xmrig | 83a159ccac790c466423abd51f969317bff1d5c041a1cbad59553d38253d6386

Analysis

max time kernel
24s
max time network
19s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
Size

1.8MB
MD5

0a1ca3b51edb6a2539b1591ecf40baeb
SHA1

9f5ea4397a1c64122c84c92b90e05e65c44adcc2
SHA256

83a159ccac790c466423abd51f969317bff1d5c041a1cbad59553d38253d6386
SHA512

e5e8b8ba3a153048b1f564d8bb8f2ee770d8b0a6e53de1e6ccf9da799cef1ca6be619b15460cbfca1fe64a84a7ec08d4816c1fc67491f5d9ae4fa8e9a208f894
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlnp:NABY

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2436-90-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2828-108-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2488-105-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2432-103-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2624-101-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/2552-98-0x000000013FFE0000-0x00000001403D2000-memory.dmp	xmrig
behavioral1/memory/2576-59-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2572	FCfSFje.exe
2568	sXdAjtV.exe
2548	ATpTUju.exe
2576	hvDuZHh.exe
2656	yXpfhJE.exe
2436	dgZTWKW.exe
2552	EQvoxao.exe
2624	ctxjcxJ.exe
2432	AzpaAOP.exe
2488	PbtSUgA.exe
2828	YdlkyzZ.exe
1448	Tqniowr.exe
860	lvVbShp.exe
280	InzeKog.exe
1364	IAiusNc.exe
1752	lrLAFpb.exe
2476	dvpDJBd.exe
2132	bHwHRMh.exe
1872	hEELhGb.exe
2452	ULWyQam.exe
1932	YVWbeCc.exe
2008	ZyfxgLR.exe
1864	VzvbOXS.exe
704	rZxwruH.exe
1124	AEPpaWg.exe
800	zDIlsuk.exe
2152	IhRiDvv.exe
1700	wSktGcw.exe
1780	hGnsjgc.exe
1472	JXHlxkO.exe
1316	oGRxCcw.exe
892	OpbDOtC.exe
924	CZVkknC.exe
2936	zDTcSPX.exe
2084	UWADFSg.exe
3020	UmhyLOo.exe
2100	zssoOVx.exe
2092	JIYzqwG.exe
1952	aPZRsAi.exe
2240	amoVudT.exe
1540	QFemJwO.exe
2508	SOQCIUP.exe
2912	heNrSrq.exe
2676	qKjPtJu.exe
2456	EBBNgko.exe
1196	RhLegeS.exe
1252	hklbJAs.exe
1176	zlipCQt.exe
2932	hMsqUiv.exe
1056	NRqpFgP.exe
2644	pEysxFP.exe
1824	QgUATVj.exe
2512	Kijuqyd.exe
588	uwhPkNg.exe
1076	MrROSCU.exe
1760	UXWhCuV.exe
2380	VQbXvkN.exe
856	mxFIrrR.exe
2952	KMAOhjS.exe
2780	XuxuEJt.exe
1892	pCPOnhl.exe
820	jaiKGWn.exe
776	QosWoeo.exe
3068	SIZTHir.exe

Loads dropped DLL 64 IoCs

pid	Process
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2204-1-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/files/0x000e000000012335-6.dat	upx
behavioral1/files/0x0016000000005586-16.dat	upx
behavioral1/files/0x0009000000012349-27.dat	upx
behavioral1/files/0x000900000001234d-30.dat	upx
behavioral1/files/0x0009000000012351-35.dat	upx
behavioral1/files/0x0009000000013144-38.dat	upx
behavioral1/files/0x000700000001318d-42.dat	upx
behavioral1/files/0x00070000000133bc-52.dat	upx
behavioral1/files/0x0007000000013309-50.dat	upx
behavioral1/files/0x0007000000013216-46.dat	upx
behavioral1/files/0x000a000000012345-23.dat	upx
behavioral1/files/0x000700000001342e-73.dat	upx
behavioral1/files/0x0007000000013599-78.dat	upx
behavioral1/files/0x0007000000013708-81.dat	upx
behavioral1/files/0x0007000000013417-70.dat	upx
behavioral1/memory/2656-66-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/files/0x0007000000013a3f-122.dat	upx
behavioral1/files/0x00070000000139f1-115.dat	upx
behavioral1/files/0x0007000000013a88-131.dat	upx
behavioral1/files/0x0006000000013f2c-139.dat	upx
behavioral1/files/0x0006000000014183-146.dat	upx
behavioral1/files/0x0006000000014251-151.dat	upx
behavioral1/files/0x000600000001432f-160.dat	upx
behavioral1/files/0x00060000000143fb-167.dat	upx
behavioral1/files/0x00060000000144e9-174.dat	upx
behavioral1/files/0x0006000000014677-186.dat	upx
behavioral1/files/0x00060000000144f9-181.dat	upx
behavioral1/memory/2436-90-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/files/0x000600000001459d-183.dat	upx
behavioral1/files/0x00060000000144f1-176.dat	upx
behavioral1/files/0x0006000000014457-169.dat	upx
behavioral1/files/0x0006000000014367-162.dat	upx
behavioral1/files/0x000600000001431b-155.dat	upx
behavioral1/files/0x000600000001418c-148.dat	upx
behavioral1/files/0x0006000000014171-141.dat	upx
behavioral1/files/0x0007000000013adc-133.dat	upx
behavioral1/files/0x0007000000013a53-126.dat	upx
behavioral1/memory/2828-108-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2488-105-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2432-103-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2624-101-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/memory/2552-98-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/files/0x003100000001233d-118.dat	upx
behavioral1/memory/2576-59-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2548-57-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2568-55-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/memory/2572-53-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/files/0x003000000001233b-15.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AVjLNGU.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\iqEiEpg.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\AXkWFlA.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\AEPpaWg.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\XPjwlYm.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\pgNSYTH.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\iwfqDbA.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\hzWYKrP.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\qfRXOss.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\MbRAwgx.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\bzXpMXb.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\ztKrljU.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\NGGqOhu.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\qotgtOS.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\zDYOwIs.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\UYZmjRJ.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\zlipCQt.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\CuWdOTV.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\kCGxSHY.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\pUfFHuX.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\aLdfbRM.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\hzVJCLt.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\mycrrkj.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\svtgiQB.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\qSAZkOm.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\ctvjstY.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\QDZuqkz.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\TMaqXmJ.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\nHLzQln.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\tTTEPDJ.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\OpbDOtC.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\kiEcGbJ.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\DGqLTXA.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\CCXodQG.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\IxXwEhw.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\yEUsnxk.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\cWKbLYV.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\RUglCba.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\WPYSPwG.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\RtOFGVc.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\CTOTWsc.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\eJOrdAH.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\MoEhFLK.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\WrncUTV.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\RTUmdWa.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\joHudll.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\MjhrjBU.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\pDjPTWX.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\xQpAfIn.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\RpGfvEd.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\jjTNMMA.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\zBbolqS.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\bNEwJHA.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\uNkQkUf.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\YbajedH.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\TLqLjnA.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\QeJFwIm.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\pNmceyT.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\jMMbsdn.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\sbwhnVk.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\FXtSxDf.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\SYtwbra.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\RHKIHiP.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
File created	C:\Windows\System\OCwASiW.exe	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2700	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
Token: SeDebugPrivilege	2700	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2700	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	29
PID 2204 wrote to memory of 2700	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	29
PID 2204 wrote to memory of 2700	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	29
PID 2204 wrote to memory of 2572	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	30
PID 2204 wrote to memory of 2572	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	30
PID 2204 wrote to memory of 2572	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	30
PID 2204 wrote to memory of 2568	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	31
PID 2204 wrote to memory of 2568	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	31
PID 2204 wrote to memory of 2568	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	31
PID 2204 wrote to memory of 2548	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	32
PID 2204 wrote to memory of 2548	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	32
PID 2204 wrote to memory of 2548	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	32
PID 2204 wrote to memory of 2576	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	33
PID 2204 wrote to memory of 2576	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	33
PID 2204 wrote to memory of 2576	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	33
PID 2204 wrote to memory of 2656	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	34
PID 2204 wrote to memory of 2656	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	34
PID 2204 wrote to memory of 2656	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	34
PID 2204 wrote to memory of 2436	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	35
PID 2204 wrote to memory of 2436	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	35
PID 2204 wrote to memory of 2436	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	35
PID 2204 wrote to memory of 2552	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	36
PID 2204 wrote to memory of 2552	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	36
PID 2204 wrote to memory of 2552	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	36
PID 2204 wrote to memory of 2624	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	37
PID 2204 wrote to memory of 2624	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	37
PID 2204 wrote to memory of 2624	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	37
PID 2204 wrote to memory of 2432	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	38
PID 2204 wrote to memory of 2432	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	38
PID 2204 wrote to memory of 2432	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	38
PID 2204 wrote to memory of 2488	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	39
PID 2204 wrote to memory of 2488	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	39
PID 2204 wrote to memory of 2488	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	39
PID 2204 wrote to memory of 2828	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	40
PID 2204 wrote to memory of 2828	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	40
PID 2204 wrote to memory of 2828	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	40
PID 2204 wrote to memory of 1448	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	41
PID 2204 wrote to memory of 1448	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	41
PID 2204 wrote to memory of 1448	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	41
PID 2204 wrote to memory of 860	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	42
PID 2204 wrote to memory of 860	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	42
PID 2204 wrote to memory of 860	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	42
PID 2204 wrote to memory of 1364	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	43
PID 2204 wrote to memory of 1364	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	43
PID 2204 wrote to memory of 1364	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	43
PID 2204 wrote to memory of 280	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	44
PID 2204 wrote to memory of 280	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	44
PID 2204 wrote to memory of 280	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	44
PID 2204 wrote to memory of 1752	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	45
PID 2204 wrote to memory of 1752	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	45
PID 2204 wrote to memory of 1752	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	45
PID 2204 wrote to memory of 2476	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	46
PID 2204 wrote to memory of 2476	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	46
PID 2204 wrote to memory of 2476	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	46
PID 2204 wrote to memory of 2132	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	47
PID 2204 wrote to memory of 2132	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	47
PID 2204 wrote to memory of 2132	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	47
PID 2204 wrote to memory of 1872	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	48
PID 2204 wrote to memory of 1872	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	48
PID 2204 wrote to memory of 1872	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	48
PID 2204 wrote to memory of 1056	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	49
PID 2204 wrote to memory of 1056	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	49
PID 2204 wrote to memory of 1056	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	49
PID 2204 wrote to memory of 2452	2204	0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a1ca3b51edb6a2539b1591ecf40baeb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\System\FCfSFje.exe
  C:\Windows\System\FCfSFje.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\sXdAjtV.exe
  C:\Windows\System\sXdAjtV.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\ATpTUju.exe
  C:\Windows\System\ATpTUju.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\hvDuZHh.exe
  C:\Windows\System\hvDuZHh.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\yXpfhJE.exe
  C:\Windows\System\yXpfhJE.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\dgZTWKW.exe
  C:\Windows\System\dgZTWKW.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\EQvoxao.exe
  C:\Windows\System\EQvoxao.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\ctxjcxJ.exe
  C:\Windows\System\ctxjcxJ.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\AzpaAOP.exe
  C:\Windows\System\AzpaAOP.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\PbtSUgA.exe
  C:\Windows\System\PbtSUgA.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\YdlkyzZ.exe
  C:\Windows\System\YdlkyzZ.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\Tqniowr.exe
  C:\Windows\System\Tqniowr.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\lvVbShp.exe
  C:\Windows\System\lvVbShp.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\IAiusNc.exe
  C:\Windows\System\IAiusNc.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\InzeKog.exe
  C:\Windows\System\InzeKog.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\lrLAFpb.exe
  C:\Windows\System\lrLAFpb.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\dvpDJBd.exe
  C:\Windows\System\dvpDJBd.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\bHwHRMh.exe
  C:\Windows\System\bHwHRMh.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\hEELhGb.exe
  C:\Windows\System\hEELhGb.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\NRqpFgP.exe
  C:\Windows\System\NRqpFgP.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\ULWyQam.exe
  C:\Windows\System\ULWyQam.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\pEysxFP.exe
  C:\Windows\System\pEysxFP.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\YVWbeCc.exe
  C:\Windows\System\YVWbeCc.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\QgUATVj.exe
  C:\Windows\System\QgUATVj.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\ZyfxgLR.exe
  C:\Windows\System\ZyfxgLR.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\Kijuqyd.exe
  C:\Windows\System\Kijuqyd.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\VzvbOXS.exe
  C:\Windows\System\VzvbOXS.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\uwhPkNg.exe
  C:\Windows\System\uwhPkNg.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\rZxwruH.exe
  C:\Windows\System\rZxwruH.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\MrROSCU.exe
  C:\Windows\System\MrROSCU.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\AEPpaWg.exe
  C:\Windows\System\AEPpaWg.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\UXWhCuV.exe
  C:\Windows\System\UXWhCuV.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\zDIlsuk.exe
  C:\Windows\System\zDIlsuk.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\VQbXvkN.exe
  C:\Windows\System\VQbXvkN.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\IhRiDvv.exe
  C:\Windows\System\IhRiDvv.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\mxFIrrR.exe
  C:\Windows\System\mxFIrrR.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\wSktGcw.exe
  C:\Windows\System\wSktGcw.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\KMAOhjS.exe
  C:\Windows\System\KMAOhjS.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\hGnsjgc.exe
  C:\Windows\System\hGnsjgc.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\XuxuEJt.exe
  C:\Windows\System\XuxuEJt.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\JXHlxkO.exe
  C:\Windows\System\JXHlxkO.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\pCPOnhl.exe
  C:\Windows\System\pCPOnhl.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\oGRxCcw.exe
  C:\Windows\System\oGRxCcw.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\jaiKGWn.exe
  C:\Windows\System\jaiKGWn.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\OpbDOtC.exe
  C:\Windows\System\OpbDOtC.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\QosWoeo.exe
  C:\Windows\System\QosWoeo.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\CZVkknC.exe
  C:\Windows\System\CZVkknC.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\SIZTHir.exe
  C:\Windows\System\SIZTHir.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\zDTcSPX.exe
  C:\Windows\System\zDTcSPX.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\KvTDgqU.exe
  C:\Windows\System\KvTDgqU.exe
  2⤵
  PID:2220
- C:\Windows\System\UWADFSg.exe
  C:\Windows\System\UWADFSg.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\QbRKOcc.exe
  C:\Windows\System\QbRKOcc.exe
  2⤵
  PID:1688
- C:\Windows\System\UmhyLOo.exe
  C:\Windows\System\UmhyLOo.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\HCRNtoD.exe
  C:\Windows\System\HCRNtoD.exe
  2⤵
  PID:1120
- C:\Windows\System\zssoOVx.exe
  C:\Windows\System\zssoOVx.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\FItsRAq.exe
  C:\Windows\System\FItsRAq.exe
  2⤵
  PID:2276
- C:\Windows\System\JIYzqwG.exe
  C:\Windows\System\JIYzqwG.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\ldvXTeM.exe
  C:\Windows\System\ldvXTeM.exe
  2⤵
  PID:1904
- C:\Windows\System\aPZRsAi.exe
  C:\Windows\System\aPZRsAi.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\xYzivKC.exe
  C:\Windows\System\xYzivKC.exe
  2⤵
  PID:2384
- C:\Windows\System\amoVudT.exe
  C:\Windows\System\amoVudT.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\BUwGMXZ.exe
  C:\Windows\System\BUwGMXZ.exe
  2⤵
  PID:2956
- C:\Windows\System\QFemJwO.exe
  C:\Windows\System\QFemJwO.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\OjrZGon.exe
  C:\Windows\System\OjrZGon.exe
  2⤵
  PID:1532
- C:\Windows\System\SOQCIUP.exe
  C:\Windows\System\SOQCIUP.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\HnbVXSM.exe
  C:\Windows\System\HnbVXSM.exe
  2⤵
  PID:2760
- C:\Windows\System\heNrSrq.exe
  C:\Windows\System\heNrSrq.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\uRukeep.exe
  C:\Windows\System\uRukeep.exe
  2⤵
  PID:2448
- C:\Windows\System\qKjPtJu.exe
  C:\Windows\System\qKjPtJu.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\mOUiAhE.exe
  C:\Windows\System\mOUiAhE.exe
  2⤵
  PID:2472
- C:\Windows\System\EBBNgko.exe
  C:\Windows\System\EBBNgko.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\xcAxESD.exe
  C:\Windows\System\xcAxESD.exe
  2⤵
  PID:2652
- C:\Windows\System\RhLegeS.exe
  C:\Windows\System\RhLegeS.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\iSTxOtT.exe
  C:\Windows\System\iSTxOtT.exe
  2⤵
  PID:2332
- C:\Windows\System\hklbJAs.exe
  C:\Windows\System\hklbJAs.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\HzGZtOD.exe
  C:\Windows\System\HzGZtOD.exe
  2⤵
  PID:2344
- C:\Windows\System\zlipCQt.exe
  C:\Windows\System\zlipCQt.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\fjiUmCx.exe
  C:\Windows\System\fjiUmCx.exe
  2⤵
  PID:608
- C:\Windows\System\hMsqUiv.exe
  C:\Windows\System\hMsqUiv.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\kYBItIS.exe
  C:\Windows\System\kYBItIS.exe
  2⤵
  PID:2596
- C:\Windows\System\lmtZixc.exe
  C:\Windows\System\lmtZixc.exe
  2⤵
  PID:2216
- C:\Windows\System\rvknxRN.exe
  C:\Windows\System\rvknxRN.exe
  2⤵
  PID:300
- C:\Windows\System\uFfLBsZ.exe
  C:\Windows\System\uFfLBsZ.exe
  2⤵
  PID:2416
- C:\Windows\System\XYNbVoz.exe
  C:\Windows\System\XYNbVoz.exe
  2⤵
  PID:2620
- C:\Windows\System\AsxEeVj.exe
  C:\Windows\System\AsxEeVj.exe
  2⤵
  PID:1520
- C:\Windows\System\BAtlErb.exe
  C:\Windows\System\BAtlErb.exe
  2⤵
  PID:2732
- C:\Windows\System\JCIgsoP.exe
  C:\Windows\System\JCIgsoP.exe
  2⤵
  PID:1420
- C:\Windows\System\ySahPmR.exe
  C:\Windows\System\ySahPmR.exe
  2⤵
  PID:2776
- C:\Windows\System\dIydXve.exe
  C:\Windows\System\dIydXve.exe
  2⤵
  PID:2244
- C:\Windows\System\ImUhxLS.exe
  C:\Windows\System\ImUhxLS.exe
  2⤵
  PID:1644
- C:\Windows\System\ZWZlWVO.exe
  C:\Windows\System\ZWZlWVO.exe
  2⤵
  PID:2176
- C:\Windows\System\OSQiLYH.exe
  C:\Windows\System\OSQiLYH.exe
  2⤵
  PID:2696
- C:\Windows\System\EnYxnhs.exe
  C:\Windows\System\EnYxnhs.exe
  2⤵
  PID:2884
- C:\Windows\System\kxRzqXZ.exe
  C:\Windows\System\kxRzqXZ.exe
  2⤵
  PID:3048
- C:\Windows\System\hMbbRIE.exe
  C:\Windows\System\hMbbRIE.exe
  2⤵
  PID:2556
- C:\Windows\System\QxFWlAb.exe
  C:\Windows\System\QxFWlAb.exe
  2⤵
  PID:1604
- C:\Windows\System\reqwkUn.exe
  C:\Windows\System\reqwkUn.exe
  2⤵
  PID:564
- C:\Windows\System\pJbASbr.exe
  C:\Windows\System\pJbASbr.exe
  2⤵
  PID:896
- C:\Windows\System\qpSlraV.exe
  C:\Windows\System\qpSlraV.exe
  2⤵
  PID:1668
- C:\Windows\System\ACcZpLu.exe
  C:\Windows\System\ACcZpLu.exe
  2⤵
  PID:880
- C:\Windows\System\LsSCani.exe
  C:\Windows\System\LsSCani.exe
  2⤵
  PID:2896
- C:\Windows\System\MtUXQvG.exe
  C:\Windows\System\MtUXQvG.exe
  2⤵
  PID:644
- C:\Windows\System\wdjXBVY.exe
  C:\Windows\System\wdjXBVY.exe
  2⤵
  PID:1048
- C:\Windows\System\COKEqcR.exe
  C:\Windows\System\COKEqcR.exe
  2⤵
  PID:2208
- C:\Windows\System\bzXpMXb.exe
  C:\Windows\System\bzXpMXb.exe
  2⤵
  PID:1632
- C:\Windows\System\kMFWBwN.exe
  C:\Windows\System\kMFWBwN.exe
  2⤵
  PID:2172
- C:\Windows\System\pntBSpf.exe
  C:\Windows\System\pntBSpf.exe
  2⤵
  PID:2664
- C:\Windows\System\hFsJvgW.exe
  C:\Windows\System\hFsJvgW.exe
  2⤵
  PID:1192
- C:\Windows\System\WEGxEZM.exe
  C:\Windows\System\WEGxEZM.exe
  2⤵
  PID:2668
- C:\Windows\System\OgrsdFh.exe
  C:\Windows\System\OgrsdFh.exe
  2⤵
  PID:3088
- C:\Windows\System\sGbqepH.exe
  C:\Windows\System\sGbqepH.exe
  2⤵
  PID:3104
- C:\Windows\System\AbHgHRW.exe
  C:\Windows\System\AbHgHRW.exe
  2⤵
  PID:3120
- C:\Windows\System\LtflIsE.exe
  C:\Windows\System\LtflIsE.exe
  2⤵
  PID:3140
- C:\Windows\System\EgjiaZr.exe
  C:\Windows\System\EgjiaZr.exe
  2⤵
  PID:3156
- C:\Windows\System\ejZfryE.exe
  C:\Windows\System\ejZfryE.exe
  2⤵
  PID:3172
- C:\Windows\System\DNqzzVZ.exe
  C:\Windows\System\DNqzzVZ.exe
  2⤵
  PID:3188
- C:\Windows\System\zabBCEq.exe
  C:\Windows\System\zabBCEq.exe
  2⤵
  PID:3204
- C:\Windows\System\kiEcGbJ.exe
  C:\Windows\System\kiEcGbJ.exe
  2⤵
  PID:3220
- C:\Windows\System\aeYBbWn.exe
  C:\Windows\System\aeYBbWn.exe
  2⤵
  PID:3236
- C:\Windows\System\YHwccbe.exe
  C:\Windows\System\YHwccbe.exe
  2⤵
  PID:3252
- C:\Windows\System\bAxibvG.exe
  C:\Windows\System\bAxibvG.exe
  2⤵
  PID:3268
- C:\Windows\System\GsEbCbi.exe
  C:\Windows\System\GsEbCbi.exe
  2⤵
  PID:3284
- C:\Windows\System\NpPNEZT.exe
  C:\Windows\System\NpPNEZT.exe
  2⤵
  PID:3300
- C:\Windows\System\PjxJdol.exe
  C:\Windows\System\PjxJdol.exe
  2⤵
  PID:3316
- C:\Windows\System\sFQasWa.exe
  C:\Windows\System\sFQasWa.exe
  2⤵
  PID:3332
- C:\Windows\System\XAnUIzJ.exe
  C:\Windows\System\XAnUIzJ.exe
  2⤵
  PID:3348
- C:\Windows\System\ApzmZSo.exe
  C:\Windows\System\ApzmZSo.exe
  2⤵
  PID:3364
- C:\Windows\System\lByINip.exe
  C:\Windows\System\lByINip.exe
  2⤵
  PID:3460
- C:\Windows\System\XVyntjw.exe
  C:\Windows\System\XVyntjw.exe
  2⤵
  PID:3476
- C:\Windows\System\cOjdLzF.exe
  C:\Windows\System\cOjdLzF.exe
  2⤵
  PID:3492
- C:\Windows\System\ESwRADT.exe
  C:\Windows\System\ESwRADT.exe
  2⤵
  PID:3508
- C:\Windows\System\rGVDNyH.exe
  C:\Windows\System\rGVDNyH.exe
  2⤵
  PID:3528
- C:\Windows\System\PAkydcx.exe
  C:\Windows\System\PAkydcx.exe
  2⤵
  PID:3604
- C:\Windows\System\nTdiVmh.exe
  C:\Windows\System\nTdiVmh.exe
  2⤵
  PID:3624
- C:\Windows\System\BKvwufn.exe
  C:\Windows\System\BKvwufn.exe
  2⤵
  PID:3644
- C:\Windows\System\AYLutCt.exe
  C:\Windows\System\AYLutCt.exe
  2⤵
  PID:3664
- C:\Windows\System\ZjyfNHn.exe
  C:\Windows\System\ZjyfNHn.exe
  2⤵
  PID:3680
- C:\Windows\System\kWEzAQk.exe
  C:\Windows\System\kWEzAQk.exe
  2⤵
  PID:3704
- C:\Windows\System\QoQwBME.exe
  C:\Windows\System\QoQwBME.exe
  2⤵
  PID:3720
- C:\Windows\System\sgvWgzl.exe
  C:\Windows\System\sgvWgzl.exe
  2⤵
  PID:3736
- C:\Windows\System\sxufWuC.exe
  C:\Windows\System\sxufWuC.exe
  2⤵
  PID:3756
- C:\Windows\System\nlrftEW.exe
  C:\Windows\System\nlrftEW.exe
  2⤵
  PID:3772
- C:\Windows\System\DdmSrNt.exe
  C:\Windows\System\DdmSrNt.exe
  2⤵
  PID:3792
- C:\Windows\System\FGCyZqe.exe
  C:\Windows\System\FGCyZqe.exe
  2⤵
  PID:3808
- C:\Windows\System\NUSMFvX.exe
  C:\Windows\System\NUSMFvX.exe
  2⤵
  PID:3840
- C:\Windows\System\eRSNBim.exe
  C:\Windows\System\eRSNBim.exe
  2⤵
  PID:3860
- C:\Windows\System\FzSySeU.exe
  C:\Windows\System\FzSySeU.exe
  2⤵
  PID:3884
- C:\Windows\System\OGGCkSJ.exe
  C:\Windows\System\OGGCkSJ.exe
  2⤵
  PID:3904
- C:\Windows\System\zsbddzZ.exe
  C:\Windows\System\zsbddzZ.exe
  2⤵
  PID:3920
- C:\Windows\System\CkIDqIW.exe
  C:\Windows\System\CkIDqIW.exe
  2⤵
  PID:3944
- C:\Windows\System\iWTNjTV.exe
  C:\Windows\System\iWTNjTV.exe
  2⤵
  PID:3964
- C:\Windows\System\HGuFXaD.exe
  C:\Windows\System\HGuFXaD.exe
  2⤵
  PID:3988
- C:\Windows\System\GxldfgG.exe
  C:\Windows\System\GxldfgG.exe
  2⤵
  PID:4004
- C:\Windows\System\srcbssA.exe
  C:\Windows\System\srcbssA.exe
  2⤵
  PID:4032
- C:\Windows\System\SbjXqOA.exe
  C:\Windows\System\SbjXqOA.exe
  2⤵
  PID:4048
- C:\Windows\System\XHxBVIw.exe
  C:\Windows\System\XHxBVIw.exe
  2⤵
  PID:4068
- C:\Windows\System\amrGDbB.exe
  C:\Windows\System\amrGDbB.exe
  2⤵
  PID:4088
- C:\Windows\System\QLKRgVw.exe
  C:\Windows\System\QLKRgVw.exe
  2⤵
  PID:1444
- C:\Windows\System\GYVeGTQ.exe
  C:\Windows\System\GYVeGTQ.exe
  2⤵
  PID:1388
- C:\Windows\System\daSTXty.exe
  C:\Windows\System\daSTXty.exe
  2⤵
  PID:2196
- C:\Windows\System\pCgMPIu.exe
  C:\Windows\System\pCgMPIu.exe
  2⤵
  PID:3116
- C:\Windows\System\HUhPAKq.exe
  C:\Windows\System\HUhPAKq.exe
  2⤵
  PID:2824
- C:\Windows\System\DGqLTXA.exe
  C:\Windows\System\DGqLTXA.exe
  2⤵
  PID:2308
- C:\Windows\System\VPQmtAu.exe
  C:\Windows\System\VPQmtAu.exe
  2⤵
  PID:2632
- C:\Windows\System\sUrjCSh.exe
  C:\Windows\System\sUrjCSh.exe
  2⤵
  PID:1028
- C:\Windows\System\RmhBhsB.exe
  C:\Windows\System\RmhBhsB.exe
  2⤵
  PID:3212
- C:\Windows\System\TblRFTD.exe
  C:\Windows\System\TblRFTD.exe
  2⤵
  PID:3248
- C:\Windows\System\aHvYBKi.exe
  C:\Windows\System\aHvYBKi.exe
  2⤵
  PID:3344
- C:\Windows\System\RSJOBWQ.exe
  C:\Windows\System\RSJOBWQ.exe
  2⤵
  PID:3388
- C:\Windows\System\twmmvUa.exe
  C:\Windows\System\twmmvUa.exe
  2⤵
  PID:3408
- C:\Windows\System\rjjclZo.exe
  C:\Windows\System\rjjclZo.exe
  2⤵
  PID:3420
- C:\Windows\System\XYvGBzo.exe
  C:\Windows\System\XYvGBzo.exe
  2⤵
  PID:3436
- C:\Windows\System\vJcWamw.exe
  C:\Windows\System\vJcWamw.exe
  2⤵
  PID:3448
- C:\Windows\System\QIizvqy.exe
  C:\Windows\System\QIizvqy.exe
  2⤵
  PID:3520
- C:\Windows\System\OHRpDeK.exe
  C:\Windows\System\OHRpDeK.exe
  2⤵
  PID:2520
- C:\Windows\System\EQngqLv.exe
  C:\Windows\System\EQngqLv.exe
  2⤵
  PID:3544
- C:\Windows\System\zwtTkLU.exe
  C:\Windows\System\zwtTkLU.exe
  2⤵
  PID:3500
- C:\Windows\System\XPjwlYm.exe
  C:\Windows\System\XPjwlYm.exe
  2⤵
  PID:3552
- C:\Windows\System\KmthNyy.exe
  C:\Windows\System\KmthNyy.exe
  2⤵
  PID:3360
- C:\Windows\System\tTTEPDJ.exe
  C:\Windows\System\tTTEPDJ.exe
  2⤵
  PID:3264
- C:\Windows\System\kxxbNOk.exe
  C:\Windows\System\kxxbNOk.exe
  2⤵
  PID:3228
- C:\Windows\System\cONJhAN.exe
  C:\Windows\System\cONJhAN.exe
  2⤵
  PID:3580
- C:\Windows\System\VhaPNAx.exe
  C:\Windows\System\VhaPNAx.exe
  2⤵
  PID:3596
- C:\Windows\System\eTWvqRI.exe
  C:\Windows\System\eTWvqRI.exe
  2⤵
  PID:3660
- C:\Windows\System\ZYLjCHq.exe
  C:\Windows\System\ZYLjCHq.exe
  2⤵
  PID:3696
- C:\Windows\System\asDKdjQ.exe
  C:\Windows\System\asDKdjQ.exe
  2⤵
  PID:3728
- C:\Windows\System\qdALhid.exe
  C:\Windows\System\qdALhid.exe
  2⤵
  PID:3768
- C:\Windows\System\BZokCgG.exe
  C:\Windows\System\BZokCgG.exe
  2⤵
  PID:3804
- C:\Windows\System\zFUVTyW.exe
  C:\Windows\System\zFUVTyW.exe
  2⤵
  PID:3752
- C:\Windows\System\hcfWZVE.exe
  C:\Windows\System\hcfWZVE.exe
  2⤵
  PID:3816
- C:\Windows\System\dVxnMuN.exe
  C:\Windows\System\dVxnMuN.exe
  2⤵
  PID:3832
- C:\Windows\System\dobaQDZ.exe
  C:\Windows\System\dobaQDZ.exe
  2⤵
  PID:3900
- C:\Windows\System\ogxBRfc.exe
  C:\Windows\System\ogxBRfc.exe
  2⤵
  PID:3912
- C:\Windows\System\juvDvgz.exe
  C:\Windows\System\juvDvgz.exe
  2⤵
  PID:3928
- C:\Windows\System\ykyyGHB.exe
  C:\Windows\System\ykyyGHB.exe
  2⤵
  PID:3916
- C:\Windows\System\BHiaSMZ.exe
  C:\Windows\System\BHiaSMZ.exe
  2⤵
  PID:3956
- C:\Windows\System\jypApTR.exe
  C:\Windows\System\jypApTR.exe
  2⤵
  PID:2348
- C:\Windows\System\lTHSHVa.exe
  C:\Windows\System\lTHSHVa.exe
  2⤵
  PID:2236
- C:\Windows\System\RWzTFAO.exe
  C:\Windows\System\RWzTFAO.exe
  2⤵
  PID:3976
- C:\Windows\System\aupaBCZ.exe
  C:\Windows\System\aupaBCZ.exe
  2⤵
  PID:4000
- C:\Windows\System\hAjolhr.exe
  C:\Windows\System\hAjolhr.exe
  2⤵
  PID:2408
- C:\Windows\System\HpVfuXR.exe
  C:\Windows\System\HpVfuXR.exe
  2⤵
  PID:2412
- C:\Windows\System\CmOFUPa.exe
  C:\Windows\System\CmOFUPa.exe
  2⤵
  PID:1756
- C:\Windows\System\sFFaZsb.exe
  C:\Windows\System\sFFaZsb.exe
  2⤵
  PID:4080
- C:\Windows\System\LfKjesJ.exe
  C:\Windows\System\LfKjesJ.exe
  2⤵
  PID:2280
- C:\Windows\System\ffFWngG.exe
  C:\Windows\System\ffFWngG.exe
  2⤵
  PID:2300
- C:\Windows\System\JpRzFia.exe
  C:\Windows\System\JpRzFia.exe
  2⤵
  PID:2580
- C:\Windows\System\kqOIUwP.exe
  C:\Windows\System\kqOIUwP.exe
  2⤵
  PID:1916
- C:\Windows\System\ZLogmTZ.exe
  C:\Windows\System\ZLogmTZ.exe
  2⤵
  PID:2112
- C:\Windows\System\ncUmxHQ.exe
  C:\Windows\System\ncUmxHQ.exe
  2⤵
  PID:1768
- C:\Windows\System\SWHbSPg.exe
  C:\Windows\System\SWHbSPg.exe
  2⤵
  PID:2480
- C:\Windows\System\oMMGlJn.exe
  C:\Windows\System\oMMGlJn.exe
  2⤵
  PID:1276
- C:\Windows\System\DtAMwNI.exe
  C:\Windows\System\DtAMwNI.exe
  2⤵
  PID:2164
- C:\Windows\System\qXdNOtY.exe
  C:\Windows\System\qXdNOtY.exe
  2⤵
  PID:3244
- C:\Windows\System\CCXodQG.exe
  C:\Windows\System\CCXodQG.exe
  2⤵
  PID:3376
- C:\Windows\System\iLeDgKv.exe
  C:\Windows\System\iLeDgKv.exe
  2⤵
  PID:3396
- C:\Windows\System\WPKRdrp.exe
  C:\Windows\System\WPKRdrp.exe
  2⤵
  PID:3400
- C:\Windows\System\uifnjcD.exe
  C:\Windows\System\uifnjcD.exe
  2⤵
  PID:3100
- C:\Windows\System\eesrbCO.exe
  C:\Windows\System\eesrbCO.exe
  2⤵
  PID:3444
- C:\Windows\System\LvHRlWp.exe
  C:\Windows\System\LvHRlWp.exe
  2⤵
  PID:3524
- C:\Windows\System\yEUsnxk.exe
  C:\Windows\System\yEUsnxk.exe
  2⤵
  PID:2544
- C:\Windows\System\IhsnJln.exe
  C:\Windows\System\IhsnJln.exe
  2⤵
  PID:836
- C:\Windows\System\XTPFRfT.exe
  C:\Windows\System\XTPFRfT.exe
  2⤵
  PID:472
- C:\Windows\System\RYXVqum.exe
  C:\Windows\System\RYXVqum.exe
  2⤵
  PID:3356
- C:\Windows\System\SJrgLpL.exe
  C:\Windows\System\SJrgLpL.exe
  2⤵
  PID:3296
- C:\Windows\System\npWtmQa.exe
  C:\Windows\System\npWtmQa.exe
  2⤵
  PID:3232
- C:\Windows\System\ZteHUlg.exe
  C:\Windows\System\ZteHUlg.exe
  2⤵
  PID:3592
- C:\Windows\System\TIWIHHB.exe
  C:\Windows\System\TIWIHHB.exe
  2⤵
  PID:3656
- C:\Windows\System\CyOxuBO.exe
  C:\Windows\System\CyOxuBO.exe
  2⤵
  PID:3712
- C:\Windows\System\benMtjr.exe
  C:\Windows\System\benMtjr.exe
  2⤵
  PID:3748
- C:\Windows\System\NNPxEOJ.exe
  C:\Windows\System\NNPxEOJ.exe
  2⤵
  PID:3744
- C:\Windows\System\cWKbLYV.exe
  C:\Windows\System\cWKbLYV.exe
  2⤵
  PID:4100
- C:\Windows\System\QpUIUYE.exe
  C:\Windows\System\QpUIUYE.exe
  2⤵
  PID:4116
- C:\Windows\System\ztKrljU.exe
  C:\Windows\System\ztKrljU.exe
  2⤵
  PID:4136
- C:\Windows\System\UcBGdwm.exe
  C:\Windows\System\UcBGdwm.exe
  2⤵
  PID:4152
- C:\Windows\System\KSfzVHa.exe
  C:\Windows\System\KSfzVHa.exe
  2⤵
  PID:4168
- C:\Windows\System\XjRSpSx.exe
  C:\Windows\System\XjRSpSx.exe
  2⤵
  PID:4184
- C:\Windows\System\VwjfYFR.exe
  C:\Windows\System\VwjfYFR.exe
  2⤵
  PID:4200
- C:\Windows\System\svtgiQB.exe
  C:\Windows\System\svtgiQB.exe
  2⤵
  PID:4216
- C:\Windows\System\CrfemVo.exe
  C:\Windows\System\CrfemVo.exe
  2⤵
  PID:4232
- C:\Windows\System\XpPpubU.exe
  C:\Windows\System\XpPpubU.exe
  2⤵
  PID:4252
- C:\Windows\System\RHKIHiP.exe
  C:\Windows\System\RHKIHiP.exe
  2⤵
  PID:4268
- C:\Windows\System\oPMRoFM.exe
  C:\Windows\System\oPMRoFM.exe
  2⤵
  PID:4284
- C:\Windows\System\QFueJnM.exe
  C:\Windows\System\QFueJnM.exe
  2⤵
  PID:4300
- C:\Windows\System\glVIoEg.exe
  C:\Windows\System\glVIoEg.exe
  2⤵
  PID:4316
- C:\Windows\System\BtKlyHB.exe
  C:\Windows\System\BtKlyHB.exe
  2⤵
  PID:4332
- C:\Windows\System\LDMqugu.exe
  C:\Windows\System\LDMqugu.exe
  2⤵
  PID:4348
- C:\Windows\System\SBHNZCm.exe
  C:\Windows\System\SBHNZCm.exe
  2⤵
  PID:4364
- C:\Windows\System\UjiQYtJ.exe
  C:\Windows\System\UjiQYtJ.exe
  2⤵
  PID:4384
- C:\Windows\System\TtGAEPX.exe
  C:\Windows\System\TtGAEPX.exe
  2⤵
  PID:4400
- C:\Windows\System\xqpwVeM.exe
  C:\Windows\System\xqpwVeM.exe
  2⤵
  PID:4416
- C:\Windows\System\MUBBFdC.exe
  C:\Windows\System\MUBBFdC.exe
  2⤵
  PID:4432
- C:\Windows\System\snHTxej.exe
  C:\Windows\System\snHTxej.exe
  2⤵
  PID:4448
- C:\Windows\System\bLntwQa.exe
  C:\Windows\System\bLntwQa.exe
  2⤵
  PID:4464
- C:\Windows\System\HkYQwzl.exe
  C:\Windows\System\HkYQwzl.exe
  2⤵
  PID:4480
- C:\Windows\System\AGzSvgO.exe
  C:\Windows\System\AGzSvgO.exe
  2⤵
  PID:4500
- C:\Windows\System\hXZrKpf.exe
  C:\Windows\System\hXZrKpf.exe
  2⤵
  PID:4692
- C:\Windows\System\ArWUYQp.exe
  C:\Windows\System\ArWUYQp.exe
  2⤵
  PID:4816
- C:\Windows\System\JUDxJWA.exe
  C:\Windows\System\JUDxJWA.exe
  2⤵
  PID:4836
- C:\Windows\System\nfouBAO.exe
  C:\Windows\System\nfouBAO.exe
  2⤵
  PID:4852
- C:\Windows\System\RHgoRtJ.exe
  C:\Windows\System\RHgoRtJ.exe
  2⤵
  PID:4868
- C:\Windows\System\DLOjXVJ.exe
  C:\Windows\System\DLOjXVJ.exe
  2⤵
  PID:4884
- C:\Windows\System\CmYHiiz.exe
  C:\Windows\System\CmYHiiz.exe
  2⤵
  PID:4904
- C:\Windows\System\RGCIGqS.exe
  C:\Windows\System\RGCIGqS.exe
  2⤵
  PID:4920
- C:\Windows\System\ulAabSD.exe
  C:\Windows\System\ulAabSD.exe
  2⤵
  PID:4936
- C:\Windows\System\xZwSsSg.exe
  C:\Windows\System\xZwSsSg.exe
  2⤵
  PID:4952
- C:\Windows\System\hefIIXE.exe
  C:\Windows\System\hefIIXE.exe
  2⤵
  PID:4968
- C:\Windows\System\olzQIgk.exe
  C:\Windows\System\olzQIgk.exe
  2⤵
  PID:4984
- C:\Windows\System\kiUSWGQ.exe
  C:\Windows\System\kiUSWGQ.exe
  2⤵
  PID:5000
- C:\Windows\System\LIQOvma.exe
  C:\Windows\System\LIQOvma.exe
  2⤵
  PID:5016
- C:\Windows\System\PhhENBq.exe
  C:\Windows\System\PhhENBq.exe
  2⤵
  PID:5036
- C:\Windows\System\pHiwEGh.exe
  C:\Windows\System\pHiwEGh.exe
  2⤵
  PID:5076
- C:\Windows\System\tMPFtIF.exe
  C:\Windows\System\tMPFtIF.exe
  2⤵
  PID:5116
- C:\Windows\System\yRIeuPT.exe
  C:\Windows\System\yRIeuPT.exe
  2⤵
  PID:4028
- C:\Windows\System\RrEHyca.exe
  C:\Windows\System\RrEHyca.exe
  2⤵
  PID:1480
- C:\Windows\System\rireImM.exe
  C:\Windows\System\rireImM.exe
  2⤵
  PID:2592
- C:\Windows\System\CYIqriI.exe
  C:\Windows\System\CYIqriI.exe
  2⤵
  PID:1416
- C:\Windows\System\vGDRctN.exe
  C:\Windows\System\vGDRctN.exe
  2⤵
  PID:2036
- C:\Windows\System\XCgqRvz.exe
  C:\Windows\System\XCgqRvz.exe
  2⤵
  PID:1968
- C:\Windows\System\LCRExCo.exe
  C:\Windows\System\LCRExCo.exe
  2⤵
  PID:3380
- C:\Windows\System\KsbPmsg.exe
  C:\Windows\System\KsbPmsg.exe
  2⤵
  PID:3096
- C:\Windows\System\TGxVCof.exe
  C:\Windows\System\TGxVCof.exe
  2⤵
  PID:3428
- C:\Windows\System\RugFYTO.exe
  C:\Windows\System\RugFYTO.exe
  2⤵
  PID:3784
- C:\Windows\System\DbuODWp.exe
  C:\Windows\System\DbuODWp.exe
  2⤵
  PID:3616
- C:\Windows\System\tqESLHT.exe
  C:\Windows\System\tqESLHT.exe
  2⤵
  PID:3636
- C:\Windows\System\saAafrF.exe
  C:\Windows\System\saAafrF.exe
  2⤵
  PID:3932
- C:\Windows\System\UCDsLVR.exe
  C:\Windows\System\UCDsLVR.exe
  2⤵
  PID:4160
- C:\Windows\System\nkbzJfg.exe
  C:\Windows\System\nkbzJfg.exe
  2⤵
  PID:3560
- C:\Windows\System\PPsMmXH.exe
  C:\Windows\System\PPsMmXH.exe
  2⤵
  PID:3828
- C:\Windows\System\uoyxdOw.exe
  C:\Windows\System\uoyxdOw.exe
  2⤵
  PID:2352
- C:\Windows\System\qSAZkOm.exe
  C:\Windows\System\qSAZkOm.exe
  2⤵
  PID:4244
- C:\Windows\System\gpAKYnc.exe
  C:\Windows\System\gpAKYnc.exe
  2⤵
  PID:4524
- C:\Windows\System\MBpbebH.exe
  C:\Windows\System\MBpbebH.exe
  2⤵
  PID:320
- C:\Windows\System\teSruoQ.exe
  C:\Windows\System\teSruoQ.exe
  2⤵
  PID:4552
- C:\Windows\System\IrnFwfa.exe
  C:\Windows\System\IrnFwfa.exe
  2⤵
  PID:4544
- C:\Windows\System\AKVNWpE.exe
  C:\Windows\System\AKVNWpE.exe
  2⤵
  PID:4564
- C:\Windows\System\CQYTJLz.exe
  C:\Windows\System\CQYTJLz.exe
  2⤵
  PID:4584
- C:\Windows\System\colQzWo.exe
  C:\Windows\System\colQzWo.exe
  2⤵
  PID:4600
- C:\Windows\System\qaieVft.exe
  C:\Windows\System\qaieVft.exe
  2⤵
  PID:4632
- C:\Windows\System\cMYtDer.exe
  C:\Windows\System\cMYtDer.exe
  2⤵
  PID:4640
- C:\Windows\System\mrxgjdX.exe
  C:\Windows\System\mrxgjdX.exe
  2⤵
  PID:3892
- C:\Windows\System\MjhrjBU.exe
  C:\Windows\System\MjhrjBU.exe
  2⤵
  PID:4512
- C:\Windows\System\jjWczrX.exe
  C:\Windows\System\jjWczrX.exe
  2⤵
  PID:4412
- C:\Windows\System\SjOXWDb.exe
  C:\Windows\System\SjOXWDb.exe
  2⤵
  PID:4260
- C:\Windows\System\zrfwqJm.exe
  C:\Windows\System\zrfwqJm.exe
  2⤵
  PID:4460
- C:\Windows\System\hYprJUI.exe
  C:\Windows\System\hYprJUI.exe
  2⤵
  PID:4492
- C:\Windows\System\IhTdywA.exe
  C:\Windows\System\IhTdywA.exe
  2⤵
  PID:4440
- C:\Windows\System\iStBBFG.exe
  C:\Windows\System\iStBBFG.exe
  2⤵
  PID:4652
- C:\Windows\System\JaFzLJh.exe
  C:\Windows\System\JaFzLJh.exe
  2⤵
  PID:4676
- C:\Windows\System\OQVvRbY.exe
  C:\Windows\System\OQVvRbY.exe
  2⤵
  PID:4744
- C:\Windows\System\KEQNBWG.exe
  C:\Windows\System\KEQNBWG.exe
  2⤵
  PID:4776
- C:\Windows\System\wFIlHEy.exe
  C:\Windows\System\wFIlHEy.exe
  2⤵
  PID:4792
- C:\Windows\System\ihKJYlD.exe
  C:\Windows\System\ihKJYlD.exe
  2⤵
  PID:4808
- C:\Windows\System\CRMkjvc.exe
  C:\Windows\System\CRMkjvc.exe
  2⤵
  PID:4828
- C:\Windows\System\KtQEiPU.exe
  C:\Windows\System\KtQEiPU.exe
  2⤵
  PID:4880
- C:\Windows\System\CuWdOTV.exe
  C:\Windows\System\CuWdOTV.exe
  2⤵
  PID:4900
- C:\Windows\System\gKRQrNt.exe
  C:\Windows\System\gKRQrNt.exe
  2⤵
  PID:4896
- C:\Windows\System\VGKUmYo.exe
  C:\Windows\System\VGKUmYo.exe
  2⤵
  PID:4980
- C:\Windows\System\UXMeqGx.exe
  C:\Windows\System\UXMeqGx.exe
  2⤵
  PID:844
- C:\Windows\System\BkDpiMc.exe
  C:\Windows\System\BkDpiMc.exe
  2⤵
  PID:4992
- C:\Windows\System\rqyiWgB.exe
  C:\Windows\System\rqyiWgB.exe
  2⤵
  PID:5032
- C:\Windows\System\EukUMwZ.exe
  C:\Windows\System\EukUMwZ.exe
  2⤵
  PID:5084
- C:\Windows\System\XqHDjMs.exe
  C:\Windows\System\XqHDjMs.exe
  2⤵
  PID:5104
- C:\Windows\System\wYnTrxG.exe
  C:\Windows\System\wYnTrxG.exe
  2⤵
  PID:5100
- C:\Windows\System\RpjXxnI.exe
  C:\Windows\System\RpjXxnI.exe
  2⤵
  PID:4060
- C:\Windows\System\pDmZaSs.exe
  C:\Windows\System\pDmZaSs.exe
  2⤵
  PID:3848
- C:\Windows\System\LNCHuKU.exe
  C:\Windows\System\LNCHuKU.exe
  2⤵
  PID:3996
- C:\Windows\System\qzuhHNA.exe
  C:\Windows\System\qzuhHNA.exe
  2⤵
  PID:4672
- C:\Windows\System\SSXhQke.exe
  C:\Windows\System\SSXhQke.exe
  2⤵
  PID:2328
- C:\Windows\System\ZjzoWBU.exe
  C:\Windows\System\ZjzoWBU.exe
  2⤵
  PID:3084
- C:\Windows\System\fUUNAGn.exe
  C:\Windows\System\fUUNAGn.exe
  2⤵
  PID:3216
- C:\Windows\System\BxniqRp.exe
  C:\Windows\System\BxniqRp.exe
  2⤵
  PID:3452
- C:\Windows\System\nPOXvLQ.exe
  C:\Windows\System\nPOXvLQ.exe
  2⤵
  PID:3872
- C:\Windows\System\bdJWVZw.exe
  C:\Windows\System\bdJWVZw.exe
  2⤵
  PID:3260
- C:\Windows\System\GtPXDGu.exe
  C:\Windows\System\GtPXDGu.exe
  2⤵
  PID:3572
- C:\Windows\System\JeImkXl.exe
  C:\Windows\System\JeImkXl.exe
  2⤵
  PID:3676
- C:\Windows\System\WWQuGDF.exe
  C:\Windows\System\WWQuGDF.exe
  2⤵
  PID:3856
- C:\Windows\System\jMoAevL.exe
  C:\Windows\System\jMoAevL.exe
  2⤵
  PID:4196
- C:\Windows\System\SmQWXBA.exe
  C:\Windows\System\SmQWXBA.exe
  2⤵
  PID:4212
- C:\Windows\System\aDfrhQz.exe
  C:\Windows\System\aDfrhQz.exe
  2⤵
  PID:4516
- C:\Windows\System\ioAmqHa.exe
  C:\Windows\System\ioAmqHa.exe
  2⤵
  PID:1220
- C:\Windows\System\gdrYkaC.exe
  C:\Windows\System\gdrYkaC.exe
  2⤵
  PID:4580
- C:\Windows\System\oNLeTIa.exe
  C:\Windows\System\oNLeTIa.exe
  2⤵
  PID:4628
- C:\Windows\System\SqHYdVL.exe
  C:\Windows\System\SqHYdVL.exe
  2⤵
  PID:4596
- C:\Windows\System\PAmUxDF.exe
  C:\Windows\System\PAmUxDF.exe
  2⤵
  PID:4608
- C:\Windows\System\poanmXg.exe
  C:\Windows\System\poanmXg.exe
  2⤵
  PID:4324
- C:\Windows\System\BgPGJeL.exe
  C:\Windows\System\BgPGJeL.exe
  2⤵
  PID:4264
- C:\Windows\System\sbCznAc.exe
  C:\Windows\System\sbCznAc.exe
  2⤵
  PID:4308
- C:\Windows\System\CbQWkUo.exe
  C:\Windows\System\CbQWkUo.exe
  2⤵
  PID:4664
- C:\Windows\System\croWELe.exe
  C:\Windows\System\croWELe.exe
  2⤵
  PID:4396
- C:\Windows\System\epclaJC.exe
  C:\Windows\System\epclaJC.exe
  2⤵
  PID:4704
- C:\Windows\System\biiPoHX.exe
  C:\Windows\System\biiPoHX.exe
  2⤵
  PID:4408
- C:\Windows\System\AqmtrkT.exe
  C:\Windows\System\AqmtrkT.exe
  2⤵
  PID:4708
- C:\Windows\System\uAOoTUW.exe
  C:\Windows\System\uAOoTUW.exe
  2⤵
  PID:4800
- C:\Windows\System\NomPxuB.exe
  C:\Windows\System\NomPxuB.exe
  2⤵
  PID:4848
- C:\Windows\System\CVfBmNF.exe
  C:\Windows\System\CVfBmNF.exe
  2⤵
  PID:2752
- C:\Windows\System\PuUbGhS.exe
  C:\Windows\System\PuUbGhS.exe
  2⤵
  PID:2628
- C:\Windows\System\raLvuzk.exe
  C:\Windows\System\raLvuzk.exe
  2⤵
  PID:1044
- C:\Windows\System\PYXtnGq.exe
  C:\Windows\System\PYXtnGq.exe
  2⤵
  PID:1572
- C:\Windows\System\HsLJRWF.exe
  C:\Windows\System\HsLJRWF.exe
  2⤵
  PID:2464
- C:\Windows\System\NnBqYEa.exe
  C:\Windows\System\NnBqYEa.exe
  2⤵
  PID:4112
- C:\Windows\System\jobjGAg.exe
  C:\Windows\System\jobjGAg.exe
  2⤵
  PID:4576
- C:\Windows\System\rOVxdix.exe
  C:\Windows\System\rOVxdix.exe
  2⤵
  PID:2052
- C:\Windows\System\XiPTwiG.exe
  C:\Windows\System\XiPTwiG.exe
  2⤵
  PID:3940
- C:\Windows\System\GZQkFoy.exe
  C:\Windows\System\GZQkFoy.exe
  2⤵
  PID:3820
- C:\Windows\System\KagQNba.exe
  C:\Windows\System\KagQNba.exe
  2⤵
  PID:2516
- C:\Windows\System\tbgUSMz.exe
  C:\Windows\System\tbgUSMz.exe
  2⤵
  PID:4548
- C:\Windows\System\RpsjyIr.exe
  C:\Windows\System\RpsjyIr.exe
  2⤵
  PID:4276
- C:\Windows\System\wcIrMxr.exe
  C:\Windows\System\wcIrMxr.exe
  2⤵
  PID:4428
- C:\Windows\System\zUmhUWf.exe
  C:\Windows\System\zUmhUWf.exe
  2⤵
  PID:4772
- C:\Windows\System\aIMXBCt.exe
  C:\Windows\System\aIMXBCt.exe
  2⤵
  PID:4812
- C:\Windows\System\JPWUrgQ.exe
  C:\Windows\System\JPWUrgQ.exe
  2⤵
  PID:4912
- C:\Windows\System\JiURSen.exe
  C:\Windows\System\JiURSen.exe
  2⤵
  PID:5012
- C:\Windows\System\reRJCpm.exe
  C:\Windows\System\reRJCpm.exe
  2⤵
  PID:4944
- C:\Windows\System\apxNaNo.exe
  C:\Windows\System\apxNaNo.exe
  2⤵
  PID:5028
- C:\Windows\System\MKDUaxf.exe
  C:\Windows\System\MKDUaxf.exe
  2⤵
  PID:1564
- C:\Windows\System\JAokhyA.exe
  C:\Windows\System\JAokhyA.exe
  2⤵
  PID:1508
- C:\Windows\System\YBVaHee.exe
  C:\Windows\System\YBVaHee.exe
  2⤵
  PID:5088
- C:\Windows\System\paLDDqF.exe
  C:\Windows\System\paLDDqF.exe
  2⤵
  PID:4076
- C:\Windows\System\dLFfBkI.exe
  C:\Windows\System\dLFfBkI.exe
  2⤵
  PID:1256
- C:\Windows\System\CTOTWsc.exe
  C:\Windows\System\CTOTWsc.exe
  2⤵
  PID:4804
- C:\Windows\System\rJFoSDY.exe
  C:\Windows\System\rJFoSDY.exe
  2⤵
  PID:1732
- C:\Windows\System\lNVhbnk.exe
  C:\Windows\System\lNVhbnk.exe
  2⤵
  PID:3164
- C:\Windows\System\QYSeVIP.exe
  C:\Windows\System\QYSeVIP.exe
  2⤵
  PID:4248
- C:\Windows\System\QAQWkhO.exe
  C:\Windows\System\QAQWkhO.exe
  2⤵
  PID:4592
- C:\Windows\System\FXtSxDf.exe
  C:\Windows\System\FXtSxDf.exe
  2⤵
  PID:4680
- C:\Windows\System\XtqECrl.exe
  C:\Windows\System\XtqECrl.exe
  2⤵
  PID:3972
- C:\Windows\System\eTXcKYR.exe
  C:\Windows\System\eTXcKYR.exe
  2⤵
  PID:4560
- C:\Windows\System\wAQsVJD.exe
  C:\Windows\System\wAQsVJD.exe
  2⤵
  PID:4996
- C:\Windows\System\rLfbXlx.exe
  C:\Windows\System\rLfbXlx.exe
  2⤵
  PID:5052
- C:\Windows\System\wkJQfEw.exe
  C:\Windows\System\wkJQfEw.exe
  2⤵
  PID:4520
- C:\Windows\System\mdaFggv.exe
  C:\Windows\System\mdaFggv.exe
  2⤵
  PID:3672
- C:\Windows\System\rWqZWrk.exe
  C:\Windows\System\rWqZWrk.exe
  2⤵
  PID:4176
- C:\Windows\System\XyEMJTB.exe
  C:\Windows\System\XyEMJTB.exe
  2⤵
  PID:5132
- C:\Windows\System\jjTNMMA.exe
  C:\Windows\System\jjTNMMA.exe
  2⤵
  PID:5148
- C:\Windows\System\lkEkpss.exe
  C:\Windows\System\lkEkpss.exe
  2⤵
  PID:5164
- C:\Windows\System\BWTDfsy.exe
  C:\Windows\System\BWTDfsy.exe
  2⤵
  PID:5180
- C:\Windows\System\bqqzWhR.exe
  C:\Windows\System\bqqzWhR.exe
  2⤵
  PID:5196
- C:\Windows\System\UsJNTMQ.exe
  C:\Windows\System\UsJNTMQ.exe
  2⤵
  PID:5212
- C:\Windows\System\rTNnkQB.exe
  C:\Windows\System\rTNnkQB.exe
  2⤵
  PID:5228
- C:\Windows\System\evhMhzE.exe
  C:\Windows\System\evhMhzE.exe
  2⤵
  PID:5244
- C:\Windows\System\WATFjKd.exe
  C:\Windows\System\WATFjKd.exe
  2⤵
  PID:5260
- C:\Windows\System\VLbPYpc.exe
  C:\Windows\System\VLbPYpc.exe
  2⤵
  PID:5276
- C:\Windows\System\JTZQkZO.exe
  C:\Windows\System\JTZQkZO.exe
  2⤵
  PID:5292
- C:\Windows\System\VOySeoI.exe
  C:\Windows\System\VOySeoI.exe
  2⤵
  PID:5308
- C:\Windows\System\NoflvYR.exe
  C:\Windows\System\NoflvYR.exe
  2⤵
  PID:5324
- C:\Windows\System\mkKyXuB.exe
  C:\Windows\System\mkKyXuB.exe
  2⤵
  PID:5340
- C:\Windows\System\fNYSaHq.exe
  C:\Windows\System\fNYSaHq.exe
  2⤵
  PID:5356
- C:\Windows\System\EcirmCG.exe
  C:\Windows\System\EcirmCG.exe
  2⤵
  PID:5372
- C:\Windows\System\CMDbFCq.exe
  C:\Windows\System\CMDbFCq.exe
  2⤵
  PID:5388
- C:\Windows\System\XXNGaKA.exe
  C:\Windows\System\XXNGaKA.exe
  2⤵
  PID:5404
- C:\Windows\System\tTnZlTy.exe
  C:\Windows\System\tTnZlTy.exe
  2⤵
  PID:5420
- C:\Windows\System\dJKsUtO.exe
  C:\Windows\System\dJKsUtO.exe
  2⤵
  PID:5436
- C:\Windows\System\QYSebQG.exe
  C:\Windows\System\QYSebQG.exe
  2⤵
  PID:5452
- C:\Windows\System\rTRykPq.exe
  C:\Windows\System\rTRykPq.exe
  2⤵
  PID:5468
- C:\Windows\System\ZFdSzzi.exe
  C:\Windows\System\ZFdSzzi.exe
  2⤵
  PID:5484
- C:\Windows\System\ywVPtOW.exe
  C:\Windows\System\ywVPtOW.exe
  2⤵
  PID:5500
- C:\Windows\System\RVQGylS.exe
  C:\Windows\System\RVQGylS.exe
  2⤵
  PID:5516
- C:\Windows\System\FAvCuGc.exe
  C:\Windows\System\FAvCuGc.exe
  2⤵
  PID:5532
- C:\Windows\System\gwMdblq.exe
  C:\Windows\System\gwMdblq.exe
  2⤵
  PID:5548
- C:\Windows\System\QwxSunS.exe
  C:\Windows\System\QwxSunS.exe
  2⤵
  PID:5564
- C:\Windows\System\VRlgMbb.exe
  C:\Windows\System\VRlgMbb.exe
  2⤵
  PID:5580
- C:\Windows\System\jhZzzGl.exe
  C:\Windows\System\jhZzzGl.exe
  2⤵
  PID:5596
- C:\Windows\System\QTwMYfy.exe
  C:\Windows\System\QTwMYfy.exe
  2⤵
  PID:5612
- C:\Windows\System\oBHtFaf.exe
  C:\Windows\System\oBHtFaf.exe
  2⤵
  PID:5636
- C:\Windows\System\gHYQouW.exe
  C:\Windows\System\gHYQouW.exe
  2⤵
  PID:5652
- C:\Windows\System\GkALRVG.exe
  C:\Windows\System\GkALRVG.exe
  2⤵
  PID:5668
- C:\Windows\System\VjqSTXZ.exe
  C:\Windows\System\VjqSTXZ.exe
  2⤵
  PID:5684
- C:\Windows\System\AReIkHS.exe
  C:\Windows\System\AReIkHS.exe
  2⤵
  PID:5700
- C:\Windows\System\AQAtETD.exe
  C:\Windows\System\AQAtETD.exe
  2⤵
  PID:5716
- C:\Windows\System\HajFXDz.exe
  C:\Windows\System\HajFXDz.exe
  2⤵
  PID:5732
- C:\Windows\System\WVhifZs.exe
  C:\Windows\System\WVhifZs.exe
  2⤵
  PID:5748
- C:\Windows\System\AVjLNGU.exe
  C:\Windows\System\AVjLNGU.exe
  2⤵
  PID:5764
- C:\Windows\System\DtKBvnD.exe
  C:\Windows\System\DtKBvnD.exe
  2⤵
  PID:5780
- C:\Windows\System\XKVTslr.exe
  C:\Windows\System\XKVTslr.exe
  2⤵
  PID:5796
- C:\Windows\System\AooPbtw.exe
  C:\Windows\System\AooPbtw.exe
  2⤵
  PID:5812
- C:\Windows\System\DmGRhWC.exe
  C:\Windows\System\DmGRhWC.exe
  2⤵
  PID:5828
- C:\Windows\System\QVeEOEn.exe
  C:\Windows\System\QVeEOEn.exe
  2⤵
  PID:5844
- C:\Windows\System\pqrRCyL.exe
  C:\Windows\System\pqrRCyL.exe
  2⤵
  PID:5860
- C:\Windows\System\WNiCtpp.exe
  C:\Windows\System\WNiCtpp.exe
  2⤵
  PID:5876
- C:\Windows\System\USOLdBk.exe
  C:\Windows\System\USOLdBk.exe
  2⤵
  PID:5892
- C:\Windows\System\LMVMGdp.exe
  C:\Windows\System\LMVMGdp.exe
  2⤵
  PID:5908
- C:\Windows\System\LspEoCs.exe
  C:\Windows\System\LspEoCs.exe
  2⤵
  PID:5924
- C:\Windows\System\XVxhuSe.exe
  C:\Windows\System\XVxhuSe.exe
  2⤵
  PID:5944
- C:\Windows\System\OKWNoHR.exe
  C:\Windows\System\OKWNoHR.exe
  2⤵
  PID:5960
- C:\Windows\System\CAlwgas.exe
  C:\Windows\System\CAlwgas.exe
  2⤵
  PID:5976
- C:\Windows\System\XPwguBR.exe
  C:\Windows\System\XPwguBR.exe
  2⤵
  PID:5992
- C:\Windows\System\eCDmYEY.exe
  C:\Windows\System\eCDmYEY.exe
  2⤵
  PID:6008
- C:\Windows\System\CtYKIIi.exe
  C:\Windows\System\CtYKIIi.exe
  2⤵
  PID:6024
- C:\Windows\System\NSBHuOp.exe
  C:\Windows\System\NSBHuOp.exe
  2⤵
  PID:6040
- C:\Windows\System\ZhhnVJX.exe
  C:\Windows\System\ZhhnVJX.exe
  2⤵
  PID:6056
- C:\Windows\System\oLMSwIM.exe
  C:\Windows\System\oLMSwIM.exe
  2⤵
  PID:6072
- C:\Windows\System\ABtMJfb.exe
  C:\Windows\System\ABtMJfb.exe
  2⤵
  PID:6088
- C:\Windows\System\FqVaKyO.exe
  C:\Windows\System\FqVaKyO.exe
  2⤵
  PID:6104
- C:\Windows\System\uLaOLfi.exe
  C:\Windows\System\uLaOLfi.exe
  2⤵
  PID:6120
- C:\Windows\System\wqYDpOP.exe
  C:\Windows\System\wqYDpOP.exe
  2⤵
  PID:6136
- C:\Windows\System\IujZuAV.exe
  C:\Windows\System\IujZuAV.exe
  2⤵
  PID:500
- C:\Windows\System\rTJHLVz.exe
  C:\Windows\System\rTJHLVz.exe
  2⤵
  PID:4444
- C:\Windows\System\FTmsgPi.exe
  C:\Windows\System\FTmsgPi.exe
  2⤵
  PID:1584
- C:\Windows\System\yvqMPIy.exe
  C:\Windows\System\yvqMPIy.exe
  2⤵
  PID:4876
- C:\Windows\System\gWXiYRp.exe
  C:\Windows\System\gWXiYRp.exe
  2⤵
  PID:5252
- C:\Windows\System\QeJFwIm.exe
  C:\Windows\System\QeJFwIm.exe
  2⤵
  PID:5316
- C:\Windows\System\fLVtOTp.exe
  C:\Windows\System\fLVtOTp.exe
  2⤵
  PID:4128
- C:\Windows\System\CtaLFVj.exe
  C:\Windows\System\CtaLFVj.exe
  2⤵
  PID:5172
- C:\Windows\System\vDUqvaK.exe
  C:\Windows\System\vDUqvaK.exe
  2⤵
  PID:5236
- C:\Windows\System\PuxpUhn.exe
  C:\Windows\System\PuxpUhn.exe
  2⤵
  PID:5272
- C:\Windows\System\npFTRdc.exe
  C:\Windows\System\npFTRdc.exe
  2⤵
  PID:4764
- C:\Windows\System\gozShGQ.exe
  C:\Windows\System\gozShGQ.exe
  2⤵
  PID:1608
- C:\Windows\System\mmgzZEs.exe
  C:\Windows\System\mmgzZEs.exe
  2⤵
  PID:3312
- C:\Windows\System\KWZibJA.exe
  C:\Windows\System\KWZibJA.exe
  2⤵
  PID:2312
- C:\Windows\System\rLTHmpO.exe
  C:\Windows\System\rLTHmpO.exe
  2⤵
  PID:5368
- C:\Windows\System\CgIzvWG.exe
  C:\Windows\System\CgIzvWG.exe
  2⤵
  PID:5400
- C:\Windows\System\VQHahAK.exe
  C:\Windows\System\VQHahAK.exe
  2⤵
  PID:5352
- C:\Windows\System\FtyZtRG.exe
  C:\Windows\System\FtyZtRG.exe
  2⤵
  PID:5432
- C:\Windows\System\AkeJvds.exe
  C:\Windows\System\AkeJvds.exe
  2⤵
  PID:5476
- C:\Windows\System\RKerpsb.exe
  C:\Windows\System\RKerpsb.exe
  2⤵
  PID:5492
- C:\Windows\System\qoQqVRN.exe
  C:\Windows\System\qoQqVRN.exe
  2⤵
  PID:5524
- C:\Windows\System\NEZjkXy.exe
  C:\Windows\System\NEZjkXy.exe
  2⤵
  PID:5512
- C:\Windows\System\MxUPQyx.exe
  C:\Windows\System\MxUPQyx.exe
  2⤵
  PID:5628
- C:\Windows\System\JxWznLj.exe
  C:\Windows\System\JxWznLj.exe
  2⤵
  PID:5508
- C:\Windows\System\ExxCWRc.exe
  C:\Windows\System\ExxCWRc.exe
  2⤵
  PID:5856
- C:\Windows\System\acuKlOz.exe
  C:\Windows\System\acuKlOz.exe
  2⤵
  PID:5920
- C:\Windows\System\cpDZfWx.exe
  C:\Windows\System\cpDZfWx.exe
  2⤵
  PID:5904
- C:\Windows\System\uTeleOC.exe
  C:\Windows\System\uTeleOC.exe
  2⤵
  PID:6020
- C:\Windows\System\McBDXUD.exe
  C:\Windows\System\McBDXUD.exe
  2⤵
  PID:6036
- C:\Windows\System\zEbBswq.exe
  C:\Windows\System\zEbBswq.exe
  2⤵
  PID:6032
- C:\Windows\System\WWsJiwY.exe
  C:\Windows\System\WWsJiwY.exe
  2⤵
  PID:6096
- C:\Windows\System\CowdDHZ.exe
  C:\Windows\System\CowdDHZ.exe
  2⤵
  PID:6068
- C:\Windows\System\PmfWdiI.exe
  C:\Windows\System\PmfWdiI.exe
  2⤵
  PID:6112
- C:\Windows\System\YGMhfQp.exe
  C:\Windows\System\YGMhfQp.exe
  2⤵
  PID:5160
- C:\Windows\System\HInvhbw.exe
  C:\Windows\System\HInvhbw.exe
  2⤵
  PID:6000
- C:\Windows\System\EozZHOr.exe
  C:\Windows\System\EozZHOr.exe
  2⤵
  PID:5140
- C:\Windows\System\ZqsaDpz.exe
  C:\Windows\System\ZqsaDpz.exe
  2⤵
  PID:5224
- C:\Windows\System\vnpjpQD.exe
  C:\Windows\System\vnpjpQD.exe
  2⤵
  PID:1652
- C:\Windows\System\WMrDDUC.exe
  C:\Windows\System\WMrDDUC.exe
  2⤵
  PID:5204
- C:\Windows\System\gKVXTpi.exe
  C:\Windows\System\gKVXTpi.exe
  2⤵
  PID:5384
- C:\Windows\System\VBKEzFX.exe
  C:\Windows\System\VBKEzFX.exe
  2⤵
  PID:5304
- C:\Windows\System\NAmUCIM.exe
  C:\Windows\System\NAmUCIM.exe
  2⤵
  PID:3516
- C:\Windows\System\tZpCrKG.exe
  C:\Windows\System\tZpCrKG.exe
  2⤵
  PID:5448
- C:\Windows\System\DcPMpQA.exe
  C:\Windows\System\DcPMpQA.exe
  2⤵
  PID:2076
- C:\Windows\System\zBbolqS.exe
  C:\Windows\System\zBbolqS.exe
  2⤵
  PID:5588
- C:\Windows\System\lOknvKX.exe
  C:\Windows\System\lOknvKX.exe
  2⤵
  PID:5692
- C:\Windows\System\IDayvcI.exe
  C:\Windows\System\IDayvcI.exe
  2⤵
  PID:5676
- C:\Windows\System\iqEiEpg.exe
  C:\Windows\System\iqEiEpg.exe
  2⤵
  PID:5708
- C:\Windows\System\rTaWbpb.exe
  C:\Windows\System\rTaWbpb.exe
  2⤵
  PID:5772
- C:\Windows\System\tokYSXx.exe
  C:\Windows\System\tokYSXx.exe
  2⤵
  PID:5724
- C:\Windows\System\ekmUFlX.exe
  C:\Windows\System\ekmUFlX.exe
  2⤵
  PID:5820
- C:\Windows\System\qVekBVW.exe
  C:\Windows\System\qVekBVW.exe
  2⤵
  PID:5788
- C:\Windows\System\gDhCztG.exe
  C:\Windows\System\gDhCztG.exe
  2⤵
  PID:6016
- C:\Windows\System\YiSSwsX.exe
  C:\Windows\System\YiSSwsX.exe
  2⤵
  PID:5288
- C:\Windows\System\cRbgPxe.exe
  C:\Windows\System\cRbgPxe.exe
  2⤵
  PID:5284
- C:\Windows\System\ZqcRjzJ.exe
  C:\Windows\System\ZqcRjzJ.exe
  2⤵
  PID:2672
- C:\Windows\System\TLIbaAi.exe
  C:\Windows\System\TLIbaAi.exe
  2⤵
  PID:1464
- C:\Windows\System\ryMmbJc.exe
  C:\Windows\System\ryMmbJc.exe
  2⤵
  PID:5620
- C:\Windows\System\tgydELH.exe
  C:\Windows\System\tgydELH.exe
  2⤵
  PID:5644
- C:\Windows\System\ueyBQuh.exe
  C:\Windows\System\ueyBQuh.exe
  2⤵
  PID:5776
- C:\Windows\System\LUdDeoN.exe
  C:\Windows\System\LUdDeoN.exe
  2⤵
  PID:6064
- C:\Windows\System\XJslbdC.exe
  C:\Windows\System\XJslbdC.exe
  2⤵
  PID:6148
- C:\Windows\System\nJfwBwA.exe
  C:\Windows\System\nJfwBwA.exe
  2⤵
  PID:6168
- C:\Windows\System\AEiQScA.exe
  C:\Windows\System\AEiQScA.exe
  2⤵
  PID:6184
- C:\Windows\System\xWBlFrd.exe
  C:\Windows\System\xWBlFrd.exe
  2⤵
  PID:6200
- C:\Windows\System\OBVlCeW.exe
  C:\Windows\System\OBVlCeW.exe
  2⤵
  PID:6216
- C:\Windows\System\NurmwkF.exe
  C:\Windows\System\NurmwkF.exe
  2⤵
  PID:6236
- C:\Windows\System\nehHDKM.exe
  C:\Windows\System\nehHDKM.exe
  2⤵
  PID:6252
- C:\Windows\System\eUeDhpN.exe
  C:\Windows\System\eUeDhpN.exe
  2⤵
  PID:6268
- C:\Windows\System\EeArBYF.exe
  C:\Windows\System\EeArBYF.exe
  2⤵
  PID:6284
- C:\Windows\System\VCqRalC.exe
  C:\Windows\System\VCqRalC.exe
  2⤵
  PID:6300
- C:\Windows\System\sFilltu.exe
  C:\Windows\System\sFilltu.exe
  2⤵
  PID:6316
- C:\Windows\System\rHwFeFv.exe
  C:\Windows\System\rHwFeFv.exe
  2⤵
  PID:6332
- C:\Windows\System\eJOrdAH.exe
  C:\Windows\System\eJOrdAH.exe
  2⤵
  PID:6348
- C:\Windows\System\GpTOKNC.exe
  C:\Windows\System\GpTOKNC.exe
  2⤵
  PID:6364
- C:\Windows\System\LEvJkmS.exe
  C:\Windows\System\LEvJkmS.exe
  2⤵
  PID:6380
- C:\Windows\System\hLNoxEd.exe
  C:\Windows\System\hLNoxEd.exe
  2⤵
  PID:6400
- C:\Windows\System\UnzHija.exe
  C:\Windows\System\UnzHija.exe
  2⤵
  PID:6416
- C:\Windows\System\AZxkOuD.exe
  C:\Windows\System\AZxkOuD.exe
  2⤵
  PID:6432
- C:\Windows\System\vWUOZkY.exe
  C:\Windows\System\vWUOZkY.exe
  2⤵
  PID:6448
- C:\Windows\System\CIuKmnV.exe
  C:\Windows\System\CIuKmnV.exe
  2⤵
  PID:6464
- C:\Windows\System\dAZXBXi.exe
  C:\Windows\System\dAZXBXi.exe
  2⤵
  PID:6480
- C:\Windows\System\CffqkcU.exe
  C:\Windows\System\CffqkcU.exe
  2⤵
  PID:6496
- C:\Windows\System\WcRqfOT.exe
  C:\Windows\System\WcRqfOT.exe
  2⤵
  PID:6512
- C:\Windows\System\tFhGqCp.exe
  C:\Windows\System\tFhGqCp.exe
  2⤵
  PID:6532
- C:\Windows\System\JUNYXXE.exe
  C:\Windows\System\JUNYXXE.exe
  2⤵
  PID:6548
- C:\Windows\System\ezwtWGc.exe
  C:\Windows\System\ezwtWGc.exe
  2⤵
  PID:6564
- C:\Windows\System\QgaHqux.exe
  C:\Windows\System\QgaHqux.exe
  2⤵
  PID:6580
- C:\Windows\System\ZeyplmF.exe
  C:\Windows\System\ZeyplmF.exe
  2⤵
  PID:6596
- C:\Windows\System\stXZIrl.exe
  C:\Windows\System\stXZIrl.exe
  2⤵
  PID:6612
- C:\Windows\System\aBqygSD.exe
  C:\Windows\System\aBqygSD.exe
  2⤵
  PID:6628
- C:\Windows\System\sWtKHhd.exe
  C:\Windows\System\sWtKHhd.exe
  2⤵
  PID:6644
- C:\Windows\System\hOVjHlZ.exe
  C:\Windows\System\hOVjHlZ.exe
  2⤵
  PID:6660
- C:\Windows\System\JDjzCIz.exe
  C:\Windows\System\JDjzCIz.exe
  2⤵
  PID:6676
- C:\Windows\System\RWczHcV.exe
  C:\Windows\System\RWczHcV.exe
  2⤵
  PID:6696
- C:\Windows\System\HzLlaLJ.exe
  C:\Windows\System\HzLlaLJ.exe
  2⤵
  PID:6712
- C:\Windows\System\aYzXawz.exe
  C:\Windows\System\aYzXawz.exe
  2⤵
  PID:6728
- C:\Windows\System\tkwcmVM.exe
  C:\Windows\System\tkwcmVM.exe
  2⤵
  PID:6744
- C:\Windows\System\aZMllII.exe
  C:\Windows\System\aZMllII.exe
  2⤵
  PID:6760
- C:\Windows\System\zpNqqrM.exe
  C:\Windows\System\zpNqqrM.exe
  2⤵
  PID:6780
- C:\Windows\System\vkpCZjd.exe
  C:\Windows\System\vkpCZjd.exe
  2⤵
  PID:6796
- C:\Windows\System\JUrWFri.exe
  C:\Windows\System\JUrWFri.exe
  2⤵
  PID:6812
- C:\Windows\System\ZrFKgGN.exe
  C:\Windows\System\ZrFKgGN.exe
  2⤵
  PID:6828
- C:\Windows\System\pIQSDZN.exe
  C:\Windows\System\pIQSDZN.exe
  2⤵
  PID:6844
- C:\Windows\System\upWdcye.exe
  C:\Windows\System\upWdcye.exe
  2⤵
  PID:6860
- C:\Windows\System\mIpmtAb.exe
  C:\Windows\System\mIpmtAb.exe
  2⤵
  PID:6876
- C:\Windows\System\aRMsigj.exe
  C:\Windows\System\aRMsigj.exe
  2⤵
  PID:6892
- C:\Windows\System\bwfNWEq.exe
  C:\Windows\System\bwfNWEq.exe
  2⤵
  PID:6908
- C:\Windows\System\NlIWkiH.exe
  C:\Windows\System\NlIWkiH.exe
  2⤵
  PID:6924
- C:\Windows\System\uoDXnob.exe
  C:\Windows\System\uoDXnob.exe
  2⤵
  PID:6944
- C:\Windows\System\UrOUeMk.exe
  C:\Windows\System\UrOUeMk.exe
  2⤵
  PID:6964
- C:\Windows\System\FUNoktg.exe
  C:\Windows\System\FUNoktg.exe
  2⤵
  PID:6984
- C:\Windows\System\aRvqwXm.exe
  C:\Windows\System\aRvqwXm.exe
  2⤵
  PID:7000
- C:\Windows\System\NGGqOhu.exe
  C:\Windows\System\NGGqOhu.exe
  2⤵
  PID:7016
- C:\Windows\System\kdqCrLQ.exe
  C:\Windows\System\kdqCrLQ.exe
  2⤵
  PID:7032
- C:\Windows\System\taYvjau.exe
  C:\Windows\System\taYvjau.exe
  2⤵
  PID:7048
- C:\Windows\System\wxbByXN.exe
  C:\Windows\System\wxbByXN.exe
  2⤵
  PID:7064
- C:\Windows\System\jPBLuLN.exe
  C:\Windows\System\jPBLuLN.exe
  2⤵
  PID:7080
- C:\Windows\System\OCwASiW.exe
  C:\Windows\System\OCwASiW.exe
  2⤵
  PID:7096
- C:\Windows\System\WPkWLSE.exe
  C:\Windows\System\WPkWLSE.exe
  2⤵
  PID:7112
- C:\Windows\System\FoSUmmM.exe
  C:\Windows\System\FoSUmmM.exe
  2⤵
  PID:7128
- C:\Windows\System\PPbkojt.exe
  C:\Windows\System\PPbkojt.exe
  2⤵
  PID:7144
- C:\Windows\System\rAHxroj.exe
  C:\Windows\System\rAHxroj.exe
  2⤵
  PID:7160
- C:\Windows\System\lhCUGum.exe
  C:\Windows\System\lhCUGum.exe
  2⤵
  PID:5128
- C:\Windows\System\PxMIDET.exe
  C:\Windows\System\PxMIDET.exe
  2⤵
  PID:2160
- C:\Windows\System\FzVdORh.exe
  C:\Windows\System\FzVdORh.exe
  2⤵
  PID:5428
- C:\Windows\System\JXKXRKi.exe
  C:\Windows\System\JXKXRKi.exe
  2⤵
  PID:5576
- C:\Windows\System\pDjPTWX.exe
  C:\Windows\System\pDjPTWX.exe
  2⤵
  PID:5744
- C:\Windows\System\etMWmYs.exe
  C:\Windows\System\etMWmYs.exe
  2⤵
  PID:5220
- C:\Windows\System\apQBNXX.exe
  C:\Windows\System\apQBNXX.exe
  2⤵
  PID:5544
- C:\Windows\System\rZgesih.exe
  C:\Windows\System\rZgesih.exe
  2⤵
  PID:6004
- C:\Windows\System\sVOsNON.exe
  C:\Windows\System\sVOsNON.exe
  2⤵
  PID:6164
- C:\Windows\System\JnMTlRu.exe
  C:\Windows\System\JnMTlRu.exe
  2⤵
  PID:6196
- C:\Windows\System\lStCzBw.exe
  C:\Windows\System\lStCzBw.exe
  2⤵
  PID:6260
- C:\Windows\System\MoEhFLK.exe
  C:\Windows\System\MoEhFLK.exe
  2⤵
  PID:6296
- C:\Windows\System\MLgWWRd.exe
  C:\Windows\System\MLgWWRd.exe
  2⤵
  PID:4084
- C:\Windows\System\YHhNQHM.exe
  C:\Windows\System\YHhNQHM.exe
  2⤵
  PID:6208
- C:\Windows\System\QPqkumk.exe
  C:\Windows\System\QPqkumk.exe
  2⤵
  PID:6356
- C:\Windows\System\UmHHzEl.exe
  C:\Windows\System\UmHHzEl.exe
  2⤵
  PID:6344
- C:\Windows\System\OTIkCjG.exe
  C:\Windows\System\OTIkCjG.exe
  2⤵
  PID:6376
- C:\Windows\System\feMiIwS.exe
  C:\Windows\System\feMiIwS.exe
  2⤵
  PID:6472
- C:\Windows\System\xQjiWSG.exe
  C:\Windows\System\xQjiWSG.exe
  2⤵
  PID:6428
- C:\Windows\System\OvzqJdf.exe
  C:\Windows\System\OvzqJdf.exe
  2⤵
  PID:6492
- C:\Windows\System\PdaMuBD.exe
  C:\Windows\System\PdaMuBD.exe
  2⤵
  PID:6592
- C:\Windows\System\zbVmlwG.exe
  C:\Windows\System\zbVmlwG.exe
  2⤵
  PID:6560
- C:\Windows\System\ctvjstY.exe
  C:\Windows\System\ctvjstY.exe
  2⤵
  PID:6656
- C:\Windows\System\nPihxSV.exe
  C:\Windows\System\nPihxSV.exe
  2⤵
  PID:6640
- C:\Windows\System\TLOOsCH.exe
  C:\Windows\System\TLOOsCH.exe
  2⤵
  PID:6672
- C:\Windows\System\qMFsTJG.exe
  C:\Windows\System\qMFsTJG.exe
  2⤵
  PID:6708
- C:\Windows\System\yvSaQZK.exe
  C:\Windows\System\yvSaQZK.exe
  2⤵
  PID:6792
- C:\Windows\System\kYSEKlh.exe
  C:\Windows\System\kYSEKlh.exe
  2⤵
  PID:6856
- C:\Windows\System\MEWOOVc.exe
  C:\Windows\System\MEWOOVc.exe
  2⤵
  PID:6916
- C:\Windows\System\XDEdHFJ.exe
  C:\Windows\System\XDEdHFJ.exe
  2⤵
  PID:6996
- C:\Windows\System\JErmfTA.exe
  C:\Windows\System\JErmfTA.exe
  2⤵
  PID:6740
- C:\Windows\System\BFgCxBH.exe
  C:\Windows\System\BFgCxBH.exe
  2⤵
  PID:6804
- C:\Windows\System\nlpjqBP.exe
  C:\Windows\System\nlpjqBP.exe
  2⤵
  PID:6936
- C:\Windows\System\RlXCwtU.exe
  C:\Windows\System\RlXCwtU.exe
  2⤵
  PID:6840
- C:\Windows\System\AxYdals.exe
  C:\Windows\System\AxYdals.exe
  2⤵
  PID:6904
- C:\Windows\System\JyBCmNu.exe
  C:\Windows\System\JyBCmNu.exe
  2⤵
  PID:7040
- C:\Windows\System\qotgtOS.exe
  C:\Windows\System\qotgtOS.exe
  2⤵
  PID:7120
- C:\Windows\System\ZVhcWDy.exe
  C:\Windows\System\ZVhcWDy.exe
  2⤵
  PID:7156
- C:\Windows\System\BqrFkyB.exe
  C:\Windows\System\BqrFkyB.exe
  2⤵
  PID:7072
- C:\Windows\System\PYcDxmU.exe
  C:\Windows\System\PYcDxmU.exe
  2⤵
  PID:5792
- C:\Windows\System\GxMCTKR.exe
  C:\Windows\System\GxMCTKR.exe
  2⤵
  PID:6100
- C:\Windows\System\wEIhYdB.exe
  C:\Windows\System\wEIhYdB.exe
  2⤵
  PID:7140
- C:\Windows\System\smDVDbo.exe
  C:\Windows\System\smDVDbo.exe
  2⤵
  PID:5460
- C:\Windows\System\jlXksCq.exe
  C:\Windows\System\jlXksCq.exe
  2⤵
  PID:6176
- C:\Windows\System\EprNgFm.exe
  C:\Windows\System\EprNgFm.exe
  2⤵
  PID:6160
- C:\Windows\System\HhAXnAU.exe
  C:\Windows\System\HhAXnAU.exe
  2⤵
  PID:6248
- C:\Windows\System\EWimIwa.exe
  C:\Windows\System\EWimIwa.exe
  2⤵
  PID:6440
- C:\Windows\System\dLWJBpQ.exe
  C:\Windows\System\dLWJBpQ.exe
  2⤵
  PID:6504
- C:\Windows\System\qnoDwWw.exe
  C:\Windows\System\qnoDwWw.exe
  2⤵
  PID:6324
- C:\Windows\System\BbnOoay.exe
  C:\Windows\System\BbnOoay.exe
  2⤵
  PID:6508
- C:\Windows\System\YxrAgJZ.exe
  C:\Windows\System\YxrAgJZ.exe
  2⤵
  PID:6544
- C:\Windows\System\zvwmYuc.exe
  C:\Windows\System\zvwmYuc.exe
  2⤵
  PID:6460
- C:\Windows\System\lAlCbEV.exe
  C:\Windows\System\lAlCbEV.exe
  2⤵
  PID:6688
- C:\Windows\System\xawzmbb.exe
  C:\Windows\System\xawzmbb.exe
  2⤵
  PID:6824
- C:\Windows\System\bNEwJHA.exe
  C:\Windows\System\bNEwJHA.exe
  2⤵
  PID:6776
- C:\Windows\System\gEhzQJC.exe
  C:\Windows\System\gEhzQJC.exe
  2⤵
  PID:6940
- C:\Windows\System\UGLDqRN.exe
  C:\Windows\System\UGLDqRN.exe
  2⤵
  PID:5712
- C:\Windows\System\SsRvZdp.exe
  C:\Windows\System\SsRvZdp.exe
  2⤵
  PID:6328
- C:\Windows\System\KlhOagO.exe
  C:\Windows\System\KlhOagO.exe
  2⤵
  PID:6372
- C:\Windows\System\MvilDBR.exe
  C:\Windows\System\MvilDBR.exe
  2⤵
  PID:6704
- C:\Windows\System\qakmWFj.exe
  C:\Windows\System\qakmWFj.exe
  2⤵
  PID:6872
- C:\Windows\System\PEZyEqm.exe
  C:\Windows\System\PEZyEqm.exe
  2⤵
  PID:6836
- C:\Windows\System\tzEltVe.exe
  C:\Windows\System\tzEltVe.exe
  2⤵
  PID:7076
- C:\Windows\System\fhPMeZh.exe
  C:\Windows\System\fhPMeZh.exe
  2⤵
  PID:5916
- C:\Windows\System\vvigCLR.exe
  C:\Windows\System\vvigCLR.exe
  2⤵
  PID:6264
- C:\Windows\System\mPyEXpH.exe
  C:\Windows\System\mPyEXpH.exe
  2⤵
  PID:6392
- C:\Windows\System\IFaKzXM.exe
  C:\Windows\System\IFaKzXM.exe
  2⤵
  PID:6588
- C:\Windows\System\eFheLWe.exe
  C:\Windows\System\eFheLWe.exe
  2⤵
  PID:6604
- C:\Windows\System\SMmVpjG.exe
  C:\Windows\System\SMmVpjG.exe
  2⤵
  PID:6788
- C:\Windows\System\bstYkWG.exe
  C:\Windows\System\bstYkWG.exe
  2⤵
  PID:6960
- C:\Windows\System\xjPsMYE.exe
  C:\Windows\System\xjPsMYE.exe
  2⤵
  PID:5660
- C:\Windows\System\XXEgxne.exe
  C:\Windows\System\XXEgxne.exe
  2⤵
  PID:6668
- C:\Windows\System\FHvJZLo.exe
  C:\Windows\System\FHvJZLo.exe
  2⤵
  PID:5124
- C:\Windows\System\HUZRuIs.exe
  C:\Windows\System\HUZRuIs.exe
  2⤵
  PID:6572
- C:\Windows\System\mNXKAYO.exe
  C:\Windows\System\mNXKAYO.exe
  2⤵
  PID:6424
- C:\Windows\System\DCznVgl.exe
  C:\Windows\System\DCznVgl.exe
  2⤵
  PID:7176
- C:\Windows\System\uqueCli.exe
  C:\Windows\System\uqueCli.exe
  2⤵
  PID:7192
- C:\Windows\System\FnPRAuH.exe
  C:\Windows\System\FnPRAuH.exe
  2⤵
  PID:7216
- C:\Windows\System\DJdPzYi.exe
  C:\Windows\System\DJdPzYi.exe
  2⤵
  PID:7232
- C:\Windows\System\MprewbB.exe
  C:\Windows\System\MprewbB.exe
  2⤵
  PID:7248
- C:\Windows\System\CqhwVSV.exe
  C:\Windows\System\CqhwVSV.exe
  2⤵
  PID:7264
- C:\Windows\System\WrncUTV.exe
  C:\Windows\System\WrncUTV.exe
  2⤵
  PID:7280
- C:\Windows\System\XRsdlrP.exe
  C:\Windows\System\XRsdlrP.exe
  2⤵
  PID:7300
- C:\Windows\System\QtbhdKu.exe
  C:\Windows\System\QtbhdKu.exe
  2⤵
  PID:7316
- C:\Windows\System\wNkNjjv.exe
  C:\Windows\System\wNkNjjv.exe
  2⤵
  PID:7336
- C:\Windows\System\ctxbuzY.exe
  C:\Windows\System\ctxbuzY.exe
  2⤵
  PID:7352
- C:\Windows\System\WXcpYXX.exe
  C:\Windows\System\WXcpYXX.exe
  2⤵
  PID:7372
- C:\Windows\System\OtJgDAb.exe
  C:\Windows\System\OtJgDAb.exe
  2⤵
  PID:7388
- C:\Windows\System\BQDmzoy.exe
  C:\Windows\System\BQDmzoy.exe
  2⤵
  PID:7404
- C:\Windows\System\VVcZsxB.exe
  C:\Windows\System\VVcZsxB.exe
  2⤵
  PID:7420
- C:\Windows\System\DDRNnNC.exe
  C:\Windows\System\DDRNnNC.exe
  2⤵
  PID:7436
- C:\Windows\System\qUowYZq.exe
  C:\Windows\System\qUowYZq.exe
  2⤵
  PID:7452
- C:\Windows\System\DhtDdDh.exe
  C:\Windows\System\DhtDdDh.exe
  2⤵
  PID:7468
- C:\Windows\System\ZrvpOBc.exe
  C:\Windows\System\ZrvpOBc.exe
  2⤵
  PID:7484
- C:\Windows\System\lAOeaKQ.exe
  C:\Windows\System\lAOeaKQ.exe
  2⤵
  PID:7500
- C:\Windows\System\aoCwmkn.exe
  C:\Windows\System\aoCwmkn.exe
  2⤵
  PID:7516
- C:\Windows\System\NbOpbXQ.exe
  C:\Windows\System\NbOpbXQ.exe
  2⤵
  PID:7532
- C:\Windows\System\XCZnJyY.exe
  C:\Windows\System\XCZnJyY.exe
  2⤵
  PID:7548
- C:\Windows\System\qXiAILY.exe
  C:\Windows\System\qXiAILY.exe
  2⤵
  PID:7564
- C:\Windows\System\hZTWwgm.exe
  C:\Windows\System\hZTWwgm.exe
  2⤵
  PID:7580
- C:\Windows\System\riudVVc.exe
  C:\Windows\System\riudVVc.exe
  2⤵
  PID:7596
- C:\Windows\System\wRIrUMY.exe
  C:\Windows\System\wRIrUMY.exe
  2⤵
  PID:7612
- C:\Windows\System\KHYFXGP.exe
  C:\Windows\System\KHYFXGP.exe
  2⤵
  PID:7632
- C:\Windows\System\DowXiTK.exe
  C:\Windows\System\DowXiTK.exe
  2⤵
  PID:7648
- C:\Windows\System\ldEISqs.exe
  C:\Windows\System\ldEISqs.exe
  2⤵
  PID:7664
- C:\Windows\System\fabbHGu.exe
  C:\Windows\System\fabbHGu.exe
  2⤵
  PID:7680
- C:\Windows\System\zTTdfdK.exe
  C:\Windows\System\zTTdfdK.exe
  2⤵
  PID:7696
- C:\Windows\System\eKbwpLW.exe
  C:\Windows\System\eKbwpLW.exe
  2⤵
  PID:7712
- C:\Windows\System\uroSZEv.exe
  C:\Windows\System\uroSZEv.exe
  2⤵
  PID:7728
- C:\Windows\System\gAGqTwF.exe
  C:\Windows\System\gAGqTwF.exe
  2⤵
  PID:7744
- C:\Windows\System\xtngnIC.exe
  C:\Windows\System\xtngnIC.exe
  2⤵
  PID:7760
- C:\Windows\System\aHXMkhf.exe
  C:\Windows\System\aHXMkhf.exe
  2⤵
  PID:7776
- C:\Windows\System\pGXZhNR.exe
  C:\Windows\System\pGXZhNR.exe
  2⤵
  PID:7792
- C:\Windows\System\ImCdEIN.exe
  C:\Windows\System\ImCdEIN.exe
  2⤵
  PID:7808
- C:\Windows\System\tSRRMTr.exe
  C:\Windows\System\tSRRMTr.exe
  2⤵
  PID:7824
- C:\Windows\System\LWKNYda.exe
  C:\Windows\System\LWKNYda.exe
  2⤵
  PID:7840
- C:\Windows\System\cVMmzrj.exe
  C:\Windows\System\cVMmzrj.exe
  2⤵
  PID:7856
- C:\Windows\System\sCEsKMA.exe
  C:\Windows\System\sCEsKMA.exe
  2⤵
  PID:7872
- C:\Windows\System\zSkvJID.exe
  C:\Windows\System\zSkvJID.exe
  2⤵
  PID:7888
- C:\Windows\System\KpnHyjh.exe
  C:\Windows\System\KpnHyjh.exe
  2⤵
  PID:7904
- C:\Windows\System\gyzEcec.exe
  C:\Windows\System\gyzEcec.exe
  2⤵
  PID:7920
- C:\Windows\System\feSnICe.exe
  C:\Windows\System\feSnICe.exe
  2⤵
  PID:7936
- C:\Windows\System\RBylIeO.exe
  C:\Windows\System\RBylIeO.exe
  2⤵
  PID:7952
- C:\Windows\System\WoBHqmM.exe
  C:\Windows\System\WoBHqmM.exe
  2⤵
  PID:7968
- C:\Windows\System\kCGxSHY.exe
  C:\Windows\System\kCGxSHY.exe
  2⤵
  PID:7984
- C:\Windows\System\dUtBdTj.exe
  C:\Windows\System\dUtBdTj.exe
  2⤵
  PID:8000
- C:\Windows\System\FsJJSHB.exe
  C:\Windows\System\FsJJSHB.exe
  2⤵
  PID:8016
- C:\Windows\System\mgSeBJc.exe
  C:\Windows\System\mgSeBJc.exe
  2⤵
  PID:8032
- C:\Windows\System\ahEAsmA.exe
  C:\Windows\System\ahEAsmA.exe
  2⤵
  PID:8048
- C:\Windows\System\zDYOwIs.exe
  C:\Windows\System\zDYOwIs.exe
  2⤵
  PID:8064
- C:\Windows\System\PCxrymF.exe
  C:\Windows\System\PCxrymF.exe
  2⤵
  PID:8080
- C:\Windows\System\MiWCfQV.exe
  C:\Windows\System\MiWCfQV.exe
  2⤵
  PID:8096
- C:\Windows\System\QDZuqkz.exe
  C:\Windows\System\QDZuqkz.exe
  2⤵
  PID:8112
- C:\Windows\System\JqGrBRo.exe
  C:\Windows\System\JqGrBRo.exe
  2⤵
  PID:8128
- C:\Windows\System\xCQFbAT.exe
  C:\Windows\System\xCQFbAT.exe
  2⤵
  PID:8144
- C:\Windows\System\WCvOZUI.exe
  C:\Windows\System\WCvOZUI.exe
  2⤵
  PID:8160
- C:\Windows\System\rwyHPGX.exe
  C:\Windows\System\rwyHPGX.exe
  2⤵
  PID:8176
- C:\Windows\System\XDSqQHD.exe
  C:\Windows\System\XDSqQHD.exe
  2⤵
  PID:6652
- C:\Windows\System\LbuGHxD.exe
  C:\Windows\System\LbuGHxD.exe
  2⤵
  PID:6244
- C:\Windows\System\KHrJMmj.exe
  C:\Windows\System\KHrJMmj.exe
  2⤵
  PID:7092
- C:\Windows\System\irUMHEY.exe
  C:\Windows\System\irUMHEY.exe
  2⤵
  PID:6576
- C:\Windows\System\aCqmOWi.exe
  C:\Windows\System\aCqmOWi.exe
  2⤵
  PID:6952
- C:\Windows\System\FigpYJx.exe
  C:\Windows\System\FigpYJx.exe
  2⤵
  PID:7024
- C:\Windows\System\GKBRdxO.exe
  C:\Windows\System\GKBRdxO.exe
  2⤵
  PID:7208
- C:\Windows\System\ZVslzCA.exe
  C:\Windows\System\ZVslzCA.exe
  2⤵
  PID:7224
- C:\Windows\System\zxeQcaa.exe
  C:\Windows\System\zxeQcaa.exe
  2⤵
  PID:7272
- C:\Windows\System\wCGYWKK.exe
  C:\Windows\System\wCGYWKK.exe
  2⤵
  PID:7344
- C:\Windows\System\lmksAIo.exe
  C:\Windows\System\lmksAIo.exe
  2⤵
  PID:7288
- C:\Windows\System\oEAMVPw.exe
  C:\Windows\System\oEAMVPw.exe
  2⤵
  PID:7328
- C:\Windows\System\WgvBGfY.exe
  C:\Windows\System\WgvBGfY.exe
  2⤵
  PID:7368
- C:\Windows\System\djIyhoC.exe
  C:\Windows\System\djIyhoC.exe
  2⤵
  PID:7416
- C:\Windows\System\bBXpAyH.exe
  C:\Windows\System\bBXpAyH.exe
  2⤵
  PID:7476
- C:\Windows\System\GeqbLPj.exe
  C:\Windows\System\GeqbLPj.exe
  2⤵
  PID:7432
- C:\Windows\System\XfmdlIc.exe
  C:\Windows\System\XfmdlIc.exe
  2⤵
  PID:7528
- C:\Windows\System\wBoxFmW.exe
  C:\Windows\System\wBoxFmW.exe
  2⤵
  PID:7560
- C:\Windows\System\spUQQKS.exe
  C:\Windows\System\spUQQKS.exe
  2⤵
  PID:7512
- C:\Windows\System\IYjfZJy.exe
  C:\Windows\System\IYjfZJy.exe
  2⤵
  PID:7576
- C:\Windows\System\UfoecLO.exe
  C:\Windows\System\UfoecLO.exe
  2⤵
  PID:7056
- C:\Windows\System\GKFJaCt.exe
  C:\Windows\System\GKFJaCt.exe
  2⤵
  PID:7676
- C:\Windows\System\GIydvKo.exe
  C:\Windows\System\GIydvKo.exe
  2⤵
  PID:7740
- C:\Windows\System\YlcseDx.exe
  C:\Windows\System\YlcseDx.exe
  2⤵
  PID:7720
- C:\Windows\System\nRufqBJ.exe
  C:\Windows\System\nRufqBJ.exe
  2⤵
  PID:7660
- C:\Windows\System\dMiEZXT.exe
  C:\Windows\System\dMiEZXT.exe
  2⤵
  PID:7756
- C:\Windows\System\EIqenpB.exe
  C:\Windows\System\EIqenpB.exe
  2⤵
  PID:7832
- C:\Windows\System\HRvNskf.exe
  C:\Windows\System\HRvNskf.exe
  2⤵
  PID:7896
- C:\Windows\System\oxjJkqJ.exe
  C:\Windows\System\oxjJkqJ.exe
  2⤵
  PID:7884
- C:\Windows\System\SRNYzSD.exe
  C:\Windows\System\SRNYzSD.exe
  2⤵
  PID:7912
- C:\Windows\System\QKSpzrR.exe
  C:\Windows\System\QKSpzrR.exe
  2⤵
  PID:7960
- C:\Windows\System\pgNSYTH.exe
  C:\Windows\System\pgNSYTH.exe
  2⤵
  PID:7976
- C:\Windows\System\ciRgbDv.exe
  C:\Windows\System\ciRgbDv.exe
  2⤵
  PID:8024
- C:\Windows\System\CHtBNFe.exe
  C:\Windows\System\CHtBNFe.exe
  2⤵
  PID:8056
- C:\Windows\System\ZwUEpyG.exe
  C:\Windows\System\ZwUEpyG.exe
  2⤵
  PID:8120
- C:\Windows\System\BShpOXG.exe
  C:\Windows\System\BShpOXG.exe
  2⤵
  PID:8156
- C:\Windows\System\lfmJHhh.exe
  C:\Windows\System\lfmJHhh.exe
  2⤵
  PID:8104
- C:\Windows\System\kGHyjHc.exe
  C:\Windows\System\kGHyjHc.exe
  2⤵
  PID:8168
- C:\Windows\System\pUfFHuX.exe
  C:\Windows\System\pUfFHuX.exe
  2⤵
  PID:7152
- C:\Windows\System\pZCcwfe.exe
  C:\Windows\System\pZCcwfe.exe
  2⤵
  PID:7012
- C:\Windows\System\QrHCYzO.exe
  C:\Windows\System\QrHCYzO.exe
  2⤵
  PID:7184
- C:\Windows\System\juXHuCz.exe
  C:\Windows\System\juXHuCz.exe
  2⤵
  PID:7200
- C:\Windows\System\rlihuqo.exe
  C:\Windows\System\rlihuqo.exe
  2⤵
  PID:7256
- C:\Windows\System\xMKUeGn.exe
  C:\Windows\System\xMKUeGn.exe
  2⤵
  PID:7296
- C:\Windows\System\QCQqtfw.exe
  C:\Windows\System\QCQqtfw.exe
  2⤵
  PID:7324
- C:\Windows\System\exQGqlU.exe
  C:\Windows\System\exQGqlU.exe
  2⤵
  PID:7384
- C:\Windows\System\yjNFnRR.exe
  C:\Windows\System\yjNFnRR.exe
  2⤵
  PID:7508
- C:\Windows\System\rVNZMct.exe
  C:\Windows\System\rVNZMct.exe
  2⤵
  PID:7544
- C:\Windows\System\RsyKnjU.exe
  C:\Windows\System\RsyKnjU.exe
  2⤵
  PID:7708
- C:\Windows\System\MekwhGS.exe
  C:\Windows\System\MekwhGS.exe
  2⤵
  PID:7672
- C:\Windows\System\UYZmjRJ.exe
  C:\Windows\System\UYZmjRJ.exe
  2⤵
  PID:7772
- C:\Windows\System\PUzyCBG.exe
  C:\Windows\System\PUzyCBG.exe
  2⤵
  PID:7928
- C:\Windows\System\sQyYDiD.exe
  C:\Windows\System\sQyYDiD.exe
  2⤵
  PID:8088
- C:\Windows\System\bahPUAp.exe
  C:\Windows\System\bahPUAp.exe
  2⤵
  PID:8172
- C:\Windows\System\aZUGtuA.exe
  C:\Windows\System\aZUGtuA.exe
  2⤵
  PID:6756
- C:\Windows\System\kiTRwqW.exe
  C:\Windows\System\kiTRwqW.exe
  2⤵
  PID:7364
- C:\Windows\System\aYQoZUO.exe
  C:\Windows\System\aYQoZUO.exe
  2⤵
  PID:7592
- C:\Windows\System\RkVZkDm.exe
  C:\Windows\System\RkVZkDm.exe
  2⤵
  PID:8188
- C:\Windows\System\STkfSjw.exe
  C:\Windows\System\STkfSjw.exe
  2⤵
  PID:8012
- C:\Windows\System\cQzBMdV.exe
  C:\Windows\System\cQzBMdV.exe
  2⤵
  PID:6808
- C:\Windows\System\SIEGsjI.exe
  C:\Windows\System\SIEGsjI.exe
  2⤵
  PID:7260
- C:\Windows\System\cvUWGMj.exe
  C:\Windows\System\cvUWGMj.exe
  2⤵
  PID:7412
- C:\Windows\System\qTJeqAA.exe
  C:\Windows\System\qTJeqAA.exe
  2⤵
  PID:7492
- C:\Windows\System\saZJQet.exe
  C:\Windows\System\saZJQet.exe
  2⤵
  PID:7820
- C:\Windows\System\ZzlCpqr.exe
  C:\Windows\System\ZzlCpqr.exe
  2⤵
  PID:7752
- C:\Windows\System\YejHAgz.exe
  C:\Windows\System\YejHAgz.exe
  2⤵
  PID:8076
- C:\Windows\System\lcIrlOI.exe
  C:\Windows\System\lcIrlOI.exe
  2⤵
  PID:8072
- C:\Windows\System\phEVEHU.exe
  C:\Windows\System\phEVEHU.exe
  2⤵
  PID:8140
- C:\Windows\System\kZPrClY.exe
  C:\Windows\System\kZPrClY.exe
  2⤵
  PID:7656
- C:\Windows\System\pkeaWSF.exe
  C:\Windows\System\pkeaWSF.exe
  2⤵
  PID:7880
- C:\Windows\System\iwfqDbA.exe
  C:\Windows\System\iwfqDbA.exe
  2⤵
  PID:7400
- C:\Windows\System\lMViTga.exe
  C:\Windows\System\lMViTga.exe
  2⤵
  PID:7608
- C:\Windows\System\HsjPUsX.exe
  C:\Windows\System\HsjPUsX.exe
  2⤵
  PID:7244
- C:\Windows\System\WaVQtLk.exe
  C:\Windows\System\WaVQtLk.exe
  2⤵
  PID:7204
- C:\Windows\System\HfHwVct.exe
  C:\Windows\System\HfHwVct.exe
  2⤵
  PID:8136
- C:\Windows\System\WPYSPwG.exe
  C:\Windows\System\WPYSPwG.exe
  2⤵
  PID:8196
- C:\Windows\System\nqSjTcv.exe
  C:\Windows\System\nqSjTcv.exe
  2⤵
  PID:8212
- C:\Windows\System\GUjaJxI.exe
  C:\Windows\System\GUjaJxI.exe
  2⤵
  PID:8228
- C:\Windows\System\WaIQaDQ.exe
  C:\Windows\System\WaIQaDQ.exe
  2⤵
  PID:8244
- C:\Windows\System\bneFCIQ.exe
  C:\Windows\System\bneFCIQ.exe
  2⤵
  PID:8260
- C:\Windows\System\aiUfemJ.exe
  C:\Windows\System\aiUfemJ.exe
  2⤵
  PID:8276
- C:\Windows\System\NoslkJN.exe
  C:\Windows\System\NoslkJN.exe
  2⤵
  PID:8292
- C:\Windows\System\iREMLRV.exe
  C:\Windows\System\iREMLRV.exe
  2⤵
  PID:8308
- C:\Windows\System\PxUiJTc.exe
  C:\Windows\System\PxUiJTc.exe
  2⤵
  PID:8324
- C:\Windows\System\qvyATfI.exe
  C:\Windows\System\qvyATfI.exe
  2⤵
  PID:8340
- C:\Windows\System\NZWqxRo.exe
  C:\Windows\System\NZWqxRo.exe
  2⤵
  PID:8356
- C:\Windows\System\zhmJNQn.exe
  C:\Windows\System\zhmJNQn.exe
  2⤵
  PID:8372
- C:\Windows\System\nCjDfoo.exe
  C:\Windows\System\nCjDfoo.exe
  2⤵
  PID:8392
- C:\Windows\System\NpaxXZE.exe
  C:\Windows\System\NpaxXZE.exe
  2⤵
  PID:8408
- C:\Windows\System\MtiQHZV.exe
  C:\Windows\System\MtiQHZV.exe
  2⤵
  PID:8424
- C:\Windows\System\IPvPIHb.exe
  C:\Windows\System\IPvPIHb.exe
  2⤵
  PID:8440
- C:\Windows\System\AzfwIzw.exe
  C:\Windows\System\AzfwIzw.exe
  2⤵
  PID:8456
- C:\Windows\System\bhMhWuR.exe
  C:\Windows\System\bhMhWuR.exe
  2⤵
  PID:8472
- C:\Windows\System\UBRqOST.exe
  C:\Windows\System\UBRqOST.exe
  2⤵
  PID:8488
- C:\Windows\System\UxcbbPl.exe
  C:\Windows\System\UxcbbPl.exe
  2⤵
  PID:8504
- C:\Windows\System\UcnRnXo.exe
  C:\Windows\System\UcnRnXo.exe
  2⤵
  PID:8520
- C:\Windows\System\TryfWcK.exe
  C:\Windows\System\TryfWcK.exe
  2⤵
  PID:8536
- C:\Windows\System\RTUmdWa.exe
  C:\Windows\System\RTUmdWa.exe
  2⤵
  PID:8552
- C:\Windows\System\VtNRzCh.exe
  C:\Windows\System\VtNRzCh.exe
  2⤵
  PID:8568
- C:\Windows\System\uEhnPWK.exe
  C:\Windows\System\uEhnPWK.exe
  2⤵
  PID:8584
- C:\Windows\System\uaPNgoR.exe
  C:\Windows\System\uaPNgoR.exe
  2⤵
  PID:8600
- C:\Windows\System\tNyyuin.exe
  C:\Windows\System\tNyyuin.exe
  2⤵
  PID:8616
- C:\Windows\System\CbOunGz.exe
  C:\Windows\System\CbOunGz.exe
  2⤵
  PID:8632
- C:\Windows\System\ZbTHxxB.exe
  C:\Windows\System\ZbTHxxB.exe
  2⤵
  PID:8648
- C:\Windows\System\bdgmgVI.exe
  C:\Windows\System\bdgmgVI.exe
  2⤵
  PID:8664
- C:\Windows\System\pizRCnD.exe
  C:\Windows\System\pizRCnD.exe
  2⤵
  PID:8680
- C:\Windows\System\jfzpOdF.exe
  C:\Windows\System\jfzpOdF.exe
  2⤵
  PID:8696
- C:\Windows\System\olvqOEA.exe
  C:\Windows\System\olvqOEA.exe
  2⤵
  PID:8712
- C:\Windows\System\HOxlhnT.exe
  C:\Windows\System\HOxlhnT.exe
  2⤵
  PID:8728
- C:\Windows\System\iBzbeWZ.exe
  C:\Windows\System\iBzbeWZ.exe
  2⤵
  PID:8744
- C:\Windows\System\cPlStuC.exe
  C:\Windows\System\cPlStuC.exe
  2⤵
  PID:8760
- C:\Windows\System\HMjzybx.exe
  C:\Windows\System\HMjzybx.exe
  2⤵
  PID:8776
- C:\Windows\System\OFAEOnn.exe
  C:\Windows\System\OFAEOnn.exe
  2⤵
  PID:8792
- C:\Windows\System\zSblLYs.exe
  C:\Windows\System\zSblLYs.exe
  2⤵
  PID:8808
- C:\Windows\System\ubytbRl.exe
  C:\Windows\System\ubytbRl.exe
  2⤵
  PID:8824
- C:\Windows\System\dwoqKvZ.exe
  C:\Windows\System\dwoqKvZ.exe
  2⤵
  PID:8840
- C:\Windows\System\OswsIXe.exe
  C:\Windows\System\OswsIXe.exe
  2⤵
  PID:8856
- C:\Windows\System\YaQXVhG.exe
  C:\Windows\System\YaQXVhG.exe
  2⤵
  PID:8872
- C:\Windows\System\NIFdUNB.exe
  C:\Windows\System\NIFdUNB.exe
  2⤵
  PID:8888
- C:\Windows\System\zIPzndH.exe
  C:\Windows\System\zIPzndH.exe
  2⤵
  PID:8904
- C:\Windows\System\PvMDqLV.exe
  C:\Windows\System\PvMDqLV.exe
  2⤵
  PID:8920
- C:\Windows\System\wVWEUyR.exe
  C:\Windows\System\wVWEUyR.exe
  2⤵
  PID:8936
- C:\Windows\System\EIToGMZ.exe
  C:\Windows\System\EIToGMZ.exe
  2⤵
  PID:8952
- C:\Windows\System\faNThNI.exe
  C:\Windows\System\faNThNI.exe
  2⤵
  PID:8968
- C:\Windows\System\YyAyCic.exe
  C:\Windows\System\YyAyCic.exe
  2⤵
  PID:8984
- C:\Windows\System\JSocKEw.exe
  C:\Windows\System\JSocKEw.exe
  2⤵
  PID:9000
- C:\Windows\System\BFDgHIM.exe
  C:\Windows\System\BFDgHIM.exe
  2⤵
  PID:9016
- C:\Windows\System\KmeUmYD.exe
  C:\Windows\System\KmeUmYD.exe
  2⤵
  PID:9032
- C:\Windows\System\xNYxawh.exe
  C:\Windows\System\xNYxawh.exe
  2⤵
  PID:9048
- C:\Windows\System\tQkgnQL.exe
  C:\Windows\System\tQkgnQL.exe
  2⤵
  PID:9064
- C:\Windows\System\EVLyUPA.exe
  C:\Windows\System\EVLyUPA.exe
  2⤵
  PID:9080
- C:\Windows\System\FxngFtE.exe
  C:\Windows\System\FxngFtE.exe
  2⤵
  PID:9096
- C:\Windows\System\VnAhIsE.exe
  C:\Windows\System\VnAhIsE.exe
  2⤵
  PID:9112
- C:\Windows\System\jvOdTbG.exe
  C:\Windows\System\jvOdTbG.exe
  2⤵
  PID:9128
- C:\Windows\System\owElMJA.exe
  C:\Windows\System\owElMJA.exe
  2⤵
  PID:9144
- C:\Windows\System\dmmUFPL.exe
  C:\Windows\System\dmmUFPL.exe
  2⤵
  PID:9160
- C:\Windows\System\VirRkyd.exe
  C:\Windows\System\VirRkyd.exe
  2⤵
  PID:9176
- C:\Windows\System\ESxNCZp.exe
  C:\Windows\System\ESxNCZp.exe
  2⤵
  PID:9192
- C:\Windows\System\FbeoEdy.exe
  C:\Windows\System\FbeoEdy.exe
  2⤵
  PID:9208
- C:\Windows\System\aNrXcIF.exe
  C:\Windows\System\aNrXcIF.exe
  2⤵
  PID:7136
- C:\Windows\System\xfSWvge.exe
  C:\Windows\System\xfSWvge.exe
  2⤵
  PID:8268
- C:\Windows\System\uDyMxVy.exe
  C:\Windows\System\uDyMxVy.exe
  2⤵
  PID:8332
- C:\Windows\System\TBkHQop.exe
  C:\Windows\System\TBkHQop.exe
  2⤵
  PID:8400
- C:\Windows\System\dYfrLqc.exe
  C:\Windows\System\dYfrLqc.exe
  2⤵
  PID:8464
- C:\Windows\System\MMwoghi.exe
  C:\Windows\System\MMwoghi.exe
  2⤵
  PID:8320
- C:\Windows\System\yiyhSVb.exe
  C:\Windows\System\yiyhSVb.exe
  2⤵
  PID:8256
- C:\Windows\System\wkyKHKn.exe
  C:\Windows\System\wkyKHKn.exe
  2⤵
  PID:8496
- C:\Windows\System\cIsDNks.exe
  C:\Windows\System\cIsDNks.exe
  2⤵
  PID:8416
- C:\Windows\System\MKYeloZ.exe
  C:\Windows\System\MKYeloZ.exe
  2⤵
  PID:8480
- C:\Windows\System\nqayVAH.exe
  C:\Windows\System\nqayVAH.exe
  2⤵
  PID:8560
- C:\Windows\System\fFBTPKX.exe
  C:\Windows\System\fFBTPKX.exe
  2⤵
  PID:8592
- C:\Windows\System\tzYrnTP.exe
  C:\Windows\System\tzYrnTP.exe
  2⤵
  PID:8628
- C:\Windows\System\xPdCAIY.exe
  C:\Windows\System\xPdCAIY.exe
  2⤵
  PID:8544
- C:\Windows\System\beslUZm.exe
  C:\Windows\System\beslUZm.exe
  2⤵
  PID:8644
- C:\Windows\System\slhlQTg.exe
  C:\Windows\System\slhlQTg.exe
  2⤵
  PID:8576
- C:\Windows\System\MuVtoFR.exe
  C:\Windows\System\MuVtoFR.exe
  2⤵
  PID:8752
- C:\Windows\System\btzBOYI.exe
  C:\Windows\System\btzBOYI.exe
  2⤵
  PID:8708
- C:\Windows\System\AXkWFlA.exe
  C:\Windows\System\AXkWFlA.exe
  2⤵
  PID:8788
- C:\Windows\System\CblacLm.exe
  C:\Windows\System\CblacLm.exe
  2⤵
  PID:8852
- C:\Windows\System\MCXMNPp.exe
  C:\Windows\System\MCXMNPp.exe
  2⤵
  PID:8916
- C:\Windows\System\cifABIS.exe
  C:\Windows\System\cifABIS.exe
  2⤵
  PID:8772
- C:\Windows\System\wvDUHNN.exe
  C:\Windows\System\wvDUHNN.exe
  2⤵
  PID:9008
- C:\Windows\System\kJsPHpf.exe
  C:\Windows\System\kJsPHpf.exe
  2⤵
  PID:8832
- C:\Windows\System\CrLQAoX.exe
  C:\Windows\System\CrLQAoX.exe
  2⤵
  PID:8804
- C:\Windows\System\MQdRDBD.exe
  C:\Windows\System\MQdRDBD.exe
  2⤵
  PID:8896
- C:\Windows\System\YepcStj.exe
  C:\Windows\System\YepcStj.exe
  2⤵
  PID:8964
- C:\Windows\System\hstBntp.exe
  C:\Windows\System\hstBntp.exe
  2⤵
  PID:9056
- C:\Windows\System\thVDoGL.exe
  C:\Windows\System\thVDoGL.exe
  2⤵
  PID:9092
- C:\Windows\System\IagJUbH.exe
  C:\Windows\System\IagJUbH.exe
  2⤵
  PID:9204
- C:\Windows\System\jNoIwSO.exe
  C:\Windows\System\jNoIwSO.exe
  2⤵
  PID:9172
- C:\Windows\System\HWJOclV.exe
  C:\Windows\System\HWJOclV.exe
  2⤵
  PID:8368
- C:\Windows\System\VTwWeSN.exe
  C:\Windows\System\VTwWeSN.exe
  2⤵
  PID:8500
- C:\Windows\System\zdrcMZp.exe
  C:\Windows\System\zdrcMZp.exe
  2⤵
  PID:8516
- C:\Windows\System\pHZPaGA.exe
  C:\Windows\System\pHZPaGA.exe
  2⤵
  PID:8304
- C:\Windows\System\MhBSLSp.exe
  C:\Windows\System\MhBSLSp.exe
  2⤵
  PID:8724
- C:\Windows\System\aXflyxp.exe
  C:\Windows\System\aXflyxp.exe
  2⤵
  PID:8204
- C:\Windows\System\hzWYKrP.exe
  C:\Windows\System\hzWYKrP.exe
  2⤵
  PID:9188
- C:\Windows\System\SKXeQza.exe
  C:\Windows\System\SKXeQza.exe
  2⤵
  PID:8736
- C:\Windows\System\xjscBGt.exe
  C:\Windows\System\xjscBGt.exe
  2⤵
  PID:8224
- C:\Windows\System\NtzAmwF.exe
  C:\Windows\System\NtzAmwF.exe
  2⤵
  PID:8820
- C:\Windows\System\oLvBfJg.exe
  C:\Windows\System\oLvBfJg.exe
  2⤵
  PID:8756
- C:\Windows\System\SAGfDlM.exe
  C:\Windows\System\SAGfDlM.exe
  2⤵
  PID:8948
- C:\Windows\System\uABDMZH.exe
  C:\Windows\System\uABDMZH.exe
  2⤵
  PID:8980
- C:\Windows\System\GswRjET.exe
  C:\Windows\System\GswRjET.exe
  2⤵
  PID:8960
- C:\Windows\System\TMaqXmJ.exe
  C:\Windows\System\TMaqXmJ.exe
  2⤵
  PID:9044
- C:\Windows\System\TNAzxGQ.exe
  C:\Windows\System\TNAzxGQ.exe
  2⤵
  PID:9028
- C:\Windows\System\OEbCtDi.exe
  C:\Windows\System\OEbCtDi.exe
  2⤵
  PID:8364
- C:\Windows\System\zKRXjFg.exe
  C:\Windows\System\zKRXjFg.exe
  2⤵
  PID:9156
- C:\Windows\System\CjpmliP.exe
  C:\Windows\System\CjpmliP.exe
  2⤵
  PID:8252
- C:\Windows\System\gCniZbW.exe
  C:\Windows\System\gCniZbW.exe
  2⤵
  PID:9200
- C:\Windows\System\uBLZcke.exe
  C:\Windows\System\uBLZcke.exe
  2⤵
  PID:8300
- C:\Windows\System\LzIsDAP.exe
  C:\Windows\System\LzIsDAP.exe
  2⤵
  PID:8316
- C:\Windows\System\MBCaAOf.exe
  C:\Windows\System\MBCaAOf.exe
  2⤵
  PID:8352
- C:\Windows\System\iaSmYBt.exe
  C:\Windows\System\iaSmYBt.exe
  2⤵
  PID:9108
- C:\Windows\System\glGKJSM.exe
  C:\Windows\System\glGKJSM.exe
  2⤵
  PID:9072
- C:\Windows\System\cvGzmfR.exe
  C:\Windows\System\cvGzmfR.exe
  2⤵
  PID:8692
- C:\Windows\System\LFnokOM.exe
  C:\Windows\System\LFnokOM.exe
  2⤵
  PID:9088
- C:\Windows\System\LsOPJHQ.exe
  C:\Windows\System\LsOPJHQ.exe
  2⤵
  PID:8436
- C:\Windows\System\BlEoSuc.exe
  C:\Windows\System\BlEoSuc.exe
  2⤵
  PID:9024
- C:\Windows\System\ZwAGhUX.exe
  C:\Windows\System\ZwAGhUX.exe
  2⤵
  PID:1500
- C:\Windows\System\YtnZEIV.exe
  C:\Windows\System\YtnZEIV.exe
  2⤵
  PID:9224
- C:\Windows\System\ahfTJYO.exe
  C:\Windows\System\ahfTJYO.exe
  2⤵
  PID:9240
- C:\Windows\System\bPWttAF.exe
  C:\Windows\System\bPWttAF.exe
  2⤵
  PID:9256
- C:\Windows\System\QchOOgN.exe
  C:\Windows\System\QchOOgN.exe
  2⤵
  PID:9272
- C:\Windows\System\zAritZL.exe
  C:\Windows\System\zAritZL.exe
  2⤵
  PID:9288
- C:\Windows\System\HcTJGNF.exe
  C:\Windows\System\HcTJGNF.exe
  2⤵
  PID:9304
- C:\Windows\System\StTTKhI.exe
  C:\Windows\System\StTTKhI.exe
  2⤵
  PID:9320
- C:\Windows\System\nEiiunL.exe
  C:\Windows\System\nEiiunL.exe
  2⤵
  PID:9336
- C:\Windows\System\wLYUNCR.exe
  C:\Windows\System\wLYUNCR.exe
  2⤵
  PID:9352
- C:\Windows\System\TPRmSbo.exe
  C:\Windows\System\TPRmSbo.exe
  2⤵
  PID:9368
- C:\Windows\System\PPVASVg.exe
  C:\Windows\System\PPVASVg.exe
  2⤵
  PID:9384
- C:\Windows\System\joHudll.exe
  C:\Windows\System\joHudll.exe
  2⤵
  PID:9404
- C:\Windows\System\vhYZtfs.exe
  C:\Windows\System\vhYZtfs.exe
  2⤵
  PID:9420
- C:\Windows\System\KBqJsak.exe
  C:\Windows\System\KBqJsak.exe
  2⤵
  PID:9436
- C:\Windows\System\JluEsHr.exe
  C:\Windows\System\JluEsHr.exe
  2⤵
  PID:9452
- C:\Windows\System\EMikgcp.exe
  C:\Windows\System\EMikgcp.exe
  2⤵
  PID:9468
- C:\Windows\System\IqfSxac.exe
  C:\Windows\System\IqfSxac.exe
  2⤵
  PID:9484
- C:\Windows\System\KmSjbKH.exe
  C:\Windows\System\KmSjbKH.exe
  2⤵
  PID:9500
- C:\Windows\System\VPXfmkY.exe
  C:\Windows\System\VPXfmkY.exe
  2⤵
  PID:9516
- C:\Windows\System\NGvxIaY.exe
  C:\Windows\System\NGvxIaY.exe
  2⤵
  PID:9532
- C:\Windows\System\HEmqRcn.exe
  C:\Windows\System\HEmqRcn.exe
  2⤵
  PID:9548
- C:\Windows\System\KuXwxkb.exe
  C:\Windows\System\KuXwxkb.exe
  2⤵
  PID:9564
- C:\Windows\System\uFtVVXg.exe
  C:\Windows\System\uFtVVXg.exe
  2⤵
  PID:9580
- C:\Windows\System\oBPcUyZ.exe
  C:\Windows\System\oBPcUyZ.exe
  2⤵
  PID:9596
- C:\Windows\System\UCOpdAY.exe
  C:\Windows\System\UCOpdAY.exe
  2⤵
  PID:9612
- C:\Windows\System\nnNfHdP.exe
  C:\Windows\System\nnNfHdP.exe
  2⤵
  PID:9628
- C:\Windows\System\rBJFJRT.exe
  C:\Windows\System\rBJFJRT.exe
  2⤵
  PID:9644
- C:\Windows\System\cvRMVaF.exe
  C:\Windows\System\cvRMVaF.exe
  2⤵
  PID:9660
- C:\Windows\System\teAuofJ.exe
  C:\Windows\System\teAuofJ.exe
  2⤵
  PID:9676
- C:\Windows\System\hAiyyjA.exe
  C:\Windows\System\hAiyyjA.exe
  2⤵
  PID:9692
- C:\Windows\System\OebeOYw.exe
  C:\Windows\System\OebeOYw.exe
  2⤵
  PID:9708
- C:\Windows\System\BWokNcV.exe
  C:\Windows\System\BWokNcV.exe
  2⤵
  PID:9724
- C:\Windows\System\nHLzQln.exe
  C:\Windows\System\nHLzQln.exe
  2⤵
  PID:9740
- C:\Windows\System\JZawZDQ.exe
  C:\Windows\System\JZawZDQ.exe
  2⤵
  PID:9756
- C:\Windows\System\rrsrITE.exe
  C:\Windows\System\rrsrITE.exe
  2⤵
  PID:9772
- C:\Windows\System\ETEoGIw.exe
  C:\Windows\System\ETEoGIw.exe
  2⤵
  PID:9788
- C:\Windows\System\LQroFNy.exe
  C:\Windows\System\LQroFNy.exe
  2⤵
  PID:9804
- C:\Windows\System\xqqNTWU.exe
  C:\Windows\System\xqqNTWU.exe
  2⤵
  PID:9820
- C:\Windows\System\OQUcljM.exe
  C:\Windows\System\OQUcljM.exe
  2⤵
  PID:9836
- C:\Windows\System\uNkQkUf.exe
  C:\Windows\System\uNkQkUf.exe
  2⤵
  PID:9852
- C:\Windows\System\qbEPqPN.exe
  C:\Windows\System\qbEPqPN.exe
  2⤵
  PID:9868
- C:\Windows\System\ZFMrzMX.exe
  C:\Windows\System\ZFMrzMX.exe
  2⤵
  PID:9884
- C:\Windows\System\DWckEpE.exe
  C:\Windows\System\DWckEpE.exe
  2⤵
  PID:9900
- C:\Windows\System\IUqxCka.exe
  C:\Windows\System\IUqxCka.exe
  2⤵
  PID:9916
- C:\Windows\System\vJgyvEt.exe
  C:\Windows\System\vJgyvEt.exe
  2⤵
  PID:9932
- C:\Windows\System\PMTpdBP.exe
  C:\Windows\System\PMTpdBP.exe
  2⤵
  PID:9948
- C:\Windows\System\ZZorQQz.exe
  C:\Windows\System\ZZorQQz.exe
  2⤵
  PID:9964
- C:\Windows\System\pNmceyT.exe
  C:\Windows\System\pNmceyT.exe
  2⤵
  PID:9980
- C:\Windows\System\kmUXFYq.exe
  C:\Windows\System\kmUXFYq.exe
  2⤵
  PID:9996
- C:\Windows\System\KhvHdoa.exe
  C:\Windows\System\KhvHdoa.exe
  2⤵
  PID:10012
- C:\Windows\System\kfBRWzO.exe
  C:\Windows\System\kfBRWzO.exe
  2⤵
  PID:10028
- C:\Windows\System\qbEfxch.exe
  C:\Windows\System\qbEfxch.exe
  2⤵
  PID:10044
- C:\Windows\System\rsCrGkJ.exe
  C:\Windows\System\rsCrGkJ.exe
  2⤵
  PID:10060
- C:\Windows\System\hwJKFSt.exe
  C:\Windows\System\hwJKFSt.exe
  2⤵
  PID:10076
- C:\Windows\System\Vznhdrg.exe
  C:\Windows\System\Vznhdrg.exe
  2⤵
  PID:10092
- C:\Windows\System\FLzMJxm.exe
  C:\Windows\System\FLzMJxm.exe
  2⤵
  PID:10108
- C:\Windows\System\cOzFxgD.exe
  C:\Windows\System\cOzFxgD.exe
  2⤵
  PID:10124
- C:\Windows\System\IDClMhv.exe
  C:\Windows\System\IDClMhv.exe
  2⤵
  PID:10140
- C:\Windows\System\LRnWMjG.exe
  C:\Windows\System\LRnWMjG.exe
  2⤵
  PID:10156
- C:\Windows\System\ZGnfoVI.exe
  C:\Windows\System\ZGnfoVI.exe
  2⤵
  PID:10172
- C:\Windows\System\kqizLBH.exe
  C:\Windows\System\kqizLBH.exe
  2⤵
  PID:10188
- C:\Windows\System\lrtUHfA.exe
  C:\Windows\System\lrtUHfA.exe
  2⤵
  PID:10204
- C:\Windows\System\LEohIPa.exe
  C:\Windows\System\LEohIPa.exe
  2⤵
  PID:10220
- C:\Windows\System\RBUVbDS.exe
  C:\Windows\System\RBUVbDS.exe
  2⤵
  PID:10236
- C:\Windows\System\mBlLBBV.exe
  C:\Windows\System\mBlLBBV.exe
  2⤵
  PID:9248
- C:\Windows\System\gsJJfZu.exe
  C:\Windows\System\gsJJfZu.exe
  2⤵
  PID:9152
- C:\Windows\System\uzUrcpA.exe
  C:\Windows\System\uzUrcpA.exe
  2⤵
  PID:9348
- C:\Windows\System\IVbQMjT.exe
  C:\Windows\System\IVbQMjT.exe
  2⤵
  PID:9184
- C:\Windows\System\opdCJLI.exe
  C:\Windows\System\opdCJLI.exe
  2⤵
  PID:9140
- C:\Windows\System\fGkJWZd.exe
  C:\Windows\System\fGkJWZd.exe
  2⤵
  PID:9296
- C:\Windows\System\kfCTUhg.exe
  C:\Windows\System\kfCTUhg.exe
  2⤵
  PID:9360
- C:\Windows\System\cARVsIt.exe
  C:\Windows\System\cARVsIt.exe
  2⤵
  PID:9412
- C:\Windows\System\mreabkh.exe
  C:\Windows\System\mreabkh.exe
  2⤵
  PID:9476
- C:\Windows\System\JghoUvh.exe
  C:\Windows\System\JghoUvh.exe
  2⤵
  PID:9492
- C:\Windows\System\JiNyPpU.exe
  C:\Windows\System\JiNyPpU.exe
  2⤵
  PID:9464
- C:\Windows\System\IyhxWOX.exe
  C:\Windows\System\IyhxWOX.exe
  2⤵
  PID:9576
- C:\Windows\System\xQpAfIn.exe
  C:\Windows\System\xQpAfIn.exe
  2⤵
  PID:9556
- C:\Windows\System\slhmYga.exe
  C:\Windows\System\slhmYga.exe
  2⤵
  PID:9608
- C:\Windows\System\xEzoGkh.exe
  C:\Windows\System\xEzoGkh.exe
  2⤵
  PID:9624
- C:\Windows\System\rIAxgaV.exe
  C:\Windows\System\rIAxgaV.exe
  2⤵
  PID:9684
- C:\Windows\System\UjdsnIS.exe
  C:\Windows\System\UjdsnIS.exe
  2⤵
  PID:9700
- C:\Windows\System\tOqBkwa.exe
  C:\Windows\System\tOqBkwa.exe
  2⤵
  PID:9764
- C:\Windows\System\lBPiRbw.exe
  C:\Windows\System\lBPiRbw.exe
  2⤵
  PID:9720
- C:\Windows\System\xoMMEzz.exe
  C:\Windows\System\xoMMEzz.exe
  2⤵
  PID:9784
- C:\Windows\System\bTCfxlA.exe
  C:\Windows\System\bTCfxlA.exe
  2⤵
  PID:9832
- C:\Windows\System\yeQSYff.exe
  C:\Windows\System\yeQSYff.exe
  2⤵
  PID:9860
- C:\Windows\System\YmIOzOz.exe
  C:\Windows\System\YmIOzOz.exe
  2⤵
  PID:9876
- C:\Windows\System\rrJtmis.exe
  C:\Windows\System\rrJtmis.exe
  2⤵
  PID:9912
- C:\Windows\System\RUBwBHS.exe
  C:\Windows\System\RUBwBHS.exe
  2⤵
  PID:9940
- C:\Windows\System\jeruqDk.exe
  C:\Windows\System\jeruqDk.exe
  2⤵
  PID:9976
- C:\Windows\System\zFiTyyU.exe
  C:\Windows\System\zFiTyyU.exe
  2⤵
  PID:10024
- C:\Windows\System\XFHSiPY.exe
  C:\Windows\System\XFHSiPY.exe
  2⤵
  PID:10088
- C:\Windows\System\njxIsHx.exe
  C:\Windows\System\njxIsHx.exe
  2⤵
  PID:10148
- C:\Windows\System\QTvyFZS.exe
  C:\Windows\System\QTvyFZS.exe
  2⤵
  PID:10212
- C:\Windows\System\quLCSHd.exe
  C:\Windows\System\quLCSHd.exe
  2⤵
  PID:9316
- C:\Windows\System\NvIuIfZ.exe
  C:\Windows\System\NvIuIfZ.exe
  2⤵
  PID:8912
- C:\Windows\System\kTNXpiM.exe
  C:\Windows\System\kTNXpiM.exe
  2⤵
  PID:10068
- C:\Windows\System\TDRIzFa.exe
  C:\Windows\System\TDRIzFa.exe
  2⤵
  PID:10168
- C:\Windows\System\DdodyGy.exe
  C:\Windows\System\DdodyGy.exe
  2⤵
  PID:10100
- C:\Windows\System\RtOFGVc.exe
  C:\Windows\System\RtOFGVc.exe
  2⤵
  PID:9392
- C:\Windows\System\XXgYgLC.exe
  C:\Windows\System\XXgYgLC.exe
  2⤵
  PID:9284
- C:\Windows\System\gHSqomR.exe
  C:\Windows\System\gHSqomR.exe
  2⤵
  PID:9444
- C:\Windows\System\DZNFvbJ.exe
  C:\Windows\System\DZNFvbJ.exe
  2⤵
  PID:9448
- C:\Windows\System\yfakcIF.exe
  C:\Windows\System\yfakcIF.exe
  2⤵
  PID:9544
- C:\Windows\System\BQkFxGD.exe
  C:\Windows\System\BQkFxGD.exe
  2⤵
  PID:9620
- C:\Windows\System\hgjlMPH.exe
  C:\Windows\System\hgjlMPH.exe
  2⤵
  PID:9748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AEPpaWg.exe

Filesize
1.9MB

MD5
af39a3d06caf70c9a9358c9c9ad368e0

SHA1
5d3271b7d39c288d827cea3b10dd37558eaf08b6

SHA256
1fa39e498dc762213345b0ed589c5401646923c757a82810a88d459948d558ab

SHA512
dda00f9ce296ab60b1bce89c722c945305d9049d1f40cf42f8a96b9186db00c9836ca5a0ffcb9887943903c268877f7a7401c5a19fd3c995310bd27c02400810

Download Submit
C:\Windows\system\AzpaAOP.exe

Filesize
1.8MB

MD5
49344c14a734db8d9920655868845091

SHA1
558d527a228aedcf8a350f1bc1610940e706a9c0

SHA256
0b058d754257020fb9cd1d195bf8524b51153a19cc69e59bca80ffcdec43a0d9

SHA512
26c14e57c12ad258c560eca7b74940d93627b2182ad6050150e649cd28db4f824cb152e6db00aa2f424b703cf48c4c40ecd52508615739fa8de02f2d235332ad

Download Submit
C:\Windows\system\EQvoxao.exe

Filesize
1.8MB

MD5
9084f49bb7dfb76bdaeb02a4d1e65839

SHA1
5e44937385511e3a3f93452b2eed663cbf662c44

SHA256
4ead32d78db71a7643e5d9a7c3cec56d05c022a11ececed1ac60905fe9af8e24

SHA512
3c68f20dd70fdf308e10284b50cb0d893f55cb67cec8f05b9a99ad21f0641bd57e115a16d18b22f344027c89f1b69abf903212f29baa858308b536ada6b57f0b

Download Submit
C:\Windows\system\FCfSFje.exe

Filesize
1.8MB

MD5
7e670a800f769798d164aa766d036a1e

SHA1
faea4af9d667f4dda45a7b58f929c99c9d4496fc

SHA256
17214d14c005b9d8f5af62802c4e983760a6741fc43707dabad72cf3776a68c4

SHA512
94e2c69ecf6d3c1dcc18307fd8ac80dbd4e2ba3672d478c44da51338b365f0bfd40db74668e9afe357f98f67bb1cc364fb9e53515df0cb523376296ed81cef7f

Download Submit
C:\Windows\system\IhRiDvv.exe

Filesize
1.9MB

MD5
84481b48c8662575ff1a04a794c032b9

SHA1
b72e7fd0a494453a3be946397d0b1c0480784fac

SHA256
77ed7c1bbd483453dce1074aa5cb1e15661b885465a7d727c807a94fb0808c90

SHA512
63b27513e2a2bd7147693f6a3ecb7f8afa34e6c514c0a993733af5da2e4cc464a83514cda4427575dbe778d021e59d7af1da11ee3993a2c58107bcf411f26022

Download Submit
C:\Windows\system\PbtSUgA.exe

Filesize
1.8MB

MD5
a3770ceadfe53ca1482f980e11289ff6

SHA1
e51c8db60eabd9a30e0ae69285e9840f56eee6b7

SHA256
9b173241ad6ebc6c2c1834438baa8ac8bc7a4b9460c40d10536f5afa5e3b0d7b

SHA512
14ba54b1f20d7d0e582672607c771d1e0e13716b2d45650604682008efa2106c4ea847a4fbd44aed75b92e1cf2e281334d6006f705a439b2de87c2fdb1f9cbfc

Download Submit
C:\Windows\system\ULWyQam.exe

Filesize
1.9MB

MD5
86a2e897332b0f543bbddbb360bb01df

SHA1
020897244a38dcae56c6f243024d50fce5bd0562

SHA256
779caac08fe5c86ff93469ddd01ff7f1b0e0be698af00868433d9b62cd9b5cdb

SHA512
8847102e3ca46975eee9b5e60b595521244872a2245a18f6777929badebc36ed8ece470134a89e34c33b7add3c6a759023df832907cb175ac755193624e92abd

Download Submit
C:\Windows\system\YVWbeCc.exe

Filesize
1.9MB

MD5
6593808253af9787639c108fdce46909

SHA1
fb41ec26675ac87433beb29e9e80591abf577ac3

SHA256
44f10ddaba026e37b3a1494e4cdb613b63581f8f995ca4f41e60876d7e74a4cd

SHA512
7efd9bff21c85a6b3189341ecdbd27b6df1b940275be42ce651ce5f2cb231eca7ea1958f3254b7db344949fe79f889ebc32c758dff39a6f79913e1273bd26bad

Download Submit
C:\Windows\system\YdlkyzZ.exe

Filesize
1.8MB

MD5
1660d124de986a3b097e94f9a4eb52d3

SHA1
d63a15626b7f301f38d5fc6fda1d310ebfbc709a

SHA256
582d72e53c56f0bf0a487da2c95a9039ffdc9285240e1807b467700a0ca31b2e

SHA512
c99bf3cb62eaea567e295eb601820021bded5a938a4a328bf383d79ebc109c8bed66a555ec4732f87977d843033429bc27cb566107c01850568f0a0aa9f97a18

Download Submit
C:\Windows\system\ZyfxgLR.exe

Filesize
1.9MB

MD5
eeb1d7f575b17d3d34d850826920e280

SHA1
8893023e5cee752595d5308ccc66407997164936

SHA256
3f1d54888b84462ff4d5f4b5304da1af5aa078de3711bab7d68ed0dfa984f9c6

SHA512
0e7d41db644edcf19330a8d7b1a1900cf904c5f22fa967af31cb57268efd8b16a126d31f9f806e7c5ca4be93991dbf631abbcc8411240e4be8b621e481d40751

Download Submit
C:\Windows\system\bHwHRMh.exe

Filesize
1.9MB

MD5
e22f876f71453e7f5eac9577f3ec2571

SHA1
cde4618607b974de917fd8d6addb17edb83e8850

SHA256
f8ae79e50ed8c5782d13d329a8ffc0b7e3ff0f1a1e51df0a32be00be0aa4aab9

SHA512
cd94a76fff0a9afc15af0906b8711b674619621b9742905ca229a2d98ab16f939eb633128c2f22779a0d2cddaa31d2ef1913d2b44b6ce1975b6964ece238571c

Download Submit
C:\Windows\system\ctxjcxJ.exe

Filesize
1.8MB

MD5
e49bc270bef73189feda7d7929517ece

SHA1
f87c29fec258b1cc1c8935dc670502a84a97eeb8

SHA256
5c6740985a4b7dbd0c7b90f10eec64bef3dc9b76066009d8203fbb534cdc95d9

SHA512
d92abf6e1154a76fd74d477cfaa2dd86fe80e960b0307e0eeca33a49f07df6cbcc67c7056c35034f4a7716bbf498bf6c2f4264fea2103c6eead2ce3f2b1b8009

Download Submit
C:\Windows\system\dgZTWKW.exe

Filesize
1.8MB

MD5
3fc3bcb2023f869ee9398d23d4bcc87d

SHA1
0ae3cfd7c01ae2729a6cf43ad5259b8184d73119

SHA256
4c145530ae1a56b7504ff8eaff21e9a43fd4dade161ebed534d393551e2ebca5

SHA512
bae081d82792d5f7632b98c8bfc640aa8b5db29c329c463e49adcbecb331c691518db6fb38df8f02b05a0bcb125c9f86816a2dd6fc3737252d44711e914fb5d0

Download Submit
C:\Windows\system\dvpDJBd.exe

Filesize
1.9MB

MD5
b710830ee4f6ce010fdd1e3e2b75136b

SHA1
53b533f3d5541882e83c8fc15f465882177f52dd

SHA256
996b9aa1fe33a94c58682dc3e71d495f5886f953660dda98bf961a933c121f2c

SHA512
ed6dfc4063fabafb66347d859bbf74af566f03a38913918e019bad108d206c2727c0e399b716640c11f5129af075ab8fc73508efb96d953040db9e2787265cb4

Download Submit
C:\Windows\system\hEELhGb.exe

Filesize
1.9MB

MD5
21acda2b83a0c0b500feeb3f38faca08

SHA1
e137f20bad319c8d357ddd8dc5ae7bb2ce37b4f5

SHA256
9dc6895b763e8f5034ea23b50ced936358db094bada22390040cc12cae45f5ff

SHA512
443a7670721c7a0584378f90c2a8bebf95090612ad6ad3f2cf1f02e61c994f9670bd2c7e9a49bd62fb8e31b8c25fb5e3876ef35b9aa7efd6f0c9231866592675

Download Submit
C:\Windows\system\hvDuZHh.exe

Filesize
1.8MB

MD5
038085c3d742809887f2a0c07ed96966

SHA1
4d349d6efbb83aefeee49ceb71d4e1ab26843789

SHA256
df14d87edc95a796bf67afc4dfc7f8d082921546dc270d50ecd59932306b83cd

SHA512
5eeef564d57cddecc57bd70d83946c190f2ecb47c5e0b9cdfc5abb061a10475f7fca004747348b18647498297361f2287c9fe8e32fdb1f85d109853a75aadfdf

Download Submit
C:\Windows\system\rZxwruH.exe

Filesize
1.9MB

MD5
d8940a9c8f8a05ec7eef0d6277a1b469

SHA1
4f517b69bfc948fcce1de7012bc4750bf24ac67e

SHA256
dabfd4817cb1934c4e8016b3d8e5fe7f00be46c01948faf9ad815d4fa08db7de

SHA512
02b46854c6037e07335e925208e75b2b1601f21b3876649090d60368b60a81a71259e184a90a716d6c5eafe985d5cfac1d6babf42373d4a88c9a81afb7532df1

Download Submit
C:\Windows\system\sXdAjtV.exe

Filesize
1.8MB

MD5
0b33aaec84baa4f65be0ca96aa9eb3cb

SHA1
d856424e8a7c3ab2d4be73033145140b9d9c829b

SHA256
5665012bdb0d2f322aee100d24f78418079961dc96149e0b8e8662aa13c76873

SHA512
f58a5db76a7b4c6ab5aadcae717230698c33ab85829e2313d0175910ab0385da4bfe8187764fcd58ec11bbc344c4df9654631a3d32b125cc895b995304e9f2d4

Download Submit
C:\Windows\system\yXpfhJE.exe

Filesize
1.8MB

MD5
8cc6fc3ae176c52d81f60e23a8fca4d3

SHA1
f159613404995c0c9347a5572456063a9ca3c665

SHA256
a501f434648977b808553aa1326366f881f4b5c95c002d32148cfdcd03b66701

SHA512
5a6dc075d35a02602994066f318a1bf724213b8961580a4da00768313f96dd373f407fa14705edf034871c9e7f14e0cb26601ec4beb2c6c2df0ecfe5e7f16e95

Download Submit
C:\Windows\system\zDIlsuk.exe

Filesize
1.9MB

MD5
d7273f1ef707a126d3164b594e316ef6

SHA1
87506214531123f292469611bf9e0d9519dd1225

SHA256
7098fdaae5fb954d04b6297bfa2ce6c97c9a158cae9bdd3a2e00de009d199405

SHA512
2a85224f4c4a29ac4dbf9cc46cf97bc3d0dc2105545f285187c86b5469adf67dd1dd7c753590dec5e3f3092781ef872042f05e99752d0bbcf01035823a7fdf72

Download Submit
\Windows\system\ATpTUju.exe

Filesize
1.8MB

MD5
d46d60833e8fa5ecbc4eb6b31764ec56

SHA1
9b69c1e1d62cf3f58e733f082c9fd6c9a6d9e08f

SHA256
a2191d8682fe88baa7db8cf80466c964bbf2ecf6f8249b7c73766415a440004c

SHA512
be7969c972252de327ea4510eec05a3bff74fffb09b68bbd6e1377cb3cc52257000098b005e4cf4c754b8d272df78d351c7908f48fad23761d42f53b4ad06f3a

Download Submit
\Windows\system\IAiusNc.exe

Filesize
1.9MB

MD5
f843c008baf586668b5c96b46c5bd4bb

SHA1
05f1808d9d6b3a8758fd0f785421bd898e833df9

SHA256
c9c7a49301761e94010977761ff16cabf4aad8fd83a8abdb0ba372e23fb04429

SHA512
0bcc9a50832cf6b64f762a2abfb66e9bc321df22368bd0dbbdd014b18e3ec3eae723866dd451ef6c7da83ac0c96dd15e9cc368b3562d63218ac735840997b6f9

Download Submit
\Windows\system\InzeKog.exe

Filesize
1.9MB

MD5
86a9de969f81e6073718743cf22e2df6

SHA1
ac95cc9f7e7782d69a9c35bc1b8f63ea26933f26

SHA256
d95167646b526788ad2ca865bda72a31ba2986f408dc406d61ca9faff57d8611

SHA512
36adfe9110469c2e3b164c77c7027cd3e11dbe5522e5f04611c572843cc1e8932793c17178ccd7fba47ec98251de1dc17ef5484ac0e99301834682d832aa42ba

Download Submit
\Windows\system\Kijuqyd.exe

Filesize
1.9MB

MD5
9fe1f5815a50e0d5f148582cb3c7c276

SHA1
d0c76194f9f862d93e1bd69243cf8de28e0cf01f

SHA256
56978bd53258caffae72640cc64f2efda0b397930fb9d6e56be084e1b8bc688c

SHA512
8c8d7989752855938eccb613e450e55ebee5b7b813dc16f0517b824d4ceb8d824a6bca7aa667e2f8cbdd67d97babdc8499d230acff36a2337382cc4a5848730e

Download Submit
\Windows\system\MrROSCU.exe

Filesize
1.9MB

MD5
b5d05cfd3441f054b736a67502e2d4ea

SHA1
cf12720525da81697c19e4f05ab7a936f9498d43

SHA256
7bbfeebd381c067a84df7edfafc0900c87acbd23432f6fc3cd3d63b55c098b6f

SHA512
f4afa9ba23c95e8e527555e4142110480e18c7799606c949eda37251c220dd7bd3a3d974020bdebfe6c7ad30d87683e851eccc74f8ae9968ed7ecfd7de6cc4b5

Download Submit
\Windows\system\NRqpFgP.exe

Filesize
1.9MB

MD5
184f30d9cc94aa0fa64cd27e3ef19bf2

SHA1
c7aa11d8c9ae1e1ea81405340c4edd15bee3b423

SHA256
646f4610614edf3b2122a26533b3748abe1e7f73fb35b81ac1b2a92ee79c4cfd

SHA512
e61828acecbe0960ff406575445d6e69d3f55ab0e026d582b368d07880e2eda5947e810e9f16f7a27c2f1fe5574525e1b674acb162723ae920a284598a4cd4fa

Download Submit
\Windows\system\QgUATVj.exe

Filesize
1.9MB

MD5
e868d32a561eb62eb970ffe76927026c

SHA1
9b93a061c6e9be28b3931c068f27d542bbc588bc

SHA256
c2f4e0940fbb0c3491fccde9cd7d7c5e1158ae4ab6e4eb43421cbf27ebc8aa6c

SHA512
43c67a5bbbca0634b60522cae3e7b65101ff1f1fc72aa8d78565be0560e773262b9c1210fa9830e8d550805f18c3d0683eb659758a7bea9f3ca32b95f0bb9446

Download Submit
\Windows\system\Tqniowr.exe

Filesize
1.9MB

MD5
dd0415cf27a9c9167beb3a32c3de3db6

SHA1
dffd8e8858b4d08444a9fa54587d99272163b1b7

SHA256
14d58d4ebefd0f71e10b8a33c8ea97bd530517b931a7372010a530c0b2f8ba56

SHA512
2e4f904b9ed73881092bd445128f86229b2ed0f6fa9c4e6bd4b67e8bc89f7fe56998e6b4fd6bc51e9e4b8077e572ed3d8c8788ac6306be82da4c8b52b7c6b86c

Download Submit
\Windows\system\UXWhCuV.exe

Filesize
1.9MB

MD5
92915d572773850e71c757f009a60580

SHA1
f8ae4f37e5dc900adf840133b01f49748614e246

SHA256
22c3861233fd6aae624b17f1d7b5bead70abcd4c4a943cf327ba395820bd9083

SHA512
1780372f248fa3d3ca2ec55afb4ca430459ccc5ae276ef766c020c374fdaf28a96145ee141441b146896b0525821727350fecebed8e6bfc12c93081bffffcc5a

Download Submit
\Windows\system\VQbXvkN.exe

Filesize
1.9MB

MD5
9bccc3c4d66301755c87a53097c05a6d

SHA1
01f018775cdb89ebe362f156336ec7e69b524fda

SHA256
98ac939b918e3bb5ef1037f16bfb682401183099b7f14e2fee559be6c5763496

SHA512
ee60152b125adc113868544d00c75546b9c4a4ba49e781603a65f9ecea9dd3b15a92cfdb5df3375b34b96140a479c3aa8ed80af9152745c5da352a21916e33d8

Download Submit
\Windows\system\VzvbOXS.exe

Filesize
1.9MB

MD5
22bd63086cdaeba7b239fc6fffc140e6

SHA1
cf8c6c0179a615219142ca06994fd1f57dfdec66

SHA256
83f3d10a6af7e078558dde8e5ab7b21b176b4ab794d01fdc0ace2657bd2e4010

SHA512
c6c061dd65b6eb0ac67df42fa8dba832fd93a9207078a4ef1d3207f79a677daa09310ce47c89f9fd9a6c0011e8c2b4121dc9391d2b50974c4a76b990814b12d0

Download Submit
\Windows\system\lrLAFpb.exe

Filesize
1.9MB

MD5
6f326042ff6def02d5c12e7af81f5081

SHA1
f40016c574df195153c62721aec6e2e4efd57787

SHA256
fc775f6e19bff8e5132832ffe0dbbfb4374c7cd12030eb6015c3cd495e14201c

SHA512
fe97ee516fc5027f3c237f7be540811849282ebbc467300e629734c6e1179c7ab65b92197cafbd4e218cb5caa14e703a7f983e93a9ebd18ee01ae4c8bf189d76

Download Submit
\Windows\system\lvVbShp.exe

Filesize
1.9MB

MD5
24e38ee9b1e7e81232a0e632822bc578

SHA1
76dfed11531d6cbc58d51e035fce4e4176f5935a

SHA256
a24e3a8ddf922319d7094fc2fe41474424f792f2842fdb8114b2f27439f12c8d

SHA512
b83d4acc5fce2be5d6a336a517e7d0fb4de42b67dddd9e7c20886e66803e0ae60c4b4456a94ea29d1a34a3e35e992348a2c7241aa8b7d74de07f1eb704307397

Download Submit
\Windows\system\mxFIrrR.exe

Filesize
1.9MB

MD5
3316699987d255cd67da7bc9597c12a1

SHA1
ee607c6fbe60ebda7b0258ac85f2f9c959164541

SHA256
921a9a1a211049d7be4f3dbe0fa702c7a00bdb8750d73fed891b738e7f67b1a2

SHA512
c766e40dfe9772d4a7f68adb29b51128830313d15cb90dc4efd76a57f1799b60a5000290ae293d45c470bffefdae8f0dc68acea1858e3328f74b1289e89d1e34

Download Submit
\Windows\system\pEysxFP.exe

Filesize
1.9MB

MD5
a0f0fb2ff595473d48265fcc331e9008

SHA1
268da703b7027c4330560a488205e937531038b3

SHA256
be3aeab58ee04657a92aff63b8166d747dab0c41b7a492d46f5b008f9ab947bd

SHA512
befb80b6087ea79ae9e44df38a89fa648fbf9df16b4a99bed414498b7a26c8efb7a95ed7eb6d8ecfaa574052794b2637be818f87b4130073bba7d1858efdcebc

Download Submit
\Windows\system\uwhPkNg.exe

Filesize
1.9MB

MD5
15c5df7ff5439d37b19fb48abc1d7484

SHA1
51e210e8305ac8018a92a63b2cec1a3659ed1a9c

SHA256
2104901148a4332c32d837cf4366e2c7ff7b947c4861728ae86803742d820e6f

SHA512
d46f62100fce58ea4c9abfeec269fcc3cc3070daa0867d600cb85288fda2c9c7c473d04b9f1962d412fd2afb9146f649638f121bba4913ff51186144701fc466

Download Submit
\Windows\system\wSktGcw.exe

Filesize
1.9MB

MD5
cc7608d270514c07118420cfe0f93ed7

SHA1
d0f29d81a33518237c12acfd44bdad1b6106c0a4

SHA256
4f473902360cbd9067f35353ffd73e61482fa49d779013ee6cd2cada9b7b2121

SHA512
e0fe9602238fcabeb8e468afed79e7f6608d47a59e951d77ca9563f010a9d180f7640e144119ceb9767dc1d3594193831a65d6d4845b8da773c17b50a4de0a46

Download Submit
memory/2204-67-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/2204-60-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/2204-91-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-1-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-56-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2204-58-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/2204-111-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/2204-109-0x00000000034D0000-0x00000000038C2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-7-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/2204-107-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/2204-100-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2204-104-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2204-102-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2432-103-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2436-90-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2488-105-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2548-57-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-98-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-55-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-53-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2576-59-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-101-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2656-66-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-54-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2700-76-0x00000000004B0000-0x00000000004B8000-memory.dmp

Filesize
32KB

Download
memory/2828-108-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download