xmrig | a5aeb62dd2b93d44649c3ad327ad9adb418f9a44980bc84d766898c606f9db9d

Analysis

max time kernel
28s
max time network
28s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04ed85966c54220644921589ddba4156_JaffaCakes118.exe
Size

1.9MB
MD5

04ed85966c54220644921589ddba4156
SHA1

d41c830cc068cc668c19e546e0052cd9ecc5a980
SHA256

a5aeb62dd2b93d44649c3ad327ad9adb418f9a44980bc84d766898c606f9db9d
SHA512

56240728e219933abe949fc9af06a74432f54df8b22960306623189bab60d948fc1e091c4fe95ca2be159fba1a2f12371aaaea7ed15878dd785ad2c86a89da1e
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1FUQ:NABa

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2852-19-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/2336-17-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2484-179-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/2380-212-0x00000000031A0000-0x0000000003592000-memory.dmp	xmrig
behavioral1/memory/2732-211-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2488-210-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2380-204-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2576-159-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/2704-112-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2336	WvmNiyO.exe
2852	HlUPmEY.exe
2704	iIgWCXe.exe
2576	KQvDeTa.exe
2484	BHeEUVK.exe
2488	iBXFSIO.exe
2732	HnkydMk.exe
2516	aVyDufh.exe
2476	XxPwRFI.exe
1296	PrqNcVK.exe
2176	qFACTCS.exe
2500	ntbXIjx.exe
320	KLBbNho.exe
940	tSvDVgW.exe
2680	WRuVpVK.exe
2796	bAencSX.exe
1580	XBnjbsZ.exe
2624	QlXvdqH.exe
2464	YZoNlYX.exe
2836	VSQKKqv.exe
2136	COBCETt.exe
2672	gusQYVC.exe
2232	uwnnBoH.exe
324	zaknwXx.exe
292	xJFARli.exe
592	nSRthey.exe
932	QuKWCYZ.exe
1312	cffQYph.exe
3068	hpBGNpf.exe
1796	oIqWnUV.exe
1620	yzyIDbP.exe
1848	xOSmkRi.exe
2884	RDpkcXh.exe
2340	aClltrX.exe
1748	XXYkesG.exe
2768	msIOgcd.exe
2828	CnaeJGP.exe
2180	vhBHCRR.exe
2940	xlkNpRn.exe
2104	sYzAdqu.exe
268	PJyJNOm.exe
2640	XxzQHNV.exe
1028	OnokzHq.exe
1460	brhZkHH.exe
1532	suUqOyN.exe
2736	xDMWVLt.exe
876	ChGBkfj.exe
1132	AnAcwAj.exe
1180	lhIjZlg.exe
1116	ZMXCKAf.exe
2888	BCvWTGc.exe
2536	ieeMITf.exe
2240	zdGtCZz.exe
936	nsmQhjI.exe
1688	jSzckcL.exe
1672	XePNIdR.exe
1208	IIwRODW.exe
2540	ZmmExYL.exe
2052	FkbcWNm.exe
1248	mFxLINc.exe
2432	AKtvaWa.exe
1732	atrbxmS.exe
2264	xuMDTQN.exe
1164	gEPLeHB.exe

Loads dropped DLL 64 IoCs

pid	Process
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2380-2-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/files/0x000c0000000141c0-5.dat	upx
behavioral1/files/0x00090000000143ec-7.dat	upx
behavioral1/files/0x0008000000014539-22.dat	upx
behavioral1/memory/2852-19-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/2336-17-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/files/0x0006000000015018-73.dat	upx
behavioral1/files/0x0006000000014b70-121.dat	upx
behavioral1/files/0x0007000000014abe-149.dat	upx
behavioral1/memory/2484-179-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/files/0x0006000000015d1a-176.dat	upx
behavioral1/files/0x0006000000015d07-148.dat	upx
behavioral1/files/0x0006000000015cf6-141.dat	upx
behavioral1/files/0x0006000000015cce-135.dat	upx
behavioral1/files/0x0006000000015c78-129.dat	upx
behavioral1/files/0x0006000000015c52-128.dat	upx
behavioral1/files/0x0006000000015b6f-126.dat	upx
behavioral1/files/0x0006000000015616-125.dat	upx
behavioral1/files/0x00060000000155f7-124.dat	upx
behavioral1/files/0x00060000000155ed-123.dat	upx
behavioral1/files/0x0006000000014ef8-122.dat	upx
behavioral1/files/0x0006000000015c3d-103.dat	upx
behavioral1/files/0x0006000000015626-92.dat	upx
behavioral1/files/0x0006000000015d27-180.dat	upx
behavioral1/memory/2732-211-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2488-210-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/files/0x0006000000015c9f-172.dat	upx
behavioral1/files/0x0006000000014de9-162.dat	upx
behavioral1/memory/2576-159-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/files/0x0006000000014b31-156.dat	upx
behavioral1/files/0x0006000000015d0f-152.dat	upx
behavioral1/files/0x0006000000015cfe-144.dat	upx
behavioral1/files/0x0006000000015cee-138.dat	upx
behavioral1/files/0x0009000000014825-132.dat	upx
behavioral1/files/0x0006000000015cb6-131.dat	upx
behavioral1/files/0x0006000000015c83-117.dat	upx
behavioral1/memory/2704-112-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/files/0x0006000000015c6b-109.dat	upx
behavioral1/files/0x0006000000015605-86.dat	upx
behavioral1/files/0x00060000000155f3-80.dat	upx
behavioral1/files/0x00090000000146b8-79.dat	upx
behavioral1/files/0x0007000000014af6-64.dat	upx
behavioral1/files/0x00070000000149f5-61.dat	upx
behavioral1/files/0x00090000000146c0-60.dat	upx
behavioral1/files/0x00080000000146a2-36.dat	upx
behavioral1/files/0x000f000000005578-29.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FFpGgLj.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\SAOHqrg.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\fLbnvJH.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\ibjqaER.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\jIshQFh.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\brhZkHH.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\AnAcwAj.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\dMAiAJT.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\UgyXLEl.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\xVwIDMV.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\QulwAjZ.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\wNRtypM.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\mZrhajT.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\hhgERJK.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\tSMUjWw.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\JZnxcCT.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\eFZSbpB.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\PeEiTXS.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\QshsusN.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\vtkFXrM.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\NRJkxLq.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\ZRwiwgC.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\NSwIOLl.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\ErmGBpB.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\VRwNdSf.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\tSvDVgW.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\BXOkxTB.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\TfRKqWz.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\XIXmQvq.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\CjVWFoH.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\kZALVdf.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\HvLfYlP.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\aBZCggF.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\aukLxNx.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\xmtRSbu.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\KQvDeTa.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\KLBbNho.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\xlkNpRn.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\oxlgQbk.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\afuisqz.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\xcBBWWb.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\XgtJrnY.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\ZvcwqEF.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\JwEQmIM.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\wTSuQOq.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\PAFtUaJ.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\hOfIrlY.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\qhjzOcN.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\dQlhuyI.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\hxKwsrf.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\nQVrNPb.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\kkHKtgB.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\frYyxwG.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\UIxWooi.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\eginSmx.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\VzILlmd.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\lUSTTiQ.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\xuyoGCU.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\KxQJoSD.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\FYZXXwU.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\KfbyGvB.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\hGbEKdw.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\EtScsqx.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
File created	C:\Windows\System\ZGftvqz.exe	04ed85966c54220644921589ddba4156_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2372	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe
Token: SeDebugPrivilege	2372	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2372	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2372	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2372	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2336	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2336	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2336	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2852	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	31
PID 2380 wrote to memory of 2852	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	31
PID 2380 wrote to memory of 2852	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	31
PID 2380 wrote to memory of 2704	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	32
PID 2380 wrote to memory of 2704	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	32
PID 2380 wrote to memory of 2704	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	32
PID 2380 wrote to memory of 2576	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	33
PID 2380 wrote to memory of 2576	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	33
PID 2380 wrote to memory of 2576	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	33
PID 2380 wrote to memory of 2484	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	34
PID 2380 wrote to memory of 2484	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	34
PID 2380 wrote to memory of 2484	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	34
PID 2380 wrote to memory of 2476	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	35
PID 2380 wrote to memory of 2476	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	35
PID 2380 wrote to memory of 2476	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	35
PID 2380 wrote to memory of 2488	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	36
PID 2380 wrote to memory of 2488	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	36
PID 2380 wrote to memory of 2488	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	36
PID 2380 wrote to memory of 2624	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	37
PID 2380 wrote to memory of 2624	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	37
PID 2380 wrote to memory of 2624	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	37
PID 2380 wrote to memory of 2732	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	38
PID 2380 wrote to memory of 2732	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	38
PID 2380 wrote to memory of 2732	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	38
PID 2380 wrote to memory of 2464	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	39
PID 2380 wrote to memory of 2464	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	39
PID 2380 wrote to memory of 2464	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	39
PID 2380 wrote to memory of 2516	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	40
PID 2380 wrote to memory of 2516	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	40
PID 2380 wrote to memory of 2516	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	40
PID 2380 wrote to memory of 2836	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	41
PID 2380 wrote to memory of 2836	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	41
PID 2380 wrote to memory of 2836	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	41
PID 2380 wrote to memory of 1296	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	42
PID 2380 wrote to memory of 1296	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	42
PID 2380 wrote to memory of 1296	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	42
PID 2380 wrote to memory of 2136	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	43
PID 2380 wrote to memory of 2136	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	43
PID 2380 wrote to memory of 2136	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	43
PID 2380 wrote to memory of 2176	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	44
PID 2380 wrote to memory of 2176	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	44
PID 2380 wrote to memory of 2176	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	44
PID 2380 wrote to memory of 2672	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	45
PID 2380 wrote to memory of 2672	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	45
PID 2380 wrote to memory of 2672	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	45
PID 2380 wrote to memory of 2500	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	46
PID 2380 wrote to memory of 2500	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	46
PID 2380 wrote to memory of 2500	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	46
PID 2380 wrote to memory of 932	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	47
PID 2380 wrote to memory of 932	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	47
PID 2380 wrote to memory of 932	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	47
PID 2380 wrote to memory of 320	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	48
PID 2380 wrote to memory of 320	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	48
PID 2380 wrote to memory of 320	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	48
PID 2380 wrote to memory of 1312	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	49
PID 2380 wrote to memory of 1312	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	49
PID 2380 wrote to memory of 1312	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	49
PID 2380 wrote to memory of 940	2380	04ed85966c54220644921589ddba4156_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\04ed85966c54220644921589ddba4156_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04ed85966c54220644921589ddba4156_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\System\WvmNiyO.exe
  C:\Windows\System\WvmNiyO.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\HlUPmEY.exe
  C:\Windows\System\HlUPmEY.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\iIgWCXe.exe
  C:\Windows\System\iIgWCXe.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\KQvDeTa.exe
  C:\Windows\System\KQvDeTa.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\BHeEUVK.exe
  C:\Windows\System\BHeEUVK.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\XxPwRFI.exe
  C:\Windows\System\XxPwRFI.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\iBXFSIO.exe
  C:\Windows\System\iBXFSIO.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\QlXvdqH.exe
  C:\Windows\System\QlXvdqH.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\HnkydMk.exe
  C:\Windows\System\HnkydMk.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\YZoNlYX.exe
  C:\Windows\System\YZoNlYX.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\aVyDufh.exe
  C:\Windows\System\aVyDufh.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\VSQKKqv.exe
  C:\Windows\System\VSQKKqv.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\PrqNcVK.exe
  C:\Windows\System\PrqNcVK.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\COBCETt.exe
  C:\Windows\System\COBCETt.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\qFACTCS.exe
  C:\Windows\System\qFACTCS.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\gusQYVC.exe
  C:\Windows\System\gusQYVC.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\ntbXIjx.exe
  C:\Windows\System\ntbXIjx.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\QuKWCYZ.exe
  C:\Windows\System\QuKWCYZ.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\KLBbNho.exe
  C:\Windows\System\KLBbNho.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\cffQYph.exe
  C:\Windows\System\cffQYph.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\tSvDVgW.exe
  C:\Windows\System\tSvDVgW.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\aClltrX.exe
  C:\Windows\System\aClltrX.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\WRuVpVK.exe
  C:\Windows\System\WRuVpVK.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\msIOgcd.exe
  C:\Windows\System\msIOgcd.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\bAencSX.exe
  C:\Windows\System\bAencSX.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\CnaeJGP.exe
  C:\Windows\System\CnaeJGP.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\XBnjbsZ.exe
  C:\Windows\System\XBnjbsZ.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\xlkNpRn.exe
  C:\Windows\System\xlkNpRn.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\uwnnBoH.exe
  C:\Windows\System\uwnnBoH.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\sYzAdqu.exe
  C:\Windows\System\sYzAdqu.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\zaknwXx.exe
  C:\Windows\System\zaknwXx.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\PJyJNOm.exe
  C:\Windows\System\PJyJNOm.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\xJFARli.exe
  C:\Windows\System\xJFARli.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\OnokzHq.exe
  C:\Windows\System\OnokzHq.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\nSRthey.exe
  C:\Windows\System\nSRthey.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\brhZkHH.exe
  C:\Windows\System\brhZkHH.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\hpBGNpf.exe
  C:\Windows\System\hpBGNpf.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\suUqOyN.exe
  C:\Windows\System\suUqOyN.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\oIqWnUV.exe
  C:\Windows\System\oIqWnUV.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\ChGBkfj.exe
  C:\Windows\System\ChGBkfj.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\yzyIDbP.exe
  C:\Windows\System\yzyIDbP.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\AnAcwAj.exe
  C:\Windows\System\AnAcwAj.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\xOSmkRi.exe
  C:\Windows\System\xOSmkRi.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\lhIjZlg.exe
  C:\Windows\System\lhIjZlg.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\RDpkcXh.exe
  C:\Windows\System\RDpkcXh.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\ZMXCKAf.exe
  C:\Windows\System\ZMXCKAf.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\XXYkesG.exe
  C:\Windows\System\XXYkesG.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\BCvWTGc.exe
  C:\Windows\System\BCvWTGc.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\vhBHCRR.exe
  C:\Windows\System\vhBHCRR.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\ieeMITf.exe
  C:\Windows\System\ieeMITf.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\XxzQHNV.exe
  C:\Windows\System\XxzQHNV.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\zdGtCZz.exe
  C:\Windows\System\zdGtCZz.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\xDMWVLt.exe
  C:\Windows\System\xDMWVLt.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\nsmQhjI.exe
  C:\Windows\System\nsmQhjI.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\jSzckcL.exe
  C:\Windows\System\jSzckcL.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\XePNIdR.exe
  C:\Windows\System\XePNIdR.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\IIwRODW.exe
  C:\Windows\System\IIwRODW.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\ZmmExYL.exe
  C:\Windows\System\ZmmExYL.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\FkbcWNm.exe
  C:\Windows\System\FkbcWNm.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\mFxLINc.exe
  C:\Windows\System\mFxLINc.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\AKtvaWa.exe
  C:\Windows\System\AKtvaWa.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\atrbxmS.exe
  C:\Windows\System\atrbxmS.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\xuMDTQN.exe
  C:\Windows\System\xuMDTQN.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\gEPLeHB.exe
  C:\Windows\System\gEPLeHB.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\izwMWru.exe
  C:\Windows\System\izwMWru.exe
  2⤵
  PID:2512
- C:\Windows\System\RLNHcwR.exe
  C:\Windows\System\RLNHcwR.exe
  2⤵
  PID:2664
- C:\Windows\System\HvLfYlP.exe
  C:\Windows\System\HvLfYlP.exe
  2⤵
  PID:2604
- C:\Windows\System\mGXkNei.exe
  C:\Windows\System\mGXkNei.exe
  2⤵
  PID:1220
- C:\Windows\System\XJoOZZV.exe
  C:\Windows\System\XJoOZZV.exe
  2⤵
  PID:1604
- C:\Windows\System\AnOYCtb.exe
  C:\Windows\System\AnOYCtb.exe
  2⤵
  PID:1512
- C:\Windows\System\UCcWzqM.exe
  C:\Windows\System\UCcWzqM.exe
  2⤵
  PID:1956
- C:\Windows\System\FJkEMHy.exe
  C:\Windows\System\FJkEMHy.exe
  2⤵
  PID:880
- C:\Windows\System\pIRniiL.exe
  C:\Windows\System\pIRniiL.exe
  2⤵
  PID:1916
- C:\Windows\System\vIFjXLg.exe
  C:\Windows\System\vIFjXLg.exe
  2⤵
  PID:1504
- C:\Windows\System\FFpGgLj.exe
  C:\Windows\System\FFpGgLj.exe
  2⤵
  PID:1488
- C:\Windows\System\WkAwbmU.exe
  C:\Windows\System\WkAwbmU.exe
  2⤵
  PID:272
- C:\Windows\System\ihIbAWJ.exe
  C:\Windows\System\ihIbAWJ.exe
  2⤵
  PID:2140
- C:\Windows\System\cQicZMz.exe
  C:\Windows\System\cQicZMz.exe
  2⤵
  PID:2444
- C:\Windows\System\UTSgGPx.exe
  C:\Windows\System\UTSgGPx.exe
  2⤵
  PID:2908
- C:\Windows\System\ehQIOes.exe
  C:\Windows\System\ehQIOes.exe
  2⤵
  PID:2556
- C:\Windows\System\TPOGIXu.exe
  C:\Windows\System\TPOGIXu.exe
  2⤵
  PID:2976
- C:\Windows\System\Gvoqtqk.exe
  C:\Windows\System\Gvoqtqk.exe
  2⤵
  PID:2256
- C:\Windows\System\VXLmCLJ.exe
  C:\Windows\System\VXLmCLJ.exe
  2⤵
  PID:2956
- C:\Windows\System\TgaAxKs.exe
  C:\Windows\System\TgaAxKs.exe
  2⤵
  PID:2696
- C:\Windows\System\ySSUdNe.exe
  C:\Windows\System\ySSUdNe.exe
  2⤵
  PID:1020
- C:\Windows\System\GxYGuHA.exe
  C:\Windows\System\GxYGuHA.exe
  2⤵
  PID:2064
- C:\Windows\System\gkFBHPa.exe
  C:\Windows\System\gkFBHPa.exe
  2⤵
  PID:776
- C:\Windows\System\LHLHAzu.exe
  C:\Windows\System\LHLHAzu.exe
  2⤵
  PID:1084
- C:\Windows\System\KPJeixc.exe
  C:\Windows\System\KPJeixc.exe
  2⤵
  PID:2560
- C:\Windows\System\WGpMoTf.exe
  C:\Windows\System\WGpMoTf.exe
  2⤵
  PID:1128
- C:\Windows\System\fShaLAJ.exe
  C:\Windows\System\fShaLAJ.exe
  2⤵
  PID:2804
- C:\Windows\System\aRuubmm.exe
  C:\Windows\System\aRuubmm.exe
  2⤵
  PID:1148
- C:\Windows\System\mBKhxHj.exe
  C:\Windows\System\mBKhxHj.exe
  2⤵
  PID:2400
- C:\Windows\System\yUhgfMy.exe
  C:\Windows\System\yUhgfMy.exe
  2⤵
  PID:2832
- C:\Windows\System\hmDKEjF.exe
  C:\Windows\System\hmDKEjF.exe
  2⤵
  PID:2520
- C:\Windows\System\srbsqwA.exe
  C:\Windows\System\srbsqwA.exe
  2⤵
  PID:1308
- C:\Windows\System\KZLrDne.exe
  C:\Windows\System\KZLrDne.exe
  2⤵
  PID:2344
- C:\Windows\System\TBOphKN.exe
  C:\Windows\System\TBOphKN.exe
  2⤵
  PID:828
- C:\Windows\System\auwILGA.exe
  C:\Windows\System\auwILGA.exe
  2⤵
  PID:2588
- C:\Windows\System\dBsbdEk.exe
  C:\Windows\System\dBsbdEk.exe
  2⤵
  PID:2992
- C:\Windows\System\DWSzbRW.exe
  C:\Windows\System\DWSzbRW.exe
  2⤵
  PID:2616
- C:\Windows\System\mpLCtfi.exe
  C:\Windows\System\mpLCtfi.exe
  2⤵
  PID:960
- C:\Windows\System\RLVmcNu.exe
  C:\Windows\System\RLVmcNu.exe
  2⤵
  PID:3000
- C:\Windows\System\VWQPvaH.exe
  C:\Windows\System\VWQPvaH.exe
  2⤵
  PID:684
- C:\Windows\System\ENpbEdp.exe
  C:\Windows\System\ENpbEdp.exe
  2⤵
  PID:2752
- C:\Windows\System\HxbRXzU.exe
  C:\Windows\System\HxbRXzU.exe
  2⤵
  PID:2436
- C:\Windows\System\QNMsoOn.exe
  C:\Windows\System\QNMsoOn.exe
  2⤵
  PID:2532
- C:\Windows\System\lZKNbIE.exe
  C:\Windows\System\lZKNbIE.exe
  2⤵
  PID:3084
- C:\Windows\System\jFgMrDO.exe
  C:\Windows\System\jFgMrDO.exe
  2⤵
  PID:3100
- C:\Windows\System\eMVyIgk.exe
  C:\Windows\System\eMVyIgk.exe
  2⤵
  PID:3116
- C:\Windows\System\GqCfcye.exe
  C:\Windows\System\GqCfcye.exe
  2⤵
  PID:3136
- C:\Windows\System\jImtOnC.exe
  C:\Windows\System\jImtOnC.exe
  2⤵
  PID:3160
- C:\Windows\System\omMnkmH.exe
  C:\Windows\System\omMnkmH.exe
  2⤵
  PID:3176
- C:\Windows\System\XgtJrnY.exe
  C:\Windows\System\XgtJrnY.exe
  2⤵
  PID:3192
- C:\Windows\System\AeBlvVP.exe
  C:\Windows\System\AeBlvVP.exe
  2⤵
  PID:3300
- C:\Windows\System\vuoeFfr.exe
  C:\Windows\System\vuoeFfr.exe
  2⤵
  PID:3320
- C:\Windows\System\XydCOQB.exe
  C:\Windows\System\XydCOQB.exe
  2⤵
  PID:3340
- C:\Windows\System\pUNGIgG.exe
  C:\Windows\System\pUNGIgG.exe
  2⤵
  PID:3360
- C:\Windows\System\FrcHyRX.exe
  C:\Windows\System\FrcHyRX.exe
  2⤵
  PID:3380
- C:\Windows\System\LbaPIef.exe
  C:\Windows\System\LbaPIef.exe
  2⤵
  PID:3400
- C:\Windows\System\ewRPgRC.exe
  C:\Windows\System\ewRPgRC.exe
  2⤵
  PID:3420
- C:\Windows\System\BFYeeWW.exe
  C:\Windows\System\BFYeeWW.exe
  2⤵
  PID:3440
- C:\Windows\System\VnwbYdK.exe
  C:\Windows\System\VnwbYdK.exe
  2⤵
  PID:3456
- C:\Windows\System\TflHThS.exe
  C:\Windows\System\TflHThS.exe
  2⤵
  PID:3480
- C:\Windows\System\SAOHqrg.exe
  C:\Windows\System\SAOHqrg.exe
  2⤵
  PID:3500
- C:\Windows\System\syjZPnW.exe
  C:\Windows\System\syjZPnW.exe
  2⤵
  PID:3520
- C:\Windows\System\IKyfBdi.exe
  C:\Windows\System\IKyfBdi.exe
  2⤵
  PID:3540
- C:\Windows\System\BACqZBI.exe
  C:\Windows\System\BACqZBI.exe
  2⤵
  PID:3560
- C:\Windows\System\ZnqffWb.exe
  C:\Windows\System\ZnqffWb.exe
  2⤵
  PID:3580
- C:\Windows\System\QGwulgq.exe
  C:\Windows\System\QGwulgq.exe
  2⤵
  PID:3596
- C:\Windows\System\kwLApju.exe
  C:\Windows\System\kwLApju.exe
  2⤵
  PID:3616
- C:\Windows\System\iYaqMnX.exe
  C:\Windows\System\iYaqMnX.exe
  2⤵
  PID:3640
- C:\Windows\System\moLbfpH.exe
  C:\Windows\System\moLbfpH.exe
  2⤵
  PID:3656
- C:\Windows\System\jegBUMp.exe
  C:\Windows\System\jegBUMp.exe
  2⤵
  PID:3680
- C:\Windows\System\EqZVgln.exe
  C:\Windows\System\EqZVgln.exe
  2⤵
  PID:3700
- C:\Windows\System\vnKEbEQ.exe
  C:\Windows\System\vnKEbEQ.exe
  2⤵
  PID:3720
- C:\Windows\System\jYahbfQ.exe
  C:\Windows\System\jYahbfQ.exe
  2⤵
  PID:3736
- C:\Windows\System\DVXvnid.exe
  C:\Windows\System\DVXvnid.exe
  2⤵
  PID:3756
- C:\Windows\System\tzGgyss.exe
  C:\Windows\System\tzGgyss.exe
  2⤵
  PID:3776
- C:\Windows\System\FVsMFgj.exe
  C:\Windows\System\FVsMFgj.exe
  2⤵
  PID:3808
- C:\Windows\System\jIwoGIk.exe
  C:\Windows\System\jIwoGIk.exe
  2⤵
  PID:3828
- C:\Windows\System\pRqOaTj.exe
  C:\Windows\System\pRqOaTj.exe
  2⤵
  PID:3844
- C:\Windows\System\RGIoHOG.exe
  C:\Windows\System\RGIoHOG.exe
  2⤵
  PID:3864
- C:\Windows\System\oydernF.exe
  C:\Windows\System\oydernF.exe
  2⤵
  PID:3888
- C:\Windows\System\NIQvRSN.exe
  C:\Windows\System\NIQvRSN.exe
  2⤵
  PID:3904
- C:\Windows\System\BelcnQT.exe
  C:\Windows\System\BelcnQT.exe
  2⤵
  PID:3924
- C:\Windows\System\ImWwypI.exe
  C:\Windows\System\ImWwypI.exe
  2⤵
  PID:3940
- C:\Windows\System\HOEKuNh.exe
  C:\Windows\System\HOEKuNh.exe
  2⤵
  PID:3956
- C:\Windows\System\EtScsqx.exe
  C:\Windows\System\EtScsqx.exe
  2⤵
  PID:3972
- C:\Windows\System\wRnBAdu.exe
  C:\Windows\System\wRnBAdu.exe
  2⤵
  PID:3992
- C:\Windows\System\JzfSivY.exe
  C:\Windows\System\JzfSivY.exe
  2⤵
  PID:4008
- C:\Windows\System\lZTqTee.exe
  C:\Windows\System\lZTqTee.exe
  2⤵
  PID:4024
- C:\Windows\System\sVEWIuo.exe
  C:\Windows\System\sVEWIuo.exe
  2⤵
  PID:4044
- C:\Windows\System\moudGdK.exe
  C:\Windows\System\moudGdK.exe
  2⤵
  PID:4080
- C:\Windows\System\kYoMurV.exe
  C:\Windows\System\kYoMurV.exe
  2⤵
  PID:1144
- C:\Windows\System\axkRaYr.exe
  C:\Windows\System\axkRaYr.exe
  2⤵
  PID:2248
- C:\Windows\System\zQvicCU.exe
  C:\Windows\System\zQvicCU.exe
  2⤵
  PID:2700
- C:\Windows\System\ssLlSXM.exe
  C:\Windows\System\ssLlSXM.exe
  2⤵
  PID:2688
- C:\Windows\System\BSCnByk.exe
  C:\Windows\System\BSCnByk.exe
  2⤵
  PID:2376
- C:\Windows\System\ZjpVjPf.exe
  C:\Windows\System\ZjpVjPf.exe
  2⤵
  PID:2008
- C:\Windows\System\PthXezo.exe
  C:\Windows\System\PthXezo.exe
  2⤵
  PID:2684
- C:\Windows\System\AqWptgo.exe
  C:\Windows\System\AqWptgo.exe
  2⤵
  PID:2056
- C:\Windows\System\NEtirqS.exe
  C:\Windows\System\NEtirqS.exe
  2⤵
  PID:2668
- C:\Windows\System\pXfhiyr.exe
  C:\Windows\System\pXfhiyr.exe
  2⤵
  PID:1196
- C:\Windows\System\jZIAvtg.exe
  C:\Windows\System\jZIAvtg.exe
  2⤵
  PID:2652
- C:\Windows\System\qLlgdnY.exe
  C:\Windows\System\qLlgdnY.exe
  2⤵
  PID:2528
- C:\Windows\System\UxDsGAY.exe
  C:\Windows\System\UxDsGAY.exe
  2⤵
  PID:2792
- C:\Windows\System\JxPlcVL.exe
  C:\Windows\System\JxPlcVL.exe
  2⤵
  PID:1816
- C:\Windows\System\JwEQmIM.exe
  C:\Windows\System\JwEQmIM.exe
  2⤵
  PID:3076
- C:\Windows\System\TNllcOw.exe
  C:\Windows\System\TNllcOw.exe
  2⤵
  PID:3144
- C:\Windows\System\EOElmmQ.exe
  C:\Windows\System\EOElmmQ.exe
  2⤵
  PID:3184
- C:\Windows\System\XtQTBWl.exe
  C:\Windows\System\XtQTBWl.exe
  2⤵
  PID:2160
- C:\Windows\System\WKAbhSy.exe
  C:\Windows\System\WKAbhSy.exe
  2⤵
  PID:600
- C:\Windows\System\igIEtyX.exe
  C:\Windows\System\igIEtyX.exe
  2⤵
  PID:1476
- C:\Windows\System\MVQHHyo.exe
  C:\Windows\System\MVQHHyo.exe
  2⤵
  PID:3124
- C:\Windows\System\hoWwsVL.exe
  C:\Windows\System\hoWwsVL.exe
  2⤵
  PID:3172
- C:\Windows\System\zcqYnSC.exe
  C:\Windows\System\zcqYnSC.exe
  2⤵
  PID:3220
- C:\Windows\System\IkeFoIN.exe
  C:\Windows\System\IkeFoIN.exe
  2⤵
  PID:3236
- C:\Windows\System\BOVhehQ.exe
  C:\Windows\System\BOVhehQ.exe
  2⤵
  PID:3248
- C:\Windows\System\BXOkxTB.exe
  C:\Windows\System\BXOkxTB.exe
  2⤵
  PID:3252
- C:\Windows\System\OjouKJY.exe
  C:\Windows\System\OjouKJY.exe
  2⤵
  PID:3272
- C:\Windows\System\drACgTx.exe
  C:\Windows\System\drACgTx.exe
  2⤵
  PID:3288
- C:\Windows\System\JsszNRH.exe
  C:\Windows\System\JsszNRH.exe
  2⤵
  PID:3312
- C:\Windows\System\DCXUSrF.exe
  C:\Windows\System\DCXUSrF.exe
  2⤵
  PID:3336
- C:\Windows\System\YhOFfVY.exe
  C:\Windows\System\YhOFfVY.exe
  2⤵
  PID:3376
- C:\Windows\System\OpjaxIK.exe
  C:\Windows\System\OpjaxIK.exe
  2⤵
  PID:2544
- C:\Windows\System\OlWVMYa.exe
  C:\Windows\System\OlWVMYa.exe
  2⤵
  PID:3408
- C:\Windows\System\KlQwOfi.exe
  C:\Windows\System\KlQwOfi.exe
  2⤵
  PID:3488
- C:\Windows\System\dMAiAJT.exe
  C:\Windows\System\dMAiAJT.exe
  2⤵
  PID:1616
- C:\Windows\System\hALVuCv.exe
  C:\Windows\System\hALVuCv.exe
  2⤵
  PID:3528
- C:\Windows\System\RWxYwpi.exe
  C:\Windows\System\RWxYwpi.exe
  2⤵
  PID:3016
- C:\Windows\System\fDjPXUK.exe
  C:\Windows\System\fDjPXUK.exe
  2⤵
  PID:3588
- C:\Windows\System\vDDvQfi.exe
  C:\Windows\System\vDDvQfi.exe
  2⤵
  PID:3624
- C:\Windows\System\TklMRkP.exe
  C:\Windows\System\TklMRkP.exe
  2⤵
  PID:3608
- C:\Windows\System\WvUgoui.exe
  C:\Windows\System\WvUgoui.exe
  2⤵
  PID:3652
- C:\Windows\System\zqdtgjO.exe
  C:\Windows\System\zqdtgjO.exe
  2⤵
  PID:3668
- C:\Windows\System\CaVHBNx.exe
  C:\Windows\System\CaVHBNx.exe
  2⤵
  PID:3708
- C:\Windows\System\AwlICto.exe
  C:\Windows\System\AwlICto.exe
  2⤵
  PID:2948
- C:\Windows\System\WnlpHTx.exe
  C:\Windows\System\WnlpHTx.exe
  2⤵
  PID:1644
- C:\Windows\System\hAaaHVS.exe
  C:\Windows\System\hAaaHVS.exe
  2⤵
  PID:3764
- C:\Windows\System\TlvkZRO.exe
  C:\Windows\System\TlvkZRO.exe
  2⤵
  PID:3788
- C:\Windows\System\ftfHeFB.exe
  C:\Windows\System\ftfHeFB.exe
  2⤵
  PID:2120
- C:\Windows\System\tvBcqtI.exe
  C:\Windows\System\tvBcqtI.exe
  2⤵
  PID:1980
- C:\Windows\System\nTnhvNH.exe
  C:\Windows\System\nTnhvNH.exe
  2⤵
  PID:2156
- C:\Windows\System\gOxxDRK.exe
  C:\Windows\System\gOxxDRK.exe
  2⤵
  PID:1868
- C:\Windows\System\wvqicRA.exe
  C:\Windows\System\wvqicRA.exe
  2⤵
  PID:1060
- C:\Windows\System\oxlgQbk.exe
  C:\Windows\System\oxlgQbk.exe
  2⤵
  PID:412
- C:\Windows\System\CalVyVK.exe
  C:\Windows\System\CalVyVK.exe
  2⤵
  PID:2128
- C:\Windows\System\SVKgWSB.exe
  C:\Windows\System\SVKgWSB.exe
  2⤵
  PID:3852
- C:\Windows\System\czbijCh.exe
  C:\Windows\System\czbijCh.exe
  2⤵
  PID:3872
- C:\Windows\System\ISPGwEU.exe
  C:\Windows\System\ISPGwEU.exe
  2⤵
  PID:3876
- C:\Windows\System\HTdsNGI.exe
  C:\Windows\System\HTdsNGI.exe
  2⤵
  PID:3916
- C:\Windows\System\PFoDFnQ.exe
  C:\Windows\System\PFoDFnQ.exe
  2⤵
  PID:3964
- C:\Windows\System\KQyRWev.exe
  C:\Windows\System\KQyRWev.exe
  2⤵
  PID:3988
- C:\Windows\System\EhuBdZk.exe
  C:\Windows\System\EhuBdZk.exe
  2⤵
  PID:4020
- C:\Windows\System\QRURoVV.exe
  C:\Windows\System\QRURoVV.exe
  2⤵
  PID:4056
- C:\Windows\System\lUSTTiQ.exe
  C:\Windows\System\lUSTTiQ.exe
  2⤵
  PID:4072
- C:\Windows\System\AQwaajy.exe
  C:\Windows\System\AQwaajy.exe
  2⤵
  PID:2124
- C:\Windows\System\ZNxaQPt.exe
  C:\Windows\System\ZNxaQPt.exe
  2⤵
  PID:1092
- C:\Windows\System\dlWgWBi.exe
  C:\Windows\System\dlWgWBi.exe
  2⤵
  PID:1900
- C:\Windows\System\ktSyqWQ.exe
  C:\Windows\System\ktSyqWQ.exe
  2⤵
  PID:1636
- C:\Windows\System\wQlrBpQ.exe
  C:\Windows\System\wQlrBpQ.exe
  2⤵
  PID:2572
- C:\Windows\System\kOgVejo.exe
  C:\Windows\System\kOgVejo.exe
  2⤵
  PID:3092
- C:\Windows\System\PdMCGVN.exe
  C:\Windows\System\PdMCGVN.exe
  2⤵
  PID:2296
- C:\Windows\System\ViiwJxU.exe
  C:\Windows\System\ViiwJxU.exe
  2⤵
  PID:3168
- C:\Windows\System\JZnxcCT.exe
  C:\Windows\System\JZnxcCT.exe
  2⤵
  PID:3256
- C:\Windows\System\doIkBXj.exe
  C:\Windows\System\doIkBXj.exe
  2⤵
  PID:3396
- C:\Windows\System\UtGRVqf.exe
  C:\Windows\System\UtGRVqf.exe
  2⤵
  PID:2492
- C:\Windows\System\ThNAqdW.exe
  C:\Windows\System\ThNAqdW.exe
  2⤵
  PID:3476
- C:\Windows\System\NSGvuNo.exe
  C:\Windows\System\NSGvuNo.exe
  2⤵
  PID:2612
- C:\Windows\System\mAlmxcE.exe
  C:\Windows\System\mAlmxcE.exe
  2⤵
  PID:2012
- C:\Windows\System\ObcZIwL.exe
  C:\Windows\System\ObcZIwL.exe
  2⤵
  PID:3152
- C:\Windows\System\AjKhcWl.exe
  C:\Windows\System\AjKhcWl.exe
  2⤵
  PID:4112
- C:\Windows\System\HLvwIZZ.exe
  C:\Windows\System\HLvwIZZ.exe
  2⤵
  PID:4132
- C:\Windows\System\ExFakXl.exe
  C:\Windows\System\ExFakXl.exe
  2⤵
  PID:4148
- C:\Windows\System\MlNbwdI.exe
  C:\Windows\System\MlNbwdI.exe
  2⤵
  PID:4164
- C:\Windows\System\tNnVdpi.exe
  C:\Windows\System\tNnVdpi.exe
  2⤵
  PID:4180
- C:\Windows\System\VQtqwTn.exe
  C:\Windows\System\VQtqwTn.exe
  2⤵
  PID:4196
- C:\Windows\System\wIloyNH.exe
  C:\Windows\System\wIloyNH.exe
  2⤵
  PID:4212
- C:\Windows\System\EvMlhGs.exe
  C:\Windows\System\EvMlhGs.exe
  2⤵
  PID:4228
- C:\Windows\System\CVwzGkH.exe
  C:\Windows\System\CVwzGkH.exe
  2⤵
  PID:4248
- C:\Windows\System\BuRkoEV.exe
  C:\Windows\System\BuRkoEV.exe
  2⤵
  PID:4264
- C:\Windows\System\UfXYzuC.exe
  C:\Windows\System\UfXYzuC.exe
  2⤵
  PID:4280
- C:\Windows\System\xJPDhZx.exe
  C:\Windows\System\xJPDhZx.exe
  2⤵
  PID:4296
- C:\Windows\System\FGZkkKT.exe
  C:\Windows\System\FGZkkKT.exe
  2⤵
  PID:4312
- C:\Windows\System\fHuqRNb.exe
  C:\Windows\System\fHuqRNb.exe
  2⤵
  PID:4332
- C:\Windows\System\rsYEtSi.exe
  C:\Windows\System\rsYEtSi.exe
  2⤵
  PID:4348
- C:\Windows\System\wTOAmUu.exe
  C:\Windows\System\wTOAmUu.exe
  2⤵
  PID:4364
- C:\Windows\System\XGSpKMM.exe
  C:\Windows\System\XGSpKMM.exe
  2⤵
  PID:4380
- C:\Windows\System\AcgmjHd.exe
  C:\Windows\System\AcgmjHd.exe
  2⤵
  PID:4396
- C:\Windows\System\UgyXLEl.exe
  C:\Windows\System\UgyXLEl.exe
  2⤵
  PID:4412
- C:\Windows\System\IzoJGvz.exe
  C:\Windows\System\IzoJGvz.exe
  2⤵
  PID:4428
- C:\Windows\System\ULnodax.exe
  C:\Windows\System\ULnodax.exe
  2⤵
  PID:4444
- C:\Windows\System\AWiBWrN.exe
  C:\Windows\System\AWiBWrN.exe
  2⤵
  PID:4464
- C:\Windows\System\ZOrOnTC.exe
  C:\Windows\System\ZOrOnTC.exe
  2⤵
  PID:4480
- C:\Windows\System\VwFLXKr.exe
  C:\Windows\System\VwFLXKr.exe
  2⤵
  PID:4496
- C:\Windows\System\LAgNlGq.exe
  C:\Windows\System\LAgNlGq.exe
  2⤵
  PID:4512
- C:\Windows\System\jwLFrBn.exe
  C:\Windows\System\jwLFrBn.exe
  2⤵
  PID:4528
- C:\Windows\System\kQrWCgd.exe
  C:\Windows\System\kQrWCgd.exe
  2⤵
  PID:4608
- C:\Windows\System\Ykftpkb.exe
  C:\Windows\System\Ykftpkb.exe
  2⤵
  PID:4628
- C:\Windows\System\uCUvpdP.exe
  C:\Windows\System\uCUvpdP.exe
  2⤵
  PID:4644
- C:\Windows\System\ZfHbFgI.exe
  C:\Windows\System\ZfHbFgI.exe
  2⤵
  PID:4660
- C:\Windows\System\nQVrNPb.exe
  C:\Windows\System\nQVrNPb.exe
  2⤵
  PID:4676
- C:\Windows\System\gGYdvXr.exe
  C:\Windows\System\gGYdvXr.exe
  2⤵
  PID:4692
- C:\Windows\System\xyXAfmi.exe
  C:\Windows\System\xyXAfmi.exe
  2⤵
  PID:4708
- C:\Windows\System\bGxBHgd.exe
  C:\Windows\System\bGxBHgd.exe
  2⤵
  PID:4732
- C:\Windows\System\WBBkoxB.exe
  C:\Windows\System\WBBkoxB.exe
  2⤵
  PID:4756
- C:\Windows\System\kCCLyHR.exe
  C:\Windows\System\kCCLyHR.exe
  2⤵
  PID:4772
- C:\Windows\System\hOoYnPg.exe
  C:\Windows\System\hOoYnPg.exe
  2⤵
  PID:4788
- C:\Windows\System\ChRTnsD.exe
  C:\Windows\System\ChRTnsD.exe
  2⤵
  PID:4804
- C:\Windows\System\SciySjF.exe
  C:\Windows\System\SciySjF.exe
  2⤵
  PID:4820
- C:\Windows\System\yDNOESz.exe
  C:\Windows\System\yDNOESz.exe
  2⤵
  PID:4836
- C:\Windows\System\CnszEVP.exe
  C:\Windows\System\CnszEVP.exe
  2⤵
  PID:4852
- C:\Windows\System\EKSrChQ.exe
  C:\Windows\System\EKSrChQ.exe
  2⤵
  PID:4868
- C:\Windows\System\VxaDkKr.exe
  C:\Windows\System\VxaDkKr.exe
  2⤵
  PID:4884
- C:\Windows\System\tIvknVo.exe
  C:\Windows\System\tIvknVo.exe
  2⤵
  PID:4900
- C:\Windows\System\mPbxUED.exe
  C:\Windows\System\mPbxUED.exe
  2⤵
  PID:4916
- C:\Windows\System\CocNRAh.exe
  C:\Windows\System\CocNRAh.exe
  2⤵
  PID:4932
- C:\Windows\System\qkTMhiR.exe
  C:\Windows\System\qkTMhiR.exe
  2⤵
  PID:4948
- C:\Windows\System\njbrUdp.exe
  C:\Windows\System\njbrUdp.exe
  2⤵
  PID:4964
- C:\Windows\System\YvQabPj.exe
  C:\Windows\System\YvQabPj.exe
  2⤵
  PID:4980
- C:\Windows\System\eaIZdSw.exe
  C:\Windows\System\eaIZdSw.exe
  2⤵
  PID:4996
- C:\Windows\System\XzUrQfc.exe
  C:\Windows\System\XzUrQfc.exe
  2⤵
  PID:5012
- C:\Windows\System\uNfAehC.exe
  C:\Windows\System\uNfAehC.exe
  2⤵
  PID:5028
- C:\Windows\System\BhnaSCs.exe
  C:\Windows\System\BhnaSCs.exe
  2⤵
  PID:5044
- C:\Windows\System\WMPGpVa.exe
  C:\Windows\System\WMPGpVa.exe
  2⤵
  PID:5060
- C:\Windows\System\FmqYASh.exe
  C:\Windows\System\FmqYASh.exe
  2⤵
  PID:5076
- C:\Windows\System\NRFCjUe.exe
  C:\Windows\System\NRFCjUe.exe
  2⤵
  PID:5092
- C:\Windows\System\zaHiZip.exe
  C:\Windows\System\zaHiZip.exe
  2⤵
  PID:5108
- C:\Windows\System\MKWzSlZ.exe
  C:\Windows\System\MKWzSlZ.exe
  2⤵
  PID:1716
- C:\Windows\System\SecYjTY.exe
  C:\Windows\System\SecYjTY.exe
  2⤵
  PID:3244
- C:\Windows\System\OYImYBE.exe
  C:\Windows\System\OYImYBE.exe
  2⤵
  PID:3204
- C:\Windows\System\HYiXjlD.exe
  C:\Windows\System\HYiXjlD.exe
  2⤵
  PID:3436
- C:\Windows\System\rtHDrJt.exe
  C:\Windows\System\rtHDrJt.exe
  2⤵
  PID:2480
- C:\Windows\System\irneETa.exe
  C:\Windows\System\irneETa.exe
  2⤵
  PID:3648
- C:\Windows\System\LWfFHMC.exe
  C:\Windows\System\LWfFHMC.exe
  2⤵
  PID:3732
- C:\Windows\System\iGgTrSU.exe
  C:\Windows\System\iGgTrSU.exe
  2⤵
  PID:2580
- C:\Windows\System\Mskyjkw.exe
  C:\Windows\System\Mskyjkw.exe
  2⤵
  PID:3884
- C:\Windows\System\lqYREEd.exe
  C:\Windows\System\lqYREEd.exe
  2⤵
  PID:4016
- C:\Windows\System\kRujffN.exe
  C:\Windows\System\kRujffN.exe
  2⤵
  PID:2728
- C:\Windows\System\lKmiYdO.exe
  C:\Windows\System\lKmiYdO.exe
  2⤵
  PID:3432
- C:\Windows\System\OojWTZt.exe
  C:\Windows\System\OojWTZt.exe
  2⤵
  PID:4124
- C:\Windows\System\XjeeGxo.exe
  C:\Windows\System\XjeeGxo.exe
  2⤵
  PID:2348
- C:\Windows\System\PrkKkIs.exe
  C:\Windows\System\PrkKkIs.exe
  2⤵
  PID:3512
- C:\Windows\System\LbOqvMi.exe
  C:\Windows\System\LbOqvMi.exe
  2⤵
  PID:3636
- C:\Windows\System\wviSOBZ.exe
  C:\Windows\System\wviSOBZ.exe
  2⤵
  PID:1192
- C:\Windows\System\fjLyTKe.exe
  C:\Windows\System\fjLyTKe.exe
  2⤵
  PID:3800
- C:\Windows\System\RWkTPFG.exe
  C:\Windows\System\RWkTPFG.exe
  2⤵
  PID:3816
- C:\Windows\System\kkHKtgB.exe
  C:\Windows\System\kkHKtgB.exe
  2⤵
  PID:1664
- C:\Windows\System\dnkHGgR.exe
  C:\Windows\System\dnkHGgR.exe
  2⤵
  PID:4000
- C:\Windows\System\UVXmVpO.exe
  C:\Windows\System\UVXmVpO.exe
  2⤵
  PID:4040
- C:\Windows\System\xuyoGCU.exe
  C:\Windows\System\xuyoGCU.exe
  2⤵
  PID:2720
- C:\Windows\System\OHWaOYV.exe
  C:\Windows\System\OHWaOYV.exe
  2⤵
  PID:3232
- C:\Windows\System\iZTRTxI.exe
  C:\Windows\System\iZTRTxI.exe
  2⤵
  PID:4192
- C:\Windows\System\GCLTdgU.exe
  C:\Windows\System\GCLTdgU.exe
  2⤵
  PID:4288
- C:\Windows\System\QdOwyFy.exe
  C:\Windows\System\QdOwyFy.exe
  2⤵
  PID:4324
- C:\Windows\System\AXkBJYK.exe
  C:\Windows\System\AXkBJYK.exe
  2⤵
  PID:4392
- C:\Windows\System\eginSmx.exe
  C:\Windows\System\eginSmx.exe
  2⤵
  PID:4456
- C:\Windows\System\UWpKAvV.exe
  C:\Windows\System\UWpKAvV.exe
  2⤵
  PID:4520
- C:\Windows\System\kXVnmpx.exe
  C:\Windows\System\kXVnmpx.exe
  2⤵
  PID:2188
- C:\Windows\System\RdpkwcU.exe
  C:\Windows\System\RdpkwcU.exe
  2⤵
  PID:4624
- C:\Windows\System\vaeFABn.exe
  C:\Windows\System\vaeFABn.exe
  2⤵
  PID:3472
- C:\Windows\System\fXskTvU.exe
  C:\Windows\System\fXskTvU.exe
  2⤵
  PID:2800
- C:\Windows\System\nPtHuga.exe
  C:\Windows\System\nPtHuga.exe
  2⤵
  PID:4176
- C:\Windows\System\vEUxEaY.exe
  C:\Windows\System\vEUxEaY.exe
  2⤵
  PID:4244
- C:\Windows\System\QuMIMFa.exe
  C:\Windows\System\QuMIMFa.exe
  2⤵
  PID:4308
- C:\Windows\System\XZAtddI.exe
  C:\Windows\System\XZAtddI.exe
  2⤵
  PID:4376
- C:\Windows\System\MbkiZgc.exe
  C:\Windows\System\MbkiZgc.exe
  2⤵
  PID:4440
- C:\Windows\System\aCfRzFU.exe
  C:\Windows\System\aCfRzFU.exe
  2⤵
  PID:4504
- C:\Windows\System\NdgbTHZ.exe
  C:\Windows\System\NdgbTHZ.exe
  2⤵
  PID:4544
- C:\Windows\System\Phfkayx.exe
  C:\Windows\System\Phfkayx.exe
  2⤵
  PID:4564
- C:\Windows\System\rwFbuwU.exe
  C:\Windows\System\rwFbuwU.exe
  2⤵
  PID:4580
- C:\Windows\System\HkBXxIJ.exe
  C:\Windows\System\HkBXxIJ.exe
  2⤵
  PID:4656
- C:\Windows\System\Obltaeg.exe
  C:\Windows\System\Obltaeg.exe
  2⤵
  PID:4688
- C:\Windows\System\WQPAskG.exe
  C:\Windows\System\WQPAskG.exe
  2⤵
  PID:1968
- C:\Windows\System\GzEShoX.exe
  C:\Windows\System\GzEShoX.exe
  2⤵
  PID:4172
- C:\Windows\System\QpGTHaT.exe
  C:\Windows\System\QpGTHaT.exe
  2⤵
  PID:4552
- C:\Windows\System\REHrkfa.exe
  C:\Windows\System\REHrkfa.exe
  2⤵
  PID:4668
- C:\Windows\System\OBiaghN.exe
  C:\Windows\System\OBiaghN.exe
  2⤵
  PID:4704
- C:\Windows\System\RiMEzyO.exe
  C:\Windows\System\RiMEzyO.exe
  2⤵
  PID:4592
- C:\Windows\System\ycUXjyl.exe
  C:\Windows\System\ycUXjyl.exe
  2⤵
  PID:4780
- C:\Windows\System\UgejZpc.exe
  C:\Windows\System\UgejZpc.exe
  2⤵
  PID:4784
- C:\Windows\System\SUwlGEk.exe
  C:\Windows\System\SUwlGEk.exe
  2⤵
  PID:4800
- C:\Windows\System\nHQITow.exe
  C:\Windows\System\nHQITow.exe
  2⤵
  PID:4828
- C:\Windows\System\Giitjqj.exe
  C:\Windows\System\Giitjqj.exe
  2⤵
  PID:4864
- C:\Windows\System\IuecnIT.exe
  C:\Windows\System\IuecnIT.exe
  2⤵
  PID:4860
- C:\Windows\System\KIUvDPj.exe
  C:\Windows\System\KIUvDPj.exe
  2⤵
  PID:4992
- C:\Windows\System\mWPmfeU.exe
  C:\Windows\System\mWPmfeU.exe
  2⤵
  PID:4908
- C:\Windows\System\siJUxpr.exe
  C:\Windows\System\siJUxpr.exe
  2⤵
  PID:4944
- C:\Windows\System\rcwnVMF.exe
  C:\Windows\System\rcwnVMF.exe
  2⤵
  PID:5100
- C:\Windows\System\hWHkyHN.exe
  C:\Windows\System\hWHkyHN.exe
  2⤵
  PID:5116
- C:\Windows\System\wDgdgHr.exe
  C:\Windows\System\wDgdgHr.exe
  2⤵
  PID:3428
- C:\Windows\System\ynrVWIw.exe
  C:\Windows\System\ynrVWIw.exe
  2⤵
  PID:4004
- C:\Windows\System\iFrFirH.exe
  C:\Windows\System\iFrFirH.exe
  2⤵
  PID:3452
- C:\Windows\System\AGtvPAM.exe
  C:\Windows\System\AGtvPAM.exe
  2⤵
  PID:2916
- C:\Windows\System\aamcjOQ.exe
  C:\Windows\System\aamcjOQ.exe
  2⤵
  PID:3296
- C:\Windows\System\kRGdjaU.exe
  C:\Windows\System\kRGdjaU.exe
  2⤵
  PID:3004
- C:\Windows\System\LbkNxzU.exe
  C:\Windows\System\LbkNxzU.exe
  2⤵
  PID:2656
- C:\Windows\System\ayczcJR.exe
  C:\Windows\System\ayczcJR.exe
  2⤵
  PID:3676
- C:\Windows\System\dkzXwvp.exe
  C:\Windows\System\dkzXwvp.exe
  2⤵
  PID:3912
- C:\Windows\System\yQabucx.exe
  C:\Windows\System\yQabucx.exe
  2⤵
  PID:3836
- C:\Windows\System\OmyslQA.exe
  C:\Windows\System\OmyslQA.exe
  2⤵
  PID:4076
- C:\Windows\System\bOxIipM.exe
  C:\Windows\System\bOxIipM.exe
  2⤵
  PID:4160
- C:\Windows\System\DSfRfeD.exe
  C:\Windows\System\DSfRfeD.exe
  2⤵
  PID:4424
- C:\Windows\System\lFcrepZ.exe
  C:\Windows\System\lFcrepZ.exe
  2⤵
  PID:3080
- C:\Windows\System\qcQOmWc.exe
  C:\Windows\System\qcQOmWc.exe
  2⤵
  PID:4492
- C:\Windows\System\hyKhXEz.exe
  C:\Windows\System\hyKhXEz.exe
  2⤵
  PID:3284
- C:\Windows\System\UWFaaGg.exe
  C:\Windows\System\UWFaaGg.exe
  2⤵
  PID:4104
- C:\Windows\System\ewPToKe.exe
  C:\Windows\System\ewPToKe.exe
  2⤵
  PID:4344
- C:\Windows\System\DVIUDNp.exe
  C:\Windows\System\DVIUDNp.exe
  2⤵
  PID:4556
- C:\Windows\System\KlcXWfL.exe
  C:\Windows\System\KlcXWfL.exe
  2⤵
  PID:3356
- C:\Windows\System\TcFsUXt.exe
  C:\Windows\System\TcFsUXt.exe
  2⤵
  PID:4408
- C:\Windows\System\lzPztRb.exe
  C:\Windows\System\lzPztRb.exe
  2⤵
  PID:4560
- C:\Windows\System\wTSuQOq.exe
  C:\Windows\System\wTSuQOq.exe
  2⤵
  PID:4540
- C:\Windows\System\EfudCzz.exe
  C:\Windows\System\EfudCzz.exe
  2⤵
  PID:3132
- C:\Windows\System\HTXiwkM.exe
  C:\Windows\System\HTXiwkM.exe
  2⤵
  PID:3784
- C:\Windows\System\vMBofXY.exe
  C:\Windows\System\vMBofXY.exe
  2⤵
  PID:4596
- C:\Windows\System\twswaTe.exe
  C:\Windows\System\twswaTe.exe
  2⤵
  PID:4848
- C:\Windows\System\JaquNMH.exe
  C:\Windows\System\JaquNMH.exe
  2⤵
  PID:2144
- C:\Windows\System\bjhJrOn.exe
  C:\Windows\System\bjhJrOn.exe
  2⤵
  PID:4700
- C:\Windows\System\ZGftvqz.exe
  C:\Windows\System\ZGftvqz.exe
  2⤵
  PID:4768
- C:\Windows\System\KyVqDXX.exe
  C:\Windows\System\KyVqDXX.exe
  2⤵
  PID:3696
- C:\Windows\System\lSSOklV.exe
  C:\Windows\System\lSSOklV.exe
  2⤵
  PID:2164
- C:\Windows\System\HtXxEkG.exe
  C:\Windows\System\HtXxEkG.exe
  2⤵
  PID:2132
- C:\Windows\System\CZVIrXA.exe
  C:\Windows\System\CZVIrXA.exe
  2⤵
  PID:3604
- C:\Windows\System\NCYEIKP.exe
  C:\Windows\System\NCYEIKP.exe
  2⤵
  PID:636
- C:\Windows\System\LUrlmiO.exe
  C:\Windows\System\LUrlmiO.exe
  2⤵
  PID:4972
- C:\Windows\System\QiPRoqK.exe
  C:\Windows\System\QiPRoqK.exe
  2⤵
  PID:5084
- C:\Windows\System\UAXvdOl.exe
  C:\Windows\System\UAXvdOl.exe
  2⤵
  PID:3632
- C:\Windows\System\ZRwiwgC.exe
  C:\Windows\System\ZRwiwgC.exe
  2⤵
  PID:4068
- C:\Windows\System\qiLohxW.exe
  C:\Windows\System\qiLohxW.exe
  2⤵
  PID:3692
- C:\Windows\System\kGxaNyt.exe
  C:\Windows\System\kGxaNyt.exe
  2⤵
  PID:3796
- C:\Windows\System\CnunGan.exe
  C:\Windows\System\CnunGan.exe
  2⤵
  PID:3012
- C:\Windows\System\PvJEKbQ.exe
  C:\Windows\System\PvJEKbQ.exe
  2⤵
  PID:2092
- C:\Windows\System\hsGKdTI.exe
  C:\Windows\System\hsGKdTI.exe
  2⤵
  PID:1472
- C:\Windows\System\UaHHWrZ.exe
  C:\Windows\System\UaHHWrZ.exe
  2⤵
  PID:1088
- C:\Windows\System\mkPBaGW.exe
  C:\Windows\System\mkPBaGW.exe
  2⤵
  PID:3348
- C:\Windows\System\dyXoyJe.exe
  C:\Windows\System\dyXoyJe.exe
  2⤵
  PID:4572
- C:\Windows\System\pjfQLYK.exe
  C:\Windows\System\pjfQLYK.exe
  2⤵
  PID:4684
- C:\Windows\System\KxQJoSD.exe
  C:\Windows\System\KxQJoSD.exe
  2⤵
  PID:4752
- C:\Windows\System\BCrQyFM.exe
  C:\Windows\System\BCrQyFM.exe
  2⤵
  PID:4896
- C:\Windows\System\afuisqz.exe
  C:\Windows\System\afuisqz.exe
  2⤵
  PID:4188
- C:\Windows\System\QksJyAv.exe
  C:\Windows\System\QksJyAv.exe
  2⤵
  PID:2920
- C:\Windows\System\JfwWvNx.exe
  C:\Windows\System\JfwWvNx.exe
  2⤵
  PID:3368
- C:\Windows\System\LWnjgbX.exe
  C:\Windows\System\LWnjgbX.exe
  2⤵
  PID:3112
- C:\Windows\System\FgjelkG.exe
  C:\Windows\System\FgjelkG.exe
  2⤵
  PID:1464
- C:\Windows\System\mPlHPZo.exe
  C:\Windows\System\mPlHPZo.exe
  2⤵
  PID:5128
- C:\Windows\System\rWXIQkG.exe
  C:\Windows\System\rWXIQkG.exe
  2⤵
  PID:5144
- C:\Windows\System\qtXqcQM.exe
  C:\Windows\System\qtXqcQM.exe
  2⤵
  PID:5160
- C:\Windows\System\PAFtUaJ.exe
  C:\Windows\System\PAFtUaJ.exe
  2⤵
  PID:5176
- C:\Windows\System\BrCKsbN.exe
  C:\Windows\System\BrCKsbN.exe
  2⤵
  PID:5192
- C:\Windows\System\wistMxX.exe
  C:\Windows\System\wistMxX.exe
  2⤵
  PID:5212
- C:\Windows\System\DeoyHBm.exe
  C:\Windows\System\DeoyHBm.exe
  2⤵
  PID:5228
- C:\Windows\System\DIIguAd.exe
  C:\Windows\System\DIIguAd.exe
  2⤵
  PID:5244
- C:\Windows\System\YvYJOCd.exe
  C:\Windows\System\YvYJOCd.exe
  2⤵
  PID:5260
- C:\Windows\System\EgonLVs.exe
  C:\Windows\System\EgonLVs.exe
  2⤵
  PID:5276
- C:\Windows\System\lYLGbZF.exe
  C:\Windows\System\lYLGbZF.exe
  2⤵
  PID:5292
- C:\Windows\System\iiNyBWY.exe
  C:\Windows\System\iiNyBWY.exe
  2⤵
  PID:5308
- C:\Windows\System\OhpSxQB.exe
  C:\Windows\System\OhpSxQB.exe
  2⤵
  PID:5324
- C:\Windows\System\ZtDnbhx.exe
  C:\Windows\System\ZtDnbhx.exe
  2⤵
  PID:5340
- C:\Windows\System\ioXbuvd.exe
  C:\Windows\System\ioXbuvd.exe
  2⤵
  PID:5432
- C:\Windows\System\mrAvDjh.exe
  C:\Windows\System\mrAvDjh.exe
  2⤵
  PID:5464
- C:\Windows\System\TZlJUIC.exe
  C:\Windows\System\TZlJUIC.exe
  2⤵
  PID:5484
- C:\Windows\System\wYllczs.exe
  C:\Windows\System\wYllczs.exe
  2⤵
  PID:5504
- C:\Windows\System\agTgbsX.exe
  C:\Windows\System\agTgbsX.exe
  2⤵
  PID:5584
- C:\Windows\System\UjWQBzn.exe
  C:\Windows\System\UjWQBzn.exe
  2⤵
  PID:5744
- C:\Windows\System\mfTWnaw.exe
  C:\Windows\System\mfTWnaw.exe
  2⤵
  PID:5812
- C:\Windows\System\curILMT.exe
  C:\Windows\System\curILMT.exe
  2⤵
  PID:5828
- C:\Windows\System\iOHKihk.exe
  C:\Windows\System\iOHKihk.exe
  2⤵
  PID:5844
- C:\Windows\System\QAUMjpN.exe
  C:\Windows\System\QAUMjpN.exe
  2⤵
  PID:5860
- C:\Windows\System\dOWqItD.exe
  C:\Windows\System\dOWqItD.exe
  2⤵
  PID:5876
- C:\Windows\System\NboNnwk.exe
  C:\Windows\System\NboNnwk.exe
  2⤵
  PID:5892
- C:\Windows\System\ligQVmg.exe
  C:\Windows\System\ligQVmg.exe
  2⤵
  PID:5908
- C:\Windows\System\qeLhHCc.exe
  C:\Windows\System\qeLhHCc.exe
  2⤵
  PID:5924
- C:\Windows\System\mdaYbon.exe
  C:\Windows\System\mdaYbon.exe
  2⤵
  PID:5940
- C:\Windows\System\ntpDHkB.exe
  C:\Windows\System\ntpDHkB.exe
  2⤵
  PID:5956
- C:\Windows\System\ixIXbXx.exe
  C:\Windows\System\ixIXbXx.exe
  2⤵
  PID:5972
- C:\Windows\System\vLPRHiI.exe
  C:\Windows\System\vLPRHiI.exe
  2⤵
  PID:5988
- C:\Windows\System\XktpMLy.exe
  C:\Windows\System\XktpMLy.exe
  2⤵
  PID:6004
- C:\Windows\System\GDjYApZ.exe
  C:\Windows\System\GDjYApZ.exe
  2⤵
  PID:6020
- C:\Windows\System\zlwXwjc.exe
  C:\Windows\System\zlwXwjc.exe
  2⤵
  PID:6036
- C:\Windows\System\wxOZwyI.exe
  C:\Windows\System\wxOZwyI.exe
  2⤵
  PID:6052
- C:\Windows\System\hQflQwh.exe
  C:\Windows\System\hQflQwh.exe
  2⤵
  PID:6068
- C:\Windows\System\hKbCBgd.exe
  C:\Windows\System\hKbCBgd.exe
  2⤵
  PID:6084
- C:\Windows\System\umMEMzo.exe
  C:\Windows\System\umMEMzo.exe
  2⤵
  PID:6104
- C:\Windows\System\JpTakan.exe
  C:\Windows\System\JpTakan.exe
  2⤵
  PID:6120
- C:\Windows\System\VTDoCJG.exe
  C:\Windows\System\VTDoCJG.exe
  2⤵
  PID:6136
- C:\Windows\System\ncCrgnG.exe
  C:\Windows\System\ncCrgnG.exe
  2⤵
  PID:4240
- C:\Windows\System\CSNdGFR.exe
  C:\Windows\System\CSNdGFR.exe
  2⤵
  PID:4032
- C:\Windows\System\SITPefG.exe
  C:\Windows\System\SITPefG.exe
  2⤵
  PID:5124
- C:\Windows\System\fUniwok.exe
  C:\Windows\System\fUniwok.exe
  2⤵
  PID:5188
- C:\Windows\System\xocZCWk.exe
  C:\Windows\System\xocZCWk.exe
  2⤵
  PID:5256
- C:\Windows\System\mKbYZrN.exe
  C:\Windows\System\mKbYZrN.exe
  2⤵
  PID:5320
- C:\Windows\System\NAQptdI.exe
  C:\Windows\System\NAQptdI.exe
  2⤵
  PID:1992
- C:\Windows\System\vYSluAx.exe
  C:\Windows\System\vYSluAx.exe
  2⤵
  PID:4616
- C:\Windows\System\JrXdtwh.exe
  C:\Windows\System\JrXdtwh.exe
  2⤵
  PID:5268
- C:\Windows\System\dhduLyY.exe
  C:\Windows\System\dhduLyY.exe
  2⤵
  PID:2284
- C:\Windows\System\tqQcwOD.exe
  C:\Windows\System\tqQcwOD.exe
  2⤵
  PID:1184
- C:\Windows\System\okvXgEv.exe
  C:\Windows\System\okvXgEv.exe
  2⤵
  PID:5140
- C:\Windows\System\xlZRzIk.exe
  C:\Windows\System\xlZRzIk.exe
  2⤵
  PID:5204
- C:\Windows\System\eqTqqIb.exe
  C:\Windows\System\eqTqqIb.exe
  2⤵
  PID:5364
- C:\Windows\System\PcWJvve.exe
  C:\Windows\System\PcWJvve.exe
  2⤵
  PID:5384
- C:\Windows\System\brnluej.exe
  C:\Windows\System\brnluej.exe
  2⤵
  PID:5396
- C:\Windows\System\DxloCwv.exe
  C:\Windows\System\DxloCwv.exe
  2⤵
  PID:5412
- C:\Windows\System\FkoLtDH.exe
  C:\Windows\System\FkoLtDH.exe
  2⤵
  PID:5440
- C:\Windows\System\sxbAvFY.exe
  C:\Windows\System\sxbAvFY.exe
  2⤵
  PID:5460
- C:\Windows\System\uVbPKrN.exe
  C:\Windows\System\uVbPKrN.exe
  2⤵
  PID:5672
- C:\Windows\System\rlMxUHT.exe
  C:\Windows\System\rlMxUHT.exe
  2⤵
  PID:5684
- C:\Windows\System\wDPPvZk.exe
  C:\Windows\System\wDPPvZk.exe
  2⤵
  PID:5700
- C:\Windows\System\xIJPqcQ.exe
  C:\Windows\System\xIJPqcQ.exe
  2⤵
  PID:5720
- C:\Windows\System\XempNIO.exe
  C:\Windows\System\XempNIO.exe
  2⤵
  PID:5752
- C:\Windows\System\gabTAwc.exe
  C:\Windows\System\gabTAwc.exe
  2⤵
  PID:5768
- C:\Windows\System\RMQTGgI.exe
  C:\Windows\System\RMQTGgI.exe
  2⤵
  PID:5784
- C:\Windows\System\LseGXhX.exe
  C:\Windows\System\LseGXhX.exe
  2⤵
  PID:5760
- C:\Windows\System\NMJsMXL.exe
  C:\Windows\System\NMJsMXL.exe
  2⤵
  PID:5852
- C:\Windows\System\pSvQCfV.exe
  C:\Windows\System\pSvQCfV.exe
  2⤵
  PID:5888
- C:\Windows\System\OAVLXRt.exe
  C:\Windows\System\OAVLXRt.exe
  2⤵
  PID:5980
- C:\Windows\System\xMlrsmw.exe
  C:\Windows\System\xMlrsmw.exe
  2⤵
  PID:5840
- C:\Windows\System\ZDRXNPM.exe
  C:\Windows\System\ZDRXNPM.exe
  2⤵
  PID:5900
- C:\Windows\System\ACnRIAY.exe
  C:\Windows\System\ACnRIAY.exe
  2⤵
  PID:6048
- C:\Windows\System\ipzjRUj.exe
  C:\Windows\System\ipzjRUj.exe
  2⤵
  PID:5968
- C:\Windows\System\eFZSbpB.exe
  C:\Windows\System\eFZSbpB.exe
  2⤵
  PID:6032
- C:\Windows\System\wZaILZI.exe
  C:\Windows\System\wZaILZI.exe
  2⤵
  PID:4156
- C:\Windows\System\DkETwaf.exe
  C:\Windows\System\DkETwaf.exe
  2⤵
  PID:6092
- C:\Windows\System\gCybLXC.exe
  C:\Windows\System\gCybLXC.exe
  2⤵
  PID:5224
- C:\Windows\System\LOIWGan.exe
  C:\Windows\System\LOIWGan.exe
  2⤵
  PID:5236
- C:\Windows\System\YlJMRpE.exe
  C:\Windows\System\YlJMRpE.exe
  2⤵
  PID:5052
- C:\Windows\System\PeEiTXS.exe
  C:\Windows\System\PeEiTXS.exe
  2⤵
  PID:5200
- C:\Windows\System\rDsaveC.exe
  C:\Windows\System\rDsaveC.exe
  2⤵
  PID:5348
- C:\Windows\System\DeTILvW.exe
  C:\Windows\System\DeTILvW.exe
  2⤵
  PID:5336
- C:\Windows\System\dPjGrjr.exe
  C:\Windows\System\dPjGrjr.exe
  2⤵
  PID:4940
- C:\Windows\System\zHvAhQA.exe
  C:\Windows\System\zHvAhQA.exe
  2⤵
  PID:5388
- C:\Windows\System\MhbRlFb.exe
  C:\Windows\System\MhbRlFb.exe
  2⤵
  PID:5452
- C:\Windows\System\tRkfTFo.exe
  C:\Windows\System\tRkfTFo.exe
  2⤵
  PID:5472
- C:\Windows\System\wSeLyfR.exe
  C:\Windows\System\wSeLyfR.exe
  2⤵
  PID:5444
- C:\Windows\System\CyQraKL.exe
  C:\Windows\System\CyQraKL.exe
  2⤵
  PID:5516
- C:\Windows\System\FYZXXwU.exe
  C:\Windows\System\FYZXXwU.exe
  2⤵
  PID:5536
- C:\Windows\System\PIAgFPv.exe
  C:\Windows\System\PIAgFPv.exe
  2⤵
  PID:5556
- C:\Windows\System\fLbnvJH.exe
  C:\Windows\System\fLbnvJH.exe
  2⤵
  PID:5500
- C:\Windows\System\TfRKqWz.exe
  C:\Windows\System\TfRKqWz.exe
  2⤵
  PID:5576
- C:\Windows\System\fZnCody.exe
  C:\Windows\System\fZnCody.exe
  2⤵
  PID:5592
- C:\Windows\System\knsyeIg.exe
  C:\Windows\System\knsyeIg.exe
  2⤵
  PID:2220
- C:\Windows\System\UNIzalD.exe
  C:\Windows\System\UNIzalD.exe
  2⤵
  PID:5800
- C:\Windows\System\RkPtgrt.exe
  C:\Windows\System\RkPtgrt.exe
  2⤵
  PID:5716
- C:\Windows\System\dyPLSSe.exe
  C:\Windows\System\dyPLSSe.exe
  2⤵
  PID:5796
- C:\Windows\System\IghFwca.exe
  C:\Windows\System\IghFwca.exe
  2⤵
  PID:5692
- C:\Windows\System\lElPVIv.exe
  C:\Windows\System\lElPVIv.exe
  2⤵
  PID:6000
- C:\Windows\System\xAhUjhR.exe
  C:\Windows\System\xAhUjhR.exe
  2⤵
  PID:6076
- C:\Windows\System\MtqyISR.exe
  C:\Windows\System\MtqyISR.exe
  2⤵
  PID:5820
- C:\Windows\System\DnJraUs.exe
  C:\Windows\System\DnJraUs.exe
  2⤵
  PID:5984
- C:\Windows\System\ksXTMcy.exe
  C:\Windows\System\ksXTMcy.exe
  2⤵
  PID:6080
- C:\Windows\System\ImjQfiK.exe
  C:\Windows\System\ImjQfiK.exe
  2⤵
  PID:6128
- C:\Windows\System\Jnxbrpg.exe
  C:\Windows\System\Jnxbrpg.exe
  2⤵
  PID:6100
- C:\Windows\System\xUoIfYN.exe
  C:\Windows\System\xUoIfYN.exe
  2⤵
  PID:5424
- C:\Windows\System\MNVVpzK.exe
  C:\Windows\System\MNVVpzK.exe
  2⤵
  PID:5528
- C:\Windows\System\cXZyxcf.exe
  C:\Windows\System\cXZyxcf.exe
  2⤵
  PID:6064
- C:\Windows\System\JfwMAgi.exe
  C:\Windows\System\JfwMAgi.exe
  2⤵
  PID:4304
- C:\Windows\System\ILgpKBD.exe
  C:\Windows\System\ILgpKBD.exe
  2⤵
  PID:5332
- C:\Windows\System\mtwPXwv.exe
  C:\Windows\System\mtwPXwv.exe
  2⤵
  PID:5376
- C:\Windows\System\aeoMGBl.exe
  C:\Windows\System\aeoMGBl.exe
  2⤵
  PID:5552
- C:\Windows\System\iOMLUre.exe
  C:\Windows\System\iOMLUre.exe
  2⤵
  PID:5612
- C:\Windows\System\dwMzXKq.exe
  C:\Windows\System\dwMzXKq.exe
  2⤵
  PID:5624
- C:\Windows\System\zDKMhCG.exe
  C:\Windows\System\zDKMhCG.exe
  2⤵
  PID:5652
- C:\Windows\System\Yrrjwzg.exe
  C:\Windows\System\Yrrjwzg.exe
  2⤵
  PID:5808
- C:\Windows\System\SXwyYGv.exe
  C:\Windows\System\SXwyYGv.exe
  2⤵
  PID:5948
- C:\Windows\System\TmsOIvw.exe
  C:\Windows\System\TmsOIvw.exe
  2⤵
  PID:5420
- C:\Windows\System\vyeTPSi.exe
  C:\Windows\System\vyeTPSi.exe
  2⤵
  PID:5600
- C:\Windows\System\JbFSKuC.exe
  C:\Windows\System\JbFSKuC.exe
  2⤵
  PID:5548
- C:\Windows\System\HOMySar.exe
  C:\Windows\System\HOMySar.exe
  2⤵
  PID:6044
- C:\Windows\System\XJdpwMN.exe
  C:\Windows\System\XJdpwMN.exe
  2⤵
  PID:5728
- C:\Windows\System\VApoZSr.exe
  C:\Windows\System\VApoZSr.exe
  2⤵
  PID:5184
- C:\Windows\System\jXABJeN.exe
  C:\Windows\System\jXABJeN.exe
  2⤵
  PID:5656
- C:\Windows\System\iuJGCjN.exe
  C:\Windows\System\iuJGCjN.exe
  2⤵
  PID:5540
- C:\Windows\System\QopsHoh.exe
  C:\Windows\System\QopsHoh.exe
  2⤵
  PID:5920
- C:\Windows\System\kZihsVS.exe
  C:\Windows\System\kZihsVS.exe
  2⤵
  PID:5804
- C:\Windows\System\GFthPoq.exe
  C:\Windows\System\GFthPoq.exe
  2⤵
  PID:5708
- C:\Windows\System\njpCISM.exe
  C:\Windows\System\njpCISM.exe
  2⤵
  PID:6012
- C:\Windows\System\zKgGMkY.exe
  C:\Windows\System\zKgGMkY.exe
  2⤵
  PID:5304
- C:\Windows\System\lDmFLzN.exe
  C:\Windows\System\lDmFLzN.exe
  2⤵
  PID:1536
- C:\Windows\System\pzfdlen.exe
  C:\Windows\System\pzfdlen.exe
  2⤵
  PID:5628
- C:\Windows\System\SbsOCJX.exe
  C:\Windows\System\SbsOCJX.exe
  2⤵
  PID:5596
- C:\Windows\System\eJFnibA.exe
  C:\Windows\System\eJFnibA.exe
  2⤵
  PID:5884
- C:\Windows\System\tEqLmTM.exe
  C:\Windows\System\tEqLmTM.exe
  2⤵
  PID:6148
- C:\Windows\System\NXGNkUA.exe
  C:\Windows\System\NXGNkUA.exe
  2⤵
  PID:6164
- C:\Windows\System\CqKeHcn.exe
  C:\Windows\System\CqKeHcn.exe
  2⤵
  PID:6180
- C:\Windows\System\HiidTMG.exe
  C:\Windows\System\HiidTMG.exe
  2⤵
  PID:6196
- C:\Windows\System\wkgdyOc.exe
  C:\Windows\System\wkgdyOc.exe
  2⤵
  PID:6212
- C:\Windows\System\bbpgqpv.exe
  C:\Windows\System\bbpgqpv.exe
  2⤵
  PID:6228
- C:\Windows\System\rJWejIu.exe
  C:\Windows\System\rJWejIu.exe
  2⤵
  PID:6244
- C:\Windows\System\rxoDqCv.exe
  C:\Windows\System\rxoDqCv.exe
  2⤵
  PID:6264
- C:\Windows\System\XYBJHFo.exe
  C:\Windows\System\XYBJHFo.exe
  2⤵
  PID:6280
- C:\Windows\System\DuBOAHX.exe
  C:\Windows\System\DuBOAHX.exe
  2⤵
  PID:6296
- C:\Windows\System\giFdZXf.exe
  C:\Windows\System\giFdZXf.exe
  2⤵
  PID:6312
- C:\Windows\System\XGaCwjo.exe
  C:\Windows\System\XGaCwjo.exe
  2⤵
  PID:6328
- C:\Windows\System\MwMbBAp.exe
  C:\Windows\System\MwMbBAp.exe
  2⤵
  PID:6344
- C:\Windows\System\WDCuuSM.exe
  C:\Windows\System\WDCuuSM.exe
  2⤵
  PID:6360
- C:\Windows\System\ajaKyBN.exe
  C:\Windows\System\ajaKyBN.exe
  2⤵
  PID:6376
- C:\Windows\System\hZcjRhV.exe
  C:\Windows\System\hZcjRhV.exe
  2⤵
  PID:6392
- C:\Windows\System\aBZCggF.exe
  C:\Windows\System\aBZCggF.exe
  2⤵
  PID:6408
- C:\Windows\System\sXHIMcq.exe
  C:\Windows\System\sXHIMcq.exe
  2⤵
  PID:6424
- C:\Windows\System\xCFPSYh.exe
  C:\Windows\System\xCFPSYh.exe
  2⤵
  PID:6440
- C:\Windows\System\cxnjqIp.exe
  C:\Windows\System\cxnjqIp.exe
  2⤵
  PID:6456
- C:\Windows\System\lHJqReC.exe
  C:\Windows\System\lHJqReC.exe
  2⤵
  PID:6472
- C:\Windows\System\YZhLBbS.exe
  C:\Windows\System\YZhLBbS.exe
  2⤵
  PID:6488
- C:\Windows\System\JvMdEXf.exe
  C:\Windows\System\JvMdEXf.exe
  2⤵
  PID:6504
- C:\Windows\System\QshsusN.exe
  C:\Windows\System\QshsusN.exe
  2⤵
  PID:6520
- C:\Windows\System\XbSpZVq.exe
  C:\Windows\System\XbSpZVq.exe
  2⤵
  PID:6540
- C:\Windows\System\pECJBVA.exe
  C:\Windows\System\pECJBVA.exe
  2⤵
  PID:6556
- C:\Windows\System\eHaYkjK.exe
  C:\Windows\System\eHaYkjK.exe
  2⤵
  PID:6572
- C:\Windows\System\lqblbrP.exe
  C:\Windows\System\lqblbrP.exe
  2⤵
  PID:6588
- C:\Windows\System\SWdnVAJ.exe
  C:\Windows\System\SWdnVAJ.exe
  2⤵
  PID:6604
- C:\Windows\System\crmgujD.exe
  C:\Windows\System\crmgujD.exe
  2⤵
  PID:6620
- C:\Windows\System\CuRYuQt.exe
  C:\Windows\System\CuRYuQt.exe
  2⤵
  PID:6636
- C:\Windows\System\HGPVRDn.exe
  C:\Windows\System\HGPVRDn.exe
  2⤵
  PID:6656
- C:\Windows\System\BAoDzoz.exe
  C:\Windows\System\BAoDzoz.exe
  2⤵
  PID:6676
- C:\Windows\System\pRNwEpe.exe
  C:\Windows\System\pRNwEpe.exe
  2⤵
  PID:6692
- C:\Windows\System\OwQiDnp.exe
  C:\Windows\System\OwQiDnp.exe
  2⤵
  PID:6708
- C:\Windows\System\ErCtTxP.exe
  C:\Windows\System\ErCtTxP.exe
  2⤵
  PID:6724
- C:\Windows\System\uJYDYzT.exe
  C:\Windows\System\uJYDYzT.exe
  2⤵
  PID:6740
- C:\Windows\System\RadodQw.exe
  C:\Windows\System\RadodQw.exe
  2⤵
  PID:6760
- C:\Windows\System\sNnfFlJ.exe
  C:\Windows\System\sNnfFlJ.exe
  2⤵
  PID:6776
- C:\Windows\System\VjQCQWj.exe
  C:\Windows\System\VjQCQWj.exe
  2⤵
  PID:6796
- C:\Windows\System\FXiWljl.exe
  C:\Windows\System\FXiWljl.exe
  2⤵
  PID:6812
- C:\Windows\System\grminfl.exe
  C:\Windows\System\grminfl.exe
  2⤵
  PID:6828
- C:\Windows\System\FDWAeam.exe
  C:\Windows\System\FDWAeam.exe
  2⤵
  PID:6844
- C:\Windows\System\xkpuOmU.exe
  C:\Windows\System\xkpuOmU.exe
  2⤵
  PID:6860
- C:\Windows\System\zfyLpDA.exe
  C:\Windows\System\zfyLpDA.exe
  2⤵
  PID:6876
- C:\Windows\System\VqMzWYe.exe
  C:\Windows\System\VqMzWYe.exe
  2⤵
  PID:6892
- C:\Windows\System\ixrppAD.exe
  C:\Windows\System\ixrppAD.exe
  2⤵
  PID:6908
- C:\Windows\System\SxdxiZL.exe
  C:\Windows\System\SxdxiZL.exe
  2⤵
  PID:6924
- C:\Windows\System\CuxDLgK.exe
  C:\Windows\System\CuxDLgK.exe
  2⤵
  PID:6940
- C:\Windows\System\sTyuNoI.exe
  C:\Windows\System\sTyuNoI.exe
  2⤵
  PID:6956
- C:\Windows\System\cgojPHJ.exe
  C:\Windows\System\cgojPHJ.exe
  2⤵
  PID:6972
- C:\Windows\System\KLgaBrt.exe
  C:\Windows\System\KLgaBrt.exe
  2⤵
  PID:6988
- C:\Windows\System\hOfIrlY.exe
  C:\Windows\System\hOfIrlY.exe
  2⤵
  PID:7004
- C:\Windows\System\GRMeDsG.exe
  C:\Windows\System\GRMeDsG.exe
  2⤵
  PID:7020
- C:\Windows\System\pTswOhK.exe
  C:\Windows\System\pTswOhK.exe
  2⤵
  PID:7152
- C:\Windows\System\FxWKZpn.exe
  C:\Windows\System\FxWKZpn.exe
  2⤵
  PID:5644
- C:\Windows\System\jFCXzgj.exe
  C:\Windows\System\jFCXzgj.exe
  2⤵
  PID:6204
- C:\Windows\System\sBkDMss.exe
  C:\Windows\System\sBkDMss.exe
  2⤵
  PID:5360
- C:\Windows\System\nXNyHun.exe
  C:\Windows\System\nXNyHun.exe
  2⤵
  PID:6188
- C:\Windows\System\sboVYqh.exe
  C:\Windows\System\sboVYqh.exe
  2⤵
  PID:5632
- C:\Windows\System\egdtQUG.exe
  C:\Windows\System\egdtQUG.exe
  2⤵
  PID:6276
- C:\Windows\System\rgKbMYQ.exe
  C:\Windows\System\rgKbMYQ.exe
  2⤵
  PID:6308
- C:\Windows\System\TRlmDdd.exe
  C:\Windows\System\TRlmDdd.exe
  2⤵
  PID:6372
- C:\Windows\System\aukLxNx.exe
  C:\Windows\System\aukLxNx.exe
  2⤵
  PID:6436
- C:\Windows\System\MZWnncm.exe
  C:\Windows\System\MZWnncm.exe
  2⤵
  PID:6528
- C:\Windows\System\vtkFXrM.exe
  C:\Windows\System\vtkFXrM.exe
  2⤵
  PID:6564
- C:\Windows\System\ELhOPXg.exe
  C:\Windows\System\ELhOPXg.exe
  2⤵
  PID:6600
- C:\Windows\System\kuWPiri.exe
  C:\Windows\System\kuWPiri.exe
  2⤵
  PID:6388
- C:\Windows\System\kVUdRwD.exe
  C:\Windows\System\kVUdRwD.exe
  2⤵
  PID:6288
- C:\Windows\System\iSmTkeV.exe
  C:\Windows\System\iSmTkeV.exe
  2⤵
  PID:6356
- C:\Windows\System\bHoZpVB.exe
  C:\Windows\System\bHoZpVB.exe
  2⤵
  PID:6448
- C:\Windows\System\iQvZCRw.exe
  C:\Windows\System\iQvZCRw.exe
  2⤵
  PID:6580
- C:\Windows\System\QsVGROO.exe
  C:\Windows\System\QsVGROO.exe
  2⤵
  PID:6632
- C:\Windows\System\zoYCYDp.exe
  C:\Windows\System\zoYCYDp.exe
  2⤵
  PID:6700
- C:\Windows\System\nCxJLdS.exe
  C:\Windows\System\nCxJLdS.exe
  2⤵
  PID:6768
- C:\Windows\System\jRqMYuK.exe
  C:\Windows\System\jRqMYuK.exe
  2⤵
  PID:6644
- C:\Windows\System\cobKaKv.exe
  C:\Windows\System\cobKaKv.exe
  2⤵
  PID:6752
- C:\Windows\System\esBAFjw.exe
  C:\Windows\System\esBAFjw.exe
  2⤵
  PID:6720
- C:\Windows\System\NayDLpz.exe
  C:\Windows\System\NayDLpz.exe
  2⤵
  PID:6824
- C:\Windows\System\bmUkXGe.exe
  C:\Windows\System\bmUkXGe.exe
  2⤵
  PID:6872
- C:\Windows\System\atcScIC.exe
  C:\Windows\System\atcScIC.exe
  2⤵
  PID:6936
- C:\Windows\System\vKmRwHx.exe
  C:\Windows\System\vKmRwHx.exe
  2⤵
  PID:6968
- C:\Windows\System\jlhgZPg.exe
  C:\Windows\System\jlhgZPg.exe
  2⤵
  PID:6996
- C:\Windows\System\RQQxNJE.exe
  C:\Windows\System\RQQxNJE.exe
  2⤵
  PID:6916
- C:\Windows\System\HVIQKLF.exe
  C:\Windows\System\HVIQKLF.exe
  2⤵
  PID:6984
- C:\Windows\System\BjQIKuA.exe
  C:\Windows\System\BjQIKuA.exe
  2⤵
  PID:7036
- C:\Windows\System\MraeWdH.exe
  C:\Windows\System\MraeWdH.exe
  2⤵
  PID:7052
- C:\Windows\System\isZTmCI.exe
  C:\Windows\System\isZTmCI.exe
  2⤵
  PID:7068
- C:\Windows\System\OEDlEHC.exe
  C:\Windows\System\OEDlEHC.exe
  2⤵
  PID:7084
- C:\Windows\System\WqCoWjQ.exe
  C:\Windows\System\WqCoWjQ.exe
  2⤵
  PID:7096
- C:\Windows\System\CJgfsaj.exe
  C:\Windows\System\CJgfsaj.exe
  2⤵
  PID:7116
- C:\Windows\System\WZWHcmQ.exe
  C:\Windows\System\WZWHcmQ.exe
  2⤵
  PID:7132
- C:\Windows\System\fuPjktm.exe
  C:\Windows\System\fuPjktm.exe
  2⤵
  PID:7148
- C:\Windows\System\JWjcCoe.exe
  C:\Windows\System\JWjcCoe.exe
  2⤵
  PID:6156
- C:\Windows\System\NRbMvup.exe
  C:\Windows\System\NRbMvup.exe
  2⤵
  PID:6340
- C:\Windows\System\ShAhMFH.exe
  C:\Windows\System\ShAhMFH.exe
  2⤵
  PID:6568
- C:\Windows\System\hlLYKnF.exe
  C:\Windows\System\hlLYKnF.exe
  2⤵
  PID:6416
- C:\Windows\System\TfdXMle.exe
  C:\Windows\System\TfdXMle.exe
  2⤵
  PID:6652
- C:\Windows\System\WaWWhrb.exe
  C:\Windows\System\WaWWhrb.exe
  2⤵
  PID:6688
- C:\Windows\System\fnShlup.exe
  C:\Windows\System\fnShlup.exe
  2⤵
  PID:6904
- C:\Windows\System\IHtRpCY.exe
  C:\Windows\System\IHtRpCY.exe
  2⤵
  PID:6804
- C:\Windows\System\ZdOzeiD.exe
  C:\Windows\System\ZdOzeiD.exe
  2⤵
  PID:6256
- C:\Windows\System\YWMltOR.exe
  C:\Windows\System\YWMltOR.exe
  2⤵
  PID:6432
- C:\Windows\System\FeHsLKq.exe
  C:\Windows\System\FeHsLKq.exe
  2⤵
  PID:6920
- C:\Windows\System\iwLaUnG.exe
  C:\Windows\System\iwLaUnG.exe
  2⤵
  PID:6628
- C:\Windows\System\PapmKCU.exe
  C:\Windows\System\PapmKCU.exe
  2⤵
  PID:7076
- C:\Windows\System\IRkvkEg.exe
  C:\Windows\System\IRkvkEg.exe
  2⤵
  PID:6516
- C:\Windows\System\VaZLTxm.exe
  C:\Windows\System\VaZLTxm.exe
  2⤵
  PID:6672
- C:\Windows\System\wqAqTku.exe
  C:\Windows\System\wqAqTku.exe
  2⤵
  PID:6856
- C:\Windows\System\NRJkxLq.exe
  C:\Windows\System\NRJkxLq.exe
  2⤵
  PID:7064
- C:\Windows\System\suwAADT.exe
  C:\Windows\System\suwAADT.exe
  2⤵
  PID:7124
- C:\Windows\System\UEbQoeg.exe
  C:\Windows\System\UEbQoeg.exe
  2⤵
  PID:6240
- C:\Windows\System\DecbxIU.exe
  C:\Windows\System\DecbxIU.exe
  2⤵
  PID:6272
- C:\Windows\System\XlACDrX.exe
  C:\Windows\System\XlACDrX.exe
  2⤵
  PID:6684
- C:\Windows\System\HrgUEzV.exe
  C:\Windows\System\HrgUEzV.exe
  2⤵
  PID:5732
- C:\Windows\System\CfGZDOh.exe
  C:\Windows\System\CfGZDOh.exe
  2⤵
  PID:6324
- C:\Windows\System\xVwIDMV.exe
  C:\Windows\System\xVwIDMV.exe
  2⤵
  PID:6888
- C:\Windows\System\IjzdVUg.exe
  C:\Windows\System\IjzdVUg.exe
  2⤵
  PID:6292
- C:\Windows\System\oyGxKnS.exe
  C:\Windows\System\oyGxKnS.exe
  2⤵
  PID:6220
- C:\Windows\System\MhaCwoj.exe
  C:\Windows\System\MhaCwoj.exe
  2⤵
  PID:6964
- C:\Windows\System\ENdlSda.exe
  C:\Windows\System\ENdlSda.exe
  2⤵
  PID:6616
- C:\Windows\System\nkVPgAZ.exe
  C:\Windows\System\nkVPgAZ.exe
  2⤵
  PID:6224
- C:\Windows\System\uWJfWAf.exe
  C:\Windows\System\uWJfWAf.exe
  2⤵
  PID:7060
- C:\Windows\System\mJafrhi.exe
  C:\Windows\System\mJafrhi.exe
  2⤵
  PID:1720
- C:\Windows\System\kMNZEkT.exe
  C:\Windows\System\kMNZEkT.exe
  2⤵
  PID:7108
- C:\Windows\System\QNlbEsK.exe
  C:\Windows\System\QNlbEsK.exe
  2⤵
  PID:7180
- C:\Windows\System\FuLsnqL.exe
  C:\Windows\System\FuLsnqL.exe
  2⤵
  PID:7196
- C:\Windows\System\YindFGI.exe
  C:\Windows\System\YindFGI.exe
  2⤵
  PID:7212
- C:\Windows\System\NKNlowd.exe
  C:\Windows\System\NKNlowd.exe
  2⤵
  PID:7228
- C:\Windows\System\VOyUEyL.exe
  C:\Windows\System\VOyUEyL.exe
  2⤵
  PID:7244
- C:\Windows\System\aosLihz.exe
  C:\Windows\System\aosLihz.exe
  2⤵
  PID:7260
- C:\Windows\System\aTWhHyq.exe
  C:\Windows\System\aTWhHyq.exe
  2⤵
  PID:7276
- C:\Windows\System\kLaICRV.exe
  C:\Windows\System\kLaICRV.exe
  2⤵
  PID:7292
- C:\Windows\System\LFijnZB.exe
  C:\Windows\System\LFijnZB.exe
  2⤵
  PID:7308
- C:\Windows\System\HiTvaeY.exe
  C:\Windows\System\HiTvaeY.exe
  2⤵
  PID:7324
- C:\Windows\System\rECADms.exe
  C:\Windows\System\rECADms.exe
  2⤵
  PID:7344
- C:\Windows\System\hQMccyd.exe
  C:\Windows\System\hQMccyd.exe
  2⤵
  PID:7360
- C:\Windows\System\cxxQOfe.exe
  C:\Windows\System\cxxQOfe.exe
  2⤵
  PID:7376
- C:\Windows\System\wBsWNKv.exe
  C:\Windows\System\wBsWNKv.exe
  2⤵
  PID:7392
- C:\Windows\System\PTcJzGj.exe
  C:\Windows\System\PTcJzGj.exe
  2⤵
  PID:7408
- C:\Windows\System\NSwIOLl.exe
  C:\Windows\System\NSwIOLl.exe
  2⤵
  PID:7424
- C:\Windows\System\OlQMwhz.exe
  C:\Windows\System\OlQMwhz.exe
  2⤵
  PID:7440
- C:\Windows\System\JgHvtNw.exe
  C:\Windows\System\JgHvtNw.exe
  2⤵
  PID:7456
- C:\Windows\System\MbbuuNa.exe
  C:\Windows\System\MbbuuNa.exe
  2⤵
  PID:7472
- C:\Windows\System\lhmTHpQ.exe
  C:\Windows\System\lhmTHpQ.exe
  2⤵
  PID:7488
- C:\Windows\System\KoAgjVz.exe
  C:\Windows\System\KoAgjVz.exe
  2⤵
  PID:7504
- C:\Windows\System\MPwKxEk.exe
  C:\Windows\System\MPwKxEk.exe
  2⤵
  PID:7520
- C:\Windows\System\XFeqXOR.exe
  C:\Windows\System\XFeqXOR.exe
  2⤵
  PID:7536
- C:\Windows\System\FyZJyYj.exe
  C:\Windows\System\FyZJyYj.exe
  2⤵
  PID:7552
- C:\Windows\System\oxnzauO.exe
  C:\Windows\System\oxnzauO.exe
  2⤵
  PID:7568
- C:\Windows\System\sdSfnTT.exe
  C:\Windows\System\sdSfnTT.exe
  2⤵
  PID:7584
- C:\Windows\System\XNsLDWo.exe
  C:\Windows\System\XNsLDWo.exe
  2⤵
  PID:7600
- C:\Windows\System\KawKpfH.exe
  C:\Windows\System\KawKpfH.exe
  2⤵
  PID:7616
- C:\Windows\System\jKEyBhO.exe
  C:\Windows\System\jKEyBhO.exe
  2⤵
  PID:7632
- C:\Windows\System\oChiTvy.exe
  C:\Windows\System\oChiTvy.exe
  2⤵
  PID:7648
- C:\Windows\System\QrWxllw.exe
  C:\Windows\System\QrWxllw.exe
  2⤵
  PID:7664
- C:\Windows\System\NByqxFS.exe
  C:\Windows\System\NByqxFS.exe
  2⤵
  PID:7680
- C:\Windows\System\eJQeqzj.exe
  C:\Windows\System\eJQeqzj.exe
  2⤵
  PID:7696
- C:\Windows\System\BOGEKUM.exe
  C:\Windows\System\BOGEKUM.exe
  2⤵
  PID:7712
- C:\Windows\System\ArZdoNt.exe
  C:\Windows\System\ArZdoNt.exe
  2⤵
  PID:7728
- C:\Windows\System\bqvCWcN.exe
  C:\Windows\System\bqvCWcN.exe
  2⤵
  PID:7744
- C:\Windows\System\qHXOfQJ.exe
  C:\Windows\System\qHXOfQJ.exe
  2⤵
  PID:7788
- C:\Windows\System\ELxAPpj.exe
  C:\Windows\System\ELxAPpj.exe
  2⤵
  PID:7804
- C:\Windows\System\YavLSvD.exe
  C:\Windows\System\YavLSvD.exe
  2⤵
  PID:7820
- C:\Windows\System\Lbzmqpg.exe
  C:\Windows\System\Lbzmqpg.exe
  2⤵
  PID:7836
- C:\Windows\System\AAxzPHf.exe
  C:\Windows\System\AAxzPHf.exe
  2⤵
  PID:7852
- C:\Windows\System\Ncurnvs.exe
  C:\Windows\System\Ncurnvs.exe
  2⤵
  PID:7868
- C:\Windows\System\QOtTqka.exe
  C:\Windows\System\QOtTqka.exe
  2⤵
  PID:7884
- C:\Windows\System\JaBDbuU.exe
  C:\Windows\System\JaBDbuU.exe
  2⤵
  PID:7900
- C:\Windows\System\KoWioAH.exe
  C:\Windows\System\KoWioAH.exe
  2⤵
  PID:7916
- C:\Windows\System\ZySnHwP.exe
  C:\Windows\System\ZySnHwP.exe
  2⤵
  PID:7932
- C:\Windows\System\emyEDNT.exe
  C:\Windows\System\emyEDNT.exe
  2⤵
  PID:7948
- C:\Windows\System\RfIoEOA.exe
  C:\Windows\System\RfIoEOA.exe
  2⤵
  PID:7964
- C:\Windows\System\UQiWFNv.exe
  C:\Windows\System\UQiWFNv.exe
  2⤵
  PID:7980
- C:\Windows\System\eQztCxK.exe
  C:\Windows\System\eQztCxK.exe
  2⤵
  PID:7996
- C:\Windows\System\kXwtHwO.exe
  C:\Windows\System\kXwtHwO.exe
  2⤵
  PID:8012
- C:\Windows\System\XmmYHez.exe
  C:\Windows\System\XmmYHez.exe
  2⤵
  PID:8028
- C:\Windows\System\CGMhTdJ.exe
  C:\Windows\System\CGMhTdJ.exe
  2⤵
  PID:8044
- C:\Windows\System\ptvnHFe.exe
  C:\Windows\System\ptvnHFe.exe
  2⤵
  PID:8060
- C:\Windows\System\WZZIBNh.exe
  C:\Windows\System\WZZIBNh.exe
  2⤵
  PID:8076
- C:\Windows\System\yjWSubZ.exe
  C:\Windows\System\yjWSubZ.exe
  2⤵
  PID:8092
- C:\Windows\System\wuNcxqr.exe
  C:\Windows\System\wuNcxqr.exe
  2⤵
  PID:8108
- C:\Windows\System\YzIpclO.exe
  C:\Windows\System\YzIpclO.exe
  2⤵
  PID:6536
- C:\Windows\System\LGtLoNE.exe
  C:\Windows\System\LGtLoNE.exe
  2⤵
  PID:6792
- C:\Windows\System\shgQnVa.exe
  C:\Windows\System\shgQnVa.exe
  2⤵
  PID:7288
- C:\Windows\System\qhjzOcN.exe
  C:\Windows\System\qhjzOcN.exe
  2⤵
  PID:7352
- C:\Windows\System\YmkFWwZ.exe
  C:\Windows\System\YmkFWwZ.exe
  2⤵
  PID:7176
- C:\Windows\System\UmCBJVe.exe
  C:\Windows\System\UmCBJVe.exe
  2⤵
  PID:7236
- C:\Windows\System\mhLIvNQ.exe
  C:\Windows\System\mhLIvNQ.exe
  2⤵
  PID:7300
- C:\Windows\System\vyTHIGF.exe
  C:\Windows\System\vyTHIGF.exe
  2⤵
  PID:7400
- C:\Windows\System\TILdueM.exe
  C:\Windows\System\TILdueM.exe
  2⤵
  PID:7420
- C:\Windows\System\dLaVxRR.exe
  C:\Windows\System\dLaVxRR.exe
  2⤵
  PID:7480
- C:\Windows\System\ljMzmOW.exe
  C:\Windows\System\ljMzmOW.exe
  2⤵
  PID:7484
- C:\Windows\System\IVjZIqS.exe
  C:\Windows\System\IVjZIqS.exe
  2⤵
  PID:7528
- C:\Windows\System\dKStbME.exe
  C:\Windows\System\dKStbME.exe
  2⤵
  PID:7640
- C:\Windows\System\xHJtnJZ.exe
  C:\Windows\System\xHJtnJZ.exe
  2⤵
  PID:7704
- C:\Windows\System\NVZWuqU.exe
  C:\Windows\System\NVZWuqU.exe
  2⤵
  PID:7624
- C:\Windows\System\XEJvyXS.exe
  C:\Windows\System\XEJvyXS.exe
  2⤵
  PID:7688
- C:\Windows\System\MkNYqTD.exe
  C:\Windows\System\MkNYqTD.exe
  2⤵
  PID:7592
- C:\Windows\System\PYhEYBI.exe
  C:\Windows\System\PYhEYBI.exe
  2⤵
  PID:7708
- C:\Windows\System\DjjMsQa.exe
  C:\Windows\System\DjjMsQa.exe
  2⤵
  PID:7756
- C:\Windows\System\ynXtLfu.exe
  C:\Windows\System\ynXtLfu.exe
  2⤵
  PID:7860
- C:\Windows\System\lFglVJp.exe
  C:\Windows\System\lFglVJp.exe
  2⤵
  PID:7956
- C:\Windows\System\ZqkBovZ.exe
  C:\Windows\System\ZqkBovZ.exe
  2⤵
  PID:8020
- C:\Windows\System\HqnxIdr.exe
  C:\Windows\System\HqnxIdr.exe
  2⤵
  PID:8056
- C:\Windows\System\syGgDWD.exe
  C:\Windows\System\syGgDWD.exe
  2⤵
  PID:7812
- C:\Windows\System\hruSLqp.exe
  C:\Windows\System\hruSLqp.exe
  2⤵
  PID:7908
- C:\Windows\System\cApqdWH.exe
  C:\Windows\System\cApqdWH.exe
  2⤵
  PID:8036
- C:\Windows\System\LhIRsch.exe
  C:\Windows\System\LhIRsch.exe
  2⤵
  PID:7876
- C:\Windows\System\WTDPNUh.exe
  C:\Windows\System\WTDPNUh.exe
  2⤵
  PID:7972
- C:\Windows\System\rpDquPK.exe
  C:\Windows\System\rpDquPK.exe
  2⤵
  PID:8140
- C:\Windows\System\iRWDEoP.exe
  C:\Windows\System\iRWDEoP.exe
  2⤵
  PID:8160
- C:\Windows\System\FgcBcKN.exe
  C:\Windows\System\FgcBcKN.exe
  2⤵
  PID:8132
- C:\Windows\System\WkSHABH.exe
  C:\Windows\System\WkSHABH.exe
  2⤵
  PID:8168
- C:\Windows\System\oNImqRT.exe
  C:\Windows\System\oNImqRT.exe
  2⤵
  PID:6352
- C:\Windows\System\fJgdVVD.exe
  C:\Windows\System\fJgdVVD.exe
  2⤵
  PID:6788
- C:\Windows\System\eQFQZeb.exe
  C:\Windows\System\eQFQZeb.exe
  2⤵
  PID:7188
- C:\Windows\System\lkvrPYF.exe
  C:\Windows\System\lkvrPYF.exe
  2⤵
  PID:6852
- C:\Windows\System\NcWnofH.exe
  C:\Windows\System\NcWnofH.exe
  2⤵
  PID:7208
- C:\Windows\System\DnUuTQQ.exe
  C:\Windows\System\DnUuTQQ.exe
  2⤵
  PID:7172
- C:\Windows\System\oxXZNCD.exe
  C:\Windows\System\oxXZNCD.exe
  2⤵
  PID:7464
- C:\Windows\System\kcUFvQZ.exe
  C:\Windows\System\kcUFvQZ.exe
  2⤵
  PID:7672
- C:\Windows\System\KimTQTT.exe
  C:\Windows\System\KimTQTT.exe
  2⤵
  PID:7404
- C:\Windows\System\kWmLcjR.exe
  C:\Windows\System\kWmLcjR.exe
  2⤵
  PID:8052
- C:\Windows\System\xTmBOXL.exe
  C:\Windows\System\xTmBOXL.exe
  2⤵
  PID:7516
- C:\Windows\System\dlejMAQ.exe
  C:\Windows\System\dlejMAQ.exe
  2⤵
  PID:7844
- C:\Windows\System\xVjquhd.exe
  C:\Windows\System\xVjquhd.exe
  2⤵
  PID:7832
- C:\Windows\System\tTepNpg.exe
  C:\Windows\System\tTepNpg.exe
  2⤵
  PID:7660
- C:\Windows\System\bFQCBJw.exe
  C:\Windows\System\bFQCBJw.exe
  2⤵
  PID:7880
- C:\Windows\System\ZIlAsZl.exe
  C:\Windows\System\ZIlAsZl.exe
  2⤵
  PID:8188
- C:\Windows\System\SVmvgor.exe
  C:\Windows\System\SVmvgor.exe
  2⤵
  PID:8176
- C:\Windows\System\xlkcGML.exe
  C:\Windows\System\xlkcGML.exe
  2⤵
  PID:7112
- C:\Windows\System\DsNVrbU.exe
  C:\Windows\System\DsNVrbU.exe
  2⤵
  PID:7432
- C:\Windows\System\eDBJACR.exe
  C:\Windows\System\eDBJACR.exe
  2⤵
  PID:7496
- C:\Windows\System\EQjsCac.exe
  C:\Windows\System\EQjsCac.exe
  2⤵
  PID:7940
- C:\Windows\System\MFsTZaw.exe
  C:\Windows\System\MFsTZaw.exe
  2⤵
  PID:7104
- C:\Windows\System\DuBFfkR.exe
  C:\Windows\System\DuBFfkR.exe
  2⤵
  PID:7384
- C:\Windows\System\CPuJEsK.exe
  C:\Windows\System\CPuJEsK.exe
  2⤵
  PID:6500
- C:\Windows\System\oJmiLEV.exe
  C:\Windows\System\oJmiLEV.exe
  2⤵
  PID:7924
- C:\Windows\System\fesjrUC.exe
  C:\Windows\System\fesjrUC.exe
  2⤵
  PID:7928
- C:\Windows\System\KGMXefh.exe
  C:\Windows\System\KGMXefh.exe
  2⤵
  PID:8200
- C:\Windows\System\rYOAaoy.exe
  C:\Windows\System\rYOAaoy.exe
  2⤵
  PID:8216
- C:\Windows\System\yUijeZd.exe
  C:\Windows\System\yUijeZd.exe
  2⤵
  PID:8232
- C:\Windows\System\HtpiRhA.exe
  C:\Windows\System\HtpiRhA.exe
  2⤵
  PID:8248
- C:\Windows\System\QulwAjZ.exe
  C:\Windows\System\QulwAjZ.exe
  2⤵
  PID:8264
- C:\Windows\System\EgMRgyF.exe
  C:\Windows\System\EgMRgyF.exe
  2⤵
  PID:8280
- C:\Windows\System\MfdcZPW.exe
  C:\Windows\System\MfdcZPW.exe
  2⤵
  PID:8296
- C:\Windows\System\vHcJwtb.exe
  C:\Windows\System\vHcJwtb.exe
  2⤵
  PID:8312
- C:\Windows\System\jAPVcqp.exe
  C:\Windows\System\jAPVcqp.exe
  2⤵
  PID:8328
- C:\Windows\System\mEsqfQS.exe
  C:\Windows\System\mEsqfQS.exe
  2⤵
  PID:8344
- C:\Windows\System\MivYPiw.exe
  C:\Windows\System\MivYPiw.exe
  2⤵
  PID:8360
- C:\Windows\System\XBjtBYG.exe
  C:\Windows\System\XBjtBYG.exe
  2⤵
  PID:8376
- C:\Windows\System\NNvxsBA.exe
  C:\Windows\System\NNvxsBA.exe
  2⤵
  PID:8392
- C:\Windows\System\hXhcumG.exe
  C:\Windows\System\hXhcumG.exe
  2⤵
  PID:8408
- C:\Windows\System\WIctXDN.exe
  C:\Windows\System\WIctXDN.exe
  2⤵
  PID:8424
- C:\Windows\System\dQlhuyI.exe
  C:\Windows\System\dQlhuyI.exe
  2⤵
  PID:8440
- C:\Windows\System\rgXzZuJ.exe
  C:\Windows\System\rgXzZuJ.exe
  2⤵
  PID:8456
- C:\Windows\System\juhyHSp.exe
  C:\Windows\System\juhyHSp.exe
  2⤵
  PID:8472
- C:\Windows\System\ofYwUhK.exe
  C:\Windows\System\ofYwUhK.exe
  2⤵
  PID:8488
- C:\Windows\System\wNRtypM.exe
  C:\Windows\System\wNRtypM.exe
  2⤵
  PID:8504
- C:\Windows\System\jImcgMR.exe
  C:\Windows\System\jImcgMR.exe
  2⤵
  PID:8520
- C:\Windows\System\agUJyuw.exe
  C:\Windows\System\agUJyuw.exe
  2⤵
  PID:8536
- C:\Windows\System\KsbkdlO.exe
  C:\Windows\System\KsbkdlO.exe
  2⤵
  PID:8552
- C:\Windows\System\CvHZaSf.exe
  C:\Windows\System\CvHZaSf.exe
  2⤵
  PID:8568
- C:\Windows\System\lTudckx.exe
  C:\Windows\System\lTudckx.exe
  2⤵
  PID:8584
- C:\Windows\System\IQyifQe.exe
  C:\Windows\System\IQyifQe.exe
  2⤵
  PID:8600
- C:\Windows\System\cxfwkel.exe
  C:\Windows\System\cxfwkel.exe
  2⤵
  PID:8616
- C:\Windows\System\fvKJcDV.exe
  C:\Windows\System\fvKJcDV.exe
  2⤵
  PID:8632
- C:\Windows\System\hIvClzo.exe
  C:\Windows\System\hIvClzo.exe
  2⤵
  PID:8648
- C:\Windows\System\tTcesMo.exe
  C:\Windows\System\tTcesMo.exe
  2⤵
  PID:8664
- C:\Windows\System\WJTMHim.exe
  C:\Windows\System\WJTMHim.exe
  2⤵
  PID:8680
- C:\Windows\System\yNcmJWa.exe
  C:\Windows\System\yNcmJWa.exe
  2⤵
  PID:8700
- C:\Windows\System\HOicxGb.exe
  C:\Windows\System\HOicxGb.exe
  2⤵
  PID:8716
- C:\Windows\System\TFrIhKm.exe
  C:\Windows\System\TFrIhKm.exe
  2⤵
  PID:8732
- C:\Windows\System\BYaKPPq.exe
  C:\Windows\System\BYaKPPq.exe
  2⤵
  PID:8748
- C:\Windows\System\NOXibJU.exe
  C:\Windows\System\NOXibJU.exe
  2⤵
  PID:8768
- C:\Windows\System\tFRcVrv.exe
  C:\Windows\System\tFRcVrv.exe
  2⤵
  PID:8784
- C:\Windows\System\iiMUqTl.exe
  C:\Windows\System\iiMUqTl.exe
  2⤵
  PID:8800
- C:\Windows\System\swvRgPj.exe
  C:\Windows\System\swvRgPj.exe
  2⤵
  PID:8816
- C:\Windows\System\RCXzLFW.exe
  C:\Windows\System\RCXzLFW.exe
  2⤵
  PID:8832
- C:\Windows\System\QqCPLSc.exe
  C:\Windows\System\QqCPLSc.exe
  2⤵
  PID:8852
- C:\Windows\System\XYETbyv.exe
  C:\Windows\System\XYETbyv.exe
  2⤵
  PID:8872
- C:\Windows\System\NSDxNAB.exe
  C:\Windows\System\NSDxNAB.exe
  2⤵
  PID:8888
- C:\Windows\System\SQgGVvs.exe
  C:\Windows\System\SQgGVvs.exe
  2⤵
  PID:8904
- C:\Windows\System\vspSsHP.exe
  C:\Windows\System\vspSsHP.exe
  2⤵
  PID:8920
- C:\Windows\System\efEJETt.exe
  C:\Windows\System\efEJETt.exe
  2⤵
  PID:8936
- C:\Windows\System\jbottpp.exe
  C:\Windows\System\jbottpp.exe
  2⤵
  PID:8952
- C:\Windows\System\XBumNnu.exe
  C:\Windows\System\XBumNnu.exe
  2⤵
  PID:8968
- C:\Windows\System\clhGHQX.exe
  C:\Windows\System\clhGHQX.exe
  2⤵
  PID:8984
- C:\Windows\System\gxPDQbm.exe
  C:\Windows\System\gxPDQbm.exe
  2⤵
  PID:9000
- C:\Windows\System\dqAmxsg.exe
  C:\Windows\System\dqAmxsg.exe
  2⤵
  PID:9016
- C:\Windows\System\muPnjuh.exe
  C:\Windows\System\muPnjuh.exe
  2⤵
  PID:9032
- C:\Windows\System\LdCUzcM.exe
  C:\Windows\System\LdCUzcM.exe
  2⤵
  PID:9048
- C:\Windows\System\lTkyTOw.exe
  C:\Windows\System\lTkyTOw.exe
  2⤵
  PID:9064
- C:\Windows\System\ogEvABF.exe
  C:\Windows\System\ogEvABF.exe
  2⤵
  PID:9080
- C:\Windows\System\ZJCGmaX.exe
  C:\Windows\System\ZJCGmaX.exe
  2⤵
  PID:9096
- C:\Windows\System\ouSAvyZ.exe
  C:\Windows\System\ouSAvyZ.exe
  2⤵
  PID:9112
- C:\Windows\System\DdiIjVz.exe
  C:\Windows\System\DdiIjVz.exe
  2⤵
  PID:9128
- C:\Windows\System\PqoCPST.exe
  C:\Windows\System\PqoCPST.exe
  2⤵
  PID:9144
- C:\Windows\System\ytNGjGx.exe
  C:\Windows\System\ytNGjGx.exe
  2⤵
  PID:9160
- C:\Windows\System\ZMIRquq.exe
  C:\Windows\System\ZMIRquq.exe
  2⤵
  PID:9180
- C:\Windows\System\KeRORuK.exe
  C:\Windows\System\KeRORuK.exe
  2⤵
  PID:9196
- C:\Windows\System\vUgZuqY.exe
  C:\Windows\System\vUgZuqY.exe
  2⤵
  PID:9212
- C:\Windows\System\sdUiPjE.exe
  C:\Windows\System\sdUiPjE.exe
  2⤵
  PID:7256
- C:\Windows\System\oDGfFFv.exe
  C:\Windows\System\oDGfFFv.exe
  2⤵
  PID:7656
- C:\Windows\System\YBmxATE.exe
  C:\Windows\System\YBmxATE.exe
  2⤵
  PID:6840
- C:\Windows\System\VCwQtvC.exe
  C:\Windows\System\VCwQtvC.exe
  2⤵
  PID:7032
- C:\Windows\System\hUDHnkb.exe
  C:\Windows\System\hUDHnkb.exe
  2⤵
  PID:8276
- C:\Windows\System\uMTVwKF.exe
  C:\Windows\System\uMTVwKF.exe
  2⤵
  PID:8340
- C:\Windows\System\pOySxwU.exe
  C:\Windows\System\pOySxwU.exe
  2⤵
  PID:8436
- C:\Windows\System\lgPSACl.exe
  C:\Windows\System\lgPSACl.exe
  2⤵
  PID:8496
- C:\Windows\System\bkLccuk.exe
  C:\Windows\System\bkLccuk.exe
  2⤵
  PID:8084
- C:\Windows\System\JBxeBms.exe
  C:\Windows\System\JBxeBms.exe
  2⤵
  PID:7848
- C:\Windows\System\PGKETJS.exe
  C:\Windows\System\PGKETJS.exe
  2⤵
  PID:8548
- C:\Windows\System\zGeVIXB.exe
  C:\Windows\System\zGeVIXB.exe
  2⤵
  PID:8608
- C:\Windows\System\baRNfbu.exe
  C:\Windows\System\baRNfbu.exe
  2⤵
  PID:8688
- C:\Windows\System\pXUKIqw.exe
  C:\Windows\System\pXUKIqw.exe
  2⤵
  PID:8756
- C:\Windows\System\yQbnXwd.exe
  C:\Windows\System\yQbnXwd.exe
  2⤵
  PID:8644
- C:\Windows\System\BvrtrfJ.exe
  C:\Windows\System\BvrtrfJ.exe
  2⤵
  PID:8740
- C:\Windows\System\bWXqfBk.exe
  C:\Windows\System\bWXqfBk.exe
  2⤵
  PID:8808
- C:\Windows\System\wxaUNAR.exe
  C:\Windows\System\wxaUNAR.exe
  2⤵
  PID:8848
- C:\Windows\System\QSZWAdb.exe
  C:\Windows\System\QSZWAdb.exe
  2⤵
  PID:8900
- C:\Windows\System\AdZsNlS.exe
  C:\Windows\System\AdZsNlS.exe
  2⤵
  PID:9104
- C:\Windows\System\MxmjTMr.exe
  C:\Windows\System\MxmjTMr.exe
  2⤵
  PID:9028
- C:\Windows\System\pJJgVKf.exe
  C:\Windows\System\pJJgVKf.exe
  2⤵
  PID:9156
- C:\Windows\System\LrrcyQJ.exe
  C:\Windows\System\LrrcyQJ.exe
  2⤵
  PID:9152
- C:\Windows\System\QWcnaik.exe
  C:\Windows\System\QWcnaik.exe
  2⤵
  PID:9208
- C:\Windows\System\bfcnRVb.exe
  C:\Windows\System\bfcnRVb.exe
  2⤵
  PID:8164
- C:\Windows\System\VzILlmd.exe
  C:\Windows\System\VzILlmd.exe
  2⤵
  PID:7736
- C:\Windows\System\frYyxwG.exe
  C:\Windows\System\frYyxwG.exe
  2⤵
  PID:8256
- C:\Windows\System\ldttVFy.exe
  C:\Windows\System\ldttVFy.exe
  2⤵
  PID:8320
- C:\Windows\System\SvlveLe.exe
  C:\Windows\System\SvlveLe.exe
  2⤵
  PID:8592
- C:\Windows\System\URUmptB.exe
  C:\Windows\System\URUmptB.exe
  2⤵
  PID:8480
- C:\Windows\System\YNmJRpY.exe
  C:\Windows\System\YNmJRpY.exe
  2⤵
  PID:8512
- C:\Windows\System\UhtJFDK.exe
  C:\Windows\System\UhtJFDK.exe
  2⤵
  PID:7448
- C:\Windows\System\ySOAaMP.exe
  C:\Windows\System\ySOAaMP.exe
  2⤵
  PID:8724
- C:\Windows\System\VWAAKFa.exe
  C:\Windows\System\VWAAKFa.exe
  2⤵
  PID:8712
- C:\Windows\System\gtNJElf.exe
  C:\Windows\System\gtNJElf.exe
  2⤵
  PID:8692
- C:\Windows\System\qPwcpWw.exe
  C:\Windows\System\qPwcpWw.exe
  2⤵
  PID:8796
- C:\Windows\System\tuCRhDA.exe
  C:\Windows\System\tuCRhDA.exe
  2⤵
  PID:8776
- C:\Windows\System\JInqBBp.exe
  C:\Windows\System\JInqBBp.exe
  2⤵
  PID:8860
- C:\Windows\System\pxeDdSN.exe
  C:\Windows\System\pxeDdSN.exe
  2⤵
  PID:8912
- C:\Windows\System\ScYTNmO.exe
  C:\Windows\System\ScYTNmO.exe
  2⤵
  PID:8944
- C:\Windows\System\GXKOCUc.exe
  C:\Windows\System\GXKOCUc.exe
  2⤵
  PID:9012
- C:\Windows\System\lIezdhy.exe
  C:\Windows\System\lIezdhy.exe
  2⤵
  PID:8960
- C:\Windows\System\qqHbGtZ.exe
  C:\Windows\System\qqHbGtZ.exe
  2⤵
  PID:8928
- C:\Windows\System\rwkASsR.exe
  C:\Windows\System\rwkASsR.exe
  2⤵
  PID:7628
- C:\Windows\System\eEqRtbb.exe
  C:\Windows\System\eEqRtbb.exe
  2⤵
  PID:9188
- C:\Windows\System\zhNKxAu.exe
  C:\Windows\System\zhNKxAu.exe
  2⤵
  PID:8464
- C:\Windows\System\qbLuyAv.exe
  C:\Windows\System\qbLuyAv.exe
  2⤵
  PID:8372
- C:\Windows\System\wrgSAMg.exe
  C:\Windows\System\wrgSAMg.exe
  2⤵
  PID:9192
- C:\Windows\System\kZieDdx.exe
  C:\Windows\System\kZieDdx.exe
  2⤵
  PID:8240
- C:\Windows\System\HaLHJLU.exe
  C:\Windows\System\HaLHJLU.exe
  2⤵
  PID:8404
- C:\Windows\System\FQKPbzA.exe
  C:\Windows\System\FQKPbzA.exe
  2⤵
  PID:8272
- C:\Windows\System\vQmnhwN.exe
  C:\Windows\System\vQmnhwN.exe
  2⤵
  PID:8152
- C:\Windows\System\AzmzPEC.exe
  C:\Windows\System\AzmzPEC.exe
  2⤵
  PID:8124
- C:\Windows\System\PvRLDgf.exe
  C:\Windows\System\PvRLDgf.exe
  2⤵
  PID:8676
- C:\Windows\System\ErmGBpB.exe
  C:\Windows\System\ErmGBpB.exe
  2⤵
  PID:8292
- C:\Windows\System\mZrhajT.exe
  C:\Windows\System\mZrhajT.exe
  2⤵
  PID:8976
- C:\Windows\System\AFvhTCn.exe
  C:\Windows\System\AFvhTCn.exe
  2⤵
  PID:8932
- C:\Windows\System\UoCZYfc.exe
  C:\Windows\System\UoCZYfc.exe
  2⤵
  PID:9176
- C:\Windows\System\YNQtFPd.exe
  C:\Windows\System\YNQtFPd.exe
  2⤵
  PID:8432
- C:\Windows\System\zgcJngr.exe
  C:\Windows\System\zgcJngr.exe
  2⤵
  PID:8388
- C:\Windows\System\NsOcGOd.exe
  C:\Windows\System\NsOcGOd.exe
  2⤵
  PID:8628
- C:\Windows\System\sfAELEP.exe
  C:\Windows\System\sfAELEP.exe
  2⤵
  PID:7608
- C:\Windows\System\AmJjqak.exe
  C:\Windows\System\AmJjqak.exe
  2⤵
  PID:8640
- C:\Windows\System\blPYIxi.exe
  C:\Windows\System\blPYIxi.exe
  2⤵
  PID:9092
- C:\Windows\System\gsIiYEv.exe
  C:\Windows\System\gsIiYEv.exe
  2⤵
  PID:9120
- C:\Windows\System\kvfUtuQ.exe
  C:\Windows\System\kvfUtuQ.exe
  2⤵
  PID:8352
- C:\Windows\System\BcHZMVA.exe
  C:\Windows\System\BcHZMVA.exe
  2⤵
  PID:8336
- C:\Windows\System\TJKWhLo.exe
  C:\Windows\System\TJKWhLo.exe
  2⤵
  PID:7268
- C:\Windows\System\LMTbZUB.exe
  C:\Windows\System\LMTbZUB.exe
  2⤵
  PID:8780
- C:\Windows\System\JIpdDqw.exe
  C:\Windows\System\JIpdDqw.exe
  2⤵
  PID:9024
- C:\Windows\System\JNvFiwo.exe
  C:\Windows\System\JNvFiwo.exe
  2⤵
  PID:8824
- C:\Windows\System\vMiQmko.exe
  C:\Windows\System\vMiQmko.exe
  2⤵
  PID:8560
- C:\Windows\System\pRmMNmy.exe
  C:\Windows\System\pRmMNmy.exe
  2⤵
  PID:7752
- C:\Windows\System\ltjZgPa.exe
  C:\Windows\System\ltjZgPa.exe
  2⤵
  PID:9220
- C:\Windows\System\FphJlqJ.exe
  C:\Windows\System\FphJlqJ.exe
  2⤵
  PID:9236
- C:\Windows\System\NWsCiOY.exe
  C:\Windows\System\NWsCiOY.exe
  2⤵
  PID:9252
- C:\Windows\System\vpBIZeV.exe
  C:\Windows\System\vpBIZeV.exe
  2⤵
  PID:9268
- C:\Windows\System\lTrevTz.exe
  C:\Windows\System\lTrevTz.exe
  2⤵
  PID:9284
- C:\Windows\System\pWUvKkG.exe
  C:\Windows\System\pWUvKkG.exe
  2⤵
  PID:9300
- C:\Windows\System\ZvcwqEF.exe
  C:\Windows\System\ZvcwqEF.exe
  2⤵
  PID:9316
- C:\Windows\System\PTYRBSR.exe
  C:\Windows\System\PTYRBSR.exe
  2⤵
  PID:9332
- C:\Windows\System\MPASNkH.exe
  C:\Windows\System\MPASNkH.exe
  2⤵
  PID:9348
- C:\Windows\System\svGWIJB.exe
  C:\Windows\System\svGWIJB.exe
  2⤵
  PID:9364
- C:\Windows\System\cTiKoig.exe
  C:\Windows\System\cTiKoig.exe
  2⤵
  PID:9380
- C:\Windows\System\ovxxPIp.exe
  C:\Windows\System\ovxxPIp.exe
  2⤵
  PID:9396
- C:\Windows\System\woRwAnc.exe
  C:\Windows\System\woRwAnc.exe
  2⤵
  PID:9412
- C:\Windows\System\DvaoMAb.exe
  C:\Windows\System\DvaoMAb.exe
  2⤵
  PID:9432
- C:\Windows\System\XCSBNIm.exe
  C:\Windows\System\XCSBNIm.exe
  2⤵
  PID:9452
- C:\Windows\System\XfKWBiQ.exe
  C:\Windows\System\XfKWBiQ.exe
  2⤵
  PID:9468
- C:\Windows\System\gUSCSun.exe
  C:\Windows\System\gUSCSun.exe
  2⤵
  PID:9492
- C:\Windows\System\rUilCli.exe
  C:\Windows\System\rUilCli.exe
  2⤵
  PID:9508
- C:\Windows\System\RRwPaad.exe
  C:\Windows\System\RRwPaad.exe
  2⤵
  PID:9524
- C:\Windows\System\xoBtPAi.exe
  C:\Windows\System\xoBtPAi.exe
  2⤵
  PID:9540
- C:\Windows\System\jDzcfnh.exe
  C:\Windows\System\jDzcfnh.exe
  2⤵
  PID:9560
- C:\Windows\System\yCjJGAh.exe
  C:\Windows\System\yCjJGAh.exe
  2⤵
  PID:9580
- C:\Windows\System\KoZeiEq.exe
  C:\Windows\System\KoZeiEq.exe
  2⤵
  PID:9596
- C:\Windows\System\qHrjvTR.exe
  C:\Windows\System\qHrjvTR.exe
  2⤵
  PID:9612
- C:\Windows\System\LedhhzI.exe
  C:\Windows\System\LedhhzI.exe
  2⤵
  PID:9628
- C:\Windows\System\uflRRos.exe
  C:\Windows\System\uflRRos.exe
  2⤵
  PID:9644
- C:\Windows\System\ZSmeXoH.exe
  C:\Windows\System\ZSmeXoH.exe
  2⤵
  PID:9660
- C:\Windows\System\ibjqaER.exe
  C:\Windows\System\ibjqaER.exe
  2⤵
  PID:9676
- C:\Windows\System\CFigrby.exe
  C:\Windows\System\CFigrby.exe
  2⤵
  PID:9692
- C:\Windows\System\XIXmQvq.exe
  C:\Windows\System\XIXmQvq.exe
  2⤵
  PID:9708
- C:\Windows\System\QHeAYII.exe
  C:\Windows\System\QHeAYII.exe
  2⤵
  PID:9724
- C:\Windows\System\ZsUjupT.exe
  C:\Windows\System\ZsUjupT.exe
  2⤵
  PID:9740
- C:\Windows\System\UmmUTRK.exe
  C:\Windows\System\UmmUTRK.exe
  2⤵
  PID:9756
- C:\Windows\System\iWLqsjK.exe
  C:\Windows\System\iWLqsjK.exe
  2⤵
  PID:9776
- C:\Windows\System\kqQkFdi.exe
  C:\Windows\System\kqQkFdi.exe
  2⤵
  PID:9792
- C:\Windows\System\GDVQzeW.exe
  C:\Windows\System\GDVQzeW.exe
  2⤵
  PID:9812
- C:\Windows\System\PUnaRtC.exe
  C:\Windows\System\PUnaRtC.exe
  2⤵
  PID:9828
- C:\Windows\System\haeJpcC.exe
  C:\Windows\System\haeJpcC.exe
  2⤵
  PID:9844
- C:\Windows\System\bsOWOTR.exe
  C:\Windows\System\bsOWOTR.exe
  2⤵
  PID:9860
- C:\Windows\System\IYtjKNd.exe
  C:\Windows\System\IYtjKNd.exe
  2⤵
  PID:9880
- C:\Windows\System\UIxWooi.exe
  C:\Windows\System\UIxWooi.exe
  2⤵
  PID:9896
- C:\Windows\System\WwaeMHx.exe
  C:\Windows\System\WwaeMHx.exe
  2⤵
  PID:9916
- C:\Windows\System\oSqdeLb.exe
  C:\Windows\System\oSqdeLb.exe
  2⤵
  PID:9932
- C:\Windows\System\XqaibBq.exe
  C:\Windows\System\XqaibBq.exe
  2⤵
  PID:9948
- C:\Windows\System\ZgOkqce.exe
  C:\Windows\System\ZgOkqce.exe
  2⤵
  PID:9964
- C:\Windows\System\VPpvFWI.exe
  C:\Windows\System\VPpvFWI.exe
  2⤵
  PID:10016
- C:\Windows\System\lYwnzdM.exe
  C:\Windows\System\lYwnzdM.exe
  2⤵
  PID:10032
- C:\Windows\System\hhgERJK.exe
  C:\Windows\System\hhgERJK.exe
  2⤵
  PID:10048
- C:\Windows\System\CKVCiLx.exe
  C:\Windows\System\CKVCiLx.exe
  2⤵
  PID:10064
- C:\Windows\System\azHtxyi.exe
  C:\Windows\System\azHtxyi.exe
  2⤵
  PID:10080
- C:\Windows\System\HKAqNMt.exe
  C:\Windows\System\HKAqNMt.exe
  2⤵
  PID:10096
- C:\Windows\System\VoSVtLt.exe
  C:\Windows\System\VoSVtLt.exe
  2⤵
  PID:10116
- C:\Windows\System\kIiqKOb.exe
  C:\Windows\System\kIiqKOb.exe
  2⤵
  PID:10132
- C:\Windows\System\GtYWkEI.exe
  C:\Windows\System\GtYWkEI.exe
  2⤵
  PID:10148
- C:\Windows\System\sooWQkU.exe
  C:\Windows\System\sooWQkU.exe
  2⤵
  PID:10164
- C:\Windows\System\THnkaLU.exe
  C:\Windows\System\THnkaLU.exe
  2⤵
  PID:10180
- C:\Windows\System\OwgudpG.exe
  C:\Windows\System\OwgudpG.exe
  2⤵
  PID:10196
- C:\Windows\System\rxttTch.exe
  C:\Windows\System\rxttTch.exe
  2⤵
  PID:10212
- C:\Windows\System\LQYBGtw.exe
  C:\Windows\System\LQYBGtw.exe
  2⤵
  PID:10228
- C:\Windows\System\CjVWFoH.exe
  C:\Windows\System\CjVWFoH.exe
  2⤵
  PID:9124
- C:\Windows\System\JmGkpqL.exe
  C:\Windows\System\JmGkpqL.exe
  2⤵
  PID:9276
- C:\Windows\System\UgEtAnu.exe
  C:\Windows\System\UgEtAnu.exe
  2⤵
  PID:9312
- C:\Windows\System\RxgMPDO.exe
  C:\Windows\System\RxgMPDO.exe
  2⤵
  PID:9376
- C:\Windows\System\WyQxvYO.exe
  C:\Windows\System\WyQxvYO.exe
  2⤵
  PID:8516
- C:\Windows\System\oxFpHTh.exe
  C:\Windows\System\oxFpHTh.exe
  2⤵
  PID:7332
- C:\Windows\System\bKmFueE.exe
  C:\Windows\System\bKmFueE.exe
  2⤵
  PID:8564
- C:\Windows\System\VKOpJuE.exe
  C:\Windows\System\VKOpJuE.exe
  2⤵
  PID:9260
- C:\Windows\System\MGTVdeI.exe
  C:\Windows\System\MGTVdeI.exe
  2⤵
  PID:9324
- C:\Windows\System\GJXBsNC.exe
  C:\Windows\System\GJXBsNC.exe
  2⤵
  PID:9444
- C:\Windows\System\DvlANHs.exe
  C:\Windows\System\DvlANHs.exe
  2⤵
  PID:9420
- C:\Windows\System\BCuxjtd.exe
  C:\Windows\System\BCuxjtd.exe
  2⤵
  PID:9476
- C:\Windows\System\PMWgsmB.exe
  C:\Windows\System\PMWgsmB.exe
  2⤵
  PID:9516
- C:\Windows\System\mYWSeHG.exe
  C:\Windows\System\mYWSeHG.exe
  2⤵
  PID:9504
- C:\Windows\System\mDZciti.exe
  C:\Windows\System\mDZciti.exe
  2⤵
  PID:9556
- C:\Windows\System\CxnwLuf.exe
  C:\Windows\System\CxnwLuf.exe
  2⤵
  PID:9576
- C:\Windows\System\RzqiKEX.exe
  C:\Windows\System\RzqiKEX.exe
  2⤵
  PID:9652
- C:\Windows\System\gOrnPBR.exe
  C:\Windows\System\gOrnPBR.exe
  2⤵
  PID:9716
- C:\Windows\System\yTUheOq.exe
  C:\Windows\System\yTUheOq.exe
  2⤵
  PID:9608
- C:\Windows\System\ykSbMFn.exe
  C:\Windows\System\ykSbMFn.exe
  2⤵
  PID:9704
- C:\Windows\System\FjLbVuM.exe
  C:\Windows\System\FjLbVuM.exe
  2⤵
  PID:9700
- C:\Windows\System\JEXiEVC.exe
  C:\Windows\System\JEXiEVC.exe
  2⤵
  PID:9784
- C:\Windows\System\vnzvaeN.exe
  C:\Windows\System\vnzvaeN.exe
  2⤵
  PID:9856
- C:\Windows\System\gVVqAJK.exe
  C:\Windows\System\gVVqAJK.exe
  2⤵
  PID:9800
- C:\Windows\System\xUcFbgG.exe
  C:\Windows\System\xUcFbgG.exe
  2⤵
  PID:9868
- C:\Windows\System\bMcOkZx.exe
  C:\Windows\System\bMcOkZx.exe
  2⤵
  PID:9804
- C:\Windows\System\HYIqwdT.exe
  C:\Windows\System\HYIqwdT.exe
  2⤵
  PID:9924
- C:\Windows\System\ZUHdmhG.exe
  C:\Windows\System\ZUHdmhG.exe
  2⤵
  PID:9976
- C:\Windows\System\gBwatZI.exe
  C:\Windows\System\gBwatZI.exe
  2⤵
  PID:9996
- C:\Windows\System\HPFcHzb.exe
  C:\Windows\System\HPFcHzb.exe
  2⤵
  PID:10000
- C:\Windows\System\xDDwdvk.exe
  C:\Windows\System\xDDwdvk.exe
  2⤵
  PID:10028
- C:\Windows\System\zZcKSXH.exe
  C:\Windows\System\zZcKSXH.exe
  2⤵
  PID:10092
- C:\Windows\System\nfdXRuV.exe
  C:\Windows\System\nfdXRuV.exe
  2⤵
  PID:10076
- C:\Windows\System\EQkostO.exe
  C:\Windows\System\EQkostO.exe
  2⤵
  PID:10112
- C:\Windows\System\TKYXQvl.exe
  C:\Windows\System\TKYXQvl.exe
  2⤵
  PID:10160
- C:\Windows\System\eMKgeXy.exe
  C:\Windows\System\eMKgeXy.exe
  2⤵
  PID:10192
- C:\Windows\System\PRWtGoU.exe
  C:\Windows\System\PRWtGoU.exe
  2⤵
  PID:9248
- C:\Windows\System\KBRHGos.exe
  C:\Windows\System\KBRHGos.exe
  2⤵
  PID:9388
- C:\Windows\System\SRpzkGH.exe
  C:\Windows\System\SRpzkGH.exe
  2⤵
  PID:8448
- C:\Windows\System\jIshQFh.exe
  C:\Windows\System\jIshQFh.exe
  2⤵
  PID:9592
- C:\Windows\System\TLRRtuF.exe
  C:\Windows\System\TLRRtuF.exe
  2⤵
  PID:10236
- C:\Windows\System\ApaFvWV.exe
  C:\Windows\System\ApaFvWV.exe
  2⤵
  PID:9620
- C:\Windows\System\OGxEERr.exe
  C:\Windows\System\OGxEERr.exe
  2⤵
  PID:9668
- C:\Windows\System\xcBBWWb.exe
  C:\Windows\System\xcBBWWb.exe
  2⤵
  PID:9404
- C:\Windows\System\HfpVxkA.exe
  C:\Windows\System\HfpVxkA.exe
  2⤵
  PID:9772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BHeEUVK.exe

Filesize
1.9MB

MD5
4f8d846a1efbfbc30a7fc669c3475759

SHA1
6c4d8d216ddc553fe5444bf68d5b8888b71fc4eb

SHA256
78034dfa7900392c5a0dee78f58139e6c99468c41d0e8bccb8f491e2c088e53a

SHA512
1c34e39dd60ac10efbb3234fd1a9f1250beb3421dc557274a0c15d223fa22237331faaf49cc2df47eac417d66a8e8a3d58820fc382c7fc232712f6e52407dbd7

Download Submit
C:\Windows\system\COBCETt.exe

Filesize
1.9MB

MD5
35005d23b91e174ad8926fe03ca1cbd1

SHA1
a1ecacc7296534278707da5ffbf9bda79233e72c

SHA256
4e338ad158dcf280641d0dc0a69f10bd4c72476d2eec3872b6ece3a85843fd27

SHA512
c6b9ca751aff8f44fa7e07888d1739bf520426c6eaf7a1b5e75a0c0116a5e6c7e14b14072b053a81d31e89b95138ced5b13b0472f4b78553d267949ed8c78d8a

Download Submit
C:\Windows\system\HnkydMk.exe

Filesize
1.9MB

MD5
c213492f0d22a495ba02375f17149cd2

SHA1
8dd88bd5f07306e98e2ffa62e20343f2d368d2ad

SHA256
ea06f9f215ab88526dd13212aaed7c420a8750d1c84432ea376b021049f549e6

SHA512
744a5c1026bf64503c76fd510b0d9c064b3291972ddb3263cc4f84335bb6242c607ea51e7fd9a07a9f76186384b5b9df9086527657cec4c55b233d30bc698fd2

Download Submit
C:\Windows\system\KLBbNho.exe

Filesize
1.9MB

MD5
08b6f7043b7b80d45887f5920aeec98e

SHA1
cdd4b57ac64685e5c32f3b3dcc945ad281a4e6f0

SHA256
8180685bcae30f624a5bf376f755a733b857f96fc409db1d98ceaa4317091996

SHA512
ed31e115b2165fb0b93f7b1cdabbd4c5ef058f601236066972d1bebb3b7c4b0c508c42b14fac49ca2af8d89fc5b572d50373574466f8db3b9127822c03c586b2

Download Submit
C:\Windows\system\KQvDeTa.exe

Filesize
1.9MB

MD5
2ca2299d11e1b78a3ffea77ace543344

SHA1
4ef1eff7ebc463a5c1c8a70df7536eb0c23fc3c9

SHA256
045d12931b38ca290c465215bba4c0fd815804cb94696a72bf0c431679ed04c7

SHA512
5fec1be51f18555cfec5628b78ba1922bf640cddb95e860724ac0ffdc1d90424353ed1c9f6f5c5a4f94c82ff02128c96d26341e898f1f0d8c2008a18ea7f8b00

Download Submit
C:\Windows\system\PrqNcVK.exe

Filesize
1.9MB

MD5
906348b272baeee098de000b46fbdcaf

SHA1
2e469207bd73e96e19589e6d19eb0a0226d48ba1

SHA256
36517c7e2b7433d722788c82aea8bf00332e5215ac842516a3f1ebe9926544c2

SHA512
681274c2c8d761ca6edbb24fc113dfb6de5e5329b2d2744f70da3e269edd26f3f5164d04167ccd9b0f2e55ed5434f557b694a0a838c44484181e8a5157022ef9

Download Submit
C:\Windows\system\QlXvdqH.exe

Filesize
1.9MB

MD5
f0a95f57597798702755a819606f258b

SHA1
95008b4c52e89ed8cf34c73bc405505bad0480e3

SHA256
d0c43cc1374c058602defd058ca22209d1aa540913d99624c6a2481e4b2c21df

SHA512
14ff1ac92b0af47b8f12a0e4b42fd3abef09e95bca0dc93efa1bab09f438eb77462cbe9dedb81180e6de653370dd48fc7f891dd44b99fa8231a404584cbe17e5

Download Submit
C:\Windows\system\VSQKKqv.exe

Filesize
1.9MB

MD5
88754d5aaee9e0cdc3737240bc511a7a

SHA1
37dafadfeb9a7f1d10cbb7deb576385e2025831e

SHA256
109dc1fe9cb5987fa8d9a397d8aae313ed685cb8d62fa9408b5225e23882578d

SHA512
6ab258cfa2b017d4b17771ba38a18e40a4ca7f996f3a4fa81c9a0f679b3bc23b9df8669c0e0d248af5a6e85b9c008eb0ebc6bde5369838577782a6e9ae92d733

Download Submit
C:\Windows\system\WRuVpVK.exe

Filesize
1.9MB

MD5
04114172cb037ded644d4a02c79ed7cf

SHA1
b7271d92728131be82eff6dd571cd777ea1a66b9

SHA256
36370c72fdf820ffc7a77afabdcbad6042adb506eeb3c8f8f57fcf435a5f77c5

SHA512
fe589c9732c304453d7ccab880e615e7afdaede40c6db35085586e569398c9e3bddace88625b6a73a9ff503edd9cae605b7687bb4ee04cba039d881845afe24a

Download Submit
C:\Windows\system\WvmNiyO.exe

Filesize
1.9MB

MD5
83cba4dd361e7004ef01ce15fb0ced47

SHA1
8e591214de8a83b8bdead3384ed38d810c38db39

SHA256
c08be0b1d119c7b64621972841ad074ce68f5ec51dff4e3e7fa22b7e184eb404

SHA512
ca288fd154f00b97f108ddd4fbca4aacafcd618dae527e05d8d6dece77df0bbd94394f651774de5c13e6f40028d3a9f79fce3362d5987e4a29a7c9b928751a11

Download Submit
C:\Windows\system\XBnjbsZ.exe

Filesize
1.9MB

MD5
37d1a1a58cc44e58b351459f42ba200e

SHA1
338daa360bc83ab50834b9cc72549b0d67a8bd17

SHA256
02f1dfa775ff0faf618d495d62e94c2c32faf13df9177ee623e028442739b44d

SHA512
1ed66197d588a21c380325a2deaee56d1559366a1b674a666d0a088c2fe97b5103757113fef3c34d1868dce0aa85233213ba157ff4acfaead447413144675694

Download Submit
C:\Windows\system\XxPwRFI.exe

Filesize
1.9MB

MD5
35f210f554907b0df0e6ad5bafb538cf

SHA1
4fd9e4d79833cb9d88c1802114f9820d6de8ed72

SHA256
bf53da2887c8a90d17611603ef7e2e422ec1d967172f19e487dc29f84bc04d77

SHA512
11fc4d10ce46b154c243048d1c1a6fbb5d89feadadb83b4bfa8cc1701ea638a690f19ba58fb9aeb4c9e729fab7db9d1f257ca6e788124ab25dbd3e718705d4d1

Download Submit
C:\Windows\system\YZoNlYX.exe

Filesize
1.9MB

MD5
bfddc4783a086ab5192790ecabea0452

SHA1
272b3d4ff52080e8436b3ee3e946f43525385874

SHA256
c3391475878559529555c2eb4e169242c7f6224430d8721c2150f59f98dd3bd7

SHA512
7ceecf95612cd0121086c5d6fddd5c2218ead94942bc33cd00269ea3991a553f76ece2ec97678c87f6743822422f714d5a13d4d9f06212023c576021694225dc

Download Submit
C:\Windows\system\aVyDufh.exe

Filesize
1.9MB

MD5
4bfeba13553d6bff6b9924e35937ea55

SHA1
c4a95369ba64f178bd9554024f23ee457bfaec0d

SHA256
c998b12a8d384637b4f50340a3e86be1ff3ef810fe4703043d1370bb020a3bda

SHA512
95704e03f923c57c706cd1127c67b1066005a0ddee90a98df066a31b571bac05144b9f8c9f3837f5a5de8a0ce3187b4872729119337b4e7bbf4842450640d5e6

Download Submit
C:\Windows\system\bAencSX.exe

Filesize
1.9MB

MD5
fb39218ead7e645341d39dfab4f2ee5c

SHA1
48c8e9a9544b525adb509ff7515d13f3197a76af

SHA256
6e819c5e0d45f1a07fdae2132320a0488d709fce089d8bd42e6acf88b4be69f2

SHA512
11fd222b5f32df849e3eaba84d54a3997892b1b5118af76b2163333e1371811f032bc2e3200c62560e08113625903a1dc1b7273556ca1c6571145f62415bf5a0

Download Submit
C:\Windows\system\iBXFSIO.exe

Filesize
1.9MB

MD5
a6a578ea71c779738d2a4514d4738502

SHA1
7b1d2b6deb5070d99d3d578ab8f5a4aa5ac25bec

SHA256
1cf11f41fc05090a8bee133447e8460b0a196f6a6a3e21ad6b9e50c160025784

SHA512
be4911d46306ae5d3864078c407ea5ff6b4fe4d3bd87815ac0305a971e2b86212567eca96935200275cdc642fbf7cd0f29e9dbd8b165712f69c3d1d940124874

Download Submit
C:\Windows\system\ntbXIjx.exe

Filesize
1.9MB

MD5
929d01985fc1a7b4e7813e89c9f67892

SHA1
b40158e7bbba0c136e78463a211bf2c6ac6fa0cc

SHA256
7ff62937e708566770a452bb7a93475b132f035d7ae3f8bc907fe87efc90aff5

SHA512
28b559f0594e44d59711cf10196806690be10d1cd2acda817bd140689936a0ad6b4ed8b0458f326d52e07085dea760f4479a86205ef84a30ea762f154e809a25

Download Submit
C:\Windows\system\qFACTCS.exe

Filesize
1.9MB

MD5
58ed25a779fb95fa8a9944f8bd8831e0

SHA1
42a2b365072be7e8d8359529e381544510f89e2d

SHA256
276fa970e641b8b95732d27ad5a7a60adfa8db1df98331ed6f55b02a2d670c3f

SHA512
0d44d9884491cbd6b751fce8896d3bd15020d51c39d011b7c68a17e6d4e45ad65fe969d84e8352830aeebb41ec6c93a71f9a9ef2c30ee8b2bf860b341fd145d5

Download Submit
C:\Windows\system\tSvDVgW.exe

Filesize
1.9MB

MD5
a85182ee2e788e0dc4d9ca139358084a

SHA1
a6c47ae39bdbd10871ae86a7692ce0c3e4330d13

SHA256
b955a599a95ca46eb59f4441d07ad5ee895ad10e1d0beccdcb7731b70e2057a9

SHA512
bec23def47f8bf4d4905334d68b4a78771ee24da6782442292c3edcbe42509b434fad9ccb23bcfeba265b5d75b53ef693fa825fa0c78c1bb5a4fcdac4ab81881

Download Submit
C:\Windows\system\uwnnBoH.exe

Filesize
1.9MB

MD5
261d610743e6b4c319c446f2f057b539

SHA1
fe752c111d56348894ac7f8b8621372f1e0de0b8

SHA256
1a322badb524ba80726ade9f154be4c4fd4ab33f28c9d3cf437c84cee36c5e67

SHA512
3594e46d00bf0968178e6d1ef783a39a6811e94385c7f11b7ff9faabcaad2df602c039babc17da704d48ca1b654d5cd1adb6fc7c9f5b2514befffb08a7ff6b1f

Download Submit
\Windows\system\CnaeJGP.exe

Filesize
1.9MB

MD5
5322327c4d812d0e22d3312d8f23d5ee

SHA1
34c4c729276db3d66fb5a980ec61278b54be878b

SHA256
1fab6271e6c4cebf39ed08b9be27706343d3f1d7f3007cb4f81f9f9b98627265

SHA512
e3c6ba91bf3b92dddc6e17495bc284ed1dac173a2f946f0141bf49f5727c02c2214dedbd754c7d52b859255333d913b22788d4cdd21ec0265edf006d8a90814c

Download Submit
\Windows\system\HlUPmEY.exe

Filesize
1.9MB

MD5
dad466eab4c9a027a916d0958df4dfa5

SHA1
df7c2b64980f6ca17757a890e1d9c3c4b17f8298

SHA256
886437357bfa6999299061d0a53226945c0d542bf8e58d65067854490bfdff60

SHA512
104da8b6d564822a5dabc216091d748ffd0cb2a85ba2134fa002e04dc2b824bab009d75ea3ce93cd3bc76e7038ae020a6b66caff91f5901e57615e40d55c0f9d

Download Submit
\Windows\system\OnokzHq.exe

Filesize
1.9MB

MD5
c72f994b01b30921d733d8a6092d8540

SHA1
20df25756ef97a6d2426dfb08ffcb9ceb5dd4409

SHA256
6dbb13ea51ec2b1ff1cdac67226ddc519ba12f4bb67f49c28b59794bf598285e

SHA512
13d4eafe7d367e364731a6d2b2f242aa2ce1ded403e93518a458a127099d9b64eaf44a3a0e0aa6f6b6dae0ae5dbb0630c74251632a1feda8889235d770db5378

Download Submit
\Windows\system\PJyJNOm.exe

Filesize
1.9MB

MD5
e800f2605d983c29c71c58744767efdb

SHA1
a1f77c140a16946bbd9c67f71703a9f10dde95fc

SHA256
259b5b9b11de91a70bb1a64a3c65468327627f17fabcf684379854535854fbfa

SHA512
e95659fe39c2f3754916e1c2e990157a3dc5827014c4dc52aa7127767101b77931083de7a91d655b2fea0a7937b51a4bf1b6686b9c111e7c666be73c715b9ddb

Download Submit
\Windows\system\QuKWCYZ.exe

Filesize
1.9MB

MD5
d6b86d6f8117889da4e65afc30d5c387

SHA1
8f4d0c07c05e3839faae257b8117bb8fd7eaa654

SHA256
ef5eafa2034a17f8494c7b9fbd19177cd3d575f437a9401428da4d761af715fd

SHA512
f3623ed4ef441e750e7d5e86fb6fb48f28e2d2151cb6252985a635bd1824ec31c0c3831693394f955e05cab7dc55d1777068d1ab32b317fa428c8673cbb4b1c4

Download Submit
\Windows\system\aClltrX.exe

Filesize
1.9MB

MD5
d89305b2fc5f7ec1a6ea678aed2fb627

SHA1
00b3d623e3bfee171a35a2058467e3969bce28ca

SHA256
94c4cbc526c6684ec6f52f3c5dfd02c5afce52b364a107093cdd86b8aeb2d0e2

SHA512
7ae733aab1d62f8ebcd6bdbceb00acd969c00fa210924b39898bcdc4473678af14987b479130b61273f67a867cb755fd0c4ab4f82ec76c52d1a789a17a660ca4

Download Submit
\Windows\system\brhZkHH.exe

Filesize
1.9MB

MD5
b831f042c817aed7fd18e6eb1b7249d4

SHA1
74689d9ecadbb36686853b9d33243a1ece5225fa

SHA256
53ee46311aff074d1e93def833dcd3f3d68ec6bc1107abca2ec3fff0293cde7a

SHA512
2bee01be3222bd87d967e6e4f76650cc439af3b7af21c1686d4cd9baa5ba9e2ac9653210be4ef0b7b6fe08704b25cc0e963bfd7ce9d6f5b9d52df78d36cb2789

Download Submit
\Windows\system\cffQYph.exe

Filesize
1.9MB

MD5
8fea08c83f8bfc364f348f7bf1d1954c

SHA1
55ca353070f3c3970cdf3a1642ed4d24075e6671

SHA256
caf453301b802fe007617eb194967aa1fdd930cd939c164fadb3fea2a0542872

SHA512
4f595fda7737c80ccf0ee6d77212764d0bb28058057a6d3460a9fe3eb22ea66d9a3344aeff682308962fb60721f204546b5058f0c1ea9f95777b882b540c7a70

Download Submit
\Windows\system\gusQYVC.exe

Filesize
1.9MB

MD5
db765afe3b70a0302a0443d641b64547

SHA1
30d1157f0bdb9fb7e25fd13b9dfb1b8871085ef3

SHA256
ec0a9933db63bec772d754c4b97e8e915910451df81d9790ad55a9e3b0dacdc0

SHA512
ee758bd95683f5eb520f9dc2cae1a98a9df5858d5094201cc5db394fa1432a50600d84649d42b28006ed3f583f22e416325a0881fb11bb133906dc1864c6dd81

Download Submit
\Windows\system\hpBGNpf.exe

Filesize
1.9MB

MD5
2650b455fda8f1c033551ef9e2d2f5ad

SHA1
e346adeb48f7d2ad9c2e2c6a00ba6306e06b51b8

SHA256
cd14061d7786aaca2c18aaeb31959dfbf85611978585cfd0d814d9429955c8e2

SHA512
a3da3b9b11f781c2193fa2cd9844e0c58a19fdd0289453ef1cb8bdf1da1f9ee894833ef2ba3add6648e3b419ffb9f49373fd93d6224a69688f22645ccf33b9bf

Download Submit
\Windows\system\iIgWCXe.exe

Filesize
1.9MB

MD5
941711444ed847ef534a3ca22fa1f4d0

SHA1
4578255ed37c00cef296ea0747d686e43adeedc9

SHA256
bef0d23e204ea5de82aa27ff9ee10a84e63252516e95c4306ed4c57a5da3a8ba

SHA512
37dbba4baca9de230cf0f4bc36272ec59b476354bb8677cea7f544680260c90aafb755c0fd630bc322f415a1f9acb8540aae4b98038536946c16998b475bca42

Download Submit
\Windows\system\msIOgcd.exe

Filesize
1.9MB

MD5
72b666b005e7213c9fbc641b638c66d1

SHA1
71a6744af10a9ec19ec92ab52e184966c9af25f4

SHA256
34063ee2cbb6dc5cc207acda8b973ca5d03504c9842b79defeefd1d14fa82e56

SHA512
e8772acb1644bca1e2403bb1d5e24c655ed871285e1339d18b38413d7d20ea6db9565bb9b9c856c2c03745b1a9396a4039f37618fcc0c60b9025a23ef1758407

Download Submit
\Windows\system\nSRthey.exe

Filesize
1.9MB

MD5
31fbd71a771a0c848770500c0c4b59b9

SHA1
eb4fb31a32d9a7a8fb12621b5184535bdaff288c

SHA256
a826b7dbe06fda8637edbcd919bab15844c7dab61a091906f31dce4a52b19a92

SHA512
264edbd8ae1f0a46746c984fbfacec92b8c869fdb6dfc672bf0a12910b1661cc2a24cf27ad8f71e24b48256e3dd4b9b99a3b9fd8a9f21e8f2d388724530b9d49

Download Submit
\Windows\system\sYzAdqu.exe

Filesize
1.9MB

MD5
2a12144993d2261004a23500ed24d58a

SHA1
f4e03ae62b62b0bf2d079df10213a9741cdcf8c5

SHA256
86ae24fe3d89a88411c5e84989b8788ef07a5a5bcc21fd4fa6ad3fd741361fa4

SHA512
71e43bdb2b3b3385e8a59c7435b476b9e834f10e19233a6aba9a1e4afcd23e0660db41b01bd0f9b96797bfdc8739d99b0e09456cc7ed42bc5e0dbd90adb3caef

Download Submit
\Windows\system\suUqOyN.exe

Filesize
1.9MB

MD5
0cb1e3f1e9b6dbaaf476534eb7118ac3

SHA1
2994f31c27f5f464867e775c06e2b3510df63376

SHA256
cf87f13f97f475bd58f9d5e346d91ee35e50028128c582a9e373c20e5daa4e8f

SHA512
95d03f85776276cbb74a3ce1740595eac261a56688a47012c0329fe44dbbccc152eb9168d8342336e6c916cdff9452f265349c08eabed3c773aa10f7ce097765

Download Submit
\Windows\system\xJFARli.exe

Filesize
1.9MB

MD5
38b83f702788c5b981b8a84cb33e424f

SHA1
fad3e1c9634211ffdb36612f340b3f8bc811cf05

SHA256
4b8e100de46c1c6f478deba36c1e2d7081a7d4cb78b1ae12576f4b828f316ee7

SHA512
d8749beef34b9824b45f194f718877fa748c9e36cfb6d9df7f998401e0477f1bdc59fc7789d9a8038f609a3d98d86a1e7236990166ddff12ef2334f73868889f

Download Submit
\Windows\system\xlkNpRn.exe

Filesize
1.9MB

MD5
81260c02d394c23294f21c20199e33c0

SHA1
846d6645c6c53f75829d97f8beffae5baf8d088a

SHA256
88ae80d8bb7039cbb2f6ca976af5f867822fc328acff92487310d257c84386b2

SHA512
c0a330cc8b2254ed0ba75c2d6101d50341bf0a07cd74ec24e4affc75fe3dd8ade8559702df8e3c3707568d8084da28f03c7c61a645f21784d468ef8428c1c65f

Download Submit
\Windows\system\zaknwXx.exe

Filesize
1.9MB

MD5
4aac20966aca783bfe72f25c1571b8cc

SHA1
417e6bd31289cd800f352d8172916b84a34829c3

SHA256
e8b0e1ad4e65fce470855f66c67cc98190bcf262d9122d5c6b895c4d5286144e

SHA512
ffd02238deb63ae83e273fc009a518171d3f2b286d956ffa199e918cffcaa681a29d9e61ed3b6593e22d984e5054ac49325f8b314e10c0cbd51e70cf7d6a9ab5

Download Submit
memory/2336-17-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-96-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2372-340-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2372-31-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2372-56-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2372-21-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Filesize
512KB

Download
memory/2372-66-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2372-116-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Filesize
512KB

Download
memory/2380-209-0x0000000003680000-0x0000000003A72000-memory.dmp

Filesize
3.9MB

Download
memory/2380-171-0x0000000003680000-0x0000000003A72000-memory.dmp

Filesize
3.9MB

Download
memory/2380-212-0x00000000031A0000-0x0000000003592000-memory.dmp

Filesize
3.9MB

Download
memory/2380-2-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-204-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2380-20-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2380-207-0x0000000003680000-0x0000000003A72000-memory.dmp

Filesize
3.9MB

Download
memory/2380-206-0x0000000003680000-0x0000000003A72000-memory.dmp

Filesize
3.9MB

Download
memory/2380-16-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-213-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2380-208-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-179-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2488-210-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2576-159-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2704-112-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2732-211-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2852-19-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download