xmrig | db8bfe1ca7f7e3c0a128d34ea58646ee626dd8a68b858d6b78f19e91e7b54baa

Analysis

max time kernel
29s
max time network
28s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
Size

1.6MB
MD5

07e71571e7c0ea67720a43b3a9ebc238
SHA1

54cf6365165f3c2c13c5b4276a7b6c5721607fde
SHA256

db8bfe1ca7f7e3c0a128d34ea58646ee626dd8a68b858d6b78f19e91e7b54baa
SHA512

a1ea017edf88c23d53a99b4d8bab153b4167a89bf6e4974f58e01842864d848ef19aa14c520c81e4639ad1e3fa8251a85b6ea1f0226249626ef1702acec395e7
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwpfky:Lz071uv4BPMkibTIA5CJY

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral1/memory/2680-110-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/2564-84-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2604-124-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2696-109-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2616-107-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/3036-103-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2564	YwPDeZq.exe
3036	XvdsEBp.exe
2616	ZOLiItJ.exe
2696	ThldIyR.exe
2680	vEkucqn.exe
2604	oICowuX.exe
2880	PfMPQPj.exe
2496	WvpdaiV.exe
2584	YeHCPkL.exe
2500	EGNYTOR.exe
1656	cAQdXBo.exe
1860	nsbfhvu.exe
2776	KNIlgsC.exe
2060	lOKQoIy.exe
2608	QQboejI.exe
2464	bswfLNM.exe
2592	jBBgoEH.exe
1288	KywvzlH.exe
1760	cdXZHhZ.exe
1488	eoaelrt.exe
2116	QXBhDzH.exe
1312	aKvkwon.exe
2912	sibyuPp.exe
964	syuhGLy.exe
1140	qQSKyYY.exe
1704	ceiMCty.exe
1956	PsAPtHs.exe
280	PruUUGD.exe
304	myMirXn.exe
1052	QmBlOJz.exe
3020	adYwmgD.exe
1160	jEzpzmq.exe
992	byESbfw.exe
1452	cNxfCaO.exe
1168	JLCqppl.exe
2928	osZFbTo.exe
2064	KpabAOq.exe
1816	Yjahpuv.exe
2348	JlHqnmN.exe
1484	JAIFipg.exe
1240	BPtREap.exe
3004	DQjjorN.exe
888	CgWaivJ.exe
2416	xPzuHvC.exe
1808	eHHJkWO.exe
1060	eaeiQZh.exe
2224	XCkfCwe.exe
2340	EmeFFwi.exe
2712	mTzVOOo.exe
1784	CNPMdXO.exe
2872	RlGUkrG.exe
840	CLXNKiO.exe
1876	Iaqpyst.exe
2664	AllnPJA.exe
2468	EhVARyJ.exe
2828	QDSVeYk.exe
3044	gnfXamo.exe
1708	KCWceGm.exe
2456	BoNoPhv.exe
2476	cKCJrdl.exe
1868	KUmlSui.exe
2448	kcXdiCW.exe
1592	ugkKYkp.exe
1516	cGxZAkV.exe

Loads dropped DLL 64 IoCs

pid	Process
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2956-0-0x000000013F420000-0x000000013F812000-memory.dmp	upx
behavioral1/files/0x000a000000014120-20.dat	upx
behavioral1/files/0x0006000000014b70-77.dat	upx
behavioral1/files/0x0006000000015616-104.dat	upx
behavioral1/memory/2680-110-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/files/0x000f000000005578-136.dat	upx
behavioral1/files/0x0006000000015c78-152.dat	upx
behavioral1/files/0x0006000000015cb6-179.dat	upx
behavioral1/files/0x0006000000015cce-180.dat	upx
behavioral1/files/0x0006000000015c83-174.dat	upx
behavioral1/files/0x000900000001448a-171.dat	upx
behavioral1/files/0x0006000000015c6b-165.dat	upx
behavioral1/files/0x0007000000015c3d-163.dat	upx
behavioral1/files/0x0006000000015626-161.dat	upx
behavioral1/files/0x0006000000015605-159.dat	upx
behavioral1/files/0x00060000000155f3-130.dat	upx
behavioral1/files/0x0006000000015018-129.dat	upx
behavioral1/files/0x0006000000015cee-185.dat	upx
behavioral1/memory/2564-84-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/files/0x00060000000155f7-82.dat	upx
behavioral1/files/0x00060000000155ed-81.dat	upx
behavioral1/files/0x0006000000014ef8-80.dat	upx
behavioral1/files/0x0006000000015c9f-170.dat	upx
behavioral1/files/0x0006000000015c52-142.dat	upx
behavioral1/memory/2604-124-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/2696-109-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/2616-107-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/memory/3036-103-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/files/0x0006000000014de9-102.dat	upx
behavioral1/files/0x0006000000014b31-92.dat	upx
behavioral1/files/0x0007000000014abe-90.dat	upx
behavioral1/files/0x0009000000014825-88.dat	upx
behavioral1/files/0x0007000000014af6-76.dat	upx
behavioral1/files/0x00070000000149f5-75.dat	upx
behavioral1/files/0x00080000000146c0-74.dat	upx
behavioral1/files/0x00080000000146b8-57.dat	upx
behavioral1/files/0x0008000000014539-21.dat	upx
behavioral1/files/0x0007000000014667-27.dat	upx
behavioral1/files/0x00070000000146a2-24.dat	upx
behavioral1/memory/2956-13-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/files/0x00090000000143ec-11.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sHbxHRS.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\MNPtekj.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\AKiZsuH.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\imWvlGg.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\KqTpqZd.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\Eisibpm.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\EjItNwY.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\CmNrSOp.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\siLfnBv.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\fjYuXol.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\iUVCsJj.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\SDfgMls.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\eSxKJcY.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\SKJlXnQ.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\lVnlDyt.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\AVPUTNa.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\BTQVEZL.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\XQWVoyq.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\LiqDOlk.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\FNsfUml.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\CJwVrNG.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\gLVytGf.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\JlHqnmN.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\nJizVdq.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\nQqJuHX.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\YtacRAo.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\NWyRgNN.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\KpabAOq.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\BPtREap.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\CNrhnVt.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\DfGhTEj.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\MzcnCWb.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\ljcAHVq.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\aFKQRkX.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\qPIzKbl.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\FNeILiF.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\qkFBQpj.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\cZUgaDd.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\QTKLlnm.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\KTfULUf.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\bJFMHom.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\heBbSrN.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\sUmGWcg.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\xoYjejc.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\QSTUvcg.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\scoJOdC.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\tAmqlUP.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\JBDOZzi.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\fTwMIUr.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\gjxVpuh.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\iEmDlNV.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\dWBOOMi.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\yoHQNwi.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\XrinmKC.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\BkRLGAI.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\UgSFQhz.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\ucfHEjo.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\AllnPJA.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\kcXdiCW.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\ETSBlRE.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\TsOeRpI.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\UEKrjXp.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\wYtOzOU.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
File created	C:\Windows\System\RbTTfmf.exe	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2240	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
Token: SeDebugPrivilege	2240	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2240	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	29
PID 2956 wrote to memory of 2240	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	29
PID 2956 wrote to memory of 2240	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	29
PID 2956 wrote to memory of 3036	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	30
PID 2956 wrote to memory of 3036	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	30
PID 2956 wrote to memory of 3036	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	30
PID 2956 wrote to memory of 2564	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	31
PID 2956 wrote to memory of 2564	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	31
PID 2956 wrote to memory of 2564	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	31
PID 2956 wrote to memory of 2616	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	32
PID 2956 wrote to memory of 2616	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	32
PID 2956 wrote to memory of 2616	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	32
PID 2956 wrote to memory of 2680	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	33
PID 2956 wrote to memory of 2680	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	33
PID 2956 wrote to memory of 2680	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	33
PID 2956 wrote to memory of 2696	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	34
PID 2956 wrote to memory of 2696	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	34
PID 2956 wrote to memory of 2696	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	34
PID 2956 wrote to memory of 2604	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	35
PID 2956 wrote to memory of 2604	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	35
PID 2956 wrote to memory of 2604	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	35
PID 2956 wrote to memory of 2880	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	36
PID 2956 wrote to memory of 2880	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	36
PID 2956 wrote to memory of 2880	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	36
PID 2956 wrote to memory of 2060	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	37
PID 2956 wrote to memory of 2060	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	37
PID 2956 wrote to memory of 2060	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	37
PID 2956 wrote to memory of 2496	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	38
PID 2956 wrote to memory of 2496	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	38
PID 2956 wrote to memory of 2496	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	38
PID 2956 wrote to memory of 2608	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	39
PID 2956 wrote to memory of 2608	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	39
PID 2956 wrote to memory of 2608	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	39
PID 2956 wrote to memory of 2584	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	40
PID 2956 wrote to memory of 2584	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	40
PID 2956 wrote to memory of 2584	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	40
PID 2956 wrote to memory of 2464	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	41
PID 2956 wrote to memory of 2464	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	41
PID 2956 wrote to memory of 2464	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	41
PID 2956 wrote to memory of 2500	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	42
PID 2956 wrote to memory of 2500	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	42
PID 2956 wrote to memory of 2500	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	42
PID 2956 wrote to memory of 2592	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	43
PID 2956 wrote to memory of 2592	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	43
PID 2956 wrote to memory of 2592	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	43
PID 2956 wrote to memory of 1656	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	44
PID 2956 wrote to memory of 1656	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	44
PID 2956 wrote to memory of 1656	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	44
PID 2956 wrote to memory of 1760	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	45
PID 2956 wrote to memory of 1760	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	45
PID 2956 wrote to memory of 1760	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	45
PID 2956 wrote to memory of 1860	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	46
PID 2956 wrote to memory of 1860	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	46
PID 2956 wrote to memory of 1860	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	46
PID 2956 wrote to memory of 1488	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	47
PID 2956 wrote to memory of 1488	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	47
PID 2956 wrote to memory of 1488	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	47
PID 2956 wrote to memory of 2776	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	48
PID 2956 wrote to memory of 2776	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	48
PID 2956 wrote to memory of 2776	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	48
PID 2956 wrote to memory of 964	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	49
PID 2956 wrote to memory of 964	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	49
PID 2956 wrote to memory of 964	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	49
PID 2956 wrote to memory of 1288	2956	07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07e71571e7c0ea67720a43b3a9ebc238_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- C:\Windows\System\XvdsEBp.exe
  C:\Windows\System\XvdsEBp.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\YwPDeZq.exe
  C:\Windows\System\YwPDeZq.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\ZOLiItJ.exe
  C:\Windows\System\ZOLiItJ.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\vEkucqn.exe
  C:\Windows\System\vEkucqn.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\ThldIyR.exe
  C:\Windows\System\ThldIyR.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\oICowuX.exe
  C:\Windows\System\oICowuX.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\PfMPQPj.exe
  C:\Windows\System\PfMPQPj.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\lOKQoIy.exe
  C:\Windows\System\lOKQoIy.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\WvpdaiV.exe
  C:\Windows\System\WvpdaiV.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\QQboejI.exe
  C:\Windows\System\QQboejI.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\YeHCPkL.exe
  C:\Windows\System\YeHCPkL.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\bswfLNM.exe
  C:\Windows\System\bswfLNM.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\EGNYTOR.exe
  C:\Windows\System\EGNYTOR.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\jBBgoEH.exe
  C:\Windows\System\jBBgoEH.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\cAQdXBo.exe
  C:\Windows\System\cAQdXBo.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\cdXZHhZ.exe
  C:\Windows\System\cdXZHhZ.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\nsbfhvu.exe
  C:\Windows\System\nsbfhvu.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\eoaelrt.exe
  C:\Windows\System\eoaelrt.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\KNIlgsC.exe
  C:\Windows\System\KNIlgsC.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\syuhGLy.exe
  C:\Windows\System\syuhGLy.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\KywvzlH.exe
  C:\Windows\System\KywvzlH.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\qQSKyYY.exe
  C:\Windows\System\qQSKyYY.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\QXBhDzH.exe
  C:\Windows\System\QXBhDzH.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\ceiMCty.exe
  C:\Windows\System\ceiMCty.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\aKvkwon.exe
  C:\Windows\System\aKvkwon.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\PsAPtHs.exe
  C:\Windows\System\PsAPtHs.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\sibyuPp.exe
  C:\Windows\System\sibyuPp.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\myMirXn.exe
  C:\Windows\System\myMirXn.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\PruUUGD.exe
  C:\Windows\System\PruUUGD.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\jEzpzmq.exe
  C:\Windows\System\jEzpzmq.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\QmBlOJz.exe
  C:\Windows\System\QmBlOJz.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\KpabAOq.exe
  C:\Windows\System\KpabAOq.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\adYwmgD.exe
  C:\Windows\System\adYwmgD.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\Yjahpuv.exe
  C:\Windows\System\Yjahpuv.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\byESbfw.exe
  C:\Windows\System\byESbfw.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\BPtREap.exe
  C:\Windows\System\BPtREap.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\cNxfCaO.exe
  C:\Windows\System\cNxfCaO.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\eHHJkWO.exe
  C:\Windows\System\eHHJkWO.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\JLCqppl.exe
  C:\Windows\System\JLCqppl.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\eaeiQZh.exe
  C:\Windows\System\eaeiQZh.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\osZFbTo.exe
  C:\Windows\System\osZFbTo.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\XCkfCwe.exe
  C:\Windows\System\XCkfCwe.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\JlHqnmN.exe
  C:\Windows\System\JlHqnmN.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\EmeFFwi.exe
  C:\Windows\System\EmeFFwi.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\JAIFipg.exe
  C:\Windows\System\JAIFipg.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\mTzVOOo.exe
  C:\Windows\System\mTzVOOo.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\DQjjorN.exe
  C:\Windows\System\DQjjorN.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\CNPMdXO.exe
  C:\Windows\System\CNPMdXO.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\CgWaivJ.exe
  C:\Windows\System\CgWaivJ.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\RlGUkrG.exe
  C:\Windows\System\RlGUkrG.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\xPzuHvC.exe
  C:\Windows\System\xPzuHvC.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\CLXNKiO.exe
  C:\Windows\System\CLXNKiO.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\Iaqpyst.exe
  C:\Windows\System\Iaqpyst.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\AllnPJA.exe
  C:\Windows\System\AllnPJA.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\EhVARyJ.exe
  C:\Windows\System\EhVARyJ.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\gnfXamo.exe
  C:\Windows\System\gnfXamo.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\QDSVeYk.exe
  C:\Windows\System\QDSVeYk.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\KCWceGm.exe
  C:\Windows\System\KCWceGm.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\BoNoPhv.exe
  C:\Windows\System\BoNoPhv.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\KUmlSui.exe
  C:\Windows\System\KUmlSui.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\cKCJrdl.exe
  C:\Windows\System\cKCJrdl.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\kcXdiCW.exe
  C:\Windows\System\kcXdiCW.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\ugkKYkp.exe
  C:\Windows\System\ugkKYkp.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\cGxZAkV.exe
  C:\Windows\System\cGxZAkV.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\JADyMOF.exe
  C:\Windows\System\JADyMOF.exe
  2⤵
  PID:1684
- C:\Windows\System\zaNwtjB.exe
  C:\Windows\System\zaNwtjB.exe
  2⤵
  PID:2784
- C:\Windows\System\JJVrrvo.exe
  C:\Windows\System\JJVrrvo.exe
  2⤵
  PID:2028
- C:\Windows\System\jqRPgOT.exe
  C:\Windows\System\jqRPgOT.exe
  2⤵
  PID:2920
- C:\Windows\System\xnYeveW.exe
  C:\Windows\System\xnYeveW.exe
  2⤵
  PID:1608
- C:\Windows\System\MvXVVZc.exe
  C:\Windows\System\MvXVVZc.exe
  2⤵
  PID:772
- C:\Windows\System\mSlAUAF.exe
  C:\Windows\System\mSlAUAF.exe
  2⤵
  PID:2808
- C:\Windows\System\CPEXPhN.exe
  C:\Windows\System\CPEXPhN.exe
  2⤵
  PID:1624
- C:\Windows\System\frohikw.exe
  C:\Windows\System\frohikw.exe
  2⤵
  PID:1500
- C:\Windows\System\zYVHBSt.exe
  C:\Windows\System\zYVHBSt.exe
  2⤵
  PID:2372
- C:\Windows\System\CWatHRp.exe
  C:\Windows\System\CWatHRp.exe
  2⤵
  PID:2188
- C:\Windows\System\XEXWLGS.exe
  C:\Windows\System\XEXWLGS.exe
  2⤵
  PID:1184
- C:\Windows\System\iQLbWVP.exe
  C:\Windows\System\iQLbWVP.exe
  2⤵
  PID:2924
- C:\Windows\System\KqBFUoC.exe
  C:\Windows\System\KqBFUoC.exe
  2⤵
  PID:1188
- C:\Windows\System\BTQVEZL.exe
  C:\Windows\System\BTQVEZL.exe
  2⤵
  PID:2208
- C:\Windows\System\cxXBUch.exe
  C:\Windows\System\cxXBUch.exe
  2⤵
  PID:1912
- C:\Windows\System\eqCVCEW.exe
  C:\Windows\System\eqCVCEW.exe
  2⤵
  PID:2436
- C:\Windows\System\yvVdmDO.exe
  C:\Windows\System\yvVdmDO.exe
  2⤵
  PID:2704
- C:\Windows\System\CKJGSVY.exe
  C:\Windows\System\CKJGSVY.exe
  2⤵
  PID:1688
- C:\Windows\System\yzBdVBV.exe
  C:\Windows\System\yzBdVBV.exe
  2⤵
  PID:2444
- C:\Windows\System\EuWtPFM.exe
  C:\Windows\System\EuWtPFM.exe
  2⤵
  PID:776
- C:\Windows\System\LofrRaR.exe
  C:\Windows\System\LofrRaR.exe
  2⤵
  PID:2952
- C:\Windows\System\VQwnpwb.exe
  C:\Windows\System\VQwnpwb.exe
  2⤵
  PID:1832
- C:\Windows\System\WPcKmQT.exe
  C:\Windows\System\WPcKmQT.exe
  2⤵
  PID:1180
- C:\Windows\System\RAXMyjU.exe
  C:\Windows\System\RAXMyjU.exe
  2⤵
  PID:1212
- C:\Windows\System\YJTNPhY.exe
  C:\Windows\System\YJTNPhY.exe
  2⤵
  PID:1076
- C:\Windows\System\QybNlsB.exe
  C:\Windows\System\QybNlsB.exe
  2⤵
  PID:2136
- C:\Windows\System\IAUFGpi.exe
  C:\Windows\System\IAUFGpi.exe
  2⤵
  PID:2200
- C:\Windows\System\vJsNJbe.exe
  C:\Windows\System\vJsNJbe.exe
  2⤵
  PID:1844
- C:\Windows\System\wLNfJTq.exe
  C:\Windows\System\wLNfJTq.exe
  2⤵
  PID:1120
- C:\Windows\System\tLqZpZj.exe
  C:\Windows\System\tLqZpZj.exe
  2⤵
  PID:1456
- C:\Windows\System\OEqcHnX.exe
  C:\Windows\System\OEqcHnX.exe
  2⤵
  PID:1056
- C:\Windows\System\YDpTveb.exe
  C:\Windows\System\YDpTveb.exe
  2⤵
  PID:2052
- C:\Windows\System\MzcnCWb.exe
  C:\Windows\System\MzcnCWb.exe
  2⤵
  PID:1588
- C:\Windows\System\QqGNbDU.exe
  C:\Windows\System\QqGNbDU.exe
  2⤵
  PID:1776
- C:\Windows\System\UZYYAsx.exe
  C:\Windows\System\UZYYAsx.exe
  2⤵
  PID:2576
- C:\Windows\System\KWdUBOh.exe
  C:\Windows\System\KWdUBOh.exe
  2⤵
  PID:1628
- C:\Windows\System\OPiAznJ.exe
  C:\Windows\System\OPiAznJ.exe
  2⤵
  PID:2700
- C:\Windows\System\WBPKAcM.exe
  C:\Windows\System\WBPKAcM.exe
  2⤵
  PID:1736
- C:\Windows\System\YZHwsoA.exe
  C:\Windows\System\YZHwsoA.exe
  2⤵
  PID:2884
- C:\Windows\System\HjQUxVh.exe
  C:\Windows\System\HjQUxVh.exe
  2⤵
  PID:1740
- C:\Windows\System\YqSWRzt.exe
  C:\Windows\System\YqSWRzt.exe
  2⤵
  PID:2964
- C:\Windows\System\CNrhnVt.exe
  C:\Windows\System\CNrhnVt.exe
  2⤵
  PID:1720
- C:\Windows\System\GZBbJhg.exe
  C:\Windows\System\GZBbJhg.exe
  2⤵
  PID:312
- C:\Windows\System\cTmdXKf.exe
  C:\Windows\System\cTmdXKf.exe
  2⤵
  PID:2760
- C:\Windows\System\WmoGAxI.exe
  C:\Windows\System\WmoGAxI.exe
  2⤵
  PID:2960
- C:\Windows\System\ccNYXED.exe
  C:\Windows\System\ccNYXED.exe
  2⤵
  PID:1664
- C:\Windows\System\cZUgaDd.exe
  C:\Windows\System\cZUgaDd.exe
  2⤵
  PID:2540
- C:\Windows\System\dPWVUNd.exe
  C:\Windows\System\dPWVUNd.exe
  2⤵
  PID:1852
- C:\Windows\System\GFxhTOI.exe
  C:\Windows\System\GFxhTOI.exe
  2⤵
  PID:2292
- C:\Windows\System\yBAJgbV.exe
  C:\Windows\System\yBAJgbV.exe
  2⤵
  PID:1508
- C:\Windows\System\wowVieN.exe
  C:\Windows\System\wowVieN.exe
  2⤵
  PID:536
- C:\Windows\System\KCObKZc.exe
  C:\Windows\System\KCObKZc.exe
  2⤵
  PID:2516
- C:\Windows\System\BKxIGRQ.exe
  C:\Windows\System\BKxIGRQ.exe
  2⤵
  PID:2164
- C:\Windows\System\ftLdLSG.exe
  C:\Windows\System\ftLdLSG.exe
  2⤵
  PID:1744
- C:\Windows\System\DiwmQXp.exe
  C:\Windows\System\DiwmQXp.exe
  2⤵
  PID:1848
- C:\Windows\System\pYGgWPi.exe
  C:\Windows\System\pYGgWPi.exe
  2⤵
  PID:3088
- C:\Windows\System\pmmjEJc.exe
  C:\Windows\System\pmmjEJc.exe
  2⤵
  PID:3104
- C:\Windows\System\EczbpGR.exe
  C:\Windows\System\EczbpGR.exe
  2⤵
  PID:3120
- C:\Windows\System\GpbkcMu.exe
  C:\Windows\System\GpbkcMu.exe
  2⤵
  PID:3136
- C:\Windows\System\xwgbiNt.exe
  C:\Windows\System\xwgbiNt.exe
  2⤵
  PID:3152
- C:\Windows\System\aJdTTuU.exe
  C:\Windows\System\aJdTTuU.exe
  2⤵
  PID:3168
- C:\Windows\System\YhGTDxc.exe
  C:\Windows\System\YhGTDxc.exe
  2⤵
  PID:3184
- C:\Windows\System\bhazqFY.exe
  C:\Windows\System\bhazqFY.exe
  2⤵
  PID:3200
- C:\Windows\System\vLinSFM.exe
  C:\Windows\System\vLinSFM.exe
  2⤵
  PID:3216
- C:\Windows\System\EbmMUaN.exe
  C:\Windows\System\EbmMUaN.exe
  2⤵
  PID:3232
- C:\Windows\System\ETSBlRE.exe
  C:\Windows\System\ETSBlRE.exe
  2⤵
  PID:3248
- C:\Windows\System\GcGoNxz.exe
  C:\Windows\System\GcGoNxz.exe
  2⤵
  PID:3264
- C:\Windows\System\FbVPKSf.exe
  C:\Windows\System\FbVPKSf.exe
  2⤵
  PID:3288
- C:\Windows\System\gfcxNfa.exe
  C:\Windows\System\gfcxNfa.exe
  2⤵
  PID:3316
- C:\Windows\System\tKbDaPm.exe
  C:\Windows\System\tKbDaPm.exe
  2⤵
  PID:3332
- C:\Windows\System\EAvfhre.exe
  C:\Windows\System\EAvfhre.exe
  2⤵
  PID:3348
- C:\Windows\System\tEUKjKe.exe
  C:\Windows\System\tEUKjKe.exe
  2⤵
  PID:3364
- C:\Windows\System\zjlfLKi.exe
  C:\Windows\System\zjlfLKi.exe
  2⤵
  PID:3380
- C:\Windows\System\dZfZWAM.exe
  C:\Windows\System\dZfZWAM.exe
  2⤵
  PID:3400
- C:\Windows\System\TZqPSTl.exe
  C:\Windows\System\TZqPSTl.exe
  2⤵
  PID:3416
- C:\Windows\System\CAQZNhy.exe
  C:\Windows\System\CAQZNhy.exe
  2⤵
  PID:3432
- C:\Windows\System\szmhqHa.exe
  C:\Windows\System\szmhqHa.exe
  2⤵
  PID:3448
- C:\Windows\System\kcAnjYd.exe
  C:\Windows\System\kcAnjYd.exe
  2⤵
  PID:3464
- C:\Windows\System\BlmhiYC.exe
  C:\Windows\System\BlmhiYC.exe
  2⤵
  PID:3480
- C:\Windows\System\BCMBZjN.exe
  C:\Windows\System\BCMBZjN.exe
  2⤵
  PID:3496
- C:\Windows\System\YkCETUb.exe
  C:\Windows\System\YkCETUb.exe
  2⤵
  PID:3512
- C:\Windows\System\AugTYQz.exe
  C:\Windows\System\AugTYQz.exe
  2⤵
  PID:3528
- C:\Windows\System\EFgWajL.exe
  C:\Windows\System\EFgWajL.exe
  2⤵
  PID:3680
- C:\Windows\System\hFGLXrh.exe
  C:\Windows\System\hFGLXrh.exe
  2⤵
  PID:3704
- C:\Windows\System\oZomGER.exe
  C:\Windows\System\oZomGER.exe
  2⤵
  PID:3720
- C:\Windows\System\JjbyBkV.exe
  C:\Windows\System\JjbyBkV.exe
  2⤵
  PID:3736
- C:\Windows\System\NQIAakA.exe
  C:\Windows\System\NQIAakA.exe
  2⤵
  PID:3752
- C:\Windows\System\sjEmNNz.exe
  C:\Windows\System\sjEmNNz.exe
  2⤵
  PID:3768
- C:\Windows\System\OtIItIX.exe
  C:\Windows\System\OtIItIX.exe
  2⤵
  PID:3784
- C:\Windows\System\qCXDbaC.exe
  C:\Windows\System\qCXDbaC.exe
  2⤵
  PID:3800
- C:\Windows\System\RTNLPyD.exe
  C:\Windows\System\RTNLPyD.exe
  2⤵
  PID:3816
- C:\Windows\System\wRmVqdu.exe
  C:\Windows\System\wRmVqdu.exe
  2⤵
  PID:3832
- C:\Windows\System\grDkVKI.exe
  C:\Windows\System\grDkVKI.exe
  2⤵
  PID:3852
- C:\Windows\System\SRuDiod.exe
  C:\Windows\System\SRuDiod.exe
  2⤵
  PID:3868
- C:\Windows\System\zTYJRAY.exe
  C:\Windows\System\zTYJRAY.exe
  2⤵
  PID:3884
- C:\Windows\System\WGGhhEk.exe
  C:\Windows\System\WGGhhEk.exe
  2⤵
  PID:3900
- C:\Windows\System\pqcGSUw.exe
  C:\Windows\System\pqcGSUw.exe
  2⤵
  PID:3916
- C:\Windows\System\zuaNvAE.exe
  C:\Windows\System\zuaNvAE.exe
  2⤵
  PID:3932
- C:\Windows\System\vwfxeJA.exe
  C:\Windows\System\vwfxeJA.exe
  2⤵
  PID:3952
- C:\Windows\System\ImPSDTk.exe
  C:\Windows\System\ImPSDTk.exe
  2⤵
  PID:3968
- C:\Windows\System\lDtQrrH.exe
  C:\Windows\System\lDtQrrH.exe
  2⤵
  PID:3984
- C:\Windows\System\vrFAMry.exe
  C:\Windows\System\vrFAMry.exe
  2⤵
  PID:4000
- C:\Windows\System\LLyCwEd.exe
  C:\Windows\System\LLyCwEd.exe
  2⤵
  PID:4016
- C:\Windows\System\uiQpJKE.exe
  C:\Windows\System\uiQpJKE.exe
  2⤵
  PID:4032
- C:\Windows\System\PwYajod.exe
  C:\Windows\System\PwYajod.exe
  2⤵
  PID:4048
- C:\Windows\System\ofSNqsy.exe
  C:\Windows\System\ofSNqsy.exe
  2⤵
  PID:2900
- C:\Windows\System\jsdPSCl.exe
  C:\Windows\System\jsdPSCl.exe
  2⤵
  PID:2672
- C:\Windows\System\VtqCMFC.exe
  C:\Windows\System\VtqCMFC.exe
  2⤵
  PID:3100
- C:\Windows\System\CyhtRkS.exe
  C:\Windows\System\CyhtRkS.exe
  2⤵
  PID:1888
- C:\Windows\System\Dxkjjxo.exe
  C:\Windows\System\Dxkjjxo.exe
  2⤵
  PID:3000
- C:\Windows\System\McYUPfA.exe
  C:\Windows\System\McYUPfA.exe
  2⤵
  PID:1156
- C:\Windows\System\zoouELz.exe
  C:\Windows\System\zoouELz.exe
  2⤵
  PID:3164
- C:\Windows\System\JIxixCl.exe
  C:\Windows\System\JIxixCl.exe
  2⤵
  PID:3228
- C:\Windows\System\AbbtfYE.exe
  C:\Windows\System\AbbtfYE.exe
  2⤵
  PID:3300
- C:\Windows\System\dHhAssW.exe
  C:\Windows\System\dHhAssW.exe
  2⤵
  PID:1200
- C:\Windows\System\tYUBJkU.exe
  C:\Windows\System\tYUBJkU.exe
  2⤵
  PID:3412
- C:\Windows\System\NoYVgdD.exe
  C:\Windows\System\NoYVgdD.exe
  2⤵
  PID:3444
- C:\Windows\System\VeLPumt.exe
  C:\Windows\System\VeLPumt.exe
  2⤵
  PID:3508
- C:\Windows\System\kssGhqX.exe
  C:\Windows\System\kssGhqX.exe
  2⤵
  PID:3548
- C:\Windows\System\eWnqYVH.exe
  C:\Windows\System\eWnqYVH.exe
  2⤵
  PID:3560
- C:\Windows\System\fWRVBIy.exe
  C:\Windows\System\fWRVBIy.exe
  2⤵
  PID:3576
- C:\Windows\System\hUjKTYE.exe
  C:\Windows\System\hUjKTYE.exe
  2⤵
  PID:3600
- C:\Windows\System\hawBfIl.exe
  C:\Windows\System\hawBfIl.exe
  2⤵
  PID:2628
- C:\Windows\System\LClGRRy.exe
  C:\Windows\System\LClGRRy.exe
  2⤵
  PID:3652
- C:\Windows\System\oPYeuVw.exe
  C:\Windows\System\oPYeuVw.exe
  2⤵
  PID:3668
- C:\Windows\System\kIyuhVa.exe
  C:\Windows\System\kIyuhVa.exe
  2⤵
  PID:3388
- C:\Windows\System\DnhogHT.exe
  C:\Windows\System\DnhogHT.exe
  2⤵
  PID:3324
- C:\Windows\System\MiVNpdp.exe
  C:\Windows\System\MiVNpdp.exe
  2⤵
  PID:3240
- C:\Windows\System\GQNZOnK.exe
  C:\Windows\System\GQNZOnK.exe
  2⤵
  PID:3144
- C:\Windows\System\sUmGWcg.exe
  C:\Windows\System\sUmGWcg.exe
  2⤵
  PID:2796
- C:\Windows\System\okwyokI.exe
  C:\Windows\System\okwyokI.exe
  2⤵
  PID:1984
- C:\Windows\System\jvIBoIM.exe
  C:\Windows\System\jvIBoIM.exe
  2⤵
  PID:3676
- C:\Windows\System\TsOeRpI.exe
  C:\Windows\System\TsOeRpI.exe
  2⤵
  PID:3712
- C:\Windows\System\vQesitF.exe
  C:\Windows\System\vQesitF.exe
  2⤵
  PID:3776
- C:\Windows\System\YcuPCCq.exe
  C:\Windows\System\YcuPCCq.exe
  2⤵
  PID:3840
- C:\Windows\System\xqIipeG.exe
  C:\Windows\System\xqIipeG.exe
  2⤵
  PID:3880
- C:\Windows\System\IJDbtHZ.exe
  C:\Windows\System\IJDbtHZ.exe
  2⤵
  PID:3948
- C:\Windows\System\KDgtFIH.exe
  C:\Windows\System\KDgtFIH.exe
  2⤵
  PID:3728
- C:\Windows\System\GaaKSaI.exe
  C:\Windows\System\GaaKSaI.exe
  2⤵
  PID:3796
- C:\Windows\System\AkPowSu.exe
  C:\Windows\System\AkPowSu.exe
  2⤵
  PID:4044
- C:\Windows\System\luQsJtq.exe
  C:\Windows\System\luQsJtq.exe
  2⤵
  PID:4028
- C:\Windows\System\IdGwQat.exe
  C:\Windows\System\IdGwQat.exe
  2⤵
  PID:4064
- C:\Windows\System\IkTVCto.exe
  C:\Windows\System\IkTVCto.exe
  2⤵
  PID:2108
- C:\Windows\System\EfcjuOP.exe
  C:\Windows\System\EfcjuOP.exe
  2⤵
  PID:3224
- C:\Windows\System\UEKrjXp.exe
  C:\Windows\System\UEKrjXp.exe
  2⤵
  PID:3376
- C:\Windows\System\nwDFqsq.exe
  C:\Windows\System\nwDFqsq.exe
  2⤵
  PID:3568
- C:\Windows\System\hcMKQnv.exe
  C:\Windows\System\hcMKQnv.exe
  2⤵
  PID:3764
- C:\Windows\System\DfGKeKv.exe
  C:\Windows\System\DfGKeKv.exe
  2⤵
  PID:3864
- C:\Windows\System\QIKfQqz.exe
  C:\Windows\System\QIKfQqz.exe
  2⤵
  PID:3928
- C:\Windows\System\eKygHze.exe
  C:\Windows\System\eKygHze.exe
  2⤵
  PID:3996
- C:\Windows\System\DbraCRS.exe
  C:\Windows\System\DbraCRS.exe
  2⤵
  PID:4072
- C:\Windows\System\DjRnybl.exe
  C:\Windows\System\DjRnybl.exe
  2⤵
  PID:1648
- C:\Windows\System\OUNTKpA.exe
  C:\Windows\System\OUNTKpA.exe
  2⤵
  PID:2232
- C:\Windows\System\BFhWxJT.exe
  C:\Windows\System\BFhWxJT.exe
  2⤵
  PID:1788
- C:\Windows\System\jbealvP.exe
  C:\Windows\System\jbealvP.exe
  2⤵
  PID:2068
- C:\Windows\System\vcOmWhv.exe
  C:\Windows\System\vcOmWhv.exe
  2⤵
  PID:2228
- C:\Windows\System\bjmvbhJ.exe
  C:\Windows\System\bjmvbhJ.exe
  2⤵
  PID:3260
- C:\Windows\System\ascTsxy.exe
  C:\Windows\System\ascTsxy.exe
  2⤵
  PID:3504
- C:\Windows\System\vdduOPq.exe
  C:\Windows\System\vdduOPq.exe
  2⤵
  PID:3588
- C:\Windows\System\nLjABch.exe
  C:\Windows\System\nLjABch.exe
  2⤵
  PID:3616
- C:\Windows\System\wxPdrHF.exe
  C:\Windows\System\wxPdrHF.exe
  2⤵
  PID:768
- C:\Windows\System\QMBRPeA.exe
  C:\Windows\System\QMBRPeA.exe
  2⤵
  PID:3284
- C:\Windows\System\JlXJWFp.exe
  C:\Windows\System\JlXJWFp.exe
  2⤵
  PID:3456
- C:\Windows\System\ZFYjRxY.exe
  C:\Windows\System\ZFYjRxY.exe
  2⤵
  PID:3524
- C:\Windows\System\NNODwmk.exe
  C:\Windows\System\NNODwmk.exe
  2⤵
  PID:3636
- C:\Windows\System\nXsUapr.exe
  C:\Windows\System\nXsUapr.exe
  2⤵
  PID:2012
- C:\Windows\System\UBIUnOu.exe
  C:\Windows\System\UBIUnOu.exe
  2⤵
  PID:2660
- C:\Windows\System\ZvMIDCt.exe
  C:\Windows\System\ZvMIDCt.exe
  2⤵
  PID:1996
- C:\Windows\System\XesSZtZ.exe
  C:\Windows\System\XesSZtZ.exe
  2⤵
  PID:3356
- C:\Windows\System\bBcFUUD.exe
  C:\Windows\System\bBcFUUD.exe
  2⤵
  PID:3148
- C:\Windows\System\QUReZhB.exe
  C:\Windows\System\QUReZhB.exe
  2⤵
  PID:2024
- C:\Windows\System\XOoLMUS.exe
  C:\Windows\System\XOoLMUS.exe
  2⤵
  PID:3084
- C:\Windows\System\mnbKDJz.exe
  C:\Windows\System\mnbKDJz.exe
  2⤵
  PID:2844
- C:\Windows\System\DMEJgsM.exe
  C:\Windows\System\DMEJgsM.exe
  2⤵
  PID:2708
- C:\Windows\System\OjGlYhg.exe
  C:\Windows\System\OjGlYhg.exe
  2⤵
  PID:1316
- C:\Windows\System\WhNVRLJ.exe
  C:\Windows\System\WhNVRLJ.exe
  2⤵
  PID:3488
- C:\Windows\System\ZiBDbLI.exe
  C:\Windows\System\ZiBDbLI.exe
  2⤵
  PID:2428
- C:\Windows\System\QvIgnqH.exe
  C:\Windows\System\QvIgnqH.exe
  2⤵
  PID:3392
- C:\Windows\System\vvgpbKu.exe
  C:\Windows\System\vvgpbKu.exe
  2⤵
  PID:3744
- C:\Windows\System\eqwYsnk.exe
  C:\Windows\System\eqwYsnk.exe
  2⤵
  PID:3876
- C:\Windows\System\dfBTTjE.exe
  C:\Windows\System\dfBTTjE.exe
  2⤵
  PID:2412
- C:\Windows\System\HkXAexY.exe
  C:\Windows\System\HkXAexY.exe
  2⤵
  PID:3748
- C:\Windows\System\OFGuLyd.exe
  C:\Windows\System\OFGuLyd.exe
  2⤵
  PID:3760
- C:\Windows\System\LtJpYam.exe
  C:\Windows\System\LtJpYam.exe
  2⤵
  PID:2536
- C:\Windows\System\OknACRM.exe
  C:\Windows\System\OknACRM.exe
  2⤵
  PID:3692
- C:\Windows\System\TmmxdAo.exe
  C:\Windows\System\TmmxdAo.exe
  2⤵
  PID:4068
- C:\Windows\System\cxNjtQv.exe
  C:\Windows\System\cxNjtQv.exe
  2⤵
  PID:2572
- C:\Windows\System\PvkxPvH.exe
  C:\Windows\System\PvkxPvH.exe
  2⤵
  PID:3160
- C:\Windows\System\pvPcCPC.exe
  C:\Windows\System\pvPcCPC.exe
  2⤵
  PID:1752
- C:\Windows\System\tUxLwoO.exe
  C:\Windows\System\tUxLwoO.exe
  2⤵
  PID:3632
- C:\Windows\System\loHhJGr.exe
  C:\Windows\System\loHhJGr.exe
  2⤵
  PID:3660
- C:\Windows\System\CbdKKzt.exe
  C:\Windows\System\CbdKKzt.exe
  2⤵
  PID:3244
- C:\Windows\System\qIcXwMs.exe
  C:\Windows\System\qIcXwMs.exe
  2⤵
  PID:2612
- C:\Windows\System\xsMwoZx.exe
  C:\Windows\System\xsMwoZx.exe
  2⤵
  PID:3808
- C:\Windows\System\eJKShRt.exe
  C:\Windows\System\eJKShRt.exe
  2⤵
  PID:3688
- C:\Windows\System\aJnuCzP.exe
  C:\Windows\System\aJnuCzP.exe
  2⤵
  PID:3540
- C:\Windows\System\GOZiABQ.exe
  C:\Windows\System\GOZiABQ.exe
  2⤵
  PID:3992
- C:\Windows\System\WaVPjbr.exe
  C:\Windows\System\WaVPjbr.exe
  2⤵
  PID:2568
- C:\Windows\System\OibvDiQ.exe
  C:\Windows\System\OibvDiQ.exe
  2⤵
  PID:3180
- C:\Windows\System\mJFZhKp.exe
  C:\Windows\System\mJFZhKp.exe
  2⤵
  PID:3492
- C:\Windows\System\cfQnfiL.exe
  C:\Windows\System\cfQnfiL.exe
  2⤵
  PID:640
- C:\Windows\System\UgSFQhz.exe
  C:\Windows\System\UgSFQhz.exe
  2⤵
  PID:2148
- C:\Windows\System\FZnXTNt.exe
  C:\Windows\System\FZnXTNt.exe
  2⤵
  PID:3896
- C:\Windows\System\Pfhnmsq.exe
  C:\Windows\System\Pfhnmsq.exe
  2⤵
  PID:3132
- C:\Windows\System\DtPkSqw.exe
  C:\Windows\System\DtPkSqw.exe
  2⤵
  PID:3112
- C:\Windows\System\vQcvnfo.exe
  C:\Windows\System\vQcvnfo.exe
  2⤵
  PID:3584
- C:\Windows\System\VSiWjou.exe
  C:\Windows\System\VSiWjou.exe
  2⤵
  PID:1972
- C:\Windows\System\mpEDUcY.exe
  C:\Windows\System\mpEDUcY.exe
  2⤵
  PID:3700
- C:\Windows\System\pUZqHKU.exe
  C:\Windows\System\pUZqHKU.exe
  2⤵
  PID:3176
- C:\Windows\System\waPTHtv.exe
  C:\Windows\System\waPTHtv.exe
  2⤵
  PID:3848
- C:\Windows\System\agIAQCT.exe
  C:\Windows\System\agIAQCT.exe
  2⤵
  PID:3196
- C:\Windows\System\uxUsBOS.exe
  C:\Windows\System\uxUsBOS.exe
  2⤵
  PID:1108
- C:\Windows\System\ATxDImv.exe
  C:\Windows\System\ATxDImv.exe
  2⤵
  PID:3476
- C:\Windows\System\OLHDbiC.exe
  C:\Windows\System\OLHDbiC.exe
  2⤵
  PID:4024
- C:\Windows\System\iKhkZvx.exe
  C:\Windows\System\iKhkZvx.exe
  2⤵
  PID:3628
- C:\Windows\System\JBDOZzi.exe
  C:\Windows\System\JBDOZzi.exe
  2⤵
  PID:3640
- C:\Windows\System\IyryOOw.exe
  C:\Windows\System\IyryOOw.exe
  2⤵
  PID:860
- C:\Windows\System\GTJZCJd.exe
  C:\Windows\System\GTJZCJd.exe
  2⤵
  PID:3308
- C:\Windows\System\XggYZyO.exe
  C:\Windows\System\XggYZyO.exe
  2⤵
  PID:568
- C:\Windows\System\AjIDaho.exe
  C:\Windows\System\AjIDaho.exe
  2⤵
  PID:4108
- C:\Windows\System\mlKjeDF.exe
  C:\Windows\System\mlKjeDF.exe
  2⤵
  PID:4124
- C:\Windows\System\XQWVoyq.exe
  C:\Windows\System\XQWVoyq.exe
  2⤵
  PID:4140
- C:\Windows\System\IZsccKc.exe
  C:\Windows\System\IZsccKc.exe
  2⤵
  PID:4156
- C:\Windows\System\EQKmrgY.exe
  C:\Windows\System\EQKmrgY.exe
  2⤵
  PID:4172
- C:\Windows\System\tmUFGHn.exe
  C:\Windows\System\tmUFGHn.exe
  2⤵
  PID:4188
- C:\Windows\System\OSHgSJW.exe
  C:\Windows\System\OSHgSJW.exe
  2⤵
  PID:4208
- C:\Windows\System\XCgGMcR.exe
  C:\Windows\System\XCgGMcR.exe
  2⤵
  PID:4224
- C:\Windows\System\HngZHoZ.exe
  C:\Windows\System\HngZHoZ.exe
  2⤵
  PID:4240
- C:\Windows\System\gYLMjkz.exe
  C:\Windows\System\gYLMjkz.exe
  2⤵
  PID:4256
- C:\Windows\System\XwkfaCy.exe
  C:\Windows\System\XwkfaCy.exe
  2⤵
  PID:4272
- C:\Windows\System\WFkSKFs.exe
  C:\Windows\System\WFkSKFs.exe
  2⤵
  PID:4288
- C:\Windows\System\XZBdyOW.exe
  C:\Windows\System\XZBdyOW.exe
  2⤵
  PID:4304
- C:\Windows\System\KzaGfYi.exe
  C:\Windows\System\KzaGfYi.exe
  2⤵
  PID:4320
- C:\Windows\System\lOUxLeV.exe
  C:\Windows\System\lOUxLeV.exe
  2⤵
  PID:4336
- C:\Windows\System\xCqeBHw.exe
  C:\Windows\System\xCqeBHw.exe
  2⤵
  PID:4352
- C:\Windows\System\bXVIwpy.exe
  C:\Windows\System\bXVIwpy.exe
  2⤵
  PID:4368
- C:\Windows\System\ZNOlCWe.exe
  C:\Windows\System\ZNOlCWe.exe
  2⤵
  PID:4384
- C:\Windows\System\CTkhjLC.exe
  C:\Windows\System\CTkhjLC.exe
  2⤵
  PID:4400
- C:\Windows\System\NsLVsQx.exe
  C:\Windows\System\NsLVsQx.exe
  2⤵
  PID:4416
- C:\Windows\System\QcEKIvc.exe
  C:\Windows\System\QcEKIvc.exe
  2⤵
  PID:4432
- C:\Windows\System\bnzEBdW.exe
  C:\Windows\System\bnzEBdW.exe
  2⤵
  PID:4448
- C:\Windows\System\CKkwyuU.exe
  C:\Windows\System\CKkwyuU.exe
  2⤵
  PID:4464
- C:\Windows\System\LsqsIPV.exe
  C:\Windows\System\LsqsIPV.exe
  2⤵
  PID:4480
- C:\Windows\System\QboHvcl.exe
  C:\Windows\System\QboHvcl.exe
  2⤵
  PID:4496
- C:\Windows\System\pzmbzRg.exe
  C:\Windows\System\pzmbzRg.exe
  2⤵
  PID:4512
- C:\Windows\System\hnvqcWE.exe
  C:\Windows\System\hnvqcWE.exe
  2⤵
  PID:4528
- C:\Windows\System\SdwnYqc.exe
  C:\Windows\System\SdwnYqc.exe
  2⤵
  PID:4544
- C:\Windows\System\nlfTVGU.exe
  C:\Windows\System\nlfTVGU.exe
  2⤵
  PID:4564
- C:\Windows\System\eCjzKsA.exe
  C:\Windows\System\eCjzKsA.exe
  2⤵
  PID:4580
- C:\Windows\System\CIUMOdc.exe
  C:\Windows\System\CIUMOdc.exe
  2⤵
  PID:4600
- C:\Windows\System\zJjQHET.exe
  C:\Windows\System\zJjQHET.exe
  2⤵
  PID:4616
- C:\Windows\System\EIScBOs.exe
  C:\Windows\System\EIScBOs.exe
  2⤵
  PID:4632
- C:\Windows\System\OrvgwFD.exe
  C:\Windows\System\OrvgwFD.exe
  2⤵
  PID:4648
- C:\Windows\System\ckSKkbV.exe
  C:\Windows\System\ckSKkbV.exe
  2⤵
  PID:4664
- C:\Windows\System\xoYjejc.exe
  C:\Windows\System\xoYjejc.exe
  2⤵
  PID:4680
- C:\Windows\System\bFFAsMr.exe
  C:\Windows\System\bFFAsMr.exe
  2⤵
  PID:4696
- C:\Windows\System\MXUQaie.exe
  C:\Windows\System\MXUQaie.exe
  2⤵
  PID:4712
- C:\Windows\System\gLVytGf.exe
  C:\Windows\System\gLVytGf.exe
  2⤵
  PID:4728
- C:\Windows\System\sUtoDWI.exe
  C:\Windows\System\sUtoDWI.exe
  2⤵
  PID:4744
- C:\Windows\System\vHUMcau.exe
  C:\Windows\System\vHUMcau.exe
  2⤵
  PID:4760
- C:\Windows\System\JGwIApv.exe
  C:\Windows\System\JGwIApv.exe
  2⤵
  PID:4776
- C:\Windows\System\XGhMVsI.exe
  C:\Windows\System\XGhMVsI.exe
  2⤵
  PID:4792
- C:\Windows\System\BEfscjm.exe
  C:\Windows\System\BEfscjm.exe
  2⤵
  PID:4808
- C:\Windows\System\etSJDJH.exe
  C:\Windows\System\etSJDJH.exe
  2⤵
  PID:4824
- C:\Windows\System\hvQPgdr.exe
  C:\Windows\System\hvQPgdr.exe
  2⤵
  PID:4840
- C:\Windows\System\kdUpyrv.exe
  C:\Windows\System\kdUpyrv.exe
  2⤵
  PID:4856
- C:\Windows\System\nVEnyHl.exe
  C:\Windows\System\nVEnyHl.exe
  2⤵
  PID:4872
- C:\Windows\System\ItmikbT.exe
  C:\Windows\System\ItmikbT.exe
  2⤵
  PID:4888
- C:\Windows\System\YmqmYWh.exe
  C:\Windows\System\YmqmYWh.exe
  2⤵
  PID:4904
- C:\Windows\System\KEqoHoK.exe
  C:\Windows\System\KEqoHoK.exe
  2⤵
  PID:4920
- C:\Windows\System\jDJePnd.exe
  C:\Windows\System\jDJePnd.exe
  2⤵
  PID:4936
- C:\Windows\System\DVBNUJX.exe
  C:\Windows\System\DVBNUJX.exe
  2⤵
  PID:4952
- C:\Windows\System\AniZKnf.exe
  C:\Windows\System\AniZKnf.exe
  2⤵
  PID:4968
- C:\Windows\System\CHvlAyP.exe
  C:\Windows\System\CHvlAyP.exe
  2⤵
  PID:4984
- C:\Windows\System\nGmISBJ.exe
  C:\Windows\System\nGmISBJ.exe
  2⤵
  PID:5000
- C:\Windows\System\IOofTDV.exe
  C:\Windows\System\IOofTDV.exe
  2⤵
  PID:5016
- C:\Windows\System\cgsURlj.exe
  C:\Windows\System\cgsURlj.exe
  2⤵
  PID:5032
- C:\Windows\System\BBQdMPU.exe
  C:\Windows\System\BBQdMPU.exe
  2⤵
  PID:5048
- C:\Windows\System\qnSWXnk.exe
  C:\Windows\System\qnSWXnk.exe
  2⤵
  PID:5064
- C:\Windows\System\zUlaVbl.exe
  C:\Windows\System\zUlaVbl.exe
  2⤵
  PID:5080
- C:\Windows\System\YcZxnhy.exe
  C:\Windows\System\YcZxnhy.exe
  2⤵
  PID:5096
- C:\Windows\System\gAQszDs.exe
  C:\Windows\System\gAQszDs.exe
  2⤵
  PID:5112
- C:\Windows\System\kzvALpM.exe
  C:\Windows\System\kzvALpM.exe
  2⤵
  PID:3544
- C:\Windows\System\SZNEyzK.exe
  C:\Windows\System\SZNEyzK.exe
  2⤵
  PID:700
- C:\Windows\System\RIOiXgE.exe
  C:\Windows\System\RIOiXgE.exe
  2⤵
  PID:4168
- C:\Windows\System\uVhmFKw.exe
  C:\Windows\System\uVhmFKw.exe
  2⤵
  PID:4268
- C:\Windows\System\Khaxdzb.exe
  C:\Windows\System\Khaxdzb.exe
  2⤵
  PID:4236
- C:\Windows\System\VXgqeDi.exe
  C:\Windows\System\VXgqeDi.exe
  2⤵
  PID:4328
- C:\Windows\System\vWYIesV.exe
  C:\Windows\System\vWYIesV.exe
  2⤵
  PID:4396
- C:\Windows\System\SDfgMls.exe
  C:\Windows\System\SDfgMls.exe
  2⤵
  PID:4456
- C:\Windows\System\xBRlTrD.exe
  C:\Windows\System\xBRlTrD.exe
  2⤵
  PID:4560
- C:\Windows\System\nJizVdq.exe
  C:\Windows\System\nJizVdq.exe
  2⤵
  PID:4284
- C:\Windows\System\iMkaoNN.exe
  C:\Windows\System\iMkaoNN.exe
  2⤵
  PID:4152
- C:\Windows\System\qOkbwbA.exe
  C:\Windows\System\qOkbwbA.exe
  2⤵
  PID:4220
- C:\Windows\System\yoHQNwi.exe
  C:\Windows\System\yoHQNwi.exe
  2⤵
  PID:4588
- C:\Windows\System\BQLsSkk.exe
  C:\Windows\System\BQLsSkk.exe
  2⤵
  PID:4312
- C:\Windows\System\JnfGwwY.exe
  C:\Windows\System\JnfGwwY.exe
  2⤵
  PID:4380
- C:\Windows\System\zaPJdIM.exe
  C:\Windows\System\zaPJdIM.exe
  2⤵
  PID:4444
- C:\Windows\System\tIQBXxV.exe
  C:\Windows\System\tIQBXxV.exe
  2⤵
  PID:4536
- C:\Windows\System\VyRFgDD.exe
  C:\Windows\System\VyRFgDD.exe
  2⤵
  PID:4612
- C:\Windows\System\zphfYKQ.exe
  C:\Windows\System\zphfYKQ.exe
  2⤵
  PID:4660
- C:\Windows\System\McZjUVv.exe
  C:\Windows\System\McZjUVv.exe
  2⤵
  PID:4724
- C:\Windows\System\WBHivcC.exe
  C:\Windows\System\WBHivcC.exe
  2⤵
  PID:4676
- C:\Windows\System\hErtRtn.exe
  C:\Windows\System\hErtRtn.exe
  2⤵
  PID:4644
- C:\Windows\System\rrENbwm.exe
  C:\Windows\System\rrENbwm.exe
  2⤵
  PID:4740
- C:\Windows\System\xhXUVKt.exe
  C:\Windows\System\xhXUVKt.exe
  2⤵
  PID:4804
- C:\Windows\System\kOCZqbq.exe
  C:\Windows\System\kOCZqbq.exe
  2⤵
  PID:4896
- C:\Windows\System\EQGBJJa.exe
  C:\Windows\System\EQGBJJa.exe
  2⤵
  PID:4816
- C:\Windows\System\oIQBxqL.exe
  C:\Windows\System\oIQBxqL.exe
  2⤵
  PID:5024
- C:\Windows\System\SYMfAjE.exe
  C:\Windows\System\SYMfAjE.exe
  2⤵
  PID:4820
- C:\Windows\System\XBXbIwA.exe
  C:\Windows\System\XBXbIwA.exe
  2⤵
  PID:4916
- C:\Windows\System\imWvlGg.exe
  C:\Windows\System\imWvlGg.exe
  2⤵
  PID:4976
- C:\Windows\System\wrKSbrA.exe
  C:\Windows\System\wrKSbrA.exe
  2⤵
  PID:4852
- C:\Windows\System\ccdjDjl.exe
  C:\Windows\System\ccdjDjl.exe
  2⤵
  PID:5056
- C:\Windows\System\pOGfUCZ.exe
  C:\Windows\System\pOGfUCZ.exe
  2⤵
  PID:5072
- C:\Windows\System\XrinmKC.exe
  C:\Windows\System\XrinmKC.exe
  2⤵
  PID:4100
- C:\Windows\System\LBfuwFz.exe
  C:\Windows\System\LBfuwFz.exe
  2⤵
  PID:4136
- C:\Windows\System\cOXwPxv.exe
  C:\Windows\System\cOXwPxv.exe
  2⤵
  PID:4204
- C:\Windows\System\KMXoDgx.exe
  C:\Windows\System\KMXoDgx.exe
  2⤵
  PID:4556
- C:\Windows\System\fELVQVU.exe
  C:\Windows\System\fELVQVU.exe
  2⤵
  PID:2988
- C:\Windows\System\DFExLiM.exe
  C:\Windows\System\DFExLiM.exe
  2⤵
  PID:4316
- C:\Windows\System\tlpwRRx.exe
  C:\Windows\System\tlpwRRx.exe
  2⤵
  PID:4692
- C:\Windows\System\NDBNzSu.exe
  C:\Windows\System\NDBNzSu.exe
  2⤵
  PID:4960
- C:\Windows\System\igrtFXl.exe
  C:\Windows\System\igrtFXl.exe
  2⤵
  PID:4864
- C:\Windows\System\jeIAhAI.exe
  C:\Windows\System\jeIAhAI.exe
  2⤵
  PID:2732
- C:\Windows\System\ESFUNLj.exe
  C:\Windows\System\ESFUNLj.exe
  2⤵
  PID:3912
- C:\Windows\System\ONVYFJA.exe
  C:\Windows\System\ONVYFJA.exe
  2⤵
  PID:2376
- C:\Windows\System\NDcnPbH.exe
  C:\Windows\System\NDcnPbH.exe
  2⤵
  PID:4376
- C:\Windows\System\nbDDVhn.exe
  C:\Windows\System\nbDDVhn.exe
  2⤵
  PID:4912
- C:\Windows\System\WYMZwKM.exe
  C:\Windows\System\WYMZwKM.exe
  2⤵
  PID:4784
- C:\Windows\System\GeSUvMb.exe
  C:\Windows\System\GeSUvMb.exe
  2⤵
  PID:4752
- C:\Windows\System\WeZlVUw.exe
  C:\Windows\System\WeZlVUw.exe
  2⤵
  PID:4848
- C:\Windows\System\sQxXMRE.exe
  C:\Windows\System\sQxXMRE.exe
  2⤵
  PID:4132
- C:\Windows\System\NJVyMDO.exe
  C:\Windows\System\NJVyMDO.exe
  2⤵
  PID:4184
- C:\Windows\System\LHyzmEQ.exe
  C:\Windows\System\LHyzmEQ.exe
  2⤵
  PID:4884
- C:\Windows\System\ldWqpOx.exe
  C:\Windows\System\ldWqpOx.exe
  2⤵
  PID:1796
- C:\Windows\System\pEvZuBX.exe
  C:\Windows\System\pEvZuBX.exe
  2⤵
  PID:4608
- C:\Windows\System\efFjIxp.exe
  C:\Windows\System\efFjIxp.exe
  2⤵
  PID:4120
- C:\Windows\System\rQjapHx.exe
  C:\Windows\System\rQjapHx.exe
  2⤵
  PID:4932
- C:\Windows\System\PRMSlSY.exe
  C:\Windows\System\PRMSlSY.exe
  2⤵
  PID:4800
- C:\Windows\System\XyszMgN.exe
  C:\Windows\System\XyszMgN.exe
  2⤵
  PID:1492
- C:\Windows\System\MkdFSkt.exe
  C:\Windows\System\MkdFSkt.exe
  2⤵
  PID:4708
- C:\Windows\System\RoFVuvE.exe
  C:\Windows\System\RoFVuvE.exe
  2⤵
  PID:1436
- C:\Windows\System\hnpRLan.exe
  C:\Windows\System\hnpRLan.exe
  2⤵
  PID:5108
- C:\Windows\System\tUdYHdo.exe
  C:\Windows\System\tUdYHdo.exe
  2⤵
  PID:1476
- C:\Windows\System\UcyYslH.exe
  C:\Windows\System\UcyYslH.exe
  2⤵
  PID:4640
- C:\Windows\System\wWeWOXA.exe
  C:\Windows\System\wWeWOXA.exe
  2⤵
  PID:5012
- C:\Windows\System\mqBZBhN.exe
  C:\Windows\System\mqBZBhN.exe
  2⤵
  PID:2856
- C:\Windows\System\oBvDtYJ.exe
  C:\Windows\System\oBvDtYJ.exe
  2⤵
  PID:4280
- C:\Windows\System\SHkMNSx.exe
  C:\Windows\System\SHkMNSx.exe
  2⤵
  PID:2724
- C:\Windows\System\qcfHxxP.exe
  C:\Windows\System\qcfHxxP.exe
  2⤵
  PID:5268
- C:\Windows\System\xWIPjtW.exe
  C:\Windows\System\xWIPjtW.exe
  2⤵
  PID:5288
- C:\Windows\System\PqrkJag.exe
  C:\Windows\System\PqrkJag.exe
  2⤵
  PID:5312
- C:\Windows\System\UXeMTTi.exe
  C:\Windows\System\UXeMTTi.exe
  2⤵
  PID:5336
- C:\Windows\System\qNjrzco.exe
  C:\Windows\System\qNjrzco.exe
  2⤵
  PID:5380
- C:\Windows\System\MdDEKuo.exe
  C:\Windows\System\MdDEKuo.exe
  2⤵
  PID:5396
- C:\Windows\System\kFybXda.exe
  C:\Windows\System\kFybXda.exe
  2⤵
  PID:5412
- C:\Windows\System\JSsSPCw.exe
  C:\Windows\System\JSsSPCw.exe
  2⤵
  PID:5428
- C:\Windows\System\wrVTjVV.exe
  C:\Windows\System\wrVTjVV.exe
  2⤵
  PID:5444
- C:\Windows\System\jsRadam.exe
  C:\Windows\System\jsRadam.exe
  2⤵
  PID:5460
- C:\Windows\System\vLjyJJv.exe
  C:\Windows\System\vLjyJJv.exe
  2⤵
  PID:5476
- C:\Windows\System\YVoKaYv.exe
  C:\Windows\System\YVoKaYv.exe
  2⤵
  PID:5492
- C:\Windows\System\hcKpPFg.exe
  C:\Windows\System\hcKpPFg.exe
  2⤵
  PID:5508
- C:\Windows\System\sFwGDel.exe
  C:\Windows\System\sFwGDel.exe
  2⤵
  PID:5524
- C:\Windows\System\ONtCiVl.exe
  C:\Windows\System\ONtCiVl.exe
  2⤵
  PID:5540
- C:\Windows\System\fZffPOH.exe
  C:\Windows\System\fZffPOH.exe
  2⤵
  PID:5560
- C:\Windows\System\BlpyPSw.exe
  C:\Windows\System\BlpyPSw.exe
  2⤵
  PID:5576
- C:\Windows\System\SVXTnPs.exe
  C:\Windows\System\SVXTnPs.exe
  2⤵
  PID:5592
- C:\Windows\System\lqrfQlK.exe
  C:\Windows\System\lqrfQlK.exe
  2⤵
  PID:5608
- C:\Windows\System\CiloHAS.exe
  C:\Windows\System\CiloHAS.exe
  2⤵
  PID:5624
- C:\Windows\System\MZSYmXy.exe
  C:\Windows\System\MZSYmXy.exe
  2⤵
  PID:5640
- C:\Windows\System\SXuArMw.exe
  C:\Windows\System\SXuArMw.exe
  2⤵
  PID:5656
- C:\Windows\System\nCuqVio.exe
  C:\Windows\System\nCuqVio.exe
  2⤵
  PID:5676
- C:\Windows\System\zpGGuwC.exe
  C:\Windows\System\zpGGuwC.exe
  2⤵
  PID:5692
- C:\Windows\System\uHavUME.exe
  C:\Windows\System\uHavUME.exe
  2⤵
  PID:5708
- C:\Windows\System\iARtVkz.exe
  C:\Windows\System\iARtVkz.exe
  2⤵
  PID:5724
- C:\Windows\System\ozrOKLk.exe
  C:\Windows\System\ozrOKLk.exe
  2⤵
  PID:5740
- C:\Windows\System\OUQiTiW.exe
  C:\Windows\System\OUQiTiW.exe
  2⤵
  PID:5756
- C:\Windows\System\nQqJuHX.exe
  C:\Windows\System\nQqJuHX.exe
  2⤵
  PID:5772
- C:\Windows\System\EVJyjch.exe
  C:\Windows\System\EVJyjch.exe
  2⤵
  PID:5788
- C:\Windows\System\PMZaVpx.exe
  C:\Windows\System\PMZaVpx.exe
  2⤵
  PID:5804
- C:\Windows\System\XFRzzFP.exe
  C:\Windows\System\XFRzzFP.exe
  2⤵
  PID:5820
- C:\Windows\System\letefXT.exe
  C:\Windows\System\letefXT.exe
  2⤵
  PID:5836
- C:\Windows\System\PQJcaAk.exe
  C:\Windows\System\PQJcaAk.exe
  2⤵
  PID:5852
- C:\Windows\System\gWyTojE.exe
  C:\Windows\System\gWyTojE.exe
  2⤵
  PID:5868
- C:\Windows\System\vXfqtlD.exe
  C:\Windows\System\vXfqtlD.exe
  2⤵
  PID:5884
- C:\Windows\System\DrZYkZm.exe
  C:\Windows\System\DrZYkZm.exe
  2⤵
  PID:5900
- C:\Windows\System\yMxzCBt.exe
  C:\Windows\System\yMxzCBt.exe
  2⤵
  PID:5916
- C:\Windows\System\hcgGMlk.exe
  C:\Windows\System\hcgGMlk.exe
  2⤵
  PID:5932
- C:\Windows\System\NIqZnSR.exe
  C:\Windows\System\NIqZnSR.exe
  2⤵
  PID:5948
- C:\Windows\System\YtacRAo.exe
  C:\Windows\System\YtacRAo.exe
  2⤵
  PID:5964
- C:\Windows\System\xGXgMxy.exe
  C:\Windows\System\xGXgMxy.exe
  2⤵
  PID:5980
- C:\Windows\System\sKMjKjf.exe
  C:\Windows\System\sKMjKjf.exe
  2⤵
  PID:5996
- C:\Windows\System\FjXKpmy.exe
  C:\Windows\System\FjXKpmy.exe
  2⤵
  PID:6012
- C:\Windows\System\bltoaEw.exe
  C:\Windows\System\bltoaEw.exe
  2⤵
  PID:6028
- C:\Windows\System\GeTsyZm.exe
  C:\Windows\System\GeTsyZm.exe
  2⤵
  PID:6044
- C:\Windows\System\AnexCom.exe
  C:\Windows\System\AnexCom.exe
  2⤵
  PID:6060
- C:\Windows\System\zctUUOx.exe
  C:\Windows\System\zctUUOx.exe
  2⤵
  PID:6076
- C:\Windows\System\cyhEdKE.exe
  C:\Windows\System\cyhEdKE.exe
  2⤵
  PID:6092
- C:\Windows\System\auMYwRN.exe
  C:\Windows\System\auMYwRN.exe
  2⤵
  PID:6108
- C:\Windows\System\zJZAgsf.exe
  C:\Windows\System\zJZAgsf.exe
  2⤵
  PID:6124
- C:\Windows\System\gTOlsaH.exe
  C:\Windows\System\gTOlsaH.exe
  2⤵
  PID:6140
- C:\Windows\System\nUOiyro.exe
  C:\Windows\System\nUOiyro.exe
  2⤵
  PID:5184
- C:\Windows\System\nIBtfpZ.exe
  C:\Windows\System\nIBtfpZ.exe
  2⤵
  PID:5164
- C:\Windows\System\WFhpFVB.exe
  C:\Windows\System\WFhpFVB.exe
  2⤵
  PID:4628
- C:\Windows\System\bgDbrDE.exe
  C:\Windows\System\bgDbrDE.exe
  2⤵
  PID:4992
- C:\Windows\System\UMWHIVo.exe
  C:\Windows\System\UMWHIVo.exe
  2⤵
  PID:4252
- C:\Windows\System\acYaHQP.exe
  C:\Windows\System\acYaHQP.exe
  2⤵
  PID:5124
- C:\Windows\System\zMIzeqn.exe
  C:\Windows\System\zMIzeqn.exe
  2⤵
  PID:5148
- C:\Windows\System\iMKrgRr.exe
  C:\Windows\System\iMKrgRr.exe
  2⤵
  PID:5172
- C:\Windows\System\nzqivMO.exe
  C:\Windows\System\nzqivMO.exe
  2⤵
  PID:5200
- C:\Windows\System\cWvqMJE.exe
  C:\Windows\System\cWvqMJE.exe
  2⤵
  PID:5216
- C:\Windows\System\yGoyFUM.exe
  C:\Windows\System\yGoyFUM.exe
  2⤵
  PID:5232
- C:\Windows\System\dzMFdkl.exe
  C:\Windows\System\dzMFdkl.exe
  2⤵
  PID:5248
- C:\Windows\System\MqKhZAf.exe
  C:\Windows\System\MqKhZAf.exe
  2⤵
  PID:5264
- C:\Windows\System\pPcnlSt.exe
  C:\Windows\System\pPcnlSt.exe
  2⤵
  PID:5296
- C:\Windows\System\tlonwJo.exe
  C:\Windows\System\tlonwJo.exe
  2⤵
  PID:5320
- C:\Windows\System\jOLltph.exe
  C:\Windows\System\jOLltph.exe
  2⤵
  PID:5344
- C:\Windows\System\LiqDOlk.exe
  C:\Windows\System\LiqDOlk.exe
  2⤵
  PID:5424
- C:\Windows\System\zFbmuBu.exe
  C:\Windows\System\zFbmuBu.exe
  2⤵
  PID:5520
- C:\Windows\System\mDtnnxZ.exe
  C:\Windows\System\mDtnnxZ.exe
  2⤵
  PID:5456
- C:\Windows\System\MeqWzAE.exe
  C:\Windows\System\MeqWzAE.exe
  2⤵
  PID:5620
- C:\Windows\System\jVxlFfx.exe
  C:\Windows\System\jVxlFfx.exe
  2⤵
  PID:5684
- C:\Windows\System\wBkJYbq.exe
  C:\Windows\System\wBkJYbq.exe
  2⤵
  PID:5716
- C:\Windows\System\CddCFLJ.exe
  C:\Windows\System\CddCFLJ.exe
  2⤵
  PID:5812
- C:\Windows\System\afEGTRD.exe
  C:\Windows\System\afEGTRD.exe
  2⤵
  PID:5844
- C:\Windows\System\hNloYtD.exe
  C:\Windows\System\hNloYtD.exe
  2⤵
  PID:5876
- C:\Windows\System\FPNPSqz.exe
  C:\Windows\System\FPNPSqz.exe
  2⤵
  PID:5912
- C:\Windows\System\kvWsTPo.exe
  C:\Windows\System\kvWsTPo.exe
  2⤵
  PID:5360
- C:\Windows\System\JQhFXqN.exe
  C:\Windows\System\JQhFXqN.exe
  2⤵
  PID:5348
- C:\Windows\System\tsCLCYW.exe
  C:\Windows\System\tsCLCYW.exe
  2⤵
  PID:5976
- C:\Windows\System\LzHqHYM.exe
  C:\Windows\System\LzHqHYM.exe
  2⤵
  PID:5632
- C:\Windows\System\cJJMQiT.exe
  C:\Windows\System\cJJMQiT.exe
  2⤵
  PID:5368
- C:\Windows\System\pHpoBfR.exe
  C:\Windows\System\pHpoBfR.exe
  2⤵
  PID:5408
- C:\Windows\System\gprFwFA.exe
  C:\Windows\System\gprFwFA.exe
  2⤵
  PID:5536
- C:\Windows\System\CRxvYcb.exe
  C:\Windows\System\CRxvYcb.exe
  2⤵
  PID:5636
- C:\Windows\System\eSdZbFA.exe
  C:\Windows\System\eSdZbFA.exe
  2⤵
  PID:5704
- C:\Windows\System\UURzFLz.exe
  C:\Windows\System\UURzFLz.exe
  2⤵
  PID:5988
- C:\Windows\System\rsTIkMB.exe
  C:\Windows\System\rsTIkMB.exe
  2⤵
  PID:5892
- C:\Windows\System\xkyZkOh.exe
  C:\Windows\System\xkyZkOh.exe
  2⤵
  PID:5992
- C:\Windows\System\KqTpqZd.exe
  C:\Windows\System\KqTpqZd.exe
  2⤵
  PID:6068
- C:\Windows\System\bLNeXic.exe
  C:\Windows\System\bLNeXic.exe
  2⤵
  PID:6100
- C:\Windows\System\ZDGMakv.exe
  C:\Windows\System\ZDGMakv.exe
  2⤵
  PID:6084
- C:\Windows\System\Wbzlseh.exe
  C:\Windows\System\Wbzlseh.exe
  2⤵
  PID:6120
- C:\Windows\System\vkqIIwa.exe
  C:\Windows\System\vkqIIwa.exe
  2⤵
  PID:4656
- C:\Windows\System\exPNMVO.exe
  C:\Windows\System\exPNMVO.exe
  2⤵
  PID:5092
- C:\Windows\System\mIRATyS.exe
  C:\Windows\System\mIRATyS.exe
  2⤵
  PID:5128
- C:\Windows\System\zqDpdPS.exe
  C:\Windows\System\zqDpdPS.exe
  2⤵
  PID:5208
- C:\Windows\System\mqGsMxY.exe
  C:\Windows\System\mqGsMxY.exe
  2⤵
  PID:5224
- C:\Windows\System\fjEENmD.exe
  C:\Windows\System\fjEENmD.exe
  2⤵
  PID:5328
- C:\Windows\System\TpqEfDJ.exe
  C:\Windows\System\TpqEfDJ.exe
  2⤵
  PID:5588
- C:\Windows\System\McGxOFi.exe
  C:\Windows\System\McGxOFi.exe
  2⤵
  PID:5472
- C:\Windows\System\vXlCxam.exe
  C:\Windows\System\vXlCxam.exe
  2⤵
  PID:5604
- C:\Windows\System\uDQlPEN.exe
  C:\Windows\System\uDQlPEN.exe
  2⤵
  PID:5468
- C:\Windows\System\ENGRIxk.exe
  C:\Windows\System\ENGRIxk.exe
  2⤵
  PID:5600
- C:\Windows\System\slmWudT.exe
  C:\Windows\System\slmWudT.exe
  2⤵
  PID:5928
- C:\Windows\System\BEMkiSt.exe
  C:\Windows\System\BEMkiSt.exe
  2⤵
  PID:5944
- C:\Windows\System\elEeOsM.exe
  C:\Windows\System\elEeOsM.exe
  2⤵
  PID:2684
- C:\Windows\System\poEmeYc.exe
  C:\Windows\System\poEmeYc.exe
  2⤵
  PID:5260
- C:\Windows\System\caDrvcF.exe
  C:\Windows\System\caDrvcF.exe
  2⤵
  PID:6088
- C:\Windows\System\MLmGlNH.exe
  C:\Windows\System\MLmGlNH.exe
  2⤵
  PID:5556
- C:\Windows\System\QTKLlnm.exe
  C:\Windows\System\QTKLlnm.exe
  2⤵
  PID:5504
- C:\Windows\System\rdwZUZR.exe
  C:\Windows\System\rdwZUZR.exe
  2⤵
  PID:5356
- C:\Windows\System\qVHhJQA.exe
  C:\Windows\System\qVHhJQA.exe
  2⤵
  PID:5864
- C:\Windows\System\LluQPoF.exe
  C:\Windows\System\LluQPoF.exe
  2⤵
  PID:4440
- C:\Windows\System\QpZXUbh.exe
  C:\Windows\System\QpZXUbh.exe
  2⤵
  PID:4572
- C:\Windows\System\vhBklzu.exe
  C:\Windows\System\vhBklzu.exe
  2⤵
  PID:5168
- C:\Windows\System\paCwcBW.exe
  C:\Windows\System\paCwcBW.exe
  2⤵
  PID:5516
- C:\Windows\System\cdaNzCs.exe
  C:\Windows\System\cdaNzCs.exe
  2⤵
  PID:5280
- C:\Windows\System\yRuvcGO.exe
  C:\Windows\System\yRuvcGO.exe
  2⤵
  PID:5924
- C:\Windows\System\mDzCpYB.exe
  C:\Windows\System\mDzCpYB.exe
  2⤵
  PID:5228
- C:\Windows\System\beRlURq.exe
  C:\Windows\System\beRlURq.exe
  2⤵
  PID:5204
- C:\Windows\System\sqJXhUW.exe
  C:\Windows\System\sqJXhUW.exe
  2⤵
  PID:5532
- C:\Windows\System\xSZjwtj.exe
  C:\Windows\System\xSZjwtj.exe
  2⤵
  PID:5552
- C:\Windows\System\DQaVlEc.exe
  C:\Windows\System\DQaVlEc.exe
  2⤵
  PID:5732
- C:\Windows\System\zdRHXes.exe
  C:\Windows\System\zdRHXes.exe
  2⤵
  PID:5324
- C:\Windows\System\LxbsTWD.exe
  C:\Windows\System\LxbsTWD.exe
  2⤵
  PID:5796
- C:\Windows\System\bAxAAdj.exe
  C:\Windows\System\bAxAAdj.exe
  2⤵
  PID:2852
- C:\Windows\System\zbQHlQg.exe
  C:\Windows\System\zbQHlQg.exe
  2⤵
  PID:6136
- C:\Windows\System\hVJGdjj.exe
  C:\Windows\System\hVJGdjj.exe
  2⤵
  PID:6160
- C:\Windows\System\kLQDCJw.exe
  C:\Windows\System\kLQDCJw.exe
  2⤵
  PID:6176
- C:\Windows\System\oUAtjFJ.exe
  C:\Windows\System\oUAtjFJ.exe
  2⤵
  PID:6192
- C:\Windows\System\nAdNWgK.exe
  C:\Windows\System\nAdNWgK.exe
  2⤵
  PID:6208
- C:\Windows\System\bcFUaVV.exe
  C:\Windows\System\bcFUaVV.exe
  2⤵
  PID:6224
- C:\Windows\System\fnAkEzD.exe
  C:\Windows\System\fnAkEzD.exe
  2⤵
  PID:6240
- C:\Windows\System\igctWmF.exe
  C:\Windows\System\igctWmF.exe
  2⤵
  PID:6256
- C:\Windows\System\EyYACip.exe
  C:\Windows\System\EyYACip.exe
  2⤵
  PID:6272
- C:\Windows\System\BHwLSPB.exe
  C:\Windows\System\BHwLSPB.exe
  2⤵
  PID:6288
- C:\Windows\System\CmSfxfl.exe
  C:\Windows\System\CmSfxfl.exe
  2⤵
  PID:6304
- C:\Windows\System\ucfHEjo.exe
  C:\Windows\System\ucfHEjo.exe
  2⤵
  PID:6320
- C:\Windows\System\snlNPQw.exe
  C:\Windows\System\snlNPQw.exe
  2⤵
  PID:6336
- C:\Windows\System\jnpMQPm.exe
  C:\Windows\System\jnpMQPm.exe
  2⤵
  PID:6352
- C:\Windows\System\hFrYxUW.exe
  C:\Windows\System\hFrYxUW.exe
  2⤵
  PID:6368
- C:\Windows\System\uUQxFxW.exe
  C:\Windows\System\uUQxFxW.exe
  2⤵
  PID:6384
- C:\Windows\System\Hqmglfh.exe
  C:\Windows\System\Hqmglfh.exe
  2⤵
  PID:6400
- C:\Windows\System\MiosBUm.exe
  C:\Windows\System\MiosBUm.exe
  2⤵
  PID:6416
- C:\Windows\System\YHiGtpE.exe
  C:\Windows\System\YHiGtpE.exe
  2⤵
  PID:6432
- C:\Windows\System\BfkFqHM.exe
  C:\Windows\System\BfkFqHM.exe
  2⤵
  PID:6448
- C:\Windows\System\rKYsEmd.exe
  C:\Windows\System\rKYsEmd.exe
  2⤵
  PID:6464
- C:\Windows\System\bPrWKRa.exe
  C:\Windows\System\bPrWKRa.exe
  2⤵
  PID:6480
- C:\Windows\System\YLYKesL.exe
  C:\Windows\System\YLYKesL.exe
  2⤵
  PID:6496
- C:\Windows\System\cAwnOdi.exe
  C:\Windows\System\cAwnOdi.exe
  2⤵
  PID:6512
- C:\Windows\System\RNepvFu.exe
  C:\Windows\System\RNepvFu.exe
  2⤵
  PID:6528
- C:\Windows\System\scenDCC.exe
  C:\Windows\System\scenDCC.exe
  2⤵
  PID:6544
- C:\Windows\System\RAusFfD.exe
  C:\Windows\System\RAusFfD.exe
  2⤵
  PID:6560
- C:\Windows\System\tNaVfLD.exe
  C:\Windows\System\tNaVfLD.exe
  2⤵
  PID:6576
- C:\Windows\System\iHCNfXx.exe
  C:\Windows\System\iHCNfXx.exe
  2⤵
  PID:6592
- C:\Windows\System\OYwNMRd.exe
  C:\Windows\System\OYwNMRd.exe
  2⤵
  PID:6612
- C:\Windows\System\nFVxFCi.exe
  C:\Windows\System\nFVxFCi.exe
  2⤵
  PID:6628
- C:\Windows\System\UCyFDUD.exe
  C:\Windows\System\UCyFDUD.exe
  2⤵
  PID:6648
- C:\Windows\System\wVlCrTh.exe
  C:\Windows\System\wVlCrTh.exe
  2⤵
  PID:6664
- C:\Windows\System\WoWQKBH.exe
  C:\Windows\System\WoWQKBH.exe
  2⤵
  PID:6680
- C:\Windows\System\eSxKJcY.exe
  C:\Windows\System\eSxKJcY.exe
  2⤵
  PID:6696
- C:\Windows\System\trHrlEz.exe
  C:\Windows\System\trHrlEz.exe
  2⤵
  PID:6712
- C:\Windows\System\LLnTwJz.exe
  C:\Windows\System\LLnTwJz.exe
  2⤵
  PID:6728
- C:\Windows\System\XqWomVo.exe
  C:\Windows\System\XqWomVo.exe
  2⤵
  PID:6744
- C:\Windows\System\YfnYobn.exe
  C:\Windows\System\YfnYobn.exe
  2⤵
  PID:6760
- C:\Windows\System\WLefwlM.exe
  C:\Windows\System\WLefwlM.exe
  2⤵
  PID:6776
- C:\Windows\System\CXcePTA.exe
  C:\Windows\System\CXcePTA.exe
  2⤵
  PID:6792
- C:\Windows\System\KOqPjoX.exe
  C:\Windows\System\KOqPjoX.exe
  2⤵
  PID:6808
- C:\Windows\System\ptegKCj.exe
  C:\Windows\System\ptegKCj.exe
  2⤵
  PID:6824
- C:\Windows\System\xhUfbGX.exe
  C:\Windows\System\xhUfbGX.exe
  2⤵
  PID:6840
- C:\Windows\System\uJMSnWm.exe
  C:\Windows\System\uJMSnWm.exe
  2⤵
  PID:6856
- C:\Windows\System\XIaenYA.exe
  C:\Windows\System\XIaenYA.exe
  2⤵
  PID:6872
- C:\Windows\System\HhAVaSm.exe
  C:\Windows\System\HhAVaSm.exe
  2⤵
  PID:6888
- C:\Windows\System\KTfULUf.exe
  C:\Windows\System\KTfULUf.exe
  2⤵
  PID:6904
- C:\Windows\System\Eisibpm.exe
  C:\Windows\System\Eisibpm.exe
  2⤵
  PID:6920
- C:\Windows\System\HFqYvVF.exe
  C:\Windows\System\HFqYvVF.exe
  2⤵
  PID:6936
- C:\Windows\System\INqcBVO.exe
  C:\Windows\System\INqcBVO.exe
  2⤵
  PID:6952
- C:\Windows\System\lGrarxw.exe
  C:\Windows\System\lGrarxw.exe
  2⤵
  PID:6968
- C:\Windows\System\mDpxlCW.exe
  C:\Windows\System\mDpxlCW.exe
  2⤵
  PID:6984
- C:\Windows\System\pvRHBfH.exe
  C:\Windows\System\pvRHBfH.exe
  2⤵
  PID:7000
- C:\Windows\System\aaQvrWy.exe
  C:\Windows\System\aaQvrWy.exe
  2⤵
  PID:7016
- C:\Windows\System\sAleIcX.exe
  C:\Windows\System\sAleIcX.exe
  2⤵
  PID:7032
- C:\Windows\System\ZWJZyoP.exe
  C:\Windows\System\ZWJZyoP.exe
  2⤵
  PID:7048
- C:\Windows\System\jxufzRw.exe
  C:\Windows\System\jxufzRw.exe
  2⤵
  PID:7064
- C:\Windows\System\tolCQHv.exe
  C:\Windows\System\tolCQHv.exe
  2⤵
  PID:7080
- C:\Windows\System\SgnyQHY.exe
  C:\Windows\System\SgnyQHY.exe
  2⤵
  PID:7096
- C:\Windows\System\hzfdWHc.exe
  C:\Windows\System\hzfdWHc.exe
  2⤵
  PID:7112
- C:\Windows\System\EjItNwY.exe
  C:\Windows\System\EjItNwY.exe
  2⤵
  PID:7128
- C:\Windows\System\BkRLGAI.exe
  C:\Windows\System\BkRLGAI.exe
  2⤵
  PID:7144
- C:\Windows\System\uFqkwuD.exe
  C:\Windows\System\uFqkwuD.exe
  2⤵
  PID:7160
- C:\Windows\System\FAgtQSt.exe
  C:\Windows\System\FAgtQSt.exe
  2⤵
  PID:6184
- C:\Windows\System\QQOufqz.exe
  C:\Windows\System\QQOufqz.exe
  2⤵
  PID:6248
- C:\Windows\System\hEnfAvR.exe
  C:\Windows\System\hEnfAvR.exe
  2⤵
  PID:6312
- C:\Windows\System\iJWdgdB.exe
  C:\Windows\System\iJWdgdB.exe
  2⤵
  PID:6376
- C:\Windows\System\TXddDPX.exe
  C:\Windows\System\TXddDPX.exe
  2⤵
  PID:6440
- C:\Windows\System\CmNrSOp.exe
  C:\Windows\System\CmNrSOp.exe
  2⤵
  PID:6168
- C:\Windows\System\sfMXLxk.exe
  C:\Windows\System\sfMXLxk.exe
  2⤵
  PID:6204
- C:\Windows\System\IiSqarS.exe
  C:\Windows\System\IiSqarS.exe
  2⤵
  PID:6296
- C:\Windows\System\GauHDym.exe
  C:\Windows\System\GauHDym.exe
  2⤵
  PID:5584
- C:\Windows\System\lrgzBae.exe
  C:\Windows\System\lrgzBae.exe
  2⤵
  PID:5500
- C:\Windows\System\BvunJbl.exe
  C:\Windows\System\BvunJbl.exe
  2⤵
  PID:5420
- C:\Windows\System\zoMHZqx.exe
  C:\Windows\System\zoMHZqx.exe
  2⤵
  PID:6424
- C:\Windows\System\XqZoXKP.exe
  C:\Windows\System\XqZoXKP.exe
  2⤵
  PID:6456
- C:\Windows\System\fcLmqti.exe
  C:\Windows\System\fcLmqti.exe
  2⤵
  PID:6540
- C:\Windows\System\qBxWxsj.exe
  C:\Windows\System\qBxWxsj.exe
  2⤵
  PID:6072
- C:\Windows\System\TdLXIgl.exe
  C:\Windows\System\TdLXIgl.exe
  2⤵
  PID:2936
- C:\Windows\System\WvQtzEt.exe
  C:\Windows\System\WvQtzEt.exe
  2⤵
  PID:6600
- C:\Windows\System\geZgsDj.exe
  C:\Windows\System\geZgsDj.exe
  2⤵
  PID:6672
- C:\Windows\System\ODtAUpu.exe
  C:\Windows\System\ODtAUpu.exe
  2⤵
  PID:6524
- C:\Windows\System\vaVlvcj.exe
  C:\Windows\System\vaVlvcj.exe
  2⤵
  PID:6584
- C:\Windows\System\OtOeEPl.exe
  C:\Windows\System\OtOeEPl.exe
  2⤵
  PID:6704
- C:\Windows\System\RMYGKfu.exe
  C:\Windows\System\RMYGKfu.exe
  2⤵
  PID:6692
- C:\Windows\System\SoNQOZg.exe
  C:\Windows\System\SoNQOZg.exe
  2⤵
  PID:6752
- C:\Windows\System\kBbgIzg.exe
  C:\Windows\System\kBbgIzg.exe
  2⤵
  PID:6804
- C:\Windows\System\hxwCSEs.exe
  C:\Windows\System\hxwCSEs.exe
  2⤵
  PID:6784
- C:\Windows\System\SeYvhyx.exe
  C:\Windows\System\SeYvhyx.exe
  2⤵
  PID:6852
- C:\Windows\System\FqXsfrJ.exe
  C:\Windows\System\FqXsfrJ.exe
  2⤵
  PID:6868
- C:\Windows\System\VGJhnqa.exe
  C:\Windows\System\VGJhnqa.exe
  2⤵
  PID:6916
- C:\Windows\System\aIwJamD.exe
  C:\Windows\System\aIwJamD.exe
  2⤵
  PID:6932
- C:\Windows\System\TszoQqJ.exe
  C:\Windows\System\TszoQqJ.exe
  2⤵
  PID:6996
- C:\Windows\System\uXMzPTo.exe
  C:\Windows\System\uXMzPTo.exe
  2⤵
  PID:6980
- C:\Windows\System\DZJPQCT.exe
  C:\Windows\System\DZJPQCT.exe
  2⤵
  PID:7044
- C:\Windows\System\gBKYutV.exe
  C:\Windows\System\gBKYutV.exe
  2⤵
  PID:7056
- C:\Windows\System\poaCYOX.exe
  C:\Windows\System\poaCYOX.exe
  2⤵
  PID:7076
- C:\Windows\System\UYDgAwS.exe
  C:\Windows\System\UYDgAwS.exe
  2⤵
  PID:7108
- C:\Windows\System\EGtxcko.exe
  C:\Windows\System\EGtxcko.exe
  2⤵
  PID:2404
- C:\Windows\System\rfqQqlT.exe
  C:\Windows\System\rfqQqlT.exe
  2⤵
  PID:6348
- C:\Windows\System\gXsiybW.exe
  C:\Windows\System\gXsiybW.exe
  2⤵
  PID:5572
- C:\Windows\System\lMhBkmT.exe
  C:\Windows\System\lMhBkmT.exe
  2⤵
  PID:6536
- C:\Windows\System\aplKvKO.exe
  C:\Windows\System\aplKvKO.exe
  2⤵
  PID:6284
- C:\Windows\System\dZZDWBB.exe
  C:\Windows\System\dZZDWBB.exe
  2⤵
  PID:6360
- C:\Windows\System\sIzmRHm.exe
  C:\Windows\System\sIzmRHm.exe
  2⤵
  PID:6328
- C:\Windows\System\GRjhKTR.exe
  C:\Windows\System\GRjhKTR.exe
  2⤵
  PID:6688
- C:\Windows\System\JhXAvum.exe
  C:\Windows\System\JhXAvum.exe
  2⤵
  PID:6768
- C:\Windows\System\SmcYrnn.exe
  C:\Windows\System\SmcYrnn.exe
  2⤵
  PID:6364
- C:\Windows\System\MCYmjoU.exe
  C:\Windows\System\MCYmjoU.exe
  2⤵
  PID:6816
- C:\Windows\System\CDyOhiw.exe
  C:\Windows\System\CDyOhiw.exe
  2⤵
  PID:6552
- C:\Windows\System\LdEfvYB.exe
  C:\Windows\System\LdEfvYB.exe
  2⤵
  PID:6912
- C:\Windows\System\SHEvJKU.exe
  C:\Windows\System\SHEvJKU.exe
  2⤵
  PID:6832
- C:\Windows\System\fymYPOy.exe
  C:\Windows\System\fymYPOy.exe
  2⤵
  PID:7040
- C:\Windows\System\HTVrLwt.exe
  C:\Windows\System\HTVrLwt.exe
  2⤵
  PID:6492
- C:\Windows\System\jTEcaRQ.exe
  C:\Windows\System\jTEcaRQ.exe
  2⤵
  PID:6928
- C:\Windows\System\datXXcV.exe
  C:\Windows\System\datXXcV.exe
  2⤵
  PID:7088
- C:\Windows\System\nATySqV.exe
  C:\Windows\System\nATySqV.exe
  2⤵
  PID:7092
- C:\Windows\System\ElDjkxn.exe
  C:\Windows\System\ElDjkxn.exe
  2⤵
  PID:6020
- C:\Windows\System\xvZaNxq.exe
  C:\Windows\System\xvZaNxq.exe
  2⤵
  PID:6604
- C:\Windows\System\qDfjzxd.exe
  C:\Windows\System\qDfjzxd.exe
  2⤵
  PID:6736
- C:\Windows\System\jKYindk.exe
  C:\Windows\System\jKYindk.exe
  2⤵
  PID:6408
- C:\Windows\System\RZciirT.exe
  C:\Windows\System\RZciirT.exe
  2⤵
  PID:5212
- C:\Windows\System\NdPSbuq.exe
  C:\Windows\System\NdPSbuq.exe
  2⤵
  PID:6396
- C:\Windows\System\ArhkLla.exe
  C:\Windows\System\ArhkLla.exe
  2⤵
  PID:6520
- C:\Windows\System\yBnKPfV.exe
  C:\Windows\System\yBnKPfV.exe
  2⤵
  PID:6656
- C:\Windows\System\iJlZPEP.exe
  C:\Windows\System\iJlZPEP.exe
  2⤵
  PID:6976
- C:\Windows\System\nIMrpuD.exe
  C:\Windows\System\nIMrpuD.exe
  2⤵
  PID:6572
- C:\Windows\System\rHnLPEX.exe
  C:\Windows\System\rHnLPEX.exe
  2⤵
  PID:6156
- C:\Windows\System\eUkMWgO.exe
  C:\Windows\System\eUkMWgO.exe
  2⤵
  PID:6392
- C:\Windows\System\zYgbeeC.exe
  C:\Windows\System\zYgbeeC.exe
  2⤵
  PID:7152
- C:\Windows\System\eVsWZvy.exe
  C:\Windows\System\eVsWZvy.exe
  2⤵
  PID:5308
- C:\Windows\System\ngdTSlf.exe
  C:\Windows\System\ngdTSlf.exe
  2⤵
  PID:6268
- C:\Windows\System\yftRCYd.exe
  C:\Windows\System\yftRCYd.exe
  2⤵
  PID:7176
- C:\Windows\System\ZtJZwSL.exe
  C:\Windows\System\ZtJZwSL.exe
  2⤵
  PID:7192
- C:\Windows\System\OGxxPLB.exe
  C:\Windows\System\OGxxPLB.exe
  2⤵
  PID:7208
- C:\Windows\System\OJqmIEL.exe
  C:\Windows\System\OJqmIEL.exe
  2⤵
  PID:7224
- C:\Windows\System\lvZgKkK.exe
  C:\Windows\System\lvZgKkK.exe
  2⤵
  PID:7240
- C:\Windows\System\FnEcABO.exe
  C:\Windows\System\FnEcABO.exe
  2⤵
  PID:7256
- C:\Windows\System\OMMwRmv.exe
  C:\Windows\System\OMMwRmv.exe
  2⤵
  PID:7272
- C:\Windows\System\ZmihBXJ.exe
  C:\Windows\System\ZmihBXJ.exe
  2⤵
  PID:7288
- C:\Windows\System\JbgLIpS.exe
  C:\Windows\System\JbgLIpS.exe
  2⤵
  PID:7304
- C:\Windows\System\HyrSOQG.exe
  C:\Windows\System\HyrSOQG.exe
  2⤵
  PID:7320
- C:\Windows\System\MznYltz.exe
  C:\Windows\System\MznYltz.exe
  2⤵
  PID:7336
- C:\Windows\System\jTVKBep.exe
  C:\Windows\System\jTVKBep.exe
  2⤵
  PID:7352
- C:\Windows\System\PYYewKK.exe
  C:\Windows\System\PYYewKK.exe
  2⤵
  PID:7368
- C:\Windows\System\yPvWwOR.exe
  C:\Windows\System\yPvWwOR.exe
  2⤵
  PID:7384
- C:\Windows\System\yApOwWj.exe
  C:\Windows\System\yApOwWj.exe
  2⤵
  PID:7400
- C:\Windows\System\VRlmfbz.exe
  C:\Windows\System\VRlmfbz.exe
  2⤵
  PID:7416
- C:\Windows\System\hzrRTrS.exe
  C:\Windows\System\hzrRTrS.exe
  2⤵
  PID:7432
- C:\Windows\System\ozBahKs.exe
  C:\Windows\System\ozBahKs.exe
  2⤵
  PID:7448
- C:\Windows\System\brEEMLJ.exe
  C:\Windows\System\brEEMLJ.exe
  2⤵
  PID:7464
- C:\Windows\System\HItGZfX.exe
  C:\Windows\System\HItGZfX.exe
  2⤵
  PID:7480
- C:\Windows\System\sVqikxe.exe
  C:\Windows\System\sVqikxe.exe
  2⤵
  PID:7496
- C:\Windows\System\cSToxow.exe
  C:\Windows\System\cSToxow.exe
  2⤵
  PID:7512
- C:\Windows\System\GTudCle.exe
  C:\Windows\System\GTudCle.exe
  2⤵
  PID:7528
- C:\Windows\System\TfSOKcu.exe
  C:\Windows\System\TfSOKcu.exe
  2⤵
  PID:7544
- C:\Windows\System\fTwMIUr.exe
  C:\Windows\System\fTwMIUr.exe
  2⤵
  PID:7564
- C:\Windows\System\kSLYDTd.exe
  C:\Windows\System\kSLYDTd.exe
  2⤵
  PID:7580
- C:\Windows\System\kMdjHIq.exe
  C:\Windows\System\kMdjHIq.exe
  2⤵
  PID:7596
- C:\Windows\System\OYXWpgR.exe
  C:\Windows\System\OYXWpgR.exe
  2⤵
  PID:7612
- C:\Windows\System\oBepsqp.exe
  C:\Windows\System\oBepsqp.exe
  2⤵
  PID:7628
- C:\Windows\System\HmcaQhr.exe
  C:\Windows\System\HmcaQhr.exe
  2⤵
  PID:7644
- C:\Windows\System\tACQGQl.exe
  C:\Windows\System\tACQGQl.exe
  2⤵
  PID:7660
- C:\Windows\System\bMAcyYm.exe
  C:\Windows\System\bMAcyYm.exe
  2⤵
  PID:7676
- C:\Windows\System\jgpIhtE.exe
  C:\Windows\System\jgpIhtE.exe
  2⤵
  PID:7692
- C:\Windows\System\hWcjNwC.exe
  C:\Windows\System\hWcjNwC.exe
  2⤵
  PID:7708
- C:\Windows\System\ljcAHVq.exe
  C:\Windows\System\ljcAHVq.exe
  2⤵
  PID:7724
- C:\Windows\System\SdBMtJv.exe
  C:\Windows\System\SdBMtJv.exe
  2⤵
  PID:7740
- C:\Windows\System\qPcbQJn.exe
  C:\Windows\System\qPcbQJn.exe
  2⤵
  PID:7756
- C:\Windows\System\hgeKdRs.exe
  C:\Windows\System\hgeKdRs.exe
  2⤵
  PID:7772
- C:\Windows\System\DcIAnbS.exe
  C:\Windows\System\DcIAnbS.exe
  2⤵
  PID:7788
- C:\Windows\System\PdtIYEe.exe
  C:\Windows\System\PdtIYEe.exe
  2⤵
  PID:7804
- C:\Windows\System\HaYeOys.exe
  C:\Windows\System\HaYeOys.exe
  2⤵
  PID:7820
- C:\Windows\System\xvJNJZs.exe
  C:\Windows\System\xvJNJZs.exe
  2⤵
  PID:7836
- C:\Windows\System\rMfVhPL.exe
  C:\Windows\System\rMfVhPL.exe
  2⤵
  PID:7852
- C:\Windows\System\evecncf.exe
  C:\Windows\System\evecncf.exe
  2⤵
  PID:7868
- C:\Windows\System\ekSTAyV.exe
  C:\Windows\System\ekSTAyV.exe
  2⤵
  PID:7884
- C:\Windows\System\cMKsAHM.exe
  C:\Windows\System\cMKsAHM.exe
  2⤵
  PID:7900
- C:\Windows\System\AjHHBCp.exe
  C:\Windows\System\AjHHBCp.exe
  2⤵
  PID:7916
- C:\Windows\System\XqCUuiX.exe
  C:\Windows\System\XqCUuiX.exe
  2⤵
  PID:7932
- C:\Windows\System\iHHmeuk.exe
  C:\Windows\System\iHHmeuk.exe
  2⤵
  PID:7948
- C:\Windows\System\hEGRDXG.exe
  C:\Windows\System\hEGRDXG.exe
  2⤵
  PID:7964
- C:\Windows\System\fAepIpM.exe
  C:\Windows\System\fAepIpM.exe
  2⤵
  PID:7980
- C:\Windows\System\obHmojw.exe
  C:\Windows\System\obHmojw.exe
  2⤵
  PID:7996
- C:\Windows\System\XLqDpvb.exe
  C:\Windows\System\XLqDpvb.exe
  2⤵
  PID:8012
- C:\Windows\System\iZFGkop.exe
  C:\Windows\System\iZFGkop.exe
  2⤵
  PID:8028
- C:\Windows\System\FReeqiQ.exe
  C:\Windows\System\FReeqiQ.exe
  2⤵
  PID:8044
- C:\Windows\System\eoPNvHr.exe
  C:\Windows\System\eoPNvHr.exe
  2⤵
  PID:8060
- C:\Windows\System\edvogsj.exe
  C:\Windows\System\edvogsj.exe
  2⤵
  PID:8076
- C:\Windows\System\GTlgikl.exe
  C:\Windows\System\GTlgikl.exe
  2⤵
  PID:8092
- C:\Windows\System\tsKEsMJ.exe
  C:\Windows\System\tsKEsMJ.exe
  2⤵
  PID:8108
- C:\Windows\System\syJVOAS.exe
  C:\Windows\System\syJVOAS.exe
  2⤵
  PID:8124
- C:\Windows\System\pBnlTqY.exe
  C:\Windows\System\pBnlTqY.exe
  2⤵
  PID:8140
- C:\Windows\System\nfwfXRl.exe
  C:\Windows\System\nfwfXRl.exe
  2⤵
  PID:8156
- C:\Windows\System\UFfCFKg.exe
  C:\Windows\System\UFfCFKg.exe
  2⤵
  PID:8172
- C:\Windows\System\HZHzjWN.exe
  C:\Windows\System\HZHzjWN.exe
  2⤵
  PID:8188
- C:\Windows\System\vbPbhLO.exe
  C:\Windows\System\vbPbhLO.exe
  2⤵
  PID:6992
- C:\Windows\System\lMCQzBo.exe
  C:\Windows\System\lMCQzBo.exe
  2⤵
  PID:7232
- C:\Windows\System\TPRauxO.exe
  C:\Windows\System\TPRauxO.exe
  2⤵
  PID:7184
- C:\Windows\System\gjxVpuh.exe
  C:\Windows\System\gjxVpuh.exe
  2⤵
  PID:7172
- C:\Windows\System\UlnEgFl.exe
  C:\Windows\System\UlnEgFl.exe
  2⤵
  PID:7220
- C:\Windows\System\SKJlXnQ.exe
  C:\Windows\System\SKJlXnQ.exe
  2⤵
  PID:7348
- C:\Windows\System\rbKRRbV.exe
  C:\Windows\System\rbKRRbV.exe
  2⤵
  PID:7252
- C:\Windows\System\XIrEhbW.exe
  C:\Windows\System\XIrEhbW.exe
  2⤵
  PID:7316
- C:\Windows\System\JlnRxtX.exe
  C:\Windows\System\JlnRxtX.exe
  2⤵
  PID:7364
- C:\Windows\System\skbsBKQ.exe
  C:\Windows\System\skbsBKQ.exe
  2⤵
  PID:7440
- C:\Windows\System\wPMDMmI.exe
  C:\Windows\System\wPMDMmI.exe
  2⤵
  PID:7460
- C:\Windows\System\ySUceNi.exe
  C:\Windows\System\ySUceNi.exe
  2⤵
  PID:6476
- C:\Windows\System\HOmGTfc.exe
  C:\Windows\System\HOmGTfc.exe
  2⤵
  PID:7588
- C:\Windows\System\QSTUvcg.exe
  C:\Windows\System\QSTUvcg.exe
  2⤵
  PID:7652
- C:\Windows\System\LaUbNxU.exe
  C:\Windows\System\LaUbNxU.exe
  2⤵
  PID:7572
- C:\Windows\System\bdkrPaw.exe
  C:\Windows\System\bdkrPaw.exe
  2⤵
  PID:7476
- C:\Windows\System\fagYjrH.exe
  C:\Windows\System\fagYjrH.exe
  2⤵
  PID:7668
- C:\Windows\System\RDHlJJi.exe
  C:\Windows\System\RDHlJJi.exe
  2⤵
  PID:7716
- C:\Windows\System\Pelxpvk.exe
  C:\Windows\System\Pelxpvk.exe
  2⤵
  PID:7780
- C:\Windows\System\yuxAbYe.exe
  C:\Windows\System\yuxAbYe.exe
  2⤵
  PID:7816
- C:\Windows\System\ptQuxvi.exe
  C:\Windows\System\ptQuxvi.exe
  2⤵
  PID:7796
- C:\Windows\System\UadgTeY.exe
  C:\Windows\System\UadgTeY.exe
  2⤵
  PID:7736
- C:\Windows\System\xSylMSr.exe
  C:\Windows\System\xSylMSr.exe
  2⤵
  PID:7700
- C:\Windows\System\LvMSEJB.exe
  C:\Windows\System\LvMSEJB.exe
  2⤵
  PID:7908
- C:\Windows\System\XhMbzLt.exe
  C:\Windows\System\XhMbzLt.exe
  2⤵
  PID:7944
- C:\Windows\System\HXgOADw.exe
  C:\Windows\System\HXgOADw.exe
  2⤵
  PID:8008
- C:\Windows\System\KZihvID.exe
  C:\Windows\System\KZihvID.exe
  2⤵
  PID:8072
- C:\Windows\System\pGOoLki.exe
  C:\Windows\System\pGOoLki.exe
  2⤵
  PID:8136
- C:\Windows\System\GCzTCNK.exe
  C:\Windows\System\GCzTCNK.exe
  2⤵
  PID:6152
- C:\Windows\System\ELrsbvm.exe
  C:\Windows\System\ELrsbvm.exe
  2⤵
  PID:7960
- C:\Windows\System\nBFmZSv.exe
  C:\Windows\System\nBFmZSv.exe
  2⤵
  PID:7892
- C:\Windows\System\WWwdoTo.exe
  C:\Windows\System\WWwdoTo.exe
  2⤵
  PID:7896
- C:\Windows\System\LMQjEBo.exe
  C:\Windows\System\LMQjEBo.exe
  2⤵
  PID:8024
- C:\Windows\System\RJEsJSD.exe
  C:\Windows\System\RJEsJSD.exe
  2⤵
  PID:8088
- C:\Windows\System\MikddEd.exe
  C:\Windows\System\MikddEd.exe
  2⤵
  PID:8152
- C:\Windows\System\lVnlDyt.exe
  C:\Windows\System\lVnlDyt.exe
  2⤵
  PID:7216
- C:\Windows\System\kEWCCyz.exe
  C:\Windows\System\kEWCCyz.exe
  2⤵
  PID:7392
- C:\Windows\System\VXVDrAw.exe
  C:\Windows\System\VXVDrAw.exe
  2⤵
  PID:7396
- C:\Windows\System\GPQRGxz.exe
  C:\Windows\System\GPQRGxz.exe
  2⤵
  PID:7556
- C:\Windows\System\aJLamQd.exe
  C:\Windows\System\aJLamQd.exe
  2⤵
  PID:7608
- C:\Windows\System\PmnlRWV.exe
  C:\Windows\System\PmnlRWV.exe
  2⤵
  PID:7876
- C:\Windows\System\zPwWLDY.exe
  C:\Windows\System\zPwWLDY.exe
  2⤵
  PID:7940
- C:\Windows\System\cIidxxj.exe
  C:\Windows\System\cIidxxj.exe
  2⤵
  PID:6900
- C:\Windows\System\HSflofa.exe
  C:\Windows\System\HSflofa.exe
  2⤵
  PID:7992
- C:\Windows\System\tzodQpO.exe
  C:\Windows\System\tzodQpO.exe
  2⤵
  PID:7380
- C:\Windows\System\aFKQRkX.exe
  C:\Windows\System\aFKQRkX.exe
  2⤵
  PID:7848
- C:\Windows\System\RyhNTra.exe
  C:\Windows\System\RyhNTra.exe
  2⤵
  PID:8148
- C:\Windows\System\RbTTfmf.exe
  C:\Windows\System\RbTTfmf.exe
  2⤵
  PID:8196
- C:\Windows\System\GSulGrk.exe
  C:\Windows\System\GSulGrk.exe
  2⤵
  PID:8212
- C:\Windows\System\qlRVkEg.exe
  C:\Windows\System\qlRVkEg.exe
  2⤵
  PID:8228
- C:\Windows\System\vSftIRJ.exe
  C:\Windows\System\vSftIRJ.exe
  2⤵
  PID:8244
- C:\Windows\System\QXOWcWI.exe
  C:\Windows\System\QXOWcWI.exe
  2⤵
  PID:8260
- C:\Windows\System\WOVLVtE.exe
  C:\Windows\System\WOVLVtE.exe
  2⤵
  PID:8276
- C:\Windows\System\FFJCuzK.exe
  C:\Windows\System\FFJCuzK.exe
  2⤵
  PID:8292
- C:\Windows\System\XEvugrX.exe
  C:\Windows\System\XEvugrX.exe
  2⤵
  PID:8308
- C:\Windows\System\waCXQTb.exe
  C:\Windows\System\waCXQTb.exe
  2⤵
  PID:8324
- C:\Windows\System\bdXihth.exe
  C:\Windows\System\bdXihth.exe
  2⤵
  PID:8340
- C:\Windows\System\WyZySfm.exe
  C:\Windows\System\WyZySfm.exe
  2⤵
  PID:8356
- C:\Windows\System\Kpxcdyx.exe
  C:\Windows\System\Kpxcdyx.exe
  2⤵
  PID:8372
- C:\Windows\System\RLdUIZd.exe
  C:\Windows\System\RLdUIZd.exe
  2⤵
  PID:8388
- C:\Windows\System\PQCXqvY.exe
  C:\Windows\System\PQCXqvY.exe
  2⤵
  PID:8404
- C:\Windows\System\xVSDsKL.exe
  C:\Windows\System\xVSDsKL.exe
  2⤵
  PID:8420
- C:\Windows\System\HgWjhCW.exe
  C:\Windows\System\HgWjhCW.exe
  2⤵
  PID:8436
- C:\Windows\System\NcgZiPi.exe
  C:\Windows\System\NcgZiPi.exe
  2⤵
  PID:8452
- C:\Windows\System\OGrOcDU.exe
  C:\Windows\System\OGrOcDU.exe
  2⤵
  PID:8468
- C:\Windows\System\xbISzIh.exe
  C:\Windows\System\xbISzIh.exe
  2⤵
  PID:8484
- C:\Windows\System\ctChvEu.exe
  C:\Windows\System\ctChvEu.exe
  2⤵
  PID:8504
- C:\Windows\System\MIiYdOE.exe
  C:\Windows\System\MIiYdOE.exe
  2⤵
  PID:8520
- C:\Windows\System\cUtTYqW.exe
  C:\Windows\System\cUtTYqW.exe
  2⤵
  PID:8536
- C:\Windows\System\pkFSmzm.exe
  C:\Windows\System\pkFSmzm.exe
  2⤵
  PID:8552
- C:\Windows\System\pQwugqg.exe
  C:\Windows\System\pQwugqg.exe
  2⤵
  PID:8568
- C:\Windows\System\RClyzCi.exe
  C:\Windows\System\RClyzCi.exe
  2⤵
  PID:8584
- C:\Windows\System\qeSLWvI.exe
  C:\Windows\System\qeSLWvI.exe
  2⤵
  PID:8600
- C:\Windows\System\AAmgOwA.exe
  C:\Windows\System\AAmgOwA.exe
  2⤵
  PID:8616
- C:\Windows\System\wbBjgBD.exe
  C:\Windows\System\wbBjgBD.exe
  2⤵
  PID:8632
- C:\Windows\System\OxaxgRw.exe
  C:\Windows\System\OxaxgRw.exe
  2⤵
  PID:8648
- C:\Windows\System\iOWsLkx.exe
  C:\Windows\System\iOWsLkx.exe
  2⤵
  PID:8664
- C:\Windows\System\zgCmuHI.exe
  C:\Windows\System\zgCmuHI.exe
  2⤵
  PID:8680
- C:\Windows\System\uuBrBJp.exe
  C:\Windows\System\uuBrBJp.exe
  2⤵
  PID:8696
- C:\Windows\System\BzQDFcj.exe
  C:\Windows\System\BzQDFcj.exe
  2⤵
  PID:8736
- C:\Windows\System\HghguNV.exe
  C:\Windows\System\HghguNV.exe
  2⤵
  PID:8752
- C:\Windows\System\yEFiWsD.exe
  C:\Windows\System\yEFiWsD.exe
  2⤵
  PID:8768
- C:\Windows\System\JmKhBWS.exe
  C:\Windows\System\JmKhBWS.exe
  2⤵
  PID:8784
- C:\Windows\System\PLTddie.exe
  C:\Windows\System\PLTddie.exe
  2⤵
  PID:8800
- C:\Windows\System\SqQBfZJ.exe
  C:\Windows\System\SqQBfZJ.exe
  2⤵
  PID:8816
- C:\Windows\System\BhTQBZg.exe
  C:\Windows\System\BhTQBZg.exe
  2⤵
  PID:8832
- C:\Windows\System\etlBCnY.exe
  C:\Windows\System\etlBCnY.exe
  2⤵
  PID:8848
- C:\Windows\System\WvHEghe.exe
  C:\Windows\System\WvHEghe.exe
  2⤵
  PID:9016
- C:\Windows\System\GCfXaLb.exe
  C:\Windows\System\GCfXaLb.exe
  2⤵
  PID:9032
- C:\Windows\System\FoJDnZe.exe
  C:\Windows\System\FoJDnZe.exe
  2⤵
  PID:9048
- C:\Windows\System\KaENQYf.exe
  C:\Windows\System\KaENQYf.exe
  2⤵
  PID:9064
- C:\Windows\System\OHErRxU.exe
  C:\Windows\System\OHErRxU.exe
  2⤵
  PID:9080
- C:\Windows\System\YZhPFDF.exe
  C:\Windows\System\YZhPFDF.exe
  2⤵
  PID:9096
- C:\Windows\System\mjtzevh.exe
  C:\Windows\System\mjtzevh.exe
  2⤵
  PID:9112
- C:\Windows\System\vdrlTIR.exe
  C:\Windows\System\vdrlTIR.exe
  2⤵
  PID:9128
- C:\Windows\System\xBUATtw.exe
  C:\Windows\System\xBUATtw.exe
  2⤵
  PID:9144
- C:\Windows\System\xXuFvGc.exe
  C:\Windows\System\xXuFvGc.exe
  2⤵
  PID:9160
- C:\Windows\System\JSMfOKe.exe
  C:\Windows\System\JSMfOKe.exe
  2⤵
  PID:9176
- C:\Windows\System\LXBvhtq.exe
  C:\Windows\System\LXBvhtq.exe
  2⤵
  PID:9192
- C:\Windows\System\pgjiFpk.exe
  C:\Windows\System\pgjiFpk.exe
  2⤵
  PID:9208
- C:\Windows\System\FNsfUml.exe
  C:\Windows\System\FNsfUml.exe
  2⤵
  PID:8204
- C:\Windows\System\LABYSYc.exe
  C:\Windows\System\LABYSYc.exe
  2⤵
  PID:7672
- C:\Windows\System\zYazlIk.exe
  C:\Windows\System\zYazlIk.exe
  2⤵
  PID:6836
- C:\Windows\System\CqKWGXV.exe
  C:\Windows\System\CqKWGXV.exe
  2⤵
  PID:7560
- C:\Windows\System\tFEJEOX.exe
  C:\Windows\System\tFEJEOX.exe
  2⤵
  PID:8256
- C:\Windows\System\BNQGiYl.exe
  C:\Windows\System\BNQGiYl.exe
  2⤵
  PID:8332
- C:\Windows\System\XVJLiaN.exe
  C:\Windows\System\XVJLiaN.exe
  2⤵
  PID:8428
- C:\Windows\System\LwuHlwC.exe
  C:\Windows\System\LwuHlwC.exe
  2⤵
  PID:8336
- C:\Windows\System\gTRcYTS.exe
  C:\Windows\System\gTRcYTS.exe
  2⤵
  PID:8528
- C:\Windows\System\GBowKCE.exe
  C:\Windows\System\GBowKCE.exe
  2⤵
  PID:8380
- C:\Windows\System\BkCUBeP.exe
  C:\Windows\System\BkCUBeP.exe
  2⤵
  PID:8448
- C:\Windows\System\TSGMaiG.exe
  C:\Windows\System\TSGMaiG.exe
  2⤵
  PID:8544
- C:\Windows\System\NzMFRlY.exe
  C:\Windows\System\NzMFRlY.exe
  2⤵
  PID:8316
- C:\Windows\System\TeyIKZc.exe
  C:\Windows\System\TeyIKZc.exe
  2⤵
  PID:8624
- C:\Windows\System\UYxwWDg.exe
  C:\Windows\System\UYxwWDg.exe
  2⤵
  PID:8660
- C:\Windows\System\ySjhjfE.exe
  C:\Windows\System\ySjhjfE.exe
  2⤵
  PID:8748
- C:\Windows\System\BFFxWSl.exe
  C:\Windows\System\BFFxWSl.exe
  2⤵
  PID:8732
- C:\Windows\System\ZzDCDLF.exe
  C:\Windows\System\ZzDCDLF.exe
  2⤵
  PID:8612
- C:\Windows\System\WuIGmmL.exe
  C:\Windows\System\WuIGmmL.exe
  2⤵
  PID:8708
- C:\Windows\System\pqRgqHl.exe
  C:\Windows\System\pqRgqHl.exe
  2⤵
  PID:8724
- C:\Windows\System\bkFgSPo.exe
  C:\Windows\System\bkFgSPo.exe
  2⤵
  PID:8676
- C:\Windows\System\mWyWsdV.exe
  C:\Windows\System\mWyWsdV.exe
  2⤵
  PID:8840
- C:\Windows\System\ngBZcUh.exe
  C:\Windows\System\ngBZcUh.exe
  2⤵
  PID:8812
- C:\Windows\System\dYsKuqC.exe
  C:\Windows\System\dYsKuqC.exe
  2⤵
  PID:8868
- C:\Windows\System\ZHacaXG.exe
  C:\Windows\System\ZHacaXG.exe
  2⤵
  PID:8896
- C:\Windows\System\EDHHsMD.exe
  C:\Windows\System\EDHHsMD.exe
  2⤵
  PID:8880
- C:\Windows\System\UBzshPt.exe
  C:\Windows\System\UBzshPt.exe
  2⤵
  PID:9028
- C:\Windows\System\AXLeeqC.exe
  C:\Windows\System\AXLeeqC.exe
  2⤵
  PID:8904
- C:\Windows\System\XhrlOxm.exe
  C:\Windows\System\XhrlOxm.exe
  2⤵
  PID:8920
- C:\Windows\System\VEfCdbw.exe
  C:\Windows\System\VEfCdbw.exe
  2⤵
  PID:8944
- C:\Windows\System\IEDKFVt.exe
  C:\Windows\System\IEDKFVt.exe
  2⤵
  PID:9000
- C:\Windows\System\htOLsjr.exe
  C:\Windows\System\htOLsjr.exe
  2⤵
  PID:8980
- C:\Windows\System\zXsLmJO.exe
  C:\Windows\System\zXsLmJO.exe
  2⤵
  PID:8996
- C:\Windows\System\uhvjcAQ.exe
  C:\Windows\System\uhvjcAQ.exe
  2⤵
  PID:9088
- C:\Windows\System\FdzvvOs.exe
  C:\Windows\System\FdzvvOs.exe
  2⤵
  PID:9044
- C:\Windows\System\SmkZGRg.exe
  C:\Windows\System\SmkZGRg.exe
  2⤵
  PID:7536
- C:\Windows\System\QzfJrem.exe
  C:\Windows\System\QzfJrem.exe
  2⤵
  PID:8104
- C:\Windows\System\MkDXwtX.exe
  C:\Windows\System\MkDXwtX.exe
  2⤵
  PID:7204
- C:\Windows\System\MhrCScB.exe
  C:\Windows\System\MhrCScB.exe
  2⤵
  PID:7412
- C:\Windows\System\QGnbQqe.exe
  C:\Windows\System\QGnbQqe.exe
  2⤵
  PID:8224
- C:\Windows\System\gHCAoHF.exe
  C:\Windows\System\gHCAoHF.exe
  2⤵
  PID:2804
- C:\Windows\System\QWENIPl.exe
  C:\Windows\System\QWENIPl.exe
  2⤵
  PID:6132
- C:\Windows\System\qSFwQDv.exe
  C:\Windows\System\qSFwQDv.exe
  2⤵
  PID:1660
- C:\Windows\System\qGUZhNC.exe
  C:\Windows\System\qGUZhNC.exe
  2⤵
  PID:8592
- C:\Windows\System\YiXAiXI.exe
  C:\Windows\System\YiXAiXI.exe
  2⤵
  PID:8252
- C:\Windows\System\WTcFpmH.exe
  C:\Windows\System\WTcFpmH.exe
  2⤵
  PID:8496
- C:\Windows\System\QoknJQS.exe
  C:\Windows\System\QoknJQS.exe
  2⤵
  PID:8688
- C:\Windows\System\BrQWfxG.exe
  C:\Windows\System\BrQWfxG.exe
  2⤵
  PID:8720
- C:\Windows\System\nUMqzNP.exe
  C:\Windows\System\nUMqzNP.exe
  2⤵
  PID:8548
- C:\Windows\System\MDCgGVp.exe
  C:\Windows\System\MDCgGVp.exe
  2⤵
  PID:8796
- C:\Windows\System\wezpwGu.exe
  C:\Windows\System\wezpwGu.exe
  2⤵
  PID:8640
- C:\Windows\System\ZFvEGom.exe
  C:\Windows\System\ZFvEGom.exe
  2⤵
  PID:8856
- C:\Windows\System\amFnkcr.exe
  C:\Windows\System\amFnkcr.exe
  2⤵
  PID:8964
- C:\Windows\System\iLGiYfH.exe
  C:\Windows\System\iLGiYfH.exe
  2⤵
  PID:8968
- C:\Windows\System\ndmcEWa.exe
  C:\Windows\System\ndmcEWa.exe
  2⤵
  PID:8952
- C:\Windows\System\cfgWfAS.exe
  C:\Windows\System\cfgWfAS.exe
  2⤵
  PID:8972
- C:\Windows\System\BdfIitH.exe
  C:\Windows\System\BdfIitH.exe
  2⤵
  PID:9012
- C:\Windows\System\DihRgfR.exe
  C:\Windows\System\DihRgfR.exe
  2⤵
  PID:9152
- C:\Windows\System\dEjsoUh.exe
  C:\Windows\System\dEjsoUh.exe
  2⤵
  PID:8168
- C:\Windows\System\bCcWoWr.exe
  C:\Windows\System\bCcWoWr.exe
  2⤵
  PID:7828
- C:\Windows\System\UlmUJMA.exe
  C:\Windows\System\UlmUJMA.exe
  2⤵
  PID:1992
- C:\Windows\System\MbZoYSp.exe
  C:\Windows\System\MbZoYSp.exe
  2⤵
  PID:8512
- C:\Windows\System\ptyjOGz.exe
  C:\Windows\System\ptyjOGz.exe
  2⤵
  PID:8348
- C:\Windows\System\TmvbKQM.exe
  C:\Windows\System\TmvbKQM.exe
  2⤵
  PID:8808
- C:\Windows\System\lfTWtlL.exe
  C:\Windows\System\lfTWtlL.exe
  2⤵
  PID:8940
- C:\Windows\System\zZNxQmV.exe
  C:\Windows\System\zZNxQmV.exe
  2⤵
  PID:8272
- C:\Windows\System\CpTUYAm.exe
  C:\Windows\System\CpTUYAm.exe
  2⤵
  PID:8300
- C:\Windows\System\ZMdJYFF.exe
  C:\Windows\System\ZMdJYFF.exe
  2⤵
  PID:8444
- C:\Windows\System\gPQNTnW.exe
  C:\Windows\System\gPQNTnW.exe
  2⤵
  PID:8716
- C:\Windows\System\vkZHPle.exe
  C:\Windows\System\vkZHPle.exe
  2⤵
  PID:8860
- C:\Windows\System\DjduIrS.exe
  C:\Windows\System\DjduIrS.exe
  2⤵
  PID:9040
- C:\Windows\System\ntYgmyz.exe
  C:\Windows\System\ntYgmyz.exe
  2⤵
  PID:9140
- C:\Windows\System\KUwFjAN.exe
  C:\Windows\System\KUwFjAN.exe
  2⤵
  PID:9104
- C:\Windows\System\UARUSck.exe
  C:\Windows\System\UARUSck.exe
  2⤵
  PID:9172
- C:\Windows\System\ethXrqK.exe
  C:\Windows\System\ethXrqK.exe
  2⤵
  PID:8084
- C:\Windows\System\MZMfWYb.exe
  C:\Windows\System\MZMfWYb.exe
  2⤵
  PID:7604
- C:\Windows\System\UEIlcUh.exe
  C:\Windows\System\UEIlcUh.exe
  2⤵
  PID:7732
- C:\Windows\System\LVjImMP.exe
  C:\Windows\System\LVjImMP.exe
  2⤵
  PID:7624
- C:\Windows\System\scoJOdC.exe
  C:\Windows\System\scoJOdC.exe
  2⤵
  PID:7988
- C:\Windows\System\lTXATIN.exe
  C:\Windows\System\lTXATIN.exe
  2⤵
  PID:9024
- C:\Windows\System\gaFRxir.exe
  C:\Windows\System\gaFRxir.exe
  2⤵
  PID:7912
- C:\Windows\System\vkwKkDM.exe
  C:\Windows\System\vkwKkDM.exe
  2⤵
  PID:8932
- C:\Windows\System\PjeyghD.exe
  C:\Windows\System\PjeyghD.exe
  2⤵
  PID:8988
- C:\Windows\System\qCNrSeD.exe
  C:\Windows\System\qCNrSeD.exe
  2⤵
  PID:8828
- C:\Windows\System\EdOGuTD.exe
  C:\Windows\System\EdOGuTD.exe
  2⤵
  PID:9184
- C:\Windows\System\VbsoXyD.exe
  C:\Windows\System\VbsoXyD.exe
  2⤵
  PID:8284
- C:\Windows\System\vTJFEUf.exe
  C:\Windows\System\vTJFEUf.exe
  2⤵
  PID:9136
- C:\Windows\System\aQSZQVK.exe
  C:\Windows\System\aQSZQVK.exe
  2⤵
  PID:7636
- C:\Windows\System\SQjrgqQ.exe
  C:\Windows\System\SQjrgqQ.exe
  2⤵
  PID:9076
- C:\Windows\System\JDzsUoz.exe
  C:\Windows\System\JDzsUoz.exe
  2⤵
  PID:7684
- C:\Windows\System\fSTVUKM.exe
  C:\Windows\System\fSTVUKM.exe
  2⤵
  PID:9168
- C:\Windows\System\mUKYzMM.exe
  C:\Windows\System\mUKYzMM.exe
  2⤵
  PID:9228
- C:\Windows\System\daRAQDl.exe
  C:\Windows\System\daRAQDl.exe
  2⤵
  PID:9244
- C:\Windows\System\QTiEkst.exe
  C:\Windows\System\QTiEkst.exe
  2⤵
  PID:9260
- C:\Windows\System\AUIOyVz.exe
  C:\Windows\System\AUIOyVz.exe
  2⤵
  PID:9276
- C:\Windows\System\zYpzDQn.exe
  C:\Windows\System\zYpzDQn.exe
  2⤵
  PID:9292
- C:\Windows\System\FxfRBAQ.exe
  C:\Windows\System\FxfRBAQ.exe
  2⤵
  PID:9308
- C:\Windows\System\hNEciiU.exe
  C:\Windows\System\hNEciiU.exe
  2⤵
  PID:9324
- C:\Windows\System\eBuISWU.exe
  C:\Windows\System\eBuISWU.exe
  2⤵
  PID:9340
- C:\Windows\System\HCDLqjc.exe
  C:\Windows\System\HCDLqjc.exe
  2⤵
  PID:9356
- C:\Windows\System\lDWLHiZ.exe
  C:\Windows\System\lDWLHiZ.exe
  2⤵
  PID:9484
- C:\Windows\System\PKEDYJp.exe
  C:\Windows\System\PKEDYJp.exe
  2⤵
  PID:9500
- C:\Windows\System\PntTduu.exe
  C:\Windows\System\PntTduu.exe
  2⤵
  PID:9516
- C:\Windows\System\kTGsNgB.exe
  C:\Windows\System\kTGsNgB.exe
  2⤵
  PID:9532
- C:\Windows\System\aNnnQCz.exe
  C:\Windows\System\aNnnQCz.exe
  2⤵
  PID:9548
- C:\Windows\System\qmMrqBS.exe
  C:\Windows\System\qmMrqBS.exe
  2⤵
  PID:9564
- C:\Windows\System\oMjhIdO.exe
  C:\Windows\System\oMjhIdO.exe
  2⤵
  PID:9580
- C:\Windows\System\ESpVuxe.exe
  C:\Windows\System\ESpVuxe.exe
  2⤵
  PID:9600
- C:\Windows\System\zGZMJXX.exe
  C:\Windows\System\zGZMJXX.exe
  2⤵
  PID:9616
- C:\Windows\System\SuTLqzV.exe
  C:\Windows\System\SuTLqzV.exe
  2⤵
  PID:9632
- C:\Windows\System\mubHQtd.exe
  C:\Windows\System\mubHQtd.exe
  2⤵
  PID:9656
- C:\Windows\System\FqfUgtP.exe
  C:\Windows\System\FqfUgtP.exe
  2⤵
  PID:9672
- C:\Windows\System\vzkZFcv.exe
  C:\Windows\System\vzkZFcv.exe
  2⤵
  PID:9692
- C:\Windows\System\FoxwbSj.exe
  C:\Windows\System\FoxwbSj.exe
  2⤵
  PID:9708
- C:\Windows\System\UDnmeGt.exe
  C:\Windows\System\UDnmeGt.exe
  2⤵
  PID:9728
- C:\Windows\System\UIcKpHk.exe
  C:\Windows\System\UIcKpHk.exe
  2⤵
  PID:9744
- C:\Windows\System\EGJnCim.exe
  C:\Windows\System\EGJnCim.exe
  2⤵
  PID:9760
- C:\Windows\System\QfoXODz.exe
  C:\Windows\System\QfoXODz.exe
  2⤵
  PID:9776
- C:\Windows\System\DlEAMMD.exe
  C:\Windows\System\DlEAMMD.exe
  2⤵
  PID:9792
- C:\Windows\System\gbDwYjp.exe
  C:\Windows\System\gbDwYjp.exe
  2⤵
  PID:9820
- C:\Windows\System\SDWUlyk.exe
  C:\Windows\System\SDWUlyk.exe
  2⤵
  PID:9836
- C:\Windows\System\UcwHeNF.exe
  C:\Windows\System\UcwHeNF.exe
  2⤵
  PID:9852
- C:\Windows\System\kXqTSlw.exe
  C:\Windows\System\kXqTSlw.exe
  2⤵
  PID:9872
- C:\Windows\System\ZPupDaU.exe
  C:\Windows\System\ZPupDaU.exe
  2⤵
  PID:9892
- C:\Windows\System\tuOnrbR.exe
  C:\Windows\System\tuOnrbR.exe
  2⤵
  PID:9916
- C:\Windows\System\vaSLZFS.exe
  C:\Windows\System\vaSLZFS.exe
  2⤵
  PID:9932
- C:\Windows\System\rvwmhWJ.exe
  C:\Windows\System\rvwmhWJ.exe
  2⤵
  PID:9948
- C:\Windows\System\qbBRLYs.exe
  C:\Windows\System\qbBRLYs.exe
  2⤵
  PID:9964
- C:\Windows\System\avzkzTa.exe
  C:\Windows\System\avzkzTa.exe
  2⤵
  PID:9980
- C:\Windows\System\slzaJQv.exe
  C:\Windows\System\slzaJQv.exe
  2⤵
  PID:9996
- C:\Windows\System\WYDRDVR.exe
  C:\Windows\System\WYDRDVR.exe
  2⤵
  PID:10016
- C:\Windows\System\YkkuQWz.exe
  C:\Windows\System\YkkuQWz.exe
  2⤵
  PID:10032
- C:\Windows\System\ZdryBmh.exe
  C:\Windows\System\ZdryBmh.exe
  2⤵
  PID:10052
- C:\Windows\System\IUSXeoV.exe
  C:\Windows\System\IUSXeoV.exe
  2⤵
  PID:10068
- C:\Windows\System\KqyVdma.exe
  C:\Windows\System\KqyVdma.exe
  2⤵
  PID:10084
- C:\Windows\System\eZkKCFI.exe
  C:\Windows\System\eZkKCFI.exe
  2⤵
  PID:10100
- C:\Windows\System\sHbxHRS.exe
  C:\Windows\System\sHbxHRS.exe
  2⤵
  PID:10116
- C:\Windows\System\vlNdSgO.exe
  C:\Windows\System\vlNdSgO.exe
  2⤵
  PID:10132
- C:\Windows\System\RdvioQl.exe
  C:\Windows\System\RdvioQl.exe
  2⤵
  PID:10148
- C:\Windows\System\dSwAUuP.exe
  C:\Windows\System\dSwAUuP.exe
  2⤵
  PID:10164
- C:\Windows\System\yMvdDZu.exe
  C:\Windows\System\yMvdDZu.exe
  2⤵
  PID:10180
- C:\Windows\System\bxEHgvA.exe
  C:\Windows\System\bxEHgvA.exe
  2⤵
  PID:10196
- C:\Windows\System\AVPUTNa.exe
  C:\Windows\System\AVPUTNa.exe
  2⤵
  PID:10212
- C:\Windows\System\uoCQeTW.exe
  C:\Windows\System\uoCQeTW.exe
  2⤵
  PID:10232
- C:\Windows\System\iEmDlNV.exe
  C:\Windows\System\iEmDlNV.exe
  2⤵
  PID:9236
- C:\Windows\System\DdESJNE.exe
  C:\Windows\System\DdESJNE.exe
  2⤵
  PID:9300
- C:\Windows\System\mPEDtir.exe
  C:\Windows\System\mPEDtir.exe
  2⤵
  PID:9332
- C:\Windows\System\TkCxoEW.exe
  C:\Windows\System\TkCxoEW.exe
  2⤵
  PID:9188
- C:\Windows\System\SCZguME.exe
  C:\Windows\System\SCZguME.exe
  2⤵
  PID:8464
- C:\Windows\System\RJnsIaI.exe
  C:\Windows\System\RJnsIaI.exe
  2⤵
  PID:8580
- C:\Windows\System\LfGWavn.exe
  C:\Windows\System\LfGWavn.exe
  2⤵
  PID:9452
- C:\Windows\System\RPCIVFv.exe
  C:\Windows\System\RPCIVFv.exe
  2⤵
  PID:9472
- C:\Windows\System\nuEMzMQ.exe
  C:\Windows\System\nuEMzMQ.exe
  2⤵
  PID:9492
- C:\Windows\System\QLpQkwz.exe
  C:\Windows\System\QLpQkwz.exe
  2⤵
  PID:9544
- C:\Windows\System\fOyqzJl.exe
  C:\Windows\System\fOyqzJl.exe
  2⤵
  PID:9640
- C:\Windows\System\UmZVjGd.exe
  C:\Windows\System\UmZVjGd.exe
  2⤵
  PID:9680
- C:\Windows\System\hbFrGTF.exe
  C:\Windows\System\hbFrGTF.exe
  2⤵
  PID:9720
- C:\Windows\System\feGstsC.exe
  C:\Windows\System\feGstsC.exe
  2⤵
  PID:9072
- C:\Windows\System\siLfnBv.exe
  C:\Windows\System\siLfnBv.exe
  2⤵
  PID:9560
- C:\Windows\System\nTmeKjo.exe
  C:\Windows\System\nTmeKjo.exe
  2⤵
  PID:9664
- C:\Windows\System\zTTSyKF.exe
  C:\Windows\System\zTTSyKF.exe
  2⤵
  PID:9740
- C:\Windows\System\JIbGfBs.exe
  C:\Windows\System\JIbGfBs.exe
  2⤵
  PID:9804
- C:\Windows\System\BVvOAoF.exe
  C:\Windows\System\BVvOAoF.exe
  2⤵
  PID:9844
- C:\Windows\System\zsHCEDA.exe
  C:\Windows\System\zsHCEDA.exe
  2⤵
  PID:9756
- C:\Windows\System\GZcJTLE.exe
  C:\Windows\System\GZcJTLE.exe
  2⤵
  PID:9832
- C:\Windows\System\yEJKZsF.exe
  C:\Windows\System\yEJKZsF.exe
  2⤵
  PID:9900
- C:\Windows\System\qfsOmXZ.exe
  C:\Windows\System\qfsOmXZ.exe
  2⤵
  PID:9944
- C:\Windows\System\JTsmtPc.exe
  C:\Windows\System\JTsmtPc.exe
  2⤵
  PID:10008
- C:\Windows\System\kkkzsoD.exe
  C:\Windows\System\kkkzsoD.exe
  2⤵
  PID:10048
- C:\Windows\System\iqbmIHA.exe
  C:\Windows\System\iqbmIHA.exe
  2⤵
  PID:10112
- C:\Windows\System\giQXXNd.exe
  C:\Windows\System\giQXXNd.exe
  2⤵
  PID:9924
- C:\Windows\System\Ywzgwwm.exe
  C:\Windows\System\Ywzgwwm.exe
  2⤵
  PID:10208
- C:\Windows\System\bJFMHom.exe
  C:\Windows\System\bJFMHom.exe
  2⤵
  PID:9928
- C:\Windows\System\CPvrVLS.exe
  C:\Windows\System\CPvrVLS.exe
  2⤵
  PID:10064
- C:\Windows\System\DiLJEFv.exe
  C:\Windows\System\DiLJEFv.exe
  2⤵
  PID:8764
- C:\Windows\System\DVhlECl.exe
  C:\Windows\System\DVhlECl.exe
  2⤵
  PID:10160
- C:\Windows\System\rYVSIjy.exe
  C:\Windows\System\rYVSIjy.exe
  2⤵
  PID:10128
- C:\Windows\System\wIKFzBp.exe
  C:\Windows\System\wIKFzBp.exe
  2⤵
  PID:10220
- C:\Windows\System\OvBmHko.exe
  C:\Windows\System\OvBmHko.exe
  2⤵
  PID:9268
- C:\Windows\System\rEZXdUN.exe
  C:\Windows\System\rEZXdUN.exe
  2⤵
  PID:9252
- C:\Windows\System\bAsEQVT.exe
  C:\Windows\System\bAsEQVT.exe
  2⤵
  PID:9368
- C:\Windows\System\gvTuKfk.exe
  C:\Windows\System\gvTuKfk.exe
  2⤵
  PID:9380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EGNYTOR.exe

Filesize
1.6MB

MD5
f384d6689af13e85cd289f49da636b1b

SHA1
c4671247ba96b310db78f4f6303b2ce30177ea0f

SHA256
a11c167f0b63eb421ba021081dd6414a3070f9ae3f4694563da94ea95b146166

SHA512
bd16f65144582120e04acb92ca800c91d8b880220d06cd5943b0b7d7698543ab74fea45f9dd86955c72ee7e4ee37e19b894024e6aa045a1a03a39fb746b5dc67

Download Submit
C:\Windows\system\KNIlgsC.exe

Filesize
1.6MB

MD5
689ef08270233a35290c4326b0f9b894

SHA1
12a8f57e20015f08bf5c33cce0ce3112743c68f6

SHA256
8ef78f21869cbb240452efa4b1a50978636302f95c31e10baa0aa9e94de64380

SHA512
d22daf7c13389a5fda0b5b993776cb0e9914ac2f5e7b61151485d988364cd293cb437fe5d93ea8f993bc87dcd57d66e3a4ed4608c9430c77dd978347504f3a99

Download Submit
C:\Windows\system\KywvzlH.exe

Filesize
1.6MB

MD5
273ca5f0754b456311a1ca94ad7f8111

SHA1
7d25590408a4d353218b30404310099cea8455db

SHA256
8f8d7992e532345fb4de7a57c64e8bba7226e35722c6a01872af4a0f3708f946

SHA512
ec36df0f04a4fc05b3804943d5fddd5ff25647c89fcac8073edb44bf3eaa98687bd457ae449e37043f102f520bc994b100505b2d841f3bec6f4617a45595369a

Download Submit
C:\Windows\system\PfMPQPj.exe

Filesize
1.6MB

MD5
5075bfa45bcf10f8140950ca26d18f55

SHA1
ee5a5f8295add817c1be2061f4b44d6864dfc8ff

SHA256
e2ebf9d194afa5a80a183fd24f5246750dc07a8559d9e560259a0e9dcabedebc

SHA512
f9803dbd5f8088972836259108478ae424dcce95691014baeff2f39f477dc44d827e76c22ea6a000db611ed34116119ad0c5ff0b1e2cd671286d9b1e81dcecf9

Download Submit
C:\Windows\system\PruUUGD.exe

Filesize
1.6MB

MD5
aa8a8be9bc0aa920e1a9ac58fcd7f136

SHA1
f74f2a7f745d34fb843818e6d1c94874ff752ae2

SHA256
835fbf7885f9ad5d52bcfab98c24405ff729466eb987b0152c433c857de8a67c

SHA512
a6e78202d5841c6afc9af905cc479acb004c89e0d763e09b407bb92d76d4d34335646da498b53adb66b9e417f315d6fbeaf31e0245dc20d0bf113a243f51dd82

Download Submit
C:\Windows\system\PsAPtHs.exe

Filesize
1.6MB

MD5
934836f091885413a9874871a05da531

SHA1
e404d59c7ba5ca56695cd4a9a2dff485632d8dd9

SHA256
85c60da9a40a559c74c6334f2a1e9ac9b7740ab8b1980125a84abdd7b6dc809d

SHA512
c532a30db08639e38ff8a12f5f1a7971a539b6b74f686a511f71a24c5cd83863a9ee0118ac44b1765ee703efac31d27161c130ed5c57b1c8a260cbc4d5ce9e66

Download Submit
C:\Windows\system\QQboejI.exe

Filesize
1.6MB

MD5
cc756555ba76c2c2bbadc797755bc361

SHA1
b22d51360187957c3d5bcb9470998b972e0c46e6

SHA256
4c62a2220fe098ce2b832b8a835eecbaa49e74e1872bbb3e4d27546a19f90c89

SHA512
4e02e9cbff7578691e93536eb6172df8bcb86350d5e031d0e81e0e17d67fb254b1e1bb45163327cdc55816e0866e333b761892a32c5d7882c5cf8620ff4e5f2b

Download Submit
C:\Windows\system\QXBhDzH.exe

Filesize
1.6MB

MD5
8b2d953397f22878a4bd95ee2e4f9cab

SHA1
d06facc95f11b6b1c49ce9ca6d89518982aefc11

SHA256
009071d87fb8f446471254af4bd3e50695ddf753d07d9140961d95694b108d7c

SHA512
e69e4f417dba5380c55e527d2899c73208110e531a4514af56110aab83f18f7eba3d73bcc8cb59a0124ad98148682c68078b809af9f0ad8e9060db133322c452

Download Submit
C:\Windows\system\QmBlOJz.exe

Filesize
1.6MB

MD5
dab8fdc82b219e79f34ab265e8a7962f

SHA1
99d94464a73906a24e1be7b7161635c86bd86f92

SHA256
e68ba799f8921e4fa46614d0f878b713cb305ed4c373892bc46b23909de0036e

SHA512
9dbae2de58812281cace44056d06e6a50c0551d1bffd3fb852bf7de6146a108b75c5e9bfcfc551488a64623f5fded059aa76d65e96fcdcc4140314b9e20de029

Download Submit
C:\Windows\system\ThldIyR.exe

Filesize
1.6MB

MD5
c9722c26a46aba0c1359dfc551b8bbc1

SHA1
5090e72ad1a91bcd6e7ccd717ed236b0e8f6c54d

SHA256
7612fd2f018f8a06a116cd5e00294a61cc1a54a2ef0040b23f1d9b190e750a47

SHA512
f852e76372731d0ace2bae9555a8f70d295fd41b1ac3c42ae8bf6a9aa0ebb4a9f8fd1faec0e72346219d0c58db1c7b7d31190642cf49b6ffa4e4707f34e8deba

Download Submit
C:\Windows\system\WvpdaiV.exe

Filesize
1.6MB

MD5
6008bd9ce9e98568220152d58ab7aba5

SHA1
b6edc3a2da8bc3a54da659f7868c44599fbfd732

SHA256
7a5663edfd6397160902276c5ecc4c1aaca81be8c79ee21a30f4c5ca17e36d78

SHA512
c029da6ae277f19a294a3d53aaa56cbd0227aaeded59151800d0e20c7e2aae3f42f67b02da1b8c0a8d7598b64ce543774b8c0015cf86f726cc581ed3df44b25e

Download Submit
C:\Windows\system\XvdsEBp.exe

Filesize
1.6MB

MD5
833fb2e8ce3e6d368b0236188ec5ce31

SHA1
b140fb947f969cd41d5b0bdcd3d6480f438d770c

SHA256
92df5342f1c2af81e0db28caf56fbfc43b8ba03ae7d57ac8d1b991616ae651fc

SHA512
882f16cd80401b270ab5e5797af8eec487375708aeca5e42aad555543ee9f02a24bc0023b9fab7484f8b8c114ba6a753482769b107f2437e26e8d2abe68c86f8

Download Submit
C:\Windows\system\YeHCPkL.exe

Filesize
1.6MB

MD5
8e03be32c192613d73c477b87e52d4bd

SHA1
3130927d4205e781e76642f2350444946fb2af53

SHA256
35dd529542f5d2ccffdb04f9688c6911ada473c9e9f118573c0eccacb3dab7d4

SHA512
27d5c44a669e1442d8126bc594cc858c3c2a7476ee70d13b705a2a99ac9d6d5cf006043762dd24ec69b54754de3fe6606d3d5c4c262f04fdffd6f4f88aa1cc1b

Download Submit
C:\Windows\system\YwPDeZq.exe

Filesize
1.6MB

MD5
c741349b5bb3e7f32a3391ed11c20497

SHA1
640b82ca23ddab1fd7b83cac424e1a94abab5c89

SHA256
dd9a74b174ec5bf84ab365999eab04b0fcb234ec13a78832ddb63c35b596e1e8

SHA512
96eddb0e72ca855ec40b7567d4bbbdd3167eed22d2671ca57659560eb27b70175fb188080b9ab80ee1b0624847efc8064b7b37e0b83e61b55b877aeb334dece2

Download Submit
C:\Windows\system\ZOLiItJ.exe

Filesize
1.6MB

MD5
fbcc7ed4ab2b60ba46f115f12a1d1375

SHA1
3fa45e7002f5c25bd36659ff9fa1ab8bafa334db

SHA256
bdf87027a9b45d76a4354b3f9e186a0ee3da30e26abd3547e5c7bb4d03591611

SHA512
fce4bcf4bc4868230e511885f73b688c18ccb749daf06ada7fe8f146cd4615df1008db5311e75e5cf6a79f931d7ed228b19be4566e44f69b68076b705ed7510d

Download Submit
C:\Windows\system\aKvkwon.exe

Filesize
1.6MB

MD5
c2e0d76ebef931042fc79e567b20c5f8

SHA1
a1ac7a411c80c1a8fd6e04fb7962afd74414ce19

SHA256
37d2598188889b71f16ddcd16c0268baa8b61df8c170313e468109a19ef6b07d

SHA512
794927b87291c8a40e7704e63c24957830d66b2a45959ee2b0856a483adf06db68185b5af2d52156caa1371507fbb67dd7ddbb7c1c893ea442ab801c1b2f1ad1

Download Submit
C:\Windows\system\adYwmgD.exe

Filesize
1.6MB

MD5
7d76f17dfa30b21dadff9f0aadbca4c1

SHA1
83767febe7d78b7f7a8aeae49ef68409fda4228d

SHA256
ebfd079288a74f8d1f20b41e9b7176641ec9f7d1042cc0807c387f5a8adccc62

SHA512
a98d0c024befa38e5f2c534d6deb26e715bfb9c518a212589a555ef2e0a2f97751ffd6304c74efd65a89d6410bcc0c15d2f32053d30cde11224c1d84a6bc9a64

Download Submit
C:\Windows\system\bswfLNM.exe

Filesize
1.6MB

MD5
ad5ae5974530899b8427067bbf149ed7

SHA1
4166ab6e56a523df78be310ef105ab2d963924c4

SHA256
bcc75cc752c6e9e800bd2ffa8be77611553928061255f762ed79e4d7142f6f76

SHA512
f870832076728b7536de551d53ad2e82646cf87cf90442d2c6fee4370c791c9346e7c0fe4e0a4d8dee9aae1381425ef7c437a12c2287a3e28c4023f28e57eea7

Download Submit
C:\Windows\system\cAQdXBo.exe

Filesize
1.6MB

MD5
cadcfa536fe60eb02c7ae5adfaab825a

SHA1
8e67aaae9c21d64e4a5cbcd958e7c9750fafb5fc

SHA256
8356b41cb2ccd6df4be8c67cec3aa393238151380c6986c699d05b5193bce545

SHA512
5b9537b683839a04d8c73b6dcfadc8ac1efdd06a4fb967393010133ce377f64fa75d2262c2574f5ba964e198b4bfd67969853d0e8159f71ff2b9d4c0d83b3dca

Download Submit
C:\Windows\system\cdXZHhZ.exe

Filesize
1.6MB

MD5
3c9cafb489133fb01c0a8d60c861b2d0

SHA1
5824ea6bc8f2b82ada85d76267e0bd6ceab6dcf7

SHA256
381230b628d7e0a93a42d94d50345a1eb42f3d2544e34b38b1f6c31c838912a3

SHA512
7921aec2f6130eec0023f6154af555c3f0673426a25f7bf00187e2581d26f505436a9b3e46ae4e87ca2ba3ca4f9fde800eae1cc276fc83e872ae3377c597f545

Download Submit
C:\Windows\system\ceiMCty.exe

Filesize
1.6MB

MD5
12a5c8f8699462d620ec3f7d78cd2689

SHA1
5355e4201682ae37ba5ef777a5560e2d81d36444

SHA256
51fc2925711aab5843a078fd5c45e854abb04a278f95da8cfcb9822ee91031c0

SHA512
b13534fb2c5ea08eee336ead62b7659a5d3354409c072532c30a7a293bef0c77edf232170b290310beddde34289e2e28e2ddf6587169357f1d7a389f60c7f24a

Download Submit
C:\Windows\system\eoaelrt.exe

Filesize
1.6MB

MD5
5bdc28611818cbca8af7b65bd8a7c4f9

SHA1
6ddf09adb991afc71f8fa9843b04a6f2fa33e2c9

SHA256
5760f885ecdbbfbc7bdf83e301cfd10600af883448610e8a3174cebae18d217d

SHA512
5060907b8c6016729b58d912d6158332ed27207d3d3c44d7ac4207ecf3a57017da59cbba83fb444c22f81b1466fa05febad15c9fc81c2c1e90dcd7f8647867e4

Download Submit
C:\Windows\system\jBBgoEH.exe

Filesize
1.6MB

MD5
e9dda38f23dc85b8336236cdd3e47087

SHA1
95909c53dc735195dc4889b4164ade1da8ee51b7

SHA256
1e110098eec5bb11bd86ff1082e97c72c67ca38281411bd6a769f9e1a39170e2

SHA512
1caf3e8ee2025256352aeeb4c12abeae752ae2689756388d69b93189ecc57a8c4edeed936b8dc28bc3aad0f8f658ab8db13bd5064e4a484c242ccf5ae63e21ea

Download Submit
C:\Windows\system\lOKQoIy.exe

Filesize
1.6MB

MD5
a1fa9c124b9206a070ed92196639a7ac

SHA1
5357deb3aad6300f1817afe459c11733808f2156

SHA256
e587e1e3dc06044b9e8aa2cebaabed1764319832fd59360c67373ac290fad98b

SHA512
16be16f50a593477a2964a824de507b5e4e432fd8620c85751a0d3f4b8db1e7b31700c8e67095e3bffbc7659ad5a9f6a5a342c166a340fce01135cb17846ac4e

Download Submit
C:\Windows\system\myMirXn.exe

Filesize
1.6MB

MD5
b8acec8ba8475aa1aa86116afced56f7

SHA1
5f1416c03f83855e907cf14c63ab4713b6a48c38

SHA256
539aeee17a25f4eba2aaa777e9b340bdc50fed70b22b80d0c8d002f7fc3afcee

SHA512
bfb15dd315c9c6ace2a1d73097cd6c4e323019d17d8079a514a9faf2f844fe2458676aa6139ede64169225ddaa5db8e933b76a151daaa49d2de5c6db30542939

Download Submit
C:\Windows\system\nsbfhvu.exe

Filesize
1.6MB

MD5
c9a659296f63fbb43cade4e4ac1316ee

SHA1
ae2fc37ef4aa2a54dc004a6a9ac58dfea145c83c

SHA256
7d4c40f6de44f82377ebc0d091104cba0d890fbdb98dff2ce201e6b46de44c6e

SHA512
b15d9720b979807c0961bb400454b053af9584fe60750862602028a21e7ea73b91ab0e8e19b738ef2cb298adc0aea45587a263ede9ac161fe9fbf7602abc357b

Download Submit
C:\Windows\system\oICowuX.exe

Filesize
1.6MB

MD5
baacbffca3d1f2cc3c054b2bfe19e403

SHA1
4c0818c3574cf603887d5aa148f8a17aa4366d4a

SHA256
647b819de59980df453ae993bdd0a684f2167cb71bf0f9e5f4a50a1ef68ca510

SHA512
db7740b314e86f671d34842a75d4967957bc079fa4b3b391c7765f7aa40fddbd9e78e5d25fbf9523655086b845b4fd1327f0c2c1d3300d466507a9386b07006b

Download Submit
C:\Windows\system\qQSKyYY.exe

Filesize
1.6MB

MD5
079704229249de6c4d93f0e125bb76d4

SHA1
27a48f336e91203bbacf4f537837bf6b39fe8e5e

SHA256
443b94f45db5692f1306a5b15a95f7c481e0063ab3baade8df2e04e13cd18da5

SHA512
4764cc9f6621d4038464ee90fca49d7567bb13faf35405dbd8550d5c2aa0c43b6c21936c6cb6abc4d4b6cccfee2815529f5fd3e3b6187c80ee1846541cbd460c

Download Submit
C:\Windows\system\sibyuPp.exe

Filesize
1.6MB

MD5
4b34ca6fd9f02e127f0c8d88e6da2557

SHA1
4d32e4a903793cd9ac68cc167bce84ab92fba752

SHA256
e23b012340d161be79b57a2057f3b935a01da98476246931a44198cf788ce335

SHA512
e3f46a3881186e18ea48001a9834e37d0798774130417acb17c5bd71fbabb1db87500b701e98e6b7bfb002d8a6e9d3b6298dc0a0a0810acb3f7c36d330e21a7b

Download Submit
C:\Windows\system\syuhGLy.exe

Filesize
1.6MB

MD5
5b313a4635743e164356b99992aa8b1f

SHA1
089b71dfff5485c130ecc7eaee5253ed0693aaee

SHA256
9a537d4eefabba962ad34e46aa2461a27e8b97e5a50ae9ac77c05f8766c702b9

SHA512
e6536371c7c4bdb19c26b56a70869ec5c96cc58f115426f32d44b2177dcca93f39c75459324a55fa661949c65a264807f418b83ff10376177ea8d317354161fb

Download Submit
C:\Windows\system\vEkucqn.exe

Filesize
1.6MB

MD5
ad96eca1eef4037adaedca897aec93a8

SHA1
f68543119c742669615d8124cff4133afd6e13b8

SHA256
28a1605b59c5c6d90b01fadfda8f379c2b30b9972325d605a2772781c82bcdc4

SHA512
bd3507c94af5944250282cee865b5b24cb94f2973ba2e2146c7fb8ad5fd65e467f1d2b7b787352a1d995708d50ad627dca8267378a7300a4f620f6a223dacd4c

Download Submit
\Windows\system\KpabAOq.exe

Filesize
1.6MB

MD5
36dd0dd2527d41b5fd4ff403b48f9e75

SHA1
3e89f7044116c7ccb57b2ef9f97cb0d747aea592

SHA256
f00b592b365dc0ea25ca3a74b8d4c8bfaeaffae784e3b4ad1a0a28589dc4a9c7

SHA512
c554a4f3bffb418dccf7c464b22bca655a43469fd8cfed588552891ba94da101a2ace02ddfb54a605c911678a99c5007aefc3b4f32b8e56d291c2be753fd0bee

Download Submit
\Windows\system\jEzpzmq.exe

Filesize
1.6MB

MD5
d58ab76f0ebaefaa172b44e2535c6b23

SHA1
203ade68e6f58d7887e53fb3b9d5eeb51e79b547

SHA256
256f5454814ae23976aa790283f51966a1a8d8524acf3d589e818458f11e091e

SHA512
1aaab9594ea709d90eb15b9a51d4c027dae23ffeec40c9fc59cf6d0f865d4f28efac7963bb6cd1858f972a1a7e764997366dda4585b8ae223833e7349e0c3fc6

Download Submit
memory/2240-830-0x0000000002030000-0x0000000002038000-memory.dmp

Filesize
32KB

Download
memory/2240-479-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/2564-84-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2604-124-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-107-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2680-110-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2696-109-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2956-118-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/2956-122-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-112-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2956-1-0x0000000001B20000-0x0000000001B30000-memory.dmp

Filesize
64KB

Download
memory/2956-126-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/2956-94-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/2956-128-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2956-119-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-121-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-111-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/2956-0-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/2956-123-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/2956-66-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/2956-120-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/2956-113-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/2956-125-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2956-108-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/2956-13-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-103-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download