xmrig | 15030ac1b31c43ee9222dc018f7a6d49eeea263a9ccb2271c20a9af160c1b631

Analysis

max time kernel
40s
max time network
37s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 19:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
Size

2.2MB
MD5

01739b9bc5d45f2329c68e2e491b779c
SHA1

7a31271a6fb78fb066fddbd99fa258b79c1354e7
SHA256

15030ac1b31c43ee9222dc018f7a6d49eeea263a9ccb2271c20a9af160c1b631
SHA512

6862266e690872b711b2a4506dfcd77cf2541e85443112de276b8e6147e830100e43720e8cc34a284d63d95694235d47ef7dc111c28c6f26451c6d7939d82016
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDI:NAB1

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral1/memory/2148-43-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/2544-45-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2536-40-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2732-62-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/2856-97-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig
behavioral1/memory/1616-75-0x000000013F260000-0x000000013F652000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2872	fkhZbsn.exe
2188	ipsloSW.exe
2536	GvfLczd.exe
2148	iLVcIRH.exe
2544	hKFgaVo.exe
2484	hwLTvbJ.exe
2732	QkQvEON.exe
1616	njpuXEE.exe
2856	sGKwhZq.exe
2972	dbPMhMa.exe
3032	hjsyOjm.exe
2776	xlVTcwr.exe
2468	zWFMAOD.exe
2780	HfPgLyc.exe
2660	DLuvhIN.exe
2652	BzGHYoO.exe
2808	xfcPIPB.exe
1200	AkPoCyO.exe
2100	yGQFelF.exe
2900	JqbWuvV.exe
1196	xyTjbcA.exe
1480	NCvFWfD.exe
1304	hicmsNA.exe
1084	ZBFrGva.exe
1132	sGJSmGZ.exe
1548	TdmLhDQ.exe
952	EPshoeR.exe
1056	SXUcnJh.exe
1792	IasXrcC.exe
836	ikcxLqf.exe
1584	uOCCKzZ.exe
2516	jOgHNSB.exe
2828	fRPQmad.exe
1724	ZRKcdsK.exe
2212	cpHLolU.exe
1716	rkOImai.exe
2384	eMkQZCv.exe
2408	RtnZwZE.exe
776	UlnqZss.exe
1256	xZBGASH.exe
1644	oWPJETF.exe
2080	KUdhhQl.exe
956	JKilhkO.exe
2276	ThRNUPo.exe
1772	hcAYwlj.exe
932	rAroLUH.exe
1828	RTuTBao.exe
2208	zviRAkO.exe
2016	qbePblh.exe
2204	lrItOaS.exe
1908	SVSZyie.exe
2936	nBuZKDu.exe
1600	kcwxOuB.exe
876	nGQApNy.exe
2376	RoVTbtS.exe
2044	RpTvMWp.exe
2124	BWdAExi.exe
2424	DPfofLN.exe
2620	oWCcACS.exe
2736	XpNvgLW.exe
2980	UAwYHNG.exe
3040	OdUGCMF.exe
2940	nnIqNOf.exe
1744	XPngjcN.exe

Loads dropped DLL 64 IoCs

pid	Process
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1812-0-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/files/0x000d00000001232e-3.dat	upx
behavioral1/files/0x002d000000014665-16.dat	upx
behavioral1/files/0x0008000000014983-20.dat	upx
behavioral1/memory/2188-18-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/memory/2872-17-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/files/0x001400000000549e-28.dat	upx
behavioral1/memory/2148-43-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/memory/2544-45-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/2536-40-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/files/0x0008000000014b12-34.dat	upx
behavioral1/files/0x0007000000014e5a-59.dat	upx
behavioral1/memory/2484-54-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/2732-62-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/files/0x002c000000014701-67.dat	upx
behavioral1/files/0x0006000000015cdb-86.dat	upx
behavioral1/files/0x0006000000016277-135.dat	upx
behavioral1/files/0x0006000000016525-138.dat	upx
behavioral1/files/0x00060000000167ef-143.dat	upx
behavioral1/files/0x0006000000016c17-152.dat	upx
behavioral1/files/0x0006000000016ce1-180.dat	upx
behavioral1/files/0x0006000000016d06-193.dat	upx
behavioral1/files/0x0006000000016411-127.dat	upx
behavioral1/files/0x0006000000016cf5-191.dat	upx
behavioral1/files/0x0006000000016cfe-189.dat	upx
behavioral1/files/0x0006000000016ced-183.dat	upx
behavioral1/files/0x0006000000016cab-175.dat	upx
behavioral1/files/0x0006000000016cc9-172.dat	upx
behavioral1/files/0x0006000000016c7a-166.dat	upx
behavioral1/files/0x0006000000016c26-159.dat	upx
behavioral1/files/0x0006000000016a45-147.dat	upx
behavioral1/files/0x0006000000016597-140.dat	upx
behavioral1/files/0x0006000000015cca-120.dat	upx
behavioral1/files/0x00060000000160f8-117.dat	upx
behavioral1/files/0x0006000000015f9e-111.dat	upx
behavioral1/files/0x0006000000015d6e-104.dat	upx
behavioral1/files/0x0006000000015d06-98.dat	upx
behavioral1/files/0x0006000000015cc1-92.dat	upx
behavioral1/files/0x0006000000015cec-89.dat	upx
behavioral1/files/0x0006000000016c2e-164.dat	upx
behavioral1/files/0x0006000000016056-134.dat	upx
behavioral1/files/0x0006000000015f1b-133.dat	upx
behavioral1/files/0x0006000000015d5d-132.dat	upx
behavioral1/files/0x0006000000015cf7-131.dat	upx
behavioral1/memory/2856-97-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/files/0x0008000000015cad-81.dat	upx
behavioral1/memory/1616-75-0x000000013F260000-0x000000013F652000-memory.dmp	upx
behavioral1/files/0x0007000000015023-66.dat	upx
behavioral1/files/0x0007000000014c25-53.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ojcqUhY.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\tybfsBb.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\gpNCAMS.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\OJcgucU.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\wjvFDII.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\YWkxakF.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\XrrqbEF.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\KPPWCVp.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\acHQRpN.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\tZxKnOj.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\CIcSwyt.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\AYeCBty.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\lBXeJWU.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\oDpOUPD.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\cgUgDEb.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\dkHjxmH.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\xFhyreC.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\EzWOcGh.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\drwRwrr.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\xuXlYwB.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\wyoBwqk.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\SMHVvLm.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\nwbjJVp.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\uUuFHho.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\vtqczXe.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\DkQDxFZ.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\oUCMQHM.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\MrSHeKX.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\gJGNmvj.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\IGVLelP.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\xkzjwvn.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\MYuaBRl.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\vBQsszb.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\WqAVhQP.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\mIOggIF.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\EgqvVGW.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\hSglSOT.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\qIynvwV.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\syQFkPc.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\nRNrBiH.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\zCBuHjq.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\qKXlINK.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\QkQvEON.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\bGkDpwJ.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\fXsTNsZ.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\XeHKRJN.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\SXRvNUO.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\jOgHNSB.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\ogSIQkG.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\ASDVxeH.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\ubgrEgF.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\fYUCKCy.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\iIekngS.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\ncgwlJe.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\ZBFrGva.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\JqXXRSR.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\kmuHqpS.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\WegrFPL.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\wMNemku.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\PYmWsKu.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\sbzFtSV.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\zIaThMr.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\cPUnueK.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
File created	C:\Windows\System\nKPxrwx.exe	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3052	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
Token: SeDebugPrivilege	3052	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 3052	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	29
PID 1812 wrote to memory of 3052	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	29
PID 1812 wrote to memory of 3052	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	29
PID 1812 wrote to memory of 2872	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	30
PID 1812 wrote to memory of 2872	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	30
PID 1812 wrote to memory of 2872	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	30
PID 1812 wrote to memory of 2188	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	31
PID 1812 wrote to memory of 2188	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	31
PID 1812 wrote to memory of 2188	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	31
PID 1812 wrote to memory of 2536	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	32
PID 1812 wrote to memory of 2536	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	32
PID 1812 wrote to memory of 2536	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	32
PID 1812 wrote to memory of 2148	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	33
PID 1812 wrote to memory of 2148	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	33
PID 1812 wrote to memory of 2148	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	33
PID 1812 wrote to memory of 2544	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	34
PID 1812 wrote to memory of 2544	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	34
PID 1812 wrote to memory of 2544	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	34
PID 1812 wrote to memory of 2484	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	35
PID 1812 wrote to memory of 2484	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	35
PID 1812 wrote to memory of 2484	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	35
PID 1812 wrote to memory of 2732	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	36
PID 1812 wrote to memory of 2732	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	36
PID 1812 wrote to memory of 2732	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	36
PID 1812 wrote to memory of 1616	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	37
PID 1812 wrote to memory of 1616	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	37
PID 1812 wrote to memory of 1616	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	37
PID 1812 wrote to memory of 2856	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	38
PID 1812 wrote to memory of 2856	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	38
PID 1812 wrote to memory of 2856	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	38
PID 1812 wrote to memory of 2972	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	39
PID 1812 wrote to memory of 2972	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	39
PID 1812 wrote to memory of 2972	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	39
PID 1812 wrote to memory of 3032	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	40
PID 1812 wrote to memory of 3032	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	40
PID 1812 wrote to memory of 3032	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	40
PID 1812 wrote to memory of 2468	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	41
PID 1812 wrote to memory of 2468	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	41
PID 1812 wrote to memory of 2468	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	41
PID 1812 wrote to memory of 2776	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	42
PID 1812 wrote to memory of 2776	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	42
PID 1812 wrote to memory of 2776	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	42
PID 1812 wrote to memory of 836	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	43
PID 1812 wrote to memory of 836	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	43
PID 1812 wrote to memory of 836	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	43
PID 1812 wrote to memory of 2780	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	44
PID 1812 wrote to memory of 2780	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	44
PID 1812 wrote to memory of 2780	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	44
PID 1812 wrote to memory of 1584	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	45
PID 1812 wrote to memory of 1584	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	45
PID 1812 wrote to memory of 1584	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	45
PID 1812 wrote to memory of 2660	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	46
PID 1812 wrote to memory of 2660	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	46
PID 1812 wrote to memory of 2660	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	46
PID 1812 wrote to memory of 2516	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	47
PID 1812 wrote to memory of 2516	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	47
PID 1812 wrote to memory of 2516	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	47
PID 1812 wrote to memory of 2652	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	48
PID 1812 wrote to memory of 2652	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	48
PID 1812 wrote to memory of 2652	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	48
PID 1812 wrote to memory of 2828	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	49
PID 1812 wrote to memory of 2828	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	49
PID 1812 wrote to memory of 2828	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	49
PID 1812 wrote to memory of 2808	1812	01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01739b9bc5d45f2329c68e2e491b779c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3052
- C:\Windows\System\fkhZbsn.exe
  C:\Windows\System\fkhZbsn.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\ipsloSW.exe
  C:\Windows\System\ipsloSW.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\GvfLczd.exe
  C:\Windows\System\GvfLczd.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\iLVcIRH.exe
  C:\Windows\System\iLVcIRH.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\hKFgaVo.exe
  C:\Windows\System\hKFgaVo.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\hwLTvbJ.exe
  C:\Windows\System\hwLTvbJ.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\QkQvEON.exe
  C:\Windows\System\QkQvEON.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\njpuXEE.exe
  C:\Windows\System\njpuXEE.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\sGKwhZq.exe
  C:\Windows\System\sGKwhZq.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\dbPMhMa.exe
  C:\Windows\System\dbPMhMa.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\hjsyOjm.exe
  C:\Windows\System\hjsyOjm.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\zWFMAOD.exe
  C:\Windows\System\zWFMAOD.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\xlVTcwr.exe
  C:\Windows\System\xlVTcwr.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\ikcxLqf.exe
  C:\Windows\System\ikcxLqf.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\HfPgLyc.exe
  C:\Windows\System\HfPgLyc.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\uOCCKzZ.exe
  C:\Windows\System\uOCCKzZ.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\DLuvhIN.exe
  C:\Windows\System\DLuvhIN.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\jOgHNSB.exe
  C:\Windows\System\jOgHNSB.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\BzGHYoO.exe
  C:\Windows\System\BzGHYoO.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\fRPQmad.exe
  C:\Windows\System\fRPQmad.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\xfcPIPB.exe
  C:\Windows\System\xfcPIPB.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\ZRKcdsK.exe
  C:\Windows\System\ZRKcdsK.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\AkPoCyO.exe
  C:\Windows\System\AkPoCyO.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\rkOImai.exe
  C:\Windows\System\rkOImai.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\yGQFelF.exe
  C:\Windows\System\yGQFelF.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\eMkQZCv.exe
  C:\Windows\System\eMkQZCv.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\JqbWuvV.exe
  C:\Windows\System\JqbWuvV.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\RtnZwZE.exe
  C:\Windows\System\RtnZwZE.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\xyTjbcA.exe
  C:\Windows\System\xyTjbcA.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\UlnqZss.exe
  C:\Windows\System\UlnqZss.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\NCvFWfD.exe
  C:\Windows\System\NCvFWfD.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\oWPJETF.exe
  C:\Windows\System\oWPJETF.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\hicmsNA.exe
  C:\Windows\System\hicmsNA.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\KUdhhQl.exe
  C:\Windows\System\KUdhhQl.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\ZBFrGva.exe
  C:\Windows\System\ZBFrGva.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\JKilhkO.exe
  C:\Windows\System\JKilhkO.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\sGJSmGZ.exe
  C:\Windows\System\sGJSmGZ.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\ThRNUPo.exe
  C:\Windows\System\ThRNUPo.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\TdmLhDQ.exe
  C:\Windows\System\TdmLhDQ.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\hcAYwlj.exe
  C:\Windows\System\hcAYwlj.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\EPshoeR.exe
  C:\Windows\System\EPshoeR.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\rAroLUH.exe
  C:\Windows\System\rAroLUH.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\SXUcnJh.exe
  C:\Windows\System\SXUcnJh.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\RTuTBao.exe
  C:\Windows\System\RTuTBao.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\IasXrcC.exe
  C:\Windows\System\IasXrcC.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\qbePblh.exe
  C:\Windows\System\qbePblh.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\cpHLolU.exe
  C:\Windows\System\cpHLolU.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\lrItOaS.exe
  C:\Windows\System\lrItOaS.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\xZBGASH.exe
  C:\Windows\System\xZBGASH.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\SVSZyie.exe
  C:\Windows\System\SVSZyie.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\zviRAkO.exe
  C:\Windows\System\zviRAkO.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\nBuZKDu.exe
  C:\Windows\System\nBuZKDu.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\kcwxOuB.exe
  C:\Windows\System\kcwxOuB.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\nGQApNy.exe
  C:\Windows\System\nGQApNy.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\RoVTbtS.exe
  C:\Windows\System\RoVTbtS.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\oWCcACS.exe
  C:\Windows\System\oWCcACS.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\RpTvMWp.exe
  C:\Windows\System\RpTvMWp.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\XpNvgLW.exe
  C:\Windows\System\XpNvgLW.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\BWdAExi.exe
  C:\Windows\System\BWdAExi.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\UAwYHNG.exe
  C:\Windows\System\UAwYHNG.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\DPfofLN.exe
  C:\Windows\System\DPfofLN.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\OdUGCMF.exe
  C:\Windows\System\OdUGCMF.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\nnIqNOf.exe
  C:\Windows\System\nnIqNOf.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\XPngjcN.exe
  C:\Windows\System\XPngjcN.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\NNpPAyE.exe
  C:\Windows\System\NNpPAyE.exe
  2⤵
  PID:2860
- C:\Windows\System\UhuhHwr.exe
  C:\Windows\System\UhuhHwr.exe
  2⤵
  PID:828
- C:\Windows\System\AqqODFH.exe
  C:\Windows\System\AqqODFH.exe
  2⤵
  PID:2916
- C:\Windows\System\imlnvBY.exe
  C:\Windows\System\imlnvBY.exe
  2⤵
  PID:676
- C:\Windows\System\EgEncIN.exe
  C:\Windows\System\EgEncIN.exe
  2⤵
  PID:536
- C:\Windows\System\WPYLHJV.exe
  C:\Windows\System\WPYLHJV.exe
  2⤵
  PID:852
- C:\Windows\System\yBynjuq.exe
  C:\Windows\System\yBynjuq.exe
  2⤵
  PID:2720
- C:\Windows\System\IrYoCGn.exe
  C:\Windows\System\IrYoCGn.exe
  2⤵
  PID:1668
- C:\Windows\System\hxudaWY.exe
  C:\Windows\System\hxudaWY.exe
  2⤵
  PID:636
- C:\Windows\System\gGuvfSZ.exe
  C:\Windows\System\gGuvfSZ.exe
  2⤵
  PID:912
- C:\Windows\System\ARmVVPW.exe
  C:\Windows\System\ARmVVPW.exe
  2⤵
  PID:2256
- C:\Windows\System\rTLiqZO.exe
  C:\Windows\System\rTLiqZO.exe
  2⤵
  PID:1700
- C:\Windows\System\VRRCkad.exe
  C:\Windows\System\VRRCkad.exe
  2⤵
  PID:2560
- C:\Windows\System\ZIMPyvX.exe
  C:\Windows\System\ZIMPyvX.exe
  2⤵
  PID:984
- C:\Windows\System\ogTgMcI.exe
  C:\Windows\System\ogTgMcI.exe
  2⤵
  PID:1500
- C:\Windows\System\PXtMjfw.exe
  C:\Windows\System\PXtMjfw.exe
  2⤵
  PID:2488
- C:\Windows\System\fGxfIau.exe
  C:\Windows\System\fGxfIau.exe
  2⤵
  PID:2792
- C:\Windows\System\AdyArOc.exe
  C:\Windows\System\AdyArOc.exe
  2⤵
  PID:1496
- C:\Windows\System\EYnUsHi.exe
  C:\Windows\System\EYnUsHi.exe
  2⤵
  PID:2228
- C:\Windows\System\PYFPSkQ.exe
  C:\Windows\System\PYFPSkQ.exe
  2⤵
  PID:2356
- C:\Windows\System\KxzRAwm.exe
  C:\Windows\System\KxzRAwm.exe
  2⤵
  PID:576
- C:\Windows\System\RmyqMWK.exe
  C:\Windows\System\RmyqMWK.exe
  2⤵
  PID:556
- C:\Windows\System\sHpzosZ.exe
  C:\Windows\System\sHpzosZ.exe
  2⤵
  PID:1736
- C:\Windows\System\vrJesLh.exe
  C:\Windows\System\vrJesLh.exe
  2⤵
  PID:1984
- C:\Windows\System\hQIszoz.exe
  C:\Windows\System\hQIszoz.exe
  2⤵
  PID:2948
- C:\Windows\System\QggADQj.exe
  C:\Windows\System\QggADQj.exe
  2⤵
  PID:2532
- C:\Windows\System\wxuDdqP.exe
  C:\Windows\System\wxuDdqP.exe
  2⤵
  PID:1092
- C:\Windows\System\MwVxpZs.exe
  C:\Windows\System\MwVxpZs.exe
  2⤵
  PID:2700
- C:\Windows\System\EufOzNM.exe
  C:\Windows\System\EufOzNM.exe
  2⤵
  PID:1800
- C:\Windows\System\lsLvQOk.exe
  C:\Windows\System\lsLvQOk.exe
  2⤵
  PID:1160
- C:\Windows\System\VxnjlNL.exe
  C:\Windows\System\VxnjlNL.exe
  2⤵
  PID:1504
- C:\Windows\System\DyxpDBU.exe
  C:\Windows\System\DyxpDBU.exe
  2⤵
  PID:2348
- C:\Windows\System\msQlMxH.exe
  C:\Windows\System\msQlMxH.exe
  2⤵
  PID:1708
- C:\Windows\System\UiZxcBx.exe
  C:\Windows\System\UiZxcBx.exe
  2⤵
  PID:2832
- C:\Windows\System\ipCoqBT.exe
  C:\Windows\System\ipCoqBT.exe
  2⤵
  PID:3024
- C:\Windows\System\EzWOcGh.exe
  C:\Windows\System\EzWOcGh.exe
  2⤵
  PID:1628
- C:\Windows\System\pUUOurQ.exe
  C:\Windows\System\pUUOurQ.exe
  2⤵
  PID:1856
- C:\Windows\System\jxvbIHd.exe
  C:\Windows\System\jxvbIHd.exe
  2⤵
  PID:1060
- C:\Windows\System\QcHSRcN.exe
  C:\Windows\System\QcHSRcN.exe
  2⤵
  PID:2248
- C:\Windows\System\aWddYKN.exe
  C:\Windows\System\aWddYKN.exe
  2⤵
  PID:2816
- C:\Windows\System\kdbiKnK.exe
  C:\Windows\System\kdbiKnK.exe
  2⤵
  PID:2168
- C:\Windows\System\TcBrXLD.exe
  C:\Windows\System\TcBrXLD.exe
  2⤵
  PID:2628
- C:\Windows\System\PZOxJRu.exe
  C:\Windows\System\PZOxJRu.exe
  2⤵
  PID:2452
- C:\Windows\System\FvfoDez.exe
  C:\Windows\System\FvfoDez.exe
  2⤵
  PID:2968
- C:\Windows\System\TAyNQaY.exe
  C:\Windows\System\TAyNQaY.exe
  2⤵
  PID:2740
- C:\Windows\System\pTyokRQ.exe
  C:\Windows\System\pTyokRQ.exe
  2⤵
  PID:2584
- C:\Windows\System\sePFYpi.exe
  C:\Windows\System\sePFYpi.exe
  2⤵
  PID:3084
- C:\Windows\System\jsTPCEH.exe
  C:\Windows\System\jsTPCEH.exe
  2⤵
  PID:3100
- C:\Windows\System\gFVfHqJ.exe
  C:\Windows\System\gFVfHqJ.exe
  2⤵
  PID:3116
- C:\Windows\System\aLaQBFj.exe
  C:\Windows\System\aLaQBFj.exe
  2⤵
  PID:3132
- C:\Windows\System\ladYhiB.exe
  C:\Windows\System\ladYhiB.exe
  2⤵
  PID:3148
- C:\Windows\System\SBcxefK.exe
  C:\Windows\System\SBcxefK.exe
  2⤵
  PID:3164
- C:\Windows\System\quyUogf.exe
  C:\Windows\System\quyUogf.exe
  2⤵
  PID:3180
- C:\Windows\System\VMhvPRX.exe
  C:\Windows\System\VMhvPRX.exe
  2⤵
  PID:3196
- C:\Windows\System\iaphDXj.exe
  C:\Windows\System\iaphDXj.exe
  2⤵
  PID:3212
- C:\Windows\System\gwXdLik.exe
  C:\Windows\System\gwXdLik.exe
  2⤵
  PID:3232
- C:\Windows\System\lWztiBv.exe
  C:\Windows\System\lWztiBv.exe
  2⤵
  PID:3248
- C:\Windows\System\iaZfoaT.exe
  C:\Windows\System\iaZfoaT.exe
  2⤵
  PID:3264
- C:\Windows\System\ecPCJhR.exe
  C:\Windows\System\ecPCJhR.exe
  2⤵
  PID:3280
- C:\Windows\System\GLxgOCy.exe
  C:\Windows\System\GLxgOCy.exe
  2⤵
  PID:3296
- C:\Windows\System\NiZODbX.exe
  C:\Windows\System\NiZODbX.exe
  2⤵
  PID:3312
- C:\Windows\System\IrgDbdp.exe
  C:\Windows\System\IrgDbdp.exe
  2⤵
  PID:3328
- C:\Windows\System\sfgujfh.exe
  C:\Windows\System\sfgujfh.exe
  2⤵
  PID:3344
- C:\Windows\System\jPNRJPd.exe
  C:\Windows\System\jPNRJPd.exe
  2⤵
  PID:3360
- C:\Windows\System\EYmUDoc.exe
  C:\Windows\System\EYmUDoc.exe
  2⤵
  PID:3376
- C:\Windows\System\dNoXTrj.exe
  C:\Windows\System\dNoXTrj.exe
  2⤵
  PID:3392
- C:\Windows\System\FQVNbrm.exe
  C:\Windows\System\FQVNbrm.exe
  2⤵
  PID:3408
- C:\Windows\System\HPiByqZ.exe
  C:\Windows\System\HPiByqZ.exe
  2⤵
  PID:3424
- C:\Windows\System\uHTPqhs.exe
  C:\Windows\System\uHTPqhs.exe
  2⤵
  PID:3440
- C:\Windows\System\lMzLbPU.exe
  C:\Windows\System\lMzLbPU.exe
  2⤵
  PID:3456
- C:\Windows\System\oDpOUPD.exe
  C:\Windows\System\oDpOUPD.exe
  2⤵
  PID:3476
- C:\Windows\System\smXvOms.exe
  C:\Windows\System\smXvOms.exe
  2⤵
  PID:3492
- C:\Windows\System\OnzUlkl.exe
  C:\Windows\System\OnzUlkl.exe
  2⤵
  PID:3508
- C:\Windows\System\NqZHJnN.exe
  C:\Windows\System\NqZHJnN.exe
  2⤵
  PID:3524
- C:\Windows\System\TTnupEY.exe
  C:\Windows\System\TTnupEY.exe
  2⤵
  PID:3540
- C:\Windows\System\zSvWOlJ.exe
  C:\Windows\System\zSvWOlJ.exe
  2⤵
  PID:3568
- C:\Windows\System\wiFrijO.exe
  C:\Windows\System\wiFrijO.exe
  2⤵
  PID:3588
- C:\Windows\System\krPMhAC.exe
  C:\Windows\System\krPMhAC.exe
  2⤵
  PID:3604
- C:\Windows\System\ankwnfI.exe
  C:\Windows\System\ankwnfI.exe
  2⤵
  PID:3620
- C:\Windows\System\CIcSwyt.exe
  C:\Windows\System\CIcSwyt.exe
  2⤵
  PID:3636
- C:\Windows\System\RjKGyES.exe
  C:\Windows\System\RjKGyES.exe
  2⤵
  PID:3652
- C:\Windows\System\EFUWfPT.exe
  C:\Windows\System\EFUWfPT.exe
  2⤵
  PID:3668
- C:\Windows\System\RMoipVQ.exe
  C:\Windows\System\RMoipVQ.exe
  2⤵
  PID:3684
- C:\Windows\System\MNQaNDC.exe
  C:\Windows\System\MNQaNDC.exe
  2⤵
  PID:3700
- C:\Windows\System\VuwUgCw.exe
  C:\Windows\System\VuwUgCw.exe
  2⤵
  PID:3716
- C:\Windows\System\ZwdrWlN.exe
  C:\Windows\System\ZwdrWlN.exe
  2⤵
  PID:3732
- C:\Windows\System\pYhBxmy.exe
  C:\Windows\System\pYhBxmy.exe
  2⤵
  PID:3748
- C:\Windows\System\qLUKvKe.exe
  C:\Windows\System\qLUKvKe.exe
  2⤵
  PID:3764
- C:\Windows\System\dsijCXx.exe
  C:\Windows\System\dsijCXx.exe
  2⤵
  PID:3780
- C:\Windows\System\BJUlqYR.exe
  C:\Windows\System\BJUlqYR.exe
  2⤵
  PID:3796
- C:\Windows\System\uEsFFnG.exe
  C:\Windows\System\uEsFFnG.exe
  2⤵
  PID:3820
- C:\Windows\System\HqZkJSc.exe
  C:\Windows\System\HqZkJSc.exe
  2⤵
  PID:3836
- C:\Windows\System\ZTvDAkB.exe
  C:\Windows\System\ZTvDAkB.exe
  2⤵
  PID:3852
- C:\Windows\System\zxSneXI.exe
  C:\Windows\System\zxSneXI.exe
  2⤵
  PID:3868
- C:\Windows\System\lZkhvrS.exe
  C:\Windows\System\lZkhvrS.exe
  2⤵
  PID:3884
- C:\Windows\System\opXnviI.exe
  C:\Windows\System\opXnviI.exe
  2⤵
  PID:3900
- C:\Windows\System\UNScbyd.exe
  C:\Windows\System\UNScbyd.exe
  2⤵
  PID:3916
- C:\Windows\System\tEtddfM.exe
  C:\Windows\System\tEtddfM.exe
  2⤵
  PID:3936
- C:\Windows\System\GqvmydR.exe
  C:\Windows\System\GqvmydR.exe
  2⤵
  PID:3952
- C:\Windows\System\rtdeNhT.exe
  C:\Windows\System\rtdeNhT.exe
  2⤵
  PID:3968
- C:\Windows\System\wfDavxA.exe
  C:\Windows\System\wfDavxA.exe
  2⤵
  PID:3984
- C:\Windows\System\LTWMTnm.exe
  C:\Windows\System\LTWMTnm.exe
  2⤵
  PID:4000
- C:\Windows\System\XShJcEe.exe
  C:\Windows\System\XShJcEe.exe
  2⤵
  PID:4016
- C:\Windows\System\VMJHQOk.exe
  C:\Windows\System\VMJHQOk.exe
  2⤵
  PID:4032
- C:\Windows\System\FanpDNv.exe
  C:\Windows\System\FanpDNv.exe
  2⤵
  PID:4048
- C:\Windows\System\pAATHFY.exe
  C:\Windows\System\pAATHFY.exe
  2⤵
  PID:4064
- C:\Windows\System\XrrqbEF.exe
  C:\Windows\System\XrrqbEF.exe
  2⤵
  PID:4080
- C:\Windows\System\NhlYFGl.exe
  C:\Windows\System\NhlYFGl.exe
  2⤵
  PID:1064
- C:\Windows\System\RDssmKf.exe
  C:\Windows\System\RDssmKf.exe
  2⤵
  PID:1768
- C:\Windows\System\IAPdUKn.exe
  C:\Windows\System\IAPdUKn.exe
  2⤵
  PID:3384
- C:\Windows\System\cqGivBf.exe
  C:\Windows\System\cqGivBf.exe
  2⤵
  PID:3420
- C:\Windows\System\UctSuHR.exe
  C:\Windows\System\UctSuHR.exe
  2⤵
  PID:1008
- C:\Windows\System\YXrftGj.exe
  C:\Windows\System\YXrftGj.exe
  2⤵
  PID:568
- C:\Windows\System\RtelAyO.exe
  C:\Windows\System\RtelAyO.exe
  2⤵
  PID:2764
- C:\Windows\System\lkYtqnV.exe
  C:\Windows\System\lkYtqnV.exe
  2⤵
  PID:1212
- C:\Windows\System\drwRwrr.exe
  C:\Windows\System\drwRwrr.exe
  2⤵
  PID:448
- C:\Windows\System\bbbozzO.exe
  C:\Windows\System\bbbozzO.exe
  2⤵
  PID:2464
- C:\Windows\System\ojcqUhY.exe
  C:\Windows\System\ojcqUhY.exe
  2⤵
  PID:2392
- C:\Windows\System\bGkDpwJ.exe
  C:\Windows\System\bGkDpwJ.exe
  2⤵
  PID:3516
- C:\Windows\System\SVfXSDQ.exe
  C:\Windows\System\SVfXSDQ.exe
  2⤵
  PID:3556
- C:\Windows\System\BVQXPzx.exe
  C:\Windows\System\BVQXPzx.exe
  2⤵
  PID:3600
- C:\Windows\System\NGUJFvl.exe
  C:\Windows\System\NGUJFvl.exe
  2⤵
  PID:3664
- C:\Windows\System\pDNVzvd.exe
  C:\Windows\System\pDNVzvd.exe
  2⤵
  PID:3724
- C:\Windows\System\WrISLua.exe
  C:\Windows\System\WrISLua.exe
  2⤵
  PID:3792
- C:\Windows\System\tRbxsFL.exe
  C:\Windows\System\tRbxsFL.exe
  2⤵
  PID:3864
- C:\Windows\System\PvRWObx.exe
  C:\Windows\System\PvRWObx.exe
  2⤵
  PID:3928
- C:\Windows\System\fEapBLq.exe
  C:\Windows\System\fEapBLq.exe
  2⤵
  PID:3992
- C:\Windows\System\imDozdO.exe
  C:\Windows\System\imDozdO.exe
  2⤵
  PID:4056
- C:\Windows\System\gtVQpSM.exe
  C:\Windows\System\gtVQpSM.exe
  2⤵
  PID:2556
- C:\Windows\System\ZlJWwAk.exe
  C:\Windows\System\ZlJWwAk.exe
  2⤵
  PID:760
- C:\Windows\System\gPYeHGL.exe
  C:\Windows\System\gPYeHGL.exe
  2⤵
  PID:1728
- C:\Windows\System\oraTHiN.exe
  C:\Windows\System\oraTHiN.exe
  2⤵
  PID:2404
- C:\Windows\System\bhpQlBB.exe
  C:\Windows\System\bhpQlBB.exe
  2⤵
  PID:2712
- C:\Windows\System\vzPVgeb.exe
  C:\Windows\System\vzPVgeb.exe
  2⤵
  PID:1952
- C:\Windows\System\CkqYAIn.exe
  C:\Windows\System\CkqYAIn.exe
  2⤵
  PID:3160
- C:\Windows\System\uuNfOpi.exe
  C:\Windows\System\uuNfOpi.exe
  2⤵
  PID:3224
- C:\Windows\System\bCKjgiF.exe
  C:\Windows\System\bCKjgiF.exe
  2⤵
  PID:3288
- C:\Windows\System\tybfsBb.exe
  C:\Windows\System\tybfsBb.exe
  2⤵
  PID:784
- C:\Windows\System\PxcMZcQ.exe
  C:\Windows\System\PxcMZcQ.exe
  2⤵
  PID:1544
- C:\Windows\System\rogSwYX.exe
  C:\Windows\System\rogSwYX.exe
  2⤵
  PID:1740
- C:\Windows\System\JXpkUuo.exe
  C:\Windows\System\JXpkUuo.exe
  2⤵
  PID:2960
- C:\Windows\System\bbaECNB.exe
  C:\Windows\System\bbaECNB.exe
  2⤵
  PID:4104
- C:\Windows\System\psQrZhT.exe
  C:\Windows\System\psQrZhT.exe
  2⤵
  PID:4120
- C:\Windows\System\UBnGazY.exe
  C:\Windows\System\UBnGazY.exe
  2⤵
  PID:4136
- C:\Windows\System\DtokjKa.exe
  C:\Windows\System\DtokjKa.exe
  2⤵
  PID:4152
- C:\Windows\System\rZRlOQh.exe
  C:\Windows\System\rZRlOQh.exe
  2⤵
  PID:4168
- C:\Windows\System\RJYVLFo.exe
  C:\Windows\System\RJYVLFo.exe
  2⤵
  PID:4188
- C:\Windows\System\ZkYzTlk.exe
  C:\Windows\System\ZkYzTlk.exe
  2⤵
  PID:4204
- C:\Windows\System\MIuINHd.exe
  C:\Windows\System\MIuINHd.exe
  2⤵
  PID:4220
- C:\Windows\System\Ghsorvc.exe
  C:\Windows\System\Ghsorvc.exe
  2⤵
  PID:4236
- C:\Windows\System\jHKOsfD.exe
  C:\Windows\System\jHKOsfD.exe
  2⤵
  PID:4252
- C:\Windows\System\HPuzfzV.exe
  C:\Windows\System\HPuzfzV.exe
  2⤵
  PID:4272
- C:\Windows\System\ayWQoKz.exe
  C:\Windows\System\ayWQoKz.exe
  2⤵
  PID:4288
- C:\Windows\System\hGLvFaQ.exe
  C:\Windows\System\hGLvFaQ.exe
  2⤵
  PID:4304
- C:\Windows\System\DLWVpGX.exe
  C:\Windows\System\DLWVpGX.exe
  2⤵
  PID:4320
- C:\Windows\System\fuLCjbX.exe
  C:\Windows\System\fuLCjbX.exe
  2⤵
  PID:4336
- C:\Windows\System\dwXBNiv.exe
  C:\Windows\System\dwXBNiv.exe
  2⤵
  PID:4352
- C:\Windows\System\GwyujlP.exe
  C:\Windows\System\GwyujlP.exe
  2⤵
  PID:4368
- C:\Windows\System\mAiaQCp.exe
  C:\Windows\System\mAiaQCp.exe
  2⤵
  PID:4384
- C:\Windows\System\gpNCAMS.exe
  C:\Windows\System\gpNCAMS.exe
  2⤵
  PID:4404
- C:\Windows\System\GnOqtSj.exe
  C:\Windows\System\GnOqtSj.exe
  2⤵
  PID:4420
- C:\Windows\System\sqImyPj.exe
  C:\Windows\System\sqImyPj.exe
  2⤵
  PID:4436
- C:\Windows\System\hzntHkx.exe
  C:\Windows\System\hzntHkx.exe
  2⤵
  PID:4452
- C:\Windows\System\GJFdSLZ.exe
  C:\Windows\System\GJFdSLZ.exe
  2⤵
  PID:4468
- C:\Windows\System\GWxQgJJ.exe
  C:\Windows\System\GWxQgJJ.exe
  2⤵
  PID:4484
- C:\Windows\System\ZXTUMPr.exe
  C:\Windows\System\ZXTUMPr.exe
  2⤵
  PID:4500
- C:\Windows\System\StUblNO.exe
  C:\Windows\System\StUblNO.exe
  2⤵
  PID:4520
- C:\Windows\System\bNWeIrN.exe
  C:\Windows\System\bNWeIrN.exe
  2⤵
  PID:4536
- C:\Windows\System\fFtrrjA.exe
  C:\Windows\System\fFtrrjA.exe
  2⤵
  PID:4552
- C:\Windows\System\TUWwtIb.exe
  C:\Windows\System\TUWwtIb.exe
  2⤵
  PID:4568
- C:\Windows\System\VFLdxFR.exe
  C:\Windows\System\VFLdxFR.exe
  2⤵
  PID:4584
- C:\Windows\System\GuhDgtj.exe
  C:\Windows\System\GuhDgtj.exe
  2⤵
  PID:4600
- C:\Windows\System\aeBgEzM.exe
  C:\Windows\System\aeBgEzM.exe
  2⤵
  PID:4616
- C:\Windows\System\oMNpyra.exe
  C:\Windows\System\oMNpyra.exe
  2⤵
  PID:4684
- C:\Windows\System\JRKOEOE.exe
  C:\Windows\System\JRKOEOE.exe
  2⤵
  PID:4756
- C:\Windows\System\vaYKqZc.exe
  C:\Windows\System\vaYKqZc.exe
  2⤵
  PID:4772
- C:\Windows\System\YvqvxTd.exe
  C:\Windows\System\YvqvxTd.exe
  2⤵
  PID:4788
- C:\Windows\System\jDJnlNq.exe
  C:\Windows\System\jDJnlNq.exe
  2⤵
  PID:4804
- C:\Windows\System\QHGOQiE.exe
  C:\Windows\System\QHGOQiE.exe
  2⤵
  PID:4820
- C:\Windows\System\FrdgdcW.exe
  C:\Windows\System\FrdgdcW.exe
  2⤵
  PID:4836
- C:\Windows\System\zNYpvZz.exe
  C:\Windows\System\zNYpvZz.exe
  2⤵
  PID:4852
- C:\Windows\System\LtVEUJJ.exe
  C:\Windows\System\LtVEUJJ.exe
  2⤵
  PID:4868
- C:\Windows\System\pRYzOKC.exe
  C:\Windows\System\pRYzOKC.exe
  2⤵
  PID:4884
- C:\Windows\System\qTjmSvm.exe
  C:\Windows\System\qTjmSvm.exe
  2⤵
  PID:4900
- C:\Windows\System\GXelyqu.exe
  C:\Windows\System\GXelyqu.exe
  2⤵
  PID:4916
- C:\Windows\System\NXXYmSO.exe
  C:\Windows\System\NXXYmSO.exe
  2⤵
  PID:4932
- C:\Windows\System\byqpuTK.exe
  C:\Windows\System\byqpuTK.exe
  2⤵
  PID:4948
- C:\Windows\System\CmtkKzV.exe
  C:\Windows\System\CmtkKzV.exe
  2⤵
  PID:4968
- C:\Windows\System\EkAZtyh.exe
  C:\Windows\System\EkAZtyh.exe
  2⤵
  PID:4984
- C:\Windows\System\KJMFohs.exe
  C:\Windows\System\KJMFohs.exe
  2⤵
  PID:5000
- C:\Windows\System\WcZHBkX.exe
  C:\Windows\System\WcZHBkX.exe
  2⤵
  PID:5016
- C:\Windows\System\fXsTNsZ.exe
  C:\Windows\System\fXsTNsZ.exe
  2⤵
  PID:5032
- C:\Windows\System\lVpoecw.exe
  C:\Windows\System\lVpoecw.exe
  2⤵
  PID:5048
- C:\Windows\System\AtumxQW.exe
  C:\Windows\System\AtumxQW.exe
  2⤵
  PID:5064
- C:\Windows\System\qtSAQHa.exe
  C:\Windows\System\qtSAQHa.exe
  2⤵
  PID:5080
- C:\Windows\System\eszfKDN.exe
  C:\Windows\System\eszfKDN.exe
  2⤵
  PID:5096
- C:\Windows\System\aoTKtik.exe
  C:\Windows\System\aoTKtik.exe
  2⤵
  PID:5112
- C:\Windows\System\LYFDZwC.exe
  C:\Windows\System\LYFDZwC.exe
  2⤵
  PID:2160
- C:\Windows\System\dGsRLUH.exe
  C:\Windows\System\dGsRLUH.exe
  2⤵
  PID:3112
- C:\Windows\System\EGfRfxq.exe
  C:\Windows\System\EGfRfxq.exe
  2⤵
  PID:504
- C:\Windows\System\aIPhgou.exe
  C:\Windows\System\aIPhgou.exe
  2⤵
  PID:3308
- C:\Windows\System\zFZloOv.exe
  C:\Windows\System\zFZloOv.exe
  2⤵
  PID:3552
- C:\Windows\System\zzwMWOh.exe
  C:\Windows\System\zzwMWOh.exe
  2⤵
  PID:3760
- C:\Windows\System\FjDJhwZ.exe
  C:\Windows\System\FjDJhwZ.exe
  2⤵
  PID:4024
- C:\Windows\System\NgMXuDM.exe
  C:\Windows\System\NgMXuDM.exe
  2⤵
  PID:2676
- C:\Windows\System\QiwzFej.exe
  C:\Windows\System\QiwzFej.exe
  2⤵
  PID:3220
- C:\Windows\System\EXBpeYK.exe
  C:\Windows\System\EXBpeYK.exe
  2⤵
  PID:4428
- C:\Windows\System\ZyRrRKJ.exe
  C:\Windows\System\ZyRrRKJ.exe
  2⤵
  PID:4496
- C:\Windows\System\NaUBOkt.exe
  C:\Windows\System\NaUBOkt.exe
  2⤵
  PID:4664
- C:\Windows\System\YhSlbOs.exe
  C:\Windows\System\YhSlbOs.exe
  2⤵
  PID:3372
- C:\Windows\System\YOMRlCt.exe
  C:\Windows\System\YOMRlCt.exe
  2⤵
  PID:3464
- C:\Windows\System\wlrTTEe.exe
  C:\Windows\System\wlrTTEe.exe
  2⤵
  PID:3532
- C:\Windows\System\xeDGTSG.exe
  C:\Windows\System\xeDGTSG.exe
  2⤵
  PID:3584
- C:\Windows\System\IDuLmpf.exe
  C:\Windows\System\IDuLmpf.exe
  2⤵
  PID:3648
- C:\Windows\System\GgteHlY.exe
  C:\Windows\System\GgteHlY.exe
  2⤵
  PID:3712
- C:\Windows\System\rbAILWm.exe
  C:\Windows\System\rbAILWm.exe
  2⤵
  PID:3812
- C:\Windows\System\jqHFRBQ.exe
  C:\Windows\System\jqHFRBQ.exe
  2⤵
  PID:3876
- C:\Windows\System\DjFqBed.exe
  C:\Windows\System\DjFqBed.exe
  2⤵
  PID:3944
- C:\Windows\System\OiTRiLW.exe
  C:\Windows\System\OiTRiLW.exe
  2⤵
  PID:4008
- C:\Windows\System\ogSIQkG.exe
  C:\Windows\System\ogSIQkG.exe
  2⤵
  PID:1680
- C:\Windows\System\bhawOtT.exe
  C:\Windows\System\bhawOtT.exe
  2⤵
  PID:3388
- C:\Windows\System\GFAQWXj.exe
  C:\Windows\System\GFAQWXj.exe
  2⤵
  PID:2176
- C:\Windows\System\PBXhzIk.exe
  C:\Windows\System\PBXhzIk.exe
  2⤵
  PID:3596
- C:\Windows\System\CiOvFBK.exe
  C:\Windows\System\CiOvFBK.exe
  2⤵
  PID:3964
- C:\Windows\System\ojvytms.exe
  C:\Windows\System\ojvytms.exe
  2⤵
  PID:1968
- C:\Windows\System\FMfNnqF.exe
  C:\Windows\System\FMfNnqF.exe
  2⤵
  PID:3156
- C:\Windows\System\KjnmMIK.exe
  C:\Windows\System\KjnmMIK.exe
  2⤵
  PID:2992
- C:\Windows\System\XITHRqv.exe
  C:\Windows\System\XITHRqv.exe
  2⤵
  PID:4212
- C:\Windows\System\vFXreEg.exe
  C:\Windows\System\vFXreEg.exe
  2⤵
  PID:4764
- C:\Windows\System\iRCvvQv.exe
  C:\Windows\System\iRCvvQv.exe
  2⤵
  PID:2172
- C:\Windows\System\FrGjpaS.exe
  C:\Windows\System\FrGjpaS.exe
  2⤵
  PID:4864
- C:\Windows\System\wbNSOrM.exe
  C:\Windows\System\wbNSOrM.exe
  2⤵
  PID:4928
- C:\Windows\System\KqVJFlM.exe
  C:\Windows\System\KqVJFlM.exe
  2⤵
  PID:4992
- C:\Windows\System\fLYXrmH.exe
  C:\Windows\System\fLYXrmH.exe
  2⤵
  PID:5056
- C:\Windows\System\STbhYMf.exe
  C:\Windows\System\STbhYMf.exe
  2⤵
  PID:1756
- C:\Windows\System\gkrSzdh.exe
  C:\Windows\System\gkrSzdh.exe
  2⤵
  PID:3340
- C:\Windows\System\dJidvnv.exe
  C:\Windows\System\dJidvnv.exe
  2⤵
  PID:3092
- C:\Windows\System\NKmwvto.exe
  C:\Windows\System\NKmwvto.exe
  2⤵
  PID:4492
- C:\Windows\System\uJgqwTg.exe
  C:\Windows\System\uJgqwTg.exe
  2⤵
  PID:5124
- C:\Windows\System\NjSQbJd.exe
  C:\Windows\System\NjSQbJd.exe
  2⤵
  PID:5140
- C:\Windows\System\Vxmxjbq.exe
  C:\Windows\System\Vxmxjbq.exe
  2⤵
  PID:5160
- C:\Windows\System\khQutGM.exe
  C:\Windows\System\khQutGM.exe
  2⤵
  PID:5176
- C:\Windows\System\qaURnjc.exe
  C:\Windows\System\qaURnjc.exe
  2⤵
  PID:5200
- C:\Windows\System\hpFaFUi.exe
  C:\Windows\System\hpFaFUi.exe
  2⤵
  PID:5216
- C:\Windows\System\BTNbnNe.exe
  C:\Windows\System\BTNbnNe.exe
  2⤵
  PID:5232
- C:\Windows\System\DdfdnSp.exe
  C:\Windows\System\DdfdnSp.exe
  2⤵
  PID:5248
- C:\Windows\System\ktpHaIv.exe
  C:\Windows\System\ktpHaIv.exe
  2⤵
  PID:5264
- C:\Windows\System\NVPCaGF.exe
  C:\Windows\System\NVPCaGF.exe
  2⤵
  PID:5280
- C:\Windows\System\gyOxIOj.exe
  C:\Windows\System\gyOxIOj.exe
  2⤵
  PID:5296
- C:\Windows\System\hISjAbj.exe
  C:\Windows\System\hISjAbj.exe
  2⤵
  PID:5320
- C:\Windows\System\vJPGaGK.exe
  C:\Windows\System\vJPGaGK.exe
  2⤵
  PID:5344
- C:\Windows\System\vAHpwUM.exe
  C:\Windows\System\vAHpwUM.exe
  2⤵
  PID:5360
- C:\Windows\System\ejNLTQE.exe
  C:\Windows\System\ejNLTQE.exe
  2⤵
  PID:5376
- C:\Windows\System\KtFKsgj.exe
  C:\Windows\System\KtFKsgj.exe
  2⤵
  PID:5392
- C:\Windows\System\BSWUDkT.exe
  C:\Windows\System\BSWUDkT.exe
  2⤵
  PID:5412
- C:\Windows\System\yzxAdme.exe
  C:\Windows\System\yzxAdme.exe
  2⤵
  PID:5428
- C:\Windows\System\SOfGNzH.exe
  C:\Windows\System\SOfGNzH.exe
  2⤵
  PID:5444
- C:\Windows\System\FBfnXWL.exe
  C:\Windows\System\FBfnXWL.exe
  2⤵
  PID:5460
- C:\Windows\System\DUsPyyW.exe
  C:\Windows\System\DUsPyyW.exe
  2⤵
  PID:5476
- C:\Windows\System\JYNPpMA.exe
  C:\Windows\System\JYNPpMA.exe
  2⤵
  PID:5496
- C:\Windows\System\MrdudWo.exe
  C:\Windows\System\MrdudWo.exe
  2⤵
  PID:5512
- C:\Windows\System\vzpQUiA.exe
  C:\Windows\System\vzpQUiA.exe
  2⤵
  PID:5588
- C:\Windows\System\BPwSYRH.exe
  C:\Windows\System\BPwSYRH.exe
  2⤵
  PID:5604
- C:\Windows\System\MehElwk.exe
  C:\Windows\System\MehElwk.exe
  2⤵
  PID:5620
- C:\Windows\System\kQuSsyK.exe
  C:\Windows\System\kQuSsyK.exe
  2⤵
  PID:5640
- C:\Windows\System\AWaxEJg.exe
  C:\Windows\System\AWaxEJg.exe
  2⤵
  PID:5656
- C:\Windows\System\BdcQkiw.exe
  C:\Windows\System\BdcQkiw.exe
  2⤵
  PID:5728
- C:\Windows\System\vhYTtQf.exe
  C:\Windows\System\vhYTtQf.exe
  2⤵
  PID:5804
- C:\Windows\System\nZnnVaN.exe
  C:\Windows\System\nZnnVaN.exe
  2⤵
  PID:5932
- C:\Windows\System\EzLmznJ.exe
  C:\Windows\System\EzLmznJ.exe
  2⤵
  PID:5952
- C:\Windows\System\TBTudLQ.exe
  C:\Windows\System\TBTudLQ.exe
  2⤵
  PID:2144
- C:\Windows\System\JXfltLb.exe
  C:\Windows\System\JXfltLb.exe
  2⤵
  PID:3912
- C:\Windows\System\kVhhQDE.exe
  C:\Windows\System\kVhhQDE.exe
  2⤵
  PID:3832
- C:\Windows\System\vinrwih.exe
  C:\Windows\System\vinrwih.exe
  2⤵
  PID:4176
- C:\Windows\System\ZXcqwuk.exe
  C:\Windows\System\ZXcqwuk.exe
  2⤵
  PID:5028
- C:\Windows\System\SYrXOGL.exe
  C:\Windows\System\SYrXOGL.exe
  2⤵
  PID:5172
- C:\Windows\System\EUPZOjS.exe
  C:\Windows\System\EUPZOjS.exe
  2⤵
  PID:5276
- C:\Windows\System\OsVyTkF.exe
  C:\Windows\System\OsVyTkF.exe
  2⤵
  PID:5356
- C:\Windows\System\RXRhXrJ.exe
  C:\Windows\System\RXRhXrJ.exe
  2⤵
  PID:5484
- C:\Windows\System\WjZnMDw.exe
  C:\Windows\System\WjZnMDw.exe
  2⤵
  PID:4608
- C:\Windows\System\xJuhIwB.exe
  C:\Windows\System\xJuhIwB.exe
  2⤵
  PID:3172
- C:\Windows\System\EMQrxYU.exe
  C:\Windows\System\EMQrxYU.exe
  2⤵
  PID:4924
- C:\Windows\System\UBcjkvW.exe
  C:\Windows\System\UBcjkvW.exe
  2⤵
  PID:5528
- C:\Windows\System\ZcnBfBR.exe
  C:\Windows\System\ZcnBfBR.exe
  2⤵
  PID:5548
- C:\Windows\System\UeBwFjB.exe
  C:\Windows\System\UeBwFjB.exe
  2⤵
  PID:5560
- C:\Windows\System\mBzZEuZ.exe
  C:\Windows\System\mBzZEuZ.exe
  2⤵
  PID:5576
- C:\Windows\System\RwhMpTC.exe
  C:\Windows\System\RwhMpTC.exe
  2⤵
  PID:3276
- C:\Windows\System\buKASbU.exe
  C:\Windows\System\buKASbU.exe
  2⤵
  PID:4748
- C:\Windows\System\sySaXvl.exe
  C:\Windows\System\sySaXvl.exe
  2⤵
  PID:4816
- C:\Windows\System\meuFGPY.exe
  C:\Windows\System\meuFGPY.exe
  2⤵
  PID:4880
- C:\Windows\System\GYrTSmZ.exe
  C:\Windows\System\GYrTSmZ.exe
  2⤵
  PID:4976
- C:\Windows\System\MpKoKUw.exe
  C:\Windows\System\MpKoKUw.exe
  2⤵
  PID:3472
- C:\Windows\System\SYNHdQB.exe
  C:\Windows\System\SYNHdQB.exe
  2⤵
  PID:4072
- C:\Windows\System\ZKCdKsv.exe
  C:\Windows\System\ZKCdKsv.exe
  2⤵
  PID:1028
- C:\Windows\System\Kvofwzh.exe
  C:\Windows\System\Kvofwzh.exe
  2⤵
  PID:1512
- C:\Windows\System\Ttlbocg.exe
  C:\Windows\System\Ttlbocg.exe
  2⤵
  PID:2104
- C:\Windows\System\xhelGQX.exe
  C:\Windows\System\xhelGQX.exe
  2⤵
  PID:5648
- C:\Windows\System\tsRKpeR.exe
  C:\Windows\System\tsRKpeR.exe
  2⤵
  PID:4284
- C:\Windows\System\VtvSoxz.exe
  C:\Windows\System\VtvSoxz.exe
  2⤵
  PID:3488
- C:\Windows\System\GFqnYxn.exe
  C:\Windows\System\GFqnYxn.exe
  2⤵
  PID:5260
- C:\Windows\System\fZvoGlX.exe
  C:\Windows\System\fZvoGlX.exe
  2⤵
  PID:3404
- C:\Windows\System\GNbuWuq.exe
  C:\Windows\System\GNbuWuq.exe
  2⤵
  PID:4184
- C:\Windows\System\ErrFqDY.exe
  C:\Windows\System\ErrFqDY.exe
  2⤵
  PID:4040
- C:\Windows\System\yQoaxYg.exe
  C:\Windows\System\yQoaxYg.exe
  2⤵
  PID:2956
- C:\Windows\System\DZNDJbr.exe
  C:\Windows\System\DZNDJbr.exe
  2⤵
  PID:1260
- C:\Windows\System\DLnGrZj.exe
  C:\Windows\System\DLnGrZj.exe
  2⤵
  PID:3108
- C:\Windows\System\LRJtWON.exe
  C:\Windows\System\LRJtWON.exe
  2⤵
  PID:4300
- C:\Windows\System\ShhjDlF.exe
  C:\Windows\System\ShhjDlF.exe
  2⤵
  PID:4364
- C:\Windows\System\CZRqIzm.exe
  C:\Windows\System\CZRqIzm.exe
  2⤵
  PID:4564
- C:\Windows\System\cCjNYCJ.exe
  C:\Windows\System\cCjNYCJ.exe
  2⤵
  PID:4628
- C:\Windows\System\LvpGAOb.exe
  C:\Windows\System\LvpGAOb.exe
  2⤵
  PID:4648
- C:\Windows\System\HzKozye.exe
  C:\Windows\System\HzKozye.exe
  2⤵
  PID:3580
- C:\Windows\System\WcEoYRw.exe
  C:\Windows\System\WcEoYRw.exe
  2⤵
  PID:3848
- C:\Windows\System\rFcgDGX.exe
  C:\Windows\System\rFcgDGX.exe
  2⤵
  PID:2800
- C:\Windows\System\TRwAuqD.exe
  C:\Windows\System\TRwAuqD.exe
  2⤵
  PID:4088
- C:\Windows\System\UPfidpO.exe
  C:\Windows\System\UPfidpO.exe
  2⤵
  PID:5152
- C:\Windows\System\GbKKalc.exe
  C:\Windows\System\GbKKalc.exe
  2⤵
  PID:5088
- C:\Windows\System\iAfDzem.exe
  C:\Windows\System\iAfDzem.exe
  2⤵
  PID:4672
- C:\Windows\System\tGBFhtf.exe
  C:\Windows\System\tGBFhtf.exe
  2⤵
  PID:5196
- C:\Windows\System\hzqqZmc.exe
  C:\Windows\System\hzqqZmc.exe
  2⤵
  PID:5256
- C:\Windows\System\PGfXrRO.exe
  C:\Windows\System\PGfXrRO.exe
  2⤵
  PID:5340
- C:\Windows\System\hiYyOad.exe
  C:\Windows\System\hiYyOad.exe
  2⤵
  PID:5468
- C:\Windows\System\OnZjAUQ.exe
  C:\Windows\System\OnZjAUQ.exe
  2⤵
  PID:5440
- C:\Windows\System\QmmOOgf.exe
  C:\Windows\System\QmmOOgf.exe
  2⤵
  PID:5596
- C:\Windows\System\AWGmKrF.exe
  C:\Windows\System\AWGmKrF.exe
  2⤵
  PID:4700
- C:\Windows\System\cFWAtZa.exe
  C:\Windows\System\cFWAtZa.exe
  2⤵
  PID:4708
- C:\Windows\System\KSmdQyS.exe
  C:\Windows\System\KSmdQyS.exe
  2⤵
  PID:5676
- C:\Windows\System\uyiPDNj.exe
  C:\Windows\System\uyiPDNj.exe
  2⤵
  PID:1576
- C:\Windows\System\YiSeSdB.exe
  C:\Windows\System\YiSeSdB.exe
  2⤵
  PID:5688
- C:\Windows\System\ASDVxeH.exe
  C:\Windows\System\ASDVxeH.exe
  2⤵
  PID:1956
- C:\Windows\System\GToJCMc.exe
  C:\Windows\System\GToJCMc.exe
  2⤵
  PID:5704
- C:\Windows\System\tFOUEgw.exe
  C:\Windows\System\tFOUEgw.exe
  2⤵
  PID:5712
- C:\Windows\System\Mriodjx.exe
  C:\Windows\System\Mriodjx.exe
  2⤵
  PID:1860
- C:\Windows\System\miDcAoa.exe
  C:\Windows\System\miDcAoa.exe
  2⤵
  PID:2640
- C:\Windows\System\QsLSXVG.exe
  C:\Windows\System\QsLSXVG.exe
  2⤵
  PID:5736
- C:\Windows\System\rxAgpzW.exe
  C:\Windows\System\rxAgpzW.exe
  2⤵
  PID:2024
- C:\Windows\System\gusYFRH.exe
  C:\Windows\System\gusYFRH.exe
  2⤵
  PID:5848
- C:\Windows\System\yKXJiMj.exe
  C:\Windows\System\yKXJiMj.exe
  2⤵
  PID:1040
- C:\Windows\System\xQgBAMw.exe
  C:\Windows\System\xQgBAMw.exe
  2⤵
  PID:1852
- C:\Windows\System\WVIpMxc.exe
  C:\Windows\System\WVIpMxc.exe
  2⤵
  PID:5880
- C:\Windows\System\WGIcBGT.exe
  C:\Windows\System\WGIcBGT.exe
  2⤵
  PID:2884
- C:\Windows\System\VrVUEyW.exe
  C:\Windows\System\VrVUEyW.exe
  2⤵
  PID:5884
- C:\Windows\System\wdTUnFt.exe
  C:\Windows\System\wdTUnFt.exe
  2⤵
  PID:5900
- C:\Windows\System\PvOTJWL.exe
  C:\Windows\System\PvOTJWL.exe
  2⤵
  PID:5916
- C:\Windows\System\QCPTBQx.exe
  C:\Windows\System\QCPTBQx.exe
  2⤵
  PID:2068
- C:\Windows\System\XNioqFs.exe
  C:\Windows\System\XNioqFs.exe
  2⤵
  PID:5968
- C:\Windows\System\wccNWEY.exe
  C:\Windows\System\wccNWEY.exe
  2⤵
  PID:1108
- C:\Windows\System\ajiguuT.exe
  C:\Windows\System\ajiguuT.exe
  2⤵
  PID:6000
- C:\Windows\System\AknZAKF.exe
  C:\Windows\System\AknZAKF.exe
  2⤵
  PID:2444
- C:\Windows\System\qeslgAc.exe
  C:\Windows\System\qeslgAc.exe
  2⤵
  PID:2852
- C:\Windows\System\rtAWiKU.exe
  C:\Windows\System\rtAWiKU.exe
  2⤵
  PID:1520
- C:\Windows\System\PCXeYQn.exe
  C:\Windows\System\PCXeYQn.exe
  2⤵
  PID:6100
- C:\Windows\System\EPLVBPG.exe
  C:\Windows\System\EPLVBPG.exe
  2⤵
  PID:6040
- C:\Windows\System\ZVEakuN.exe
  C:\Windows\System\ZVEakuN.exe
  2⤵
  PID:4312
- C:\Windows\System\EZyGVrq.exe
  C:\Windows\System\EZyGVrq.exe
  2⤵
  PID:6080
- C:\Windows\System\lHrFWnl.exe
  C:\Windows\System\lHrFWnl.exe
  2⤵
  PID:6116
- C:\Windows\System\YfKUkHE.exe
  C:\Windows\System\YfKUkHE.exe
  2⤵
  PID:6132
- C:\Windows\System\QwcvLNv.exe
  C:\Windows\System\QwcvLNv.exe
  2⤵
  PID:4344
- C:\Windows\System\atxDlEc.exe
  C:\Windows\System\atxDlEc.exe
  2⤵
  PID:2672
- C:\Windows\System\BHkxyYS.exe
  C:\Windows\System\BHkxyYS.exe
  2⤵
  PID:4444
- C:\Windows\System\xCVFVqT.exe
  C:\Windows\System\xCVFVqT.exe
  2⤵
  PID:4508
- C:\Windows\System\GsKvIol.exe
  C:\Windows\System\GsKvIol.exe
  2⤵
  PID:4680
- C:\Windows\System\DXHEBIA.exe
  C:\Windows\System\DXHEBIA.exe
  2⤵
  PID:3644
- C:\Windows\System\RIHosFk.exe
  C:\Windows\System\RIHosFk.exe
  2⤵
  PID:3908
- C:\Windows\System\LoTTmOt.exe
  C:\Windows\System\LoTTmOt.exe
  2⤵
  PID:3000
- C:\Windows\System\kELvcXb.exe
  C:\Windows\System\kELvcXb.exe
  2⤵
  PID:4800
- C:\Windows\System\nIQmkUA.exe
  C:\Windows\System\nIQmkUA.exe
  2⤵
  PID:4460
- C:\Windows\System\yxlOrwN.exe
  C:\Windows\System\yxlOrwN.exe
  2⤵
  PID:5168
- C:\Windows\System\pbAMFEM.exe
  C:\Windows\System\pbAMFEM.exe
  2⤵
  PID:5272
- C:\Windows\System\geJTtzE.exe
  C:\Windows\System\geJTtzE.exe
  2⤵
  PID:5388
- C:\Windows\System\SoDyyTY.exe
  C:\Windows\System\SoDyyTY.exe
  2⤵
  PID:2580
- C:\Windows\System\IsgbkSI.exe
  C:\Windows\System\IsgbkSI.exe
  2⤵
  PID:2448
- C:\Windows\System\ZvOPFsE.exe
  C:\Windows\System\ZvOPFsE.exe
  2⤵
  PID:4548
- C:\Windows\System\xCchzXd.exe
  C:\Windows\System\xCchzXd.exe
  2⤵
  PID:5312
- C:\Windows\System\zIaThMr.exe
  C:\Windows\System\zIaThMr.exe
  2⤵
  PID:5524
- C:\Windows\System\YFZClwE.exe
  C:\Windows\System\YFZClwE.exe
  2⤵
  PID:4812
- C:\Windows\System\hHLTHYI.exe
  C:\Windows\System\hHLTHYI.exe
  2⤵
  PID:3808
- C:\Windows\System\gXOGmQE.exe
  C:\Windows\System\gXOGmQE.exe
  2⤵
  PID:4148
- C:\Windows\System\kwBHqBF.exe
  C:\Windows\System\kwBHqBF.exe
  2⤵
  PID:4396
- C:\Windows\System\aMcFdqc.exe
  C:\Windows\System\aMcFdqc.exe
  2⤵
  PID:5008
- C:\Windows\System\JGStpTT.exe
  C:\Windows\System\JGStpTT.exe
  2⤵
  PID:2864
- C:\Windows\System\fMTvNAA.exe
  C:\Windows\System\fMTvNAA.exe
  2⤵
  PID:856
- C:\Windows\System\CIZYEKr.exe
  C:\Windows\System\CIZYEKr.exe
  2⤵
  PID:4280
- C:\Windows\System\ifKJhnU.exe
  C:\Windows\System\ifKJhnU.exe
  2⤵
  PID:5400
- C:\Windows\System\RsEIEEE.exe
  C:\Windows\System\RsEIEEE.exe
  2⤵
  PID:4740
- C:\Windows\System\XaIhNII.exe
  C:\Windows\System\XaIhNII.exe
  2⤵
  PID:4724
- C:\Windows\System\MKOUTLA.exe
  C:\Windows\System\MKOUTLA.exe
  2⤵
  PID:2260
- C:\Windows\System\MOPwRZq.exe
  C:\Windows\System\MOPwRZq.exe
  2⤵
  PID:4100
- C:\Windows\System\AlPEczU.exe
  C:\Windows\System\AlPEczU.exe
  2⤵
  PID:3616
- C:\Windows\System\dkVvOQX.exe
  C:\Windows\System\dkVvOQX.exe
  2⤵
  PID:2648
- C:\Windows\System\XbpwuEN.exe
  C:\Windows\System\XbpwuEN.exe
  2⤵
  PID:4532
- C:\Windows\System\jGfcCHg.exe
  C:\Windows\System\jGfcCHg.exe
  2⤵
  PID:3844
- C:\Windows\System\oHwFzPY.exe
  C:\Windows\System\oHwFzPY.exe
  2⤵
  PID:4960
- C:\Windows\System\DisSDhc.exe
  C:\Windows\System\DisSDhc.exe
  2⤵
  PID:5404
- C:\Windows\System\lynEFsa.exe
  C:\Windows\System\lynEFsa.exe
  2⤵
  PID:4712
- C:\Windows\System\hXScZod.exe
  C:\Windows\System\hXScZod.exe
  2⤵
  PID:5696
- C:\Windows\System\MwsKCWh.exe
  C:\Windows\System\MwsKCWh.exe
  2⤵
  PID:308
- C:\Windows\System\QDCgruz.exe
  C:\Windows\System\QDCgruz.exe
  2⤵
  PID:3304
- C:\Windows\System\FiplQIb.exe
  C:\Windows\System\FiplQIb.exe
  2⤵
  PID:4660
- C:\Windows\System\nmpwJUw.exe
  C:\Windows\System\nmpwJUw.exe
  2⤵
  PID:5092
- C:\Windows\System\ciluMsl.exe
  C:\Windows\System\ciluMsl.exe
  2⤵
  PID:5628
- C:\Windows\System\TPfxIVP.exe
  C:\Windows\System\TPfxIVP.exe
  2⤵
  PID:2116
- C:\Windows\System\PVHEcJS.exe
  C:\Windows\System\PVHEcJS.exe
  2⤵
  PID:1240
- C:\Windows\System\mNwnIcB.exe
  C:\Windows\System\mNwnIcB.exe
  2⤵
  PID:2592
- C:\Windows\System\PADVVjp.exe
  C:\Windows\System\PADVVjp.exe
  2⤵
  PID:5224
- C:\Windows\System\EUDAmdA.exe
  C:\Windows\System\EUDAmdA.exe
  2⤵
  PID:5756
- C:\Windows\System\JELNNEN.exe
  C:\Windows\System\JELNNEN.exe
  2⤵
  PID:5772
- C:\Windows\System\CTnsjww.exe
  C:\Windows\System\CTnsjww.exe
  2⤵
  PID:5788
- C:\Windows\System\DIRaaXh.exe
  C:\Windows\System\DIRaaXh.exe
  2⤵
  PID:5792
- C:\Windows\System\hmnrUji.exe
  C:\Windows\System\hmnrUji.exe
  2⤵
  PID:2428
- C:\Windows\System\XoxplcP.exe
  C:\Windows\System\XoxplcP.exe
  2⤵
  PID:5824
- C:\Windows\System\pLyjuPx.exe
  C:\Windows\System\pLyjuPx.exe
  2⤵
  PID:2600
- C:\Windows\System\OtNHDwy.exe
  C:\Windows\System\OtNHDwy.exe
  2⤵
  PID:2908
- C:\Windows\System\kGjdbbC.exe
  C:\Windows\System\kGjdbbC.exe
  2⤵
  PID:5840
- C:\Windows\System\WAlPdFd.exe
  C:\Windows\System\WAlPdFd.exe
  2⤵
  PID:5856
- C:\Windows\System\VDHCLPv.exe
  C:\Windows\System\VDHCLPv.exe
  2⤵
  PID:5868
- C:\Windows\System\cNhsNcW.exe
  C:\Windows\System\cNhsNcW.exe
  2⤵
  PID:2388
- C:\Windows\System\zruUMjX.exe
  C:\Windows\System\zruUMjX.exe
  2⤵
  PID:5896
- C:\Windows\System\FLxhAGx.exe
  C:\Windows\System\FLxhAGx.exe
  2⤵
  PID:5860
- C:\Windows\System\zwmcpOC.exe
  C:\Windows\System\zwmcpOC.exe
  2⤵
  PID:2456
- C:\Windows\System\wuvCsEg.exe
  C:\Windows\System\wuvCsEg.exe
  2⤵
  PID:6044
- C:\Windows\System\bhcYeRi.exe
  C:\Windows\System\bhcYeRi.exe
  2⤵
  PID:6008
- C:\Windows\System\MtzdAlD.exe
  C:\Windows\System\MtzdAlD.exe
  2⤵
  PID:6072
- C:\Windows\System\NuHtpuS.exe
  C:\Windows\System\NuHtpuS.exe
  2⤵
  PID:6136
- C:\Windows\System\dNCMrdu.exe
  C:\Windows\System\dNCMrdu.exe
  2⤵
  PID:6068
- C:\Windows\System\WYGhUsq.exe
  C:\Windows\System\WYGhUsq.exe
  2⤵
  PID:6128
- C:\Windows\System\sGCXWhX.exe
  C:\Windows\System\sGCXWhX.exe
  2⤵
  PID:6052
- C:\Windows\System\MdGbiqU.exe
  C:\Windows\System\MdGbiqU.exe
  2⤵
  PID:4480
- C:\Windows\System\OUXsfQx.exe
  C:\Windows\System\OUXsfQx.exe
  2⤵
  PID:6096
- C:\Windows\System\SwAzZhs.exe
  C:\Windows\System\SwAzZhs.exe
  2⤵
  PID:4896
- C:\Windows\System\qSibnJY.exe
  C:\Windows\System\qSibnJY.exe
  2⤵
  PID:2824
- C:\Windows\System\MrSHeKX.exe
  C:\Windows\System\MrSHeKX.exe
  2⤵
  PID:4576
- C:\Windows\System\XPWozhQ.exe
  C:\Windows\System\XPWozhQ.exe
  2⤵
  PID:4732
- C:\Windows\System\FomlHOP.exe
  C:\Windows\System\FomlHOP.exe
  2⤵
  PID:3504
- C:\Windows\System\UfPcSKR.exe
  C:\Windows\System\UfPcSKR.exe
  2⤵
  PID:3144
- C:\Windows\System\iQMerPC.exe
  C:\Windows\System\iQMerPC.exe
  2⤵
  PID:5456
- C:\Windows\System\ThFQHaD.exe
  C:\Windows\System\ThFQHaD.exe
  2⤵
  PID:3080
- C:\Windows\System\LZPXBwQ.exe
  C:\Windows\System\LZPXBwQ.exe
  2⤵
  PID:3244
- C:\Windows\System\srAAQXP.exe
  C:\Windows\System\srAAQXP.exe
  2⤵
  PID:3416
- C:\Windows\System\XMAGYRs.exe
  C:\Windows\System\XMAGYRs.exe
  2⤵
  PID:5012
- C:\Windows\System\xJgsdUw.exe
  C:\Windows\System\xJgsdUw.exe
  2⤵
  PID:5488
- C:\Windows\System\Xgzmmjv.exe
  C:\Windows\System\Xgzmmjv.exe
  2⤵
  PID:2292
- C:\Windows\System\BcJYfCu.exe
  C:\Windows\System\BcJYfCu.exe
  2⤵
  PID:5436
- C:\Windows\System\FcDAbIV.exe
  C:\Windows\System\FcDAbIV.exe
  2⤵
  PID:5108
- C:\Windows\System\fyOCBUy.exe
  C:\Windows\System\fyOCBUy.exe
  2⤵
  PID:5632
- C:\Windows\System\FjhixrK.exe
  C:\Windows\System\FjhixrK.exe
  2⤵
  PID:1620
- C:\Windows\System\ksTjfDm.exe
  C:\Windows\System\ksTjfDm.exe
  2⤵
  PID:4296
- C:\Windows\System\hQiFWTl.exe
  C:\Windows\System\hQiFWTl.exe
  2⤵
  PID:2692
- C:\Windows\System\kwvQXXO.exe
  C:\Windows\System\kwvQXXO.exe
  2⤵
  PID:4332
- C:\Windows\System\wzbCFYd.exe
  C:\Windows\System\wzbCFYd.exe
  2⤵
  PID:1640
- C:\Windows\System\AWfurJZ.exe
  C:\Windows\System\AWfurJZ.exe
  2⤵
  PID:4560
- C:\Windows\System\QQHZjiQ.exe
  C:\Windows\System\QQHZjiQ.exe
  2⤵
  PID:3452
- C:\Windows\System\VBoPKNN.exe
  C:\Windows\System\VBoPKNN.exe
  2⤵
  PID:5764
- C:\Windows\System\DyZxpeY.exe
  C:\Windows\System\DyZxpeY.exe
  2⤵
  PID:1144
- C:\Windows\System\VmiOXVn.exe
  C:\Windows\System\VmiOXVn.exe
  2⤵
  PID:5816
- C:\Windows\System\nejOdAi.exe
  C:\Windows\System\nejOdAi.exe
  2⤵
  PID:5768
- C:\Windows\System\ddDkuCH.exe
  C:\Windows\System\ddDkuCH.exe
  2⤵
  PID:2664
- C:\Windows\System\EWIlVOi.exe
  C:\Windows\System\EWIlVOi.exe
  2⤵
  PID:1488
- C:\Windows\System\jwmQgyC.exe
  C:\Windows\System\jwmQgyC.exe
  2⤵
  PID:5908
- C:\Windows\System\krDHJRO.exe
  C:\Windows\System\krDHJRO.exe
  2⤵
  PID:5944
- C:\Windows\System\CGmJTTw.exe
  C:\Windows\System\CGmJTTw.exe
  2⤵
  PID:5876
- C:\Windows\System\TGZIprI.exe
  C:\Windows\System\TGZIprI.exe
  2⤵
  PID:1808
- C:\Windows\System\SCgAHfx.exe
  C:\Windows\System\SCgAHfx.exe
  2⤵
  PID:6124
- C:\Windows\System\HIKCbwO.exe
  C:\Windows\System\HIKCbwO.exe
  2⤵
  PID:4376
- C:\Windows\System\CzHkijf.exe
  C:\Windows\System\CzHkijf.exe
  2⤵
  PID:2636
- C:\Windows\System\WTHSfbd.exe
  C:\Windows\System\WTHSfbd.exe
  2⤵
  PID:5240
- C:\Windows\System\YOJNkLa.exe
  C:\Windows\System\YOJNkLa.exe
  2⤵
  PID:6060
- C:\Windows\System\iWAozbJ.exe
  C:\Windows\System\iWAozbJ.exe
  2⤵
  PID:3208
- C:\Windows\System\KzjvdnW.exe
  C:\Windows\System\KzjvdnW.exe
  2⤵
  PID:4228
- C:\Windows\System\gIbIMgt.exe
  C:\Windows\System\gIbIMgt.exe
  2⤵
  PID:2052
- C:\Windows\System\uuoiWSc.exe
  C:\Windows\System\uuoiWSc.exe
  2⤵
  PID:1380
- C:\Windows\System\dDErKfT.exe
  C:\Windows\System\dDErKfT.exe
  2⤵
  PID:592
- C:\Windows\System\PpFPFHJ.exe
  C:\Windows\System\PpFPFHJ.exe
  2⤵
  PID:5104
- C:\Windows\System\yoRvWMe.exe
  C:\Windows\System\yoRvWMe.exe
  2⤵
  PID:1052
- C:\Windows\System\JbJCxGw.exe
  C:\Windows\System\JbJCxGw.exe
  2⤵
  PID:2868
- C:\Windows\System\sCstWQG.exe
  C:\Windows\System\sCstWQG.exe
  2⤵
  PID:4624
- C:\Windows\System\rDjbDkR.exe
  C:\Windows\System\rDjbDkR.exe
  2⤵
  PID:5072
- C:\Windows\System\uYLDhho.exe
  C:\Windows\System\uYLDhho.exe
  2⤵
  PID:584
- C:\Windows\System\iVMnrcO.exe
  C:\Windows\System\iVMnrcO.exe
  2⤵
  PID:4964
- C:\Windows\System\KfuzDsa.exe
  C:\Windows\System\KfuzDsa.exe
  2⤵
  PID:4160
- C:\Windows\System\hmkxzRO.exe
  C:\Windows\System\hmkxzRO.exe
  2⤵
  PID:1444
- C:\Windows\System\javnceL.exe
  C:\Windows\System\javnceL.exe
  2⤵
  PID:6104
- C:\Windows\System\BMYKEet.exe
  C:\Windows\System\BMYKEet.exe
  2⤵
  PID:4348
- C:\Windows\System\KvmPjlq.exe
  C:\Windows\System\KvmPjlq.exe
  2⤵
  PID:5244
- C:\Windows\System\jNrxhLV.exe
  C:\Windows\System\jNrxhLV.exe
  2⤵
  PID:5228
- C:\Windows\System\EstbACp.exe
  C:\Windows\System\EstbACp.exe
  2⤵
  PID:5584
- C:\Windows\System\qHfqfvN.exe
  C:\Windows\System\qHfqfvN.exe
  2⤵
  PID:5980
- C:\Windows\System\sgVxtGz.exe
  C:\Windows\System\sgVxtGz.exe
  2⤵
  PID:5708
- C:\Windows\System\yvUecvA.exe
  C:\Windows\System\yvUecvA.exe
  2⤵
  PID:2904
- C:\Windows\System\cpykdiF.exe
  C:\Windows\System\cpykdiF.exe
  2⤵
  PID:3860
- C:\Windows\System\vQFfrEr.exe
  C:\Windows\System\vQFfrEr.exe
  2⤵
  PID:5292
- C:\Windows\System\ZEuKHyR.exe
  C:\Windows\System\ZEuKHyR.exe
  2⤵
  PID:4476
- C:\Windows\System\InLJoEO.exe
  C:\Windows\System\InLJoEO.exe
  2⤵
  PID:5784
- C:\Windows\System\FaXjomd.exe
  C:\Windows\System\FaXjomd.exe
  2⤵
  PID:2920
- C:\Windows\System\yvuraTv.exe
  C:\Windows\System\yvuraTv.exe
  2⤵
  PID:6184
- C:\Windows\System\gJGNmvj.exe
  C:\Windows\System\gJGNmvj.exe
  2⤵
  PID:6204
- C:\Windows\System\vKNbJug.exe
  C:\Windows\System\vKNbJug.exe
  2⤵
  PID:6220
- C:\Windows\System\kbAkzED.exe
  C:\Windows\System\kbAkzED.exe
  2⤵
  PID:6236
- C:\Windows\System\kWYHvfg.exe
  C:\Windows\System\kWYHvfg.exe
  2⤵
  PID:6260
- C:\Windows\System\dvSpxwE.exe
  C:\Windows\System\dvSpxwE.exe
  2⤵
  PID:6276
- C:\Windows\System\wAITCiw.exe
  C:\Windows\System\wAITCiw.exe
  2⤵
  PID:6292
- C:\Windows\System\BhAxetT.exe
  C:\Windows\System\BhAxetT.exe
  2⤵
  PID:6312
- C:\Windows\System\FvENKJC.exe
  C:\Windows\System\FvENKJC.exe
  2⤵
  PID:6328
- C:\Windows\System\kCmHuXO.exe
  C:\Windows\System\kCmHuXO.exe
  2⤵
  PID:6344
- C:\Windows\System\ZZzVdkc.exe
  C:\Windows\System\ZZzVdkc.exe
  2⤵
  PID:6364
- C:\Windows\System\htYCnJH.exe
  C:\Windows\System\htYCnJH.exe
  2⤵
  PID:6380
- C:\Windows\System\APUlBZk.exe
  C:\Windows\System\APUlBZk.exe
  2⤵
  PID:6396
- C:\Windows\System\EZMlrNb.exe
  C:\Windows\System\EZMlrNb.exe
  2⤵
  PID:6412
- C:\Windows\System\XFpkqjY.exe
  C:\Windows\System\XFpkqjY.exe
  2⤵
  PID:6428
- C:\Windows\System\rwAIQFP.exe
  C:\Windows\System\rwAIQFP.exe
  2⤵
  PID:6444
- C:\Windows\System\uWnBMcl.exe
  C:\Windows\System\uWnBMcl.exe
  2⤵
  PID:6460
- C:\Windows\System\oFlioKg.exe
  C:\Windows\System\oFlioKg.exe
  2⤵
  PID:6476
- C:\Windows\System\Mysjhmc.exe
  C:\Windows\System\Mysjhmc.exe
  2⤵
  PID:6492
- C:\Windows\System\fgqDZqQ.exe
  C:\Windows\System\fgqDZqQ.exe
  2⤵
  PID:6508
- C:\Windows\System\LNXujlI.exe
  C:\Windows\System\LNXujlI.exe
  2⤵
  PID:6528
- C:\Windows\System\lswJEMa.exe
  C:\Windows\System\lswJEMa.exe
  2⤵
  PID:6544
- C:\Windows\System\uAUSVlA.exe
  C:\Windows\System\uAUSVlA.exe
  2⤵
  PID:6560
- C:\Windows\System\JuvSeJJ.exe
  C:\Windows\System\JuvSeJJ.exe
  2⤵
  PID:6576
- C:\Windows\System\zQdXzqt.exe
  C:\Windows\System\zQdXzqt.exe
  2⤵
  PID:6596
- C:\Windows\System\hvXdFwe.exe
  C:\Windows\System\hvXdFwe.exe
  2⤵
  PID:6612
- C:\Windows\System\mmYpUdB.exe
  C:\Windows\System\mmYpUdB.exe
  2⤵
  PID:6628
- C:\Windows\System\rbUQkVd.exe
  C:\Windows\System\rbUQkVd.exe
  2⤵
  PID:6644
- C:\Windows\System\cntkoDz.exe
  C:\Windows\System\cntkoDz.exe
  2⤵
  PID:6660
- C:\Windows\System\ZZCRPRC.exe
  C:\Windows\System\ZZCRPRC.exe
  2⤵
  PID:6760
- C:\Windows\System\rUjhADw.exe
  C:\Windows\System\rUjhADw.exe
  2⤵
  PID:6784
- C:\Windows\System\aHbHWpt.exe
  C:\Windows\System\aHbHWpt.exe
  2⤵
  PID:6800
- C:\Windows\System\RXhxVXN.exe
  C:\Windows\System\RXhxVXN.exe
  2⤵
  PID:6816
- C:\Windows\System\IJuIhJr.exe
  C:\Windows\System\IJuIhJr.exe
  2⤵
  PID:6832
- C:\Windows\System\rzfFvqp.exe
  C:\Windows\System\rzfFvqp.exe
  2⤵
  PID:6848
- C:\Windows\System\pEuAyow.exe
  C:\Windows\System\pEuAyow.exe
  2⤵
  PID:6864
- C:\Windows\System\EEoGSDr.exe
  C:\Windows\System\EEoGSDr.exe
  2⤵
  PID:6880
- C:\Windows\System\gSzsMeN.exe
  C:\Windows\System\gSzsMeN.exe
  2⤵
  PID:6896
- C:\Windows\System\MNKHuAg.exe
  C:\Windows\System\MNKHuAg.exe
  2⤵
  PID:6912
- C:\Windows\System\VxZrYzN.exe
  C:\Windows\System\VxZrYzN.exe
  2⤵
  PID:6932
- C:\Windows\System\PKrFhMH.exe
  C:\Windows\System\PKrFhMH.exe
  2⤵
  PID:6948
- C:\Windows\System\SIEiVlA.exe
  C:\Windows\System\SIEiVlA.exe
  2⤵
  PID:6964
- C:\Windows\System\vkaXiac.exe
  C:\Windows\System\vkaXiac.exe
  2⤵
  PID:6980
- C:\Windows\System\lVyPlvH.exe
  C:\Windows\System\lVyPlvH.exe
  2⤵
  PID:7000
- C:\Windows\System\hzYApCr.exe
  C:\Windows\System\hzYApCr.exe
  2⤵
  PID:7016
- C:\Windows\System\DCjvAyD.exe
  C:\Windows\System\DCjvAyD.exe
  2⤵
  PID:7032
- C:\Windows\System\LVsrsiZ.exe
  C:\Windows\System\LVsrsiZ.exe
  2⤵
  PID:7048
- C:\Windows\System\kbNNVsR.exe
  C:\Windows\System\kbNNVsR.exe
  2⤵
  PID:7068
- C:\Windows\System\GskTznn.exe
  C:\Windows\System\GskTznn.exe
  2⤵
  PID:7088
- C:\Windows\System\KQaobfm.exe
  C:\Windows\System\KQaobfm.exe
  2⤵
  PID:7104
- C:\Windows\System\TtSVIeh.exe
  C:\Windows\System\TtSVIeh.exe
  2⤵
  PID:7120
- C:\Windows\System\uBcPtXx.exe
  C:\Windows\System\uBcPtXx.exe
  2⤵
  PID:7140
- C:\Windows\System\ThiUptC.exe
  C:\Windows\System\ThiUptC.exe
  2⤵
  PID:7156
- C:\Windows\System\ShMhPJl.exe
  C:\Windows\System\ShMhPJl.exe
  2⤵
  PID:5892
- C:\Windows\System\BpbmSgN.exe
  C:\Windows\System\BpbmSgN.exe
  2⤵
  PID:6180
- C:\Windows\System\QVcWFHE.exe
  C:\Windows\System\QVcWFHE.exe
  2⤵
  PID:5992
- C:\Windows\System\NEsPkYb.exe
  C:\Windows\System\NEsPkYb.exe
  2⤵
  PID:412
- C:\Windows\System\GvTrSIG.exe
  C:\Windows\System\GvTrSIG.exe
  2⤵
  PID:5800
- C:\Windows\System\QmEnHmX.exe
  C:\Windows\System\QmEnHmX.exe
  2⤵
  PID:6252
- C:\Windows\System\VpSEyKq.exe
  C:\Windows\System\VpSEyKq.exe
  2⤵
  PID:6248
- C:\Windows\System\prjUSSZ.exe
  C:\Windows\System\prjUSSZ.exe
  2⤵
  PID:6360
- C:\Windows\System\hNkwfnJ.exe
  C:\Windows\System\hNkwfnJ.exe
  2⤵
  PID:6420
- C:\Windows\System\QnikObV.exe
  C:\Windows\System\QnikObV.exe
  2⤵
  PID:6272
- C:\Windows\System\JmntagV.exe
  C:\Windows\System\JmntagV.exe
  2⤵
  PID:6232
- C:\Windows\System\yiIKHUF.exe
  C:\Windows\System\yiIKHUF.exe
  2⤵
  PID:6372
- C:\Windows\System\LmGkWSc.exe
  C:\Windows\System\LmGkWSc.exe
  2⤵
  PID:6436
- C:\Windows\System\nyaREHD.exe
  C:\Windows\System\nyaREHD.exe
  2⤵
  PID:6516
- C:\Windows\System\FiFtCcp.exe
  C:\Windows\System\FiFtCcp.exe
  2⤵
  PID:6552
- C:\Windows\System\HakXRXY.exe
  C:\Windows\System\HakXRXY.exe
  2⤵
  PID:6588
- C:\Windows\System\VUxiiOG.exe
  C:\Windows\System\VUxiiOG.exe
  2⤵
  PID:6568
- C:\Windows\System\naPrxtD.exe
  C:\Windows\System\naPrxtD.exe
  2⤵
  PID:6620
- C:\Windows\System\YTWxKGF.exe
  C:\Windows\System\YTWxKGF.exe
  2⤵
  PID:6624
- C:\Windows\System\PWaEfYd.exe
  C:\Windows\System\PWaEfYd.exe
  2⤵
  PID:6668
- C:\Windows\System\NdAlmAR.exe
  C:\Windows\System\NdAlmAR.exe
  2⤵
  PID:6680
- C:\Windows\System\ezjtQnz.exe
  C:\Windows\System\ezjtQnz.exe
  2⤵
  PID:6700
- C:\Windows\System\SftTgBZ.exe
  C:\Windows\System\SftTgBZ.exe
  2⤵
  PID:6708
- C:\Windows\System\VTYgMWX.exe
  C:\Windows\System\VTYgMWX.exe
  2⤵
  PID:6740
- C:\Windows\System\wJKyDLH.exe
  C:\Windows\System\wJKyDLH.exe
  2⤵
  PID:5572
- C:\Windows\System\CldXrQL.exe
  C:\Windows\System\CldXrQL.exe
  2⤵
  PID:6812
- C:\Windows\System\mTEWKss.exe
  C:\Windows\System\mTEWKss.exe
  2⤵
  PID:6944
- C:\Windows\System\gvsGAiQ.exe
  C:\Windows\System\gvsGAiQ.exe
  2⤵
  PID:7044
- C:\Windows\System\FqUlPWR.exe
  C:\Windows\System\FqUlPWR.exe
  2⤵
  PID:7012
- C:\Windows\System\wGSBBBR.exe
  C:\Windows\System\wGSBBBR.exe
  2⤵
  PID:6156
- C:\Windows\System\mltuauZ.exe
  C:\Windows\System\mltuauZ.exe
  2⤵
  PID:6172
- C:\Windows\System\RJnmkHA.exe
  C:\Windows\System\RJnmkHA.exe
  2⤵
  PID:6324
- C:\Windows\System\nGfNrBs.exe
  C:\Windows\System\nGfNrBs.exe
  2⤵
  PID:6336
- C:\Windows\System\VsgTcXs.exe
  C:\Windows\System\VsgTcXs.exe
  2⤵
  PID:6268
- C:\Windows\System\BUHzWIJ.exe
  C:\Windows\System\BUHzWIJ.exe
  2⤵
  PID:7056
- C:\Windows\System\anlnVcv.exe
  C:\Windows\System\anlnVcv.exe
  2⤵
  PID:5724
- C:\Windows\System\OPnmCpY.exe
  C:\Windows\System\OPnmCpY.exe
  2⤵
  PID:6408
- C:\Windows\System\AIbmMbE.exe
  C:\Windows\System\AIbmMbE.exe
  2⤵
  PID:6704
- C:\Windows\System\GfctHWz.exe
  C:\Windows\System\GfctHWz.exe
  2⤵
  PID:6356
- C:\Windows\System\HiDiJJW.exe
  C:\Windows\System\HiDiJJW.exe
  2⤵
  PID:6488
- C:\Windows\System\GVHrsCV.exe
  C:\Windows\System\GVHrsCV.exe
  2⤵
  PID:6940
- C:\Windows\System\jlsnHZN.exe
  C:\Windows\System\jlsnHZN.exe
  2⤵
  PID:7028
- C:\Windows\System\GjSRlHp.exe
  C:\Windows\System\GjSRlHp.exe
  2⤵
  PID:6064
- C:\Windows\System\HXEuFeW.exe
  C:\Windows\System\HXEuFeW.exe
  2⤵
  PID:6484
- C:\Windows\System\ZrSUfRZ.exe
  C:\Windows\System\ZrSUfRZ.exe
  2⤵
  PID:6828
- C:\Windows\System\FoxcatG.exe
  C:\Windows\System\FoxcatG.exe
  2⤵
  PID:6924
- C:\Windows\System\dZZDzPB.exe
  C:\Windows\System\dZZDzPB.exe
  2⤵
  PID:6996
- C:\Windows\System\mNJlYKe.exe
  C:\Windows\System\mNJlYKe.exe
  2⤵
  PID:7128
- C:\Windows\System\eQTPoKc.exe
  C:\Windows\System\eQTPoKc.exe
  2⤵
  PID:6256
- C:\Windows\System\lYtnQAD.exe
  C:\Windows\System\lYtnQAD.exe
  2⤵
  PID:6524
- C:\Windows\System\eYoGHWG.exe
  C:\Windows\System\eYoGHWG.exe
  2⤵
  PID:6676
- C:\Windows\System\NAIYDfW.exe
  C:\Windows\System\NAIYDfW.exe
  2⤵
  PID:6908
- C:\Windows\System\BRTrFBK.exe
  C:\Windows\System\BRTrFBK.exe
  2⤵
  PID:5984
- C:\Windows\System\hydyySn.exe
  C:\Windows\System\hydyySn.exe
  2⤵
  PID:6732
- C:\Windows\System\DLCBdsy.exe
  C:\Windows\System\DLCBdsy.exe
  2⤵
  PID:7084
- C:\Windows\System\wvrUKwj.exe
  C:\Windows\System\wvrUKwj.exe
  2⤵
  PID:5372
- C:\Windows\System\oxMzYko.exe
  C:\Windows\System\oxMzYko.exe
  2⤵
  PID:6640
- C:\Windows\System\xilNySD.exe
  C:\Windows\System\xilNySD.exe
  2⤵
  PID:6856
- C:\Windows\System\LxVOUrS.exe
  C:\Windows\System\LxVOUrS.exe
  2⤵
  PID:6216
- C:\Windows\System\DKyxirT.exe
  C:\Windows\System\DKyxirT.exe
  2⤵
  PID:6584
- C:\Windows\System\YNIvkpH.exe
  C:\Windows\System\YNIvkpH.exe
  2⤵
  PID:7164
- C:\Windows\System\mCVFEjM.exe
  C:\Windows\System\mCVFEjM.exe
  2⤵
  PID:6160
- C:\Windows\System\DoVgmHw.exe
  C:\Windows\System\DoVgmHw.exe
  2⤵
  PID:7076
- C:\Windows\System\cPUnueK.exe
  C:\Windows\System\cPUnueK.exe
  2⤵
  PID:6988
- C:\Windows\System\mcsWqwJ.exe
  C:\Windows\System\mcsWqwJ.exe
  2⤵
  PID:6736
- C:\Windows\System\pMLnALK.exe
  C:\Windows\System\pMLnALK.exe
  2⤵
  PID:6808
- C:\Windows\System\uoVUxIa.exe
  C:\Windows\System\uoVUxIa.exe
  2⤵
  PID:7100
- C:\Windows\System\AizGfKN.exe
  C:\Windows\System\AizGfKN.exe
  2⤵
  PID:6468
- C:\Windows\System\eFICXBD.exe
  C:\Windows\System\eFICXBD.exe
  2⤵
  PID:6656
- C:\Windows\System\CExvlVM.exe
  C:\Windows\System\CExvlVM.exe
  2⤵
  PID:2340
- C:\Windows\System\hSquLVU.exe
  C:\Windows\System\hSquLVU.exe
  2⤵
  PID:6824
- C:\Windows\System\KCdXRdp.exe
  C:\Windows\System\KCdXRdp.exe
  2⤵
  PID:6904
- C:\Windows\System\HVPVBDA.exe
  C:\Windows\System\HVPVBDA.exe
  2⤵
  PID:6604
- C:\Windows\System\vLxwFMl.exe
  C:\Windows\System\vLxwFMl.exe
  2⤵
  PID:6164
- C:\Windows\System\NhlDDSt.exe
  C:\Windows\System\NhlDDSt.exe
  2⤵
  PID:6872
- C:\Windows\System\UPoZjpz.exe
  C:\Windows\System\UPoZjpz.exe
  2⤵
  PID:6228
- C:\Windows\System\BgmojHP.exe
  C:\Windows\System\BgmojHP.exe
  2⤵
  PID:7172
- C:\Windows\System\fRkujgq.exe
  C:\Windows\System\fRkujgq.exe
  2⤵
  PID:7188
- C:\Windows\System\NZFrLGx.exe
  C:\Windows\System\NZFrLGx.exe
  2⤵
  PID:7204
- C:\Windows\System\xhEEvIZ.exe
  C:\Windows\System\xhEEvIZ.exe
  2⤵
  PID:7220
- C:\Windows\System\ReiruTD.exe
  C:\Windows\System\ReiruTD.exe
  2⤵
  PID:7236
- C:\Windows\System\JRGrNSY.exe
  C:\Windows\System\JRGrNSY.exe
  2⤵
  PID:7252
- C:\Windows\System\woKBkjz.exe
  C:\Windows\System\woKBkjz.exe
  2⤵
  PID:7268
- C:\Windows\System\uXBaKiz.exe
  C:\Windows\System\uXBaKiz.exe
  2⤵
  PID:7284
- C:\Windows\System\oXWsOHK.exe
  C:\Windows\System\oXWsOHK.exe
  2⤵
  PID:7300
- C:\Windows\System\jTZEWfi.exe
  C:\Windows\System\jTZEWfi.exe
  2⤵
  PID:7316
- C:\Windows\System\lJpGWLR.exe
  C:\Windows\System\lJpGWLR.exe
  2⤵
  PID:7332
- C:\Windows\System\pzvcTxQ.exe
  C:\Windows\System\pzvcTxQ.exe
  2⤵
  PID:7348
- C:\Windows\System\RDSyBQU.exe
  C:\Windows\System\RDSyBQU.exe
  2⤵
  PID:7364
- C:\Windows\System\cdPIBww.exe
  C:\Windows\System\cdPIBww.exe
  2⤵
  PID:7380
- C:\Windows\System\RUbmSfN.exe
  C:\Windows\System\RUbmSfN.exe
  2⤵
  PID:7396
- C:\Windows\System\kFnKaDe.exe
  C:\Windows\System\kFnKaDe.exe
  2⤵
  PID:7412
- C:\Windows\System\cXHAasU.exe
  C:\Windows\System\cXHAasU.exe
  2⤵
  PID:7452
- C:\Windows\System\FIOGoIy.exe
  C:\Windows\System\FIOGoIy.exe
  2⤵
  PID:7480
- C:\Windows\System\iOYKklP.exe
  C:\Windows\System\iOYKklP.exe
  2⤵
  PID:7496
- C:\Windows\System\hoToBjG.exe
  C:\Windows\System\hoToBjG.exe
  2⤵
  PID:7512
- C:\Windows\System\JqXXRSR.exe
  C:\Windows\System\JqXXRSR.exe
  2⤵
  PID:7540
- C:\Windows\System\aLvSgLK.exe
  C:\Windows\System\aLvSgLK.exe
  2⤵
  PID:7632
- C:\Windows\System\MwwiJQh.exe
  C:\Windows\System\MwwiJQh.exe
  2⤵
  PID:7664
- C:\Windows\System\CBSGeCI.exe
  C:\Windows\System\CBSGeCI.exe
  2⤵
  PID:7680
- C:\Windows\System\yAKbfkT.exe
  C:\Windows\System\yAKbfkT.exe
  2⤵
  PID:7696
- C:\Windows\System\DRrykGR.exe
  C:\Windows\System\DRrykGR.exe
  2⤵
  PID:7712
- C:\Windows\System\bIrPXKa.exe
  C:\Windows\System\bIrPXKa.exe
  2⤵
  PID:7728
- C:\Windows\System\tkBhqCm.exe
  C:\Windows\System\tkBhqCm.exe
  2⤵
  PID:7784
- C:\Windows\System\wctYPnJ.exe
  C:\Windows\System\wctYPnJ.exe
  2⤵
  PID:7808
- C:\Windows\System\hHlNNYc.exe
  C:\Windows\System\hHlNNYc.exe
  2⤵
  PID:7828
- C:\Windows\System\joDivhI.exe
  C:\Windows\System\joDivhI.exe
  2⤵
  PID:7844
- C:\Windows\System\fysScqu.exe
  C:\Windows\System\fysScqu.exe
  2⤵
  PID:7860
- C:\Windows\System\ExmhKrp.exe
  C:\Windows\System\ExmhKrp.exe
  2⤵
  PID:7876
- C:\Windows\System\MQwrgcb.exe
  C:\Windows\System\MQwrgcb.exe
  2⤵
  PID:7892
- C:\Windows\System\FGPvfsr.exe
  C:\Windows\System\FGPvfsr.exe
  2⤵
  PID:7908
- C:\Windows\System\nfHVuDC.exe
  C:\Windows\System\nfHVuDC.exe
  2⤵
  PID:7924
- C:\Windows\System\sMxqntL.exe
  C:\Windows\System\sMxqntL.exe
  2⤵
  PID:7940
- C:\Windows\System\gSbEGGY.exe
  C:\Windows\System\gSbEGGY.exe
  2⤵
  PID:7960
- C:\Windows\System\MaoDkdJ.exe
  C:\Windows\System\MaoDkdJ.exe
  2⤵
  PID:7984
- C:\Windows\System\UgKSYCQ.exe
  C:\Windows\System\UgKSYCQ.exe
  2⤵
  PID:8000
- C:\Windows\System\gNvMunK.exe
  C:\Windows\System\gNvMunK.exe
  2⤵
  PID:8016
- C:\Windows\System\WtadZKW.exe
  C:\Windows\System\WtadZKW.exe
  2⤵
  PID:8032
- C:\Windows\System\QBmRdPO.exe
  C:\Windows\System\QBmRdPO.exe
  2⤵
  PID:8048
- C:\Windows\System\pLaMbwx.exe
  C:\Windows\System\pLaMbwx.exe
  2⤵
  PID:8068
- C:\Windows\System\UKzasJQ.exe
  C:\Windows\System\UKzasJQ.exe
  2⤵
  PID:8084
- C:\Windows\System\KIuAAhq.exe
  C:\Windows\System\KIuAAhq.exe
  2⤵
  PID:8100
- C:\Windows\System\nVymdiO.exe
  C:\Windows\System\nVymdiO.exe
  2⤵
  PID:8120
- C:\Windows\System\phKzoCb.exe
  C:\Windows\System\phKzoCb.exe
  2⤵
  PID:8136
- C:\Windows\System\RSffBkW.exe
  C:\Windows\System\RSffBkW.exe
  2⤵
  PID:8152
- C:\Windows\System\hWlcPwb.exe
  C:\Windows\System\hWlcPwb.exe
  2⤵
  PID:8172
- C:\Windows\System\LPlLUgN.exe
  C:\Windows\System\LPlLUgN.exe
  2⤵
  PID:6888
- C:\Windows\System\wBZsTGe.exe
  C:\Windows\System\wBZsTGe.exe
  2⤵
  PID:7388
- C:\Windows\System\eBdibMw.exe
  C:\Windows\System\eBdibMw.exe
  2⤵
  PID:6456
- C:\Windows\System\EMmaagM.exe
  C:\Windows\System\EMmaagM.exe
  2⤵
  PID:6200
- C:\Windows\System\sFjJzSs.exe
  C:\Windows\System\sFjJzSs.exe
  2⤵
  PID:7244
- C:\Windows\System\YXvduUK.exe
  C:\Windows\System\YXvduUK.exe
  2⤵
  PID:7312
- C:\Windows\System\JAGKwTN.exe
  C:\Windows\System\JAGKwTN.exe
  2⤵
  PID:7376
- C:\Windows\System\dkMShge.exe
  C:\Windows\System\dkMShge.exe
  2⤵
  PID:7184
- C:\Windows\System\bLFcatg.exe
  C:\Windows\System\bLFcatg.exe
  2⤵
  PID:7424
- C:\Windows\System\hRbCsbm.exe
  C:\Windows\System\hRbCsbm.exe
  2⤵
  PID:7440
- C:\Windows\System\JCkaawX.exe
  C:\Windows\System\JCkaawX.exe
  2⤵
  PID:7492
- C:\Windows\System\YHjBQzj.exe
  C:\Windows\System\YHjBQzj.exe
  2⤵
  PID:7660
- C:\Windows\System\OJcgucU.exe
  C:\Windows\System\OJcgucU.exe
  2⤵
  PID:7532
- C:\Windows\System\hONyJrJ.exe
  C:\Windows\System\hONyJrJ.exe
  2⤵
  PID:7692
- C:\Windows\System\CeaGtGH.exe
  C:\Windows\System\CeaGtGH.exe
  2⤵
  PID:7796
- C:\Windows\System\BWgnIZl.exe
  C:\Windows\System\BWgnIZl.exe
  2⤵
  PID:7836
- C:\Windows\System\UoClQmu.exe
  C:\Windows\System\UoClQmu.exe
  2⤵
  PID:7900
- C:\Windows\System\ZtfDCcV.exe
  C:\Windows\System\ZtfDCcV.exe
  2⤵
  PID:7972
- C:\Windows\System\qzMTAps.exe
  C:\Windows\System\qzMTAps.exe
  2⤵
  PID:7980
- C:\Windows\System\WAARCYF.exe
  C:\Windows\System\WAARCYF.exe
  2⤵
  PID:8040
- C:\Windows\System\AHnwRgN.exe
  C:\Windows\System\AHnwRgN.exe
  2⤵
  PID:8144
- C:\Windows\System\heyIgNR.exe
  C:\Windows\System\heyIgNR.exe
  2⤵
  PID:8108
- C:\Windows\System\lWLArkh.exe
  C:\Windows\System\lWLArkh.exe
  2⤵
  PID:7816
- C:\Windows\System\RWkmyPQ.exe
  C:\Windows\System\RWkmyPQ.exe
  2⤵
  PID:8096
- C:\Windows\System\nDNKkXK.exe
  C:\Windows\System\nDNKkXK.exe
  2⤵
  PID:8164
- C:\Windows\System\oDBNvCD.exe
  C:\Windows\System\oDBNvCD.exe
  2⤵
  PID:7232
- C:\Windows\System\iDnFBiY.exe
  C:\Windows\System\iDnFBiY.exe
  2⤵
  PID:7460
- C:\Windows\System\AZOFrFu.exe
  C:\Windows\System\AZOFrFu.exe
  2⤵
  PID:7476
- C:\Windows\System\FXvupGu.exe
  C:\Windows\System\FXvupGu.exe
  2⤵
  PID:7536
- C:\Windows\System\gyDRfdw.exe
  C:\Windows\System\gyDRfdw.exe
  2⤵
  PID:7604
- C:\Windows\System\GstFppM.exe
  C:\Windows\System\GstFppM.exe
  2⤵
  PID:7772
- C:\Windows\System\iYjOCLr.exe
  C:\Windows\System\iYjOCLr.exe
  2⤵
  PID:7888
- C:\Windows\System\STenGBi.exe
  C:\Windows\System\STenGBi.exe
  2⤵
  PID:7572
- C:\Windows\System\oQCHAmS.exe
  C:\Windows\System\oQCHAmS.exe
  2⤵
  PID:7588
- C:\Windows\System\wtJtyMa.exe
  C:\Windows\System\wtJtyMa.exe
  2⤵
  PID:7564
- C:\Windows\System\qrilpqt.exe
  C:\Windows\System\qrilpqt.exe
  2⤵
  PID:7620
- C:\Windows\System\hSvtWPB.exe
  C:\Windows\System\hSvtWPB.exe
  2⤵
  PID:7708
- C:\Windows\System\OcOgGgR.exe
  C:\Windows\System\OcOgGgR.exe
  2⤵
  PID:7752
- C:\Windows\System\MNVpNOQ.exe
  C:\Windows\System\MNVpNOQ.exe
  2⤵
  PID:7768
- C:\Windows\System\CoFZNli.exe
  C:\Windows\System\CoFZNli.exe
  2⤵
  PID:7920
- C:\Windows\System\SxGekjq.exe
  C:\Windows\System\SxGekjq.exe
  2⤵
  PID:7992
- C:\Windows\System\VDSisJt.exe
  C:\Windows\System\VDSisJt.exe
  2⤵
  PID:8056
- C:\Windows\System\iUBDeHY.exe
  C:\Windows\System\iUBDeHY.exe
  2⤵
  PID:7356
- C:\Windows\System\eJtBBWJ.exe
  C:\Windows\System\eJtBBWJ.exe
  2⤵
  PID:7392
- C:\Windows\System\ModTjnk.exe
  C:\Windows\System\ModTjnk.exe
  2⤵
  PID:6684
- C:\Windows\System\jmmdGhe.exe
  C:\Windows\System\jmmdGhe.exe
  2⤵
  PID:7408
- C:\Windows\System\aLxzWjG.exe
  C:\Windows\System\aLxzWjG.exe
  2⤵
  PID:7488
- C:\Windows\System\YeRVsXQ.exe
  C:\Windows\System\YeRVsXQ.exe
  2⤵
  PID:7436
- C:\Windows\System\TzpJVjP.exe
  C:\Windows\System\TzpJVjP.exe
  2⤵
  PID:7656
- C:\Windows\System\XREGSlI.exe
  C:\Windows\System\XREGSlI.exe
  2⤵
  PID:7724
- C:\Windows\System\DGcLohK.exe
  C:\Windows\System\DGcLohK.exe
  2⤵
  PID:7936
- C:\Windows\System\ulZztOf.exe
  C:\Windows\System\ulZztOf.exe
  2⤵
  PID:8092
- C:\Windows\System\TCTMdEN.exe
  C:\Windows\System\TCTMdEN.exe
  2⤵
  PID:7200
- C:\Windows\System\MqWLrBm.exe
  C:\Windows\System\MqWLrBm.exe
  2⤵
  PID:7556
- C:\Windows\System\paKLPLz.exe
  C:\Windows\System\paKLPLz.exe
  2⤵
  PID:7264
- C:\Windows\System\ZaUvfiI.exe
  C:\Windows\System\ZaUvfiI.exe
  2⤵
  PID:7676
- C:\Windows\System\zPOplQc.exe
  C:\Windows\System\zPOplQc.exe
  2⤵
  PID:7744
- C:\Windows\System\SHIttOt.exe
  C:\Windows\System\SHIttOt.exe
  2⤵
  PID:7584
- C:\Windows\System\uZPddLI.exe
  C:\Windows\System\uZPddLI.exe
  2⤵
  PID:7616
- C:\Windows\System\GDCwOBQ.exe
  C:\Windows\System\GDCwOBQ.exe
  2⤵
  PID:7820
- C:\Windows\System\EQllRFP.exe
  C:\Windows\System\EQllRFP.exe
  2⤵
  PID:6196
- C:\Windows\System\LPDogqz.exe
  C:\Windows\System\LPDogqz.exe
  2⤵
  PID:7644
- C:\Windows\System\gLZkTGv.exe
  C:\Windows\System\gLZkTGv.exe
  2⤵
  PID:7760
- C:\Windows\System\BDnFQmy.exe
  C:\Windows\System\BDnFQmy.exe
  2⤵
  PID:7468
- C:\Windows\System\aWRnnAn.exe
  C:\Windows\System\aWRnnAn.exe
  2⤵
  PID:7856
- C:\Windows\System\uySxWrZ.exe
  C:\Windows\System\uySxWrZ.exe
  2⤵
  PID:7404
- C:\Windows\System\sNoBvvy.exe
  C:\Windows\System\sNoBvvy.exe
  2⤵
  PID:7216
- C:\Windows\System\KUlmJow.exe
  C:\Windows\System\KUlmJow.exe
  2⤵
  PID:8208
- C:\Windows\System\TECqQfF.exe
  C:\Windows\System\TECqQfF.exe
  2⤵
  PID:8224
- C:\Windows\System\wqmjTmX.exe
  C:\Windows\System\wqmjTmX.exe
  2⤵
  PID:8240
- C:\Windows\System\DzWTrEh.exe
  C:\Windows\System\DzWTrEh.exe
  2⤵
  PID:8256
- C:\Windows\System\FedNoHX.exe
  C:\Windows\System\FedNoHX.exe
  2⤵
  PID:8272
- C:\Windows\System\cIXENQh.exe
  C:\Windows\System\cIXENQh.exe
  2⤵
  PID:8288
- C:\Windows\System\LsADBHV.exe
  C:\Windows\System\LsADBHV.exe
  2⤵
  PID:8304
- C:\Windows\System\DKPtqxK.exe
  C:\Windows\System\DKPtqxK.exe
  2⤵
  PID:8320
- C:\Windows\System\YDqMcUP.exe
  C:\Windows\System\YDqMcUP.exe
  2⤵
  PID:8336
- C:\Windows\System\oQCocCP.exe
  C:\Windows\System\oQCocCP.exe
  2⤵
  PID:8352
- C:\Windows\System\AoXnSwH.exe
  C:\Windows\System\AoXnSwH.exe
  2⤵
  PID:8368
- C:\Windows\System\ZMVkXXO.exe
  C:\Windows\System\ZMVkXXO.exe
  2⤵
  PID:8384
- C:\Windows\System\KpOXcjb.exe
  C:\Windows\System\KpOXcjb.exe
  2⤵
  PID:8400
- C:\Windows\System\WXqNuox.exe
  C:\Windows\System\WXqNuox.exe
  2⤵
  PID:8416
- C:\Windows\System\ARCnWyZ.exe
  C:\Windows\System\ARCnWyZ.exe
  2⤵
  PID:8432
- C:\Windows\System\wzEuseB.exe
  C:\Windows\System\wzEuseB.exe
  2⤵
  PID:8448
- C:\Windows\System\dvuRfRh.exe
  C:\Windows\System\dvuRfRh.exe
  2⤵
  PID:8464
- C:\Windows\System\FXnGoOK.exe
  C:\Windows\System\FXnGoOK.exe
  2⤵
  PID:8480
- C:\Windows\System\AUppEUf.exe
  C:\Windows\System\AUppEUf.exe
  2⤵
  PID:8496
- C:\Windows\System\VBvlpDd.exe
  C:\Windows\System\VBvlpDd.exe
  2⤵
  PID:8512
- C:\Windows\System\oaVbIHy.exe
  C:\Windows\System\oaVbIHy.exe
  2⤵
  PID:8528
- C:\Windows\System\PdlCcZl.exe
  C:\Windows\System\PdlCcZl.exe
  2⤵
  PID:8544
- C:\Windows\System\OHLXTdT.exe
  C:\Windows\System\OHLXTdT.exe
  2⤵
  PID:8560
- C:\Windows\System\MBeHsMU.exe
  C:\Windows\System\MBeHsMU.exe
  2⤵
  PID:8576
- C:\Windows\System\DFkrGQe.exe
  C:\Windows\System\DFkrGQe.exe
  2⤵
  PID:8592
- C:\Windows\System\ecEwilG.exe
  C:\Windows\System\ecEwilG.exe
  2⤵
  PID:8608
- C:\Windows\System\sFdjnmN.exe
  C:\Windows\System\sFdjnmN.exe
  2⤵
  PID:8624
- C:\Windows\System\TVbmSzt.exe
  C:\Windows\System\TVbmSzt.exe
  2⤵
  PID:8644
- C:\Windows\System\sjKNvfz.exe
  C:\Windows\System\sjKNvfz.exe
  2⤵
  PID:8660
- C:\Windows\System\swUBBYA.exe
  C:\Windows\System\swUBBYA.exe
  2⤵
  PID:8676
- C:\Windows\System\eIRDeyP.exe
  C:\Windows\System\eIRDeyP.exe
  2⤵
  PID:8692
- C:\Windows\System\ciBylqG.exe
  C:\Windows\System\ciBylqG.exe
  2⤵
  PID:8708
- C:\Windows\System\hDFRqqC.exe
  C:\Windows\System\hDFRqqC.exe
  2⤵
  PID:8724
- C:\Windows\System\uuUjCSQ.exe
  C:\Windows\System\uuUjCSQ.exe
  2⤵
  PID:8740
- C:\Windows\System\PCLqkSe.exe
  C:\Windows\System\PCLqkSe.exe
  2⤵
  PID:8756
- C:\Windows\System\JyQhcFH.exe
  C:\Windows\System\JyQhcFH.exe
  2⤵
  PID:8772
- C:\Windows\System\mRsPypf.exe
  C:\Windows\System\mRsPypf.exe
  2⤵
  PID:8788
- C:\Windows\System\wmQeFjF.exe
  C:\Windows\System\wmQeFjF.exe
  2⤵
  PID:8804
- C:\Windows\System\sfnLGts.exe
  C:\Windows\System\sfnLGts.exe
  2⤵
  PID:8820
- C:\Windows\System\VnnKDwi.exe
  C:\Windows\System\VnnKDwi.exe
  2⤵
  PID:8836
- C:\Windows\System\tkdilus.exe
  C:\Windows\System\tkdilus.exe
  2⤵
  PID:8852
- C:\Windows\System\GaZWylH.exe
  C:\Windows\System\GaZWylH.exe
  2⤵
  PID:8868
- C:\Windows\System\IAZjOJp.exe
  C:\Windows\System\IAZjOJp.exe
  2⤵
  PID:8884
- C:\Windows\System\iKceTth.exe
  C:\Windows\System\iKceTth.exe
  2⤵
  PID:8900
- C:\Windows\System\YKzfrHI.exe
  C:\Windows\System\YKzfrHI.exe
  2⤵
  PID:8916
- C:\Windows\System\MEbHvBp.exe
  C:\Windows\System\MEbHvBp.exe
  2⤵
  PID:8932
- C:\Windows\System\xyNASWw.exe
  C:\Windows\System\xyNASWw.exe
  2⤵
  PID:8948
- C:\Windows\System\XutTotM.exe
  C:\Windows\System\XutTotM.exe
  2⤵
  PID:8964
- C:\Windows\System\zALXQsD.exe
  C:\Windows\System\zALXQsD.exe
  2⤵
  PID:8980
- C:\Windows\System\mnfXzEw.exe
  C:\Windows\System\mnfXzEw.exe
  2⤵
  PID:8996
- C:\Windows\System\UTHIxMo.exe
  C:\Windows\System\UTHIxMo.exe
  2⤵
  PID:9012
- C:\Windows\System\QXgjlJm.exe
  C:\Windows\System\QXgjlJm.exe
  2⤵
  PID:9028
- C:\Windows\System\cuETjPq.exe
  C:\Windows\System\cuETjPq.exe
  2⤵
  PID:9044
- C:\Windows\System\xRhGLnc.exe
  C:\Windows\System\xRhGLnc.exe
  2⤵
  PID:9060
- C:\Windows\System\IjmssvW.exe
  C:\Windows\System\IjmssvW.exe
  2⤵
  PID:9076
- C:\Windows\System\IGVLelP.exe
  C:\Windows\System\IGVLelP.exe
  2⤵
  PID:9092
- C:\Windows\System\EZmpSED.exe
  C:\Windows\System\EZmpSED.exe
  2⤵
  PID:9108
- C:\Windows\System\tMRHcIq.exe
  C:\Windows\System\tMRHcIq.exe
  2⤵
  PID:9124
- C:\Windows\System\azOUHay.exe
  C:\Windows\System\azOUHay.exe
  2⤵
  PID:9140
- C:\Windows\System\eIfPxZS.exe
  C:\Windows\System\eIfPxZS.exe
  2⤵
  PID:9156
- C:\Windows\System\xzzKzLE.exe
  C:\Windows\System\xzzKzLE.exe
  2⤵
  PID:9172
- C:\Windows\System\ghZruKb.exe
  C:\Windows\System\ghZruKb.exe
  2⤵
  PID:9188
- C:\Windows\System\bwrURuJ.exe
  C:\Windows\System\bwrURuJ.exe
  2⤵
  PID:9204
- C:\Windows\System\SHcTJvt.exe
  C:\Windows\System\SHcTJvt.exe
  2⤵
  PID:8008
- C:\Windows\System\OQXvtxC.exe
  C:\Windows\System\OQXvtxC.exe
  2⤵
  PID:8236
- C:\Windows\System\aZoFvpG.exe
  C:\Windows\System\aZoFvpG.exe
  2⤵
  PID:8296
- C:\Windows\System\yuCQOYv.exe
  C:\Windows\System\yuCQOYv.exe
  2⤵
  PID:7472
- C:\Windows\System\LqLliae.exe
  C:\Windows\System\LqLliae.exe
  2⤵
  PID:8360
- C:\Windows\System\RCDOyaw.exe
  C:\Windows\System\RCDOyaw.exe
  2⤵
  PID:7280
- C:\Windows\System\zdCAYNM.exe
  C:\Windows\System\zdCAYNM.exe
  2⤵
  PID:8428
- C:\Windows\System\Xnpddpi.exe
  C:\Windows\System\Xnpddpi.exe
  2⤵
  PID:7448
- C:\Windows\System\zvIvgiZ.exe
  C:\Windows\System\zvIvgiZ.exe
  2⤵
  PID:7868
- C:\Windows\System\LjjjQfY.exe
  C:\Windows\System\LjjjQfY.exe
  2⤵
  PID:7956
- C:\Windows\System\ShorIEe.exe
  C:\Windows\System\ShorIEe.exe
  2⤵
  PID:5832
- C:\Windows\System\nHEWyyQ.exe
  C:\Windows\System\nHEWyyQ.exe
  2⤵
  PID:7624
- C:\Windows\System\bDLImGi.exe
  C:\Windows\System\bDLImGi.exe
  2⤵
  PID:8252
- C:\Windows\System\ROZBSAt.exe
  C:\Windows\System\ROZBSAt.exe
  2⤵
  PID:8520
- C:\Windows\System\ODFuYou.exe
  C:\Windows\System\ODFuYou.exe
  2⤵
  PID:8188
- C:\Windows\System\dxFLeiY.exe
  C:\Windows\System\dxFLeiY.exe
  2⤵
  PID:7824
- C:\Windows\System\eseIXAF.exe
  C:\Windows\System\eseIXAF.exe
  2⤵
  PID:8220
- C:\Windows\System\XmnVhty.exe
  C:\Windows\System\XmnVhty.exe
  2⤵
  PID:8316
- C:\Windows\System\bGXjiXX.exe
  C:\Windows\System\bGXjiXX.exe
  2⤵
  PID:8408
- C:\Windows\System\hThogPQ.exe
  C:\Windows\System\hThogPQ.exe
  2⤵
  PID:8472
- C:\Windows\System\cgUgDEb.exe
  C:\Windows\System\cgUgDEb.exe
  2⤵
  PID:8552
- C:\Windows\System\zFscmgA.exe
  C:\Windows\System\zFscmgA.exe
  2⤵
  PID:8600
- C:\Windows\System\DXUEHxd.exe
  C:\Windows\System\DXUEHxd.exe
  2⤵
  PID:8616
- C:\Windows\System\uTpiwHt.exe
  C:\Windows\System\uTpiwHt.exe
  2⤵
  PID:8640
- C:\Windows\System\CljYeqj.exe
  C:\Windows\System\CljYeqj.exe
  2⤵
  PID:8748
- C:\Windows\System\kFtjOCg.exe
  C:\Windows\System\kFtjOCg.exe
  2⤵
  PID:8784
- C:\Windows\System\nwcmqFJ.exe
  C:\Windows\System\nwcmqFJ.exe
  2⤵
  PID:8768
- C:\Windows\System\xCBVRIS.exe
  C:\Windows\System\xCBVRIS.exe
  2⤵
  PID:8736
- C:\Windows\System\uqpBHwd.exe
  C:\Windows\System\uqpBHwd.exe
  2⤵
  PID:8844
- C:\Windows\System\vHjMOCX.exe
  C:\Windows\System\vHjMOCX.exe
  2⤵
  PID:8832
- C:\Windows\System\phddBVP.exe
  C:\Windows\System\phddBVP.exe
  2⤵
  PID:8876
- C:\Windows\System\SIkIqki.exe
  C:\Windows\System\SIkIqki.exe
  2⤵
  PID:8944
- C:\Windows\System\swOZfPK.exe
  C:\Windows\System\swOZfPK.exe
  2⤵
  PID:9008
- C:\Windows\System\TXLbQdR.exe
  C:\Windows\System\TXLbQdR.exe
  2⤵
  PID:9040
- C:\Windows\System\QBasReb.exe
  C:\Windows\System\QBasReb.exe
  2⤵
  PID:8892
- C:\Windows\System\QWOKZQe.exe
  C:\Windows\System\QWOKZQe.exe
  2⤵
  PID:8928
- C:\Windows\System\EveOrrn.exe
  C:\Windows\System\EveOrrn.exe
  2⤵
  PID:8992
- C:\Windows\System\uclUFEo.exe
  C:\Windows\System\uclUFEo.exe
  2⤵
  PID:9056
- C:\Windows\System\dLrDvxc.exe
  C:\Windows\System\dLrDvxc.exe
  2⤵
  PID:9168
- C:\Windows\System\OukpahS.exe
  C:\Windows\System\OukpahS.exe
  2⤵
  PID:9152
- C:\Windows\System\sIeUWZB.exe
  C:\Windows\System\sIeUWZB.exe
  2⤵
  PID:8200
- C:\Windows\System\fCIbmUM.exe
  C:\Windows\System\fCIbmUM.exe
  2⤵
  PID:8328
- C:\Windows\System\xuXlYwB.exe
  C:\Windows\System\xuXlYwB.exe
  2⤵
  PID:6892
- C:\Windows\System\lZmsFRs.exe
  C:\Windows\System\lZmsFRs.exe
  2⤵
  PID:8284
- C:\Windows\System\dMuqwFq.exe
  C:\Windows\System\dMuqwFq.exe
  2⤵
  PID:8312
- C:\Windows\System\dkHjxmH.exe
  C:\Windows\System\dkHjxmH.exe
  2⤵
  PID:8264
- C:\Windows\System\bKQTasw.exe
  C:\Windows\System\bKQTasw.exe
  2⤵
  PID:7596
- C:\Windows\System\GkpYOtN.exe
  C:\Windows\System\GkpYOtN.exe
  2⤵
  PID:8504
- C:\Windows\System\DUUjyUS.exe
  C:\Windows\System\DUUjyUS.exe
  2⤵
  PID:7612
- C:\Windows\System\ubgrEgF.exe
  C:\Windows\System\ubgrEgF.exe
  2⤵
  PID:8116
- C:\Windows\System\CfACEHj.exe
  C:\Windows\System\CfACEHj.exe
  2⤵
  PID:8572
- C:\Windows\System\MNajhvB.exe
  C:\Windows\System\MNajhvB.exe
  2⤵
  PID:8656
- C:\Windows\System\SgSYfND.exe
  C:\Windows\System\SgSYfND.exe
  2⤵
  PID:8672
- C:\Windows\System\rnVbeDH.exe
  C:\Windows\System\rnVbeDH.exe
  2⤵
  PID:8720
- C:\Windows\System\BjgtJQd.exe
  C:\Windows\System\BjgtJQd.exe
  2⤵
  PID:8704
- C:\Windows\System\CjwMbpB.exe
  C:\Windows\System\CjwMbpB.exe
  2⤵
  PID:8912
- C:\Windows\System\DCZbFPr.exe
  C:\Windows\System\DCZbFPr.exe
  2⤵
  PID:9052
- C:\Windows\System\cXFXysL.exe
  C:\Windows\System\cXFXysL.exe
  2⤵
  PID:9120
- C:\Windows\System\uvPJNnm.exe
  C:\Windows\System\uvPJNnm.exe
  2⤵
  PID:7372
- C:\Windows\System\WVTSRGN.exe
  C:\Windows\System\WVTSRGN.exe
  2⤵
  PID:8524
- C:\Windows\System\jyUCFPi.exe
  C:\Windows\System\jyUCFPi.exe
  2⤵
  PID:8492
- C:\Windows\System\WwpKqRh.exe
  C:\Windows\System\WwpKqRh.exe
  2⤵
  PID:8700
- C:\Windows\System\UdANmeF.exe
  C:\Windows\System\UdANmeF.exe
  2⤵
  PID:8860
- C:\Windows\System\mqzbgYf.exe
  C:\Windows\System\mqzbgYf.exe
  2⤵
  PID:8620
- C:\Windows\System\MrexnnK.exe
  C:\Windows\System\MrexnnK.exe
  2⤵
  PID:9224
- C:\Windows\System\NIJpxpC.exe
  C:\Windows\System\NIJpxpC.exe
  2⤵
  PID:9240
- C:\Windows\System\WhLctGL.exe
  C:\Windows\System\WhLctGL.exe
  2⤵
  PID:9256
- C:\Windows\System\DdfYImD.exe
  C:\Windows\System\DdfYImD.exe
  2⤵
  PID:9272
- C:\Windows\System\eNzYRLh.exe
  C:\Windows\System\eNzYRLh.exe
  2⤵
  PID:9288
- C:\Windows\System\dwHfqaI.exe
  C:\Windows\System\dwHfqaI.exe
  2⤵
  PID:9304
- C:\Windows\System\BqviIsx.exe
  C:\Windows\System\BqviIsx.exe
  2⤵
  PID:9320
- C:\Windows\System\OztkXRU.exe
  C:\Windows\System\OztkXRU.exe
  2⤵
  PID:9336
- C:\Windows\System\iLNJhjD.exe
  C:\Windows\System\iLNJhjD.exe
  2⤵
  PID:9352
- C:\Windows\System\FUtPKEf.exe
  C:\Windows\System\FUtPKEf.exe
  2⤵
  PID:9368
- C:\Windows\System\VkVprfU.exe
  C:\Windows\System\VkVprfU.exe
  2⤵
  PID:9384
- C:\Windows\System\yRitkIJ.exe
  C:\Windows\System\yRitkIJ.exe
  2⤵
  PID:9400
- C:\Windows\System\PZVsxrD.exe
  C:\Windows\System\PZVsxrD.exe
  2⤵
  PID:9416
- C:\Windows\System\kxCvbWX.exe
  C:\Windows\System\kxCvbWX.exe
  2⤵
  PID:9432
- C:\Windows\System\sOUFHns.exe
  C:\Windows\System\sOUFHns.exe
  2⤵
  PID:9448
- C:\Windows\System\OpbZvoQ.exe
  C:\Windows\System\OpbZvoQ.exe
  2⤵
  PID:9464
- C:\Windows\System\YjKhdil.exe
  C:\Windows\System\YjKhdil.exe
  2⤵
  PID:9480
- C:\Windows\System\vdoWvOh.exe
  C:\Windows\System\vdoWvOh.exe
  2⤵
  PID:9496
- C:\Windows\System\JXuPrdQ.exe
  C:\Windows\System\JXuPrdQ.exe
  2⤵
  PID:9512
- C:\Windows\System\aJrjdCR.exe
  C:\Windows\System\aJrjdCR.exe
  2⤵
  PID:9528
- C:\Windows\System\mPoghzK.exe
  C:\Windows\System\mPoghzK.exe
  2⤵
  PID:9544
- C:\Windows\System\POAPykJ.exe
  C:\Windows\System\POAPykJ.exe
  2⤵
  PID:9564
- C:\Windows\System\UFvbIED.exe
  C:\Windows\System\UFvbIED.exe
  2⤵
  PID:9580
- C:\Windows\System\MnqaOiF.exe
  C:\Windows\System\MnqaOiF.exe
  2⤵
  PID:9596
- C:\Windows\System\JkykfwW.exe
  C:\Windows\System\JkykfwW.exe
  2⤵
  PID:9612
- C:\Windows\System\Qarkmej.exe
  C:\Windows\System\Qarkmej.exe
  2⤵
  PID:9628
- C:\Windows\System\tJMjNAs.exe
  C:\Windows\System\tJMjNAs.exe
  2⤵
  PID:9644
- C:\Windows\System\LJvxquz.exe
  C:\Windows\System\LJvxquz.exe
  2⤵
  PID:9660
- C:\Windows\System\IQiNcnJ.exe
  C:\Windows\System\IQiNcnJ.exe
  2⤵
  PID:9676
- C:\Windows\System\GKZKrGu.exe
  C:\Windows\System\GKZKrGu.exe
  2⤵
  PID:9692
- C:\Windows\System\ETOdBUv.exe
  C:\Windows\System\ETOdBUv.exe
  2⤵
  PID:9708
- C:\Windows\System\xgKeaFv.exe
  C:\Windows\System\xgKeaFv.exe
  2⤵
  PID:9724
- C:\Windows\System\tFpwcBG.exe
  C:\Windows\System\tFpwcBG.exe
  2⤵
  PID:9740
- C:\Windows\System\DDJpPph.exe
  C:\Windows\System\DDJpPph.exe
  2⤵
  PID:9756
- C:\Windows\System\WleMaZZ.exe
  C:\Windows\System\WleMaZZ.exe
  2⤵
  PID:9772
- C:\Windows\System\PYmWsKu.exe
  C:\Windows\System\PYmWsKu.exe
  2⤵
  PID:9788
- C:\Windows\System\isoQnfh.exe
  C:\Windows\System\isoQnfh.exe
  2⤵
  PID:9804
- C:\Windows\System\DFkYPfg.exe
  C:\Windows\System\DFkYPfg.exe
  2⤵
  PID:9820
- C:\Windows\System\EEUhdli.exe
  C:\Windows\System\EEUhdli.exe
  2⤵
  PID:9836
- C:\Windows\System\vtUlhaV.exe
  C:\Windows\System\vtUlhaV.exe
  2⤵
  PID:9852
- C:\Windows\System\luPlcbb.exe
  C:\Windows\System\luPlcbb.exe
  2⤵
  PID:9868
- C:\Windows\System\wgkzPlx.exe
  C:\Windows\System\wgkzPlx.exe
  2⤵
  PID:9884
- C:\Windows\System\skCqgSH.exe
  C:\Windows\System\skCqgSH.exe
  2⤵
  PID:9900
- C:\Windows\System\jHplehC.exe
  C:\Windows\System\jHplehC.exe
  2⤵
  PID:9916
- C:\Windows\System\nmIbNUU.exe
  C:\Windows\System\nmIbNUU.exe
  2⤵
  PID:9932
- C:\Windows\System\KUVytav.exe
  C:\Windows\System\KUVytav.exe
  2⤵
  PID:9948
- C:\Windows\System\FTNoVRF.exe
  C:\Windows\System\FTNoVRF.exe
  2⤵
  PID:9964
- C:\Windows\System\FbpMbSs.exe
  C:\Windows\System\FbpMbSs.exe
  2⤵
  PID:9984
- C:\Windows\System\wxkiMIg.exe
  C:\Windows\System\wxkiMIg.exe
  2⤵
  PID:10000
- C:\Windows\System\kOxRtSF.exe
  C:\Windows\System\kOxRtSF.exe
  2⤵
  PID:10020
- C:\Windows\System\umUoIHh.exe
  C:\Windows\System\umUoIHh.exe
  2⤵
  PID:10036
- C:\Windows\System\yejhEay.exe
  C:\Windows\System\yejhEay.exe
  2⤵
  PID:10052
- C:\Windows\System\fxsKiXt.exe
  C:\Windows\System\fxsKiXt.exe
  2⤵
  PID:10072
- C:\Windows\System\XjJenLE.exe
  C:\Windows\System\XjJenLE.exe
  2⤵
  PID:10088
- C:\Windows\System\YNLoYgM.exe
  C:\Windows\System\YNLoYgM.exe
  2⤵
  PID:10104
- C:\Windows\System\OwBZbqR.exe
  C:\Windows\System\OwBZbqR.exe
  2⤵
  PID:10120
- C:\Windows\System\ejSzrtZ.exe
  C:\Windows\System\ejSzrtZ.exe
  2⤵
  PID:10136
- C:\Windows\System\kihaWnF.exe
  C:\Windows\System\kihaWnF.exe
  2⤵
  PID:10152
- C:\Windows\System\tzfhJzJ.exe
  C:\Windows\System\tzfhJzJ.exe
  2⤵
  PID:10172
- C:\Windows\System\aJlVhqP.exe
  C:\Windows\System\aJlVhqP.exe
  2⤵
  PID:10188
- C:\Windows\System\mnxvxTL.exe
  C:\Windows\System\mnxvxTL.exe
  2⤵
  PID:10204
- C:\Windows\System\fYUCKCy.exe
  C:\Windows\System\fYUCKCy.exe
  2⤵
  PID:9428
- C:\Windows\System\aUbkusw.exe
  C:\Windows\System\aUbkusw.exe
  2⤵
  PID:9488
- C:\Windows\System\RRTsJQm.exe
  C:\Windows\System\RRTsJQm.exe
  2⤵
  PID:9136
- C:\Windows\System\bFmVOTQ.exe
  C:\Windows\System\bFmVOTQ.exe
  2⤵
  PID:9100
- C:\Windows\System\uMHUuXz.exe
  C:\Windows\System\uMHUuXz.exe
  2⤵
  PID:9004
- C:\Windows\System\fCHldUn.exe
  C:\Windows\System\fCHldUn.exe
  2⤵
  PID:1568
- C:\Windows\System\iDufxcb.exe
  C:\Windows\System\iDufxcb.exe
  2⤵
  PID:8828
- C:\Windows\System\fEDZBWy.exe
  C:\Windows\System\fEDZBWy.exe
  2⤵
  PID:9312
- C:\Windows\System\PkNnVJY.exe
  C:\Windows\System\PkNnVJY.exe
  2⤵
  PID:8988
- C:\Windows\System\aLFJBdj.exe
  C:\Windows\System\aLFJBdj.exe
  2⤵
  PID:8028
- C:\Windows\System\gWtQFfI.exe
  C:\Windows\System\gWtQFfI.exe
  2⤵
  PID:8780
- C:\Windows\System\DtZmIEo.exe
  C:\Windows\System\DtZmIEo.exe
  2⤵
  PID:8132
- C:\Windows\System\RUapfzv.exe
  C:\Windows\System\RUapfzv.exe
  2⤵
  PID:9220
- C:\Windows\System\FtTelNm.exe
  C:\Windows\System\FtTelNm.exe
  2⤵
  PID:9344
- C:\Windows\System\TYdntOd.exe
  C:\Windows\System\TYdntOd.exe
  2⤵
  PID:9412
- C:\Windows\System\CsbWtPO.exe
  C:\Windows\System\CsbWtPO.exe
  2⤵
  PID:8636
- C:\Windows\System\EyMISQY.exe
  C:\Windows\System\EyMISQY.exe
  2⤵
  PID:9620
- C:\Windows\System\SOLcPIg.exe
  C:\Windows\System\SOLcPIg.exe
  2⤵
  PID:9684
- C:\Windows\System\kdlUYYW.exe
  C:\Windows\System\kdlUYYW.exe
  2⤵
  PID:9700
- C:\Windows\System\ghfhqos.exe
  C:\Windows\System\ghfhqos.exe
  2⤵
  PID:9576
- C:\Windows\System\moNtCBK.exe
  C:\Windows\System\moNtCBK.exe
  2⤵
  PID:9668
- C:\Windows\System\TeKbmuM.exe
  C:\Windows\System\TeKbmuM.exe
  2⤵
  PID:9748
- C:\Windows\System\DgKZiiC.exe
  C:\Windows\System\DgKZiiC.exe
  2⤵
  PID:9784
- C:\Windows\System\WPrINBf.exe
  C:\Windows\System\WPrINBf.exe
  2⤵
  PID:9768
- C:\Windows\System\AYeCBty.exe
  C:\Windows\System\AYeCBty.exe
  2⤵
  PID:9880
- C:\Windows\System\JDRjhUf.exe
  C:\Windows\System\JDRjhUf.exe
  2⤵
  PID:9892
- C:\Windows\System\yMHXoEa.exe
  C:\Windows\System\yMHXoEa.exe
  2⤵
  PID:9924
- C:\Windows\System\tsuYmLx.exe
  C:\Windows\System\tsuYmLx.exe
  2⤵
  PID:9980
- C:\Windows\System\bGPmToA.exe
  C:\Windows\System\bGPmToA.exe
  2⤵
  PID:10012
- C:\Windows\System\oRLbaMD.exe
  C:\Windows\System\oRLbaMD.exe
  2⤵
  PID:10084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AkPoCyO.exe

Filesize
2.2MB

MD5
7c63ed1a136de1de890dcfdf9f596ebc

SHA1
3675fd1f00432a9a50f0b34db8d38ee154684da5

SHA256
c83f507c9486c48ac24e5d42f46a573fed29a729f2ec59349fa963111a254b57

SHA512
d4c8a4cf14f059696603ccbaf7253001126be1c03db1a25fb0903255688d8a54661d51ccc7dbce325d9a0ac1b06df23c015f7f6114ab9d46cfad147e272bb01f

Download Submit
C:\Windows\system\BzGHYoO.exe

Filesize
2.2MB

MD5
0de01f2f76b370788e889da480b51715

SHA1
c88052aad0c9343d8527c5925e047759b8668e4f

SHA256
44241f15587da2001bfb12fa0d0bc116b745cbc3b90badb365923fa288e29f1d

SHA512
38c12f996f6c943053f3d50ac0ee5bdffc9b1cc060e6341944b056d176036446df2ecab85e6302bb3aee5e973f0362981dc7c1f5b2b8cc41e7458af20e9bbc42

Download Submit
C:\Windows\system\DLuvhIN.exe

Filesize
2.2MB

MD5
9548e6a77e06a42f38f74065d0bc40dc

SHA1
21451965f7508c3d7af75fe94f27e1d7818c6a9f

SHA256
046dfa4c8f95a7815992ac76d7b8addaa8cb07b7174ff73960d5a3ab4df8951e

SHA512
75f84f48edf338beeb5ce797c07b1e99dbfc04beac46572e8b5eb77e6c7e66b572d73ed480078cd48e82794bcc57a8e7bb042b87a7d7f82fa4cdf1de6ce121c5

Download Submit
C:\Windows\system\HfPgLyc.exe

Filesize
2.2MB

MD5
d61b7e3ddfaa076d983285585167e97e

SHA1
ec3fd4e42e72e7920c221fda94aef5a8dd65f04a

SHA256
6005d1462a0bfbc4e0b25df4ff720cd0a48caefc88e3b8cff17a34995a2c85a3

SHA512
c663e518c09b543fcf3eebcab1ce1993a52108f96bc607628f11c16cf3a086d375d356b58c4ee777706ae57f03fed6dcfc32d8e8193a32e8d7f0c13317a0b66c

Download Submit
C:\Windows\system\IyOGmee.exe

Filesize
18B

MD5
0f74d26e324b3e4ca82621930feb3f71

SHA1
51c6fa90586c9009cc733bd2843df60120221d7c

SHA256
fd7091421895dbcf3ff7ed5b13b38b3963999338b6384ef6aea7e3d35f76533b

SHA512
4138922aed63819f2a910844c95c594cb337f1a54724135c8e61e94f0fb0e215db86c537da9be91f8c7625d109830aca6217c6d58a22b0f4be237d3c65bc9b67

Download Submit
C:\Windows\system\NCvFWfD.exe

Filesize
2.2MB

MD5
fe346118a442c5e079de67662331153d

SHA1
6b1719ed6c72672088de132b201ac3a0fef5818d

SHA256
5ef9602a4d3d51fa9a66dbc7b08a5e9783ceead31d97dc48247f39ac36cdc468

SHA512
2c2d7d5751226b88013869b29009c6a83143705a8d037a02e370f2481701e5c3f4b4f897b6d927cf20e5be664812736d2b31b0cf79c34e68e6285dc7dcf986f5

Download Submit
C:\Windows\system\QkQvEON.exe

Filesize
2.2MB

MD5
a224e2f70f05b09585a495c283ce3172

SHA1
063f6770a931b0f5f3690e27a43975efd65ccc69

SHA256
c3f08d417d0eb385d4f3778cc117f1ec6efd6c0b0c643b2d524745ed6bd389e7

SHA512
f6eeb81f5718fcdb1b5551b18324b914190a5daf5a8697c692181e5b4170cfcd7d7d068cbbfa1acd6f72faa0b5741b85d7adbdf146dacce51f5521503e405b57

Download Submit
C:\Windows\system\ZBFrGva.exe

Filesize
2.2MB

MD5
310cf486eb8a9b7e20042c05c2d20d53

SHA1
884e7c78b272c090ebcc5af7339bc931dde127c9

SHA256
32819b11d527175f499044812ee4ce4c3f485d2a09db2d59a9807f01222459df

SHA512
f7aaa948849c50c27b4deb2107098cdde86cdee22ee4cb4c3026c1482865d9e2b54bfecc20de4aa4bc6745a22cbe21c4d8ab2c7cff9b120e69f58ac740f7fb10

Download Submit
C:\Windows\system\dbPMhMa.exe

Filesize
2.2MB

MD5
6840203e4ef5c799f2ba287ec8138109

SHA1
35820622b8c8a2ad7c3eed93027608e4e526809a

SHA256
be8ce77041bc8e6d5819a7da64a42d165eb2cce1e1d80b62c81182a7a3bddfb2

SHA512
76070cb5ee6bff3ae9913452da2f272cb012f1ca1b5e9cf6164a8ec92c2e45b6e101d546da86fd3a9dc2b6bfd7ff780677e3a1e9e358987c6438f6d1d81db4ae

Download Submit
C:\Windows\system\hKFgaVo.exe

Filesize
2.2MB

MD5
ae4bc256369ecc45d23d7e16b94cda15

SHA1
4cd39b523f83f4385d9d057cee1f467220244da8

SHA256
ce4ef3749cede2c8ae777fc4459e5b8fb193ac815087f0ee2a96e8b38f819b75

SHA512
0e961fdcf9c4fed112de0322958220c1925578ae527fd07fca5d9fec64408f6502a16ef86aeb15a7d1360078e540ec2a5be56e5a33c2dbef68c7441a2b15efce

Download Submit
C:\Windows\system\hicmsNA.exe

Filesize
2.2MB

MD5
b02a09230156c5596ea37f5597f93b88

SHA1
a73703b0e76bcefe15644bf8f395701ae93aeec7

SHA256
434313179aadaa033e6b98f37ecf3b01a0ece9503f6ebd384d45d35e54692438

SHA512
b973a50650c51a20dde87dc2467f7a9c6a689b108921174d1e92852f8a6093ef2f68957f70200ddb155afd238bfea48229b1958938ce91bfd4b31637c6ef3eb2

Download Submit
C:\Windows\system\hjsyOjm.exe

Filesize
2.2MB

MD5
1112aeacaa7aa037ad51d8d259b6c1be

SHA1
baf51f7ca883d57c3161526b1744e7c342f3bd94

SHA256
2808fc273bb86282f0c2aedf260c8f1ed835ad36be064a5cc7a519e8e27856aa

SHA512
b32a8d860324304e92b168ec9658ac8944945a68c392bc82181590265ec60224ce4daec061197db6f083f74da009ee2f81dd7c2171bd1e99d94806b575fc8254

Download Submit
C:\Windows\system\hwLTvbJ.exe

Filesize
2.2MB

MD5
dd388d027db8eae9e7bd6d4462d6d8b0

SHA1
1a9fab99dbf291321e0b1c0e05e763eaf71dda6c

SHA256
3e8b698a707341baedde6d92d1b273ee826a9b7116cbe16279fadf869dbaadc9

SHA512
6e1ed837d725937e9dfbe2af8dc6863faae2b023ea6537283845bee5934737eba1f424b5776ed3a9ab98ccdb222bbc219e387708e4de2037f61c13fe71722704

Download Submit
C:\Windows\system\iLVcIRH.exe

Filesize
2.2MB

MD5
b8a5712bd7a7be357cdf8a86c6938d79

SHA1
7c7b55df4acb13efa239920f784d605cf6ea1789

SHA256
ead2905070283938d1b4e01d3ecca93fe6f349e81a7b8fd1294c9e0ad935d677

SHA512
6edf6639bea04c1e79e04af676db0baf687ad9fd893446ba501502c1f65affc473544a012cfaead914ddf2733d2fc81e407fc197efdcc5cbf1a579ca8e7cf785

Download Submit
C:\Windows\system\ipsloSW.exe

Filesize
2.2MB

MD5
27076b0fcb1a8e4b7e2c983ae32b9f21

SHA1
010ba3bf4ed1b8e71978679f31114e94d6dffd5f

SHA256
92bb4fcf878698d8619afed1e9b36d93d231fbab6e2f127ae345d85c113ccc49

SHA512
12cae23f48bc2bb2c1b8f533a1dfa4d83260e6d39cde7aaa93bb6f9cb00e19d93ddf55646e7d74fb39c76194bceb21113692c506c095022f527005d317e592af

Download Submit
C:\Windows\system\njpuXEE.exe

Filesize
2.2MB

MD5
63a024ffa893677f033667abf184d48b

SHA1
2a835f0299298a1bde3b4db1ac30241b74f5d693

SHA256
30f56fee52c7e9bda997d9c5e91aa67d12f6d9c906eb850385852af592db8ee4

SHA512
a434cf733de16c68940827058ac61d17b1cba1a1cb4a847fa927500de8a61255fdbdb6ba8766de54645167a692c8c6e5eac1715e59300618a2fadfccf1ad056d

Download Submit
C:\Windows\system\sGJSmGZ.exe

Filesize
2.2MB

MD5
4a03c4d04ca8fa990fff5940adb3ae7e

SHA1
ced662d67a2f38d1303a69a536dc12161fdf69f3

SHA256
ce71408cebf12760916f7fa50d44c4c5587ea0c838a00476e378a2d23887434d

SHA512
a6e78871d992e6f36f47ac8761fbd60e121a42f0f0448ca827bb510364b10618bf532061aeafb815ec0833fa81b8d415cbda3730f41c02ed0296b1211e7ee73d

Download Submit
C:\Windows\system\xfcPIPB.exe

Filesize
2.2MB

MD5
d04eb752b0953358b750d52e6f79f61e

SHA1
e5a1cf58ec4d96a11a81339c4f966b99a97f0a0b

SHA256
f72578073bfe7465cccda993f37640f101b6077bd71dc8fedcf91d8d52c14898

SHA512
9d0a48ac0ec7e6d7ba3dfed1a070b7b44f0ad99d008f31cf203c2257512b8a119cf89e0ce2af62c6963d6f0d0a49ad37cc017b3f816964540a3a939cf2165b07

Download Submit
C:\Windows\system\xyTjbcA.exe

Filesize
2.2MB

MD5
29290ecb5079d207b7bc4a8530fbb0e7

SHA1
ea9db1349134df8653f1b0c7ec09af1a15053363

SHA256
9caa415b6e311def3211d96cbad31c647d19521c88145dea69a8516135f3ca01

SHA512
bb03cc3e06858936b2fc122cd066b7cebcfef6c70071be8c7de694f7ba3ab991d5bc287bb0906c3f8769309a739b77f6ea45a755a928aa3f298f3c45386022cc

Download Submit
C:\Windows\system\yGQFelF.exe

Filesize
2.2MB

MD5
cd81ea496e22bccda581edb41601338d

SHA1
918ecd9b4b389277701ae087473db58c9f7137f0

SHA256
1a77daf7338f9a262aec7784d6e2f80c0a2096ee5c16ebaa366dec732dc34654

SHA512
1588451b7d9639990d27aaca64bcad79bf1d503520d4e98f43f917ba6a1e094cb388ab8a8491ffd9614db8f2f61c7ab4cf57707f9cdd3c567561cff45e18a0c9

Download Submit
C:\Windows\system\zWFMAOD.exe

Filesize
2.2MB

MD5
03643501b424a09f5bb3538fd93d8234

SHA1
dea6bb60bfc15953532ef05d25cacdac97d25f69

SHA256
50fdd6d0e5b5a1469f3c7f45923d2e76ce4c09deb3ee8d300db6ba37ece0b94c

SHA512
fa3f1b7139d9d33fdfac5a9667820f9b341a090a5c4e368f71960e6a6becc318028b537d197fe91adc1af889ec65d3f2a1ab48773fd9db79d113b444759b0267

Download Submit
\Windows\system\GvfLczd.exe

Filesize
2.2MB

MD5
384768554ddb39960e843d1a77829082

SHA1
9f151de331674f826c877a725e22803d18a4df9b

SHA256
0dc0a5c6634bc16415640cea2a3a2644f54d4d6364c67f6a47729fcf1382f3a6

SHA512
6dfacee6aedf8808cb2054a11c3e6c38107551e8fb929186bfd0157a63a3b3c90843c757e4c7a70d4d56b9164e75f868fff1b383e7e251b08d6c8984b031e717

Download Submit
\Windows\system\JKilhkO.exe

Filesize
2.2MB

MD5
3d5a1a0a4f527444f44569279a6de609

SHA1
cafbfcb44ffb0c13a391008cd9e1511cb4d41970

SHA256
2d5763f1e38e9fe0d9cf29844986cd25c1851fd26bc4a772b4883a2cdb0bd598

SHA512
bbed88b6828112fe2a3acec1e262154e84eea8efed5604fd497d1f7c402b3bffef3a9badf555032922b61b68a13d67ef41a6fb5bec6f12c21783816ba9e594b3

Download Submit
\Windows\system\JqbWuvV.exe

Filesize
2.2MB

MD5
bd4c0e323e3e174b66520cab83e4ea6f

SHA1
fedb0c7ec5290b5053286721e6c0ca5b2e738f0c

SHA256
69c9298f19e85457facdd6fa1876b787feee0d27d532f717700d251d4c6ce2a8

SHA512
a72528ee586804a4752eb1b1b6478bb6898a351c1d90791e5a76456ac53a203b27055352654c3a75caff230e95766f8aceb044839075810ab736880fd4b91ea5

Download Submit
\Windows\system\KUdhhQl.exe

Filesize
2.2MB

MD5
29a75bf40167901882dd27c62a8d0bf1

SHA1
e7ecc37930eeebe2e30b48557dac168cc23ddd42

SHA256
8a9632875156709944b2d406a4dba5df55c872278314b95793ca16d7aaf4dd10

SHA512
63395186950e6d4a435741bfeed27425d8df87ce0f06d687652ffd37c77f20eb3c20435ef0880c511ce1378cca81df5990c961a17e77c2874c1f558b4bb8673b

Download Submit
\Windows\system\RtnZwZE.exe

Filesize
2.2MB

MD5
6e0239a9e96756594d8796b85c6788ca

SHA1
450e1c8bc6674b6a968036588896c8addc7d0e0d

SHA256
a03bf7de5a999e6964dfef48248a61aa58f70aa3ac901f880d81fda9d6c7e830

SHA512
2e7bc5beba2dcf3072dc490fbec439c82e6b7d8896cb5828a3fe48eae0feef687738864e412977f9feea8663fb08a33023e6ba515db19ab31eafdf2a47e1e66f

Download Submit
\Windows\system\TdmLhDQ.exe

Filesize
2.2MB

MD5
73b5b3eb60b760a41361124e8af57185

SHA1
7da59e928385b5a1028eaa102d95679f1462a7f4

SHA256
df1df564c15d088a974a9ef9392c0342c60776560a7cd3c6d6ca4867e14899b6

SHA512
3349d3cb627dd2c68f0bf13137f5d497a2c5607663ce80bcbd9b12f4f9099d1ccdf8c4b1dfa032bce73159277ad0f004271b5aede60cb25e904bc6d89e456fab

Download Submit
\Windows\system\ThRNUPo.exe

Filesize
2.2MB

MD5
5c09207bfa3585143912266b90589978

SHA1
d06d39062db5f52bf938ff393052b110af9a9446

SHA256
8e82cdbe848632e31b830f023a42fff90695e54c42c5cef9be291c876dbd537a

SHA512
95bf9ea984aeb33110717e3a303e96e27c0490f22450983ee33656478f1a439e96b595b0921885f8f0bd3e03db4eba8eed9b31743ce4ea1b8bb8f14c7eaeb145

Download Submit
\Windows\system\UlnqZss.exe

Filesize
2.2MB

MD5
710c0183232d86e47bd011b92060cf15

SHA1
cf8dc6139462403bcde0a85a1fd569a35227d1b4

SHA256
9c841a99e9dc84498c65fad2638d54b3d37311d1b93ac497d92893ccb53f296c

SHA512
5471641b51b517ca2315506023dc03e9e31906cc9803df179129306ae1263d1d8c6de401a92caad97c7876de7b324809d4b7c9cb8ec88d549f8fe561bf3558c4

Download Submit
\Windows\system\ZRKcdsK.exe

Filesize
2.2MB

MD5
5f17f07963cfc13daa8db58c1ff7f712

SHA1
f51e948e75ddd17b29f1b61ff8c1b3fbfbab21ad

SHA256
51089a07dd67c4e4258ffbff63f5263fd51a629a19db741322afb79830c4c36b

SHA512
100d3bb4bf65c47536d0203d565cb0c898b382bd7c6e4dbb302c55a8818a23270994aaf31835ac5c7cf95982cdec8ba7d9e37277d8d118ac24c1674bc6e21d2a

Download Submit
\Windows\system\eMkQZCv.exe

Filesize
2.2MB

MD5
728a23040b3527e04b3095b763da290d

SHA1
f88651e721fe22b5c3c8fcd7264dc0fbdeb4a515

SHA256
de255d50c0e082b1b9e666bc7847082d801ee92d5d541ed10550dacd2fdc6500

SHA512
ac0ccfad23054be9353eab09083624364a9354fe52583118b471a7a7e069abaf0905b9f1145f1779b0136ccebbb858fc7d8ebed252135ed294723c69f7e393c3

Download Submit
\Windows\system\fRPQmad.exe

Filesize
2.2MB

MD5
3641a1add61671aeb7c81a1885e48cf6

SHA1
0c6fe5920930767e9bef6dc7b40b30ee02622fe2

SHA256
80a5870dd0a4ac4daf1dd4034830c5ec72f16086bfda022d75c57f95a4e8e533

SHA512
9cdc69bf53ae06183003cba23a9a76640292e1dcc1417f3ff164937d7a52d8c464b189eb0c411ee45c1aa448ad18939043c789591404840c1e730a8ef03ae52e

Download Submit
\Windows\system\fkhZbsn.exe

Filesize
2.2MB

MD5
b92901281c9762ba5c2179d452502d4d

SHA1
66cb13436a5bc54b05eb5e075ffecf4bce19f050

SHA256
adae749c39de93bb0c42b3dbe817f19dea4503d7ff5ad495c357734f270438cf

SHA512
222c81b4d13759fe4197f9a38d8a10dbe1af0d9f721510e2d69334b5cabb5287999a1d479c5966411ccdfdb67df1b6ab9e419c5dcfc51c6cd42f24ba937316de

Download Submit
\Windows\system\ikcxLqf.exe

Filesize
2.2MB

MD5
955462a17d266e5cb35f8d7092f0c552

SHA1
8fd14317d72639dba301922720f28f6fe447c20c

SHA256
e895f117a757ac106bf055b5dc35701e677cab4f5963172ea855a511235fb674

SHA512
d402429a629b6f541de0e40c033f1c339054686d62707475bbc837b1115f904b5869407347cef63134a40e200cf0693b733aef9a3eb11da1594f23118f6d3320

Download Submit
\Windows\system\jOgHNSB.exe

Filesize
2.2MB

MD5
72de217d624e4803309d0b89b6651d5c

SHA1
b69b63e79dcc93e112c1f4b3afeb6158019a5cdc

SHA256
958118542cb952dcca6f361b19807f9f6bd7e939fff62ba2503f5d7df75a7be3

SHA512
ea715308148c9dea74e5f32d7651ff6f6a35d0efe85cc17128a35cd5c0e4bf37e2de01dd34ce6ce42934221ab594d98147fb0124b41e683974a2bdfec7b02109

Download Submit
\Windows\system\oWPJETF.exe

Filesize
2.2MB

MD5
ca0b4c0dc6709da6817171d1b4b07415

SHA1
3e9dea0d4ec0e1064093c3745f688d99da4884b6

SHA256
ca1acadc7b36e775a66e7768d599df9b1da03eed85b9bb6b7a4390f2377f7055

SHA512
7a38fb467c2d56b61650abc5cc696728844bc7d3d28857b2b191fde6beaf9317b8f51cb6416bc2c45af5b7dee19bb6854a40e707d93f4f6dc564537983bfcbb9

Download Submit
\Windows\system\rkOImai.exe

Filesize
2.2MB

MD5
4d15114e5bba09a462463e3cec27f510

SHA1
21170a63977f9cd62c1671322a7e57791cc6fa2c

SHA256
6a0eb0e7b5ccb939214b2d1e3ef5a1a7951bd8b746612bde56accd23d68a420e

SHA512
e20af9e26f643a1eaa760bbfbde50d95a1ddbcae1b7dcde7a926864e5444cc55e66f0b9f0f8a8ade21ae9fda15bda74a07da5b93c2ebd80fd65d0e1a79952376

Download Submit
\Windows\system\sGKwhZq.exe

Filesize
2.2MB

MD5
3e7a06641fb1082c1b1d57450b957fcd

SHA1
58f6b3aca088e9b265ecb50e02d8caad42246811

SHA256
784e24dc15038d7c1aab721b22cb11454711fab34e010077efe3b5cd0630b3de

SHA512
b1680e729f0ef86825b8028ef3201f4e376d62c0b06c7f9b4ebb352d675bfcb11d9db93fa84f4121da1ffe9cff3e74f959a565efaea46cfc52c73a556f98f019

Download Submit
\Windows\system\uOCCKzZ.exe

Filesize
2.2MB

MD5
83595d9e8b5aba04bf11b880b1502c7a

SHA1
244c5718ad741865bfe360ff52927366ab9505a0

SHA256
be6baf232faedaad9b1ab46a6834c1789d52d2ebcd70e72e2ca2722e274e0daa

SHA512
b39a4639749fa70e59253f9dd51eebbcc391a4ce7cd900dc61b25c7d9cbff1ba50d66cc4625564f7c23de6e80aa355780943266a77271862afd3408b8577cca0

Download Submit
\Windows\system\xlVTcwr.exe

Filesize
2.2MB

MD5
25b2bfd307ed0b3fcd59e4e62732d755

SHA1
2706e1f9b6aecadd77d859d6b980f5fb686df61d

SHA256
ba55c1a6e066a5b23b5ab52a415e5b3bbb86e3b39ec7662a2c69bba6f341463c

SHA512
393a33fce0d3caa90cae4642252235f2aaa8b184871fd5a6beb3ef2001fb117c53b4f3c66fd4bf3fdf1e7a0de0fcf37d6b646b53fe7acc59954b888350af2cac

Download Submit
memory/1616-75-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/1812-52-0x0000000003550000-0x0000000003942000-memory.dmp

Filesize
3.9MB

Download
memory/1812-136-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/1812-7-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/1812-73-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/1812-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/1812-42-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/1812-44-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/1812-46-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/1812-48-0x0000000003550000-0x0000000003942000-memory.dmp

Filesize
3.9MB

Download
memory/1812-0-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/1812-61-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/1812-85-0x0000000003550000-0x0000000003942000-memory.dmp

Filesize
3.9MB

Download
memory/2148-43-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-18-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-54-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2536-40-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2544-45-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2732-62-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-97-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2872-17-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/3052-33-0x0000000002070000-0x0000000002078000-memory.dmp

Filesize
32KB

Download
memory/3052-22-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/3052-41-0x0000000002CC0000-0x0000000002D40000-memory.dmp

Filesize
512KB

Download
memory/3052-39-0x0000000002CC0000-0x0000000002D40000-memory.dmp

Filesize
512KB

Download
memory/3052-19-0x0000000002CC0000-0x0000000002D40000-memory.dmp

Filesize
512KB

Download
memory/3052-226-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/3052-38-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/3052-47-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download