xmrig | 710e2014fc07101be085973fc0ca70f3b6bde084a67f6b9dd5a08e0bbcdf653b

Analysis

max time kernel
17s
max time network
32s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
Size

2.4MB
MD5

02f2c58086d1482b92a24da68b6b0deb
SHA1

a1c8d080bea49a70f6e375e3599856d951a35efc
SHA256

710e2014fc07101be085973fc0ca70f3b6bde084a67f6b9dd5a08e0bbcdf653b
SHA512

10f8e448c478550fe8cb95e70ffa3812666379863c076518563da76e654bf8bdaa2b07301fc8a6f02c9c35f7934187542ba78639261db9aff7e16d92d3b4f009
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cRbsl:NABk

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2616-8-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig
behavioral1/memory/2200-199-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2684-198-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2916-195-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2436-193-0x000000013F850000-0x000000013FC42000-memory.dmp	xmrig
behavioral1/memory/2408-190-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2716-188-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/1888-186-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2616	zWePgDr.exe
2560	FZblogW.exe
2684	CHJgDaw.exe
2200	rJdTbii.exe
1888	WBTlrTv.exe
2568	naWZWwc.exe
2716	NlLozBp.exe
2408	tHgKnJr.exe
2436	zMyvBJf.exe
2916	KBHJDcr.exe
2664	ihBDcUC.exe
2624	SevXqfp.exe
2484	vZCitMi.exe
2180	GVPLCoc.exe
2652	UZlDGdc.exe
2068	wyIZPox.exe
1484	kcceMtn.exe
1836	RHNYTYd.exe
1812	yIxoTtQ.exe
1356	yuORGUF.exe
308	UlDDmbm.exe
2912	ksraheS.exe
1260	PFkDdac.exe
296	sEaEeBB.exe
1244	hCSTVKc.exe
1960	oDmKqvh.exe
2032	bFEuWTN.exe
1912	uVvWePc.exe
264	FgDwzck.exe
1848	sOpeQLu.exe
2020	RBSuMCR.exe
2504	iRVCNiT.exe
1596	mroOpyB.exe
1048	hdJrEjQ.exe
2944	iphOgAI.exe
444	KltUuXV.exe
1472	ydpHSBD.exe
752	EClMcuR.exe
988	ETBTJTV.exe
2192	rLwnIvH.exe
1132	DWbwhVB.exe
780	tyxYGMn.exe
1712	DUPMxyq.exe
3040	HniSzoh.exe
2160	uTYurKx.exe
2364	CaBrSGN.exe
2868	PvnkGXV.exe
2328	ZcLgtTq.exe
1480	TLJNWMM.exe
3044	cRPCARX.exe
2608	ZhIxdGo.exe
2232	OdcDIuh.exe
2636	ZiVGRKn.exe
1904	fbjbnWN.exe
2508	tZPyipU.exe
1808	bSppKAY.exe
2656	iIWVskB.exe
1176	WydEqfe.exe
1392	oyKMIiw.exe
1948	dzkZjgt.exe
3064	mIYjOsp.exe
660	nakdciq.exe
1580	RxcUshb.exe
3048	cUTNXtP.exe

Loads dropped DLL 64 IoCs

pid	Process
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2300-0-0x000000013FD20000-0x0000000140112000-memory.dmp	upx
behavioral1/files/0x000c000000012279-3.dat	upx
behavioral1/memory/2616-8-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/files/0x0038000000016126-13.dat	upx
behavioral1/files/0x00090000000167e8-20.dat	upx
behavioral1/files/0x0008000000016c3a-36.dat	upx
behavioral1/files/0x0007000000016c5b-35.dat	upx
behavioral1/files/0x0007000000016c57-29.dat	upx
behavioral1/files/0x0008000000016d7d-48.dat	upx
behavioral1/files/0x000600000001738e-68.dat	upx
behavioral1/files/0x00060000000173e2-74.dat	upx
behavioral1/files/0x000600000001738f-69.dat	upx
behavioral1/files/0x00060000000173e5-87.dat	upx
behavioral1/files/0x000600000001902f-147.dat	upx
behavioral1/files/0x000500000001927b-166.dat	upx
behavioral1/memory/2200-199-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2684-198-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/memory/2916-195-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/memory/2436-193-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/memory/2408-190-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/2716-188-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/memory/2568-187-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/1888-186-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/files/0x000500000001928e-168.dat	upx
behavioral1/files/0x0005000000019276-159.dat	upx
behavioral1/files/0x0005000000019254-151.dat	upx
behavioral1/files/0x000500000001871c-145.dat	upx
behavioral1/files/0x000500000001878f-142.dat	upx
behavioral1/files/0x00050000000186a2-127.dat	upx
behavioral1/files/0x000500000001925a-157.dat	upx
behavioral1/files/0x0005000000018749-140.dat	upx
behavioral1/files/0x000500000001870e-131.dat	upx
behavioral1/files/0x0006000000017603-117.dat	upx
behavioral1/files/0x000d000000018689-122.dat	upx
behavioral1/files/0x00060000000175f7-107.dat	upx
behavioral1/files/0x00060000000175fd-112.dat	upx
behavioral1/files/0x00060000000174ef-97.dat	upx
behavioral1/files/0x0006000000017577-101.dat	upx
behavioral1/files/0x0006000000017436-92.dat	upx
behavioral1/files/0x00060000000171ad-60.dat	upx
behavioral1/files/0x0006000000016fa9-51.dat	upx
behavioral1/files/0x0007000000016ccd-47.dat	upx
behavioral1/files/0x000600000001708c-57.dat	upx
behavioral1/files/0x00130000000054a8-25.dat	upx
behavioral1/memory/2560-24-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sbCBwbP.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\gKdJaYd.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\ZKVBipx.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\aHruQxP.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\qDfqxjn.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\AtSdFPQ.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\GPrdPBT.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\nrwuuqQ.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\dYXcYLj.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\iAqWytE.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\qddnyCm.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\CvauZso.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\oyKMIiw.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\BFxehUY.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\aVnICfy.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\cCYFTKW.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\LSNIZZB.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\wxphWbR.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\pOVDtMP.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\VGZunwW.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\GnHDDRz.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\NOxmUwE.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\vZCitMi.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\wyIZPox.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\pbdxNyh.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\bQxfFyp.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\RxcUshb.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\kLePnjj.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\gZTAVnF.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\nmSWoLu.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\owazdWp.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\lwvradA.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\zaRrRrp.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\fxpFkNM.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\IaIibIf.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\SYQWqrV.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\FABYxlY.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\FQOoQAy.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\mBuWvCE.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\bLWzghL.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\EClMcuR.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\XaCPPun.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\NObziuq.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\LESsWxU.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\uerZxuG.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\jCUWeKi.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\HDNAGpz.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\edkSUBR.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\PWxyGHZ.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\sSvdkHJ.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\dsoMQys.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\AaxjTcp.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\akOtVKR.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\rooFypR.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\IFaOQRF.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\FTTkmkt.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\HUbroUm.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\nKIAvjD.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\znMgZxq.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\fsxmrYe.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\rMahuGx.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\uDPZXPK.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\DHkGLkY.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
File created	C:\Windows\System\WYAULEC.exe	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2492	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
Token: SeDebugPrivilege	2492	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2492	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	29
PID 2300 wrote to memory of 2492	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	29
PID 2300 wrote to memory of 2492	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	29
PID 2300 wrote to memory of 2616	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	30
PID 2300 wrote to memory of 2616	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	30
PID 2300 wrote to memory of 2616	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	30
PID 2300 wrote to memory of 2560	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	31
PID 2300 wrote to memory of 2560	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	31
PID 2300 wrote to memory of 2560	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	31
PID 2300 wrote to memory of 2684	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	32
PID 2300 wrote to memory of 2684	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	32
PID 2300 wrote to memory of 2684	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	32
PID 2300 wrote to memory of 2568	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	33
PID 2300 wrote to memory of 2568	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	33
PID 2300 wrote to memory of 2568	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	33
PID 2300 wrote to memory of 2200	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	34
PID 2300 wrote to memory of 2200	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	34
PID 2300 wrote to memory of 2200	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	34
PID 2300 wrote to memory of 2716	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	35
PID 2300 wrote to memory of 2716	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	35
PID 2300 wrote to memory of 2716	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	35
PID 2300 wrote to memory of 1888	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	36
PID 2300 wrote to memory of 1888	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	36
PID 2300 wrote to memory of 1888	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	36
PID 2300 wrote to memory of 2408	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	37
PID 2300 wrote to memory of 2408	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	37
PID 2300 wrote to memory of 2408	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	37
PID 2300 wrote to memory of 2436	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	38
PID 2300 wrote to memory of 2436	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	38
PID 2300 wrote to memory of 2436	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	38
PID 2300 wrote to memory of 2484	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	39
PID 2300 wrote to memory of 2484	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	39
PID 2300 wrote to memory of 2484	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	39
PID 2300 wrote to memory of 2916	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	40
PID 2300 wrote to memory of 2916	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	40
PID 2300 wrote to memory of 2916	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	40
PID 2300 wrote to memory of 2180	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	41
PID 2300 wrote to memory of 2180	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	41
PID 2300 wrote to memory of 2180	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	41
PID 2300 wrote to memory of 2664	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	42
PID 2300 wrote to memory of 2664	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	42
PID 2300 wrote to memory of 2664	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	42
PID 2300 wrote to memory of 2652	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	43
PID 2300 wrote to memory of 2652	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	43
PID 2300 wrote to memory of 2652	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	43
PID 2300 wrote to memory of 2624	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	44
PID 2300 wrote to memory of 2624	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	44
PID 2300 wrote to memory of 2624	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	44
PID 2300 wrote to memory of 2068	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	45
PID 2300 wrote to memory of 2068	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	45
PID 2300 wrote to memory of 2068	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	45
PID 2300 wrote to memory of 1484	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	46
PID 2300 wrote to memory of 1484	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	46
PID 2300 wrote to memory of 1484	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	46
PID 2300 wrote to memory of 1836	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	47
PID 2300 wrote to memory of 1836	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	47
PID 2300 wrote to memory of 1836	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	47
PID 2300 wrote to memory of 1812	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	48
PID 2300 wrote to memory of 1812	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	48
PID 2300 wrote to memory of 1812	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	48
PID 2300 wrote to memory of 1356	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	49
PID 2300 wrote to memory of 1356	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	49
PID 2300 wrote to memory of 1356	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	49
PID 2300 wrote to memory of 308	2300	02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02f2c58086d1482b92a24da68b6b0deb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2492
- C:\Windows\System\zWePgDr.exe
  C:\Windows\System\zWePgDr.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\FZblogW.exe
  C:\Windows\System\FZblogW.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\CHJgDaw.exe
  C:\Windows\System\CHJgDaw.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\naWZWwc.exe
  C:\Windows\System\naWZWwc.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\rJdTbii.exe
  C:\Windows\System\rJdTbii.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\NlLozBp.exe
  C:\Windows\System\NlLozBp.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\WBTlrTv.exe
  C:\Windows\System\WBTlrTv.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\tHgKnJr.exe
  C:\Windows\System\tHgKnJr.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\zMyvBJf.exe
  C:\Windows\System\zMyvBJf.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\vZCitMi.exe
  C:\Windows\System\vZCitMi.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\KBHJDcr.exe
  C:\Windows\System\KBHJDcr.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\GVPLCoc.exe
  C:\Windows\System\GVPLCoc.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\ihBDcUC.exe
  C:\Windows\System\ihBDcUC.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\UZlDGdc.exe
  C:\Windows\System\UZlDGdc.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\SevXqfp.exe
  C:\Windows\System\SevXqfp.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\wyIZPox.exe
  C:\Windows\System\wyIZPox.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\kcceMtn.exe
  C:\Windows\System\kcceMtn.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\RHNYTYd.exe
  C:\Windows\System\RHNYTYd.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\yIxoTtQ.exe
  C:\Windows\System\yIxoTtQ.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\yuORGUF.exe
  C:\Windows\System\yuORGUF.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\UlDDmbm.exe
  C:\Windows\System\UlDDmbm.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\ksraheS.exe
  C:\Windows\System\ksraheS.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\PFkDdac.exe
  C:\Windows\System\PFkDdac.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\sEaEeBB.exe
  C:\Windows\System\sEaEeBB.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\hCSTVKc.exe
  C:\Windows\System\hCSTVKc.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\bFEuWTN.exe
  C:\Windows\System\bFEuWTN.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\oDmKqvh.exe
  C:\Windows\System\oDmKqvh.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\RBSuMCR.exe
  C:\Windows\System\RBSuMCR.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\uVvWePc.exe
  C:\Windows\System\uVvWePc.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\iRVCNiT.exe
  C:\Windows\System\iRVCNiT.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\FgDwzck.exe
  C:\Windows\System\FgDwzck.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\hdJrEjQ.exe
  C:\Windows\System\hdJrEjQ.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\sOpeQLu.exe
  C:\Windows\System\sOpeQLu.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\iphOgAI.exe
  C:\Windows\System\iphOgAI.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\mroOpyB.exe
  C:\Windows\System\mroOpyB.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\KltUuXV.exe
  C:\Windows\System\KltUuXV.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\ydpHSBD.exe
  C:\Windows\System\ydpHSBD.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\EClMcuR.exe
  C:\Windows\System\EClMcuR.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\ETBTJTV.exe
  C:\Windows\System\ETBTJTV.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\uWgjheZ.exe
  C:\Windows\System\uWgjheZ.exe
  2⤵
  PID:2244
- C:\Windows\System\rLwnIvH.exe
  C:\Windows\System\rLwnIvH.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\ZuBnfNt.exe
  C:\Windows\System\ZuBnfNt.exe
  2⤵
  PID:1664
- C:\Windows\System\DWbwhVB.exe
  C:\Windows\System\DWbwhVB.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\reftPdL.exe
  C:\Windows\System\reftPdL.exe
  2⤵
  PID:552
- C:\Windows\System\tyxYGMn.exe
  C:\Windows\System\tyxYGMn.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\ACDceQV.exe
  C:\Windows\System\ACDceQV.exe
  2⤵
  PID:1860
- C:\Windows\System\DUPMxyq.exe
  C:\Windows\System\DUPMxyq.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\fyLgBbV.exe
  C:\Windows\System\fyLgBbV.exe
  2⤵
  PID:2296
- C:\Windows\System\HniSzoh.exe
  C:\Windows\System\HniSzoh.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\oeOMfkR.exe
  C:\Windows\System\oeOMfkR.exe
  2⤵
  PID:2284
- C:\Windows\System\uTYurKx.exe
  C:\Windows\System\uTYurKx.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\UkaZiTL.exe
  C:\Windows\System\UkaZiTL.exe
  2⤵
  PID:2228
- C:\Windows\System\CaBrSGN.exe
  C:\Windows\System\CaBrSGN.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\QfNKmuc.exe
  C:\Windows\System\QfNKmuc.exe
  2⤵
  PID:884
- C:\Windows\System\PvnkGXV.exe
  C:\Windows\System\PvnkGXV.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\tKZkpdo.exe
  C:\Windows\System\tKZkpdo.exe
  2⤵
  PID:1632
- C:\Windows\System\ZcLgtTq.exe
  C:\Windows\System\ZcLgtTq.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\TyBOeIx.exe
  C:\Windows\System\TyBOeIx.exe
  2⤵
  PID:1516
- C:\Windows\System\TLJNWMM.exe
  C:\Windows\System\TLJNWMM.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\aOlBbaq.exe
  C:\Windows\System\aOlBbaq.exe
  2⤵
  PID:2344
- C:\Windows\System\cRPCARX.exe
  C:\Windows\System\cRPCARX.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\UEHqojA.exe
  C:\Windows\System\UEHqojA.exe
  2⤵
  PID:2704
- C:\Windows\System\ZhIxdGo.exe
  C:\Windows\System\ZhIxdGo.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\rluDOnu.exe
  C:\Windows\System\rluDOnu.exe
  2⤵
  PID:2472
- C:\Windows\System\OdcDIuh.exe
  C:\Windows\System\OdcDIuh.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\houpSjM.exe
  C:\Windows\System\houpSjM.exe
  2⤵
  PID:2172
- C:\Windows\System\ZiVGRKn.exe
  C:\Windows\System\ZiVGRKn.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\behNFmK.exe
  C:\Windows\System\behNFmK.exe
  2⤵
  PID:2788
- C:\Windows\System\fbjbnWN.exe
  C:\Windows\System\fbjbnWN.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\fxpFkNM.exe
  C:\Windows\System\fxpFkNM.exe
  2⤵
  PID:1572
- C:\Windows\System\tZPyipU.exe
  C:\Windows\System\tZPyipU.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\ppFFnsR.exe
  C:\Windows\System\ppFFnsR.exe
  2⤵
  PID:2904
- C:\Windows\System\bSppKAY.exe
  C:\Windows\System\bSppKAY.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\UDZzWri.exe
  C:\Windows\System\UDZzWri.exe
  2⤵
  PID:1488
- C:\Windows\System\iIWVskB.exe
  C:\Windows\System\iIWVskB.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\XJqbqbB.exe
  C:\Windows\System\XJqbqbB.exe
  2⤵
  PID:1012
- C:\Windows\System\WydEqfe.exe
  C:\Windows\System\WydEqfe.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\dvnMtHy.exe
  C:\Windows\System\dvnMtHy.exe
  2⤵
  PID:1924
- C:\Windows\System\oyKMIiw.exe
  C:\Windows\System\oyKMIiw.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\XaCPPun.exe
  C:\Windows\System\XaCPPun.exe
  2⤵
  PID:2392
- C:\Windows\System\dzkZjgt.exe
  C:\Windows\System\dzkZjgt.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\NWIsTYt.exe
  C:\Windows\System\NWIsTYt.exe
  2⤵
  PID:2464
- C:\Windows\System\mIYjOsp.exe
  C:\Windows\System\mIYjOsp.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\GzdGHwV.exe
  C:\Windows\System\GzdGHwV.exe
  2⤵
  PID:1340
- C:\Windows\System\nakdciq.exe
  C:\Windows\System\nakdciq.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\PsWZDGp.exe
  C:\Windows\System\PsWZDGp.exe
  2⤵
  PID:700
- C:\Windows\System\RxcUshb.exe
  C:\Windows\System\RxcUshb.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\ojnKgwC.exe
  C:\Windows\System\ojnKgwC.exe
  2⤵
  PID:756
- C:\Windows\System\cUTNXtP.exe
  C:\Windows\System\cUTNXtP.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\RgoDHLl.exe
  C:\Windows\System\RgoDHLl.exe
  2⤵
  PID:2004
- C:\Windows\System\tXTmGRD.exe
  C:\Windows\System\tXTmGRD.exe
  2⤵
  PID:596
- C:\Windows\System\sKEuVRb.exe
  C:\Windows\System\sKEuVRb.exe
  2⤵
  PID:888
- C:\Windows\System\jCUWeKi.exe
  C:\Windows\System\jCUWeKi.exe
  2⤵
  PID:1504
- C:\Windows\System\mYNfIdu.exe
  C:\Windows\System\mYNfIdu.exe
  2⤵
  PID:2500
- C:\Windows\System\lMswFbz.exe
  C:\Windows\System\lMswFbz.exe
  2⤵
  PID:2692
- C:\Windows\System\PIOMBYU.exe
  C:\Windows\System\PIOMBYU.exe
  2⤵
  PID:2780
- C:\Windows\System\ZepKucz.exe
  C:\Windows\System\ZepKucz.exe
  2⤵
  PID:1436
- C:\Windows\System\jCPflSd.exe
  C:\Windows\System\jCPflSd.exe
  2⤵
  PID:1188
- C:\Windows\System\LESsWxU.exe
  C:\Windows\System\LESsWxU.exe
  2⤵
  PID:2936
- C:\Windows\System\witMzXZ.exe
  C:\Windows\System\witMzXZ.exe
  2⤵
  PID:2892
- C:\Windows\System\GPrdPBT.exe
  C:\Windows\System\GPrdPBT.exe
  2⤵
  PID:3084
- C:\Windows\System\TvlAYoW.exe
  C:\Windows\System\TvlAYoW.exe
  2⤵
  PID:3100
- C:\Windows\System\qelhwyK.exe
  C:\Windows\System\qelhwyK.exe
  2⤵
  PID:3116
- C:\Windows\System\ASUCMAS.exe
  C:\Windows\System\ASUCMAS.exe
  2⤵
  PID:3132
- C:\Windows\System\KovaplB.exe
  C:\Windows\System\KovaplB.exe
  2⤵
  PID:3148
- C:\Windows\System\bTdmlQz.exe
  C:\Windows\System\bTdmlQz.exe
  2⤵
  PID:3164
- C:\Windows\System\XNnKrSF.exe
  C:\Windows\System\XNnKrSF.exe
  2⤵
  PID:3180
- C:\Windows\System\aNSuPTJ.exe
  C:\Windows\System\aNSuPTJ.exe
  2⤵
  PID:3196
- C:\Windows\System\zdcGeSj.exe
  C:\Windows\System\zdcGeSj.exe
  2⤵
  PID:3212
- C:\Windows\System\MLgLkyH.exe
  C:\Windows\System\MLgLkyH.exe
  2⤵
  PID:3228
- C:\Windows\System\ypYgxzv.exe
  C:\Windows\System\ypYgxzv.exe
  2⤵
  PID:3244
- C:\Windows\System\SihlmxZ.exe
  C:\Windows\System\SihlmxZ.exe
  2⤵
  PID:3260
- C:\Windows\System\mzsUhla.exe
  C:\Windows\System\mzsUhla.exe
  2⤵
  PID:3276
- C:\Windows\System\aOUIvWd.exe
  C:\Windows\System\aOUIvWd.exe
  2⤵
  PID:3292
- C:\Windows\System\cqlxBTp.exe
  C:\Windows\System\cqlxBTp.exe
  2⤵
  PID:3308
- C:\Windows\System\BbmeIxV.exe
  C:\Windows\System\BbmeIxV.exe
  2⤵
  PID:3324
- C:\Windows\System\xmbLQiq.exe
  C:\Windows\System\xmbLQiq.exe
  2⤵
  PID:3340
- C:\Windows\System\wQiAxYe.exe
  C:\Windows\System\wQiAxYe.exe
  2⤵
  PID:3356
- C:\Windows\System\Aamaing.exe
  C:\Windows\System\Aamaing.exe
  2⤵
  PID:3372
- C:\Windows\System\PWxyGHZ.exe
  C:\Windows\System\PWxyGHZ.exe
  2⤵
  PID:3388
- C:\Windows\System\qNoHwaB.exe
  C:\Windows\System\qNoHwaB.exe
  2⤵
  PID:3404
- C:\Windows\System\dYyWMlj.exe
  C:\Windows\System\dYyWMlj.exe
  2⤵
  PID:3420
- C:\Windows\System\sHaXois.exe
  C:\Windows\System\sHaXois.exe
  2⤵
  PID:3436
- C:\Windows\System\IFaOQRF.exe
  C:\Windows\System\IFaOQRF.exe
  2⤵
  PID:3452
- C:\Windows\System\aMuzLAR.exe
  C:\Windows\System\aMuzLAR.exe
  2⤵
  PID:3468
- C:\Windows\System\jRfRHNv.exe
  C:\Windows\System\jRfRHNv.exe
  2⤵
  PID:3484
- C:\Windows\System\mxGgRra.exe
  C:\Windows\System\mxGgRra.exe
  2⤵
  PID:3500
- C:\Windows\System\BFxehUY.exe
  C:\Windows\System\BFxehUY.exe
  2⤵
  PID:3516
- C:\Windows\System\kmamXCQ.exe
  C:\Windows\System\kmamXCQ.exe
  2⤵
  PID:3532
- C:\Windows\System\NGnqWwg.exe
  C:\Windows\System\NGnqWwg.exe
  2⤵
  PID:3548
- C:\Windows\System\bgftlwK.exe
  C:\Windows\System\bgftlwK.exe
  2⤵
  PID:3564
- C:\Windows\System\aEzcnfo.exe
  C:\Windows\System\aEzcnfo.exe
  2⤵
  PID:3580
- C:\Windows\System\rhmsYTu.exe
  C:\Windows\System\rhmsYTu.exe
  2⤵
  PID:3596
- C:\Windows\System\HDNAGpz.exe
  C:\Windows\System\HDNAGpz.exe
  2⤵
  PID:3612
- C:\Windows\System\XPbJgUG.exe
  C:\Windows\System\XPbJgUG.exe
  2⤵
  PID:3628
- C:\Windows\System\VjbUsdz.exe
  C:\Windows\System\VjbUsdz.exe
  2⤵
  PID:3644
- C:\Windows\System\imbuwab.exe
  C:\Windows\System\imbuwab.exe
  2⤵
  PID:3660
- C:\Windows\System\NEFkOCS.exe
  C:\Windows\System\NEFkOCS.exe
  2⤵
  PID:3676
- C:\Windows\System\uDPZXPK.exe
  C:\Windows\System\uDPZXPK.exe
  2⤵
  PID:3692
- C:\Windows\System\NfxOSYT.exe
  C:\Windows\System\NfxOSYT.exe
  2⤵
  PID:3708
- C:\Windows\System\nLXeJMh.exe
  C:\Windows\System\nLXeJMh.exe
  2⤵
  PID:3724
- C:\Windows\System\UXbdQEp.exe
  C:\Windows\System\UXbdQEp.exe
  2⤵
  PID:3740
- C:\Windows\System\YMhTbVs.exe
  C:\Windows\System\YMhTbVs.exe
  2⤵
  PID:3756
- C:\Windows\System\WSZmpJN.exe
  C:\Windows\System\WSZmpJN.exe
  2⤵
  PID:3772
- C:\Windows\System\dPTfvvs.exe
  C:\Windows\System\dPTfvvs.exe
  2⤵
  PID:3788
- C:\Windows\System\wAoQats.exe
  C:\Windows\System\wAoQats.exe
  2⤵
  PID:3804
- C:\Windows\System\HlrbzsY.exe
  C:\Windows\System\HlrbzsY.exe
  2⤵
  PID:3820
- C:\Windows\System\AODdvTm.exe
  C:\Windows\System\AODdvTm.exe
  2⤵
  PID:3836
- C:\Windows\System\LnWsfKF.exe
  C:\Windows\System\LnWsfKF.exe
  2⤵
  PID:3852
- C:\Windows\System\cJNrFGJ.exe
  C:\Windows\System\cJNrFGJ.exe
  2⤵
  PID:3868
- C:\Windows\System\FviPMUi.exe
  C:\Windows\System\FviPMUi.exe
  2⤵
  PID:3884
- C:\Windows\System\AwdAlVK.exe
  C:\Windows\System\AwdAlVK.exe
  2⤵
  PID:3900
- C:\Windows\System\lQoSmkK.exe
  C:\Windows\System\lQoSmkK.exe
  2⤵
  PID:3916
- C:\Windows\System\zqGpakN.exe
  C:\Windows\System\zqGpakN.exe
  2⤵
  PID:3932
- C:\Windows\System\GCxfwtc.exe
  C:\Windows\System\GCxfwtc.exe
  2⤵
  PID:3948
- C:\Windows\System\REegaET.exe
  C:\Windows\System\REegaET.exe
  2⤵
  PID:3964
- C:\Windows\System\bbFrXzs.exe
  C:\Windows\System\bbFrXzs.exe
  2⤵
  PID:3980
- C:\Windows\System\DkAbAci.exe
  C:\Windows\System\DkAbAci.exe
  2⤵
  PID:3996
- C:\Windows\System\DhRGIxn.exe
  C:\Windows\System\DhRGIxn.exe
  2⤵
  PID:4012
- C:\Windows\System\FzhFBns.exe
  C:\Windows\System\FzhFBns.exe
  2⤵
  PID:4028
- C:\Windows\System\UczoQuA.exe
  C:\Windows\System\UczoQuA.exe
  2⤵
  PID:4044
- C:\Windows\System\pWeIYRh.exe
  C:\Windows\System\pWeIYRh.exe
  2⤵
  PID:4060
- C:\Windows\System\PAWXduK.exe
  C:\Windows\System\PAWXduK.exe
  2⤵
  PID:4076
- C:\Windows\System\QcJSzSD.exe
  C:\Windows\System\QcJSzSD.exe
  2⤵
  PID:4092
- C:\Windows\System\aVnICfy.exe
  C:\Windows\System\aVnICfy.exe
  2⤵
  PID:1680
- C:\Windows\System\vqvSISo.exe
  C:\Windows\System\vqvSISo.exe
  2⤵
  PID:1956
- C:\Windows\System\DSZyPks.exe
  C:\Windows\System\DSZyPks.exe
  2⤵
  PID:2672
- C:\Windows\System\qNwewwP.exe
  C:\Windows\System\qNwewwP.exe
  2⤵
  PID:1708
- C:\Windows\System\TyItbjZ.exe
  C:\Windows\System\TyItbjZ.exe
  2⤵
  PID:3124
- C:\Windows\System\gApORpM.exe
  C:\Windows\System\gApORpM.exe
  2⤵
  PID:3188
- C:\Windows\System\zzEJTNI.exe
  C:\Windows\System\zzEJTNI.exe
  2⤵
  PID:3252
- C:\Windows\System\IaIibIf.exe
  C:\Windows\System\IaIibIf.exe
  2⤵
  PID:3316
- C:\Windows\System\iAEARRV.exe
  C:\Windows\System\iAEARRV.exe
  2⤵
  PID:3380
- C:\Windows\System\KqcFnbW.exe
  C:\Windows\System\KqcFnbW.exe
  2⤵
  PID:2448
- C:\Windows\System\ckAuOUa.exe
  C:\Windows\System\ckAuOUa.exe
  2⤵
  PID:284
- C:\Windows\System\hSCviJE.exe
  C:\Windows\System\hSCviJE.exe
  2⤵
  PID:2584
- C:\Windows\System\OoUhmyb.exe
  C:\Windows\System\OoUhmyb.exe
  2⤵
  PID:3540
- C:\Windows\System\ozfRVmg.exe
  C:\Windows\System\ozfRVmg.exe
  2⤵
  PID:2468
- C:\Windows\System\TcTCgjc.exe
  C:\Windows\System\TcTCgjc.exe
  2⤵
  PID:3640
- C:\Windows\System\NHCpTmF.exe
  C:\Windows\System\NHCpTmF.exe
  2⤵
  PID:3704
- C:\Windows\System\sbCBwbP.exe
  C:\Windows\System\sbCBwbP.exe
  2⤵
  PID:3764
- C:\Windows\System\jfiyldF.exe
  C:\Windows\System\jfiyldF.exe
  2⤵
  PID:3828
- C:\Windows\System\nrwuuqQ.exe
  C:\Windows\System\nrwuuqQ.exe
  2⤵
  PID:2928
- C:\Windows\System\hFWJJXQ.exe
  C:\Windows\System\hFWJJXQ.exe
  2⤵
  PID:3928
- C:\Windows\System\ysYViAa.exe
  C:\Windows\System\ysYViAa.exe
  2⤵
  PID:2588
- C:\Windows\System\omsFYbU.exe
  C:\Windows\System\omsFYbU.exe
  2⤵
  PID:4052
- C:\Windows\System\JaMaPnH.exe
  C:\Windows\System\JaMaPnH.exe
  2⤵
  PID:4088
- C:\Windows\System\sSvdkHJ.exe
  C:\Windows\System\sSvdkHJ.exe
  2⤵
  PID:1828
- C:\Windows\System\RPGMAbr.exe
  C:\Windows\System\RPGMAbr.exe
  2⤵
  PID:3160
- C:\Windows\System\EElaPYU.exe
  C:\Windows\System\EElaPYU.exe
  2⤵
  PID:3384
- C:\Windows\System\ofExWbY.exe
  C:\Windows\System\ofExWbY.exe
  2⤵
  PID:2784
- C:\Windows\System\fbgiZkl.exe
  C:\Windows\System\fbgiZkl.exe
  2⤵
  PID:1636
- C:\Windows\System\YtKMrcr.exe
  C:\Windows\System\YtKMrcr.exe
  2⤵
  PID:3796
- C:\Windows\System\dsoMQys.exe
  C:\Windows\System\dsoMQys.exe
  2⤵
  PID:3896
- C:\Windows\System\yaBEHLA.exe
  C:\Windows\System\yaBEHLA.exe
  2⤵
  PID:4024
- C:\Windows\System\SncaWZs.exe
  C:\Windows\System\SncaWZs.exe
  2⤵
  PID:4104
- C:\Windows\System\oeiisSa.exe
  C:\Windows\System\oeiisSa.exe
  2⤵
  PID:4120
- C:\Windows\System\dzBiENw.exe
  C:\Windows\System\dzBiENw.exe
  2⤵
  PID:4136
- C:\Windows\System\zKenPpl.exe
  C:\Windows\System\zKenPpl.exe
  2⤵
  PID:4152
- C:\Windows\System\dYXcYLj.exe
  C:\Windows\System\dYXcYLj.exe
  2⤵
  PID:4168
- C:\Windows\System\qDfqxjn.exe
  C:\Windows\System\qDfqxjn.exe
  2⤵
  PID:4184
- C:\Windows\System\HdyergB.exe
  C:\Windows\System\HdyergB.exe
  2⤵
  PID:4204
- C:\Windows\System\yJATEXz.exe
  C:\Windows\System\yJATEXz.exe
  2⤵
  PID:4220
- C:\Windows\System\uGaraKy.exe
  C:\Windows\System\uGaraKy.exe
  2⤵
  PID:4236
- C:\Windows\System\jIpEWKH.exe
  C:\Windows\System\jIpEWKH.exe
  2⤵
  PID:4256
- C:\Windows\System\KgLweqw.exe
  C:\Windows\System\KgLweqw.exe
  2⤵
  PID:4272
- C:\Windows\System\GsKJOPJ.exe
  C:\Windows\System\GsKJOPJ.exe
  2⤵
  PID:4288
- C:\Windows\System\ZaeWJmi.exe
  C:\Windows\System\ZaeWJmi.exe
  2⤵
  PID:4304
- C:\Windows\System\uxZPDeo.exe
  C:\Windows\System\uxZPDeo.exe
  2⤵
  PID:4320
- C:\Windows\System\wKaxrFz.exe
  C:\Windows\System\wKaxrFz.exe
  2⤵
  PID:4336
- C:\Windows\System\YNQEiiv.exe
  C:\Windows\System\YNQEiiv.exe
  2⤵
  PID:4352
- C:\Windows\System\sfQYcaE.exe
  C:\Windows\System\sfQYcaE.exe
  2⤵
  PID:4368
- C:\Windows\System\CvykcQj.exe
  C:\Windows\System\CvykcQj.exe
  2⤵
  PID:4384
- C:\Windows\System\gtegnxy.exe
  C:\Windows\System\gtegnxy.exe
  2⤵
  PID:4400
- C:\Windows\System\LXAcEba.exe
  C:\Windows\System\LXAcEba.exe
  2⤵
  PID:4416
- C:\Windows\System\AaxjTcp.exe
  C:\Windows\System\AaxjTcp.exe
  2⤵
  PID:4432
- C:\Windows\System\XVshNGD.exe
  C:\Windows\System\XVshNGD.exe
  2⤵
  PID:4448
- C:\Windows\System\yjgnvXI.exe
  C:\Windows\System\yjgnvXI.exe
  2⤵
  PID:4464
- C:\Windows\System\POMYMmk.exe
  C:\Windows\System\POMYMmk.exe
  2⤵
  PID:4480
- C:\Windows\System\EYCdDOr.exe
  C:\Windows\System\EYCdDOr.exe
  2⤵
  PID:4496
- C:\Windows\System\AEUVXBl.exe
  C:\Windows\System\AEUVXBl.exe
  2⤵
  PID:4512
- C:\Windows\System\nqKWMKj.exe
  C:\Windows\System\nqKWMKj.exe
  2⤵
  PID:4528
- C:\Windows\System\GcUmnwV.exe
  C:\Windows\System\GcUmnwV.exe
  2⤵
  PID:4544
- C:\Windows\System\oWpfeLm.exe
  C:\Windows\System\oWpfeLm.exe
  2⤵
  PID:4560
- C:\Windows\System\JoNpCaq.exe
  C:\Windows\System\JoNpCaq.exe
  2⤵
  PID:4576
- C:\Windows\System\zWxORHR.exe
  C:\Windows\System\zWxORHR.exe
  2⤵
  PID:4592
- C:\Windows\System\scvrPIU.exe
  C:\Windows\System\scvrPIU.exe
  2⤵
  PID:4608
- C:\Windows\System\VsgrkWF.exe
  C:\Windows\System\VsgrkWF.exe
  2⤵
  PID:4624
- C:\Windows\System\XSEADnA.exe
  C:\Windows\System\XSEADnA.exe
  2⤵
  PID:4640
- C:\Windows\System\yvovULs.exe
  C:\Windows\System\yvovULs.exe
  2⤵
  PID:4668
- C:\Windows\System\yorxKZg.exe
  C:\Windows\System\yorxKZg.exe
  2⤵
  PID:4684
- C:\Windows\System\IQimLFL.exe
  C:\Windows\System\IQimLFL.exe
  2⤵
  PID:4700
- C:\Windows\System\PGJOYYV.exe
  C:\Windows\System\PGJOYYV.exe
  2⤵
  PID:4724
- C:\Windows\System\eZjCLHc.exe
  C:\Windows\System\eZjCLHc.exe
  2⤵
  PID:4816
- C:\Windows\System\LxrdBuu.exe
  C:\Windows\System\LxrdBuu.exe
  2⤵
  PID:3288
- C:\Windows\System\zMVMjRj.exe
  C:\Windows\System\zMVMjRj.exe
  2⤵
  PID:852
- C:\Windows\System\wuGiJCL.exe
  C:\Windows\System\wuGiJCL.exe
  2⤵
  PID:2028
- C:\Windows\System\jCzxWgX.exe
  C:\Windows\System\jCzxWgX.exe
  2⤵
  PID:2196
- C:\Windows\System\HYrsKgJ.exe
  C:\Windows\System\HYrsKgJ.exe
  2⤵
  PID:4100
- C:\Windows\System\leDdrHT.exe
  C:\Windows\System\leDdrHT.exe
  2⤵
  PID:984
- C:\Windows\System\NXAVQXi.exe
  C:\Windows\System\NXAVQXi.exe
  2⤵
  PID:1896
- C:\Windows\System\qeTaJUO.exe
  C:\Windows\System\qeTaJUO.exe
  2⤵
  PID:4196
- C:\Windows\System\muGOqLO.exe
  C:\Windows\System\muGOqLO.exe
  2⤵
  PID:1288
- C:\Windows\System\SYQWqrV.exe
  C:\Windows\System\SYQWqrV.exe
  2⤵
  PID:4264
- C:\Windows\System\cneXbaP.exe
  C:\Windows\System\cneXbaP.exe
  2⤵
  PID:4332
- C:\Windows\System\TLqdJeQ.exe
  C:\Windows\System\TLqdJeQ.exe
  2⤵
  PID:4396
- C:\Windows\System\gKdJaYd.exe
  C:\Windows\System\gKdJaYd.exe
  2⤵
  PID:4460
- C:\Windows\System\bBYAGFL.exe
  C:\Windows\System\bBYAGFL.exe
  2⤵
  PID:4524
- C:\Windows\System\sUrmhvT.exe
  C:\Windows\System\sUrmhvT.exe
  2⤵
  PID:4588
- C:\Windows\System\GrnyWjA.exe
  C:\Windows\System\GrnyWjA.exe
  2⤵
  PID:4656
- C:\Windows\System\edkSUBR.exe
  C:\Windows\System\edkSUBR.exe
  2⤵
  PID:4692
- C:\Windows\System\KlbzqhW.exe
  C:\Windows\System\KlbzqhW.exe
  2⤵
  PID:4744
- C:\Windows\System\cRUWTNz.exe
  C:\Windows\System\cRUWTNz.exe
  2⤵
  PID:2752
- C:\Windows\System\XxTiTyR.exe
  C:\Windows\System\XxTiTyR.exe
  2⤵
  PID:4764
- C:\Windows\System\ZLthyHo.exe
  C:\Windows\System\ZLthyHo.exe
  2⤵
  PID:4780
- C:\Windows\System\CawmwZx.exe
  C:\Windows\System\CawmwZx.exe
  2⤵
  PID:4796
- C:\Windows\System\OVdMLLw.exe
  C:\Windows\System\OVdMLLw.exe
  2⤵
  PID:4812
- C:\Windows\System\ouSaojb.exe
  C:\Windows\System\ouSaojb.exe
  2⤵
  PID:1604
- C:\Windows\System\NsUkcBh.exe
  C:\Windows\System\NsUkcBh.exe
  2⤵
  PID:1412
- C:\Windows\System\VMZGpRx.exe
  C:\Windows\System\VMZGpRx.exe
  2⤵
  PID:2988
- C:\Windows\System\QngMmSG.exe
  C:\Windows\System\QngMmSG.exe
  2⤵
  PID:1536
- C:\Windows\System\FpoGqMi.exe
  C:\Windows\System\FpoGqMi.exe
  2⤵
  PID:4132
- C:\Windows\System\dzAPOvh.exe
  C:\Windows\System\dzAPOvh.exe
  2⤵
  PID:4232
- C:\Windows\System\VhftOcq.exe
  C:\Windows\System\VhftOcq.exe
  2⤵
  PID:4492
- C:\Windows\System\tmkQrhX.exe
  C:\Windows\System\tmkQrhX.exe
  2⤵
  PID:4732
- C:\Windows\System\plkNWXb.exe
  C:\Windows\System\plkNWXb.exe
  2⤵
  PID:4788
- C:\Windows\System\WvXwHsT.exe
  C:\Windows\System\WvXwHsT.exe
  2⤵
  PID:2136
- C:\Windows\System\JzfvSfK.exe
  C:\Windows\System\JzfvSfK.exe
  2⤵
  PID:1704
- C:\Windows\System\QkdjiCY.exe
  C:\Windows\System\QkdjiCY.exe
  2⤵
  PID:5136
- C:\Windows\System\pbdxNyh.exe
  C:\Windows\System\pbdxNyh.exe
  2⤵
  PID:5152
- C:\Windows\System\iVDukqb.exe
  C:\Windows\System\iVDukqb.exe
  2⤵
  PID:5168
- C:\Windows\System\wtYnvpa.exe
  C:\Windows\System\wtYnvpa.exe
  2⤵
  PID:5184
- C:\Windows\System\mhqGvZJ.exe
  C:\Windows\System\mhqGvZJ.exe
  2⤵
  PID:5200
- C:\Windows\System\cAdrepc.exe
  C:\Windows\System\cAdrepc.exe
  2⤵
  PID:5216
- C:\Windows\System\xsaZDGN.exe
  C:\Windows\System\xsaZDGN.exe
  2⤵
  PID:5240
- C:\Windows\System\CesIBBf.exe
  C:\Windows\System\CesIBBf.exe
  2⤵
  PID:5256
- C:\Windows\System\qHDgswl.exe
  C:\Windows\System\qHDgswl.exe
  2⤵
  PID:5272
- C:\Windows\System\dVLLpUc.exe
  C:\Windows\System\dVLLpUc.exe
  2⤵
  PID:5288
- C:\Windows\System\jcFcopw.exe
  C:\Windows\System\jcFcopw.exe
  2⤵
  PID:5304
- C:\Windows\System\wPanHBD.exe
  C:\Windows\System\wPanHBD.exe
  2⤵
  PID:5320
- C:\Windows\System\BtynXdW.exe
  C:\Windows\System\BtynXdW.exe
  2⤵
  PID:5336
- C:\Windows\System\VNwaWkp.exe
  C:\Windows\System\VNwaWkp.exe
  2⤵
  PID:5504
- C:\Windows\System\RAEKzpM.exe
  C:\Windows\System\RAEKzpM.exe
  2⤵
  PID:5520
- C:\Windows\System\SpVMwIV.exe
  C:\Windows\System\SpVMwIV.exe
  2⤵
  PID:5536
- C:\Windows\System\hMRfCtR.exe
  C:\Windows\System\hMRfCtR.exe
  2⤵
  PID:5552
- C:\Windows\System\VVQbkHO.exe
  C:\Windows\System\VVQbkHO.exe
  2⤵
  PID:5568
- C:\Windows\System\QRWhZKH.exe
  C:\Windows\System\QRWhZKH.exe
  2⤵
  PID:5584
- C:\Windows\System\iAqWytE.exe
  C:\Windows\System\iAqWytE.exe
  2⤵
  PID:5604
- C:\Windows\System\wVGJwjq.exe
  C:\Windows\System\wVGJwjq.exe
  2⤵
  PID:5620
- C:\Windows\System\NledVOL.exe
  C:\Windows\System\NledVOL.exe
  2⤵
  PID:5636
- C:\Windows\System\lbFDaYY.exe
  C:\Windows\System\lbFDaYY.exe
  2⤵
  PID:5652
- C:\Windows\System\NKWLxkI.exe
  C:\Windows\System\NKWLxkI.exe
  2⤵
  PID:5668
- C:\Windows\System\fXOJCYl.exe
  C:\Windows\System\fXOJCYl.exe
  2⤵
  PID:5684
- C:\Windows\System\PlVvAkw.exe
  C:\Windows\System\PlVvAkw.exe
  2⤵
  PID:5700
- C:\Windows\System\bQxfFyp.exe
  C:\Windows\System\bQxfFyp.exe
  2⤵
  PID:5720
- C:\Windows\System\CPVTckO.exe
  C:\Windows\System\CPVTckO.exe
  2⤵
  PID:5736
- C:\Windows\System\EMEpetK.exe
  C:\Windows\System\EMEpetK.exe
  2⤵
  PID:5752
- C:\Windows\System\XNaPUPc.exe
  C:\Windows\System\XNaPUPc.exe
  2⤵
  PID:5768
- C:\Windows\System\knSJVNg.exe
  C:\Windows\System\knSJVNg.exe
  2⤵
  PID:5784
- C:\Windows\System\tohxDKc.exe
  C:\Windows\System\tohxDKc.exe
  2⤵
  PID:5800
- C:\Windows\System\nhMeINE.exe
  C:\Windows\System\nhMeINE.exe
  2⤵
  PID:5820
- C:\Windows\System\FABYxlY.exe
  C:\Windows\System\FABYxlY.exe
  2⤵
  PID:5836
- C:\Windows\System\kqhsjAS.exe
  C:\Windows\System\kqhsjAS.exe
  2⤵
  PID:5852
- C:\Windows\System\MBJjmal.exe
  C:\Windows\System\MBJjmal.exe
  2⤵
  PID:5868
- C:\Windows\System\JMbfuPG.exe
  C:\Windows\System\JMbfuPG.exe
  2⤵
  PID:5956
- C:\Windows\System\sWUofgv.exe
  C:\Windows\System\sWUofgv.exe
  2⤵
  PID:5980
- C:\Windows\System\FrKIyWH.exe
  C:\Windows\System\FrKIyWH.exe
  2⤵
  PID:6000
- C:\Windows\System\NQuqpsT.exe
  C:\Windows\System\NQuqpsT.exe
  2⤵
  PID:6040
- C:\Windows\System\DPcxkKK.exe
  C:\Windows\System\DPcxkKK.exe
  2⤵
  PID:6092
- C:\Windows\System\GEEkKzR.exe
  C:\Windows\System\GEEkKzR.exe
  2⤵
  PID:6124
- C:\Windows\System\MuSGGOz.exe
  C:\Windows\System\MuSGGOz.exe
  2⤵
  PID:2776
- C:\Windows\System\FTTkmkt.exe
  C:\Windows\System\FTTkmkt.exe
  2⤵
  PID:3144
- C:\Windows\System\AiCdAVy.exe
  C:\Windows\System\AiCdAVy.exe
  2⤵
  PID:3268
- C:\Windows\System\lgXXCIr.exe
  C:\Windows\System\lgXXCIr.exe
  2⤵
  PID:3368
- C:\Windows\System\zgteExu.exe
  C:\Windows\System\zgteExu.exe
  2⤵
  PID:2696
- C:\Windows\System\LNVgPnE.exe
  C:\Windows\System\LNVgPnE.exe
  2⤵
  PID:4364
- C:\Windows\System\iDnsIwL.exe
  C:\Windows\System\iDnsIwL.exe
  2⤵
  PID:5252
- C:\Windows\System\AbIMnPY.exe
  C:\Windows\System\AbIMnPY.exe
  2⤵
  PID:5352
- C:\Windows\System\wNdkfXV.exe
  C:\Windows\System\wNdkfXV.exe
  2⤵
  PID:5404
- C:\Windows\System\YwOXRMk.exe
  C:\Windows\System\YwOXRMk.exe
  2⤵
  PID:5464
- C:\Windows\System\uLMvnRG.exe
  C:\Windows\System\uLMvnRG.exe
  2⤵
  PID:5492
- C:\Windows\System\BDyxvxp.exe
  C:\Windows\System\BDyxvxp.exe
  2⤵
  PID:3560
- C:\Windows\System\wxphWbR.exe
  C:\Windows\System\wxphWbR.exe
  2⤵
  PID:5760
- C:\Windows\System\KTUJsmn.exe
  C:\Windows\System\KTUJsmn.exe
  2⤵
  PID:3988
- C:\Windows\System\NsajzsB.exe
  C:\Windows\System\NsajzsB.exe
  2⤵
  PID:4444
- C:\Windows\System\LoSxpDO.exe
  C:\Windows\System\LoSxpDO.exe
  2⤵
  PID:1564
- C:\Windows\System\pOVDtMP.exe
  C:\Windows\System\pOVDtMP.exe
  2⤵
  PID:2096
- C:\Windows\System\ZWcCaJl.exe
  C:\Windows\System\ZWcCaJl.exe
  2⤵
  PID:676
- C:\Windows\System\xCvZtxh.exe
  C:\Windows\System\xCvZtxh.exe
  2⤵
  PID:3780
- C:\Windows\System\elAssMg.exe
  C:\Windows\System\elAssMg.exe
  2⤵
  PID:3844
- C:\Windows\System\HUbroUm.exe
  C:\Windows\System\HUbroUm.exe
  2⤵
  PID:3908
- C:\Windows\System\OOvZmAA.exe
  C:\Windows\System\OOvZmAA.exe
  2⤵
  PID:3972
- C:\Windows\System\dMeqYfN.exe
  C:\Windows\System\dMeqYfN.exe
  2⤵
  PID:4036
- C:\Windows\System\rETNwHQ.exe
  C:\Windows\System\rETNwHQ.exe
  2⤵
  PID:3224
- C:\Windows\System\tcyRHve.exe
  C:\Windows\System\tcyRHve.exe
  2⤵
  PID:2460
- C:\Windows\System\EMuEwRe.exe
  C:\Windows\System\EMuEwRe.exe
  2⤵
  PID:3636
- C:\Windows\System\rfyLzbs.exe
  C:\Windows\System\rfyLzbs.exe
  2⤵
  PID:6024
- C:\Windows\System\MtMVXvp.exe
  C:\Windows\System\MtMVXvp.exe
  2⤵
  PID:2756
- C:\Windows\System\ibEDWzq.exe
  C:\Windows\System\ibEDWzq.exe
  2⤵
  PID:3672
- C:\Windows\System\bSLUOYQ.exe
  C:\Windows\System\bSLUOYQ.exe
  2⤵
  PID:4112
- C:\Windows\System\ZKVBipx.exe
  C:\Windows\System\ZKVBipx.exe
  2⤵
  PID:4176
- C:\Windows\System\RkTVjTQ.exe
  C:\Windows\System\RkTVjTQ.exe
  2⤵
  PID:4248
- C:\Windows\System\mTpLgjK.exe
  C:\Windows\System\mTpLgjK.exe
  2⤵
  PID:4344
- C:\Windows\System\VzDzOrI.exe
  C:\Windows\System\VzDzOrI.exe
  2⤵
  PID:4408
- C:\Windows\System\kBQPSCt.exe
  C:\Windows\System\kBQPSCt.exe
  2⤵
  PID:4476
- C:\Windows\System\cCYFTKW.exe
  C:\Windows\System\cCYFTKW.exe
  2⤵
  PID:4568
- C:\Windows\System\ujKRvGb.exe
  C:\Windows\System\ujKRvGb.exe
  2⤵
  PID:4632
- C:\Windows\System\NoQKiKD.exe
  C:\Windows\System\NoQKiKD.exe
  2⤵
  PID:4708
- C:\Windows\System\hHCNGTs.exe
  C:\Windows\System\hHCNGTs.exe
  2⤵
  PID:4824
- C:\Windows\System\eqoHYtJ.exe
  C:\Windows\System\eqoHYtJ.exe
  2⤵
  PID:4840
- C:\Windows\System\sTYXEcO.exe
  C:\Windows\System\sTYXEcO.exe
  2⤵
  PID:4856
- C:\Windows\System\BCMJcBZ.exe
  C:\Windows\System\BCMJcBZ.exe
  2⤵
  PID:4872
- C:\Windows\System\FsWzGPq.exe
  C:\Windows\System\FsWzGPq.exe
  2⤵
  PID:4888
- C:\Windows\System\LJUAvfs.exe
  C:\Windows\System\LJUAvfs.exe
  2⤵
  PID:4904
- C:\Windows\System\SmAwUus.exe
  C:\Windows\System\SmAwUus.exe
  2⤵
  PID:4920
- C:\Windows\System\XiPBKKZ.exe
  C:\Windows\System\XiPBKKZ.exe
  2⤵
  PID:4936
- C:\Windows\System\cnVarad.exe
  C:\Windows\System\cnVarad.exe
  2⤵
  PID:4952
- C:\Windows\System\DpthEFe.exe
  C:\Windows\System\DpthEFe.exe
  2⤵
  PID:4968
- C:\Windows\System\ydxjAvb.exe
  C:\Windows\System\ydxjAvb.exe
  2⤵
  PID:4984
- C:\Windows\System\BONtTMM.exe
  C:\Windows\System\BONtTMM.exe
  2⤵
  PID:5000
- C:\Windows\System\kTLrkiZ.exe
  C:\Windows\System\kTLrkiZ.exe
  2⤵
  PID:5016
- C:\Windows\System\xtadaVv.exe
  C:\Windows\System\xtadaVv.exe
  2⤵
  PID:5032
- C:\Windows\System\cMXefhg.exe
  C:\Windows\System\cMXefhg.exe
  2⤵
  PID:5048
- C:\Windows\System\lhEhEDK.exe
  C:\Windows\System\lhEhEDK.exe
  2⤵
  PID:5064
- C:\Windows\System\KmcKhBn.exe
  C:\Windows\System\KmcKhBn.exe
  2⤵
  PID:5084
- C:\Windows\System\CfvxgFH.exe
  C:\Windows\System\CfvxgFH.exe
  2⤵
  PID:5100
- C:\Windows\System\UyHiYkU.exe
  C:\Windows\System\UyHiYkU.exe
  2⤵
  PID:2632
- C:\Windows\System\QzoXQXF.exe
  C:\Windows\System\QzoXQXF.exe
  2⤵
  PID:1920
- C:\Windows\System\cCRgZLH.exe
  C:\Windows\System\cCRgZLH.exe
  2⤵
  PID:1464
- C:\Windows\System\eVmmrtf.exe
  C:\Windows\System\eVmmrtf.exe
  2⤵
  PID:4328
- C:\Windows\System\wkUqJes.exe
  C:\Windows\System\wkUqJes.exe
  2⤵
  PID:4584
- C:\Windows\System\HIDJsEy.exe
  C:\Windows\System\HIDJsEy.exe
  2⤵
  PID:4756
- C:\Windows\System\vGmdesY.exe
  C:\Windows\System\vGmdesY.exe
  2⤵
  PID:4808
- C:\Windows\System\TUhViAz.exe
  C:\Windows\System\TUhViAz.exe
  2⤵
  PID:2640
- C:\Windows\System\efNuuoO.exe
  C:\Windows\System\efNuuoO.exe
  2⤵
  PID:4648
- C:\Windows\System\buDBzZd.exe
  C:\Windows\System\buDBzZd.exe
  2⤵
  PID:5132
- C:\Windows\System\LyfrrGq.exe
  C:\Windows\System\LyfrrGq.exe
  2⤵
  PID:5196
- C:\Windows\System\YlgBEfO.exe
  C:\Windows\System\YlgBEfO.exe
  2⤵
  PID:5264
- C:\Windows\System\NObziuq.exe
  C:\Windows\System\NObziuq.exe
  2⤵
  PID:5328
- C:\Windows\System\BPTfYov.exe
  C:\Windows\System\BPTfYov.exe
  2⤵
  PID:5544
- C:\Windows\System\pZWnvod.exe
  C:\Windows\System\pZWnvod.exe
  2⤵
  PID:5612
- C:\Windows\System\DHkGLkY.exe
  C:\Windows\System\DHkGLkY.exe
  2⤵
  PID:6068
- C:\Windows\System\lAgZEDL.exe
  C:\Windows\System\lAgZEDL.exe
  2⤵
  PID:6052
- C:\Windows\System\LJhQoUP.exe
  C:\Windows\System\LJhQoUP.exe
  2⤵
  PID:3112
- C:\Windows\System\BTicMPy.exe
  C:\Windows\System\BTicMPy.exe
  2⤵
  PID:3300
- C:\Windows\System\VselMAu.exe
  C:\Windows\System\VselMAu.exe
  2⤵
  PID:4128
- C:\Windows\System\bujSrER.exe
  C:\Windows\System\bujSrER.exe
  2⤵
  PID:2628
- C:\Windows\System\BLnebei.exe
  C:\Windows\System\BLnebei.exe
  2⤵
  PID:624
- C:\Windows\System\BsuuVXL.exe
  C:\Windows\System\BsuuVXL.exe
  2⤵
  PID:5448
- C:\Windows\System\XdUDrty.exe
  C:\Windows\System\XdUDrty.exe
  2⤵
  PID:5460
- C:\Windows\System\LSNIZZB.exe
  C:\Windows\System\LSNIZZB.exe
  2⤵
  PID:5488
- C:\Windows\System\ReXscgn.exe
  C:\Windows\System\ReXscgn.exe
  2⤵
  PID:5360
- C:\Windows\System\gQNAfGA.exe
  C:\Windows\System\gQNAfGA.exe
  2⤵
  PID:2572
- C:\Windows\System\UZUkAOE.exe
  C:\Windows\System\UZUkAOE.exe
  2⤵
  PID:1628
- C:\Windows\System\bKtaHUs.exe
  C:\Windows\System\bKtaHUs.exe
  2⤵
  PID:5420
- C:\Windows\System\VGZunwW.exe
  C:\Windows\System\VGZunwW.exe
  2⤵
  PID:5432
- C:\Windows\System\ufYTPKk.exe
  C:\Windows\System\ufYTPKk.exe
  2⤵
  PID:5444
- C:\Windows\System\nKIAvjD.exe
  C:\Windows\System\nKIAvjD.exe
  2⤵
  PID:3492
- C:\Windows\System\eUtXaxm.exe
  C:\Windows\System\eUtXaxm.exe
  2⤵
  PID:5452
- C:\Windows\System\EHClqaM.exe
  C:\Windows\System\EHClqaM.exe
  2⤵
  PID:5484
- C:\Windows\System\DGeLvAz.exe
  C:\Windows\System\DGeLvAz.exe
  2⤵
  PID:2060
- C:\Windows\System\gKNYmPR.exe
  C:\Windows\System\gKNYmPR.exe
  2⤵
  PID:5600
- C:\Windows\System\PKZNHii.exe
  C:\Windows\System\PKZNHii.exe
  2⤵
  PID:5664
- C:\Windows\System\ZfiOzWt.exe
  C:\Windows\System\ZfiOzWt.exe
  2⤵
  PID:5860
- C:\Windows\System\ZaYbOYN.exe
  C:\Windows\System\ZaYbOYN.exe
  2⤵
  PID:5728
- C:\Windows\System\LMWVOhw.exe
  C:\Windows\System\LMWVOhw.exe
  2⤵
  PID:5828
- C:\Windows\System\znMgZxq.exe
  C:\Windows\System\znMgZxq.exe
  2⤵
  PID:5732
- C:\Windows\System\FzOsyGJ.exe
  C:\Windows\System\FzOsyGJ.exe
  2⤵
  PID:2700
- C:\Windows\System\dcObVwR.exe
  C:\Windows\System\dcObVwR.exe
  2⤵
  PID:2832
- C:\Windows\System\fCqOmmC.exe
  C:\Windows\System\fCqOmmC.exe
  2⤵
  PID:2084
- C:\Windows\System\jlQkmUI.exe
  C:\Windows\System\jlQkmUI.exe
  2⤵
  PID:3060
- C:\Windows\System\fhhfvjj.exe
  C:\Windows\System\fhhfvjj.exe
  2⤵
  PID:5964
- C:\Windows\System\WzYZIzS.exe
  C:\Windows\System\WzYZIzS.exe
  2⤵
  PID:2612
- C:\Windows\System\ohUhIiJ.exe
  C:\Windows\System\ohUhIiJ.exe
  2⤵
  PID:2384
- C:\Windows\System\fLRsfVr.exe
  C:\Windows\System\fLRsfVr.exe
  2⤵
  PID:1588
- C:\Windows\System\DrjZEeF.exe
  C:\Windows\System\DrjZEeF.exe
  2⤵
  PID:1168
- C:\Windows\System\gAWnAaE.exe
  C:\Windows\System\gAWnAaE.exe
  2⤵
  PID:2980
- C:\Windows\System\xzQwSRR.exe
  C:\Windows\System\xzQwSRR.exe
  2⤵
  PID:2424
- C:\Windows\System\ctdCoNP.exe
  C:\Windows\System\ctdCoNP.exe
  2⤵
  PID:824
- C:\Windows\System\jXXeHgX.exe
  C:\Windows\System\jXXeHgX.exe
  2⤵
  PID:1512
- C:\Windows\System\FTxTHzZ.exe
  C:\Windows\System\FTxTHzZ.exe
  2⤵
  PID:2276
- C:\Windows\System\wjsLVlt.exe
  C:\Windows\System\wjsLVlt.exe
  2⤵
  PID:2764
- C:\Windows\System\fsxmrYe.exe
  C:\Windows\System\fsxmrYe.exe
  2⤵
  PID:2052
- C:\Windows\System\XYmjkyh.exe
  C:\Windows\System\XYmjkyh.exe
  2⤵
  PID:800
- C:\Windows\System\qIlMmCI.exe
  C:\Windows\System\qIlMmCI.exe
  2⤵
  PID:1568
- C:\Windows\System\fwvvDck.exe
  C:\Windows\System\fwvvDck.exe
  2⤵
  PID:3688
- C:\Windows\System\VtMXHuI.exe
  C:\Windows\System\VtMXHuI.exe
  2⤵
  PID:3752
- C:\Windows\System\EoqMAHp.exe
  C:\Windows\System\EoqMAHp.exe
  2⤵
  PID:4008
- C:\Windows\System\dDQeQvG.exe
  C:\Windows\System\dDQeQvG.exe
  2⤵
  PID:4084
- C:\Windows\System\lgrxfNr.exe
  C:\Windows\System\lgrxfNr.exe
  2⤵
  PID:4244
- C:\Windows\System\mPfbVjH.exe
  C:\Windows\System\mPfbVjH.exe
  2⤵
  PID:4832
- C:\Windows\System\IyRnzGR.exe
  C:\Windows\System\IyRnzGR.exe
  2⤵
  PID:3448
- C:\Windows\System\dCyzzXZ.exe
  C:\Windows\System\dCyzzXZ.exe
  2⤵
  PID:4148
- C:\Windows\System\sMCttTr.exe
  C:\Windows\System\sMCttTr.exe
  2⤵
  PID:4472
- C:\Windows\System\AtSdFPQ.exe
  C:\Windows\System\AtSdFPQ.exe
  2⤵
  PID:4160
- C:\Windows\System\DfPXHou.exe
  C:\Windows\System\DfPXHou.exe
  2⤵
  PID:5080
- C:\Windows\System\jdGgLIR.exe
  C:\Windows\System\jdGgLIR.exe
  2⤵
  PID:5012
- C:\Windows\System\xtWdKwH.exe
  C:\Windows\System\xtWdKwH.exe
  2⤵
  PID:4948
- C:\Windows\System\BTgNbZO.exe
  C:\Windows\System\BTgNbZO.exe
  2⤵
  PID:4880
- C:\Windows\System\qUsiLru.exe
  C:\Windows\System\qUsiLru.exe
  2⤵
  PID:1768
- C:\Windows\System\zjEDGbv.exe
  C:\Windows\System\zjEDGbv.exe
  2⤵
  PID:4600
- C:\Windows\System\nhbbEkj.exe
  C:\Windows\System\nhbbEkj.exe
  2⤵
  PID:3220
- C:\Windows\System\akOtVKR.exe
  C:\Windows\System\akOtVKR.exe
  2⤵
  PID:4932
- C:\Windows\System\KitFuNA.exe
  C:\Windows\System\KitFuNA.exe
  2⤵
  PID:4964
- C:\Windows\System\JKvDBCH.exe
  C:\Windows\System\JKvDBCH.exe
  2⤵
  PID:5028
- C:\Windows\System\gMMlLlp.exe
  C:\Windows\System\gMMlLlp.exe
  2⤵
  PID:5096
- C:\Windows\System\lpeAGeq.exe
  C:\Windows\System\lpeAGeq.exe
  2⤵
  PID:5648
- C:\Windows\System\WzMGZmh.exe
  C:\Windows\System\WzMGZmh.exe
  2⤵
  PID:5712
- C:\Windows\System\FQOoQAy.exe
  C:\Windows\System\FQOoQAy.exe
  2⤵
  PID:5776
- C:\Windows\System\hFYxeRe.exe
  C:\Windows\System\hFYxeRe.exe
  2⤵
  PID:5816
- C:\Windows\System\vzmgCKn.exe
  C:\Windows\System\vzmgCKn.exe
  2⤵
  PID:1232
- C:\Windows\System\qddnyCm.exe
  C:\Windows\System\qddnyCm.exe
  2⤵
  PID:1584
- C:\Windows\System\OUbCddA.exe
  C:\Windows\System\OUbCddA.exe
  2⤵
  PID:1724
- C:\Windows\System\JfYAZzP.exe
  C:\Windows\System\JfYAZzP.exe
  2⤵
  PID:5896
- C:\Windows\System\LbZdslt.exe
  C:\Windows\System\LbZdslt.exe
  2⤵
  PID:5912
- C:\Windows\System\aybWgRD.exe
  C:\Windows\System\aybWgRD.exe
  2⤵
  PID:5928
- C:\Windows\System\JoDuBCd.exe
  C:\Windows\System\JoDuBCd.exe
  2⤵
  PID:5944
- C:\Windows\System\CkCFtHn.exe
  C:\Windows\System\CkCFtHn.exe
  2⤵
  PID:1700
- C:\Windows\System\MyPeAnB.exe
  C:\Windows\System\MyPeAnB.exe
  2⤵
  PID:6100
- C:\Windows\System\uUPufgO.exe
  C:\Windows\System\uUPufgO.exe
  2⤵
  PID:4228
- C:\Windows\System\LiEUpXz.exe
  C:\Windows\System\LiEUpXz.exe
  2⤵
  PID:5228
- C:\Windows\System\dagxvrL.exe
  C:\Windows\System\dagxvrL.exe
  2⤵
  PID:5992
- C:\Windows\System\IHPLlmQ.exe
  C:\Windows\System\IHPLlmQ.exe
  2⤵
  PID:6108
- C:\Windows\System\LNUbLix.exe
  C:\Windows\System\LNUbLix.exe
  2⤵
  PID:6120
- C:\Windows\System\JKwuMiU.exe
  C:\Windows\System\JKwuMiU.exe
  2⤵
  PID:5192
- C:\Windows\System\NGrffdg.exe
  C:\Windows\System\NGrffdg.exe
  2⤵
  PID:1248
- C:\Windows\System\JdOoCmV.exe
  C:\Windows\System\JdOoCmV.exe
  2⤵
  PID:6136
- C:\Windows\System\WHbHwLI.exe
  C:\Windows\System\WHbHwLI.exe
  2⤵
  PID:5148
- C:\Windows\System\RUYxshU.exe
  C:\Windows\System\RUYxshU.exe
  2⤵
  PID:5368
- C:\Windows\System\nGccgjC.exe
  C:\Windows\System\nGccgjC.exe
  2⤵
  PID:2896
- C:\Windows\System\ddCElmr.exe
  C:\Windows\System\ddCElmr.exe
  2⤵
  PID:5696
- C:\Windows\System\CvauZso.exe
  C:\Windows\System\CvauZso.exe
  2⤵
  PID:5560
- C:\Windows\System\ZsSwAJf.exe
  C:\Windows\System\ZsSwAJf.exe
  2⤵
  PID:3428
- C:\Windows\System\ySlmHoR.exe
  C:\Windows\System\ySlmHoR.exe
  2⤵
  PID:908
- C:\Windows\System\JSgczct.exe
  C:\Windows\System\JSgczct.exe
  2⤵
  PID:1952
- C:\Windows\System\bjeWosE.exe
  C:\Windows\System\bjeWosE.exe
  2⤵
  PID:6048
- C:\Windows\System\wiglZQs.exe
  C:\Windows\System\wiglZQs.exe
  2⤵
  PID:5596
- C:\Windows\System\Ytrmgiz.exe
  C:\Windows\System\Ytrmgiz.exe
  2⤵
  PID:3860
- C:\Windows\System\TpgXjOV.exe
  C:\Windows\System\TpgXjOV.exe
  2⤵
  PID:6084
- C:\Windows\System\mIktrZF.exe
  C:\Windows\System\mIktrZF.exe
  2⤵
  PID:1544
- C:\Windows\System\SKYjnBH.exe
  C:\Windows\System\SKYjnBH.exe
  2⤵
  PID:3364
- C:\Windows\System\sSIBwBN.exe
  C:\Windows\System\sSIBwBN.exe
  2⤵
  PID:2212
- C:\Windows\System\ZLSsyKh.exe
  C:\Windows\System\ZLSsyKh.exe
  2⤵
  PID:5344
- C:\Windows\System\uerZxuG.exe
  C:\Windows\System\uerZxuG.exe
  2⤵
  PID:3460
- C:\Windows\System\aHruQxP.exe
  C:\Windows\System\aHruQxP.exe
  2⤵
  PID:5476
- C:\Windows\System\beRmhVx.exe
  C:\Windows\System\beRmhVx.exe
  2⤵
  PID:3004
- C:\Windows\System\WYAULEC.exe
  C:\Windows\System\WYAULEC.exe
  2⤵
  PID:1996
- C:\Windows\System\umoxjeN.exe
  C:\Windows\System\umoxjeN.exe
  2⤵
  PID:872
- C:\Windows\System\KvWsEeJ.exe
  C:\Windows\System\KvWsEeJ.exe
  2⤵
  PID:804
- C:\Windows\System\CLteiVV.exe
  C:\Windows\System\CLteiVV.exe
  2⤵
  PID:2440
- C:\Windows\System\tSPBmKO.exe
  C:\Windows\System\tSPBmKO.exe
  2⤵
  PID:2848
- C:\Windows\System\kZoRpLt.exe
  C:\Windows\System\kZoRpLt.exe
  2⤵
  PID:4068
- C:\Windows\System\owazdWp.exe
  C:\Windows\System\owazdWp.exe
  2⤵
  PID:4020
- C:\Windows\System\erzgyRo.exe
  C:\Windows\System\erzgyRo.exe
  2⤵
  PID:3748
- C:\Windows\System\iujXDyv.exe
  C:\Windows\System\iujXDyv.exe
  2⤵
  PID:3608
- C:\Windows\System\rAmDNWc.exe
  C:\Windows\System\rAmDNWc.exe
  2⤵
  PID:4144
- C:\Windows\System\cnqtVGo.exe
  C:\Windows\System\cnqtVGo.exe
  2⤵
  PID:4676
- C:\Windows\System\WqyhZAd.exe
  C:\Windows\System\WqyhZAd.exe
  2⤵
  PID:4440
- C:\Windows\System\bZqMnuq.exe
  C:\Windows\System\bZqMnuq.exe
  2⤵
  PID:5108
- C:\Windows\System\kLePnjj.exe
  C:\Windows\System\kLePnjj.exe
  2⤵
  PID:4916
- C:\Windows\System\rMahuGx.exe
  C:\Windows\System\rMahuGx.exe
  2⤵
  PID:4852
- C:\Windows\System\OravjUb.exe
  C:\Windows\System\OravjUb.exe
  2⤵
  PID:5092
- C:\Windows\System\TsKunas.exe
  C:\Windows\System\TsKunas.exe
  2⤵
  PID:4912
- C:\Windows\System\gZTAVnF.exe
  C:\Windows\System\gZTAVnF.exe
  2⤵
  PID:3416
- C:\Windows\System\ieAqpkp.exe
  C:\Windows\System\ieAqpkp.exe
  2⤵
  PID:2024
- C:\Windows\System\mBuWvCE.exe
  C:\Windows\System\mBuWvCE.exe
  2⤵
  PID:5708
- C:\Windows\System\EROjXmE.exe
  C:\Windows\System\EROjXmE.exe
  2⤵
  PID:5812
- C:\Windows\System\BfRerex.exe
  C:\Windows\System\BfRerex.exe
  2⤵
  PID:5920
- C:\Windows\System\AHVDIuc.exe
  C:\Windows\System\AHVDIuc.exe
  2⤵
  PID:5164
- C:\Windows\System\EzGoXGn.exe
  C:\Windows\System\EzGoXGn.exe
  2⤵
  PID:5904
- C:\Windows\System\GnHDDRz.exe
  C:\Windows\System\GnHDDRz.exe
  2⤵
  PID:5236
- C:\Windows\System\FHxZNqB.exe
  C:\Windows\System\FHxZNqB.exe
  2⤵
  PID:2148
- C:\Windows\System\bLWzghL.exe
  C:\Windows\System\bLWzghL.exe
  2⤵
  PID:4620
- C:\Windows\System\hxTSPQR.exe
  C:\Windows\System\hxTSPQR.exe
  2⤵
  PID:5284
- C:\Windows\System\arSmTdh.exe
  C:\Windows\System\arSmTdh.exe
  2⤵
  PID:5300
- C:\Windows\System\uVGRipM.exe
  C:\Windows\System\uVGRipM.exe
  2⤵
  PID:2496
- C:\Windows\System\PEpjAjo.exe
  C:\Windows\System\PEpjAjo.exe
  2⤵
  PID:528
- C:\Windows\System\CDICMNW.exe
  C:\Windows\System\CDICMNW.exe
  2⤵
  PID:3024
- C:\Windows\System\VPXUYZx.exe
  C:\Windows\System\VPXUYZx.exe
  2⤵
  PID:5248
- C:\Windows\System\TWDpSMf.exe
  C:\Windows\System\TWDpSMf.exe
  2⤵
  PID:5416
- C:\Windows\System\ctzPTqi.exe
  C:\Windows\System\ctzPTqi.exe
  2⤵
  PID:1028
- C:\Windows\System\BzVCBEe.exe
  C:\Windows\System\BzVCBEe.exe
  2⤵
  PID:5316
- C:\Windows\System\BzCKQLZ.exe
  C:\Windows\System\BzCKQLZ.exe
  2⤵
  PID:4760
- C:\Windows\System\hrUkETX.exe
  C:\Windows\System\hrUkETX.exe
  2⤵
  PID:1944
- C:\Windows\System\ARkZWNI.exe
  C:\Windows\System\ARkZWNI.exe
  2⤵
  PID:2556
- C:\Windows\System\BvnxiaV.exe
  C:\Windows\System\BvnxiaV.exe
  2⤵
  PID:6008
- C:\Windows\System\xCxGpGe.exe
  C:\Windows\System\xCxGpGe.exe
  2⤵
  PID:4540
- C:\Windows\System\TnmmOzy.exe
  C:\Windows\System\TnmmOzy.exe
  2⤵
  PID:4456
- C:\Windows\System\tEKXEbq.exe
  C:\Windows\System\tEKXEbq.exe
  2⤵
  PID:4996
- C:\Windows\System\hunzzMm.exe
  C:\Windows\System\hunzzMm.exe
  2⤵
  PID:1460
- C:\Windows\System\eTYoQgU.exe
  C:\Windows\System\eTYoQgU.exe
  2⤵
  PID:4216
- C:\Windows\System\dUguSEk.exe
  C:\Windows\System\dUguSEk.exe
  2⤵
  PID:1676
- C:\Windows\System\dvlsMXt.exe
  C:\Windows\System\dvlsMXt.exe
  2⤵
  PID:4864
- C:\Windows\System\llmJDFF.exe
  C:\Windows\System\llmJDFF.exe
  2⤵
  PID:5888
- C:\Windows\System\CZzrqLh.exe
  C:\Windows\System\CZzrqLh.exe
  2⤵
  PID:5040
- C:\Windows\System\KDLAevn.exe
  C:\Windows\System\KDLAevn.exe
  2⤵
  PID:5296
- C:\Windows\System\SSFVYtN.exe
  C:\Windows\System\SSFVYtN.exe
  2⤵
  PID:1228
- C:\Windows\System\FqpgjDb.exe
  C:\Windows\System\FqpgjDb.exe
  2⤵
  PID:6032
- C:\Windows\System\rooFypR.exe
  C:\Windows\System\rooFypR.exe
  2⤵
  PID:6056
- C:\Windows\System\RvuwygG.exe
  C:\Windows\System\RvuwygG.exe
  2⤵
  PID:6104
- C:\Windows\System\REoyjWM.exe
  C:\Windows\System\REoyjWM.exe
  2⤵
  PID:2356
- C:\Windows\System\bjZaVLO.exe
  C:\Windows\System\bjZaVLO.exe
  2⤵
  PID:5212
- C:\Windows\System\FIPZGeM.exe
  C:\Windows\System\FIPZGeM.exe
  2⤵
  PID:5632
- C:\Windows\System\FdVWTNP.exe
  C:\Windows\System\FdVWTNP.exe
  2⤵
  PID:2580
- C:\Windows\System\KixtNYD.exe
  C:\Windows\System\KixtNYD.exe
  2⤵
  PID:3864
- C:\Windows\System\WsRWEWQ.exe
  C:\Windows\System\WsRWEWQ.exe
  2⤵
  PID:3816
- C:\Windows\System\mZFjCMO.exe
  C:\Windows\System\mZFjCMO.exe
  2⤵
  PID:4300
- C:\Windows\System\GChbqHu.exe
  C:\Windows\System\GChbqHu.exe
  2⤵
  PID:4900
- C:\Windows\System\HutBEMp.exe
  C:\Windows\System\HutBEMp.exe
  2⤵
  PID:4316
- C:\Windows\System\RvjAiQy.exe
  C:\Windows\System\RvjAiQy.exe
  2⤵
  PID:4536
- C:\Windows\System\keikGwP.exe
  C:\Windows\System\keikGwP.exe
  2⤵
  PID:3092
- C:\Windows\System\lLwpRTZ.exe
  C:\Windows\System\lLwpRTZ.exe
  2⤵
  PID:892
- C:\Windows\System\MrSWbVj.exe
  C:\Windows\System\MrSWbVj.exe
  2⤵
  PID:2736
- C:\Windows\System\kKEZjoJ.exe
  C:\Windows\System\kKEZjoJ.exe
  2⤵
  PID:5936
- C:\Windows\System\KybcyDI.exe
  C:\Windows\System\KybcyDI.exe
  2⤵
  PID:5848
- C:\Windows\System\iXBgdWP.exe
  C:\Windows\System\iXBgdWP.exe
  2⤵
  PID:4004
- C:\Windows\System\AFFdgvO.exe
  C:\Windows\System\AFFdgvO.exe
  2⤵
  PID:5044
- C:\Windows\System\RrhBiIG.exe
  C:\Windows\System\RrhBiIG.exe
  2⤵
  PID:576
- C:\Windows\System\gjNpAUI.exe
  C:\Windows\System\gjNpAUI.exe
  2⤵
  PID:5384
- C:\Windows\System\HRJdVQK.exe
  C:\Windows\System\HRJdVQK.exe
  2⤵
  PID:304
- C:\Windows\System\NOxmUwE.exe
  C:\Windows\System\NOxmUwE.exe
  2⤵
  PID:3204
- C:\Windows\System\pkwhgyn.exe
  C:\Windows\System\pkwhgyn.exe
  2⤵
  PID:6152
- C:\Windows\System\KhDsgrM.exe
  C:\Windows\System\KhDsgrM.exe
  2⤵
  PID:6172
- C:\Windows\System\ctxBayB.exe
  C:\Windows\System\ctxBayB.exe
  2⤵
  PID:6188
- C:\Windows\System\jSkePlN.exe
  C:\Windows\System\jSkePlN.exe
  2⤵
  PID:6204
- C:\Windows\System\pIVsIzg.exe
  C:\Windows\System\pIVsIzg.exe
  2⤵
  PID:6220
- C:\Windows\System\nmSWoLu.exe
  C:\Windows\System\nmSWoLu.exe
  2⤵
  PID:6236
- C:\Windows\System\HjfrVdf.exe
  C:\Windows\System\HjfrVdf.exe
  2⤵
  PID:6252
- C:\Windows\System\WHXUcdA.exe
  C:\Windows\System\WHXUcdA.exe
  2⤵
  PID:6268
- C:\Windows\System\OxnWrCQ.exe
  C:\Windows\System\OxnWrCQ.exe
  2⤵
  PID:6284
- C:\Windows\System\uuXezdJ.exe
  C:\Windows\System\uuXezdJ.exe
  2⤵
  PID:6300
- C:\Windows\System\meMpduc.exe
  C:\Windows\System\meMpduc.exe
  2⤵
  PID:6316
- C:\Windows\System\njFQGQs.exe
  C:\Windows\System\njFQGQs.exe
  2⤵
  PID:6332
- C:\Windows\System\BMTdcOf.exe
  C:\Windows\System\BMTdcOf.exe
  2⤵
  PID:6348
- C:\Windows\System\tfYoMXE.exe
  C:\Windows\System\tfYoMXE.exe
  2⤵
  PID:6364
- C:\Windows\System\MQTFiHF.exe
  C:\Windows\System\MQTFiHF.exe
  2⤵
  PID:6380
- C:\Windows\System\YzNcduq.exe
  C:\Windows\System\YzNcduq.exe
  2⤵
  PID:6396
- C:\Windows\System\KxPwywU.exe
  C:\Windows\System\KxPwywU.exe
  2⤵
  PID:6412
- C:\Windows\System\GfzJKXl.exe
  C:\Windows\System\GfzJKXl.exe
  2⤵
  PID:6428
- C:\Windows\System\ryObdoC.exe
  C:\Windows\System\ryObdoC.exe
  2⤵
  PID:6444
- C:\Windows\System\cPIUFcj.exe
  C:\Windows\System\cPIUFcj.exe
  2⤵
  PID:6460
- C:\Windows\System\BNioLaa.exe
  C:\Windows\System\BNioLaa.exe
  2⤵
  PID:6476
- C:\Windows\System\qgtNrkD.exe
  C:\Windows\System\qgtNrkD.exe
  2⤵
  PID:6492
- C:\Windows\System\HVBlzsK.exe
  C:\Windows\System\HVBlzsK.exe
  2⤵
  PID:6508
- C:\Windows\System\lwvradA.exe
  C:\Windows\System\lwvradA.exe
  2⤵
  PID:6524
- C:\Windows\System\TJcUvEP.exe
  C:\Windows\System\TJcUvEP.exe
  2⤵
  PID:6540
- C:\Windows\System\dnfrlZI.exe
  C:\Windows\System\dnfrlZI.exe
  2⤵
  PID:6556
- C:\Windows\System\TwlBlDN.exe
  C:\Windows\System\TwlBlDN.exe
  2⤵
  PID:6572
- C:\Windows\System\eElbAtN.exe
  C:\Windows\System\eElbAtN.exe
  2⤵
  PID:6588
- C:\Windows\System\DmJIqpj.exe
  C:\Windows\System\DmJIqpj.exe
  2⤵
  PID:6604
- C:\Windows\System\MsFkwza.exe
  C:\Windows\System\MsFkwza.exe
  2⤵
  PID:6620
- C:\Windows\System\LMNyPdW.exe
  C:\Windows\System\LMNyPdW.exe
  2⤵
  PID:6636
- C:\Windows\System\XUjXtDk.exe
  C:\Windows\System\XUjXtDk.exe
  2⤵
  PID:6652
- C:\Windows\System\iibEEhD.exe
  C:\Windows\System\iibEEhD.exe
  2⤵
  PID:6672
- C:\Windows\System\YIfEjQp.exe
  C:\Windows\System\YIfEjQp.exe
  2⤵
  PID:6688
- C:\Windows\System\CCAozxA.exe
  C:\Windows\System\CCAozxA.exe
  2⤵
  PID:6704
- C:\Windows\System\FRPjObK.exe
  C:\Windows\System\FRPjObK.exe
  2⤵
  PID:6720
- C:\Windows\System\VGmCuCt.exe
  C:\Windows\System\VGmCuCt.exe
  2⤵
  PID:6736
- C:\Windows\System\BCnsebo.exe
  C:\Windows\System\BCnsebo.exe
  2⤵
  PID:6752
- C:\Windows\System\zaRrRrp.exe
  C:\Windows\System\zaRrRrp.exe
  2⤵
  PID:6768
- C:\Windows\System\upYMrSh.exe
  C:\Windows\System\upYMrSh.exe
  2⤵
  PID:6784
- C:\Windows\System\AKeqsnx.exe
  C:\Windows\System\AKeqsnx.exe
  2⤵
  PID:6800
- C:\Windows\System\dtWezoI.exe
  C:\Windows\System\dtWezoI.exe
  2⤵
  PID:6816
- C:\Windows\System\BUltwsJ.exe
  C:\Windows\System\BUltwsJ.exe
  2⤵
  PID:6832
- C:\Windows\System\Oryfono.exe
  C:\Windows\System\Oryfono.exe
  2⤵
  PID:6852
- C:\Windows\System\YCioxrK.exe
  C:\Windows\System\YCioxrK.exe
  2⤵
  PID:6868
- C:\Windows\System\GVVFRTk.exe
  C:\Windows\System\GVVFRTk.exe
  2⤵
  PID:6884
- C:\Windows\System\wVEYhvk.exe
  C:\Windows\System\wVEYhvk.exe
  2⤵
  PID:6900
- C:\Windows\System\jnyFUXw.exe
  C:\Windows\System\jnyFUXw.exe
  2⤵
  PID:6916
- C:\Windows\System\tZgseOu.exe
  C:\Windows\System\tZgseOu.exe
  2⤵
  PID:6932
- C:\Windows\System\IbIyMkG.exe
  C:\Windows\System\IbIyMkG.exe
  2⤵
  PID:6948
- C:\Windows\System\BgrMEMT.exe
  C:\Windows\System\BgrMEMT.exe
  2⤵
  PID:6964
- C:\Windows\System\MFJQaKa.exe
  C:\Windows\System\MFJQaKa.exe
  2⤵
  PID:6980
- C:\Windows\System\BlntfHM.exe
  C:\Windows\System\BlntfHM.exe
  2⤵
  PID:6996
- C:\Windows\System\HSvHyzK.exe
  C:\Windows\System\HSvHyzK.exe
  2⤵
  PID:7012
- C:\Windows\System\zcYFQyg.exe
  C:\Windows\System\zcYFQyg.exe
  2⤵
  PID:7028
- C:\Windows\System\cdteVlO.exe
  C:\Windows\System\cdteVlO.exe
  2⤵
  PID:7044
- C:\Windows\System\iphWSIM.exe
  C:\Windows\System\iphWSIM.exe
  2⤵
  PID:7060
- C:\Windows\System\DyMTJRJ.exe
  C:\Windows\System\DyMTJRJ.exe
  2⤵
  PID:7076
- C:\Windows\System\fvIaGJV.exe
  C:\Windows\System\fvIaGJV.exe
  2⤵
  PID:7092
- C:\Windows\System\bhtrlqC.exe
  C:\Windows\System\bhtrlqC.exe
  2⤵
  PID:7108
- C:\Windows\System\CxPRRuB.exe
  C:\Windows\System\CxPRRuB.exe
  2⤵
  PID:7124
- C:\Windows\System\QlnWVSG.exe
  C:\Windows\System\QlnWVSG.exe
  2⤵
  PID:7140
- C:\Windows\System\rqdOXHs.exe
  C:\Windows\System\rqdOXHs.exe
  2⤵
  PID:7156
- C:\Windows\System\kfXJfXe.exe
  C:\Windows\System\kfXJfXe.exe
  2⤵
  PID:5496
- C:\Windows\System\QRLmxpI.exe
  C:\Windows\System\QRLmxpI.exe
  2⤵
  PID:4508
- C:\Windows\System\CZVxXih.exe
  C:\Windows\System\CZVxXih.exe
  2⤵
  PID:5988
- C:\Windows\System\WwSjSJR.exe
  C:\Windows\System\WwSjSJR.exe
  2⤵
  PID:6264
- C:\Windows\System\LYvIHBD.exe
  C:\Windows\System\LYvIHBD.exe
  2⤵
  PID:6328
- C:\Windows\System\TNjHNer.exe
  C:\Windows\System\TNjHNer.exe
  2⤵
  PID:4284
- C:\Windows\System\leSVdTK.exe
  C:\Windows\System\leSVdTK.exe
  2⤵
  PID:6184
- C:\Windows\System\eQzGLtE.exe
  C:\Windows\System\eQzGLtE.exe
  2⤵
  PID:6248
- C:\Windows\System\ZdpwsVw.exe
  C:\Windows\System\ZdpwsVw.exe
  2⤵
  PID:6308
- C:\Windows\System\NsYSSHf.exe
  C:\Windows\System\NsYSSHf.exe
  2⤵
  PID:6216
- C:\Windows\System\srddClu.exe
  C:\Windows\System\srddClu.exe
  2⤵
  PID:6344
- C:\Windows\System\JenXDSL.exe
  C:\Windows\System\JenXDSL.exe
  2⤵
  PID:6440
- C:\Windows\System\jTBeWLL.exe
  C:\Windows\System\jTBeWLL.exe
  2⤵
  PID:6452
- C:\Windows\System\RyQIMpb.exe
  C:\Windows\System\RyQIMpb.exe
  2⤵
  PID:6564
- C:\Windows\System\rZsgqNb.exe
  C:\Windows\System\rZsgqNb.exe
  2⤵
  PID:6488
- C:\Windows\System\LMLBiuA.exe
  C:\Windows\System\LMLBiuA.exe
  2⤵
  PID:6552
- C:\Windows\System\zewYWqy.exe
  C:\Windows\System\zewYWqy.exe
  2⤵
  PID:6568
- C:\Windows\System\TFgKUWp.exe
  C:\Windows\System\TFgKUWp.exe
  2⤵
  PID:6644
- C:\Windows\System\pmRNnih.exe
  C:\Windows\System\pmRNnih.exe
  2⤵
  PID:6632
- C:\Windows\System\bstnJfG.exe
  C:\Windows\System\bstnJfG.exe
  2⤵
  PID:6744
- C:\Windows\System\KdsqDmp.exe
  C:\Windows\System\KdsqDmp.exe
  2⤵
  PID:6748
- C:\Windows\System\JIIIiXn.exe
  C:\Windows\System\JIIIiXn.exe
  2⤵
  PID:6696
- C:\Windows\System\hSCtDYG.exe
  C:\Windows\System\hSCtDYG.exe
  2⤵
  PID:6876
- C:\Windows\System\wcMhFup.exe
  C:\Windows\System\wcMhFup.exe
  2⤵
  PID:6912
- C:\Windows\System\hQStIss.exe
  C:\Windows\System\hQStIss.exe
  2⤵
  PID:6976
- C:\Windows\System\BQOyAMo.exe
  C:\Windows\System\BQOyAMo.exe
  2⤵
  PID:7040
- C:\Windows\System\WCEJpQb.exe
  C:\Windows\System\WCEJpQb.exe
  2⤵
  PID:6796
- C:\Windows\System\ybkcSlQ.exe
  C:\Windows\System\ybkcSlQ.exe
  2⤵
  PID:6988
- C:\Windows\System\DdQCAGJ.exe
  C:\Windows\System\DdQCAGJ.exe
  2⤵
  PID:6828
- C:\Windows\System\DXjVtgf.exe
  C:\Windows\System\DXjVtgf.exe
  2⤵
  PID:6956
- C:\Windows\System\ObEMMrH.exe
  C:\Windows\System\ObEMMrH.exe
  2⤵
  PID:7024
- C:\Windows\System\oRZCOFE.exe
  C:\Windows\System\oRZCOFE.exe
  2⤵
  PID:7100
- C:\Windows\System\IGLCWPk.exe
  C:\Windows\System\IGLCWPk.exe
  2⤵
  PID:7164
- C:\Windows\System\uRkBYzQ.exe
  C:\Windows\System\uRkBYzQ.exe
  2⤵
  PID:6296
- C:\Windows\System\lWQNxte.exe
  C:\Windows\System\lWQNxte.exe
  2⤵
  PID:7116
- C:\Windows\System\hCXRpyS.exe
  C:\Windows\System\hCXRpyS.exe
  2⤵
  PID:5744
- C:\Windows\System\RPDnqgf.exe
  C:\Windows\System\RPDnqgf.exe
  2⤵
  PID:6324
- C:\Windows\System\jViRBrC.exe
  C:\Windows\System\jViRBrC.exe
  2⤵
  PID:6388
- C:\Windows\System\rpvwfjk.exe
  C:\Windows\System\rpvwfjk.exe
  2⤵
  PID:6408
- C:\Windows\System\MQJmKZK.exe
  C:\Windows\System\MQJmKZK.exe
  2⤵
  PID:6536
- C:\Windows\System\cqpBHdK.exe
  C:\Windows\System\cqpBHdK.exe
  2⤵
  PID:6680
- C:\Windows\System\wBJEMKV.exe
  C:\Windows\System\wBJEMKV.exe
  2⤵
  PID:6848
- C:\Windows\System\DhJDGla.exe
  C:\Windows\System\DhJDGla.exe
  2⤵
  PID:6808
- C:\Windows\System\vvLoSUq.exe
  C:\Windows\System\vvLoSUq.exe
  2⤵
  PID:6732
- C:\Windows\System\UdRFnFb.exe
  C:\Windows\System\UdRFnFb.exe
  2⤵
  PID:6992
- C:\Windows\System\uriBWiL.exe
  C:\Windows\System\uriBWiL.exe
  2⤵
  PID:7084
- C:\Windows\System\FHrkpuR.exe
  C:\Windows\System\FHrkpuR.exe
  2⤵
  PID:6928
- C:\Windows\System\zlsyGnt.exe
  C:\Windows\System\zlsyGnt.exe
  2⤵
  PID:6260
- C:\Windows\System\fiWRDhq.exe
  C:\Windows\System\fiWRDhq.exe
  2⤵
  PID:6392
- C:\Windows\System\gvIijGX.exe
  C:\Windows\System\gvIijGX.exe
  2⤵
  PID:7148
- C:\Windows\System\KsJuoyS.exe
  C:\Windows\System\KsJuoyS.exe
  2⤵
  PID:7036
- C:\Windows\System\ZnAzZMZ.exe
  C:\Windows\System\ZnAzZMZ.exe
  2⤵
  PID:6404
- C:\Windows\System\tcGtyFK.exe
  C:\Windows\System\tcGtyFK.exe
  2⤵
  PID:6712
- C:\Windows\System\TpSpEeI.exe
  C:\Windows\System\TpSpEeI.exe
  2⤵
  PID:6792
- C:\Windows\System\pYwxSOt.exe
  C:\Windows\System\pYwxSOt.exe
  2⤵
  PID:7068
- C:\Windows\System\iZitaPl.exe
  C:\Windows\System\iZitaPl.exe
  2⤵
  PID:3588
- C:\Windows\System\TcAuoTO.exe
  C:\Windows\System\TcAuoTO.exe
  2⤵
  PID:6944
- C:\Windows\System\RiqOcKv.exe
  C:\Windows\System\RiqOcKv.exe
  2⤵
  PID:6616
- C:\Windows\System\QRHHWFV.exe
  C:\Windows\System\QRHHWFV.exe
  2⤵
  PID:5748
- C:\Windows\System\dJrXHMp.exe
  C:\Windows\System\dJrXHMp.exe
  2⤵
  PID:6864
- C:\Windows\System\rFampKS.exe
  C:\Windows\System\rFampKS.exe
  2⤵
  PID:7136
- C:\Windows\System\aYIQlNF.exe
  C:\Windows\System\aYIQlNF.exe
  2⤵
  PID:7180
- C:\Windows\System\ipkOrkB.exe
  C:\Windows\System\ipkOrkB.exe
  2⤵
  PID:7196
- C:\Windows\System\kPeBjEw.exe
  C:\Windows\System\kPeBjEw.exe
  2⤵
  PID:7212
- C:\Windows\System\ilNfSxs.exe
  C:\Windows\System\ilNfSxs.exe
  2⤵
  PID:7228
- C:\Windows\System\ayHErWn.exe
  C:\Windows\System\ayHErWn.exe
  2⤵
  PID:7244
- C:\Windows\System\agMKPOa.exe
  C:\Windows\System\agMKPOa.exe
  2⤵
  PID:7260
- C:\Windows\System\iRSPxMh.exe
  C:\Windows\System\iRSPxMh.exe
  2⤵
  PID:7276
- C:\Windows\System\gNnyMIR.exe
  C:\Windows\System\gNnyMIR.exe
  2⤵
  PID:7292
- C:\Windows\System\iloCqhi.exe
  C:\Windows\System\iloCqhi.exe
  2⤵
  PID:7308
- C:\Windows\System\CoJqtLz.exe
  C:\Windows\System\CoJqtLz.exe
  2⤵
  PID:7324
- C:\Windows\System\hoNVLmh.exe
  C:\Windows\System\hoNVLmh.exe
  2⤵
  PID:7340
- C:\Windows\System\uNGbMgy.exe
  C:\Windows\System\uNGbMgy.exe
  2⤵
  PID:7356
- C:\Windows\System\RjjvTON.exe
  C:\Windows\System\RjjvTON.exe
  2⤵
  PID:7372
- C:\Windows\System\qThpWmO.exe
  C:\Windows\System\qThpWmO.exe
  2⤵
  PID:7388
- C:\Windows\System\WsBENuQ.exe
  C:\Windows\System\WsBENuQ.exe
  2⤵
  PID:7404
- C:\Windows\System\KLCYAUm.exe
  C:\Windows\System\KLCYAUm.exe
  2⤵
  PID:7420
- C:\Windows\System\buUfFZN.exe
  C:\Windows\System\buUfFZN.exe
  2⤵
  PID:7436
- C:\Windows\System\bEuGzfO.exe
  C:\Windows\System\bEuGzfO.exe
  2⤵
  PID:7452
- C:\Windows\System\usvlTaL.exe
  C:\Windows\System\usvlTaL.exe
  2⤵
  PID:7468
- C:\Windows\System\MxFvfeO.exe
  C:\Windows\System\MxFvfeO.exe
  2⤵
  PID:7484
- C:\Windows\System\zgWsLam.exe
  C:\Windows\System\zgWsLam.exe
  2⤵
  PID:7500
- C:\Windows\System\xpEimiE.exe
  C:\Windows\System\xpEimiE.exe
  2⤵
  PID:7516
- C:\Windows\System\cVfxlpL.exe
  C:\Windows\System\cVfxlpL.exe
  2⤵
  PID:7532
- C:\Windows\System\voBQsuH.exe
  C:\Windows\System\voBQsuH.exe
  2⤵
  PID:7548
- C:\Windows\System\YZpPhwo.exe
  C:\Windows\System\YZpPhwo.exe
  2⤵
  PID:7564
- C:\Windows\System\haWsXaa.exe
  C:\Windows\System\haWsXaa.exe
  2⤵
  PID:7580
- C:\Windows\System\ZuZWSRC.exe
  C:\Windows\System\ZuZWSRC.exe
  2⤵
  PID:7596
- C:\Windows\System\GrAZLXV.exe
  C:\Windows\System\GrAZLXV.exe
  2⤵
  PID:7612
- C:\Windows\System\ktsRibc.exe
  C:\Windows\System\ktsRibc.exe
  2⤵
  PID:7628
- C:\Windows\System\DWnTjxw.exe
  C:\Windows\System\DWnTjxw.exe
  2⤵
  PID:7644
- C:\Windows\System\AjGfbIw.exe
  C:\Windows\System\AjGfbIw.exe
  2⤵
  PID:7660
- C:\Windows\System\pDsRPBY.exe
  C:\Windows\System\pDsRPBY.exe
  2⤵
  PID:7676
- C:\Windows\System\dJflxes.exe
  C:\Windows\System\dJflxes.exe
  2⤵
  PID:7692
- C:\Windows\System\xorPjKB.exe
  C:\Windows\System\xorPjKB.exe
  2⤵
  PID:7708
- C:\Windows\System\UWnbTnO.exe
  C:\Windows\System\UWnbTnO.exe
  2⤵
  PID:7724
- C:\Windows\System\WZqTjPy.exe
  C:\Windows\System\WZqTjPy.exe
  2⤵
  PID:7740
- C:\Windows\System\rYvjOPf.exe
  C:\Windows\System\rYvjOPf.exe
  2⤵
  PID:7756
- C:\Windows\System\LLurhQt.exe
  C:\Windows\System\LLurhQt.exe
  2⤵
  PID:7772
- C:\Windows\System\aAdcDyx.exe
  C:\Windows\System\aAdcDyx.exe
  2⤵
  PID:7788
- C:\Windows\System\KsDYFHS.exe
  C:\Windows\System\KsDYFHS.exe
  2⤵
  PID:7804
- C:\Windows\System\QZseMXQ.exe
  C:\Windows\System\QZseMXQ.exe
  2⤵
  PID:7820
- C:\Windows\System\GqOvgTd.exe
  C:\Windows\System\GqOvgTd.exe
  2⤵
  PID:7836
- C:\Windows\System\JbhPxJi.exe
  C:\Windows\System\JbhPxJi.exe
  2⤵
  PID:7852
- C:\Windows\System\sxuuWxM.exe
  C:\Windows\System\sxuuWxM.exe
  2⤵
  PID:7868
- C:\Windows\System\fDADyKB.exe
  C:\Windows\System\fDADyKB.exe
  2⤵
  PID:7884
- C:\Windows\System\ltlSono.exe
  C:\Windows\System\ltlSono.exe
  2⤵
  PID:7900
- C:\Windows\System\LQcicrL.exe
  C:\Windows\System\LQcicrL.exe
  2⤵
  PID:7916
- C:\Windows\System\euVXooU.exe
  C:\Windows\System\euVXooU.exe
  2⤵
  PID:7940
- C:\Windows\System\rmVpLNV.exe
  C:\Windows\System\rmVpLNV.exe
  2⤵
  PID:7956
- C:\Windows\System\NzTGhuf.exe
  C:\Windows\System\NzTGhuf.exe
  2⤵
  PID:7972
- C:\Windows\System\fwgJNMh.exe
  C:\Windows\System\fwgJNMh.exe
  2⤵
  PID:7988
- C:\Windows\System\JDxLyyK.exe
  C:\Windows\System\JDxLyyK.exe
  2⤵
  PID:8004
- C:\Windows\System\WPYltFz.exe
  C:\Windows\System\WPYltFz.exe
  2⤵
  PID:8020
- C:\Windows\System\IJHPyBQ.exe
  C:\Windows\System\IJHPyBQ.exe
  2⤵
  PID:8036
- C:\Windows\System\kRvxDgs.exe
  C:\Windows\System\kRvxDgs.exe
  2⤵
  PID:8052
- C:\Windows\System\zWXpMlN.exe
  C:\Windows\System\zWXpMlN.exe
  2⤵
  PID:8068
- C:\Windows\System\qLRXRIo.exe
  C:\Windows\System\qLRXRIo.exe
  2⤵
  PID:8084
- C:\Windows\System\BnPhOhG.exe
  C:\Windows\System\BnPhOhG.exe
  2⤵
  PID:8100
- C:\Windows\System\hVxjOVO.exe
  C:\Windows\System\hVxjOVO.exe
  2⤵
  PID:8116
- C:\Windows\System\jBpkqKs.exe
  C:\Windows\System\jBpkqKs.exe
  2⤵
  PID:8132
- C:\Windows\System\LohUbxg.exe
  C:\Windows\System\LohUbxg.exe
  2⤵
  PID:8148
- C:\Windows\System\dAGEFTI.exe
  C:\Windows\System\dAGEFTI.exe
  2⤵
  PID:8164
- C:\Windows\System\eEpfMCi.exe
  C:\Windows\System\eEpfMCi.exe
  2⤵
  PID:8180
- C:\Windows\System\mAZmmIJ.exe
  C:\Windows\System\mAZmmIJ.exe
  2⤵
  PID:6232
- C:\Windows\System\jlgZVnW.exe
  C:\Windows\System\jlgZVnW.exe
  2⤵
  PID:7224
- C:\Windows\System\OKUsBhm.exe
  C:\Windows\System\OKUsBhm.exe
  2⤵
  PID:7252
- C:\Windows\System\AMsgyPr.exe
  C:\Windows\System\AMsgyPr.exe
  2⤵
  PID:7288
- C:\Windows\System\pdOTROE.exe
  C:\Windows\System\pdOTROE.exe
  2⤵
  PID:6340
- C:\Windows\System\VDoqoFj.exe
  C:\Windows\System\VDoqoFj.exe
  2⤵
  PID:7208
- C:\Windows\System\SuYICgp.exe
  C:\Windows\System\SuYICgp.exe
  2⤵
  PID:6504
- C:\Windows\System\ZEixpdb.exe
  C:\Windows\System\ZEixpdb.exe
  2⤵
  PID:6612
- C:\Windows\System\kKYJIPW.exe
  C:\Windows\System\kKYJIPW.exe
  2⤵
  PID:7240
- C:\Windows\System\IiQiTHH.exe
  C:\Windows\System\IiQiTHH.exe
  2⤵
  PID:7348
- C:\Windows\System\ITIKKDx.exe
  C:\Windows\System\ITIKKDx.exe
  2⤵
  PID:7352
- C:\Windows\System\kokSFUF.exe
  C:\Windows\System\kokSFUF.exe
  2⤵
  PID:7364
- C:\Windows\System\ZKCNHYI.exe
  C:\Windows\System\ZKCNHYI.exe
  2⤵
  PID:7508
- C:\Windows\System\IWrhGfO.exe
  C:\Windows\System\IWrhGfO.exe
  2⤵
  PID:7544
- C:\Windows\System\YrBGoVR.exe
  C:\Windows\System\YrBGoVR.exe
  2⤵
  PID:7608
- C:\Windows\System\JIBjzFO.exe
  C:\Windows\System\JIBjzFO.exe
  2⤵
  PID:7672
- C:\Windows\System\qqpTgSD.exe
  C:\Windows\System\qqpTgSD.exe
  2⤵
  PID:7556
- C:\Windows\System\bAjDSEv.exe
  C:\Windows\System\bAjDSEv.exe
  2⤵
  PID:7428
- C:\Windows\System\lpQndYz.exe
  C:\Windows\System\lpQndYz.exe
  2⤵
  PID:7464
- C:\Windows\System\pzsKfwE.exe
  C:\Windows\System\pzsKfwE.exe
  2⤵
  PID:7524
- C:\Windows\System\zThYEKs.exe
  C:\Windows\System\zThYEKs.exe
  2⤵
  PID:7652
- C:\Windows\System\MamIsDC.exe
  C:\Windows\System\MamIsDC.exe
  2⤵
  PID:7720
- C:\Windows\System\dUlrYYe.exe
  C:\Windows\System\dUlrYYe.exe
  2⤵
  PID:7796
- C:\Windows\System\YzBKhXx.exe
  C:\Windows\System\YzBKhXx.exe
  2⤵
  PID:7800
- C:\Windows\System\sSoAjnf.exe
  C:\Windows\System\sSoAjnf.exe
  2⤵
  PID:7864
- C:\Windows\System\BLRJIIg.exe
  C:\Windows\System\BLRJIIg.exe
  2⤵
  PID:7816
- C:\Windows\System\AohWjpD.exe
  C:\Windows\System\AohWjpD.exe
  2⤵
  PID:7876
- C:\Windows\System\vAGIRyO.exe
  C:\Windows\System\vAGIRyO.exe
  2⤵
  PID:1476
- C:\Windows\System\amNkGpn.exe
  C:\Windows\System\amNkGpn.exe
  2⤵
  PID:7932
- C:\Windows\System\LLbByfL.exe
  C:\Windows\System\LLbByfL.exe
  2⤵
  PID:7996
- C:\Windows\System\hQTOPsh.exe
  C:\Windows\System\hQTOPsh.exe
  2⤵
  PID:7980
- C:\Windows\System\EtQvECd.exe
  C:\Windows\System\EtQvECd.exe
  2⤵
  PID:8092
- C:\Windows\System\fkBlbKv.exe
  C:\Windows\System\fkBlbKv.exe
  2⤵
  PID:8016
- C:\Windows\System\SNTYZYm.exe
  C:\Windows\System\SNTYZYm.exe
  2⤵
  PID:8080
- C:\Windows\System\OystrRI.exe
  C:\Windows\System\OystrRI.exe
  2⤵
  PID:8160
- C:\Windows\System\YSyAXjP.exe
  C:\Windows\System\YSyAXjP.exe
  2⤵
  PID:6896
- C:\Windows\System\TeITYbE.exe
  C:\Windows\System\TeITYbE.exe
  2⤵
  PID:7220
- C:\Windows\System\sryBipe.exe
  C:\Windows\System\sryBipe.exe
  2⤵
  PID:7284
- C:\Windows\System\prkJXdM.exe
  C:\Windows\System\prkJXdM.exe
  2⤵
  PID:6548
- C:\Windows\System\GgGeleu.exe
  C:\Windows\System\GgGeleu.exe
  2⤵
  PID:7176
- C:\Windows\System\WdtlxgU.exe
  C:\Windows\System\WdtlxgU.exe
  2⤵
  PID:7476
- C:\Windows\System\CrCebvk.exe
  C:\Windows\System\CrCebvk.exe
  2⤵
  PID:7700
- C:\Windows\System\bYfUZWY.exe
  C:\Windows\System\bYfUZWY.exe
  2⤵
  PID:7444
- C:\Windows\System\SpXfDLJ.exe
  C:\Windows\System\SpXfDLJ.exe
  2⤵
  PID:7448
- C:\Windows\System\GFqJWwf.exe
  C:\Windows\System\GFqJWwf.exe
  2⤵
  PID:7432
- C:\Windows\System\nWxLaTc.exe
  C:\Windows\System\nWxLaTc.exe
  2⤵
  PID:7764
- C:\Windows\System\rFyJPzk.exe
  C:\Windows\System\rFyJPzk.exe
  2⤵
  PID:7492
- C:\Windows\System\FHUquiq.exe
  C:\Windows\System\FHUquiq.exe
  2⤵
  PID:7688
- C:\Windows\System\HHSCTNJ.exe
  C:\Windows\System\HHSCTNJ.exe
  2⤵
  PID:7896
- C:\Windows\System\yWsbEIA.exe
  C:\Windows\System\yWsbEIA.exe
  2⤵
  PID:7952
- C:\Windows\System\MtaGMRy.exe
  C:\Windows\System\MtaGMRy.exe
  2⤵
  PID:7924
- C:\Windows\System\KkGVSXE.exe
  C:\Windows\System\KkGVSXE.exe
  2⤵
  PID:8012
- C:\Windows\System\lBnXVoG.exe
  C:\Windows\System\lBnXVoG.exe
  2⤵
  PID:7192
- C:\Windows\System\lQSxBRu.exe
  C:\Windows\System\lQSxBRu.exe
  2⤵
  PID:7384
- C:\Windows\System\eeOIzOy.exe
  C:\Windows\System\eeOIzOy.exe
  2⤵
  PID:8060
- C:\Windows\System\lbKlVEF.exe
  C:\Windows\System\lbKlVEF.exe
  2⤵
  PID:7576
- C:\Windows\System\YIezUfr.exe
  C:\Windows\System\YIezUfr.exe
  2⤵
  PID:7832
- C:\Windows\System\NWaIOOy.exe
  C:\Windows\System\NWaIOOy.exe
  2⤵
  PID:8076
- C:\Windows\System\fvWYOnr.exe
  C:\Windows\System\fvWYOnr.exe
  2⤵
  PID:7300
- C:\Windows\System\BtEVIRu.exe
  C:\Windows\System\BtEVIRu.exe
  2⤵
  PID:7912
- C:\Windows\System\mvqIdQG.exe
  C:\Windows\System\mvqIdQG.exe
  2⤵
  PID:6780
- C:\Windows\System\ihJSwmZ.exe
  C:\Windows\System\ihJSwmZ.exe
  2⤵
  PID:7272
- C:\Windows\System\GHihuuG.exe
  C:\Windows\System\GHihuuG.exe
  2⤵
  PID:7396
- C:\Windows\System\lsKBpID.exe
  C:\Windows\System\lsKBpID.exe
  2⤵
  PID:6844
- C:\Windows\System\GrQiace.exe
  C:\Windows\System\GrQiace.exe
  2⤵
  PID:8188
- C:\Windows\System\bkcxdFV.exe
  C:\Windows\System\bkcxdFV.exe
  2⤵
  PID:7624
- C:\Windows\System\BuPpPWM.exe
  C:\Windows\System\BuPpPWM.exe
  2⤵
  PID:8028
- C:\Windows\System\dkMgyLu.exe
  C:\Windows\System\dkMgyLu.exe
  2⤵
  PID:7732
- C:\Windows\System\ffNacsd.exe
  C:\Windows\System\ffNacsd.exe
  2⤵
  PID:8196
- C:\Windows\System\IUCZDeh.exe
  C:\Windows\System\IUCZDeh.exe
  2⤵
  PID:8212
- C:\Windows\System\ipWKLHn.exe
  C:\Windows\System\ipWKLHn.exe
  2⤵
  PID:8228
- C:\Windows\System\BchCdfe.exe
  C:\Windows\System\BchCdfe.exe
  2⤵
  PID:8244
- C:\Windows\System\ZnKRxRF.exe
  C:\Windows\System\ZnKRxRF.exe
  2⤵
  PID:8260
- C:\Windows\System\HZDOcxV.exe
  C:\Windows\System\HZDOcxV.exe
  2⤵
  PID:8276
- C:\Windows\System\QhtcUyM.exe
  C:\Windows\System\QhtcUyM.exe
  2⤵
  PID:8292
- C:\Windows\System\zoVTOsD.exe
  C:\Windows\System\zoVTOsD.exe
  2⤵
  PID:8312
- C:\Windows\System\uVppjvY.exe
  C:\Windows\System\uVppjvY.exe
  2⤵
  PID:8328
- C:\Windows\System\YsQDXCu.exe
  C:\Windows\System\YsQDXCu.exe
  2⤵
  PID:8344
- C:\Windows\System\WPbDtyf.exe
  C:\Windows\System\WPbDtyf.exe
  2⤵
  PID:8360
- C:\Windows\System\DRZktIG.exe
  C:\Windows\System\DRZktIG.exe
  2⤵
  PID:8376
- C:\Windows\System\yhNiuqA.exe
  C:\Windows\System\yhNiuqA.exe
  2⤵
  PID:8392
- C:\Windows\System\JTlPPCH.exe
  C:\Windows\System\JTlPPCH.exe
  2⤵
  PID:8408
- C:\Windows\System\dXJublx.exe
  C:\Windows\System\dXJublx.exe
  2⤵
  PID:8424
- C:\Windows\System\JSTcZEM.exe
  C:\Windows\System\JSTcZEM.exe
  2⤵
  PID:8444
- C:\Windows\System\wuNEhlA.exe
  C:\Windows\System\wuNEhlA.exe
  2⤵
  PID:8464
- C:\Windows\System\FNCYoqh.exe
  C:\Windows\System\FNCYoqh.exe
  2⤵
  PID:8480
- C:\Windows\System\hmSIMMX.exe
  C:\Windows\System\hmSIMMX.exe
  2⤵
  PID:8496
- C:\Windows\System\mbpKJIg.exe
  C:\Windows\System\mbpKJIg.exe
  2⤵
  PID:8512
- C:\Windows\System\mDfHJKn.exe
  C:\Windows\System\mDfHJKn.exe
  2⤵
  PID:8528
- C:\Windows\System\wvklnjw.exe
  C:\Windows\System\wvklnjw.exe
  2⤵
  PID:8544
- C:\Windows\System\NcDCrnq.exe
  C:\Windows\System\NcDCrnq.exe
  2⤵
  PID:8560
- C:\Windows\System\wmweKVu.exe
  C:\Windows\System\wmweKVu.exe
  2⤵
  PID:8576
- C:\Windows\System\XYJqVfy.exe
  C:\Windows\System\XYJqVfy.exe
  2⤵
  PID:8592
- C:\Windows\System\BELdxNp.exe
  C:\Windows\System\BELdxNp.exe
  2⤵
  PID:8608
- C:\Windows\System\SHEdNEx.exe
  C:\Windows\System\SHEdNEx.exe
  2⤵
  PID:8624
- C:\Windows\System\OFdXFoE.exe
  C:\Windows\System\OFdXFoE.exe
  2⤵
  PID:8640
- C:\Windows\System\Rxneedk.exe
  C:\Windows\System\Rxneedk.exe
  2⤵
  PID:8656
- C:\Windows\System\xbGZZVt.exe
  C:\Windows\System\xbGZZVt.exe
  2⤵
  PID:8672
- C:\Windows\System\qqdBnYs.exe
  C:\Windows\System\qqdBnYs.exe
  2⤵
  PID:8688
- C:\Windows\System\VqGaIEI.exe
  C:\Windows\System\VqGaIEI.exe
  2⤵
  PID:8708
- C:\Windows\System\pMyxdOn.exe
  C:\Windows\System\pMyxdOn.exe
  2⤵
  PID:8724
- C:\Windows\System\JxfwUQr.exe
  C:\Windows\System\JxfwUQr.exe
  2⤵
  PID:8740
- C:\Windows\System\vTksbze.exe
  C:\Windows\System\vTksbze.exe
  2⤵
  PID:8756
- C:\Windows\System\HFOSfdD.exe
  C:\Windows\System\HFOSfdD.exe
  2⤵
  PID:8772
- C:\Windows\System\rFErYKm.exe
  C:\Windows\System\rFErYKm.exe
  2⤵
  PID:8792
- C:\Windows\System\PTbBOLo.exe
  C:\Windows\System\PTbBOLo.exe
  2⤵
  PID:8808
- C:\Windows\System\bkkwCdY.exe
  C:\Windows\System\bkkwCdY.exe
  2⤵
  PID:8828
- C:\Windows\System\ruatqqr.exe
  C:\Windows\System\ruatqqr.exe
  2⤵
  PID:8844
- C:\Windows\System\WnJmujP.exe
  C:\Windows\System\WnJmujP.exe
  2⤵
  PID:8860
- C:\Windows\System\LkKAwqh.exe
  C:\Windows\System\LkKAwqh.exe
  2⤵
  PID:8876
- C:\Windows\System\txcYtVo.exe
  C:\Windows\System\txcYtVo.exe
  2⤵
  PID:8892
- C:\Windows\System\yzolEVa.exe
  C:\Windows\System\yzolEVa.exe
  2⤵
  PID:8908
- C:\Windows\System\NMEqUYi.exe
  C:\Windows\System\NMEqUYi.exe
  2⤵
  PID:8924
- C:\Windows\System\wQxYZuk.exe
  C:\Windows\System\wQxYZuk.exe
  2⤵
  PID:8944
- C:\Windows\System\doBdMvL.exe
  C:\Windows\System\doBdMvL.exe
  2⤵
  PID:8960
- C:\Windows\System\OCFplnC.exe
  C:\Windows\System\OCFplnC.exe
  2⤵
  PID:8980
- C:\Windows\System\fJASwJE.exe
  C:\Windows\System\fJASwJE.exe
  2⤵
  PID:8996
- C:\Windows\System\tIFtYKx.exe
  C:\Windows\System\tIFtYKx.exe
  2⤵
  PID:9012
- C:\Windows\System\UeaKWNn.exe
  C:\Windows\System\UeaKWNn.exe
  2⤵
  PID:9032
- C:\Windows\System\MkBpLri.exe
  C:\Windows\System\MkBpLri.exe
  2⤵
  PID:9048
- C:\Windows\System\ylrZKHA.exe
  C:\Windows\System\ylrZKHA.exe
  2⤵
  PID:9064
- C:\Windows\System\lDvHDQl.exe
  C:\Windows\System\lDvHDQl.exe
  2⤵
  PID:9080
- C:\Windows\System\raTxOBG.exe
  C:\Windows\System\raTxOBG.exe
  2⤵
  PID:9096
- C:\Windows\System\EAFLUuV.exe
  C:\Windows\System\EAFLUuV.exe
  2⤵
  PID:9112
- C:\Windows\System\TkOfEpq.exe
  C:\Windows\System\TkOfEpq.exe
  2⤵
  PID:9128
- C:\Windows\System\NmCYkpU.exe
  C:\Windows\System\NmCYkpU.exe
  2⤵
  PID:9144
- C:\Windows\System\URgfxMU.exe
  C:\Windows\System\URgfxMU.exe
  2⤵
  PID:9160
- C:\Windows\System\aHLpHZO.exe
  C:\Windows\System\aHLpHZO.exe
  2⤵
  PID:9176
- C:\Windows\System\yuQXjRf.exe
  C:\Windows\System\yuQXjRf.exe
  2⤵
  PID:9192
- C:\Windows\System\EUuotqd.exe
  C:\Windows\System\EUuotqd.exe
  2⤵
  PID:9212
- C:\Windows\System\xyKpJfG.exe
  C:\Windows\System\xyKpJfG.exe
  2⤵
  PID:8176
- C:\Windows\System\Jgkodps.exe
  C:\Windows\System\Jgkodps.exe
  2⤵
  PID:7968
- C:\Windows\System\facQLEP.exe
  C:\Windows\System\facQLEP.exe
  2⤵
  PID:8288
- C:\Windows\System\TMyEgEq.exe
  C:\Windows\System\TMyEgEq.exe
  2⤵
  PID:7984
- C:\Windows\System\qHYVWEt.exe
  C:\Windows\System\qHYVWEt.exe
  2⤵
  PID:8324
- C:\Windows\System\cyzeNUC.exe
  C:\Windows\System\cyzeNUC.exe
  2⤵
  PID:8352
- C:\Windows\System\RzCRJkh.exe
  C:\Windows\System\RzCRJkh.exe
  2⤵
  PID:6484
- C:\Windows\System\BBekRmM.exe
  C:\Windows\System\BBekRmM.exe
  2⤵
  PID:8384
- C:\Windows\System\vXViZVI.exe
  C:\Windows\System\vXViZVI.exe
  2⤵
  PID:8452
- C:\Windows\System\fUqBwGN.exe
  C:\Windows\System\fUqBwGN.exe
  2⤵
  PID:8372
- C:\Windows\System\xykIHxp.exe
  C:\Windows\System\xykIHxp.exe
  2⤵
  PID:8440
- C:\Windows\System\EqvWaOm.exe
  C:\Windows\System\EqvWaOm.exe
  2⤵
  PID:8504
- C:\Windows\System\BmOZoJA.exe
  C:\Windows\System\BmOZoJA.exe
  2⤵
  PID:8524
- C:\Windows\System\eEUxgGi.exe
  C:\Windows\System\eEUxgGi.exe
  2⤵
  PID:8568
- C:\Windows\System\GMdqmwT.exe
  C:\Windows\System\GMdqmwT.exe
  2⤵
  PID:8616
- C:\Windows\System\RrCtEkc.exe
  C:\Windows\System\RrCtEkc.exe
  2⤵
  PID:8572
- C:\Windows\System\XzhlVlc.exe
  C:\Windows\System\XzhlVlc.exe
  2⤵
  PID:8684
- C:\Windows\System\NVaTBpE.exe
  C:\Windows\System\NVaTBpE.exe
  2⤵
  PID:8636
- C:\Windows\System\rSYWWXY.exe
  C:\Windows\System\rSYWWXY.exe
  2⤵
  PID:8732
- C:\Windows\System\rrYAOCr.exe
  C:\Windows\System\rrYAOCr.exe
  2⤵
  PID:8768
- C:\Windows\System\xAVbxZk.exe
  C:\Windows\System\xAVbxZk.exe
  2⤵
  PID:8780
- C:\Windows\System\eIBFJps.exe
  C:\Windows\System\eIBFJps.exe
  2⤵
  PID:8804
- C:\Windows\System\MtogMmS.exe
  C:\Windows\System\MtogMmS.exe
  2⤵
  PID:8852
- C:\Windows\System\WxeXSnB.exe
  C:\Windows\System\WxeXSnB.exe
  2⤵
  PID:8840
- C:\Windows\System\AZUxjtZ.exe
  C:\Windows\System\AZUxjtZ.exe
  2⤵
  PID:8952
- C:\Windows\System\BDIVVtR.exe
  C:\Windows\System\BDIVVtR.exe
  2⤵
  PID:8956
- C:\Windows\System\HLAHMoy.exe
  C:\Windows\System\HLAHMoy.exe
  2⤵
  PID:8936
- C:\Windows\System\oYVKekq.exe
  C:\Windows\System\oYVKekq.exe
  2⤵
  PID:8992
- C:\Windows\System\PtWhpqc.exe
  C:\Windows\System\PtWhpqc.exe
  2⤵
  PID:9008
- C:\Windows\System\KeQdGFX.exe
  C:\Windows\System\KeQdGFX.exe
  2⤵
  PID:8976
- C:\Windows\System\zeujHBI.exe
  C:\Windows\System\zeujHBI.exe
  2⤵
  PID:9120
- C:\Windows\System\JqABBCB.exe
  C:\Windows\System\JqABBCB.exe
  2⤵
  PID:9104
- C:\Windows\System\XTFYfyu.exe
  C:\Windows\System\XTFYfyu.exe
  2⤵
  PID:9156
- C:\Windows\System\dVHdMnz.exe
  C:\Windows\System\dVHdMnz.exe
  2⤵
  PID:7604
- C:\Windows\System\aAmragI.exe
  C:\Windows\System\aAmragI.exe
  2⤵
  PID:9172
- C:\Windows\System\rPdocZE.exe
  C:\Windows\System\rPdocZE.exe
  2⤵
  PID:8256
- C:\Windows\System\ubJnJbL.exe
  C:\Windows\System\ubJnJbL.exe
  2⤵
  PID:8240
- C:\Windows\System\LDixpId.exe
  C:\Windows\System\LDixpId.exe
  2⤵
  PID:8300
- C:\Windows\System\AiMCtKG.exe
  C:\Windows\System\AiMCtKG.exe
  2⤵
  PID:8420
- C:\Windows\System\dUnCNmS.exe
  C:\Windows\System\dUnCNmS.exe
  2⤵
  PID:8520
- C:\Windows\System\xeoynAM.exe
  C:\Windows\System\xeoynAM.exe
  2⤵
  PID:8604
- C:\Windows\System\dYJPcCh.exe
  C:\Windows\System\dYJPcCh.exe
  2⤵
  PID:8752
- C:\Windows\System\EufeKVR.exe
  C:\Windows\System\EufeKVR.exe
  2⤵
  PID:8336
- C:\Windows\System\XhVVQrm.exe
  C:\Windows\System\XhVVQrm.exe
  2⤵
  PID:8404
- C:\Windows\System\goIdpoT.exe
  C:\Windows\System\goIdpoT.exe
  2⤵
  PID:8652
- C:\Windows\System\gASXjHS.exe
  C:\Windows\System\gASXjHS.exe
  2⤵
  PID:8764
- C:\Windows\System\TkguUox.exe
  C:\Windows\System\TkguUox.exe
  2⤵
  PID:8472
- C:\Windows\System\HoWvisa.exe
  C:\Windows\System\HoWvisa.exe
  2⤵
  PID:8884
- C:\Windows\System\pJyKwCl.exe
  C:\Windows\System\pJyKwCl.exe
  2⤵
  PID:8988
- C:\Windows\System\xlOeSBP.exe
  C:\Windows\System\xlOeSBP.exe
  2⤵
  PID:9060
- C:\Windows\System\cKQMrFL.exe
  C:\Windows\System\cKQMrFL.exe
  2⤵
  PID:9168
- C:\Windows\System\ssWexeH.exe
  C:\Windows\System\ssWexeH.exe
  2⤵
  PID:8304
- C:\Windows\System\mFsNitD.exe
  C:\Windows\System\mFsNitD.exe
  2⤵
  PID:8272
- C:\Windows\System\BqiixSt.exe
  C:\Windows\System\BqiixSt.exe
  2⤵
  PID:8416
- C:\Windows\System\wWUgWYE.exe
  C:\Windows\System\wWUgWYE.exe
  2⤵
  PID:8916
- C:\Windows\System\ruPdNRZ.exe
  C:\Windows\System\ruPdNRZ.exe
  2⤵
  PID:8748
- C:\Windows\System\xlItHyy.exe
  C:\Windows\System\xlItHyy.exe
  2⤵
  PID:8836
- C:\Windows\System\XHwiSdo.exe
  C:\Windows\System\XHwiSdo.exe
  2⤵
  PID:8872
- C:\Windows\System\RmNpvXC.exe
  C:\Windows\System\RmNpvXC.exe
  2⤵
  PID:9220
- C:\Windows\System\gXEEKhb.exe
  C:\Windows\System\gXEEKhb.exe
  2⤵
  PID:9236
- C:\Windows\System\lHLVuyU.exe
  C:\Windows\System\lHLVuyU.exe
  2⤵
  PID:9252
- C:\Windows\System\BnOZoaL.exe
  C:\Windows\System\BnOZoaL.exe
  2⤵
  PID:9268
- C:\Windows\System\yUelfkr.exe
  C:\Windows\System\yUelfkr.exe
  2⤵
  PID:9284
- C:\Windows\System\UjPVFrR.exe
  C:\Windows\System\UjPVFrR.exe
  2⤵
  PID:9300
- C:\Windows\System\khPrfnK.exe
  C:\Windows\System\khPrfnK.exe
  2⤵
  PID:9316
- C:\Windows\System\KjpNFdl.exe
  C:\Windows\System\KjpNFdl.exe
  2⤵
  PID:9332
- C:\Windows\System\pjmVKRG.exe
  C:\Windows\System\pjmVKRG.exe
  2⤵
  PID:9348
- C:\Windows\System\PDCAsfe.exe
  C:\Windows\System\PDCAsfe.exe
  2⤵
  PID:9364
- C:\Windows\System\qocBAPF.exe
  C:\Windows\System\qocBAPF.exe
  2⤵
  PID:9380
- C:\Windows\System\kJglOdT.exe
  C:\Windows\System\kJglOdT.exe
  2⤵
  PID:9396
- C:\Windows\System\GPqSvlH.exe
  C:\Windows\System\GPqSvlH.exe
  2⤵
  PID:9412
- C:\Windows\System\dTTsHTc.exe
  C:\Windows\System\dTTsHTc.exe
  2⤵
  PID:9428
- C:\Windows\System\EoBZGbh.exe
  C:\Windows\System\EoBZGbh.exe
  2⤵
  PID:9444
- C:\Windows\System\WbsDRqq.exe
  C:\Windows\System\WbsDRqq.exe
  2⤵
  PID:9460
- C:\Windows\System\HIahHbD.exe
  C:\Windows\System\HIahHbD.exe
  2⤵
  PID:9476
- C:\Windows\System\ofupXLg.exe
  C:\Windows\System\ofupXLg.exe
  2⤵
  PID:9492
- C:\Windows\System\fpqgIps.exe
  C:\Windows\System\fpqgIps.exe
  2⤵
  PID:9508
- C:\Windows\System\EAGgiwD.exe
  C:\Windows\System\EAGgiwD.exe
  2⤵
  PID:9524
- C:\Windows\System\GqPThzS.exe
  C:\Windows\System\GqPThzS.exe
  2⤵
  PID:9540
- C:\Windows\System\gSyapSi.exe
  C:\Windows\System\gSyapSi.exe
  2⤵
  PID:9556
- C:\Windows\System\fxIFzJI.exe
  C:\Windows\System\fxIFzJI.exe
  2⤵
  PID:9572
- C:\Windows\System\MnPyToW.exe
  C:\Windows\System\MnPyToW.exe
  2⤵
  PID:9592
- C:\Windows\System\FYpDvWV.exe
  C:\Windows\System\FYpDvWV.exe
  2⤵
  PID:9608
- C:\Windows\System\IkPuNYg.exe
  C:\Windows\System\IkPuNYg.exe
  2⤵
  PID:9624
- C:\Windows\System\eOhlBMj.exe
  C:\Windows\System\eOhlBMj.exe
  2⤵
  PID:9640
- C:\Windows\System\AXwulep.exe
  C:\Windows\System\AXwulep.exe
  2⤵
  PID:9656
- C:\Windows\System\mGahZdo.exe
  C:\Windows\System\mGahZdo.exe
  2⤵
  PID:9672
- C:\Windows\System\RAcBOWb.exe
  C:\Windows\System\RAcBOWb.exe
  2⤵
  PID:9688
- C:\Windows\System\ejYywmm.exe
  C:\Windows\System\ejYywmm.exe
  2⤵
  PID:9704
- C:\Windows\System\bwFAGLi.exe
  C:\Windows\System\bwFAGLi.exe
  2⤵
  PID:9720
- C:\Windows\System\xIzerhT.exe
  C:\Windows\System\xIzerhT.exe
  2⤵
  PID:9736
- C:\Windows\System\TJXAglD.exe
  C:\Windows\System\TJXAglD.exe
  2⤵
  PID:9752
- C:\Windows\System\JfBCvFi.exe
  C:\Windows\System\JfBCvFi.exe
  2⤵
  PID:9768
- C:\Windows\System\oxPFouc.exe
  C:\Windows\System\oxPFouc.exe
  2⤵
  PID:9792
- C:\Windows\System\xaCReWs.exe
  C:\Windows\System\xaCReWs.exe
  2⤵
  PID:9808
- C:\Windows\System\czxXljm.exe
  C:\Windows\System\czxXljm.exe
  2⤵
  PID:9824
- C:\Windows\System\bCwNDYI.exe
  C:\Windows\System\bCwNDYI.exe
  2⤵
  PID:9840
- C:\Windows\System\modEtLZ.exe
  C:\Windows\System\modEtLZ.exe
  2⤵
  PID:9856
- C:\Windows\System\RqminTF.exe
  C:\Windows\System\RqminTF.exe
  2⤵
  PID:9872
- C:\Windows\System\EFkVbzU.exe
  C:\Windows\System\EFkVbzU.exe
  2⤵
  PID:9888
- C:\Windows\System\MTrzSUr.exe
  C:\Windows\System\MTrzSUr.exe
  2⤵
  PID:9904
- C:\Windows\System\VMNnbvt.exe
  C:\Windows\System\VMNnbvt.exe
  2⤵
  PID:9920
- C:\Windows\System\VhhlUMW.exe
  C:\Windows\System\VhhlUMW.exe
  2⤵
  PID:9936
- C:\Windows\System\KTaCZRo.exe
  C:\Windows\System\KTaCZRo.exe
  2⤵
  PID:9952
- C:\Windows\System\ktMfxGq.exe
  C:\Windows\System\ktMfxGq.exe
  2⤵
  PID:9968
- C:\Windows\System\esGRDxh.exe
  C:\Windows\System\esGRDxh.exe
  2⤵
  PID:9984
- C:\Windows\System\tXkZqDL.exe
  C:\Windows\System\tXkZqDL.exe
  2⤵
  PID:10000
- C:\Windows\System\vedvSif.exe
  C:\Windows\System\vedvSif.exe
  2⤵
  PID:10016
- C:\Windows\System\euAuzhk.exe
  C:\Windows\System\euAuzhk.exe
  2⤵
  PID:10032
- C:\Windows\System\lfUTBJA.exe
  C:\Windows\System\lfUTBJA.exe
  2⤵
  PID:10052
- C:\Windows\System\hMsjtmH.exe
  C:\Windows\System\hMsjtmH.exe
  2⤵
  PID:10068
- C:\Windows\System\ABmhjys.exe
  C:\Windows\System\ABmhjys.exe
  2⤵
  PID:10088
- C:\Windows\System\KMnOtUH.exe
  C:\Windows\System\KMnOtUH.exe
  2⤵
  PID:10104
- C:\Windows\System\NLnTFNT.exe
  C:\Windows\System\NLnTFNT.exe
  2⤵
  PID:10120
- C:\Windows\System\uRHYLJP.exe
  C:\Windows\System\uRHYLJP.exe
  2⤵
  PID:10136
- C:\Windows\System\HXLzULH.exe
  C:\Windows\System\HXLzULH.exe
  2⤵
  PID:10152
- C:\Windows\System\gVqcprG.exe
  C:\Windows\System\gVqcprG.exe
  2⤵
  PID:10168
- C:\Windows\System\gOWfsxt.exe
  C:\Windows\System\gOWfsxt.exe
  2⤵
  PID:10184
- C:\Windows\System\GnGLdnk.exe
  C:\Windows\System\GnGLdnk.exe
  2⤵
  PID:10200
- C:\Windows\System\XumSCeK.exe
  C:\Windows\System\XumSCeK.exe
  2⤵
  PID:10216
- C:\Windows\System\KHwgjrT.exe
  C:\Windows\System\KHwgjrT.exe
  2⤵
  PID:10232
- C:\Windows\System\fCDqyGZ.exe
  C:\Windows\System\fCDqyGZ.exe
  2⤵
  PID:8600
- C:\Windows\System\SNbpiUE.exe
  C:\Windows\System\SNbpiUE.exe
  2⤵
  PID:8932
- C:\Windows\System\PvjHOjN.exe
  C:\Windows\System\PvjHOjN.exe
  2⤵
  PID:9248
- C:\Windows\System\rBmcRas.exe
  C:\Windows\System\rBmcRas.exe
  2⤵
  PID:8632
- C:\Windows\System\bNFLWvY.exe
  C:\Windows\System\bNFLWvY.exe
  2⤵
  PID:9312
- C:\Windows\System\ieFPBsy.exe
  C:\Windows\System\ieFPBsy.exe
  2⤵
  PID:9260
- C:\Windows\System\iCsMVbL.exe
  C:\Windows\System\iCsMVbL.exe
  2⤵
  PID:8204
- C:\Windows\System\NRQXJzr.exe
  C:\Windows\System\NRQXJzr.exe
  2⤵
  PID:9228
- C:\Windows\System\nukeISd.exe
  C:\Windows\System\nukeISd.exe
  2⤵
  PID:9296
- C:\Windows\System\ddAsexu.exe
  C:\Windows\System\ddAsexu.exe
  2⤵
  PID:9372
- C:\Windows\System\ODEpVdu.exe
  C:\Windows\System\ODEpVdu.exe
  2⤵
  PID:9436
- C:\Windows\System\zOEFPbB.exe
  C:\Windows\System\zOEFPbB.exe
  2⤵
  PID:9500
- C:\Windows\System\PCoKmiZ.exe
  C:\Windows\System\PCoKmiZ.exe
  2⤵
  PID:9568
- C:\Windows\System\DLQTDXs.exe
  C:\Windows\System\DLQTDXs.exe
  2⤵
  PID:9484
- C:\Windows\System\DLogIEC.exe
  C:\Windows\System\DLogIEC.exe
  2⤵
  PID:9424
- C:\Windows\System\jRckIpn.exe
  C:\Windows\System\jRckIpn.exe
  2⤵
  PID:9488
- C:\Windows\System\edMyUjO.exe
  C:\Windows\System\edMyUjO.exe
  2⤵
  PID:9552
- C:\Windows\System\iAjuzFu.exe
  C:\Windows\System\iAjuzFu.exe
  2⤵
  PID:9604
- C:\Windows\System\IwGVSHG.exe
  C:\Windows\System\IwGVSHG.exe
  2⤵
  PID:9664
- C:\Windows\System\WPvrLOs.exe
  C:\Windows\System\WPvrLOs.exe
  2⤵
  PID:9616
- C:\Windows\System\EOMVxWC.exe
  C:\Windows\System\EOMVxWC.exe
  2⤵
  PID:9620
- C:\Windows\System\GcmslMY.exe
  C:\Windows\System\GcmslMY.exe
  2⤵
  PID:9648
- C:\Windows\System\YWxhDAl.exe
  C:\Windows\System\YWxhDAl.exe
  2⤵
  PID:9776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CHJgDaw.exe

Filesize
2.4MB

MD5
0ad459c1d511674b20974b686c4aa54e

SHA1
b7d2592cfcd21ba879c79f2d8c580156c457fff8

SHA256
e0b563cbb93924d563815920e9e86181c908f462b678ae9a834198ed3b632961

SHA512
3ae541d24eb3921fea63f24418f36e41555750439358811a002fff117c6692319dcff5e556decc064f79399941b9d30f867c469e7651a0a05bbb3b174d9be365

Download Submit
C:\Windows\system\FgDwzck.exe

Filesize
2.4MB

MD5
244e98c302ae19a94ad78c627d6155a0

SHA1
7ef975dcff1dbb3e9f4240b399b16c0b9eb756de

SHA256
2618e34cfec9bfdad76842552a1aa0fcafdea05b58a5f10e09089c40fad38066

SHA512
4f430102a8191c4393fc7a639ee151f97e96b26a4c9b7fb7a00cee3ff7ce85bbb6035ba783856046719e15df4911c8c88f736fd72019cccf133cdb69a62c3836

Download Submit
C:\Windows\system\KBHJDcr.exe

Filesize
2.4MB

MD5
13b6562375b1df35fee90f691ea09368

SHA1
3329e423598c7ad9888a56208ab5e3e0f632b36c

SHA256
5cae9427458bb8f6842c31da98c171430202e48e1a627b9d3b6ac2979e68f8d0

SHA512
ab1b4065810ad05b78410cc90bb6100f30f81cf5be8a1b0bfe42fcbe7aa4c9c528de18921432e1c08cec5fb532de23510d4bcb17c05c295a171aee60e6c68b97

Download Submit
C:\Windows\system\PFkDdac.exe

Filesize
2.4MB

MD5
02a11ec967b02585404e1663d0773d71

SHA1
888a2497502d32df694e70dcb57a5afd35f04512

SHA256
1ba6b2693d643e5936cad8da3ef8020b19aaabfe145f07292a08699070dce2ea

SHA512
fe1d40e578875affabbb23e10635ccbe014b27ae06facab7d4333e48363fbb9c4d9e59532980b2ceb5b65da58759989a20cc8ae1ecf9c26869cf8293255c5b3a

Download Submit
C:\Windows\system\RHNYTYd.exe

Filesize
2.4MB

MD5
f2b7f43dc4a66259fca226b0a860c334

SHA1
6c605bcfd9f1e03279d2c2231e9f5a8aa7879014

SHA256
554e61f50dd5179ba9739a46df7ec705cb36a89ce6151d8521c706bec7a05074

SHA512
2b090d03da9dcf582a0475908066147df31465185a594c51ebd2090a6187ee6d1661763174a2d534edf9b66bf76d80124e005806b16cea58ae08af10c8db9737

Download Submit
C:\Windows\system\SevXqfp.exe

Filesize
2.4MB

MD5
407b2c3bda0affce6cb631f6051c4324

SHA1
094c33ee9b2c76b9b3dac2daaf28e4d926f62074

SHA256
676438488dc69c34c46894b17856e951f38496aefdc949749c1a6f39f2ea1129

SHA512
d948cd25c01fc1fb5f6f4cc7c704aeb2087a22272436f3410644196c828c3bfb5cb7b0471d3fa567f6e2e4682111e5cee9ce52f1859b2c3458b7f3ed56dddf4f

Download Submit
C:\Windows\system\UlDDmbm.exe

Filesize
2.4MB

MD5
888dfd192e72bd9082207cd30961b01a

SHA1
7db5deed581c62f569e9669bc9799a5e6fb868e0

SHA256
9dc3f1b2243cd92bccaa84626f5c72904761c82adea20d5774109e66aaa94f73

SHA512
ca1c0274a3bba58a390064687436251020e6e3b297f6f79ad61e0029f499ee6f136c8b37d471e0df9b8abf1a22202dcc4c95d5fb9be40e76de58454cd5153190

Download Submit
C:\Windows\system\bFEuWTN.exe

Filesize
2.4MB

MD5
e77e02b4cb7bbff90801dac2c348781d

SHA1
4ff4484633f7bcdda386be3a4368c2936b18cb3c

SHA256
d0126457ed8c2b1c9cdeea95be1a1418f83cd0bd2e93b770119b6acfbcccb017

SHA512
64a2af88c87cd3cf211bce9406632b5d9b4b378ee1006bd52af3b5e4672454b9ac3a9dafb20318333f124d2f990a70a77e1b8d67e2fe040f833487e8dfcbedde

Download Submit
C:\Windows\system\hCSTVKc.exe

Filesize
2.4MB

MD5
31f5c3b19c5e21a0357d0bb089722d60

SHA1
1b4ff3f1612d298887ad6243519a66be1a34330c

SHA256
7bdc3c6bace194b1d5441082abcb09dbb23058178ce7a4f41e3fea69723a4ca0

SHA512
87d63a4d25b7c08452177230edb6869a1c4c83ac6ed22bc56f67cba3e3af6dd088694b32fba1407769aa0aa41faeaea8c69c94b0748a3341eab9f9cae1e742b9

Download Submit
C:\Windows\system\ihBDcUC.exe

Filesize
2.4MB

MD5
2b065d93434a9029e98e7656b309ba6f

SHA1
765faccd59a9aa583a4d58c6bb0cce891c11bd5a

SHA256
90dee5af090edf2a6db73e81d0bc0f03e04a21fb87db65fab98c564794ea591e

SHA512
7c5882badf9afcb0c5553ee30ea9c38f9804a07e24f179982db625b55516aab1921fa8ee7f5b0ba77f2d35844289c21439bf270f18f00e44caad0c064c660120

Download Submit
C:\Windows\system\kcceMtn.exe

Filesize
2.4MB

MD5
8d0ae6f96c3ad5c1ec7f1d9aefd3518a

SHA1
0a9751182e7592413bb636a7e8bc66e211a42ed6

SHA256
ea17b02870ef23c779aad72e0af7e70a85f29bb054039fbecfe8c225185dca56

SHA512
219f9ed6291f86d515e68e548f4dd28c170ab7df3714e6df8ffafa1b386fa41280fe4288264fb450ee5f1d6afb3d1f2adb5ede7a47a84024794b2e6a2aba3557

Download Submit
C:\Windows\system\ksraheS.exe

Filesize
2.4MB

MD5
3e40b592ade36134d78087fa35a8cbdf

SHA1
7a8c9c151ed0308da4e8cdb320011221d4f4dff2

SHA256
bb8cc8eac8b2316a7015c2ae08b4c07ca6b47ad8ae6184e1b41f077f6641b530

SHA512
0cb8e95a2aea677fb218a11512c5a59441ef1bbcbf7112ed709ee4952cebedd3198f6c7de2ae3a6a774e1576867faa64ffb5533be3666b3728d7bde05552d711

Download Submit
C:\Windows\system\naWZWwc.exe

Filesize
2.4MB

MD5
7da670e80f814e1fbde4a224944ec54a

SHA1
c49339df468fd0f5ba6af26a2508ff1a65b1f418

SHA256
d4fca87ca86553cf4b078d631cc50b305dc09c251d59abb8a6e480ad6e9c246a

SHA512
801942f4e6868916e2dd051dab840da66c4600c821a0afe01dd3769b50ebd62cffa87d554808436e921206e783d0f109e9eb042875f98d073c290f6e2b4c6bef

Download Submit
C:\Windows\system\oDmKqvh.exe

Filesize
2.4MB

MD5
7a479aa3f0f362c129df1418fde519b7

SHA1
9e7d61f7e37c0312da48c1d205d87d41ccc7620d

SHA256
1f35de218411da555e7e0a6e8feba662428753ff9c20e666399c93c7a9a8018f

SHA512
2efb1b88ec4dded2e1bb1a95406cc06664e3d3df56fed78310d383d1b0836203d81d1ab8e004434a7676fb48a0cdc1e33ef1838b00011dd6e342a2644a6fdc25

Download Submit
C:\Windows\system\rJdTbii.exe

Filesize
2.4MB

MD5
84a5a280dfa2b4a2a7646b1c6acc1525

SHA1
150cedee330fa833cae2b425811c4b847b6660ac

SHA256
6f73e3439ebba9adfa7dcb63d09159d417c41e15665696aba750c368fee4705e

SHA512
ac90cf152c86954a475f7e1b6de78437a773d795de62a190e5985fc75236e25b7ad88eb8cb9c7d21c3dda7a9126169b4f9491e33d2aa2d6cef88701250e12ed2

Download Submit
C:\Windows\system\sEaEeBB.exe

Filesize
2.4MB

MD5
492b01bd23b020c2ba65bf18285d2ac4

SHA1
a403cecdf871ec38371fa41a8f234caadcf48252

SHA256
11658d5f170948567d3c36baa8acdaa0b00a35085c79646f0358fb8be418fb0a

SHA512
f2331b02e89e71e70e294fdb51ab79b96d4a6d48dbfc1ac40771338e1a450fdf9922640d83904c986d2accaa2f6b11f86ac108e3a22871923c84579b8397fda1

Download Submit
C:\Windows\system\sOpeQLu.exe

Filesize
2.4MB

MD5
dbd02170313d256bb7984dbf7999cae2

SHA1
8b40cce2c65e38a8b9519fc36c51ffd077faf2df

SHA256
e159010610ecf3d6f1d94c3d5989f946ccbd9961d7eb90384d65592fa404d4c9

SHA512
17e649f6b823edd2e97640702ddf4eeff91de0310e9ff952fd188edb5d9873ebf7fa3598fdba7f79960c2ba90cf17ffbc4edd48ed48fc4760fabb0eed61e9d94

Download Submit
C:\Windows\system\tHgKnJr.exe

Filesize
2.4MB

MD5
bb014b0288a04580663f7ca97e201dc2

SHA1
bc80b34ac2884eac4e86a47b5812bf9e1fec0320

SHA256
5cbb8458c62d63350f94ee9f33a7a5d7e1be9d29ed12a1532908d97538be79a2

SHA512
f43e2fa779696a082975525d96962f718cd8723b2b67fcb3b84f1a53bd53fd50be3e0218d017f9799a19a4808ac8ce9c1c963aa43d3080e080c9c32d31e6df41

Download Submit
C:\Windows\system\wyIZPox.exe

Filesize
2.4MB

MD5
ce8ff45654ec0333b863414fec11db46

SHA1
70dc03798e69f48fdb9bf3a31e7977616362dcad

SHA256
b343cc9a4eb07b222d88e2846ca972ab39c1e8b6b5d20398f11a6e559a491a53

SHA512
13a7f9dea05f21cecdbe84ca4fe8de3d2da17cb98e1870bb6d08374bd3495567f92c163dd46a70ec981005ed2b357396c13ea53d732af73a67056d5728c2782a

Download Submit
C:\Windows\system\yIxoTtQ.exe

Filesize
2.4MB

MD5
cac1a948c031a24a96eb7c251787e7da

SHA1
57bbed1538a1ef326636ed867c590781155fdf62

SHA256
5b24c79fdd8675ae91d5e2c8d3e493e378a6c6e02d4e13bf5b48f9d4a27bf7fb

SHA512
c9664263fcaab6108701417d31273777186c1d6ea29932d4c22ff20d0afeaec3c75fdeb0148926ec5c631793b3f0c7e50e9e82c9ae885f8906cbda8510ff3fa3

Download Submit
C:\Windows\system\yuORGUF.exe

Filesize
2.4MB

MD5
6d829ae75c952280abb4572526999710

SHA1
ed652b277c5d2e26983c2c85ce3d61d8f194f516

SHA256
c71b87b06e50318d76205f71b1434e8c302105c9277c3884bd94f425c434a086

SHA512
f3fdc09481687b8732f1d7fce16fa573dd5d8e3774443c49c4517a358723bc2f438dd66ad934ec035d308cd36180e3ef31d9015db08e6443e3a70723f0cbc731

Download Submit
\Windows\system\FZblogW.exe

Filesize
2.4MB

MD5
dc63f589d04ba917abed07c848060875

SHA1
ba8cccabec844f535709607fe7a4e64ad0bb1eb2

SHA256
d08e6e19663d4590d5830579b7af14feddec4724cc966340b8ab16591ab5aeb3

SHA512
45a05c85c9b40e0683bcb338976fcc42f8734a10af11135354ac50756e2bcd0b4840d4b355940f92c87248a48918bec8c09f1a393758001f169bae76139b392a

Download Submit
\Windows\system\GVPLCoc.exe

Filesize
2.4MB

MD5
e780351c5403fa0445af44b757873a47

SHA1
aa34cf0f14cdfac90d43e2c73802f361409150cc

SHA256
40e57437920b8fca506cee1fc6cb2fa45ceda8b6da359c09427da77cce020371

SHA512
3963174e83f821d582583e0caef5f5d5d28f850105863f38205772cb7de4a1f9bbb13f95b8cb35d06b0ffc88a7a6cddbd9cd584692c1f30c42a4b8310282d995

Download Submit
\Windows\system\NlLozBp.exe

Filesize
2.4MB

MD5
a9c23eb55922b66caf4f4a41c35f0e54

SHA1
a6bc0b90e2950f7a6b58c499bf56af874435330c

SHA256
a0dc641ddcaf60f987722cc1c1e6790956e5a47275682d051aa3eb23158866b9

SHA512
2c1f97bad72fad98d40044313dc74d66e988d1243269f3ca9e82068c9c94e88a5bf3f19809f2bf6fc1cede528d9a3460c100e5043572c2cec3b76f19e5f6c0a3

Download Submit
\Windows\system\RBSuMCR.exe

Filesize
2.4MB

MD5
19a1edae530b10be6aa151849d2c3eed

SHA1
2618fd39963361755fc813501ac73c036eea4c10

SHA256
7a17d881340882dcd7a936486b0671c3573e17721fb1d838cb175a0c064d610d

SHA512
0ccb0be4185f40773a5b705705b5859ba3eda0cad28af164bfff89d957d0e4f3fc731511b30f533d750e99529aaf44b74bf2522fedbd506ef8d060a387348817

Download Submit
\Windows\system\UZlDGdc.exe

Filesize
2.4MB

MD5
655c275a952fae5a368f60ab4640eed2

SHA1
c256f7f9a85775abe361d17961cd422d3d144792

SHA256
638d1d7120cf1d99273fa7d40cd097085bf2de8de680add7063c0563b2e72cda

SHA512
05b16cb87f3a29df3512716879d3a2c7293c9b0b1511cb6e9c4063a1532e5b6fd33501fc73e5d297d405f117f17792539809987f7f3a79e3c54adfd155c0c90a

Download Submit
\Windows\system\WBTlrTv.exe

Filesize
2.4MB

MD5
d97515c0223617302bb7ee06785f97ae

SHA1
81b45213d2eff8c4476500c2027c094cf9dda886

SHA256
c6e4260f37eb7615ea72f4d60a332e37fccc021f802c730ffe1c7c2a71c00058

SHA512
dd746b7e2a7a061c4051ef9eb2bda765389e5cceec6169e9c043b2501d3393c61a289db457d16336e4dfb4d207e88facccbc07275ea15078b84d7d75802002fa

Download Submit
\Windows\system\hdJrEjQ.exe

Filesize
2.4MB

MD5
ed12782ee25d4504688e1e18e59a6d46

SHA1
3b995c745ba21be36b7f227bc94223cb8001561a

SHA256
5620cdaf48d87f4278a4cdda8cce73bc520b1b50fbd56453b159b530104163b4

SHA512
2591ef7788161028d3b01c4835f1532fea4c27758d4484e81318205683ee40285e26056eb0d8008580151af98b58ae3289d6fb873724108921712075603f40a3

Download Submit
\Windows\system\iRVCNiT.exe

Filesize
2.4MB

MD5
dfff734bf6962d340b3a284e005f3318

SHA1
a9ab16dd654f37a21dd6c0ba5174a1374581be44

SHA256
8d9cc7955ee50b4d26f49e09a76bdb56eb509ce3b0b2048e33ce7dc974564061

SHA512
aac830f9ffb77084a73fb5138e62a1ed724f42664fed621bcbce4dc89d7141fc3117c29c9511af66365101a0fcc7383914e2d90d19d233f72ce6fc49d0ee5285

Download Submit
\Windows\system\iphOgAI.exe

Filesize
2.4MB

MD5
422f99419fb9ec9e588d12c2b5f5fa46

SHA1
1c4f66ee97555a6af4c40aaa87d55fe94e39d496

SHA256
4bd8018f9ab4f3e139f0e827707f6147288faafc94c9e714a7750c2fab12da99

SHA512
4ef2f6063d9df3fcd2c5d81563c635f2293f5e511591178f1c0a941d2aa1ae59dcd769e91828e826dbac75cd20eae02cf1e3448251b297581bf4c96f7baeb4a6

Download Submit
\Windows\system\uVvWePc.exe

Filesize
2.4MB

MD5
7e80ca36e26fced79466a9ad89d3f534

SHA1
f8214603967e6fcb4c3456803a90ed6e63bcf3e3

SHA256
bfcfddb8e14995407da1d6f0bb9c6ddd9d102c8353b1ed252a37bb00a1482b6a

SHA512
9763fad5e26a87809552b291bfaf9df17686665dd295ded5863ec4e650aa1dc77c80862329c074010e811b6366c552cad3e1b7b5b8d1bbaa0426589db81440c6

Download Submit
\Windows\system\vZCitMi.exe

Filesize
2.4MB

MD5
5f296662e6bfc27296b872107383b277

SHA1
c21c9321f97b4e592495ab2dd7aa7a0d4700ca59

SHA256
0a66c48e37add6f75c45ff60693640d58b3a288e329f3651c355dc63aa733df3

SHA512
4875bb8fad8f58df308cb803ce4c42f3fda82a113287e1b0b6ed49a6feb366a77f04810daf8b57e413453d7967ac8826acb95b08b153ba0a57f34023f46ab54f

Download Submit
\Windows\system\zMyvBJf.exe

Filesize
2.4MB

MD5
a861af4328526d0930290eb610d903cf

SHA1
53097e0fbfa8e3edd7e4b8650ef0ff944cd7fad6

SHA256
8c6122743c8e6e9286f9c59ab83bcbcf006a500e9292e5ceb58d38ec51a198ef

SHA512
cf5db5ddee6e34efcb1756e1ed30c80442ed49a13d9a7d47586d9a2afbf02e164b0b4fada4d8bf651087d5555c6869f128760573d5371ab627a314f9658260a9

Download Submit
\Windows\system\zWePgDr.exe

Filesize
2.4MB

MD5
ac79d87a4ed4333c3c02a557ce89460d

SHA1
1707f779bef47a48504b095d476bd0a1937b9719

SHA256
30714e71f3693cb8c7d26eacd2423d113821a33b085dfd3b140a17ac071609c5

SHA512
b879070642671c938471ac1ab0c116c7ef4b9d3ad85bff85c7b3312185b57305f4f1abaeb585efb544affd74b556fa363ae0cdd4d9625de62d0e2182bbba13be

Download Submit
memory/1888-186-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2200-199-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-197-0x0000000003160000-0x0000000003552000-memory.dmp

Filesize
3.9MB

Download
memory/2300-0-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2300-192-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-34-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2300-191-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2300-185-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-194-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-189-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2300-196-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-16-0x000000013F3B0000-0x000000013F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2300-182-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2300-181-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2408-190-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2436-193-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2492-205-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/2492-204-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/2492-1095-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2492-179-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2492-180-0x0000000002DC0000-0x0000000002E40000-memory.dmp

Filesize
512KB

Download
memory/2560-24-0x000000013F3B0000-0x000000013F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-187-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2616-8-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-198-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-188-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2916-195-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download