xmrig | 550fba6017140157aff717c2f0c5718170eecc5b9340e5ba0a05a7312d1f51bd

Analysis

max time kernel
108s
max time network
100s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 22:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
Size

1.8MB
MD5

0a8a8f2fcbbc765fb1dee3726b23755d
SHA1

ea61a33676075cf0769074d301f39184ad73cd7a
SHA256

550fba6017140157aff717c2f0c5718170eecc5b9340e5ba0a05a7312d1f51bd
SHA512

e4c250c4549eec69e1044fd53adfb0c974ec2647e506b757ec99f1a988588b267affa6a6b8b15fb0eaf02159bdbf75d35600021d84c56080f740993f62a31bb5
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrltE:NABD

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 14 IoCs

miner

resource	yara_rule
behavioral1/memory/2816-9-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/2808-89-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig
behavioral1/memory/1432-90-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/1052-83-0x000000013F660000-0x000000013FA52000-memory.dmp	xmrig
behavioral1/memory/776-76-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2516-58-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig
behavioral1/memory/2356-57-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2988-69-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/2552-67-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2540-44-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2484-43-0x000000013FFE0000-0x00000001403D2000-memory.dmp	xmrig
behavioral1/memory/2440-26-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/2808-25-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/2424-23-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2816	TkRGCjm.exe
2424	iLhXeAS.exe
2440	BkpqqNQ.exe
2484	PHtPqWB.exe
2540	usKNuYK.exe
2356	ppmyTWf.exe
2516	qftpoHY.exe
2552	LGqkIhl.exe
2988	LIcSgDU.exe
776	xtZNdxI.exe
1052	ckWbPXZ.exe
1432	htFksZN.exe
572	DCZGUUw.exe
1476	POmSPta.exe
1932	ahTqDuH.exe
2288	ErlENIE.exe
2304	lODXhWt.exe
1940	lBoQthZ.exe
1360	ugIMpjF.exe
1928	ALFnHFM.exe
2020	XpXmQOV.exe
2164	Uocuzde.exe
884	kdenghn.exe
1592	YQothJB.exe
2592	HkXJnrN.exe
2584	NLZmBKh.exe
2960	RnXQcmD.exe
2748	yzoedmZ.exe
2244	CreUXWf.exe
2648	uWidOpJ.exe
1128	MrCAkOF.exe
1636	efxQEaT.exe
832	VLfEpYA.exe
1136	KVCHreH.exe
1572	nBFaTch.exe
1988	GYNteZg.exe
1160	ZauwTni.exe
1700	EHcuPle.exe
1580	tstfdym.exe
1968	vhGpBMX.exe
1972	RvDWQRs.exe
908	DTPOBTH.exe
604	UKpjObS.exe
3000	lelVFHH.exe
2948	kZwFYhR.exe
2928	zFopKDO.exe
2072	VQxaJBI.exe
3028	DUhuiRu.exe
2116	pMXHpat.exe
1764	vQvfcRC.exe
880	brWBJsz.exe
2264	yPYVCdZ.exe
2268	lZqqtAr.exe
1608	QHOsMtd.exe
1732	tLWSqsZ.exe
2680	GluSFpi.exe
2472	bomSSiH.exe
1556	qCyILBw.exe
2392	zOHaimk.exe
2096	YVnjaVo.exe
2692	pYrruQw.exe
2348	CZGhZJh.exe
1092	smkWQwl.exe
460	kLQtlnT.exe

Loads dropped DLL 64 IoCs

pid	Process
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2808-0-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/files/0x000b000000014fe1-3.dat	upx
behavioral1/memory/2816-9-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-60.dat	upx
behavioral1/files/0x0006000000016283-73.dat	upx
behavioral1/memory/2808-89-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/files/0x0006000000016b5e-108.dat	upx
behavioral1/files/0x0006000000016c90-132.dat	upx
behavioral1/files/0x0006000000016ca9-138.dat	upx
behavioral1/files/0x0006000000016d01-155.dat	upx
behavioral1/files/0x0006000000016d24-168.dat	upx
behavioral1/files/0x0006000000016d4f-188.dat	upx
behavioral1/files/0x0006000000016d4a-183.dat	upx
behavioral1/files/0x0006000000016d41-178.dat	upx
behavioral1/files/0x0006000000016d36-172.dat	upx
behavioral1/files/0x0006000000016d11-163.dat	upx
behavioral1/files/0x0006000000016cd4-148.dat	upx
behavioral1/files/0x0006000000016cf0-152.dat	upx
behavioral1/files/0x0006000000016c23-128.dat	upx
behavioral1/files/0x0006000000016ccf-142.dat	upx
behavioral1/files/0x0006000000016c10-118.dat	upx
behavioral1/files/0x0006000000016c1a-122.dat	upx
behavioral1/files/0x0006000000016b96-112.dat	upx
behavioral1/files/0x000600000001663d-98.dat	upx
behavioral1/files/0x00060000000167db-102.dat	upx
behavioral1/memory/1432-90-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/files/0x0006000000016476-86.dat	upx
behavioral1/files/0x00060000000165ae-93.dat	upx
behavioral1/memory/1052-83-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/memory/776-76-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/files/0x0006000000016332-79.dat	upx
behavioral1/memory/2516-58-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/memory/2356-57-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/memory/2988-69-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/memory/2552-67-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2540-44-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/2484-43-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/files/0x0009000000015c52-37.dat	upx
behavioral1/files/0x0007000000016042-63.dat	upx
behavioral1/memory/2440-26-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/2424-23-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/files/0x0007000000015c2f-21.dat	upx
behavioral1/files/0x000600000001604b-49.dat	upx
behavioral1/files/0x00090000000155e2-11.dat	upx
behavioral1/files/0x0007000000015c3c-31.dat	upx
behavioral1/files/0x0008000000015c23-17.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vhBfNHq.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\eoaUxrU.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\goNZpdz.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\FDrQVHn.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\lzevonx.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\LkPRZxb.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\HrFYQLh.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\ymrwFwK.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\iEXyVQN.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\SKqmNBr.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\VLfEpYA.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\tPfOylk.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\Rqavfgy.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\aqIxVUB.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\xasOvoQ.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\XjChlAn.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\GCllezQ.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\AMVLzRV.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\ovDgIwG.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\HdRmGXr.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\XPYKyWb.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\OxCyOUi.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\EkMosbz.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\cSitxxF.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\aTxecEq.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\ZqfJUzv.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\VbEQzKD.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\CXTVFtD.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\JZOihVm.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\TYZcwsS.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\bMqVTdG.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\dDbMoLV.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\auiReAu.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\unEHdIU.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\qACYMaF.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\SRsDjmZ.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\AgWmeLO.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\UWMKcNX.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\aPcgaFN.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\tqtpUhn.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\uYWeYsI.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\HsLxRgd.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\yHCrbYg.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\lpMuAUG.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\bkEJzng.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\fwikmTD.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\NLZmBKh.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\siQHTLi.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\RhOArco.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\CyNVZEf.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\DvAYMfO.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\IYeHbvh.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\nAwDuaO.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\uBdtWjh.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\bzOQgUp.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\CwMyxaf.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\penRgvF.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\EMOSPwb.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\dwfaBuG.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\tNVKNko.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\bESCvbk.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\AQKzdNj.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\DRCcRoI.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
File created	C:\Windows\System\fbORMAs.exe	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2216	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
Token: SeDebugPrivilege	2216	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2216	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	29
PID 2808 wrote to memory of 2216	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	29
PID 2808 wrote to memory of 2216	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	29
PID 2808 wrote to memory of 2816	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	30
PID 2808 wrote to memory of 2816	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	30
PID 2808 wrote to memory of 2816	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	30
PID 2808 wrote to memory of 2424	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	31
PID 2808 wrote to memory of 2424	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	31
PID 2808 wrote to memory of 2424	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	31
PID 2808 wrote to memory of 2440	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	32
PID 2808 wrote to memory of 2440	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	32
PID 2808 wrote to memory of 2440	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	32
PID 2808 wrote to memory of 2540	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	33
PID 2808 wrote to memory of 2540	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	33
PID 2808 wrote to memory of 2540	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	33
PID 2808 wrote to memory of 2484	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	34
PID 2808 wrote to memory of 2484	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	34
PID 2808 wrote to memory of 2484	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	34
PID 2808 wrote to memory of 2516	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	35
PID 2808 wrote to memory of 2516	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	35
PID 2808 wrote to memory of 2516	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	35
PID 2808 wrote to memory of 2356	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	36
PID 2808 wrote to memory of 2356	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	36
PID 2808 wrote to memory of 2356	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	36
PID 2808 wrote to memory of 2552	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	37
PID 2808 wrote to memory of 2552	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	37
PID 2808 wrote to memory of 2552	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	37
PID 2808 wrote to memory of 2988	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	38
PID 2808 wrote to memory of 2988	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	38
PID 2808 wrote to memory of 2988	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	38
PID 2808 wrote to memory of 776	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	39
PID 2808 wrote to memory of 776	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	39
PID 2808 wrote to memory of 776	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	39
PID 2808 wrote to memory of 1052	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	40
PID 2808 wrote to memory of 1052	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	40
PID 2808 wrote to memory of 1052	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	40
PID 2808 wrote to memory of 1432	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	41
PID 2808 wrote to memory of 1432	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	41
PID 2808 wrote to memory of 1432	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	41
PID 2808 wrote to memory of 572	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	42
PID 2808 wrote to memory of 572	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	42
PID 2808 wrote to memory of 572	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	42
PID 2808 wrote to memory of 1476	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	43
PID 2808 wrote to memory of 1476	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	43
PID 2808 wrote to memory of 1476	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	43
PID 2808 wrote to memory of 1932	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	44
PID 2808 wrote to memory of 1932	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	44
PID 2808 wrote to memory of 1932	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	44
PID 2808 wrote to memory of 2288	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	45
PID 2808 wrote to memory of 2288	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	45
PID 2808 wrote to memory of 2288	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	45
PID 2808 wrote to memory of 2304	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	46
PID 2808 wrote to memory of 2304	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	46
PID 2808 wrote to memory of 2304	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	46
PID 2808 wrote to memory of 1940	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	47
PID 2808 wrote to memory of 1940	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	47
PID 2808 wrote to memory of 1940	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	47
PID 2808 wrote to memory of 1360	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	48
PID 2808 wrote to memory of 1360	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	48
PID 2808 wrote to memory of 1360	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	48
PID 2808 wrote to memory of 1928	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	49
PID 2808 wrote to memory of 1928	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	49
PID 2808 wrote to memory of 1928	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	49
PID 2808 wrote to memory of 2020	2808	0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a8a8f2fcbbc765fb1dee3726b23755d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\System\TkRGCjm.exe
  C:\Windows\System\TkRGCjm.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\iLhXeAS.exe
  C:\Windows\System\iLhXeAS.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\BkpqqNQ.exe
  C:\Windows\System\BkpqqNQ.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\usKNuYK.exe
  C:\Windows\System\usKNuYK.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\PHtPqWB.exe
  C:\Windows\System\PHtPqWB.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\qftpoHY.exe
  C:\Windows\System\qftpoHY.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\ppmyTWf.exe
  C:\Windows\System\ppmyTWf.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\LGqkIhl.exe
  C:\Windows\System\LGqkIhl.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\LIcSgDU.exe
  C:\Windows\System\LIcSgDU.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\xtZNdxI.exe
  C:\Windows\System\xtZNdxI.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\ckWbPXZ.exe
  C:\Windows\System\ckWbPXZ.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\htFksZN.exe
  C:\Windows\System\htFksZN.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\DCZGUUw.exe
  C:\Windows\System\DCZGUUw.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\POmSPta.exe
  C:\Windows\System\POmSPta.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\ahTqDuH.exe
  C:\Windows\System\ahTqDuH.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\ErlENIE.exe
  C:\Windows\System\ErlENIE.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\lODXhWt.exe
  C:\Windows\System\lODXhWt.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\lBoQthZ.exe
  C:\Windows\System\lBoQthZ.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\ugIMpjF.exe
  C:\Windows\System\ugIMpjF.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\ALFnHFM.exe
  C:\Windows\System\ALFnHFM.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\XpXmQOV.exe
  C:\Windows\System\XpXmQOV.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\Uocuzde.exe
  C:\Windows\System\Uocuzde.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\kdenghn.exe
  C:\Windows\System\kdenghn.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\YQothJB.exe
  C:\Windows\System\YQothJB.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\HkXJnrN.exe
  C:\Windows\System\HkXJnrN.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\NLZmBKh.exe
  C:\Windows\System\NLZmBKh.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\RnXQcmD.exe
  C:\Windows\System\RnXQcmD.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\yzoedmZ.exe
  C:\Windows\System\yzoedmZ.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\CreUXWf.exe
  C:\Windows\System\CreUXWf.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\uWidOpJ.exe
  C:\Windows\System\uWidOpJ.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\MrCAkOF.exe
  C:\Windows\System\MrCAkOF.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\efxQEaT.exe
  C:\Windows\System\efxQEaT.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\VLfEpYA.exe
  C:\Windows\System\VLfEpYA.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\KVCHreH.exe
  C:\Windows\System\KVCHreH.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\nBFaTch.exe
  C:\Windows\System\nBFaTch.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\GYNteZg.exe
  C:\Windows\System\GYNteZg.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\ZauwTni.exe
  C:\Windows\System\ZauwTni.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\EHcuPle.exe
  C:\Windows\System\EHcuPle.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\tstfdym.exe
  C:\Windows\System\tstfdym.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\vhGpBMX.exe
  C:\Windows\System\vhGpBMX.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\RvDWQRs.exe
  C:\Windows\System\RvDWQRs.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\DTPOBTH.exe
  C:\Windows\System\DTPOBTH.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\UKpjObS.exe
  C:\Windows\System\UKpjObS.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\lelVFHH.exe
  C:\Windows\System\lelVFHH.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\kZwFYhR.exe
  C:\Windows\System\kZwFYhR.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\zFopKDO.exe
  C:\Windows\System\zFopKDO.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\VQxaJBI.exe
  C:\Windows\System\VQxaJBI.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\DUhuiRu.exe
  C:\Windows\System\DUhuiRu.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\pMXHpat.exe
  C:\Windows\System\pMXHpat.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\vQvfcRC.exe
  C:\Windows\System\vQvfcRC.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\brWBJsz.exe
  C:\Windows\System\brWBJsz.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\yPYVCdZ.exe
  C:\Windows\System\yPYVCdZ.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\lZqqtAr.exe
  C:\Windows\System\lZqqtAr.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\QHOsMtd.exe
  C:\Windows\System\QHOsMtd.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\tLWSqsZ.exe
  C:\Windows\System\tLWSqsZ.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\GluSFpi.exe
  C:\Windows\System\GluSFpi.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\bomSSiH.exe
  C:\Windows\System\bomSSiH.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\qCyILBw.exe
  C:\Windows\System\qCyILBw.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\zOHaimk.exe
  C:\Windows\System\zOHaimk.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\YVnjaVo.exe
  C:\Windows\System\YVnjaVo.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\pYrruQw.exe
  C:\Windows\System\pYrruQw.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\CZGhZJh.exe
  C:\Windows\System\CZGhZJh.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\smkWQwl.exe
  C:\Windows\System\smkWQwl.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\kLQtlnT.exe
  C:\Windows\System\kLQtlnT.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\jVgQkjr.exe
  C:\Windows\System\jVgQkjr.exe
  2⤵
  PID:536
- C:\Windows\System\HggyuwU.exe
  C:\Windows\System\HggyuwU.exe
  2⤵
  PID:948
- C:\Windows\System\qqxHKGu.exe
  C:\Windows\System\qqxHKGu.exe
  2⤵
  PID:2300
- C:\Windows\System\aIMlmPP.exe
  C:\Windows\System\aIMlmPP.exe
  2⤵
  PID:1960
- C:\Windows\System\fUZUcvK.exe
  C:\Windows\System\fUZUcvK.exe
  2⤵
  PID:2284
- C:\Windows\System\WKSwDkA.exe
  C:\Windows\System\WKSwDkA.exe
  2⤵
  PID:1756
- C:\Windows\System\wouPzPo.exe
  C:\Windows\System\wouPzPo.exe
  2⤵
  PID:940
- C:\Windows\System\qUkluoz.exe
  C:\Windows\System\qUkluoz.exe
  2⤵
  PID:3064
- C:\Windows\System\IBnBjKp.exe
  C:\Windows\System\IBnBjKp.exe
  2⤵
  PID:2656
- C:\Windows\System\jMvzjbI.exe
  C:\Windows\System\jMvzjbI.exe
  2⤵
  PID:2256
- C:\Windows\System\kxHZeyH.exe
  C:\Windows\System\kxHZeyH.exe
  2⤵
  PID:2720
- C:\Windows\System\IQypbGD.exe
  C:\Windows\System\IQypbGD.exe
  2⤵
  PID:2908
- C:\Windows\System\xQssxBT.exe
  C:\Windows\System\xQssxBT.exe
  2⤵
  PID:836
- C:\Windows\System\EsOdirQ.exe
  C:\Windows\System\EsOdirQ.exe
  2⤵
  PID:1924
- C:\Windows\System\xpNxukt.exe
  C:\Windows\System\xpNxukt.exe
  2⤵
  PID:1620
- C:\Windows\System\EQmklCW.exe
  C:\Windows\System\EQmklCW.exe
  2⤵
  PID:976
- C:\Windows\System\GjeLgVj.exe
  C:\Windows\System\GjeLgVj.exe
  2⤵
  PID:1980
- C:\Windows\System\skwYLad.exe
  C:\Windows\System\skwYLad.exe
  2⤵
  PID:1964
- C:\Windows\System\fynDRXQ.exe
  C:\Windows\System\fynDRXQ.exe
  2⤵
  PID:568
- C:\Windows\System\fRurQEU.exe
  C:\Windows\System\fRurQEU.exe
  2⤵
  PID:2456
- C:\Windows\System\ALDPYCf.exe
  C:\Windows\System\ALDPYCf.exe
  2⤵
  PID:864
- C:\Windows\System\OzleHYj.exe
  C:\Windows\System\OzleHYj.exe
  2⤵
  PID:1508
- C:\Windows\System\qoTXfyp.exe
  C:\Windows\System\qoTXfyp.exe
  2⤵
  PID:584
- C:\Windows\System\tPfOylk.exe
  C:\Windows\System\tPfOylk.exe
  2⤵
  PID:292
- C:\Windows\System\mCwDBeM.exe
  C:\Windows\System\mCwDBeM.exe
  2⤵
  PID:2920
- C:\Windows\System\GCNdymj.exe
  C:\Windows\System\GCNdymj.exe
  2⤵
  PID:2236
- C:\Windows\System\cbBoXaj.exe
  C:\Windows\System\cbBoXaj.exe
  2⤵
  PID:2052
- C:\Windows\System\zLDCQiZ.exe
  C:\Windows\System\zLDCQiZ.exe
  2⤵
  PID:1612
- C:\Windows\System\qkHWLLc.exe
  C:\Windows\System\qkHWLLc.exe
  2⤵
  PID:2840
- C:\Windows\System\BdlWQuB.exe
  C:\Windows\System\BdlWQuB.exe
  2⤵
  PID:2620
- C:\Windows\System\oXuJpPo.exe
  C:\Windows\System\oXuJpPo.exe
  2⤵
  PID:2344
- C:\Windows\System\zSDsKQq.exe
  C:\Windows\System\zSDsKQq.exe
  2⤵
  PID:1252
- C:\Windows\System\xKkIgTO.exe
  C:\Windows\System\xKkIgTO.exe
  2⤵
  PID:1308
- C:\Windows\System\YAVlCOq.exe
  C:\Windows\System\YAVlCOq.exe
  2⤵
  PID:2136
- C:\Windows\System\SJFaSRx.exe
  C:\Windows\System\SJFaSRx.exe
  2⤵
  PID:936
- C:\Windows\System\Kmfbomy.exe
  C:\Windows\System\Kmfbomy.exe
  2⤵
  PID:1772
- C:\Windows\System\lTwPaZe.exe
  C:\Windows\System\lTwPaZe.exe
  2⤵
  PID:2428
- C:\Windows\System\tUzuLUi.exe
  C:\Windows\System\tUzuLUi.exe
  2⤵
  PID:1100
- C:\Windows\System\HdGcpph.exe
  C:\Windows\System\HdGcpph.exe
  2⤵
  PID:1108
- C:\Windows\System\Utgprix.exe
  C:\Windows\System\Utgprix.exe
  2⤵
  PID:1564
- C:\Windows\System\FTYNTBf.exe
  C:\Windows\System\FTYNTBf.exe
  2⤵
  PID:980
- C:\Windows\System\hMgQfLG.exe
  C:\Windows\System\hMgQfLG.exe
  2⤵
  PID:1668
- C:\Windows\System\UAQWyvv.exe
  C:\Windows\System\UAQWyvv.exe
  2⤵
  PID:1676
- C:\Windows\System\DQPeFtP.exe
  C:\Windows\System\DQPeFtP.exe
  2⤵
  PID:2740
- C:\Windows\System\YNIawFe.exe
  C:\Windows\System\YNIawFe.exe
  2⤵
  PID:1816
- C:\Windows\System\OiKTJKO.exe
  C:\Windows\System\OiKTJKO.exe
  2⤵
  PID:1768
- C:\Windows\System\EaTAyPv.exe
  C:\Windows\System\EaTAyPv.exe
  2⤵
  PID:1896
- C:\Windows\System\QuZDfRI.exe
  C:\Windows\System\QuZDfRI.exe
  2⤵
  PID:2616
- C:\Windows\System\LzmtSTo.exe
  C:\Windows\System\LzmtSTo.exe
  2⤵
  PID:2728
- C:\Windows\System\jSfitND.exe
  C:\Windows\System\jSfitND.exe
  2⤵
  PID:2892
- C:\Windows\System\tkGHIYT.exe
  C:\Windows\System\tkGHIYT.exe
  2⤵
  PID:2184
- C:\Windows\System\iypsgnq.exe
  C:\Windows\System\iypsgnq.exe
  2⤵
  PID:2372
- C:\Windows\System\lbcYKyM.exe
  C:\Windows\System\lbcYKyM.exe
  2⤵
  PID:1540
- C:\Windows\System\uPmXurq.exe
  C:\Windows\System\uPmXurq.exe
  2⤵
  PID:2200
- C:\Windows\System\ZpZqpCz.exe
  C:\Windows\System\ZpZqpCz.exe
  2⤵
  PID:1920
- C:\Windows\System\FPhSVce.exe
  C:\Windows\System\FPhSVce.exe
  2⤵
  PID:2672
- C:\Windows\System\hSJvUFU.exe
  C:\Windows\System\hSJvUFU.exe
  2⤵
  PID:2432
- C:\Windows\System\TaYIlWu.exe
  C:\Windows\System\TaYIlWu.exe
  2⤵
  PID:1808
- C:\Windows\System\eahvaUY.exe
  C:\Windows\System\eahvaUY.exe
  2⤵
  PID:1916
- C:\Windows\System\YcXnASD.exe
  C:\Windows\System\YcXnASD.exe
  2⤵
  PID:1336
- C:\Windows\System\PTwoklS.exe
  C:\Windows\System\PTwoklS.exe
  2⤵
  PID:2848
- C:\Windows\System\EXiiScg.exe
  C:\Windows\System\EXiiScg.exe
  2⤵
  PID:2668
- C:\Windows\System\JnDmbkg.exe
  C:\Windows\System\JnDmbkg.exe
  2⤵
  PID:2596
- C:\Windows\System\iWIWEPN.exe
  C:\Windows\System\iWIWEPN.exe
  2⤵
  PID:2520
- C:\Windows\System\suxiRth.exe
  C:\Windows\System\suxiRth.exe
  2⤵
  PID:1656
- C:\Windows\System\fiTPIjB.exe
  C:\Windows\System\fiTPIjB.exe
  2⤵
  PID:2176
- C:\Windows\System\bySqLng.exe
  C:\Windows\System\bySqLng.exe
  2⤵
  PID:1680
- C:\Windows\System\vOFCaGR.exe
  C:\Windows\System\vOFCaGR.exe
  2⤵
  PID:2160
- C:\Windows\System\mGhAUOF.exe
  C:\Windows\System\mGhAUOF.exe
  2⤵
  PID:2704
- C:\Windows\System\MchyAuc.exe
  C:\Windows\System\MchyAuc.exe
  2⤵
  PID:528
- C:\Windows\System\VBAkWCB.exe
  C:\Windows\System\VBAkWCB.exe
  2⤵
  PID:2060
- C:\Windows\System\NqPYLWD.exe
  C:\Windows\System\NqPYLWD.exe
  2⤵
  PID:1840
- C:\Windows\System\vhBfNHq.exe
  C:\Windows\System\vhBfNHq.exe
  2⤵
  PID:812
- C:\Windows\System\OxCyOUi.exe
  C:\Windows\System\OxCyOUi.exe
  2⤵
  PID:2788
- C:\Windows\System\PLACzMj.exe
  C:\Windows\System\PLACzMj.exe
  2⤵
  PID:2532
- C:\Windows\System\BCiqywa.exe
  C:\Windows\System\BCiqywa.exe
  2⤵
  PID:2448
- C:\Windows\System\LgYLQZF.exe
  C:\Windows\System\LgYLQZF.exe
  2⤵
  PID:2632
- C:\Windows\System\WkBLtzG.exe
  C:\Windows\System\WkBLtzG.exe
  2⤵
  PID:1536
- C:\Windows\System\OgjlZAT.exe
  C:\Windows\System\OgjlZAT.exe
  2⤵
  PID:1068
- C:\Windows\System\JXATrsr.exe
  C:\Windows\System\JXATrsr.exe
  2⤵
  PID:1844
- C:\Windows\System\RIrWbxC.exe
  C:\Windows\System\RIrWbxC.exe
  2⤵
  PID:1752
- C:\Windows\System\OQAqDdb.exe
  C:\Windows\System\OQAqDdb.exe
  2⤵
  PID:1796
- C:\Windows\System\bKvhHSF.exe
  C:\Windows\System\bKvhHSF.exe
  2⤵
  PID:2896
- C:\Windows\System\oddIHEa.exe
  C:\Windows\System\oddIHEa.exe
  2⤵
  PID:1948
- C:\Windows\System\Ymftiqj.exe
  C:\Windows\System\Ymftiqj.exe
  2⤵
  PID:2228
- C:\Windows\System\BdwDzkE.exe
  C:\Windows\System\BdwDzkE.exe
  2⤵
  PID:2252
- C:\Windows\System\mavoFsp.exe
  C:\Windows\System\mavoFsp.exe
  2⤵
  PID:1736
- C:\Windows\System\iUHalPJ.exe
  C:\Windows\System\iUHalPJ.exe
  2⤵
  PID:2796
- C:\Windows\System\gjwIThf.exe
  C:\Windows\System\gjwIThf.exe
  2⤵
  PID:2276
- C:\Windows\System\DOmelJw.exe
  C:\Windows\System\DOmelJw.exe
  2⤵
  PID:2128
- C:\Windows\System\CQRmLye.exe
  C:\Windows\System\CQRmLye.exe
  2⤵
  PID:1660
- C:\Windows\System\CtgSKYC.exe
  C:\Windows\System\CtgSKYC.exe
  2⤵
  PID:2000
- C:\Windows\System\CWUPYZz.exe
  C:\Windows\System\CWUPYZz.exe
  2⤵
  PID:2336
- C:\Windows\System\qyFrtZq.exe
  C:\Windows\System\qyFrtZq.exe
  2⤵
  PID:3080
- C:\Windows\System\OmcvqSQ.exe
  C:\Windows\System\OmcvqSQ.exe
  2⤵
  PID:3096
- C:\Windows\System\UukyaNQ.exe
  C:\Windows\System\UukyaNQ.exe
  2⤵
  PID:3112
- C:\Windows\System\gQRMHnk.exe
  C:\Windows\System\gQRMHnk.exe
  2⤵
  PID:3128
- C:\Windows\System\LpBNOYU.exe
  C:\Windows\System\LpBNOYU.exe
  2⤵
  PID:3144
- C:\Windows\System\ULiUelL.exe
  C:\Windows\System\ULiUelL.exe
  2⤵
  PID:3160
- C:\Windows\System\RSHitgg.exe
  C:\Windows\System\RSHitgg.exe
  2⤵
  PID:3204
- C:\Windows\System\ISmnHiF.exe
  C:\Windows\System\ISmnHiF.exe
  2⤵
  PID:3220
- C:\Windows\System\DDaDDNn.exe
  C:\Windows\System\DDaDDNn.exe
  2⤵
  PID:3240
- C:\Windows\System\rWJRoEp.exe
  C:\Windows\System\rWJRoEp.exe
  2⤵
  PID:3256
- C:\Windows\System\hSrPeLa.exe
  C:\Windows\System\hSrPeLa.exe
  2⤵
  PID:3272
- C:\Windows\System\GfjvmmT.exe
  C:\Windows\System\GfjvmmT.exe
  2⤵
  PID:3288
- C:\Windows\System\vpNUcub.exe
  C:\Windows\System\vpNUcub.exe
  2⤵
  PID:3304
- C:\Windows\System\buYMYbT.exe
  C:\Windows\System\buYMYbT.exe
  2⤵
  PID:3320
- C:\Windows\System\iqUGUQc.exe
  C:\Windows\System\iqUGUQc.exe
  2⤵
  PID:3336
- C:\Windows\System\fzNJpxt.exe
  C:\Windows\System\fzNJpxt.exe
  2⤵
  PID:3352
- C:\Windows\System\TPuFzuz.exe
  C:\Windows\System\TPuFzuz.exe
  2⤵
  PID:3372
- C:\Windows\System\eyMiOJK.exe
  C:\Windows\System\eyMiOJK.exe
  2⤵
  PID:3388
- C:\Windows\System\oFlfuEU.exe
  C:\Windows\System\oFlfuEU.exe
  2⤵
  PID:3404
- C:\Windows\System\yBfPLVv.exe
  C:\Windows\System\yBfPLVv.exe
  2⤵
  PID:3420
- C:\Windows\System\EZIvUoy.exe
  C:\Windows\System\EZIvUoy.exe
  2⤵
  PID:3440
- C:\Windows\System\PiCkxiR.exe
  C:\Windows\System\PiCkxiR.exe
  2⤵
  PID:3456
- C:\Windows\System\kVonWNL.exe
  C:\Windows\System\kVonWNL.exe
  2⤵
  PID:3472
- C:\Windows\System\FDrQVHn.exe
  C:\Windows\System\FDrQVHn.exe
  2⤵
  PID:3488
- C:\Windows\System\OzRZMZI.exe
  C:\Windows\System\OzRZMZI.exe
  2⤵
  PID:3504
- C:\Windows\System\XHeTGRI.exe
  C:\Windows\System\XHeTGRI.exe
  2⤵
  PID:3520
- C:\Windows\System\sWKNzGJ.exe
  C:\Windows\System\sWKNzGJ.exe
  2⤵
  PID:3536
- C:\Windows\System\ZaORpma.exe
  C:\Windows\System\ZaORpma.exe
  2⤵
  PID:3552
- C:\Windows\System\IXjShbq.exe
  C:\Windows\System\IXjShbq.exe
  2⤵
  PID:3568
- C:\Windows\System\kMmCblC.exe
  C:\Windows\System\kMmCblC.exe
  2⤵
  PID:3584
- C:\Windows\System\ymSPCoO.exe
  C:\Windows\System\ymSPCoO.exe
  2⤵
  PID:3600
- C:\Windows\System\APmnwOG.exe
  C:\Windows\System\APmnwOG.exe
  2⤵
  PID:3616
- C:\Windows\System\ncgokbH.exe
  C:\Windows\System\ncgokbH.exe
  2⤵
  PID:3632
- C:\Windows\System\EDYOSZo.exe
  C:\Windows\System\EDYOSZo.exe
  2⤵
  PID:3648
- C:\Windows\System\rOEtMyS.exe
  C:\Windows\System\rOEtMyS.exe
  2⤵
  PID:3664
- C:\Windows\System\DakQlzv.exe
  C:\Windows\System\DakQlzv.exe
  2⤵
  PID:3680
- C:\Windows\System\Phrnbdk.exe
  C:\Windows\System\Phrnbdk.exe
  2⤵
  PID:3700
- C:\Windows\System\jafDiWr.exe
  C:\Windows\System\jafDiWr.exe
  2⤵
  PID:3716
- C:\Windows\System\PEZOuDw.exe
  C:\Windows\System\PEZOuDw.exe
  2⤵
  PID:3732
- C:\Windows\System\RheFmVQ.exe
  C:\Windows\System\RheFmVQ.exe
  2⤵
  PID:3748
- C:\Windows\System\rxahyFp.exe
  C:\Windows\System\rxahyFp.exe
  2⤵
  PID:3764
- C:\Windows\System\cFhaNHf.exe
  C:\Windows\System\cFhaNHf.exe
  2⤵
  PID:3780
- C:\Windows\System\UFqllvd.exe
  C:\Windows\System\UFqllvd.exe
  2⤵
  PID:3796
- C:\Windows\System\Xtuiccw.exe
  C:\Windows\System\Xtuiccw.exe
  2⤵
  PID:3812
- C:\Windows\System\rnlbUcr.exe
  C:\Windows\System\rnlbUcr.exe
  2⤵
  PID:3832
- C:\Windows\System\zdKoFJC.exe
  C:\Windows\System\zdKoFJC.exe
  2⤵
  PID:3848
- C:\Windows\System\LDQPNXa.exe
  C:\Windows\System\LDQPNXa.exe
  2⤵
  PID:3864
- C:\Windows\System\wUlWIdh.exe
  C:\Windows\System\wUlWIdh.exe
  2⤵
  PID:3880
- C:\Windows\System\KgvVLLK.exe
  C:\Windows\System\KgvVLLK.exe
  2⤵
  PID:3896
- C:\Windows\System\kuzRXJj.exe
  C:\Windows\System\kuzRXJj.exe
  2⤵
  PID:3916
- C:\Windows\System\NaCrzMn.exe
  C:\Windows\System\NaCrzMn.exe
  2⤵
  PID:3932
- C:\Windows\System\BbTqlCG.exe
  C:\Windows\System\BbTqlCG.exe
  2⤵
  PID:3948
- C:\Windows\System\IZNGlos.exe
  C:\Windows\System\IZNGlos.exe
  2⤵
  PID:3964
- C:\Windows\System\fuDtuIo.exe
  C:\Windows\System\fuDtuIo.exe
  2⤵
  PID:3980
- C:\Windows\System\qJwMLqn.exe
  C:\Windows\System\qJwMLqn.exe
  2⤵
  PID:3996
- C:\Windows\System\MXAzlcW.exe
  C:\Windows\System\MXAzlcW.exe
  2⤵
  PID:4012
- C:\Windows\System\CKfzHFO.exe
  C:\Windows\System\CKfzHFO.exe
  2⤵
  PID:4028
- C:\Windows\System\HjOQWkd.exe
  C:\Windows\System\HjOQWkd.exe
  2⤵
  PID:4044
- C:\Windows\System\jVkASxm.exe
  C:\Windows\System\jVkASxm.exe
  2⤵
  PID:4060
- C:\Windows\System\yzaqwiv.exe
  C:\Windows\System\yzaqwiv.exe
  2⤵
  PID:4080
- C:\Windows\System\wsIRCTA.exe
  C:\Windows\System\wsIRCTA.exe
  2⤵
  PID:1196
- C:\Windows\System\MCFehBI.exe
  C:\Windows\System\MCFehBI.exe
  2⤵
  PID:1596
- C:\Windows\System\vLYWDCI.exe
  C:\Windows\System\vLYWDCI.exe
  2⤵
  PID:1648
- C:\Windows\System\dZGpnpV.exe
  C:\Windows\System\dZGpnpV.exe
  2⤵
  PID:3076
- C:\Windows\System\ojtYSNj.exe
  C:\Windows\System\ojtYSNj.exe
  2⤵
  PID:3088
- C:\Windows\System\mbhxqtB.exe
  C:\Windows\System\mbhxqtB.exe
  2⤵
  PID:1780
- C:\Windows\System\hHHLPZQ.exe
  C:\Windows\System\hHHLPZQ.exe
  2⤵
  PID:1184
- C:\Windows\System\DCnodVn.exe
  C:\Windows\System\DCnodVn.exe
  2⤵
  PID:3120
- C:\Windows\System\FrZoMuE.exe
  C:\Windows\System\FrZoMuE.exe
  2⤵
  PID:2736
- C:\Windows\System\uusdwUw.exe
  C:\Windows\System\uusdwUw.exe
  2⤵
  PID:2420
- C:\Windows\System\BeyQTEL.exe
  C:\Windows\System\BeyQTEL.exe
  2⤵
  PID:3176
- C:\Windows\System\jBiSaje.exe
  C:\Windows\System\jBiSaje.exe
  2⤵
  PID:3192
- C:\Windows\System\vKPsqyc.exe
  C:\Windows\System\vKPsqyc.exe
  2⤵
  PID:3228
- C:\Windows\System\EyYqqxd.exe
  C:\Windows\System\EyYqqxd.exe
  2⤵
  PID:3236
- C:\Windows\System\KszbXsC.exe
  C:\Windows\System\KszbXsC.exe
  2⤵
  PID:3300
- C:\Windows\System\ueVKEwr.exe
  C:\Windows\System\ueVKEwr.exe
  2⤵
  PID:3328
- C:\Windows\System\dUGbWjk.exe
  C:\Windows\System\dUGbWjk.exe
  2⤵
  PID:3360
- C:\Windows\System\SRsDjmZ.exe
  C:\Windows\System\SRsDjmZ.exe
  2⤵
  PID:3364
- C:\Windows\System\HKHzSMe.exe
  C:\Windows\System\HKHzSMe.exe
  2⤵
  PID:3396
- C:\Windows\System\aLeiswy.exe
  C:\Windows\System\aLeiswy.exe
  2⤵
  PID:3348
- C:\Windows\System\WmJglrh.exe
  C:\Windows\System\WmJglrh.exe
  2⤵
  PID:668
- C:\Windows\System\AesAvVy.exe
  C:\Windows\System\AesAvVy.exe
  2⤵
  PID:324
- C:\Windows\System\YihUCyv.exe
  C:\Windows\System\YihUCyv.exe
  2⤵
  PID:3500
- C:\Windows\System\HiydbRP.exe
  C:\Windows\System\HiydbRP.exe
  2⤵
  PID:1212
- C:\Windows\System\jpxqEGs.exe
  C:\Windows\System\jpxqEGs.exe
  2⤵
  PID:3452
- C:\Windows\System\Rqavfgy.exe
  C:\Windows\System\Rqavfgy.exe
  2⤵
  PID:3512
- C:\Windows\System\vCFxnpx.exe
  C:\Windows\System\vCFxnpx.exe
  2⤵
  PID:3544
- C:\Windows\System\ZgjGhLl.exe
  C:\Windows\System\ZgjGhLl.exe
  2⤵
  PID:3608
- C:\Windows\System\wpuIdBf.exe
  C:\Windows\System\wpuIdBf.exe
  2⤵
  PID:3656
- C:\Windows\System\HAKPMtT.exe
  C:\Windows\System\HAKPMtT.exe
  2⤵
  PID:1616
- C:\Windows\System\bazWiYX.exe
  C:\Windows\System\bazWiYX.exe
  2⤵
  PID:3756
- C:\Windows\System\XqFnObU.exe
  C:\Windows\System\XqFnObU.exe
  2⤵
  PID:3708
- C:\Windows\System\EhziSmJ.exe
  C:\Windows\System\EhziSmJ.exe
  2⤵
  PID:3792
- C:\Windows\System\WThrFqP.exe
  C:\Windows\System\WThrFqP.exe
  2⤵
  PID:3820
- C:\Windows\System\pcPXHTK.exe
  C:\Windows\System\pcPXHTK.exe
  2⤵
  PID:3808
- C:\Windows\System\FVklZCi.exe
  C:\Windows\System\FVklZCi.exe
  2⤵
  PID:3844
- C:\Windows\System\AEstpET.exe
  C:\Windows\System\AEstpET.exe
  2⤵
  PID:3924
- C:\Windows\System\ofkesvN.exe
  C:\Windows\System\ofkesvN.exe
  2⤵
  PID:3960
- C:\Windows\System\rANOSki.exe
  C:\Windows\System\rANOSki.exe
  2⤵
  PID:4052
- C:\Windows\System\AgWmeLO.exe
  C:\Windows\System\AgWmeLO.exe
  2⤵
  PID:3912
- C:\Windows\System\LlQYvaO.exe
  C:\Windows\System\LlQYvaO.exe
  2⤵
  PID:4004
- C:\Windows\System\WswODli.exe
  C:\Windows\System\WswODli.exe
  2⤵
  PID:4056
- C:\Windows\System\rmTHpBH.exe
  C:\Windows\System\rmTHpBH.exe
  2⤵
  PID:2132
- C:\Windows\System\ICwtOTA.exe
  C:\Windows\System\ICwtOTA.exe
  2⤵
  PID:2904
- C:\Windows\System\USTPvtP.exe
  C:\Windows\System\USTPvtP.exe
  2⤵
  PID:3200
- C:\Windows\System\YlBLTIa.exe
  C:\Windows\System\YlBLTIa.exe
  2⤵
  PID:2024
- C:\Windows\System\emmgZnK.exe
  C:\Windows\System\emmgZnK.exe
  2⤵
  PID:3296
- C:\Windows\System\JjJRuHu.exe
  C:\Windows\System\JjJRuHu.exe
  2⤵
  PID:3344
- C:\Windows\System\xbhvCMi.exe
  C:\Windows\System\xbhvCMi.exe
  2⤵
  PID:3428
- C:\Windows\System\ytVptNs.exe
  C:\Windows\System\ytVptNs.exe
  2⤵
  PID:2712
- C:\Windows\System\OblkfUW.exe
  C:\Windows\System\OblkfUW.exe
  2⤵
  PID:3184
- C:\Windows\System\heTeavo.exe
  C:\Windows\System\heTeavo.exe
  2⤵
  PID:3212
- C:\Windows\System\DvvgBxS.exe
  C:\Windows\System\DvvgBxS.exe
  2⤵
  PID:3516
- C:\Windows\System\QrqxdEL.exe
  C:\Windows\System\QrqxdEL.exe
  2⤵
  PID:3252
- C:\Windows\System\MXxuAsZ.exe
  C:\Windows\System\MXxuAsZ.exe
  2⤵
  PID:904
- C:\Windows\System\zuurjcK.exe
  C:\Windows\System\zuurjcK.exe
  2⤵
  PID:3728
- C:\Windows\System\ygfQECT.exe
  C:\Windows\System\ygfQECT.exe
  2⤵
  PID:3560
- C:\Windows\System\ywMaTea.exe
  C:\Windows\System\ywMaTea.exe
  2⤵
  PID:3532
- C:\Windows\System\PwJdWgm.exe
  C:\Windows\System\PwJdWgm.exe
  2⤵
  PID:3776
- C:\Windows\System\YQmKyqf.exe
  C:\Windows\System\YQmKyqf.exe
  2⤵
  PID:3892
- C:\Windows\System\kmAQKAR.exe
  C:\Windows\System\kmAQKAR.exe
  2⤵
  PID:1912
- C:\Windows\System\lAnMoIm.exe
  C:\Windows\System\lAnMoIm.exe
  2⤵
  PID:3944
- C:\Windows\System\TsNLwup.exe
  C:\Windows\System\TsNLwup.exe
  2⤵
  PID:3840
- C:\Windows\System\jqLcdUI.exe
  C:\Windows\System\jqLcdUI.exe
  2⤵
  PID:3856
- C:\Windows\System\JSiOYUK.exe
  C:\Windows\System\JSiOYUK.exe
  2⤵
  PID:3152
- C:\Windows\System\uRGZkrw.exe
  C:\Windows\System\uRGZkrw.exe
  2⤵
  PID:3248
- C:\Windows\System\dwfaBuG.exe
  C:\Windows\System\dwfaBuG.exe
  2⤵
  PID:2752
- C:\Windows\System\kEZGTkR.exe
  C:\Windows\System\kEZGTkR.exe
  2⤵
  PID:2032
- C:\Windows\System\AzLGryV.exe
  C:\Windows\System\AzLGryV.exe
  2⤵
  PID:4072
- C:\Windows\System\zIMYStK.exe
  C:\Windows\System\zIMYStK.exe
  2⤵
  PID:3380
- C:\Windows\System\mheZlhn.exe
  C:\Windows\System\mheZlhn.exe
  2⤵
  PID:3432
- C:\Windows\System\liNsbHa.exe
  C:\Windows\System\liNsbHa.exe
  2⤵
  PID:3108
- C:\Windows\System\elWJEPI.exe
  C:\Windows\System\elWJEPI.exe
  2⤵
  PID:3888
- C:\Windows\System\ffGjXmE.exe
  C:\Windows\System\ffGjXmE.exe
  2⤵
  PID:3580
- C:\Windows\System\SQQbEAH.exe
  C:\Windows\System\SQQbEAH.exe
  2⤵
  PID:2556
- C:\Windows\System\dqtDWGq.exe
  C:\Windows\System\dqtDWGq.exe
  2⤵
  PID:2196
- C:\Windows\System\pYKUhFS.exe
  C:\Windows\System\pYKUhFS.exe
  2⤵
  PID:3956
- C:\Windows\System\LCVUwbe.exe
  C:\Windows\System\LCVUwbe.exe
  2⤵
  PID:2568
- C:\Windows\System\CTDCGLR.exe
  C:\Windows\System\CTDCGLR.exe
  2⤵
  PID:3140
- C:\Windows\System\SQipacj.exe
  C:\Windows\System\SQipacj.exe
  2⤵
  PID:3416
- C:\Windows\System\SAtkZoW.exe
  C:\Windows\System\SAtkZoW.exe
  2⤵
  PID:2172
- C:\Windows\System\pKVpAnC.exe
  C:\Windows\System\pKVpAnC.exe
  2⤵
  PID:2996
- C:\Windows\System\hKZtQxt.exe
  C:\Windows\System\hKZtQxt.exe
  2⤵
  PID:3468
- C:\Windows\System\tjIdhay.exe
  C:\Windows\System\tjIdhay.exe
  2⤵
  PID:680
- C:\Windows\System\yhXafyz.exe
  C:\Windows\System\yhXafyz.exe
  2⤵
  PID:2396
- C:\Windows\System\NpGOXiK.exe
  C:\Windows\System\NpGOXiK.exe
  2⤵
  PID:2180
- C:\Windows\System\TnyMMrd.exe
  C:\Windows\System\TnyMMrd.exe
  2⤵
  PID:4112
- C:\Windows\System\KSgPjyc.exe
  C:\Windows\System\KSgPjyc.exe
  2⤵
  PID:4128
- C:\Windows\System\XOnnGgx.exe
  C:\Windows\System\XOnnGgx.exe
  2⤵
  PID:4148
- C:\Windows\System\fursXBh.exe
  C:\Windows\System\fursXBh.exe
  2⤵
  PID:4164
- C:\Windows\System\sOOUAeA.exe
  C:\Windows\System\sOOUAeA.exe
  2⤵
  PID:4180
- C:\Windows\System\VaPKSqe.exe
  C:\Windows\System\VaPKSqe.exe
  2⤵
  PID:4200
- C:\Windows\System\HrLfiee.exe
  C:\Windows\System\HrLfiee.exe
  2⤵
  PID:4216
- C:\Windows\System\FMtPBCi.exe
  C:\Windows\System\FMtPBCi.exe
  2⤵
  PID:4236
- C:\Windows\System\ljcFnwn.exe
  C:\Windows\System\ljcFnwn.exe
  2⤵
  PID:4252
- C:\Windows\System\WhTNjKr.exe
  C:\Windows\System\WhTNjKr.exe
  2⤵
  PID:4288
- C:\Windows\System\JMMYtxe.exe
  C:\Windows\System\JMMYtxe.exe
  2⤵
  PID:4308
- C:\Windows\System\wCcjmtz.exe
  C:\Windows\System\wCcjmtz.exe
  2⤵
  PID:4324
- C:\Windows\System\mAvHMjb.exe
  C:\Windows\System\mAvHMjb.exe
  2⤵
  PID:4340
- C:\Windows\System\CXTVFtD.exe
  C:\Windows\System\CXTVFtD.exe
  2⤵
  PID:4356
- C:\Windows\System\TbcvpJb.exe
  C:\Windows\System\TbcvpJb.exe
  2⤵
  PID:4376
- C:\Windows\System\uBXeOOS.exe
  C:\Windows\System\uBXeOOS.exe
  2⤵
  PID:4396
- C:\Windows\System\UvSuJFE.exe
  C:\Windows\System\UvSuJFE.exe
  2⤵
  PID:4412
- C:\Windows\System\OifgNsG.exe
  C:\Windows\System\OifgNsG.exe
  2⤵
  PID:4428
- C:\Windows\System\WjNMCPu.exe
  C:\Windows\System\WjNMCPu.exe
  2⤵
  PID:4444
- C:\Windows\System\JHjYdjX.exe
  C:\Windows\System\JHjYdjX.exe
  2⤵
  PID:4464
- C:\Windows\System\SCUwkxT.exe
  C:\Windows\System\SCUwkxT.exe
  2⤵
  PID:4484
- C:\Windows\System\nPqPHsk.exe
  C:\Windows\System\nPqPHsk.exe
  2⤵
  PID:4504
- C:\Windows\System\bppmsSd.exe
  C:\Windows\System\bppmsSd.exe
  2⤵
  PID:4520
- C:\Windows\System\uATFtCp.exe
  C:\Windows\System\uATFtCp.exe
  2⤵
  PID:4540
- C:\Windows\System\YnDhWGK.exe
  C:\Windows\System\YnDhWGK.exe
  2⤵
  PID:4560
- C:\Windows\System\lNTkLfi.exe
  C:\Windows\System\lNTkLfi.exe
  2⤵
  PID:4580
- C:\Windows\System\mvRZrKA.exe
  C:\Windows\System\mvRZrKA.exe
  2⤵
  PID:4600
- C:\Windows\System\cjAIfJI.exe
  C:\Windows\System\cjAIfJI.exe
  2⤵
  PID:4616
- C:\Windows\System\sjYxtOj.exe
  C:\Windows\System\sjYxtOj.exe
  2⤵
  PID:4632
- C:\Windows\System\aRNEGJp.exe
  C:\Windows\System\aRNEGJp.exe
  2⤵
  PID:4648
- C:\Windows\System\vySHHsq.exe
  C:\Windows\System\vySHHsq.exe
  2⤵
  PID:4664
- C:\Windows\System\trjefjT.exe
  C:\Windows\System\trjefjT.exe
  2⤵
  PID:4680
- C:\Windows\System\TFRPLDe.exe
  C:\Windows\System\TFRPLDe.exe
  2⤵
  PID:4696
- C:\Windows\System\TfsjtHL.exe
  C:\Windows\System\TfsjtHL.exe
  2⤵
  PID:4712
- C:\Windows\System\boqgZLW.exe
  C:\Windows\System\boqgZLW.exe
  2⤵
  PID:4728
- C:\Windows\System\ejlWyyX.exe
  C:\Windows\System\ejlWyyX.exe
  2⤵
  PID:4744
- C:\Windows\System\cesSpwd.exe
  C:\Windows\System\cesSpwd.exe
  2⤵
  PID:5032
- C:\Windows\System\frwHBXn.exe
  C:\Windows\System\frwHBXn.exe
  2⤵
  PID:5052
- C:\Windows\System\NZTphrU.exe
  C:\Windows\System\NZTphrU.exe
  2⤵
  PID:5068
- C:\Windows\System\mrrxxWz.exe
  C:\Windows\System\mrrxxWz.exe
  2⤵
  PID:5092
- C:\Windows\System\bcLZsOq.exe
  C:\Windows\System\bcLZsOq.exe
  2⤵
  PID:5108
- C:\Windows\System\NNDiZfZ.exe
  C:\Windows\System\NNDiZfZ.exe
  2⤵
  PID:3464
- C:\Windows\System\JiJdfsy.exe
  C:\Windows\System\JiJdfsy.exe
  2⤵
  PID:4020
- C:\Windows\System\LujlSEr.exe
  C:\Windows\System\LujlSEr.exe
  2⤵
  PID:4136
- C:\Windows\System\BoYaZPd.exe
  C:\Windows\System\BoYaZPd.exe
  2⤵
  PID:1632
- C:\Windows\System\uecpxTA.exe
  C:\Windows\System\uecpxTA.exe
  2⤵
  PID:4120
- C:\Windows\System\lSzMbFU.exe
  C:\Windows\System\lSzMbFU.exe
  2⤵
  PID:2528
- C:\Windows\System\uFaOKfr.exe
  C:\Windows\System\uFaOKfr.exe
  2⤵
  PID:4188
- C:\Windows\System\OQStmjt.exe
  C:\Windows\System\OQStmjt.exe
  2⤵
  PID:4372
- C:\Windows\System\IitYlea.exe
  C:\Windows\System\IitYlea.exe
  2⤵
  PID:4436
- C:\Windows\System\DRAvRPh.exe
  C:\Windows\System\DRAvRPh.exe
  2⤵
  PID:4452
- C:\Windows\System\EkMosbz.exe
  C:\Windows\System\EkMosbz.exe
  2⤵
  PID:4644
- C:\Windows\System\iKAaoSn.exe
  C:\Windows\System\iKAaoSn.exe
  2⤵
  PID:4736
- C:\Windows\System\IYutUNF.exe
  C:\Windows\System\IYutUNF.exe
  2⤵
  PID:4768
- C:\Windows\System\pRQxcEc.exe
  C:\Windows\System\pRQxcEc.exe
  2⤵
  PID:4824
- C:\Windows\System\owphOqM.exe
  C:\Windows\System\owphOqM.exe
  2⤵
  PID:4844
- C:\Windows\System\pzouCOu.exe
  C:\Windows\System\pzouCOu.exe
  2⤵
  PID:4856
- C:\Windows\System\NZBAXAV.exe
  C:\Windows\System\NZBAXAV.exe
  2⤵
  PID:4876
- C:\Windows\System\HkfquUY.exe
  C:\Windows\System\HkfquUY.exe
  2⤵
  PID:5040
- C:\Windows\System\TUOBvEy.exe
  C:\Windows\System\TUOBvEy.exe
  2⤵
  PID:3724
- C:\Windows\System\eJSaGDI.exe
  C:\Windows\System\eJSaGDI.exe
  2⤵
  PID:5080
- C:\Windows\System\IgyiUgN.exe
  C:\Windows\System\IgyiUgN.exe
  2⤵
  PID:4104
- C:\Windows\System\cSrJstG.exe
  C:\Windows\System\cSrJstG.exe
  2⤵
  PID:5012
- C:\Windows\System\zTvoijz.exe
  C:\Windows\System\zTvoijz.exe
  2⤵
  PID:4908
- C:\Windows\System\yuEWooV.exe
  C:\Windows\System\yuEWooV.exe
  2⤵
  PID:4928
- C:\Windows\System\GNFZWHt.exe
  C:\Windows\System\GNFZWHt.exe
  2⤵
  PID:4208
- C:\Windows\System\iFaGKhB.exe
  C:\Windows\System\iFaGKhB.exe
  2⤵
  PID:4948
- C:\Windows\System\IoBLMpz.exe
  C:\Windows\System\IoBLMpz.exe
  2⤵
  PID:4972
- C:\Windows\System\HOInEAU.exe
  C:\Windows\System\HOInEAU.exe
  2⤵
  PID:4988
- C:\Windows\System\MyzIKYl.exe
  C:\Windows\System\MyzIKYl.exe
  2⤵
  PID:5004
- C:\Windows\System\EgxuqUp.exe
  C:\Windows\System\EgxuqUp.exe
  2⤵
  PID:5024
- C:\Windows\System\sbmYWwa.exe
  C:\Windows\System\sbmYWwa.exe
  2⤵
  PID:4176
- C:\Windows\System\auiReAu.exe
  C:\Windows\System\auiReAu.exe
  2⤵
  PID:5104
- C:\Windows\System\nLcLXFT.exe
  C:\Windows\System\nLcLXFT.exe
  2⤵
  PID:4260
- C:\Windows\System\QopZGTK.exe
  C:\Windows\System\QopZGTK.exe
  2⤵
  PID:4300
- C:\Windows\System\xbHwYMh.exe
  C:\Windows\System\xbHwYMh.exe
  2⤵
  PID:4476
- C:\Windows\System\FMZTZFE.exe
  C:\Windows\System\FMZTZFE.exe
  2⤵
  PID:4516
- C:\Windows\System\erzvNbM.exe
  C:\Windows\System\erzvNbM.exe
  2⤵
  PID:4424
- C:\Windows\System\fiKtmUg.exe
  C:\Windows\System\fiKtmUg.exe
  2⤵
  PID:4496
- C:\Windows\System\SDRfbiR.exe
  C:\Windows\System\SDRfbiR.exe
  2⤵
  PID:4492
- C:\Windows\System\snQnaNF.exe
  C:\Windows\System\snQnaNF.exe
  2⤵
  PID:4708
- C:\Windows\System\SraWNKy.exe
  C:\Windows\System\SraWNKy.exe
  2⤵
  PID:4624
- C:\Windows\System\hVHOaCV.exe
  C:\Windows\System\hVHOaCV.exe
  2⤵
  PID:4628
- C:\Windows\System\oKevVgH.exe
  C:\Windows\System\oKevVgH.exe
  2⤵
  PID:4752
- C:\Windows\System\qdXJGdP.exe
  C:\Windows\System\qdXJGdP.exe
  2⤵
  PID:4740
- C:\Windows\System\pSRLaoS.exe
  C:\Windows\System\pSRLaoS.exe
  2⤵
  PID:4576
- C:\Windows\System\LALxosc.exe
  C:\Windows\System\LALxosc.exe
  2⤵
  PID:4804
- C:\Windows\System\pegObSB.exe
  C:\Windows\System\pegObSB.exe
  2⤵
  PID:3180
- C:\Windows\System\aqIxVUB.exe
  C:\Windows\System\aqIxVUB.exe
  2⤵
  PID:4892
- C:\Windows\System\KNvfcYt.exe
  C:\Windows\System\KNvfcYt.exe
  2⤵
  PID:5088
- C:\Windows\System\HsLxRgd.exe
  C:\Windows\System\HsLxRgd.exe
  2⤵
  PID:4984
- C:\Windows\System\atklCHX.exe
  C:\Windows\System\atklCHX.exe
  2⤵
  PID:4840
- C:\Windows\System\LRyinYE.exe
  C:\Windows\System\LRyinYE.exe
  2⤵
  PID:4868
- C:\Windows\System\qVvEXmV.exe
  C:\Windows\System\qVvEXmV.exe
  2⤵
  PID:4968
- C:\Windows\System\vHEBsoz.exe
  C:\Windows\System\vHEBsoz.exe
  2⤵
  PID:4964
- C:\Windows\System\svnOsvY.exe
  C:\Windows\System\svnOsvY.exe
  2⤵
  PID:2612
- C:\Windows\System\iMBKwRi.exe
  C:\Windows\System\iMBKwRi.exe
  2⤵
  PID:4228
- C:\Windows\System\AwkbbTV.exe
  C:\Windows\System\AwkbbTV.exe
  2⤵
  PID:4336
- C:\Windows\System\Qdxujka.exe
  C:\Windows\System\Qdxujka.exe
  2⤵
  PID:5100
- C:\Windows\System\EfrIGyX.exe
  C:\Windows\System\EfrIGyX.exe
  2⤵
  PID:4596
- C:\Windows\System\ovyfrEU.exe
  C:\Windows\System\ovyfrEU.exe
  2⤵
  PID:4720
- C:\Windows\System\WjbGpTO.exe
  C:\Windows\System\WjbGpTO.exe
  2⤵
  PID:4796
- C:\Windows\System\mwlOnsk.exe
  C:\Windows\System\mwlOnsk.exe
  2⤵
  PID:4884
- C:\Windows\System\cSitxxF.exe
  C:\Windows\System\cSitxxF.exe
  2⤵
  PID:4704
- C:\Windows\System\bxuZhlu.exe
  C:\Windows\System\bxuZhlu.exe
  2⤵
  PID:4692
- C:\Windows\System\piJUBYb.exe
  C:\Windows\System\piJUBYb.exe
  2⤵
  PID:4244
- C:\Windows\System\MqkXlga.exe
  C:\Windows\System\MqkXlga.exe
  2⤵
  PID:4936
- C:\Windows\System\kvVMEdF.exe
  C:\Windows\System\kvVMEdF.exe
  2⤵
  PID:4156
- C:\Windows\System\CAzbatc.exe
  C:\Windows\System\CAzbatc.exe
  2⤵
  PID:4756
- C:\Windows\System\NsUqVIm.exe
  C:\Windows\System\NsUqVIm.exe
  2⤵
  PID:4320
- C:\Windows\System\tIqaLAL.exe
  C:\Windows\System\tIqaLAL.exe
  2⤵
  PID:2640
- C:\Windows\System\GUbQVqO.exe
  C:\Windows\System\GUbQVqO.exe
  2⤵
  PID:4956
- C:\Windows\System\tFygbFp.exe
  C:\Windows\System\tFygbFp.exe
  2⤵
  PID:964
- C:\Windows\System\EsYdqXX.exe
  C:\Windows\System\EsYdqXX.exe
  2⤵
  PID:4852
- C:\Windows\System\snSkkWC.exe
  C:\Windows\System\snSkkWC.exe
  2⤵
  PID:4248
- C:\Windows\System\xasOvoQ.exe
  C:\Windows\System\xasOvoQ.exe
  2⤵
  PID:4588
- C:\Windows\System\vHvxFdM.exe
  C:\Windows\System\vHvxFdM.exe
  2⤵
  PID:4872
- C:\Windows\System\RDzisKy.exe
  C:\Windows\System\RDzisKy.exe
  2⤵
  PID:2152
- C:\Windows\System\OeJOKVX.exe
  C:\Windows\System\OeJOKVX.exe
  2⤵
  PID:4536
- C:\Windows\System\uVvvUei.exe
  C:\Windows\System\uVvvUei.exe
  2⤵
  PID:4792
- C:\Windows\System\FwCJQUO.exe
  C:\Windows\System\FwCJQUO.exe
  2⤵
  PID:4864
- C:\Windows\System\BpXbgqv.exe
  C:\Windows\System\BpXbgqv.exe
  2⤵
  PID:4888
- C:\Windows\System\EGzblgg.exe
  C:\Windows\System\EGzblgg.exe
  2⤵
  PID:3760
- C:\Windows\System\dqEbDdU.exe
  C:\Windows\System\dqEbDdU.exe
  2⤵
  PID:4916
- C:\Windows\System\AHNfAmb.exe
  C:\Windows\System\AHNfAmb.exe
  2⤵
  PID:4500
- C:\Windows\System\aTxecEq.exe
  C:\Windows\System\aTxecEq.exe
  2⤵
  PID:5060
- C:\Windows\System\kfOsFqS.exe
  C:\Windows\System\kfOsFqS.exe
  2⤵
  PID:4172
- C:\Windows\System\nUyblyA.exe
  C:\Windows\System\nUyblyA.exe
  2⤵
  PID:4920
- C:\Windows\System\YFPeFfM.exe
  C:\Windows\System\YFPeFfM.exe
  2⤵
  PID:2376
- C:\Windows\System\QUMYyOb.exe
  C:\Windows\System\QUMYyOb.exe
  2⤵
  PID:4608
- C:\Windows\System\NApwfUz.exe
  C:\Windows\System\NApwfUz.exe
  2⤵
  PID:1584
- C:\Windows\System\giEIAVM.exe
  C:\Windows\System\giEIAVM.exe
  2⤵
  PID:5128
- C:\Windows\System\DVmaQPk.exe
  C:\Windows\System\DVmaQPk.exe
  2⤵
  PID:5144
- C:\Windows\System\HipRjaD.exe
  C:\Windows\System\HipRjaD.exe
  2⤵
  PID:5160
- C:\Windows\System\nsPhSLm.exe
  C:\Windows\System\nsPhSLm.exe
  2⤵
  PID:5176
- C:\Windows\System\RJKFKEa.exe
  C:\Windows\System\RJKFKEa.exe
  2⤵
  PID:5196
- C:\Windows\System\QxpdKCz.exe
  C:\Windows\System\QxpdKCz.exe
  2⤵
  PID:5212
- C:\Windows\System\ywgNDir.exe
  C:\Windows\System\ywgNDir.exe
  2⤵
  PID:5232
- C:\Windows\System\MBmbwoB.exe
  C:\Windows\System\MBmbwoB.exe
  2⤵
  PID:5256
- C:\Windows\System\KtkgfWC.exe
  C:\Windows\System\KtkgfWC.exe
  2⤵
  PID:5276
- C:\Windows\System\dXWEVzC.exe
  C:\Windows\System\dXWEVzC.exe
  2⤵
  PID:5332
- C:\Windows\System\yIrbIcb.exe
  C:\Windows\System\yIrbIcb.exe
  2⤵
  PID:5348
- C:\Windows\System\hkyrNYm.exe
  C:\Windows\System\hkyrNYm.exe
  2⤵
  PID:5364
- C:\Windows\System\fsdXkXz.exe
  C:\Windows\System\fsdXkXz.exe
  2⤵
  PID:5380
- C:\Windows\System\TbfjlAt.exe
  C:\Windows\System\TbfjlAt.exe
  2⤵
  PID:5400
- C:\Windows\System\vwEdkFr.exe
  C:\Windows\System\vwEdkFr.exe
  2⤵
  PID:5436
- C:\Windows\System\ghFyzJj.exe
  C:\Windows\System\ghFyzJj.exe
  2⤵
  PID:5452
- C:\Windows\System\XXNFmEZ.exe
  C:\Windows\System\XXNFmEZ.exe
  2⤵
  PID:5488
- C:\Windows\System\oAZKYSF.exe
  C:\Windows\System\oAZKYSF.exe
  2⤵
  PID:5508
- C:\Windows\System\WldRWku.exe
  C:\Windows\System\WldRWku.exe
  2⤵
  PID:5528
- C:\Windows\System\ZqfJUzv.exe
  C:\Windows\System\ZqfJUzv.exe
  2⤵
  PID:5548
- C:\Windows\System\DvAYMfO.exe
  C:\Windows\System\DvAYMfO.exe
  2⤵
  PID:5564
- C:\Windows\System\fqaKOOq.exe
  C:\Windows\System\fqaKOOq.exe
  2⤵
  PID:5580
- C:\Windows\System\BNCyVyW.exe
  C:\Windows\System\BNCyVyW.exe
  2⤵
  PID:5596
- C:\Windows\System\PTYeUsA.exe
  C:\Windows\System\PTYeUsA.exe
  2⤵
  PID:5612
- C:\Windows\System\AgUYDZB.exe
  C:\Windows\System\AgUYDZB.exe
  2⤵
  PID:5632
- C:\Windows\System\ovDgIwG.exe
  C:\Windows\System\ovDgIwG.exe
  2⤵
  PID:5648
- C:\Windows\System\aaHHCCk.exe
  C:\Windows\System\aaHHCCk.exe
  2⤵
  PID:5664
- C:\Windows\System\qPUMlap.exe
  C:\Windows\System\qPUMlap.exe
  2⤵
  PID:5680
- C:\Windows\System\JZOihVm.exe
  C:\Windows\System\JZOihVm.exe
  2⤵
  PID:5700
- C:\Windows\System\FVyTCCI.exe
  C:\Windows\System\FVyTCCI.exe
  2⤵
  PID:5720
- C:\Windows\System\jgSYcxP.exe
  C:\Windows\System\jgSYcxP.exe
  2⤵
  PID:5736
- C:\Windows\System\siQHTLi.exe
  C:\Windows\System\siQHTLi.exe
  2⤵
  PID:5752
- C:\Windows\System\PBGJUlZ.exe
  C:\Windows\System\PBGJUlZ.exe
  2⤵
  PID:5772
- C:\Windows\System\xbjdxCJ.exe
  C:\Windows\System\xbjdxCJ.exe
  2⤵
  PID:5796
- C:\Windows\System\JYHIzen.exe
  C:\Windows\System\JYHIzen.exe
  2⤵
  PID:5816
- C:\Windows\System\WNyztNx.exe
  C:\Windows\System\WNyztNx.exe
  2⤵
  PID:5832
- C:\Windows\System\TAbSRpQ.exe
  C:\Windows\System\TAbSRpQ.exe
  2⤵
  PID:5848
- C:\Windows\System\mHdjgDx.exe
  C:\Windows\System\mHdjgDx.exe
  2⤵
  PID:5868
- C:\Windows\System\ezReRVK.exe
  C:\Windows\System\ezReRVK.exe
  2⤵
  PID:5884
- C:\Windows\System\XgkqECE.exe
  C:\Windows\System\XgkqECE.exe
  2⤵
  PID:5900
- C:\Windows\System\FuYEdsh.exe
  C:\Windows\System\FuYEdsh.exe
  2⤵
  PID:5916
- C:\Windows\System\xaOzOYZ.exe
  C:\Windows\System\xaOzOYZ.exe
  2⤵
  PID:5936
- C:\Windows\System\GvAdGpi.exe
  C:\Windows\System\GvAdGpi.exe
  2⤵
  PID:5952
- C:\Windows\System\RpUszFH.exe
  C:\Windows\System\RpUszFH.exe
  2⤵
  PID:5968
- C:\Windows\System\UeyDoKB.exe
  C:\Windows\System\UeyDoKB.exe
  2⤵
  PID:5984
- C:\Windows\System\FmbQTWE.exe
  C:\Windows\System\FmbQTWE.exe
  2⤵
  PID:6000
- C:\Windows\System\LWJpHBg.exe
  C:\Windows\System\LWJpHBg.exe
  2⤵
  PID:6020
- C:\Windows\System\JtxvUoN.exe
  C:\Windows\System\JtxvUoN.exe
  2⤵
  PID:6036
- C:\Windows\System\VCLHHjD.exe
  C:\Windows\System\VCLHHjD.exe
  2⤵
  PID:6056
- C:\Windows\System\JPYgsVl.exe
  C:\Windows\System\JPYgsVl.exe
  2⤵
  PID:6072
- C:\Windows\System\jodytvK.exe
  C:\Windows\System\jodytvK.exe
  2⤵
  PID:6088
- C:\Windows\System\BNdUQHH.exe
  C:\Windows\System\BNdUQHH.exe
  2⤵
  PID:6108
- C:\Windows\System\qWMNFnF.exe
  C:\Windows\System\qWMNFnF.exe
  2⤵
  PID:6124
- C:\Windows\System\AHIxkBE.exe
  C:\Windows\System\AHIxkBE.exe
  2⤵
  PID:6140
- C:\Windows\System\rxzTdMx.exe
  C:\Windows\System\rxzTdMx.exe
  2⤵
  PID:5140
- C:\Windows\System\cyPSGWW.exe
  C:\Windows\System\cyPSGWW.exe
  2⤵
  PID:4836
- C:\Windows\System\uKzsYEx.exe
  C:\Windows\System\uKzsYEx.exe
  2⤵
  PID:5188
- C:\Windows\System\nADhlOk.exe
  C:\Windows\System\nADhlOk.exe
  2⤵
  PID:5152
- C:\Windows\System\POlENri.exe
  C:\Windows\System\POlENri.exe
  2⤵
  PID:5272
- C:\Windows\System\hbfjOgm.exe
  C:\Windows\System\hbfjOgm.exe
  2⤵
  PID:5288
- C:\Windows\System\UMklEvm.exe
  C:\Windows\System\UMklEvm.exe
  2⤵
  PID:5308
- C:\Windows\System\HWesoyl.exe
  C:\Windows\System\HWesoyl.exe
  2⤵
  PID:5344
- C:\Windows\System\UlKCpmR.exe
  C:\Windows\System\UlKCpmR.exe
  2⤵
  PID:5420
- C:\Windows\System\vgNXWbP.exe
  C:\Windows\System\vgNXWbP.exe
  2⤵
  PID:5388
- C:\Windows\System\oarzYbI.exe
  C:\Windows\System\oarzYbI.exe
  2⤵
  PID:5444
- C:\Windows\System\BSiSUUs.exe
  C:\Windows\System\BSiSUUs.exe
  2⤵
  PID:5496
- C:\Windows\System\VsDcJHo.exe
  C:\Windows\System\VsDcJHo.exe
  2⤵
  PID:5520
- C:\Windows\System\HrvcWvm.exe
  C:\Windows\System\HrvcWvm.exe
  2⤵
  PID:5588
- C:\Windows\System\vqNuyoj.exe
  C:\Windows\System\vqNuyoj.exe
  2⤵
  PID:5624
- C:\Windows\System\hihSsMP.exe
  C:\Windows\System\hihSsMP.exe
  2⤵
  PID:5572
- C:\Windows\System\ycqEDMU.exe
  C:\Windows\System\ycqEDMU.exe
  2⤵
  PID:5660
- C:\Windows\System\TYZcwsS.exe
  C:\Windows\System\TYZcwsS.exe
  2⤵
  PID:5640
- C:\Windows\System\OVdKETF.exe
  C:\Windows\System\OVdKETF.exe
  2⤵
  PID:5732
- C:\Windows\System\DFyoxPA.exe
  C:\Windows\System\DFyoxPA.exe
  2⤵
  PID:5840
- C:\Windows\System\VywtMUM.exe
  C:\Windows\System\VywtMUM.exe
  2⤵
  PID:5876
- C:\Windows\System\VYxtVBc.exe
  C:\Windows\System\VYxtVBc.exe
  2⤵
  PID:5908
- C:\Windows\System\GAnMVJG.exe
  C:\Windows\System\GAnMVJG.exe
  2⤵
  PID:6032
- C:\Windows\System\OCudZff.exe
  C:\Windows\System\OCudZff.exe
  2⤵
  PID:6096
- C:\Windows\System\uzlzrWJ.exe
  C:\Windows\System\uzlzrWJ.exe
  2⤵
  PID:5156
- C:\Windows\System\muAIjPL.exe
  C:\Windows\System\muAIjPL.exe
  2⤵
  PID:5296
- C:\Windows\System\lRmFZXG.exe
  C:\Windows\System\lRmFZXG.exe
  2⤵
  PID:5396
- C:\Windows\System\HlaMKFK.exe
  C:\Windows\System\HlaMKFK.exe
  2⤵
  PID:5340
- C:\Windows\System\rSRZACx.exe
  C:\Windows\System\rSRZACx.exe
  2⤵
  PID:5464
- C:\Windows\System\JbCQMQH.exe
  C:\Windows\System\JbCQMQH.exe
  2⤵
  PID:5356
- C:\Windows\System\BjiChEn.exe
  C:\Windows\System\BjiChEn.exe
  2⤵
  PID:5412
- C:\Windows\System\InNmgyq.exe
  C:\Windows\System\InNmgyq.exe
  2⤵
  PID:5540
- C:\Windows\System\yoIRmZm.exe
  C:\Windows\System\yoIRmZm.exe
  2⤵
  PID:5764
- C:\Windows\System\jPTvBsm.exe
  C:\Windows\System\jPTvBsm.exe
  2⤵
  PID:5860
- C:\Windows\System\phhmWKR.exe
  C:\Windows\System\phhmWKR.exe
  2⤵
  PID:5516
- C:\Windows\System\enWhVJc.exe
  C:\Windows\System\enWhVJc.exe
  2⤵
  PID:5696
- C:\Windows\System\RMLYWRx.exe
  C:\Windows\System\RMLYWRx.exe
  2⤵
  PID:5744
- C:\Windows\System\anjfdof.exe
  C:\Windows\System\anjfdof.exe
  2⤵
  PID:5844
- C:\Windows\System\HvLfWkJ.exe
  C:\Windows\System\HvLfWkJ.exe
  2⤵
  PID:5864
- C:\Windows\System\HCLiFKp.exe
  C:\Windows\System\HCLiFKp.exe
  2⤵
  PID:5944
- C:\Windows\System\snUQEvm.exe
  C:\Windows\System\snUQEvm.exe
  2⤵
  PID:6016
- C:\Windows\System\JClqJGM.exe
  C:\Windows\System\JClqJGM.exe
  2⤵
  PID:5924
- C:\Windows\System\lzevonx.exe
  C:\Windows\System\lzevonx.exe
  2⤵
  PID:6068
- C:\Windows\System\InCCGlq.exe
  C:\Windows\System\InCCGlq.exe
  2⤵
  PID:5992
- C:\Windows\System\bOvUGcv.exe
  C:\Windows\System\bOvUGcv.exe
  2⤵
  PID:6104
- C:\Windows\System\uuqVGwu.exe
  C:\Windows\System\uuqVGwu.exe
  2⤵
  PID:6132
- C:\Windows\System\QlHfpmv.exe
  C:\Windows\System\QlHfpmv.exe
  2⤵
  PID:6120
- C:\Windows\System\JeYgxFy.exe
  C:\Windows\System\JeYgxFy.exe
  2⤵
  PID:5804
- C:\Windows\System\JWZRYfB.exe
  C:\Windows\System\JWZRYfB.exe
  2⤵
  PID:5376
- C:\Windows\System\ivRcgwU.exe
  C:\Windows\System\ivRcgwU.exe
  2⤵
  PID:5608
- C:\Windows\System\tyzjPbM.exe
  C:\Windows\System\tyzjPbM.exe
  2⤵
  PID:5468
- C:\Windows\System\ewPsecB.exe
  C:\Windows\System\ewPsecB.exe
  2⤵
  PID:5948
- C:\Windows\System\MkxWpZB.exe
  C:\Windows\System\MkxWpZB.exe
  2⤵
  PID:5788
- C:\Windows\System\wFZmGag.exe
  C:\Windows\System\wFZmGag.exe
  2⤵
  PID:6008
- C:\Windows\System\oMwBLmM.exe
  C:\Windows\System\oMwBLmM.exe
  2⤵
  PID:5996
- C:\Windows\System\IJgnMqa.exe
  C:\Windows\System\IJgnMqa.exe
  2⤵
  PID:5220
- C:\Windows\System\yDRyAsS.exe
  C:\Windows\System\yDRyAsS.exe
  2⤵
  PID:5892
- C:\Windows\System\lcYsOxn.exe
  C:\Windows\System\lcYsOxn.exe
  2⤵
  PID:5124
- C:\Windows\System\xSkelCi.exe
  C:\Windows\System\xSkelCi.exe
  2⤵
  PID:5224
- C:\Windows\System\pOYEISz.exe
  C:\Windows\System\pOYEISz.exe
  2⤵
  PID:5960
- C:\Windows\System\UpTPkTE.exe
  C:\Windows\System\UpTPkTE.exe
  2⤵
  PID:5136
- C:\Windows\System\xvzxdag.exe
  C:\Windows\System\xvzxdag.exe
  2⤵
  PID:6012
- C:\Windows\System\URvnpWc.exe
  C:\Windows\System\URvnpWc.exe
  2⤵
  PID:5856
- C:\Windows\System\LqHkJlJ.exe
  C:\Windows\System\LqHkJlJ.exe
  2⤵
  PID:5672
- C:\Windows\System\KXSmlQN.exe
  C:\Windows\System\KXSmlQN.exe
  2⤵
  PID:280
- C:\Windows\System\AmMzkLX.exe
  C:\Windows\System\AmMzkLX.exe
  2⤵
  PID:6148
- C:\Windows\System\UnHScew.exe
  C:\Windows\System\UnHScew.exe
  2⤵
  PID:6164
- C:\Windows\System\kJEqFcR.exe
  C:\Windows\System\kJEqFcR.exe
  2⤵
  PID:6180
- C:\Windows\System\YDNXROd.exe
  C:\Windows\System\YDNXROd.exe
  2⤵
  PID:6196
- C:\Windows\System\gWfiyPW.exe
  C:\Windows\System\gWfiyPW.exe
  2⤵
  PID:6212
- C:\Windows\System\AnlAvkt.exe
  C:\Windows\System\AnlAvkt.exe
  2⤵
  PID:6228
- C:\Windows\System\hoSltUO.exe
  C:\Windows\System\hoSltUO.exe
  2⤵
  PID:6244
- C:\Windows\System\RyXNjvQ.exe
  C:\Windows\System\RyXNjvQ.exe
  2⤵
  PID:6260
- C:\Windows\System\dqSRrdn.exe
  C:\Windows\System\dqSRrdn.exe
  2⤵
  PID:6276
- C:\Windows\System\oHGgLMK.exe
  C:\Windows\System\oHGgLMK.exe
  2⤵
  PID:6292
- C:\Windows\System\xLpNTBF.exe
  C:\Windows\System\xLpNTBF.exe
  2⤵
  PID:6308
- C:\Windows\System\rKVEmij.exe
  C:\Windows\System\rKVEmij.exe
  2⤵
  PID:6324
- C:\Windows\System\FJyQuIs.exe
  C:\Windows\System\FJyQuIs.exe
  2⤵
  PID:6340
- C:\Windows\System\jbqLKSh.exe
  C:\Windows\System\jbqLKSh.exe
  2⤵
  PID:6360
- C:\Windows\System\xsFZDZu.exe
  C:\Windows\System\xsFZDZu.exe
  2⤵
  PID:6376
- C:\Windows\System\DPKySDh.exe
  C:\Windows\System\DPKySDh.exe
  2⤵
  PID:6392
- C:\Windows\System\NfEqZHu.exe
  C:\Windows\System\NfEqZHu.exe
  2⤵
  PID:6408
- C:\Windows\System\ehiFnro.exe
  C:\Windows\System\ehiFnro.exe
  2⤵
  PID:6424
- C:\Windows\System\SOEFdED.exe
  C:\Windows\System\SOEFdED.exe
  2⤵
  PID:6444
- C:\Windows\System\NVJVeXV.exe
  C:\Windows\System\NVJVeXV.exe
  2⤵
  PID:6460
- C:\Windows\System\aAzrkzj.exe
  C:\Windows\System\aAzrkzj.exe
  2⤵
  PID:6476
- C:\Windows\System\SXAENJW.exe
  C:\Windows\System\SXAENJW.exe
  2⤵
  PID:6496
- C:\Windows\System\RhOArco.exe
  C:\Windows\System\RhOArco.exe
  2⤵
  PID:6516
- C:\Windows\System\nxoydzX.exe
  C:\Windows\System\nxoydzX.exe
  2⤵
  PID:6548
- C:\Windows\System\ggsAEje.exe
  C:\Windows\System\ggsAEje.exe
  2⤵
  PID:6564
- C:\Windows\System\TlXOity.exe
  C:\Windows\System\TlXOity.exe
  2⤵
  PID:6580
- C:\Windows\System\wOKFzxl.exe
  C:\Windows\System\wOKFzxl.exe
  2⤵
  PID:6596
- C:\Windows\System\MgZnwDr.exe
  C:\Windows\System\MgZnwDr.exe
  2⤵
  PID:6612
- C:\Windows\System\Gvjjrto.exe
  C:\Windows\System\Gvjjrto.exe
  2⤵
  PID:6628
- C:\Windows\System\OGHQuPF.exe
  C:\Windows\System\OGHQuPF.exe
  2⤵
  PID:6644
- C:\Windows\System\sdowwug.exe
  C:\Windows\System\sdowwug.exe
  2⤵
  PID:6664
- C:\Windows\System\YKFZyFQ.exe
  C:\Windows\System\YKFZyFQ.exe
  2⤵
  PID:6680
- C:\Windows\System\GTqpgfX.exe
  C:\Windows\System\GTqpgfX.exe
  2⤵
  PID:6696
- C:\Windows\System\WqTdqhj.exe
  C:\Windows\System\WqTdqhj.exe
  2⤵
  PID:6712
- C:\Windows\System\izsrBrI.exe
  C:\Windows\System\izsrBrI.exe
  2⤵
  PID:6728
- C:\Windows\System\IHbeYXB.exe
  C:\Windows\System\IHbeYXB.exe
  2⤵
  PID:6744
- C:\Windows\System\TyEqxju.exe
  C:\Windows\System\TyEqxju.exe
  2⤵
  PID:6760
- C:\Windows\System\vUTYCPk.exe
  C:\Windows\System\vUTYCPk.exe
  2⤵
  PID:6776
- C:\Windows\System\kVRcjuQ.exe
  C:\Windows\System\kVRcjuQ.exe
  2⤵
  PID:6792
- C:\Windows\System\SxYBtrJ.exe
  C:\Windows\System\SxYBtrJ.exe
  2⤵
  PID:6808
- C:\Windows\System\oeWigXw.exe
  C:\Windows\System\oeWigXw.exe
  2⤵
  PID:6828
- C:\Windows\System\jWuPRkt.exe
  C:\Windows\System\jWuPRkt.exe
  2⤵
  PID:6860
- C:\Windows\System\AtsjEBz.exe
  C:\Windows\System\AtsjEBz.exe
  2⤵
  PID:6876
- C:\Windows\System\BdEqTxN.exe
  C:\Windows\System\BdEqTxN.exe
  2⤵
  PID:6892
- C:\Windows\System\xasqMsM.exe
  C:\Windows\System\xasqMsM.exe
  2⤵
  PID:6920
- C:\Windows\System\HdykkoH.exe
  C:\Windows\System\HdykkoH.exe
  2⤵
  PID:6936
- C:\Windows\System\zLdyrtq.exe
  C:\Windows\System\zLdyrtq.exe
  2⤵
  PID:6952
- C:\Windows\System\hpHPLLk.exe
  C:\Windows\System\hpHPLLk.exe
  2⤵
  PID:6968
- C:\Windows\System\FvWfjNY.exe
  C:\Windows\System\FvWfjNY.exe
  2⤵
  PID:6984
- C:\Windows\System\hTHIOoh.exe
  C:\Windows\System\hTHIOoh.exe
  2⤵
  PID:7008
- C:\Windows\System\AImMFib.exe
  C:\Windows\System\AImMFib.exe
  2⤵
  PID:7024
- C:\Windows\System\dtHqOwH.exe
  C:\Windows\System\dtHqOwH.exe
  2⤵
  PID:7048
- C:\Windows\System\wFIAdNl.exe
  C:\Windows\System\wFIAdNl.exe
  2⤵
  PID:7064
- C:\Windows\System\hghgthJ.exe
  C:\Windows\System\hghgthJ.exe
  2⤵
  PID:7080
- C:\Windows\System\SdrUXpi.exe
  C:\Windows\System\SdrUXpi.exe
  2⤵
  PID:7096
- C:\Windows\System\cfjfoot.exe
  C:\Windows\System\cfjfoot.exe
  2⤵
  PID:7112
- C:\Windows\System\cJwsypH.exe
  C:\Windows\System\cJwsypH.exe
  2⤵
  PID:7128
- C:\Windows\System\ZUVzRQv.exe
  C:\Windows\System\ZUVzRQv.exe
  2⤵
  PID:7144
- C:\Windows\System\DUHvfVO.exe
  C:\Windows\System\DUHvfVO.exe
  2⤵
  PID:7164
- C:\Windows\System\pzeKISS.exe
  C:\Windows\System\pzeKISS.exe
  2⤵
  PID:5424
- C:\Windows\System\jVnmCKh.exe
  C:\Windows\System\jVnmCKh.exe
  2⤵
  PID:6052
- C:\Windows\System\rINdKdw.exe
  C:\Windows\System\rINdKdw.exe
  2⤵
  PID:4408
- C:\Windows\System\dXnZXYx.exe
  C:\Windows\System\dXnZXYx.exe
  2⤵
  PID:6176
- C:\Windows\System\LdciNRh.exe
  C:\Windows\System\LdciNRh.exe
  2⤵
  PID:6252
- C:\Windows\System\bLFfHEn.exe
  C:\Windows\System\bLFfHEn.exe
  2⤵
  PID:5792
- C:\Windows\System\MNbvxwa.exe
  C:\Windows\System\MNbvxwa.exe
  2⤵
  PID:6204
- C:\Windows\System\fAnQdjm.exe
  C:\Windows\System\fAnQdjm.exe
  2⤵
  PID:6272
- C:\Windows\System\BxatGIG.exe
  C:\Windows\System\BxatGIG.exe
  2⤵
  PID:6352
- C:\Windows\System\sFqBqHw.exe
  C:\Windows\System\sFqBqHw.exe
  2⤵
  PID:6368
- C:\Windows\System\oOMTJSd.exe
  C:\Windows\System\oOMTJSd.exe
  2⤵
  PID:6388
- C:\Windows\System\yHCrbYg.exe
  C:\Windows\System\yHCrbYg.exe
  2⤵
  PID:6456
- C:\Windows\System\kGugFuE.exe
  C:\Windows\System\kGugFuE.exe
  2⤵
  PID:2844
- C:\Windows\System\npbRlvp.exe
  C:\Windows\System\npbRlvp.exe
  2⤵
  PID:6436
- C:\Windows\System\MNbArJy.exe
  C:\Windows\System\MNbArJy.exe
  2⤵
  PID:6544
- C:\Windows\System\ybWpWQP.exe
  C:\Windows\System\ybWpWQP.exe
  2⤵
  PID:6588
- C:\Windows\System\YSsjftV.exe
  C:\Windows\System\YSsjftV.exe
  2⤵
  PID:6652
- C:\Windows\System\QzTTtXO.exe
  C:\Windows\System\QzTTtXO.exe
  2⤵
  PID:6704
- C:\Windows\System\FimcRkL.exe
  C:\Windows\System\FimcRkL.exe
  2⤵
  PID:6576
- C:\Windows\System\VrpvBpn.exe
  C:\Windows\System\VrpvBpn.exe
  2⤵
  PID:6640
- C:\Windows\System\PhKBNvb.exe
  C:\Windows\System\PhKBNvb.exe
  2⤵
  PID:6768
- C:\Windows\System\UcXvMVh.exe
  C:\Windows\System\UcXvMVh.exe
  2⤵
  PID:6840
- C:\Windows\System\WaEnUSQ.exe
  C:\Windows\System\WaEnUSQ.exe
  2⤵
  PID:6856
- C:\Windows\System\rWpWoOP.exe
  C:\Windows\System\rWpWoOP.exe
  2⤵
  PID:6932
- C:\Windows\System\XdbQNCM.exe
  C:\Windows\System\XdbQNCM.exe
  2⤵
  PID:6820
- C:\Windows\System\VXHVjDq.exe
  C:\Windows\System\VXHVjDq.exe
  2⤵
  PID:6756
- C:\Windows\System\gdIJluj.exe
  C:\Windows\System\gdIJluj.exe
  2⤵
  PID:6964
- C:\Windows\System\vNKSThb.exe
  C:\Windows\System\vNKSThb.exe
  2⤵
  PID:6868
- C:\Windows\System\RPeZnRC.exe
  C:\Windows\System\RPeZnRC.exe
  2⤵
  PID:6976
- C:\Windows\System\iHZXKvQ.exe
  C:\Windows\System\iHZXKvQ.exe
  2⤵
  PID:7032
- C:\Windows\System\ExUakTI.exe
  C:\Windows\System\ExUakTI.exe
  2⤵
  PID:6356
- C:\Windows\System\ymIvMKk.exe
  C:\Windows\System\ymIvMKk.exe
  2⤵
  PID:7108
- C:\Windows\System\VjbslMg.exe
  C:\Windows\System\VjbslMg.exe
  2⤵
  PID:7092
- C:\Windows\System\AuHjWAp.exe
  C:\Windows\System\AuHjWAp.exe
  2⤵
  PID:7136
- C:\Windows\System\AcGGmHj.exe
  C:\Windows\System\AcGGmHj.exe
  2⤵
  PID:5560
- C:\Windows\System\kwsYOxV.exe
  C:\Windows\System\kwsYOxV.exe
  2⤵
  PID:5824
- C:\Windows\System\ovzghnK.exe
  C:\Windows\System\ovzghnK.exe
  2⤵
  PID:6320
- C:\Windows\System\ONuZZxu.exe
  C:\Windows\System\ONuZZxu.exe
  2⤵
  PID:6288
- C:\Windows\System\jZhDURF.exe
  C:\Windows\System\jZhDURF.exe
  2⤵
  PID:6488
- C:\Windows\System\ripVNyg.exe
  C:\Windows\System\ripVNyg.exe
  2⤵
  PID:6492
- C:\Windows\System\jcIfgYA.exe
  C:\Windows\System\jcIfgYA.exe
  2⤵
  PID:6512
- C:\Windows\System\KzcadoC.exe
  C:\Windows\System\KzcadoC.exe
  2⤵
  PID:6240
- C:\Windows\System\wQetiUH.exe
  C:\Windows\System\wQetiUH.exe
  2⤵
  PID:6688
- C:\Windows\System\CwkjewK.exe
  C:\Windows\System\CwkjewK.exe
  2⤵
  PID:6420
- C:\Windows\System\FzWOgYN.exe
  C:\Windows\System\FzWOgYN.exe
  2⤵
  PID:6800
- C:\Windows\System\UzfFBgA.exe
  C:\Windows\System\UzfFBgA.exe
  2⤵
  PID:6848
- C:\Windows\System\cjeuEkW.exe
  C:\Windows\System\cjeuEkW.exe
  2⤵
  PID:6804
- C:\Windows\System\aLZJIeV.exe
  C:\Windows\System\aLZJIeV.exe
  2⤵
  PID:6824
- C:\Windows\System\OFWVKOW.exe
  C:\Windows\System\OFWVKOW.exe
  2⤵
  PID:6960
- C:\Windows\System\JNwYIZX.exe
  C:\Windows\System\JNwYIZX.exe
  2⤵
  PID:6944
- C:\Windows\System\oMDxgnA.exe
  C:\Windows\System\oMDxgnA.exe
  2⤵
  PID:7072
- C:\Windows\System\FIifLJF.exe
  C:\Windows\System\FIifLJF.exe
  2⤵
  PID:6160
- C:\Windows\System\YrzOWMN.exe
  C:\Windows\System\YrzOWMN.exe
  2⤵
  PID:5712
- C:\Windows\System\PcARrNx.exe
  C:\Windows\System\PcARrNx.exe
  2⤵
  PID:6268
- C:\Windows\System\FtnbvFR.exe
  C:\Windows\System\FtnbvFR.exe
  2⤵
  PID:7020
- C:\Windows\System\kkExcwN.exe
  C:\Windows\System\kkExcwN.exe
  2⤵
  PID:5556
- C:\Windows\System\dwtvImP.exe
  C:\Windows\System\dwtvImP.exe
  2⤵
  PID:6188
- C:\Windows\System\FbuugNP.exe
  C:\Windows\System\FbuugNP.exe
  2⤵
  PID:6472
- C:\Windows\System\UEsPjYp.exe
  C:\Windows\System\UEsPjYp.exe
  2⤵
  PID:6384
- C:\Windows\System\sqRznLM.exe
  C:\Windows\System\sqRznLM.exe
  2⤵
  PID:6740
- C:\Windows\System\fehsMRM.exe
  C:\Windows\System\fehsMRM.exe
  2⤵
  PID:6224
- C:\Windows\System\UithIVm.exe
  C:\Windows\System\UithIVm.exe
  2⤵
  PID:6284
- C:\Windows\System\AjTSilC.exe
  C:\Windows\System\AjTSilC.exe
  2⤵
  PID:6784
- C:\Windows\System\uqITKAq.exe
  C:\Windows\System\uqITKAq.exe
  2⤵
  PID:6872
- C:\Windows\System\JHuEOdB.exe
  C:\Windows\System\JHuEOdB.exe
  2⤵
  PID:6948
- C:\Windows\System\qCHwXbu.exe
  C:\Windows\System\qCHwXbu.exe
  2⤵
  PID:6504
- C:\Windows\System\cCyDSKx.exe
  C:\Windows\System\cCyDSKx.exe
  2⤵
  PID:6836
- C:\Windows\System\TxfgkbP.exe
  C:\Windows\System\TxfgkbP.exe
  2⤵
  PID:6720
- C:\Windows\System\CaABEHN.exe
  C:\Windows\System\CaABEHN.exe
  2⤵
  PID:6736
- C:\Windows\System\qGngMQe.exe
  C:\Windows\System\qGngMQe.exe
  2⤵
  PID:6916
- C:\Windows\System\RtrNvIb.exe
  C:\Windows\System\RtrNvIb.exe
  2⤵
  PID:7176
- C:\Windows\System\DGBatSc.exe
  C:\Windows\System\DGBatSc.exe
  2⤵
  PID:7196
- C:\Windows\System\qgLZAdS.exe
  C:\Windows\System\qgLZAdS.exe
  2⤵
  PID:7212
- C:\Windows\System\ymrwFwK.exe
  C:\Windows\System\ymrwFwK.exe
  2⤵
  PID:7228
- C:\Windows\System\HTeCmKJ.exe
  C:\Windows\System\HTeCmKJ.exe
  2⤵
  PID:7248
- C:\Windows\System\frjMnRi.exe
  C:\Windows\System\frjMnRi.exe
  2⤵
  PID:7264
- C:\Windows\System\NVwHntc.exe
  C:\Windows\System\NVwHntc.exe
  2⤵
  PID:7280
- C:\Windows\System\oJhPozV.exe
  C:\Windows\System\oJhPozV.exe
  2⤵
  PID:7300
- C:\Windows\System\HgcycBp.exe
  C:\Windows\System\HgcycBp.exe
  2⤵
  PID:7316
- C:\Windows\System\pLColjO.exe
  C:\Windows\System\pLColjO.exe
  2⤵
  PID:7332
- C:\Windows\System\uroQXvl.exe
  C:\Windows\System\uroQXvl.exe
  2⤵
  PID:7348
- C:\Windows\System\BPPDDat.exe
  C:\Windows\System\BPPDDat.exe
  2⤵
  PID:7364
- C:\Windows\System\UFodsou.exe
  C:\Windows\System\UFodsou.exe
  2⤵
  PID:7380
- C:\Windows\System\FzfmzEv.exe
  C:\Windows\System\FzfmzEv.exe
  2⤵
  PID:7404
- C:\Windows\System\cjETXlO.exe
  C:\Windows\System\cjETXlO.exe
  2⤵
  PID:7420
- C:\Windows\System\idTKdjy.exe
  C:\Windows\System\idTKdjy.exe
  2⤵
  PID:7436
- C:\Windows\System\JhfcaBc.exe
  C:\Windows\System\JhfcaBc.exe
  2⤵
  PID:7452
- C:\Windows\System\uJlLrhj.exe
  C:\Windows\System\uJlLrhj.exe
  2⤵
  PID:7472
- C:\Windows\System\yeqcyMh.exe
  C:\Windows\System\yeqcyMh.exe
  2⤵
  PID:7488
- C:\Windows\System\dlyTdDP.exe
  C:\Windows\System\dlyTdDP.exe
  2⤵
  PID:7504
- C:\Windows\System\wuXmVDE.exe
  C:\Windows\System\wuXmVDE.exe
  2⤵
  PID:7520
- C:\Windows\System\VzsKkNV.exe
  C:\Windows\System\VzsKkNV.exe
  2⤵
  PID:7540
- C:\Windows\System\dfPQNJS.exe
  C:\Windows\System\dfPQNJS.exe
  2⤵
  PID:7556
- C:\Windows\System\rjeLGuY.exe
  C:\Windows\System\rjeLGuY.exe
  2⤵
  PID:7580
- C:\Windows\System\BiWxYHR.exe
  C:\Windows\System\BiWxYHR.exe
  2⤵
  PID:7596
- C:\Windows\System\DJsQkAz.exe
  C:\Windows\System\DJsQkAz.exe
  2⤵
  PID:7612
- C:\Windows\System\RLBqIQD.exe
  C:\Windows\System\RLBqIQD.exe
  2⤵
  PID:7628
- C:\Windows\System\VAGKdkn.exe
  C:\Windows\System\VAGKdkn.exe
  2⤵
  PID:7644
- C:\Windows\System\oGlASsa.exe
  C:\Windows\System\oGlASsa.exe
  2⤵
  PID:7660
- C:\Windows\System\QYoCZjd.exe
  C:\Windows\System\QYoCZjd.exe
  2⤵
  PID:7680
- C:\Windows\System\FAZUtRp.exe
  C:\Windows\System\FAZUtRp.exe
  2⤵
  PID:7700
- C:\Windows\System\QYCkTjg.exe
  C:\Windows\System\QYCkTjg.exe
  2⤵
  PID:7720
- C:\Windows\System\nZEerTd.exe
  C:\Windows\System\nZEerTd.exe
  2⤵
  PID:7736
- C:\Windows\System\CsgHVTo.exe
  C:\Windows\System\CsgHVTo.exe
  2⤵
  PID:7756
- C:\Windows\System\JpOmZNR.exe
  C:\Windows\System\JpOmZNR.exe
  2⤵
  PID:7772
- C:\Windows\System\DULxYKu.exe
  C:\Windows\System\DULxYKu.exe
  2⤵
  PID:7788
- C:\Windows\System\DTfqyOI.exe
  C:\Windows\System\DTfqyOI.exe
  2⤵
  PID:7804
- C:\Windows\System\zdLNWyH.exe
  C:\Windows\System\zdLNWyH.exe
  2⤵
  PID:7820
- C:\Windows\System\nPLbACK.exe
  C:\Windows\System\nPLbACK.exe
  2⤵
  PID:7840
- C:\Windows\System\vadinYh.exe
  C:\Windows\System\vadinYh.exe
  2⤵
  PID:7856
- C:\Windows\System\RxvLofv.exe
  C:\Windows\System\RxvLofv.exe
  2⤵
  PID:7872
- C:\Windows\System\unEHdIU.exe
  C:\Windows\System\unEHdIU.exe
  2⤵
  PID:7888
- C:\Windows\System\vLwgqle.exe
  C:\Windows\System\vLwgqle.exe
  2⤵
  PID:7908
- C:\Windows\System\LnLFhvu.exe
  C:\Windows\System\LnLFhvu.exe
  2⤵
  PID:7924
- C:\Windows\System\yeeeWIN.exe
  C:\Windows\System\yeeeWIN.exe
  2⤵
  PID:7940
- C:\Windows\System\XDflpEW.exe
  C:\Windows\System\XDflpEW.exe
  2⤵
  PID:7960
- C:\Windows\System\XIDhgaO.exe
  C:\Windows\System\XIDhgaO.exe
  2⤵
  PID:7976
- C:\Windows\System\sreZwAW.exe
  C:\Windows\System\sreZwAW.exe
  2⤵
  PID:7992
- C:\Windows\System\IQclSRo.exe
  C:\Windows\System\IQclSRo.exe
  2⤵
  PID:8008
- C:\Windows\System\hrFqjoX.exe
  C:\Windows\System\hrFqjoX.exe
  2⤵
  PID:8024
- C:\Windows\System\RMkrTXe.exe
  C:\Windows\System\RMkrTXe.exe
  2⤵
  PID:8040
- C:\Windows\System\hJmteWN.exe
  C:\Windows\System\hJmteWN.exe
  2⤵
  PID:8056
- C:\Windows\System\wbquYYv.exe
  C:\Windows\System\wbquYYv.exe
  2⤵
  PID:8076
- C:\Windows\System\eoxcpBK.exe
  C:\Windows\System\eoxcpBK.exe
  2⤵
  PID:8092
- C:\Windows\System\gckVjvz.exe
  C:\Windows\System\gckVjvz.exe
  2⤵
  PID:8108
- C:\Windows\System\rtGZGcb.exe
  C:\Windows\System\rtGZGcb.exe
  2⤵
  PID:8124
- C:\Windows\System\fDVzEJh.exe
  C:\Windows\System\fDVzEJh.exe
  2⤵
  PID:8140
- C:\Windows\System\DSMnIIV.exe
  C:\Windows\System\DSMnIIV.exe
  2⤵
  PID:8156
- C:\Windows\System\JEKrqWg.exe
  C:\Windows\System\JEKrqWg.exe
  2⤵
  PID:8172
- C:\Windows\System\sWFKkiJ.exe
  C:\Windows\System\sWFKkiJ.exe
  2⤵
  PID:8188
- C:\Windows\System\fPKZZoK.exe
  C:\Windows\System\fPKZZoK.exe
  2⤵
  PID:7236
- C:\Windows\System\MgklykU.exe
  C:\Windows\System\MgklykU.exe
  2⤵
  PID:7160
- C:\Windows\System\CJTdXWe.exe
  C:\Windows\System\CJTdXWe.exe
  2⤵
  PID:7220
- C:\Windows\System\FNmsTWH.exe
  C:\Windows\System\FNmsTWH.exe
  2⤵
  PID:7260
- C:\Windows\System\lpMuAUG.exe
  C:\Windows\System\lpMuAUG.exe
  2⤵
  PID:7344
- C:\Windows\System\ZoWEBHj.exe
  C:\Windows\System\ZoWEBHj.exe
  2⤵
  PID:7292
- C:\Windows\System\WcNfAFI.exe
  C:\Windows\System\WcNfAFI.exe
  2⤵
  PID:7396
- C:\Windows\System\CmDkQmk.exe
  C:\Windows\System\CmDkQmk.exe
  2⤵
  PID:7428
- C:\Windows\System\zsqxgit.exe
  C:\Windows\System\zsqxgit.exe
  2⤵
  PID:7448
- C:\Windows\System\YlpuIMC.exe
  C:\Windows\System\YlpuIMC.exe
  2⤵
  PID:7512
- C:\Windows\System\PbMmUax.exe
  C:\Windows\System\PbMmUax.exe
  2⤵
  PID:7496
- C:\Windows\System\JyIfyyE.exe
  C:\Windows\System\JyIfyyE.exe
  2⤵
  PID:7548
- C:\Windows\System\yVVJrIH.exe
  C:\Windows\System\yVVJrIH.exe
  2⤵
  PID:7604
- C:\Windows\System\ZRsIHoh.exe
  C:\Windows\System\ZRsIHoh.exe
  2⤵
  PID:7620
- C:\Windows\System\mFFLgEQ.exe
  C:\Windows\System\mFFLgEQ.exe
  2⤵
  PID:7672
- C:\Windows\System\ErafBPU.exe
  C:\Windows\System\ErafBPU.exe
  2⤵
  PID:7692
- C:\Windows\System\ljZyeNl.exe
  C:\Windows\System\ljZyeNl.exe
  2⤵
  PID:7728
- C:\Windows\System\Fodowny.exe
  C:\Windows\System\Fodowny.exe
  2⤵
  PID:7752
- C:\Windows\System\GkAGBTd.exe
  C:\Windows\System\GkAGBTd.exe
  2⤵
  PID:7816
- C:\Windows\System\LcYjXfm.exe
  C:\Windows\System\LcYjXfm.exe
  2⤵
  PID:7800
- C:\Windows\System\klyGded.exe
  C:\Windows\System\klyGded.exe
  2⤵
  PID:7864
- C:\Windows\System\GcnUJpM.exe
  C:\Windows\System\GcnUJpM.exe
  2⤵
  PID:7868
- C:\Windows\System\cNNXcAZ.exe
  C:\Windows\System\cNNXcAZ.exe
  2⤵
  PID:7904
- C:\Windows\System\PDEKvBX.exe
  C:\Windows\System\PDEKvBX.exe
  2⤵
  PID:7920
- C:\Windows\System\FfUDQqO.exe
  C:\Windows\System\FfUDQqO.exe
  2⤵
  PID:7956
- C:\Windows\System\jFFlLIu.exe
  C:\Windows\System\jFFlLIu.exe
  2⤵
  PID:8000
- C:\Windows\System\LLqHimC.exe
  C:\Windows\System\LLqHimC.exe
  2⤵
  PID:2092
- C:\Windows\System\LIbmspP.exe
  C:\Windows\System\LIbmspP.exe
  2⤵
  PID:8020
- C:\Windows\System\uBdtWjh.exe
  C:\Windows\System\uBdtWjh.exe
  2⤵
  PID:8052
- C:\Windows\System\gjbOELY.exe
  C:\Windows\System\gjbOELY.exe
  2⤵
  PID:8148
- C:\Windows\System\lwbvdXQ.exe
  C:\Windows\System\lwbvdXQ.exe
  2⤵
  PID:8072
- C:\Windows\System\byTezta.exe
  C:\Windows\System\byTezta.exe
  2⤵
  PID:8136
- C:\Windows\System\JedOlzq.exe
  C:\Windows\System\JedOlzq.exe
  2⤵
  PID:8184
- C:\Windows\System\PexuOMz.exe
  C:\Windows\System\PexuOMz.exe
  2⤵
  PID:7204
- C:\Windows\System\gbRcwZw.exe
  C:\Windows\System\gbRcwZw.exe
  2⤵
  PID:7276
- C:\Windows\System\nNTUWDU.exe
  C:\Windows\System\nNTUWDU.exe
  2⤵
  PID:7412
- C:\Windows\System\HmYQAAv.exe
  C:\Windows\System\HmYQAAv.exe
  2⤵
  PID:7356
- C:\Windows\System\fKmdRQh.exe
  C:\Windows\System\fKmdRQh.exe
  2⤵
  PID:7468
- C:\Windows\System\PodoQcB.exe
  C:\Windows\System\PodoQcB.exe
  2⤵
  PID:7592
- C:\Windows\System\mckBLFj.exe
  C:\Windows\System\mckBLFj.exe
  2⤵
  PID:7576
- C:\Windows\System\YtzrpBd.exe
  C:\Windows\System\YtzrpBd.exe
  2⤵
  PID:7696
- C:\Windows\System\LXvhJiS.exe
  C:\Windows\System\LXvhJiS.exe
  2⤵
  PID:7812
- C:\Windows\System\GLPQTJL.exe
  C:\Windows\System\GLPQTJL.exe
  2⤵
  PID:7296
- C:\Windows\System\RtQBsry.exe
  C:\Windows\System\RtQBsry.exe
  2⤵
  PID:7896
- C:\Windows\System\NQVdGCi.exe
  C:\Windows\System\NQVdGCi.exe
  2⤵
  PID:7972
- C:\Windows\System\nbioNvc.exe
  C:\Windows\System\nbioNvc.exe
  2⤵
  PID:8116
- C:\Windows\System\AhPEIgw.exe
  C:\Windows\System\AhPEIgw.exe
  2⤵
  PID:8168
- C:\Windows\System\KwxvJKl.exe
  C:\Windows\System\KwxvJKl.exe
  2⤵
  PID:8180
- C:\Windows\System\CvhsVdv.exe
  C:\Windows\System\CvhsVdv.exe
  2⤵
  PID:7484
- C:\Windows\System\UnCmcdC.exe
  C:\Windows\System\UnCmcdC.exe
  2⤵
  PID:7564
- C:\Windows\System\lNMsWdj.exe
  C:\Windows\System\lNMsWdj.exe
  2⤵
  PID:7340
- C:\Windows\System\aGBHfaN.exe
  C:\Windows\System\aGBHfaN.exe
  2⤵
  PID:7744
- C:\Windows\System\KUSgTcV.exe
  C:\Windows\System\KUSgTcV.exe
  2⤵
  PID:7916
- C:\Windows\System\pttPRIL.exe
  C:\Windows\System\pttPRIL.exe
  2⤵
  PID:7324
- C:\Windows\System\xVkQtbD.exe
  C:\Windows\System\xVkQtbD.exe
  2⤵
  PID:8036
- C:\Windows\System\qelvoQY.exe
  C:\Windows\System\qelvoQY.exe
  2⤵
  PID:7952
- C:\Windows\System\DRqptuh.exe
  C:\Windows\System\DRqptuh.exe
  2⤵
  PID:7464
- C:\Windows\System\YLRUVRG.exe
  C:\Windows\System\YLRUVRG.exe
  2⤵
  PID:7748
- C:\Windows\System\Clnyaug.exe
  C:\Windows\System\Clnyaug.exe
  2⤵
  PID:7272
- C:\Windows\System\dREuXBr.exe
  C:\Windows\System\dREuXBr.exe
  2⤵
  PID:7636
- C:\Windows\System\xAMiZIV.exe
  C:\Windows\System\xAMiZIV.exe
  2⤵
  PID:8212
- C:\Windows\System\mCjGGuW.exe
  C:\Windows\System\mCjGGuW.exe
  2⤵
  PID:8228
- C:\Windows\System\QOrdLTh.exe
  C:\Windows\System\QOrdLTh.exe
  2⤵
  PID:8260
- C:\Windows\System\LZBYAhr.exe
  C:\Windows\System\LZBYAhr.exe
  2⤵
  PID:8276
- C:\Windows\System\LzIAtuM.exe
  C:\Windows\System\LzIAtuM.exe
  2⤵
  PID:8292
- C:\Windows\System\FMxxBpY.exe
  C:\Windows\System\FMxxBpY.exe
  2⤵
  PID:8308
- C:\Windows\System\gsstCCk.exe
  C:\Windows\System\gsstCCk.exe
  2⤵
  PID:8324
- C:\Windows\System\nGlhkUL.exe
  C:\Windows\System\nGlhkUL.exe
  2⤵
  PID:8340
- C:\Windows\System\FrGByXA.exe
  C:\Windows\System\FrGByXA.exe
  2⤵
  PID:8356
- C:\Windows\System\xVZykli.exe
  C:\Windows\System\xVZykli.exe
  2⤵
  PID:8372
- C:\Windows\System\idQnOkR.exe
  C:\Windows\System\idQnOkR.exe
  2⤵
  PID:8392
- C:\Windows\System\jWaUXGz.exe
  C:\Windows\System\jWaUXGz.exe
  2⤵
  PID:8412
- C:\Windows\System\EMxwJAe.exe
  C:\Windows\System\EMxwJAe.exe
  2⤵
  PID:8428
- C:\Windows\System\YvHTzOc.exe
  C:\Windows\System\YvHTzOc.exe
  2⤵
  PID:8444
- C:\Windows\System\LcsVpjr.exe
  C:\Windows\System\LcsVpjr.exe
  2⤵
  PID:8460
- C:\Windows\System\xMndZpi.exe
  C:\Windows\System\xMndZpi.exe
  2⤵
  PID:8640
- C:\Windows\System\MGczgKs.exe
  C:\Windows\System\MGczgKs.exe
  2⤵
  PID:8660
- C:\Windows\System\TiGwJuB.exe
  C:\Windows\System\TiGwJuB.exe
  2⤵
  PID:8676
- C:\Windows\System\bMqVTdG.exe
  C:\Windows\System\bMqVTdG.exe
  2⤵
  PID:8732
- C:\Windows\System\cCjmPRk.exe
  C:\Windows\System\cCjmPRk.exe
  2⤵
  PID:8748
- C:\Windows\System\AQJEtHB.exe
  C:\Windows\System\AQJEtHB.exe
  2⤵
  PID:8764
- C:\Windows\System\MGPAukT.exe
  C:\Windows\System\MGPAukT.exe
  2⤵
  PID:8780
- C:\Windows\System\THfxXid.exe
  C:\Windows\System\THfxXid.exe
  2⤵
  PID:8796
- C:\Windows\System\IkaqrrA.exe
  C:\Windows\System\IkaqrrA.exe
  2⤵
  PID:8812
- C:\Windows\System\Dijqzvu.exe
  C:\Windows\System\Dijqzvu.exe
  2⤵
  PID:8828
- C:\Windows\System\UFYNbSO.exe
  C:\Windows\System\UFYNbSO.exe
  2⤵
  PID:8844
- C:\Windows\System\lUhbhII.exe
  C:\Windows\System\lUhbhII.exe
  2⤵
  PID:8860
- C:\Windows\System\njAMhsZ.exe
  C:\Windows\System\njAMhsZ.exe
  2⤵
  PID:8876
- C:\Windows\System\IOwQvyQ.exe
  C:\Windows\System\IOwQvyQ.exe
  2⤵
  PID:8892
- C:\Windows\System\ItoJXGN.exe
  C:\Windows\System\ItoJXGN.exe
  2⤵
  PID:8908
- C:\Windows\System\GeMeXMm.exe
  C:\Windows\System\GeMeXMm.exe
  2⤵
  PID:8924
- C:\Windows\System\snCqzWl.exe
  C:\Windows\System\snCqzWl.exe
  2⤵
  PID:8940
- C:\Windows\System\aNYThGL.exe
  C:\Windows\System\aNYThGL.exe
  2⤵
  PID:8956
- C:\Windows\System\cslswrV.exe
  C:\Windows\System\cslswrV.exe
  2⤵
  PID:8976
- C:\Windows\System\IDzCHVp.exe
  C:\Windows\System\IDzCHVp.exe
  2⤵
  PID:8992
- C:\Windows\System\fKHiFPx.exe
  C:\Windows\System\fKHiFPx.exe
  2⤵
  PID:9008
- C:\Windows\System\gCZFsqW.exe
  C:\Windows\System\gCZFsqW.exe
  2⤵
  PID:9024
- C:\Windows\System\KsPVoIs.exe
  C:\Windows\System\KsPVoIs.exe
  2⤵
  PID:9040
- C:\Windows\System\BOEcqGp.exe
  C:\Windows\System\BOEcqGp.exe
  2⤵
  PID:9056
- C:\Windows\System\pCJLIyP.exe
  C:\Windows\System\pCJLIyP.exe
  2⤵
  PID:9192
- C:\Windows\System\usUUPAA.exe
  C:\Windows\System\usUUPAA.exe
  2⤵
  PID:7376
- C:\Windows\System\ZmGjEfr.exe
  C:\Windows\System\ZmGjEfr.exe
  2⤵
  PID:8220
- C:\Windows\System\FkEnZnX.exe
  C:\Windows\System\FkEnZnX.exe
  2⤵
  PID:8224
- C:\Windows\System\qokIdNN.exe
  C:\Windows\System\qokIdNN.exe
  2⤵
  PID:7852
- C:\Windows\System\qPtkrWS.exe
  C:\Windows\System\qPtkrWS.exe
  2⤵
  PID:8268
- C:\Windows\System\TKIqlqQ.exe
  C:\Windows\System\TKIqlqQ.exe
  2⤵
  PID:8304
- C:\Windows\System\eBKpOxR.exe
  C:\Windows\System\eBKpOxR.exe
  2⤵
  PID:2368
- C:\Windows\System\IObyJpB.exe
  C:\Windows\System\IObyJpB.exe
  2⤵
  PID:8208
- C:\Windows\System\JEIOeXo.exe
  C:\Windows\System\JEIOeXo.exe
  2⤵
  PID:8364
- C:\Windows\System\OCrWYgo.exe
  C:\Windows\System\OCrWYgo.exe
  2⤵
  PID:8348
- C:\Windows\System\wFGKwmd.exe
  C:\Windows\System\wFGKwmd.exe
  2⤵
  PID:8652
- C:\Windows\System\nAWVRDS.exe
  C:\Windows\System\nAWVRDS.exe
  2⤵
  PID:8756
- C:\Windows\System\fACBeEl.exe
  C:\Windows\System\fACBeEl.exe
  2⤵
  PID:8820
- C:\Windows\System\xjNBpuZ.exe
  C:\Windows\System\xjNBpuZ.exe
  2⤵
  PID:8888
- C:\Windows\System\kUBPHNm.exe
  C:\Windows\System\kUBPHNm.exe
  2⤵
  PID:8612
- C:\Windows\System\bLtAEPH.exe
  C:\Windows\System\bLtAEPH.exe
  2⤵
  PID:8628
- C:\Windows\System\dlcZhbF.exe
  C:\Windows\System\dlcZhbF.exe
  2⤵
  PID:8740
- C:\Windows\System\JGvwTKK.exe
  C:\Windows\System\JGvwTKK.exe
  2⤵
  PID:8900
- C:\Windows\System\xTIQYTf.exe
  C:\Windows\System\xTIQYTf.exe
  2⤵
  PID:9200
- C:\Windows\System\oWvOBXU.exe
  C:\Windows\System\oWvOBXU.exe
  2⤵
  PID:9072
- C:\Windows\System\qKxZmcI.exe
  C:\Windows\System\qKxZmcI.exe
  2⤵
  PID:9092
- C:\Windows\System\BbCZyZk.exe
  C:\Windows\System\BbCZyZk.exe
  2⤵
  PID:9116
- C:\Windows\System\WaEvhbF.exe
  C:\Windows\System\WaEvhbF.exe
  2⤵
  PID:9128
- C:\Windows\System\fOHmFOa.exe
  C:\Windows\System\fOHmFOa.exe
  2⤵
  PID:9148
- C:\Windows\System\cjkYXLx.exe
  C:\Windows\System\cjkYXLx.exe
  2⤵
  PID:9164
- C:\Windows\System\GlUaTlX.exe
  C:\Windows\System\GlUaTlX.exe
  2⤵
  PID:8132
- C:\Windows\System\rFRRCig.exe
  C:\Windows\System\rFRRCig.exe
  2⤵
  PID:7984
- C:\Windows\System\nfYCHeL.exe
  C:\Windows\System\nfYCHeL.exe
  2⤵
  PID:7936
- C:\Windows\System\sbIGDGb.exe
  C:\Windows\System\sbIGDGb.exe
  2⤵
  PID:8240
- C:\Windows\System\ahHePpm.exe
  C:\Windows\System\ahHePpm.exe
  2⤵
  PID:8388
- C:\Windows\System\DHBZkUG.exe
  C:\Windows\System\DHBZkUG.exe
  2⤵
  PID:8320
- C:\Windows\System\lAFVepd.exe
  C:\Windows\System\lAFVepd.exe
  2⤵
  PID:8452
- C:\Windows\System\wNtCJtl.exe
  C:\Windows\System\wNtCJtl.exe
  2⤵
  PID:8484
- C:\Windows\System\KxbsbZK.exe
  C:\Windows\System\KxbsbZK.exe
  2⤵
  PID:8524
- C:\Windows\System\dArydal.exe
  C:\Windows\System\dArydal.exe
  2⤵
  PID:8516
- C:\Windows\System\ShbfZCT.exe
  C:\Windows\System\ShbfZCT.exe
  2⤵
  PID:8532
- C:\Windows\System\TKnrNXI.exe
  C:\Windows\System\TKnrNXI.exe
  2⤵
  PID:8560
- C:\Windows\System\grmKQPK.exe
  C:\Windows\System\grmKQPK.exe
  2⤵
  PID:8684
- C:\Windows\System\wABoSKZ.exe
  C:\Windows\System\wABoSKZ.exe
  2⤵
  PID:8884
- C:\Windows\System\ZDOpxbH.exe
  C:\Windows\System\ZDOpxbH.exe
  2⤵
  PID:8648
- C:\Windows\System\OtyzDHL.exe
  C:\Windows\System\OtyzDHL.exe
  2⤵
  PID:8088
- C:\Windows\System\PHiczJp.exe
  C:\Windows\System\PHiczJp.exe
  2⤵
  PID:8868
- C:\Windows\System\jkgobQm.exe
  C:\Windows\System\jkgobQm.exe
  2⤵
  PID:9208
- C:\Windows\System\iEXyVQN.exe
  C:\Windows\System\iEXyVQN.exe
  2⤵
  PID:9212
- C:\Windows\System\MYLBSfK.exe
  C:\Windows\System\MYLBSfK.exe
  2⤵
  PID:8332
- C:\Windows\System\SKqmNBr.exe
  C:\Windows\System\SKqmNBr.exe
  2⤵
  PID:8792
- C:\Windows\System\BKNocnd.exe
  C:\Windows\System\BKNocnd.exe
  2⤵
  PID:8692
- C:\Windows\System\RSgEtqJ.exe
  C:\Windows\System\RSgEtqJ.exe
  2⤵
  PID:9088
- C:\Windows\System\xLXFJTZ.exe
  C:\Windows\System\xLXFJTZ.exe
  2⤵
  PID:9124
- C:\Windows\System\wmLmFZs.exe
  C:\Windows\System\wmLmFZs.exe
  2⤵
  PID:9004
- C:\Windows\System\TZyqyTl.exe
  C:\Windows\System\TZyqyTl.exe
  2⤵
  PID:8984
- C:\Windows\System\EvvXiPX.exe
  C:\Windows\System\EvvXiPX.exe
  2⤵
  PID:7708
- C:\Windows\System\pVWmlbL.exe
  C:\Windows\System\pVWmlbL.exe
  2⤵
  PID:8552
- C:\Windows\System\ZGrXOnL.exe
  C:\Windows\System\ZGrXOnL.exe
  2⤵
  PID:8492
- C:\Windows\System\bkEJzng.exe
  C:\Windows\System\bkEJzng.exe
  2⤵
  PID:8504
- C:\Windows\System\YGIRMmp.exe
  C:\Windows\System\YGIRMmp.exe
  2⤵
  PID:8248
- C:\Windows\System\OWckejw.exe
  C:\Windows\System\OWckejw.exe
  2⤵
  PID:8760
- C:\Windows\System\dgOqIku.exe
  C:\Windows\System\dgOqIku.exe
  2⤵
  PID:9224
- C:\Windows\System\zOiqXCc.exe
  C:\Windows\System\zOiqXCc.exe
  2⤵
  PID:9372
- C:\Windows\System\IulKSap.exe
  C:\Windows\System\IulKSap.exe
  2⤵
  PID:9408
- C:\Windows\System\kJzknjP.exe
  C:\Windows\System\kJzknjP.exe
  2⤵
  PID:9424
- C:\Windows\System\VUFZgXj.exe
  C:\Windows\System\VUFZgXj.exe
  2⤵
  PID:9440
- C:\Windows\System\bzOQgUp.exe
  C:\Windows\System\bzOQgUp.exe
  2⤵
  PID:9460
- C:\Windows\System\PknoTZp.exe
  C:\Windows\System\PknoTZp.exe
  2⤵
  PID:9520
- C:\Windows\System\BjJebkE.exe
  C:\Windows\System\BjJebkE.exe
  2⤵
  PID:9536
- C:\Windows\System\phxlWbV.exe
  C:\Windows\System\phxlWbV.exe
  2⤵
  PID:9552
- C:\Windows\System\qNXYrZw.exe
  C:\Windows\System\qNXYrZw.exe
  2⤵
  PID:9576
- C:\Windows\System\gazIfmT.exe
  C:\Windows\System\gazIfmT.exe
  2⤵
  PID:9600
- C:\Windows\System\qbiWaXF.exe
  C:\Windows\System\qbiWaXF.exe
  2⤵
  PID:9616
- C:\Windows\System\LitueRt.exe
  C:\Windows\System\LitueRt.exe
  2⤵
  PID:9636
- C:\Windows\System\ZvPLkaj.exe
  C:\Windows\System\ZvPLkaj.exe
  2⤵
  PID:9652
- C:\Windows\System\CwMyxaf.exe
  C:\Windows\System\CwMyxaf.exe
  2⤵
  PID:9752
- C:\Windows\System\tpLOrUI.exe
  C:\Windows\System\tpLOrUI.exe
  2⤵
  PID:9772
- C:\Windows\System\yQaQsGY.exe
  C:\Windows\System\yQaQsGY.exe
  2⤵
  PID:9788
- C:\Windows\System\UCmbNTZ.exe
  C:\Windows\System\UCmbNTZ.exe
  2⤵
  PID:9804
- C:\Windows\System\eclTQYX.exe
  C:\Windows\System\eclTQYX.exe
  2⤵
  PID:9820
- C:\Windows\System\yElzgUw.exe
  C:\Windows\System\yElzgUw.exe
  2⤵
  PID:9844
- C:\Windows\System\xVEaHfm.exe
  C:\Windows\System\xVEaHfm.exe
  2⤵
  PID:9868
- C:\Windows\System\duwGIio.exe
  C:\Windows\System\duwGIio.exe
  2⤵
  PID:9884
- C:\Windows\System\HdRmGXr.exe
  C:\Windows\System\HdRmGXr.exe
  2⤵
  PID:9908
- C:\Windows\System\fgjRFEP.exe
  C:\Windows\System\fgjRFEP.exe
  2⤵
  PID:9936
- C:\Windows\System\UWMKcNX.exe
  C:\Windows\System\UWMKcNX.exe
  2⤵
  PID:9952
- C:\Windows\System\QWFWAym.exe
  C:\Windows\System\QWFWAym.exe
  2⤵
  PID:9968
- C:\Windows\System\cdjtaQc.exe
  C:\Windows\System\cdjtaQc.exe
  2⤵
  PID:9984
- C:\Windows\System\cqLECgX.exe
  C:\Windows\System\cqLECgX.exe
  2⤵
  PID:10000
- C:\Windows\System\xJbApYK.exe
  C:\Windows\System\xJbApYK.exe
  2⤵
  PID:10028
- C:\Windows\System\kpgxbkb.exe
  C:\Windows\System\kpgxbkb.exe
  2⤵
  PID:10140
- C:\Windows\System\ZcSYRCU.exe
  C:\Windows\System\ZcSYRCU.exe
  2⤵
  PID:10156
- C:\Windows\System\BmIvrMj.exe
  C:\Windows\System\BmIvrMj.exe
  2⤵
  PID:10172
- C:\Windows\System\IvIjJhV.exe
  C:\Windows\System\IvIjJhV.exe
  2⤵
  PID:10188
- C:\Windows\System\etvvrVn.exe
  C:\Windows\System\etvvrVn.exe
  2⤵
  PID:10204
- C:\Windows\System\xYSwCIb.exe
  C:\Windows\System\xYSwCIb.exe
  2⤵
  PID:10220
- C:\Windows\System\oNANKrO.exe
  C:\Windows\System\oNANKrO.exe
  2⤵
  PID:8936
- C:\Windows\System\PXOiusL.exe
  C:\Windows\System\PXOiusL.exe
  2⤵
  PID:8556
- C:\Windows\System\wwbtCyN.exe
  C:\Windows\System\wwbtCyN.exe
  2⤵
  PID:9232
- C:\Windows\System\KXOHCJG.exe
  C:\Windows\System\KXOHCJG.exe
  2⤵
  PID:8496
- C:\Windows\System\nZApOOw.exe
  C:\Windows\System\nZApOOw.exe
  2⤵
  PID:9180
- C:\Windows\System\pkjTxhP.exe
  C:\Windows\System\pkjTxhP.exe
  2⤵
  PID:9096
- C:\Windows\System\sLHuqQs.exe
  C:\Windows\System\sLHuqQs.exe
  2⤵
  PID:8856
- C:\Windows\System\jPzbfkw.exe
  C:\Windows\System\jPzbfkw.exe
  2⤵
  PID:1504
- C:\Windows\System\QpDPxjT.exe
  C:\Windows\System\QpDPxjT.exe
  2⤵
  PID:9064
- C:\Windows\System\gnVnGUh.exe
  C:\Windows\System\gnVnGUh.exe
  2⤵
  PID:960
- C:\Windows\System\vbmcWSw.exe
  C:\Windows\System\vbmcWSw.exe
  2⤵
  PID:9184
- C:\Windows\System\ZXnEozS.exe
  C:\Windows\System\ZXnEozS.exe
  2⤵
  PID:2800
- C:\Windows\System\PEiVDTF.exe
  C:\Windows\System\PEiVDTF.exe
  2⤵
  PID:8716
- C:\Windows\System\ILgsgFS.exe
  C:\Windows\System\ILgsgFS.exe
  2⤵
  PID:8920
- C:\Windows\System\POGCNDJ.exe
  C:\Windows\System\POGCNDJ.exe
  2⤵
  PID:8948
- C:\Windows\System\ZBZjWUe.exe
  C:\Windows\System\ZBZjWUe.exe
  2⤵
  PID:8472
- C:\Windows\System\trwLwTv.exe
  C:\Windows\System\trwLwTv.exe
  2⤵
  PID:8840
- C:\Windows\System\xuSyDId.exe
  C:\Windows\System\xuSyDId.exe
  2⤵
  PID:8564
- C:\Windows\System\AQKzdNj.exe
  C:\Windows\System\AQKzdNj.exe
  2⤵
  PID:9276
- C:\Windows\System\KYObQEZ.exe
  C:\Windows\System\KYObQEZ.exe
  2⤵
  PID:9308
- C:\Windows\System\XPYKyWb.exe
  C:\Windows\System\XPYKyWb.exe
  2⤵
  PID:9432
- C:\Windows\System\ZeJTigL.exe
  C:\Windows\System\ZeJTigL.exe
  2⤵
  PID:9504
- C:\Windows\System\YTvraWB.exe
  C:\Windows\System\YTvraWB.exe
  2⤵
  PID:9544
- C:\Windows\System\rdJWDoR.exe
  C:\Windows\System\rdJWDoR.exe
  2⤵
  PID:9660
- C:\Windows\System\jTbDDaD.exe
  C:\Windows\System\jTbDDaD.exe
  2⤵
  PID:9668
- C:\Windows\System\eoaUxrU.exe
  C:\Windows\System\eoaUxrU.exe
  2⤵
  PID:9456
- C:\Windows\System\BlLFTjC.exe
  C:\Windows\System\BlLFTjC.exe
  2⤵
  PID:9684
- C:\Windows\System\vDICLKH.exe
  C:\Windows\System\vDICLKH.exe
  2⤵
  PID:9700
- C:\Windows\System\lkZTRJn.exe
  C:\Windows\System\lkZTRJn.exe
  2⤵
  PID:9724
- C:\Windows\System\QYZUfLs.exe
  C:\Windows\System\QYZUfLs.exe
  2⤵
  PID:9744
- C:\Windows\System\ejfRAyV.exe
  C:\Windows\System\ejfRAyV.exe
  2⤵
  PID:9812
- C:\Windows\System\rVaijLx.exe
  C:\Windows\System\rVaijLx.exe
  2⤵
  PID:9860
- C:\Windows\System\LjbyxAE.exe
  C:\Windows\System\LjbyxAE.exe
  2⤵
  PID:9904
- C:\Windows\System\nJMMCCd.exe
  C:\Windows\System\nJMMCCd.exe
  2⤵
  PID:9532
- C:\Windows\System\XguUqnn.exe
  C:\Windows\System\XguUqnn.exe
  2⤵
  PID:9568
- C:\Windows\System\IYeHbvh.exe
  C:\Windows\System\IYeHbvh.exe
  2⤵
  PID:9648
- C:\Windows\System\YXOyZPz.exe
  C:\Windows\System\YXOyZPz.exe
  2⤵
  PID:10020
- C:\Windows\System\rcHsEDg.exe
  C:\Windows\System\rcHsEDg.exe
  2⤵
  PID:9932
- C:\Windows\System\XLMEjyw.exe
  C:\Windows\System\XLMEjyw.exe
  2⤵
  PID:10040
- C:\Windows\System\njgkNwm.exe
  C:\Windows\System\njgkNwm.exe
  2⤵
  PID:10148
- C:\Windows\System\IrirAyv.exe
  C:\Windows\System\IrirAyv.exe
  2⤵
  PID:10076
- C:\Windows\System\iPLcprM.exe
  C:\Windows\System\iPLcprM.exe
  2⤵
  PID:10072
- C:\Windows\System\Esekqhn.exe
  C:\Windows\System\Esekqhn.exe
  2⤵
  PID:10136
- C:\Windows\System\PfoDmrf.exe
  C:\Windows\System\PfoDmrf.exe
  2⤵
  PID:10108
- C:\Windows\System\tbbnCEf.exe
  C:\Windows\System\tbbnCEf.exe
  2⤵
  PID:9000
- C:\Windows\System\YeMPTka.exe
  C:\Windows\System\YeMPTka.exe
  2⤵
  PID:9268
- C:\Windows\System\jAjFYHT.exe
  C:\Windows\System\jAjFYHT.exe
  2⤵
  PID:10236
- C:\Windows\System\qijNbnM.exe
  C:\Windows\System\qijNbnM.exe
  2⤵
  PID:9172
- C:\Windows\System\OSEZNJA.exe
  C:\Windows\System\OSEZNJA.exe
  2⤵
  PID:8852
- C:\Windows\System\RFQNrmq.exe
  C:\Windows\System\RFQNrmq.exe
  2⤵
  PID:2404
- C:\Windows\System\ToiNdYI.exe
  C:\Windows\System\ToiNdYI.exe
  2⤵
  PID:8972
- C:\Windows\System\cjijiPm.exe
  C:\Windows\System\cjijiPm.exe
  2⤵
  PID:8636
- C:\Windows\System\YorHyok.exe
  C:\Windows\System\YorHyok.exe
  2⤵
  PID:8788
- C:\Windows\System\wyrPCdU.exe
  C:\Windows\System\wyrPCdU.exe
  2⤵
  PID:9156
- C:\Windows\System\aSXWjbT.exe
  C:\Windows\System\aSXWjbT.exe
  2⤵
  PID:8440
- C:\Windows\System\qfGcnJV.exe
  C:\Windows\System\qfGcnJV.exe
  2⤵
  PID:8316
- C:\Windows\System\HqbAadb.exe
  C:\Windows\System\HqbAadb.exe
  2⤵
  PID:9240
- C:\Windows\System\ubpqSWR.exe
  C:\Windows\System\ubpqSWR.exe
  2⤵
  PID:9292
- C:\Windows\System\PkGqtbx.exe
  C:\Windows\System\PkGqtbx.exe
  2⤵
  PID:10056
- C:\Windows\System\LzGkGSA.exe
  C:\Windows\System\LzGkGSA.exe
  2⤵
  PID:9404
- C:\Windows\System\fiJdElk.exe
  C:\Windows\System\fiJdElk.exe
  2⤵
  PID:9396
- C:\Windows\System\zQaXNCc.exe
  C:\Windows\System\zQaXNCc.exe
  2⤵
  PID:9352
- C:\Windows\System\BqKndvI.exe
  C:\Windows\System\BqKndvI.exe
  2⤵
  PID:9488
- C:\Windows\System\hUTuRTw.exe
  C:\Windows\System\hUTuRTw.exe
  2⤵
  PID:9508
- C:\Windows\System\NjhcsKa.exe
  C:\Windows\System\NjhcsKa.exe
  2⤵
  PID:9512
- C:\Windows\System\PKlHiqe.exe
  C:\Windows\System\PKlHiqe.exe
  2⤵
  PID:9676
- C:\Windows\System\fclFUKN.exe
  C:\Windows\System\fclFUKN.exe
  2⤵
  PID:9712
- C:\Windows\System\rTXXzxK.exe
  C:\Windows\System\rTXXzxK.exe
  2⤵
  PID:9624
- C:\Windows\System\BmwmRGC.exe
  C:\Windows\System\BmwmRGC.exe
  2⤵
  PID:9452
- C:\Windows\System\FGKtbek.exe
  C:\Windows\System\FGKtbek.exe
  2⤵
  PID:9736
- C:\Windows\System\bMgpdoJ.exe
  C:\Windows\System\bMgpdoJ.exe
  2⤵
  PID:9528
- C:\Windows\System\xYqTRjx.exe
  C:\Windows\System\xYqTRjx.exe
  2⤵
  PID:9780
- C:\Windows\System\beKepAu.exe
  C:\Windows\System\beKepAu.exe
  2⤵
  PID:9920
- C:\Windows\System\nZhWOws.exe
  C:\Windows\System\nZhWOws.exe
  2⤵
  PID:9136
- C:\Windows\System\kaJHinL.exe
  C:\Windows\System\kaJHinL.exe
  2⤵
  PID:10036
- C:\Windows\System\ApMgDnr.exe
  C:\Windows\System\ApMgDnr.exe
  2⤵
  PID:9796
- C:\Windows\System\RJaiASB.exe
  C:\Windows\System\RJaiASB.exe
  2⤵
  PID:10008
- C:\Windows\System\fZZABbb.exe
  C:\Windows\System\fZZABbb.exe
  2⤵
  PID:10096
- C:\Windows\System\mwFxZwb.exe
  C:\Windows\System\mwFxZwb.exe
  2⤵
  PID:10048
- C:\Windows\System\ypqvfRs.exe
  C:\Windows\System\ypqvfRs.exe
  2⤵
  PID:10216
- C:\Windows\System\FpUVFVF.exe
  C:\Windows\System\FpUVFVF.exe
  2⤵
  PID:10164
- C:\Windows\System\fwikmTD.exe
  C:\Windows\System\fwikmTD.exe
  2⤵
  PID:8804
- C:\Windows\System\JZVLxYg.exe
  C:\Windows\System\JZVLxYg.exe
  2⤵
  PID:8420
- C:\Windows\System\eXqttdz.exe
  C:\Windows\System\eXqttdz.exe
  2⤵
  PID:1528
- C:\Windows\System\gvuQYEc.exe
  C:\Windows\System\gvuQYEc.exe
  2⤵
  PID:8488
- C:\Windows\System\ERyFvpm.exe
  C:\Windows\System\ERyFvpm.exe
  2⤵
  PID:9272
- C:\Windows\System\gJFznjo.exe
  C:\Windows\System\gJFznjo.exe
  2⤵
  PID:2888
- C:\Windows\System\QXptfGp.exe
  C:\Windows\System\QXptfGp.exe
  2⤵
  PID:8548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ALFnHFM.exe

Filesize
1.8MB

MD5
4a1c5767c05a136d54fa86d48d846503

SHA1
f545958ad683067d155f0cd108169b7487db8872

SHA256
40221e9f958182cacd491e449f952e2512344636dacfcb0df9dbead471923ec2

SHA512
9c8238dcf0d16dd415a9cfea09c9912b7192dc5dfe6f2e59fdd5b1148a8482574d07c0eada51c17e39f6f44a4b7d93ccae725dec026e9cdc2fddb0f05dec6f5d

Download Submit
C:\Windows\system\BkpqqNQ.exe

Filesize
1.8MB

MD5
68b9313969b2a17c4bccc2e3fdc582df

SHA1
c64eb4ea9f5325adf4c103b6f08aeac8d374e6ce

SHA256
6c894871ecf211eba0c5efe0981e51d5e8b56528fd94006c27d47ad8c56a0ff5

SHA512
cb76cf59a1e9a9b9ba1f1bd44644c0b5d01a1a1bb2bf1298a20b8db13fc59a94c5d42173d41438dbe86538f4d48fb2de5da70a480d72fa2edf97efede269c7ef

Download Submit
C:\Windows\system\CreUXWf.exe

Filesize
1.8MB

MD5
9d4c458e1c94063787fb3e1b57953c51

SHA1
e1888bb9b0e98ef55e1a27fb72edbfd681ab3fae

SHA256
3fa28f6b6957d4be03e801251d2d4d8dfd3cc17dc90c194bc77f793c67ba18de

SHA512
be94c6cea678152649cbca60bcbc3cfb6bed1bee34d63e79794334c2d6ee12cd2392ae92fdd114ad16002fa27c76d61b9a0de1e41910423099c5858897a50088

Download Submit
C:\Windows\system\DCZGUUw.exe

Filesize
1.8MB

MD5
30522b67e0609208990e6eadfc31331c

SHA1
f5290864c14ed5c797935e6e2f2c0aede820db33

SHA256
12a1bc778eb4b738788e3a701800666e7a41377757c3a63b0e582c6105287d04

SHA512
f69a72c563629c39706c854d3a55204cbcc501d44bccad992f1a93fe1259d73037c9d88ed305567b7e3932f80c643616f8738ee4a7884ab73e8e3cb8740a3b25

Download Submit
C:\Windows\system\ErlENIE.exe

Filesize
1.8MB

MD5
67cf20c12eed459e5cffb0c436a7d9b2

SHA1
0520ae1158120b4953a7f2e04a27dead471e51fd

SHA256
a3d4fdb87f2009e6a1f20a72bd8be9782569747904178b7008ccad7ba4d07f87

SHA512
226bc022ad11790bd63f24934a12809cc1ef1153fe98108133353b43ed241ee79dfab6637c7ba232612f0be373bdc92c314fd88c5d38b6899ebeb647bc0be962

Download Submit
C:\Windows\system\HkXJnrN.exe

Filesize
1.8MB

MD5
2b0ca796a6c8af05c160237b499b27f6

SHA1
242f2be50259b3918bffb08554d17b9ede7a8199

SHA256
3624ea61c8935390ec2fc98a4e216155bb2f73e8c20c06479a38d2c8fc5596d6

SHA512
5ec8b60ca1634103f40f41b27dccaaf3d1bb246f866d6a15d0d35a8f5a3ef61d248f68b6a044ab7788fc30bc82b0474e0eb51cc4f4b38375cd4da33ddbb22ccd

Download Submit
C:\Windows\system\LGqkIhl.exe

Filesize
1.8MB

MD5
ba43f9890e667ccec9653f20bf8c3fd5

SHA1
62938e3fa938b042edba3997270124723fff556c

SHA256
feacdb729c51e271ce55fc325fba5d7d07d406086c36fb0ffd96e1cc99ec4cb8

SHA512
dacbccb2915b89b782d99d3f5f2eb5b65fb3316232bcdba72d2568196d86689f2ed1e582dbedf885808954197602c886381038c4628f6f7c61c28764760f697b

Download Submit
C:\Windows\system\LIcSgDU.exe

Filesize
1.8MB

MD5
47e81b3914c4761c2c01056ca28e0f25

SHA1
0353e3b92983f2daa657453f38ba3d19be78f735

SHA256
91950ab85ca60bf4fc405755c75ef92a5dfb093742e329f133f85bad6547a32c

SHA512
8d2bc0087e28f36e16234294e8b8c939126ba542cd0a6e71ac3c77b81662de38f03f48c062060f5ee58b812d0cb8adb512bb2e41f41c6db4fae8da1c121e29cc

Download Submit
C:\Windows\system\MrCAkOF.exe

Filesize
1.8MB

MD5
f8e30b37256d0eaf84acaf4396371709

SHA1
24dfd495f5ef60fe21faca0a2f6c42ac35b307e3

SHA256
04220070a349c1ab401bf8236f39fe0ef567cc57a1a5433b409369caf1988ba8

SHA512
02b47f2c3c085bbf61112b9e1d8d5fdce17a0965b699e230f7dc025dc68af641ec0fa34f1b4a271cda60eb69c55b63c86991af6802d44faed461af4c8417ed27

Download Submit
C:\Windows\system\PHtPqWB.exe

Filesize
1.8MB

MD5
74bba6d0646d483b5e8cce2fb9432284

SHA1
df182cfd01789e5772df7ab929a04ff8153e8eb7

SHA256
cdc0e3d177781f9aaaa71046b4e054deb44f71919f1c568411ae923a52af603a

SHA512
d8b6b1729f124b8655d7c8ffd7c97db6c6ff557fd920ebbae8e745cdbea101e5195ce6b67659aed86b40aec9f1cd077b178c27bae7b67e79fc7b69e78c5960dc

Download Submit
C:\Windows\system\POmSPta.exe

Filesize
1.8MB

MD5
2db3e5ced30541d66cd798336b57f6b3

SHA1
98e952426c617c161cbd1367c3f4ed90cb807f45

SHA256
19e45ba072d5ac38bd50ffa49859d036ef77521aacb17a763ef7517a5d9ac71a

SHA512
7918385a32aac8febb1abf3e3c00ffe0811b3efddb3e9d1bc3216b2966e316f81b812b2aa9ae3a96c88204b1e6f23d705d0f1233ef0c385ab6d95ab52525ac03

Download Submit
C:\Windows\system\RnXQcmD.exe

Filesize
1.8MB

MD5
202a8ae964d476f20a7efdbb1d9f20b3

SHA1
a8496ed0e9cbea1f79d40f681e4babab09ac5327

SHA256
2713d069f2d048f77437618d1edf27142f5eb2a7fb0abc8d00963847d957ca17

SHA512
109ec34997ae3af3b73d3e00e0d0a3a93e2a9211b858139a194eb1192fe7c05a26962b92213e80a97a679b2b9c39ab2fb838c2a77d698a29cc9e0416a3477d2e

Download Submit
C:\Windows\system\Uocuzde.exe

Filesize
1.8MB

MD5
723a6fa3b1d0efc8f50ebafede60c1c5

SHA1
3baafecebfbedbee24d3cfe59563f40b8d4009eb

SHA256
1c131d9f1f843054820d0d45a8817d7350b55734824a4c637bbb4670f9b4df11

SHA512
90caf74d1bc22dea7fe16287a9990700cbfef16d2a12fd1ade4c10df8926e7c1238efbe77dc4b0485663c1d78e8cd9406e272963e7359a24ab6cbb1de41b4412

Download Submit
C:\Windows\system\XpXmQOV.exe

Filesize
1.8MB

MD5
c90f126b5fcced2ff2c2a810679ff973

SHA1
f5961eeb7036666423c48f3fce050cd4f2ed5123

SHA256
59754c82acad0035191d90221fa8d837f011fddf075e902588f4b6c500db95ce

SHA512
601a1413e7bc51adf8bc2b3134c2b0a5f67151387dffd20a54b8d91509cdf96cd224ecfed9ed49bbc6a17771f4dcd1e2443c21a9e43edfa3fb77d4462c5c29ef

Download Submit
C:\Windows\system\YQothJB.exe

Filesize
1.8MB

MD5
12a004512fc3068b5a74daaddd7b46a8

SHA1
cf62d2cd7bc201fab0ace00f13394dfc6417b01d

SHA256
7839ffb64db6be225d5852e1cc46bc395e2896d03fc6dc6eff3a0960044c9eba

SHA512
4eb4ec6500255b8fc9b6e72fde8a08c0da1e6794a9f94da393119ecd5b2e8db5ca6a78d13722bb7329c962316952641723cd6505e7398222ed4de2c1c75ca263

Download Submit
C:\Windows\system\ahTqDuH.exe

Filesize
1.8MB

MD5
13cc1f5a6f309fbef3d2aa184e393956

SHA1
22920ca564c26c31d1245e907a9f4e965e752fd3

SHA256
2ad3975d7bc65e83dad644a1e24be5ec85325d6feeb3c4684a4198520290effd

SHA512
9ea36c2be9f1164e1a976c9df6f9d6f15a5160f4813452b2671b48c662d647834688e0c479e4ffc4bd193469500f6e05adc16ac788219fcf9cfc61190c090b72

Download Submit
C:\Windows\system\ckWbPXZ.exe

Filesize
1.8MB

MD5
0869e1cf1a56231ab193707962d69263

SHA1
e201427714a8711f60440d7d581e73097f2aaad6

SHA256
efe5877815efde3cc6fe5157e7e0cc0d46f7aaa64d0f0bff57361134bd146219

SHA512
1df0ce60f18b461e20ab8bfebc0f4b687b7a7ccf7fff7f58322813c733be65e81edb0aa097f365a543b70ae36d966fae67c4caba6c29aa6ee0198c57e7d68974

Download Submit
C:\Windows\system\efxQEaT.exe

Filesize
1.8MB

MD5
90aad8c5113aef69460d9b3807b90e57

SHA1
34d78f3d720a274d898b9d105a9db6edb8b067df

SHA256
5bdfcced36ce8f0e8425931e21b189378a292156bb70e899f3556e848a47e79a

SHA512
a05328dadcec62e23b5470e87a5b75bfb5382df026fb3579253767b150bff48c2ec6d7dd6e4879c7c53a96f65a8d2288b7fdd9a57a61efc22b5dd77e8b11d284

Download Submit
C:\Windows\system\htFksZN.exe

Filesize
1.8MB

MD5
5a59b4f3750f5d942974bf3358579274

SHA1
6129f0461a5a7de398974e1e1559542e4459e96e

SHA256
9cf857dbd9d8120b72f07f0ecc8bc0a65653c984b924a798cf0884aaa1247be3

SHA512
7bae2541a56fb20c568e96e802d9212c9bda538cd5b6110134b599bc29cd9e5df9897f7a72cab892500ec20338cde33591034aeb2e0dd2872e11aef535d5a931

Download Submit
C:\Windows\system\iLhXeAS.exe

Filesize
1.8MB

MD5
33049b64046339d0502eede94ff11e2a

SHA1
25908e1eda58117bfa8e0d3c66e8fa435580cf06

SHA256
71b5ba61c5c14b30bbe25d68c72b09954dffccefbcb5cdd648164109a3c28824

SHA512
064c5f4c333b843ee9d2bb8982a6f5b48d169f343121b76f4922d462d32e6c7485b09801cfda39e89f306d7cfb1899f50cb7a9b709e6fbb65d3644f2d4d3ffad

Download Submit
C:\Windows\system\kdenghn.exe

Filesize
1.8MB

MD5
4c585ad907a5fa198c960d75d55cdfaf

SHA1
e853fa2e1b29254d5e6747486c5b89cb65c2dee3

SHA256
e2e5ab28961b2241c22fa3374ae24a79f44c564a4fb65f92635b9b9803c5c53e

SHA512
2ca753223c4350c7707207c6e17e709f8a1eeab4e1046937572780ec510f220a0970b24f1ed602487ea621451d59353f77a095b2654aa019dd0ad5d2b66b11cc

Download Submit
C:\Windows\system\lBoQthZ.exe

Filesize
1.8MB

MD5
c7ff12d1824660163265cee090a3090d

SHA1
2c944d0162f6d9aced4e5fbc8b5eccb57fbd8aaf

SHA256
8473dfa2a49276b1a8bad8dac2a6d1fa92e14e25b05334907b582d34944c2fcc

SHA512
df7ad517944f87d9c14cbabe188723acb78af05672040cd3227df92f91a5ae930bf4b84a2e9f397bc351e570d3c0f942bcd48cb63e49f01d9fa9934177f80d77

Download Submit
C:\Windows\system\lODXhWt.exe

Filesize
1.8MB

MD5
ce6b08a66707436d56f92c9f571e45c5

SHA1
f2ac1a84d8675728a737e4b3e750537bcd016342

SHA256
1f7ee0b54a27af6a71f101f02506cc5e9d310e1b25a3e1d74011f13cac86339f

SHA512
f816243a66008ce38b123e0484037e2742c5790953af4600396115d946cf68b260ee53836efed40acb2243b645a43f40165297ad1a02e86977344b53a73c2eae

Download Submit
C:\Windows\system\ppmyTWf.exe

Filesize
1.8MB

MD5
1993994bbf71a18c263d2fa393b3238f

SHA1
25a4b9344f98147714261fe29b819016127d5b87

SHA256
ad2384d0b2d765b8a10c4b199226114e95a59cb59170facfae183c866e500476

SHA512
f378b5af9f82492e81dfc86df548e868a17ea0c2e29118e5d62c6a77804c10b03cba6d15a4e99a63f9c843bd3b0f07ce62c577d5eeed40c2171e8c0fa6fbe4ad

Download Submit
C:\Windows\system\uWidOpJ.exe

Filesize
1.8MB

MD5
636baa4450a508ed9ba4ce8d15318635

SHA1
1e93c1db5b76c447c1b6ade4f67eb033b7a71b0a

SHA256
64847f97c843f86feb1653cf473bd5a49c0b13d41fa66b5aa208b39241aa801d

SHA512
bf277e9f8cba0aaf4aed81b743b953876daa7675603479a7a371921a3decc351b307e2e6cb4b3e89a08c7e211952caf79d2d7f280d21daf11b7451add95cacdb

Download Submit
C:\Windows\system\ugIMpjF.exe

Filesize
1.8MB

MD5
60f7f5613ab6a9e702b25ab27a474964

SHA1
771403600968ab1ff3cde5b71e7da6bb151a5b48

SHA256
7bd7bab10d19b60a6be66cdcc9cbbcb98bbe2dbdb6ae163f997e4c66edd06e50

SHA512
d9077be94f0ca55aa86f5a4b542ede6716f7a078894d2c7e48d8b854fccaef4e454eca72f616c1f6807e4dc7f399cc4c66b713cc9852c8b6c205723b67a07f8e

Download Submit
C:\Windows\system\xtZNdxI.exe

Filesize
1.8MB

MD5
c99054d40235ea66b5426b615320b3b8

SHA1
fede7d1a40ef601fa4942444d1ed57f52cf3cb95

SHA256
bd0cf75ce11ff418cd520335a5811fc83c583050dba40b3b565ed3fdff874d71

SHA512
67e69b7a063cd51569f0ef6542360c9217f61798b110b118bd0a9e6a65ecfd1efbe5377f25138454e937be9ff1beb6d196536ca0134c3099436ce6fcbd884617

Download Submit
C:\Windows\system\yzoedmZ.exe

Filesize
1.8MB

MD5
67d2fc46b30459ba19b0e992c8edb390

SHA1
209adf34a0d2b6f2ca65a7a70738c58b917f9134

SHA256
3cb6a86a3f6f5128483ed99560d65252184c04930fa3c4c40567c8835fba1602

SHA512
68940beb2fda0483763f54178ebd981c6abcdffb53101050bca95f7f2e792ccaf6a4f8ce7ccfa20dc765c128a32bf376093b45671a8f24dbb304b97e9a84c80a

Download Submit
\Windows\system\NLZmBKh.exe

Filesize
1.8MB

MD5
a9e870a154fd1c692a37e1e8348f6094

SHA1
b91114c178082fe1b647614d209165b828093153

SHA256
3474cc1bc2d306222845496938084e3fcd082412625692690c2e3169724cd1c7

SHA512
3dd6fe309a3a3fdaa4a4ef3dc24816c567ff4feefda3e85c02eedd044d671cda6e058ee0a3d3d74cd4d47e4f1f39252b810e5ea43a73601bb951e9e7ba7a1e44

Download Submit
\Windows\system\TkRGCjm.exe

Filesize
1.8MB

MD5
228cb5f810d4d7c3b115e155f06e7078

SHA1
7ea439ce24f5d0ebc5d4b1a2467f98d33355a752

SHA256
5e0758fb368c950e23099e1f99cff777c564774712fdb9e55c6cfe7fd89c05da

SHA512
705b15bb2f6985909d4bece48c70df8390f11fddf4fa737ff9da0cb7b6f379639864c61107b6416f9b26ba91b980021add00f07b9dfea7fafcd4161189a6875f

Download Submit
\Windows\system\qftpoHY.exe

Filesize
1.8MB

MD5
1748f0282b747a292cf208f9f6aee0bf

SHA1
b2848b85862ff32953fad74fe98360be868c9a8c

SHA256
9a8627b677ce444766e73a35ea3eb44d191deb18a682446dc18962832e1cea32

SHA512
ab571ea0b5d939bf2fea28f0a96b02f1084371c0ea20dd370ea60c46fe71bec6372d73ad2c0f20fd2fddc2e93da87399b3c20619344748f163185744dcfed26d

Download Submit
\Windows\system\usKNuYK.exe

Filesize
1.8MB

MD5
b1ac7b3e96b346fffe2b1d72ac923f1b

SHA1
2f1e1a64622a9360abf6dc26fefa81ff949e139e

SHA256
941f1068623b9e599356ef4126e16e21868b74ea9ea5da4299b391b985db8f7a

SHA512
7fcd79382293ad8a8735f785e3ca1325220fa2d55e008455b294c15f7a6a544e676626a7aadcbb84331dca79c98768491e6585c0c8ed9dd911668cf12266ea18

Download Submit
memory/776-76-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/1052-83-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/1432-90-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2216-562-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/2216-535-0x000000001B460000-0x000000001B742000-memory.dmp

Filesize
2.9MB

Download
memory/2356-57-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2424-23-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2440-26-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-43-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2516-58-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2540-44-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2552-67-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2808-89-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2808-59-0x0000000003280000-0x0000000003672000-memory.dmp

Filesize
3.9MB

Download
memory/2808-68-0x0000000003280000-0x0000000003672000-memory.dmp

Filesize
3.9MB

Download
memory/2808-8-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-42-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2808-56-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2808-0-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2808-45-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-25-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-82-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/2808-75-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2808-27-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2808-20-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2808-1-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2816-9-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2988-69-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download