xmrig | b4c4210659a5c758dea647b8d1570d552d4d4b42559d19a04132fb791e6fcbba

Analysis

max time kernel
36s
max time network
34s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
Size

1.9MB
MD5

0ad9836af1cefd4ab562d5150fdb76c4
SHA1

77fc8c90a82cd746ca321c168398838f13e09f61
SHA256

b4c4210659a5c758dea647b8d1570d552d4d4b42559d19a04132fb791e6fcbba
SHA512

3df5805aeaf06fd52472240bb68789f444823164887d51f6c31829bf33c6b62a678c8a6de5b0f231f81693672349038e0310aa1780840ce25b1e0251e7f025db
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1G:NABn

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/1744-1-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2920-364-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2988-368-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/1744-365-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/2484-391-0x000000013F7A0000-0x000000013FB92000-memory.dmp	xmrig
behavioral1/memory/2884-394-0x000000013FFE0000-0x00000001403D2000-memory.dmp	xmrig
behavioral1/memory/2708-387-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/2444-383-0x000000013F7A0000-0x000000013FB92000-memory.dmp	xmrig
behavioral1/memory/2648-373-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2576-371-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2884	qvWMoww.exe
2920	qVBEbae.exe
2988	XbwsUya.exe
2576	nVtmJEP.exe
2648	fjAoKqC.exe
2704	ZVbemZb.exe
2560	XjiaYOg.exe
2444	kFLJZnq.exe
2552	NqcXkxe.exe
2708	QWWSlvH.exe
2136	TZEKfKa.exe
2484	yobyWVW.exe
2436	OTmOzwu.exe
2480	zzvegPS.exe
2032	jlYMIfv.exe
2944	YQKeDJr.exe
2872	sGvAMaS.exe
1204	EVxkUXt.exe
1668	vCdXbFH.exe
768	urUKKyi.exe
312	xLQlxSg.exe
816	dGitzGw.exe
2040	HxgHKUG.exe
1872	hLejyvb.exe
1052	HASBhZp.exe
600	ylXBVXm.exe
576	rEkauzf.exe
1136	yIexMqT.exe
1628	dJdePNx.exe
1752	dIpLytu.exe
556	tksVOzX.exe
2736	FfgBtTV.exe
2832	dBMVsmG.exe
2620	yYewfqf.exe
1520	wqImDos.exe
2420	LEWfeRm.exe
2072	yRWMYvi.exe
2808	WGRgHUD.exe
2796	BpZeuiG.exe
3028	CMKBGRY.exe
584	AdRbzMG.exe
2144	WehKhxp.exe
1904	KtfuHXl.exe
560	EgHcsGI.exe
1868	IObAakI.exe
108	AePlMEA.exe
1088	CEAZrKK.exe
2396	NZNVcyb.exe
3052	cGzSLeB.exe
3044	vjfYwVX.exe
848	oNDyjfK.exe
1172	hubFTpD.exe
1580	yQPCXTM.exe
928	QhWtwoq.exe
1344	EWVXVVy.exe
1876	OBrPwEy.exe
1808	tMgnRfJ.exe
1796	GXilIJq.exe
1804	XWTyisZ.exe
960	ZLbknhl.exe
2160	XaiQTEN.exe
1384	UYIuJvG.exe
1740	jRiYsYb.exe
2812	piAOBQp.exe

Loads dropped DLL 64 IoCs

pid	Process
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1744-1-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/files/0x000c00000001225d-3.dat	upx
behavioral1/files/0x0008000000016122-14.dat	upx
behavioral1/files/0x00070000000164ec-25.dat	upx
behavioral1/files/0x00070000000163eb-22.dat	upx
behavioral1/files/0x00070000000161ee-18.dat	upx
behavioral1/files/0x0032000000015d85-10.dat	upx
behavioral1/files/0x0006000000016d81-45.dat	upx
behavioral1/files/0x0006000000016f7e-61.dat	upx
behavioral1/files/0x0006000000016e56-57.dat	upx
behavioral1/files/0x0006000000016da9-53.dat	upx
behavioral1/files/0x000600000001738c-73.dat	upx
behavioral1/files/0x00060000000173df-83.dat	upx
behavioral1/files/0x000600000001748d-101.dat	upx
behavioral1/files/0x0005000000018674-117.dat	upx
behavioral1/files/0x00060000000190bc-129.dat	upx
behavioral1/memory/1744-351-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/memory/2920-364-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/2988-368-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/memory/2704-379-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2552-385-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/memory/2484-391-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/memory/2884-394-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/memory/2136-389-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/memory/2708-387-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/2444-383-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/memory/2560-381-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/2648-373-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/2576-371-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/files/0x00060000000190b3-125.dat	upx
behavioral1/files/0x000500000001877f-121.dat	upx
behavioral1/files/0x000d00000001865b-113.dat	upx
behavioral1/files/0x000600000001864a-109.dat	upx
behavioral1/files/0x0006000000017510-105.dat	upx
behavioral1/files/0x0006000000017472-97.dat	upx
behavioral1/files/0x000600000001745d-93.dat	upx
behavioral1/files/0x00060000000173e7-89.dat	upx
behavioral1/files/0x00060000000173dc-82.dat	upx
behavioral1/files/0x00060000000173c5-77.dat	upx
behavioral1/files/0x000600000001737e-69.dat	upx
behavioral1/files/0x000600000001737b-65.dat	upx
behavioral1/files/0x0006000000016d85-49.dat	upx
behavioral1/files/0x0006000000016d31-41.dat	upx
behavioral1/files/0x0006000000016d29-37.dat	upx
behavioral1/files/0x0008000000016d21-33.dat	upx
behavioral1/files/0x0007000000016575-30.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mIHrOaF.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\rEqnWlt.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\vedfKgs.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\JFVpLQt.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\KIzCTgw.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\phWHFLL.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\zXlrbio.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\vNmujBV.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\MsDAUyy.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\AQoBcKw.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\urrDIRw.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\dBMVsmG.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\WASDfmK.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\KMFFIDw.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\mFcMBjB.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\ZqrIuON.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\GfCPzsr.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\gIAoOZi.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\TDchmaA.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\boyzsPC.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\LwXJOak.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\yBSbnNT.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\mflwLyX.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\VUkKzgq.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\ToMNOaj.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\hStstBF.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\FGPdKfR.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\uofvdJb.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\YuyDVNR.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\CJCClMa.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\IstnGKJ.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\qBPsvZF.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\vOYxUca.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\aJfWXyx.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\mhDORKX.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\fmZkqpR.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\ZAsSRQN.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\LJflcsv.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\juynHAf.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\czFWLqQ.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\zsNibht.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\qYYoVUf.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\zlMHUob.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\svqNVgS.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\GVCWaPc.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\SKaRDLi.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\hSmbhyi.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\AXnvfqI.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\maBGOXA.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\nvDxrYi.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\qwjUlap.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\xMIsVqv.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\PlJtHZj.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\caCZKLl.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\tLABjhR.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\WQRKiIO.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\ZbmLsGG.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\UwuaXXa.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\xKZfsjh.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\WxWeEMk.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\LYeELgS.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\qSdfyiC.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\kEdBLdT.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
File created	C:\Windows\System\LKIbMYf.exe	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2840	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
Token: SeDebugPrivilege	2840	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2840	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	29
PID 1744 wrote to memory of 2840	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	29
PID 1744 wrote to memory of 2840	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	29
PID 1744 wrote to memory of 2884	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	30
PID 1744 wrote to memory of 2884	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	30
PID 1744 wrote to memory of 2884	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	30
PID 1744 wrote to memory of 2920	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2920	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2920	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	31
PID 1744 wrote to memory of 2988	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	32
PID 1744 wrote to memory of 2988	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	32
PID 1744 wrote to memory of 2988	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	32
PID 1744 wrote to memory of 2576	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	33
PID 1744 wrote to memory of 2576	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	33
PID 1744 wrote to memory of 2576	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	33
PID 1744 wrote to memory of 2648	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	34
PID 1744 wrote to memory of 2648	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	34
PID 1744 wrote to memory of 2648	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	34
PID 1744 wrote to memory of 2704	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	35
PID 1744 wrote to memory of 2704	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	35
PID 1744 wrote to memory of 2704	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	35
PID 1744 wrote to memory of 2560	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	36
PID 1744 wrote to memory of 2560	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	36
PID 1744 wrote to memory of 2560	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	36
PID 1744 wrote to memory of 2444	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	37
PID 1744 wrote to memory of 2444	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	37
PID 1744 wrote to memory of 2444	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	37
PID 1744 wrote to memory of 2552	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	38
PID 1744 wrote to memory of 2552	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	38
PID 1744 wrote to memory of 2552	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	38
PID 1744 wrote to memory of 2708	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	39
PID 1744 wrote to memory of 2708	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	39
PID 1744 wrote to memory of 2708	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	39
PID 1744 wrote to memory of 2136	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	40
PID 1744 wrote to memory of 2136	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	40
PID 1744 wrote to memory of 2136	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	40
PID 1744 wrote to memory of 2484	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	41
PID 1744 wrote to memory of 2484	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	41
PID 1744 wrote to memory of 2484	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	41
PID 1744 wrote to memory of 2436	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	42
PID 1744 wrote to memory of 2436	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	42
PID 1744 wrote to memory of 2436	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	42
PID 1744 wrote to memory of 2480	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	43
PID 1744 wrote to memory of 2480	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	43
PID 1744 wrote to memory of 2480	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	43
PID 1744 wrote to memory of 2032	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	44
PID 1744 wrote to memory of 2032	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	44
PID 1744 wrote to memory of 2032	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	44
PID 1744 wrote to memory of 2944	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	45
PID 1744 wrote to memory of 2944	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	45
PID 1744 wrote to memory of 2944	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	45
PID 1744 wrote to memory of 2872	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	46
PID 1744 wrote to memory of 2872	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	46
PID 1744 wrote to memory of 2872	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	46
PID 1744 wrote to memory of 1204	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	47
PID 1744 wrote to memory of 1204	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	47
PID 1744 wrote to memory of 1204	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	47
PID 1744 wrote to memory of 1668	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	48
PID 1744 wrote to memory of 1668	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	48
PID 1744 wrote to memory of 1668	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	48
PID 1744 wrote to memory of 768	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	49
PID 1744 wrote to memory of 768	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	49
PID 1744 wrote to memory of 768	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	49
PID 1744 wrote to memory of 312	1744	0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ad9836af1cefd4ab562d5150fdb76c4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\System\qvWMoww.exe
  C:\Windows\System\qvWMoww.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\qVBEbae.exe
  C:\Windows\System\qVBEbae.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\XbwsUya.exe
  C:\Windows\System\XbwsUya.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\nVtmJEP.exe
  C:\Windows\System\nVtmJEP.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\fjAoKqC.exe
  C:\Windows\System\fjAoKqC.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\ZVbemZb.exe
  C:\Windows\System\ZVbemZb.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\XjiaYOg.exe
  C:\Windows\System\XjiaYOg.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\kFLJZnq.exe
  C:\Windows\System\kFLJZnq.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\NqcXkxe.exe
  C:\Windows\System\NqcXkxe.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\QWWSlvH.exe
  C:\Windows\System\QWWSlvH.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\TZEKfKa.exe
  C:\Windows\System\TZEKfKa.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\yobyWVW.exe
  C:\Windows\System\yobyWVW.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\OTmOzwu.exe
  C:\Windows\System\OTmOzwu.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\zzvegPS.exe
  C:\Windows\System\zzvegPS.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\jlYMIfv.exe
  C:\Windows\System\jlYMIfv.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\YQKeDJr.exe
  C:\Windows\System\YQKeDJr.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\sGvAMaS.exe
  C:\Windows\System\sGvAMaS.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\EVxkUXt.exe
  C:\Windows\System\EVxkUXt.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\vCdXbFH.exe
  C:\Windows\System\vCdXbFH.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\urUKKyi.exe
  C:\Windows\System\urUKKyi.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\xLQlxSg.exe
  C:\Windows\System\xLQlxSg.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\dGitzGw.exe
  C:\Windows\System\dGitzGw.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\HxgHKUG.exe
  C:\Windows\System\HxgHKUG.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\hLejyvb.exe
  C:\Windows\System\hLejyvb.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\HASBhZp.exe
  C:\Windows\System\HASBhZp.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\ylXBVXm.exe
  C:\Windows\System\ylXBVXm.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\rEkauzf.exe
  C:\Windows\System\rEkauzf.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\yIexMqT.exe
  C:\Windows\System\yIexMqT.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\dJdePNx.exe
  C:\Windows\System\dJdePNx.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\dIpLytu.exe
  C:\Windows\System\dIpLytu.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\tksVOzX.exe
  C:\Windows\System\tksVOzX.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\FfgBtTV.exe
  C:\Windows\System\FfgBtTV.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\dBMVsmG.exe
  C:\Windows\System\dBMVsmG.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\yYewfqf.exe
  C:\Windows\System\yYewfqf.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\wqImDos.exe
  C:\Windows\System\wqImDos.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\LEWfeRm.exe
  C:\Windows\System\LEWfeRm.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\yRWMYvi.exe
  C:\Windows\System\yRWMYvi.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\WGRgHUD.exe
  C:\Windows\System\WGRgHUD.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\BpZeuiG.exe
  C:\Windows\System\BpZeuiG.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\CMKBGRY.exe
  C:\Windows\System\CMKBGRY.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\AdRbzMG.exe
  C:\Windows\System\AdRbzMG.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\WehKhxp.exe
  C:\Windows\System\WehKhxp.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\KtfuHXl.exe
  C:\Windows\System\KtfuHXl.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\EgHcsGI.exe
  C:\Windows\System\EgHcsGI.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\IObAakI.exe
  C:\Windows\System\IObAakI.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\AePlMEA.exe
  C:\Windows\System\AePlMEA.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\CEAZrKK.exe
  C:\Windows\System\CEAZrKK.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\NZNVcyb.exe
  C:\Windows\System\NZNVcyb.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\cGzSLeB.exe
  C:\Windows\System\cGzSLeB.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\vjfYwVX.exe
  C:\Windows\System\vjfYwVX.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\oNDyjfK.exe
  C:\Windows\System\oNDyjfK.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\hubFTpD.exe
  C:\Windows\System\hubFTpD.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\yQPCXTM.exe
  C:\Windows\System\yQPCXTM.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\QhWtwoq.exe
  C:\Windows\System\QhWtwoq.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\EWVXVVy.exe
  C:\Windows\System\EWVXVVy.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\OBrPwEy.exe
  C:\Windows\System\OBrPwEy.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\tMgnRfJ.exe
  C:\Windows\System\tMgnRfJ.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\GXilIJq.exe
  C:\Windows\System\GXilIJq.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\XWTyisZ.exe
  C:\Windows\System\XWTyisZ.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\ZLbknhl.exe
  C:\Windows\System\ZLbknhl.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\XaiQTEN.exe
  C:\Windows\System\XaiQTEN.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\UYIuJvG.exe
  C:\Windows\System\UYIuJvG.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\jRiYsYb.exe
  C:\Windows\System\jRiYsYb.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\piAOBQp.exe
  C:\Windows\System\piAOBQp.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\QUQGbWI.exe
  C:\Windows\System\QUQGbWI.exe
  2⤵
  PID:360
- C:\Windows\System\sALttcj.exe
  C:\Windows\System\sALttcj.exe
  2⤵
  PID:1728
- C:\Windows\System\FnLYwpM.exe
  C:\Windows\System\FnLYwpM.exe
  2⤵
  PID:1584
- C:\Windows\System\rtrfquV.exe
  C:\Windows\System\rtrfquV.exe
  2⤵
  PID:2172
- C:\Windows\System\SXYQUuC.exe
  C:\Windows\System\SXYQUuC.exe
  2⤵
  PID:1440
- C:\Windows\System\ZIICRRr.exe
  C:\Windows\System\ZIICRRr.exe
  2⤵
  PID:2112
- C:\Windows\System\zeoGTbz.exe
  C:\Windows\System\zeoGTbz.exe
  2⤵
  PID:2152
- C:\Windows\System\OCqIAnK.exe
  C:\Windows\System\OCqIAnK.exe
  2⤵
  PID:2324
- C:\Windows\System\AdMYdlf.exe
  C:\Windows\System\AdMYdlf.exe
  2⤵
  PID:1604
- C:\Windows\System\MEacrDC.exe
  C:\Windows\System\MEacrDC.exe
  2⤵
  PID:2328
- C:\Windows\System\vpRhNBZ.exe
  C:\Windows\System\vpRhNBZ.exe
  2⤵
  PID:2148
- C:\Windows\System\qwjUlap.exe
  C:\Windows\System\qwjUlap.exe
  2⤵
  PID:2932
- C:\Windows\System\uyPjzfJ.exe
  C:\Windows\System\uyPjzfJ.exe
  2⤵
  PID:2660
- C:\Windows\System\urKsZwr.exe
  C:\Windows\System\urKsZwr.exe
  2⤵
  PID:2568
- C:\Windows\System\Bbbxfci.exe
  C:\Windows\System\Bbbxfci.exe
  2⤵
  PID:2472
- C:\Windows\System\ybJynSi.exe
  C:\Windows\System\ybJynSi.exe
  2⤵
  PID:2600
- C:\Windows\System\EhrbYeq.exe
  C:\Windows\System\EhrbYeq.exe
  2⤵
  PID:2456
- C:\Windows\System\rLzuFIy.exe
  C:\Windows\System\rLzuFIy.exe
  2⤵
  PID:2900
- C:\Windows\System\rrPXMVK.exe
  C:\Windows\System\rrPXMVK.exe
  2⤵
  PID:2016
- C:\Windows\System\mkhemkf.exe
  C:\Windows\System\mkhemkf.exe
  2⤵
  PID:624
- C:\Windows\System\MIfddcb.exe
  C:\Windows\System\MIfddcb.exe
  2⤵
  PID:1444
- C:\Windows\System\eEpSjQO.exe
  C:\Windows\System\eEpSjQO.exe
  2⤵
  PID:1032
- C:\Windows\System\XGxtngT.exe
  C:\Windows\System\XGxtngT.exe
  2⤵
  PID:2008
- C:\Windows\System\IHzzsWP.exe
  C:\Windows\System\IHzzsWP.exe
  2⤵
  PID:336
- C:\Windows\System\cxaYwcw.exe
  C:\Windows\System\cxaYwcw.exe
  2⤵
  PID:1092
- C:\Windows\System\AGYaLHQ.exe
  C:\Windows\System\AGYaLHQ.exe
  2⤵
  PID:1764
- C:\Windows\System\UbyslzT.exe
  C:\Windows\System\UbyslzT.exe
  2⤵
  PID:2476
- C:\Windows\System\pfVZQfA.exe
  C:\Windows\System\pfVZQfA.exe
  2⤵
  PID:2536
- C:\Windows\System\GGShuOt.exe
  C:\Windows\System\GGShuOt.exe
  2⤵
  PID:2852
- C:\Windows\System\nEjswxB.exe
  C:\Windows\System\nEjswxB.exe
  2⤵
  PID:2308
- C:\Windows\System\GoRwSez.exe
  C:\Windows\System\GoRwSez.exe
  2⤵
  PID:2804
- C:\Windows\System\zfzuvTL.exe
  C:\Windows\System\zfzuvTL.exe
  2⤵
  PID:1408
- C:\Windows\System\ccQTGPl.exe
  C:\Windows\System\ccQTGPl.exe
  2⤵
  PID:1104
- C:\Windows\System\HSjyJox.exe
  C:\Windows\System\HSjyJox.exe
  2⤵
  PID:2912
- C:\Windows\System\xFnjWcj.exe
  C:\Windows\System\xFnjWcj.exe
  2⤵
  PID:2664
- C:\Windows\System\VLKYSFs.exe
  C:\Windows\System\VLKYSFs.exe
  2⤵
  PID:2392
- C:\Windows\System\Suczkto.exe
  C:\Windows\System\Suczkto.exe
  2⤵
  PID:3040
- C:\Windows\System\UUgZirP.exe
  C:\Windows\System\UUgZirP.exe
  2⤵
  PID:1044
- C:\Windows\System\lvoBLXD.exe
  C:\Windows\System\lvoBLXD.exe
  2⤵
  PID:2540
- C:\Windows\System\AglJiBN.exe
  C:\Windows\System\AglJiBN.exe
  2⤵
  PID:1616
- C:\Windows\System\KXKqxod.exe
  C:\Windows\System\KXKqxod.exe
  2⤵
  PID:2652
- C:\Windows\System\fknIosC.exe
  C:\Windows\System\fknIosC.exe
  2⤵
  PID:1972
- C:\Windows\System\rWWUwUG.exe
  C:\Windows\System\rWWUwUG.exe
  2⤵
  PID:916
- C:\Windows\System\hsscckN.exe
  C:\Windows\System\hsscckN.exe
  2⤵
  PID:616
- C:\Windows\System\Twzvqnt.exe
  C:\Windows\System\Twzvqnt.exe
  2⤵
  PID:2080
- C:\Windows\System\jGWRFuv.exe
  C:\Windows\System\jGWRFuv.exe
  2⤵
  PID:1944
- C:\Windows\System\fcafptl.exe
  C:\Windows\System\fcafptl.exe
  2⤵
  PID:3000
- C:\Windows\System\IMmUyhV.exe
  C:\Windows\System\IMmUyhV.exe
  2⤵
  PID:1756
- C:\Windows\System\iTpBOxl.exe
  C:\Windows\System\iTpBOxl.exe
  2⤵
  PID:2296
- C:\Windows\System\IrZXiSk.exe
  C:\Windows\System\IrZXiSk.exe
  2⤵
  PID:2096
- C:\Windows\System\EQRXIrS.exe
  C:\Windows\System\EQRXIrS.exe
  2⤵
  PID:2824
- C:\Windows\System\LwXJOak.exe
  C:\Windows\System\LwXJOak.exe
  2⤵
  PID:2632
- C:\Windows\System\evAiFHx.exe
  C:\Windows\System\evAiFHx.exe
  2⤵
  PID:2720
- C:\Windows\System\QZHObAH.exe
  C:\Windows\System\QZHObAH.exe
  2⤵
  PID:2936
- C:\Windows\System\zPvwbZV.exe
  C:\Windows\System\zPvwbZV.exe
  2⤵
  PID:2868
- C:\Windows\System\xTzQKKW.exe
  C:\Windows\System\xTzQKKW.exe
  2⤵
  PID:404
- C:\Windows\System\POQNNfy.exe
  C:\Windows\System\POQNNfy.exe
  2⤵
  PID:1056
- C:\Windows\System\RppZYTs.exe
  C:\Windows\System\RppZYTs.exe
  2⤵
  PID:964
- C:\Windows\System\CWvsKAn.exe
  C:\Windows\System\CWvsKAn.exe
  2⤵
  PID:1680
- C:\Windows\System\kBWCJTQ.exe
  C:\Windows\System\kBWCJTQ.exe
  2⤵
  PID:2612
- C:\Windows\System\SWLRWtI.exe
  C:\Windows\System\SWLRWtI.exe
  2⤵
  PID:2088
- C:\Windows\System\qTCFgHX.exe
  C:\Windows\System\qTCFgHX.exe
  2⤵
  PID:2952
- C:\Windows\System\mrCjvBb.exe
  C:\Windows\System\mrCjvBb.exe
  2⤵
  PID:644
- C:\Windows\System\UnNZZua.exe
  C:\Windows\System\UnNZZua.exe
  2⤵
  PID:1556
- C:\Windows\System\CtewkNq.exe
  C:\Windows\System\CtewkNq.exe
  2⤵
  PID:2972
- C:\Windows\System\tFgAUCx.exe
  C:\Windows\System\tFgAUCx.exe
  2⤵
  PID:2784
- C:\Windows\System\RNODDkf.exe
  C:\Windows\System\RNODDkf.exe
  2⤵
  PID:1652
- C:\Windows\System\oBiMeaO.exe
  C:\Windows\System\oBiMeaO.exe
  2⤵
  PID:2636
- C:\Windows\System\ghCOmuL.exe
  C:\Windows\System\ghCOmuL.exe
  2⤵
  PID:2592
- C:\Windows\System\oIFHuej.exe
  C:\Windows\System\oIFHuej.exe
  2⤵
  PID:1508
- C:\Windows\System\LfIzlBq.exe
  C:\Windows\System\LfIzlBq.exe
  2⤵
  PID:2888
- C:\Windows\System\vlpxTqY.exe
  C:\Windows\System\vlpxTqY.exe
  2⤵
  PID:2672
- C:\Windows\System\LjiWsuY.exe
  C:\Windows\System\LjiWsuY.exe
  2⤵
  PID:2236
- C:\Windows\System\CnFdpzh.exe
  C:\Windows\System\CnFdpzh.exe
  2⤵
  PID:2012
- C:\Windows\System\Bbljgsx.exe
  C:\Windows\System\Bbljgsx.exe
  2⤵
  PID:2848
- C:\Windows\System\DAEWaFg.exe
  C:\Windows\System\DAEWaFg.exe
  2⤵
  PID:2628
- C:\Windows\System\oPuLfdK.exe
  C:\Windows\System\oPuLfdK.exe
  2⤵
  PID:2068
- C:\Windows\System\RXNIreI.exe
  C:\Windows\System\RXNIreI.exe
  2⤵
  PID:860
- C:\Windows\System\QYXgleJ.exe
  C:\Windows\System\QYXgleJ.exe
  2⤵
  PID:2728
- C:\Windows\System\zksAnrP.exe
  C:\Windows\System\zksAnrP.exe
  2⤵
  PID:2056
- C:\Windows\System\YHMqJcB.exe
  C:\Windows\System\YHMqJcB.exe
  2⤵
  PID:2332
- C:\Windows\System\AeBCDRv.exe
  C:\Windows\System\AeBCDRv.exe
  2⤵
  PID:1880
- C:\Windows\System\qFZVsJK.exe
  C:\Windows\System\qFZVsJK.exe
  2⤵
  PID:2800
- C:\Windows\System\ngMXwoj.exe
  C:\Windows\System\ngMXwoj.exe
  2⤵
  PID:3092
- C:\Windows\System\lMislla.exe
  C:\Windows\System\lMislla.exe
  2⤵
  PID:3120
- C:\Windows\System\EJRoxcG.exe
  C:\Windows\System\EJRoxcG.exe
  2⤵
  PID:3140
- C:\Windows\System\mPvYClj.exe
  C:\Windows\System\mPvYClj.exe
  2⤵
  PID:3160
- C:\Windows\System\FgySPAk.exe
  C:\Windows\System\FgySPAk.exe
  2⤵
  PID:3176
- C:\Windows\System\eqrAMNf.exe
  C:\Windows\System\eqrAMNf.exe
  2⤵
  PID:3192
- C:\Windows\System\sYldJvE.exe
  C:\Windows\System\sYldJvE.exe
  2⤵
  PID:3208
- C:\Windows\System\HccxLxX.exe
  C:\Windows\System\HccxLxX.exe
  2⤵
  PID:3336
- C:\Windows\System\NJmJuJp.exe
  C:\Windows\System\NJmJuJp.exe
  2⤵
  PID:3384
- C:\Windows\System\AJOHRgd.exe
  C:\Windows\System\AJOHRgd.exe
  2⤵
  PID:3540
- C:\Windows\System\yfyRwiA.exe
  C:\Windows\System\yfyRwiA.exe
  2⤵
  PID:3584
- C:\Windows\System\fTAXIin.exe
  C:\Windows\System\fTAXIin.exe
  2⤵
  PID:3620
- C:\Windows\System\fQJBxxS.exe
  C:\Windows\System\fQJBxxS.exe
  2⤵
  PID:3644
- C:\Windows\System\BCiKqZX.exe
  C:\Windows\System\BCiKqZX.exe
  2⤵
  PID:3684
- C:\Windows\System\OuMWghX.exe
  C:\Windows\System\OuMWghX.exe
  2⤵
  PID:3704
- C:\Windows\System\FaVbqzm.exe
  C:\Windows\System\FaVbqzm.exe
  2⤵
  PID:3736
- C:\Windows\System\DdvlpXQ.exe
  C:\Windows\System\DdvlpXQ.exe
  2⤵
  PID:3848
- C:\Windows\System\RoMkxrY.exe
  C:\Windows\System\RoMkxrY.exe
  2⤵
  PID:3864
- C:\Windows\System\hhkqSTu.exe
  C:\Windows\System\hhkqSTu.exe
  2⤵
  PID:3900
- C:\Windows\System\xMIsVqv.exe
  C:\Windows\System\xMIsVqv.exe
  2⤵
  PID:3952
- C:\Windows\System\kdfkNQn.exe
  C:\Windows\System\kdfkNQn.exe
  2⤵
  PID:3996
- C:\Windows\System\RFsKxGn.exe
  C:\Windows\System\RFsKxGn.exe
  2⤵
  PID:4032
- C:\Windows\System\OgXgIps.exe
  C:\Windows\System\OgXgIps.exe
  2⤵
  PID:4052
- C:\Windows\System\pIAeglN.exe
  C:\Windows\System\pIAeglN.exe
  2⤵
  PID:4072
- C:\Windows\System\SvpsqDO.exe
  C:\Windows\System\SvpsqDO.exe
  2⤵
  PID:4092
- C:\Windows\System\NXqAChe.exe
  C:\Windows\System\NXqAChe.exe
  2⤵
  PID:772
- C:\Windows\System\KGSLtZp.exe
  C:\Windows\System\KGSLtZp.exe
  2⤵
  PID:1828
- C:\Windows\System\kLEOKWb.exe
  C:\Windows\System\kLEOKWb.exe
  2⤵
  PID:2496
- C:\Windows\System\WxWeEMk.exe
  C:\Windows\System\WxWeEMk.exe
  2⤵
  PID:3084
- C:\Windows\System\svNpGaX.exe
  C:\Windows\System\svNpGaX.exe
  2⤵
  PID:3088
- C:\Windows\System\MBCJAPG.exe
  C:\Windows\System\MBCJAPG.exe
  2⤵
  PID:3108
- C:\Windows\System\VZaHFHb.exe
  C:\Windows\System\VZaHFHb.exe
  2⤵
  PID:488
- C:\Windows\System\RqRGnlr.exe
  C:\Windows\System\RqRGnlr.exe
  2⤵
  PID:3204
- C:\Windows\System\hXYgofX.exe
  C:\Windows\System\hXYgofX.exe
  2⤵
  PID:1716
- C:\Windows\System\TANUgjT.exe
  C:\Windows\System\TANUgjT.exe
  2⤵
  PID:3156
- C:\Windows\System\fIaanYG.exe
  C:\Windows\System\fIaanYG.exe
  2⤵
  PID:900
- C:\Windows\System\RXudBUY.exe
  C:\Windows\System\RXudBUY.exe
  2⤵
  PID:3236
- C:\Windows\System\hPKDeAu.exe
  C:\Windows\System\hPKDeAu.exe
  2⤵
  PID:3276
- C:\Windows\System\BQgcToy.exe
  C:\Windows\System\BQgcToy.exe
  2⤵
  PID:2212
- C:\Windows\System\ykfUXNq.exe
  C:\Windows\System\ykfUXNq.exe
  2⤵
  PID:2368
- C:\Windows\System\YffBEeu.exe
  C:\Windows\System\YffBEeu.exe
  2⤵
  PID:3284
- C:\Windows\System\wMTQtqN.exe
  C:\Windows\System\wMTQtqN.exe
  2⤵
  PID:3300
- C:\Windows\System\NaORBib.exe
  C:\Windows\System\NaORBib.exe
  2⤵
  PID:3320
- C:\Windows\System\pkrPgUi.exe
  C:\Windows\System\pkrPgUi.exe
  2⤵
  PID:3344
- C:\Windows\System\NKMQqWX.exe
  C:\Windows\System\NKMQqWX.exe
  2⤵
  PID:3364
- C:\Windows\System\MBObHGb.exe
  C:\Windows\System\MBObHGb.exe
  2⤵
  PID:3380
- C:\Windows\System\jbQJqrs.exe
  C:\Windows\System\jbQJqrs.exe
  2⤵
  PID:3556
- C:\Windows\System\kVAIPPY.exe
  C:\Windows\System\kVAIPPY.exe
  2⤵
  PID:3468
- C:\Windows\System\glKCnLq.exe
  C:\Windows\System\glKCnLq.exe
  2⤵
  PID:3484
- C:\Windows\System\oIQncdZ.exe
  C:\Windows\System\oIQncdZ.exe
  2⤵
  PID:3500
- C:\Windows\System\ovQMqRN.exe
  C:\Windows\System\ovQMqRN.exe
  2⤵
  PID:3516
- C:\Windows\System\vpchsQD.exe
  C:\Windows\System\vpchsQD.exe
  2⤵
  PID:3532
- C:\Windows\System\SJDpbVn.exe
  C:\Windows\System\SJDpbVn.exe
  2⤵
  PID:3576
- C:\Windows\System\qVZQtdv.exe
  C:\Windows\System\qVZQtdv.exe
  2⤵
  PID:3396
- C:\Windows\System\nzngrXO.exe
  C:\Windows\System\nzngrXO.exe
  2⤵
  PID:3412
- C:\Windows\System\oWpkSDC.exe
  C:\Windows\System\oWpkSDC.exe
  2⤵
  PID:3428
- C:\Windows\System\srLhpCi.exe
  C:\Windows\System\srLhpCi.exe
  2⤵
  PID:3444
- C:\Windows\System\IVJyfvU.exe
  C:\Windows\System\IVJyfvU.exe
  2⤵
  PID:3628
- C:\Windows\System\hrmvryM.exe
  C:\Windows\System\hrmvryM.exe
  2⤵
  PID:3600
- C:\Windows\System\wxMDBdr.exe
  C:\Windows\System\wxMDBdr.exe
  2⤵
  PID:3652
- C:\Windows\System\tihGkcB.exe
  C:\Windows\System\tihGkcB.exe
  2⤵
  PID:3660
- C:\Windows\System\EOanhjT.exe
  C:\Windows\System\EOanhjT.exe
  2⤵
  PID:3692
- C:\Windows\System\WLpKQRO.exe
  C:\Windows\System\WLpKQRO.exe
  2⤵
  PID:3680
- C:\Windows\System\DBBzxhA.exe
  C:\Windows\System\DBBzxhA.exe
  2⤵
  PID:3748
- C:\Windows\System\DYBgcCF.exe
  C:\Windows\System\DYBgcCF.exe
  2⤵
  PID:3768
- C:\Windows\System\chHBtjC.exe
  C:\Windows\System\chHBtjC.exe
  2⤵
  PID:3788
- C:\Windows\System\VOqzxlV.exe
  C:\Windows\System\VOqzxlV.exe
  2⤵
  PID:3804
- C:\Windows\System\xDLUbcz.exe
  C:\Windows\System\xDLUbcz.exe
  2⤵
  PID:3820
- C:\Windows\System\dnRQVie.exe
  C:\Windows\System\dnRQVie.exe
  2⤵
  PID:3720
- C:\Windows\System\EXptrcs.exe
  C:\Windows\System\EXptrcs.exe
  2⤵
  PID:3824
- C:\Windows\System\moNTPrd.exe
  C:\Windows\System\moNTPrd.exe
  2⤵
  PID:3856
- C:\Windows\System\dipgmwd.exe
  C:\Windows\System\dipgmwd.exe
  2⤵
  PID:3880
- C:\Windows\System\dDfivdo.exe
  C:\Windows\System\dDfivdo.exe
  2⤵
  PID:3884
- C:\Windows\System\xmiogJm.exe
  C:\Windows\System\xmiogJm.exe
  2⤵
  PID:2452
- C:\Windows\System\EZKDGKl.exe
  C:\Windows\System\EZKDGKl.exe
  2⤵
  PID:3916
- C:\Windows\System\kSXPgEF.exe
  C:\Windows\System\kSXPgEF.exe
  2⤵
  PID:3928
- C:\Windows\System\xcinzMy.exe
  C:\Windows\System\xcinzMy.exe
  2⤵
  PID:3912
- C:\Windows\System\FYMBYtU.exe
  C:\Windows\System\FYMBYtU.exe
  2⤵
  PID:3976
- C:\Windows\System\vzPxXXT.exe
  C:\Windows\System\vzPxXXT.exe
  2⤵
  PID:3964
- C:\Windows\System\SgGKmRj.exe
  C:\Windows\System\SgGKmRj.exe
  2⤵
  PID:2964
- C:\Windows\System\mXxgdLg.exe
  C:\Windows\System\mXxgdLg.exe
  2⤵
  PID:4028
- C:\Windows\System\lpfZVEE.exe
  C:\Windows\System\lpfZVEE.exe
  2⤵
  PID:4044
- C:\Windows\System\TdZjJJI.exe
  C:\Windows\System\TdZjJJI.exe
  2⤵
  PID:4080
- C:\Windows\System\KlIMCrG.exe
  C:\Windows\System\KlIMCrG.exe
  2⤵
  PID:1020
- C:\Windows\System\qFFFlOa.exe
  C:\Windows\System\qFFFlOa.exe
  2⤵
  PID:2052
- C:\Windows\System\AXnvfqI.exe
  C:\Windows\System\AXnvfqI.exe
  2⤵
  PID:1708
- C:\Windows\System\zBDyQHv.exe
  C:\Windows\System\zBDyQHv.exe
  2⤵
  PID:3200
- C:\Windows\System\WYYyxJx.exe
  C:\Windows\System\WYYyxJx.exe
  2⤵
  PID:296
- C:\Windows\System\miMhylh.exe
  C:\Windows\System\miMhylh.exe
  2⤵
  PID:2624
- C:\Windows\System\UQYlOfR.exe
  C:\Windows\System\UQYlOfR.exe
  2⤵
  PID:3104
- C:\Windows\System\lZoNPun.exe
  C:\Windows\System\lZoNPun.exe
  2⤵
  PID:1500
- C:\Windows\System\SaEJVYo.exe
  C:\Windows\System\SaEJVYo.exe
  2⤵
  PID:3256
- C:\Windows\System\FoBfWKI.exe
  C:\Windows\System\FoBfWKI.exe
  2⤵
  PID:3248
- C:\Windows\System\jHCaVwt.exe
  C:\Windows\System\jHCaVwt.exe
  2⤵
  PID:2364
- C:\Windows\System\WZWNhTN.exe
  C:\Windows\System\WZWNhTN.exe
  2⤵
  PID:4112
- C:\Windows\System\JgSdOKJ.exe
  C:\Windows\System\JgSdOKJ.exe
  2⤵
  PID:4128
- C:\Windows\System\gIAoOZi.exe
  C:\Windows\System\gIAoOZi.exe
  2⤵
  PID:4144
- C:\Windows\System\FJvximi.exe
  C:\Windows\System\FJvximi.exe
  2⤵
  PID:4160
- C:\Windows\System\TChPjXi.exe
  C:\Windows\System\TChPjXi.exe
  2⤵
  PID:4176
- C:\Windows\System\asOwxrT.exe
  C:\Windows\System\asOwxrT.exe
  2⤵
  PID:4192
- C:\Windows\System\QloYzqO.exe
  C:\Windows\System\QloYzqO.exe
  2⤵
  PID:4208
- C:\Windows\System\nkYaCbt.exe
  C:\Windows\System\nkYaCbt.exe
  2⤵
  PID:4224
- C:\Windows\System\koptnmN.exe
  C:\Windows\System\koptnmN.exe
  2⤵
  PID:4240
- C:\Windows\System\QDlWAZu.exe
  C:\Windows\System\QDlWAZu.exe
  2⤵
  PID:4256
- C:\Windows\System\EpJQWvj.exe
  C:\Windows\System\EpJQWvj.exe
  2⤵
  PID:4276
- C:\Windows\System\YjmCAzv.exe
  C:\Windows\System\YjmCAzv.exe
  2⤵
  PID:4528
- C:\Windows\System\fceVAWm.exe
  C:\Windows\System\fceVAWm.exe
  2⤵
  PID:4548
- C:\Windows\System\RxxAYtU.exe
  C:\Windows\System\RxxAYtU.exe
  2⤵
  PID:4564
- C:\Windows\System\ECzlCHG.exe
  C:\Windows\System\ECzlCHG.exe
  2⤵
  PID:4584
- C:\Windows\System\uVDToFg.exe
  C:\Windows\System\uVDToFg.exe
  2⤵
  PID:4604
- C:\Windows\System\rYbFFkF.exe
  C:\Windows\System\rYbFFkF.exe
  2⤵
  PID:4620
- C:\Windows\System\IucpLNd.exe
  C:\Windows\System\IucpLNd.exe
  2⤵
  PID:4636
- C:\Windows\System\BpqVLlW.exe
  C:\Windows\System\BpqVLlW.exe
  2⤵
  PID:4652
- C:\Windows\System\Zxtarol.exe
  C:\Windows\System\Zxtarol.exe
  2⤵
  PID:4684
- C:\Windows\System\TFsGDSH.exe
  C:\Windows\System\TFsGDSH.exe
  2⤵
  PID:4740
- C:\Windows\System\EaJjiKc.exe
  C:\Windows\System\EaJjiKc.exe
  2⤵
  PID:4768
- C:\Windows\System\bkokrgf.exe
  C:\Windows\System\bkokrgf.exe
  2⤵
  PID:4784
- C:\Windows\System\ZrgPtCG.exe
  C:\Windows\System\ZrgPtCG.exe
  2⤵
  PID:4800
- C:\Windows\System\NNMeRqQ.exe
  C:\Windows\System\NNMeRqQ.exe
  2⤵
  PID:4832
- C:\Windows\System\eSPLJpZ.exe
  C:\Windows\System\eSPLJpZ.exe
  2⤵
  PID:4848
- C:\Windows\System\FqCkqkD.exe
  C:\Windows\System\FqCkqkD.exe
  2⤵
  PID:4864
- C:\Windows\System\nACMwJI.exe
  C:\Windows\System\nACMwJI.exe
  2⤵
  PID:4880
- C:\Windows\System\MiUrCob.exe
  C:\Windows\System\MiUrCob.exe
  2⤵
  PID:4896
- C:\Windows\System\nKviWvz.exe
  C:\Windows\System\nKviWvz.exe
  2⤵
  PID:4912
- C:\Windows\System\CBqtcIT.exe
  C:\Windows\System\CBqtcIT.exe
  2⤵
  PID:4932
- C:\Windows\System\wfJzrkF.exe
  C:\Windows\System\wfJzrkF.exe
  2⤵
  PID:4976
- C:\Windows\System\fmZkqpR.exe
  C:\Windows\System\fmZkqpR.exe
  2⤵
  PID:4992
- C:\Windows\System\OrduaML.exe
  C:\Windows\System\OrduaML.exe
  2⤵
  PID:5012
- C:\Windows\System\QfOGONA.exe
  C:\Windows\System\QfOGONA.exe
  2⤵
  PID:5028
- C:\Windows\System\uTsNKwk.exe
  C:\Windows\System\uTsNKwk.exe
  2⤵
  PID:5044
- C:\Windows\System\DaomToI.exe
  C:\Windows\System\DaomToI.exe
  2⤵
  PID:5060
- C:\Windows\System\tLABjhR.exe
  C:\Windows\System\tLABjhR.exe
  2⤵
  PID:5076
- C:\Windows\System\OwfMArF.exe
  C:\Windows\System\OwfMArF.exe
  2⤵
  PID:5092
- C:\Windows\System\GMcWcsY.exe
  C:\Windows\System\GMcWcsY.exe
  2⤵
  PID:5108
- C:\Windows\System\SFsvVWb.exe
  C:\Windows\System\SFsvVWb.exe
  2⤵
  PID:2352
- C:\Windows\System\ETKuluf.exe
  C:\Windows\System\ETKuluf.exe
  2⤵
  PID:1672
- C:\Windows\System\lpGcBTn.exe
  C:\Windows\System\lpGcBTn.exe
  2⤵
  PID:3220
- C:\Windows\System\YYMnUCt.exe
  C:\Windows\System\YYMnUCt.exe
  2⤵
  PID:3552
- C:\Windows\System\mbLJmju.exe
  C:\Windows\System\mbLJmju.exe
  2⤵
  PID:3672
- C:\Windows\System\KVgkuEf.exe
  C:\Windows\System\KVgkuEf.exe
  2⤵
  PID:3784
- C:\Windows\System\VtzLSCz.exe
  C:\Windows\System\VtzLSCz.exe
  2⤵
  PID:3480
- C:\Windows\System\FivJMaM.exe
  C:\Windows\System\FivJMaM.exe
  2⤵
  PID:3568
- C:\Windows\System\vaKPOcA.exe
  C:\Windows\System\vaKPOcA.exe
  2⤵
  PID:3400
- C:\Windows\System\ucDQSnB.exe
  C:\Windows\System\ucDQSnB.exe
  2⤵
  PID:3640
- C:\Windows\System\JYlzwxP.exe
  C:\Windows\System\JYlzwxP.exe
  2⤵
  PID:3596
- C:\Windows\System\EfaXSNq.exe
  C:\Windows\System\EfaXSNq.exe
  2⤵
  PID:3772
- C:\Windows\System\FmUGywu.exe
  C:\Windows\System\FmUGywu.exe
  2⤵
  PID:3752
- C:\Windows\System\eqexJdQ.exe
  C:\Windows\System\eqexJdQ.exe
  2⤵
  PID:3896
- C:\Windows\System\aqpRElf.exe
  C:\Windows\System\aqpRElf.exe
  2⤵
  PID:3940
- C:\Windows\System\HNoIfcF.exe
  C:\Windows\System\HNoIfcF.exe
  2⤵
  PID:4068
- C:\Windows\System\fIqvEoY.exe
  C:\Windows\System\fIqvEoY.exe
  2⤵
  PID:3172
- C:\Windows\System\RRUwCJm.exe
  C:\Windows\System\RRUwCJm.exe
  2⤵
  PID:3152
- C:\Windows\System\zlMHUob.exe
  C:\Windows\System\zlMHUob.exe
  2⤵
  PID:2268
- C:\Windows\System\FWpTHZl.exe
  C:\Windows\System\FWpTHZl.exe
  2⤵
  PID:1292
- C:\Windows\System\NtiXaYj.exe
  C:\Windows\System\NtiXaYj.exe
  2⤵
  PID:4120
- C:\Windows\System\LhFptIF.exe
  C:\Windows\System\LhFptIF.exe
  2⤵
  PID:3460
- C:\Windows\System\fBrmxQi.exe
  C:\Windows\System\fBrmxQi.exe
  2⤵
  PID:4408
- C:\Windows\System\dzDPqoG.exe
  C:\Windows\System\dzDPqoG.exe
  2⤵
  PID:4456
- C:\Windows\System\SKaRDLi.exe
  C:\Windows\System\SKaRDLi.exe
  2⤵
  PID:4472
- C:\Windows\System\TZRWfpB.exe
  C:\Windows\System\TZRWfpB.exe
  2⤵
  PID:4496
- C:\Windows\System\PFXWnfH.exe
  C:\Windows\System\PFXWnfH.exe
  2⤵
  PID:4288
- C:\Windows\System\HEaYBZe.exe
  C:\Windows\System\HEaYBZe.exe
  2⤵
  PID:4372
- C:\Windows\System\ipGHpJw.exe
  C:\Windows\System\ipGHpJw.exe
  2⤵
  PID:4392
- C:\Windows\System\uofvdJb.exe
  C:\Windows\System\uofvdJb.exe
  2⤵
  PID:4416
- C:\Windows\System\kYhleDu.exe
  C:\Windows\System\kYhleDu.exe
  2⤵
  PID:4432
- C:\Windows\System\pkcJwEr.exe
  C:\Windows\System\pkcJwEr.exe
  2⤵
  PID:3924
- C:\Windows\System\VnCREPS.exe
  C:\Windows\System\VnCREPS.exe
  2⤵
  PID:4004
- C:\Windows\System\xYTrhlv.exe
  C:\Windows\System\xYTrhlv.exe
  2⤵
  PID:3080
- C:\Windows\System\UHJwatI.exe
  C:\Windows\System\UHJwatI.exe
  2⤵
  PID:4476
- C:\Windows\System\VUkKzgq.exe
  C:\Windows\System\VUkKzgq.exe
  2⤵
  PID:4124
- C:\Windows\System\mKMpewZ.exe
  C:\Windows\System\mKMpewZ.exe
  2⤵
  PID:4248
- C:\Windows\System\cpQddEa.exe
  C:\Windows\System\cpQddEa.exe
  2⤵
  PID:4512
- C:\Windows\System\dENlHCJ.exe
  C:\Windows\System\dENlHCJ.exe
  2⤵
  PID:4304
- C:\Windows\System\VgpwQFE.exe
  C:\Windows\System\VgpwQFE.exe
  2⤵
  PID:4312
- C:\Windows\System\iVFIoRm.exe
  C:\Windows\System\iVFIoRm.exe
  2⤵
  PID:4328
- C:\Windows\System\LpQXMvk.exe
  C:\Windows\System\LpQXMvk.exe
  2⤵
  PID:4520
- C:\Windows\System\eAxAwyk.exe
  C:\Windows\System\eAxAwyk.exe
  2⤵
  PID:4592
- C:\Windows\System\RkyctvZ.exe
  C:\Windows\System\RkyctvZ.exe
  2⤵
  PID:4556
- C:\Windows\System\nHNBrUI.exe
  C:\Windows\System\nHNBrUI.exe
  2⤵
  PID:4628
- C:\Windows\System\VOgaysA.exe
  C:\Windows\System\VOgaysA.exe
  2⤵
  PID:4672
- C:\Windows\System\TDchmaA.exe
  C:\Windows\System\TDchmaA.exe
  2⤵
  PID:4700
- C:\Windows\System\sMRHqYk.exe
  C:\Windows\System\sMRHqYk.exe
  2⤵
  PID:4776
- C:\Windows\System\CpAaPNz.exe
  C:\Windows\System\CpAaPNz.exe
  2⤵
  PID:4796
- C:\Windows\System\OhlJcqQ.exe
  C:\Windows\System\OhlJcqQ.exe
  2⤵
  PID:4792
- C:\Windows\System\aUfhFcX.exe
  C:\Windows\System\aUfhFcX.exe
  2⤵
  PID:4860
- C:\Windows\System\vFjsIbY.exe
  C:\Windows\System\vFjsIbY.exe
  2⤵
  PID:4924
- C:\Windows\System\LZOUvrl.exe
  C:\Windows\System\LZOUvrl.exe
  2⤵
  PID:4940
- C:\Windows\System\OOaOGxb.exe
  C:\Windows\System\OOaOGxb.exe
  2⤵
  PID:4944
- C:\Windows\System\VHJQJkT.exe
  C:\Windows\System\VHJQJkT.exe
  2⤵
  PID:4960
- C:\Windows\System\xVRBHLd.exe
  C:\Windows\System\xVRBHLd.exe
  2⤵
  PID:4988
- C:\Windows\System\nigwEwW.exe
  C:\Windows\System\nigwEwW.exe
  2⤵
  PID:5036
- C:\Windows\System\HavpkLX.exe
  C:\Windows\System\HavpkLX.exe
  2⤵
  PID:5072
- C:\Windows\System\ZqcUmCN.exe
  C:\Windows\System\ZqcUmCN.exe
  2⤵
  PID:5100
- C:\Windows\System\lXIgaYv.exe
  C:\Windows\System\lXIgaYv.exe
  2⤵
  PID:5052
- C:\Windows\System\RCblgRC.exe
  C:\Windows\System\RCblgRC.exe
  2⤵
  PID:1660
- C:\Windows\System\ACJSkbH.exe
  C:\Windows\System\ACJSkbH.exe
  2⤵
  PID:3548
- C:\Windows\System\CyLXbQF.exe
  C:\Windows\System\CyLXbQF.exe
  2⤵
  PID:3696
- C:\Windows\System\MoMMHlc.exe
  C:\Windows\System\MoMMHlc.exe
  2⤵
  PID:3796
- C:\Windows\System\kgaCPRO.exe
  C:\Windows\System\kgaCPRO.exe
  2⤵
  PID:3936
- C:\Windows\System\akJGMDL.exe
  C:\Windows\System\akJGMDL.exe
  2⤵
  PID:3948
- C:\Windows\System\xWSCeSR.exe
  C:\Windows\System\xWSCeSR.exe
  2⤵
  PID:4016
- C:\Windows\System\hLukXuY.exe
  C:\Windows\System\hLukXuY.exe
  2⤵
  PID:1252
- C:\Windows\System\hBZFUNS.exe
  C:\Windows\System\hBZFUNS.exe
  2⤵
  PID:3268
- C:\Windows\System\LvlFTJM.exe
  C:\Windows\System\LvlFTJM.exe
  2⤵
  PID:4264
- C:\Windows\System\AkOisEV.exe
  C:\Windows\System\AkOisEV.exe
  2⤵
  PID:1676
- C:\Windows\System\lPUmjdn.exe
  C:\Windows\System\lPUmjdn.exe
  2⤵
  PID:3312
- C:\Windows\System\BCEvdwK.exe
  C:\Windows\System\BCEvdwK.exe
  2⤵
  PID:4188
- C:\Windows\System\XuGYzBJ.exe
  C:\Windows\System\XuGYzBJ.exe
  2⤵
  PID:3252
- C:\Windows\System\oBeqNEZ.exe
  C:\Windows\System\oBeqNEZ.exe
  2⤵
  PID:4360
- C:\Windows\System\hecYiGt.exe
  C:\Windows\System\hecYiGt.exe
  2⤵
  PID:4404
- C:\Windows\System\eaDAEJy.exe
  C:\Windows\System\eaDAEJy.exe
  2⤵
  PID:4452
- C:\Windows\System\vrmGGEm.exe
  C:\Windows\System\vrmGGEm.exe
  2⤵
  PID:4428
- C:\Windows\System\QgprIPd.exe
  C:\Windows\System\QgprIPd.exe
  2⤵
  PID:4764
- C:\Windows\System\maBGOXA.exe
  C:\Windows\System\maBGOXA.exe
  2⤵
  PID:4840
- C:\Windows\System\pUwbJVN.exe
  C:\Windows\System\pUwbJVN.exe
  2⤵
  PID:3376
- C:\Windows\System\OssdjJw.exe
  C:\Windows\System\OssdjJw.exe
  2⤵
  PID:3116
- C:\Windows\System\YjdNUIV.exe
  C:\Windows\System\YjdNUIV.exe
  2⤵
  PID:4508
- C:\Windows\System\duFJLeW.exe
  C:\Windows\System\duFJLeW.exe
  2⤵
  PID:4336
- C:\Windows\System\srRnwoH.exe
  C:\Windows\System\srRnwoH.exe
  2⤵
  PID:4752
- C:\Windows\System\UjnSQGc.exe
  C:\Windows\System\UjnSQGc.exe
  2⤵
  PID:4344
- C:\Windows\System\zXlrbio.exe
  C:\Windows\System\zXlrbio.exe
  2⤵
  PID:3844
- C:\Windows\System\fmmZhaK.exe
  C:\Windows\System\fmmZhaK.exe
  2⤵
  PID:4820
- C:\Windows\System\wFgiBqv.exe
  C:\Windows\System\wFgiBqv.exe
  2⤵
  PID:4972
- C:\Windows\System\zPbOYwp.exe
  C:\Windows\System\zPbOYwp.exe
  2⤵
  PID:3328
- C:\Windows\System\auUsLLA.exe
  C:\Windows\System\auUsLLA.exe
  2⤵
  PID:3356
- C:\Windows\System\YhzGffH.exe
  C:\Windows\System\YhzGffH.exe
  2⤵
  PID:1800
- C:\Windows\System\uLAzsMN.exe
  C:\Windows\System\uLAzsMN.exe
  2⤵
  PID:3760
- C:\Windows\System\VXaKwIz.exe
  C:\Windows\System\VXaKwIz.exe
  2⤵
  PID:3632
- C:\Windows\System\LFdlNUv.exe
  C:\Windows\System\LFdlNUv.exe
  2⤵
  PID:4168
- C:\Windows\System\zYJBQPU.exe
  C:\Windows\System\zYJBQPU.exe
  2⤵
  PID:3876
- C:\Windows\System\NjpvofE.exe
  C:\Windows\System\NjpvofE.exe
  2⤵
  PID:3136
- C:\Windows\System\jfgzGMm.exe
  C:\Windows\System\jfgzGMm.exe
  2⤵
  PID:1568
- C:\Windows\System\kEdBLdT.exe
  C:\Windows\System\kEdBLdT.exe
  2⤵
  PID:3732
- C:\Windows\System\pmVRHku.exe
  C:\Windows\System\pmVRHku.exe
  2⤵
  PID:3920
- C:\Windows\System\QAWTFrK.exe
  C:\Windows\System\QAWTFrK.exe
  2⤵
  PID:1684
- C:\Windows\System\TFYiAAu.exe
  C:\Windows\System\TFYiAAu.exe
  2⤵
  PID:4204
- C:\Windows\System\MseLPWq.exe
  C:\Windows\System\MseLPWq.exe
  2⤵
  PID:4172
- C:\Windows\System\fzIdprK.exe
  C:\Windows\System\fzIdprK.exe
  2⤵
  PID:4232
- C:\Windows\System\vNmujBV.exe
  C:\Windows\System\vNmujBV.exe
  2⤵
  PID:788
- C:\Windows\System\fhDdsxk.exe
  C:\Windows\System\fhDdsxk.exe
  2⤵
  PID:4460
- C:\Windows\System\XTgYQcW.exe
  C:\Windows\System\XTgYQcW.exe
  2⤵
  PID:4448
- C:\Windows\System\jNtFcNb.exe
  C:\Windows\System\jNtFcNb.exe
  2⤵
  PID:4388
- C:\Windows\System\PlTcBwg.exe
  C:\Windows\System\PlTcBwg.exe
  2⤵
  PID:4424
- C:\Windows\System\hbkVsNr.exe
  C:\Windows\System\hbkVsNr.exe
  2⤵
  PID:1572
- C:\Windows\System\IRDVavK.exe
  C:\Windows\System\IRDVavK.exe
  2⤵
  PID:4504
- C:\Windows\System\HRbvaEh.exe
  C:\Windows\System\HRbvaEh.exe
  2⤵
  PID:4324
- C:\Windows\System\geQxBPP.exe
  C:\Windows\System\geQxBPP.exe
  2⤵
  PID:4600
- C:\Windows\System\JFVpLQt.exe
  C:\Windows\System\JFVpLQt.exe
  2⤵
  PID:5008
- C:\Windows\System\ruklOdi.exe
  C:\Windows\System\ruklOdi.exe
  2⤵
  PID:4544
- C:\Windows\System\mAzCEEV.exe
  C:\Windows\System\mAzCEEV.exe
  2⤵
  PID:4816
- C:\Windows\System\rrGiCMK.exe
  C:\Windows\System\rrGiCMK.exe
  2⤵
  PID:4956
- C:\Windows\System\uGrbYyf.exe
  C:\Windows\System\uGrbYyf.exe
  2⤵
  PID:4488
- C:\Windows\System\CJcglXE.exe
  C:\Windows\System\CJcglXE.exe
  2⤵
  PID:4612
- C:\Windows\System\ZmDfNjl.exe
  C:\Windows\System\ZmDfNjl.exe
  2⤵
  PID:5020
- C:\Windows\System\gQyfOwg.exe
  C:\Windows\System\gQyfOwg.exe
  2⤵
  PID:3524
- C:\Windows\System\OHJGNdM.exe
  C:\Windows\System\OHJGNdM.exe
  2⤵
  PID:2724
- C:\Windows\System\KFsTRwZ.exe
  C:\Windows\System\KFsTRwZ.exe
  2⤵
  PID:4136
- C:\Windows\System\nZjtzZv.exe
  C:\Windows\System\nZjtzZv.exe
  2⤵
  PID:4140
- C:\Windows\System\XeTWyja.exe
  C:\Windows\System\XeTWyja.exe
  2⤵
  PID:680
- C:\Windows\System\oCcfkXb.exe
  C:\Windows\System\oCcfkXb.exe
  2⤵
  PID:4500
- C:\Windows\System\YCfFGZX.exe
  C:\Windows\System\YCfFGZX.exe
  2⤵
  PID:2956
- C:\Windows\System\KwmeAUb.exe
  C:\Windows\System\KwmeAUb.exe
  2⤵
  PID:3668
- C:\Windows\System\MxnYWvj.exe
  C:\Windows\System\MxnYWvj.exe
  2⤵
  PID:4200
- C:\Windows\System\KIzCTgw.exe
  C:\Windows\System\KIzCTgw.exe
  2⤵
  PID:3564
- C:\Windows\System\xfutNLO.exe
  C:\Windows\System\xfutNLO.exe
  2⤵
  PID:4236
- C:\Windows\System\khKpPWl.exe
  C:\Windows\System\khKpPWl.exe
  2⤵
  PID:4300
- C:\Windows\System\seQgFpF.exe
  C:\Windows\System\seQgFpF.exe
  2⤵
  PID:3244
- C:\Windows\System\JVYHFQI.exe
  C:\Windows\System\JVYHFQI.exe
  2⤵
  PID:4220
- C:\Windows\System\okhAbNt.exe
  C:\Windows\System\okhAbNt.exe
  2⤵
  PID:5068
- C:\Windows\System\WASDfmK.exe
  C:\Windows\System\WASDfmK.exe
  2⤵
  PID:3440
- C:\Windows\System\sJBpUcB.exe
  C:\Windows\System\sJBpUcB.exe
  2⤵
  PID:4580
- C:\Windows\System\rlpGLyd.exe
  C:\Windows\System\rlpGLyd.exe
  2⤵
  PID:1456
- C:\Windows\System\rJfmQxu.exe
  C:\Windows\System\rJfmQxu.exe
  2⤵
  PID:1932
- C:\Windows\System\gDlYPKN.exe
  C:\Windows\System\gDlYPKN.exe
  2⤵
  PID:4468
- C:\Windows\System\INcwhYy.exe
  C:\Windows\System\INcwhYy.exe
  2⤵
  PID:4356
- C:\Windows\System\wLyUlSm.exe
  C:\Windows\System\wLyUlSm.exe
  2⤵
  PID:5128
- C:\Windows\System\ppLRskj.exe
  C:\Windows\System\ppLRskj.exe
  2⤵
  PID:5144
- C:\Windows\System\eWkpObu.exe
  C:\Windows\System\eWkpObu.exe
  2⤵
  PID:5160
- C:\Windows\System\YadJRhQ.exe
  C:\Windows\System\YadJRhQ.exe
  2⤵
  PID:5180
- C:\Windows\System\qtypYUH.exe
  C:\Windows\System\qtypYUH.exe
  2⤵
  PID:5196
- C:\Windows\System\KNHsDrO.exe
  C:\Windows\System\KNHsDrO.exe
  2⤵
  PID:5216
- C:\Windows\System\KMFFIDw.exe
  C:\Windows\System\KMFFIDw.exe
  2⤵
  PID:5232
- C:\Windows\System\ImeqoSy.exe
  C:\Windows\System\ImeqoSy.exe
  2⤵
  PID:5248
- C:\Windows\System\KVWHFRj.exe
  C:\Windows\System\KVWHFRj.exe
  2⤵
  PID:5264
- C:\Windows\System\BeZzGfo.exe
  C:\Windows\System\BeZzGfo.exe
  2⤵
  PID:5280
- C:\Windows\System\yFyPWxN.exe
  C:\Windows\System\yFyPWxN.exe
  2⤵
  PID:5296
- C:\Windows\System\lKOfnpB.exe
  C:\Windows\System\lKOfnpB.exe
  2⤵
  PID:5312
- C:\Windows\System\aaBQCmH.exe
  C:\Windows\System\aaBQCmH.exe
  2⤵
  PID:5328
- C:\Windows\System\ROaAkcE.exe
  C:\Windows\System\ROaAkcE.exe
  2⤵
  PID:5344
- C:\Windows\System\CYcSapt.exe
  C:\Windows\System\CYcSapt.exe
  2⤵
  PID:5360
- C:\Windows\System\KIuzJZJ.exe
  C:\Windows\System\KIuzJZJ.exe
  2⤵
  PID:5376
- C:\Windows\System\tyxKklJ.exe
  C:\Windows\System\tyxKklJ.exe
  2⤵
  PID:5392
- C:\Windows\System\MkNEsIJ.exe
  C:\Windows\System\MkNEsIJ.exe
  2⤵
  PID:5408
- C:\Windows\System\ZjPGSzI.exe
  C:\Windows\System\ZjPGSzI.exe
  2⤵
  PID:5424
- C:\Windows\System\moUsEXr.exe
  C:\Windows\System\moUsEXr.exe
  2⤵
  PID:5440
- C:\Windows\System\YTYmHnt.exe
  C:\Windows\System\YTYmHnt.exe
  2⤵
  PID:5456
- C:\Windows\System\UwuaXXa.exe
  C:\Windows\System\UwuaXXa.exe
  2⤵
  PID:5472
- C:\Windows\System\EOFvGEs.exe
  C:\Windows\System\EOFvGEs.exe
  2⤵
  PID:5488
- C:\Windows\System\HRCNLIL.exe
  C:\Windows\System\HRCNLIL.exe
  2⤵
  PID:5508
- C:\Windows\System\zFFZWFN.exe
  C:\Windows\System\zFFZWFN.exe
  2⤵
  PID:5524
- C:\Windows\System\SJecAhM.exe
  C:\Windows\System\SJecAhM.exe
  2⤵
  PID:5540
- C:\Windows\System\OuliRqA.exe
  C:\Windows\System\OuliRqA.exe
  2⤵
  PID:5556
- C:\Windows\System\SKLayRw.exe
  C:\Windows\System\SKLayRw.exe
  2⤵
  PID:5576
- C:\Windows\System\WDGZwSo.exe
  C:\Windows\System\WDGZwSo.exe
  2⤵
  PID:5592
- C:\Windows\System\UtMNSra.exe
  C:\Windows\System\UtMNSra.exe
  2⤵
  PID:5608
- C:\Windows\System\gDjwbHF.exe
  C:\Windows\System\gDjwbHF.exe
  2⤵
  PID:5624
- C:\Windows\System\vniYFdz.exe
  C:\Windows\System\vniYFdz.exe
  2⤵
  PID:5640
- C:\Windows\System\OXchYzl.exe
  C:\Windows\System\OXchYzl.exe
  2⤵
  PID:5656
- C:\Windows\System\rEqnWlt.exe
  C:\Windows\System\rEqnWlt.exe
  2⤵
  PID:5672
- C:\Windows\System\qBPsvZF.exe
  C:\Windows\System\qBPsvZF.exe
  2⤵
  PID:5696
- C:\Windows\System\ltKrAxw.exe
  C:\Windows\System\ltKrAxw.exe
  2⤵
  PID:5712
- C:\Windows\System\dmZIGlG.exe
  C:\Windows\System\dmZIGlG.exe
  2⤵
  PID:5728
- C:\Windows\System\YcDDKIk.exe
  C:\Windows\System\YcDDKIk.exe
  2⤵
  PID:5744
- C:\Windows\System\OZqQlgA.exe
  C:\Windows\System\OZqQlgA.exe
  2⤵
  PID:5760
- C:\Windows\System\vGwojSG.exe
  C:\Windows\System\vGwojSG.exe
  2⤵
  PID:5776
- C:\Windows\System\xiUVkIx.exe
  C:\Windows\System\xiUVkIx.exe
  2⤵
  PID:5792
- C:\Windows\System\teuomCT.exe
  C:\Windows\System\teuomCT.exe
  2⤵
  PID:5812
- C:\Windows\System\KuNaxxP.exe
  C:\Windows\System\KuNaxxP.exe
  2⤵
  PID:5868
- C:\Windows\System\vDApdyr.exe
  C:\Windows\System\vDApdyr.exe
  2⤵
  PID:5916
- C:\Windows\System\XdqKybq.exe
  C:\Windows\System\XdqKybq.exe
  2⤵
  PID:6056
- C:\Windows\System\zzcPRIZ.exe
  C:\Windows\System\zzcPRIZ.exe
  2⤵
  PID:6076
- C:\Windows\System\qNhJIks.exe
  C:\Windows\System\qNhJIks.exe
  2⤵
  PID:6092
- C:\Windows\System\JxVDPnK.exe
  C:\Windows\System\JxVDPnK.exe
  2⤵
  PID:6108
- C:\Windows\System\oQYihpj.exe
  C:\Windows\System\oQYihpj.exe
  2⤵
  PID:6124
- C:\Windows\System\swDVpBh.exe
  C:\Windows\System\swDVpBh.exe
  2⤵
  PID:6140
- C:\Windows\System\lLspDZB.exe
  C:\Windows\System\lLspDZB.exe
  2⤵
  PID:3780
- C:\Windows\System\WEMkQhY.exe
  C:\Windows\System\WEMkQhY.exe
  2⤵
  PID:3496
- C:\Windows\System\rhdHGZy.exe
  C:\Windows\System\rhdHGZy.exe
  2⤵
  PID:2372
- C:\Windows\System\hkkcuBC.exe
  C:\Windows\System\hkkcuBC.exe
  2⤵
  PID:4856
- C:\Windows\System\tfmMOxr.exe
  C:\Windows\System\tfmMOxr.exe
  2⤵
  PID:5212
- C:\Windows\System\GkNdLzD.exe
  C:\Windows\System\GkNdLzD.exe
  2⤵
  PID:5188
- C:\Windows\System\yWAyWAH.exe
  C:\Windows\System\yWAyWAH.exe
  2⤵
  PID:4384
- C:\Windows\System\WmvEuCB.exe
  C:\Windows\System\WmvEuCB.exe
  2⤵
  PID:5256
- C:\Windows\System\PxBdOwf.exe
  C:\Windows\System\PxBdOwf.exe
  2⤵
  PID:5228
- C:\Windows\System\agZfHMO.exe
  C:\Windows\System\agZfHMO.exe
  2⤵
  PID:5324
- C:\Windows\System\NCKYQUK.exe
  C:\Windows\System\NCKYQUK.exe
  2⤵
  PID:5320
- C:\Windows\System\eyKTpDu.exe
  C:\Windows\System\eyKTpDu.exe
  2⤵
  PID:5368
- C:\Windows\System\daRvAJn.exe
  C:\Windows\System\daRvAJn.exe
  2⤵
  PID:5648
- C:\Windows\System\SFWggQl.exe
  C:\Windows\System\SFWggQl.exe
  2⤵
  PID:5584
- C:\Windows\System\ZObWuhK.exe
  C:\Windows\System\ZObWuhK.exe
  2⤵
  PID:5516
- C:\Windows\System\PHtAYNT.exe
  C:\Windows\System\PHtAYNT.exe
  2⤵
  PID:5420
- C:\Windows\System\hqYoZSo.exe
  C:\Windows\System\hqYoZSo.exe
  2⤵
  PID:5680
- C:\Windows\System\OmNqKJr.exe
  C:\Windows\System\OmNqKJr.exe
  2⤵
  PID:5720
- C:\Windows\System\fQXkiOX.exe
  C:\Windows\System\fQXkiOX.exe
  2⤵
  PID:5496
- C:\Windows\System\DafwTey.exe
  C:\Windows\System\DafwTey.exe
  2⤵
  PID:5564
- C:\Windows\System\uPvTEHf.exe
  C:\Windows\System\uPvTEHf.exe
  2⤵
  PID:5756
- C:\Windows\System\szgHuNY.exe
  C:\Windows\System\szgHuNY.exe
  2⤵
  PID:5664
- C:\Windows\System\QeiNByB.exe
  C:\Windows\System\QeiNByB.exe
  2⤵
  PID:5828
- C:\Windows\System\ZAsSRQN.exe
  C:\Windows\System\ZAsSRQN.exe
  2⤵
  PID:5860
- C:\Windows\System\lzjiJpH.exe
  C:\Windows\System\lzjiJpH.exe
  2⤵
  PID:5824
- C:\Windows\System\TwPWakV.exe
  C:\Windows\System\TwPWakV.exe
  2⤵
  PID:5864
- C:\Windows\System\yUFFPot.exe
  C:\Windows\System\yUFFPot.exe
  2⤵
  PID:5768
- C:\Windows\System\gfRUobn.exe
  C:\Windows\System\gfRUobn.exe
  2⤵
  PID:5808
- C:\Windows\System\PowmJvl.exe
  C:\Windows\System\PowmJvl.exe
  2⤵
  PID:5888
- C:\Windows\System\GtvhJAl.exe
  C:\Windows\System\GtvhJAl.exe
  2⤵
  PID:5904
- C:\Windows\System\dleKjTO.exe
  C:\Windows\System\dleKjTO.exe
  2⤵
  PID:5936
- C:\Windows\System\XMYirEQ.exe
  C:\Windows\System\XMYirEQ.exe
  2⤵
  PID:5956
- C:\Windows\System\MWigqEo.exe
  C:\Windows\System\MWigqEo.exe
  2⤵
  PID:5960
- C:\Windows\System\tLKANbb.exe
  C:\Windows\System\tLKANbb.exe
  2⤵
  PID:5972
- C:\Windows\System\ftfPcmO.exe
  C:\Windows\System\ftfPcmO.exe
  2⤵
  PID:5992
- C:\Windows\System\ZxBYpaz.exe
  C:\Windows\System\ZxBYpaz.exe
  2⤵
  PID:1784
- C:\Windows\System\EAZDyLG.exe
  C:\Windows\System\EAZDyLG.exe
  2⤵
  PID:5356
- C:\Windows\System\aOjzufO.exe
  C:\Windows\System\aOjzufO.exe
  2⤵
  PID:5480
- C:\Windows\System\vAkkqNY.exe
  C:\Windows\System\vAkkqNY.exe
  2⤵
  PID:904
- C:\Windows\System\VLqbJAf.exe
  C:\Windows\System\VLqbJAf.exe
  2⤵
  PID:5384
- C:\Windows\System\EEiEjkJ.exe
  C:\Windows\System\EEiEjkJ.exe
  2⤵
  PID:5652
- C:\Windows\System\aEyFOVd.exe
  C:\Windows\System\aEyFOVd.exe
  2⤵
  PID:5452
- C:\Windows\System\Lnzfhbe.exe
  C:\Windows\System\Lnzfhbe.exe
  2⤵
  PID:5464
- C:\Windows\System\xPeWyVO.exe
  C:\Windows\System\xPeWyVO.exe
  2⤵
  PID:5752
- C:\Windows\System\SeNCqph.exe
  C:\Windows\System\SeNCqph.exe
  2⤵
  PID:5880
- C:\Windows\System\LYeELgS.exe
  C:\Windows\System\LYeELgS.exe
  2⤵
  PID:5952
- C:\Windows\System\bGySyzi.exe
  C:\Windows\System\bGySyzi.exe
  2⤵
  PID:5740
- C:\Windows\System\VNHMGSG.exe
  C:\Windows\System\VNHMGSG.exe
  2⤵
  PID:5980
- C:\Windows\System\GxDybkE.exe
  C:\Windows\System\GxDybkE.exe
  2⤵
  PID:5632
- C:\Windows\System\QaIDXPG.exe
  C:\Windows\System\QaIDXPG.exe
  2⤵
  PID:5832
- C:\Windows\System\bFUCytB.exe
  C:\Windows\System\bFUCytB.exe
  2⤵
  PID:5940
- C:\Windows\System\uNTlzpe.exe
  C:\Windows\System\uNTlzpe.exe
  2⤵
  PID:6008
- C:\Windows\System\pfwYqNI.exe
  C:\Windows\System\pfwYqNI.exe
  2⤵
  PID:6016
- C:\Windows\System\XbqzCey.exe
  C:\Windows\System\XbqzCey.exe
  2⤵
  PID:6044
- C:\Windows\System\pZLLzgS.exe
  C:\Windows\System\pZLLzgS.exe
  2⤵
  PID:6120
- C:\Windows\System\aArmvdG.exe
  C:\Windows\System\aArmvdG.exe
  2⤵
  PID:4828
- C:\Windows\System\enBdvpd.exe
  C:\Windows\System\enBdvpd.exe
  2⤵
  PID:6064
- C:\Windows\System\pwMVjFv.exe
  C:\Windows\System\pwMVjFv.exe
  2⤵
  PID:6072
- C:\Windows\System\XWqIchh.exe
  C:\Windows\System\XWqIchh.exe
  2⤵
  PID:5168
- C:\Windows\System\AVCrkSb.exe
  C:\Windows\System\AVCrkSb.exe
  2⤵
  PID:5588
- C:\Windows\System\YGTwtoy.exe
  C:\Windows\System\YGTwtoy.exe
  2⤵
  PID:5520
- C:\Windows\System\jUkExVR.exe
  C:\Windows\System\jUkExVR.exe
  2⤵
  PID:5912
- C:\Windows\System\svqNVgS.exe
  C:\Windows\System\svqNVgS.exe
  2⤵
  PID:5848
- C:\Windows\System\qbhrkpV.exe
  C:\Windows\System\qbhrkpV.exe
  2⤵
  PID:5736
- C:\Windows\System\vOYxUca.exe
  C:\Windows\System\vOYxUca.exe
  2⤵
  PID:5856
- C:\Windows\System\jYTXbnH.exe
  C:\Windows\System\jYTXbnH.exe
  2⤵
  PID:6024
- C:\Windows\System\PzCkJax.exe
  C:\Windows\System\PzCkJax.exe
  2⤵
  PID:3744
- C:\Windows\System\WMMkJVp.exe
  C:\Windows\System\WMMkJVp.exe
  2⤵
  PID:5468
- C:\Windows\System\wMFhmNi.exe
  C:\Windows\System\wMFhmNi.exe
  2⤵
  PID:6012
- C:\Windows\System\JISlsjQ.exe
  C:\Windows\System\JISlsjQ.exe
  2⤵
  PID:6004
- C:\Windows\System\EnhRBuN.exe
  C:\Windows\System\EnhRBuN.exe
  2⤵
  PID:5156
- C:\Windows\System\vNHXpbT.exe
  C:\Windows\System\vNHXpbT.exe
  2⤵
  PID:6088
- C:\Windows\System\fxpkTgY.exe
  C:\Windows\System\fxpkTgY.exe
  2⤵
  PID:5152
- C:\Windows\System\qagHafn.exe
  C:\Windows\System\qagHafn.exe
  2⤵
  PID:6116
- C:\Windows\System\dpfogwR.exe
  C:\Windows\System\dpfogwR.exe
  2⤵
  PID:5896
- C:\Windows\System\RRqFsDK.exe
  C:\Windows\System\RRqFsDK.exe
  2⤵
  PID:5224
- C:\Windows\System\NrwYdFB.exe
  C:\Windows\System\NrwYdFB.exe
  2⤵
  PID:6084
- C:\Windows\System\NLYZmqS.exe
  C:\Windows\System\NLYZmqS.exe
  2⤵
  PID:4444
- C:\Windows\System\GmOtFBV.exe
  C:\Windows\System\GmOtFBV.exe
  2⤵
  PID:5536
- C:\Windows\System\UamTpeE.exe
  C:\Windows\System\UamTpeE.exe
  2⤵
  PID:5136
- C:\Windows\System\dqsIOaZ.exe
  C:\Windows\System\dqsIOaZ.exe
  2⤵
  PID:5988
- C:\Windows\System\WkESGQg.exe
  C:\Windows\System\WkESGQg.exe
  2⤵
  PID:6156
- C:\Windows\System\qkUtLhx.exe
  C:\Windows\System\qkUtLhx.exe
  2⤵
  PID:6172
- C:\Windows\System\FDToWsR.exe
  C:\Windows\System\FDToWsR.exe
  2⤵
  PID:6188
- C:\Windows\System\YUZYZon.exe
  C:\Windows\System\YUZYZon.exe
  2⤵
  PID:6208
- C:\Windows\System\YZqMGuF.exe
  C:\Windows\System\YZqMGuF.exe
  2⤵
  PID:6224
- C:\Windows\System\yzgrCBC.exe
  C:\Windows\System\yzgrCBC.exe
  2⤵
  PID:6240
- C:\Windows\System\HTTEoxP.exe
  C:\Windows\System\HTTEoxP.exe
  2⤵
  PID:6256
- C:\Windows\System\jlqWHkd.exe
  C:\Windows\System\jlqWHkd.exe
  2⤵
  PID:6276
- C:\Windows\System\MsDAUyy.exe
  C:\Windows\System\MsDAUyy.exe
  2⤵
  PID:6292
- C:\Windows\System\pLRllax.exe
  C:\Windows\System\pLRllax.exe
  2⤵
  PID:6308
- C:\Windows\System\XSOstPV.exe
  C:\Windows\System\XSOstPV.exe
  2⤵
  PID:6344
- C:\Windows\System\uyTncom.exe
  C:\Windows\System\uyTncom.exe
  2⤵
  PID:6360
- C:\Windows\System\XSkunIA.exe
  C:\Windows\System\XSkunIA.exe
  2⤵
  PID:6376
- C:\Windows\System\BfQgQvL.exe
  C:\Windows\System\BfQgQvL.exe
  2⤵
  PID:6392
- C:\Windows\System\wueyuYk.exe
  C:\Windows\System\wueyuYk.exe
  2⤵
  PID:6408
- C:\Windows\System\CJCClMa.exe
  C:\Windows\System\CJCClMa.exe
  2⤵
  PID:6424
- C:\Windows\System\zEHmGnA.exe
  C:\Windows\System\zEHmGnA.exe
  2⤵
  PID:6444
- C:\Windows\System\ocpuqMw.exe
  C:\Windows\System\ocpuqMw.exe
  2⤵
  PID:6460
- C:\Windows\System\RJRGyzY.exe
  C:\Windows\System\RJRGyzY.exe
  2⤵
  PID:6476
- C:\Windows\System\ibfKaKW.exe
  C:\Windows\System\ibfKaKW.exe
  2⤵
  PID:6492
- C:\Windows\System\xKZfsjh.exe
  C:\Windows\System\xKZfsjh.exe
  2⤵
  PID:6508
- C:\Windows\System\LvsPcWi.exe
  C:\Windows\System\LvsPcWi.exe
  2⤵
  PID:6524
- C:\Windows\System\ToMNOaj.exe
  C:\Windows\System\ToMNOaj.exe
  2⤵
  PID:6544
- C:\Windows\System\rCVzDWe.exe
  C:\Windows\System\rCVzDWe.exe
  2⤵
  PID:6560
- C:\Windows\System\yldmhQD.exe
  C:\Windows\System\yldmhQD.exe
  2⤵
  PID:6580
- C:\Windows\System\ykntmHy.exe
  C:\Windows\System\ykntmHy.exe
  2⤵
  PID:6596
- C:\Windows\System\mFcMBjB.exe
  C:\Windows\System\mFcMBjB.exe
  2⤵
  PID:6612
- C:\Windows\System\yMaGpWO.exe
  C:\Windows\System\yMaGpWO.exe
  2⤵
  PID:6628
- C:\Windows\System\XoUCPND.exe
  C:\Windows\System\XoUCPND.exe
  2⤵
  PID:6648
- C:\Windows\System\ohBXPUG.exe
  C:\Windows\System\ohBXPUG.exe
  2⤵
  PID:6664
- C:\Windows\System\RvUELmP.exe
  C:\Windows\System\RvUELmP.exe
  2⤵
  PID:6680
- C:\Windows\System\BhgEJxO.exe
  C:\Windows\System\BhgEJxO.exe
  2⤵
  PID:6696
- C:\Windows\System\lMludAS.exe
  C:\Windows\System\lMludAS.exe
  2⤵
  PID:6716
- C:\Windows\System\YuyDVNR.exe
  C:\Windows\System\YuyDVNR.exe
  2⤵
  PID:6732
- C:\Windows\System\PKILLnH.exe
  C:\Windows\System\PKILLnH.exe
  2⤵
  PID:6748
- C:\Windows\System\mmumTQM.exe
  C:\Windows\System\mmumTQM.exe
  2⤵
  PID:6764
- C:\Windows\System\DBdyHsY.exe
  C:\Windows\System\DBdyHsY.exe
  2⤵
  PID:6780
- C:\Windows\System\FUHZHxL.exe
  C:\Windows\System\FUHZHxL.exe
  2⤵
  PID:6796
- C:\Windows\System\looDwbm.exe
  C:\Windows\System\looDwbm.exe
  2⤵
  PID:6812
- C:\Windows\System\zTqRgyy.exe
  C:\Windows\System\zTqRgyy.exe
  2⤵
  PID:6828
- C:\Windows\System\MrfkVvd.exe
  C:\Windows\System\MrfkVvd.exe
  2⤵
  PID:6844
- C:\Windows\System\ELdRaqW.exe
  C:\Windows\System\ELdRaqW.exe
  2⤵
  PID:6864
- C:\Windows\System\hStstBF.exe
  C:\Windows\System\hStstBF.exe
  2⤵
  PID:6880
- C:\Windows\System\Egntibp.exe
  C:\Windows\System\Egntibp.exe
  2⤵
  PID:6900
- C:\Windows\System\ZnvXOEH.exe
  C:\Windows\System\ZnvXOEH.exe
  2⤵
  PID:6916
- C:\Windows\System\UxUEvBJ.exe
  C:\Windows\System\UxUEvBJ.exe
  2⤵
  PID:6932
- C:\Windows\System\SDKlbFi.exe
  C:\Windows\System\SDKlbFi.exe
  2⤵
  PID:6948
- C:\Windows\System\SUENQEO.exe
  C:\Windows\System\SUENQEO.exe
  2⤵
  PID:6964
- C:\Windows\System\aZepuEa.exe
  C:\Windows\System\aZepuEa.exe
  2⤵
  PID:6980
- C:\Windows\System\BHOnJOd.exe
  C:\Windows\System\BHOnJOd.exe
  2⤵
  PID:7004
- C:\Windows\System\vTwpiTA.exe
  C:\Windows\System\vTwpiTA.exe
  2⤵
  PID:7020
- C:\Windows\System\iCTZuTG.exe
  C:\Windows\System\iCTZuTG.exe
  2⤵
  PID:7036
- C:\Windows\System\cYZnjMx.exe
  C:\Windows\System\cYZnjMx.exe
  2⤵
  PID:7056
- C:\Windows\System\CwHpqCu.exe
  C:\Windows\System\CwHpqCu.exe
  2⤵
  PID:7076
- C:\Windows\System\ODvAYbV.exe
  C:\Windows\System\ODvAYbV.exe
  2⤵
  PID:7092
- C:\Windows\System\QhuXqib.exe
  C:\Windows\System\QhuXqib.exe
  2⤵
  PID:7112
- C:\Windows\System\YFiWqSu.exe
  C:\Windows\System\YFiWqSu.exe
  2⤵
  PID:7128
- C:\Windows\System\nhXCJol.exe
  C:\Windows\System\nhXCJol.exe
  2⤵
  PID:7144
- C:\Windows\System\sNjPtNA.exe
  C:\Windows\System\sNjPtNA.exe
  2⤵
  PID:7160
- C:\Windows\System\eFicGUA.exe
  C:\Windows\System\eFicGUA.exe
  2⤵
  PID:5124
- C:\Windows\System\zWxylJT.exe
  C:\Windows\System\zWxylJT.exe
  2⤵
  PID:6136
- C:\Windows\System\PlhpTkz.exe
  C:\Windows\System\PlhpTkz.exe
  2⤵
  PID:5708
- C:\Windows\System\zjXUpXm.exe
  C:\Windows\System\zjXUpXm.exe
  2⤵
  PID:6216
- C:\Windows\System\cyeJZzB.exe
  C:\Windows\System\cyeJZzB.exe
  2⤵
  PID:6200
- C:\Windows\System\hPTkjXq.exe
  C:\Windows\System\hPTkjXq.exe
  2⤵
  PID:6204
- C:\Windows\System\EZTEsXf.exe
  C:\Windows\System\EZTEsXf.exe
  2⤵
  PID:6304
- C:\Windows\System\mYFJfbD.exe
  C:\Windows\System\mYFJfbD.exe
  2⤵
  PID:6264
- C:\Windows\System\wOGUSvQ.exe
  C:\Windows\System\wOGUSvQ.exe
  2⤵
  PID:6328
- C:\Windows\System\YiKeVsx.exe
  C:\Windows\System\YiKeVsx.exe
  2⤵
  PID:6400
- C:\Windows\System\XMWiNRC.exe
  C:\Windows\System\XMWiNRC.exe
  2⤵
  PID:6404
- C:\Windows\System\fXVEvxC.exe
  C:\Windows\System\fXVEvxC.exe
  2⤵
  PID:6436
- C:\Windows\System\iPxfOgJ.exe
  C:\Windows\System\iPxfOgJ.exe
  2⤵
  PID:6536
- C:\Windows\System\WdSQXkk.exe
  C:\Windows\System\WdSQXkk.exe
  2⤵
  PID:6384
- C:\Windows\System\RngDTjy.exe
  C:\Windows\System\RngDTjy.exe
  2⤵
  PID:6452
- C:\Windows\System\SSbOtef.exe
  C:\Windows\System\SSbOtef.exe
  2⤵
  PID:6516
- C:\Windows\System\DlpgvRT.exe
  C:\Windows\System\DlpgvRT.exe
  2⤵
  PID:6572
- C:\Windows\System\HiiNLCp.exe
  C:\Windows\System\HiiNLCp.exe
  2⤵
  PID:6608
- C:\Windows\System\hVTOzVL.exe
  C:\Windows\System\hVTOzVL.exe
  2⤵
  PID:6592
- C:\Windows\System\oGKZuvq.exe
  C:\Windows\System\oGKZuvq.exe
  2⤵
  PID:6624
- C:\Windows\System\lovIpVc.exe
  C:\Windows\System\lovIpVc.exe
  2⤵
  PID:6656
- C:\Windows\System\bTbPqSq.exe
  C:\Windows\System\bTbPqSq.exe
  2⤵
  PID:6776
- C:\Windows\System\LpThDea.exe
  C:\Windows\System\LpThDea.exe
  2⤵
  PID:6840
- C:\Windows\System\igJhUZo.exe
  C:\Windows\System\igJhUZo.exe
  2⤵
  PID:6908
- C:\Windows\System\jYRLGFu.exe
  C:\Windows\System\jYRLGFu.exe
  2⤵
  PID:6728
- C:\Windows\System\kCkHspr.exe
  C:\Windows\System\kCkHspr.exe
  2⤵
  PID:6724
- C:\Windows\System\LKIbMYf.exe
  C:\Windows\System\LKIbMYf.exe
  2⤵
  PID:6820
- C:\Windows\System\PWOSnFR.exe
  C:\Windows\System\PWOSnFR.exe
  2⤵
  PID:6956
- C:\Windows\System\mQsHhnt.exe
  C:\Windows\System\mQsHhnt.exe
  2⤵
  PID:6184
- C:\Windows\System\HvDSJLH.exe
  C:\Windows\System\HvDSJLH.exe
  2⤵
  PID:6992
- C:\Windows\System\jXfRWPW.exe
  C:\Windows\System\jXfRWPW.exe
  2⤵
  PID:6248
- C:\Windows\System\PyEiNcL.exe
  C:\Windows\System\PyEiNcL.exe
  2⤵
  PID:6340
- C:\Windows\System\FCNxAXE.exe
  C:\Windows\System\FCNxAXE.exe
  2⤵
  PID:7064
- C:\Windows\System\ApOXGXA.exe
  C:\Windows\System\ApOXGXA.exe
  2⤵
  PID:6288
- C:\Windows\System\JwxhBzm.exe
  C:\Windows\System\JwxhBzm.exe
  2⤵
  PID:6372
- C:\Windows\System\nnfCjrK.exe
  C:\Windows\System\nnfCjrK.exe
  2⤵
  PID:7140
- C:\Windows\System\hYfHtPk.exe
  C:\Windows\System\hYfHtPk.exe
  2⤵
  PID:6164
- C:\Windows\System\sgFgEtG.exe
  C:\Windows\System\sgFgEtG.exe
  2⤵
  PID:7104
- C:\Windows\System\vRHyhFm.exe
  C:\Windows\System\vRHyhFm.exe
  2⤵
  PID:6488
- C:\Windows\System\tuiWtPu.exe
  C:\Windows\System\tuiWtPu.exe
  2⤵
  PID:7136
- C:\Windows\System\JoGDUcC.exe
  C:\Windows\System\JoGDUcC.exe
  2⤵
  PID:6744
- C:\Windows\System\LqWirLu.exe
  C:\Windows\System\LqWirLu.exe
  2⤵
  PID:6672
- C:\Windows\System\FqwdFMS.exe
  C:\Windows\System\FqwdFMS.exe
  2⤵
  PID:6872
- C:\Windows\System\qRzbBhA.exe
  C:\Windows\System\qRzbBhA.exe
  2⤵
  PID:6708
- C:\Windows\System\gCcGeBy.exe
  C:\Windows\System\gCcGeBy.exe
  2⤵
  PID:6760
- C:\Windows\System\SvWWgVj.exe
  C:\Windows\System\SvWWgVj.exe
  2⤵
  PID:6860
- C:\Windows\System\wPkMAXT.exe
  C:\Windows\System\wPkMAXT.exe
  2⤵
  PID:7016
- C:\Windows\System\LkFpXmS.exe
  C:\Windows\System\LkFpXmS.exe
  2⤵
  PID:6892
- C:\Windows\System\CxjQwSV.exe
  C:\Windows\System\CxjQwSV.exe
  2⤵
  PID:4844
- C:\Windows\System\UNEVdgp.exe
  C:\Windows\System\UNEVdgp.exe
  2⤵
  PID:7152
- C:\Windows\System\JGzofny.exe
  C:\Windows\System\JGzofny.exe
  2⤵
  PID:5532
- C:\Windows\System\hOrVPAU.exe
  C:\Windows\System\hOrVPAU.exe
  2⤵
  PID:6336
- C:\Windows\System\tHyOBeZ.exe
  C:\Windows\System\tHyOBeZ.exe
  2⤵
  PID:6468
- C:\Windows\System\eogxslj.exe
  C:\Windows\System\eogxslj.exe
  2⤵
  PID:6196
- C:\Windows\System\ypBcBhD.exe
  C:\Windows\System\ypBcBhD.exe
  2⤵
  PID:6036
- C:\Windows\System\XPFCeGp.exe
  C:\Windows\System\XPFCeGp.exe
  2⤵
  PID:6472
- C:\Windows\System\xukAWeL.exe
  C:\Windows\System\xukAWeL.exe
  2⤵
  PID:6644
- C:\Windows\System\AQoBcKw.exe
  C:\Windows\System\AQoBcKw.exe
  2⤵
  PID:6836
- C:\Windows\System\gdfyNED.exe
  C:\Windows\System\gdfyNED.exe
  2⤵
  PID:6888
- C:\Windows\System\nRzoXnJ.exe
  C:\Windows\System\nRzoXnJ.exe
  2⤵
  PID:6152
- C:\Windows\System\NQUvzFW.exe
  C:\Windows\System\NQUvzFW.exe
  2⤵
  PID:7032
- C:\Windows\System\pacHZpO.exe
  C:\Windows\System\pacHZpO.exe
  2⤵
  PID:6856
- C:\Windows\System\XTCQyQJ.exe
  C:\Windows\System\XTCQyQJ.exe
  2⤵
  PID:6636
- C:\Windows\System\IIGFsIW.exe
  C:\Windows\System\IIGFsIW.exe
  2⤵
  PID:5404
- C:\Windows\System\aJfWXyx.exe
  C:\Windows\System\aJfWXyx.exe
  2⤵
  PID:6272
- C:\Windows\System\dYaQKir.exe
  C:\Windows\System\dYaQKir.exe
  2⤵
  PID:6352
- C:\Windows\System\IDyhmvs.exe
  C:\Windows\System\IDyhmvs.exe
  2⤵
  PID:6416
- C:\Windows\System\QGaIFTa.exe
  C:\Windows\System\QGaIFTa.exe
  2⤵
  PID:6484
- C:\Windows\System\MtuauSo.exe
  C:\Windows\System\MtuauSo.exe
  2⤵
  PID:6556
- C:\Windows\System\ljEZcmp.exe
  C:\Windows\System\ljEZcmp.exe
  2⤵
  PID:7052
- C:\Windows\System\ANOzKYP.exe
  C:\Windows\System\ANOzKYP.exe
  2⤵
  PID:7184
- C:\Windows\System\sUvLqgs.exe
  C:\Windows\System\sUvLqgs.exe
  2⤵
  PID:7200
- C:\Windows\System\ivWbjPP.exe
  C:\Windows\System\ivWbjPP.exe
  2⤵
  PID:7220
- C:\Windows\System\ADvMBUU.exe
  C:\Windows\System\ADvMBUU.exe
  2⤵
  PID:7236
- C:\Windows\System\qgKevXF.exe
  C:\Windows\System\qgKevXF.exe
  2⤵
  PID:7252
- C:\Windows\System\KdazCdW.exe
  C:\Windows\System\KdazCdW.exe
  2⤵
  PID:7268
- C:\Windows\System\BoWXMNd.exe
  C:\Windows\System\BoWXMNd.exe
  2⤵
  PID:7284
- C:\Windows\System\TQITVJP.exe
  C:\Windows\System\TQITVJP.exe
  2⤵
  PID:7300
- C:\Windows\System\wKOEhoo.exe
  C:\Windows\System\wKOEhoo.exe
  2⤵
  PID:7316
- C:\Windows\System\yBSbnNT.exe
  C:\Windows\System\yBSbnNT.exe
  2⤵
  PID:7332
- C:\Windows\System\KSWHfJC.exe
  C:\Windows\System\KSWHfJC.exe
  2⤵
  PID:7348
- C:\Windows\System\DKWMVeC.exe
  C:\Windows\System\DKWMVeC.exe
  2⤵
  PID:7364
- C:\Windows\System\WKXUMoq.exe
  C:\Windows\System\WKXUMoq.exe
  2⤵
  PID:7380
- C:\Windows\System\JjfahCc.exe
  C:\Windows\System\JjfahCc.exe
  2⤵
  PID:7556
- C:\Windows\System\oWeoYrJ.exe
  C:\Windows\System\oWeoYrJ.exe
  2⤵
  PID:7576
- C:\Windows\System\Ajvmzpl.exe
  C:\Windows\System\Ajvmzpl.exe
  2⤵
  PID:7592
- C:\Windows\System\Fgzelky.exe
  C:\Windows\System\Fgzelky.exe
  2⤵
  PID:7608
- C:\Windows\System\LzzBYtD.exe
  C:\Windows\System\LzzBYtD.exe
  2⤵
  PID:7624
- C:\Windows\System\ZnyIKXo.exe
  C:\Windows\System\ZnyIKXo.exe
  2⤵
  PID:7640
- C:\Windows\System\vedfKgs.exe
  C:\Windows\System\vedfKgs.exe
  2⤵
  PID:7660
- C:\Windows\System\fQaMKwL.exe
  C:\Windows\System\fQaMKwL.exe
  2⤵
  PID:7676
- C:\Windows\System\FluioqP.exe
  C:\Windows\System\FluioqP.exe
  2⤵
  PID:7696
- C:\Windows\System\NxVXRNP.exe
  C:\Windows\System\NxVXRNP.exe
  2⤵
  PID:7712
- C:\Windows\System\KqwcstX.exe
  C:\Windows\System\KqwcstX.exe
  2⤵
  PID:7728
- C:\Windows\System\GsJvrjn.exe
  C:\Windows\System\GsJvrjn.exe
  2⤵
  PID:7744
- C:\Windows\System\hHZlDKA.exe
  C:\Windows\System\hHZlDKA.exe
  2⤵
  PID:7760
- C:\Windows\System\hvsjkzv.exe
  C:\Windows\System\hvsjkzv.exe
  2⤵
  PID:7776
- C:\Windows\System\IxGqqTz.exe
  C:\Windows\System\IxGqqTz.exe
  2⤵
  PID:7792
- C:\Windows\System\XfnkCwB.exe
  C:\Windows\System\XfnkCwB.exe
  2⤵
  PID:7808
- C:\Windows\System\boyzsPC.exe
  C:\Windows\System\boyzsPC.exe
  2⤵
  PID:7824
- C:\Windows\System\ZvHePfk.exe
  C:\Windows\System\ZvHePfk.exe
  2⤵
  PID:7840
- C:\Windows\System\qNgQPes.exe
  C:\Windows\System\qNgQPes.exe
  2⤵
  PID:7856
- C:\Windows\System\zFcDUcp.exe
  C:\Windows\System\zFcDUcp.exe
  2⤵
  PID:7872
- C:\Windows\System\rOxqJhN.exe
  C:\Windows\System\rOxqJhN.exe
  2⤵
  PID:7928
- C:\Windows\System\WHuzlTq.exe
  C:\Windows\System\WHuzlTq.exe
  2⤵
  PID:7944
- C:\Windows\System\naXXIQf.exe
  C:\Windows\System\naXXIQf.exe
  2⤵
  PID:7960
- C:\Windows\System\Nxahapp.exe
  C:\Windows\System\Nxahapp.exe
  2⤵
  PID:7976
- C:\Windows\System\OotdfLP.exe
  C:\Windows\System\OotdfLP.exe
  2⤵
  PID:7992
- C:\Windows\System\RhTbrJK.exe
  C:\Windows\System\RhTbrJK.exe
  2⤵
  PID:8008
- C:\Windows\System\ChkKrCH.exe
  C:\Windows\System\ChkKrCH.exe
  2⤵
  PID:8024
- C:\Windows\System\WQRKiIO.exe
  C:\Windows\System\WQRKiIO.exe
  2⤵
  PID:8040
- C:\Windows\System\YIyQQEe.exe
  C:\Windows\System\YIyQQEe.exe
  2⤵
  PID:8056
- C:\Windows\System\WTJrtUT.exe
  C:\Windows\System\WTJrtUT.exe
  2⤵
  PID:8072
- C:\Windows\System\izihCDN.exe
  C:\Windows\System\izihCDN.exe
  2⤵
  PID:8088
- C:\Windows\System\RQUdBXO.exe
  C:\Windows\System\RQUdBXO.exe
  2⤵
  PID:8104
- C:\Windows\System\hWKcaPD.exe
  C:\Windows\System\hWKcaPD.exe
  2⤵
  PID:8124
- C:\Windows\System\rEpAVtP.exe
  C:\Windows\System\rEpAVtP.exe
  2⤵
  PID:8140
- C:\Windows\System\NVFIDZN.exe
  C:\Windows\System\NVFIDZN.exe
  2⤵
  PID:8156
- C:\Windows\System\IVfBgpJ.exe
  C:\Windows\System\IVfBgpJ.exe
  2⤵
  PID:8172
- C:\Windows\System\MCEcXPu.exe
  C:\Windows\System\MCEcXPu.exe
  2⤵
  PID:7028
- C:\Windows\System\HTRGmsN.exe
  C:\Windows\System\HTRGmsN.exe
  2⤵
  PID:7196
- C:\Windows\System\LcBALrX.exe
  C:\Windows\System\LcBALrX.exe
  2⤵
  PID:7000
- C:\Windows\System\eljDKnm.exe
  C:\Windows\System\eljDKnm.exe
  2⤵
  PID:7260
- C:\Windows\System\qSdfyiC.exe
  C:\Windows\System\qSdfyiC.exe
  2⤵
  PID:6792
- C:\Windows\System\SzLHaeY.exe
  C:\Windows\System\SzLHaeY.exe
  2⤵
  PID:7244
- C:\Windows\System\bkEPRXu.exe
  C:\Windows\System\bkEPRXu.exe
  2⤵
  PID:7276
- C:\Windows\System\NaYDnsX.exe
  C:\Windows\System\NaYDnsX.exe
  2⤵
  PID:7328
- C:\Windows\System\rvBlutr.exe
  C:\Windows\System\rvBlutr.exe
  2⤵
  PID:7392
- C:\Windows\System\guEzdxP.exe
  C:\Windows\System\guEzdxP.exe
  2⤵
  PID:7340
- C:\Windows\System\wGATmlz.exe
  C:\Windows\System\wGATmlz.exe
  2⤵
  PID:7376
- C:\Windows\System\GaQiAJc.exe
  C:\Windows\System\GaQiAJc.exe
  2⤵
  PID:7416
- C:\Windows\System\PCkOWCy.exe
  C:\Windows\System\PCkOWCy.exe
  2⤵
  PID:7432
- C:\Windows\System\sIWQZTe.exe
  C:\Windows\System\sIWQZTe.exe
  2⤵
  PID:7448
- C:\Windows\System\HGRIRNa.exe
  C:\Windows\System\HGRIRNa.exe
  2⤵
  PID:7472
- C:\Windows\System\yxAjsew.exe
  C:\Windows\System\yxAjsew.exe
  2⤵
  PID:7488
- C:\Windows\System\mAzVPqx.exe
  C:\Windows\System\mAzVPqx.exe
  2⤵
  PID:7504
- C:\Windows\System\SoVgYSm.exe
  C:\Windows\System\SoVgYSm.exe
  2⤵
  PID:7524
- C:\Windows\System\ZbmLsGG.exe
  C:\Windows\System\ZbmLsGG.exe
  2⤵
  PID:7540
- C:\Windows\System\MQiCjuP.exe
  C:\Windows\System\MQiCjuP.exe
  2⤵
  PID:7584
- C:\Windows\System\SFeoSAX.exe
  C:\Windows\System\SFeoSAX.exe
  2⤵
  PID:7600
- C:\Windows\System\dpzprVE.exe
  C:\Windows\System\dpzprVE.exe
  2⤵
  PID:7572
- C:\Windows\System\qNtcEab.exe
  C:\Windows\System\qNtcEab.exe
  2⤵
  PID:7864
- C:\Windows\System\lxPUDUv.exe
  C:\Windows\System\lxPUDUv.exe
  2⤵
  PID:7800
- C:\Windows\System\inhWvbq.exe
  C:\Windows\System\inhWvbq.exe
  2⤵
  PID:7736
- C:\Windows\System\bZWtCum.exe
  C:\Windows\System\bZWtCum.exe
  2⤵
  PID:7720
- C:\Windows\System\AKGAFjG.exe
  C:\Windows\System\AKGAFjG.exe
  2⤵
  PID:7648
- C:\Windows\System\SPkjDZI.exe
  C:\Windows\System\SPkjDZI.exe
  2⤵
  PID:7688
- C:\Windows\System\FGmeddM.exe
  C:\Windows\System\FGmeddM.exe
  2⤵
  PID:7756
- C:\Windows\System\rnREJPN.exe
  C:\Windows\System\rnREJPN.exe
  2⤵
  PID:7884
- C:\Windows\System\UsJJUPC.exe
  C:\Windows\System\UsJJUPC.exe
  2⤵
  PID:7904
- C:\Windows\System\kEnZHVf.exe
  C:\Windows\System\kEnZHVf.exe
  2⤵
  PID:7920
- C:\Windows\System\sKqBLjJ.exe
  C:\Windows\System\sKqBLjJ.exe
  2⤵
  PID:8000
- C:\Windows\System\yLKiONL.exe
  C:\Windows\System\yLKiONL.exe
  2⤵
  PID:6420
- C:\Windows\System\PeCoGGI.exe
  C:\Windows\System\PeCoGGI.exe
  2⤵
  PID:8068
- C:\Windows\System\PKFKiam.exe
  C:\Windows\System\PKFKiam.exe
  2⤵
  PID:8136
- C:\Windows\System\dTuUiMH.exe
  C:\Windows\System\dTuUiMH.exe
  2⤵
  PID:7216
- C:\Windows\System\gGbQHMN.exe
  C:\Windows\System\gGbQHMN.exe
  2⤵
  PID:7424
- C:\Windows\System\EHAGczg.exe
  C:\Windows\System\EHAGczg.exe
  2⤵
  PID:7468
- C:\Windows\System\UyvMEuy.exe
  C:\Windows\System\UyvMEuy.exe
  2⤵
  PID:7440
- C:\Windows\System\PvbtMOV.exe
  C:\Windows\System\PvbtMOV.exe
  2⤵
  PID:7308
- C:\Windows\System\ENyrDbs.exe
  C:\Windows\System\ENyrDbs.exe
  2⤵
  PID:7548
- C:\Windows\System\hADohly.exe
  C:\Windows\System\hADohly.exe
  2⤵
  PID:7516
- C:\Windows\System\wNNPcKK.exe
  C:\Windows\System\wNNPcKK.exe
  2⤵
  PID:7568
- C:\Windows\System\hYUPsyP.exe
  C:\Windows\System\hYUPsyP.exe
  2⤵
  PID:7868
- C:\Windows\System\hybGQdk.exe
  C:\Windows\System\hybGQdk.exe
  2⤵
  PID:7820
- C:\Windows\System\FUOzaWz.exe
  C:\Windows\System\FUOzaWz.exe
  2⤵
  PID:7892
- C:\Windows\System\CyzrYAo.exe
  C:\Windows\System\CyzrYAo.exe
  2⤵
  PID:7936
- C:\Windows\System\lidHrYn.exe
  C:\Windows\System\lidHrYn.exe
  2⤵
  PID:7832
- C:\Windows\System\GHYRaOy.exe
  C:\Windows\System\GHYRaOy.exe
  2⤵
  PID:7852
- C:\Windows\System\gDyMgCf.exe
  C:\Windows\System\gDyMgCf.exe
  2⤵
  PID:7656
- C:\Windows\System\lKOdBTz.exe
  C:\Windows\System\lKOdBTz.exe
  2⤵
  PID:7232
- C:\Windows\System\LJflcsv.exe
  C:\Windows\System\LJflcsv.exe
  2⤵
  PID:7956
- C:\Windows\System\LcvZmDw.exe
  C:\Windows\System\LcvZmDw.exe
  2⤵
  PID:7464
- C:\Windows\System\ktZxSLv.exe
  C:\Windows\System\ktZxSLv.exe
  2⤵
  PID:7500
- C:\Windows\System\CGufMQp.exe
  C:\Windows\System\CGufMQp.exe
  2⤵
  PID:7412
- C:\Windows\System\ONMeEwh.exe
  C:\Windows\System\ONMeEwh.exe
  2⤵
  PID:7668
- C:\Windows\System\ZqrIuON.exe
  C:\Windows\System\ZqrIuON.exe
  2⤵
  PID:7768
- C:\Windows\System\BINxRTJ.exe
  C:\Windows\System\BINxRTJ.exe
  2⤵
  PID:7564
- C:\Windows\System\FtqmeBO.exe
  C:\Windows\System\FtqmeBO.exe
  2⤵
  PID:7672
- C:\Windows\System\MjpVmZL.exe
  C:\Windows\System\MjpVmZL.exe
  2⤵
  PID:7012
- C:\Windows\System\yuZubiV.exe
  C:\Windows\System\yuZubiV.exe
  2⤵
  PID:7532
- C:\Windows\System\OUdRvJw.exe
  C:\Windows\System\OUdRvJw.exe
  2⤵
  PID:7900
- C:\Windows\System\ASsDkEx.exe
  C:\Windows\System\ASsDkEx.exe
  2⤵
  PID:8200
- C:\Windows\System\ZUjXLCO.exe
  C:\Windows\System\ZUjXLCO.exe
  2⤵
  PID:8216
- C:\Windows\System\rywyKKx.exe
  C:\Windows\System\rywyKKx.exe
  2⤵
  PID:8236
- C:\Windows\System\urrDIRw.exe
  C:\Windows\System\urrDIRw.exe
  2⤵
  PID:8256
- C:\Windows\System\hkNclLd.exe
  C:\Windows\System\hkNclLd.exe
  2⤵
  PID:8272
- C:\Windows\System\bMOMyuk.exe
  C:\Windows\System\bMOMyuk.exe
  2⤵
  PID:8288
- C:\Windows\System\QWIkgoF.exe
  C:\Windows\System\QWIkgoF.exe
  2⤵
  PID:8304
- C:\Windows\System\ogAFlJQ.exe
  C:\Windows\System\ogAFlJQ.exe
  2⤵
  PID:8320
- C:\Windows\System\WTiSgXO.exe
  C:\Windows\System\WTiSgXO.exe
  2⤵
  PID:8336
- C:\Windows\System\fdeBysr.exe
  C:\Windows\System\fdeBysr.exe
  2⤵
  PID:8352
- C:\Windows\System\TdrvmzO.exe
  C:\Windows\System\TdrvmzO.exe
  2⤵
  PID:8368
- C:\Windows\System\jznSUWZ.exe
  C:\Windows\System\jznSUWZ.exe
  2⤵
  PID:8384
- C:\Windows\System\vTvksQX.exe
  C:\Windows\System\vTvksQX.exe
  2⤵
  PID:8400
- C:\Windows\System\kIyvDaA.exe
  C:\Windows\System\kIyvDaA.exe
  2⤵
  PID:8416
- C:\Windows\System\cCzCfJb.exe
  C:\Windows\System\cCzCfJb.exe
  2⤵
  PID:8432
- C:\Windows\System\cxVTajT.exe
  C:\Windows\System\cxVTajT.exe
  2⤵
  PID:8448
- C:\Windows\System\iIRrCCy.exe
  C:\Windows\System\iIRrCCy.exe
  2⤵
  PID:8464
- C:\Windows\System\ogQoims.exe
  C:\Windows\System\ogQoims.exe
  2⤵
  PID:8480
- C:\Windows\System\VgkkWAL.exe
  C:\Windows\System\VgkkWAL.exe
  2⤵
  PID:8496
- C:\Windows\System\hwdfxhQ.exe
  C:\Windows\System\hwdfxhQ.exe
  2⤵
  PID:8512
- C:\Windows\System\SnkfVTZ.exe
  C:\Windows\System\SnkfVTZ.exe
  2⤵
  PID:8528
- C:\Windows\System\xXtkFHd.exe
  C:\Windows\System\xXtkFHd.exe
  2⤵
  PID:8548
- C:\Windows\System\YCirtSq.exe
  C:\Windows\System\YCirtSq.exe
  2⤵
  PID:8564
- C:\Windows\System\nYWVHbk.exe
  C:\Windows\System\nYWVHbk.exe
  2⤵
  PID:8580
- C:\Windows\System\onnuxUk.exe
  C:\Windows\System\onnuxUk.exe
  2⤵
  PID:8596
- C:\Windows\System\lpaRZBl.exe
  C:\Windows\System\lpaRZBl.exe
  2⤵
  PID:8612
- C:\Windows\System\rCBNyxU.exe
  C:\Windows\System\rCBNyxU.exe
  2⤵
  PID:8628
- C:\Windows\System\VdAovGt.exe
  C:\Windows\System\VdAovGt.exe
  2⤵
  PID:8644
- C:\Windows\System\jYWvYHN.exe
  C:\Windows\System\jYWvYHN.exe
  2⤵
  PID:8664
- C:\Windows\System\zqAYBrh.exe
  C:\Windows\System\zqAYBrh.exe
  2⤵
  PID:8680
- C:\Windows\System\GhaYQpg.exe
  C:\Windows\System\GhaYQpg.exe
  2⤵
  PID:8696
- C:\Windows\System\qUjheJQ.exe
  C:\Windows\System\qUjheJQ.exe
  2⤵
  PID:8712
- C:\Windows\System\hCGPlhG.exe
  C:\Windows\System\hCGPlhG.exe
  2⤵
  PID:8728
- C:\Windows\System\BdfeATz.exe
  C:\Windows\System\BdfeATz.exe
  2⤵
  PID:8744
- C:\Windows\System\JVRkfyH.exe
  C:\Windows\System\JVRkfyH.exe
  2⤵
  PID:8760
- C:\Windows\System\KotKAYL.exe
  C:\Windows\System\KotKAYL.exe
  2⤵
  PID:8776
- C:\Windows\System\vXVMkWQ.exe
  C:\Windows\System\vXVMkWQ.exe
  2⤵
  PID:8792
- C:\Windows\System\PRFQbIP.exe
  C:\Windows\System\PRFQbIP.exe
  2⤵
  PID:8808
- C:\Windows\System\AiOVAWO.exe
  C:\Windows\System\AiOVAWO.exe
  2⤵
  PID:8824
- C:\Windows\System\HKLasRr.exe
  C:\Windows\System\HKLasRr.exe
  2⤵
  PID:8840
- C:\Windows\System\jiwEBZd.exe
  C:\Windows\System\jiwEBZd.exe
  2⤵
  PID:8856
- C:\Windows\System\wYaJjDM.exe
  C:\Windows\System\wYaJjDM.exe
  2⤵
  PID:8872
- C:\Windows\System\JNviTrN.exe
  C:\Windows\System\JNviTrN.exe
  2⤵
  PID:8888
- C:\Windows\System\qXdcaQU.exe
  C:\Windows\System\qXdcaQU.exe
  2⤵
  PID:8904
- C:\Windows\System\GaFnZyP.exe
  C:\Windows\System\GaFnZyP.exe
  2⤵
  PID:8920
- C:\Windows\System\pUVVNBJ.exe
  C:\Windows\System\pUVVNBJ.exe
  2⤵
  PID:8936
- C:\Windows\System\RspHGED.exe
  C:\Windows\System\RspHGED.exe
  2⤵
  PID:8952
- C:\Windows\System\fZIUhyb.exe
  C:\Windows\System\fZIUhyb.exe
  2⤵
  PID:8968
- C:\Windows\System\zauWUOJ.exe
  C:\Windows\System\zauWUOJ.exe
  2⤵
  PID:8984
- C:\Windows\System\fdzIvpg.exe
  C:\Windows\System\fdzIvpg.exe
  2⤵
  PID:9000
- C:\Windows\System\juynHAf.exe
  C:\Windows\System\juynHAf.exe
  2⤵
  PID:9016
- C:\Windows\System\MCqGumK.exe
  C:\Windows\System\MCqGumK.exe
  2⤵
  PID:9032
- C:\Windows\System\mYmeuPs.exe
  C:\Windows\System\mYmeuPs.exe
  2⤵
  PID:9048
- C:\Windows\System\rLExGRo.exe
  C:\Windows\System\rLExGRo.exe
  2⤵
  PID:9064
- C:\Windows\System\wSIMPbR.exe
  C:\Windows\System\wSIMPbR.exe
  2⤵
  PID:9080
- C:\Windows\System\IuNrhTp.exe
  C:\Windows\System\IuNrhTp.exe
  2⤵
  PID:9096
- C:\Windows\System\ArxHyMa.exe
  C:\Windows\System\ArxHyMa.exe
  2⤵
  PID:9112
- C:\Windows\System\khAKVqT.exe
  C:\Windows\System\khAKVqT.exe
  2⤵
  PID:9128
- C:\Windows\System\FLMnowR.exe
  C:\Windows\System\FLMnowR.exe
  2⤵
  PID:9144
- C:\Windows\System\cdyymwf.exe
  C:\Windows\System\cdyymwf.exe
  2⤵
  PID:9160
- C:\Windows\System\eZxkcoc.exe
  C:\Windows\System\eZxkcoc.exe
  2⤵
  PID:9176
- C:\Windows\System\FGPdKfR.exe
  C:\Windows\System\FGPdKfR.exe
  2⤵
  PID:9192
- C:\Windows\System\KvOdvVh.exe
  C:\Windows\System\KvOdvVh.exe
  2⤵
  PID:9208
- C:\Windows\System\VwEVWJM.exe
  C:\Windows\System\VwEVWJM.exe
  2⤵
  PID:8208
- C:\Windows\System\jFsBMqm.exe
  C:\Windows\System\jFsBMqm.exe
  2⤵
  PID:8252
- C:\Windows\System\KTEmFeo.exe
  C:\Windows\System\KTEmFeo.exe
  2⤵
  PID:8312
- C:\Windows\System\JnfMvLe.exe
  C:\Windows\System\JnfMvLe.exe
  2⤵
  PID:8016
- C:\Windows\System\qmfEnYJ.exe
  C:\Windows\System\qmfEnYJ.exe
  2⤵
  PID:8412
- C:\Windows\System\jfXjfFX.exe
  C:\Windows\System\jfXjfFX.exe
  2⤵
  PID:8476
- C:\Windows\System\KPDIiQU.exe
  C:\Windows\System\KPDIiQU.exe
  2⤵
  PID:8536
- C:\Windows\System\VMFenMK.exe
  C:\Windows\System\VMFenMK.exe
  2⤵
  PID:8604
- C:\Windows\System\mhDORKX.exe
  C:\Windows\System\mhDORKX.exe
  2⤵
  PID:7972
- C:\Windows\System\hSmbhyi.exe
  C:\Windows\System\hSmbhyi.exe
  2⤵
  PID:6692
- C:\Windows\System\nvDxrYi.exe
  C:\Windows\System\nvDxrYi.exe
  2⤵
  PID:7460
- C:\Windows\System\NFWRAwC.exe
  C:\Windows\System\NFWRAwC.exe
  2⤵
  PID:7988
- C:\Windows\System\iUcyfUb.exe
  C:\Windows\System\iUcyfUb.exe
  2⤵
  PID:8524
- C:\Windows\System\tVfiyZC.exe
  C:\Windows\System\tVfiyZC.exe
  2⤵
  PID:8300
- C:\Windows\System\HYeWkJK.exe
  C:\Windows\System\HYeWkJK.exe
  2⤵
  PID:8084
- C:\Windows\System\Egqhmhz.exe
  C:\Windows\System\Egqhmhz.exe
  2⤵
  PID:8180
- C:\Windows\System\GHYTPEh.exe
  C:\Windows\System\GHYTPEh.exe
  2⤵
  PID:8168
- C:\Windows\System\wUFNQfp.exe
  C:\Windows\System\wUFNQfp.exe
  2⤵
  PID:7292
- C:\Windows\System\GfCPzsr.exe
  C:\Windows\System\GfCPzsr.exe
  2⤵
  PID:7916
- C:\Windows\System\BVhGvKR.exe
  C:\Windows\System\BVhGvKR.exe
  2⤵
  PID:1560
- C:\Windows\System\afxTvWM.exe
  C:\Windows\System\afxTvWM.exe
  2⤵
  PID:8520
- C:\Windows\System\ArzctGZ.exe
  C:\Windows\System\ArzctGZ.exe
  2⤵
  PID:8332
- C:\Windows\System\WeHbBGh.exe
  C:\Windows\System\WeHbBGh.exe
  2⤵
  PID:8640
- C:\Windows\System\DCmGVgH.exe
  C:\Windows\System\DCmGVgH.exe
  2⤵
  PID:8676
- C:\Windows\System\KvxfGsi.exe
  C:\Windows\System\KvxfGsi.exe
  2⤵
  PID:8768
- C:\Windows\System\BKyCXUN.exe
  C:\Windows\System\BKyCXUN.exe
  2⤵
  PID:8772
- C:\Windows\System\VfUhWCz.exe
  C:\Windows\System\VfUhWCz.exe
  2⤵
  PID:8832
- C:\Windows\System\IcMYpdq.exe
  C:\Windows\System\IcMYpdq.exe
  2⤵
  PID:8896
- C:\Windows\System\qEPdbaf.exe
  C:\Windows\System\qEPdbaf.exe
  2⤵
  PID:8752
- C:\Windows\System\jAVnkLB.exe
  C:\Windows\System\jAVnkLB.exe
  2⤵
  PID:8784
- C:\Windows\System\uwxKdJv.exe
  C:\Windows\System\uwxKdJv.exe
  2⤵
  PID:8816
- C:\Windows\System\pVvxBlG.exe
  C:\Windows\System\pVvxBlG.exe
  2⤵
  PID:8880
- C:\Windows\System\XhThvSW.exe
  C:\Windows\System\XhThvSW.exe
  2⤵
  PID:8932
- C:\Windows\System\JGnYvyd.exe
  C:\Windows\System\JGnYvyd.exe
  2⤵
  PID:8960
- C:\Windows\System\GnMwaUP.exe
  C:\Windows\System\GnMwaUP.exe
  2⤵
  PID:9056
- C:\Windows\System\awXULLM.exe
  C:\Windows\System\awXULLM.exe
  2⤵
  PID:9124
- C:\Windows\System\yjpoBhG.exe
  C:\Windows\System\yjpoBhG.exe
  2⤵
  PID:8980
- C:\Windows\System\QcfyZDh.exe
  C:\Windows\System\QcfyZDh.exe
  2⤵
  PID:9044
- C:\Windows\System\oOPYFpJ.exe
  C:\Windows\System\oOPYFpJ.exe
  2⤵
  PID:9108
- C:\Windows\System\zrGnWlx.exe
  C:\Windows\System\zrGnWlx.exe
  2⤵
  PID:9168
- C:\Windows\System\xuKIcWe.exe
  C:\Windows\System\xuKIcWe.exe
  2⤵
  PID:9156
- C:\Windows\System\tkMnPwa.exe
  C:\Windows\System\tkMnPwa.exe
  2⤵
  PID:7740
- C:\Windows\System\qrWmsiT.exe
  C:\Windows\System\qrWmsiT.exe
  2⤵
  PID:8020
- C:\Windows\System\wOwIKyo.exe
  C:\Windows\System\wOwIKyo.exe
  2⤵
  PID:8004
- C:\Windows\System\zecYNdh.exe
  C:\Windows\System\zecYNdh.exe
  2⤵
  PID:8244
- C:\Windows\System\cjRQcLf.exe
  C:\Windows\System\cjRQcLf.exe
  2⤵
  PID:8424
- C:\Windows\System\bjpiKMc.exe
  C:\Windows\System\bjpiKMc.exe
  2⤵
  PID:8472
- C:\Windows\System\BKMoXRJ.exe
  C:\Windows\System\BKMoXRJ.exe
  2⤵
  PID:8456
- C:\Windows\System\nfAkNSk.exe
  C:\Windows\System\nfAkNSk.exe
  2⤵
  PID:7752
- C:\Windows\System\vHjAsIK.exe
  C:\Windows\System\vHjAsIK.exe
  2⤵
  PID:8268
- C:\Windows\System\BMVmqTw.exe
  C:\Windows\System\BMVmqTw.exe
  2⤵
  PID:8660
- C:\Windows\System\zuLSROm.exe
  C:\Windows\System\zuLSROm.exe
  2⤵
  PID:8720
- C:\Windows\System\ZinVKAA.exe
  C:\Windows\System\ZinVKAA.exe
  2⤵
  PID:8912
- C:\Windows\System\mBwMlsY.exe
  C:\Windows\System\mBwMlsY.exe
  2⤵
  PID:8976
- C:\Windows\System\FDIjLJK.exe
  C:\Windows\System\FDIjLJK.exe
  2⤵
  PID:9204
- C:\Windows\System\WoPfOEe.exe
  C:\Windows\System\WoPfOEe.exe
  2⤵
  PID:7176
- C:\Windows\System\mFkPYgM.exe
  C:\Windows\System\mFkPYgM.exe
  2⤵
  PID:8280
- C:\Windows\System\MdAJkkI.exe
  C:\Windows\System\MdAJkkI.exe
  2⤵
  PID:8392
- C:\Windows\System\GdkigRg.exe
  C:\Windows\System\GdkigRg.exe
  2⤵
  PID:8636
- C:\Windows\System\EGgaeNC.exe
  C:\Windows\System\EGgaeNC.exe
  2⤵
  PID:9140
- C:\Windows\System\bOXLiYx.exe
  C:\Windows\System\bOXLiYx.exe
  2⤵
  PID:9012
- C:\Windows\System\DNYPwBu.exe
  C:\Windows\System\DNYPwBu.exe
  2⤵
  PID:9028
- C:\Windows\System\orsnOxX.exe
  C:\Windows\System\orsnOxX.exe
  2⤵
  PID:8928
- C:\Windows\System\BUxFZVB.exe
  C:\Windows\System\BUxFZVB.exe
  2⤵
  PID:8624
- C:\Windows\System\TmyspNi.exe
  C:\Windows\System\TmyspNi.exe
  2⤵
  PID:8508
- C:\Windows\System\IlMpUEQ.exe
  C:\Windows\System\IlMpUEQ.exe
  2⤵
  PID:8544
- C:\Windows\System\HZyulAq.exe
  C:\Windows\System\HZyulAq.exe
  2⤵
  PID:8740
- C:\Windows\System\ZNlCnsj.exe
  C:\Windows\System\ZNlCnsj.exe
  2⤵
  PID:7208
- C:\Windows\System\GwHENZd.exe
  C:\Windows\System\GwHENZd.exe
  2⤵
  PID:8232
- C:\Windows\System\aWLGado.exe
  C:\Windows\System\aWLGado.exe
  2⤵
  PID:9152
- C:\Windows\System\YtSDpTg.exe
  C:\Windows\System\YtSDpTg.exe
  2⤵
  PID:9024
- C:\Windows\System\LGMwBeJ.exe
  C:\Windows\System\LGMwBeJ.exe
  2⤵
  PID:9188
- C:\Windows\System\flUKJbQ.exe
  C:\Windows\System\flUKJbQ.exe
  2⤵
  PID:8848
- C:\Windows\System\leWHiIQ.exe
  C:\Windows\System\leWHiIQ.exe
  2⤵
  PID:9224
- C:\Windows\System\rpyuvGo.exe
  C:\Windows\System\rpyuvGo.exe
  2⤵
  PID:9240
- C:\Windows\System\lYwmCNb.exe
  C:\Windows\System\lYwmCNb.exe
  2⤵
  PID:9256
- C:\Windows\System\phWHFLL.exe
  C:\Windows\System\phWHFLL.exe
  2⤵
  PID:9272
- C:\Windows\System\baUNqTf.exe
  C:\Windows\System\baUNqTf.exe
  2⤵
  PID:9288
- C:\Windows\System\VxqYJzO.exe
  C:\Windows\System\VxqYJzO.exe
  2⤵
  PID:9304
- C:\Windows\System\gaxJUTL.exe
  C:\Windows\System\gaxJUTL.exe
  2⤵
  PID:9320
- C:\Windows\System\HSmLFCd.exe
  C:\Windows\System\HSmLFCd.exe
  2⤵
  PID:9336
- C:\Windows\System\MCkOaLp.exe
  C:\Windows\System\MCkOaLp.exe
  2⤵
  PID:9352
- C:\Windows\System\sWlnXrh.exe
  C:\Windows\System\sWlnXrh.exe
  2⤵
  PID:9368
- C:\Windows\System\YElrpYY.exe
  C:\Windows\System\YElrpYY.exe
  2⤵
  PID:9384
- C:\Windows\System\mHXsgxA.exe
  C:\Windows\System\mHXsgxA.exe
  2⤵
  PID:9400
- C:\Windows\System\nZjWTKx.exe
  C:\Windows\System\nZjWTKx.exe
  2⤵
  PID:9416
- C:\Windows\System\RbhMFUq.exe
  C:\Windows\System\RbhMFUq.exe
  2⤵
  PID:9432
- C:\Windows\System\XGLSDIz.exe
  C:\Windows\System\XGLSDIz.exe
  2⤵
  PID:9452
- C:\Windows\System\QVINJYK.exe
  C:\Windows\System\QVINJYK.exe
  2⤵
  PID:9468
- C:\Windows\System\IjwKZDA.exe
  C:\Windows\System\IjwKZDA.exe
  2⤵
  PID:9484
- C:\Windows\System\tlTpcAU.exe
  C:\Windows\System\tlTpcAU.exe
  2⤵
  PID:9500
- C:\Windows\System\ILqdFAp.exe
  C:\Windows\System\ILqdFAp.exe
  2⤵
  PID:9516
- C:\Windows\System\XrjfCQZ.exe
  C:\Windows\System\XrjfCQZ.exe
  2⤵
  PID:9532
- C:\Windows\System\cMCcRBc.exe
  C:\Windows\System\cMCcRBc.exe
  2⤵
  PID:9548
- C:\Windows\System\IwqlNnS.exe
  C:\Windows\System\IwqlNnS.exe
  2⤵
  PID:9564
- C:\Windows\System\NmerUqP.exe
  C:\Windows\System\NmerUqP.exe
  2⤵
  PID:9580
- C:\Windows\System\lvLDckm.exe
  C:\Windows\System\lvLDckm.exe
  2⤵
  PID:9600
- C:\Windows\System\bzpgByV.exe
  C:\Windows\System\bzpgByV.exe
  2⤵
  PID:9616
- C:\Windows\System\fsaujyT.exe
  C:\Windows\System\fsaujyT.exe
  2⤵
  PID:9632
- C:\Windows\System\BNAewMP.exe
  C:\Windows\System\BNAewMP.exe
  2⤵
  PID:9648
- C:\Windows\System\edlfrTb.exe
  C:\Windows\System\edlfrTb.exe
  2⤵
  PID:9668
- C:\Windows\System\kFtqjha.exe
  C:\Windows\System\kFtqjha.exe
  2⤵
  PID:9684
- C:\Windows\System\WgAKLdg.exe
  C:\Windows\System\WgAKLdg.exe
  2⤵
  PID:9700
- C:\Windows\System\vCbyDNk.exe
  C:\Windows\System\vCbyDNk.exe
  2⤵
  PID:9716
- C:\Windows\System\ZUDNsXj.exe
  C:\Windows\System\ZUDNsXj.exe
  2⤵
  PID:9736
- C:\Windows\System\NfDkwOw.exe
  C:\Windows\System\NfDkwOw.exe
  2⤵
  PID:9752
- C:\Windows\System\YjnTrHQ.exe
  C:\Windows\System\YjnTrHQ.exe
  2⤵
  PID:9768
- C:\Windows\System\hNzYqZv.exe
  C:\Windows\System\hNzYqZv.exe
  2⤵
  PID:9784
- C:\Windows\System\QkctmzV.exe
  C:\Windows\System\QkctmzV.exe
  2⤵
  PID:9800
- C:\Windows\System\uwDVVbu.exe
  C:\Windows\System\uwDVVbu.exe
  2⤵
  PID:9816
- C:\Windows\System\czFWLqQ.exe
  C:\Windows\System\czFWLqQ.exe
  2⤵
  PID:9832
- C:\Windows\System\WzVaRsy.exe
  C:\Windows\System\WzVaRsy.exe
  2⤵
  PID:9848
- C:\Windows\System\IfcvcpO.exe
  C:\Windows\System\IfcvcpO.exe
  2⤵
  PID:9864
- C:\Windows\System\YNcckiZ.exe
  C:\Windows\System\YNcckiZ.exe
  2⤵
  PID:9880
- C:\Windows\System\XHZMWjw.exe
  C:\Windows\System\XHZMWjw.exe
  2⤵
  PID:9896
- C:\Windows\System\YbHcXYV.exe
  C:\Windows\System\YbHcXYV.exe
  2⤵
  PID:9912
- C:\Windows\System\mZdQIIF.exe
  C:\Windows\System\mZdQIIF.exe
  2⤵
  PID:9928
- C:\Windows\System\DdeXaDb.exe
  C:\Windows\System\DdeXaDb.exe
  2⤵
  PID:9944
- C:\Windows\System\BAnXZqx.exe
  C:\Windows\System\BAnXZqx.exe
  2⤵
  PID:9960
- C:\Windows\System\vaOfbLa.exe
  C:\Windows\System\vaOfbLa.exe
  2⤵
  PID:9976
- C:\Windows\System\vxSibLo.exe
  C:\Windows\System\vxSibLo.exe
  2⤵
  PID:9992
- C:\Windows\System\uEWFPrf.exe
  C:\Windows\System\uEWFPrf.exe
  2⤵
  PID:10008
- C:\Windows\System\IIGeGqF.exe
  C:\Windows\System\IIGeGqF.exe
  2⤵
  PID:10024
- C:\Windows\System\IbgHEOY.exe
  C:\Windows\System\IbgHEOY.exe
  2⤵
  PID:10040
- C:\Windows\System\imVBzYe.exe
  C:\Windows\System\imVBzYe.exe
  2⤵
  PID:10056
- C:\Windows\System\odKWrLb.exe
  C:\Windows\System\odKWrLb.exe
  2⤵
  PID:9540
- C:\Windows\System\xasYCqD.exe
  C:\Windows\System\xasYCqD.exe
  2⤵
  PID:9660
- C:\Windows\System\EYkJZDg.exe
  C:\Windows\System\EYkJZDg.exe
  2⤵
  PID:9608
- C:\Windows\System\adDdBQI.exe
  C:\Windows\System\adDdBQI.exe
  2⤵
  PID:9680
- C:\Windows\System\TLakwuj.exe
  C:\Windows\System\TLakwuj.exe
  2⤵
  PID:9728
- C:\Windows\System\JKBrHXv.exe
  C:\Windows\System\JKBrHXv.exe
  2⤵
  PID:9744
- C:\Windows\System\vRBisIy.exe
  C:\Windows\System\vRBisIy.exe
  2⤵
  PID:9860
- C:\Windows\System\ZSQywAg.exe
  C:\Windows\System\ZSQywAg.exe
  2⤵
  PID:9924
- C:\Windows\System\opYFsnE.exe
  C:\Windows\System\opYFsnE.exe
  2⤵
  PID:9876
- C:\Windows\System\XIpAJBC.exe
  C:\Windows\System\XIpAJBC.exe
  2⤵
  PID:9936
- C:\Windows\System\sQQbMhf.exe
  C:\Windows\System\sQQbMhf.exe
  2⤵
  PID:9780
- C:\Windows\System\KJepewd.exe
  C:\Windows\System\KJepewd.exe
  2⤵
  PID:10004
- C:\Windows\System\AARNsuG.exe
  C:\Windows\System\AARNsuG.exe
  2⤵
  PID:9808
- C:\Windows\System\zWyspFh.exe
  C:\Windows\System\zWyspFh.exe
  2⤵
  PID:10052
- C:\Windows\System\oHdKAmd.exe
  C:\Windows\System\oHdKAmd.exe
  2⤵
  PID:10076
- C:\Windows\System\ItwMWwr.exe
  C:\Windows\System\ItwMWwr.exe
  2⤵
  PID:10092
- C:\Windows\System\pLeMcrE.exe
  C:\Windows\System\pLeMcrE.exe
  2⤵
  PID:10108
- C:\Windows\System\ochRuKL.exe
  C:\Windows\System\ochRuKL.exe
  2⤵
  PID:10124
- C:\Windows\System\xDuRfqG.exe
  C:\Windows\System\xDuRfqG.exe
  2⤵
  PID:10140
- C:\Windows\System\uvjBmHe.exe
  C:\Windows\System\uvjBmHe.exe
  2⤵
  PID:10156
- C:\Windows\System\KZndEPO.exe
  C:\Windows\System\KZndEPO.exe
  2⤵
  PID:10168
- C:\Windows\System\GUBMEYa.exe
  C:\Windows\System\GUBMEYa.exe
  2⤵
  PID:10188
- C:\Windows\System\gMJHOqU.exe
  C:\Windows\System\gMJHOqU.exe
  2⤵
  PID:10212
- C:\Windows\System\PlJtHZj.exe
  C:\Windows\System\PlJtHZj.exe
  2⤵
  PID:10220
- C:\Windows\System\KgdxXsY.exe
  C:\Windows\System\KgdxXsY.exe
  2⤵
  PID:10236
- C:\Windows\System\itRMsun.exe
  C:\Windows\System\itRMsun.exe
  2⤵
  PID:8228
- C:\Windows\System\flFyweG.exe
  C:\Windows\System\flFyweG.exe
  2⤵
  PID:9060
- C:\Windows\System\Hgidpbm.exe
  C:\Windows\System\Hgidpbm.exe
  2⤵
  PID:9264
- C:\Windows\System\CRmYYmr.exe
  C:\Windows\System\CRmYYmr.exe
  2⤵
  PID:9296
- C:\Windows\System\BafyhYU.exe
  C:\Windows\System\BafyhYU.exe
  2⤵
  PID:9332
- C:\Windows\System\mkeilKu.exe
  C:\Windows\System\mkeilKu.exe
  2⤵
  PID:9364
- C:\Windows\System\gFAVSAl.exe
  C:\Windows\System\gFAVSAl.exe
  2⤵
  PID:8864
- C:\Windows\System\RQkqFkD.exe
  C:\Windows\System\RQkqFkD.exe
  2⤵
  PID:8488
- C:\Windows\System\EdqsBgy.exe
  C:\Windows\System\EdqsBgy.exe
  2⤵
  PID:9396
- C:\Windows\System\AmKtNUj.exe
  C:\Windows\System\AmKtNUj.exe
  2⤵
  PID:9424
- C:\Windows\System\lXqLqwD.exe
  C:\Windows\System\lXqLqwD.exe
  2⤵
  PID:9348
- C:\Windows\System\rGxKHtb.exe
  C:\Windows\System\rGxKHtb.exe
  2⤵
  PID:9464
- C:\Windows\System\caCZKLl.exe
  C:\Windows\System\caCZKLl.exe
  2⤵
  PID:9524
- C:\Windows\System\rQhMoUy.exe
  C:\Windows\System\rQhMoUy.exe
  2⤵
  PID:9588
- C:\Windows\System\FnfzceI.exe
  C:\Windows\System\FnfzceI.exe
  2⤵
  PID:9412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EVxkUXt.exe

Filesize
1.9MB

MD5
bd486d8f636667ea465b0a0bdc822174

SHA1
810f599c2e11b86c5bc23688dab378bb7a68f48b

SHA256
71dc912b0d7fa9e4171fb0193349ba6cc81fccaad81451564056010efaad4f08

SHA512
9929287fe4e6511ffb4d0b7928290998b18df6becd9a95871a766cf3c21300f1d034b4ab267e35a8771e1044a4709c53d34383038058a52f1fbbd27964db0a18

Download Submit
C:\Windows\system\FfgBtTV.exe

Filesize
1.9MB

MD5
23436ef51541d38496189acdac7395b0

SHA1
5c1154497fb79ba5a828d3c8af594e7854a4b2b1

SHA256
2ce1d18806522a05a5edb7805188c9556a78eae7ab6718676284bf15a54154ea

SHA512
482f2a9d2cb71c9b0da77ae3cd61c156f505fa9388c5ee8a2ec02037745298f066595b2b10a7df2a583b62d07879778c67f870c19f2ea3c41137f45e870775e9

Download Submit
C:\Windows\system\HASBhZp.exe

Filesize
1.9MB

MD5
d100934ad1cf8ca2df2e5648986d5098

SHA1
3fc0131d6f16e6e8a242dc95e8b42920f138a2f0

SHA256
f79ae4d3387a1870ba09351724359806f859f36904b78f3fc9ef4d61407f3395

SHA512
d240a196bad338104d014881ff6b5a0e0fc75020cb08b66296ef6cedfa018a80cd81c61b2ebb8fbd16f02a5b4604d9551bc3f6638390e6656464f3a4cb77662e

Download Submit
C:\Windows\system\HxgHKUG.exe

Filesize
1.9MB

MD5
e3fccfac2350a74ef5c397b23f4e3837

SHA1
908bcabf281504c1d9d501e8724e7a12e3842815

SHA256
6545e2cc7ca85b15666d6cc306057add47de3b3018f72aa7686ed0ee76f836a9

SHA512
24b14bf801b968a34ebb81bf25e9f3fdeb9a648f266147a158798448e2cff0300edf568ed53e8ce5a724bc2b811e5c6b24e0267bb1feea1b6777009907d1e05f

Download Submit
C:\Windows\system\NqcXkxe.exe

Filesize
1.9MB

MD5
9389af27540b1a991b0a8e567cf5a19b

SHA1
f2ac33ea5e8e8533cf4caf086bd31acd01bef744

SHA256
1f559d2b1b9e75d801eeaca87c7523254023b63e621ea51325c52d60d1a2c70c

SHA512
2139eda89e7490d84059c6e0cccd4d867d0b291e694b60ca032209da34b7d6597203c1329ab87ae06217300cdf7f641c0ed18f3113254eb5c33658874f60f07a

Download Submit
C:\Windows\system\OTmOzwu.exe

Filesize
1.9MB

MD5
c58e7fbfcf90a471e3b2765d9d5046b7

SHA1
51ca5b7b65ab57ce25225f4db1ec51d0365d2dff

SHA256
87a021ec6611ff9300dbeed958df3272e6a5b333abf80b6b28b96c7970e6e703

SHA512
a341ab27f36999d510a7985ea9e2b0f25df82692845e1f401a18899e6d0760737d42f28783d8dbb660b53078b1b672f65432879877b884176b026dbfdad136c6

Download Submit
C:\Windows\system\QWWSlvH.exe

Filesize
1.9MB

MD5
de36bcb69114a5af79e773b7f4930efe

SHA1
adf54f9b6879c8e574ce5a1940a267c77c9e71f3

SHA256
b49c4f446df7c9ea109266b430fff7445f1e2fb0098506b40f6cbc5a87178978

SHA512
eed50f853b34893dfa10b7ffc7945898c46f36165983e91b6ca92bc38b22bd65e45efadc28882354505ff65fe7385bb51491ef0b71d48bfc2099a63efa037361

Download Submit
C:\Windows\system\TZEKfKa.exe

Filesize
1.9MB

MD5
9a97f7f4149d6d109298760857bc7a02

SHA1
c4c3f8369a9feef0c159a4a1fa8135c383f07a40

SHA256
ced1adc0d49cf4485bda7386d37275b8738412bd97680b49ac96c8a398393403

SHA512
048424200b39cedd224f40d124f994d52f58118b06158b9cec70c060faaee93d482254867bdbba47dd408f285ff53ec683710f7414eb2fe8aa57ec26bd1605d7

Download Submit
C:\Windows\system\XbwsUya.exe

Filesize
1.9MB

MD5
d805d3f1ce44dd43e6b312eff894fe43

SHA1
2dc3995a114134a72404cb16ba0ae4029eb48efd

SHA256
80d1ebeea4a5d968e8859a2ff1b6a4f5c4ee2c58a2141014bc5c255886b16a4e

SHA512
98397143b415553919f2a9b0cc8ad1bcb29c4640e45f9ae3a5aa55f4b09b9fe40cf1cf6b524962e668e2d015aa3ac59ea09167c7c4ede29689322f34aa58fe02

Download Submit
C:\Windows\system\XjiaYOg.exe

Filesize
1.9MB

MD5
2278406ae3746263a51580f23ccb346f

SHA1
8ab410c00b145371ecb865b0d750106a75353ee7

SHA256
260f1d865306c3c66c833988fe6047b6fbdb81c4c6e7426bf4a1dadc9bcbfdb7

SHA512
521c05fdd2cdfbd801f607dcd87b53b4cb7cac31ce6bf713f03d1c7a77e1497c797ae4c72ebae3eae4fcd51842e6b1bd9ab56580b47aa774c1062ba53723d785

Download Submit
C:\Windows\system\YQKeDJr.exe

Filesize
1.9MB

MD5
789878d06c96b002b74a65fcb1f52032

SHA1
14c3d34594685b331418a44cd84c532abbbe7668

SHA256
4419d99d9b33cf97bcfba8d9044afcecc37083ae70df2ebb2455a53a12d57a37

SHA512
4a2fe04412812779b5d2b177b0460a30574f1b63f284191e33f2e8c9170f68ba1e1137515fe805683fc926c899d0f9a493f10306f5017928bf2f189a64eb6bf6

Download Submit
C:\Windows\system\ZVbemZb.exe

Filesize
1.9MB

MD5
322aca63c79a4d364da4e7b493d3ef6f

SHA1
a72d160b8812bbdd8f6e25f3c84d6ed4b829f827

SHA256
2d8ac5454ee9c4eac18c956212da95696b8fe870df22f0b9b7ec6d646725622c

SHA512
fe5572856ec691a743ec0f0180ba12de8f90b06ab3c2a76d22519124a3c3474e028efafd5135517fa198d80f94d0f7260a3502153b671593c7572c67e07a0e3f

Download Submit
C:\Windows\system\dGitzGw.exe

Filesize
1.9MB

MD5
ab44700e473c98b5cb1a18188bb9cb8d

SHA1
8a6608a9a6a14e338ae3ba6aeab0ac39d086fab8

SHA256
47ba877383509d5ae767917459d6af486dca72e8414881a8e8ce250a10a1e562

SHA512
a46b5f448fceec9963910488e6664fbb2aa6a25797faa518b36167955ec58e722f54062dce1d533a78ec34ecc36ea5993fa64e51a03419b56458464f4b57d68b

Download Submit
C:\Windows\system\dIpLytu.exe

Filesize
1.9MB

MD5
d9c9be4e2d6633d80f24350d8a7b2a4f

SHA1
e8123f875639a73f38f66685edac34e641d626e0

SHA256
0110ce21e033bd888064fb6e625709577e4a3b0e43fa02e4093927fd66308700

SHA512
43bca049a166230da8ed1d71e417946edabe4ee932b3587def8b947d4b1c261f218e9a6115268ade96099c15b4de9afed5d115f4d291be40f678516c2a0d5d58

Download Submit
C:\Windows\system\dJdePNx.exe

Filesize
1.9MB

MD5
3d2550b2e7734cb8a4bdb7f93b01f7a3

SHA1
cbfa9a07ed90778a432c380b1c0ec936525cf702

SHA256
0254a5589601c325352e7e7da3076340ba77d4e43a78248f3f719272a2c4e010

SHA512
bc3630176f7dabe2e9799c06983671792498aacf2e22c7826c30b0c9752ac5268a4ce84b87e513d62ed0cbdca674284f2ed79094cc81db6ab9eafbd09a08de98

Download Submit
C:\Windows\system\fjAoKqC.exe

Filesize
1.9MB

MD5
4a6eb2c2019da402525ba10878dcf5fd

SHA1
cef79846f7d9f766359a27e5f5aa0709478b7527

SHA256
555470ff5150b05a304110108ffa14e8752de0de65272982c06e4f35572a3f92

SHA512
c9fff2f27e0ed16eea2345f6f0b29cdc2c1a35de442e684d9a9054073c4d4717dd8016ed6b6470a7e69a0418d04a6fada51fac2367c4b37e51ca4d83b9cf84d1

Download Submit
C:\Windows\system\hLejyvb.exe

Filesize
1.9MB

MD5
54488a5f0308f1f1017abf87da84c3f8

SHA1
1e73791d3e2983d07bfe077f7192516b7cd049cb

SHA256
022996fd7ed604d764768014049c439776c3de402f259d216420de496870b548

SHA512
14f77633b39440e0d13aee796915d2c9dca8462cb70ca0d9babfd590610d9d5983dc511405769151db614ccb594c70f5d7642a6044343d907551801427a49621

Download Submit
C:\Windows\system\jlYMIfv.exe

Filesize
1.9MB

MD5
65a8c640aff9887a1c29d1922cccb004

SHA1
e54f47ae3a2a0eb2065837414dc9598ca2491aca

SHA256
1200c5d26b79a468d6c375e607d6e6d4e317bfeaba97c87eb123a93b7f3ca1ad

SHA512
aa6f2d4ad73e77c7d4e76c86f11fe8cfc9b712dd48fa823634073030a68543efd445209beb89cb8258e52884fc4e44d217c87f9b389584a2598936fbf4d6b057

Download Submit
C:\Windows\system\kFLJZnq.exe

Filesize
1.9MB

MD5
5bda00185b8675c2754d63ea9a5ea3c0

SHA1
a34014a4439a6335c7b807883f4e61c03ea4383e

SHA256
91df7f1f2af19178ab08d64d141de744ca2a9123efeccd59289126f1d8d282c1

SHA512
ca69a03f2298dd6d03b993acd72792e43c643d9e0bbfeba540af42c26548993cbf0219d47c6d674c12e9acff80c391632e1b279c7226446d35c597644a42f49b

Download Submit
C:\Windows\system\nVtmJEP.exe

Filesize
1.9MB

MD5
1c15696009890ee8be29192135e42557

SHA1
50b13a025135aa7e3544fbb30740e105c33ac94b

SHA256
3338dc2fdf5617c1ba07d78588000cd41c1c180288082bdaedf97235b2a00927

SHA512
7cedbe425e332e270a9d80d0980bc4636222346ecb7dadd990a127e9897a53bd0ecf9c11a5d7edac4b7279540f7acd6e6995e6b5cbab923c1408b782df551cf9

Download Submit
C:\Windows\system\qVBEbae.exe

Filesize
1.9MB

MD5
b51c1d4878bda42a6f6d36a827c0d53f

SHA1
e2dd4dca7d6ae7a0e1981bf9f7eae399de6ac691

SHA256
e0cb581afe209a3c3085d5efeec99ac1d3f8c7a266941bd7f15b752d507da2b6

SHA512
b772a4e5812af1f24e7a665db7eb8baa19117582272c042001a91227502cc9919384101449159d9bb741d1316dba3e5b6e27368b2069ed27d121650af588ee82

Download Submit
C:\Windows\system\rEkauzf.exe

Filesize
1.9MB

MD5
4cdc7d5cb2aa68d5d90aa853e246831d

SHA1
3c380a7067f3c2effefe8e0508af9ac41b61f40f

SHA256
5241d53bd5289973c24286da79b9d2810ee9ea625cbfde4fcd912b202b3ba9b7

SHA512
cda0fe8ecaf0e9aa9bc0b257780249ca63b4adcaf49f3e2b6bdf72b1dd1740fbf9afe54bf0883358530af212c00c7d26ca514adc0cb14865646dd1a8d995c66c

Download Submit
C:\Windows\system\sGvAMaS.exe

Filesize
1.9MB

MD5
17aecde0ecfb5e6c18975491f8cfe7eb

SHA1
bae2be12516dbb06d217f97748a4361db960b271

SHA256
7b1891a8f639902bdd3829f2f208b92182bebaad0815bb003c2982a445c363c8

SHA512
4151ac7634f892ebda8390905fd9c1fdd43e71437a415155d09c042de2f81690aa6c413f3335dd4de611785f5314e5032cf492f303c4a1e7fd749c4f76c92061

Download Submit
C:\Windows\system\tksVOzX.exe

Filesize
1.9MB

MD5
6885c878b21bc4f88ad12d00e6218767

SHA1
dd314c44572c3ea1806ea2d245d391c0d9f39d0c

SHA256
ab004027e0dafc7dd435a344ba4e35f8edb52e84b3d3cedec4f8340f0c07c991

SHA512
3d10cbdddf438f9dece43f6b94fd6c84e7650c1ad0b78065eed2a44247ef5b8f13fb67d33e0b054c527ac798c42f4979ba9b9dd591f11a4b92d3f1b76fa693ae

Download Submit
C:\Windows\system\urUKKyi.exe

Filesize
1.9MB

MD5
93615c2aef2aa44abcc213fe92c2efac

SHA1
7d5f9555fb250aaf79b1e2a62c4a231990f9df9f

SHA256
153db728f013891e847c63716769f465577b80c177329328baa9778620495056

SHA512
81e3b3a35dfbdb13767c4d6713f8e889bd3d2308125b1c642b341305d369ef4af99f5f07e1947657e1f44b500b1043eb6eb6c20d68f4ee50f05780dee3dcbbb8

Download Submit
C:\Windows\system\vCdXbFH.exe

Filesize
1.9MB

MD5
8a19506f37ee6a4a846013bac03298b7

SHA1
9c1f9e66422512fd1b40922667a319eae55f95f1

SHA256
2ac2336974dfe762cc87c539095694ed80db7e3e8da5b0555f92a19588247db5

SHA512
2232f1016d67b9557faa4a194eb38a9ddaf7f0804f57919dfeca7d1a5cc6a8b31b0ab4c96619255fca6b3fbbde804ea5e32ffc3f29ea5db78202424fce8b206a

Download Submit
C:\Windows\system\yIexMqT.exe

Filesize
1.9MB

MD5
74c970c49f802a03c8bb6a762e810d67

SHA1
b02d3c59d9bcad72d9616000119f915867f89f48

SHA256
10cdfbb0d782bfffc2108304a7f6a6c5de3f5b11b62ee156a3aeb2dd8015be07

SHA512
8676ddda41bd7ff62e246c753624fd1e38a7bc9c70a18a90f22878eea6f595e313d5d9ebf268912e6f17dc3ad80b455da51c838425af3981cd4db7f83a189471

Download Submit
C:\Windows\system\ylXBVXm.exe

Filesize
1.9MB

MD5
2ba0965012d34f553e4ba9331e61d3e3

SHA1
0ace5e13da808b4819d8d6d36809caa4ede77a5a

SHA256
f4ca84a84affcab86f2ff786ccecbaf86d6088840b56980c967ea94462a42d64

SHA512
b96ba80bfe7ee7592fb43aa933d0a95f2ed937a07ecdfbdecd647edc5ec866553bbc670879bfd25580e66bfe7f846eb7689a6300ca91a15653f9ffcafe1c4294

Download Submit
C:\Windows\system\yobyWVW.exe

Filesize
1.9MB

MD5
23237f074aed156603af70fdbd414e46

SHA1
14454babeed9bb63d3b3a5cbc1074206f6fea013

SHA256
36cf0d3843bde254991ec24946c036f5d79ab29eb4d04e13797a951ed6aed8e1

SHA512
0496319c3cf886c6855fcbe27fdad16b0caf16b2c291fc258bca717cc62ba4b3695cdfb66e267c46235f41b3604929d10b67d2b8503a7da6c0ee4086df334ada

Download Submit
C:\Windows\system\zzvegPS.exe

Filesize
1.9MB

MD5
dfbcaa9cf3b8733964dcf17ed2e39144

SHA1
b36c8732077b9b0caf799dc7c2dc435cfe200fb7

SHA256
eefec34c2554e0e6ded81a803c97213b3c1798e0afbf9f720579f1481ff8990c

SHA512
7f1a3030b8c2424216cb465bbff309e13e160912357282bda68d0a02c1674ed90f7d2f022f96a38dbf16880b622afc84b63fa58acfeb2b12d299d06405f22b7c

Download Submit
\Windows\system\qvWMoww.exe

Filesize
1.9MB

MD5
363b5eb1801b2389d3afdf5afc651cd6

SHA1
ee18c0a23f39dada56d687ed9f76c7fcb05ad34d

SHA256
d904b9256c20cf24013be42fd5575eae947c6665f2d72611942e4e5c21d7fd4d

SHA512
0aba8576858c79bd8a546bbd1ef1b19a33ce35a3f87c3140132a424320bacda9cbd8f1b437cc70084995c31dc2d08f4f0cd679f032c9413d4c77d0d8908443b0

Download Submit
\Windows\system\xLQlxSg.exe

Filesize
1.9MB

MD5
551628779413ec3ef3078afbb5e30953

SHA1
eff25fe0b218f7ae2e768c2b79d1b20f1fda9327

SHA256
9679a9787a5f7684101ede2947fa356fe7246226b3ca0e26f8e41bc4a77bad1e

SHA512
eda382a53ef60c42d87bc36b6932fe3f90946fd75fdea3ab4cc2b745783e4196dfec73566fdc39473c8553ba76079f3d4a3297be5eef7d802f4fbbe92fa7b766

Download Submit
memory/1744-363-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/1744-1-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/1744-386-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/1744-380-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/1744-382-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/1744-351-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/1744-378-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/1744-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1744-372-0x0000000002CB0000-0x00000000030A2000-memory.dmp

Filesize
3.9MB

Download
memory/1744-390-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/1744-369-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/1744-388-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/1744-365-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/1744-384-0x0000000002CB0000-0x00000000030A2000-memory.dmp

Filesize
3.9MB

Download
memory/2136-389-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2444-383-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2484-391-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2552-385-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2560-381-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-371-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-373-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2704-379-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/2708-387-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2840-396-0x00000000029A0000-0x00000000029A8000-memory.dmp

Filesize
32KB

Download
memory/2840-395-0x000000001B520000-0x000000001B802000-memory.dmp

Filesize
2.9MB

Download
memory/2884-394-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-364-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2988-368-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download