xmrig | bc85d990ca32a682850cd61546557909e9526d9c9540a8d111c4bc26052e7dc6

Analysis

max time kernel
30s
max time network
32s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
Size

1.8MB
MD5

03c1245a42360ca436deb670aeac912e
SHA1

e88767d9b18b17a1cadf18408b223142bdf989dc
SHA256

bc85d990ca32a682850cd61546557909e9526d9c9540a8d111c4bc26052e7dc6
SHA512

55517ef2a1ec0f555b7476325181c66a5c3bcdde7a33e38733141e618e099ab2e3916265fae1075db65c8b9f2fc16e277b38edccaffaae55788766f33c71bd70
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl5S9:NABx

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2140-101-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/1740-113-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2556-114-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/1712-111-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2736-102-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig
behavioral1/memory/804-100-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2040-71-0x000000013F020000-0x000000013F412000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2040	fmwEjJa.exe
804	TtzeoOc.exe
2140	UqSUUnd.exe
2736	kGkkzKp.exe
1712	zRyaZbL.exe
1740	AavJOfm.exe
2556	RhMHWCk.exe
2656	wjqeCgM.exe
2524	lXvxXSS.exe
1148	QyVhuCw.exe
2948	JKMALFV.exe
1636	ZFJbkIl.exe
2872	sAlhKTR.exe
3060	KyzNoAL.exe
2820	hRQHooB.exe
2860	cDoOQgf.exe
2568	KQiQUlu.exe
2552	kjHKYjM.exe
1896	cYdwNFf.exe
3040	PcAdVxM.exe
2832	EmYojWU.exe
2912	NicZWmp.exe
1452	uuwxFUt.exe
1320	updlsJl.exe
2012	qPfQDqR.exe
2240	OMUzobL.exe
332	XZIiRcX.exe
688	LszrgKf.exe
1640	DLRvhTD.exe
976	IhACAco.exe
832	XTbpfHs.exe
868	veoCuvb.exe
1392	rnHxCCI.exe
2276	DOOUghL.exe
1352	JLsqUdo.exe
948	TUaaVrb.exe
1536	WwRoxkU.exe
2152	TFFkbfP.exe
800	xnXikqu.exe
2236	nEhfdVy.exe
900	ldZkezQ.exe
2400	qorQhyp.exe
2076	DSfCHui.exe
1296	JepldhO.exe
2456	FIHmVop.exe
2408	WwMUFXO.exe
2376	kBSAbZU.exe
236	QDdpwjO.exe
880	pjeEEVU.exe
1952	TwqCqBe.exe
2984	AzfPoid.exe
2604	RodWhKP.exe
1604	zzoXePU.exe
2112	sutEzei.exe
2676	vhRfmFb.exe
2624	SSlcjSy.exe
2932	PTFgzpP.exe
2536	wUtMqNs.exe
1624	nbupmnc.exe
2904	oyfiGNx.exe
1524	RhdvJFP.exe
1512	lEQoXHN.exe
1936	aqzaSzK.exe
2204	qskxOtd.exe

Loads dropped DLL 64 IoCs

pid	Process
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe

UPX packed file 40 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2364-20-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/files/0x0006000000014a29-61.dat	upx
behavioral1/memory/2140-101-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/1740-113-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/files/0x00060000000148af-133.dat	upx
behavioral1/files/0x00060000000155e8-149.dat	upx
behavioral1/files/0x003900000001344f-184.dat	upx
behavioral1/files/0x0006000000015c91-175.dat	upx
behavioral1/files/0x0006000000015c9b-180.dat	upx
behavioral1/files/0x0006000000015b72-164.dat	upx
behavioral1/files/0x0006000000015bb5-169.dat	upx
behavioral1/files/0x0006000000015a15-154.dat	upx
behavioral1/files/0x000600000001543a-144.dat	upx
behavioral1/files/0x0006000000015b37-158.dat	upx
behavioral1/files/0x000600000001474b-126.dat	upx
behavioral1/files/0x00060000000146a7-123.dat	upx
behavioral1/files/0x00060000000145c9-122.dat	upx
behavioral1/files/0x000700000001451d-121.dat	upx
behavioral1/files/0x00060000000150aa-115.dat	upx
behavioral1/files/0x0006000000014fac-78.dat	upx
behavioral1/files/0x0006000000014c0b-72.dat	upx
behavioral1/files/0x000600000001523e-129.dat	upx
behavioral1/files/0x0008000000013a85-25.dat	upx
behavioral1/memory/2556-114-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/1712-111-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/2736-102-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/memory/804-100-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/files/0x0006000000015077-93.dat	upx
behavioral1/files/0x0006000000014d0f-92.dat	upx
behavioral1/files/0x0009000000013b02-84.dat	upx
behavioral1/memory/2040-71-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/files/0x000600000001475f-70.dat	upx
behavioral1/files/0x0006000000014730-69.dat	upx
behavioral1/files/0x00060000000145d4-68.dat	upx
behavioral1/files/0x0006000000014525-65.dat	upx
behavioral1/files/0x0007000000013f4b-63.dat	upx
behavioral1/files/0x0008000000013a15-24.dat	upx
behavioral1/files/0x000b000000012301-23.dat	upx
behavioral1/files/0x0008000000013a65-57.dat	upx
behavioral1/files/0x003900000001340e-8.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sjimKjp.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\ZJkPrIQ.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\PkcSgVu.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\OjTsOVq.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\IpnfeEF.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\dbrxYtI.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\rocHrFT.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\SnWZqYE.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\jQPdvSe.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\eTtEabD.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\bvupEqp.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\NnIBgnk.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\JjDCSDK.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\EqFJloJ.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\qsFORSf.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\CgbVymv.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\jMOcSUc.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\AMqoOUf.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\rWBSwKO.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\xLjmIQX.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\EZyrVeR.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\jlzpEnj.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\YDSgbIc.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\zGfJrch.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\JPmLAXW.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\wPOJVvq.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\VOcWtOA.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\yGMFTqZ.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\OrnNSek.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\maTmocg.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\eoAhqsB.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\DRCBKIB.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\uuwxFUt.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\DXfHNpN.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\RIwdCsk.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\LiwdIQZ.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\ISrpIcs.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\ZFnKZIx.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\PcAdVxM.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\JXrrcGi.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\gNrscmo.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\WRtcaku.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\pBkQQqM.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\YXtcLoZ.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\yPkUvff.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\ZHxdtvA.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\bmHLxJv.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\FysaEqY.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\kMpHmOb.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\JLsqUdo.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\eNPhjjf.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\JcOlRzO.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\cTQiKFT.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\SSlcjSy.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\MLEABMw.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\jDBZaAD.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\RIegmHO.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\zuJZoBp.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\kgfeGvt.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\AavJOfm.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\iuXmwMG.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\pJBJuuX.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\lEQoXHN.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\qdkKrhJ.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2352	powershell.exe
2352	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
Token: SeDebugPrivilege	2352	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2352	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	29
PID 2364 wrote to memory of 2352	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	29
PID 2364 wrote to memory of 2352	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	29
PID 2364 wrote to memory of 804	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	30
PID 2364 wrote to memory of 804	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	30
PID 2364 wrote to memory of 804	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2040	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	31
PID 2364 wrote to memory of 2040	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	31
PID 2364 wrote to memory of 2040	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	31
PID 2364 wrote to memory of 2140	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	32
PID 2364 wrote to memory of 2140	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	32
PID 2364 wrote to memory of 2140	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	32
PID 2364 wrote to memory of 1712	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	33
PID 2364 wrote to memory of 1712	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	33
PID 2364 wrote to memory of 1712	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	33
PID 2364 wrote to memory of 2736	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	34
PID 2364 wrote to memory of 2736	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	34
PID 2364 wrote to memory of 2736	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	34
PID 2364 wrote to memory of 2948	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	35
PID 2364 wrote to memory of 2948	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	35
PID 2364 wrote to memory of 2948	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	35
PID 2364 wrote to memory of 1740	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	36
PID 2364 wrote to memory of 1740	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	36
PID 2364 wrote to memory of 1740	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	36
PID 2364 wrote to memory of 2820	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	37
PID 2364 wrote to memory of 2820	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	37
PID 2364 wrote to memory of 2820	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	37
PID 2364 wrote to memory of 2556	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	38
PID 2364 wrote to memory of 2556	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	38
PID 2364 wrote to memory of 2556	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	38
PID 2364 wrote to memory of 2860	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	39
PID 2364 wrote to memory of 2860	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	39
PID 2364 wrote to memory of 2860	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	39
PID 2364 wrote to memory of 2656	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	40
PID 2364 wrote to memory of 2656	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	40
PID 2364 wrote to memory of 2656	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	40
PID 2364 wrote to memory of 2568	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	41
PID 2364 wrote to memory of 2568	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	41
PID 2364 wrote to memory of 2568	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	41
PID 2364 wrote to memory of 2524	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	42
PID 2364 wrote to memory of 2524	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	42
PID 2364 wrote to memory of 2524	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	42
PID 2364 wrote to memory of 2552	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	43
PID 2364 wrote to memory of 2552	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	43
PID 2364 wrote to memory of 2552	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	43
PID 2364 wrote to memory of 1148	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	44
PID 2364 wrote to memory of 1148	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	44
PID 2364 wrote to memory of 1148	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	44
PID 2364 wrote to memory of 3040	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	45
PID 2364 wrote to memory of 3040	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	45
PID 2364 wrote to memory of 3040	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	45
PID 2364 wrote to memory of 1636	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	46
PID 2364 wrote to memory of 1636	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	46
PID 2364 wrote to memory of 1636	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	46
PID 2364 wrote to memory of 2832	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	47
PID 2364 wrote to memory of 2832	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	47
PID 2364 wrote to memory of 2832	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	47
PID 2364 wrote to memory of 2872	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	48
PID 2364 wrote to memory of 2872	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	48
PID 2364 wrote to memory of 2872	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	48
PID 2364 wrote to memory of 2912	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	49
PID 2364 wrote to memory of 2912	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	49
PID 2364 wrote to memory of 2912	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	49
PID 2364 wrote to memory of 3060	2364	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\System\TtzeoOc.exe
  C:\Windows\System\TtzeoOc.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\fmwEjJa.exe
  C:\Windows\System\fmwEjJa.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\UqSUUnd.exe
  C:\Windows\System\UqSUUnd.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\zRyaZbL.exe
  C:\Windows\System\zRyaZbL.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\kGkkzKp.exe
  C:\Windows\System\kGkkzKp.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\JKMALFV.exe
  C:\Windows\System\JKMALFV.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\AavJOfm.exe
  C:\Windows\System\AavJOfm.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\hRQHooB.exe
  C:\Windows\System\hRQHooB.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\RhMHWCk.exe
  C:\Windows\System\RhMHWCk.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\cDoOQgf.exe
  C:\Windows\System\cDoOQgf.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\wjqeCgM.exe
  C:\Windows\System\wjqeCgM.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\KQiQUlu.exe
  C:\Windows\System\KQiQUlu.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\lXvxXSS.exe
  C:\Windows\System\lXvxXSS.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\kjHKYjM.exe
  C:\Windows\System\kjHKYjM.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\QyVhuCw.exe
  C:\Windows\System\QyVhuCw.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\PcAdVxM.exe
  C:\Windows\System\PcAdVxM.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\ZFJbkIl.exe
  C:\Windows\System\ZFJbkIl.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\EmYojWU.exe
  C:\Windows\System\EmYojWU.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\sAlhKTR.exe
  C:\Windows\System\sAlhKTR.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\NicZWmp.exe
  C:\Windows\System\NicZWmp.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\KyzNoAL.exe
  C:\Windows\System\KyzNoAL.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\uuwxFUt.exe
  C:\Windows\System\uuwxFUt.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\cYdwNFf.exe
  C:\Windows\System\cYdwNFf.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\updlsJl.exe
  C:\Windows\System\updlsJl.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\qPfQDqR.exe
  C:\Windows\System\qPfQDqR.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\OMUzobL.exe
  C:\Windows\System\OMUzobL.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\XZIiRcX.exe
  C:\Windows\System\XZIiRcX.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\LszrgKf.exe
  C:\Windows\System\LszrgKf.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\DLRvhTD.exe
  C:\Windows\System\DLRvhTD.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\IhACAco.exe
  C:\Windows\System\IhACAco.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\XTbpfHs.exe
  C:\Windows\System\XTbpfHs.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\veoCuvb.exe
  C:\Windows\System\veoCuvb.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\rnHxCCI.exe
  C:\Windows\System\rnHxCCI.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\DOOUghL.exe
  C:\Windows\System\DOOUghL.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\JLsqUdo.exe
  C:\Windows\System\JLsqUdo.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\WwRoxkU.exe
  C:\Windows\System\WwRoxkU.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\TUaaVrb.exe
  C:\Windows\System\TUaaVrb.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\xnXikqu.exe
  C:\Windows\System\xnXikqu.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\TFFkbfP.exe
  C:\Windows\System\TFFkbfP.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\nEhfdVy.exe
  C:\Windows\System\nEhfdVy.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\ldZkezQ.exe
  C:\Windows\System\ldZkezQ.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\qorQhyp.exe
  C:\Windows\System\qorQhyp.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\DSfCHui.exe
  C:\Windows\System\DSfCHui.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\JepldhO.exe
  C:\Windows\System\JepldhO.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\FIHmVop.exe
  C:\Windows\System\FIHmVop.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\WwMUFXO.exe
  C:\Windows\System\WwMUFXO.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\kBSAbZU.exe
  C:\Windows\System\kBSAbZU.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\QDdpwjO.exe
  C:\Windows\System\QDdpwjO.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\pjeEEVU.exe
  C:\Windows\System\pjeEEVU.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\TwqCqBe.exe
  C:\Windows\System\TwqCqBe.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\AzfPoid.exe
  C:\Windows\System\AzfPoid.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\RodWhKP.exe
  C:\Windows\System\RodWhKP.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\zzoXePU.exe
  C:\Windows\System\zzoXePU.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\sutEzei.exe
  C:\Windows\System\sutEzei.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\vhRfmFb.exe
  C:\Windows\System\vhRfmFb.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\SSlcjSy.exe
  C:\Windows\System\SSlcjSy.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\PTFgzpP.exe
  C:\Windows\System\PTFgzpP.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\wUtMqNs.exe
  C:\Windows\System\wUtMqNs.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\nbupmnc.exe
  C:\Windows\System\nbupmnc.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\oyfiGNx.exe
  C:\Windows\System\oyfiGNx.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\RhdvJFP.exe
  C:\Windows\System\RhdvJFP.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\lEQoXHN.exe
  C:\Windows\System\lEQoXHN.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\aqzaSzK.exe
  C:\Windows\System\aqzaSzK.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\qskxOtd.exe
  C:\Windows\System\qskxOtd.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\eNfRyyf.exe
  C:\Windows\System\eNfRyyf.exe
  2⤵
  PID:2640
- C:\Windows\System\qXNaBxO.exe
  C:\Windows\System\qXNaBxO.exe
  2⤵
  PID:2908
- C:\Windows\System\kglhLUs.exe
  C:\Windows\System\kglhLUs.exe
  2⤵
  PID:2128
- C:\Windows\System\kGRkWWh.exe
  C:\Windows\System\kGRkWWh.exe
  2⤵
  PID:2608
- C:\Windows\System\DkzUWER.exe
  C:\Windows\System\DkzUWER.exe
  2⤵
  PID:3012
- C:\Windows\System\uEwxuTz.exe
  C:\Windows\System\uEwxuTz.exe
  2⤵
  PID:2616
- C:\Windows\System\oYymlWa.exe
  C:\Windows\System\oYymlWa.exe
  2⤵
  PID:3004
- C:\Windows\System\cGnfdwj.exe
  C:\Windows\System\cGnfdwj.exe
  2⤵
  PID:1268
- C:\Windows\System\ACMMYdV.exe
  C:\Windows\System\ACMMYdV.exe
  2⤵
  PID:444
- C:\Windows\System\WfHNHWy.exe
  C:\Windows\System\WfHNHWy.exe
  2⤵
  PID:2064
- C:\Windows\System\vpmHboh.exe
  C:\Windows\System\vpmHboh.exe
  2⤵
  PID:1596
- C:\Windows\System\LTwubNp.exe
  C:\Windows\System\LTwubNp.exe
  2⤵
  PID:1616
- C:\Windows\System\CBqJHPX.exe
  C:\Windows\System\CBqJHPX.exe
  2⤵
  PID:1028
- C:\Windows\System\ouTXJfY.exe
  C:\Windows\System\ouTXJfY.exe
  2⤵
  PID:1780
- C:\Windows\System\KCqyPOV.exe
  C:\Windows\System\KCqyPOV.exe
  2⤵
  PID:2396
- C:\Windows\System\XzenNOq.exe
  C:\Windows\System\XzenNOq.exe
  2⤵
  PID:1756
- C:\Windows\System\tKOswpI.exe
  C:\Windows\System\tKOswpI.exe
  2⤵
  PID:2444
- C:\Windows\System\ZsmIaMr.exe
  C:\Windows\System\ZsmIaMr.exe
  2⤵
  PID:1228
- C:\Windows\System\wxjfwLd.exe
  C:\Windows\System\wxjfwLd.exe
  2⤵
  PID:1796
- C:\Windows\System\lFCbfVB.exe
  C:\Windows\System\lFCbfVB.exe
  2⤵
  PID:2464
- C:\Windows\System\qsSbuQl.exe
  C:\Windows\System\qsSbuQl.exe
  2⤵
  PID:2008
- C:\Windows\System\jpWruHQ.exe
  C:\Windows\System\jpWruHQ.exe
  2⤵
  PID:1576
- C:\Windows\System\pvjosuZ.exe
  C:\Windows\System\pvjosuZ.exe
  2⤵
  PID:1708
- C:\Windows\System\TrwpRyt.exe
  C:\Windows\System\TrwpRyt.exe
  2⤵
  PID:2144
- C:\Windows\System\KyjcUjj.exe
  C:\Windows\System\KyjcUjj.exe
  2⤵
  PID:660
- C:\Windows\System\PDxeeDm.exe
  C:\Windows\System\PDxeeDm.exe
  2⤵
  PID:2844
- C:\Windows\System\titaIXE.exe
  C:\Windows\System\titaIXE.exe
  2⤵
  PID:2664
- C:\Windows\System\ZdVIqwc.exe
  C:\Windows\System\ZdVIqwc.exe
  2⤵
  PID:2124
- C:\Windows\System\CCCNlyk.exe
  C:\Windows\System\CCCNlyk.exe
  2⤵
  PID:1872
- C:\Windows\System\MVkinaY.exe
  C:\Windows\System\MVkinaY.exe
  2⤵
  PID:3052
- C:\Windows\System\QhHMCgI.exe
  C:\Windows\System\QhHMCgI.exe
  2⤵
  PID:1284
- C:\Windows\System\gZyxGgg.exe
  C:\Windows\System\gZyxGgg.exe
  2⤵
  PID:1032
- C:\Windows\System\oPBWbtF.exe
  C:\Windows\System\oPBWbtF.exe
  2⤵
  PID:1940
- C:\Windows\System\tLrxCmK.exe
  C:\Windows\System\tLrxCmK.exe
  2⤵
  PID:1792
- C:\Windows\System\wlKCXXW.exe
  C:\Windows\System\wlKCXXW.exe
  2⤵
  PID:3076
- C:\Windows\System\WHlscsQ.exe
  C:\Windows\System\WHlscsQ.exe
  2⤵
  PID:3096
- C:\Windows\System\LkqXdhp.exe
  C:\Windows\System\LkqXdhp.exe
  2⤵
  PID:3124
- C:\Windows\System\nxewtYY.exe
  C:\Windows\System\nxewtYY.exe
  2⤵
  PID:3140
- C:\Windows\System\HgwtogE.exe
  C:\Windows\System\HgwtogE.exe
  2⤵
  PID:3160
- C:\Windows\System\xVXXmlY.exe
  C:\Windows\System\xVXXmlY.exe
  2⤵
  PID:3176
- C:\Windows\System\IslBwEq.exe
  C:\Windows\System\IslBwEq.exe
  2⤵
  PID:3196
- C:\Windows\System\EmLdfrR.exe
  C:\Windows\System\EmLdfrR.exe
  2⤵
  PID:3212
- C:\Windows\System\fvEsNFh.exe
  C:\Windows\System\fvEsNFh.exe
  2⤵
  PID:3228
- C:\Windows\System\mOIepIq.exe
  C:\Windows\System\mOIepIq.exe
  2⤵
  PID:3248
- C:\Windows\System\QeuMECL.exe
  C:\Windows\System\QeuMECL.exe
  2⤵
  PID:3284
- C:\Windows\System\pkoRuFO.exe
  C:\Windows\System\pkoRuFO.exe
  2⤵
  PID:3300
- C:\Windows\System\Ilmnqhj.exe
  C:\Windows\System\Ilmnqhj.exe
  2⤵
  PID:3324
- C:\Windows\System\UkUMWHi.exe
  C:\Windows\System\UkUMWHi.exe
  2⤵
  PID:3340
- C:\Windows\System\BfOPcKu.exe
  C:\Windows\System\BfOPcKu.exe
  2⤵
  PID:3360
- C:\Windows\System\maTmocg.exe
  C:\Windows\System\maTmocg.exe
  2⤵
  PID:3376
- C:\Windows\System\DowAWQc.exe
  C:\Windows\System\DowAWQc.exe
  2⤵
  PID:3404
- C:\Windows\System\urCaYxS.exe
  C:\Windows\System\urCaYxS.exe
  2⤵
  PID:3420
- C:\Windows\System\ITwieKY.exe
  C:\Windows\System\ITwieKY.exe
  2⤵
  PID:3440
- C:\Windows\System\WZeEPeg.exe
  C:\Windows\System\WZeEPeg.exe
  2⤵
  PID:3456
- C:\Windows\System\sKPTFkG.exe
  C:\Windows\System\sKPTFkG.exe
  2⤵
  PID:3476
- C:\Windows\System\qAzqUwv.exe
  C:\Windows\System\qAzqUwv.exe
  2⤵
  PID:3492
- C:\Windows\System\yntgkUO.exe
  C:\Windows\System\yntgkUO.exe
  2⤵
  PID:3508
- C:\Windows\System\WcLENsF.exe
  C:\Windows\System\WcLENsF.exe
  2⤵
  PID:3528
- C:\Windows\System\eqxaGsg.exe
  C:\Windows\System\eqxaGsg.exe
  2⤵
  PID:3564
- C:\Windows\System\FgljFpf.exe
  C:\Windows\System\FgljFpf.exe
  2⤵
  PID:3580
- C:\Windows\System\iEMXwhk.exe
  C:\Windows\System\iEMXwhk.exe
  2⤵
  PID:3596
- C:\Windows\System\lFzMIkb.exe
  C:\Windows\System\lFzMIkb.exe
  2⤵
  PID:3616
- C:\Windows\System\VvEnwdq.exe
  C:\Windows\System\VvEnwdq.exe
  2⤵
  PID:3636
- C:\Windows\System\rxjyAKP.exe
  C:\Windows\System\rxjyAKP.exe
  2⤵
  PID:3652
- C:\Windows\System\hAXYGJI.exe
  C:\Windows\System\hAXYGJI.exe
  2⤵
  PID:3668
- C:\Windows\System\eoAhqsB.exe
  C:\Windows\System\eoAhqsB.exe
  2⤵
  PID:3688
- C:\Windows\System\pTCROTr.exe
  C:\Windows\System\pTCROTr.exe
  2⤵
  PID:3704
- C:\Windows\System\JBnCsOY.exe
  C:\Windows\System\JBnCsOY.exe
  2⤵
  PID:3720
- C:\Windows\System\neInrCB.exe
  C:\Windows\System\neInrCB.exe
  2⤵
  PID:3740
- C:\Windows\System\XNhpqBQ.exe
  C:\Windows\System\XNhpqBQ.exe
  2⤵
  PID:3760
- C:\Windows\System\IYFXvFU.exe
  C:\Windows\System\IYFXvFU.exe
  2⤵
  PID:3808
- C:\Windows\System\VOcWtOA.exe
  C:\Windows\System\VOcWtOA.exe
  2⤵
  PID:3828
- C:\Windows\System\euRsqQA.exe
  C:\Windows\System\euRsqQA.exe
  2⤵
  PID:3848
- C:\Windows\System\RnIXbuc.exe
  C:\Windows\System\RnIXbuc.exe
  2⤵
  PID:3868
- C:\Windows\System\vRpizGn.exe
  C:\Windows\System\vRpizGn.exe
  2⤵
  PID:3888
- C:\Windows\System\zoPLjam.exe
  C:\Windows\System\zoPLjam.exe
  2⤵
  PID:3908
- C:\Windows\System\Hjsphml.exe
  C:\Windows\System\Hjsphml.exe
  2⤵
  PID:3928
- C:\Windows\System\fjvcugN.exe
  C:\Windows\System\fjvcugN.exe
  2⤵
  PID:3948
- C:\Windows\System\zqEzxPb.exe
  C:\Windows\System\zqEzxPb.exe
  2⤵
  PID:3968
- C:\Windows\System\DXfHNpN.exe
  C:\Windows\System\DXfHNpN.exe
  2⤵
  PID:3988
- C:\Windows\System\bRwBSiW.exe
  C:\Windows\System\bRwBSiW.exe
  2⤵
  PID:4004
- C:\Windows\System\nnqikgu.exe
  C:\Windows\System\nnqikgu.exe
  2⤵
  PID:4020
- C:\Windows\System\aOqPxuk.exe
  C:\Windows\System\aOqPxuk.exe
  2⤵
  PID:4036
- C:\Windows\System\ceBZlsH.exe
  C:\Windows\System\ceBZlsH.exe
  2⤵
  PID:4056
- C:\Windows\System\UfHTLif.exe
  C:\Windows\System\UfHTLif.exe
  2⤵
  PID:4080
- C:\Windows\System\LKZRoKZ.exe
  C:\Windows\System\LKZRoKZ.exe
  2⤵
  PID:1748
- C:\Windows\System\thVItLA.exe
  C:\Windows\System\thVItLA.exe
  2⤵
  PID:2120
- C:\Windows\System\mFeuuqi.exe
  C:\Windows\System\mFeuuqi.exe
  2⤵
  PID:1248
- C:\Windows\System\BbqkdsI.exe
  C:\Windows\System\BbqkdsI.exe
  2⤵
  PID:864
- C:\Windows\System\NhETjGx.exe
  C:\Windows\System\NhETjGx.exe
  2⤵
  PID:2228
- C:\Windows\System\AYSpuwe.exe
  C:\Windows\System\AYSpuwe.exe
  2⤵
  PID:2732
- C:\Windows\System\RwjomHa.exe
  C:\Windows\System\RwjomHa.exe
  2⤵
  PID:2480
- C:\Windows\System\ZlscVPZ.exe
  C:\Windows\System\ZlscVPZ.exe
  2⤵
  PID:2468
- C:\Windows\System\wwnpURE.exe
  C:\Windows\System\wwnpURE.exe
  2⤵
  PID:2788
- C:\Windows\System\FJDrWqj.exe
  C:\Windows\System\FJDrWqj.exe
  2⤵
  PID:2520
- C:\Windows\System\qlOnlsc.exe
  C:\Windows\System\qlOnlsc.exe
  2⤵
  PID:1304
- C:\Windows\System\EZyrVeR.exe
  C:\Windows\System\EZyrVeR.exe
  2⤵
  PID:484
- C:\Windows\System\oVxHGGC.exe
  C:\Windows\System\oVxHGGC.exe
  2⤵
  PID:2792
- C:\Windows\System\QguAFkB.exe
  C:\Windows\System\QguAFkB.exe
  2⤵
  PID:3092
- C:\Windows\System\QuKwUAv.exe
  C:\Windows\System\QuKwUAv.exe
  2⤵
  PID:3172
- C:\Windows\System\AshXUSf.exe
  C:\Windows\System\AshXUSf.exe
  2⤵
  PID:408
- C:\Windows\System\VZxCrqL.exe
  C:\Windows\System\VZxCrqL.exe
  2⤵
  PID:3108
- C:\Windows\System\KaPGJiv.exe
  C:\Windows\System\KaPGJiv.exe
  2⤵
  PID:3292
- C:\Windows\System\AOLAJJh.exe
  C:\Windows\System\AOLAJJh.exe
  2⤵
  PID:3372
- C:\Windows\System\ZRqazGO.exe
  C:\Windows\System\ZRqazGO.exe
  2⤵
  PID:1556
- C:\Windows\System\gxKrPWj.exe
  C:\Windows\System\gxKrPWj.exe
  2⤵
  PID:3152
- C:\Windows\System\DtIIbbd.exe
  C:\Windows\System\DtIIbbd.exe
  2⤵
  PID:3188
- C:\Windows\System\RdvvVTQ.exe
  C:\Windows\System\RdvvVTQ.exe
  2⤵
  PID:3448
- C:\Windows\System\EkjgyDh.exe
  C:\Windows\System\EkjgyDh.exe
  2⤵
  PID:3148
- C:\Windows\System\UyRxwMZ.exe
  C:\Windows\System\UyRxwMZ.exe
  2⤵
  PID:2652
- C:\Windows\System\OYKGSCR.exe
  C:\Windows\System\OYKGSCR.exe
  2⤵
  PID:3392
- C:\Windows\System\tiGlvlC.exe
  C:\Windows\System\tiGlvlC.exe
  2⤵
  PID:3400
- C:\Windows\System\xeeConr.exe
  C:\Windows\System\xeeConr.exe
  2⤵
  PID:3608
- C:\Windows\System\rpWShSb.exe
  C:\Windows\System\rpWShSb.exe
  2⤵
  PID:3648
- C:\Windows\System\sqOyrws.exe
  C:\Windows\System\sqOyrws.exe
  2⤵
  PID:3536
- C:\Windows\System\ekvuVhL.exe
  C:\Windows\System\ekvuVhL.exe
  2⤵
  PID:3548
- C:\Windows\System\iUiWtLg.exe
  C:\Windows\System\iUiWtLg.exe
  2⤵
  PID:3684
- C:\Windows\System\YSjkDZo.exe
  C:\Windows\System\YSjkDZo.exe
  2⤵
  PID:3752
- C:\Windows\System\jCRrGgr.exe
  C:\Windows\System\jCRrGgr.exe
  2⤵
  PID:3700
- C:\Windows\System\fWYyMdb.exe
  C:\Windows\System\fWYyMdb.exe
  2⤵
  PID:3768
- C:\Windows\System\duYsXno.exe
  C:\Windows\System\duYsXno.exe
  2⤵
  PID:3784
- C:\Windows\System\FCHCYna.exe
  C:\Windows\System\FCHCYna.exe
  2⤵
  PID:3632
- C:\Windows\System\dqepGVL.exe
  C:\Windows\System\dqepGVL.exe
  2⤵
  PID:3824
- C:\Windows\System\pBHaNDi.exe
  C:\Windows\System\pBHaNDi.exe
  2⤵
  PID:2368
- C:\Windows\System\gEeBHMJ.exe
  C:\Windows\System\gEeBHMJ.exe
  2⤵
  PID:2784
- C:\Windows\System\IxnPJlr.exe
  C:\Windows\System\IxnPJlr.exe
  2⤵
  PID:3860
- C:\Windows\System\sTScWLY.exe
  C:\Windows\System\sTScWLY.exe
  2⤵
  PID:3876
- C:\Windows\System\JvoQxBa.exe
  C:\Windows\System\JvoQxBa.exe
  2⤵
  PID:3916
- C:\Windows\System\DaTHyez.exe
  C:\Windows\System\DaTHyez.exe
  2⤵
  PID:3032
- C:\Windows\System\viKSetJ.exe
  C:\Windows\System\viKSetJ.exe
  2⤵
  PID:3984
- C:\Windows\System\EyWubNZ.exe
  C:\Windows\System\EyWubNZ.exe
  2⤵
  PID:2340
- C:\Windows\System\tmCvGTu.exe
  C:\Windows\System\tmCvGTu.exe
  2⤵
  PID:2772
- C:\Windows\System\oJUPMmy.exe
  C:\Windows\System\oJUPMmy.exe
  2⤵
  PID:3960
- C:\Windows\System\WRtcaku.exe
  C:\Windows\System\WRtcaku.exe
  2⤵
  PID:2404
- C:\Windows\System\ajhcFBt.exe
  C:\Windows\System\ajhcFBt.exe
  2⤵
  PID:1608
- C:\Windows\System\eUPCYWy.exe
  C:\Windows\System\eUPCYWy.exe
  2⤵
  PID:3068
- C:\Windows\System\wduZSEl.exe
  C:\Windows\System\wduZSEl.exe
  2⤵
  PID:2596
- C:\Windows\System\BVIqVZE.exe
  C:\Windows\System\BVIqVZE.exe
  2⤵
  PID:3132
- C:\Windows\System\bpdGSfw.exe
  C:\Windows\System\bpdGSfw.exe
  2⤵
  PID:4072
- C:\Windows\System\ScybMDN.exe
  C:\Windows\System\ScybMDN.exe
  2⤵
  PID:3120
- C:\Windows\System\SqQUCVr.exe
  C:\Windows\System\SqQUCVr.exe
  2⤵
  PID:2252
- C:\Windows\System\ZGAoVZV.exe
  C:\Windows\System\ZGAoVZV.exe
  2⤵
  PID:3220
- C:\Windows\System\XEqgMoU.exe
  C:\Windows\System\XEqgMoU.exe
  2⤵
  PID:2728
- C:\Windows\System\ZXxNvXj.exe
  C:\Windows\System\ZXxNvXj.exe
  2⤵
  PID:2972
- C:\Windows\System\IwidFLh.exe
  C:\Windows\System\IwidFLh.exe
  2⤵
  PID:3056
- C:\Windows\System\LiQWRXZ.exe
  C:\Windows\System\LiQWRXZ.exe
  2⤵
  PID:3644
- C:\Windows\System\RIwdCsk.exe
  C:\Windows\System\RIwdCsk.exe
  2⤵
  PID:3792
- C:\Windows\System\xLjmIQX.exe
  C:\Windows\System\xLjmIQX.exe
  2⤵
  PID:3240
- C:\Windows\System\yGqowOp.exe
  C:\Windows\System\yGqowOp.exe
  2⤵
  PID:3412
- C:\Windows\System\ubvSfmI.exe
  C:\Windows\System\ubvSfmI.exe
  2⤵
  PID:3264
- C:\Windows\System\tebkSOS.exe
  C:\Windows\System\tebkSOS.exe
  2⤵
  PID:3000
- C:\Windows\System\hbxYywb.exe
  C:\Windows\System\hbxYywb.exe
  2⤵
  PID:3516
- C:\Windows\System\zDiLcmG.exe
  C:\Windows\System\zDiLcmG.exe
  2⤵
  PID:2256
- C:\Windows\System\cpZdfPA.exe
  C:\Windows\System\cpZdfPA.exe
  2⤵
  PID:1376
- C:\Windows\System\paUMXbf.exe
  C:\Windows\System\paUMXbf.exe
  2⤵
  PID:3204
- C:\Windows\System\Rqlbzrr.exe
  C:\Windows\System\Rqlbzrr.exe
  2⤵
  PID:3976
- C:\Windows\System\udxhfzK.exe
  C:\Windows\System\udxhfzK.exe
  2⤵
  PID:3468
- C:\Windows\System\DRCBKIB.exe
  C:\Windows\System\DRCBKIB.exe
  2⤵
  PID:3504
- C:\Windows\System\hYLZosc.exe
  C:\Windows\System\hYLZosc.exe
  2⤵
  PID:2816
- C:\Windows\System\VpweseA.exe
  C:\Windows\System\VpweseA.exe
  2⤵
  PID:3900
- C:\Windows\System\MyREBmU.exe
  C:\Windows\System\MyREBmU.exe
  2⤵
  PID:4012
- C:\Windows\System\bParmJK.exe
  C:\Windows\System\bParmJK.exe
  2⤵
  PID:4092
- C:\Windows\System\xAYsanQ.exe
  C:\Windows\System\xAYsanQ.exe
  2⤵
  PID:2876
- C:\Windows\System\tTXfexU.exe
  C:\Windows\System\tTXfexU.exe
  2⤵
  PID:3996
- C:\Windows\System\BmxrXZZ.exe
  C:\Windows\System\BmxrXZZ.exe
  2⤵
  PID:2856
- C:\Windows\System\egjPPeF.exe
  C:\Windows\System\egjPPeF.exe
  2⤵
  PID:2668
- C:\Windows\System\MzaWAEJ.exe
  C:\Windows\System\MzaWAEJ.exe
  2⤵
  PID:3560
- C:\Windows\System\roJHszP.exe
  C:\Windows\System\roJHszP.exe
  2⤵
  PID:3064
- C:\Windows\System\mVbGTYo.exe
  C:\Windows\System\mVbGTYo.exe
  2⤵
  PID:3280
- C:\Windows\System\IBWfTFw.exe
  C:\Windows\System\IBWfTFw.exe
  2⤵
  PID:3348
- C:\Windows\System\gHZdwvg.exe
  C:\Windows\System\gHZdwvg.exe
  2⤵
  PID:3796
- C:\Windows\System\ACqwLPQ.exe
  C:\Windows\System\ACqwLPQ.exe
  2⤵
  PID:3260
- C:\Windows\System\NnepfrX.exe
  C:\Windows\System\NnepfrX.exe
  2⤵
  PID:3384
- C:\Windows\System\xbppELN.exe
  C:\Windows\System\xbppELN.exe
  2⤵
  PID:3320
- C:\Windows\System\gGOsswo.exe
  C:\Windows\System\gGOsswo.exe
  2⤵
  PID:2588
- C:\Windows\System\TxhngCb.exe
  C:\Windows\System\TxhngCb.exe
  2⤵
  PID:3964
- C:\Windows\System\cLiQpVW.exe
  C:\Windows\System\cLiQpVW.exe
  2⤵
  PID:2564
- C:\Windows\System\lJnZSim.exe
  C:\Windows\System\lJnZSim.exe
  2⤵
  PID:3332
- C:\Windows\System\VNfWPXQ.exe
  C:\Windows\System\VNfWPXQ.exe
  2⤵
  PID:820
- C:\Windows\System\dbHtHZe.exe
  C:\Windows\System\dbHtHZe.exe
  2⤵
  PID:1600
- C:\Windows\System\tluoXHl.exe
  C:\Windows\System\tluoXHl.exe
  2⤵
  PID:4120
- C:\Windows\System\AhfbJKm.exe
  C:\Windows\System\AhfbJKm.exe
  2⤵
  PID:4136
- C:\Windows\System\SonDUYO.exe
  C:\Windows\System\SonDUYO.exe
  2⤵
  PID:4156
- C:\Windows\System\FxjArMI.exe
  C:\Windows\System\FxjArMI.exe
  2⤵
  PID:4172
- C:\Windows\System\WQEXCcv.exe
  C:\Windows\System\WQEXCcv.exe
  2⤵
  PID:4192
- C:\Windows\System\ljtRJbr.exe
  C:\Windows\System\ljtRJbr.exe
  2⤵
  PID:4208
- C:\Windows\System\aTGSUoT.exe
  C:\Windows\System\aTGSUoT.exe
  2⤵
  PID:4232
- C:\Windows\System\NkJeWwE.exe
  C:\Windows\System\NkJeWwE.exe
  2⤵
  PID:4280
- C:\Windows\System\cEJklha.exe
  C:\Windows\System\cEJklha.exe
  2⤵
  PID:4300
- C:\Windows\System\LIaGgLN.exe
  C:\Windows\System\LIaGgLN.exe
  2⤵
  PID:4320
- C:\Windows\System\lxRMKCs.exe
  C:\Windows\System\lxRMKCs.exe
  2⤵
  PID:4336
- C:\Windows\System\NKbYJTw.exe
  C:\Windows\System\NKbYJTw.exe
  2⤵
  PID:4356
- C:\Windows\System\TeHZkDQ.exe
  C:\Windows\System\TeHZkDQ.exe
  2⤵
  PID:4372
- C:\Windows\System\FVFdlRV.exe
  C:\Windows\System\FVFdlRV.exe
  2⤵
  PID:4396
- C:\Windows\System\nSLscNk.exe
  C:\Windows\System\nSLscNk.exe
  2⤵
  PID:4416
- C:\Windows\System\YXtcLoZ.exe
  C:\Windows\System\YXtcLoZ.exe
  2⤵
  PID:4432
- C:\Windows\System\bFikkNe.exe
  C:\Windows\System\bFikkNe.exe
  2⤵
  PID:4448
- C:\Windows\System\YjCbcHj.exe
  C:\Windows\System\YjCbcHj.exe
  2⤵
  PID:4464
- C:\Windows\System\klExoCg.exe
  C:\Windows\System\klExoCg.exe
  2⤵
  PID:4480
- C:\Windows\System\smQMWxA.exe
  C:\Windows\System\smQMWxA.exe
  2⤵
  PID:4500
- C:\Windows\System\QCuBuYw.exe
  C:\Windows\System\QCuBuYw.exe
  2⤵
  PID:4516
- C:\Windows\System\aDZzKCT.exe
  C:\Windows\System\aDZzKCT.exe
  2⤵
  PID:4532
- C:\Windows\System\xBsEEze.exe
  C:\Windows\System\xBsEEze.exe
  2⤵
  PID:4548
- C:\Windows\System\AHVwvRq.exe
  C:\Windows\System\AHVwvRq.exe
  2⤵
  PID:4568
- C:\Windows\System\tJDMDJt.exe
  C:\Windows\System\tJDMDJt.exe
  2⤵
  PID:4588
- C:\Windows\System\ChMgFbv.exe
  C:\Windows\System\ChMgFbv.exe
  2⤵
  PID:4604
- C:\Windows\System\qJoYsSO.exe
  C:\Windows\System\qJoYsSO.exe
  2⤵
  PID:4620
- C:\Windows\System\QUWwBDa.exe
  C:\Windows\System\QUWwBDa.exe
  2⤵
  PID:4652
- C:\Windows\System\JEwGBaz.exe
  C:\Windows\System\JEwGBaz.exe
  2⤵
  PID:4668
- C:\Windows\System\TaArBAg.exe
  C:\Windows\System\TaArBAg.exe
  2⤵
  PID:4684
- C:\Windows\System\MLEABMw.exe
  C:\Windows\System\MLEABMw.exe
  2⤵
  PID:4700
- C:\Windows\System\euSvhQC.exe
  C:\Windows\System\euSvhQC.exe
  2⤵
  PID:4716
- C:\Windows\System\OuPvMao.exe
  C:\Windows\System\OuPvMao.exe
  2⤵
  PID:4732
- C:\Windows\System\kuqbjHa.exe
  C:\Windows\System\kuqbjHa.exe
  2⤵
  PID:4748
- C:\Windows\System\zmuDRYv.exe
  C:\Windows\System\zmuDRYv.exe
  2⤵
  PID:4764
- C:\Windows\System\mjbYYNQ.exe
  C:\Windows\System\mjbYYNQ.exe
  2⤵
  PID:4780
- C:\Windows\System\QGeywZv.exe
  C:\Windows\System\QGeywZv.exe
  2⤵
  PID:4804
- C:\Windows\System\RFYOeDr.exe
  C:\Windows\System\RFYOeDr.exe
  2⤵
  PID:4840
- C:\Windows\System\qdkKrhJ.exe
  C:\Windows\System\qdkKrhJ.exe
  2⤵
  PID:4876
- C:\Windows\System\kSnSIHW.exe
  C:\Windows\System\kSnSIHW.exe
  2⤵
  PID:4892
- C:\Windows\System\gmIbUVf.exe
  C:\Windows\System\gmIbUVf.exe
  2⤵
  PID:5004
- C:\Windows\System\pdSTZYQ.exe
  C:\Windows\System\pdSTZYQ.exe
  2⤵
  PID:5020
- C:\Windows\System\EdDniTg.exe
  C:\Windows\System\EdDniTg.exe
  2⤵
  PID:5044
- C:\Windows\System\FiImFbl.exe
  C:\Windows\System\FiImFbl.exe
  2⤵
  PID:5068
- C:\Windows\System\apHEhgQ.exe
  C:\Windows\System\apHEhgQ.exe
  2⤵
  PID:5084
- C:\Windows\System\wSMBZqe.exe
  C:\Windows\System\wSMBZqe.exe
  2⤵
  PID:5112
- C:\Windows\System\bQRSupH.exe
  C:\Windows\System\bQRSupH.exe
  2⤵
  PID:4032
- C:\Windows\System\KiIWBDa.exe
  C:\Windows\System\KiIWBDa.exe
  2⤵
  PID:1804
- C:\Windows\System\AkwSArQ.exe
  C:\Windows\System\AkwSArQ.exe
  2⤵
  PID:1852
- C:\Windows\System\GKOkDRB.exe
  C:\Windows\System\GKOkDRB.exe
  2⤵
  PID:1676
- C:\Windows\System\xKqHEjB.exe
  C:\Windows\System\xKqHEjB.exe
  2⤵
  PID:3732
- C:\Windows\System\gKtklvd.exe
  C:\Windows\System\gKtklvd.exe
  2⤵
  PID:4128
- C:\Windows\System\ubUpsOY.exe
  C:\Windows\System\ubUpsOY.exe
  2⤵
  PID:4164
- C:\Windows\System\GtVFGpN.exe
  C:\Windows\System\GtVFGpN.exe
  2⤵
  PID:3236
- C:\Windows\System\XKVoESU.exe
  C:\Windows\System\XKVoESU.exe
  2⤵
  PID:3676
- C:\Windows\System\eTtEabD.exe
  C:\Windows\System\eTtEabD.exe
  2⤵
  PID:1692
- C:\Windows\System\PDLIrJt.exe
  C:\Windows\System\PDLIrJt.exe
  2⤵
  PID:4076
- C:\Windows\System\OPSpwkU.exe
  C:\Windows\System\OPSpwkU.exe
  2⤵
  PID:1992
- C:\Windows\System\xmKmXOK.exe
  C:\Windows\System\xmKmXOK.exe
  2⤵
  PID:3592
- C:\Windows\System\PkXLriU.exe
  C:\Windows\System\PkXLriU.exe
  2⤵
  PID:4152
- C:\Windows\System\WfGaIwy.exe
  C:\Windows\System\WfGaIwy.exe
  2⤵
  PID:4180
- C:\Windows\System\kVWlZNB.exe
  C:\Windows\System\kVWlZNB.exe
  2⤵
  PID:4224
- C:\Windows\System\jMOcSUc.exe
  C:\Windows\System\jMOcSUc.exe
  2⤵
  PID:4348
- C:\Windows\System\cacsuZv.exe
  C:\Windows\System\cacsuZv.exe
  2⤵
  PID:4388
- C:\Windows\System\FfwIpWF.exe
  C:\Windows\System\FfwIpWF.exe
  2⤵
  PID:4428
- C:\Windows\System\sAwKUXT.exe
  C:\Windows\System\sAwKUXT.exe
  2⤵
  PID:4328
- C:\Windows\System\coGGrRD.exe
  C:\Windows\System\coGGrRD.exe
  2⤵
  PID:4404
- C:\Windows\System\JxznCLp.exe
  C:\Windows\System\JxznCLp.exe
  2⤵
  PID:4528
- C:\Windows\System\zkYpDxZ.exe
  C:\Windows\System\zkYpDxZ.exe
  2⤵
  PID:4476
- C:\Windows\System\eCZyyjc.exe
  C:\Windows\System\eCZyyjc.exe
  2⤵
  PID:4628
- C:\Windows\System\ksLYmBL.exe
  C:\Windows\System\ksLYmBL.exe
  2⤵
  PID:4596
- C:\Windows\System\bOnhJzM.exe
  C:\Windows\System\bOnhJzM.exe
  2⤵
  PID:4580
- C:\Windows\System\AhPuhQX.exe
  C:\Windows\System\AhPuhQX.exe
  2⤵
  PID:4824
- C:\Windows\System\QZKBHVN.exe
  C:\Windows\System\QZKBHVN.exe
  2⤵
  PID:4696
- C:\Windows\System\maDwbRa.exe
  C:\Windows\System\maDwbRa.exe
  2⤵
  PID:4760
- C:\Windows\System\CBslQHv.exe
  C:\Windows\System\CBslQHv.exe
  2⤵
  PID:4800
- C:\Windows\System\jMPnXtf.exe
  C:\Windows\System\jMPnXtf.exe
  2⤵
  PID:2704
- C:\Windows\System\wgbOAMV.exe
  C:\Windows\System\wgbOAMV.exe
  2⤵
  PID:4860
- C:\Windows\System\IyWdcYj.exe
  C:\Windows\System\IyWdcYj.exe
  2⤵
  PID:4872
- C:\Windows\System\rVcFAKf.exe
  C:\Windows\System\rVcFAKf.exe
  2⤵
  PID:4904
- C:\Windows\System\qJFrDCi.exe
  C:\Windows\System\qJFrDCi.exe
  2⤵
  PID:4920
- C:\Windows\System\yEDenUq.exe
  C:\Windows\System\yEDenUq.exe
  2⤵
  PID:2776
- C:\Windows\System\tNbBILs.exe
  C:\Windows\System\tNbBILs.exe
  2⤵
  PID:3016
- C:\Windows\System\YRobTLW.exe
  C:\Windows\System\YRobTLW.exe
  2⤵
  PID:1256
- C:\Windows\System\YiXkIeN.exe
  C:\Windows\System\YiXkIeN.exe
  2⤵
  PID:4956
- C:\Windows\System\INdFTWC.exe
  C:\Windows\System\INdFTWC.exe
  2⤵
  PID:2168
- C:\Windows\System\cmJUuBM.exe
  C:\Windows\System\cmJUuBM.exe
  2⤵
  PID:1560
- C:\Windows\System\xhscSkp.exe
  C:\Windows\System\xhscSkp.exe
  2⤵
  PID:5016
- C:\Windows\System\WhnpHFM.exe
  C:\Windows\System\WhnpHFM.exe
  2⤵
  PID:5052
- C:\Windows\System\iOZviSq.exe
  C:\Windows\System\iOZviSq.exe
  2⤵
  PID:1888
- C:\Windows\System\YgbIFUv.exe
  C:\Windows\System\YgbIFUv.exe
  2⤵
  PID:1976
- C:\Windows\System\cdhBySM.exe
  C:\Windows\System\cdhBySM.exe
  2⤵
  PID:1836
- C:\Windows\System\pszxilX.exe
  C:\Windows\System\pszxilX.exe
  2⤵
  PID:5096
- C:\Windows\System\RKWmEQP.exe
  C:\Windows\System\RKWmEQP.exe
  2⤵
  PID:3416
- C:\Windows\System\hXqQQDU.exe
  C:\Windows\System\hXqQQDU.exe
  2⤵
  PID:3084
- C:\Windows\System\iXdgKBC.exe
  C:\Windows\System\iXdgKBC.exe
  2⤵
  PID:2648
- C:\Windows\System\CmucGQO.exe
  C:\Windows\System\CmucGQO.exe
  2⤵
  PID:2760
- C:\Windows\System\pTpAQVR.exe
  C:\Windows\System\pTpAQVR.exe
  2⤵
  PID:3428
- C:\Windows\System\xIseosB.exe
  C:\Windows\System\xIseosB.exe
  2⤵
  PID:1812
- C:\Windows\System\svfeWhs.exe
  C:\Windows\System\svfeWhs.exe
  2⤵
  PID:3836
- C:\Windows\System\kcmAREu.exe
  C:\Windows\System\kcmAREu.exe
  2⤵
  PID:2180
- C:\Windows\System\fCRTNuD.exe
  C:\Windows\System\fCRTNuD.exe
  2⤵
  PID:3112
- C:\Windows\System\oEDFCKn.exe
  C:\Windows\System\oEDFCKn.exe
  2⤵
  PID:4200
- C:\Windows\System\atdtvkf.exe
  C:\Windows\System\atdtvkf.exe
  2⤵
  PID:1356
- C:\Windows\System\znYHNGY.exe
  C:\Windows\System\znYHNGY.exe
  2⤵
  PID:3776
- C:\Windows\System\KYyyuxt.exe
  C:\Windows\System\KYyyuxt.exe
  2⤵
  PID:1612
- C:\Windows\System\KpzVmDp.exe
  C:\Windows\System\KpzVmDp.exe
  2⤵
  PID:3840
- C:\Windows\System\SgDJaOu.exe
  C:\Windows\System\SgDJaOu.exe
  2⤵
  PID:340
- C:\Windows\System\TLdbWWq.exe
  C:\Windows\System\TLdbWWq.exe
  2⤵
  PID:1660
- C:\Windows\System\iCFwGGG.exe
  C:\Windows\System\iCFwGGG.exe
  2⤵
  PID:4312
- C:\Windows\System\GQfRlhC.exe
  C:\Windows\System\GQfRlhC.exe
  2⤵
  PID:4600
- C:\Windows\System\CYdZYtT.exe
  C:\Windows\System\CYdZYtT.exe
  2⤵
  PID:4364
- C:\Windows\System\cadWZUW.exe
  C:\Windows\System\cadWZUW.exe
  2⤵
  PID:4644
- C:\Windows\System\hOpNRaj.exe
  C:\Windows\System\hOpNRaj.exe
  2⤵
  PID:4616
- C:\Windows\System\iThvtjf.exe
  C:\Windows\System\iThvtjf.exe
  2⤵
  PID:4912
- C:\Windows\System\rFcOGaD.exe
  C:\Windows\System\rFcOGaD.exe
  2⤵
  PID:288
- C:\Windows\System\pJBJuuX.exe
  C:\Windows\System\pJBJuuX.exe
  2⤵
  PID:2696
- C:\Windows\System\BieogFG.exe
  C:\Windows\System\BieogFG.exe
  2⤵
  PID:4952
- C:\Windows\System\WaLNvHA.exe
  C:\Windows\System\WaLNvHA.exe
  2⤵
  PID:2884
- C:\Windows\System\XdkEvUL.exe
  C:\Windows\System\XdkEvUL.exe
  2⤵
  PID:4812
- C:\Windows\System\WPiUuuA.exe
  C:\Windows\System\WPiUuuA.exe
  2⤵
  PID:4832
- C:\Windows\System\eVyIWtl.exe
  C:\Windows\System\eVyIWtl.exe
  2⤵
  PID:4796
- C:\Windows\System\lRWMPty.exe
  C:\Windows\System\lRWMPty.exe
  2⤵
  PID:2420
- C:\Windows\System\vAPdJEM.exe
  C:\Windows\System\vAPdJEM.exe
  2⤵
  PID:2424
- C:\Windows\System\oGyUkLF.exe
  C:\Windows\System\oGyUkLF.exe
  2⤵
  PID:4972
- C:\Windows\System\ZWIeQSo.exe
  C:\Windows\System\ZWIeQSo.exe
  2⤵
  PID:4968
- C:\Windows\System\bwrUEUo.exe
  C:\Windows\System\bwrUEUo.exe
  2⤵
  PID:2580
- C:\Windows\System\RSpmujf.exe
  C:\Windows\System\RSpmujf.exe
  2⤵
  PID:748
- C:\Windows\System\eaNaNHS.exe
  C:\Windows\System\eaNaNHS.exe
  2⤵
  PID:5104
- C:\Windows\System\jEJBQot.exe
  C:\Windows\System\jEJBQot.exe
  2⤵
  PID:5080
- C:\Windows\System\xcgpkTn.exe
  C:\Windows\System\xcgpkTn.exe
  2⤵
  PID:3820
- C:\Windows\System\JRSHzTy.exe
  C:\Windows\System\JRSHzTy.exe
  2⤵
  PID:4204
- C:\Windows\System\nDYAQKJ.exe
  C:\Windows\System\nDYAQKJ.exe
  2⤵
  PID:3904
- C:\Windows\System\wZkBKRu.exe
  C:\Windows\System\wZkBKRu.exe
  2⤵
  PID:3088
- C:\Windows\System\bpPUfda.exe
  C:\Windows\System\bpPUfda.exe
  2⤵
  PID:3856
- C:\Windows\System\tStscKu.exe
  C:\Windows\System\tStscKu.exe
  2⤵
  PID:4344
- C:\Windows\System\mzTMVHZ.exe
  C:\Windows\System\mzTMVHZ.exe
  2⤵
  PID:1456
- C:\Windows\System\VBargYs.exe
  C:\Windows\System\VBargYs.exe
  2⤵
  PID:4512
- C:\Windows\System\dRtbpRL.exe
  C:\Windows\System\dRtbpRL.exe
  2⤵
  PID:4220
- C:\Windows\System\XhsBOGC.exe
  C:\Windows\System\XhsBOGC.exe
  2⤵
  PID:4296
- C:\Windows\System\KyQVjbx.exe
  C:\Windows\System\KyQVjbx.exe
  2⤵
  PID:4384
- C:\Windows\System\JYjwdVh.exe
  C:\Windows\System\JYjwdVh.exe
  2⤵
  PID:4712
- C:\Windows\System\OnMSjqD.exe
  C:\Windows\System\OnMSjqD.exe
  2⤵
  PID:4472
- C:\Windows\System\ovnWGIT.exe
  C:\Windows\System\ovnWGIT.exe
  2⤵
  PID:4676
- C:\Windows\System\XqXQxGb.exe
  C:\Windows\System\XqXQxGb.exe
  2⤵
  PID:2528
- C:\Windows\System\PfglwIz.exe
  C:\Windows\System\PfglwIz.exe
  2⤵
  PID:2916
- C:\Windows\System\QoPMaVL.exe
  C:\Windows\System\QoPMaVL.exe
  2⤵
  PID:4992
- C:\Windows\System\lUxQLsk.exe
  C:\Windows\System\lUxQLsk.exe
  2⤵
  PID:896
- C:\Windows\System\KAkbTDF.exe
  C:\Windows\System\KAkbTDF.exe
  2⤵
  PID:4984
- C:\Windows\System\McvhKZe.exe
  C:\Windows\System\McvhKZe.exe
  2⤵
  PID:3272
- C:\Windows\System\NIEFqaa.exe
  C:\Windows\System\NIEFqaa.exe
  2⤵
  PID:1300
- C:\Windows\System\WFgnjHT.exe
  C:\Windows\System\WFgnjHT.exe
  2⤵
  PID:5056
- C:\Windows\System\EmVsxzq.exe
  C:\Windows\System\EmVsxzq.exe
  2⤵
  PID:2068
- C:\Windows\System\dVOjEFE.exe
  C:\Windows\System\dVOjEFE.exe
  2⤵
  PID:1184
- C:\Windows\System\OeVPYMK.exe
  C:\Windows\System\OeVPYMK.exe
  2⤵
  PID:3316
- C:\Windows\System\xkuXSLX.exe
  C:\Windows\System\xkuXSLX.exe
  2⤵
  PID:4052
- C:\Windows\System\EqFJloJ.exe
  C:\Windows\System\EqFJloJ.exe
  2⤵
  PID:4268
- C:\Windows\System\kTHuWLy.exe
  C:\Windows\System\kTHuWLy.exe
  2⤵
  PID:4112
- C:\Windows\System\szyqRYo.exe
  C:\Windows\System\szyqRYo.exe
  2⤵
  PID:2096
- C:\Windows\System\RnQMNfV.exe
  C:\Windows\System\RnQMNfV.exe
  2⤵
  PID:4492
- C:\Windows\System\svoecgZ.exe
  C:\Windows\System\svoecgZ.exe
  2⤵
  PID:4412
- C:\Windows\System\yPkUvff.exe
  C:\Windows\System\yPkUvff.exe
  2⤵
  PID:4440
- C:\Windows\System\lULxJkt.exe
  C:\Windows\System\lULxJkt.exe
  2⤵
  PID:4852
- C:\Windows\System\PzBCwXu.exe
  C:\Windows\System\PzBCwXu.exe
  2⤵
  PID:4932
- C:\Windows\System\MgazTID.exe
  C:\Windows\System\MgazTID.exe
  2⤵
  PID:4900
- C:\Windows\System\dvJzefK.exe
  C:\Windows\System\dvJzefK.exe
  2⤵
  PID:4792
- C:\Windows\System\EcDqkeF.exe
  C:\Windows\System\EcDqkeF.exe
  2⤵
  PID:5064
- C:\Windows\System\AXbwLmG.exe
  C:\Windows\System\AXbwLmG.exe
  2⤵
  PID:4976
- C:\Windows\System\oNXFMOF.exe
  C:\Windows\System\oNXFMOF.exe
  2⤵
  PID:5040
- C:\Windows\System\CplkvKR.exe
  C:\Windows\System\CplkvKR.exe
  2⤵
  PID:5036
- C:\Windows\System\vwMaCbk.exe
  C:\Windows\System\vwMaCbk.exe
  2⤵
  PID:912
- C:\Windows\System\tKjhZBL.exe
  C:\Windows\System\tKjhZBL.exe
  2⤵
  PID:4352
- C:\Windows\System\koLjlBj.exe
  C:\Windows\System\koLjlBj.exe
  2⤵
  PID:4884
- C:\Windows\System\FSItEkS.exe
  C:\Windows\System\FSItEkS.exe
  2⤵
  PID:4828
- C:\Windows\System\LiwdIQZ.exe
  C:\Windows\System\LiwdIQZ.exe
  2⤵
  PID:5092
- C:\Windows\System\txSTlMy.exe
  C:\Windows\System\txSTlMy.exe
  2⤵
  PID:4188
- C:\Windows\System\lJUjBrV.exe
  C:\Windows\System\lJUjBrV.exe
  2⤵
  PID:5140
- C:\Windows\System\fdIhcDX.exe
  C:\Windows\System\fdIhcDX.exe
  2⤵
  PID:5156
- C:\Windows\System\NcZebby.exe
  C:\Windows\System\NcZebby.exe
  2⤵
  PID:5172
- C:\Windows\System\eNwaCIp.exe
  C:\Windows\System\eNwaCIp.exe
  2⤵
  PID:5188
- C:\Windows\System\zwiwqub.exe
  C:\Windows\System\zwiwqub.exe
  2⤵
  PID:5204
- C:\Windows\System\RsBNprY.exe
  C:\Windows\System\RsBNprY.exe
  2⤵
  PID:5220
- C:\Windows\System\DazTxwo.exe
  C:\Windows\System\DazTxwo.exe
  2⤵
  PID:5236
- C:\Windows\System\PLzXkWN.exe
  C:\Windows\System\PLzXkWN.exe
  2⤵
  PID:5252
- C:\Windows\System\PkcSgVu.exe
  C:\Windows\System\PkcSgVu.exe
  2⤵
  PID:5268
- C:\Windows\System\lyPjgug.exe
  C:\Windows\System\lyPjgug.exe
  2⤵
  PID:5284
- C:\Windows\System\ISrpIcs.exe
  C:\Windows\System\ISrpIcs.exe
  2⤵
  PID:5300
- C:\Windows\System\RQZcbhN.exe
  C:\Windows\System\RQZcbhN.exe
  2⤵
  PID:5316
- C:\Windows\System\cfrFFrq.exe
  C:\Windows\System\cfrFFrq.exe
  2⤵
  PID:5396
- C:\Windows\System\OrnNSek.exe
  C:\Windows\System\OrnNSek.exe
  2⤵
  PID:5412
- C:\Windows\System\AYOhpjx.exe
  C:\Windows\System\AYOhpjx.exe
  2⤵
  PID:5428
- C:\Windows\System\iSaBbhM.exe
  C:\Windows\System\iSaBbhM.exe
  2⤵
  PID:5444
- C:\Windows\System\IVHkZbz.exe
  C:\Windows\System\IVHkZbz.exe
  2⤵
  PID:5460
- C:\Windows\System\JMqPBbC.exe
  C:\Windows\System\JMqPBbC.exe
  2⤵
  PID:5476
- C:\Windows\System\BOfrhiU.exe
  C:\Windows\System\BOfrhiU.exe
  2⤵
  PID:5492
- C:\Windows\System\jlzpEnj.exe
  C:\Windows\System\jlzpEnj.exe
  2⤵
  PID:5512
- C:\Windows\System\isktnIX.exe
  C:\Windows\System\isktnIX.exe
  2⤵
  PID:5528
- C:\Windows\System\rNgJhhb.exe
  C:\Windows\System\rNgJhhb.exe
  2⤵
  PID:5544
- C:\Windows\System\DgIGTIC.exe
  C:\Windows\System\DgIGTIC.exe
  2⤵
  PID:5560
- C:\Windows\System\SBPuFey.exe
  C:\Windows\System\SBPuFey.exe
  2⤵
  PID:5576
- C:\Windows\System\BVJxtQK.exe
  C:\Windows\System\BVJxtQK.exe
  2⤵
  PID:5596
- C:\Windows\System\cwFdiYx.exe
  C:\Windows\System\cwFdiYx.exe
  2⤵
  PID:5612
- C:\Windows\System\MHQGxmp.exe
  C:\Windows\System\MHQGxmp.exe
  2⤵
  PID:5628
- C:\Windows\System\iSdtTzZ.exe
  C:\Windows\System\iSdtTzZ.exe
  2⤵
  PID:5644
- C:\Windows\System\AqceECQ.exe
  C:\Windows\System\AqceECQ.exe
  2⤵
  PID:5660
- C:\Windows\System\jMxDacm.exe
  C:\Windows\System\jMxDacm.exe
  2⤵
  PID:5676
- C:\Windows\System\BATOhDS.exe
  C:\Windows\System\BATOhDS.exe
  2⤵
  PID:5692
- C:\Windows\System\sjimKjp.exe
  C:\Windows\System\sjimKjp.exe
  2⤵
  PID:5712
- C:\Windows\System\UEbnDVY.exe
  C:\Windows\System\UEbnDVY.exe
  2⤵
  PID:5728
- C:\Windows\System\WdVfZCO.exe
  C:\Windows\System\WdVfZCO.exe
  2⤵
  PID:5744
- C:\Windows\System\ryDkhMc.exe
  C:\Windows\System\ryDkhMc.exe
  2⤵
  PID:5760
- C:\Windows\System\iklfzbq.exe
  C:\Windows\System\iklfzbq.exe
  2⤵
  PID:5776
- C:\Windows\System\MROCDim.exe
  C:\Windows\System\MROCDim.exe
  2⤵
  PID:5792
- C:\Windows\System\cAzHxeR.exe
  C:\Windows\System\cAzHxeR.exe
  2⤵
  PID:5812
- C:\Windows\System\SjlEadk.exe
  C:\Windows\System\SjlEadk.exe
  2⤵
  PID:5828
- C:\Windows\System\FbnaFHf.exe
  C:\Windows\System\FbnaFHf.exe
  2⤵
  PID:5844
- C:\Windows\System\bLWhboc.exe
  C:\Windows\System\bLWhboc.exe
  2⤵
  PID:5860
- C:\Windows\System\gbDtrEd.exe
  C:\Windows\System\gbDtrEd.exe
  2⤵
  PID:5876
- C:\Windows\System\qPwKrvn.exe
  C:\Windows\System\qPwKrvn.exe
  2⤵
  PID:5892
- C:\Windows\System\LOpzNkK.exe
  C:\Windows\System\LOpzNkK.exe
  2⤵
  PID:5908
- C:\Windows\System\FKMAscV.exe
  C:\Windows\System\FKMAscV.exe
  2⤵
  PID:5924
- C:\Windows\System\sxVIPMN.exe
  C:\Windows\System\sxVIPMN.exe
  2⤵
  PID:5940
- C:\Windows\System\HkkuWAB.exe
  C:\Windows\System\HkkuWAB.exe
  2⤵
  PID:5960
- C:\Windows\System\jGjksxx.exe
  C:\Windows\System\jGjksxx.exe
  2⤵
  PID:5976
- C:\Windows\System\HBTWaMz.exe
  C:\Windows\System\HBTWaMz.exe
  2⤵
  PID:5992
- C:\Windows\System\NOnsidW.exe
  C:\Windows\System\NOnsidW.exe
  2⤵
  PID:6008
- C:\Windows\System\xLyjXUI.exe
  C:\Windows\System\xLyjXUI.exe
  2⤵
  PID:6024
- C:\Windows\System\XopPYYL.exe
  C:\Windows\System\XopPYYL.exe
  2⤵
  PID:6040
- C:\Windows\System\yzncDwa.exe
  C:\Windows\System\yzncDwa.exe
  2⤵
  PID:6092
- C:\Windows\System\tJKciry.exe
  C:\Windows\System\tJKciry.exe
  2⤵
  PID:6108
- C:\Windows\System\AMqoOUf.exe
  C:\Windows\System\AMqoOUf.exe
  2⤵
  PID:6124
- C:\Windows\System\oPqucYr.exe
  C:\Windows\System\oPqucYr.exe
  2⤵
  PID:6140
- C:\Windows\System\NTYwbsH.exe
  C:\Windows\System\NTYwbsH.exe
  2⤵
  PID:3524
- C:\Windows\System\tVdZqQb.exe
  C:\Windows\System\tVdZqQb.exe
  2⤵
  PID:4692
- C:\Windows\System\oGwzQAm.exe
  C:\Windows\System\oGwzQAm.exe
  2⤵
  PID:2684
- C:\Windows\System\gpqyYeo.exe
  C:\Windows\System\gpqyYeo.exe
  2⤵
  PID:588
- C:\Windows\System\gvOWJkF.exe
  C:\Windows\System\gvOWJkF.exe
  2⤵
  PID:5132
- C:\Windows\System\tnNfUZX.exe
  C:\Windows\System\tnNfUZX.exe
  2⤵
  PID:5200
- C:\Windows\System\ggDglqx.exe
  C:\Windows\System\ggDglqx.exe
  2⤵
  PID:5152
- C:\Windows\System\PVXZDfc.exe
  C:\Windows\System\PVXZDfc.exe
  2⤵
  PID:5296
- C:\Windows\System\rFVCcFQ.exe
  C:\Windows\System\rFVCcFQ.exe
  2⤵
  PID:5244
- C:\Windows\System\MiLdwNF.exe
  C:\Windows\System\MiLdwNF.exe
  2⤵
  PID:5276
- C:\Windows\System\cWVBWAp.exe
  C:\Windows\System\cWVBWAp.exe
  2⤵
  PID:5332
- C:\Windows\System\uNPophD.exe
  C:\Windows\System\uNPophD.exe
  2⤵
  PID:5348
- C:\Windows\System\ZTneLaS.exe
  C:\Windows\System\ZTneLaS.exe
  2⤵
  PID:5372
- C:\Windows\System\umyzqjq.exe
  C:\Windows\System\umyzqjq.exe
  2⤵
  PID:5384
- C:\Windows\System\hbqWWOY.exe
  C:\Windows\System\hbqWWOY.exe
  2⤵
  PID:5468
- C:\Windows\System\SzvaCsm.exe
  C:\Windows\System\SzvaCsm.exe
  2⤵
  PID:5536
- C:\Windows\System\omPaiXZ.exe
  C:\Windows\System\omPaiXZ.exe
  2⤵
  PID:5668
- C:\Windows\System\jhwOcAl.exe
  C:\Windows\System\jhwOcAl.exe
  2⤵
  PID:5736
- C:\Windows\System\iafmOps.exe
  C:\Windows\System\iafmOps.exe
  2⤵
  PID:5808
- C:\Windows\System\kZRFnQm.exe
  C:\Windows\System\kZRFnQm.exe
  2⤵
  PID:5872
- C:\Windows\System\oTDSXPt.exe
  C:\Windows\System\oTDSXPt.exe
  2⤵
  PID:5936
- C:\Windows\System\dVVGnlX.exe
  C:\Windows\System\dVVGnlX.exe
  2⤵
  PID:5456
- C:\Windows\System\JVLTRsB.exe
  C:\Windows\System\JVLTRsB.exe
  2⤵
  PID:6016
- C:\Windows\System\mAMCdPw.exe
  C:\Windows\System\mAMCdPw.exe
  2⤵
  PID:5952
- C:\Windows\System\odopbeD.exe
  C:\Windows\System\odopbeD.exe
  2⤵
  PID:5888
- C:\Windows\System\qysJTKt.exe
  C:\Windows\System\qysJTKt.exe
  2⤵
  PID:5824
- C:\Windows\System\NqmBktY.exe
  C:\Windows\System\NqmBktY.exe
  2⤵
  PID:5756
- C:\Windows\System\dbrxYtI.exe
  C:\Windows\System\dbrxYtI.exe
  2⤵
  PID:5688
- C:\Windows\System\osVPDHr.exe
  C:\Windows\System\osVPDHr.exe
  2⤵
  PID:5624
- C:\Windows\System\flnDzpJ.exe
  C:\Windows\System\flnDzpJ.exe
  2⤵
  PID:5584
- C:\Windows\System\QaQBWuT.exe
  C:\Windows\System\QaQBWuT.exe
  2⤵
  PID:5520
- C:\Windows\System\ejukuuE.exe
  C:\Windows\System\ejukuuE.exe
  2⤵
  PID:6056
- C:\Windows\System\UoRfXPo.exe
  C:\Windows\System\UoRfXPo.exe
  2⤵
  PID:5124
- C:\Windows\System\nVZutoP.exe
  C:\Windows\System\nVZutoP.exe
  2⤵
  PID:6088
- C:\Windows\System\iEeRFfy.exe
  C:\Windows\System\iEeRFfy.exe
  2⤵
  PID:6084
- C:\Windows\System\HzZsMHc.exe
  C:\Windows\System\HzZsMHc.exe
  2⤵
  PID:5260
- C:\Windows\System\KBJirmi.exe
  C:\Windows\System\KBJirmi.exe
  2⤵
  PID:5216
- C:\Windows\System\pqRIlTC.exe
  C:\Windows\System\pqRIlTC.exe
  2⤵
  PID:2672
- C:\Windows\System\JDxDaOV.exe
  C:\Windows\System\JDxDaOV.exe
  2⤵
  PID:5212
- C:\Windows\System\gmZZqjJ.exe
  C:\Windows\System\gmZZqjJ.exe
  2⤵
  PID:5380
- C:\Windows\System\HiBbjqx.exe
  C:\Windows\System\HiBbjqx.exe
  2⤵
  PID:2988
- C:\Windows\System\lCCgkoz.exe
  C:\Windows\System\lCCgkoz.exe
  2⤵
  PID:5168
- C:\Windows\System\xqLisLD.exe
  C:\Windows\System\xqLisLD.exe
  2⤵
  PID:5280
- C:\Windows\System\JNCrlpw.exe
  C:\Windows\System\JNCrlpw.exe
  2⤵
  PID:5440
- C:\Windows\System\FBzBQoO.exe
  C:\Windows\System\FBzBQoO.exe
  2⤵
  PID:5608
- C:\Windows\System\yBFurel.exe
  C:\Windows\System\yBFurel.exe
  2⤵
  PID:5772
- C:\Windows\System\NSVxhrC.exe
  C:\Windows\System\NSVxhrC.exe
  2⤵
  PID:5504
- C:\Windows\System\MhrNAQQ.exe
  C:\Windows\System\MhrNAQQ.exe
  2⤵
  PID:5840
- C:\Windows\System\bVIkEvT.exe
  C:\Windows\System\bVIkEvT.exe
  2⤵
  PID:6032
- C:\Windows\System\NAIMrBn.exe
  C:\Windows\System\NAIMrBn.exe
  2⤵
  PID:5424
- C:\Windows\System\emutooW.exe
  C:\Windows\System\emutooW.exe
  2⤵
  PID:5984
- C:\Windows\System\aiatrXl.exe
  C:\Windows\System\aiatrXl.exe
  2⤵
  PID:5920
- C:\Windows\System\jGSWBdP.exe
  C:\Windows\System\jGSWBdP.exe
  2⤵
  PID:5784
- C:\Windows\System\JLeIUMV.exe
  C:\Windows\System\JLeIUMV.exe
  2⤵
  PID:5524
- C:\Windows\System\vNokqjt.exe
  C:\Windows\System\vNokqjt.exe
  2⤵
  PID:6104
- C:\Windows\System\tPTYxAI.exe
  C:\Windows\System\tPTYxAI.exe
  2⤵
  PID:5328
- C:\Windows\System\PDlnWyq.exe
  C:\Windows\System\PDlnWyq.exe
  2⤵
  PID:6076
- C:\Windows\System\wXnUHMs.exe
  C:\Windows\System\wXnUHMs.exe
  2⤵
  PID:6136
- C:\Windows\System\MBgpqeE.exe
  C:\Windows\System\MBgpqeE.exe
  2⤵
  PID:5128
- C:\Windows\System\ZiDhrzM.exe
  C:\Windows\System\ZiDhrzM.exe
  2⤵
  PID:5604
- C:\Windows\System\AsTGrhL.exe
  C:\Windows\System\AsTGrhL.exe
  2⤵
  PID:4964
- C:\Windows\System\SsqyWGZ.exe
  C:\Windows\System\SsqyWGZ.exe
  2⤵
  PID:5356
- C:\Windows\System\mSrcWlZ.exe
  C:\Windows\System\mSrcWlZ.exe
  2⤵
  PID:5904
- C:\Windows\System\wyYUnmK.exe
  C:\Windows\System\wyYUnmK.exe
  2⤵
  PID:5420
- C:\Windows\System\DaUJBFd.exe
  C:\Windows\System\DaUJBFd.exe
  2⤵
  PID:5788
- C:\Windows\System\bgxzlvj.exe
  C:\Windows\System\bgxzlvj.exe
  2⤵
  PID:4612
- C:\Windows\System\HxFQbqe.exe
  C:\Windows\System\HxFQbqe.exe
  2⤵
  PID:6068
- C:\Windows\System\BdDtClh.exe
  C:\Windows\System\BdDtClh.exe
  2⤵
  PID:5704
- C:\Windows\System\rpJgiwm.exe
  C:\Windows\System\rpJgiwm.exe
  2⤵
  PID:6156
- C:\Windows\System\rocHrFT.exe
  C:\Windows\System\rocHrFT.exe
  2⤵
  PID:6172
- C:\Windows\System\faDguaY.exe
  C:\Windows\System\faDguaY.exe
  2⤵
  PID:6188
- C:\Windows\System\onMaOXn.exe
  C:\Windows\System\onMaOXn.exe
  2⤵
  PID:6208
- C:\Windows\System\rCAnCST.exe
  C:\Windows\System\rCAnCST.exe
  2⤵
  PID:6224
- C:\Windows\System\FGjclDh.exe
  C:\Windows\System\FGjclDh.exe
  2⤵
  PID:6240
- C:\Windows\System\BoZgjVB.exe
  C:\Windows\System\BoZgjVB.exe
  2⤵
  PID:6256
- C:\Windows\System\gqMXfgt.exe
  C:\Windows\System\gqMXfgt.exe
  2⤵
  PID:6276
- C:\Windows\System\RAVZEIX.exe
  C:\Windows\System\RAVZEIX.exe
  2⤵
  PID:6292
- C:\Windows\System\ERNXBvb.exe
  C:\Windows\System\ERNXBvb.exe
  2⤵
  PID:6312
- C:\Windows\System\wcSkyMQ.exe
  C:\Windows\System\wcSkyMQ.exe
  2⤵
  PID:6332
- C:\Windows\System\ARGVqbF.exe
  C:\Windows\System\ARGVqbF.exe
  2⤵
  PID:6348
- C:\Windows\System\DEVnjvb.exe
  C:\Windows\System\DEVnjvb.exe
  2⤵
  PID:6364
- C:\Windows\System\oclUlLZ.exe
  C:\Windows\System\oclUlLZ.exe
  2⤵
  PID:6380
- C:\Windows\System\DMcKBNi.exe
  C:\Windows\System\DMcKBNi.exe
  2⤵
  PID:6396
- C:\Windows\System\gnAwPSr.exe
  C:\Windows\System\gnAwPSr.exe
  2⤵
  PID:6412
- C:\Windows\System\OeAmGxr.exe
  C:\Windows\System\OeAmGxr.exe
  2⤵
  PID:6428
- C:\Windows\System\AQABTKr.exe
  C:\Windows\System\AQABTKr.exe
  2⤵
  PID:6444
- C:\Windows\System\wvPshcB.exe
  C:\Windows\System\wvPshcB.exe
  2⤵
  PID:6460
- C:\Windows\System\NRxEFvq.exe
  C:\Windows\System\NRxEFvq.exe
  2⤵
  PID:6476
- C:\Windows\System\VeyPdzs.exe
  C:\Windows\System\VeyPdzs.exe
  2⤵
  PID:6492
- C:\Windows\System\vPZiCxt.exe
  C:\Windows\System\vPZiCxt.exe
  2⤵
  PID:6508
- C:\Windows\System\rNNzXoi.exe
  C:\Windows\System\rNNzXoi.exe
  2⤵
  PID:6524
- C:\Windows\System\lxYXLiO.exe
  C:\Windows\System\lxYXLiO.exe
  2⤵
  PID:6544
- C:\Windows\System\KXJAImZ.exe
  C:\Windows\System\KXJAImZ.exe
  2⤵
  PID:6560
- C:\Windows\System\pirKoXP.exe
  C:\Windows\System\pirKoXP.exe
  2⤵
  PID:6576
- C:\Windows\System\yeaawKH.exe
  C:\Windows\System\yeaawKH.exe
  2⤵
  PID:6592
- C:\Windows\System\ZHxdtvA.exe
  C:\Windows\System\ZHxdtvA.exe
  2⤵
  PID:6608
- C:\Windows\System\JXrrcGi.exe
  C:\Windows\System\JXrrcGi.exe
  2⤵
  PID:6624
- C:\Windows\System\lZyTJZo.exe
  C:\Windows\System\lZyTJZo.exe
  2⤵
  PID:6640
- C:\Windows\System\fTJvzZh.exe
  C:\Windows\System\fTJvzZh.exe
  2⤵
  PID:6656
- C:\Windows\System\khbErKL.exe
  C:\Windows\System\khbErKL.exe
  2⤵
  PID:6672
- C:\Windows\System\KGVPOSy.exe
  C:\Windows\System\KGVPOSy.exe
  2⤵
  PID:6688
- C:\Windows\System\RHrXcUj.exe
  C:\Windows\System\RHrXcUj.exe
  2⤵
  PID:6704
- C:\Windows\System\eCBuund.exe
  C:\Windows\System\eCBuund.exe
  2⤵
  PID:6720
- C:\Windows\System\HvMdQgw.exe
  C:\Windows\System\HvMdQgw.exe
  2⤵
  PID:6736
- C:\Windows\System\TVSATKi.exe
  C:\Windows\System\TVSATKi.exe
  2⤵
  PID:6752
- C:\Windows\System\nmkiLfz.exe
  C:\Windows\System\nmkiLfz.exe
  2⤵
  PID:6768
- C:\Windows\System\LdvxRyd.exe
  C:\Windows\System\LdvxRyd.exe
  2⤵
  PID:6784
- C:\Windows\System\SOapzVv.exe
  C:\Windows\System\SOapzVv.exe
  2⤵
  PID:6800
- C:\Windows\System\BvJDbEs.exe
  C:\Windows\System\BvJDbEs.exe
  2⤵
  PID:6816
- C:\Windows\System\NSJPkdl.exe
  C:\Windows\System\NSJPkdl.exe
  2⤵
  PID:6832
- C:\Windows\System\IduLvYg.exe
  C:\Windows\System\IduLvYg.exe
  2⤵
  PID:6848
- C:\Windows\System\CBucAdQ.exe
  C:\Windows\System\CBucAdQ.exe
  2⤵
  PID:6864
- C:\Windows\System\JkRIFNu.exe
  C:\Windows\System\JkRIFNu.exe
  2⤵
  PID:6880
- C:\Windows\System\qsFORSf.exe
  C:\Windows\System\qsFORSf.exe
  2⤵
  PID:6896
- C:\Windows\System\ZstnqlX.exe
  C:\Windows\System\ZstnqlX.exe
  2⤵
  PID:6912
- C:\Windows\System\byuxIkE.exe
  C:\Windows\System\byuxIkE.exe
  2⤵
  PID:6928
- C:\Windows\System\jMFJueD.exe
  C:\Windows\System\jMFJueD.exe
  2⤵
  PID:6944
- C:\Windows\System\PiVVcfE.exe
  C:\Windows\System\PiVVcfE.exe
  2⤵
  PID:6960
- C:\Windows\System\xjzPVsW.exe
  C:\Windows\System\xjzPVsW.exe
  2⤵
  PID:6976
- C:\Windows\System\JTWDPXl.exe
  C:\Windows\System\JTWDPXl.exe
  2⤵
  PID:6992
- C:\Windows\System\gWhuJKx.exe
  C:\Windows\System\gWhuJKx.exe
  2⤵
  PID:7052
- C:\Windows\System\yHazpAo.exe
  C:\Windows\System\yHazpAo.exe
  2⤵
  PID:7076
- C:\Windows\System\GOzSqAP.exe
  C:\Windows\System\GOzSqAP.exe
  2⤵
  PID:7092
- C:\Windows\System\XcECOdJ.exe
  C:\Windows\System\XcECOdJ.exe
  2⤵
  PID:7108
- C:\Windows\System\NYTXlri.exe
  C:\Windows\System\NYTXlri.exe
  2⤵
  PID:7124
- C:\Windows\System\MnPPtXF.exe
  C:\Windows\System\MnPPtXF.exe
  2⤵
  PID:7140
- C:\Windows\System\RrGOeIw.exe
  C:\Windows\System\RrGOeIw.exe
  2⤵
  PID:7160
- C:\Windows\System\CgbVymv.exe
  C:\Windows\System\CgbVymv.exe
  2⤵
  PID:6148
- C:\Windows\System\vuFAWZy.exe
  C:\Windows\System\vuFAWZy.exe
  2⤵
  PID:6248
- C:\Windows\System\Jpeoquk.exe
  C:\Windows\System\Jpeoquk.exe
  2⤵
  PID:6320
- C:\Windows\System\aAqUjIT.exe
  C:\Windows\System\aAqUjIT.exe
  2⤵
  PID:6572
- C:\Windows\System\LRCqHvm.exe
  C:\Windows\System\LRCqHvm.exe
  2⤵
  PID:5572
- C:\Windows\System\JKPyAYh.exe
  C:\Windows\System\JKPyAYh.exe
  2⤵
  PID:5972
- C:\Windows\System\ZmRFFjw.exe
  C:\Windows\System\ZmRFFjw.exe
  2⤵
  PID:1136
- C:\Windows\System\vRaFGFQ.exe
  C:\Windows\System\vRaFGFQ.exe
  2⤵
  PID:6204
- C:\Windows\System\YDSgbIc.exe
  C:\Windows\System\YDSgbIc.exe
  2⤵
  PID:6344
- C:\Windows\System\rXWqHNi.exe
  C:\Windows\System\rXWqHNi.exe
  2⤵
  PID:6620
- C:\Windows\System\BNOIfOY.exe
  C:\Windows\System\BNOIfOY.exe
  2⤵
  PID:6636
- C:\Windows\System\eQluEbv.exe
  C:\Windows\System\eQluEbv.exe
  2⤵
  PID:6540
- C:\Windows\System\vAajoxo.exe
  C:\Windows\System\vAajoxo.exe
  2⤵
  PID:6744
- C:\Windows\System\xrefXad.exe
  C:\Windows\System\xrefXad.exe
  2⤵
  PID:6664
- C:\Windows\System\cYuZkkx.exe
  C:\Windows\System\cYuZkkx.exe
  2⤵
  PID:6812
- C:\Windows\System\AmZHeMt.exe
  C:\Windows\System\AmZHeMt.exe
  2⤵
  PID:6908
- C:\Windows\System\SfqbGDe.exe
  C:\Windows\System\SfqbGDe.exe
  2⤵
  PID:6972
- C:\Windows\System\DPBKOfa.exe
  C:\Windows\System\DPBKOfa.exe
  2⤵
  PID:6696
- C:\Windows\System\wsfqDGG.exe
  C:\Windows\System\wsfqDGG.exe
  2⤵
  PID:6764
- C:\Windows\System\cyRCVHK.exe
  C:\Windows\System\cyRCVHK.exe
  2⤵
  PID:6860
- C:\Windows\System\NCgsWbd.exe
  C:\Windows\System\NCgsWbd.exe
  2⤵
  PID:6924
- C:\Windows\System\gfteaKy.exe
  C:\Windows\System\gfteaKy.exe
  2⤵
  PID:6988
- C:\Windows\System\BzKBWaG.exe
  C:\Windows\System\BzKBWaG.exe
  2⤵
  PID:7020
- C:\Windows\System\wJkqPTW.exe
  C:\Windows\System\wJkqPTW.exe
  2⤵
  PID:7036
- C:\Windows\System\HQKdtOq.exe
  C:\Windows\System\HQKdtOq.exe
  2⤵
  PID:7064
- C:\Windows\System\afvzirF.exe
  C:\Windows\System\afvzirF.exe
  2⤵
  PID:7104
- C:\Windows\System\aeafTlc.exe
  C:\Windows\System\aeafTlc.exe
  2⤵
  PID:6288
- C:\Windows\System\BXoscER.exe
  C:\Windows\System\BXoscER.exe
  2⤵
  PID:7120
- C:\Windows\System\OYjGRFv.exe
  C:\Windows\System\OYjGRFv.exe
  2⤵
  PID:6180
- C:\Windows\System\aQOZGey.exe
  C:\Windows\System\aQOZGey.exe
  2⤵
  PID:6220
- C:\Windows\System\YPGLofZ.exe
  C:\Windows\System\YPGLofZ.exe
  2⤵
  PID:6360
- C:\Windows\System\GmqgtIb.exe
  C:\Windows\System\GmqgtIb.exe
  2⤵
  PID:6424
- C:\Windows\System\bmHLxJv.exe
  C:\Windows\System\bmHLxJv.exe
  2⤵
  PID:6168
- C:\Windows\System\YvQAJHj.exe
  C:\Windows\System\YvQAJHj.exe
  2⤵
  PID:6484
- C:\Windows\System\CnCkPyv.exe
  C:\Windows\System\CnCkPyv.exe
  2⤵
  PID:6520
- C:\Windows\System\PBoJRIy.exe
  C:\Windows\System\PBoJRIy.exe
  2⤵
  PID:6556
- C:\Windows\System\qgzBiIa.exe
  C:\Windows\System\qgzBiIa.exe
  2⤵
  PID:5552
- C:\Windows\System\yGyfXzr.exe
  C:\Windows\System\yGyfXzr.exe
  2⤵
  PID:5376
- C:\Windows\System\GGLESzf.exe
  C:\Windows\System\GGLESzf.exe
  2⤵
  PID:6264
- C:\Windows\System\ZFnKZIx.exe
  C:\Windows\System\ZFnKZIx.exe
  2⤵
  PID:6308
- C:\Windows\System\xbszzJA.exe
  C:\Windows\System\xbszzJA.exe
  2⤵
  PID:5404
- C:\Windows\System\EEkTNov.exe
  C:\Windows\System\EEkTNov.exe
  2⤵
  PID:6196
- C:\Windows\System\osBuoyQ.exe
  C:\Windows\System\osBuoyQ.exe
  2⤵
  PID:6536
- C:\Windows\System\XaPjPfA.exe
  C:\Windows\System\XaPjPfA.exe
  2⤵
  PID:6844
- C:\Windows\System\rswdcMd.exe
  C:\Windows\System\rswdcMd.exe
  2⤵
  PID:6616
- C:\Windows\System\cAicWYU.exe
  C:\Windows\System\cAicWYU.exe
  2⤵
  PID:7000
- C:\Windows\System\BMoRMuZ.exe
  C:\Windows\System\BMoRMuZ.exe
  2⤵
  PID:6856
- C:\Windows\System\FyebYXP.exe
  C:\Windows\System\FyebYXP.exe
  2⤵
  PID:7072
- C:\Windows\System\XPaWJXW.exe
  C:\Windows\System\XPaWJXW.exe
  2⤵
  PID:7028
- C:\Windows\System\LHsKAll.exe
  C:\Windows\System\LHsKAll.exe
  2⤵
  PID:5856
- C:\Windows\System\aGaTsIy.exe
  C:\Windows\System\aGaTsIy.exe
  2⤵
  PID:6236
- C:\Windows\System\DZQdxPP.exe
  C:\Windows\System\DZQdxPP.exe
  2⤵
  PID:6080
- C:\Windows\System\NWTCxgM.exe
  C:\Windows\System\NWTCxgM.exe
  2⤵
  PID:5344
- C:\Windows\System\eAYzNEW.exe
  C:\Windows\System\eAYzNEW.exe
  2⤵
  PID:6808
- C:\Windows\System\CWNMacI.exe
  C:\Windows\System\CWNMacI.exe
  2⤵
  PID:1572
- C:\Windows\System\LKjkTET.exe
  C:\Windows\System\LKjkTET.exe
  2⤵
  PID:6920
- C:\Windows\System\pmGtqAw.exe
  C:\Windows\System\pmGtqAw.exe
  2⤵
  PID:6216
- C:\Windows\System\LlHXodM.exe
  C:\Windows\System\LlHXodM.exe
  2⤵
  PID:6164
- C:\Windows\System\LCWawZq.exe
  C:\Windows\System\LCWawZq.exe
  2⤵
  PID:5652
- C:\Windows\System\rJTngyQ.exe
  C:\Windows\System\rJTngyQ.exe
  2⤵
  PID:6468
- C:\Windows\System\KPqcTGf.exe
  C:\Windows\System\KPqcTGf.exe
  2⤵
  PID:5708
- C:\Windows\System\RbMLkxk.exe
  C:\Windows\System\RbMLkxk.exe
  2⤵
  PID:6064
- C:\Windows\System\XDrULbl.exe
  C:\Windows\System\XDrULbl.exe
  2⤵
  PID:6632
- C:\Windows\System\tezRlSC.exe
  C:\Windows\System\tezRlSC.exe
  2⤵
  PID:7008
- C:\Windows\System\YUCSuCX.exe
  C:\Windows\System\YUCSuCX.exe
  2⤵
  PID:7132
- C:\Windows\System\UiAsSPw.exe
  C:\Windows\System\UiAsSPw.exe
  2⤵
  PID:6304
- C:\Windows\System\dUyIkOR.exe
  C:\Windows\System\dUyIkOR.exe
  2⤵
  PID:5292
- C:\Windows\System\QlbUdLP.exe
  C:\Windows\System\QlbUdLP.exe
  2⤵
  PID:7116
- C:\Windows\System\qSTNwsH.exe
  C:\Windows\System\qSTNwsH.exe
  2⤵
  PID:6716
- C:\Windows\System\ChOEfty.exe
  C:\Windows\System\ChOEfty.exe
  2⤵
  PID:5700
- C:\Windows\System\hBVAXsJ.exe
  C:\Windows\System\hBVAXsJ.exe
  2⤵
  PID:6668
- C:\Windows\System\cVcEhHX.exe
  C:\Windows\System\cVcEhHX.exe
  2⤵
  PID:6780
- C:\Windows\System\kvHwwxY.exe
  C:\Windows\System\kvHwwxY.exe
  2⤵
  PID:6532
- C:\Windows\System\ZkRKrDx.exe
  C:\Windows\System\ZkRKrDx.exe
  2⤵
  PID:6824
- C:\Windows\System\HWSemmg.exe
  C:\Windows\System\HWSemmg.exe
  2⤵
  PID:6728
- C:\Windows\System\SXpwbCT.exe
  C:\Windows\System\SXpwbCT.exe
  2⤵
  PID:5640
- C:\Windows\System\qOnadym.exe
  C:\Windows\System\qOnadym.exe
  2⤵
  PID:7044
- C:\Windows\System\kKEYXIi.exe
  C:\Windows\System\kKEYXIi.exe
  2⤵
  PID:7176
- C:\Windows\System\UQSchhT.exe
  C:\Windows\System\UQSchhT.exe
  2⤵
  PID:7192
- C:\Windows\System\uppTYyp.exe
  C:\Windows\System\uppTYyp.exe
  2⤵
  PID:7208
- C:\Windows\System\WymhkfJ.exe
  C:\Windows\System\WymhkfJ.exe
  2⤵
  PID:7224
- C:\Windows\System\gjXbttt.exe
  C:\Windows\System\gjXbttt.exe
  2⤵
  PID:7240
- C:\Windows\System\TUQruee.exe
  C:\Windows\System\TUQruee.exe
  2⤵
  PID:7256
- C:\Windows\System\zqaenpZ.exe
  C:\Windows\System\zqaenpZ.exe
  2⤵
  PID:7272
- C:\Windows\System\LJDCsrW.exe
  C:\Windows\System\LJDCsrW.exe
  2⤵
  PID:7288
- C:\Windows\System\ZTyuUtz.exe
  C:\Windows\System\ZTyuUtz.exe
  2⤵
  PID:7304
- C:\Windows\System\Dnqrcpm.exe
  C:\Windows\System\Dnqrcpm.exe
  2⤵
  PID:7320
- C:\Windows\System\pEIhJgz.exe
  C:\Windows\System\pEIhJgz.exe
  2⤵
  PID:7336
- C:\Windows\System\omABTPw.exe
  C:\Windows\System\omABTPw.exe
  2⤵
  PID:7352
- C:\Windows\System\htGJadv.exe
  C:\Windows\System\htGJadv.exe
  2⤵
  PID:7368
- C:\Windows\System\AcwsNaa.exe
  C:\Windows\System\AcwsNaa.exe
  2⤵
  PID:7384
- C:\Windows\System\hzHxSNH.exe
  C:\Windows\System\hzHxSNH.exe
  2⤵
  PID:7400
- C:\Windows\System\wnFfevZ.exe
  C:\Windows\System\wnFfevZ.exe
  2⤵
  PID:7416
- C:\Windows\System\hAaVlTw.exe
  C:\Windows\System\hAaVlTw.exe
  2⤵
  PID:7432
- C:\Windows\System\DWzCIqj.exe
  C:\Windows\System\DWzCIqj.exe
  2⤵
  PID:7448
- C:\Windows\System\KngoKqA.exe
  C:\Windows\System\KngoKqA.exe
  2⤵
  PID:7464
- C:\Windows\System\RnaruTT.exe
  C:\Windows\System\RnaruTT.exe
  2⤵
  PID:7480
- C:\Windows\System\TAmrlqt.exe
  C:\Windows\System\TAmrlqt.exe
  2⤵
  PID:7496
- C:\Windows\System\SMaEJlQ.exe
  C:\Windows\System\SMaEJlQ.exe
  2⤵
  PID:7512
- C:\Windows\System\XxnfpzZ.exe
  C:\Windows\System\XxnfpzZ.exe
  2⤵
  PID:7528
- C:\Windows\System\mDRYcUx.exe
  C:\Windows\System\mDRYcUx.exe
  2⤵
  PID:7544
- C:\Windows\System\oYvGkQj.exe
  C:\Windows\System\oYvGkQj.exe
  2⤵
  PID:7560
- C:\Windows\System\tVeGDWI.exe
  C:\Windows\System\tVeGDWI.exe
  2⤵
  PID:7576
- C:\Windows\System\gNrscmo.exe
  C:\Windows\System\gNrscmo.exe
  2⤵
  PID:7592
- C:\Windows\System\paImzej.exe
  C:\Windows\System\paImzej.exe
  2⤵
  PID:7608
- C:\Windows\System\qsZgXZM.exe
  C:\Windows\System\qsZgXZM.exe
  2⤵
  PID:7624
- C:\Windows\System\Jozfqqg.exe
  C:\Windows\System\Jozfqqg.exe
  2⤵
  PID:7640
- C:\Windows\System\zGfJrch.exe
  C:\Windows\System\zGfJrch.exe
  2⤵
  PID:7656
- C:\Windows\System\FysaEqY.exe
  C:\Windows\System\FysaEqY.exe
  2⤵
  PID:7672
- C:\Windows\System\XEYmzZe.exe
  C:\Windows\System\XEYmzZe.exe
  2⤵
  PID:7688
- C:\Windows\System\yGMFTqZ.exe
  C:\Windows\System\yGMFTqZ.exe
  2⤵
  PID:7708
- C:\Windows\System\LXrMgpB.exe
  C:\Windows\System\LXrMgpB.exe
  2⤵
  PID:7724
- C:\Windows\System\jsOMQyG.exe
  C:\Windows\System\jsOMQyG.exe
  2⤵
  PID:7740
- C:\Windows\System\fnxlyEI.exe
  C:\Windows\System\fnxlyEI.exe
  2⤵
  PID:7756
- C:\Windows\System\lykFLmq.exe
  C:\Windows\System\lykFLmq.exe
  2⤵
  PID:7772
- C:\Windows\System\IELOhNw.exe
  C:\Windows\System\IELOhNw.exe
  2⤵
  PID:7792
- C:\Windows\System\nkbgMvn.exe
  C:\Windows\System\nkbgMvn.exe
  2⤵
  PID:7808
- C:\Windows\System\AfnYJHG.exe
  C:\Windows\System\AfnYJHG.exe
  2⤵
  PID:7824
- C:\Windows\System\jqcBYgw.exe
  C:\Windows\System\jqcBYgw.exe
  2⤵
  PID:7840
- C:\Windows\System\XRuiNfz.exe
  C:\Windows\System\XRuiNfz.exe
  2⤵
  PID:7856
- C:\Windows\System\sTRMrwJ.exe
  C:\Windows\System\sTRMrwJ.exe
  2⤵
  PID:7872
- C:\Windows\System\mGnBtLs.exe
  C:\Windows\System\mGnBtLs.exe
  2⤵
  PID:7888
- C:\Windows\System\ffVgYKi.exe
  C:\Windows\System\ffVgYKi.exe
  2⤵
  PID:7904
- C:\Windows\System\bDOcSNr.exe
  C:\Windows\System\bDOcSNr.exe
  2⤵
  PID:7920
- C:\Windows\System\rnjrUpV.exe
  C:\Windows\System\rnjrUpV.exe
  2⤵
  PID:7936
- C:\Windows\System\sYZHfYn.exe
  C:\Windows\System\sYZHfYn.exe
  2⤵
  PID:7952
- C:\Windows\System\APZActl.exe
  C:\Windows\System\APZActl.exe
  2⤵
  PID:7968
- C:\Windows\System\KVueHfp.exe
  C:\Windows\System\KVueHfp.exe
  2⤵
  PID:7984
- C:\Windows\System\xLVrMWt.exe
  C:\Windows\System\xLVrMWt.exe
  2⤵
  PID:8000
- C:\Windows\System\tTKZhom.exe
  C:\Windows\System\tTKZhom.exe
  2⤵
  PID:8016
- C:\Windows\System\RbOgfqL.exe
  C:\Windows\System\RbOgfqL.exe
  2⤵
  PID:8032
- C:\Windows\System\RhEfLfV.exe
  C:\Windows\System\RhEfLfV.exe
  2⤵
  PID:8048
- C:\Windows\System\yLKNXXh.exe
  C:\Windows\System\yLKNXXh.exe
  2⤵
  PID:8064
- C:\Windows\System\OTRGzjp.exe
  C:\Windows\System\OTRGzjp.exe
  2⤵
  PID:8080
- C:\Windows\System\WQyZYgS.exe
  C:\Windows\System\WQyZYgS.exe
  2⤵
  PID:8096
- C:\Windows\System\eNPhjjf.exe
  C:\Windows\System\eNPhjjf.exe
  2⤵
  PID:8112
- C:\Windows\System\WMplarF.exe
  C:\Windows\System\WMplarF.exe
  2⤵
  PID:8128
- C:\Windows\System\gnjTOvA.exe
  C:\Windows\System\gnjTOvA.exe
  2⤵
  PID:8144
- C:\Windows\System\ViVFfuH.exe
  C:\Windows\System\ViVFfuH.exe
  2⤵
  PID:8160
- C:\Windows\System\pYhOntO.exe
  C:\Windows\System\pYhOntO.exe
  2⤵
  PID:8176
- C:\Windows\System\jZPqYwJ.exe
  C:\Windows\System\jZPqYwJ.exe
  2⤵
  PID:6356
- C:\Windows\System\armtgPS.exe
  C:\Windows\System\armtgPS.exe
  2⤵
  PID:7232
- C:\Windows\System\uNjRuYl.exe
  C:\Windows\System\uNjRuYl.exe
  2⤵
  PID:7156
- C:\Windows\System\okoeWgm.exe
  C:\Windows\System\okoeWgm.exe
  2⤵
  PID:6588
- C:\Windows\System\CtSeDby.exe
  C:\Windows\System\CtSeDby.exe
  2⤵
  PID:7296
- C:\Windows\System\KbjNfVM.exe
  C:\Windows\System\KbjNfVM.exe
  2⤵
  PID:7248
- C:\Windows\System\SSdofLI.exe
  C:\Windows\System\SSdofLI.exe
  2⤵
  PID:7220
- C:\Windows\System\CszJaTZ.exe
  C:\Windows\System\CszJaTZ.exe
  2⤵
  PID:7280
- C:\Windows\System\mczxVhX.exe
  C:\Windows\System\mczxVhX.exe
  2⤵
  PID:7396
- C:\Windows\System\NtLNqYn.exe
  C:\Windows\System\NtLNqYn.exe
  2⤵
  PID:7456
- C:\Windows\System\GXMKeaC.exe
  C:\Windows\System\GXMKeaC.exe
  2⤵
  PID:7412
- C:\Windows\System\kkKTiYo.exe
  C:\Windows\System\kkKTiYo.exe
  2⤵
  PID:7376
- C:\Windows\System\EjGtSco.exe
  C:\Windows\System\EjGtSco.exe
  2⤵
  PID:7476
- C:\Windows\System\FXPMBmk.exe
  C:\Windows\System\FXPMBmk.exe
  2⤵
  PID:7524
- C:\Windows\System\GFGwXMx.exe
  C:\Windows\System\GFGwXMx.exe
  2⤵
  PID:7588
- C:\Windows\System\tffdFbf.exe
  C:\Windows\System\tffdFbf.exe
  2⤵
  PID:7504
- C:\Windows\System\jDBZaAD.exe
  C:\Windows\System\jDBZaAD.exe
  2⤵
  PID:7572
- C:\Windows\System\wOHlCYh.exe
  C:\Windows\System\wOHlCYh.exe
  2⤵
  PID:7652
- C:\Windows\System\QgeOGgV.exe
  C:\Windows\System\QgeOGgV.exe
  2⤵
  PID:7720
- C:\Windows\System\ocoehuR.exe
  C:\Windows\System\ocoehuR.exe
  2⤵
  PID:7788
- C:\Windows\System\JYVoYie.exe
  C:\Windows\System\JYVoYie.exe
  2⤵
  PID:7636
- C:\Windows\System\bNHPzQL.exe
  C:\Windows\System\bNHPzQL.exe
  2⤵
  PID:7884
- C:\Windows\System\tMbolvA.exe
  C:\Windows\System\tMbolvA.exe
  2⤵
  PID:7944
- C:\Windows\System\RIegmHO.exe
  C:\Windows\System\RIegmHO.exe
  2⤵
  PID:7704
- C:\Windows\System\uDthZqd.exe
  C:\Windows\System\uDthZqd.exe
  2⤵
  PID:7768
- C:\Windows\System\OpoqXuy.exe
  C:\Windows\System\OpoqXuy.exe
  2⤵
  PID:7836
- C:\Windows\System\QcyeAuh.exe
  C:\Windows\System\QcyeAuh.exe
  2⤵
  PID:8008
- C:\Windows\System\JKKIisQ.exe
  C:\Windows\System\JKKIisQ.exe
  2⤵
  PID:8012
- C:\Windows\System\yffgAIo.exe
  C:\Windows\System\yffgAIo.exe
  2⤵
  PID:8076
- C:\Windows\System\lcnjwJZ.exe
  C:\Windows\System\lcnjwJZ.exe
  2⤵
  PID:7992
- C:\Windows\System\gPdrpPe.exe
  C:\Windows\System\gPdrpPe.exe
  2⤵
  PID:8168
- C:\Windows\System\ldPmXlV.exe
  C:\Windows\System\ldPmXlV.exe
  2⤵
  PID:7204
- C:\Windows\System\lRbhfuP.exe
  C:\Windows\System\lRbhfuP.exe
  2⤵
  PID:8056
- C:\Windows\System\EuqvwqK.exe
  C:\Windows\System\EuqvwqK.exe
  2⤵
  PID:8088
- C:\Windows\System\IpnfeEF.exe
  C:\Windows\System\IpnfeEF.exe
  2⤵
  PID:8152
- C:\Windows\System\WgrLfaQ.exe
  C:\Windows\System\WgrLfaQ.exe
  2⤵
  PID:7236
- C:\Windows\System\KEeFrxo.exe
  C:\Windows\System\KEeFrxo.exe
  2⤵
  PID:6300
- C:\Windows\System\fjUigCj.exe
  C:\Windows\System\fjUigCj.exe
  2⤵
  PID:7252
- C:\Windows\System\zuJZoBp.exe
  C:\Windows\System\zuJZoBp.exe
  2⤵
  PID:7424
- C:\Windows\System\oSOfqQg.exe
  C:\Windows\System\oSOfqQg.exe
  2⤵
  PID:7408
- C:\Windows\System\LCBYPwP.exe
  C:\Windows\System\LCBYPwP.exe
  2⤵
  PID:7472
- C:\Windows\System\WFiRWOB.exe
  C:\Windows\System\WFiRWOB.exe
  2⤵
  PID:7648
- C:\Windows\System\wjVnNnI.exe
  C:\Windows\System\wjVnNnI.exe
  2⤵
  PID:7784
- C:\Windows\System\URPuFoQ.exe
  C:\Windows\System\URPuFoQ.exe
  2⤵
  PID:7880
- C:\Windows\System\SHJqEmg.exe
  C:\Windows\System\SHJqEmg.exe
  2⤵
  PID:7832
- C:\Windows\System\XyJBabz.exe
  C:\Windows\System\XyJBabz.exe
  2⤵
  PID:8108
- C:\Windows\System\mvZvhIl.exe
  C:\Windows\System\mvZvhIl.exe
  2⤵
  PID:8024
- C:\Windows\System\bjhQytI.exe
  C:\Windows\System\bjhQytI.exe
  2⤵
  PID:7568
- C:\Windows\System\tbuxIPj.exe
  C:\Windows\System\tbuxIPj.exe
  2⤵
  PID:7916
- C:\Windows\System\OYerAAN.exe
  C:\Windows\System\OYerAAN.exe
  2⤵
  PID:7200
- C:\Windows\System\VJBlkKa.exe
  C:\Windows\System\VJBlkKa.exe
  2⤵
  PID:8140
- C:\Windows\System\kBDwoKv.exe
  C:\Windows\System\kBDwoKv.exe
  2⤵
  PID:8184
- C:\Windows\System\ZJkPrIQ.exe
  C:\Windows\System\ZJkPrIQ.exe
  2⤵
  PID:6904
- C:\Windows\System\sxWBXbp.exe
  C:\Windows\System\sxWBXbp.exe
  2⤵
  PID:7184
- C:\Windows\System\IIjQnTz.exe
  C:\Windows\System\IIjQnTz.exe
  2⤵
  PID:7444
- C:\Windows\System\pvBSCHh.exe
  C:\Windows\System\pvBSCHh.exe
  2⤵
  PID:7584
- C:\Windows\System\HprKeRa.exe
  C:\Windows\System\HprKeRa.exe
  2⤵
  PID:7736
- C:\Windows\System\pbYfcCq.exe
  C:\Windows\System\pbYfcCq.exe
  2⤵
  PID:8044
- C:\Windows\System\LQegzOP.exe
  C:\Windows\System\LQegzOP.exe
  2⤵
  PID:7928
- C:\Windows\System\FDcoMGb.exe
  C:\Windows\System\FDcoMGb.exe
  2⤵
  PID:7316
- C:\Windows\System\UVTlOyt.exe
  C:\Windows\System\UVTlOyt.exe
  2⤵
  PID:5852
- C:\Windows\System\kCaHJig.exe
  C:\Windows\System\kCaHJig.exe
  2⤵
  PID:7716
- C:\Windows\System\WBVfoHc.exe
  C:\Windows\System\WBVfoHc.exe
  2⤵
  PID:7556
- C:\Windows\System\zgWjTNP.exe
  C:\Windows\System\zgWjTNP.exe
  2⤵
  PID:7852
- C:\Windows\System\Fscbneo.exe
  C:\Windows\System\Fscbneo.exe
  2⤵
  PID:8204
- C:\Windows\System\XyIijHb.exe
  C:\Windows\System\XyIijHb.exe
  2⤵
  PID:8220
- C:\Windows\System\EGrzKGE.exe
  C:\Windows\System\EGrzKGE.exe
  2⤵
  PID:8236
- C:\Windows\System\YspKXAz.exe
  C:\Windows\System\YspKXAz.exe
  2⤵
  PID:8252
- C:\Windows\System\EiGLDFp.exe
  C:\Windows\System\EiGLDFp.exe
  2⤵
  PID:8268
- C:\Windows\System\hvdBkcn.exe
  C:\Windows\System\hvdBkcn.exe
  2⤵
  PID:8284
- C:\Windows\System\HCvpcUT.exe
  C:\Windows\System\HCvpcUT.exe
  2⤵
  PID:8300
- C:\Windows\System\EFYsdrA.exe
  C:\Windows\System\EFYsdrA.exe
  2⤵
  PID:8316
- C:\Windows\System\XwOqaBB.exe
  C:\Windows\System\XwOqaBB.exe
  2⤵
  PID:8332
- C:\Windows\System\YrQQeTZ.exe
  C:\Windows\System\YrQQeTZ.exe
  2⤵
  PID:8348
- C:\Windows\System\mMojuaC.exe
  C:\Windows\System\mMojuaC.exe
  2⤵
  PID:8364
- C:\Windows\System\XMVRCTh.exe
  C:\Windows\System\XMVRCTh.exe
  2⤵
  PID:8380
- C:\Windows\System\sScVGiu.exe
  C:\Windows\System\sScVGiu.exe
  2⤵
  PID:8396
- C:\Windows\System\WKzVneV.exe
  C:\Windows\System\WKzVneV.exe
  2⤵
  PID:8412
- C:\Windows\System\rEIcjey.exe
  C:\Windows\System\rEIcjey.exe
  2⤵
  PID:8428
- C:\Windows\System\AculxJe.exe
  C:\Windows\System\AculxJe.exe
  2⤵
  PID:8444
- C:\Windows\System\wHeBmzd.exe
  C:\Windows\System\wHeBmzd.exe
  2⤵
  PID:8460
- C:\Windows\System\yosBTCo.exe
  C:\Windows\System\yosBTCo.exe
  2⤵
  PID:8476
- C:\Windows\System\OULkoUb.exe
  C:\Windows\System\OULkoUb.exe
  2⤵
  PID:8492
- C:\Windows\System\LmXNwUt.exe
  C:\Windows\System\LmXNwUt.exe
  2⤵
  PID:8508
- C:\Windows\System\NmAkAKj.exe
  C:\Windows\System\NmAkAKj.exe
  2⤵
  PID:8536
- C:\Windows\System\pPSuxJW.exe
  C:\Windows\System\pPSuxJW.exe
  2⤵
  PID:8552
- C:\Windows\System\AWvIinh.exe
  C:\Windows\System\AWvIinh.exe
  2⤵
  PID:8568
- C:\Windows\System\HGNFkHh.exe
  C:\Windows\System\HGNFkHh.exe
  2⤵
  PID:8584
- C:\Windows\System\MLoEBYl.exe
  C:\Windows\System\MLoEBYl.exe
  2⤵
  PID:8600
- C:\Windows\System\fZJwvJK.exe
  C:\Windows\System\fZJwvJK.exe
  2⤵
  PID:8620
- C:\Windows\System\YxVvrSO.exe
  C:\Windows\System\YxVvrSO.exe
  2⤵
  PID:8636
- C:\Windows\System\SnWZqYE.exe
  C:\Windows\System\SnWZqYE.exe
  2⤵
  PID:8652
- C:\Windows\System\JjDCSDK.exe
  C:\Windows\System\JjDCSDK.exe
  2⤵
  PID:8668
- C:\Windows\System\eygXYjL.exe
  C:\Windows\System\eygXYjL.exe
  2⤵
  PID:8684
- C:\Windows\System\XhvjxYe.exe
  C:\Windows\System\XhvjxYe.exe
  2⤵
  PID:8700
- C:\Windows\System\vOUDYIf.exe
  C:\Windows\System\vOUDYIf.exe
  2⤵
  PID:8716
- C:\Windows\System\NlHFhpO.exe
  C:\Windows\System\NlHFhpO.exe
  2⤵
  PID:8732
- C:\Windows\System\Nrsvvpo.exe
  C:\Windows\System\Nrsvvpo.exe
  2⤵
  PID:8748
- C:\Windows\System\DsnWThV.exe
  C:\Windows\System\DsnWThV.exe
  2⤵
  PID:8764
- C:\Windows\System\COdAKFL.exe
  C:\Windows\System\COdAKFL.exe
  2⤵
  PID:8780
- C:\Windows\System\FreqMIt.exe
  C:\Windows\System\FreqMIt.exe
  2⤵
  PID:8796
- C:\Windows\System\JcOlRzO.exe
  C:\Windows\System\JcOlRzO.exe
  2⤵
  PID:8812
- C:\Windows\System\YsDqWsS.exe
  C:\Windows\System\YsDqWsS.exe
  2⤵
  PID:8828
- C:\Windows\System\cexMcwO.exe
  C:\Windows\System\cexMcwO.exe
  2⤵
  PID:8844
- C:\Windows\System\UskqtsW.exe
  C:\Windows\System\UskqtsW.exe
  2⤵
  PID:8860
- C:\Windows\System\rWBSwKO.exe
  C:\Windows\System\rWBSwKO.exe
  2⤵
  PID:8876
- C:\Windows\System\jAJThsg.exe
  C:\Windows\System\jAJThsg.exe
  2⤵
  PID:8892
- C:\Windows\System\SdisFcN.exe
  C:\Windows\System\SdisFcN.exe
  2⤵
  PID:8908
- C:\Windows\System\ryFIeoS.exe
  C:\Windows\System\ryFIeoS.exe
  2⤵
  PID:8924
- C:\Windows\System\kMpHmOb.exe
  C:\Windows\System\kMpHmOb.exe
  2⤵
  PID:8940
- C:\Windows\System\AWRAAeV.exe
  C:\Windows\System\AWRAAeV.exe
  2⤵
  PID:9000
- C:\Windows\System\dCxYaOY.exe
  C:\Windows\System\dCxYaOY.exe
  2⤵
  PID:9020
- C:\Windows\System\EwjzvjR.exe
  C:\Windows\System\EwjzvjR.exe
  2⤵
  PID:9040
- C:\Windows\System\DmnfmER.exe
  C:\Windows\System\DmnfmER.exe
  2⤵
  PID:9056
- C:\Windows\System\YKAEjeC.exe
  C:\Windows\System\YKAEjeC.exe
  2⤵
  PID:9072
- C:\Windows\System\QxnUUYy.exe
  C:\Windows\System\QxnUUYy.exe
  2⤵
  PID:9088
- C:\Windows\System\UpzznJK.exe
  C:\Windows\System\UpzznJK.exe
  2⤵
  PID:9112
- C:\Windows\System\dHfOJlD.exe
  C:\Windows\System\dHfOJlD.exe
  2⤵
  PID:9132
- C:\Windows\System\WLcMIlp.exe
  C:\Windows\System\WLcMIlp.exe
  2⤵
  PID:9148
- C:\Windows\System\cpipvns.exe
  C:\Windows\System\cpipvns.exe
  2⤵
  PID:9164
- C:\Windows\System\tQHqvSU.exe
  C:\Windows\System\tQHqvSU.exe
  2⤵
  PID:9188
- C:\Windows\System\QWwnTFp.exe
  C:\Windows\System\QWwnTFp.exe
  2⤵
  PID:9204
- C:\Windows\System\yFEAebQ.exe
  C:\Windows\System\yFEAebQ.exe
  2⤵
  PID:8072
- C:\Windows\System\FAUEBLz.exe
  C:\Windows\System\FAUEBLz.exe
  2⤵
  PID:8124
- C:\Windows\System\lAtELpn.exe
  C:\Windows\System\lAtELpn.exe
  2⤵
  PID:8440
- C:\Windows\System\EFgAakD.exe
  C:\Windows\System\EFgAakD.exe
  2⤵
  PID:8356
- C:\Windows\System\uKpIrND.exe
  C:\Windows\System\uKpIrND.exe
  2⤵
  PID:8504
- C:\Windows\System\ADyMhiK.exe
  C:\Windows\System\ADyMhiK.exe
  2⤵
  PID:8456
- C:\Windows\System\EAjLxan.exe
  C:\Windows\System\EAjLxan.exe
  2⤵
  PID:8484
- C:\Windows\System\HAuSWvK.exe
  C:\Windows\System\HAuSWvK.exe
  2⤵
  PID:8528
- C:\Windows\System\sQZgBaG.exe
  C:\Windows\System\sQZgBaG.exe
  2⤵
  PID:8564
- C:\Windows\System\MoMfDaw.exe
  C:\Windows\System\MoMfDaw.exe
  2⤵
  PID:8608
- C:\Windows\System\CiuAwzf.exe
  C:\Windows\System\CiuAwzf.exe
  2⤵
  PID:8648
- C:\Windows\System\GhqOJOX.exe
  C:\Windows\System\GhqOJOX.exe
  2⤵
  PID:8740
- C:\Windows\System\oehlnWR.exe
  C:\Windows\System\oehlnWR.exe
  2⤵
  PID:8804
- C:\Windows\System\FRpzizZ.exe
  C:\Windows\System\FRpzizZ.exe
  2⤵
  PID:8628
- C:\Windows\System\kZXthsj.exe
  C:\Windows\System\kZXthsj.exe
  2⤵
  PID:8724
- C:\Windows\System\uqJvHfB.exe
  C:\Windows\System\uqJvHfB.exe
  2⤵
  PID:8788
- C:\Windows\System\TyDmGgm.exe
  C:\Windows\System\TyDmGgm.exe
  2⤵
  PID:8868
- C:\Windows\System\AxXehIO.exe
  C:\Windows\System\AxXehIO.exe
  2⤵
  PID:8884
- C:\Windows\System\youprAn.exe
  C:\Windows\System\youprAn.exe
  2⤵
  PID:8888
- C:\Windows\System\pqcjRkT.exe
  C:\Windows\System\pqcjRkT.exe
  2⤵
  PID:8916
- C:\Windows\System\nGKDgsm.exe
  C:\Windows\System\nGKDgsm.exe
  2⤵
  PID:8956
- C:\Windows\System\ONuNKXK.exe
  C:\Windows\System\ONuNKXK.exe
  2⤵
  PID:8976
- C:\Windows\System\ZlGfgNn.exe
  C:\Windows\System\ZlGfgNn.exe
  2⤵
  PID:8992
- C:\Windows\System\vTVIadx.exe
  C:\Windows\System\vTVIadx.exe
  2⤵
  PID:9048
- C:\Windows\System\dIbQNUC.exe
  C:\Windows\System\dIbQNUC.exe
  2⤵
  PID:9080
- C:\Windows\System\rZTOdhS.exe
  C:\Windows\System\rZTOdhS.exe
  2⤵
  PID:9128
- C:\Windows\System\jowIwKK.exe
  C:\Windows\System\jowIwKK.exe
  2⤵
  PID:9064
- C:\Windows\System\DGDBGAA.exe
  C:\Windows\System\DGDBGAA.exe
  2⤵
  PID:9108
- C:\Windows\System\lzYzLXt.exe
  C:\Windows\System\lzYzLXt.exe
  2⤵
  PID:9180
- C:\Windows\System\vbIBjsO.exe
  C:\Windows\System\vbIBjsO.exe
  2⤵
  PID:8028
- C:\Windows\System\vkAgQso.exe
  C:\Windows\System\vkAgQso.exe
  2⤵
  PID:7964
- C:\Windows\System\DDjvIgU.exe
  C:\Windows\System\DDjvIgU.exe
  2⤵
  PID:8228
- C:\Windows\System\CqCGhcX.exe
  C:\Windows\System\CqCGhcX.exe
  2⤵
  PID:8308
- C:\Windows\System\NZxAWnN.exe
  C:\Windows\System\NZxAWnN.exe
  2⤵
  PID:8312
- C:\Windows\System\DVjnVTr.exe
  C:\Windows\System\DVjnVTr.exe
  2⤵
  PID:8372
- C:\Windows\System\TkrRnYw.exe
  C:\Windows\System\TkrRnYw.exe
  2⤵
  PID:8408
- C:\Windows\System\EOhuauM.exe
  C:\Windows\System\EOhuauM.exe
  2⤵
  PID:8420
- C:\Windows\System\gycQLfX.exe
  C:\Windows\System\gycQLfX.exe
  2⤵
  PID:8560
- C:\Windows\System\jNxbSCp.exe
  C:\Windows\System\jNxbSCp.exe
  2⤵
  PID:7392
- C:\Windows\System\keazTjZ.exe
  C:\Windows\System\keazTjZ.exe
  2⤵
  PID:8580
- C:\Windows\System\chuPAVW.exe
  C:\Windows\System\chuPAVW.exe
  2⤵
  PID:8712
- C:\Windows\System\LlpGjHi.exe
  C:\Windows\System\LlpGjHi.exe
  2⤵
  PID:8760
- C:\Windows\System\icbPFdP.exe
  C:\Windows\System\icbPFdP.exe
  2⤵
  PID:8936
- C:\Windows\System\IGJVsiN.exe
  C:\Windows\System\IGJVsiN.exe
  2⤵
  PID:9032
- C:\Windows\System\gIhqxIB.exe
  C:\Windows\System\gIhqxIB.exe
  2⤵
  PID:8644
- C:\Windows\System\SBlUcIm.exe
  C:\Windows\System\SBlUcIm.exe
  2⤵
  PID:8840
- C:\Windows\System\qvyKKri.exe
  C:\Windows\System\qvyKKri.exe
  2⤵
  PID:8968
- C:\Windows\System\bddOILl.exe
  C:\Windows\System\bddOILl.exe
  2⤵
  PID:9008
- C:\Windows\System\fiWsFsI.exe
  C:\Windows\System\fiWsFsI.exe
  2⤵
  PID:9172
- C:\Windows\System\JrvLnyD.exe
  C:\Windows\System\JrvLnyD.exe
  2⤵
  PID:8244
- C:\Windows\System\PnBlqzJ.exe
  C:\Windows\System\PnBlqzJ.exe
  2⤵
  PID:8120
- C:\Windows\System\PKsKloq.exe
  C:\Windows\System\PKsKloq.exe
  2⤵
  PID:8212
- C:\Windows\System\yDdujZw.exe
  C:\Windows\System\yDdujZw.exe
  2⤵
  PID:8500
- C:\Windows\System\fwsgMzx.exe
  C:\Windows\System\fwsgMzx.exe
  2⤵
  PID:8404
- C:\Windows\System\cpOoZfz.exe
  C:\Windows\System\cpOoZfz.exe
  2⤵
  PID:8524
- C:\Windows\System\cTQiKFT.exe
  C:\Windows\System\cTQiKFT.exe
  2⤵
  PID:8516
- C:\Windows\System\PpcMyVr.exe
  C:\Windows\System\PpcMyVr.exe
  2⤵
  PID:9028
- C:\Windows\System\IeoWAUx.exe
  C:\Windows\System\IeoWAUx.exe
  2⤵
  PID:8692
- C:\Windows\System\ivmyUEu.exe
  C:\Windows\System\ivmyUEu.exe
  2⤵
  PID:8616
- C:\Windows\System\qSbEpux.exe
  C:\Windows\System\qSbEpux.exe
  2⤵
  PID:9036
- C:\Windows\System\XVRTrDK.exe
  C:\Windows\System\XVRTrDK.exe
  2⤵
  PID:8200
- C:\Windows\System\OEInxdc.exe
  C:\Windows\System\OEInxdc.exe
  2⤵
  PID:8344
- C:\Windows\System\wjUKIdm.exe
  C:\Windows\System\wjUKIdm.exe
  2⤵
  PID:8196
- C:\Windows\System\VkTgiwf.exe
  C:\Windows\System\VkTgiwf.exe
  2⤵
  PID:8216
- C:\Windows\System\yCwWsSd.exe
  C:\Windows\System\yCwWsSd.exe
  2⤵
  PID:8708
- C:\Windows\System\zyJVMLM.exe
  C:\Windows\System\zyJVMLM.exe
  2⤵
  PID:9228
- C:\Windows\System\gGLvlVH.exe
  C:\Windows\System\gGLvlVH.exe
  2⤵
  PID:9244
- C:\Windows\System\PBMKjQz.exe
  C:\Windows\System\PBMKjQz.exe
  2⤵
  PID:9260
- C:\Windows\System\ROVdHzk.exe
  C:\Windows\System\ROVdHzk.exe
  2⤵
  PID:9276
- C:\Windows\System\lsTkEPG.exe
  C:\Windows\System\lsTkEPG.exe
  2⤵
  PID:9292
- C:\Windows\System\NxlciBS.exe
  C:\Windows\System\NxlciBS.exe
  2⤵
  PID:9308
- C:\Windows\System\ipMCyYI.exe
  C:\Windows\System\ipMCyYI.exe
  2⤵
  PID:9336
- C:\Windows\System\BDghTVl.exe
  C:\Windows\System\BDghTVl.exe
  2⤵
  PID:9352
- C:\Windows\System\iBxeCrh.exe
  C:\Windows\System\iBxeCrh.exe
  2⤵
  PID:9372
- C:\Windows\System\jQPdvSe.exe
  C:\Windows\System\jQPdvSe.exe
  2⤵
  PID:9388
- C:\Windows\System\zzMNwqO.exe
  C:\Windows\System\zzMNwqO.exe
  2⤵
  PID:9404
- C:\Windows\System\AvDtakS.exe
  C:\Windows\System\AvDtakS.exe
  2⤵
  PID:9420
- C:\Windows\System\pTfxQfg.exe
  C:\Windows\System\pTfxQfg.exe
  2⤵
  PID:9452
- C:\Windows\System\bvupEqp.exe
  C:\Windows\System\bvupEqp.exe
  2⤵
  PID:9472
- C:\Windows\System\EhbxUoX.exe
  C:\Windows\System\EhbxUoX.exe
  2⤵
  PID:9488
- C:\Windows\System\SIreduC.exe
  C:\Windows\System\SIreduC.exe
  2⤵
  PID:9504
- C:\Windows\System\ZuMkjjH.exe
  C:\Windows\System\ZuMkjjH.exe
  2⤵
  PID:9520
- C:\Windows\System\owsMpzt.exe
  C:\Windows\System\owsMpzt.exe
  2⤵
  PID:9612
- C:\Windows\System\wLMDxpB.exe
  C:\Windows\System\wLMDxpB.exe
  2⤵
  PID:9632
- C:\Windows\System\iWgfWwD.exe
  C:\Windows\System\iWgfWwD.exe
  2⤵
  PID:9648
- C:\Windows\System\nrNBZDx.exe
  C:\Windows\System\nrNBZDx.exe
  2⤵
  PID:9664
- C:\Windows\System\QOhKiJN.exe
  C:\Windows\System\QOhKiJN.exe
  2⤵
  PID:9680
- C:\Windows\System\DiaLmws.exe
  C:\Windows\System\DiaLmws.exe
  2⤵
  PID:9696
- C:\Windows\System\CdclVxc.exe
  C:\Windows\System\CdclVxc.exe
  2⤵
  PID:9712
- C:\Windows\System\gUScChX.exe
  C:\Windows\System\gUScChX.exe
  2⤵
  PID:9728
- C:\Windows\System\hMPfWff.exe
  C:\Windows\System\hMPfWff.exe
  2⤵
  PID:9744
- C:\Windows\System\XNyHWyS.exe
  C:\Windows\System\XNyHWyS.exe
  2⤵
  PID:9760
- C:\Windows\System\SHpKSry.exe
  C:\Windows\System\SHpKSry.exe
  2⤵
  PID:9776
- C:\Windows\System\fiwdzKW.exe
  C:\Windows\System\fiwdzKW.exe
  2⤵
  PID:9796
- C:\Windows\System\jeXuXuI.exe
  C:\Windows\System\jeXuXuI.exe
  2⤵
  PID:9812
- C:\Windows\System\aEkpOQZ.exe
  C:\Windows\System\aEkpOQZ.exe
  2⤵
  PID:9828
- C:\Windows\System\ETBbndd.exe
  C:\Windows\System\ETBbndd.exe
  2⤵
  PID:9844
- C:\Windows\System\loNwxUN.exe
  C:\Windows\System\loNwxUN.exe
  2⤵
  PID:9860
- C:\Windows\System\NyAwurq.exe
  C:\Windows\System\NyAwurq.exe
  2⤵
  PID:9876
- C:\Windows\System\uOAQeAu.exe
  C:\Windows\System\uOAQeAu.exe
  2⤵
  PID:9892
- C:\Windows\System\hVTNQIc.exe
  C:\Windows\System\hVTNQIc.exe
  2⤵
  PID:9908
- C:\Windows\System\AxFAOmJ.exe
  C:\Windows\System\AxFAOmJ.exe
  2⤵
  PID:9924
- C:\Windows\System\Gyuzjew.exe
  C:\Windows\System\Gyuzjew.exe
  2⤵
  PID:9940
- C:\Windows\System\vQgXgfr.exe
  C:\Windows\System\vQgXgfr.exe
  2⤵
  PID:9956
- C:\Windows\System\peTqvjy.exe
  C:\Windows\System\peTqvjy.exe
  2⤵
  PID:9976
- C:\Windows\System\tNniYPR.exe
  C:\Windows\System\tNniYPR.exe
  2⤵
  PID:9992
- C:\Windows\System\TjTDQSU.exe
  C:\Windows\System\TjTDQSU.exe
  2⤵
  PID:10008
- C:\Windows\System\IwnLXnZ.exe
  C:\Windows\System\IwnLXnZ.exe
  2⤵
  PID:10024
- C:\Windows\System\UbWeKZC.exe
  C:\Windows\System\UbWeKZC.exe
  2⤵
  PID:10040
- C:\Windows\System\YzwggRk.exe
  C:\Windows\System\YzwggRk.exe
  2⤵
  PID:10060
- C:\Windows\System\VbDfewG.exe
  C:\Windows\System\VbDfewG.exe
  2⤵
  PID:10080
- C:\Windows\System\aKwycwS.exe
  C:\Windows\System\aKwycwS.exe
  2⤵
  PID:10196
- C:\Windows\System\IJOzPaJ.exe
  C:\Windows\System\IJOzPaJ.exe
  2⤵
  PID:10220
- C:\Windows\System\hQyAZrE.exe
  C:\Windows\System\hQyAZrE.exe
  2⤵
  PID:10236
- C:\Windows\System\GfNSvSv.exe
  C:\Windows\System\GfNSvSv.exe
  2⤵
  PID:8820
- C:\Windows\System\nUkzvcG.exe
  C:\Windows\System\nUkzvcG.exe
  2⤵
  PID:9096
- C:\Windows\System\mbhDIpY.exe
  C:\Windows\System\mbhDIpY.exe
  2⤵
  PID:9224
- C:\Windows\System\IsYbXYV.exe
  C:\Windows\System\IsYbXYV.exe
  2⤵
  PID:9516
- C:\Windows\System\BwfaaUV.exe
  C:\Windows\System\BwfaaUV.exe
  2⤵
  PID:9548
- C:\Windows\System\bDJxWKD.exe
  C:\Windows\System\bDJxWKD.exe
  2⤵
  PID:9568
- C:\Windows\System\YIjmHdf.exe
  C:\Windows\System\YIjmHdf.exe
  2⤵
  PID:9584
- C:\Windows\System\yIYliAk.exe
  C:\Windows\System\yIYliAk.exe
  2⤵
  PID:9600
- C:\Windows\System\QlaVGng.exe
  C:\Windows\System\QlaVGng.exe
  2⤵
  PID:9624
- C:\Windows\System\sxihlxA.exe
  C:\Windows\System\sxihlxA.exe
  2⤵
  PID:9688
- C:\Windows\System\bSJlKuF.exe
  C:\Windows\System\bSJlKuF.exe
  2⤵
  PID:9752
- C:\Windows\System\fntFXPb.exe
  C:\Windows\System\fntFXPb.exe
  2⤵
  PID:9644
- C:\Windows\System\NnIBgnk.exe
  C:\Windows\System\NnIBgnk.exe
  2⤵
  PID:9824
- C:\Windows\System\aUnADha.exe
  C:\Windows\System\aUnADha.exe
  2⤵
  PID:9740
- C:\Windows\System\oMmtxQO.exe
  C:\Windows\System\oMmtxQO.exe
  2⤵
  PID:9856
- C:\Windows\System\hRpNDmw.exe
  C:\Windows\System\hRpNDmw.exe
  2⤵
  PID:9920
- C:\Windows\System\zGFWYBB.exe
  C:\Windows\System\zGFWYBB.exe
  2⤵
  PID:9872
- C:\Windows\System\SOaDjTb.exe
  C:\Windows\System\SOaDjTb.exe
  2⤵
  PID:10072
- C:\Windows\System\wgCOjiP.exe
  C:\Windows\System\wgCOjiP.exe
  2⤵
  PID:10056
- C:\Windows\System\MkEstRq.exe
  C:\Windows\System\MkEstRq.exe
  2⤵
  PID:10096
- C:\Windows\System\yuZiOqh.exe
  C:\Windows\System\yuZiOqh.exe
  2⤵
  PID:10116
- C:\Windows\System\IgWmsiL.exe
  C:\Windows\System\IgWmsiL.exe
  2⤵
  PID:10140
- C:\Windows\System\TmndAPH.exe
  C:\Windows\System\TmndAPH.exe
  2⤵
  PID:10156
- C:\Windows\System\hjMvcTy.exe
  C:\Windows\System\hjMvcTy.exe
  2⤵
  PID:10172
- C:\Windows\System\AdbVKpk.exe
  C:\Windows\System\AdbVKpk.exe
  2⤵
  PID:10176
- C:\Windows\System\WRNSbFW.exe
  C:\Windows\System\WRNSbFW.exe
  2⤵
  PID:10232
- C:\Windows\System\vAdpPDM.exe
  C:\Windows\System\vAdpPDM.exe
  2⤵
  PID:8596
- C:\Windows\System\wkIzjUp.exe
  C:\Windows\System\wkIzjUp.exe
  2⤵
  PID:9256
- C:\Windows\System\rprvBzX.exe
  C:\Windows\System\rprvBzX.exe
  2⤵
  PID:9580
- C:\Windows\System\gaYLTaP.exe
  C:\Windows\System\gaYLTaP.exe
  2⤵
  PID:9360
- C:\Windows\System\BTScPxn.exe
  C:\Windows\System\BTScPxn.exe
  2⤵
  PID:9320
- C:\Windows\System\okOsxiB.exe
  C:\Windows\System\okOsxiB.exe
  2⤵
  PID:9368
- C:\Windows\System\JPmLAXW.exe
  C:\Windows\System\JPmLAXW.exe
  2⤵
  PID:8680
- C:\Windows\System\tjNZxNa.exe
  C:\Windows\System\tjNZxNa.exe
  2⤵
  PID:9380
- C:\Windows\System\ghSRlgv.exe
  C:\Windows\System\ghSRlgv.exe
  2⤵
  PID:9344
- C:\Windows\System\AdZckDJ.exe
  C:\Windows\System\AdZckDJ.exe
  2⤵
  PID:9384
- C:\Windows\System\TRFHvEr.exe
  C:\Windows\System\TRFHvEr.exe
  2⤵
  PID:9436
- C:\Windows\System\WXYqTEx.exe
  C:\Windows\System\WXYqTEx.exe
  2⤵
  PID:9468
- C:\Windows\System\DOswstz.exe
  C:\Windows\System\DOswstz.exe
  2⤵
  PID:9532
- C:\Windows\System\qovFaEw.exe
  C:\Windows\System\qovFaEw.exe
  2⤵
  PID:9512
- C:\Windows\System\iuXmwMG.exe
  C:\Windows\System\iuXmwMG.exe
  2⤵
  PID:9592
- C:\Windows\System\kgfeGvt.exe
  C:\Windows\System\kgfeGvt.exe
  2⤵
  PID:9660
- C:\Windows\System\aJWkKla.exe
  C:\Windows\System\aJWkKla.exe
  2⤵
  PID:9704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AavJOfm.exe

Filesize
1.9MB

MD5
6d290bb3ee565b3ab8dd840f89f1a57f

SHA1
ed42251a5dfa62c84494dd4c004deb77e3ea0a54

SHA256
ce488c19c387d3a0bb531ce19895aaaa93d2479dcfb3b6e28a4332506f8975ed

SHA512
ad7b218454e826da526c2eb5990ce6251c40c97cdd86004b68e2a70145075debf5d83227ee05ca30229b65f9db01f4d184dfb40f53d2a36dbaaba8897f3b7ec5

Download Submit
C:\Windows\system\DLRvhTD.exe

Filesize
1.9MB

MD5
f721e39ff38c4f62d02aa8a7ed1f31ab

SHA1
c6588439056d51f812b843f9eb32f020584d6a10

SHA256
d1a9e5a886fc4d4de02cb0b560f2e739a2c2b7deb647c4c7e49de0b81cca89cc

SHA512
2ab58a24c9541b126141c00608ee271650896d4549d6bb0299ef02b923b92cc78d9d1f7bf01cb28e9d810983f88387ff8c7f56e61fa12dd596c9169321e04bdc

Download Submit
C:\Windows\system\IhACAco.exe

Filesize
1.9MB

MD5
98541f5d592807ae6b85ab7283536e68

SHA1
7b51f82bde2d597e9f29fe091b8003ba9bc51f1c

SHA256
c326acbd72483028085f659c19ddc70851a1a4973b1b947e448d55bf811fe942

SHA512
381949112105d5a9e04d15f0f1e30383e786e2a3526f383b260a64d86585234cb671b46cfc98f1b8885f4f7d71e67310ed4cce21e1f222fd33e5e594b2395754

Download Submit
C:\Windows\system\JKMALFV.exe

Filesize
1.9MB

MD5
8316697f0e247717a3bfaf4178670a16

SHA1
a150c7598ad6c708971267fbeb22814a0b2b753c

SHA256
4cfd7cb674675c54933f3dbd3d51248b20e0a3e0ada12aa3aa0c10ea1c17c9e8

SHA512
e3c78bd445ca18cbbf1688f8eae50cdfe0bd62baec9ecdef20a4d971a01ed8d29c6780009b6636304246966cc1c3002f90548dfe1d55b36316564cc9311f76bc

Download Submit
C:\Windows\system\KQiQUlu.exe

Filesize
1.9MB

MD5
b4c946916fe9ddd80768e2c6c55bf57e

SHA1
fb9feb855d2359abee747a58faf23330f6b5c7a2

SHA256
97e5bc62f75513a70cf9859fe5b24f63a43a82d8d742c01c796a290c03d5a4cf

SHA512
79ca358366d8478c13f1b31ab881ae4aaf1dafdd0d5339704e2f8f2f8644470c1d8aecae4ce95aa2698513b8c418b4b18e1501039d78e7570e4f5fa3e3503072

Download Submit
C:\Windows\system\KyzNoAL.exe

Filesize
1.9MB

MD5
11c3cacc69a40007ef77f17dcdd8e661

SHA1
5d74e325292d8ab0397e78b6394ae0b8eb692a90

SHA256
4ff5cc1e188325bbbec843954b8b4754b820d5643b7a6eaba699efb43a3d5780

SHA512
2450d9424720f084b7571e1cd3206df357a6be5c66b9fe2fd51ea27aebe69e32998c3106fe7daf204caad12f58b9faa094012405809bffa2c2bd9a44c4ab3720

Download Submit
C:\Windows\system\LszrgKf.exe

Filesize
1.9MB

MD5
e4ba32f20dcc2fc40cc4c626c73865c1

SHA1
52dc06ee9f2be6699d1cc26673f37dbce8ebb9ff

SHA256
a684403505ab901ff51fbbc4680a2b3f1c0d025dbeacc328176cb8af732d332d

SHA512
cb072933b8adf5a6eb6d2032cee20dfb882495e64b2ffb84768980d3f034088003f396e52d0a73956ba5814803730dbc80046097cd6abbc4b0825d933ba357fe

Download Submit
C:\Windows\system\OMUzobL.exe

Filesize
1.9MB

MD5
5c170def4039610ebd3f6937a8e3a7e1

SHA1
4dff06fa18a28b2dcdae9eb40f17054e16a9b0ca

SHA256
fd32459ff868fa06d57036bb2bfff1f4a2a83206acb8472e710230be909a493d

SHA512
67cdbf0f46b56698f83cd01dae28e59c01e500d0d77397674cf2031fa49fc74ae1e9161ea6db9dd6ccd455626081f1c46fa9abfc2becc4273f4ee4bf6de59178

Download Submit
C:\Windows\system\PDUvzFU.exe

Filesize
8B

MD5
0a4d9fd0cc8fe1472d155d5d981ff235

SHA1
137003f778b74f1b96494293112b43e4307e765e

SHA256
4707e767d70e4899759ce8aba6535007a27f8c132e3f3e05b8b8ae03c23dd080

SHA512
ad9c5b802b25d2a28cbec3d4cc246b638fad901bd44704bb559f8a0cf5c0d25f339a2e2fe9f4b8bbba249477fc11b0b14c51d97cfa76d081fb255f90811dd5c7

Download Submit
C:\Windows\system\PcAdVxM.exe

Filesize
1.9MB

MD5
0908772e5a81f0205904f730b0908b6d

SHA1
bff15c80d567e9b6b46b60b627eea7b36abb51c0

SHA256
e77edd34c26f108c0c0cec4e2e85817d0431b804041a3759322b760fe7d17802

SHA512
3148def3e353fef735ddddcd3de3656a146eea4c622599bb7ac4082d203db8d4b6948f11cdf2dca7550ae6cb6d0dc17cf42159f7b8a1ebdc5217dff6dc001ddf

Download Submit
C:\Windows\system\QyVhuCw.exe

Filesize
1.9MB

MD5
3510f60aefd2acf8f864cdb64992ce83

SHA1
dfd60e2a88a0788c43bdcbcd3886442c93e3ad32

SHA256
2e929efcedc1c7d04d6e8cc19ee346a9ec60379802700458aba69db591082044

SHA512
be5278d4cafd1cebe959c6657e07936fa7665e360864279a58613b40f9dec08251a064fe7dfea184008a38dffef1108152dc6549be2880dbec9a9a9ae169e985

Download Submit
C:\Windows\system\RhMHWCk.exe

Filesize
1.9MB

MD5
2b5b3305a6d6e22cfcf83893e38248e0

SHA1
2a63484026549ffb06bfed8dee5f6d1f6aa0c9d7

SHA256
605dcc36bdeeb16a759c483ffe44850363c9f1c994b01ab4cd0fcd71c4170a5c

SHA512
cb001f3bf5523901518280e34cd795b5a4c2a6ca601a4ee19971f34813c234bfb8137b276d49bb000180c3a99276daa67bacede00172c9501e4bc694a2db739f

Download Submit
C:\Windows\system\TtzeoOc.exe

Filesize
1.8MB

MD5
21e35fe370ebe3cdba2cb465890d5e63

SHA1
d63336a592869156e5ff704c02b8db10750a63db

SHA256
45b2bf975758e7a75cf82358eee3770636a18f792060ed0ae3c936313c765fdd

SHA512
c4cc7401852019c70dcaab74e5b1527950bc39f83848499e79149787d1e25097d1d0357392499845c016c07a85c422048b15c2145c54abb13b820ebf8486ebb0

Download Submit
C:\Windows\system\UqSUUnd.exe

Filesize
1.8MB

MD5
8ac5836cb045f067e9cefd43c81bb91b

SHA1
b2b3b0f1a549dfe65a1caf3152c3dbe3815de7e7

SHA256
3fce82dcd92c89a179e6dc47b27634def6f513abb947ce6b943a93af0ac7af99

SHA512
d1f3ac490d5114a76ed7fec06a0ab88d11ca37417289330566e97f9a557cd8193bce2f6dc9daa588b109740c9e43259c3c49446f7b421a1f349f932f3b9aeed2

Download Submit
C:\Windows\system\XTbpfHs.exe

Filesize
1.9MB

MD5
878bdc431e31d8ef4654fbe7b7b059b0

SHA1
616d623bfb36911ec167543263f87e1cd5cf8c70

SHA256
9b2ae54124dd8b6a19ced5ae2e3f39522726e0cb2905433a253855f8def504fe

SHA512
9a0bbc804306f40c0daf2155cef72d6b47dde7affe1bdd42be90fdebc2b194de2ffd47dd1f410850c1517d2f96f9d2a380a7ed57b25885c65a3abe76ebb86789

Download Submit
C:\Windows\system\XZIiRcX.exe

Filesize
1.9MB

MD5
e081c4218afd1e086b5d26fe9377a0eb

SHA1
db35d15f40ad66ddf817cdf5fe2bc3a887b10cd0

SHA256
02ffb1779b5ecc42d6c9b40d850c9ee938ed706403f9eb6d214494f0dda5d5be

SHA512
28e1dfbc46dfe276caf0a4c49dc585fe732f48fe4b691c31ce9c2efb115366227886173c3b6af107cc6426c4a55fdeafe412afc19008e1e5a9497a701f2b6ae8

Download Submit
C:\Windows\system\cDoOQgf.exe

Filesize
1.9MB

MD5
f6ed77da92a3b52a72a0240154db8454

SHA1
26b59996a55d7f65bd3c6b062bf6d61c84fe1829

SHA256
2a5616dcfa1b24f31e0e6a87783eb6e04fbe1b960f98280df12a4c977d79827d

SHA512
442f6d4bff07a7c50f0526bd233f54661a659baa8e74dc1c3cb151c122680e97ffcdce4f3e67ebb5951a3e37a302f270e26aea2f97f7e765e15a133233986102

Download Submit
C:\Windows\system\cYdwNFf.exe

Filesize
1.9MB

MD5
55684111b809ef8871c7206fde88b1a6

SHA1
8656263d889e162f50d9e6511d9d0812ec8d72f7

SHA256
cc0bc397945fa8319b9d44e6771fa861c4e8ad1af7b944783cf3352c35bc183f

SHA512
20ddba511822014d141c8720f04842d5b3c3760e13f415eae33e2a8ced6246f78488b9023084c17c8bfe37a2dec3297667550c69304d71e4c2d283e1b06584f3

Download Submit
C:\Windows\system\fmwEjJa.exe

Filesize
1.8MB

MD5
3f08cdc0a47368af3b84e85991e00502

SHA1
9aa09d3823a60c5f76a0829188d3d0154678fb00

SHA256
ce59dd92e5a01f89f8aadc4511242c993b96a8dff0d84837401c6cbc1b4a5f06

SHA512
7dc42a9192faba2fbf5f7d3ff980c5aa7f4651543c4dbb2432008759ef751a6e462f1e7a293074f3979eba09a62a0ceb057d2a46ffba6572af64fc07e5f55f67

Download Submit
C:\Windows\system\hRQHooB.exe

Filesize
1.9MB

MD5
ed0604d84a432db1ee888b4db8e1198c

SHA1
789923a973b8a90279644778d03c998ca5856fde

SHA256
b70cbbef404f702733a9bcc70c96901021b27d127cb556ede54522e867a4b7ac

SHA512
f9522e40a6205ae6edb8031761b3641e723904eef48afcf116e6ce7ed6048a8181e6406adfaebe484b0f1a8ed43ac0ec461e57f2692b5709241a357100d15c74

Download Submit
C:\Windows\system\kGkkzKp.exe

Filesize
1.8MB

MD5
48d95dd976d82b0e8bef168706234171

SHA1
c5a5b36dc9764c9b03a0afae94150e0f66252d9b

SHA256
0d7388dd455de1a0a3fe4ecae24056b32041a2d94d14a6663b4c86f4bdd990b4

SHA512
25c9abdcb0823dd5f20fb56e57d821a045bd0f92a78e593b41ec32ded44bb4b73db230adfa692a607bb8ad8a2d4deb71970c6c54b0da98da1760fb1d18d1426b

Download Submit
C:\Windows\system\kjHKYjM.exe

Filesize
1.9MB

MD5
eb98393d5d624f6396cd4f155c260af7

SHA1
ae500604b0fb8a303b743e503fb1ef5b375eaac7

SHA256
a63521cfec50aca887add9d513ac96fe3521d23f6e6e34e4ba7a2343a2094c0d

SHA512
d5d3f7b773a996b71176f8a76adf88530377528146783eb2e9aa4b665e827d09082b3f7f3ff22ea63efd2774beb10fff258759364b2492a38c28a9012886f6ba

Download Submit
C:\Windows\system\lXvxXSS.exe

Filesize
1.9MB

MD5
65dbfc84bf31630d56acbb13fd18e1b2

SHA1
46d73905abd57e13e4d37f54e3ae0c9d918fcd79

SHA256
436a0cef1a32c2172fef0debd3590c6f7067d6d288c2f92441c2a1d7ece37c5b

SHA512
ed678438c1d192a7b0e7e10d6fcefbab0bb44cd919d705bdcd37de7fc64e29e7a1c46d53877056d9957fb622c41e9f19ac86a2427adcfde064f4a141b6d6ffff

Download Submit
C:\Windows\system\qPfQDqR.exe

Filesize
1.9MB

MD5
270e4ee48451f318d69d3842b65ccaab

SHA1
57edc39133cb4919baa8cfca61f85e03295232a3

SHA256
94dbe76724f303e0dd42f86906d1200eb1f1e32f8d76074a46d35b6e528a6729

SHA512
faa7c15f3a2bd72234d52eab140e089166032a770d2169e31f910c65c86ecd98f3523e1d97dee9a022e8e0bb39c7bfaf02680d3c4d9bc2c4285c85bcf7e3c1ba

Download Submit
C:\Windows\system\sAlhKTR.exe

Filesize
1.9MB

MD5
bfdee27b042299a3b0562a8c4d0205cf

SHA1
2d000aea787d4a3f0b8ed90a686cfe73438e1725

SHA256
e64ac955069ea291bc5fdb06da23ab37eb16eba676133fc080d02a17f1358cab

SHA512
2e9f508897f197a798fbf8fe4a39c24d77a49b9e40ba53625e9936e5ed36c7aa84ce16ba81e11464d7e88921f7de7170224cd442be1d6e0da55c9332609b7928

Download Submit
C:\Windows\system\updlsJl.exe

Filesize
1.9MB

MD5
380c9ec11e2cd2425ed937d9727ea1da

SHA1
b57c72251a750051f2375c5b41b5ab3843ad948d

SHA256
be9d6207e48aaa68bdc2204bf3908dae6d37ff5bf1c5b97ba3e84b945d59049b

SHA512
5e13e1c4770cedd70937758bfe24d95bbdb0c1c0697adacbdffa9d9d05cf8041448e15dbf794eb797b5c2cec29a5307af152059a5e915d913539279f53eb05f6

Download Submit
C:\Windows\system\veoCuvb.exe

Filesize
1.9MB

MD5
2bd29dfb6a0d569df9b812dfc410ee4b

SHA1
df8b60175383a51987b1be945060ec89251d4cbc

SHA256
3c413720f273fcdefe947a2ad8e009fc5029d739bd18696b1bfd060236a45529

SHA512
4847664b249d043832101fc0f5e271a9b6819285efcc4dfd5dbca88243fa1b24049b909cc5296ab7e86465d159b068ade483a45303986b2f1610a34c660cc544

Download Submit
C:\Windows\system\wjqeCgM.exe

Filesize
1.9MB

MD5
4a3b1b314b107c33d6b631722deae804

SHA1
b609092d0761d3ca9f6ae20bddd7751404abec7d

SHA256
b9032efb93cbfd121c87138fb5e86fe70186af833fa55fa69f734cec6ebb7912

SHA512
e4ecc6fa836517d8866696bcb16a1a8ec399036eb6e9564a72b24093747f798f6813f137bdaa683d7eaa37b94daa577b43b3398994551bfbda0246cdc4f878fb

Download Submit
C:\Windows\system\zRyaZbL.exe

Filesize
1.8MB

MD5
f4c9c1cd5221e3e5ca25ddc3265e51ab

SHA1
56859f77f0f02d0bb9957696550e29361847aa32

SHA256
b709aada471af85f87491ce3bc06d6f84df7fe43b0bcc7df7e0b193b96b8b6d4

SHA512
eb108cd4a7727142fa3af5f4c630b3a9da3a10aca21d49e36f99e0cf820e9c6bce5f9d7285adba4bc04b39e47eda7ee7840e369bedbf0e0a7dbf76805cb30088

Download Submit
\Windows\system\EmYojWU.exe

Filesize
1.9MB

MD5
51a06ec600f5200d3b12d7d8992d7365

SHA1
c627ecf2b5bf9e1fcf1b31154b63b0f5e7732ea2

SHA256
50008b0ef8db69e59a1ca0b1b2534d072eb9c3c96d25b9ab2bccd2fc287c05cc

SHA512
10de2e3bfeedc07a61bd49e700e102d84c4dc839bf83066fd8ab4adf3b0e3464185c1c1bbe0bd7e3b1b7b1a9ab0008620916d7e09ed04f0eb5ba29d57741ebfa

Download Submit
\Windows\system\NicZWmp.exe

Filesize
1.9MB

MD5
9796fcb1a8c612205bb8b06ebf046a58

SHA1
c5029b9bb544ada5e1f64b2e1d51d1d6fe4c1bb3

SHA256
94f864a36e3a83ad65dbdab6118edba8f15a2e53b3e71b9b86026a8e5a2da38f

SHA512
95176573882ba63f6e025028758187f3380abb066440e7417d21959e2c7a3bf20501426791f7d97fa21cae230dfb8e899ce912f5fe35ad72de24e758195f1019

Download Submit
\Windows\system\ZFJbkIl.exe

Filesize
1.9MB

MD5
82cb2c4578988c19f84c0a0ac818a7ab

SHA1
a12a80408203ab830488203187ccccee8e562680

SHA256
53a0665f7b054f98b67461eb004c9cbf49e5744bcd69c5e9a51e64aa0c90daca

SHA512
dfce9faceb3c0531a9a38b886097e82bc4bea59c89811b173c58ad7780a3fb7680569c8b4b15a41c67b491f02937917c2060070671c263fae4d51557fbaf57c0

Download Submit
\Windows\system\uuwxFUt.exe

Filesize
1.9MB

MD5
ddde6f29b8b09b3c51a7ba2b63d10821

SHA1
118d52990c8d752f5ab478a7a3754e1f49527217

SHA256
4cd9ccfe7fa0f95bb8cee904b7772a95ca0d760d7a44eba207088498b157e719

SHA512
bafe5d408ecb846eaf8d71e163adae2aa9bf80e9516e3b7894a06a4c98aab90f31584fa41ad71cb3fbebbe13579d5574e62a1ecbc4dca73e1924699b54fc8e0f

Download Submit
memory/804-100-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/1712-111-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/1740-113-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2040-71-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2140-101-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2352-1253-0x0000000000680000-0x0000000000688000-memory.dmp

Filesize
32KB

Download
memory/2352-1168-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2364-20-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2364-48-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2364-95-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2364-94-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2364-120-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2364-112-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2364-89-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-108-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-103-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/2364-99-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2364-104-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-109-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/2364-110-0x000000013FC30000-0x0000000140022000-memory.dmp

Filesize
3.9MB

Download
memory/2364-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2364-105-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/2364-106-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/2364-118-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-119-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/2364-107-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-114-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-102-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download