xmrig | 0127aee23390aff420220981ce1fa2065798060517dc8319c771761116c7010a

Analysis

max time kernel
22s
max time network
16s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
Size

1.8MB
MD5

020bd1bff2e7bfabeab74b210cbf9d0e
SHA1

6c7c8c5118d3ec2f5fcb9c816e42a55490073956
SHA256

0127aee23390aff420220981ce1fa2065798060517dc8319c771761116c7010a
SHA512

ed614fe62842d3da6ab98a88ede6d6de1a9b563272a224129fa80e4e89926b592ecce3eccecaee2e5562cfcc566921e1505bf3995a285a1d2b64f48880b3b98e
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl9:NABo

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/3060-9-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/2424-184-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2460-180-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2628-112-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2676-64-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2116-51-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/2660-37-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2372-1316-0x000000013F020000-0x000000013F412000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3060	MZOjCTf.exe
2116	UCegTxb.exe
2608	ewObBQg.exe
2660	DevzSTb.exe
2676	OIcOFhS.exe
2628	pToweoS.exe
2460	NwEsEMK.exe
2424	kCxgshC.exe
2744	lepeMyg.exe
1756	dPhwasN.exe
2940	oKuGGNg.exe
2904	rXKUuAO.exe
1924	OZdaYUr.exe
1640	NtMaQVa.exe
2640	tVWRoCC.exe
2512	jDJTgyS.exe
2528	SilpvmG.exe
864	IcuiICz.exe
2944	KhEEZPh.exe
1764	eoHPAMq.exe
3064	wvnIGTL.exe
2320	oOcbSpr.exe
1760	aAcxWOo.exe
600	sLbcvNW.exe
412	dEnFvFV.exe
1832	bvNWLmz.exe
3028	StpzGIb.exe
1612	xGjnziH.exe
1092	qPtkvKs.exe
2044	wdJYgVP.exe
724	dgKDHiD.exe
2964	hKuZuge.exe
1672	WZPLqqb.exe
2792	tvpPuco.exe
1880	blJyomf.exe
240	oNHvTer.exe
2908	UkRpCdy.exe
1132	cfutaDt.exe
2560	SlQWkSb.exe
2364	CabMXvm.exe
1720	fgMDEZY.exe
816	sMVvwOr.exe
268	bFzaulL.exe
1124	YEDbqcb.exe
2920	BLfqWIY.exe
2780	SGWveUO.exe
1812	ARPLccb.exe
1636	gAygEgu.exe
860	KpOEejf.exe
988	eKxGeCg.exe
3040	beJtjTo.exe
900	iDkFUnb.exe
1620	rWZqKVp.exe
2728	CdDLrUv.exe
2468	fHtCfjW.exe
2484	SOfBagA.exe
2768	CATiJbm.exe
2356	cvnrfsi.exe
2552	qgLWPhw.exe
1864	HrZootI.exe
1648	BAjXXxR.exe
708	QiesKNH.exe
1876	jDAxsmq.exe
992	trpaGyP.exe

Loads dropped DLL 64 IoCs

pid	Process
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2372-0-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/files/0x000b000000015605-3.dat	upx
behavioral1/memory/3060-9-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/files/0x0009000000015c78-10.dat	upx
behavioral1/files/0x0007000000015cee-17.dat	upx
behavioral1/files/0x0007000000015cf6-26.dat	upx
behavioral1/files/0x0006000000015f7a-68.dat	upx
behavioral1/files/0x0006000000016fed-169.dat	upx
behavioral1/files/0x0006000000016448-80.dat	upx
behavioral1/files/0x0006000000016176-74.dat	upx
behavioral1/memory/2424-184-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/files/0x0006000000016e24-178.dat	upx
behavioral1/files/0x0006000000016c51-120.dat	upx
behavioral1/memory/2460-180-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/files/0x0006000000016e4a-166.dat	upx
behavioral1/files/0x0006000000015df1-162.dat	upx
behavioral1/files/0x0006000000016d57-153.dat	upx
behavioral1/files/0x0006000000016d3e-146.dat	upx
behavioral1/files/0x0006000000016d16-140.dat	upx
behavioral1/files/0x0007000000015d31-136.dat	upx
behavioral1/files/0x0006000000016cbe-133.dat	upx
behavioral1/files/0x0006000000016ca5-127.dat	upx
behavioral1/files/0x000a000000015d1a-116.dat	upx
behavioral1/memory/2628-112-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/files/0x0006000000016be2-110.dat	upx
behavioral1/files/0x00060000000167d5-109.dat	upx
behavioral1/files/0x000600000001650c-108.dat	upx
behavioral1/files/0x0006000000016287-107.dat	upx
behavioral1/files/0x00060000000160af-106.dat	upx
behavioral1/files/0x0006000000015f01-105.dat	upx
behavioral1/files/0x0006000000016bfb-104.dat	upx
behavioral1/files/0x000a000000015cfe-100.dat	upx
behavioral1/files/0x0006000000016a29-96.dat	upx
behavioral1/files/0x00060000000165ae-89.dat	upx
behavioral1/files/0x0006000000016d51-177.dat	upx
behavioral1/files/0x0006000000016d1a-176.dat	upx
behavioral1/files/0x0006000000016cc6-175.dat	upx
behavioral1/files/0x0006000000016cb6-174.dat	upx
behavioral1/files/0x0006000000016c7c-173.dat	upx
behavioral1/files/0x0006000000016c04-172.dat	upx
behavioral1/memory/2676-64-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/files/0x0007000000015d98-60.dat	upx
behavioral1/files/0x0007000000015d27-59.dat	upx
behavioral1/files/0x000f000000005578-58.dat	upx
behavioral1/memory/2116-51-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/memory/2660-37-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2608-36-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/files/0x0008000000015cce-25.dat	upx
behavioral1/memory/2372-1316-0x000000013F020000-0x000000013F412000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UmvgCWU.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\PyYnnGq.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\uWlkHEx.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\DGOzqDg.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\tVWRoCC.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\kcIsRog.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\orRgrJO.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\GYpQYDY.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\xAdUNOh.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\xBhVbcj.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\SilpvmG.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\YcwiXqe.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\zyAWqHN.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\EfmiMgd.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\EUFEMtd.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\tVYZvuV.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\fpHhLAe.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\hYZRAry.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\JjGJJRB.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\ViAOwVs.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\pKIeuxS.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\YMcZoFw.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\HyBCbwM.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\pueQUoT.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\GvTRfKi.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\piSdIMd.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\UBaNPBr.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\cOhJHtF.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\xYSChnC.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\ucPnmmi.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\rXKUuAO.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\OElzMYv.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\KuCyEsJ.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\tbJItwV.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\LhJdeZy.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\JdxlZjW.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\BSaGMGy.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\vrAhZXo.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\CtdSZPV.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\zkDQpeK.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\GERLXje.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\cbndqIr.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\vUGloqh.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\lJkojUY.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\ARPLccb.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\kLcdfkd.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\NmuefrR.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\aLiKmOl.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\jPFrzyc.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\UjvWSUx.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\gRVFJgg.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\DPtEGAv.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\oJxsUXd.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\gIZDmGF.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\SaoVxgA.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\ZtKZQkW.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\LbaNTBq.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\nRnzfiM.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\lYzTxah.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\amWMhIo.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\mgwetcx.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\PLxNkVH.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\TmqBLto.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
File created	C:\Windows\System\CdDLrUv.exe	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2816	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
Token: SeDebugPrivilege	2816	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2816	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	29
PID 2372 wrote to memory of 2816	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	29
PID 2372 wrote to memory of 2816	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	29
PID 2372 wrote to memory of 3060	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	30
PID 2372 wrote to memory of 3060	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	30
PID 2372 wrote to memory of 3060	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2116	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2116	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2116	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2608	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2608	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2608	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2676	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2676	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2676	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2660	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	34
PID 2372 wrote to memory of 2660	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	34
PID 2372 wrote to memory of 2660	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	34
PID 2372 wrote to memory of 2744	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	35
PID 2372 wrote to memory of 2744	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	35
PID 2372 wrote to memory of 2744	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	35
PID 2372 wrote to memory of 2628	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	36
PID 2372 wrote to memory of 2628	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	36
PID 2372 wrote to memory of 2628	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	36
PID 2372 wrote to memory of 2512	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	37
PID 2372 wrote to memory of 2512	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	37
PID 2372 wrote to memory of 2512	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	37
PID 2372 wrote to memory of 2460	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	38
PID 2372 wrote to memory of 2460	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	38
PID 2372 wrote to memory of 2460	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	38
PID 2372 wrote to memory of 2528	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	39
PID 2372 wrote to memory of 2528	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	39
PID 2372 wrote to memory of 2528	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	39
PID 2372 wrote to memory of 2424	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	40
PID 2372 wrote to memory of 2424	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	40
PID 2372 wrote to memory of 2424	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	40
PID 2372 wrote to memory of 864	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	41
PID 2372 wrote to memory of 864	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	41
PID 2372 wrote to memory of 864	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	41
PID 2372 wrote to memory of 1756	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	42
PID 2372 wrote to memory of 1756	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	42
PID 2372 wrote to memory of 1756	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	42
PID 2372 wrote to memory of 1832	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	43
PID 2372 wrote to memory of 1832	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	43
PID 2372 wrote to memory of 1832	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	43
PID 2372 wrote to memory of 2940	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	44
PID 2372 wrote to memory of 2940	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	44
PID 2372 wrote to memory of 2940	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	44
PID 2372 wrote to memory of 2964	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	45
PID 2372 wrote to memory of 2964	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	45
PID 2372 wrote to memory of 2964	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	45
PID 2372 wrote to memory of 2904	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	46
PID 2372 wrote to memory of 2904	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	46
PID 2372 wrote to memory of 2904	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	46
PID 2372 wrote to memory of 1672	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	47
PID 2372 wrote to memory of 1672	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	47
PID 2372 wrote to memory of 1672	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	47
PID 2372 wrote to memory of 1924	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	48
PID 2372 wrote to memory of 1924	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	48
PID 2372 wrote to memory of 1924	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	48
PID 2372 wrote to memory of 2792	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	49
PID 2372 wrote to memory of 2792	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	49
PID 2372 wrote to memory of 2792	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	49
PID 2372 wrote to memory of 1640	2372	020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\020bd1bff2e7bfabeab74b210cbf9d0e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\System\MZOjCTf.exe
  C:\Windows\System\MZOjCTf.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\UCegTxb.exe
  C:\Windows\System\UCegTxb.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\ewObBQg.exe
  C:\Windows\System\ewObBQg.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\OIcOFhS.exe
  C:\Windows\System\OIcOFhS.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\DevzSTb.exe
  C:\Windows\System\DevzSTb.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\lepeMyg.exe
  C:\Windows\System\lepeMyg.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\pToweoS.exe
  C:\Windows\System\pToweoS.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\jDJTgyS.exe
  C:\Windows\System\jDJTgyS.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\NwEsEMK.exe
  C:\Windows\System\NwEsEMK.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\SilpvmG.exe
  C:\Windows\System\SilpvmG.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\kCxgshC.exe
  C:\Windows\System\kCxgshC.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\IcuiICz.exe
  C:\Windows\System\IcuiICz.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\dPhwasN.exe
  C:\Windows\System\dPhwasN.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\bvNWLmz.exe
  C:\Windows\System\bvNWLmz.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\oKuGGNg.exe
  C:\Windows\System\oKuGGNg.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\hKuZuge.exe
  C:\Windows\System\hKuZuge.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\rXKUuAO.exe
  C:\Windows\System\rXKUuAO.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\WZPLqqb.exe
  C:\Windows\System\WZPLqqb.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\OZdaYUr.exe
  C:\Windows\System\OZdaYUr.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\tvpPuco.exe
  C:\Windows\System\tvpPuco.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\NtMaQVa.exe
  C:\Windows\System\NtMaQVa.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\blJyomf.exe
  C:\Windows\System\blJyomf.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\tVWRoCC.exe
  C:\Windows\System\tVWRoCC.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\UkRpCdy.exe
  C:\Windows\System\UkRpCdy.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\KhEEZPh.exe
  C:\Windows\System\KhEEZPh.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\cfutaDt.exe
  C:\Windows\System\cfutaDt.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\eoHPAMq.exe
  C:\Windows\System\eoHPAMq.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\SlQWkSb.exe
  C:\Windows\System\SlQWkSb.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\wvnIGTL.exe
  C:\Windows\System\wvnIGTL.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\fgMDEZY.exe
  C:\Windows\System\fgMDEZY.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\oOcbSpr.exe
  C:\Windows\System\oOcbSpr.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\sMVvwOr.exe
  C:\Windows\System\sMVvwOr.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\aAcxWOo.exe
  C:\Windows\System\aAcxWOo.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\bFzaulL.exe
  C:\Windows\System\bFzaulL.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\sLbcvNW.exe
  C:\Windows\System\sLbcvNW.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\YEDbqcb.exe
  C:\Windows\System\YEDbqcb.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\dEnFvFV.exe
  C:\Windows\System\dEnFvFV.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\BLfqWIY.exe
  C:\Windows\System\BLfqWIY.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\StpzGIb.exe
  C:\Windows\System\StpzGIb.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\ARPLccb.exe
  C:\Windows\System\ARPLccb.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\xGjnziH.exe
  C:\Windows\System\xGjnziH.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\gAygEgu.exe
  C:\Windows\System\gAygEgu.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\qPtkvKs.exe
  C:\Windows\System\qPtkvKs.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\KpOEejf.exe
  C:\Windows\System\KpOEejf.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\wdJYgVP.exe
  C:\Windows\System\wdJYgVP.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\eKxGeCg.exe
  C:\Windows\System\eKxGeCg.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\dgKDHiD.exe
  C:\Windows\System\dgKDHiD.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\beJtjTo.exe
  C:\Windows\System\beJtjTo.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\oNHvTer.exe
  C:\Windows\System\oNHvTer.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\iDkFUnb.exe
  C:\Windows\System\iDkFUnb.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\CabMXvm.exe
  C:\Windows\System\CabMXvm.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\rWZqKVp.exe
  C:\Windows\System\rWZqKVp.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\SGWveUO.exe
  C:\Windows\System\SGWveUO.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\CdDLrUv.exe
  C:\Windows\System\CdDLrUv.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\fHtCfjW.exe
  C:\Windows\System\fHtCfjW.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\SOfBagA.exe
  C:\Windows\System\SOfBagA.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\CATiJbm.exe
  C:\Windows\System\CATiJbm.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\cvnrfsi.exe
  C:\Windows\System\cvnrfsi.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\qgLWPhw.exe
  C:\Windows\System\qgLWPhw.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\HrZootI.exe
  C:\Windows\System\HrZootI.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\BAjXXxR.exe
  C:\Windows\System\BAjXXxR.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\QiesKNH.exe
  C:\Windows\System\QiesKNH.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\jDAxsmq.exe
  C:\Windows\System\jDAxsmq.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\trpaGyP.exe
  C:\Windows\System\trpaGyP.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\YzyShSi.exe
  C:\Windows\System\YzyShSi.exe
  2⤵
  PID:1060
- C:\Windows\System\OcRhUtx.exe
  C:\Windows\System\OcRhUtx.exe
  2⤵
  PID:2600
- C:\Windows\System\BIEmyxO.exe
  C:\Windows\System\BIEmyxO.exe
  2⤵
  PID:2984
- C:\Windows\System\ByTrbhh.exe
  C:\Windows\System\ByTrbhh.exe
  2⤵
  PID:2872
- C:\Windows\System\VdszguI.exe
  C:\Windows\System\VdszguI.exe
  2⤵
  PID:820
- C:\Windows\System\TuxtwiZ.exe
  C:\Windows\System\TuxtwiZ.exe
  2⤵
  PID:1684
- C:\Windows\System\hERsANd.exe
  C:\Windows\System\hERsANd.exe
  2⤵
  PID:1852
- C:\Windows\System\BVoTOjU.exe
  C:\Windows\System\BVoTOjU.exe
  2⤵
  PID:2100
- C:\Windows\System\iwPyTBx.exe
  C:\Windows\System\iwPyTBx.exe
  2⤵
  PID:2304
- C:\Windows\System\brIeais.exe
  C:\Windows\System\brIeais.exe
  2⤵
  PID:380
- C:\Windows\System\nhwYhJy.exe
  C:\Windows\System\nhwYhJy.exe
  2⤵
  PID:1216
- C:\Windows\System\erGQOcT.exe
  C:\Windows\System\erGQOcT.exe
  2⤵
  PID:2680
- C:\Windows\System\PkmkhKG.exe
  C:\Windows\System\PkmkhKG.exe
  2⤵
  PID:1464
- C:\Windows\System\tUDOJMr.exe
  C:\Windows\System\tUDOJMr.exe
  2⤵
  PID:1752
- C:\Windows\System\PTlZBDI.exe
  C:\Windows\System\PTlZBDI.exe
  2⤵
  PID:2824
- C:\Windows\System\acmDBKA.exe
  C:\Windows\System\acmDBKA.exe
  2⤵
  PID:2876
- C:\Windows\System\HBHHCAL.exe
  C:\Windows\System\HBHHCAL.exe
  2⤵
  PID:1628
- C:\Windows\System\wRxagKT.exe
  C:\Windows\System\wRxagKT.exe
  2⤵
  PID:2612
- C:\Windows\System\XxHdZLx.exe
  C:\Windows\System\XxHdZLx.exe
  2⤵
  PID:3024
- C:\Windows\System\qOXyugm.exe
  C:\Windows\System\qOXyugm.exe
  2⤵
  PID:2708
- C:\Windows\System\fJeXGsg.exe
  C:\Windows\System\fJeXGsg.exe
  2⤵
  PID:2068
- C:\Windows\System\ONXJsxS.exe
  C:\Windows\System\ONXJsxS.exe
  2⤵
  PID:1116
- C:\Windows\System\abeaQnT.exe
  C:\Windows\System\abeaQnT.exe
  2⤵
  PID:2732
- C:\Windows\System\rwaLCaz.exe
  C:\Windows\System\rwaLCaz.exe
  2⤵
  PID:1448
- C:\Windows\System\vJCGFwr.exe
  C:\Windows\System\vJCGFwr.exe
  2⤵
  PID:2804
- C:\Windows\System\HbsZDwC.exe
  C:\Windows\System\HbsZDwC.exe
  2⤵
  PID:2812
- C:\Windows\System\PBBOSJp.exe
  C:\Windows\System\PBBOSJp.exe
  2⤵
  PID:1728
- C:\Windows\System\sMHxEjW.exe
  C:\Windows\System\sMHxEjW.exe
  2⤵
  PID:2296
- C:\Windows\System\WFDOjtr.exe
  C:\Windows\System\WFDOjtr.exe
  2⤵
  PID:1912
- C:\Windows\System\XShXDWr.exe
  C:\Windows\System\XShXDWr.exe
  2⤵
  PID:3052
- C:\Windows\System\yuxOuxa.exe
  C:\Windows\System\yuxOuxa.exe
  2⤵
  PID:2544
- C:\Windows\System\xvNWrwq.exe
  C:\Windows\System\xvNWrwq.exe
  2⤵
  PID:2192
- C:\Windows\System\kIpTczd.exe
  C:\Windows\System\kIpTczd.exe
  2⤵
  PID:1792
- C:\Windows\System\UdVlzgQ.exe
  C:\Windows\System\UdVlzgQ.exe
  2⤵
  PID:1508
- C:\Windows\System\SlehNsX.exe
  C:\Windows\System\SlehNsX.exe
  2⤵
  PID:1284
- C:\Windows\System\ZXTWXSP.exe
  C:\Windows\System\ZXTWXSP.exe
  2⤵
  PID:2580
- C:\Windows\System\gTFeQlX.exe
  C:\Windows\System\gTFeQlX.exe
  2⤵
  PID:2284
- C:\Windows\System\tkMrNqX.exe
  C:\Windows\System\tkMrNqX.exe
  2⤵
  PID:1532
- C:\Windows\System\OpVWJuu.exe
  C:\Windows\System\OpVWJuu.exe
  2⤵
  PID:3080
- C:\Windows\System\lZpWrYQ.exe
  C:\Windows\System\lZpWrYQ.exe
  2⤵
  PID:3096
- C:\Windows\System\uxVMzbh.exe
  C:\Windows\System\uxVMzbh.exe
  2⤵
  PID:3112
- C:\Windows\System\DYRBpcM.exe
  C:\Windows\System\DYRBpcM.exe
  2⤵
  PID:3136
- C:\Windows\System\bSUsBmQ.exe
  C:\Windows\System\bSUsBmQ.exe
  2⤵
  PID:3156
- C:\Windows\System\kjBqpxP.exe
  C:\Windows\System\kjBqpxP.exe
  2⤵
  PID:3172
- C:\Windows\System\xLVmwOX.exe
  C:\Windows\System\xLVmwOX.exe
  2⤵
  PID:3188
- C:\Windows\System\BWLWRMD.exe
  C:\Windows\System\BWLWRMD.exe
  2⤵
  PID:3212
- C:\Windows\System\WyuMZWN.exe
  C:\Windows\System\WyuMZWN.exe
  2⤵
  PID:3228
- C:\Windows\System\BkAIMmK.exe
  C:\Windows\System\BkAIMmK.exe
  2⤵
  PID:3244
- C:\Windows\System\aEakndK.exe
  C:\Windows\System\aEakndK.exe
  2⤵
  PID:3260
- C:\Windows\System\sZQSXLW.exe
  C:\Windows\System\sZQSXLW.exe
  2⤵
  PID:3280
- C:\Windows\System\icCqcMc.exe
  C:\Windows\System\icCqcMc.exe
  2⤵
  PID:3300
- C:\Windows\System\nXojhCS.exe
  C:\Windows\System\nXojhCS.exe
  2⤵
  PID:3316
- C:\Windows\System\Qmgtust.exe
  C:\Windows\System\Qmgtust.exe
  2⤵
  PID:3344
- C:\Windows\System\rWFIvoE.exe
  C:\Windows\System\rWFIvoE.exe
  2⤵
  PID:3360
- C:\Windows\System\AoAKlwH.exe
  C:\Windows\System\AoAKlwH.exe
  2⤵
  PID:3376
- C:\Windows\System\PEjCxYf.exe
  C:\Windows\System\PEjCxYf.exe
  2⤵
  PID:3392
- C:\Windows\System\fbMgjQb.exe
  C:\Windows\System\fbMgjQb.exe
  2⤵
  PID:3408
- C:\Windows\System\kLpgyvE.exe
  C:\Windows\System\kLpgyvE.exe
  2⤵
  PID:3424
- C:\Windows\System\wdlFvXA.exe
  C:\Windows\System\wdlFvXA.exe
  2⤵
  PID:3440
- C:\Windows\System\KBzDMGm.exe
  C:\Windows\System\KBzDMGm.exe
  2⤵
  PID:3456
- C:\Windows\System\OtZTYHY.exe
  C:\Windows\System\OtZTYHY.exe
  2⤵
  PID:3472
- C:\Windows\System\ELmUzii.exe
  C:\Windows\System\ELmUzii.exe
  2⤵
  PID:3492
- C:\Windows\System\AZdaXMG.exe
  C:\Windows\System\AZdaXMG.exe
  2⤵
  PID:3508
- C:\Windows\System\XSBaAhn.exe
  C:\Windows\System\XSBaAhn.exe
  2⤵
  PID:3524
- C:\Windows\System\kLcdfkd.exe
  C:\Windows\System\kLcdfkd.exe
  2⤵
  PID:3540
- C:\Windows\System\GCNuOfk.exe
  C:\Windows\System\GCNuOfk.exe
  2⤵
  PID:3556
- C:\Windows\System\uQdCUTl.exe
  C:\Windows\System\uQdCUTl.exe
  2⤵
  PID:3572
- C:\Windows\System\xagQqIz.exe
  C:\Windows\System\xagQqIz.exe
  2⤵
  PID:3588
- C:\Windows\System\tFhZmPv.exe
  C:\Windows\System\tFhZmPv.exe
  2⤵
  PID:3604
- C:\Windows\System\ydrbaOG.exe
  C:\Windows\System\ydrbaOG.exe
  2⤵
  PID:3620
- C:\Windows\System\VcdTFmD.exe
  C:\Windows\System\VcdTFmD.exe
  2⤵
  PID:3636
- C:\Windows\System\eXswdOw.exe
  C:\Windows\System\eXswdOw.exe
  2⤵
  PID:3652
- C:\Windows\System\WlhOMbX.exe
  C:\Windows\System\WlhOMbX.exe
  2⤵
  PID:3668
- C:\Windows\System\nAYIpwP.exe
  C:\Windows\System\nAYIpwP.exe
  2⤵
  PID:3684
- C:\Windows\System\ZjjoJHG.exe
  C:\Windows\System\ZjjoJHG.exe
  2⤵
  PID:3700
- C:\Windows\System\YcwiXqe.exe
  C:\Windows\System\YcwiXqe.exe
  2⤵
  PID:3716
- C:\Windows\System\bUQBGeO.exe
  C:\Windows\System\bUQBGeO.exe
  2⤵
  PID:3732
- C:\Windows\System\srTtaKS.exe
  C:\Windows\System\srTtaKS.exe
  2⤵
  PID:3748
- C:\Windows\System\ieCkfhw.exe
  C:\Windows\System\ieCkfhw.exe
  2⤵
  PID:3764
- C:\Windows\System\ZDkHxbv.exe
  C:\Windows\System\ZDkHxbv.exe
  2⤵
  PID:3780
- C:\Windows\System\nkyOBRY.exe
  C:\Windows\System\nkyOBRY.exe
  2⤵
  PID:3796
- C:\Windows\System\ZhCpzZB.exe
  C:\Windows\System\ZhCpzZB.exe
  2⤵
  PID:3984
- C:\Windows\System\LiRhGQJ.exe
  C:\Windows\System\LiRhGQJ.exe
  2⤵
  PID:4004
- C:\Windows\System\kcIsRog.exe
  C:\Windows\System\kcIsRog.exe
  2⤵
  PID:4020
- C:\Windows\System\vVgqYNh.exe
  C:\Windows\System\vVgqYNh.exe
  2⤵
  PID:4036
- C:\Windows\System\RDmbDPd.exe
  C:\Windows\System\RDmbDPd.exe
  2⤵
  PID:4056
- C:\Windows\System\TUbOuLR.exe
  C:\Windows\System\TUbOuLR.exe
  2⤵
  PID:4072
- C:\Windows\System\QEMmyax.exe
  C:\Windows\System\QEMmyax.exe
  2⤵
  PID:4088
- C:\Windows\System\yzujXUc.exe
  C:\Windows\System\yzujXUc.exe
  2⤵
  PID:1280
- C:\Windows\System\EfmiMgd.exe
  C:\Windows\System\EfmiMgd.exe
  2⤵
  PID:908
- C:\Windows\System\uTzexFB.exe
  C:\Windows\System\uTzexFB.exe
  2⤵
  PID:1996
- C:\Windows\System\TigcysR.exe
  C:\Windows\System\TigcysR.exe
  2⤵
  PID:608
- C:\Windows\System\XgKBsSg.exe
  C:\Windows\System\XgKBsSg.exe
  2⤵
  PID:1584
- C:\Windows\System\zuvjOHp.exe
  C:\Windows\System\zuvjOHp.exe
  2⤵
  PID:3120
- C:\Windows\System\hZyBVFH.exe
  C:\Windows\System\hZyBVFH.exe
  2⤵
  PID:3164
- C:\Windows\System\fClXzRX.exe
  C:\Windows\System\fClXzRX.exe
  2⤵
  PID:3204
- C:\Windows\System\LZELiTh.exe
  C:\Windows\System\LZELiTh.exe
  2⤵
  PID:3268
- C:\Windows\System\UFKMNpC.exe
  C:\Windows\System\UFKMNpC.exe
  2⤵
  PID:3352
- C:\Windows\System\roFgrSh.exe
  C:\Windows\System\roFgrSh.exe
  2⤵
  PID:3416
- C:\Windows\System\jAVkicT.exe
  C:\Windows\System\jAVkicT.exe
  2⤵
  PID:2568
- C:\Windows\System\tuNEYkP.exe
  C:\Windows\System\tuNEYkP.exe
  2⤵
  PID:3516
- C:\Windows\System\yEqyfYe.exe
  C:\Windows\System\yEqyfYe.exe
  2⤵
  PID:3580
- C:\Windows\System\aITRgXE.exe
  C:\Windows\System\aITRgXE.exe
  2⤵
  PID:2340
- C:\Windows\System\xxOFeGv.exe
  C:\Windows\System\xxOFeGv.exe
  2⤵
  PID:2164
- C:\Windows\System\rSWMFUT.exe
  C:\Windows\System\rSWMFUT.exe
  2⤵
  PID:3912
- C:\Windows\System\gVcomQt.exe
  C:\Windows\System\gVcomQt.exe
  2⤵
  PID:3920
- C:\Windows\System\elKxRht.exe
  C:\Windows\System\elKxRht.exe
  2⤵
  PID:3932
- C:\Windows\System\yzOTjDi.exe
  C:\Windows\System\yzOTjDi.exe
  2⤵
  PID:3940
- C:\Windows\System\IigtwJt.exe
  C:\Windows\System\IigtwJt.exe
  2⤵
  PID:1240
- C:\Windows\System\wAmozin.exe
  C:\Windows\System\wAmozin.exe
  2⤵
  PID:2276
- C:\Windows\System\rvDFTSX.exe
  C:\Windows\System\rvDFTSX.exe
  2⤵
  PID:2936
- C:\Windows\System\dDjwagb.exe
  C:\Windows\System\dDjwagb.exe
  2⤵
  PID:1348
- C:\Windows\System\VhuJoMY.exe
  C:\Windows\System\VhuJoMY.exe
  2⤵
  PID:2712
- C:\Windows\System\wnfAykn.exe
  C:\Windows\System\wnfAykn.exe
  2⤵
  PID:3976
- C:\Windows\System\mKexGUC.exe
  C:\Windows\System\mKexGUC.exe
  2⤵
  PID:2832
- C:\Windows\System\zqxPPce.exe
  C:\Windows\System\zqxPPce.exe
  2⤵
  PID:1076
- C:\Windows\System\KeWVDea.exe
  C:\Windows\System\KeWVDea.exe
  2⤵
  PID:3632
- C:\Windows\System\gJVzlkt.exe
  C:\Windows\System\gJVzlkt.exe
  2⤵
  PID:4044
- C:\Windows\System\OzoulYM.exe
  C:\Windows\System\OzoulYM.exe
  2⤵
  PID:4084
- C:\Windows\System\AGenWTx.exe
  C:\Windows\System\AGenWTx.exe
  2⤵
  PID:2132
- C:\Windows\System\ixPdzMI.exe
  C:\Windows\System\ixPdzMI.exe
  2⤵
  PID:3200
- C:\Windows\System\XTXKuzP.exe
  C:\Windows\System\XTXKuzP.exe
  2⤵
  PID:3692
- C:\Windows\System\FHrVxTF.exe
  C:\Windows\System\FHrVxTF.exe
  2⤵
  PID:3756
- C:\Windows\System\FaClMHl.exe
  C:\Windows\System\FaClMHl.exe
  2⤵
  PID:1736
- C:\Windows\System\GRWFWmM.exe
  C:\Windows\System\GRWFWmM.exe
  2⤵
  PID:2224
- C:\Windows\System\oyzgjPE.exe
  C:\Windows\System\oyzgjPE.exe
  2⤵
  PID:3144
- C:\Windows\System\mBEeunq.exe
  C:\Windows\System\mBEeunq.exe
  2⤵
  PID:3220
- C:\Windows\System\rKZLGbA.exe
  C:\Windows\System\rKZLGbA.exe
  2⤵
  PID:3324
- C:\Windows\System\hdIfYDX.exe
  C:\Windows\System\hdIfYDX.exe
  2⤵
  PID:3336
- C:\Windows\System\dhMohDq.exe
  C:\Windows\System\dhMohDq.exe
  2⤵
  PID:3400
- C:\Windows\System\eVOLjwe.exe
  C:\Windows\System\eVOLjwe.exe
  2⤵
  PID:3872
- C:\Windows\System\NRfDBUN.exe
  C:\Windows\System\NRfDBUN.exe
  2⤵
  PID:3464
- C:\Windows\System\UoGntfL.exe
  C:\Windows\System\UoGntfL.exe
  2⤵
  PID:3536
- C:\Windows\System\CxilLLP.exe
  C:\Windows\System\CxilLLP.exe
  2⤵
  PID:2428
- C:\Windows\System\uSpRVkZ.exe
  C:\Windows\System\uSpRVkZ.exe
  2⤵
  PID:2532
- C:\Windows\System\JNHuFjp.exe
  C:\Windows\System\JNHuFjp.exe
  2⤵
  PID:2588
- C:\Windows\System\gJgWfkd.exe
  C:\Windows\System\gJgWfkd.exe
  2⤵
  PID:4028
- C:\Windows\System\pBCnJEs.exe
  C:\Windows\System\pBCnJEs.exe
  2⤵
  PID:648
- C:\Windows\System\WKxWjLR.exe
  C:\Windows\System\WKxWjLR.exe
  2⤵
  PID:3128
- C:\Windows\System\XfgvygS.exe
  C:\Windows\System\XfgvygS.exe
  2⤵
  PID:3644
- C:\Windows\System\pNRnLIG.exe
  C:\Windows\System\pNRnLIG.exe
  2⤵
  PID:3056
- C:\Windows\System\TJhTtsp.exe
  C:\Windows\System\TJhTtsp.exe
  2⤵
  PID:3104
- C:\Windows\System\FAAqoLM.exe
  C:\Windows\System\FAAqoLM.exe
  2⤵
  PID:3804
- C:\Windows\System\nZHzlqM.exe
  C:\Windows\System\nZHzlqM.exe
  2⤵
  PID:3816
- C:\Windows\System\UmvgCWU.exe
  C:\Windows\System\UmvgCWU.exe
  2⤵
  PID:3828
- C:\Windows\System\ZNPCjtg.exe
  C:\Windows\System\ZNPCjtg.exe
  2⤵
  PID:3844
- C:\Windows\System\qmqPAzj.exe
  C:\Windows\System\qmqPAzj.exe
  2⤵
  PID:2636
- C:\Windows\System\XIqOWEy.exe
  C:\Windows\System\XIqOWEy.exe
  2⤵
  PID:3916
- C:\Windows\System\txqKLEy.exe
  C:\Windows\System\txqKLEy.exe
  2⤵
  PID:3928
- C:\Windows\System\YzLMlRY.exe
  C:\Windows\System\YzLMlRY.exe
  2⤵
  PID:1436
- C:\Windows\System\piSdIMd.exe
  C:\Windows\System\piSdIMd.exe
  2⤵
  PID:2720
- C:\Windows\System\cctSSIB.exe
  C:\Windows\System\cctSSIB.exe
  2⤵
  PID:3952
- C:\Windows\System\IEbwpFF.exe
  C:\Windows\System\IEbwpFF.exe
  2⤵
  PID:1896
- C:\Windows\System\kboxiWm.exe
  C:\Windows\System\kboxiWm.exe
  2⤵
  PID:3788
- C:\Windows\System\ZZsjteD.exe
  C:\Windows\System\ZZsjteD.exe
  2⤵
  PID:3628
- C:\Windows\System\LmxpTVL.exe
  C:\Windows\System\LmxpTVL.exe
  2⤵
  PID:3660
- C:\Windows\System\KmxNKow.exe
  C:\Windows\System\KmxNKow.exe
  2⤵
  PID:1992
- C:\Windows\System\rLDeeIj.exe
  C:\Windows\System\rLDeeIj.exe
  2⤵
  PID:3196
- C:\Windows\System\FKmmmZN.exe
  C:\Windows\System\FKmmmZN.exe
  2⤵
  PID:2420
- C:\Windows\System\xKcQsHq.exe
  C:\Windows\System\xKcQsHq.exe
  2⤵
  PID:3372
- C:\Windows\System\mgwetcx.exe
  C:\Windows\System\mgwetcx.exe
  2⤵
  PID:3568
- C:\Windows\System\eBDhAsS.exe
  C:\Windows\System\eBDhAsS.exe
  2⤵
  PID:4068
- C:\Windows\System\OmwAuRZ.exe
  C:\Windows\System\OmwAuRZ.exe
  2⤵
  PID:3328
- C:\Windows\System\uTshkuT.exe
  C:\Windows\System\uTshkuT.exe
  2⤵
  PID:1900
- C:\Windows\System\yRuDKIM.exe
  C:\Windows\System\yRuDKIM.exe
  2⤵
  PID:3612
- C:\Windows\System\MuriPWw.exe
  C:\Windows\System\MuriPWw.exe
  2⤵
  PID:2652
- C:\Windows\System\sRDjRJR.exe
  C:\Windows\System\sRDjRJR.exe
  2⤵
  PID:1104
- C:\Windows\System\zhbiyKv.exe
  C:\Windows\System\zhbiyKv.exe
  2⤵
  PID:1888
- C:\Windows\System\twrbeat.exe
  C:\Windows\System\twrbeat.exe
  2⤵
  PID:4000
- C:\Windows\System\XqzMMZu.exe
  C:\Windows\System\XqzMMZu.exe
  2⤵
  PID:2576
- C:\Windows\System\MTgjkGJ.exe
  C:\Windows\System\MTgjkGJ.exe
  2⤵
  PID:1976
- C:\Windows\System\tNFsjRV.exe
  C:\Windows\System\tNFsjRV.exe
  2⤵
  PID:3180
- C:\Windows\System\WkqeJeN.exe
  C:\Windows\System\WkqeJeN.exe
  2⤵
  PID:2064
- C:\Windows\System\rYOigwa.exe
  C:\Windows\System\rYOigwa.exe
  2⤵
  PID:1712
- C:\Windows\System\lFWozXo.exe
  C:\Windows\System\lFWozXo.exe
  2⤵
  PID:3708
- C:\Windows\System\gRVFJgg.exe
  C:\Windows\System\gRVFJgg.exe
  2⤵
  PID:3772
- C:\Windows\System\wITUxjS.exe
  C:\Windows\System\wITUxjS.exe
  2⤵
  PID:3812
- C:\Windows\System\UqmfmoB.exe
  C:\Windows\System\UqmfmoB.exe
  2⤵
  PID:856
- C:\Windows\System\UloNgqq.exe
  C:\Windows\System\UloNgqq.exe
  2⤵
  PID:3860
- C:\Windows\System\wLYtXOi.exe
  C:\Windows\System\wLYtXOi.exe
  2⤵
  PID:3956
- C:\Windows\System\CnTlVuF.exe
  C:\Windows\System\CnTlVuF.exe
  2⤵
  PID:2056
- C:\Windows\System\OSLCmhZ.exe
  C:\Windows\System\OSLCmhZ.exe
  2⤵
  PID:3832
- C:\Windows\System\txWgfpl.exe
  C:\Windows\System\txWgfpl.exe
  2⤵
  PID:2772
- C:\Windows\System\fgdezIn.exe
  C:\Windows\System\fgdezIn.exe
  2⤵
  PID:2596
- C:\Windows\System\dMfxJxJ.exe
  C:\Windows\System\dMfxJxJ.exe
  2⤵
  PID:3792
- C:\Windows\System\oDpNOqd.exe
  C:\Windows\System\oDpNOqd.exe
  2⤵
  PID:3448
- C:\Windows\System\pdwbbGo.exe
  C:\Windows\System\pdwbbGo.exe
  2⤵
  PID:1732
- C:\Windows\System\OZTamZD.exe
  C:\Windows\System\OZTamZD.exe
  2⤵
  PID:1268
- C:\Windows\System\NWWIULL.exe
  C:\Windows\System\NWWIULL.exe
  2⤵
  PID:568
- C:\Windows\System\haCiVEi.exe
  C:\Windows\System\haCiVEi.exe
  2⤵
  PID:1988
- C:\Windows\System\kbctyxR.exe
  C:\Windows\System\kbctyxR.exe
  2⤵
  PID:3288
- C:\Windows\System\RFQuAyQ.exe
  C:\Windows\System\RFQuAyQ.exe
  2⤵
  PID:3404
- C:\Windows\System\GKtQfyt.exe
  C:\Windows\System\GKtQfyt.exe
  2⤵
  PID:2808
- C:\Windows\System\fbGYgBk.exe
  C:\Windows\System\fbGYgBk.exe
  2⤵
  PID:1820
- C:\Windows\System\RtjluSt.exe
  C:\Windows\System\RtjluSt.exe
  2⤵
  PID:3076
- C:\Windows\System\OdjaWUi.exe
  C:\Windows\System\OdjaWUi.exe
  2⤵
  PID:1328
- C:\Windows\System\ObafVoF.exe
  C:\Windows\System\ObafVoF.exe
  2⤵
  PID:2656
- C:\Windows\System\mAbBjrL.exe
  C:\Windows\System\mAbBjrL.exe
  2⤵
  PID:3936
- C:\Windows\System\PyYnnGq.exe
  C:\Windows\System\PyYnnGq.exe
  2⤵
  PID:3996
- C:\Windows\System\vvutdTJ.exe
  C:\Windows\System\vvutdTJ.exe
  2⤵
  PID:3728
- C:\Windows\System\STQQhib.exe
  C:\Windows\System\STQQhib.exe
  2⤵
  PID:3088
- C:\Windows\System\GKlPJqX.exe
  C:\Windows\System\GKlPJqX.exe
  2⤵
  PID:2148
- C:\Windows\System\htXhxdp.exe
  C:\Windows\System\htXhxdp.exe
  2⤵
  PID:1332
- C:\Windows\System\qRtHYis.exe
  C:\Windows\System\qRtHYis.exe
  2⤵
  PID:3820
- C:\Windows\System\vNNqIYh.exe
  C:\Windows\System\vNNqIYh.exe
  2⤵
  PID:3296
- C:\Windows\System\PshMDiw.exe
  C:\Windows\System\PshMDiw.exe
  2⤵
  PID:2324
- C:\Windows\System\yboTTWD.exe
  C:\Windows\System\yboTTWD.exe
  2⤵
  PID:3548
- C:\Windows\System\HPtJirf.exe
  C:\Windows\System\HPtJirf.exe
  2⤵
  PID:1676
- C:\Windows\System\FumhiTQ.exe
  C:\Windows\System\FumhiTQ.exe
  2⤵
  PID:1360
- C:\Windows\System\AFHcXEy.exe
  C:\Windows\System\AFHcXEy.exe
  2⤵
  PID:4080
- C:\Windows\System\PzmmeUK.exe
  C:\Windows\System\PzmmeUK.exe
  2⤵
  PID:2524
- C:\Windows\System\uSxaeEI.exe
  C:\Windows\System\uSxaeEI.exe
  2⤵
  PID:2464
- C:\Windows\System\zyDHXhm.exe
  C:\Windows\System\zyDHXhm.exe
  2⤵
  PID:2516
- C:\Windows\System\NOtttkW.exe
  C:\Windows\System\NOtttkW.exe
  2⤵
  PID:3004
- C:\Windows\System\kXrLAwS.exe
  C:\Windows\System\kXrLAwS.exe
  2⤵
  PID:2384
- C:\Windows\System\GtysnED.exe
  C:\Windows\System\GtysnED.exe
  2⤵
  PID:2452
- C:\Windows\System\IKiPBJt.exe
  C:\Windows\System\IKiPBJt.exe
  2⤵
  PID:1840
- C:\Windows\System\zrVlpNw.exe
  C:\Windows\System\zrVlpNw.exe
  2⤵
  PID:2200
- C:\Windows\System\SDNNtKv.exe
  C:\Windows\System\SDNNtKv.exe
  2⤵
  PID:2152
- C:\Windows\System\IQZSWeY.exe
  C:\Windows\System\IQZSWeY.exe
  2⤵
  PID:2948
- C:\Windows\System\IpDaRtx.exe
  C:\Windows\System\IpDaRtx.exe
  2⤵
  PID:3308
- C:\Windows\System\snNQuxR.exe
  C:\Windows\System\snNQuxR.exe
  2⤵
  PID:3808
- C:\Windows\System\CdXDKeO.exe
  C:\Windows\System\CdXDKeO.exe
  2⤵
  PID:1828
- C:\Windows\System\xlHnlvm.exe
  C:\Windows\System\xlHnlvm.exe
  2⤵
  PID:3564
- C:\Windows\System\NWWdIBh.exe
  C:\Windows\System\NWWdIBh.exe
  2⤵
  PID:1872
- C:\Windows\System\LFzXbZU.exe
  C:\Windows\System\LFzXbZU.exe
  2⤵
  PID:3312
- C:\Windows\System\IJHtSnu.exe
  C:\Windows\System\IJHtSnu.exe
  2⤵
  PID:3384
- C:\Windows\System\VNOWwgH.exe
  C:\Windows\System\VNOWwgH.exe
  2⤵
  PID:892
- C:\Windows\System\JNCvYjn.exe
  C:\Windows\System\JNCvYjn.exe
  2⤵
  PID:4116
- C:\Windows\System\beMcyVG.exe
  C:\Windows\System\beMcyVG.exe
  2⤵
  PID:4132
- C:\Windows\System\xUkYkPL.exe
  C:\Windows\System\xUkYkPL.exe
  2⤵
  PID:4148
- C:\Windows\System\cZwLaxt.exe
  C:\Windows\System\cZwLaxt.exe
  2⤵
  PID:4164
- C:\Windows\System\kxrCmQK.exe
  C:\Windows\System\kxrCmQK.exe
  2⤵
  PID:4180
- C:\Windows\System\ZPFtvAe.exe
  C:\Windows\System\ZPFtvAe.exe
  2⤵
  PID:4196
- C:\Windows\System\AiWHNOa.exe
  C:\Windows\System\AiWHNOa.exe
  2⤵
  PID:4216
- C:\Windows\System\pypXukA.exe
  C:\Windows\System\pypXukA.exe
  2⤵
  PID:4232
- C:\Windows\System\XLpHvVW.exe
  C:\Windows\System\XLpHvVW.exe
  2⤵
  PID:4248
- C:\Windows\System\oTArTLI.exe
  C:\Windows\System\oTArTLI.exe
  2⤵
  PID:4264
- C:\Windows\System\gavvqDx.exe
  C:\Windows\System\gavvqDx.exe
  2⤵
  PID:4280
- C:\Windows\System\eEeTIyg.exe
  C:\Windows\System\eEeTIyg.exe
  2⤵
  PID:4296
- C:\Windows\System\cZHesWw.exe
  C:\Windows\System\cZHesWw.exe
  2⤵
  PID:4312
- C:\Windows\System\JgYTbGd.exe
  C:\Windows\System\JgYTbGd.exe
  2⤵
  PID:4332
- C:\Windows\System\gEfOjjY.exe
  C:\Windows\System\gEfOjjY.exe
  2⤵
  PID:4348
- C:\Windows\System\deBcmMl.exe
  C:\Windows\System\deBcmMl.exe
  2⤵
  PID:4364
- C:\Windows\System\JjoqvEl.exe
  C:\Windows\System\JjoqvEl.exe
  2⤵
  PID:4380
- C:\Windows\System\BueUixR.exe
  C:\Windows\System\BueUixR.exe
  2⤵
  PID:4396
- C:\Windows\System\zQeyseR.exe
  C:\Windows\System\zQeyseR.exe
  2⤵
  PID:4412
- C:\Windows\System\hOnysDw.exe
  C:\Windows\System\hOnysDw.exe
  2⤵
  PID:4428
- C:\Windows\System\cqFErWF.exe
  C:\Windows\System\cqFErWF.exe
  2⤵
  PID:4448
- C:\Windows\System\kXKdrjL.exe
  C:\Windows\System\kXKdrjL.exe
  2⤵
  PID:4592
- C:\Windows\System\vrAhZXo.exe
  C:\Windows\System\vrAhZXo.exe
  2⤵
  PID:4616
- C:\Windows\System\qORmbGs.exe
  C:\Windows\System\qORmbGs.exe
  2⤵
  PID:4640
- C:\Windows\System\uvXIzbi.exe
  C:\Windows\System\uvXIzbi.exe
  2⤵
  PID:4656
- C:\Windows\System\itDUeKA.exe
  C:\Windows\System\itDUeKA.exe
  2⤵
  PID:4672
- C:\Windows\System\zTXoyEs.exe
  C:\Windows\System\zTXoyEs.exe
  2⤵
  PID:4688
- C:\Windows\System\rdyFgbZ.exe
  C:\Windows\System\rdyFgbZ.exe
  2⤵
  PID:4704
- C:\Windows\System\QYPJtlC.exe
  C:\Windows\System\QYPJtlC.exe
  2⤵
  PID:4724
- C:\Windows\System\TddUTRF.exe
  C:\Windows\System\TddUTRF.exe
  2⤵
  PID:4740
- C:\Windows\System\uiXNyvl.exe
  C:\Windows\System\uiXNyvl.exe
  2⤵
  PID:4760
- C:\Windows\System\AzNcqss.exe
  C:\Windows\System\AzNcqss.exe
  2⤵
  PID:4776
- C:\Windows\System\izOjxch.exe
  C:\Windows\System\izOjxch.exe
  2⤵
  PID:4796
- C:\Windows\System\XJiVxQL.exe
  C:\Windows\System\XJiVxQL.exe
  2⤵
  PID:4812
- C:\Windows\System\aoonwDj.exe
  C:\Windows\System\aoonwDj.exe
  2⤵
  PID:4828
- C:\Windows\System\vCYdBwa.exe
  C:\Windows\System\vCYdBwa.exe
  2⤵
  PID:4880
- C:\Windows\System\VHTeCEo.exe
  C:\Windows\System\VHTeCEo.exe
  2⤵
  PID:4896
- C:\Windows\System\BXfFKPX.exe
  C:\Windows\System\BXfFKPX.exe
  2⤵
  PID:4912
- C:\Windows\System\TgRZIhr.exe
  C:\Windows\System\TgRZIhr.exe
  2⤵
  PID:4928
- C:\Windows\System\iooWQVP.exe
  C:\Windows\System\iooWQVP.exe
  2⤵
  PID:4944
- C:\Windows\System\qyluuKB.exe
  C:\Windows\System\qyluuKB.exe
  2⤵
  PID:4964
- C:\Windows\System\UBaNPBr.exe
  C:\Windows\System\UBaNPBr.exe
  2⤵
  PID:4980
- C:\Windows\System\PFZDtcO.exe
  C:\Windows\System\PFZDtcO.exe
  2⤵
  PID:4996
- C:\Windows\System\uGiTfar.exe
  C:\Windows\System\uGiTfar.exe
  2⤵
  PID:5020
- C:\Windows\System\UMGRsIv.exe
  C:\Windows\System\UMGRsIv.exe
  2⤵
  PID:5036
- C:\Windows\System\ViAOwVs.exe
  C:\Windows\System\ViAOwVs.exe
  2⤵
  PID:5056
- C:\Windows\System\nISdZPm.exe
  C:\Windows\System\nISdZPm.exe
  2⤵
  PID:5072
- C:\Windows\System\uWHegEZ.exe
  C:\Windows\System\uWHegEZ.exe
  2⤵
  PID:5088
- C:\Windows\System\bqQVwMP.exe
  C:\Windows\System\bqQVwMP.exe
  2⤵
  PID:5112
- C:\Windows\System\GqtUMyr.exe
  C:\Windows\System\GqtUMyr.exe
  2⤵
  PID:1808
- C:\Windows\System\nCVNmBu.exe
  C:\Windows\System\nCVNmBu.exe
  2⤵
  PID:3388
- C:\Windows\System\bNqKRmq.exe
  C:\Windows\System\bNqKRmq.exe
  2⤵
  PID:1136
- C:\Windows\System\cvbqzmp.exe
  C:\Windows\System\cvbqzmp.exe
  2⤵
  PID:4176
- C:\Windows\System\oHeVoTf.exe
  C:\Windows\System\oHeVoTf.exe
  2⤵
  PID:4240
- C:\Windows\System\dxJUmQg.exe
  C:\Windows\System\dxJUmQg.exe
  2⤵
  PID:3724
- C:\Windows\System\FIKaMwC.exe
  C:\Windows\System\FIKaMwC.exe
  2⤵
  PID:2564
- C:\Windows\System\ZMFYUHn.exe
  C:\Windows\System\ZMFYUHn.exe
  2⤵
  PID:1780
- C:\Windows\System\SFRRgiW.exe
  C:\Windows\System\SFRRgiW.exe
  2⤵
  PID:4128
- C:\Windows\System\nrCvRSj.exe
  C:\Windows\System\nrCvRSj.exe
  2⤵
  PID:4192
- C:\Windows\System\HJKrGuE.exe
  C:\Windows\System\HJKrGuE.exe
  2⤵
  PID:4260
- C:\Windows\System\eJlLNCc.exe
  C:\Windows\System\eJlLNCc.exe
  2⤵
  PID:4392
- C:\Windows\System\TyDOrFT.exe
  C:\Windows\System\TyDOrFT.exe
  2⤵
  PID:4456
- C:\Windows\System\IMlbGzB.exe
  C:\Windows\System\IMlbGzB.exe
  2⤵
  PID:4356
- C:\Windows\System\VxEJbCC.exe
  C:\Windows\System\VxEJbCC.exe
  2⤵
  PID:4468
- C:\Windows\System\ehqgqLo.exe
  C:\Windows\System\ehqgqLo.exe
  2⤵
  PID:4496
- C:\Windows\System\WQwxYYE.exe
  C:\Windows\System\WQwxYYE.exe
  2⤵
  PID:4516
- C:\Windows\System\YajICIo.exe
  C:\Windows\System\YajICIo.exe
  2⤵
  PID:4524
- C:\Windows\System\sOsCzBZ.exe
  C:\Windows\System\sOsCzBZ.exe
  2⤵
  PID:4552
- C:\Windows\System\HtIDcKL.exe
  C:\Windows\System\HtIDcKL.exe
  2⤵
  PID:4564
- C:\Windows\System\mpXbnOn.exe
  C:\Windows\System\mpXbnOn.exe
  2⤵
  PID:4588
- C:\Windows\System\sRXfevY.exe
  C:\Windows\System\sRXfevY.exe
  2⤵
  PID:4604
- C:\Windows\System\JoCqcye.exe
  C:\Windows\System\JoCqcye.exe
  2⤵
  PID:4632
- C:\Windows\System\quPaeGJ.exe
  C:\Windows\System\quPaeGJ.exe
  2⤵
  PID:4664
- C:\Windows\System\FrULstn.exe
  C:\Windows\System\FrULstn.exe
  2⤵
  PID:4716
- C:\Windows\System\HVdVnIq.exe
  C:\Windows\System\HVdVnIq.exe
  2⤵
  PID:4748
- C:\Windows\System\KiECwWJ.exe
  C:\Windows\System\KiECwWJ.exe
  2⤵
  PID:4868
- C:\Windows\System\gMsUmpp.exe
  C:\Windows\System\gMsUmpp.exe
  2⤵
  PID:4952
- C:\Windows\System\SCipgSf.exe
  C:\Windows\System\SCipgSf.exe
  2⤵
  PID:4992
- C:\Windows\System\gGNcmJo.exe
  C:\Windows\System\gGNcmJo.exe
  2⤵
  PID:5028
- C:\Windows\System\gfTRMSc.exe
  C:\Windows\System\gfTRMSc.exe
  2⤵
  PID:5104
- C:\Windows\System\eIhhyIv.exe
  C:\Windows\System\eIhhyIv.exe
  2⤵
  PID:5064
- C:\Windows\System\kLXNgeg.exe
  C:\Windows\System\kLXNgeg.exe
  2⤵
  PID:4276
- C:\Windows\System\PKjLIbp.exe
  C:\Windows\System\PKjLIbp.exe
  2⤵
  PID:4292
- C:\Windows\System\BBJHCoq.exe
  C:\Windows\System\BBJHCoq.exe
  2⤵
  PID:4212
- C:\Windows\System\FZYifrN.exe
  C:\Windows\System\FZYifrN.exe
  2⤵
  PID:5008
- C:\Windows\System\CHWegmM.exe
  C:\Windows\System\CHWegmM.exe
  2⤵
  PID:4360
- C:\Windows\System\EVYdUGa.exe
  C:\Windows\System\EVYdUGa.exe
  2⤵
  PID:4160
- C:\Windows\System\wxVlSfV.exe
  C:\Windows\System\wxVlSfV.exe
  2⤵
  PID:4440
- C:\Windows\System\igGZvxM.exe
  C:\Windows\System\igGZvxM.exe
  2⤵
  PID:4460
- C:\Windows\System\YXlsJfB.exe
  C:\Windows\System\YXlsJfB.exe
  2⤵
  PID:4512
- C:\Windows\System\GRWVbuq.exe
  C:\Windows\System\GRWVbuq.exe
  2⤵
  PID:4572
- C:\Windows\System\jlNGwfr.exe
  C:\Windows\System\jlNGwfr.exe
  2⤵
  PID:4904
- C:\Windows\System\yxoklcH.exe
  C:\Windows\System\yxoklcH.exe
  2⤵
  PID:4860
- C:\Windows\System\uwLSEcH.exe
  C:\Windows\System\uwLSEcH.exe
  2⤵
  PID:4848
- C:\Windows\System\arnuqqH.exe
  C:\Windows\System\arnuqqH.exe
  2⤵
  PID:4772
- C:\Windows\System\SgINUMx.exe
  C:\Windows\System\SgINUMx.exe
  2⤵
  PID:4700
- C:\Windows\System\RelhqVu.exe
  C:\Windows\System\RelhqVu.exe
  2⤵
  PID:4908
- C:\Windows\System\IAiEuYK.exe
  C:\Windows\System\IAiEuYK.exe
  2⤵
  PID:5032
- C:\Windows\System\stpPvZE.exe
  C:\Windows\System\stpPvZE.exe
  2⤵
  PID:4940
- C:\Windows\System\KUmfPkc.exe
  C:\Windows\System\KUmfPkc.exe
  2⤵
  PID:4304
- C:\Windows\System\AGWreeR.exe
  C:\Windows\System\AGWreeR.exe
  2⤵
  PID:4104
- C:\Windows\System\HcIrIxR.exe
  C:\Windows\System\HcIrIxR.exe
  2⤵
  PID:5044
- C:\Windows\System\rLyqbjq.exe
  C:\Windows\System\rLyqbjq.exe
  2⤵
  PID:4976
- C:\Windows\System\biYUDTh.exe
  C:\Windows\System\biYUDTh.exe
  2⤵
  PID:1200
- C:\Windows\System\xLpXlmz.exe
  C:\Windows\System\xLpXlmz.exe
  2⤵
  PID:4376
- C:\Windows\System\JhkguPF.exe
  C:\Windows\System\JhkguPF.exe
  2⤵
  PID:4560
- C:\Windows\System\EdAvyjc.exe
  C:\Windows\System\EdAvyjc.exe
  2⤵
  PID:4784
- C:\Windows\System\nFfrZfZ.exe
  C:\Windows\System\nFfrZfZ.exe
  2⤵
  PID:4228
- C:\Windows\System\eMoUFtm.exe
  C:\Windows\System\eMoUFtm.exe
  2⤵
  PID:4720
- C:\Windows\System\IOHamIp.exe
  C:\Windows\System\IOHamIp.exe
  2⤵
  PID:584
- C:\Windows\System\ygiitox.exe
  C:\Windows\System\ygiitox.exe
  2⤵
  PID:4736
- C:\Windows\System\egGZugq.exe
  C:\Windows\System\egGZugq.exe
  2⤵
  PID:4768
- C:\Windows\System\tLMwZla.exe
  C:\Windows\System\tLMwZla.exe
  2⤵
  PID:4872
- C:\Windows\System\PhDXudZ.exe
  C:\Windows\System\PhDXudZ.exe
  2⤵
  PID:4444
- C:\Windows\System\nOChXWN.exe
  C:\Windows\System\nOChXWN.exe
  2⤵
  PID:4140
- C:\Windows\System\PymCEeD.exe
  C:\Windows\System\PymCEeD.exe
  2⤵
  PID:4696
- C:\Windows\System\siBYsfB.exe
  C:\Windows\System\siBYsfB.exe
  2⤵
  PID:5048
- C:\Windows\System\DEXLoXl.exe
  C:\Windows\System\DEXLoXl.exe
  2⤵
  PID:4836
- C:\Windows\System\XvpVMwD.exe
  C:\Windows\System\XvpVMwD.exe
  2⤵
  PID:5080
- C:\Windows\System\nyRltJv.exe
  C:\Windows\System\nyRltJv.exe
  2⤵
  PID:4556
- C:\Windows\System\EDnwEAM.exe
  C:\Windows\System\EDnwEAM.exe
  2⤵
  PID:4256
- C:\Windows\System\VVqNZsj.exe
  C:\Windows\System\VVqNZsj.exe
  2⤵
  PID:4788
- C:\Windows\System\RGfSOvf.exe
  C:\Windows\System\RGfSOvf.exe
  2⤵
  PID:4324
- C:\Windows\System\QxswAXP.exe
  C:\Windows\System\QxswAXP.exe
  2⤵
  PID:4272
- C:\Windows\System\OfjQBrf.exe
  C:\Windows\System\OfjQBrf.exe
  2⤵
  PID:4124
- C:\Windows\System\pHfHEys.exe
  C:\Windows\System\pHfHEys.exe
  2⤵
  PID:960
- C:\Windows\System\QTXqrcq.exe
  C:\Windows\System\QTXqrcq.exe
  2⤵
  PID:4936
- C:\Windows\System\GyZoZMs.exe
  C:\Windows\System\GyZoZMs.exe
  2⤵
  PID:5012
- C:\Windows\System\XctXuCq.exe
  C:\Windows\System\XctXuCq.exe
  2⤵
  PID:4668
- C:\Windows\System\aQlJESx.exe
  C:\Windows\System\aQlJESx.exe
  2⤵
  PID:5128
- C:\Windows\System\nRnzfiM.exe
  C:\Windows\System\nRnzfiM.exe
  2⤵
  PID:5144
- C:\Windows\System\Cmoqcke.exe
  C:\Windows\System\Cmoqcke.exe
  2⤵
  PID:5160
- C:\Windows\System\amWMhIo.exe
  C:\Windows\System\amWMhIo.exe
  2⤵
  PID:5176
- C:\Windows\System\pKIeuxS.exe
  C:\Windows\System\pKIeuxS.exe
  2⤵
  PID:5192
- C:\Windows\System\hRgxQKp.exe
  C:\Windows\System\hRgxQKp.exe
  2⤵
  PID:5208
- C:\Windows\System\ilysQVk.exe
  C:\Windows\System\ilysQVk.exe
  2⤵
  PID:5224
- C:\Windows\System\sVkyBBy.exe
  C:\Windows\System\sVkyBBy.exe
  2⤵
  PID:5240
- C:\Windows\System\iCeSFkh.exe
  C:\Windows\System\iCeSFkh.exe
  2⤵
  PID:5256
- C:\Windows\System\jaJirdC.exe
  C:\Windows\System\jaJirdC.exe
  2⤵
  PID:5276
- C:\Windows\System\pZBqQgI.exe
  C:\Windows\System\pZBqQgI.exe
  2⤵
  PID:5292
- C:\Windows\System\NNmtOYq.exe
  C:\Windows\System\NNmtOYq.exe
  2⤵
  PID:5308
- C:\Windows\System\tdMbqgy.exe
  C:\Windows\System\tdMbqgy.exe
  2⤵
  PID:5324
- C:\Windows\System\BhbcqVR.exe
  C:\Windows\System\BhbcqVR.exe
  2⤵
  PID:5340
- C:\Windows\System\yeHBZhu.exe
  C:\Windows\System\yeHBZhu.exe
  2⤵
  PID:5356
- C:\Windows\System\aQttJXr.exe
  C:\Windows\System\aQttJXr.exe
  2⤵
  PID:5372
- C:\Windows\System\wvdCBHQ.exe
  C:\Windows\System\wvdCBHQ.exe
  2⤵
  PID:5396
- C:\Windows\System\rSazzwU.exe
  C:\Windows\System\rSazzwU.exe
  2⤵
  PID:5424
- C:\Windows\System\ELXWFcm.exe
  C:\Windows\System\ELXWFcm.exe
  2⤵
  PID:5440
- C:\Windows\System\KLNzhco.exe
  C:\Windows\System\KLNzhco.exe
  2⤵
  PID:5456
- C:\Windows\System\jovteDG.exe
  C:\Windows\System\jovteDG.exe
  2⤵
  PID:5472
- C:\Windows\System\fnAWwSO.exe
  C:\Windows\System\fnAWwSO.exe
  2⤵
  PID:5488
- C:\Windows\System\Sjfoohm.exe
  C:\Windows\System\Sjfoohm.exe
  2⤵
  PID:5504
- C:\Windows\System\clSXLpb.exe
  C:\Windows\System\clSXLpb.exe
  2⤵
  PID:5520
- C:\Windows\System\LOlsHVS.exe
  C:\Windows\System\LOlsHVS.exe
  2⤵
  PID:5536
- C:\Windows\System\uNTWQFN.exe
  C:\Windows\System\uNTWQFN.exe
  2⤵
  PID:5552
- C:\Windows\System\RIjvoFz.exe
  C:\Windows\System\RIjvoFz.exe
  2⤵
  PID:5568
- C:\Windows\System\SASmYQA.exe
  C:\Windows\System\SASmYQA.exe
  2⤵
  PID:5584
- C:\Windows\System\sCUddNa.exe
  C:\Windows\System\sCUddNa.exe
  2⤵
  PID:5600
- C:\Windows\System\xMznETz.exe
  C:\Windows\System\xMznETz.exe
  2⤵
  PID:5616
- C:\Windows\System\VLdNNVB.exe
  C:\Windows\System\VLdNNVB.exe
  2⤵
  PID:5632
- C:\Windows\System\DyhIcxV.exe
  C:\Windows\System\DyhIcxV.exe
  2⤵
  PID:5648
- C:\Windows\System\ymYmudh.exe
  C:\Windows\System\ymYmudh.exe
  2⤵
  PID:5664
- C:\Windows\System\wbgWSDs.exe
  C:\Windows\System\wbgWSDs.exe
  2⤵
  PID:5680
- C:\Windows\System\knsBAqk.exe
  C:\Windows\System\knsBAqk.exe
  2⤵
  PID:5696
- C:\Windows\System\cGoTkAV.exe
  C:\Windows\System\cGoTkAV.exe
  2⤵
  PID:5712
- C:\Windows\System\QCWPOuR.exe
  C:\Windows\System\QCWPOuR.exe
  2⤵
  PID:5728
- C:\Windows\System\iurIvgn.exe
  C:\Windows\System\iurIvgn.exe
  2⤵
  PID:5744
- C:\Windows\System\wuyxVuH.exe
  C:\Windows\System\wuyxVuH.exe
  2⤵
  PID:5760
- C:\Windows\System\KUIJsQK.exe
  C:\Windows\System\KUIJsQK.exe
  2⤵
  PID:5776
- C:\Windows\System\zfNDEqa.exe
  C:\Windows\System\zfNDEqa.exe
  2⤵
  PID:5792
- C:\Windows\System\OXJpFuW.exe
  C:\Windows\System\OXJpFuW.exe
  2⤵
  PID:5812
- C:\Windows\System\QcEMwel.exe
  C:\Windows\System\QcEMwel.exe
  2⤵
  PID:5828
- C:\Windows\System\WjPiBKM.exe
  C:\Windows\System\WjPiBKM.exe
  2⤵
  PID:5844
- C:\Windows\System\TjrcANP.exe
  C:\Windows\System\TjrcANP.exe
  2⤵
  PID:5860
- C:\Windows\System\rNWMBUJ.exe
  C:\Windows\System\rNWMBUJ.exe
  2⤵
  PID:5876
- C:\Windows\System\nouvhAS.exe
  C:\Windows\System\nouvhAS.exe
  2⤵
  PID:5892
- C:\Windows\System\zEsQaMS.exe
  C:\Windows\System\zEsQaMS.exe
  2⤵
  PID:5908
- C:\Windows\System\OyGpScd.exe
  C:\Windows\System\OyGpScd.exe
  2⤵
  PID:5924
- C:\Windows\System\UdrZzfV.exe
  C:\Windows\System\UdrZzfV.exe
  2⤵
  PID:5940
- C:\Windows\System\JKZDTga.exe
  C:\Windows\System\JKZDTga.exe
  2⤵
  PID:5956
- C:\Windows\System\RiBFocM.exe
  C:\Windows\System\RiBFocM.exe
  2⤵
  PID:5972
- C:\Windows\System\GcvaoSM.exe
  C:\Windows\System\GcvaoSM.exe
  2⤵
  PID:5988
- C:\Windows\System\QtpWyqH.exe
  C:\Windows\System\QtpWyqH.exe
  2⤵
  PID:6004
- C:\Windows\System\xDazkff.exe
  C:\Windows\System\xDazkff.exe
  2⤵
  PID:6020
- C:\Windows\System\uGslJrZ.exe
  C:\Windows\System\uGslJrZ.exe
  2⤵
  PID:6036
- C:\Windows\System\YMcZoFw.exe
  C:\Windows\System\YMcZoFw.exe
  2⤵
  PID:6052
- C:\Windows\System\DPtEGAv.exe
  C:\Windows\System\DPtEGAv.exe
  2⤵
  PID:6068
- C:\Windows\System\EMlqrSI.exe
  C:\Windows\System\EMlqrSI.exe
  2⤵
  PID:6084
- C:\Windows\System\orRgrJO.exe
  C:\Windows\System\orRgrJO.exe
  2⤵
  PID:6100
- C:\Windows\System\WPKMxOe.exe
  C:\Windows\System\WPKMxOe.exe
  2⤵
  PID:6116
- C:\Windows\System\NSkqUpx.exe
  C:\Windows\System\NSkqUpx.exe
  2⤵
  PID:6132
- C:\Windows\System\fSqtlLX.exe
  C:\Windows\System\fSqtlLX.exe
  2⤵
  PID:5152
- C:\Windows\System\mcMSFrd.exe
  C:\Windows\System\mcMSFrd.exe
  2⤵
  PID:5052
- C:\Windows\System\KaPJTha.exe
  C:\Windows\System\KaPJTha.exe
  2⤵
  PID:5124
- C:\Windows\System\HyBCbwM.exe
  C:\Windows\System\HyBCbwM.exe
  2⤵
  PID:4792
- C:\Windows\System\PTbPDJp.exe
  C:\Windows\System\PTbPDJp.exe
  2⤵
  PID:4544
- C:\Windows\System\XljrwOo.exe
  C:\Windows\System\XljrwOo.exe
  2⤵
  PID:5172
- C:\Windows\System\bbRiTLC.exe
  C:\Windows\System\bbRiTLC.exe
  2⤵
  PID:5264
- C:\Windows\System\aQZMCou.exe
  C:\Windows\System\aQZMCou.exe
  2⤵
  PID:5248
- C:\Windows\System\sIyIbTN.exe
  C:\Windows\System\sIyIbTN.exe
  2⤵
  PID:5288
- C:\Windows\System\oslPYfA.exe
  C:\Windows\System\oslPYfA.exe
  2⤵
  PID:5316
- C:\Windows\System\VTlwkia.exe
  C:\Windows\System\VTlwkia.exe
  2⤵
  PID:5336
- C:\Windows\System\jBjSxqK.exe
  C:\Windows\System\jBjSxqK.exe
  2⤵
  PID:5384
- C:\Windows\System\DQKAVBA.exe
  C:\Windows\System\DQKAVBA.exe
  2⤵
  PID:5388
- C:\Windows\System\fBHgJXS.exe
  C:\Windows\System\fBHgJXS.exe
  2⤵
  PID:5432
- C:\Windows\System\OElzMYv.exe
  C:\Windows\System\OElzMYv.exe
  2⤵
  PID:5468
- C:\Windows\System\mUgMDEo.exe
  C:\Windows\System\mUgMDEo.exe
  2⤵
  PID:5516
- C:\Windows\System\GLsVsjY.exe
  C:\Windows\System\GLsVsjY.exe
  2⤵
  PID:5580
- C:\Windows\System\MhdOVfg.exe
  C:\Windows\System\MhdOVfg.exe
  2⤵
  PID:5644
- C:\Windows\System\VRltlAW.exe
  C:\Windows\System\VRltlAW.exe
  2⤵
  PID:5708
- C:\Windows\System\YgKucxz.exe
  C:\Windows\System\YgKucxz.exe
  2⤵
  PID:5772
- C:\Windows\System\SypdwNH.exe
  C:\Windows\System\SypdwNH.exe
  2⤵
  PID:4988
- C:\Windows\System\vjEguln.exe
  C:\Windows\System\vjEguln.exe
  2⤵
  PID:5500
- C:\Windows\System\zkDQpeK.exe
  C:\Windows\System\zkDQpeK.exe
  2⤵
  PID:5624
- C:\Windows\System\hFcwZeP.exe
  C:\Windows\System\hFcwZeP.exe
  2⤵
  PID:2188
- C:\Windows\System\BKyBJXu.exe
  C:\Windows\System\BKyBJXu.exe
  2⤵
  PID:5692
- C:\Windows\System\FuVysbv.exe
  C:\Windows\System\FuVysbv.exe
  2⤵
  PID:5756
- C:\Windows\System\KDnvPCW.exe
  C:\Windows\System\KDnvPCW.exe
  2⤵
  PID:5904
- C:\Windows\System\zkOOrMO.exe
  C:\Windows\System\zkOOrMO.exe
  2⤵
  PID:5872
- C:\Windows\System\igoWGFd.exe
  C:\Windows\System\igoWGFd.exe
  2⤵
  PID:5968
- C:\Windows\System\ZtxISTk.exe
  C:\Windows\System\ZtxISTk.exe
  2⤵
  PID:6060
- C:\Windows\System\wtZlinv.exe
  C:\Windows\System\wtZlinv.exe
  2⤵
  PID:6124
- C:\Windows\System\ilqCJeo.exe
  C:\Windows\System\ilqCJeo.exe
  2⤵
  PID:4208
- C:\Windows\System\cYMglZJ.exe
  C:\Windows\System\cYMglZJ.exe
  2⤵
  PID:5168
- C:\Windows\System\jGTUubK.exe
  C:\Windows\System\jGTUubK.exe
  2⤵
  PID:5852
- C:\Windows\System\lhjjQCj.exe
  C:\Windows\System\lhjjQCj.exe
  2⤵
  PID:5916
- C:\Windows\System\gYtjmSA.exe
  C:\Windows\System\gYtjmSA.exe
  2⤵
  PID:5980
- C:\Windows\System\AWVRfea.exe
  C:\Windows\System\AWVRfea.exe
  2⤵
  PID:6048
- C:\Windows\System\lYzTxah.exe
  C:\Windows\System\lYzTxah.exe
  2⤵
  PID:6108
- C:\Windows\System\rvqwRRW.exe
  C:\Windows\System\rvqwRRW.exe
  2⤵
  PID:4600
- C:\Windows\System\gSbXkWe.exe
  C:\Windows\System\gSbXkWe.exe
  2⤵
  PID:5204
- C:\Windows\System\KsSdhtE.exe
  C:\Windows\System\KsSdhtE.exe
  2⤵
  PID:5304
- C:\Windows\System\uBjNcZP.exe
  C:\Windows\System\uBjNcZP.exe
  2⤵
  PID:5448
- C:\Windows\System\anHdAdM.exe
  C:\Windows\System\anHdAdM.exe
  2⤵
  PID:5612
- C:\Windows\System\dTrLTJg.exe
  C:\Windows\System\dTrLTJg.exe
  2⤵
  PID:5768
- C:\Windows\System\KfpagMG.exe
  C:\Windows\System\KfpagMG.exe
  2⤵
  PID:5660
- C:\Windows\System\urkrrwP.exe
  C:\Windows\System\urkrrwP.exe
  2⤵
  PID:5868
- C:\Windows\System\fkuKSoq.exe
  C:\Windows\System\fkuKSoq.exe
  2⤵
  PID:6128
- C:\Windows\System\rnhEqyK.exe
  C:\Windows\System\rnhEqyK.exe
  2⤵
  PID:5320
- C:\Windows\System\ZjkcARm.exe
  C:\Windows\System\ZjkcARm.exe
  2⤵
  PID:5808
- C:\Windows\System\HFQRpiY.exe
  C:\Windows\System\HFQRpiY.exe
  2⤵
  PID:5936
- C:\Windows\System\plfSFTu.exe
  C:\Windows\System\plfSFTu.exe
  2⤵
  PID:5576
- C:\Windows\System\FKOjxED.exe
  C:\Windows\System\FKOjxED.exe
  2⤵
  PID:5596
- C:\Windows\System\ynRdqJa.exe
  C:\Windows\System\ynRdqJa.exe
  2⤵
  PID:6064
- C:\Windows\System\HFuVjFb.exe
  C:\Windows\System\HFuVjFb.exe
  2⤵
  PID:5884
- C:\Windows\System\vFjeZiw.exe
  C:\Windows\System\vFjeZiw.exe
  2⤵
  PID:6044
- C:\Windows\System\foINNOd.exe
  C:\Windows\System\foINNOd.exe
  2⤵
  PID:6076
- C:\Windows\System\kpcYexD.exe
  C:\Windows\System\kpcYexD.exe
  2⤵
  PID:5420
- C:\Windows\System\uNJWykl.exe
  C:\Windows\System\uNJWykl.exe
  2⤵
  PID:5752
- C:\Windows\System\fQpTunU.exe
  C:\Windows\System\fQpTunU.exe
  2⤵
  PID:5272
- C:\Windows\System\eXQOshv.exe
  C:\Windows\System\eXQOshv.exe
  2⤵
  PID:5820
- C:\Windows\System\jsPCzrn.exe
  C:\Windows\System\jsPCzrn.exe
  2⤵
  PID:5496
- C:\Windows\System\WxSvQWU.exe
  C:\Windows\System\WxSvQWU.exe
  2⤵
  PID:5184
- C:\Windows\System\mgdbXwO.exe
  C:\Windows\System\mgdbXwO.exe
  2⤵
  PID:5352
- C:\Windows\System\eFNsHrJ.exe
  C:\Windows\System\eFNsHrJ.exe
  2⤵
  PID:5740
- C:\Windows\System\lQuCIdQ.exe
  C:\Windows\System\lQuCIdQ.exe
  2⤵
  PID:6012
- C:\Windows\System\PkTzmiL.exe
  C:\Windows\System\PkTzmiL.exe
  2⤵
  PID:5548
- C:\Windows\System\vucIYkC.exe
  C:\Windows\System\vucIYkC.exe
  2⤵
  PID:5220
- C:\Windows\System\ruNztfk.exe
  C:\Windows\System\ruNztfk.exe
  2⤵
  PID:5640
- C:\Windows\System\bYSaOcC.exe
  C:\Windows\System\bYSaOcC.exe
  2⤵
  PID:6148
- C:\Windows\System\sXFCyUc.exe
  C:\Windows\System\sXFCyUc.exe
  2⤵
  PID:6164
- C:\Windows\System\whywsbQ.exe
  C:\Windows\System\whywsbQ.exe
  2⤵
  PID:6180
- C:\Windows\System\tzZLxMK.exe
  C:\Windows\System\tzZLxMK.exe
  2⤵
  PID:6196
- C:\Windows\System\WNFUZiO.exe
  C:\Windows\System\WNFUZiO.exe
  2⤵
  PID:6212
- C:\Windows\System\jvaRdqA.exe
  C:\Windows\System\jvaRdqA.exe
  2⤵
  PID:6228
- C:\Windows\System\PWixtZv.exe
  C:\Windows\System\PWixtZv.exe
  2⤵
  PID:6244
- C:\Windows\System\EGihijp.exe
  C:\Windows\System\EGihijp.exe
  2⤵
  PID:6260
- C:\Windows\System\vjKTrLa.exe
  C:\Windows\System\vjKTrLa.exe
  2⤵
  PID:6276
- C:\Windows\System\hCsPvzC.exe
  C:\Windows\System\hCsPvzC.exe
  2⤵
  PID:6296
- C:\Windows\System\GbWgDqF.exe
  C:\Windows\System\GbWgDqF.exe
  2⤵
  PID:6312
- C:\Windows\System\FolugRM.exe
  C:\Windows\System\FolugRM.exe
  2⤵
  PID:6328
- C:\Windows\System\ejvDpuq.exe
  C:\Windows\System\ejvDpuq.exe
  2⤵
  PID:6344
- C:\Windows\System\xONTSSD.exe
  C:\Windows\System\xONTSSD.exe
  2⤵
  PID:6360
- C:\Windows\System\mpTvDVZ.exe
  C:\Windows\System\mpTvDVZ.exe
  2⤵
  PID:6376
- C:\Windows\System\WwEQIyW.exe
  C:\Windows\System\WwEQIyW.exe
  2⤵
  PID:6392
- C:\Windows\System\CtOdAQG.exe
  C:\Windows\System\CtOdAQG.exe
  2⤵
  PID:6408
- C:\Windows\System\BhwTymO.exe
  C:\Windows\System\BhwTymO.exe
  2⤵
  PID:6424
- C:\Windows\System\hRqdBAr.exe
  C:\Windows\System\hRqdBAr.exe
  2⤵
  PID:6440
- C:\Windows\System\qsvjeDu.exe
  C:\Windows\System\qsvjeDu.exe
  2⤵
  PID:6456
- C:\Windows\System\QUPaslS.exe
  C:\Windows\System\QUPaslS.exe
  2⤵
  PID:6472
- C:\Windows\System\pPwSaHy.exe
  C:\Windows\System\pPwSaHy.exe
  2⤵
  PID:6488
- C:\Windows\System\yjudXUm.exe
  C:\Windows\System\yjudXUm.exe
  2⤵
  PID:6508
- C:\Windows\System\UNTZlvo.exe
  C:\Windows\System\UNTZlvo.exe
  2⤵
  PID:6524
- C:\Windows\System\KVdqLbM.exe
  C:\Windows\System\KVdqLbM.exe
  2⤵
  PID:6540
- C:\Windows\System\egvZeGk.exe
  C:\Windows\System\egvZeGk.exe
  2⤵
  PID:6556
- C:\Windows\System\rwiSEAm.exe
  C:\Windows\System\rwiSEAm.exe
  2⤵
  PID:6572
- C:\Windows\System\OehqwDj.exe
  C:\Windows\System\OehqwDj.exe
  2⤵
  PID:6588
- C:\Windows\System\hrwbnCV.exe
  C:\Windows\System\hrwbnCV.exe
  2⤵
  PID:6604
- C:\Windows\System\WKSmBLc.exe
  C:\Windows\System\WKSmBLc.exe
  2⤵
  PID:6620
- C:\Windows\System\AeovFDq.exe
  C:\Windows\System\AeovFDq.exe
  2⤵
  PID:6636
- C:\Windows\System\guQpewU.exe
  C:\Windows\System\guQpewU.exe
  2⤵
  PID:6652
- C:\Windows\System\HtaeqAx.exe
  C:\Windows\System\HtaeqAx.exe
  2⤵
  PID:6668
- C:\Windows\System\yVEFcgJ.exe
  C:\Windows\System\yVEFcgJ.exe
  2⤵
  PID:6684
- C:\Windows\System\dJnWFyt.exe
  C:\Windows\System\dJnWFyt.exe
  2⤵
  PID:6700
- C:\Windows\System\glLsNHG.exe
  C:\Windows\System\glLsNHG.exe
  2⤵
  PID:6716
- C:\Windows\System\gQDdkXZ.exe
  C:\Windows\System\gQDdkXZ.exe
  2⤵
  PID:6732
- C:\Windows\System\UCaKxzu.exe
  C:\Windows\System\UCaKxzu.exe
  2⤵
  PID:6748
- C:\Windows\System\dRKOXfl.exe
  C:\Windows\System\dRKOXfl.exe
  2⤵
  PID:6764
- C:\Windows\System\dZTjwMJ.exe
  C:\Windows\System\dZTjwMJ.exe
  2⤵
  PID:6780
- C:\Windows\System\oytBorp.exe
  C:\Windows\System\oytBorp.exe
  2⤵
  PID:6796
- C:\Windows\System\WSrYwVM.exe
  C:\Windows\System\WSrYwVM.exe
  2⤵
  PID:6812
- C:\Windows\System\TpVJiWf.exe
  C:\Windows\System\TpVJiWf.exe
  2⤵
  PID:6828
- C:\Windows\System\lsoAMpx.exe
  C:\Windows\System\lsoAMpx.exe
  2⤵
  PID:6844
- C:\Windows\System\HQgEZVq.exe
  C:\Windows\System\HQgEZVq.exe
  2⤵
  PID:6860
- C:\Windows\System\BKTIQiw.exe
  C:\Windows\System\BKTIQiw.exe
  2⤵
  PID:6876
- C:\Windows\System\ACJyamK.exe
  C:\Windows\System\ACJyamK.exe
  2⤵
  PID:6892
- C:\Windows\System\OKThLOK.exe
  C:\Windows\System\OKThLOK.exe
  2⤵
  PID:6908
- C:\Windows\System\tUnEHLU.exe
  C:\Windows\System\tUnEHLU.exe
  2⤵
  PID:6924
- C:\Windows\System\WDdEgLR.exe
  C:\Windows\System\WDdEgLR.exe
  2⤵
  PID:6940
- C:\Windows\System\SNSwDAi.exe
  C:\Windows\System\SNSwDAi.exe
  2⤵
  PID:6956
- C:\Windows\System\RWHgMsp.exe
  C:\Windows\System\RWHgMsp.exe
  2⤵
  PID:6972
- C:\Windows\System\gazAqyf.exe
  C:\Windows\System\gazAqyf.exe
  2⤵
  PID:6988
- C:\Windows\System\hYZRAry.exe
  C:\Windows\System\hYZRAry.exe
  2⤵
  PID:7004
- C:\Windows\System\czDNqRQ.exe
  C:\Windows\System\czDNqRQ.exe
  2⤵
  PID:7020
- C:\Windows\System\BBuCVKG.exe
  C:\Windows\System\BBuCVKG.exe
  2⤵
  PID:7036
- C:\Windows\System\YtMejif.exe
  C:\Windows\System\YtMejif.exe
  2⤵
  PID:7052
- C:\Windows\System\VNMRowJ.exe
  C:\Windows\System\VNMRowJ.exe
  2⤵
  PID:7068
- C:\Windows\System\QNYyqAU.exe
  C:\Windows\System\QNYyqAU.exe
  2⤵
  PID:7084
- C:\Windows\System\xYSChnC.exe
  C:\Windows\System\xYSChnC.exe
  2⤵
  PID:7100
- C:\Windows\System\HkrGSYW.exe
  C:\Windows\System\HkrGSYW.exe
  2⤵
  PID:7116
- C:\Windows\System\nEtJHvK.exe
  C:\Windows\System\nEtJHvK.exe
  2⤵
  PID:7136
- C:\Windows\System\ZJapZze.exe
  C:\Windows\System\ZJapZze.exe
  2⤵
  PID:7152
- C:\Windows\System\AguAJVb.exe
  C:\Windows\System\AguAJVb.exe
  2⤵
  PID:5416
- C:\Windows\System\RZRdhlM.exe
  C:\Windows\System\RZRdhlM.exe
  2⤵
  PID:6080
- C:\Windows\System\NDQIfOv.exe
  C:\Windows\System\NDQIfOv.exe
  2⤵
  PID:5464
- C:\Windows\System\HzyuShc.exe
  C:\Windows\System\HzyuShc.exe
  2⤵
  PID:6172
- C:\Windows\System\SjtgYpr.exe
  C:\Windows\System\SjtgYpr.exe
  2⤵
  PID:6252
- C:\Windows\System\pgFjxhn.exe
  C:\Windows\System\pgFjxhn.exe
  2⤵
  PID:6256
- C:\Windows\System\ljTkWkq.exe
  C:\Windows\System\ljTkWkq.exe
  2⤵
  PID:6324
- C:\Windows\System\jDESNEw.exe
  C:\Windows\System\jDESNEw.exe
  2⤵
  PID:6388
- C:\Windows\System\SxXzmow.exe
  C:\Windows\System\SxXzmow.exe
  2⤵
  PID:6452
- C:\Windows\System\iCmSNUm.exe
  C:\Windows\System\iCmSNUm.exe
  2⤵
  PID:6516
- C:\Windows\System\ASIRDvu.exe
  C:\Windows\System\ASIRDvu.exe
  2⤵
  PID:6548
- C:\Windows\System\NmuefrR.exe
  C:\Windows\System\NmuefrR.exe
  2⤵
  PID:6584
- C:\Windows\System\jHBVSYS.exe
  C:\Windows\System\jHBVSYS.exe
  2⤵
  PID:6644
- C:\Windows\System\mJfZqAc.exe
  C:\Windows\System\mJfZqAc.exe
  2⤵
  PID:6400
- C:\Windows\System\BTgTfaT.exe
  C:\Windows\System\BTgTfaT.exe
  2⤵
  PID:6268
- C:\Windows\System\QHqFgqL.exe
  C:\Windows\System\QHqFgqL.exe
  2⤵
  PID:6676
- C:\Windows\System\EKQyunE.exe
  C:\Windows\System\EKQyunE.exe
  2⤵
  PID:6536
- C:\Windows\System\ZkuLtSn.exe
  C:\Windows\System\ZkuLtSn.exe
  2⤵
  PID:6372
- C:\Windows\System\UhiiUPB.exe
  C:\Windows\System\UhiiUPB.exe
  2⤵
  PID:6600
- C:\Windows\System\myiHtPK.exe
  C:\Windows\System\myiHtPK.exe
  2⤵
  PID:6664
- C:\Windows\System\piWAYqq.exe
  C:\Windows\System\piWAYqq.exe
  2⤵
  PID:6696
- C:\Windows\System\wzluGCW.exe
  C:\Windows\System\wzluGCW.exe
  2⤵
  PID:6744
- C:\Windows\System\vQGMchq.exe
  C:\Windows\System\vQGMchq.exe
  2⤵
  PID:6808
- C:\Windows\System\zAjOFiW.exe
  C:\Windows\System\zAjOFiW.exe
  2⤵
  PID:6840
- C:\Windows\System\qTZXKOd.exe
  C:\Windows\System\qTZXKOd.exe
  2⤵
  PID:6932
- C:\Windows\System\cJijyHd.exe
  C:\Windows\System\cJijyHd.exe
  2⤵
  PID:6996
- C:\Windows\System\XRWxJiI.exe
  C:\Windows\System\XRWxJiI.exe
  2⤵
  PID:7032
- C:\Windows\System\xXzMLjj.exe
  C:\Windows\System\xXzMLjj.exe
  2⤵
  PID:7124
- C:\Windows\System\UfrUPuP.exe
  C:\Windows\System\UfrUPuP.exe
  2⤵
  PID:6760
- C:\Windows\System\xkKsIDM.exe
  C:\Windows\System\xkKsIDM.exe
  2⤵
  PID:6788
- C:\Windows\System\DacIoNw.exe
  C:\Windows\System\DacIoNw.exe
  2⤵
  PID:7164
- C:\Windows\System\cyTiodA.exe
  C:\Windows\System\cyTiodA.exe
  2⤵
  PID:6888
- C:\Windows\System\VHcBEGT.exe
  C:\Windows\System\VHcBEGT.exe
  2⤵
  PID:6160
- C:\Windows\System\IMToawa.exe
  C:\Windows\System\IMToawa.exe
  2⤵
  PID:7076
- C:\Windows\System\wcGfiSc.exe
  C:\Windows\System\wcGfiSc.exe
  2⤵
  PID:6952
- C:\Windows\System\KXTBRpZ.exe
  C:\Windows\System\KXTBRpZ.exe
  2⤵
  PID:6188
- C:\Windows\System\HJjtjCI.exe
  C:\Windows\System\HJjtjCI.exe
  2⤵
  PID:6220
- C:\Windows\System\PSyURel.exe
  C:\Windows\System\PSyURel.exe
  2⤵
  PID:6224
- C:\Windows\System\psUrmEC.exe
  C:\Windows\System\psUrmEC.exe
  2⤵
  PID:6448
- C:\Windows\System\VNPGMWN.exe
  C:\Windows\System\VNPGMWN.exe
  2⤵
  PID:6204
- C:\Windows\System\pZRvzra.exe
  C:\Windows\System\pZRvzra.exe
  2⤵
  PID:6648
- C:\Windows\System\YppOIVh.exe
  C:\Windows\System\YppOIVh.exe
  2⤵
  PID:6240
- C:\Windows\System\kDHoQPu.exe
  C:\Windows\System\kDHoQPu.exe
  2⤵
  PID:6308
- C:\Windows\System\NmDqCBi.exe
  C:\Windows\System\NmDqCBi.exe
  2⤵
  PID:6468
- C:\Windows\System\iRalOLC.exe
  C:\Windows\System\iRalOLC.exe
  2⤵
  PID:6632
- C:\Windows\System\eypnYaN.exe
  C:\Windows\System\eypnYaN.exe
  2⤵
  PID:6904
- C:\Windows\System\ePycffh.exe
  C:\Windows\System\ePycffh.exe
  2⤵
  PID:7028
- C:\Windows\System\kRFJClq.exe
  C:\Windows\System\kRFJClq.exe
  2⤵
  PID:6964
- C:\Windows\System\FvWKKHM.exe
  C:\Windows\System\FvWKKHM.exe
  2⤵
  PID:6712
- C:\Windows\System\YtqgHQX.exe
  C:\Windows\System\YtqgHQX.exe
  2⤵
  PID:6920
- C:\Windows\System\xiKiHwM.exe
  C:\Windows\System\xiKiHwM.exe
  2⤵
  PID:6856
- C:\Windows\System\JahulZK.exe
  C:\Windows\System\JahulZK.exe
  2⤵
  PID:7096
- C:\Windows\System\StudMxK.exe
  C:\Windows\System\StudMxK.exe
  2⤵
  PID:7048
- C:\Windows\System\wEZYCQf.exe
  C:\Windows\System\wEZYCQf.exe
  2⤵
  PID:6504
- C:\Windows\System\nACBaAR.exe
  C:\Windows\System\nACBaAR.exe
  2⤵
  PID:6660
- C:\Windows\System\BnWyhnD.exe
  C:\Windows\System\BnWyhnD.exe
  2⤵
  PID:6884
- C:\Windows\System\CtdSZPV.exe
  C:\Windows\System\CtdSZPV.exe
  2⤵
  PID:7108
- C:\Windows\System\oJxsUXd.exe
  C:\Windows\System\oJxsUXd.exe
  2⤵
  PID:6916
- C:\Windows\System\ITUTGdH.exe
  C:\Windows\System\ITUTGdH.exe
  2⤵
  PID:6596
- C:\Windows\System\ZWWPtSH.exe
  C:\Windows\System\ZWWPtSH.exe
  2⤵
  PID:6836
- C:\Windows\System\fQOaxht.exe
  C:\Windows\System\fQOaxht.exe
  2⤵
  PID:6420
- C:\Windows\System\aOCRqLv.exe
  C:\Windows\System\aOCRqLv.exe
  2⤵
  PID:6872
- C:\Windows\System\moHURSP.exe
  C:\Windows\System\moHURSP.exe
  2⤵
  PID:7148
- C:\Windows\System\PytGjjO.exe
  C:\Windows\System\PytGjjO.exe
  2⤵
  PID:7184
- C:\Windows\System\VklbdMu.exe
  C:\Windows\System\VklbdMu.exe
  2⤵
  PID:7200
- C:\Windows\System\uWrJtgw.exe
  C:\Windows\System\uWrJtgw.exe
  2⤵
  PID:7216
- C:\Windows\System\cARtaZy.exe
  C:\Windows\System\cARtaZy.exe
  2⤵
  PID:7232
- C:\Windows\System\dJuCNxR.exe
  C:\Windows\System\dJuCNxR.exe
  2⤵
  PID:7248
- C:\Windows\System\fqEqpZK.exe
  C:\Windows\System\fqEqpZK.exe
  2⤵
  PID:7264
- C:\Windows\System\MNDSQgP.exe
  C:\Windows\System\MNDSQgP.exe
  2⤵
  PID:7280
- C:\Windows\System\lCDEPMd.exe
  C:\Windows\System\lCDEPMd.exe
  2⤵
  PID:7296
- C:\Windows\System\TGAtwfo.exe
  C:\Windows\System\TGAtwfo.exe
  2⤵
  PID:7312
- C:\Windows\System\wehIVRz.exe
  C:\Windows\System\wehIVRz.exe
  2⤵
  PID:7328
- C:\Windows\System\HSJnEiD.exe
  C:\Windows\System\HSJnEiD.exe
  2⤵
  PID:7344
- C:\Windows\System\gIZDmGF.exe
  C:\Windows\System\gIZDmGF.exe
  2⤵
  PID:7360
- C:\Windows\System\fVHFbaz.exe
  C:\Windows\System\fVHFbaz.exe
  2⤵
  PID:7376
- C:\Windows\System\ridhoUq.exe
  C:\Windows\System\ridhoUq.exe
  2⤵
  PID:7392
- C:\Windows\System\nkqGoHZ.exe
  C:\Windows\System\nkqGoHZ.exe
  2⤵
  PID:7408
- C:\Windows\System\whGnZZp.exe
  C:\Windows\System\whGnZZp.exe
  2⤵
  PID:7424
- C:\Windows\System\OfjSHvM.exe
  C:\Windows\System\OfjSHvM.exe
  2⤵
  PID:7440
- C:\Windows\System\aXtyfhq.exe
  C:\Windows\System\aXtyfhq.exe
  2⤵
  PID:7456
- C:\Windows\System\aLiKmOl.exe
  C:\Windows\System\aLiKmOl.exe
  2⤵
  PID:7472
- C:\Windows\System\bsuAlZi.exe
  C:\Windows\System\bsuAlZi.exe
  2⤵
  PID:7488
- C:\Windows\System\qnAOxpT.exe
  C:\Windows\System\qnAOxpT.exe
  2⤵
  PID:7504
- C:\Windows\System\nBoduoE.exe
  C:\Windows\System\nBoduoE.exe
  2⤵
  PID:7520
- C:\Windows\System\QNiJuJJ.exe
  C:\Windows\System\QNiJuJJ.exe
  2⤵
  PID:7536
- C:\Windows\System\saEemBn.exe
  C:\Windows\System\saEemBn.exe
  2⤵
  PID:7552
- C:\Windows\System\QEJLlgp.exe
  C:\Windows\System\QEJLlgp.exe
  2⤵
  PID:7568
- C:\Windows\System\FglAVlB.exe
  C:\Windows\System\FglAVlB.exe
  2⤵
  PID:7584
- C:\Windows\System\mpjlNdc.exe
  C:\Windows\System\mpjlNdc.exe
  2⤵
  PID:7600
- C:\Windows\System\loewHSz.exe
  C:\Windows\System\loewHSz.exe
  2⤵
  PID:7616
- C:\Windows\System\ZmXjfQh.exe
  C:\Windows\System\ZmXjfQh.exe
  2⤵
  PID:7632
- C:\Windows\System\JBSCnYp.exe
  C:\Windows\System\JBSCnYp.exe
  2⤵
  PID:7648
- C:\Windows\System\rLeZsfP.exe
  C:\Windows\System\rLeZsfP.exe
  2⤵
  PID:7664
- C:\Windows\System\feWnEml.exe
  C:\Windows\System\feWnEml.exe
  2⤵
  PID:7680
- C:\Windows\System\pEXtqWN.exe
  C:\Windows\System\pEXtqWN.exe
  2⤵
  PID:7696
- C:\Windows\System\TKKAURi.exe
  C:\Windows\System\TKKAURi.exe
  2⤵
  PID:7712
- C:\Windows\System\lbjjKCp.exe
  C:\Windows\System\lbjjKCp.exe
  2⤵
  PID:7728
- C:\Windows\System\LZCrfxL.exe
  C:\Windows\System\LZCrfxL.exe
  2⤵
  PID:7744
- C:\Windows\System\dhDBaGD.exe
  C:\Windows\System\dhDBaGD.exe
  2⤵
  PID:7760
- C:\Windows\System\ZYegtDD.exe
  C:\Windows\System\ZYegtDD.exe
  2⤵
  PID:7776
- C:\Windows\System\PWXRFyV.exe
  C:\Windows\System\PWXRFyV.exe
  2⤵
  PID:7792
- C:\Windows\System\NRGGATQ.exe
  C:\Windows\System\NRGGATQ.exe
  2⤵
  PID:7808
- C:\Windows\System\JjGJJRB.exe
  C:\Windows\System\JjGJJRB.exe
  2⤵
  PID:7824
- C:\Windows\System\dAEmMOj.exe
  C:\Windows\System\dAEmMOj.exe
  2⤵
  PID:7840
- C:\Windows\System\TggnZNj.exe
  C:\Windows\System\TggnZNj.exe
  2⤵
  PID:7856
- C:\Windows\System\tOFyyhT.exe
  C:\Windows\System\tOFyyhT.exe
  2⤵
  PID:7872
- C:\Windows\System\OfZDKDL.exe
  C:\Windows\System\OfZDKDL.exe
  2⤵
  PID:7888
- C:\Windows\System\GPIkRfN.exe
  C:\Windows\System\GPIkRfN.exe
  2⤵
  PID:7904
- C:\Windows\System\GTgGOzU.exe
  C:\Windows\System\GTgGOzU.exe
  2⤵
  PID:7920
- C:\Windows\System\GYpQYDY.exe
  C:\Windows\System\GYpQYDY.exe
  2⤵
  PID:7936
- C:\Windows\System\VqffpxZ.exe
  C:\Windows\System\VqffpxZ.exe
  2⤵
  PID:7952
- C:\Windows\System\gGGqJBi.exe
  C:\Windows\System\gGGqJBi.exe
  2⤵
  PID:7972
- C:\Windows\System\AqgNRXg.exe
  C:\Windows\System\AqgNRXg.exe
  2⤵
  PID:7988
- C:\Windows\System\obRTGed.exe
  C:\Windows\System\obRTGed.exe
  2⤵
  PID:8004
- C:\Windows\System\VPkOIog.exe
  C:\Windows\System\VPkOIog.exe
  2⤵
  PID:8020
- C:\Windows\System\pUIXNTF.exe
  C:\Windows\System\pUIXNTF.exe
  2⤵
  PID:8036
- C:\Windows\System\ldIaPfW.exe
  C:\Windows\System\ldIaPfW.exe
  2⤵
  PID:8052
- C:\Windows\System\bTRWhIR.exe
  C:\Windows\System\bTRWhIR.exe
  2⤵
  PID:8068
- C:\Windows\System\CWHeLRe.exe
  C:\Windows\System\CWHeLRe.exe
  2⤵
  PID:8084
- C:\Windows\System\PLxNkVH.exe
  C:\Windows\System\PLxNkVH.exe
  2⤵
  PID:8100
- C:\Windows\System\GNNqxyE.exe
  C:\Windows\System\GNNqxyE.exe
  2⤵
  PID:8116
- C:\Windows\System\IYVPvbM.exe
  C:\Windows\System\IYVPvbM.exe
  2⤵
  PID:8132
- C:\Windows\System\cDoFlis.exe
  C:\Windows\System\cDoFlis.exe
  2⤵
  PID:8148
- C:\Windows\System\nnGrJCC.exe
  C:\Windows\System\nnGrJCC.exe
  2⤵
  PID:8164
- C:\Windows\System\evmDBRI.exe
  C:\Windows\System\evmDBRI.exe
  2⤵
  PID:8180
- C:\Windows\System\vVcIzEl.exe
  C:\Windows\System\vVcIzEl.exe
  2⤵
  PID:6680
- C:\Windows\System\CkeWdyx.exe
  C:\Windows\System\CkeWdyx.exe
  2⤵
  PID:6948
- C:\Windows\System\EOuCTyd.exe
  C:\Windows\System\EOuCTyd.exe
  2⤵
  PID:7196
- C:\Windows\System\VXlbCmN.exe
  C:\Windows\System\VXlbCmN.exe
  2⤵
  PID:6616
- C:\Windows\System\iscBgnJ.exe
  C:\Windows\System\iscBgnJ.exe
  2⤵
  PID:6728
- C:\Windows\System\CXarwzo.exe
  C:\Windows\System\CXarwzo.exe
  2⤵
  PID:7012
- C:\Windows\System\uaEWlrO.exe
  C:\Windows\System\uaEWlrO.exe
  2⤵
  PID:7212
- C:\Windows\System\EpajFrT.exe
  C:\Windows\System\EpajFrT.exe
  2⤵
  PID:7356
- C:\Windows\System\gGyqpOB.exe
  C:\Windows\System\gGyqpOB.exe
  2⤵
  PID:7276
- C:\Windows\System\cDqgKuc.exe
  C:\Windows\System\cDqgKuc.exe
  2⤵
  PID:7340
- C:\Windows\System\zaVdOWt.exe
  C:\Windows\System\zaVdOWt.exe
  2⤵
  PID:7372
- C:\Windows\System\XRlFELa.exe
  C:\Windows\System\XRlFELa.exe
  2⤵
  PID:7452
- C:\Windows\System\AgsXQao.exe
  C:\Windows\System\AgsXQao.exe
  2⤵
  PID:7516
- C:\Windows\System\jIaxsOa.exe
  C:\Windows\System\jIaxsOa.exe
  2⤵
  PID:7400
- C:\Windows\System\qqxGnED.exe
  C:\Windows\System\qqxGnED.exe
  2⤵
  PID:7468
- C:\Windows\System\pKuGqeJ.exe
  C:\Windows\System\pKuGqeJ.exe
  2⤵
  PID:7532
- C:\Windows\System\puVkTiR.exe
  C:\Windows\System\puVkTiR.exe
  2⤵
  PID:7580
- C:\Windows\System\lpyJJxt.exe
  C:\Windows\System\lpyJJxt.exe
  2⤵
  PID:7612
- C:\Windows\System\ytYSLzj.exe
  C:\Windows\System\ytYSLzj.exe
  2⤵
  PID:7676
- C:\Windows\System\KuCyEsJ.exe
  C:\Windows\System\KuCyEsJ.exe
  2⤵
  PID:7624
- C:\Windows\System\DYnpNrA.exe
  C:\Windows\System\DYnpNrA.exe
  2⤵
  PID:7688
- C:\Windows\System\gYLeuxB.exe
  C:\Windows\System\gYLeuxB.exe
  2⤵
  PID:7660
- C:\Windows\System\UMGXNzQ.exe
  C:\Windows\System\UMGXNzQ.exe
  2⤵
  PID:7804
- C:\Windows\System\qxjfNTU.exe
  C:\Windows\System\qxjfNTU.exe
  2⤵
  PID:7788
- C:\Windows\System\cUyCGse.exe
  C:\Windows\System\cUyCGse.exe
  2⤵
  PID:7868
- C:\Windows\System\OuZWkGc.exe
  C:\Windows\System\OuZWkGc.exe
  2⤵
  PID:7820
- C:\Windows\System\QfeoOBm.exe
  C:\Windows\System\QfeoOBm.exe
  2⤵
  PID:7964
- C:\Windows\System\VqrMtOo.exe
  C:\Windows\System\VqrMtOo.exe
  2⤵
  PID:8032
- C:\Windows\System\fukaviy.exe
  C:\Windows\System\fukaviy.exe
  2⤵
  PID:7912
- C:\Windows\System\AxqUXEI.exe
  C:\Windows\System\AxqUXEI.exe
  2⤵
  PID:7980
- C:\Windows\System\pDrtPYp.exe
  C:\Windows\System\pDrtPYp.exe
  2⤵
  PID:8044
- C:\Windows\System\ZpTBCcK.exe
  C:\Windows\System\ZpTBCcK.exe
  2⤵
  PID:8064
- C:\Windows\System\WPfUNMJ.exe
  C:\Windows\System\WPfUNMJ.exe
  2⤵
  PID:8128
- C:\Windows\System\GERLXje.exe
  C:\Windows\System\GERLXje.exe
  2⤵
  PID:8112
- C:\Windows\System\iHVqYgY.exe
  C:\Windows\System\iHVqYgY.exe
  2⤵
  PID:6464
- C:\Windows\System\vufHjDt.exe
  C:\Windows\System\vufHjDt.exe
  2⤵
  PID:7208
- C:\Windows\System\abATqUh.exe
  C:\Windows\System\abATqUh.exe
  2⤵
  PID:8108
- C:\Windows\System\THqfvtz.exe
  C:\Windows\System\THqfvtz.exe
  2⤵
  PID:6156
- C:\Windows\System\xAdUNOh.exe
  C:\Windows\System\xAdUNOh.exe
  2⤵
  PID:6792
- C:\Windows\System\XhFOkRl.exe
  C:\Windows\System\XhFOkRl.exe
  2⤵
  PID:7512
- C:\Windows\System\nXMKLoc.exe
  C:\Windows\System\nXMKLoc.exe
  2⤵
  PID:7384
- C:\Windows\System\SHCzfVt.exe
  C:\Windows\System\SHCzfVt.exe
  2⤵
  PID:7420
- C:\Windows\System\PgdghWf.exe
  C:\Windows\System\PgdghWf.exe
  2⤵
  PID:7448
- C:\Windows\System\UAXhPLn.exe
  C:\Windows\System\UAXhPLn.exe
  2⤵
  PID:7500
- C:\Windows\System\crVYbvE.exe
  C:\Windows\System\crVYbvE.exe
  2⤵
  PID:7708
- C:\Windows\System\twTiQHx.exe
  C:\Windows\System\twTiQHx.exe
  2⤵
  PID:7656
- C:\Windows\System\EUFEMtd.exe
  C:\Windows\System\EUFEMtd.exe
  2⤵
  PID:7720
- C:\Windows\System\uiRDToi.exe
  C:\Windows\System\uiRDToi.exe
  2⤵
  PID:7864
- C:\Windows\System\YKTqQdU.exe
  C:\Windows\System\YKTqQdU.exe
  2⤵
  PID:7880
- C:\Windows\System\uhmkmUU.exe
  C:\Windows\System\uhmkmUU.exe
  2⤵
  PID:8124
- C:\Windows\System\AsYhdqn.exe
  C:\Windows\System\AsYhdqn.exe
  2⤵
  PID:7272
- C:\Windows\System\MjyIrIH.exe
  C:\Windows\System\MjyIrIH.exe
  2⤵
  PID:7484
- C:\Windows\System\JblgzTj.exe
  C:\Windows\System\JblgzTj.exe
  2⤵
  PID:7848
- C:\Windows\System\tUmSocj.exe
  C:\Windows\System\tUmSocj.exe
  2⤵
  PID:7948
- C:\Windows\System\TmimOYt.exe
  C:\Windows\System\TmimOYt.exe
  2⤵
  PID:8076
- C:\Windows\System\ysckApM.exe
  C:\Windows\System\ysckApM.exe
  2⤵
  PID:8172
- C:\Windows\System\aHdtVtz.exe
  C:\Windows\System\aHdtVtz.exe
  2⤵
  PID:7592
- C:\Windows\System\wfyJQox.exe
  C:\Windows\System\wfyJQox.exe
  2⤵
  PID:7672
- C:\Windows\System\wjEGlmB.exe
  C:\Windows\System\wjEGlmB.exe
  2⤵
  PID:7928
- C:\Windows\System\vmpeXUZ.exe
  C:\Windows\System\vmpeXUZ.exe
  2⤵
  PID:7852
- C:\Windows\System\pyIHrls.exe
  C:\Windows\System\pyIHrls.exe
  2⤵
  PID:7816
- C:\Windows\System\qBmslNe.exe
  C:\Windows\System\qBmslNe.exe
  2⤵
  PID:8016
- C:\Windows\System\antJhFd.exe
  C:\Windows\System\antJhFd.exe
  2⤵
  PID:7944
- C:\Windows\System\PBwNXIU.exe
  C:\Windows\System\PBwNXIU.exe
  2⤵
  PID:8096
- C:\Windows\System\TtFhSzR.exe
  C:\Windows\System\TtFhSzR.exe
  2⤵
  PID:7736
- C:\Windows\System\ixtSNqY.exe
  C:\Windows\System\ixtSNqY.exe
  2⤵
  PID:7256
- C:\Windows\System\eSsEDNj.exe
  C:\Windows\System\eSsEDNj.exe
  2⤵
  PID:8208
- C:\Windows\System\TUXyfhU.exe
  C:\Windows\System\TUXyfhU.exe
  2⤵
  PID:8224
- C:\Windows\System\OCkYlKT.exe
  C:\Windows\System\OCkYlKT.exe
  2⤵
  PID:8240
- C:\Windows\System\FRRhDfs.exe
  C:\Windows\System\FRRhDfs.exe
  2⤵
  PID:8256
- C:\Windows\System\TGyeHYk.exe
  C:\Windows\System\TGyeHYk.exe
  2⤵
  PID:8272
- C:\Windows\System\FuHkRWr.exe
  C:\Windows\System\FuHkRWr.exe
  2⤵
  PID:8288
- C:\Windows\System\mhiEMSQ.exe
  C:\Windows\System\mhiEMSQ.exe
  2⤵
  PID:8304
- C:\Windows\System\VLBeqlI.exe
  C:\Windows\System\VLBeqlI.exe
  2⤵
  PID:8320
- C:\Windows\System\HrncVcT.exe
  C:\Windows\System\HrncVcT.exe
  2⤵
  PID:8336
- C:\Windows\System\CRvYMuC.exe
  C:\Windows\System\CRvYMuC.exe
  2⤵
  PID:8352
- C:\Windows\System\daYqgiC.exe
  C:\Windows\System\daYqgiC.exe
  2⤵
  PID:8368
- C:\Windows\System\dPmOFNP.exe
  C:\Windows\System\dPmOFNP.exe
  2⤵
  PID:8384
- C:\Windows\System\cCJgbRa.exe
  C:\Windows\System\cCJgbRa.exe
  2⤵
  PID:8400
- C:\Windows\System\waPhmNe.exe
  C:\Windows\System\waPhmNe.exe
  2⤵
  PID:8416
- C:\Windows\System\IsLHLVy.exe
  C:\Windows\System\IsLHLVy.exe
  2⤵
  PID:8432
- C:\Windows\System\puiYaiW.exe
  C:\Windows\System\puiYaiW.exe
  2⤵
  PID:8448
- C:\Windows\System\COFJVkN.exe
  C:\Windows\System\COFJVkN.exe
  2⤵
  PID:8464
- C:\Windows\System\JKynXMW.exe
  C:\Windows\System\JKynXMW.exe
  2⤵
  PID:8480
- C:\Windows\System\QzGxXwJ.exe
  C:\Windows\System\QzGxXwJ.exe
  2⤵
  PID:8496
- C:\Windows\System\NBlvkHN.exe
  C:\Windows\System\NBlvkHN.exe
  2⤵
  PID:8512
- C:\Windows\System\bLszBtJ.exe
  C:\Windows\System\bLszBtJ.exe
  2⤵
  PID:8528
- C:\Windows\System\XzPtvtD.exe
  C:\Windows\System\XzPtvtD.exe
  2⤵
  PID:8544
- C:\Windows\System\OBnrKwT.exe
  C:\Windows\System\OBnrKwT.exe
  2⤵
  PID:8560
- C:\Windows\System\pCbRSdq.exe
  C:\Windows\System\pCbRSdq.exe
  2⤵
  PID:8580
- C:\Windows\System\fwlDzYR.exe
  C:\Windows\System\fwlDzYR.exe
  2⤵
  PID:8596
- C:\Windows\System\Mmjphsu.exe
  C:\Windows\System\Mmjphsu.exe
  2⤵
  PID:8612
- C:\Windows\System\uxQvWyE.exe
  C:\Windows\System\uxQvWyE.exe
  2⤵
  PID:8628
- C:\Windows\System\FJixzVu.exe
  C:\Windows\System\FJixzVu.exe
  2⤵
  PID:8644
- C:\Windows\System\LkZioJy.exe
  C:\Windows\System\LkZioJy.exe
  2⤵
  PID:8660
- C:\Windows\System\HEeYfyY.exe
  C:\Windows\System\HEeYfyY.exe
  2⤵
  PID:8676
- C:\Windows\System\PXQqGtF.exe
  C:\Windows\System\PXQqGtF.exe
  2⤵
  PID:8692
- C:\Windows\System\cKBbqtb.exe
  C:\Windows\System\cKBbqtb.exe
  2⤵
  PID:8708
- C:\Windows\System\heSkWqK.exe
  C:\Windows\System\heSkWqK.exe
  2⤵
  PID:8724
- C:\Windows\System\BJegNRX.exe
  C:\Windows\System\BJegNRX.exe
  2⤵
  PID:8740
- C:\Windows\System\SZLukGD.exe
  C:\Windows\System\SZLukGD.exe
  2⤵
  PID:8764
- C:\Windows\System\jZVpBGI.exe
  C:\Windows\System\jZVpBGI.exe
  2⤵
  PID:8780
- C:\Windows\System\kIrtELv.exe
  C:\Windows\System\kIrtELv.exe
  2⤵
  PID:8796
- C:\Windows\System\YxFSOEt.exe
  C:\Windows\System\YxFSOEt.exe
  2⤵
  PID:8812
- C:\Windows\System\MpdbCft.exe
  C:\Windows\System\MpdbCft.exe
  2⤵
  PID:8828
- C:\Windows\System\wOZMJch.exe
  C:\Windows\System\wOZMJch.exe
  2⤵
  PID:8844
- C:\Windows\System\xnHZsJL.exe
  C:\Windows\System\xnHZsJL.exe
  2⤵
  PID:8860
- C:\Windows\System\sYqBKPQ.exe
  C:\Windows\System\sYqBKPQ.exe
  2⤵
  PID:8876
- C:\Windows\System\TmqBLto.exe
  C:\Windows\System\TmqBLto.exe
  2⤵
  PID:8892
- C:\Windows\System\DWsSdRh.exe
  C:\Windows\System\DWsSdRh.exe
  2⤵
  PID:8908
- C:\Windows\System\daTkEKv.exe
  C:\Windows\System\daTkEKv.exe
  2⤵
  PID:8924
- C:\Windows\System\HLvATNQ.exe
  C:\Windows\System\HLvATNQ.exe
  2⤵
  PID:8940
- C:\Windows\System\lDBleBm.exe
  C:\Windows\System\lDBleBm.exe
  2⤵
  PID:8956
- C:\Windows\System\cbndqIr.exe
  C:\Windows\System\cbndqIr.exe
  2⤵
  PID:8972
- C:\Windows\System\sQzwRQs.exe
  C:\Windows\System\sQzwRQs.exe
  2⤵
  PID:8988
- C:\Windows\System\ihDvKrb.exe
  C:\Windows\System\ihDvKrb.exe
  2⤵
  PID:9004
- C:\Windows\System\OwyYSZc.exe
  C:\Windows\System\OwyYSZc.exe
  2⤵
  PID:9024
- C:\Windows\System\nJMcoPP.exe
  C:\Windows\System\nJMcoPP.exe
  2⤵
  PID:9040
- C:\Windows\System\fBPesrM.exe
  C:\Windows\System\fBPesrM.exe
  2⤵
  PID:9056
- C:\Windows\System\dZXNrbv.exe
  C:\Windows\System\dZXNrbv.exe
  2⤵
  PID:9072
- C:\Windows\System\YTkElpe.exe
  C:\Windows\System\YTkElpe.exe
  2⤵
  PID:9088
- C:\Windows\System\LyHrnOv.exe
  C:\Windows\System\LyHrnOv.exe
  2⤵
  PID:9104
- C:\Windows\System\iVvzcUP.exe
  C:\Windows\System\iVvzcUP.exe
  2⤵
  PID:9120
- C:\Windows\System\nDIjSPA.exe
  C:\Windows\System\nDIjSPA.exe
  2⤵
  PID:9136
- C:\Windows\System\OXIulzZ.exe
  C:\Windows\System\OXIulzZ.exe
  2⤵
  PID:9152
- C:\Windows\System\zyXMqtS.exe
  C:\Windows\System\zyXMqtS.exe
  2⤵
  PID:9168
- C:\Windows\System\vDZgCpZ.exe
  C:\Windows\System\vDZgCpZ.exe
  2⤵
  PID:9184
- C:\Windows\System\YKYxzwg.exe
  C:\Windows\System\YKYxzwg.exe
  2⤵
  PID:9200
- C:\Windows\System\eiyLmdq.exe
  C:\Windows\System\eiyLmdq.exe
  2⤵
  PID:7464
- C:\Windows\System\iwhUDJb.exe
  C:\Windows\System\iwhUDJb.exe
  2⤵
  PID:7772
- C:\Windows\System\iYoBLMd.exe
  C:\Windows\System\iYoBLMd.exe
  2⤵
  PID:8204
- C:\Windows\System\EFgKdzF.exe
  C:\Windows\System\EFgKdzF.exe
  2⤵
  PID:8264
- C:\Windows\System\GqyvsFp.exe
  C:\Windows\System\GqyvsFp.exe
  2⤵
  PID:8300
- C:\Windows\System\qbcUYOa.exe
  C:\Windows\System\qbcUYOa.exe
  2⤵
  PID:8360
- C:\Windows\System\DKdcBGf.exe
  C:\Windows\System\DKdcBGf.exe
  2⤵
  PID:8396
- C:\Windows\System\iuWDQSm.exe
  C:\Windows\System\iuWDQSm.exe
  2⤵
  PID:8248
- C:\Windows\System\uNxMAAg.exe
  C:\Windows\System\uNxMAAg.exe
  2⤵
  PID:8312
- C:\Windows\System\XMufolT.exe
  C:\Windows\System\XMufolT.exe
  2⤵
  PID:8424
- C:\Windows\System\njyPASd.exe
  C:\Windows\System\njyPASd.exe
  2⤵
  PID:8412
- C:\Windows\System\voWEpbh.exe
  C:\Windows\System\voWEpbh.exe
  2⤵
  PID:8488
- C:\Windows\System\eaGBrqJ.exe
  C:\Windows\System\eaGBrqJ.exe
  2⤵
  PID:8520
- C:\Windows\System\DDlZISa.exe
  C:\Windows\System\DDlZISa.exe
  2⤵
  PID:8552
- C:\Windows\System\MtkggsP.exe
  C:\Windows\System\MtkggsP.exe
  2⤵
  PID:8592
- C:\Windows\System\vMKjVQa.exe
  C:\Windows\System\vMKjVQa.exe
  2⤵
  PID:8540
- C:\Windows\System\jJEuOiZ.exe
  C:\Windows\System\jJEuOiZ.exe
  2⤵
  PID:8604
- C:\Windows\System\NwoaJwv.exe
  C:\Windows\System\NwoaJwv.exe
  2⤵
  PID:8652
- C:\Windows\System\yxHiiOl.exe
  C:\Windows\System\yxHiiOl.exe
  2⤵
  PID:8668
- C:\Windows\System\OFhJSSF.exe
  C:\Windows\System\OFhJSSF.exe
  2⤵
  PID:8704
- C:\Windows\System\ZHmswSm.exe
  C:\Windows\System\ZHmswSm.exe
  2⤵
  PID:8748
- C:\Windows\System\gGDZrnm.exe
  C:\Windows\System\gGDZrnm.exe
  2⤵
  PID:8792
- C:\Windows\System\VapAFVI.exe
  C:\Windows\System\VapAFVI.exe
  2⤵
  PID:8884
- C:\Windows\System\SrsRjIl.exe
  C:\Windows\System\SrsRjIl.exe
  2⤵
  PID:8948
- C:\Windows\System\Xrolmbp.exe
  C:\Windows\System\Xrolmbp.exe
  2⤵
  PID:8980
- C:\Windows\System\kYCPWjR.exe
  C:\Windows\System\kYCPWjR.exe
  2⤵
  PID:8932
- C:\Windows\System\YAiOOgp.exe
  C:\Windows\System\YAiOOgp.exe
  2⤵
  PID:8840
- C:\Windows\System\grCaiRO.exe
  C:\Windows\System\grCaiRO.exe
  2⤵
  PID:8904
- C:\Windows\System\mnZvDWe.exe
  C:\Windows\System\mnZvDWe.exe
  2⤵
  PID:8996
- C:\Windows\System\JQdsRNB.exe
  C:\Windows\System\JQdsRNB.exe
  2⤵
  PID:9080
- C:\Windows\System\gOiTJxh.exe
  C:\Windows\System\gOiTJxh.exe
  2⤵
  PID:9144
- C:\Windows\System\bSniaDC.exe
  C:\Windows\System\bSniaDC.exe
  2⤵
  PID:9128
- C:\Windows\System\TQodooc.exe
  C:\Windows\System\TQodooc.exe
  2⤵
  PID:9032
- C:\Windows\System\XKSHQXv.exe
  C:\Windows\System\XKSHQXv.exe
  2⤵
  PID:9160
- C:\Windows\System\BbRZCxw.exe
  C:\Windows\System\BbRZCxw.exe
  2⤵
  PID:9212
- C:\Windows\System\xxViHWT.exe
  C:\Windows\System\xxViHWT.exe
  2⤵
  PID:7180
- C:\Windows\System\uAgEZRt.exe
  C:\Windows\System\uAgEZRt.exe
  2⤵
  PID:8268
- C:\Windows\System\CzsFAej.exe
  C:\Windows\System\CzsFAej.exe
  2⤵
  PID:8376
- C:\Windows\System\twuXZDE.exe
  C:\Windows\System\twuXZDE.exe
  2⤵
  PID:7752
- C:\Windows\System\yIaOesw.exe
  C:\Windows\System\yIaOesw.exe
  2⤵
  PID:8428
- C:\Windows\System\QHFymgE.exe
  C:\Windows\System\QHFymgE.exe
  2⤵
  PID:8476
- C:\Windows\System\SaoVxgA.exe
  C:\Windows\System\SaoVxgA.exe
  2⤵
  PID:8444
- C:\Windows\System\XYnWJBO.exe
  C:\Windows\System\XYnWJBO.exe
  2⤵
  PID:8620
- C:\Windows\System\HLAmRJP.exe
  C:\Windows\System\HLAmRJP.exe
  2⤵
  PID:8636
- C:\Windows\System\zbxdNrw.exe
  C:\Windows\System\zbxdNrw.exe
  2⤵
  PID:8716
- C:\Windows\System\cbZzkRy.exe
  C:\Windows\System\cbZzkRy.exe
  2⤵
  PID:8824
- C:\Windows\System\kEIKVMq.exe
  C:\Windows\System\kEIKVMq.exe
  2⤵
  PID:8916
- C:\Windows\System\EKLchuG.exe
  C:\Windows\System\EKLchuG.exe
  2⤵
  PID:8968
- C:\Windows\System\ZtKZQkW.exe
  C:\Windows\System\ZtKZQkW.exe
  2⤵
  PID:9048
- C:\Windows\System\bSOVtrx.exe
  C:\Windows\System\bSOVtrx.exe
  2⤵
  PID:9176
- C:\Windows\System\BdMBfax.exe
  C:\Windows\System\BdMBfax.exe
  2⤵
  PID:8872
- C:\Windows\System\eyAUZsp.exe
  C:\Windows\System\eyAUZsp.exe
  2⤵
  PID:9100
- C:\Windows\System\DYRiIjU.exe
  C:\Windows\System\DYRiIjU.exe
  2⤵
  PID:7640
- C:\Windows\System\cTpvNYq.exe
  C:\Windows\System\cTpvNYq.exe
  2⤵
  PID:8392
- C:\Windows\System\DpQkzjb.exe
  C:\Windows\System\DpQkzjb.exe
  2⤵
  PID:8280
- C:\Windows\System\vUGloqh.exe
  C:\Windows\System\vUGloqh.exe
  2⤵
  PID:8572
- C:\Windows\System\APqFSLw.exe
  C:\Windows\System\APqFSLw.exe
  2⤵
  PID:8688
- C:\Windows\System\LXxsssF.exe
  C:\Windows\System\LXxsssF.exe
  2⤵
  PID:8756
- C:\Windows\System\ZZhHnZI.exe
  C:\Windows\System\ZZhHnZI.exe
  2⤵
  PID:9116
- C:\Windows\System\JbPJpls.exe
  C:\Windows\System\JbPJpls.exe
  2⤵
  PID:8808
- C:\Windows\System\gavcJqV.exe
  C:\Windows\System\gavcJqV.exe
  2⤵
  PID:7352
- C:\Windows\System\KUrBMYw.exe
  C:\Windows\System\KUrBMYw.exe
  2⤵
  PID:9148
- C:\Windows\System\wLnMEEz.exe
  C:\Windows\System\wLnMEEz.exe
  2⤵
  PID:9112
- C:\Windows\System\pdNNuvk.exe
  C:\Windows\System\pdNNuvk.exe
  2⤵
  PID:8508
- C:\Windows\System\LSmnyVp.exe
  C:\Windows\System\LSmnyVp.exe
  2⤵
  PID:8788
- C:\Windows\System\jhrhkRh.exe
  C:\Windows\System\jhrhkRh.exe
  2⤵
  PID:8836
- C:\Windows\System\WwZuwzD.exe
  C:\Windows\System\WwZuwzD.exe
  2⤵
  PID:9232
- C:\Windows\System\DHJXAmX.exe
  C:\Windows\System\DHJXAmX.exe
  2⤵
  PID:9248
- C:\Windows\System\nZmUukD.exe
  C:\Windows\System\nZmUukD.exe
  2⤵
  PID:9264
- C:\Windows\System\vhachem.exe
  C:\Windows\System\vhachem.exe
  2⤵
  PID:9284
- C:\Windows\System\OubSouR.exe
  C:\Windows\System\OubSouR.exe
  2⤵
  PID:9300
- C:\Windows\System\AAaipNd.exe
  C:\Windows\System\AAaipNd.exe
  2⤵
  PID:9316
- C:\Windows\System\RlHJIgx.exe
  C:\Windows\System\RlHJIgx.exe
  2⤵
  PID:9332
- C:\Windows\System\WwYHmcq.exe
  C:\Windows\System\WwYHmcq.exe
  2⤵
  PID:9348
- C:\Windows\System\YFvxpvu.exe
  C:\Windows\System\YFvxpvu.exe
  2⤵
  PID:9364
- C:\Windows\System\HAgWarA.exe
  C:\Windows\System\HAgWarA.exe
  2⤵
  PID:9380
- C:\Windows\System\ccqvMnS.exe
  C:\Windows\System\ccqvMnS.exe
  2⤵
  PID:9396
- C:\Windows\System\LqHQKdS.exe
  C:\Windows\System\LqHQKdS.exe
  2⤵
  PID:9412
- C:\Windows\System\TduYNyh.exe
  C:\Windows\System\TduYNyh.exe
  2⤵
  PID:9428
- C:\Windows\System\XpzFWch.exe
  C:\Windows\System\XpzFWch.exe
  2⤵
  PID:9444
- C:\Windows\System\oHmvXiq.exe
  C:\Windows\System\oHmvXiq.exe
  2⤵
  PID:9460
- C:\Windows\System\ytzgTyf.exe
  C:\Windows\System\ytzgTyf.exe
  2⤵
  PID:9476
- C:\Windows\System\vGXvZEm.exe
  C:\Windows\System\vGXvZEm.exe
  2⤵
  PID:9492
- C:\Windows\System\uxgIFCe.exe
  C:\Windows\System\uxgIFCe.exe
  2⤵
  PID:9508
- C:\Windows\System\jyEGEcn.exe
  C:\Windows\System\jyEGEcn.exe
  2⤵
  PID:9524
- C:\Windows\System\afkFGZq.exe
  C:\Windows\System\afkFGZq.exe
  2⤵
  PID:9540
- C:\Windows\System\tZKWOfh.exe
  C:\Windows\System\tZKWOfh.exe
  2⤵
  PID:9560
- C:\Windows\System\RNPMuGG.exe
  C:\Windows\System\RNPMuGG.exe
  2⤵
  PID:9576
- C:\Windows\System\PlUgDId.exe
  C:\Windows\System\PlUgDId.exe
  2⤵
  PID:9592
- C:\Windows\System\ocjXFie.exe
  C:\Windows\System\ocjXFie.exe
  2⤵
  PID:9608
- C:\Windows\System\lJkojUY.exe
  C:\Windows\System\lJkojUY.exe
  2⤵
  PID:9624
- C:\Windows\System\sYNpbAX.exe
  C:\Windows\System\sYNpbAX.exe
  2⤵
  PID:9640
- C:\Windows\System\yXkPTGU.exe
  C:\Windows\System\yXkPTGU.exe
  2⤵
  PID:9656
- C:\Windows\System\kwLoTqJ.exe
  C:\Windows\System\kwLoTqJ.exe
  2⤵
  PID:9672
- C:\Windows\System\bMieDrK.exe
  C:\Windows\System\bMieDrK.exe
  2⤵
  PID:9688
- C:\Windows\System\fyZXcoL.exe
  C:\Windows\System\fyZXcoL.exe
  2⤵
  PID:9704
- C:\Windows\System\SVsVjsU.exe
  C:\Windows\System\SVsVjsU.exe
  2⤵
  PID:9720
- C:\Windows\System\iEJqZsz.exe
  C:\Windows\System\iEJqZsz.exe
  2⤵
  PID:9740
- C:\Windows\System\tbJItwV.exe
  C:\Windows\System\tbJItwV.exe
  2⤵
  PID:9756
- C:\Windows\System\rsQmWVg.exe
  C:\Windows\System\rsQmWVg.exe
  2⤵
  PID:9772
- C:\Windows\System\flSJAIu.exe
  C:\Windows\System\flSJAIu.exe
  2⤵
  PID:9788
- C:\Windows\System\kxmqjEr.exe
  C:\Windows\System\kxmqjEr.exe
  2⤵
  PID:9804
- C:\Windows\System\JZnGmoa.exe
  C:\Windows\System\JZnGmoa.exe
  2⤵
  PID:9820
- C:\Windows\System\kFNkMjm.exe
  C:\Windows\System\kFNkMjm.exe
  2⤵
  PID:9836
- C:\Windows\System\axapuAw.exe
  C:\Windows\System\axapuAw.exe
  2⤵
  PID:9852
- C:\Windows\System\BVtoTHq.exe
  C:\Windows\System\BVtoTHq.exe
  2⤵
  PID:9868
- C:\Windows\System\qDBxKpV.exe
  C:\Windows\System\qDBxKpV.exe
  2⤵
  PID:9884
- C:\Windows\System\QjKsFdg.exe
  C:\Windows\System\QjKsFdg.exe
  2⤵
  PID:9900
- C:\Windows\System\juZtRFw.exe
  C:\Windows\System\juZtRFw.exe
  2⤵
  PID:9916
- C:\Windows\System\PlNVLbV.exe
  C:\Windows\System\PlNVLbV.exe
  2⤵
  PID:9932
- C:\Windows\System\vmItOxv.exe
  C:\Windows\System\vmItOxv.exe
  2⤵
  PID:9948
- C:\Windows\System\WUZflwj.exe
  C:\Windows\System\WUZflwj.exe
  2⤵
  PID:9964
- C:\Windows\System\XfzvjYc.exe
  C:\Windows\System\XfzvjYc.exe
  2⤵
  PID:9980
- C:\Windows\System\SgCTSfX.exe
  C:\Windows\System\SgCTSfX.exe
  2⤵
  PID:10000
- C:\Windows\System\GpvaQYB.exe
  C:\Windows\System\GpvaQYB.exe
  2⤵
  PID:10016
- C:\Windows\System\SkwKmgE.exe
  C:\Windows\System\SkwKmgE.exe
  2⤵
  PID:10032
- C:\Windows\System\BWSYppt.exe
  C:\Windows\System\BWSYppt.exe
  2⤵
  PID:10048
- C:\Windows\System\HwnnGAG.exe
  C:\Windows\System\HwnnGAG.exe
  2⤵
  PID:10064
- C:\Windows\System\wsJauHJ.exe
  C:\Windows\System\wsJauHJ.exe
  2⤵
  PID:10080
- C:\Windows\System\HiQAhgm.exe
  C:\Windows\System\HiQAhgm.exe
  2⤵
  PID:10096
- C:\Windows\System\bjtSzmu.exe
  C:\Windows\System\bjtSzmu.exe
  2⤵
  PID:10112
- C:\Windows\System\zaIEJrH.exe
  C:\Windows\System\zaIEJrH.exe
  2⤵
  PID:10128
- C:\Windows\System\YAoDPvd.exe
  C:\Windows\System\YAoDPvd.exe
  2⤵
  PID:10144
- C:\Windows\System\uQCRtxC.exe
  C:\Windows\System\uQCRtxC.exe
  2⤵
  PID:10160
- C:\Windows\System\zLihBks.exe
  C:\Windows\System\zLihBks.exe
  2⤵
  PID:10176
- C:\Windows\System\ItokmcA.exe
  C:\Windows\System\ItokmcA.exe
  2⤵
  PID:10192
- C:\Windows\System\yvCtXBa.exe
  C:\Windows\System\yvCtXBa.exe
  2⤵
  PID:10208
- C:\Windows\System\fagwruj.exe
  C:\Windows\System\fagwruj.exe
  2⤵
  PID:10224
- C:\Windows\System\rzaPXzu.exe
  C:\Windows\System\rzaPXzu.exe
  2⤵
  PID:9208
- C:\Windows\System\ENvGYhT.exe
  C:\Windows\System\ENvGYhT.exe
  2⤵
  PID:8408
- C:\Windows\System\eDIxJWI.exe
  C:\Windows\System\eDIxJWI.exe
  2⤵
  PID:9260
- C:\Windows\System\xBhVbcj.exe
  C:\Windows\System\xBhVbcj.exe
  2⤵
  PID:9272
- C:\Windows\System\cxLhizI.exe
  C:\Windows\System\cxLhizI.exe
  2⤵
  PID:9324
- C:\Windows\System\GAUpKpz.exe
  C:\Windows\System\GAUpKpz.exe
  2⤵
  PID:9312
- C:\Windows\System\bjguvJb.exe
  C:\Windows\System\bjguvJb.exe
  2⤵
  PID:9344
- C:\Windows\System\WkoAlNH.exe
  C:\Windows\System\WkoAlNH.exe
  2⤵
  PID:9420
- C:\Windows\System\aJBvcfZ.exe
  C:\Windows\System\aJBvcfZ.exe
  2⤵
  PID:9424
- C:\Windows\System\JeIyaYx.exe
  C:\Windows\System\JeIyaYx.exe
  2⤵
  PID:9488
- C:\Windows\System\apxWolz.exe
  C:\Windows\System\apxWolz.exe
  2⤵
  PID:9520
- C:\Windows\System\ZItssQe.exe
  C:\Windows\System\ZItssQe.exe
  2⤵
  PID:9440
- C:\Windows\System\DBDHMTg.exe
  C:\Windows\System\DBDHMTg.exe
  2⤵
  PID:9532
- C:\Windows\System\pWqFauU.exe
  C:\Windows\System\pWqFauU.exe
  2⤵
  PID:9600
- C:\Windows\System\sNNOaVk.exe
  C:\Windows\System\sNNOaVk.exe
  2⤵
  PID:9572
- C:\Windows\System\TnVlOfw.exe
  C:\Windows\System\TnVlOfw.exe
  2⤵
  PID:9684
- C:\Windows\System\rFPlYHQ.exe
  C:\Windows\System\rFPlYHQ.exe
  2⤵
  PID:9712
- C:\Windows\System\ckQAXUK.exe
  C:\Windows\System\ckQAXUK.exe
  2⤵
  PID:9700
- C:\Windows\System\ptwMLKa.exe
  C:\Windows\System\ptwMLKa.exe
  2⤵
  PID:9752
- C:\Windows\System\hsCkugU.exe
  C:\Windows\System\hsCkugU.exe
  2⤵
  PID:9800
- C:\Windows\System\CvAkWWb.exe
  C:\Windows\System\CvAkWWb.exe
  2⤵
  PID:9796
- C:\Windows\System\LhJdeZy.exe
  C:\Windows\System\LhJdeZy.exe
  2⤵
  PID:9844
- C:\Windows\System\AZmBjDv.exe
  C:\Windows\System\AZmBjDv.exe
  2⤵
  PID:9816
- C:\Windows\System\NODjIhg.exe
  C:\Windows\System\NODjIhg.exe
  2⤵
  PID:9908
- C:\Windows\System\FXcAlLr.exe
  C:\Windows\System\FXcAlLr.exe
  2⤵
  PID:9972
- C:\Windows\System\caBHPAQ.exe
  C:\Windows\System\caBHPAQ.exe
  2⤵
  PID:9976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DevzSTb.exe

Filesize
1.8MB

MD5
267d253cb51d55d92fa38db30b3c3566

SHA1
1889795d66ab1bd14238d72469aad87f92f322f9

SHA256
829b8788cacb4abdf7ae750efd293136a4d906052220e23cb216b7fe58d5e89d

SHA512
1df8a1bc01a8504015b4653b4c0942aef456bfdf236e0bd76ae0a84f0178dc8aa2dc459cdc804d559274ed5f8a50744725114ee70a4120b523af74714d3cea2b

Download Submit
C:\Windows\system\IcuiICz.exe

Filesize
1.8MB

MD5
f686fde05142aebd91837ffb99e9d789

SHA1
2f511b9507599b9b42026f15bd9392fe287bceff

SHA256
4e36c0b7f1ce21bf111e11717e38160293e5c51170dc7af93a42c5d3cfe046ec

SHA512
8000bbb3b75f47b5bb53ad8c924e9c9b5ceb0e1df524dc0f33162c50a94b3f978f0c170c823a0f396e63281a2aba45b4f9e0331930ac3ce1a95b006e85d936bd

Download Submit
C:\Windows\system\KhEEZPh.exe

Filesize
1.9MB

MD5
5f4d23aba175640b124c2d827236ef42

SHA1
416502a3539b5cb9e9ae39d7f96508717aa47052

SHA256
d252115986e916feecd01268d7e932d1c252cd5f90c9a5bf85cd4819568b4c1c

SHA512
ba2a47b3a2402fe642a5cb01a7108589994cbae85a18f6177d4067af431e0cc3758907ca0188daba8de8a3810f475ecfc6888a8751ae4a7c34a4b084d692f68b

Download Submit
C:\Windows\system\NtMaQVa.exe

Filesize
1.9MB

MD5
def9246f698f45a2275bd42739a00501

SHA1
6d52cafa4a322df21d50f7ca6b1e0751c45b8546

SHA256
f6ecb6597f31ebbc343749f382c969ced4b734f07e5143cc08d28dcdaa178366

SHA512
da61a7d202a0b0ca3f18edf71cd4bab610694daf8ad15af585f054193f2d26e7cbbe1f6063dea538b8d87e6909e03c01a7cf70d1a2108bbb7da5ed4a130b42e6

Download Submit
C:\Windows\system\NwEsEMK.exe

Filesize
1.8MB

MD5
ff7581cb3af191c7b0afa7d259578365

SHA1
529f51672f30e1a534054771ec7c5102a56656e6

SHA256
43630453940655cc7e95c71353060b74f9754904e77de893fde5e288336faccc

SHA512
05c8a32ced1eb6616a80f09e5bb52ad19ca24cff2d8f8f63e9e08119799f6794d9391814d13b6a5fc14af86960e6f87e580e38635d51b56fc1051c43372ae6fc

Download Submit
C:\Windows\system\OZdaYUr.exe

Filesize
1.8MB

MD5
de8cbbd6bfdc68bf161495fd264fc475

SHA1
8f8502643f445af22a0d311429212505e896de14

SHA256
a7e3af3f529ceab2775296e43f75f08c64135e0647fd2f88857e2e29209f4523

SHA512
70e05b104ff888de463f230b87b5ccf6801f9b5598a5fa9a2aabc3897b41c9b93a2553b550149d80cc92ff800cb6b184b98d6afe51b1f2e40163a6edffb6adc2

Download Submit
C:\Windows\system\SilpvmG.exe

Filesize
1.8MB

MD5
aad2b1821d74ba7c8329db17853b1cca

SHA1
f0fdd7d9759f7ba1075836427bad604b3df1bdf2

SHA256
99bf220b55e4c6b11ef9b4e7010b17bcb0863162e13a75af801cb0d5bbd973a2

SHA512
f9d674e570229019583c50f6338dac2e14c4ac0f62b408b27d863527fe7e1df1438b6523a3d59edc88dea82018f82cea46f9f33d7a1680357c24181d65a65fba

Download Submit
C:\Windows\system\aAcxWOo.exe

Filesize
1.9MB

MD5
2e299049e8bbabbe8547e21090426145

SHA1
1c2ccafc23a7c69ee29c3bc76cc262f8de650d49

SHA256
3c0d07e54728491bb6e877a45ec2fc66b1a63686c5025a0806f31566f4610c8b

SHA512
5f4d782a2df362a91c1159e70ec808a47abe954710fa01755768fd253f7843f833fe1979d6cea25e7f62900029a829bc21645391b28d6a193d0becf48252e20b

Download Submit
C:\Windows\system\dEnFvFV.exe

Filesize
1.9MB

MD5
6b5260980c4ddfd2c47436e35314e667

SHA1
07d2d86a766eb26d1ab2bcaf223128ccb6a7b488

SHA256
5659e089582578bd3d82f99ace4cb4246768a2189bc7ebc4faef3a54e657fb3f

SHA512
684fbce4639a31bbcb497a87f74b5c6dbd0ade3db69146da3b24213232edb55fdbabd90c3b3559b3aff426267772fcd13fde94cbd71c0a86229c85b26da50746

Download Submit
C:\Windows\system\dPhwasN.exe

Filesize
1.8MB

MD5
3c48d5db9312ee511912e3640a5d15c9

SHA1
17e678a9577e484665f2d1f5c819df2e49a1db36

SHA256
9dcc54378475be257a94603fa0d3d5e2c71b89bfa595dc7bc5286534f2d35c34

SHA512
de34bdf7419d1abc70e0df047de8ea1b7e70a23a737fdd8cd1fb971d3f91b3765aa562b2ae0f131ed52521e65e9a2a6a64913e48c33674a19cb16189a76294c4

Download Submit
C:\Windows\system\eoHPAMq.exe

Filesize
1.9MB

MD5
2467ed2f375c14d13f60d343a1edf682

SHA1
d32330d1a46e7d016b4cca036431236426163683

SHA256
8792f72e3d23834746a0317e7ae3ee9b7f4ff6907d1a563a81528c54b40d30a3

SHA512
4b9617c93e206e70f7de6c71b0568af651162b04b60d12bd33267086bec90d8429d0f1b79676e986d8282d04258cf1714f7c5240647af70260b18674a49ab49c

Download Submit
C:\Windows\system\ewObBQg.exe

Filesize
1.8MB

MD5
dacec5daeed4cae4aabf304dceae0ee5

SHA1
acf8d7915314816865bc50cbba00a8a96ac1400c

SHA256
22d23f15778481096d807338abd0863f3356f407d1b7e17059c1616c0acc5188

SHA512
1be00f94c7b0f7498aa89870747be3fe736af569b84fa52bb3daabd89a4023d362cf44d0aa2a4d5d58253e592b73fece5e2ba14060868feeb9c059e4b0882602

Download Submit
C:\Windows\system\jDJTgyS.exe

Filesize
1.8MB

MD5
84bc83e22a9088885f2b71b2879f174f

SHA1
8774a2bbad326c83a0d6585e925e6052ac2416a8

SHA256
62efadf3190f5dc72669c0abc4c2d7939ac24007cdc68a6dbf1a29f76c5d0c2b

SHA512
ee01a0af78775f2b6a607401ae15d6ab5e68855aea62f6e28eb49cc4dcb74f9e4f36e67ca974aefec017a842137f97a10ae6fdc1d5524ad027478e7c0d38140d

Download Submit
C:\Windows\system\kCxgshC.exe

Filesize
1.8MB

MD5
50c5ec3ab4495403481bf888122a55e6

SHA1
204718fdcf5cf465d9f64eefc46162e227c5ddbc

SHA256
07ce61dfd8bb1522a0c739b84eb71b9259ff88659d776008dfb5b3d734bfcd7e

SHA512
3f86216136815d691864c779105779b76ff12295d287839bafb0cc98ad11d8c23a6142d5dbaea3b5260b40737e8201671a83fce6dde59d4f1b1151c04ce12207

Download Submit
C:\Windows\system\lepeMyg.exe

Filesize
1.8MB

MD5
820049f2fcdcb6eabb0b236acf920dff

SHA1
c55875abd99f20b605748b6fbc46984c583dbf2a

SHA256
8e8487a87e0dd207af63becd80c9563862094bfde624d79af4276b1fc9c2ed0d

SHA512
89ed3a1390d08960c850c5a6d1964ee1f9aebc946b18833712ddc913e343a4ca37d5d98112685b58eef405f792033b52181e4cd96a5b70b7d34a853c528b3947

Download Submit
C:\Windows\system\oKuGGNg.exe

Filesize
1.8MB

MD5
9e4378489f777d2c38a989cc710eeca1

SHA1
d816111d6109aa714a69b1822ca3312dbadd7eff

SHA256
d00076006c4023d1280a07688b633c6c740928b2f4bb34999e6dae4865d3d5d2

SHA512
6cecf33a1ee0cb148c9cf4330486816aac7c7788dc9b46e5cae44d7efb5a47ca4d88e63d33eeba6a4a4ff78b2d718695e1c434afa416d6c629c76228a70c82ca

Download Submit
C:\Windows\system\oOcbSpr.exe

Filesize
1.9MB

MD5
b1c3da64ef22c5fd5eac813e658d0d53

SHA1
4e8701e7884afa454a5a8461a28ca928f13683db

SHA256
1198c90dc8678e6226a2a3896f156d3356b7ba3bdef866fab5a0b98d4b3ae32a

SHA512
eba6ed96136861800e8327533d96d075a0a6ace53871e3434d566b0bb9866345bb265a0c50cb34ab9cf857af5bcc0ee395831cabe4b0f746f53b7fdbd9aef712

Download Submit
C:\Windows\system\pToweoS.exe

Filesize
1.8MB

MD5
7f9bbe1e6d2b3f41fd640534334008a3

SHA1
61371ba3b3833efd97d85179493eeaa35de77adc

SHA256
f8971098047af937ee51bc2962c8a7a64e9d19c927d32a9eb173cc48ec8ea96f

SHA512
b585a2e1e649ab5a0706c05c4792874d0ac4195e859f64b3a67647805e57e57760a3738cafad7fd84c35530ddd22194833d2d4c0e99aa2d54e510ef3205977b2

Download Submit
C:\Windows\system\rXKUuAO.exe

Filesize
1.8MB

MD5
6794ed877ab76e1969730296c5717297

SHA1
ab01bed718183af516ea9e1c030fb4e3cb4809ea

SHA256
318e7506c122bf29f171f03a8374e9b0e033475502253ce94ebe280c56bb5e56

SHA512
aa045b0dddd66d45213f58995e6afb9ff9cdc420f479f5dd5b18a7dd5f76841df155af45b04bb4d7eee4c15c3598791a062e769491ff7a90eebffac0ba792bfd

Download Submit
C:\Windows\system\sLbcvNW.exe

Filesize
1.9MB

MD5
cca7863bd916a33a21b50a466c582632

SHA1
7d533a5296b175401723adab76106d81a1497706

SHA256
97873bfd9741c89e225e6f365ae68521f162ddf66209928256e8e94f8f625aa9

SHA512
9dd6af2dd21e7ea0fa2dcd329a46bd867830bd14a06dbb278eb1dae1bbf4755438b5b656bd5b346cbcd866978b20af75e509befd07f885816592949f90b3cfff

Download Submit
C:\Windows\system\tVWRoCC.exe

Filesize
1.9MB

MD5
1a429e1de264d2b115293c77ca6b1431

SHA1
57ed917cc02b1110df022fe55f10545826f90ac6

SHA256
036ffe387ba316ff040f2d18771f90962691b4b1a3b29a82888f0e3e98636352

SHA512
3a86e8e9ae73cd399e9f6429c50dbcc1a011e0ae3613ca07a2c226e09eafe8f214b4beb05409ecf31f010d56bc346de148645c2c43d74c1f1bac521d373716ac

Download Submit
C:\Windows\system\wvnIGTL.exe

Filesize
1.9MB

MD5
942c4940262691aca0c8e002e84ed00b

SHA1
1c24f0bc740acfcd13aaec22aea71d28cf29e707

SHA256
3becaa24bf4673b44cfc4e05f8628ebd68e883fdb57f0891698b85f874ed6bf6

SHA512
db83e86bf529d8358d0d99d729a005fadaf648aa20f3959ee2a5bdfec5d7171d07f5d1131f9d87dd5b5a5474785a16de49e50a0d6b5221ea905fd3278e9d5b37

Download Submit
\Windows\system\BLfqWIY.exe

Filesize
1.9MB

MD5
a3bb51397e9c46194f13b4e3dd021b21

SHA1
daba6dce49ed57453e93bf957f34ab248b5540ff

SHA256
5518adb0aa44f1c165e5e951b88e887b1d9c86e06c24aecbcfd58528af3bc78a

SHA512
ea195859972162fabeae0ebab5a636b6f8be6cb0e436735e636f2e02dbda8dc3776478347898afa844356b128a8b60be62933b30eb6649faa9c29831e4b76714

Download Submit
\Windows\system\MZOjCTf.exe

Filesize
1.8MB

MD5
02cfa52d6fc8fdbf45dace0200f32c4a

SHA1
c06554869211cae8268619efa18f07c67b5116c0

SHA256
b9ec18472d16869dcc4cc847d3ab027d885858a91b97573162ae6b03eeed8f4e

SHA512
efa141734a0402190db9f131aaebefeb0a9422b3b9a32e81c41e030a2b50e8eb623750b985475d15928ab181ad470298f65b4bc1f86fd3da05521cf2007b5d29

Download Submit
\Windows\system\OIcOFhS.exe

Filesize
1.8MB

MD5
0d51ffd3567e9a02627ed170ca9d76f3

SHA1
0ebc10f64177a1fe70d3b61be1aa67f91b36788c

SHA256
54f478c190ce65408692be070382cd6ba53a86175a2f275684e46a2feeb4ac2d

SHA512
ae1578d545c4a6ba1df9569d61efbdbc8bd39292355d768fce93989838beb3be7406b871f3ad0688100415db9327d4955a0d888cc7e0dfbc21d6774717240ab6

Download Submit
\Windows\system\SlQWkSb.exe

Filesize
1.9MB

MD5
c52de88ff98f363341086cd987be63ec

SHA1
26b1e03587e067e22ef4a85b68ab96c2b6691129

SHA256
50f582d85330bdb609c5d57851c7525e34ea37e1a49a5f350ce740c9c3188af1

SHA512
2ce66787e1bd77e8ed24c15eb830e6cb29de8836fa493af300fa0b7f54f9b9f350fd953474d62408695d56267650a002e7bcdae83626a508ef9cfad9774915fd

Download Submit
\Windows\system\StpzGIb.exe

Filesize
1.9MB

MD5
2b0bf2f6e3900c620413c65f156c85f6

SHA1
5abb6723af020d2d364255bbc5ad107b6575db43

SHA256
e74311428d0526b583776065c6dc2286033014a0fb185867d445d7f20cedcfb1

SHA512
6027900d5dd68cb8a5b020a30a3ea075fbd819749d24b2a375706e41a110fe9d54052c59a9fc4e09dc24c2eea30b84d83a5e8e9cd8883a3d175eae5237bdc9c2

Download Submit
\Windows\system\UCegTxb.exe

Filesize
1.8MB

MD5
e8f48918bb3033495ca2d4e033ebfb81

SHA1
105d95423d0eb63114c1fdaa978d485ae402966a

SHA256
9108b2c7ac766c7872c2c0e1a72bdc5ef5dd10939fba927f0fdf799b41b24b09

SHA512
4cb4afa0adca43e9c93c28aa284362c270bf53a8494ef825258de8027dece538697cd4fe9b7636e54d279fc0ba962fa715bc0dc0f1dee114761d750e339b76b8

Download Submit
\Windows\system\UkRpCdy.exe

Filesize
1.9MB

MD5
c2706a3d57a4140188d8bf550f8f2455

SHA1
0706fcdf3c3259241c77931187eb79ed1d45775f

SHA256
b50996069e023e138a8287c4720af6a2545c369e7ec5b1ad04cda854103200fc

SHA512
fa40a9418e62a9c813042642ea048ff199064e3381371630478d87a939f690072246a1f7dda563b5b947e71a15ffb65134cc0b2e867196c9923d112b2fdca253

Download Submit
\Windows\system\WZPLqqb.exe

Filesize
1.8MB

MD5
5263a7c0971d04954f4c58af139abb44

SHA1
483d752ec455558fdd043cee6802cc755ff95fbd

SHA256
029f4a33083a028672cb7776e5fcc9ad96ae701a70c151e76570f3481a15fe95

SHA512
641f6029adac8bc0042da054d24270b27436691ed95ee513555e28efd47de482911c661f35e417ce6d2946cf7ab366272751777d9c7d0ab9c59ca3b32efaf6b7

Download Submit
\Windows\system\YEDbqcb.exe

Filesize
1.9MB

MD5
a97ec00c81921a814b0baa3b2a2b2ff1

SHA1
7517400e4b5f6eae2babbeb7a9369a1b1cfaf79d

SHA256
7235dc88c9eed9139ce8ed8fff41e1d6e0954afab50912d19cd223a13e831178

SHA512
0abdfc99cdb14167e691638662bd38015c10b992b26954103db6d2db615acd79011734f1a4822af8fa5ad5bff3b070d4c283295b42667e1d8e8782ecc79fae25

Download Submit
\Windows\system\bFzaulL.exe

Filesize
1.9MB

MD5
3cd9473126cc67d04bf5ddee558f5f6f

SHA1
a5aac3db1371591b8025cd7358ba20f0fae9b7bb

SHA256
ca64bd507ecd48a2085de50f13d63d10d8cee2fa2dfc3583bb4d641761e6ba7f

SHA512
bc5a22e9f860de1bb17db2c48e9e3b80cb9cea5b73058593f49df4e8c57888edb15f8d0c6798ec6ce95b28f7d70e89ab1b58a8ef933cfdeb0ad10d5a97978197

Download Submit
\Windows\system\blJyomf.exe

Filesize
1.9MB

MD5
c07d492d7c7e074c00135503eb96b296

SHA1
b9e3c77e9d74946e91b36aee137c5d161e98ccd0

SHA256
7a95cfe40798c7634805ce7c1f5388a0feec93fa0536d07fc12acaf9f2f886b4

SHA512
b8d54add528a219ccde7b0d316ea838426f1ab76ce116f120317edd31cee07e671d69dc3f8aa4580ce2f1c6eefc1bb1592ba77004b8b95db948f69a65b876f60

Download Submit
\Windows\system\bvNWLmz.exe

Filesize
1.8MB

MD5
2cccf93ddc8674202dfb5e841c811f2b

SHA1
73bf4b1100864ba4729d0b876430f20c69552e45

SHA256
f86f9ed49ad8a4754503285d4f387ef69a7612c89ee5ca823103981bebf94556

SHA512
7c1b2635d5d3d83f1cc548ad4bf4bc0b2a9bc5c02aaf150f5705f34359641c466d849d5b0f60ee40ae9221158d7fa6058306fa5d147e9754ced0ac7321200a3d

Download Submit
\Windows\system\cfutaDt.exe

Filesize
1.9MB

MD5
e450b54ea914f4de00093bba08122e89

SHA1
72349e46345c922c6eab8dea93edccea01f3fc74

SHA256
09094aac692664b5876bc972be9370d8f59c2097aa54dac1759c072b0fe89254

SHA512
047825eee46233c71070f2a9d0ed5c762c86b71a0af4b587d59a8a4a9e9d3a87c1e531bda0913fb985fca2ec46393d35b5721f3e320c59d18b9e01d040363990

Download Submit
\Windows\system\fgMDEZY.exe

Filesize
1.9MB

MD5
9aae788b68756c33bd84a77c0b4634ad

SHA1
0632d055181efb688ae7d882e65e72f08a3b59c6

SHA256
4f443d40dbf20510b2a5fda34c02ad171f53cc2033f977be2610ccb57d8a3c51

SHA512
cc07d424bd1c7386cf2d26c199a699f9da107f26854d4801576d9a9959e6318822fc27e00d8c6c3bcecb08e8d32431948586eecce5450c1f698d0e50cf1f0ad9

Download Submit
\Windows\system\hKuZuge.exe

Filesize
1.8MB

MD5
8ef975100085268b28e0a29f93bf474f

SHA1
d5fbebc48931ba238583b49404b999f19efd3db8

SHA256
233d81dd622d4669e185575a44a44d11a824e58c35acd1abe7133d815b7917da

SHA512
856b34b559395ff086120391c26fe337fb2cf111302ee2be843cb76fb6fb1f91b1165cba9b174117b913cfa1faa20ba7624a73a67a7eca44632f1bdbb2ed955c

Download Submit
\Windows\system\sMVvwOr.exe

Filesize
1.9MB

MD5
41fa92a91a9271481b5e36e7cba64127

SHA1
fa01ab9d63a05a7911c95ba4e9e7149afd452431

SHA256
7234886478c608389e3017dfdebe1841c6b0dd44be5952907b4e4459d455915e

SHA512
02dc1d51efa42b482ee6ae9ef77fee737541b0a6ba48c5f833ac52a0fd5a8063d70981b9b5745118e74139f1e1a20ca8c03016691bb5e1bb63a5c5b4903e4f60

Download Submit
\Windows\system\tvpPuco.exe

Filesize
1.9MB

MD5
81b4c04104c6aa8af234b09d19a4bb51

SHA1
009ad88e8338c58fbedd88ab3befd772de2f0c31

SHA256
cebef4e5d86d7463b18cd0c6ef4d015c4abd0d7cf5e633830afd3ad5e2ccbe1d

SHA512
daa1f019442621047c050c1e81f4958eacc15dde65dc81178f66fb2fd362c7ff1233b5902751a0216a7415b0ce3b33c1322721736d068a143b18bfc6b7bb482c

Download Submit
memory/2116-51-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-203-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-20-0x0000000002FC0000-0x00000000033B2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-217-0x0000000003430000-0x0000000003822000-memory.dmp

Filesize
3.9MB

Download
memory/2372-97-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-215-0x0000000003430000-0x0000000003822000-memory.dmp

Filesize
3.9MB

Download
memory/2372-205-0x0000000003430000-0x0000000003822000-memory.dmp

Filesize
3.9MB

Download
memory/2372-204-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-216-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2372-1316-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2372-193-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-111-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2372-44-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2372-7-0x0000000002FC0000-0x00000000033B2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-16-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-189-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2372-0-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2372-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2424-184-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2460-180-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2608-36-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-112-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-37-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2676-64-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-93-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2816-227-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/3060-9-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download