExnF.exe
  2⤵
  PID:9312
- C:\Windows\System\UGYDGxe.exe
  C:\Windows\System\UGYDGxe.exe
  2⤵
  PID:9404
- C:\Windows\System\UFhImLV.exe
  C:\Windows\System\UFhImLV.exe
  2⤵
  PID:9468
- C:\Windows\System\SlUCzOt.exe
  C:\Windows\System\SlUCzOt.exe
  2⤵
  PID:9500
- C:\Windows\System\bBaFGmf.exe
  C:\Windows\System\bBaFGmf.exe
  2⤵
  PID:9588
- C:\Windows\System\LonMTiI.exe
  C:\Windows\System\LonMTiI.exe
  2⤵
  PID:9648
- C:\Windows\System\VlPoAXX.exe
  C:\Windows\System\VlPoAXX.exe
  2⤵
  PID:9540
- C:\Windows\System\nDuqZIs.exe
  C:\Windows\System\nDuqZIs.exe
  2⤵
  PID:9600
- C:\Windows\System\plTcGpl.exe
  C:\Windows\System\plTcGpl.exe
  2⤵
  PID:9744
- C:\Windows\System\UJSevNp.exe
  C:\Windows\System\UJSevNp.exe
  2⤵
  PID:9668
- C:\Windows\System\CyuYJkK.exe
  C:\Windows\System\CyuYJkK.exe
  2⤵
  PID:9808
- C:\Windows\System\uIfQFXk.exe
  C:\Windows\System\uIfQFXk.exe
  2⤵
  PID:9844
- C:\Windows\System\jVUiceU.exe
  C:\Windows\System\jVUiceU.exe
  2⤵
  PID:9908
- C:\Windows\System\CbjREiX.exe
  C:\Windows\System\CbjREiX.exe
  2⤵
  PID:9728
- C:\Windows\System\IUbTnrc.exe
  C:\Windows\System\IUbTnrc.exe
  2⤵
  PID:9892
- C:\Windows\System\awFTAvE.exe
  C:\Windows\System\awFTAvE.exe
  2⤵
  PID:9972
- C:\Windows\System\XKEzQeL.exe
  C:\Windows\System\XKEzQeL.exe
  2⤵
  PID:9828
- C:\Windows\System\DzZyfGp.exe
  C:\Windows\System\DzZyfGp.exe
  2⤵
  PID:9956
- C:\Windows\System\GryWUwz.exe
  C:\Windows\System\GryWUwz.exe
  2⤵
  PID:10032
- C:\Windows\System\iZZUJBx.exe
  C:\Windows\System\iZZUJBx.exe
  2⤵
  PID:10016
- C:\Windows\System\KgNDQaw.exe
  C:\Windows\System\KgNDQaw.exe
  2⤵
  PID:10068
- C:\Windows\System\RoqareL.exe
  C:\Windows\System\RoqareL.exe
  2⤵
  PID:10132
- C:\Windows\System\bHcZkUV.exe
  C:\Windows\System\bHcZkUV.exe
  2⤵
  PID:10192
- C:\Windows\System\sGoAKfn.exe
  C:\Windows\System\sGoAKfn.exe
  2⤵
  PID:9292
- C:\Windows\System\yqWXQAo.exe
  C:\Windows\System\yqWXQAo.exe
  2⤵
  PID:9420
- C:\Windows\System\SWfdnrE.exe
  C:\Windows\System\SWfdnrE.exe
  2⤵
  PID:10084
- C:\Windows\System\okOrQXF.exe
  C:\Windows\System\okOrQXF.exe
  2⤵
  PID:10176
- C:\Windows\System\wenzzkl.exe
  C:\Windows\System\wenzzkl.exe
  2⤵
  PID:9224
- C:\Windows\System\YfbNBkD.exe
  C:\Windows\System\YfbNBkD.exe
  2⤵
  PID:10208
- C:\Windows\System\DfLzdaf.exe
  C:\Windows\System\DfLzdaf.exe
  2⤵
  PID:9452
- C:\Windows\System\aPnqaOd.exe
  C:\Windows\System\aPnqaOd.exe
  2⤵
  PID:9372
- C:\Windows\System\HtGcOes.exe
  C:\Windows\System\HtGcOes.exe
  2⤵
  PID:9240
- C:\Windows\System\JWAGgUK.exe
  C:\Windows\System\JWAGgUK.exe
  2⤵
  PID:9436
- C:\Windows\System\QzlkbfZ.exe
  C:\Windows\System\QzlkbfZ.exe
  2⤵
  PID:9572
- C:\Windows\System\ckzPmHx.exe
  C:\Windows\System\ckzPmHx.exe
  2⤵
  PID:9556
- C:\Windows\System\XkZdZkx.exe
  C:\Windows\System\XkZdZkx.exe
  2⤵
  PID:9604
- C:\Windows\System\kwhMGkx.exe
  C:\Windows\System\kwhMGkx.exe
  2⤵
  PID:9840
- C:\Windows\System\NcSnSyW.exe
  C:\Windows\System\NcSnSyW.exe
  2⤵
  PID:9968
- C:\Windows\System\cXqEKrS.exe
  C:\Windows\System\cXqEKrS.exe
  2⤵
  PID:9700
- C:\Windows\System\dWavuiH.exe
  C:\Windows\System\dWavuiH.exe
  2⤵
  PID:9860
- C:\Windows\System\waifBoD.exe
  C:\Windows\System\waifBoD.exe
  2⤵
  PID:9952
- C:\Windows\System\YZCpjvk.exe
  C:\Windows\System\YZCpjvk.exe
  2⤵
  PID:10128
- C:\Windows\System\HeKrMJk.exe
  C:\Windows\System\HeKrMJk.exe
  2⤵
  PID:10080
- C:\Windows\System\TPkorRV.exe
  C:\Windows\System\TPkorRV.exe
  2⤵
  PID:9356
- C:\Windows\System\iBnsNji.exe
  C:\Windows\System\iBnsNji.exe
  2⤵
  PID:10196
- C:\Windows\System\WYVqSFS.exe
  C:\Windows\System\WYVqSFS.exe
  2⤵
  PID:9244
- C:\Windows\System\lIocKYC.exe
  C:\Windows\System\lIocKYC.exe
  2⤵
  PID:9620
- C:\Windows\System\BMrtoCg.exe
  C:\Windows\System\BMrtoCg.exe
  2⤵
  PID:10004
- C:\Windows\System\scOFdfU.exe
  C:\Windows\System\scOFdfU.exe
  2⤵
  PID:10052
- C:\Windows\System\wJxVwqb.exe
  C:\Windows\System\wJxVwqb.exe
  2⤵
  PID:10148
- C:\Windows\System\yRVNMLZ.exe
  C:\Windows\System\yRVNMLZ.exe
  2⤵
  PID:10100
- C:\Windows\System\IBqtCWl.exe
  C:\Windows\System\IBqtCWl.exe
  2⤵
  PID:9584
- C:\Windows\System\jOChikB.exe
  C:\Windows\System\jOChikB.exe
  2⤵
  PID:9308
- C:\Windows\System\XnufhwG.exe
  C:\Windows\System\XnufhwG.exe
  2⤵
  PID:9376
- C:\Windows\System\RrQbLYH.exe
  C:\Windows\System\RrQbLYH.exe
  2⤵
  PID:9228
- C:\Windows\System\ocvHMWZ.exe
  C:\Windows\System\ocvHMWZ.exe
  2⤵
  PID:10112
- C:\Windows\System\hjkAQhC.exe
  C:\Windows\System\hjkAQhC.exe
  2⤵
  PID:10116
- C:\Windows\System\CQWndOu.exe
  C:\Windows\System\CQWndOu.exe
  2⤵
  PID:9764
- C:\Windows\System\AnvnRpm.exe
  C:\Windows\System\AnvnRpm.exe
  2⤵
  PID:9940
- C:\Windows\System\NfueXws.exe
  C:\Windows\System\NfueXws.exe
  2⤵
  PID:2912
- C:\Windows\System\EFGZKBS.exe
  C:\Windows\System\EFGZKBS.exe
  2⤵
  PID:9716
- C:\Windows\System\hooqfRx.exe
  C:\Windows\System\hooqfRx.exe
  2⤵
  PID:10256
- C:\Windows\System\yPaMrxW.exe
  C:\Windows\System\yPaMrxW.exe
  2⤵
  PID:10272
- C:\Windows\System\ASHOmAz.exe
  C:\Windows\System\ASHOmAz.exe
  2⤵
  PID:10288
- C:\Windows\System\cNltKXC.exe
  C:\Windows\System\cNltKXC.exe
  2⤵
  PID:10304
- C:\Windows\System\RtMcSUq.exe
  C:\Windows\System\RtMcSUq.exe
  2⤵
  PID:10320
- C:\Windows\System\RuoOKjG.exe
  C:\Windows\System\RuoOKjG.exe
  2⤵
  PID:10336
- C:\Windows\System\uihRSuK.exe
  C:\Windows\System\uihRSuK.exe
  2⤵
  PID:10352
- C:\Windows\System\UAslNxA.exe
  C:\Windows\System\UAslNxA.exe
  2⤵
  PID:10368
- C:\Windows\System\qnxREMB.exe
  C:\Windows\System\qnxREMB.exe
  2⤵
  PID:10384
- C:\Windows\System\eWBOEbM.exe
  C:\Windows\System\eWBOEbM.exe
  2⤵
  PID:10400
- C:\Windows\System\HUAlZGs.exe
  C:\Windows\System\HUAlZGs.exe
  2⤵
  PID:10416
- C:\Windows\System\BFxKVFc.exe
  C:\Windows\System\BFxKVFc.exe
  2⤵
  PID:10432
- C:\Windows\System\XlLBrWU.exe
  C:\Windows\System\XlLBrWU.exe
  2⤵
  PID:10448
- C:\Windows\System\rhroHse.exe
  C:\Windows\System\rhroHse.exe
  2⤵
  PID:10464
- C:\Windows\System\lLliyGS.exe
  C:\Windows\System\lLliyGS.exe
  2⤵
  PID:10480
- C:\Windows\System\LxidFLC.exe
  C:\Windows\System\LxidFLC.exe
  2⤵
  PID:10496
- C:\Windows\System\ErnILbB.exe
  C:\Windows\System\ErnILbB.exe
  2⤵
  PID:10512
- C:\Windows\System\iWbUTKL.exe
  C:\Windows\System\iWbUTKL.exe
  2⤵
  PID:10528
- C:\Windows\System\hEAgeYv.exe
  C:\Windows\System\hEAgeYv.exe
  2⤵
  PID:10544
- C:\Windows\System\oQdnFZS.exe
  C:\Windows\System\oQdnFZS.exe
  2⤵
  PID:10560
- C:\Windows\System\ofisIxf.exe
  C:\Windows\System\ofisIxf.exe
  2⤵
  PID:10576
- C:\Windows\System\yWKjkBh.exe
  C:\Windows\System\yWKjkBh.exe
  2⤵
  PID:10592
- C:\Windows\System\VvEIsIA.exe
  C:\Windows\System\VvEIsIA.exe
  2⤵
  PID:10608
- C:\Windows\System\BzWTfUS.exe
  C:\Windows\System\BzWTfUS.exe
  2⤵
  PID:10624
- C:\Windows\System\OgIlMYH.exe
  C:\Windows\System\OgIlMYH.exe
  2⤵
  PID:10640
- C:\Windows\System\VnkdhtI.exe
  C:\Windows\System\VnkdhtI.exe
  2⤵
  PID:10656
- C:\Windows\System\JwUgcAb.exe
  C:\Windows\System\JwUgcAb.exe
  2⤵
  PID:10672
- C:\Windows\System\NlBomlw.exe
  C:\Windows\System\NlBomlw.exe
  2⤵
  PID:10688
- C:\Windows\System\DCUlKmX.exe
  C:\Windows\System\DCUlKmX.exe
  2⤵
  PID:10704
- C:\Windows\System\sSZHPhq.exe
  C:\Windows\System\sSZHPhq.exe
  2⤵
  PID:10720
- C:\Windows\System\PWzvZfV.exe
  C:\Windows\System\PWzvZfV.exe
  2⤵
  PID:10736
- C:\Windows\System\NGvDUbY.exe
  C:\Windows\System\NGvDUbY.exe
  2⤵
  PID:10752
- C:\Windows\System\vAmYuWJ.exe
  C:\Windows\System\vAmYuWJ.exe
  2⤵
  PID:10768
- C:\Windows\System\qYirrWr.exe
  C:\Windows\System\qYirrWr.exe
  2⤵
  PID:10784
- C:\Windows\System\AGJrazC.exe
  C:\Windows\System\AGJrazC.exe
  2⤵
  PID:10800
- C:\Windows\System\QNdIJWJ.exe
  C:\Windows\System\QNdIJWJ.exe
  2⤵
  PID:10816
- C:\Windows\System\ripdCzG.exe
  C:\Windows\System\ripdCzG.exe
  2⤵
  PID:10832
- C:\Windows\System\RcJYwHO.exe
  C:\Windows\System\RcJYwHO.exe
  2⤵
  PID:10848
- C:\Windows\System\LFuEWxs.exe
  C:\Windows\System\LFuEWxs.exe
  2⤵
  PID:10864
- C:\Windows\System\oBMOtCF.exe
  C:\Windows\System\oBMOtCF.exe
  2⤵
  PID:10880
- C:\Windows\System\jExCbqs.exe
  C:\Windows\System\jExCbqs.exe
  2⤵
  PID:10896
- C:\Windows\System\AGSBbfC.exe
  C:\Windows\System\AGSBbfC.exe
  2⤵
  PID:10912
- C:\Windows\System\JeTCAgT.exe
  C:\Windows\System\JeTCAgT.exe
  2⤵
  PID:10928
- C:\Windows\System\xlvRxkK.exe
  C:\Windows\System\xlvRxkK.exe
  2⤵
  PID:10944
- C:\Windows\System\GvVzrcJ.exe
  C:\Windows\System\GvVzrcJ.exe
  2⤵
  PID:10960
- C:\Windows\System\WSBhxjZ.exe
  C:\Windows\System\WSBhxjZ.exe
  2⤵
  PID:10976
- C:\Windows\System\RgIQcex.exe
  C:\Windows\System\RgIQcex.exe
  2⤵
  PID:10992
- C:\Windows\System\LBRjQKR.exe
  C:\Windows\System\LBRjQKR.exe
  2⤵
  PID:11008
- C:\Windows\System\kIUpnKc.exe
  C:\Windows\System\kIUpnKc.exe
  2⤵
  PID:11024
- C:\Windows\System\kWAaoUi.exe
  C:\Windows\System\kWAaoUi.exe
  2⤵
  PID:11040
- C:\Windows\System\OQEcCZw.exe
  C:\Windows\System\OQEcCZw.exe
  2⤵
  PID:11056
- C:\Windows\System\XXFTizJ.exe
  C:\Windows\System\XXFTizJ.exe
  2⤵
  PID:11072
- C:\Windows\System\PRqzTmC.exe
  C:\Windows\System\PRqzTmC.exe
  2⤵
  PID:11088
- C:\Windows\System\TTEJddj.exe
  C:\Windows\System\TTEJddj.exe
  2⤵
  PID:11104
- C:\Windows\System\QLAxDbV.exe
  C:\Windows\System\QLAxDbV.exe
  2⤵
  PID:11120
- C:\Windows\System\ObFMplm.exe
  C:\Windows\System\ObFMplm.exe
  2⤵
  PID:11136
- C:\Windows\System\LEAoBYL.exe
  C:\Windows\System\LEAoBYL.exe
  2⤵
  PID:11152
- C:\Windows\System\GVKeJIx.exe
  C:\Windows\System\GVKeJIx.exe
  2⤵
  PID:11168
- C:\Windows\System\ElNbszg.exe
  C:\Windows\System\ElNbszg.exe
  2⤵
  PID:11184
- C:\Windows\System\QtZhwip.exe
  C:\Windows\System\QtZhwip.exe
  2⤵
  PID:11200
- C:\Windows\System\jbBKAgI.exe
  C:\Windows\System\jbBKAgI.exe
  2⤵
  PID:11216
- C:\Windows\System\vOOMKgF.exe
  C:\Windows\System\vOOMKgF.exe
  2⤵
  PID:11232
- C:\Windows\System\sVjgtaf.exe
  C:\Windows\System\sVjgtaf.exe
  2⤵
  PID:11248
- C:\Windows\System\HJOEHdk.exe
  C:\Windows\System\HJOEHdk.exe
  2⤵
  PID:7224
- C:\Windows\System\pUZFGFi.exe
  C:\Windows\System\pUZFGFi.exe
  2⤵
  PID:10264
- C:\Windows\System\nkFJPWh.exe
  C:\Windows\System\nkFJPWh.exe
  2⤵
  PID:10332
- C:\Windows\System\ngfnGfz.exe
  C:\Windows\System\ngfnGfz.exe
  2⤵
  PID:9792
- C:\Windows\System\alXgukj.exe
  C:\Windows\System\alXgukj.exe
  2⤵
  PID:10284
- C:\Windows\System\pBnFbdA.exe
  C:\Windows\System\pBnFbdA.exe
  2⤵
  PID:10348
- C:\Windows\System\LtdIskb.exe
  C:\Windows\System\LtdIskb.exe
  2⤵
  PID:10392
- C:\Windows\System\okTcRMF.exe
  C:\Windows\System\okTcRMF.exe
  2⤵
  PID:10456
- C:\Windows\System\jDJCJCU.exe
  C:\Windows\System\jDJCJCU.exe
  2⤵
  PID:10472
- C:\Windows\System\uHtJlOs.exe
  C:\Windows\System\uHtJlOs.exe
  2⤵
  PID:10460
- C:\Windows\System\eAHphWm.exe
  C:\Windows\System\eAHphWm.exe
  2⤵
  PID:10536
- C:\Windows\System\jsnrUsk.exe
  C:\Windows\System\jsnrUsk.exe
  2⤵
  PID:10568
- C:\Windows\System\lkpMPlb.exe
  C:\Windows\System\lkpMPlb.exe
  2⤵
  PID:9504
- C:\Windows\System\wxwlbtk.exe
  C:\Windows\System\wxwlbtk.exe
  2⤵
  PID:10616
- C:\Windows\System\Qeasjzl.exe
  C:\Windows\System\Qeasjzl.exe
  2⤵
  PID:10664
- C:\Windows\System\aWjBTSa.exe
  C:\Windows\System\aWjBTSa.exe
  2⤵
  PID:10648
- C:\Windows\System\axLuOjp.exe
  C:\Windows\System\axLuOjp.exe
  2⤵
  PID:10712
- C:\Windows\System\LahzSwX.exe
  C:\Windows\System\LahzSwX.exe
  2⤵
  PID:10764
- C:\Windows\System\fgjqCGz.exe
  C:\Windows\System\fgjqCGz.exe
  2⤵
  PID:10828
- C:\Windows\System\oddtnNJ.exe
  C:\Windows\System\oddtnNJ.exe
  2⤵
  PID:10888
- C:\Windows\System\JsMSGnV.exe
  C:\Windows\System\JsMSGnV.exe
  2⤵
  PID:10952
- C:\Windows\System\AoOzVha.exe
  C:\Windows\System\AoOzVha.exe
  2⤵
  PID:10776
- C:\Windows\System\vgDDaPK.exe
  C:\Windows\System\vgDDaPK.exe
  2⤵
  PID:10780
- C:\Windows\System\npmNDCt.exe
  C:\Windows\System\npmNDCt.exe
  2⤵
  PID:10872
- C:\Windows\System\LODgFbd.exe
  C:\Windows\System\LODgFbd.exe
  2⤵
  PID:10968
- C:\Windows\System\gmXPriX.exe
  C:\Windows\System\gmXPriX.exe
  2⤵
  PID:11016
- C:\Windows\System\BenTjpd.exe
  C:\Windows\System\BenTjpd.exe
  2⤵
  PID:11080
- C:\Windows\System\qESvphO.exe
  C:\Windows\System\qESvphO.exe
  2⤵
  PID:11000
- C:\Windows\System\ZuVAgqf.exe
  C:\Windows\System\ZuVAgqf.exe
  2⤵
  PID:11064
- C:\Windows\System\fOVOlgc.exe
  C:\Windows\System\fOVOlgc.exe
  2⤵
  PID:11128
- C:\Windows\System\aLWSXTj.exe
  C:\Windows\System\aLWSXTj.exe
  2⤵
  PID:11180
- C:\Windows\System\CzPkTgn.exe
  C:\Windows\System\CzPkTgn.exe
  2⤵
  PID:11240
- C:\Windows\System\GtkDsMb.exe
  C:\Windows\System\GtkDsMb.exe
  2⤵
  PID:11224
- C:\Windows\System\jDevaOO.exe
  C:\Windows\System\jDevaOO.exe
  2⤵
  PID:11228
- C:\Windows\System\AlQYBNj.exe
  C:\Windows\System\AlQYBNj.exe
  2⤵
  PID:10296
- C:\Windows\System\RtZZWYd.exe
  C:\Windows\System\RtZZWYd.exe
  2⤵
  PID:9888
- C:\Windows\System\sSnFwVn.exe
  C:\Windows\System\sSnFwVn.exe
  2⤵
  PID:10344
- C:\Windows\System\gCoYhFl.exe
  C:\Windows\System\gCoYhFl.exe
  2⤵
  PID:10428
- C:\Windows\System\nXVJEIb.exe
  C:\Windows\System\nXVJEIb.exe
  2⤵
  PID:10552
- C:\Windows\System\DzXgrRL.exe
  C:\Windows\System\DzXgrRL.exe
  2⤵
  PID:10700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ARxcNBt.exe

Filesize
2.3MB

MD5
8e7e400fecc1ad53133068a9cd6e146c

SHA1
c674da784eb8f3575ef853c1d7378a4937e56cfe

SHA256
1405462d53e3bf8db1a71e94123df89d24f9a7585e943dee295f903811ca480b

SHA512
df079acf174be14042fa00d07f4b5a75e01fe56c263a6dcc0ee9df0a84f0e1fe45214102ba7cb3f28843e88cbc92bf6ac559b24e2373395533e57fb0fe65afee

Download Submit
C:\Windows\system\BmqMEjf.exe

Filesize
2.3MB

MD5
9571a23c11fdff46ed7f4ad6467e95a5

SHA1
af54497429df2adbf364d61244e0697b032c3a70

SHA256
024db53a42f949012b6119110d20811cdebe7f5973e216fa3c5e2c56d58c8e3b

SHA512
c2269b00026713215d3db5c461dd552d726725baff060923cdfab8daf7f3ae1c950f6527c3db1c995e73c86d6e67478d0ba382ced8d2d0f51731f7891b558523

Download Submit
C:\Windows\system\FMqNTpo.exe

Filesize
2.3MB

MD5
65dd4fd1c21ccdf448935a796e1795d4

SHA1
68240ffd4a287f98c5f1c85348f6e3be0bd8568e

SHA256
99be1d0777427f94c5c0b85218a0c50db9f918984dc451a8194b9a1ac4cd5afe

SHA512
a6390b4b4f52ad050f40bd7c7b8878f9348cd6c59a20fd6399c3df3424a3a425eb6ba4965f827854e14e31baa5f048722d90346de45cd227dfa40435ef276a6f

Download Submit
C:\Windows\system\FSDBRaI.exe

Filesize
2.3MB

MD5
11f2870a19a07f1a1c05c7ff02ac9be6

SHA1
95c7610526b88a19832324ea081648999e8045b0

SHA256
be51bf87a63587dd31950969a94aecf56e777f8c4562313fcdad522f44695ad6

SHA512
535ddeeaf19bbe7a22e399b350d2a3558ebc7502c64504836cc317d33bbce3dd67673d917973b40efbf1b5a40964f2702e169db7b77aaf451c197df102ca81ee

Download Submit
C:\Windows\system\ILmEwIF.exe

Filesize
2.3MB

MD5
0b37ecc2eb64aebb0221543a1c574389

SHA1
ed72d7ded5c214ddbafbffe69fcfe96ba1d653b8

SHA256
603d4d2c5028f9196f83e8593cfbeb75c71d4664c2a8449613b96b905249c237

SHA512
1749fd6e7b05858dd3ad771131270763a2c17e0e28e8be94c8d4172f6171556c3342473cd1fb4cecff2a9818d6887beb74e23370f90d1606fefe65c4de6db65c

Download Submit
C:\Windows\system\NexeJAO.exe

Filesize
2.3MB

MD5
b62e1068d4157cc72ef2c9fd3b9d5f97

SHA1
39839fe6821e71374d4b8f02377cfbbd58633e38

SHA256
076db8b82c6e687e528f830c7c57eb8ca063aaaec28a011fb9c0284dea86ab0d

SHA512
3b96e7136ccd7b37b6de5a39e73f1940f9d2a0f30f556355e2dde956e5a603f85e119c203f1f5a358614fed1a56f4de2aabcb24aa36b6d5c02e9677c853a0ee3

Download Submit
C:\Windows\system\OWCCwPR.exe

Filesize
2.3MB

MD5
233457d8d82527d3b3997cb154593232

SHA1
9b4d3505fd6a186ea26d2c84b6ca9065a41d0fe2

SHA256
ed250c88448873c23014fbff0d874f2d3c70a34319eee400c63d7d1c67c4e63c

SHA512
0ac1c6259bbfb4bf9373d00535a43cca959ea7787b390299ec882b5e8652d7281d474e6dcc994b2977e73c9d25bf8f544b3cdf8071a4273b9a69e0904f33fa55

Download Submit
C:\Windows\system\PmrUIIR.exe

Filesize
2.3MB

MD5
a81c0cef0f58009bbdfa05a345191c16

SHA1
bd372375cf2b0ccc6a83f4bdd12541240e10ff30

SHA256
dc3af3419e0eb0b0bdd6c1bbd6244fb0a3c271781dd182b039faf107c37e87c3

SHA512
c3e3d6eb4d7f432d218a634d30e4fdcfb2832bdff9ca665a15abdf5f11f0faa6bb532532c5f7ce2404c36ff605e8aef90f3147d4de7b8817541f6d2b4c6aacbb

Download Submit
C:\Windows\system\TUAEjvU.exe

Filesize
2.3MB

MD5
cb937427d997fb3e8fb8b0758c46cf6c

SHA1
f03c5f2d4bce133a9282d70532dfbf600a4a9627

SHA256
f0cdb9118697f66251ef5218e6ef110aa3959cb319c1300a1ec1af3ea28510ff

SHA512
1524891815dfe0ff447c2e284a22cc74a3f2eef6e82160ca206df47bd4da5d5d3808a695ed05c0c6958435065b55ebf3b6103dd910291cb24a9b273da596a183

Download Submit
C:\Windows\system\XXnXwxg.exe

Filesize
2.3MB

MD5
4912dd5a3a9ef13faebcd822e10241b8

SHA1
ac24c360e7289711ae5a77619d4150abb75c4a80

SHA256
d33ba87c08c81dcc8c8e50739709bc20fdb169f207d28524dd71ea73c28a727f

SHA512
a2ed0ff0a0df501f7b7dcc0504891dad922ac60bd523403c57feb00ec988cf2dec4943a4a891e99759ff83e72dd62099557711898326240ee034ad0e6d1fc7b4

Download Submit
C:\Windows\system\iUyknmT.exe

Filesize
2.3MB

MD5
c08c4dbed324b0c237109164ee17848a

SHA1
eedac36fcf657466d88cf9d1d1ab11f76f0b0865

SHA256
9a7b6df34092336df0e056160613bb043ed768b8e2a527ac1c75fa8d861b15d3

SHA512
383988369cc4b3569262bf104228c58fe35e9009a9677ac9cf128cc82188c8c9e701b4be73307f0f81f323a2b4da3cb4e50f77bec1def50f5b20d4764ad05e3e

Download Submit
C:\Windows\system\kwMAWPz.exe

Filesize
2.3MB

MD5
887b3bc506aa960b17d4e25cbcd4c7bd

SHA1
c1871af5a42f79b49ebdaf5d49a523065ceac2d4

SHA256
9931289baa345a11a74e9e890d5ae79e8f5c58d2f1b9fd89cd90c37a203cb377

SHA512
055cdb930090f60b58914fafd3f25f4e848610fcd4fce2cabca4bb08ef45b0c658bbe6073670bf57e29586961a67a597d6d4b6f0a4de5d99dc522bdc379b331f

Download Submit
C:\Windows\system\nDXwjmK.exe

Filesize
2.3MB

MD5
731fceba7b77b74e172621fac7e87d6d

SHA1
e4b60d62cc0ec91af3449a41332c44008abeff61

SHA256
4ba2742ec890089db18495cf26d873fdf80ab3771c53a4693fef651a8b114b9c

SHA512
d78b6f5a8ae38bad1bec87b25b66a1bfd0848689674c73015d5f57986758fea93b38102a606ceb0572c19e749f3f7808a2885d9b3d033a06d90a823619f8b210

Download Submit
C:\Windows\system\nkyhSSX.exe

Filesize
2.3MB

MD5
4deacb5073a98260206cbbf82a0dd11d

SHA1
93f09584c56957918e7e0dd68ffc0e3c91b13d76

SHA256
19265b7b66f77fd88511e4c8e5f15cee8a2599c05f88a3114b90d2248775d6b7

SHA512
17f49b314390c9c04dad37562d8308278f5c5a0e7e5dad0e39499c1c5f912579c261cf116bf4ba4fc7d40b6514730955b433c79beac45b12f9a3ac11ee7503fe

Download Submit
C:\Windows\system\oFGQzpz.exe

Filesize
2.3MB

MD5
59b4312d32027581f5a53b540ef61fd2

SHA1
379d6a961b59d902a0c2f9a2cd2fa434cd587d37

SHA256
f10487c92949976c47265d5bc28bcb83cf083f889cb2b68c17f7ae0c39634657

SHA512
7ae2533fcd8d7250559dba5220c9c53d3092debf845a5e892bfb3666f1ecfa1b7a7ceae3b80d75883b7d402ef3f0a4c43eb9885ae396f74860b0af4bf63166e1

Download Submit
C:\Windows\system\ofZWCPD.exe

Filesize
2.3MB

MD5
2bb17edd020d09af88d55b5e40d4db0e

SHA1
4f9d4511637910232cbe50ed47e4864e97204887

SHA256
0261af1ea4b1f1273dc3d18718ac4e717d92b20c6d49c76328b3d79cf30f5c0f

SHA512
07a9febfc2fa80295d896a8f5975cea57b9c159c400934f20d047adbb5271f29f50fa48c26d48cb784c0a57c17fc0da083454a8e813e08dd3dd880eeef5a48e8

Download Submit
C:\Windows\system\pcnDgrd.exe

Filesize
2.3MB

MD5
3d68c6d5bd841ee16db2b3512f31138c

SHA1
54d84d9653f193d5af52c881382fb6ddf4754d38

SHA256
1ed34de102353c575e76872ad178e524a08d2a8bf393dd1d76742d81c4ced859

SHA512
a017350e20036cf8bd0f4f33eaac743128b50f64012f1894ece4576d1ce0c90fc38f7fefdf07fcbf13406eeeb32f791d258405b022da77568b121ebf363fec48

Download Submit
C:\Windows\system\uKQBbCs.exe

Filesize
2.3MB

MD5
2e4e95935df6a5a8cb86255b3ab9297d

SHA1
5fd11403d93f01d30ef5d429ffd6c899aa3ccf0b

SHA256
670c68a739892e4ca55bbb2dc591b8d8617768c6862733c7cc4fcd08a15e07a9

SHA512
e931abb6e8013dba4628a873aaaf76cc6d927faf0c1bcdde3715542b8a5c0fc7757d17a8aa26c438cfe2681e0e0a94c492a7455077c1fbf84db8439e61175d14

Download Submit
C:\Windows\system\vFIrgoO.exe

Filesize
2.3MB

MD5
8765d14670bfeb72f592dda86c5fd3bc

SHA1
a8c33b1cc64d51fc933d3cc306c9af06808d9a59

SHA256
361a1d70fd7528bd35a264241beb052e0a611ee475997fe73f4272d16bad32ff

SHA512
062c69802305735d303fd3d93cb578b8b9050ce47c4495dd884d2aa40bbdfcd769fbac1471bc8fa88886b3722884ec212d2053e73981671e51e925e3ff93e7ed

Download Submit
C:\Windows\system\vwjbNlL.exe

Filesize
2.3MB

MD5
24ee6307f541a21675f0ee2fb4f25132

SHA1
ef6f7d151b6e724457ae49c5556ce689d4684e4c

SHA256
8989512e77066c374791bb1d1f2a2644d9cfef707a5129bb8d9b78fed63fc6e0

SHA512
6b5ef10701939db2ec5ef3f52418b95da8096b947ef74fe5feadf30b3c99cb1d64ca0f2a7950a73776120f28c0494abc52e5ca6d42f7d9158a8ec695b61ab708

Download Submit
C:\Windows\system\wnmkwKM.exe

Filesize
2.3MB

MD5
e6986718bd2b88a7254c897a0fb671bd

SHA1
b42ffd03c22697d7cdaf390c61f65d0a0903dea0

SHA256
137eaa7dc87c4edc35afacdeaf0b39ef8f58c93ad5a4b3804c291dc6404a9640

SHA512
fd363bf44f84a997c8893fe4f9a748669af7f122f2c78f139c9b0828738f1df222d502948f7ba7ece4866f95d54972384368c6dcf1a346f136952bd1e8f4b747

Download Submit
\Windows\system\JkkpLHa.exe

Filesize
2.3MB

MD5
b79858ecb13fc943ae55106e1aed3894

SHA1
c318e728d6a15dcb0d8d9f33458d50ecbcb58e78

SHA256
66b2faa996b1ed323d89f2487b19d454ebcfed502ebf962989e65461bde48102

SHA512
55eca9d7ac89d8b3891558ce96c9c3ea0f927442c29d01ff78fb0659ba1245fee685953ed57fe050938fd7316a0dfd4090ad000bf1ba00dea81bf5cdd04f15b0

Download Submit
\Windows\system\QNkautW.exe

Filesize
2.3MB

MD5
49b5e089bbd3b8d025a6ced75c1c8c9e

SHA1
43e2a17078894a5f71becce29b101e2a6f2171e4

SHA256
748283d377821ec6b565ba0c4fca16a8116ccc97a7d21731681c7d43d4e2d89b

SHA512
356792dc814cf9b57cc722693da5e087f98373d4cd1323657b7233148f01c7cae98aec1c290a4a8b50f3ecb1708f1a6dc59ad20694306b6556e167c81dd29da2

Download Submit
\Windows\system\WRwduVI.exe

Filesize
2.3MB

MD5
1577e70fdb0cf915cd166a20fada76ef

SHA1
9994d385a2f9fcb9903340ccbfb83aec319be122

SHA256
6e54d7d4b882da7917fe9f310483e580aeaa5ae0f30b44e33ef9820285e3cbc3

SHA512
529a324b923967088bdfe62f579a19cc225452422bddf720e59bbe1f49540563a3157c747e40ccd7729b7455ef2014e0b4a6fd6f850effae14bf235bc5e5f411

Download Submit
\Windows\system\WwxLGzs.exe

Filesize
2.3MB

MD5
00cc00de17e37f47a5f3b7ccf735b9b4

SHA1
47e9136c0dc81ee7a198dd7ca189c25fceb2b6f5

SHA256
1ecc6d1d6cd438a83cb8c45a46a4f7b4c2efbe268f859bad283d2b4e38e72b50

SHA512
2b7dfec3856fc64b18260598d0f4cb67955fb1f32c9aaa3067a85f9dc1082a32f63c0eeff7d8f30f6e041311ba9a60e4767138f01eceece177247fe3dcc1e077

Download Submit
\Windows\system\ZRWoJBW.exe

Filesize
2.3MB

MD5
3610b227ebc3954e3a47e69018d9f3e1

SHA1
fa36945837adde8b7f0e780170f939b4d3027fb0

SHA256
b80fc6436648caf0074d9e219ac4d19dea690501791edb6d28d063310686f842

SHA512
634616b69faf71834366b730c68d2d6963673deb258a18fec837561fd80bd957bd814507869383b7de7d53777c5dde3a29edcf86ad234eb0d28056a1900c7aef

Download Submit
\Windows\system\gsknLzp.exe

Filesize
2.3MB

MD5
0401b2efa192a42be84607b7e43d0321

SHA1
b4444823d63f3290543576f38fbdfd61f6bfb13a

SHA256
ee1235f85a06d33ef740f9ac424b737c3f25910f2930c2869589e1649dee50c4

SHA512
5204c44412d4b0d4e03d5723e018b5e2468f09254adf70d1afe30b834c51e28103c8b61acd7e64b5143932c0dcb87a191d546406f5b8a84c31cbd7b66e45953d

Download Submit
\Windows\system\kQRrjru.exe

Filesize
2.3MB

MD5
c0d8efa14e7bfdcb66738e24d2924d87

SHA1
f1a6709ef2416063c417c4794ab38b03c66bfb2a

SHA256
8a99f94060378787f25309fb98546192c6171103af4486cfe828246c489446c4

SHA512
7dc7577ab21275d8c4eb058ce75c4e34d675732dbd287c691261c43969e43862daa474ef1390aaae250ce2adcd7b9ae8e0055478b3d4ef9738f91c4ec5c83928

Download Submit
\Windows\system\kfjQKcw.exe

Filesize
2.3MB

MD5
a8efd1ff16dbcaf3e68459f415b6c39c

SHA1
1e51fba6b9fb86abdd911216e7221286418861b2

SHA256
53b23b94804699e82c9a9cc3dbf1035b8e9adadc46788e20adef5db5ef930357

SHA512
16a05b5a591902f62ed72b012ef990a85f142acaf0b38c5431a2fa4e661125a8326cad9b1f30b520cb028998b7ae19282fa92b63b4a665079f5cbbfc424be66d

Download Submit
\Windows\system\nGIewQy.exe

Filesize
2.3MB

MD5
f63d9e360962e9d231f9b46cfa872b10

SHA1
3183850f8d645d7cc53c0ef7fc01c87f541f803c

SHA256
db17b0b94c2ac2a37c693ec8b291bca88564c5c438686e0ff5d2c5e64c4c424b

SHA512
7605ba6c580b68b10eb5d2dbaa68bbccd89749a4c828de509961af926ddfd1733558a616132f9a6be865e8e425cc210bf7bff440c5eb470bd6f55b323220f776

Download Submit
\Windows\system\nsoiYCF.exe

Filesize
2.3MB

MD5
d8c21680b2b3571bbf4dd3dd01edb420

SHA1
4c2aac5ac4be264c175865a1f6e65813dd77be18

SHA256
097f69c2325b7bfc39c09eaec8092007b61e7a06aa03ef6089a041f13a1d1bfa

SHA512
d7678b7c146222b578780d9ba72013eb8462062c03dfe3545b6f035eb97961fe0e8fdb1b5bd1bfa5fd35f1c3c90a2927c7577aa60a4b302fe5920e47463ecb8e

Download Submit
\Windows\system\otKduPs.exe

Filesize
2.3MB

MD5
78da6fbf21a455e90587ca0e1758487a

SHA1
f54def1059796673cd351ce4bf8d0044410e3f85

SHA256
dd8676439c207ea6a299f3d84e24e00371dfaecf44d12b75136605e93ad9bcf4

SHA512
70b3a99e5774c85516b9cea14318ff3a5f38a86192ab2f262855fb49bda7bc8ddecc076fa85ccf5f0c24221f5df99b840cd4d2d8a2e0b194ab0d35176a50bd88

Download Submit
\Windows\system\pinxWIS.exe

Filesize
2.3MB

MD5
087d1d2c4671a41a6a42f0c159c58274

SHA1
f9a8da27a380bb236bd6b6d035d09931e0ff8f97

SHA256
02aeba40bda9ffe45d93811ea2e2eb0474a6fbd0fc143ead8b469f95afe68433

SHA512
a1c85ce07d6e56ef494c3eabde227e9e58af84dcbf8606144f07be7faffd24500de0e7e33f85ad6512c1825005374beb7f99d0b60cbb44cd32dff86693096044

Download Submit
\Windows\system\rPCWKDw.exe

Filesize
2.3MB

MD5
48a59fdb8af1425adbb3affc388389cd

SHA1
36d48ad4ad754eea7b7224622534aa63855185d7

SHA256
5348a55b6e78e826fb1a677b2ab4d231cc409f359b3ceb8cb0e19e9db86089bb

SHA512
cb309d61a2738981c53f2aeee3715b6de68f15abd07198c85debd002c0cc4ac0c9581b52278491a8987263d47130303b21b656cb96f25db1a80b1fc395272978

Download Submit
\Windows\system\vhOKBBn.exe

Filesize
2.3MB

MD5
417e9c150e182f6913dacaef398f8fc9

SHA1
4a57611c8d12414178bcc2b59a158a12abaa5e4e

SHA256
f7553cbef4e90db44c4a29f343d6dfff6beb056657c81cc22cbaaac9cdaecd57

SHA512
1c0b155c26c6c69e946ee238f05e3a8b2f9408cf37003a1debfb84e6c28588c397d2204f18efa7a462d68d6a104ed68801965f5219c36c40e660ac36beb1cd05

Download Submit
\Windows\system\yZYVUME.exe

Filesize
2.3MB

MD5
0ef7d3def3e1f22b82fa6831e4073859

SHA1
a09c42f5a6a7471c031300478021b5eeac71d238

SHA256
d7fbfa208a5acf1e4d640d284950d767efb4938f4175d6806ea614bb34229f13

SHA512
1758c4d94f5514e4c26db7e0e95a77d1cf9a050bc10ad0df6d2070b8fafd5f649a887c825b4e1c7ae06c0e7ba37356fa4c534fe4bb7fa167fb21b81168422ac6

Download Submit
memory/380-74-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/1476-49-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-72-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2012-94-0x00000000032E0000-0x00000000036D2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-15-0x00000000032E0000-0x00000000036D2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-57-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2012-21-0x00000000032E0000-0x00000000036D2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-77-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2012-85-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-0-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-25-0x00000000032E0000-0x00000000036D2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-44-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2012-63-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-102-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2408-58-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2468-67-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-61-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2552-26-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2616-33-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2684-23-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-126-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2728-128-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2796-69-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2824-98-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/3056-28-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download