xmrig | 6943b18bb0cf5af069d603876f3905c314534d271b2764442df4df2801a1df2f

Analysis

max time kernel
14s
max time network
22s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
Size

1.8MB
MD5

0a207b297e4b22fd63cd890ce830e135
SHA1

d747add8112b9ca13d318cecc07b1080f1648c18
SHA256

6943b18bb0cf5af069d603876f3905c314534d271b2764442df4df2801a1df2f
SHA512

22b93afd4880c0f24418aed96ec526fca9dc1ff4d0173955d506aec2cd76da0b8b7945e8e3f1e3987a327dbfce56b50d60dfe8ee2a3cb9531821ca2c66e15c38
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlAp:NABz

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2232-13-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2584-56-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	xmrig
behavioral1/memory/2388-64-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2076-61-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2740-53-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2380-79-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig
behavioral1/memory/328-86-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/2444-81-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2296-74-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2232	LZQWXsh.exe
2740	brgNQLe.exe
2584	qLwcuUn.exe
2076	ZaCKjVr.exe
2388	NSLVBEf.exe
2296	pdmqKJP.exe
2380	DCYzcVk.exe
2444	BQzRaRq.exe
328	OFyvwvl.exe
384	FkzgeMF.exe
1756	jXYOJgc.exe
1604	vGhcgzI.exe
2128	GvhkNfA.exe
768	XFEULUt.exe
1908	INVUnGe.exe
1744	MRhjKYX.exe
1808	TMlnGLs.exe
300	bqPXEUH.exe
1900	Ugoubmc.exe
2684	KUgLdXR.exe
1968	YIcygNY.exe
1496	FMMSpMt.exe
2932	DMBqosg.exe
792	BxGOwzy.exe
876	bmxXSAq.exe
2840	tHslZhA.exe
1852	IBZvhSU.exe
844	NaPpSGf.exe
536	ATThbaO.exe
2884	AOTpnoF.exe
2060	GIXEuDj.exe
1288	SXgXEPm.exe
1804	sarVbyp.exe
880	LgDSUws.exe
2888	WHfjjUL.exe
940	CsQfOEq.exe
1896	WcjTWxo.exe
2864	toxjOyc.exe
1860	MjGtPdw.exe
1848	UOzQaUb.exe
2012	qRPImFh.exe
2192	EHEohDH.exe
1736	cedIBuP.exe
2288	RiSLpuF.exe
1540	MojfdUj.exe
984	kxAXDdJ.exe
2900	Rtqvncx.exe
2136	HvurdYx.exe
344	nmEQEyL.exe
2588	DeZexhO.exe
2788	cpBlsVs.exe
900	oscHHdg.exe
2556	Epuyapy.exe
3060	pqLgIlj.exe
2748	qyekiJa.exe
2360	FjqeyTW.exe
2816	ObmrTJN.exe
1376	hAdDJRW.exe
2340	wqarLJS.exe
1800	Yuteqld.exe
1692	UGvvXDZ.exe
2028	WrBKicm.exe
864	lwSJiZb.exe
1616	wXdxQTf.exe

Loads dropped DLL 64 IoCs

pid	Process
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2160-0-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/files/0x000d0000000144e9-3.dat	upx
behavioral1/memory/2232-13-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/files/0x0036000000014817-18.dat	upx
behavioral1/files/0x001400000000549e-19.dat	upx
behavioral1/files/0x0008000000015023-23.dat	upx
behavioral1/files/0x0007000000015136-27.dat	upx
behavioral1/files/0x0007000000015362-35.dat	upx
behavioral1/files/0x000a0000000153cf-39.dat	upx
behavioral1/files/0x00090000000155e3-49.dat	upx
behavioral1/memory/2584-56-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	upx
behavioral1/memory/2388-64-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x0008000000015cc1-63.dat	upx
behavioral1/memory/2076-61-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2740-53-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/files/0x0006000000015cec-70.dat	upx
behavioral1/memory/2380-79-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/files/0x0036000000014983-94.dat	upx
behavioral1/files/0x0006000000015f1b-110.dat	upx
behavioral1/files/0x0006000000016277-124.dat	upx
behavioral1/files/0x0006000000016525-139.dat	upx
behavioral1/files/0x0006000000016c2e-165.dat	upx
behavioral1/files/0x0006000000016411-171.dat	upx
behavioral1/files/0x0006000000015d6e-105.dat	upx
behavioral1/files/0x0006000000016056-123.dat	upx
behavioral1/files/0x0006000000016c7a-182.dat	upx
behavioral1/files/0x0006000000016cc9-187.dat	upx
behavioral1/files/0x0006000000016c26-180.dat	upx
behavioral1/files/0x0006000000016a45-178.dat	upx
behavioral1/files/0x0006000000016597-175.dat	upx
behavioral1/files/0x00060000000160f8-120.dat	upx
behavioral1/files/0x0006000000016ce1-191.dat	upx
behavioral1/files/0x0006000000016cab-185.dat	upx
behavioral1/files/0x0006000000015d06-96.dat	upx
behavioral1/files/0x0006000000016c17-164.dat	upx
behavioral1/files/0x00060000000167ef-163.dat	upx
behavioral1/files/0x0006000000015f9e-154.dat	upx
behavioral1/files/0x0006000000015cf7-91.dat	upx
behavioral1/files/0x0006000000015d5d-103.dat	upx
behavioral1/memory/328-86-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/memory/2444-81-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/files/0x0006000000015cdb-76.dat	upx
behavioral1/memory/2296-74-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rTTYBcL.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\DjMagfi.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\DupySdm.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\lSEDTnS.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\lkFLSRv.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\ueLIzbz.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\quHwKkq.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\oscHHdg.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\CAoraDw.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\ByANnSc.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\CCouFmv.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\akDhbCo.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\LZMDDzx.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\VnkBcGa.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\YGUbdXw.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\OdKBExm.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\FqrAWZd.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\dfhRrLq.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\ePPoUDu.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\Xgptoxd.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\LlEbvlu.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\htJjEjI.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\tPkHjkV.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\jgAUmKa.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\bCeZhhK.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\fvILrLf.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\EWWKUHr.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\GLtDLdp.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\HtjTTZG.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\mKyrWdi.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\fQrhlcq.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\lxGQGGe.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\GOhbjbF.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\dKMCDtY.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\LzYrBMe.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\wwpdeRr.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\pQlUMaT.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\qojdpPw.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\YJrvsZq.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\hCHSWIh.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\MjGtPdw.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\gLrEvRs.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\LloXhqs.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\OLFaJPW.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\NfZuhCw.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\gqwRUJX.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\nnDRgCM.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\UXCXFMa.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\TuxZUco.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\oBJRAXP.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\adurcPX.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\NnkSfnV.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\uDWgpwT.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\gvbdJgM.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\FjqeyTW.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\UGDDyIF.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\JkylcxK.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\tLKSZbO.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\VbXDUra.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\jEhMFTt.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\WmUaKck.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\VJTlaUm.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\jirnJIP.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
File created	C:\Windows\System\CGtPtLX.exe	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3052	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
Token: SeDebugPrivilege	3052	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 3052	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	29
PID 2160 wrote to memory of 3052	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	29
PID 2160 wrote to memory of 3052	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	29
PID 2160 wrote to memory of 2232	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	30
PID 2160 wrote to memory of 2232	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	30
PID 2160 wrote to memory of 2232	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	30
PID 2160 wrote to memory of 2740	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2740	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2740	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2584	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	32
PID 2160 wrote to memory of 2584	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	32
PID 2160 wrote to memory of 2584	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	32
PID 2160 wrote to memory of 2076	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	33
PID 2160 wrote to memory of 2076	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	33
PID 2160 wrote to memory of 2076	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	33
PID 2160 wrote to memory of 2388	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	34
PID 2160 wrote to memory of 2388	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	34
PID 2160 wrote to memory of 2388	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	34
PID 2160 wrote to memory of 2296	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	35
PID 2160 wrote to memory of 2296	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	35
PID 2160 wrote to memory of 2296	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	35
PID 2160 wrote to memory of 2380	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	36
PID 2160 wrote to memory of 2380	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	36
PID 2160 wrote to memory of 2380	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	36
PID 2160 wrote to memory of 2444	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	37
PID 2160 wrote to memory of 2444	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	37
PID 2160 wrote to memory of 2444	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	37
PID 2160 wrote to memory of 328	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	38
PID 2160 wrote to memory of 328	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	38
PID 2160 wrote to memory of 328	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	38
PID 2160 wrote to memory of 1756	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	39
PID 2160 wrote to memory of 1756	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	39
PID 2160 wrote to memory of 1756	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	39
PID 2160 wrote to memory of 384	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	40
PID 2160 wrote to memory of 384	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	40
PID 2160 wrote to memory of 384	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	40
PID 2160 wrote to memory of 1604	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	41
PID 2160 wrote to memory of 1604	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	41
PID 2160 wrote to memory of 1604	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	41
PID 2160 wrote to memory of 2128	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	42
PID 2160 wrote to memory of 2128	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	42
PID 2160 wrote to memory of 2128	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	42
PID 2160 wrote to memory of 1744	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	43
PID 2160 wrote to memory of 1744	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	43
PID 2160 wrote to memory of 1744	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	43
PID 2160 wrote to memory of 768	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	44
PID 2160 wrote to memory of 768	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	44
PID 2160 wrote to memory of 768	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	44
PID 2160 wrote to memory of 1900	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	45
PID 2160 wrote to memory of 1900	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	45
PID 2160 wrote to memory of 1900	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	45
PID 2160 wrote to memory of 1908	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	46
PID 2160 wrote to memory of 1908	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	46
PID 2160 wrote to memory of 1908	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	46
PID 2160 wrote to memory of 1968	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	47
PID 2160 wrote to memory of 1968	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	47
PID 2160 wrote to memory of 1968	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	47
PID 2160 wrote to memory of 1808	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	48
PID 2160 wrote to memory of 1808	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	48
PID 2160 wrote to memory of 1808	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	48
PID 2160 wrote to memory of 876	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	49
PID 2160 wrote to memory of 876	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	49
PID 2160 wrote to memory of 876	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	49
PID 2160 wrote to memory of 300	2160	0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a207b297e4b22fd63cd890ce830e135_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3052
- C:\Windows\System\LZQWXsh.exe
  C:\Windows\System\LZQWXsh.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\brgNQLe.exe
  C:\Windows\System\brgNQLe.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\qLwcuUn.exe
  C:\Windows\System\qLwcuUn.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\ZaCKjVr.exe
  C:\Windows\System\ZaCKjVr.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\NSLVBEf.exe
  C:\Windows\System\NSLVBEf.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\pdmqKJP.exe
  C:\Windows\System\pdmqKJP.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\DCYzcVk.exe
  C:\Windows\System\DCYzcVk.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\BQzRaRq.exe
  C:\Windows\System\BQzRaRq.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\OFyvwvl.exe
  C:\Windows\System\OFyvwvl.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\jXYOJgc.exe
  C:\Windows\System\jXYOJgc.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\FkzgeMF.exe
  C:\Windows\System\FkzgeMF.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\vGhcgzI.exe
  C:\Windows\System\vGhcgzI.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\GvhkNfA.exe
  C:\Windows\System\GvhkNfA.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\MRhjKYX.exe
  C:\Windows\System\MRhjKYX.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\XFEULUt.exe
  C:\Windows\System\XFEULUt.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\Ugoubmc.exe
  C:\Windows\System\Ugoubmc.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\INVUnGe.exe
  C:\Windows\System\INVUnGe.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\YIcygNY.exe
  C:\Windows\System\YIcygNY.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\TMlnGLs.exe
  C:\Windows\System\TMlnGLs.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\bmxXSAq.exe
  C:\Windows\System\bmxXSAq.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\bqPXEUH.exe
  C:\Windows\System\bqPXEUH.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\tHslZhA.exe
  C:\Windows\System\tHslZhA.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\KUgLdXR.exe
  C:\Windows\System\KUgLdXR.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\IBZvhSU.exe
  C:\Windows\System\IBZvhSU.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\FMMSpMt.exe
  C:\Windows\System\FMMSpMt.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\NaPpSGf.exe
  C:\Windows\System\NaPpSGf.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\DMBqosg.exe
  C:\Windows\System\DMBqosg.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\ATThbaO.exe
  C:\Windows\System\ATThbaO.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\BxGOwzy.exe
  C:\Windows\System\BxGOwzy.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\AOTpnoF.exe
  C:\Windows\System\AOTpnoF.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\GIXEuDj.exe
  C:\Windows\System\GIXEuDj.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\LgDSUws.exe
  C:\Windows\System\LgDSUws.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\SXgXEPm.exe
  C:\Windows\System\SXgXEPm.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\WcjTWxo.exe
  C:\Windows\System\WcjTWxo.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\sarVbyp.exe
  C:\Windows\System\sarVbyp.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\MjGtPdw.exe
  C:\Windows\System\MjGtPdw.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\WHfjjUL.exe
  C:\Windows\System\WHfjjUL.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\UOzQaUb.exe
  C:\Windows\System\UOzQaUb.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\CsQfOEq.exe
  C:\Windows\System\CsQfOEq.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\Rtqvncx.exe
  C:\Windows\System\Rtqvncx.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\toxjOyc.exe
  C:\Windows\System\toxjOyc.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\HvurdYx.exe
  C:\Windows\System\HvurdYx.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\qRPImFh.exe
  C:\Windows\System\qRPImFh.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\nmEQEyL.exe
  C:\Windows\System\nmEQEyL.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\EHEohDH.exe
  C:\Windows\System\EHEohDH.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\cpBlsVs.exe
  C:\Windows\System\cpBlsVs.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\cedIBuP.exe
  C:\Windows\System\cedIBuP.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\oscHHdg.exe
  C:\Windows\System\oscHHdg.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\RiSLpuF.exe
  C:\Windows\System\RiSLpuF.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\Epuyapy.exe
  C:\Windows\System\Epuyapy.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\MojfdUj.exe
  C:\Windows\System\MojfdUj.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\pqLgIlj.exe
  C:\Windows\System\pqLgIlj.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\kxAXDdJ.exe
  C:\Windows\System\kxAXDdJ.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\qyekiJa.exe
  C:\Windows\System\qyekiJa.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\DeZexhO.exe
  C:\Windows\System\DeZexhO.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\FjqeyTW.exe
  C:\Windows\System\FjqeyTW.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\ObmrTJN.exe
  C:\Windows\System\ObmrTJN.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\hAdDJRW.exe
  C:\Windows\System\hAdDJRW.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\wqarLJS.exe
  C:\Windows\System\wqarLJS.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\Yuteqld.exe
  C:\Windows\System\Yuteqld.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\UGvvXDZ.exe
  C:\Windows\System\UGvvXDZ.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\WrBKicm.exe
  C:\Windows\System\WrBKicm.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\lwSJiZb.exe
  C:\Windows\System\lwSJiZb.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\wXdxQTf.exe
  C:\Windows\System\wXdxQTf.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\GnPgLYs.exe
  C:\Windows\System\GnPgLYs.exe
  2⤵
  PID:2836
- C:\Windows\System\XqwVlhf.exe
  C:\Windows\System\XqwVlhf.exe
  2⤵
  PID:2592
- C:\Windows\System\CAoraDw.exe
  C:\Windows\System\CAoraDw.exe
  2⤵
  PID:2080
- C:\Windows\System\wdZifvn.exe
  C:\Windows\System\wdZifvn.exe
  2⤵
  PID:2756
- C:\Windows\System\dlHgavl.exe
  C:\Windows\System\dlHgavl.exe
  2⤵
  PID:2016
- C:\Windows\System\oQHdKQU.exe
  C:\Windows\System\oQHdKQU.exe
  2⤵
  PID:1200
- C:\Windows\System\kaRliNR.exe
  C:\Windows\System\kaRliNR.exe
  2⤵
  PID:2068
- C:\Windows\System\GOhbjbF.exe
  C:\Windows\System\GOhbjbF.exe
  2⤵
  PID:2744
- C:\Windows\System\rDAuRpe.exe
  C:\Windows\System\rDAuRpe.exe
  2⤵
  PID:2696
- C:\Windows\System\IXVMjTT.exe
  C:\Windows\System\IXVMjTT.exe
  2⤵
  PID:2708
- C:\Windows\System\mgzFGkw.exe
  C:\Windows\System\mgzFGkw.exe
  2⤵
  PID:2464
- C:\Windows\System\vakqutW.exe
  C:\Windows\System\vakqutW.exe
  2⤵
  PID:1656
- C:\Windows\System\OZQcizb.exe
  C:\Windows\System\OZQcizb.exe
  2⤵
  PID:2936
- C:\Windows\System\dXhGWBs.exe
  C:\Windows\System\dXhGWBs.exe
  2⤵
  PID:1212
- C:\Windows\System\NbPlxcM.exe
  C:\Windows\System\NbPlxcM.exe
  2⤵
  PID:2540
- C:\Windows\System\FEzAjrK.exe
  C:\Windows\System\FEzAjrK.exe
  2⤵
  PID:784
- C:\Windows\System\dKMCDtY.exe
  C:\Windows\System\dKMCDtY.exe
  2⤵
  PID:964
- C:\Windows\System\kuHPkji.exe
  C:\Windows\System\kuHPkji.exe
  2⤵
  PID:2984
- C:\Windows\System\RpJBnfk.exe
  C:\Windows\System\RpJBnfk.exe
  2⤵
  PID:2512
- C:\Windows\System\ZZydcno.exe
  C:\Windows\System\ZZydcno.exe
  2⤵
  PID:1740
- C:\Windows\System\mrstTmN.exe
  C:\Windows\System\mrstTmN.exe
  2⤵
  PID:2264
- C:\Windows\System\attYMwY.exe
  C:\Windows\System\attYMwY.exe
  2⤵
  PID:2224
- C:\Windows\System\erKKVTN.exe
  C:\Windows\System\erKKVTN.exe
  2⤵
  PID:2612
- C:\Windows\System\qjYpNzP.exe
  C:\Windows\System\qjYpNzP.exe
  2⤵
  PID:2824
- C:\Windows\System\SWjKwbd.exe
  C:\Windows\System\SWjKwbd.exe
  2⤵
  PID:2620
- C:\Windows\System\EDIEUho.exe
  C:\Windows\System\EDIEUho.exe
  2⤵
  PID:2844
- C:\Windows\System\lIpwolV.exe
  C:\Windows\System\lIpwolV.exe
  2⤵
  PID:1232
- C:\Windows\System\rTTYBcL.exe
  C:\Windows\System\rTTYBcL.exe
  2⤵
  PID:1892
- C:\Windows\System\dWoeHgy.exe
  C:\Windows\System\dWoeHgy.exe
  2⤵
  PID:1116
- C:\Windows\System\ExEZspO.exe
  C:\Windows\System\ExEZspO.exe
  2⤵
  PID:2492
- C:\Windows\System\lprdRSp.exe
  C:\Windows\System\lprdRSp.exe
  2⤵
  PID:2116
- C:\Windows\System\LzYrBMe.exe
  C:\Windows\System\LzYrBMe.exe
  2⤵
  PID:1680
- C:\Windows\System\HMJfhok.exe
  C:\Windows\System\HMJfhok.exe
  2⤵
  PID:1876
- C:\Windows\System\UGDDyIF.exe
  C:\Windows\System\UGDDyIF.exe
  2⤵
  PID:2404
- C:\Windows\System\efafzSC.exe
  C:\Windows\System\efafzSC.exe
  2⤵
  PID:452
- C:\Windows\System\odTWWXQ.exe
  C:\Windows\System\odTWWXQ.exe
  2⤵
  PID:1568
- C:\Windows\System\awkzlnX.exe
  C:\Windows\System\awkzlnX.exe
  2⤵
  PID:1564
- C:\Windows\System\dNilkjb.exe
  C:\Windows\System\dNilkjb.exe
  2⤵
  PID:2184
- C:\Windows\System\CRNJBff.exe
  C:\Windows\System\CRNJBff.exe
  2⤵
  PID:1516
- C:\Windows\System\pQGADDj.exe
  C:\Windows\System\pQGADDj.exe
  2⤵
  PID:2660
- C:\Windows\System\akEhwfm.exe
  C:\Windows\System\akEhwfm.exe
  2⤵
  PID:1704
- C:\Windows\System\VnkBcGa.exe
  C:\Windows\System\VnkBcGa.exe
  2⤵
  PID:2768
- C:\Windows\System\QoAmYJy.exe
  C:\Windows\System\QoAmYJy.exe
  2⤵
  PID:2752
- C:\Windows\System\jXKuSWJ.exe
  C:\Windows\System\jXKuSWJ.exe
  2⤵
  PID:1556
- C:\Windows\System\HJyvNda.exe
  C:\Windows\System\HJyvNda.exe
  2⤵
  PID:2468
- C:\Windows\System\ksdvIAb.exe
  C:\Windows\System\ksdvIAb.exe
  2⤵
  PID:2248
- C:\Windows\System\kwumKLl.exe
  C:\Windows\System\kwumKLl.exe
  2⤵
  PID:1932
- C:\Windows\System\NfZuhCw.exe
  C:\Windows\System\NfZuhCw.exe
  2⤵
  PID:1276
- C:\Windows\System\fKjyntu.exe
  C:\Windows\System\fKjyntu.exe
  2⤵
  PID:2796
- C:\Windows\System\aXYyxNw.exe
  C:\Windows\System\aXYyxNw.exe
  2⤵
  PID:2532
- C:\Windows\System\QKvPVWf.exe
  C:\Windows\System\QKvPVWf.exe
  2⤵
  PID:320
- C:\Windows\System\gZyHNJH.exe
  C:\Windows\System\gZyHNJH.exe
  2⤵
  PID:664
- C:\Windows\System\ARPKXja.exe
  C:\Windows\System\ARPKXja.exe
  2⤵
  PID:2088
- C:\Windows\System\VflcIrZ.exe
  C:\Windows\System\VflcIrZ.exe
  2⤵
  PID:2052
- C:\Windows\System\LLXZxUq.exe
  C:\Windows\System\LLXZxUq.exe
  2⤵
  PID:1048
- C:\Windows\System\xdUYdOx.exe
  C:\Windows\System\xdUYdOx.exe
  2⤵
  PID:1948
- C:\Windows\System\aiyCHiW.exe
  C:\Windows\System\aiyCHiW.exe
  2⤵
  PID:1512
- C:\Windows\System\VbXDUra.exe
  C:\Windows\System\VbXDUra.exe
  2⤵
  PID:2672
- C:\Windows\System\StjCJdB.exe
  C:\Windows\System\StjCJdB.exe
  2⤵
  PID:1992
- C:\Windows\System\bbBVduT.exe
  C:\Windows\System\bbBVduT.exe
  2⤵
  PID:3084
- C:\Windows\System\zHdLmNN.exe
  C:\Windows\System\zHdLmNN.exe
  2⤵
  PID:3100
- C:\Windows\System\NDlBQnQ.exe
  C:\Windows\System\NDlBQnQ.exe
  2⤵
  PID:3116
- C:\Windows\System\mTXoTlM.exe
  C:\Windows\System\mTXoTlM.exe
  2⤵
  PID:3144
- C:\Windows\System\kfIMnrn.exe
  C:\Windows\System\kfIMnrn.exe
  2⤵
  PID:3160
- C:\Windows\System\owuJDNa.exe
  C:\Windows\System\owuJDNa.exe
  2⤵
  PID:3176
- C:\Windows\System\clLQBms.exe
  C:\Windows\System\clLQBms.exe
  2⤵
  PID:3192
- C:\Windows\System\KwyPxkV.exe
  C:\Windows\System\KwyPxkV.exe
  2⤵
  PID:3208
- C:\Windows\System\BKEKsem.exe
  C:\Windows\System\BKEKsem.exe
  2⤵
  PID:3224
- C:\Windows\System\KBKcqdY.exe
  C:\Windows\System\KBKcqdY.exe
  2⤵
  PID:3240
- C:\Windows\System\LawXSIU.exe
  C:\Windows\System\LawXSIU.exe
  2⤵
  PID:3260
- C:\Windows\System\EsbrWRL.exe
  C:\Windows\System\EsbrWRL.exe
  2⤵
  PID:3400
- C:\Windows\System\tJkLAPH.exe
  C:\Windows\System\tJkLAPH.exe
  2⤵
  PID:3420
- C:\Windows\System\gLrEvRs.exe
  C:\Windows\System\gLrEvRs.exe
  2⤵
  PID:3436
- C:\Windows\System\DdZjcYv.exe
  C:\Windows\System\DdZjcYv.exe
  2⤵
  PID:3452
- C:\Windows\System\QRWEeEz.exe
  C:\Windows\System\QRWEeEz.exe
  2⤵
  PID:3468
- C:\Windows\System\LZOYQEd.exe
  C:\Windows\System\LZOYQEd.exe
  2⤵
  PID:3488
- C:\Windows\System\snCauGC.exe
  C:\Windows\System\snCauGC.exe
  2⤵
  PID:3504
- C:\Windows\System\hQVMvqs.exe
  C:\Windows\System\hQVMvqs.exe
  2⤵
  PID:3520
- C:\Windows\System\JkylcxK.exe
  C:\Windows\System\JkylcxK.exe
  2⤵
  PID:3536
- C:\Windows\System\mEFBicw.exe
  C:\Windows\System\mEFBicw.exe
  2⤵
  PID:3552
- C:\Windows\System\BZHjAmc.exe
  C:\Windows\System\BZHjAmc.exe
  2⤵
  PID:3568
- C:\Windows\System\twkujDJ.exe
  C:\Windows\System\twkujDJ.exe
  2⤵
  PID:3588
- C:\Windows\System\cLwoPJg.exe
  C:\Windows\System\cLwoPJg.exe
  2⤵
  PID:3604
- C:\Windows\System\KfsHbvL.exe
  C:\Windows\System\KfsHbvL.exe
  2⤵
  PID:3620
- C:\Windows\System\yFEIxnz.exe
  C:\Windows\System\yFEIxnz.exe
  2⤵
  PID:3636
- C:\Windows\System\mSOmNLO.exe
  C:\Windows\System\mSOmNLO.exe
  2⤵
  PID:3652
- C:\Windows\System\xdNMxUH.exe
  C:\Windows\System\xdNMxUH.exe
  2⤵
  PID:3672
- C:\Windows\System\wZKxszz.exe
  C:\Windows\System\wZKxszz.exe
  2⤵
  PID:3688
- C:\Windows\System\dSPgQeP.exe
  C:\Windows\System\dSPgQeP.exe
  2⤵
  PID:3704
- C:\Windows\System\sJzdRra.exe
  C:\Windows\System\sJzdRra.exe
  2⤵
  PID:3724
- C:\Windows\System\glflgBG.exe
  C:\Windows\System\glflgBG.exe
  2⤵
  PID:3744
- C:\Windows\System\xWTyNbG.exe
  C:\Windows\System\xWTyNbG.exe
  2⤵
  PID:3760
- C:\Windows\System\jgAUmKa.exe
  C:\Windows\System\jgAUmKa.exe
  2⤵
  PID:3776
- C:\Windows\System\rqpHvDG.exe
  C:\Windows\System\rqpHvDG.exe
  2⤵
  PID:3792
- C:\Windows\System\PgKdAKA.exe
  C:\Windows\System\PgKdAKA.exe
  2⤵
  PID:3808
- C:\Windows\System\AtLPWUU.exe
  C:\Windows\System\AtLPWUU.exe
  2⤵
  PID:3824
- C:\Windows\System\SUqGVhN.exe
  C:\Windows\System\SUqGVhN.exe
  2⤵
  PID:3840
- C:\Windows\System\ruooGSz.exe
  C:\Windows\System\ruooGSz.exe
  2⤵
  PID:3856
- C:\Windows\System\ZMLuisT.exe
  C:\Windows\System\ZMLuisT.exe
  2⤵
  PID:3876
- C:\Windows\System\jtYgVrO.exe
  C:\Windows\System\jtYgVrO.exe
  2⤵
  PID:3892
- C:\Windows\System\cGHojpb.exe
  C:\Windows\System\cGHojpb.exe
  2⤵
  PID:3908
- C:\Windows\System\ZytBzAe.exe
  C:\Windows\System\ZytBzAe.exe
  2⤵
  PID:3924
- C:\Windows\System\qFjqFqT.exe
  C:\Windows\System\qFjqFqT.exe
  2⤵
  PID:3940
- C:\Windows\System\GLtDLdp.exe
  C:\Windows\System\GLtDLdp.exe
  2⤵
  PID:3956
- C:\Windows\System\HtjTTZG.exe
  C:\Windows\System\HtjTTZG.exe
  2⤵
  PID:3972
- C:\Windows\System\ByANnSc.exe
  C:\Windows\System\ByANnSc.exe
  2⤵
  PID:3988
- C:\Windows\System\CrUlton.exe
  C:\Windows\System\CrUlton.exe
  2⤵
  PID:4008
- C:\Windows\System\qvJrATd.exe
  C:\Windows\System\qvJrATd.exe
  2⤵
  PID:4024
- C:\Windows\System\HELfwKl.exe
  C:\Windows\System\HELfwKl.exe
  2⤵
  PID:4044
- C:\Windows\System\AHhhqkr.exe
  C:\Windows\System\AHhhqkr.exe
  2⤵
  PID:4064
- C:\Windows\System\KLEREYa.exe
  C:\Windows\System\KLEREYa.exe
  2⤵
  PID:4088
- C:\Windows\System\LloXhqs.exe
  C:\Windows\System\LloXhqs.exe
  2⤵
  PID:856
- C:\Windows\System\FksZyKy.exe
  C:\Windows\System\FksZyKy.exe
  2⤵
  PID:1548
- C:\Windows\System\uRIUEOX.exe
  C:\Windows\System\uRIUEOX.exe
  2⤵
  PID:3080
- C:\Windows\System\lQwdNmP.exe
  C:\Windows\System\lQwdNmP.exe
  2⤵
  PID:604
- C:\Windows\System\vSOHOJW.exe
  C:\Windows\System\vSOHOJW.exe
  2⤵
  PID:592
- C:\Windows\System\hJTOqfu.exe
  C:\Windows\System\hJTOqfu.exe
  2⤵
  PID:3056
- C:\Windows\System\qMoMYbC.exe
  C:\Windows\System\qMoMYbC.exe
  2⤵
  PID:1820
- C:\Windows\System\RuqYCTZ.exe
  C:\Windows\System\RuqYCTZ.exe
  2⤵
  PID:3156
- C:\Windows\System\yPVfMDs.exe
  C:\Windows\System\yPVfMDs.exe
  2⤵
  PID:3248
- C:\Windows\System\lvOJvkV.exe
  C:\Windows\System\lvOJvkV.exe
  2⤵
  PID:2600
- C:\Windows\System\xfjFzId.exe
  C:\Windows\System\xfjFzId.exe
  2⤵
  PID:1596
- C:\Windows\System\ycWUCpU.exe
  C:\Windows\System\ycWUCpU.exe
  2⤵
  PID:1368
- C:\Windows\System\BjscNzb.exe
  C:\Windows\System\BjscNzb.exe
  2⤵
  PID:1456
- C:\Windows\System\IZQztxt.exe
  C:\Windows\System\IZQztxt.exe
  2⤵
  PID:2640
- C:\Windows\System\oROsADE.exe
  C:\Windows\System\oROsADE.exe
  2⤵
  PID:2632
- C:\Windows\System\CCouFmv.exe
  C:\Windows\System\CCouFmv.exe
  2⤵
  PID:3092
- C:\Windows\System\GgYMOGD.exe
  C:\Windows\System\GgYMOGD.exe
  2⤵
  PID:3132
- C:\Windows\System\tLKSZbO.exe
  C:\Windows\System\tLKSZbO.exe
  2⤵
  PID:3172
- C:\Windows\System\GBjEdhZ.exe
  C:\Windows\System\GBjEdhZ.exe
  2⤵
  PID:3268
- C:\Windows\System\IGKhMAO.exe
  C:\Windows\System\IGKhMAO.exe
  2⤵
  PID:1624
- C:\Windows\System\iWcViJb.exe
  C:\Windows\System\iWcViJb.exe
  2⤵
  PID:3280
- C:\Windows\System\oRualeW.exe
  C:\Windows\System\oRualeW.exe
  2⤵
  PID:3304
- C:\Windows\System\YvxdcJS.exe
  C:\Windows\System\YvxdcJS.exe
  2⤵
  PID:3320
- C:\Windows\System\LBVMezL.exe
  C:\Windows\System\LBVMezL.exe
  2⤵
  PID:3336
- C:\Windows\System\MsdkTmx.exe
  C:\Windows\System\MsdkTmx.exe
  2⤵
  PID:2652
- C:\Windows\System\zmiJfcZ.exe
  C:\Windows\System\zmiJfcZ.exe
  2⤵
  PID:2960
- C:\Windows\System\DLmIlUq.exe
  C:\Windows\System\DLmIlUq.exe
  2⤵
  PID:3356
- C:\Windows\System\bCeZhhK.exe
  C:\Windows\System\bCeZhhK.exe
  2⤵
  PID:1424
- C:\Windows\System\dfhRrLq.exe
  C:\Windows\System\dfhRrLq.exe
  2⤵
  PID:3412
- C:\Windows\System\yKuFVYF.exe
  C:\Windows\System\yKuFVYF.exe
  2⤵
  PID:3544
- C:\Windows\System\hohJOAi.exe
  C:\Windows\System\hohJOAi.exe
  2⤵
  PID:2704
- C:\Windows\System\NXaFhXp.exe
  C:\Windows\System\NXaFhXp.exe
  2⤵
  PID:3152
- C:\Windows\System\tuJKcHu.exe
  C:\Windows\System\tuJKcHu.exe
  2⤵
  PID:2008
- C:\Windows\System\ULeYeSu.exe
  C:\Windows\System\ULeYeSu.exe
  2⤵
  PID:2212
- C:\Windows\System\QDnrxOn.exe
  C:\Windows\System\QDnrxOn.exe
  2⤵
  PID:3788
- C:\Windows\System\gyxEuvg.exe
  C:\Windows\System\gyxEuvg.exe
  2⤵
  PID:3852
- C:\Windows\System\egBwrIE.exe
  C:\Windows\System\egBwrIE.exe
  2⤵
  PID:3920
- C:\Windows\System\gzVluai.exe
  C:\Windows\System\gzVluai.exe
  2⤵
  PID:3984
- C:\Windows\System\NVnMrzC.exe
  C:\Windows\System\NVnMrzC.exe
  2⤵
  PID:4056
- C:\Windows\System\jugTnFT.exe
  C:\Windows\System\jugTnFT.exe
  2⤵
  PID:2432
- C:\Windows\System\crajCSy.exe
  C:\Windows\System\crajCSy.exe
  2⤵
  PID:1672
- C:\Windows\System\clbzomf.exe
  C:\Windows\System\clbzomf.exe
  2⤵
  PID:3216
- C:\Windows\System\tjwrywv.exe
  C:\Windows\System\tjwrywv.exe
  2⤵
  PID:1920
- C:\Windows\System\guQTzkP.exe
  C:\Windows\System\guQTzkP.exe
  2⤵
  PID:2736
- C:\Windows\System\inOZeqz.exe
  C:\Windows\System\inOZeqz.exe
  2⤵
  PID:3408
- C:\Windows\System\KKfMjQq.exe
  C:\Windows\System\KKfMjQq.exe
  2⤵
  PID:3512
- C:\Windows\System\FNyanZr.exe
  C:\Windows\System\FNyanZr.exe
  2⤵
  PID:3580
- C:\Windows\System\NxyxRfy.exe
  C:\Windows\System\NxyxRfy.exe
  2⤵
  PID:3644
- C:\Windows\System\KVlgGZe.exe
  C:\Windows\System\KVlgGZe.exe
  2⤵
  PID:3464
- C:\Windows\System\hvwlNDI.exe
  C:\Windows\System\hvwlNDI.exe
  2⤵
  PID:2524
- C:\Windows\System\YGUbdXw.exe
  C:\Windows\System\YGUbdXw.exe
  2⤵
  PID:3564
- C:\Windows\System\uyPjbNh.exe
  C:\Windows\System\uyPjbNh.exe
  2⤵
  PID:3716
- C:\Windows\System\ldmVKuO.exe
  C:\Windows\System\ldmVKuO.exe
  2⤵
  PID:3696
- C:\Windows\System\DlFSkBk.exe
  C:\Windows\System\DlFSkBk.exe
  2⤵
  PID:3768
- C:\Windows\System\gqwRUJX.exe
  C:\Windows\System\gqwRUJX.exe
  2⤵
  PID:3836
- C:\Windows\System\JnEcSJk.exe
  C:\Windows\System\JnEcSJk.exe
  2⤵
  PID:3900
- C:\Windows\System\cOpPmts.exe
  C:\Windows\System\cOpPmts.exe
  2⤵
  PID:3996
- C:\Windows\System\qqiwnvD.exe
  C:\Windows\System\qqiwnvD.exe
  2⤵
  PID:3292
- C:\Windows\System\ZbjjlyK.exe
  C:\Windows\System\ZbjjlyK.exe
  2⤵
  PID:4040
- C:\Windows\System\WaNLWBo.exe
  C:\Windows\System\WaNLWBo.exe
  2⤵
  PID:3668
- C:\Windows\System\wqwdgBE.exe
  C:\Windows\System\wqwdgBE.exe
  2⤵
  PID:4036
- C:\Windows\System\gHaxXZh.exe
  C:\Windows\System\gHaxXZh.exe
  2⤵
  PID:2084
- C:\Windows\System\vQpOZMa.exe
  C:\Windows\System\vQpOZMa.exe
  2⤵
  PID:1600
- C:\Windows\System\HiVmXWU.exe
  C:\Windows\System\HiVmXWU.exe
  2⤵
  PID:3416
- C:\Windows\System\jlhepIJ.exe
  C:\Windows\System\jlhepIJ.exe
  2⤵
  PID:2624
- C:\Windows\System\NpycHrv.exe
  C:\Windows\System\NpycHrv.exe
  2⤵
  PID:2140
- C:\Windows\System\HwqbGjB.exe
  C:\Windows\System\HwqbGjB.exe
  2⤵
  PID:2776
- C:\Windows\System\cvgITJr.exe
  C:\Windows\System\cvgITJr.exe
  2⤵
  PID:3112
- C:\Windows\System\ZutWpmq.exe
  C:\Windows\System\ZutWpmq.exe
  2⤵
  PID:2656
- C:\Windows\System\DJmEhFf.exe
  C:\Windows\System\DJmEhFf.exe
  2⤵
  PID:3756
- C:\Windows\System\zyDoYDq.exe
  C:\Windows\System\zyDoYDq.exe
  2⤵
  PID:2268
- C:\Windows\System\GIVOYHW.exe
  C:\Windows\System\GIVOYHW.exe
  2⤵
  PID:2920
- C:\Windows\System\lGobCLk.exe
  C:\Windows\System\lGobCLk.exe
  2⤵
  PID:2724
- C:\Windows\System\THinYiC.exe
  C:\Windows\System\THinYiC.exe
  2⤵
  PID:3204
- C:\Windows\System\zkJgJkV.exe
  C:\Windows\System\zkJgJkV.exe
  2⤵
  PID:3352
- C:\Windows\System\PgjiWeH.exe
  C:\Windows\System\PgjiWeH.exe
  2⤵
  PID:3980
- C:\Windows\System\WuUyCRp.exe
  C:\Windows\System\WuUyCRp.exe
  2⤵
  PID:3312
- C:\Windows\System\VbtaOHe.exe
  C:\Windows\System\VbtaOHe.exe
  2⤵
  PID:4104
- C:\Windows\System\ZOrOore.exe
  C:\Windows\System\ZOrOore.exe
  2⤵
  PID:4120
- C:\Windows\System\NbucEXI.exe
  C:\Windows\System\NbucEXI.exe
  2⤵
  PID:4216
- C:\Windows\System\hqCSnvQ.exe
  C:\Windows\System\hqCSnvQ.exe
  2⤵
  PID:4232
- C:\Windows\System\xstXwdg.exe
  C:\Windows\System\xstXwdg.exe
  2⤵
  PID:4248
- C:\Windows\System\ZteljvP.exe
  C:\Windows\System\ZteljvP.exe
  2⤵
  PID:4264
- C:\Windows\System\jwxhlqP.exe
  C:\Windows\System\jwxhlqP.exe
  2⤵
  PID:4280
- C:\Windows\System\ptXEhWy.exe
  C:\Windows\System\ptXEhWy.exe
  2⤵
  PID:4296
- C:\Windows\System\XlUVoZp.exe
  C:\Windows\System\XlUVoZp.exe
  2⤵
  PID:4312
- C:\Windows\System\xLqXDOt.exe
  C:\Windows\System\xLqXDOt.exe
  2⤵
  PID:4328
- C:\Windows\System\OdKBExm.exe
  C:\Windows\System\OdKBExm.exe
  2⤵
  PID:4344
- C:\Windows\System\IkdfSgM.exe
  C:\Windows\System\IkdfSgM.exe
  2⤵
  PID:4368
- C:\Windows\System\CUxXQdA.exe
  C:\Windows\System\CUxXQdA.exe
  2⤵
  PID:4388
- C:\Windows\System\UtOzhvW.exe
  C:\Windows\System\UtOzhvW.exe
  2⤵
  PID:4412
- C:\Windows\System\HcVzrmF.exe
  C:\Windows\System\HcVzrmF.exe
  2⤵
  PID:4428
- C:\Windows\System\DjMagfi.exe
  C:\Windows\System\DjMagfi.exe
  2⤵
  PID:4444
- C:\Windows\System\GaHqfAI.exe
  C:\Windows\System\GaHqfAI.exe
  2⤵
  PID:4460
- C:\Windows\System\jDVfdjt.exe
  C:\Windows\System\jDVfdjt.exe
  2⤵
  PID:4476
- C:\Windows\System\wwpdeRr.exe
  C:\Windows\System\wwpdeRr.exe
  2⤵
  PID:4492
- C:\Windows\System\hjXKRpE.exe
  C:\Windows\System\hjXKRpE.exe
  2⤵
  PID:4512
- C:\Windows\System\uDWgpwT.exe
  C:\Windows\System\uDWgpwT.exe
  2⤵
  PID:4528
- C:\Windows\System\rmYpOkt.exe
  C:\Windows\System\rmYpOkt.exe
  2⤵
  PID:4544
- C:\Windows\System\NFDGcTs.exe
  C:\Windows\System\NFDGcTs.exe
  2⤵
  PID:4660
- C:\Windows\System\mnnwkRk.exe
  C:\Windows\System\mnnwkRk.exe
  2⤵
  PID:4688
- C:\Windows\System\GGtYCgc.exe
  C:\Windows\System\GGtYCgc.exe
  2⤵
  PID:4708
- C:\Windows\System\sTwpKvh.exe
  C:\Windows\System\sTwpKvh.exe
  2⤵
  PID:4724
- C:\Windows\System\INqtGTB.exe
  C:\Windows\System\INqtGTB.exe
  2⤵
  PID:4740
- C:\Windows\System\lSEDTnS.exe
  C:\Windows\System\lSEDTnS.exe
  2⤵
  PID:4756
- C:\Windows\System\liDZSHG.exe
  C:\Windows\System\liDZSHG.exe
  2⤵
  PID:4772
- C:\Windows\System\TSHzlHF.exe
  C:\Windows\System\TSHzlHF.exe
  2⤵
  PID:4788
- C:\Windows\System\ysmKwJw.exe
  C:\Windows\System\ysmKwJw.exe
  2⤵
  PID:4804
- C:\Windows\System\PvabjGC.exe
  C:\Windows\System\PvabjGC.exe
  2⤵
  PID:4868
- C:\Windows\System\CUrtMUX.exe
  C:\Windows\System\CUrtMUX.exe
  2⤵
  PID:4892
- C:\Windows\System\ePPoUDu.exe
  C:\Windows\System\ePPoUDu.exe
  2⤵
  PID:4908
- C:\Windows\System\GClByJz.exe
  C:\Windows\System\GClByJz.exe
  2⤵
  PID:4924
- C:\Windows\System\dhwDFiA.exe
  C:\Windows\System\dhwDFiA.exe
  2⤵
  PID:4940
- C:\Windows\System\PUpnSpV.exe
  C:\Windows\System\PUpnSpV.exe
  2⤵
  PID:4956
- C:\Windows\System\VqdTjKq.exe
  C:\Windows\System\VqdTjKq.exe
  2⤵
  PID:4972
- C:\Windows\System\PsQOcJG.exe
  C:\Windows\System\PsQOcJG.exe
  2⤵
  PID:4988
- C:\Windows\System\yfwlrTU.exe
  C:\Windows\System\yfwlrTU.exe
  2⤵
  PID:5004
- C:\Windows\System\CEoysbI.exe
  C:\Windows\System\CEoysbI.exe
  2⤵
  PID:5020
- C:\Windows\System\fhbkZiO.exe
  C:\Windows\System\fhbkZiO.exe
  2⤵
  PID:5036
- C:\Windows\System\XMyQoWY.exe
  C:\Windows\System\XMyQoWY.exe
  2⤵
  PID:5052
- C:\Windows\System\bfkthkG.exe
  C:\Windows\System\bfkthkG.exe
  2⤵
  PID:5068
- C:\Windows\System\oNtVoSn.exe
  C:\Windows\System\oNtVoSn.exe
  2⤵
  PID:5088
- C:\Windows\System\fvILrLf.exe
  C:\Windows\System\fvILrLf.exe
  2⤵
  PID:5104
- C:\Windows\System\LqZSFUl.exe
  C:\Windows\System\LqZSFUl.exe
  2⤵
  PID:1472
- C:\Windows\System\xQyFdDo.exe
  C:\Windows\System\xQyFdDo.exe
  2⤵
  PID:3684
- C:\Windows\System\nnDRgCM.exe
  C:\Windows\System\nnDRgCM.exe
  2⤵
  PID:3732
- C:\Windows\System\lkFLSRv.exe
  C:\Windows\System\lkFLSRv.exe
  2⤵
  PID:3500
- C:\Windows\System\czXMzNt.exe
  C:\Windows\System\czXMzNt.exe
  2⤵
  PID:4084
- C:\Windows\System\LFIuQhx.exe
  C:\Windows\System\LFIuQhx.exe
  2⤵
  PID:3820
- C:\Windows\System\tFrGcFi.exe
  C:\Windows\System\tFrGcFi.exe
  2⤵
  PID:4100
- C:\Windows\System\lIugKCc.exe
  C:\Windows\System\lIugKCc.exe
  2⤵
  PID:3460
- C:\Windows\System\UPyhJOo.exe
  C:\Windows\System\UPyhJOo.exe
  2⤵
  PID:3660
- C:\Windows\System\SthgBAt.exe
  C:\Windows\System\SthgBAt.exe
  2⤵
  PID:3968
- C:\Windows\System\ueLIzbz.exe
  C:\Windows\System\ueLIzbz.exe
  2⤵
  PID:3964
- C:\Windows\System\vgqbGcr.exe
  C:\Windows\System\vgqbGcr.exe
  2⤵
  PID:3932
- C:\Windows\System\PBArPTK.exe
  C:\Windows\System\PBArPTK.exe
  2⤵
  PID:1476
- C:\Windows\System\oRxNzKs.exe
  C:\Windows\System\oRxNzKs.exe
  2⤵
  PID:3480
- C:\Windows\System\EqKBfNW.exe
  C:\Windows\System\EqKBfNW.exe
  2⤵
  PID:2228
- C:\Windows\System\mFZhKLp.exe
  C:\Windows\System\mFZhKLp.exe
  2⤵
  PID:4144
- C:\Windows\System\dIbjBne.exe
  C:\Windows\System\dIbjBne.exe
  2⤵
  PID:4156
- C:\Windows\System\WbkvdjV.exe
  C:\Windows\System\WbkvdjV.exe
  2⤵
  PID:4172
- C:\Windows\System\DupySdm.exe
  C:\Windows\System\DupySdm.exe
  2⤵
  PID:4272
- C:\Windows\System\edJYmcL.exe
  C:\Windows\System\edJYmcL.exe
  2⤵
  PID:4436
- C:\Windows\System\ziYlgRb.exe
  C:\Windows\System\ziYlgRb.exe
  2⤵
  PID:4288
- C:\Windows\System\gcPywWc.exe
  C:\Windows\System\gcPywWc.exe
  2⤵
  PID:4364
- C:\Windows\System\dlAfAQw.exe
  C:\Windows\System\dlAfAQw.exe
  2⤵
  PID:4376
- C:\Windows\System\dWCVJUY.exe
  C:\Windows\System\dWCVJUY.exe
  2⤵
  PID:4472
- C:\Windows\System\DPFORbR.exe
  C:\Windows\System\DPFORbR.exe
  2⤵
  PID:2812
- C:\Windows\System\AOLudyz.exe
  C:\Windows\System\AOLudyz.exe
  2⤵
  PID:4484
- C:\Windows\System\UDFKdnz.exe
  C:\Windows\System\UDFKdnz.exe
  2⤵
  PID:2252
- C:\Windows\System\RJIAboj.exe
  C:\Windows\System\RJIAboj.exe
  2⤵
  PID:4564
- C:\Windows\System\TDEGODv.exe
  C:\Windows\System\TDEGODv.exe
  2⤵
  PID:4572
- C:\Windows\System\SpmAjMz.exe
  C:\Windows\System\SpmAjMz.exe
  2⤵
  PID:4596
- C:\Windows\System\sFwApSR.exe
  C:\Windows\System\sFwApSR.exe
  2⤵
  PID:1608
- C:\Windows\System\idYrHYC.exe
  C:\Windows\System\idYrHYC.exe
  2⤵
  PID:4616
- C:\Windows\System\guyngJU.exe
  C:\Windows\System\guyngJU.exe
  2⤵
  PID:1748
- C:\Windows\System\suHfNIP.exe
  C:\Windows\System\suHfNIP.exe
  2⤵
  PID:4640
- C:\Windows\System\zuPwgPg.exe
  C:\Windows\System\zuPwgPg.exe
  2⤵
  PID:4668
- C:\Windows\System\kcZguqL.exe
  C:\Windows\System\kcZguqL.exe
  2⤵
  PID:4716
- C:\Windows\System\OkBYwsW.exe
  C:\Windows\System\OkBYwsW.exe
  2⤵
  PID:4752
- C:\Windows\System\OirDGtT.exe
  C:\Windows\System\OirDGtT.exe
  2⤵
  PID:4732
- C:\Windows\System\LmpoZmN.exe
  C:\Windows\System\LmpoZmN.exe
  2⤵
  PID:1964
- C:\Windows\System\TmPUzQE.exe
  C:\Windows\System\TmPUzQE.exe
  2⤵
  PID:704
- C:\Windows\System\bpgqZmx.exe
  C:\Windows\System\bpgqZmx.exe
  2⤵
  PID:1936
- C:\Windows\System\wBQBTvh.exe
  C:\Windows\System\wBQBTvh.exe
  2⤵
  PID:4840
- C:\Windows\System\uavUCxr.exe
  C:\Windows\System\uavUCxr.exe
  2⤵
  PID:4860
- C:\Windows\System\OYyyWsN.exe
  C:\Windows\System\OYyyWsN.exe
  2⤵
  PID:4876
- C:\Windows\System\srROaid.exe
  C:\Windows\System\srROaid.exe
  2⤵
  PID:4936
- C:\Windows\System\fSgAAzh.exe
  C:\Windows\System\fSgAAzh.exe
  2⤵
  PID:4916
- C:\Windows\System\ujMnlAC.exe
  C:\Windows\System\ujMnlAC.exe
  2⤵
  PID:5080
- C:\Windows\System\ndMJQdr.exe
  C:\Windows\System\ndMJQdr.exe
  2⤵
  PID:5028
- C:\Windows\System\UXCXFMa.exe
  C:\Windows\System\UXCXFMa.exe
  2⤵
  PID:3576
- C:\Windows\System\jeSkqPH.exe
  C:\Windows\System\jeSkqPH.exe
  2⤵
  PID:2096
- C:\Windows\System\DsSYEKn.exe
  C:\Windows\System\DsSYEKn.exe
  2⤵
  PID:3740
- C:\Windows\System\uIUKWXs.exe
  C:\Windows\System\uIUKWXs.exe
  2⤵
  PID:3332
- C:\Windows\System\udZgFPN.exe
  C:\Windows\System\udZgFPN.exe
  2⤵
  PID:3124
- C:\Windows\System\OlyQfpb.exe
  C:\Windows\System\OlyQfpb.exe
  2⤵
  PID:4136
- C:\Windows\System\gvbdJgM.exe
  C:\Windows\System\gvbdJgM.exe
  2⤵
  PID:3936
- C:\Windows\System\IHJCwwn.exe
  C:\Windows\System\IHJCwwn.exe
  2⤵
  PID:2820
- C:\Windows\System\prLmYno.exe
  C:\Windows\System\prLmYno.exe
  2⤵
  PID:4032
- C:\Windows\System\mzBuiEo.exe
  C:\Windows\System\mzBuiEo.exe
  2⤵
  PID:1864
- C:\Windows\System\nHCszQJ.exe
  C:\Windows\System\nHCszQJ.exe
  2⤵
  PID:2548
- C:\Windows\System\IifTvAn.exe
  C:\Windows\System\IifTvAn.exe
  2⤵
  PID:4180
- C:\Windows\System\UTgBzau.exe
  C:\Windows\System\UTgBzau.exe
  2⤵
  PID:4200
- C:\Windows\System\HgIoGZJ.exe
  C:\Windows\System\HgIoGZJ.exe
  2⤵
  PID:1520
- C:\Windows\System\qHwqHlV.exe
  C:\Windows\System\qHwqHlV.exe
  2⤵
  PID:4148
- C:\Windows\System\xFukTwd.exe
  C:\Windows\System\xFukTwd.exe
  2⤵
  PID:4244
- C:\Windows\System\EnbCInW.exe
  C:\Windows\System\EnbCInW.exe
  2⤵
  PID:4224
- C:\Windows\System\CkxaEiD.exe
  C:\Windows\System\CkxaEiD.exe
  2⤵
  PID:4352
- C:\Windows\System\OjmWxvM.exe
  C:\Windows\System\OjmWxvM.exe
  2⤵
  PID:4400
- C:\Windows\System\aalczGa.exe
  C:\Windows\System\aalczGa.exe
  2⤵
  PID:4508
- C:\Windows\System\TuxZUco.exe
  C:\Windows\System\TuxZUco.exe
  2⤵
  PID:1560
- C:\Windows\System\lGNoqhx.exe
  C:\Windows\System\lGNoqhx.exe
  2⤵
  PID:4588
- C:\Windows\System\wbNgnfU.exe
  C:\Windows\System\wbNgnfU.exe
  2⤵
  PID:4612
- C:\Windows\System\oQsqSzW.exe
  C:\Windows\System\oQsqSzW.exe
  2⤵
  PID:4620
- C:\Windows\System\ELeQeOo.exe
  C:\Windows\System\ELeQeOo.exe
  2⤵
  PID:688
- C:\Windows\System\CStCCWK.exe
  C:\Windows\System\CStCCWK.exe
  2⤵
  PID:4648
- C:\Windows\System\yYORQbA.exe
  C:\Windows\System\yYORQbA.exe
  2⤵
  PID:4696
- C:\Windows\System\XAySwJT.exe
  C:\Windows\System\XAySwJT.exe
  2⤵
  PID:4796
- C:\Windows\System\PATNMQH.exe
  C:\Windows\System\PATNMQH.exe
  2⤵
  PID:2560
- C:\Windows\System\UhVNzbL.exe
  C:\Windows\System\UhVNzbL.exe
  2⤵
  PID:4736
- C:\Windows\System\YUfPKRT.exe
  C:\Windows\System\YUfPKRT.exe
  2⤵
  PID:4852
- C:\Windows\System\qrXXSgx.exe
  C:\Windows\System\qrXXSgx.exe
  2⤵
  PID:4904
- C:\Windows\System\EFIxweK.exe
  C:\Windows\System\EFIxweK.exe
  2⤵
  PID:5096
- C:\Windows\System\ZDItoer.exe
  C:\Windows\System\ZDItoer.exe
  2⤵
  PID:4880
- C:\Windows\System\bCOUuNf.exe
  C:\Windows\System\bCOUuNf.exe
  2⤵
  PID:5012
- C:\Windows\System\ijSWcOF.exe
  C:\Windows\System\ijSWcOF.exe
  2⤵
  PID:3712
- C:\Windows\System\hhFWtzE.exe
  C:\Windows\System\hhFWtzE.exe
  2⤵
  PID:3632
- C:\Windows\System\tfmfDtl.exe
  C:\Windows\System\tfmfDtl.exe
  2⤵
  PID:4076
- C:\Windows\System\nwkntzi.exe
  C:\Windows\System\nwkntzi.exe
  2⤵
  PID:3484
- C:\Windows\System\OLFaJPW.exe
  C:\Windows\System\OLFaJPW.exe
  2⤵
  PID:4116
- C:\Windows\System\AOnBFTD.exe
  C:\Windows\System\AOnBFTD.exe
  2⤵
  PID:4188
- C:\Windows\System\quHwKkq.exe
  C:\Windows\System\quHwKkq.exe
  2⤵
  PID:4304
- C:\Windows\System\VJTlaUm.exe
  C:\Windows\System\VJTlaUm.exe
  2⤵
  PID:4308
- C:\Windows\System\oBJRAXP.exe
  C:\Windows\System\oBJRAXP.exe
  2⤵
  PID:4356
- C:\Windows\System\gwCGCHt.exe
  C:\Windows\System\gwCGCHt.exe
  2⤵
  PID:4504
- C:\Windows\System\NyGWwju.exe
  C:\Windows\System\NyGWwju.exe
  2⤵
  PID:808
- C:\Windows\System\SwgkkwA.exe
  C:\Windows\System\SwgkkwA.exe
  2⤵
  PID:4556
- C:\Windows\System\BNQtZUm.exe
  C:\Windows\System\BNQtZUm.exe
  2⤵
  PID:2972
- C:\Windows\System\jBpQJHv.exe
  C:\Windows\System\jBpQJHv.exe
  2⤵
  PID:1136
- C:\Windows\System\czSfoNf.exe
  C:\Windows\System\czSfoNf.exe
  2⤵
  PID:4656
- C:\Windows\System\JrqsUFP.exe
  C:\Windows\System\JrqsUFP.exe
  2⤵
  PID:2576
- C:\Windows\System\pQlUMaT.exe
  C:\Windows\System\pQlUMaT.exe
  2⤵
  PID:4768
- C:\Windows\System\TndDcYA.exe
  C:\Windows\System\TndDcYA.exe
  2⤵
  PID:4836
- C:\Windows\System\wpGJVAd.exe
  C:\Windows\System\wpGJVAd.exe
  2⤵
  PID:1972
- C:\Windows\System\XcFMSsO.exe
  C:\Windows\System\XcFMSsO.exe
  2⤵
  PID:4932
- C:\Windows\System\lLBKGTn.exe
  C:\Windows\System\lLBKGTn.exe
  2⤵
  PID:5044
- C:\Windows\System\DpLrCXG.exe
  C:\Windows\System\DpLrCXG.exe
  2⤵
  PID:3428
- C:\Windows\System\GuaFviF.exe
  C:\Windows\System\GuaFviF.exe
  2⤵
  PID:3848
- C:\Windows\System\TSEicAi.exe
  C:\Windows\System\TSEicAi.exe
  2⤵
  PID:1452
- C:\Windows\System\urLPESc.exe
  C:\Windows\System\urLPESc.exe
  2⤵
  PID:2832
- C:\Windows\System\wvZPrRj.exe
  C:\Windows\System\wvZPrRj.exe
  2⤵
  PID:4196
- C:\Windows\System\ySaSYap.exe
  C:\Windows\System\ySaSYap.exe
  2⤵
  PID:4228
- C:\Windows\System\KpMMOOt.exe
  C:\Windows\System\KpMMOOt.exe
  2⤵
  PID:4408
- C:\Windows\System\zVPQphh.exe
  C:\Windows\System\zVPQphh.exe
  2⤵
  PID:4540
- C:\Windows\System\EitOJLX.exe
  C:\Windows\System\EitOJLX.exe
  2⤵
  PID:4608
- C:\Windows\System\xLCZKxC.exe
  C:\Windows\System\xLCZKxC.exe
  2⤵
  PID:4684
- C:\Windows\System\BMWczAk.exe
  C:\Windows\System\BMWczAk.exe
  2⤵
  PID:5116
- C:\Windows\System\RjmjRHv.exe
  C:\Windows\System\RjmjRHv.exe
  2⤵
  PID:336
- C:\Windows\System\BehnZVl.exe
  C:\Windows\System\BehnZVl.exe
  2⤵
  PID:3868
- C:\Windows\System\DKSSgux.exe
  C:\Windows\System\DKSSgux.exe
  2⤵
  PID:4848
- C:\Windows\System\MmMHsUB.exe
  C:\Windows\System\MmMHsUB.exe
  2⤵
  PID:4784
- C:\Windows\System\opjNtNl.exe
  C:\Windows\System\opjNtNl.exe
  2⤵
  PID:1636
- C:\Windows\System\ljFMAYh.exe
  C:\Windows\System\ljFMAYh.exe
  2⤵
  PID:3532
- C:\Windows\System\yDjBWaa.exe
  C:\Windows\System\yDjBWaa.exe
  2⤵
  PID:4336
- C:\Windows\System\BDFrlMi.exe
  C:\Windows\System\BDFrlMi.exe
  2⤵
  PID:2472
- C:\Windows\System\AeXWLji.exe
  C:\Windows\System\AeXWLji.exe
  2⤵
  PID:4952
- C:\Windows\System\ENPJLke.exe
  C:\Windows\System\ENPJLke.exe
  2⤵
  PID:4820
- C:\Windows\System\cJTFCeU.exe
  C:\Windows\System\cJTFCeU.exe
  2⤵
  PID:4208
- C:\Windows\System\zHMaSeu.exe
  C:\Windows\System\zHMaSeu.exe
  2⤵
  PID:5132
- C:\Windows\System\pHHuSDz.exe
  C:\Windows\System\pHHuSDz.exe
  2⤵
  PID:5148
- C:\Windows\System\wBztaEM.exe
  C:\Windows\System\wBztaEM.exe
  2⤵
  PID:5164
- C:\Windows\System\pLVebeU.exe
  C:\Windows\System\pLVebeU.exe
  2⤵
  PID:5180
- C:\Windows\System\aUXdFmP.exe
  C:\Windows\System\aUXdFmP.exe
  2⤵
  PID:5196
- C:\Windows\System\SnJYJRX.exe
  C:\Windows\System\SnJYJRX.exe
  2⤵
  PID:5212
- C:\Windows\System\yACmakB.exe
  C:\Windows\System\yACmakB.exe
  2⤵
  PID:5228
- C:\Windows\System\fnsnTPy.exe
  C:\Windows\System\fnsnTPy.exe
  2⤵
  PID:5248
- C:\Windows\System\lgSxXWI.exe
  C:\Windows\System\lgSxXWI.exe
  2⤵
  PID:5264
- C:\Windows\System\Mdxvhrh.exe
  C:\Windows\System\Mdxvhrh.exe
  2⤵
  PID:5280
- C:\Windows\System\eIUMmcB.exe
  C:\Windows\System\eIUMmcB.exe
  2⤵
  PID:5296
- C:\Windows\System\pCFUExk.exe
  C:\Windows\System\pCFUExk.exe
  2⤵
  PID:5312
- C:\Windows\System\ESXEMBl.exe
  C:\Windows\System\ESXEMBl.exe
  2⤵
  PID:5328
- C:\Windows\System\RWqRoDc.exe
  C:\Windows\System\RWqRoDc.exe
  2⤵
  PID:5352
- C:\Windows\System\exuqOiW.exe
  C:\Windows\System\exuqOiW.exe
  2⤵
  PID:5372
- C:\Windows\System\CeuHWPL.exe
  C:\Windows\System\CeuHWPL.exe
  2⤵
  PID:5388
- C:\Windows\System\kEfUfZb.exe
  C:\Windows\System\kEfUfZb.exe
  2⤵
  PID:5404
- C:\Windows\System\TlEnRAl.exe
  C:\Windows\System\TlEnRAl.exe
  2⤵
  PID:5420
- C:\Windows\System\cDoEubd.exe
  C:\Windows\System\cDoEubd.exe
  2⤵
  PID:5436
- C:\Windows\System\AhAqJWQ.exe
  C:\Windows\System\AhAqJWQ.exe
  2⤵
  PID:5460
- C:\Windows\System\oSmLgLT.exe
  C:\Windows\System\oSmLgLT.exe
  2⤵
  PID:5476
- C:\Windows\System\hsDXMAO.exe
  C:\Windows\System\hsDXMAO.exe
  2⤵
  PID:5492
- C:\Windows\System\dxrbgeg.exe
  C:\Windows\System\dxrbgeg.exe
  2⤵
  PID:5508
- C:\Windows\System\PXfuuKF.exe
  C:\Windows\System\PXfuuKF.exe
  2⤵
  PID:5524
- C:\Windows\System\pxsqbPC.exe
  C:\Windows\System\pxsqbPC.exe
  2⤵
  PID:5544
- C:\Windows\System\hViANRs.exe
  C:\Windows\System\hViANRs.exe
  2⤵
  PID:5572
- C:\Windows\System\WiQOAtE.exe
  C:\Windows\System\WiQOAtE.exe
  2⤵
  PID:5588
- C:\Windows\System\vVPataM.exe
  C:\Windows\System\vVPataM.exe
  2⤵
  PID:5604
- C:\Windows\System\sbopenR.exe
  C:\Windows\System\sbopenR.exe
  2⤵
  PID:5620
- C:\Windows\System\CFXRCyC.exe
  C:\Windows\System\CFXRCyC.exe
  2⤵
  PID:5636
- C:\Windows\System\DXBijiu.exe
  C:\Windows\System\DXBijiu.exe
  2⤵
  PID:5652
- C:\Windows\System\dEgCUBQ.exe
  C:\Windows\System\dEgCUBQ.exe
  2⤵
  PID:5668
- C:\Windows\System\GtDwYCK.exe
  C:\Windows\System\GtDwYCK.exe
  2⤵
  PID:5684
- C:\Windows\System\lxGQGGe.exe
  C:\Windows\System\lxGQGGe.exe
  2⤵
  PID:5700
- C:\Windows\System\adurcPX.exe
  C:\Windows\System\adurcPX.exe
  2⤵
  PID:5716
- C:\Windows\System\fLpfYnh.exe
  C:\Windows\System\fLpfYnh.exe
  2⤵
  PID:5736
- C:\Windows\System\oQqaMVn.exe
  C:\Windows\System\oQqaMVn.exe
  2⤵
  PID:5752
- C:\Windows\System\RmaoXOi.exe
  C:\Windows\System\RmaoXOi.exe
  2⤵
  PID:5768
- C:\Windows\System\EBZuloQ.exe
  C:\Windows\System\EBZuloQ.exe
  2⤵
  PID:5784
- C:\Windows\System\btKOsaU.exe
  C:\Windows\System\btKOsaU.exe
  2⤵
  PID:5800
- C:\Windows\System\jEhMFTt.exe
  C:\Windows\System\jEhMFTt.exe
  2⤵
  PID:5816
- C:\Windows\System\sgsRFVu.exe
  C:\Windows\System\sgsRFVu.exe
  2⤵
  PID:5832
- C:\Windows\System\bOMGRjX.exe
  C:\Windows\System\bOMGRjX.exe
  2⤵
  PID:5852
- C:\Windows\System\PxIYLhb.exe
  C:\Windows\System\PxIYLhb.exe
  2⤵
  PID:5872
- C:\Windows\System\JeauuWl.exe
  C:\Windows\System\JeauuWl.exe
  2⤵
  PID:5888
- C:\Windows\System\WdhzGEQ.exe
  C:\Windows\System\WdhzGEQ.exe
  2⤵
  PID:5904
- C:\Windows\System\WSgoJtY.exe
  C:\Windows\System\WSgoJtY.exe
  2⤵
  PID:5924
- C:\Windows\System\aHPyWrB.exe
  C:\Windows\System\aHPyWrB.exe
  2⤵
  PID:5940
- C:\Windows\System\FPUKjpi.exe
  C:\Windows\System\FPUKjpi.exe
  2⤵
  PID:5956
- C:\Windows\System\xadVaYb.exe
  C:\Windows\System\xadVaYb.exe
  2⤵
  PID:5972
- C:\Windows\System\VuWXccB.exe
  C:\Windows\System\VuWXccB.exe
  2⤵
  PID:5988
- C:\Windows\System\jOveojQ.exe
  C:\Windows\System\jOveojQ.exe
  2⤵
  PID:6004
- C:\Windows\System\YEVTxsZ.exe
  C:\Windows\System\YEVTxsZ.exe
  2⤵
  PID:6020
- C:\Windows\System\QZzJZvl.exe
  C:\Windows\System\QZzJZvl.exe
  2⤵
  PID:6036
- C:\Windows\System\HqFqmpU.exe
  C:\Windows\System\HqFqmpU.exe
  2⤵
  PID:6052
- C:\Windows\System\aAIhxTA.exe
  C:\Windows\System\aAIhxTA.exe
  2⤵
  PID:6068
- C:\Windows\System\rbusVZc.exe
  C:\Windows\System\rbusVZc.exe
  2⤵
  PID:6084
- C:\Windows\System\BozfAYf.exe
  C:\Windows\System\BozfAYf.exe
  2⤵
  PID:6100
- C:\Windows\System\mXxjagz.exe
  C:\Windows\System\mXxjagz.exe
  2⤵
  PID:6116
- C:\Windows\System\gclxXMX.exe
  C:\Windows\System\gclxXMX.exe
  2⤵
  PID:6132
- C:\Windows\System\hUTpDTb.exe
  C:\Windows\System\hUTpDTb.exe
  2⤵
  PID:4948
- C:\Windows\System\kRmQgff.exe
  C:\Windows\System\kRmQgff.exe
  2⤵
  PID:5128
- C:\Windows\System\neBhVqU.exe
  C:\Windows\System\neBhVqU.exe
  2⤵
  PID:5176
- C:\Windows\System\jjwgKYf.exe
  C:\Windows\System\jjwgKYf.exe
  2⤵
  PID:5256
- C:\Windows\System\vGLezWw.exe
  C:\Windows\System\vGLezWw.exe
  2⤵
  PID:5324
- C:\Windows\System\iqWLBFV.exe
  C:\Windows\System\iqWLBFV.exe
  2⤵
  PID:5396
- C:\Windows\System\IPycHEl.exe
  C:\Windows\System\IPycHEl.exe
  2⤵
  PID:5204
- C:\Windows\System\MggGjOP.exe
  C:\Windows\System\MggGjOP.exe
  2⤵
  PID:4140
- C:\Windows\System\EWWKUHr.exe
  C:\Windows\System\EWWKUHr.exe
  2⤵
  PID:5340
- C:\Windows\System\NbmgJny.exe
  C:\Windows\System\NbmgJny.exe
  2⤵
  PID:4240
- C:\Windows\System\clhCFgM.exe
  C:\Windows\System\clhCFgM.exe
  2⤵
  PID:1688
- C:\Windows\System\HJOszgf.exe
  C:\Windows\System\HJOszgf.exe
  2⤵
  PID:5240
- C:\Windows\System\WEYHIpi.exe
  C:\Windows\System\WEYHIpi.exe
  2⤵
  PID:5272
- C:\Windows\System\tTTssuw.exe
  C:\Windows\System\tTTssuw.exe
  2⤵
  PID:5344
- C:\Windows\System\pxguJKG.exe
  C:\Windows\System\pxguJKG.exe
  2⤵
  PID:5456
- C:\Windows\System\Xgptoxd.exe
  C:\Windows\System\Xgptoxd.exe
  2⤵
  PID:5536
- C:\Windows\System\eyfBvau.exe
  C:\Windows\System\eyfBvau.exe
  2⤵
  PID:5612
- C:\Windows\System\SotrZNE.exe
  C:\Windows\System\SotrZNE.exe
  2⤵
  PID:5676
- C:\Windows\System\MyFGAQE.exe
  C:\Windows\System\MyFGAQE.exe
  2⤵
  PID:5732
- C:\Windows\System\pfNOEpf.exe
  C:\Windows\System\pfNOEpf.exe
  2⤵
  PID:5780
- C:\Windows\System\mWolFad.exe
  C:\Windows\System\mWolFad.exe
  2⤵
  PID:5844
- C:\Windows\System\pYHdUiF.exe
  C:\Windows\System\pYHdUiF.exe
  2⤵
  PID:5912
- C:\Windows\System\KhSaewN.exe
  C:\Windows\System\KhSaewN.exe
  2⤵
  PID:5952
- C:\Windows\System\FSRyfKq.exe
  C:\Windows\System\FSRyfKq.exe
  2⤵
  PID:6016
- C:\Windows\System\mvMouRk.exe
  C:\Windows\System\mvMouRk.exe
  2⤵
  PID:5016
- C:\Windows\System\nbtEFjp.exe
  C:\Windows\System\nbtEFjp.exe
  2⤵
  PID:6108
- C:\Windows\System\xhBTEeh.exe
  C:\Windows\System\xhBTEeh.exe
  2⤵
  PID:5292
- C:\Windows\System\KXGHURi.exe
  C:\Windows\System\KXGHURi.exe
  2⤵
  PID:5380
- C:\Windows\System\mmbhOEo.exe
  C:\Windows\System\mmbhOEo.exe
  2⤵
  PID:5244
- C:\Windows\System\IkRIQeK.exe
  C:\Windows\System\IkRIQeK.exe
  2⤵
  PID:5556
- C:\Windows\System\FCnYaqm.exe
  C:\Windows\System\FCnYaqm.exe
  2⤵
  PID:5712
- C:\Windows\System\jirnJIP.exe
  C:\Windows\System\jirnJIP.exe
  2⤵
  PID:5948
- C:\Windows\System\onbnsZY.exe
  C:\Windows\System\onbnsZY.exe
  2⤵
  PID:6048
- C:\Windows\System\vexhRNK.exe
  C:\Windows\System\vexhRNK.exe
  2⤵
  PID:6076
- C:\Windows\System\etfRRHm.exe
  C:\Windows\System\etfRRHm.exe
  2⤵
  PID:6060
- C:\Windows\System\enwjXVk.exe
  C:\Windows\System\enwjXVk.exe
  2⤵
  PID:4968
- C:\Windows\System\FqrAWZd.exe
  C:\Windows\System\FqrAWZd.exe
  2⤵
  PID:5188
- C:\Windows\System\TaiCSjO.exe
  C:\Windows\System\TaiCSjO.exe
  2⤵
  PID:5444
- C:\Windows\System\fGeUqif.exe
  C:\Windows\System\fGeUqif.exe
  2⤵
  PID:5336
- C:\Windows\System\BiRaJSN.exe
  C:\Windows\System\BiRaJSN.exe
  2⤵
  PID:5692
- C:\Windows\System\UmYteob.exe
  C:\Windows\System\UmYteob.exe
  2⤵
  PID:5484
- C:\Windows\System\IHeozDS.exe
  C:\Windows\System\IHeozDS.exe
  2⤵
  PID:5516
- C:\Windows\System\ThFkLFq.exe
  C:\Windows\System\ThFkLFq.exe
  2⤵
  PID:5224
- C:\Windows\System\EZcgFmL.exe
  C:\Windows\System\EZcgFmL.exe
  2⤵
  PID:5560
- C:\Windows\System\xPYrwrO.exe
  C:\Windows\System\xPYrwrO.exe
  2⤵
  PID:5156
- C:\Windows\System\kyaRmZh.exe
  C:\Windows\System\kyaRmZh.exe
  2⤵
  PID:5628
- C:\Windows\System\ZMwDglv.exe
  C:\Windows\System\ZMwDglv.exe
  2⤵
  PID:5728
- C:\Windows\System\LXSjNVX.exe
  C:\Windows\System\LXSjNVX.exe
  2⤵
  PID:5824
- C:\Windows\System\gEejOCA.exe
  C:\Windows\System\gEejOCA.exe
  2⤵
  PID:5964
- C:\Windows\System\tijXCzH.exe
  C:\Windows\System\tijXCzH.exe
  2⤵
  PID:6140
- C:\Windows\System\QIjxMKa.exe
  C:\Windows\System\QIjxMKa.exe
  2⤵
  PID:5504
- C:\Windows\System\jttQQDF.exe
  C:\Windows\System\jttQQDF.exe
  2⤵
  PID:5776
- C:\Windows\System\XrpiRUN.exe
  C:\Windows\System\XrpiRUN.exe
  2⤵
  PID:3020
- C:\Windows\System\svtDOai.exe
  C:\Windows\System\svtDOai.exe
  2⤵
  PID:5276
- C:\Windows\System\PjohrLW.exe
  C:\Windows\System\PjohrLW.exe
  2⤵
  PID:5172
- C:\Windows\System\ctjvetj.exe
  C:\Windows\System\ctjvetj.exe
  2⤵
  PID:6092
- C:\Windows\System\tlymHKC.exe
  C:\Windows\System\tlymHKC.exe
  2⤵
  PID:5596
- C:\Windows\System\CONlXsx.exe
  C:\Windows\System\CONlXsx.exe
  2⤵
  PID:6124
- C:\Windows\System\YtlgMdw.exe
  C:\Windows\System\YtlgMdw.exe
  2⤵
  PID:5520
- C:\Windows\System\JPorUFv.exe
  C:\Windows\System\JPorUFv.exe
  2⤵
  PID:5220
- C:\Windows\System\dWARrKK.exe
  C:\Windows\System\dWARrKK.exe
  2⤵
  PID:5724
- C:\Windows\System\LPRijmh.exe
  C:\Windows\System\LPRijmh.exe
  2⤵
  PID:5140
- C:\Windows\System\MgnoXCx.exe
  C:\Windows\System\MgnoXCx.exe
  2⤵
  PID:1660
- C:\Windows\System\KtPcJLZ.exe
  C:\Windows\System\KtPcJLZ.exe
  2⤵
  PID:5308
- C:\Windows\System\NCDfPAc.exe
  C:\Windows\System\NCDfPAc.exe
  2⤵
  PID:5932
- C:\Windows\System\TWmqWLG.exe
  C:\Windows\System\TWmqWLG.exe
  2⤵
  PID:6028
- C:\Windows\System\NpjYbFs.exe
  C:\Windows\System\NpjYbFs.exe
  2⤵
  PID:6164
- C:\Windows\System\KWrsVyu.exe
  C:\Windows\System\KWrsVyu.exe
  2⤵
  PID:6180
- C:\Windows\System\KUPuNYc.exe
  C:\Windows\System\KUPuNYc.exe
  2⤵
  PID:6196
- C:\Windows\System\ktgNHtk.exe
  C:\Windows\System\ktgNHtk.exe
  2⤵
  PID:6212
- C:\Windows\System\FyGiPOH.exe
  C:\Windows\System\FyGiPOH.exe
  2⤵
  PID:6232
- C:\Windows\System\qojdpPw.exe
  C:\Windows\System\qojdpPw.exe
  2⤵
  PID:6248
- C:\Windows\System\bdwECYT.exe
  C:\Windows\System\bdwECYT.exe
  2⤵
  PID:6268
- C:\Windows\System\wpjEqrs.exe
  C:\Windows\System\wpjEqrs.exe
  2⤵
  PID:6284
- C:\Windows\System\tZXSyVd.exe
  C:\Windows\System\tZXSyVd.exe
  2⤵
  PID:6304
- C:\Windows\System\wQWTfjQ.exe
  C:\Windows\System\wQWTfjQ.exe
  2⤵
  PID:6320
- C:\Windows\System\mKyrWdi.exe
  C:\Windows\System\mKyrWdi.exe
  2⤵
  PID:6336
- C:\Windows\System\cdAQpYH.exe
  C:\Windows\System\cdAQpYH.exe
  2⤵
  PID:6352
- C:\Windows\System\VvzBHNH.exe
  C:\Windows\System\VvzBHNH.exe
  2⤵
  PID:6368
- C:\Windows\System\pVBiIFs.exe
  C:\Windows\System\pVBiIFs.exe
  2⤵
  PID:6384
- C:\Windows\System\yBUTFiX.exe
  C:\Windows\System\yBUTFiX.exe
  2⤵
  PID:6404
- C:\Windows\System\fzxxzFC.exe
  C:\Windows\System\fzxxzFC.exe
  2⤵
  PID:6420
- C:\Windows\System\htJjEjI.exe
  C:\Windows\System\htJjEjI.exe
  2⤵
  PID:6440
- C:\Windows\System\hVzKSmP.exe
  C:\Windows\System\hVzKSmP.exe
  2⤵
  PID:6456
- C:\Windows\System\EQsdInp.exe
  C:\Windows\System\EQsdInp.exe
  2⤵
  PID:6472
- C:\Windows\System\sEbExTN.exe
  C:\Windows\System\sEbExTN.exe
  2⤵
  PID:6488
- C:\Windows\System\YQaIWnp.exe
  C:\Windows\System\YQaIWnp.exe
  2⤵
  PID:6504
- C:\Windows\System\CGtPtLX.exe
  C:\Windows\System\CGtPtLX.exe
  2⤵
  PID:6520
- C:\Windows\System\dAsOngp.exe
  C:\Windows\System\dAsOngp.exe
  2⤵
  PID:6536
- C:\Windows\System\cZaQnHV.exe
  C:\Windows\System\cZaQnHV.exe
  2⤵
  PID:6552
- C:\Windows\System\wnojYql.exe
  C:\Windows\System\wnojYql.exe
  2⤵
  PID:6648
- C:\Windows\System\SsDNxDj.exe
  C:\Windows\System\SsDNxDj.exe
  2⤵
  PID:6664
- C:\Windows\System\ZgDgipF.exe
  C:\Windows\System\ZgDgipF.exe
  2⤵
  PID:6680
- C:\Windows\System\hQrqaNo.exe
  C:\Windows\System\hQrqaNo.exe
  2⤵
  PID:6700
- C:\Windows\System\eMMsTVM.exe
  C:\Windows\System\eMMsTVM.exe
  2⤵
  PID:6720
- C:\Windows\System\CGbwFoR.exe
  C:\Windows\System\CGbwFoR.exe
  2⤵
  PID:6736
- C:\Windows\System\ZKkKalr.exe
  C:\Windows\System\ZKkKalr.exe
  2⤵
  PID:6760
- C:\Windows\System\njrtteI.exe
  C:\Windows\System\njrtteI.exe
  2⤵
  PID:6780
- C:\Windows\System\AKZgEoL.exe
  C:\Windows\System\AKZgEoL.exe
  2⤵
  PID:6796
- C:\Windows\System\cWqGOMT.exe
  C:\Windows\System\cWqGOMT.exe
  2⤵
  PID:6816
- C:\Windows\System\YJrvsZq.exe
  C:\Windows\System\YJrvsZq.exe
  2⤵
  PID:6832
- C:\Windows\System\VYkwGvz.exe
  C:\Windows\System\VYkwGvz.exe
  2⤵
  PID:6848
- C:\Windows\System\hzXqAfe.exe
  C:\Windows\System\hzXqAfe.exe
  2⤵
  PID:6864
- C:\Windows\System\rPUJvpv.exe
  C:\Windows\System\rPUJvpv.exe
  2⤵
  PID:6880
- C:\Windows\System\plhyYGr.exe
  C:\Windows\System\plhyYGr.exe
  2⤵
  PID:6896
- C:\Windows\System\dDzDoFs.exe
  C:\Windows\System\dDzDoFs.exe
  2⤵
  PID:6912
- C:\Windows\System\eExmyKn.exe
  C:\Windows\System\eExmyKn.exe
  2⤵
  PID:6928
- C:\Windows\System\BapjaZe.exe
  C:\Windows\System\BapjaZe.exe
  2⤵
  PID:6944
- C:\Windows\System\LkQBdMh.exe
  C:\Windows\System\LkQBdMh.exe
  2⤵
  PID:6960
- C:\Windows\System\JVyMvkw.exe
  C:\Windows\System\JVyMvkw.exe
  2⤵
  PID:6976
- C:\Windows\System\bzNNiWV.exe
  C:\Windows\System\bzNNiWV.exe
  2⤵
  PID:6992
- C:\Windows\System\mfZOohJ.exe
  C:\Windows\System\mfZOohJ.exe
  2⤵
  PID:7008
- C:\Windows\System\YSJeKdD.exe
  C:\Windows\System\YSJeKdD.exe
  2⤵
  PID:7024
- C:\Windows\System\bltXeDg.exe
  C:\Windows\System\bltXeDg.exe
  2⤵
  PID:7044
- C:\Windows\System\UsjJtfb.exe
  C:\Windows\System\UsjJtfb.exe
  2⤵
  PID:7060
- C:\Windows\System\Bbasphi.exe
  C:\Windows\System\Bbasphi.exe
  2⤵
  PID:7076
- C:\Windows\System\NNGrJkm.exe
  C:\Windows\System\NNGrJkm.exe
  2⤵
  PID:7092
- C:\Windows\System\rxSrJCY.exe
  C:\Windows\System\rxSrJCY.exe
  2⤵
  PID:7108
- C:\Windows\System\mcFwkWk.exe
  C:\Windows\System\mcFwkWk.exe
  2⤵
  PID:7124
- C:\Windows\System\NaTvdpN.exe
  C:\Windows\System\NaTvdpN.exe
  2⤵
  PID:7140
- C:\Windows\System\eXVsLnz.exe
  C:\Windows\System\eXVsLnz.exe
  2⤵
  PID:7156
- C:\Windows\System\ipqqtOH.exe
  C:\Windows\System\ipqqtOH.exe
  2⤵
  PID:5532
- C:\Windows\System\cOJVkxP.exe
  C:\Windows\System\cOJVkxP.exe
  2⤵
  PID:5660
- C:\Windows\System\iCiyXXK.exe
  C:\Windows\System\iCiyXXK.exe
  2⤵
  PID:6160
- C:\Windows\System\PoSeyPW.exe
  C:\Windows\System\PoSeyPW.exe
  2⤵
  PID:5208
- C:\Windows\System\eLGqIKr.exe
  C:\Windows\System\eLGqIKr.exe
  2⤵
  PID:5860
- C:\Windows\System\ThzHInj.exe
  C:\Windows\System\ThzHInj.exe
  2⤵
  PID:5920
- C:\Windows\System\zcqjhHC.exe
  C:\Windows\System\zcqjhHC.exe
  2⤵
  PID:6176
- C:\Windows\System\aQForAZ.exe
  C:\Windows\System\aQForAZ.exe
  2⤵
  PID:4020
- C:\Windows\System\ZaubgPQ.exe
  C:\Windows\System\ZaubgPQ.exe
  2⤵
  PID:6260
- C:\Windows\System\vXGLfwe.exe
  C:\Windows\System\vXGLfwe.exe
  2⤵
  PID:6328
- C:\Windows\System\nmMaOSZ.exe
  C:\Windows\System\nmMaOSZ.exe
  2⤵
  PID:6360
- C:\Windows\System\IUWVLGL.exe
  C:\Windows\System\IUWVLGL.exe
  2⤵
  PID:6276
- C:\Windows\System\fprMbUy.exe
  C:\Windows\System\fprMbUy.exe
  2⤵
  PID:6432
- C:\Windows\System\XVQZCbd.exe
  C:\Windows\System\XVQZCbd.exe
  2⤵
  PID:6380
- C:\Windows\System\TbvoQIT.exe
  C:\Windows\System\TbvoQIT.exe
  2⤵
  PID:6312
- C:\Windows\System\fcboTSz.exe
  C:\Windows\System\fcboTSz.exe
  2⤵
  PID:6412
- C:\Windows\System\FCjPwTT.exe
  C:\Windows\System\FCjPwTT.exe
  2⤵
  PID:6496
- C:\Windows\System\xbxuXTo.exe
  C:\Windows\System\xbxuXTo.exe
  2⤵
  PID:6512
- C:\Windows\System\unfEJGN.exe
  C:\Windows\System\unfEJGN.exe
  2⤵
  PID:6564
- C:\Windows\System\qXgsRmk.exe
  C:\Windows\System\qXgsRmk.exe
  2⤵
  PID:6568
- C:\Windows\System\fQrhlcq.exe
  C:\Windows\System\fQrhlcq.exe
  2⤵
  PID:6584
- C:\Windows\System\zKfiwkI.exe
  C:\Windows\System\zKfiwkI.exe
  2⤵
  PID:6600
- C:\Windows\System\JJxfeWO.exe
  C:\Windows\System\JJxfeWO.exe
  2⤵
  PID:6620
- C:\Windows\System\WmUaKck.exe
  C:\Windows\System\WmUaKck.exe
  2⤵
  PID:6632
- C:\Windows\System\eihuKFu.exe
  C:\Windows\System\eihuKFu.exe
  2⤵
  PID:6656
- C:\Windows\System\hOUmlTN.exe
  C:\Windows\System\hOUmlTN.exe
  2⤵
  PID:6676
- C:\Windows\System\akDhbCo.exe
  C:\Windows\System\akDhbCo.exe
  2⤵
  PID:6728
- C:\Windows\System\NjxGoZf.exe
  C:\Windows\System\NjxGoZf.exe
  2⤵
  PID:6744
- C:\Windows\System\lwahmPO.exe
  C:\Windows\System\lwahmPO.exe
  2⤵
  PID:6788
- C:\Windows\System\MbIZJAB.exe
  C:\Windows\System\MbIZJAB.exe
  2⤵
  PID:6768
- C:\Windows\System\ZYmetNB.exe
  C:\Windows\System\ZYmetNB.exe
  2⤵
  PID:6772
- C:\Windows\System\tSKyvXG.exe
  C:\Windows\System\tSKyvXG.exe
  2⤵
  PID:6804
- C:\Windows\System\AuslWHJ.exe
  C:\Windows\System\AuslWHJ.exe
  2⤵
  PID:6956
- C:\Windows\System\OICjqXP.exe
  C:\Windows\System\OICjqXP.exe
  2⤵
  PID:7020
- C:\Windows\System\wpapeEQ.exe
  C:\Windows\System\wpapeEQ.exe
  2⤵
  PID:7052
- C:\Windows\System\tCbSkDs.exe
  C:\Windows\System\tCbSkDs.exe
  2⤵
  PID:6876
- C:\Windows\System\LwiekPi.exe
  C:\Windows\System\LwiekPi.exe
  2⤵
  PID:6940
- C:\Windows\System\DZTVzXy.exe
  C:\Windows\System\DZTVzXy.exe
  2⤵
  PID:7036
- C:\Windows\System\McTZrIU.exe
  C:\Windows\System\McTZrIU.exe
  2⤵
  PID:7088
- C:\Windows\System\vHDLYsz.exe
  C:\Windows\System\vHDLYsz.exe
  2⤵
  PID:7152
- C:\Windows\System\POtYPbV.exe
  C:\Windows\System\POtYPbV.exe
  2⤵
  PID:5236
- C:\Windows\System\pJMbQum.exe
  C:\Windows\System\pJMbQum.exe
  2⤵
  PID:6224
- C:\Windows\System\XqSPnle.exe
  C:\Windows\System\XqSPnle.exe
  2⤵
  PID:6396
- C:\Windows\System\pmevvlS.exe
  C:\Windows\System\pmevvlS.exe
  2⤵
  PID:6344
- C:\Windows\System\xSwtQxr.exe
  C:\Windows\System\xSwtQxr.exe
  2⤵
  PID:5348
- C:\Windows\System\AYmKhkG.exe
  C:\Windows\System\AYmKhkG.exe
  2⤵
  PID:7164
- C:\Windows\System\PHkQKtP.exe
  C:\Windows\System\PHkQKtP.exe
  2⤵
  PID:1484
- C:\Windows\System\zMHVJun.exe
  C:\Windows\System\zMHVJun.exe
  2⤵
  PID:6332
- C:\Windows\System\LZMDDzx.exe
  C:\Windows\System\LZMDDzx.exe
  2⤵
  PID:6416
- C:\Windows\System\fROnigR.exe
  C:\Windows\System\fROnigR.exe
  2⤵
  PID:6480
- C:\Windows\System\MIMcGKd.exe
  C:\Windows\System\MIMcGKd.exe
  2⤵
  PID:6532
- C:\Windows\System\LlEbvlu.exe
  C:\Windows\System\LlEbvlu.exe
  2⤵
  PID:6596
- C:\Windows\System\XgMDjNb.exe
  C:\Windows\System\XgMDjNb.exe
  2⤵
  PID:6608
- C:\Windows\System\baVpXaq.exe
  C:\Windows\System\baVpXaq.exe
  2⤵
  PID:6672
- C:\Windows\System\AWHNEiO.exe
  C:\Windows\System\AWHNEiO.exe
  2⤵
  PID:6824
- C:\Windows\System\dYhHVnf.exe
  C:\Windows\System\dYhHVnf.exe
  2⤵
  PID:7016
- C:\Windows\System\QfzKsfv.exe
  C:\Windows\System\QfzKsfv.exe
  2⤵
  PID:6752
- C:\Windows\System\cfWkitC.exe
  C:\Windows\System\cfWkitC.exe
  2⤵
  PID:6756
- C:\Windows\System\BmFxZOW.exe
  C:\Windows\System\BmFxZOW.exe
  2⤵
  PID:6952
- C:\Windows\System\hCHSWIh.exe
  C:\Windows\System\hCHSWIh.exe
  2⤵
  PID:6936
- C:\Windows\System\EMaZzlL.exe
  C:\Windows\System\EMaZzlL.exe
  2⤵
  PID:5984
- C:\Windows\System\WmUWtGq.exe
  C:\Windows\System\WmUWtGq.exe
  2⤵
  PID:6156
- C:\Windows\System\IdoOKUh.exe
  C:\Windows\System\IdoOKUh.exe
  2⤵
  PID:6256
- C:\Windows\System\haOXbfE.exe
  C:\Windows\System\haOXbfE.exe
  2⤵
  PID:6548
- C:\Windows\System\CHkJVdv.exe
  C:\Windows\System\CHkJVdv.exe
  2⤵
  PID:6640
- C:\Windows\System\ETWnMio.exe
  C:\Windows\System\ETWnMio.exe
  2⤵
  PID:6300
- C:\Windows\System\MCCuZnF.exe
  C:\Windows\System\MCCuZnF.exe
  2⤵
  PID:6920
- C:\Windows\System\jZYOaWX.exe
  C:\Windows\System\jZYOaWX.exe
  2⤵
  PID:5364
- C:\Windows\System\TfIwdtJ.exe
  C:\Windows\System\TfIwdtJ.exe
  2⤵
  PID:6264
- C:\Windows\System\HANXAeh.exe
  C:\Windows\System\HANXAeh.exe
  2⤵
  PID:6972
- C:\Windows\System\jOkVxrt.exe
  C:\Windows\System\jOkVxrt.exe
  2⤵
  PID:6908
- C:\Windows\System\pDVhFWb.exe
  C:\Windows\System\pDVhFWb.exe
  2⤵
  PID:6776
- C:\Windows\System\GoCwRdf.exe
  C:\Windows\System\GoCwRdf.exe
  2⤵
  PID:6192
- C:\Windows\System\HAEFEMf.exe
  C:\Windows\System\HAEFEMf.exe
  2⤵
  PID:7068
- C:\Windows\System\BiAuDJh.exe
  C:\Windows\System\BiAuDJh.exe
  2⤵
  PID:6576
- C:\Windows\System\NLewzIQ.exe
  C:\Windows\System\NLewzIQ.exe
  2⤵
  PID:7120
- C:\Windows\System\vKkZnit.exe
  C:\Windows\System\vKkZnit.exe
  2⤵
  PID:6280
- C:\Windows\System\jtlWcCr.exe
  C:\Windows\System\jtlWcCr.exe
  2⤵
  PID:7180
- C:\Windows\System\nYKazug.exe
  C:\Windows\System\nYKazug.exe
  2⤵
  PID:7196
- C:\Windows\System\knRpIgn.exe
  C:\Windows\System\knRpIgn.exe
  2⤵
  PID:7212
- C:\Windows\System\OGIuqHp.exe
  C:\Windows\System\OGIuqHp.exe
  2⤵
  PID:7228
- C:\Windows\System\YrrNydx.exe
  C:\Windows\System\YrrNydx.exe
  2⤵
  PID:7244
- C:\Windows\System\KTzCLmm.exe
  C:\Windows\System\KTzCLmm.exe
  2⤵
  PID:7260
- C:\Windows\System\ImKYNEU.exe
  C:\Windows\System\ImKYNEU.exe
  2⤵
  PID:7276
- C:\Windows\System\sQgXdzW.exe
  C:\Windows\System\sQgXdzW.exe
  2⤵
  PID:7296
- C:\Windows\System\FZidNFJ.exe
  C:\Windows\System\FZidNFJ.exe
  2⤵
  PID:7312
- C:\Windows\System\drSvwLl.exe
  C:\Windows\System\drSvwLl.exe
  2⤵
  PID:7328
- C:\Windows\System\QWyIrpW.exe
  C:\Windows\System\QWyIrpW.exe
  2⤵
  PID:7344
- C:\Windows\System\ZfRXLxQ.exe
  C:\Windows\System\ZfRXLxQ.exe
  2⤵
  PID:7360
- C:\Windows\System\NnkSfnV.exe
  C:\Windows\System\NnkSfnV.exe
  2⤵
  PID:7376
- C:\Windows\System\wvRtiho.exe
  C:\Windows\System\wvRtiho.exe
  2⤵
  PID:7392
- C:\Windows\System\VSSlFkH.exe
  C:\Windows\System\VSSlFkH.exe
  2⤵
  PID:7408
- C:\Windows\System\mdnsNBK.exe
  C:\Windows\System\mdnsNBK.exe
  2⤵
  PID:7424
- C:\Windows\System\tPkHjkV.exe
  C:\Windows\System\tPkHjkV.exe
  2⤵
  PID:7440
- C:\Windows\System\sdKeGTC.exe
  C:\Windows\System\sdKeGTC.exe
  2⤵
  PID:7456
- C:\Windows\System\SJKkOgP.exe
  C:\Windows\System\SJKkOgP.exe
  2⤵
  PID:7472
- C:\Windows\System\oZmoiMG.exe
  C:\Windows\System\oZmoiMG.exe
  2⤵
  PID:7488
- C:\Windows\System\vvUmNIL.exe
  C:\Windows\System\vvUmNIL.exe
  2⤵
  PID:7504
- C:\Windows\System\aHLGJot.exe
  C:\Windows\System\aHLGJot.exe
  2⤵
  PID:7520
- C:\Windows\System\XGoQvGY.exe
  C:\Windows\System\XGoQvGY.exe
  2⤵
  PID:7536
- C:\Windows\System\WozPofV.exe
  C:\Windows\System\WozPofV.exe
  2⤵
  PID:7552
- C:\Windows\System\KQUMmkh.exe
  C:\Windows\System\KQUMmkh.exe
  2⤵
  PID:7568
- C:\Windows\System\KBsVaQS.exe
  C:\Windows\System\KBsVaQS.exe
  2⤵
  PID:7584
- C:\Windows\System\uksSEye.exe
  C:\Windows\System\uksSEye.exe
  2⤵
  PID:7600
- C:\Windows\System\ZEzvhQT.exe
  C:\Windows\System\ZEzvhQT.exe
  2⤵
  PID:7616
- C:\Windows\System\VjPJeUU.exe
  C:\Windows\System\VjPJeUU.exe
  2⤵
  PID:7636
- C:\Windows\System\byhtoBF.exe
  C:\Windows\System\byhtoBF.exe
  2⤵
  PID:7652
- C:\Windows\System\WuWlYSA.exe
  C:\Windows\System\WuWlYSA.exe
  2⤵
  PID:7668
- C:\Windows\System\KdDPySo.exe
  C:\Windows\System\KdDPySo.exe
  2⤵
  PID:7684
- C:\Windows\System\IDcEZGC.exe
  C:\Windows\System\IDcEZGC.exe
  2⤵
  PID:7700
- C:\Windows\System\zqjSvhC.exe
  C:\Windows\System\zqjSvhC.exe
  2⤵
  PID:7716
- C:\Windows\System\DkApVZb.exe
  C:\Windows\System\DkApVZb.exe
  2⤵
  PID:7732
- C:\Windows\System\HaNdKyo.exe
  C:\Windows\System\HaNdKyo.exe
  2⤵
  PID:7748
- C:\Windows\System\UlSUrzm.exe
  C:\Windows\System\UlSUrzm.exe
  2⤵
  PID:7764
- C:\Windows\System\AuBHNOU.exe
  C:\Windows\System\AuBHNOU.exe
  2⤵
  PID:7780
- C:\Windows\System\XnZVSTB.exe
  C:\Windows\System\XnZVSTB.exe
  2⤵
  PID:7796
- C:\Windows\System\eYUdLpz.exe
  C:\Windows\System\eYUdLpz.exe
  2⤵
  PID:7812
- C:\Windows\System\AJyGLhf.exe
  C:\Windows\System\AJyGLhf.exe
  2⤵
  PID:7828
- C:\Windows\System\BEdnGMs.exe
  C:\Windows\System\BEdnGMs.exe
  2⤵
  PID:7844
- C:\Windows\System\MYMRDvq.exe
  C:\Windows\System\MYMRDvq.exe
  2⤵
  PID:7860
- C:\Windows\System\JfpZTPc.exe
  C:\Windows\System\JfpZTPc.exe
  2⤵
  PID:7876
- C:\Windows\System\DRunNkT.exe
  C:\Windows\System\DRunNkT.exe
  2⤵
  PID:7892
- C:\Windows\System\eGesNKC.exe
  C:\Windows\System\eGesNKC.exe
  2⤵
  PID:7908
- C:\Windows\System\BGsKzBu.exe
  C:\Windows\System\BGsKzBu.exe
  2⤵
  PID:7924
- C:\Windows\System\bDMFcjx.exe
  C:\Windows\System\bDMFcjx.exe
  2⤵
  PID:7940
- C:\Windows\System\QYytoCc.exe
  C:\Windows\System\QYytoCc.exe
  2⤵
  PID:7956
- C:\Windows\System\acVOLJn.exe
  C:\Windows\System\acVOLJn.exe
  2⤵
  PID:7972
- C:\Windows\System\VpWHxKx.exe
  C:\Windows\System\VpWHxKx.exe
  2⤵
  PID:7988
- C:\Windows\System\xgyBiMN.exe
  C:\Windows\System\xgyBiMN.exe
  2⤵
  PID:8004
- C:\Windows\System\aZekCYv.exe
  C:\Windows\System\aZekCYv.exe
  2⤵
  PID:8020
- C:\Windows\System\HudIGGk.exe
  C:\Windows\System\HudIGGk.exe
  2⤵
  PID:8036
- C:\Windows\System\PpquzwP.exe
  C:\Windows\System\PpquzwP.exe
  2⤵
  PID:8052
- C:\Windows\System\csFcpPQ.exe
  C:\Windows\System\csFcpPQ.exe
  2⤵
  PID:8068
- C:\Windows\System\oyxBWEw.exe
  C:\Windows\System\oyxBWEw.exe
  2⤵
  PID:8084
- C:\Windows\System\WaCjHQC.exe
  C:\Windows\System\WaCjHQC.exe
  2⤵
  PID:8100
- C:\Windows\System\dKwxDvU.exe
  C:\Windows\System\dKwxDvU.exe
  2⤵
  PID:8116
- C:\Windows\System\KdPROCl.exe
  C:\Windows\System\KdPROCl.exe
  2⤵
  PID:8132
- C:\Windows\System\vbvvmVV.exe
  C:\Windows\System\vbvvmVV.exe
  2⤵
  PID:8148
- C:\Windows\System\YOFfLiM.exe
  C:\Windows\System\YOFfLiM.exe
  2⤵
  PID:8164
- C:\Windows\System\hMmugzP.exe
  C:\Windows\System\hMmugzP.exe
  2⤵
  PID:8180
- C:\Windows\System\pTQweCP.exe
  C:\Windows\System\pTQweCP.exe
  2⤵
  PID:7176
- C:\Windows\System\bdwgKEN.exe
  C:\Windows\System\bdwgKEN.exe
  2⤵
  PID:7240
- C:\Windows\System\qwOlgpo.exe
  C:\Windows\System\qwOlgpo.exe
  2⤵
  PID:7100
- C:\Windows\System\yXhIbcv.exe
  C:\Windows\System\yXhIbcv.exe
  2⤵
  PID:6624
- C:\Windows\System\qYVIXBJ.exe
  C:\Windows\System\qYVIXBJ.exe
  2⤵
  PID:7220
- C:\Windows\System\nTKMiAx.exe
  C:\Windows\System\nTKMiAx.exe
  2⤵
  PID:6812
- C:\Windows\System\eUBhbqv.exe
  C:\Windows\System\eUBhbqv.exe
  2⤵
  PID:7256
- C:\Windows\System\SQQMzSy.exe
  C:\Windows\System\SQQMzSy.exe
  2⤵
  PID:7324
- C:\Windows\System\VMHIAgd.exe
  C:\Windows\System\VMHIAgd.exe
  2⤵
  PID:7340
- C:\Windows\System\xZLNIND.exe
  C:\Windows\System\xZLNIND.exe
  2⤵
  PID:7372
- C:\Windows\System\soKLMVn.exe
  C:\Windows\System\soKLMVn.exe
  2⤵
  PID:7436
- C:\Windows\System\TMJfSNv.exe
  C:\Windows\System\TMJfSNv.exe
  2⤵
  PID:7448
- C:\Windows\System\fvWUsuc.exe
  C:\Windows\System\fvWUsuc.exe
  2⤵
  PID:7528
- C:\Windows\System\DuAhWIr.exe
  C:\Windows\System\DuAhWIr.exe
  2⤵
  PID:6828
- C:\Windows\System\zDZipuh.exe
  C:\Windows\System\zDZipuh.exe
  2⤵
  PID:7632
- C:\Windows\System\oTHtIra.exe
  C:\Windows\System\oTHtIra.exe
  2⤵
  PID:7480
- C:\Windows\System\BKWksWf.exe
  C:\Windows\System\BKWksWf.exe
  2⤵
  PID:7548
- C:\Windows\System\rwyTQbt.exe
  C:\Windows\System\rwyTQbt.exe
  2⤵
  PID:7612
- C:\Windows\System\KlTtJGZ.exe
  C:\Windows\System\KlTtJGZ.exe
  2⤵
  PID:7664
- C:\Windows\System\YghgEUx.exe
  C:\Windows\System\YghgEUx.exe
  2⤵
  PID:7724
- C:\Windows\System\WHowQlR.exe
  C:\Windows\System\WHowQlR.exe
  2⤵
  PID:7756
- C:\Windows\System\bdDxVqB.exe
  C:\Windows\System\bdDxVqB.exe
  2⤵
  PID:7708
- C:\Windows\System\qGrlPma.exe
  C:\Windows\System\qGrlPma.exe
  2⤵
  PID:7856
- C:\Windows\System\kJkeiRj.exe
  C:\Windows\System\kJkeiRj.exe
  2⤵
  PID:7776
- C:\Windows\System\KyPVMyT.exe
  C:\Windows\System\KyPVMyT.exe
  2⤵
  PID:7884
- C:\Windows\System\qrbJonb.exe
  C:\Windows\System\qrbJonb.exe
  2⤵
  PID:7916
- C:\Windows\System\rxgMqdO.exe
  C:\Windows\System\rxgMqdO.exe
  2⤵
  PID:7904
- C:\Windows\System\SmcGHKe.exe
  C:\Windows\System\SmcGHKe.exe
  2⤵
  PID:7952
- C:\Windows\System\jsBaBHY.exe
  C:\Windows\System\jsBaBHY.exe
  2⤵
  PID:7968
- C:\Windows\System\VginkXz.exe
  C:\Windows\System\VginkXz.exe
  2⤵
  PID:8048
- C:\Windows\System\RDNFLAJ.exe
  C:\Windows\System\RDNFLAJ.exe
  2⤵
  PID:8112
- C:\Windows\System\SBmTZcU.exe
  C:\Windows\System\SBmTZcU.exe
  2⤵
  PID:8144
- C:\Windows\System\IZECeqs.exe
  C:\Windows\System\IZECeqs.exe
  2⤵
  PID:7236
- C:\Windows\System\NVIDAQr.exe
  C:\Windows\System\NVIDAQr.exe
  2⤵
  PID:7136
- C:\Windows\System\dLXgMiK.exe
  C:\Windows\System\dLXgMiK.exe
  2⤵
  PID:7996
- C:\Windows\System\kBXbQyD.exe
  C:\Windows\System\kBXbQyD.exe
  2⤵
  PID:8064
- C:\Windows\System\WFCbTCA.exe
  C:\Windows\System\WFCbTCA.exe
  2⤵
  PID:8156
- C:\Windows\System\ogvVyio.exe
  C:\Windows\System\ogvVyio.exe
  2⤵
  PID:7352
- C:\Windows\System\klQgsxH.exe
  C:\Windows\System\klQgsxH.exe
  2⤵
  PID:7384
- C:\Windows\System\iJxrapj.exe
  C:\Windows\System\iJxrapj.exe
  2⤵
  PID:7304
- C:\Windows\System\ioSgRMG.exe
  C:\Windows\System\ioSgRMG.exe
  2⤵
  PID:7560
- C:\Windows\System\mBuCKiQ.exe
  C:\Windows\System\mBuCKiQ.exe
  2⤵
  PID:7580
- C:\Windows\System\aAMskGl.exe
  C:\Windows\System\aAMskGl.exe
  2⤵
  PID:7500
- C:\Windows\System\zAJZoOO.exe
  C:\Windows\System\zAJZoOO.exe
  2⤵
  PID:7544
- C:\Windows\System\wWrwzhQ.exe
  C:\Windows\System\wWrwzhQ.exe
  2⤵
  PID:7820
- C:\Windows\System\ltKylri.exe
  C:\Windows\System\ltKylri.exe
  2⤵
  PID:7868
- C:\Windows\System\zSlcbAj.exe
  C:\Windows\System\zSlcbAj.exe
  2⤵
  PID:8044
- C:\Windows\System\Lddpyzm.exe
  C:\Windows\System\Lddpyzm.exe
  2⤵
  PID:7836
- C:\Windows\System\uvoyFvk.exe
  C:\Windows\System\uvoyFvk.exe
  2⤵
  PID:6580
- C:\Windows\System\ijBRnsi.exe
  C:\Windows\System\ijBRnsi.exe
  2⤵
  PID:7852
- C:\Windows\System\UluIyef.exe
  C:\Windows\System\UluIyef.exe
  2⤵
  PID:8060
- C:\Windows\System\WQTZjbm.exe
  C:\Windows\System\WQTZjbm.exe
  2⤵
  PID:7268
- C:\Windows\System\PfMwccV.exe
  C:\Windows\System\PfMwccV.exe
  2⤵
  PID:8108
- C:\Windows\System\YaTQADw.exe
  C:\Windows\System\YaTQADw.exe
  2⤵
  PID:8124
- C:\Windows\System\LPpMOrw.exe
  C:\Windows\System\LPpMOrw.exe
  2⤵
  PID:7288
- C:\Windows\System\qDhBpcJ.exe
  C:\Windows\System\qDhBpcJ.exe
  2⤵
  PID:7432
- C:\Windows\System\zCTSkfy.exe
  C:\Windows\System\zCTSkfy.exe
  2⤵
  PID:7368
- C:\Windows\System\umnEwxm.exe
  C:\Windows\System\umnEwxm.exe
  2⤵
  PID:7888
- C:\Windows\System\otdhtJJ.exe
  C:\Windows\System\otdhtJJ.exe
  2⤵
  PID:8016
- C:\Windows\System\mSEisXO.exe
  C:\Windows\System\mSEisXO.exe
  2⤵
  PID:7792
- C:\Windows\System\dFTuIRJ.exe
  C:\Windows\System\dFTuIRJ.exe
  2⤵
  PID:7208
- C:\Windows\System\WRWtpmy.exe
  C:\Windows\System\WRWtpmy.exe
  2⤵
  PID:8032
- C:\Windows\System\QQFWHyE.exe
  C:\Windows\System\QQFWHyE.exe
  2⤵
  PID:7356
- C:\Windows\System\ZIisnHU.exe
  C:\Windows\System\ZIisnHU.exe
  2⤵
  PID:7188
- C:\Windows\System\bZudBNi.exe
  C:\Windows\System\bZudBNi.exe
  2⤵
  PID:8200
- C:\Windows\System\VXBACtP.exe
  C:\Windows\System\VXBACtP.exe
  2⤵
  PID:8216
- C:\Windows\System\NXCuSoJ.exe
  C:\Windows\System\NXCuSoJ.exe
  2⤵
  PID:8232
- C:\Windows\System\hMLRGzM.exe
  C:\Windows\System\hMLRGzM.exe
  2⤵
  PID:8248
- C:\Windows\System\EZWeAWj.exe
  C:\Windows\System\EZWeAWj.exe
  2⤵
  PID:8268
- C:\Windows\System\sxhHzoH.exe
  C:\Windows\System\sxhHzoH.exe
  2⤵
  PID:8284
- C:\Windows\System\vlVCPMp.exe
  C:\Windows\System\vlVCPMp.exe
  2⤵
  PID:8300
- C:\Windows\System\mtXTmof.exe
  C:\Windows\System\mtXTmof.exe
  2⤵
  PID:8316
- C:\Windows\System\kpgluIB.exe
  C:\Windows\System\kpgluIB.exe
  2⤵
  PID:8332
- C:\Windows\System\tuRLPfM.exe
  C:\Windows\System\tuRLPfM.exe
  2⤵
  PID:8348
- C:\Windows\System\qsPDFEq.exe
  C:\Windows\System\qsPDFEq.exe
  2⤵
  PID:8364
- C:\Windows\System\nWXfFHR.exe
  C:\Windows\System\nWXfFHR.exe
  2⤵
  PID:8380
- C:\Windows\System\kVCQHYL.exe
  C:\Windows\System\kVCQHYL.exe
  2⤵
  PID:8396
- C:\Windows\System\BnIYjRQ.exe
  C:\Windows\System\BnIYjRQ.exe
  2⤵
  PID:8412
- C:\Windows\System\vrTxHRp.exe
  C:\Windows\System\vrTxHRp.exe
  2⤵
  PID:8428
- C:\Windows\System\SrIkPbq.exe
  C:\Windows\System\SrIkPbq.exe
  2⤵
  PID:8444
- C:\Windows\System\lwziqiQ.exe
  C:\Windows\System\lwziqiQ.exe
  2⤵
  PID:8460
- C:\Windows\System\ONqcJJJ.exe
  C:\Windows\System\ONqcJJJ.exe
  2⤵
  PID:8476
- C:\Windows\System\nTEoURa.exe
  C:\Windows\System\nTEoURa.exe
  2⤵
  PID:8492
- C:\Windows\System\gshBOSS.exe
  C:\Windows\System\gshBOSS.exe
  2⤵
  PID:8508
- C:\Windows\System\wHWLaza.exe
  C:\Windows\System\wHWLaza.exe
  2⤵
  PID:8524
- C:\Windows\System\ieCbLpZ.exe
  C:\Windows\System\ieCbLpZ.exe
  2⤵
  PID:8540
- C:\Windows\System\PBwmtyw.exe
  C:\Windows\System\PBwmtyw.exe
  2⤵
  PID:8556
- C:\Windows\System\UGATjlo.exe
  C:\Windows\System\UGATjlo.exe
  2⤵
  PID:8572
- C:\Windows\System\zchSuAm.exe
  C:\Windows\System\zchSuAm.exe
  2⤵
  PID:8588
- C:\Windows\System\ODhrOxG.exe
  C:\Windows\System\ODhrOxG.exe
  2⤵
  PID:8604
- C:\Windows\System\mPBogjc.exe
  C:\Windows\System\mPBogjc.exe
  2⤵
  PID:8620
- C:\Windows\System\jYlAKxR.exe
  C:\Windows\System\jYlAKxR.exe
  2⤵
  PID:8636
- C:\Windows\System\EPEMGCX.exe
  C:\Windows\System\EPEMGCX.exe
  2⤵
  PID:8652
- C:\Windows\System\rLtxQrN.exe
  C:\Windows\System\rLtxQrN.exe
  2⤵
  PID:8668
- C:\Windows\System\wNkfaVV.exe
  C:\Windows\System\wNkfaVV.exe
  2⤵
  PID:8684
- C:\Windows\System\tHrVkSS.exe
  C:\Windows\System\tHrVkSS.exe
  2⤵
  PID:8700
- C:\Windows\System\bJmHGsZ.exe
  C:\Windows\System\bJmHGsZ.exe
  2⤵
  PID:8716
- C:\Windows\System\btOcmQL.exe
  C:\Windows\System\btOcmQL.exe
  2⤵
  PID:8736
- C:\Windows\System\nnHqfEx.exe
  C:\Windows\System\nnHqfEx.exe
  2⤵
  PID:8752
- C:\Windows\System\RaAGGyI.exe
  C:\Windows\System\RaAGGyI.exe
  2⤵
  PID:8768
- C:\Windows\System\FLPhlWX.exe
  C:\Windows\System\FLPhlWX.exe
  2⤵
  PID:8784
- C:\Windows\System\XZPNRyd.exe
  C:\Windows\System\XZPNRyd.exe
  2⤵
  PID:8800
- C:\Windows\System\iIFitSf.exe
  C:\Windows\System\iIFitSf.exe
  2⤵
  PID:8816
- C:\Windows\System\BlJYfsq.exe
  C:\Windows\System\BlJYfsq.exe
  2⤵
  PID:8832
- C:\Windows\System\khahOBG.exe
  C:\Windows\System\khahOBG.exe
  2⤵
  PID:8848
- C:\Windows\System\uekiEpi.exe
  C:\Windows\System\uekiEpi.exe
  2⤵
  PID:8864
- C:\Windows\System\FPLKYlz.exe
  C:\Windows\System\FPLKYlz.exe
  2⤵
  PID:8880
- C:\Windows\System\QskiVEt.exe
  C:\Windows\System\QskiVEt.exe
  2⤵
  PID:8896
- C:\Windows\System\PESOsbZ.exe
  C:\Windows\System\PESOsbZ.exe
  2⤵
  PID:8912
- C:\Windows\System\eASddrX.exe
  C:\Windows\System\eASddrX.exe
  2⤵
  PID:8928
- C:\Windows\System\KjyCVdg.exe
  C:\Windows\System\KjyCVdg.exe
  2⤵
  PID:8944
- C:\Windows\System\pmiAidf.exe
  C:\Windows\System\pmiAidf.exe
  2⤵
  PID:8960
- C:\Windows\System\CnjIUOP.exe
  C:\Windows\System\CnjIUOP.exe
  2⤵
  PID:8976
- C:\Windows\System\KXiQRNV.exe
  C:\Windows\System\KXiQRNV.exe
  2⤵
  PID:8992
- C:\Windows\System\AAPHusN.exe
  C:\Windows\System\AAPHusN.exe
  2⤵
  PID:9008
- C:\Windows\System\whbJoiw.exe
  C:\Windows\System\whbJoiw.exe
  2⤵
  PID:9024
- C:\Windows\System\RxSvXAQ.exe
  C:\Windows\System\RxSvXAQ.exe
  2⤵
  PID:9040
- C:\Windows\System\lisdUCH.exe
  C:\Windows\System\lisdUCH.exe
  2⤵
  PID:9056
- C:\Windows\System\cRweVnj.exe
  C:\Windows\System\cRweVnj.exe
  2⤵
  PID:9072
- C:\Windows\System\QfvoZUp.exe
  C:\Windows\System\QfvoZUp.exe
  2⤵
  PID:9088
- C:\Windows\System\XEMNyud.exe
  C:\Windows\System\XEMNyud.exe
  2⤵
  PID:9104
- C:\Windows\System\iGUytcF.exe
  C:\Windows\System\iGUytcF.exe
  2⤵
  PID:9120
- C:\Windows\System\lWYatbC.exe
  C:\Windows\System\lWYatbC.exe
  2⤵
  PID:9136
- C:\Windows\System\XDrFUFI.exe
  C:\Windows\System\XDrFUFI.exe
  2⤵
  PID:9152
- C:\Windows\System\MLPercH.exe
  C:\Windows\System\MLPercH.exe
  2⤵
  PID:9168
- C:\Windows\System\cKdfxgV.exe
  C:\Windows\System\cKdfxgV.exe
  2⤵
  PID:9184
- C:\Windows\System\dWbmZFE.exe
  C:\Windows\System\dWbmZFE.exe
  2⤵
  PID:9200
- C:\Windows\System\fHvKOYn.exe
  C:\Windows\System\fHvKOYn.exe
  2⤵
  PID:7516
- C:\Windows\System\LkFXmjZ.exe
  C:\Windows\System\LkFXmjZ.exe
  2⤵
  PID:7872
- C:\Windows\System\cVMWeQu.exe
  C:\Windows\System\cVMWeQu.exe
  2⤵
  PID:7648
- C:\Windows\System\OEuYaop.exe
  C:\Windows\System\OEuYaop.exe
  2⤵
  PID:8196
- C:\Windows\System\tqbDYAY.exe
  C:\Windows\System\tqbDYAY.exe
  2⤵
  PID:8080
- C:\Windows\System\PIYImxz.exe
  C:\Windows\System\PIYImxz.exe
  2⤵
  PID:8276
- C:\Windows\System\VZzldUP.exe
  C:\Windows\System\VZzldUP.exe
  2⤵
  PID:8344
- C:\Windows\System\yCPFuBu.exe
  C:\Windows\System\yCPFuBu.exe
  2⤵
  PID:8404
- C:\Windows\System\mctKFER.exe
  C:\Windows\System\mctKFER.exe
  2⤵
  PID:8472
- C:\Windows\System\gKnNjzZ.exe
  C:\Windows\System\gKnNjzZ.exe
  2⤵
  PID:8536
- C:\Windows\System\jDWrRgi.exe
  C:\Windows\System\jDWrRgi.exe
  2⤵
  PID:8596
- C:\Windows\System\vCsGTvQ.exe
  C:\Windows\System\vCsGTvQ.exe
  2⤵
  PID:8292
- C:\Windows\System\NdcpzEj.exe
  C:\Windows\System\NdcpzEj.exe
  2⤵
  PID:8520
- C:\Windows\System\cuLsbmz.exe
  C:\Windows\System\cuLsbmz.exe
  2⤵
  PID:8584
- C:\Windows\System\SrkiwXi.exe
  C:\Windows\System\SrkiwXi.exe
  2⤵
  PID:8484
- C:\Windows\System\BATGEfW.exe
  C:\Windows\System\BATGEfW.exe
  2⤵
  PID:8392
- C:\Windows\System\UdimcAd.exe
  C:\Windows\System\UdimcAd.exe
  2⤵
  PID:8328
- C:\Windows\System\azLVLcp.exe
  C:\Windows\System\azLVLcp.exe
  2⤵
  PID:8660
- C:\Windows\System\WPtXMBJ.exe
  C:\Windows\System\WPtXMBJ.exe
  2⤵
  PID:8676
- C:\Windows\System\XwNqJKa.exe
  C:\Windows\System\XwNqJKa.exe
  2⤵
  PID:8724
- C:\Windows\System\FpAHCLc.exe
  C:\Windows\System\FpAHCLc.exe
  2⤵
  PID:8764
- C:\Windows\System\NKFBuCa.exe
  C:\Windows\System\NKFBuCa.exe
  2⤵
  PID:8828
- C:\Windows\System\phQxJpf.exe
  C:\Windows\System\phQxJpf.exe
  2⤵
  PID:8892
- C:\Windows\System\QtkwOux.exe
  C:\Windows\System\QtkwOux.exe
  2⤵
  PID:8840
- C:\Windows\System\UuRstNP.exe
  C:\Windows\System\UuRstNP.exe
  2⤵
  PID:8808
- C:\Windows\System\aexUsQM.exe
  C:\Windows\System\aexUsQM.exe
  2⤵
  PID:8904
- C:\Windows\System\NzknPuY.exe
  C:\Windows\System\NzknPuY.exe
  2⤵
  PID:8956
- C:\Windows\System\lMWzeup.exe
  C:\Windows\System\lMWzeup.exe
  2⤵
  PID:9020
- C:\Windows\System\aLBQbWF.exe
  C:\Windows\System\aLBQbWF.exe
  2⤵
  PID:8968
- C:\Windows\System\YluGwto.exe
  C:\Windows\System\YluGwto.exe
  2⤵
  PID:9068
- C:\Windows\System\txUeJDF.exe
  C:\Windows\System\txUeJDF.exe
  2⤵
  PID:8936
- C:\Windows\System\bPlacBV.exe
  C:\Windows\System\bPlacBV.exe
  2⤵
  PID:9064
- C:\Windows\System\bTnXola.exe
  C:\Windows\System\bTnXola.exe
  2⤵
  PID:9132
- C:\Windows\System\TezGdti.exe
  C:\Windows\System\TezGdti.exe
  2⤵
  PID:9160
- C:\Windows\System\npqqfvz.exe
  C:\Windows\System\npqqfvz.exe
  2⤵
  PID:9208
- C:\Windows\System\wpzjTua.exe
  C:\Windows\System\wpzjTua.exe
  2⤵
  PID:7676
- C:\Windows\System\cULfztV.exe
  C:\Windows\System\cULfztV.exe
  2⤵
  PID:8340
- C:\Windows\System\GMEjIrc.exe
  C:\Windows\System\GMEjIrc.exe
  2⤵
  PID:2168
- C:\Windows\System\lNIFKHU.exe
  C:\Windows\System\lNIFKHU.exe
  2⤵
  PID:7416
- C:\Windows\System\ykUlyai.exe
  C:\Windows\System\ykUlyai.exe
  2⤵
  PID:8256
- C:\Windows\System\qnKlFMg.exe
  C:\Windows\System\qnKlFMg.exe
  2⤵
  PID:8372
- C:\Windows\System\KvsbThd.exe
  C:\Windows\System\KvsbThd.exe
  2⤵
  PID:8612
- C:\Windows\System\qMwhuYQ.exe
  C:\Windows\System\qMwhuYQ.exe
  2⤵
  PID:8356
- C:\Windows\System\cRSvMBY.exe
  C:\Windows\System\cRSvMBY.exe
  2⤵
  PID:8696
- C:\Windows\System\WpdhcYt.exe
  C:\Windows\System\WpdhcYt.exe
  2⤵
  PID:8760
- C:\Windows\System\dwormVh.exe
  C:\Windows\System\dwormVh.exe
  2⤵
  PID:8796
- C:\Windows\System\DVOzjPL.exe
  C:\Windows\System\DVOzjPL.exe
  2⤵
  PID:8776
- C:\Windows\System\CUpGZEJ.exe
  C:\Windows\System\CUpGZEJ.exe
  2⤵
  PID:8812
- C:\Windows\System\qpXusMv.exe
  C:\Windows\System\qpXusMv.exe
  2⤵
  PID:9016
- C:\Windows\System\UYDtPwS.exe
  C:\Windows\System\UYDtPwS.exe
  2⤵
  PID:9100
- C:\Windows\System\yLeTygn.exe
  C:\Windows\System\yLeTygn.exe
  2⤵
  PID:9032
- C:\Windows\System\QiMVzKV.exe
  C:\Windows\System\QiMVzKV.exe
  2⤵
  PID:9180
- C:\Windows\System\XiELwVZ.exe
  C:\Windows\System\XiELwVZ.exe
  2⤵
  PID:9080
- C:\Windows\System\tdlFLVE.exe
  C:\Windows\System\tdlFLVE.exe
  2⤵
  PID:8468
- C:\Windows\System\xpQIdqN.exe
  C:\Windows\System\xpQIdqN.exe
  2⤵
  PID:8360
- C:\Windows\System\zvlVHqn.exe
  C:\Windows\System\zvlVHqn.exe
  2⤵
  PID:8452
- C:\Windows\System\JXuTxpv.exe
  C:\Windows\System\JXuTxpv.exe
  2⤵
  PID:9052
- C:\Windows\System\UvnycAg.exe
  C:\Windows\System\UvnycAg.exe
  2⤵
  PID:8296
- C:\Windows\System\GOGcKGs.exe
  C:\Windows\System\GOGcKGs.exe
  2⤵
  PID:8312
- C:\Windows\System\afHDqmx.exe
  C:\Windows\System\afHDqmx.exe
  2⤵
  PID:8860
- C:\Windows\System\zkHtbiK.exe
  C:\Windows\System\zkHtbiK.exe
  2⤵
  PID:8876
- C:\Windows\System\ZsYNQUv.exe
  C:\Windows\System\ZsYNQUv.exe
  2⤵
  PID:9004
- C:\Windows\System\NxosCLV.exe
  C:\Windows\System\NxosCLV.exe
  2⤵
  PID:8712
- C:\Windows\System\fUCMayc.exe
  C:\Windows\System\fUCMayc.exe
  2⤵
  PID:8648
- C:\Windows\System\BpDMaVI.exe
  C:\Windows\System\BpDMaVI.exe
  2⤵
  PID:8888
- C:\Windows\System\YzHqajw.exe
  C:\Windows\System\YzHqajw.exe
  2⤵
  PID:8732
- C:\Windows\System\ELVpRiM.exe
  C:\Windows\System\ELVpRiM.exe
  2⤵
  PID:8600
- C:\Windows\System\fsWBSZz.exe
  C:\Windows\System\fsWBSZz.exe
  2⤵
  PID:9224
- C:\Windows\System\XclfQEF.exe
  C:\Windows\System\XclfQEF.exe
  2⤵
  PID:9240
- C:\Windows\System\cuNKqkB.exe
  C:\Windows\System\cuNKqkB.exe
  2⤵
  PID:9256
- C:\Windows\System\NMSqYZc.exe
  C:\Windows\System\NMSqYZc.exe
  2⤵
  PID:9272
- C:\Windows\System\GFcmYUM.exe
  C:\Windows\System\GFcmYUM.exe
  2⤵
  PID:9288
- C:\Windows\System\liEcmMS.exe
  C:\Windows\System\liEcmMS.exe
  2⤵
  PID:9304
- C:\Windows\System\SIdmroQ.exe
  C:\Windows\System\SIdmroQ.exe
  2⤵
  PID:9320
- C:\Windows\System\qdacigc.exe
  C:\Windows\System\qdacigc.exe
  2⤵
  PID:9336
- C:\Windows\System\nzhtTnU.exe
  C:\Windows\System\nzhtTnU.exe
  2⤵
  PID:9352
- C:\Windows\System\LkitIMF.exe
  C:\Windows\System\LkitIMF.exe
  2⤵
  PID:9372
- C:\Windows\System\AmHIvpW.exe
  C:\Windows\System\AmHIvpW.exe
  2⤵
  PID:9388
- C:\Windows\System\euUoHee.exe
  C:\Windows\System\euUoHee.exe
  2⤵
  PID:9404
- C:\Windows\System\reBJkUb.exe
  C:\Windows\System\reBJkUb.exe
  2⤵
  PID:9420
- C:\Windows\System\MmrpGRd.exe
  C:\Windows\System\MmrpGRd.exe
  2⤵
  PID:9436
- C:\Windows\System\QOIWsxS.exe
  C:\Windows\System\QOIWsxS.exe
  2⤵
  PID:9452
- C:\Windows\System\LWBgvXe.exe
  C:\Windows\System\LWBgvXe.exe
  2⤵
  PID:9468
- C:\Windows\System\LfWEeGf.exe
  C:\Windows\System\LfWEeGf.exe
  2⤵
  PID:9484
- C:\Windows\System\yKcwWbx.exe
  C:\Windows\System\yKcwWbx.exe
  2⤵
  PID:9504
- C:\Windows\System\pYzQaNo.exe
  C:\Windows\System\pYzQaNo.exe
  2⤵
  PID:9520
- C:\Windows\System\KnjPstw.exe
  C:\Windows\System\KnjPstw.exe
  2⤵
  PID:9536
- C:\Windows\System\DmesGUX.exe
  C:\Windows\System\DmesGUX.exe
  2⤵
  PID:9552
- C:\Windows\System\GJJcgmN.exe
  C:\Windows\System\GJJcgmN.exe
  2⤵
  PID:9572
- C:\Windows\System\hlDnlTL.exe
  C:\Windows\System\hlDnlTL.exe
  2⤵
  PID:9588
- C:\Windows\System\sYKdOlj.exe
  C:\Windows\System\sYKdOlj.exe
  2⤵
  PID:9604
- C:\Windows\System\vTrWxlj.exe
  C:\Windows\System\vTrWxlj.exe
  2⤵
  PID:9628
- C:\Windows\System\CGnFMzh.exe
  C:\Windows\System\CGnFMzh.exe
  2⤵
  PID:9644
- C:\Windows\System\bRhzDVz.exe
  C:\Windows\System\bRhzDVz.exe
  2⤵
  PID:9660
- C:\Windows\System\ZJbTSoj.exe
  C:\Windows\System\ZJbTSoj.exe
  2⤵
  PID:9680
- C:\Windows\System\EGgvVbp.exe
  C:\Windows\System\EGgvVbp.exe
  2⤵
  PID:9696
- C:\Windows\System\IhLgFIw.exe
  C:\Windows\System\IhLgFIw.exe
  2⤵
  PID:9712
- C:\Windows\System\AomHXEj.exe
  C:\Windows\System\AomHXEj.exe
  2⤵
  PID:9728
- C:\Windows\System\wSUOMIA.exe
  C:\Windows\System\wSUOMIA.exe
  2⤵
  PID:9744
- C:\Windows\System\RjjcXBd.exe
  C:\Windows\System\RjjcXBd.exe
  2⤵
  PID:9760
- C:\Windows\System\gmJOjKV.exe
  C:\Windows\System\gmJOjKV.exe
  2⤵
  PID:9776
- C:\Windows\System\rnecgIs.exe
  C:\Windows\System\rnecgIs.exe
  2⤵
  PID:9792
- C:\Windows\System\TDBVYQN.exe
  C:\Windows\System\TDBVYQN.exe
  2⤵
  PID:9812
- C:\Windows\System\WZmnhJy.exe
  C:\Windows\System\WZmnhJy.exe
  2⤵
  PID:9828
- C:\Windows\System\KBTlowg.exe
  C:\Windows\System\KBTlowg.exe
  2⤵
  PID:9844
- C:\Windows\System\OZVLmbN.exe
  C:\Windows\System\OZVLmbN.exe
  2⤵
  PID:9860
- C:\Windows\System\fKmxKst.exe
  C:\Windows\System\fKmxKst.exe
  2⤵
  PID:9876
- C:\Windows\System\JplDCtj.exe
  C:\Windows\System\JplDCtj.exe
  2⤵
  PID:9896
- C:\Windows\System\RDlOXPB.exe
  C:\Windows\System\RDlOXPB.exe
  2⤵
  PID:9912
- C:\Windows\System\SzHxWNi.exe
  C:\Windows\System\SzHxWNi.exe
  2⤵
  PID:9928
- C:\Windows\System\yVWBTIM.exe
  C:\Windows\System\yVWBTIM.exe
  2⤵
  PID:9944
- C:\Windows\System\HajjlTC.exe
  C:\Windows\System\HajjlTC.exe
  2⤵
  PID:9960
- C:\Windows\System\qwJxGYh.exe
  C:\Windows\System\qwJxGYh.exe
  2⤵
  PID:9976
- C:\Windows\System\aKWiZUh.exe
  C:\Windows\System\aKWiZUh.exe
  2⤵
  PID:9992
- C:\Windows\System\gEwtOSW.exe
  C:\Windows\System\gEwtOSW.exe
  2⤵
  PID:10008
- C:\Windows\System\vbhXdZj.exe
  C:\Windows\System\vbhXdZj.exe
  2⤵
  PID:10024
- C:\Windows\System\fjYunmn.exe
  C:\Windows\System\fjYunmn.exe
  2⤵
  PID:10040
- C:\Windows\System\wIvUIyP.exe
  C:\Windows\System\wIvUIyP.exe
  2⤵
  PID:10056
- C:\Windows\System\cahEbSg.exe
  C:\Windows\System\cahEbSg.exe
  2⤵
  PID:10072
- C:\Windows\System\GeAxZXe.exe
  C:\Windows\System\GeAxZXe.exe
  2⤵
  PID:10088
- C:\Windows\System\ZYUFPaE.exe
  C:\Windows\System\ZYUFPaE.exe
  2⤵
  PID:10104
- C:\Windows\System\aOEEUAP.exe
  C:\Windows\System\aOEEUAP.exe
  2⤵
  PID:10120
- C:\Windows\System\UovlJve.exe
  C:\Windows\System\UovlJve.exe
  2⤵
  PID:10136
- C:\Windows\System\hSSnwRb.exe
  C:\Windows\System\hSSnwRb.exe
  2⤵
  PID:10152
- C:\Windows\System\jmaLmNM.exe
  C:\Windows\System\jmaLmNM.exe
  2⤵
  PID:10168
- C:\Windows\System\OAZwSAl.exe
  C:\Windows\System\OAZwSAl.exe
  2⤵
  PID:10184
- C:\Windows\System\taEEVWo.exe
  C:\Windows\System\taEEVWo.exe
  2⤵
  PID:10200
- C:\Windows\System\HjgEDCE.exe
  C:\Windows\System\HjgEDCE.exe
  2⤵
  PID:10216
- C:\Windows\System\OlUwwnX.exe
  C:\Windows\System\OlUwwnX.exe
  2⤵
  PID:10232
- C:\Windows\System\WDXoqaX.exe
  C:\Windows\System\WDXoqaX.exe
  2⤵
  PID:9236
- C:\Windows\System\JakiTTv.exe
  C:\Windows\System\JakiTTv.exe
  2⤵
  PID:8244
- C:\Windows\System\OCvWneD.exe
  C:\Windows\System\OCvWneD.exe
  2⤵
  PID:8504
- C:\Windows\System\JuxQouu.exe
  C:\Windows\System\JuxQouu.exe
  2⤵
  PID:9328
- C:\Windows\System\YbiLKMF.exe
  C:\Windows\System\YbiLKMF.exe
  2⤵
  PID:9360
- C:\Windows\System\MyZEUfQ.exe
  C:\Windows\System\MyZEUfQ.exe
  2⤵
  PID:9312
- C:\Windows\System\yYikNWS.exe
  C:\Windows\System\yYikNWS.exe
  2⤵
  PID:9380
- C:\Windows\System\XHnaEkN.exe
  C:\Windows\System\XHnaEkN.exe
  2⤵
  PID:9460
- C:\Windows\System\cfYFugA.exe
  C:\Windows\System\cfYFugA.exe
  2⤵
  PID:9432
- C:\Windows\System\iXzHueN.exe
  C:\Windows\System\iXzHueN.exe
  2⤵
  PID:9448
- C:\Windows\System\jfuXnvO.exe
  C:\Windows\System\jfuXnvO.exe
  2⤵
  PID:9480
- C:\Windows\System\WQGLcif.exe
  C:\Windows\System\WQGLcif.exe
  2⤵
  PID:9512
- C:\Windows\System\msQrNdH.exe
  C:\Windows\System\msQrNdH.exe
  2⤵
  PID:9580
- C:\Windows\System\BMMSzFt.exe
  C:\Windows\System\BMMSzFt.exe
  2⤵
  PID:9612
- C:\Windows\System\TUexMME.exe
  C:\Windows\System\TUexMME.exe
  2⤵
  PID:9672
- C:\Windows\System\sioykbY.exe
  C:\Windows\System\sioykbY.exe
  2⤵
  PID:9624
- C:\Windows\System\fWcpzcb.exe
  C:\Windows\System\fWcpzcb.exe
  2⤵
  PID:9692
- C:\Windows\System\qhMSVta.exe
  C:\Windows\System\qhMSVta.exe
  2⤵
  PID:9720
- C:\Windows\System\ZFMuVUK.exe
  C:\Windows\System\ZFMuVUK.exe
  2⤵
  PID:9772
- C:\Windows\System\VEnKptH.exe
  C:\Windows\System\VEnKptH.exe
  2⤵
  PID:9808
- C:\Windows\System\IQWxgRv.exe
  C:\Windows\System\IQWxgRv.exe
  2⤵
  PID:9756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AOTpnoF.exe

Filesize
1.9MB

MD5
2afb73beae4bfef298c7c16fba9914c8

SHA1
0ce390c20d90679ef0a000621ce2ef0c1ee4b1c7

SHA256
fafb3428b01baa6f091c47049d76257528b9b23568fdce8865b771bddd42afd9

SHA512
af075445aa110e8680ca4d414c6264c01050ddfe1d8af653d226cd7a5593a7a50977f381d4c7b0b4c72dc0cd935406d790771e1f16184fbae9321cea5317d5d2

Download Submit
C:\Windows\system\ATThbaO.exe

Filesize
1.9MB

MD5
b85df0f0b12f9cc6afcb078d88131415

SHA1
0209fd74ab62d3ead0bd1ac8effefeb2e56698c8

SHA256
f13c140459d40aa493809a237ab7f9c3a71a807aa2b3dd5b9926d93725efd8bb

SHA512
f11e6990201c03b476a907c65ed094438a2842613b70674263586ee06b275b58e0fb784f9760299286878f822200e551786081895f26092535906805bc11d5b8

Download Submit
C:\Windows\system\BQzRaRq.exe

Filesize
1.8MB

MD5
a58caf4892a1dcb857ea68d4bf843908

SHA1
a2f04e5437c23cb7df4a8338fbff9b965ea7ab89

SHA256
563aee8330c41314c24e4e9bbf0687899dc31db270ce8cabb73b116fa80db9d7

SHA512
1fefd0738ee5cc62b6a29e78f7eaed5cca0a00b9dbf31a6a60d0cc61322a6197b686bb874f26a07379ab73939895a75792f459f8e5831f730a81ca0a6ef38f39

Download Submit
C:\Windows\system\BxGOwzy.exe

Filesize
1.9MB

MD5
3cbfd4cf4f1471bf66b671190e11d188

SHA1
991a39ce3851a0d11892890aaf11d019f63d8c2d

SHA256
9f7e0316f25dde9dac024f19a3882c1d167def3e8a32952d1a4144aec9a31f13

SHA512
0d89f7be298ea4d5d44c0c1efbf0cd5bf6a18bfa0cb5e0974b312d9a9870d030d43c9325c6dcab454ed7ebcd372fe96061664671e598fe5002df5c830a241d60

Download Submit
C:\Windows\system\DMBqosg.exe

Filesize
1.9MB

MD5
84f2b96175720a3a7a672930e6149af2

SHA1
ee55a9b8a78c7b584beda2b7ab7e18baddcd46e4

SHA256
4fb6370540454c631691cddb6043658eab28cc59e6ee9a693eb0812ae73278fd

SHA512
4c281bea6d8d1b2e0c8afc05adc45c9c52619ea10b95fa988edf8f6e0f769e4c610665f16a221476f43a1862db389ce9e327fb176a2138f4fd275eb81a9e639f

Download Submit
C:\Windows\system\FMMSpMt.exe

Filesize
1.8MB

MD5
4cf9416e0692eb9d483e306a7e5fbf87

SHA1
27ab57cf744b9eef00434870a747259b66ccccbe

SHA256
7d37614dcc30fb11138ee0d16801c933e4493a14c1d77e3037e3f889c3afd950

SHA512
7a0c67deeb954136226c4804c51be134492ecc1a975a91a81353f4eac88e7bc39ed8026b023707e6bae309b1980f05c6c930f5a5751d25a0ad0a432ca2d7193d

Download Submit
C:\Windows\system\GIXEuDj.exe

Filesize
1.9MB

MD5
c3427f2abc31023e1ba3e677aa5ec726

SHA1
8984959869e39e4d0d6b2de1067bc024d1e85534

SHA256
7f2b0bb6f3b045d8d1738168b295e73ceec6b491dd183a9c60e4eeff6bbd2948

SHA512
1be7c6b4afd470a634316320df51c6f3fe3c46c871ec030e9c949580689f8210faf230e94f953861e1fd62b324f32139fa60282ab26bef81a9df98aacf30a4be

Download Submit
C:\Windows\system\GvhkNfA.exe

Filesize
1.8MB

MD5
45fdf51f7f02a7bf300317743a909e9a

SHA1
f1335161e9b1c12ad7f8e3801caeeefb7c5ff222

SHA256
54755f9a16f4e6e41e4c0c94d5cd085e11498fa6878d7b61c6df10267222658a

SHA512
dfeaf7ecd1d8d232c1f126d7b80454f05bc9c5f6aaa282325f6e2604cc2f1d101eec86763a7a47e448083132d7d143da296db90c513126aff6aa946818acb727

Download Submit
C:\Windows\system\IBZvhSU.exe

Filesize
1.8MB

MD5
e298eef0fb7ef17452d0b5a90d274483

SHA1
d2630f93c0b5313f90e46768326f898f04e7dd63

SHA256
e54d0abd6b4187ccd8d56bb5bed50c3ecbef2f2292cee7ed5cf89219c54684ac

SHA512
07183055005a57356e8c17cb00b0bdbb8d533706c1cbd83007c44b9c858c0ca195014dcae4ee5b848ef06b9ec39668ec6601cb220c6fb93d610714ec0ab57190

Download Submit
C:\Windows\system\INVUnGe.exe

Filesize
1.8MB

MD5
294271448af68c97ac294470e5cec1c5

SHA1
2c8df2522e0e0e8af8620da98e17fc11fc843f95

SHA256
4c27029d9637e66806c7735eb3dcc58a57ac47d2432107cbdcc5ecc3b15359e3

SHA512
f1832c36b31480d248b0ea2cf6722a7ed528aa280b35e60d95e872ea29458a06a2572fbb9131689cb74b68f11b47debeda849df59a55d7e8b6792e30ef8f86b2

Download Submit
C:\Windows\system\KUgLdXR.exe

Filesize
1.8MB

MD5
0c9c9d382b0ca681158c4ff8833f3405

SHA1
da53544bfe5809643b07e5ae87ef543d81990ff8

SHA256
857bee47ec6c55189f566bd05eff6d7248e6b28fb7eadbcbe92de200f30232c0

SHA512
f5bfc77505560c6d3b87a802e13b4b1b39c84e8d77a58265321575ef4837a274a3b9ed4f3da2ae823075ceb9aa91c937b0dce89b9a83dca0434840451c5a7f76

Download Submit
C:\Windows\system\NaPpSGf.exe

Filesize
1.9MB

MD5
fe143cbd95d1ea5f75f0be476a0636c1

SHA1
eb76feddd0da8f3942c8717e98efc7898e50476b

SHA256
90ce8f0d00de23a7904e0dc173eb0ca90cb72ae147146cd92b892143d99146ca

SHA512
936a0674f25a81658eac68151f73c5738950a4739c2a0593246a25bd2f02e04970874dda27a51a9cedab41bce0fccf0888557d842ffb050d2a04cedd5aa9d15b

Download Submit
C:\Windows\system\OFyvwvl.exe

Filesize
1.8MB

MD5
0be8480f0aad2ae6eaf61ae4ecd9b658

SHA1
90114ccda12b5c0c767451b534a52d774aca430b

SHA256
e89d7091d95214aad8bcf4a46503b30fe72e5dcdbb8399803a1dc6bb666c4dc3

SHA512
2e0935a1338bc11f1fce664187e9ff59fad5796d2ac3ee8e4897df3cb73c1019ab5abfa7f00d3bf7880469a3ff2494f4c3705279176d3ddc62ffbcde0bb3df7b

Download Submit
C:\Windows\system\TMlnGLs.exe

Filesize
1.8MB

MD5
e6c70225ac98f286424896b22d7c01ba

SHA1
d49b877ebd641a83169923ce585c67de3d9d9885

SHA256
1e093f58a68a048dfb5df3201fbb5e02aa439efa69d420191d616deb35b14b68

SHA512
66f6efec067cfc71067180cc1e57f284e3bde6eef05d3cdeb4c50a8ca48a081156c5a13e8728c468a2da8ea58fac929df08a04c00ddc540cfb807182f5d67f72

Download Submit
C:\Windows\system\XFEULUt.exe

Filesize
1.8MB

MD5
bd23b86b12069fb8f984fdb4fc9a1d1a

SHA1
0d90e320a3df56975c4b6c2566e410c8f828ce0f

SHA256
34b5045f9cadeedbcfbbe7a3fa346c53d978fe68e74286b31f0c47414819a6b6

SHA512
26e8272ddff9f625d957810ba3c80a19434c5fe40ba8fc90f8dd906a77e2fb7df7327f28c466d39ccf4083ddad901859f78cc6a5bc2d85ddf82ef65a5d8f4601

Download Submit
C:\Windows\system\YIcygNY.exe

Filesize
1.8MB

MD5
4267931fa2836226136ac83a01554771

SHA1
97f74495bd7ae869bc50cb5b39d9f8dfde599ec2

SHA256
085002bd6066a1d51c61ba09e1cdf824990e993bd849b5b78c1c31ae253781f2

SHA512
ab3a3f2e49f13b5c9311594243c155e00aa7342ac71f139f580f10853a7fc85292c7d11412584051a2f3121f170a3dc6b630ceebf06dca8e020125a652b5cdf7

Download Submit
C:\Windows\system\brgNQLe.exe

Filesize
1.8MB

MD5
6b447748a42c8887b73541c0e92855ad

SHA1
fde297c5676babf4013b25a561ecf391b3a34482

SHA256
513875d315add46a653cb01109a05c02496efd40409031e6e9d597c8cb5709e3

SHA512
54faa1959ccd12d1aedf1476574b32400d44fd5a3b2b3c34cbcd883c6dfc136a9767c2e5e5856ef7c648a04e141d2ed3b6ee4763c36155def195ef05da029ea3

Download Submit
C:\Windows\system\jXYOJgc.exe

Filesize
1.8MB

MD5
03c70648d5e0a7dbba69118c74f21f60

SHA1
25bd70f3dbcffd1a67a0ae2228547fed823a6fd2

SHA256
b1889f1b179032e5a5e732496df58df58f59de96a4038c336de00cfdebc48604

SHA512
1599914822e9023360952a31e5a607c90dea092dc36f52539b68529babc9d35bc7d0b888212269f2ac729bd94ec5cb863997a3ba239c00807e41ef2c22b4e50b

Download Submit
C:\Windows\system\pdmqKJP.exe

Filesize
1.8MB

MD5
a1d604be36932698ea7dd3f3e574c481

SHA1
3d66772a9676c756bc6e3c6eb889354c1ac6338a

SHA256
a858c8865ca9ef26b1a85f20973eba5dfefce991f1eaa17d7da719cb25968664

SHA512
6f4db205ab8fb0b178e41863f8d78bb496f6b37830bcdf6f7974bedeab85ed267a916c80331181e662eb3ad7eff8dcea9b6e9d827ef1a197a7c3a8b25901d53c

Download Submit
C:\Windows\system\tHslZhA.exe

Filesize
1.8MB

MD5
dbe2aaf102b118e5695a1b8c06c440dc

SHA1
614491d135311f4c4c3a831f36466faee22ab185

SHA256
ac96281a30043be50c360fa482e9aee81b4ce61ddb38cd970065669b875006a1

SHA512
dd281e4296434ad0adef2add05c56ac4c535f738f892df5403e3643f53c668af17d8628a526627dfab801ad755b756e07626d8e7a2d346971a62b35a338a5d5d

Download Submit
C:\Windows\system\vGhcgzI.exe

Filesize
1.8MB

MD5
3dee7c7c27973e8ada5d2f1d07f2ef21

SHA1
2c5c3917fb60f2acd7a033ef99d80175c795d09c

SHA256
2ca9397180fbfd1d2a678dfcab4ea746d30ff4ec8361ba7cc75a111b7c0f40a2

SHA512
2f1d0a61d1af09045d856f80f1b4c09c90c35bdf48fec2e8993ef9fc2de1d5a8a6b76abfe9af433f2a58d283de82dcb4f974616ccc813d5ad6c1a3d3ad4e1b66

Download Submit
\Windows\system\DCYzcVk.exe

Filesize
1.8MB

MD5
0adb33d0c37ae5f1a7f5bc4793090503

SHA1
c5f39d9a06a55f24ca88261b349745688216a291

SHA256
a170e4f28614edfe3008302176d5a42d6912a39abb99cfbcc97dafd090f11369

SHA512
565a67fecdc101e106ecfabe646f434fd84780f7e00f36129664f6148a171e13a6e1715ace30f3356120b20284f3c2b977bdd243404b3b1b06247dec838a86b4

Download Submit
\Windows\system\FkzgeMF.exe

Filesize
1.8MB

MD5
87f4772115c66c8c44e8d2cb16209e49

SHA1
ab15f98a5c6ae995b2f82b14dbeccc0a6cddc1f8

SHA256
4ebb4677d469b7577ad2890bf25287f86a21316a5f30b3a17fd8be29cabbea70

SHA512
a4f32e948c3a54237dd8ba0766648c03e8f5263b712fe7e47088ac336f71cb43cb1b70b0efeabeb05e7d6df4d8ae795b2c32981c7e935cb751b35f77dadb2209

Download Submit
\Windows\system\LZQWXsh.exe

Filesize
1.8MB

MD5
44ff7d3525758cccc3cd2c30a870169b

SHA1
8bb57ddb0cb0ee83af90287e565805aa30fc7254

SHA256
6633062eadd356d61332fbfecd1bdb522a099d0bde3d7593d005f11af837a048

SHA512
be1f43e360d1b16dccfee511f34f0ab55fbf83e86c1a1614f5e78cd77f0bf2ec66db2642a7dfcf0aa8fbd5423353ea33f99cd50bd071ccdbabeee470beb414db

Download Submit
\Windows\system\LgDSUws.exe

Filesize
1.9MB

MD5
fdba8c5347a7bbc9d3c762be443568bf

SHA1
03b1d074bf8a5bf4573bdc250c67ca686e2f2d7c

SHA256
de9e468769eebe7f2874820076d84c2cf8adccedfd2ba61a3b047cecc53de9b2

SHA512
6463f7796b075eeb4a805ffbfdd752711a3e8d6bcc0dba886d02cacf9409a5d36a1f7891fdb4f92f725b22cc6d7ad5c63c6fe7fcc14904442c6d919201efd67a

Download Submit
\Windows\system\MRhjKYX.exe

Filesize
1.8MB

MD5
da7ea49604e14aebc13f36b3117c4544

SHA1
9de7a47292ff3feb33c9123ac3e472950d62be20

SHA256
13febb12417a9e29b5798ad08789926b5f642e07de443ed5f3d8e7a4eba3131e

SHA512
d74df55e97097e2d255bba061ed8835c4ac35f5b16102484f93a058845c8395ec725431e4123d2c08a6c37ef73f74249ec648b506b4adb372d8cb42f5f3fe37a

Download Submit
\Windows\system\NSLVBEf.exe

Filesize
1.8MB

MD5
ed0b0dd9c1ceeb8640bd769501441fe9

SHA1
82f3fac3e0bc1a217a2d34d95047adf4525683a4

SHA256
3e9180de249948a2fd94aa9e1375a11b6700b4aeaecb86e9ebd324d8d5f079c2

SHA512
c4a3d800100e74255b0dc9073c081633d8079cf52350468a551f3e6f7f29e16ea6bb17eee75018a1734fbbfae7c70b7f266c1c880a6d780738624fb7a9a357fb

Download Submit
\Windows\system\SXgXEPm.exe

Filesize
1.9MB

MD5
28b5d1c6462bfd031ec48c2bdce3b0bb

SHA1
b170ac024526beb9e58ea0f8d8134700ff1185f4

SHA256
58474a6c9a4a6820ad8d732eba373bc8cece6c8e19568f3153349989574a8cdf

SHA512
244ca21e43f306307ad5ac406c12a9574c4fdbf8f38c54fd43951ef7d3402eea644006b69f3dad838bb28685db88e316f3e53014568cd0097efb58ac7cf23597

Download Submit
\Windows\system\Ugoubmc.exe

Filesize
1.8MB

MD5
643b5fa911cc408b6f16d8275ab108e5

SHA1
4d73df07e9fa76f73b24e71a4738b7c3244de2a1

SHA256
d319d9aa6c5bcc3e6010c64a2fc917b93fc4d0bfa6f2d5adb4285c8be3918683

SHA512
bfbd0361d34cfa7cfb675a7336ad448241a1a1c8bdf20e0b3e6c83bd5a4704f762a37f5f990213dd2c1cc3ac06424e8bde0d3f50b2fe2839616e8f1fd51dabf1

Download Submit
\Windows\system\ZaCKjVr.exe

Filesize
1.8MB

MD5
a6dfcb8ff0e803d6d57a30937cea94e6

SHA1
ee9d2ae2bfe11b1dc64b2ceec84b33a5ab4434c2

SHA256
3129bdf6be04a9cbb603b8cd89514bc0d45a3d15b17cd58874112ea17743881a

SHA512
46e044315d9b8a8b8199d62e96aedbf33a412efe61794d5e82052b30082545d98ec18bea2bbb0789ea0af0b2564afc104fa003427e2c62d3388310939c017d5d

Download Submit
\Windows\system\bmxXSAq.exe

Filesize
1.8MB

MD5
a8e20e8cb6266a5a0b25df934eeae503

SHA1
fb7d23d1769dbb984bf6ce185b7ce0a71d26a6a5

SHA256
5b5e5288acc3081f68332a0d2bc13f92429f42fb28c4709e09177ace3d94a6f9

SHA512
fec4307e0a5c0d5fd0d027c8c1473af66b933126ee6664f2c48d4ce0ade520a4dc12638287718568a0d359dd59aab5594aa26d2142e272cf327b2dd28469b329

Download Submit
\Windows\system\bqPXEUH.exe

Filesize
1.8MB

MD5
92bb94667e00e33191120ad7de111557

SHA1
46b3b6285717725d8feb743b145a0ec5a1d122de

SHA256
223f6d51de90295557a9619bc1a9d72bb2702396435059af8ff58d552f41e1a5

SHA512
a1f3fc8a0d1a29d67e64edaf9adc5eb69ef2a9e9840ea29c2dae0e6b9953827dbcbea7e212ca97ddf015879fa83ef947da2280a28e66b2f76cf4ad85328ad4b3

Download Submit
\Windows\system\qLwcuUn.exe

Filesize
1.8MB

MD5
da62676a97ca3695f0c8413ea9f85915

SHA1
6fdd525f5fe23eb314701e45ed9d3f9bd50b75bb

SHA256
8d35d9ade4c656589ef850ed7f61130a768ec4815e243b4566371efd8cf9d4e2

SHA512
dc9504e2fbea97cd7628154dd7c9f2b488a48e0f15d29fde34d9b8829445a80d404156b9808e0826d3fa275cff976b4891931efdda4e6f4f2d9350b179c509a6

Download Submit
memory/328-86-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2076-61-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2160-0-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2160-85-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2160-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2160-77-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2160-57-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2160-80-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2160-84-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2160-62-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2160-87-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2160-12-0x0000000002840000-0x0000000002C32000-memory.dmp

Filesize
3.9MB

Download
memory/2160-69-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2160-54-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2232-13-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2296-74-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2380-79-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2388-64-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2444-81-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-56-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-53-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/3052-52-0x0000000002CD0000-0x0000000002D50000-memory.dmp

Filesize
512KB

Download
memory/3052-43-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/3052-83-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

Filesize
9.6MB

Download
memory/3052-158-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

Filesize
9.6MB

Download
memory/3052-48-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/3052-78-0x0000000002CD0000-0x0000000002D50000-memory.dmp

Filesize
512KB

Download
memory/3052-51-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

Filesize
9.6MB

Download
memory/3052-14-0x0000000002CD0000-0x0000000002D50000-memory.dmp

Filesize
512KB

Download