xmrig | c7319dd790ef5ca5c395e1decfe4c7b67a65a13a8e57e4f6f314ad4f39afa7db

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
Size

1.7MB
MD5

00977a48201a3ae8125191b31fa68204
SHA1

5b59a47f93b522a5409e324e97b2b8ffaf811c62
SHA256

c7319dd790ef5ca5c395e1decfe4c7b67a65a13a8e57e4f6f314ad4f39afa7db
SHA512

cfab62ef89d70fd5decd603e984402a8c7969c6e093f8e90286ff128f475dbbca5b3e7b029beafea883ff3e33c05a006652d1f9fac3e471fdecc43b116e189a0
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFtC:Lz071uv4BPMkibTIA5I4TNrpDGKaU

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2832-78-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2440-101-0x0000000002540000-0x0000000002932000-memory.dmp	xmrig
behavioral1/memory/2776-94-0x000000013FB20000-0x000000013FF12000-memory.dmp	xmrig
behavioral1/memory/2524-92-0x000000013F440000-0x000000013F832000-memory.dmp	xmrig
behavioral1/memory/3060-90-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2812-89-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2532-88-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2896-87-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	xmrig
behavioral1/memory/2676-86-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2836-77-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2836	cNXsEuS.exe
2832	mUlsVvG.exe
2676	cFqTaup.exe
2896	amsvXyV.exe
2532	rOOFSno.exe
2812	HZdaacf.exe
3060	oQdyLku.exe
2524	mpPKKVZ.exe
2776	hgusiww.exe
2632	LOweZmP.exe
2984	VEzOxrw.exe
2752	XEPgjEg.exe
1916	FQatfTB.exe
2716	uqWEygb.exe
1152	YlVarxH.exe
1912	zFtgCAA.exe
3016	mkKiTpF.exe
1944	WIzaHPo.exe
1684	NJRamVm.exe
2604	weODftb.exe
1900	vYyWNUq.exe
1216	yOfAIzn.exe
664	OKjkSgA.exe
2256	HYeYtni.exe
556	zSCRilw.exe
2864	jNEaflv.exe
2972	bCHHakl.exe
1840	NeAgRBh.exe
1584	iBpYtgD.exe
1596	WQJiNrO.exe
2904	cfecaVO.exe
484	rYFzeOW.exe
580	kaHZbET.exe
1752	FGyUtZZ.exe
2244	EioKYkm.exe
1124	VLKwvvu.exe
1348	MMUsTQL.exe
1788	HjpAvrj.exe
1556	sjQJhnD.exe
1092	uEBKXxA.exe
1904	SVpudQe.exe
1328	xxIBnvo.exe
1864	sneXEJK.exe
568	UWUpIqB.exe
940	TwnbPey.exe
3044	BFkzeGp.exe
1764	gYYWPgk.exe
1924	rhLiEIh.exe
1512	almFhrG.exe
2288	VzqPFoP.exe
3048	fLrebcJ.exe
1600	XvlwPWb.exe
2804	QfwubwZ.exe
2664	FiWWgow.exe
2292	GemJZgN.exe
1936	NLICdzs.exe
2504	oCyNsyC.exe
2620	KITjQCj.exe
676	ZTuzjOm.exe
2644	MjHKyPb.exe
2580	ztjuDBQ.exe
2828	ZbKvnMD.exe
2496	vesuDrq.exe
2236	SAkrTok.exe

Loads dropped DLL 64 IoCs

pid	Process
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2440-1-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/files/0x000b00000001227c-19.dat	upx
behavioral1/files/0x000a000000013abd-49.dat	upx
behavioral1/files/0x000600000001475f-71.dat	upx
behavioral1/memory/2832-78-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/files/0x000800000001451d-84.dat	upx
behavioral1/files/0x0006000000014d0f-109.dat	upx
behavioral1/files/0x0006000000015b37-147.dat	upx
behavioral1/files/0x0006000000015cc2-179.dat	upx
behavioral1/files/0x0006000000015077-125.dat	upx
behavioral1/files/0x0006000000015cca-187.dat	upx
behavioral1/files/0x00060000000150aa-176.dat	upx
behavioral1/files/0x0006000000014fac-174.dat	upx
behavioral1/files/0x0007000000014c0b-172.dat	upx
behavioral1/files/0x00060000000148af-169.dat	upx
behavioral1/files/0x0006000000015ca9-165.dat	upx
behavioral1/files/0x0006000000015c91-157.dat	upx
behavioral1/files/0x0006000000015b72-149.dat	upx
behavioral1/files/0x000600000001474b-144.dat	upx
behavioral1/files/0x0006000000015a15-139.dat	upx
behavioral1/files/0x000600000001523e-131.dat	upx
behavioral1/files/0x000600000001543a-129.dat	upx
behavioral1/files/0x00060000000146a7-118.dat	upx
behavioral1/files/0x00060000000145c9-106.dat	upx
behavioral1/files/0x00130000000054a8-104.dat	upx
behavioral1/files/0x0006000000014730-55.dat	upx
behavioral1/files/0x0006000000015c9b-162.dat	upx
behavioral1/files/0x0006000000015bb5-155.dat	upx
behavioral1/files/0x00060000000155e8-136.dat	upx
behavioral1/memory/2776-94-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/memory/2524-92-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/memory/3060-90-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/memory/2812-89-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/memory/2532-88-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2896-87-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	upx
behavioral1/memory/2676-86-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2836-77-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/files/0x0008000000013a85-68.dat	upx
behavioral1/files/0x0008000000013a15-58.dat	upx
behavioral1/files/0x00060000000145d4-51.dat	upx
behavioral1/files/0x0006000000014525-50.dat	upx
behavioral1/files/0x0008000000013a65-48.dat	upx
behavioral1/files/0x00090000000134f5-47.dat	upx
behavioral1/files/0x0039000000013362-17.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mWmVOMs.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\vrdOsJM.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\OKLFPEK.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\gmWPoWo.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\OtiSzWD.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\RDmjdaq.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\CnsRTlk.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\LjmbQuO.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\zNxBmIM.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\AAKtvJD.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\tUtGcBj.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\PAshppx.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\MZlfXaE.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\TnaQMDu.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\AiWSXTK.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\icexBXN.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\nKOIdrQ.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\ujgGZLH.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\OrKgsWw.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\zSCRilw.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\icbDkyc.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\YFSXbOJ.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\SKylhAj.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\JYiDocT.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\HYeYtni.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\jydocjc.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\hrfTirn.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\QUaQQvD.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\LdLinQx.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\DLdNloh.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\kTNkPcV.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\UIYGQYw.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\BDwOkgo.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\ZCIriQj.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\kVDFLmg.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\YhjLeqE.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\ESzvTAH.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\uZaQnzp.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\iygYvJH.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\bddQMno.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\bCWpumR.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\lWDWUPj.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\DiGLkLy.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\nUpwdlJ.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\hsGcRki.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\XvlwPWb.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\pGTLXey.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\nLPMcWi.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\JBpvYfg.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\LOweZmP.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\kaHZbET.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\PQoTAGg.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\JdWZqdj.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\MdpJgYS.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\BDhdFPN.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\SLkYVNn.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\MwdPlNi.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\BzVaBVn.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\yNAdDgL.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\uwTLgTe.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\SJjFCpU.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\XBUZLuF.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\CJvlyUc.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
File created	C:\Windows\System\JuECMtj.exe	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2304	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeLockMemoryPrivilege	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2304	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	29
PID 2440 wrote to memory of 2304	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	29
PID 2440 wrote to memory of 2304	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	29
PID 2440 wrote to memory of 2832	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2832	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2832	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2836	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	31
PID 2440 wrote to memory of 2836	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	31
PID 2440 wrote to memory of 2836	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	31
PID 2440 wrote to memory of 2676	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	32
PID 2440 wrote to memory of 2676	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	32
PID 2440 wrote to memory of 2676	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	32
PID 2440 wrote to memory of 2776	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	33
PID 2440 wrote to memory of 2776	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	33
PID 2440 wrote to memory of 2776	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	33
PID 2440 wrote to memory of 2896	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	34
PID 2440 wrote to memory of 2896	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	34
PID 2440 wrote to memory of 2896	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	34
PID 2440 wrote to memory of 2632	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	35
PID 2440 wrote to memory of 2632	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	35
PID 2440 wrote to memory of 2632	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	35
PID 2440 wrote to memory of 2532	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	36
PID 2440 wrote to memory of 2532	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	36
PID 2440 wrote to memory of 2532	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	36
PID 2440 wrote to memory of 2752	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	37
PID 2440 wrote to memory of 2752	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	37
PID 2440 wrote to memory of 2752	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	37
PID 2440 wrote to memory of 2812	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	38
PID 2440 wrote to memory of 2812	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	38
PID 2440 wrote to memory of 2812	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	38
PID 2440 wrote to memory of 2716	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	39
PID 2440 wrote to memory of 2716	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	39
PID 2440 wrote to memory of 2716	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	39
PID 2440 wrote to memory of 3060	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	40
PID 2440 wrote to memory of 3060	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	40
PID 2440 wrote to memory of 3060	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	40
PID 2440 wrote to memory of 1912	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	41
PID 2440 wrote to memory of 1912	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	41
PID 2440 wrote to memory of 1912	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	41
PID 2440 wrote to memory of 2524	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	42
PID 2440 wrote to memory of 2524	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	42
PID 2440 wrote to memory of 2524	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	42
PID 2440 wrote to memory of 2604	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	43
PID 2440 wrote to memory of 2604	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	43
PID 2440 wrote to memory of 2604	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	43
PID 2440 wrote to memory of 2984	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	44
PID 2440 wrote to memory of 2984	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	44
PID 2440 wrote to memory of 2984	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	44
PID 2440 wrote to memory of 2256	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	45
PID 2440 wrote to memory of 2256	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	45
PID 2440 wrote to memory of 2256	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	45
PID 2440 wrote to memory of 1916	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	46
PID 2440 wrote to memory of 1916	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	46
PID 2440 wrote to memory of 1916	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	46
PID 2440 wrote to memory of 556	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	47
PID 2440 wrote to memory of 556	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	47
PID 2440 wrote to memory of 556	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	47
PID 2440 wrote to memory of 1152	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	48
PID 2440 wrote to memory of 1152	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	48
PID 2440 wrote to memory of 1152	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	48
PID 2440 wrote to memory of 2864	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	49
PID 2440 wrote to memory of 2864	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	49
PID 2440 wrote to memory of 2864	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	49
PID 2440 wrote to memory of 3016	2440	00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00977a48201a3ae8125191b31fa68204_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\System\mUlsVvG.exe
  C:\Windows\System\mUlsVvG.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\cNXsEuS.exe
  C:\Windows\System\cNXsEuS.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\cFqTaup.exe
  C:\Windows\System\cFqTaup.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\hgusiww.exe
  C:\Windows\System\hgusiww.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\amsvXyV.exe
  C:\Windows\System\amsvXyV.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\LOweZmP.exe
  C:\Windows\System\LOweZmP.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\rOOFSno.exe
  C:\Windows\System\rOOFSno.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\XEPgjEg.exe
  C:\Windows\System\XEPgjEg.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\HZdaacf.exe
  C:\Windows\System\HZdaacf.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\uqWEygb.exe
  C:\Windows\System\uqWEygb.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\oQdyLku.exe
  C:\Windows\System\oQdyLku.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\zFtgCAA.exe
  C:\Windows\System\zFtgCAA.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\mpPKKVZ.exe
  C:\Windows\System\mpPKKVZ.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\weODftb.exe
  C:\Windows\System\weODftb.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\VEzOxrw.exe
  C:\Windows\System\VEzOxrw.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\HYeYtni.exe
  C:\Windows\System\HYeYtni.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\FQatfTB.exe
  C:\Windows\System\FQatfTB.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\zSCRilw.exe
  C:\Windows\System\zSCRilw.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\YlVarxH.exe
  C:\Windows\System\YlVarxH.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\jNEaflv.exe
  C:\Windows\System\jNEaflv.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\mkKiTpF.exe
  C:\Windows\System\mkKiTpF.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\bCHHakl.exe
  C:\Windows\System\bCHHakl.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\WIzaHPo.exe
  C:\Windows\System\WIzaHPo.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\iBpYtgD.exe
  C:\Windows\System\iBpYtgD.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\NJRamVm.exe
  C:\Windows\System\NJRamVm.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\WQJiNrO.exe
  C:\Windows\System\WQJiNrO.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\vYyWNUq.exe
  C:\Windows\System\vYyWNUq.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\cfecaVO.exe
  C:\Windows\System\cfecaVO.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\yOfAIzn.exe
  C:\Windows\System\yOfAIzn.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\rYFzeOW.exe
  C:\Windows\System\rYFzeOW.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\System\OKjkSgA.exe
  C:\Windows\System\OKjkSgA.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\kaHZbET.exe
  C:\Windows\System\kaHZbET.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\NeAgRBh.exe
  C:\Windows\System\NeAgRBh.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\FGyUtZZ.exe
  C:\Windows\System\FGyUtZZ.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\EioKYkm.exe
  C:\Windows\System\EioKYkm.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\VLKwvvu.exe
  C:\Windows\System\VLKwvvu.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\MMUsTQL.exe
  C:\Windows\System\MMUsTQL.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\HjpAvrj.exe
  C:\Windows\System\HjpAvrj.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\sjQJhnD.exe
  C:\Windows\System\sjQJhnD.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\SVpudQe.exe
  C:\Windows\System\SVpudQe.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\uEBKXxA.exe
  C:\Windows\System\uEBKXxA.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\xxIBnvo.exe
  C:\Windows\System\xxIBnvo.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\sneXEJK.exe
  C:\Windows\System\sneXEJK.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\TwnbPey.exe
  C:\Windows\System\TwnbPey.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\UWUpIqB.exe
  C:\Windows\System\UWUpIqB.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\BFkzeGp.exe
  C:\Windows\System\BFkzeGp.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\gYYWPgk.exe
  C:\Windows\System\gYYWPgk.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\KsZUHss.exe
  C:\Windows\System\KsZUHss.exe
  2⤵
  PID:1712
- C:\Windows\System\rhLiEIh.exe
  C:\Windows\System\rhLiEIh.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\RnrhKAI.exe
  C:\Windows\System\RnrhKAI.exe
  2⤵
  PID:2880
- C:\Windows\System\almFhrG.exe
  C:\Windows\System\almFhrG.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\cIHkrNo.exe
  C:\Windows\System\cIHkrNo.exe
  2⤵
  PID:876
- C:\Windows\System\VzqPFoP.exe
  C:\Windows\System\VzqPFoP.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\jxvuxIv.exe
  C:\Windows\System\jxvuxIv.exe
  2⤵
  PID:2172
- C:\Windows\System\fLrebcJ.exe
  C:\Windows\System\fLrebcJ.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\dFtYyUm.exe
  C:\Windows\System\dFtYyUm.exe
  2⤵
  PID:2800
- C:\Windows\System\XvlwPWb.exe
  C:\Windows\System\XvlwPWb.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\ZcsiVuL.exe
  C:\Windows\System\ZcsiVuL.exe
  2⤵
  PID:1604
- C:\Windows\System\QfwubwZ.exe
  C:\Windows\System\QfwubwZ.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\jydocjc.exe
  C:\Windows\System\jydocjc.exe
  2⤵
  PID:2148
- C:\Windows\System\FiWWgow.exe
  C:\Windows\System\FiWWgow.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\kYmPGpv.exe
  C:\Windows\System\kYmPGpv.exe
  2⤵
  PID:2540
- C:\Windows\System\GemJZgN.exe
  C:\Windows\System\GemJZgN.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\BDjmECS.exe
  C:\Windows\System\BDjmECS.exe
  2⤵
  PID:1412
- C:\Windows\System\NLICdzs.exe
  C:\Windows\System\NLICdzs.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\PjmcZxK.exe
  C:\Windows\System\PjmcZxK.exe
  2⤵
  PID:1292
- C:\Windows\System\oCyNsyC.exe
  C:\Windows\System\oCyNsyC.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\TdEDNKF.exe
  C:\Windows\System\TdEDNKF.exe
  2⤵
  PID:2956
- C:\Windows\System\KITjQCj.exe
  C:\Windows\System\KITjQCj.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\FGFtIXU.exe
  C:\Windows\System\FGFtIXU.exe
  2⤵
  PID:1612
- C:\Windows\System\ZTuzjOm.exe
  C:\Windows\System\ZTuzjOm.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\OHOwUbd.exe
  C:\Windows\System\OHOwUbd.exe
  2⤵
  PID:584
- C:\Windows\System\MjHKyPb.exe
  C:\Windows\System\MjHKyPb.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\FiQuFPc.exe
  C:\Windows\System\FiQuFPc.exe
  2⤵
  PID:704
- C:\Windows\System\ztjuDBQ.exe
  C:\Windows\System\ztjuDBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\jmpHcLo.exe
  C:\Windows\System\jmpHcLo.exe
  2⤵
  PID:1628
- C:\Windows\System\ZbKvnMD.exe
  C:\Windows\System\ZbKvnMD.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\oEJTasp.exe
  C:\Windows\System\oEJTasp.exe
  2⤵
  PID:2968
- C:\Windows\System\vesuDrq.exe
  C:\Windows\System\vesuDrq.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\vVdwwWm.exe
  C:\Windows\System\vVdwwWm.exe
  2⤵
  PID:2068
- C:\Windows\System\SAkrTok.exe
  C:\Windows\System\SAkrTok.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\qNLJnmg.exe
  C:\Windows\System\qNLJnmg.exe
  2⤵
  PID:608
- C:\Windows\System\PcoCPoN.exe
  C:\Windows\System\PcoCPoN.exe
  2⤵
  PID:1520
- C:\Windows\System\NELLIKg.exe
  C:\Windows\System\NELLIKg.exe
  2⤵
  PID:448
- C:\Windows\System\OSsxTZR.exe
  C:\Windows\System\OSsxTZR.exe
  2⤵
  PID:2372
- C:\Windows\System\fmORKdb.exe
  C:\Windows\System\fmORKdb.exe
  2⤵
  PID:1368
- C:\Windows\System\fDiddnH.exe
  C:\Windows\System\fDiddnH.exe
  2⤵
  PID:1156
- C:\Windows\System\dJSkhpo.exe
  C:\Windows\System\dJSkhpo.exe
  2⤵
  PID:1876
- C:\Windows\System\icbDkyc.exe
  C:\Windows\System\icbDkyc.exe
  2⤵
  PID:692
- C:\Windows\System\DLdNloh.exe
  C:\Windows\System\DLdNloh.exe
  2⤵
  PID:2712
- C:\Windows\System\xemvdTZ.exe
  C:\Windows\System\xemvdTZ.exe
  2⤵
  PID:2404
- C:\Windows\System\odfnHOQ.exe
  C:\Windows\System\odfnHOQ.exe
  2⤵
  PID:2544
- C:\Windows\System\SELthod.exe
  C:\Windows\System\SELthod.exe
  2⤵
  PID:2940
- C:\Windows\System\WHEUqDb.exe
  C:\Windows\System\WHEUqDb.exe
  2⤵
  PID:2992
- C:\Windows\System\TFXQZEn.exe
  C:\Windows\System\TFXQZEn.exe
  2⤵
  PID:2588
- C:\Windows\System\EXqwyne.exe
  C:\Windows\System\EXqwyne.exe
  2⤵
  PID:1552
- C:\Windows\System\usXrcRz.exe
  C:\Windows\System\usXrcRz.exe
  2⤵
  PID:1760
- C:\Windows\System\srqPYOa.exe
  C:\Windows\System\srqPYOa.exe
  2⤵
  PID:2392
- C:\Windows\System\veErfQg.exe
  C:\Windows\System\veErfQg.exe
  2⤵
  PID:1624
- C:\Windows\System\mmHUKpk.exe
  C:\Windows\System\mmHUKpk.exe
  2⤵
  PID:2900
- C:\Windows\System\fMdYzbY.exe
  C:\Windows\System\fMdYzbY.exe
  2⤵
  PID:320
- C:\Windows\System\AtuIuTo.exe
  C:\Windows\System\AtuIuTo.exe
  2⤵
  PID:2996
- C:\Windows\System\TylLvnX.exe
  C:\Windows\System\TylLvnX.exe
  2⤵
  PID:1872
- C:\Windows\System\kTNkPcV.exe
  C:\Windows\System\kTNkPcV.exe
  2⤵
  PID:2856
- C:\Windows\System\BzVaBVn.exe
  C:\Windows\System\BzVaBVn.exe
  2⤵
  PID:1496
- C:\Windows\System\Ckczipd.exe
  C:\Windows\System\Ckczipd.exe
  2⤵
  PID:2464
- C:\Windows\System\dxncvMb.exe
  C:\Windows\System\dxncvMb.exe
  2⤵
  PID:2308
- C:\Windows\System\oOFdIuE.exe
  C:\Windows\System\oOFdIuE.exe
  2⤵
  PID:1716
- C:\Windows\System\nXMEyrE.exe
  C:\Windows\System\nXMEyrE.exe
  2⤵
  PID:2348
- C:\Windows\System\WjBvyHm.exe
  C:\Windows\System\WjBvyHm.exe
  2⤵
  PID:2156
- C:\Windows\System\iKNyxAO.exe
  C:\Windows\System\iKNyxAO.exe
  2⤵
  PID:1852
- C:\Windows\System\MLTJxJE.exe
  C:\Windows\System\MLTJxJE.exe
  2⤵
  PID:2512
- C:\Windows\System\nUpwdlJ.exe
  C:\Windows\System\nUpwdlJ.exe
  2⤵
  PID:1180
- C:\Windows\System\hRMkJCh.exe
  C:\Windows\System\hRMkJCh.exe
  2⤵
  PID:2484
- C:\Windows\System\hsGcRki.exe
  C:\Windows\System\hsGcRki.exe
  2⤵
  PID:2396
- C:\Windows\System\FhWmkJV.exe
  C:\Windows\System\FhWmkJV.exe
  2⤵
  PID:1848
- C:\Windows\System\zCbOUTT.exe
  C:\Windows\System\zCbOUTT.exe
  2⤵
  PID:1664
- C:\Windows\System\rweCtFi.exe
  C:\Windows\System\rweCtFi.exe
  2⤵
  PID:2208
- C:\Windows\System\ZDMJXLn.exe
  C:\Windows\System\ZDMJXLn.exe
  2⤵
  PID:1304
- C:\Windows\System\YFSXbOJ.exe
  C:\Windows\System\YFSXbOJ.exe
  2⤵
  PID:1660
- C:\Windows\System\hgBgXkI.exe
  C:\Windows\System\hgBgXkI.exe
  2⤵
  PID:1692
- C:\Windows\System\IoCxcaN.exe
  C:\Windows\System\IoCxcaN.exe
  2⤵
  PID:2264
- C:\Windows\System\Dvfsqms.exe
  C:\Windows\System\Dvfsqms.exe
  2⤵
  PID:1896
- C:\Windows\System\YhjLeqE.exe
  C:\Windows\System\YhjLeqE.exe
  2⤵
  PID:2052
- C:\Windows\System\tRnlKSz.exe
  C:\Windows\System\tRnlKSz.exe
  2⤵
  PID:2092
- C:\Windows\System\hgWLZgq.exe
  C:\Windows\System\hgWLZgq.exe
  2⤵
  PID:2936
- C:\Windows\System\ioetFYF.exe
  C:\Windows\System\ioetFYF.exe
  2⤵
  PID:2868
- C:\Windows\System\zaVBpgg.exe
  C:\Windows\System\zaVBpgg.exe
  2⤵
  PID:2728
- C:\Windows\System\BoWWUGr.exe
  C:\Windows\System\BoWWUGr.exe
  2⤵
  PID:1888
- C:\Windows\System\icexBXN.exe
  C:\Windows\System\icexBXN.exe
  2⤵
  PID:2160
- C:\Windows\System\TVHkJDq.exe
  C:\Windows\System\TVHkJDq.exe
  2⤵
  PID:1676
- C:\Windows\System\SvdNbMn.exe
  C:\Windows\System\SvdNbMn.exe
  2⤵
  PID:1620
- C:\Windows\System\aCOoLjM.exe
  C:\Windows\System\aCOoLjM.exe
  2⤵
  PID:2268
- C:\Windows\System\VHtyDAd.exe
  C:\Windows\System\VHtyDAd.exe
  2⤵
  PID:3008
- C:\Windows\System\BjtJrsw.exe
  C:\Windows\System\BjtJrsw.exe
  2⤵
  PID:2724
- C:\Windows\System\MdvorQF.exe
  C:\Windows\System\MdvorQF.exe
  2⤵
  PID:2284
- C:\Windows\System\knFBeNQ.exe
  C:\Windows\System\knFBeNQ.exe
  2⤵
  PID:2280
- C:\Windows\System\ofaYuwp.exe
  C:\Windows\System\ofaYuwp.exe
  2⤵
  PID:1616
- C:\Windows\System\WJOfkXV.exe
  C:\Windows\System\WJOfkXV.exe
  2⤵
  PID:344
- C:\Windows\System\qMlpSpk.exe
  C:\Windows\System\qMlpSpk.exe
  2⤵
  PID:1528
- C:\Windows\System\YUipjJc.exe
  C:\Windows\System\YUipjJc.exe
  2⤵
  PID:1772
- C:\Windows\System\azzKELE.exe
  C:\Windows\System\azzKELE.exe
  2⤵
  PID:1884
- C:\Windows\System\IOMEOGV.exe
  C:\Windows\System\IOMEOGV.exe
  2⤵
  PID:2556
- C:\Windows\System\bCWpumR.exe
  C:\Windows\System\bCWpumR.exe
  2⤵
  PID:2848
- C:\Windows\System\ZVprUYo.exe
  C:\Windows\System\ZVprUYo.exe
  2⤵
  PID:1332
- C:\Windows\System\GPUDzBf.exe
  C:\Windows\System\GPUDzBf.exe
  2⤵
  PID:1636
- C:\Windows\System\lmtPBZT.exe
  C:\Windows\System\lmtPBZT.exe
  2⤵
  PID:2696
- C:\Windows\System\xMZuCza.exe
  C:\Windows\System\xMZuCza.exe
  2⤵
  PID:2636
- C:\Windows\System\OEYQEbF.exe
  C:\Windows\System\OEYQEbF.exe
  2⤵
  PID:840
- C:\Windows\System\eDZnuvK.exe
  C:\Windows\System\eDZnuvK.exe
  2⤵
  PID:2912
- C:\Windows\System\mMprTXM.exe
  C:\Windows\System\mMprTXM.exe
  2⤵
  PID:1952
- C:\Windows\System\IwHcQbo.exe
  C:\Windows\System\IwHcQbo.exe
  2⤵
  PID:2424
- C:\Windows\System\JSQrKGE.exe
  C:\Windows\System\JSQrKGE.exe
  2⤵
  PID:2820
- C:\Windows\System\wNuQzor.exe
  C:\Windows\System\wNuQzor.exe
  2⤵
  PID:372
- C:\Windows\System\ypwajoj.exe
  C:\Windows\System\ypwajoj.exe
  2⤵
  PID:2060
- C:\Windows\System\ahSOTaG.exe
  C:\Windows\System\ahSOTaG.exe
  2⤵
  PID:1036
- C:\Windows\System\yfJXbiS.exe
  C:\Windows\System\yfJXbiS.exe
  2⤵
  PID:1960
- C:\Windows\System\YYOoewY.exe
  C:\Windows\System\YYOoewY.exe
  2⤵
  PID:1236
- C:\Windows\System\upSNBkX.exe
  C:\Windows\System\upSNBkX.exe
  2⤵
  PID:2004
- C:\Windows\System\hoDAOLs.exe
  C:\Windows\System\hoDAOLs.exe
  2⤵
  PID:2420
- C:\Windows\System\yYYcoUm.exe
  C:\Windows\System\yYYcoUm.exe
  2⤵
  PID:2960
- C:\Windows\System\jciPhMj.exe
  C:\Windows\System\jciPhMj.exe
  2⤵
  PID:2072
- C:\Windows\System\fZmIRrG.exe
  C:\Windows\System\fZmIRrG.exe
  2⤵
  PID:2952
- C:\Windows\System\tHoXwbT.exe
  C:\Windows\System\tHoXwbT.exe
  2⤵
  PID:1004
- C:\Windows\System\FjXpVXJ.exe
  C:\Windows\System\FjXpVXJ.exe
  2⤵
  PID:2548
- C:\Windows\System\ERRPlsv.exe
  C:\Windows\System\ERRPlsv.exe
  2⤵
  PID:3084
- C:\Windows\System\nKOIdrQ.exe
  C:\Windows\System\nKOIdrQ.exe
  2⤵
  PID:3100
- C:\Windows\System\OtiSzWD.exe
  C:\Windows\System\OtiSzWD.exe
  2⤵
  PID:3116
- C:\Windows\System\ZHrgfyv.exe
  C:\Windows\System\ZHrgfyv.exe
  2⤵
  PID:3132
- C:\Windows\System\PexlrYl.exe
  C:\Windows\System\PexlrYl.exe
  2⤵
  PID:3148
- C:\Windows\System\SQklHZg.exe
  C:\Windows\System\SQklHZg.exe
  2⤵
  PID:3164
- C:\Windows\System\wtmeMfP.exe
  C:\Windows\System\wtmeMfP.exe
  2⤵
  PID:3180
- C:\Windows\System\mplcitT.exe
  C:\Windows\System\mplcitT.exe
  2⤵
  PID:3196
- C:\Windows\System\RDspLbc.exe
  C:\Windows\System\RDspLbc.exe
  2⤵
  PID:3212
- C:\Windows\System\WcoGczm.exe
  C:\Windows\System\WcoGczm.exe
  2⤵
  PID:3228
- C:\Windows\System\mKWuKAn.exe
  C:\Windows\System\mKWuKAn.exe
  2⤵
  PID:3244
- C:\Windows\System\ZUBuelC.exe
  C:\Windows\System\ZUBuelC.exe
  2⤵
  PID:3260
- C:\Windows\System\RDmjdaq.exe
  C:\Windows\System\RDmjdaq.exe
  2⤵
  PID:3276
- C:\Windows\System\wjnbUxZ.exe
  C:\Windows\System\wjnbUxZ.exe
  2⤵
  PID:3292
- C:\Windows\System\FwnKeiw.exe
  C:\Windows\System\FwnKeiw.exe
  2⤵
  PID:3308
- C:\Windows\System\GuBWYsW.exe
  C:\Windows\System\GuBWYsW.exe
  2⤵
  PID:3324
- C:\Windows\System\lgsIJGh.exe
  C:\Windows\System\lgsIJGh.exe
  2⤵
  PID:3340
- C:\Windows\System\qclCYIi.exe
  C:\Windows\System\qclCYIi.exe
  2⤵
  PID:3356
- C:\Windows\System\QMNJeVC.exe
  C:\Windows\System\QMNJeVC.exe
  2⤵
  PID:3372
- C:\Windows\System\pGTLXey.exe
  C:\Windows\System\pGTLXey.exe
  2⤵
  PID:3388
- C:\Windows\System\gsBVREq.exe
  C:\Windows\System\gsBVREq.exe
  2⤵
  PID:3404
- C:\Windows\System\aXzPLWp.exe
  C:\Windows\System\aXzPLWp.exe
  2⤵
  PID:3420
- C:\Windows\System\vWxopYe.exe
  C:\Windows\System\vWxopYe.exe
  2⤵
  PID:3436
- C:\Windows\System\dvRGhBx.exe
  C:\Windows\System\dvRGhBx.exe
  2⤵
  PID:3452
- C:\Windows\System\EdyDbSG.exe
  C:\Windows\System\EdyDbSG.exe
  2⤵
  PID:3468
- C:\Windows\System\sjMMcAS.exe
  C:\Windows\System\sjMMcAS.exe
  2⤵
  PID:3484
- C:\Windows\System\VhMpULK.exe
  C:\Windows\System\VhMpULK.exe
  2⤵
  PID:3500
- C:\Windows\System\ELgBEBP.exe
  C:\Windows\System\ELgBEBP.exe
  2⤵
  PID:3516
- C:\Windows\System\NBLDMSM.exe
  C:\Windows\System\NBLDMSM.exe
  2⤵
  PID:3532
- C:\Windows\System\rNWDXiV.exe
  C:\Windows\System\rNWDXiV.exe
  2⤵
  PID:3548
- C:\Windows\System\UiJhGxv.exe
  C:\Windows\System\UiJhGxv.exe
  2⤵
  PID:3564
- C:\Windows\System\PAiJASE.exe
  C:\Windows\System\PAiJASE.exe
  2⤵
  PID:3580
- C:\Windows\System\YeYWmow.exe
  C:\Windows\System\YeYWmow.exe
  2⤵
  PID:3596
- C:\Windows\System\vfzRDpA.exe
  C:\Windows\System\vfzRDpA.exe
  2⤵
  PID:3612
- C:\Windows\System\PvUhMjB.exe
  C:\Windows\System\PvUhMjB.exe
  2⤵
  PID:3628
- C:\Windows\System\uQtWiHT.exe
  C:\Windows\System\uQtWiHT.exe
  2⤵
  PID:3644
- C:\Windows\System\fmKSyyt.exe
  C:\Windows\System\fmKSyyt.exe
  2⤵
  PID:3660
- C:\Windows\System\upqtrft.exe
  C:\Windows\System\upqtrft.exe
  2⤵
  PID:3676
- C:\Windows\System\OEclRbB.exe
  C:\Windows\System\OEclRbB.exe
  2⤵
  PID:3692
- C:\Windows\System\nVkfEog.exe
  C:\Windows\System\nVkfEog.exe
  2⤵
  PID:3708
- C:\Windows\System\eUUkepx.exe
  C:\Windows\System\eUUkepx.exe
  2⤵
  PID:3724
- C:\Windows\System\HsEkIJJ.exe
  C:\Windows\System\HsEkIJJ.exe
  2⤵
  PID:3740
- C:\Windows\System\nfHmuno.exe
  C:\Windows\System\nfHmuno.exe
  2⤵
  PID:3756
- C:\Windows\System\WQpVVzF.exe
  C:\Windows\System\WQpVVzF.exe
  2⤵
  PID:3772
- C:\Windows\System\agOpNWt.exe
  C:\Windows\System\agOpNWt.exe
  2⤵
  PID:3788
- C:\Windows\System\INPEZAA.exe
  C:\Windows\System\INPEZAA.exe
  2⤵
  PID:3804
- C:\Windows\System\sqSwEvw.exe
  C:\Windows\System\sqSwEvw.exe
  2⤵
  PID:3820
- C:\Windows\System\WhwdYun.exe
  C:\Windows\System\WhwdYun.exe
  2⤵
  PID:3836
- C:\Windows\System\zrPmCET.exe
  C:\Windows\System\zrPmCET.exe
  2⤵
  PID:3852
- C:\Windows\System\QWvQBai.exe
  C:\Windows\System\QWvQBai.exe
  2⤵
  PID:3868
- C:\Windows\System\wbSNIvv.exe
  C:\Windows\System\wbSNIvv.exe
  2⤵
  PID:3884
- C:\Windows\System\qsoRsqE.exe
  C:\Windows\System\qsoRsqE.exe
  2⤵
  PID:3900
- C:\Windows\System\aXUkkxg.exe
  C:\Windows\System\aXUkkxg.exe
  2⤵
  PID:3916
- C:\Windows\System\MTKgfmA.exe
  C:\Windows\System\MTKgfmA.exe
  2⤵
  PID:3932
- C:\Windows\System\WHNjEOi.exe
  C:\Windows\System\WHNjEOi.exe
  2⤵
  PID:3948
- C:\Windows\System\OZTZEWV.exe
  C:\Windows\System\OZTZEWV.exe
  2⤵
  PID:3964
- C:\Windows\System\ESzvTAH.exe
  C:\Windows\System\ESzvTAH.exe
  2⤵
  PID:3980
- C:\Windows\System\UIYGQYw.exe
  C:\Windows\System\UIYGQYw.exe
  2⤵
  PID:3996
- C:\Windows\System\FcVgQGC.exe
  C:\Windows\System\FcVgQGC.exe
  2⤵
  PID:4012
- C:\Windows\System\kVNAwiH.exe
  C:\Windows\System\kVNAwiH.exe
  2⤵
  PID:4028
- C:\Windows\System\WBUrhgb.exe
  C:\Windows\System\WBUrhgb.exe
  2⤵
  PID:4044
- C:\Windows\System\rANlYLT.exe
  C:\Windows\System\rANlYLT.exe
  2⤵
  PID:4060
- C:\Windows\System\yNAdDgL.exe
  C:\Windows\System\yNAdDgL.exe
  2⤵
  PID:4076
- C:\Windows\System\rnCfZtk.exe
  C:\Windows\System\rnCfZtk.exe
  2⤵
  PID:4092
- C:\Windows\System\JewUcwm.exe
  C:\Windows\System\JewUcwm.exe
  2⤵
  PID:2792
- C:\Windows\System\WbCvkDS.exe
  C:\Windows\System\WbCvkDS.exe
  2⤵
  PID:548
- C:\Windows\System\lnQRFmE.exe
  C:\Windows\System\lnQRFmE.exe
  2⤵
  PID:2768
- C:\Windows\System\AZhQmxY.exe
  C:\Windows\System\AZhQmxY.exe
  2⤵
  PID:2232
- C:\Windows\System\AQDAheJ.exe
  C:\Windows\System\AQDAheJ.exe
  2⤵
  PID:3092
- C:\Windows\System\IBXbdIE.exe
  C:\Windows\System\IBXbdIE.exe
  2⤵
  PID:3124
- C:\Windows\System\ZOXKFOD.exe
  C:\Windows\System\ZOXKFOD.exe
  2⤵
  PID:3156
- C:\Windows\System\tWDRIkU.exe
  C:\Windows\System\tWDRIkU.exe
  2⤵
  PID:3188
- C:\Windows\System\qBjKLkP.exe
  C:\Windows\System\qBjKLkP.exe
  2⤵
  PID:3220
- C:\Windows\System\gRvsyta.exe
  C:\Windows\System\gRvsyta.exe
  2⤵
  PID:3240
- C:\Windows\System\dFOPRsl.exe
  C:\Windows\System\dFOPRsl.exe
  2⤵
  PID:3272
- C:\Windows\System\qpRZSIw.exe
  C:\Windows\System\qpRZSIw.exe
  2⤵
  PID:3288
- C:\Windows\System\dUNPgrq.exe
  C:\Windows\System\dUNPgrq.exe
  2⤵
  PID:3336
- C:\Windows\System\qlBvdpA.exe
  C:\Windows\System\qlBvdpA.exe
  2⤵
  PID:3368
- C:\Windows\System\iNMWUqz.exe
  C:\Windows\System\iNMWUqz.exe
  2⤵
  PID:3400
- C:\Windows\System\MZlfXaE.exe
  C:\Windows\System\MZlfXaE.exe
  2⤵
  PID:3460
- C:\Windows\System\kuapNPq.exe
  C:\Windows\System\kuapNPq.exe
  2⤵
  PID:3492
- C:\Windows\System\gXEeAGn.exe
  C:\Windows\System\gXEeAGn.exe
  2⤵
  PID:3524
- C:\Windows\System\UvEpMqj.exe
  C:\Windows\System\UvEpMqj.exe
  2⤵
  PID:3556
- C:\Windows\System\EhlEIsO.exe
  C:\Windows\System\EhlEIsO.exe
  2⤵
  PID:3588
- C:\Windows\System\vYmpwcv.exe
  C:\Windows\System\vYmpwcv.exe
  2⤵
  PID:3620
- C:\Windows\System\uvYCane.exe
  C:\Windows\System\uvYCane.exe
  2⤵
  PID:3652
- C:\Windows\System\QUxFThY.exe
  C:\Windows\System\QUxFThY.exe
  2⤵
  PID:3684
- C:\Windows\System\xUwTrye.exe
  C:\Windows\System\xUwTrye.exe
  2⤵
  PID:3716
- C:\Windows\System\gEwotFn.exe
  C:\Windows\System\gEwotFn.exe
  2⤵
  PID:3748
- C:\Windows\System\FUmGAEr.exe
  C:\Windows\System\FUmGAEr.exe
  2⤵
  PID:3764
- C:\Windows\System\ADgeWwH.exe
  C:\Windows\System\ADgeWwH.exe
  2⤵
  PID:3796
- C:\Windows\System\BDwOkgo.exe
  C:\Windows\System\BDwOkgo.exe
  2⤵
  PID:3844
- C:\Windows\System\AZOBomJ.exe
  C:\Windows\System\AZOBomJ.exe
  2⤵
  PID:3828
- C:\Windows\System\DEpnkPT.exe
  C:\Windows\System\DEpnkPT.exe
  2⤵
  PID:3892
- C:\Windows\System\IEdYVus.exe
  C:\Windows\System\IEdYVus.exe
  2⤵
  PID:3944
- C:\Windows\System\LUseMzX.exe
  C:\Windows\System\LUseMzX.exe
  2⤵
  PID:348
- C:\Windows\System\wmCVqII.exe
  C:\Windows\System\wmCVqII.exe
  2⤵
  PID:3924
- C:\Windows\System\HKZorfQ.exe
  C:\Windows\System\HKZorfQ.exe
  2⤵
  PID:1708
- C:\Windows\System\BBXrrvX.exe
  C:\Windows\System\BBXrrvX.exe
  2⤵
  PID:3960
- C:\Windows\System\ZTgaGlm.exe
  C:\Windows\System\ZTgaGlm.exe
  2⤵
  PID:1992
- C:\Windows\System\KmndEqB.exe
  C:\Windows\System\KmndEqB.exe
  2⤵
  PID:2144
- C:\Windows\System\dZIPpJp.exe
  C:\Windows\System\dZIPpJp.exe
  2⤵
  PID:3992
- C:\Windows\System\NOXUDtQ.exe
  C:\Windows\System\NOXUDtQ.exe
  2⤵
  PID:4112
- C:\Windows\System\eCmCHBP.exe
  C:\Windows\System\eCmCHBP.exe
  2⤵
  PID:4128
- C:\Windows\System\lWtMZva.exe
  C:\Windows\System\lWtMZva.exe
  2⤵
  PID:4144
- C:\Windows\System\MzWbfXe.exe
  C:\Windows\System\MzWbfXe.exe
  2⤵
  PID:4160
- C:\Windows\System\TnaQMDu.exe
  C:\Windows\System\TnaQMDu.exe
  2⤵
  PID:4176
- C:\Windows\System\JUQiOHM.exe
  C:\Windows\System\JUQiOHM.exe
  2⤵
  PID:4192
- C:\Windows\System\Suevggz.exe
  C:\Windows\System\Suevggz.exe
  2⤵
  PID:4208
- C:\Windows\System\nLtXPAc.exe
  C:\Windows\System\nLtXPAc.exe
  2⤵
  PID:4224
- C:\Windows\System\omikaXh.exe
  C:\Windows\System\omikaXh.exe
  2⤵
  PID:4240
- C:\Windows\System\zeOyCLh.exe
  C:\Windows\System\zeOyCLh.exe
  2⤵
  PID:4256
- C:\Windows\System\CnsRTlk.exe
  C:\Windows\System\CnsRTlk.exe
  2⤵
  PID:4272
- C:\Windows\System\zekgUWh.exe
  C:\Windows\System\zekgUWh.exe
  2⤵
  PID:4288
- C:\Windows\System\HiuXjla.exe
  C:\Windows\System\HiuXjla.exe
  2⤵
  PID:4304
- C:\Windows\System\CpbpmRy.exe
  C:\Windows\System\CpbpmRy.exe
  2⤵
  PID:4320
- C:\Windows\System\zIHwmjn.exe
  C:\Windows\System\zIHwmjn.exe
  2⤵
  PID:4336
- C:\Windows\System\dEawZiI.exe
  C:\Windows\System\dEawZiI.exe
  2⤵
  PID:4352
- C:\Windows\System\YuDCIOf.exe
  C:\Windows\System\YuDCIOf.exe
  2⤵
  PID:4368
- C:\Windows\System\DurhTIk.exe
  C:\Windows\System\DurhTIk.exe
  2⤵
  PID:4384
- C:\Windows\System\GKPsXQS.exe
  C:\Windows\System\GKPsXQS.exe
  2⤵
  PID:4400
- C:\Windows\System\nblYAEb.exe
  C:\Windows\System\nblYAEb.exe
  2⤵
  PID:4416
- C:\Windows\System\VxnxZhC.exe
  C:\Windows\System\VxnxZhC.exe
  2⤵
  PID:4432
- C:\Windows\System\boFXMdV.exe
  C:\Windows\System\boFXMdV.exe
  2⤵
  PID:4448
- C:\Windows\System\NpTfOJa.exe
  C:\Windows\System\NpTfOJa.exe
  2⤵
  PID:4464
- C:\Windows\System\nzlgSMv.exe
  C:\Windows\System\nzlgSMv.exe
  2⤵
  PID:4480
- C:\Windows\System\FCvZOkd.exe
  C:\Windows\System\FCvZOkd.exe
  2⤵
  PID:4496
- C:\Windows\System\ytyBwAz.exe
  C:\Windows\System\ytyBwAz.exe
  2⤵
  PID:4512
- C:\Windows\System\AKmxvrz.exe
  C:\Windows\System\AKmxvrz.exe
  2⤵
  PID:4528
- C:\Windows\System\kPNRWyu.exe
  C:\Windows\System\kPNRWyu.exe
  2⤵
  PID:4544
- C:\Windows\System\YJwZprg.exe
  C:\Windows\System\YJwZprg.exe
  2⤵
  PID:4560
- C:\Windows\System\tpGssJW.exe
  C:\Windows\System\tpGssJW.exe
  2⤵
  PID:4576
- C:\Windows\System\xtznWNM.exe
  C:\Windows\System\xtznWNM.exe
  2⤵
  PID:4592
- C:\Windows\System\KXjauVX.exe
  C:\Windows\System\KXjauVX.exe
  2⤵
  PID:4608
- C:\Windows\System\xpbsVqU.exe
  C:\Windows\System\xpbsVqU.exe
  2⤵
  PID:4624
- C:\Windows\System\wGWGNWV.exe
  C:\Windows\System\wGWGNWV.exe
  2⤵
  PID:4640
- C:\Windows\System\SAheXcn.exe
  C:\Windows\System\SAheXcn.exe
  2⤵
  PID:4656
- C:\Windows\System\YPxUtQk.exe
  C:\Windows\System\YPxUtQk.exe
  2⤵
  PID:4672
- C:\Windows\System\brHNCHK.exe
  C:\Windows\System\brHNCHK.exe
  2⤵
  PID:4688
- C:\Windows\System\MIfcEfS.exe
  C:\Windows\System\MIfcEfS.exe
  2⤵
  PID:4704
- C:\Windows\System\ZVpEdCd.exe
  C:\Windows\System\ZVpEdCd.exe
  2⤵
  PID:4720
- C:\Windows\System\BWkbheN.exe
  C:\Windows\System\BWkbheN.exe
  2⤵
  PID:4736
- C:\Windows\System\CwMISJI.exe
  C:\Windows\System\CwMISJI.exe
  2⤵
  PID:4752
- C:\Windows\System\zQJcUGC.exe
  C:\Windows\System\zQJcUGC.exe
  2⤵
  PID:4768
- C:\Windows\System\mWmVOMs.exe
  C:\Windows\System\mWmVOMs.exe
  2⤵
  PID:4784
- C:\Windows\System\dkDpYHQ.exe
  C:\Windows\System\dkDpYHQ.exe
  2⤵
  PID:4800
- C:\Windows\System\jNoVkpz.exe
  C:\Windows\System\jNoVkpz.exe
  2⤵
  PID:4816
- C:\Windows\System\AjyEYSC.exe
  C:\Windows\System\AjyEYSC.exe
  2⤵
  PID:4832
- C:\Windows\System\yvneBOW.exe
  C:\Windows\System\yvneBOW.exe
  2⤵
  PID:4848
- C:\Windows\System\KeGaUmq.exe
  C:\Windows\System\KeGaUmq.exe
  2⤵
  PID:4864
- C:\Windows\System\vswkyfo.exe
  C:\Windows\System\vswkyfo.exe
  2⤵
  PID:4880
- C:\Windows\System\iygYvJH.exe
  C:\Windows\System\iygYvJH.exe
  2⤵
  PID:4896
- C:\Windows\System\vdWJMex.exe
  C:\Windows\System\vdWJMex.exe
  2⤵
  PID:4912
- C:\Windows\System\rCbOsba.exe
  C:\Windows\System\rCbOsba.exe
  2⤵
  PID:4928
- C:\Windows\System\Odazeyn.exe
  C:\Windows\System\Odazeyn.exe
  2⤵
  PID:4944
- C:\Windows\System\cUfjESC.exe
  C:\Windows\System\cUfjESC.exe
  2⤵
  PID:4960
- C:\Windows\System\HpdtaZe.exe
  C:\Windows\System\HpdtaZe.exe
  2⤵
  PID:4976
- C:\Windows\System\XCGriGN.exe
  C:\Windows\System\XCGriGN.exe
  2⤵
  PID:4992
- C:\Windows\System\rvMBcfm.exe
  C:\Windows\System\rvMBcfm.exe
  2⤵
  PID:5008
- C:\Windows\System\cFvpVFB.exe
  C:\Windows\System\cFvpVFB.exe
  2⤵
  PID:5024
- C:\Windows\System\CcXXlbe.exe
  C:\Windows\System\CcXXlbe.exe
  2⤵
  PID:4036
- C:\Windows\System\xutBQMy.exe
  C:\Windows\System\xutBQMy.exe
  2⤵
  PID:5132
- C:\Windows\System\oiHBsZt.exe
  C:\Windows\System\oiHBsZt.exe
  2⤵
  PID:5148
- C:\Windows\System\fIjhzeL.exe
  C:\Windows\System\fIjhzeL.exe
  2⤵
  PID:5164
- C:\Windows\System\KVEhQEf.exe
  C:\Windows\System\KVEhQEf.exe
  2⤵
  PID:5180
- C:\Windows\System\tEKStgf.exe
  C:\Windows\System\tEKStgf.exe
  2⤵
  PID:5196
- C:\Windows\System\quAeyKg.exe
  C:\Windows\System\quAeyKg.exe
  2⤵
  PID:5212
- C:\Windows\System\CKSqdvx.exe
  C:\Windows\System\CKSqdvx.exe
  2⤵
  PID:5228
- C:\Windows\System\NesjDVh.exe
  C:\Windows\System\NesjDVh.exe
  2⤵
  PID:5244
- C:\Windows\System\LEkFqOA.exe
  C:\Windows\System\LEkFqOA.exe
  2⤵
  PID:5260
- C:\Windows\System\QjhyoQy.exe
  C:\Windows\System\QjhyoQy.exe
  2⤵
  PID:5276
- C:\Windows\System\rCCWXuj.exe
  C:\Windows\System\rCCWXuj.exe
  2⤵
  PID:5292
- C:\Windows\System\mDLyyzr.exe
  C:\Windows\System\mDLyyzr.exe
  2⤵
  PID:5308
- C:\Windows\System\yUZdjiP.exe
  C:\Windows\System\yUZdjiP.exe
  2⤵
  PID:5324
- C:\Windows\System\LjmbQuO.exe
  C:\Windows\System\LjmbQuO.exe
  2⤵
  PID:5344
- C:\Windows\System\geNTWei.exe
  C:\Windows\System\geNTWei.exe
  2⤵
  PID:5360
- C:\Windows\System\LaQende.exe
  C:\Windows\System\LaQende.exe
  2⤵
  PID:5376
- C:\Windows\System\lPIWyAt.exe
  C:\Windows\System\lPIWyAt.exe
  2⤵
  PID:5392
- C:\Windows\System\bQDFjoD.exe
  C:\Windows\System\bQDFjoD.exe
  2⤵
  PID:5408
- C:\Windows\System\jTadtVJ.exe
  C:\Windows\System\jTadtVJ.exe
  2⤵
  PID:5424
- C:\Windows\System\QNHlarH.exe
  C:\Windows\System\QNHlarH.exe
  2⤵
  PID:5440
- C:\Windows\System\rqfIxAb.exe
  C:\Windows\System\rqfIxAb.exe
  2⤵
  PID:5456
- C:\Windows\System\IjkwJdl.exe
  C:\Windows\System\IjkwJdl.exe
  2⤵
  PID:5472
- C:\Windows\System\nHIVAMC.exe
  C:\Windows\System\nHIVAMC.exe
  2⤵
  PID:5488
- C:\Windows\System\SfOnwkX.exe
  C:\Windows\System\SfOnwkX.exe
  2⤵
  PID:5504
- C:\Windows\System\BZyOMTG.exe
  C:\Windows\System\BZyOMTG.exe
  2⤵
  PID:5520
- C:\Windows\System\uwTLgTe.exe
  C:\Windows\System\uwTLgTe.exe
  2⤵
  PID:5536
- C:\Windows\System\VQABJPf.exe
  C:\Windows\System\VQABJPf.exe
  2⤵
  PID:5552
- C:\Windows\System\YJLpBAF.exe
  C:\Windows\System\YJLpBAF.exe
  2⤵
  PID:5568
- C:\Windows\System\juXvunS.exe
  C:\Windows\System\juXvunS.exe
  2⤵
  PID:5584
- C:\Windows\System\ynmQRZL.exe
  C:\Windows\System\ynmQRZL.exe
  2⤵
  PID:5604
- C:\Windows\System\FkXnwVw.exe
  C:\Windows\System\FkXnwVw.exe
  2⤵
  PID:5620
- C:\Windows\System\SzzDfjx.exe
  C:\Windows\System\SzzDfjx.exe
  2⤵
  PID:5636
- C:\Windows\System\rfuKhga.exe
  C:\Windows\System\rfuKhga.exe
  2⤵
  PID:5652
- C:\Windows\System\GmQSLOD.exe
  C:\Windows\System\GmQSLOD.exe
  2⤵
  PID:5668
- C:\Windows\System\gveeSQp.exe
  C:\Windows\System\gveeSQp.exe
  2⤵
  PID:5684
- C:\Windows\System\niPPRFe.exe
  C:\Windows\System\niPPRFe.exe
  2⤵
  PID:5700
- C:\Windows\System\PgIBRHx.exe
  C:\Windows\System\PgIBRHx.exe
  2⤵
  PID:5720
- C:\Windows\System\bNWZGdf.exe
  C:\Windows\System\bNWZGdf.exe
  2⤵
  PID:5736
- C:\Windows\System\QqmAHcZ.exe
  C:\Windows\System\QqmAHcZ.exe
  2⤵
  PID:5752
- C:\Windows\System\nRqYYjg.exe
  C:\Windows\System\nRqYYjg.exe
  2⤵
  PID:5768
- C:\Windows\System\WnivMNb.exe
  C:\Windows\System\WnivMNb.exe
  2⤵
  PID:5784
- C:\Windows\System\KoJQiGv.exe
  C:\Windows\System\KoJQiGv.exe
  2⤵
  PID:5800
- C:\Windows\System\pdFxpqv.exe
  C:\Windows\System\pdFxpqv.exe
  2⤵
  PID:5816
- C:\Windows\System\lWDWUPj.exe
  C:\Windows\System\lWDWUPj.exe
  2⤵
  PID:5832
- C:\Windows\System\gMFoGsW.exe
  C:\Windows\System\gMFoGsW.exe
  2⤵
  PID:5848
- C:\Windows\System\cYbowVq.exe
  C:\Windows\System\cYbowVq.exe
  2⤵
  PID:5864
- C:\Windows\System\heTuTnu.exe
  C:\Windows\System\heTuTnu.exe
  2⤵
  PID:5904
- C:\Windows\System\ifybCsX.exe
  C:\Windows\System\ifybCsX.exe
  2⤵
  PID:5920
- C:\Windows\System\QmFuxPH.exe
  C:\Windows\System\QmFuxPH.exe
  2⤵
  PID:5936
- C:\Windows\System\TzWdJFi.exe
  C:\Windows\System\TzWdJFi.exe
  2⤵
  PID:5952
- C:\Windows\System\PlWTgfz.exe
  C:\Windows\System\PlWTgfz.exe
  2⤵
  PID:5968
- C:\Windows\System\SuyTVsB.exe
  C:\Windows\System\SuyTVsB.exe
  2⤵
  PID:5984
- C:\Windows\System\tlxCTzR.exe
  C:\Windows\System\tlxCTzR.exe
  2⤵
  PID:6000
- C:\Windows\System\AajxRoo.exe
  C:\Windows\System\AajxRoo.exe
  2⤵
  PID:6016
- C:\Windows\System\yLmqdFD.exe
  C:\Windows\System\yLmqdFD.exe
  2⤵
  PID:6032
- C:\Windows\System\hfHvTwF.exe
  C:\Windows\System\hfHvTwF.exe
  2⤵
  PID:6048
- C:\Windows\System\oXTlkuH.exe
  C:\Windows\System\oXTlkuH.exe
  2⤵
  PID:6072
- C:\Windows\System\xrsRDCW.exe
  C:\Windows\System\xrsRDCW.exe
  2⤵
  PID:6088
- C:\Windows\System\VcWdBnB.exe
  C:\Windows\System\VcWdBnB.exe
  2⤵
  PID:6104
- C:\Windows\System\atiUDJW.exe
  C:\Windows\System\atiUDJW.exe
  2⤵
  PID:6120
- C:\Windows\System\bxYVPJR.exe
  C:\Windows\System\bxYVPJR.exe
  2⤵
  PID:6136
- C:\Windows\System\nHZRnjN.exe
  C:\Windows\System\nHZRnjN.exe
  2⤵
  PID:4072
- C:\Windows\System\hpjwxcm.exe
  C:\Windows\System\hpjwxcm.exe
  2⤵
  PID:2112
- C:\Windows\System\PQoTAGg.exe
  C:\Windows\System\PQoTAGg.exe
  2⤵
  PID:3144
- C:\Windows\System\xjBNdkF.exe
  C:\Windows\System\xjBNdkF.exe
  2⤵
  PID:3332
- C:\Windows\System\HPzPbJq.exe
  C:\Windows\System\HPzPbJq.exe
  2⤵
  PID:3464
- C:\Windows\System\DOJSrPk.exe
  C:\Windows\System\DOJSrPk.exe
  2⤵
  PID:3592
- C:\Windows\System\pcDySso.exe
  C:\Windows\System\pcDySso.exe
  2⤵
  PID:3704
- C:\Windows\System\ZvmazRJ.exe
  C:\Windows\System\ZvmazRJ.exe
  2⤵
  PID:3876
- C:\Windows\System\YTcSRft.exe
  C:\Windows\System\YTcSRft.exe
  2⤵
  PID:2616
- C:\Windows\System\ByGSISX.exe
  C:\Windows\System\ByGSISX.exe
  2⤵
  PID:1476
- C:\Windows\System\kYfpmyM.exe
  C:\Windows\System\kYfpmyM.exe
  2⤵
  PID:4136
- C:\Windows\System\VjkCMnr.exe
  C:\Windows\System\VjkCMnr.exe
  2⤵
  PID:4204
- C:\Windows\System\lrulbqO.exe
  C:\Windows\System\lrulbqO.exe
  2⤵
  PID:4268
- C:\Windows\System\CuIAYwA.exe
  C:\Windows\System\CuIAYwA.exe
  2⤵
  PID:4332
- C:\Windows\System\jXJKGVP.exe
  C:\Windows\System\jXJKGVP.exe
  2⤵
  PID:4396
- C:\Windows\System\VZuBRhO.exe
  C:\Windows\System\VZuBRhO.exe
  2⤵
  PID:4460
- C:\Windows\System\kKEdOpE.exe
  C:\Windows\System\kKEdOpE.exe
  2⤵
  PID:4524
- C:\Windows\System\kiVlsKq.exe
  C:\Windows\System\kiVlsKq.exe
  2⤵
  PID:4588
- C:\Windows\System\KKfRrNK.exe
  C:\Windows\System\KKfRrNK.exe
  2⤵
  PID:4652
- C:\Windows\System\VCMuNfC.exe
  C:\Windows\System\VCMuNfC.exe
  2⤵
  PID:4716
- C:\Windows\System\DqpYapE.exe
  C:\Windows\System\DqpYapE.exe
  2⤵
  PID:4780
- C:\Windows\System\LuzvXMx.exe
  C:\Windows\System\LuzvXMx.exe
  2⤵
  PID:4844
- C:\Windows\System\iSwXdRp.exe
  C:\Windows\System\iSwXdRp.exe
  2⤵
  PID:4908
- C:\Windows\System\ZGRJwru.exe
  C:\Windows\System\ZGRJwru.exe
  2⤵
  PID:4972
- C:\Windows\System\zNxBmIM.exe
  C:\Windows\System\zNxBmIM.exe
  2⤵
  PID:5040
- C:\Windows\System\AAKtvJD.exe
  C:\Windows\System\AAKtvJD.exe
  2⤵
  PID:5060
- C:\Windows\System\UihBlzR.exe
  C:\Windows\System\UihBlzR.exe
  2⤵
  PID:5076
- C:\Windows\System\tUtGcBj.exe
  C:\Windows\System\tUtGcBj.exe
  2⤵
  PID:5096
- C:\Windows\System\PAshppx.exe
  C:\Windows\System\PAshppx.exe
  2⤵
  PID:5112
- C:\Windows\System\SKylhAj.exe
  C:\Windows\System\SKylhAj.exe
  2⤵
  PID:5140
- C:\Windows\System\QcEDLNq.exe
  C:\Windows\System\QcEDLNq.exe
  2⤵
  PID:3160
- C:\Windows\System\jExiHMI.exe
  C:\Windows\System\jExiHMI.exe
  2⤵
  PID:3300
- C:\Windows\System\RHDdohD.exe
  C:\Windows\System\RHDdohD.exe
  2⤵
  PID:3428
- C:\Windows\System\TmxPLvB.exe
  C:\Windows\System\TmxPLvB.exe
  2⤵
  PID:3496
- C:\Windows\System\SJjFCpU.exe
  C:\Windows\System\SJjFCpU.exe
  2⤵
  PID:3624
- C:\Windows\System\EaARvrY.exe
  C:\Windows\System\EaARvrY.exe
  2⤵
  PID:3736
- C:\Windows\System\BaBLcKF.exe
  C:\Windows\System\BaBLcKF.exe
  2⤵
  PID:3860
- C:\Windows\System\NKuiNLN.exe
  C:\Windows\System\NKuiNLN.exe
  2⤵
  PID:316
- C:\Windows\System\pblwWzX.exe
  C:\Windows\System\pblwWzX.exe
  2⤵
  PID:4008
- C:\Windows\System\ZNCZKLD.exe
  C:\Windows\System\ZNCZKLD.exe
  2⤵
  PID:4156
- C:\Windows\System\jDQpLAa.exe
  C:\Windows\System\jDQpLAa.exe
  2⤵
  PID:4220
- C:\Windows\System\XurfQpM.exe
  C:\Windows\System\XurfQpM.exe
  2⤵
  PID:4284
- C:\Windows\System\PXPJZKe.exe
  C:\Windows\System\PXPJZKe.exe
  2⤵
  PID:4348
- C:\Windows\System\aIyBPDj.exe
  C:\Windows\System\aIyBPDj.exe
  2⤵
  PID:4412
- C:\Windows\System\wahvzIm.exe
  C:\Windows\System\wahvzIm.exe
  2⤵
  PID:4476
- C:\Windows\System\zQeFaFw.exe
  C:\Windows\System\zQeFaFw.exe
  2⤵
  PID:4568
- C:\Windows\System\KSxcNNA.exe
  C:\Windows\System\KSxcNNA.exe
  2⤵
  PID:4632
- C:\Windows\System\wxmKdsu.exe
  C:\Windows\System\wxmKdsu.exe
  2⤵
  PID:4696
- C:\Windows\System\DyljSnZ.exe
  C:\Windows\System\DyljSnZ.exe
  2⤵
  PID:4760
- C:\Windows\System\UcVAAyC.exe
  C:\Windows\System\UcVAAyC.exe
  2⤵
  PID:4824
- C:\Windows\System\RqRQjgv.exe
  C:\Windows\System\RqRQjgv.exe
  2⤵
  PID:4888
- C:\Windows\System\wCyembf.exe
  C:\Windows\System\wCyembf.exe
  2⤵
  PID:4952
- C:\Windows\System\zAhahio.exe
  C:\Windows\System\zAhahio.exe
  2⤵
  PID:5020
- C:\Windows\System\HKtcFLq.exe
  C:\Windows\System\HKtcFLq.exe
  2⤵
  PID:5176
- C:\Windows\System\JdWZqdj.exe
  C:\Windows\System\JdWZqdj.exe
  2⤵
  PID:5240
- C:\Windows\System\FgaDoBj.exe
  C:\Windows\System\FgaDoBj.exe
  2⤵
  PID:5304
- C:\Windows\System\MdpJgYS.exe
  C:\Windows\System\MdpJgYS.exe
  2⤵
  PID:5400
- C:\Windows\System\TLYJhzV.exe
  C:\Windows\System\TLYJhzV.exe
  2⤵
  PID:5464
- C:\Windows\System\krfRCtJ.exe
  C:\Windows\System\krfRCtJ.exe
  2⤵
  PID:5528
- C:\Windows\System\PcKusso.exe
  C:\Windows\System\PcKusso.exe
  2⤵
  PID:5564
- C:\Windows\System\TUYzfsl.exe
  C:\Windows\System\TUYzfsl.exe
  2⤵
  PID:5160
- C:\Windows\System\sJYDBxq.exe
  C:\Windows\System\sJYDBxq.exe
  2⤵
  PID:5600
- C:\Windows\System\NUPYCap.exe
  C:\Windows\System\NUPYCap.exe
  2⤵
  PID:5612
- C:\Windows\System\XmqTyjZ.exe
  C:\Windows\System\XmqTyjZ.exe
  2⤵
  PID:5664
- C:\Windows\System\VJuImPd.exe
  C:\Windows\System\VJuImPd.exe
  2⤵
  PID:5692
- C:\Windows\System\tFETSKO.exe
  C:\Windows\System\tFETSKO.exe
  2⤵
  PID:5580
- C:\Windows\System\iZoVolv.exe
  C:\Windows\System\iZoVolv.exe
  2⤵
  PID:5256
- C:\Windows\System\IPTjRIl.exe
  C:\Windows\System\IPTjRIl.exe
  2⤵
  PID:5320
- C:\Windows\System\WHarhCC.exe
  C:\Windows\System\WHarhCC.exe
  2⤵
  PID:5416
- C:\Windows\System\aeGyUEr.exe
  C:\Windows\System\aeGyUEr.exe
  2⤵
  PID:5452
- C:\Windows\System\dTcvSNd.exe
  C:\Windows\System\dTcvSNd.exe
  2⤵
  PID:5516
- C:\Windows\System\taeubgm.exe
  C:\Windows\System\taeubgm.exe
  2⤵
  PID:5760
- C:\Windows\System\BtwlUTH.exe
  C:\Windows\System\BtwlUTH.exe
  2⤵
  PID:5824
- C:\Windows\System\ZCIriQj.exe
  C:\Windows\System\ZCIriQj.exe
  2⤵
  PID:268
- C:\Windows\System\BDhdFPN.exe
  C:\Windows\System\BDhdFPN.exe
  2⤵
  PID:5776
- C:\Windows\System\YzoVMxE.exe
  C:\Windows\System\YzoVMxE.exe
  2⤵
  PID:5944
- C:\Windows\System\RyoFXKF.exe
  C:\Windows\System\RyoFXKF.exe
  2⤵
  PID:6040
- C:\Windows\System\QLQlqDO.exe
  C:\Windows\System\QLQlqDO.exe
  2⤵
  PID:3208
- C:\Windows\System\PfIjdfS.exe
  C:\Windows\System\PfIjdfS.exe
  2⤵
  PID:3128
- C:\Windows\System\QGFZGGj.exe
  C:\Windows\System\QGFZGGj.exe
  2⤵
  PID:3668
- C:\Windows\System\rLmmwwf.exe
  C:\Windows\System\rLmmwwf.exe
  2⤵
  PID:4108
- C:\Windows\System\JWbQooJ.exe
  C:\Windows\System\JWbQooJ.exe
  2⤵
  PID:4492
- C:\Windows\System\bYiMYdz.exe
  C:\Windows\System\bYiMYdz.exe
  2⤵
  PID:4748
- C:\Windows\System\fHSlMBZ.exe
  C:\Windows\System\fHSlMBZ.exe
  2⤵
  PID:5004
- C:\Windows\System\XnZQHEY.exe
  C:\Windows\System\XnZQHEY.exe
  2⤵
  PID:5104
- C:\Windows\System\BcgPKye.exe
  C:\Windows\System\BcgPKye.exe
  2⤵
  PID:3956
- C:\Windows\System\kXXRuIa.exe
  C:\Windows\System\kXXRuIa.exe
  2⤵
  PID:4200
- C:\Windows\System\fvoeoAD.exe
  C:\Windows\System\fvoeoAD.exe
  2⤵
  PID:2884
- C:\Windows\System\XBUZLuF.exe
  C:\Windows\System\XBUZLuF.exe
  2⤵
  PID:3560
- C:\Windows\System\wdNakYY.exe
  C:\Windows\System\wdNakYY.exe
  2⤵
  PID:4556
- C:\Windows\System\wjaSqdE.exe
  C:\Windows\System\wjaSqdE.exe
  2⤵
  PID:4812
- C:\Windows\System\DYopkXt.exe
  C:\Windows\System\DYopkXt.exe
  2⤵
  PID:5048
- C:\Windows\System\nLPMcWi.exe
  C:\Windows\System\nLPMcWi.exe
  2⤵
  PID:5088
- C:\Windows\System\MibPFdE.exe
  C:\Windows\System\MibPFdE.exe
  2⤵
  PID:3236
- C:\Windows\System\jDTFLzO.exe
  C:\Windows\System\jDTFLzO.exe
  2⤵
  PID:3688
- C:\Windows\System\zBYijSt.exe
  C:\Windows\System\zBYijSt.exe
  2⤵
  PID:1408
- C:\Windows\System\DMjFwon.exe
  C:\Windows\System\DMjFwon.exe
  2⤵
  PID:4124
- C:\Windows\System\yTtKkAR.exe
  C:\Windows\System\yTtKkAR.exe
  2⤵
  PID:4380
- C:\Windows\System\jtyVqIM.exe
  C:\Windows\System\jtyVqIM.exe
  2⤵
  PID:4540
- C:\Windows\System\EasDChq.exe
  C:\Windows\System\EasDChq.exe
  2⤵
  PID:4796
- C:\Windows\System\YngcWor.exe
  C:\Windows\System\YngcWor.exe
  2⤵
  PID:5156
- C:\Windows\System\BOAWoRb.exe
  C:\Windows\System\BOAWoRb.exe
  2⤵
  PID:5272
- C:\Windows\System\ujgGZLH.exe
  C:\Windows\System\ujgGZLH.exe
  2⤵
  PID:2980
- C:\Windows\System\vVuFxMn.exe
  C:\Windows\System\vVuFxMn.exe
  2⤵
  PID:4316
- C:\Windows\System\RqJPIWH.exe
  C:\Windows\System\RqJPIWH.exe
  2⤵
  PID:4056
- C:\Windows\System\XBiOTfK.exe
  C:\Windows\System\XBiOTfK.exe
  2⤵
  PID:5644
- C:\Windows\System\lTupydp.exe
  C:\Windows\System\lTupydp.exe
  2⤵
  PID:4472
- C:\Windows\System\pTOuqUI.exe
  C:\Windows\System\pTOuqUI.exe
  2⤵
  PID:5448
- C:\Windows\System\zzZTfrF.exe
  C:\Windows\System\zzZTfrF.exe
  2⤵
  PID:1640
- C:\Windows\System\kEibAzi.exe
  C:\Windows\System\kEibAzi.exe
  2⤵
  PID:5896
- C:\Windows\System\OKpjoxg.exe
  C:\Windows\System\OKpjoxg.exe
  2⤵
  PID:6008
- C:\Windows\System\DxNIPqd.exe
  C:\Windows\System\DxNIPqd.exe
  2⤵
  PID:5996
- C:\Windows\System\RtmBoGN.exe
  C:\Windows\System\RtmBoGN.exe
  2⤵
  PID:6068
- C:\Windows\System\bddQMno.exe
  C:\Windows\System\bddQMno.exe
  2⤵
  PID:6132
- C:\Windows\System\hPrAfHs.exe
  C:\Windows\System\hPrAfHs.exe
  2⤵
  PID:5928
- C:\Windows\System\Loegbno.exe
  C:\Windows\System\Loegbno.exe
  2⤵
  PID:4264
- C:\Windows\System\TGZUrKm.exe
  C:\Windows\System\TGZUrKm.exe
  2⤵
  PID:6024
- C:\Windows\System\OUfUWUK.exe
  C:\Windows\System\OUfUWUK.exe
  2⤵
  PID:4648
- C:\Windows\System\hrfTirn.exe
  C:\Windows\System\hrfTirn.exe
  2⤵
  PID:2648
- C:\Windows\System\VCrhMRY.exe
  C:\Windows\System\VCrhMRY.exe
  2⤵
  PID:2336
- C:\Windows\System\lSucnxJ.exe
  C:\Windows\System\lSucnxJ.exe
  2⤵
  PID:4712
- C:\Windows\System\AEcsUvL.exe
  C:\Windows\System\AEcsUvL.exe
  2⤵
  PID:5036
- C:\Windows\System\lJGFpdb.exe
  C:\Windows\System\lJGFpdb.exe
  2⤵
  PID:5084
- C:\Windows\System\AkkSkyW.exe
  C:\Windows\System\AkkSkyW.exe
  2⤵
  PID:4328
- C:\Windows\System\qNBLFHq.exe
  C:\Windows\System\qNBLFHq.exe
  2⤵
  PID:4604
- C:\Windows\System\RTRPuar.exe
  C:\Windows\System\RTRPuar.exe
  2⤵
  PID:5560
- C:\Windows\System\dHihqpP.exe
  C:\Windows\System\dHihqpP.exe
  2⤵
  PID:3024
- C:\Windows\System\jMKRDiM.exe
  C:\Windows\System\jMKRDiM.exe
  2⤵
  PID:5900
- C:\Windows\System\epGlliC.exe
  C:\Windows\System\epGlliC.exe
  2⤵
  PID:4728
- C:\Windows\System\CpqUeZG.exe
  C:\Windows\System\CpqUeZG.exe
  2⤵
  PID:5496
- C:\Windows\System\TwqWIjA.exe
  C:\Windows\System\TwqWIjA.exe
  2⤵
  PID:5716
- C:\Windows\System\EcVBqQf.exe
  C:\Windows\System\EcVBqQf.exe
  2⤵
  PID:5316
- C:\Windows\System\hwRXEpZ.exe
  C:\Windows\System\hwRXEpZ.exe
  2⤵
  PID:4344
- C:\Windows\System\WnBFFUL.exe
  C:\Windows\System\WnBFFUL.exe
  2⤵
  PID:4732
- C:\Windows\System\RRNlQvt.exe
  C:\Windows\System\RRNlQvt.exe
  2⤵
  PID:5676
- C:\Windows\System\ZsIrtkm.exe
  C:\Windows\System\ZsIrtkm.exe
  2⤵
  PID:4188
- C:\Windows\System\AiWSXTK.exe
  C:\Windows\System\AiWSXTK.exe
  2⤵
  PID:5188
- C:\Windows\System\BNnxmPb.exe
  C:\Windows\System\BNnxmPb.exe
  2⤵
  PID:5576
- C:\Windows\System\QUaQQvD.exe
  C:\Windows\System\QUaQQvD.exe
  2⤵
  PID:5384
- C:\Windows\System\CFbbzqu.exe
  C:\Windows\System\CFbbzqu.exe
  2⤵
  PID:5796
- C:\Windows\System\CJvlyUc.exe
  C:\Windows\System\CJvlyUc.exe
  2⤵
  PID:5932
- C:\Windows\System\YGUpbdt.exe
  C:\Windows\System\YGUpbdt.exe
  2⤵
  PID:4940
- C:\Windows\System\MzMoJIn.exe
  C:\Windows\System\MzMoJIn.exe
  2⤵
  PID:5072
- C:\Windows\System\EjotIJI.exe
  C:\Windows\System\EjotIJI.exe
  2⤵
  PID:5976
- C:\Windows\System\kVDFLmg.exe
  C:\Windows\System\kVDFLmg.exe
  2⤵
  PID:5660
- C:\Windows\System\GqpHGXX.exe
  C:\Windows\System\GqpHGXX.exe
  2⤵
  PID:5792
- C:\Windows\System\aPHxdgk.exe
  C:\Windows\System\aPHxdgk.exe
  2⤵
  PID:6116
- C:\Windows\System\jtEvXzE.exe
  C:\Windows\System\jtEvXzE.exe
  2⤵
  PID:4876
- C:\Windows\System\bcJYyUK.exe
  C:\Windows\System\bcJYyUK.exe
  2⤵
  PID:6128
- C:\Windows\System\UTjHlgs.exe
  C:\Windows\System\UTjHlgs.exe
  2⤵
  PID:4280
- C:\Windows\System\SqqoMpH.exe
  C:\Windows\System\SqqoMpH.exe
  2⤵
  PID:4300
- C:\Windows\System\xXkULPg.exe
  C:\Windows\System\xXkULPg.exe
  2⤵
  PID:5844
- C:\Windows\System\mbSDEAm.exe
  C:\Windows\System\mbSDEAm.exe
  2⤵
  PID:5500
- C:\Windows\System\dZtIkMr.exe
  C:\Windows\System\dZtIkMr.exe
  2⤵
  PID:5368
- C:\Windows\System\LdLinQx.exe
  C:\Windows\System\LdLinQx.exe
  2⤵
  PID:4104
- C:\Windows\System\vrdOsJM.exe
  C:\Windows\System\vrdOsJM.exe
  2⤵
  PID:3940
- C:\Windows\System\gqyjpkD.exe
  C:\Windows\System\gqyjpkD.exe
  2⤵
  PID:5992
- C:\Windows\System\oYctSCe.exe
  C:\Windows\System\oYctSCe.exe
  2⤵
  PID:6064
- C:\Windows\System\fyqRxDG.exe
  C:\Windows\System\fyqRxDG.exe
  2⤵
  PID:1832
- C:\Windows\System\zrRbSHV.exe
  C:\Windows\System\zrRbSHV.exe
  2⤵
  PID:4536
- C:\Windows\System\eiLEPwJ.exe
  C:\Windows\System\eiLEPwJ.exe
  2⤵
  PID:4024
- C:\Windows\System\tZSDfNk.exe
  C:\Windows\System\tZSDfNk.exe
  2⤵
  PID:1756
- C:\Windows\System\HfYfGat.exe
  C:\Windows\System\HfYfGat.exe
  2⤵
  PID:4792
- C:\Windows\System\pobEVqW.exe
  C:\Windows\System\pobEVqW.exe
  2⤵
  PID:4984
- C:\Windows\System\YHQXvow.exe
  C:\Windows\System\YHQXvow.exe
  2⤵
  PID:4444
- C:\Windows\System\uZaQnzp.exe
  C:\Windows\System\uZaQnzp.exe
  2⤵
  PID:5220
- C:\Windows\System\EbXATJS.exe
  C:\Windows\System\EbXATJS.exe
  2⤵
  PID:3352
- C:\Windows\System\hhuyKDO.exe
  C:\Windows\System\hhuyKDO.exe
  2⤵
  PID:6160
- C:\Windows\System\hbBQZEB.exe
  C:\Windows\System\hbBQZEB.exe
  2⤵
  PID:6176
- C:\Windows\System\nUdmvXT.exe
  C:\Windows\System\nUdmvXT.exe
  2⤵
  PID:6192
- C:\Windows\System\BxQXnDu.exe
  C:\Windows\System\BxQXnDu.exe
  2⤵
  PID:6208
- C:\Windows\System\KsUxhVe.exe
  C:\Windows\System\KsUxhVe.exe
  2⤵
  PID:6224
- C:\Windows\System\mjbEIjm.exe
  C:\Windows\System\mjbEIjm.exe
  2⤵
  PID:6240
- C:\Windows\System\zONcpUJ.exe
  C:\Windows\System\zONcpUJ.exe
  2⤵
  PID:6256
- C:\Windows\System\rmxeuWX.exe
  C:\Windows\System\rmxeuWX.exe
  2⤵
  PID:6272
- C:\Windows\System\qGFffin.exe
  C:\Windows\System\qGFffin.exe
  2⤵
  PID:6288
- C:\Windows\System\OKLFPEK.exe
  C:\Windows\System\OKLFPEK.exe
  2⤵
  PID:6304
- C:\Windows\System\uHSLhNS.exe
  C:\Windows\System\uHSLhNS.exe
  2⤵
  PID:6320
- C:\Windows\System\fNMeAeb.exe
  C:\Windows\System\fNMeAeb.exe
  2⤵
  PID:6336
- C:\Windows\System\BLZucfi.exe
  C:\Windows\System\BLZucfi.exe
  2⤵
  PID:6352
- C:\Windows\System\DiGLkLy.exe
  C:\Windows\System\DiGLkLy.exe
  2⤵
  PID:6372
- C:\Windows\System\PYhHXfa.exe
  C:\Windows\System\PYhHXfa.exe
  2⤵
  PID:6388
- C:\Windows\System\JBpvYfg.exe
  C:\Windows\System\JBpvYfg.exe
  2⤵
  PID:6404
- C:\Windows\System\mIGrSyk.exe
  C:\Windows\System\mIGrSyk.exe
  2⤵
  PID:6420
- C:\Windows\System\xsGpOwN.exe
  C:\Windows\System\xsGpOwN.exe
  2⤵
  PID:6440
- C:\Windows\System\AotEgkc.exe
  C:\Windows\System\AotEgkc.exe
  2⤵
  PID:6464
- C:\Windows\System\dwQMspm.exe
  C:\Windows\System\dwQMspm.exe
  2⤵
  PID:6480
- C:\Windows\System\vllVQQx.exe
  C:\Windows\System\vllVQQx.exe
  2⤵
  PID:6496
- C:\Windows\System\ZJHyiUG.exe
  C:\Windows\System\ZJHyiUG.exe
  2⤵
  PID:6512
- C:\Windows\System\xfhViyu.exe
  C:\Windows\System\xfhViyu.exe
  2⤵
  PID:6532
- C:\Windows\System\hRGXpeE.exe
  C:\Windows\System\hRGXpeE.exe
  2⤵
  PID:6548
- C:\Windows\System\sFkEDbu.exe
  C:\Windows\System\sFkEDbu.exe
  2⤵
  PID:6564
- C:\Windows\System\NHuFFtV.exe
  C:\Windows\System\NHuFFtV.exe
  2⤵
  PID:6580
- C:\Windows\System\UoREkhY.exe
  C:\Windows\System\UoREkhY.exe
  2⤵
  PID:6600
- C:\Windows\System\uNgKIZG.exe
  C:\Windows\System\uNgKIZG.exe
  2⤵
  PID:6620
- C:\Windows\System\bOKQTzZ.exe
  C:\Windows\System\bOKQTzZ.exe
  2⤵
  PID:6640
- C:\Windows\System\EPZDaNf.exe
  C:\Windows\System\EPZDaNf.exe
  2⤵
  PID:6656
- C:\Windows\System\QWxSSDI.exe
  C:\Windows\System\QWxSSDI.exe
  2⤵
  PID:6672
- C:\Windows\System\NibXRHP.exe
  C:\Windows\System\NibXRHP.exe
  2⤵
  PID:6688
- C:\Windows\System\NKvAJWJ.exe
  C:\Windows\System\NKvAJWJ.exe
  2⤵
  PID:6704
- C:\Windows\System\CXweGji.exe
  C:\Windows\System\CXweGji.exe
  2⤵
  PID:6720
- C:\Windows\System\ForXYzW.exe
  C:\Windows\System\ForXYzW.exe
  2⤵
  PID:6736
- C:\Windows\System\ZeSlDMa.exe
  C:\Windows\System\ZeSlDMa.exe
  2⤵
  PID:6752
- C:\Windows\System\lFtXGCs.exe
  C:\Windows\System\lFtXGCs.exe
  2⤵
  PID:6768
- C:\Windows\System\PPbumvV.exe
  C:\Windows\System\PPbumvV.exe
  2⤵
  PID:6784
- C:\Windows\System\irmPpOt.exe
  C:\Windows\System\irmPpOt.exe
  2⤵
  PID:6800
- C:\Windows\System\MqlFvyk.exe
  C:\Windows\System\MqlFvyk.exe
  2⤵
  PID:6816
- C:\Windows\System\rfAPNxc.exe
  C:\Windows\System\rfAPNxc.exe
  2⤵
  PID:6832
- C:\Windows\System\nhvCJoa.exe
  C:\Windows\System\nhvCJoa.exe
  2⤵
  PID:6848
- C:\Windows\System\XldHLkF.exe
  C:\Windows\System\XldHLkF.exe
  2⤵
  PID:6864
- C:\Windows\System\QsgwCnf.exe
  C:\Windows\System\QsgwCnf.exe
  2⤵
  PID:6880
- C:\Windows\System\NNwUaIp.exe
  C:\Windows\System\NNwUaIp.exe
  2⤵
  PID:6896
- C:\Windows\System\cdHpzic.exe
  C:\Windows\System\cdHpzic.exe
  2⤵
  PID:6912
- C:\Windows\System\OrKgsWw.exe
  C:\Windows\System\OrKgsWw.exe
  2⤵
  PID:6928
- C:\Windows\System\EKvjNwK.exe
  C:\Windows\System\EKvjNwK.exe
  2⤵
  PID:6944
- C:\Windows\System\TzFeMjQ.exe
  C:\Windows\System\TzFeMjQ.exe
  2⤵
  PID:6960
- C:\Windows\System\CKQcNqN.exe
  C:\Windows\System\CKQcNqN.exe
  2⤵
  PID:6976
- C:\Windows\System\KoLKZmO.exe
  C:\Windows\System\KoLKZmO.exe
  2⤵
  PID:6992
- C:\Windows\System\jZToYWC.exe
  C:\Windows\System\jZToYWC.exe
  2⤵
  PID:7008
- C:\Windows\System\NbKacPE.exe
  C:\Windows\System\NbKacPE.exe
  2⤵
  PID:7024
- C:\Windows\System\JYiDocT.exe
  C:\Windows\System\JYiDocT.exe
  2⤵
  PID:7040
- C:\Windows\System\fvbpLuq.exe
  C:\Windows\System\fvbpLuq.exe
  2⤵
  PID:7056
- C:\Windows\System\nEncUVl.exe
  C:\Windows\System\nEncUVl.exe
  2⤵
  PID:7072
- C:\Windows\System\sYTAOEF.exe
  C:\Windows\System\sYTAOEF.exe
  2⤵
  PID:7088
- C:\Windows\System\IHGNnuc.exe
  C:\Windows\System\IHGNnuc.exe
  2⤵
  PID:7104
- C:\Windows\System\xiHwAhC.exe
  C:\Windows\System\xiHwAhC.exe
  2⤵
  PID:7124
- C:\Windows\System\JyyYFgP.exe
  C:\Windows\System\JyyYFgP.exe
  2⤵
  PID:7140
- C:\Windows\System\FbOTczf.exe
  C:\Windows\System\FbOTczf.exe
  2⤵
  PID:7156
- C:\Windows\System\rqhpKdH.exe
  C:\Windows\System\rqhpKdH.exe
  2⤵
  PID:4456
- C:\Windows\System\ptScGlp.exe
  C:\Windows\System\ptScGlp.exe
  2⤵
  PID:3768
- C:\Windows\System\iHUeuQg.exe
  C:\Windows\System\iHUeuQg.exe
  2⤵
  PID:5056
- C:\Windows\System\gVMsRsN.exe
  C:\Windows\System\gVMsRsN.exe
  2⤵
  PID:5748
- C:\Windows\System\TecPjtr.exe
  C:\Windows\System\TecPjtr.exe
  2⤵
  PID:6184
- C:\Windows\System\znCHHMr.exe
  C:\Windows\System\znCHHMr.exe
  2⤵
  PID:1892
- C:\Windows\System\XQCwwRo.exe
  C:\Windows\System\XQCwwRo.exe
  2⤵
  PID:6280
- C:\Windows\System\UOamRhd.exe
  C:\Windows\System\UOamRhd.exe
  2⤵
  PID:6232
- C:\Windows\System\NUVpMxv.exe
  C:\Windows\System\NUVpMxv.exe
  2⤵
  PID:6312
- C:\Windows\System\kJbojqW.exe
  C:\Windows\System\kJbojqW.exe
  2⤵
  PID:6152
- C:\Windows\System\AZrSxBS.exe
  C:\Windows\System\AZrSxBS.exe
  2⤵
  PID:5268
- C:\Windows\System\OByfcnZ.exe
  C:\Windows\System\OByfcnZ.exe
  2⤵
  PID:6236
- C:\Windows\System\MtWUdGU.exe
  C:\Windows\System\MtWUdGU.exe
  2⤵
  PID:6396
- C:\Windows\System\SLkYVNn.exe
  C:\Windows\System\SLkYVNn.exe
  2⤵
  PID:6428
- C:\Windows\System\MYgzpNq.exe
  C:\Windows\System\MYgzpNq.exe
  2⤵
  PID:6436
- C:\Windows\System\cUbZFid.exe
  C:\Windows\System\cUbZFid.exe
  2⤵
  PID:6488
- C:\Windows\System\gTQuaKB.exe
  C:\Windows\System\gTQuaKB.exe
  2⤵
  PID:6472
- C:\Windows\System\uhVgUzQ.exe
  C:\Windows\System\uhVgUzQ.exe
  2⤵
  PID:6560
- C:\Windows\System\JuECMtj.exe
  C:\Windows\System\JuECMtj.exe
  2⤵
  PID:6628
- C:\Windows\System\CeKehVE.exe
  C:\Windows\System\CeKehVE.exe
  2⤵
  PID:6696
- C:\Windows\System\nIFCygq.exe
  C:\Windows\System\nIFCygq.exe
  2⤵
  PID:6648
- C:\Windows\System\NPPFXLE.exe
  C:\Windows\System\NPPFXLE.exe
  2⤵
  PID:6508
- C:\Windows\System\WMGFztu.exe
  C:\Windows\System\WMGFztu.exe
  2⤵
  PID:6576
- C:\Windows\System\MwdPlNi.exe
  C:\Windows\System\MwdPlNi.exe
  2⤵
  PID:6716
- C:\Windows\System\YqKHQzW.exe
  C:\Windows\System\YqKHQzW.exe
  2⤵
  PID:6764
- C:\Windows\System\itsnzeG.exe
  C:\Windows\System\itsnzeG.exe
  2⤵
  PID:6824
- C:\Windows\System\UffxyAM.exe
  C:\Windows\System\UffxyAM.exe
  2⤵
  PID:6808
- C:\Windows\System\IqmwESn.exe
  C:\Windows\System\IqmwESn.exe
  2⤵
  PID:6856
- C:\Windows\System\ZuMQhwA.exe
  C:\Windows\System\ZuMQhwA.exe
  2⤵
  PID:6920
- C:\Windows\System\ZuJSoYy.exe
  C:\Windows\System\ZuJSoYy.exe
  2⤵
  PID:6904
- C:\Windows\System\bzRNbnU.exe
  C:\Windows\System\bzRNbnU.exe
  2⤵
  PID:6940
- C:\Windows\System\gmWPoWo.exe
  C:\Windows\System\gmWPoWo.exe
  2⤵
  PID:6364
- C:\Windows\System\QfSZanY.exe
  C:\Windows\System\QfSZanY.exe
  2⤵
  PID:7000
- C:\Windows\System\VfLGfTz.exe
  C:\Windows\System\VfLGfTz.exe
  2⤵
  PID:7052
- C:\Windows\System\FcLCHNt.exe
  C:\Windows\System\FcLCHNt.exe
  2⤵
  PID:7116
- C:\Windows\System\dbAentP.exe
  C:\Windows\System\dbAentP.exe
  2⤵
  PID:2432
- C:\Windows\System\JPxJWmA.exe
  C:\Windows\System\JPxJWmA.exe
  2⤵
  PID:6220
- C:\Windows\System\JiVaUWL.exe
  C:\Windows\System\JiVaUWL.exe
  2⤵
  PID:6344
- C:\Windows\System\cSxOGfe.exe
  C:\Windows\System\cSxOGfe.exe
  2⤵
  PID:7004
- C:\Windows\System\LmKSpSE.exe
  C:\Windows\System\LmKSpSE.exe
  2⤵
  PID:7100
- C:\Windows\System\EBhAJJh.exe
  C:\Windows\System\EBhAJJh.exe
  2⤵
  PID:7136
- C:\Windows\System\WJwwrzu.exe
  C:\Windows\System\WJwwrzu.exe
  2⤵
  PID:6332
- C:\Windows\System\lyQoYOA.exe
  C:\Windows\System\lyQoYOA.exe
  2⤵
  PID:7064
- C:\Windows\System\fGywQDL.exe
  C:\Windows\System\fGywQDL.exe
  2⤵
  PID:3800
- C:\Windows\System\oqKnQGt.exe
  C:\Windows\System\oqKnQGt.exe
  2⤵
  PID:6432
- C:\Windows\System\NHBEiPp.exe
  C:\Windows\System\NHBEiPp.exe
  2⤵
  PID:6556
- C:\Windows\System\IqUWnNM.exe
  C:\Windows\System\IqUWnNM.exe
  2⤵
  PID:6636
- C:\Windows\System\JXwXlFy.exe
  C:\Windows\System\JXwXlFy.exe
  2⤵
  PID:6572
- C:\Windows\System\AhxmfOB.exe
  C:\Windows\System\AhxmfOB.exe
  2⤵
  PID:6712
- C:\Windows\System\zFQpvzM.exe
  C:\Windows\System\zFQpvzM.exe
  2⤵
  PID:6828
- C:\Windows\System\OlZAIsR.exe
  C:\Windows\System\OlZAIsR.exe
  2⤵
  PID:6840
- C:\Windows\System\mycuXpX.exe
  C:\Windows\System\mycuXpX.exe
  2⤵
  PID:6952
- C:\Windows\System\dnVXDzg.exe
  C:\Windows\System\dnVXDzg.exe
  2⤵
  PID:6760
- C:\Windows\System\bYZxNuL.exe
  C:\Windows\System\bYZxNuL.exe
  2⤵
  PID:6936
- C:\Windows\System\KmSBNIU.exe
  C:\Windows\System\KmSBNIU.exe
  2⤵
  PID:4508
- C:\Windows\System\BQCBBIJ.exe
  C:\Windows\System\BQCBBIJ.exe
  2⤵
  PID:7112
- C:\Windows\System\HCUcNRX.exe
  C:\Windows\System\HCUcNRX.exe
  2⤵
  PID:3528
- C:\Windows\System\LTunXOC.exe
  C:\Windows\System\LTunXOC.exe
  2⤵
  PID:6456
- C:\Windows\System\mCklnUP.exe
  C:\Windows\System\mCklnUP.exe
  2⤵
  PID:6368
- C:\Windows\System\tIhWULf.exe
  C:\Windows\System\tIhWULf.exe
  2⤵
  PID:7036
- C:\Windows\System\EskVaRc.exe
  C:\Windows\System\EskVaRc.exe
  2⤵
  PID:6328
- C:\Windows\System\ASOyjiE.exe
  C:\Windows\System\ASOyjiE.exe
  2⤵
  PID:6744
- C:\Windows\System\SLqYyNa.exe
  C:\Windows\System\SLqYyNa.exe
  2⤵
  PID:6612
- C:\Windows\System\fYfRgYp.exe
  C:\Windows\System\fYfRgYp.exe
  2⤵
  PID:6892
- C:\Windows\System\eFLpGMu.exe
  C:\Windows\System\eFLpGMu.exe
  2⤵
  PID:4252
- C:\Windows\System\PiqbdWW.exe
  C:\Windows\System\PiqbdWW.exe
  2⤵
  PID:6592
- C:\Windows\System\kmimUkW.exe
  C:\Windows\System\kmimUkW.exe
  2⤵
  PID:7180
- C:\Windows\System\SMfqnyb.exe
  C:\Windows\System\SMfqnyb.exe
  2⤵
  PID:7196
- C:\Windows\System\TunJwrH.exe
  C:\Windows\System\TunJwrH.exe
  2⤵
  PID:7212
- C:\Windows\System\XdgYQTW.exe
  C:\Windows\System\XdgYQTW.exe
  2⤵
  PID:7228
- C:\Windows\System\nJzLNTq.exe
  C:\Windows\System\nJzLNTq.exe
  2⤵
  PID:7244
- C:\Windows\System\FiLfopZ.exe
  C:\Windows\System\FiLfopZ.exe
  2⤵
  PID:7260
- C:\Windows\System\YIprKhv.exe
  C:\Windows\System\YIprKhv.exe
  2⤵
  PID:7276
- C:\Windows\System\fiNitnQ.exe
  C:\Windows\System\fiNitnQ.exe
  2⤵
  PID:7292
- C:\Windows\System\xEenjSk.exe
  C:\Windows\System\xEenjSk.exe
  2⤵
  PID:7308
- C:\Windows\System\qVoLENR.exe
  C:\Windows\System\qVoLENR.exe
  2⤵
  PID:7324
- C:\Windows\System\AhdOkDX.exe
  C:\Windows\System\AhdOkDX.exe
  2⤵
  PID:7340
- C:\Windows\System\lEzMyaD.exe
  C:\Windows\System\lEzMyaD.exe
  2⤵
  PID:7356
- C:\Windows\System\XCTCmPv.exe
  C:\Windows\System\XCTCmPv.exe
  2⤵
  PID:7372
- C:\Windows\System\lOsQKdF.exe
  C:\Windows\System\lOsQKdF.exe
  2⤵
  PID:7388
- C:\Windows\System\ELLBumw.exe
  C:\Windows\System\ELLBumw.exe
  2⤵
  PID:7404
- C:\Windows\System\bkhsFaT.exe
  C:\Windows\System\bkhsFaT.exe
  2⤵
  PID:7420
- C:\Windows\System\tHUzWUJ.exe
  C:\Windows\System\tHUzWUJ.exe
  2⤵
  PID:7436
- C:\Windows\System\KzHhjea.exe
  C:\Windows\System\KzHhjea.exe
  2⤵
  PID:7452
- C:\Windows\System\PKrwRbc.exe
  C:\Windows\System\PKrwRbc.exe
  2⤵
  PID:7468
- C:\Windows\System\vOGuvLX.exe
  C:\Windows\System\vOGuvLX.exe
  2⤵
  PID:7484
- C:\Windows\System\inmVupT.exe
  C:\Windows\System\inmVupT.exe
  2⤵
  PID:7504
- C:\Windows\System\oklOtuY.exe
  C:\Windows\System\oklOtuY.exe
  2⤵
  PID:7520
- C:\Windows\System\cRaoAHN.exe
  C:\Windows\System\cRaoAHN.exe
  2⤵
  PID:7536
- C:\Windows\System\eFWaoyH.exe
  C:\Windows\System\eFWaoyH.exe
  2⤵
  PID:7552
- C:\Windows\System\cJWkpIc.exe
  C:\Windows\System\cJWkpIc.exe
  2⤵
  PID:7568
- C:\Windows\System\JeRgDSD.exe
  C:\Windows\System\JeRgDSD.exe
  2⤵
  PID:7584
- C:\Windows\System\kilhsaN.exe
  C:\Windows\System\kilhsaN.exe
  2⤵
  PID:7600
- C:\Windows\System\OtjwXwb.exe
  C:\Windows\System\OtjwXwb.exe
  2⤵
  PID:7616
- C:\Windows\System\aHdKEUQ.exe
  C:\Windows\System\aHdKEUQ.exe
  2⤵
  PID:7632
- C:\Windows\System\mghUSRJ.exe
  C:\Windows\System\mghUSRJ.exe
  2⤵
  PID:7648
- C:\Windows\System\PWxKcDx.exe
  C:\Windows\System\PWxKcDx.exe
  2⤵
  PID:7664
- C:\Windows\System\kGcEgmG.exe
  C:\Windows\System\kGcEgmG.exe
  2⤵
  PID:7680
- C:\Windows\System\plDWgxi.exe
  C:\Windows\System\plDWgxi.exe
  2⤵
  PID:7696
- C:\Windows\System\GopNUeB.exe
  C:\Windows\System\GopNUeB.exe
  2⤵
  PID:7712
- C:\Windows\System\mkRSxVq.exe
  C:\Windows\System\mkRSxVq.exe
  2⤵
  PID:7728
- C:\Windows\System\lkLpeZw.exe
  C:\Windows\System\lkLpeZw.exe
  2⤵
  PID:7744
- C:\Windows\System\BMDsqHw.exe
  C:\Windows\System\BMDsqHw.exe
  2⤵
  PID:7760
- C:\Windows\System\XwDsdWp.exe
  C:\Windows\System\XwDsdWp.exe
  2⤵
  PID:7776
- C:\Windows\System\GzPyifx.exe
  C:\Windows\System\GzPyifx.exe
  2⤵
  PID:7792
- C:\Windows\System\gtRsJQs.exe
  C:\Windows\System\gtRsJQs.exe
  2⤵
  PID:7808
- C:\Windows\System\KgDTbTo.exe
  C:\Windows\System\KgDTbTo.exe
  2⤵
  PID:7824
- C:\Windows\System\GNYfBaN.exe
  C:\Windows\System\GNYfBaN.exe
  2⤵
  PID:7840
- C:\Windows\System\gygSyLo.exe
  C:\Windows\System\gygSyLo.exe
  2⤵
  PID:7856
- C:\Windows\System\qpDpWXt.exe
  C:\Windows\System\qpDpWXt.exe
  2⤵
  PID:7872
- C:\Windows\System\xTLvwzd.exe
  C:\Windows\System\xTLvwzd.exe
  2⤵
  PID:7888
- C:\Windows\System\IOTlgJR.exe
  C:\Windows\System\IOTlgJR.exe
  2⤵
  PID:7904
- C:\Windows\System\JFloIDe.exe
  C:\Windows\System\JFloIDe.exe
  2⤵
  PID:7920
- C:\Windows\System\FVuoOIq.exe
  C:\Windows\System\FVuoOIq.exe
  2⤵
  PID:7936
- C:\Windows\System\goAYaqj.exe
  C:\Windows\System\goAYaqj.exe
  2⤵
  PID:7952
- C:\Windows\System\QJXFYsN.exe
  C:\Windows\System\QJXFYsN.exe
  2⤵
  PID:7968
- C:\Windows\System\umxJMEp.exe
  C:\Windows\System\umxJMEp.exe
  2⤵
  PID:7984
- C:\Windows\System\UXdVGbo.exe
  C:\Windows\System\UXdVGbo.exe
  2⤵
  PID:8000
- C:\Windows\System\HZUEalo.exe
  C:\Windows\System\HZUEalo.exe
  2⤵
  PID:8016
- C:\Windows\System\krFWNdP.exe
  C:\Windows\System\krFWNdP.exe
  2⤵
  PID:8032
- C:\Windows\System\QQvGtoR.exe
  C:\Windows\System\QQvGtoR.exe
  2⤵
  PID:8048
- C:\Windows\System\GpswYGg.exe
  C:\Windows\System\GpswYGg.exe
  2⤵
  PID:8064
- C:\Windows\System\SsXCPpQ.exe
  C:\Windows\System\SsXCPpQ.exe
  2⤵
  PID:8080
- C:\Windows\System\hYxFZYJ.exe
  C:\Windows\System\hYxFZYJ.exe
  2⤵
  PID:8096
- C:\Windows\System\WgFEWbG.exe
  C:\Windows\System\WgFEWbG.exe
  2⤵
  PID:8112
- C:\Windows\System\nqaIMRU.exe
  C:\Windows\System\nqaIMRU.exe
  2⤵
  PID:8128
- C:\Windows\System\AyuTWez.exe
  C:\Windows\System\AyuTWez.exe
  2⤵
  PID:8144
- C:\Windows\System\XjUpflo.exe
  C:\Windows\System\XjUpflo.exe
  2⤵
  PID:8160
- C:\Windows\System\eEexxEg.exe
  C:\Windows\System\eEexxEg.exe
  2⤵
  PID:8176
- C:\Windows\System\HldFkXE.exe
  C:\Windows\System\HldFkXE.exe
  2⤵
  PID:6956
- C:\Windows\System\HwKOQLn.exe
  C:\Windows\System\HwKOQLn.exe
  2⤵
  PID:7188
- C:\Windows\System\BXSRWmo.exe
  C:\Windows\System\BXSRWmo.exe
  2⤵
  PID:7252
- C:\Windows\System\GQAKenJ.exe
  C:\Windows\System\GQAKenJ.exe
  2⤵
  PID:7316
- C:\Windows\System\PTXGXkN.exe
  C:\Windows\System\PTXGXkN.exe
  2⤵
  PID:7352
- C:\Windows\System\FwuFXQu.exe
  C:\Windows\System\FwuFXQu.exe
  2⤵
  PID:6684
- C:\Windows\System\wcGuANv.exe
  C:\Windows\System\wcGuANv.exe
  2⤵
  PID:7204
- C:\Windows\System\IbKdOLq.exe
  C:\Windows\System\IbKdOLq.exe
  2⤵
  PID:6984
- C:\Windows\System\ExVnrXW.exe
  C:\Windows\System\ExVnrXW.exe
  2⤵
  PID:7172
- C:\Windows\System\uCKUDMM.exe
  C:\Windows\System\uCKUDMM.exe
  2⤵
  PID:7048
- C:\Windows\System\NszMCex.exe
  C:\Windows\System\NszMCex.exe
  2⤵
  PID:6528
- C:\Windows\System\jTDyDsQ.exe
  C:\Windows\System\jTDyDsQ.exe
  2⤵
  PID:7240
- C:\Windows\System\UgsKily.exe
  C:\Windows\System\UgsKily.exe
  2⤵
  PID:7412
- C:\Windows\System\clKVAdp.exe
  C:\Windows\System\clKVAdp.exe
  2⤵
  PID:7448
- C:\Windows\System\NeFJvXT.exe
  C:\Windows\System\NeFJvXT.exe
  2⤵
  PID:7460
- C:\Windows\System\tbIaRgC.exe
  C:\Windows\System\tbIaRgC.exe
  2⤵
  PID:7496
- C:\Windows\System\PZPyStM.exe
  C:\Windows\System\PZPyStM.exe
  2⤵
  PID:7544
- C:\Windows\System\FceMjIC.exe
  C:\Windows\System\FceMjIC.exe
  2⤵
  PID:7592
- C:\Windows\System\HsViXYs.exe
  C:\Windows\System\HsViXYs.exe
  2⤵
  PID:7660
- C:\Windows\System\FiRSles.exe
  C:\Windows\System\FiRSles.exe
  2⤵
  PID:7608
- C:\Windows\System\QJCIWRS.exe
  C:\Windows\System\QJCIWRS.exe
  2⤵
  PID:7676
- C:\Windows\System\kPCUGsB.exe
  C:\Windows\System\kPCUGsB.exe
  2⤵
  PID:7624
- C:\Windows\System\pCLJWHf.exe
  C:\Windows\System\pCLJWHf.exe
  2⤵
  PID:7724
- C:\Windows\System\nZXRLBv.exe
  C:\Windows\System\nZXRLBv.exe
  2⤵
  PID:7772
- C:\Windows\System\UCTxBOx.exe
  C:\Windows\System\UCTxBOx.exe
  2⤵
  PID:7784
- C:\Windows\System\wuFnfCO.exe
  C:\Windows\System\wuFnfCO.exe
  2⤵
  PID:7820
- C:\Windows\System\umeJNze.exe
  C:\Windows\System\umeJNze.exe
  2⤵
  PID:7868
- C:\Windows\System\hxWVEcL.exe
  C:\Windows\System\hxWVEcL.exe
  2⤵
  PID:7932
- C:\Windows\System\EztfXtH.exe
  C:\Windows\System\EztfXtH.exe
  2⤵
  PID:7996
- C:\Windows\System\fMFOgdR.exe
  C:\Windows\System\fMFOgdR.exe
  2⤵
  PID:8060
- C:\Windows\System\rAzQXvr.exe
  C:\Windows\System\rAzQXvr.exe
  2⤵
  PID:8124
- C:\Windows\System\nABpoEw.exe
  C:\Windows\System\nABpoEw.exe
  2⤵
  PID:8184
- C:\Windows\System\deJFlZO.exe
  C:\Windows\System\deJFlZO.exe
  2⤵
  PID:7852
- C:\Windows\System\lRtKPqX.exe
  C:\Windows\System\lRtKPqX.exe
  2⤵
  PID:7120
- C:\Windows\System\DZDcGRJ.exe
  C:\Windows\System\DZDcGRJ.exe
  2⤵
  PID:6412
- C:\Windows\System\qPYadwO.exe
  C:\Windows\System\qPYadwO.exe
  2⤵
  PID:8168
- C:\Windows\System\lWyNGrw.exe
  C:\Windows\System\lWyNGrw.exe
  2⤵
  PID:8008
- C:\Windows\System\UDEqpuO.exe
  C:\Windows\System\UDEqpuO.exe
  2⤵
  PID:6544
- C:\Windows\System\BJmoRar.exe
  C:\Windows\System\BJmoRar.exe
  2⤵
  PID:7416
- C:\Windows\System\LYjNNbo.exe
  C:\Windows\System\LYjNNbo.exe
  2⤵
  PID:8044
- C:\Windows\System\QqBSfob.exe
  C:\Windows\System\QqBSfob.exe
  2⤵
  PID:5192
- C:\Windows\System\zaYajbW.exe
  C:\Windows\System\zaYajbW.exe
  2⤵
  PID:6360
- C:\Windows\System\SEYuwvS.exe
  C:\Windows\System\SEYuwvS.exe
  2⤵
  PID:6780
- C:\Windows\System\RmxfBoe.exe
  C:\Windows\System\RmxfBoe.exe
  2⤵
  PID:7464
- C:\Windows\System\oPmTltc.exe
  C:\Windows\System\oPmTltc.exe
  2⤵
  PID:7480
- C:\Windows\System\lstPJpn.exe
  C:\Windows\System\lstPJpn.exe
  2⤵
  PID:7564
- C:\Windows\System\gPRlIhJ.exe
  C:\Windows\System\gPRlIhJ.exe
  2⤵
  PID:7692
- C:\Windows\System\xUePEJV.exe
  C:\Windows\System\xUePEJV.exe
  2⤵
  PID:7640
- C:\Windows\System\ZjuKFRp.exe
  C:\Windows\System\ZjuKFRp.exe
  2⤵
  PID:7768
- C:\Windows\System\yLYCNOo.exe
  C:\Windows\System\yLYCNOo.exe
  2⤵
  PID:7864
- C:\Windows\System\voAqrRq.exe
  C:\Windows\System\voAqrRq.exe
  2⤵
  PID:8092
- C:\Windows\System\BunuqUf.exe
  C:\Windows\System\BunuqUf.exe
  2⤵
  PID:8156
- C:\Windows\System\aZaFGio.exe
  C:\Windows\System\aZaFGio.exe
  2⤵
  PID:8024
- C:\Windows\System\FChGYuF.exe
  C:\Windows\System\FChGYuF.exe
  2⤵
  PID:7348
- C:\Windows\System\EsLGGdy.exe
  C:\Windows\System\EsLGGdy.exe
  2⤵
  PID:7492
- C:\Windows\System\llvjatm.exe
  C:\Windows\System\llvjatm.exe
  2⤵
  PID:8104
- C:\Windows\System\ThhoBJa.exe
  C:\Windows\System\ThhoBJa.exe
  2⤵
  PID:8140
- C:\Windows\System\apfgxAQ.exe
  C:\Windows\System\apfgxAQ.exe
  2⤵
  PID:7288
- C:\Windows\System\eIGQwjG.exe
  C:\Windows\System\eIGQwjG.exe
  2⤵
  PID:7528
- C:\Windows\System\aFhxWBY.exe
  C:\Windows\System\aFhxWBY.exe
  2⤵
  PID:7444
- C:\Windows\System\feUXXRT.exe
  C:\Windows\System\feUXXRT.exe
  2⤵
  PID:7704
- C:\Windows\System\QqBAWTg.exe
  C:\Windows\System\QqBAWTg.exe
  2⤵
  PID:7992
- C:\Windows\System\RjMsmJo.exe
  C:\Windows\System\RjMsmJo.exe
  2⤵
  PID:7788
- C:\Windows\System\KqKKDzd.exe
  C:\Windows\System\KqKKDzd.exe
  2⤵
  PID:7364
- C:\Windows\System\dubVnPj.exe
  C:\Windows\System\dubVnPj.exe
  2⤵
  PID:8188
- C:\Windows\System\pzymCui.exe
  C:\Windows\System\pzymCui.exe
  2⤵
  PID:7580
- C:\Windows\System\fGjBsDY.exe
  C:\Windows\System\fGjBsDY.exe
  2⤵
  PID:7976
- C:\Windows\System\HclJTQP.exe
  C:\Windows\System\HclJTQP.exe
  2⤵
  PID:7752
- C:\Windows\System\rsfskCz.exe
  C:\Windows\System\rsfskCz.exe
  2⤵
  PID:7816
- C:\Windows\System\CUZqIRr.exe
  C:\Windows\System\CUZqIRr.exe
  2⤵
  PID:6448
- C:\Windows\System\tfxncUa.exe
  C:\Windows\System\tfxncUa.exe
  2⤵
  PID:8040
- C:\Windows\System\vSoVUyh.exe
  C:\Windows\System\vSoVUyh.exe
  2⤵
  PID:7644
- C:\Windows\System\opJehTW.exe
  C:\Windows\System\opJehTW.exe
  2⤵
  PID:8204
- C:\Windows\System\vUgulQI.exe
  C:\Windows\System\vUgulQI.exe
  2⤵
  PID:8220
- C:\Windows\System\pnQNPcP.exe
  C:\Windows\System\pnQNPcP.exe
  2⤵
  PID:8236
- C:\Windows\System\bPoZOFd.exe
  C:\Windows\System\bPoZOFd.exe
  2⤵
  PID:8252
- C:\Windows\System\EUZYYeN.exe
  C:\Windows\System\EUZYYeN.exe
  2⤵
  PID:8268
- C:\Windows\System\bqLdpno.exe
  C:\Windows\System\bqLdpno.exe
  2⤵
  PID:8284
- C:\Windows\System\yIIRthV.exe
  C:\Windows\System\yIIRthV.exe
  2⤵
  PID:8300
- C:\Windows\System\CSFbpTD.exe
  C:\Windows\System\CSFbpTD.exe
  2⤵
  PID:8316
- C:\Windows\System\oTNDzHh.exe
  C:\Windows\System\oTNDzHh.exe
  2⤵
  PID:8332
- C:\Windows\System\ugISJjP.exe
  C:\Windows\System\ugISJjP.exe
  2⤵
  PID:8348
- C:\Windows\System\QkkKWkF.exe
  C:\Windows\System\QkkKWkF.exe
  2⤵
  PID:8364
- C:\Windows\System\RDdNIEY.exe
  C:\Windows\System\RDdNIEY.exe
  2⤵
  PID:8380
- C:\Windows\System\JjMHfpD.exe
  C:\Windows\System\JjMHfpD.exe
  2⤵
  PID:8396
- C:\Windows\System\YsBlFnA.exe
  C:\Windows\System\YsBlFnA.exe
  2⤵
  PID:8412
- C:\Windows\System\dKhyHnX.exe
  C:\Windows\System\dKhyHnX.exe
  2⤵
  PID:8428
- C:\Windows\System\fMlUkpY.exe
  C:\Windows\System\fMlUkpY.exe
  2⤵
  PID:8444
- C:\Windows\System\skAuqVk.exe
  C:\Windows\System\skAuqVk.exe
  2⤵
  PID:8464
- C:\Windows\System\JHmvmVk.exe
  C:\Windows\System\JHmvmVk.exe
  2⤵
  PID:8480
- C:\Windows\System\faDnJjh.exe
  C:\Windows\System\faDnJjh.exe
  2⤵
  PID:8496
- C:\Windows\System\lVVkUJy.exe
  C:\Windows\System\lVVkUJy.exe
  2⤵
  PID:8512
- C:\Windows\System\hspCNgu.exe
  C:\Windows\System\hspCNgu.exe
  2⤵
  PID:8528
- C:\Windows\System\rHPoMdk.exe
  C:\Windows\System\rHPoMdk.exe
  2⤵
  PID:8544
- C:\Windows\System\bxNSBNB.exe
  C:\Windows\System\bxNSBNB.exe
  2⤵
  PID:8560
- C:\Windows\System\LfdcaTH.exe
  C:\Windows\System\LfdcaTH.exe
  2⤵
  PID:8576
- C:\Windows\System\cPIZijg.exe
  C:\Windows\System\cPIZijg.exe
  2⤵
  PID:8592
- C:\Windows\System\mBIHYxC.exe
  C:\Windows\System\mBIHYxC.exe
  2⤵
  PID:8608
- C:\Windows\System\jVHAThR.exe
  C:\Windows\System\jVHAThR.exe
  2⤵
  PID:8624
- C:\Windows\System\MjvZVub.exe
  C:\Windows\System\MjvZVub.exe
  2⤵
  PID:8640
- C:\Windows\System\SjPSpqc.exe
  C:\Windows\System\SjPSpqc.exe
  2⤵
  PID:8656
- C:\Windows\System\OMdKJoC.exe
  C:\Windows\System\OMdKJoC.exe
  2⤵
  PID:8672
- C:\Windows\System\pDkfMpS.exe
  C:\Windows\System\pDkfMpS.exe
  2⤵
  PID:8688
- C:\Windows\System\NtLMCth.exe
  C:\Windows\System\NtLMCth.exe
  2⤵
  PID:8704
- C:\Windows\System\bRNLxoU.exe
  C:\Windows\System\bRNLxoU.exe
  2⤵
  PID:8720
- C:\Windows\System\UcSaOjj.exe
  C:\Windows\System\UcSaOjj.exe
  2⤵
  PID:8736
- C:\Windows\System\iXleRaK.exe
  C:\Windows\System\iXleRaK.exe
  2⤵
  PID:8752
- C:\Windows\System\ZNOPUsA.exe
  C:\Windows\System\ZNOPUsA.exe
  2⤵
  PID:8768
- C:\Windows\System\lNmmiUy.exe
  C:\Windows\System\lNmmiUy.exe
  2⤵
  PID:8784
- C:\Windows\System\rImdzin.exe
  C:\Windows\System\rImdzin.exe
  2⤵
  PID:8800
- C:\Windows\System\vZmUXlG.exe
  C:\Windows\System\vZmUXlG.exe
  2⤵
  PID:8816
- C:\Windows\System\mgoSWGH.exe
  C:\Windows\System\mgoSWGH.exe
  2⤵
  PID:8832
- C:\Windows\System\outyhFB.exe
  C:\Windows\System\outyhFB.exe
  2⤵
  PID:8848
- C:\Windows\System\hFpAerU.exe
  C:\Windows\System\hFpAerU.exe
  2⤵
  PID:8864
- C:\Windows\System\WaCbogf.exe
  C:\Windows\System\WaCbogf.exe
  2⤵
  PID:8880
- C:\Windows\System\XwmBMES.exe
  C:\Windows\System\XwmBMES.exe
  2⤵
  PID:8896
- C:\Windows\System\LQIaEeP.exe
  C:\Windows\System\LQIaEeP.exe
  2⤵
  PID:8912
- C:\Windows\System\GxNbOmf.exe
  C:\Windows\System\GxNbOmf.exe
  2⤵
  PID:8928
- C:\Windows\System\HqRVbpn.exe
  C:\Windows\System\HqRVbpn.exe
  2⤵
  PID:8944
- C:\Windows\System\vikuiLP.exe
  C:\Windows\System\vikuiLP.exe
  2⤵
  PID:8960
- C:\Windows\System\yPRTLYu.exe
  C:\Windows\System\yPRTLYu.exe
  2⤵
  PID:8976
- C:\Windows\System\vWcaGIj.exe
  C:\Windows\System\vWcaGIj.exe
  2⤵
  PID:8992
- C:\Windows\System\vnVEcfO.exe
  C:\Windows\System\vnVEcfO.exe
  2⤵
  PID:9008
- C:\Windows\System\wAAJCCb.exe
  C:\Windows\System\wAAJCCb.exe
  2⤵
  PID:9024
- C:\Windows\System\DJaXpna.exe
  C:\Windows\System\DJaXpna.exe
  2⤵
  PID:9040
- C:\Windows\System\PUjzaXr.exe
  C:\Windows\System\PUjzaXr.exe
  2⤵
  PID:9056
- C:\Windows\System\JVnSqdq.exe
  C:\Windows\System\JVnSqdq.exe
  2⤵
  PID:9072
- C:\Windows\System\xAHrSqt.exe
  C:\Windows\System\xAHrSqt.exe
  2⤵
  PID:9088
- C:\Windows\System\JxEwDLr.exe
  C:\Windows\System\JxEwDLr.exe
  2⤵
  PID:9104
- C:\Windows\System\TtTriQN.exe
  C:\Windows\System\TtTriQN.exe
  2⤵
  PID:9120
- C:\Windows\System\uUdRYGD.exe
  C:\Windows\System\uUdRYGD.exe
  2⤵
  PID:9136
- C:\Windows\System\tZNzZwW.exe
  C:\Windows\System\tZNzZwW.exe
  2⤵
  PID:9152
- C:\Windows\System\wmEboKw.exe
  C:\Windows\System\wmEboKw.exe
  2⤵
  PID:9168
- C:\Windows\System\YqnpCFF.exe
  C:\Windows\System\YqnpCFF.exe
  2⤵
  PID:9184
- C:\Windows\System\oMvIPft.exe
  C:\Windows\System\oMvIPft.exe
  2⤵
  PID:9200
- C:\Windows\System\bxEIoOO.exe
  C:\Windows\System\bxEIoOO.exe
  2⤵
  PID:8196
- C:\Windows\System\BLkIPTv.exe
  C:\Windows\System\BLkIPTv.exe
  2⤵
  PID:8260
- C:\Windows\System\kaeUNFr.exe
  C:\Windows\System\kaeUNFr.exe
  2⤵
  PID:7900
- C:\Windows\System\JNxvFLR.exe
  C:\Windows\System\JNxvFLR.exe
  2⤵
  PID:8248
- C:\Windows\System\qIsydhc.exe
  C:\Windows\System\qIsydhc.exe
  2⤵
  PID:8212
- C:\Windows\System\AbMHUEO.exe
  C:\Windows\System\AbMHUEO.exe
  2⤵
  PID:8356
- C:\Windows\System\QEMBCsE.exe
  C:\Windows\System\QEMBCsE.exe
  2⤵
  PID:8340
- C:\Windows\System\abXDLHF.exe
  C:\Windows\System\abXDLHF.exe
  2⤵
  PID:8420
- C:\Windows\System\ShMsgUD.exe
  C:\Windows\System\ShMsgUD.exe
  2⤵
  PID:8408
- C:\Windows\System\gXuLJhT.exe
  C:\Windows\System\gXuLJhT.exe
  2⤵
  PID:8476
- C:\Windows\System\qcEARPf.exe
  C:\Windows\System\qcEARPf.exe
  2⤵
  PID:8488
- C:\Windows\System\McNgSFt.exe
  C:\Windows\System\McNgSFt.exe
  2⤵
  PID:8556
- C:\Windows\System\LtVgIWy.exe
  C:\Windows\System\LtVgIWy.exe
  2⤵
  PID:8588
- C:\Windows\System\DBCySGA.exe
  C:\Windows\System\DBCySGA.exe
  2⤵
  PID:8568
- C:\Windows\System\uPOBBZw.exe
  C:\Windows\System\uPOBBZw.exe
  2⤵
  PID:8680
- C:\Windows\System\zrSWTbA.exe
  C:\Windows\System\zrSWTbA.exe
  2⤵
  PID:8636
- C:\Windows\System\aCdXmuE.exe
  C:\Windows\System\aCdXmuE.exe
  2⤵
  PID:8632
- C:\Windows\System\SZHCrQU.exe
  C:\Windows\System\SZHCrQU.exe
  2⤵
  PID:8700
- C:\Windows\System\dgfMYyl.exe
  C:\Windows\System\dgfMYyl.exe
  2⤵
  PID:8776
- C:\Windows\System\otyZqce.exe
  C:\Windows\System\otyZqce.exe
  2⤵
  PID:8792
- C:\Windows\System\KyYdEPW.exe
  C:\Windows\System\KyYdEPW.exe
  2⤵
  PID:8872
- C:\Windows\System\zmiSaxY.exe
  C:\Windows\System\zmiSaxY.exe
  2⤵
  PID:8904
- C:\Windows\System\AMcxdlv.exe
  C:\Windows\System\AMcxdlv.exe
  2⤵
  PID:8824
- C:\Windows\System\ArBfift.exe
  C:\Windows\System\ArBfift.exe
  2⤵
  PID:8936
- C:\Windows\System\uADouoB.exe
  C:\Windows\System\uADouoB.exe
  2⤵
  PID:8920
- C:\Windows\System\lyfPIFr.exe
  C:\Windows\System\lyfPIFr.exe
  2⤵
  PID:8956
- C:\Windows\System\qZQUnhI.exe
  C:\Windows\System\qZQUnhI.exe
  2⤵
  PID:9032
- C:\Windows\System\ExbAOzL.exe
  C:\Windows\System\ExbAOzL.exe
  2⤵
  PID:9020
- C:\Windows\System\vFkWBQd.exe
  C:\Windows\System\vFkWBQd.exe
  2⤵
  PID:9096
- C:\Windows\System\egVnRza.exe
  C:\Windows\System\egVnRza.exe
  2⤵
  PID:9160
- C:\Windows\System\BzhkNfm.exe
  C:\Windows\System\BzhkNfm.exe
  2⤵
  PID:8228
- C:\Windows\System\jCmtsjz.exe
  C:\Windows\System\jCmtsjz.exe
  2⤵
  PID:1568
- C:\Windows\System\WepIylm.exe
  C:\Windows\System\WepIylm.exe
  2⤵
  PID:8392
- C:\Windows\System\AGnijot.exe
  C:\Windows\System\AGnijot.exe
  2⤵
  PID:8552
- C:\Windows\System\KyErTqw.exe
  C:\Windows\System\KyErTqw.exe
  2⤵
  PID:9112
- C:\Windows\System\uxnylDl.exe
  C:\Windows\System\uxnylDl.exe
  2⤵
  PID:8540
- C:\Windows\System\jphqEMT.exe
  C:\Windows\System\jphqEMT.exe
  2⤵
  PID:8308
- C:\Windows\System\rmrtNSD.exe
  C:\Windows\System\rmrtNSD.exe
  2⤵
  PID:9144
- C:\Windows\System\TRihUHP.exe
  C:\Windows\System\TRihUHP.exe
  2⤵
  PID:8760
- C:\Windows\System\cxzxLRF.exe
  C:\Windows\System\cxzxLRF.exe
  2⤵
  PID:9180
- C:\Windows\System\HOAGVoJ.exe
  C:\Windows\System\HOAGVoJ.exe
  2⤵
  PID:8652
- C:\Windows\System\geUZshS.exe
  C:\Windows\System\geUZshS.exe
  2⤵
  PID:8748
- C:\Windows\System\bHfyWqr.exe
  C:\Windows\System\bHfyWqr.exe
  2⤵
  PID:8732
- C:\Windows\System\UMJZfcy.exe
  C:\Windows\System\UMJZfcy.exe
  2⤵
  PID:8888
- C:\Windows\System\qbbbKMv.exe
  C:\Windows\System\qbbbKMv.exe
  2⤵
  PID:8860
- C:\Windows\System\NdrvkEt.exe
  C:\Windows\System\NdrvkEt.exe
  2⤵
  PID:8968
- C:\Windows\System\mJBOvDO.exe
  C:\Windows\System\mJBOvDO.exe
  2⤵
  PID:9132
- C:\Windows\System\oCJaMtx.exe
  C:\Windows\System\oCJaMtx.exe
  2⤵
  PID:9068
- C:\Windows\System\MaqdgPb.exe
  C:\Windows\System\MaqdgPb.exe
  2⤵
  PID:9196
- C:\Windows\System\PqkoYLX.exe
  C:\Windows\System\PqkoYLX.exe
  2⤵
  PID:9148
- C:\Windows\System\bCiRIhl.exe
  C:\Windows\System\bCiRIhl.exe
  2⤵
  PID:8292
- C:\Windows\System\YnUVTpB.exe
  C:\Windows\System\YnUVTpB.exe
  2⤵
  PID:8668
- C:\Windows\System\VoCDmnU.exe
  C:\Windows\System\VoCDmnU.exe
  2⤵
  PID:8404
- C:\Windows\System\LFNzlKA.exe
  C:\Windows\System\LFNzlKA.exe
  2⤵
  PID:7512
- C:\Windows\System\zzoCTPH.exe
  C:\Windows\System\zzoCTPH.exe
  2⤵
  PID:8844
- C:\Windows\System\PoJmiQU.exe
  C:\Windows\System\PoJmiQU.exe
  2⤵
  PID:8856
- C:\Windows\System\FSedvUZ.exe
  C:\Windows\System\FSedvUZ.exe
  2⤵
  PID:9016
- C:\Windows\System\DJJuGbg.exe
  C:\Windows\System\DJJuGbg.exe
  2⤵
  PID:9192
- C:\Windows\System\SzaxITT.exe
  C:\Windows\System\SzaxITT.exe
  2⤵
  PID:8344
- C:\Windows\System\pKNeSjh.exe
  C:\Windows\System\pKNeSjh.exe
  2⤵
  PID:8952
- C:\Windows\System\eQADTPj.exe
  C:\Windows\System\eQADTPj.exe
  2⤵
  PID:9212
- C:\Windows\System\UeiiSwn.exe
  C:\Windows\System\UeiiSwn.exe
  2⤵
  PID:8324
- C:\Windows\System\VVdnERh.exe
  C:\Windows\System\VVdnERh.exe
  2⤵
  PID:7084
- C:\Windows\System\OqZCnqa.exe
  C:\Windows\System\OqZCnqa.exe
  2⤵
  PID:9220
- C:\Windows\System\XnwBLVX.exe
  C:\Windows\System\XnwBLVX.exe
  2⤵
  PID:9236
- C:\Windows\System\tXihubK.exe
  C:\Windows\System\tXihubK.exe
  2⤵
  PID:9252
- C:\Windows\System\FMpTDoR.exe
  C:\Windows\System\FMpTDoR.exe
  2⤵
  PID:9268
- C:\Windows\System\CnUiVYi.exe
  C:\Windows\System\CnUiVYi.exe
  2⤵
  PID:9284
- C:\Windows\System\THrCUdc.exe
  C:\Windows\System\THrCUdc.exe
  2⤵
  PID:9300
- C:\Windows\System\cCPOGsj.exe
  C:\Windows\System\cCPOGsj.exe
  2⤵
  PID:9316
- C:\Windows\System\jsszgNh.exe
  C:\Windows\System\jsszgNh.exe
  2⤵
  PID:9332
- C:\Windows\System\AwZsAwm.exe
  C:\Windows\System\AwZsAwm.exe
  2⤵
  PID:9348
- C:\Windows\System\nMwSZHm.exe
  C:\Windows\System\nMwSZHm.exe
  2⤵
  PID:9364
- C:\Windows\System\FkupnLL.exe
  C:\Windows\System\FkupnLL.exe
  2⤵
  PID:9380
- C:\Windows\System\zsZfQgt.exe
  C:\Windows\System\zsZfQgt.exe
  2⤵
  PID:9396
- C:\Windows\System\RoiSQJw.exe
  C:\Windows\System\RoiSQJw.exe
  2⤵
  PID:9412
- C:\Windows\System\XdURYzF.exe
  C:\Windows\System\XdURYzF.exe
  2⤵
  PID:9428
- C:\Windows\System\ITSaXRH.exe
  C:\Windows\System\ITSaXRH.exe
  2⤵
  PID:9444
- C:\Windows\System\yQPkVne.exe
  C:\Windows\System\yQPkVne.exe
  2⤵
  PID:9460
- C:\Windows\System\TCqxkuW.exe
  C:\Windows\System\TCqxkuW.exe
  2⤵
  PID:9476
- C:\Windows\System\ONqirkr.exe
  C:\Windows\System\ONqirkr.exe
  2⤵
  PID:9492
- C:\Windows\System\ariQlym.exe
  C:\Windows\System\ariQlym.exe
  2⤵
  PID:9508
- C:\Windows\System\hEmZnRp.exe
  C:\Windows\System\hEmZnRp.exe
  2⤵
  PID:9524
- C:\Windows\System\hoaMSab.exe
  C:\Windows\System\hoaMSab.exe
  2⤵
  PID:9540
- C:\Windows\System\JGSBEvb.exe
  C:\Windows\System\JGSBEvb.exe
  2⤵
  PID:9556
- C:\Windows\System\ViAPJDa.exe
  C:\Windows\System\ViAPJDa.exe
  2⤵
  PID:9572
- C:\Windows\System\ouBhltj.exe
  C:\Windows\System\ouBhltj.exe
  2⤵
  PID:9588
- C:\Windows\System\bHtKosO.exe
  C:\Windows\System\bHtKosO.exe
  2⤵
  PID:9604
- C:\Windows\System\KOSchOO.exe
  C:\Windows\System\KOSchOO.exe
  2⤵
  PID:9620
- C:\Windows\System\gjlQqCf.exe
  C:\Windows\System\gjlQqCf.exe
  2⤵
  PID:9636
- C:\Windows\System\fthmMHW.exe
  C:\Windows\System\fthmMHW.exe
  2⤵
  PID:9652
- C:\Windows\System\RdtqzXJ.exe
  C:\Windows\System\RdtqzXJ.exe
  2⤵
  PID:9668
- C:\Windows\System\VZNGdec.exe
  C:\Windows\System\VZNGdec.exe
  2⤵
  PID:9684
- C:\Windows\System\HsodchA.exe
  C:\Windows\System\HsodchA.exe
  2⤵
  PID:9700
- C:\Windows\System\XbnFsxc.exe
  C:\Windows\System\XbnFsxc.exe
  2⤵
  PID:9716
- C:\Windows\System\gIvtUOQ.exe
  C:\Windows\System\gIvtUOQ.exe
  2⤵
  PID:9732
- C:\Windows\System\QOARvuW.exe
  C:\Windows\System\QOARvuW.exe
  2⤵
  PID:9748
- C:\Windows\System\OEQMuXI.exe
  C:\Windows\System\OEQMuXI.exe
  2⤵
  PID:9764
- C:\Windows\System\fbAhblY.exe
  C:\Windows\System\fbAhblY.exe
  2⤵
  PID:9780
- C:\Windows\System\DHyjyZE.exe
  C:\Windows\System\DHyjyZE.exe
  2⤵
  PID:9796
- C:\Windows\System\HKcHjgz.exe
  C:\Windows\System\HKcHjgz.exe
  2⤵
  PID:9812
- C:\Windows\System\NPVAvYr.exe
  C:\Windows\System\NPVAvYr.exe
  2⤵
  PID:9828
- C:\Windows\System\SwiNSgx.exe
  C:\Windows\System\SwiNSgx.exe
  2⤵
  PID:9844
- C:\Windows\System\HTKmbcI.exe
  C:\Windows\System\HTKmbcI.exe
  2⤵
  PID:9860
- C:\Windows\System\wpAejTa.exe
  C:\Windows\System\wpAejTa.exe
  2⤵
  PID:9876
- C:\Windows\System\LdpXUQI.exe
  C:\Windows\System\LdpXUQI.exe
  2⤵
  PID:9892
- C:\Windows\System\WUeGkyh.exe
  C:\Windows\System\WUeGkyh.exe
  2⤵
  PID:9908
- C:\Windows\System\TNdDZSJ.exe
  C:\Windows\System\TNdDZSJ.exe
  2⤵
  PID:9924
- C:\Windows\System\fQrXAoU.exe
  C:\Windows\System\fQrXAoU.exe
  2⤵
  PID:9940
- C:\Windows\System\iXLdjMO.exe
  C:\Windows\System\iXLdjMO.exe
  2⤵
  PID:9956
- C:\Windows\System\TOjQZWG.exe
  C:\Windows\System\TOjQZWG.exe
  2⤵
  PID:9972
- C:\Windows\System\jsJWxUj.exe
  C:\Windows\System\jsJWxUj.exe
  2⤵
  PID:9988
- C:\Windows\System\GOVxcpC.exe
  C:\Windows\System\GOVxcpC.exe
  2⤵
  PID:10004
- C:\Windows\System\urijdRJ.exe
  C:\Windows\System\urijdRJ.exe
  2⤵
  PID:10020
- C:\Windows\System\cuGlVJn.exe
  C:\Windows\System\cuGlVJn.exe
  2⤵
  PID:10036
- C:\Windows\System\mZUGIss.exe
  C:\Windows\System\mZUGIss.exe
  2⤵
  PID:10052
- C:\Windows\System\rWokLAi.exe
  C:\Windows\System\rWokLAi.exe
  2⤵
  PID:10068
- C:\Windows\System\OviYKEl.exe
  C:\Windows\System\OviYKEl.exe
  2⤵
  PID:10084
- C:\Windows\System\CFUXQmk.exe
  C:\Windows\System\CFUXQmk.exe
  2⤵
  PID:10100
- C:\Windows\System\kdmlizQ.exe
  C:\Windows\System\kdmlizQ.exe
  2⤵
  PID:10116
- C:\Windows\System\JXVQjLb.exe
  C:\Windows\System\JXVQjLb.exe
  2⤵
  PID:10132
- C:\Windows\System\TekKiDb.exe
  C:\Windows\System\TekKiDb.exe
  2⤵
  PID:10148
- C:\Windows\System\RASIcYc.exe
  C:\Windows\System\RASIcYc.exe
  2⤵
  PID:10164
- C:\Windows\System\sLRDKVf.exe
  C:\Windows\System\sLRDKVf.exe
  2⤵
  PID:10180
- C:\Windows\System\NsmKBTw.exe
  C:\Windows\System\NsmKBTw.exe
  2⤵
  PID:10196
- C:\Windows\System\NDSDFPi.exe
  C:\Windows\System\NDSDFPi.exe
  2⤵
  PID:10212
- C:\Windows\System\kOpTilZ.exe
  C:\Windows\System\kOpTilZ.exe
  2⤵
  PID:10228
- C:\Windows\System\pWhMgwg.exe
  C:\Windows\System\pWhMgwg.exe
  2⤵
  PID:9244
- C:\Windows\System\yJOmPJu.exe
  C:\Windows\System\yJOmPJu.exe
  2⤵
  PID:8328
- C:\Windows\System\bMvEMeV.exe
  C:\Windows\System\bMvEMeV.exe
  2⤵
  PID:9308
- C:\Windows\System\fhqrjtr.exe
  C:\Windows\System\fhqrjtr.exe
  2⤵
  PID:9340
- C:\Windows\System\CNnZQvG.exe
  C:\Windows\System\CNnZQvG.exe
  2⤵
  PID:8696
- C:\Windows\System\GfdZsgB.exe
  C:\Windows\System\GfdZsgB.exe
  2⤵
  PID:9324
- C:\Windows\System\gsUfaqi.exe
  C:\Windows\System\gsUfaqi.exe
  2⤵
  PID:9376
- C:\Windows\System\YNXfSZP.exe
  C:\Windows\System\YNXfSZP.exe
  2⤵
  PID:9440
- C:\Windows\System\ImejKtY.exe
  C:\Windows\System\ImejKtY.exe
  2⤵
  PID:9420
- C:\Windows\System\tiQdcwk.exe
  C:\Windows\System\tiQdcwk.exe
  2⤵
  PID:9484
- C:\Windows\System\tbZykEo.exe
  C:\Windows\System\tbZykEo.exe
  2⤵
  PID:9548
- C:\Windows\System\gTvLFfP.exe
  C:\Windows\System\gTvLFfP.exe
  2⤵
  PID:9612
- C:\Windows\System\nLxUtVi.exe
  C:\Windows\System\nLxUtVi.exe
  2⤵
  PID:9676
- C:\Windows\System\GbBhwpg.exe
  C:\Windows\System\GbBhwpg.exe
  2⤵
  PID:9776
- C:\Windows\System\mASqTem.exe
  C:\Windows\System\mASqTem.exe
  2⤵
  PID:9804
- C:\Windows\System\EngRtFZ.exe
  C:\Windows\System\EngRtFZ.exe
  2⤵
  PID:9868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FQatfTB.exe

Filesize
1.7MB

MD5
95fae71d972a58f8949db88dd47914bd

SHA1
e67d8825c6c4fec765456ae89ba1da634fe09453

SHA256
f5823fd8dca231ba1c865048fc7cfdbcf0f46c96d06509609506c9661e9f7e74

SHA512
e846f2a2c47bc733fbf0dfc4a496666ef5b116e9db11278ff89574fa84c1d3d9d09e4aa95230d9328f608253e7b54bb4b2505f237ddd9f498ff50490d00f88dc

Download Submit
C:\Windows\system\HYeYtni.exe

Filesize
1.7MB

MD5
a865dc6a9507c60fe125af72d16ca163

SHA1
e88973acd2d167cccd62100fe46bb61fd412d845

SHA256
8bac3a59ae5fb20a9b64c6df0f58df00be3deebaeff54232db29ef845934b192

SHA512
36936e8cb66d488d8d658ff8e91c474edbdcbf784705964ad105275f3be282ff5947d263e9accec2c11b8ed021df14cef781bc0b9ce18adad4d6ea248eff4e40

Download Submit
C:\Windows\system\HZdaacf.exe

Filesize
1.7MB

MD5
caf020b6d722ad4df7c4a6f5a12c692e

SHA1
a6ec1a49bb3f88a467b5c158228f57918061ff89

SHA256
b223480858e6532d0a89f6f9bfbd31d37cb9c1e184eceb121f6dcb40f63c476f

SHA512
7036e6d721575dc69e3780503da65c7f8fa982c4e44cabfd82c178594b5c157200b84e9e0d863a6622725c0969eac4bebfa6c209869fbfa3ac94c4e0f31337d2

Download Submit
C:\Windows\system\LOweZmP.exe

Filesize
1.7MB

MD5
5c0fb8b76648759864d4b5a792fd9bb5

SHA1
df76303fd7a33db7b36aa453d2956edd602b8873

SHA256
7ce14aadb925c65bd65880758c9dda86e336d115fa71f8cb1874b1a52128ba67

SHA512
bc9c73d61b3f59df83041fd57ecc05582bec534b7bfdce5c75509d197fb1826343e0d7a493e4d9e61b9bc7360b765fd82c2e3182c846d10ad3619e92b6993b4a

Download Submit
C:\Windows\system\NJRamVm.exe

Filesize
1.7MB

MD5
215367ecd20728c0f9299fd784386181

SHA1
82293f47a6839ed9f7f2e4583391352ea2fa3b3b

SHA256
c80d38e41863a92811ab5f45392e87317458571ee30c201607840dc4eedbdd4c

SHA512
d1d68fcd91cda868195fe69a06f0e150aaa0f44ee463b59d5f4ee7ca74f68528232e6c632a1aa756c7d1a5c1e76b990d49dab67b336e064bcd25f31ee266834b

Download Submit
C:\Windows\system\NeAgRBh.exe

Filesize
1.7MB

MD5
4dae05a1b3369d4a6837ddac1fe5644b

SHA1
5f7344c01cb6ff63c958b0236db5f982d53bd9ae

SHA256
88330132493f6589e6a4a4b483c98bbd922b3b10c68a3313f8d63f6e5b327969

SHA512
8a3080d8c351c000d44a991e548997472a062ff357a7f3aee1fa93fe7b010f945856ee47c8251deb6847733bb98db8de02de65476fca8d9ebf0b18e9590e7146

Download Submit
C:\Windows\system\OKjkSgA.exe

Filesize
1.7MB

MD5
37a145b95365b3c24af286d13cd3d68d

SHA1
e0782268747cd8ce98830f19fd06d232d1d197fb

SHA256
a4a112b488b90001fa84c5ff25922b5e38bf1d5ac5d9662b2271a069568eaa7d

SHA512
45e5cbb86152288344995bb99f850762c33007a0a0a1cb07529de5f11cdc88466df08ebaec842b70f1da3158374ec250a4efd4d4913063fe4c6fa09926d66f46

Download Submit
C:\Windows\system\VEzOxrw.exe

Filesize
1.7MB

MD5
33557b74a2f30d6a46701f3029c876b7

SHA1
3c78f68449933aa4d599cc22530234316a77a67b

SHA256
a6986192d38fa64c511e5405e37f2c45033f7f2c9ea4b23e53720d79f5732a2c

SHA512
f78f2323a9e982dc7fab95ed22c39715485ea43445b5d29e8c1586a2209d1a84b0b097676cec0697c3ca0cce0e4a94826f45c031e2311a2370f230c0fea3fc48

Download Submit
C:\Windows\system\WIzaHPo.exe

Filesize
1.7MB

MD5
221e62d98c1d48ba5ff02105c2333b6e

SHA1
978662e656be8915a7bf40d70ea0ee7a732eec41

SHA256
2dd0865bb36a1af614f2d093bcfebefbcb7c5f54e44c4499b1f76574de935b8b

SHA512
bc5b8cd964df91d23c9d2a24cc34fe5b4b3cc7d133b7461e7c5382547d997ad93628e6b06b11b46185c40e0ab13b74657d756e8fbbbb955796b31c3cb5683740

Download Submit
C:\Windows\system\XEPgjEg.exe

Filesize
1.7MB

MD5
e080a78cd01fbb7db9d8dbcd6359b78c

SHA1
2f98277dee7d9c9750cfa89438b6dbc0ea7add19

SHA256
bcae1f32f9dc0c68edcacf6c683bbd9d6bf3c508871ec1763e0f47b46c10e817

SHA512
0e4dc0b5859454c32bb51d5b722a333d93666df3c2a9bac66ad1e07c20cd36e52ead6ae1cb73b3179bfd1ca11a67c994de6636672df5266915f21375baa997a2

Download Submit
C:\Windows\system\YKuGimA.exe

Filesize
18B

MD5
69712a8f9ef9a2cbe4907aa446157abb

SHA1
2b5c964a1748c4a6a2f7493dad88bc47a2d4511c

SHA256
b9cc1ff1554bd2f25357d0be7df90fe8a89296de72a2afbc4a6860c87a817497

SHA512
e050468b7108288e0fa907c0304cf8e8a182bd9da2b253d0061963594f6238ca0b6aa0d55af3b2e2ca64630286776467c06ed51b0e331ea22edb14321931191f

Download Submit
C:\Windows\system\amsvXyV.exe

Filesize
1.7MB

MD5
3eaee416246b063afc126467921c923c

SHA1
82d555b8a1ac49c8141cbd25bb862defef07ca6b

SHA256
023206d69da84b6ca241f2c112636b766b12cf188b6d67dd404da8d87289f0fd

SHA512
2f956eec0ced51b46ed1eb782bc02d77af7bae4cbf1ccb16f3492a96144c0dd2224a9221fc9d5ed18beaa9effc839845fc55808a4f4eae2c15824d1b07ed0ab1

Download Submit
C:\Windows\system\bCHHakl.exe

Filesize
1.7MB

MD5
bf2344c1c338b4ea71aee25ff53d5e36

SHA1
b39b3578606dc40df6caac1ea89679a0cb1bbc9e

SHA256
6e5efb81af3f2289910c4b77f085ee40661469ddef98c0996329ba1ea3ce7012

SHA512
ae18ba33fd927c5fc10d76b7588bd287396e1a0f4acde7f10c99d56819883f8d5ea52c633e0d1d1b721a1847ee57c63fee3bfcdff12c9ee790ca16fefcafc659

Download Submit
C:\Windows\system\cFqTaup.exe

Filesize
1.7MB

MD5
5c379ce084a242489512f60273a8ec65

SHA1
d3269ac5d90e999645706dfb5f2b0db7a5448050

SHA256
c6376d872068619cb22858cb37d1762c8e0678cd05e2e1a9dbf4b5e89d1ce154

SHA512
b520911b72697264d1c1b27e991754400d3b353e880eefeaec3484f667c93a186d4fd15d058c6273aa5fa4bad1ed4184081989e84c6071f749aac399b5a02204

Download Submit
C:\Windows\system\cNXsEuS.exe

Filesize
1.7MB

MD5
69b0d80d0eaaa71fddad0131cc3368be

SHA1
055d0b4965d618c79bb63ad56d075966ff957c81

SHA256
a48bc1aeee53ff2d9854fe35138bde88570849cac07ab142df6497ddab90daf9

SHA512
10db75720eb2a27ddc8ce57d8d357eee2eda018b446b082ab393998dbbaffd77bd694cfe55c3c4cdaea49021801c29ac0f22fd085d28164ef13950751188db45

Download Submit
C:\Windows\system\hgusiww.exe

Filesize
1.7MB

MD5
3d7046b2c2f88bfca36dd6bc8026471e

SHA1
949c7b79cdb9d4327851476ee249cc3681e78e74

SHA256
9fc0c421d857c112ce59bb8b7528130cb4754f0076ad40dbeae76171d0bd0ac8

SHA512
195577ae0145cefe360277e8b0aea6a14e7be3d608277d456142abfae5753f4a43723c0e763ff6b8e482a755e5c0471f057c77e0d2525c50e2659fe41c5e19ba

Download Submit
C:\Windows\system\jNEaflv.exe

Filesize
1.7MB

MD5
5b7b2d154411b16fde357608c28e82b2

SHA1
eb6d0c4628ad7554f91faf10c48020fce4f5fdf7

SHA256
f31dee49fa9b53fa9ba2aae5ac9d51d78f7a5a932f9d942026f244df7c68e3bb

SHA512
169b185129c65d8e51f8676f3ecdfef6727738325c27010de991da6cca637dc0bc78fce3fe28914d0950b10762d42bdeda5d6590ae9cfbc7ada8518d8c7804bd

Download Submit
C:\Windows\system\mUlsVvG.exe

Filesize
1.7MB

MD5
a52e4995bf8a105dfbc5e245b4f20c94

SHA1
4d6a7f2add78ffeb0f11e18e0835e8f4e0ed81c2

SHA256
34e9c8ca2986fa355689bffd316f32660b0f541a5187a98f1a0b07d0a8b7defe

SHA512
be20d3dd8c80c789c706b3b69772fcf5e5c40117474582c9cf6d3830d9d743d5dd0c9bc811b251f620c5f4e0d874e7751b494c381da433a25672175e57d53a11

Download Submit
C:\Windows\system\mkKiTpF.exe

Filesize
1.7MB

MD5
a4efa8f982858441022fdfadd7167012

SHA1
81c25402b0149620b55d395686076a37cc73c4be

SHA256
827dc2ae7c2e4a8ec0b1f99c8ed19e5de147d221b5d6d59c4c0e420d401946f2

SHA512
ffdbcb9768c2f7254caaa6ccca9e0c6756f806a530dd43f194e5c5ff9b269470aba4d286d58af0b020c6109b13e870188dbccdae034fde4b608686bb47851f6d

Download Submit
C:\Windows\system\mpPKKVZ.exe

Filesize
1.7MB

MD5
a3976c550196d9cfe36e8824c3af73e5

SHA1
24848ffa52c3d7ba7749761271d23538a5ab7133

SHA256
f622eb98821ae503494b5c8fa97d7dc081b03db9cc882e3f4d1a72ecb349ed93

SHA512
b2a10b2ad702166c3d54779ba0bd9db787e9318ebf55b2dfd1fe22e56b91e452e5a279a2da44a70da1b29b46b9748c6c04373718be22ffb182b1dbafa2ad227a

Download Submit
C:\Windows\system\oQdyLku.exe

Filesize
1.7MB

MD5
d23361e795a22f3c6b61a34faa73752c

SHA1
ddd90ecdd08e8f8f7c5b7044782a95d25b46f11b

SHA256
2fad89c576aeb6227017a121506df45ad54e7448819d248886d713c1b446e930

SHA512
f62e73934af9e2f5a1b9c27e24cc449de5e4962feac14d11f4ef3c433243051c3a46b3026bfc2dd29c022662f95f197d8fc5284e6539d58e36c2689071be8437

Download Submit
C:\Windows\system\rOOFSno.exe

Filesize
1.7MB

MD5
97cf01616800224a76d3a80a7afe5d2b

SHA1
bdeae3f4c6612e1bfcfbd0bf549dcdc1aa570d56

SHA256
69c5d12c66de72a8ff23343a9de5275d5b051c082f38606cf43a62656356e533

SHA512
fa9631066fdcbaba104d3521c9c9ced7277b5326b297dd3c58e5d6e4de95316fd4cb713271d815c7bb5b2bddf5fc75c15da6ac2e9dc19ba63be78f7cce8ed567

Download Submit
C:\Windows\system\uqWEygb.exe

Filesize
1.7MB

MD5
01fb0dbee823769ad4e451b1990ec85f

SHA1
54e41f5d12f69f896f17d1a04009a8dc2c70ab3f

SHA256
edec32e73d6190aa4a6dd8a147dcdb2bc3e426bbcf6c4c702412cc3c346dd38f

SHA512
f2fb9fb0ef173d2c1aea1c5637200f97eb149f4a3810e271e6f8a7344f024911589a04592e4b9b729cd0d60087488f5a129402d2cd0bd6fb4f65a6e7a122b7bf

Download Submit
C:\Windows\system\vYyWNUq.exe

Filesize
1.7MB

MD5
f7e568e9c0065feb8626887475fcda24

SHA1
82014f285a3fa25d31419955e432c73d75c6fe93

SHA256
e4f5c25884ac764066987a221d5a3815fd4e2b1dc7f01bdcd25c4bcb25690eda

SHA512
75eb8fcea367baf4697109a04cd3c7061bee7754c1f8e6c8a54ebe2bdf152a6156c39b7684cd0ee4bbc10d306614371b63dc9c4807b74de66a6e0b07c326f0ab

Download Submit
C:\Windows\system\weODftb.exe

Filesize
1.7MB

MD5
ace6a53e46e98c50ab02f3d51abd9f4f

SHA1
e3d45e0a8eb52e43f052966cd3570684855ebbfb

SHA256
36c12773677b35b7b4e20a472f1140013c34318bc86fa22a2f1f7ca99faf178c

SHA512
3024dce1554ddf47960380b3e2150dcc500f914da673619569f10c16b2f856a0db7f5e4e1da1b51bb5e549a9b143807cef4eab39753294656f870a2d444b274a

Download Submit
C:\Windows\system\yOfAIzn.exe

Filesize
1.7MB

MD5
830e5219d5c7edca78d5b79af33c2f36

SHA1
c17a6cfc46332e9ff7ca6bf6ed994f8788873cf9

SHA256
9011d68cd06c18e13910c48ed9e13dcea7afad21f34e1c585399d648a776d19f

SHA512
5b71e027b8e448f77583a7b86092e7b52467617a35ca6efdf6ff96038f447903b67bcea15fd24eca06f6b8405619386b5c9c474c67895a4a9134454eb98f7739

Download Submit
C:\Windows\system\zFtgCAA.exe

Filesize
1.7MB

MD5
dd5db9c0a9147947eeea8e3c986dd638

SHA1
c50146e20b80c9f48fb9ee38791bf372e6a9e663

SHA256
53a05c9c9f18efad28c2a27277c4a35782eee3fe86a9cee91cc2bd1a520f74d0

SHA512
20c89a6b09fb923f8f353393dcb6b861d4e79bbdce171b5f17bbe547e02e51ba41b92c1189aab19a7fbab5848db5dda32d11884d34a29aca34a396f5d051357b

Download Submit
C:\Windows\system\zSCRilw.exe

Filesize
1.7MB

MD5
e3e1b5042fd883bd43d309a75e0d8bbd

SHA1
1fbd95034f290b956fe04836706b712ba36f77ea

SHA256
eb869d1a196595e354da6af12ed7f2acd710793baa0994882870897b37927ede

SHA512
e64f6546be23c60d2835e14408974d2fc3448b1c4a937514fcdb6adea7e0c2ef3840251f2426ed71f46c3f8c8a2e4dd2b42b1f4b579993e5ac1fccbaeddd710e

Download Submit
\Windows\system\FGyUtZZ.exe

Filesize
1.7MB

MD5
d011138115db60702b331975a7a46386

SHA1
85042171f2450e4cbcede1c48f77a29a1ad4fd2c

SHA256
b9d99bd9a0d928ba4f51f67c5e01a2c5c711ebce2582e551a704803ca6f4ab35

SHA512
16baf56946c6e65cf4d4fcb1c10d6e2f94bf9e5c809e573df1c1d76e3b84b95d21bd9ca1ff6c76439e4317291d2609c74d9f32003ef9fe64d9c0e7baf497fdd3

Download Submit
\Windows\system\WQJiNrO.exe

Filesize
1.7MB

MD5
cc46a2dbb903c87a4e95bf965174e0cd

SHA1
17b224af93f6d49158a34834e9bd227e023c88d0

SHA256
c26773d21db7241807403b2cc8a330254109199f35385687688c2646ae994da1

SHA512
6768acebef08771065193c8c92f9a240046e772468d94472858a76db40208367b53c9247390c757a3fd3f615a086603b4143d345d195e612bf7c5d5a0cdff3d1

Download Submit
\Windows\system\YlVarxH.exe

Filesize
1.7MB

MD5
3f226803130809a4be2f6aa97e809fed

SHA1
a9bfc7f77962a7f4f394e1910c139600ca3f5d50

SHA256
2d7b15327f47d50960cef204f22c4c0172dff1659a8719ec3d930686af2ff820

SHA512
bbf766e43f1ea29276b3d5ba5ff132d9b7d657e85dbf3fe09d10f8b8c3822ee315c4561a45bedb6d55f47038a98689a3dcc4fe5dcc61482bd15a96b4efbe8429

Download Submit
\Windows\system\cfecaVO.exe

Filesize
1.7MB

MD5
0c4f4a096f6eca9c41a3d48a884d2de0

SHA1
f5e8fd8d44519af5c692815b782f0814214256b8

SHA256
48d73abcab8d97bdf25593c9a56dbcce5ae2badc3a496f129885bfcdd2153bf4

SHA512
e395b2964b5708841a2530ca7dac6172109e9fd487089f60d21d8cef48caf71c7ffb5892ae564e70bdbd0ded09d2766286d1de030bf3bf7ee3b9175c0705aac2

Download Submit
\Windows\system\iBpYtgD.exe

Filesize
1.7MB

MD5
a630dd866639f41f9ff0060bcf9ac2b4

SHA1
b7840c8a485af26bf58c89389458bb0c58dc4848

SHA256
ad9b2aef0b87101375eb9c60513494044d2fa650952ca1ac0b6dae92c30759d1

SHA512
c65cd58c0eb51e198e1284e0f35874b3fe0e1418459beb72e7f0998a495c492eb92e53f71d866838a3ae291c719a88e08af4bc5864809914721b0f9ccb00c2dc

Download Submit
\Windows\system\kaHZbET.exe

Filesize
1.7MB

MD5
a758c9ef9deb5ec2e4ad701f87b4fe8f

SHA1
457f4879b7a2fd5b45d31cc5c89bb3b0d489df0b

SHA256
d521dc9e8208238daf8be8f4fc6b2688346b7c3f2773901a581217dc9a0ae5e3

SHA512
85f44c9ecfbd841acecedfd4e3dc07b73cc434b2fde305c42e2fc496db4775e0d4769d983d44bb1d762f9437843ddf352efc8bc6c7685fd9b1442ac4afaabfd6

Download Submit
\Windows\system\rYFzeOW.exe

Filesize
1.7MB

MD5
77f750b590d701daed82ef3bb34ac2eb

SHA1
55f06e5ad654f89505d7a1e5eed00504d280fc42

SHA256
eda149c1654e65f98e7f4457eba4abb1a01496823de014f48aebf84ece7f6be2

SHA512
7535c06a43af1e87f40cd86f814668b7fa68a3b69fadaea9cdefed7d783e2078356300a9bb60cb7c2a83f21bc6714dbb87e197b1694c7d448ff5272f6de43f5a

Download Submit
memory/2304-216-0x000000001B4B0000-0x000000001B792000-memory.dmp

Filesize
2.9MB

Download
memory/2304-227-0x0000000002960000-0x0000000002968000-memory.dmp

Filesize
32KB

Download
memory/2440-83-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2440-93-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2440-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2440-40-0x0000000002540000-0x0000000002932000-memory.dmp

Filesize
3.9MB

Download
memory/2440-80-0x0000000002D80000-0x0000000003172000-memory.dmp

Filesize
3.9MB

Download
memory/2440-101-0x0000000002540000-0x0000000002932000-memory.dmp

Filesize
3.9MB

Download
memory/2440-103-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2440-85-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2440-91-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2440-82-0x0000000002D80000-0x0000000003172000-memory.dmp

Filesize
3.9MB

Download
memory/2440-81-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2440-79-0x0000000002D80000-0x0000000003172000-memory.dmp

Filesize
3.9MB

Download
memory/2440-64-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2440-70-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2440-1-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2524-92-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2532-88-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-86-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2776-94-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2812-89-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2832-78-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2836-77-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2896-87-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/3060-90-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download