xmrig | e5e0cbd87fcc0ca5a0054452cd94a4359f121fc650be9e07d76452b8473376bb

Analysis

max time kernel
23s
max time network
27s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
Size

1.9MB
MD5

0b4ea98f7054221f799c77f1b2a8a2e7
SHA1

1aeb98e9872f3e9bd1f90615fd0ab66168d9a4c5
SHA256

e5e0cbd87fcc0ca5a0054452cd94a4359f121fc650be9e07d76452b8473376bb
SHA512

da1249a0808fef1d3c1fccfd28a8eb173feba8b693d7624c7adf654215be766b5ef1de707ede999a14f6393f9b21d7084a4c2b49fa421b850de3ebc3bc09ada2
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1km:NABi

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral1/memory/2148-9-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/3036-18-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2096-43-0x000000013FC10000-0x0000000140002000-memory.dmp	xmrig
behavioral1/memory/2756-40-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2500-64-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2148-611-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/3036-1042-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2664-1103-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2924-88-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2920-87-0x00000000034C0000-0x00000000038B2000-memory.dmp	xmrig
behavioral1/memory/2920-78-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2756-2035-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2148	wtJpEXc.exe
3036	qNwjCcI.exe
2664	QjEQOSl.exe
2756	BHrMdpZ.exe
2096	YCgwrYq.exe
2452	zEcmaEs.exe
2500	RvqFBJT.exe
1952	jokkIZI.exe
2924	FqsLuYk.exe
3056	dgTfXqV.exe
556	lPLQqPm.exe
2116	trCzofw.exe
1936	tlKvyoI.exe
2544	nVjKnbI.exe
1156	DQCSaIf.exe
2772	BIbMWFA.exe
2524	ojSYgVp.exe
2812	MzukBjg.exe
1052	KvAzFkm.exe
1064	CVQLrJv.exe
1032	TyVwzhd.exe
768	nFXxrng.exe
764	CULQAyZ.exe
2896	FWveMJz.exe
540	jawCvOE.exe
1504	jdXnxmN.exe
2800	QeMnadW.exe
1712	XxXDpoA.exe
796	bqvxuaW.exe
1792	pFPoPbX.exe
1588	lHxSPfu.exe
308	RDjXjLt.exe
2424	xHXCxIn.exe
2264	aVzuVII.exe
2276	ILTZAQe.exe
1784	WSWievu.exe
1628	GJPRkyD.exe
852	TqZMBck.exe
1988	XloVNYd.exe
900	uBtDOPT.exe
2860	YdrFigA.exe
2296	FtTWzyf.exe
2392	pGXcPrM.exe
2872	EdmsPlL.exe
1956	oaPUXVo.exe
2988	hvLubFI.exe
1644	sdXULbk.exe
1512	ypvZYGc.exe
1748	wnDvFqS.exe
3060	FVmxsQN.exe
2712	JOmTdFp.exe
2320	xWhZRJs.exe
1232	cDNhTWH.exe
3048	tXSxPdL.exe
880	MYVQkhR.exe
2192	dAHxDWm.exe
1980	knpMOQx.exe
2532	yEbnGjA.exe
2732	zTSRjgn.exe
2004	jTdGgxm.exe
2816	wNtsNAI.exe
2552	ogfhQKu.exe
2180	blJQdmd.exe
2708	sPkiLEK.exe

Loads dropped DLL 64 IoCs

pid	Process
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2920-0-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/files/0x000a0000000144e9-3.dat	upx
behavioral1/memory/2148-9-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/files/0x0033000000014817-13.dat	upx
behavioral1/files/0x0008000000014c25-14.dat	upx
behavioral1/memory/2664-25-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/3036-18-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/files/0x001400000000549e-31.dat	upx
behavioral1/memory/2096-43-0x000000013FC10000-0x0000000140002000-memory.dmp	upx
behavioral1/files/0x0007000000015362-53.dat	upx
behavioral1/memory/2452-52-0x000000013F870000-0x000000013FC62000-memory.dmp	upx
behavioral1/files/0x0008000000015136-50.dat	upx
behavioral1/memory/2756-40-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/files/0x0007000000014e5a-29.dat	upx
behavioral1/memory/1952-66-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/memory/2500-64-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/files/0x0032000000014983-71.dat	upx
behavioral1/files/0x0006000000015cdb-81.dat	upx
behavioral1/files/0x0006000000015cf7-90.dat	upx
behavioral1/files/0x0006000000015d06-94.dat	upx
behavioral1/files/0x0006000000015f9e-119.dat	upx
behavioral1/files/0x0006000000016c17-156.dat	upx
behavioral1/files/0x0006000000016c2e-163.dat	upx
behavioral1/files/0x0006000000016cab-180.dat	upx
behavioral1/memory/2148-611-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/3036-1042-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2664-1103-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/files/0x0006000000016cc9-187.dat	upx
behavioral1/files/0x0006000000016c26-177.dat	upx
behavioral1/files/0x0006000000016a45-174.dat	upx
behavioral1/files/0x0006000000016597-173.dat	upx
behavioral1/files/0x0006000000016c7a-167.dat	upx
behavioral1/files/0x0006000000016411-147.dat	upx
behavioral1/files/0x0006000000016525-145.dat	upx
behavioral1/files/0x00060000000167ef-150.dat	upx
behavioral1/files/0x00060000000160f8-128.dat	upx
behavioral1/files/0x0006000000016277-133.dat	upx
behavioral1/files/0x0006000000016056-123.dat	upx
behavioral1/files/0x0006000000015d6e-116.dat	upx
behavioral1/files/0x0006000000015f1b-114.dat	upx
behavioral1/files/0x0006000000015d5d-113.dat	upx
behavioral1/files/0x0006000000015cec-89.dat	upx
behavioral1/memory/2924-88-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/memory/2920-78-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/files/0x0007000000015cca-76.dat	upx
behavioral1/files/0x0008000000015cc1-63.dat	upx
behavioral1/memory/2756-2035-0x000000013FD90000-0x0000000140182000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\nhiebzm.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\spicitn.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\IuitecF.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\ZQhTlCW.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\ziKAHVm.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\qFwgYsY.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\EdDzdYE.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\RzGWEOG.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\CuxJdMs.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\rlVSlND.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\XrDngVG.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\kyDbSoP.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\KGxSMfq.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\pjOsfeh.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\BbgYEEk.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\AUgxvwc.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\qfocsVo.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\sopumqg.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\ztkeXZD.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\UGFnYUv.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\YCgwrYq.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\SbzlUPZ.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\reMcSAn.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\uqMuWHw.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\piUMbYp.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\SRTFPMT.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\ZXeMOpm.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\foIQLGg.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\AfsReEA.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\PQAFAlM.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\DJWfbXK.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\WRbTiSR.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\VFGArry.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\AutCJvT.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\wlaVlXU.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\RDqdriZ.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\NEwxGBY.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\HlAoHED.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\EemKZbM.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\EvakmsH.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\VKidTHM.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\cPuKTVR.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\yJHQrEz.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\RDjXjLt.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\ZyhiJBR.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\RynNAQD.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\FqsLuYk.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\FukGGmu.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\ihVDiSw.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\oLeJZWU.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\OUQtBkh.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\QqfVCxL.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\aIEGtMy.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\vaKhDLL.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\kUvnmhw.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\ABDCVbg.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\pFPoPbX.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\HEdgCID.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\fCVjQcu.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\AKZfPuU.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\sPkiLEK.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\WrJIaew.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\fAuTlok.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
File created	C:\Windows\System\mglgpwB.exe	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2856	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
Token: SeDebugPrivilege	2856	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2856	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	29
PID 2920 wrote to memory of 2856	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	29
PID 2920 wrote to memory of 2856	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	29
PID 2920 wrote to memory of 2148	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	30
PID 2920 wrote to memory of 2148	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	30
PID 2920 wrote to memory of 2148	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	30
PID 2920 wrote to memory of 3036	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	31
PID 2920 wrote to memory of 3036	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	31
PID 2920 wrote to memory of 3036	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	31
PID 2920 wrote to memory of 2664	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	32
PID 2920 wrote to memory of 2664	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	32
PID 2920 wrote to memory of 2664	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	32
PID 2920 wrote to memory of 2756	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	33
PID 2920 wrote to memory of 2756	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	33
PID 2920 wrote to memory of 2756	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	33
PID 2920 wrote to memory of 2096	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	34
PID 2920 wrote to memory of 2096	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	34
PID 2920 wrote to memory of 2096	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	34
PID 2920 wrote to memory of 2452	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	35
PID 2920 wrote to memory of 2452	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	35
PID 2920 wrote to memory of 2452	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	35
PID 2920 wrote to memory of 2500	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	36
PID 2920 wrote to memory of 2500	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	36
PID 2920 wrote to memory of 2500	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	36
PID 2920 wrote to memory of 1952	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	37
PID 2920 wrote to memory of 1952	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	37
PID 2920 wrote to memory of 1952	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	37
PID 2920 wrote to memory of 2924	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	38
PID 2920 wrote to memory of 2924	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	38
PID 2920 wrote to memory of 2924	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	38
PID 2920 wrote to memory of 3056	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	39
PID 2920 wrote to memory of 3056	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	39
PID 2920 wrote to memory of 3056	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	39
PID 2920 wrote to memory of 556	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	40
PID 2920 wrote to memory of 556	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	40
PID 2920 wrote to memory of 556	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	40
PID 2920 wrote to memory of 2116	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	41
PID 2920 wrote to memory of 2116	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	41
PID 2920 wrote to memory of 2116	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	41
PID 2920 wrote to memory of 1936	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	42
PID 2920 wrote to memory of 1936	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	42
PID 2920 wrote to memory of 1936	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	42
PID 2920 wrote to memory of 2544	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	43
PID 2920 wrote to memory of 2544	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	43
PID 2920 wrote to memory of 2544	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	43
PID 2920 wrote to memory of 1156	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	44
PID 2920 wrote to memory of 1156	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	44
PID 2920 wrote to memory of 1156	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	44
PID 2920 wrote to memory of 2524	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	45
PID 2920 wrote to memory of 2524	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	45
PID 2920 wrote to memory of 2524	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	45
PID 2920 wrote to memory of 2772	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	46
PID 2920 wrote to memory of 2772	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	46
PID 2920 wrote to memory of 2772	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	46
PID 2920 wrote to memory of 2812	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	47
PID 2920 wrote to memory of 2812	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	47
PID 2920 wrote to memory of 2812	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	47
PID 2920 wrote to memory of 1052	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	48
PID 2920 wrote to memory of 1052	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	48
PID 2920 wrote to memory of 1052	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	48
PID 2920 wrote to memory of 1064	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	49
PID 2920 wrote to memory of 1064	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	49
PID 2920 wrote to memory of 1064	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	49
PID 2920 wrote to memory of 1032	2920	0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b4ea98f7054221f799c77f1b2a8a2e7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\System\wtJpEXc.exe
  C:\Windows\System\wtJpEXc.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\qNwjCcI.exe
  C:\Windows\System\qNwjCcI.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\QjEQOSl.exe
  C:\Windows\System\QjEQOSl.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\BHrMdpZ.exe
  C:\Windows\System\BHrMdpZ.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\YCgwrYq.exe
  C:\Windows\System\YCgwrYq.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\zEcmaEs.exe
  C:\Windows\System\zEcmaEs.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\RvqFBJT.exe
  C:\Windows\System\RvqFBJT.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\jokkIZI.exe
  C:\Windows\System\jokkIZI.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\FqsLuYk.exe
  C:\Windows\System\FqsLuYk.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\dgTfXqV.exe
  C:\Windows\System\dgTfXqV.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\lPLQqPm.exe
  C:\Windows\System\lPLQqPm.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\trCzofw.exe
  C:\Windows\System\trCzofw.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\tlKvyoI.exe
  C:\Windows\System\tlKvyoI.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\nVjKnbI.exe
  C:\Windows\System\nVjKnbI.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\DQCSaIf.exe
  C:\Windows\System\DQCSaIf.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\ojSYgVp.exe
  C:\Windows\System\ojSYgVp.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\BIbMWFA.exe
  C:\Windows\System\BIbMWFA.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\MzukBjg.exe
  C:\Windows\System\MzukBjg.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\KvAzFkm.exe
  C:\Windows\System\KvAzFkm.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\CVQLrJv.exe
  C:\Windows\System\CVQLrJv.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\TyVwzhd.exe
  C:\Windows\System\TyVwzhd.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\CULQAyZ.exe
  C:\Windows\System\CULQAyZ.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\nFXxrng.exe
  C:\Windows\System\nFXxrng.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\QeMnadW.exe
  C:\Windows\System\QeMnadW.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\FWveMJz.exe
  C:\Windows\System\FWveMJz.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\XxXDpoA.exe
  C:\Windows\System\XxXDpoA.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\jawCvOE.exe
  C:\Windows\System\jawCvOE.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\bqvxuaW.exe
  C:\Windows\System\bqvxuaW.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\jdXnxmN.exe
  C:\Windows\System\jdXnxmN.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\lHxSPfu.exe
  C:\Windows\System\lHxSPfu.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\pFPoPbX.exe
  C:\Windows\System\pFPoPbX.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\RDjXjLt.exe
  C:\Windows\System\RDjXjLt.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\xHXCxIn.exe
  C:\Windows\System\xHXCxIn.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\aVzuVII.exe
  C:\Windows\System\aVzuVII.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\ILTZAQe.exe
  C:\Windows\System\ILTZAQe.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\TqZMBck.exe
  C:\Windows\System\TqZMBck.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\WSWievu.exe
  C:\Windows\System\WSWievu.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\sdXULbk.exe
  C:\Windows\System\sdXULbk.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\GJPRkyD.exe
  C:\Windows\System\GJPRkyD.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\ypvZYGc.exe
  C:\Windows\System\ypvZYGc.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\XloVNYd.exe
  C:\Windows\System\XloVNYd.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\wnDvFqS.exe
  C:\Windows\System\wnDvFqS.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\uBtDOPT.exe
  C:\Windows\System\uBtDOPT.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\FVmxsQN.exe
  C:\Windows\System\FVmxsQN.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\YdrFigA.exe
  C:\Windows\System\YdrFigA.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\xWhZRJs.exe
  C:\Windows\System\xWhZRJs.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\FtTWzyf.exe
  C:\Windows\System\FtTWzyf.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\cDNhTWH.exe
  C:\Windows\System\cDNhTWH.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\pGXcPrM.exe
  C:\Windows\System\pGXcPrM.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\tXSxPdL.exe
  C:\Windows\System\tXSxPdL.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\EdmsPlL.exe
  C:\Windows\System\EdmsPlL.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\MYVQkhR.exe
  C:\Windows\System\MYVQkhR.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\oaPUXVo.exe
  C:\Windows\System\oaPUXVo.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\dAHxDWm.exe
  C:\Windows\System\dAHxDWm.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\hvLubFI.exe
  C:\Windows\System\hvLubFI.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\knpMOQx.exe
  C:\Windows\System\knpMOQx.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\JOmTdFp.exe
  C:\Windows\System\JOmTdFp.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\zTSRjgn.exe
  C:\Windows\System\zTSRjgn.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\yEbnGjA.exe
  C:\Windows\System\yEbnGjA.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\jTdGgxm.exe
  C:\Windows\System\jTdGgxm.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\wNtsNAI.exe
  C:\Windows\System\wNtsNAI.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\ogfhQKu.exe
  C:\Windows\System\ogfhQKu.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\blJQdmd.exe
  C:\Windows\System\blJQdmd.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\sPkiLEK.exe
  C:\Windows\System\sPkiLEK.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\JaebgHZ.exe
  C:\Windows\System\JaebgHZ.exe
  2⤵
  PID:2752
- C:\Windows\System\aDeHLNq.exe
  C:\Windows\System\aDeHLNq.exe
  2⤵
  PID:2868
- C:\Windows\System\opuNVHV.exe
  C:\Windows\System\opuNVHV.exe
  2⤵
  PID:1400
- C:\Windows\System\wJgdTZv.exe
  C:\Windows\System\wJgdTZv.exe
  2⤵
  PID:1728
- C:\Windows\System\WXAJDCK.exe
  C:\Windows\System\WXAJDCK.exe
  2⤵
  PID:1944
- C:\Windows\System\vaZCMVk.exe
  C:\Windows\System\vaZCMVk.exe
  2⤵
  PID:2676
- C:\Windows\System\QqfVCxL.exe
  C:\Windows\System\QqfVCxL.exe
  2⤵
  PID:1072
- C:\Windows\System\WrJIaew.exe
  C:\Windows\System\WrJIaew.exe
  2⤵
  PID:1324
- C:\Windows\System\HJqpNYX.exe
  C:\Windows\System\HJqpNYX.exe
  2⤵
  PID:2796
- C:\Windows\System\LFBbAgV.exe
  C:\Windows\System\LFBbAgV.exe
  2⤵
  PID:680
- C:\Windows\System\wZdIRQg.exe
  C:\Windows\System\wZdIRQg.exe
  2⤵
  PID:2332
- C:\Windows\System\mGtcned.exe
  C:\Windows\System\mGtcned.exe
  2⤵
  PID:1732
- C:\Windows\System\XwkSTSR.exe
  C:\Windows\System\XwkSTSR.exe
  2⤵
  PID:2356
- C:\Windows\System\TUsxnmk.exe
  C:\Windows\System\TUsxnmk.exe
  2⤵
  PID:2224
- C:\Windows\System\RvJBhpK.exe
  C:\Windows\System\RvJBhpK.exe
  2⤵
  PID:1040
- C:\Windows\System\BTxFXAi.exe
  C:\Windows\System\BTxFXAi.exe
  2⤵
  PID:1044
- C:\Windows\System\OihDaJS.exe
  C:\Windows\System\OihDaJS.exe
  2⤵
  PID:2432
- C:\Windows\System\foIQLGg.exe
  C:\Windows\System\foIQLGg.exe
  2⤵
  PID:1708
- C:\Windows\System\AvmyDpW.exe
  C:\Windows\System\AvmyDpW.exe
  2⤵
  PID:1764
- C:\Windows\System\TmrrDeh.exe
  C:\Windows\System\TmrrDeh.exe
  2⤵
  PID:1696
- C:\Windows\System\tuVwyYJ.exe
  C:\Windows\System\tuVwyYJ.exe
  2⤵
  PID:1552
- C:\Windows\System\Kixlreq.exe
  C:\Windows\System\Kixlreq.exe
  2⤵
  PID:1916
- C:\Windows\System\TjdEWDm.exe
  C:\Windows\System\TjdEWDm.exe
  2⤵
  PID:840
- C:\Windows\System\fAuTlok.exe
  C:\Windows\System\fAuTlok.exe
  2⤵
  PID:2056
- C:\Windows\System\jSfHsKo.exe
  C:\Windows\System\jSfHsKo.exe
  2⤵
  PID:1308
- C:\Windows\System\ujYYsxC.exe
  C:\Windows\System\ujYYsxC.exe
  2⤵
  PID:2000
- C:\Windows\System\oNITnKq.exe
  C:\Windows\System\oNITnKq.exe
  2⤵
  PID:3004
- C:\Windows\System\lwwdCxe.exe
  C:\Windows\System\lwwdCxe.exe
  2⤵
  PID:2604
- C:\Windows\System\ZLWevGV.exe
  C:\Windows\System\ZLWevGV.exe
  2⤵
  PID:2620
- C:\Windows\System\WQBAAvx.exe
  C:\Windows\System\WQBAAvx.exe
  2⤵
  PID:2828
- C:\Windows\System\rRToeYI.exe
  C:\Windows\System\rRToeYI.exe
  2⤵
  PID:2956
- C:\Windows\System\mNpDyqD.exe
  C:\Windows\System\mNpDyqD.exe
  2⤵
  PID:1932
- C:\Windows\System\sYAJfdl.exe
  C:\Windows\System\sYAJfdl.exe
  2⤵
  PID:2808
- C:\Windows\System\ILBjhjI.exe
  C:\Windows\System\ILBjhjI.exe
  2⤵
  PID:2892
- C:\Windows\System\WqeULLc.exe
  C:\Windows\System\WqeULLc.exe
  2⤵
  PID:2960
- C:\Windows\System\EvKKxpH.exe
  C:\Windows\System\EvKKxpH.exe
  2⤵
  PID:1568
- C:\Windows\System\pJdXWdm.exe
  C:\Windows\System\pJdXWdm.exe
  2⤵
  PID:384
- C:\Windows\System\qfocsVo.exe
  C:\Windows\System\qfocsVo.exe
  2⤵
  PID:644
- C:\Windows\System\QOtgqxC.exe
  C:\Windows\System\QOtgqxC.exe
  2⤵
  PID:1116
- C:\Windows\System\rtBHmEi.exe
  C:\Windows\System\rtBHmEi.exe
  2⤵
  PID:1820
- C:\Windows\System\wqkuZPu.exe
  C:\Windows\System\wqkuZPu.exe
  2⤵
  PID:1872
- C:\Windows\System\vjFLYIm.exe
  C:\Windows\System\vjFLYIm.exe
  2⤵
  PID:2164
- C:\Windows\System\KiRTORe.exe
  C:\Windows\System\KiRTORe.exe
  2⤵
  PID:1772
- C:\Windows\System\VmvhcKJ.exe
  C:\Windows\System\VmvhcKJ.exe
  2⤵
  PID:576
- C:\Windows\System\sxqmHIn.exe
  C:\Windows\System\sxqmHIn.exe
  2⤵
  PID:2100
- C:\Windows\System\xzEfWrf.exe
  C:\Windows\System\xzEfWrf.exe
  2⤵
  PID:2616
- C:\Windows\System\cgyJQIQ.exe
  C:\Windows\System\cgyJQIQ.exe
  2⤵
  PID:1136
- C:\Windows\System\maqZfNs.exe
  C:\Windows\System\maqZfNs.exe
  2⤵
  PID:2492
- C:\Windows\System\HEdgCID.exe
  C:\Windows\System\HEdgCID.exe
  2⤵
  PID:988
- C:\Windows\System\rVlfkSB.exe
  C:\Windows\System\rVlfkSB.exe
  2⤵
  PID:2372
- C:\Windows\System\oyRAVMI.exe
  C:\Windows\System\oyRAVMI.exe
  2⤵
  PID:868
- C:\Windows\System\HlAoHED.exe
  C:\Windows\System\HlAoHED.exe
  2⤵
  PID:2512
- C:\Windows\System\Cxykvts.exe
  C:\Windows\System\Cxykvts.exe
  2⤵
  PID:2972
- C:\Windows\System\bKJusfA.exe
  C:\Windows\System\bKJusfA.exe
  2⤵
  PID:2656
- C:\Windows\System\EjfrGwO.exe
  C:\Windows\System\EjfrGwO.exe
  2⤵
  PID:1256
- C:\Windows\System\pjItAxE.exe
  C:\Windows\System\pjItAxE.exe
  2⤵
  PID:2644
- C:\Windows\System\DVfbRYF.exe
  C:\Windows\System\DVfbRYF.exe
  2⤵
  PID:1624
- C:\Windows\System\HUyNARC.exe
  C:\Windows\System\HUyNARC.exe
  2⤵
  PID:2764
- C:\Windows\System\XBKDEnp.exe
  C:\Windows\System\XBKDEnp.exe
  2⤵
  PID:1768
- C:\Windows\System\sCkIogw.exe
  C:\Windows\System\sCkIogw.exe
  2⤵
  PID:2612
- C:\Windows\System\MVxZOql.exe
  C:\Windows\System\MVxZOql.exe
  2⤵
  PID:1720
- C:\Windows\System\VLRteJj.exe
  C:\Windows\System\VLRteJj.exe
  2⤵
  PID:1940
- C:\Windows\System\ZatJSQX.exe
  C:\Windows\System\ZatJSQX.exe
  2⤵
  PID:2548
- C:\Windows\System\ZVaqPYo.exe
  C:\Windows\System\ZVaqPYo.exe
  2⤵
  PID:348
- C:\Windows\System\JOSntWI.exe
  C:\Windows\System\JOSntWI.exe
  2⤵
  PID:2024
- C:\Windows\System\qaUeOWA.exe
  C:\Windows\System\qaUeOWA.exe
  2⤵
  PID:2888
- C:\Windows\System\cyntcwY.exe
  C:\Windows\System\cyntcwY.exe
  2⤵
  PID:3084
- C:\Windows\System\mmszbDD.exe
  C:\Windows\System\mmszbDD.exe
  2⤵
  PID:3104
- C:\Windows\System\ZyhiJBR.exe
  C:\Windows\System\ZyhiJBR.exe
  2⤵
  PID:3124
- C:\Windows\System\bHSzrgV.exe
  C:\Windows\System\bHSzrgV.exe
  2⤵
  PID:3140
- C:\Windows\System\aWaSRax.exe
  C:\Windows\System\aWaSRax.exe
  2⤵
  PID:3156
- C:\Windows\System\trQfXeb.exe
  C:\Windows\System\trQfXeb.exe
  2⤵
  PID:3172
- C:\Windows\System\oQbtsiv.exe
  C:\Windows\System\oQbtsiv.exe
  2⤵
  PID:3188
- C:\Windows\System\yoxydmV.exe
  C:\Windows\System\yoxydmV.exe
  2⤵
  PID:3204
- C:\Windows\System\llsnexD.exe
  C:\Windows\System\llsnexD.exe
  2⤵
  PID:3220
- C:\Windows\System\uqMuWHw.exe
  C:\Windows\System\uqMuWHw.exe
  2⤵
  PID:3236
- C:\Windows\System\ptcVWXD.exe
  C:\Windows\System\ptcVWXD.exe
  2⤵
  PID:3252
- C:\Windows\System\mvpWAzG.exe
  C:\Windows\System\mvpWAzG.exe
  2⤵
  PID:3268
- C:\Windows\System\JTkUQsc.exe
  C:\Windows\System\JTkUQsc.exe
  2⤵
  PID:3284
- C:\Windows\System\fgARwPr.exe
  C:\Windows\System\fgARwPr.exe
  2⤵
  PID:3304
- C:\Windows\System\JEOcbzn.exe
  C:\Windows\System\JEOcbzn.exe
  2⤵
  PID:3320
- C:\Windows\System\DboLLpc.exe
  C:\Windows\System\DboLLpc.exe
  2⤵
  PID:3336
- C:\Windows\System\SWWDwGN.exe
  C:\Windows\System\SWWDwGN.exe
  2⤵
  PID:3352
- C:\Windows\System\veDsVlQ.exe
  C:\Windows\System\veDsVlQ.exe
  2⤵
  PID:3368
- C:\Windows\System\LPDHoMd.exe
  C:\Windows\System\LPDHoMd.exe
  2⤵
  PID:3384
- C:\Windows\System\dprzytY.exe
  C:\Windows\System\dprzytY.exe
  2⤵
  PID:3400
- C:\Windows\System\hQekyxa.exe
  C:\Windows\System\hQekyxa.exe
  2⤵
  PID:3416
- C:\Windows\System\jcrCTfK.exe
  C:\Windows\System\jcrCTfK.exe
  2⤵
  PID:3432
- C:\Windows\System\ofHRFwT.exe
  C:\Windows\System\ofHRFwT.exe
  2⤵
  PID:3448
- C:\Windows\System\eyfMmGx.exe
  C:\Windows\System\eyfMmGx.exe
  2⤵
  PID:3468
- C:\Windows\System\xptntjH.exe
  C:\Windows\System\xptntjH.exe
  2⤵
  PID:3484
- C:\Windows\System\qVhpbqj.exe
  C:\Windows\System\qVhpbqj.exe
  2⤵
  PID:3500
- C:\Windows\System\MArAbWQ.exe
  C:\Windows\System\MArAbWQ.exe
  2⤵
  PID:3516
- C:\Windows\System\ptEGKpx.exe
  C:\Windows\System\ptEGKpx.exe
  2⤵
  PID:3532
- C:\Windows\System\SuvNlWe.exe
  C:\Windows\System\SuvNlWe.exe
  2⤵
  PID:3548
- C:\Windows\System\zSFqDOV.exe
  C:\Windows\System\zSFqDOV.exe
  2⤵
  PID:3564
- C:\Windows\System\dVsBKNM.exe
  C:\Windows\System\dVsBKNM.exe
  2⤵
  PID:3580
- C:\Windows\System\uAMYkGw.exe
  C:\Windows\System\uAMYkGw.exe
  2⤵
  PID:3596
- C:\Windows\System\cgPOlaY.exe
  C:\Windows\System\cgPOlaY.exe
  2⤵
  PID:3612
- C:\Windows\System\rRekXro.exe
  C:\Windows\System\rRekXro.exe
  2⤵
  PID:3628
- C:\Windows\System\sklWmUU.exe
  C:\Windows\System\sklWmUU.exe
  2⤵
  PID:3644
- C:\Windows\System\aENNVxS.exe
  C:\Windows\System\aENNVxS.exe
  2⤵
  PID:3660
- C:\Windows\System\RMSAldO.exe
  C:\Windows\System\RMSAldO.exe
  2⤵
  PID:3680
- C:\Windows\System\tnRbSfT.exe
  C:\Windows\System\tnRbSfT.exe
  2⤵
  PID:3696
- C:\Windows\System\cXkdckC.exe
  C:\Windows\System\cXkdckC.exe
  2⤵
  PID:3712
- C:\Windows\System\yJcJWed.exe
  C:\Windows\System\yJcJWed.exe
  2⤵
  PID:3728
- C:\Windows\System\aVbasaw.exe
  C:\Windows\System\aVbasaw.exe
  2⤵
  PID:3744
- C:\Windows\System\JQItDSz.exe
  C:\Windows\System\JQItDSz.exe
  2⤵
  PID:3760
- C:\Windows\System\BryuKUL.exe
  C:\Windows\System\BryuKUL.exe
  2⤵
  PID:3776
- C:\Windows\System\zoHCznP.exe
  C:\Windows\System\zoHCznP.exe
  2⤵
  PID:3792
- C:\Windows\System\aIEGtMy.exe
  C:\Windows\System\aIEGtMy.exe
  2⤵
  PID:3808
- C:\Windows\System\AfsReEA.exe
  C:\Windows\System\AfsReEA.exe
  2⤵
  PID:3824
- C:\Windows\System\EemKZbM.exe
  C:\Windows\System\EemKZbM.exe
  2⤵
  PID:3840
- C:\Windows\System\VFGArry.exe
  C:\Windows\System\VFGArry.exe
  2⤵
  PID:3856
- C:\Windows\System\VGljhAZ.exe
  C:\Windows\System\VGljhAZ.exe
  2⤵
  PID:3872
- C:\Windows\System\EKjefQv.exe
  C:\Windows\System\EKjefQv.exe
  2⤵
  PID:3892
- C:\Windows\System\ZdyuGYs.exe
  C:\Windows\System\ZdyuGYs.exe
  2⤵
  PID:3908
- C:\Windows\System\LVHhprb.exe
  C:\Windows\System\LVHhprb.exe
  2⤵
  PID:3924
- C:\Windows\System\FjSFmBM.exe
  C:\Windows\System\FjSFmBM.exe
  2⤵
  PID:3940
- C:\Windows\System\jYNFJhA.exe
  C:\Windows\System\jYNFJhA.exe
  2⤵
  PID:3956
- C:\Windows\System\kMFTmCz.exe
  C:\Windows\System\kMFTmCz.exe
  2⤵
  PID:3972
- C:\Windows\System\vuTcDSE.exe
  C:\Windows\System\vuTcDSE.exe
  2⤵
  PID:3988
- C:\Windows\System\QsSTYIy.exe
  C:\Windows\System\QsSTYIy.exe
  2⤵
  PID:4004
- C:\Windows\System\EdDzdYE.exe
  C:\Windows\System\EdDzdYE.exe
  2⤵
  PID:4020
- C:\Windows\System\tjjMGsq.exe
  C:\Windows\System\tjjMGsq.exe
  2⤵
  PID:4036
- C:\Windows\System\faxewyq.exe
  C:\Windows\System\faxewyq.exe
  2⤵
  PID:4056
- C:\Windows\System\CfVOQPy.exe
  C:\Windows\System\CfVOQPy.exe
  2⤵
  PID:4072
- C:\Windows\System\mglgpwB.exe
  C:\Windows\System\mglgpwB.exe
  2⤵
  PID:4088
- C:\Windows\System\ITGrSON.exe
  C:\Windows\System\ITGrSON.exe
  2⤵
  PID:2852
- C:\Windows\System\eIpBVwJ.exe
  C:\Windows\System\eIpBVwJ.exe
  2⤵
  PID:2748
- C:\Windows\System\olQYtGm.exe
  C:\Windows\System\olQYtGm.exe
  2⤵
  PID:3544
- C:\Windows\System\fQoSrXV.exe
  C:\Windows\System\fQoSrXV.exe
  2⤵
  PID:4108
- C:\Windows\System\xTYBJPM.exe
  C:\Windows\System\xTYBJPM.exe
  2⤵
  PID:4124
- C:\Windows\System\JhjRuws.exe
  C:\Windows\System\JhjRuws.exe
  2⤵
  PID:4140
- C:\Windows\System\elmZLyI.exe
  C:\Windows\System\elmZLyI.exe
  2⤵
  PID:4156
- C:\Windows\System\pGgdvnq.exe
  C:\Windows\System\pGgdvnq.exe
  2⤵
  PID:4172
- C:\Windows\System\PjxyViZ.exe
  C:\Windows\System\PjxyViZ.exe
  2⤵
  PID:4188
- C:\Windows\System\CercUwM.exe
  C:\Windows\System\CercUwM.exe
  2⤵
  PID:4204
- C:\Windows\System\WLhqNHw.exe
  C:\Windows\System\WLhqNHw.exe
  2⤵
  PID:4220
- C:\Windows\System\xNjpHmp.exe
  C:\Windows\System\xNjpHmp.exe
  2⤵
  PID:4240
- C:\Windows\System\koFyRpc.exe
  C:\Windows\System\koFyRpc.exe
  2⤵
  PID:4256
- C:\Windows\System\HOObCLp.exe
  C:\Windows\System\HOObCLp.exe
  2⤵
  PID:4272
- C:\Windows\System\YnndQRO.exe
  C:\Windows\System\YnndQRO.exe
  2⤵
  PID:4288
- C:\Windows\System\RUSkwab.exe
  C:\Windows\System\RUSkwab.exe
  2⤵
  PID:4304
- C:\Windows\System\DiLaIHV.exe
  C:\Windows\System\DiLaIHV.exe
  2⤵
  PID:4320
- C:\Windows\System\kYiVGQD.exe
  C:\Windows\System\kYiVGQD.exe
  2⤵
  PID:4336
- C:\Windows\System\AufsEEn.exe
  C:\Windows\System\AufsEEn.exe
  2⤵
  PID:4356
- C:\Windows\System\pjGzbfB.exe
  C:\Windows\System\pjGzbfB.exe
  2⤵
  PID:4372
- C:\Windows\System\SbzlUPZ.exe
  C:\Windows\System\SbzlUPZ.exe
  2⤵
  PID:4388
- C:\Windows\System\bPVGhpU.exe
  C:\Windows\System\bPVGhpU.exe
  2⤵
  PID:4404
- C:\Windows\System\WOHAyNg.exe
  C:\Windows\System\WOHAyNg.exe
  2⤵
  PID:4420
- C:\Windows\System\PPRvntD.exe
  C:\Windows\System\PPRvntD.exe
  2⤵
  PID:4436
- C:\Windows\System\spicitn.exe
  C:\Windows\System\spicitn.exe
  2⤵
  PID:4452
- C:\Windows\System\fgTuHnv.exe
  C:\Windows\System\fgTuHnv.exe
  2⤵
  PID:4468
- C:\Windows\System\DrAajfU.exe
  C:\Windows\System\DrAajfU.exe
  2⤵
  PID:4488
- C:\Windows\System\RzGWEOG.exe
  C:\Windows\System\RzGWEOG.exe
  2⤵
  PID:4504
- C:\Windows\System\zSlVihj.exe
  C:\Windows\System\zSlVihj.exe
  2⤵
  PID:4520
- C:\Windows\System\nyWqcoq.exe
  C:\Windows\System\nyWqcoq.exe
  2⤵
  PID:4536
- C:\Windows\System\ZvmAFDS.exe
  C:\Windows\System\ZvmAFDS.exe
  2⤵
  PID:4552
- C:\Windows\System\UgDQHuC.exe
  C:\Windows\System\UgDQHuC.exe
  2⤵
  PID:4568
- C:\Windows\System\FukGGmu.exe
  C:\Windows\System\FukGGmu.exe
  2⤵
  PID:4584
- C:\Windows\System\xXtEZuL.exe
  C:\Windows\System\xXtEZuL.exe
  2⤵
  PID:4600
- C:\Windows\System\jYOiFaB.exe
  C:\Windows\System\jYOiFaB.exe
  2⤵
  PID:4620
- C:\Windows\System\tbqghAe.exe
  C:\Windows\System\tbqghAe.exe
  2⤵
  PID:4636
- C:\Windows\System\UgbVsvX.exe
  C:\Windows\System\UgbVsvX.exe
  2⤵
  PID:4652
- C:\Windows\System\GWlAXva.exe
  C:\Windows\System\GWlAXva.exe
  2⤵
  PID:4668
- C:\Windows\System\heIFckV.exe
  C:\Windows\System\heIFckV.exe
  2⤵
  PID:4684
- C:\Windows\System\bjObBCA.exe
  C:\Windows\System\bjObBCA.exe
  2⤵
  PID:4944
- C:\Windows\System\eYjcVgz.exe
  C:\Windows\System\eYjcVgz.exe
  2⤵
  PID:4976
- C:\Windows\System\xekDfsc.exe
  C:\Windows\System\xekDfsc.exe
  2⤵
  PID:4996
- C:\Windows\System\HKGodwd.exe
  C:\Windows\System\HKGodwd.exe
  2⤵
  PID:5012
- C:\Windows\System\fCVjQcu.exe
  C:\Windows\System\fCVjQcu.exe
  2⤵
  PID:5028
- C:\Windows\System\XrUZXQF.exe
  C:\Windows\System\XrUZXQF.exe
  2⤵
  PID:5044
- C:\Windows\System\wxuqAaZ.exe
  C:\Windows\System\wxuqAaZ.exe
  2⤵
  PID:5060
- C:\Windows\System\yYvfbDt.exe
  C:\Windows\System\yYvfbDt.exe
  2⤵
  PID:5076
- C:\Windows\System\jGJEbDE.exe
  C:\Windows\System\jGJEbDE.exe
  2⤵
  PID:5092
- C:\Windows\System\sIrUhwL.exe
  C:\Windows\System\sIrUhwL.exe
  2⤵
  PID:5108
- C:\Windows\System\cgdPdIv.exe
  C:\Windows\System\cgdPdIv.exe
  2⤵
  PID:3636
- C:\Windows\System\WHryBXB.exe
  C:\Windows\System\WHryBXB.exe
  2⤵
  PID:3676
- C:\Windows\System\HTSFPfJ.exe
  C:\Windows\System\HTSFPfJ.exe
  2⤵
  PID:2184
- C:\Windows\System\wsFIMAv.exe
  C:\Windows\System\wsFIMAv.exe
  2⤵
  PID:3772
- C:\Windows\System\iwMZbos.exe
  C:\Windows\System\iwMZbos.exe
  2⤵
  PID:3864
- C:\Windows\System\qqlJSJV.exe
  C:\Windows\System\qqlJSJV.exe
  2⤵
  PID:3936
- C:\Windows\System\yIokIOW.exe
  C:\Windows\System\yIokIOW.exe
  2⤵
  PID:4068
- C:\Windows\System\jouxkua.exe
  C:\Windows\System\jouxkua.exe
  2⤵
  PID:2124
- C:\Windows\System\IDWblHS.exe
  C:\Windows\System\IDWblHS.exe
  2⤵
  PID:2052
- C:\Windows\System\nKclaxL.exe
  C:\Windows\System\nKclaxL.exe
  2⤵
  PID:2692
- C:\Windows\System\DJWfbXK.exe
  C:\Windows\System\DJWfbXK.exe
  2⤵
  PID:1496
- C:\Windows\System\vOCzkqz.exe
  C:\Windows\System\vOCzkqz.exe
  2⤵
  PID:2668
- C:\Windows\System\ltuFTlK.exe
  C:\Windows\System\ltuFTlK.exe
  2⤵
  PID:3424
- C:\Windows\System\mYglitr.exe
  C:\Windows\System\mYglitr.exe
  2⤵
  PID:2228
- C:\Windows\System\UWxxOlK.exe
  C:\Windows\System\UWxxOlK.exe
  2⤵
  PID:3080
- C:\Windows\System\xICZYhr.exe
  C:\Windows\System\xICZYhr.exe
  2⤵
  PID:2564
- C:\Windows\System\nInrVtC.exe
  C:\Windows\System\nInrVtC.exe
  2⤵
  PID:2588
- C:\Windows\System\ZuQPFDJ.exe
  C:\Windows\System\ZuQPFDJ.exe
  2⤵
  PID:3216
- C:\Windows\System\aqAaPto.exe
  C:\Windows\System\aqAaPto.exe
  2⤵
  PID:2652
- C:\Windows\System\SuBXJKa.exe
  C:\Windows\System\SuBXJKa.exe
  2⤵
  PID:3248
- C:\Windows\System\hHXkKzI.exe
  C:\Windows\System\hHXkKzI.exe
  2⤵
  PID:3312
- C:\Windows\System\VNVpTwZ.exe
  C:\Windows\System\VNVpTwZ.exe
  2⤵
  PID:3348
- C:\Windows\System\KkiqBYF.exe
  C:\Windows\System\KkiqBYF.exe
  2⤵
  PID:4180
- C:\Windows\System\lTBHtQF.exe
  C:\Windows\System\lTBHtQF.exe
  2⤵
  PID:4252
- C:\Windows\System\KVXGyGz.exe
  C:\Windows\System\KVXGyGz.exe
  2⤵
  PID:4316
- C:\Windows\System\XrDngVG.exe
  C:\Windows\System\XrDngVG.exe
  2⤵
  PID:4512
- C:\Windows\System\GxWhnnr.exe
  C:\Windows\System\GxWhnnr.exe
  2⤵
  PID:4580
- C:\Windows\System\YBzXNnc.exe
  C:\Windows\System\YBzXNnc.exe
  2⤵
  PID:3164
- C:\Windows\System\IZXaocy.exe
  C:\Windows\System\IZXaocy.exe
  2⤵
  PID:3228
- C:\Windows\System\ZzZvIpr.exe
  C:\Windows\System\ZzZvIpr.exe
  2⤵
  PID:3292
- C:\Windows\System\InRbLNz.exe
  C:\Windows\System\InRbLNz.exe
  2⤵
  PID:3360
- C:\Windows\System\kcgEumg.exe
  C:\Windows\System\kcgEumg.exe
  2⤵
  PID:3428
- C:\Windows\System\FQKurMa.exe
  C:\Windows\System\FQKurMa.exe
  2⤵
  PID:3496
- C:\Windows\System\QZWELZd.exe
  C:\Windows\System\QZWELZd.exe
  2⤵
  PID:3560
- C:\Windows\System\KocWpbg.exe
  C:\Windows\System\KocWpbg.exe
  2⤵
  PID:3624
- C:\Windows\System\CJoaTLg.exe
  C:\Windows\System\CJoaTLg.exe
  2⤵
  PID:3692
- C:\Windows\System\LOemSAa.exe
  C:\Windows\System\LOemSAa.exe
  2⤵
  PID:3756
- C:\Windows\System\BAwuXUb.exe
  C:\Windows\System\BAwuXUb.exe
  2⤵
  PID:3820
- C:\Windows\System\oPYUKYj.exe
  C:\Windows\System\oPYUKYj.exe
  2⤵
  PID:3884
- C:\Windows\System\rOAskUp.exe
  C:\Windows\System\rOAskUp.exe
  2⤵
  PID:3948
- C:\Windows\System\skNEKYx.exe
  C:\Windows\System\skNEKYx.exe
  2⤵
  PID:4012
- C:\Windows\System\KMBQvog.exe
  C:\Windows\System\KMBQvog.exe
  2⤵
  PID:4080
- C:\Windows\System\zVilqTj.exe
  C:\Windows\System\zVilqTj.exe
  2⤵
  PID:1284
- C:\Windows\System\LPBykNC.exe
  C:\Windows\System\LPBykNC.exe
  2⤵
  PID:4104
- C:\Windows\System\cjMHDHJ.exe
  C:\Windows\System\cjMHDHJ.exe
  2⤵
  PID:4168
- C:\Windows\System\ihVDiSw.exe
  C:\Windows\System\ihVDiSw.exe
  2⤵
  PID:4232
- C:\Windows\System\GdXFVLv.exe
  C:\Windows\System\GdXFVLv.exe
  2⤵
  PID:4296
- C:\Windows\System\kXXkKSN.exe
  C:\Windows\System\kXXkKSN.exe
  2⤵
  PID:4364
- C:\Windows\System\tbQYxBa.exe
  C:\Windows\System\tbQYxBa.exe
  2⤵
  PID:4776
- C:\Windows\System\jSCykVV.exe
  C:\Windows\System\jSCykVV.exe
  2⤵
  PID:4792
- C:\Windows\System\lBWpswO.exe
  C:\Windows\System\lBWpswO.exe
  2⤵
  PID:4696
- C:\Windows\System\tCiLAhV.exe
  C:\Windows\System\tCiLAhV.exe
  2⤵
  PID:4824
- C:\Windows\System\kMlIVvH.exe
  C:\Windows\System\kMlIVvH.exe
  2⤵
  PID:4840
- C:\Windows\System\DcsHMls.exe
  C:\Windows\System\DcsHMls.exe
  2⤵
  PID:4856
- C:\Windows\System\KdxZaht.exe
  C:\Windows\System\KdxZaht.exe
  2⤵
  PID:4872
- C:\Windows\System\TiJIyZN.exe
  C:\Windows\System\TiJIyZN.exe
  2⤵
  PID:4888
- C:\Windows\System\mAqYyaj.exe
  C:\Windows\System\mAqYyaj.exe
  2⤵
  PID:4904
- C:\Windows\System\dFDVpGD.exe
  C:\Windows\System\dFDVpGD.exe
  2⤵
  PID:4940
- C:\Windows\System\vfluVgj.exe
  C:\Windows\System\vfluVgj.exe
  2⤵
  PID:3904
- C:\Windows\System\NyfjDIA.exe
  C:\Windows\System\NyfjDIA.exe
  2⤵
  PID:2040
- C:\Windows\System\jKcTvyF.exe
  C:\Windows\System\jKcTvyF.exe
  2⤵
  PID:4608
- C:\Windows\System\lxVCSzi.exe
  C:\Windows\System\lxVCSzi.exe
  2⤵
  PID:4648
- C:\Windows\System\OzXVLmk.exe
  C:\Windows\System\OzXVLmk.exe
  2⤵
  PID:4952
- C:\Windows\System\eGzvNrI.exe
  C:\Windows\System\eGzvNrI.exe
  2⤵
  PID:1876
- C:\Windows\System\sopumqg.exe
  C:\Windows\System\sopumqg.exe
  2⤵
  PID:4972
- C:\Windows\System\PzbgGaB.exe
  C:\Windows\System\PzbgGaB.exe
  2⤵
  PID:5008
- C:\Windows\System\tQBekvs.exe
  C:\Windows\System\tQBekvs.exe
  2⤵
  PID:5072
- C:\Windows\System\gFMNQwy.exe
  C:\Windows\System\gFMNQwy.exe
  2⤵
  PID:5104
- C:\Windows\System\QHVSKwH.exe
  C:\Windows\System\QHVSKwH.exe
  2⤵
  PID:3708
- C:\Windows\System\RWoVXKn.exe
  C:\Windows\System\RWoVXKn.exe
  2⤵
  PID:3668
- C:\Windows\System\ZmkbmLh.exe
  C:\Windows\System\ZmkbmLh.exe
  2⤵
  PID:3092
- C:\Windows\System\EvakmsH.exe
  C:\Windows\System\EvakmsH.exe
  2⤵
  PID:4992
- C:\Windows\System\uKDUiZD.exe
  C:\Windows\System\uKDUiZD.exe
  2⤵
  PID:3444
- C:\Windows\System\CeMXIJz.exe
  C:\Windows\System\CeMXIJz.exe
  2⤵
  PID:560
- C:\Windows\System\otoAxwx.exe
  C:\Windows\System\otoAxwx.exe
  2⤵
  PID:3476
- C:\Windows\System\hYbRlIL.exe
  C:\Windows\System\hYbRlIL.exe
  2⤵
  PID:3512
- C:\Windows\System\pUCsiWY.exe
  C:\Windows\System\pUCsiWY.exe
  2⤵
  PID:2844
- C:\Windows\System\RdDVllW.exe
  C:\Windows\System\RdDVllW.exe
  2⤵
  PID:4312
- C:\Windows\System\DqACGNH.exe
  C:\Windows\System\DqACGNH.exe
  2⤵
  PID:2784
- C:\Windows\System\FxpnbaL.exe
  C:\Windows\System\FxpnbaL.exe
  2⤵
  PID:3076
- C:\Windows\System\laafBvv.exe
  C:\Windows\System\laafBvv.exe
  2⤵
  PID:3116
- C:\Windows\System\bxFcPUO.exe
  C:\Windows\System\bxFcPUO.exe
  2⤵
  PID:3412
- C:\Windows\System\UMjYkZd.exe
  C:\Windows\System\UMjYkZd.exe
  2⤵
  PID:1564
- C:\Windows\System\DAbBeJw.exe
  C:\Windows\System\DAbBeJw.exe
  2⤵
  PID:1868
- C:\Windows\System\gJvovFC.exe
  C:\Windows\System\gJvovFC.exe
  2⤵
  PID:4352
- C:\Windows\System\SRTFPMT.exe
  C:\Windows\System\SRTFPMT.exe
  2⤵
  PID:876
- C:\Windows\System\QTueixH.exe
  C:\Windows\System\QTueixH.exe
  2⤵
  PID:2480
- C:\Windows\System\hiizvVm.exe
  C:\Windows\System\hiizvVm.exe
  2⤵
  PID:4444
- C:\Windows\System\SjQCWkB.exe
  C:\Windows\System\SjQCWkB.exe
  2⤵
  PID:2696
- C:\Windows\System\BBrERXL.exe
  C:\Windows\System\BBrERXL.exe
  2⤵
  PID:4264
- C:\Windows\System\OpgCdSP.exe
  C:\Windows\System\OpgCdSP.exe
  2⤵
  PID:3724
- C:\Windows\System\gtcOJJw.exe
  C:\Windows\System\gtcOJJw.exe
  2⤵
  PID:3196
- C:\Windows\System\uoOdWkl.exe
  C:\Windows\System\uoOdWkl.exe
  2⤵
  PID:3984
- C:\Windows\System\hwDWRyd.exe
  C:\Windows\System\hwDWRyd.exe
  2⤵
  PID:4332
- C:\Windows\System\UHascRT.exe
  C:\Windows\System\UHascRT.exe
  2⤵
  PID:3920
- C:\Windows\System\sSksJmx.exe
  C:\Windows\System\sSksJmx.exe
  2⤵
  PID:3396
- C:\Windows\System\LdTfPDh.exe
  C:\Windows\System\LdTfPDh.exe
  2⤵
  PID:4200
- C:\Windows\System\kVOLMbv.exe
  C:\Windows\System\kVOLMbv.exe
  2⤵
  PID:3392
- C:\Windows\System\BtPftQw.exe
  C:\Windows\System\BtPftQw.exe
  2⤵
  PID:3752
- C:\Windows\System\GNrjpTH.exe
  C:\Windows\System\GNrjpTH.exe
  2⤵
  PID:4432
- C:\Windows\System\CtOoHUe.exe
  C:\Windows\System\CtOoHUe.exe
  2⤵
  PID:1544
- C:\Windows\System\jiFxwww.exe
  C:\Windows\System\jiFxwww.exe
  2⤵
  PID:4564
- C:\Windows\System\xSRgLfH.exe
  C:\Windows\System\xSRgLfH.exe
  2⤵
  PID:4632
- C:\Windows\System\oLrqqpd.exe
  C:\Windows\System\oLrqqpd.exe
  2⤵
  PID:4704
- C:\Windows\System\GmQyRZq.exe
  C:\Windows\System\GmQyRZq.exe
  2⤵
  PID:4728
- C:\Windows\System\lXkGplc.exe
  C:\Windows\System\lXkGplc.exe
  2⤵
  PID:4744
- C:\Windows\System\MmycpzR.exe
  C:\Windows\System\MmycpzR.exe
  2⤵
  PID:1724
- C:\Windows\System\EGXlUyc.exe
  C:\Windows\System\EGXlUyc.exe
  2⤵
  PID:4760
- C:\Windows\System\EoqhzHi.exe
  C:\Windows\System\EoqhzHi.exe
  2⤵
  PID:2412
- C:\Windows\System\qygrDLf.exe
  C:\Windows\System\qygrDLf.exe
  2⤵
  PID:4896
- C:\Windows\System\NYYhivf.exe
  C:\Windows\System\NYYhivf.exe
  2⤵
  PID:4920
- C:\Windows\System\xkHHvQZ.exe
  C:\Windows\System\xkHHvQZ.exe
  2⤵
  PID:3968
- C:\Windows\System\dCJCkVN.exe
  C:\Windows\System\dCJCkVN.exe
  2⤵
  PID:4028
- C:\Windows\System\bDEpiRh.exe
  C:\Windows\System\bDEpiRh.exe
  2⤵
  PID:2160
- C:\Windows\System\EXtDrVY.exe
  C:\Windows\System\EXtDrVY.exe
  2⤵
  PID:4616
- C:\Windows\System\yXzQDkP.exe
  C:\Windows\System\yXzQDkP.exe
  2⤵
  PID:2216
- C:\Windows\System\MyoMkhu.exe
  C:\Windows\System\MyoMkhu.exe
  2⤵
  PID:828
- C:\Windows\System\MOlTZoG.exe
  C:\Windows\System\MOlTZoG.exe
  2⤵
  PID:844
- C:\Windows\System\GReHOQB.exe
  C:\Windows\System\GReHOQB.exe
  2⤵
  PID:1672
- C:\Windows\System\bTweUMx.exe
  C:\Windows\System\bTweUMx.exe
  2⤵
  PID:2344
- C:\Windows\System\PFuMjpJ.exe
  C:\Windows\System\PFuMjpJ.exe
  2⤵
  PID:3604
- C:\Windows\System\vaKhDLL.exe
  C:\Windows\System\vaKhDLL.exe
  2⤵
  PID:5056
- C:\Windows\System\zpxabSC.exe
  C:\Windows\System\zpxabSC.exe
  2⤵
  PID:2628
- C:\Windows\System\baAEegW.exe
  C:\Windows\System\baAEegW.exe
  2⤵
  PID:2608
- C:\Windows\System\xXaRKha.exe
  C:\Windows\System\xXaRKha.exe
  2⤵
  PID:2820
- C:\Windows\System\etmlJaR.exe
  C:\Windows\System\etmlJaR.exe
  2⤵
  PID:3132
- C:\Windows\System\SyKyqhD.exe
  C:\Windows\System\SyKyqhD.exe
  2⤵
  PID:4084
- C:\Windows\System\WArgyxe.exe
  C:\Windows\System\WArgyxe.exe
  2⤵
  PID:3916
- C:\Windows\System\EfjcRch.exe
  C:\Windows\System\EfjcRch.exe
  2⤵
  PID:4148
- C:\Windows\System\ZcUQOuQ.exe
  C:\Windows\System\ZcUQOuQ.exe
  2⤵
  PID:1924
- C:\Windows\System\WRbTiSR.exe
  C:\Windows\System\WRbTiSR.exe
  2⤵
  PID:4216
- C:\Windows\System\IYyIjUF.exe
  C:\Windows\System\IYyIjUF.exe
  2⤵
  PID:2428
- C:\Windows\System\IWmQxdv.exe
  C:\Windows\System\IWmQxdv.exe
  2⤵
  PID:3980
- C:\Windows\System\ySGDlaz.exe
  C:\Windows\System\ySGDlaz.exe
  2⤵
  PID:4100
- C:\Windows\System\hJSsDQz.exe
  C:\Windows\System\hJSsDQz.exe
  2⤵
  PID:3620
- C:\Windows\System\RSefVsW.exe
  C:\Windows\System\RSefVsW.exe
  2⤵
  PID:4496
- C:\Windows\System\gDxxeel.exe
  C:\Windows\System\gDxxeel.exe
  2⤵
  PID:1700
- C:\Windows\System\hDxUzWb.exe
  C:\Windows\System\hDxUzWb.exe
  2⤵
  PID:4716
- C:\Windows\System\kVaCIKq.exe
  C:\Windows\System\kVaCIKq.exe
  2⤵
  PID:4752
- C:\Windows\System\gItykWr.exe
  C:\Windows\System\gItykWr.exe
  2⤵
  PID:4764
- C:\Windows\System\kLaZKJM.exe
  C:\Windows\System\kLaZKJM.exe
  2⤵
  PID:4712
- C:\Windows\System\KGxSMfq.exe
  C:\Windows\System\KGxSMfq.exe
  2⤵
  PID:824
- C:\Windows\System\uUkeoRz.exe
  C:\Windows\System\uUkeoRz.exe
  2⤵
  PID:4800
- C:\Windows\System\LaIvqZU.exe
  C:\Windows\System\LaIvqZU.exe
  2⤵
  PID:4788
- C:\Windows\System\kyDbSoP.exe
  C:\Windows\System\kyDbSoP.exe
  2⤵
  PID:4816
- C:\Windows\System\labNkGk.exe
  C:\Windows\System\labNkGk.exe
  2⤵
  PID:4820
- C:\Windows\System\AaKmyjL.exe
  C:\Windows\System\AaKmyjL.exe
  2⤵
  PID:2152
- C:\Windows\System\MnPuXce.exe
  C:\Windows\System\MnPuXce.exe
  2⤵
  PID:5084
- C:\Windows\System\ObexpQK.exe
  C:\Windows\System\ObexpQK.exe
  2⤵
  PID:3672
- C:\Windows\System\OVZLAyP.exe
  C:\Windows\System\OVZLAyP.exe
  2⤵
  PID:4480
- C:\Windows\System\uInZlqB.exe
  C:\Windows\System\uInZlqB.exe
  2⤵
  PID:4284
- C:\Windows\System\IRmDNHF.exe
  C:\Windows\System\IRmDNHF.exe
  2⤵
  PID:3556
- C:\Windows\System\QauppjH.exe
  C:\Windows\System\QauppjH.exe
  2⤵
  PID:4380
- C:\Windows\System\MNhPYUg.exe
  C:\Windows\System\MNhPYUg.exe
  2⤵
  PID:3492
- C:\Windows\System\FNxxDoE.exe
  C:\Windows\System\FNxxDoE.exe
  2⤵
  PID:4560
- C:\Windows\System\VKidTHM.exe
  C:\Windows\System\VKidTHM.exe
  2⤵
  PID:4628
- C:\Windows\System\QnGuReF.exe
  C:\Windows\System\QnGuReF.exe
  2⤵
  PID:4852
- C:\Windows\System\EoYHnSc.exe
  C:\Windows\System\EoYHnSc.exe
  2⤵
  PID:4880
- C:\Windows\System\shksgYi.exe
  C:\Windows\System\shksgYi.exe
  2⤵
  PID:4900
- C:\Windows\System\KwMhMNo.exe
  C:\Windows\System\KwMhMNo.exe
  2⤵
  PID:4916
- C:\Windows\System\atlHxjv.exe
  C:\Windows\System\atlHxjv.exe
  2⤵
  PID:1648
- C:\Windows\System\YoQiboV.exe
  C:\Windows\System\YoQiboV.exe
  2⤵
  PID:4184
- C:\Windows\System\TXhVAAu.exe
  C:\Windows\System\TXhVAAu.exe
  2⤵
  PID:4476
- C:\Windows\System\rLrehrB.exe
  C:\Windows\System\rLrehrB.exe
  2⤵
  PID:2788
- C:\Windows\System\HEnnITD.exe
  C:\Windows\System\HEnnITD.exe
  2⤵
  PID:4960
- C:\Windows\System\coJiyvr.exe
  C:\Windows\System\coJiyvr.exe
  2⤵
  PID:3768
- C:\Windows\System\oTwrfHz.exe
  C:\Windows\System\oTwrfHz.exe
  2⤵
  PID:2020
- C:\Windows\System\TJlAxYS.exe
  C:\Windows\System\TJlAxYS.exe
  2⤵
  PID:3540
- C:\Windows\System\AutCJvT.exe
  C:\Windows\System\AutCJvT.exe
  2⤵
  PID:1248
- C:\Windows\System\dEsaiGw.exe
  C:\Windows\System\dEsaiGw.exe
  2⤵
  PID:2624
- C:\Windows\System\LgGdsBp.exe
  C:\Windows\System\LgGdsBp.exe
  2⤵
  PID:3332
- C:\Windows\System\pjOsfeh.exe
  C:\Windows\System\pjOsfeh.exe
  2⤵
  PID:296
- C:\Windows\System\OFsYgxt.exe
  C:\Windows\System\OFsYgxt.exe
  2⤵
  PID:2272
- C:\Windows\System\oLeJZWU.exe
  C:\Windows\System\oLeJZWU.exe
  2⤵
  PID:412
- C:\Windows\System\VZrAKkr.exe
  C:\Windows\System\VZrAKkr.exe
  2⤵
  PID:4724
- C:\Windows\System\sRVjkwA.exe
  C:\Windows\System\sRVjkwA.exe
  2⤵
  PID:4804
- C:\Windows\System\OgjbZtP.exe
  C:\Windows\System\OgjbZtP.exe
  2⤵
  PID:3804
- C:\Windows\System\nJnHGwo.exe
  C:\Windows\System\nJnHGwo.exe
  2⤵
  PID:2848
- C:\Windows\System\OtXGrwn.exe
  C:\Windows\System\OtXGrwn.exe
  2⤵
  PID:1356
- C:\Windows\System\wlaVlXU.exe
  C:\Windows\System\wlaVlXU.exe
  2⤵
  PID:5128
- C:\Windows\System\bsIGoBS.exe
  C:\Windows\System\bsIGoBS.exe
  2⤵
  PID:5144
- C:\Windows\System\TgRXKBR.exe
  C:\Windows\System\TgRXKBR.exe
  2⤵
  PID:5164
- C:\Windows\System\eoAMtzt.exe
  C:\Windows\System\eoAMtzt.exe
  2⤵
  PID:5180
- C:\Windows\System\dVJhKmD.exe
  C:\Windows\System\dVJhKmD.exe
  2⤵
  PID:5196
- C:\Windows\System\IvknoHv.exe
  C:\Windows\System\IvknoHv.exe
  2⤵
  PID:5212
- C:\Windows\System\KyzYQdQ.exe
  C:\Windows\System\KyzYQdQ.exe
  2⤵
  PID:5232
- C:\Windows\System\wzhLtHS.exe
  C:\Windows\System\wzhLtHS.exe
  2⤵
  PID:5312
- C:\Windows\System\vJvdDoT.exe
  C:\Windows\System\vJvdDoT.exe
  2⤵
  PID:5328
- C:\Windows\System\CsTwpKZ.exe
  C:\Windows\System\CsTwpKZ.exe
  2⤵
  PID:5344
- C:\Windows\System\KloGhWS.exe
  C:\Windows\System\KloGhWS.exe
  2⤵
  PID:5360
- C:\Windows\System\vsvOrhW.exe
  C:\Windows\System\vsvOrhW.exe
  2⤵
  PID:5376
- C:\Windows\System\uqXBsdF.exe
  C:\Windows\System\uqXBsdF.exe
  2⤵
  PID:5392
- C:\Windows\System\lbqWfWd.exe
  C:\Windows\System\lbqWfWd.exe
  2⤵
  PID:5408
- C:\Windows\System\AUHYJGU.exe
  C:\Windows\System\AUHYJGU.exe
  2⤵
  PID:5424
- C:\Windows\System\qaoVUXE.exe
  C:\Windows\System\qaoVUXE.exe
  2⤵
  PID:5440
- C:\Windows\System\VFpTgcr.exe
  C:\Windows\System\VFpTgcr.exe
  2⤵
  PID:5456
- C:\Windows\System\bpGnpxl.exe
  C:\Windows\System\bpGnpxl.exe
  2⤵
  PID:5472
- C:\Windows\System\mbcOfzE.exe
  C:\Windows\System\mbcOfzE.exe
  2⤵
  PID:5492
- C:\Windows\System\RDqdriZ.exe
  C:\Windows\System\RDqdriZ.exe
  2⤵
  PID:5508
- C:\Windows\System\ECqcAOW.exe
  C:\Windows\System\ECqcAOW.exe
  2⤵
  PID:5524
- C:\Windows\System\LmlRzAh.exe
  C:\Windows\System\LmlRzAh.exe
  2⤵
  PID:5540
- C:\Windows\System\NrAQyjy.exe
  C:\Windows\System\NrAQyjy.exe
  2⤵
  PID:5556
- C:\Windows\System\WhTVUjF.exe
  C:\Windows\System\WhTVUjF.exe
  2⤵
  PID:5572
- C:\Windows\System\vWRCOhX.exe
  C:\Windows\System\vWRCOhX.exe
  2⤵
  PID:5588
- C:\Windows\System\JLZSfXh.exe
  C:\Windows\System\JLZSfXh.exe
  2⤵
  PID:5604
- C:\Windows\System\pErcMsM.exe
  C:\Windows\System\pErcMsM.exe
  2⤵
  PID:5624
- C:\Windows\System\GINRpOL.exe
  C:\Windows\System\GINRpOL.exe
  2⤵
  PID:5640
- C:\Windows\System\wsWIGOP.exe
  C:\Windows\System\wsWIGOP.exe
  2⤵
  PID:5656
- C:\Windows\System\fgCGbuD.exe
  C:\Windows\System\fgCGbuD.exe
  2⤵
  PID:5672
- C:\Windows\System\piUMbYp.exe
  C:\Windows\System\piUMbYp.exe
  2⤵
  PID:5688
- C:\Windows\System\DZZCQQn.exe
  C:\Windows\System\DZZCQQn.exe
  2⤵
  PID:5860
- C:\Windows\System\mZZpyPH.exe
  C:\Windows\System\mZZpyPH.exe
  2⤵
  PID:5876
- C:\Windows\System\rZlkjtz.exe
  C:\Windows\System\rZlkjtz.exe
  2⤵
  PID:5896
- C:\Windows\System\FeXKlmN.exe
  C:\Windows\System\FeXKlmN.exe
  2⤵
  PID:5912
- C:\Windows\System\wgCgbHP.exe
  C:\Windows\System\wgCgbHP.exe
  2⤵
  PID:5928
- C:\Windows\System\qleozsG.exe
  C:\Windows\System\qleozsG.exe
  2⤵
  PID:5944
- C:\Windows\System\hwfUvBd.exe
  C:\Windows\System\hwfUvBd.exe
  2⤵
  PID:5960
- C:\Windows\System\PYsSWvE.exe
  C:\Windows\System\PYsSWvE.exe
  2⤵
  PID:5976
- C:\Windows\System\KFrEerv.exe
  C:\Windows\System\KFrEerv.exe
  2⤵
  PID:5992
- C:\Windows\System\zylfUCw.exe
  C:\Windows\System\zylfUCw.exe
  2⤵
  PID:6008
- C:\Windows\System\kXhgliC.exe
  C:\Windows\System\kXhgliC.exe
  2⤵
  PID:6068
- C:\Windows\System\BZNwtXK.exe
  C:\Windows\System\BZNwtXK.exe
  2⤵
  PID:6084
- C:\Windows\System\pecYbAp.exe
  C:\Windows\System\pecYbAp.exe
  2⤵
  PID:6104
- C:\Windows\System\XubAQxV.exe
  C:\Windows\System\XubAQxV.exe
  2⤵
  PID:6120
- C:\Windows\System\VaNBfjF.exe
  C:\Windows\System\VaNBfjF.exe
  2⤵
  PID:6136
- C:\Windows\System\ZVgfBKq.exe
  C:\Windows\System\ZVgfBKq.exe
  2⤵
  PID:5088
- C:\Windows\System\wsGMJyh.exe
  C:\Windows\System\wsGMJyh.exe
  2⤵
  PID:2104
- C:\Windows\System\wnZVgzL.exe
  C:\Windows\System\wnZVgzL.exe
  2⤵
  PID:5228
- C:\Windows\System\XbXCSQl.exe
  C:\Windows\System\XbXCSQl.exe
  2⤵
  PID:5160
- C:\Windows\System\AytDYzn.exe
  C:\Windows\System\AytDYzn.exe
  2⤵
  PID:3836
- C:\Windows\System\iqwmiyj.exe
  C:\Windows\System\iqwmiyj.exe
  2⤵
  PID:1312
- C:\Windows\System\iGDcZNB.exe
  C:\Windows\System\iGDcZNB.exe
  2⤵
  PID:3460
- C:\Windows\System\PQAFAlM.exe
  C:\Windows\System\PQAFAlM.exe
  2⤵
  PID:4644
- C:\Windows\System\iSNKezf.exe
  C:\Windows\System\iSNKezf.exe
  2⤵
  PID:3380
- C:\Windows\System\JGdTIRi.exe
  C:\Windows\System\JGdTIRi.exe
  2⤵
  PID:4328
- C:\Windows\System\zGbGsyH.exe
  C:\Windows\System\zGbGsyH.exe
  2⤵
  PID:2484
- C:\Windows\System\eLhwdSx.exe
  C:\Windows\System\eLhwdSx.exe
  2⤵
  PID:5248
- C:\Windows\System\ZpcUfzP.exe
  C:\Windows\System\ZpcUfzP.exe
  2⤵
  PID:5268
- C:\Windows\System\dYLjUoH.exe
  C:\Windows\System\dYLjUoH.exe
  2⤵
  PID:5284
- C:\Windows\System\zScFiOk.exe
  C:\Windows\System\zScFiOk.exe
  2⤵
  PID:5324
- C:\Windows\System\nfWIpJV.exe
  C:\Windows\System\nfWIpJV.exe
  2⤵
  PID:5356
- C:\Windows\System\FxVMFUr.exe
  C:\Windows\System\FxVMFUr.exe
  2⤵
  PID:5420
- C:\Windows\System\vgeSUCc.exe
  C:\Windows\System\vgeSUCc.exe
  2⤵
  PID:5484
- C:\Windows\System\LKqgCyh.exe
  C:\Windows\System\LKqgCyh.exe
  2⤵
  PID:5548
- C:\Windows\System\NGKxksA.exe
  C:\Windows\System\NGKxksA.exe
  2⤵
  PID:5404
- C:\Windows\System\xiQtnlx.exe
  C:\Windows\System\xiQtnlx.exe
  2⤵
  PID:5336
- C:\Windows\System\XYUgbXo.exe
  C:\Windows\System\XYUgbXo.exe
  2⤵
  PID:5400
- C:\Windows\System\uqHRJuW.exe
  C:\Windows\System\uqHRJuW.exe
  2⤵
  PID:5468
- C:\Windows\System\vsDhLeo.exe
  C:\Windows\System\vsDhLeo.exe
  2⤵
  PID:5536
- C:\Windows\System\ODpenoI.exe
  C:\Windows\System\ODpenoI.exe
  2⤵
  PID:5600
- C:\Windows\System\VhclMdU.exe
  C:\Windows\System\VhclMdU.exe
  2⤵
  PID:5668
- C:\Windows\System\iynkcBh.exe
  C:\Windows\System\iynkcBh.exe
  2⤵
  PID:5708
- C:\Windows\System\heMNNVp.exe
  C:\Windows\System\heMNNVp.exe
  2⤵
  PID:5724
- C:\Windows\System\FeAsWJU.exe
  C:\Windows\System\FeAsWJU.exe
  2⤵
  PID:5744
- C:\Windows\System\wnmqvxh.exe
  C:\Windows\System\wnmqvxh.exe
  2⤵
  PID:5760
- C:\Windows\System\IgusmuD.exe
  C:\Windows\System\IgusmuD.exe
  2⤵
  PID:5776
- C:\Windows\System\LifCMHZ.exe
  C:\Windows\System\LifCMHZ.exe
  2⤵
  PID:5792
- C:\Windows\System\AaDzHSD.exe
  C:\Windows\System\AaDzHSD.exe
  2⤵
  PID:5808
- C:\Windows\System\wcGpjGE.exe
  C:\Windows\System\wcGpjGE.exe
  2⤵
  PID:5820
- C:\Windows\System\vACeMct.exe
  C:\Windows\System\vACeMct.exe
  2⤵
  PID:5872
- C:\Windows\System\wUJklPo.exe
  C:\Windows\System\wUJklPo.exe
  2⤵
  PID:5936
- C:\Windows\System\xbqBKjX.exe
  C:\Windows\System\xbqBKjX.exe
  2⤵
  PID:6000
- C:\Windows\System\nDPhpfG.exe
  C:\Windows\System\nDPhpfG.exe
  2⤵
  PID:5836
- C:\Windows\System\hSCbAuo.exe
  C:\Windows\System\hSCbAuo.exe
  2⤵
  PID:5844
- C:\Windows\System\CouUABe.exe
  C:\Windows\System\CouUABe.exe
  2⤵
  PID:5856
- C:\Windows\System\CJgHbEl.exe
  C:\Windows\System\CJgHbEl.exe
  2⤵
  PID:6044
- C:\Windows\System\LBcicaR.exe
  C:\Windows\System\LBcicaR.exe
  2⤵
  PID:5956
- C:\Windows\System\zDXGfPy.exe
  C:\Windows\System\zDXGfPy.exe
  2⤵
  PID:6040
- C:\Windows\System\pOgtUKQ.exe
  C:\Windows\System\pOgtUKQ.exe
  2⤵
  PID:6076
- C:\Windows\System\MuxHhOf.exe
  C:\Windows\System\MuxHhOf.exe
  2⤵
  PID:6116
- C:\Windows\System\SqQqdin.exe
  C:\Windows\System\SqQqdin.exe
  2⤵
  PID:4984
- C:\Windows\System\QtZOiRc.exe
  C:\Windows\System\QtZOiRc.exe
  2⤵
  PID:4428
- C:\Windows\System\KAXISof.exe
  C:\Windows\System\KAXISof.exe
  2⤵
  PID:5416
- C:\Windows\System\EvKXWSC.exe
  C:\Windows\System\EvKXWSC.exe
  2⤵
  PID:5256
- C:\Windows\System\NXbnXGV.exe
  C:\Windows\System\NXbnXGV.exe
  2⤵
  PID:4884
- C:\Windows\System\xYsooeg.exe
  C:\Windows\System\xYsooeg.exe
  2⤵
  PID:5620
- C:\Windows\System\enkHtpq.exe
  C:\Windows\System\enkHtpq.exe
  2⤵
  PID:6132
- C:\Windows\System\TupOXld.exe
  C:\Windows\System\TupOXld.exe
  2⤵
  PID:6096
- C:\Windows\System\IVPxwlg.exe
  C:\Windows\System\IVPxwlg.exe
  2⤵
  PID:5452
- C:\Windows\System\yFteyDM.exe
  C:\Windows\System\yFteyDM.exe
  2⤵
  PID:4936
- C:\Windows\System\scdanUm.exe
  C:\Windows\System\scdanUm.exe
  2⤵
  PID:2684
- C:\Windows\System\rIJcztc.exe
  C:\Windows\System\rIJcztc.exe
  2⤵
  PID:5352
- C:\Windows\System\CJUxFhY.exe
  C:\Windows\System\CJUxFhY.exe
  2⤵
  PID:5652
- C:\Windows\System\BwOQHEX.exe
  C:\Windows\System\BwOQHEX.exe
  2⤵
  PID:5300
- C:\Windows\System\qSsbmgS.exe
  C:\Windows\System\qSsbmgS.exe
  2⤵
  PID:5304
- C:\Windows\System\RJOnYTE.exe
  C:\Windows\System\RJOnYTE.exe
  2⤵
  PID:5504
- C:\Windows\System\bUiTsDb.exe
  C:\Windows\System\bUiTsDb.exe
  2⤵
  PID:5700
- C:\Windows\System\mpyHNgr.exe
  C:\Windows\System\mpyHNgr.exe
  2⤵
  PID:5772
- C:\Windows\System\NunjTbn.exe
  C:\Windows\System\NunjTbn.exe
  2⤵
  PID:5804
- C:\Windows\System\DItMaIe.exe
  C:\Windows\System\DItMaIe.exe
  2⤵
  PID:5972
- C:\Windows\System\MVzkeaC.exe
  C:\Windows\System\MVzkeaC.exe
  2⤵
  PID:5884
- C:\Windows\System\OBEupnZ.exe
  C:\Windows\System\OBEupnZ.exe
  2⤵
  PID:6080
- C:\Windows\System\qHOrdje.exe
  C:\Windows\System\qHOrdje.exe
  2⤵
  PID:5152
- C:\Windows\System\mdslYqF.exe
  C:\Windows\System\mdslYqF.exe
  2⤵
  PID:5616
- C:\Windows\System\aXqLnZS.exe
  C:\Windows\System\aXqLnZS.exe
  2⤵
  PID:5188
- C:\Windows\System\nAMJyFq.exe
  C:\Windows\System\nAMJyFq.exe
  2⤵
  PID:5296
- C:\Windows\System\PpcYSCw.exe
  C:\Windows\System\PpcYSCw.exe
  2⤵
  PID:5768
- C:\Windows\System\LcgElou.exe
  C:\Windows\System\LcgElou.exe
  2⤵
  PID:6060
- C:\Windows\System\ZFAmALN.exe
  C:\Windows\System\ZFAmALN.exe
  2⤵
  PID:300
- C:\Windows\System\psFKwjU.exe
  C:\Windows\System\psFKwjU.exe
  2⤵
  PID:6148
- C:\Windows\System\ydepqUL.exe
  C:\Windows\System\ydepqUL.exe
  2⤵
  PID:6164
- C:\Windows\System\humEWHf.exe
  C:\Windows\System\humEWHf.exe
  2⤵
  PID:6180
- C:\Windows\System\GdFcJda.exe
  C:\Windows\System\GdFcJda.exe
  2⤵
  PID:6196
- C:\Windows\System\oQiPtLt.exe
  C:\Windows\System\oQiPtLt.exe
  2⤵
  PID:6212
- C:\Windows\System\xcTTDxG.exe
  C:\Windows\System\xcTTDxG.exe
  2⤵
  PID:6228
- C:\Windows\System\vUvtWAO.exe
  C:\Windows\System\vUvtWAO.exe
  2⤵
  PID:6244
- C:\Windows\System\uWIIJCC.exe
  C:\Windows\System\uWIIJCC.exe
  2⤵
  PID:6260
- C:\Windows\System\iJtKJSO.exe
  C:\Windows\System\iJtKJSO.exe
  2⤵
  PID:6276
- C:\Windows\System\toJahwQ.exe
  C:\Windows\System\toJahwQ.exe
  2⤵
  PID:6292
- C:\Windows\System\CBIniek.exe
  C:\Windows\System\CBIniek.exe
  2⤵
  PID:6308
- C:\Windows\System\xvJXjWv.exe
  C:\Windows\System\xvJXjWv.exe
  2⤵
  PID:6328
- C:\Windows\System\SwQKwUz.exe
  C:\Windows\System\SwQKwUz.exe
  2⤵
  PID:6344
- C:\Windows\System\mngKkBi.exe
  C:\Windows\System\mngKkBi.exe
  2⤵
  PID:6360
- C:\Windows\System\OHwwZuM.exe
  C:\Windows\System\OHwwZuM.exe
  2⤵
  PID:6376
- C:\Windows\System\QAiMYuH.exe
  C:\Windows\System\QAiMYuH.exe
  2⤵
  PID:6396
- C:\Windows\System\LcRnqNh.exe
  C:\Windows\System\LcRnqNh.exe
  2⤵
  PID:6412
- C:\Windows\System\vMtWSCM.exe
  C:\Windows\System\vMtWSCM.exe
  2⤵
  PID:6428
- C:\Windows\System\mbRPjif.exe
  C:\Windows\System\mbRPjif.exe
  2⤵
  PID:6444
- C:\Windows\System\iRuoioH.exe
  C:\Windows\System\iRuoioH.exe
  2⤵
  PID:6464
- C:\Windows\System\RXRARGx.exe
  C:\Windows\System\RXRARGx.exe
  2⤵
  PID:6480
- C:\Windows\System\lnaJfmA.exe
  C:\Windows\System\lnaJfmA.exe
  2⤵
  PID:6496
- C:\Windows\System\QuddrCp.exe
  C:\Windows\System\QuddrCp.exe
  2⤵
  PID:6512
- C:\Windows\System\AJLOCnm.exe
  C:\Windows\System\AJLOCnm.exe
  2⤵
  PID:6528
- C:\Windows\System\NmQLPUj.exe
  C:\Windows\System\NmQLPUj.exe
  2⤵
  PID:6544
- C:\Windows\System\cHdVGXq.exe
  C:\Windows\System\cHdVGXq.exe
  2⤵
  PID:6564
- C:\Windows\System\GLDGpxg.exe
  C:\Windows\System\GLDGpxg.exe
  2⤵
  PID:6580
- C:\Windows\System\EmKgNVj.exe
  C:\Windows\System\EmKgNVj.exe
  2⤵
  PID:6596
- C:\Windows\System\SddKRoP.exe
  C:\Windows\System\SddKRoP.exe
  2⤵
  PID:6612
- C:\Windows\System\aHpmzbu.exe
  C:\Windows\System\aHpmzbu.exe
  2⤵
  PID:6628
- C:\Windows\System\cdiNHWQ.exe
  C:\Windows\System\cdiNHWQ.exe
  2⤵
  PID:6648
- C:\Windows\System\XNdPhof.exe
  C:\Windows\System\XNdPhof.exe
  2⤵
  PID:6664
- C:\Windows\System\UhCIKGx.exe
  C:\Windows\System\UhCIKGx.exe
  2⤵
  PID:6680
- C:\Windows\System\IuitecF.exe
  C:\Windows\System\IuitecF.exe
  2⤵
  PID:6772
- C:\Windows\System\xDKMyqk.exe
  C:\Windows\System\xDKMyqk.exe
  2⤵
  PID:6788
- C:\Windows\System\nSBcjby.exe
  C:\Windows\System\nSBcjby.exe
  2⤵
  PID:6804
- C:\Windows\System\uzSJrDG.exe
  C:\Windows\System\uzSJrDG.exe
  2⤵
  PID:6824
- C:\Windows\System\PrlxwWm.exe
  C:\Windows\System\PrlxwWm.exe
  2⤵
  PID:6840
- C:\Windows\System\AHdJWYa.exe
  C:\Windows\System\AHdJWYa.exe
  2⤵
  PID:6856
- C:\Windows\System\tGBFjHE.exe
  C:\Windows\System\tGBFjHE.exe
  2⤵
  PID:6872
- C:\Windows\System\RKhOIFQ.exe
  C:\Windows\System\RKhOIFQ.exe
  2⤵
  PID:7032
- C:\Windows\System\XGWUNfD.exe
  C:\Windows\System\XGWUNfD.exe
  2⤵
  PID:7048
- C:\Windows\System\zaCAGFC.exe
  C:\Windows\System\zaCAGFC.exe
  2⤵
  PID:7064
- C:\Windows\System\IxJezyR.exe
  C:\Windows\System\IxJezyR.exe
  2⤵
  PID:7080
- C:\Windows\System\FQsOCgA.exe
  C:\Windows\System\FQsOCgA.exe
  2⤵
  PID:7096
- C:\Windows\System\DWsfCrn.exe
  C:\Windows\System\DWsfCrn.exe
  2⤵
  PID:7112
- C:\Windows\System\oDTdKTY.exe
  C:\Windows\System\oDTdKTY.exe
  2⤵
  PID:7128
- C:\Windows\System\sNordsK.exe
  C:\Windows\System\sNordsK.exe
  2⤵
  PID:7144
- C:\Windows\System\osZkxDB.exe
  C:\Windows\System\osZkxDB.exe
  2⤵
  PID:7160
- C:\Windows\System\UOHTXcX.exe
  C:\Windows\System\UOHTXcX.exe
  2⤵
  PID:6204
- C:\Windows\System\wGuybdJ.exe
  C:\Windows\System\wGuybdJ.exe
  2⤵
  PID:6268
- C:\Windows\System\JVxZgHV.exe
  C:\Windows\System\JVxZgHV.exe
  2⤵
  PID:5720
- C:\Windows\System\cvZXCxH.exe
  C:\Windows\System\cvZXCxH.exe
  2⤵
  PID:5788
- C:\Windows\System\SELctXw.exe
  C:\Windows\System\SELctXw.exe
  2⤵
  PID:5176
- C:\Windows\System\uhsTCKL.exe
  C:\Windows\System\uhsTCKL.exe
  2⤵
  PID:6192
- C:\Windows\System\uTUdMNB.exe
  C:\Windows\System\uTUdMNB.exe
  2⤵
  PID:5816
- C:\Windows\System\VmmLhob.exe
  C:\Windows\System\VmmLhob.exe
  2⤵
  PID:5852
- C:\Windows\System\rWVldQM.exe
  C:\Windows\System\rWVldQM.exe
  2⤵
  PID:6024
- C:\Windows\System\avTJLjk.exe
  C:\Windows\System\avTJLjk.exe
  2⤵
  PID:5516
- C:\Windows\System\afazHxp.exe
  C:\Windows\System\afazHxp.exe
  2⤵
  PID:6128
- C:\Windows\System\eqlabyA.exe
  C:\Windows\System\eqlabyA.exe
  2⤵
  PID:5580
- C:\Windows\System\XLWizUw.exe
  C:\Windows\System\XLWizUw.exe
  2⤵
  PID:5568
- C:\Windows\System\dnVGilQ.exe
  C:\Windows\System\dnVGilQ.exe
  2⤵
  PID:6028
- C:\Windows\System\cnqiRUO.exe
  C:\Windows\System\cnqiRUO.exe
  2⤵
  PID:5192
- C:\Windows\System\wrOmzLo.exe
  C:\Windows\System\wrOmzLo.exe
  2⤵
  PID:6160
- C:\Windows\System\ceaAspq.exe
  C:\Windows\System\ceaAspq.exe
  2⤵
  PID:6288
- C:\Windows\System\jkDACol.exe
  C:\Windows\System\jkDACol.exe
  2⤵
  PID:6340
- C:\Windows\System\rYFRsWl.exe
  C:\Windows\System\rYFRsWl.exe
  2⤵
  PID:6436
- C:\Windows\System\jBXLYhw.exe
  C:\Windows\System\jBXLYhw.exe
  2⤵
  PID:6504
- C:\Windows\System\YYiKYdX.exe
  C:\Windows\System\YYiKYdX.exe
  2⤵
  PID:6572
- C:\Windows\System\dBQAycw.exe
  C:\Windows\System\dBQAycw.exe
  2⤵
  PID:6636
- C:\Windows\System\nhiebzm.exe
  C:\Windows\System\nhiebzm.exe
  2⤵
  PID:6676
- C:\Windows\System\iGAIGBa.exe
  C:\Windows\System\iGAIGBa.exe
  2⤵
  PID:6424
- C:\Windows\System\EjjrLbF.exe
  C:\Windows\System\EjjrLbF.exe
  2⤵
  PID:6352
- C:\Windows\System\hTPLVSb.exe
  C:\Windows\System\hTPLVSb.exe
  2⤵
  PID:6452
- C:\Windows\System\TcIWBWe.exe
  C:\Windows\System\TcIWBWe.exe
  2⤵
  PID:6524
- C:\Windows\System\UqREdcC.exe
  C:\Windows\System\UqREdcC.exe
  2⤵
  PID:6620
- C:\Windows\System\JgujobG.exe
  C:\Windows\System\JgujobG.exe
  2⤵
  PID:6696
- C:\Windows\System\fFyEOYT.exe
  C:\Windows\System\fFyEOYT.exe
  2⤵
  PID:6712
- C:\Windows\System\mSlRMNQ.exe
  C:\Windows\System\mSlRMNQ.exe
  2⤵
  PID:6728
- C:\Windows\System\IhtRreq.exe
  C:\Windows\System\IhtRreq.exe
  2⤵
  PID:6744
- C:\Windows\System\EddhIpT.exe
  C:\Windows\System\EddhIpT.exe
  2⤵
  PID:6692
- C:\Windows\System\Sbxspdd.exe
  C:\Windows\System\Sbxspdd.exe
  2⤵
  PID:6816
- C:\Windows\System\tdgJfUF.exe
  C:\Windows\System\tdgJfUF.exe
  2⤵
  PID:6884
- C:\Windows\System\UuPBMQm.exe
  C:\Windows\System\UuPBMQm.exe
  2⤵
  PID:6900
- C:\Windows\System\cqmIxQn.exe
  C:\Windows\System\cqmIxQn.exe
  2⤵
  PID:6920
- C:\Windows\System\pRpmyGj.exe
  C:\Windows\System\pRpmyGj.exe
  2⤵
  PID:6936
- C:\Windows\System\IHHfary.exe
  C:\Windows\System\IHHfary.exe
  2⤵
  PID:6952
- C:\Windows\System\gVMjwhc.exe
  C:\Windows\System\gVMjwhc.exe
  2⤵
  PID:6968
- C:\Windows\System\fbcMIOk.exe
  C:\Windows\System\fbcMIOk.exe
  2⤵
  PID:6984
- C:\Windows\System\WkwZatG.exe
  C:\Windows\System\WkwZatG.exe
  2⤵
  PID:7000
- C:\Windows\System\fOjaxqD.exe
  C:\Windows\System\fOjaxqD.exe
  2⤵
  PID:6800
- C:\Windows\System\MFsGCVM.exe
  C:\Windows\System\MFsGCVM.exe
  2⤵
  PID:6868
- C:\Windows\System\ztirBdF.exe
  C:\Windows\System\ztirBdF.exe
  2⤵
  PID:2592
- C:\Windows\System\mMKTFvq.exe
  C:\Windows\System\mMKTFvq.exe
  2⤵
  PID:7044
- C:\Windows\System\FiJeSHu.exe
  C:\Windows\System\FiJeSHu.exe
  2⤵
  PID:7056
- C:\Windows\System\RynNAQD.exe
  C:\Windows\System\RynNAQD.exe
  2⤵
  PID:7124
- C:\Windows\System\pCFyNTP.exe
  C:\Windows\System\pCFyNTP.exe
  2⤵
  PID:6236
- C:\Windows\System\cdjtkpX.exe
  C:\Windows\System\cdjtkpX.exe
  2⤵
  PID:7060
- C:\Windows\System\dgYAIId.exe
  C:\Windows\System\dgYAIId.exe
  2⤵
  PID:6016
- C:\Windows\System\ToUZpmG.exe
  C:\Windows\System\ToUZpmG.exe
  2⤵
  PID:6300
- C:\Windows\System\gLUCYYF.exe
  C:\Windows\System\gLUCYYF.exe
  2⤵
  PID:6052
- C:\Windows\System\xRCWCyS.exe
  C:\Windows\System\xRCWCyS.exe
  2⤵
  PID:7140
- C:\Windows\System\MguYPyp.exe
  C:\Windows\System\MguYPyp.exe
  2⤵
  PID:5204
- C:\Windows\System\lyTzLBA.exe
  C:\Windows\System\lyTzLBA.exe
  2⤵
  PID:5584
- C:\Windows\System\QAsSxSx.exe
  C:\Windows\System\QAsSxSx.exe
  2⤵
  PID:5276
- C:\Windows\System\BrOidcc.exe
  C:\Windows\System\BrOidcc.exe
  2⤵
  PID:4784
- C:\Windows\System\UXdKRUB.exe
  C:\Windows\System\UXdKRUB.exe
  2⤵
  PID:6284
- C:\Windows\System\aArXbfh.exe
  C:\Windows\System\aArXbfh.exe
  2⤵
  PID:6372
- C:\Windows\System\nqRzIeg.exe
  C:\Windows\System\nqRzIeg.exe
  2⤵
  PID:6488
- C:\Windows\System\lQHhsNn.exe
  C:\Windows\System\lQHhsNn.exe
  2⤵
  PID:6592
- C:\Windows\System\BmEKJye.exe
  C:\Windows\System\BmEKJye.exe
  2⤵
  PID:6708
- C:\Windows\System\sKhUaCw.exe
  C:\Windows\System\sKhUaCw.exe
  2⤵
  PID:6324
- C:\Windows\System\ASRkVux.exe
  C:\Windows\System\ASRkVux.exe
  2⤵
  PID:6688
- C:\Windows\System\RTiPkdD.exe
  C:\Windows\System\RTiPkdD.exe
  2⤵
  PID:6740
- C:\Windows\System\AoOKDLH.exe
  C:\Windows\System\AoOKDLH.exe
  2⤵
  PID:6784
- C:\Windows\System\waTJQMM.exe
  C:\Windows\System\waTJQMM.exe
  2⤵
  PID:6996
- C:\Windows\System\bEEgyzl.exe
  C:\Windows\System\bEEgyzl.exe
  2⤵
  PID:6836
- C:\Windows\System\hhNGEYr.exe
  C:\Windows\System\hhNGEYr.exe
  2⤵
  PID:6760
- C:\Windows\System\StQoqJJ.exe
  C:\Windows\System\StQoqJJ.exe
  2⤵
  PID:5756
- C:\Windows\System\EMJzkwA.exe
  C:\Windows\System\EMJzkwA.exe
  2⤵
  PID:6980
- C:\Windows\System\LigIlob.exe
  C:\Windows\System\LigIlob.exe
  2⤵
  PID:6912
- C:\Windows\System\KyquYzh.exe
  C:\Windows\System\KyquYzh.exe
  2⤵
  PID:7008
- C:\Windows\System\HcDTGxL.exe
  C:\Windows\System\HcDTGxL.exe
  2⤵
  PID:2496
- C:\Windows\System\MABBgaw.exe
  C:\Windows\System\MABBgaw.exe
  2⤵
  PID:5784
- C:\Windows\System\gQKmOiP.exe
  C:\Windows\System\gQKmOiP.exe
  2⤵
  PID:5716
- C:\Windows\System\XssHVnC.exe
  C:\Windows\System\XssHVnC.exe
  2⤵
  PID:5664
- C:\Windows\System\iygnbGg.exe
  C:\Windows\System\iygnbGg.exe
  2⤵
  PID:6272
- C:\Windows\System\sJTNkkY.exe
  C:\Windows\System\sJTNkkY.exe
  2⤵
  PID:4836
- C:\Windows\System\wkyDbon.exe
  C:\Windows\System\wkyDbon.exe
  2⤵
  PID:6224
- C:\Windows\System\ImYnWEZ.exe
  C:\Windows\System\ImYnWEZ.exe
  2⤵
  PID:6556
- C:\Windows\System\tmWFHzU.exe
  C:\Windows\System\tmWFHzU.exe
  2⤵
  PID:6724
- C:\Windows\System\yfQYIGp.exe
  C:\Windows\System\yfQYIGp.exe
  2⤵
  PID:6892
- C:\Windows\System\nqDsQVE.exe
  C:\Windows\System\nqDsQVE.exe
  2⤵
  PID:6092
- C:\Windows\System\RfaTFNO.exe
  C:\Windows\System\RfaTFNO.exe
  2⤵
  PID:6420
- C:\Windows\System\DsPCKDI.exe
  C:\Windows\System\DsPCKDI.exe
  2⤵
  PID:6656
- C:\Windows\System\itplrFS.exe
  C:\Windows\System\itplrFS.exe
  2⤵
  PID:6992
- C:\Windows\System\CuxJdMs.exe
  C:\Windows\System\CuxJdMs.exe
  2⤵
  PID:6756
- C:\Windows\System\jOtYsrR.exe
  C:\Windows\System\jOtYsrR.exe
  2⤵
  PID:7028
- C:\Windows\System\ublrymk.exe
  C:\Windows\System\ublrymk.exe
  2⤵
  PID:5832
- C:\Windows\System\ZQhTlCW.exe
  C:\Windows\System\ZQhTlCW.exe
  2⤵
  PID:5024
- C:\Windows\System\RLKGHjX.exe
  C:\Windows\System\RLKGHjX.exe
  2⤵
  PID:5796
- C:\Windows\System\xQdglTC.exe
  C:\Windows\System\xQdglTC.exe
  2⤵
  PID:7040
- C:\Windows\System\ahfKJmT.exe
  C:\Windows\System\ahfKJmT.exe
  2⤵
  PID:6896
- C:\Windows\System\qZCRDfi.exe
  C:\Windows\System\qZCRDfi.exe
  2⤵
  PID:6748
- C:\Windows\System\PXFROnl.exe
  C:\Windows\System\PXFROnl.exe
  2⤵
  PID:7188
- C:\Windows\System\FIVhLew.exe
  C:\Windows\System\FIVhLew.exe
  2⤵
  PID:7204
- C:\Windows\System\Evgybkn.exe
  C:\Windows\System\Evgybkn.exe
  2⤵
  PID:7228
- C:\Windows\System\KwtzxQk.exe
  C:\Windows\System\KwtzxQk.exe
  2⤵
  PID:7244
- C:\Windows\System\bbYaJaB.exe
  C:\Windows\System\bbYaJaB.exe
  2⤵
  PID:7260
- C:\Windows\System\ylrXLyR.exe
  C:\Windows\System\ylrXLyR.exe
  2⤵
  PID:7276
- C:\Windows\System\ZBbODkn.exe
  C:\Windows\System\ZBbODkn.exe
  2⤵
  PID:7296
- C:\Windows\System\cHKrcFt.exe
  C:\Windows\System\cHKrcFt.exe
  2⤵
  PID:7312
- C:\Windows\System\Maebuil.exe
  C:\Windows\System\Maebuil.exe
  2⤵
  PID:7328
- C:\Windows\System\xlcYGfu.exe
  C:\Windows\System\xlcYGfu.exe
  2⤵
  PID:7344
- C:\Windows\System\OotLnos.exe
  C:\Windows\System\OotLnos.exe
  2⤵
  PID:7360
- C:\Windows\System\eFOssAD.exe
  C:\Windows\System\eFOssAD.exe
  2⤵
  PID:7376
- C:\Windows\System\UshLCLB.exe
  C:\Windows\System\UshLCLB.exe
  2⤵
  PID:7392
- C:\Windows\System\kUvnmhw.exe
  C:\Windows\System\kUvnmhw.exe
  2⤵
  PID:7408
- C:\Windows\System\aOteYlD.exe
  C:\Windows\System\aOteYlD.exe
  2⤵
  PID:7424
- C:\Windows\System\fQCWBPh.exe
  C:\Windows\System\fQCWBPh.exe
  2⤵
  PID:7440
- C:\Windows\System\laaYklf.exe
  C:\Windows\System\laaYklf.exe
  2⤵
  PID:7456
- C:\Windows\System\CrIYTKX.exe
  C:\Windows\System\CrIYTKX.exe
  2⤵
  PID:7472
- C:\Windows\System\rBkTMVT.exe
  C:\Windows\System\rBkTMVT.exe
  2⤵
  PID:7488
- C:\Windows\System\viNrrYQ.exe
  C:\Windows\System\viNrrYQ.exe
  2⤵
  PID:7504
- C:\Windows\System\RqiJLTc.exe
  C:\Windows\System\RqiJLTc.exe
  2⤵
  PID:7524
- C:\Windows\System\zFpGAAS.exe
  C:\Windows\System\zFpGAAS.exe
  2⤵
  PID:7540
- C:\Windows\System\ObXgErw.exe
  C:\Windows\System\ObXgErw.exe
  2⤵
  PID:7556
- C:\Windows\System\iZfEtcY.exe
  C:\Windows\System\iZfEtcY.exe
  2⤵
  PID:7572
- C:\Windows\System\vPttJMM.exe
  C:\Windows\System\vPttJMM.exe
  2⤵
  PID:7592
- C:\Windows\System\OEvmNQp.exe
  C:\Windows\System\OEvmNQp.exe
  2⤵
  PID:7608
- C:\Windows\System\NPvliWh.exe
  C:\Windows\System\NPvliWh.exe
  2⤵
  PID:7624
- C:\Windows\System\zNpcIsY.exe
  C:\Windows\System\zNpcIsY.exe
  2⤵
  PID:7640
- C:\Windows\System\vcECgZU.exe
  C:\Windows\System\vcECgZU.exe
  2⤵
  PID:7656
- C:\Windows\System\zLFxdUW.exe
  C:\Windows\System\zLFxdUW.exe
  2⤵
  PID:7672
- C:\Windows\System\dSwCSar.exe
  C:\Windows\System\dSwCSar.exe
  2⤵
  PID:7692
- C:\Windows\System\oObCBgy.exe
  C:\Windows\System\oObCBgy.exe
  2⤵
  PID:7712
- C:\Windows\System\KyaLTrS.exe
  C:\Windows\System\KyaLTrS.exe
  2⤵
  PID:7728
- C:\Windows\System\RExlggj.exe
  C:\Windows\System\RExlggj.exe
  2⤵
  PID:7744
- C:\Windows\System\YhIyoPs.exe
  C:\Windows\System\YhIyoPs.exe
  2⤵
  PID:7760
- C:\Windows\System\IlRMytr.exe
  C:\Windows\System\IlRMytr.exe
  2⤵
  PID:7776
- C:\Windows\System\xvDQyAt.exe
  C:\Windows\System\xvDQyAt.exe
  2⤵
  PID:7792
- C:\Windows\System\ACjwFXu.exe
  C:\Windows\System\ACjwFXu.exe
  2⤵
  PID:7808
- C:\Windows\System\likXxEL.exe
  C:\Windows\System\likXxEL.exe
  2⤵
  PID:7824
- C:\Windows\System\YdxmJtE.exe
  C:\Windows\System\YdxmJtE.exe
  2⤵
  PID:7840
- C:\Windows\System\edClhZY.exe
  C:\Windows\System\edClhZY.exe
  2⤵
  PID:7856
- C:\Windows\System\UBMPZoA.exe
  C:\Windows\System\UBMPZoA.exe
  2⤵
  PID:7872
- C:\Windows\System\cPuKTVR.exe
  C:\Windows\System\cPuKTVR.exe
  2⤵
  PID:7892
- C:\Windows\System\xOdRvLh.exe
  C:\Windows\System\xOdRvLh.exe
  2⤵
  PID:7908
- C:\Windows\System\OfPKAMS.exe
  C:\Windows\System\OfPKAMS.exe
  2⤵
  PID:7924
- C:\Windows\System\SoULQUQ.exe
  C:\Windows\System\SoULQUQ.exe
  2⤵
  PID:7940
- C:\Windows\System\GAOuxbo.exe
  C:\Windows\System\GAOuxbo.exe
  2⤵
  PID:7956
- C:\Windows\System\AkPEsho.exe
  C:\Windows\System\AkPEsho.exe
  2⤵
  PID:7972
- C:\Windows\System\ziKAHVm.exe
  C:\Windows\System\ziKAHVm.exe
  2⤵
  PID:7988
- C:\Windows\System\LUsybOO.exe
  C:\Windows\System\LUsybOO.exe
  2⤵
  PID:8004
- C:\Windows\System\YtZTvgu.exe
  C:\Windows\System\YtZTvgu.exe
  2⤵
  PID:8020
- C:\Windows\System\rlVSlND.exe
  C:\Windows\System\rlVSlND.exe
  2⤵
  PID:8036
- C:\Windows\System\XJNFWZs.exe
  C:\Windows\System\XJNFWZs.exe
  2⤵
  PID:8052
- C:\Windows\System\EoJUahj.exe
  C:\Windows\System\EoJUahj.exe
  2⤵
  PID:8068
- C:\Windows\System\GeYXNRb.exe
  C:\Windows\System\GeYXNRb.exe
  2⤵
  PID:8084
- C:\Windows\System\sWUdmsO.exe
  C:\Windows\System\sWUdmsO.exe
  2⤵
  PID:8100
- C:\Windows\System\ycWdADV.exe
  C:\Windows\System\ycWdADV.exe
  2⤵
  PID:8116
- C:\Windows\System\ABDCVbg.exe
  C:\Windows\System\ABDCVbg.exe
  2⤵
  PID:8132
- C:\Windows\System\mIbYqpS.exe
  C:\Windows\System\mIbYqpS.exe
  2⤵
  PID:8148
- C:\Windows\System\AKZfPuU.exe
  C:\Windows\System\AKZfPuU.exe
  2⤵
  PID:8164
- C:\Windows\System\ORwVtOL.exe
  C:\Windows\System\ORwVtOL.exe
  2⤵
  PID:8180
- C:\Windows\System\japvflh.exe
  C:\Windows\System\japvflh.exe
  2⤵
  PID:6384
- C:\Windows\System\ZjgpmRv.exe
  C:\Windows\System\ZjgpmRv.exe
  2⤵
  PID:5464
- C:\Windows\System\ketFKDK.exe
  C:\Windows\System\ketFKDK.exe
  2⤵
  PID:7156
- C:\Windows\System\RppWYaU.exe
  C:\Windows\System\RppWYaU.exe
  2⤵
  PID:6536
- C:\Windows\System\CZwrmiU.exe
  C:\Windows\System\CZwrmiU.exe
  2⤵
  PID:6852
- C:\Windows\System\ADlOugY.exe
  C:\Windows\System\ADlOugY.exe
  2⤵
  PID:7200
- C:\Windows\System\anLihvk.exe
  C:\Windows\System\anLihvk.exe
  2⤵
  PID:7212
- C:\Windows\System\jToWccg.exe
  C:\Windows\System\jToWccg.exe
  2⤵
  PID:7256
- C:\Windows\System\kYaqzGa.exe
  C:\Windows\System\kYaqzGa.exe
  2⤵
  PID:7236
- C:\Windows\System\CCDCgMa.exe
  C:\Windows\System\CCDCgMa.exe
  2⤵
  PID:7304
- C:\Windows\System\gmBBvSl.exe
  C:\Windows\System\gmBBvSl.exe
  2⤵
  PID:7352
- C:\Windows\System\MSBUBxX.exe
  C:\Windows\System\MSBUBxX.exe
  2⤵
  PID:7356
- C:\Windows\System\qFwgYsY.exe
  C:\Windows\System\qFwgYsY.exe
  2⤵
  PID:7400
- C:\Windows\System\xhknPKb.exe
  C:\Windows\System\xhknPKb.exe
  2⤵
  PID:7404
- C:\Windows\System\KiwevMv.exe
  C:\Windows\System\KiwevMv.exe
  2⤵
  PID:7468
- C:\Windows\System\quhHptI.exe
  C:\Windows\System\quhHptI.exe
  2⤵
  PID:7496
- C:\Windows\System\QveXmeG.exe
  C:\Windows\System\QveXmeG.exe
  2⤵
  PID:7532
- C:\Windows\System\GfAjXsK.exe
  C:\Windows\System\GfAjXsK.exe
  2⤵
  PID:6796
- C:\Windows\System\mtyWEOH.exe
  C:\Windows\System\mtyWEOH.exe
  2⤵
  PID:7588
- C:\Windows\System\PSEfcpA.exe
  C:\Windows\System\PSEfcpA.exe
  2⤵
  PID:7648
- C:\Windows\System\LlMAyMt.exe
  C:\Windows\System\LlMAyMt.exe
  2⤵
  PID:7684
- C:\Windows\System\WDdeiGB.exe
  C:\Windows\System\WDdeiGB.exe
  2⤵
  PID:7752
- C:\Windows\System\NEahWEr.exe
  C:\Windows\System\NEahWEr.exe
  2⤵
  PID:7816
- C:\Windows\System\EbtIxhi.exe
  C:\Windows\System\EbtIxhi.exe
  2⤵
  PID:7632
- C:\Windows\System\BbuBZbZ.exe
  C:\Windows\System\BbuBZbZ.exe
  2⤵
  PID:7600
- C:\Windows\System\aiciVac.exe
  C:\Windows\System\aiciVac.exe
  2⤵
  PID:7736
- C:\Windows\System\ftpDNUc.exe
  C:\Windows\System\ftpDNUc.exe
  2⤵
  PID:7800
- C:\Windows\System\ouzxGEC.exe
  C:\Windows\System\ouzxGEC.exe
  2⤵
  PID:7884
- C:\Windows\System\qNrqmjP.exe
  C:\Windows\System\qNrqmjP.exe
  2⤵
  PID:7948
- C:\Windows\System\zNGTRMV.exe
  C:\Windows\System\zNGTRMV.exe
  2⤵
  PID:7984
- C:\Windows\System\BZznCzR.exe
  C:\Windows\System\BZznCzR.exe
  2⤵
  PID:7936
- C:\Windows\System\cghsqMg.exe
  C:\Windows\System\cghsqMg.exe
  2⤵
  PID:8000
- C:\Windows\System\JsZPwTE.exe
  C:\Windows\System\JsZPwTE.exe
  2⤵
  PID:8032
- C:\Windows\System\fTPbwEC.exe
  C:\Windows\System\fTPbwEC.exe
  2⤵
  PID:8044
- C:\Windows\System\EUbQrfP.exe
  C:\Windows\System\EUbQrfP.exe
  2⤵
  PID:8096
- C:\Windows\System\PKMKKNf.exe
  C:\Windows\System\PKMKKNf.exe
  2⤵
  PID:8188
- C:\Windows\System\XplAyQA.exe
  C:\Windows\System\XplAyQA.exe
  2⤵
  PID:8128
- C:\Windows\System\kswJEDB.exe
  C:\Windows\System\kswJEDB.exe
  2⤵
  PID:7180
- C:\Windows\System\tYXjNIX.exe
  C:\Windows\System\tYXjNIX.exe
  2⤵
  PID:8076
- C:\Windows\System\XHnScoZ.exe
  C:\Windows\System\XHnScoZ.exe
  2⤵
  PID:8172
- C:\Windows\System\dmLpcBF.exe
  C:\Windows\System\dmLpcBF.exe
  2⤵
  PID:7252
- C:\Windows\System\ToQUNYL.exe
  C:\Windows\System\ToQUNYL.exe
  2⤵
  PID:7372
- C:\Windows\System\NgvEdtV.exe
  C:\Windows\System\NgvEdtV.exe
  2⤵
  PID:8112
- C:\Windows\System\ztkeXZD.exe
  C:\Windows\System\ztkeXZD.exe
  2⤵
  PID:6672
- C:\Windows\System\YnmKTTB.exe
  C:\Windows\System\YnmKTTB.exe
  2⤵
  PID:6520
- C:\Windows\System\yJHQrEz.exe
  C:\Windows\System\yJHQrEz.exe
  2⤵
  PID:7420
- C:\Windows\System\tMpftfo.exe
  C:\Windows\System\tMpftfo.exe
  2⤵
  PID:7484
- C:\Windows\System\wUWVwjB.exe
  C:\Windows\System\wUWVwjB.exe
  2⤵
  PID:7580
- C:\Windows\System\eNyGRyF.exe
  C:\Windows\System\eNyGRyF.exe
  2⤵
  PID:7720
- C:\Windows\System\tvHJglO.exe
  C:\Windows\System\tvHJglO.exe
  2⤵
  PID:7604
- C:\Windows\System\pSQVmyY.exe
  C:\Windows\System\pSQVmyY.exe
  2⤵
  PID:7636
- C:\Windows\System\RwVyvUe.exe
  C:\Windows\System\RwVyvUe.exe
  2⤵
  PID:7832
- C:\Windows\System\OGcqAOp.exe
  C:\Windows\System\OGcqAOp.exe
  2⤵
  PID:8028
- C:\Windows\System\rPxpjpg.exe
  C:\Windows\System\rPxpjpg.exe
  2⤵
  PID:7836
- C:\Windows\System\GPuRuVP.exe
  C:\Windows\System\GPuRuVP.exe
  2⤵
  PID:7864
- C:\Windows\System\bjRxrOs.exe
  C:\Windows\System\bjRxrOs.exe
  2⤵
  PID:8156
- C:\Windows\System\xgylWdY.exe
  C:\Windows\System\xgylWdY.exe
  2⤵
  PID:7292
- C:\Windows\System\MhQlxRY.exe
  C:\Windows\System\MhQlxRY.exe
  2⤵
  PID:7388
- C:\Windows\System\VpNXrol.exe
  C:\Windows\System\VpNXrol.exe
  2⤵
  PID:8140
- C:\Windows\System\BrDGUcX.exe
  C:\Windows\System\BrDGUcX.exe
  2⤵
  PID:6316
- C:\Windows\System\TwtOllF.exe
  C:\Windows\System\TwtOllF.exe
  2⤵
  PID:7368
- C:\Windows\System\aHPnlhD.exe
  C:\Windows\System\aHPnlhD.exe
  2⤵
  PID:7336
- C:\Windows\System\KQpldYL.exe
  C:\Windows\System\KQpldYL.exe
  2⤵
  PID:7788
- C:\Windows\System\nIDTZha.exe
  C:\Windows\System\nIDTZha.exe
  2⤵
  PID:7768
- C:\Windows\System\CibNMIP.exe
  C:\Windows\System\CibNMIP.exe
  2⤵
  PID:7968
- C:\Windows\System\OOaRIqJ.exe
  C:\Windows\System\OOaRIqJ.exe
  2⤵
  PID:6976
- C:\Windows\System\vJZVXod.exe
  C:\Windows\System\vJZVXod.exe
  2⤵
  PID:7584
- C:\Windows\System\BbgYEEk.exe
  C:\Windows\System\BbgYEEk.exe
  2⤵
  PID:7548
- C:\Windows\System\tifLSnD.exe
  C:\Windows\System\tifLSnD.exe
  2⤵
  PID:7512
- C:\Windows\System\MBckbxh.exe
  C:\Windows\System\MBckbxh.exe
  2⤵
  PID:8196
- C:\Windows\System\xKRHfnZ.exe
  C:\Windows\System\xKRHfnZ.exe
  2⤵
  PID:8212
- C:\Windows\System\kwRGirJ.exe
  C:\Windows\System\kwRGirJ.exe
  2⤵
  PID:8228
- C:\Windows\System\DMuNafT.exe
  C:\Windows\System\DMuNafT.exe
  2⤵
  PID:8248
- C:\Windows\System\VczwyxO.exe
  C:\Windows\System\VczwyxO.exe
  2⤵
  PID:8272
- C:\Windows\System\RYeHIfy.exe
  C:\Windows\System\RYeHIfy.exe
  2⤵
  PID:8288
- C:\Windows\System\XqqiZxG.exe
  C:\Windows\System\XqqiZxG.exe
  2⤵
  PID:8304
- C:\Windows\System\qOwWKaX.exe
  C:\Windows\System\qOwWKaX.exe
  2⤵
  PID:8320
- C:\Windows\System\WgGnOcX.exe
  C:\Windows\System\WgGnOcX.exe
  2⤵
  PID:8336
- C:\Windows\System\pmhWSTJ.exe
  C:\Windows\System\pmhWSTJ.exe
  2⤵
  PID:8352
- C:\Windows\System\AaatKUy.exe
  C:\Windows\System\AaatKUy.exe
  2⤵
  PID:8368
- C:\Windows\System\gvnqUED.exe
  C:\Windows\System\gvnqUED.exe
  2⤵
  PID:8384
- C:\Windows\System\AMrZiKm.exe
  C:\Windows\System\AMrZiKm.exe
  2⤵
  PID:8400
- C:\Windows\System\NEwxGBY.exe
  C:\Windows\System\NEwxGBY.exe
  2⤵
  PID:8416
- C:\Windows\System\UGFnYUv.exe
  C:\Windows\System\UGFnYUv.exe
  2⤵
  PID:8432
- C:\Windows\System\nPcxCNZ.exe
  C:\Windows\System\nPcxCNZ.exe
  2⤵
  PID:8448
- C:\Windows\System\KAFfXIP.exe
  C:\Windows\System\KAFfXIP.exe
  2⤵
  PID:8464
- C:\Windows\System\SqONiio.exe
  C:\Windows\System\SqONiio.exe
  2⤵
  PID:8480
- C:\Windows\System\yeJSdUr.exe
  C:\Windows\System\yeJSdUr.exe
  2⤵
  PID:8496
- C:\Windows\System\IzYswNU.exe
  C:\Windows\System\IzYswNU.exe
  2⤵
  PID:8512
- C:\Windows\System\ZFwQjvh.exe
  C:\Windows\System\ZFwQjvh.exe
  2⤵
  PID:8528
- C:\Windows\System\lzkyEwv.exe
  C:\Windows\System\lzkyEwv.exe
  2⤵
  PID:8544
- C:\Windows\System\kNnmkyF.exe
  C:\Windows\System\kNnmkyF.exe
  2⤵
  PID:8560
- C:\Windows\System\ZKGQXkm.exe
  C:\Windows\System\ZKGQXkm.exe
  2⤵
  PID:8576
- C:\Windows\System\ldXEzyR.exe
  C:\Windows\System\ldXEzyR.exe
  2⤵
  PID:8592
- C:\Windows\System\LxATclX.exe
  C:\Windows\System\LxATclX.exe
  2⤵
  PID:8608
- C:\Windows\System\SbXdsgL.exe
  C:\Windows\System\SbXdsgL.exe
  2⤵
  PID:8624
- C:\Windows\System\ZXeMOpm.exe
  C:\Windows\System\ZXeMOpm.exe
  2⤵
  PID:8640
- C:\Windows\System\gofaLhT.exe
  C:\Windows\System\gofaLhT.exe
  2⤵
  PID:8656
- C:\Windows\System\OtsUvPM.exe
  C:\Windows\System\OtsUvPM.exe
  2⤵
  PID:8672
- C:\Windows\System\bKlzCGL.exe
  C:\Windows\System\bKlzCGL.exe
  2⤵
  PID:8688
- C:\Windows\System\keHwobj.exe
  C:\Windows\System\keHwobj.exe
  2⤵
  PID:8704
- C:\Windows\System\FNKzCUe.exe
  C:\Windows\System\FNKzCUe.exe
  2⤵
  PID:8720
- C:\Windows\System\GnsIlCu.exe
  C:\Windows\System\GnsIlCu.exe
  2⤵
  PID:8736
- C:\Windows\System\emFYlht.exe
  C:\Windows\System\emFYlht.exe
  2⤵
  PID:8752
- C:\Windows\System\aTYxmQg.exe
  C:\Windows\System\aTYxmQg.exe
  2⤵
  PID:8768
- C:\Windows\System\IizeFzw.exe
  C:\Windows\System\IizeFzw.exe
  2⤵
  PID:8792
- C:\Windows\System\CwTWses.exe
  C:\Windows\System\CwTWses.exe
  2⤵
  PID:8808
- C:\Windows\System\nxmFdWA.exe
  C:\Windows\System\nxmFdWA.exe
  2⤵
  PID:8824
- C:\Windows\System\fOLGVZe.exe
  C:\Windows\System\fOLGVZe.exe
  2⤵
  PID:8840
- C:\Windows\System\BtxNNhY.exe
  C:\Windows\System\BtxNNhY.exe
  2⤵
  PID:8856
- C:\Windows\System\HPtpptR.exe
  C:\Windows\System\HPtpptR.exe
  2⤵
  PID:8872
- C:\Windows\System\nXenjxH.exe
  C:\Windows\System\nXenjxH.exe
  2⤵
  PID:8888
- C:\Windows\System\WddBYgS.exe
  C:\Windows\System\WddBYgS.exe
  2⤵
  PID:8904
- C:\Windows\System\zisisqR.exe
  C:\Windows\System\zisisqR.exe
  2⤵
  PID:8920
- C:\Windows\System\WKDVLnf.exe
  C:\Windows\System\WKDVLnf.exe
  2⤵
  PID:8936
- C:\Windows\System\KmscAVA.exe
  C:\Windows\System\KmscAVA.exe
  2⤵
  PID:8952
- C:\Windows\System\GYQgTcF.exe
  C:\Windows\System\GYQgTcF.exe
  2⤵
  PID:8968
- C:\Windows\System\HTHfNOt.exe
  C:\Windows\System\HTHfNOt.exe
  2⤵
  PID:8984
- C:\Windows\System\slytowd.exe
  C:\Windows\System\slytowd.exe
  2⤵
  PID:9000
- C:\Windows\System\ZzShDTE.exe
  C:\Windows\System\ZzShDTE.exe
  2⤵
  PID:9016
- C:\Windows\System\qhVlNad.exe
  C:\Windows\System\qhVlNad.exe
  2⤵
  PID:9032
- C:\Windows\System\QNcQFAr.exe
  C:\Windows\System\QNcQFAr.exe
  2⤵
  PID:9048
- C:\Windows\System\QjzyMYo.exe
  C:\Windows\System\QjzyMYo.exe
  2⤵
  PID:9064
- C:\Windows\System\rqzHsHr.exe
  C:\Windows\System\rqzHsHr.exe
  2⤵
  PID:9080
- C:\Windows\System\JDyOvpz.exe
  C:\Windows\System\JDyOvpz.exe
  2⤵
  PID:9096
- C:\Windows\System\SghKuNl.exe
  C:\Windows\System\SghKuNl.exe
  2⤵
  PID:9112
- C:\Windows\System\DHIDHpw.exe
  C:\Windows\System\DHIDHpw.exe
  2⤵
  PID:9128
- C:\Windows\System\ddsEvUa.exe
  C:\Windows\System\ddsEvUa.exe
  2⤵
  PID:9144
- C:\Windows\System\VNbaDfF.exe
  C:\Windows\System\VNbaDfF.exe
  2⤵
  PID:9160
- C:\Windows\System\jFGejtN.exe
  C:\Windows\System\jFGejtN.exe
  2⤵
  PID:9176
- C:\Windows\System\XLsLPmk.exe
  C:\Windows\System\XLsLPmk.exe
  2⤵
  PID:9192
- C:\Windows\System\Iauzsrr.exe
  C:\Windows\System\Iauzsrr.exe
  2⤵
  PID:9208
- C:\Windows\System\kcSkqfW.exe
  C:\Windows\System\kcSkqfW.exe
  2⤵
  PID:7220
- C:\Windows\System\xRtyaVd.exe
  C:\Windows\System\xRtyaVd.exe
  2⤵
  PID:8092
- C:\Windows\System\nOyIxZk.exe
  C:\Windows\System\nOyIxZk.exe
  2⤵
  PID:8220
- C:\Windows\System\FYwVeCT.exe
  C:\Windows\System\FYwVeCT.exe
  2⤵
  PID:7848
- C:\Windows\System\eLcrzkk.exe
  C:\Windows\System\eLcrzkk.exe
  2⤵
  PID:8312
- C:\Windows\System\jnuKZNM.exe
  C:\Windows\System\jnuKZNM.exe
  2⤵
  PID:8584
- C:\Windows\System\DUJwAcl.exe
  C:\Windows\System\DUJwAcl.exe
  2⤵
  PID:8616
- C:\Windows\System\YmsZpgE.exe
  C:\Windows\System\YmsZpgE.exe
  2⤵
  PID:8648
- C:\Windows\System\ozjAoDw.exe
  C:\Windows\System\ozjAoDw.exe
  2⤵
  PID:8684
- C:\Windows\System\PphloWu.exe
  C:\Windows\System\PphloWu.exe
  2⤵
  PID:8760
- C:\Windows\System\qqfnGoQ.exe
  C:\Windows\System\qqfnGoQ.exe
  2⤵
  PID:8748
- C:\Windows\System\EMKPvuA.exe
  C:\Windows\System\EMKPvuA.exe
  2⤵
  PID:8800
- C:\Windows\System\sutoVWo.exe
  C:\Windows\System\sutoVWo.exe
  2⤵
  PID:8864
- C:\Windows\System\dRqEaGU.exe
  C:\Windows\System\dRqEaGU.exe
  2⤵
  PID:8880
- C:\Windows\System\ppEXWgt.exe
  C:\Windows\System\ppEXWgt.exe
  2⤵
  PID:8900
- C:\Windows\System\wKdpNwI.exe
  C:\Windows\System\wKdpNwI.exe
  2⤵
  PID:8964
- C:\Windows\System\FCcfWNG.exe
  C:\Windows\System\FCcfWNG.exe
  2⤵
  PID:8976
- C:\Windows\System\CLecOJM.exe
  C:\Windows\System\CLecOJM.exe
  2⤵
  PID:9008
- C:\Windows\System\NQuqCmK.exe
  C:\Windows\System\NQuqCmK.exe
  2⤵
  PID:9056
- C:\Windows\System\KrUGkmV.exe
  C:\Windows\System\KrUGkmV.exe
  2⤵
  PID:9092
- C:\Windows\System\HtPxaEX.exe
  C:\Windows\System\HtPxaEX.exe
  2⤵
  PID:9044
- C:\Windows\System\KkEUubp.exe
  C:\Windows\System\KkEUubp.exe
  2⤵
  PID:9136
- C:\Windows\System\cUxryUl.exe
  C:\Windows\System\cUxryUl.exe
  2⤵
  PID:8280
- C:\Windows\System\vcsBmLu.exe
  C:\Windows\System\vcsBmLu.exe
  2⤵
  PID:8208
- C:\Windows\System\izdnhbL.exe
  C:\Windows\System\izdnhbL.exe
  2⤵
  PID:8700
- C:\Windows\System\IsNpfYD.exe
  C:\Windows\System\IsNpfYD.exe
  2⤵
  PID:8804
- C:\Windows\System\TSlVjYP.exe
  C:\Windows\System\TSlVjYP.exe
  2⤵
  PID:8392
- C:\Windows\System\IIKugTe.exe
  C:\Windows\System\IIKugTe.exe
  2⤵
  PID:8412
- C:\Windows\System\AUgxvwc.exe
  C:\Windows\System\AUgxvwc.exe
  2⤵
  PID:8472
- C:\Windows\System\rxdxqXa.exe
  C:\Windows\System\rxdxqXa.exe
  2⤵
  PID:8492
- C:\Windows\System\QbjoKyt.exe
  C:\Windows\System\QbjoKyt.exe
  2⤵
  PID:8568
- C:\Windows\System\BilYWFA.exe
  C:\Windows\System\BilYWFA.exe
  2⤵
  PID:8620
- C:\Windows\System\gvCmaXk.exe
  C:\Windows\System\gvCmaXk.exe
  2⤵
  PID:8896
- C:\Windows\System\eVBZnom.exe
  C:\Windows\System\eVBZnom.exe
  2⤵
  PID:8488
- C:\Windows\System\RKdWZhG.exe
  C:\Windows\System\RKdWZhG.exe
  2⤵
  PID:7996
- C:\Windows\System\KmlYByw.exe
  C:\Windows\System\KmlYByw.exe
  2⤵
  PID:8932
- C:\Windows\System\DXTBiqq.exe
  C:\Windows\System\DXTBiqq.exe
  2⤵
  PID:9040
- C:\Windows\System\DJyICsT.exe
  C:\Windows\System\DJyICsT.exe
  2⤵
  PID:9028
- C:\Windows\System\QYguNHk.exe
  C:\Windows\System\QYguNHk.exe
  2⤵
  PID:9156
- C:\Windows\System\FlzMvqy.exe
  C:\Windows\System\FlzMvqy.exe
  2⤵
  PID:9188
- C:\Windows\System\JuQXUIS.exe
  C:\Windows\System\JuQXUIS.exe
  2⤵
  PID:8912
- C:\Windows\System\sLxtSJV.exe
  C:\Windows\System\sLxtSJV.exe
  2⤵
  PID:7708
- C:\Windows\System\DNAEpZz.exe
  C:\Windows\System\DNAEpZz.exe
  2⤵
  PID:7852
- C:\Windows\System\OUQtBkh.exe
  C:\Windows\System\OUQtBkh.exe
  2⤵
  PID:7136
- C:\Windows\System\DjGGGOn.exe
  C:\Windows\System\DjGGGOn.exe
  2⤵
  PID:7568
- C:\Windows\System\zxdscZe.exe
  C:\Windows\System\zxdscZe.exe
  2⤵
  PID:8296
- C:\Windows\System\wYfBDgW.exe
  C:\Windows\System\wYfBDgW.exe
  2⤵
  PID:8680
- C:\Windows\System\JhekhUL.exe
  C:\Windows\System\JhekhUL.exe
  2⤵
  PID:8744
- C:\Windows\System\urXOFYf.exe
  C:\Windows\System\urXOFYf.exe
  2⤵
  PID:8444
- C:\Windows\System\oJjLeki.exe
  C:\Windows\System\oJjLeki.exe
  2⤵
  PID:8508
- C:\Windows\System\pgGrTBY.exe
  C:\Windows\System\pgGrTBY.exe
  2⤵
  PID:8600
- C:\Windows\System\OpxLFrz.exe
  C:\Windows\System\OpxLFrz.exe
  2⤵
  PID:8944
- C:\Windows\System\IsiQCvN.exe
  C:\Windows\System\IsiQCvN.exe
  2⤵
  PID:8960
- C:\Windows\System\fscImsz.exe
  C:\Windows\System\fscImsz.exe
  2⤵
  PID:8460
- C:\Windows\System\TmzTawq.exe
  C:\Windows\System\TmzTawq.exe
  2⤵
  PID:8476
- C:\Windows\System\jpsmwRF.exe
  C:\Windows\System\jpsmwRF.exe
  2⤵
  PID:6032
- C:\Windows\System\tSbrRrj.exe
  C:\Windows\System\tSbrRrj.exe
  2⤵
  PID:8300
- C:\Windows\System\cIQwGql.exe
  C:\Windows\System\cIQwGql.exe
  2⤵
  PID:8456
- C:\Windows\System\WJzXHfv.exe
  C:\Windows\System\WJzXHfv.exe
  2⤵
  PID:8536
- C:\Windows\System\gdycNgM.exe
  C:\Windows\System\gdycNgM.exe
  2⤵
  PID:9184
- C:\Windows\System\tBRCNeD.exe
  C:\Windows\System\tBRCNeD.exe
  2⤵
  PID:8632
- C:\Windows\System\eoHQWzW.exe
  C:\Windows\System\eoHQWzW.exe
  2⤵
  PID:9168
- C:\Windows\System\HmzAljT.exe
  C:\Windows\System\HmzAljT.exe
  2⤵
  PID:8268
- C:\Windows\System\GEhHgNX.exe
  C:\Windows\System\GEhHgNX.exe
  2⤵
  PID:8520
- C:\Windows\System\BBwqrEY.exe
  C:\Windows\System\BBwqrEY.exe
  2⤵
  PID:8716
- C:\Windows\System\TAnTJRl.exe
  C:\Windows\System\TAnTJRl.exe
  2⤵
  PID:8408
- C:\Windows\System\oRmDjSJ.exe
  C:\Windows\System\oRmDjSJ.exe
  2⤵
  PID:9140
- C:\Windows\System\fRMUZYc.exe
  C:\Windows\System\fRMUZYc.exe
  2⤵
  PID:8816
- C:\Windows\System\SkwAjQI.exe
  C:\Windows\System\SkwAjQI.exe
  2⤵
  PID:8552
- C:\Windows\System\DZwBATw.exe
  C:\Windows\System\DZwBATw.exe
  2⤵
  PID:1576
- C:\Windows\System\BmlEKxR.exe
  C:\Windows\System\BmlEKxR.exe
  2⤵
  PID:9224
- C:\Windows\System\AaFZWdu.exe
  C:\Windows\System\AaFZWdu.exe
  2⤵
  PID:9240
- C:\Windows\System\JNmgwJi.exe
  C:\Windows\System\JNmgwJi.exe
  2⤵
  PID:9256
- C:\Windows\System\MgFXcIp.exe
  C:\Windows\System\MgFXcIp.exe
  2⤵
  PID:9272
- C:\Windows\System\SvTRGTp.exe
  C:\Windows\System\SvTRGTp.exe
  2⤵
  PID:9288
- C:\Windows\System\PdCgCJG.exe
  C:\Windows\System\PdCgCJG.exe
  2⤵
  PID:9308
- C:\Windows\System\xvBJYko.exe
  C:\Windows\System\xvBJYko.exe
  2⤵
  PID:9324
- C:\Windows\System\ZaZFywM.exe
  C:\Windows\System\ZaZFywM.exe
  2⤵
  PID:9340
- C:\Windows\System\JAFQlsB.exe
  C:\Windows\System\JAFQlsB.exe
  2⤵
  PID:9356
- C:\Windows\System\vSajXay.exe
  C:\Windows\System\vSajXay.exe
  2⤵
  PID:9372
- C:\Windows\System\ZwjSweN.exe
  C:\Windows\System\ZwjSweN.exe
  2⤵
  PID:9388
- C:\Windows\System\HggogPV.exe
  C:\Windows\System\HggogPV.exe
  2⤵
  PID:9404
- C:\Windows\System\zLVYPEP.exe
  C:\Windows\System\zLVYPEP.exe
  2⤵
  PID:9420
- C:\Windows\System\mGXiGBW.exe
  C:\Windows\System\mGXiGBW.exe
  2⤵
  PID:9436
- C:\Windows\System\XaVySjV.exe
  C:\Windows\System\XaVySjV.exe
  2⤵
  PID:9452
- C:\Windows\System\OLIQZwK.exe
  C:\Windows\System\OLIQZwK.exe
  2⤵
  PID:9468
- C:\Windows\System\reMcSAn.exe
  C:\Windows\System\reMcSAn.exe
  2⤵
  PID:9484
- C:\Windows\System\djMsBpI.exe
  C:\Windows\System\djMsBpI.exe
  2⤵
  PID:9504
- C:\Windows\System\CEgzXdG.exe
  C:\Windows\System\CEgzXdG.exe
  2⤵
  PID:9520
- C:\Windows\System\cAlomme.exe
  C:\Windows\System\cAlomme.exe
  2⤵
  PID:9540
- C:\Windows\System\xuajfiI.exe
  C:\Windows\System\xuajfiI.exe
  2⤵
  PID:9556
- C:\Windows\System\jmMmSfR.exe
  C:\Windows\System\jmMmSfR.exe
  2⤵
  PID:9576
- C:\Windows\System\pAYlyHJ.exe
  C:\Windows\System\pAYlyHJ.exe
  2⤵
  PID:9592
- C:\Windows\System\RmMOpYa.exe
  C:\Windows\System\RmMOpYa.exe
  2⤵
  PID:9608
- C:\Windows\System\mUITgNW.exe
  C:\Windows\System\mUITgNW.exe
  2⤵
  PID:9628
- C:\Windows\System\ujJDbmr.exe
  C:\Windows\System\ujJDbmr.exe
  2⤵
  PID:9644
- C:\Windows\System\CRQEWmS.exe
  C:\Windows\System\CRQEWmS.exe
  2⤵
  PID:9660
- C:\Windows\System\AyiiThK.exe
  C:\Windows\System\AyiiThK.exe
  2⤵
  PID:9676
- C:\Windows\System\HapyCfr.exe
  C:\Windows\System\HapyCfr.exe
  2⤵
  PID:9692
- C:\Windows\System\SBKAHyj.exe
  C:\Windows\System\SBKAHyj.exe
  2⤵
  PID:9708
- C:\Windows\System\ZVwradB.exe
  C:\Windows\System\ZVwradB.exe
  2⤵
  PID:9724
- C:\Windows\System\cnBYvLX.exe
  C:\Windows\System\cnBYvLX.exe
  2⤵
  PID:9740
- C:\Windows\System\mdveVcf.exe
  C:\Windows\System\mdveVcf.exe
  2⤵
  PID:9756
- C:\Windows\System\DBQpiEJ.exe
  C:\Windows\System\DBQpiEJ.exe
  2⤵
  PID:9772
- C:\Windows\System\RVxiPmL.exe
  C:\Windows\System\RVxiPmL.exe
  2⤵
  PID:9788
- C:\Windows\System\svCEaRt.exe
  C:\Windows\System\svCEaRt.exe
  2⤵
  PID:9804
- C:\Windows\System\DkqZCLT.exe
  C:\Windows\System\DkqZCLT.exe
  2⤵
  PID:9820
- C:\Windows\System\CnINxaD.exe
  C:\Windows\System\CnINxaD.exe
  2⤵
  PID:9836
- C:\Windows\System\IfRTHsD.exe
  C:\Windows\System\IfRTHsD.exe
  2⤵
  PID:9852
- C:\Windows\System\CghXhak.exe
  C:\Windows\System\CghXhak.exe
  2⤵
  PID:9868
- C:\Windows\System\PwREBaM.exe
  C:\Windows\System\PwREBaM.exe
  2⤵
  PID:9884
- C:\Windows\System\SXUyjSh.exe
  C:\Windows\System\SXUyjSh.exe
  2⤵
  PID:9900
- C:\Windows\System\UpOClGD.exe
  C:\Windows\System\UpOClGD.exe
  2⤵
  PID:9916
- C:\Windows\System\xhZmVRv.exe
  C:\Windows\System\xhZmVRv.exe
  2⤵
  PID:9932
- C:\Windows\System\cKZRKll.exe
  C:\Windows\System\cKZRKll.exe
  2⤵
  PID:9948
- C:\Windows\System\hWSdKMW.exe
  C:\Windows\System\hWSdKMW.exe
  2⤵
  PID:9964
- C:\Windows\System\mOwyesB.exe
  C:\Windows\System\mOwyesB.exe
  2⤵
  PID:9980
- C:\Windows\System\oTgdgLd.exe
  C:\Windows\System\oTgdgLd.exe
  2⤵
  PID:9996
- C:\Windows\System\WMoTkIk.exe
  C:\Windows\System\WMoTkIk.exe
  2⤵
  PID:10012
- C:\Windows\System\twoyaQg.exe
  C:\Windows\System\twoyaQg.exe
  2⤵
  PID:10028
- C:\Windows\System\kxoKwzN.exe
  C:\Windows\System\kxoKwzN.exe
  2⤵
  PID:10044
- C:\Windows\System\GdNVUyW.exe
  C:\Windows\System\GdNVUyW.exe
  2⤵
  PID:10060
- C:\Windows\System\MoSwnwf.exe
  C:\Windows\System\MoSwnwf.exe
  2⤵
  PID:10076
- C:\Windows\System\DXKnVcX.exe
  C:\Windows\System\DXKnVcX.exe
  2⤵
  PID:10092
- C:\Windows\System\CMUZxZM.exe
  C:\Windows\System\CMUZxZM.exe
  2⤵
  PID:10108
- C:\Windows\System\rjLzGid.exe
  C:\Windows\System\rjLzGid.exe
  2⤵
  PID:10124
- C:\Windows\System\wcJhqgN.exe
  C:\Windows\System\wcJhqgN.exe
  2⤵
  PID:10140
- C:\Windows\System\SubVBZk.exe
  C:\Windows\System\SubVBZk.exe
  2⤵
  PID:10156
- C:\Windows\System\JXOdJcT.exe
  C:\Windows\System\JXOdJcT.exe
  2⤵
  PID:10172
- C:\Windows\System\dEngqKk.exe
  C:\Windows\System\dEngqKk.exe
  2⤵
  PID:10188
- C:\Windows\System\jMiXPhr.exe
  C:\Windows\System\jMiXPhr.exe
  2⤵
  PID:10204
- C:\Windows\System\eNupGfB.exe
  C:\Windows\System\eNupGfB.exe
  2⤵
  PID:10220
- C:\Windows\System\WneHadc.exe
  C:\Windows\System\WneHadc.exe
  2⤵
  PID:10236
- C:\Windows\System\OjLWcjd.exe
  C:\Windows\System\OjLWcjd.exe
  2⤵
  PID:9220
- C:\Windows\System\UXPLUCs.exe
  C:\Windows\System\UXPLUCs.exe
  2⤵
  PID:9252
- C:\Windows\System\KvGPwoL.exe
  C:\Windows\System\KvGPwoL.exe
  2⤵
  PID:9284
- C:\Windows\System\tehBgyG.exe
  C:\Windows\System\tehBgyG.exe
  2⤵
  PID:9304
- C:\Windows\System\KlkAPDb.exe
  C:\Windows\System\KlkAPDb.exe
  2⤵
  PID:9364
- C:\Windows\System\RQYEEds.exe
  C:\Windows\System\RQYEEds.exe
  2⤵
  PID:9348
- C:\Windows\System\IndQLIk.exe
  C:\Windows\System\IndQLIk.exe
  2⤵
  PID:9480
- C:\Windows\System\rCidPOw.exe
  C:\Windows\System\rCidPOw.exe
  2⤵
  PID:9516
- C:\Windows\System\vPvyUsB.exe
  C:\Windows\System\vPvyUsB.exe
  2⤵
  PID:9588
- C:\Windows\System\ydDATPF.exe
  C:\Windows\System\ydDATPF.exe
  2⤵
  PID:9624
- C:\Windows\System\gneLJbm.exe
  C:\Windows\System\gneLJbm.exe
  2⤵
  PID:9688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BHrMdpZ.exe

Filesize
1.9MB

MD5
094f261cfe18cf2ff7cd44a8e0070238

SHA1
8c4300630b6f75091b5517200fe2eb0be8b6452f

SHA256
2c507bfa0c91bd64f3ebc30fb7e78417d89d091d99ee06ba3c09460c99d2cffe

SHA512
3358d44aad2be4179759dd5f5b4fdba1b901740fd29677f4e87a5f935fc21de2a3118e6468f0b5e2dabef3fa26adc7a7df1744781937a1613158f966d30604ec

Download Submit
C:\Windows\system\BIbMWFA.exe

Filesize
1.9MB

MD5
26716048f95227cb3d8ae92de40da9fb

SHA1
69dbe800aacef2c476ddcca8848e110e00bcd035

SHA256
1a9962fd39b8218a05dc69f375450bb1d5e1c28abd217617732f23f7762b8d2c

SHA512
9c835508699722b8f0a6ac2f0e95fe5c3086afaae7746d82a66180dc1f94219f5d605391654555542edbd4478cb7203e4eb277805a6e916d3d296d98c3944df5

Download Submit
C:\Windows\system\CULQAyZ.exe

Filesize
1.9MB

MD5
70ced0564f3f307ddf2a6a58b25ba7dd

SHA1
5a06bf24909686607f5263390106d1c4e4ec60a9

SHA256
905969907f82a49072ed8458379bbe183aa5c5a12e7e1a2c97ec256a0baf0ed6

SHA512
d2cefc6f9f4979df4de752d445533a4255fe9c6493f8cc4bf7093b2bbda2a4ae6f6544fae9db957437977381e68cf6803c07c76ba12701631120ee70f7b75b44

Download Submit
C:\Windows\system\CVQLrJv.exe

Filesize
1.9MB

MD5
75e7a3a294927d6fced00f06c376e9ea

SHA1
df3fdcd178530f3e1b092dceceaba8a4adf0de5a

SHA256
933f5fd6df62f572997c2240949dda538738f22155f4b11e9c0e99f26fa6c040

SHA512
436286fb5cf819dfa6b43bd74eb506977fa1a6e796063e89deb8cf0a4244dff9dc903a2586b9b6f4b9e5922da237ff78dee5861dc3ce43022d495658bb82ea7e

Download Submit
C:\Windows\system\DQCSaIf.exe

Filesize
1.9MB

MD5
d5030061a74562ef249ef3cb34229034

SHA1
801f1fbce07717a671b2bfa76b264817bab94626

SHA256
9ce681c8c5187dfa252f0a55e478e3f0a1b7ccf80007ef9b83c5450a6227e41e

SHA512
3c9959158b29ce7a2bfc3c9b7fa6cd43d1379e68966175f037702e79f07db41fd05208adbaba58b86de9f3dd9b61b82b6a67b69b0d85e2b7aea7d4cf0e6d9646

Download Submit
C:\Windows\system\FWveMJz.exe

Filesize
1.9MB

MD5
82a058fd6f4c6ef8fc66c1f15545c4e7

SHA1
e6e14cd965ac349a96faa603505e2305f1a81d7c

SHA256
c156d8fe83f642e4c30b42661d8d4d090ee29561038e974ded89839a64c76b2b

SHA512
9dcdf9fb8bcff2a0d184b2bbfb84513c1550f4c57d726a85c1ca5b7bb15a5dd4927060bfd9ce038b116bb8a16153bc045d63c977046b04fab9b36ab4b2f83cf2

Download Submit
C:\Windows\system\FqsLuYk.exe

Filesize
1.9MB

MD5
1e96dc355b66d70f87a809519b7e345c

SHA1
b175b95c8d142984177364731294a09955c6451f

SHA256
30fd9c41f29e6b4ad31fdeefbb1f8f39a33d643707de51c8eb36c353dc3e0a08

SHA512
2912cab50c562970aee902b4873b0d92c9a53bd42f02bd067fe378b23160db1db21854274175d512f40b154392dd4a2cf534905d798cbce732f34a0b22a7e2f5

Download Submit
C:\Windows\system\KvAzFkm.exe

Filesize
1.9MB

MD5
36d05df89608acaac1f7856005758604

SHA1
299a529efcbe6d465558c00df29628f1b82fc4bb

SHA256
81886cbcd08bc55e13178cc496116d171a15e005807f0b96baef9a01f67129d3

SHA512
47494c159fba1df7563addad6067f428ffce3499a96e4dbe7197cd55c9a329f64a12d5d6aba1edb4ce64eb7a53bce61264603f2ad88b5a96fc725d0bf82a1901

Download Submit
C:\Windows\system\MzukBjg.exe

Filesize
1.9MB

MD5
511a09226f92f2de8679c2b80057575e

SHA1
213f9d1f494ef985683a216028356465641d71cf

SHA256
59c4ec6e1dbfbeab54dcad17a464ff78606c239e0d5eb849ad7f3b6a8118963f

SHA512
5ad2e653715ea8c6062a2a1cb4d255877ff3527ec1518d4c1983099dff279ff885afeda51e7d4406e88af29dfa13c61a8d2c28a7bb3e14dbad3045be6c6d5dc0

Download Submit
C:\Windows\system\QeMnadW.exe

Filesize
1.9MB

MD5
b352549857beb0e46d78bbb1bddaabd9

SHA1
d8ed7b6a764692b2bd645088aebaa86b4d4f084a

SHA256
6933226adb13f6cdeee51763985c4f9c5b1b945131daac3b510fb6e3ffed5e7b

SHA512
0dc0342d83a133f819c8d798672d140caf72ecfcf4f6ecfb316cdfd79a47cc33c73323dce6df501bdaa1acd848afccdfaf141fbee60b65aab662559ba57df36b

Download Submit
C:\Windows\system\RDjXjLt.exe

Filesize
1.9MB

MD5
56c6a2c89b279b3eb90913255b080b1c

SHA1
bfee65f3e83ad2daf0b416c22023ba7f336b789d

SHA256
992b3d574bce5c75b17171813f67488910acffef8f6d25b1d9b5d0d92378d2c1

SHA512
7facab3a3a83ee9ee833143d508e82e09eab6112731c65dcf2e741b63f800eaf669a5bae59d27a033a918be9aa9f6d430a0beebb8db473a49eb548c289f8d7f7

Download Submit
C:\Windows\system\TyVwzhd.exe

Filesize
1.9MB

MD5
be5cf17d742390c87faaf451cc332ea9

SHA1
c55d63c43a54e9566287155861aabd8a65de4d6e

SHA256
3c197e396a719d0a2d42e4d091f5db6b3ed69c6004a62fdd1d45d7932b58b0c2

SHA512
98025119f748eeb83f1bebcb395f6ffb63d20a1791184a9874ededc8040cbe8bef166ed53cadd252ca7030efabe93f2f22fa68a731115f332dc48f1c2390351c

Download Submit
C:\Windows\system\XxXDpoA.exe

Filesize
1.9MB

MD5
a88afc07b295f379efeec63a7562c44a

SHA1
46b0c5f89d5bdab2b6375e5e44db9f8022cb38cd

SHA256
296e09121bf20c2d1738f6b0b7990663c4924adc0664549995c312a54d723048

SHA512
95fda670df71f00bf02c99a78b736b74db8c1eaed2e37c7fb3a9bdbc4b1db5fec3b64b274a0d0b9d7e193798167285aea23e21f7b0284587cea0f14ca6accf19

Download Submit
C:\Windows\system\bqvxuaW.exe

Filesize
1.9MB

MD5
8f045d97c83bb67066e3f18d8ea30bdc

SHA1
bbc7b45715a5ddbfb142e29337541e35c8eb4a8a

SHA256
78620375092b29b40fc85cc10c48d9ede342642fd23b26f43619d9518b9fd279

SHA512
9dc422fae089feebbc7643bb7d731bdc1441d67254815cd1b483272da756fd459b030c3cb2b4048b5d15ef0e71400b0c0faaffa6fe079dea424d9fa3103dc911

Download Submit
C:\Windows\system\dgTfXqV.exe

Filesize
1.9MB

MD5
2d4ad61fc33e33e943e61679a29363d1

SHA1
15b95a10f9ea23feb3e9763ea7e47f7ba15d4caa

SHA256
02274c89077ae9c73c762796bf59e6dcac52e566f5508aabc21e114565100006

SHA512
7bd67da148cb07538531a95410e096f0b5d23fe79fbbde4d2fb5c27f3bffb041ff43de8fffce6e960a3bd312ee2b9f94e84271774bda22047e11cb2e62db7dce

Download Submit
C:\Windows\system\jokkIZI.exe

Filesize
1.9MB

MD5
e2cc8bb2c767ca134c62850a2b828d75

SHA1
53ad53229977e3eedfa48741c07a8dd02710d48d

SHA256
d564192f18390d72daac4fa9ba7211ffb396007485122fba83b8cc52f3f06d5e

SHA512
bf5fb7289f3381aef8d86e9e156b739d6b1f4a713248b1c860ea75f4c467448d5769defe2a55790fe4d7b28ccc8b15a875eb6247bb8c12788a260c1670b5ec40

Download Submit
C:\Windows\system\lPLQqPm.exe

Filesize
1.9MB

MD5
49e5d66eca90c17cd355ff5a78122b6f

SHA1
e0c5c10ce06a695bb7384368a64f29f5ecba093b

SHA256
34a52606accabe94a3ab4a5a94597d06ae0160be1032823390841d264de40209

SHA512
1532a2d6a631cac34bab08fa493f341b2753d5d345adb34b82024016ef4ae021c381381e9b3ed6e85d92d1fe1515d57e106c8462eddf785161801e8641df152f

Download Submit
C:\Windows\system\nFXxrng.exe

Filesize
1.9MB

MD5
dff282d155198bc809d1826a198c9b3b

SHA1
44c0e319197a5a51d7c4ac981f4b7695d3aa8bd1

SHA256
7d24ef7f9deff7766b2f2ff8b81b0fcec24c212d23e65caaa5ba2da69ce3413e

SHA512
8cfa3b9bbe301b921c79a806e84f5407d8d13e8964dfb31e3e647c8674d27a29121188ab152c9ffabf2ddd11b0ad64d9c3f97150460b23505032032e49cd93f1

Download Submit
C:\Windows\system\ojSYgVp.exe

Filesize
1.9MB

MD5
ad4ba1899b44ff39a59ebaa4a6f80d36

SHA1
1b84e84ea86d3d60e5fef34f1867ced6bc7771a5

SHA256
dde4faa7fca0c83204080fc865c03757b7776eb47131a2d2314c46903620375f

SHA512
5e745d7fdf5cf59e8ea9d9000e309f556eac6185269e3d4fb3653213812c463fd174c08ca65c2573175cf2eeb47d567f6b6d88757fa84e1886efee04590da1a0

Download Submit
C:\Windows\system\pFPoPbX.exe

Filesize
1.9MB

MD5
4b4d37deb78fe9ddfd3700fb5f778ea6

SHA1
738bdee9bee43dd1530030f1d6486bf822cf7d40

SHA256
d485ec4bbf66589254d77703b8d7d1b40586f5f3d51170f67c64f3ae5af4dc9b

SHA512
84cf68f72040f6bdf733feb8af873c4aaa87e541fa816136cfdbde590528fd8c6cbcd15e04fa6dded6cec0a05d8f272081a8376f61b321ae6a62a01b29025d73

Download Submit
C:\Windows\system\qNwjCcI.exe

Filesize
1.9MB

MD5
4a249ee4b127d247e9dd1768ff53ab57

SHA1
34fb2c228e55d80a8bf6a3c0d52f6c5c1ac62454

SHA256
c410b422e53136227b0afa0c3a5b8e70018c8e19591317fdd278c9463f494a26

SHA512
e512c28c84ec6b8e4be999c3602e603d1fa2d1b870f809ba56d1ef41963a7adb74492644bf48adf9c22377b73da8a1e7f6b4e90b81c357937ce8a6bf50fa5fe8

Download Submit
C:\Windows\system\trCzofw.exe

Filesize
1.9MB

MD5
ae36227a37d384bf08eddc4f799b695e

SHA1
2ad69261f2db187b84c41834d8a183dffffc39b2

SHA256
df75d9c7cd957eb64eba31698164ac2e9c06fd4be37dbc29ac3cf718cdc14bf6

SHA512
1bc0ee3252d0231b00aa1926dbf3844421ac420779476021e11eb4c1416af30a748bfbd6dd247be0aab95982f89c4f10f28e84c1c42f0bfcf8cbd721075e7bd4

Download Submit
C:\Windows\system\zEcmaEs.exe

Filesize
1.9MB

MD5
480a10e12314c065177cf215caa0bb84

SHA1
b5540f2e372e2703a9cf827accc43895ba56e92b

SHA256
416a782428081be8d9671c1e6c68ef94f07e594225157616bae764f887efaacc

SHA512
1f9747acf9fa74a19bff71d8eec1bd2a1993510e99b18205d632cf5fd701860a2d49c5ad2df65de812776037fda2be5fe4586f149d44c6bf75c65540a48844ff

Download Submit
\Windows\system\QjEQOSl.exe

Filesize
1.9MB

MD5
4f258d8b516f2b008e1e8450fca62700

SHA1
ed732140ae39a4d79acf529e22c243305a8ed3e3

SHA256
f23bd6df0207be2fcf6f105676a6a84519b8137057ee889998ba5ce02186e529

SHA512
6a39e221601b6ea9c0c78aa63ff8dad10213d6b16f0eaf95e45366679c94a0a458ec2154fcbf03e0bd66451d99c246bc34862726f78aae5e119a6d2a0027d810

Download Submit
\Windows\system\RvqFBJT.exe

Filesize
1.9MB

MD5
d14d468d4e717f040179884152f7911b

SHA1
85caa6e808358008011917bd6585b192eadba282

SHA256
d928e6e48c58c818a181ab3ddbebd3b0547e255a10da6ddbe3574e5f0a30d4ab

SHA512
3e6f4b269a0e59fca3999ed8d545b54e608c7e003d1b0aaee36a6cbda7dd5b9576b2ccf6b2f3ef6839d052846fcc6575c0ab2b20b131833db3d225131f24d68f

Download Submit
\Windows\system\YCgwrYq.exe

Filesize
1.9MB

MD5
47ba3008f5e00857dfe758d2aeb9d7a2

SHA1
a56284e7bc06d2dcb6bb2b0bb63cd46f092838cb

SHA256
2fb346f4067b75d5cfc667031b8d2ce9224b29cd8c983a0b063bd7328153c677

SHA512
626876744709b7fbceb80dd2c399cafbab220eb07359cfcc8094aab5136c06f6775f545828fbd2d78c5ae414fb7bcda296aede4dbc62a854d8b6c013d695b3c8

Download Submit
\Windows\system\jawCvOE.exe

Filesize
1.9MB

MD5
fd3c63b4a6dba76cd7ec9787a914295f

SHA1
e93a51df6a702c8c63f70f01f11bc298f1f2676c

SHA256
862d2bfa6ade11e1f1d803851d68bf5408d48256d6b6810a7a58cf3d41d6b4c1

SHA512
45ab466a880acbef3b7873496799907bbbb43e14044f4bf1bc61045373881078f9e0986970c73098f4496d46d48b9bb58f17d34451d7c928df3a08c256def25f

Download Submit
\Windows\system\jdXnxmN.exe

Filesize
1.9MB

MD5
f23abb5efa243a371e14ede41a7939a2

SHA1
b302479dfd8912cf32f5961eda15e8a4018fd118

SHA256
d8cd6c7b4a2d9d9182228a31bb7828372199f4362d01daf42924931427b34169

SHA512
14a1c2d264436807f1e702c24690cea81560cfbecd156c479041d9573ed1b4311e997e278af4a03783735e66f2b5fe954648a2f2e50c5689cf700182fe7e0f3c

Download Submit
\Windows\system\lHxSPfu.exe

Filesize
1.9MB

MD5
df9753e7a9d1346642e37969fa6d6a92

SHA1
a99c41ae28494356c870af065c5e1a5a1c8fdf58

SHA256
db2403aec7213e16941184b27b7f3e661e24f92042507856105fca06fffc5c0f

SHA512
bafada72d5605d578c82de171e7f75b72c6fc3aacff8eceb1645dec9b653c9c76c008fded589b90d461f0db25eff426ed56bd5704d3dce4713a2757c121b0d58

Download Submit
\Windows\system\nVjKnbI.exe

Filesize
1.9MB

MD5
83e0a8e055088e53cafd2d5a21b240fc

SHA1
287201d25afab317f89d53df44e2a44babce56dc

SHA256
7594d71290f85a6150b5cca9886098b3ca1e56602fede7580a7b5b22911c84a4

SHA512
712ac311abe136430763955cb74181f7429efb3ed64eda4aec4f224b69f69f1d41f388121de0fabbfd805c4d652944d07ff779bb91a80623e595e7123f1094cd

Download Submit
\Windows\system\tlKvyoI.exe

Filesize
1.9MB

MD5
473e8c75573bcdf76ddba45dea46875a

SHA1
8c4b8b094780fa2dd33d61d065377efa7299fe3b

SHA256
8c0eb63ffd2163dee50edfb048d92d4989029fea3a01dee7ed938d06abf39cb9

SHA512
7cf553f79972a9fd9b80a15eb3d0a269de9f19662c40f83d9d06572da59eaf479969a18b4570d09d1d5ab3debce1b5ce24bd0b356763c0262f9b2509c7f10c07

Download Submit
\Windows\system\wtJpEXc.exe

Filesize
1.9MB

MD5
d2119a971b3ffd2f16904ac5eb871b0e

SHA1
267dd455adcea86198f0e90da0f2d290bbd90245

SHA256
11eb6321f05a8cf701148bb49aba14b0d5bd35ba79ae9a67eab018cb3dd39fe0

SHA512
39fc1f4383ae092350c4e0446d9317321f007984a50c8bf871bc814e0b4b91fc12253238f611c2682d5e17e1a1d06ec5815a2f5218b5b98785774c8c089b941d

Download Submit
memory/1952-66-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2096-43-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2148-611-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2148-9-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2452-52-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2500-64-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-25-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2664-1103-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2756-40-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2756-2035-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2856-37-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2856-44-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2856-35-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2856-106-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2856-38-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/2856-47-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/2856-45-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/2856-39-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/2920-55-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-42-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-2036-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-19-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2920-46-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2920-67-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2920-7-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2920-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/2920-87-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-78-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2920-0-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2924-88-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/3036-1042-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-18-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download