xmrig | 67d371f1bd16c8b3a374fec86d09754d6e6a07646da594beb4d00f917219b08d

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
Size

2.2MB
MD5

0c459e71a4bf6c0a890556703a3a8d7d
SHA1

afda37951bb12e1a82813089512856a707d02431
SHA256

67d371f1bd16c8b3a374fec86d09754d6e6a07646da594beb4d00f917219b08d
SHA512

93840bb574908e74a0827a831ec59cc20a0554312060147ffedc2d87db45ca558a9389821d7dc21e279da5e55cc030e7e161951677afe1c0273f583a0523488c
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfK:NAB9

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2448-168-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2216-156-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/2600-167-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2708-166-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2160-164-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2988-160-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2504-147-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2604-122-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/2732-70-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/3012-50-0x000000013F7A0000-0x000000013FB92000-memory.dmp	xmrig
behavioral1/memory/3028-33-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2216-4570-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/2604-4580-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/3028-4607-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2504-4600-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2988-4636-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2708-4656-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2448-4645-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2600-4675-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/3012-4682-0x000000013F7A0000-0x000000013FB92000-memory.dmp	xmrig
behavioral1/memory/2732-4687-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2160-4595-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2360-10699-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2216	DFiMmFj.exe
2988	ySNcMer.exe
3028	sPkqOIE.exe
3012	EPLUiin.exe
2160	LpkjXbd.exe
2732	BvtgxKi.exe
2708	lsPEduf.exe
2600	VctIFbX.exe
2604	ayrgoxP.exe
2504	vbZhBFE.exe
2448	xOgJMfO.exe
1224	XqulsaW.exe
2008	CnYwJWU.exe
2468	LZqixaS.exe
1040	uUOKeHQ.exe
1940	ZKGHjrp.exe
1948	agNMUSl.exe
2656	LVWyEZl.exe
2676	ofLgRqM.exe
1660	KaeKxNj.exe
2840	lvVknqd.exe
2308	HwTSjPt.exe
1476	pXXYlgU.exe
2388	hgTupVw.exe
2004	auGgaTk.exe
1920	VjUmFpv.exe
1528	RTGRaVh.exe
2404	kBLpAVG.exe
1436	JQBQTar.exe
2684	oszlEEz.exe
1800	PXUnwwf.exe
2956	ukyIjNe.exe
1200	wjKqjld.exe
696	hHVeKdw.exe
1376	xmQqWFG.exe
788	FYtmTxF.exe
356	QrMfDhP.exe
652	cSITYuB.exe
2064	UxiIlKy.exe
1232	sJKfPkv.exe
1128	UwOyapn.exe
2264	BCNOnvF.exe
2268	gvOyAjf.exe
2284	cSdVOOz.exe
2240	EgRAdRP.exe
2256	jOTwepQ.exe
2892	xxFBduy.exe
2872	DZhHcqU.exe
1876	UDgCgwk.exe
1592	IbsiTkZ.exe
1188	OtBnIbJ.exe
2548	dLypRor.exe
2648	teGJVHN.exe
1152	OnNyxLf.exe
2156	PMQBZaW.exe
1972	vhdYEfM.exe
2820	zHzCweL.exe
560	BLrFaSt.exe
948	iCPCIDA.exe
1532	WoCtpoe.exe
2012	TUjHSmS.exe
2780	fbdffMa.exe
1752	zZzSCCu.exe
2412	bspNCoq.exe

Loads dropped DLL 64 IoCs

pid	Process
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2360-2-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/files/0x000a000000015f7a-3.dat	upx
behavioral1/files/0x00090000000167d5-7.dat	upx
behavioral1/files/0x0008000000016bfb-14.dat	upx
behavioral1/files/0x0007000000016c51-29.dat	upx
behavioral1/files/0x000f000000005578-46.dat	upx
behavioral1/files/0x0007000000016d16-67.dat	upx
behavioral1/files/0x0006000000017374-114.dat	upx
behavioral1/files/0x00140000000185e9-148.dat	upx
behavioral1/files/0x0006000000019052-162.dat	upx
behavioral1/memory/2448-168-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/files/0x0006000000017407-190.dat	upx
behavioral1/files/0x0006000000018bab-139.dat	upx
behavioral1/files/0x000600000001737c-183.dat	upx
behavioral1/files/0x0006000000017371-181.dat	upx
behavioral1/files/0x0006000000016fed-179.dat	upx
behavioral1/files/0x0006000000016e24-177.dat	upx
behavioral1/files/0x0006000000019064-171.dat	upx
behavioral1/memory/2216-156-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/files/0x0006000000018fbf-153.dat	upx
behavioral1/files/0x0006000000016d51-135.dat	upx
behavioral1/files/0x0005000000018717-132.dat	upx
behavioral1/files/0x000d0000000185f4-124.dat	upx
behavioral1/files/0x00060000000174a5-117.dat	upx
behavioral1/files/0x0007000000016d1a-103.dat	upx
behavioral1/files/0x0005000000019159-187.dat	upx
behavioral1/memory/2600-167-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/memory/2708-166-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2160-164-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/files/0x0006000000018ed8-161.dat	upx
behavioral1/memory/2988-160-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/files/0x0006000000018ba1-150.dat	upx
behavioral1/files/0x000500000001860c-149.dat	upx
behavioral1/memory/2504-147-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2604-122-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/files/0x0006000000017422-116.dat	upx
behavioral1/files/0x00060000000173f2-115.dat	upx
behavioral1/files/0x000600000001735a-92.dat	upx
behavioral1/files/0x0006000000016e4a-91.dat	upx
behavioral1/files/0x0007000000016c7c-56.dat	upx
behavioral1/files/0x000a000000016cc6-72.dat	upx
behavioral1/memory/2732-70-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/files/0x0006000000016d57-69.dat	upx
behavioral1/files/0x0007000000016d3e-68.dat	upx
behavioral1/memory/3012-50-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/files/0x0007000000016c04-37.dat	upx
behavioral1/memory/3028-33-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2216-4570-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/memory/2604-4580-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/memory/3028-4607-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2504-4600-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2988-4636-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2708-4656-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2448-4645-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/memory/2600-4675-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/memory/3012-4682-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/memory/2732-4687-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2160-4595-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2360-10699-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DhllBWz.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\VCSoRgB.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\sJkeXbr.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\cJyADSs.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\jSoVlWx.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\iYhQVYa.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\knSJsts.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\aVKSisv.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\sLoQVdG.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\FivnkDo.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\jUZdqyV.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\SwxDtLo.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\dKsuXPC.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\nfMctsh.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\MWMQnAc.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\CfwDpHX.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\RlBNTus.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\ZIWZfBe.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\UQUyvfD.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\QtrstLn.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\oUTkZmW.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\veTUPuQ.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\DCHWyAs.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\zohvWZR.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\ofLoqrA.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\poJkkUX.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\gbQlsFE.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\GRjCUgm.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\vcJXjBM.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\YHoWOKC.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\kfjPJLe.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\Bmzgvib.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\vdXqEWc.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\ybVQnHU.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\PRMWUfM.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\EwlKZos.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\BgfTMzU.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\mltbmEh.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\rfIFQVM.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\YOufQEZ.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\oZIFEwQ.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\QCotZBA.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\oQSedRt.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\QjtHvDL.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\uCskRwL.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\CcCgogh.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\kDHOoEz.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\WOnvgBd.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\pHLobab.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\qKNtMQk.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\AnEkWle.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\fGeVxGb.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\lCpsQbe.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\pxgUSMa.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\tNZxAbK.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\LGuhavQ.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\QQxFmsH.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\SIDEDUR.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\TYsvmlx.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\woOzeeF.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\vkLGAMH.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\FcNRNNY.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\ArgsTdP.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
File created	C:\Windows\System\HlHiCEW.exe	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2132	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
Token: SeDebugPrivilege	2132	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2132	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	29
PID 2360 wrote to memory of 2132	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	29
PID 2360 wrote to memory of 2132	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	29
PID 2360 wrote to memory of 2216	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2216	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2216	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2988	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	31
PID 2360 wrote to memory of 2988	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	31
PID 2360 wrote to memory of 2988	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	31
PID 2360 wrote to memory of 3028	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	32
PID 2360 wrote to memory of 3028	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	32
PID 2360 wrote to memory of 3028	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	32
PID 2360 wrote to memory of 2160	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	33
PID 2360 wrote to memory of 2160	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	33
PID 2360 wrote to memory of 2160	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	33
PID 2360 wrote to memory of 3012	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	34
PID 2360 wrote to memory of 3012	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	34
PID 2360 wrote to memory of 3012	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	34
PID 2360 wrote to memory of 2708	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	35
PID 2360 wrote to memory of 2708	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	35
PID 2360 wrote to memory of 2708	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	35
PID 2360 wrote to memory of 2732	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	36
PID 2360 wrote to memory of 2732	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	36
PID 2360 wrote to memory of 2732	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	36
PID 2360 wrote to memory of 2448	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	37
PID 2360 wrote to memory of 2448	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	37
PID 2360 wrote to memory of 2448	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	37
PID 2360 wrote to memory of 2600	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	38
PID 2360 wrote to memory of 2600	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	38
PID 2360 wrote to memory of 2600	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	38
PID 2360 wrote to memory of 2468	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	39
PID 2360 wrote to memory of 2468	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	39
PID 2360 wrote to memory of 2468	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	39
PID 2360 wrote to memory of 2604	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	40
PID 2360 wrote to memory of 2604	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	40
PID 2360 wrote to memory of 2604	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	40
PID 2360 wrote to memory of 2656	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	41
PID 2360 wrote to memory of 2656	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	41
PID 2360 wrote to memory of 2656	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	41
PID 2360 wrote to memory of 2504	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	42
PID 2360 wrote to memory of 2504	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	42
PID 2360 wrote to memory of 2504	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	42
PID 2360 wrote to memory of 2388	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	43
PID 2360 wrote to memory of 2388	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	43
PID 2360 wrote to memory of 2388	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	43
PID 2360 wrote to memory of 1224	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	44
PID 2360 wrote to memory of 1224	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	44
PID 2360 wrote to memory of 1224	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	44
PID 2360 wrote to memory of 2004	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	45
PID 2360 wrote to memory of 2004	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	45
PID 2360 wrote to memory of 2004	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	45
PID 2360 wrote to memory of 2008	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	46
PID 2360 wrote to memory of 2008	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	46
PID 2360 wrote to memory of 2008	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	46
PID 2360 wrote to memory of 1920	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	47
PID 2360 wrote to memory of 1920	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	47
PID 2360 wrote to memory of 1920	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	47
PID 2360 wrote to memory of 1040	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	48
PID 2360 wrote to memory of 1040	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	48
PID 2360 wrote to memory of 1040	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	48
PID 2360 wrote to memory of 1528	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	49
PID 2360 wrote to memory of 1528	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	49
PID 2360 wrote to memory of 1528	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	49
PID 2360 wrote to memory of 1940	2360	0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c459e71a4bf6c0a890556703a3a8d7d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2132
- C:\Windows\System\DFiMmFj.exe
  C:\Windows\System\DFiMmFj.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\ySNcMer.exe
  C:\Windows\System\ySNcMer.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\sPkqOIE.exe
  C:\Windows\System\sPkqOIE.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\LpkjXbd.exe
  C:\Windows\System\LpkjXbd.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\EPLUiin.exe
  C:\Windows\System\EPLUiin.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\lsPEduf.exe
  C:\Windows\System\lsPEduf.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\BvtgxKi.exe
  C:\Windows\System\BvtgxKi.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\xOgJMfO.exe
  C:\Windows\System\xOgJMfO.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\VctIFbX.exe
  C:\Windows\System\VctIFbX.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\LZqixaS.exe
  C:\Windows\System\LZqixaS.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\ayrgoxP.exe
  C:\Windows\System\ayrgoxP.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\LVWyEZl.exe
  C:\Windows\System\LVWyEZl.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\vbZhBFE.exe
  C:\Windows\System\vbZhBFE.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\hgTupVw.exe
  C:\Windows\System\hgTupVw.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\XqulsaW.exe
  C:\Windows\System\XqulsaW.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\auGgaTk.exe
  C:\Windows\System\auGgaTk.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\CnYwJWU.exe
  C:\Windows\System\CnYwJWU.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\VjUmFpv.exe
  C:\Windows\System\VjUmFpv.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\uUOKeHQ.exe
  C:\Windows\System\uUOKeHQ.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\RTGRaVh.exe
  C:\Windows\System\RTGRaVh.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\ZKGHjrp.exe
  C:\Windows\System\ZKGHjrp.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\JQBQTar.exe
  C:\Windows\System\JQBQTar.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\agNMUSl.exe
  C:\Windows\System\agNMUSl.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\oszlEEz.exe
  C:\Windows\System\oszlEEz.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\ofLgRqM.exe
  C:\Windows\System\ofLgRqM.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\PXUnwwf.exe
  C:\Windows\System\PXUnwwf.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\KaeKxNj.exe
  C:\Windows\System\KaeKxNj.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\ukyIjNe.exe
  C:\Windows\System\ukyIjNe.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\lvVknqd.exe
  C:\Windows\System\lvVknqd.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\wjKqjld.exe
  C:\Windows\System\wjKqjld.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\HwTSjPt.exe
  C:\Windows\System\HwTSjPt.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\hHVeKdw.exe
  C:\Windows\System\hHVeKdw.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\pXXYlgU.exe
  C:\Windows\System\pXXYlgU.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\FYtmTxF.exe
  C:\Windows\System\FYtmTxF.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\kBLpAVG.exe
  C:\Windows\System\kBLpAVG.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\QrMfDhP.exe
  C:\Windows\System\QrMfDhP.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\xmQqWFG.exe
  C:\Windows\System\xmQqWFG.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\cSITYuB.exe
  C:\Windows\System\cSITYuB.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\UxiIlKy.exe
  C:\Windows\System\UxiIlKy.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\sJKfPkv.exe
  C:\Windows\System\sJKfPkv.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\UwOyapn.exe
  C:\Windows\System\UwOyapn.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\BCNOnvF.exe
  C:\Windows\System\BCNOnvF.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\gvOyAjf.exe
  C:\Windows\System\gvOyAjf.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\cSdVOOz.exe
  C:\Windows\System\cSdVOOz.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\EgRAdRP.exe
  C:\Windows\System\EgRAdRP.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\jOTwepQ.exe
  C:\Windows\System\jOTwepQ.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\xxFBduy.exe
  C:\Windows\System\xxFBduy.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\DZhHcqU.exe
  C:\Windows\System\DZhHcqU.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\UDgCgwk.exe
  C:\Windows\System\UDgCgwk.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\IcKQlcH.exe
  C:\Windows\System\IcKQlcH.exe
  2⤵
  PID:2096
- C:\Windows\System\IbsiTkZ.exe
  C:\Windows\System\IbsiTkZ.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\CmBkzHL.exe
  C:\Windows\System\CmBkzHL.exe
  2⤵
  PID:1596
- C:\Windows\System\OtBnIbJ.exe
  C:\Windows\System\OtBnIbJ.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\LlehStv.exe
  C:\Windows\System\LlehStv.exe
  2⤵
  PID:3052
- C:\Windows\System\dLypRor.exe
  C:\Windows\System\dLypRor.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\fKIQtIl.exe
  C:\Windows\System\fKIQtIl.exe
  2⤵
  PID:2596
- C:\Windows\System\teGJVHN.exe
  C:\Windows\System\teGJVHN.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\IsBhbRa.exe
  C:\Windows\System\IsBhbRa.exe
  2⤵
  PID:376
- C:\Windows\System\OnNyxLf.exe
  C:\Windows\System\OnNyxLf.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\MBnWwBM.exe
  C:\Windows\System\MBnWwBM.exe
  2⤵
  PID:2940
- C:\Windows\System\PMQBZaW.exe
  C:\Windows\System\PMQBZaW.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\WnmVNbk.exe
  C:\Windows\System\WnmVNbk.exe
  2⤵
  PID:1716
- C:\Windows\System\vhdYEfM.exe
  C:\Windows\System\vhdYEfM.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\aqGoytB.exe
  C:\Windows\System\aqGoytB.exe
  2⤵
  PID:2032
- C:\Windows\System\zHzCweL.exe
  C:\Windows\System\zHzCweL.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\ItAuKZQ.exe
  C:\Windows\System\ItAuKZQ.exe
  2⤵
  PID:768
- C:\Windows\System\BLrFaSt.exe
  C:\Windows\System\BLrFaSt.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\NtmMBnf.exe
  C:\Windows\System\NtmMBnf.exe
  2⤵
  PID:3016
- C:\Windows\System\iCPCIDA.exe
  C:\Windows\System\iCPCIDA.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\xCNkcRR.exe
  C:\Windows\System\xCNkcRR.exe
  2⤵
  PID:2884
- C:\Windows\System\WoCtpoe.exe
  C:\Windows\System\WoCtpoe.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\yOwOZDD.exe
  C:\Windows\System\yOwOZDD.exe
  2⤵
  PID:2960
- C:\Windows\System\TUjHSmS.exe
  C:\Windows\System\TUjHSmS.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\dnrSLFe.exe
  C:\Windows\System\dnrSLFe.exe
  2⤵
  PID:2416
- C:\Windows\System\fbdffMa.exe
  C:\Windows\System\fbdffMa.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\KCztExl.exe
  C:\Windows\System\KCztExl.exe
  2⤵
  PID:1900
- C:\Windows\System\zZzSCCu.exe
  C:\Windows\System\zZzSCCu.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\ynrVSCn.exe
  C:\Windows\System\ynrVSCn.exe
  2⤵
  PID:752
- C:\Windows\System\bspNCoq.exe
  C:\Windows\System\bspNCoq.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\zRyncKZ.exe
  C:\Windows\System\zRyncKZ.exe
  2⤵
  PID:708
- C:\Windows\System\DEdpCzj.exe
  C:\Windows\System\DEdpCzj.exe
  2⤵
  PID:1428
- C:\Windows\System\mKxfcGt.exe
  C:\Windows\System\mKxfcGt.exe
  2⤵
  PID:2856
- C:\Windows\System\BPmrmER.exe
  C:\Windows\System\BPmrmER.exe
  2⤵
  PID:1172
- C:\Windows\System\IWCPMOQ.exe
  C:\Windows\System\IWCPMOQ.exe
  2⤵
  PID:1084
- C:\Windows\System\JZkgtgm.exe
  C:\Windows\System\JZkgtgm.exe
  2⤵
  PID:1892
- C:\Windows\System\BKATVWT.exe
  C:\Windows\System\BKATVWT.exe
  2⤵
  PID:2056
- C:\Windows\System\IaQVwyA.exe
  C:\Windows\System\IaQVwyA.exe
  2⤵
  PID:636
- C:\Windows\System\jAyNlIp.exe
  C:\Windows\System\jAyNlIp.exe
  2⤵
  PID:1756
- C:\Windows\System\QkCPGSq.exe
  C:\Windows\System\QkCPGSq.exe
  2⤵
  PID:2088
- C:\Windows\System\cvmIEsZ.exe
  C:\Windows\System\cvmIEsZ.exe
  2⤵
  PID:3004
- C:\Windows\System\mQzyTCt.exe
  C:\Windows\System\mQzyTCt.exe
  2⤵
  PID:2740
- C:\Windows\System\KOcTruy.exe
  C:\Windows\System\KOcTruy.exe
  2⤵
  PID:2440
- C:\Windows\System\wKmxpMg.exe
  C:\Windows\System\wKmxpMg.exe
  2⤵
  PID:2428
- C:\Windows\System\eIwBwPA.exe
  C:\Windows\System\eIwBwPA.exe
  2⤵
  PID:2564
- C:\Windows\System\TxnVTSM.exe
  C:\Windows\System\TxnVTSM.exe
  2⤵
  PID:2444
- C:\Windows\System\nMQAdQJ.exe
  C:\Windows\System\nMQAdQJ.exe
  2⤵
  PID:1816
- C:\Windows\System\kpPCSHH.exe
  C:\Windows\System\kpPCSHH.exe
  2⤵
  PID:1296
- C:\Windows\System\CSztRpT.exe
  C:\Windows\System\CSztRpT.exe
  2⤵
  PID:800
- C:\Windows\System\FxRNofB.exe
  C:\Windows\System\FxRNofB.exe
  2⤵
  PID:1016
- C:\Windows\System\IOYjQXI.exe
  C:\Windows\System\IOYjQXI.exe
  2⤵
  PID:2560
- C:\Windows\System\gpqIGMx.exe
  C:\Windows\System\gpqIGMx.exe
  2⤵
  PID:3088
- C:\Windows\System\KFVvmIG.exe
  C:\Windows\System\KFVvmIG.exe
  2⤵
  PID:3104
- C:\Windows\System\xKVgawL.exe
  C:\Windows\System\xKVgawL.exe
  2⤵
  PID:3120
- C:\Windows\System\zoypwIk.exe
  C:\Windows\System\zoypwIk.exe
  2⤵
  PID:3136
- C:\Windows\System\mwUHUFr.exe
  C:\Windows\System\mwUHUFr.exe
  2⤵
  PID:3152
- C:\Windows\System\PRMWUfM.exe
  C:\Windows\System\PRMWUfM.exe
  2⤵
  PID:3168
- C:\Windows\System\KhQAifR.exe
  C:\Windows\System\KhQAifR.exe
  2⤵
  PID:3184
- C:\Windows\System\fzfyTaF.exe
  C:\Windows\System\fzfyTaF.exe
  2⤵
  PID:3200
- C:\Windows\System\kpPjiGZ.exe
  C:\Windows\System\kpPjiGZ.exe
  2⤵
  PID:3216
- C:\Windows\System\ctUSVjB.exe
  C:\Windows\System\ctUSVjB.exe
  2⤵
  PID:3232
- C:\Windows\System\rEjdNcO.exe
  C:\Windows\System\rEjdNcO.exe
  2⤵
  PID:3248
- C:\Windows\System\dAzedST.exe
  C:\Windows\System\dAzedST.exe
  2⤵
  PID:3264
- C:\Windows\System\vKEQoIm.exe
  C:\Windows\System\vKEQoIm.exe
  2⤵
  PID:3280
- C:\Windows\System\ICDrYNi.exe
  C:\Windows\System\ICDrYNi.exe
  2⤵
  PID:3296
- C:\Windows\System\RNfoOpP.exe
  C:\Windows\System\RNfoOpP.exe
  2⤵
  PID:3312
- C:\Windows\System\ozseFfl.exe
  C:\Windows\System\ozseFfl.exe
  2⤵
  PID:3328
- C:\Windows\System\nYhvYWB.exe
  C:\Windows\System\nYhvYWB.exe
  2⤵
  PID:3344
- C:\Windows\System\hcPpzoT.exe
  C:\Windows\System\hcPpzoT.exe
  2⤵
  PID:3360
- C:\Windows\System\jAuFdoo.exe
  C:\Windows\System\jAuFdoo.exe
  2⤵
  PID:3376
- C:\Windows\System\hVWVeNU.exe
  C:\Windows\System\hVWVeNU.exe
  2⤵
  PID:3392
- C:\Windows\System\srdWnoJ.exe
  C:\Windows\System\srdWnoJ.exe
  2⤵
  PID:3408
- C:\Windows\System\tskVNPb.exe
  C:\Windows\System\tskVNPb.exe
  2⤵
  PID:3424
- C:\Windows\System\PqcBJuU.exe
  C:\Windows\System\PqcBJuU.exe
  2⤵
  PID:3440
- C:\Windows\System\YzyXdDm.exe
  C:\Windows\System\YzyXdDm.exe
  2⤵
  PID:3456
- C:\Windows\System\ttgPXUx.exe
  C:\Windows\System\ttgPXUx.exe
  2⤵
  PID:3472
- C:\Windows\System\UnVDXqp.exe
  C:\Windows\System\UnVDXqp.exe
  2⤵
  PID:3488
- C:\Windows\System\WkbUHdf.exe
  C:\Windows\System\WkbUHdf.exe
  2⤵
  PID:3504
- C:\Windows\System\xNmhClc.exe
  C:\Windows\System\xNmhClc.exe
  2⤵
  PID:3520
- C:\Windows\System\onitIoW.exe
  C:\Windows\System\onitIoW.exe
  2⤵
  PID:3536
- C:\Windows\System\NiRzNAC.exe
  C:\Windows\System\NiRzNAC.exe
  2⤵
  PID:3552
- C:\Windows\System\qhZnjoY.exe
  C:\Windows\System\qhZnjoY.exe
  2⤵
  PID:3568
- C:\Windows\System\Gdxxdgc.exe
  C:\Windows\System\Gdxxdgc.exe
  2⤵
  PID:3584
- C:\Windows\System\DLWnSUO.exe
  C:\Windows\System\DLWnSUO.exe
  2⤵
  PID:3600
- C:\Windows\System\JQwZeuR.exe
  C:\Windows\System\JQwZeuR.exe
  2⤵
  PID:3616
- C:\Windows\System\qFFTwzE.exe
  C:\Windows\System\qFFTwzE.exe
  2⤵
  PID:3632
- C:\Windows\System\dPkxxik.exe
  C:\Windows\System\dPkxxik.exe
  2⤵
  PID:3648
- C:\Windows\System\mDJKdPs.exe
  C:\Windows\System\mDJKdPs.exe
  2⤵
  PID:3664
- C:\Windows\System\ofoNNDL.exe
  C:\Windows\System\ofoNNDL.exe
  2⤵
  PID:3680
- C:\Windows\System\heNkvWr.exe
  C:\Windows\System\heNkvWr.exe
  2⤵
  PID:3696
- C:\Windows\System\ZSBInmx.exe
  C:\Windows\System\ZSBInmx.exe
  2⤵
  PID:3712
- C:\Windows\System\VBsOGWQ.exe
  C:\Windows\System\VBsOGWQ.exe
  2⤵
  PID:3728
- C:\Windows\System\fntRqxO.exe
  C:\Windows\System\fntRqxO.exe
  2⤵
  PID:3744
- C:\Windows\System\UFOlNdi.exe
  C:\Windows\System\UFOlNdi.exe
  2⤵
  PID:3760
- C:\Windows\System\uMKYrsz.exe
  C:\Windows\System\uMKYrsz.exe
  2⤵
  PID:3776
- C:\Windows\System\UwgHhFA.exe
  C:\Windows\System\UwgHhFA.exe
  2⤵
  PID:3792
- C:\Windows\System\BTNHflt.exe
  C:\Windows\System\BTNHflt.exe
  2⤵
  PID:3808
- C:\Windows\System\NsMapZT.exe
  C:\Windows\System\NsMapZT.exe
  2⤵
  PID:3824
- C:\Windows\System\gMzJVWd.exe
  C:\Windows\System\gMzJVWd.exe
  2⤵
  PID:3840
- C:\Windows\System\vcJXjBM.exe
  C:\Windows\System\vcJXjBM.exe
  2⤵
  PID:3856
- C:\Windows\System\dgzTdHb.exe
  C:\Windows\System\dgzTdHb.exe
  2⤵
  PID:3872
- C:\Windows\System\tTMbqiu.exe
  C:\Windows\System\tTMbqiu.exe
  2⤵
  PID:3888
- C:\Windows\System\kagIXhs.exe
  C:\Windows\System\kagIXhs.exe
  2⤵
  PID:3904
- C:\Windows\System\HsmWwco.exe
  C:\Windows\System\HsmWwco.exe
  2⤵
  PID:3920
- C:\Windows\System\rcacNJw.exe
  C:\Windows\System\rcacNJw.exe
  2⤵
  PID:3936
- C:\Windows\System\ktfElek.exe
  C:\Windows\System\ktfElek.exe
  2⤵
  PID:3952
- C:\Windows\System\CHoSNBp.exe
  C:\Windows\System\CHoSNBp.exe
  2⤵
  PID:3968
- C:\Windows\System\xeOpnGl.exe
  C:\Windows\System\xeOpnGl.exe
  2⤵
  PID:3984
- C:\Windows\System\PUjiXUT.exe
  C:\Windows\System\PUjiXUT.exe
  2⤵
  PID:4000
- C:\Windows\System\LGAERXr.exe
  C:\Windows\System\LGAERXr.exe
  2⤵
  PID:4016
- C:\Windows\System\wzNEbJr.exe
  C:\Windows\System\wzNEbJr.exe
  2⤵
  PID:4032
- C:\Windows\System\rAUtpkG.exe
  C:\Windows\System\rAUtpkG.exe
  2⤵
  PID:4048
- C:\Windows\System\ZhxTwXy.exe
  C:\Windows\System\ZhxTwXy.exe
  2⤵
  PID:4064
- C:\Windows\System\QuqvRBU.exe
  C:\Windows\System\QuqvRBU.exe
  2⤵
  PID:4080
- C:\Windows\System\woNxIjl.exe
  C:\Windows\System\woNxIjl.exe
  2⤵
  PID:1648
- C:\Windows\System\iGrUKDG.exe
  C:\Windows\System\iGrUKDG.exe
  2⤵
  PID:1536
- C:\Windows\System\QZaobwG.exe
  C:\Windows\System\QZaobwG.exe
  2⤵
  PID:3096
- C:\Windows\System\euwsmAr.exe
  C:\Windows\System\euwsmAr.exe
  2⤵
  PID:3160
- C:\Windows\System\ZAVKBPr.exe
  C:\Windows\System\ZAVKBPr.exe
  2⤵
  PID:3224
- C:\Windows\System\RffMBaH.exe
  C:\Windows\System\RffMBaH.exe
  2⤵
  PID:3288
- C:\Windows\System\TRDkcfD.exe
  C:\Windows\System\TRDkcfD.exe
  2⤵
  PID:3352
- C:\Windows\System\OZSVsYs.exe
  C:\Windows\System\OZSVsYs.exe
  2⤵
  PID:3420
- C:\Windows\System\ezFDjox.exe
  C:\Windows\System\ezFDjox.exe
  2⤵
  PID:3480
- C:\Windows\System\JkzIDPE.exe
  C:\Windows\System\JkzIDPE.exe
  2⤵
  PID:3516
- C:\Windows\System\lAaEVzB.exe
  C:\Windows\System\lAaEVzB.exe
  2⤵
  PID:3580
- C:\Windows\System\uPWdYjO.exe
  C:\Windows\System\uPWdYjO.exe
  2⤵
  PID:3644
- C:\Windows\System\hBBfdmj.exe
  C:\Windows\System\hBBfdmj.exe
  2⤵
  PID:3704
- C:\Windows\System\OIGWpBb.exe
  C:\Windows\System\OIGWpBb.exe
  2⤵
  PID:3768
- C:\Windows\System\KWXEUoK.exe
  C:\Windows\System\KWXEUoK.exe
  2⤵
  PID:3832
- C:\Windows\System\xYxkmGC.exe
  C:\Windows\System\xYxkmGC.exe
  2⤵
  PID:3868
- C:\Windows\System\tCHFBVO.exe
  C:\Windows\System\tCHFBVO.exe
  2⤵
  PID:2996
- C:\Windows\System\uVLWIVF.exe
  C:\Windows\System\uVLWIVF.exe
  2⤵
  PID:3992
- C:\Windows\System\nQwVegq.exe
  C:\Windows\System\nQwVegq.exe
  2⤵
  PID:4056
- C:\Windows\System\kqDdEpU.exe
  C:\Windows\System\kqDdEpU.exe
  2⤵
  PID:1700
- C:\Windows\System\FyIioRo.exe
  C:\Windows\System\FyIioRo.exe
  2⤵
  PID:3320
- C:\Windows\System\wPdXnzc.exe
  C:\Windows\System\wPdXnzc.exe
  2⤵
  PID:3548
- C:\Windows\System\BCKcgBU.exe
  C:\Windows\System\BCKcgBU.exe
  2⤵
  PID:3800
- C:\Windows\System\XnJmNgh.exe
  C:\Windows\System\XnJmNgh.exe
  2⤵
  PID:4024
- C:\Windows\System\EcOcIvG.exe
  C:\Windows\System\EcOcIvG.exe
  2⤵
  PID:4100
- C:\Windows\System\IoDglle.exe
  C:\Windows\System\IoDglle.exe
  2⤵
  PID:4116
- C:\Windows\System\RTgBjkF.exe
  C:\Windows\System\RTgBjkF.exe
  2⤵
  PID:4132
- C:\Windows\System\IPfHssB.exe
  C:\Windows\System\IPfHssB.exe
  2⤵
  PID:4148
- C:\Windows\System\TRhRTFp.exe
  C:\Windows\System\TRhRTFp.exe
  2⤵
  PID:4164
- C:\Windows\System\JzhIjTE.exe
  C:\Windows\System\JzhIjTE.exe
  2⤵
  PID:4180
- C:\Windows\System\XMierrq.exe
  C:\Windows\System\XMierrq.exe
  2⤵
  PID:4196
- C:\Windows\System\oZxHriM.exe
  C:\Windows\System\oZxHriM.exe
  2⤵
  PID:4212
- C:\Windows\System\sRVzPOX.exe
  C:\Windows\System\sRVzPOX.exe
  2⤵
  PID:4228
- C:\Windows\System\mNQvwoR.exe
  C:\Windows\System\mNQvwoR.exe
  2⤵
  PID:4244
- C:\Windows\System\tBEWCtd.exe
  C:\Windows\System\tBEWCtd.exe
  2⤵
  PID:4260
- C:\Windows\System\HVtGwYG.exe
  C:\Windows\System\HVtGwYG.exe
  2⤵
  PID:4276
- C:\Windows\System\pquwmln.exe
  C:\Windows\System\pquwmln.exe
  2⤵
  PID:4292
- C:\Windows\System\ACBBjuF.exe
  C:\Windows\System\ACBBjuF.exe
  2⤵
  PID:4308
- C:\Windows\System\ZIUnoFx.exe
  C:\Windows\System\ZIUnoFx.exe
  2⤵
  PID:4324
- C:\Windows\System\WOEYEIR.exe
  C:\Windows\System\WOEYEIR.exe
  2⤵
  PID:4340
- C:\Windows\System\wOYDYhX.exe
  C:\Windows\System\wOYDYhX.exe
  2⤵
  PID:4356
- C:\Windows\System\mbIlvzY.exe
  C:\Windows\System\mbIlvzY.exe
  2⤵
  PID:4372
- C:\Windows\System\zlkiPOs.exe
  C:\Windows\System\zlkiPOs.exe
  2⤵
  PID:4388
- C:\Windows\System\wegqHHJ.exe
  C:\Windows\System\wegqHHJ.exe
  2⤵
  PID:4404
- C:\Windows\System\bqFtdth.exe
  C:\Windows\System\bqFtdth.exe
  2⤵
  PID:4420
- C:\Windows\System\QxoNmFN.exe
  C:\Windows\System\QxoNmFN.exe
  2⤵
  PID:4436
- C:\Windows\System\aeViOtO.exe
  C:\Windows\System\aeViOtO.exe
  2⤵
  PID:4452
- C:\Windows\System\YamEoJT.exe
  C:\Windows\System\YamEoJT.exe
  2⤵
  PID:4468
- C:\Windows\System\YGpYcza.exe
  C:\Windows\System\YGpYcza.exe
  2⤵
  PID:4484
- C:\Windows\System\vKNdtpo.exe
  C:\Windows\System\vKNdtpo.exe
  2⤵
  PID:4500
- C:\Windows\System\FNDXvyZ.exe
  C:\Windows\System\FNDXvyZ.exe
  2⤵
  PID:4516
- C:\Windows\System\DcVayBU.exe
  C:\Windows\System\DcVayBU.exe
  2⤵
  PID:4532
- C:\Windows\System\oxhKBAw.exe
  C:\Windows\System\oxhKBAw.exe
  2⤵
  PID:4548
- C:\Windows\System\mkryRwd.exe
  C:\Windows\System\mkryRwd.exe
  2⤵
  PID:4564
- C:\Windows\System\IOamdck.exe
  C:\Windows\System\IOamdck.exe
  2⤵
  PID:4580
- C:\Windows\System\wmWtjbY.exe
  C:\Windows\System\wmWtjbY.exe
  2⤵
  PID:4596
- C:\Windows\System\asoNVln.exe
  C:\Windows\System\asoNVln.exe
  2⤵
  PID:4612
- C:\Windows\System\YwMHpbe.exe
  C:\Windows\System\YwMHpbe.exe
  2⤵
  PID:4628
- C:\Windows\System\BowOEuY.exe
  C:\Windows\System\BowOEuY.exe
  2⤵
  PID:4644
- C:\Windows\System\gvuVdVt.exe
  C:\Windows\System\gvuVdVt.exe
  2⤵
  PID:4660
- C:\Windows\System\LQKHSnS.exe
  C:\Windows\System\LQKHSnS.exe
  2⤵
  PID:4676
- C:\Windows\System\WiSlqqH.exe
  C:\Windows\System\WiSlqqH.exe
  2⤵
  PID:4692
- C:\Windows\System\LqVnKOW.exe
  C:\Windows\System\LqVnKOW.exe
  2⤵
  PID:4708
- C:\Windows\System\hgappuF.exe
  C:\Windows\System\hgappuF.exe
  2⤵
  PID:4724
- C:\Windows\System\oWAjZIo.exe
  C:\Windows\System\oWAjZIo.exe
  2⤵
  PID:4740
- C:\Windows\System\qlPfixs.exe
  C:\Windows\System\qlPfixs.exe
  2⤵
  PID:4756
- C:\Windows\System\OsdSCdB.exe
  C:\Windows\System\OsdSCdB.exe
  2⤵
  PID:4772
- C:\Windows\System\uShRDSa.exe
  C:\Windows\System\uShRDSa.exe
  2⤵
  PID:4788
- C:\Windows\System\hWPGqdC.exe
  C:\Windows\System\hWPGqdC.exe
  2⤵
  PID:4804
- C:\Windows\System\vyvaXiR.exe
  C:\Windows\System\vyvaXiR.exe
  2⤵
  PID:4820
- C:\Windows\System\GjwJFrI.exe
  C:\Windows\System\GjwJFrI.exe
  2⤵
  PID:4836
- C:\Windows\System\rePlywp.exe
  C:\Windows\System\rePlywp.exe
  2⤵
  PID:4852
- C:\Windows\System\VzFhJgZ.exe
  C:\Windows\System\VzFhJgZ.exe
  2⤵
  PID:4868
- C:\Windows\System\AcPUjTl.exe
  C:\Windows\System\AcPUjTl.exe
  2⤵
  PID:4884
- C:\Windows\System\yDuPUkt.exe
  C:\Windows\System\yDuPUkt.exe
  2⤵
  PID:4900
- C:\Windows\System\IGjHRck.exe
  C:\Windows\System\IGjHRck.exe
  2⤵
  PID:4916
- C:\Windows\System\gPdyKtN.exe
  C:\Windows\System\gPdyKtN.exe
  2⤵
  PID:4932
- C:\Windows\System\MKcRdbz.exe
  C:\Windows\System\MKcRdbz.exe
  2⤵
  PID:4948
- C:\Windows\System\qorYHAw.exe
  C:\Windows\System\qorYHAw.exe
  2⤵
  PID:4964
- C:\Windows\System\zKSTFqW.exe
  C:\Windows\System\zKSTFqW.exe
  2⤵
  PID:1624
- C:\Windows\System\fmYQiFW.exe
  C:\Windows\System\fmYQiFW.exe
  2⤵
  PID:2772
- C:\Windows\System\nXlwEPL.exe
  C:\Windows\System\nXlwEPL.exe
  2⤵
  PID:1064
- C:\Windows\System\RaLaoSU.exe
  C:\Windows\System\RaLaoSU.exe
  2⤵
  PID:2120
- C:\Windows\System\OjgmGEj.exe
  C:\Windows\System\OjgmGEj.exe
  2⤵
  PID:2588
- C:\Windows\System\sARFCMQ.exe
  C:\Windows\System\sARFCMQ.exe
  2⤵
  PID:1612
- C:\Windows\System\vfPxFkG.exe
  C:\Windows\System\vfPxFkG.exe
  2⤵
  PID:3080
- C:\Windows\System\DhXCunv.exe
  C:\Windows\System\DhXCunv.exe
  2⤵
  PID:3144
- C:\Windows\System\YqyqteE.exe
  C:\Windows\System\YqyqteE.exe
  2⤵
  PID:3208
- C:\Windows\System\EoHOJEq.exe
  C:\Windows\System\EoHOJEq.exe
  2⤵
  PID:3272
- C:\Windows\System\qtJbmuA.exe
  C:\Windows\System\qtJbmuA.exe
  2⤵
  PID:3336
- C:\Windows\System\DvxMVmw.exe
  C:\Windows\System\DvxMVmw.exe
  2⤵
  PID:3400
- C:\Windows\System\jekADVy.exe
  C:\Windows\System\jekADVy.exe
  2⤵
  PID:3464
- C:\Windows\System\jGkroMD.exe
  C:\Windows\System\jGkroMD.exe
  2⤵
  PID:3528
- C:\Windows\System\BveIvYo.exe
  C:\Windows\System\BveIvYo.exe
  2⤵
  PID:3592
- C:\Windows\System\coazFdX.exe
  C:\Windows\System\coazFdX.exe
  2⤵
  PID:3656
- C:\Windows\System\ELxlTbx.exe
  C:\Windows\System\ELxlTbx.exe
  2⤵
  PID:3720
- C:\Windows\System\SlSxMmi.exe
  C:\Windows\System\SlSxMmi.exe
  2⤵
  PID:3784
- C:\Windows\System\PgGliAt.exe
  C:\Windows\System\PgGliAt.exe
  2⤵
  PID:3880
- C:\Windows\System\lphYflL.exe
  C:\Windows\System\lphYflL.exe
  2⤵
  PID:3948
- C:\Windows\System\kxahfPj.exe
  C:\Windows\System\kxahfPj.exe
  2⤵
  PID:4012
- C:\Windows\System\EvYELkT.exe
  C:\Windows\System\EvYELkT.exe
  2⤵
  PID:4076
- C:\Windows\System\vtyimSp.exe
  C:\Windows\System\vtyimSp.exe
  2⤵
  PID:3132
- C:\Windows\System\ZzHLfKc.exe
  C:\Windows\System\ZzHLfKc.exe
  2⤵
  PID:3388
- C:\Windows\System\BUnXYSQ.exe
  C:\Windows\System\BUnXYSQ.exe
  2⤵
  PID:3740
- C:\Windows\System\AehfzGJ.exe
  C:\Windows\System\AehfzGJ.exe
  2⤵
  PID:3964
- C:\Windows\System\IGDiQap.exe
  C:\Windows\System\IGDiQap.exe
  2⤵
  PID:3452
- C:\Windows\System\AsQHvIQ.exe
  C:\Windows\System\AsQHvIQ.exe
  2⤵
  PID:4112
- C:\Windows\System\JXzIqaD.exe
  C:\Windows\System\JXzIqaD.exe
  2⤵
  PID:4176
- C:\Windows\System\TNMwIet.exe
  C:\Windows\System\TNMwIet.exe
  2⤵
  PID:4240
- C:\Windows\System\FUdplLF.exe
  C:\Windows\System\FUdplLF.exe
  2⤵
  PID:4304
- C:\Windows\System\BOAvKII.exe
  C:\Windows\System\BOAvKII.exe
  2⤵
  PID:4368
- C:\Windows\System\piLkIRL.exe
  C:\Windows\System\piLkIRL.exe
  2⤵
  PID:4432
- C:\Windows\System\EPkkxld.exe
  C:\Windows\System\EPkkxld.exe
  2⤵
  PID:4524
- C:\Windows\System\GhUGrlk.exe
  C:\Windows\System\GhUGrlk.exe
  2⤵
  PID:4588
- C:\Windows\System\KhFsLDi.exe
  C:\Windows\System\KhFsLDi.exe
  2⤵
  PID:3060
- C:\Windows\System\BRwSUMg.exe
  C:\Windows\System\BRwSUMg.exe
  2⤵
  PID:4752
- C:\Windows\System\pmqnvgt.exe
  C:\Windows\System\pmqnvgt.exe
  2⤵
  PID:4848
- C:\Windows\System\KLlyQuh.exe
  C:\Windows\System\KLlyQuh.exe
  2⤵
  PID:4944
- C:\Windows\System\DOlniQG.exe
  C:\Windows\System\DOlniQG.exe
  2⤵
  PID:1732
- C:\Windows\System\eidIVCt.exe
  C:\Windows\System\eidIVCt.exe
  2⤵
  PID:5004
- C:\Windows\System\OJGKMrU.exe
  C:\Windows\System\OJGKMrU.exe
  2⤵
  PID:5012
- C:\Windows\System\dLSoCIQ.exe
  C:\Windows\System\dLSoCIQ.exe
  2⤵
  PID:1468
- C:\Windows\System\vDVoLNw.exe
  C:\Windows\System\vDVoLNw.exe
  2⤵
  PID:1908
- C:\Windows\System\FgRNHdR.exe
  C:\Windows\System\FgRNHdR.exe
  2⤵
  PID:5036
- C:\Windows\System\MvSkNYi.exe
  C:\Windows\System\MvSkNYi.exe
  2⤵
  PID:904
- C:\Windows\System\QwCNGOE.exe
  C:\Windows\System\QwCNGOE.exe
  2⤵
  PID:5060
- C:\Windows\System\utBeBQc.exe
  C:\Windows\System\utBeBQc.exe
  2⤵
  PID:580
- C:\Windows\System\Bdydiba.exe
  C:\Windows\System\Bdydiba.exe
  2⤵
  PID:4460
- C:\Windows\System\wbfxkfn.exe
  C:\Windows\System\wbfxkfn.exe
  2⤵
  PID:4748
- C:\Windows\System\ciucaDO.exe
  C:\Windows\System\ciucaDO.exe
  2⤵
  PID:4912
- C:\Windows\System\EqhESQf.exe
  C:\Windows\System\EqhESQf.exe
  2⤵
  PID:4928
- C:\Windows\System\vumDntF.exe
  C:\Windows\System\vumDntF.exe
  2⤵
  PID:4960
- C:\Windows\System\XJsMLoT.exe
  C:\Windows\System\XJsMLoT.exe
  2⤵
  PID:1600
- C:\Windows\System\mUsBkjf.exe
  C:\Windows\System\mUsBkjf.exe
  2⤵
  PID:2396
- C:\Windows\System\aLxNByp.exe
  C:\Windows\System\aLxNByp.exe
  2⤵
  PID:2524
- C:\Windows\System\DIHXsgz.exe
  C:\Windows\System\DIHXsgz.exe
  2⤵
  PID:1236
- C:\Windows\System\EHGXFWp.exe
  C:\Windows\System\EHGXFWp.exe
  2⤵
  PID:5072
- C:\Windows\System\KGZyAiC.exe
  C:\Windows\System\KGZyAiC.exe
  2⤵
  PID:5092
- C:\Windows\System\bFnjJsj.exe
  C:\Windows\System\bFnjJsj.exe
  2⤵
  PID:5108
- C:\Windows\System\nckdjCu.exe
  C:\Windows\System\nckdjCu.exe
  2⤵
  PID:3672
- C:\Windows\System\wDVdPID.exe
  C:\Windows\System\wDVdPID.exe
  2⤵
  PID:4124
- C:\Windows\System\jMwoHge.exe
  C:\Windows\System\jMwoHge.exe
  2⤵
  PID:4188
- C:\Windows\System\IDhLWri.exe
  C:\Windows\System\IDhLWri.exe
  2⤵
  PID:4220
- C:\Windows\System\DATdxir.exe
  C:\Windows\System\DATdxir.exe
  2⤵
  PID:4284
- C:\Windows\System\iJSgnPl.exe
  C:\Windows\System\iJSgnPl.exe
  2⤵
  PID:4320
- C:\Windows\System\HrGUcFS.exe
  C:\Windows\System\HrGUcFS.exe
  2⤵
  PID:2948
- C:\Windows\System\jdjTrBB.exe
  C:\Windows\System\jdjTrBB.exe
  2⤵
  PID:4412
- C:\Windows\System\AzLEtlx.exe
  C:\Windows\System\AzLEtlx.exe
  2⤵
  PID:1880
- C:\Windows\System\scZDAfq.exe
  C:\Windows\System\scZDAfq.exe
  2⤵
  PID:4512
- C:\Windows\System\nmhktWw.exe
  C:\Windows\System\nmhktWw.exe
  2⤵
  PID:4576
- C:\Windows\System\TWketQn.exe
  C:\Windows\System\TWketQn.exe
  2⤵
  PID:1220
- C:\Windows\System\DyCVacM.exe
  C:\Windows\System\DyCVacM.exe
  2⤵
  PID:4668
- C:\Windows\System\tRZxhTZ.exe
  C:\Windows\System\tRZxhTZ.exe
  2⤵
  PID:4732
- C:\Windows\System\yTHecnP.exe
  C:\Windows\System\yTHecnP.exe
  2⤵
  PID:1576
- C:\Windows\System\VKLkaPu.exe
  C:\Windows\System\VKLkaPu.exe
  2⤵
  PID:1652
- C:\Windows\System\NsBdUQa.exe
  C:\Windows\System\NsBdUQa.exe
  2⤵
  PID:1328
- C:\Windows\System\pipctTJ.exe
  C:\Windows\System\pipctTJ.exe
  2⤵
  PID:4796
- C:\Windows\System\aXYtybR.exe
  C:\Windows\System\aXYtybR.exe
  2⤵
  PID:4832
- C:\Windows\System\aiRsAvp.exe
  C:\Windows\System\aiRsAvp.exe
  2⤵
  PID:268
- C:\Windows\System\HWkfIzg.exe
  C:\Windows\System\HWkfIzg.exe
  2⤵
  PID:616
- C:\Windows\System\IoswWEw.exe
  C:\Windows\System\IoswWEw.exe
  2⤵
  PID:2136
- C:\Windows\System\uOCRYYj.exe
  C:\Windows\System\uOCRYYj.exe
  2⤵
  PID:3240
- C:\Windows\System\iurWfPJ.exe
  C:\Windows\System\iurWfPJ.exe
  2⤵
  PID:972
- C:\Windows\System\JoopgnX.exe
  C:\Windows\System\JoopgnX.exe
  2⤵
  PID:2112
- C:\Windows\System\tpcgYaN.exe
  C:\Windows\System\tpcgYaN.exe
  2⤵
  PID:3624
- C:\Windows\System\hvPrcAg.exe
  C:\Windows\System\hvPrcAg.exe
  2⤵
  PID:3180
- C:\Windows\System\HDNCBvY.exe
  C:\Windows\System\HDNCBvY.exe
  2⤵
  PID:3432
- C:\Windows\System\qgBAMIY.exe
  C:\Windows\System\qgBAMIY.exe
  2⤵
  PID:3560
- C:\Windows\System\vhewcsB.exe
  C:\Windows\System\vhewcsB.exe
  2⤵
  PID:3692
- C:\Windows\System\FyhCZSE.exe
  C:\Windows\System\FyhCZSE.exe
  2⤵
  PID:4072
- C:\Windows\System\KGdhdQs.exe
  C:\Windows\System\KGdhdQs.exe
  2⤵
  PID:3864
- C:\Windows\System\aLPWUzQ.exe
  C:\Windows\System\aLPWUzQ.exe
  2⤵
  PID:3128
- C:\Windows\System\UqVhjnG.exe
  C:\Windows\System\UqVhjnG.exe
  2⤵
  PID:3900
- C:\Windows\System\uksMCKL.exe
  C:\Windows\System\uksMCKL.exe
  2⤵
  PID:4092
- C:\Windows\System\uImDVjj.exe
  C:\Windows\System\uImDVjj.exe
  2⤵
  PID:4172
- C:\Windows\System\AQunrRh.exe
  C:\Windows\System\AQunrRh.exe
  2⤵
  PID:4620
- C:\Windows\System\EAdMkNM.exe
  C:\Windows\System\EAdMkNM.exe
  2⤵
  PID:4844
- C:\Windows\System\OOGxata.exe
  C:\Windows\System\OOGxata.exe
  2⤵
  PID:1656
- C:\Windows\System\euveSVv.exe
  C:\Windows\System\euveSVv.exe
  2⤵
  PID:4428
- C:\Windows\System\vdXqEWc.exe
  C:\Windows\System\vdXqEWc.exe
  2⤵
  PID:4720
- C:\Windows\System\BxhSlns.exe
  C:\Windows\System\BxhSlns.exe
  2⤵
  PID:5000
- C:\Windows\System\yOMHNBA.exe
  C:\Windows\System\yOMHNBA.exe
  2⤵
  PID:5016
- C:\Windows\System\QQjHPHk.exe
  C:\Windows\System\QQjHPHk.exe
  2⤵
  PID:5048
- C:\Windows\System\HvCqTik.exe
  C:\Windows\System\HvCqTik.exe
  2⤵
  PID:4688
- C:\Windows\System\rFRbJLx.exe
  C:\Windows\System\rFRbJLx.exe
  2⤵
  PID:4988
- C:\Windows\System\YELkdsM.exe
  C:\Windows\System\YELkdsM.exe
  2⤵
  PID:4780
- C:\Windows\System\qaUWBrU.exe
  C:\Windows\System\qaUWBrU.exe
  2⤵
  PID:5068
- C:\Windows\System\JMlbrnx.exe
  C:\Windows\System\JMlbrnx.exe
  2⤵
  PID:5104
- C:\Windows\System\nXJtXxo.exe
  C:\Windows\System\nXJtXxo.exe
  2⤵
  PID:2736
- C:\Windows\System\YtuKfMH.exe
  C:\Windows\System\YtuKfMH.exe
  2⤵
  PID:4316
- C:\Windows\System\UVLMDOW.exe
  C:\Windows\System\UVLMDOW.exe
  2⤵
  PID:1988
- C:\Windows\System\qPpLGAl.exe
  C:\Windows\System\qPpLGAl.exe
  2⤵
  PID:2608
- C:\Windows\System\koIlyoI.exe
  C:\Windows\System\koIlyoI.exe
  2⤵
  PID:4156
- C:\Windows\System\AAUcmsS.exe
  C:\Windows\System\AAUcmsS.exe
  2⤵
  PID:4256
- C:\Windows\System\XQVDpxo.exe
  C:\Windows\System\XQVDpxo.exe
  2⤵
  PID:4480
- C:\Windows\System\tZNJxum.exe
  C:\Windows\System\tZNJxum.exe
  2⤵
  PID:2176
- C:\Windows\System\XCsZIqV.exe
  C:\Windows\System\XCsZIqV.exe
  2⤵
  PID:4572
- C:\Windows\System\VqjoixQ.exe
  C:\Windows\System\VqjoixQ.exe
  2⤵
  PID:4704
- C:\Windows\System\BUVHixI.exe
  C:\Windows\System\BUVHixI.exe
  2⤵
  PID:3056
- C:\Windows\System\llnkjLx.exe
  C:\Windows\System\llnkjLx.exe
  2⤵
  PID:2620
- C:\Windows\System\cqkCPJn.exe
  C:\Windows\System\cqkCPJn.exe
  2⤵
  PID:612
- C:\Windows\System\BOzgiZd.exe
  C:\Windows\System\BOzgiZd.exe
  2⤵
  PID:3368
- C:\Windows\System\gnILQUo.exe
  C:\Windows\System\gnILQUo.exe
  2⤵
  PID:2408
- C:\Windows\System\iGvfYGT.exe
  C:\Windows\System\iGvfYGT.exe
  2⤵
  PID:3564
- C:\Windows\System\ndwlIXn.exe
  C:\Windows\System\ndwlIXn.exe
  2⤵
  PID:3436
- C:\Windows\System\CNxIMup.exe
  C:\Windows\System\CNxIMup.exe
  2⤵
  PID:4044
- C:\Windows\System\cDWAGpS.exe
  C:\Windows\System\cDWAGpS.exe
  2⤵
  PID:1640
- C:\Windows\System\xZSlcRt.exe
  C:\Windows\System\xZSlcRt.exe
  2⤵
  PID:4236
- C:\Windows\System\EwJstWj.exe
  C:\Windows\System\EwJstWj.exe
  2⤵
  PID:4364
- C:\Windows\System\xdSDEOP.exe
  C:\Windows\System\xdSDEOP.exe
  2⤵
  PID:3000
- C:\Windows\System\abglgvR.exe
  C:\Windows\System\abglgvR.exe
  2⤵
  PID:4300
- C:\Windows\System\OjfqSvO.exe
  C:\Windows\System\OjfqSvO.exe
  2⤵
  PID:4656
- C:\Windows\System\zJgbyuV.exe
  C:\Windows\System\zJgbyuV.exe
  2⤵
  PID:2196
- C:\Windows\System\rhpQHmM.exe
  C:\Windows\System\rhpQHmM.exe
  2⤵
  PID:1464
- C:\Windows\System\aZntIpg.exe
  C:\Windows\System\aZntIpg.exe
  2⤵
  PID:4400
- C:\Windows\System\hAhKuRl.exe
  C:\Windows\System\hAhKuRl.exe
  2⤵
  PID:5056
- C:\Windows\System\VthAHLD.exe
  C:\Windows\System\VthAHLD.exe
  2⤵
  PID:2080
- C:\Windows\System\przazHH.exe
  C:\Windows\System\przazHH.exe
  2⤵
  PID:2688
- C:\Windows\System\oFCZIpv.exe
  C:\Windows\System\oFCZIpv.exe
  2⤵
  PID:5100
- C:\Windows\System\EOIDgge.exe
  C:\Windows\System\EOIDgge.exe
  2⤵
  PID:2668
- C:\Windows\System\JnqvShZ.exe
  C:\Windows\System\JnqvShZ.exe
  2⤵
  PID:4636
- C:\Windows\System\AOPqrTA.exe
  C:\Windows\System\AOPqrTA.exe
  2⤵
  PID:2016
- C:\Windows\System\LtzHmAY.exe
  C:\Windows\System\LtzHmAY.exe
  2⤵
  PID:1032
- C:\Windows\System\HHjDRgv.exe
  C:\Windows\System\HHjDRgv.exe
  2⤵
  PID:1996
- C:\Windows\System\nrbYfoe.exe
  C:\Windows\System\nrbYfoe.exe
  2⤵
  PID:4448
- C:\Windows\System\zNGZPTx.exe
  C:\Windows\System\zNGZPTx.exe
  2⤵
  PID:4348
- C:\Windows\System\GmjyJWe.exe
  C:\Windows\System\GmjyJWe.exe
  2⤵
  PID:3500
- C:\Windows\System\aroiuhK.exe
  C:\Windows\System\aroiuhK.exe
  2⤵
  PID:3820
- C:\Windows\System\NZoSOUT.exe
  C:\Windows\System\NZoSOUT.exe
  2⤵
  PID:3640
- C:\Windows\System\ohiQHPO.exe
  C:\Windows\System\ohiQHPO.exe
  2⤵
  PID:2568
- C:\Windows\System\GRzIcMN.exe
  C:\Windows\System\GRzIcMN.exe
  2⤵
  PID:4560
- C:\Windows\System\hVREdpe.exe
  C:\Windows\System\hVREdpe.exe
  2⤵
  PID:2816
- C:\Windows\System\yAZifoh.exe
  C:\Windows\System\yAZifoh.exe
  2⤵
  PID:2024
- C:\Windows\System\QBXYSFP.exe
  C:\Windows\System\QBXYSFP.exe
  2⤵
  PID:2496
- C:\Windows\System\HUooFtv.exe
  C:\Windows\System\HUooFtv.exe
  2⤵
  PID:1632
- C:\Windows\System\bXwFgON.exe
  C:\Windows\System\bXwFgON.exe
  2⤵
  PID:4160
- C:\Windows\System\EIlhKAZ.exe
  C:\Windows\System\EIlhKAZ.exe
  2⤵
  PID:2532
- C:\Windows\System\wfrBxTB.exe
  C:\Windows\System\wfrBxTB.exe
  2⤵
  PID:2784
- C:\Windows\System\mEzOBVr.exe
  C:\Windows\System\mEzOBVr.exe
  2⤵
  PID:1768
- C:\Windows\System\BjlFDgH.exe
  C:\Windows\System\BjlFDgH.exe
  2⤵
  PID:2148
- C:\Windows\System\cNWNpfy.exe
  C:\Windows\System\cNWNpfy.exe
  2⤵
  PID:4252
- C:\Windows\System\BMgHQwF.exe
  C:\Windows\System\BMgHQwF.exe
  2⤵
  PID:1960
- C:\Windows\System\fRrMqJa.exe
  C:\Windows\System\fRrMqJa.exe
  2⤵
  PID:1748
- C:\Windows\System\FdQWrZn.exe
  C:\Windows\System\FdQWrZn.exe
  2⤵
  PID:2060
- C:\Windows\System\mloQwJb.exe
  C:\Windows\System\mloQwJb.exe
  2⤵
  PID:1076
- C:\Windows\System\qZYhtSq.exe
  C:\Windows\System\qZYhtSq.exe
  2⤵
  PID:4956
- C:\Windows\System\cMAVkRc.exe
  C:\Windows\System\cMAVkRc.exe
  2⤵
  PID:2952
- C:\Windows\System\ZtnTidb.exe
  C:\Windows\System\ZtnTidb.exe
  2⤵
  PID:1676
- C:\Windows\System\rRxoHYg.exe
  C:\Windows\System\rRxoHYg.exe
  2⤵
  PID:2576
- C:\Windows\System\VHTOPwk.exe
  C:\Windows\System\VHTOPwk.exe
  2⤵
  PID:2664
- C:\Windows\System\glTgYCD.exe
  C:\Windows\System\glTgYCD.exe
  2⤵
  PID:976
- C:\Windows\System\SLnpiyQ.exe
  C:\Windows\System\SLnpiyQ.exe
  2⤵
  PID:5136
- C:\Windows\System\UdonDNm.exe
  C:\Windows\System\UdonDNm.exe
  2⤵
  PID:5152
- C:\Windows\System\bOYcbDm.exe
  C:\Windows\System\bOYcbDm.exe
  2⤵
  PID:5168
- C:\Windows\System\kjVgGDi.exe
  C:\Windows\System\kjVgGDi.exe
  2⤵
  PID:5184
- C:\Windows\System\OCWBXId.exe
  C:\Windows\System\OCWBXId.exe
  2⤵
  PID:5200
- C:\Windows\System\sMWxyqN.exe
  C:\Windows\System\sMWxyqN.exe
  2⤵
  PID:5216
- C:\Windows\System\SIRbLhD.exe
  C:\Windows\System\SIRbLhD.exe
  2⤵
  PID:5232
- C:\Windows\System\lyfeKbh.exe
  C:\Windows\System\lyfeKbh.exe
  2⤵
  PID:5248
- C:\Windows\System\SAJUpBv.exe
  C:\Windows\System\SAJUpBv.exe
  2⤵
  PID:5264
- C:\Windows\System\apEIlDA.exe
  C:\Windows\System\apEIlDA.exe
  2⤵
  PID:5280
- C:\Windows\System\IcmgnVA.exe
  C:\Windows\System\IcmgnVA.exe
  2⤵
  PID:5296
- C:\Windows\System\mfkEDIY.exe
  C:\Windows\System\mfkEDIY.exe
  2⤵
  PID:5312
- C:\Windows\System\dzlrBKR.exe
  C:\Windows\System\dzlrBKR.exe
  2⤵
  PID:5328
- C:\Windows\System\XEUOTmk.exe
  C:\Windows\System\XEUOTmk.exe
  2⤵
  PID:5344
- C:\Windows\System\jjEbvoZ.exe
  C:\Windows\System\jjEbvoZ.exe
  2⤵
  PID:5360
- C:\Windows\System\lErAVDx.exe
  C:\Windows\System\lErAVDx.exe
  2⤵
  PID:5376
- C:\Windows\System\NkSWHji.exe
  C:\Windows\System\NkSWHji.exe
  2⤵
  PID:5392
- C:\Windows\System\womFptA.exe
  C:\Windows\System\womFptA.exe
  2⤵
  PID:5408
- C:\Windows\System\uqyZmKC.exe
  C:\Windows\System\uqyZmKC.exe
  2⤵
  PID:5424
- C:\Windows\System\naHgyTX.exe
  C:\Windows\System\naHgyTX.exe
  2⤵
  PID:5440
- C:\Windows\System\dTZoEhk.exe
  C:\Windows\System\dTZoEhk.exe
  2⤵
  PID:5456
- C:\Windows\System\WnJBdud.exe
  C:\Windows\System\WnJBdud.exe
  2⤵
  PID:5472
- C:\Windows\System\oYNAlfU.exe
  C:\Windows\System\oYNAlfU.exe
  2⤵
  PID:5488
- C:\Windows\System\cxjkElA.exe
  C:\Windows\System\cxjkElA.exe
  2⤵
  PID:5504
- C:\Windows\System\RbRxeXn.exe
  C:\Windows\System\RbRxeXn.exe
  2⤵
  PID:5520
- C:\Windows\System\oQSedRt.exe
  C:\Windows\System\oQSedRt.exe
  2⤵
  PID:5536
- C:\Windows\System\nvKsjEo.exe
  C:\Windows\System\nvKsjEo.exe
  2⤵
  PID:5552
- C:\Windows\System\OFKXflr.exe
  C:\Windows\System\OFKXflr.exe
  2⤵
  PID:5568
- C:\Windows\System\ZfbuPdb.exe
  C:\Windows\System\ZfbuPdb.exe
  2⤵
  PID:5584
- C:\Windows\System\ihJMuCw.exe
  C:\Windows\System\ihJMuCw.exe
  2⤵
  PID:5600
- C:\Windows\System\FdvKBrA.exe
  C:\Windows\System\FdvKBrA.exe
  2⤵
  PID:5616
- C:\Windows\System\uXuVJVU.exe
  C:\Windows\System\uXuVJVU.exe
  2⤵
  PID:5632
- C:\Windows\System\TsERNyJ.exe
  C:\Windows\System\TsERNyJ.exe
  2⤵
  PID:5648
- C:\Windows\System\gBSFLMK.exe
  C:\Windows\System\gBSFLMK.exe
  2⤵
  PID:5664
- C:\Windows\System\pxDgdOO.exe
  C:\Windows\System\pxDgdOO.exe
  2⤵
  PID:5680
- C:\Windows\System\yBsItNo.exe
  C:\Windows\System\yBsItNo.exe
  2⤵
  PID:5696
- C:\Windows\System\yFclZkf.exe
  C:\Windows\System\yFclZkf.exe
  2⤵
  PID:5712
- C:\Windows\System\hVIwapu.exe
  C:\Windows\System\hVIwapu.exe
  2⤵
  PID:5728
- C:\Windows\System\eddTBmB.exe
  C:\Windows\System\eddTBmB.exe
  2⤵
  PID:5744
- C:\Windows\System\zGPVlQm.exe
  C:\Windows\System\zGPVlQm.exe
  2⤵
  PID:5760
- C:\Windows\System\zCkDLUc.exe
  C:\Windows\System\zCkDLUc.exe
  2⤵
  PID:5776
- C:\Windows\System\iqrLTBi.exe
  C:\Windows\System\iqrLTBi.exe
  2⤵
  PID:5792
- C:\Windows\System\TuCbtgI.exe
  C:\Windows\System\TuCbtgI.exe
  2⤵
  PID:5808
- C:\Windows\System\YxfoDEI.exe
  C:\Windows\System\YxfoDEI.exe
  2⤵
  PID:5824
- C:\Windows\System\iQxLJxU.exe
  C:\Windows\System\iQxLJxU.exe
  2⤵
  PID:5844
- C:\Windows\System\ezxcUiw.exe
  C:\Windows\System\ezxcUiw.exe
  2⤵
  PID:5860
- C:\Windows\System\AJTpnAM.exe
  C:\Windows\System\AJTpnAM.exe
  2⤵
  PID:5880
- C:\Windows\System\sJHDDUd.exe
  C:\Windows\System\sJHDDUd.exe
  2⤵
  PID:5896
- C:\Windows\System\kiGUqKY.exe
  C:\Windows\System\kiGUqKY.exe
  2⤵
  PID:5912
- C:\Windows\System\OIJcZsw.exe
  C:\Windows\System\OIJcZsw.exe
  2⤵
  PID:5928
- C:\Windows\System\BVvGeNn.exe
  C:\Windows\System\BVvGeNn.exe
  2⤵
  PID:5944
- C:\Windows\System\XVTztXd.exe
  C:\Windows\System\XVTztXd.exe
  2⤵
  PID:5960
- C:\Windows\System\EgAFTHL.exe
  C:\Windows\System\EgAFTHL.exe
  2⤵
  PID:5976
- C:\Windows\System\hdlCQrv.exe
  C:\Windows\System\hdlCQrv.exe
  2⤵
  PID:5992
- C:\Windows\System\GcMATDo.exe
  C:\Windows\System\GcMATDo.exe
  2⤵
  PID:6008
- C:\Windows\System\vxozFDF.exe
  C:\Windows\System\vxozFDF.exe
  2⤵
  PID:6024
- C:\Windows\System\MtyADax.exe
  C:\Windows\System\MtyADax.exe
  2⤵
  PID:6040
- C:\Windows\System\mLdYiYE.exe
  C:\Windows\System\mLdYiYE.exe
  2⤵
  PID:6056
- C:\Windows\System\uHhfSMD.exe
  C:\Windows\System\uHhfSMD.exe
  2⤵
  PID:6072
- C:\Windows\System\xZAOVAF.exe
  C:\Windows\System\xZAOVAF.exe
  2⤵
  PID:6088
- C:\Windows\System\CmLignw.exe
  C:\Windows\System\CmLignw.exe
  2⤵
  PID:6104
- C:\Windows\System\YYKzALj.exe
  C:\Windows\System\YYKzALj.exe
  2⤵
  PID:6120
- C:\Windows\System\AgXOpze.exe
  C:\Windows\System\AgXOpze.exe
  2⤵
  PID:6136
- C:\Windows\System\yXMcyuZ.exe
  C:\Windows\System\yXMcyuZ.exe
  2⤵
  PID:5128
- C:\Windows\System\fHtfGvL.exe
  C:\Windows\System\fHtfGvL.exe
  2⤵
  PID:408
- C:\Windows\System\oUVNipO.exe
  C:\Windows\System\oUVNipO.exe
  2⤵
  PID:1020
- C:\Windows\System\WGvKRsc.exe
  C:\Windows\System\WGvKRsc.exe
  2⤵
  PID:5192
- C:\Windows\System\WHqzhcW.exe
  C:\Windows\System\WHqzhcW.exe
  2⤵
  PID:5224
- C:\Windows\System\bsHYYwu.exe
  C:\Windows\System\bsHYYwu.exe
  2⤵
  PID:1888
- C:\Windows\System\VNBJcWd.exe
  C:\Windows\System\VNBJcWd.exe
  2⤵
  PID:5324
- C:\Windows\System\nxukXqB.exe
  C:\Windows\System\nxukXqB.exe
  2⤵
  PID:5388
- C:\Windows\System\MczeSrQ.exe
  C:\Windows\System\MczeSrQ.exe
  2⤵
  PID:5452
- C:\Windows\System\bWOrbVr.exe
  C:\Windows\System\bWOrbVr.exe
  2⤵
  PID:1060
- C:\Windows\System\yhiGTkP.exe
  C:\Windows\System\yhiGTkP.exe
  2⤵
  PID:5480
- C:\Windows\System\HFPACDL.exe
  C:\Windows\System\HFPACDL.exe
  2⤵
  PID:2184
- C:\Windows\System\dPKjIuh.exe
  C:\Windows\System\dPKjIuh.exe
  2⤵
  PID:5548
- C:\Windows\System\IrjpcgO.exe
  C:\Windows\System\IrjpcgO.exe
  2⤵
  PID:2692
- C:\Windows\System\XHMyCYd.exe
  C:\Windows\System\XHMyCYd.exe
  2⤵
  PID:5672
- C:\Windows\System\zisSwvG.exe
  C:\Windows\System\zisSwvG.exe
  2⤵
  PID:5704
- C:\Windows\System\TmnJoaN.exe
  C:\Windows\System\TmnJoaN.exe
  2⤵
  PID:5464
- C:\Windows\System\gRDaUbR.exe
  C:\Windows\System\gRDaUbR.exe
  2⤵
  PID:5276
- C:\Windows\System\fBDrmnF.exe
  C:\Windows\System\fBDrmnF.exe
  2⤵
  PID:5208
- C:\Windows\System\pyWnCnj.exe
  C:\Windows\System\pyWnCnj.exe
  2⤵
  PID:5336
- C:\Windows\System\zquXeFh.exe
  C:\Windows\System\zquXeFh.exe
  2⤵
  PID:5404
- C:\Windows\System\nmumYDc.exe
  C:\Windows\System\nmumYDc.exe
  2⤵
  PID:5500
- C:\Windows\System\RFevHpe.exe
  C:\Windows\System\RFevHpe.exe
  2⤵
  PID:5564
- C:\Windows\System\yBXExQW.exe
  C:\Windows\System\yBXExQW.exe
  2⤵
  PID:5628
- C:\Windows\System\HWebiOu.exe
  C:\Windows\System\HWebiOu.exe
  2⤵
  PID:5724
- C:\Windows\System\PWnVXNu.exe
  C:\Windows\System\PWnVXNu.exe
  2⤵
  PID:5752
- C:\Windows\System\uBrIfHD.exe
  C:\Windows\System\uBrIfHD.exe
  2⤵
  PID:1904
- C:\Windows\System\vmsImnj.exe
  C:\Windows\System\vmsImnj.exe
  2⤵
  PID:5804
- C:\Windows\System\RLwjutq.exe
  C:\Windows\System\RLwjutq.exe
  2⤵
  PID:2276
- C:\Windows\System\ukBlvqK.exe
  C:\Windows\System\ukBlvqK.exe
  2⤵
  PID:5836
- C:\Windows\System\WMHsUlJ.exe
  C:\Windows\System\WMHsUlJ.exe
  2⤵
  PID:5908
- C:\Windows\System\DcaITWO.exe
  C:\Windows\System\DcaITWO.exe
  2⤵
  PID:5968
- C:\Windows\System\FxAHMOr.exe
  C:\Windows\System\FxAHMOr.exe
  2⤵
  PID:6036
- C:\Windows\System\udOYdGy.exe
  C:\Windows\System\udOYdGy.exe
  2⤵
  PID:6068
- C:\Windows\System\EFxaYVo.exe
  C:\Windows\System\EFxaYVo.exe
  2⤵
  PID:6132
- C:\Windows\System\qLJuCpY.exe
  C:\Windows\System\qLJuCpY.exe
  2⤵
  PID:6016
- C:\Windows\System\jQVEUid.exe
  C:\Windows\System\jQVEUid.exe
  2⤵
  PID:5952
- C:\Windows\System\ftcCenB.exe
  C:\Windows\System\ftcCenB.exe
  2⤵
  PID:5892
- C:\Windows\System\IDZpjbB.exe
  C:\Windows\System\IDZpjbB.exe
  2⤵
  PID:5984
- C:\Windows\System\cLDXstF.exe
  C:\Windows\System\cLDXstF.exe
  2⤵
  PID:1336
- C:\Windows\System\YhJWAWt.exe
  C:\Windows\System\YhJWAWt.exe
  2⤵
  PID:2332
- C:\Windows\System\ZIWZfBe.exe
  C:\Windows\System\ZIWZfBe.exe
  2⤵
  PID:4908
- C:\Windows\System\deJqdWH.exe
  C:\Windows\System\deJqdWH.exe
  2⤵
  PID:5352
- C:\Windows\System\iEophvg.exe
  C:\Windows\System\iEophvg.exe
  2⤵
  PID:5512
- C:\Windows\System\YSjbPQX.exe
  C:\Windows\System\YSjbPQX.exe
  2⤵
  PID:5608
- C:\Windows\System\agMASWf.exe
  C:\Windows\System\agMASWf.exe
  2⤵
  PID:2464
- C:\Windows\System\edyyoBS.exe
  C:\Windows\System\edyyoBS.exe
  2⤵
  PID:5640
- C:\Windows\System\zyzVJWl.exe
  C:\Windows\System\zyzVJWl.exe
  2⤵
  PID:5288
- C:\Windows\System\CSYqTVL.exe
  C:\Windows\System\CSYqTVL.exe
  2⤵
  PID:5176
- C:\Windows\System\VVCQKIL.exe
  C:\Windows\System\VVCQKIL.exe
  2⤵
  PID:5308
- C:\Windows\System\iWMCYrU.exe
  C:\Windows\System\iWMCYrU.exe
  2⤵
  PID:2936
- C:\Windows\System\GcZsCyf.exe
  C:\Windows\System\GcZsCyf.exe
  2⤵
  PID:5560
- C:\Windows\System\XAunxpP.exe
  C:\Windows\System\XAunxpP.exe
  2⤵
  PID:5688
- C:\Windows\System\CuNADuI.exe
  C:\Windows\System\CuNADuI.exe
  2⤵
  PID:5784
- C:\Windows\System\VtRUqcU.exe
  C:\Windows\System\VtRUqcU.exe
  2⤵
  PID:5800
- C:\Windows\System\BqAbxWJ.exe
  C:\Windows\System\BqAbxWJ.exe
  2⤵
  PID:6000
- C:\Windows\System\YwyPaeX.exe
  C:\Windows\System\YwyPaeX.exe
  2⤵
  PID:6080
- C:\Windows\System\WQImSxq.exe
  C:\Windows\System\WQImSxq.exe
  2⤵
  PID:5832
- C:\Windows\System\guCTwGe.exe
  C:\Windows\System\guCTwGe.exe
  2⤵
  PID:4608
- C:\Windows\System\qFAyOQP.exe
  C:\Windows\System\qFAyOQP.exe
  2⤵
  PID:6052
- C:\Windows\System\poMxWNC.exe
  C:\Windows\System\poMxWNC.exe
  2⤵
  PID:5924
- C:\Windows\System\RbJorRO.exe
  C:\Windows\System\RbJorRO.exe
  2⤵
  PID:5516
- C:\Windows\System\NHQdjAB.exe
  C:\Windows\System\NHQdjAB.exe
  2⤵
  PID:5436
- C:\Windows\System\SKZmvPh.exe
  C:\Windows\System\SKZmvPh.exe
  2⤵
  PID:5772
- C:\Windows\System\VROcGcS.exe
  C:\Windows\System\VROcGcS.exe
  2⤵
  PID:6128
- C:\Windows\System\ZGVPBFs.exe
  C:\Windows\System\ZGVPBFs.exe
  2⤵
  PID:5788
- C:\Windows\System\tRtVBVq.exe
  C:\Windows\System\tRtVBVq.exe
  2⤵
  PID:880
- C:\Windows\System\dzepFmR.exe
  C:\Windows\System\dzepFmR.exe
  2⤵
  PID:5676
- C:\Windows\System\aAWVsAg.exe
  C:\Windows\System\aAWVsAg.exe
  2⤵
  PID:5368
- C:\Windows\System\vuzrBrY.exe
  C:\Windows\System\vuzrBrY.exe
  2⤵
  PID:5532
- C:\Windows\System\xodugcs.exe
  C:\Windows\System\xodugcs.exe
  2⤵
  PID:6116
- C:\Windows\System\Jclwsvx.exe
  C:\Windows\System\Jclwsvx.exe
  2⤵
  PID:2020
- C:\Windows\System\zJrnzRT.exe
  C:\Windows\System\zJrnzRT.exe
  2⤵
  PID:584
- C:\Windows\System\pQYfXbu.exe
  C:\Windows\System\pQYfXbu.exe
  2⤵
  PID:5904
- C:\Windows\System\kXsfslB.exe
  C:\Windows\System\kXsfslB.exe
  2⤵
  PID:5856
- C:\Windows\System\GWVCffB.exe
  C:\Windows\System\GWVCffB.exe
  2⤵
  PID:6148
- C:\Windows\System\SdvCibj.exe
  C:\Windows\System\SdvCibj.exe
  2⤵
  PID:6164
- C:\Windows\System\IIHRniI.exe
  C:\Windows\System\IIHRniI.exe
  2⤵
  PID:6180
- C:\Windows\System\vZhvmko.exe
  C:\Windows\System\vZhvmko.exe
  2⤵
  PID:6196
- C:\Windows\System\hyfDCNk.exe
  C:\Windows\System\hyfDCNk.exe
  2⤵
  PID:6212
- C:\Windows\System\wGUTpID.exe
  C:\Windows\System\wGUTpID.exe
  2⤵
  PID:6228
- C:\Windows\System\fWBbPvI.exe
  C:\Windows\System\fWBbPvI.exe
  2⤵
  PID:6244
- C:\Windows\System\gnLIzRY.exe
  C:\Windows\System\gnLIzRY.exe
  2⤵
  PID:6260
- C:\Windows\System\cmKVpKr.exe
  C:\Windows\System\cmKVpKr.exe
  2⤵
  PID:6276
- C:\Windows\System\qjlEaPI.exe
  C:\Windows\System\qjlEaPI.exe
  2⤵
  PID:6292
- C:\Windows\System\MDrCEGK.exe
  C:\Windows\System\MDrCEGK.exe
  2⤵
  PID:6308
- C:\Windows\System\HSZNkNh.exe
  C:\Windows\System\HSZNkNh.exe
  2⤵
  PID:6324
- C:\Windows\System\GHIySoa.exe
  C:\Windows\System\GHIySoa.exe
  2⤵
  PID:6340
- C:\Windows\System\yLvLBAs.exe
  C:\Windows\System\yLvLBAs.exe
  2⤵
  PID:6356
- C:\Windows\System\RJKRXwl.exe
  C:\Windows\System\RJKRXwl.exe
  2⤵
  PID:6372
- C:\Windows\System\oHbwWQN.exe
  C:\Windows\System\oHbwWQN.exe
  2⤵
  PID:6388
- C:\Windows\System\PHnGeAZ.exe
  C:\Windows\System\PHnGeAZ.exe
  2⤵
  PID:6404
- C:\Windows\System\xrEyBpq.exe
  C:\Windows\System\xrEyBpq.exe
  2⤵
  PID:6420
- C:\Windows\System\qTZSoSa.exe
  C:\Windows\System\qTZSoSa.exe
  2⤵
  PID:6436
- C:\Windows\System\TbxWsDc.exe
  C:\Windows\System\TbxWsDc.exe
  2⤵
  PID:6452
- C:\Windows\System\MtoIeJW.exe
  C:\Windows\System\MtoIeJW.exe
  2⤵
  PID:6476
- C:\Windows\System\fHuBkde.exe
  C:\Windows\System\fHuBkde.exe
  2⤵
  PID:6520
- C:\Windows\System\ixIPrbf.exe
  C:\Windows\System\ixIPrbf.exe
  2⤵
  PID:6596
- C:\Windows\System\LbDlZfA.exe
  C:\Windows\System\LbDlZfA.exe
  2⤵
  PID:6616
- C:\Windows\System\MFntlrU.exe
  C:\Windows\System\MFntlrU.exe
  2⤵
  PID:6636
- C:\Windows\System\GIwXfOf.exe
  C:\Windows\System\GIwXfOf.exe
  2⤵
  PID:6656
- C:\Windows\System\ivYCjbc.exe
  C:\Windows\System\ivYCjbc.exe
  2⤵
  PID:6672
- C:\Windows\System\SxAaeYA.exe
  C:\Windows\System\SxAaeYA.exe
  2⤵
  PID:6688
- C:\Windows\System\zbUfTTL.exe
  C:\Windows\System\zbUfTTL.exe
  2⤵
  PID:6704
- C:\Windows\System\BQMLQbv.exe
  C:\Windows\System\BQMLQbv.exe
  2⤵
  PID:6720
- C:\Windows\System\CqxnwsG.exe
  C:\Windows\System\CqxnwsG.exe
  2⤵
  PID:6760
- C:\Windows\System\XSKAOul.exe
  C:\Windows\System\XSKAOul.exe
  2⤵
  PID:6780
- C:\Windows\System\GwqZXPo.exe
  C:\Windows\System\GwqZXPo.exe
  2⤵
  PID:6796
- C:\Windows\System\LVVQusA.exe
  C:\Windows\System\LVVQusA.exe
  2⤵
  PID:6812
- C:\Windows\System\veTUPuQ.exe
  C:\Windows\System\veTUPuQ.exe
  2⤵
  PID:6896
- C:\Windows\System\mHkqxND.exe
  C:\Windows\System\mHkqxND.exe
  2⤵
  PID:6920
- C:\Windows\System\AOdneME.exe
  C:\Windows\System\AOdneME.exe
  2⤵
  PID:6952
- C:\Windows\System\XPlfCPD.exe
  C:\Windows\System\XPlfCPD.exe
  2⤵
  PID:6976
- C:\Windows\System\egqNkAk.exe
  C:\Windows\System\egqNkAk.exe
  2⤵
  PID:6996
- C:\Windows\System\MlmKgPe.exe
  C:\Windows\System\MlmKgPe.exe
  2⤵
  PID:7016
- C:\Windows\System\gKYqHXi.exe
  C:\Windows\System\gKYqHXi.exe
  2⤵
  PID:7084
- C:\Windows\System\MoolluD.exe
  C:\Windows\System\MoolluD.exe
  2⤵
  PID:7100
- C:\Windows\System\tKFBPoa.exe
  C:\Windows\System\tKFBPoa.exe
  2⤵
  PID:7156
- C:\Windows\System\mpSTRvL.exe
  C:\Windows\System\mpSTRvL.exe
  2⤵
  PID:6336
- C:\Windows\System\mVrpcoI.exe
  C:\Windows\System\mVrpcoI.exe
  2⤵
  PID:5260
- C:\Windows\System\lvZbdXE.exe
  C:\Windows\System\lvZbdXE.exe
  2⤵
  PID:6348
- C:\Windows\System\NfIEDlb.exe
  C:\Windows\System\NfIEDlb.exe
  2⤵
  PID:6220
- C:\Windows\System\UsehvzJ.exe
  C:\Windows\System\UsehvzJ.exe
  2⤵
  PID:6484
- C:\Windows\System\OHQiTmT.exe
  C:\Windows\System\OHQiTmT.exe
  2⤵
  PID:6604
- C:\Windows\System\KEWjMDh.exe
  C:\Windows\System\KEWjMDh.exe
  2⤵
  PID:6700
- C:\Windows\System\aHHUOzB.exe
  C:\Windows\System\aHHUOzB.exe
  2⤵
  PID:6772
- C:\Windows\System\CuTZkue.exe
  C:\Windows\System\CuTZkue.exe
  2⤵
  PID:6832
- C:\Windows\System\BljIStt.exe
  C:\Windows\System\BljIStt.exe
  2⤵
  PID:6912
- C:\Windows\System\XjNYEAG.exe
  C:\Windows\System\XjNYEAG.exe
  2⤵
  PID:6828
- C:\Windows\System\mkOLSFo.exe
  C:\Windows\System\mkOLSFo.exe
  2⤵
  PID:6864
- C:\Windows\System\JoJkwME.exe
  C:\Windows\System\JoJkwME.exe
  2⤵
  PID:6932
- C:\Windows\System\NfTkPWR.exe
  C:\Windows\System\NfTkPWR.exe
  2⤵
  PID:6928
- C:\Windows\System\IXNhXBT.exe
  C:\Windows\System\IXNhXBT.exe
  2⤵
  PID:7004
- C:\Windows\System\JDGQuag.exe
  C:\Windows\System\JDGQuag.exe
  2⤵
  PID:7092
- C:\Windows\System\CoSASXK.exe
  C:\Windows\System\CoSASXK.exe
  2⤵
  PID:7032
- C:\Windows\System\KtkvxXV.exe
  C:\Windows\System\KtkvxXV.exe
  2⤵
  PID:7048
- C:\Windows\System\CSctqwd.exe
  C:\Windows\System\CSctqwd.exe
  2⤵
  PID:7108
- C:\Windows\System\CCzklTg.exe
  C:\Windows\System\CCzklTg.exe
  2⤵
  PID:7136
- C:\Windows\System\hTJuimH.exe
  C:\Windows\System\hTJuimH.exe
  2⤵
  PID:7148
- C:\Windows\System\NyAnCEi.exe
  C:\Windows\System\NyAnCEi.exe
  2⤵
  PID:5496
- C:\Windows\System\plzmbVP.exe
  C:\Windows\System\plzmbVP.exe
  2⤵
  PID:4864
- C:\Windows\System\fjLdSkv.exe
  C:\Windows\System\fjLdSkv.exe
  2⤵
  PID:6268
- C:\Windows\System\HCcltNT.exe
  C:\Windows\System\HCcltNT.exe
  2⤵
  PID:6396
- C:\Windows\System\RkqCDHE.exe
  C:\Windows\System\RkqCDHE.exe
  2⤵
  PID:6160
- C:\Windows\System\ufTONbV.exe
  C:\Windows\System\ufTONbV.exe
  2⤵
  PID:6384
- C:\Windows\System\KSlEhiV.exe
  C:\Windows\System\KSlEhiV.exe
  2⤵
  PID:6460
- C:\Windows\System\TDzzxad.exe
  C:\Windows\System\TDzzxad.exe
  2⤵
  PID:6496
- C:\Windows\System\gyTTJaS.exe
  C:\Windows\System\gyTTJaS.exe
  2⤵
  PID:6560
- C:\Windows\System\COTgyAg.exe
  C:\Windows\System\COTgyAg.exe
  2⤵
  PID:6532
- C:\Windows\System\WWntQAw.exe
  C:\Windows\System\WWntQAw.exe
  2⤵
  PID:6592
- C:\Windows\System\SwgQbGs.exe
  C:\Windows\System\SwgQbGs.exe
  2⤵
  PID:6536
- C:\Windows\System\cLJYzAn.exe
  C:\Windows\System\cLJYzAn.exe
  2⤵
  PID:6628
- C:\Windows\System\VwIrfbg.exe
  C:\Windows\System\VwIrfbg.exe
  2⤵
  PID:6664
- C:\Windows\System\UwzCNxb.exe
  C:\Windows\System\UwzCNxb.exe
  2⤵
  PID:6756
- C:\Windows\System\XzHPBuJ.exe
  C:\Windows\System\XzHPBuJ.exe
  2⤵
  PID:7176
- C:\Windows\System\IFvsBmC.exe
  C:\Windows\System\IFvsBmC.exe
  2⤵
  PID:7200
- C:\Windows\System\UkNLpoo.exe
  C:\Windows\System\UkNLpoo.exe
  2⤵
  PID:7224
- C:\Windows\System\YLBuJeo.exe
  C:\Windows\System\YLBuJeo.exe
  2⤵
  PID:7240
- C:\Windows\System\ABRDPOy.exe
  C:\Windows\System\ABRDPOy.exe
  2⤵
  PID:7256
- C:\Windows\System\OPBUAwa.exe
  C:\Windows\System\OPBUAwa.exe
  2⤵
  PID:7272
- C:\Windows\System\SEWkbqv.exe
  C:\Windows\System\SEWkbqv.exe
  2⤵
  PID:7288
- C:\Windows\System\Bmzgvib.exe
  C:\Windows\System\Bmzgvib.exe
  2⤵
  PID:7304
- C:\Windows\System\zbwLHAA.exe
  C:\Windows\System\zbwLHAA.exe
  2⤵
  PID:7320
- C:\Windows\System\pHvxHlM.exe
  C:\Windows\System\pHvxHlM.exe
  2⤵
  PID:7336
- C:\Windows\System\QxjNGGT.exe
  C:\Windows\System\QxjNGGT.exe
  2⤵
  PID:7352
- C:\Windows\System\vezBhSc.exe
  C:\Windows\System\vezBhSc.exe
  2⤵
  PID:7368
- C:\Windows\System\VKAsfeq.exe
  C:\Windows\System\VKAsfeq.exe
  2⤵
  PID:7384
- C:\Windows\System\RNEtCRW.exe
  C:\Windows\System\RNEtCRW.exe
  2⤵
  PID:7404
- C:\Windows\System\amkwmpl.exe
  C:\Windows\System\amkwmpl.exe
  2⤵
  PID:7420
- C:\Windows\System\QYAKPsu.exe
  C:\Windows\System\QYAKPsu.exe
  2⤵
  PID:7436
- C:\Windows\System\fVTtATv.exe
  C:\Windows\System\fVTtATv.exe
  2⤵
  PID:7456
- C:\Windows\System\NZtBEhz.exe
  C:\Windows\System\NZtBEhz.exe
  2⤵
  PID:7472
- C:\Windows\System\XWHgtDu.exe
  C:\Windows\System\XWHgtDu.exe
  2⤵
  PID:7488
- C:\Windows\System\XSQHAhy.exe
  C:\Windows\System\XSQHAhy.exe
  2⤵
  PID:7508
- C:\Windows\System\KQHuZAc.exe
  C:\Windows\System\KQHuZAc.exe
  2⤵
  PID:7716
- C:\Windows\System\cTjIAVA.exe
  C:\Windows\System\cTjIAVA.exe
  2⤵
  PID:7732
- C:\Windows\System\NTYMeXf.exe
  C:\Windows\System\NTYMeXf.exe
  2⤵
  PID:7748
- C:\Windows\System\caUCRxF.exe
  C:\Windows\System\caUCRxF.exe
  2⤵
  PID:7764
- C:\Windows\System\UGPgjaN.exe
  C:\Windows\System\UGPgjaN.exe
  2⤵
  PID:7780
- C:\Windows\System\NjwNbnt.exe
  C:\Windows\System\NjwNbnt.exe
  2⤵
  PID:7796
- C:\Windows\System\IeGmxXw.exe
  C:\Windows\System\IeGmxXw.exe
  2⤵
  PID:7812
- C:\Windows\System\LQRNrRt.exe
  C:\Windows\System\LQRNrRt.exe
  2⤵
  PID:7828
- C:\Windows\System\TskazPN.exe
  C:\Windows\System\TskazPN.exe
  2⤵
  PID:7844
- C:\Windows\System\tWVOXSX.exe
  C:\Windows\System\tWVOXSX.exe
  2⤵
  PID:7860
- C:\Windows\System\ahhIuBc.exe
  C:\Windows\System\ahhIuBc.exe
  2⤵
  PID:7876
- C:\Windows\System\XxhHiGa.exe
  C:\Windows\System\XxhHiGa.exe
  2⤵
  PID:7892
- C:\Windows\System\jOBNech.exe
  C:\Windows\System\jOBNech.exe
  2⤵
  PID:7908
- C:\Windows\System\nkYSDBq.exe
  C:\Windows\System\nkYSDBq.exe
  2⤵
  PID:7924
- C:\Windows\System\SGMcNMS.exe
  C:\Windows\System\SGMcNMS.exe
  2⤵
  PID:7940
- C:\Windows\System\tQhYVZt.exe
  C:\Windows\System\tQhYVZt.exe
  2⤵
  PID:7956
- C:\Windows\System\vYQhjKq.exe
  C:\Windows\System\vYQhjKq.exe
  2⤵
  PID:7972
- C:\Windows\System\jTLQJom.exe
  C:\Windows\System\jTLQJom.exe
  2⤵
  PID:7988
- C:\Windows\System\WwFFwpV.exe
  C:\Windows\System\WwFFwpV.exe
  2⤵
  PID:8004
- C:\Windows\System\TWkbxPs.exe
  C:\Windows\System\TWkbxPs.exe
  2⤵
  PID:8020
- C:\Windows\System\jEwxsnL.exe
  C:\Windows\System\jEwxsnL.exe
  2⤵
  PID:8036
- C:\Windows\System\tGagbAQ.exe
  C:\Windows\System\tGagbAQ.exe
  2⤵
  PID:8080
- C:\Windows\System\NLTHOsX.exe
  C:\Windows\System\NLTHOsX.exe
  2⤵
  PID:8096
- C:\Windows\System\FFNAjZI.exe
  C:\Windows\System\FFNAjZI.exe
  2⤵
  PID:8112
- C:\Windows\System\XHtPaAb.exe
  C:\Windows\System\XHtPaAb.exe
  2⤵
  PID:8128
- C:\Windows\System\gjCcymj.exe
  C:\Windows\System\gjCcymj.exe
  2⤵
  PID:8144
- C:\Windows\System\BKbnEhi.exe
  C:\Windows\System\BKbnEhi.exe
  2⤵
  PID:8160
- C:\Windows\System\YYcBmwJ.exe
  C:\Windows\System\YYcBmwJ.exe
  2⤵
  PID:8176
- C:\Windows\System\IcdIEiu.exe
  C:\Windows\System\IcdIEiu.exe
  2⤵
  PID:6904
- C:\Windows\System\JXkufiK.exe
  C:\Windows\System\JXkufiK.exe
  2⤵
  PID:6860
- C:\Windows\System\jbSOxWD.exe
  C:\Windows\System\jbSOxWD.exe
  2⤵
  PID:7024
- C:\Windows\System\LjSuBVs.exe
  C:\Windows\System\LjSuBVs.exe
  2⤵
  PID:7056
- C:\Windows\System\TYsvmlx.exe
  C:\Windows\System\TYsvmlx.exe
  2⤵
  PID:7116
- C:\Windows\System\gEfptsI.exe
  C:\Windows\System\gEfptsI.exe
  2⤵
  PID:6176
- C:\Windows\System\MnupWke.exe
  C:\Windows\System\MnupWke.exe
  2⤵
  PID:6252
- C:\Windows\System\SuBVwuJ.exe
  C:\Windows\System\SuBVwuJ.exe
  2⤵
  PID:6416
- C:\Windows\System\cJhZPyG.exe
  C:\Windows\System\cJhZPyG.exe
  2⤵
  PID:5144
- C:\Windows\System\ElBucEM.exe
  C:\Windows\System\ElBucEM.exe
  2⤵
  PID:6572
- C:\Windows\System\tjYaWNt.exe
  C:\Windows\System\tjYaWNt.exe
  2⤵
  PID:6508
- C:\Windows\System\rriCIlI.exe
  C:\Windows\System\rriCIlI.exe
  2⤵
  PID:6512
- C:\Windows\System\JFxEbRy.exe
  C:\Windows\System\JFxEbRy.exe
  2⤵
  PID:7232
- C:\Windows\System\FZUsUYc.exe
  C:\Windows\System\FZUsUYc.exe
  2⤵
  PID:7268
- C:\Windows\System\YITNjJI.exe
  C:\Windows\System\YITNjJI.exe
  2⤵
  PID:7300
- C:\Windows\System\vWscNEE.exe
  C:\Windows\System\vWscNEE.exe
  2⤵
  PID:7332
- C:\Windows\System\QtyBnXx.exe
  C:\Windows\System\QtyBnXx.exe
  2⤵
  PID:6740
- C:\Windows\System\YWAGKze.exe
  C:\Windows\System\YWAGKze.exe
  2⤵
  PID:7188
- C:\Windows\System\JSgjwDz.exe
  C:\Windows\System\JSgjwDz.exe
  2⤵
  PID:7464
- C:\Windows\System\VZnVmhb.exe
  C:\Windows\System\VZnVmhb.exe
  2⤵
  PID:7392
- C:\Windows\System\pTOynuE.exe
  C:\Windows\System\pTOynuE.exe
  2⤵
  PID:7096
- C:\Windows\System\nrxaLSs.exe
  C:\Windows\System\nrxaLSs.exe
  2⤵
  PID:7620
- C:\Windows\System\pRmcdsg.exe
  C:\Windows\System\pRmcdsg.exe
  2⤵
  PID:6824
- C:\Windows\System\FeQxRqG.exe
  C:\Windows\System\FeQxRqG.exe
  2⤵
  PID:6880
- C:\Windows\System\WEkUgQe.exe
  C:\Windows\System\WEkUgQe.exe
  2⤵
  PID:6888
- C:\Windows\System\LMIyuWz.exe
  C:\Windows\System\LMIyuWz.exe
  2⤵
  PID:6948
- C:\Windows\System\fZVBSij.exe
  C:\Windows\System\fZVBSij.exe
  2⤵
  PID:7036
- C:\Windows\System\mDgyWoB.exe
  C:\Windows\System\mDgyWoB.exe
  2⤵
  PID:5448
- C:\Windows\System\EnxLmdy.exe
  C:\Windows\System\EnxLmdy.exe
  2⤵
  PID:5768
- C:\Windows\System\dggJBze.exe
  C:\Windows\System\dggJBze.exe
  2⤵
  PID:6316
- C:\Windows\System\PoNjbpF.exe
  C:\Windows\System\PoNjbpF.exe
  2⤵
  PID:7144
- C:\Windows\System\ydVKVCJ.exe
  C:\Windows\System\ydVKVCJ.exe
  2⤵
  PID:6556
- C:\Windows\System\BlWsCvb.exe
  C:\Windows\System\BlWsCvb.exe
  2⤵
  PID:6528
- C:\Windows\System\FxiuKkt.exe
  C:\Windows\System\FxiuKkt.exe
  2⤵
  PID:6632
- C:\Windows\System\BEALlel.exe
  C:\Windows\System\BEALlel.exe
  2⤵
  PID:7208
- C:\Windows\System\grAAhFl.exe
  C:\Windows\System\grAAhFl.exe
  2⤵
  PID:7280
- C:\Windows\System\OxPizwn.exe
  C:\Windows\System\OxPizwn.exe
  2⤵
  PID:7344
- C:\Windows\System\BlQkGuZ.exe
  C:\Windows\System\BlQkGuZ.exe
  2⤵
  PID:7484
- C:\Windows\System\zjQxNNF.exe
  C:\Windows\System\zjQxNNF.exe
  2⤵
  PID:7532
- C:\Windows\System\xIbQvMd.exe
  C:\Windows\System\xIbQvMd.exe
  2⤵
  PID:7552
- C:\Windows\System\rIzujMw.exe
  C:\Windows\System\rIzujMw.exe
  2⤵
  PID:7612
- C:\Windows\System\XchkJgG.exe
  C:\Windows\System\XchkJgG.exe
  2⤵
  PID:7936
- C:\Windows\System\SumCtwa.exe
  C:\Windows\System\SumCtwa.exe
  2⤵
  PID:8200
- C:\Windows\System\qXHooTV.exe
  C:\Windows\System\qXHooTV.exe
  2⤵
  PID:8216
- C:\Windows\System\AGrabRT.exe
  C:\Windows\System\AGrabRT.exe
  2⤵
  PID:8236
- C:\Windows\System\PkiFqbX.exe
  C:\Windows\System\PkiFqbX.exe
  2⤵
  PID:8252
- C:\Windows\System\nnWdxdA.exe
  C:\Windows\System\nnWdxdA.exe
  2⤵
  PID:8268
- C:\Windows\System\KnYvzad.exe
  C:\Windows\System\KnYvzad.exe
  2⤵
  PID:8284
- C:\Windows\System\HDQYZlq.exe
  C:\Windows\System\HDQYZlq.exe
  2⤵
  PID:8300
- C:\Windows\System\vZOvpyz.exe
  C:\Windows\System\vZOvpyz.exe
  2⤵
  PID:8324
- C:\Windows\System\sdAXvdz.exe
  C:\Windows\System\sdAXvdz.exe
  2⤵
  PID:8340
- C:\Windows\System\CvVBQSS.exe
  C:\Windows\System\CvVBQSS.exe
  2⤵
  PID:8360
- C:\Windows\System\sitetvh.exe
  C:\Windows\System\sitetvh.exe
  2⤵
  PID:8376
- C:\Windows\System\XKrknGo.exe
  C:\Windows\System\XKrknGo.exe
  2⤵
  PID:8396
- C:\Windows\System\RMKHmoI.exe
  C:\Windows\System\RMKHmoI.exe
  2⤵
  PID:8416
- C:\Windows\System\xsbQWmj.exe
  C:\Windows\System\xsbQWmj.exe
  2⤵
  PID:8436
- C:\Windows\System\SuiVEBn.exe
  C:\Windows\System\SuiVEBn.exe
  2⤵
  PID:8452
- C:\Windows\System\cFZdyvL.exe
  C:\Windows\System\cFZdyvL.exe
  2⤵
  PID:8468
- C:\Windows\System\fRFtRwQ.exe
  C:\Windows\System\fRFtRwQ.exe
  2⤵
  PID:8484
- C:\Windows\System\cdWqpDu.exe
  C:\Windows\System\cdWqpDu.exe
  2⤵
  PID:8500
- C:\Windows\System\MdMOQOP.exe
  C:\Windows\System\MdMOQOP.exe
  2⤵
  PID:8516
- C:\Windows\System\BTWAzet.exe
  C:\Windows\System\BTWAzet.exe
  2⤵
  PID:8532
- C:\Windows\System\wmedUwm.exe
  C:\Windows\System\wmedUwm.exe
  2⤵
  PID:8548
- C:\Windows\System\ehNXEuJ.exe
  C:\Windows\System\ehNXEuJ.exe
  2⤵
  PID:8568
- C:\Windows\System\JvTQWtH.exe
  C:\Windows\System\JvTQWtH.exe
  2⤵
  PID:8584
- C:\Windows\System\UuVFHLW.exe
  C:\Windows\System\UuVFHLW.exe
  2⤵
  PID:8604
- C:\Windows\System\OqZEieJ.exe
  C:\Windows\System\OqZEieJ.exe
  2⤵
  PID:8628
- C:\Windows\System\ilUzceZ.exe
  C:\Windows\System\ilUzceZ.exe
  2⤵
  PID:8644
- C:\Windows\System\vNZuMSK.exe
  C:\Windows\System\vNZuMSK.exe
  2⤵
  PID:8688
- C:\Windows\System\sxPeXti.exe
  C:\Windows\System\sxPeXti.exe
  2⤵
  PID:8704
- C:\Windows\System\CXbtKuv.exe
  C:\Windows\System\CXbtKuv.exe
  2⤵
  PID:8720
- C:\Windows\System\JySsmoB.exe
  C:\Windows\System\JySsmoB.exe
  2⤵
  PID:8736
- C:\Windows\System\kwrKEvI.exe
  C:\Windows\System\kwrKEvI.exe
  2⤵
  PID:8752
- C:\Windows\System\YQpipkJ.exe
  C:\Windows\System\YQpipkJ.exe
  2⤵
  PID:8768
- C:\Windows\System\CCkTuFI.exe
  C:\Windows\System\CCkTuFI.exe
  2⤵
  PID:8784
- C:\Windows\System\iJEmFix.exe
  C:\Windows\System\iJEmFix.exe
  2⤵
  PID:8800
- C:\Windows\System\YVDMeaf.exe
  C:\Windows\System\YVDMeaf.exe
  2⤵
  PID:8816
- C:\Windows\System\vwHqZnn.exe
  C:\Windows\System\vwHqZnn.exe
  2⤵
  PID:8832
- C:\Windows\System\PUHuOMj.exe
  C:\Windows\System\PUHuOMj.exe
  2⤵
  PID:8848
- C:\Windows\System\CsDGvIQ.exe
  C:\Windows\System\CsDGvIQ.exe
  2⤵
  PID:8864
- C:\Windows\System\PkTNqvz.exe
  C:\Windows\System\PkTNqvz.exe
  2⤵
  PID:8884
- C:\Windows\System\JrnJAUZ.exe
  C:\Windows\System\JrnJAUZ.exe
  2⤵
  PID:8900
- C:\Windows\System\sfaGkxj.exe
  C:\Windows\System\sfaGkxj.exe
  2⤵
  PID:8916
- C:\Windows\System\fRdGTQa.exe
  C:\Windows\System\fRdGTQa.exe
  2⤵
  PID:8932
- C:\Windows\System\HVhtFEZ.exe
  C:\Windows\System\HVhtFEZ.exe
  2⤵
  PID:8948
- C:\Windows\System\utsOOwD.exe
  C:\Windows\System\utsOOwD.exe
  2⤵
  PID:8964
- C:\Windows\System\QyYcQMw.exe
  C:\Windows\System\QyYcQMw.exe
  2⤵
  PID:8980
- C:\Windows\System\sdqmVJx.exe
  C:\Windows\System\sdqmVJx.exe
  2⤵
  PID:8996
- C:\Windows\System\bqYzKdM.exe
  C:\Windows\System\bqYzKdM.exe
  2⤵
  PID:9012
- C:\Windows\System\FllLTgB.exe
  C:\Windows\System\FllLTgB.exe
  2⤵
  PID:9028
- C:\Windows\System\ZpOPZlZ.exe
  C:\Windows\System\ZpOPZlZ.exe
  2⤵
  PID:9044
- C:\Windows\System\reJdcuz.exe
  C:\Windows\System\reJdcuz.exe
  2⤵
  PID:9060
- C:\Windows\System\TbbGUuS.exe
  C:\Windows\System\TbbGUuS.exe
  2⤵
  PID:9076
- C:\Windows\System\nQSEQQA.exe
  C:\Windows\System\nQSEQQA.exe
  2⤵
  PID:9092
- C:\Windows\System\AeDOyeV.exe
  C:\Windows\System\AeDOyeV.exe
  2⤵
  PID:9108
- C:\Windows\System\UObuwxn.exe
  C:\Windows\System\UObuwxn.exe
  2⤵
  PID:9124
- C:\Windows\System\kqtGUCg.exe
  C:\Windows\System\kqtGUCg.exe
  2⤵
  PID:9144
- C:\Windows\System\sMAXOFa.exe
  C:\Windows\System\sMAXOFa.exe
  2⤵
  PID:9160
- C:\Windows\System\qUoMZgZ.exe
  C:\Windows\System\qUoMZgZ.exe
  2⤵
  PID:9176
- C:\Windows\System\YmwIyjp.exe
  C:\Windows\System\YmwIyjp.exe
  2⤵
  PID:9192
- C:\Windows\System\aulDPeu.exe
  C:\Windows\System\aulDPeu.exe
  2⤵
  PID:9208
- C:\Windows\System\EVsOgPv.exe
  C:\Windows\System\EVsOgPv.exe
  2⤵
  PID:7696
- C:\Windows\System\tWtYCYT.exe
  C:\Windows\System\tWtYCYT.exe
  2⤵
  PID:7980
- C:\Windows\System\DJvDUEc.exe
  C:\Windows\System\DJvDUEc.exe
  2⤵
  PID:7916
- C:\Windows\System\nsOhTmx.exe
  C:\Windows\System\nsOhTmx.exe
  2⤵
  PID:7852
- C:\Windows\System\ZBbkViD.exe
  C:\Windows\System\ZBbkViD.exe
  2⤵
  PID:7760
- C:\Windows\System\CTSRucp.exe
  C:\Windows\System\CTSRucp.exe
  2⤵
  PID:8044
- C:\Windows\System\wExJoMz.exe
  C:\Windows\System\wExJoMz.exe
  2⤵
  PID:8060
- C:\Windows\System\FNciBJE.exe
  C:\Windows\System\FNciBJE.exe
  2⤵
  PID:8076
- C:\Windows\System\qUqbhQp.exe
  C:\Windows\System\qUqbhQp.exe
  2⤵
  PID:6432
- C:\Windows\System\MlZoOXC.exe
  C:\Windows\System\MlZoOXC.exe
  2⤵
  PID:6712
- C:\Windows\System\BVLQOPK.exe
  C:\Windows\System\BVLQOPK.exe
  2⤵
  PID:7328
- C:\Windows\System\FJFRINY.exe
  C:\Windows\System\FJFRINY.exe
  2⤵
  PID:7500
- C:\Windows\System\ouJZptQ.exe
  C:\Windows\System\ouJZptQ.exe
  2⤵
  PID:7680
- C:\Windows\System\ojARcdx.exe
  C:\Windows\System\ojARcdx.exe
  2⤵
  PID:7068
- C:\Windows\System\WTEKnLo.exe
  C:\Windows\System\WTEKnLo.exe
  2⤵
  PID:6288
- C:\Windows\System\RAAXkyT.exe
  C:\Windows\System\RAAXkyT.exe
  2⤵
  PID:6696
- C:\Windows\System\FyehSUg.exe
  C:\Windows\System\FyehSUg.exe
  2⤵
  PID:7376
- C:\Windows\System\UhcZaRt.exe
  C:\Windows\System\UhcZaRt.exe
  2⤵
  PID:7448
- C:\Windows\System\bJfOVjc.exe
  C:\Windows\System\bJfOVjc.exe
  2⤵
  PID:7544
- C:\Windows\System\wRHbnHd.exe
  C:\Windows\System\wRHbnHd.exe
  2⤵
  PID:7636
- C:\Windows\System\EgVyCsg.exe
  C:\Windows\System\EgVyCsg.exe
  2⤵
  PID:7656
- C:\Windows\System\sdVxdvy.exe
  C:\Windows\System\sdVxdvy.exe
  2⤵
  PID:7676
- C:\Windows\System\AKybmRU.exe
  C:\Windows\System\AKybmRU.exe
  2⤵
  PID:8244
- C:\Windows\System\lYZxleX.exe
  C:\Windows\System\lYZxleX.exe
  2⤵
  PID:8312
- C:\Windows\System\ooiGMlV.exe
  C:\Windows\System\ooiGMlV.exe
  2⤵
  PID:8352
- C:\Windows\System\PxnsVoR.exe
  C:\Windows\System\PxnsVoR.exe
  2⤵
  PID:8388
- C:\Windows\System\IhoWFzN.exe
  C:\Windows\System\IhoWFzN.exe
  2⤵
  PID:8424
- C:\Windows\System\ojGPcNw.exe
  C:\Windows\System\ojGPcNw.exe
  2⤵
  PID:8464
- C:\Windows\System\kyXJkhN.exe
  C:\Windows\System\kyXJkhN.exe
  2⤵
  PID:8496
- C:\Windows\System\sKbgwbf.exe
  C:\Windows\System\sKbgwbf.exe
  2⤵
  PID:8524
- C:\Windows\System\PxdGbvo.exe
  C:\Windows\System\PxdGbvo.exe
  2⤵
  PID:8556
- C:\Windows\System\TZvqlYO.exe
  C:\Windows\System\TZvqlYO.exe
  2⤵
  PID:8248
- C:\Windows\System\OYfpBmQ.exe
  C:\Windows\System\OYfpBmQ.exe
  2⤵
  PID:8592
- C:\Windows\System\EiEOIDW.exe
  C:\Windows\System\EiEOIDW.exe
  2⤵
  PID:6752
- C:\Windows\System\dZFeiXf.exe
  C:\Windows\System\dZFeiXf.exe
  2⤵
  PID:7588
- C:\Windows\System\BZMJmno.exe
  C:\Windows\System\BZMJmno.exe
  2⤵
  PID:7604
- C:\Windows\System\cXWrEat.exe
  C:\Windows\System\cXWrEat.exe
  2⤵
  PID:7808
- C:\Windows\System\iOYjHxD.exe
  C:\Windows\System\iOYjHxD.exe
  2⤵
  PID:8000
- C:\Windows\System\OJhZVTP.exe
  C:\Windows\System\OJhZVTP.exe
  2⤵
  PID:8264
- C:\Windows\System\PVOVXQU.exe
  C:\Windows\System\PVOVXQU.exe
  2⤵
  PID:8540
- C:\Windows\System\AJRHSqH.exe
  C:\Windows\System\AJRHSqH.exe
  2⤵
  PID:8088
- C:\Windows\System\zLEhmsl.exe
  C:\Windows\System\zLEhmsl.exe
  2⤵
  PID:8728
- C:\Windows\System\tKHBLqv.exe
  C:\Windows\System\tKHBLqv.exe
  2⤵
  PID:6100
- C:\Windows\System\RtccdjO.exe
  C:\Windows\System\RtccdjO.exe
  2⤵
  PID:6588
- C:\Windows\System\pviFuwQ.exe
  C:\Windows\System\pviFuwQ.exe
  2⤵
  PID:7564
- C:\Windows\System\BpXPoUL.exe
  C:\Windows\System\BpXPoUL.exe
  2⤵
  PID:8760
- C:\Windows\System\TaShZmL.exe
  C:\Windows\System\TaShZmL.exe
  2⤵
  PID:8412
- C:\Windows\System\IzwsyAR.exe
  C:\Windows\System\IzwsyAR.exe
  2⤵
  PID:8796
- C:\Windows\System\DBzBVVP.exe
  C:\Windows\System\DBzBVVP.exe
  2⤵
  PID:8652
- C:\Windows\System\zubolhb.exe
  C:\Windows\System\zubolhb.exe
  2⤵
  PID:8660
- C:\Windows\System\sVoMPki.exe
  C:\Windows\System\sVoMPki.exe
  2⤵
  PID:8156
- C:\Windows\System\qDCRMRo.exe
  C:\Windows\System\qDCRMRo.exe
  2⤵
  PID:7124
- C:\Windows\System\rFsQXIC.exe
  C:\Windows\System\rFsQXIC.exe
  2⤵
  PID:6320
- C:\Windows\System\cwyhNoc.exe
  C:\Windows\System\cwyhNoc.exe
  2⤵
  PID:7184
- C:\Windows\System\DyZsdMS.exe
  C:\Windows\System\DyZsdMS.exe
  2⤵
  PID:7296
- C:\Windows\System\mbKmLBZ.exe
  C:\Windows\System\mbKmLBZ.exe
  2⤵
  PID:7432
- C:\Windows\System\fDYWvQi.exe
  C:\Windows\System\fDYWvQi.exe
  2⤵
  PID:6876
- C:\Windows\System\hsOZXVj.exe
  C:\Windows\System\hsOZXVj.exe
  2⤵
  PID:7868
- C:\Windows\System\CmnTSXk.exe
  C:\Windows\System\CmnTSXk.exe
  2⤵
  PID:8032
- C:\Windows\System\bSGCChj.exe
  C:\Windows\System\bSGCChj.exe
  2⤵
  PID:8296
- C:\Windows\System\MjPFlcS.exe
  C:\Windows\System\MjPFlcS.exe
  2⤵
  PID:8684
- C:\Windows\System\xlUAMiX.exe
  C:\Windows\System\xlUAMiX.exe
  2⤵
  PID:8476
- C:\Windows\System\WrLCfSi.exe
  C:\Windows\System\WrLCfSi.exe
  2⤵
  PID:8616
- C:\Windows\System\bWDRldf.exe
  C:\Windows\System\bWDRldf.exe
  2⤵
  PID:8812
- C:\Windows\System\ejsDKAG.exe
  C:\Windows\System\ejsDKAG.exe
  2⤵
  PID:8744
- C:\Windows\System\vdLrhJY.exe
  C:\Windows\System\vdLrhJY.exe
  2⤵
  PID:8844
- C:\Windows\System\tiUWvXG.exe
  C:\Windows\System\tiUWvXG.exe
  2⤵
  PID:8908
- C:\Windows\System\WaMMXcj.exe
  C:\Windows\System\WaMMXcj.exe
  2⤵
  PID:8924
- C:\Windows\System\XWudfmH.exe
  C:\Windows\System\XWudfmH.exe
  2⤵
  PID:8988
- C:\Windows\System\IKdyyoJ.exe
  C:\Windows\System\IKdyyoJ.exe
  2⤵
  PID:9052
- C:\Windows\System\MPKVlVZ.exe
  C:\Windows\System\MPKVlVZ.exe
  2⤵
  PID:9116
- C:\Windows\System\uvNnpSv.exe
  C:\Windows\System\uvNnpSv.exe
  2⤵
  PID:9184
- C:\Windows\System\gyiPElb.exe
  C:\Windows\System\gyiPElb.exe
  2⤵
  PID:7920
- C:\Windows\System\aisipeX.exe
  C:\Windows\System\aisipeX.exe
  2⤵
  PID:8052
- C:\Windows\System\IqUBHRz.exe
  C:\Windows\System\IqUBHRz.exe
  2⤵
  PID:8972
- C:\Windows\System\OFBtXts.exe
  C:\Windows\System\OFBtXts.exe
  2⤵
  PID:9036
- C:\Windows\System\dKhjDNA.exe
  C:\Windows\System\dKhjDNA.exe
  2⤵
  PID:8940
- C:\Windows\System\bGbyudl.exe
  C:\Windows\System\bGbyudl.exe
  2⤵
  PID:9072
- C:\Windows\System\bxLlfHY.exe
  C:\Windows\System\bxLlfHY.exe
  2⤵
  PID:9140
- C:\Windows\System\TdIVOHR.exe
  C:\Windows\System\TdIVOHR.exe
  2⤵
  PID:9204
- C:\Windows\System\RMsWtZI.exe
  C:\Windows\System\RMsWtZI.exe
  2⤵
  PID:7724
- C:\Windows\System\bNIVxzG.exe
  C:\Windows\System\bNIVxzG.exe
  2⤵
  PID:8680
- C:\Windows\System\EqVIOBt.exe
  C:\Windows\System\EqVIOBt.exe
  2⤵
  PID:8136
- C:\Windows\System\NTPZDxr.exe
  C:\Windows\System\NTPZDxr.exe
  2⤵
  PID:7252
- C:\Windows\System\oqLghvB.exe
  C:\Windows\System\oqLghvB.exe
  2⤵
  PID:7776
- C:\Windows\System\mOVrsCa.exe
  C:\Windows\System\mOVrsCa.exe
  2⤵
  PID:8260
- C:\Windows\System\rNmncXc.exe
  C:\Windows\System\rNmncXc.exe
  2⤵
  PID:8732
- C:\Windows\System\GWeSEwF.exe
  C:\Windows\System\GWeSEwF.exe
  2⤵
  PID:7416
- C:\Windows\System\NnmrRby.exe
  C:\Windows\System\NnmrRby.exe
  2⤵
  PID:8208
- C:\Windows\System\fdxotZf.exe
  C:\Windows\System\fdxotZf.exe
  2⤵
  PID:7772
- C:\Windows\System\qlchABv.exe
  C:\Windows\System\qlchABv.exe
  2⤵
  PID:8492
- C:\Windows\System\lVPxmgz.exe
  C:\Windows\System\lVPxmgz.exe
  2⤵
  PID:8348
- C:\Windows\System\QReVQcO.exe
  C:\Windows\System\QReVQcO.exe
  2⤵
  PID:6552
- C:\Windows\System\EUbvyDH.exe
  C:\Windows\System\EUbvyDH.exe
  2⤵
  PID:8404
- C:\Windows\System\inRgDzH.exe
  C:\Windows\System\inRgDzH.exe
  2⤵
  PID:6300
- C:\Windows\System\wpmypIB.exe
  C:\Windows\System\wpmypIB.exe
  2⤵
  PID:6964
- C:\Windows\System\HNqLfiM.exe
  C:\Windows\System\HNqLfiM.exe
  2⤵
  PID:8280
- C:\Windows\System\SlnDEMk.exe
  C:\Windows\System\SlnDEMk.exe
  2⤵
  PID:8308
- C:\Windows\System\lEUScwN.exe
  C:\Windows\System\lEUScwN.exe
  2⤵
  PID:8564
- C:\Windows\System\hIXfIyY.exe
  C:\Windows\System\hIXfIyY.exe
  2⤵
  PID:6716
- C:\Windows\System\IZbUBts.exe
  C:\Windows\System\IZbUBts.exe
  2⤵
  PID:8408
- C:\Windows\System\vTKlcsw.exe
  C:\Windows\System\vTKlcsw.exe
  2⤵
  PID:8124
- C:\Windows\System\VOayioC.exe
  C:\Windows\System\VOayioC.exe
  2⤵
  PID:7520
- C:\Windows\System\aVKSisv.exe
  C:\Windows\System\aVKSisv.exe
  2⤵
  PID:6236
- C:\Windows\System\CjqXwId.exe
  C:\Windows\System\CjqXwId.exe
  2⤵
  PID:6820
- C:\Windows\System\GqWgkuW.exe
  C:\Windows\System\GqWgkuW.exe
  2⤵
  PID:7428
- C:\Windows\System\AnEkWle.exe
  C:\Windows\System\AnEkWle.exe
  2⤵
  PID:6984
- C:\Windows\System\REUZVXe.exe
  C:\Windows\System\REUZVXe.exe
  2⤵
  PID:8372
- C:\Windows\System\GHHCllp.exe
  C:\Windows\System\GHHCllp.exe
  2⤵
  PID:8716
- C:\Windows\System\AFsHQJi.exe
  C:\Windows\System\AFsHQJi.exe
  2⤵
  PID:8960
- C:\Windows\System\SBWEmlR.exe
  C:\Windows\System\SBWEmlR.exe
  2⤵
  PID:7692
- C:\Windows\System\xkcZAmM.exe
  C:\Windows\System\xkcZAmM.exe
  2⤵
  PID:7984
- C:\Windows\System\SlYfUmA.exe
  C:\Windows\System\SlYfUmA.exe
  2⤵
  PID:8668
- C:\Windows\System\GKXGFIO.exe
  C:\Windows\System\GKXGFIO.exe
  2⤵
  PID:8808
- C:\Windows\System\QjAvLOW.exe
  C:\Windows\System\QjAvLOW.exe
  2⤵
  PID:8896
- C:\Windows\System\PJMOqUV.exe
  C:\Windows\System\PJMOqUV.exe
  2⤵
  PID:9004
- C:\Windows\System\lSYDRhm.exe
  C:\Windows\System\lSYDRhm.exe
  2⤵
  PID:8224
- C:\Windows\System\mEVFMLU.exe
  C:\Windows\System\mEVFMLU.exe
  2⤵
  PID:6612
- C:\Windows\System\kHNBvFn.exe
  C:\Windows\System\kHNBvFn.exe
  2⤵
  PID:9152
- C:\Windows\System\lraTJKf.exe
  C:\Windows\System\lraTJKf.exe
  2⤵
  PID:8696
- C:\Windows\System\JXIaaht.exe
  C:\Windows\System\JXIaaht.exe
  2⤵
  PID:7572
- C:\Windows\System\vdrJKBl.exe
  C:\Windows\System\vdrJKBl.exe
  2⤵
  PID:7708
- C:\Windows\System\MyLhGBM.exe
  C:\Windows\System\MyLhGBM.exe
  2⤵
  PID:7196
- C:\Windows\System\XvTFQIu.exe
  C:\Windows\System\XvTFQIu.exe
  2⤵
  PID:7380
- C:\Windows\System\QivAqxR.exe
  C:\Windows\System\QivAqxR.exe
  2⤵
  PID:7900
- C:\Windows\System\JoiikgR.exe
  C:\Windows\System\JoiikgR.exe
  2⤵
  PID:6380
- C:\Windows\System\WppzFwg.exe
  C:\Windows\System\WppzFwg.exe
  2⤵
  PID:6472
- C:\Windows\System\bKnshCw.exe
  C:\Windows\System\bKnshCw.exe
  2⤵
  PID:7316
- C:\Windows\System\qaaeEsK.exe
  C:\Windows\System\qaaeEsK.exe
  2⤵
  PID:8512
- C:\Windows\System\xAvOOIE.exe
  C:\Windows\System\xAvOOIE.exe
  2⤵
  PID:6668
- C:\Windows\System\inqOQCb.exe
  C:\Windows\System\inqOQCb.exe
  2⤵
  PID:8580
- C:\Windows\System\uluhLqP.exe
  C:\Windows\System\uluhLqP.exe
  2⤵
  PID:6188
- C:\Windows\System\huSDDoy.exe
  C:\Windows\System\huSDDoy.exe
  2⤵
  PID:8152
- C:\Windows\System\VmzBfbW.exe
  C:\Windows\System\VmzBfbW.exe
  2⤵
  PID:6580
- C:\Windows\System\eDWwlxF.exe
  C:\Windows\System\eDWwlxF.exe
  2⤵
  PID:6744
- C:\Windows\System\rQQlnpG.exe
  C:\Windows\System\rQQlnpG.exe
  2⤵
  PID:9040
- C:\Windows\System\DZUWkhr.exe
  C:\Windows\System\DZUWkhr.exe
  2⤵
  PID:7652
- C:\Windows\System\LDxWrnQ.exe
  C:\Windows\System\LDxWrnQ.exe
  2⤵
  PID:7480
- C:\Windows\System\vDJyfxv.exe
  C:\Windows\System\vDJyfxv.exe
  2⤵
  PID:8432
- C:\Windows\System\RmhgWVU.exe
  C:\Windows\System\RmhgWVU.exe
  2⤵
  PID:9172
- C:\Windows\System\WOHerDz.exe
  C:\Windows\System\WOHerDz.exe
  2⤵
  PID:8368
- C:\Windows\System\fqVpUFe.exe
  C:\Windows\System\fqVpUFe.exe
  2⤵
  PID:7740
- C:\Windows\System\DNAKifg.exe
  C:\Windows\System\DNAKifg.exe
  2⤵
  PID:8384
- C:\Windows\System\EGhweNp.exe
  C:\Windows\System\EGhweNp.exe
  2⤵
  PID:8028
- C:\Windows\System\fsVJVqm.exe
  C:\Windows\System\fsVJVqm.exe
  2⤵
  PID:9084
- C:\Windows\System\fgZQpzK.exe
  C:\Windows\System\fgZQpzK.exe
  2⤵
  PID:7644
- C:\Windows\System\abrzGll.exe
  C:\Windows\System\abrzGll.exe
  2⤵
  PID:7968
- C:\Windows\System\rZmQHWO.exe
  C:\Windows\System\rZmQHWO.exe
  2⤵
  PID:8780
- C:\Windows\System\FUFnKjB.exe
  C:\Windows\System\FUFnKjB.exe
  2⤵
  PID:7672
- C:\Windows\System\TFrtoAa.exe
  C:\Windows\System\TFrtoAa.exe
  2⤵
  PID:8444
- C:\Windows\System\XJpNiQV.exe
  C:\Windows\System\XJpNiQV.exe
  2⤵
  PID:6368
- C:\Windows\System\PnNLMbn.exe
  C:\Windows\System\PnNLMbn.exe
  2⤵
  PID:9024
- C:\Windows\System\VMofLlg.exe
  C:\Windows\System\VMofLlg.exe
  2⤵
  PID:8860
- C:\Windows\System\yTwVLhd.exe
  C:\Windows\System\yTwVLhd.exe
  2⤵
  PID:8640
- C:\Windows\System\EpEVdMl.exe
  C:\Windows\System\EpEVdMl.exe
  2⤵
  PID:9232
- C:\Windows\System\gxvicen.exe
  C:\Windows\System\gxvicen.exe
  2⤵
  PID:9248
- C:\Windows\System\cTrCeZz.exe
  C:\Windows\System\cTrCeZz.exe
  2⤵
  PID:9264
- C:\Windows\System\asHFoiE.exe
  C:\Windows\System\asHFoiE.exe
  2⤵
  PID:9280
- C:\Windows\System\vqtoiLI.exe
  C:\Windows\System\vqtoiLI.exe
  2⤵
  PID:9296
- C:\Windows\System\IBWGGaA.exe
  C:\Windows\System\IBWGGaA.exe
  2⤵
  PID:9312
- C:\Windows\System\aLYQFiJ.exe
  C:\Windows\System\aLYQFiJ.exe
  2⤵
  PID:9328
- C:\Windows\System\NzXVSDW.exe
  C:\Windows\System\NzXVSDW.exe
  2⤵
  PID:9344
- C:\Windows\System\xTdSwuO.exe
  C:\Windows\System\xTdSwuO.exe
  2⤵
  PID:9360
- C:\Windows\System\fsuPWqC.exe
  C:\Windows\System\fsuPWqC.exe
  2⤵
  PID:9376
- C:\Windows\System\onOeZlT.exe
  C:\Windows\System\onOeZlT.exe
  2⤵
  PID:9392
- C:\Windows\System\qjvaQMq.exe
  C:\Windows\System\qjvaQMq.exe
  2⤵
  PID:9408
- C:\Windows\System\TRJuvkO.exe
  C:\Windows\System\TRJuvkO.exe
  2⤵
  PID:9424
- C:\Windows\System\lNHQkuB.exe
  C:\Windows\System\lNHQkuB.exe
  2⤵
  PID:9440
- C:\Windows\System\nkSVpaX.exe
  C:\Windows\System\nkSVpaX.exe
  2⤵
  PID:9456
- C:\Windows\System\mRCTJSG.exe
  C:\Windows\System\mRCTJSG.exe
  2⤵
  PID:9472
- C:\Windows\System\nECEOKf.exe
  C:\Windows\System\nECEOKf.exe
  2⤵
  PID:9488
- C:\Windows\System\mIvdkDD.exe
  C:\Windows\System\mIvdkDD.exe
  2⤵
  PID:9504
- C:\Windows\System\bmdHmfK.exe
  C:\Windows\System\bmdHmfK.exe
  2⤵
  PID:9524
- C:\Windows\System\emspgHp.exe
  C:\Windows\System\emspgHp.exe
  2⤵
  PID:9540
- C:\Windows\System\nZplQew.exe
  C:\Windows\System\nZplQew.exe
  2⤵
  PID:9556
- C:\Windows\System\TkKedlK.exe
  C:\Windows\System\TkKedlK.exe
  2⤵
  PID:9572
- C:\Windows\System\swNoPnC.exe
  C:\Windows\System\swNoPnC.exe
  2⤵
  PID:9588
- C:\Windows\System\dRwgiJf.exe
  C:\Windows\System\dRwgiJf.exe
  2⤵
  PID:9604
- C:\Windows\System\MyFaytK.exe
  C:\Windows\System\MyFaytK.exe
  2⤵
  PID:9620
- C:\Windows\System\DUtlczn.exe
  C:\Windows\System\DUtlczn.exe
  2⤵
  PID:9636
- C:\Windows\System\HtaFAUR.exe
  C:\Windows\System\HtaFAUR.exe
  2⤵
  PID:9652
- C:\Windows\System\WOnvgBd.exe
  C:\Windows\System\WOnvgBd.exe
  2⤵
  PID:9668
- C:\Windows\System\sjDwFCA.exe
  C:\Windows\System\sjDwFCA.exe
  2⤵
  PID:9684
- C:\Windows\System\xaQopYN.exe
  C:\Windows\System\xaQopYN.exe
  2⤵
  PID:9700
- C:\Windows\System\doQZyBm.exe
  C:\Windows\System\doQZyBm.exe
  2⤵
  PID:9716
- C:\Windows\System\MFwaTcK.exe
  C:\Windows\System\MFwaTcK.exe
  2⤵
  PID:9732
- C:\Windows\System\KqUXYGT.exe
  C:\Windows\System\KqUXYGT.exe
  2⤵
  PID:9748
- C:\Windows\System\tlvXfCO.exe
  C:\Windows\System\tlvXfCO.exe
  2⤵
  PID:9764
- C:\Windows\System\gFEHoLg.exe
  C:\Windows\System\gFEHoLg.exe
  2⤵
  PID:9780
- C:\Windows\System\ghzEAZA.exe
  C:\Windows\System\ghzEAZA.exe
  2⤵
  PID:9796
- C:\Windows\System\lFezOiw.exe
  C:\Windows\System\lFezOiw.exe
  2⤵
  PID:9812
- C:\Windows\System\cWInDcU.exe
  C:\Windows\System\cWInDcU.exe
  2⤵
  PID:9828
- C:\Windows\System\ofLoqrA.exe
  C:\Windows\System\ofLoqrA.exe
  2⤵
  PID:9844
- C:\Windows\System\MaXmVID.exe
  C:\Windows\System\MaXmVID.exe
  2⤵
  PID:9860
- C:\Windows\System\NUFfjAg.exe
  C:\Windows\System\NUFfjAg.exe
  2⤵
  PID:9876
- C:\Windows\System\VWyVTbr.exe
  C:\Windows\System\VWyVTbr.exe
  2⤵
  PID:9892
- C:\Windows\System\jRUpCks.exe
  C:\Windows\System\jRUpCks.exe
  2⤵
  PID:9908
- C:\Windows\System\fIAvMqc.exe
  C:\Windows\System\fIAvMqc.exe
  2⤵
  PID:9924
- C:\Windows\System\XhtJWti.exe
  C:\Windows\System\XhtJWti.exe
  2⤵
  PID:9940
- C:\Windows\System\BOroEhE.exe
  C:\Windows\System\BOroEhE.exe
  2⤵
  PID:9956
- C:\Windows\System\BCCQHtw.exe
  C:\Windows\System\BCCQHtw.exe
  2⤵
  PID:9972
- C:\Windows\System\lwfZTCQ.exe
  C:\Windows\System\lwfZTCQ.exe
  2⤵
  PID:9988
- C:\Windows\System\jwIdArO.exe
  C:\Windows\System\jwIdArO.exe
  2⤵
  PID:10004
- C:\Windows\System\yJMhiIi.exe
  C:\Windows\System\yJMhiIi.exe
  2⤵
  PID:10020
- C:\Windows\System\HZpdpuK.exe
  C:\Windows\System\HZpdpuK.exe
  2⤵
  PID:10036
- C:\Windows\System\ZIvPaIf.exe
  C:\Windows\System\ZIvPaIf.exe
  2⤵
  PID:10052
- C:\Windows\System\ZSxPObC.exe
  C:\Windows\System\ZSxPObC.exe
  2⤵
  PID:10068
- C:\Windows\System\CSvTbdF.exe
  C:\Windows\System\CSvTbdF.exe
  2⤵
  PID:10084
- C:\Windows\System\gxhncDV.exe
  C:\Windows\System\gxhncDV.exe
  2⤵
  PID:10100
- C:\Windows\System\yYmYMdd.exe
  C:\Windows\System\yYmYMdd.exe
  2⤵
  PID:10116
- C:\Windows\System\sbzvcTV.exe
  C:\Windows\System\sbzvcTV.exe
  2⤵
  PID:10132
- C:\Windows\System\DGUHcvr.exe
  C:\Windows\System\DGUHcvr.exe
  2⤵
  PID:10148
- C:\Windows\System\telmxBg.exe
  C:\Windows\System\telmxBg.exe
  2⤵
  PID:10164
- C:\Windows\System\WWlBsWs.exe
  C:\Windows\System\WWlBsWs.exe
  2⤵
  PID:10180
- C:\Windows\System\ywnKchf.exe
  C:\Windows\System\ywnKchf.exe
  2⤵
  PID:10196
- C:\Windows\System\BcRQvsk.exe
  C:\Windows\System\BcRQvsk.exe
  2⤵
  PID:10212
- C:\Windows\System\eiRNYPL.exe
  C:\Windows\System\eiRNYPL.exe
  2⤵
  PID:10228
- C:\Windows\System\GyMmgKF.exe
  C:\Windows\System\GyMmgKF.exe
  2⤵
  PID:9228
- C:\Windows\System\CZqyUKa.exe
  C:\Windows\System\CZqyUKa.exe
  2⤵
  PID:9288
- C:\Windows\System\OmDJzwo.exe
  C:\Windows\System\OmDJzwo.exe
  2⤵
  PID:9324
- C:\Windows\System\YWZfCAj.exe
  C:\Windows\System\YWZfCAj.exe
  2⤵
  PID:7668
- C:\Windows\System\WyaCSlG.exe
  C:\Windows\System\WyaCSlG.exe
  2⤵
  PID:9416
- C:\Windows\System\KKLXaDK.exe
  C:\Windows\System\KKLXaDK.exe
  2⤵
  PID:9480
- C:\Windows\System\ZUHUhZt.exe
  C:\Windows\System\ZUHUhZt.exe
  2⤵
  PID:9548
- C:\Windows\System\PfNPvtL.exe
  C:\Windows\System\PfNPvtL.exe
  2⤵
  PID:8012
- C:\Windows\System\jRoDSIf.exe
  C:\Windows\System\jRoDSIf.exe
  2⤵
  PID:9336
- C:\Windows\System\NhTHeCe.exe
  C:\Windows\System\NhTHeCe.exe
  2⤵
  PID:9680
- C:\Windows\System\yqBCQxl.exe
  C:\Windows\System\yqBCQxl.exe
  2⤵
  PID:9712
- C:\Windows\System\gVOICLp.exe
  C:\Windows\System\gVOICLp.exe
  2⤵
  PID:9776
- C:\Windows\System\MIsRZah.exe
  C:\Windows\System\MIsRZah.exe
  2⤵
  PID:9308
- C:\Windows\System\WaYZIYI.exe
  C:\Windows\System\WaYZIYI.exe
  2⤵
  PID:9464
- C:\Windows\System\ZQFjvNT.exe
  C:\Windows\System\ZQFjvNT.exe
  2⤵
  PID:9596
- C:\Windows\System\adhOXIS.exe
  C:\Windows\System\adhOXIS.exe
  2⤵
  PID:9404
- C:\Windows\System\toWEcvl.exe
  C:\Windows\System\toWEcvl.exe
  2⤵
  PID:9788
- C:\Windows\System\SQiJphY.exe
  C:\Windows\System\SQiJphY.exe
  2⤵
  PID:9724
- C:\Windows\System\CdCQjGJ.exe
  C:\Windows\System\CdCQjGJ.exe
  2⤵
  PID:9660
- C:\Windows\System\QykkNbG.exe
  C:\Windows\System\QykkNbG.exe
  2⤵
  PID:9532
- C:\Windows\System\VtmCgwt.exe
  C:\Windows\System\VtmCgwt.exe
  2⤵
  PID:9820
- C:\Windows\System\xnUIpIZ.exe
  C:\Windows\System\xnUIpIZ.exe
  2⤵
  PID:9872
- C:\Windows\System\JlwPAOT.exe
  C:\Windows\System\JlwPAOT.exe
  2⤵
  PID:9936
- C:\Windows\System\HQJPfse.exe
  C:\Windows\System\HQJPfse.exe
  2⤵
  PID:10000
- C:\Windows\System\dMzqqnz.exe
  C:\Windows\System\dMzqqnz.exe
  2⤵
  PID:10064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BvtgxKi.exe

Filesize
2.2MB

MD5
0cf8399de5e400a63dc1e19d957d623c

SHA1
44c1c56cdd7e305e69bdcc663ed68627d51d8368

SHA256
e0b2d9c2460c74f4cb8d382c3dac1b7ac03fb841c09dd99b469a85b17d6a62cf

SHA512
6f238fbf7506fbc4eb7345ccaab53432dd9f5b4c39a2c28a13c8dc9945daa7e6f0c24011a347191e3c067ca906e520cd924f7d47b92b59cde4dee60d84ed7610

Download Submit
C:\Windows\system\CnYwJWU.exe

Filesize
2.2MB

MD5
1751f0d6bec04e299adfb6c8c41a5963

SHA1
5be8a44cb8f31ead496fbdf3853f6c942169767f

SHA256
3dbb34f9eb85bdd81601216a6dff4641445f55a13f30ce93f70555998ebecc26

SHA512
0753d97d8fd17f3fa7c28506495c1d2389c553b3fda73e13f83802abe03462446b22819799bb86fc58ee45965b51402a3079ec475273b132cc2d797a4a7aae80

Download Submit
C:\Windows\system\EPLUiin.exe

Filesize
2.2MB

MD5
22a4dc57d8e1df701e1a988a30a94bf3

SHA1
22f56635eeddc3969e3539f056cf417508bf3a43

SHA256
4fe90045aaee9d0998feb7067a1b70e17be20142eea3c93e116858a02ce40cd4

SHA512
6c555c54aab4bb5fbdfc79415506c9f25c00052e57579a4d4fde2de5571ac98cc2cdfc48dac8cab8bcb69b97a3e5d28ec9601154c85221e054429cf47b712600

Download Submit
C:\Windows\system\HwTSjPt.exe

Filesize
2.2MB

MD5
18cfea32c613c13fde1f9463ee4b097a

SHA1
20ff7a19b24cd63520fcad5949db8e012279eb7a

SHA256
d02b305beb6248991a17424b9392138137d1ad1ef59e5d288b7fcff9b687dae5

SHA512
636b6be0881086bb65bc3e3c49b15622f92fe66be9839fa6d9ef694014e421dbad557df13a92f9f949be080fcc6613f8ba15bf4b3f22e81e1c0bf848c7066368

Download Submit
C:\Windows\system\JQBQTar.exe

Filesize
2.2MB

MD5
736431bddac142316810dd59d3c81e18

SHA1
32347228a04be156af91edf62e8e2b96c5dff85a

SHA256
e48e67bf4b80b8ca316d420edafecdcaee98274e00cd3d2f0eb4d774a7b62797

SHA512
ffeede42a0702644379d2ee5d998029d16c7e045fa6f44c04f3ae8ba3ad535b8203afa711ced9bae4dacea6d8018bb2417865d4fc5cb9312f0c04ddcfdd3cc0a

Download Submit
C:\Windows\system\KaeKxNj.exe

Filesize
2.2MB

MD5
4d8ed0383610e2755ac80143616b3901

SHA1
47855e7096ae9e9c7dac29688d0ba7dec6624449

SHA256
b657e64465aabbb1f25eb2d9f0f46dceb3f5fb9e4a77f9da37595279d0db022f

SHA512
f078af78a1a77d3d64bbe7bfb4f48ca423270ef5d535512bf3796c70c99438d94c5f8a72463d46f561540af5f7265f1d9ced3feb2cdab35f639b68810922df9d

Download Submit
C:\Windows\system\LVWyEZl.exe

Filesize
2.2MB

MD5
37190ae66479881c6c2d7716e9bd30c3

SHA1
cc36c3343185d5798939b1c88265b2f109bf395d

SHA256
26884a227a0c6118121278dc73333f51de860e3ac9979e125128b814f0e2b210

SHA512
6a3191ab831b417e584847cd51f04921c908d509a8a6a64e52e1686408fb2c6323fe731fb7cf10bd4a693467597ecd59a615d1a906d93ce515b4eb2073bbca1b

Download Submit
C:\Windows\system\LZqixaS.exe

Filesize
2.2MB

MD5
e3a97ca62f68a099e8806e31529bf0d7

SHA1
f0a0b4612b82b04ce20f268ce5b0c38965272281

SHA256
ab91cb1da62c70b1e07d085216c3f2c80e4ba5b38c4d3b071ccc10d57a653a8f

SHA512
a92d65c04675f0eccaa285ac2314810645d0c6d8c5c9e06176c71080da2c475b1142dc94418980fa64807f91ddbf10675131372f205e8dbda304e089ca0b1d1a

Download Submit
C:\Windows\system\LpkjXbd.exe

Filesize
2.2MB

MD5
0299e842f37488c5e8040d672f5b69f8

SHA1
9b585a823da3ebd249d6e33772cecd64ec67ef8f

SHA256
b3f0d39779bd54db904ee329c58712ca43569456ba8da42189ed2884aeecdb4e

SHA512
836e9fe548ca62f2ef89b060077f760d89bfc8a1ceefa3b3aa66f0ef1ab8f7f31e9399b2aeb224bfec87d2cdb2e67a5e93fd9531fd3f66d72daf9007add90178

Download Submit
C:\Windows\system\RTGRaVh.exe

Filesize
2.2MB

MD5
210d2bbd6cdc1245517cbe3be0130726

SHA1
cc1781f56561899cab57f3f8b6766dbe63defd98

SHA256
35b8292174934e0a209053c6bfb542c14f5f014d631a8e75e72e2d7ba790c814

SHA512
c147c5865c46d9538c049cc76bd98f890fa6af801e634de6aa42d61100179980acca9143ca17745ccad4850b1eeba7522eafc909e102886267cd6bfd5e6bb8e2

Download Submit
C:\Windows\system\VctIFbX.exe

Filesize
2.2MB

MD5
e73a627f5357245cde7d086cf0de7f61

SHA1
7693260985bd86609b180b7e4bd1af3d9ef409df

SHA256
e4da94b292736244b3ee07b48d8cd29b9ad30d69ea9053887d7b63e19bb432c2

SHA512
0c6ce7481ec0e252599ab66f8727a29e6d4e087d0d867a67e3bf4b9115f4d45d1a83ace5106a42a15b8b2701f73f9f85879ec70cba67cf35a90aac4d1d1ae2b4

Download Submit
C:\Windows\system\VjUmFpv.exe

Filesize
2.2MB

MD5
5a90d8435d7b056312ed56f916f9032c

SHA1
ab37b9b38269f2b4935790d4aa6f717ee18d06b3

SHA256
420dc06790ed0a1a85e0ff3898e9d55edb6a0ce4c8b5a9e52aecd7b86de0843a

SHA512
70f2029322f7fa07553fe7992993d5083a410ab9b62e940e3119c1986e13d89743c6060057dc30b05e32805e615ee975ed8f6f85fbb8ea51359483756d67bb44

Download Submit
C:\Windows\system\XqulsaW.exe

Filesize
2.2MB

MD5
df13a5917790b0a680581b40f58c8e0d

SHA1
7b4fe95e8c7058ff070ffa8ff9942b54dcf3e317

SHA256
1c882f3b19044ccf5f71ced0043c749b449238b89d09c20a46f6d3f77279bdcd

SHA512
a2190f8cc0863417f127cb36b9dabd7452df27ef453b66d4db30a44f9ca65300579613d2609a111b3d0a7a1e76b0897a3535d985761efbc2a6248025b30f661a

Download Submit
C:\Windows\system\ZKGHjrp.exe

Filesize
2.2MB

MD5
14d208187e5995469d297edbe1f31c0a

SHA1
27dc08de3a0937c4a54636b95b2bbcf9cf44304a

SHA256
d7be993c104f6e36482b4f2b7ec119a2750d5b228a188a9fca2c1e8fc458da2f

SHA512
5349ae7e34157ca7801238bc52f6165d9e0cf76094ab065b16960028c466682ec6f0d7cd7acb15e65f40840266e4385852e0f0d2a45d9aa059246c8563255876

Download Submit
C:\Windows\system\agNMUSl.exe

Filesize
2.2MB

MD5
2a46b489a17d6bfa92f8eedf43140b9a

SHA1
fbe0301cb2f8a2bdfeb6d9bfde231a345f0cd765

SHA256
0cb6d2b519b1d3e772df474d3990b1e6e58d553b4fa34b42c2f41156f99c06ac

SHA512
3f31584bb1bceb263915cc5b5b172c631b6b57e41392237baf3aa13cd477857e20dbd8e3c0d73cdafc1c8192904c95f4d05cfa05662fb38d6acb763878e43d01

Download Submit
C:\Windows\system\auGgaTk.exe

Filesize
2.2MB

MD5
8798b161432c19e5e956bdda97bcd1a8

SHA1
5b386a44ce9512089d36776fb94152a2fd9b2fdb

SHA256
5ff08294f810ceca128e2a6ad3bb6169382fd7c5374ca1fe9b377a6d080abf06

SHA512
a9103c4921cd1061a01a148abfe1ba9dbe10aae0af96c1d5892d3c75d467afaf6d65e82278dc1288cff896c860afe31cff2be120d3adba2d55e38b571bf8a7b6

Download Submit
C:\Windows\system\ayrgoxP.exe

Filesize
2.2MB

MD5
7748d5dd79729cc0b84fb30f74851ed8

SHA1
be7a86e0aa0f3986d6527038364d352e618fb53d

SHA256
f880a75e9c8d532c6f8bf0abc7fb85c8efa8016aed9b27626a2ca81bfae18422

SHA512
a8a6076a784765507c3ae350a53682504e9480e01f6b844f2086cca35e28020b8d82c68fb5c45466ada1d5c19ef61b48198efa8b6283eb445b96d51754143b40

Download Submit
C:\Windows\system\hgTupVw.exe

Filesize
2.2MB

MD5
ae1a3623f548ab353f5ad43da7d108ab

SHA1
f3c740b5a270b8136f549414968505a90aa2a761

SHA256
f76d0874cc8838d32bf072226929fe074d893e70fed70ef20cf30a5ec8719478

SHA512
cbc4f913f3ae5a143d0ccc24f2d9aaac03b3b2c80fd01473fc2f98050295a7d8db112359f9e0defc8d2bbea0499444c46f6de869a9b42bee27740eb08f9b5b49

Download Submit
C:\Windows\system\kBLpAVG.exe

Filesize
2.2MB

MD5
9e8d6d6d06b8d4153a9e1b1f1cf2f815

SHA1
756595b934e9bedad826984243f398b3caedc118

SHA256
2a957987d1089c5aa7b79742083d6f1e88e4855e6f6f1cef244e3e5639757a3e

SHA512
bfe406e6e9cba0f75b849b271a7f9b38269a83844be43709ede448500f45042120a544dbf77a8e9e8e7956c89139ff16d7c0604f127e932f9019a47d19e0e714

Download Submit
C:\Windows\system\lsPEduf.exe

Filesize
2.2MB

MD5
4af77d353758741f4e523dc8f8307007

SHA1
129f81c2a0998559c750984bf14defc2ae7f9bf4

SHA256
65e03d087324de48d2411d864d178660f5e5f49e6a6b80db2352aef57a0b0a55

SHA512
396042925aabe192e78d1d7f31eaedae305802c529a91fcf921edc3dd0ea9512463b2c93996b1f2e506f042be42cecf94682471e2899ca641344b14ffbda261f

Download Submit
C:\Windows\system\lvVknqd.exe

Filesize
2.2MB

MD5
abd54b76e5e9a52a41321125e429925a

SHA1
bd87760db7d3a0c36a9a52d463b5400ee6df31a9

SHA256
6b42db236cde7f84e37fd0147f80a4335a5f67c475ddf3a24bdcad99dffc90d7

SHA512
42ea1c4d12f3ed448243dbbd082a2597e689ed43a6c239706bfe150029d866e7fd2ddb240ce03181a620a755339a5605d2b7a384797bc053150f81f58bfe41cf

Download Submit
C:\Windows\system\ofLgRqM.exe

Filesize
2.2MB

MD5
8b21515572743589714d61f69ad12775

SHA1
2ef911dc1bf01ac4ce4bce35747cc4ed5079fdc7

SHA256
032a8461757afc395821cfd278de3d1b7a09607f7351ec69183a135b9b907205

SHA512
a906b8c91350dbd07bc679b605b05a568fd94e12581f2f837cb530452b257ba29dee0e21889992c75c81919908d6be1f61ccf0f057886aa7d906e2b2b43ce8e3

Download Submit
C:\Windows\system\pXXYlgU.exe

Filesize
2.2MB

MD5
ef840782c115f6e1fc81577faf66e10c

SHA1
2e62449d924b1ce0d4a6d56550380194abdb77b7

SHA256
6fa86c9eed9d6a9e8ab3e0216fdb83a9c4e4e9406ed001accba376f110737447

SHA512
4f3609f047f85814a8fe7e01cc24e3ad830cbaa9bffc38a08b816d183679fdc0cd36662a5153c70f1fe92946703143439b9c9b09114556869eb5f3b7d7471965

Download Submit
C:\Windows\system\uUOKeHQ.exe

Filesize
2.2MB

MD5
3730f6ec461265bf14bc60fbb3b0339d

SHA1
02235648621822be79cd478062f9b544f13ca737

SHA256
978c00ed5d07b54f64302f52dc1f84fa14f5f1828cba3343ad920d9e2f0d570d

SHA512
5c6daa13978d651a39386c19c29afcf557a38a49013f8ac3a4e7a108451e8a7797c0f199faad912c01bcdc2443ee1a395724e09f1c793096ec92b405116dfc5c

Download Submit
C:\Windows\system\vbZhBFE.exe

Filesize
2.2MB

MD5
94b6fb461b4acc920a5251292b56f899

SHA1
049ee3f4f348cc12d05a5cc77b35082b2a1a0e6a

SHA256
fd03abe6728dc51737b739645253d0e16586d577a03f53aa157101c2fdbce06f

SHA512
54e2180d1cdb57648f3408031bac104f723e93cce66bbeb135ce5daed37c88b7ace0328311cbcdead16cf37c3ff3d0fdd139e317c16a16cc71cdeda495d31e24

Download Submit
C:\Windows\system\xOgJMfO.exe

Filesize
2.2MB

MD5
159482516602e2bd2fcd3ff324c1e73b

SHA1
2a9e76ba442129d350dafe94436c7f68ac8593f9

SHA256
2ed9f1179cf1485769b1f33aa18615ac004aa1f42d40ebe63f10950aec392336

SHA512
98d0ea1d669998ab3a493c5901c1b24de9817b680996dd773b45f149578014dda2b7dffda1143b26a90ea33c5a404996fcbf2eea0ab19c59341180911a192bce

Download Submit
\Windows\system\DFiMmFj.exe

Filesize
2.2MB

MD5
e13c4246bf0da0d7db9def1347ffec4e

SHA1
8f5c065bcb5a71d4c51dd1dc9b66052c82a15ca1

SHA256
bcdab5a300939d1e34094ea950f54a2f769ae0c9b82e9fda1f2d7611bbe3268c

SHA512
4c3a207015e360f820e4a4192293b6eed2eed749b9f85a9ad5ced2145bb9039ee0b278d6042cda661b178b157a6ca1cbc928f2434e3470675ab3886c7cd0430a

Download Submit
\Windows\system\FYtmTxF.exe

Filesize
2.2MB

MD5
d267724080a5f3e384cb29ab615b7e76

SHA1
393606bec7889d5998e3765645163742bb14c719

SHA256
9e15ee739ffd7c1549eb1ffaecea9c3b058d74d04baf6b1a73f2797ae08e00de

SHA512
92eb70d0eda5829145b665d1b89c42b5e8f076935b7de68b26ec870517b76b2908e2fd708d82886d63e82cc6aa5f70b9112b80fc08de03c7cc8e5303d4b08652

Download Submit
\Windows\system\PXUnwwf.exe

Filesize
2.2MB

MD5
811814b269aa01c0c848523300823894

SHA1
d93026e3c55b849508934c95682311ff978f9321

SHA256
0ad377e083d6511c8e4ff0d031d752210359a142f45ccc5c9f44b91195fc25e0

SHA512
da5b72a4bdce914591e56c2bfa1f3627771d229556135f65b2860e13bb8542219c8573330bd59bc23de39424bd8332edf05b605aabc9ed109d1a858ee041983d

Download Submit
\Windows\system\hHVeKdw.exe

Filesize
2.2MB

MD5
8ef304f97b82c038cbbaedcdf6b9558c

SHA1
661e3ce80c46c80e00c2651365f82cb4ee35d49b

SHA256
cede3ceb969790d84c218dd9927736113379bb371a4ab9c577865871ec5279d3

SHA512
85be3b76f422374fb349445b551695fcce83daacaffb36eee530744e4af5e1f782b35c8f9dafb72431a85446b8ae4d2ecca4c41554552f0b090a1763e1e431c1

Download Submit
\Windows\system\oszlEEz.exe

Filesize
2.2MB

MD5
95c89a10281c906c4149fae9899068e3

SHA1
7e677079db11b38f68721d31b2207975a21cf7d9

SHA256
ba4b2c5cf64a94a3d494fe28ba6c577d865c12cc7db369d8d729efe80c7e777e

SHA512
e3d7e542dea42411ccc4f1fdf000989b08805d06d5f3057487b7fac0779abd615c3e40829dd82f22bc1a0a348585b55a42ed413265eadeb940f16df6056c6ddd

Download Submit
\Windows\system\sPkqOIE.exe

Filesize
2.2MB

MD5
2bcfa52e3d26f2810305a786eae88e82

SHA1
bd153d4914724859fffbdfd1bc51acca74d001b6

SHA256
d419d3c48dbbe0d78669aad4bd8b4e09c237f8bcb2f0dcac32da550ff1e47370

SHA512
fe7bc170a68a0eb2a86eb1e67a8b52236e753dbd3c2e21f7abb7510da84df9570da5bbacbc4887b6221a31e5cd68c364a1f9cd1a9f9dfc78ab89fc8cc243a27a

Download Submit
\Windows\system\ukyIjNe.exe

Filesize
2.2MB

MD5
7bac1780af6a61b63d1ea5aeac3f34bb

SHA1
88e8accf903a9d3619d7784e560a123a0c87c725

SHA256
4fe771f02bb02746f7d470d140840a381b01bbb6f729eafa1c30fa4e67eab03e

SHA512
ae64bfea9af0d2eccbcf595263bec3268beca8b45f7c4d89cca38a894c46e23b5b6bde3522832fd7bb4b11a66fd31030543f57cd474b78ed2aac55ebd2c873d8

Download Submit
\Windows\system\wjKqjld.exe

Filesize
2.2MB

MD5
20078912503931a9c35d3318f50bc30d

SHA1
84ffd1c8571c4c0fdcc943639c8a9a796f6886f6

SHA256
f6ea5c34b19922e1960212e4b80d38118c91f096dd0e8eb5be3bcdab4976dfed

SHA512
6fdeb9811ee574c3a1ffb64e057c2af164e39adc1c13691abe9cf9797728ce555d7912d7e74e44d8b7fe4477e24dbc98e7adb31244b47b8dd882a2b84a2e7b2a

Download Submit
\Windows\system\ySNcMer.exe

Filesize
2.2MB

MD5
279ec2ca662fc975bff87db0ae608ec4

SHA1
f1b1d3838d448721f81dc41ce50ee884fb91f2a1

SHA256
500bc3f51aa463f3358624f753d3c4c5ce8fa71067b4c5261936c22695ae6445

SHA512
5a201321de2f3ea1e8aa0a5839ab77b615729e021cae38016ff7b1ea8e08d0ebbda1bd23b9ed6f563dbbee7e3077d22c5e872de907f57ab0fcd94124dce084e0

Download Submit
memory/2132-234-0x000000001B4E0000-0x000000001B7C2000-memory.dmp

Filesize
2.9MB

Download
memory/2132-235-0x0000000002780000-0x0000000002788000-memory.dmp

Filesize
32KB

Download
memory/2160-164-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2160-4595-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2216-4570-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-156-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-163-0x0000000002FE0000-0x00000000033D2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-2-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-10699-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2360-99-0x00000000036A0000-0x0000000003A92000-memory.dmp

Filesize
3.9MB

Download
memory/2360-14340-0x00000000036A0000-0x0000000003A92000-memory.dmp

Filesize
3.9MB

Download
memory/2360-9-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-165-0x0000000002FE0000-0x00000000033D2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-77-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2360-11387-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-12886-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2360-13245-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2360-63-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2360-14334-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2360-39-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2360-86-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2360-35-0x0000000002FE0000-0x00000000033D2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-14305-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-32-0x0000000002FE0000-0x00000000033D2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-13-0x0000000002FE0000-0x00000000033D2000-memory.dmp

Filesize
3.9MB

Download
memory/2448-168-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2448-4645-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2504-4600-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2504-147-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2600-167-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2600-4675-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2604-4580-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2604-122-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2708-4656-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-166-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2732-70-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2732-4687-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2988-4636-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2988-160-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/3012-4682-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/3012-50-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/3028-4607-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-33-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download