xmrig | 4ed90ca8f2a87fe553166b6b5d0411d0b61d21ae0f55dd2bf8ae25126e6125d1

Analysis

max time kernel
31s
max time network
30s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
Size

2.2MB
MD5

04880c3c4966fb5faa26c7008b960c94
SHA1

2b5017d678223802fb660d26fd574a796dee9064
SHA256

4ed90ca8f2a87fe553166b6b5d0411d0b61d21ae0f55dd2bf8ae25126e6125d1
SHA512

ef86c33bef68208d87b84a61f4c423ff7c95185a48ba2fb4c686b102c9c429a5b9e54beda19ec37ff150397884b0b83bdebb19bec652e7595802b0ac777c3440
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfp:NABy

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/1564-70-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2404-59-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/2552-58-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/1948-56-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/2560-54-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/2600-47-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2540-44-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig
behavioral1/memory/2256-36-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2724-84-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/1300-91-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2256	pVjvoDc.exe
2540	WVmiMnD.exe
2600	tdlzzwG.exe
1948	uzLLeKx.exe
2560	QInwZbU.exe
2552	RtIYBCR.exe
2404	uLKzPna.exe
2728	OXkqIxV.exe
1564	JCBYzTN.exe
2648	xhObVJu.exe
2724	RIcCjwi.exe
1300	oZanUjc.exe
1020	iQZgWQt.exe
2312	BhQLiRM.exe
112	IgSoOJl.exe
1248	XJqbqaQ.exe
1452	GRqcbaw.exe
2036	DFMegFz.exe
2000	HJyRnKg.exe
3060	nJFoeah.exe
2344	DDqLRrw.exe
2352	LfwLnPT.exe
2064	FyDCmci.exe
972	RtuVtHj.exe
1704	XhJsodh.exe
2220	TPzSvCO.exe
2260	knntLBS.exe
688	hKdzrZg.exe
1392	KNtLWYg.exe
1424	KFOcrlZ.exe
1848	KADwcgg.exe
3012	gLnXzwV.exe
1576	sbPPUQp.exe
452	AXvfHrA.exe
1304	yvDwQyY.exe
864	dsvPWnj.exe
820	CHKTZiU.exe
1868	JyYwDJP.exe
1656	vXfVLXn.exe
844	gKpoSNk.exe
472	pZHDdVe.exe
1608	SsfXiSe.exe
2192	nAdhHjc.exe
1664	OyjCFfB.exe
2484	cBzJSvC.exe
3024	dChHzag.exe
1420	AQAAIrg.exe
2832	XHOVkCF.exe
572	WHfJoFn.exe
1956	ArULjqe.exe
1888	QbsCOwQ.exe
1720	eLBQJOK.exe
2904	kVbhgZv.exe
2952	erxTEtK.exe
2680	vVFDhPi.exe
2548	cJcLWCs.exe
2516	OqJWcxB.exe
2168	jcILnoC.exe
2520	zNloJgQ.exe
2384	ILiqnIu.exe
2916	apZHJpB.exe
1252	aSytTYh.exe
2340	WLPSqna.exe
3016	bRCGNxj.exe

Loads dropped DLL 64 IoCs

pid	Process
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2868-0-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/files/0x000c000000012707-3.dat	upx
behavioral1/files/0x002f000000014c2d-8.dat	upx
behavioral1/files/0x0007000000015662-16.dat	upx
behavioral1/files/0x0007000000015ae3-22.dat	upx
behavioral1/files/0x000a000000015b50-26.dat	upx
behavioral1/files/0x00070000000158d9-19.dat	upx
behavioral1/files/0x00080000000153ee-15.dat	upx
behavioral1/files/0x0009000000015c9a-31.dat	upx
behavioral1/memory/1564-70-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/files/0x0016000000005586-74.dat	upx
behavioral1/memory/2648-76-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/files/0x0007000000015f23-77.dat	upx
behavioral1/memory/2728-62-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2404-59-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/2552-58-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/memory/1948-56-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/memory/2560-54-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/memory/2600-47-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2540-44-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/memory/2256-36-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2724-84-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/files/0x002f000000014f57-88.dat	upx
behavioral1/files/0x0006000000015fa6-94.dat	upx
behavioral1/memory/1300-91-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/files/0x0006000000016013-100.dat	upx
behavioral1/files/0x00060000000163eb-112.dat	upx
behavioral1/files/0x0006000000016575-119.dat	upx
behavioral1/files/0x00060000000164ec-117.dat	upx
behavioral1/files/0x00060000000161ee-108.dat	upx
behavioral1/files/0x0006000000016122-103.dat	upx
behavioral1/files/0x0006000000015d85-66.dat	upx
behavioral1/files/0x0006000000016a28-132.dat	upx
behavioral1/files/0x0006000000016cf3-161.dat	upx
behavioral1/files/0x0006000000016d06-168.dat	upx
behavioral1/files/0x0006000000016c1f-173.dat	upx
behavioral1/files/0x0006000000016cb5-177.dat	upx
behavioral1/files/0x0006000000016cfd-181.dat	upx
behavioral1/files/0x0006000000016d18-189.dat	upx
behavioral1/files/0x0006000000016ce0-167.dat	upx
behavioral1/files/0x0006000000016d10-186.dat	upx
behavioral1/files/0x0006000000016ced-158.dat	upx
behavioral1/files/0x0006000000016c84-151.dat	upx
behavioral1/files/0x0006000000016c30-144.dat	upx
behavioral1/files/0x0006000000016c38-141.dat	upx
behavioral1/files/0x00060000000167bf-137.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HenIEvF.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\qhplYXl.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\AGOzQWd.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\INaAnRC.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\oQndHiJ.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\CiVqRcB.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\LjiIXIB.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\kpyRuBL.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\PeUKaRj.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\dtaBWfL.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\uybnBYh.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\GwVVaNo.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\EcjTUKn.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\gKoiheg.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\iCwWHjD.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\HXhbhai.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\xwAkFgy.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\MezgWxa.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\grNaBLM.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\ItTguRJ.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\OjBEpMG.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\vvLMyhs.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\PtKaAQo.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\PWxtWWx.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\WrEwpwD.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\XOwqykS.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\WLPSqna.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\rjdMKQp.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\eSEqRdS.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\KNtLWYg.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\FqXcgKx.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\uZrOpGo.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\jcILnoC.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\RkDxEUe.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\DkwiVYR.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\eZkaeco.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\LZNzeYk.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\wYoowqt.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\qLEiuvn.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\bramJqf.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\smvItKo.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\LZLNttx.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\jqhmQdk.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\vZLXOpp.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\EmqZgXb.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\MjKsQip.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\vtoGBbZ.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\TlpxXVU.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\UPDzHSR.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\KivhEKa.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\FeDwqvc.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\cZooPyu.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\nilNmDZ.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\DDqLRrw.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\VNEnrLa.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\DZyAFDK.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\sNSMaDi.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\vVJyvxI.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\cHoHpfo.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\lgeTcFO.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\ckGnWBr.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\qwSszCn.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\ANIuSpQ.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\eSxPEfe.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2920	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
Token: SeDebugPrivilege	2920	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2920	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	29
PID 2868 wrote to memory of 2920	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	29
PID 2868 wrote to memory of 2920	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	29
PID 2868 wrote to memory of 2256	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2256	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2256	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2540	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	31
PID 2868 wrote to memory of 2540	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	31
PID 2868 wrote to memory of 2540	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	31
PID 2868 wrote to memory of 2600	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	32
PID 2868 wrote to memory of 2600	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	32
PID 2868 wrote to memory of 2600	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	32
PID 2868 wrote to memory of 2552	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	33
PID 2868 wrote to memory of 2552	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	33
PID 2868 wrote to memory of 2552	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	33
PID 2868 wrote to memory of 1948	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	34
PID 2868 wrote to memory of 1948	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	34
PID 2868 wrote to memory of 1948	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	34
PID 2868 wrote to memory of 2404	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	35
PID 2868 wrote to memory of 2404	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	35
PID 2868 wrote to memory of 2404	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	35
PID 2868 wrote to memory of 2560	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	36
PID 2868 wrote to memory of 2560	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	36
PID 2868 wrote to memory of 2560	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	36
PID 2868 wrote to memory of 2728	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	37
PID 2868 wrote to memory of 2728	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	37
PID 2868 wrote to memory of 2728	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	37
PID 2868 wrote to memory of 1564	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	38
PID 2868 wrote to memory of 1564	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	38
PID 2868 wrote to memory of 1564	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	38
PID 2868 wrote to memory of 2648	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	39
PID 2868 wrote to memory of 2648	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	39
PID 2868 wrote to memory of 2648	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	39
PID 2868 wrote to memory of 2724	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	40
PID 2868 wrote to memory of 2724	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	40
PID 2868 wrote to memory of 2724	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	40
PID 2868 wrote to memory of 1300	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	41
PID 2868 wrote to memory of 1300	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	41
PID 2868 wrote to memory of 1300	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	41
PID 2868 wrote to memory of 1020	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	42
PID 2868 wrote to memory of 1020	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	42
PID 2868 wrote to memory of 1020	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	42
PID 2868 wrote to memory of 2312	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	43
PID 2868 wrote to memory of 2312	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	43
PID 2868 wrote to memory of 2312	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	43
PID 2868 wrote to memory of 112	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	44
PID 2868 wrote to memory of 112	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	44
PID 2868 wrote to memory of 112	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	44
PID 2868 wrote to memory of 1248	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	45
PID 2868 wrote to memory of 1248	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	45
PID 2868 wrote to memory of 1248	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	45
PID 2868 wrote to memory of 1452	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	46
PID 2868 wrote to memory of 1452	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	46
PID 2868 wrote to memory of 1452	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	46
PID 2868 wrote to memory of 2036	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	47
PID 2868 wrote to memory of 2036	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	47
PID 2868 wrote to memory of 2036	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	47
PID 2868 wrote to memory of 2000	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	48
PID 2868 wrote to memory of 2000	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	48
PID 2868 wrote to memory of 2000	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	48
PID 2868 wrote to memory of 2344	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	49
PID 2868 wrote to memory of 2344	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	49
PID 2868 wrote to memory of 2344	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	49
PID 2868 wrote to memory of 3060	2868	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\System\pVjvoDc.exe
  C:\Windows\System\pVjvoDc.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\WVmiMnD.exe
  C:\Windows\System\WVmiMnD.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\tdlzzwG.exe
  C:\Windows\System\tdlzzwG.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\RtIYBCR.exe
  C:\Windows\System\RtIYBCR.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\uzLLeKx.exe
  C:\Windows\System\uzLLeKx.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\uLKzPna.exe
  C:\Windows\System\uLKzPna.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\QInwZbU.exe
  C:\Windows\System\QInwZbU.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\OXkqIxV.exe
  C:\Windows\System\OXkqIxV.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\JCBYzTN.exe
  C:\Windows\System\JCBYzTN.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\xhObVJu.exe
  C:\Windows\System\xhObVJu.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\RIcCjwi.exe
  C:\Windows\System\RIcCjwi.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\oZanUjc.exe
  C:\Windows\System\oZanUjc.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\iQZgWQt.exe
  C:\Windows\System\iQZgWQt.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\BhQLiRM.exe
  C:\Windows\System\BhQLiRM.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\IgSoOJl.exe
  C:\Windows\System\IgSoOJl.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\XJqbqaQ.exe
  C:\Windows\System\XJqbqaQ.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\GRqcbaw.exe
  C:\Windows\System\GRqcbaw.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\DFMegFz.exe
  C:\Windows\System\DFMegFz.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\HJyRnKg.exe
  C:\Windows\System\HJyRnKg.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\DDqLRrw.exe
  C:\Windows\System\DDqLRrw.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\nJFoeah.exe
  C:\Windows\System\nJFoeah.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\TPzSvCO.exe
  C:\Windows\System\TPzSvCO.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\LfwLnPT.exe
  C:\Windows\System\LfwLnPT.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\knntLBS.exe
  C:\Windows\System\knntLBS.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\FyDCmci.exe
  C:\Windows\System\FyDCmci.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\hKdzrZg.exe
  C:\Windows\System\hKdzrZg.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\RtuVtHj.exe
  C:\Windows\System\RtuVtHj.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\KNtLWYg.exe
  C:\Windows\System\KNtLWYg.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\XhJsodh.exe
  C:\Windows\System\XhJsodh.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\KFOcrlZ.exe
  C:\Windows\System\KFOcrlZ.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\KADwcgg.exe
  C:\Windows\System\KADwcgg.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\AXvfHrA.exe
  C:\Windows\System\AXvfHrA.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\gLnXzwV.exe
  C:\Windows\System\gLnXzwV.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\dsvPWnj.exe
  C:\Windows\System\dsvPWnj.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\sbPPUQp.exe
  C:\Windows\System\sbPPUQp.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\JyYwDJP.exe
  C:\Windows\System\JyYwDJP.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\yvDwQyY.exe
  C:\Windows\System\yvDwQyY.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\vXfVLXn.exe
  C:\Windows\System\vXfVLXn.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\CHKTZiU.exe
  C:\Windows\System\CHKTZiU.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\gKpoSNk.exe
  C:\Windows\System\gKpoSNk.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\pZHDdVe.exe
  C:\Windows\System\pZHDdVe.exe
  2⤵
  - Executes dropped EXE
  PID:472
- C:\Windows\System\SsfXiSe.exe
  C:\Windows\System\SsfXiSe.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\nAdhHjc.exe
  C:\Windows\System\nAdhHjc.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\OyjCFfB.exe
  C:\Windows\System\OyjCFfB.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\cBzJSvC.exe
  C:\Windows\System\cBzJSvC.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\XHOVkCF.exe
  C:\Windows\System\XHOVkCF.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\dChHzag.exe
  C:\Windows\System\dChHzag.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\WHfJoFn.exe
  C:\Windows\System\WHfJoFn.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\AQAAIrg.exe
  C:\Windows\System\AQAAIrg.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\ArULjqe.exe
  C:\Windows\System\ArULjqe.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\QbsCOwQ.exe
  C:\Windows\System\QbsCOwQ.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\eLBQJOK.exe
  C:\Windows\System\eLBQJOK.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\kVbhgZv.exe
  C:\Windows\System\kVbhgZv.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\erxTEtK.exe
  C:\Windows\System\erxTEtK.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\vVFDhPi.exe
  C:\Windows\System\vVFDhPi.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\cJcLWCs.exe
  C:\Windows\System\cJcLWCs.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\OqJWcxB.exe
  C:\Windows\System\OqJWcxB.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\jcILnoC.exe
  C:\Windows\System\jcILnoC.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\zNloJgQ.exe
  C:\Windows\System\zNloJgQ.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\ILiqnIu.exe
  C:\Windows\System\ILiqnIu.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\apZHJpB.exe
  C:\Windows\System\apZHJpB.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\aSytTYh.exe
  C:\Windows\System\aSytTYh.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\WLPSqna.exe
  C:\Windows\System\WLPSqna.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\bRCGNxj.exe
  C:\Windows\System\bRCGNxj.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\dYzjbNp.exe
  C:\Windows\System\dYzjbNp.exe
  2⤵
  PID:1636
- C:\Windows\System\sNXxfnj.exe
  C:\Windows\System\sNXxfnj.exe
  2⤵
  PID:2188
- C:\Windows\System\uQYQhoR.exe
  C:\Windows\System\uQYQhoR.exe
  2⤵
  PID:1668
- C:\Windows\System\mbhZKLc.exe
  C:\Windows\System\mbhZKLc.exe
  2⤵
  PID:2688
- C:\Windows\System\VYxAwMq.exe
  C:\Windows\System\VYxAwMq.exe
  2⤵
  PID:2204
- C:\Windows\System\qNUnnem.exe
  C:\Windows\System\qNUnnem.exe
  2⤵
  PID:2436
- C:\Windows\System\JgFwMve.exe
  C:\Windows\System\JgFwMve.exe
  2⤵
  PID:668
- C:\Windows\System\QyjlkWp.exe
  C:\Windows\System\QyjlkWp.exe
  2⤵
  PID:1548
- C:\Windows\System\UzGUUPs.exe
  C:\Windows\System\UzGUUPs.exe
  2⤵
  PID:1124
- C:\Windows\System\RiQdSQc.exe
  C:\Windows\System\RiQdSQc.exe
  2⤵
  PID:2572
- C:\Windows\System\gaYkWJC.exe
  C:\Windows\System\gaYkWJC.exe
  2⤵
  PID:3004
- C:\Windows\System\YvbJKZL.exe
  C:\Windows\System\YvbJKZL.exe
  2⤵
  PID:412
- C:\Windows\System\SWHZhiD.exe
  C:\Windows\System\SWHZhiD.exe
  2⤵
  PID:1064
- C:\Windows\System\fxtpTPF.exe
  C:\Windows\System\fxtpTPF.exe
  2⤵
  PID:1680
- C:\Windows\System\iBJlpQD.exe
  C:\Windows\System\iBJlpQD.exe
  2⤵
  PID:956
- C:\Windows\System\BUFtxNB.exe
  C:\Windows\System\BUFtxNB.exe
  2⤵
  PID:616
- C:\Windows\System\dMktrFh.exe
  C:\Windows\System\dMktrFh.exe
  2⤵
  PID:1912
- C:\Windows\System\zxwLDtx.exe
  C:\Windows\System\zxwLDtx.exe
  2⤵
  PID:2156
- C:\Windows\System\buSNnJj.exe
  C:\Windows\System\buSNnJj.exe
  2⤵
  PID:2844
- C:\Windows\System\VXnrIFF.exe
  C:\Windows\System\VXnrIFF.exe
  2⤵
  PID:2936
- C:\Windows\System\HpFVTUz.exe
  C:\Windows\System\HpFVTUz.exe
  2⤵
  PID:2084
- C:\Windows\System\FEKPoly.exe
  C:\Windows\System\FEKPoly.exe
  2⤵
  PID:1532
- C:\Windows\System\bvjEAAx.exe
  C:\Windows\System\bvjEAAx.exe
  2⤵
  PID:1176
- C:\Windows\System\kSORTqM.exe
  C:\Windows\System\kSORTqM.exe
  2⤵
  PID:1416
- C:\Windows\System\IYysNMe.exe
  C:\Windows\System\IYysNMe.exe
  2⤵
  PID:1928
- C:\Windows\System\gwYrxeV.exe
  C:\Windows\System\gwYrxeV.exe
  2⤵
  PID:1484
- C:\Windows\System\CMThFGz.exe
  C:\Windows\System\CMThFGz.exe
  2⤵
  PID:860
- C:\Windows\System\toAnOQc.exe
  C:\Windows\System\toAnOQc.exe
  2⤵
  PID:2820
- C:\Windows\System\kjzyjcl.exe
  C:\Windows\System\kjzyjcl.exe
  2⤵
  PID:2628
- C:\Windows\System\kpyRuBL.exe
  C:\Windows\System\kpyRuBL.exe
  2⤵
  PID:2524
- C:\Windows\System\HwYJIWd.exe
  C:\Windows\System\HwYJIWd.exe
  2⤵
  PID:2512
- C:\Windows\System\iZMVNuy.exe
  C:\Windows\System\iZMVNuy.exe
  2⤵
  PID:2324
- C:\Windows\System\ELkcWlc.exe
  C:\Windows\System\ELkcWlc.exe
  2⤵
  PID:1028
- C:\Windows\System\YRFHXXU.exe
  C:\Windows\System\YRFHXXU.exe
  2⤵
  PID:2756
- C:\Windows\System\RkDxEUe.exe
  C:\Windows\System\RkDxEUe.exe
  2⤵
  PID:2620
- C:\Windows\System\yWWdsjP.exe
  C:\Windows\System\yWWdsjP.exe
  2⤵
  PID:2452
- C:\Windows\System\fIorSuE.exe
  C:\Windows\System\fIorSuE.exe
  2⤵
  PID:1268
- C:\Windows\System\TKltrMA.exe
  C:\Windows\System\TKltrMA.exe
  2⤵
  PID:3040
- C:\Windows\System\kmasCil.exe
  C:\Windows\System\kmasCil.exe
  2⤵
  PID:1468
- C:\Windows\System\rHGgkJu.exe
  C:\Windows\System\rHGgkJu.exe
  2⤵
  PID:2992
- C:\Windows\System\GZqZpko.exe
  C:\Windows\System\GZqZpko.exe
  2⤵
  PID:1584
- C:\Windows\System\FYZMeit.exe
  C:\Windows\System\FYZMeit.exe
  2⤵
  PID:2536
- C:\Windows\System\ZapyedJ.exe
  C:\Windows\System\ZapyedJ.exe
  2⤵
  PID:1348
- C:\Windows\System\TnDmqiv.exe
  C:\Windows\System\TnDmqiv.exe
  2⤵
  PID:3064
- C:\Windows\System\ROGyeRN.exe
  C:\Windows\System\ROGyeRN.exe
  2⤵
  PID:2496
- C:\Windows\System\uqhhvBl.exe
  C:\Windows\System\uqhhvBl.exe
  2⤵
  PID:2360
- C:\Windows\System\PoYIuff.exe
  C:\Windows\System\PoYIuff.exe
  2⤵
  PID:332
- C:\Windows\System\eqVePSI.exe
  C:\Windows\System\eqVePSI.exe
  2⤵
  PID:3020
- C:\Windows\System\CsqxFgS.exe
  C:\Windows\System\CsqxFgS.exe
  2⤵
  PID:1080
- C:\Windows\System\gBZUouS.exe
  C:\Windows\System\gBZUouS.exe
  2⤵
  PID:2908
- C:\Windows\System\RHCLkTl.exe
  C:\Windows\System\RHCLkTl.exe
  2⤵
  PID:2432
- C:\Windows\System\QMKAWif.exe
  C:\Windows\System\QMKAWif.exe
  2⤵
  PID:3132
- C:\Windows\System\ytntZhw.exe
  C:\Windows\System\ytntZhw.exe
  2⤵
  PID:3152
- C:\Windows\System\QGUoWGX.exe
  C:\Windows\System\QGUoWGX.exe
  2⤵
  PID:3180
- C:\Windows\System\WlqmEcQ.exe
  C:\Windows\System\WlqmEcQ.exe
  2⤵
  PID:3212
- C:\Windows\System\YKEQjrh.exe
  C:\Windows\System\YKEQjrh.exe
  2⤵
  PID:3248
- C:\Windows\System\XXGNGGQ.exe
  C:\Windows\System\XXGNGGQ.exe
  2⤵
  PID:3268
- C:\Windows\System\sqCjQug.exe
  C:\Windows\System\sqCjQug.exe
  2⤵
  PID:3284
- C:\Windows\System\PUFURgI.exe
  C:\Windows\System\PUFURgI.exe
  2⤵
  PID:3304
- C:\Windows\System\VVTMqwx.exe
  C:\Windows\System\VVTMqwx.exe
  2⤵
  PID:3324
- C:\Windows\System\sSsSNET.exe
  C:\Windows\System\sSsSNET.exe
  2⤵
  PID:3340
- C:\Windows\System\elgrhcl.exe
  C:\Windows\System\elgrhcl.exe
  2⤵
  PID:3356
- C:\Windows\System\KMwAbQo.exe
  C:\Windows\System\KMwAbQo.exe
  2⤵
  PID:3376
- C:\Windows\System\UPDzHSR.exe
  C:\Windows\System\UPDzHSR.exe
  2⤵
  PID:3404
- C:\Windows\System\YRYYmol.exe
  C:\Windows\System\YRYYmol.exe
  2⤵
  PID:3424
- C:\Windows\System\nxaVBST.exe
  C:\Windows\System\nxaVBST.exe
  2⤵
  PID:3448
- C:\Windows\System\ZDVOiXg.exe
  C:\Windows\System\ZDVOiXg.exe
  2⤵
  PID:3464
- C:\Windows\System\ffXZvnZ.exe
  C:\Windows\System\ffXZvnZ.exe
  2⤵
  PID:3488
- C:\Windows\System\tCNeCGK.exe
  C:\Windows\System\tCNeCGK.exe
  2⤵
  PID:3504
- C:\Windows\System\hdGHTlM.exe
  C:\Windows\System\hdGHTlM.exe
  2⤵
  PID:3528
- C:\Windows\System\ZOSTvbS.exe
  C:\Windows\System\ZOSTvbS.exe
  2⤵
  PID:3544
- C:\Windows\System\QxNRoim.exe
  C:\Windows\System\QxNRoim.exe
  2⤵
  PID:3568
- C:\Windows\System\yvLHmeZ.exe
  C:\Windows\System\yvLHmeZ.exe
  2⤵
  PID:3588
- C:\Windows\System\yHpdCZD.exe
  C:\Windows\System\yHpdCZD.exe
  2⤵
  PID:3604
- C:\Windows\System\McvbYND.exe
  C:\Windows\System\McvbYND.exe
  2⤵
  PID:3632
- C:\Windows\System\TUpSuFt.exe
  C:\Windows\System\TUpSuFt.exe
  2⤵
  PID:3648
- C:\Windows\System\AsLvujV.exe
  C:\Windows\System\AsLvujV.exe
  2⤵
  PID:3664
- C:\Windows\System\wnrCBaw.exe
  C:\Windows\System\wnrCBaw.exe
  2⤵
  PID:3680
- C:\Windows\System\TkhFJHX.exe
  C:\Windows\System\TkhFJHX.exe
  2⤵
  PID:3708
- C:\Windows\System\NklssQp.exe
  C:\Windows\System\NklssQp.exe
  2⤵
  PID:3724
- C:\Windows\System\PtKaAQo.exe
  C:\Windows\System\PtKaAQo.exe
  2⤵
  PID:3748
- C:\Windows\System\vJnElRG.exe
  C:\Windows\System\vJnElRG.exe
  2⤵
  PID:3768
- C:\Windows\System\pkBfhrm.exe
  C:\Windows\System\pkBfhrm.exe
  2⤵
  PID:3788
- C:\Windows\System\WRDvtcf.exe
  C:\Windows\System\WRDvtcf.exe
  2⤵
  PID:3812
- C:\Windows\System\LKYbLBM.exe
  C:\Windows\System\LKYbLBM.exe
  2⤵
  PID:3832
- C:\Windows\System\XohjaAI.exe
  C:\Windows\System\XohjaAI.exe
  2⤵
  PID:3852
- C:\Windows\System\PmqZddC.exe
  C:\Windows\System\PmqZddC.exe
  2⤵
  PID:3872
- C:\Windows\System\ACwPyjb.exe
  C:\Windows\System\ACwPyjb.exe
  2⤵
  PID:3888
- C:\Windows\System\uMZhKRD.exe
  C:\Windows\System\uMZhKRD.exe
  2⤵
  PID:3904
- C:\Windows\System\MmtqJNz.exe
  C:\Windows\System\MmtqJNz.exe
  2⤵
  PID:3920
- C:\Windows\System\pLWHUvD.exe
  C:\Windows\System\pLWHUvD.exe
  2⤵
  PID:3936
- C:\Windows\System\YeXyUEW.exe
  C:\Windows\System\YeXyUEW.exe
  2⤵
  PID:3952
- C:\Windows\System\OqKBglJ.exe
  C:\Windows\System\OqKBglJ.exe
  2⤵
  PID:3968
- C:\Windows\System\RjFcjRy.exe
  C:\Windows\System\RjFcjRy.exe
  2⤵
  PID:3984
- C:\Windows\System\rrkSqFR.exe
  C:\Windows\System\rrkSqFR.exe
  2⤵
  PID:4000
- C:\Windows\System\WMzMuUI.exe
  C:\Windows\System\WMzMuUI.exe
  2⤵
  PID:4020
- C:\Windows\System\eKMQbOB.exe
  C:\Windows\System\eKMQbOB.exe
  2⤵
  PID:4036
- C:\Windows\System\fcpoflq.exe
  C:\Windows\System\fcpoflq.exe
  2⤵
  PID:2396
- C:\Windows\System\UCSESbr.exe
  C:\Windows\System\UCSESbr.exe
  2⤵
  PID:1916
- C:\Windows\System\mMIOunN.exe
  C:\Windows\System\mMIOunN.exe
  2⤵
  PID:2900
- C:\Windows\System\iuztQEN.exe
  C:\Windows\System\iuztQEN.exe
  2⤵
  PID:1260
- C:\Windows\System\pMHRcJj.exe
  C:\Windows\System\pMHRcJj.exe
  2⤵
  PID:2200
- C:\Windows\System\WIFxomJ.exe
  C:\Windows\System\WIFxomJ.exe
  2⤵
  PID:2016
- C:\Windows\System\HIdoxgp.exe
  C:\Windows\System\HIdoxgp.exe
  2⤵
  PID:980
- C:\Windows\System\aRReJYR.exe
  C:\Windows\System\aRReJYR.exe
  2⤵
  PID:2500
- C:\Windows\System\hewzWNb.exe
  C:\Windows\System\hewzWNb.exe
  2⤵
  PID:3088
- C:\Windows\System\rsGcMjC.exe
  C:\Windows\System\rsGcMjC.exe
  2⤵
  PID:3104
- C:\Windows\System\sneRIZs.exe
  C:\Windows\System\sneRIZs.exe
  2⤵
  PID:3120
- C:\Windows\System\zzvVCJd.exe
  C:\Windows\System\zzvVCJd.exe
  2⤵
  PID:2508
- C:\Windows\System\tHtlwYi.exe
  C:\Windows\System\tHtlwYi.exe
  2⤵
  PID:1516
- C:\Windows\System\PYPgqIz.exe
  C:\Windows\System\PYPgqIz.exe
  2⤵
  PID:3172
- C:\Windows\System\sWNnYCl.exe
  C:\Windows\System\sWNnYCl.exe
  2⤵
  PID:2720
- C:\Windows\System\PeUKaRj.exe
  C:\Windows\System\PeUKaRj.exe
  2⤵
  PID:588
- C:\Windows\System\ZbJbvpq.exe
  C:\Windows\System\ZbJbvpq.exe
  2⤵
  PID:2024
- C:\Windows\System\nrlaQIy.exe
  C:\Windows\System\nrlaQIy.exe
  2⤵
  PID:1448
- C:\Windows\System\YEvDjYP.exe
  C:\Windows\System\YEvDjYP.exe
  2⤵
  PID:892
- C:\Windows\System\piNztby.exe
  C:\Windows\System\piNztby.exe
  2⤵
  PID:2644
- C:\Windows\System\CnnMJgx.exe
  C:\Windows\System\CnnMJgx.exe
  2⤵
  PID:1936
- C:\Windows\System\zXfRQes.exe
  C:\Windows\System\zXfRQes.exe
  2⤵
  PID:608
- C:\Windows\System\BQCOkqy.exe
  C:\Windows\System\BQCOkqy.exe
  2⤵
  PID:3140
- C:\Windows\System\mDrEtHt.exe
  C:\Windows\System\mDrEtHt.exe
  2⤵
  PID:3188
- C:\Windows\System\bAWQsHl.exe
  C:\Windows\System\bAWQsHl.exe
  2⤵
  PID:3208
- C:\Windows\System\ErvsfzY.exe
  C:\Windows\System\ErvsfzY.exe
  2⤵
  PID:2212
- C:\Windows\System\pmMhfRH.exe
  C:\Windows\System\pmMhfRH.exe
  2⤵
  PID:2852
- C:\Windows\System\vTNjQkV.exe
  C:\Windows\System\vTNjQkV.exe
  2⤵
  PID:1228
- C:\Windows\System\cDBMIMU.exe
  C:\Windows\System\cDBMIMU.exe
  2⤵
  PID:3256
- C:\Windows\System\OMkFtOk.exe
  C:\Windows\System\OMkFtOk.exe
  2⤵
  PID:3260
- C:\Windows\System\KiRNotL.exe
  C:\Windows\System\KiRNotL.exe
  2⤵
  PID:3296
- C:\Windows\System\uBxDroH.exe
  C:\Windows\System\uBxDroH.exe
  2⤵
  PID:3316
- C:\Windows\System\siPvTzq.exe
  C:\Windows\System\siPvTzq.exe
  2⤵
  PID:3332
- C:\Windows\System\MEVaadT.exe
  C:\Windows\System\MEVaadT.exe
  2⤵
  PID:3352
- C:\Windows\System\KTkqahE.exe
  C:\Windows\System\KTkqahE.exe
  2⤵
  PID:3384
- C:\Windows\System\jszWvib.exe
  C:\Windows\System\jszWvib.exe
  2⤵
  PID:3400
- C:\Windows\System\DkwiVYR.exe
  C:\Windows\System\DkwiVYR.exe
  2⤵
  PID:3388
- C:\Windows\System\ssPdQMs.exe
  C:\Windows\System\ssPdQMs.exe
  2⤵
  PID:3420
- C:\Windows\System\QRFSWkj.exe
  C:\Windows\System\QRFSWkj.exe
  2⤵
  PID:3444
- C:\Windows\System\EWoyyvw.exe
  C:\Windows\System\EWoyyvw.exe
  2⤵
  PID:1996
- C:\Windows\System\dwzWpql.exe
  C:\Windows\System\dwzWpql.exe
  2⤵
  PID:3480
- C:\Windows\System\imbIJnw.exe
  C:\Windows\System\imbIJnw.exe
  2⤵
  PID:3576
- C:\Windows\System\xLGDyAd.exe
  C:\Windows\System\xLGDyAd.exe
  2⤵
  PID:3596
- C:\Windows\System\OctnfLT.exe
  C:\Windows\System\OctnfLT.exe
  2⤵
  PID:2132
- C:\Windows\System\tUcAAaF.exe
  C:\Windows\System\tUcAAaF.exe
  2⤵
  PID:3620
- C:\Windows\System\vRIFCeU.exe
  C:\Windows\System\vRIFCeU.exe
  2⤵
  PID:2144
- C:\Windows\System\xwAkFgy.exe
  C:\Windows\System\xwAkFgy.exe
  2⤵
  PID:1352
- C:\Windows\System\gQEjXwZ.exe
  C:\Windows\System\gQEjXwZ.exe
  2⤵
  PID:1408
- C:\Windows\System\tagYuyI.exe
  C:\Windows\System\tagYuyI.exe
  2⤵
  PID:3704
- C:\Windows\System\jPefPnJ.exe
  C:\Windows\System\jPefPnJ.exe
  2⤵
  PID:3732
- C:\Windows\System\WywqnoH.exe
  C:\Windows\System\WywqnoH.exe
  2⤵
  PID:3736
- C:\Windows\System\xPNIbVu.exe
  C:\Windows\System\xPNIbVu.exe
  2⤵
  PID:3776
- C:\Windows\System\wfwfJIQ.exe
  C:\Windows\System\wfwfJIQ.exe
  2⤵
  PID:3804
- C:\Windows\System\ughuMbl.exe
  C:\Windows\System\ughuMbl.exe
  2⤵
  PID:3820
- C:\Windows\System\qmrKVaO.exe
  C:\Windows\System\qmrKVaO.exe
  2⤵
  PID:3848
- C:\Windows\System\LjoaYfP.exe
  C:\Windows\System\LjoaYfP.exe
  2⤵
  PID:3868
- C:\Windows\System\thVJhXA.exe
  C:\Windows\System\thVJhXA.exe
  2⤵
  PID:1884
- C:\Windows\System\MnnjKsj.exe
  C:\Windows\System\MnnjKsj.exe
  2⤵
  PID:2664
- C:\Windows\System\COLRHhn.exe
  C:\Windows\System\COLRHhn.exe
  2⤵
  PID:2476
- C:\Windows\System\WhMjphx.exe
  C:\Windows\System\WhMjphx.exe
  2⤵
  PID:1748
- C:\Windows\System\VNAcstD.exe
  C:\Windows\System\VNAcstD.exe
  2⤵
  PID:4032
- C:\Windows\System\KEBfgZe.exe
  C:\Windows\System\KEBfgZe.exe
  2⤵
  PID:3916
- C:\Windows\System\GHBlvoq.exe
  C:\Windows\System\GHBlvoq.exe
  2⤵
  PID:3948
- C:\Windows\System\QTtDgEv.exe
  C:\Windows\System\QTtDgEv.exe
  2⤵
  PID:4044
- C:\Windows\System\sHTfGNc.exe
  C:\Windows\System\sHTfGNc.exe
  2⤵
  PID:4072
- C:\Windows\System\cpOtUMg.exe
  C:\Windows\System\cpOtUMg.exe
  2⤵
  PID:4088
- C:\Windows\System\dcdyKOJ.exe
  C:\Windows\System\dcdyKOJ.exe
  2⤵
  PID:2736
- C:\Windows\System\GsUXsqN.exe
  C:\Windows\System\GsUXsqN.exe
  2⤵
  PID:2944
- C:\Windows\System\rslADjh.exe
  C:\Windows\System\rslADjh.exe
  2⤵
  PID:3096
- C:\Windows\System\XRwlTDa.exe
  C:\Windows\System\XRwlTDa.exe
  2⤵
  PID:3128
- C:\Windows\System\AmeDhmI.exe
  C:\Windows\System\AmeDhmI.exe
  2⤵
  PID:1896
- C:\Windows\System\VmMPnVH.exe
  C:\Windows\System\VmMPnVH.exe
  2⤵
  PID:1192
- C:\Windows\System\iLqXwDC.exe
  C:\Windows\System\iLqXwDC.exe
  2⤵
  PID:3116
- C:\Windows\System\jXSwlej.exe
  C:\Windows\System\jXSwlej.exe
  2⤵
  PID:3164
- C:\Windows\System\POaInuv.exe
  C:\Windows\System\POaInuv.exe
  2⤵
  PID:2072
- C:\Windows\System\mQmOUwF.exe
  C:\Windows\System\mQmOUwF.exe
  2⤵
  PID:3240
- C:\Windows\System\jHkAaUW.exe
  C:\Windows\System\jHkAaUW.exe
  2⤵
  PID:3244
- C:\Windows\System\XXbzUKC.exe
  C:\Windows\System\XXbzUKC.exe
  2⤵
  PID:3364
- C:\Windows\System\bWPzicS.exe
  C:\Windows\System\bWPzicS.exe
  2⤵
  PID:324
- C:\Windows\System\AbGuNnN.exe
  C:\Windows\System\AbGuNnN.exe
  2⤵
  PID:3460
- C:\Windows\System\jvTTayq.exe
  C:\Windows\System\jvTTayq.exe
  2⤵
  PID:2116
- C:\Windows\System\OIcCssz.exe
  C:\Windows\System\OIcCssz.exe
  2⤵
  PID:1908
- C:\Windows\System\gKoiheg.exe
  C:\Windows\System\gKoiheg.exe
  2⤵
  PID:3540
- C:\Windows\System\mAMeNkE.exe
  C:\Windows\System\mAMeNkE.exe
  2⤵
  PID:3644
- C:\Windows\System\iYHkUGC.exe
  C:\Windows\System\iYHkUGC.exe
  2⤵
  PID:3716
- C:\Windows\System\QAhLakx.exe
  C:\Windows\System\QAhLakx.exe
  2⤵
  PID:3764
- C:\Windows\System\nerOIkm.exe
  C:\Windows\System\nerOIkm.exe
  2⤵
  PID:3844
- C:\Windows\System\xBQbhBH.exe
  C:\Windows\System\xBQbhBH.exe
  2⤵
  PID:3996
- C:\Windows\System\mntuEqb.exe
  C:\Windows\System\mntuEqb.exe
  2⤵
  PID:4052
- C:\Windows\System\mPbONJg.exe
  C:\Windows\System\mPbONJg.exe
  2⤵
  PID:4084
- C:\Windows\System\FxaBUOK.exe
  C:\Windows\System\FxaBUOK.exe
  2⤵
  PID:2748
- C:\Windows\System\zhchzIL.exe
  C:\Windows\System\zhchzIL.exe
  2⤵
  PID:3068
- C:\Windows\System\uMaCkxk.exe
  C:\Windows\System\uMaCkxk.exe
  2⤵
  PID:3624
- C:\Windows\System\oLxhzAq.exe
  C:\Windows\System\oLxhzAq.exe
  2⤵
  PID:696
- C:\Windows\System\OamdUaB.exe
  C:\Windows\System\OamdUaB.exe
  2⤵
  PID:3744
- C:\Windows\System\wjqPBkr.exe
  C:\Windows\System\wjqPBkr.exe
  2⤵
  PID:2292
- C:\Windows\System\Vjabrfu.exe
  C:\Windows\System\Vjabrfu.exe
  2⤵
  PID:3960
- C:\Windows\System\ZdeMlCu.exe
  C:\Windows\System\ZdeMlCu.exe
  2⤵
  PID:3176
- C:\Windows\System\tQyWGbt.exe
  C:\Windows\System\tQyWGbt.exe
  2⤵
  PID:2956
- C:\Windows\System\FPrYngA.exe
  C:\Windows\System\FPrYngA.exe
  2⤵
  PID:4064
- C:\Windows\System\gGelkhL.exe
  C:\Windows\System\gGelkhL.exe
  2⤵
  PID:4060
- C:\Windows\System\aDssZxx.exe
  C:\Windows\System\aDssZxx.exe
  2⤵
  PID:3100
- C:\Windows\System\SVHyURM.exe
  C:\Windows\System\SVHyURM.exe
  2⤵
  PID:908
- C:\Windows\System\QnVFGIV.exe
  C:\Windows\System\QnVFGIV.exe
  2⤵
  PID:800
- C:\Windows\System\xnsOXhY.exe
  C:\Windows\System\xnsOXhY.exe
  2⤵
  PID:3220
- C:\Windows\System\MCSXygS.exe
  C:\Windows\System\MCSXygS.exe
  2⤵
  PID:2676
- C:\Windows\System\itAncdj.exe
  C:\Windows\System\itAncdj.exe
  2⤵
  PID:3276
- C:\Windows\System\qIOtEZV.exe
  C:\Windows\System\qIOtEZV.exe
  2⤵
  PID:3336
- C:\Windows\System\sDpxJWk.exe
  C:\Windows\System\sDpxJWk.exe
  2⤵
  PID:1944
- C:\Windows\System\beYIsSk.exe
  C:\Windows\System\beYIsSk.exe
  2⤵
  PID:1540
- C:\Windows\System\LZNzeYk.exe
  C:\Windows\System\LZNzeYk.exe
  2⤵
  PID:1904
- C:\Windows\System\sGCXysl.exe
  C:\Windows\System\sGCXysl.exe
  2⤵
  PID:2564
- C:\Windows\System\bgvZjby.exe
  C:\Windows\System\bgvZjby.exe
  2⤵
  PID:3372
- C:\Windows\System\DahYgvQ.exe
  C:\Windows\System\DahYgvQ.exe
  2⤵
  PID:3084
- C:\Windows\System\WClRCki.exe
  C:\Windows\System\WClRCki.exe
  2⤵
  PID:3536
- C:\Windows\System\QdktOXE.exe
  C:\Windows\System\QdktOXE.exe
  2⤵
  PID:3524
- C:\Windows\System\kdnzCRO.exe
  C:\Windows\System\kdnzCRO.exe
  2⤵
  PID:352
- C:\Windows\System\QQJOUJe.exe
  C:\Windows\System\QQJOUJe.exe
  2⤵
  PID:3808
- C:\Windows\System\ZKRWWXk.exe
  C:\Windows\System\ZKRWWXk.exe
  2⤵
  PID:2636
- C:\Windows\System\vZLXOpp.exe
  C:\Windows\System\vZLXOpp.exe
  2⤵
  PID:612
- C:\Windows\System\XQiDwQy.exe
  C:\Windows\System\XQiDwQy.exe
  2⤵
  PID:3696
- C:\Windows\System\hQiQTKT.exe
  C:\Windows\System\hQiQTKT.exe
  2⤵
  PID:2232
- C:\Windows\System\bEKLvHB.exe
  C:\Windows\System\bEKLvHB.exe
  2⤵
  PID:3740
- C:\Windows\System\zyApFcp.exe
  C:\Windows\System\zyApFcp.exe
  2⤵
  PID:2412
- C:\Windows\System\IlIyXrT.exe
  C:\Windows\System\IlIyXrT.exe
  2⤵
  PID:876
- C:\Windows\System\QYJnnhd.exe
  C:\Windows\System\QYJnnhd.exe
  2⤵
  PID:3028
- C:\Windows\System\UbAEKPk.exe
  C:\Windows\System\UbAEKPk.exe
  2⤵
  PID:2884
- C:\Windows\System\lPybrfc.exe
  C:\Windows\System\lPybrfc.exe
  2⤵
  PID:3472
- C:\Windows\System\efsLEoi.exe
  C:\Windows\System\efsLEoi.exe
  2⤵
  PID:3160
- C:\Windows\System\BIBDdMl.exe
  C:\Windows\System\BIBDdMl.exe
  2⤵
  PID:3476
- C:\Windows\System\rPbdSHH.exe
  C:\Windows\System\rPbdSHH.exe
  2⤵
  PID:2928
- C:\Windows\System\YTkAQpO.exe
  C:\Windows\System\YTkAQpO.exe
  2⤵
  PID:3396
- C:\Windows\System\UjQeaCw.exe
  C:\Windows\System\UjQeaCw.exe
  2⤵
  PID:3760
- C:\Windows\System\yUQVPBJ.exe
  C:\Windows\System\yUQVPBJ.exe
  2⤵
  PID:4048
- C:\Windows\System\yBZroeP.exe
  C:\Windows\System\yBZroeP.exe
  2⤵
  PID:2764
- C:\Windows\System\zzzjiTT.exe
  C:\Windows\System\zzzjiTT.exe
  2⤵
  PID:1876
- C:\Windows\System\NuOhePo.exe
  C:\Windows\System\NuOhePo.exe
  2⤵
  PID:3520
- C:\Windows\System\kGrydNo.exe
  C:\Windows\System\kGrydNo.exe
  2⤵
  PID:3312
- C:\Windows\System\KvpSwSw.exe
  C:\Windows\System\KvpSwSw.exe
  2⤵
  PID:2032
- C:\Windows\System\mzcoWmZ.exe
  C:\Windows\System\mzcoWmZ.exe
  2⤵
  PID:3900
- C:\Windows\System\oGYPdMk.exe
  C:\Windows\System\oGYPdMk.exe
  2⤵
  PID:4016
- C:\Windows\System\CpfnbEv.exe
  C:\Windows\System\CpfnbEv.exe
  2⤵
  PID:1552
- C:\Windows\System\zArEexP.exe
  C:\Windows\System\zArEexP.exe
  2⤵
  PID:1536
- C:\Windows\System\UWIflOV.exe
  C:\Windows\System\UWIflOV.exe
  2⤵
  PID:4100
- C:\Windows\System\KivhEKa.exe
  C:\Windows\System\KivhEKa.exe
  2⤵
  PID:4116
- C:\Windows\System\SxUMCHA.exe
  C:\Windows\System\SxUMCHA.exe
  2⤵
  PID:4136
- C:\Windows\System\TbIZtEw.exe
  C:\Windows\System\TbIZtEw.exe
  2⤵
  PID:4152
- C:\Windows\System\vGyHXDa.exe
  C:\Windows\System\vGyHXDa.exe
  2⤵
  PID:4168
- C:\Windows\System\OiqwhJx.exe
  C:\Windows\System\OiqwhJx.exe
  2⤵
  PID:4184
- C:\Windows\System\bMeZEjJ.exe
  C:\Windows\System\bMeZEjJ.exe
  2⤵
  PID:4200
- C:\Windows\System\XJZXPVL.exe
  C:\Windows\System\XJZXPVL.exe
  2⤵
  PID:4216
- C:\Windows\System\zKBtnns.exe
  C:\Windows\System\zKBtnns.exe
  2⤵
  PID:4232
- C:\Windows\System\rzpHakh.exe
  C:\Windows\System\rzpHakh.exe
  2⤵
  PID:4248
- C:\Windows\System\JIJaeRt.exe
  C:\Windows\System\JIJaeRt.exe
  2⤵
  PID:4268
- C:\Windows\System\LPYabII.exe
  C:\Windows\System\LPYabII.exe
  2⤵
  PID:4284
- C:\Windows\System\ZAkcgqd.exe
  C:\Windows\System\ZAkcgqd.exe
  2⤵
  PID:4300
- C:\Windows\System\zPgGZXP.exe
  C:\Windows\System\zPgGZXP.exe
  2⤵
  PID:4316
- C:\Windows\System\CMmZLGD.exe
  C:\Windows\System\CMmZLGD.exe
  2⤵
  PID:4332
- C:\Windows\System\iCwWHjD.exe
  C:\Windows\System\iCwWHjD.exe
  2⤵
  PID:4348
- C:\Windows\System\oUnWNRY.exe
  C:\Windows\System\oUnWNRY.exe
  2⤵
  PID:4364
- C:\Windows\System\ftAEfhm.exe
  C:\Windows\System\ftAEfhm.exe
  2⤵
  PID:4380
- C:\Windows\System\uuevsJR.exe
  C:\Windows\System\uuevsJR.exe
  2⤵
  PID:4420
- C:\Windows\System\eRclnOY.exe
  C:\Windows\System\eRclnOY.exe
  2⤵
  PID:4452
- C:\Windows\System\FWKDWRt.exe
  C:\Windows\System\FWKDWRt.exe
  2⤵
  PID:4468
- C:\Windows\System\xDVjVms.exe
  C:\Windows\System\xDVjVms.exe
  2⤵
  PID:4488
- C:\Windows\System\AumaADb.exe
  C:\Windows\System\AumaADb.exe
  2⤵
  PID:4508
- C:\Windows\System\BuvfMFl.exe
  C:\Windows\System\BuvfMFl.exe
  2⤵
  PID:4524
- C:\Windows\System\AGOzQWd.exe
  C:\Windows\System\AGOzQWd.exe
  2⤵
  PID:4540
- C:\Windows\System\eGfipmL.exe
  C:\Windows\System\eGfipmL.exe
  2⤵
  PID:4556
- C:\Windows\System\cmGrxYP.exe
  C:\Windows\System\cmGrxYP.exe
  2⤵
  PID:4576
- C:\Windows\System\yyqArKj.exe
  C:\Windows\System\yyqArKj.exe
  2⤵
  PID:4592
- C:\Windows\System\OVMUTGj.exe
  C:\Windows\System\OVMUTGj.exe
  2⤵
  PID:4608
- C:\Windows\System\bhXeqrB.exe
  C:\Windows\System\bhXeqrB.exe
  2⤵
  PID:4624
- C:\Windows\System\VNEnrLa.exe
  C:\Windows\System\VNEnrLa.exe
  2⤵
  PID:4640
- C:\Windows\System\dyRbWWp.exe
  C:\Windows\System\dyRbWWp.exe
  2⤵
  PID:4656
- C:\Windows\System\jHkrGRO.exe
  C:\Windows\System\jHkrGRO.exe
  2⤵
  PID:4672
- C:\Windows\System\jmHMOqw.exe
  C:\Windows\System\jmHMOqw.exe
  2⤵
  PID:4688
- C:\Windows\System\gBXrVcX.exe
  C:\Windows\System\gBXrVcX.exe
  2⤵
  PID:4704
- C:\Windows\System\ckGnWBr.exe
  C:\Windows\System\ckGnWBr.exe
  2⤵
  PID:4720
- C:\Windows\System\ETlxswy.exe
  C:\Windows\System\ETlxswy.exe
  2⤵
  PID:4752
- C:\Windows\System\vlDevGG.exe
  C:\Windows\System\vlDevGG.exe
  2⤵
  PID:4768
- C:\Windows\System\VbYGNEZ.exe
  C:\Windows\System\VbYGNEZ.exe
  2⤵
  PID:4784
- C:\Windows\System\tXldebX.exe
  C:\Windows\System\tXldebX.exe
  2⤵
  PID:4800
- C:\Windows\System\fRrXOYV.exe
  C:\Windows\System\fRrXOYV.exe
  2⤵
  PID:4816
- C:\Windows\System\yQRmmXo.exe
  C:\Windows\System\yQRmmXo.exe
  2⤵
  PID:4832
- C:\Windows\System\XRnaQAc.exe
  C:\Windows\System\XRnaQAc.exe
  2⤵
  PID:4848
- C:\Windows\System\rNGlgJG.exe
  C:\Windows\System\rNGlgJG.exe
  2⤵
  PID:4868
- C:\Windows\System\tHWyUmR.exe
  C:\Windows\System\tHWyUmR.exe
  2⤵
  PID:4884
- C:\Windows\System\aLXBfxM.exe
  C:\Windows\System\aLXBfxM.exe
  2⤵
  PID:4900
- C:\Windows\System\evKTIWn.exe
  C:\Windows\System\evKTIWn.exe
  2⤵
  PID:4916
- C:\Windows\System\voSkZZC.exe
  C:\Windows\System\voSkZZC.exe
  2⤵
  PID:4932
- C:\Windows\System\ZhIlLuz.exe
  C:\Windows\System\ZhIlLuz.exe
  2⤵
  PID:4948
- C:\Windows\System\VfSmhik.exe
  C:\Windows\System\VfSmhik.exe
  2⤵
  PID:4964
- C:\Windows\System\rUiLpuy.exe
  C:\Windows\System\rUiLpuy.exe
  2⤵
  PID:4980
- C:\Windows\System\IVhxwQP.exe
  C:\Windows\System\IVhxwQP.exe
  2⤵
  PID:4996
- C:\Windows\System\KrNuCwX.exe
  C:\Windows\System\KrNuCwX.exe
  2⤵
  PID:5012
- C:\Windows\System\INaAnRC.exe
  C:\Windows\System\INaAnRC.exe
  2⤵
  PID:5032
- C:\Windows\System\lxvNBnL.exe
  C:\Windows\System\lxvNBnL.exe
  2⤵
  PID:5048
- C:\Windows\System\KFGpeZS.exe
  C:\Windows\System\KFGpeZS.exe
  2⤵
  PID:5064
- C:\Windows\System\MezgWxa.exe
  C:\Windows\System\MezgWxa.exe
  2⤵
  PID:5080
- C:\Windows\System\sBQJDmr.exe
  C:\Windows\System\sBQJDmr.exe
  2⤵
  PID:5096
- C:\Windows\System\qPHlIOa.exe
  C:\Windows\System\qPHlIOa.exe
  2⤵
  PID:5112
- C:\Windows\System\sndAZgI.exe
  C:\Windows\System\sndAZgI.exe
  2⤵
  PID:2568
- C:\Windows\System\vCvQjae.exe
  C:\Windows\System\vCvQjae.exe
  2⤵
  PID:4128
- C:\Windows\System\wnzRplV.exe
  C:\Windows\System\wnzRplV.exe
  2⤵
  PID:1780
- C:\Windows\System\khbuWzm.exe
  C:\Windows\System\khbuWzm.exe
  2⤵
  PID:2424
- C:\Windows\System\dJmnVsR.exe
  C:\Windows\System\dJmnVsR.exe
  2⤵
  PID:4228
- C:\Windows\System\KMmmeFU.exe
  C:\Windows\System\KMmmeFU.exe
  2⤵
  PID:4180
- C:\Windows\System\mTJhxwa.exe
  C:\Windows\System\mTJhxwa.exe
  2⤵
  PID:4112
- C:\Windows\System\Qnqfwct.exe
  C:\Windows\System\Qnqfwct.exe
  2⤵
  PID:4264
- C:\Windows\System\FGeHCsW.exe
  C:\Windows\System\FGeHCsW.exe
  2⤵
  PID:4244
- C:\Windows\System\mJKBExY.exe
  C:\Windows\System\mJKBExY.exe
  2⤵
  PID:4328
- C:\Windows\System\UwhrnEf.exe
  C:\Windows\System\UwhrnEf.exe
  2⤵
  PID:4344
- C:\Windows\System\aSUTcSA.exe
  C:\Windows\System\aSUTcSA.exe
  2⤵
  PID:4388
- C:\Windows\System\QmbDlyn.exe
  C:\Windows\System\QmbDlyn.exe
  2⤵
  PID:4564
- C:\Windows\System\wrTJYFH.exe
  C:\Windows\System\wrTJYFH.exe
  2⤵
  PID:4696
- C:\Windows\System\mFlIufJ.exe
  C:\Windows\System\mFlIufJ.exe
  2⤵
  PID:4480
- C:\Windows\System\FgKqyrg.exe
  C:\Windows\System\FgKqyrg.exe
  2⤵
  PID:4552
- C:\Windows\System\jzgClLv.exe
  C:\Windows\System\jzgClLv.exe
  2⤵
  PID:4620
- C:\Windows\System\vZmPExs.exe
  C:\Windows\System\vZmPExs.exe
  2⤵
  PID:4748
- C:\Windows\System\rAHJguW.exe
  C:\Windows\System\rAHJguW.exe
  2⤵
  PID:4864
- C:\Windows\System\EHJVNyB.exe
  C:\Windows\System\EHJVNyB.exe
  2⤵
  PID:4260
- C:\Windows\System\UocRdmV.exe
  C:\Windows\System\UocRdmV.exe
  2⤵
  PID:4636
- C:\Windows\System\rwbTqfG.exe
  C:\Windows\System\rwbTqfG.exe
  2⤵
  PID:4444
- C:\Windows\System\NtIgJfY.exe
  C:\Windows\System\NtIgJfY.exe
  2⤵
  PID:4448
- C:\Windows\System\LsaIVlF.exe
  C:\Windows\System\LsaIVlF.exe
  2⤵
  PID:4780
- C:\Windows\System\iGmEkRC.exe
  C:\Windows\System\iGmEkRC.exe
  2⤵
  PID:4844
- C:\Windows\System\QavpqbT.exe
  C:\Windows\System\QavpqbT.exe
  2⤵
  PID:4912
- C:\Windows\System\QnYjcJU.exe
  C:\Windows\System\QnYjcJU.exe
  2⤵
  PID:4896
- C:\Windows\System\JcKtsbG.exe
  C:\Windows\System\JcKtsbG.exe
  2⤵
  PID:4924
- C:\Windows\System\rNIBGMe.exe
  C:\Windows\System\rNIBGMe.exe
  2⤵
  PID:4972
- C:\Windows\System\wdodVuq.exe
  C:\Windows\System\wdodVuq.exe
  2⤵
  PID:5020
- C:\Windows\System\AOZdQuN.exe
  C:\Windows\System\AOZdQuN.exe
  2⤵
  PID:5092
- C:\Windows\System\KBzkvkG.exe
  C:\Windows\System\KBzkvkG.exe
  2⤵
  PID:4164
- C:\Windows\System\smhEZFR.exe
  C:\Windows\System\smhEZFR.exe
  2⤵
  PID:4196
- C:\Windows\System\oBtmdcw.exe
  C:\Windows\System\oBtmdcw.exe
  2⤵
  PID:4132
- C:\Windows\System\niQucdT.exe
  C:\Windows\System\niQucdT.exe
  2⤵
  PID:4224
- C:\Windows\System\FUSYJjG.exe
  C:\Windows\System\FUSYJjG.exe
  2⤵
  PID:4340
- C:\Windows\System\WTeTQTy.exe
  C:\Windows\System\WTeTQTy.exe
  2⤵
  PID:4356
- C:\Windows\System\Ydbkdwu.exe
  C:\Windows\System\Ydbkdwu.exe
  2⤵
  PID:3828
- C:\Windows\System\GOaLIJa.exe
  C:\Windows\System\GOaLIJa.exe
  2⤵
  PID:4416
- C:\Windows\System\iFDZYPV.exe
  C:\Windows\System\iFDZYPV.exe
  2⤵
  PID:4500
- C:\Windows\System\pzMOFAU.exe
  C:\Windows\System\pzMOFAU.exe
  2⤵
  PID:4408
- C:\Windows\System\JvOBijY.exe
  C:\Windows\System\JvOBijY.exe
  2⤵
  PID:4632
- C:\Windows\System\xlYFAcy.exe
  C:\Windows\System\xlYFAcy.exe
  2⤵
  PID:4812
- C:\Windows\System\ClyNuaP.exe
  C:\Windows\System\ClyNuaP.exe
  2⤵
  PID:4944
- C:\Windows\System\BsifTHD.exe
  C:\Windows\System\BsifTHD.exe
  2⤵
  PID:4728
- C:\Windows\System\GBzzfJa.exe
  C:\Windows\System\GBzzfJa.exe
  2⤵
  PID:4584
- C:\Windows\System\iGrLfMI.exe
  C:\Windows\System\iGrLfMI.exe
  2⤵
  PID:4732
- C:\Windows\System\epOHakV.exe
  C:\Windows\System\epOHakV.exe
  2⤵
  PID:4796
- C:\Windows\System\YMGkeKZ.exe
  C:\Windows\System\YMGkeKZ.exe
  2⤵
  PID:4880
- C:\Windows\System\QBzTMDQ.exe
  C:\Windows\System\QBzTMDQ.exe
  2⤵
  PID:5040
- C:\Windows\System\OsfPlYr.exe
  C:\Windows\System\OsfPlYr.exe
  2⤵
  PID:4292
- C:\Windows\System\zxWOKRZ.exe
  C:\Windows\System\zxWOKRZ.exe
  2⤵
  PID:5044
- C:\Windows\System\omRkUCE.exe
  C:\Windows\System\omRkUCE.exe
  2⤵
  PID:4124
- C:\Windows\System\ZIjVBfa.exe
  C:\Windows\System\ZIjVBfa.exe
  2⤵
  PID:5128
- C:\Windows\System\jMwNUnD.exe
  C:\Windows\System\jMwNUnD.exe
  2⤵
  PID:5144
- C:\Windows\System\oefYuOW.exe
  C:\Windows\System\oefYuOW.exe
  2⤵
  PID:5160
- C:\Windows\System\xzhNUVg.exe
  C:\Windows\System\xzhNUVg.exe
  2⤵
  PID:5176
- C:\Windows\System\jZxilty.exe
  C:\Windows\System\jZxilty.exe
  2⤵
  PID:5192
- C:\Windows\System\zlbQnCb.exe
  C:\Windows\System\zlbQnCb.exe
  2⤵
  PID:5208
- C:\Windows\System\eligLmh.exe
  C:\Windows\System\eligLmh.exe
  2⤵
  PID:5224
- C:\Windows\System\YbKXEvS.exe
  C:\Windows\System\YbKXEvS.exe
  2⤵
  PID:5240
- C:\Windows\System\RVIuXIK.exe
  C:\Windows\System\RVIuXIK.exe
  2⤵
  PID:5256
- C:\Windows\System\tAdtqxf.exe
  C:\Windows\System\tAdtqxf.exe
  2⤵
  PID:5272
- C:\Windows\System\VBRCfaF.exe
  C:\Windows\System\VBRCfaF.exe
  2⤵
  PID:5288
- C:\Windows\System\FpplnIi.exe
  C:\Windows\System\FpplnIi.exe
  2⤵
  PID:5308
- C:\Windows\System\bLTLmfH.exe
  C:\Windows\System\bLTLmfH.exe
  2⤵
  PID:5324
- C:\Windows\System\RoTszbY.exe
  C:\Windows\System\RoTszbY.exe
  2⤵
  PID:5340
- C:\Windows\System\HwynoiK.exe
  C:\Windows\System\HwynoiK.exe
  2⤵
  PID:5360
- C:\Windows\System\cRUGMdR.exe
  C:\Windows\System\cRUGMdR.exe
  2⤵
  PID:5376
- C:\Windows\System\wEhCxZe.exe
  C:\Windows\System\wEhCxZe.exe
  2⤵
  PID:5392
- C:\Windows\System\aGKFJPO.exe
  C:\Windows\System\aGKFJPO.exe
  2⤵
  PID:5408
- C:\Windows\System\OkDpUbG.exe
  C:\Windows\System\OkDpUbG.exe
  2⤵
  PID:5428
- C:\Windows\System\RIBhdKm.exe
  C:\Windows\System\RIBhdKm.exe
  2⤵
  PID:5444
- C:\Windows\System\CUllCMW.exe
  C:\Windows\System\CUllCMW.exe
  2⤵
  PID:5460
- C:\Windows\System\YDSwNSU.exe
  C:\Windows\System\YDSwNSU.exe
  2⤵
  PID:5476
- C:\Windows\System\VBFnCzG.exe
  C:\Windows\System\VBFnCzG.exe
  2⤵
  PID:5492
- C:\Windows\System\cEMRVWx.exe
  C:\Windows\System\cEMRVWx.exe
  2⤵
  PID:5508
- C:\Windows\System\zwkkxAN.exe
  C:\Windows\System\zwkkxAN.exe
  2⤵
  PID:5524
- C:\Windows\System\fLInVle.exe
  C:\Windows\System\fLInVle.exe
  2⤵
  PID:5540
- C:\Windows\System\KncxnWy.exe
  C:\Windows\System\KncxnWy.exe
  2⤵
  PID:5556
- C:\Windows\System\jKxBBiC.exe
  C:\Windows\System\jKxBBiC.exe
  2⤵
  PID:5572
- C:\Windows\System\qeAXHgu.exe
  C:\Windows\System\qeAXHgu.exe
  2⤵
  PID:5588
- C:\Windows\System\DGAdfVW.exe
  C:\Windows\System\DGAdfVW.exe
  2⤵
  PID:5620
- C:\Windows\System\eZkaeco.exe
  C:\Windows\System\eZkaeco.exe
  2⤵
  PID:5640
- C:\Windows\System\bjuvnYH.exe
  C:\Windows\System\bjuvnYH.exe
  2⤵
  PID:5656
- C:\Windows\System\srdwcmH.exe
  C:\Windows\System\srdwcmH.exe
  2⤵
  PID:5704
- C:\Windows\System\JbsTefb.exe
  C:\Windows\System\JbsTefb.exe
  2⤵
  PID:5720
- C:\Windows\System\fSlLEpF.exe
  C:\Windows\System\fSlLEpF.exe
  2⤵
  PID:5736
- C:\Windows\System\ULVaOAX.exe
  C:\Windows\System\ULVaOAX.exe
  2⤵
  PID:5752
- C:\Windows\System\rbSzsdP.exe
  C:\Windows\System\rbSzsdP.exe
  2⤵
  PID:5768
- C:\Windows\System\ouZEVlD.exe
  C:\Windows\System\ouZEVlD.exe
  2⤵
  PID:5832
- C:\Windows\System\OqKJbDv.exe
  C:\Windows\System\OqKJbDv.exe
  2⤵
  PID:5848
- C:\Windows\System\EOWfSnS.exe
  C:\Windows\System\EOWfSnS.exe
  2⤵
  PID:5864
- C:\Windows\System\LZLNttx.exe
  C:\Windows\System\LZLNttx.exe
  2⤵
  PID:5880
- C:\Windows\System\irqNGLy.exe
  C:\Windows\System\irqNGLy.exe
  2⤵
  PID:5896
- C:\Windows\System\YXpHkWO.exe
  C:\Windows\System\YXpHkWO.exe
  2⤵
  PID:5912
- C:\Windows\System\LQADbjc.exe
  C:\Windows\System\LQADbjc.exe
  2⤵
  PID:5928
- C:\Windows\System\JxzGZah.exe
  C:\Windows\System\JxzGZah.exe
  2⤵
  PID:5944
- C:\Windows\System\cKIkpjB.exe
  C:\Windows\System\cKIkpjB.exe
  2⤵
  PID:5960
- C:\Windows\System\CHtXrmc.exe
  C:\Windows\System\CHtXrmc.exe
  2⤵
  PID:5976
- C:\Windows\System\vVJyvxI.exe
  C:\Windows\System\vVJyvxI.exe
  2⤵
  PID:5992
- C:\Windows\System\WsIiKUt.exe
  C:\Windows\System\WsIiKUt.exe
  2⤵
  PID:6008
- C:\Windows\System\lfjpXEe.exe
  C:\Windows\System\lfjpXEe.exe
  2⤵
  PID:6024
- C:\Windows\System\WIEXCpi.exe
  C:\Windows\System\WIEXCpi.exe
  2⤵
  PID:6040
- C:\Windows\System\Dittxua.exe
  C:\Windows\System\Dittxua.exe
  2⤵
  PID:6056
- C:\Windows\System\vpWolaQ.exe
  C:\Windows\System\vpWolaQ.exe
  2⤵
  PID:6072
- C:\Windows\System\dFIUnRR.exe
  C:\Windows\System\dFIUnRR.exe
  2⤵
  PID:6088
- C:\Windows\System\doyydPi.exe
  C:\Windows\System\doyydPi.exe
  2⤵
  PID:6104
- C:\Windows\System\TaWKJrf.exe
  C:\Windows\System\TaWKJrf.exe
  2⤵
  PID:6120
- C:\Windows\System\cifhsak.exe
  C:\Windows\System\cifhsak.exe
  2⤵
  PID:6136
- C:\Windows\System\SJcVOul.exe
  C:\Windows\System\SJcVOul.exe
  2⤵
  PID:4404
- C:\Windows\System\csSAREm.exe
  C:\Windows\System\csSAREm.exe
  2⤵
  PID:4744
- C:\Windows\System\UukYEsW.exe
  C:\Windows\System\UukYEsW.exe
  2⤵
  PID:4716
- C:\Windows\System\cEflOzO.exe
  C:\Windows\System\cEflOzO.exe
  2⤵
  PID:4828
- C:\Windows\System\WEICAOR.exe
  C:\Windows\System\WEICAOR.exe
  2⤵
  PID:4212
- C:\Windows\System\kDoGnkn.exe
  C:\Windows\System\kDoGnkn.exe
  2⤵
  PID:5172
- C:\Windows\System\PaieWKg.exe
  C:\Windows\System\PaieWKg.exe
  2⤵
  PID:5232
- C:\Windows\System\LieLRaM.exe
  C:\Windows\System\LieLRaM.exe
  2⤵
  PID:5296
- C:\Windows\System\nilNmDZ.exe
  C:\Windows\System\nilNmDZ.exe
  2⤵
  PID:5336
- C:\Windows\System\AZeuOYC.exe
  C:\Windows\System\AZeuOYC.exe
  2⤵
  PID:5404
- C:\Windows\System\aQvGVRh.exe
  C:\Windows\System\aQvGVRh.exe
  2⤵
  PID:5500
- C:\Windows\System\NgzYQNE.exe
  C:\Windows\System\NgzYQNE.exe
  2⤵
  PID:5436
- C:\Windows\System\FQnLfml.exe
  C:\Windows\System\FQnLfml.exe
  2⤵
  PID:5520
- C:\Windows\System\YtvpYWI.exe
  C:\Windows\System\YtvpYWI.exe
  2⤵
  PID:5608
- C:\Windows\System\bICHOKd.exe
  C:\Windows\System\bICHOKd.exe
  2⤵
  PID:4256
- C:\Windows\System\CBmFKIl.exe
  C:\Windows\System\CBmFKIl.exe
  2⤵
  PID:4464
- C:\Windows\System\upVUUoB.exe
  C:\Windows\System\upVUUoB.exe
  2⤵
  PID:4604
- C:\Windows\System\BmtPzok.exe
  C:\Windows\System\BmtPzok.exe
  2⤵
  PID:4548
- C:\Windows\System\FWhImee.exe
  C:\Windows\System\FWhImee.exe
  2⤵
  PID:4960
- C:\Windows\System\yevNlxf.exe
  C:\Windows\System\yevNlxf.exe
  2⤵
  PID:4296
- C:\Windows\System\itDSRrr.exe
  C:\Windows\System\itDSRrr.exe
  2⤵
  PID:5184
- C:\Windows\System\nLElJnc.exe
  C:\Windows\System\nLElJnc.exe
  2⤵
  PID:5248
- C:\Windows\System\BNLpgiP.exe
  C:\Windows\System\BNLpgiP.exe
  2⤵
  PID:5316
- C:\Windows\System\SKvsQRO.exe
  C:\Windows\System\SKvsQRO.exe
  2⤵
  PID:5384
- C:\Windows\System\KxBklik.exe
  C:\Windows\System\KxBklik.exe
  2⤵
  PID:5424
- C:\Windows\System\iNEPzgo.exe
  C:\Windows\System\iNEPzgo.exe
  2⤵
  PID:5548
- C:\Windows\System\SslyBmM.exe
  C:\Windows\System\SslyBmM.exe
  2⤵
  PID:5636
- C:\Windows\System\TWZMzZj.exe
  C:\Windows\System\TWZMzZj.exe
  2⤵
  PID:5728
- C:\Windows\System\BXHhfLm.exe
  C:\Windows\System\BXHhfLm.exe
  2⤵
  PID:5672
- C:\Windows\System\Equaqgv.exe
  C:\Windows\System\Equaqgv.exe
  2⤵
  PID:5692
- C:\Windows\System\zJeaJTs.exe
  C:\Windows\System\zJeaJTs.exe
  2⤵
  PID:5744
- C:\Windows\System\fWzuJer.exe
  C:\Windows\System\fWzuJer.exe
  2⤵
  PID:5784
- C:\Windows\System\CmMgvhi.exe
  C:\Windows\System\CmMgvhi.exe
  2⤵
  PID:5800
- C:\Windows\System\OJeRdWi.exe
  C:\Windows\System\OJeRdWi.exe
  2⤵
  PID:5816
- C:\Windows\System\PzMlzAE.exe
  C:\Windows\System\PzMlzAE.exe
  2⤵
  PID:5828
- C:\Windows\System\kxOuQrv.exe
  C:\Windows\System\kxOuQrv.exe
  2⤵
  PID:5892
- C:\Windows\System\ezJkaiJ.exe
  C:\Windows\System\ezJkaiJ.exe
  2⤵
  PID:5956
- C:\Windows\System\uzBBKwy.exe
  C:\Windows\System\uzBBKwy.exe
  2⤵
  PID:6020
- C:\Windows\System\EgTZdjr.exe
  C:\Windows\System\EgTZdjr.exe
  2⤵
  PID:6084
- C:\Windows\System\iHZKVdz.exe
  C:\Windows\System\iHZKVdz.exe
  2⤵
  PID:4376
- C:\Windows\System\KbSLWCn.exe
  C:\Windows\System\KbSLWCn.exe
  2⤵
  PID:5204
- C:\Windows\System\GuDxIWi.exe
  C:\Windows\System\GuDxIWi.exe
  2⤵
  PID:5532
- C:\Windows\System\PYmqWRs.exe
  C:\Windows\System\PYmqWRs.exe
  2⤵
  PID:5568
- C:\Windows\System\BAlIoAm.exe
  C:\Windows\System\BAlIoAm.exe
  2⤵
  PID:4440
- C:\Windows\System\yAHdExw.exe
  C:\Windows\System\yAHdExw.exe
  2⤵
  PID:5872
- C:\Windows\System\sVdvZvw.exe
  C:\Windows\System\sVdvZvw.exe
  2⤵
  PID:6000
- C:\Windows\System\ZprIXGw.exe
  C:\Windows\System\ZprIXGw.exe
  2⤵
  PID:5844
- C:\Windows\System\jGdibPM.exe
  C:\Windows\System\jGdibPM.exe
  2⤵
  PID:5940
- C:\Windows\System\VlZirnk.exe
  C:\Windows\System\VlZirnk.exe
  2⤵
  PID:6064
- C:\Windows\System\iLUKyxw.exe
  C:\Windows\System\iLUKyxw.exe
  2⤵
  PID:6128
- C:\Windows\System\Lqkbzgy.exe
  C:\Windows\System\Lqkbzgy.exe
  2⤵
  PID:4824
- C:\Windows\System\dGpFylR.exe
  C:\Windows\System\dGpFylR.exe
  2⤵
  PID:5268
- C:\Windows\System\UBQKwpp.exe
  C:\Windows\System\UBQKwpp.exe
  2⤵
  PID:5440
- C:\Windows\System\sGnUYMV.exe
  C:\Windows\System\sGnUYMV.exe
  2⤵
  PID:4428
- C:\Windows\System\cJbprkg.exe
  C:\Windows\System\cJbprkg.exe
  2⤵
  PID:5284
- C:\Windows\System\pAzpPHP.exe
  C:\Windows\System\pAzpPHP.exe
  2⤵
  PID:5416
- C:\Windows\System\FMXZcVR.exe
  C:\Windows\System\FMXZcVR.exe
  2⤵
  PID:5628
- C:\Windows\System\WyywmIB.exe
  C:\Windows\System\WyywmIB.exe
  2⤵
  PID:5764
- C:\Windows\System\PPclESk.exe
  C:\Windows\System\PPclESk.exe
  2⤵
  PID:5712
- C:\Windows\System\XAeWKVn.exe
  C:\Windows\System\XAeWKVn.exe
  2⤵
  PID:4600
- C:\Windows\System\nsojPmD.exe
  C:\Windows\System\nsojPmD.exe
  2⤵
  PID:5516
- C:\Windows\System\IXUSmPB.exe
  C:\Windows\System\IXUSmPB.exe
  2⤵
  PID:5700
- C:\Windows\System\MiCxRIq.exe
  C:\Windows\System\MiCxRIq.exe
  2⤵
  PID:4240
- C:\Windows\System\iohRflS.exe
  C:\Windows\System\iohRflS.exe
  2⤵
  PID:5812
- C:\Windows\System\PQYIssq.exe
  C:\Windows\System\PQYIssq.exe
  2⤵
  PID:5356
- C:\Windows\System\KBiluIt.exe
  C:\Windows\System\KBiluIt.exe
  2⤵
  PID:5484
- C:\Windows\System\JxpVQSe.exe
  C:\Windows\System\JxpVQSe.exe
  2⤵
  PID:5888
- C:\Windows\System\cDHWVCi.exe
  C:\Windows\System\cDHWVCi.exe
  2⤵
  PID:4572
- C:\Windows\System\ouJtshd.exe
  C:\Windows\System\ouJtshd.exe
  2⤵
  PID:6036
- C:\Windows\System\LpIrXyK.exe
  C:\Windows\System\LpIrXyK.exe
  2⤵
  PID:4712
- C:\Windows\System\kcMQpLV.exe
  C:\Windows\System\kcMQpLV.exe
  2⤵
  PID:5060
- C:\Windows\System\RoeGAnT.exe
  C:\Windows\System\RoeGAnT.exe
  2⤵
  PID:5652
- C:\Windows\System\VLdywlq.exe
  C:\Windows\System\VLdywlq.exe
  2⤵
  PID:1736
- C:\Windows\System\eWEcPPp.exe
  C:\Windows\System\eWEcPPp.exe
  2⤵
  PID:1724
- C:\Windows\System\XSPVFbT.exe
  C:\Windows\System\XSPVFbT.exe
  2⤵
  PID:4616
- C:\Windows\System\aGuJESk.exe
  C:\Windows\System\aGuJESk.exe
  2⤵
  PID:5088
- C:\Windows\System\xyPCkep.exe
  C:\Windows\System\xyPCkep.exe
  2⤵
  PID:5684
- C:\Windows\System\WznMzZn.exe
  C:\Windows\System\WznMzZn.exe
  2⤵
  PID:5808
- C:\Windows\System\yvCiOiS.exe
  C:\Windows\System\yvCiOiS.exe
  2⤵
  PID:5220
- C:\Windows\System\ZCnRAKB.exe
  C:\Windows\System\ZCnRAKB.exe
  2⤵
  PID:4392
- C:\Windows\System\fXXgUtz.exe
  C:\Windows\System\fXXgUtz.exe
  2⤵
  PID:6096
- C:\Windows\System\cutQYwa.exe
  C:\Windows\System\cutQYwa.exe
  2⤵
  PID:5604
- C:\Windows\System\diDVEOD.exe
  C:\Windows\System\diDVEOD.exe
  2⤵
  PID:5352
- C:\Windows\System\THnCQUu.exe
  C:\Windows\System\THnCQUu.exe
  2⤵
  PID:6100
- C:\Windows\System\JtXMgMs.exe
  C:\Windows\System\JtXMgMs.exe
  2⤵
  PID:5924
- C:\Windows\System\PWxtWWx.exe
  C:\Windows\System\PWxtWWx.exe
  2⤵
  PID:6016
- C:\Windows\System\WWuAMXQ.exe
  C:\Windows\System\WWuAMXQ.exe
  2⤵
  PID:5348
- C:\Windows\System\WQvJrPz.exe
  C:\Windows\System\WQvJrPz.exe
  2⤵
  PID:5600
- C:\Windows\System\LpecsjB.exe
  C:\Windows\System\LpecsjB.exe
  2⤵
  PID:5780
- C:\Windows\System\uwWcDBU.exe
  C:\Windows\System\uwWcDBU.exe
  2⤵
  PID:5632
- C:\Windows\System\EBDKrAW.exe
  C:\Windows\System\EBDKrAW.exe
  2⤵
  PID:6160
- C:\Windows\System\HnwioKn.exe
  C:\Windows\System\HnwioKn.exe
  2⤵
  PID:6176
- C:\Windows\System\tlBdWcz.exe
  C:\Windows\System\tlBdWcz.exe
  2⤵
  PID:6192
- C:\Windows\System\grNaBLM.exe
  C:\Windows\System\grNaBLM.exe
  2⤵
  PID:6208
- C:\Windows\System\xVcHvQV.exe
  C:\Windows\System\xVcHvQV.exe
  2⤵
  PID:6224
- C:\Windows\System\wYoowqt.exe
  C:\Windows\System\wYoowqt.exe
  2⤵
  PID:6244
- C:\Windows\System\JlfOcDT.exe
  C:\Windows\System\JlfOcDT.exe
  2⤵
  PID:6260
- C:\Windows\System\pZAbMmE.exe
  C:\Windows\System\pZAbMmE.exe
  2⤵
  PID:6276
- C:\Windows\System\RsCzNRj.exe
  C:\Windows\System\RsCzNRj.exe
  2⤵
  PID:6292
- C:\Windows\System\RvoVKQC.exe
  C:\Windows\System\RvoVKQC.exe
  2⤵
  PID:6308
- C:\Windows\System\wvOOafq.exe
  C:\Windows\System\wvOOafq.exe
  2⤵
  PID:6324
- C:\Windows\System\PFEtavt.exe
  C:\Windows\System\PFEtavt.exe
  2⤵
  PID:6340
- C:\Windows\System\dvNLZae.exe
  C:\Windows\System\dvNLZae.exe
  2⤵
  PID:6356
- C:\Windows\System\xMjeNmc.exe
  C:\Windows\System\xMjeNmc.exe
  2⤵
  PID:6372
- C:\Windows\System\kfalRUG.exe
  C:\Windows\System\kfalRUG.exe
  2⤵
  PID:6388
- C:\Windows\System\gJVXSjq.exe
  C:\Windows\System\gJVXSjq.exe
  2⤵
  PID:6404
- C:\Windows\System\jShEuQt.exe
  C:\Windows\System\jShEuQt.exe
  2⤵
  PID:6420
- C:\Windows\System\WqzNFMr.exe
  C:\Windows\System\WqzNFMr.exe
  2⤵
  PID:6436
- C:\Windows\System\AJhpfFf.exe
  C:\Windows\System\AJhpfFf.exe
  2⤵
  PID:6456
- C:\Windows\System\vVBDKNu.exe
  C:\Windows\System\vVBDKNu.exe
  2⤵
  PID:6472
- C:\Windows\System\tXhUBGQ.exe
  C:\Windows\System\tXhUBGQ.exe
  2⤵
  PID:6488
- C:\Windows\System\QTUZlXH.exe
  C:\Windows\System\QTUZlXH.exe
  2⤵
  PID:6508
- C:\Windows\System\RnrxXhi.exe
  C:\Windows\System\RnrxXhi.exe
  2⤵
  PID:6524
- C:\Windows\System\njaFRVV.exe
  C:\Windows\System\njaFRVV.exe
  2⤵
  PID:6540
- C:\Windows\System\wufYbDR.exe
  C:\Windows\System\wufYbDR.exe
  2⤵
  PID:6560
- C:\Windows\System\wzzUkoO.exe
  C:\Windows\System\wzzUkoO.exe
  2⤵
  PID:6576
- C:\Windows\System\TTMwTNU.exe
  C:\Windows\System\TTMwTNU.exe
  2⤵
  PID:6592
- C:\Windows\System\nKbqEQP.exe
  C:\Windows\System\nKbqEQP.exe
  2⤵
  PID:6608
- C:\Windows\System\zwqkQTW.exe
  C:\Windows\System\zwqkQTW.exe
  2⤵
  PID:6628
- C:\Windows\System\lpEnzdG.exe
  C:\Windows\System\lpEnzdG.exe
  2⤵
  PID:6644
- C:\Windows\System\DPVepCp.exe
  C:\Windows\System\DPVepCp.exe
  2⤵
  PID:6660
- C:\Windows\System\RDDZOzn.exe
  C:\Windows\System\RDDZOzn.exe
  2⤵
  PID:6708
- C:\Windows\System\nEmPOer.exe
  C:\Windows\System\nEmPOer.exe
  2⤵
  PID:6724
- C:\Windows\System\bDRAscc.exe
  C:\Windows\System\bDRAscc.exe
  2⤵
  PID:6740
- C:\Windows\System\FKMhlTa.exe
  C:\Windows\System\FKMhlTa.exe
  2⤵
  PID:6756
- C:\Windows\System\NfFObCt.exe
  C:\Windows\System\NfFObCt.exe
  2⤵
  PID:6772
- C:\Windows\System\XdCUxlC.exe
  C:\Windows\System\XdCUxlC.exe
  2⤵
  PID:6788
- C:\Windows\System\CyAfGSg.exe
  C:\Windows\System\CyAfGSg.exe
  2⤵
  PID:6804
- C:\Windows\System\RbeBEXj.exe
  C:\Windows\System\RbeBEXj.exe
  2⤵
  PID:6820
- C:\Windows\System\iFHWvxi.exe
  C:\Windows\System\iFHWvxi.exe
  2⤵
  PID:6836
- C:\Windows\System\sYrgriH.exe
  C:\Windows\System\sYrgriH.exe
  2⤵
  PID:6852
- C:\Windows\System\LwDnSvE.exe
  C:\Windows\System\LwDnSvE.exe
  2⤵
  PID:6868
- C:\Windows\System\enLIdgj.exe
  C:\Windows\System\enLIdgj.exe
  2⤵
  PID:6884
- C:\Windows\System\mMqSaWd.exe
  C:\Windows\System\mMqSaWd.exe
  2⤵
  PID:6900
- C:\Windows\System\cduZFlx.exe
  C:\Windows\System\cduZFlx.exe
  2⤵
  PID:6916
- C:\Windows\System\JDNmVQF.exe
  C:\Windows\System\JDNmVQF.exe
  2⤵
  PID:6932
- C:\Windows\System\XmCQMqA.exe
  C:\Windows\System\XmCQMqA.exe
  2⤵
  PID:6948
- C:\Windows\System\IDHihPK.exe
  C:\Windows\System\IDHihPK.exe
  2⤵
  PID:6964
- C:\Windows\System\eIdKEUI.exe
  C:\Windows\System\eIdKEUI.exe
  2⤵
  PID:6980
- C:\Windows\System\TuFelwy.exe
  C:\Windows\System\TuFelwy.exe
  2⤵
  PID:6996
- C:\Windows\System\gOLEmzr.exe
  C:\Windows\System\gOLEmzr.exe
  2⤵
  PID:7012
- C:\Windows\System\SolAmmP.exe
  C:\Windows\System\SolAmmP.exe
  2⤵
  PID:7028
- C:\Windows\System\oIWkerJ.exe
  C:\Windows\System\oIWkerJ.exe
  2⤵
  PID:7044
- C:\Windows\System\hgtnOgI.exe
  C:\Windows\System\hgtnOgI.exe
  2⤵
  PID:7060
- C:\Windows\System\SCvBQUR.exe
  C:\Windows\System\SCvBQUR.exe
  2⤵
  PID:7076
- C:\Windows\System\yFSlmQi.exe
  C:\Windows\System\yFSlmQi.exe
  2⤵
  PID:7092
- C:\Windows\System\zYLUdAE.exe
  C:\Windows\System\zYLUdAE.exe
  2⤵
  PID:7108
- C:\Windows\System\MbrnZsu.exe
  C:\Windows\System\MbrnZsu.exe
  2⤵
  PID:7124
- C:\Windows\System\MIDZpeg.exe
  C:\Windows\System\MIDZpeg.exe
  2⤵
  PID:7140
- C:\Windows\System\Ziomekv.exe
  C:\Windows\System\Ziomekv.exe
  2⤵
  PID:7156
- C:\Windows\System\JDsKelr.exe
  C:\Windows\System\JDsKelr.exe
  2⤵
  PID:6156
- C:\Windows\System\TjuHQUz.exe
  C:\Windows\System\TjuHQUz.exe
  2⤵
  PID:6220
- C:\Windows\System\depKOOL.exe
  C:\Windows\System\depKOOL.exe
  2⤵
  PID:6232
- C:\Windows\System\UiDkcje.exe
  C:\Windows\System\UiDkcje.exe
  2⤵
  PID:5988
- C:\Windows\System\rKkDBkx.exe
  C:\Windows\System\rKkDBkx.exe
  2⤵
  PID:6200
- C:\Windows\System\PfIIjwh.exe
  C:\Windows\System\PfIIjwh.exe
  2⤵
  PID:5152
- C:\Windows\System\AiYKuOx.exe
  C:\Windows\System\AiYKuOx.exe
  2⤵
  PID:6320
- C:\Windows\System\NtzDoZm.exe
  C:\Windows\System\NtzDoZm.exe
  2⤵
  PID:6380
- C:\Windows\System\XHSQadp.exe
  C:\Windows\System\XHSQadp.exe
  2⤵
  PID:6444
- C:\Windows\System\DvTNSlr.exe
  C:\Windows\System\DvTNSlr.exe
  2⤵
  PID:6484
- C:\Windows\System\mxoudcE.exe
  C:\Windows\System\mxoudcE.exe
  2⤵
  PID:6304
- C:\Windows\System\nwWCQnE.exe
  C:\Windows\System\nwWCQnE.exe
  2⤵
  PID:6584
- C:\Windows\System\oWVriki.exe
  C:\Windows\System\oWVriki.exe
  2⤵
  PID:6624
- C:\Windows\System\RTGslEk.exe
  C:\Windows\System\RTGslEk.exe
  2⤵
  PID:6504
- C:\Windows\System\mWfNMtC.exe
  C:\Windows\System\mWfNMtC.exe
  2⤵
  PID:6396
- C:\Windows\System\ZNyGVYA.exe
  C:\Windows\System\ZNyGVYA.exe
  2⤵
  PID:6428
- C:\Windows\System\VJqAyeS.exe
  C:\Windows\System\VJqAyeS.exe
  2⤵
  PID:6496
- C:\Windows\System\RhPLoVw.exe
  C:\Windows\System\RhPLoVw.exe
  2⤵
  PID:6572
- C:\Windows\System\zMEgPQq.exe
  C:\Windows\System\zMEgPQq.exe
  2⤵
  PID:6668
- C:\Windows\System\anElAdQ.exe
  C:\Windows\System\anElAdQ.exe
  2⤵
  PID:6680
- C:\Windows\System\FUuToLH.exe
  C:\Windows\System\FUuToLH.exe
  2⤵
  PID:6692
- C:\Windows\System\KcGuqUX.exe
  C:\Windows\System\KcGuqUX.exe
  2⤵
  PID:6748
- C:\Windows\System\NxnZTuE.exe
  C:\Windows\System\NxnZTuE.exe
  2⤵
  PID:6784
- C:\Windows\System\AVEwXBn.exe
  C:\Windows\System\AVEwXBn.exe
  2⤵
  PID:6848
- C:\Windows\System\hoPlFzG.exe
  C:\Windows\System\hoPlFzG.exe
  2⤵
  PID:6732
- C:\Windows\System\HRiiWhv.exe
  C:\Windows\System\HRiiWhv.exe
  2⤵
  PID:6832
- C:\Windows\System\OzGBKCI.exe
  C:\Windows\System\OzGBKCI.exe
  2⤵
  PID:6864
- C:\Windows\System\XcAzWxg.exe
  C:\Windows\System\XcAzWxg.exe
  2⤵
  PID:6940
- C:\Windows\System\SpZvqNY.exe
  C:\Windows\System\SpZvqNY.exe
  2⤵
  PID:6976
- C:\Windows\System\CqZDzUW.exe
  C:\Windows\System\CqZDzUW.exe
  2⤵
  PID:7040
- C:\Windows\System\tvxlUxt.exe
  C:\Windows\System\tvxlUxt.exe
  2⤵
  PID:6928
- C:\Windows\System\ELdOgkV.exe
  C:\Windows\System\ELdOgkV.exe
  2⤵
  PID:7136
- C:\Windows\System\qaFmOUC.exe
  C:\Windows\System\qaFmOUC.exe
  2⤵
  PID:6152
- C:\Windows\System\vGItyNc.exe
  C:\Windows\System\vGItyNc.exe
  2⤵
  PID:7024
- C:\Windows\System\JqRtNFE.exe
  C:\Windows\System\JqRtNFE.exe
  2⤵
  PID:6188
- C:\Windows\System\LOlSgzy.exe
  C:\Windows\System\LOlSgzy.exe
  2⤵
  PID:7056
- C:\Windows\System\dRdTwEF.exe
  C:\Windows\System\dRdTwEF.exe
  2⤵
  PID:7120
- C:\Windows\System\WQdpbRq.exe
  C:\Windows\System\WQdpbRq.exe
  2⤵
  PID:6172
- C:\Windows\System\eykjMGI.exe
  C:\Windows\System\eykjMGI.exe
  2⤵
  PID:6416
- C:\Windows\System\WjfRPzI.exe
  C:\Windows\System\WjfRPzI.exe
  2⤵
  PID:6272
- C:\Windows\System\SDmyivF.exe
  C:\Windows\System\SDmyivF.exe
  2⤵
  PID:6656
- C:\Windows\System\varmQfP.exe
  C:\Windows\System\varmQfP.exe
  2⤵
  PID:6352
- C:\Windows\System\BjRoAWs.exe
  C:\Windows\System\BjRoAWs.exe
  2⤵
  PID:6368
- C:\Windows\System\WfDGmml.exe
  C:\Windows\System\WfDGmml.exe
  2⤵
  PID:6468
- C:\Windows\System\nEkRqAM.exe
  C:\Windows\System\nEkRqAM.exe
  2⤵
  PID:6568
- C:\Windows\System\ZAzUbgs.exe
  C:\Windows\System\ZAzUbgs.exe
  2⤵
  PID:6688
- C:\Windows\System\DbAyfdD.exe
  C:\Windows\System\DbAyfdD.exe
  2⤵
  PID:6720
- C:\Windows\System\zkiupxA.exe
  C:\Windows\System\zkiupxA.exe
  2⤵
  PID:6844
- C:\Windows\System\MEDqjPe.exe
  C:\Windows\System\MEDqjPe.exe
  2⤵
  PID:6924
- C:\Windows\System\FeDwqvc.exe
  C:\Windows\System\FeDwqvc.exe
  2⤵
  PID:6912
- C:\Windows\System\HRhZcOl.exe
  C:\Windows\System\HRhZcOl.exe
  2⤵
  PID:7072
- C:\Windows\System\lWpIkPc.exe
  C:\Windows\System\lWpIkPc.exe
  2⤵
  PID:7152
- C:\Windows\System\eDpkSAe.exe
  C:\Windows\System\eDpkSAe.exe
  2⤵
  PID:7132
- C:\Windows\System\KNIOUTW.exe
  C:\Windows\System\KNIOUTW.exe
  2⤵
  PID:6548
- C:\Windows\System\zBHyhkf.exe
  C:\Windows\System\zBHyhkf.exe
  2⤵
  PID:6284
- C:\Windows\System\rfYawmX.exe
  C:\Windows\System\rfYawmX.exe
  2⤵
  PID:6620
- C:\Windows\System\IImKYQG.exe
  C:\Windows\System\IImKYQG.exe
  2⤵
  PID:6364
- C:\Windows\System\CWefesD.exe
  C:\Windows\System\CWefesD.exe
  2⤵
  PID:1712
- C:\Windows\System\GZSBzKD.exe
  C:\Windows\System\GZSBzKD.exe
  2⤵
  PID:6604
- C:\Windows\System\kOyxBYs.exe
  C:\Windows\System\kOyxBYs.exe
  2⤵
  PID:7036
- C:\Windows\System\eSdQaqt.exe
  C:\Windows\System\eSdQaqt.exe
  2⤵
  PID:7008
- C:\Windows\System\ztwsfQJ.exe
  C:\Windows\System\ztwsfQJ.exe
  2⤵
  PID:6412
- C:\Windows\System\GKkaCQC.exe
  C:\Windows\System\GKkaCQC.exe
  2⤵
  PID:7084
- C:\Windows\System\wvFJxoV.exe
  C:\Windows\System\wvFJxoV.exe
  2⤵
  PID:6640
- C:\Windows\System\nKjoszs.exe
  C:\Windows\System\nKjoszs.exe
  2⤵
  PID:6780
- C:\Windows\System\ZvjiRgg.exe
  C:\Windows\System\ZvjiRgg.exe
  2⤵
  PID:7088
- C:\Windows\System\ILtGwNx.exe
  C:\Windows\System\ILtGwNx.exe
  2⤵
  PID:7176
- C:\Windows\System\aTphSFu.exe
  C:\Windows\System\aTphSFu.exe
  2⤵
  PID:7192
- C:\Windows\System\XwnZaUL.exe
  C:\Windows\System\XwnZaUL.exe
  2⤵
  PID:7208
- C:\Windows\System\RiEBSfI.exe
  C:\Windows\System\RiEBSfI.exe
  2⤵
  PID:7224
- C:\Windows\System\OhGpntK.exe
  C:\Windows\System\OhGpntK.exe
  2⤵
  PID:7240
- C:\Windows\System\csKriyM.exe
  C:\Windows\System\csKriyM.exe
  2⤵
  PID:7260
- C:\Windows\System\XkkASQv.exe
  C:\Windows\System\XkkASQv.exe
  2⤵
  PID:7276
- C:\Windows\System\uuoTbri.exe
  C:\Windows\System\uuoTbri.exe
  2⤵
  PID:7292
- C:\Windows\System\ESPMAYR.exe
  C:\Windows\System\ESPMAYR.exe
  2⤵
  PID:7308
- C:\Windows\System\YCVEJBC.exe
  C:\Windows\System\YCVEJBC.exe
  2⤵
  PID:7328
- C:\Windows\System\oQndHiJ.exe
  C:\Windows\System\oQndHiJ.exe
  2⤵
  PID:7344
- C:\Windows\System\ViIrNmf.exe
  C:\Windows\System\ViIrNmf.exe
  2⤵
  PID:7364
- C:\Windows\System\OTtrHPv.exe
  C:\Windows\System\OTtrHPv.exe
  2⤵
  PID:7380
- C:\Windows\System\ohFJOhX.exe
  C:\Windows\System\ohFJOhX.exe
  2⤵
  PID:7396
- C:\Windows\System\xaQZQrF.exe
  C:\Windows\System\xaQZQrF.exe
  2⤵
  PID:7412
- C:\Windows\System\WXZKXYp.exe
  C:\Windows\System\WXZKXYp.exe
  2⤵
  PID:7428
- C:\Windows\System\wtlhkje.exe
  C:\Windows\System\wtlhkje.exe
  2⤵
  PID:7444
- C:\Windows\System\qnvOUwA.exe
  C:\Windows\System\qnvOUwA.exe
  2⤵
  PID:7460
- C:\Windows\System\rjdMKQp.exe
  C:\Windows\System\rjdMKQp.exe
  2⤵
  PID:7476
- C:\Windows\System\xgliNNg.exe
  C:\Windows\System\xgliNNg.exe
  2⤵
  PID:7492
- C:\Windows\System\WDyBxcX.exe
  C:\Windows\System\WDyBxcX.exe
  2⤵
  PID:7512
- C:\Windows\System\xGRPSNp.exe
  C:\Windows\System\xGRPSNp.exe
  2⤵
  PID:7528
- C:\Windows\System\PQdlNFu.exe
  C:\Windows\System\PQdlNFu.exe
  2⤵
  PID:7544
- C:\Windows\System\DwJVCDu.exe
  C:\Windows\System\DwJVCDu.exe
  2⤵
  PID:7560
- C:\Windows\System\oCznBhC.exe
  C:\Windows\System\oCznBhC.exe
  2⤵
  PID:7576
- C:\Windows\System\eFrBjax.exe
  C:\Windows\System\eFrBjax.exe
  2⤵
  PID:7592
- C:\Windows\System\VWsYIOf.exe
  C:\Windows\System\VWsYIOf.exe
  2⤵
  PID:7608
- C:\Windows\System\jsXSItU.exe
  C:\Windows\System\jsXSItU.exe
  2⤵
  PID:7624
- C:\Windows\System\WlNyClT.exe
  C:\Windows\System\WlNyClT.exe
  2⤵
  PID:7640
- C:\Windows\System\lwMweWH.exe
  C:\Windows\System\lwMweWH.exe
  2⤵
  PID:7656
- C:\Windows\System\UnEERMM.exe
  C:\Windows\System\UnEERMM.exe
  2⤵
  PID:7672
- C:\Windows\System\dguSQIP.exe
  C:\Windows\System\dguSQIP.exe
  2⤵
  PID:7688
- C:\Windows\System\BdDBAGA.exe
  C:\Windows\System\BdDBAGA.exe
  2⤵
  PID:7704
- C:\Windows\System\gwHqjkf.exe
  C:\Windows\System\gwHqjkf.exe
  2⤵
  PID:7720
- C:\Windows\System\jMbQZgM.exe
  C:\Windows\System\jMbQZgM.exe
  2⤵
  PID:7736
- C:\Windows\System\owqiDCr.exe
  C:\Windows\System\owqiDCr.exe
  2⤵
  PID:7752
- C:\Windows\System\iwcRscg.exe
  C:\Windows\System\iwcRscg.exe
  2⤵
  PID:7768
- C:\Windows\System\pAzJHPE.exe
  C:\Windows\System\pAzJHPE.exe
  2⤵
  PID:7784
- C:\Windows\System\pficRGC.exe
  C:\Windows\System\pficRGC.exe
  2⤵
  PID:7800
- C:\Windows\System\VFnXIqN.exe
  C:\Windows\System\VFnXIqN.exe
  2⤵
  PID:7816
- C:\Windows\System\FgrhQrB.exe
  C:\Windows\System\FgrhQrB.exe
  2⤵
  PID:7832
- C:\Windows\System\ZwMCigP.exe
  C:\Windows\System\ZwMCigP.exe
  2⤵
  PID:7848
- C:\Windows\System\opyLIJt.exe
  C:\Windows\System\opyLIJt.exe
  2⤵
  PID:7864
- C:\Windows\System\uqQEOiL.exe
  C:\Windows\System\uqQEOiL.exe
  2⤵
  PID:7880
- C:\Windows\System\LpKTuRZ.exe
  C:\Windows\System\LpKTuRZ.exe
  2⤵
  PID:7896
- C:\Windows\System\lsRISDj.exe
  C:\Windows\System\lsRISDj.exe
  2⤵
  PID:7912
- C:\Windows\System\HXhbhai.exe
  C:\Windows\System\HXhbhai.exe
  2⤵
  PID:7928
- C:\Windows\System\TeGIaYj.exe
  C:\Windows\System\TeGIaYj.exe
  2⤵
  PID:7944
- C:\Windows\System\wgPbnsb.exe
  C:\Windows\System\wgPbnsb.exe
  2⤵
  PID:7960
- C:\Windows\System\lfwZcgx.exe
  C:\Windows\System\lfwZcgx.exe
  2⤵
  PID:7976
- C:\Windows\System\bmfnMaA.exe
  C:\Windows\System\bmfnMaA.exe
  2⤵
  PID:7992
- C:\Windows\System\VGXmbOk.exe
  C:\Windows\System\VGXmbOk.exe
  2⤵
  PID:8008
- C:\Windows\System\BanHJqF.exe
  C:\Windows\System\BanHJqF.exe
  2⤵
  PID:8024
- C:\Windows\System\VqGdBNf.exe
  C:\Windows\System\VqGdBNf.exe
  2⤵
  PID:8040
- C:\Windows\System\cvWQzmC.exe
  C:\Windows\System\cvWQzmC.exe
  2⤵
  PID:8056
- C:\Windows\System\QZZsquf.exe
  C:\Windows\System\QZZsquf.exe
  2⤵
  PID:8072
- C:\Windows\System\iNelEPp.exe
  C:\Windows\System\iNelEPp.exe
  2⤵
  PID:8088
- C:\Windows\System\lhfVBVw.exe
  C:\Windows\System\lhfVBVw.exe
  2⤵
  PID:7220
- C:\Windows\System\hBxBRJG.exe
  C:\Windows\System\hBxBRJG.exe
  2⤵
  PID:7272
- C:\Windows\System\uasQStO.exe
  C:\Windows\System\uasQStO.exe
  2⤵
  PID:7304
- C:\Windows\System\CCYjxbG.exe
  C:\Windows\System\CCYjxbG.exe
  2⤵
  PID:7372
- C:\Windows\System\AlAZvHn.exe
  C:\Windows\System\AlAZvHn.exe
  2⤵
  PID:7436
- C:\Windows\System\JESFkGk.exe
  C:\Windows\System\JESFkGk.exe
  2⤵
  PID:7500
- C:\Windows\System\gnNQZih.exe
  C:\Windows\System\gnNQZih.exe
  2⤵
  PID:7424
- C:\Windows\System\QhNbUZD.exe
  C:\Windows\System\QhNbUZD.exe
  2⤵
  PID:7456
- C:\Windows\System\LWHNyIh.exe
  C:\Windows\System\LWHNyIh.exe
  2⤵
  PID:7388
- C:\Windows\System\NbTBzKm.exe
  C:\Windows\System\NbTBzKm.exe
  2⤵
  PID:7540
- C:\Windows\System\yTVqHme.exe
  C:\Windows\System\yTVqHme.exe
  2⤵
  PID:7588
- C:\Windows\System\YrMByUp.exe
  C:\Windows\System\YrMByUp.exe
  2⤵
  PID:7600
- C:\Windows\System\TPbcWFm.exe
  C:\Windows\System\TPbcWFm.exe
  2⤵
  PID:7664
- C:\Windows\System\rTaEjGW.exe
  C:\Windows\System\rTaEjGW.exe
  2⤵
  PID:7652
- C:\Windows\System\OyvjbrV.exe
  C:\Windows\System\OyvjbrV.exe
  2⤵
  PID:7728
- C:\Windows\System\LbIXLLO.exe
  C:\Windows\System\LbIXLLO.exe
  2⤵
  PID:7828
- C:\Windows\System\EaDmMbr.exe
  C:\Windows\System\EaDmMbr.exe
  2⤵
  PID:7892
- C:\Windows\System\JDHEumE.exe
  C:\Windows\System\JDHEumE.exe
  2⤵
  PID:7920
- C:\Windows\System\DcPRiAw.exe
  C:\Windows\System\DcPRiAw.exe
  2⤵
  PID:7680
- C:\Windows\System\iyHwXSu.exe
  C:\Windows\System\iyHwXSu.exe
  2⤵
  PID:7988
- C:\Windows\System\EmeCPze.exe
  C:\Windows\System\EmeCPze.exe
  2⤵
  PID:7748
- C:\Windows\System\fqmZrEi.exe
  C:\Windows\System\fqmZrEi.exe
  2⤵
  PID:7940
- C:\Windows\System\gltjUcm.exe
  C:\Windows\System\gltjUcm.exe
  2⤵
  PID:8020
- C:\Windows\System\tjfwYQK.exe
  C:\Windows\System\tjfwYQK.exe
  2⤵
  PID:7904
- C:\Windows\System\qyCTtTa.exe
  C:\Windows\System\qyCTtTa.exe
  2⤵
  PID:7872
- C:\Windows\System\HryqPnW.exe
  C:\Windows\System\HryqPnW.exe
  2⤵
  PID:7808
- C:\Windows\System\fPhuJij.exe
  C:\Windows\System\fPhuJij.exe
  2⤵
  PID:8068
- C:\Windows\System\xvggQep.exe
  C:\Windows\System\xvggQep.exe
  2⤵
  PID:8108
- C:\Windows\System\svEDtfj.exe
  C:\Windows\System\svEDtfj.exe
  2⤵
  PID:8124
- C:\Windows\System\FuoNKHF.exe
  C:\Windows\System\FuoNKHF.exe
  2⤵
  PID:8140
- C:\Windows\System\TfbZBzq.exe
  C:\Windows\System\TfbZBzq.exe
  2⤵
  PID:8156
- C:\Windows\System\YabfuXU.exe
  C:\Windows\System\YabfuXU.exe
  2⤵
  PID:7252
- C:\Windows\System\UcRXOHQ.exe
  C:\Windows\System\UcRXOHQ.exe
  2⤵
  PID:8184
- C:\Windows\System\abhLpFW.exe
  C:\Windows\System\abhLpFW.exe
  2⤵
  PID:6860
- C:\Windows\System\EUWQFeY.exe
  C:\Windows\System\EUWQFeY.exe
  2⤵
  PID:6336
- C:\Windows\System\LaqKRKE.exe
  C:\Windows\System\LaqKRKE.exe
  2⤵
  PID:7188
- C:\Windows\System\kajTgSV.exe
  C:\Windows\System\kajTgSV.exe
  2⤵
  PID:7236
- C:\Windows\System\hGjdVyI.exe
  C:\Windows\System\hGjdVyI.exe
  2⤵
  PID:7336
- C:\Windows\System\JDmciuS.exe
  C:\Windows\System\JDmciuS.exe
  2⤵
  PID:7468
- C:\Windows\System\iRzjuqY.exe
  C:\Windows\System\iRzjuqY.exe
  2⤵
  PID:7404
- C:\Windows\System\hpRmvxb.exe
  C:\Windows\System\hpRmvxb.exe
  2⤵
  PID:7452
- C:\Windows\System\TyfbAcP.exe
  C:\Windows\System\TyfbAcP.exe
  2⤵
  PID:7392
- C:\Windows\System\Zyanxfa.exe
  C:\Windows\System\Zyanxfa.exe
  2⤵
  PID:7632
- C:\Windows\System\xytqlMO.exe
  C:\Windows\System\xytqlMO.exe
  2⤵
  PID:7792
- C:\Windows\System\hOyHNCg.exe
  C:\Windows\System\hOyHNCg.exe
  2⤵
  PID:7636
- C:\Windows\System\WZyiFRB.exe
  C:\Windows\System\WZyiFRB.exe
  2⤵
  PID:7936
- C:\Windows\System\cWhWEbE.exe
  C:\Windows\System\cWhWEbE.exe
  2⤵
  PID:7860
- C:\Windows\System\nuALuTi.exe
  C:\Windows\System\nuALuTi.exe
  2⤵
  PID:7956
- C:\Windows\System\rUgiPry.exe
  C:\Windows\System\rUgiPry.exe
  2⤵
  PID:8000
- C:\Windows\System\pyTHJJu.exe
  C:\Windows\System\pyTHJJu.exe
  2⤵
  PID:7840
- C:\Windows\System\WrEwpwD.exe
  C:\Windows\System\WrEwpwD.exe
  2⤵
  PID:8100
- C:\Windows\System\CqXBzHq.exe
  C:\Windows\System\CqXBzHq.exe
  2⤵
  PID:8164
- C:\Windows\System\XFWYCLm.exe
  C:\Windows\System\XFWYCLm.exe
  2⤵
  PID:8148
- C:\Windows\System\JDvbRuU.exe
  C:\Windows\System\JDvbRuU.exe
  2⤵
  PID:4516
- C:\Windows\System\GPTqRgK.exe
  C:\Windows\System\GPTqRgK.exe
  2⤵
  PID:7204
- C:\Windows\System\qpaORBd.exe
  C:\Windows\System\qpaORBd.exe
  2⤵
  PID:7232
- C:\Windows\System\QfXCdlc.exe
  C:\Windows\System\QfXCdlc.exe
  2⤵
  PID:7320
- C:\Windows\System\xWnlcXZ.exe
  C:\Windows\System\xWnlcXZ.exe
  2⤵
  PID:7488
- C:\Windows\System\PKWeMtx.exe
  C:\Windows\System\PKWeMtx.exe
  2⤵
  PID:7524
- C:\Windows\System\uiYgWhu.exe
  C:\Windows\System\uiYgWhu.exe
  2⤵
  PID:7796
- C:\Windows\System\NaDjVeW.exe
  C:\Windows\System\NaDjVeW.exe
  2⤵
  PID:8052
- C:\Windows\System\XMuuDsH.exe
  C:\Windows\System\XMuuDsH.exe
  2⤵
  PID:8004
- C:\Windows\System\YZZPRon.exe
  C:\Windows\System\YZZPRon.exe
  2⤵
  PID:8036
- C:\Windows\System\oGFUOSH.exe
  C:\Windows\System\oGFUOSH.exe
  2⤵
  PID:7268
- C:\Windows\System\EwPAiPG.exe
  C:\Windows\System\EwPAiPG.exe
  2⤵
  PID:8120
- C:\Windows\System\PocdEMv.exe
  C:\Windows\System\PocdEMv.exe
  2⤵
  PID:7184
- C:\Windows\System\YOBImDh.exe
  C:\Windows\System\YOBImDh.exe
  2⤵
  PID:7764
- C:\Windows\System\GAFjYbM.exe
  C:\Windows\System\GAFjYbM.exe
  2⤵
  PID:6240
- C:\Windows\System\JPtPIFF.exe
  C:\Windows\System\JPtPIFF.exe
  2⤵
  PID:7876
- C:\Windows\System\uFVblWl.exe
  C:\Windows\System\uFVblWl.exe
  2⤵
  PID:8208
- C:\Windows\System\scGzEDW.exe
  C:\Windows\System\scGzEDW.exe
  2⤵
  PID:8224
- C:\Windows\System\uPKOURt.exe
  C:\Windows\System\uPKOURt.exe
  2⤵
  PID:8240
- C:\Windows\System\rsdYPIK.exe
  C:\Windows\System\rsdYPIK.exe
  2⤵
  PID:8256
- C:\Windows\System\nOmLSWR.exe
  C:\Windows\System\nOmLSWR.exe
  2⤵
  PID:8272
- C:\Windows\System\TfpqRyS.exe
  C:\Windows\System\TfpqRyS.exe
  2⤵
  PID:8288
- C:\Windows\System\ZYfstcu.exe
  C:\Windows\System\ZYfstcu.exe
  2⤵
  PID:8304
- C:\Windows\System\InHuWvU.exe
  C:\Windows\System\InHuWvU.exe
  2⤵
  PID:8320
- C:\Windows\System\WFZXOeA.exe
  C:\Windows\System\WFZXOeA.exe
  2⤵
  PID:8336
- C:\Windows\System\Ertwbyv.exe
  C:\Windows\System\Ertwbyv.exe
  2⤵
  PID:8352
- C:\Windows\System\QxrQdAU.exe
  C:\Windows\System\QxrQdAU.exe
  2⤵
  PID:8368
- C:\Windows\System\QpyHjuu.exe
  C:\Windows\System\QpyHjuu.exe
  2⤵
  PID:8384
- C:\Windows\System\AeRoclT.exe
  C:\Windows\System\AeRoclT.exe
  2⤵
  PID:8400
- C:\Windows\System\RkFLMWE.exe
  C:\Windows\System\RkFLMWE.exe
  2⤵
  PID:8416
- C:\Windows\System\NwkRrWs.exe
  C:\Windows\System\NwkRrWs.exe
  2⤵
  PID:8432
- C:\Windows\System\mLuBrJJ.exe
  C:\Windows\System\mLuBrJJ.exe
  2⤵
  PID:8448
- C:\Windows\System\MEBdTmR.exe
  C:\Windows\System\MEBdTmR.exe
  2⤵
  PID:8464
- C:\Windows\System\AkkNBMP.exe
  C:\Windows\System\AkkNBMP.exe
  2⤵
  PID:8480
- C:\Windows\System\QqQsgZK.exe
  C:\Windows\System\QqQsgZK.exe
  2⤵
  PID:8496
- C:\Windows\System\cHlASrS.exe
  C:\Windows\System\cHlASrS.exe
  2⤵
  PID:8512
- C:\Windows\System\zbCWzhw.exe
  C:\Windows\System\zbCWzhw.exe
  2⤵
  PID:8528
- C:\Windows\System\MIwtbch.exe
  C:\Windows\System\MIwtbch.exe
  2⤵
  PID:8544
- C:\Windows\System\HrrTMhw.exe
  C:\Windows\System\HrrTMhw.exe
  2⤵
  PID:8560
- C:\Windows\System\MOJpSjp.exe
  C:\Windows\System\MOJpSjp.exe
  2⤵
  PID:8576
- C:\Windows\System\dHakxdN.exe
  C:\Windows\System\dHakxdN.exe
  2⤵
  PID:8592
- C:\Windows\System\FPzHUFy.exe
  C:\Windows\System\FPzHUFy.exe
  2⤵
  PID:8608
- C:\Windows\System\YvVMLAr.exe
  C:\Windows\System\YvVMLAr.exe
  2⤵
  PID:8624
- C:\Windows\System\VtIcaNF.exe
  C:\Windows\System\VtIcaNF.exe
  2⤵
  PID:8640
- C:\Windows\System\TVpDtft.exe
  C:\Windows\System\TVpDtft.exe
  2⤵
  PID:8656
- C:\Windows\System\vLhlMkm.exe
  C:\Windows\System\vLhlMkm.exe
  2⤵
  PID:8672
- C:\Windows\System\imvqWEn.exe
  C:\Windows\System\imvqWEn.exe
  2⤵
  PID:8688
- C:\Windows\System\fonMFhP.exe
  C:\Windows\System\fonMFhP.exe
  2⤵
  PID:8704
- C:\Windows\System\qcWejIn.exe
  C:\Windows\System\qcWejIn.exe
  2⤵
  PID:8720
- C:\Windows\System\emHgaCt.exe
  C:\Windows\System\emHgaCt.exe
  2⤵
  PID:8736
- C:\Windows\System\kmdbflQ.exe
  C:\Windows\System\kmdbflQ.exe
  2⤵
  PID:8752
- C:\Windows\System\AgLJETZ.exe
  C:\Windows\System\AgLJETZ.exe
  2⤵
  PID:8768
- C:\Windows\System\AKxArZS.exe
  C:\Windows\System\AKxArZS.exe
  2⤵
  PID:8784
- C:\Windows\System\pfynfBz.exe
  C:\Windows\System\pfynfBz.exe
  2⤵
  PID:8800
- C:\Windows\System\jaxTPQu.exe
  C:\Windows\System\jaxTPQu.exe
  2⤵
  PID:8816
- C:\Windows\System\uMXaWHY.exe
  C:\Windows\System\uMXaWHY.exe
  2⤵
  PID:8832
- C:\Windows\System\GrvfytO.exe
  C:\Windows\System\GrvfytO.exe
  2⤵
  PID:8848
- C:\Windows\System\MvyCHQX.exe
  C:\Windows\System\MvyCHQX.exe
  2⤵
  PID:8864
- C:\Windows\System\SsafvpL.exe
  C:\Windows\System\SsafvpL.exe
  2⤵
  PID:8880
- C:\Windows\System\IWlxZms.exe
  C:\Windows\System\IWlxZms.exe
  2⤵
  PID:8896
- C:\Windows\System\cMuchUz.exe
  C:\Windows\System\cMuchUz.exe
  2⤵
  PID:8912
- C:\Windows\System\VHpsKPm.exe
  C:\Windows\System\VHpsKPm.exe
  2⤵
  PID:8928
- C:\Windows\System\JBdGUts.exe
  C:\Windows\System\JBdGUts.exe
  2⤵
  PID:8944
- C:\Windows\System\zXkxKWt.exe
  C:\Windows\System\zXkxKWt.exe
  2⤵
  PID:8960
- C:\Windows\System\mvOblGo.exe
  C:\Windows\System\mvOblGo.exe
  2⤵
  PID:8976
- C:\Windows\System\uQLBTrB.exe
  C:\Windows\System\uQLBTrB.exe
  2⤵
  PID:8992
- C:\Windows\System\JqALGMg.exe
  C:\Windows\System\JqALGMg.exe
  2⤵
  PID:9008
- C:\Windows\System\KWCukrW.exe
  C:\Windows\System\KWCukrW.exe
  2⤵
  PID:9024
- C:\Windows\System\JfWsQnP.exe
  C:\Windows\System\JfWsQnP.exe
  2⤵
  PID:9040
- C:\Windows\System\QNGheKc.exe
  C:\Windows\System\QNGheKc.exe
  2⤵
  PID:9056
- C:\Windows\System\aBttUMc.exe
  C:\Windows\System\aBttUMc.exe
  2⤵
  PID:9072
- C:\Windows\System\lqRFEOv.exe
  C:\Windows\System\lqRFEOv.exe
  2⤵
  PID:9088
- C:\Windows\System\qEnroTH.exe
  C:\Windows\System\qEnroTH.exe
  2⤵
  PID:9104
- C:\Windows\System\IhQwnYr.exe
  C:\Windows\System\IhQwnYr.exe
  2⤵
  PID:9120
- C:\Windows\System\HTakiwS.exe
  C:\Windows\System\HTakiwS.exe
  2⤵
  PID:9136
- C:\Windows\System\LMEDICW.exe
  C:\Windows\System\LMEDICW.exe
  2⤵
  PID:9152
- C:\Windows\System\ZEIZCxg.exe
  C:\Windows\System\ZEIZCxg.exe
  2⤵
  PID:9168
- C:\Windows\System\dYJLLpm.exe
  C:\Windows\System\dYJLLpm.exe
  2⤵
  PID:9184
- C:\Windows\System\BJSPxTQ.exe
  C:\Windows\System\BJSPxTQ.exe
  2⤵
  PID:9200
- C:\Windows\System\jqYrpmA.exe
  C:\Windows\System\jqYrpmA.exe
  2⤵
  PID:7700
- C:\Windows\System\dUkrTSN.exe
  C:\Windows\System\dUkrTSN.exe
  2⤵
  PID:8064
- C:\Windows\System\qtBnSKL.exe
  C:\Windows\System\qtBnSKL.exe
  2⤵
  PID:8232
- C:\Windows\System\wqtPHbj.exe
  C:\Windows\System\wqtPHbj.exe
  2⤵
  PID:8264
- C:\Windows\System\ConkYck.exe
  C:\Windows\System\ConkYck.exe
  2⤵
  PID:7288
- C:\Windows\System\zOrSIJI.exe
  C:\Windows\System\zOrSIJI.exe
  2⤵
  PID:8284
- C:\Windows\System\zZtWsiJ.exe
  C:\Windows\System\zZtWsiJ.exe
  2⤵
  PID:8312
- C:\Windows\System\kbBeCMJ.exe
  C:\Windows\System\kbBeCMJ.exe
  2⤵
  PID:8364
- C:\Windows\System\ZkBOFDe.exe
  C:\Windows\System\ZkBOFDe.exe
  2⤵
  PID:8392
- C:\Windows\System\wivWtmI.exe
  C:\Windows\System\wivWtmI.exe
  2⤵
  PID:8412
- C:\Windows\System\nAIbCwC.exe
  C:\Windows\System\nAIbCwC.exe
  2⤵
  PID:8488
- C:\Windows\System\VLwaynV.exe
  C:\Windows\System\VLwaynV.exe
  2⤵
  PID:8492
- C:\Windows\System\HSxsYmK.exe
  C:\Windows\System\HSxsYmK.exe
  2⤵
  PID:8540
- C:\Windows\System\nKNvSfO.exe
  C:\Windows\System\nKNvSfO.exe
  2⤵
  PID:8556
- C:\Windows\System\qvoIYKO.exe
  C:\Windows\System\qvoIYKO.exe
  2⤵
  PID:8572
- C:\Windows\System\uBOqKqr.exe
  C:\Windows\System\uBOqKqr.exe
  2⤵
  PID:8636
- C:\Windows\System\gRYdudJ.exe
  C:\Windows\System\gRYdudJ.exe
  2⤵
  PID:8632
- C:\Windows\System\tZjJEEy.exe
  C:\Windows\System\tZjJEEy.exe
  2⤵
  PID:8668
- C:\Windows\System\tsIpVuI.exe
  C:\Windows\System\tsIpVuI.exe
  2⤵
  PID:8716
- C:\Windows\System\LVreijO.exe
  C:\Windows\System\LVreijO.exe
  2⤵
  PID:8764
- C:\Windows\System\qcwsxLs.exe
  C:\Windows\System\qcwsxLs.exe
  2⤵
  PID:8812
- C:\Windows\System\RswszuW.exe
  C:\Windows\System\RswszuW.exe
  2⤵
  PID:8876
- C:\Windows\System\VIUwFXd.exe
  C:\Windows\System\VIUwFXd.exe
  2⤵
  PID:8860
- C:\Windows\System\FJdiQVW.exe
  C:\Windows\System\FJdiQVW.exe
  2⤵
  PID:8956
- C:\Windows\System\BIFInqT.exe
  C:\Windows\System\BIFInqT.exe
  2⤵
  PID:9016
- C:\Windows\System\RaxzRlU.exe
  C:\Windows\System\RaxzRlU.exe
  2⤵
  PID:8920
- C:\Windows\System\IPJapOy.exe
  C:\Windows\System\IPJapOy.exe
  2⤵
  PID:9032
- C:\Windows\System\ipRrmjB.exe
  C:\Windows\System\ipRrmjB.exe
  2⤵
  PID:9064
- C:\Windows\System\uNThSso.exe
  C:\Windows\System\uNThSso.exe
  2⤵
  PID:9096
- C:\Windows\System\WvuBZTQ.exe
  C:\Windows\System\WvuBZTQ.exe
  2⤵
  PID:9112
- C:\Windows\System\aRbaDWy.exe
  C:\Windows\System\aRbaDWy.exe
  2⤵
  PID:9160
- C:\Windows\System\lFEmfHB.exe
  C:\Windows\System\lFEmfHB.exe
  2⤵
  PID:9148
- C:\Windows\System\QjlvZDe.exe
  C:\Windows\System\QjlvZDe.exe
  2⤵
  PID:9208
- C:\Windows\System\xEpXuOT.exe
  C:\Windows\System\xEpXuOT.exe
  2⤵
  PID:8236
- C:\Windows\System\sqMJWxo.exe
  C:\Windows\System\sqMJWxo.exe
  2⤵
  PID:8328
- C:\Windows\System\rLNknTx.exe
  C:\Windows\System\rLNknTx.exe
  2⤵
  PID:9212
- C:\Windows\System\rypoTuB.exe
  C:\Windows\System\rypoTuB.exe
  2⤵
  PID:8472
- C:\Windows\System\SudKtWR.exe
  C:\Windows\System\SudKtWR.exe
  2⤵
  PID:8280
- C:\Windows\System\kXXLHMr.exe
  C:\Windows\System\kXXLHMr.exe
  2⤵
  PID:8348
- C:\Windows\System\cwSvaJE.exe
  C:\Windows\System\cwSvaJE.exe
  2⤵
  PID:8508
- C:\Windows\System\UTiLffQ.exe
  C:\Windows\System\UTiLffQ.exe
  2⤵
  PID:8616
- C:\Windows\System\OrHsYRh.exe
  C:\Windows\System\OrHsYRh.exe
  2⤵
  PID:8588
- C:\Windows\System\NQIzaSi.exe
  C:\Windows\System\NQIzaSi.exe
  2⤵
  PID:8712
- C:\Windows\System\qCSwMSp.exe
  C:\Windows\System\qCSwMSp.exe
  2⤵
  PID:8776
- C:\Windows\System\YjKQUaw.exe
  C:\Windows\System\YjKQUaw.exe
  2⤵
  PID:8824
- C:\Windows\System\omLLElc.exe
  C:\Windows\System\omLLElc.exe
  2⤵
  PID:8844
- C:\Windows\System\PtGfYaf.exe
  C:\Windows\System\PtGfYaf.exe
  2⤵
  PID:8940
- C:\Windows\System\ikPqPvF.exe
  C:\Windows\System\ikPqPvF.exe
  2⤵
  PID:9052
- C:\Windows\System\dJZkpLE.exe
  C:\Windows\System\dJZkpLE.exe
  2⤵
  PID:9084
- C:\Windows\System\WBsLbyu.exe
  C:\Windows\System\WBsLbyu.exe
  2⤵
  PID:9000
- C:\Windows\System\DmQKNdY.exe
  C:\Windows\System\DmQKNdY.exe
  2⤵
  PID:8408
- C:\Windows\System\abwKSGW.exe
  C:\Windows\System\abwKSGW.exe
  2⤵
  PID:8460
- C:\Windows\System\UkJabKN.exe
  C:\Windows\System\UkJabKN.exe
  2⤵
  PID:8652
- C:\Windows\System\lMTUnBJ.exe
  C:\Windows\System\lMTUnBJ.exe
  2⤵
  PID:8808
- C:\Windows\System\EqlUUXk.exe
  C:\Windows\System\EqlUUXk.exe
  2⤵
  PID:9180
- C:\Windows\System\papdoYV.exe
  C:\Windows\System\papdoYV.exe
  2⤵
  PID:9164
- C:\Windows\System\qXBOPMT.exe
  C:\Windows\System\qXBOPMT.exe
  2⤵
  PID:8440
- C:\Windows\System\jLDgfrg.exe
  C:\Windows\System\jLDgfrg.exe
  2⤵
  PID:9080
- C:\Windows\System\KiZKUSf.exe
  C:\Windows\System\KiZKUSf.exe
  2⤵
  PID:8796
- C:\Windows\System\sRtupdM.exe
  C:\Windows\System\sRtupdM.exe
  2⤵
  PID:8972
- C:\Windows\System\ZolOYVY.exe
  C:\Windows\System\ZolOYVY.exe
  2⤵
  PID:8872
- C:\Windows\System\ItTguRJ.exe
  C:\Windows\System\ItTguRJ.exe
  2⤵
  PID:7776
- C:\Windows\System\RZSKdPi.exe
  C:\Windows\System\RZSKdPi.exe
  2⤵
  PID:8604
- C:\Windows\System\oNbDrwi.exe
  C:\Windows\System\oNbDrwi.exe
  2⤵
  PID:8552
- C:\Windows\System\bxeQYpW.exe
  C:\Windows\System\bxeQYpW.exe
  2⤵
  PID:8952
- C:\Windows\System\UNQQyja.exe
  C:\Windows\System\UNQQyja.exe
  2⤵
  PID:9232
- C:\Windows\System\QoSVboI.exe
  C:\Windows\System\QoSVboI.exe
  2⤵
  PID:9248
- C:\Windows\System\EiClFEB.exe
  C:\Windows\System\EiClFEB.exe
  2⤵
  PID:9264
- C:\Windows\System\srdPHdF.exe
  C:\Windows\System\srdPHdF.exe
  2⤵
  PID:9280
- C:\Windows\System\HOSveLT.exe
  C:\Windows\System\HOSveLT.exe
  2⤵
  PID:9296
- C:\Windows\System\ueqSEHV.exe
  C:\Windows\System\ueqSEHV.exe
  2⤵
  PID:9312
- C:\Windows\System\jpwwwBW.exe
  C:\Windows\System\jpwwwBW.exe
  2⤵
  PID:9328
- C:\Windows\System\oFRAfCQ.exe
  C:\Windows\System\oFRAfCQ.exe
  2⤵
  PID:9344
- C:\Windows\System\dtaBWfL.exe
  C:\Windows\System\dtaBWfL.exe
  2⤵
  PID:9360
- C:\Windows\System\fuqvzgx.exe
  C:\Windows\System\fuqvzgx.exe
  2⤵
  PID:9376
- C:\Windows\System\zSsjCWf.exe
  C:\Windows\System\zSsjCWf.exe
  2⤵
  PID:9392
- C:\Windows\System\EXMMiOF.exe
  C:\Windows\System\EXMMiOF.exe
  2⤵
  PID:9408
- C:\Windows\System\QDjffEp.exe
  C:\Windows\System\QDjffEp.exe
  2⤵
  PID:9424
- C:\Windows\System\GljBEhR.exe
  C:\Windows\System\GljBEhR.exe
  2⤵
  PID:9440
- C:\Windows\System\nxMrhfR.exe
  C:\Windows\System\nxMrhfR.exe
  2⤵
  PID:9456
- C:\Windows\System\gjgvdcI.exe
  C:\Windows\System\gjgvdcI.exe
  2⤵
  PID:9472
- C:\Windows\System\ZIhgrol.exe
  C:\Windows\System\ZIhgrol.exe
  2⤵
  PID:9488
- C:\Windows\System\KMPucvB.exe
  C:\Windows\System\KMPucvB.exe
  2⤵
  PID:9508
- C:\Windows\System\IJYScRP.exe
  C:\Windows\System\IJYScRP.exe
  2⤵
  PID:9524
- C:\Windows\System\byvQOMN.exe
  C:\Windows\System\byvQOMN.exe
  2⤵
  PID:9540
- C:\Windows\System\smvItKo.exe
  C:\Windows\System\smvItKo.exe
  2⤵
  PID:9556
- C:\Windows\System\UPzvYiD.exe
  C:\Windows\System\UPzvYiD.exe
  2⤵
  PID:9572
- C:\Windows\System\BxsErBK.exe
  C:\Windows\System\BxsErBK.exe
  2⤵
  PID:9588
- C:\Windows\System\nIiSPsR.exe
  C:\Windows\System\nIiSPsR.exe
  2⤵
  PID:9604
- C:\Windows\System\oUTxCps.exe
  C:\Windows\System\oUTxCps.exe
  2⤵
  PID:9624
- C:\Windows\System\QoBreKe.exe
  C:\Windows\System\QoBreKe.exe
  2⤵
  PID:9640
- C:\Windows\System\hLfwpJk.exe
  C:\Windows\System\hLfwpJk.exe
  2⤵
  PID:9656
- C:\Windows\System\tYexdLW.exe
  C:\Windows\System\tYexdLW.exe
  2⤵
  PID:9672
- C:\Windows\System\yGmoXCb.exe
  C:\Windows\System\yGmoXCb.exe
  2⤵
  PID:9688
- C:\Windows\System\sRiPgpZ.exe
  C:\Windows\System\sRiPgpZ.exe
  2⤵
  PID:9704
- C:\Windows\System\eeVRxOA.exe
  C:\Windows\System\eeVRxOA.exe
  2⤵
  PID:9720
- C:\Windows\System\OjKDsLs.exe
  C:\Windows\System\OjKDsLs.exe
  2⤵
  PID:9736
- C:\Windows\System\bPRzRey.exe
  C:\Windows\System\bPRzRey.exe
  2⤵
  PID:9752
- C:\Windows\System\nuSUcCI.exe
  C:\Windows\System\nuSUcCI.exe
  2⤵
  PID:9768
- C:\Windows\System\PNAXrrp.exe
  C:\Windows\System\PNAXrrp.exe
  2⤵
  PID:9784
- C:\Windows\System\sabTCVm.exe
  C:\Windows\System\sabTCVm.exe
  2⤵
  PID:9800
- C:\Windows\System\GfrmyxI.exe
  C:\Windows\System\GfrmyxI.exe
  2⤵
  PID:9816
- C:\Windows\System\DZzjEvo.exe
  C:\Windows\System\DZzjEvo.exe
  2⤵
  PID:9832
- C:\Windows\System\FmHLmyU.exe
  C:\Windows\System\FmHLmyU.exe
  2⤵
  PID:9992
- C:\Windows\System\EKLiDFt.exe
  C:\Windows\System\EKLiDFt.exe
  2⤵
  PID:10024
- C:\Windows\System\cZooPyu.exe
  C:\Windows\System\cZooPyu.exe
  2⤵
  PID:10040
- C:\Windows\System\HjZLroB.exe
  C:\Windows\System\HjZLroB.exe
  2⤵
  PID:10056
- C:\Windows\System\PeBPnqf.exe
  C:\Windows\System\PeBPnqf.exe
  2⤵
  PID:10084
- C:\Windows\System\PabSsWO.exe
  C:\Windows\System\PabSsWO.exe
  2⤵
  PID:10100
- C:\Windows\System\BtvMWIW.exe
  C:\Windows\System\BtvMWIW.exe
  2⤵
  PID:10124
- C:\Windows\System\JyzqfXm.exe
  C:\Windows\System\JyzqfXm.exe
  2⤵
  PID:10140
- C:\Windows\System\fgRDPKI.exe
  C:\Windows\System\fgRDPKI.exe
  2⤵
  PID:10156
- C:\Windows\System\PcohqLw.exe
  C:\Windows\System\PcohqLw.exe
  2⤵
  PID:10172
- C:\Windows\System\BOmuewO.exe
  C:\Windows\System\BOmuewO.exe
  2⤵
  PID:10188
- C:\Windows\System\yBUQpFM.exe
  C:\Windows\System\yBUQpFM.exe
  2⤵
  PID:10208
- C:\Windows\System\vFmihjM.exe
  C:\Windows\System\vFmihjM.exe
  2⤵
  PID:10228
- C:\Windows\System\cANVIhj.exe
  C:\Windows\System\cANVIhj.exe
  2⤵
  PID:8536
- C:\Windows\System\vWVeRhE.exe
  C:\Windows\System\vWVeRhE.exe
  2⤵
  PID:9288
- C:\Windows\System\zatacQP.exe
  C:\Windows\System\zatacQP.exe
  2⤵
  PID:9352
- C:\Windows\System\XiylBMs.exe
  C:\Windows\System\XiylBMs.exe
  2⤵
  PID:9388
- C:\Windows\System\pZEEcpv.exe
  C:\Windows\System\pZEEcpv.exe
  2⤵
  PID:9480
- C:\Windows\System\HskEWbI.exe
  C:\Windows\System\HskEWbI.exe
  2⤵
  PID:9520
- C:\Windows\System\sfJaYXP.exe
  C:\Windows\System\sfJaYXP.exe
  2⤵
  PID:9584
- C:\Windows\System\pHeJXYb.exe
  C:\Windows\System\pHeJXYb.exe
  2⤵
  PID:8732
- C:\Windows\System\qWucYEx.exe
  C:\Windows\System\qWucYEx.exe
  2⤵
  PID:1480
- C:\Windows\System\sSkIzzj.exe
  C:\Windows\System\sSkIzzj.exe
  2⤵
  PID:9132
- C:\Windows\System\VQDhILP.exe
  C:\Windows\System\VQDhILP.exe
  2⤵
  PID:9532
- C:\Windows\System\xQQmaFi.exe
  C:\Windows\System\xQQmaFi.exe
  2⤵
  PID:9500
- C:\Windows\System\fxNnjeF.exe
  C:\Windows\System\fxNnjeF.exe
  2⤵
  PID:9436
- C:\Windows\System\uavkrFa.exe
  C:\Windows\System\uavkrFa.exe
  2⤵
  PID:9632
- C:\Windows\System\waiBfle.exe
  C:\Windows\System\waiBfle.exe
  2⤵
  PID:9664
- C:\Windows\System\RyqtWXs.exe
  C:\Windows\System\RyqtWXs.exe
  2⤵
  PID:9776
- C:\Windows\System\ppTtPOc.exe
  C:\Windows\System\ppTtPOc.exe
  2⤵
  PID:9696
- C:\Windows\System\NfIqPca.exe
  C:\Windows\System\NfIqPca.exe
  2⤵
  PID:9732
- C:\Windows\System\ImHydRj.exe
  C:\Windows\System\ImHydRj.exe
  2⤵
  PID:9764
- C:\Windows\System\lGvuijO.exe
  C:\Windows\System\lGvuijO.exe
  2⤵
  PID:9844
- C:\Windows\System\sbnUNQq.exe
  C:\Windows\System\sbnUNQq.exe
  2⤵
  PID:9864
- C:\Windows\System\tnVHTgT.exe
  C:\Windows\System\tnVHTgT.exe
  2⤵
  PID:9888
- C:\Windows\System\QdxKcXk.exe
  C:\Windows\System\QdxKcXk.exe
  2⤵
  PID:9908
- C:\Windows\System\LixAZDQ.exe
  C:\Windows\System\LixAZDQ.exe
  2⤵
  PID:9924
- C:\Windows\System\lFbRAvG.exe
  C:\Windows\System\lFbRAvG.exe
  2⤵
  PID:9932
- C:\Windows\System\dxvIDnB.exe
  C:\Windows\System\dxvIDnB.exe
  2⤵
  PID:9956
- C:\Windows\System\pNeaayX.exe
  C:\Windows\System\pNeaayX.exe
  2⤵
  PID:9972
- C:\Windows\System\IzuzxxZ.exe
  C:\Windows\System\IzuzxxZ.exe
  2⤵
  PID:9976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BhQLiRM.exe

Filesize
2.2MB

MD5
de4fc108735e6a1fc9e3066de7cf7ac3

SHA1
f15dee1bb8588f7de25d4b4f5699a26db27444df

SHA256
c8c450baef6f864c3f2a8175b5455e6b806dbef5ddf91e9f0dde5e1adc063fae

SHA512
7f82450848a5302fa06b49eaf7aa17d5ffbb0e4e58cc0f0e44272fc1fa3e761d9811906649b80ef101684c70dcbea61c58d2a3735aa58e47894c6fa51c5be4b5

Download Submit
C:\Windows\system\DDqLRrw.exe

Filesize
2.2MB

MD5
d0a040aea1a741ce3f500f537265b6b6

SHA1
77141984df2051a2b29d056236a8197cb03ecfd8

SHA256
649235b17cbd40462b32443fd3151207007bb4e99f528e557f7ba5e8716df070

SHA512
57c4837f09d7a0cddc162be1486dfd51c3a040cef92030749bd3c3d73c4e61a6b8fe280b0fc5c9876c7df1937e14c81228a6cc1d96919ac06db40ab0c5838018

Download Submit
C:\Windows\system\DFMegFz.exe

Filesize
2.2MB

MD5
12e467e388f09c0a1e4c3553a9959fa8

SHA1
064b21a2cd694e96665f8099688880c48d06f27b

SHA256
3745775be72addc82d989519893fe0689dbaf80692c1324465acdc0dcb20fdde

SHA512
1272473247b9625173b6e602b77feb27e3bc08620c3a298be0bd31848fffea7a28a4d6ad4d663272869e69d4cbb2dfa09d17eebea6443caca448d152beb624e9

Download Submit
C:\Windows\system\FyDCmci.exe

Filesize
2.2MB

MD5
25ba06cc410952fcd35840bfb321c798

SHA1
b200562980cb1835cf51f72793f7d348c2fc73de

SHA256
142b98f227eaf55fa1fa63889887453c6bfe80d6012973bd15618ca4c8fd1d77

SHA512
d9f30ca68062b7fe2a8ec2d56ab086d3c0524ed051d12e9b085c3abd5a5cf50cea92ca040e4cc50d359997d2bb678ad259d06818e747265c762f0534b9d60157

Download Submit
C:\Windows\system\GRqcbaw.exe

Filesize
2.2MB

MD5
443aacc17a66cfab6faadec90c032b95

SHA1
429d061d73a83a7583bb6631125db119c25d6d18

SHA256
55817794ea88cd7f91436c345656823b2f6ebb6a0dffa83d66bd9068f4f94966

SHA512
5e41ad0633ccd14826ad79176e9ebc43e7f703063561aab92db827c5c04a886abf55270d0cfb571864fd15587ecc35bc6fc56fca608f622c0d61057062aa0b42

Download Submit
C:\Windows\system\IgSoOJl.exe

Filesize
2.2MB

MD5
e58f7b8b4971173fdd46de0868b27773

SHA1
533db4ce8575d0db7b088b3fd5f34ad01d2f74c0

SHA256
49d8ced569474fd0b8466609451c21c57a5fbd0d7400dbfeb90a7036499409c5

SHA512
fa22d08e384a08cfc89b92fa56d0df9e3b45f15002fd0af6806cda0bd9eae2fd54ee427c8d9120d81557c71d0768b4efdb1d741a283ef3d903306d0453693d59

Download Submit
C:\Windows\system\JCBYzTN.exe

Filesize
2.2MB

MD5
cabb185994da1fe1a064c9983b580209

SHA1
b0d8ee57d165740c4affb9b9e63f8296b0ee1617

SHA256
7da9876f085dd16c0e078d8ae8e035d6125f96825e46c38c5c8c62da9af47008

SHA512
fe2c22f5838a5fdb98235a4d184591a54e75a30cdc5bac202c87bd5d9f5332f847f426d14bc75028e399fdf044959ba3a35c305adc73b2f0554fb1805b8fdef2

Download Submit
C:\Windows\system\KFOcrlZ.exe

Filesize
2.2MB

MD5
96dda762538e36dd00cbc07e7c240666

SHA1
8f57cf66786ce5b7bd3934965f40dda2c2d217c7

SHA256
c01ef80065a5347acf7f57be55b531044e49a0508cb6565df018217f05ba9027

SHA512
926fdf166c5cf0a92f47b73b9ca5e4d2652007073cab66de2f92982b2846bc35548ae74cabdf7d70d3bf5c1513378416937b4f1275a66c224a19f4823785e58d

Download Submit
C:\Windows\system\LfwLnPT.exe

Filesize
2.2MB

MD5
ecec1c313f3b1006047e01952a245921

SHA1
1d142806c9aaf80974d8f5e7990b14469ed09d94

SHA256
18d59fbe7177db9f0a92a68ddecd8d54be698a1535b3fddd25641d562dd46df5

SHA512
1ec7dae598b760593f2db8147718cc61a4e1243579a64e6cbae74856bf5f4ee49fdb8c01cb54331e2ae824b9c49e168774ec98758ea2600174e7f605a5341417

Download Submit
C:\Windows\system\RtuVtHj.exe

Filesize
2.2MB

MD5
b67f36e8c90dddf9a7fbd44b3202eeaf

SHA1
d57d9785040183efe30c75ee04a555ed6d2fb610

SHA256
9a3aeb201d56cb08164b7033260aba7160deda639ca2441bd130ff4518844295

SHA512
6225f360bcf1513874ce29ad360a94865dfd4ba8b705e8eec058ecd5ae65b4beb445ea96d97f06a66a31f89acaf2785c0ac7bb3e4c5048a075f5d8fbe2d7cc4d

Download Submit
C:\Windows\system\TPzSvCO.exe

Filesize
2.2MB

MD5
7a48525b5b9f67769333b33a987c673d

SHA1
7419929ab9588a16adadbbe4fbaffc1d11275632

SHA256
ff177c00954dcd6fbbf14c98e0136f7a78be8a9b2d0ea5db882c387c5b6b0a96

SHA512
50e37bc0cbfdf7265c6558048b91678cb3e1bb4838ca791290d4bc2a483753a0d0ad6fc3bf47db0471cab9519347b6c47394e950db2b65c6f86cdcd7c1ad381b

Download Submit
C:\Windows\system\WVmiMnD.exe

Filesize
2.2MB

MD5
e01fe4ee8c5b9085a431b2cc1ec5a65c

SHA1
1b34020c43d347222a2af1a716436eeef6c03210

SHA256
c6b8a44de03a01401a0948c763a4df98c14c6e22a697964f9452e18e445a11eb

SHA512
5f637530923c698605937b958c75b536f89d1fcf14af1ab3a6f03d8e251f66b079276984aa4612a6455fd8eb8ae243e1721359568b0d4ea939fbb9900cfa7747

Download Submit
C:\Windows\system\XJqbqaQ.exe

Filesize
2.2MB

MD5
7d4721aecd4c1b73300ed8d71bf92213

SHA1
293ed52bd9ab6d740d24c70e5b207de27a0e25ea

SHA256
0f7f42e51d7e1892f953124498ddc03ee8e4177bdd6e8ca0025d8e7fabc6de98

SHA512
48ee502e01f894a55fd60bd68e0b8d849c7429352081d9fe67229d5123ab52d6f58d97173d050d5bbdcc562abecd9e6d8204e62f28b852a1b38e0f069e688242

Download Submit
C:\Windows\system\hKdzrZg.exe

Filesize
2.2MB

MD5
5ae103df6303fc157f761a230c1d9720

SHA1
22cdf6f3ada9fed9723ded522832a72ff9253766

SHA256
63b3a545d765e86deab7b3ec367ac3bc6b304d1f39c0ecd5aa4309ecb1459589

SHA512
0e1a664caf08e465f1347e25bd296fe870e3c6637c92c86a2cec783bde81ac32cd8f017eab942d6a4f20498c0c01f9267e5055e94e3d2a71c3dbc0d9676fe91f

Download Submit
C:\Windows\system\iQZgWQt.exe

Filesize
2.2MB

MD5
1e0768b5470603f9c4341d9496c273df

SHA1
0f2a5d5b7a46f3c2990608d368a74fa55869a8e5

SHA256
2f31792c7cfc8f490c29e239acbebec66d8e4e272da0f98872ab4b0894ae86a6

SHA512
2093c8b2c82054ebe77cb0e7b7246df3a7b919fb0d8da7aa6ded2a1b6e753c5b15b5033d079a7ba379ab4f3e44cef0480e235c1a7fe453e7b77c83a138b83cfd

Download Submit
C:\Windows\system\nJFoeah.exe

Filesize
2.2MB

MD5
f5ea2cba99a2f29246fee3e020cdaff8

SHA1
9035f213f1c98eecdf27290fcd9b313a915f9c0e

SHA256
07d7197ae015f2caed50843271db5e9ed3f89fcd3fa91f0ee4dc8ccc3b3a892b

SHA512
83ae79d1ee54cee35e4a117ed146bd2945bebf0ac14e944b5f625b25cef7777a86bbee49b5e51788792882f3422a1867b532f5c6f6ad10b78d197462071058ba

Download Submit
C:\Windows\system\oZanUjc.exe

Filesize
2.2MB

MD5
894345c459d75660bd7f822f5de7ec5d

SHA1
d67acd3b11a949437b2e195101987c4895617e3e

SHA256
388bfc4a9aa23a3ff90ba70cd6b7311da133efdd0269c7daa8fdcf9387f611c8

SHA512
1d9ade0d4bc55d634845ad9580e8d3c5dbedcc5cb1e55bc046912c12e9282cc5a0c1490d7d6869354e6308cde385f7df94b78d0f24ac1ee21e69fa4ce70e970e

Download Submit
C:\Windows\system\tdlzzwG.exe

Filesize
2.2MB

MD5
2955f002c62902fa120b256b95e173ae

SHA1
1f4a061c4cace1adb3bd209d6e99dca6b723ae41

SHA256
bd327f0d3900e5abe8b2654bd0d8755024c958056f32494eeef971c552edf3fd

SHA512
cf46903dd033a82aa409997b422e3fe571bd4302c1082df89711dfcc873ae47ea6fae2d088ff48924be45dffcb59d14cabd22876801a58c8cb3caeed8b1d8493

Download Submit
C:\Windows\system\xhObVJu.exe

Filesize
2.2MB

MD5
8b6b447dc7caf4abf2b81e2a65218d09

SHA1
32f28123015df65e9ef69c8948fba2db3f2bf71d

SHA256
112962d0322356c054d08571b71edc98928f6364c1a4bdc32a77b70ef3421e71

SHA512
71de73ce355dcf3dd370f11fcad60ddb190e3fbf40e59e16676f723cd8fd27bcf51484e4598d3bd145d547c36e8d4d4d18b35211b958ab6b8238c1f1b10ea751

Download Submit
\Windows\system\AXvfHrA.exe

Filesize
2.2MB

MD5
008f48c9904f6950157e625e75a2bef2

SHA1
d079b7ef57eb3fd1ec6fe2d8342a18998643ac42

SHA256
bf218d9573de1e573312461fe36af7d91e93cafb3cb20a515276545fee5f53f1

SHA512
8c33ebbaacf8b57bf081c84f5708a8c40930b00fd771b89f8e78418de6a07fc993a8f06f06325b5e468e0de4577a5c7d0fc25edb05cab15c72d9f5f7bd3eb574

Download Submit
\Windows\system\HJyRnKg.exe

Filesize
2.2MB

MD5
6e39d7c15b2d1e47b6c9de4818fdcfa8

SHA1
af7c74a4038b6bfd3e2a25ac5313dd9081bd567d

SHA256
3d77032dda426438ded6de403721da804b936b93ae8bc1674d3373acd9b223fe

SHA512
d8969c0623a5f7332dced82d07c93ffbb6a8c5ee016cea223492bb8c062ee3f4190353c6b4da87e20ac219317d1b32748577bc4de1f160725a438e8388ce8a6a

Download Submit
\Windows\system\KADwcgg.exe

Filesize
2.2MB

MD5
93e1e01e115d05881ca558e81978a4cd

SHA1
61b1062855fbae791c4d987f89bd78ec76ab3194

SHA256
9bfc08663c1636cf32ca6ecf9c458bd4b1c3e78c7db5eb9c80e0007fe5f7573f

SHA512
51054c18dc7a2d5613fdae6d66c6f574cf385e82f741ac7da083682fcdbe6a9ca90b92cd8d26cad555b4cac24df5d39878823a51133826f57c22ae0ac244977d

Download Submit
\Windows\system\KNtLWYg.exe

Filesize
2.2MB

MD5
ca952c306ca9f1a9c3b53198578ef0cf

SHA1
ad552ca934678a2d14fae2f6583b522fbb06e0b4

SHA256
9b6e468d0fc17ee10df50ca3d2bcb682c6bee8645de436df080afe87ce137bd7

SHA512
968eea05aadbec0819e750593f708d97aafb387b24ab71f177825274e4ea6c7fe143ba5abf02b3d1fad20cd0aa0d437968c1c85d74dcc83a2d029fd5cbd90056

Download Submit
\Windows\system\OXkqIxV.exe

Filesize
2.2MB

MD5
01bba6a3d30142395fae1e6fb7ae9064

SHA1
06a76a99b934215fa64e17496dbd72281a55a28b

SHA256
2633f8bace4a02bea12086bcb9ac26df9a2b18ec2c8e5b4008bead962354589c

SHA512
d903ae7d8c6e7c6efcf5aa4cd829159003222c799f7d46b08cca9d35aabe5343c02da1830380e1e24c0cb930657dae5179b31b22d732f06934ae80822dcc8282

Download Submit
\Windows\system\QInwZbU.exe

Filesize
2.2MB

MD5
5f7702c0b688cfd81077ddb25d3659ed

SHA1
6ef4dc624f4f5d19cf2f8c2f8b9d6a85d0906f32

SHA256
f0e124e70c8a74c17b797382ada958eb05991c78d1dbc3c8bde891959b6afd33

SHA512
effc675cff89a079873f9118c5587320d1e1901b1a98a4dec8ff2c68bc190c44418fc5bd993eb454a5ea0295a44c60580e47e21992846dd5de185a2558f834dd

Download Submit
\Windows\system\RIcCjwi.exe

Filesize
2.2MB

MD5
68e5d6d9ac014989e0a2c17da5d6b4a4

SHA1
b309774d854e97c6b6cdc7f24f4d5c544a8948b1

SHA256
ff2c8d10dbc55997731d05d7c0efc3c9e2cde4498989c91af61ac0cddb8483ac

SHA512
27f44182b55f591a1410de95366c2a322f432805f36c2fb6011a39811ada1f9c8dec2ec1e78e9cd6703f7fff87b0b1c9f85927841d686e5b27e39fd6ed01595f

Download Submit
\Windows\system\RtIYBCR.exe

Filesize
2.2MB

MD5
69b2c532dad8029ebd6f2f171599cb12

SHA1
847bf45e52df3d26efda26a0c046e907deee670c

SHA256
e3405575204e1f68c4aaabf7653d6ae53182deecb10a1e33444621734c9c61ae

SHA512
f7538fd7041a07ff6b217d3822d1323f825600c8778bdf9ea96a512878313c2eefd125aaeef7291a8196e1670b438c22a11396a7fddce4c1dc0d9d7e5f3d0102

Download Submit
\Windows\system\XhJsodh.exe

Filesize
2.2MB

MD5
cb64c24bb797965b3a81df2fb3ad67b0

SHA1
55487a0eac90db80bdff3b0cc6cbf365a7fd17ca

SHA256
95d13f55a2afa606981e74106906404e686db2f615395bcf725cdbc1c35a3240

SHA512
87974bf71aac1bbb9deb0540d70d05242f8c94b34db523e3c7e88c13c145a7f89fdc24ecf4a75a9b2c0563f3c152d62dbc9f620402f5f8fe830ac58d9ccbd8c9

Download Submit
\Windows\system\gLnXzwV.exe

Filesize
2.2MB

MD5
615138c60a54494ec5ea8fcdc9a4d1e7

SHA1
d97df08704656a9a9c836e1f1251aa35c9605e72

SHA256
a8caa221d9932691e844164821de6f7dd619b4715dba26f225633719bdd1a43d

SHA512
c928d4cba23c3543737ca33ba011f3f84ec2d3afe3dd1987d7440e9d894e00ae98164e4687a5d17e5781447e6b43f13af12a5799491fe020fac5e03af1ebe43d

Download Submit
\Windows\system\knntLBS.exe

Filesize
2.2MB

MD5
3d8e0c287079b9cc04a9575a7a188dca

SHA1
fe693a20e2f0b10a458cf98fd87de600ef832ee3

SHA256
c16809b77647d2596c22fdc1002e05d4da12d9fb40ff1220d030233307d69193

SHA512
cc0a1b1b75ac6d7374072c3a69ee5a8865130ad86d08105a9ad22bca99c6947381044d58543905ba4d88844eabf29ba74174aa3eb555cc0d07f2d4540dae12e4

Download Submit
\Windows\system\pVjvoDc.exe

Filesize
2.2MB

MD5
6919205b8e04c8f28a66c73e0d770b01

SHA1
03c2b34270391bfb806c9ab05f5a8612a1876f01

SHA256
afcb1047e2613eea19b696b3e4028900fcb893d0fc800e70a609af97d480d59c

SHA512
b14d8290c72bcc6733a11a3937e3787190d4685e23d916a87d76daf3848cf79f59cdf1ccead54137d1e689055152cb3fdd9d412e7f3d7e24ad3c9459fea9568c

Download Submit
\Windows\system\uLKzPna.exe

Filesize
2.2MB

MD5
765b2d61aca206e86b204083ef601a9a

SHA1
22ae1b91a168c37ae545831c890b5b3cd15796d3

SHA256
0db968f260cb76ba8a72c0b8ab9203296b334718771fdd7536ae84570779dd69

SHA512
b1a3ad7fe88989bdc5c96489a11b35146e51b4fea48a750999f9d5bb552867ec559c8e15eb52441d350b7787d7d1fe69705fe52c26efc39b1174e09e513ee546

Download Submit
\Windows\system\uzLLeKx.exe

Filesize
2.2MB

MD5
1ac684b7a6c2643a7f538ad888c068bd

SHA1
1cb4054ea822181c8f2098286f5c2cd0caf224a4

SHA256
687b10d23b1af30263dfaf4d1b9a8ce4a02ddddc22571cf5608c6bea3008c653

SHA512
cc36126ec6191f2a0521b77d4a12ffffef6d8245255b09ff74baea6127c07cba9a37e188ea5359adc10785577b0f70372ef8dfb91c3a55f0535b599191ff3354

Download Submit
memory/1300-91-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/1564-70-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/1948-56-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2256-36-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2404-59-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2540-44-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2552-58-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-54-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-47-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2648-76-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-84-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2728-62-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2868-55-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-75-0x0000000003490000-0x0000000003882000-memory.dmp

Filesize
3.9MB

Download
memory/2868-49-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-50-0x00000000030C0000-0x00000000034B2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-52-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-45-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2868-1277-0x00000000030C0000-0x00000000034B2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2868-89-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2868-78-0x0000000003490000-0x0000000003882000-memory.dmp

Filesize
3.9MB

Download
memory/2868-0-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2868-43-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2868-69-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2868-30-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2920-61-0x0000000002780000-0x0000000002788000-memory.dmp

Filesize
32KB

Download
memory/2920-57-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download