xmrig | bfe8ce21dddaf44ca991b261cc9464f98f76adcd2d28be0c6adbc7269d03179b

Analysis

max time kernel
34s
max time network
58s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
Size

2.3MB
MD5

04b8d600d2ac70348ed501b089de3fa0
SHA1

af63ee49b66f48960e84a72b78fb8124377d0ea2
SHA256

bfe8ce21dddaf44ca991b261cc9464f98f76adcd2d28be0c6adbc7269d03179b
SHA512

ac714f8f25d8534997110e8d8cb45ad04727fa9241726ab6a5a047c22137c8443cbc9992fd544efcec8ad6ad8cf7d3decb78df05be29c368ba48eed08d933ae0
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDio0:NAB7

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

resource	yara_rule
behavioral1/memory/2156-84-0x0000000003690000-0x0000000003A82000-memory.dmp	xmrig
behavioral1/memory/2404-83-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2156-82-0x000000013FFE0000-0x00000001403D2000-memory.dmp	xmrig
behavioral1/memory/1284-17-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/2172-42-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2672-37-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/2172-3701-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2672-3702-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/2504-3705-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2656-3711-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2404-3712-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2384-3713-0x000000013F660000-0x000000013FA52000-memory.dmp	xmrig
behavioral1/memory/2064-3714-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig
behavioral1/memory/2676-3715-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/1884-3708-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1284	fmGyipI.exe
1884	vdprvYi.exe
2172	EaVtPGA.exe
2672	IweIhOV.exe
2504	kLXaUjZ.exe
2284	NfphSyL.exe
2676	uRoynVl.exe
2064	rcpOBHR.exe
2656	SIRTJpM.exe
2384	aBzwvUo.exe
2404	voLvNhd.exe
2748	ZEAidgj.exe
2936	kqWPFhW.exe
2012	CLvrVBY.exe
2596	YpGBHEz.exe
1864	SPVzApD.exe
2588	IStCiXo.exe
2736	TAIuBCb.exe
2752	MRjbXZn.exe
1628	VAGorGo.exe
1892	mNnhZoN.exe
2872	iHTaGAT.exe
2896	bzseqmp.exe
2400	ABsPPMV.exe
2240	nVbheWi.exe
1792	jnBQEXP.exe
1824	HsmigrU.exe
324	xEFXZvW.exe
948	fNModDQ.exe
2220	DqIUGSM.exe
2900	LmpPKbA.exe
1084	EOqakyC.exe
2008	WfSlmHS.exe
1664	HTXJrbF.exe
1532	xuSyQJP.exe
1692	dAblsUq.exe
1852	DihXJtg.exe
1356	XfjKeCD.exe
3044	UiKZqjG.exe
1744	kZAChQL.exe
1740	ublsEMt.exe
2820	pGQvQMW.exe
3024	XcxsJvF.exe
2224	eVRJans.exe
2068	Mfxpzub.exe
352	DFpFUlo.exe
2204	tlafwno.exe
1380	JlVZGck.exe
1624	LMvJKLB.exe
884	LiaMHUH.exe
2300	iCUvkcm.exe
1732	CRRChFt.exe
1592	qErDQnF.exe
1708	udklnnk.exe
1240	lhRfOEC.exe
2276	vxJrXeX.exe
2564	sZwadgJ.exe
2456	CDDrRAE.exe
2668	LBCrPGP.exe
2960	DZrWChp.exe
2208	vrsuoSw.exe
1996	izYwjwX.exe
1460	OrHBlRB.exe
2044	GcQVaOg.exe

Loads dropped DLL 64 IoCs

pid	Process
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2156-1-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/files/0x000700000001432c-36.dat	upx
behavioral1/files/0x0007000000014318-23.dat	upx
behavioral1/memory/2676-48-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/files/0x000a000000013a45-26.dat	upx
behavioral1/files/0x0006000000014bea-63.dat	upx
behavioral1/memory/2156-67-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/files/0x0006000000014e51-66.dat	upx
behavioral1/memory/2384-65-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/files/0x000600000001567f-119.dat	upx
behavioral1/files/0x0006000000015cba-139.dat	upx
behavioral1/files/0x0006000000015ceb-154.dat	upx
behavioral1/files/0x0006000000015d67-183.dat	upx
behavioral1/files/0x0006000000015d28-164.dat	upx
behavioral1/files/0x0006000000015d6f-187.dat	upx
behavioral1/files/0x0006000000015d56-174.dat	upx
behavioral1/files/0x0006000000015d5e-180.dat	upx
behavioral1/files/0x0006000000015d4a-170.dat	upx
behavioral1/files/0x0006000000015d07-159.dat	upx
behavioral1/files/0x0006000000015ce1-149.dat	upx
behavioral1/files/0x0006000000015cd5-144.dat	upx
behavioral1/files/0x0006000000015ca6-134.dat	upx
behavioral1/files/0x0006000000015be6-129.dat	upx
behavioral1/files/0x000600000001568c-124.dat	upx
behavioral1/files/0x000600000001566b-114.dat	upx
behavioral1/files/0x0006000000015661-109.dat	upx
behavioral1/files/0x0006000000015659-104.dat	upx
behavioral1/files/0x000700000001508a-95.dat	upx
behavioral1/files/0x0006000000015653-99.dat	upx
behavioral1/memory/2404-83-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2156-82-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/files/0x0006000000014f71-77.dat	upx
behavioral1/files/0x0007000000004e76-88.dat	upx
behavioral1/memory/2656-59-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x0006000000014baa-57.dat	upx
behavioral1/memory/2064-54-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/files/0x0008000000014b27-52.dat	upx
behavioral1/memory/1284-17-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/files/0x000800000001420f-15.dat	upx
behavioral1/memory/2284-46-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/2504-43-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/2172-42-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2672-37-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/1884-34-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/files/0x000700000001424e-33.dat	upx
behavioral1/files/0x0008000000014185-31.dat	upx
behavioral1/files/0x00070000000122cd-6.dat	upx
behavioral1/memory/2172-3701-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2672-3702-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/2504-3705-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/2656-3711-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2404-3712-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2384-3713-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/memory/2064-3714-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/memory/2676-3715-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/memory/1884-3708-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GZfiRAh.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\xENRokx.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\rbdpttY.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\qiluXCW.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\RCHFClT.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\gMMoxtG.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\AQSdbsD.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\nIBCFEf.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\scwnEqY.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\KwjcSgU.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\zqLnhGK.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\dAblsUq.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\HBkeqND.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\KUYjZop.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\BmjmXcF.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\aLjsHBY.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\vrsuoSw.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\oklrIQG.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\vXVBHDR.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\HxoURDr.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\JlqvEKe.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\BEHhpdN.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\gVjdlTO.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\GXyJivc.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\LYurHDr.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\eEUuECl.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\ERzoCpR.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\puhLElS.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\XBRKzPo.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\iBSSXog.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\KnNTgxR.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\TEzvpAH.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\paACXKX.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\mEoqKxr.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\ykTUHIK.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\qAzWswf.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\bWGKpLO.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\MlGOsrM.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\YpBJHRu.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\PCQwuZk.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\NfphSyL.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\YpGBHEz.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\gsmOBdS.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\apipdMi.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\PAuHOgD.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\UnZbNQa.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\aYZKOlr.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\txXrqeU.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\cIaXxnz.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\dXHhoEO.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\BjJnLlv.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\TXULwRB.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\VDomIuj.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\dxaKdLQ.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\IWOnzCU.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\GpGKxik.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\RvjDFNU.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\yNFkhTm.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\COCyYpZ.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\EGbDIUr.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\vjKdIrM.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\NlGlgEp.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\ZEAidgj.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
File created	C:\Windows\System\TdtzQUL.exe	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2128	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
Token: SeDebugPrivilege	2128	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2128	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	29
PID 2156 wrote to memory of 2128	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	29
PID 2156 wrote to memory of 2128	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	29
PID 2156 wrote to memory of 1284	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	30
PID 2156 wrote to memory of 1284	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	30
PID 2156 wrote to memory of 1284	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	30
PID 2156 wrote to memory of 1884	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	31
PID 2156 wrote to memory of 1884	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	31
PID 2156 wrote to memory of 1884	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	31
PID 2156 wrote to memory of 2172	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	32
PID 2156 wrote to memory of 2172	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	32
PID 2156 wrote to memory of 2172	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	32
PID 2156 wrote to memory of 2284	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	33
PID 2156 wrote to memory of 2284	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	33
PID 2156 wrote to memory of 2284	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	33
PID 2156 wrote to memory of 2672	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	34
PID 2156 wrote to memory of 2672	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	34
PID 2156 wrote to memory of 2672	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	34
PID 2156 wrote to memory of 2676	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	35
PID 2156 wrote to memory of 2676	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	35
PID 2156 wrote to memory of 2676	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	35
PID 2156 wrote to memory of 2504	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	36
PID 2156 wrote to memory of 2504	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	36
PID 2156 wrote to memory of 2504	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	36
PID 2156 wrote to memory of 2064	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	37
PID 2156 wrote to memory of 2064	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	37
PID 2156 wrote to memory of 2064	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	37
PID 2156 wrote to memory of 2656	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	38
PID 2156 wrote to memory of 2656	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	38
PID 2156 wrote to memory of 2656	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	38
PID 2156 wrote to memory of 2384	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	39
PID 2156 wrote to memory of 2384	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	39
PID 2156 wrote to memory of 2384	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	39
PID 2156 wrote to memory of 2404	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	40
PID 2156 wrote to memory of 2404	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	40
PID 2156 wrote to memory of 2404	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	40
PID 2156 wrote to memory of 2936	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	41
PID 2156 wrote to memory of 2936	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	41
PID 2156 wrote to memory of 2936	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	41
PID 2156 wrote to memory of 2748	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	42
PID 2156 wrote to memory of 2748	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	42
PID 2156 wrote to memory of 2748	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	42
PID 2156 wrote to memory of 2012	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	43
PID 2156 wrote to memory of 2012	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	43
PID 2156 wrote to memory of 2012	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	43
PID 2156 wrote to memory of 2596	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	44
PID 2156 wrote to memory of 2596	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	44
PID 2156 wrote to memory of 2596	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	44
PID 2156 wrote to memory of 1864	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	45
PID 2156 wrote to memory of 1864	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	45
PID 2156 wrote to memory of 1864	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	45
PID 2156 wrote to memory of 2588	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	46
PID 2156 wrote to memory of 2588	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	46
PID 2156 wrote to memory of 2588	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	46
PID 2156 wrote to memory of 2736	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	47
PID 2156 wrote to memory of 2736	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	47
PID 2156 wrote to memory of 2736	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	47
PID 2156 wrote to memory of 2752	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	48
PID 2156 wrote to memory of 2752	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	48
PID 2156 wrote to memory of 2752	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	48
PID 2156 wrote to memory of 1628	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	49
PID 2156 wrote to memory of 1628	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	49
PID 2156 wrote to memory of 1628	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	49
PID 2156 wrote to memory of 1892	2156	04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04b8d600d2ac70348ed501b089de3fa0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Windows\System\fmGyipI.exe
  C:\Windows\System\fmGyipI.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\vdprvYi.exe
  C:\Windows\System\vdprvYi.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\EaVtPGA.exe
  C:\Windows\System\EaVtPGA.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\NfphSyL.exe
  C:\Windows\System\NfphSyL.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\IweIhOV.exe
  C:\Windows\System\IweIhOV.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\uRoynVl.exe
  C:\Windows\System\uRoynVl.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\kLXaUjZ.exe
  C:\Windows\System\kLXaUjZ.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\rcpOBHR.exe
  C:\Windows\System\rcpOBHR.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\SIRTJpM.exe
  C:\Windows\System\SIRTJpM.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\aBzwvUo.exe
  C:\Windows\System\aBzwvUo.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\voLvNhd.exe
  C:\Windows\System\voLvNhd.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\kqWPFhW.exe
  C:\Windows\System\kqWPFhW.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\ZEAidgj.exe
  C:\Windows\System\ZEAidgj.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\CLvrVBY.exe
  C:\Windows\System\CLvrVBY.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\YpGBHEz.exe
  C:\Windows\System\YpGBHEz.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\SPVzApD.exe
  C:\Windows\System\SPVzApD.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\IStCiXo.exe
  C:\Windows\System\IStCiXo.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\TAIuBCb.exe
  C:\Windows\System\TAIuBCb.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\MRjbXZn.exe
  C:\Windows\System\MRjbXZn.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\VAGorGo.exe
  C:\Windows\System\VAGorGo.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\mNnhZoN.exe
  C:\Windows\System\mNnhZoN.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\iHTaGAT.exe
  C:\Windows\System\iHTaGAT.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\bzseqmp.exe
  C:\Windows\System\bzseqmp.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\ABsPPMV.exe
  C:\Windows\System\ABsPPMV.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\nVbheWi.exe
  C:\Windows\System\nVbheWi.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\jnBQEXP.exe
  C:\Windows\System\jnBQEXP.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\HsmigrU.exe
  C:\Windows\System\HsmigrU.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\xEFXZvW.exe
  C:\Windows\System\xEFXZvW.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\fNModDQ.exe
  C:\Windows\System\fNModDQ.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\DqIUGSM.exe
  C:\Windows\System\DqIUGSM.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\LmpPKbA.exe
  C:\Windows\System\LmpPKbA.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\xuSyQJP.exe
  C:\Windows\System\xuSyQJP.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\EOqakyC.exe
  C:\Windows\System\EOqakyC.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\dAblsUq.exe
  C:\Windows\System\dAblsUq.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\WfSlmHS.exe
  C:\Windows\System\WfSlmHS.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\DihXJtg.exe
  C:\Windows\System\DihXJtg.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\HTXJrbF.exe
  C:\Windows\System\HTXJrbF.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\XfjKeCD.exe
  C:\Windows\System\XfjKeCD.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\UiKZqjG.exe
  C:\Windows\System\UiKZqjG.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\kZAChQL.exe
  C:\Windows\System\kZAChQL.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\ublsEMt.exe
  C:\Windows\System\ublsEMt.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\pGQvQMW.exe
  C:\Windows\System\pGQvQMW.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\XcxsJvF.exe
  C:\Windows\System\XcxsJvF.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\eVRJans.exe
  C:\Windows\System\eVRJans.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\Mfxpzub.exe
  C:\Windows\System\Mfxpzub.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\DFpFUlo.exe
  C:\Windows\System\DFpFUlo.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\tlafwno.exe
  C:\Windows\System\tlafwno.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\JlVZGck.exe
  C:\Windows\System\JlVZGck.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\LMvJKLB.exe
  C:\Windows\System\LMvJKLB.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\LiaMHUH.exe
  C:\Windows\System\LiaMHUH.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\iCUvkcm.exe
  C:\Windows\System\iCUvkcm.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\CRRChFt.exe
  C:\Windows\System\CRRChFt.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\qErDQnF.exe
  C:\Windows\System\qErDQnF.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\udklnnk.exe
  C:\Windows\System\udklnnk.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\lhRfOEC.exe
  C:\Windows\System\lhRfOEC.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\vxJrXeX.exe
  C:\Windows\System\vxJrXeX.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\sZwadgJ.exe
  C:\Windows\System\sZwadgJ.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\CDDrRAE.exe
  C:\Windows\System\CDDrRAE.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\LBCrPGP.exe
  C:\Windows\System\LBCrPGP.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\DZrWChp.exe
  C:\Windows\System\DZrWChp.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\vrsuoSw.exe
  C:\Windows\System\vrsuoSw.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\izYwjwX.exe
  C:\Windows\System\izYwjwX.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\OrHBlRB.exe
  C:\Windows\System\OrHBlRB.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\GcQVaOg.exe
  C:\Windows\System\GcQVaOg.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\ahbhrOg.exe
  C:\Windows\System\ahbhrOg.exe
  2⤵
  PID:2580
- C:\Windows\System\QiYjTke.exe
  C:\Windows\System\QiYjTke.exe
  2⤵
  PID:2732
- C:\Windows\System\SryZIrO.exe
  C:\Windows\System\SryZIrO.exe
  2⤵
  PID:1604
- C:\Windows\System\WoiMVfv.exe
  C:\Windows\System\WoiMVfv.exe
  2⤵
  PID:1644
- C:\Windows\System\ZUGFHqe.exe
  C:\Windows\System\ZUGFHqe.exe
  2⤵
  PID:2892
- C:\Windows\System\nfulOpY.exe
  C:\Windows\System\nfulOpY.exe
  2⤵
  PID:2228
- C:\Windows\System\EjkDfhF.exe
  C:\Windows\System\EjkDfhF.exe
  2⤵
  PID:676
- C:\Windows\System\EkKpqnh.exe
  C:\Windows\System\EkKpqnh.exe
  2⤵
  PID:2324
- C:\Windows\System\dCLVgMC.exe
  C:\Windows\System\dCLVgMC.exe
  2⤵
  PID:1584
- C:\Windows\System\aswbhzG.exe
  C:\Windows\System\aswbhzG.exe
  2⤵
  PID:2628
- C:\Windows\System\XPxwrrR.exe
  C:\Windows\System\XPxwrrR.exe
  2⤵
  PID:2708
- C:\Windows\System\pbvyWYr.exe
  C:\Windows\System\pbvyWYr.exe
  2⤵
  PID:1876
- C:\Windows\System\TGkPzzN.exe
  C:\Windows\System\TGkPzzN.exe
  2⤵
  PID:2516
- C:\Windows\System\yTwcVaD.exe
  C:\Windows\System\yTwcVaD.exe
  2⤵
  PID:2496
- C:\Windows\System\FNpjzIO.exe
  C:\Windows\System\FNpjzIO.exe
  2⤵
  PID:588
- C:\Windows\System\OzdYffD.exe
  C:\Windows\System\OzdYffD.exe
  2⤵
  PID:384
- C:\Windows\System\iufpghX.exe
  C:\Windows\System\iufpghX.exe
  2⤵
  PID:2680
- C:\Windows\System\NyTkFHF.exe
  C:\Windows\System\NyTkFHF.exe
  2⤵
  PID:2648
- C:\Windows\System\lYtWqlp.exe
  C:\Windows\System\lYtWqlp.exe
  2⤵
  PID:636
- C:\Windows\System\vGyClFm.exe
  C:\Windows\System\vGyClFm.exe
  2⤵
  PID:1820
- C:\Windows\System\nYmqyLr.exe
  C:\Windows\System\nYmqyLr.exe
  2⤵
  PID:880
- C:\Windows\System\KYyGuER.exe
  C:\Windows\System\KYyGuER.exe
  2⤵
  PID:1040
- C:\Windows\System\ysvNLZF.exe
  C:\Windows\System\ysvNLZF.exe
  2⤵
  PID:1120
- C:\Windows\System\yIBbLVq.exe
  C:\Windows\System\yIBbLVq.exe
  2⤵
  PID:1276
- C:\Windows\System\aIrlvBI.exe
  C:\Windows\System\aIrlvBI.exe
  2⤵
  PID:3036
- C:\Windows\System\RGjdjwt.exe
  C:\Windows\System\RGjdjwt.exe
  2⤵
  PID:452
- C:\Windows\System\pBlVnKM.exe
  C:\Windows\System\pBlVnKM.exe
  2⤵
  PID:1536
- C:\Windows\System\FuvhonX.exe
  C:\Windows\System\FuvhonX.exe
  2⤵
  PID:1748
- C:\Windows\System\ejcyvfA.exe
  C:\Windows\System\ejcyvfA.exe
  2⤵
  PID:1612
- C:\Windows\System\WWEbADH.exe
  C:\Windows\System\WWEbADH.exe
  2⤵
  PID:2336
- C:\Windows\System\rzlOfzr.exe
  C:\Windows\System\rzlOfzr.exe
  2⤵
  PID:1760
- C:\Windows\System\KppnDDo.exe
  C:\Windows\System\KppnDDo.exe
  2⤵
  PID:1248
- C:\Windows\System\vLkYpFE.exe
  C:\Windows\System\vLkYpFE.exe
  2⤵
  PID:2976
- C:\Windows\System\fYjBWbg.exe
  C:\Windows\System\fYjBWbg.exe
  2⤵
  PID:1048
- C:\Windows\System\pXwuArq.exe
  C:\Windows\System\pXwuArq.exe
  2⤵
  PID:1988
- C:\Windows\System\oFaxIYh.exe
  C:\Windows\System\oFaxIYh.exe
  2⤵
  PID:608
- C:\Windows\System\vnvkdMK.exe
  C:\Windows\System\vnvkdMK.exe
  2⤵
  PID:2340
- C:\Windows\System\UKiFaIn.exe
  C:\Windows\System\UKiFaIn.exe
  2⤵
  PID:2852
- C:\Windows\System\hqJAcFN.exe
  C:\Windows\System\hqJAcFN.exe
  2⤵
  PID:1152
- C:\Windows\System\iLKhXXR.exe
  C:\Windows\System\iLKhXXR.exe
  2⤵
  PID:1840
- C:\Windows\System\yNFkhTm.exe
  C:\Windows\System\yNFkhTm.exe
  2⤵
  PID:2320
- C:\Windows\System\UhIhmgh.exe
  C:\Windows\System\UhIhmgh.exe
  2⤵
  PID:2928
- C:\Windows\System\ZcWEeJi.exe
  C:\Windows\System\ZcWEeJi.exe
  2⤵
  PID:1552
- C:\Windows\System\YNEzVvA.exe
  C:\Windows\System\YNEzVvA.exe
  2⤵
  PID:2616
- C:\Windows\System\STaGThQ.exe
  C:\Windows\System\STaGThQ.exe
  2⤵
  PID:2884
- C:\Windows\System\cQhcHeK.exe
  C:\Windows\System\cQhcHeK.exe
  2⤵
  PID:1860
- C:\Windows\System\FXRRYyx.exe
  C:\Windows\System\FXRRYyx.exe
  2⤵
  PID:2332
- C:\Windows\System\IBUJdUs.exe
  C:\Windows\System\IBUJdUs.exe
  2⤵
  PID:2592
- C:\Windows\System\JgNwcfa.exe
  C:\Windows\System\JgNwcfa.exe
  2⤵
  PID:1648
- C:\Windows\System\KeRyFIP.exe
  C:\Windows\System\KeRyFIP.exe
  2⤵
  PID:1944
- C:\Windows\System\nQDvALa.exe
  C:\Windows\System\nQDvALa.exe
  2⤵
  PID:2776
- C:\Windows\System\MhtMPjI.exe
  C:\Windows\System\MhtMPjI.exe
  2⤵
  PID:332
- C:\Windows\System\OAlTAUL.exe
  C:\Windows\System\OAlTAUL.exe
  2⤵
  PID:1508
- C:\Windows\System\JsTZzir.exe
  C:\Windows\System\JsTZzir.exe
  2⤵
  PID:1772
- C:\Windows\System\ihiveDN.exe
  C:\Windows\System\ihiveDN.exe
  2⤵
  PID:1888
- C:\Windows\System\VXTvtKT.exe
  C:\Windows\System\VXTvtKT.exe
  2⤵
  PID:240
- C:\Windows\System\oklrIQG.exe
  C:\Windows\System\oklrIQG.exe
  2⤵
  PID:2472
- C:\Windows\System\bjkvvaa.exe
  C:\Windows\System\bjkvvaa.exe
  2⤵
  PID:1804
- C:\Windows\System\QafZKfb.exe
  C:\Windows\System\QafZKfb.exe
  2⤵
  PID:2388
- C:\Windows\System\RKwNPKd.exe
  C:\Windows\System\RKwNPKd.exe
  2⤵
  PID:916
- C:\Windows\System\LXlcMpH.exe
  C:\Windows\System\LXlcMpH.exe
  2⤵
  PID:1620
- C:\Windows\System\TCiNBxZ.exe
  C:\Windows\System\TCiNBxZ.exe
  2⤵
  PID:2572
- C:\Windows\System\VVbXKgU.exe
  C:\Windows\System\VVbXKgU.exe
  2⤵
  PID:1992
- C:\Windows\System\iAqJIOF.exe
  C:\Windows\System\iAqJIOF.exe
  2⤵
  PID:848
- C:\Windows\System\hQkPUQK.exe
  C:\Windows\System\hQkPUQK.exe
  2⤵
  PID:1932
- C:\Windows\System\bgBMPCS.exe
  C:\Windows\System\bgBMPCS.exe
  2⤵
  PID:2152
- C:\Windows\System\ENJLsyQ.exe
  C:\Windows\System\ENJLsyQ.exe
  2⤵
  PID:952
- C:\Windows\System\vUbXApt.exe
  C:\Windows\System\vUbXApt.exe
  2⤵
  PID:2188
- C:\Windows\System\TdtzQUL.exe
  C:\Windows\System\TdtzQUL.exe
  2⤵
  PID:2728
- C:\Windows\System\XrBUeiw.exe
  C:\Windows\System\XrBUeiw.exe
  2⤵
  PID:2600
- C:\Windows\System\PudTLPv.exe
  C:\Windows\System\PudTLPv.exe
  2⤵
  PID:3032
- C:\Windows\System\WUOkqtZ.exe
  C:\Windows\System\WUOkqtZ.exe
  2⤵
  PID:2540
- C:\Windows\System\vPcbkTx.exe
  C:\Windows\System\vPcbkTx.exe
  2⤵
  PID:1596
- C:\Windows\System\fWLYflN.exe
  C:\Windows\System\fWLYflN.exe
  2⤵
  PID:3088
- C:\Windows\System\vrZXgni.exe
  C:\Windows\System\vrZXgni.exe
  2⤵
  PID:3104
- C:\Windows\System\YqYuDUq.exe
  C:\Windows\System\YqYuDUq.exe
  2⤵
  PID:3120
- C:\Windows\System\OwnhFKz.exe
  C:\Windows\System\OwnhFKz.exe
  2⤵
  PID:3136
- C:\Windows\System\wpClnCg.exe
  C:\Windows\System\wpClnCg.exe
  2⤵
  PID:3152
- C:\Windows\System\lUgcfZA.exe
  C:\Windows\System\lUgcfZA.exe
  2⤵
  PID:3168
- C:\Windows\System\gwnjCZI.exe
  C:\Windows\System\gwnjCZI.exe
  2⤵
  PID:3184
- C:\Windows\System\nEtZeTh.exe
  C:\Windows\System\nEtZeTh.exe
  2⤵
  PID:3200
- C:\Windows\System\dQcKJOr.exe
  C:\Windows\System\dQcKJOr.exe
  2⤵
  PID:3216
- C:\Windows\System\gESnzbL.exe
  C:\Windows\System\gESnzbL.exe
  2⤵
  PID:3232
- C:\Windows\System\sDefMVq.exe
  C:\Windows\System\sDefMVq.exe
  2⤵
  PID:3248
- C:\Windows\System\mQUxSlF.exe
  C:\Windows\System\mQUxSlF.exe
  2⤵
  PID:3264
- C:\Windows\System\toWGLtF.exe
  C:\Windows\System\toWGLtF.exe
  2⤵
  PID:3284
- C:\Windows\System\dHOjeFg.exe
  C:\Windows\System\dHOjeFg.exe
  2⤵
  PID:3300
- C:\Windows\System\ltQEOgs.exe
  C:\Windows\System\ltQEOgs.exe
  2⤵
  PID:3316
- C:\Windows\System\HZHJhNd.exe
  C:\Windows\System\HZHJhNd.exe
  2⤵
  PID:3332
- C:\Windows\System\EqGJBrj.exe
  C:\Windows\System\EqGJBrj.exe
  2⤵
  PID:3348
- C:\Windows\System\YSJuUcL.exe
  C:\Windows\System\YSJuUcL.exe
  2⤵
  PID:3364
- C:\Windows\System\UeiOgNb.exe
  C:\Windows\System\UeiOgNb.exe
  2⤵
  PID:3380
- C:\Windows\System\GpGKxik.exe
  C:\Windows\System\GpGKxik.exe
  2⤵
  PID:3396
- C:\Windows\System\FQDVANR.exe
  C:\Windows\System\FQDVANR.exe
  2⤵
  PID:3412
- C:\Windows\System\BRJEJRA.exe
  C:\Windows\System\BRJEJRA.exe
  2⤵
  PID:3428
- C:\Windows\System\cJZLgvS.exe
  C:\Windows\System\cJZLgvS.exe
  2⤵
  PID:3444
- C:\Windows\System\hvViTGb.exe
  C:\Windows\System\hvViTGb.exe
  2⤵
  PID:3460
- C:\Windows\System\SQaTPxa.exe
  C:\Windows\System\SQaTPxa.exe
  2⤵
  PID:3476
- C:\Windows\System\sjkQeaj.exe
  C:\Windows\System\sjkQeaj.exe
  2⤵
  PID:3500
- C:\Windows\System\kBTIZxE.exe
  C:\Windows\System\kBTIZxE.exe
  2⤵
  PID:3520
- C:\Windows\System\TsAOyMI.exe
  C:\Windows\System\TsAOyMI.exe
  2⤵
  PID:3536
- C:\Windows\System\okEDGMk.exe
  C:\Windows\System\okEDGMk.exe
  2⤵
  PID:3552
- C:\Windows\System\pUYqCXy.exe
  C:\Windows\System\pUYqCXy.exe
  2⤵
  PID:3568
- C:\Windows\System\QZmCRNf.exe
  C:\Windows\System\QZmCRNf.exe
  2⤵
  PID:3584
- C:\Windows\System\qldHsyY.exe
  C:\Windows\System\qldHsyY.exe
  2⤵
  PID:3600
- C:\Windows\System\TwewzDM.exe
  C:\Windows\System\TwewzDM.exe
  2⤵
  PID:3616
- C:\Windows\System\ltdZTve.exe
  C:\Windows\System\ltdZTve.exe
  2⤵
  PID:3632
- C:\Windows\System\hALIxgu.exe
  C:\Windows\System\hALIxgu.exe
  2⤵
  PID:3648
- C:\Windows\System\NbalOmk.exe
  C:\Windows\System\NbalOmk.exe
  2⤵
  PID:3664
- C:\Windows\System\stkjvbO.exe
  C:\Windows\System\stkjvbO.exe
  2⤵
  PID:3716
- C:\Windows\System\cvIqxGD.exe
  C:\Windows\System\cvIqxGD.exe
  2⤵
  PID:3732
- C:\Windows\System\BqOzDaR.exe
  C:\Windows\System\BqOzDaR.exe
  2⤵
  PID:3748
- C:\Windows\System\ekUPfkV.exe
  C:\Windows\System\ekUPfkV.exe
  2⤵
  PID:3764
- C:\Windows\System\vjTpaqz.exe
  C:\Windows\System\vjTpaqz.exe
  2⤵
  PID:3780
- C:\Windows\System\CuZBzIn.exe
  C:\Windows\System\CuZBzIn.exe
  2⤵
  PID:3804
- C:\Windows\System\BLVpzNA.exe
  C:\Windows\System\BLVpzNA.exe
  2⤵
  PID:3820
- C:\Windows\System\jkCxgrp.exe
  C:\Windows\System\jkCxgrp.exe
  2⤵
  PID:3836
- C:\Windows\System\sJOAtyM.exe
  C:\Windows\System\sJOAtyM.exe
  2⤵
  PID:3852
- C:\Windows\System\iUPPfLK.exe
  C:\Windows\System\iUPPfLK.exe
  2⤵
  PID:3872
- C:\Windows\System\RCHFClT.exe
  C:\Windows\System\RCHFClT.exe
  2⤵
  PID:3888
- C:\Windows\System\jlvFBwF.exe
  C:\Windows\System\jlvFBwF.exe
  2⤵
  PID:3908
- C:\Windows\System\VHmFtjk.exe
  C:\Windows\System\VHmFtjk.exe
  2⤵
  PID:3924
- C:\Windows\System\FPDxLty.exe
  C:\Windows\System\FPDxLty.exe
  2⤵
  PID:3940
- C:\Windows\System\mqlIqLw.exe
  C:\Windows\System\mqlIqLw.exe
  2⤵
  PID:3956
- C:\Windows\System\rEsByjp.exe
  C:\Windows\System\rEsByjp.exe
  2⤵
  PID:3972
- C:\Windows\System\zwwxbcC.exe
  C:\Windows\System\zwwxbcC.exe
  2⤵
  PID:3988
- C:\Windows\System\PRLRgsG.exe
  C:\Windows\System\PRLRgsG.exe
  2⤵
  PID:4004
- C:\Windows\System\GkmLCIy.exe
  C:\Windows\System\GkmLCIy.exe
  2⤵
  PID:4020
- C:\Windows\System\fVSlPXW.exe
  C:\Windows\System\fVSlPXW.exe
  2⤵
  PID:4036
- C:\Windows\System\GXNnKrD.exe
  C:\Windows\System\GXNnKrD.exe
  2⤵
  PID:4052
- C:\Windows\System\UgSOPwH.exe
  C:\Windows\System\UgSOPwH.exe
  2⤵
  PID:4068
- C:\Windows\System\vOQJxDS.exe
  C:\Windows\System\vOQJxDS.exe
  2⤵
  PID:4084
- C:\Windows\System\eyCzBFw.exe
  C:\Windows\System\eyCzBFw.exe
  2⤵
  PID:1476
- C:\Windows\System\nWLKfUb.exe
  C:\Windows\System\nWLKfUb.exe
  2⤵
  PID:2056
- C:\Windows\System\kzejhGS.exe
  C:\Windows\System\kzejhGS.exe
  2⤵
  PID:2100
- C:\Windows\System\lIjukCF.exe
  C:\Windows\System\lIjukCF.exe
  2⤵
  PID:2444
- C:\Windows\System\UDuoJaz.exe
  C:\Windows\System\UDuoJaz.exe
  2⤵
  PID:4116
- C:\Windows\System\BSkmXJQ.exe
  C:\Windows\System\BSkmXJQ.exe
  2⤵
  PID:4132
- C:\Windows\System\xoXjgpv.exe
  C:\Windows\System\xoXjgpv.exe
  2⤵
  PID:4148
- C:\Windows\System\yQNcuto.exe
  C:\Windows\System\yQNcuto.exe
  2⤵
  PID:4164
- C:\Windows\System\eqcZxWm.exe
  C:\Windows\System\eqcZxWm.exe
  2⤵
  PID:4196
- C:\Windows\System\iRQBRwj.exe
  C:\Windows\System\iRQBRwj.exe
  2⤵
  PID:4212
- C:\Windows\System\bibdhfP.exe
  C:\Windows\System\bibdhfP.exe
  2⤵
  PID:4228
- C:\Windows\System\bVwIckE.exe
  C:\Windows\System\bVwIckE.exe
  2⤵
  PID:4244
- C:\Windows\System\QkQsiGd.exe
  C:\Windows\System\QkQsiGd.exe
  2⤵
  PID:4260
- C:\Windows\System\qXPKwAB.exe
  C:\Windows\System\qXPKwAB.exe
  2⤵
  PID:4276
- C:\Windows\System\HJIeYzu.exe
  C:\Windows\System\HJIeYzu.exe
  2⤵
  PID:4292
- C:\Windows\System\lTmRkOo.exe
  C:\Windows\System\lTmRkOo.exe
  2⤵
  PID:4316
- C:\Windows\System\NMXueqn.exe
  C:\Windows\System\NMXueqn.exe
  2⤵
  PID:4332
- C:\Windows\System\vzVxePU.exe
  C:\Windows\System\vzVxePU.exe
  2⤵
  PID:4348
- C:\Windows\System\GJlYNls.exe
  C:\Windows\System\GJlYNls.exe
  2⤵
  PID:4364
- C:\Windows\System\ByQTxdT.exe
  C:\Windows\System\ByQTxdT.exe
  2⤵
  PID:4384
- C:\Windows\System\IJeQcWj.exe
  C:\Windows\System\IJeQcWj.exe
  2⤵
  PID:4400
- C:\Windows\System\cbUpuRx.exe
  C:\Windows\System\cbUpuRx.exe
  2⤵
  PID:4416
- C:\Windows\System\gUwRpgn.exe
  C:\Windows\System\gUwRpgn.exe
  2⤵
  PID:4432
- C:\Windows\System\SNhHlat.exe
  C:\Windows\System\SNhHlat.exe
  2⤵
  PID:4452
- C:\Windows\System\rEXfJfB.exe
  C:\Windows\System\rEXfJfB.exe
  2⤵
  PID:4468
- C:\Windows\System\SRzgBMp.exe
  C:\Windows\System\SRzgBMp.exe
  2⤵
  PID:4484
- C:\Windows\System\LjBuMGj.exe
  C:\Windows\System\LjBuMGj.exe
  2⤵
  PID:4500
- C:\Windows\System\HxoURDr.exe
  C:\Windows\System\HxoURDr.exe
  2⤵
  PID:4520
- C:\Windows\System\qFPoKjI.exe
  C:\Windows\System\qFPoKjI.exe
  2⤵
  PID:4536
- C:\Windows\System\bNDjTdg.exe
  C:\Windows\System\bNDjTdg.exe
  2⤵
  PID:4556
- C:\Windows\System\pYPgCPX.exe
  C:\Windows\System\pYPgCPX.exe
  2⤵
  PID:4572
- C:\Windows\System\bdQKupu.exe
  C:\Windows\System\bdQKupu.exe
  2⤵
  PID:4588
- C:\Windows\System\xyIIGyF.exe
  C:\Windows\System\xyIIGyF.exe
  2⤵
  PID:4608
- C:\Windows\System\fobJkzQ.exe
  C:\Windows\System\fobJkzQ.exe
  2⤵
  PID:4624
- C:\Windows\System\cwnXySF.exe
  C:\Windows\System\cwnXySF.exe
  2⤵
  PID:4640
- C:\Windows\System\gMMoxtG.exe
  C:\Windows\System\gMMoxtG.exe
  2⤵
  PID:4656
- C:\Windows\System\MUkyTWl.exe
  C:\Windows\System\MUkyTWl.exe
  2⤵
  PID:4672
- C:\Windows\System\AQSdbsD.exe
  C:\Windows\System\AQSdbsD.exe
  2⤵
  PID:4688
- C:\Windows\System\tqCYmXn.exe
  C:\Windows\System\tqCYmXn.exe
  2⤵
  PID:4704
- C:\Windows\System\BOWEvNL.exe
  C:\Windows\System\BOWEvNL.exe
  2⤵
  PID:4720
- C:\Windows\System\eEUuECl.exe
  C:\Windows\System\eEUuECl.exe
  2⤵
  PID:4736
- C:\Windows\System\btQxtpk.exe
  C:\Windows\System\btQxtpk.exe
  2⤵
  PID:4752
- C:\Windows\System\rmkznOs.exe
  C:\Windows\System\rmkznOs.exe
  2⤵
  PID:4788
- C:\Windows\System\ijxeVDZ.exe
  C:\Windows\System\ijxeVDZ.exe
  2⤵
  PID:4804
- C:\Windows\System\COCyYpZ.exe
  C:\Windows\System\COCyYpZ.exe
  2⤵
  PID:4856
- C:\Windows\System\IsMCezX.exe
  C:\Windows\System\IsMCezX.exe
  2⤵
  PID:4872
- C:\Windows\System\iVsshsr.exe
  C:\Windows\System\iVsshsr.exe
  2⤵
  PID:4888
- C:\Windows\System\xARikEX.exe
  C:\Windows\System\xARikEX.exe
  2⤵
  PID:4904
- C:\Windows\System\ZEkEXaQ.exe
  C:\Windows\System\ZEkEXaQ.exe
  2⤵
  PID:4920
- C:\Windows\System\KNmXJqY.exe
  C:\Windows\System\KNmXJqY.exe
  2⤵
  PID:4936
- C:\Windows\System\tlAvxHK.exe
  C:\Windows\System\tlAvxHK.exe
  2⤵
  PID:4952
- C:\Windows\System\qFZBWGz.exe
  C:\Windows\System\qFZBWGz.exe
  2⤵
  PID:4968
- C:\Windows\System\KYVmbtf.exe
  C:\Windows\System\KYVmbtf.exe
  2⤵
  PID:4984
- C:\Windows\System\PoXduaS.exe
  C:\Windows\System\PoXduaS.exe
  2⤵
  PID:5000
- C:\Windows\System\oeMennS.exe
  C:\Windows\System\oeMennS.exe
  2⤵
  PID:5016
- C:\Windows\System\NkCPKGN.exe
  C:\Windows\System\NkCPKGN.exe
  2⤵
  PID:5032
- C:\Windows\System\FlyjIsE.exe
  C:\Windows\System\FlyjIsE.exe
  2⤵
  PID:5048
- C:\Windows\System\aJGZjnt.exe
  C:\Windows\System\aJGZjnt.exe
  2⤵
  PID:5064
- C:\Windows\System\EEjzQsS.exe
  C:\Windows\System\EEjzQsS.exe
  2⤵
  PID:5080
- C:\Windows\System\QYMnqEk.exe
  C:\Windows\System\QYMnqEk.exe
  2⤵
  PID:5096
- C:\Windows\System\QgDbOiR.exe
  C:\Windows\System\QgDbOiR.exe
  2⤵
  PID:5112
- C:\Windows\System\HiTHULD.exe
  C:\Windows\System\HiTHULD.exe
  2⤵
  PID:2552
- C:\Windows\System\KnNTgxR.exe
  C:\Windows\System\KnNTgxR.exe
  2⤵
  PID:2604
- C:\Windows\System\mPtvsWg.exe
  C:\Windows\System\mPtvsWg.exe
  2⤵
  PID:532
- C:\Windows\System\rctlUNi.exe
  C:\Windows\System\rctlUNi.exe
  2⤵
  PID:2036
- C:\Windows\System\BwyveOQ.exe
  C:\Windows\System\BwyveOQ.exe
  2⤵
  PID:1100
- C:\Windows\System\BvreLJx.exe
  C:\Windows\System\BvreLJx.exe
  2⤵
  PID:3004
- C:\Windows\System\ViOxiSV.exe
  C:\Windows\System\ViOxiSV.exe
  2⤵
  PID:2432
- C:\Windows\System\AhkhTqL.exe
  C:\Windows\System\AhkhTqL.exe
  2⤵
  PID:3080
- C:\Windows\System\IajOXsf.exe
  C:\Windows\System\IajOXsf.exe
  2⤵
  PID:3144
- C:\Windows\System\sKHobTk.exe
  C:\Windows\System\sKHobTk.exe
  2⤵
  PID:3208
- C:\Windows\System\MpiXuKj.exe
  C:\Windows\System\MpiXuKj.exe
  2⤵
  PID:3244
- C:\Windows\System\XJnLxRh.exe
  C:\Windows\System\XJnLxRh.exe
  2⤵
  PID:3308
- C:\Windows\System\jgeBVal.exe
  C:\Windows\System\jgeBVal.exe
  2⤵
  PID:3472
- C:\Windows\System\FzGynZN.exe
  C:\Windows\System\FzGynZN.exe
  2⤵
  PID:3644
- C:\Windows\System\jOaCNHI.exe
  C:\Windows\System\jOaCNHI.exe
  2⤵
  PID:3688
- C:\Windows\System\AkzKLJz.exe
  C:\Windows\System\AkzKLJz.exe
  2⤵
  PID:3704
- C:\Windows\System\wWMMNMA.exe
  C:\Windows\System\wWMMNMA.exe
  2⤵
  PID:3744
- C:\Windows\System\vStCnbc.exe
  C:\Windows\System\vStCnbc.exe
  2⤵
  PID:3816
- C:\Windows\System\NSzVWLj.exe
  C:\Windows\System\NSzVWLj.exe
  2⤵
  PID:3884
- C:\Windows\System\lFdoAGi.exe
  C:\Windows\System\lFdoAGi.exe
  2⤵
  PID:3952
- C:\Windows\System\cYZvmBU.exe
  C:\Windows\System\cYZvmBU.exe
  2⤵
  PID:4016
- C:\Windows\System\HBkeqND.exe
  C:\Windows\System\HBkeqND.exe
  2⤵
  PID:4080
- C:\Windows\System\eTzwrCd.exe
  C:\Windows\System\eTzwrCd.exe
  2⤵
  PID:2052
- C:\Windows\System\AIayNrI.exe
  C:\Windows\System\AIayNrI.exe
  2⤵
  PID:4204
- C:\Windows\System\KAnMPlr.exe
  C:\Windows\System\KAnMPlr.exe
  2⤵
  PID:4268
- C:\Windows\System\pvNVFTb.exe
  C:\Windows\System\pvNVFTb.exe
  2⤵
  PID:4308
- C:\Windows\System\TXULwRB.exe
  C:\Windows\System\TXULwRB.exe
  2⤵
  PID:4372
- C:\Windows\System\xbNqNnO.exe
  C:\Windows\System\xbNqNnO.exe
  2⤵
  PID:4412
- C:\Windows\System\LdTpfzn.exe
  C:\Windows\System\LdTpfzn.exe
  2⤵
  PID:4476
- C:\Windows\System\MDaQkpc.exe
  C:\Windows\System\MDaQkpc.exe
  2⤵
  PID:4516
- C:\Windows\System\MupydFp.exe
  C:\Windows\System\MupydFp.exe
  2⤵
  PID:4580
- C:\Windows\System\PmUufxs.exe
  C:\Windows\System\PmUufxs.exe
  2⤵
  PID:4648
- C:\Windows\System\krlwzgf.exe
  C:\Windows\System\krlwzgf.exe
  2⤵
  PID:4712
- C:\Windows\System\HJXKWTc.exe
  C:\Windows\System\HJXKWTc.exe
  2⤵
  PID:4796
- C:\Windows\System\yfyrJTd.exe
  C:\Windows\System\yfyrJTd.exe
  2⤵
  PID:2236
- C:\Windows\System\ooeBBne.exe
  C:\Windows\System\ooeBBne.exe
  2⤵
  PID:2268
- C:\Windows\System\hnJKPQa.exe
  C:\Windows\System\hnJKPQa.exe
  2⤵
  PID:1492
- C:\Windows\System\fvawnaW.exe
  C:\Windows\System\fvawnaW.exe
  2⤵
  PID:2020
- C:\Windows\System\UgpkMBY.exe
  C:\Windows\System\UgpkMBY.exe
  2⤵
  PID:808
- C:\Windows\System\ytkhgzA.exe
  C:\Windows\System\ytkhgzA.exe
  2⤵
  PID:2808
- C:\Windows\System\twYwSwC.exe
  C:\Windows\System\twYwSwC.exe
  2⤵
  PID:1800
- C:\Windows\System\rbdpttY.exe
  C:\Windows\System\rbdpttY.exe
  2⤵
  PID:2500
- C:\Windows\System\cOBxJaV.exe
  C:\Windows\System\cOBxJaV.exe
  2⤵
  PID:932
- C:\Windows\System\QOYExxB.exe
  C:\Windows\System\QOYExxB.exe
  2⤵
  PID:2256
- C:\Windows\System\lgQqXrl.exe
  C:\Windows\System\lgQqXrl.exe
  2⤵
  PID:3096
- C:\Windows\System\kozvOyK.exe
  C:\Windows\System\kozvOyK.exe
  2⤵
  PID:3008
- C:\Windows\System\wdvHxXC.exe
  C:\Windows\System\wdvHxXC.exe
  2⤵
  PID:3224
- C:\Windows\System\BaxkJjp.exe
  C:\Windows\System\BaxkJjp.exe
  2⤵
  PID:3324
- C:\Windows\System\zSihxbb.exe
  C:\Windows\System\zSihxbb.exe
  2⤵
  PID:3420
- C:\Windows\System\rtmyCPY.exe
  C:\Windows\System\rtmyCPY.exe
  2⤵
  PID:3528
- C:\Windows\System\UcSaWrM.exe
  C:\Windows\System\UcSaWrM.exe
  2⤵
  PID:3624
- C:\Windows\System\sqBhdSi.exe
  C:\Windows\System\sqBhdSi.exe
  2⤵
  PID:3728
- C:\Windows\System\zoeVpGV.exe
  C:\Windows\System\zoeVpGV.exe
  2⤵
  PID:3796
- C:\Windows\System\fxhWccL.exe
  C:\Windows\System\fxhWccL.exe
  2⤵
  PID:2004
- C:\Windows\System\nVxfmyY.exe
  C:\Windows\System\nVxfmyY.exe
  2⤵
  PID:4000
- C:\Windows\System\XSbyKji.exe
  C:\Windows\System\XSbyKji.exe
  2⤵
  PID:4092
- C:\Windows\System\TmhSOAg.exe
  C:\Windows\System\TmhSOAg.exe
  2⤵
  PID:4104
- C:\Windows\System\cBsdCHS.exe
  C:\Windows\System\cBsdCHS.exe
  2⤵
  PID:4284
- C:\Windows\System\sVjRLss.exe
  C:\Windows\System\sVjRLss.exe
  2⤵
  PID:4328
- C:\Windows\System\gKFTdje.exe
  C:\Windows\System\gKFTdje.exe
  2⤵
  PID:4424
- C:\Windows\System\kEYRvmy.exe
  C:\Windows\System\kEYRvmy.exe
  2⤵
  PID:4496
- C:\Windows\System\tJwAYdQ.exe
  C:\Windows\System\tJwAYdQ.exe
  2⤵
  PID:4568
- C:\Windows\System\ntYgNMt.exe
  C:\Windows\System\ntYgNMt.exe
  2⤵
  PID:4632
- C:\Windows\System\EPFUjOF.exe
  C:\Windows\System\EPFUjOF.exe
  2⤵
  PID:2608
- C:\Windows\System\VimRBZD.exe
  C:\Windows\System\VimRBZD.exe
  2⤵
  PID:4732
- C:\Windows\System\YSzeewk.exe
  C:\Windows\System\YSzeewk.exe
  2⤵
  PID:4772
- C:\Windows\System\ICyQPKZ.exe
  C:\Windows\System\ICyQPKZ.exe
  2⤵
  PID:4812
- C:\Windows\System\keOoHsz.exe
  C:\Windows\System\keOoHsz.exe
  2⤵
  PID:2684
- C:\Windows\System\HMpZBtX.exe
  C:\Windows\System\HMpZBtX.exe
  2⤵
  PID:1544
- C:\Windows\System\FhwlGxR.exe
  C:\Windows\System\FhwlGxR.exe
  2⤵
  PID:4840
- C:\Windows\System\WAEqvxC.exe
  C:\Windows\System\WAEqvxC.exe
  2⤵
  PID:3196
- C:\Windows\System\HySxCDR.exe
  C:\Windows\System\HySxCDR.exe
  2⤵
  PID:3392
- C:\Windows\System\sHoEJRe.exe
  C:\Windows\System\sHoEJRe.exe
  2⤵
  PID:3788
- C:\Windows\System\ZApsVSJ.exe
  C:\Windows\System\ZApsVSJ.exe
  2⤵
  PID:3900
- C:\Windows\System\JxLBgop.exe
  C:\Windows\System\JxLBgop.exe
  2⤵
  PID:4064
- C:\Windows\System\hxoqILL.exe
  C:\Windows\System\hxoqILL.exe
  2⤵
  PID:4528
- C:\Windows\System\OKcNytM.exe
  C:\Windows\System\OKcNytM.exe
  2⤵
  PID:2116
- C:\Windows\System\faySLcY.exe
  C:\Windows\System\faySLcY.exe
  2⤵
  PID:4884
- C:\Windows\System\EhPixAR.exe
  C:\Windows\System\EhPixAR.exe
  2⤵
  PID:4948
- C:\Windows\System\TGBMJRH.exe
  C:\Windows\System\TGBMJRH.exe
  2⤵
  PID:4444
- C:\Windows\System\LuYwaLq.exe
  C:\Windows\System\LuYwaLq.exe
  2⤵
  PID:4340
- C:\Windows\System\pYkMqBz.exe
  C:\Windows\System\pYkMqBz.exe
  2⤵
  PID:4928
- C:\Windows\System\wfvhENu.exe
  C:\Windows\System\wfvhENu.exe
  2⤵
  PID:564
- C:\Windows\System\XzIvmwY.exe
  C:\Windows\System\XzIvmwY.exe
  2⤵
  PID:5028
- C:\Windows\System\xspZuML.exe
  C:\Windows\System\xspZuML.exe
  2⤵
  PID:2200
- C:\Windows\System\DsLfUfb.exe
  C:\Windows\System\DsLfUfb.exe
  2⤵
  PID:3116
- C:\Windows\System\ttEuLRr.exe
  C:\Windows\System\ttEuLRr.exe
  2⤵
  PID:3344
- C:\Windows\System\bGuNuNa.exe
  C:\Windows\System\bGuNuNa.exe
  2⤵
  PID:3440
- C:\Windows\System\ciRkWcR.exe
  C:\Windows\System\ciRkWcR.exe
  2⤵
  PID:3740
- C:\Windows\System\EGbDIUr.exe
  C:\Windows\System\EGbDIUr.exe
  2⤵
  PID:4012
- C:\Windows\System\sHnvnov.exe
  C:\Windows\System\sHnvnov.exe
  2⤵
  PID:4344
- C:\Windows\System\xDefLFm.exe
  C:\Windows\System\xDefLFm.exe
  2⤵
  PID:1028
- C:\Windows\System\ecPTnbz.exe
  C:\Windows\System\ecPTnbz.exe
  2⤵
  PID:2772
- C:\Windows\System\wKChhgj.exe
  C:\Windows\System\wKChhgj.exe
  2⤵
  PID:5008
- C:\Windows\System\ZzcqYVe.exe
  C:\Windows\System\ZzcqYVe.exe
  2⤵
  PID:3164
- C:\Windows\System\XKOfYLB.exe
  C:\Windows\System\XKOfYLB.exe
  2⤵
  PID:3356
- C:\Windows\System\SNKDhKZ.exe
  C:\Windows\System\SNKDhKZ.exe
  2⤵
  PID:3760
- C:\Windows\System\hblBElN.exe
  C:\Windows\System\hblBElN.exe
  2⤵
  PID:3548
- C:\Windows\System\LALlhNf.exe
  C:\Windows\System\LALlhNf.exe
  2⤵
  PID:3696
- C:\Windows\System\oTDvXHI.exe
  C:\Windows\System\oTDvXHI.exe
  2⤵
  PID:3920
- C:\Windows\System\jcMnnpy.exe
  C:\Windows\System\jcMnnpy.exe
  2⤵
  PID:4128
- C:\Windows\System\MlBphjF.exe
  C:\Windows\System\MlBphjF.exe
  2⤵
  PID:4380
- C:\Windows\System\ewkqnuu.exe
  C:\Windows\System\ewkqnuu.exe
  2⤵
  PID:4616
- C:\Windows\System\rNRLOoa.exe
  C:\Windows\System\rNRLOoa.exe
  2⤵
  PID:2028
- C:\Windows\System\khYJcPh.exe
  C:\Windows\System\khYJcPh.exe
  2⤵
  PID:308
- C:\Windows\System\yuPrPeR.exe
  C:\Windows\System\yuPrPeR.exe
  2⤵
  PID:3296
- C:\Windows\System\OdccFlu.exe
  C:\Windows\System\OdccFlu.exe
  2⤵
  PID:3724
- C:\Windows\System\ecaUySa.exe
  C:\Windows\System\ecaUySa.exe
  2⤵
  PID:4324
- C:\Windows\System\ntEofmD.exe
  C:\Windows\System\ntEofmD.exe
  2⤵
  PID:2248
- C:\Windows\System\FQSDDzf.exe
  C:\Windows\System\FQSDDzf.exe
  2⤵
  PID:4252
- C:\Windows\System\gsmOBdS.exe
  C:\Windows\System\gsmOBdS.exe
  2⤵
  PID:4700
- C:\Windows\System\QukGsVC.exe
  C:\Windows\System\QukGsVC.exe
  2⤵
  PID:4784
- C:\Windows\System\GwStoVE.exe
  C:\Windows\System\GwStoVE.exe
  2⤵
  PID:4768
- C:\Windows\System\BVywHQx.exe
  C:\Windows\System\BVywHQx.exe
  2⤵
  PID:2368
- C:\Windows\System\LSivZrD.exe
  C:\Windows\System\LSivZrD.exe
  2⤵
  PID:2692
- C:\Windows\System\cknTOdR.exe
  C:\Windows\System\cknTOdR.exe
  2⤵
  PID:4836
- C:\Windows\System\HhJvywd.exe
  C:\Windows\System\HhJvywd.exe
  2⤵
  PID:3660
- C:\Windows\System\pnuUYNT.exe
  C:\Windows\System\pnuUYNT.exe
  2⤵
  PID:4356
- C:\Windows\System\TFTmEQA.exe
  C:\Windows\System\TFTmEQA.exe
  2⤵
  PID:4460
- C:\Windows\System\gvRuOZQ.exe
  C:\Windows\System\gvRuOZQ.exe
  2⤵
  PID:4960
- C:\Windows\System\dAChJsy.exe
  C:\Windows\System\dAChJsy.exe
  2⤵
  PID:4680
- C:\Windows\System\BwSOdim.exe
  C:\Windows\System\BwSOdim.exe
  2⤵
  PID:2632
- C:\Windows\System\KUYjZop.exe
  C:\Windows\System\KUYjZop.exe
  2⤵
  PID:3676
- C:\Windows\System\ERzoCpR.exe
  C:\Windows\System\ERzoCpR.exe
  2⤵
  PID:4236
- C:\Windows\System\ZdOwZyl.exe
  C:\Windows\System\ZdOwZyl.exe
  2⤵
  PID:4896
- C:\Windows\System\ApINaqp.exe
  C:\Windows\System\ApINaqp.exe
  2⤵
  PID:1316
- C:\Windows\System\DTWrEir.exe
  C:\Windows\System\DTWrEir.exe
  2⤵
  PID:3376
- C:\Windows\System\rsnlFno.exe
  C:\Windows\System\rsnlFno.exe
  2⤵
  PID:1488
- C:\Windows\System\crcxRSU.exe
  C:\Windows\System\crcxRSU.exe
  2⤵
  PID:1728
- C:\Windows\System\njuGKqf.exe
  C:\Windows\System\njuGKqf.exe
  2⤵
  PID:3592
- C:\Windows\System\ZQIxnGD.exe
  C:\Windows\System\ZQIxnGD.exe
  2⤵
  PID:2124
- C:\Windows\System\exRVVoV.exe
  C:\Windows\System\exRVVoV.exe
  2⤵
  PID:5012
- C:\Windows\System\MvDiyso.exe
  C:\Windows\System\MvDiyso.exe
  2⤵
  PID:2804
- C:\Windows\System\cidsjCP.exe
  C:\Windows\System\cidsjCP.exe
  2⤵
  PID:3180
- C:\Windows\System\UeIsYqC.exe
  C:\Windows\System\UeIsYqC.exe
  2⤵
  PID:3512
- C:\Windows\System\hVIFLIF.exe
  C:\Windows\System\hVIFLIF.exe
  2⤵
  PID:3640
- C:\Windows\System\GQUnLyS.exe
  C:\Windows\System\GQUnLyS.exe
  2⤵
  PID:4512
- C:\Windows\System\mGalWBW.exe
  C:\Windows\System\mGalWBW.exe
  2⤵
  PID:836
- C:\Windows\System\UHATmjo.exe
  C:\Windows\System\UHATmjo.exe
  2⤵
  PID:3864
- C:\Windows\System\YOrXqQK.exe
  C:\Windows\System\YOrXqQK.exe
  2⤵
  PID:4668
- C:\Windows\System\FTyoAcy.exe
  C:\Windows\System\FTyoAcy.exe
  2⤵
  PID:1244
- C:\Windows\System\HPFSIYy.exe
  C:\Windows\System\HPFSIYy.exe
  2⤵
  PID:4916
- C:\Windows\System\GEVnhnW.exe
  C:\Windows\System\GEVnhnW.exe
  2⤵
  PID:5060
- C:\Windows\System\xiUCZGR.exe
  C:\Windows\System\xiUCZGR.exe
  2⤵
  PID:2788
- C:\Windows\System\kDhhSll.exe
  C:\Windows\System\kDhhSll.exe
  2⤵
  PID:5044
- C:\Windows\System\HbFzEVm.exe
  C:\Windows\System\HbFzEVm.exe
  2⤵
  PID:3280
- C:\Windows\System\CmnBAbe.exe
  C:\Windows\System\CmnBAbe.exe
  2⤵
  PID:4464
- C:\Windows\System\iRmNqgX.exe
  C:\Windows\System\iRmNqgX.exe
  2⤵
  PID:1700
- C:\Windows\System\FbgjYgT.exe
  C:\Windows\System\FbgjYgT.exe
  2⤵
  PID:3812
- C:\Windows\System\FeKHWQy.exe
  C:\Windows\System\FeKHWQy.exe
  2⤵
  PID:5076
- C:\Windows\System\MswenrW.exe
  C:\Windows\System\MswenrW.exe
  2⤵
  PID:5132
- C:\Windows\System\BevvxET.exe
  C:\Windows\System\BevvxET.exe
  2⤵
  PID:5152
- C:\Windows\System\kMJxNqb.exe
  C:\Windows\System\kMJxNqb.exe
  2⤵
  PID:5172
- C:\Windows\System\nqBiSAz.exe
  C:\Windows\System\nqBiSAz.exe
  2⤵
  PID:5188
- C:\Windows\System\AhHHoUD.exe
  C:\Windows\System\AhHHoUD.exe
  2⤵
  PID:5204
- C:\Windows\System\mXBJdDX.exe
  C:\Windows\System\mXBJdDX.exe
  2⤵
  PID:5220
- C:\Windows\System\ltvMXTh.exe
  C:\Windows\System\ltvMXTh.exe
  2⤵
  PID:5236
- C:\Windows\System\vrrlvIF.exe
  C:\Windows\System\vrrlvIF.exe
  2⤵
  PID:5256
- C:\Windows\System\HhtUypY.exe
  C:\Windows\System\HhtUypY.exe
  2⤵
  PID:5272
- C:\Windows\System\pQsnzeF.exe
  C:\Windows\System\pQsnzeF.exe
  2⤵
  PID:5288
- C:\Windows\System\uMhYfKk.exe
  C:\Windows\System\uMhYfKk.exe
  2⤵
  PID:5304
- C:\Windows\System\RKaSaLm.exe
  C:\Windows\System\RKaSaLm.exe
  2⤵
  PID:5320
- C:\Windows\System\kfFpmLK.exe
  C:\Windows\System\kfFpmLK.exe
  2⤵
  PID:5336
- C:\Windows\System\puhLElS.exe
  C:\Windows\System\puhLElS.exe
  2⤵
  PID:5352
- C:\Windows\System\DhroVzE.exe
  C:\Windows\System\DhroVzE.exe
  2⤵
  PID:5368
- C:\Windows\System\FJsWIEG.exe
  C:\Windows\System\FJsWIEG.exe
  2⤵
  PID:5384
- C:\Windows\System\lpkdFrl.exe
  C:\Windows\System\lpkdFrl.exe
  2⤵
  PID:5400
- C:\Windows\System\DENFNxN.exe
  C:\Windows\System\DENFNxN.exe
  2⤵
  PID:5416
- C:\Windows\System\QfjTmNU.exe
  C:\Windows\System\QfjTmNU.exe
  2⤵
  PID:5436
- C:\Windows\System\JlqvEKe.exe
  C:\Windows\System\JlqvEKe.exe
  2⤵
  PID:5452
- C:\Windows\System\byPQOYN.exe
  C:\Windows\System\byPQOYN.exe
  2⤵
  PID:5468
- C:\Windows\System\qfSKFGb.exe
  C:\Windows\System\qfSKFGb.exe
  2⤵
  PID:5484
- C:\Windows\System\LQMFrSY.exe
  C:\Windows\System\LQMFrSY.exe
  2⤵
  PID:5560
- C:\Windows\System\lDqTcVe.exe
  C:\Windows\System\lDqTcVe.exe
  2⤵
  PID:5688
- C:\Windows\System\VDomIuj.exe
  C:\Windows\System\VDomIuj.exe
  2⤵
  PID:5712
- C:\Windows\System\JHbgMUx.exe
  C:\Windows\System\JHbgMUx.exe
  2⤵
  PID:5744
- C:\Windows\System\TTlbNat.exe
  C:\Windows\System\TTlbNat.exe
  2⤵
  PID:5768
- C:\Windows\System\cuktmwm.exe
  C:\Windows\System\cuktmwm.exe
  2⤵
  PID:5784
- C:\Windows\System\IXrWVcV.exe
  C:\Windows\System\IXrWVcV.exe
  2⤵
  PID:5820
- C:\Windows\System\xywTSLn.exe
  C:\Windows\System\xywTSLn.exe
  2⤵
  PID:5836
- C:\Windows\System\KlJFlqe.exe
  C:\Windows\System\KlJFlqe.exe
  2⤵
  PID:5852
- C:\Windows\System\hgkLesx.exe
  C:\Windows\System\hgkLesx.exe
  2⤵
  PID:5868
- C:\Windows\System\LmzOBJB.exe
  C:\Windows\System\LmzOBJB.exe
  2⤵
  PID:5888
- C:\Windows\System\jOrazQY.exe
  C:\Windows\System\jOrazQY.exe
  2⤵
  PID:5904
- C:\Windows\System\vXVBHDR.exe
  C:\Windows\System\vXVBHDR.exe
  2⤵
  PID:5920
- C:\Windows\System\bsKcHXi.exe
  C:\Windows\System\bsKcHXi.exe
  2⤵
  PID:5936
- C:\Windows\System\MyegYQE.exe
  C:\Windows\System\MyegYQE.exe
  2⤵
  PID:5952
- C:\Windows\System\xTjjJuI.exe
  C:\Windows\System\xTjjJuI.exe
  2⤵
  PID:5968
- C:\Windows\System\GqsPofu.exe
  C:\Windows\System\GqsPofu.exe
  2⤵
  PID:5984
- C:\Windows\System\nIBCFEf.exe
  C:\Windows\System\nIBCFEf.exe
  2⤵
  PID:6000
- C:\Windows\System\IFqIdql.exe
  C:\Windows\System\IFqIdql.exe
  2⤵
  PID:6016
- C:\Windows\System\VTVqAYF.exe
  C:\Windows\System\VTVqAYF.exe
  2⤵
  PID:6032
- C:\Windows\System\scwnEqY.exe
  C:\Windows\System\scwnEqY.exe
  2⤵
  PID:4744
- C:\Windows\System\tJtyVHA.exe
  C:\Windows\System\tJtyVHA.exe
  2⤵
  PID:5300
- C:\Windows\System\qVqYWsb.exe
  C:\Windows\System\qVqYWsb.exe
  2⤵
  PID:5244
- C:\Windows\System\gdyukhL.exe
  C:\Windows\System\gdyukhL.exe
  2⤵
  PID:3712
- C:\Windows\System\PiyOZgH.exe
  C:\Windows\System\PiyOZgH.exe
  2⤵
  PID:3564
- C:\Windows\System\EKRpbBn.exe
  C:\Windows\System\EKRpbBn.exe
  2⤵
  PID:5140
- C:\Windows\System\vjKdIrM.exe
  C:\Windows\System\vjKdIrM.exe
  2⤵
  PID:652
- C:\Windows\System\sitsMkd.exe
  C:\Windows\System\sitsMkd.exe
  2⤵
  PID:3452
- C:\Windows\System\ESMQPGr.exe
  C:\Windows\System\ESMQPGr.exe
  2⤵
  PID:5216
- C:\Windows\System\rjlkRmO.exe
  C:\Windows\System\rjlkRmO.exe
  2⤵
  PID:5180
- C:\Windows\System\drQWbjx.exe
  C:\Windows\System\drQWbjx.exe
  2⤵
  PID:4604
- C:\Windows\System\oSQzzkK.exe
  C:\Windows\System\oSQzzkK.exe
  2⤵
  PID:2084
- C:\Windows\System\iEJdCQW.exe
  C:\Windows\System\iEJdCQW.exe
  2⤵
  PID:4880
- C:\Windows\System\pXaGvdD.exe
  C:\Windows\System\pXaGvdD.exe
  2⤵
  PID:4548
- C:\Windows\System\yhDvBDR.exe
  C:\Windows\System\yhDvBDR.exe
  2⤵
  PID:3456
- C:\Windows\System\NMZstpL.exe
  C:\Windows\System\NMZstpL.exe
  2⤵
  PID:3608
- C:\Windows\System\naEENYZ.exe
  C:\Windows\System\naEENYZ.exe
  2⤵
  PID:3860
- C:\Windows\System\DRcFlqg.exe
  C:\Windows\System\DRcFlqg.exe
  2⤵
  PID:5284
- C:\Windows\System\KQWICzG.exe
  C:\Windows\System\KQWICzG.exe
  2⤵
  PID:5444
- C:\Windows\System\fgEhgsm.exe
  C:\Windows\System\fgEhgsm.exe
  2⤵
  PID:5500
- C:\Windows\System\UCOTePv.exe
  C:\Windows\System\UCOTePv.exe
  2⤵
  PID:5512
- C:\Windows\System\trxfOnE.exe
  C:\Windows\System\trxfOnE.exe
  2⤵
  PID:5528
- C:\Windows\System\aJLocbq.exe
  C:\Windows\System\aJLocbq.exe
  2⤵
  PID:5544
- C:\Windows\System\xbrNmDC.exe
  C:\Windows\System\xbrNmDC.exe
  2⤵
  PID:5584
- C:\Windows\System\cmkjzrw.exe
  C:\Windows\System\cmkjzrw.exe
  2⤵
  PID:5580
- C:\Windows\System\unKCZAx.exe
  C:\Windows\System\unKCZAx.exe
  2⤵
  PID:5632
- C:\Windows\System\XlWNSKM.exe
  C:\Windows\System\XlWNSKM.exe
  2⤵
  PID:5648
- C:\Windows\System\HxwxYlN.exe
  C:\Windows\System\HxwxYlN.exe
  2⤵
  PID:5700
- C:\Windows\System\xbDuLEw.exe
  C:\Windows\System\xbDuLEw.exe
  2⤵
  PID:5668
- C:\Windows\System\fghPLbq.exe
  C:\Windows\System\fghPLbq.exe
  2⤵
  PID:5624
- C:\Windows\System\nNioOFb.exe
  C:\Windows\System\nNioOFb.exe
  2⤵
  PID:5708
- C:\Windows\System\KjauANe.exe
  C:\Windows\System\KjauANe.exe
  2⤵
  PID:5756
- C:\Windows\System\uFoJziD.exe
  C:\Windows\System\uFoJziD.exe
  2⤵
  PID:5740
- C:\Windows\System\oBqKoak.exe
  C:\Windows\System\oBqKoak.exe
  2⤵
  PID:5776
- C:\Windows\System\nSxodyU.exe
  C:\Windows\System\nSxodyU.exe
  2⤵
  PID:5964
- C:\Windows\System\bfmcjJp.exe
  C:\Windows\System\bfmcjJp.exe
  2⤵
  PID:5948
- C:\Windows\System\xkoSRJO.exe
  C:\Windows\System\xkoSRJO.exe
  2⤵
  PID:5796
- C:\Windows\System\NHHuahk.exe
  C:\Windows\System\NHHuahk.exe
  2⤵
  PID:5848
- C:\Windows\System\SuFOxQe.exe
  C:\Windows\System\SuFOxQe.exe
  2⤵
  PID:5912
- C:\Windows\System\BRziuFk.exe
  C:\Windows\System\BRziuFk.exe
  2⤵
  PID:6044
- C:\Windows\System\SkEUcog.exe
  C:\Windows\System\SkEUcog.exe
  2⤵
  PID:6064
- C:\Windows\System\MybbAjN.exe
  C:\Windows\System\MybbAjN.exe
  2⤵
  PID:5804
- C:\Windows\System\PGJBQEg.exe
  C:\Windows\System\PGJBQEg.exe
  2⤵
  PID:3656
- C:\Windows\System\LvZhlmP.exe
  C:\Windows\System\LvZhlmP.exe
  2⤵
  PID:6096
- C:\Windows\System\cBOqTsL.exe
  C:\Windows\System\cBOqTsL.exe
  2⤵
  PID:6120
- C:\Windows\System\XjIwKhM.exe
  C:\Windows\System\XjIwKhM.exe
  2⤵
  PID:6140
- C:\Windows\System\qcudFYy.exe
  C:\Windows\System\qcudFYy.exe
  2⤵
  PID:5124
- C:\Windows\System\FXtPCqR.exe
  C:\Windows\System\FXtPCqR.exe
  2⤵
  PID:3132
- C:\Windows\System\ZHkKdif.exe
  C:\Windows\System\ZHkKdif.exe
  2⤵
  PID:6040
- C:\Windows\System\xfXODdg.exe
  C:\Windows\System\xfXODdg.exe
  2⤵
  PID:5832
- C:\Windows\System\kFzBhwO.exe
  C:\Windows\System\kFzBhwO.exe
  2⤵
  PID:3292
- C:\Windows\System\kodyAge.exe
  C:\Windows\System\kodyAge.exe
  2⤵
  PID:3896
- C:\Windows\System\lotVcGx.exe
  C:\Windows\System\lotVcGx.exe
  2⤵
  PID:5296
- C:\Windows\System\QEJFOUF.exe
  C:\Windows\System\QEJFOUF.exe
  2⤵
  PID:5332
- C:\Windows\System\apipdMi.exe
  C:\Windows\System\apipdMi.exe
  2⤵
  PID:2032
- C:\Windows\System\OeDTwBn.exe
  C:\Windows\System\OeDTwBn.exe
  2⤵
  PID:5364
- C:\Windows\System\OZZgAzj.exe
  C:\Windows\System\OZZgAzj.exe
  2⤵
  PID:2232
- C:\Windows\System\IDbJYli.exe
  C:\Windows\System\IDbJYli.exe
  2⤵
  PID:5148
- C:\Windows\System\EvFkjhM.exe
  C:\Windows\System\EvFkjhM.exe
  2⤵
  PID:5448
- C:\Windows\System\NlGlgEp.exe
  C:\Windows\System\NlGlgEp.exe
  2⤵
  PID:5024
- C:\Windows\System\dxaKdLQ.exe
  C:\Windows\System\dxaKdLQ.exe
  2⤵
  PID:3580
- C:\Windows\System\aYZKOlr.exe
  C:\Windows\System\aYZKOlr.exe
  2⤵
  PID:5252
- C:\Windows\System\XFnqNiw.exe
  C:\Windows\System\XFnqNiw.exe
  2⤵
  PID:6076
- C:\Windows\System\BmjmXcF.exe
  C:\Windows\System\BmjmXcF.exe
  2⤵
  PID:5556
- C:\Windows\System\ZlsLUqJ.exe
  C:\Windows\System\ZlsLUqJ.exe
  2⤵
  PID:5508
- C:\Windows\System\hQjicpz.exe
  C:\Windows\System\hQjicpz.exe
  2⤵
  PID:5616
- C:\Windows\System\XmKwCmJ.exe
  C:\Windows\System\XmKwCmJ.exe
  2⤵
  PID:5536
- C:\Windows\System\Tdabzdd.exe
  C:\Windows\System\Tdabzdd.exe
  2⤵
  PID:5696
- C:\Windows\System\EMoIoVu.exe
  C:\Windows\System\EMoIoVu.exe
  2⤵
  PID:5732
- C:\Windows\System\QVlmpDn.exe
  C:\Windows\System\QVlmpDn.exe
  2⤵
  PID:5932
- C:\Windows\System\IYZIvtI.exe
  C:\Windows\System\IYZIvtI.exe
  2⤵
  PID:5572
- C:\Windows\System\cxFqkuw.exe
  C:\Windows\System\cxFqkuw.exe
  2⤵
  PID:5900
- C:\Windows\System\MNJACeo.exe
  C:\Windows\System\MNJACeo.exe
  2⤵
  PID:5792
- C:\Windows\System\hDzJGGG.exe
  C:\Windows\System\hDzJGGG.exe
  2⤵
  PID:6048
- C:\Windows\System\eksyLRA.exe
  C:\Windows\System\eksyLRA.exe
  2⤵
  PID:6056
- C:\Windows\System\xIGhAAE.exe
  C:\Windows\System\xIGhAAE.exe
  2⤵
  PID:6132
- C:\Windows\System\FmBRixI.exe
  C:\Windows\System\FmBRixI.exe
  2⤵
  PID:5992
- C:\Windows\System\CHdnRaw.exe
  C:\Windows\System\CHdnRaw.exe
  2⤵
  PID:6108
- C:\Windows\System\aLjsHBY.exe
  C:\Windows\System\aLjsHBY.exe
  2⤵
  PID:6028
- C:\Windows\System\TSWYboK.exe
  C:\Windows\System\TSWYboK.exe
  2⤵
  PID:5412
- C:\Windows\System\gNtDWiE.exe
  C:\Windows\System\gNtDWiE.exe
  2⤵
  PID:4824
- C:\Windows\System\zmhQvSx.exe
  C:\Windows\System\zmhQvSx.exe
  2⤵
  PID:5164
- C:\Windows\System\HzUsRhd.exe
  C:\Windows\System\HzUsRhd.exe
  2⤵
  PID:5600
- C:\Windows\System\VMFCYZn.exe
  C:\Windows\System\VMFCYZn.exe
  2⤵
  PID:3340
- C:\Windows\System\BBVnMya.exe
  C:\Windows\System\BBVnMya.exe
  2⤵
  PID:3048
- C:\Windows\System\HPYaFWL.exe
  C:\Windows\System\HPYaFWL.exe
  2⤵
  PID:5428
- C:\Windows\System\TCjNdvP.exe
  C:\Windows\System\TCjNdvP.exe
  2⤵
  PID:5268
- C:\Windows\System\HPHefqc.exe
  C:\Windows\System\HPHefqc.exe
  2⤵
  PID:2244
- C:\Windows\System\qMliEss.exe
  C:\Windows\System\qMliEss.exe
  2⤵
  PID:5524
- C:\Windows\System\gTtRApq.exe
  C:\Windows\System\gTtRApq.exe
  2⤵
  PID:5592
- C:\Windows\System\CCxqWVO.exe
  C:\Windows\System\CCxqWVO.exe
  2⤵
  PID:5540
- C:\Windows\System\cTENnWX.exe
  C:\Windows\System\cTENnWX.exe
  2⤵
  PID:5764
- C:\Windows\System\GdUqHZG.exe
  C:\Windows\System\GdUqHZG.exe
  2⤵
  PID:6072
- C:\Windows\System\wvShjPU.exe
  C:\Windows\System\wvShjPU.exe
  2⤵
  PID:6104
- C:\Windows\System\EgIwrhL.exe
  C:\Windows\System\EgIwrhL.exe
  2⤵
  PID:6088
- C:\Windows\System\gbleAHZ.exe
  C:\Windows\System\gbleAHZ.exe
  2⤵
  PID:5264
- C:\Windows\System\VpJNDZQ.exe
  C:\Windows\System\VpJNDZQ.exe
  2⤵
  PID:5604
- C:\Windows\System\bdwivqA.exe
  C:\Windows\System\bdwivqA.exe
  2⤵
  PID:6136
- C:\Windows\System\CjYnVNi.exe
  C:\Windows\System\CjYnVNi.exe
  2⤵
  PID:5656
- C:\Windows\System\BRtUawL.exe
  C:\Windows\System\BRtUawL.exe
  2⤵
  PID:6156
- C:\Windows\System\YqDpGMA.exe
  C:\Windows\System\YqDpGMA.exe
  2⤵
  PID:6172
- C:\Windows\System\WpABWfG.exe
  C:\Windows\System\WpABWfG.exe
  2⤵
  PID:6188
- C:\Windows\System\oGWfGnO.exe
  C:\Windows\System\oGWfGnO.exe
  2⤵
  PID:6204
- C:\Windows\System\PkSsOjr.exe
  C:\Windows\System\PkSsOjr.exe
  2⤵
  PID:6220
- C:\Windows\System\AVQHbFN.exe
  C:\Windows\System\AVQHbFN.exe
  2⤵
  PID:6236
- C:\Windows\System\kJCKnfM.exe
  C:\Windows\System\kJCKnfM.exe
  2⤵
  PID:6252
- C:\Windows\System\OeFCyJK.exe
  C:\Windows\System\OeFCyJK.exe
  2⤵
  PID:6268
- C:\Windows\System\eIRdUnI.exe
  C:\Windows\System\eIRdUnI.exe
  2⤵
  PID:6284
- C:\Windows\System\mVaRHbG.exe
  C:\Windows\System\mVaRHbG.exe
  2⤵
  PID:6300
- C:\Windows\System\WsKTLEx.exe
  C:\Windows\System\WsKTLEx.exe
  2⤵
  PID:6320
- C:\Windows\System\antWDoi.exe
  C:\Windows\System\antWDoi.exe
  2⤵
  PID:6336
- C:\Windows\System\kXYoecm.exe
  C:\Windows\System\kXYoecm.exe
  2⤵
  PID:6352
- C:\Windows\System\utnmDLo.exe
  C:\Windows\System\utnmDLo.exe
  2⤵
  PID:6368
- C:\Windows\System\RNEpxXK.exe
  C:\Windows\System\RNEpxXK.exe
  2⤵
  PID:6384
- C:\Windows\System\zNoJobt.exe
  C:\Windows\System\zNoJobt.exe
  2⤵
  PID:6400
- C:\Windows\System\yRuLRrA.exe
  C:\Windows\System\yRuLRrA.exe
  2⤵
  PID:6416
- C:\Windows\System\rKXusCf.exe
  C:\Windows\System\rKXusCf.exe
  2⤵
  PID:6432
- C:\Windows\System\yWSZKDa.exe
  C:\Windows\System\yWSZKDa.exe
  2⤵
  PID:6448
- C:\Windows\System\wJYUpQq.exe
  C:\Windows\System\wJYUpQq.exe
  2⤵
  PID:6464
- C:\Windows\System\TWaPcNy.exe
  C:\Windows\System\TWaPcNy.exe
  2⤵
  PID:6480
- C:\Windows\System\TaltnWr.exe
  C:\Windows\System\TaltnWr.exe
  2⤵
  PID:6496
- C:\Windows\System\nmheaSJ.exe
  C:\Windows\System\nmheaSJ.exe
  2⤵
  PID:6512
- C:\Windows\System\PzRKtiT.exe
  C:\Windows\System\PzRKtiT.exe
  2⤵
  PID:6528
- C:\Windows\System\MzBvtyj.exe
  C:\Windows\System\MzBvtyj.exe
  2⤵
  PID:6544
- C:\Windows\System\VVHeKSq.exe
  C:\Windows\System\VVHeKSq.exe
  2⤵
  PID:6560
- C:\Windows\System\JUpSKvB.exe
  C:\Windows\System\JUpSKvB.exe
  2⤵
  PID:6576
- C:\Windows\System\vmuxGAt.exe
  C:\Windows\System\vmuxGAt.exe
  2⤵
  PID:6592
- C:\Windows\System\AQryoxi.exe
  C:\Windows\System\AQryoxi.exe
  2⤵
  PID:6608
- C:\Windows\System\oopQtAQ.exe
  C:\Windows\System\oopQtAQ.exe
  2⤵
  PID:6624
- C:\Windows\System\fedGPDY.exe
  C:\Windows\System\fedGPDY.exe
  2⤵
  PID:6640
- C:\Windows\System\pWTpZzr.exe
  C:\Windows\System\pWTpZzr.exe
  2⤵
  PID:6656
- C:\Windows\System\dMtyvvI.exe
  C:\Windows\System\dMtyvvI.exe
  2⤵
  PID:6672
- C:\Windows\System\xhqGosX.exe
  C:\Windows\System\xhqGosX.exe
  2⤵
  PID:6688
- C:\Windows\System\KabuvoU.exe
  C:\Windows\System\KabuvoU.exe
  2⤵
  PID:6704
- C:\Windows\System\nTvfWQP.exe
  C:\Windows\System\nTvfWQP.exe
  2⤵
  PID:6720
- C:\Windows\System\twDCfJo.exe
  C:\Windows\System\twDCfJo.exe
  2⤵
  PID:6736
- C:\Windows\System\USYWRAW.exe
  C:\Windows\System\USYWRAW.exe
  2⤵
  PID:6752
- C:\Windows\System\XBRKzPo.exe
  C:\Windows\System\XBRKzPo.exe
  2⤵
  PID:6768
- C:\Windows\System\BDpzTpY.exe
  C:\Windows\System\BDpzTpY.exe
  2⤵
  PID:6784
- C:\Windows\System\BAZzFZr.exe
  C:\Windows\System\BAZzFZr.exe
  2⤵
  PID:6800
- C:\Windows\System\zktDuio.exe
  C:\Windows\System\zktDuio.exe
  2⤵
  PID:6816
- C:\Windows\System\bgeBJSR.exe
  C:\Windows\System\bgeBJSR.exe
  2⤵
  PID:6832
- C:\Windows\System\xPuhlgR.exe
  C:\Windows\System\xPuhlgR.exe
  2⤵
  PID:6848
- C:\Windows\System\nlGyBVN.exe
  C:\Windows\System\nlGyBVN.exe
  2⤵
  PID:6864
- C:\Windows\System\WCNbJmH.exe
  C:\Windows\System\WCNbJmH.exe
  2⤵
  PID:6880
- C:\Windows\System\qNmHGKL.exe
  C:\Windows\System\qNmHGKL.exe
  2⤵
  PID:6896
- C:\Windows\System\BPoazqI.exe
  C:\Windows\System\BPoazqI.exe
  2⤵
  PID:6912
- C:\Windows\System\CSZupLu.exe
  C:\Windows\System\CSZupLu.exe
  2⤵
  PID:6932
- C:\Windows\System\lvlWmWE.exe
  C:\Windows\System\lvlWmWE.exe
  2⤵
  PID:6948
- C:\Windows\System\uMqTmTO.exe
  C:\Windows\System\uMqTmTO.exe
  2⤵
  PID:6964
- C:\Windows\System\mWkGrLe.exe
  C:\Windows\System\mWkGrLe.exe
  2⤵
  PID:6980
- C:\Windows\System\aImIPXn.exe
  C:\Windows\System\aImIPXn.exe
  2⤵
  PID:6996
- C:\Windows\System\tJkurcY.exe
  C:\Windows\System\tJkurcY.exe
  2⤵
  PID:7012
- C:\Windows\System\FBtncTE.exe
  C:\Windows\System\FBtncTE.exe
  2⤵
  PID:7028
- C:\Windows\System\KNWRlaD.exe
  C:\Windows\System\KNWRlaD.exe
  2⤵
  PID:7044
- C:\Windows\System\MEAxblc.exe
  C:\Windows\System\MEAxblc.exe
  2⤵
  PID:7060
- C:\Windows\System\HbFRJTF.exe
  C:\Windows\System\HbFRJTF.exe
  2⤵
  PID:7076
- C:\Windows\System\KLenLKO.exe
  C:\Windows\System\KLenLKO.exe
  2⤵
  PID:7092
- C:\Windows\System\QufTRuZ.exe
  C:\Windows\System\QufTRuZ.exe
  2⤵
  PID:7108
- C:\Windows\System\zATzTPs.exe
  C:\Windows\System\zATzTPs.exe
  2⤵
  PID:7124
- C:\Windows\System\sJIPSSt.exe
  C:\Windows\System\sJIPSSt.exe
  2⤵
  PID:7140
- C:\Windows\System\lpCCsHO.exe
  C:\Windows\System\lpCCsHO.exe
  2⤵
  PID:7156
- C:\Windows\System\OYwfDjw.exe
  C:\Windows\System\OYwfDjw.exe
  2⤵
  PID:6180
- C:\Windows\System\DlwoHUo.exe
  C:\Windows\System\DlwoHUo.exe
  2⤵
  PID:6216
- C:\Windows\System\KmPlYDH.exe
  C:\Windows\System\KmPlYDH.exe
  2⤵
  PID:6116
- C:\Windows\System\csnhpHR.exe
  C:\Windows\System\csnhpHR.exe
  2⤵
  PID:5680
- C:\Windows\System\VEKAkiz.exe
  C:\Windows\System\VEKAkiz.exe
  2⤵
  PID:5880
- C:\Windows\System\TEzvpAH.exe
  C:\Windows\System\TEzvpAH.exe
  2⤵
  PID:4060
- C:\Windows\System\ESSMNZr.exe
  C:\Windows\System\ESSMNZr.exe
  2⤵
  PID:4780
- C:\Windows\System\CaqkLEG.exe
  C:\Windows\System\CaqkLEG.exe
  2⤵
  PID:5424
- C:\Windows\System\VGstzNP.exe
  C:\Windows\System\VGstzNP.exe
  2⤵
  PID:5928
- C:\Windows\System\kMedIsT.exe
  C:\Windows\System\kMedIsT.exe
  2⤵
  PID:5640
- C:\Windows\System\vMSfcHr.exe
  C:\Windows\System\vMSfcHr.exe
  2⤵
  PID:6308
- C:\Windows\System\SZeULge.exe
  C:\Windows\System\SZeULge.exe
  2⤵
  PID:6196
- C:\Windows\System\FphmeFA.exe
  C:\Windows\System\FphmeFA.exe
  2⤵
  PID:6260
- C:\Windows\System\gANbMVn.exe
  C:\Windows\System\gANbMVn.exe
  2⤵
  PID:6344
- C:\Windows\System\xYLfkHG.exe
  C:\Windows\System\xYLfkHG.exe
  2⤵
  PID:6408
- C:\Windows\System\LqJvZmB.exe
  C:\Windows\System\LqJvZmB.exe
  2⤵
  PID:6472
- C:\Windows\System\AqXpVVs.exe
  C:\Windows\System\AqXpVVs.exe
  2⤵
  PID:6536
- C:\Windows\System\fcekfbs.exe
  C:\Windows\System\fcekfbs.exe
  2⤵
  PID:6572
- C:\Windows\System\hzBwVWb.exe
  C:\Windows\System\hzBwVWb.exe
  2⤵
  PID:6664
- C:\Windows\System\uRdKZYr.exe
  C:\Windows\System\uRdKZYr.exe
  2⤵
  PID:6728
- C:\Windows\System\RknDdxI.exe
  C:\Windows\System\RknDdxI.exe
  2⤵
  PID:6792
- C:\Windows\System\oLzIsIw.exe
  C:\Windows\System\oLzIsIw.exe
  2⤵
  PID:6856
- C:\Windows\System\gAXVXvA.exe
  C:\Windows\System\gAXVXvA.exe
  2⤵
  PID:6924
- C:\Windows\System\qAzWswf.exe
  C:\Windows\System\qAzWswf.exe
  2⤵
  PID:6988
- C:\Windows\System\IwHeGHy.exe
  C:\Windows\System\IwHeGHy.exe
  2⤵
  PID:6360
- C:\Windows\System\KTjlXdf.exe
  C:\Windows\System\KTjlXdf.exe
  2⤵
  PID:7052
- C:\Windows\System\NDUBMmz.exe
  C:\Windows\System\NDUBMmz.exe
  2⤵
  PID:7008
- C:\Windows\System\BsYQdAH.exe
  C:\Windows\System\BsYQdAH.exe
  2⤵
  PID:7120
- C:\Windows\System\jdYtgzQ.exe
  C:\Windows\System\jdYtgzQ.exe
  2⤵
  PID:6184
- C:\Windows\System\LbpBBlr.exe
  C:\Windows\System\LbpBBlr.exe
  2⤵
  PID:3776
- C:\Windows\System\gWZOmcX.exe
  C:\Windows\System\gWZOmcX.exe
  2⤵
  PID:7004
- C:\Windows\System\xOnxUqz.exe
  C:\Windows\System\xOnxUqz.exe
  2⤵
  PID:6392
- C:\Windows\System\gwbRPDZ.exe
  C:\Windows\System\gwbRPDZ.exe
  2⤵
  PID:6488
- C:\Windows\System\vZcWste.exe
  C:\Windows\System\vZcWste.exe
  2⤵
  PID:6744
- C:\Windows\System\UBPrZjF.exe
  C:\Windows\System\UBPrZjF.exe
  2⤵
  PID:6748
- C:\Windows\System\VbAHTcp.exe
  C:\Windows\System\VbAHTcp.exe
  2⤵
  PID:7040
- C:\Windows\System\iBSSXog.exe
  C:\Windows\System\iBSSXog.exe
  2⤵
  PID:6824
- C:\Windows\System\KwjcSgU.exe
  C:\Windows\System\KwjcSgU.exe
  2⤵
  PID:5328
- C:\Windows\System\CDRxrtL.exe
  C:\Windows\System\CDRxrtL.exe
  2⤵
  PID:6960
- C:\Windows\System\TpmyCIg.exe
  C:\Windows\System\TpmyCIg.exe
  2⤵
  PID:7088
- C:\Windows\System\VuZbtQj.exe
  C:\Windows\System\VuZbtQj.exe
  2⤵
  PID:7100
- C:\Windows\System\BfsZITW.exe
  C:\Windows\System\BfsZITW.exe
  2⤵
  PID:6280
- C:\Windows\System\zcRyXIb.exe
  C:\Windows\System\zcRyXIb.exe
  2⤵
  PID:5808
- C:\Windows\System\CClVBEy.exe
  C:\Windows\System\CClVBEy.exe
  2⤵
  PID:7020
- C:\Windows\System\wHJJFfn.exe
  C:\Windows\System\wHJJFfn.exe
  2⤵
  PID:6508
- C:\Windows\System\wgYqlKA.exe
  C:\Windows\System\wgYqlKA.exe
  2⤵
  PID:6764
- C:\Windows\System\hjClTCX.exe
  C:\Windows\System\hjClTCX.exe
  2⤵
  PID:6492
- C:\Windows\System\VDvxmTE.exe
  C:\Windows\System\VDvxmTE.exe
  2⤵
  PID:6292
- C:\Windows\System\owWWElj.exe
  C:\Windows\System\owWWElj.exe
  2⤵
  PID:6424
- C:\Windows\System\Dvpncxb.exe
  C:\Windows\System\Dvpncxb.exe
  2⤵
  PID:6552
- C:\Windows\System\UPFWNOj.exe
  C:\Windows\System\UPFWNOj.exe
  2⤵
  PID:6164
- C:\Windows\System\KtiaazJ.exe
  C:\Windows\System\KtiaazJ.exe
  2⤵
  PID:6712
- C:\Windows\System\tdFLbUz.exe
  C:\Windows\System\tdFLbUz.exe
  2⤵
  PID:6444
- C:\Windows\System\SdukWbq.exe
  C:\Windows\System\SdukWbq.exe
  2⤵
  PID:6812
- C:\Windows\System\lgeQCfp.exe
  C:\Windows\System\lgeQCfp.exe
  2⤵
  PID:6876
- C:\Windows\System\pXhyBpl.exe
  C:\Windows\System\pXhyBpl.exe
  2⤵
  PID:6944
- C:\Windows\System\bQdWDyI.exe
  C:\Windows\System\bQdWDyI.exe
  2⤵
  PID:6700
- C:\Windows\System\AMVEnID.exe
  C:\Windows\System\AMVEnID.exe
  2⤵
  PID:6584
- C:\Windows\System\qSWJbRn.exe
  C:\Windows\System\qSWJbRn.exe
  2⤵
  PID:6956
- C:\Windows\System\BIkkNkM.exe
  C:\Windows\System\BIkkNkM.exe
  2⤵
  PID:6920
- C:\Windows\System\wvNaoQG.exe
  C:\Windows\System\wvNaoQG.exe
  2⤵
  PID:6632
- C:\Windows\System\TlOClCf.exe
  C:\Windows\System\TlOClCf.exe
  2⤵
  PID:4664
- C:\Windows\System\ELFCIan.exe
  C:\Windows\System\ELFCIan.exe
  2⤵
  PID:6616
- C:\Windows\System\OuAltoH.exe
  C:\Windows\System\OuAltoH.exe
  2⤵
  PID:6940
- C:\Windows\System\sebeZcW.exe
  C:\Windows\System\sebeZcW.exe
  2⤵
  PID:1060
- C:\Windows\System\cIQbNQS.exe
  C:\Windows\System\cIQbNQS.exe
  2⤵
  PID:6332
- C:\Windows\System\XtjYQup.exe
  C:\Windows\System\XtjYQup.exe
  2⤵
  PID:5860
- C:\Windows\System\zLVfvWQ.exe
  C:\Windows\System\zLVfvWQ.exe
  2⤵
  PID:6808
- C:\Windows\System\iCzwYnb.exe
  C:\Windows\System\iCzwYnb.exe
  2⤵
  PID:5736
- C:\Windows\System\PAuHOgD.exe
  C:\Windows\System\PAuHOgD.exe
  2⤵
  PID:6684
- C:\Windows\System\kfKiDjo.exe
  C:\Windows\System\kfKiDjo.exe
  2⤵
  PID:6976
- C:\Windows\System\wSaityl.exe
  C:\Windows\System\wSaityl.exe
  2⤵
  PID:6568
- C:\Windows\System\pIFNfXA.exe
  C:\Windows\System\pIFNfXA.exe
  2⤵
  PID:6872
- C:\Windows\System\BqKhxmA.exe
  C:\Windows\System\BqKhxmA.exe
  2⤵
  PID:7136
- C:\Windows\System\HdCGyvu.exe
  C:\Windows\System\HdCGyvu.exe
  2⤵
  PID:6908
- C:\Windows\System\XjYHrsM.exe
  C:\Windows\System\XjYHrsM.exe
  2⤵
  PID:7176
- C:\Windows\System\XxECyLT.exe
  C:\Windows\System\XxECyLT.exe
  2⤵
  PID:7192
- C:\Windows\System\uFQAqoM.exe
  C:\Windows\System\uFQAqoM.exe
  2⤵
  PID:7208
- C:\Windows\System\sfyeAiX.exe
  C:\Windows\System\sfyeAiX.exe
  2⤵
  PID:7224
- C:\Windows\System\dpyyJFX.exe
  C:\Windows\System\dpyyJFX.exe
  2⤵
  PID:7240
- C:\Windows\System\GLlUCJw.exe
  C:\Windows\System\GLlUCJw.exe
  2⤵
  PID:7256
- C:\Windows\System\SzGwCQK.exe
  C:\Windows\System\SzGwCQK.exe
  2⤵
  PID:7272
- C:\Windows\System\ezKczDm.exe
  C:\Windows\System\ezKczDm.exe
  2⤵
  PID:7288
- C:\Windows\System\CBdZnfk.exe
  C:\Windows\System\CBdZnfk.exe
  2⤵
  PID:7304
- C:\Windows\System\NmBRbGQ.exe
  C:\Windows\System\NmBRbGQ.exe
  2⤵
  PID:7320
- C:\Windows\System\rQbXXpz.exe
  C:\Windows\System\rQbXXpz.exe
  2⤵
  PID:7336
- C:\Windows\System\vjAVVPg.exe
  C:\Windows\System\vjAVVPg.exe
  2⤵
  PID:7352
- C:\Windows\System\DVUucmH.exe
  C:\Windows\System\DVUucmH.exe
  2⤵
  PID:7368
- C:\Windows\System\hlPAWee.exe
  C:\Windows\System\hlPAWee.exe
  2⤵
  PID:7384
- C:\Windows\System\KOSyHEs.exe
  C:\Windows\System\KOSyHEs.exe
  2⤵
  PID:7400
- C:\Windows\System\Rclofri.exe
  C:\Windows\System\Rclofri.exe
  2⤵
  PID:7416
- C:\Windows\System\zdlvbzu.exe
  C:\Windows\System\zdlvbzu.exe
  2⤵
  PID:7432
- C:\Windows\System\mnOkQnt.exe
  C:\Windows\System\mnOkQnt.exe
  2⤵
  PID:7448
- C:\Windows\System\UjOQZvY.exe
  C:\Windows\System\UjOQZvY.exe
  2⤵
  PID:7464
- C:\Windows\System\pqPOGnz.exe
  C:\Windows\System\pqPOGnz.exe
  2⤵
  PID:7480
- C:\Windows\System\SBFZqxU.exe
  C:\Windows\System\SBFZqxU.exe
  2⤵
  PID:7496
- C:\Windows\System\oqxGFxr.exe
  C:\Windows\System\oqxGFxr.exe
  2⤵
  PID:7512
- C:\Windows\System\bRstqDN.exe
  C:\Windows\System\bRstqDN.exe
  2⤵
  PID:7528
- C:\Windows\System\DnJPvHC.exe
  C:\Windows\System\DnJPvHC.exe
  2⤵
  PID:7544
- C:\Windows\System\FxulryG.exe
  C:\Windows\System\FxulryG.exe
  2⤵
  PID:7560
- C:\Windows\System\wiNcpZa.exe
  C:\Windows\System\wiNcpZa.exe
  2⤵
  PID:7576
- C:\Windows\System\tUljjls.exe
  C:\Windows\System\tUljjls.exe
  2⤵
  PID:7592
- C:\Windows\System\Rdsvgpx.exe
  C:\Windows\System\Rdsvgpx.exe
  2⤵
  PID:7608
- C:\Windows\System\mEoqKxr.exe
  C:\Windows\System\mEoqKxr.exe
  2⤵
  PID:7628
- C:\Windows\System\CxrUXCP.exe
  C:\Windows\System\CxrUXCP.exe
  2⤵
  PID:7644
- C:\Windows\System\jkmCrai.exe
  C:\Windows\System\jkmCrai.exe
  2⤵
  PID:7692
- C:\Windows\System\fTNsKvH.exe
  C:\Windows\System\fTNsKvH.exe
  2⤵
  PID:7708
- C:\Windows\System\yobaAMT.exe
  C:\Windows\System\yobaAMT.exe
  2⤵
  PID:7724
- C:\Windows\System\SExBWvM.exe
  C:\Windows\System\SExBWvM.exe
  2⤵
  PID:7740
- C:\Windows\System\SMsPFEb.exe
  C:\Windows\System\SMsPFEb.exe
  2⤵
  PID:7756
- C:\Windows\System\mMyFNjS.exe
  C:\Windows\System\mMyFNjS.exe
  2⤵
  PID:7772
- C:\Windows\System\WEcjzBD.exe
  C:\Windows\System\WEcjzBD.exe
  2⤵
  PID:7788
- C:\Windows\System\wVCUIrC.exe
  C:\Windows\System\wVCUIrC.exe
  2⤵
  PID:7804
- C:\Windows\System\mXyzTUe.exe
  C:\Windows\System\mXyzTUe.exe
  2⤵
  PID:7820
- C:\Windows\System\jeVkqPE.exe
  C:\Windows\System\jeVkqPE.exe
  2⤵
  PID:7836
- C:\Windows\System\frQtaWU.exe
  C:\Windows\System\frQtaWU.exe
  2⤵
  PID:7852
- C:\Windows\System\POhLzSz.exe
  C:\Windows\System\POhLzSz.exe
  2⤵
  PID:7868
- C:\Windows\System\jiBOVqR.exe
  C:\Windows\System\jiBOVqR.exe
  2⤵
  PID:7884
- C:\Windows\System\WrlwbAy.exe
  C:\Windows\System\WrlwbAy.exe
  2⤵
  PID:7900
- C:\Windows\System\YvlPTQk.exe
  C:\Windows\System\YvlPTQk.exe
  2⤵
  PID:7916
- C:\Windows\System\eouQxEG.exe
  C:\Windows\System\eouQxEG.exe
  2⤵
  PID:7932
- C:\Windows\System\mmKHZXL.exe
  C:\Windows\System\mmKHZXL.exe
  2⤵
  PID:7948
- C:\Windows\System\hJPknwX.exe
  C:\Windows\System\hJPknwX.exe
  2⤵
  PID:7964
- C:\Windows\System\hBEVLQD.exe
  C:\Windows\System\hBEVLQD.exe
  2⤵
  PID:7980
- C:\Windows\System\ymMFAao.exe
  C:\Windows\System\ymMFAao.exe
  2⤵
  PID:7996
- C:\Windows\System\wPIvLri.exe
  C:\Windows\System\wPIvLri.exe
  2⤵
  PID:8012
- C:\Windows\System\KoUnKIM.exe
  C:\Windows\System\KoUnKIM.exe
  2⤵
  PID:8028
- C:\Windows\System\znqgUqV.exe
  C:\Windows\System\znqgUqV.exe
  2⤵
  PID:8044
- C:\Windows\System\DNcdykw.exe
  C:\Windows\System\DNcdykw.exe
  2⤵
  PID:8060
- C:\Windows\System\cFfqstP.exe
  C:\Windows\System\cFfqstP.exe
  2⤵
  PID:8076
- C:\Windows\System\UrTaBWd.exe
  C:\Windows\System\UrTaBWd.exe
  2⤵
  PID:8092
- C:\Windows\System\QvYaUjT.exe
  C:\Windows\System\QvYaUjT.exe
  2⤵
  PID:7232
- C:\Windows\System\xBgEsXV.exe
  C:\Windows\System\xBgEsXV.exe
  2⤵
  PID:7488
- C:\Windows\System\FlLNPTH.exe
  C:\Windows\System\FlLNPTH.exe
  2⤵
  PID:7552
- C:\Windows\System\ddImnsK.exe
  C:\Windows\System\ddImnsK.exe
  2⤵
  PID:7440
- C:\Windows\System\BlCEDsa.exe
  C:\Windows\System\BlCEDsa.exe
  2⤵
  PID:7476
- C:\Windows\System\HOUXOUO.exe
  C:\Windows\System\HOUXOUO.exe
  2⤵
  PID:7540
- C:\Windows\System\JnfIHdH.exe
  C:\Windows\System\JnfIHdH.exe
  2⤵
  PID:7616
- C:\Windows\System\zxSjlco.exe
  C:\Windows\System\zxSjlco.exe
  2⤵
  PID:7604
- C:\Windows\System\dVVbdqR.exe
  C:\Windows\System\dVVbdqR.exe
  2⤵
  PID:7640
- C:\Windows\System\UAwicRh.exe
  C:\Windows\System\UAwicRh.exe
  2⤵
  PID:7668
- C:\Windows\System\kDROgma.exe
  C:\Windows\System\kDROgma.exe
  2⤵
  PID:7688
- C:\Windows\System\lTySnrV.exe
  C:\Windows\System\lTySnrV.exe
  2⤵
  PID:7752
- C:\Windows\System\zTYPHRL.exe
  C:\Windows\System\zTYPHRL.exe
  2⤵
  PID:7816
- C:\Windows\System\BoUImAv.exe
  C:\Windows\System\BoUImAv.exe
  2⤵
  PID:7876
- C:\Windows\System\hgnYSNr.exe
  C:\Windows\System\hgnYSNr.exe
  2⤵
  PID:7828
- C:\Windows\System\uFkdWQe.exe
  C:\Windows\System\uFkdWQe.exe
  2⤵
  PID:7764
- C:\Windows\System\ApQWsNd.exe
  C:\Windows\System\ApQWsNd.exe
  2⤵
  PID:7860
- C:\Windows\System\NPoXWAb.exe
  C:\Windows\System\NPoXWAb.exe
  2⤵
  PID:7924
- C:\Windows\System\LGUUoOu.exe
  C:\Windows\System\LGUUoOu.exe
  2⤵
  PID:7928
- C:\Windows\System\HWrcOWt.exe
  C:\Windows\System\HWrcOWt.exe
  2⤵
  PID:7956
- C:\Windows\System\AkyKEGV.exe
  C:\Windows\System\AkyKEGV.exe
  2⤵
  PID:8068
- C:\Windows\System\cPOXBft.exe
  C:\Windows\System\cPOXBft.exe
  2⤵
  PID:8072
- C:\Windows\System\KPpLPcI.exe
  C:\Windows\System\KPpLPcI.exe
  2⤵
  PID:8104
- C:\Windows\System\rcabQUn.exe
  C:\Windows\System\rcabQUn.exe
  2⤵
  PID:8120
- C:\Windows\System\eXoodUE.exe
  C:\Windows\System\eXoodUE.exe
  2⤵
  PID:4564
- C:\Windows\System\gMlyJjZ.exe
  C:\Windows\System\gMlyJjZ.exe
  2⤵
  PID:8136
- C:\Windows\System\lbcmcEK.exe
  C:\Windows\System\lbcmcEK.exe
  2⤵
  PID:8168
- C:\Windows\System\jiwMFxz.exe
  C:\Windows\System\jiwMFxz.exe
  2⤵
  PID:5496
- C:\Windows\System\RvjDFNU.exe
  C:\Windows\System\RvjDFNU.exe
  2⤵
  PID:7264
- C:\Windows\System\tppBeJl.exe
  C:\Windows\System\tppBeJl.exe
  2⤵
  PID:7296
- C:\Windows\System\fszQymD.exe
  C:\Windows\System\fszQymD.exe
  2⤵
  PID:6844
- C:\Windows\System\VcPUykR.exe
  C:\Windows\System\VcPUykR.exe
  2⤵
  PID:7364
- C:\Windows\System\GXyJivc.exe
  C:\Windows\System\GXyJivc.exe
  2⤵
  PID:6228
- C:\Windows\System\RpIusar.exe
  C:\Windows\System\RpIusar.exe
  2⤵
  PID:7684
- C:\Windows\System\CRdIwJU.exe
  C:\Windows\System\CRdIwJU.exe
  2⤵
  PID:7316
- C:\Windows\System\RzlRYnb.exe
  C:\Windows\System\RzlRYnb.exe
  2⤵
  PID:7428
- C:\Windows\System\VeWVLUX.exe
  C:\Windows\System\VeWVLUX.exe
  2⤵
  PID:7472
- C:\Windows\System\sBXCIia.exe
  C:\Windows\System\sBXCIia.exe
  2⤵
  PID:2908
- C:\Windows\System\ZBdHwpU.exe
  C:\Windows\System\ZBdHwpU.exe
  2⤵
  PID:7812
- C:\Windows\System\OoJtGqO.exe
  C:\Windows\System\OoJtGqO.exe
  2⤵
  PID:7800
- C:\Windows\System\neqOKgV.exe
  C:\Windows\System\neqOKgV.exe
  2⤵
  PID:7976
- C:\Windows\System\GIQlAMP.exe
  C:\Windows\System\GIQlAMP.exe
  2⤵
  PID:7748
- C:\Windows\System\BsGmzeT.exe
  C:\Windows\System\BsGmzeT.exe
  2⤵
  PID:8052
- C:\Windows\System\LHYeOzG.exe
  C:\Windows\System\LHYeOzG.exe
  2⤵
  PID:8128
- C:\Windows\System\fLdhGnQ.exe
  C:\Windows\System\fLdhGnQ.exe
  2⤵
  PID:8160
- C:\Windows\System\ijRPQbu.exe
  C:\Windows\System\ijRPQbu.exe
  2⤵
  PID:7848
- C:\Windows\System\MlGOsrM.exe
  C:\Windows\System\MlGOsrM.exe
  2⤵
  PID:7328
- C:\Windows\System\xfBqHZY.exe
  C:\Windows\System\xfBqHZY.exe
  2⤵
  PID:7284
- C:\Windows\System\mWQPtsU.exe
  C:\Windows\System\mWQPtsU.exe
  2⤵
  PID:8040
- C:\Windows\System\TeKmggc.exe
  C:\Windows\System\TeKmggc.exe
  2⤵
  PID:8112
- C:\Windows\System\uhZVWcE.exe
  C:\Windows\System\uhZVWcE.exe
  2⤵
  PID:7444
- C:\Windows\System\oGrZAYv.exe
  C:\Windows\System\oGrZAYv.exe
  2⤵
  PID:7944
- C:\Windows\System\ftVBbgp.exe
  C:\Windows\System\ftVBbgp.exe
  2⤵
  PID:7424
- C:\Windows\System\hUOUtdI.exe
  C:\Windows\System\hUOUtdI.exe
  2⤵
  PID:6652
- C:\Windows\System\kfHeJLC.exe
  C:\Windows\System\kfHeJLC.exe
  2⤵
  PID:6060
- C:\Windows\System\LytOcfh.exe
  C:\Windows\System\LytOcfh.exe
  2⤵
  PID:7248
- C:\Windows\System\KjplcXJ.exe
  C:\Windows\System\KjplcXJ.exe
  2⤵
  PID:7652
- C:\Windows\System\EsaPdsc.exe
  C:\Windows\System\EsaPdsc.exe
  2⤵
  PID:8164
- C:\Windows\System\jSgZvju.exe
  C:\Windows\System\jSgZvju.exe
  2⤵
  PID:7508
- C:\Windows\System\hbCCKdG.exe
  C:\Windows\System\hbCCKdG.exe
  2⤵
  PID:6888
- C:\Windows\System\WqJvDAd.exe
  C:\Windows\System\WqJvDAd.exe
  2⤵
  PID:8148
- C:\Windows\System\qEHfPCD.exe
  C:\Windows\System\qEHfPCD.exe
  2⤵
  PID:8188
- C:\Windows\System\fxrhUjG.exe
  C:\Windows\System\fxrhUjG.exe
  2⤵
  PID:7412
- C:\Windows\System\DzDoPPP.exe
  C:\Windows\System\DzDoPPP.exe
  2⤵
  PID:7664
- C:\Windows\System\mIFrFcL.exe
  C:\Windows\System\mIFrFcL.exe
  2⤵
  PID:7408
- C:\Windows\System\UoJsiFF.exe
  C:\Windows\System\UoJsiFF.exe
  2⤵
  PID:7784
- C:\Windows\System\gWWlogf.exe
  C:\Windows\System\gWWlogf.exe
  2⤵
  PID:7216
- C:\Windows\System\gQIQvYI.exe
  C:\Windows\System\gQIQvYI.exe
  2⤵
  PID:7220
- C:\Windows\System\RWqRraS.exe
  C:\Windows\System\RWqRraS.exe
  2⤵
  PID:7732
- C:\Windows\System\uwVyEks.exe
  C:\Windows\System\uwVyEks.exe
  2⤵
  PID:7912
- C:\Windows\System\MGkjzsx.exe
  C:\Windows\System\MGkjzsx.exe
  2⤵
  PID:7600
- C:\Windows\System\FQORxiQ.exe
  C:\Windows\System\FQORxiQ.exe
  2⤵
  PID:8056
- C:\Windows\System\hEDhLOT.exe
  C:\Windows\System\hEDhLOT.exe
  2⤵
  PID:2984
- C:\Windows\System\guvtOYl.exe
  C:\Windows\System\guvtOYl.exe
  2⤵
  PID:8200
- C:\Windows\System\suIZYbP.exe
  C:\Windows\System\suIZYbP.exe
  2⤵
  PID:8216
- C:\Windows\System\rAlVVuW.exe
  C:\Windows\System\rAlVVuW.exe
  2⤵
  PID:8232
- C:\Windows\System\DctBWCJ.exe
  C:\Windows\System\DctBWCJ.exe
  2⤵
  PID:8248
- C:\Windows\System\hDtCxWj.exe
  C:\Windows\System\hDtCxWj.exe
  2⤵
  PID:8264
- C:\Windows\System\zjcbcKV.exe
  C:\Windows\System\zjcbcKV.exe
  2⤵
  PID:8280
- C:\Windows\System\quXdWit.exe
  C:\Windows\System\quXdWit.exe
  2⤵
  PID:8296
- C:\Windows\System\nSlQESv.exe
  C:\Windows\System\nSlQESv.exe
  2⤵
  PID:8312
- C:\Windows\System\TinlmLn.exe
  C:\Windows\System\TinlmLn.exe
  2⤵
  PID:8328
- C:\Windows\System\klEGlol.exe
  C:\Windows\System\klEGlol.exe
  2⤵
  PID:8344
- C:\Windows\System\XKzASzG.exe
  C:\Windows\System\XKzASzG.exe
  2⤵
  PID:8360
- C:\Windows\System\MaMNaOZ.exe
  C:\Windows\System\MaMNaOZ.exe
  2⤵
  PID:8376
- C:\Windows\System\AOaAnkx.exe
  C:\Windows\System\AOaAnkx.exe
  2⤵
  PID:8392
- C:\Windows\System\CUYsRJO.exe
  C:\Windows\System\CUYsRJO.exe
  2⤵
  PID:8408
- C:\Windows\System\wCbhBOW.exe
  C:\Windows\System\wCbhBOW.exe
  2⤵
  PID:8424
- C:\Windows\System\VplSZBz.exe
  C:\Windows\System\VplSZBz.exe
  2⤵
  PID:8440
- C:\Windows\System\JDMIWcO.exe
  C:\Windows\System\JDMIWcO.exe
  2⤵
  PID:8456
- C:\Windows\System\ckFNOzf.exe
  C:\Windows\System\ckFNOzf.exe
  2⤵
  PID:8472
- C:\Windows\System\iPKsXxe.exe
  C:\Windows\System\iPKsXxe.exe
  2⤵
  PID:8488
- C:\Windows\System\ZXCayGZ.exe
  C:\Windows\System\ZXCayGZ.exe
  2⤵
  PID:8504
- C:\Windows\System\fVLtBlA.exe
  C:\Windows\System\fVLtBlA.exe
  2⤵
  PID:8520
- C:\Windows\System\utfWmSb.exe
  C:\Windows\System\utfWmSb.exe
  2⤵
  PID:8536
- C:\Windows\System\aPSgPFf.exe
  C:\Windows\System\aPSgPFf.exe
  2⤵
  PID:8552
- C:\Windows\System\YGBTsud.exe
  C:\Windows\System\YGBTsud.exe
  2⤵
  PID:8568
- C:\Windows\System\hHTzJkS.exe
  C:\Windows\System\hHTzJkS.exe
  2⤵
  PID:8584
- C:\Windows\System\vDDDXMA.exe
  C:\Windows\System\vDDDXMA.exe
  2⤵
  PID:8600
- C:\Windows\System\qaxWLwp.exe
  C:\Windows\System\qaxWLwp.exe
  2⤵
  PID:8616
- C:\Windows\System\KDgstPi.exe
  C:\Windows\System\KDgstPi.exe
  2⤵
  PID:8632
- C:\Windows\System\PyZOTVy.exe
  C:\Windows\System\PyZOTVy.exe
  2⤵
  PID:8648
- C:\Windows\System\irwLuoV.exe
  C:\Windows\System\irwLuoV.exe
  2⤵
  PID:8664
- C:\Windows\System\EcmePSW.exe
  C:\Windows\System\EcmePSW.exe
  2⤵
  PID:8680
- C:\Windows\System\paACXKX.exe
  C:\Windows\System\paACXKX.exe
  2⤵
  PID:8696
- C:\Windows\System\WjcsjNM.exe
  C:\Windows\System\WjcsjNM.exe
  2⤵
  PID:8712
- C:\Windows\System\RJXrxia.exe
  C:\Windows\System\RJXrxia.exe
  2⤵
  PID:8728
- C:\Windows\System\KeHRequ.exe
  C:\Windows\System\KeHRequ.exe
  2⤵
  PID:8744
- C:\Windows\System\PRDaJSL.exe
  C:\Windows\System\PRDaJSL.exe
  2⤵
  PID:8760
- C:\Windows\System\RmirCSx.exe
  C:\Windows\System\RmirCSx.exe
  2⤵
  PID:8776
- C:\Windows\System\iOreWHX.exe
  C:\Windows\System\iOreWHX.exe
  2⤵
  PID:8792
- C:\Windows\System\twlgavC.exe
  C:\Windows\System\twlgavC.exe
  2⤵
  PID:8808
- C:\Windows\System\VBSqiQX.exe
  C:\Windows\System\VBSqiQX.exe
  2⤵
  PID:8824
- C:\Windows\System\LEbGHvA.exe
  C:\Windows\System\LEbGHvA.exe
  2⤵
  PID:8840
- C:\Windows\System\dnAeigX.exe
  C:\Windows\System\dnAeigX.exe
  2⤵
  PID:8856
- C:\Windows\System\wKvIErk.exe
  C:\Windows\System\wKvIErk.exe
  2⤵
  PID:8872
- C:\Windows\System\YWpenAk.exe
  C:\Windows\System\YWpenAk.exe
  2⤵
  PID:8888
- C:\Windows\System\GZfiRAh.exe
  C:\Windows\System\GZfiRAh.exe
  2⤵
  PID:8904
- C:\Windows\System\AWEBdsb.exe
  C:\Windows\System\AWEBdsb.exe
  2⤵
  PID:8920
- C:\Windows\System\gaqQKnR.exe
  C:\Windows\System\gaqQKnR.exe
  2⤵
  PID:8936
- C:\Windows\System\glqKIVw.exe
  C:\Windows\System\glqKIVw.exe
  2⤵
  PID:8952
- C:\Windows\System\cVtZsoj.exe
  C:\Windows\System\cVtZsoj.exe
  2⤵
  PID:8968
- C:\Windows\System\yRVZfmF.exe
  C:\Windows\System\yRVZfmF.exe
  2⤵
  PID:8984
- C:\Windows\System\EKByiYI.exe
  C:\Windows\System\EKByiYI.exe
  2⤵
  PID:9000
- C:\Windows\System\xcvpgDI.exe
  C:\Windows\System\xcvpgDI.exe
  2⤵
  PID:9016
- C:\Windows\System\PMQaWKV.exe
  C:\Windows\System\PMQaWKV.exe
  2⤵
  PID:9032
- C:\Windows\System\ekbThVD.exe
  C:\Windows\System\ekbThVD.exe
  2⤵
  PID:9048
- C:\Windows\System\uiHuWJL.exe
  C:\Windows\System\uiHuWJL.exe
  2⤵
  PID:9064
- C:\Windows\System\oBdqoGi.exe
  C:\Windows\System\oBdqoGi.exe
  2⤵
  PID:9080
- C:\Windows\System\WVSjBfj.exe
  C:\Windows\System\WVSjBfj.exe
  2⤵
  PID:9096
- C:\Windows\System\nwYeroX.exe
  C:\Windows\System\nwYeroX.exe
  2⤵
  PID:9112
- C:\Windows\System\QnPrxSq.exe
  C:\Windows\System\QnPrxSq.exe
  2⤵
  PID:9128
- C:\Windows\System\tNGSjCT.exe
  C:\Windows\System\tNGSjCT.exe
  2⤵
  PID:9144
- C:\Windows\System\ljUzKKa.exe
  C:\Windows\System\ljUzKKa.exe
  2⤵
  PID:9160
- C:\Windows\System\PEpVfgw.exe
  C:\Windows\System\PEpVfgw.exe
  2⤵
  PID:9176
- C:\Windows\System\jtLemwt.exe
  C:\Windows\System\jtLemwt.exe
  2⤵
  PID:9192
- C:\Windows\System\afAJAqo.exe
  C:\Windows\System\afAJAqo.exe
  2⤵
  PID:9208
- C:\Windows\System\kWfoSXg.exe
  C:\Windows\System\kWfoSXg.exe
  2⤵
  PID:8144
- C:\Windows\System\IWOnzCU.exe
  C:\Windows\System\IWOnzCU.exe
  2⤵
  PID:8212
- C:\Windows\System\mdOUboo.exe
  C:\Windows\System\mdOUboo.exe
  2⤵
  PID:8088
- C:\Windows\System\GLCWGHx.exe
  C:\Windows\System\GLCWGHx.exe
  2⤵
  PID:8272
- C:\Windows\System\qiluXCW.exe
  C:\Windows\System\qiluXCW.exe
  2⤵
  PID:8256
- C:\Windows\System\UuhSmFi.exe
  C:\Windows\System\UuhSmFi.exe
  2⤵
  PID:8292
- C:\Windows\System\YpBJHRu.exe
  C:\Windows\System\YpBJHRu.exe
  2⤵
  PID:8324
- C:\Windows\System\DnFBAds.exe
  C:\Windows\System\DnFBAds.exe
  2⤵
  PID:8400
- C:\Windows\System\tgOOfqG.exe
  C:\Windows\System\tgOOfqG.exe
  2⤵
  PID:8384
- C:\Windows\System\eAqWtyt.exe
  C:\Windows\System\eAqWtyt.exe
  2⤵
  PID:8468
- C:\Windows\System\lLeFmbP.exe
  C:\Windows\System\lLeFmbP.exe
  2⤵
  PID:8528
- C:\Windows\System\nuzEJGj.exe
  C:\Windows\System\nuzEJGj.exe
  2⤵
  PID:8480
- C:\Windows\System\RhJWUbt.exe
  C:\Windows\System\RhJWUbt.exe
  2⤵
  PID:8596
- C:\Windows\System\cyfMkqy.exe
  C:\Windows\System\cyfMkqy.exe
  2⤵
  PID:8544
- C:\Windows\System\hnNDccL.exe
  C:\Windows\System\hnNDccL.exe
  2⤵
  PID:8628
- C:\Windows\System\CIQCEIF.exe
  C:\Windows\System\CIQCEIF.exe
  2⤵
  PID:8608
- C:\Windows\System\hFDmxaa.exe
  C:\Windows\System\hFDmxaa.exe
  2⤵
  PID:8640
- C:\Windows\System\ARAOHlw.exe
  C:\Windows\System\ARAOHlw.exe
  2⤵
  PID:8708
- C:\Windows\System\LgutIwq.exe
  C:\Windows\System\LgutIwq.exe
  2⤵
  PID:8736
- C:\Windows\System\PKowfDp.exe
  C:\Windows\System\PKowfDp.exe
  2⤵
  PID:8768
- C:\Windows\System\XFLjsTv.exe
  C:\Windows\System\XFLjsTv.exe
  2⤵
  PID:8800
- C:\Windows\System\glrEUrF.exe
  C:\Windows\System\glrEUrF.exe
  2⤵
  PID:8848
- C:\Windows\System\utorUji.exe
  C:\Windows\System\utorUji.exe
  2⤵
  PID:8832
- C:\Windows\System\bOinhkC.exe
  C:\Windows\System\bOinhkC.exe
  2⤵
  PID:8868
- C:\Windows\System\RzWIyKw.exe
  C:\Windows\System\RzWIyKw.exe
  2⤵
  PID:8944
- C:\Windows\System\FeMnCVU.exe
  C:\Windows\System\FeMnCVU.exe
  2⤵
  PID:8980
- C:\Windows\System\giqwWfX.exe
  C:\Windows\System\giqwWfX.exe
  2⤵
  PID:9044
- C:\Windows\System\zqLnhGK.exe
  C:\Windows\System\zqLnhGK.exe
  2⤵
  PID:8960
- C:\Windows\System\ArVImfO.exe
  C:\Windows\System\ArVImfO.exe
  2⤵
  PID:9024
- C:\Windows\System\utTPFNr.exe
  C:\Windows\System\utTPFNr.exe
  2⤵
  PID:9092
- C:\Windows\System\OrCrRXV.exe
  C:\Windows\System\OrCrRXV.exe
  2⤵
  PID:9124
- C:\Windows\System\ESfVcqk.exe
  C:\Windows\System\ESfVcqk.exe
  2⤵
  PID:9156
- C:\Windows\System\BNgWffP.exe
  C:\Windows\System\BNgWffP.exe
  2⤵
  PID:9200
- C:\Windows\System\mDVteIy.exe
  C:\Windows\System\mDVteIy.exe
  2⤵
  PID:412
- C:\Windows\System\pRxGdQx.exe
  C:\Windows\System\pRxGdQx.exe
  2⤵
  PID:2744
- C:\Windows\System\CGgLyJw.exe
  C:\Windows\System\CGgLyJw.exe
  2⤵
  PID:8352
- C:\Windows\System\MNclkfl.exe
  C:\Windows\System\MNclkfl.exe
  2⤵
  PID:8368
- C:\Windows\System\COAUVYJ.exe
  C:\Windows\System\COAUVYJ.exe
  2⤵
  PID:8388
- C:\Windows\System\ZCqaGGt.exe
  C:\Windows\System\ZCqaGGt.exe
  2⤵
  PID:8512
- C:\Windows\System\iNyjXWe.exe
  C:\Windows\System\iNyjXWe.exe
  2⤵
  PID:7524
- C:\Windows\System\vNlBeTt.exe
  C:\Windows\System\vNlBeTt.exe
  2⤵
  PID:8660
- C:\Windows\System\entZqrG.exe
  C:\Windows\System\entZqrG.exe
  2⤵
  PID:8752
- C:\Windows\System\wvdEDQB.exe
  C:\Windows\System\wvdEDQB.exe
  2⤵
  PID:8816
- C:\Windows\System\dqBqtgJ.exe
  C:\Windows\System\dqBqtgJ.exe
  2⤵
  PID:8820
- C:\Windows\System\HXfVUvj.exe
  C:\Windows\System\HXfVUvj.exe
  2⤵
  PID:8884
- C:\Windows\System\coFPuqe.exe
  C:\Windows\System\coFPuqe.exe
  2⤵
  PID:8896
- C:\Windows\System\MYEmSkw.exe
  C:\Windows\System\MYEmSkw.exe
  2⤵
  PID:8916
- C:\Windows\System\owAdTRv.exe
  C:\Windows\System\owAdTRv.exe
  2⤵
  PID:9168
- C:\Windows\System\IIAfbwg.exe
  C:\Windows\System\IIAfbwg.exe
  2⤵
  PID:9108
- C:\Windows\System\HVZjOjh.exe
  C:\Windows\System\HVZjOjh.exe
  2⤵
  PID:9184
- C:\Windows\System\pFOcFHC.exe
  C:\Windows\System\pFOcFHC.exe
  2⤵
  PID:8288
- C:\Windows\System\GsVLGyZ.exe
  C:\Windows\System\GsVLGyZ.exe
  2⤵
  PID:9220
- C:\Windows\System\VEfnICY.exe
  C:\Windows\System\VEfnICY.exe
  2⤵
  PID:9236
- C:\Windows\System\DlXtbkO.exe
  C:\Windows\System\DlXtbkO.exe
  2⤵
  PID:9252
- C:\Windows\System\DvvQmbG.exe
  C:\Windows\System\DvvQmbG.exe
  2⤵
  PID:9268
- C:\Windows\System\ETjyrAW.exe
  C:\Windows\System\ETjyrAW.exe
  2⤵
  PID:9284
- C:\Windows\System\jVvWVSg.exe
  C:\Windows\System\jVvWVSg.exe
  2⤵
  PID:9300
- C:\Windows\System\sXbKBCs.exe
  C:\Windows\System\sXbKBCs.exe
  2⤵
  PID:9316
- C:\Windows\System\JbLcvbs.exe
  C:\Windows\System\JbLcvbs.exe
  2⤵
  PID:9340
- C:\Windows\System\HISPJFz.exe
  C:\Windows\System\HISPJFz.exe
  2⤵
  PID:9356
- C:\Windows\System\yPdiark.exe
  C:\Windows\System\yPdiark.exe
  2⤵
  PID:9372
- C:\Windows\System\QNOnRpu.exe
  C:\Windows\System\QNOnRpu.exe
  2⤵
  PID:9388
- C:\Windows\System\IFDyJrN.exe
  C:\Windows\System\IFDyJrN.exe
  2⤵
  PID:9404
- C:\Windows\System\XIXyEwu.exe
  C:\Windows\System\XIXyEwu.exe
  2⤵
  PID:9420
- C:\Windows\System\iJXHPng.exe
  C:\Windows\System\iJXHPng.exe
  2⤵
  PID:9436
- C:\Windows\System\CaVuqEi.exe
  C:\Windows\System\CaVuqEi.exe
  2⤵
  PID:9452
- C:\Windows\System\jzdSPVy.exe
  C:\Windows\System\jzdSPVy.exe
  2⤵
  PID:9468
- C:\Windows\System\hRgTARD.exe
  C:\Windows\System\hRgTARD.exe
  2⤵
  PID:9484
- C:\Windows\System\stPbcJu.exe
  C:\Windows\System\stPbcJu.exe
  2⤵
  PID:9500
- C:\Windows\System\QOltCoI.exe
  C:\Windows\System\QOltCoI.exe
  2⤵
  PID:9516
- C:\Windows\System\lLPAKYl.exe
  C:\Windows\System\lLPAKYl.exe
  2⤵
  PID:9532
- C:\Windows\System\whCOeXm.exe
  C:\Windows\System\whCOeXm.exe
  2⤵
  PID:9548
- C:\Windows\System\pwGTJKX.exe
  C:\Windows\System\pwGTJKX.exe
  2⤵
  PID:9564
- C:\Windows\System\twqXIeI.exe
  C:\Windows\System\twqXIeI.exe
  2⤵
  PID:9580
- C:\Windows\System\BEHhpdN.exe
  C:\Windows\System\BEHhpdN.exe
  2⤵
  PID:9596
- C:\Windows\System\tVlKibD.exe
  C:\Windows\System\tVlKibD.exe
  2⤵
  PID:9612
- C:\Windows\System\bZmOgkt.exe
  C:\Windows\System\bZmOgkt.exe
  2⤵
  PID:9628
- C:\Windows\System\tAWYUEo.exe
  C:\Windows\System\tAWYUEo.exe
  2⤵
  PID:9644
- C:\Windows\System\kTTJQfb.exe
  C:\Windows\System\kTTJQfb.exe
  2⤵
  PID:9660
- C:\Windows\System\onhLnRc.exe
  C:\Windows\System\onhLnRc.exe
  2⤵
  PID:9676
- C:\Windows\System\dJaMiUs.exe
  C:\Windows\System\dJaMiUs.exe
  2⤵
  PID:9692
- C:\Windows\System\JoZojCe.exe
  C:\Windows\System\JoZojCe.exe
  2⤵
  PID:9708
- C:\Windows\System\AypkgdW.exe
  C:\Windows\System\AypkgdW.exe
  2⤵
  PID:9728
- C:\Windows\System\AgXtedH.exe
  C:\Windows\System\AgXtedH.exe
  2⤵
  PID:9744
- C:\Windows\System\XRRSCrx.exe
  C:\Windows\System\XRRSCrx.exe
  2⤵
  PID:9764
- C:\Windows\System\JDDZzAG.exe
  C:\Windows\System\JDDZzAG.exe
  2⤵
  PID:9780
- C:\Windows\System\NuCPzRD.exe
  C:\Windows\System\NuCPzRD.exe
  2⤵
  PID:9796
- C:\Windows\System\PCQwuZk.exe
  C:\Windows\System\PCQwuZk.exe
  2⤵
  PID:9812
- C:\Windows\System\zyJxYRz.exe
  C:\Windows\System\zyJxYRz.exe
  2⤵
  PID:9828
- C:\Windows\System\pVaJQoR.exe
  C:\Windows\System\pVaJQoR.exe
  2⤵
  PID:9844
- C:\Windows\System\YeykThp.exe
  C:\Windows\System\YeykThp.exe
  2⤵
  PID:9860
- C:\Windows\System\XMxqxjp.exe
  C:\Windows\System\XMxqxjp.exe
  2⤵
  PID:9876
- C:\Windows\System\pWMchDu.exe
  C:\Windows\System\pWMchDu.exe
  2⤵
  PID:9892
- C:\Windows\System\txXrqeU.exe
  C:\Windows\System\txXrqeU.exe
  2⤵
  PID:9908
- C:\Windows\System\aMjIogy.exe
  C:\Windows\System\aMjIogy.exe
  2⤵
  PID:9924
- C:\Windows\System\smBpHNW.exe
  C:\Windows\System\smBpHNW.exe
  2⤵
  PID:9940
- C:\Windows\System\LxQBQdh.exe
  C:\Windows\System\LxQBQdh.exe
  2⤵
  PID:9956
- C:\Windows\System\lRqVuyZ.exe
  C:\Windows\System\lRqVuyZ.exe
  2⤵
  PID:9972
- C:\Windows\System\mRWozAx.exe
  C:\Windows\System\mRWozAx.exe
  2⤵
  PID:9988
- C:\Windows\System\EtSMMxT.exe
  C:\Windows\System\EtSMMxT.exe
  2⤵
  PID:10004
- C:\Windows\System\JBVFwQZ.exe
  C:\Windows\System\JBVFwQZ.exe
  2⤵
  PID:10020
- C:\Windows\System\Gwxbttk.exe
  C:\Windows\System\Gwxbttk.exe
  2⤵
  PID:10036
- C:\Windows\System\wEqzrur.exe
  C:\Windows\System\wEqzrur.exe
  2⤵
  PID:10052
- C:\Windows\System\HdcmrMO.exe
  C:\Windows\System\HdcmrMO.exe
  2⤵
  PID:10068
- C:\Windows\System\RpSDTfh.exe
  C:\Windows\System\RpSDTfh.exe
  2⤵
  PID:10084
- C:\Windows\System\YfkxNoG.exe
  C:\Windows\System\YfkxNoG.exe
  2⤵
  PID:10100
- C:\Windows\System\mFdySQW.exe
  C:\Windows\System\mFdySQW.exe
  2⤵
  PID:10116
- C:\Windows\System\ckCrIeZ.exe
  C:\Windows\System\ckCrIeZ.exe
  2⤵
  PID:10132
- C:\Windows\System\qZBGKDC.exe
  C:\Windows\System\qZBGKDC.exe
  2⤵
  PID:10148
- C:\Windows\System\vFysBAk.exe
  C:\Windows\System\vFysBAk.exe
  2⤵
  PID:10164
- C:\Windows\System\nZqnmJQ.exe
  C:\Windows\System\nZqnmJQ.exe
  2⤵
  PID:10180
- C:\Windows\System\UsQRpIy.exe
  C:\Windows\System\UsQRpIy.exe
  2⤵
  PID:10196
- C:\Windows\System\DSbwcon.exe
  C:\Windows\System\DSbwcon.exe
  2⤵
  PID:10212
- C:\Windows\System\IBTeHTM.exe
  C:\Windows\System\IBTeHTM.exe
  2⤵
  PID:10228
- C:\Windows\System\LemAvrY.exe
  C:\Windows\System\LemAvrY.exe
  2⤵
  PID:8416
- C:\Windows\System\rHMgFng.exe
  C:\Windows\System\rHMgFng.exe
  2⤵
  PID:8720
- C:\Windows\System\kFJFunj.exe
  C:\Windows\System\kFJFunj.exe
  2⤵
  PID:9060
- C:\Windows\System\clfauDf.exe
  C:\Windows\System\clfauDf.exe
  2⤵
  PID:9276
- C:\Windows\System\wDURPdy.exe
  C:\Windows\System\wDURPdy.exe
  2⤵
  PID:9348
- C:\Windows\System\JCjIlot.exe
  C:\Windows\System\JCjIlot.exe
  2⤵
  PID:8304
- C:\Windows\System\fbURiti.exe
  C:\Windows\System\fbURiti.exe
  2⤵
  PID:9384
- C:\Windows\System\eWZOPbc.exe
  C:\Windows\System\eWZOPbc.exe
  2⤵
  PID:9448
- C:\Windows\System\PcqnQqD.exe
  C:\Windows\System\PcqnQqD.exe
  2⤵
  PID:9512
- C:\Windows\System\sJjjkeZ.exe
  C:\Windows\System\sJjjkeZ.exe
  2⤵
  PID:9576
- C:\Windows\System\kDtmuKC.exe
  C:\Windows\System\kDtmuKC.exe
  2⤵
  PID:9640
- C:\Windows\System\RZUowaW.exe
  C:\Windows\System\RZUowaW.exe
  2⤵
  PID:9704
- C:\Windows\System\YcALxef.exe
  C:\Windows\System\YcALxef.exe
  2⤵
  PID:9556
- C:\Windows\System\CNnJrEs.exe
  C:\Windows\System\CNnJrEs.exe
  2⤵
  PID:8576
- C:\Windows\System\MWjFFYe.exe
  C:\Windows\System\MWjFFYe.exe
  2⤵
  PID:9228
- C:\Windows\System\dibinlY.exe
  C:\Windows\System\dibinlY.exe
  2⤵
  PID:8772
- C:\Windows\System\oBOYvVs.exe
  C:\Windows\System\oBOYvVs.exe
  2⤵
  PID:9560
- C:\Windows\System\eeOniPs.exe
  C:\Windows\System\eeOniPs.exe
  2⤵
  PID:8836
- C:\Windows\System\gVjdlTO.exe
  C:\Windows\System\gVjdlTO.exe
  2⤵
  PID:9232
- C:\Windows\System\kGnXKjx.exe
  C:\Windows\System\kGnXKjx.exe
  2⤵
  PID:9368
- C:\Windows\System\aYSLpQe.exe
  C:\Windows\System\aYSLpQe.exe
  2⤵
  PID:9432
- C:\Windows\System\HABtEQT.exe
  C:\Windows\System\HABtEQT.exe
  2⤵
  PID:9528
- C:\Windows\System\hHFXoua.exe
  C:\Windows\System\hHFXoua.exe
  2⤵
  PID:9716
- C:\Windows\System\RMoizNE.exe
  C:\Windows\System\RMoizNE.exe
  2⤵
  PID:9720
- C:\Windows\System\pOzmTKy.exe
  C:\Windows\System\pOzmTKy.exe
  2⤵
  PID:9772
- C:\Windows\System\evfcHZS.exe
  C:\Windows\System\evfcHZS.exe
  2⤵
  PID:9836
- C:\Windows\System\nWJUwAl.exe
  C:\Windows\System\nWJUwAl.exe
  2⤵
  PID:9872
- C:\Windows\System\GQxgZax.exe
  C:\Windows\System\GQxgZax.exe
  2⤵
  PID:9936
- C:\Windows\System\LNgedvg.exe
  C:\Windows\System\LNgedvg.exe
  2⤵
  PID:9856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ABsPPMV.exe

Filesize
2.3MB

MD5
f03e9cb94a3cee3ce48975a1f564e887

SHA1
b769a70ee156ddb3008acc483b9c233c2b97301c

SHA256
5271bbb5738451029bd2f90cbcf462f17753bd253dd0546d98d7840734c94961

SHA512
52f15e2a8ff46a92d3884b2b7df93d66d98eea58b8f325778b0fbe7b11636089ca7be55bcecd020e3dd53bf9ad6ef79190a5d6e87caa2c5397dc4ba1158eda36

Download Submit
C:\Windows\system\CLvrVBY.exe

Filesize
2.3MB

MD5
26a2e68ea2f09e8da0e66c4776769c11

SHA1
d65cd6a7d51c1be4200b4e493877d094200d120d

SHA256
3a8606fe3df15765caf12618a42f2c970efbdb01f4b8d353c36c43b021219d21

SHA512
d776844371e4dd2026118ca11ceb0c92d27668c0698e32f3d53b4f56f74259f25f9e69108197ad2a666572520a97631ed1177fb5d5fe871534c4142300da3d77

Download Submit
C:\Windows\system\EaVtPGA.exe

Filesize
2.3MB

MD5
e3aee66d62bde2224c5a59acb1c7f88c

SHA1
051a11cf8580348542b5d9d332346584799f2c33

SHA256
653ba97337a1700dd796cc9de851f650a5c2de560a6fbf28d2392711ff17d20a

SHA512
443c629862b0a5558ac309fdbd6ed890e19aaa1f2bf28961f2b4c71976091424944a829e2651b93c117fd460a5a979b74a68c5d21d7c90747b62ad8c9991d64b

Download Submit
C:\Windows\system\HsmigrU.exe

Filesize
2.3MB

MD5
26d88095450695ab05488b4b445d8633

SHA1
5396cfbba9b6e488c06d8ab52b76b8651eaddf19

SHA256
f4eaa1932080367cecc3f130006818f6fe40450cf520d706cf3fbd1c30895c44

SHA512
fe58fc513346ce78b1175327d203f2a67c8f5a144d0afc4fcbd0c06f1d21b98a45b5e6df4a50014f7fa517a40195308450a5fd71fb7ce4651497c46c3070a275

Download Submit
C:\Windows\system\IStCiXo.exe

Filesize
2.3MB

MD5
72a6623eeb4ce1fc877d9a6aab1735fa

SHA1
173f09b3afd556d726153c173173be704ec90dd0

SHA256
389bd2b15fec55f10f571722105803435c20589112c762abbb32268ae5664a6d

SHA512
616373ea7f847bbbc1bc8821c558db6d9bd293838376cf4698117663d7eed552092673d9f8244a1f515942dd4bf109b67c7f60b240fc2cc064b8f9ca7a541546

Download Submit
C:\Windows\system\IweIhOV.exe

Filesize
2.3MB

MD5
3c47e6bd8a4e5420a22cf2d48f59333f

SHA1
c5937245ebc074f359dc0cf6656a778566466990

SHA256
0f77e9038975ccb339e0aa782f4121c3cbd10b793751b9684cbf56d94556dbaf

SHA512
79783d9f47200e38336f5a631cbec097121cf33054e65529747ba0a16bb1601b16710d2fa23cb78153bd41317649752e93fa4a11b5cd1be05687a4b4c2804d54

Download Submit
C:\Windows\system\LmpPKbA.exe

Filesize
2.3MB

MD5
30f19d59c86b3448a67f077b344087d3

SHA1
7bfa60c6fd7951c23fabf40c33c7731fa625572f

SHA256
c06f3c50defa4d773fb8909a65fd12dd0f0044c2b88bf9e97ef345bc1f2ebdde

SHA512
0b6995e217329969dc5848360f899c799eb6b161e639136a3937620deb149e2555ac9db07224eabf2a30bd5399f436025d419f3e75ceaad1e20530d72bdd50c6

Download Submit
C:\Windows\system\MRjbXZn.exe

Filesize
2.3MB

MD5
4b1e860b1360b977873dd498ae54abb8

SHA1
5b9f69799f2d8b64ad2aded80ee6c6e137d0b56e

SHA256
e44c84a10512b0f6fa43784f8fe3089d3fc04b54a3540cd7202d6f317d7586c6

SHA512
fe0f4a96c872252250a44d6ee4b9211bebd1b7131d8a4ad6656bdde39eddf0fcccc401010d64db43861be6c3c3def99224bf100fb6d26146d57446b66548d4e7

Download Submit
C:\Windows\system\SIRTJpM.exe

Filesize
2.3MB

MD5
8e40c79c15f10e5b13ba95d7b3e48c06

SHA1
2217f7eb54ccb7e2350d311448a1f7a467ce1d8c

SHA256
a23eaf016266bf7569bbdf7d642a50c19a17dac897593ce328935fe374356434

SHA512
fe1538e003b5337721bedac1025a22500d3232e5f30bcda6de71c9fb81fceac29a335d3ad16aa795b13e40e1e3ff9481b67726a304254690596fd19ef877bec6

Download Submit
C:\Windows\system\SPVzApD.exe

Filesize
2.3MB

MD5
5f9d1ef45ec8b4da9ccd8172712d0b8d

SHA1
4b387484e8834546ced1bf7846dc9d4ce37f9068

SHA256
ee580783a951903a94ee7c89dad5111665ac3b3de8dd25e512e69ad10ea5eb76

SHA512
4095684ca0a6380af59ecf951f4a14cfe22a8a5ad33a05df9b735175b37e9e2dda80c0aa258e1b2f72d16f0c688f8ec3566e716595231220f65edf816ede7dc4

Download Submit
C:\Windows\system\TAIuBCb.exe

Filesize
2.3MB

MD5
53083baa0c965889aa77445f0bc7d1c2

SHA1
f09933e5a8b0499665f30d0edd00b2f25337c0b9

SHA256
50c7e47cbe35a2c5528ee5283470e474a81a3791d68c74895de15f80daaea249

SHA512
cc315d4de59d874dbc3ae64bf7f95d9f7e51252783c8c6bdaf2e4cb380b33e65be987195dca137f678088898029b0298a287e050664f441c103a857dfd50ea0a

Download Submit
C:\Windows\system\VAGorGo.exe

Filesize
2.3MB

MD5
cfaa65593f39b504127c33e421e19413

SHA1
816f07e1076916b110f39e90fbdc5345a597beab

SHA256
00342ff40705776634575c09497ddea607cbd2a02b4cdb295b852dbbdcfe38d7

SHA512
4888016409648f867c5c59e6c77c8850511565a2418fa5d09fee17f491a031cfe2b97d5966585d60770116de7be948b6041b6e19796d7a46ea1dbb5e93f4798d

Download Submit
C:\Windows\system\YpGBHEz.exe

Filesize
2.3MB

MD5
ae363fa5e3700ececde05b52c2f2e78a

SHA1
33ca592d0f7c196c6c1d36598f27a7a7f3ba9203

SHA256
1a58e8d4a6d40cd0ba4ea61baa6466277a7b316943d4995c21c4159a974ed010

SHA512
60735aa757e1c44f81404bdc875386c0b68741ea0cdfe4373420bd20e85ebb18ab43f2e8fd3db8766f04ec9e2b702e372167ba21d7bfd1b157c3535960d25d0c

Download Submit
C:\Windows\system\ZEAidgj.exe

Filesize
2.3MB

MD5
d4ef22c762c393fe4c770b8659842c51

SHA1
848cd803dff7e189f6747b240b5dabb378cc6b59

SHA256
0be69bd5ec7c3eac0878cb11b51fe222fe94a6b2f2f8faca0023e7ca5b05cb91

SHA512
12972b83379d1358a74933d247887a8069c31a4a1239853b086a9e84b7bd246ae26b43e807233db3feb98e0e294b51281d4af7ee0cdf4dc4c926777da6347bbd

Download Submit
C:\Windows\system\ZhFVoQq.exe

Filesize
8B

MD5
92dce7fd7ec69f225baee909f1f20d27

SHA1
0fe748b20df273698767537e59de10e23a351a61

SHA256
3a8d52b801fd1c8bd120153342611f7386eb5ce0ad255d57304ec96ec9b31a84

SHA512
1e58e425b780ebf633a365e2d3edf8bb342f5bfe09e8d802b0d4dd60a53770b35758c32e598b9a4f78c23d6a0841ec0499f88be809f17838167d0c02b8f0c743

Download Submit
C:\Windows\system\aBzwvUo.exe

Filesize
2.3MB

MD5
efda06890b7b8d6a0936e544dc7c3631

SHA1
884c8f827364584a59a80c7a1b869b3a08d451ae

SHA256
eb87984ce243b2e533f76320b04acf04695d236da2c36d0eb42e46fbba914839

SHA512
8978923795e331c1cba1063ba1eb0881fae115f0fb3fb8a46e602fe1bc4c6f0d2c2487593658e45a43a4bc4f3a23aeeed3bed35fd7bd1c5695960a89b6e5188f

Download Submit
C:\Windows\system\bzseqmp.exe

Filesize
2.3MB

MD5
1fe27145cff460a28b64a000b511b841

SHA1
5acdd4822633ecc91b44ec2ed8ef3bc4e6956cb8

SHA256
6f1ff6435897e3868b501fd2b2113d9ef964b6fb5217e6767c74adebbf61e927

SHA512
be545427c99fe8183fa76f452c96fb29725f397f56364c47c90268a50394de0fcc2540bcc888f6ef63a17b67a49300189624a52e68c62dacd565c7a24fc38638

Download Submit
C:\Windows\system\fNModDQ.exe

Filesize
2.3MB

MD5
280eb2c2c953c9717f2a942864559cd7

SHA1
e6d9d87e79a34478daf1d01cf44164111fb402f4

SHA256
0c21bfab86f6e11ed405c915b8df44d6097a31fc44ff23dd7378db3492b6c5d1

SHA512
87499e11e1bae42d4459fe0f3e01b54c80bf809a5380f8b9c2faacf2bb961c336d4979b021c610c4b2d461ee63fec7cb580faf4fa563e5395c3fadb63219102b

Download Submit
C:\Windows\system\fmGyipI.exe

Filesize
2.3MB

MD5
d4c111c87077ff6fdf82958aae69c376

SHA1
873e01437597fe1c0c4b6104bc3efee9423d1e58

SHA256
53759d3526c0215938bbd029804d7d5645932174ea521488525fbe3ed45ae5f3

SHA512
698d8c93e1325ce56bece7e3cb6b88f7a4067b1c2ff3fcb617dd26f0f088c15426f512b5f7f149d96be9a027b33c50f92ecf9d970a6b30de9a139f30de5fc3bf

Download Submit
C:\Windows\system\iHTaGAT.exe

Filesize
2.3MB

MD5
051d9e0ddbdf254aacc4203d6fc3af2b

SHA1
fd27938b969b9bc7aee40a49e69c384106a965b5

SHA256
3c51dffa40451b5c589f3d9c3bb6cbd40f1cc9deb55e693ce08ace1d639a9f3f

SHA512
d9428d2007a41a1961f6c023c1c442431123d95e3ea51b6d7bc7926088768196f1ef0cc4d514fc1a26fe9ae0883d878911715ad740a4c8984264b24135e6b452

Download Submit
C:\Windows\system\jnBQEXP.exe

Filesize
2.3MB

MD5
bc2f450becd46c45132081e8176ee2eb

SHA1
94cd368e42ea105c8b2e672e243c2653e3c9a5fc

SHA256
07186e333bc7757602dba6c3623214c2e846f6e34954819c4e6392ddc4edf6cc

SHA512
2f15ea2ce8259a3a9f146b0b5c2a1baecb04005fe4d9bc1cf44709aeacae8d225f869cbabe525183f3de3d4f3b5592b0237f5b5c9da1f0adf836442fb7e7fe69

Download Submit
C:\Windows\system\kLXaUjZ.exe

Filesize
2.3MB

MD5
18e224fcf72687c00c071f2f374c02cc

SHA1
d8a3e6b359996747f2c344d61c2abda971981dd4

SHA256
8336de8e6ba58d3d8d8e6fab281a13d4a961163381ee8bc059860fbbee5f2d57

SHA512
a43ae8e4c7e252934dfaa343cdabe839f9d8bba6ddc0cc7fc2d4bc502a1f644bea9e231a24348d425dad0dcea525b965f1d7009ac9a82e15699553568544a748

Download Submit
C:\Windows\system\mNnhZoN.exe

Filesize
2.3MB

MD5
381cda04554f832bb9bf00990b493026

SHA1
c0f92533d177ffaa1ac78b327c20621e3254309c

SHA256
c00e7eef57a0e380c0822c707de524c0fb59c09c82e7539760fc85724efde35e

SHA512
2d118976eb1ac62e90e02236f7947ec398daf3b90f1b3f20fe359fd74ec45d655aa8c46265bb613cc8ae2dbc9c6142ec31543cbdbeda33c16f5866d6e861437f

Download Submit
C:\Windows\system\nVbheWi.exe

Filesize
2.3MB

MD5
d16043e6159f21a66d50baacbbf942de

SHA1
a66c99e26848e86dd7e15bd73617e8f3246c056d

SHA256
d1d0d804ad5add00e0e8d5c2ebe378734297ee9dbe2e17ccae569a98f699e454

SHA512
ecfcaf0e5221eec83e485f7b7146ca3b524f45c7506cfdcff04e81c54bfbca2341e3c44adb72dd1bae990bc03e2ce56ab6f9e6aec7883e77dbc4c237ce91d73b

Download Submit
C:\Windows\system\rcpOBHR.exe

Filesize
2.3MB

MD5
1be71052ae76be04f2d8d3c03b488913

SHA1
82ade8b6b6ab16d12dc0a527fe6b8c9e60c407b0

SHA256
1e84212005d46e29d6efb9efa2ecd9b5bd5b2d55a09c1a02a8b22b77eeb48092

SHA512
5b76114d8b8349459e2cb75d19b83d4cf1f49c0489e2d0f3529652e3583ef0727255d91ccbd51777e6102142fcdaace2902b0999a30ccd4ef3ea4d298e00c395

Download Submit
C:\Windows\system\vdprvYi.exe

Filesize
2.3MB

MD5
08ded8903acd92e6db0127a2245c84e2

SHA1
a948d613f78e8f19dc02e9e5c608bce6226d4888

SHA256
f4bf7d19fe5569fa3dce6ea8579c4c135837e196c17021369c8411b211a6f22e

SHA512
c27d34e281760fa9e76bf4e357e506e0b6e60f8cdd5704b9a6066f238f5f9efad0679598b4c9ca9aa29f89ddb35145156cd7813fc09aa3a5748f3eff8c245cfc

Download Submit
C:\Windows\system\xEFXZvW.exe

Filesize
2.3MB

MD5
8fad78cce553045aef74446ca15149e7

SHA1
54ea88ac4345c98233ad164f1288f99d7d1b8217

SHA256
a6b79186b5a13b7e9ba62eee636a321f9be62a0bc47e614c404b8e178605ff4e

SHA512
33c33c44522cdfe6bbe17a0a3e4562c5e444e7d23d26204f1af6c30707dbbff718a5771568f96a51cd5a4705a25833ed893088f62b9fdc84ba06b832357c5201

Download Submit
\Windows\system\DqIUGSM.exe

Filesize
2.3MB

MD5
5d43a3947b97bdc6972935312a6d8f2c

SHA1
b75092e494a3c2a796fcd8ccdf6e0497b85e8114

SHA256
680525c4f2676e4066999ad23f9b3ad94ba0f298552f61c05ced406b95d5a22a

SHA512
9518adb3559fc3261bb7e6a9611caf1c8c18b6566f1ebaadb33592eff5db90ce12d737e051e08aad00bc31f5f2d8b0e79a4ae6ff3b62b4b9da2547b5fa0e1ff5

Download Submit
\Windows\system\EOqakyC.exe

Filesize
2.3MB

MD5
8d16bd0335dbef9f0700ab3a262f8414

SHA1
b1bb8d12708db6d83b95e6b4f87a2d92dbe3dc9c

SHA256
a41bebe5d83e11f917cd95d87c02986ac65fba7e6a5915d75ff2c1a129eb1b3b

SHA512
741da71cb5318dc1e1efda54bc77dd76d29f2b43999bbf34d3cdec1e080c94f636f408cc01a9204a84abb56d0fc3ade4083554d45a72411ec1168fdddb5fc77d

Download Submit
\Windows\system\NfphSyL.exe

Filesize
2.3MB

MD5
c4aaca1759468325d25b18afe514e2e4

SHA1
eee9fb66a184cae0779ca5b291cea33d48dd1e06

SHA256
01dcdc314e0c4140ddeaa7e960115d6f7127d59d075f4400466a2916785a72e7

SHA512
a2e6d594df55783e566cb12a2a41d0260d411b550cf872678f4e83c8c1240961868ef4d56fc5c5d8bb0cd0e24b777f9b1ec670c18faeec2ceb63b3fe6041fb94

Download Submit
\Windows\system\kqWPFhW.exe

Filesize
2.3MB

MD5
6c1bab42ee0c99030e03307bcec7d023

SHA1
c3d247b194d0f5134fa2d9721ff9a96469dcbe23

SHA256
a33746039454d8059d085c7e7465f35a9cb7aea9adc1ef9dc0f7f734939d1208

SHA512
22a5246fe22dcae4e8061e0e6e5f432178e424050dfbf82b5bf78b0cba7c4d59f09d94a43a797956825e44399fedc1057b073668a566615ab8883b2194b143d5

Download Submit
\Windows\system\uRoynVl.exe

Filesize
2.3MB

MD5
3c563cb2f07176b90fe0df7e5a7153e9

SHA1
3fa79733d48c607bc3b3ecf1d1aa3fb6124b71f6

SHA256
ff46950404d112ac6a70e9157535c04979d0f2177922b9e07e23caa700120f65

SHA512
5ec7f71f0da0c9ce6cd5375f11b99afb9dc89d2d287ffb9239df2344f68fd8505c5d9e4a05fe40716547af0ee2beef406db2fe5cfaa277524a26dd8f5fb145c3

Download Submit
\Windows\system\voLvNhd.exe

Filesize
2.3MB

MD5
c1dd5592857395d2b81fc2e0077a9169

SHA1
fc7619445a6c6eac2898febe9b977c94372ecea3

SHA256
36da744c6de2ca2cf4fbd0388707c5ed99794dbb665f0c97ebd41e86e5376cff

SHA512
9214351ada74ca6528ea398267ea66185b95432e5e358bd4813c0a300a695a59179899fa910a15f7939a2255365b84017936844374e0e951b60205d10fc8e6a2

Download Submit
\Windows\system\xuSyQJP.exe

Filesize
2.3MB

MD5
05c7ceb7fdaea9407cbb9aae1c26ee5f

SHA1
e8ad35fa07ed90b1d8ace10b2e02cb18702c0fe3

SHA256
3e905cc545ae9d1fc3b412aea1e9999fcea27893e6210814ec9e88cf8dedeb60

SHA512
e6b5d6118e5532a7036863a03e987479d2e56e6a0209514520c41df0eddc82b62d7dc1b089a32d2d62f9486e617c7d8f215009b45e3e3fb3ba96e9885d71bcd9

Download Submit
memory/1284-17-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/1884-34-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/1884-3708-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-54-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2064-3714-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2128-173-0x0000000002920000-0x0000000002928000-memory.dmp

Filesize
32KB

Download
memory/2128-167-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2156-82-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-11-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-1-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2156-3876-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2156-27-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2156-67-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2156-41-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2156-40-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2156-39-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2156-22-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-58-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-84-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/2172-42-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-3701-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2284-46-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2384-3713-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/2384-65-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/2404-3712-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2404-83-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2504-3705-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2504-43-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2656-3711-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-59-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-37-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2672-3702-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2676-3715-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2676-48-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download