xmrig | 6c3d8bb6021438142f4f4c7c1c1f508fbf0eab9b3c82ba193c558822045c4247

Analysis

max time kernel
38s
max time network
38s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
Size

2.2MB
MD5

068c18d6e80523f6663d2e8282e54dfb
SHA1

72d8c3627bd6ad4af38384cd9d2fee9818f139b8
SHA256

6c3d8bb6021438142f4f4c7c1c1f508fbf0eab9b3c82ba193c558822045c4247
SHA512

64247f8a9faf53ce41a6d33168694f6f0e88743fe2b38a866fa8a56c7ff50697a9a085145fbdbc700774ca5a7fef74fe90e2de6465b161a0abcee9e3fe1861c3
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrf4:NABH

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2752-110-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2600-106-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2488-104-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2500-102-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2732-100-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2948-97-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2960-95-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2668-92-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2032-88-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2160-49-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1484	eqHreZJ.exe
2160	ocGHnsl.exe
2032	VRbLvXS.exe
2668	XoimUlF.exe
2960	jZXOpmf.exe
2948	RqfwJrB.exe
2732	rIPJBqp.exe
2500	IpBMMaJ.exe
2488	hSeWySj.exe
2600	KhVfCTL.exe
2752	bBJfAuX.exe
1888	mBHVRcr.exe
2896	hmHUAtM.exe
1120	NqvvZJZ.exe
3040	BvhHOAO.exe
2848	XYlXlTe.exe
2876	wjghyIY.exe
2836	gwEVTTW.exe
2652	BQCFhpZ.exe
1372	kTJKsKb.exe
484	FRbuRlK.exe
1280	VUqlhEA.exe
1772	aXTfdOw.exe
2212	IkErxkS.exe
2124	fwLQBXh.exe
1604	HGXvtYn.exe
1220	LuTlJyM.exe
2976	ralBdCQ.exe
2552	biBGcku.exe
1928	mhrCFAt.exe
3044	YjQAyYl.exe
1500	qBAtFNa.exe
2092	iQOlerR.exe
2252	UeypWbA.exe
1768	UAgnVkx.exe
1512	CNfXMga.exe
852	NCrYXfM.exe
1572	nJrSStJ.exe
1736	MLGrAKS.exe
1724	GqFtdZo.exe
1708	iGrSsmz.exe
2080	FlpwpUR.exe
1856	JJevsbu.exe
1860	nggjVNL.exe
300	EFrmvvo.exe
2060	ytRyBzf.exe
2396	ctuqzJz.exe
1636	nPZEDrE.exe
3004	dWrywDX.exe
2024	JBgWtZa.exe
2088	iosaiZP.exe
1816	qhGgdcO.exe
2188	qfQTEaH.exe
1560	nezbopF.exe
2328	FNqSCqa.exe
2688	VFtgnHT.exe
2756	tdWDmRv.exe
1600	FEliOAM.exe
2548	NhqQbJJ.exe
1648	OstrbVn.exe
2588	AayXKHR.exe
2704	lUKzeom.exe
2692	QAgDjsK.exe
1628	tXzncBF.exe

Loads dropped DLL 64 IoCs

pid	Process
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2036-0-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/files/0x000b000000012301-6.dat	upx
behavioral1/memory/1484-8-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/files/0x00360000000167e8-14.dat	upx
behavioral1/files/0x0007000000016cf2-27.dat	upx
behavioral1/files/0x000600000001738e-44.dat	upx
behavioral1/files/0x000600000001738f-48.dat	upx
behavioral1/files/0x00060000000171ad-42.dat	upx
behavioral1/files/0x000700000001708c-38.dat	upx
behavioral1/files/0x0009000000016d19-35.dat	upx
behavioral1/files/0x0007000000016d01-30.dat	upx
behavioral1/files/0x0007000000016ccd-23.dat	upx
behavioral1/files/0x0008000000016c5b-11.dat	upx
behavioral1/files/0x0006000000017577-80.dat	upx
behavioral1/files/0x00060000000173e2-73.dat	upx
behavioral1/files/0x00060000000175f7-126.dat	upx
behavioral1/files/0x000500000001925a-173.dat	upx
behavioral1/files/0x000500000001927b-183.dat	upx
behavioral1/files/0x000500000001928e-188.dat	upx
behavioral1/files/0x0005000000019276-178.dat	upx
behavioral1/files/0x0005000000019254-168.dat	upx
behavioral1/files/0x000600000001902f-163.dat	upx
behavioral1/files/0x000500000001878f-158.dat	upx
behavioral1/files/0x000500000001871c-148.dat	upx
behavioral1/files/0x0005000000018749-153.dat	upx
behavioral1/files/0x000500000001870e-143.dat	upx
behavioral1/files/0x00050000000186a2-138.dat	upx
behavioral1/files/0x0007000000017603-123.dat	upx
behavioral1/files/0x00060000000174ef-116.dat	upx
behavioral1/files/0x00060000000173e5-113.dat	upx
behavioral1/memory/2752-110-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/memory/2600-106-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/files/0x000d000000018689-131.dat	upx
behavioral1/files/0x00130000000054a8-120.dat	upx
behavioral1/memory/2488-104-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2500-102-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2732-100-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2948-97-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/2960-95-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/files/0x0036000000016a3a-93.dat	upx
behavioral1/memory/2668-92-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2032-88-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/files/0x0006000000017436-79.dat	upx
behavioral1/memory/2160-49-0x000000013F150000-0x000000013F542000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cbcCilK.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\FkUvfoq.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\mQEDOLG.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\KVVuDbZ.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\EQwHQkk.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\uRJTDEy.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\kTJKsKb.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\jmuutVe.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\KLqBamM.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\NJttAxy.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\cmLjUsB.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\kVtGGQg.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\jISgjRr.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\ocGHnsl.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\QJwRScg.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\fxcQphV.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\oEtoHDo.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\jJitPfw.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\OISMqtY.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\opkfQoU.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\bQfVHrT.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\vqsFhZK.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\FvuCgbF.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\EBWKbhh.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\DxbCWFK.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\qQbfdcW.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\MDajyuJ.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\EdACGuV.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\DkJNPGH.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\tXzncBF.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\zvJajTN.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\ggnVOwM.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\VDPqTTR.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\ZURgjfu.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\BHflbAc.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\ChDXtHU.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\HHMXNoy.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\AnStwsB.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\YUpvMwX.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\NhSSecD.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\EYXyrPx.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\WkEzZBx.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\GmIznzB.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\IOAWKXi.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\hkjpywf.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\HoMfwKw.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\lVXuCSy.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\zBVZXsY.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\kIMpUIx.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\LRInMDj.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\NIlGcyH.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\ZoSNYcQ.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\cFwEPBk.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\vHHikGw.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\QRgGYhF.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\VBGuAvD.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\wRFBAKy.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\izVzKWh.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\VEuCxKW.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\noimDOa.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\IyiozFO.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\qxazuPB.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\bJkhpeI.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
File created	C:\Windows\System\flgUxmj.exe	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2200	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
Token: SeDebugPrivilege	2200	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2200	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	29
PID 2036 wrote to memory of 2200	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	29
PID 2036 wrote to memory of 2200	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	29
PID 2036 wrote to memory of 1484	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	30
PID 2036 wrote to memory of 1484	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	30
PID 2036 wrote to memory of 1484	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	30
PID 2036 wrote to memory of 2160	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	31
PID 2036 wrote to memory of 2160	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	31
PID 2036 wrote to memory of 2160	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	31
PID 2036 wrote to memory of 2032	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	32
PID 2036 wrote to memory of 2032	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	32
PID 2036 wrote to memory of 2032	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	32
PID 2036 wrote to memory of 2668	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	33
PID 2036 wrote to memory of 2668	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	33
PID 2036 wrote to memory of 2668	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	33
PID 2036 wrote to memory of 2960	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	34
PID 2036 wrote to memory of 2960	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	34
PID 2036 wrote to memory of 2960	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	34
PID 2036 wrote to memory of 2948	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	35
PID 2036 wrote to memory of 2948	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	35
PID 2036 wrote to memory of 2948	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	35
PID 2036 wrote to memory of 2732	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	36
PID 2036 wrote to memory of 2732	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	36
PID 2036 wrote to memory of 2732	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	36
PID 2036 wrote to memory of 2500	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	37
PID 2036 wrote to memory of 2500	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	37
PID 2036 wrote to memory of 2500	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	37
PID 2036 wrote to memory of 2488	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	38
PID 2036 wrote to memory of 2488	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	38
PID 2036 wrote to memory of 2488	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	38
PID 2036 wrote to memory of 2600	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	39
PID 2036 wrote to memory of 2600	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	39
PID 2036 wrote to memory of 2600	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	39
PID 2036 wrote to memory of 2752	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	40
PID 2036 wrote to memory of 2752	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	40
PID 2036 wrote to memory of 2752	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	40
PID 2036 wrote to memory of 3040	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	41
PID 2036 wrote to memory of 3040	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	41
PID 2036 wrote to memory of 3040	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	41
PID 2036 wrote to memory of 1888	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	42
PID 2036 wrote to memory of 1888	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	42
PID 2036 wrote to memory of 1888	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	42
PID 2036 wrote to memory of 2848	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	43
PID 2036 wrote to memory of 2848	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	43
PID 2036 wrote to memory of 2848	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	43
PID 2036 wrote to memory of 2896	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	44
PID 2036 wrote to memory of 2896	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	44
PID 2036 wrote to memory of 2896	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	44
PID 2036 wrote to memory of 2876	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	45
PID 2036 wrote to memory of 2876	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	45
PID 2036 wrote to memory of 2876	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	45
PID 2036 wrote to memory of 1120	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	46
PID 2036 wrote to memory of 1120	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	46
PID 2036 wrote to memory of 1120	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	46
PID 2036 wrote to memory of 2652	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	47
PID 2036 wrote to memory of 2652	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	47
PID 2036 wrote to memory of 2652	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	47
PID 2036 wrote to memory of 2836	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	48
PID 2036 wrote to memory of 2836	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	48
PID 2036 wrote to memory of 2836	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	48
PID 2036 wrote to memory of 484	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	49
PID 2036 wrote to memory of 484	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	49
PID 2036 wrote to memory of 484	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	49
PID 2036 wrote to memory of 1372	2036	068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\068c18d6e80523f6663d2e8282e54dfb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\System\eqHreZJ.exe
  C:\Windows\System\eqHreZJ.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\ocGHnsl.exe
  C:\Windows\System\ocGHnsl.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\VRbLvXS.exe
  C:\Windows\System\VRbLvXS.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\XoimUlF.exe
  C:\Windows\System\XoimUlF.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\jZXOpmf.exe
  C:\Windows\System\jZXOpmf.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\RqfwJrB.exe
  C:\Windows\System\RqfwJrB.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\rIPJBqp.exe
  C:\Windows\System\rIPJBqp.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\IpBMMaJ.exe
  C:\Windows\System\IpBMMaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\hSeWySj.exe
  C:\Windows\System\hSeWySj.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\KhVfCTL.exe
  C:\Windows\System\KhVfCTL.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\bBJfAuX.exe
  C:\Windows\System\bBJfAuX.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\BvhHOAO.exe
  C:\Windows\System\BvhHOAO.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\mBHVRcr.exe
  C:\Windows\System\mBHVRcr.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\XYlXlTe.exe
  C:\Windows\System\XYlXlTe.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\hmHUAtM.exe
  C:\Windows\System\hmHUAtM.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\wjghyIY.exe
  C:\Windows\System\wjghyIY.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\NqvvZJZ.exe
  C:\Windows\System\NqvvZJZ.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\BQCFhpZ.exe
  C:\Windows\System\BQCFhpZ.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\gwEVTTW.exe
  C:\Windows\System\gwEVTTW.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\FRbuRlK.exe
  C:\Windows\System\FRbuRlK.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\System\kTJKsKb.exe
  C:\Windows\System\kTJKsKb.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\VUqlhEA.exe
  C:\Windows\System\VUqlhEA.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\aXTfdOw.exe
  C:\Windows\System\aXTfdOw.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\IkErxkS.exe
  C:\Windows\System\IkErxkS.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\fwLQBXh.exe
  C:\Windows\System\fwLQBXh.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\HGXvtYn.exe
  C:\Windows\System\HGXvtYn.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\LuTlJyM.exe
  C:\Windows\System\LuTlJyM.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\ralBdCQ.exe
  C:\Windows\System\ralBdCQ.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\biBGcku.exe
  C:\Windows\System\biBGcku.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\mhrCFAt.exe
  C:\Windows\System\mhrCFAt.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\YjQAyYl.exe
  C:\Windows\System\YjQAyYl.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\qBAtFNa.exe
  C:\Windows\System\qBAtFNa.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\iQOlerR.exe
  C:\Windows\System\iQOlerR.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\UeypWbA.exe
  C:\Windows\System\UeypWbA.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\UAgnVkx.exe
  C:\Windows\System\UAgnVkx.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\CNfXMga.exe
  C:\Windows\System\CNfXMga.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\NCrYXfM.exe
  C:\Windows\System\NCrYXfM.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\nJrSStJ.exe
  C:\Windows\System\nJrSStJ.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\MLGrAKS.exe
  C:\Windows\System\MLGrAKS.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\GqFtdZo.exe
  C:\Windows\System\GqFtdZo.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\iGrSsmz.exe
  C:\Windows\System\iGrSsmz.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\FlpwpUR.exe
  C:\Windows\System\FlpwpUR.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\JJevsbu.exe
  C:\Windows\System\JJevsbu.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\nggjVNL.exe
  C:\Windows\System\nggjVNL.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\EFrmvvo.exe
  C:\Windows\System\EFrmvvo.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\ytRyBzf.exe
  C:\Windows\System\ytRyBzf.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\ctuqzJz.exe
  C:\Windows\System\ctuqzJz.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\nPZEDrE.exe
  C:\Windows\System\nPZEDrE.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\dWrywDX.exe
  C:\Windows\System\dWrywDX.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\JBgWtZa.exe
  C:\Windows\System\JBgWtZa.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\iosaiZP.exe
  C:\Windows\System\iosaiZP.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\qhGgdcO.exe
  C:\Windows\System\qhGgdcO.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\qfQTEaH.exe
  C:\Windows\System\qfQTEaH.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\nezbopF.exe
  C:\Windows\System\nezbopF.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\FNqSCqa.exe
  C:\Windows\System\FNqSCqa.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\VFtgnHT.exe
  C:\Windows\System\VFtgnHT.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\tdWDmRv.exe
  C:\Windows\System\tdWDmRv.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\FEliOAM.exe
  C:\Windows\System\FEliOAM.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\NhqQbJJ.exe
  C:\Windows\System\NhqQbJJ.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\OstrbVn.exe
  C:\Windows\System\OstrbVn.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\AayXKHR.exe
  C:\Windows\System\AayXKHR.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\lUKzeom.exe
  C:\Windows\System\lUKzeom.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\QAgDjsK.exe
  C:\Windows\System\QAgDjsK.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\tXzncBF.exe
  C:\Windows\System\tXzncBF.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\Aktytlx.exe
  C:\Windows\System\Aktytlx.exe
  2⤵
  PID:2840
- C:\Windows\System\wDOWMJG.exe
  C:\Windows\System\wDOWMJG.exe
  2⤵
  PID:2716
- C:\Windows\System\hgNrBat.exe
  C:\Windows\System\hgNrBat.exe
  2⤵
  PID:1232
- C:\Windows\System\DHHhmgf.exe
  C:\Windows\System\DHHhmgf.exe
  2⤵
  PID:856
- C:\Windows\System\AhpBbEk.exe
  C:\Windows\System\AhpBbEk.exe
  2⤵
  PID:692
- C:\Windows\System\LFiSdaN.exe
  C:\Windows\System\LFiSdaN.exe
  2⤵
  PID:2864
- C:\Windows\System\ljXOVIe.exe
  C:\Windows\System\ljXOVIe.exe
  2⤵
  PID:2908
- C:\Windows\System\QFmxToJ.exe
  C:\Windows\System\QFmxToJ.exe
  2⤵
  PID:752
- C:\Windows\System\mYdSBob.exe
  C:\Windows\System\mYdSBob.exe
  2⤵
  PID:908
- C:\Windows\System\XaSvFYq.exe
  C:\Windows\System\XaSvFYq.exe
  2⤵
  PID:348
- C:\Windows\System\lFpzqYU.exe
  C:\Windows\System\lFpzqYU.exe
  2⤵
  PID:2068
- C:\Windows\System\JqWzyhH.exe
  C:\Windows\System\JqWzyhH.exe
  2⤵
  PID:1156
- C:\Windows\System\lKLfHUZ.exe
  C:\Windows\System\lKLfHUZ.exe
  2⤵
  PID:1320
- C:\Windows\System\RsptZIV.exe
  C:\Windows\System\RsptZIV.exe
  2⤵
  PID:2968
- C:\Windows\System\bMSMmrg.exe
  C:\Windows\System\bMSMmrg.exe
  2⤵
  PID:2796
- C:\Windows\System\YHqEILV.exe
  C:\Windows\System\YHqEILV.exe
  2⤵
  PID:1728
- C:\Windows\System\uGtNbiW.exe
  C:\Windows\System\uGtNbiW.exe
  2⤵
  PID:2320
- C:\Windows\System\pQnpSBs.exe
  C:\Windows\System\pQnpSBs.exe
  2⤵
  PID:1676
- C:\Windows\System\izFsrrL.exe
  C:\Windows\System\izFsrrL.exe
  2⤵
  PID:2040
- C:\Windows\System\bwvhpaQ.exe
  C:\Windows\System\bwvhpaQ.exe
  2⤵
  PID:2824
- C:\Windows\System\Qbvdtvc.exe
  C:\Windows\System\Qbvdtvc.exe
  2⤵
  PID:2436
- C:\Windows\System\aamJocZ.exe
  C:\Windows\System\aamJocZ.exe
  2⤵
  PID:1664
- C:\Windows\System\YtBQmKI.exe
  C:\Windows\System\YtBQmKI.exe
  2⤵
  PID:1692
- C:\Windows\System\IStlINg.exe
  C:\Windows\System\IStlINg.exe
  2⤵
  PID:1704
- C:\Windows\System\wSbrBXL.exe
  C:\Windows\System\wSbrBXL.exe
  2⤵
  PID:2524
- C:\Windows\System\VZeBKhI.exe
  C:\Windows\System\VZeBKhI.exe
  2⤵
  PID:2348
- C:\Windows\System\HJNAlYX.exe
  C:\Windows\System\HJNAlYX.exe
  2⤵
  PID:1840
- C:\Windows\System\DZCUGwb.exe
  C:\Windows\System\DZCUGwb.exe
  2⤵
  PID:2868
- C:\Windows\System\SoNtyTW.exe
  C:\Windows\System\SoNtyTW.exe
  2⤵
  PID:1332
- C:\Windows\System\tIgcxKG.exe
  C:\Windows\System\tIgcxKG.exe
  2⤵
  PID:1848
- C:\Windows\System\iWDDwzj.exe
  C:\Windows\System\iWDDwzj.exe
  2⤵
  PID:1096
- C:\Windows\System\NJZMqaQ.exe
  C:\Windows\System\NJZMqaQ.exe
  2⤵
  PID:2192
- C:\Windows\System\xtjUGfA.exe
  C:\Windows\System\xtjUGfA.exe
  2⤵
  PID:840
- C:\Windows\System\qtaMZGu.exe
  C:\Windows\System\qtaMZGu.exe
  2⤵
  PID:600
- C:\Windows\System\xApktzE.exe
  C:\Windows\System\xApktzE.exe
  2⤵
  PID:832
- C:\Windows\System\fqbNXzs.exe
  C:\Windows\System\fqbNXzs.exe
  2⤵
  PID:2392
- C:\Windows\System\BcTBWcr.exe
  C:\Windows\System\BcTBWcr.exe
  2⤵
  PID:2280
- C:\Windows\System\hHtsLsp.exe
  C:\Windows\System\hHtsLsp.exe
  2⤵
  PID:2256
- C:\Windows\System\EHDWThm.exe
  C:\Windows\System\EHDWThm.exe
  2⤵
  PID:2992
- C:\Windows\System\zHCSKcB.exe
  C:\Windows\System\zHCSKcB.exe
  2⤵
  PID:2300
- C:\Windows\System\dubEvyZ.exe
  C:\Windows\System\dubEvyZ.exe
  2⤵
  PID:984
- C:\Windows\System\NQAylMP.exe
  C:\Windows\System\NQAylMP.exe
  2⤵
  PID:1680
- C:\Windows\System\vAcavjG.exe
  C:\Windows\System\vAcavjG.exe
  2⤵
  PID:2932
- C:\Windows\System\pgZTYDa.exe
  C:\Windows\System\pgZTYDa.exe
  2⤵
  PID:952
- C:\Windows\System\geawWEb.exe
  C:\Windows\System\geawWEb.exe
  2⤵
  PID:2788
- C:\Windows\System\zxlSYSp.exe
  C:\Windows\System\zxlSYSp.exe
  2⤵
  PID:1240
- C:\Windows\System\TWviXLo.exe
  C:\Windows\System\TWviXLo.exe
  2⤵
  PID:1308
- C:\Windows\System\aVsBptw.exe
  C:\Windows\System\aVsBptw.exe
  2⤵
  PID:2616
- C:\Windows\System\LRInMDj.exe
  C:\Windows\System\LRInMDj.exe
  2⤵
  PID:1844
- C:\Windows\System\ShVnUHh.exe
  C:\Windows\System\ShVnUHh.exe
  2⤵
  PID:2660
- C:\Windows\System\mXYylCq.exe
  C:\Windows\System\mXYylCq.exe
  2⤵
  PID:2920
- C:\Windows\System\cfdfJaL.exe
  C:\Windows\System\cfdfJaL.exe
  2⤵
  PID:2028
- C:\Windows\System\BxMImaO.exe
  C:\Windows\System\BxMImaO.exe
  2⤵
  PID:1248
- C:\Windows\System\QDZDhhC.exe
  C:\Windows\System\QDZDhhC.exe
  2⤵
  PID:1660
- C:\Windows\System\GgwkpbT.exe
  C:\Windows\System\GgwkpbT.exe
  2⤵
  PID:2900
- C:\Windows\System\NiqeRpe.exe
  C:\Windows\System\NiqeRpe.exe
  2⤵
  PID:2508
- C:\Windows\System\UsbshDH.exe
  C:\Windows\System\UsbshDH.exe
  2⤵
  PID:2984
- C:\Windows\System\WViXHIw.exe
  C:\Windows\System\WViXHIw.exe
  2⤵
  PID:2156
- C:\Windows\System\kyateiP.exe
  C:\Windows\System\kyateiP.exe
  2⤵
  PID:2556
- C:\Windows\System\sAAgnVM.exe
  C:\Windows\System\sAAgnVM.exe
  2⤵
  PID:920
- C:\Windows\System\owCquox.exe
  C:\Windows\System\owCquox.exe
  2⤵
  PID:2928
- C:\Windows\System\Kkwqakx.exe
  C:\Windows\System\Kkwqakx.exe
  2⤵
  PID:320
- C:\Windows\System\GHGlTLj.exe
  C:\Windows\System\GHGlTLj.exe
  2⤵
  PID:1508
- C:\Windows\System\LNmcZpi.exe
  C:\Windows\System\LNmcZpi.exe
  2⤵
  PID:1544
- C:\Windows\System\HjIPOdY.exe
  C:\Windows\System\HjIPOdY.exe
  2⤵
  PID:1408
- C:\Windows\System\jmuutVe.exe
  C:\Windows\System\jmuutVe.exe
  2⤵
  PID:2168
- C:\Windows\System\EXulEDY.exe
  C:\Windows\System\EXulEDY.exe
  2⤵
  PID:936
- C:\Windows\System\MDajyuJ.exe
  C:\Windows\System\MDajyuJ.exe
  2⤵
  PID:2152
- C:\Windows\System\smTZeAK.exe
  C:\Windows\System\smTZeAK.exe
  2⤵
  PID:1584
- C:\Windows\System\ZjrzMyg.exe
  C:\Windows\System\ZjrzMyg.exe
  2⤵
  PID:1468
- C:\Windows\System\YLUqfaM.exe
  C:\Windows\System\YLUqfaM.exe
  2⤵
  PID:900
- C:\Windows\System\qOrXLQE.exe
  C:\Windows\System\qOrXLQE.exe
  2⤵
  PID:2096
- C:\Windows\System\nplYAGQ.exe
  C:\Windows\System\nplYAGQ.exe
  2⤵
  PID:732
- C:\Windows\System\uEzvebq.exe
  C:\Windows\System\uEzvebq.exe
  2⤵
  PID:1272
- C:\Windows\System\iepIFkz.exe
  C:\Windows\System\iepIFkz.exe
  2⤵
  PID:1348
- C:\Windows\System\OLfxUpL.exe
  C:\Windows\System\OLfxUpL.exe
  2⤵
  PID:408
- C:\Windows\System\SPGSRid.exe
  C:\Windows\System\SPGSRid.exe
  2⤵
  PID:1552
- C:\Windows\System\pVVyTtl.exe
  C:\Windows\System\pVVyTtl.exe
  2⤵
  PID:2148
- C:\Windows\System\KrSTPlB.exe
  C:\Windows\System\KrSTPlB.exe
  2⤵
  PID:2332
- C:\Windows\System\PjXbCzp.exe
  C:\Windows\System\PjXbCzp.exe
  2⤵
  PID:2004
- C:\Windows\System\QIBtszu.exe
  C:\Windows\System\QIBtszu.exe
  2⤵
  PID:628
- C:\Windows\System\PBYvDYB.exe
  C:\Windows\System\PBYvDYB.exe
  2⤵
  PID:1992
- C:\Windows\System\GRRVDOW.exe
  C:\Windows\System\GRRVDOW.exe
  2⤵
  PID:1032
- C:\Windows\System\tWNovcU.exe
  C:\Windows\System\tWNovcU.exe
  2⤵
  PID:2712
- C:\Windows\System\XQBtfxu.exe
  C:\Windows\System\XQBtfxu.exe
  2⤵
  PID:2468
- C:\Windows\System\PqPJjwR.exe
  C:\Windows\System\PqPJjwR.exe
  2⤵
  PID:1264
- C:\Windows\System\rdYYZuT.exe
  C:\Windows\System\rdYYZuT.exe
  2⤵
  PID:2916
- C:\Windows\System\WbjgIoQ.exe
  C:\Windows\System\WbjgIoQ.exe
  2⤵
  PID:1516
- C:\Windows\System\ROtaAbJ.exe
  C:\Windows\System\ROtaAbJ.exe
  2⤵
  PID:1936
- C:\Windows\System\RddojpT.exe
  C:\Windows\System\RddojpT.exe
  2⤵
  PID:860
- C:\Windows\System\QkDjNgg.exe
  C:\Windows\System\QkDjNgg.exe
  2⤵
  PID:696
- C:\Windows\System\sBJOtXm.exe
  C:\Windows\System\sBJOtXm.exe
  2⤵
  PID:1520
- C:\Windows\System\uSptwRT.exe
  C:\Windows\System\uSptwRT.exe
  2⤵
  PID:608
- C:\Windows\System\kFGFshs.exe
  C:\Windows\System\kFGFshs.exe
  2⤵
  PID:3048
- C:\Windows\System\wAsRMiA.exe
  C:\Windows\System\wAsRMiA.exe
  2⤵
  PID:3012
- C:\Windows\System\alugbVc.exe
  C:\Windows\System\alugbVc.exe
  2⤵
  PID:880
- C:\Windows\System\sMtpJff.exe
  C:\Windows\System\sMtpJff.exe
  2⤵
  PID:2284
- C:\Windows\System\OoSNwmm.exe
  C:\Windows\System\OoSNwmm.exe
  2⤵
  PID:2680
- C:\Windows\System\mzGeuFt.exe
  C:\Windows\System\mzGeuFt.exe
  2⤵
  PID:2724
- C:\Windows\System\QiRqEim.exe
  C:\Windows\System\QiRqEim.exe
  2⤵
  PID:1576
- C:\Windows\System\RuyMlbs.exe
  C:\Windows\System\RuyMlbs.exe
  2⤵
  PID:3052
- C:\Windows\System\DcZwPYw.exe
  C:\Windows\System\DcZwPYw.exe
  2⤵
  PID:3088
- C:\Windows\System\FoZzJJJ.exe
  C:\Windows\System\FoZzJJJ.exe
  2⤵
  PID:3104
- C:\Windows\System\nvmlIEs.exe
  C:\Windows\System\nvmlIEs.exe
  2⤵
  PID:3204
- C:\Windows\System\IXscseH.exe
  C:\Windows\System\IXscseH.exe
  2⤵
  PID:3220
- C:\Windows\System\AkbFqGe.exe
  C:\Windows\System\AkbFqGe.exe
  2⤵
  PID:3236
- C:\Windows\System\HHJZOKI.exe
  C:\Windows\System\HHJZOKI.exe
  2⤵
  PID:3252
- C:\Windows\System\oaMjyOg.exe
  C:\Windows\System\oaMjyOg.exe
  2⤵
  PID:3268
- C:\Windows\System\SAxzLLU.exe
  C:\Windows\System\SAxzLLU.exe
  2⤵
  PID:3288
- C:\Windows\System\dIydKEa.exe
  C:\Windows\System\dIydKEa.exe
  2⤵
  PID:3304
- C:\Windows\System\ikiVhRc.exe
  C:\Windows\System\ikiVhRc.exe
  2⤵
  PID:3324
- C:\Windows\System\THvzzFS.exe
  C:\Windows\System\THvzzFS.exe
  2⤵
  PID:3340
- C:\Windows\System\mKbTKwn.exe
  C:\Windows\System\mKbTKwn.exe
  2⤵
  PID:3372
- C:\Windows\System\BmZxMXf.exe
  C:\Windows\System\BmZxMXf.exe
  2⤵
  PID:3400
- C:\Windows\System\QFXHIyq.exe
  C:\Windows\System\QFXHIyq.exe
  2⤵
  PID:3416
- C:\Windows\System\aoOFdzo.exe
  C:\Windows\System\aoOFdzo.exe
  2⤵
  PID:3436
- C:\Windows\System\DTvLUYQ.exe
  C:\Windows\System\DTvLUYQ.exe
  2⤵
  PID:3452
- C:\Windows\System\GyCPZCq.exe
  C:\Windows\System\GyCPZCq.exe
  2⤵
  PID:3468
- C:\Windows\System\rVYeMVs.exe
  C:\Windows\System\rVYeMVs.exe
  2⤵
  PID:3484
- C:\Windows\System\psbirOy.exe
  C:\Windows\System\psbirOy.exe
  2⤵
  PID:3500
- C:\Windows\System\ENWUUxP.exe
  C:\Windows\System\ENWUUxP.exe
  2⤵
  PID:3520
- C:\Windows\System\dvbkJDe.exe
  C:\Windows\System\dvbkJDe.exe
  2⤵
  PID:3536
- C:\Windows\System\pHtPvKf.exe
  C:\Windows\System\pHtPvKf.exe
  2⤵
  PID:3552
- C:\Windows\System\jOcQupo.exe
  C:\Windows\System\jOcQupo.exe
  2⤵
  PID:3568
- C:\Windows\System\yOmDbHE.exe
  C:\Windows\System\yOmDbHE.exe
  2⤵
  PID:3584
- C:\Windows\System\MiHkUxN.exe
  C:\Windows\System\MiHkUxN.exe
  2⤵
  PID:3600
- C:\Windows\System\EEBrwix.exe
  C:\Windows\System\EEBrwix.exe
  2⤵
  PID:3616
- C:\Windows\System\bDtfbrt.exe
  C:\Windows\System\bDtfbrt.exe
  2⤵
  PID:3632
- C:\Windows\System\PJxgGRC.exe
  C:\Windows\System\PJxgGRC.exe
  2⤵
  PID:3656
- C:\Windows\System\ICJfvui.exe
  C:\Windows\System\ICJfvui.exe
  2⤵
  PID:3672
- C:\Windows\System\GWyDbGu.exe
  C:\Windows\System\GWyDbGu.exe
  2⤵
  PID:3688
- C:\Windows\System\uarPlRb.exe
  C:\Windows\System\uarPlRb.exe
  2⤵
  PID:3704
- C:\Windows\System\TuoqhPO.exe
  C:\Windows\System\TuoqhPO.exe
  2⤵
  PID:3720
- C:\Windows\System\HCeHVRT.exe
  C:\Windows\System\HCeHVRT.exe
  2⤵
  PID:3740
- C:\Windows\System\LRopgzZ.exe
  C:\Windows\System\LRopgzZ.exe
  2⤵
  PID:3756
- C:\Windows\System\DOfSrms.exe
  C:\Windows\System\DOfSrms.exe
  2⤵
  PID:3772
- C:\Windows\System\pogOMEz.exe
  C:\Windows\System\pogOMEz.exe
  2⤵
  PID:3788
- C:\Windows\System\QJwRScg.exe
  C:\Windows\System\QJwRScg.exe
  2⤵
  PID:3888
- C:\Windows\System\qbNCBWb.exe
  C:\Windows\System\qbNCBWb.exe
  2⤵
  PID:3908
- C:\Windows\System\fSDHxRk.exe
  C:\Windows\System\fSDHxRk.exe
  2⤵
  PID:3924
- C:\Windows\System\NIlGcyH.exe
  C:\Windows\System\NIlGcyH.exe
  2⤵
  PID:3940
- C:\Windows\System\FVMKcRY.exe
  C:\Windows\System\FVMKcRY.exe
  2⤵
  PID:3956
- C:\Windows\System\SoQqbbt.exe
  C:\Windows\System\SoQqbbt.exe
  2⤵
  PID:3972
- C:\Windows\System\IXMMZCF.exe
  C:\Windows\System\IXMMZCF.exe
  2⤵
  PID:4016
- C:\Windows\System\vADpAYJ.exe
  C:\Windows\System\vADpAYJ.exe
  2⤵
  PID:4044
- C:\Windows\System\cloVVCz.exe
  C:\Windows\System\cloVVCz.exe
  2⤵
  PID:4064
- C:\Windows\System\ajwrJev.exe
  C:\Windows\System\ajwrJev.exe
  2⤵
  PID:4080
- C:\Windows\System\kBAefVF.exe
  C:\Windows\System\kBAefVF.exe
  2⤵
  PID:2564
- C:\Windows\System\QAyyhau.exe
  C:\Windows\System\QAyyhau.exe
  2⤵
  PID:540
- C:\Windows\System\xZOIMBZ.exe
  C:\Windows\System\xZOIMBZ.exe
  2⤵
  PID:2700
- C:\Windows\System\aTMjiCK.exe
  C:\Windows\System\aTMjiCK.exe
  2⤵
  PID:2800
- C:\Windows\System\GMsMJyh.exe
  C:\Windows\System\GMsMJyh.exe
  2⤵
  PID:2744
- C:\Windows\System\PcJDprD.exe
  C:\Windows\System\PcJDprD.exe
  2⤵
  PID:1536
- C:\Windows\System\HgQcpLI.exe
  C:\Windows\System\HgQcpLI.exe
  2⤵
  PID:1292
- C:\Windows\System\tjAYpXP.exe
  C:\Windows\System\tjAYpXP.exe
  2⤵
  PID:3080
- C:\Windows\System\OISMqtY.exe
  C:\Windows\System\OISMqtY.exe
  2⤵
  PID:3120
- C:\Windows\System\uwJyDFC.exe
  C:\Windows\System\uwJyDFC.exe
  2⤵
  PID:3132
- C:\Windows\System\IUyFOAd.exe
  C:\Windows\System\IUyFOAd.exe
  2⤵
  PID:3148
- C:\Windows\System\HAqyvxd.exe
  C:\Windows\System\HAqyvxd.exe
  2⤵
  PID:3168
- C:\Windows\System\WZfFZvx.exe
  C:\Windows\System\WZfFZvx.exe
  2⤵
  PID:2204
- C:\Windows\System\soJFWzC.exe
  C:\Windows\System\soJFWzC.exe
  2⤵
  PID:3184
- C:\Windows\System\dsJadhz.exe
  C:\Windows\System\dsJadhz.exe
  2⤵
  PID:3100
- C:\Windows\System\RGXxLRT.exe
  C:\Windows\System\RGXxLRT.exe
  2⤵
  PID:2100
- C:\Windows\System\GwFLtkv.exe
  C:\Windows\System\GwFLtkv.exe
  2⤵
  PID:3192
- C:\Windows\System\zZZbwAv.exe
  C:\Windows\System\zZZbwAv.exe
  2⤵
  PID:3336
- C:\Windows\System\mfSAOna.exe
  C:\Windows\System\mfSAOna.exe
  2⤵
  PID:3264
- C:\Windows\System\vfJspxD.exe
  C:\Windows\System\vfJspxD.exe
  2⤵
  PID:3380
- C:\Windows\System\drigTbJ.exe
  C:\Windows\System\drigTbJ.exe
  2⤵
  PID:3356
- C:\Windows\System\pDzTUrp.exe
  C:\Windows\System\pDzTUrp.exe
  2⤵
  PID:3244
- C:\Windows\System\xcJBnmL.exe
  C:\Windows\System\xcJBnmL.exe
  2⤵
  PID:3396
- C:\Windows\System\CqzCuAP.exe
  C:\Windows\System\CqzCuAP.exe
  2⤵
  PID:3696
- C:\Windows\System\wPAaWce.exe
  C:\Windows\System\wPAaWce.exe
  2⤵
  PID:3532
- C:\Windows\System\jJAEUQy.exe
  C:\Windows\System\jJAEUQy.exe
  2⤵
  PID:3668
- C:\Windows\System\fRWaevz.exe
  C:\Windows\System\fRWaevz.exe
  2⤵
  PID:3764
- C:\Windows\System\ChDXtHU.exe
  C:\Windows\System\ChDXtHU.exe
  2⤵
  PID:3808
- C:\Windows\System\AVGrfnC.exe
  C:\Windows\System\AVGrfnC.exe
  2⤵
  PID:3828
- C:\Windows\System\NSAKntu.exe
  C:\Windows\System\NSAKntu.exe
  2⤵
  PID:3844
- C:\Windows\System\AyxQkJC.exe
  C:\Windows\System\AyxQkJC.exe
  2⤵
  PID:3848
- C:\Windows\System\xbfdDHr.exe
  C:\Windows\System\xbfdDHr.exe
  2⤵
  PID:3856
- C:\Windows\System\VmUCbpQ.exe
  C:\Windows\System\VmUCbpQ.exe
  2⤵
  PID:3864
- C:\Windows\System\kOKrPUT.exe
  C:\Windows\System\kOKrPUT.exe
  2⤵
  PID:3872
- C:\Windows\System\QPrdzqJ.exe
  C:\Windows\System\QPrdzqJ.exe
  2⤵
  PID:3884
- C:\Windows\System\hMhKsrZ.exe
  C:\Windows\System\hMhKsrZ.exe
  2⤵
  PID:3612
- C:\Windows\System\nBUfSYk.exe
  C:\Windows\System\nBUfSYk.exe
  2⤵
  PID:3716
- C:\Windows\System\AEqrMcf.exe
  C:\Windows\System\AEqrMcf.exe
  2⤵
  PID:3920
- C:\Windows\System\nRvKnMt.exe
  C:\Windows\System\nRvKnMt.exe
  2⤵
  PID:3984
- C:\Windows\System\ZskGUrE.exe
  C:\Windows\System\ZskGUrE.exe
  2⤵
  PID:3964
- C:\Windows\System\TyRyfOI.exe
  C:\Windows\System\TyRyfOI.exe
  2⤵
  PID:4000
- C:\Windows\System\noWcUHw.exe
  C:\Windows\System\noWcUHw.exe
  2⤵
  PID:4052
- C:\Windows\System\SGgShOT.exe
  C:\Windows\System\SGgShOT.exe
  2⤵
  PID:2784
- C:\Windows\System\PzPoddF.exe
  C:\Windows\System\PzPoddF.exe
  2⤵
  PID:1504
- C:\Windows\System\SGAnJwx.exe
  C:\Windows\System\SGAnJwx.exe
  2⤵
  PID:2828
- C:\Windows\System\fxcQphV.exe
  C:\Windows\System\fxcQphV.exe
  2⤵
  PID:2420
- C:\Windows\System\EdACGuV.exe
  C:\Windows\System\EdACGuV.exe
  2⤵
  PID:2792
- C:\Windows\System\eyHbzzl.exe
  C:\Windows\System\eyHbzzl.exe
  2⤵
  PID:3212
- C:\Windows\System\cPurngk.exe
  C:\Windows\System\cPurngk.exe
  2⤵
  PID:3176
- C:\Windows\System\gnxoqLj.exe
  C:\Windows\System\gnxoqLj.exe
  2⤵
  PID:3364
- C:\Windows\System\fUaWNRm.exe
  C:\Windows\System\fUaWNRm.exe
  2⤵
  PID:2292
- C:\Windows\System\feIrMpp.exe
  C:\Windows\System\feIrMpp.exe
  2⤵
  PID:3180
- C:\Windows\System\rzvelqh.exe
  C:\Windows\System\rzvelqh.exe
  2⤵
  PID:3624
- C:\Windows\System\LVjnQWn.exe
  C:\Windows\System\LVjnQWn.exe
  2⤵
  PID:3320
- C:\Windows\System\RHAboQc.exe
  C:\Windows\System\RHAboQc.exe
  2⤵
  PID:3836
- C:\Windows\System\ZAYaNGx.exe
  C:\Windows\System\ZAYaNGx.exe
  2⤵
  PID:3684
- C:\Windows\System\hkszZCv.exe
  C:\Windows\System\hkszZCv.exe
  2⤵
  PID:3476
- C:\Windows\System\QyHPPVC.exe
  C:\Windows\System\QyHPPVC.exe
  2⤵
  PID:3820
- C:\Windows\System\RXMpfGb.exe
  C:\Windows\System\RXMpfGb.exe
  2⤵
  PID:3860
- C:\Windows\System\WkEzZBx.exe
  C:\Windows\System\WkEzZBx.exe
  2⤵
  PID:3652
- C:\Windows\System\EoBaYDw.exe
  C:\Windows\System\EoBaYDw.exe
  2⤵
  PID:3932
- C:\Windows\System\qbOjHxk.exe
  C:\Windows\System\qbOjHxk.exe
  2⤵
  PID:3548
- C:\Windows\System\MJcVUhr.exe
  C:\Windows\System\MJcVUhr.exe
  2⤵
  PID:3916
- C:\Windows\System\URXWLlm.exe
  C:\Windows\System\URXWLlm.exe
  2⤵
  PID:2632
- C:\Windows\System\zvJajTN.exe
  C:\Windows\System\zvJajTN.exe
  2⤵
  PID:2448
- C:\Windows\System\UFGhJdc.exe
  C:\Windows\System\UFGhJdc.exe
  2⤵
  PID:3140
- C:\Windows\System\HhyuXeU.exe
  C:\Windows\System\HhyuXeU.exe
  2⤵
  PID:3216
- C:\Windows\System\KLqBamM.exe
  C:\Windows\System\KLqBamM.exe
  2⤵
  PID:3332
- C:\Windows\System\iWVmGBs.exe
  C:\Windows\System\iWVmGBs.exe
  2⤵
  PID:3460
- C:\Windows\System\yZuAtPF.exe
  C:\Windows\System\yZuAtPF.exe
  2⤵
  PID:3200
- C:\Windows\System\FIigzaq.exe
  C:\Windows\System\FIigzaq.exe
  2⤵
  PID:3796
- C:\Windows\System\MOVBKcL.exe
  C:\Windows\System\MOVBKcL.exe
  2⤵
  PID:3980
- C:\Windows\System\AFZIPIZ.exe
  C:\Windows\System\AFZIPIZ.exe
  2⤵
  PID:3280
- C:\Windows\System\MDEpSjT.exe
  C:\Windows\System\MDEpSjT.exe
  2⤵
  PID:4072
- C:\Windows\System\FZLwyvV.exe
  C:\Windows\System\FZLwyvV.exe
  2⤵
  PID:3816
- C:\Windows\System\ueiHdti.exe
  C:\Windows\System\ueiHdti.exe
  2⤵
  PID:2696
- C:\Windows\System\cpfbsKw.exe
  C:\Windows\System\cpfbsKw.exe
  2⤵
  PID:3648
- C:\Windows\System\dbfZTHY.exe
  C:\Windows\System\dbfZTHY.exe
  2⤵
  PID:4004
- C:\Windows\System\ODQFGae.exe
  C:\Windows\System\ODQFGae.exe
  2⤵
  PID:3352
- C:\Windows\System\LmrJJQv.exe
  C:\Windows\System\LmrJJQv.exe
  2⤵
  PID:2776
- C:\Windows\System\sAyGgzM.exe
  C:\Windows\System\sAyGgzM.exe
  2⤵
  PID:3348
- C:\Windows\System\nTTQxQv.exe
  C:\Windows\System\nTTQxQv.exe
  2⤵
  PID:3464
- C:\Windows\System\OHlDvvh.exe
  C:\Windows\System\OHlDvvh.exe
  2⤵
  PID:3160
- C:\Windows\System\tZWYcpG.exe
  C:\Windows\System\tZWYcpG.exe
  2⤵
  PID:2412
- C:\Windows\System\awqVrcr.exe
  C:\Windows\System\awqVrcr.exe
  2⤵
  PID:3596
- C:\Windows\System\tJQGbzy.exe
  C:\Windows\System\tJQGbzy.exe
  2⤵
  PID:2484
- C:\Windows\System\lQTbhhi.exe
  C:\Windows\System\lQTbhhi.exe
  2⤵
  PID:3896
- C:\Windows\System\wWPAivw.exe
  C:\Windows\System\wWPAivw.exe
  2⤵
  PID:3144
- C:\Windows\System\wlqZdDI.exe
  C:\Windows\System\wlqZdDI.exe
  2⤵
  PID:3312
- C:\Windows\System\LOGqSwv.exe
  C:\Windows\System\LOGqSwv.exe
  2⤵
  PID:4100
- C:\Windows\System\SsbPFCj.exe
  C:\Windows\System\SsbPFCj.exe
  2⤵
  PID:4120
- C:\Windows\System\irCAlRo.exe
  C:\Windows\System\irCAlRo.exe
  2⤵
  PID:4136
- C:\Windows\System\nPsHmbr.exe
  C:\Windows\System\nPsHmbr.exe
  2⤵
  PID:4156
- C:\Windows\System\gzmkXfx.exe
  C:\Windows\System\gzmkXfx.exe
  2⤵
  PID:4244
- C:\Windows\System\BLpsFdO.exe
  C:\Windows\System\BLpsFdO.exe
  2⤵
  PID:4260
- C:\Windows\System\IWOYLrC.exe
  C:\Windows\System\IWOYLrC.exe
  2⤵
  PID:4276
- C:\Windows\System\dDfGDfY.exe
  C:\Windows\System\dDfGDfY.exe
  2⤵
  PID:4292
- C:\Windows\System\LtkwKGD.exe
  C:\Windows\System\LtkwKGD.exe
  2⤵
  PID:4312
- C:\Windows\System\rmXnQLp.exe
  C:\Windows\System\rmXnQLp.exe
  2⤵
  PID:4332
- C:\Windows\System\bZUaAth.exe
  C:\Windows\System\bZUaAth.exe
  2⤵
  PID:4348
- C:\Windows\System\XftVitU.exe
  C:\Windows\System\XftVitU.exe
  2⤵
  PID:4376
- C:\Windows\System\BOEyUei.exe
  C:\Windows\System\BOEyUei.exe
  2⤵
  PID:4392
- C:\Windows\System\wOnGWjG.exe
  C:\Windows\System\wOnGWjG.exe
  2⤵
  PID:4412
- C:\Windows\System\TObmpXA.exe
  C:\Windows\System\TObmpXA.exe
  2⤵
  PID:4428
- C:\Windows\System\koMsiHI.exe
  C:\Windows\System\koMsiHI.exe
  2⤵
  PID:4456
- C:\Windows\System\izVzKWh.exe
  C:\Windows\System\izVzKWh.exe
  2⤵
  PID:4472
- C:\Windows\System\lJWOAXy.exe
  C:\Windows\System\lJWOAXy.exe
  2⤵
  PID:4496
- C:\Windows\System\LkavYcS.exe
  C:\Windows\System\LkavYcS.exe
  2⤵
  PID:4516
- C:\Windows\System\oQarcGe.exe
  C:\Windows\System\oQarcGe.exe
  2⤵
  PID:4536
- C:\Windows\System\IThrbBn.exe
  C:\Windows\System\IThrbBn.exe
  2⤵
  PID:4552
- C:\Windows\System\HdrlFMN.exe
  C:\Windows\System\HdrlFMN.exe
  2⤵
  PID:4580
- C:\Windows\System\tdfnvfi.exe
  C:\Windows\System\tdfnvfi.exe
  2⤵
  PID:4600
- C:\Windows\System\DCKfHLY.exe
  C:\Windows\System\DCKfHLY.exe
  2⤵
  PID:4620
- C:\Windows\System\EPVLiOi.exe
  C:\Windows\System\EPVLiOi.exe
  2⤵
  PID:4644
- C:\Windows\System\rkExjto.exe
  C:\Windows\System\rkExjto.exe
  2⤵
  PID:4660
- C:\Windows\System\oFndyAh.exe
  C:\Windows\System\oFndyAh.exe
  2⤵
  PID:4680
- C:\Windows\System\xLaHqsE.exe
  C:\Windows\System\xLaHqsE.exe
  2⤵
  PID:4700
- C:\Windows\System\vYFoilS.exe
  C:\Windows\System\vYFoilS.exe
  2⤵
  PID:4716
- C:\Windows\System\MFczOlR.exe
  C:\Windows\System\MFczOlR.exe
  2⤵
  PID:4732
- C:\Windows\System\auuCqVh.exe
  C:\Windows\System\auuCqVh.exe
  2⤵
  PID:4752
- C:\Windows\System\YQeXrnz.exe
  C:\Windows\System\YQeXrnz.exe
  2⤵
  PID:4772
- C:\Windows\System\JbtRzVH.exe
  C:\Windows\System\JbtRzVH.exe
  2⤵
  PID:4792
- C:\Windows\System\aLuIWzV.exe
  C:\Windows\System\aLuIWzV.exe
  2⤵
  PID:4820
- C:\Windows\System\jmRUCzs.exe
  C:\Windows\System\jmRUCzs.exe
  2⤵
  PID:4836
- C:\Windows\System\OINOZGU.exe
  C:\Windows\System\OINOZGU.exe
  2⤵
  PID:4860
- C:\Windows\System\iHrlAeb.exe
  C:\Windows\System\iHrlAeb.exe
  2⤵
  PID:4888
- C:\Windows\System\uiEhXaE.exe
  C:\Windows\System\uiEhXaE.exe
  2⤵
  PID:4908
- C:\Windows\System\VEuCxKW.exe
  C:\Windows\System\VEuCxKW.exe
  2⤵
  PID:4928
- C:\Windows\System\LyrmQdc.exe
  C:\Windows\System\LyrmQdc.exe
  2⤵
  PID:4944
- C:\Windows\System\renEkif.exe
  C:\Windows\System\renEkif.exe
  2⤵
  PID:4960
- C:\Windows\System\CTsPxOr.exe
  C:\Windows\System\CTsPxOr.exe
  2⤵
  PID:4976
- C:\Windows\System\Tdeulmq.exe
  C:\Windows\System\Tdeulmq.exe
  2⤵
  PID:4996
- C:\Windows\System\MoZgQrg.exe
  C:\Windows\System\MoZgQrg.exe
  2⤵
  PID:5012
- C:\Windows\System\dfBosoe.exe
  C:\Windows\System\dfBosoe.exe
  2⤵
  PID:5044
- C:\Windows\System\FkUvfoq.exe
  C:\Windows\System\FkUvfoq.exe
  2⤵
  PID:5060
- C:\Windows\System\CqCsAqp.exe
  C:\Windows\System\CqCsAqp.exe
  2⤵
  PID:5076
- C:\Windows\System\TlJYtXH.exe
  C:\Windows\System\TlJYtXH.exe
  2⤵
  PID:5092
- C:\Windows\System\ppjASfN.exe
  C:\Windows\System\ppjASfN.exe
  2⤵
  PID:5108
- C:\Windows\System\WNTuFSp.exe
  C:\Windows\System\WNTuFSp.exe
  2⤵
  PID:3752
- C:\Windows\System\mzUCloO.exe
  C:\Windows\System\mzUCloO.exe
  2⤵
  PID:3996
- C:\Windows\System\hKjjfwI.exe
  C:\Windows\System\hKjjfwI.exe
  2⤵
  PID:3448
- C:\Windows\System\CEqPdLt.exe
  C:\Windows\System\CEqPdLt.exe
  2⤵
  PID:3392
- C:\Windows\System\KXihTJr.exe
  C:\Windows\System\KXihTJr.exe
  2⤵
  PID:3016
- C:\Windows\System\zVOeUEE.exe
  C:\Windows\System\zVOeUEE.exe
  2⤵
  PID:4132
- C:\Windows\System\LCZhpup.exe
  C:\Windows\System\LCZhpup.exe
  2⤵
  PID:1036
- C:\Windows\System\ryGuydE.exe
  C:\Windows\System\ryGuydE.exe
  2⤵
  PID:4152
- C:\Windows\System\CuyEffb.exe
  C:\Windows\System\CuyEffb.exe
  2⤵
  PID:4128
- C:\Windows\System\IhtvJJk.exe
  C:\Windows\System\IhtvJJk.exe
  2⤵
  PID:4200
- C:\Windows\System\htVvDUT.exe
  C:\Windows\System\htVvDUT.exe
  2⤵
  PID:4252
- C:\Windows\System\btOEMAX.exe
  C:\Windows\System\btOEMAX.exe
  2⤵
  PID:4300
- C:\Windows\System\nfplzFe.exe
  C:\Windows\System\nfplzFe.exe
  2⤵
  PID:4356
- C:\Windows\System\xxgYDgK.exe
  C:\Windows\System\xxgYDgK.exe
  2⤵
  PID:4364
- C:\Windows\System\xSdSzuN.exe
  C:\Windows\System\xSdSzuN.exe
  2⤵
  PID:4388
- C:\Windows\System\FkEIAlc.exe
  C:\Windows\System\FkEIAlc.exe
  2⤵
  PID:4420
- C:\Windows\System\eJxnixU.exe
  C:\Windows\System\eJxnixU.exe
  2⤵
  PID:4452
- C:\Windows\System\QACUXQz.exe
  C:\Windows\System\QACUXQz.exe
  2⤵
  PID:4488
- C:\Windows\System\teiJzZC.exe
  C:\Windows\System\teiJzZC.exe
  2⤵
  PID:4524
- C:\Windows\System\pHlyxIo.exe
  C:\Windows\System\pHlyxIo.exe
  2⤵
  PID:4544
- C:\Windows\System\UDFxfIc.exe
  C:\Windows\System\UDFxfIc.exe
  2⤵
  PID:4568
- C:\Windows\System\KYNJUlj.exe
  C:\Windows\System\KYNJUlj.exe
  2⤵
  PID:4588
- C:\Windows\System\NBlOqJL.exe
  C:\Windows\System\NBlOqJL.exe
  2⤵
  PID:4612
- C:\Windows\System\JLmqzSJ.exe
  C:\Windows\System\JLmqzSJ.exe
  2⤵
  PID:4632
- C:\Windows\System\CEwHkkv.exe
  C:\Windows\System\CEwHkkv.exe
  2⤵
  PID:4668
- C:\Windows\System\eUYJKbt.exe
  C:\Windows\System\eUYJKbt.exe
  2⤵
  PID:4696
- C:\Windows\System\fZxkWXN.exe
  C:\Windows\System\fZxkWXN.exe
  2⤵
  PID:4728
- C:\Windows\System\PhkLKBp.exe
  C:\Windows\System\PhkLKBp.exe
  2⤵
  PID:4748
- C:\Windows\System\HITzNUd.exe
  C:\Windows\System\HITzNUd.exe
  2⤵
  PID:4800
- C:\Windows\System\wryQotI.exe
  C:\Windows\System\wryQotI.exe
  2⤵
  PID:4816
- C:\Windows\System\lAJBkDf.exe
  C:\Windows\System\lAJBkDf.exe
  2⤵
  PID:4968
- C:\Windows\System\opkfQoU.exe
  C:\Windows\System\opkfQoU.exe
  2⤵
  PID:4952
- C:\Windows\System\dFuyuAg.exe
  C:\Windows\System\dFuyuAg.exe
  2⤵
  PID:5028
- C:\Windows\System\XPeWSgi.exe
  C:\Windows\System\XPeWSgi.exe
  2⤵
  PID:5088
- C:\Windows\System\MPwVELS.exe
  C:\Windows\System\MPwVELS.exe
  2⤵
  PID:5116
- C:\Windows\System\BnXFHxU.exe
  C:\Windows\System\BnXFHxU.exe
  2⤵
  PID:4108
- C:\Windows\System\kVhChMm.exe
  C:\Windows\System\kVhChMm.exe
  2⤵
  PID:4092
- C:\Windows\System\TxiJgII.exe
  C:\Windows\System\TxiJgII.exe
  2⤵
  PID:4176
- C:\Windows\System\OQQleSt.exe
  C:\Windows\System\OQQleSt.exe
  2⤵
  PID:4192
- C:\Windows\System\DstwLOm.exe
  C:\Windows\System\DstwLOm.exe
  2⤵
  PID:5032
- C:\Windows\System\fSHutNe.exe
  C:\Windows\System\fSHutNe.exe
  2⤵
  PID:5100
- C:\Windows\System\RKHKPCR.exe
  C:\Windows\System\RKHKPCR.exe
  2⤵
  PID:3516
- C:\Windows\System\OcZNNId.exe
  C:\Windows\System\OcZNNId.exe
  2⤵
  PID:4196
- C:\Windows\System\yREHWjd.exe
  C:\Windows\System\yREHWjd.exe
  2⤵
  PID:4288
- C:\Windows\System\iPvkAAJ.exe
  C:\Windows\System\iPvkAAJ.exe
  2⤵
  PID:4328
- C:\Windows\System\tPcQDZi.exe
  C:\Windows\System\tPcQDZi.exe
  2⤵
  PID:4372
- C:\Windows\System\PRqygEu.exe
  C:\Windows\System\PRqygEu.exe
  2⤵
  PID:4408
- C:\Windows\System\RNHQogu.exe
  C:\Windows\System\RNHQogu.exe
  2⤵
  PID:4504
- C:\Windows\System\sNJxeFj.exe
  C:\Windows\System\sNJxeFj.exe
  2⤵
  PID:4596
- C:\Windows\System\NWwMpGv.exe
  C:\Windows\System\NWwMpGv.exe
  2⤵
  PID:1612
- C:\Windows\System\jhkaFQO.exe
  C:\Windows\System\jhkaFQO.exe
  2⤵
  PID:4528
- C:\Windows\System\DWNeUgy.exe
  C:\Windows\System\DWNeUgy.exe
  2⤵
  PID:4688
- C:\Windows\System\Drfzfaj.exe
  C:\Windows\System\Drfzfaj.exe
  2⤵
  PID:4784
- C:\Windows\System\krBXIdn.exe
  C:\Windows\System\krBXIdn.exe
  2⤵
  PID:4832
- C:\Windows\System\zwnVFDg.exe
  C:\Windows\System\zwnVFDg.exe
  2⤵
  PID:4848
- C:\Windows\System\smzFlhY.exe
  C:\Windows\System\smzFlhY.exe
  2⤵
  PID:4876
- C:\Windows\System\mQEDOLG.exe
  C:\Windows\System\mQEDOLG.exe
  2⤵
  PID:4896
- C:\Windows\System\VyzGDuE.exe
  C:\Windows\System\VyzGDuE.exe
  2⤵
  PID:4920
- C:\Windows\System\sClwPPO.exe
  C:\Windows\System\sClwPPO.exe
  2⤵
  PID:4992
- C:\Windows\System\JEhbpAa.exe
  C:\Windows\System\JEhbpAa.exe
  2⤵
  PID:4984
- C:\Windows\System\vQtumUz.exe
  C:\Windows\System\vQtumUz.exe
  2⤵
  PID:5024
- C:\Windows\System\mtKUDTh.exe
  C:\Windows\System\mtKUDTh.exe
  2⤵
  PID:3368
- C:\Windows\System\aeqCjJw.exe
  C:\Windows\System\aeqCjJw.exe
  2⤵
  PID:5072
- C:\Windows\System\cUeprVN.exe
  C:\Windows\System\cUeprVN.exe
  2⤵
  PID:3592
- C:\Windows\System\cmHPWBN.exe
  C:\Windows\System\cmHPWBN.exe
  2⤵
  PID:4232
- C:\Windows\System\zFLhsQW.exe
  C:\Windows\System\zFLhsQW.exe
  2⤵
  PID:4404
- C:\Windows\System\diPDjcq.exe
  C:\Windows\System\diPDjcq.exe
  2⤵
  PID:4424
- C:\Windows\System\bQfVHrT.exe
  C:\Windows\System\bQfVHrT.exe
  2⤵
  PID:4780
- C:\Windows\System\YvkixGS.exe
  C:\Windows\System\YvkixGS.exe
  2⤵
  PID:4272
- C:\Windows\System\qVGRjCM.exe
  C:\Windows\System\qVGRjCM.exe
  2⤵
  PID:4852
- C:\Windows\System\jzmjJhR.exe
  C:\Windows\System\jzmjJhR.exe
  2⤵
  PID:4268
- C:\Windows\System\BBgRfNI.exe
  C:\Windows\System\BBgRfNI.exe
  2⤵
  PID:5068
- C:\Windows\System\aoQlZvw.exe
  C:\Windows\System\aoQlZvw.exe
  2⤵
  PID:4056
- C:\Windows\System\AbaVtdl.exe
  C:\Windows\System\AbaVtdl.exe
  2⤵
  PID:4636
- C:\Windows\System\sKcOAVN.exe
  C:\Windows\System\sKcOAVN.exe
  2⤵
  PID:5040
- C:\Windows\System\prKpgsc.exe
  C:\Windows\System\prKpgsc.exe
  2⤵
  PID:4448
- C:\Windows\System\McbQmYY.exe
  C:\Windows\System\McbQmYY.exe
  2⤵
  PID:4652
- C:\Windows\System\gcAAtgS.exe
  C:\Windows\System\gcAAtgS.exe
  2⤵
  PID:4172
- C:\Windows\System\nhmOHIm.exe
  C:\Windows\System\nhmOHIm.exe
  2⤵
  PID:5008
- C:\Windows\System\mVyYLNY.exe
  C:\Windows\System\mVyYLNY.exe
  2⤵
  PID:4228
- C:\Windows\System\aQJmeZT.exe
  C:\Windows\System\aQJmeZT.exe
  2⤵
  PID:5056
- C:\Windows\System\SLsXAKq.exe
  C:\Windows\System\SLsXAKq.exe
  2⤵
  PID:4656
- C:\Windows\System\htMUUeP.exe
  C:\Windows\System\htMUUeP.exe
  2⤵
  PID:4916
- C:\Windows\System\hBvOOFO.exe
  C:\Windows\System\hBvOOFO.exe
  2⤵
  PID:4740
- C:\Windows\System\uIUMBwI.exe
  C:\Windows\System\uIUMBwI.exe
  2⤵
  PID:5020
- C:\Windows\System\ernTaZu.exe
  C:\Windows\System\ernTaZu.exe
  2⤵
  PID:5128
- C:\Windows\System\emQscvW.exe
  C:\Windows\System\emQscvW.exe
  2⤵
  PID:5144
- C:\Windows\System\iOkxXgF.exe
  C:\Windows\System\iOkxXgF.exe
  2⤵
  PID:5160
- C:\Windows\System\uwaTyFC.exe
  C:\Windows\System\uwaTyFC.exe
  2⤵
  PID:5176
- C:\Windows\System\aWbDPaM.exe
  C:\Windows\System\aWbDPaM.exe
  2⤵
  PID:5192
- C:\Windows\System\wCtAvkM.exe
  C:\Windows\System\wCtAvkM.exe
  2⤵
  PID:5208
- C:\Windows\System\xrRgeHb.exe
  C:\Windows\System\xrRgeHb.exe
  2⤵
  PID:5224
- C:\Windows\System\BqisaPR.exe
  C:\Windows\System\BqisaPR.exe
  2⤵
  PID:5240
- C:\Windows\System\oQMqulb.exe
  C:\Windows\System\oQMqulb.exe
  2⤵
  PID:5260
- C:\Windows\System\WugONEm.exe
  C:\Windows\System\WugONEm.exe
  2⤵
  PID:5276
- C:\Windows\System\EgKNDHx.exe
  C:\Windows\System\EgKNDHx.exe
  2⤵
  PID:5292
- C:\Windows\System\BwfBXRy.exe
  C:\Windows\System\BwfBXRy.exe
  2⤵
  PID:5308
- C:\Windows\System\sNAhOPm.exe
  C:\Windows\System\sNAhOPm.exe
  2⤵
  PID:5324
- C:\Windows\System\PpNZgai.exe
  C:\Windows\System\PpNZgai.exe
  2⤵
  PID:5344
- C:\Windows\System\ERPmxGB.exe
  C:\Windows\System\ERPmxGB.exe
  2⤵
  PID:5360
- C:\Windows\System\QonPBKB.exe
  C:\Windows\System\QonPBKB.exe
  2⤵
  PID:5376
- C:\Windows\System\PddUyLI.exe
  C:\Windows\System\PddUyLI.exe
  2⤵
  PID:5392
- C:\Windows\System\yjrSvRx.exe
  C:\Windows\System\yjrSvRx.exe
  2⤵
  PID:5408
- C:\Windows\System\gFZNldh.exe
  C:\Windows\System\gFZNldh.exe
  2⤵
  PID:5424
- C:\Windows\System\wyIHMRf.exe
  C:\Windows\System\wyIHMRf.exe
  2⤵
  PID:5548
- C:\Windows\System\rpQNmwB.exe
  C:\Windows\System\rpQNmwB.exe
  2⤵
  PID:5564
- C:\Windows\System\OZUZgCP.exe
  C:\Windows\System\OZUZgCP.exe
  2⤵
  PID:5580
- C:\Windows\System\vYVlmev.exe
  C:\Windows\System\vYVlmev.exe
  2⤵
  PID:5600
- C:\Windows\System\mpPuACx.exe
  C:\Windows\System\mpPuACx.exe
  2⤵
  PID:5616
- C:\Windows\System\glCfdoN.exe
  C:\Windows\System\glCfdoN.exe
  2⤵
  PID:5632
- C:\Windows\System\jdwkoUR.exe
  C:\Windows\System\jdwkoUR.exe
  2⤵
  PID:5648
- C:\Windows\System\vqsFhZK.exe
  C:\Windows\System\vqsFhZK.exe
  2⤵
  PID:5668
- C:\Windows\System\fJyaiyl.exe
  C:\Windows\System\fJyaiyl.exe
  2⤵
  PID:5688
- C:\Windows\System\LcNKfpe.exe
  C:\Windows\System\LcNKfpe.exe
  2⤵
  PID:5704
- C:\Windows\System\GmIznzB.exe
  C:\Windows\System\GmIznzB.exe
  2⤵
  PID:5720
- C:\Windows\System\UzJaaRU.exe
  C:\Windows\System\UzJaaRU.exe
  2⤵
  PID:5736
- C:\Windows\System\HUeysnI.exe
  C:\Windows\System\HUeysnI.exe
  2⤵
  PID:5752
- C:\Windows\System\eprdYGP.exe
  C:\Windows\System\eprdYGP.exe
  2⤵
  PID:5768
- C:\Windows\System\VUxbQtm.exe
  C:\Windows\System\VUxbQtm.exe
  2⤵
  PID:5784
- C:\Windows\System\MPqfauL.exe
  C:\Windows\System\MPqfauL.exe
  2⤵
  PID:5800
- C:\Windows\System\KfivCAc.exe
  C:\Windows\System\KfivCAc.exe
  2⤵
  PID:5816
- C:\Windows\System\noimDOa.exe
  C:\Windows\System\noimDOa.exe
  2⤵
  PID:5832
- C:\Windows\System\TPJlqhW.exe
  C:\Windows\System\TPJlqhW.exe
  2⤵
  PID:5848
- C:\Windows\System\SHblNdz.exe
  C:\Windows\System\SHblNdz.exe
  2⤵
  PID:5864
- C:\Windows\System\QAmCfaq.exe
  C:\Windows\System\QAmCfaq.exe
  2⤵
  PID:5884
- C:\Windows\System\pditema.exe
  C:\Windows\System\pditema.exe
  2⤵
  PID:5904
- C:\Windows\System\KdZcDUo.exe
  C:\Windows\System\KdZcDUo.exe
  2⤵
  PID:5920
- C:\Windows\System\WmkbFZT.exe
  C:\Windows\System\WmkbFZT.exe
  2⤵
  PID:5940
- C:\Windows\System\LWeoitJ.exe
  C:\Windows\System\LWeoitJ.exe
  2⤵
  PID:5956
- C:\Windows\System\IOAWKXi.exe
  C:\Windows\System\IOAWKXi.exe
  2⤵
  PID:5972
- C:\Windows\System\zfqJbqK.exe
  C:\Windows\System\zfqJbqK.exe
  2⤵
  PID:5988
- C:\Windows\System\KpqSHQU.exe
  C:\Windows\System\KpqSHQU.exe
  2⤵
  PID:6008
- C:\Windows\System\mKuVANy.exe
  C:\Windows\System\mKuVANy.exe
  2⤵
  PID:6024
- C:\Windows\System\zFJgTvg.exe
  C:\Windows\System\zFJgTvg.exe
  2⤵
  PID:6040
- C:\Windows\System\zpsXkQt.exe
  C:\Windows\System\zpsXkQt.exe
  2⤵
  PID:6056
- C:\Windows\System\NgNZCvN.exe
  C:\Windows\System\NgNZCvN.exe
  2⤵
  PID:6076
- C:\Windows\System\wDjuyHh.exe
  C:\Windows\System\wDjuyHh.exe
  2⤵
  PID:6092
- C:\Windows\System\UPZqMan.exe
  C:\Windows\System\UPZqMan.exe
  2⤵
  PID:6108
- C:\Windows\System\xXmuFkw.exe
  C:\Windows\System\xXmuFkw.exe
  2⤵
  PID:6124
- C:\Windows\System\sIQxXZY.exe
  C:\Windows\System\sIQxXZY.exe
  2⤵
  PID:6140
- C:\Windows\System\ggnVOwM.exe
  C:\Windows\System\ggnVOwM.exe
  2⤵
  PID:5140
- C:\Windows\System\FIgRTZM.exe
  C:\Windows\System\FIgRTZM.exe
  2⤵
  PID:5168
- C:\Windows\System\pGhmOri.exe
  C:\Windows\System\pGhmOri.exe
  2⤵
  PID:5156
- C:\Windows\System\KjXVyfh.exe
  C:\Windows\System\KjXVyfh.exe
  2⤵
  PID:4616
- C:\Windows\System\OhnlhkH.exe
  C:\Windows\System\OhnlhkH.exe
  2⤵
  PID:5204
- C:\Windows\System\cwnNjRE.exe
  C:\Windows\System\cwnNjRE.exe
  2⤵
  PID:5268
- C:\Windows\System\EntIWIh.exe
  C:\Windows\System\EntIWIh.exe
  2⤵
  PID:5252
- C:\Windows\System\XICeuvo.exe
  C:\Windows\System\XICeuvo.exe
  2⤵
  PID:5288
- C:\Windows\System\blWjkLm.exe
  C:\Windows\System\blWjkLm.exe
  2⤵
  PID:5332
- C:\Windows\System\OOVVsne.exe
  C:\Windows\System\OOVVsne.exe
  2⤵
  PID:4940
- C:\Windows\System\nhgSZOd.exe
  C:\Windows\System\nhgSZOd.exe
  2⤵
  PID:5384
- C:\Windows\System\FxpKNYa.exe
  C:\Windows\System\FxpKNYa.exe
  2⤵
  PID:5420
- C:\Windows\System\ehOaTiQ.exe
  C:\Windows\System\ehOaTiQ.exe
  2⤵
  PID:5452
- C:\Windows\System\KNOgSss.exe
  C:\Windows\System\KNOgSss.exe
  2⤵
  PID:5464
- C:\Windows\System\FFcyknR.exe
  C:\Windows\System\FFcyknR.exe
  2⤵
  PID:5476
- C:\Windows\System\wTcQNCp.exe
  C:\Windows\System\wTcQNCp.exe
  2⤵
  PID:5540
- C:\Windows\System\RxpDKIT.exe
  C:\Windows\System\RxpDKIT.exe
  2⤵
  PID:5608
- C:\Windows\System\mOpSaXf.exe
  C:\Windows\System\mOpSaXf.exe
  2⤵
  PID:5560
- C:\Windows\System\VPEhtNI.exe
  C:\Windows\System\VPEhtNI.exe
  2⤵
  PID:5712
- C:\Windows\System\gLAbXQT.exe
  C:\Windows\System\gLAbXQT.exe
  2⤵
  PID:5700
- C:\Windows\System\utuDnnH.exe
  C:\Windows\System\utuDnnH.exe
  2⤵
  PID:5660
- C:\Windows\System\ScEOxLN.exe
  C:\Windows\System\ScEOxLN.exe
  2⤵
  PID:5780
- C:\Windows\System\RYyxNXJ.exe
  C:\Windows\System\RYyxNXJ.exe
  2⤵
  PID:5840
- C:\Windows\System\GyALfiC.exe
  C:\Windows\System\GyALfiC.exe
  2⤵
  PID:5792
- C:\Windows\System\CIVimKa.exe
  C:\Windows\System\CIVimKa.exe
  2⤵
  PID:5828
- C:\Windows\System\uBIMEhF.exe
  C:\Windows\System\uBIMEhF.exe
  2⤵
  PID:5980
- C:\Windows\System\vUwLPUY.exe
  C:\Windows\System\vUwLPUY.exe
  2⤵
  PID:5728
- C:\Windows\System\cCsAEyo.exe
  C:\Windows\System\cCsAEyo.exe
  2⤵
  PID:5968
- C:\Windows\System\GVqqbBo.exe
  C:\Windows\System\GVqqbBo.exe
  2⤵
  PID:5760
- C:\Windows\System\miPoQDk.exe
  C:\Windows\System\miPoQDk.exe
  2⤵
  PID:5856
- C:\Windows\System\MemdDTz.exe
  C:\Windows\System\MemdDTz.exe
  2⤵
  PID:5964
- C:\Windows\System\gOTDodx.exe
  C:\Windows\System\gOTDodx.exe
  2⤵
  PID:6068
- C:\Windows\System\aHBJMyL.exe
  C:\Windows\System\aHBJMyL.exe
  2⤵
  PID:6116
- C:\Windows\System\VugXsMu.exe
  C:\Windows\System\VugXsMu.exe
  2⤵
  PID:6104
- C:\Windows\System\EzUNKCL.exe
  C:\Windows\System\EzUNKCL.exe
  2⤵
  PID:6132
- C:\Windows\System\ooJuzIA.exe
  C:\Windows\System\ooJuzIA.exe
  2⤵
  PID:4480
- C:\Windows\System\qzEOwbC.exe
  C:\Windows\System\qzEOwbC.exe
  2⤵
  PID:5200
- C:\Windows\System\eMrkfPs.exe
  C:\Windows\System\eMrkfPs.exe
  2⤵
  PID:5236
- C:\Windows\System\ZqXOZpC.exe
  C:\Windows\System\ZqXOZpC.exe
  2⤵
  PID:5372
- C:\Windows\System\KmDRLbB.exe
  C:\Windows\System\KmDRLbB.exe
  2⤵
  PID:5368
- C:\Windows\System\JpwCtvq.exe
  C:\Windows\System\JpwCtvq.exe
  2⤵
  PID:5352
- C:\Windows\System\KIFwRZQ.exe
  C:\Windows\System\KIFwRZQ.exe
  2⤵
  PID:5416
- C:\Windows\System\GCpFyoR.exe
  C:\Windows\System\GCpFyoR.exe
  2⤵
  PID:1532
- C:\Windows\System\qFtCgqr.exe
  C:\Windows\System\qFtCgqr.exe
  2⤵
  PID:5500
- C:\Windows\System\bPVxgqG.exe
  C:\Windows\System\bPVxgqG.exe
  2⤵
  PID:5520
- C:\Windows\System\RRDJBjv.exe
  C:\Windows\System\RRDJBjv.exe
  2⤵
  PID:5576
- C:\Windows\System\laMrSFs.exe
  C:\Windows\System\laMrSFs.exe
  2⤵
  PID:5556
- C:\Windows\System\LgbLEum.exe
  C:\Windows\System\LgbLEum.exe
  2⤵
  PID:5844
- C:\Windows\System\owTUArj.exe
  C:\Windows\System\owTUArj.exe
  2⤵
  PID:5928
- C:\Windows\System\DUxUGEB.exe
  C:\Windows\System\DUxUGEB.exe
  2⤵
  PID:5896
- C:\Windows\System\rHqtCTB.exe
  C:\Windows\System\rHqtCTB.exe
  2⤵
  PID:5596
- C:\Windows\System\eFORjwu.exe
  C:\Windows\System\eFORjwu.exe
  2⤵
  PID:5860
- C:\Windows\System\aYWbVso.exe
  C:\Windows\System\aYWbVso.exe
  2⤵
  PID:5936
- C:\Windows\System\GkrXCvh.exe
  C:\Windows\System\GkrXCvh.exe
  2⤵
  PID:4724
- C:\Windows\System\cshcRuT.exe
  C:\Windows\System\cshcRuT.exe
  2⤵
  PID:5316
- C:\Windows\System\tEGilxo.exe
  C:\Windows\System\tEGilxo.exe
  2⤵
  PID:5460
- C:\Windows\System\FucgISf.exe
  C:\Windows\System\FucgISf.exe
  2⤵
  PID:5680
- C:\Windows\System\UZvNQqH.exe
  C:\Windows\System\UZvNQqH.exe
  2⤵
  PID:5508
- C:\Windows\System\MGknBQo.exe
  C:\Windows\System\MGknBQo.exe
  2⤵
  PID:6004
- C:\Windows\System\IbmeYjj.exe
  C:\Windows\System\IbmeYjj.exe
  2⤵
  PID:5436
- C:\Windows\System\OgtxuPO.exe
  C:\Windows\System\OgtxuPO.exe
  2⤵
  PID:4236
- C:\Windows\System\NBhPyKc.exe
  C:\Windows\System\NBhPyKc.exe
  2⤵
  PID:5640
- C:\Windows\System\cAAfvSZ.exe
  C:\Windows\System\cAAfvSZ.exe
  2⤵
  PID:5496
- C:\Windows\System\TajEMWY.exe
  C:\Windows\System\TajEMWY.exe
  2⤵
  PID:5952
- C:\Windows\System\nkYHCfR.exe
  C:\Windows\System\nkYHCfR.exe
  2⤵
  PID:5512
- C:\Windows\System\qULkuRn.exe
  C:\Windows\System\qULkuRn.exe
  2⤵
  PID:6048
- C:\Windows\System\gpBBXfy.exe
  C:\Windows\System\gpBBXfy.exe
  2⤵
  PID:6036
- C:\Windows\System\QtMHnPT.exe
  C:\Windows\System\QtMHnPT.exe
  2⤵
  PID:5776
- C:\Windows\System\AEiOiMq.exe
  C:\Windows\System\AEiOiMq.exe
  2⤵
  PID:5284
- C:\Windows\System\HHMXNoy.exe
  C:\Windows\System\HHMXNoy.exe
  2⤵
  PID:5336
- C:\Windows\System\NuKZYlZ.exe
  C:\Windows\System\NuKZYlZ.exe
  2⤵
  PID:5880
- C:\Windows\System\RaitsNx.exe
  C:\Windows\System\RaitsNx.exe
  2⤵
  PID:5232
- C:\Windows\System\fypksod.exe
  C:\Windows\System\fypksod.exe
  2⤵
  PID:5812
- C:\Windows\System\QlyhDHY.exe
  C:\Windows\System\QlyhDHY.exe
  2⤵
  PID:5572
- C:\Windows\System\iSLzAYv.exe
  C:\Windows\System\iSLzAYv.exe
  2⤵
  PID:5592
- C:\Windows\System\DJCPjHO.exe
  C:\Windows\System\DJCPjHO.exe
  2⤵
  PID:6156
- C:\Windows\System\YRsEOHC.exe
  C:\Windows\System\YRsEOHC.exe
  2⤵
  PID:6172
- C:\Windows\System\DPwgUne.exe
  C:\Windows\System\DPwgUne.exe
  2⤵
  PID:6188
- C:\Windows\System\gbbgGYb.exe
  C:\Windows\System\gbbgGYb.exe
  2⤵
  PID:6212
- C:\Windows\System\XlFOTVf.exe
  C:\Windows\System\XlFOTVf.exe
  2⤵
  PID:6228
- C:\Windows\System\UHMPAbb.exe
  C:\Windows\System\UHMPAbb.exe
  2⤵
  PID:6244
- C:\Windows\System\PEmbCYt.exe
  C:\Windows\System\PEmbCYt.exe
  2⤵
  PID:6260
- C:\Windows\System\EVpXbnC.exe
  C:\Windows\System\EVpXbnC.exe
  2⤵
  PID:6280
- C:\Windows\System\OiayrID.exe
  C:\Windows\System\OiayrID.exe
  2⤵
  PID:6304
- C:\Windows\System\zUvgFcQ.exe
  C:\Windows\System\zUvgFcQ.exe
  2⤵
  PID:6320
- C:\Windows\System\YONeybw.exe
  C:\Windows\System\YONeybw.exe
  2⤵
  PID:6336
- C:\Windows\System\pfjaeip.exe
  C:\Windows\System\pfjaeip.exe
  2⤵
  PID:6356
- C:\Windows\System\SkzqrbC.exe
  C:\Windows\System\SkzqrbC.exe
  2⤵
  PID:6372
- C:\Windows\System\HBKCwhJ.exe
  C:\Windows\System\HBKCwhJ.exe
  2⤵
  PID:6388
- C:\Windows\System\wVbNHtE.exe
  C:\Windows\System\wVbNHtE.exe
  2⤵
  PID:6412
- C:\Windows\System\QYjGqMg.exe
  C:\Windows\System\QYjGqMg.exe
  2⤵
  PID:6432
- C:\Windows\System\yLnEzJa.exe
  C:\Windows\System\yLnEzJa.exe
  2⤵
  PID:6452
- C:\Windows\System\IBzVIFd.exe
  C:\Windows\System\IBzVIFd.exe
  2⤵
  PID:6468
- C:\Windows\System\NpECFBa.exe
  C:\Windows\System\NpECFBa.exe
  2⤵
  PID:6484
- C:\Windows\System\lDsDkNx.exe
  C:\Windows\System\lDsDkNx.exe
  2⤵
  PID:6500
- C:\Windows\System\SlTjEsH.exe
  C:\Windows\System\SlTjEsH.exe
  2⤵
  PID:6516
- C:\Windows\System\LasekEX.exe
  C:\Windows\System\LasekEX.exe
  2⤵
  PID:6532
- C:\Windows\System\oEtoHDo.exe
  C:\Windows\System\oEtoHDo.exe
  2⤵
  PID:6548
- C:\Windows\System\ZDJRuTJ.exe
  C:\Windows\System\ZDJRuTJ.exe
  2⤵
  PID:6564
- C:\Windows\System\bSqVNpH.exe
  C:\Windows\System\bSqVNpH.exe
  2⤵
  PID:6580
- C:\Windows\System\tMVJgxX.exe
  C:\Windows\System\tMVJgxX.exe
  2⤵
  PID:6596
- C:\Windows\System\FCfRLGm.exe
  C:\Windows\System\FCfRLGm.exe
  2⤵
  PID:6612
- C:\Windows\System\Sfxxvgt.exe
  C:\Windows\System\Sfxxvgt.exe
  2⤵
  PID:6628
- C:\Windows\System\RHHAaAT.exe
  C:\Windows\System\RHHAaAT.exe
  2⤵
  PID:6644
- C:\Windows\System\WqjUbtC.exe
  C:\Windows\System\WqjUbtC.exe
  2⤵
  PID:6672
- C:\Windows\System\NfSpKeC.exe
  C:\Windows\System\NfSpKeC.exe
  2⤵
  PID:6688
- C:\Windows\System\lKuhGeP.exe
  C:\Windows\System\lKuhGeP.exe
  2⤵
  PID:6704
- C:\Windows\System\PqUSynZ.exe
  C:\Windows\System\PqUSynZ.exe
  2⤵
  PID:6720
- C:\Windows\System\ESRzBrz.exe
  C:\Windows\System\ESRzBrz.exe
  2⤵
  PID:6736
- C:\Windows\System\YgpabLH.exe
  C:\Windows\System\YgpabLH.exe
  2⤵
  PID:6752
- C:\Windows\System\aUXCWPf.exe
  C:\Windows\System\aUXCWPf.exe
  2⤵
  PID:6768
- C:\Windows\System\xXIHVbS.exe
  C:\Windows\System\xXIHVbS.exe
  2⤵
  PID:6784
- C:\Windows\System\CtnWqVB.exe
  C:\Windows\System\CtnWqVB.exe
  2⤵
  PID:6800
- C:\Windows\System\zwkDubq.exe
  C:\Windows\System\zwkDubq.exe
  2⤵
  PID:6816
- C:\Windows\System\gaZpfrY.exe
  C:\Windows\System\gaZpfrY.exe
  2⤵
  PID:6832
- C:\Windows\System\twARhwH.exe
  C:\Windows\System\twARhwH.exe
  2⤵
  PID:6848
- C:\Windows\System\uobGKkP.exe
  C:\Windows\System\uobGKkP.exe
  2⤵
  PID:6864
- C:\Windows\System\FhvzZPw.exe
  C:\Windows\System\FhvzZPw.exe
  2⤵
  PID:6880
- C:\Windows\System\bRgQyUO.exe
  C:\Windows\System\bRgQyUO.exe
  2⤵
  PID:6896
- C:\Windows\System\QagVnVx.exe
  C:\Windows\System\QagVnVx.exe
  2⤵
  PID:6912
- C:\Windows\System\YrxJUFT.exe
  C:\Windows\System\YrxJUFT.exe
  2⤵
  PID:6928
- C:\Windows\System\GdWDZLL.exe
  C:\Windows\System\GdWDZLL.exe
  2⤵
  PID:6944
- C:\Windows\System\ioZDBDr.exe
  C:\Windows\System\ioZDBDr.exe
  2⤵
  PID:6960
- C:\Windows\System\OSLAkFM.exe
  C:\Windows\System\OSLAkFM.exe
  2⤵
  PID:6976
- C:\Windows\System\hcofYXH.exe
  C:\Windows\System\hcofYXH.exe
  2⤵
  PID:6992
- C:\Windows\System\OpGOhjs.exe
  C:\Windows\System\OpGOhjs.exe
  2⤵
  PID:7008
- C:\Windows\System\yFqhaGP.exe
  C:\Windows\System\yFqhaGP.exe
  2⤵
  PID:7024
- C:\Windows\System\zbQesPj.exe
  C:\Windows\System\zbQesPj.exe
  2⤵
  PID:6184
- C:\Windows\System\goAaPIb.exe
  C:\Windows\System\goAaPIb.exe
  2⤵
  PID:6180
- C:\Windows\System\UEijmbY.exe
  C:\Windows\System\UEijmbY.exe
  2⤵
  PID:5996
- C:\Windows\System\nCryjCa.exe
  C:\Windows\System\nCryjCa.exe
  2⤵
  PID:6256
- C:\Windows\System\xTgKPNX.exe
  C:\Windows\System\xTgKPNX.exe
  2⤵
  PID:6300
- C:\Windows\System\iiXbOLc.exe
  C:\Windows\System\iiXbOLc.exe
  2⤵
  PID:6352
- C:\Windows\System\PMXsVPg.exe
  C:\Windows\System\PMXsVPg.exe
  2⤵
  PID:6380
- C:\Windows\System\hVOPnPi.exe
  C:\Windows\System\hVOPnPi.exe
  2⤵
  PID:6428
- C:\Windows\System\IWQeNGu.exe
  C:\Windows\System\IWQeNGu.exe
  2⤵
  PID:6292
- C:\Windows\System\FvuCgbF.exe
  C:\Windows\System\FvuCgbF.exe
  2⤵
  PID:6408
- C:\Windows\System\gMfCOuP.exe
  C:\Windows\System\gMfCOuP.exe
  2⤵
  PID:6556
- C:\Windows\System\ECKLNiJ.exe
  C:\Windows\System\ECKLNiJ.exe
  2⤵
  PID:6476
- C:\Windows\System\vMPaVrq.exe
  C:\Windows\System\vMPaVrq.exe
  2⤵
  PID:6512
- C:\Windows\System\tXIZodn.exe
  C:\Windows\System\tXIZodn.exe
  2⤵
  PID:6576
- C:\Windows\System\trvrJtV.exe
  C:\Windows\System\trvrJtV.exe
  2⤵
  PID:6636
- C:\Windows\System\exqYFsP.exe
  C:\Windows\System\exqYFsP.exe
  2⤵
  PID:6640
- C:\Windows\System\DNjcUQo.exe
  C:\Windows\System\DNjcUQo.exe
  2⤵
  PID:6712
- C:\Windows\System\yRigyFc.exe
  C:\Windows\System\yRigyFc.exe
  2⤵
  PID:6776
- C:\Windows\System\OmDRbOs.exe
  C:\Windows\System\OmDRbOs.exe
  2⤵
  PID:6844
- C:\Windows\System\TGVZcQg.exe
  C:\Windows\System\TGVZcQg.exe
  2⤵
  PID:6936
- C:\Windows\System\aVjDcxB.exe
  C:\Windows\System\aVjDcxB.exe
  2⤵
  PID:7000
- C:\Windows\System\yZqdFig.exe
  C:\Windows\System\yZqdFig.exe
  2⤵
  PID:7036
- C:\Windows\System\bCUxDvH.exe
  C:\Windows\System\bCUxDvH.exe
  2⤵
  PID:7056
- C:\Windows\System\kiXFgzD.exe
  C:\Windows\System\kiXFgzD.exe
  2⤵
  PID:7080
- C:\Windows\System\qVktJAe.exe
  C:\Windows\System\qVktJAe.exe
  2⤵
  PID:7096
- C:\Windows\System\bNvLuBF.exe
  C:\Windows\System\bNvLuBF.exe
  2⤵
  PID:7112
- C:\Windows\System\YNBEabp.exe
  C:\Windows\System\YNBEabp.exe
  2⤵
  PID:7068
- C:\Windows\System\CWHxDvm.exe
  C:\Windows\System\CWHxDvm.exe
  2⤵
  PID:6796
- C:\Windows\System\PRewPCB.exe
  C:\Windows\System\PRewPCB.exe
  2⤵
  PID:7136
- C:\Windows\System\DwZrkOV.exe
  C:\Windows\System\DwZrkOV.exe
  2⤵
  PID:7160
- C:\Windows\System\cmLjUsB.exe
  C:\Windows\System\cmLjUsB.exe
  2⤵
  PID:5536
- C:\Windows\System\oJCWdOo.exe
  C:\Windows\System\oJCWdOo.exe
  2⤵
  PID:6700
- C:\Windows\System\wnRjjXY.exe
  C:\Windows\System\wnRjjXY.exe
  2⤵
  PID:6824
- C:\Windows\System\YQinxQR.exe
  C:\Windows\System\YQinxQR.exe
  2⤵
  PID:6860
- C:\Windows\System\OiuuTsM.exe
  C:\Windows\System\OiuuTsM.exe
  2⤵
  PID:6924
- C:\Windows\System\GijUeMe.exe
  C:\Windows\System\GijUeMe.exe
  2⤵
  PID:6196
- C:\Windows\System\ZoSNYcQ.exe
  C:\Windows\System\ZoSNYcQ.exe
  2⤵
  PID:6152
- C:\Windows\System\OiOXwDP.exe
  C:\Windows\System\OiOXwDP.exe
  2⤵
  PID:6236
- C:\Windows\System\ZKwetJU.exe
  C:\Windows\System\ZKwetJU.exe
  2⤵
  PID:6420
- C:\Windows\System\BIQWfOh.exe
  C:\Windows\System\BIQWfOh.exe
  2⤵
  PID:6424
- C:\Windows\System\EGgBlmw.exe
  C:\Windows\System\EGgBlmw.exe
  2⤵
  PID:6348
- C:\Windows\System\xLkaSlz.exe
  C:\Windows\System\xLkaSlz.exe
  2⤵
  PID:6492
- C:\Windows\System\nvDmDai.exe
  C:\Windows\System\nvDmDai.exe
  2⤵
  PID:6592
- C:\Windows\System\oMUAthp.exe
  C:\Windows\System\oMUAthp.exe
  2⤵
  PID:6652
- C:\Windows\System\XHXTtrx.exe
  C:\Windows\System\XHXTtrx.exe
  2⤵
  PID:6572
- C:\Windows\System\znzvYkt.exe
  C:\Windows\System\znzvYkt.exe
  2⤵
  PID:6624
- C:\Windows\System\wltzbIv.exe
  C:\Windows\System\wltzbIv.exe
  2⤵
  PID:6904
- C:\Windows\System\NmFCXPj.exe
  C:\Windows\System\NmFCXPj.exe
  2⤵
  PID:7040
- C:\Windows\System\fYvDtYZ.exe
  C:\Windows\System\fYvDtYZ.exe
  2⤵
  PID:7104
- C:\Windows\System\HlPqkmp.exe
  C:\Windows\System\HlPqkmp.exe
  2⤵
  PID:6668
- C:\Windows\System\OgXgrss.exe
  C:\Windows\System\OgXgrss.exe
  2⤵
  PID:7152
- C:\Windows\System\mQdYbmE.exe
  C:\Windows\System\mQdYbmE.exe
  2⤵
  PID:6968
- C:\Windows\System\jztKAfZ.exe
  C:\Windows\System\jztKAfZ.exe
  2⤵
  PID:7088
- C:\Windows\System\OOCUKfp.exe
  C:\Windows\System\OOCUKfp.exe
  2⤵
  PID:6760
- C:\Windows\System\oEhyTvC.exe
  C:\Windows\System\oEhyTvC.exe
  2⤵
  PID:6984
- C:\Windows\System\heSlNAX.exe
  C:\Windows\System\heSlNAX.exe
  2⤵
  PID:7016
- C:\Windows\System\RWPrySQ.exe
  C:\Windows\System\RWPrySQ.exe
  2⤵
  PID:7020
- C:\Windows\System\xzpOkTz.exe
  C:\Windows\System\xzpOkTz.exe
  2⤵
  PID:6200
- C:\Windows\System\wxAdPKE.exe
  C:\Windows\System\wxAdPKE.exe
  2⤵
  PID:6524
- C:\Windows\System\MxUNsrC.exe
  C:\Windows\System\MxUNsrC.exe
  2⤵
  PID:6748
- C:\Windows\System\qWzksBO.exe
  C:\Windows\System\qWzksBO.exe
  2⤵
  PID:6812
- C:\Windows\System\sFBlVMr.exe
  C:\Windows\System\sFBlVMr.exe
  2⤵
  PID:6660
- C:\Windows\System\EYSdsEo.exe
  C:\Windows\System\EYSdsEo.exe
  2⤵
  PID:6276
- C:\Windows\System\vjftJvE.exe
  C:\Windows\System\vjftJvE.exe
  2⤵
  PID:6588
- C:\Windows\System\gdujWgi.exe
  C:\Windows\System\gdujWgi.exe
  2⤵
  PID:6988
- C:\Windows\System\vhUWQfs.exe
  C:\Windows\System\vhUWQfs.exe
  2⤵
  PID:7156
- C:\Windows\System\OgcQuDG.exe
  C:\Windows\System\OgcQuDG.exe
  2⤵
  PID:6972
- C:\Windows\System\LmCfGty.exe
  C:\Windows\System\LmCfGty.exe
  2⤵
  PID:6268
- C:\Windows\System\ANMXtVx.exe
  C:\Windows\System\ANMXtVx.exe
  2⤵
  PID:7124
- C:\Windows\System\ImiGJvT.exe
  C:\Windows\System\ImiGJvT.exe
  2⤵
  PID:6464
- C:\Windows\System\LcTroCt.exe
  C:\Windows\System\LcTroCt.exe
  2⤵
  PID:6920
- C:\Windows\System\MgiOuMR.exe
  C:\Windows\System\MgiOuMR.exe
  2⤵
  PID:7172
- C:\Windows\System\TdYvpoL.exe
  C:\Windows\System\TdYvpoL.exe
  2⤵
  PID:7188
- C:\Windows\System\utAAFAE.exe
  C:\Windows\System\utAAFAE.exe
  2⤵
  PID:7204
- C:\Windows\System\zrUBqKg.exe
  C:\Windows\System\zrUBqKg.exe
  2⤵
  PID:7220
- C:\Windows\System\cPYiexX.exe
  C:\Windows\System\cPYiexX.exe
  2⤵
  PID:7236
- C:\Windows\System\yfXNNiw.exe
  C:\Windows\System\yfXNNiw.exe
  2⤵
  PID:7252
- C:\Windows\System\krpRFGg.exe
  C:\Windows\System\krpRFGg.exe
  2⤵
  PID:7268
- C:\Windows\System\jBUGEgD.exe
  C:\Windows\System\jBUGEgD.exe
  2⤵
  PID:7284
- C:\Windows\System\ersctVU.exe
  C:\Windows\System\ersctVU.exe
  2⤵
  PID:7300
- C:\Windows\System\gPzqvPN.exe
  C:\Windows\System\gPzqvPN.exe
  2⤵
  PID:7316
- C:\Windows\System\CQjTUAz.exe
  C:\Windows\System\CQjTUAz.exe
  2⤵
  PID:7332
- C:\Windows\System\dkkAwmB.exe
  C:\Windows\System\dkkAwmB.exe
  2⤵
  PID:7348
- C:\Windows\System\EBWKbhh.exe
  C:\Windows\System\EBWKbhh.exe
  2⤵
  PID:7364
- C:\Windows\System\BEkIuVM.exe
  C:\Windows\System\BEkIuVM.exe
  2⤵
  PID:7380
- C:\Windows\System\gcmcgAF.exe
  C:\Windows\System\gcmcgAF.exe
  2⤵
  PID:7396
- C:\Windows\System\vAxMJzF.exe
  C:\Windows\System\vAxMJzF.exe
  2⤵
  PID:7412
- C:\Windows\System\xhrwXni.exe
  C:\Windows\System\xhrwXni.exe
  2⤵
  PID:7428
- C:\Windows\System\WkGTCBa.exe
  C:\Windows\System\WkGTCBa.exe
  2⤵
  PID:7444
- C:\Windows\System\VNrJRcy.exe
  C:\Windows\System\VNrJRcy.exe
  2⤵
  PID:7460
- C:\Windows\System\GxmrCrI.exe
  C:\Windows\System\GxmrCrI.exe
  2⤵
  PID:7476
- C:\Windows\System\wqRvnHh.exe
  C:\Windows\System\wqRvnHh.exe
  2⤵
  PID:7492
- C:\Windows\System\XukaXFm.exe
  C:\Windows\System\XukaXFm.exe
  2⤵
  PID:7508
- C:\Windows\System\bosIWmh.exe
  C:\Windows\System\bosIWmh.exe
  2⤵
  PID:7524
- C:\Windows\System\BObfiDD.exe
  C:\Windows\System\BObfiDD.exe
  2⤵
  PID:7540
- C:\Windows\System\mqbuSVN.exe
  C:\Windows\System\mqbuSVN.exe
  2⤵
  PID:7556
- C:\Windows\System\LjUWBOR.exe
  C:\Windows\System\LjUWBOR.exe
  2⤵
  PID:7572
- C:\Windows\System\DLPSrCI.exe
  C:\Windows\System\DLPSrCI.exe
  2⤵
  PID:7588
- C:\Windows\System\HwyRnjJ.exe
  C:\Windows\System\HwyRnjJ.exe
  2⤵
  PID:7604
- C:\Windows\System\pukHkls.exe
  C:\Windows\System\pukHkls.exe
  2⤵
  PID:7620
- C:\Windows\System\aGexIFr.exe
  C:\Windows\System\aGexIFr.exe
  2⤵
  PID:7636
- C:\Windows\System\DXOwmgT.exe
  C:\Windows\System\DXOwmgT.exe
  2⤵
  PID:7652
- C:\Windows\System\KlnRRUR.exe
  C:\Windows\System\KlnRRUR.exe
  2⤵
  PID:7668
- C:\Windows\System\DmiImCb.exe
  C:\Windows\System\DmiImCb.exe
  2⤵
  PID:7684
- C:\Windows\System\TbiSmUE.exe
  C:\Windows\System\TbiSmUE.exe
  2⤵
  PID:7700
- C:\Windows\System\TcmRlHu.exe
  C:\Windows\System\TcmRlHu.exe
  2⤵
  PID:7716
- C:\Windows\System\UyXxODE.exe
  C:\Windows\System\UyXxODE.exe
  2⤵
  PID:7732
- C:\Windows\System\gJBXnfq.exe
  C:\Windows\System\gJBXnfq.exe
  2⤵
  PID:7748
- C:\Windows\System\NJttAxy.exe
  C:\Windows\System\NJttAxy.exe
  2⤵
  PID:7764
- C:\Windows\System\NDvzGWt.exe
  C:\Windows\System\NDvzGWt.exe
  2⤵
  PID:7780
- C:\Windows\System\VUfHNVL.exe
  C:\Windows\System\VUfHNVL.exe
  2⤵
  PID:7796
- C:\Windows\System\KlrPddG.exe
  C:\Windows\System\KlrPddG.exe
  2⤵
  PID:7812
- C:\Windows\System\GPEhbpo.exe
  C:\Windows\System\GPEhbpo.exe
  2⤵
  PID:7828
- C:\Windows\System\bmbrLYP.exe
  C:\Windows\System\bmbrLYP.exe
  2⤵
  PID:7844
- C:\Windows\System\vohxBIE.exe
  C:\Windows\System\vohxBIE.exe
  2⤵
  PID:7860
- C:\Windows\System\QYjSWZX.exe
  C:\Windows\System\QYjSWZX.exe
  2⤵
  PID:7876
- C:\Windows\System\AnStwsB.exe
  C:\Windows\System\AnStwsB.exe
  2⤵
  PID:7892
- C:\Windows\System\rqrppnv.exe
  C:\Windows\System\rqrppnv.exe
  2⤵
  PID:7908
- C:\Windows\System\MBhAXPE.exe
  C:\Windows\System\MBhAXPE.exe
  2⤵
  PID:7924
- C:\Windows\System\qbIfILJ.exe
  C:\Windows\System\qbIfILJ.exe
  2⤵
  PID:7940
- C:\Windows\System\GjAABzw.exe
  C:\Windows\System\GjAABzw.exe
  2⤵
  PID:7956
- C:\Windows\System\VzdlFXm.exe
  C:\Windows\System\VzdlFXm.exe
  2⤵
  PID:7972
- C:\Windows\System\Qttllrv.exe
  C:\Windows\System\Qttllrv.exe
  2⤵
  PID:7988
- C:\Windows\System\PYdiFvw.exe
  C:\Windows\System\PYdiFvw.exe
  2⤵
  PID:8004
- C:\Windows\System\VRzARjJ.exe
  C:\Windows\System\VRzARjJ.exe
  2⤵
  PID:8020
- C:\Windows\System\cJDBRQS.exe
  C:\Windows\System\cJDBRQS.exe
  2⤵
  PID:8036
- C:\Windows\System\TczTdJg.exe
  C:\Windows\System\TczTdJg.exe
  2⤵
  PID:8052
- C:\Windows\System\WogtxDx.exe
  C:\Windows\System\WogtxDx.exe
  2⤵
  PID:8068
- C:\Windows\System\ZGSgfdp.exe
  C:\Windows\System\ZGSgfdp.exe
  2⤵
  PID:8088
- C:\Windows\System\aCITucK.exe
  C:\Windows\System\aCITucK.exe
  2⤵
  PID:8104
- C:\Windows\System\iYfGTpz.exe
  C:\Windows\System\iYfGTpz.exe
  2⤵
  PID:8120
- C:\Windows\System\YfEvLNo.exe
  C:\Windows\System\YfEvLNo.exe
  2⤵
  PID:8136
- C:\Windows\System\qYAwrkV.exe
  C:\Windows\System\qYAwrkV.exe
  2⤵
  PID:8152
- C:\Windows\System\MTapqvF.exe
  C:\Windows\System\MTapqvF.exe
  2⤵
  PID:8168
- C:\Windows\System\wZBuKFO.exe
  C:\Windows\System\wZBuKFO.exe
  2⤵
  PID:8184
- C:\Windows\System\WcmbfPy.exe
  C:\Windows\System\WcmbfPy.exe
  2⤵
  PID:7196
- C:\Windows\System\DFGjPaf.exe
  C:\Windows\System\DFGjPaf.exe
  2⤵
  PID:7232
- C:\Windows\System\xWNAyLw.exe
  C:\Windows\System\xWNAyLw.exe
  2⤵
  PID:7180
- C:\Windows\System\JTtsbNv.exe
  C:\Windows\System\JTtsbNv.exe
  2⤵
  PID:7076
- C:\Windows\System\oaLocAk.exe
  C:\Windows\System\oaLocAk.exe
  2⤵
  PID:6744
- C:\Windows\System\MDHigbs.exe
  C:\Windows\System\MDHigbs.exe
  2⤵
  PID:7260
- C:\Windows\System\zeDxkoR.exe
  C:\Windows\System\zeDxkoR.exe
  2⤵
  PID:7324
- C:\Windows\System\qxazuPB.exe
  C:\Windows\System\qxazuPB.exe
  2⤵
  PID:7388
- C:\Windows\System\ZqyeNsL.exe
  C:\Windows\System\ZqyeNsL.exe
  2⤵
  PID:7344
- C:\Windows\System\dggeJzi.exe
  C:\Windows\System\dggeJzi.exe
  2⤵
  PID:7248
- C:\Windows\System\xDliEmX.exe
  C:\Windows\System\xDliEmX.exe
  2⤵
  PID:7280
- C:\Windows\System\xmQQWBQ.exe
  C:\Windows\System\xmQQWBQ.exe
  2⤵
  PID:7456
- C:\Windows\System\AiUmBjW.exe
  C:\Windows\System\AiUmBjW.exe
  2⤵
  PID:7520
- C:\Windows\System\DPBXMjR.exe
  C:\Windows\System\DPBXMjR.exe
  2⤵
  PID:7580
- C:\Windows\System\ARLbWeU.exe
  C:\Windows\System\ARLbWeU.exe
  2⤵
  PID:7644
- C:\Windows\System\vUfmvLD.exe
  C:\Windows\System\vUfmvLD.exe
  2⤵
  PID:7676
- C:\Windows\System\hkjpywf.exe
  C:\Windows\System\hkjpywf.exe
  2⤵
  PID:7692
- C:\Windows\System\nFaIuGx.exe
  C:\Windows\System\nFaIuGx.exe
  2⤵
  PID:7888
- C:\Windows\System\GmfRNYm.exe
  C:\Windows\System\GmfRNYm.exe
  2⤵
  PID:8032
- C:\Windows\System\cFwEPBk.exe
  C:\Windows\System\cFwEPBk.exe
  2⤵
  PID:7788
- C:\Windows\System\QcwceTf.exe
  C:\Windows\System\QcwceTf.exe
  2⤵
  PID:8084
- C:\Windows\System\lIdiwfI.exe
  C:\Windows\System\lIdiwfI.exe
  2⤵
  PID:8132
- C:\Windows\System\LfhMPHU.exe
  C:\Windows\System\LfhMPHU.exe
  2⤵
  PID:6448
- C:\Windows\System\STdbueI.exe
  C:\Windows\System\STdbueI.exe
  2⤵
  PID:7292
- C:\Windows\System\HoMfwKw.exe
  C:\Windows\System\HoMfwKw.exe
  2⤵
  PID:8116
- C:\Windows\System\iwVAtCZ.exe
  C:\Windows\System\iwVAtCZ.exe
  2⤵
  PID:6876
- C:\Windows\System\kOVZWaB.exe
  C:\Windows\System\kOVZWaB.exe
  2⤵
  PID:7340
- C:\Windows\System\fKuKwwY.exe
  C:\Windows\System\fKuKwwY.exe
  2⤵
  PID:7516
- C:\Windows\System\YQKNtjM.exe
  C:\Windows\System\YQKNtjM.exe
  2⤵
  PID:7376
- C:\Windows\System\JJezpZX.exe
  C:\Windows\System\JJezpZX.exe
  2⤵
  PID:7308
- C:\Windows\System\cGnZCOP.exe
  C:\Windows\System\cGnZCOP.exe
  2⤵
  PID:7472
- C:\Windows\System\nVAzowO.exe
  C:\Windows\System\nVAzowO.exe
  2⤵
  PID:7504
- C:\Windows\System\kLTDzcW.exe
  C:\Windows\System\kLTDzcW.exe
  2⤵
  PID:7932
- C:\Windows\System\AHHthGQ.exe
  C:\Windows\System\AHHthGQ.exe
  2⤵
  PID:7968
- C:\Windows\System\giLCAPX.exe
  C:\Windows\System\giLCAPX.exe
  2⤵
  PID:7856
- C:\Windows\System\rtAZpPQ.exe
  C:\Windows\System\rtAZpPQ.exe
  2⤵
  PID:8000
- C:\Windows\System\QLTZXqH.exe
  C:\Windows\System\QLTZXqH.exe
  2⤵
  PID:7980
- C:\Windows\System\eeydRBw.exe
  C:\Windows\System\eeydRBw.exe
  2⤵
  PID:8028
- C:\Windows\System\dIZuXkO.exe
  C:\Windows\System\dIZuXkO.exe
  2⤵
  PID:8064
- C:\Windows\System\qhqGeGP.exe
  C:\Windows\System\qhqGeGP.exe
  2⤵
  PID:8096
- C:\Windows\System\zvFJnmC.exe
  C:\Windows\System\zvFJnmC.exe
  2⤵
  PID:7356
- C:\Windows\System\CZKfYjS.exe
  C:\Windows\System\CZKfYjS.exe
  2⤵
  PID:7244
- C:\Windows\System\JnatnJO.exe
  C:\Windows\System\JnatnJO.exe
  2⤵
  PID:7228
- C:\Windows\System\PgLcLyl.exe
  C:\Windows\System\PgLcLyl.exe
  2⤵
  PID:7564
- C:\Windows\System\IyiozFO.exe
  C:\Windows\System\IyiozFO.exe
  2⤵
  PID:8112
- C:\Windows\System\HiKsBHf.exe
  C:\Windows\System\HiKsBHf.exe
  2⤵
  PID:7488
- C:\Windows\System\Rwmhyrd.exe
  C:\Windows\System\Rwmhyrd.exe
  2⤵
  PID:7612
- C:\Windows\System\sMyxVbG.exe
  C:\Windows\System\sMyxVbG.exe
  2⤵
  PID:7660
- C:\Windows\System\KVVuDbZ.exe
  C:\Windows\System\KVVuDbZ.exe
  2⤵
  PID:7740
- C:\Windows\System\bbjtWYH.exe
  C:\Windows\System\bbjtWYH.exe
  2⤵
  PID:7804
- C:\Windows\System\boZZPgW.exe
  C:\Windows\System\boZZPgW.exe
  2⤵
  PID:7868
- C:\Windows\System\zemjsqE.exe
  C:\Windows\System\zemjsqE.exe
  2⤵
  PID:7792
- C:\Windows\System\GJvnlDW.exe
  C:\Windows\System\GJvnlDW.exe
  2⤵
  PID:8012
- C:\Windows\System\vVPGSgy.exe
  C:\Windows\System\vVPGSgy.exe
  2⤵
  PID:8180
- C:\Windows\System\UzbBnNC.exe
  C:\Windows\System\UzbBnNC.exe
  2⤵
  PID:7532
- C:\Windows\System\OrVTBmz.exe
  C:\Windows\System\OrVTBmz.exe
  2⤵
  PID:7216
- C:\Windows\System\kKVTlRV.exe
  C:\Windows\System\kKVTlRV.exe
  2⤵
  PID:8080
- C:\Windows\System\zVsPHbL.exe
  C:\Windows\System\zVsPHbL.exe
  2⤵
  PID:7948
- C:\Windows\System\uSzZJfx.exe
  C:\Windows\System\uSzZJfx.exe
  2⤵
  PID:8076
- C:\Windows\System\pwNVshg.exe
  C:\Windows\System\pwNVshg.exe
  2⤵
  PID:7616
- C:\Windows\System\FjafDkX.exe
  C:\Windows\System\FjafDkX.exe
  2⤵
  PID:7728
- C:\Windows\System\vufbZsi.exe
  C:\Windows\System\vufbZsi.exe
  2⤵
  PID:6540
- C:\Windows\System\IfUjOTW.exe
  C:\Windows\System\IfUjOTW.exe
  2⤵
  PID:7744
- C:\Windows\System\KBMQrcb.exe
  C:\Windows\System\KBMQrcb.exe
  2⤵
  PID:7900
- C:\Windows\System\qHxUvgY.exe
  C:\Windows\System\qHxUvgY.exe
  2⤵
  PID:7452
- C:\Windows\System\YUpvMwX.exe
  C:\Windows\System\YUpvMwX.exe
  2⤵
  PID:7760
- C:\Windows\System\rceGQIJ.exe
  C:\Windows\System\rceGQIJ.exe
  2⤵
  PID:7964
- C:\Windows\System\ROxsUCb.exe
  C:\Windows\System\ROxsUCb.exe
  2⤵
  PID:7808
- C:\Windows\System\AYEtWfx.exe
  C:\Windows\System\AYEtWfx.exe
  2⤵
  PID:8200
- C:\Windows\System\wPnANSG.exe
  C:\Windows\System\wPnANSG.exe
  2⤵
  PID:8216
- C:\Windows\System\XOgDGaN.exe
  C:\Windows\System\XOgDGaN.exe
  2⤵
  PID:8236
- C:\Windows\System\Zjyoqeu.exe
  C:\Windows\System\Zjyoqeu.exe
  2⤵
  PID:8256
- C:\Windows\System\bJkhpeI.exe
  C:\Windows\System\bJkhpeI.exe
  2⤵
  PID:8276
- C:\Windows\System\jSDVleS.exe
  C:\Windows\System\jSDVleS.exe
  2⤵
  PID:8292
- C:\Windows\System\jGuXIKJ.exe
  C:\Windows\System\jGuXIKJ.exe
  2⤵
  PID:8308
- C:\Windows\System\JokVUCk.exe
  C:\Windows\System\JokVUCk.exe
  2⤵
  PID:8324
- C:\Windows\System\mZgNOYS.exe
  C:\Windows\System\mZgNOYS.exe
  2⤵
  PID:8344
- C:\Windows\System\DTtzLHU.exe
  C:\Windows\System\DTtzLHU.exe
  2⤵
  PID:8360
- C:\Windows\System\osHovoM.exe
  C:\Windows\System\osHovoM.exe
  2⤵
  PID:8376
- C:\Windows\System\gqDLDIM.exe
  C:\Windows\System\gqDLDIM.exe
  2⤵
  PID:8392
- C:\Windows\System\gkOnKMi.exe
  C:\Windows\System\gkOnKMi.exe
  2⤵
  PID:8412
- C:\Windows\System\hEnUtvU.exe
  C:\Windows\System\hEnUtvU.exe
  2⤵
  PID:8428
- C:\Windows\System\eqDVZfn.exe
  C:\Windows\System\eqDVZfn.exe
  2⤵
  PID:8448
- C:\Windows\System\ICtmZFB.exe
  C:\Windows\System\ICtmZFB.exe
  2⤵
  PID:8464
- C:\Windows\System\LQlEjPB.exe
  C:\Windows\System\LQlEjPB.exe
  2⤵
  PID:8480
- C:\Windows\System\aJLWGuY.exe
  C:\Windows\System\aJLWGuY.exe
  2⤵
  PID:8496
- C:\Windows\System\cswwOQr.exe
  C:\Windows\System\cswwOQr.exe
  2⤵
  PID:8512
- C:\Windows\System\XnkxVNl.exe
  C:\Windows\System\XnkxVNl.exe
  2⤵
  PID:8528
- C:\Windows\System\COIhvtQ.exe
  C:\Windows\System\COIhvtQ.exe
  2⤵
  PID:8544
- C:\Windows\System\CUPRQRx.exe
  C:\Windows\System\CUPRQRx.exe
  2⤵
  PID:8560
- C:\Windows\System\wAKuNIL.exe
  C:\Windows\System\wAKuNIL.exe
  2⤵
  PID:8576
- C:\Windows\System\txiwyIs.exe
  C:\Windows\System\txiwyIs.exe
  2⤵
  PID:8592
- C:\Windows\System\jpdVQlp.exe
  C:\Windows\System\jpdVQlp.exe
  2⤵
  PID:8608
- C:\Windows\System\PzJfiSx.exe
  C:\Windows\System\PzJfiSx.exe
  2⤵
  PID:8624
- C:\Windows\System\inikZsG.exe
  C:\Windows\System\inikZsG.exe
  2⤵
  PID:8640
- C:\Windows\System\ZUWNGHC.exe
  C:\Windows\System\ZUWNGHC.exe
  2⤵
  PID:8656
- C:\Windows\System\DkUHAEP.exe
  C:\Windows\System\DkUHAEP.exe
  2⤵
  PID:8672
- C:\Windows\System\pgoUzZY.exe
  C:\Windows\System\pgoUzZY.exe
  2⤵
  PID:8692
- C:\Windows\System\PsjQZae.exe
  C:\Windows\System\PsjQZae.exe
  2⤵
  PID:8708
- C:\Windows\System\QRgGYhF.exe
  C:\Windows\System\QRgGYhF.exe
  2⤵
  PID:8724
- C:\Windows\System\VMuSWJU.exe
  C:\Windows\System\VMuSWJU.exe
  2⤵
  PID:8740
- C:\Windows\System\CIwBNzd.exe
  C:\Windows\System\CIwBNzd.exe
  2⤵
  PID:8756
- C:\Windows\System\NDMwWOu.exe
  C:\Windows\System\NDMwWOu.exe
  2⤵
  PID:8772
- C:\Windows\System\UsTEWji.exe
  C:\Windows\System\UsTEWji.exe
  2⤵
  PID:8788
- C:\Windows\System\dieBGFL.exe
  C:\Windows\System\dieBGFL.exe
  2⤵
  PID:8804
- C:\Windows\System\KIuQksY.exe
  C:\Windows\System\KIuQksY.exe
  2⤵
  PID:8820
- C:\Windows\System\yoxsjAf.exe
  C:\Windows\System\yoxsjAf.exe
  2⤵
  PID:8836
- C:\Windows\System\ONRESyc.exe
  C:\Windows\System\ONRESyc.exe
  2⤵
  PID:8852
- C:\Windows\System\HmDkfho.exe
  C:\Windows\System\HmDkfho.exe
  2⤵
  PID:8868
- C:\Windows\System\ACigKUa.exe
  C:\Windows\System\ACigKUa.exe
  2⤵
  PID:8884
- C:\Windows\System\YVWIiDK.exe
  C:\Windows\System\YVWIiDK.exe
  2⤵
  PID:8900
- C:\Windows\System\NRUSvoT.exe
  C:\Windows\System\NRUSvoT.exe
  2⤵
  PID:8916
- C:\Windows\System\oqKXgyH.exe
  C:\Windows\System\oqKXgyH.exe
  2⤵
  PID:8932
- C:\Windows\System\dhnIeuu.exe
  C:\Windows\System\dhnIeuu.exe
  2⤵
  PID:8948
- C:\Windows\System\kVtGGQg.exe
  C:\Windows\System\kVtGGQg.exe
  2⤵
  PID:8964
- C:\Windows\System\YmbpMPP.exe
  C:\Windows\System\YmbpMPP.exe
  2⤵
  PID:8980
- C:\Windows\System\zYTTMXr.exe
  C:\Windows\System\zYTTMXr.exe
  2⤵
  PID:8996
- C:\Windows\System\jhmdoCx.exe
  C:\Windows\System\jhmdoCx.exe
  2⤵
  PID:9012
- C:\Windows\System\CzUMQat.exe
  C:\Windows\System\CzUMQat.exe
  2⤵
  PID:9028
- C:\Windows\System\CoJfbXK.exe
  C:\Windows\System\CoJfbXK.exe
  2⤵
  PID:9044
- C:\Windows\System\lrhqOCR.exe
  C:\Windows\System\lrhqOCR.exe
  2⤵
  PID:9060
- C:\Windows\System\NOTqVYp.exe
  C:\Windows\System\NOTqVYp.exe
  2⤵
  PID:9076
- C:\Windows\System\aXFkgtn.exe
  C:\Windows\System\aXFkgtn.exe
  2⤵
  PID:9092
- C:\Windows\System\ewepKLA.exe
  C:\Windows\System\ewepKLA.exe
  2⤵
  PID:9112
- C:\Windows\System\TUjtmMZ.exe
  C:\Windows\System\TUjtmMZ.exe
  2⤵
  PID:9128
- C:\Windows\System\iQWzdTs.exe
  C:\Windows\System\iQWzdTs.exe
  2⤵
  PID:9148
- C:\Windows\System\oVccsrv.exe
  C:\Windows\System\oVccsrv.exe
  2⤵
  PID:9164
- C:\Windows\System\sLlKucH.exe
  C:\Windows\System\sLlKucH.exe
  2⤵
  PID:9188
- C:\Windows\System\UHgTpbU.exe
  C:\Windows\System\UHgTpbU.exe
  2⤵
  PID:9204
- C:\Windows\System\FYyNTLD.exe
  C:\Windows\System\FYyNTLD.exe
  2⤵
  PID:7852
- C:\Windows\System\EdGQTYs.exe
  C:\Windows\System\EdGQTYs.exe
  2⤵
  PID:8264
- C:\Windows\System\MisWWQh.exe
  C:\Windows\System\MisWWQh.exe
  2⤵
  PID:8300
- C:\Windows\System\ycuyWeN.exe
  C:\Windows\System\ycuyWeN.exe
  2⤵
  PID:8340
- C:\Windows\System\juGLKnV.exe
  C:\Windows\System\juGLKnV.exe
  2⤵
  PID:8288
- C:\Windows\System\roeNKAF.exe
  C:\Windows\System\roeNKAF.exe
  2⤵
  PID:7404
- C:\Windows\System\dvnEJtr.exe
  C:\Windows\System\dvnEJtr.exe
  2⤵
  PID:8248
- C:\Windows\System\HvxVXyS.exe
  C:\Windows\System\HvxVXyS.exe
  2⤵
  PID:8320
- C:\Windows\System\mHckUWu.exe
  C:\Windows\System\mHckUWu.exe
  2⤵
  PID:8388
- C:\Windows\System\vxWYwgZ.exe
  C:\Windows\System\vxWYwgZ.exe
  2⤵
  PID:8440
- C:\Windows\System\XaDcsdW.exe
  C:\Windows\System\XaDcsdW.exe
  2⤵
  PID:8504
- C:\Windows\System\cCWvFiK.exe
  C:\Windows\System\cCWvFiK.exe
  2⤵
  PID:8520
- C:\Windows\System\KOZoGRY.exe
  C:\Windows\System\KOZoGRY.exe
  2⤵
  PID:8568
- C:\Windows\System\oaHBaaP.exe
  C:\Windows\System\oaHBaaP.exe
  2⤵
  PID:8632
- C:\Windows\System\tmRWCsW.exe
  C:\Windows\System\tmRWCsW.exe
  2⤵
  PID:8668
- C:\Windows\System\NXFOTae.exe
  C:\Windows\System\NXFOTae.exe
  2⤵
  PID:8588
- C:\Windows\System\MtufCML.exe
  C:\Windows\System\MtufCML.exe
  2⤵
  PID:8648
- C:\Windows\System\MrqfeQZ.exe
  C:\Windows\System\MrqfeQZ.exe
  2⤵
  PID:8688
- C:\Windows\System\WjFoHEl.exe
  C:\Windows\System\WjFoHEl.exe
  2⤵
  PID:8768
- C:\Windows\System\guAvjLy.exe
  C:\Windows\System\guAvjLy.exe
  2⤵
  PID:8720
- C:\Windows\System\CLcTEMV.exe
  C:\Windows\System\CLcTEMV.exe
  2⤵
  PID:8784
- C:\Windows\System\RzMiZwq.exe
  C:\Windows\System\RzMiZwq.exe
  2⤵
  PID:8816
- C:\Windows\System\uRJTDEy.exe
  C:\Windows\System\uRJTDEy.exe
  2⤵
  PID:8844
- C:\Windows\System\EXABfqW.exe
  C:\Windows\System\EXABfqW.exe
  2⤵
  PID:8908
- C:\Windows\System\XTTSmtN.exe
  C:\Windows\System\XTTSmtN.exe
  2⤵
  PID:8956
- C:\Windows\System\zfOYktT.exe
  C:\Windows\System\zfOYktT.exe
  2⤵
  PID:9020
- C:\Windows\System\lTtSIpD.exe
  C:\Windows\System\lTtSIpD.exe
  2⤵
  PID:9088
- C:\Windows\System\wseBOjd.exe
  C:\Windows\System\wseBOjd.exe
  2⤵
  PID:9040
- C:\Windows\System\cCLDHyI.exe
  C:\Windows\System\cCLDHyI.exe
  2⤵
  PID:9004
- C:\Windows\System\VaSLnPB.exe
  C:\Windows\System\VaSLnPB.exe
  2⤵
  PID:9036
- C:\Windows\System\fFiOmym.exe
  C:\Windows\System\fFiOmym.exe
  2⤵
  PID:9124
- C:\Windows\System\BilgKii.exe
  C:\Windows\System\BilgKii.exe
  2⤵
  PID:9140
- C:\Windows\System\GYMqonw.exe
  C:\Windows\System\GYMqonw.exe
  2⤵
  PID:9200
- C:\Windows\System\lVXuCSy.exe
  C:\Windows\System\lVXuCSy.exe
  2⤵
  PID:8444
- C:\Windows\System\VZPAslr.exe
  C:\Windows\System\VZPAslr.exe
  2⤵
  PID:9184
- C:\Windows\System\PzHGPIE.exe
  C:\Windows\System\PzHGPIE.exe
  2⤵
  PID:7872
- C:\Windows\System\MOxbjPr.exe
  C:\Windows\System\MOxbjPr.exe
  2⤵
  PID:8372
- C:\Windows\System\JpFWkHx.exe
  C:\Windows\System\JpFWkHx.exe
  2⤵
  PID:8420
- C:\Windows\System\upFGYIV.exe
  C:\Windows\System\upFGYIV.exe
  2⤵
  PID:8508
- C:\Windows\System\DxbCWFK.exe
  C:\Windows\System\DxbCWFK.exe
  2⤵
  PID:8556
- C:\Windows\System\nugIKCC.exe
  C:\Windows\System\nugIKCC.exe
  2⤵
  PID:8796
- C:\Windows\System\BVXEEFB.exe
  C:\Windows\System\BVXEEFB.exe
  2⤵
  PID:8488
- C:\Windows\System\LRCpufp.exe
  C:\Windows\System\LRCpufp.exe
  2⤵
  PID:8524
- C:\Windows\System\spSQWhe.exe
  C:\Windows\System\spSQWhe.exe
  2⤵
  PID:8736
- C:\Windows\System\VBGuAvD.exe
  C:\Windows\System\VBGuAvD.exe
  2⤵
  PID:8876
- C:\Windows\System\zUPfkDf.exe
  C:\Windows\System\zUPfkDf.exe
  2⤵
  PID:8800
- C:\Windows\System\zBVZXsY.exe
  C:\Windows\System\zBVZXsY.exe
  2⤵
  PID:8864
- C:\Windows\System\YcbkFDK.exe
  C:\Windows\System\YcbkFDK.exe
  2⤵
  PID:8928
- C:\Windows\System\kyxbgLI.exe
  C:\Windows\System\kyxbgLI.exe
  2⤵
  PID:9084
- C:\Windows\System\flgUxmj.exe
  C:\Windows\System\flgUxmj.exe
  2⤵
  PID:8404
- C:\Windows\System\sTvAEPf.exe
  C:\Windows\System\sTvAEPf.exe
  2⤵
  PID:9212
- C:\Windows\System\DShFJrl.exe
  C:\Windows\System\DShFJrl.exe
  2⤵
  PID:8252
- C:\Windows\System\SBBZfvd.exe
  C:\Windows\System\SBBZfvd.exe
  2⤵
  PID:8604
- C:\Windows\System\TRAuMLj.exe
  C:\Windows\System\TRAuMLj.exe
  2⤵
  PID:8680
- C:\Windows\System\GfTTlkl.exe
  C:\Windows\System\GfTTlkl.exe
  2⤵
  PID:8460
- C:\Windows\System\cJZeQQA.exe
  C:\Windows\System\cJZeQQA.exe
  2⤵
  PID:996
- C:\Windows\System\YFsgOKm.exe
  C:\Windows\System\YFsgOKm.exe
  2⤵
  PID:8332
- C:\Windows\System\kIMpUIx.exe
  C:\Windows\System\kIMpUIx.exe
  2⤵
  PID:9196
- C:\Windows\System\GtvTpEV.exe
  C:\Windows\System\GtvTpEV.exe
  2⤵
  PID:9008
- C:\Windows\System\iIFevob.exe
  C:\Windows\System\iIFevob.exe
  2⤵
  PID:9056
- C:\Windows\System\UTpAVrZ.exe
  C:\Windows\System\UTpAVrZ.exe
  2⤵
  PID:9160
- C:\Windows\System\FVlQZLE.exe
  C:\Windows\System\FVlQZLE.exe
  2⤵
  PID:8244
- C:\Windows\System\bDImjfb.exe
  C:\Windows\System\bDImjfb.exe
  2⤵
  PID:8976
- C:\Windows\System\marrvJx.exe
  C:\Windows\System\marrvJx.exe
  2⤵
  PID:8716
- C:\Windows\System\HLwXhhe.exe
  C:\Windows\System\HLwXhhe.exe
  2⤵
  PID:8752
- C:\Windows\System\DLSfCJR.exe
  C:\Windows\System\DLSfCJR.exe
  2⤵
  PID:9228
- C:\Windows\System\uVMQAtI.exe
  C:\Windows\System\uVMQAtI.exe
  2⤵
  PID:9248
- C:\Windows\System\QeCRlVx.exe
  C:\Windows\System\QeCRlVx.exe
  2⤵
  PID:9268
- C:\Windows\System\hWNAwSK.exe
  C:\Windows\System\hWNAwSK.exe
  2⤵
  PID:9284
- C:\Windows\System\sZxCKCw.exe
  C:\Windows\System\sZxCKCw.exe
  2⤵
  PID:9300
- C:\Windows\System\yKfrDpH.exe
  C:\Windows\System\yKfrDpH.exe
  2⤵
  PID:9316
- C:\Windows\System\SStSQMG.exe
  C:\Windows\System\SStSQMG.exe
  2⤵
  PID:9336
- C:\Windows\System\NyGZatV.exe
  C:\Windows\System\NyGZatV.exe
  2⤵
  PID:9352
- C:\Windows\System\qQbfdcW.exe
  C:\Windows\System\qQbfdcW.exe
  2⤵
  PID:9368
- C:\Windows\System\XpKnQGB.exe
  C:\Windows\System\XpKnQGB.exe
  2⤵
  PID:9384
- C:\Windows\System\DSBcrYe.exe
  C:\Windows\System\DSBcrYe.exe
  2⤵
  PID:9404
- C:\Windows\System\kaceSxV.exe
  C:\Windows\System\kaceSxV.exe
  2⤵
  PID:9420
- C:\Windows\System\WSiZYwy.exe
  C:\Windows\System\WSiZYwy.exe
  2⤵
  PID:9436
- C:\Windows\System\fNYyTha.exe
  C:\Windows\System\fNYyTha.exe
  2⤵
  PID:9456
- C:\Windows\System\RjMGcFY.exe
  C:\Windows\System\RjMGcFY.exe
  2⤵
  PID:9472
- C:\Windows\System\HoPZRGB.exe
  C:\Windows\System\HoPZRGB.exe
  2⤵
  PID:9488
- C:\Windows\System\VkVNvza.exe
  C:\Windows\System\VkVNvza.exe
  2⤵
  PID:9504
- C:\Windows\System\cLZEJkm.exe
  C:\Windows\System\cLZEJkm.exe
  2⤵
  PID:9520
- C:\Windows\System\tSZhRLn.exe
  C:\Windows\System\tSZhRLn.exe
  2⤵
  PID:9536
- C:\Windows\System\YRpGHkZ.exe
  C:\Windows\System\YRpGHkZ.exe
  2⤵
  PID:9552
- C:\Windows\System\UkSEWaA.exe
  C:\Windows\System\UkSEWaA.exe
  2⤵
  PID:9568
- C:\Windows\System\UFLvAjP.exe
  C:\Windows\System\UFLvAjP.exe
  2⤵
  PID:9584
- C:\Windows\System\EFUZjOl.exe
  C:\Windows\System\EFUZjOl.exe
  2⤵
  PID:9604
- C:\Windows\System\dbZhGoJ.exe
  C:\Windows\System\dbZhGoJ.exe
  2⤵
  PID:9620
- C:\Windows\System\NvmTdjZ.exe
  C:\Windows\System\NvmTdjZ.exe
  2⤵
  PID:9636
- C:\Windows\System\NuUWPAj.exe
  C:\Windows\System\NuUWPAj.exe
  2⤵
  PID:9652
- C:\Windows\System\xtloulQ.exe
  C:\Windows\System\xtloulQ.exe
  2⤵
  PID:9672
- C:\Windows\System\zwuQBza.exe
  C:\Windows\System\zwuQBza.exe
  2⤵
  PID:9688
- C:\Windows\System\dLgUPJg.exe
  C:\Windows\System\dLgUPJg.exe
  2⤵
  PID:9704
- C:\Windows\System\zMISdmm.exe
  C:\Windows\System\zMISdmm.exe
  2⤵
  PID:9720
- C:\Windows\System\iARvQfS.exe
  C:\Windows\System\iARvQfS.exe
  2⤵
  PID:9736
- C:\Windows\System\hCZXPBH.exe
  C:\Windows\System\hCZXPBH.exe
  2⤵
  PID:9752
- C:\Windows\System\RXvOvVL.exe
  C:\Windows\System\RXvOvVL.exe
  2⤵
  PID:9768
- C:\Windows\System\zgybpvQ.exe
  C:\Windows\System\zgybpvQ.exe
  2⤵
  PID:9788
- C:\Windows\System\VIKlHUY.exe
  C:\Windows\System\VIKlHUY.exe
  2⤵
  PID:9804
- C:\Windows\System\lkxahVS.exe
  C:\Windows\System\lkxahVS.exe
  2⤵
  PID:9820
- C:\Windows\System\XxPOgCt.exe
  C:\Windows\System\XxPOgCt.exe
  2⤵
  PID:9836
- C:\Windows\System\NZdGJmD.exe
  C:\Windows\System\NZdGJmD.exe
  2⤵
  PID:9852
- C:\Windows\System\LgMDKoD.exe
  C:\Windows\System\LgMDKoD.exe
  2⤵
  PID:9868
- C:\Windows\System\ZivLXAT.exe
  C:\Windows\System\ZivLXAT.exe
  2⤵
  PID:9884
- C:\Windows\System\oOVFRkq.exe
  C:\Windows\System\oOVFRkq.exe
  2⤵
  PID:9900
- C:\Windows\System\LCLHGMn.exe
  C:\Windows\System\LCLHGMn.exe
  2⤵
  PID:9916
- C:\Windows\System\pViHvBb.exe
  C:\Windows\System\pViHvBb.exe
  2⤵
  PID:9932
- C:\Windows\System\QhdZiAK.exe
  C:\Windows\System\QhdZiAK.exe
  2⤵
  PID:9948
- C:\Windows\System\OMvotcD.exe
  C:\Windows\System\OMvotcD.exe
  2⤵
  PID:9968
- C:\Windows\System\BafABlZ.exe
  C:\Windows\System\BafABlZ.exe
  2⤵
  PID:9984
- C:\Windows\System\fSbTuSK.exe
  C:\Windows\System\fSbTuSK.exe
  2⤵
  PID:10000
- C:\Windows\System\jAZdBVS.exe
  C:\Windows\System\jAZdBVS.exe
  2⤵
  PID:10016
- C:\Windows\System\amvfRXs.exe
  C:\Windows\System\amvfRXs.exe
  2⤵
  PID:10032
- C:\Windows\System\aMTxRAd.exe
  C:\Windows\System\aMTxRAd.exe
  2⤵
  PID:10048
- C:\Windows\System\xdMbtnx.exe
  C:\Windows\System\xdMbtnx.exe
  2⤵
  PID:10064
- C:\Windows\System\odniWOL.exe
  C:\Windows\System\odniWOL.exe
  2⤵
  PID:10080
- C:\Windows\System\KVQHqwB.exe
  C:\Windows\System\KVQHqwB.exe
  2⤵
  PID:10096
- C:\Windows\System\QkCVUyT.exe
  C:\Windows\System\QkCVUyT.exe
  2⤵
  PID:10112
- C:\Windows\System\ijsrKYw.exe
  C:\Windows\System\ijsrKYw.exe
  2⤵
  PID:10128
- C:\Windows\System\cXepesc.exe
  C:\Windows\System\cXepesc.exe
  2⤵
  PID:10144
- C:\Windows\System\dyyfZCu.exe
  C:\Windows\System\dyyfZCu.exe
  2⤵
  PID:10160
- C:\Windows\System\BNQBQno.exe
  C:\Windows\System\BNQBQno.exe
  2⤵
  PID:10180
- C:\Windows\System\xecrnYJ.exe
  C:\Windows\System\xecrnYJ.exe
  2⤵
  PID:10196
- C:\Windows\System\xaPlZWv.exe
  C:\Windows\System\xaPlZWv.exe
  2⤵
  PID:10212
- C:\Windows\System\jMzTRcQ.exe
  C:\Windows\System\jMzTRcQ.exe
  2⤵
  PID:10228
- C:\Windows\System\mNgZAjm.exe
  C:\Windows\System\mNgZAjm.exe
  2⤵
  PID:9224
- C:\Windows\System\WihEiUh.exe
  C:\Windows\System\WihEiUh.exe
  2⤵
  PID:9108
- C:\Windows\System\ukMzmwV.exe
  C:\Windows\System\ukMzmwV.exe
  2⤵
  PID:8992
- C:\Windows\System\RhGoWdY.exe
  C:\Windows\System\RhGoWdY.exe
  2⤵
  PID:9328
- C:\Windows\System\mFWcrNG.exe
  C:\Windows\System\mFWcrNG.exe
  2⤵
  PID:9364
- C:\Windows\System\aGQsGQB.exe
  C:\Windows\System\aGQsGQB.exe
  2⤵
  PID:9312
- C:\Windows\System\tCXFWYw.exe
  C:\Windows\System\tCXFWYw.exe
  2⤵
  PID:9344
- C:\Windows\System\pAuenwP.exe
  C:\Windows\System\pAuenwP.exe
  2⤵
  PID:9428
- C:\Windows\System\LWANfQr.exe
  C:\Windows\System\LWANfQr.exe
  2⤵
  PID:9496
- C:\Windows\System\jJitPfw.exe
  C:\Windows\System\jJitPfw.exe
  2⤵
  PID:9452
- C:\Windows\System\NGyKipE.exe
  C:\Windows\System\NGyKipE.exe
  2⤵
  PID:9532
- C:\Windows\System\fzeLLGB.exe
  C:\Windows\System\fzeLLGB.exe
  2⤵
  PID:9592
- C:\Windows\System\PoIwsVO.exe
  C:\Windows\System\PoIwsVO.exe
  2⤵
  PID:9512
- C:\Windows\System\SfDADCu.exe
  C:\Windows\System\SfDADCu.exe
  2⤵
  PID:9660
- C:\Windows\System\ImMFrEN.exe
  C:\Windows\System\ImMFrEN.exe
  2⤵
  PID:9612
- C:\Windows\System\UTuQEXY.exe
  C:\Windows\System\UTuQEXY.exe
  2⤵
  PID:9680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BQCFhpZ.exe

Filesize
2.2MB

MD5
4edeb5279b5d9f3b17254147daa39eb5

SHA1
befa3dfcef4fe235b043ee69ecd138ac1420ab62

SHA256
79ee8cbc153dd6c5119582a1fe2f7f5de28e84f6beed94696ac05d789f42d3de

SHA512
bb3d2de02602cec32ac4f820f0182fd90b29d602723b797def8a7d104204a41c819427a65c3987b82aee9ef6e73da2af9b40b4c26d67fb550d781cf693885367

Download Submit
C:\Windows\system\BvhHOAO.exe

Filesize
2.2MB

MD5
22dae8947a05f12d483df1c2556dfa94

SHA1
ea80079b806fcfa87a74ab8966231bd5768cd654

SHA256
0630d30841955238b5a47df4566ec168c881035f59cad4e04e0a32ffd9603adb

SHA512
4b3e828a61864e91c1e99620eb9161580fdc420fc71e324ed1d5028e5b44cd85345b84e5d9f42c968275274bae2d5c1791657f6d223decc95d76415a930f3692

Download Submit
C:\Windows\system\HGXvtYn.exe

Filesize
2.2MB

MD5
3e069be59883052876ab6ec71f8f4a22

SHA1
9ff077fd557845072c6f787f49a055af454c5f56

SHA256
bb6b8271b9924c08776882e30e7f79510afa75df810f5264399bab234c4eaa97

SHA512
966400a8ceabccf58f5499e218c3988c321c0cc4efe81fd0db6a4d5729288be579fbbb3399bc8bd2420698e80896ce47497788c8b11cf4863c6661a207f27c28

Download Submit
C:\Windows\system\IkErxkS.exe

Filesize
2.2MB

MD5
5c451130f7b18908d1e0c5b6dc800f5f

SHA1
a8b445ab4b4e7e574d0c9af00985868d4dce776a

SHA256
87d407250e6898f8ddbe583b5011dddf1b3fc78f894d1ff0e06c180e177ca33c

SHA512
9eea21081a0b94ab34b8803548242a7c98ec672ae2785fc019a6fcdd35edf83335364373374e38dcb257b9ff58205ee691d4018fba32ad12749351dcde7ac7c7

Download Submit
C:\Windows\system\IpBMMaJ.exe

Filesize
2.2MB

MD5
9f2ce214ec17b57f3185f5eed3584818

SHA1
1a9478857e7f98262c65aebb89ec3580d79d9090

SHA256
879ef7bdbc2aa9decdc5937c79580b363aab35e8500d90c920869d7e9b39f14a

SHA512
3dc9f33fcc243efe2978d51e3f4204241f487326c9c1e42ec25cacbd55f05460a355537529107948fe1f1ccaa17f0bb0b1fc1b2091557e55a9e6b394de518f8f

Download Submit
C:\Windows\system\LuTlJyM.exe

Filesize
2.2MB

MD5
7c70a0a403db11bb50159b1efcd552a1

SHA1
b6bd7d428d7e93c7c26e9782740f593e4a99c7d8

SHA256
d13ec8b70fc29ae7aa86444b815cd9d96d726e93a753ddf5fca3f274c047b546

SHA512
6664ec8aa9d0c16173c62596dcfbc8926d2c3f399aa01a3b07506a643d5ae1c35cae309e9371d8897937b6f6575148651e443e2468c23f5891f4892b2573e9ab

Download Submit
C:\Windows\system\NqvvZJZ.exe

Filesize
2.2MB

MD5
a906604986f9a909103398a7f56e80be

SHA1
31807da5f924967abd6d8b71878f2850cabf0e4e

SHA256
5e01792f4c57967cd711fd8df526ccc794bd7f2947e6a51778558cee8457f886

SHA512
eaa089cc3262e1744abc1e12d71ef7b858cef1e9d40b2ee7d41460af26c08db8fe31915fd16ce268ad1978e1b29d9678797b46c5de27451376def10933b1aca2

Download Submit
C:\Windows\system\RqfwJrB.exe

Filesize
2.2MB

MD5
c633129fef4412688bf25cf07c229335

SHA1
91c848f75640a32ba2e8f8da7e83afa68894f8da

SHA256
b026af908101ba2d0205a07ccbb754fd06a1a387c5b82e88708189b3e7565237

SHA512
4f5552bfd442c7289c7d3ca8aa9fcffb168a8c88b325a79ef17a9dcf05f9b2b8f2ecb444d92fc7a5bf8d9bdd1d5007b544ff6ebf1c221b9c30d640d2fc0de222

Download Submit
C:\Windows\system\VRbLvXS.exe

Filesize
2.2MB

MD5
d6543d4f22bbcd0797bc2bd211bb76e4

SHA1
da5706518a7c5e7531cbfaa8deccd397a781cf15

SHA256
c67bf54765fe85dd971652cfd54b8e2b2e8fd725b0642623807b6d7d42513e72

SHA512
b8fe844db50e328804427fe37ba77ca3e15015a3384eff85a2f64695866ee504b0990a5c8b1dd6af01a726c9f48a9c1810e0be5b899cf2bf6d67637fdbd70556

Download Submit
C:\Windows\system\VUqlhEA.exe

Filesize
2.2MB

MD5
adf54d8e752f01dd0d2f014de9cfb7b3

SHA1
30dad9060347e5c36075d0fa3222e98a70a361f6

SHA256
73e7be9657c9e610daba692e38ab05d25686a255780398c60b90847a287fae40

SHA512
3c3fcada5a6f54c6b3b4aeeaa94378794fb1d3340d68940e4ee856fd5c78a71881e79d6c7ecf930a5bb778b5b6489284945598b825febfd10e0f3c7977d3603e

Download Submit
C:\Windows\system\XYlXlTe.exe

Filesize
2.2MB

MD5
cf9c76a03266b4155ce1f0ab5246c6ee

SHA1
72225bbac2f8bc1e0e42a1ca178ad92c4467373b

SHA256
904357957b0e955282eed91eb09998132ab650f63448711a3832e9e5b7de7a31

SHA512
004b37ac2beaf8c14a3a767066f0e7c59f4cd854cd775f4cdf09b3af77128ce8a34373a8534704c1301775f1e6239fbb301e80163e566f7e8ec4fa5c932891ff

Download Submit
C:\Windows\system\XoimUlF.exe

Filesize
2.2MB

MD5
cb15ab0f8f23fbd6ce3b82c8ffb34cb6

SHA1
100e5df03de53cf27dcf9e76ad81e7c9161eccb6

SHA256
1fc916a605e474045230d2f0a6b13774de494f46fbed41e89e511b833942d79c

SHA512
90b0803b3fce69087e3eae0e23afe8caad62997bd9f7f88265e8f69a96330af7a038292ecf0d063826bd36415b6720eec5c3cd5822354fc7abe05b588f792007

Download Submit
C:\Windows\system\YjQAyYl.exe

Filesize
2.2MB

MD5
34ff20f86375743113ea212e92e3ccff

SHA1
0ec91d57519d76e49265cba639675597c7a664b8

SHA256
f4c6f31ae7ddb0c2b13da135e4d4c22ac8f400f3b5993c5d3c2366977a1c1a27

SHA512
f1126ee383a64dcf33f0a75b2f1eac60899df472a3d7fde74e940c97fb8de5005fda292300e242cc5f8567c8fc974057d50ebb2d7395ccd3a1623f856404b601

Download Submit
C:\Windows\system\aXTfdOw.exe

Filesize
2.2MB

MD5
936f13f6b15bfe6124e6153a8fc634e4

SHA1
a29852a0bd5d5523f50d266e455e2dd46ae41f34

SHA256
6e9f1518fcf445f6ce40c495d25ffcbb7203093d0c2cf6974271048029bb7caf

SHA512
3cca58f54285c91bfecbdd7524db40bf40e8e88427eef51595322f5926d1d0b87e65a7f5b467c2babc9564c89ab1e286fac45f163e5919ab6108333265a78baa

Download Submit
C:\Windows\system\biBGcku.exe

Filesize
2.2MB

MD5
a83d32483ebf001903fddb0229c59113

SHA1
a7269f7874b683b98793901d69475bad38b2d1ea

SHA256
e96b4d038451a6c02fdff3b18a570f5aae6afc7e1ffdb7bd2ad8a0c204e44049

SHA512
a826e81d2532351464611cb7399e3f7ea4592cca0a8c64f38417b491b41c6fc5ebc4df742db5a831138849a717f5cefa51bcf0bf2c0bd1877f5b782c8a652148

Download Submit
C:\Windows\system\eqHreZJ.exe

Filesize
2.2MB

MD5
7cf691dfb04612045b8344047e93a15e

SHA1
3e9250b46e8a4f8bb941b82d5041d491ae6c64e8

SHA256
df98bcbbc81e48492d25fa58a485ce949dc2e7adb6e685726bcfb7a02842abf7

SHA512
cbc80b6cb73955320b57f69085f98cca8182d449721924625a463070af77ac967cbdafaf10ded47f51651c925ed3e3ad30d078c4f957b167f34926b4fc3d5933

Download Submit
C:\Windows\system\fwLQBXh.exe

Filesize
2.2MB

MD5
88a57156efd0f65ef101722e7b0df83b

SHA1
398065e30ff86875d2f2c7d461b7fb01abd994ca

SHA256
34942961b11d32bc950edd6d7c33a4f488b9997205b08e08b2b4b24af0048fc6

SHA512
fc17e9c4dcfff8124781b25fbd40029e906e509c317864f92bbbe1d1e1d2013ac8188f438d59bb96244e609827b4721928772a0a378b9cf5175815431a079f8c

Download Submit
C:\Windows\system\gwEVTTW.exe

Filesize
2.2MB

MD5
6119980027894cb5fddad5363306f2ae

SHA1
a2049af67345bae6878b986d8ce77f173062adec

SHA256
e55f41347a8d70e0e3b577feb35dbcedecdc37d398ea2bd54ecd4ca6bd4fad9d

SHA512
92ab9b4a179ac1c6e24a8935ffe271b33fd54228186e3debfc650d2f21c2f6e6a07f33d72e25e3b77109300c52047414c7929a97515c47ccca9538836e72e865

Download Submit
C:\Windows\system\hSeWySj.exe

Filesize
2.2MB

MD5
bfe881f8ea24bd34b1d77b9f6e4a4c2d

SHA1
12df72c1a7804c25f884d9bae49321cd0916a15f

SHA256
07eedf3dbad31b7c611e3417af098624bf9c327f0b200f13a73b414b9d45f0b3

SHA512
0aa6342bb45b1cebe8dcbdff4f23f725338b248ef81f76a5b415574e29091b69e14ae953845053313edbc0bcc49aa877c86013b0d78100a1e513eda2634055da

Download Submit
C:\Windows\system\hmHUAtM.exe

Filesize
2.2MB

MD5
ee3eefb5ac6938fa9e5c346cab829fcb

SHA1
645036d37f28f3b1f58579cda8985885c2ae9de7

SHA256
ea8e46a31edd7349f39ca6f297b8346bbc16c37cebcf0749ef6c3eb7a124d52b

SHA512
0b701fe2f46b42c067638ab2ca7605cf71cf9f63a4ece826099e480921c2e30e98944577d639e8f9a81631bf8427cc07fc884400c56c886322c8d6886fce7c68

Download Submit
C:\Windows\system\jZXOpmf.exe

Filesize
2.2MB

MD5
2dbe6c090d3399e8ed90218e0de0b982

SHA1
f9a9dd58664c34d5e4af4c2b1160a6b95d9d7f17

SHA256
b636cf04a4a68b304055e0639fb7d1b7607845a9034d95e224e6cf803ce571ae

SHA512
3396248fad2548006c04cf92cb4322acb505d9320f9b395f2b0877636354391afeb746e66afd692987b445f63ae8fb03f247b441ef1701e6e7de33fd61c2faaf

Download Submit
C:\Windows\system\kTJKsKb.exe

Filesize
2.2MB

MD5
333f8d4eb342a59f102caf3ed0d96276

SHA1
a615790eb2efc31b48313632be5343700d0396b6

SHA256
cc5a6a530e625791bf15edc70ed9e49a35cb97a5b44592aff007f5f4a6b67f51

SHA512
3bcc5d0738e65d8f1a347174b30cd2c3b39375c000fe1736e5a497b7c91f3cdb6b7bceb632bb9d5acc0e32aacc5d33913633c5cbccad4ed23049e30238330187

Download Submit
C:\Windows\system\mBHVRcr.exe

Filesize
2.2MB

MD5
4519359047ad4caf135b074a983c83ea

SHA1
5d671aeedf4e5766882e39495726d396f37389f1

SHA256
68dca4340a3bae53a54af79089956c2baf1c6a4330533b756676c74f4ce98642

SHA512
b5c6d5d03c52bd6e9a10f5d0c8f5a5fe7f96735b238de738a660fab2e61f7b3457b76abfba575b302d292058974cb324d95fe9cbb7554a8fec65cf1f93d516cb

Download Submit
C:\Windows\system\mhrCFAt.exe

Filesize
2.2MB

MD5
34f9e54f8ab836041122a4a814b1909b

SHA1
b7589b2fa959bbeebfa3c308a2fd57ae036a5b93

SHA256
b1c5ac8cd83b141d881663e808b5081efaca920489504faf48a53edd44c02e8f

SHA512
8ef50f29b78b0a03c10c3d0df57cb591c52beb1a6ea8b74ef639713f9be4c4cb123421bc76ab87ddcc07ff7b4ff2c3183eaa2a20e8c6d1e708b849b48ef4a4b0

Download Submit
C:\Windows\system\ocGHnsl.exe

Filesize
2.2MB

MD5
716152d88896a13b05cdc74ab5dbbbb4

SHA1
8ef784fe58710d43993874eb2068af4690b139c1

SHA256
bec3d6453413f2e59b236ed62afdb82309f3af8ace0be2d117735b7cc45aeafc

SHA512
418a30b01abcfa13492f7bb475f93673abb44dd67b4f1bad004cb16b475bb8db3aa2000b865f52e2d44cebb5b062e230478162e1bc9a92e48e2d305d93963845

Download Submit
C:\Windows\system\qBAtFNa.exe

Filesize
2.2MB

MD5
3ac1b221bd87e3b65cb60d45838a8151

SHA1
d0460cd12443742fb33551cdeb27d123f45c02b2

SHA256
2b7a314d36ae2001be8b08c6e40f5b11865bf659146af4f42f521d8e9a869c46

SHA512
a824f1a36118a57de3d9ad8ca6001c32c727d43367b20a67c6bc5ba8815d70ad92f5e02ba57f37e7490548ad1cb1642ff8d0dfa58b4413bc9fe87e5630424329

Download Submit
C:\Windows\system\rIPJBqp.exe

Filesize
2.2MB

MD5
59d833f718e60ad913e376a22e4dcb2c

SHA1
df7fcc1b139c1ace628905d14441983d0743d9d1

SHA256
948edbc946b0aa3e6f89153b628d26bfeadefd22836752296a5eca62cf467fd2

SHA512
e1bafc89417a7ac4fc6f959446e7c1a523defbbcfe85586f81af4a349c1e72504b2f7d80bb97bce6c88b0d8adbec20a337f6dbf970855cc37bbfaa1c4548ff13

Download Submit
C:\Windows\system\ralBdCQ.exe

Filesize
2.2MB

MD5
00b46365a5e11de1e475f0fa5a6cfb6c

SHA1
76e508fa2aa6b3fd84b9ba210ca2e7c86361a25b

SHA256
9a098675bb660ccdf67072804f62af3c12f93bf6e19973de5b7bed546e6bb497

SHA512
f49f211ba5e2e4e3c6b6cc1ff8bc0ab5ddb652cd2ad8c45da53fc20eb4ef14e92800f91260bbb71a8a4ad4a15566aaac2d846cdd7d6d235bd6214b6e1e5309c3

Download Submit
C:\Windows\system\wjghyIY.exe

Filesize
2.2MB

MD5
61e1676a5606a429ae6d481d6cc57f6d

SHA1
4c5592f905741291b80e422ab0bfc87f810834cf

SHA256
78a47b2f12a2897429f310f503f06f5debd073b96e7881aa8dac67cba4f16a9e

SHA512
7cd69b85619827ad751932a6101d52f2c4a359c69d758ecefe61ceb5cf71cdfbffdb036a2667952267659f47e9d3de9a5c56e3d1d7896e8bddacc1ffdf69cd0d

Download Submit
\Windows\system\FRbuRlK.exe

Filesize
2.2MB

MD5
bfaa3cca73bf2bfa2c65a794279274a1

SHA1
1c043cb289ca38b8479778985bae4ebcae9080bb

SHA256
5b569fb74985d87b0912930769722aed4cb5d1d6ef2fe114424bccff5a87797a

SHA512
5a7ed98de0cb8e00045ee90054a4519b457211a70919de9a6d946d1eb8cc6c7a919f0d1d8bab59dd753a846011f10448403baecc5f2e348d9a8957392bbdfea4

Download Submit
\Windows\system\KhVfCTL.exe

Filesize
2.2MB

MD5
7d58b24b249a53d576b42057e74f968e

SHA1
1e1a444526c7649c1c79739958456c838267febd

SHA256
d21e8dc2ab0ffe47c20fa43498390de64d62b893c67506c86cd26c4cff20eb5c

SHA512
62af1da7fab2c20041bea0d84df9f62f6dae6ebe1af6ae80b76b4e5a71182e8e72c259daae5a5bace312733239a5a53d914df64549edf2ce2d101f2dfe84bf47

Download Submit
\Windows\system\bBJfAuX.exe

Filesize
2.2MB

MD5
6737400cc7b4218b3f4af6c4e2daaec9

SHA1
578eff10fc7cd401d17aa7c4e8b44106bcd4b0ab

SHA256
d84c85d68db5b36232018daedd542b7747b8d9c6fcc8f65f457113d305a957a6

SHA512
74150beb3c4dbf70c9fa1ab344800c3c2b40f16d9ec5d77bca232cf16c03112c59c10e2b18e32fcb7fc8175d74991f0f49cced4649ee6bcdf8a27c8494b129cf

Download Submit
memory/1484-8-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2032-88-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-111-0x0000000002E60000-0x0000000003252000-memory.dmp

Filesize
3.9MB

Download
memory/2036-101-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2036-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2036-50-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-108-0x0000000003560000-0x0000000003952000-memory.dmp

Filesize
3.9MB

Download
memory/2036-107-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2036-12-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2036-7-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-0-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-105-0x0000000002E60000-0x0000000003252000-memory.dmp

Filesize
3.9MB

Download
memory/2036-94-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2036-103-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2036-96-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2036-112-0x0000000003560000-0x0000000003952000-memory.dmp

Filesize
3.9MB

Download
memory/2036-99-0x0000000002E60000-0x0000000003252000-memory.dmp

Filesize
3.9MB

Download
memory/2160-49-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2200-194-0x000000001B880000-0x000000001BB62000-memory.dmp

Filesize
2.9MB

Download
memory/2200-195-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2488-104-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2500-102-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2600-106-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2668-92-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2732-100-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2752-110-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2948-97-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2960-95-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download