xmrig | ecbc4004c9a82bfd3de2ffee4e450d64c54b046f106b523953c8c96e35e84acc

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22649b5369179871788603682d0fd703_JaffaCakes118.exe
Size

1.7MB
MD5

22649b5369179871788603682d0fd703
SHA1

d4d2876fe3fa681f349dfa007fcd19fa1bd36347
SHA256

ecbc4004c9a82bfd3de2ffee4e450d64c54b046f106b523953c8c96e35e84acc
SHA512

c32e991d583ebeff058ffcbe9f899efa94f1c9cda6a28fc6d0d958e05555f9d4fb0b710a5b0786a8bfc8aa3cf82d3f80e4d9fba69605b09e60921f918e300062
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFtx:Lz071uv4BPMkibTIA5I4TNrpDGgDQzR

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/1424-226-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2872-229-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2672-231-0x000000013F7A0000-0x000000013FB92000-memory.dmp	xmrig
behavioral1/memory/2512-238-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2544-243-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	xmrig
behavioral1/memory/2696-236-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2536-234-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2544-6296-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	xmrig
behavioral1/memory/2696-6327-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2512-6331-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/1660-10460-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2616	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2932	JfivpPn.exe
1424	UZQraci.exe
2544	uvONPeM.exe
2872	sRYhnsF.exe
2672	HQVxaGS.exe
2536	upjFdbO.exe
2696	EgIVAWz.exe
2512	UAstCOh.exe
3032	rAviHBC.exe
2232	pzEIoKz.exe
2736	nIQBriU.exe
2412	LJkVxiE.exe
2620	gcJqEvk.exe
2992	JmxegNo.exe
1632	OZQXbJa.exe
2664	HrIoNPr.exe
1744	scNxCRD.exe
1868	uamkcrF.exe
1892	kcAKRtu.exe
784	faddwbA.exe
648	aTalRvV.exe
1984	komRbsh.exe
404	bpnFlsK.exe
2860	zfrOiyQ.exe
2416	IQsyccd.exe
1560	bJcMdeP.exe
1308	eufiHGL.exe
2552	JfxuaUr.exe
2476	xntQEJf.exe
2456	LRMaQcu.exe
2016	RnliOdu.exe
984	vdTyDxb.exe
2940	hoxQGia.exe
2964	EzyYedZ.exe
2524	DvsCNkE.exe
856	JeCbtev.exe
2716	UUqUlHy.exe
2796	XyMVZSR.exe
944	FMBtjzR.exe
1864	IyUGBja.exe
540	poyJhqH.exe
1048	GnLUhqf.exe
584	XPUNJqh.exe
1152	KPqJSZE.exe
2408	xLyPpFm.exe
1980	msPwhDA.exe
2012	tijBgwY.exe
1164	suAaraW.exe
2000	hOkcUZj.exe
1200	zkZLcLq.exe
1712	ypyNMIx.exe
1812	ybUCzkM.exe
1044	rDMdUhn.exe
1828	ppYknuH.exe
2268	TCTftOa.exe
2712	bdTftKw.exe
2692	QazLGDz.exe
2128	euhSywb.exe
1676	KYCFbMN.exe
2744	bcYIpiQ.exe
1948	BWPqEsB.exe
1408	rqyZXjL.exe
1736	WmJLlqp.exe
684	TcNiRKa.exe

Loads dropped DLL 64 IoCs

pid	Process
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1660-0-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/files/0x0007000000015c6b-14.dat	upx
behavioral1/files/0x0008000000015c52-19.dat	upx
behavioral1/files/0x0007000000015c78-18.dat	upx
behavioral1/files/0x000a000000015c9f-27.dat	upx
behavioral1/files/0x0007000000015cf6-34.dat	upx
behavioral1/files/0x0006000000015d31-59.dat	upx
behavioral1/files/0x0006000000015df1-70.dat	upx
behavioral1/files/0x0006000000016176-86.dat	upx
behavioral1/files/0x0006000000016448-92.dat	upx
behavioral1/files/0x0006000000016d16-158.dat	upx
behavioral1/files/0x0009000000015616-8.dat	upx
behavioral1/files/0x000b000000015cee-175.dat	upx
behavioral1/files/0x0006000000016d51-170.dat	upx
behavioral1/files/0x0006000000016d1a-161.dat	upx
behavioral1/files/0x0006000000016cbe-155.dat	upx
behavioral1/files/0x0006000000016cc6-152.dat	upx
behavioral1/files/0x0006000000016cb6-144.dat	upx
behavioral1/files/0x0006000000016c7c-137.dat	upx
behavioral1/files/0x000f000000005578-129.dat	upx
behavioral1/files/0x0006000000016bfb-118.dat	upx
behavioral1/files/0x0007000000015c83-113.dat	upx
behavioral1/files/0x00060000000167d5-108.dat	upx
behavioral1/memory/1424-226-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2872-229-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2672-231-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/memory/2512-238-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2544-243-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx
behavioral1/memory/2696-236-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/2536-234-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/files/0x000600000001650c-98.dat	upx
behavioral1/files/0x0006000000016287-89.dat	upx
behavioral1/files/0x0006000000015f7a-83.dat	upx
behavioral1/files/0x00060000000160af-80.dat	upx
behavioral1/files/0x0006000000015f01-73.dat	upx
behavioral1/files/0x0006000000015d98-65.dat	upx
behavioral1/files/0x0006000000015d27-56.dat	upx
behavioral1/files/0x0006000000015d0f-46.dat	upx
behavioral1/files/0x0007000000015cfe-39.dat	upx
behavioral1/files/0x0006000000016d3e-166.dat	upx
behavioral1/files/0x0006000000016ca5-142.dat	upx
behavioral1/files/0x0007000000016c51-135.dat	upx
behavioral1/files/0x0006000000016c04-133.dat	upx
behavioral1/files/0x0006000000016a29-116.dat	upx
behavioral1/files/0x00060000000165ae-106.dat	upx
behavioral1/files/0x0006000000015d1a-51.dat	upx
behavioral1/files/0x0007000000015d07-45.dat	upx
behavioral1/memory/2932-11-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/files/0x000b000000014ef8-6.dat	upx
behavioral1/memory/2544-6296-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx
behavioral1/memory/2696-6327-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/2512-6331-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/1660-10460-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vokhfbR.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\DNlMPtp.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\LbtiNFA.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\wTrGUUg.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\yekUoDl.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\kJCTsXl.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\uFMZLgD.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\eTwNEQF.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\NctiyWI.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\EFbnBIe.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\DyAPSVE.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\DgYrdTi.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\mYPpIoU.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\SslzzFW.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\QFlLTMq.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\PNxXfiO.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\xWziTeF.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\SvhpxUQ.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\nOMEoOl.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\NKNPaOl.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\XxNCorv.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\lGLjsuQ.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\SUMqnGP.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\FboAcfC.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\hvHKtcy.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\oFGOHlF.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\iLxFIzq.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\DdIRGeM.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\TAaaYxu.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\lEnNktX.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\tmyQEjF.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\qXWpuSe.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\wvKCLwZ.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\KfzvFPe.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\hLQUlIx.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\EDhCwuJ.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\GipGKrH.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\pgdZdfe.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\mLHyihF.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\oXElxUk.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\EDfyjKI.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\iHuzzwW.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\gzhnRCN.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\oACdyGM.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\RbvUKsv.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\pxLKJTm.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\YHgUuNi.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\BLicvKr.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\XvtSWUI.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\MXtpYFd.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\NfcIgaC.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\zGEPRFc.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\VvxrvTz.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\AzPUcbr.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\SrHwwxx.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\iJCgueQ.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\gyIGdVm.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\CIEhigr.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\mkhbMuG.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\rwLjfeN.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\nWkZEmQ.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\hFFhQVP.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\VVmvaGQ.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe
File created	C:\Windows\System\WQkJSNh.exe	22649b5369179871788603682d0fd703_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2616	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeLockMemoryPrivilege	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2616	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	29
PID 1660 wrote to memory of 2616	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	29
PID 1660 wrote to memory of 2616	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	29
PID 1660 wrote to memory of 2932	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	30
PID 1660 wrote to memory of 2932	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	30
PID 1660 wrote to memory of 2932	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	30
PID 1660 wrote to memory of 3032	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	31
PID 1660 wrote to memory of 3032	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	31
PID 1660 wrote to memory of 3032	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	31
PID 1660 wrote to memory of 1424	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	32
PID 1660 wrote to memory of 1424	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	32
PID 1660 wrote to memory of 1424	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	32
PID 1660 wrote to memory of 2992	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	33
PID 1660 wrote to memory of 2992	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	33
PID 1660 wrote to memory of 2992	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	33
PID 1660 wrote to memory of 2544	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	34
PID 1660 wrote to memory of 2544	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	34
PID 1660 wrote to memory of 2544	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	34
PID 1660 wrote to memory of 2664	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	35
PID 1660 wrote to memory of 2664	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	35
PID 1660 wrote to memory of 2664	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	35
PID 1660 wrote to memory of 2872	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	36
PID 1660 wrote to memory of 2872	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	36
PID 1660 wrote to memory of 2872	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	36
PID 1660 wrote to memory of 2860	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	37
PID 1660 wrote to memory of 2860	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	37
PID 1660 wrote to memory of 2860	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	37
PID 1660 wrote to memory of 2672	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	38
PID 1660 wrote to memory of 2672	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	38
PID 1660 wrote to memory of 2672	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	38
PID 1660 wrote to memory of 2552	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	39
PID 1660 wrote to memory of 2552	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	39
PID 1660 wrote to memory of 2552	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	39
PID 1660 wrote to memory of 2536	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	40
PID 1660 wrote to memory of 2536	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	40
PID 1660 wrote to memory of 2536	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	40
PID 1660 wrote to memory of 2476	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	41
PID 1660 wrote to memory of 2476	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	41
PID 1660 wrote to memory of 2476	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	41
PID 1660 wrote to memory of 2696	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	42
PID 1660 wrote to memory of 2696	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	42
PID 1660 wrote to memory of 2696	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	42
PID 1660 wrote to memory of 2456	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	43
PID 1660 wrote to memory of 2456	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	43
PID 1660 wrote to memory of 2456	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	43
PID 1660 wrote to memory of 2512	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	44
PID 1660 wrote to memory of 2512	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	44
PID 1660 wrote to memory of 2512	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	44
PID 1660 wrote to memory of 2940	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	45
PID 1660 wrote to memory of 2940	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	45
PID 1660 wrote to memory of 2940	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	45
PID 1660 wrote to memory of 2232	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	46
PID 1660 wrote to memory of 2232	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	46
PID 1660 wrote to memory of 2232	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	46
PID 1660 wrote to memory of 2964	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	47
PID 1660 wrote to memory of 2964	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	47
PID 1660 wrote to memory of 2964	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	47
PID 1660 wrote to memory of 2736	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	48
PID 1660 wrote to memory of 2736	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	48
PID 1660 wrote to memory of 2736	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	48
PID 1660 wrote to memory of 2524	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	49
PID 1660 wrote to memory of 2524	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	49
PID 1660 wrote to memory of 2524	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	49
PID 1660 wrote to memory of 2412	1660	22649b5369179871788603682d0fd703_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\22649b5369179871788603682d0fd703_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\22649b5369179871788603682d0fd703_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\System\JfivpPn.exe
  C:\Windows\System\JfivpPn.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\rAviHBC.exe
  C:\Windows\System\rAviHBC.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\UZQraci.exe
  C:\Windows\System\UZQraci.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\JmxegNo.exe
  C:\Windows\System\JmxegNo.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\uvONPeM.exe
  C:\Windows\System\uvONPeM.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\HrIoNPr.exe
  C:\Windows\System\HrIoNPr.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\sRYhnsF.exe
  C:\Windows\System\sRYhnsF.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\zfrOiyQ.exe
  C:\Windows\System\zfrOiyQ.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\HQVxaGS.exe
  C:\Windows\System\HQVxaGS.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\JfxuaUr.exe
  C:\Windows\System\JfxuaUr.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\upjFdbO.exe
  C:\Windows\System\upjFdbO.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\xntQEJf.exe
  C:\Windows\System\xntQEJf.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\EgIVAWz.exe
  C:\Windows\System\EgIVAWz.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\LRMaQcu.exe
  C:\Windows\System\LRMaQcu.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\UAstCOh.exe
  C:\Windows\System\UAstCOh.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\hoxQGia.exe
  C:\Windows\System\hoxQGia.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\pzEIoKz.exe
  C:\Windows\System\pzEIoKz.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\EzyYedZ.exe
  C:\Windows\System\EzyYedZ.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\nIQBriU.exe
  C:\Windows\System\nIQBriU.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\DvsCNkE.exe
  C:\Windows\System\DvsCNkE.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\LJkVxiE.exe
  C:\Windows\System\LJkVxiE.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\JeCbtev.exe
  C:\Windows\System\JeCbtev.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\gcJqEvk.exe
  C:\Windows\System\gcJqEvk.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\UUqUlHy.exe
  C:\Windows\System\UUqUlHy.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\OZQXbJa.exe
  C:\Windows\System\OZQXbJa.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\XyMVZSR.exe
  C:\Windows\System\XyMVZSR.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\scNxCRD.exe
  C:\Windows\System\scNxCRD.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\FMBtjzR.exe
  C:\Windows\System\FMBtjzR.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\uamkcrF.exe
  C:\Windows\System\uamkcrF.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\IyUGBja.exe
  C:\Windows\System\IyUGBja.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\kcAKRtu.exe
  C:\Windows\System\kcAKRtu.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\poyJhqH.exe
  C:\Windows\System\poyJhqH.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\faddwbA.exe
  C:\Windows\System\faddwbA.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\GnLUhqf.exe
  C:\Windows\System\GnLUhqf.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\aTalRvV.exe
  C:\Windows\System\aTalRvV.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\XPUNJqh.exe
  C:\Windows\System\XPUNJqh.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\komRbsh.exe
  C:\Windows\System\komRbsh.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\KPqJSZE.exe
  C:\Windows\System\KPqJSZE.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\bpnFlsK.exe
  C:\Windows\System\bpnFlsK.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\xLyPpFm.exe
  C:\Windows\System\xLyPpFm.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\IQsyccd.exe
  C:\Windows\System\IQsyccd.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\msPwhDA.exe
  C:\Windows\System\msPwhDA.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\bJcMdeP.exe
  C:\Windows\System\bJcMdeP.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\tijBgwY.exe
  C:\Windows\System\tijBgwY.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\eufiHGL.exe
  C:\Windows\System\eufiHGL.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\suAaraW.exe
  C:\Windows\System\suAaraW.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\RnliOdu.exe
  C:\Windows\System\RnliOdu.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\hOkcUZj.exe
  C:\Windows\System\hOkcUZj.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\vdTyDxb.exe
  C:\Windows\System\vdTyDxb.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\zkZLcLq.exe
  C:\Windows\System\zkZLcLq.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\ypyNMIx.exe
  C:\Windows\System\ypyNMIx.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\ybUCzkM.exe
  C:\Windows\System\ybUCzkM.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\rDMdUhn.exe
  C:\Windows\System\rDMdUhn.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\ppYknuH.exe
  C:\Windows\System\ppYknuH.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\TCTftOa.exe
  C:\Windows\System\TCTftOa.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\bdTftKw.exe
  C:\Windows\System\bdTftKw.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\QazLGDz.exe
  C:\Windows\System\QazLGDz.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\euhSywb.exe
  C:\Windows\System\euhSywb.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\KYCFbMN.exe
  C:\Windows\System\KYCFbMN.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\bcYIpiQ.exe
  C:\Windows\System\bcYIpiQ.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\BWPqEsB.exe
  C:\Windows\System\BWPqEsB.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\rqyZXjL.exe
  C:\Windows\System\rqyZXjL.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\WmJLlqp.exe
  C:\Windows\System\WmJLlqp.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\TcNiRKa.exe
  C:\Windows\System\TcNiRKa.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\jfAYBMQ.exe
  C:\Windows\System\jfAYBMQ.exe
  2⤵
  PID:1648
- C:\Windows\System\qXWpuSe.exe
  C:\Windows\System\qXWpuSe.exe
  2⤵
  PID:2180
- C:\Windows\System\JGyOSyV.exe
  C:\Windows\System\JGyOSyV.exe
  2⤵
  PID:1672
- C:\Windows\System\yhZpIMj.exe
  C:\Windows\System\yhZpIMj.exe
  2⤵
  PID:2852
- C:\Windows\System\IBaDadO.exe
  C:\Windows\System\IBaDadO.exe
  2⤵
  PID:908
- C:\Windows\System\nRhyGnr.exe
  C:\Windows\System\nRhyGnr.exe
  2⤵
  PID:1052
- C:\Windows\System\seBVkIM.exe
  C:\Windows\System\seBVkIM.exe
  2⤵
  PID:1592
- C:\Windows\System\hxUdRZT.exe
  C:\Windows\System\hxUdRZT.exe
  2⤵
  PID:2912
- C:\Windows\System\scltSjr.exe
  C:\Windows\System\scltSjr.exe
  2⤵
  PID:1704
- C:\Windows\System\oSQhVGA.exe
  C:\Windows\System\oSQhVGA.exe
  2⤵
  PID:2564
- C:\Windows\System\ZhjePbR.exe
  C:\Windows\System\ZhjePbR.exe
  2⤵
  PID:1184
- C:\Windows\System\bCdZymV.exe
  C:\Windows\System\bCdZymV.exe
  2⤵
  PID:2588
- C:\Windows\System\rgQqYBw.exe
  C:\Windows\System\rgQqYBw.exe
  2⤵
  PID:2728
- C:\Windows\System\nKKzhKt.exe
  C:\Windows\System\nKKzhKt.exe
  2⤵
  PID:700
- C:\Windows\System\myFWSqW.exe
  C:\Windows\System\myFWSqW.exe
  2⤵
  PID:2344
- C:\Windows\System\TiSwJfH.exe
  C:\Windows\System\TiSwJfH.exe
  2⤵
  PID:1136
- C:\Windows\System\NKMnfOC.exe
  C:\Windows\System\NKMnfOC.exe
  2⤵
  PID:1144
- C:\Windows\System\ecTrkeE.exe
  C:\Windows\System\ecTrkeE.exe
  2⤵
  PID:1496
- C:\Windows\System\FxHGRDt.exe
  C:\Windows\System\FxHGRDt.exe
  2⤵
  PID:1860
- C:\Windows\System\scAVyjQ.exe
  C:\Windows\System\scAVyjQ.exe
  2⤵
  PID:356
- C:\Windows\System\XExGnNk.exe
  C:\Windows\System\XExGnNk.exe
  2⤵
  PID:1600
- C:\Windows\System\EoKPqkq.exe
  C:\Windows\System\EoKPqkq.exe
  2⤵
  PID:1100
- C:\Windows\System\koqJauL.exe
  C:\Windows\System\koqJauL.exe
  2⤵
  PID:2472
- C:\Windows\System\Jbaocxc.exe
  C:\Windows\System\Jbaocxc.exe
  2⤵
  PID:2488
- C:\Windows\System\zRTJHIu.exe
  C:\Windows\System\zRTJHIu.exe
  2⤵
  PID:1472
- C:\Windows\System\yTahBqD.exe
  C:\Windows\System\yTahBqD.exe
  2⤵
  PID:2160
- C:\Windows\System\XKtEdTe.exe
  C:\Windows\System\XKtEdTe.exe
  2⤵
  PID:844
- C:\Windows\System\nbQomvm.exe
  C:\Windows\System\nbQomvm.exe
  2⤵
  PID:1500
- C:\Windows\System\ggsRNHB.exe
  C:\Windows\System\ggsRNHB.exe
  2⤵
  PID:2656
- C:\Windows\System\bctlmcx.exe
  C:\Windows\System\bctlmcx.exe
  2⤵
  PID:2880
- C:\Windows\System\ldkIEDd.exe
  C:\Windows\System\ldkIEDd.exe
  2⤵
  PID:1216
- C:\Windows\System\ybgBjvS.exe
  C:\Windows\System\ybgBjvS.exe
  2⤵
  PID:1396
- C:\Windows\System\AXRrAzN.exe
  C:\Windows\System\AXRrAzN.exe
  2⤵
  PID:2196
- C:\Windows\System\BgxyVtT.exe
  C:\Windows\System\BgxyVtT.exe
  2⤵
  PID:2520
- C:\Windows\System\AuvBKoA.exe
  C:\Windows\System\AuvBKoA.exe
  2⤵
  PID:2580
- C:\Windows\System\yybhWXQ.exe
  C:\Windows\System\yybhWXQ.exe
  2⤵
  PID:1920
- C:\Windows\System\xSDIGIZ.exe
  C:\Windows\System\xSDIGIZ.exe
  2⤵
  PID:1360
- C:\Windows\System\uGSNojU.exe
  C:\Windows\System\uGSNojU.exe
  2⤵
  PID:1996
- C:\Windows\System\pUQRZDC.exe
  C:\Windows\System\pUQRZDC.exe
  2⤵
  PID:788
- C:\Windows\System\QqnQaKd.exe
  C:\Windows\System\QqnQaKd.exe
  2⤵
  PID:2584
- C:\Windows\System\MWkNXET.exe
  C:\Windows\System\MWkNXET.exe
  2⤵
  PID:1580
- C:\Windows\System\EFfPgeQ.exe
  C:\Windows\System\EFfPgeQ.exe
  2⤵
  PID:2528
- C:\Windows\System\BwlyeuQ.exe
  C:\Windows\System\BwlyeuQ.exe
  2⤵
  PID:2480
- C:\Windows\System\tWztJpO.exe
  C:\Windows\System\tWztJpO.exe
  2⤵
  PID:1608
- C:\Windows\System\qLGpxUA.exe
  C:\Windows\System\qLGpxUA.exe
  2⤵
  PID:660
- C:\Windows\System\dNzNCof.exe
  C:\Windows\System\dNzNCof.exe
  2⤵
  PID:1724
- C:\Windows\System\ftRgvXG.exe
  C:\Windows\System\ftRgvXG.exe
  2⤵
  PID:2636
- C:\Windows\System\BnPtrLW.exe
  C:\Windows\System\BnPtrLW.exe
  2⤵
  PID:3044
- C:\Windows\System\HcaCPGh.exe
  C:\Windows\System\HcaCPGh.exe
  2⤵
  PID:2820
- C:\Windows\System\qTaNofd.exe
  C:\Windows\System\qTaNofd.exe
  2⤵
  PID:1544
- C:\Windows\System\xgUYHrR.exe
  C:\Windows\System\xgUYHrR.exe
  2⤵
  PID:1324
- C:\Windows\System\WAzKhgs.exe
  C:\Windows\System\WAzKhgs.exe
  2⤵
  PID:3084
- C:\Windows\System\CqOPGIl.exe
  C:\Windows\System\CqOPGIl.exe
  2⤵
  PID:3100
- C:\Windows\System\wvONhxR.exe
  C:\Windows\System\wvONhxR.exe
  2⤵
  PID:3188
- C:\Windows\System\pBQBOwe.exe
  C:\Windows\System\pBQBOwe.exe
  2⤵
  PID:3212
- C:\Windows\System\ZyOQaHW.exe
  C:\Windows\System\ZyOQaHW.exe
  2⤵
  PID:3232
- C:\Windows\System\cxXQleJ.exe
  C:\Windows\System\cxXQleJ.exe
  2⤵
  PID:3252
- C:\Windows\System\UvBDyxb.exe
  C:\Windows\System\UvBDyxb.exe
  2⤵
  PID:3268
- C:\Windows\System\cqCweuv.exe
  C:\Windows\System\cqCweuv.exe
  2⤵
  PID:3284
- C:\Windows\System\mRXGOeX.exe
  C:\Windows\System\mRXGOeX.exe
  2⤵
  PID:3300
- C:\Windows\System\gYFsmXp.exe
  C:\Windows\System\gYFsmXp.exe
  2⤵
  PID:3316
- C:\Windows\System\kOcHGkw.exe
  C:\Windows\System\kOcHGkw.exe
  2⤵
  PID:3332
- C:\Windows\System\XvjmRGL.exe
  C:\Windows\System\XvjmRGL.exe
  2⤵
  PID:3348
- C:\Windows\System\ieZyTnn.exe
  C:\Windows\System\ieZyTnn.exe
  2⤵
  PID:3364
- C:\Windows\System\YYDjaNz.exe
  C:\Windows\System\YYDjaNz.exe
  2⤵
  PID:3384
- C:\Windows\System\GunVoYS.exe
  C:\Windows\System\GunVoYS.exe
  2⤵
  PID:3436
- C:\Windows\System\IvCQJOZ.exe
  C:\Windows\System\IvCQJOZ.exe
  2⤵
  PID:3452
- C:\Windows\System\xiuCiLO.exe
  C:\Windows\System\xiuCiLO.exe
  2⤵
  PID:3472
- C:\Windows\System\MKYyZtx.exe
  C:\Windows\System\MKYyZtx.exe
  2⤵
  PID:3492
- C:\Windows\System\XJjnkHS.exe
  C:\Windows\System\XJjnkHS.exe
  2⤵
  PID:3512
- C:\Windows\System\fzXoPTl.exe
  C:\Windows\System\fzXoPTl.exe
  2⤵
  PID:3528
- C:\Windows\System\wlYhgQf.exe
  C:\Windows\System\wlYhgQf.exe
  2⤵
  PID:3544
- C:\Windows\System\mUOmELD.exe
  C:\Windows\System\mUOmELD.exe
  2⤵
  PID:3560
- C:\Windows\System\QzRJDKT.exe
  C:\Windows\System\QzRJDKT.exe
  2⤵
  PID:3580
- C:\Windows\System\qzBQgYA.exe
  C:\Windows\System\qzBQgYA.exe
  2⤵
  PID:3596
- C:\Windows\System\YdpcufV.exe
  C:\Windows\System\YdpcufV.exe
  2⤵
  PID:3612
- C:\Windows\System\Trmnwil.exe
  C:\Windows\System\Trmnwil.exe
  2⤵
  PID:3628
- C:\Windows\System\KUxZfbz.exe
  C:\Windows\System\KUxZfbz.exe
  2⤵
  PID:3644
- C:\Windows\System\URzpUWN.exe
  C:\Windows\System\URzpUWN.exe
  2⤵
  PID:3680
- C:\Windows\System\vzipcWF.exe
  C:\Windows\System\vzipcWF.exe
  2⤵
  PID:3696
- C:\Windows\System\pvyjvpg.exe
  C:\Windows\System\pvyjvpg.exe
  2⤵
  PID:3712
- C:\Windows\System\yBnfKwL.exe
  C:\Windows\System\yBnfKwL.exe
  2⤵
  PID:3752
- C:\Windows\System\pKsSaVO.exe
  C:\Windows\System\pKsSaVO.exe
  2⤵
  PID:3768
- C:\Windows\System\xthGNpD.exe
  C:\Windows\System\xthGNpD.exe
  2⤵
  PID:3784
- C:\Windows\System\pWdQUoZ.exe
  C:\Windows\System\pWdQUoZ.exe
  2⤵
  PID:3804
- C:\Windows\System\vbCmIRg.exe
  C:\Windows\System\vbCmIRg.exe
  2⤵
  PID:3820
- C:\Windows\System\YODGVos.exe
  C:\Windows\System\YODGVos.exe
  2⤵
  PID:3836
- C:\Windows\System\ApEDHlX.exe
  C:\Windows\System\ApEDHlX.exe
  2⤵
  PID:3852
- C:\Windows\System\xmvOtHR.exe
  C:\Windows\System\xmvOtHR.exe
  2⤵
  PID:3868
- C:\Windows\System\jrzKkLR.exe
  C:\Windows\System\jrzKkLR.exe
  2⤵
  PID:3884
- C:\Windows\System\kYDvrVK.exe
  C:\Windows\System\kYDvrVK.exe
  2⤵
  PID:3904
- C:\Windows\System\YSPKamu.exe
  C:\Windows\System\YSPKamu.exe
  2⤵
  PID:3920
- C:\Windows\System\UEiRgct.exe
  C:\Windows\System\UEiRgct.exe
  2⤵
  PID:3936
- C:\Windows\System\qOTGcwL.exe
  C:\Windows\System\qOTGcwL.exe
  2⤵
  PID:3952
- C:\Windows\System\WAwRNlT.exe
  C:\Windows\System\WAwRNlT.exe
  2⤵
  PID:3968
- C:\Windows\System\oQFJtFi.exe
  C:\Windows\System\oQFJtFi.exe
  2⤵
  PID:3988
- C:\Windows\System\RAnzqRn.exe
  C:\Windows\System\RAnzqRn.exe
  2⤵
  PID:4004
- C:\Windows\System\KxKMFRf.exe
  C:\Windows\System\KxKMFRf.exe
  2⤵
  PID:4020
- C:\Windows\System\bkHWPfY.exe
  C:\Windows\System\bkHWPfY.exe
  2⤵
  PID:4036
- C:\Windows\System\eHuIQvZ.exe
  C:\Windows\System\eHuIQvZ.exe
  2⤵
  PID:4056
- C:\Windows\System\YXqehUW.exe
  C:\Windows\System\YXqehUW.exe
  2⤵
  PID:4072
- C:\Windows\System\CbafXMa.exe
  C:\Windows\System\CbafXMa.exe
  2⤵
  PID:4088
- C:\Windows\System\CYfSrmx.exe
  C:\Windows\System\CYfSrmx.exe
  2⤵
  PID:3008
- C:\Windows\System\ZYqGmrx.exe
  C:\Windows\System\ZYqGmrx.exe
  2⤵
  PID:1428
- C:\Windows\System\vdmKcTs.exe
  C:\Windows\System\vdmKcTs.exe
  2⤵
  PID:1344
- C:\Windows\System\YaKnjaZ.exe
  C:\Windows\System\YaKnjaZ.exe
  2⤵
  PID:1772
- C:\Windows\System\kWZAfga.exe
  C:\Windows\System\kWZAfga.exe
  2⤵
  PID:2668
- C:\Windows\System\cYvfotY.exe
  C:\Windows\System\cYvfotY.exe
  2⤵
  PID:2112
- C:\Windows\System\HnoQrLF.exe
  C:\Windows\System\HnoQrLF.exe
  2⤵
  PID:2832
- C:\Windows\System\CaejbUj.exe
  C:\Windows\System\CaejbUj.exe
  2⤵
  PID:2956
- C:\Windows\System\VRtIhog.exe
  C:\Windows\System\VRtIhog.exe
  2⤵
  PID:2324
- C:\Windows\System\IkHmKSa.exe
  C:\Windows\System\IkHmKSa.exe
  2⤵
  PID:3112
- C:\Windows\System\nRBsAvD.exe
  C:\Windows\System\nRBsAvD.exe
  2⤵
  PID:3128
- C:\Windows\System\OFVzEXh.exe
  C:\Windows\System\OFVzEXh.exe
  2⤵
  PID:3148
- C:\Windows\System\mmRyRbr.exe
  C:\Windows\System\mmRyRbr.exe
  2⤵
  PID:3168
- C:\Windows\System\PrmAZMi.exe
  C:\Windows\System\PrmAZMi.exe
  2⤵
  PID:3180
- C:\Windows\System\jkrJbUo.exe
  C:\Windows\System\jkrJbUo.exe
  2⤵
  PID:3184
- C:\Windows\System\ivBtUwq.exe
  C:\Windows\System\ivBtUwq.exe
  2⤵
  PID:1508
- C:\Windows\System\CKBZYaM.exe
  C:\Windows\System\CKBZYaM.exe
  2⤵
  PID:1764
- C:\Windows\System\pygmSdy.exe
  C:\Windows\System\pygmSdy.exe
  2⤵
  PID:3204
- C:\Windows\System\bgDnaoi.exe
  C:\Windows\System\bgDnaoi.exe
  2⤵
  PID:3208
- C:\Windows\System\wzPTpeE.exe
  C:\Windows\System\wzPTpeE.exe
  2⤵
  PID:3228
- C:\Windows\System\YvFGAoZ.exe
  C:\Windows\System\YvFGAoZ.exe
  2⤵
  PID:3248
- C:\Windows\System\OPSLdtw.exe
  C:\Windows\System\OPSLdtw.exe
  2⤵
  PID:3324
- C:\Windows\System\leuDAOy.exe
  C:\Windows\System\leuDAOy.exe
  2⤵
  PID:3392
- C:\Windows\System\pDnPoDP.exe
  C:\Windows\System\pDnPoDP.exe
  2⤵
  PID:2060
- C:\Windows\System\jitEbBp.exe
  C:\Windows\System\jitEbBp.exe
  2⤵
  PID:2868
- C:\Windows\System\zfzeJql.exe
  C:\Windows\System\zfzeJql.exe
  2⤵
  PID:3412
- C:\Windows\System\MbLwBKl.exe
  C:\Windows\System\MbLwBKl.exe
  2⤵
  PID:3380
- C:\Windows\System\MgDthjq.exe
  C:\Windows\System\MgDthjq.exe
  2⤵
  PID:3420
- C:\Windows\System\QiyjfjG.exe
  C:\Windows\System\QiyjfjG.exe
  2⤵
  PID:3444
- C:\Windows\System\JXrGZAb.exe
  C:\Windows\System\JXrGZAb.exe
  2⤵
  PID:3464
- C:\Windows\System\BnYdvOY.exe
  C:\Windows\System\BnYdvOY.exe
  2⤵
  PID:3500
- C:\Windows\System\euKKVhI.exe
  C:\Windows\System\euKKVhI.exe
  2⤵
  PID:1488
- C:\Windows\System\TaWcMBh.exe
  C:\Windows\System\TaWcMBh.exe
  2⤵
  PID:3508
- C:\Windows\System\iZXgKQA.exe
  C:\Windows\System\iZXgKQA.exe
  2⤵
  PID:3504
- C:\Windows\System\rGbyLNR.exe
  C:\Windows\System\rGbyLNR.exe
  2⤵
  PID:3656
- C:\Windows\System\bsBBKXC.exe
  C:\Windows\System\bsBBKXC.exe
  2⤵
  PID:3540
- C:\Windows\System\EdKeRCN.exe
  C:\Windows\System\EdKeRCN.exe
  2⤵
  PID:3568
- C:\Windows\System\ZJOCHSz.exe
  C:\Windows\System\ZJOCHSz.exe
  2⤵
  PID:3604
- C:\Windows\System\RIXAwPz.exe
  C:\Windows\System\RIXAwPz.exe
  2⤵
  PID:3704
- C:\Windows\System\pTluTbU.exe
  C:\Windows\System\pTluTbU.exe
  2⤵
  PID:3688
- C:\Windows\System\hNhyHlj.exe
  C:\Windows\System\hNhyHlj.exe
  2⤵
  PID:3760
- C:\Windows\System\QCgynif.exe
  C:\Windows\System\QCgynif.exe
  2⤵
  PID:3796
- C:\Windows\System\NsEOBfp.exe
  C:\Windows\System\NsEOBfp.exe
  2⤵
  PID:3892
- C:\Windows\System\nZavjMj.exe
  C:\Windows\System\nZavjMj.exe
  2⤵
  PID:3928
- C:\Windows\System\Phcfizb.exe
  C:\Windows\System\Phcfizb.exe
  2⤵
  PID:3996
- C:\Windows\System\dAGhGqV.exe
  C:\Windows\System\dAGhGqV.exe
  2⤵
  PID:4100
- C:\Windows\System\NTPpSwi.exe
  C:\Windows\System\NTPpSwi.exe
  2⤵
  PID:4116
- C:\Windows\System\CvniUqs.exe
  C:\Windows\System\CvniUqs.exe
  2⤵
  PID:4132
- C:\Windows\System\XVhVihH.exe
  C:\Windows\System\XVhVihH.exe
  2⤵
  PID:4152
- C:\Windows\System\JbqvZdK.exe
  C:\Windows\System\JbqvZdK.exe
  2⤵
  PID:4168
- C:\Windows\System\OgsgJcr.exe
  C:\Windows\System\OgsgJcr.exe
  2⤵
  PID:4184
- C:\Windows\System\yevrvtU.exe
  C:\Windows\System\yevrvtU.exe
  2⤵
  PID:4200
- C:\Windows\System\rwzeIob.exe
  C:\Windows\System\rwzeIob.exe
  2⤵
  PID:4460
- C:\Windows\System\tPLiTNk.exe
  C:\Windows\System\tPLiTNk.exe
  2⤵
  PID:4476
- C:\Windows\System\egZGcta.exe
  C:\Windows\System\egZGcta.exe
  2⤵
  PID:4492
- C:\Windows\System\xGWNITb.exe
  C:\Windows\System\xGWNITb.exe
  2⤵
  PID:4508
- C:\Windows\System\yLEXoCo.exe
  C:\Windows\System\yLEXoCo.exe
  2⤵
  PID:4524
- C:\Windows\System\HVFRrke.exe
  C:\Windows\System\HVFRrke.exe
  2⤵
  PID:4544
- C:\Windows\System\KThWqvt.exe
  C:\Windows\System\KThWqvt.exe
  2⤵
  PID:4560
- C:\Windows\System\ZcRGAHg.exe
  C:\Windows\System\ZcRGAHg.exe
  2⤵
  PID:4576
- C:\Windows\System\guizjKR.exe
  C:\Windows\System\guizjKR.exe
  2⤵
  PID:4592
- C:\Windows\System\BBKwxqG.exe
  C:\Windows\System\BBKwxqG.exe
  2⤵
  PID:4608
- C:\Windows\System\snIRjOf.exe
  C:\Windows\System\snIRjOf.exe
  2⤵
  PID:4624
- C:\Windows\System\tYfPBQb.exe
  C:\Windows\System\tYfPBQb.exe
  2⤵
  PID:4644
- C:\Windows\System\wRuynAu.exe
  C:\Windows\System\wRuynAu.exe
  2⤵
  PID:4660
- C:\Windows\System\XRYAnGu.exe
  C:\Windows\System\XRYAnGu.exe
  2⤵
  PID:4676
- C:\Windows\System\GmDYihg.exe
  C:\Windows\System\GmDYihg.exe
  2⤵
  PID:4692
- C:\Windows\System\ZjXrRMu.exe
  C:\Windows\System\ZjXrRMu.exe
  2⤵
  PID:4708
- C:\Windows\System\NIXqwyQ.exe
  C:\Windows\System\NIXqwyQ.exe
  2⤵
  PID:4724
- C:\Windows\System\HbwsYok.exe
  C:\Windows\System\HbwsYok.exe
  2⤵
  PID:4740
- C:\Windows\System\WesPgHj.exe
  C:\Windows\System\WesPgHj.exe
  2⤵
  PID:4760
- C:\Windows\System\OgqiOEt.exe
  C:\Windows\System\OgqiOEt.exe
  2⤵
  PID:4776
- C:\Windows\System\KVdqxEG.exe
  C:\Windows\System\KVdqxEG.exe
  2⤵
  PID:4792
- C:\Windows\System\cfLzECD.exe
  C:\Windows\System\cfLzECD.exe
  2⤵
  PID:4808
- C:\Windows\System\CkFfnmD.exe
  C:\Windows\System\CkFfnmD.exe
  2⤵
  PID:4824
- C:\Windows\System\obLxblp.exe
  C:\Windows\System\obLxblp.exe
  2⤵
  PID:4840
- C:\Windows\System\tvUloRk.exe
  C:\Windows\System\tvUloRk.exe
  2⤵
  PID:4856
- C:\Windows\System\vmCAnrP.exe
  C:\Windows\System\vmCAnrP.exe
  2⤵
  PID:4876
- C:\Windows\System\KxqqgJv.exe
  C:\Windows\System\KxqqgJv.exe
  2⤵
  PID:4892
- C:\Windows\System\xYMCUKO.exe
  C:\Windows\System\xYMCUKO.exe
  2⤵
  PID:4908
- C:\Windows\System\PzjDIat.exe
  C:\Windows\System\PzjDIat.exe
  2⤵
  PID:4924
- C:\Windows\System\bRxgWZl.exe
  C:\Windows\System\bRxgWZl.exe
  2⤵
  PID:4940
- C:\Windows\System\VctEVVt.exe
  C:\Windows\System\VctEVVt.exe
  2⤵
  PID:4956
- C:\Windows\System\ShMUUtS.exe
  C:\Windows\System\ShMUUtS.exe
  2⤵
  PID:4972
- C:\Windows\System\ZzTdhgc.exe
  C:\Windows\System\ZzTdhgc.exe
  2⤵
  PID:4992
- C:\Windows\System\suyeZrr.exe
  C:\Windows\System\suyeZrr.exe
  2⤵
  PID:5008
- C:\Windows\System\ngZiteD.exe
  C:\Windows\System\ngZiteD.exe
  2⤵
  PID:5024
- C:\Windows\System\yZGqnix.exe
  C:\Windows\System\yZGqnix.exe
  2⤵
  PID:5044
- C:\Windows\System\PqsEXPV.exe
  C:\Windows\System\PqsEXPV.exe
  2⤵
  PID:5060
- C:\Windows\System\dTkWONc.exe
  C:\Windows\System\dTkWONc.exe
  2⤵
  PID:5076
- C:\Windows\System\VmIIlNu.exe
  C:\Windows\System\VmIIlNu.exe
  2⤵
  PID:3096
- C:\Windows\System\cxZBGHI.exe
  C:\Windows\System\cxZBGHI.exe
  2⤵
  PID:3428
- C:\Windows\System\CJwRSUb.exe
  C:\Windows\System\CJwRSUb.exe
  2⤵
  PID:2272
- C:\Windows\System\IOZbOhm.exe
  C:\Windows\System\IOZbOhm.exe
  2⤵
  PID:3636
- C:\Windows\System\ILMopon.exe
  C:\Windows\System\ILMopon.exe
  2⤵
  PID:4032
- C:\Windows\System\doCUvbp.exe
  C:\Windows\System\doCUvbp.exe
  2⤵
  PID:4216
- C:\Windows\System\pNBzrGU.exe
  C:\Windows\System\pNBzrGU.exe
  2⤵
  PID:2396
- C:\Windows\System\BsokgOx.exe
  C:\Windows\System\BsokgOx.exe
  2⤵
  PID:4240
- C:\Windows\System\XZKkkny.exe
  C:\Windows\System\XZKkkny.exe
  2⤵
  PID:4256
- C:\Windows\System\XfYtsNZ.exe
  C:\Windows\System\XfYtsNZ.exe
  2⤵
  PID:4272
- C:\Windows\System\YehApJN.exe
  C:\Windows\System\YehApJN.exe
  2⤵
  PID:3092
- C:\Windows\System\KyTlexA.exe
  C:\Windows\System\KyTlexA.exe
  2⤵
  PID:4300
- C:\Windows\System\JJLRHmO.exe
  C:\Windows\System\JJLRHmO.exe
  2⤵
  PID:4316
- C:\Windows\System\Xspdgbs.exe
  C:\Windows\System\Xspdgbs.exe
  2⤵
  PID:4328
- C:\Windows\System\WutZIrs.exe
  C:\Windows\System\WutZIrs.exe
  2⤵
  PID:3668
- C:\Windows\System\XFtvhnu.exe
  C:\Windows\System\XFtvhnu.exe
  2⤵
  PID:4176
- C:\Windows\System\sTCHRww.exe
  C:\Windows\System\sTCHRww.exe
  2⤵
  PID:4344
- C:\Windows\System\eDTzkID.exe
  C:\Windows\System\eDTzkID.exe
  2⤵
  PID:4364
- C:\Windows\System\ionAakG.exe
  C:\Windows\System\ionAakG.exe
  2⤵
  PID:4380
- C:\Windows\System\tkBeYrB.exe
  C:\Windows\System\tkBeYrB.exe
  2⤵
  PID:4396
- C:\Windows\System\GEIHHus.exe
  C:\Windows\System\GEIHHus.exe
  2⤵
  PID:4420
- C:\Windows\System\woNJpdz.exe
  C:\Windows\System\woNJpdz.exe
  2⤵
  PID:4432
- C:\Windows\System\uBzbZZR.exe
  C:\Windows\System\uBzbZZR.exe
  2⤵
  PID:3896
- C:\Windows\System\jnyDnnX.exe
  C:\Windows\System\jnyDnnX.exe
  2⤵
  PID:4452
- C:\Windows\System\indkmJU.exe
  C:\Windows\System\indkmJU.exe
  2⤵
  PID:4212
- C:\Windows\System\XhBoaQo.exe
  C:\Windows\System\XhBoaQo.exe
  2⤵
  PID:4484
- C:\Windows\System\rYKNSdM.exe
  C:\Windows\System\rYKNSdM.exe
  2⤵
  PID:4588
- C:\Windows\System\OkwwzOt.exe
  C:\Windows\System\OkwwzOt.exe
  2⤵
  PID:4520
- C:\Windows\System\JKYDXEA.exe
  C:\Windows\System\JKYDXEA.exe
  2⤵
  PID:3880
- C:\Windows\System\jWeeiJD.exe
  C:\Windows\System\jWeeiJD.exe
  2⤵
  PID:3916
- C:\Windows\System\aTSwkdj.exe
  C:\Windows\System\aTSwkdj.exe
  2⤵
  PID:3980
- C:\Windows\System\RcEJYYv.exe
  C:\Windows\System\RcEJYYv.exe
  2⤵
  PID:4044
- C:\Windows\System\mTAGrIt.exe
  C:\Windows\System\mTAGrIt.exe
  2⤵
  PID:3900
- C:\Windows\System\ZXHUTKW.exe
  C:\Windows\System\ZXHUTKW.exe
  2⤵
  PID:4080
- C:\Windows\System\fCnvjeb.exe
  C:\Windows\System\fCnvjeb.exe
  2⤵
  PID:852
- C:\Windows\System\gIuLmMB.exe
  C:\Windows\System\gIuLmMB.exe
  2⤵
  PID:2884
- C:\Windows\System\RSgEphN.exe
  C:\Windows\System\RSgEphN.exe
  2⤵
  PID:3136
- C:\Windows\System\gHBhnTn.exe
  C:\Windows\System\gHBhnTn.exe
  2⤵
  PID:2292
- C:\Windows\System\sDdAEAO.exe
  C:\Windows\System\sDdAEAO.exe
  2⤵
  PID:1952
- C:\Windows\System\TJoyqaP.exe
  C:\Windows\System\TJoyqaP.exe
  2⤵
  PID:3240
- C:\Windows\System\knCBpzW.exe
  C:\Windows\System\knCBpzW.exe
  2⤵
  PID:3484
- C:\Windows\System\UunLKqw.exe
  C:\Windows\System\UunLKqw.exe
  2⤵
  PID:3524
- C:\Windows\System\gwgggmY.exe
  C:\Windows\System\gwgggmY.exe
  2⤵
  PID:1888
- C:\Windows\System\WnySdOq.exe
  C:\Windows\System\WnySdOq.exe
  2⤵
  PID:4064
- C:\Windows\System\blUCBAy.exe
  C:\Windows\System\blUCBAy.exe
  2⤵
  PID:2364
- C:\Windows\System\HDPEqny.exe
  C:\Windows\System\HDPEqny.exe
  2⤵
  PID:2320
- C:\Windows\System\nfviDMi.exe
  C:\Windows\System\nfviDMi.exe
  2⤵
  PID:4716
- C:\Windows\System\uFRAWEw.exe
  C:\Windows\System\uFRAWEw.exe
  2⤵
  PID:4784
- C:\Windows\System\JDSpgFG.exe
  C:\Windows\System\JDSpgFG.exe
  2⤵
  PID:4848
- C:\Windows\System\IfDXiIq.exe
  C:\Windows\System\IfDXiIq.exe
  2⤵
  PID:4920
- C:\Windows\System\NrmEOcv.exe
  C:\Windows\System\NrmEOcv.exe
  2⤵
  PID:4984
- C:\Windows\System\jauiapL.exe
  C:\Windows\System\jauiapL.exe
  2⤵
  PID:5108
- C:\Windows\System\KVpABfT.exe
  C:\Windows\System\KVpABfT.exe
  2⤵
  PID:5056
- C:\Windows\System\TVMmKfg.exe
  C:\Windows\System\TVMmKfg.exe
  2⤵
  PID:4888
- C:\Windows\System\IiSzmip.exe
  C:\Windows\System\IiSzmip.exe
  2⤵
  PID:3028
- C:\Windows\System\KnoVSJK.exe
  C:\Windows\System\KnoVSJK.exe
  2⤵
  PID:4872
- C:\Windows\System\YWWoJpr.exe
  C:\Windows\System\YWWoJpr.exe
  2⤵
  PID:4936
- C:\Windows\System\drvhOBo.exe
  C:\Windows\System\drvhOBo.exe
  2⤵
  PID:4468
- C:\Windows\System\MrUIaRj.exe
  C:\Windows\System\MrUIaRj.exe
  2⤵
  PID:4568
- C:\Windows\System\DOLzXQt.exe
  C:\Windows\System\DOLzXQt.exe
  2⤵
  PID:4604
- C:\Windows\System\HYfuGAt.exe
  C:\Windows\System\HYfuGAt.exe
  2⤵
  PID:4668
- C:\Windows\System\uBxWXXN.exe
  C:\Windows\System\uBxWXXN.exe
  2⤵
  PID:4732
- C:\Windows\System\PLsNgUf.exe
  C:\Windows\System\PLsNgUf.exe
  2⤵
  PID:4768
- C:\Windows\System\ZmMyzSf.exe
  C:\Windows\System\ZmMyzSf.exe
  2⤵
  PID:4832
- C:\Windows\System\tOJlHHJ.exe
  C:\Windows\System\tOJlHHJ.exe
  2⤵
  PID:3160
- C:\Windows\System\JxuCvwS.exe
  C:\Windows\System\JxuCvwS.exe
  2⤵
  PID:5004
- C:\Windows\System\unIEzXw.exe
  C:\Windows\System\unIEzXw.exe
  2⤵
  PID:5068
- C:\Windows\System\yBITRgB.exe
  C:\Windows\System\yBITRgB.exe
  2⤵
  PID:624
- C:\Windows\System\ACGmfjs.exe
  C:\Windows\System\ACGmfjs.exe
  2⤵
  PID:3744
- C:\Windows\System\YPqPmoI.exe
  C:\Windows\System\YPqPmoI.exe
  2⤵
  PID:3776
- C:\Windows\System\AGFIfXl.exe
  C:\Windows\System\AGFIfXl.exe
  2⤵
  PID:3260
- C:\Windows\System\dCgsCIK.exe
  C:\Windows\System\dCgsCIK.exe
  2⤵
  PID:3400
- C:\Windows\System\IUYgqwR.exe
  C:\Windows\System\IUYgqwR.exe
  2⤵
  PID:3964
- C:\Windows\System\guBltEe.exe
  C:\Windows\System\guBltEe.exe
  2⤵
  PID:3960
- C:\Windows\System\SabyxSr.exe
  C:\Windows\System\SabyxSr.exe
  2⤵
  PID:4140
- C:\Windows\System\CZVXOjo.exe
  C:\Windows\System\CZVXOjo.exe
  2⤵
  PID:2948
- C:\Windows\System\PZqaeSx.exe
  C:\Windows\System\PZqaeSx.exe
  2⤵
  PID:2960
- C:\Windows\System\pRONDFS.exe
  C:\Windows\System\pRONDFS.exe
  2⤵
  PID:2792
- C:\Windows\System\DIQyeAP.exe
  C:\Windows\System\DIQyeAP.exe
  2⤵
  PID:4280
- C:\Windows\System\rPMNjpF.exe
  C:\Windows\System\rPMNjpF.exe
  2⤵
  PID:4332
- C:\Windows\System\DLpyvIC.exe
  C:\Windows\System\DLpyvIC.exe
  2⤵
  PID:2720
- C:\Windows\System\yhXoNps.exe
  C:\Windows\System\yhXoNps.exe
  2⤵
  PID:4388
- C:\Windows\System\DqUJClo.exe
  C:\Windows\System\DqUJClo.exe
  2⤵
  PID:2788
- C:\Windows\System\sdXxgWw.exe
  C:\Windows\System\sdXxgWw.exe
  2⤵
  PID:4416
- C:\Windows\System\ZUsBzQu.exe
  C:\Windows\System\ZUsBzQu.exe
  2⤵
  PID:4360
- C:\Windows\System\RHTuAkN.exe
  C:\Windows\System\RHTuAkN.exe
  2⤵
  PID:4292
- C:\Windows\System\QOiiGAG.exe
  C:\Windows\System\QOiiGAG.exe
  2⤵
  PID:4336
- C:\Windows\System\PjcrkGP.exe
  C:\Windows\System\PjcrkGP.exe
  2⤵
  PID:3816
- C:\Windows\System\SDfHpZf.exe
  C:\Windows\System\SDfHpZf.exe
  2⤵
  PID:3912
- C:\Windows\System\ZGGBtYU.exe
  C:\Windows\System\ZGGBtYU.exe
  2⤵
  PID:4164
- C:\Windows\System\ZnkADiR.exe
  C:\Windows\System\ZnkADiR.exe
  2⤵
  PID:4192
- C:\Windows\System\CrtwQzE.exe
  C:\Windows\System\CrtwQzE.exe
  2⤵
  PID:4584
- C:\Windows\System\SUtNqIy.exe
  C:\Windows\System\SUtNqIy.exe
  2⤵
  PID:3736
- C:\Windows\System\FwmRWSk.exe
  C:\Windows\System\FwmRWSk.exe
  2⤵
  PID:3076
- C:\Windows\System\mhXHSQN.exe
  C:\Windows\System\mhXHSQN.exe
  2⤵
  PID:2604
- C:\Windows\System\rjRNImp.exe
  C:\Windows\System\rjRNImp.exe
  2⤵
  PID:3292
- C:\Windows\System\KAztGkr.exe
  C:\Windows\System\KAztGkr.exe
  2⤵
  PID:2284
- C:\Windows\System\LkjOCRA.exe
  C:\Windows\System\LkjOCRA.exe
  2⤵
  PID:3276
- C:\Windows\System\rBPoLcx.exe
  C:\Windows\System\rBPoLcx.exe
  2⤵
  PID:1748
- C:\Windows\System\CQXzehS.exe
  C:\Windows\System\CQXzehS.exe
  2⤵
  PID:4816
- C:\Windows\System\BprTTtY.exe
  C:\Windows\System\BprTTtY.exe
  2⤵
  PID:4820
- C:\Windows\System\KOopAaG.exe
  C:\Windows\System\KOopAaG.exe
  2⤵
  PID:5092
- C:\Windows\System\BvprjUE.exe
  C:\Windows\System\BvprjUE.exe
  2⤵
  PID:3556
- C:\Windows\System\ItcAyMh.exe
  C:\Windows\System\ItcAyMh.exe
  2⤵
  PID:4884
- C:\Windows\System\KZVUnPL.exe
  C:\Windows\System\KZVUnPL.exe
  2⤵
  PID:5084
- C:\Windows\System\QkJLMea.exe
  C:\Windows\System\QkJLMea.exe
  2⤵
  PID:2904
- C:\Windows\System\IAfSkvD.exe
  C:\Windows\System\IAfSkvD.exe
  2⤵
  PID:4472
- C:\Windows\System\wgcXFsf.exe
  C:\Windows\System\wgcXFsf.exe
  2⤵
  PID:4700
- C:\Windows\System\lLNRSKu.exe
  C:\Windows\System\lLNRSKu.exe
  2⤵
  PID:5052
- C:\Windows\System\OncQsBt.exe
  C:\Windows\System\OncQsBt.exe
  2⤵
  PID:4536
- C:\Windows\System\LyxBOvg.exe
  C:\Windows\System\LyxBOvg.exe
  2⤵
  PID:5088
- C:\Windows\System\ZnShwyu.exe
  C:\Windows\System\ZnShwyu.exe
  2⤵
  PID:3356
- C:\Windows\System\MfsRaWX.exe
  C:\Windows\System\MfsRaWX.exe
  2⤵
  PID:4148
- C:\Windows\System\ReqhkYr.exe
  C:\Windows\System\ReqhkYr.exe
  2⤵
  PID:5040
- C:\Windows\System\ODKvXHu.exe
  C:\Windows\System\ODKvXHu.exe
  2⤵
  PID:3344
- C:\Windows\System\uoPSfqp.exe
  C:\Windows\System\uoPSfqp.exe
  2⤵
  PID:3156
- C:\Windows\System\YQFCKSo.exe
  C:\Windows\System\YQFCKSo.exe
  2⤵
  PID:588
- C:\Windows\System\kwVMCzl.exe
  C:\Windows\System\kwVMCzl.exe
  2⤵
  PID:3732
- C:\Windows\System\oWtWNVL.exe
  C:\Windows\System\oWtWNVL.exe
  2⤵
  PID:3812
- C:\Windows\System\jkOYuKL.exe
  C:\Windows\System\jkOYuKL.exe
  2⤵
  PID:3676
- C:\Windows\System\eFkRSkP.exe
  C:\Windows\System\eFkRSkP.exe
  2⤵
  PID:4752
- C:\Windows\System\WRpyhaC.exe
  C:\Windows\System\WRpyhaC.exe
  2⤵
  PID:5112
- C:\Windows\System\xVzczTz.exe
  C:\Windows\System\xVzczTz.exe
  2⤵
  PID:4640
- C:\Windows\System\VfYXDYC.exe
  C:\Windows\System\VfYXDYC.exe
  2⤵
  PID:3124
- C:\Windows\System\FrPpTmc.exe
  C:\Windows\System\FrPpTmc.exe
  2⤵
  PID:4376
- C:\Windows\System\dViQpwI.exe
  C:\Windows\System\dViQpwI.exe
  2⤵
  PID:4684
- C:\Windows\System\bpQNmlc.exe
  C:\Windows\System\bpQNmlc.exe
  2⤵
  PID:1944
- C:\Windows\System\nQWqocz.exe
  C:\Windows\System\nQWqocz.exe
  2⤵
  PID:4252
- C:\Windows\System\QkmxDFv.exe
  C:\Windows\System\QkmxDFv.exe
  2⤵
  PID:3976
- C:\Windows\System\McGKXyE.exe
  C:\Windows\System\McGKXyE.exe
  2⤵
  PID:3200
- C:\Windows\System\vwvTFbH.exe
  C:\Windows\System\vwvTFbH.exe
  2⤵
  PID:2336
- C:\Windows\System\pGnlBje.exe
  C:\Windows\System\pGnlBje.exe
  2⤵
  PID:4268
- C:\Windows\System\zIeFMsV.exe
  C:\Windows\System\zIeFMsV.exe
  2⤵
  PID:1552
- C:\Windows\System\bEuozcR.exe
  C:\Windows\System\bEuozcR.exe
  2⤵
  PID:1252
- C:\Windows\System\KcGvcet.exe
  C:\Windows\System\KcGvcet.exe
  2⤵
  PID:3460
- C:\Windows\System\PLLovYE.exe
  C:\Windows\System\PLLovYE.exe
  2⤵
  PID:3408
- C:\Windows\System\XRUWOcT.exe
  C:\Windows\System\XRUWOcT.exe
  2⤵
  PID:4952
- C:\Windows\System\jIFBmwf.exe
  C:\Windows\System\jIFBmwf.exe
  2⤵
  PID:4804
- C:\Windows\System\diIstDB.exe
  C:\Windows\System\diIstDB.exe
  2⤵
  PID:1644
- C:\Windows\System\WozblQD.exe
  C:\Windows\System\WozblQD.exe
  2⤵
  PID:4968
- C:\Windows\System\KYnrtnZ.exe
  C:\Windows\System\KYnrtnZ.exe
  2⤵
  PID:4144
- C:\Windows\System\XkIIcjb.exe
  C:\Windows\System\XkIIcjb.exe
  2⤵
  PID:4180
- C:\Windows\System\kApmaQt.exe
  C:\Windows\System\kApmaQt.exe
  2⤵
  PID:4552
- C:\Windows\System\OMieQwN.exe
  C:\Windows\System\OMieQwN.exe
  2⤵
  PID:4868
- C:\Windows\System\lUFbmrH.exe
  C:\Windows\System\lUFbmrH.exe
  2⤵
  PID:5036
- C:\Windows\System\EGRwdoi.exe
  C:\Windows\System\EGRwdoi.exe
  2⤵
  PID:5116
- C:\Windows\System\eGcChbA.exe
  C:\Windows\System\eGcChbA.exe
  2⤵
  PID:1936
- C:\Windows\System\gLnamFW.exe
  C:\Windows\System\gLnamFW.exe
  2⤵
  PID:2700
- C:\Windows\System\WeybEUR.exe
  C:\Windows\System\WeybEUR.exe
  2⤵
  PID:4788
- C:\Windows\System\nWmhIOx.exe
  C:\Windows\System\nWmhIOx.exe
  2⤵
  PID:4228
- C:\Windows\System\royvwry.exe
  C:\Windows\System\royvwry.exe
  2⤵
  PID:5128
- C:\Windows\System\xSpbWeZ.exe
  C:\Windows\System\xSpbWeZ.exe
  2⤵
  PID:5148
- C:\Windows\System\iIGDpoU.exe
  C:\Windows\System\iIGDpoU.exe
  2⤵
  PID:5164
- C:\Windows\System\crpObiJ.exe
  C:\Windows\System\crpObiJ.exe
  2⤵
  PID:5180
- C:\Windows\System\ZdAnDxk.exe
  C:\Windows\System\ZdAnDxk.exe
  2⤵
  PID:5200
- C:\Windows\System\OvSHWTj.exe
  C:\Windows\System\OvSHWTj.exe
  2⤵
  PID:5216
- C:\Windows\System\tJNWImF.exe
  C:\Windows\System\tJNWImF.exe
  2⤵
  PID:5232
- C:\Windows\System\bvefTih.exe
  C:\Windows\System\bvefTih.exe
  2⤵
  PID:5248
- C:\Windows\System\ZwWUZmW.exe
  C:\Windows\System\ZwWUZmW.exe
  2⤵
  PID:5268
- C:\Windows\System\kFVGhEn.exe
  C:\Windows\System\kFVGhEn.exe
  2⤵
  PID:5284
- C:\Windows\System\RqjhGbB.exe
  C:\Windows\System\RqjhGbB.exe
  2⤵
  PID:5316
- C:\Windows\System\zZmhwGT.exe
  C:\Windows\System\zZmhwGT.exe
  2⤵
  PID:5332
- C:\Windows\System\hUdlGar.exe
  C:\Windows\System\hUdlGar.exe
  2⤵
  PID:5348
- C:\Windows\System\FmESbaP.exe
  C:\Windows\System\FmESbaP.exe
  2⤵
  PID:5364
- C:\Windows\System\CiNOkiL.exe
  C:\Windows\System\CiNOkiL.exe
  2⤵
  PID:5380
- C:\Windows\System\BrfAKLW.exe
  C:\Windows\System\BrfAKLW.exe
  2⤵
  PID:5396
- C:\Windows\System\VTqdLUy.exe
  C:\Windows\System\VTqdLUy.exe
  2⤵
  PID:5412
- C:\Windows\System\DHtixOw.exe
  C:\Windows\System\DHtixOw.exe
  2⤵
  PID:5428
- C:\Windows\System\URVKybi.exe
  C:\Windows\System\URVKybi.exe
  2⤵
  PID:5444
- C:\Windows\System\KCOflLm.exe
  C:\Windows\System\KCOflLm.exe
  2⤵
  PID:5460
- C:\Windows\System\azNAwtk.exe
  C:\Windows\System\azNAwtk.exe
  2⤵
  PID:5476
- C:\Windows\System\KqDCOor.exe
  C:\Windows\System\KqDCOor.exe
  2⤵
  PID:5492
- C:\Windows\System\xvygaem.exe
  C:\Windows\System\xvygaem.exe
  2⤵
  PID:5508
- C:\Windows\System\WouWLWn.exe
  C:\Windows\System\WouWLWn.exe
  2⤵
  PID:5524
- C:\Windows\System\wesBLAx.exe
  C:\Windows\System\wesBLAx.exe
  2⤵
  PID:5540
- C:\Windows\System\istzFKc.exe
  C:\Windows\System\istzFKc.exe
  2⤵
  PID:5556
- C:\Windows\System\ihqUynX.exe
  C:\Windows\System\ihqUynX.exe
  2⤵
  PID:5572
- C:\Windows\System\AVAYntZ.exe
  C:\Windows\System\AVAYntZ.exe
  2⤵
  PID:5588
- C:\Windows\System\eJxSIUy.exe
  C:\Windows\System\eJxSIUy.exe
  2⤵
  PID:5604
- C:\Windows\System\VyBxdee.exe
  C:\Windows\System\VyBxdee.exe
  2⤵
  PID:5620
- C:\Windows\System\jKFESLG.exe
  C:\Windows\System\jKFESLG.exe
  2⤵
  PID:5636
- C:\Windows\System\FpewHrB.exe
  C:\Windows\System\FpewHrB.exe
  2⤵
  PID:5652
- C:\Windows\System\AGJCqSP.exe
  C:\Windows\System\AGJCqSP.exe
  2⤵
  PID:5668
- C:\Windows\System\FceCUlB.exe
  C:\Windows\System\FceCUlB.exe
  2⤵
  PID:5684
- C:\Windows\System\nxvpaPS.exe
  C:\Windows\System\nxvpaPS.exe
  2⤵
  PID:5700
- C:\Windows\System\khicGgS.exe
  C:\Windows\System\khicGgS.exe
  2⤵
  PID:5716
- C:\Windows\System\fXlLLfM.exe
  C:\Windows\System\fXlLLfM.exe
  2⤵
  PID:5732
- C:\Windows\System\aKmcRHy.exe
  C:\Windows\System\aKmcRHy.exe
  2⤵
  PID:5748
- C:\Windows\System\YKuIHqn.exe
  C:\Windows\System\YKuIHqn.exe
  2⤵
  PID:5764
- C:\Windows\System\NKLRBIe.exe
  C:\Windows\System\NKLRBIe.exe
  2⤵
  PID:5780
- C:\Windows\System\aQZbLow.exe
  C:\Windows\System\aQZbLow.exe
  2⤵
  PID:5796
- C:\Windows\System\SyTHkLk.exe
  C:\Windows\System\SyTHkLk.exe
  2⤵
  PID:5812
- C:\Windows\System\YroKEJU.exe
  C:\Windows\System\YroKEJU.exe
  2⤵
  PID:5828
- C:\Windows\System\knsezWb.exe
  C:\Windows\System\knsezWb.exe
  2⤵
  PID:5844
- C:\Windows\System\appmqAu.exe
  C:\Windows\System\appmqAu.exe
  2⤵
  PID:5860
- C:\Windows\System\eQTQzRF.exe
  C:\Windows\System\eQTQzRF.exe
  2⤵
  PID:5876
- C:\Windows\System\KdZJxOC.exe
  C:\Windows\System\KdZJxOC.exe
  2⤵
  PID:5892
- C:\Windows\System\ZZgYmPp.exe
  C:\Windows\System\ZZgYmPp.exe
  2⤵
  PID:5908
- C:\Windows\System\gPnoLpH.exe
  C:\Windows\System\gPnoLpH.exe
  2⤵
  PID:5924
- C:\Windows\System\TXQQAdr.exe
  C:\Windows\System\TXQQAdr.exe
  2⤵
  PID:5940
- C:\Windows\System\TMcLQMw.exe
  C:\Windows\System\TMcLQMw.exe
  2⤵
  PID:5956
- C:\Windows\System\AFfdPKU.exe
  C:\Windows\System\AFfdPKU.exe
  2⤵
  PID:5972
- C:\Windows\System\BwjjImQ.exe
  C:\Windows\System\BwjjImQ.exe
  2⤵
  PID:5988
- C:\Windows\System\epnRssg.exe
  C:\Windows\System\epnRssg.exe
  2⤵
  PID:6004
- C:\Windows\System\nPepvRt.exe
  C:\Windows\System\nPepvRt.exe
  2⤵
  PID:6024
- C:\Windows\System\IcCpWfu.exe
  C:\Windows\System\IcCpWfu.exe
  2⤵
  PID:6040
- C:\Windows\System\gMiHoXy.exe
  C:\Windows\System\gMiHoXy.exe
  2⤵
  PID:6056
- C:\Windows\System\RNDDZEG.exe
  C:\Windows\System\RNDDZEG.exe
  2⤵
  PID:6072
- C:\Windows\System\LCqDamG.exe
  C:\Windows\System\LCqDamG.exe
  2⤵
  PID:6088
- C:\Windows\System\QyGZpwQ.exe
  C:\Windows\System\QyGZpwQ.exe
  2⤵
  PID:6104
- C:\Windows\System\KuGrQzo.exe
  C:\Windows\System\KuGrQzo.exe
  2⤵
  PID:6120
- C:\Windows\System\eqrqdWG.exe
  C:\Windows\System\eqrqdWG.exe
  2⤵
  PID:6136
- C:\Windows\System\goHtbBp.exe
  C:\Windows\System\goHtbBp.exe
  2⤵
  PID:4160
- C:\Windows\System\gXBqXyA.exe
  C:\Windows\System\gXBqXyA.exe
  2⤵
  PID:5160
- C:\Windows\System\QQOfzsk.exe
  C:\Windows\System\QQOfzsk.exe
  2⤵
  PID:5196
- C:\Windows\System\IQJXWjn.exe
  C:\Windows\System\IQJXWjn.exe
  2⤵
  PID:5264
- C:\Windows\System\dadqnSB.exe
  C:\Windows\System\dadqnSB.exe
  2⤵
  PID:5304
- C:\Windows\System\lTjzckL.exe
  C:\Windows\System\lTjzckL.exe
  2⤵
  PID:5292
- C:\Windows\System\WujDwxz.exe
  C:\Windows\System\WujDwxz.exe
  2⤵
  PID:5372
- C:\Windows\System\WsZfWGT.exe
  C:\Windows\System\WsZfWGT.exe
  2⤵
  PID:5404
- C:\Windows\System\ZhrcfQx.exe
  C:\Windows\System\ZhrcfQx.exe
  2⤵
  PID:2768
- C:\Windows\System\kjoqlSY.exe
  C:\Windows\System\kjoqlSY.exe
  2⤵
  PID:5140
- C:\Windows\System\YHljXfl.exe
  C:\Windows\System\YHljXfl.exe
  2⤵
  PID:5176
- C:\Windows\System\CmLytMu.exe
  C:\Windows\System\CmLytMu.exe
  2⤵
  PID:5244
- C:\Windows\System\YqjEApV.exe
  C:\Windows\System\YqjEApV.exe
  2⤵
  PID:5436
- C:\Windows\System\IhwfuAC.exe
  C:\Windows\System\IhwfuAC.exe
  2⤵
  PID:5788
- C:\Windows\System\FmHDJKi.exe
  C:\Windows\System\FmHDJKi.exe
  2⤵
  PID:5424
- C:\Windows\System\SIuHBVt.exe
  C:\Windows\System\SIuHBVt.exe
  2⤵
  PID:5792
- C:\Windows\System\cjOBxwL.exe
  C:\Windows\System\cjOBxwL.exe
  2⤵
  PID:5856
- C:\Windows\System\iRSkJwi.exe
  C:\Windows\System\iRSkJwi.exe
  2⤵
  PID:5920
- C:\Windows\System\IhQCxKl.exe
  C:\Windows\System\IhQCxKl.exe
  2⤵
  PID:5712
- C:\Windows\System\QNKosVT.exe
  C:\Windows\System\QNKosVT.exe
  2⤵
  PID:5520
- C:\Windows\System\VyVpGWg.exe
  C:\Windows\System\VyVpGWg.exe
  2⤵
  PID:5984
- C:\Windows\System\uSiXdhR.exe
  C:\Windows\System\uSiXdhR.exe
  2⤵
  PID:6012
- C:\Windows\System\uBenHct.exe
  C:\Windows\System\uBenHct.exe
  2⤵
  PID:5740
- C:\Windows\System\ziizUUd.exe
  C:\Windows\System\ziizUUd.exe
  2⤵
  PID:5900
- C:\Windows\System\HXhMWnL.exe
  C:\Windows\System\HXhMWnL.exe
  2⤵
  PID:5996
- C:\Windows\System\FjceQas.exe
  C:\Windows\System\FjceQas.exe
  2⤵
  PID:5872
- C:\Windows\System\rXboKBB.exe
  C:\Windows\System\rXboKBB.exe
  2⤵
  PID:6020
- C:\Windows\System\YwDUWXf.exe
  C:\Windows\System\YwDUWXf.exe
  2⤵
  PID:6064
- C:\Windows\System\gPEsjTp.exe
  C:\Windows\System\gPEsjTp.exe
  2⤵
  PID:6048
- C:\Windows\System\pLYOcso.exe
  C:\Windows\System\pLYOcso.exe
  2⤵
  PID:6128
- C:\Windows\System\TTrtlmW.exe
  C:\Windows\System\TTrtlmW.exe
  2⤵
  PID:5228
- C:\Windows\System\gWApRKN.exe
  C:\Windows\System\gWApRKN.exe
  2⤵
  PID:6116
- C:\Windows\System\UAvXBUw.exe
  C:\Windows\System\UAvXBUw.exe
  2⤵
  PID:5192
- C:\Windows\System\KuIumJD.exe
  C:\Windows\System\KuIumJD.exe
  2⤵
  PID:5344
- C:\Windows\System\Hoqhggr.exe
  C:\Windows\System\Hoqhggr.exe
  2⤵
  PID:5360
- C:\Windows\System\NgpYXxD.exe
  C:\Windows\System\NgpYXxD.exe
  2⤵
  PID:4348
- C:\Windows\System\kiXbDlk.exe
  C:\Windows\System\kiXbDlk.exe
  2⤵
  PID:4500
- C:\Windows\System\EIxxofa.exe
  C:\Windows\System\EIxxofa.exe
  2⤵
  PID:5504
- C:\Windows\System\Xjxnrvl.exe
  C:\Windows\System\Xjxnrvl.exe
  2⤵
  PID:5628
- C:\Windows\System\MtBkoCU.exe
  C:\Windows\System\MtBkoCU.exe
  2⤵
  PID:5388
- C:\Windows\System\dvMwzPf.exe
  C:\Windows\System\dvMwzPf.exe
  2⤵
  PID:5692
- C:\Windows\System\gxcbvLq.exe
  C:\Windows\System\gxcbvLq.exe
  2⤵
  PID:5724
- C:\Windows\System\xtiQVXf.exe
  C:\Windows\System\xtiQVXf.exe
  2⤵
  PID:5452
- C:\Windows\System\vGjTsLV.exe
  C:\Windows\System\vGjTsLV.exe
  2⤵
  PID:3176
- C:\Windows\System\DDjSXZr.exe
  C:\Windows\System\DDjSXZr.exe
  2⤵
  PID:5760
- C:\Windows\System\aEhXjSL.exe
  C:\Windows\System\aEhXjSL.exe
  2⤵
  PID:5644
- C:\Windows\System\eouebDF.exe
  C:\Windows\System\eouebDF.exe
  2⤵
  PID:5516
- C:\Windows\System\AbrGqqP.exe
  C:\Windows\System\AbrGqqP.exe
  2⤵
  PID:5776
- C:\Windows\System\IRLwOYM.exe
  C:\Windows\System\IRLwOYM.exe
  2⤵
  PID:5980
- C:\Windows\System\GMSyLxo.exe
  C:\Windows\System\GMSyLxo.exe
  2⤵
  PID:5964
- C:\Windows\System\BoRbsvo.exe
  C:\Windows\System\BoRbsvo.exe
  2⤵
  PID:6036
- C:\Windows\System\cmDJkDj.exe
  C:\Windows\System\cmDJkDj.exe
  2⤵
  PID:5312
- C:\Windows\System\CLVxMuz.exe
  C:\Windows\System\CLVxMuz.exe
  2⤵
  PID:6096
- C:\Windows\System\LZQdjgi.exe
  C:\Windows\System\LZQdjgi.exe
  2⤵
  PID:5124
- C:\Windows\System\YOhdnhP.exe
  C:\Windows\System\YOhdnhP.exe
  2⤵
  PID:5188
- C:\Windows\System\hnKBynI.exe
  C:\Windows\System\hnKBynI.exe
  2⤵
  PID:5596
- C:\Windows\System\NIhqpUa.exe
  C:\Windows\System\NIhqpUa.exe
  2⤵
  PID:5468
- C:\Windows\System\NRxxGfo.exe
  C:\Windows\System\NRxxGfo.exe
  2⤵
  PID:5664
- C:\Windows\System\rWLzXWN.exe
  C:\Windows\System\rWLzXWN.exe
  2⤵
  PID:5676
- C:\Windows\System\HYyBmOP.exe
  C:\Windows\System\HYyBmOP.exe
  2⤵
  PID:5548
- C:\Windows\System\JZnIRDo.exe
  C:\Windows\System\JZnIRDo.exe
  2⤵
  PID:5868
- C:\Windows\System\aKqtshX.exe
  C:\Windows\System\aKqtshX.exe
  2⤵
  PID:5144
- C:\Windows\System\UqvUrXd.exe
  C:\Windows\System\UqvUrXd.exe
  2⤵
  PID:5728
- C:\Windows\System\pqnXCXF.exe
  C:\Windows\System\pqnXCXF.exe
  2⤵
  PID:5584
- C:\Windows\System\oFmYHTW.exe
  C:\Windows\System\oFmYHTW.exe
  2⤵
  PID:5536
- C:\Windows\System\MNdBjyO.exe
  C:\Windows\System\MNdBjyO.exe
  2⤵
  PID:5472
- C:\Windows\System\mUfdxRR.exe
  C:\Windows\System\mUfdxRR.exe
  2⤵
  PID:5660
- C:\Windows\System\ZRrYPKN.exe
  C:\Windows\System\ZRrYPKN.exe
  2⤵
  PID:2440
- C:\Windows\System\AedLDLI.exe
  C:\Windows\System\AedLDLI.exe
  2⤵
  PID:5612
- C:\Windows\System\AeENRkF.exe
  C:\Windows\System\AeENRkF.exe
  2⤵
  PID:5392
- C:\Windows\System\sOFmnWm.exe
  C:\Windows\System\sOFmnWm.exe
  2⤵
  PID:5500
- C:\Windows\System\BWoSQoz.exe
  C:\Windows\System\BWoSQoz.exe
  2⤵
  PID:6160
- C:\Windows\System\uYwREbx.exe
  C:\Windows\System\uYwREbx.exe
  2⤵
  PID:6176
- C:\Windows\System\oIhkOgl.exe
  C:\Windows\System\oIhkOgl.exe
  2⤵
  PID:6192
- C:\Windows\System\DsJEZAu.exe
  C:\Windows\System\DsJEZAu.exe
  2⤵
  PID:6208
- C:\Windows\System\imwvgoR.exe
  C:\Windows\System\imwvgoR.exe
  2⤵
  PID:6224
- C:\Windows\System\rKBdIij.exe
  C:\Windows\System\rKBdIij.exe
  2⤵
  PID:6240
- C:\Windows\System\DcciTXm.exe
  C:\Windows\System\DcciTXm.exe
  2⤵
  PID:6256
- C:\Windows\System\KLykErC.exe
  C:\Windows\System\KLykErC.exe
  2⤵
  PID:6272
- C:\Windows\System\ccByGcL.exe
  C:\Windows\System\ccByGcL.exe
  2⤵
  PID:6288
- C:\Windows\System\tzFBBLL.exe
  C:\Windows\System\tzFBBLL.exe
  2⤵
  PID:6304
- C:\Windows\System\oYiDHLI.exe
  C:\Windows\System\oYiDHLI.exe
  2⤵
  PID:6320
- C:\Windows\System\PASwlrA.exe
  C:\Windows\System\PASwlrA.exe
  2⤵
  PID:6336
- C:\Windows\System\uqNuuiP.exe
  C:\Windows\System\uqNuuiP.exe
  2⤵
  PID:6352
- C:\Windows\System\yfeSYQN.exe
  C:\Windows\System\yfeSYQN.exe
  2⤵
  PID:6368
- C:\Windows\System\XKNshYy.exe
  C:\Windows\System\XKNshYy.exe
  2⤵
  PID:6384
- C:\Windows\System\XadmywX.exe
  C:\Windows\System\XadmywX.exe
  2⤵
  PID:6408
- C:\Windows\System\Iyzmpra.exe
  C:\Windows\System\Iyzmpra.exe
  2⤵
  PID:6424
- C:\Windows\System\qSSPacM.exe
  C:\Windows\System\qSSPacM.exe
  2⤵
  PID:6440
- C:\Windows\System\TezALOj.exe
  C:\Windows\System\TezALOj.exe
  2⤵
  PID:6456
- C:\Windows\System\zVjlaRA.exe
  C:\Windows\System\zVjlaRA.exe
  2⤵
  PID:6472
- C:\Windows\System\IrwGStH.exe
  C:\Windows\System\IrwGStH.exe
  2⤵
  PID:6488
- C:\Windows\System\afUWzyr.exe
  C:\Windows\System\afUWzyr.exe
  2⤵
  PID:6504
- C:\Windows\System\TMfJSjr.exe
  C:\Windows\System\TMfJSjr.exe
  2⤵
  PID:6520
- C:\Windows\System\hjbUaBP.exe
  C:\Windows\System\hjbUaBP.exe
  2⤵
  PID:6536
- C:\Windows\System\yPegLAH.exe
  C:\Windows\System\yPegLAH.exe
  2⤵
  PID:6552
- C:\Windows\System\vFoFFjq.exe
  C:\Windows\System\vFoFFjq.exe
  2⤵
  PID:6568
- C:\Windows\System\yoqeXHI.exe
  C:\Windows\System\yoqeXHI.exe
  2⤵
  PID:6584
- C:\Windows\System\vrLiQUp.exe
  C:\Windows\System\vrLiQUp.exe
  2⤵
  PID:6600
- C:\Windows\System\nrrWBmS.exe
  C:\Windows\System\nrrWBmS.exe
  2⤵
  PID:6616
- C:\Windows\System\JYfbBxA.exe
  C:\Windows\System\JYfbBxA.exe
  2⤵
  PID:6632
- C:\Windows\System\uLsOhTC.exe
  C:\Windows\System\uLsOhTC.exe
  2⤵
  PID:6648
- C:\Windows\System\ZXwOHxD.exe
  C:\Windows\System\ZXwOHxD.exe
  2⤵
  PID:6664
- C:\Windows\System\NaoRIjc.exe
  C:\Windows\System\NaoRIjc.exe
  2⤵
  PID:6680
- C:\Windows\System\sQMkCJD.exe
  C:\Windows\System\sQMkCJD.exe
  2⤵
  PID:6696
- C:\Windows\System\upjESxF.exe
  C:\Windows\System\upjESxF.exe
  2⤵
  PID:6712
- C:\Windows\System\LWoicBo.exe
  C:\Windows\System\LWoicBo.exe
  2⤵
  PID:6732
- C:\Windows\System\SuZcDwT.exe
  C:\Windows\System\SuZcDwT.exe
  2⤵
  PID:6748
- C:\Windows\System\FEzgbwB.exe
  C:\Windows\System\FEzgbwB.exe
  2⤵
  PID:6764
- C:\Windows\System\KRBYmsk.exe
  C:\Windows\System\KRBYmsk.exe
  2⤵
  PID:6780
- C:\Windows\System\EnhJDaO.exe
  C:\Windows\System\EnhJDaO.exe
  2⤵
  PID:6796
- C:\Windows\System\xLsfoTo.exe
  C:\Windows\System\xLsfoTo.exe
  2⤵
  PID:6812
- C:\Windows\System\XRTTKYb.exe
  C:\Windows\System\XRTTKYb.exe
  2⤵
  PID:6828
- C:\Windows\System\MzwpJCO.exe
  C:\Windows\System\MzwpJCO.exe
  2⤵
  PID:6844
- C:\Windows\System\SRvYHow.exe
  C:\Windows\System\SRvYHow.exe
  2⤵
  PID:6860
- C:\Windows\System\vAKdUCf.exe
  C:\Windows\System\vAKdUCf.exe
  2⤵
  PID:6876
- C:\Windows\System\lfCFBAB.exe
  C:\Windows\System\lfCFBAB.exe
  2⤵
  PID:6892
- C:\Windows\System\LwQeXUN.exe
  C:\Windows\System\LwQeXUN.exe
  2⤵
  PID:6908
- C:\Windows\System\gqCQyiP.exe
  C:\Windows\System\gqCQyiP.exe
  2⤵
  PID:6928
- C:\Windows\System\YGnzhuS.exe
  C:\Windows\System\YGnzhuS.exe
  2⤵
  PID:6944
- C:\Windows\System\RxCgSsk.exe
  C:\Windows\System\RxCgSsk.exe
  2⤵
  PID:6960
- C:\Windows\System\BfQurGd.exe
  C:\Windows\System\BfQurGd.exe
  2⤵
  PID:6980
- C:\Windows\System\SBtlorS.exe
  C:\Windows\System\SBtlorS.exe
  2⤵
  PID:6996
- C:\Windows\System\CvwXmwh.exe
  C:\Windows\System\CvwXmwh.exe
  2⤵
  PID:7012
- C:\Windows\System\nNEfhoZ.exe
  C:\Windows\System\nNEfhoZ.exe
  2⤵
  PID:7028
- C:\Windows\System\dsQuQbn.exe
  C:\Windows\System\dsQuQbn.exe
  2⤵
  PID:7048
- C:\Windows\System\zEjuBVS.exe
  C:\Windows\System\zEjuBVS.exe
  2⤵
  PID:7064
- C:\Windows\System\fUNbBfu.exe
  C:\Windows\System\fUNbBfu.exe
  2⤵
  PID:7080
- C:\Windows\System\ZpsCyCf.exe
  C:\Windows\System\ZpsCyCf.exe
  2⤵
  PID:7096
- C:\Windows\System\gkeOsWq.exe
  C:\Windows\System\gkeOsWq.exe
  2⤵
  PID:7112
- C:\Windows\System\rWtdAgU.exe
  C:\Windows\System\rWtdAgU.exe
  2⤵
  PID:7128
- C:\Windows\System\TxAkPRt.exe
  C:\Windows\System\TxAkPRt.exe
  2⤵
  PID:7144
- C:\Windows\System\nbhmRjp.exe
  C:\Windows\System\nbhmRjp.exe
  2⤵
  PID:7164
- C:\Windows\System\ZkXqaxY.exe
  C:\Windows\System\ZkXqaxY.exe
  2⤵
  PID:6084
- C:\Windows\System\NqRyHkK.exe
  C:\Windows\System\NqRyHkK.exe
  2⤵
  PID:6172
- C:\Windows\System\HdfyYBJ.exe
  C:\Windows\System\HdfyYBJ.exe
  2⤵
  PID:6204
- C:\Windows\System\ifMXyYO.exe
  C:\Windows\System\ifMXyYO.exe
  2⤵
  PID:6268
- C:\Windows\System\NfcIgaC.exe
  C:\Windows\System\NfcIgaC.exe
  2⤵
  PID:6220
- C:\Windows\System\huNUqPT.exe
  C:\Windows\System\huNUqPT.exe
  2⤵
  PID:6248
- C:\Windows\System\nmLzcGx.exe
  C:\Windows\System\nmLzcGx.exe
  2⤵
  PID:6300
- C:\Windows\System\RUKsBjg.exe
  C:\Windows\System\RUKsBjg.exe
  2⤵
  PID:6280
- C:\Windows\System\vaLVwsz.exe
  C:\Windows\System\vaLVwsz.exe
  2⤵
  PID:6344
- C:\Windows\System\lDhtOln.exe
  C:\Windows\System\lDhtOln.exe
  2⤵
  PID:6432
- C:\Windows\System\kIRTACj.exe
  C:\Windows\System\kIRTACj.exe
  2⤵
  PID:6348
- C:\Windows\System\CqmsBQk.exe
  C:\Windows\System\CqmsBQk.exe
  2⤵
  PID:6528
- C:\Windows\System\NMLQdGl.exe
  C:\Windows\System\NMLQdGl.exe
  2⤵
  PID:6448
- C:\Windows\System\KEYIWQR.exe
  C:\Windows\System\KEYIWQR.exe
  2⤵
  PID:6480
- C:\Windows\System\GuKNwgz.exe
  C:\Windows\System\GuKNwgz.exe
  2⤵
  PID:6624
- C:\Windows\System\iaEWYpI.exe
  C:\Windows\System\iaEWYpI.exe
  2⤵
  PID:6516
- C:\Windows\System\GxxglMT.exe
  C:\Windows\System\GxxglMT.exe
  2⤵
  PID:6580
- C:\Windows\System\OCfIweZ.exe
  C:\Windows\System\OCfIweZ.exe
  2⤵
  PID:6608
- C:\Windows\System\FQfzixi.exe
  C:\Windows\System\FQfzixi.exe
  2⤵
  PID:6676
- C:\Windows\System\rEvrlXG.exe
  C:\Windows\System\rEvrlXG.exe
  2⤵
  PID:6740
- C:\Windows\System\qjrFPQJ.exe
  C:\Windows\System\qjrFPQJ.exe
  2⤵
  PID:6760
- C:\Windows\System\SwDAYgF.exe
  C:\Windows\System\SwDAYgF.exe
  2⤵
  PID:6820
- C:\Windows\System\eZDEqkn.exe
  C:\Windows\System\eZDEqkn.exe
  2⤵
  PID:6916
- C:\Windows\System\nMgnPcy.exe
  C:\Windows\System\nMgnPcy.exe
  2⤵
  PID:6956
- C:\Windows\System\vkhgXYb.exe
  C:\Windows\System\vkhgXYb.exe
  2⤵
  PID:7020
- C:\Windows\System\qTeAiyd.exe
  C:\Windows\System\qTeAiyd.exe
  2⤵
  PID:6772
- C:\Windows\System\YtaQmOA.exe
  C:\Windows\System\YtaQmOA.exe
  2⤵
  PID:7152
- C:\Windows\System\rwXErGO.exe
  C:\Windows\System\rwXErGO.exe
  2⤵
  PID:7124
- C:\Windows\System\msJlRLc.exe
  C:\Windows\System\msJlRLc.exe
  2⤵
  PID:6804
- C:\Windows\System\pMFFybq.exe
  C:\Windows\System\pMFFybq.exe
  2⤵
  PID:6872
- C:\Windows\System\OIjFXIO.exe
  C:\Windows\System\OIjFXIO.exe
  2⤵
  PID:6972
- C:\Windows\System\aXcdhBP.exe
  C:\Windows\System\aXcdhBP.exe
  2⤵
  PID:7036
- C:\Windows\System\Zoowmpj.exe
  C:\Windows\System\Zoowmpj.exe
  2⤵
  PID:7076
- C:\Windows\System\IGJOObl.exe
  C:\Windows\System\IGJOObl.exe
  2⤵
  PID:7140
- C:\Windows\System\tgElbos.exe
  C:\Windows\System\tgElbos.exe
  2⤵
  PID:6168
- C:\Windows\System\UgbviEI.exe
  C:\Windows\System\UgbviEI.exe
  2⤵
  PID:6100
- C:\Windows\System\IuSrzLH.exe
  C:\Windows\System\IuSrzLH.exe
  2⤵
  PID:6188
- C:\Windows\System\ttrCtOY.exe
  C:\Windows\System\ttrCtOY.exe
  2⤵
  PID:6396
- C:\Windows\System\mluhSmd.exe
  C:\Windows\System\mluhSmd.exe
  2⤵
  PID:6416
- C:\Windows\System\XGrsiOF.exe
  C:\Windows\System\XGrsiOF.exe
  2⤵
  PID:6512
- C:\Windows\System\bpTZtDR.exe
  C:\Windows\System\bpTZtDR.exe
  2⤵
  PID:6380
- C:\Windows\System\ggqVTfy.exe
  C:\Windows\System\ggqVTfy.exe
  2⤵
  PID:6312
- C:\Windows\System\qImZCCH.exe
  C:\Windows\System\qImZCCH.exe
  2⤵
  PID:6560
- C:\Windows\System\HrybuJr.exe
  C:\Windows\System\HrybuJr.exe
  2⤵
  PID:6672
- C:\Windows\System\UUfDczK.exe
  C:\Windows\System\UUfDczK.exe
  2⤵
  PID:6952
- C:\Windows\System\LIqIrkK.exe
  C:\Windows\System\LIqIrkK.exe
  2⤵
  PID:7056
- C:\Windows\System\syPCEig.exe
  C:\Windows\System\syPCEig.exe
  2⤵
  PID:7160
- C:\Windows\System\rlIcfsp.exe
  C:\Windows\System\rlIcfsp.exe
  2⤵
  PID:6840
- C:\Windows\System\JHKeXsU.exe
  C:\Windows\System\JHKeXsU.exe
  2⤵
  PID:7092
- C:\Windows\System\BidrUAw.exe
  C:\Windows\System\BidrUAw.exe
  2⤵
  PID:7108
- C:\Windows\System\GicDtTT.exe
  C:\Windows\System\GicDtTT.exe
  2⤵
  PID:6392
- C:\Windows\System\DsBaXlu.exe
  C:\Windows\System\DsBaXlu.exe
  2⤵
  PID:6708
- C:\Windows\System\ZWUJqYc.exe
  C:\Windows\System\ZWUJqYc.exe
  2⤵
  PID:6788
- C:\Windows\System\lZgBrIP.exe
  C:\Windows\System\lZgBrIP.exe
  2⤵
  PID:6968
- C:\Windows\System\uslZqwU.exe
  C:\Windows\System\uslZqwU.exe
  2⤵
  PID:4688
- C:\Windows\System\AbXByYw.exe
  C:\Windows\System\AbXByYw.exe
  2⤵
  PID:6988
- C:\Windows\System\ZWhPCeL.exe
  C:\Windows\System\ZWhPCeL.exe
  2⤵
  PID:7136
- C:\Windows\System\QRdXjAs.exe
  C:\Windows\System\QRdXjAs.exe
  2⤵
  PID:6376
- C:\Windows\System\QazZdvS.exe
  C:\Windows\System\QazZdvS.exe
  2⤵
  PID:6792
- C:\Windows\System\UdpdNDM.exe
  C:\Windows\System\UdpdNDM.exe
  2⤵
  PID:5260
- C:\Windows\System\wYbGjUt.exe
  C:\Windows\System\wYbGjUt.exe
  2⤵
  PID:6900
- C:\Windows\System\TlvLYvu.exe
  C:\Windows\System\TlvLYvu.exe
  2⤵
  PID:7088
- C:\Windows\System\HgYtClZ.exe
  C:\Windows\System\HgYtClZ.exe
  2⤵
  PID:6904
- C:\Windows\System\pgDXUPW.exe
  C:\Windows\System\pgDXUPW.exe
  2⤵
  PID:6464
- C:\Windows\System\jRhUfPw.exe
  C:\Windows\System\jRhUfPw.exe
  2⤵
  PID:6756
- C:\Windows\System\jooaCPn.exe
  C:\Windows\System\jooaCPn.exe
  2⤵
  PID:7172
- C:\Windows\System\OuQZxVR.exe
  C:\Windows\System\OuQZxVR.exe
  2⤵
  PID:7188
- C:\Windows\System\vUOJqeH.exe
  C:\Windows\System\vUOJqeH.exe
  2⤵
  PID:7204
- C:\Windows\System\xabqTzw.exe
  C:\Windows\System\xabqTzw.exe
  2⤵
  PID:7220
- C:\Windows\System\fdKVUhe.exe
  C:\Windows\System\fdKVUhe.exe
  2⤵
  PID:7240
- C:\Windows\System\eUKQzdi.exe
  C:\Windows\System\eUKQzdi.exe
  2⤵
  PID:7256
- C:\Windows\System\XmdtwiA.exe
  C:\Windows\System\XmdtwiA.exe
  2⤵
  PID:7272
- C:\Windows\System\lcNMBxA.exe
  C:\Windows\System\lcNMBxA.exe
  2⤵
  PID:7288
- C:\Windows\System\RSarHsE.exe
  C:\Windows\System\RSarHsE.exe
  2⤵
  PID:7304
- C:\Windows\System\ZqVrXvW.exe
  C:\Windows\System\ZqVrXvW.exe
  2⤵
  PID:7320
- C:\Windows\System\SQTYZdS.exe
  C:\Windows\System\SQTYZdS.exe
  2⤵
  PID:7336
- C:\Windows\System\WeJbasV.exe
  C:\Windows\System\WeJbasV.exe
  2⤵
  PID:7352
- C:\Windows\System\lVQvRLs.exe
  C:\Windows\System\lVQvRLs.exe
  2⤵
  PID:7368
- C:\Windows\System\XxnUNqk.exe
  C:\Windows\System\XxnUNqk.exe
  2⤵
  PID:7384
- C:\Windows\System\yCScGJW.exe
  C:\Windows\System\yCScGJW.exe
  2⤵
  PID:7400
- C:\Windows\System\qnVFQRB.exe
  C:\Windows\System\qnVFQRB.exe
  2⤵
  PID:7416
- C:\Windows\System\apkzKcc.exe
  C:\Windows\System\apkzKcc.exe
  2⤵
  PID:7432
- C:\Windows\System\tapSaCQ.exe
  C:\Windows\System\tapSaCQ.exe
  2⤵
  PID:7448
- C:\Windows\System\RJNjErk.exe
  C:\Windows\System\RJNjErk.exe
  2⤵
  PID:7464
- C:\Windows\System\QkLrhOB.exe
  C:\Windows\System\QkLrhOB.exe
  2⤵
  PID:7480
- C:\Windows\System\hxMlnng.exe
  C:\Windows\System\hxMlnng.exe
  2⤵
  PID:7496
- C:\Windows\System\WCFKKoQ.exe
  C:\Windows\System\WCFKKoQ.exe
  2⤵
  PID:7512
- C:\Windows\System\cKMamqJ.exe
  C:\Windows\System\cKMamqJ.exe
  2⤵
  PID:7528
- C:\Windows\System\gnxXvxr.exe
  C:\Windows\System\gnxXvxr.exe
  2⤵
  PID:7544
- C:\Windows\System\bOUbOzL.exe
  C:\Windows\System\bOUbOzL.exe
  2⤵
  PID:7560
- C:\Windows\System\Zsufrmo.exe
  C:\Windows\System\Zsufrmo.exe
  2⤵
  PID:7576
- C:\Windows\System\pDxCeDa.exe
  C:\Windows\System\pDxCeDa.exe
  2⤵
  PID:7592
- C:\Windows\System\ScFJtXS.exe
  C:\Windows\System\ScFJtXS.exe
  2⤵
  PID:7612
- C:\Windows\System\kJXmuJV.exe
  C:\Windows\System\kJXmuJV.exe
  2⤵
  PID:7628
- C:\Windows\System\TleAZvO.exe
  C:\Windows\System\TleAZvO.exe
  2⤵
  PID:7644
- C:\Windows\System\KrJRroZ.exe
  C:\Windows\System\KrJRroZ.exe
  2⤵
  PID:7660
- C:\Windows\System\KNnOyjp.exe
  C:\Windows\System\KNnOyjp.exe
  2⤵
  PID:7676
- C:\Windows\System\hwSaVDs.exe
  C:\Windows\System\hwSaVDs.exe
  2⤵
  PID:7692
- C:\Windows\System\lvBHiUO.exe
  C:\Windows\System\lvBHiUO.exe
  2⤵
  PID:7708
- C:\Windows\System\OrELcky.exe
  C:\Windows\System\OrELcky.exe
  2⤵
  PID:7724
- C:\Windows\System\iQFINXz.exe
  C:\Windows\System\iQFINXz.exe
  2⤵
  PID:7740
- C:\Windows\System\iYWtIOO.exe
  C:\Windows\System\iYWtIOO.exe
  2⤵
  PID:7756
- C:\Windows\System\obqaBuA.exe
  C:\Windows\System\obqaBuA.exe
  2⤵
  PID:7772
- C:\Windows\System\tVcjRHh.exe
  C:\Windows\System\tVcjRHh.exe
  2⤵
  PID:7788
- C:\Windows\System\mzoOAbS.exe
  C:\Windows\System\mzoOAbS.exe
  2⤵
  PID:7804
- C:\Windows\System\NJfYfwM.exe
  C:\Windows\System\NJfYfwM.exe
  2⤵
  PID:7824
- C:\Windows\System\Grdhroh.exe
  C:\Windows\System\Grdhroh.exe
  2⤵
  PID:7840
- C:\Windows\System\qlULNfn.exe
  C:\Windows\System\qlULNfn.exe
  2⤵
  PID:7856
- C:\Windows\System\xuLTiCd.exe
  C:\Windows\System\xuLTiCd.exe
  2⤵
  PID:7872
- C:\Windows\System\DbGhZff.exe
  C:\Windows\System\DbGhZff.exe
  2⤵
  PID:7888
- C:\Windows\System\KvqqMsZ.exe
  C:\Windows\System\KvqqMsZ.exe
  2⤵
  PID:7904
- C:\Windows\System\VbXdnol.exe
  C:\Windows\System\VbXdnol.exe
  2⤵
  PID:7920
- C:\Windows\System\AIXvCGo.exe
  C:\Windows\System\AIXvCGo.exe
  2⤵
  PID:7936
- C:\Windows\System\ABnaCPJ.exe
  C:\Windows\System\ABnaCPJ.exe
  2⤵
  PID:7952
- C:\Windows\System\EsmJMEj.exe
  C:\Windows\System\EsmJMEj.exe
  2⤵
  PID:7968
- C:\Windows\System\qPLQcER.exe
  C:\Windows\System\qPLQcER.exe
  2⤵
  PID:7988
- C:\Windows\System\xGxDzBi.exe
  C:\Windows\System\xGxDzBi.exe
  2⤵
  PID:8004
- C:\Windows\System\wCkrjwa.exe
  C:\Windows\System\wCkrjwa.exe
  2⤵
  PID:8020
- C:\Windows\System\JVIjGdz.exe
  C:\Windows\System\JVIjGdz.exe
  2⤵
  PID:8040
- C:\Windows\System\AhttWnW.exe
  C:\Windows\System\AhttWnW.exe
  2⤵
  PID:8056
- C:\Windows\System\wuwERSc.exe
  C:\Windows\System\wuwERSc.exe
  2⤵
  PID:8072
- C:\Windows\System\vOSJJoL.exe
  C:\Windows\System\vOSJJoL.exe
  2⤵
  PID:8088
- C:\Windows\System\WCVUmJh.exe
  C:\Windows\System\WCVUmJh.exe
  2⤵
  PID:8104
- C:\Windows\System\dHUgzsa.exe
  C:\Windows\System\dHUgzsa.exe
  2⤵
  PID:8124
- C:\Windows\System\AtRPsxS.exe
  C:\Windows\System\AtRPsxS.exe
  2⤵
  PID:8140
- C:\Windows\System\jdiTGRu.exe
  C:\Windows\System\jdiTGRu.exe
  2⤵
  PID:8156
- C:\Windows\System\tfSiaPV.exe
  C:\Windows\System\tfSiaPV.exe
  2⤵
  PID:8176
- C:\Windows\System\Lvojwlg.exe
  C:\Windows\System\Lvojwlg.exe
  2⤵
  PID:7196
- C:\Windows\System\TZGyfGo.exe
  C:\Windows\System\TZGyfGo.exe
  2⤵
  PID:7184
- C:\Windows\System\OeSWVIh.exe
  C:\Windows\System\OeSWVIh.exe
  2⤵
  PID:7044
- C:\Windows\System\UrQKnBx.exe
  C:\Windows\System\UrQKnBx.exe
  2⤵
  PID:6656
- C:\Windows\System\GZLHXgZ.exe
  C:\Windows\System\GZLHXgZ.exe
  2⤵
  PID:7248
- C:\Windows\System\JDnaAzW.exe
  C:\Windows\System\JDnaAzW.exe
  2⤵
  PID:7296
- C:\Windows\System\ASIdTvo.exe
  C:\Windows\System\ASIdTvo.exe
  2⤵
  PID:7364
- C:\Windows\System\HKOZZZv.exe
  C:\Windows\System\HKOZZZv.exe
  2⤵
  PID:7424
- C:\Windows\System\dScFFRn.exe
  C:\Windows\System\dScFFRn.exe
  2⤵
  PID:7312
- C:\Windows\System\VshjtMK.exe
  C:\Windows\System\VshjtMK.exe
  2⤵
  PID:7488
- C:\Windows\System\jMFtBgS.exe
  C:\Windows\System\jMFtBgS.exe
  2⤵
  PID:7344
- C:\Windows\System\dhJkQzn.exe
  C:\Windows\System\dhJkQzn.exe
  2⤵
  PID:7556
- C:\Windows\System\XVmgMIF.exe
  C:\Windows\System\XVmgMIF.exe
  2⤵
  PID:7624
- C:\Windows\System\mwDcYZj.exe
  C:\Windows\System\mwDcYZj.exe
  2⤵
  PID:7716
- C:\Windows\System\TDMraSH.exe
  C:\Windows\System\TDMraSH.exe
  2⤵
  PID:7472
- C:\Windows\System\GfyKLmK.exe
  C:\Windows\System\GfyKLmK.exe
  2⤵
  PID:7536
- C:\Windows\System\espDZpW.exe
  C:\Windows\System\espDZpW.exe
  2⤵
  PID:7572
- C:\Windows\System\hYvmvUL.exe
  C:\Windows\System\hYvmvUL.exe
  2⤵
  PID:7704
- C:\Windows\System\oYDmHsU.exe
  C:\Windows\System\oYDmHsU.exe
  2⤵
  PID:7672
- C:\Windows\System\RqLofSN.exe
  C:\Windows\System\RqLofSN.exe
  2⤵
  PID:8012
- C:\Windows\System\FijzTIw.exe
  C:\Windows\System\FijzTIw.exe
  2⤵
  PID:7764
- C:\Windows\System\pnowJTd.exe
  C:\Windows\System\pnowJTd.exe
  2⤵
  PID:8080
- C:\Windows\System\TaiocIb.exe
  C:\Windows\System\TaiocIb.exe
  2⤵
  PID:8120
- C:\Windows\System\XGdUCBJ.exe
  C:\Windows\System\XGdUCBJ.exe
  2⤵
  PID:7800
- C:\Windows\System\dlizKGi.exe
  C:\Windows\System\dlizKGi.exe
  2⤵
  PID:8100
- C:\Windows\System\rxfefIY.exe
  C:\Windows\System\rxfefIY.exe
  2⤵
  PID:6500
- C:\Windows\System\nMQrZOq.exe
  C:\Windows\System\nMQrZOq.exe
  2⤵
  PID:7996
- C:\Windows\System\iELwGSy.exe
  C:\Windows\System\iELwGSy.exe
  2⤵
  PID:7264
- C:\Windows\System\IRhlkNe.exe
  C:\Windows\System\IRhlkNe.exe
  2⤵
  PID:8168
- C:\Windows\System\ZSBojOa.exe
  C:\Windows\System\ZSBojOa.exe
  2⤵
  PID:8136
- C:\Windows\System\yLjRjrD.exe
  C:\Windows\System\yLjRjrD.exe
  2⤵
  PID:6548
- C:\Windows\System\BBYqSfj.exe
  C:\Windows\System\BBYqSfj.exe
  2⤵
  PID:7360
- C:\Windows\System\RlfgfuZ.exe
  C:\Windows\System\RlfgfuZ.exe
  2⤵
  PID:7520
- C:\Windows\System\FVpouro.exe
  C:\Windows\System\FVpouro.exe
  2⤵
  PID:7504
- C:\Windows\System\vupCcIQ.exe
  C:\Windows\System\vupCcIQ.exe
  2⤵
  PID:7004
- C:\Windows\System\BvWbUvO.exe
  C:\Windows\System\BvWbUvO.exe
  2⤵
  PID:7268
- C:\Windows\System\Zttfzih.exe
  C:\Windows\System\Zttfzih.exe
  2⤵
  PID:7460
- C:\Windows\System\QHVTpXS.exe
  C:\Windows\System\QHVTpXS.exe
  2⤵
  PID:7688
- C:\Windows\System\IROSRdD.exe
  C:\Windows\System\IROSRdD.exe
  2⤵
  PID:7640
- C:\Windows\System\XYMzzno.exe
  C:\Windows\System\XYMzzno.exe
  2⤵
  PID:7780
- C:\Windows\System\itBnHHS.exe
  C:\Windows\System\itBnHHS.exe
  2⤵
  PID:7848
- C:\Windows\System\WtXHqIJ.exe
  C:\Windows\System\WtXHqIJ.exe
  2⤵
  PID:7912
- C:\Windows\System\IFVICTa.exe
  C:\Windows\System\IFVICTa.exe
  2⤵
  PID:7976
- C:\Windows\System\KSwAxia.exe
  C:\Windows\System\KSwAxia.exe
  2⤵
  PID:7832
- C:\Windows\System\OFcqUbs.exe
  C:\Windows\System\OFcqUbs.exe
  2⤵
  PID:8132
- C:\Windows\System\JtMOVVq.exe
  C:\Windows\System\JtMOVVq.exe
  2⤵
  PID:8084
- C:\Windows\System\bwiNsVn.exe
  C:\Windows\System\bwiNsVn.exe
  2⤵
  PID:8096
- C:\Windows\System\GiRrXWr.exe
  C:\Windows\System\GiRrXWr.exe
  2⤵
  PID:8164
- C:\Windows\System\yvCkRnG.exe
  C:\Windows\System\yvCkRnG.exe
  2⤵
  PID:7492
- C:\Windows\System\dpaIxBZ.exe
  C:\Windows\System\dpaIxBZ.exe
  2⤵
  PID:8032
- C:\Windows\System\pvsJbbL.exe
  C:\Windows\System\pvsJbbL.exe
  2⤵
  PID:7332
- C:\Windows\System\SOUuQUJ.exe
  C:\Windows\System\SOUuQUJ.exe
  2⤵
  PID:7636
- C:\Windows\System\XJwmUQx.exe
  C:\Windows\System\XJwmUQx.exe
  2⤵
  PID:7456
- C:\Windows\System\EkubOum.exe
  C:\Windows\System\EkubOum.exe
  2⤵
  PID:7820
- C:\Windows\System\KogXFTL.exe
  C:\Windows\System\KogXFTL.exe
  2⤵
  PID:7752
- C:\Windows\System\QJqttSX.exe
  C:\Windows\System\QJqttSX.exe
  2⤵
  PID:7524
- C:\Windows\System\xZxXmNO.exe
  C:\Windows\System\xZxXmNO.exe
  2⤵
  PID:7656
- C:\Windows\System\UqShvPV.exe
  C:\Windows\System\UqShvPV.exe
  2⤵
  PID:7732
- C:\Windows\System\DFKzGJq.exe
  C:\Windows\System\DFKzGJq.exe
  2⤵
  PID:7212
- C:\Windows\System\HrIHOOK.exe
  C:\Windows\System\HrIHOOK.exe
  2⤵
  PID:7396
- C:\Windows\System\TFmGZrF.exe
  C:\Windows\System\TFmGZrF.exe
  2⤵
  PID:8116
- C:\Windows\System\brAzmaS.exe
  C:\Windows\System\brAzmaS.exe
  2⤵
  PID:8048
- C:\Windows\System\TmhFOiO.exe
  C:\Windows\System\TmhFOiO.exe
  2⤵
  PID:8000
- C:\Windows\System\gIDmtKS.exe
  C:\Windows\System\gIDmtKS.exe
  2⤵
  PID:8204
- C:\Windows\System\wLPgfzq.exe
  C:\Windows\System\wLPgfzq.exe
  2⤵
  PID:8220
- C:\Windows\System\MkVknuR.exe
  C:\Windows\System\MkVknuR.exe
  2⤵
  PID:8236
- C:\Windows\System\IfyqTdn.exe
  C:\Windows\System\IfyqTdn.exe
  2⤵
  PID:8484
- C:\Windows\System\VuWpgDG.exe
  C:\Windows\System\VuWpgDG.exe
  2⤵
  PID:8500
- C:\Windows\System\SMSJLwY.exe
  C:\Windows\System\SMSJLwY.exe
  2⤵
  PID:8516
- C:\Windows\System\oMHYHGu.exe
  C:\Windows\System\oMHYHGu.exe
  2⤵
  PID:8532
- C:\Windows\System\xHKfJIw.exe
  C:\Windows\System\xHKfJIw.exe
  2⤵
  PID:8548
- C:\Windows\System\ViKOveV.exe
  C:\Windows\System\ViKOveV.exe
  2⤵
  PID:8564
- C:\Windows\System\mPcWnDs.exe
  C:\Windows\System\mPcWnDs.exe
  2⤵
  PID:8592
- C:\Windows\System\iMTehLh.exe
  C:\Windows\System\iMTehLh.exe
  2⤵
  PID:8608
- C:\Windows\System\PWbyqSU.exe
  C:\Windows\System\PWbyqSU.exe
  2⤵
  PID:8624
- C:\Windows\System\RFDQHOH.exe
  C:\Windows\System\RFDQHOH.exe
  2⤵
  PID:8640
- C:\Windows\System\apXvfYk.exe
  C:\Windows\System\apXvfYk.exe
  2⤵
  PID:8656
- C:\Windows\System\SsCDsmf.exe
  C:\Windows\System\SsCDsmf.exe
  2⤵
  PID:8672
- C:\Windows\System\VSkKsUr.exe
  C:\Windows\System\VSkKsUr.exe
  2⤵
  PID:8700
- C:\Windows\System\LArxjfY.exe
  C:\Windows\System\LArxjfY.exe
  2⤵
  PID:8716
- C:\Windows\System\WyZdRnt.exe
  C:\Windows\System\WyZdRnt.exe
  2⤵
  PID:8736
- C:\Windows\System\sYwPCDG.exe
  C:\Windows\System\sYwPCDG.exe
  2⤵
  PID:8760
- C:\Windows\System\whFlxZM.exe
  C:\Windows\System\whFlxZM.exe
  2⤵
  PID:8776
- C:\Windows\System\Qfdkatd.exe
  C:\Windows\System\Qfdkatd.exe
  2⤵
  PID:8792
- C:\Windows\System\vdLHRac.exe
  C:\Windows\System\vdLHRac.exe
  2⤵
  PID:8812
- C:\Windows\System\SLSfiHO.exe
  C:\Windows\System\SLSfiHO.exe
  2⤵
  PID:8828
- C:\Windows\System\xJdJbRQ.exe
  C:\Windows\System\xJdJbRQ.exe
  2⤵
  PID:8844
- C:\Windows\System\NWkyhYz.exe
  C:\Windows\System\NWkyhYz.exe
  2⤵
  PID:8864
- C:\Windows\System\VhTNzCO.exe
  C:\Windows\System\VhTNzCO.exe
  2⤵
  PID:8880
- C:\Windows\System\YSdFXwq.exe
  C:\Windows\System\YSdFXwq.exe
  2⤵
  PID:8900
- C:\Windows\System\ItnbEJK.exe
  C:\Windows\System\ItnbEJK.exe
  2⤵
  PID:8916
- C:\Windows\System\HddjOBG.exe
  C:\Windows\System\HddjOBG.exe
  2⤵
  PID:8932
- C:\Windows\System\iyZgOsj.exe
  C:\Windows\System\iyZgOsj.exe
  2⤵
  PID:8948
- C:\Windows\System\AtSJKQu.exe
  C:\Windows\System\AtSJKQu.exe
  2⤵
  PID:8968
- C:\Windows\System\rbemhUz.exe
  C:\Windows\System\rbemhUz.exe
  2⤵
  PID:8988
- C:\Windows\System\CsYFOoA.exe
  C:\Windows\System\CsYFOoA.exe
  2⤵
  PID:9004
- C:\Windows\System\VjKogoU.exe
  C:\Windows\System\VjKogoU.exe
  2⤵
  PID:9020
- C:\Windows\System\JwemFUb.exe
  C:\Windows\System\JwemFUb.exe
  2⤵
  PID:9036
- C:\Windows\System\rGyeKic.exe
  C:\Windows\System\rGyeKic.exe
  2⤵
  PID:9052
- C:\Windows\System\tsQlzdR.exe
  C:\Windows\System\tsQlzdR.exe
  2⤵
  PID:9068
- C:\Windows\System\nenLZIQ.exe
  C:\Windows\System\nenLZIQ.exe
  2⤵
  PID:9088
- C:\Windows\System\tvaRfVj.exe
  C:\Windows\System\tvaRfVj.exe
  2⤵
  PID:9104
- C:\Windows\System\xLzoHjP.exe
  C:\Windows\System\xLzoHjP.exe
  2⤵
  PID:9120
- C:\Windows\System\MQdYRoI.exe
  C:\Windows\System\MQdYRoI.exe
  2⤵
  PID:9136
- C:\Windows\System\jfTeSnv.exe
  C:\Windows\System\jfTeSnv.exe
  2⤵
  PID:9152
- C:\Windows\System\kvBgoOc.exe
  C:\Windows\System\kvBgoOc.exe
  2⤵
  PID:9168
- C:\Windows\System\woXIdHp.exe
  C:\Windows\System\woXIdHp.exe
  2⤵
  PID:9184
- C:\Windows\System\CvjEYzt.exe
  C:\Windows\System\CvjEYzt.exe
  2⤵
  PID:9204
- C:\Windows\System\jdfubXZ.exe
  C:\Windows\System\jdfubXZ.exe
  2⤵
  PID:7812
- C:\Windows\System\VVZOxHq.exe
  C:\Windows\System\VVZOxHq.exe
  2⤵
  PID:8212
- C:\Windows\System\nmDblbR.exe
  C:\Windows\System\nmDblbR.exe
  2⤵
  PID:8068
- C:\Windows\System\ENtIpSS.exe
  C:\Windows\System\ENtIpSS.exe
  2⤵
  PID:7748
- C:\Windows\System\IkexlFv.exe
  C:\Windows\System\IkexlFv.exe
  2⤵
  PID:8200
- C:\Windows\System\Xdtdvdm.exe
  C:\Windows\System\Xdtdvdm.exe
  2⤵
  PID:8252
- C:\Windows\System\ksTIcxu.exe
  C:\Windows\System\ksTIcxu.exe
  2⤵
  PID:8288
- C:\Windows\System\ANXxNGO.exe
  C:\Windows\System\ANXxNGO.exe
  2⤵
  PID:8344
- C:\Windows\System\xuUQEQl.exe
  C:\Windows\System\xuUQEQl.exe
  2⤵
  PID:8284
- C:\Windows\System\vuUkWll.exe
  C:\Windows\System\vuUkWll.exe
  2⤵
  PID:8308
- C:\Windows\System\MjRmlZo.exe
  C:\Windows\System\MjRmlZo.exe
  2⤵
  PID:8440
- C:\Windows\System\OwWnIRH.exe
  C:\Windows\System\OwWnIRH.exe
  2⤵
  PID:8456
- C:\Windows\System\JyBDhON.exe
  C:\Windows\System\JyBDhON.exe
  2⤵
  PID:8472
- C:\Windows\System\RZvelCT.exe
  C:\Windows\System\RZvelCT.exe
  2⤵
  PID:8292
- C:\Windows\System\lYEtXjS.exe
  C:\Windows\System\lYEtXjS.exe
  2⤵
  PID:8340
- C:\Windows\System\DUYnrnO.exe
  C:\Windows\System\DUYnrnO.exe
  2⤵
  PID:8360
- C:\Windows\System\rJWNvWx.exe
  C:\Windows\System\rJWNvWx.exe
  2⤵
  PID:8368
- C:\Windows\System\JHHdmtZ.exe
  C:\Windows\System\JHHdmtZ.exe
  2⤵
  PID:8412
- C:\Windows\System\fYJBUzn.exe
  C:\Windows\System\fYJBUzn.exe
  2⤵
  PID:8428
- C:\Windows\System\FNbTrak.exe
  C:\Windows\System\FNbTrak.exe
  2⤵
  PID:8512
- C:\Windows\System\yNKAiIS.exe
  C:\Windows\System\yNKAiIS.exe
  2⤵
  PID:8576
- C:\Windows\System\XXTSKYW.exe
  C:\Windows\System\XXTSKYW.exe
  2⤵
  PID:8616
- C:\Windows\System\yzNidMB.exe
  C:\Windows\System\yzNidMB.exe
  2⤵
  PID:8680
- C:\Windows\System\HSseehH.exe
  C:\Windows\System\HSseehH.exe
  2⤵
  PID:8496
- C:\Windows\System\krgnzxX.exe
  C:\Windows\System\krgnzxX.exe
  2⤵
  PID:8600
- C:\Windows\System\PPcJfoR.exe
  C:\Windows\System\PPcJfoR.exe
  2⤵
  PID:8664
- C:\Windows\System\CahjvIP.exe
  C:\Windows\System\CahjvIP.exe
  2⤵
  PID:8684
- C:\Windows\System\JyAItFc.exe
  C:\Windows\System\JyAItFc.exe
  2⤵
  PID:8732
- C:\Windows\System\PRYunMr.exe
  C:\Windows\System\PRYunMr.exe
  2⤵
  PID:8808
- C:\Windows\System\NiZdFkE.exe
  C:\Windows\System\NiZdFkE.exe
  2⤵
  PID:8872
- C:\Windows\System\gaswjIj.exe
  C:\Windows\System\gaswjIj.exe
  2⤵
  PID:8940
- C:\Windows\System\UCNWjQq.exe
  C:\Windows\System\UCNWjQq.exe
  2⤵
  PID:8984
- C:\Windows\System\ydTbRRb.exe
  C:\Windows\System\ydTbRRb.exe
  2⤵
  PID:9012
- C:\Windows\System\WAtttdT.exe
  C:\Windows\System\WAtttdT.exe
  2⤵
  PID:9048
- C:\Windows\System\KPpHIdT.exe
  C:\Windows\System\KPpHIdT.exe
  2⤵
  PID:9112
- C:\Windows\System\dxLUEeL.exe
  C:\Windows\System\dxLUEeL.exe
  2⤵
  PID:9176
- C:\Windows\System\FJdhkpv.exe
  C:\Windows\System\FJdhkpv.exe
  2⤵
  PID:8896
- C:\Windows\System\mLoAkwl.exe
  C:\Windows\System\mLoAkwl.exe
  2⤵
  PID:9180
- C:\Windows\System\VqBwSTt.exe
  C:\Windows\System\VqBwSTt.exe
  2⤵
  PID:9212
- C:\Windows\System\gNZJqAf.exe
  C:\Windows\System\gNZJqAf.exe
  2⤵
  PID:8788
- C:\Windows\System\GomsSmM.exe
  C:\Windows\System\GomsSmM.exe
  2⤵
  PID:8856
- C:\Windows\System\XwMQlWT.exe
  C:\Windows\System\XwMQlWT.exe
  2⤵
  PID:9000
- C:\Windows\System\uFMZLgD.exe
  C:\Windows\System\uFMZLgD.exe
  2⤵
  PID:9032
- C:\Windows\System\yUGcPbm.exe
  C:\Windows\System\yUGcPbm.exe
  2⤵
  PID:9096
- C:\Windows\System\UCOrbxs.exe
  C:\Windows\System\UCOrbxs.exe
  2⤵
  PID:9160
- C:\Windows\System\KPlVHld.exe
  C:\Windows\System\KPlVHld.exe
  2⤵
  PID:8196
- C:\Windows\System\TqZLmqe.exe
  C:\Windows\System\TqZLmqe.exe
  2⤵
  PID:8184
- C:\Windows\System\XcrJMLd.exe
  C:\Windows\System\XcrJMLd.exe
  2⤵
  PID:8328
- C:\Windows\System\MqmPHZh.exe
  C:\Windows\System\MqmPHZh.exe
  2⤵
  PID:8436
- C:\Windows\System\fhLYnhM.exe
  C:\Windows\System\fhLYnhM.exe
  2⤵
  PID:8332
- C:\Windows\System\lUPCFDi.exe
  C:\Windows\System\lUPCFDi.exe
  2⤵
  PID:8336
- C:\Windows\System\rWHMXvm.exe
  C:\Windows\System\rWHMXvm.exe
  2⤵
  PID:8420
- C:\Windows\System\DbpXTwJ.exe
  C:\Windows\System\DbpXTwJ.exe
  2⤵
  PID:8572
- C:\Windows\System\KixEJKX.exe
  C:\Windows\System\KixEJKX.exe
  2⤵
  PID:8508
- C:\Windows\System\ldiycxx.exe
  C:\Windows\System\ldiycxx.exe
  2⤵
  PID:8648
- C:\Windows\System\MzyZIGj.exe
  C:\Windows\System\MzyZIGj.exe
  2⤵
  PID:8588
- C:\Windows\System\pfZUucL.exe
  C:\Windows\System\pfZUucL.exe
  2⤵
  PID:8636
- C:\Windows\System\FgzcGfb.exe
  C:\Windows\System\FgzcGfb.exe
  2⤵
  PID:8724
- C:\Windows\System\xGwJKFR.exe
  C:\Windows\System\xGwJKFR.exe
  2⤵
  PID:8912
- C:\Windows\System\vokhfbR.exe
  C:\Windows\System\vokhfbR.exe
  2⤵
  PID:8976
- C:\Windows\System\kSOiqFS.exe
  C:\Windows\System\kSOiqFS.exe
  2⤵
  PID:8892
- C:\Windows\System\knmxdlj.exe
  C:\Windows\System\knmxdlj.exe
  2⤵
  PID:8980
- C:\Windows\System\eqjIPAE.exe
  C:\Windows\System\eqjIPAE.exe
  2⤵
  PID:8824
- C:\Windows\System\BgTbtjv.exe
  C:\Windows\System\BgTbtjv.exe
  2⤵
  PID:8996
- C:\Windows\System\yEwGptr.exe
  C:\Windows\System\yEwGptr.exe
  2⤵
  PID:8052
- C:\Windows\System\gqOkfYl.exe
  C:\Windows\System\gqOkfYl.exe
  2⤵
  PID:7280
- C:\Windows\System\CJIrsDa.exe
  C:\Windows\System\CJIrsDa.exe
  2⤵
  PID:8448
- C:\Windows\System\PDhlrzF.exe
  C:\Windows\System\PDhlrzF.exe
  2⤵
  PID:8352
- C:\Windows\System\xeGciaa.exe
  C:\Windows\System\xeGciaa.exe
  2⤵
  PID:7768
- C:\Windows\System\cIZSpag.exe
  C:\Windows\System\cIZSpag.exe
  2⤵
  PID:9060
- C:\Windows\System\YoNfNXJ.exe
  C:\Windows\System\YoNfNXJ.exe
  2⤵
  PID:8464
- C:\Windows\System\gieBoth.exe
  C:\Windows\System\gieBoth.exe
  2⤵
  PID:8248
- C:\Windows\System\NmimAaR.exe
  C:\Windows\System\NmimAaR.exe
  2⤵
  PID:9196
- C:\Windows\System\qaSUvsP.exe
  C:\Windows\System\qaSUvsP.exe
  2⤵
  PID:8888
- C:\Windows\System\NnSuGWT.exe
  C:\Windows\System\NnSuGWT.exe
  2⤵
  PID:8744
- C:\Windows\System\VaJlies.exe
  C:\Windows\System\VaJlies.exe
  2⤵
  PID:1576
- C:\Windows\System\gveVRGv.exe
  C:\Windows\System\gveVRGv.exe
  2⤵
  PID:8260
- C:\Windows\System\ATGUKpq.exe
  C:\Windows\System\ATGUKpq.exe
  2⤵
  PID:9128
- C:\Windows\System\taJTnaK.exe
  C:\Windows\System\taJTnaK.exe
  2⤵
  PID:8216
- C:\Windows\System\bYUpJWx.exe
  C:\Windows\System\bYUpJWx.exe
  2⤵
  PID:8424
- C:\Windows\System\xZJYYnZ.exe
  C:\Windows\System\xZJYYnZ.exe
  2⤵
  PID:8956
- C:\Windows\System\kXnNEki.exe
  C:\Windows\System\kXnNEki.exe
  2⤵
  PID:8356
- C:\Windows\System\iPiIfqE.exe
  C:\Windows\System\iPiIfqE.exe
  2⤵
  PID:8632
- C:\Windows\System\YltxdDv.exe
  C:\Windows\System\YltxdDv.exe
  2⤵
  PID:9084
- C:\Windows\System\qrdlcwF.exe
  C:\Windows\System\qrdlcwF.exe
  2⤵
  PID:8432
- C:\Windows\System\bBrAlac.exe
  C:\Windows\System\bBrAlac.exe
  2⤵
  PID:9228
- C:\Windows\System\jmqyjTN.exe
  C:\Windows\System\jmqyjTN.exe
  2⤵
  PID:9244
- C:\Windows\System\cDHixiC.exe
  C:\Windows\System\cDHixiC.exe
  2⤵
  PID:9260
- C:\Windows\System\zRxdvkT.exe
  C:\Windows\System\zRxdvkT.exe
  2⤵
  PID:9276
- C:\Windows\System\drenmqa.exe
  C:\Windows\System\drenmqa.exe
  2⤵
  PID:9296
- C:\Windows\System\SxoRkPc.exe
  C:\Windows\System\SxoRkPc.exe
  2⤵
  PID:9312
- C:\Windows\System\TZRlqsn.exe
  C:\Windows\System\TZRlqsn.exe
  2⤵
  PID:9328
- C:\Windows\System\LMRLoES.exe
  C:\Windows\System\LMRLoES.exe
  2⤵
  PID:9344
- C:\Windows\System\lUhFUWg.exe
  C:\Windows\System\lUhFUWg.exe
  2⤵
  PID:9360
- C:\Windows\System\fOQqbQn.exe
  C:\Windows\System\fOQqbQn.exe
  2⤵
  PID:9376
- C:\Windows\System\opLJOaz.exe
  C:\Windows\System\opLJOaz.exe
  2⤵
  PID:9392
- C:\Windows\System\YveMTzI.exe
  C:\Windows\System\YveMTzI.exe
  2⤵
  PID:9408
- C:\Windows\System\pOlMwQd.exe
  C:\Windows\System\pOlMwQd.exe
  2⤵
  PID:9424
- C:\Windows\System\jYbaBJN.exe
  C:\Windows\System\jYbaBJN.exe
  2⤵
  PID:9444
- C:\Windows\System\ZwKPwtD.exe
  C:\Windows\System\ZwKPwtD.exe
  2⤵
  PID:9460
- C:\Windows\System\PymAwlz.exe
  C:\Windows\System\PymAwlz.exe
  2⤵
  PID:9476
- C:\Windows\System\NuWlOVS.exe
  C:\Windows\System\NuWlOVS.exe
  2⤵
  PID:9492
- C:\Windows\System\oawQaqK.exe
  C:\Windows\System\oawQaqK.exe
  2⤵
  PID:9508
- C:\Windows\System\asVxsFU.exe
  C:\Windows\System\asVxsFU.exe
  2⤵
  PID:9524
- C:\Windows\System\nZvYACN.exe
  C:\Windows\System\nZvYACN.exe
  2⤵
  PID:9540
- C:\Windows\System\sLzfFku.exe
  C:\Windows\System\sLzfFku.exe
  2⤵
  PID:9556
- C:\Windows\System\QWfWJXS.exe
  C:\Windows\System\QWfWJXS.exe
  2⤵
  PID:9572
- C:\Windows\System\MObmxoi.exe
  C:\Windows\System\MObmxoi.exe
  2⤵
  PID:9588
- C:\Windows\System\MRpesCB.exe
  C:\Windows\System\MRpesCB.exe
  2⤵
  PID:9604
- C:\Windows\System\GesIOzo.exe
  C:\Windows\System\GesIOzo.exe
  2⤵
  PID:9620
- C:\Windows\System\nddzxAb.exe
  C:\Windows\System\nddzxAb.exe
  2⤵
  PID:9636
- C:\Windows\System\Tjlgfcf.exe
  C:\Windows\System\Tjlgfcf.exe
  2⤵
  PID:9652
- C:\Windows\System\VyjyYqU.exe
  C:\Windows\System\VyjyYqU.exe
  2⤵
  PID:9668
- C:\Windows\System\ZCtlZpE.exe
  C:\Windows\System\ZCtlZpE.exe
  2⤵
  PID:9684
- C:\Windows\System\iWgzLmA.exe
  C:\Windows\System\iWgzLmA.exe
  2⤵
  PID:9700
- C:\Windows\System\zUUYHKR.exe
  C:\Windows\System\zUUYHKR.exe
  2⤵
  PID:9716
- C:\Windows\System\estbXnt.exe
  C:\Windows\System\estbXnt.exe
  2⤵
  PID:9732
- C:\Windows\System\KLfCTJP.exe
  C:\Windows\System\KLfCTJP.exe
  2⤵
  PID:9748
- C:\Windows\System\QcZbhGb.exe
  C:\Windows\System\QcZbhGb.exe
  2⤵
  PID:9764
- C:\Windows\System\GKRkqTk.exe
  C:\Windows\System\GKRkqTk.exe
  2⤵
  PID:9780
- C:\Windows\System\WWdocBj.exe
  C:\Windows\System\WWdocBj.exe
  2⤵
  PID:9796
- C:\Windows\System\aPhaLIK.exe
  C:\Windows\System\aPhaLIK.exe
  2⤵
  PID:9812
- C:\Windows\System\xfOYAFi.exe
  C:\Windows\System\xfOYAFi.exe
  2⤵
  PID:9828
- C:\Windows\System\cWyvozT.exe
  C:\Windows\System\cWyvozT.exe
  2⤵
  PID:9844
- C:\Windows\System\QtVBxbT.exe
  C:\Windows\System\QtVBxbT.exe
  2⤵
  PID:9860
- C:\Windows\System\RaBHKWD.exe
  C:\Windows\System\RaBHKWD.exe
  2⤵
  PID:9876
- C:\Windows\System\mTGYpGM.exe
  C:\Windows\System\mTGYpGM.exe
  2⤵
  PID:9892
- C:\Windows\System\obQkAKM.exe
  C:\Windows\System\obQkAKM.exe
  2⤵
  PID:9908
- C:\Windows\System\nmYXDPB.exe
  C:\Windows\System\nmYXDPB.exe
  2⤵
  PID:9924
- C:\Windows\System\bxJljgu.exe
  C:\Windows\System\bxJljgu.exe
  2⤵
  PID:9940
- C:\Windows\System\NNORkLh.exe
  C:\Windows\System\NNORkLh.exe
  2⤵
  PID:9956
- C:\Windows\System\kEnzVxl.exe
  C:\Windows\System\kEnzVxl.exe
  2⤵
  PID:9972
- C:\Windows\System\BNDZBqc.exe
  C:\Windows\System\BNDZBqc.exe
  2⤵
  PID:9988
- C:\Windows\System\xmVcDRD.exe
  C:\Windows\System\xmVcDRD.exe
  2⤵
  PID:10004
- C:\Windows\System\NIlmJLZ.exe
  C:\Windows\System\NIlmJLZ.exe
  2⤵
  PID:10020
- C:\Windows\System\VoTIZaH.exe
  C:\Windows\System\VoTIZaH.exe
  2⤵
  PID:10036
- C:\Windows\System\rNmNPJn.exe
  C:\Windows\System\rNmNPJn.exe
  2⤵
  PID:10052
- C:\Windows\System\YLiTbmD.exe
  C:\Windows\System\YLiTbmD.exe
  2⤵
  PID:10068
- C:\Windows\System\KhQNoHs.exe
  C:\Windows\System\KhQNoHs.exe
  2⤵
  PID:10084
- C:\Windows\System\eHnsULe.exe
  C:\Windows\System\eHnsULe.exe
  2⤵
  PID:10100
- C:\Windows\System\fGDFfyf.exe
  C:\Windows\System\fGDFfyf.exe
  2⤵
  PID:10116
- C:\Windows\System\lcAxHiF.exe
  C:\Windows\System\lcAxHiF.exe
  2⤵
  PID:10136
- C:\Windows\System\mXQxjvn.exe
  C:\Windows\System\mXQxjvn.exe
  2⤵
  PID:10152
- C:\Windows\System\LUxtalC.exe
  C:\Windows\System\LUxtalC.exe
  2⤵
  PID:10168
- C:\Windows\System\YQTwVxO.exe
  C:\Windows\System\YQTwVxO.exe
  2⤵
  PID:10184
- C:\Windows\System\GRPDzWK.exe
  C:\Windows\System\GRPDzWK.exe
  2⤵
  PID:10200
- C:\Windows\System\UDbknAj.exe
  C:\Windows\System\UDbknAj.exe
  2⤵
  PID:10216
- C:\Windows\System\AgqqTZi.exe
  C:\Windows\System\AgqqTZi.exe
  2⤵
  PID:10232
- C:\Windows\System\PKqhPLa.exe
  C:\Windows\System\PKqhPLa.exe
  2⤵
  PID:9240
- C:\Windows\System\iqLuASD.exe
  C:\Windows\System\iqLuASD.exe
  2⤵
  PID:9268
- C:\Windows\System\hwOLIIJ.exe
  C:\Windows\System\hwOLIIJ.exe
  2⤵
  PID:9220
- C:\Windows\System\kRePOmU.exe
  C:\Windows\System\kRePOmU.exe
  2⤵
  PID:9272
- C:\Windows\System\wuQoOfc.exe
  C:\Windows\System\wuQoOfc.exe
  2⤵
  PID:9340
- C:\Windows\System\zkoYZKG.exe
  C:\Windows\System\zkoYZKG.exe
  2⤵
  PID:9324
- C:\Windows\System\aipJKNZ.exe
  C:\Windows\System\aipJKNZ.exe
  2⤵
  PID:9400
- C:\Windows\System\CvAHzRv.exe
  C:\Windows\System\CvAHzRv.exe
  2⤵
  PID:9388
- C:\Windows\System\PhGHvry.exe
  C:\Windows\System\PhGHvry.exe
  2⤵
  PID:8772
- C:\Windows\System\MZUUHxB.exe
  C:\Windows\System\MZUUHxB.exe
  2⤵
  PID:9468
- C:\Windows\System\cFaBDsX.exe
  C:\Windows\System\cFaBDsX.exe
  2⤵
  PID:9532
- C:\Windows\System\qAGTFSr.exe
  C:\Windows\System\qAGTFSr.exe
  2⤵
  PID:9520
- C:\Windows\System\MZrsxyA.exe
  C:\Windows\System\MZrsxyA.exe
  2⤵
  PID:9552
- C:\Windows\System\gNSmFlB.exe
  C:\Windows\System\gNSmFlB.exe
  2⤵
  PID:9596
- C:\Windows\System\EHGbEke.exe
  C:\Windows\System\EHGbEke.exe
  2⤵
  PID:9644
- C:\Windows\System\PfTXUJP.exe
  C:\Windows\System\PfTXUJP.exe
  2⤵
  PID:9612
- C:\Windows\System\GwvwpdC.exe
  C:\Windows\System\GwvwpdC.exe
  2⤵
  PID:9724
- C:\Windows\System\JTCGYka.exe
  C:\Windows\System\JTCGYka.exe
  2⤵
  PID:9680
- C:\Windows\System\Ypunuqk.exe
  C:\Windows\System\Ypunuqk.exe
  2⤵
  PID:9740
- C:\Windows\System\dRVDIeD.exe
  C:\Windows\System\dRVDIeD.exe
  2⤵
  PID:9792
- C:\Windows\System\aybUlIL.exe
  C:\Windows\System\aybUlIL.exe
  2⤵
  PID:9820
- C:\Windows\System\AiusHVr.exe
  C:\Windows\System\AiusHVr.exe
  2⤵
  PID:9884
- C:\Windows\System\UokCoZO.exe
  C:\Windows\System\UokCoZO.exe
  2⤵
  PID:9948
- C:\Windows\System\vbGljqq.exe
  C:\Windows\System\vbGljqq.exe
  2⤵
  PID:9980
- C:\Windows\System\jclLOPd.exe
  C:\Windows\System\jclLOPd.exe
  2⤵
  PID:9904
- C:\Windows\System\gJdcVGr.exe
  C:\Windows\System\gJdcVGr.exe
  2⤵
  PID:10048
- C:\Windows\System\hEETSnE.exe
  C:\Windows\System\hEETSnE.exe
  2⤵
  PID:10108
- C:\Windows\System\LUNBUJY.exe
  C:\Windows\System\LUNBUJY.exe
  2⤵
  PID:10180
- C:\Windows\System\voallYL.exe
  C:\Windows\System\voallYL.exe
  2⤵
  PID:10032
- C:\Windows\System\KUIYdZw.exe
  C:\Windows\System\KUIYdZw.exe
  2⤵
  PID:10064
- C:\Windows\System\WtBXrMt.exe
  C:\Windows\System\WtBXrMt.exe
  2⤵
  PID:7816
- C:\Windows\System\socrarQ.exe
  C:\Windows\System\socrarQ.exe
  2⤵
  PID:10192
- C:\Windows\System\MGCSFKw.exe
  C:\Windows\System\MGCSFKw.exe
  2⤵
  PID:10096
- C:\Windows\System\PgnIqps.exe
  C:\Windows\System\PgnIqps.exe
  2⤵
  PID:10132
- C:\Windows\System\FKurazh.exe
  C:\Windows\System\FKurazh.exe
  2⤵
  PID:9336
- C:\Windows\System\JfZgeSL.exe
  C:\Windows\System\JfZgeSL.exe
  2⤵
  PID:9372
- C:\Windows\System\kdnFAWk.exe
  C:\Windows\System\kdnFAWk.exe
  2⤵
  PID:9420
- C:\Windows\System\azgRlMv.exe
  C:\Windows\System\azgRlMv.exe
  2⤵
  PID:9488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EgIVAWz.exe

Filesize
1.7MB

MD5
a376c053fa172f71428b2613f1f6cdf3

SHA1
25b32b21228abc29c6d758358b1330f2eeb21ce6

SHA256
d586ffece072a48642adbb99793f872a3a5ecaa365d6e7463e5b151ae5509303

SHA512
fb9877cf78f50e3525b6dac4e7ce636ff151baab78462eded7c023d8833cc70c84a2a64313d40695a44dd9c679cb428a3b4f3f624bb67b78f5eac1d7c2848e57

Download Submit
C:\Windows\system\HrIoNPr.exe

Filesize
1.7MB

MD5
9094c355c63708a331183d00b77c6ed7

SHA1
cfb3f2897ae834d5010892dcef184658085dd648

SHA256
2efc3bd5e69e0c06e0945710e4dcb14015a563431edb9dec6c9f81329a0f0fbe

SHA512
f088503a820b78849c42cf64b3c5250b2b44a9964ec4ad4fe2430bf368d64120aaf97743b3578fe8e5edb6b3083de5871ffb442dfebee78cc7a05f27b7f9ed5c

Download Submit
C:\Windows\system\JfivpPn.exe

Filesize
1.7MB

MD5
c48a4ce16b9fb6067da76070d58549b0

SHA1
e73480a48547470349ebe0350f75e4f5744bf6af

SHA256
63afa01e4e15b1ecbe7f8fbdd2f42f5156c2dc7d4a7659ccee9906f1b622f362

SHA512
29ee9df89b2166048d838bb71940d5f99ec832515149293bece5402aee21bed3b84493285726e64df4a09a304e73e97c9d009556e1d7e003c99a370566d6d0e6

Download Submit
C:\Windows\system\JmxegNo.exe

Filesize
1.7MB

MD5
66685264d10702e7d9f3e6c525c21af1

SHA1
f39142497a7d97996e04a0df4bfaa815078fe11f

SHA256
66e20ca308eb8032632c6325b388e5a6310676be2c72767185cffff957e81e1e

SHA512
c92215548aecfb4ce3a7d3e2bd29c9b29d5bd03a85523fcf43414c0b267bc9052996455ee0b4f478c14babbede9936c4dcd348c1f72683852064dbcfb983a380

Download Submit
C:\Windows\system\LJkVxiE.exe

Filesize
1.7MB

MD5
86d3ae7c4f3a3b96a2b363702f04200c

SHA1
ad17fac8ee7908ed7a92545ee4421c915c6ba70e

SHA256
8e4f1c26a1de4a366e211cabe6d73aa35284e01442dcf54cd246635592d15981

SHA512
99b1acd4daf943907e6960ee967d0bf932ec7b8b27710c8092077749bf6052b4f2c358a839857dd23cf2caa48367419c08b6b202bd7763acc96c4e9f55aa2821

Download Submit
C:\Windows\system\OZQXbJa.exe

Filesize
1.7MB

MD5
ca77af7b2de53545dedeb9e5e4ad804c

SHA1
f8e236ee8d05d1f461cc859f06f92a6014b054e9

SHA256
9d1384d628a27bcec4a9df0946b4c2f9349b8582ad3eda99b3ef4ba1d66d01d0

SHA512
a24fb4b932804fe0b9c90ba7513d897f301658fb12c56e9421122816b9219fd98ceb42f6a01ccec140e41a5c7ce1e074653a1fa585b259032974761bc6508552

Download Submit
C:\Windows\system\UZQraci.exe

Filesize
1.7MB

MD5
da3bdb904541f70c4a2352e03f17b326

SHA1
53fdd6035084962a25a3b267471b4792520cef95

SHA256
45568d2d875e4d7272b264146e5b336fa5617a6a97d087ecc01b17d8ba3a1e97

SHA512
14d6b986b1fe5b854893a12d50afe5c528f2964ef39f478532c361c97ca0e7ea797cbc6cde2b8b988a41ba13021417d98d6b5b2c185b481f70cee199d1bb18b7

Download Submit
C:\Windows\system\aTalRvV.exe

Filesize
1.7MB

MD5
20ccf3e1daf48bc18a720e043b948ed4

SHA1
f8ef9bd9b6dc8eefe9b9a422eada3ea29b965087

SHA256
2adced441d26c07d3cff7aeeb8cf73f675907c3cdaf1e1c590d4cdfb237e3492

SHA512
0e1ddeb3665d3a0c7503a4b4f9c7afc375ae82df6eca59537e18da2ac7db773ead0d35d8cb9288a8af38b57779285dce7e4e09475dddaf136a9cc292f3576ae5

Download Submit
C:\Windows\system\bpnFlsK.exe

Filesize
1.7MB

MD5
bf0f61af069ed18fcb9f7f16b1c5182a

SHA1
bcf46ea262408c3e617d2e632a1b484bbeac49b4

SHA256
f96ada0175a262f92e4acef7a91995f8ebf66585ab5feb0dd1587aed26b3dab8

SHA512
44466ec5ea03115dc5ae0004c78391686f0f9ddf39323c8f5ba141eca96fcf36877bd1bb26852d971d6ab1f802f7e4b1d5eb844ead00c3bf294c30904b4f8396

Download Submit
C:\Windows\system\faddwbA.exe

Filesize
1.7MB

MD5
526694c78f5e9f2f3ca89da2d6bd0b84

SHA1
51096cd26862eb93d356a9c4eb7334eea095e0e6

SHA256
5f5117bfe59b5909f4329946f723a238316628d19277af5f6015d3c08c788c99

SHA512
8a3c078d2c4901fcf10f3d5809ef80638b2d2cf9142e94fd83600ae7b1c454dd9d27f16cfe8ab2013c192311582e4c9739784b5dbe45c5e84ef638dbb06e820b

Download Submit
C:\Windows\system\kcAKRtu.exe

Filesize
1.7MB

MD5
920b2796a534a9d644acbc738843c9b0

SHA1
207d83bce21bae613144b38ccacbb1f7c22f0af0

SHA256
d7835b4b770a887beb3fe36db9d0d39a2f43ca721fef71fad107d8bb4e735b08

SHA512
2efff4211bf50f4daf53574a5e46863597ade828dec9845e925af38755fc5607a8368123d9ca5e51db28a61098e110e7d224d5345bcb626751a8a67e693715d2

Download Submit
C:\Windows\system\komRbsh.exe

Filesize
1.7MB

MD5
7f1232162fe20223b567d8b0ca1078c2

SHA1
148780a41b16cfe12cb9bf78581849d60261dc7d

SHA256
58bbd14f0cf2eb3e730576363244c2bf897d5d011092ee95bf782e8145b93154

SHA512
c083b15cae5bfc99ec2b06c9b985bbbe5e5accf7f39f84685645fb0c28b0919b0f9be5c6f6ff63f8dcc4f925d04aaa3b4770fb5bf585df848b8d47c3f4f4b648

Download Submit
C:\Windows\system\nIQBriU.exe

Filesize
1.7MB

MD5
6b3edd70bb5b703b4279e1a31b8be9bb

SHA1
339d15eff550dbd98ea95b540ffef111ab5b9148

SHA256
24821cd15eedc7c0c8c28c9d6db8ae928004f9aef8088f35e85663ec1a9f1ea7

SHA512
d2678e8885a977dd77d2b653814e468e9396479e2db1722b7d5b4d6e07c9bee6a701ae8f5c819b02af6c7c951ac7f232828bcf1e926a05a2c5c14a32b9e255fc

Download Submit
C:\Windows\system\scNxCRD.exe

Filesize
1.7MB

MD5
728a30989ffa1cbea016efbff3622c68

SHA1
56b61e3517bf83c41978f509c009ef5b1ca8bac5

SHA256
5eaa7c3c9efb9ad4502a243f13f0c18adbba5e15a46e01b4f7294cde101b2fce

SHA512
4c9fdc55ee894f82295289ca5d6a0312f224629ffa42e534746997dfa352581b502d04c98b7bf5ad6738e90ea951e080d9954b8e5142ff945bd9860da043d2be

Download Submit
C:\Windows\system\uamkcrF.exe

Filesize
1.7MB

MD5
17fc5e2f6d1c41e46143cfb84f350274

SHA1
2d4eb9e3d68466a754920ee14646a9619420b591

SHA256
dee485d5d8d168f6d9c01351c050c450dceb9fe2519cf09c0368fe2586286004

SHA512
a25bd8f1f7f98e0c98cf4b83cbfe2be25ebbe839292b7daa2e98eee192bc1472c048e77cca2a25232ef4362ed82c7a96c97dbcbb2c31498ffb4564a88d516342

Download Submit
C:\Windows\system\upjFdbO.exe

Filesize
1.7MB

MD5
bafb9ddeac576a2580664a055ef13970

SHA1
49737021ad64bd687a66ebd846637b6c1e6f1cbe

SHA256
a9d0012749217e9c6d3a4e7a5026fb26750079f3c9b4ba8185ede6659664ff4f

SHA512
4a42bd0fa5c6e9a20762bd18abfd7db84118b8d35ac20071e67336bf4dcc806bcce486730345b33a2bdd2a0ca128b17f0533b65e21e9321b8259806db5f694f0

Download Submit
C:\Windows\system\zfrOiyQ.exe

Filesize
1.7MB

MD5
66ffb4bd5e89bac07f0305d2e3f1ec9c

SHA1
ee841290ab7bf2e2bc0515fbe0af01a59e6aef5c

SHA256
8ddf13ce2090f05af0a957c8d26675b341e413764c95901f55a9504451f08039

SHA512
58c0d4e7e5af8ee408fdb3bbc744fca7db82b05fe73be6c03f6cf28e7416d70ee0a6393ba17b6c451b41b11a636f9305cfd573007831ecefd8ee813c40de6a1e

Download Submit
\Windows\system\DvsCNkE.exe

Filesize
1.7MB

MD5
4d0d07b6f516882c007d540516978f82

SHA1
c8713bbfe3d28be4b2879218c8c2402665f5661a

SHA256
8436c57312e5f3c7306fd93973e932eeed3b2423a05693676b9c0ba817b7ffca

SHA512
42bef207b1b25fa41321b687934daba28d0f70e86256a6190e55006575273e38153f641c16fc1f083aa583d04e317c561967398b1e42ec7e25108d18aa63e704

Download Submit
\Windows\system\EzyYedZ.exe

Filesize
1.7MB

MD5
beff5cf5843121eab813362e1ad6ed96

SHA1
472904d76388efe9ec72497009146a54a2b65acc

SHA256
81b3f3fbae792ca49fe041a6c5ed357055107880758c69ebf1b8f00e21dca14b

SHA512
8b6d1df45de678ced0d9b8dc02fd00a145d99060758c56d5b6114e6d5aa042a86c9a37f2da109cf7c170f37541797df1a8b71e6b495c88c8261f7a2147898e87

Download Submit
\Windows\system\FMBtjzR.exe

Filesize
1.7MB

MD5
589ab0ed6efe57b7e6c430b51308f93b

SHA1
29464898f85e6c69640335f581b03fed09bd908c

SHA256
6587001955f5f4f503bd56b7263899200335e6b52df0310bd216e4cb55dc225f

SHA512
a7b0409444f0ce7bf0126db1d04b89f3f084cc6063416c6389d95898a3a5d39ec6ae7b6b5ef2fded27a65ad64de1075b37696af81b0f1a6faecf5df9c47c6885

Download Submit
\Windows\system\GnLUhqf.exe

Filesize
1.7MB

MD5
44e31eaaae4c05570689668b11c5cdda

SHA1
9643359ff31007569d8e099cc39547ef55180565

SHA256
0efa817b841bf84d60b5c2fc9affdd4ff72e7f05c7dabac075cfe324c942b174

SHA512
d3bc40e22be158d6c2ca2bfa4bf6ca26a7b940cbea9544688d7e99387216172cef2264e0f356669eeb3b32665cb6aebd14c023b275805b22980d926c136b0759

Download Submit
\Windows\system\HQVxaGS.exe

Filesize
1.7MB

MD5
2f0ccd9f2f9c131eddf5334d6fded554

SHA1
c0e1122e12657796ff775fba457fea0111c8c9b5

SHA256
8c36890161508c1edce947045f842baeb0afe9292c1ae02459f78751cb6692e9

SHA512
653bb3d5a19650c79f73959eeb320b5496386f79c36449dc75b8111290db594263dd45e3efaca84e304326212c5025b773e5554979dafc71d8ebebae7ae2d09a

Download Submit
\Windows\system\IyUGBja.exe

Filesize
1.7MB

MD5
5d9528ebb295a3697f4e28663d2f971e

SHA1
bc8b183969a87b5c79e98f90b1f15ee719e0fc2f

SHA256
e4c654c49833d1b0f82f307277d73de823b6466521010004a6e924e982217838

SHA512
082ebe05675fa337df80c5ce51b8059f63f2c70385b51e7b112dd7b68f0538ae35d62328a10ac49cd13efaa674e30f54765409662d5db05926bae7be3f42a548

Download Submit
\Windows\system\JeCbtev.exe

Filesize
1.7MB

MD5
c48466b32a10841de0b45cbb03c75244

SHA1
9dd5e6faa5a97c5d29d6abf356669096026edaa0

SHA256
b1600d8c22cef60032f1bef45f1d79ed5173809d1eda0e1719135db754601862

SHA512
017edf5ac75ff8f61cf6514e4e23df65968393a5c621aace40bb4dcc6aaa3f55a380e37c57a878181c8282b3b189d5edbb5a89cbe566b1ba723a671c1b72a5d3

Download Submit
\Windows\system\JfxuaUr.exe

Filesize
1.7MB

MD5
c50be50d1d65527eff26c206ebdd38d9

SHA1
7047536782b77053d74b86fa2c7b263dd0046217

SHA256
2f07e5028215bff6f593de2f050c9824c3e0323e0cdfed39c32f30ddaa514165

SHA512
2234775a5d39168606893d62d50c0e39ab31a71b6c9b2ed50dda03076bc4a6e9f49e611b25c012010feb76d22a0a713c17c4b63a5ff464db5fe1bc02c74abff4

Download Submit
\Windows\system\KPqJSZE.exe

Filesize
1.7MB

MD5
68036f62676dce3d813b2bbc8e258a35

SHA1
7ccafd1fa980f726c589aa435cd76af1fb791098

SHA256
cb80f9473857e6a1139c87209b116328913891f96c9f8c3c6d8562bd2c38ee2a

SHA512
167278d9891d1e75c846fb6dbeda3c074aa5adbb49dbb974b35306c5ecfa23505ef1c7672cbc94edc473f82d6e865eea13d1ce0f70d9256320eca9cfc41aa9d7

Download Submit
\Windows\system\LRMaQcu.exe

Filesize
1.7MB

MD5
2985755735ad724fb2f3b250207d90c4

SHA1
558e74ad22ce58f25262d5718e53eab3534592b5

SHA256
e993cc65d18e0369c241b3dd86a5862521fc3702eb4e94d34aca23adfb809147

SHA512
5fe05169a18c50b7b8c224bde0db0877ddda1508c76dc32b8b45aa407699e17e068e13fb026b0d98c11b3e706cca2655c449a2be03eae2efde1ba5d9b1ddbdf1

Download Submit
\Windows\system\UAstCOh.exe

Filesize
1.7MB

MD5
eb00c4ff78e254713c3388911bfd2479

SHA1
f1d5ef04d0b81858dff4d076808edcb950708f68

SHA256
3afaae855f683e9eb999a44bb36a63fbbfaa2aa61b41677febd414d73f80a796

SHA512
ff0f0f6181a6f481c081e85e7687f343eba41532c6c3e1d8d9cc3a4f1352c5df613531f1b75add2c37416e2e32c5efe3a32526d184daba9bac7df265025bfc2d

Download Submit
\Windows\system\UUqUlHy.exe

Filesize
1.7MB

MD5
127ef08c19e22e1e337d10659bdd1641

SHA1
937d2380300cf21c567c2dc2b445f53aab13f61f

SHA256
d80c4635a6033b7d1238c2288214b52781be182d78931ed168bd5ae3a5562020

SHA512
4e9ee124369a65471251491666cd27442c0d1247c2caed9062dacd6a4a2d05abc70f3d03f44ec35b7a4d79fbb0d9a8f38c1df765134644aa1942a81fe2e830cc

Download Submit
\Windows\system\XPUNJqh.exe

Filesize
1.7MB

MD5
147684324fdad83949ed2b73b8792fa1

SHA1
9da3fbf912b102258083e625655885439b929700

SHA256
63a57cb1a68205f0d3bf52c15f2cd3c835d219e779a20f40e4ff930bb32853d1

SHA512
7bfbeeb8d86d44c4bc31ce4e5d0b1391cfdd2619f792ac9d600757f17d5c12145ea4524a20187ccabd7a2f2940850f2a4f40bff2c7d902a915ef41ad5c7f8eb7

Download Submit
\Windows\system\XyMVZSR.exe

Filesize
1.7MB

MD5
41761464ed64fc5cf726389212310dc2

SHA1
4d861e8ccca670e2c412b26d88b5cc8dfafea7db

SHA256
7d98d1ac47f2433317acdbb0986c927da670bf87cc67bdf8aa6e238b36a9a97a

SHA512
7121d5cbfd1c99240a33ea8341b5a8255ead08aa6782d186b2873dea3579c0a7c818a6422f753c5002dda9662d9e50a9156ebbb36a266868b18cbedbdbac6adb

Download Submit
\Windows\system\gcJqEvk.exe

Filesize
1.7MB

MD5
0c647646ca65d7f4807626466d139de9

SHA1
2087e2296e02325a4d7de69e6d6c5f23da36525b

SHA256
223723f79a1b8c8ce2717e1b3821ec78d8322d21baea5dae185f687c8020ac3e

SHA512
4455113eeb38bcad37e310fd4ae27d72a09bbb2c97659d259deb640cadd151d44f9a1f4a8ba0788bb70d3ad2c17f223a4b486b528ab62460da2cb84a66ca6a50

Download Submit
\Windows\system\hoxQGia.exe

Filesize
1.7MB

MD5
d4002e0374579b61edff7c8bd67a7673

SHA1
cc0af748987533869ae94c2194d2d94f497bfe07

SHA256
c6d2dd29c975471da9e362606b87af7b0f998f347c6fa99cff99f7eee3903594

SHA512
c94e0673d66729fe55834317491fc700495375b59427ccdf8ef586e622d8c14cd794ba089930e109e8a5ee2cf0e0907b96fb40be5912a7f60aa95e894f733063

Download Submit
\Windows\system\poyJhqH.exe

Filesize
1.7MB

MD5
eda15f04b0468ebb2cf86184aca48a3e

SHA1
9789553f30878e65b1551f43b74863785fc5cffa

SHA256
c110a2ea71fbb21b023a158efbf4a2c6c48e640533c70b709efc047f16467945

SHA512
bc6f818eb5b1e44941879e57438f6c6509d41e291c382cf5d2a03f3098cf5a0f02306ed668c0265cc6ef840d4458885ccb6a64cccfdd79b394e197ba9092d810

Download Submit
\Windows\system\pzEIoKz.exe

Filesize
1.7MB

MD5
30bf993817d3bae3737134eb1773bd1e

SHA1
ea28d4914659c2e3627a73ddd4f9c55afd86608c

SHA256
3d60b857cca117d369c056fdfad2c221bf685e37bc902c6559163ae8eeaf0ea5

SHA512
89e24e74446b52ef45e0fbe2cfba5ae57f447f216174f9799902aa00aff53da12777b0c3b44209cfb03cfe74e9c79247d6bc1e2b6029bcd8827a7958a7cbf6ce

Download Submit
\Windows\system\rAviHBC.exe

Filesize
1.7MB

MD5
164c7b66359866053cb6af129d3ef8d9

SHA1
adac35f794b4dc38557fd29a40624e67c1da3435

SHA256
196ee7a6cf317987fa216d99092c465608c25cba1f4d21800ca51dc7b10389d5

SHA512
a458f655908a2bd02fcaa82dbe0e884ebbeb5eb67a8df5a6ea0530037b77a5770e2e204419daea9294cce1dac52ec5b581c87a8c75e4fae2dddf674fd0f53499

Download Submit
\Windows\system\sRYhnsF.exe

Filesize
1.7MB

MD5
10849f4cc5a3623d387cf675bcdef4bf

SHA1
a7ec91704af0457ac1ed769c9f49338a6ef78d6c

SHA256
9a669f8812cc3b14573ce1bd2addc0381d070ac484f7f07e369cd03dd90d8dce

SHA512
84a66b24b89c7b47fc17af4261f9f885b78b6b9817959b66c5120957cf4a3d86265a24e27cec27f65c005a0650affd3428e3f317a3f042be3ed7a98951aa4e1b

Download Submit
\Windows\system\uvONPeM.exe

Filesize
1.7MB

MD5
e3c7f63871716ddc4de51974a0fd1a2a

SHA1
2d49d89447e49cd3645c1ebf76e30fc497fb3fdf

SHA256
7480b26d8b088d98672fb9d45c1c5631d407edec5677b8bd3b4259cfa94861dc

SHA512
4f4ac8cf32b27dd1aad5619883ac11d24df31b2317dd42b193d27afc763c23e6e03da773fc56791c5cccbab81875c2a3d1c54a8defe9a94d29c20851bb836969

Download Submit
\Windows\system\xLyPpFm.exe

Filesize
1.7MB

MD5
f697b967d5e45463ac8a37b33c127e93

SHA1
a9794b9e2d3e212c34fcd1309df88357239f51e0

SHA256
e279ede84f99d351e2ce4e1a816280fd77d4df7178e90126df1ea8740c38674f

SHA512
33baf46666e2b015d11b71e7b3f7a6436ec62893e51d835c3d86290bfbc6b4103793df223c6a80457c84cb4e705c32c3df833c658c02b88d437d2c5762ad08ca

Download Submit
\Windows\system\xntQEJf.exe

Filesize
1.7MB

MD5
72191a4939808fcf5442486b7e8be15e

SHA1
c48893898f2c011be88aba7fdbe789f65c8b70e0

SHA256
3b135129b2c011a57d4aedec5ee4275d6ab03a3d0015ca9c700c31e6d88aa2ca

SHA512
667775d124a718644ac537259a45ef768b9821b0686aff8f59e33116499fd143a4cab4290fa73e10ecec95921698fa65d27390a481655c14db3f6e958ef0252f

Download Submit
memory/1424-226-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-242-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/1660-0-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-228-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-227-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/1660-233-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-11602-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/1660-11569-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-230-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-11276-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/1660-240-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1660-232-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/1660-7-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/1660-224-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-239-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/1660-10460-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-241-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/1660-11673-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/1660-237-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-235-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-238-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2512-6331-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2536-234-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2544-243-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2544-6296-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-222-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2616-223-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2672-231-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2696-6327-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2696-236-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2872-229-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2932-11-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download