xmrig | e3e5868b87b389df8f4685efac322121555070bc65bc4e1df3456b881fe287f2

Analysis

max time kernel
134s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
Size

2.1MB
MD5

07726e22ab4ac67fa5d443fe8bca11cc
SHA1

415b4dfc472bb95084330b741ce9d0411494ee9a
SHA256

e3e5868b87b389df8f4685efac322121555070bc65bc4e1df3456b881fe287f2
SHA512

b595c3218141ccba0904f4782758e0071b5fba765021f8959106b2c97b9e3004538447b1cfbebe61c1e9d96556a66f7e284499d486af1dc90601b44b77dec8c9
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafws1P2:NAB/

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/2944-10-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2368-184-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2452-182-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/2412-180-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2704-176-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/1964-174-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/2684-1944-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2556-1953-0x000000013F690000-0x000000013FA82000-memory.dmp	xmrig
behavioral1/memory/2556-26-0x000000013F690000-0x000000013FA82000-memory.dmp	xmrig
behavioral1/memory/2684-24-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2704-2476-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2944-2477-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2412-2474-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2368-2472-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2572-3223-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2452-3220-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/1964-3221-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2944	bwQRqly.exe
2684	KBxhXVw.exe
2556	OEtWxjl.exe
1964	PJDIxhA.exe
2704	tETBdCA.exe
2572	hRhwSXk.exe
2412	GgrBDjs.exe
2452	xbtPYsM.exe
2368	pqYRicr.exe
2664	hXykucL.exe
2840	XkwxWDt.exe
764	UnUTGze.exe
2364	QUIhzau.exe
984	GYkqZJx.exe
892	YfvPYIa.exe
580	HnrQuYV.exe
464	kFyRvjy.exe
1252	DNcqvbt.exe
2384	veEvtVO.exe
684	SRyPetz.exe
1300	FsUkQEa.exe
2236	yledpjq.exe
1936	iFviUUa.exe
1512	QaoeAqQ.exe
1592	yHwZXXw.exe
1920	iRSMlUd.exe
2928	XGazvBt.exe
2296	udXVbjT.exe
2780	eNDxKJI.exe
2988	EaAogxn.exe
2072	hWEmNZR.exe
1272	ePVHkbi.exe
1684	YBbydRq.exe
768	JyfwJWa.exe
2964	CmDuang.exe
1372	jsVrNXl.exe
1348	WLmTnbE.exe
1504	RfUXcSF.exe
2228	xjwxtjn.exe
1832	WzPxeJE.exe
2172	JAOCzfV.exe
2792	iILuVjB.exe
1688	qTsCigr.exe
2308	JYvhKEk.exe
1760	dSFSqDF.exe
2088	PRhVpJi.exe
752	ydYKpQV.exe
1420	KijgCqe.exe
1680	tqdmqoy.exe
2516	eUerruX.exe
2104	RsRydzV.exe
1568	CHMoAOv.exe
2532	nwtCKZz.exe
2464	LlorXRe.exe
2628	oEjOlcE.exe
2264	DKnjRyG.exe
2672	gjVyDpP.exe
2480	mJrGNaL.exe
2852	SPKAVlH.exe
320	MRLSBOG.exe
1248	NFhnihW.exe
564	bckeWDi.exe
1796	VbpGtLU.exe
2356	QZUHSfN.exe

Loads dropped DLL 64 IoCs

pid	Process
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2744-0-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/files/0x002e000000014698-16.dat	upx
behavioral1/files/0x002e00000001466c-11.dat	upx
behavioral1/memory/2944-10-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-35.dat	upx
behavioral1/files/0x0008000000014b6d-38.dat	upx
behavioral1/files/0x0007000000014c67-43.dat	upx
behavioral1/files/0x0007000000015c3c-46.dat	upx
behavioral1/files/0x0006000000016c23-54.dat	upx
behavioral1/files/0x0006000000016c90-58.dat	upx
behavioral1/files/0x0006000000016cf0-78.dat	upx
behavioral1/files/0x0006000000016d11-84.dat	upx
behavioral1/files/0x0006000000016d41-109.dat	upx
behavioral1/files/0x0006000000016d4f-119.dat	upx
behavioral1/files/0x0006000000016e56-139.dat	upx
behavioral1/files/0x00050000000186a0-164.dat	upx
behavioral1/memory/2368-184-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2452-182-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/memory/2412-180-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/2572-178-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/2704-176-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/memory/1964-174-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/files/0x0006000000018ae2-169.dat	upx
behavioral1/files/0x0006000000018ae2-167.dat	upx
behavioral1/files/0x0005000000018698-159.dat	upx
behavioral1/files/0x00050000000186a0-162.dat	upx
behavioral1/files/0x000500000001868c-154.dat	upx
behavioral1/files/0x000500000001868c-152.dat	upx
behavioral1/files/0x0006000000017090-149.dat	upx
behavioral1/files/0x000600000001704f-142.dat	upx
behavioral1/files/0x0006000000016e56-137.dat	upx
behavioral1/files/0x0006000000016d84-129.dat	upx
behavioral1/files/0x0006000000016d89-134.dat	upx
behavioral1/files/0x0006000000016d55-124.dat	upx
behavioral1/files/0x0006000000016d4a-114.dat	upx
behavioral1/memory/2684-1944-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/2556-1953-0x000000013F690000-0x000000013FA82000-memory.dmp	upx
behavioral1/files/0x0006000000016d24-95.dat	upx
behavioral1/files/0x0006000000016d01-82.dat	upx
behavioral1/files/0x0006000000016cd4-74.dat	upx
behavioral1/files/0x0006000000016ccf-70.dat	upx
behavioral1/files/0x000e000000014738-66.dat	upx
behavioral1/files/0x0006000000016ca9-63.dat	upx
behavioral1/files/0x0006000000016c1a-50.dat	upx
behavioral1/files/0x0009000000014a94-31.dat	upx
behavioral1/memory/2556-26-0x000000013F690000-0x000000013FA82000-memory.dmp	upx
behavioral1/memory/2684-24-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/files/0x000c00000001445e-6.dat	upx
behavioral1/memory/2704-2476-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/memory/2944-2477-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2412-2474-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/2368-2472-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2572-3223-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/2452-3220-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/memory/1964-3221-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wAbGZWH.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\qfIZROO.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\BMhziGJ.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\eCRnZsn.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\GWerPwZ.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\IuULKkL.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\ZZntenm.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\vDCDtaa.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\yxCGkPc.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\ysdHVxx.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\gUPShkS.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\zZTrIaS.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\cnbYyUx.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\GkbxFSt.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\oCpDBxv.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\RAyUUIH.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\VQhviST.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\OVyBJeA.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\uwvVoSC.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\AOXQxWD.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\MqbZRBM.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\VbhjNSn.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\nzZbzUR.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\sSCpFro.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\EsUpBcr.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\OAXcusP.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\EcyFHDV.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\qytxEcj.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\NKlrfWc.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\lOWVeah.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\NpkMhsy.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\iqobqBw.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\sVtwlti.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\TavQlxY.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\fiQuEjR.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\ZKLHopd.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\TahQZvJ.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\knmGlxC.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\BoEJKyb.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\ABTbWFS.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\IhNfTGr.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\FyTfvIb.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\hJsqalV.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\HZkFjZt.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\GApkfGd.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\vFXohoW.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\XkwxWDt.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\fywaRMz.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\OQJbqQZ.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\diZhYTW.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\ZHsUimm.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\EKOmhnP.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\eihkLmH.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\MJtykCX.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\CLUAZfw.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\JWHheQG.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\xEthyuc.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\AtzRJGW.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\zvREsLh.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\gMnyujc.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\NzGbxHM.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\ORJUbxB.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\iuyiDgH.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
File created	C:\Windows\System\RQbhGRM.exe	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2892	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
Token: SeDebugPrivilege	2892	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2892	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	29
PID 2744 wrote to memory of 2892	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	29
PID 2744 wrote to memory of 2892	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	29
PID 2744 wrote to memory of 2944	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	30
PID 2744 wrote to memory of 2944	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	30
PID 2744 wrote to memory of 2944	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	30
PID 2744 wrote to memory of 2556	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	31
PID 2744 wrote to memory of 2556	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	31
PID 2744 wrote to memory of 2556	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	31
PID 2744 wrote to memory of 2684	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	32
PID 2744 wrote to memory of 2684	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	32
PID 2744 wrote to memory of 2684	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	32
PID 2744 wrote to memory of 1964	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	33
PID 2744 wrote to memory of 1964	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	33
PID 2744 wrote to memory of 1964	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	33
PID 2744 wrote to memory of 2704	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	34
PID 2744 wrote to memory of 2704	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	34
PID 2744 wrote to memory of 2704	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	34
PID 2744 wrote to memory of 2572	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	35
PID 2744 wrote to memory of 2572	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	35
PID 2744 wrote to memory of 2572	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	35
PID 2744 wrote to memory of 2412	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	36
PID 2744 wrote to memory of 2412	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	36
PID 2744 wrote to memory of 2412	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	36
PID 2744 wrote to memory of 2452	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	37
PID 2744 wrote to memory of 2452	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	37
PID 2744 wrote to memory of 2452	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	37
PID 2744 wrote to memory of 2368	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	38
PID 2744 wrote to memory of 2368	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	38
PID 2744 wrote to memory of 2368	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	38
PID 2744 wrote to memory of 2664	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	39
PID 2744 wrote to memory of 2664	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	39
PID 2744 wrote to memory of 2664	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	39
PID 2744 wrote to memory of 2840	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	40
PID 2744 wrote to memory of 2840	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	40
PID 2744 wrote to memory of 2840	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	40
PID 2744 wrote to memory of 764	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	41
PID 2744 wrote to memory of 764	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	41
PID 2744 wrote to memory of 764	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	41
PID 2744 wrote to memory of 2364	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	42
PID 2744 wrote to memory of 2364	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	42
PID 2744 wrote to memory of 2364	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	42
PID 2744 wrote to memory of 984	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	43
PID 2744 wrote to memory of 984	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	43
PID 2744 wrote to memory of 984	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	43
PID 2744 wrote to memory of 892	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	44
PID 2744 wrote to memory of 892	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	44
PID 2744 wrote to memory of 892	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	44
PID 2744 wrote to memory of 580	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	45
PID 2744 wrote to memory of 580	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	45
PID 2744 wrote to memory of 580	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	45
PID 2744 wrote to memory of 464	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	46
PID 2744 wrote to memory of 464	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	46
PID 2744 wrote to memory of 464	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	46
PID 2744 wrote to memory of 1252	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	47
PID 2744 wrote to memory of 1252	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	47
PID 2744 wrote to memory of 1252	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	47
PID 2744 wrote to memory of 2384	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	48
PID 2744 wrote to memory of 2384	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	48
PID 2744 wrote to memory of 2384	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	48
PID 2744 wrote to memory of 684	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	49
PID 2744 wrote to memory of 684	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	49
PID 2744 wrote to memory of 684	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	49
PID 2744 wrote to memory of 1300	2744	07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07726e22ab4ac67fa5d443fe8bca11cc_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\System\bwQRqly.exe
  C:\Windows\System\bwQRqly.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\OEtWxjl.exe
  C:\Windows\System\OEtWxjl.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\KBxhXVw.exe
  C:\Windows\System\KBxhXVw.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\PJDIxhA.exe
  C:\Windows\System\PJDIxhA.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\tETBdCA.exe
  C:\Windows\System\tETBdCA.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\hRhwSXk.exe
  C:\Windows\System\hRhwSXk.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\GgrBDjs.exe
  C:\Windows\System\GgrBDjs.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\xbtPYsM.exe
  C:\Windows\System\xbtPYsM.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\pqYRicr.exe
  C:\Windows\System\pqYRicr.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\hXykucL.exe
  C:\Windows\System\hXykucL.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\XkwxWDt.exe
  C:\Windows\System\XkwxWDt.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\UnUTGze.exe
  C:\Windows\System\UnUTGze.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\QUIhzau.exe
  C:\Windows\System\QUIhzau.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\GYkqZJx.exe
  C:\Windows\System\GYkqZJx.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\YfvPYIa.exe
  C:\Windows\System\YfvPYIa.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\HnrQuYV.exe
  C:\Windows\System\HnrQuYV.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\kFyRvjy.exe
  C:\Windows\System\kFyRvjy.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\DNcqvbt.exe
  C:\Windows\System\DNcqvbt.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\veEvtVO.exe
  C:\Windows\System\veEvtVO.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\SRyPetz.exe
  C:\Windows\System\SRyPetz.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\FsUkQEa.exe
  C:\Windows\System\FsUkQEa.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\yledpjq.exe
  C:\Windows\System\yledpjq.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\iFviUUa.exe
  C:\Windows\System\iFviUUa.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\QaoeAqQ.exe
  C:\Windows\System\QaoeAqQ.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\yHwZXXw.exe
  C:\Windows\System\yHwZXXw.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\iRSMlUd.exe
  C:\Windows\System\iRSMlUd.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\XGazvBt.exe
  C:\Windows\System\XGazvBt.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\udXVbjT.exe
  C:\Windows\System\udXVbjT.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\eNDxKJI.exe
  C:\Windows\System\eNDxKJI.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\EaAogxn.exe
  C:\Windows\System\EaAogxn.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\hWEmNZR.exe
  C:\Windows\System\hWEmNZR.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\ePVHkbi.exe
  C:\Windows\System\ePVHkbi.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\YBbydRq.exe
  C:\Windows\System\YBbydRq.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\JyfwJWa.exe
  C:\Windows\System\JyfwJWa.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\CmDuang.exe
  C:\Windows\System\CmDuang.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\jsVrNXl.exe
  C:\Windows\System\jsVrNXl.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\WLmTnbE.exe
  C:\Windows\System\WLmTnbE.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\RfUXcSF.exe
  C:\Windows\System\RfUXcSF.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\xjwxtjn.exe
  C:\Windows\System\xjwxtjn.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\WzPxeJE.exe
  C:\Windows\System\WzPxeJE.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\JAOCzfV.exe
  C:\Windows\System\JAOCzfV.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\iILuVjB.exe
  C:\Windows\System\iILuVjB.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\qTsCigr.exe
  C:\Windows\System\qTsCigr.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\dSFSqDF.exe
  C:\Windows\System\dSFSqDF.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\JYvhKEk.exe
  C:\Windows\System\JYvhKEk.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\KijgCqe.exe
  C:\Windows\System\KijgCqe.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\PRhVpJi.exe
  C:\Windows\System\PRhVpJi.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\tqdmqoy.exe
  C:\Windows\System\tqdmqoy.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\ydYKpQV.exe
  C:\Windows\System\ydYKpQV.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\RsRydzV.exe
  C:\Windows\System\RsRydzV.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\eUerruX.exe
  C:\Windows\System\eUerruX.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\oEjOlcE.exe
  C:\Windows\System\oEjOlcE.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\CHMoAOv.exe
  C:\Windows\System\CHMoAOv.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\DKnjRyG.exe
  C:\Windows\System\DKnjRyG.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\nwtCKZz.exe
  C:\Windows\System\nwtCKZz.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\gjVyDpP.exe
  C:\Windows\System\gjVyDpP.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\LlorXRe.exe
  C:\Windows\System\LlorXRe.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\mJrGNaL.exe
  C:\Windows\System\mJrGNaL.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\SPKAVlH.exe
  C:\Windows\System\SPKAVlH.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\MRLSBOG.exe
  C:\Windows\System\MRLSBOG.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\NFhnihW.exe
  C:\Windows\System\NFhnihW.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\bckeWDi.exe
  C:\Windows\System\bckeWDi.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\VbpGtLU.exe
  C:\Windows\System\VbpGtLU.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\oOnwvpR.exe
  C:\Windows\System\oOnwvpR.exe
  2⤵
  PID:2000
- C:\Windows\System\QZUHSfN.exe
  C:\Windows\System\QZUHSfN.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\mGlcclu.exe
  C:\Windows\System\mGlcclu.exe
  2⤵
  PID:2232
- C:\Windows\System\ksARUSp.exe
  C:\Windows\System\ksARUSp.exe
  2⤵
  PID:1388
- C:\Windows\System\amadHHB.exe
  C:\Windows\System\amadHHB.exe
  2⤵
  PID:1528
- C:\Windows\System\gfECKQM.exe
  C:\Windows\System\gfECKQM.exe
  2⤵
  PID:1600
- C:\Windows\System\zUdZDaV.exe
  C:\Windows\System\zUdZDaV.exe
  2⤵
  PID:2096
- C:\Windows\System\AdbPbEs.exe
  C:\Windows\System\AdbPbEs.exe
  2⤵
  PID:2504
- C:\Windows\System\wLyjCAJ.exe
  C:\Windows\System\wLyjCAJ.exe
  2⤵
  PID:2888
- C:\Windows\System\QdHLHVI.exe
  C:\Windows\System\QdHLHVI.exe
  2⤵
  PID:2952
- C:\Windows\System\yEdZYqT.exe
  C:\Windows\System\yEdZYqT.exe
  2⤵
  PID:2016
- C:\Windows\System\rtHvEIf.exe
  C:\Windows\System\rtHvEIf.exe
  2⤵
  PID:896
- C:\Windows\System\HuXjyvD.exe
  C:\Windows\System\HuXjyvD.exe
  2⤵
  PID:1004
- C:\Windows\System\EhhPjjm.exe
  C:\Windows\System\EhhPjjm.exe
  2⤵
  PID:2268
- C:\Windows\System\KoxyyKs.exe
  C:\Windows\System\KoxyyKs.exe
  2⤵
  PID:1608
- C:\Windows\System\mIjfCGj.exe
  C:\Windows\System\mIjfCGj.exe
  2⤵
  PID:2544
- C:\Windows\System\PHLYOeZ.exe
  C:\Windows\System\PHLYOeZ.exe
  2⤵
  PID:440
- C:\Windows\System\UWWTTAB.exe
  C:\Windows\System\UWWTTAB.exe
  2⤵
  PID:2632
- C:\Windows\System\bNRXOSb.exe
  C:\Windows\System\bNRXOSb.exe
  2⤵
  PID:1032
- C:\Windows\System\ylyLcVC.exe
  C:\Windows\System\ylyLcVC.exe
  2⤵
  PID:760
- C:\Windows\System\iwSrBrW.exe
  C:\Windows\System\iwSrBrW.exe
  2⤵
  PID:2724
- C:\Windows\System\aRNaXWq.exe
  C:\Windows\System\aRNaXWq.exe
  2⤵
  PID:2540
- C:\Windows\System\bgxXSwM.exe
  C:\Windows\System\bgxXSwM.exe
  2⤵
  PID:2012
- C:\Windows\System\wroiwsM.exe
  C:\Windows\System\wroiwsM.exe
  2⤵
  PID:2200
- C:\Windows\System\LRqdWvO.exe
  C:\Windows\System\LRqdWvO.exe
  2⤵
  PID:2360
- C:\Windows\System\lqzcoEP.exe
  C:\Windows\System\lqzcoEP.exe
  2⤵
  PID:2984
- C:\Windows\System\MNrFrfH.exe
  C:\Windows\System\MNrFrfH.exe
  2⤵
  PID:1716
- C:\Windows\System\zubQdjt.exe
  C:\Windows\System\zubQdjt.exe
  2⤵
  PID:2640
- C:\Windows\System\wAOTjvO.exe
  C:\Windows\System\wAOTjvO.exe
  2⤵
  PID:2328
- C:\Windows\System\dksSKMF.exe
  C:\Windows\System\dksSKMF.exe
  2⤵
  PID:3068
- C:\Windows\System\DkqSJZc.exe
  C:\Windows\System\DkqSJZc.exe
  2⤵
  PID:1744
- C:\Windows\System\bDMiLOe.exe
  C:\Windows\System\bDMiLOe.exe
  2⤵
  PID:1740
- C:\Windows\System\wtkRjtO.exe
  C:\Windows\System\wtkRjtO.exe
  2⤵
  PID:2168
- C:\Windows\System\xkQbmzw.exe
  C:\Windows\System\xkQbmzw.exe
  2⤵
  PID:2020
- C:\Windows\System\yLuSSzH.exe
  C:\Windows\System\yLuSSzH.exe
  2⤵
  PID:1664
- C:\Windows\System\ZfNJFYd.exe
  C:\Windows\System\ZfNJFYd.exe
  2⤵
  PID:2428
- C:\Windows\System\mnNCMQp.exe
  C:\Windows\System\mnNCMQp.exe
  2⤵
  PID:2392
- C:\Windows\System\cbEhzMa.exe
  C:\Windows\System\cbEhzMa.exe
  2⤵
  PID:1492
- C:\Windows\System\XkBzhYA.exe
  C:\Windows\System\XkBzhYA.exe
  2⤵
  PID:2076
- C:\Windows\System\RQPAvVY.exe
  C:\Windows\System\RQPAvVY.exe
  2⤵
  PID:796
- C:\Windows\System\OWHBOdZ.exe
  C:\Windows\System\OWHBOdZ.exe
  2⤵
  PID:2660
- C:\Windows\System\deksCmk.exe
  C:\Windows\System\deksCmk.exe
  2⤵
  PID:1876
- C:\Windows\System\dSrMSPe.exe
  C:\Windows\System\dSrMSPe.exe
  2⤵
  PID:2220
- C:\Windows\System\QRBZnKO.exe
  C:\Windows\System\QRBZnKO.exe
  2⤵
  PID:2552
- C:\Windows\System\FsbfgUj.exe
  C:\Windows\System\FsbfgUj.exe
  2⤵
  PID:2240
- C:\Windows\System\tDnLHOX.exe
  C:\Windows\System\tDnLHOX.exe
  2⤵
  PID:2140
- C:\Windows\System\cisEFse.exe
  C:\Windows\System\cisEFse.exe
  2⤵
  PID:2976
- C:\Windows\System\NEbHbaV.exe
  C:\Windows\System\NEbHbaV.exe
  2⤵
  PID:1596
- C:\Windows\System\XzdsOcE.exe
  C:\Windows\System\XzdsOcE.exe
  2⤵
  PID:1048
- C:\Windows\System\tMJqxwr.exe
  C:\Windows\System\tMJqxwr.exe
  2⤵
  PID:2184
- C:\Windows\System\VbhjNSn.exe
  C:\Windows\System\VbhjNSn.exe
  2⤵
  PID:2524
- C:\Windows\System\mezKjuj.exe
  C:\Windows\System\mezKjuj.exe
  2⤵
  PID:2272
- C:\Windows\System\sVtwlti.exe
  C:\Windows\System\sVtwlti.exe
  2⤵
  PID:1360
- C:\Windows\System\xtWEenh.exe
  C:\Windows\System\xtWEenh.exe
  2⤵
  PID:2068
- C:\Windows\System\zDonrav.exe
  C:\Windows\System\zDonrav.exe
  2⤵
  PID:2080
- C:\Windows\System\rmGiUWF.exe
  C:\Windows\System\rmGiUWF.exe
  2⤵
  PID:2520
- C:\Windows\System\TRGkTCt.exe
  C:\Windows\System\TRGkTCt.exe
  2⤵
  PID:1720
- C:\Windows\System\ItvzjAi.exe
  C:\Windows\System\ItvzjAi.exe
  2⤵
  PID:1548
- C:\Windows\System\qKRgHAv.exe
  C:\Windows\System\qKRgHAv.exe
  2⤵
  PID:1708
- C:\Windows\System\AIQjGCI.exe
  C:\Windows\System\AIQjGCI.exe
  2⤵
  PID:1944
- C:\Windows\System\wYmkjnO.exe
  C:\Windows\System\wYmkjnO.exe
  2⤵
  PID:1776
- C:\Windows\System\JTFcrIO.exe
  C:\Windows\System\JTFcrIO.exe
  2⤵
  PID:932
- C:\Windows\System\MNKgxwr.exe
  C:\Windows\System\MNKgxwr.exe
  2⤵
  PID:1700
- C:\Windows\System\yCORzyw.exe
  C:\Windows\System\yCORzyw.exe
  2⤵
  PID:3056
- C:\Windows\System\ABTbWFS.exe
  C:\Windows\System\ABTbWFS.exe
  2⤵
  PID:1288
- C:\Windows\System\onjOzci.exe
  C:\Windows\System\onjOzci.exe
  2⤵
  PID:2256
- C:\Windows\System\bSTpyWH.exe
  C:\Windows\System\bSTpyWH.exe
  2⤵
  PID:664
- C:\Windows\System\vUpDMyZ.exe
  C:\Windows\System\vUpDMyZ.exe
  2⤵
  PID:1976
- C:\Windows\System\czPHmmw.exe
  C:\Windows\System\czPHmmw.exe
  2⤵
  PID:1828
- C:\Windows\System\cQLJWGr.exe
  C:\Windows\System\cQLJWGr.exe
  2⤵
  PID:1412
- C:\Windows\System\VUMHObr.exe
  C:\Windows\System\VUMHObr.exe
  2⤵
  PID:3020
- C:\Windows\System\mumqYzK.exe
  C:\Windows\System\mumqYzK.exe
  2⤵
  PID:844
- C:\Windows\System\ZRlerMG.exe
  C:\Windows\System\ZRlerMG.exe
  2⤵
  PID:1392
- C:\Windows\System\CQFuYJw.exe
  C:\Windows\System\CQFuYJw.exe
  2⤵
  PID:1996
- C:\Windows\System\sbiiIMD.exe
  C:\Windows\System\sbiiIMD.exe
  2⤵
  PID:2996
- C:\Windows\System\LUloMks.exe
  C:\Windows\System\LUloMks.exe
  2⤵
  PID:1812
- C:\Windows\System\JcFBfmO.exe
  C:\Windows\System\JcFBfmO.exe
  2⤵
  PID:1624
- C:\Windows\System\UXAomYV.exe
  C:\Windows\System\UXAomYV.exe
  2⤵
  PID:2484
- C:\Windows\System\ckSfnRM.exe
  C:\Windows\System\ckSfnRM.exe
  2⤵
  PID:1128
- C:\Windows\System\AtzRJGW.exe
  C:\Windows\System\AtzRJGW.exe
  2⤵
  PID:2748
- C:\Windows\System\jqwbNwQ.exe
  C:\Windows\System\jqwbNwQ.exe
  2⤵
  PID:1188
- C:\Windows\System\SPdTnfe.exe
  C:\Windows\System\SPdTnfe.exe
  2⤵
  PID:1564
- C:\Windows\System\fojvwoR.exe
  C:\Windows\System\fojvwoR.exe
  2⤵
  PID:748
- C:\Windows\System\WeZmyNR.exe
  C:\Windows\System\WeZmyNR.exe
  2⤵
  PID:1496
- C:\Windows\System\ZYtHxzP.exe
  C:\Windows\System\ZYtHxzP.exe
  2⤵
  PID:1764
- C:\Windows\System\YfHklhB.exe
  C:\Windows\System\YfHklhB.exe
  2⤵
  PID:1056
- C:\Windows\System\TcwxTwf.exe
  C:\Windows\System\TcwxTwf.exe
  2⤵
  PID:2616
- C:\Windows\System\gJAiMjT.exe
  C:\Windows\System\gJAiMjT.exe
  2⤵
  PID:1516
- C:\Windows\System\mOleXdo.exe
  C:\Windows\System\mOleXdo.exe
  2⤵
  PID:1916
- C:\Windows\System\niqouTw.exe
  C:\Windows\System\niqouTw.exe
  2⤵
  PID:2828
- C:\Windows\System\lkFVFfh.exe
  C:\Windows\System\lkFVFfh.exe
  2⤵
  PID:1956
- C:\Windows\System\oxVNmNk.exe
  C:\Windows\System\oxVNmNk.exe
  2⤵
  PID:2180
- C:\Windows\System\CkpGPNG.exe
  C:\Windows\System\CkpGPNG.exe
  2⤵
  PID:1352
- C:\Windows\System\lmvWIGF.exe
  C:\Windows\System\lmvWIGF.exe
  2⤵
  PID:2564
- C:\Windows\System\VpUcfod.exe
  C:\Windows\System\VpUcfod.exe
  2⤵
  PID:1296
- C:\Windows\System\nIQfBYx.exe
  C:\Windows\System\nIQfBYx.exe
  2⤵
  PID:680
- C:\Windows\System\exMepfN.exe
  C:\Windows\System\exMepfN.exe
  2⤵
  PID:924
- C:\Windows\System\gcplPaj.exe
  C:\Windows\System\gcplPaj.exe
  2⤵
  PID:1924
- C:\Windows\System\jCvbBlH.exe
  C:\Windows\System\jCvbBlH.exe
  2⤵
  PID:3084
- C:\Windows\System\wTEOCRx.exe
  C:\Windows\System\wTEOCRx.exe
  2⤵
  PID:3128
- C:\Windows\System\oalLiPW.exe
  C:\Windows\System\oalLiPW.exe
  2⤵
  PID:3148
- C:\Windows\System\CpIOewH.exe
  C:\Windows\System\CpIOewH.exe
  2⤵
  PID:3164
- C:\Windows\System\sWuAIEG.exe
  C:\Windows\System\sWuAIEG.exe
  2⤵
  PID:3180
- C:\Windows\System\nKygKBX.exe
  C:\Windows\System\nKygKBX.exe
  2⤵
  PID:3196
- C:\Windows\System\jIRvtRh.exe
  C:\Windows\System\jIRvtRh.exe
  2⤵
  PID:3212
- C:\Windows\System\dFtESfM.exe
  C:\Windows\System\dFtESfM.exe
  2⤵
  PID:3228
- C:\Windows\System\ZaBiynk.exe
  C:\Windows\System\ZaBiynk.exe
  2⤵
  PID:3248
- C:\Windows\System\LVnvaFJ.exe
  C:\Windows\System\LVnvaFJ.exe
  2⤵
  PID:3268
- C:\Windows\System\YHtxnbL.exe
  C:\Windows\System\YHtxnbL.exe
  2⤵
  PID:3284
- C:\Windows\System\GdIMHTm.exe
  C:\Windows\System\GdIMHTm.exe
  2⤵
  PID:3304
- C:\Windows\System\fywaRMz.exe
  C:\Windows\System\fywaRMz.exe
  2⤵
  PID:3320
- C:\Windows\System\aPMjOpr.exe
  C:\Windows\System\aPMjOpr.exe
  2⤵
  PID:3340
- C:\Windows\System\abXFUst.exe
  C:\Windows\System\abXFUst.exe
  2⤵
  PID:3400
- C:\Windows\System\DMiwyCv.exe
  C:\Windows\System\DMiwyCv.exe
  2⤵
  PID:3420
- C:\Windows\System\esyuEFk.exe
  C:\Windows\System\esyuEFk.exe
  2⤵
  PID:3436
- C:\Windows\System\mupVyWG.exe
  C:\Windows\System\mupVyWG.exe
  2⤵
  PID:3452
- C:\Windows\System\mbufFsq.exe
  C:\Windows\System\mbufFsq.exe
  2⤵
  PID:3468
- C:\Windows\System\GVFnMfi.exe
  C:\Windows\System\GVFnMfi.exe
  2⤵
  PID:3492
- C:\Windows\System\Ttthsdc.exe
  C:\Windows\System\Ttthsdc.exe
  2⤵
  PID:3508
- C:\Windows\System\NohXzWZ.exe
  C:\Windows\System\NohXzWZ.exe
  2⤵
  PID:3524
- C:\Windows\System\vggSxHq.exe
  C:\Windows\System\vggSxHq.exe
  2⤵
  PID:3552
- C:\Windows\System\CZSwLsA.exe
  C:\Windows\System\CZSwLsA.exe
  2⤵
  PID:3568
- C:\Windows\System\Gusmoqq.exe
  C:\Windows\System\Gusmoqq.exe
  2⤵
  PID:3596
- C:\Windows\System\PMbCWOd.exe
  C:\Windows\System\PMbCWOd.exe
  2⤵
  PID:3612
- C:\Windows\System\yQQESpf.exe
  C:\Windows\System\yQQESpf.exe
  2⤵
  PID:3640
- C:\Windows\System\dUvkSOm.exe
  C:\Windows\System\dUvkSOm.exe
  2⤵
  PID:3656
- C:\Windows\System\jDLnRUO.exe
  C:\Windows\System\jDLnRUO.exe
  2⤵
  PID:3680
- C:\Windows\System\xlcBNfG.exe
  C:\Windows\System\xlcBNfG.exe
  2⤵
  PID:3708
- C:\Windows\System\NOQSHRj.exe
  C:\Windows\System\NOQSHRj.exe
  2⤵
  PID:3724
- C:\Windows\System\mgKSRLs.exe
  C:\Windows\System\mgKSRLs.exe
  2⤵
  PID:3748
- C:\Windows\System\dkLuzIz.exe
  C:\Windows\System\dkLuzIz.exe
  2⤵
  PID:3772
- C:\Windows\System\ePbYfDp.exe
  C:\Windows\System\ePbYfDp.exe
  2⤵
  PID:3792
- C:\Windows\System\ZxhXlsI.exe
  C:\Windows\System\ZxhXlsI.exe
  2⤵
  PID:3808
- C:\Windows\System\cjfsYBG.exe
  C:\Windows\System\cjfsYBG.exe
  2⤵
  PID:3824
- C:\Windows\System\JnuLwSH.exe
  C:\Windows\System\JnuLwSH.exe
  2⤵
  PID:3840
- C:\Windows\System\BDlfZYi.exe
  C:\Windows\System\BDlfZYi.exe
  2⤵
  PID:3856
- C:\Windows\System\KyCIbFK.exe
  C:\Windows\System\KyCIbFK.exe
  2⤵
  PID:3872
- C:\Windows\System\uPaqbXF.exe
  C:\Windows\System\uPaqbXF.exe
  2⤵
  PID:3892
- C:\Windows\System\iUBxUSq.exe
  C:\Windows\System\iUBxUSq.exe
  2⤵
  PID:3908
- C:\Windows\System\wCgkWhF.exe
  C:\Windows\System\wCgkWhF.exe
  2⤵
  PID:3952
- C:\Windows\System\FHOIcOf.exe
  C:\Windows\System\FHOIcOf.exe
  2⤵
  PID:3972
- C:\Windows\System\WEoZXZf.exe
  C:\Windows\System\WEoZXZf.exe
  2⤵
  PID:3988
- C:\Windows\System\BAKOtOO.exe
  C:\Windows\System\BAKOtOO.exe
  2⤵
  PID:4004
- C:\Windows\System\EiaXkQm.exe
  C:\Windows\System\EiaXkQm.exe
  2⤵
  PID:4028
- C:\Windows\System\ILvqnSn.exe
  C:\Windows\System\ILvqnSn.exe
  2⤵
  PID:4044
- C:\Windows\System\XJAHkUx.exe
  C:\Windows\System\XJAHkUx.exe
  2⤵
  PID:4060
- C:\Windows\System\sQzOQzi.exe
  C:\Windows\System\sQzOQzi.exe
  2⤵
  PID:4076
- C:\Windows\System\GKyMGFc.exe
  C:\Windows\System\GKyMGFc.exe
  2⤵
  PID:968
- C:\Windows\System\GjVxNlG.exe
  C:\Windows\System\GjVxNlG.exe
  2⤵
  PID:2148
- C:\Windows\System\CMzhKnY.exe
  C:\Windows\System\CMzhKnY.exe
  2⤵
  PID:2992
- C:\Windows\System\unDZZuv.exe
  C:\Windows\System\unDZZuv.exe
  2⤵
  PID:1028
- C:\Windows\System\UcvgeXQ.exe
  C:\Windows\System\UcvgeXQ.exe
  2⤵
  PID:2560
- C:\Windows\System\eVGraiZ.exe
  C:\Windows\System\eVGraiZ.exe
  2⤵
  PID:1660
- C:\Windows\System\TWAusVa.exe
  C:\Windows\System\TWAusVa.exe
  2⤵
  PID:3092
- C:\Windows\System\QYOoobm.exe
  C:\Windows\System\QYOoobm.exe
  2⤵
  PID:3172
- C:\Windows\System\BOFZVwq.exe
  C:\Windows\System\BOFZVwq.exe
  2⤵
  PID:3240
- C:\Windows\System\iccaIJU.exe
  C:\Windows\System\iccaIJU.exe
  2⤵
  PID:3280
- C:\Windows\System\VtvphAk.exe
  C:\Windows\System\VtvphAk.exe
  2⤵
  PID:3356
- C:\Windows\System\KChcpgp.exe
  C:\Windows\System\KChcpgp.exe
  2⤵
  PID:3188
- C:\Windows\System\xZPSrpu.exe
  C:\Windows\System\xZPSrpu.exe
  2⤵
  PID:3112
- C:\Windows\System\NXHbSFo.exe
  C:\Windows\System\NXHbSFo.exe
  2⤵
  PID:3384
- C:\Windows\System\eXWrKsY.exe
  C:\Windows\System\eXWrKsY.exe
  2⤵
  PID:3096
- C:\Windows\System\NbWjvrT.exe
  C:\Windows\System\NbWjvrT.exe
  2⤵
  PID:3256
- C:\Windows\System\zhJTSqR.exe
  C:\Windows\System\zhJTSqR.exe
  2⤵
  PID:3300
- C:\Windows\System\UGAVujx.exe
  C:\Windows\System\UGAVujx.exe
  2⤵
  PID:3260
- C:\Windows\System\EiVLfxk.exe
  C:\Windows\System\EiVLfxk.exe
  2⤵
  PID:3396
- C:\Windows\System\PcKynmZ.exe
  C:\Windows\System\PcKynmZ.exe
  2⤵
  PID:3432
- C:\Windows\System\IfNlZDP.exe
  C:\Windows\System\IfNlZDP.exe
  2⤵
  PID:3588
- C:\Windows\System\ZHsUimm.exe
  C:\Windows\System\ZHsUimm.exe
  2⤵
  PID:3608
- C:\Windows\System\SAHUjGi.exe
  C:\Windows\System\SAHUjGi.exe
  2⤵
  PID:3604
- C:\Windows\System\eAtbpvx.exe
  C:\Windows\System\eAtbpvx.exe
  2⤵
  PID:3676
- C:\Windows\System\DPbFosT.exe
  C:\Windows\System\DPbFosT.exe
  2⤵
  PID:3696
- C:\Windows\System\CVKFiJE.exe
  C:\Windows\System\CVKFiJE.exe
  2⤵
  PID:2144
- C:\Windows\System\EdnUxIV.exe
  C:\Windows\System\EdnUxIV.exe
  2⤵
  PID:1084
- C:\Windows\System\qfIZROO.exe
  C:\Windows\System\qfIZROO.exe
  2⤵
  PID:3700
- C:\Windows\System\RKxQWii.exe
  C:\Windows\System\RKxQWii.exe
  2⤵
  PID:3720
- C:\Windows\System\ZBrRite.exe
  C:\Windows\System\ZBrRite.exe
  2⤵
  PID:3736
- C:\Windows\System\vzWDXig.exe
  C:\Windows\System\vzWDXig.exe
  2⤵
  PID:3764
- C:\Windows\System\LkFVlgF.exe
  C:\Windows\System\LkFVlgF.exe
  2⤵
  PID:3868
- C:\Windows\System\fYAefuY.exe
  C:\Windows\System\fYAefuY.exe
  2⤵
  PID:3900
- C:\Windows\System\GYkAxOf.exe
  C:\Windows\System\GYkAxOf.exe
  2⤵
  PID:3960
- C:\Windows\System\abCdkQa.exe
  C:\Windows\System\abCdkQa.exe
  2⤵
  PID:4040
- C:\Windows\System\tjVryuA.exe
  C:\Windows\System\tjVryuA.exe
  2⤵
  PID:2712
- C:\Windows\System\uHllTrL.exe
  C:\Windows\System\uHllTrL.exe
  2⤵
  PID:2580
- C:\Windows\System\IOvSuBH.exe
  C:\Windows\System\IOvSuBH.exe
  2⤵
  PID:1336
- C:\Windows\System\cxUWveb.exe
  C:\Windows\System\cxUWveb.exe
  2⤵
  PID:3928
- C:\Windows\System\nzZbzUR.exe
  C:\Windows\System\nzZbzUR.exe
  2⤵
  PID:3076
- C:\Windows\System\iGErJXB.exe
  C:\Windows\System\iGErJXB.exe
  2⤵
  PID:3880
- C:\Windows\System\kHDMuaa.exe
  C:\Windows\System\kHDMuaa.exe
  2⤵
  PID:4012
- C:\Windows\System\ZOqecAl.exe
  C:\Windows\System\ZOqecAl.exe
  2⤵
  PID:4092
- C:\Windows\System\pcxTSle.exe
  C:\Windows\System\pcxTSle.exe
  2⤵
  PID:3984
- C:\Windows\System\PoRqEzC.exe
  C:\Windows\System\PoRqEzC.exe
  2⤵
  PID:3336
- C:\Windows\System\rxAEChM.exe
  C:\Windows\System\rxAEChM.exe
  2⤵
  PID:1076
- C:\Windows\System\LRAUwYD.exe
  C:\Windows\System\LRAUwYD.exe
  2⤵
  PID:3108
- C:\Windows\System\EUcBKKL.exe
  C:\Windows\System\EUcBKKL.exe
  2⤵
  PID:3544
- C:\Windows\System\usbwcId.exe
  C:\Windows\System\usbwcId.exe
  2⤵
  PID:3292
- C:\Windows\System\QKCLJQd.exe
  C:\Windows\System\QKCLJQd.exe
  2⤵
  PID:3392
- C:\Windows\System\VRKSUvs.exe
  C:\Windows\System\VRKSUvs.exe
  2⤵
  PID:3532
- C:\Windows\System\zvREsLh.exe
  C:\Windows\System\zvREsLh.exe
  2⤵
  PID:3580
- C:\Windows\System\wlrgjrz.exe
  C:\Windows\System\wlrgjrz.exe
  2⤵
  PID:3620
- C:\Windows\System\nAAJtZK.exe
  C:\Windows\System\nAAJtZK.exe
  2⤵
  PID:3648
- C:\Windows\System\FiLvmvL.exe
  C:\Windows\System\FiLvmvL.exe
  2⤵
  PID:3664
- C:\Windows\System\JXlcZAx.exe
  C:\Windows\System\JXlcZAx.exe
  2⤵
  PID:1136
- C:\Windows\System\WBYTMqV.exe
  C:\Windows\System\WBYTMqV.exe
  2⤵
  PID:3780
- C:\Windows\System\IWfchsJ.exe
  C:\Windows\System\IWfchsJ.exe
  2⤵
  PID:3716
- C:\Windows\System\kLFUqTC.exe
  C:\Windows\System\kLFUqTC.exe
  2⤵
  PID:3884
- C:\Windows\System\NdaRUVy.exe
  C:\Windows\System\NdaRUVy.exe
  2⤵
  PID:3968
- C:\Windows\System\eLdWMsE.exe
  C:\Windows\System\eLdWMsE.exe
  2⤵
  PID:3848
- C:\Windows\System\xioUEoy.exe
  C:\Windows\System\xioUEoy.exe
  2⤵
  PID:2620
- C:\Windows\System\zGuVyoZ.exe
  C:\Windows\System\zGuVyoZ.exe
  2⤵
  PID:3920
- C:\Windows\System\qflIveq.exe
  C:\Windows\System\qflIveq.exe
  2⤵
  PID:2608
- C:\Windows\System\LbollVH.exe
  C:\Windows\System\LbollVH.exe
  2⤵
  PID:2732
- C:\Windows\System\azfoKSW.exe
  C:\Windows\System\azfoKSW.exe
  2⤵
  PID:4052
- C:\Windows\System\mrdMJmK.exe
  C:\Windows\System\mrdMJmK.exe
  2⤵
  PID:3352
- C:\Windows\System\LrBWYVi.exe
  C:\Windows\System\LrBWYVi.exe
  2⤵
  PID:3388
- C:\Windows\System\GSaDoiW.exe
  C:\Windows\System\GSaDoiW.exe
  2⤵
  PID:3564
- C:\Windows\System\jyMnYcm.exe
  C:\Windows\System\jyMnYcm.exe
  2⤵
  PID:3412
- C:\Windows\System\qLCcDoW.exe
  C:\Windows\System\qLCcDoW.exe
  2⤵
  PID:3160
- C:\Windows\System\zfXKXIn.exe
  C:\Windows\System\zfXKXIn.exe
  2⤵
  PID:3500
- C:\Windows\System\HArkXjh.exe
  C:\Windows\System\HArkXjh.exe
  2⤵
  PID:3864
- C:\Windows\System\cDGLCnk.exe
  C:\Windows\System\cDGLCnk.exe
  2⤵
  PID:3652
- C:\Windows\System\WTuYwSQ.exe
  C:\Windows\System\WTuYwSQ.exe
  2⤵
  PID:3732
- C:\Windows\System\FgyVAPa.exe
  C:\Windows\System\FgyVAPa.exe
  2⤵
  PID:2108
- C:\Windows\System\SmyqXvU.exe
  C:\Windows\System\SmyqXvU.exe
  2⤵
  PID:3980
- C:\Windows\System\tIDilgz.exe
  C:\Windows\System\tIDilgz.exe
  2⤵
  PID:3100
- C:\Windows\System\uWCDEsu.exe
  C:\Windows\System\uWCDEsu.exe
  2⤵
  PID:2208
- C:\Windows\System\YCOeLlK.exe
  C:\Windows\System\YCOeLlK.exe
  2⤵
  PID:1540
- C:\Windows\System\zJErkLk.exe
  C:\Windows\System\zJErkLk.exe
  2⤵
  PID:3560
- C:\Windows\System\ixOsqCt.exe
  C:\Windows\System\ixOsqCt.exe
  2⤵
  PID:3836
- C:\Windows\System\YUgOzNs.exe
  C:\Windows\System\YUgOzNs.exe
  2⤵
  PID:3832
- C:\Windows\System\pSmFvSR.exe
  C:\Windows\System\pSmFvSR.exe
  2⤵
  PID:3372
- C:\Windows\System\YsXrRvx.exe
  C:\Windows\System\YsXrRvx.exe
  2⤵
  PID:4068
- C:\Windows\System\DNltJqZ.exe
  C:\Windows\System\DNltJqZ.exe
  2⤵
  PID:3948
- C:\Windows\System\LsrCUPN.exe
  C:\Windows\System\LsrCUPN.exe
  2⤵
  PID:3144
- C:\Windows\System\jQKvKfS.exe
  C:\Windows\System\jQKvKfS.exe
  2⤵
  PID:3048
- C:\Windows\System\DXkJpGR.exe
  C:\Windows\System\DXkJpGR.exe
  2⤵
  PID:3852
- C:\Windows\System\usbtekT.exe
  C:\Windows\System\usbtekT.exe
  2⤵
  PID:3348
- C:\Windows\System\qLfHKOf.exe
  C:\Windows\System\qLfHKOf.exe
  2⤵
  PID:3788
- C:\Windows\System\PLghSOH.exe
  C:\Windows\System\PLghSOH.exe
  2⤵
  PID:3220
- C:\Windows\System\jdKiHiH.exe
  C:\Windows\System\jdKiHiH.exe
  2⤵
  PID:2528
- C:\Windows\System\VhpBBln.exe
  C:\Windows\System\VhpBBln.exe
  2⤵
  PID:3520
- C:\Windows\System\aaGDJlv.exe
  C:\Windows\System\aaGDJlv.exe
  2⤵
  PID:3204
- C:\Windows\System\dlKTdnC.exe
  C:\Windows\System\dlKTdnC.exe
  2⤵
  PID:3548
- C:\Windows\System\IhNfTGr.exe
  C:\Windows\System\IhNfTGr.exe
  2⤵
  PID:3628
- C:\Windows\System\CGMpjpG.exe
  C:\Windows\System\CGMpjpG.exe
  2⤵
  PID:3784
- C:\Windows\System\wHgqGlb.exe
  C:\Windows\System\wHgqGlb.exe
  2⤵
  PID:3936
- C:\Windows\System\FZpDhoZ.exe
  C:\Windows\System\FZpDhoZ.exe
  2⤵
  PID:4108
- C:\Windows\System\BFUxrva.exe
  C:\Windows\System\BFUxrva.exe
  2⤵
  PID:4152
- C:\Windows\System\BeRpZzI.exe
  C:\Windows\System\BeRpZzI.exe
  2⤵
  PID:4168
- C:\Windows\System\sSCpFro.exe
  C:\Windows\System\sSCpFro.exe
  2⤵
  PID:4188
- C:\Windows\System\gvALpSI.exe
  C:\Windows\System\gvALpSI.exe
  2⤵
  PID:4204
- C:\Windows\System\HSrLKAp.exe
  C:\Windows\System\HSrLKAp.exe
  2⤵
  PID:4224
- C:\Windows\System\HTNiGdm.exe
  C:\Windows\System\HTNiGdm.exe
  2⤵
  PID:4244
- C:\Windows\System\fTDURbE.exe
  C:\Windows\System\fTDURbE.exe
  2⤵
  PID:4264
- C:\Windows\System\amJZPxE.exe
  C:\Windows\System\amJZPxE.exe
  2⤵
  PID:4280
- C:\Windows\System\zAaFnlv.exe
  C:\Windows\System\zAaFnlv.exe
  2⤵
  PID:4296
- C:\Windows\System\djopVJU.exe
  C:\Windows\System\djopVJU.exe
  2⤵
  PID:4312
- C:\Windows\System\jjuiPzh.exe
  C:\Windows\System\jjuiPzh.exe
  2⤵
  PID:4356
- C:\Windows\System\bynkoQS.exe
  C:\Windows\System\bynkoQS.exe
  2⤵
  PID:4372
- C:\Windows\System\XPdkkxE.exe
  C:\Windows\System\XPdkkxE.exe
  2⤵
  PID:4392
- C:\Windows\System\ComtlCV.exe
  C:\Windows\System\ComtlCV.exe
  2⤵
  PID:4412
- C:\Windows\System\rclvjmX.exe
  C:\Windows\System\rclvjmX.exe
  2⤵
  PID:4432
- C:\Windows\System\AvWxADR.exe
  C:\Windows\System\AvWxADR.exe
  2⤵
  PID:4448
- C:\Windows\System\JCtzBwp.exe
  C:\Windows\System\JCtzBwp.exe
  2⤵
  PID:4464
- C:\Windows\System\yVjpaqm.exe
  C:\Windows\System\yVjpaqm.exe
  2⤵
  PID:4484
- C:\Windows\System\TRQZNBw.exe
  C:\Windows\System\TRQZNBw.exe
  2⤵
  PID:4500
- C:\Windows\System\gMnyujc.exe
  C:\Windows\System\gMnyujc.exe
  2⤵
  PID:4516
- C:\Windows\System\seGVACN.exe
  C:\Windows\System\seGVACN.exe
  2⤵
  PID:4532
- C:\Windows\System\BpgNwBd.exe
  C:\Windows\System\BpgNwBd.exe
  2⤵
  PID:4604
- C:\Windows\System\OoIXpAI.exe
  C:\Windows\System\OoIXpAI.exe
  2⤵
  PID:4624
- C:\Windows\System\nmGOrSQ.exe
  C:\Windows\System\nmGOrSQ.exe
  2⤵
  PID:4648
- C:\Windows\System\DEULhPP.exe
  C:\Windows\System\DEULhPP.exe
  2⤵
  PID:4664
- C:\Windows\System\bPuVfXc.exe
  C:\Windows\System\bPuVfXc.exe
  2⤵
  PID:4680
- C:\Windows\System\VgojwKq.exe
  C:\Windows\System\VgojwKq.exe
  2⤵
  PID:4700
- C:\Windows\System\kwcVBZD.exe
  C:\Windows\System\kwcVBZD.exe
  2⤵
  PID:4716
- C:\Windows\System\VaEteFh.exe
  C:\Windows\System\VaEteFh.exe
  2⤵
  PID:4732
- C:\Windows\System\tyGAQEU.exe
  C:\Windows\System\tyGAQEU.exe
  2⤵
  PID:4752
- C:\Windows\System\BQsfLhQ.exe
  C:\Windows\System\BQsfLhQ.exe
  2⤵
  PID:4772
- C:\Windows\System\fbDEfTZ.exe
  C:\Windows\System\fbDEfTZ.exe
  2⤵
  PID:4788
- C:\Windows\System\zhNberi.exe
  C:\Windows\System\zhNberi.exe
  2⤵
  PID:4812
- C:\Windows\System\ZdRCdFq.exe
  C:\Windows\System\ZdRCdFq.exe
  2⤵
  PID:4836
- C:\Windows\System\HPQAvOI.exe
  C:\Windows\System\HPQAvOI.exe
  2⤵
  PID:4852
- C:\Windows\System\eMPMEwc.exe
  C:\Windows\System\eMPMEwc.exe
  2⤵
  PID:4868
- C:\Windows\System\RZDSkym.exe
  C:\Windows\System\RZDSkym.exe
  2⤵
  PID:4884
- C:\Windows\System\pDjpRXN.exe
  C:\Windows\System\pDjpRXN.exe
  2⤵
  PID:4900
- C:\Windows\System\UWFBKBu.exe
  C:\Windows\System\UWFBKBu.exe
  2⤵
  PID:4916
- C:\Windows\System\DCGLHEJ.exe
  C:\Windows\System\DCGLHEJ.exe
  2⤵
  PID:4988
- C:\Windows\System\OQJbqQZ.exe
  C:\Windows\System\OQJbqQZ.exe
  2⤵
  PID:5004
- C:\Windows\System\BrkJGCh.exe
  C:\Windows\System\BrkJGCh.exe
  2⤵
  PID:5020
- C:\Windows\System\dmuccyX.exe
  C:\Windows\System\dmuccyX.exe
  2⤵
  PID:5056
- C:\Windows\System\MXwkTjS.exe
  C:\Windows\System\MXwkTjS.exe
  2⤵
  PID:5076
- C:\Windows\System\MDxWyoH.exe
  C:\Windows\System\MDxWyoH.exe
  2⤵
  PID:5092
- C:\Windows\System\kBNZrAA.exe
  C:\Windows\System\kBNZrAA.exe
  2⤵
  PID:5108
- C:\Windows\System\wZtxWeE.exe
  C:\Windows\System\wZtxWeE.exe
  2⤵
  PID:4100
- C:\Windows\System\xbWNbVf.exe
  C:\Windows\System\xbWNbVf.exe
  2⤵
  PID:4164
- C:\Windows\System\OCdqKts.exe
  C:\Windows\System\OCdqKts.exe
  2⤵
  PID:3476
- C:\Windows\System\JYThUjt.exe
  C:\Windows\System\JYThUjt.exe
  2⤵
  PID:4200
- C:\Windows\System\ODwtSKO.exe
  C:\Windows\System\ODwtSKO.exe
  2⤵
  PID:4240
- C:\Windows\System\peJzVPa.exe
  C:\Windows\System\peJzVPa.exe
  2⤵
  PID:4364
- C:\Windows\System\HKXdoFn.exe
  C:\Windows\System\HKXdoFn.exe
  2⤵
  PID:4148
- C:\Windows\System\tvUjnyc.exe
  C:\Windows\System\tvUjnyc.exe
  2⤵
  PID:4444
- C:\Windows\System\wrVlmHZ.exe
  C:\Windows\System\wrVlmHZ.exe
  2⤵
  PID:4420
- C:\Windows\System\qwTbkZl.exe
  C:\Windows\System\qwTbkZl.exe
  2⤵
  PID:4548
- C:\Windows\System\jczpYrR.exe
  C:\Windows\System\jczpYrR.exe
  2⤵
  PID:4576
- C:\Windows\System\Zrszwdn.exe
  C:\Windows\System\Zrszwdn.exe
  2⤵
  PID:4592
- C:\Windows\System\kOuRsCL.exe
  C:\Windows\System\kOuRsCL.exe
  2⤵
  PID:4340
- C:\Windows\System\AlAQsSu.exe
  C:\Windows\System\AlAQsSu.exe
  2⤵
  PID:4600
- C:\Windows\System\yPMbCqB.exe
  C:\Windows\System\yPMbCqB.exe
  2⤵
  PID:4380
- C:\Windows\System\ocFUxDS.exe
  C:\Windows\System\ocFUxDS.exe
  2⤵
  PID:4496
- C:\Windows\System\ytkPvir.exe
  C:\Windows\System\ytkPvir.exe
  2⤵
  PID:4676
- C:\Windows\System\grVXdxD.exe
  C:\Windows\System\grVXdxD.exe
  2⤵
  PID:4708
- C:\Windows\System\TMuBgxf.exe
  C:\Windows\System\TMuBgxf.exe
  2⤵
  PID:4896
- C:\Windows\System\bFQsnoR.exe
  C:\Windows\System\bFQsnoR.exe
  2⤵
  PID:4820
- C:\Windows\System\TCLZrOO.exe
  C:\Windows\System\TCLZrOO.exe
  2⤵
  PID:4928
- C:\Windows\System\atYalha.exe
  C:\Windows\System\atYalha.exe
  2⤵
  PID:4760
- C:\Windows\System\rgrfSlV.exe
  C:\Windows\System\rgrfSlV.exe
  2⤵
  PID:4956
- C:\Windows\System\mruxzOY.exe
  C:\Windows\System\mruxzOY.exe
  2⤵
  PID:4912
- C:\Windows\System\thRRYxz.exe
  C:\Windows\System\thRRYxz.exe
  2⤵
  PID:4964
- C:\Windows\System\NzGbxHM.exe
  C:\Windows\System\NzGbxHM.exe
  2⤵
  PID:5100
- C:\Windows\System\iDaccVa.exe
  C:\Windows\System\iDaccVa.exe
  2⤵
  PID:4120
- C:\Windows\System\TLzRGGR.exe
  C:\Windows\System\TLzRGGR.exe
  2⤵
  PID:4144
- C:\Windows\System\RAsCPQU.exe
  C:\Windows\System\RAsCPQU.exe
  2⤵
  PID:4368
- C:\Windows\System\reclICV.exe
  C:\Windows\System\reclICV.exe
  2⤵
  PID:5032
- C:\Windows\System\MkgTimL.exe
  C:\Windows\System\MkgTimL.exe
  2⤵
  PID:4408
- C:\Windows\System\HxCsDCG.exe
  C:\Windows\System\HxCsDCG.exe
  2⤵
  PID:5044
- C:\Windows\System\BaPbBVx.exe
  C:\Windows\System\BaPbBVx.exe
  2⤵
  PID:4176
- C:\Windows\System\gbIkBUK.exe
  C:\Windows\System\gbIkBUK.exe
  2⤵
  PID:4388
- C:\Windows\System\YYKPgrm.exe
  C:\Windows\System\YYKPgrm.exe
  2⤵
  PID:4540
- C:\Windows\System\VDxoqiJ.exe
  C:\Windows\System\VDxoqiJ.exe
  2⤵
  PID:4292
- C:\Windows\System\rJctJlK.exe
  C:\Windows\System\rJctJlK.exe
  2⤵
  PID:4560
- C:\Windows\System\gHTWRhu.exe
  C:\Windows\System\gHTWRhu.exe
  2⤵
  PID:4636
- C:\Windows\System\LeKOqjE.exe
  C:\Windows\System\LeKOqjE.exe
  2⤵
  PID:4568
- C:\Windows\System\VUdXHEy.exe
  C:\Windows\System\VUdXHEy.exe
  2⤵
  PID:4864
- C:\Windows\System\RztZyed.exe
  C:\Windows\System\RztZyed.exe
  2⤵
  PID:4824
- C:\Windows\System\AWJMzOH.exe
  C:\Windows\System\AWJMzOH.exe
  2⤵
  PID:4780
- C:\Windows\System\zRytCvV.exe
  C:\Windows\System\zRytCvV.exe
  2⤵
  PID:4844
- C:\Windows\System\CeGwcNW.exe
  C:\Windows\System\CeGwcNW.exe
  2⤵
  PID:4848
- C:\Windows\System\qVNjrtO.exe
  C:\Windows\System\qVNjrtO.exe
  2⤵
  PID:4768
- C:\Windows\System\fmZGFpb.exe
  C:\Windows\System\fmZGFpb.exe
  2⤵
  PID:4960
- C:\Windows\System\LoGJPVv.exe
  C:\Windows\System\LoGJPVv.exe
  2⤵
  PID:5072
- C:\Windows\System\emURmxz.exe
  C:\Windows\System\emURmxz.exe
  2⤵
  PID:4272
- C:\Windows\System\CYVJUTa.exe
  C:\Windows\System\CYVJUTa.exe
  2⤵
  PID:4404
- C:\Windows\System\dHUfjXn.exe
  C:\Windows\System\dHUfjXn.exe
  2⤵
  PID:4832
- C:\Windows\System\mfsQdKw.exe
  C:\Windows\System\mfsQdKw.exe
  2⤵
  PID:5000
- C:\Windows\System\rGSIETr.exe
  C:\Windows\System\rGSIETr.exe
  2⤵
  PID:4480
- C:\Windows\System\DXdxbCr.exe
  C:\Windows\System\DXdxbCr.exe
  2⤵
  PID:4564
- C:\Windows\System\qOgZwVM.exe
  C:\Windows\System\qOgZwVM.exe
  2⤵
  PID:4440
- C:\Windows\System\UpQnrtM.exe
  C:\Windows\System\UpQnrtM.exe
  2⤵
  PID:4584
- C:\Windows\System\xDppcBA.exe
  C:\Windows\System\xDppcBA.exe
  2⤵
  PID:4336
- C:\Windows\System\asiCjkh.exe
  C:\Windows\System\asiCjkh.exe
  2⤵
  PID:4692
- C:\Windows\System\gbvaPHF.exe
  C:\Windows\System\gbvaPHF.exe
  2⤵
  PID:4800
- C:\Windows\System\oxLRPzG.exe
  C:\Windows\System\oxLRPzG.exe
  2⤵
  PID:4860
- C:\Windows\System\WDUenhb.exe
  C:\Windows\System\WDUenhb.exe
  2⤵
  PID:3668
- C:\Windows\System\fmtOsnI.exe
  C:\Windows\System\fmtOsnI.exe
  2⤵
  PID:5084
- C:\Windows\System\svvVcBc.exe
  C:\Windows\System\svvVcBc.exe
  2⤵
  PID:4460
- C:\Windows\System\urXJhtq.exe
  C:\Windows\System\urXJhtq.exe
  2⤵
  PID:4352
- C:\Windows\System\HVzCIfX.exe
  C:\Windows\System\HVzCIfX.exe
  2⤵
  PID:4644
- C:\Windows\System\YojDXDQ.exe
  C:\Windows\System\YojDXDQ.exe
  2⤵
  PID:5040
- C:\Windows\System\hatPwVT.exe
  C:\Windows\System\hatPwVT.exe
  2⤵
  PID:4972
- C:\Windows\System\bwWqfqh.exe
  C:\Windows\System\bwWqfqh.exe
  2⤵
  PID:4968
- C:\Windows\System\ASEosEc.exe
  C:\Windows\System\ASEosEc.exe
  2⤵
  PID:4492
- C:\Windows\System\cmcpULh.exe
  C:\Windows\System\cmcpULh.exe
  2⤵
  PID:5164
- C:\Windows\System\fvhVUEy.exe
  C:\Windows\System\fvhVUEy.exe
  2⤵
  PID:5184
- C:\Windows\System\cnbYyUx.exe
  C:\Windows\System\cnbYyUx.exe
  2⤵
  PID:5200
- C:\Windows\System\zWUCsWO.exe
  C:\Windows\System\zWUCsWO.exe
  2⤵
  PID:5220
- C:\Windows\System\gNteoNW.exe
  C:\Windows\System\gNteoNW.exe
  2⤵
  PID:5236
- C:\Windows\System\MBvhOhd.exe
  C:\Windows\System\MBvhOhd.exe
  2⤵
  PID:5256
- C:\Windows\System\GkbxFSt.exe
  C:\Windows\System\GkbxFSt.exe
  2⤵
  PID:5272
- C:\Windows\System\aQsdpWC.exe
  C:\Windows\System\aQsdpWC.exe
  2⤵
  PID:5288
- C:\Windows\System\oyVTzMe.exe
  C:\Windows\System\oyVTzMe.exe
  2⤵
  PID:5304
- C:\Windows\System\PHEQqBV.exe
  C:\Windows\System\PHEQqBV.exe
  2⤵
  PID:5320
- C:\Windows\System\Bcdywmi.exe
  C:\Windows\System\Bcdywmi.exe
  2⤵
  PID:5336
- C:\Windows\System\MxJrDXB.exe
  C:\Windows\System\MxJrDXB.exe
  2⤵
  PID:5356
- C:\Windows\System\ZhGibya.exe
  C:\Windows\System\ZhGibya.exe
  2⤵
  PID:5372
- C:\Windows\System\mxYhtgc.exe
  C:\Windows\System\mxYhtgc.exe
  2⤵
  PID:5388
- C:\Windows\System\LntTuRN.exe
  C:\Windows\System\LntTuRN.exe
  2⤵
  PID:5404
- C:\Windows\System\BZENnWA.exe
  C:\Windows\System\BZENnWA.exe
  2⤵
  PID:5420
- C:\Windows\System\wasyJSi.exe
  C:\Windows\System\wasyJSi.exe
  2⤵
  PID:5436
- C:\Windows\System\IBKEQnE.exe
  C:\Windows\System\IBKEQnE.exe
  2⤵
  PID:5452
- C:\Windows\System\xEhdIaY.exe
  C:\Windows\System\xEhdIaY.exe
  2⤵
  PID:5468
- C:\Windows\System\Hfvloak.exe
  C:\Windows\System\Hfvloak.exe
  2⤵
  PID:5488
- C:\Windows\System\bWhOOst.exe
  C:\Windows\System\bWhOOst.exe
  2⤵
  PID:5504
- C:\Windows\System\HFNPPDR.exe
  C:\Windows\System\HFNPPDR.exe
  2⤵
  PID:5520
- C:\Windows\System\sSStcne.exe
  C:\Windows\System\sSStcne.exe
  2⤵
  PID:5536
- C:\Windows\System\CBDItOA.exe
  C:\Windows\System\CBDItOA.exe
  2⤵
  PID:5552
- C:\Windows\System\GKFiTrs.exe
  C:\Windows\System\GKFiTrs.exe
  2⤵
  PID:5568
- C:\Windows\System\PMyiTYE.exe
  C:\Windows\System\PMyiTYE.exe
  2⤵
  PID:5592
- C:\Windows\System\eLRZDIN.exe
  C:\Windows\System\eLRZDIN.exe
  2⤵
  PID:5616
- C:\Windows\System\SHiMsxc.exe
  C:\Windows\System\SHiMsxc.exe
  2⤵
  PID:5640
- C:\Windows\System\waCPSki.exe
  C:\Windows\System\waCPSki.exe
  2⤵
  PID:5660
- C:\Windows\System\jHpQOEE.exe
  C:\Windows\System\jHpQOEE.exe
  2⤵
  PID:5676
- C:\Windows\System\WGYMIRD.exe
  C:\Windows\System\WGYMIRD.exe
  2⤵
  PID:5696
- C:\Windows\System\oQEbAzM.exe
  C:\Windows\System\oQEbAzM.exe
  2⤵
  PID:5712
- C:\Windows\System\ygoZmgt.exe
  C:\Windows\System\ygoZmgt.exe
  2⤵
  PID:5732
- C:\Windows\System\xRUyKIw.exe
  C:\Windows\System\xRUyKIw.exe
  2⤵
  PID:5748
- C:\Windows\System\bQLbnYM.exe
  C:\Windows\System\bQLbnYM.exe
  2⤵
  PID:5800
- C:\Windows\System\gPJWCMB.exe
  C:\Windows\System\gPJWCMB.exe
  2⤵
  PID:5816
- C:\Windows\System\dxIOJUS.exe
  C:\Windows\System\dxIOJUS.exe
  2⤵
  PID:5832
- C:\Windows\System\UTMHMUz.exe
  C:\Windows\System\UTMHMUz.exe
  2⤵
  PID:5848
- C:\Windows\System\djkwsCw.exe
  C:\Windows\System\djkwsCw.exe
  2⤵
  PID:5884
- C:\Windows\System\mEHANQs.exe
  C:\Windows\System\mEHANQs.exe
  2⤵
  PID:5900
- C:\Windows\System\WjiQzzb.exe
  C:\Windows\System\WjiQzzb.exe
  2⤵
  PID:5920
- C:\Windows\System\XPoJzQG.exe
  C:\Windows\System\XPoJzQG.exe
  2⤵
  PID:5940
- C:\Windows\System\SAlvRtY.exe
  C:\Windows\System\SAlvRtY.exe
  2⤵
  PID:5964
- C:\Windows\System\qeqbZsg.exe
  C:\Windows\System\qeqbZsg.exe
  2⤵
  PID:5984
- C:\Windows\System\LljSPPf.exe
  C:\Windows\System\LljSPPf.exe
  2⤵
  PID:6000
- C:\Windows\System\LTxwTxq.exe
  C:\Windows\System\LTxwTxq.exe
  2⤵
  PID:6016
- C:\Windows\System\EKOmhnP.exe
  C:\Windows\System\EKOmhnP.exe
  2⤵
  PID:6032
- C:\Windows\System\iFaZCpq.exe
  C:\Windows\System\iFaZCpq.exe
  2⤵
  PID:6056
- C:\Windows\System\esGGEAs.exe
  C:\Windows\System\esGGEAs.exe
  2⤵
  PID:6076
- C:\Windows\System\TzKUqxv.exe
  C:\Windows\System\TzKUqxv.exe
  2⤵
  PID:6092
- C:\Windows\System\kGnPdgF.exe
  C:\Windows\System\kGnPdgF.exe
  2⤵
  PID:6140
- C:\Windows\System\kMSVkhU.exe
  C:\Windows\System\kMSVkhU.exe
  2⤵
  PID:4880
- C:\Windows\System\BAhxGaH.exe
  C:\Windows\System\BAhxGaH.exe
  2⤵
  PID:4476
- C:\Windows\System\TlCGocX.exe
  C:\Windows\System\TlCGocX.exe
  2⤵
  PID:4512
- C:\Windows\System\BbwMkYl.exe
  C:\Windows\System\BbwMkYl.exe
  2⤵
  PID:5136
- C:\Windows\System\YSlfOHY.exe
  C:\Windows\System\YSlfOHY.exe
  2⤵
  PID:5152
- C:\Windows\System\XJAqhZY.exe
  C:\Windows\System\XJAqhZY.exe
  2⤵
  PID:5228
- C:\Windows\System\EsUpBcr.exe
  C:\Windows\System\EsUpBcr.exe
  2⤵
  PID:5048
- C:\Windows\System\EhfuIuQ.exe
  C:\Windows\System\EhfuIuQ.exe
  2⤵
  PID:5208
- C:\Windows\System\SpxJysx.exe
  C:\Windows\System\SpxJysx.exe
  2⤵
  PID:5280
- C:\Windows\System\RlvgzwP.exe
  C:\Windows\System\RlvgzwP.exe
  2⤵
  PID:5328
- C:\Windows\System\GUsZCYN.exe
  C:\Windows\System\GUsZCYN.exe
  2⤵
  PID:5396
- C:\Windows\System\TavQlxY.exe
  C:\Windows\System\TavQlxY.exe
  2⤵
  PID:5460
- C:\Windows\System\EWueIhK.exe
  C:\Windows\System\EWueIhK.exe
  2⤵
  PID:5532
- C:\Windows\System\oKUSHPZ.exe
  C:\Windows\System\oKUSHPZ.exe
  2⤵
  PID:5484
- C:\Windows\System\iRfOBAK.exe
  C:\Windows\System\iRfOBAK.exe
  2⤵
  PID:5352
- C:\Windows\System\CRxCOoW.exe
  C:\Windows\System\CRxCOoW.exe
  2⤵
  PID:5448
- C:\Windows\System\rJIJKEi.exe
  C:\Windows\System\rJIJKEi.exe
  2⤵
  PID:5544
- C:\Windows\System\waerpnT.exe
  C:\Windows\System\waerpnT.exe
  2⤵
  PID:5624
- C:\Windows\System\haxtNwK.exe
  C:\Windows\System\haxtNwK.exe
  2⤵
  PID:5656
- C:\Windows\System\cfSHsMj.exe
  C:\Windows\System\cfSHsMj.exe
  2⤵
  PID:5688
- C:\Windows\System\QCzxwHy.exe
  C:\Windows\System\QCzxwHy.exe
  2⤵
  PID:5672
- C:\Windows\System\LmYXnJB.exe
  C:\Windows\System\LmYXnJB.exe
  2⤵
  PID:5744
- C:\Windows\System\jLJjatl.exe
  C:\Windows\System\jLJjatl.exe
  2⤵
  PID:5768
- C:\Windows\System\UnXoYjP.exe
  C:\Windows\System\UnXoYjP.exe
  2⤵
  PID:5788
- C:\Windows\System\bXoUiVs.exe
  C:\Windows\System\bXoUiVs.exe
  2⤵
  PID:5844
- C:\Windows\System\MvZdWEZ.exe
  C:\Windows\System\MvZdWEZ.exe
  2⤵
  PID:5840
- C:\Windows\System\brncqyi.exe
  C:\Windows\System\brncqyi.exe
  2⤵
  PID:5892
- C:\Windows\System\jpLacPN.exe
  C:\Windows\System\jpLacPN.exe
  2⤵
  PID:5908
- C:\Windows\System\YPDuXUY.exe
  C:\Windows\System\YPDuXUY.exe
  2⤵
  PID:6072
- C:\Windows\System\sPhFcZE.exe
  C:\Windows\System\sPhFcZE.exe
  2⤵
  PID:6104
- C:\Windows\System\LjFlyeS.exe
  C:\Windows\System\LjFlyeS.exe
  2⤵
  PID:4276
- C:\Windows\System\HCBfJvj.exe
  C:\Windows\System\HCBfJvj.exe
  2⤵
  PID:5576
- C:\Windows\System\TUMqKTB.exe
  C:\Windows\System\TUMqKTB.exe
  2⤵
  PID:5384
- C:\Windows\System\TNPNrLj.exe
  C:\Windows\System\TNPNrLj.exe
  2⤵
  PID:5608
- C:\Windows\System\zLRkyWM.exe
  C:\Windows\System\zLRkyWM.exe
  2⤵
  PID:5244
- C:\Windows\System\Aimimrw.exe
  C:\Windows\System\Aimimrw.exe
  2⤵
  PID:5808
- C:\Windows\System\GcpHMbL.exe
  C:\Windows\System\GcpHMbL.exe
  2⤵
  PID:5652
- C:\Windows\System\mgewIFK.exe
  C:\Windows\System\mgewIFK.exe
  2⤵
  PID:5780
- C:\Windows\System\kJmyVDS.exe
  C:\Windows\System\kJmyVDS.exe
  2⤵
  PID:5916
- C:\Windows\System\IlMdLpP.exe
  C:\Windows\System\IlMdLpP.exe
  2⤵
  PID:6008
- C:\Windows\System\MpiZHVF.exe
  C:\Windows\System\MpiZHVF.exe
  2⤵
  PID:5952
- C:\Windows\System\MUbtNvf.exe
  C:\Windows\System\MUbtNvf.exe
  2⤵
  PID:4940
- C:\Windows\System\MHGWUdt.exe
  C:\Windows\System\MHGWUdt.exe
  2⤵
  PID:6024
- C:\Windows\System\XjUSUFP.exe
  C:\Windows\System\XjUSUFP.exe
  2⤵
  PID:6048
- C:\Windows\System\QnNodUv.exe
  C:\Windows\System\QnNodUv.exe
  2⤵
  PID:4744
- C:\Windows\System\UcMTfYe.exe
  C:\Windows\System\UcMTfYe.exe
  2⤵
  PID:5264
- C:\Windows\System\uMfVPeR.exe
  C:\Windows\System\uMfVPeR.exe
  2⤵
  PID:6124
- C:\Windows\System\fEKKDaO.exe
  C:\Windows\System\fEKKDaO.exe
  2⤵
  PID:5128
- C:\Windows\System\WqAjCbO.exe
  C:\Windows\System\WqAjCbO.exe
  2⤵
  PID:5564
- C:\Windows\System\BMcSjmD.exe
  C:\Windows\System\BMcSjmD.exe
  2⤵
  PID:5432
- C:\Windows\System\uMqLJnl.exe
  C:\Windows\System\uMqLJnl.exe
  2⤵
  PID:5604
- C:\Windows\System\yFqULKk.exe
  C:\Windows\System\yFqULKk.exe
  2⤵
  PID:5344
- C:\Windows\System\SvmKUSp.exe
  C:\Windows\System\SvmKUSp.exe
  2⤵
  PID:5512
- C:\Windows\System\MBjObXR.exe
  C:\Windows\System\MBjObXR.exe
  2⤵
  PID:5648
- C:\Windows\System\PaMYtLd.exe
  C:\Windows\System\PaMYtLd.exe
  2⤵
  PID:5580
- C:\Windows\System\KmihriB.exe
  C:\Windows\System\KmihriB.exe
  2⤵
  PID:5928
- C:\Windows\System\sOPygZm.exe
  C:\Windows\System\sOPygZm.exe
  2⤵
  PID:6064
- C:\Windows\System\lkIqhGE.exe
  C:\Windows\System\lkIqhGE.exe
  2⤵
  PID:5172
- C:\Windows\System\CQyFQSr.exe
  C:\Windows\System\CQyFQSr.exe
  2⤵
  PID:5828
- C:\Windows\System\oVDuuac.exe
  C:\Windows\System\oVDuuac.exe
  2⤵
  PID:5980
- C:\Windows\System\dzTRybS.exe
  C:\Windows\System\dzTRybS.exe
  2⤵
  PID:5960
- C:\Windows\System\HMqxiri.exe
  C:\Windows\System\HMqxiri.exe
  2⤵
  PID:5196
- C:\Windows\System\heOLrmv.exe
  C:\Windows\System\heOLrmv.exe
  2⤵
  PID:5132
- C:\Windows\System\dJHmFDW.exe
  C:\Windows\System\dJHmFDW.exe
  2⤵
  PID:5444
- C:\Windows\System\hEivUoy.exe
  C:\Windows\System\hEivUoy.exe
  2⤵
  PID:5764
- C:\Windows\System\USeAsBh.exe
  C:\Windows\System\USeAsBh.exe
  2⤵
  PID:6160
- C:\Windows\System\tzKciET.exe
  C:\Windows\System\tzKciET.exe
  2⤵
  PID:6176
- C:\Windows\System\hUKkKbG.exe
  C:\Windows\System\hUKkKbG.exe
  2⤵
  PID:6192
- C:\Windows\System\WznfvSt.exe
  C:\Windows\System\WznfvSt.exe
  2⤵
  PID:6208
- C:\Windows\System\mpbGimR.exe
  C:\Windows\System\mpbGimR.exe
  2⤵
  PID:6224
- C:\Windows\System\OcvRcWZ.exe
  C:\Windows\System\OcvRcWZ.exe
  2⤵
  PID:6240
- C:\Windows\System\SpIDlQS.exe
  C:\Windows\System\SpIDlQS.exe
  2⤵
  PID:6256
- C:\Windows\System\XNqYdIc.exe
  C:\Windows\System\XNqYdIc.exe
  2⤵
  PID:6276
- C:\Windows\System\HslQBBe.exe
  C:\Windows\System\HslQBBe.exe
  2⤵
  PID:6292
- C:\Windows\System\zSThcJs.exe
  C:\Windows\System\zSThcJs.exe
  2⤵
  PID:6316
- C:\Windows\System\NPsSotg.exe
  C:\Windows\System\NPsSotg.exe
  2⤵
  PID:6336
- C:\Windows\System\BMhziGJ.exe
  C:\Windows\System\BMhziGJ.exe
  2⤵
  PID:6352
- C:\Windows\System\DaTITgb.exe
  C:\Windows\System\DaTITgb.exe
  2⤵
  PID:6368
- C:\Windows\System\SmfvUZV.exe
  C:\Windows\System\SmfvUZV.exe
  2⤵
  PID:6388
- C:\Windows\System\VqhHpfK.exe
  C:\Windows\System\VqhHpfK.exe
  2⤵
  PID:6404
- C:\Windows\System\BVDKMEQ.exe
  C:\Windows\System\BVDKMEQ.exe
  2⤵
  PID:6420
- C:\Windows\System\xMtXohz.exe
  C:\Windows\System\xMtXohz.exe
  2⤵
  PID:6436
- C:\Windows\System\VPPpNlZ.exe
  C:\Windows\System\VPPpNlZ.exe
  2⤵
  PID:6452
- C:\Windows\System\snmRScC.exe
  C:\Windows\System\snmRScC.exe
  2⤵
  PID:6468
- C:\Windows\System\ODrZeTd.exe
  C:\Windows\System\ODrZeTd.exe
  2⤵
  PID:6484
- C:\Windows\System\FyTfvIb.exe
  C:\Windows\System\FyTfvIb.exe
  2⤵
  PID:6500
- C:\Windows\System\vZlFsoU.exe
  C:\Windows\System\vZlFsoU.exe
  2⤵
  PID:6516
- C:\Windows\System\oEDCGjU.exe
  C:\Windows\System\oEDCGjU.exe
  2⤵
  PID:6536
- C:\Windows\System\JGnGSJS.exe
  C:\Windows\System\JGnGSJS.exe
  2⤵
  PID:6552
- C:\Windows\System\IsejrZg.exe
  C:\Windows\System\IsejrZg.exe
  2⤵
  PID:6568
- C:\Windows\System\ORJUbxB.exe
  C:\Windows\System\ORJUbxB.exe
  2⤵
  PID:6592
- C:\Windows\System\kMkWfXb.exe
  C:\Windows\System\kMkWfXb.exe
  2⤵
  PID:6608
- C:\Windows\System\IEuSQab.exe
  C:\Windows\System\IEuSQab.exe
  2⤵
  PID:6624
- C:\Windows\System\fUxIEif.exe
  C:\Windows\System\fUxIEif.exe
  2⤵
  PID:6640
- C:\Windows\System\zfSmCFz.exe
  C:\Windows\System\zfSmCFz.exe
  2⤵
  PID:6656
- C:\Windows\System\OPSwpwJ.exe
  C:\Windows\System\OPSwpwJ.exe
  2⤵
  PID:6672
- C:\Windows\System\twkkhzw.exe
  C:\Windows\System\twkkhzw.exe
  2⤵
  PID:6688
- C:\Windows\System\SGKjKWY.exe
  C:\Windows\System\SGKjKWY.exe
  2⤵
  PID:6708
- C:\Windows\System\ntsWamM.exe
  C:\Windows\System\ntsWamM.exe
  2⤵
  PID:6724
- C:\Windows\System\TGZdoFI.exe
  C:\Windows\System\TGZdoFI.exe
  2⤵
  PID:6740
- C:\Windows\System\HHUMxcm.exe
  C:\Windows\System\HHUMxcm.exe
  2⤵
  PID:6760
- C:\Windows\System\QGPruse.exe
  C:\Windows\System\QGPruse.exe
  2⤵
  PID:6776
- C:\Windows\System\uAfpNpI.exe
  C:\Windows\System\uAfpNpI.exe
  2⤵
  PID:6792
- C:\Windows\System\zwwyNLh.exe
  C:\Windows\System\zwwyNLh.exe
  2⤵
  PID:6808
- C:\Windows\System\AzhLagS.exe
  C:\Windows\System\AzhLagS.exe
  2⤵
  PID:6824
- C:\Windows\System\QAZLfrc.exe
  C:\Windows\System\QAZLfrc.exe
  2⤵
  PID:6844
- C:\Windows\System\HAWEWBv.exe
  C:\Windows\System\HAWEWBv.exe
  2⤵
  PID:6860
- C:\Windows\System\jdpxtSM.exe
  C:\Windows\System\jdpxtSM.exe
  2⤵
  PID:6876
- C:\Windows\System\ZAjxQRZ.exe
  C:\Windows\System\ZAjxQRZ.exe
  2⤵
  PID:6892
- C:\Windows\System\YMjSpHp.exe
  C:\Windows\System\YMjSpHp.exe
  2⤵
  PID:6908
- C:\Windows\System\wibAKZK.exe
  C:\Windows\System\wibAKZK.exe
  2⤵
  PID:6924
- C:\Windows\System\IGjhRPp.exe
  C:\Windows\System\IGjhRPp.exe
  2⤵
  PID:6940
- C:\Windows\System\mdoIrsE.exe
  C:\Windows\System\mdoIrsE.exe
  2⤵
  PID:6960
- C:\Windows\System\KiuBMgc.exe
  C:\Windows\System\KiuBMgc.exe
  2⤵
  PID:6976
- C:\Windows\System\fxYsvdd.exe
  C:\Windows\System\fxYsvdd.exe
  2⤵
  PID:6992
- C:\Windows\System\GKbdKBG.exe
  C:\Windows\System\GKbdKBG.exe
  2⤵
  PID:7016
- C:\Windows\System\mpTDBty.exe
  C:\Windows\System\mpTDBty.exe
  2⤵
  PID:7036
- C:\Windows\System\FPMSEVC.exe
  C:\Windows\System\FPMSEVC.exe
  2⤵
  PID:7052
- C:\Windows\System\wcyadro.exe
  C:\Windows\System\wcyadro.exe
  2⤵
  PID:7072
- C:\Windows\System\GyhWPKa.exe
  C:\Windows\System\GyhWPKa.exe
  2⤵
  PID:7088
- C:\Windows\System\SqYfMgT.exe
  C:\Windows\System\SqYfMgT.exe
  2⤵
  PID:7112
- C:\Windows\System\PeBqhRt.exe
  C:\Windows\System\PeBqhRt.exe
  2⤵
  PID:7128
- C:\Windows\System\lEucKAt.exe
  C:\Windows\System\lEucKAt.exe
  2⤵
  PID:7152
- C:\Windows\System\LoxifjH.exe
  C:\Windows\System\LoxifjH.exe
  2⤵
  PID:5212
- C:\Windows\System\VCupJNl.exe
  C:\Windows\System\VCupJNl.exe
  2⤵
  PID:5796
- C:\Windows\System\bROSISf.exe
  C:\Windows\System\bROSISf.exe
  2⤵
  PID:5416
- C:\Windows\System\HMYBSvy.exe
  C:\Windows\System\HMYBSvy.exe
  2⤵
  PID:5176
- C:\Windows\System\uzhdsDu.exe
  C:\Windows\System\uzhdsDu.exe
  2⤵
  PID:5516
- C:\Windows\System\EYPSNMy.exe
  C:\Windows\System\EYPSNMy.exe
  2⤵
  PID:6168
- C:\Windows\System\QqQSEgS.exe
  C:\Windows\System\QqQSEgS.exe
  2⤵
  PID:6204
- C:\Windows\System\FthKEdk.exe
  C:\Windows\System\FthKEdk.exe
  2⤵
  PID:6156
- C:\Windows\System\XSbxQRt.exe
  C:\Windows\System\XSbxQRt.exe
  2⤵
  PID:6268
- C:\Windows\System\RGvGzlC.exe
  C:\Windows\System\RGvGzlC.exe
  2⤵
  PID:6184
- C:\Windows\System\rlZgIIP.exe
  C:\Windows\System\rlZgIIP.exe
  2⤵
  PID:6252
- C:\Windows\System\ctPbtxD.exe
  C:\Windows\System\ctPbtxD.exe
  2⤵
  PID:6580
- C:\Windows\System\uwXOcWc.exe
  C:\Windows\System\uwXOcWc.exe
  2⤵
  PID:6668
- C:\Windows\System\LBHNkBM.exe
  C:\Windows\System\LBHNkBM.exe
  2⤵
  PID:6684
- C:\Windows\System\CJszOXJ.exe
  C:\Windows\System\CJszOXJ.exe
  2⤵
  PID:6748
- C:\Windows\System\SYJqbMp.exe
  C:\Windows\System\SYJqbMp.exe
  2⤵
  PID:6756
- C:\Windows\System\SyYSfYG.exe
  C:\Windows\System\SyYSfYG.exe
  2⤵
  PID:6816
- C:\Windows\System\OAKjjzv.exe
  C:\Windows\System\OAKjjzv.exe
  2⤵
  PID:6736
- C:\Windows\System\gRygPkb.exe
  C:\Windows\System\gRygPkb.exe
  2⤵
  PID:6804
- C:\Windows\System\KhYHrio.exe
  C:\Windows\System\KhYHrio.exe
  2⤵
  PID:6888
- C:\Windows\System\MRHjPWK.exe
  C:\Windows\System\MRHjPWK.exe
  2⤵
  PID:6956
- C:\Windows\System\HcCRfyL.exe
  C:\Windows\System\HcCRfyL.exe
  2⤵
  PID:6936
- C:\Windows\System\aRGRHLY.exe
  C:\Windows\System\aRGRHLY.exe
  2⤵
  PID:7004
- C:\Windows\System\zIxLxEa.exe
  C:\Windows\System\zIxLxEa.exe
  2⤵
  PID:7032
- C:\Windows\System\PjttGmf.exe
  C:\Windows\System\PjttGmf.exe
  2⤵
  PID:7048
- C:\Windows\System\RtYEjkn.exe
  C:\Windows\System\RtYEjkn.exe
  2⤵
  PID:5668
- C:\Windows\System\RixFEWm.exe
  C:\Windows\System\RixFEWm.exe
  2⤵
  PID:7148
- C:\Windows\System\oppaaYS.exe
  C:\Windows\System\oppaaYS.exe
  2⤵
  PID:7100
- C:\Windows\System\MroaoYB.exe
  C:\Windows\System\MroaoYB.exe
  2⤵
  PID:5144
- C:\Windows\System\KUmxrnJ.exe
  C:\Windows\System\KUmxrnJ.exe
  2⤵
  PID:5364
- C:\Windows\System\FDpQrmX.exe
  C:\Windows\System\FDpQrmX.exe
  2⤵
  PID:6332
- C:\Windows\System\vkjBpiG.exe
  C:\Windows\System\vkjBpiG.exe
  2⤵
  PID:5348
- C:\Windows\System\VQhviST.exe
  C:\Windows\System\VQhviST.exe
  2⤵
  PID:4424
- C:\Windows\System\YuoZNoS.exe
  C:\Windows\System\YuoZNoS.exe
  2⤵
  PID:6376
- C:\Windows\System\MJdtFxY.exe
  C:\Windows\System\MJdtFxY.exe
  2⤵
  PID:6360
- C:\Windows\System\olVpZwQ.exe
  C:\Windows\System\olVpZwQ.exe
  2⤵
  PID:6384
- C:\Windows\System\lRxgLmc.exe
  C:\Windows\System\lRxgLmc.exe
  2⤵
  PID:6460
- C:\Windows\System\WpcMwgE.exe
  C:\Windows\System\WpcMwgE.exe
  2⤵
  PID:6236
- C:\Windows\System\LdXZUBx.exe
  C:\Windows\System\LdXZUBx.exe
  2⤵
  PID:6200
- C:\Windows\System\EsDJKoC.exe
  C:\Windows\System\EsDJKoC.exe
  2⤵
  PID:6588
- C:\Windows\System\FyIhfeV.exe
  C:\Windows\System\FyIhfeV.exe
  2⤵
  PID:6836
- C:\Windows\System\cfNBIlF.exe
  C:\Windows\System\cfNBIlF.exe
  2⤵
  PID:6904
- C:\Windows\System\JgnfEiU.exe
  C:\Windows\System\JgnfEiU.exe
  2⤵
  PID:6308
- C:\Windows\System\YlHTgYR.exe
  C:\Windows\System\YlHTgYR.exe
  2⤵
  PID:6616
- C:\Windows\System\nShhSES.exe
  C:\Windows\System\nShhSES.exe
  2⤵
  PID:6652
- C:\Windows\System\zuYetES.exe
  C:\Windows\System\zuYetES.exe
  2⤵
  PID:6832
- C:\Windows\System\NKlrfWc.exe
  C:\Windows\System\NKlrfWc.exe
  2⤵
  PID:6948
- C:\Windows\System\KkuLlHe.exe
  C:\Windows\System\KkuLlHe.exe
  2⤵
  PID:7080
- C:\Windows\System\RExaLCD.exe
  C:\Windows\System\RExaLCD.exe
  2⤵
  PID:6448
- C:\Windows\System\XDXBSXu.exe
  C:\Windows\System\XDXBSXu.exe
  2⤵
  PID:6304
- C:\Windows\System\fDyeojB.exe
  C:\Windows\System\fDyeojB.exe
  2⤵
  PID:7084
- C:\Windows\System\biptbQn.exe
  C:\Windows\System\biptbQn.exe
  2⤵
  PID:7136
- C:\Windows\System\lSZbScL.exe
  C:\Windows\System\lSZbScL.exe
  2⤵
  PID:7144
- C:\Windows\System\EdvndEE.exe
  C:\Windows\System\EdvndEE.exe
  2⤵
  PID:6312
- C:\Windows\System\oxZssCo.exe
  C:\Windows\System\oxZssCo.exe
  2⤵
  PID:6348
- C:\Windows\System\ibmSmJv.exe
  C:\Windows\System\ibmSmJv.exe
  2⤵
  PID:6772
- C:\Windows\System\IYELqqe.exe
  C:\Windows\System\IYELqqe.exe
  2⤵
  PID:7068
- C:\Windows\System\oMdMxYG.exe
  C:\Windows\System\oMdMxYG.exe
  2⤵
  PID:6920
- C:\Windows\System\gFgmtZX.exe
  C:\Windows\System\gFgmtZX.exe
  2⤵
  PID:7176
- C:\Windows\System\pDanfvO.exe
  C:\Windows\System\pDanfvO.exe
  2⤵
  PID:7196
- C:\Windows\System\LYNWZze.exe
  C:\Windows\System\LYNWZze.exe
  2⤵
  PID:7260
- C:\Windows\System\RytAlht.exe
  C:\Windows\System\RytAlht.exe
  2⤵
  PID:7300
- C:\Windows\System\CidAwEl.exe
  C:\Windows\System\CidAwEl.exe
  2⤵
  PID:7316
- C:\Windows\System\ecqEIlp.exe
  C:\Windows\System\ecqEIlp.exe
  2⤵
  PID:7332
- C:\Windows\System\BDWEAXj.exe
  C:\Windows\System\BDWEAXj.exe
  2⤵
  PID:7392
- C:\Windows\System\dgWjzQD.exe
  C:\Windows\System\dgWjzQD.exe
  2⤵
  PID:7408
- C:\Windows\System\xWODzuA.exe
  C:\Windows\System\xWODzuA.exe
  2⤵
  PID:7424
- C:\Windows\System\GvkGRME.exe
  C:\Windows\System\GvkGRME.exe
  2⤵
  PID:7468
- C:\Windows\System\HqBGCCW.exe
  C:\Windows\System\HqBGCCW.exe
  2⤵
  PID:7484
- C:\Windows\System\PhOiSbb.exe
  C:\Windows\System\PhOiSbb.exe
  2⤵
  PID:7500
- C:\Windows\System\BsYDvsP.exe
  C:\Windows\System\BsYDvsP.exe
  2⤵
  PID:7520
- C:\Windows\System\QkjSikH.exe
  C:\Windows\System\QkjSikH.exe
  2⤵
  PID:7536
- C:\Windows\System\MkoEDUB.exe
  C:\Windows\System\MkoEDUB.exe
  2⤵
  PID:7552
- C:\Windows\System\cwtxasn.exe
  C:\Windows\System\cwtxasn.exe
  2⤵
  PID:7568
- C:\Windows\System\XSviGBn.exe
  C:\Windows\System\XSviGBn.exe
  2⤵
  PID:7584
- C:\Windows\System\uthhqTs.exe
  C:\Windows\System\uthhqTs.exe
  2⤵
  PID:7628
- C:\Windows\System\CxDNmHN.exe
  C:\Windows\System\CxDNmHN.exe
  2⤵
  PID:7692
- C:\Windows\System\JlDHYVD.exe
  C:\Windows\System\JlDHYVD.exe
  2⤵
  PID:7708
- C:\Windows\System\dMMtakL.exe
  C:\Windows\System\dMMtakL.exe
  2⤵
  PID:7724
- C:\Windows\System\XLHUKtb.exe
  C:\Windows\System\XLHUKtb.exe
  2⤵
  PID:7740
- C:\Windows\System\xwgrPNG.exe
  C:\Windows\System\xwgrPNG.exe
  2⤵
  PID:7760
- C:\Windows\System\MGJWCcY.exe
  C:\Windows\System\MGJWCcY.exe
  2⤵
  PID:7776
- C:\Windows\System\JZlIglw.exe
  C:\Windows\System\JZlIglw.exe
  2⤵
  PID:7792
- C:\Windows\System\PpHCDrb.exe
  C:\Windows\System\PpHCDrb.exe
  2⤵
  PID:7808
- C:\Windows\System\ISuHLWm.exe
  C:\Windows\System\ISuHLWm.exe
  2⤵
  PID:7824
- C:\Windows\System\TkdQzuX.exe
  C:\Windows\System\TkdQzuX.exe
  2⤵
  PID:7844
- C:\Windows\System\IIcTfJw.exe
  C:\Windows\System\IIcTfJw.exe
  2⤵
  PID:7860
- C:\Windows\System\opjCOBo.exe
  C:\Windows\System\opjCOBo.exe
  2⤵
  PID:7880
- C:\Windows\System\IXryaqi.exe
  C:\Windows\System\IXryaqi.exe
  2⤵
  PID:7896
- C:\Windows\System\hKHuTZe.exe
  C:\Windows\System\hKHuTZe.exe
  2⤵
  PID:7912
- C:\Windows\System\EurkaNK.exe
  C:\Windows\System\EurkaNK.exe
  2⤵
  PID:7928
- C:\Windows\System\egsTSDg.exe
  C:\Windows\System\egsTSDg.exe
  2⤵
  PID:7944
- C:\Windows\System\tYXKbtZ.exe
  C:\Windows\System\tYXKbtZ.exe
  2⤵
  PID:7964
- C:\Windows\System\diZhYTW.exe
  C:\Windows\System\diZhYTW.exe
  2⤵
  PID:8000
- C:\Windows\System\OTZcdwd.exe
  C:\Windows\System\OTZcdwd.exe
  2⤵
  PID:8020
- C:\Windows\System\QCtXgmN.exe
  C:\Windows\System\QCtXgmN.exe
  2⤵
  PID:8036
- C:\Windows\System\ofaVWKU.exe
  C:\Windows\System\ofaVWKU.exe
  2⤵
  PID:8056
- C:\Windows\System\RzHPcDl.exe
  C:\Windows\System\RzHPcDl.exe
  2⤵
  PID:8072
- C:\Windows\System\AShDKTb.exe
  C:\Windows\System\AShDKTb.exe
  2⤵
  PID:8092
- C:\Windows\System\tVFkarc.exe
  C:\Windows\System\tVFkarc.exe
  2⤵
  PID:8108
- C:\Windows\System\BeJzkvl.exe
  C:\Windows\System\BeJzkvl.exe
  2⤵
  PID:8124
- C:\Windows\System\GVcMkMu.exe
  C:\Windows\System\GVcMkMu.exe
  2⤵
  PID:8144
- C:\Windows\System\cyOCEUy.exe
  C:\Windows\System\cyOCEUy.exe
  2⤵
  PID:6604
- C:\Windows\System\ZWZNXVS.exe
  C:\Windows\System\ZWZNXVS.exe
  2⤵
  PID:6900
- C:\Windows\System\VOWOeQI.exe
  C:\Windows\System\VOWOeQI.exe
  2⤵
  PID:6720
- C:\Windows\System\aVchWmz.exe
  C:\Windows\System\aVchWmz.exe
  2⤵
  PID:5932
- C:\Windows\System\EimgXqT.exe
  C:\Windows\System\EimgXqT.exe
  2⤵
  PID:7164
- C:\Windows\System\HjXpCPi.exe
  C:\Windows\System\HjXpCPi.exe
  2⤵
  PID:6560
- C:\Windows\System\zhlHaOz.exe
  C:\Windows\System\zhlHaOz.exe
  2⤵
  PID:7188
- C:\Windows\System\RESDZHX.exe
  C:\Windows\System\RESDZHX.exe
  2⤵
  PID:7208
- C:\Windows\System\maODuJs.exe
  C:\Windows\System\maODuJs.exe
  2⤵
  PID:7224
- C:\Windows\System\fZisJjX.exe
  C:\Windows\System\fZisJjX.exe
  2⤵
  PID:7236
- C:\Windows\System\eCRnZsn.exe
  C:\Windows\System\eCRnZsn.exe
  2⤵
  PID:7252
- C:\Windows\System\FFEcPkM.exe
  C:\Windows\System\FFEcPkM.exe
  2⤵
  PID:7288
- C:\Windows\System\xLgfHaT.exe
  C:\Windows\System\xLgfHaT.exe
  2⤵
  PID:7324
- C:\Windows\System\iopJvLn.exe
  C:\Windows\System\iopJvLn.exe
  2⤵
  PID:6364
- C:\Windows\System\jwlMmeF.exe
  C:\Windows\System\jwlMmeF.exe
  2⤵
  PID:7460
- C:\Windows\System\KVdfbpx.exe
  C:\Windows\System\KVdfbpx.exe
  2⤵
  PID:7496
- C:\Windows\System\GPqpukT.exe
  C:\Windows\System\GPqpukT.exe
  2⤵
  PID:7564
- C:\Windows\System\cocmdjy.exe
  C:\Windows\System\cocmdjy.exe
  2⤵
  PID:7604
- C:\Windows\System\dWUOqNX.exe
  C:\Windows\System\dWUOqNX.exe
  2⤵
  PID:7616
- C:\Windows\System\BqdDcgu.exe
  C:\Windows\System\BqdDcgu.exe
  2⤵
  PID:7480
- C:\Windows\System\fbbEPMb.exe
  C:\Windows\System\fbbEPMb.exe
  2⤵
  PID:7620
- C:\Windows\System\bsnbBqc.exe
  C:\Windows\System\bsnbBqc.exe
  2⤵
  PID:7388
- C:\Windows\System\csvRiUu.exe
  C:\Windows\System\csvRiUu.exe
  2⤵
  PID:7640
- C:\Windows\System\cPdPvRA.exe
  C:\Windows\System\cPdPvRA.exe
  2⤵
  PID:7440
- C:\Windows\System\ZweCSkZ.exe
  C:\Windows\System\ZweCSkZ.exe
  2⤵
  PID:7416
- C:\Windows\System\xFJIffi.exe
  C:\Windows\System\xFJIffi.exe
  2⤵
  PID:7384
- C:\Windows\System\GWerPwZ.exe
  C:\Windows\System\GWerPwZ.exe
  2⤵
  PID:7612
- C:\Windows\System\jssFfKC.exe
  C:\Windows\System\jssFfKC.exe
  2⤵
  PID:7380
- C:\Windows\System\rDStOos.exe
  C:\Windows\System\rDStOos.exe
  2⤵
  PID:8168
- C:\Windows\System\hUNKxxn.exe
  C:\Windows\System\hUNKxxn.exe
  2⤵
  PID:7636
- C:\Windows\System\hgqbmyO.exe
  C:\Windows\System\hgqbmyO.exe
  2⤵
  PID:7656
- C:\Windows\System\YNyndIi.exe
  C:\Windows\System\YNyndIi.exe
  2⤵
  PID:6524
- C:\Windows\System\roZQZvX.exe
  C:\Windows\System\roZQZvX.exe
  2⤵
  PID:6696
- C:\Windows\System\ieqTWGU.exe
  C:\Windows\System\ieqTWGU.exe
  2⤵
  PID:7276
- C:\Windows\System\LqQgTiH.exe
  C:\Windows\System\LqQgTiH.exe
  2⤵
  PID:7268
- C:\Windows\System\kLomcDe.exe
  C:\Windows\System\kLomcDe.exe
  2⤵
  PID:7172
- C:\Windows\System\OqZqOIt.exe
  C:\Windows\System\OqZqOIt.exe
  2⤵
  PID:6548
- C:\Windows\System\hTpyEex.exe
  C:\Windows\System\hTpyEex.exe
  2⤵
  PID:7284
- C:\Windows\System\abmfDlq.exe
  C:\Windows\System\abmfDlq.exe
  2⤵
  PID:7456
- C:\Windows\System\WmoyFzC.exe
  C:\Windows\System\WmoyFzC.exe
  2⤵
  PID:7984
- C:\Windows\System\YlHiAmA.exe
  C:\Windows\System\YlHiAmA.exe
  2⤵
  PID:7492
- C:\Windows\System\IuULKkL.exe
  C:\Windows\System\IuULKkL.exe
  2⤵
  PID:6648
- C:\Windows\System\neLFbsP.exe
  C:\Windows\System\neLFbsP.exe
  2⤵
  PID:2396
- C:\Windows\System\GTRpQyN.exe
  C:\Windows\System\GTRpQyN.exe
  2⤵
  PID:2496
- C:\Windows\System\zhrmRtX.exe
  C:\Windows\System\zhrmRtX.exe
  2⤵
  PID:2112
- C:\Windows\System\kkfMXgR.exe
  C:\Windows\System\kkfMXgR.exe
  2⤵
  PID:7836
- C:\Windows\System\QaORStO.exe
  C:\Windows\System\QaORStO.exe
  2⤵
  PID:7664
- C:\Windows\System\BHPEfEq.exe
  C:\Windows\System\BHPEfEq.exe
  2⤵
  PID:7216
- C:\Windows\System\yEsALTP.exe
  C:\Windows\System\yEsALTP.exe
  2⤵
  PID:7924
- C:\Windows\System\DXIyPMM.exe
  C:\Windows\System\DXIyPMM.exe
  2⤵
  PID:7892
- C:\Windows\System\kLWkrsS.exe
  C:\Windows\System\kLWkrsS.exe
  2⤵
  PID:8120
- C:\Windows\System\lFkjJHs.exe
  C:\Windows\System\lFkjJHs.exe
  2⤵
  PID:8160
- C:\Windows\System\tapIJul.exe
  C:\Windows\System\tapIJul.exe
  2⤵
  PID:6512
- C:\Windows\System\wMkjknO.exe
  C:\Windows\System\wMkjknO.exe
  2⤵
  PID:6680
- C:\Windows\System\nLsQWRl.exe
  C:\Windows\System\nLsQWRl.exe
  2⤵
  PID:7972
- C:\Windows\System\ChjqeeU.exe
  C:\Windows\System\ChjqeeU.exe
  2⤵
  PID:6480
- C:\Windows\System\IyjbmNX.exe
  C:\Windows\System\IyjbmNX.exe
  2⤵
  PID:7600
- C:\Windows\System\DVTHfsl.exe
  C:\Windows\System\DVTHfsl.exe
  2⤵
  PID:8032
- C:\Windows\System\GqnILpm.exe
  C:\Windows\System\GqnILpm.exe
  2⤵
  PID:8140
- C:\Windows\System\KWERZJD.exe
  C:\Windows\System\KWERZJD.exe
  2⤵
  PID:7672
- C:\Windows\System\erUOXqX.exe
  C:\Windows\System\erUOXqX.exe
  2⤵
  PID:628
- C:\Windows\System\OsDCCSs.exe
  C:\Windows\System\OsDCCSs.exe
  2⤵
  PID:7772
- C:\Windows\System\ltDmIdj.exe
  C:\Windows\System\ltDmIdj.exe
  2⤵
  PID:7244
- C:\Windows\System\oCrmVaa.exe
  C:\Windows\System\oCrmVaa.exe
  2⤵
  PID:1648
- C:\Windows\System\iuyiDgH.exe
  C:\Windows\System\iuyiDgH.exe
  2⤵
  PID:6324
- C:\Windows\System\gIwOdQk.exe
  C:\Windows\System\gIwOdQk.exe
  2⤵
  PID:7220
- C:\Windows\System\ICkYaxd.exe
  C:\Windows\System\ICkYaxd.exe
  2⤵
  PID:1644
- C:\Windows\System\EFcIjbV.exe
  C:\Windows\System\EFcIjbV.exe
  2⤵
  PID:8156
- C:\Windows\System\OBmPPsT.exe
  C:\Windows\System\OBmPPsT.exe
  2⤵
  PID:7784
- C:\Windows\System\ucOtSar.exe
  C:\Windows\System\ucOtSar.exe
  2⤵
  PID:7576
- C:\Windows\System\ETKwcMg.exe
  C:\Windows\System\ETKwcMg.exe
  2⤵
  PID:8088
- C:\Windows\System\xnwgCce.exe
  C:\Windows\System\xnwgCce.exe
  2⤵
  PID:7716
- C:\Windows\System\gRuWQFQ.exe
  C:\Windows\System\gRuWQFQ.exe
  2⤵
  PID:1228
- C:\Windows\System\Gylqyym.exe
  C:\Windows\System\Gylqyym.exe
  2⤵
  PID:8068
- C:\Windows\System\JsMOzYB.exe
  C:\Windows\System\JsMOzYB.exe
  2⤵
  PID:1676
- C:\Windows\System\TEnKGWB.exe
  C:\Windows\System\TEnKGWB.exe
  2⤵
  PID:7352
- C:\Windows\System\hoexPTH.exe
  C:\Windows\System\hoexPTH.exe
  2⤵
  PID:7960
- C:\Windows\System\SAitqOX.exe
  C:\Windows\System\SAitqOX.exe
  2⤵
  PID:7904
- C:\Windows\System\WcKEwAW.exe
  C:\Windows\System\WcKEwAW.exe
  2⤵
  PID:7232
- C:\Windows\System\KYHMhkU.exe
  C:\Windows\System\KYHMhkU.exe
  2⤵
  PID:7688
- C:\Windows\System\dPxGGXX.exe
  C:\Windows\System\dPxGGXX.exe
  2⤵
  PID:7752
- C:\Windows\System\NaFuMUr.exe
  C:\Windows\System\NaFuMUr.exe
  2⤵
  PID:8084
- C:\Windows\System\IJMHwGq.exe
  C:\Windows\System\IJMHwGq.exe
  2⤵
  PID:7748
- C:\Windows\System\kmTuZXa.exe
  C:\Windows\System\kmTuZXa.exe
  2⤵
  PID:2668
- C:\Windows\System\LKDGKMc.exe
  C:\Windows\System\LKDGKMc.exe
  2⤵
  PID:8048
- C:\Windows\System\WkqSsqq.exe
  C:\Windows\System\WkqSsqq.exe
  2⤵
  PID:7832
- C:\Windows\System\CSuLWpx.exe
  C:\Windows\System\CSuLWpx.exe
  2⤵
  PID:6868
- C:\Windows\System\ZbJnFeF.exe
  C:\Windows\System\ZbJnFeF.exe
  2⤵
  PID:7296
- C:\Windows\System\KcMfOIl.exe
  C:\Windows\System\KcMfOIl.exe
  2⤵
  PID:7876
- C:\Windows\System\nuZOjcm.exe
  C:\Windows\System\nuZOjcm.exe
  2⤵
  PID:6288
- C:\Windows\System\xezSKMk.exe
  C:\Windows\System\xezSKMk.exe
  2⤵
  PID:3064
- C:\Windows\System\cereyYA.exe
  C:\Windows\System\cereyYA.exe
  2⤵
  PID:7668
- C:\Windows\System\yklNCVN.exe
  C:\Windows\System\yklNCVN.exe
  2⤵
  PID:7000
- C:\Windows\System\hoLSlWo.exe
  C:\Windows\System\hoLSlWo.exe
  2⤵
  PID:7676
- C:\Windows\System\sQpDltJ.exe
  C:\Windows\System\sQpDltJ.exe
  2⤵
  PID:2796
- C:\Windows\System\PGRNUHe.exe
  C:\Windows\System\PGRNUHe.exe
  2⤵
  PID:8472
- C:\Windows\System\tDYTRuY.exe
  C:\Windows\System\tDYTRuY.exe
  2⤵
  PID:8488
- C:\Windows\System\mprwqyy.exe
  C:\Windows\System\mprwqyy.exe
  2⤵
  PID:8504
- C:\Windows\System\BYMsLdG.exe
  C:\Windows\System\BYMsLdG.exe
  2⤵
  PID:8520
- C:\Windows\System\pANysjq.exe
  C:\Windows\System\pANysjq.exe
  2⤵
  PID:8536
- C:\Windows\System\nKyHKRZ.exe
  C:\Windows\System\nKyHKRZ.exe
  2⤵
  PID:8552
- C:\Windows\System\RrSauhZ.exe
  C:\Windows\System\RrSauhZ.exe
  2⤵
  PID:8568
- C:\Windows\System\cclMXje.exe
  C:\Windows\System\cclMXje.exe
  2⤵
  PID:8584
- C:\Windows\System\OSXumDc.exe
  C:\Windows\System\OSXumDc.exe
  2⤵
  PID:8600
- C:\Windows\System\pBbPZfy.exe
  C:\Windows\System\pBbPZfy.exe
  2⤵
  PID:8616
- C:\Windows\System\bcxfDdB.exe
  C:\Windows\System\bcxfDdB.exe
  2⤵
  PID:8632
- C:\Windows\System\wtiQxVS.exe
  C:\Windows\System\wtiQxVS.exe
  2⤵
  PID:8648
- C:\Windows\System\FpnKpTq.exe
  C:\Windows\System\FpnKpTq.exe
  2⤵
  PID:8664
- C:\Windows\System\VOppgvH.exe
  C:\Windows\System\VOppgvH.exe
  2⤵
  PID:8680
- C:\Windows\System\amZddFP.exe
  C:\Windows\System\amZddFP.exe
  2⤵
  PID:8696
- C:\Windows\System\JXpbAdZ.exe
  C:\Windows\System\JXpbAdZ.exe
  2⤵
  PID:8712
- C:\Windows\System\OjZGgVG.exe
  C:\Windows\System\OjZGgVG.exe
  2⤵
  PID:8728
- C:\Windows\System\xbRpRKa.exe
  C:\Windows\System\xbRpRKa.exe
  2⤵
  PID:8744
- C:\Windows\System\xAtrhxq.exe
  C:\Windows\System\xAtrhxq.exe
  2⤵
  PID:8760
- C:\Windows\System\LrjfAok.exe
  C:\Windows\System\LrjfAok.exe
  2⤵
  PID:8776
- C:\Windows\System\KOGzKsB.exe
  C:\Windows\System\KOGzKsB.exe
  2⤵
  PID:8792
- C:\Windows\System\hPSNgCN.exe
  C:\Windows\System\hPSNgCN.exe
  2⤵
  PID:8808
- C:\Windows\System\PDVZJPI.exe
  C:\Windows\System\PDVZJPI.exe
  2⤵
  PID:8824
- C:\Windows\System\pRyqzTs.exe
  C:\Windows\System\pRyqzTs.exe
  2⤵
  PID:8844
- C:\Windows\System\fbUxQGE.exe
  C:\Windows\System\fbUxQGE.exe
  2⤵
  PID:8860
- C:\Windows\System\KbiZWbQ.exe
  C:\Windows\System\KbiZWbQ.exe
  2⤵
  PID:8876
- C:\Windows\System\ssQjPcr.exe
  C:\Windows\System\ssQjPcr.exe
  2⤵
  PID:8892
- C:\Windows\System\OSLtUye.exe
  C:\Windows\System\OSLtUye.exe
  2⤵
  PID:8908
- C:\Windows\System\hHqlaUM.exe
  C:\Windows\System\hHqlaUM.exe
  2⤵
  PID:8932
- C:\Windows\System\PYnKOAJ.exe
  C:\Windows\System\PYnKOAJ.exe
  2⤵
  PID:8952
- C:\Windows\System\tliTlBQ.exe
  C:\Windows\System\tliTlBQ.exe
  2⤵
  PID:8968
- C:\Windows\System\nqbnSvc.exe
  C:\Windows\System\nqbnSvc.exe
  2⤵
  PID:8984
- C:\Windows\System\NriFOSv.exe
  C:\Windows\System\NriFOSv.exe
  2⤵
  PID:9000
- C:\Windows\System\ETccpDv.exe
  C:\Windows\System\ETccpDv.exe
  2⤵
  PID:9016
- C:\Windows\System\ZHlJXNn.exe
  C:\Windows\System\ZHlJXNn.exe
  2⤵
  PID:9052
- C:\Windows\System\xGCcPgf.exe
  C:\Windows\System\xGCcPgf.exe
  2⤵
  PID:9084
- C:\Windows\System\TcuOKhq.exe
  C:\Windows\System\TcuOKhq.exe
  2⤵
  PID:9100
- C:\Windows\System\HDNqLgG.exe
  C:\Windows\System\HDNqLgG.exe
  2⤵
  PID:9116
- C:\Windows\System\mgWZhFQ.exe
  C:\Windows\System\mgWZhFQ.exe
  2⤵
  PID:9184
- C:\Windows\System\dTERRug.exe
  C:\Windows\System\dTERRug.exe
  2⤵
  PID:9212
- C:\Windows\System\gJKPUXu.exe
  C:\Windows\System\gJKPUXu.exe
  2⤵
  PID:7560
- C:\Windows\System\jJKEUJL.exe
  C:\Windows\System\jJKEUJL.exe
  2⤵
  PID:8116
- C:\Windows\System\tOwljiS.exe
  C:\Windows\System\tOwljiS.exe
  2⤵
  PID:7160
- C:\Windows\System\zzjVrjd.exe
  C:\Windows\System\zzjVrjd.exe
  2⤵
  PID:8296
- C:\Windows\System\PCgDEnF.exe
  C:\Windows\System\PCgDEnF.exe
  2⤵
  PID:7292
- C:\Windows\System\QksRfaA.exe
  C:\Windows\System\QksRfaA.exe
  2⤵
  PID:7992
- C:\Windows\System\eihkLmH.exe
  C:\Windows\System\eihkLmH.exe
  2⤵
  PID:8132
- C:\Windows\System\CrdDNef.exe
  C:\Windows\System\CrdDNef.exe
  2⤵
  PID:8336
- C:\Windows\System\kMNKBGt.exe
  C:\Windows\System\kMNKBGt.exe
  2⤵
  PID:8228
- C:\Windows\System\MFNpmhK.exe
  C:\Windows\System\MFNpmhK.exe
  2⤵
  PID:8240
- C:\Windows\System\EzZwdqN.exe
  C:\Windows\System\EzZwdqN.exe
  2⤵
  PID:8264
- C:\Windows\System\WPcwdlf.exe
  C:\Windows\System\WPcwdlf.exe
  2⤵
  PID:8304
- C:\Windows\System\XcOgNGZ.exe
  C:\Windows\System\XcOgNGZ.exe
  2⤵
  PID:8320
- C:\Windows\System\TQqilDj.exe
  C:\Windows\System\TQqilDj.exe
  2⤵
  PID:8344
- C:\Windows\System\xaWIjCb.exe
  C:\Windows\System\xaWIjCb.exe
  2⤵
  PID:8544
- C:\Windows\System\ZrXddCE.exe
  C:\Windows\System\ZrXddCE.exe
  2⤵
  PID:8612
- C:\Windows\System\YoVAnmU.exe
  C:\Windows\System\YoVAnmU.exe
  2⤵
  PID:8676
- C:\Windows\System\uCIHZPs.exe
  C:\Windows\System\uCIHZPs.exe
  2⤵
  PID:8348
- C:\Windows\System\YvzSPXu.exe
  C:\Windows\System\YvzSPXu.exe
  2⤵
  PID:8364
- C:\Windows\System\OVSPdOZ.exe
  C:\Windows\System\OVSPdOZ.exe
  2⤵
  PID:8376
- C:\Windows\System\fiQuEjR.exe
  C:\Windows\System\fiQuEjR.exe
  2⤵
  PID:8388
- C:\Windows\System\BOzpDnE.exe
  C:\Windows\System\BOzpDnE.exe
  2⤵
  PID:8408
- C:\Windows\System\BWIAjba.exe
  C:\Windows\System\BWIAjba.exe
  2⤵
  PID:8428
- C:\Windows\System\wmJWDRU.exe
  C:\Windows\System\wmJWDRU.exe
  2⤵
  PID:8444
- C:\Windows\System\FvQhXsh.exe
  C:\Windows\System\FvQhXsh.exe
  2⤵
  PID:8468
- C:\Windows\System\LAFWcCE.exe
  C:\Windows\System\LAFWcCE.exe
  2⤵
  PID:8560
- C:\Windows\System\lvpLSoW.exe
  C:\Windows\System\lvpLSoW.exe
  2⤵
  PID:8624
- C:\Windows\System\mHDyUbD.exe
  C:\Windows\System\mHDyUbD.exe
  2⤵
  PID:8688
- C:\Windows\System\SsECGqV.exe
  C:\Windows\System\SsECGqV.exe
  2⤵
  PID:8756
- C:\Windows\System\jTrliwq.exe
  C:\Windows\System\jTrliwq.exe
  2⤵
  PID:8852
- C:\Windows\System\xKBZiIW.exe
  C:\Windows\System\xKBZiIW.exe
  2⤵
  PID:8916
- C:\Windows\System\RzvchtW.exe
  C:\Windows\System\RzvchtW.exe
  2⤵
  PID:8868
- C:\Windows\System\kbvDURb.exe
  C:\Windows\System\kbvDURb.exe
  2⤵
  PID:8768
- C:\Windows\System\SaMXBVH.exe
  C:\Windows\System\SaMXBVH.exe
  2⤵
  PID:8920
- C:\Windows\System\EHaJpsw.exe
  C:\Windows\System\EHaJpsw.exe
  2⤵
  PID:8980
- C:\Windows\System\rLtdCZq.exe
  C:\Windows\System\rLtdCZq.exe
  2⤵
  PID:8964
- C:\Windows\System\BSHLopP.exe
  C:\Windows\System\BSHLopP.exe
  2⤵
  PID:8992
- C:\Windows\System\ZmXhKsR.exe
  C:\Windows\System\ZmXhKsR.exe
  2⤵
  PID:9032
- C:\Windows\System\ZxRFOjg.exe
  C:\Windows\System\ZxRFOjg.exe
  2⤵
  PID:9048
- C:\Windows\System\fXRQYtI.exe
  C:\Windows\System\fXRQYtI.exe
  2⤵
  PID:9072
- C:\Windows\System\uPfIawv.exe
  C:\Windows\System\uPfIawv.exe
  2⤵
  PID:9080
- C:\Windows\System\pVYItYV.exe
  C:\Windows\System\pVYItYV.exe
  2⤵
  PID:9132
- C:\Windows\System\WSRxURd.exe
  C:\Windows\System\WSRxURd.exe
  2⤵
  PID:9148
- C:\Windows\System\ZbxrKWr.exe
  C:\Windows\System\ZbxrKWr.exe
  2⤵
  PID:9180
- C:\Windows\System\jhuXVtm.exe
  C:\Windows\System\jhuXVtm.exe
  2⤵
  PID:9192
- C:\Windows\System\snuYffS.exe
  C:\Windows\System\snuYffS.exe
  2⤵
  PID:9208
- C:\Windows\System\jQsXxDl.exe
  C:\Windows\System\jQsXxDl.exe
  2⤵
  PID:8308
- C:\Windows\System\ggWjDQb.exe
  C:\Windows\System\ggWjDQb.exe
  2⤵
  PID:7372
- C:\Windows\System\uCOYftd.exe
  C:\Windows\System\uCOYftd.exe
  2⤵
  PID:7956
- C:\Windows\System\ZKLHopd.exe
  C:\Windows\System\ZKLHopd.exe
  2⤵
  PID:8136
- C:\Windows\System\QHAZHWP.exe
  C:\Windows\System\QHAZHWP.exe
  2⤵
  PID:5772
- C:\Windows\System\dxKSWxM.exe
  C:\Windows\System\dxKSWxM.exe
  2⤵
  PID:7788
- C:\Windows\System\ruucZTa.exe
  C:\Windows\System\ruucZTa.exe
  2⤵
  PID:7996
- C:\Windows\System\XltLZLs.exe
  C:\Windows\System\XltLZLs.exe
  2⤵
  PID:8216
- C:\Windows\System\fDEnOsn.exe
  C:\Windows\System\fDEnOsn.exe
  2⤵
  PID:8252
- C:\Windows\System\YtkcLpx.exe
  C:\Windows\System\YtkcLpx.exe
  2⤵
  PID:8548
- C:\Windows\System\sAFtrIS.exe
  C:\Windows\System\sAFtrIS.exe
  2⤵
  PID:8236
- C:\Windows\System\njfvpTa.exe
  C:\Windows\System\njfvpTa.exe
  2⤵
  PID:8392
- C:\Windows\System\iibQyUf.exe
  C:\Windows\System\iibQyUf.exe
  2⤵
  PID:8608
- C:\Windows\System\pGroccP.exe
  C:\Windows\System\pGroccP.exe
  2⤵
  PID:8280
- C:\Windows\System\KVpvUyP.exe
  C:\Windows\System\KVpvUyP.exe
  2⤵
  PID:8424
- C:\Windows\System\aOLzHiS.exe
  C:\Windows\System\aOLzHiS.exe
  2⤵
  PID:8464
- C:\Windows\System\LFzLGMQ.exe
  C:\Windows\System\LFzLGMQ.exe
  2⤵
  PID:8596
- C:\Windows\System\cFJlMRo.exe
  C:\Windows\System\cFJlMRo.exe
  2⤵
  PID:8448
- C:\Windows\System\SMbvGgg.exe
  C:\Windows\System\SMbvGgg.exe
  2⤵
  PID:8528
- C:\Windows\System\KItGnxm.exe
  C:\Windows\System\KItGnxm.exe
  2⤵
  PID:8800
- C:\Windows\System\NrzAscV.exe
  C:\Windows\System\NrzAscV.exe
  2⤵
  PID:6400
- C:\Windows\System\olpSzXu.exe
  C:\Windows\System\olpSzXu.exe
  2⤵
  PID:8872
- C:\Windows\System\LZnrFVq.exe
  C:\Windows\System\LZnrFVq.exe
  2⤵
  PID:8928
- C:\Windows\System\JoxFELT.exe
  C:\Windows\System\JoxFELT.exe
  2⤵
  PID:9040
- C:\Windows\System\LSmhYNm.exe
  C:\Windows\System\LSmhYNm.exe
  2⤵
  PID:9144
- C:\Windows\System\mTaNBsQ.exe
  C:\Windows\System\mTaNBsQ.exe
  2⤵
  PID:9024
- C:\Windows\System\ZwTBRWc.exe
  C:\Windows\System\ZwTBRWc.exe
  2⤵
  PID:9064
- C:\Windows\System\MtPYEsQ.exe
  C:\Windows\System\MtPYEsQ.exe
  2⤵
  PID:7920
- C:\Windows\System\eFRDSKJ.exe
  C:\Windows\System\eFRDSKJ.exe
  2⤵
  PID:7804
- C:\Windows\System\nZnTQvl.exe
  C:\Windows\System\nZnTQvl.exe
  2⤵
  PID:9204
- C:\Windows\System\TAvVsqA.exe
  C:\Windows\System\TAvVsqA.exe
  2⤵
  PID:8204
- C:\Windows\System\lfYzhkr.exe
  C:\Windows\System\lfYzhkr.exe
  2⤵
  PID:6084
- C:\Windows\System\xNkykrY.exe
  C:\Windows\System\xNkykrY.exe
  2⤵
  PID:816
- C:\Windows\System\YxmJifT.exe
  C:\Windows\System\YxmJifT.exe
  2⤵
  PID:8484
- C:\Windows\System\HZgKHro.exe
  C:\Windows\System\HZgKHro.exe
  2⤵
  PID:8416
- C:\Windows\System\oOymqzT.exe
  C:\Windows\System\oOymqzT.exe
  2⤵
  PID:8328
- C:\Windows\System\kkuCYgN.exe
  C:\Windows\System\kkuCYgN.exe
  2⤵
  PID:8532
- C:\Windows\System\OVyBJeA.exe
  C:\Windows\System\OVyBJeA.exe
  2⤵
  PID:8724
- C:\Windows\System\uwvVoSC.exe
  C:\Windows\System\uwvVoSC.exe
  2⤵
  PID:8976
- C:\Windows\System\OvlrMEw.exe
  C:\Windows\System\OvlrMEw.exe
  2⤵
  PID:9068
- C:\Windows\System\fuGmQdH.exe
  C:\Windows\System\fuGmQdH.exe
  2⤵
  PID:2856
- C:\Windows\System\keQsTZC.exe
  C:\Windows\System\keQsTZC.exe
  2⤵
  PID:9076
- C:\Windows\System\SESZLPo.exe
  C:\Windows\System\SESZLPo.exe
  2⤵
  PID:9160
- C:\Windows\System\aOnfWGj.exe
  C:\Windows\System\aOnfWGj.exe
  2⤵
  PID:8640
- C:\Windows\System\vySATYz.exe
  C:\Windows\System\vySATYz.exe
  2⤵
  PID:8276
- C:\Windows\System\ZZntenm.exe
  C:\Windows\System\ZZntenm.exe
  2⤵
  PID:8260
- C:\Windows\System\QWgFwSM.exe
  C:\Windows\System\QWgFwSM.exe
  2⤵
  PID:8948
- C:\Windows\System\ywnYntR.exe
  C:\Windows\System\ywnYntR.exe
  2⤵
  PID:9172
- C:\Windows\System\vSNTdsd.exe
  C:\Windows\System\vSNTdsd.exe
  2⤵
  PID:8736
- C:\Windows\System\QYGnGEO.exe
  C:\Windows\System\QYGnGEO.exe
  2⤵
  PID:8436
- C:\Windows\System\hMGBahM.exe
  C:\Windows\System\hMGBahM.exe
  2⤵
  PID:9028
- C:\Windows\System\vGEdvfM.exe
  C:\Windows\System\vGEdvfM.exe
  2⤵
  PID:1340
- C:\Windows\System\oimrWSx.exe
  C:\Windows\System\oimrWSx.exe
  2⤵
  PID:8404
- C:\Windows\System\ZSvCJiV.exe
  C:\Windows\System\ZSvCJiV.exe
  2⤵
  PID:8232
- C:\Windows\System\xhQjSvH.exe
  C:\Windows\System\xhQjSvH.exe
  2⤵
  PID:8840
- C:\Windows\System\QaAeKWB.exe
  C:\Windows\System\QaAeKWB.exe
  2⤵
  PID:8372
- C:\Windows\System\ManplQN.exe
  C:\Windows\System\ManplQN.exe
  2⤵
  PID:8324
- C:\Windows\System\Boucnta.exe
  C:\Windows\System\Boucnta.exe
  2⤵
  PID:6508
- C:\Windows\System\xXQUsQy.exe
  C:\Windows\System\xXQUsQy.exe
  2⤵
  PID:9124
- C:\Windows\System\WEJSJPj.exe
  C:\Windows\System\WEJSJPj.exe
  2⤵
  PID:8660
- C:\Windows\System\NsdpbCO.exe
  C:\Windows\System\NsdpbCO.exe
  2⤵
  PID:912
- C:\Windows\System\RoykRLY.exe
  C:\Windows\System\RoykRLY.exe
  2⤵
  PID:2056
- C:\Windows\System\lOwdrrL.exe
  C:\Windows\System\lOwdrrL.exe
  2⤵
  PID:2164
- C:\Windows\System\lcnLnXx.exe
  C:\Windows\System\lcnLnXx.exe
  2⤵
  PID:9228
- C:\Windows\System\LjpUPIa.exe
  C:\Windows\System\LjpUPIa.exe
  2⤵
  PID:9244
- C:\Windows\System\sWXfBVO.exe
  C:\Windows\System\sWXfBVO.exe
  2⤵
  PID:9260
- C:\Windows\System\XxHlaGQ.exe
  C:\Windows\System\XxHlaGQ.exe
  2⤵
  PID:9276
- C:\Windows\System\xMeDhbB.exe
  C:\Windows\System\xMeDhbB.exe
  2⤵
  PID:9292
- C:\Windows\System\bGoEVaE.exe
  C:\Windows\System\bGoEVaE.exe
  2⤵
  PID:9308
- C:\Windows\System\bZVxESU.exe
  C:\Windows\System\bZVxESU.exe
  2⤵
  PID:9328
- C:\Windows\System\PQYjeJP.exe
  C:\Windows\System\PQYjeJP.exe
  2⤵
  PID:9344
- C:\Windows\System\pHXdMJS.exe
  C:\Windows\System\pHXdMJS.exe
  2⤵
  PID:9360
- C:\Windows\System\vcayKQy.exe
  C:\Windows\System\vcayKQy.exe
  2⤵
  PID:9376
- C:\Windows\System\jWDvKTV.exe
  C:\Windows\System\jWDvKTV.exe
  2⤵
  PID:9392
- C:\Windows\System\LNHeqdX.exe
  C:\Windows\System\LNHeqdX.exe
  2⤵
  PID:9408
- C:\Windows\System\GtNoQfS.exe
  C:\Windows\System\GtNoQfS.exe
  2⤵
  PID:9424
- C:\Windows\System\EdEdCVp.exe
  C:\Windows\System\EdEdCVp.exe
  2⤵
  PID:9440
- C:\Windows\System\IjkWKTQ.exe
  C:\Windows\System\IjkWKTQ.exe
  2⤵
  PID:9456
- C:\Windows\System\PUanhYo.exe
  C:\Windows\System\PUanhYo.exe
  2⤵
  PID:9488
- C:\Windows\System\kcGkhSL.exe
  C:\Windows\System\kcGkhSL.exe
  2⤵
  PID:9504
- C:\Windows\System\kMqdKjX.exe
  C:\Windows\System\kMqdKjX.exe
  2⤵
  PID:9520
- C:\Windows\System\CRHkyvQ.exe
  C:\Windows\System\CRHkyvQ.exe
  2⤵
  PID:9536
- C:\Windows\System\aLsQtoz.exe
  C:\Windows\System\aLsQtoz.exe
  2⤵
  PID:9552
- C:\Windows\System\mZJaUdM.exe
  C:\Windows\System\mZJaUdM.exe
  2⤵
  PID:9568
- C:\Windows\System\NddyPVg.exe
  C:\Windows\System\NddyPVg.exe
  2⤵
  PID:9584
- C:\Windows\System\vIQUMSN.exe
  C:\Windows\System\vIQUMSN.exe
  2⤵
  PID:9600
- C:\Windows\System\vPvHsTu.exe
  C:\Windows\System\vPvHsTu.exe
  2⤵
  PID:9616
- C:\Windows\System\hdyLunc.exe
  C:\Windows\System\hdyLunc.exe
  2⤵
  PID:9632
- C:\Windows\System\hJsqalV.exe
  C:\Windows\System\hJsqalV.exe
  2⤵
  PID:9648
- C:\Windows\System\WeYXLag.exe
  C:\Windows\System\WeYXLag.exe
  2⤵
  PID:9664
- C:\Windows\System\xssFNgo.exe
  C:\Windows\System\xssFNgo.exe
  2⤵
  PID:9680
- C:\Windows\System\RQSyMWy.exe
  C:\Windows\System\RQSyMWy.exe
  2⤵
  PID:9696
- C:\Windows\System\CDdHDtb.exe
  C:\Windows\System\CDdHDtb.exe
  2⤵
  PID:9716
- C:\Windows\System\esSbPmF.exe
  C:\Windows\System\esSbPmF.exe
  2⤵
  PID:9732
- C:\Windows\System\fTaJZJL.exe
  C:\Windows\System\fTaJZJL.exe
  2⤵
  PID:9748
- C:\Windows\System\lOWVeah.exe
  C:\Windows\System\lOWVeah.exe
  2⤵
  PID:9764
- C:\Windows\System\ljoeAfx.exe
  C:\Windows\System\ljoeAfx.exe
  2⤵
  PID:9780
- C:\Windows\System\oKaJBxG.exe
  C:\Windows\System\oKaJBxG.exe
  2⤵
  PID:9796
- C:\Windows\System\LeOhWvm.exe
  C:\Windows\System\LeOhWvm.exe
  2⤵
  PID:9812
- C:\Windows\System\CoKsqvR.exe
  C:\Windows\System\CoKsqvR.exe
  2⤵
  PID:9828
- C:\Windows\System\GdQnpfl.exe
  C:\Windows\System\GdQnpfl.exe
  2⤵
  PID:9844
- C:\Windows\System\VNdpWAE.exe
  C:\Windows\System\VNdpWAE.exe
  2⤵
  PID:9860
- C:\Windows\System\GpkfjlH.exe
  C:\Windows\System\GpkfjlH.exe
  2⤵
  PID:9876
- C:\Windows\System\xVfaGDe.exe
  C:\Windows\System\xVfaGDe.exe
  2⤵
  PID:9892
- C:\Windows\System\EYZDvyA.exe
  C:\Windows\System\EYZDvyA.exe
  2⤵
  PID:9908
- C:\Windows\System\RQbhGRM.exe
  C:\Windows\System\RQbhGRM.exe
  2⤵
  PID:9924
- C:\Windows\System\qBgzoNe.exe
  C:\Windows\System\qBgzoNe.exe
  2⤵
  PID:9940
- C:\Windows\System\CLDgity.exe
  C:\Windows\System\CLDgity.exe
  2⤵
  PID:9956
- C:\Windows\System\zhTtNSm.exe
  C:\Windows\System\zhTtNSm.exe
  2⤵
  PID:9972
- C:\Windows\System\TQBhUlm.exe
  C:\Windows\System\TQBhUlm.exe
  2⤵
  PID:9988
- C:\Windows\System\bOODsFn.exe
  C:\Windows\System\bOODsFn.exe
  2⤵
  PID:10004
- C:\Windows\System\zkrQJFt.exe
  C:\Windows\System\zkrQJFt.exe
  2⤵
  PID:10020
- C:\Windows\System\kIPRmTd.exe
  C:\Windows\System\kIPRmTd.exe
  2⤵
  PID:10036
- C:\Windows\System\TwnaJeF.exe
  C:\Windows\System\TwnaJeF.exe
  2⤵
  PID:10052
- C:\Windows\System\BVhZZcG.exe
  C:\Windows\System\BVhZZcG.exe
  2⤵
  PID:10068
- C:\Windows\System\qEhDAFU.exe
  C:\Windows\System\qEhDAFU.exe
  2⤵
  PID:10084
- C:\Windows\System\riKrJCn.exe
  C:\Windows\System\riKrJCn.exe
  2⤵
  PID:10100
- C:\Windows\System\yBdIcOQ.exe
  C:\Windows\System\yBdIcOQ.exe
  2⤵
  PID:10116
- C:\Windows\System\KFnyflO.exe
  C:\Windows\System\KFnyflO.exe
  2⤵
  PID:10132
- C:\Windows\System\dTFEGKW.exe
  C:\Windows\System\dTFEGKW.exe
  2⤵
  PID:10148
- C:\Windows\System\ceqfvCe.exe
  C:\Windows\System\ceqfvCe.exe
  2⤵
  PID:10164
- C:\Windows\System\sgdXIts.exe
  C:\Windows\System\sgdXIts.exe
  2⤵
  PID:10180
- C:\Windows\System\yIBVvDX.exe
  C:\Windows\System\yIBVvDX.exe
  2⤵
  PID:10196
- C:\Windows\System\PJrcfuZ.exe
  C:\Windows\System\PJrcfuZ.exe
  2⤵
  PID:10212
- C:\Windows\System\XONdHSU.exe
  C:\Windows\System\XONdHSU.exe
  2⤵
  PID:10228
- C:\Windows\System\bFDrwBP.exe
  C:\Windows\System\bFDrwBP.exe
  2⤵
  PID:8288
- C:\Windows\System\UOfbLpz.exe
  C:\Windows\System\UOfbLpz.exe
  2⤵
  PID:8440
- C:\Windows\System\ptDsIBK.exe
  C:\Windows\System\ptDsIBK.exe
  2⤵
  PID:9224
- C:\Windows\System\wYYkFky.exe
  C:\Windows\System\wYYkFky.exe
  2⤵
  PID:9304
- C:\Windows\System\wKiCWas.exe
  C:\Windows\System\wKiCWas.exe
  2⤵
  PID:9284
- C:\Windows\System\XoLrvMZ.exe
  C:\Windows\System\XoLrvMZ.exe
  2⤵
  PID:9368
- C:\Windows\System\ePqPUhm.exe
  C:\Windows\System\ePqPUhm.exe
  2⤵
  PID:9388
- C:\Windows\System\oJgYaIv.exe
  C:\Windows\System\oJgYaIv.exe
  2⤵
  PID:9432
- C:\Windows\System\HZkFjZt.exe
  C:\Windows\System\HZkFjZt.exe
  2⤵
  PID:9436
- C:\Windows\System\jrrtiUf.exe
  C:\Windows\System\jrrtiUf.exe
  2⤵
  PID:2304
- C:\Windows\System\uIVJIJk.exe
  C:\Windows\System\uIVJIJk.exe
  2⤵
  PID:9480
- C:\Windows\System\nbHkxQh.exe
  C:\Windows\System\nbHkxQh.exe
  2⤵
  PID:9544
- C:\Windows\System\OdQyEFd.exe
  C:\Windows\System\OdQyEFd.exe
  2⤵
  PID:9528
- C:\Windows\System\TahQZvJ.exe
  C:\Windows\System\TahQZvJ.exe
  2⤵
  PID:9564
- C:\Windows\System\nlzsZSU.exe
  C:\Windows\System\nlzsZSU.exe
  2⤵
  PID:9612
- C:\Windows\System\mwIvSMF.exe
  C:\Windows\System\mwIvSMF.exe
  2⤵
  PID:9644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EaAogxn.exe

Filesize
2.1MB

MD5
8c2475d576de731db4f0173a53880547

SHA1
1260c4a4d1024dbd30635ddb0b66659235ddc545

SHA256
0baf86d2b30eaabc590df6a75cc5384680c88ca9daea5fd032d9b0d5383be398

SHA512
05ffe45d5c93d8c3d17b15bee9857e2a767c4ed03f65c442b06f8bcdc0115cadaf4fb90124e8d4f247ed598ca74b59852efc8fa98a0a744cff52d976f54b3c5e

Download Submit
C:\Windows\system\FsUkQEa.exe

Filesize
2.1MB

MD5
e5c75b0e7c9ed5029ba100e430f9c7af

SHA1
c9a9ff350ef92eb5e644b0e3314f05b6becbb2d5

SHA256
08829c44b4a725e69c8c3b67ae1597e78e97fb221980289d83f73d6401a319d4

SHA512
a203f7fb3c55214cd9fcaa42f76da8ebe2c972d6e1188950f6254a5567ba6dbf88e852a57a90f7c9611d4bbe7685723e4311c3152f9e91615e473509640116a8

Download Submit
C:\Windows\system\GYkqZJx.exe

Filesize
2.1MB

MD5
7f8ce9d959c6cc948073f4b3766873c8

SHA1
02dee74f4b6df184075344597e9cd3b032b65a9e

SHA256
3e2480aabe002d9cbe9eb0bfc67708243bec30bf0c1f5875d321b874b464b811

SHA512
c9fdc0ca67fe6870e829d0ac59180c36e0ea927eca6ab5940b9914bf6c0fdecdc5d0b86a76e378a134bf3aa388b37e12da948d8a5653ec115642617554f16afb

Download Submit
C:\Windows\system\GgrBDjs.exe

Filesize
2.1MB

MD5
fc9c029f53e66c282de25a7563a41be5

SHA1
4bda33921a2a2d3324c901c55de3b5268dc4246f

SHA256
b3ab50b5f56d1ff9811c80cefc7cf62dde86e5febe2fd52970af3399af3de922

SHA512
f81cf82f259e97abdac6ec7cb84d97bb3cf5f6c6a3fc0c007e7fd9f04895fc90c4a7810a7c65b9fff210789e8ad264f28a6cf17f1ed0446597033cb68ff0bab8

Download Submit
C:\Windows\system\HnrQuYV.exe

Filesize
2.1MB

MD5
f4c9a70874e42a8e9239ecbff02fb380

SHA1
81f9fd0d19ccc64a337407afe326b7c1724354b8

SHA256
b0917800a4e9981d04b109064217082f3406f93f0e7fc010c86b38f0598649df

SHA512
4a4e4d819797cd2b3d18308b35a7166b33eb111a4458d581aa0323cf0c26f2f32b62ecdbd8e4da931025029e5da3d3378ef750f23d98609c1cb85f1a0dbb734e

Download Submit
C:\Windows\system\KBxhXVw.exe

Filesize
2.1MB

MD5
c52b704ec9545fc44fedee2054401d6c

SHA1
789a151434d18653a9110e09ca40e25e90a46042

SHA256
db389ad5e17061e1f72ef6a1e8faf52d66739cfee793501cbfee6b23b4de53ce

SHA512
8e8d427d57d76a6549694ca8adf589e87b65bcb92303ab8491bee84f0b13217a114a0d73da4f091049bea654cbc940b9699a9dc15af68955378e4c0185fa47fe

Download Submit
C:\Windows\system\OEtWxjl.exe

Filesize
2.1MB

MD5
6d06c477648f205db1f3366bf10da23e

SHA1
2e3a6259e918de15fdd2d4fb6a5b3ce74816486f

SHA256
67e5b7b26f76624a6636ad60df1517b44f3c073e940517bf64da64ee0e859ca4

SHA512
386cbb7033638390a1430751546c9ea544a89dc1ab230a386fee23ef84aac9ce669baaf89f37182ee1131b16cdcdefdbaae60f7ed7dc4efae61b01a0f2d254ee

Download Submit
C:\Windows\system\PJDIxhA.exe

Filesize
2.1MB

MD5
017ed99e9e93c3ddabb8564955a4c3b7

SHA1
91111d3fe6415ba17ffae1f5be07c049f8cd2ef1

SHA256
e55cbb9dde8dc4cc92a94d1e225c1f72175edb4c55a2ccfb9fcd573bdad77288

SHA512
bc8e9af35f998c008ed38be9535bb8722400a185ee620dce7a914274556056afd101eeea379e7797f208a88fae9ed62b698033e7b1ceb8e6bc5fb3ea7d537214

Download Submit
C:\Windows\system\QUIhzau.exe

Filesize
2.1MB

MD5
3fab2d14c1a817b255fee2b4ff476d9d

SHA1
6fd74770d47356bf6737fac0222097e012b15076

SHA256
8d15e2087dae56f9440a28edb3ac9022f50d69b4546ea67daa7db591d2ed115c

SHA512
35cb55046e5062e713a97d61d8a9266ddb55b6beb18b92558443f31e35261256c85effd3de67def7822e7d6c185d0f704f93406fb9bc208209e4720bb6f361a3

Download Submit
C:\Windows\system\QaoeAqQ.exe

Filesize
2.1MB

MD5
bb735c7d931e582ee20738e6a92abd2f

SHA1
a2f7e847f1ba74fcaf598678ec4241e3b65e98e1

SHA256
e1f0423e62ebbafe268fc341c5aa43889334f40ba83740df3887a2b202fcd16b

SHA512
01f1afc7cdf72fdb5db89ebed7e850b4133f0bed36b2d54d780895af11db92bee5d92f7ad425548f85a8c1744b179595642c35a9175d14456979f45ce5649632

Download Submit
C:\Windows\system\SRyPetz.exe

Filesize
2.1MB

MD5
cba996ec87426c684f1baf55bf1e8743

SHA1
1203c46641985dd295d65c2a22005254e249c996

SHA256
702dbeae381458c86ad04a639f9c142b664ce0afa7f8b194d9a16ddf3f6d5af9

SHA512
040c564119e0581755e852f3cbcaa8209ff04a58a611cb9f29ebb9031f4bdb32b534c645ea5daf586fd3e4385315b0b40fa4aab66bb8fdab383ca1f57d570e24

Download Submit
C:\Windows\system\UnUTGze.exe

Filesize
2.1MB

MD5
bec9fad72fb38e0b51d88e63d1652d7e

SHA1
f90ede30526aab993df7c9fdc5d2760278a29133

SHA256
777c13d35f851ece20a7bbfa428166172cc1967a0ebe76280f7cf5f2e4fbb5db

SHA512
58e571be9181a572b733657747479bb186ec4891ce56c9397f91b517ba480a23ac104c40ec4422be4ffdfb2eb6a321374a0fa71d297cbeed231dc7e710fe1ebc

Download Submit
C:\Windows\system\XkwxWDt.exe

Filesize
2.1MB

MD5
ae2509a59527978fe5f82662792268e5

SHA1
b3c4f8edcab34efede6541316e9300bf1ae17bb0

SHA256
ec3b777c69c4410449f1ed0c86304e16b6dd41bb106203ab14fbe181e6c0d001

SHA512
6a3464314306d38c6eb106db37dc4a2214a8897827cd03a180803e278e8b634b5f53221214fd54a72db9148e56cfbf86cd53974352fb896236678544c3577a91

Download Submit
C:\Windows\system\YfvPYIa.exe

Filesize
2.1MB

MD5
ac333887ed0c119b2c17a83716fdd23c

SHA1
9b6e48ce5b8c5ccd0af69f96c256854e0d420f08

SHA256
1bcab36a3ffc933a66086442af191667f9617b52e985e3f788c68b37340b46b2

SHA512
a76c526c7a9cc3caaf7f49f66fa3f605da53a1c0928f0a09ab962e0e023e0446129e15719c5b47e258265522282f0f1230139ee718ad668054dc6d789516a91f

Download Submit
C:\Windows\system\bwQRqly.exe

Filesize
2.1MB

MD5
c768fb260fe3ff914c0b7e4a414f1936

SHA1
83eda9c156ec90582dbbf356006cc4cf51ccb7e3

SHA256
34e5f5584f9b71fdb0fffefc5b7e6770ee652ad7a4e4162dbdba70937667bd77

SHA512
3a9eb8bbab626e9832f45740f6df93f9cfc9ff530db0b2e02bc9d64b2d4ea7cc520bc537dba4c202396551f6acc0b93d57ef99550555fc0d0e797df9a6092f91

Download Submit
C:\Windows\system\eNDxKJI.exe

Filesize
1.5MB

MD5
f5e3ed77bc8a44696f256b21f28262db

SHA1
1ca43e7c9b0e691949ca606cbb4361e33634633a

SHA256
0e0d5d8e5dd5a482676632ddfc6be528d61c98fbd9540db344d547572db4528b

SHA512
70cef56c9ec930c0c8ecaed0e81919997b1d03e4585c3ac63ac3faf2e63995d1ec51798ead86ea82c9de2337ce340e126faf4551d654382620ed3d699a9a9b51

Download Submit
C:\Windows\system\ePVHkbi.exe

Filesize
2.1MB

MD5
b04045ada09a50e3c736d99addbb34ea

SHA1
e8f4fc01e5397b5801cd5365b608e08e341f321b

SHA256
3b9703da01e62408134c30c2ab0fdfd69e335097bf0b74e40fc614c3c6245b19

SHA512
4941c5b66a5e9f8372be7614e2534359803cc445ef1914b6d6dbe6f997dc6728d7d1c4b82097be965c7c6156478d266bc026c083befe7b36a2708d5180de10d1

Download Submit
C:\Windows\system\hRhwSXk.exe

Filesize
2.1MB

MD5
3fc356487b734b6122456322e79dbcb8

SHA1
87452831ffede24016bdc6fdbe0c07971d45e4e8

SHA256
5ab98619eec5d94fb2b4ff247c8986caa69b89cbcac0552441d419e162331e68

SHA512
d7de379e9218b95d70d415a642a85261cf0570ca6dcd5948526b2409eddad9219d113dd76d05d2301eaf8ecab133a469ef242d9bdea0989a831f0a342f6e0921

Download Submit
C:\Windows\system\hWEmNZR.exe

Filesize
2.1MB

MD5
4e88ce10b72a2c3f49c77bb5db394b6e

SHA1
fb665dc183ac54abe1b9e2c703ad9a888d90548d

SHA256
bacf5f6d52b7e0c0afc154af71f605a2d752ce0517e038be9ee61f7e6a0ef65c

SHA512
962b2bb40930ae63d1a2a2f8e86011916dacf37a182fbbe666b602ee5482a50ea456723b5cfd5779b3514913e8c884e2afbcb7bdf36ffdb85d995a328880c012

Download Submit
C:\Windows\system\hXykucL.exe

Filesize
2.1MB

MD5
369788e9eb7d4f2c28fcd31ca333ea80

SHA1
d84a401d3f6c185b8c0c1cd04622c520ae51bcb6

SHA256
964a6cb782ec1fb20d4fab5f68f49e2c5d1a254eb96252a4263286cffb4cf9b6

SHA512
bddc781445503417e429564beeca5b8e0dc18a93784d5ba394f4c406a216752ed140dd686a3dc1a3b72a10646315905e58aa36bf784e63fccbb305cc8dd11ac9

Download Submit
C:\Windows\system\iFviUUa.exe

Filesize
2.1MB

MD5
0de0a9684d06b893ca190e8e1ace1470

SHA1
a7578358e9a00b451ae4715d52a81095926657f4

SHA256
c2a0e7aa3bf915928b61645ad2eeaa122a25ec2791538f726f5ec05e3202abc4

SHA512
dfc3b35b41c852fc671b659007872b2117e47583a7b2bdb577fb9c9baf89e50dae8eee14b501f1c6221aa0f50968060e5f6323674a83a07fa3ac81d3df20d841

Download Submit
C:\Windows\system\iRSMlUd.exe

Filesize
1.6MB

MD5
619bcbaf75ed68ba403c6fe0a4cc2273

SHA1
6efe227909e8a08696cba1f26eae3a0b584562af

SHA256
4fdc1bb76d9c333165fe9797b06d9d319bd2da71d34f48ec60d4b9e08e67fafb

SHA512
f15d166736619115d26b32bc8c5e4d2ee5fff948e84fb59cfc145175192504258f0a0f2aeadb79f47dbe60b5b326d23bab2f8b9f1deb2cfd2bc51f38e9c2da19

Download Submit
C:\Windows\system\kFyRvjy.exe

Filesize
2.1MB

MD5
37670b5e2d45bd76db511c4c15832a91

SHA1
a61fdce2ce710af7604d87308b5bcd797176a75c

SHA256
bf0b650ac907c1df0a5e8c50e534e9a9833fdd8325643ca991bcaddc4af53a76

SHA512
41d600632f0d87bff4c3842083d824bb9019f2ca07d747b6cf8461fe79cbf685e387c74ada4343b0c946d3c52183b51f2ac0862b06abdce1a6f124719bf68514

Download Submit
C:\Windows\system\pqYRicr.exe

Filesize
2.1MB

MD5
b0cf62453fc14747c7b49ba13e2894a4

SHA1
21a6120b85423270ceffaeec4446d3d058dc5de4

SHA256
b2bde6879fe08c8df14ecb66ab1a4e6533dae7ec0abbd1ec835d573294788fc9

SHA512
efe675f0181b6a942f1a357aa7af53ed1cf52af9d2999a56a69a50e0b4549e6085e008ccee675d16c4c2d6fd1712050b36c25c28163f93172d1827bc173fdf13

Download Submit
C:\Windows\system\tETBdCA.exe

Filesize
2.1MB

MD5
bbaaa98e289c3c06d9d29d5f76e40a5c

SHA1
8199004bb27071e7e5cb6941aee1d1a2085b8487

SHA256
414f4e1d3f4cab356d715516c25b79159a3f65e3c7897cb7fd6b1e4b36ffdccc

SHA512
3f5a7fc34dadd64fee3cafc0f4586235b952a03cc7ce6ba3661da3a990fd74d8d89922aead40b36befc0252320899c8e1be39f45044576c3650e13c0ae8dba0d

Download Submit
C:\Windows\system\udXVbjT.exe

Filesize
2.1MB

MD5
d1044c0b6ac879919c9639a27f828836

SHA1
9a63d304e30def825f0bc2135c6a112b51f69623

SHA256
3e0a6f2c1e59b2e118c0a018557d8584373aa6dcde525eba2b23f671ae566a8c

SHA512
48a5b2a7c2d67065b59815a6f9a4dfa115f5eee935f5255b8f5a70641352958b37058a6a8e590475f3773cdfa81a14dccfd440c63449dce57d6c69d8177453e6

Download Submit
C:\Windows\system\veEvtVO.exe

Filesize
2.1MB

MD5
550509e42fb7acaa8c152aa890b38a5d

SHA1
680703ce133b88eda4a5c8417bf60dd8929050d4

SHA256
9f1debe32b549a1b5997de90ff6d17743000262ca6eacb2c39cfc8c5f1051ab6

SHA512
85b9101e4bbc0732b3fcc4b045afa6cf1c46598bff47e195ce470b0d5e33a6ed060c4354a528c23b42e62743942e96bfac8dca798b1ae8492759c0eae8663f7a

Download Submit
C:\Windows\system\xbtPYsM.exe

Filesize
2.1MB

MD5
8859438ed4847a1d00a70a8bc4bec25a

SHA1
7a1c0827a7f84a2f6fc06a12dbce7aa9529ca948

SHA256
392ff2af1e0c40c8ea423ee6cbd08da9d8508e2d00f60d2127f586a88933ccd5

SHA512
14e4852c782b3ff9f4b412d28178e28c89d824be0378c46da63557088dda49e501ed95a6626e99466bc2459c7ea693a927e085abc722ec85c85002310acd803f

Download Submit
C:\Windows\system\yHwZXXw.exe

Filesize
2.1MB

MD5
494e196ab98bc1152567a198249bf420

SHA1
db9d49f7ee5ab66e8d85420b4cc63b033af5e1bf

SHA256
eb93ebfc66806205d4f999a853b86bcd055c276319bbf1ad04ecddf7fc2330ca

SHA512
c588f3be13ffe6c11874cc9f79edf212e161c55d2f0de4e7b4f6dd1b60138e33583731acb5d60bf0984c0d3268f8719dfce8dd6f01bce4683d2881e5d94718dd

Download Submit
C:\Windows\system\yledpjq.exe

Filesize
2.1MB

MD5
da73e396c1d7d405a02e69c0c827e383

SHA1
af23bcea191b88fd53ab6f7a92435153f01e189e

SHA256
6f03cbf92fe865e21399b59a8347e493c9c47fb7c8969d7dce2485df40054e3a

SHA512
c3c0fb2d993f707070fa63ba04ea8855ea9fdb572180660d1d7c9ecd0597e8d71f3681e44a769e35ac102746ee02f516c5a06fbebbc32c22bd3a2743278cc1c9

Download Submit
\Windows\system\DNcqvbt.exe

Filesize
2.1MB

MD5
f03cb9a06cacfc78ade2f6cd28b17483

SHA1
63c89039923105aa4760ad8f9e924ef5fc0a893f

SHA256
9ef63a03e1296b438195003b4ffca8d706350c7ffaf1c26d5ecf420538f02e0c

SHA512
9d08bea40b80b38cb5e6ea975f97b68e6138b6a84b27d6fa1e7288cdb8c3e4fe205957b8e63f7c2f311a76ee9bd674994d9f2f024e15c8d4f2a45c1e228a95b9

Download Submit
\Windows\system\XGazvBt.exe

Filesize
2.1MB

MD5
092bd4a96a214c6557de96d60a15f040

SHA1
2599c896b06e20383935d3eaccab4a9156efa405

SHA256
7038712dfad5df8a40838ca74a8003813d76b973915b5aa57b24a6725eacedac

SHA512
4bef17d896913d265a9922ff785613e0a977975e14d937f636f0f847a325441e928ec53e9e628a4a8931e4c6fb4d39d73d6f60c6d4ac9a8e0fc797bb5aa0fba7

Download Submit
\Windows\system\eNDxKJI.exe

Filesize
2.1MB

MD5
7161d915d0881ac9c51fdce33e6a539c

SHA1
edc4550bb4b4795f25dd56e9c49ad876d73cdf6d

SHA256
4003e5f4ddf8e5a983ce1a229fbbc4c36e6ad5f9af2f73fb58381db114708e41

SHA512
155b9b4beafc1aa0aef1edd9f1b8ba713a1673215d88f9a9a282c5d47488f207ecac86bb7bcf45dafd3a3e9e95e61509ef6debfd400c7572b62603eb6a1852cb

Download Submit
\Windows\system\ePVHkbi.exe

Filesize
1.8MB

MD5
481d028534e82a4ec954575cfcae44f8

SHA1
3a2cf7a9847d360a63374f21236e90771e5961b5

SHA256
37b836ec74fa47401e5af0fe819d7f69fe8bb4710815b911e63a7f1e4e0aaf26

SHA512
8168058dc40f92adad47313c1cb84a2bb9a43d557001cc8a8a3ad36bc8dd4a771efd9939e8eace2a5e3774cd515a7b968ec9ed8e36a1bb0a52658d9d9c4a7d9c

Download Submit
\Windows\system\hWEmNZR.exe

Filesize
1.6MB

MD5
05a331103ecdffe0180b3703fd8674d5

SHA1
27ddc5aa6407b12306e4cba92a0a3e83f6d2b2fd

SHA256
d5c332128500d9d40a05cfd81f26912a9d5c6fc20bc98445964462c679230f01

SHA512
04609c18f9b8c314877dcf3f193f487111b3bdee4c5a11b521d0ea13ea4980aa7a84b38289a00171227bef1be14585b66bbb25cea978ffa3071fa72f41b81c33

Download Submit
\Windows\system\iRSMlUd.exe

Filesize
2.1MB

MD5
4206af73f160dea464cd716409c26da8

SHA1
c6e8844cde96e983f71537cb028ef8c28909028d

SHA256
5d8381362c83b4616224590cd664107d2a1386ff44547e1afc11520e5be1c351

SHA512
6724c842f9e565fd0d01a4138fe06c6fc6e61d0e7226d9b02f5e3e4b1ee574b33473f1817192559a7156ebd6fae2e5e3c8984e234fefded1819b63c5ff1209fb

Download Submit
memory/1964-174-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/1964-3221-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2368-184-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2368-2472-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2412-2474-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2412-180-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2452-182-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2452-3220-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-26-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/2556-1953-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/2572-178-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-3223-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-24-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-1944-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2704-176-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2704-2476-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2744-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2744-181-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-185-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-177-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-186-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-183-0x0000000003100000-0x00000000034F2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-179-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2744-175-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2744-20-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-8-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2744-0-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2892-27-0x00000000029E0000-0x0000000002A60000-memory.dmp

Filesize
512KB

Download
memory/2892-172-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2892-173-0x00000000029E0000-0x0000000002A60000-memory.dmp

Filesize
512KB

Download
memory/2892-204-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/2892-202-0x000000001B320000-0x000000001B602000-memory.dmp

Filesize
2.9MB

Download
memory/2892-285-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2944-10-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2944-2477-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download