xmrig | 76952f4ce396848504a0c2e3f0d6ad4e78c376f33a2cd2a953f956f303f69514

Analysis

max time kernel
31s
max time network
30s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 00:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
Size

1.6MB
MD5

08923e50e0004bba330f1f60b9bb08b1
SHA1

ca506df7da9d402f5195dd4845669ea5691bc2d8
SHA256

76952f4ce396848504a0c2e3f0d6ad4e78c376f33a2cd2a953f956f303f69514
SHA512

7905260797b44c0289b2dc2ca6adfd23003c847d5f32ce85cd85efbd06968d87e1fbcd2c7a2b3c425f4bca8e137398aad4535f0ca07d24bc3aa0f9bfbad17733
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFt3:Lz071uv4BPMkibTIA5I4TNrpDGgDQ7

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2560-17-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2544-71-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2492-493-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2440-491-0x000000013F660000-0x000000013FA52000-memory.dmp	xmrig
behavioral1/memory/2468-489-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2444-486-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2788-303-0x000000013F690000-0x000000013FA82000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2560	nFGWxpc.exe
2672	XQkVRir.exe
2544	basuKvT.exe
2788	DGVxCQj.exe
2444	JAHKhqW.exe
2468	TNKYLQz.exe
2440	Oexfqtm.exe
2492	ooRkffl.exe
2088	NSGMkoW.exe
2864	RFRSZHA.exe
1504	kSjOhcl.exe
1360	QKLoSnF.exe
2408	pNgxVyM.exe
300	kESQObX.exe
1016	XtWUUdz.exe
1624	rnZiCeb.exe
1604	yzciRMs.exe
2328	wfYHLLJ.exe
1180	JnafSSi.exe
2760	ZZHBWxw.exe
2060	NKvjcKk.exe
2016	zowCpMT.exe
540	eoHxbJd.exe
1424	NyXpVSb.exe
2720	mFRwFTy.exe
1072	bbRLhEE.exe
2264	hYwJKwZ.exe
1204	FwMwIhb.exe
2928	mnZrFcw.exe
2816	ZchKIMH.exe
1904	zjFRiVs.exe
1800	HfUrzZG.exe
816	xagHzmQ.exe
880	cVkFahW.exe
2504	fgvjoRk.exe
3024	fYkZKGp.exe
288	azcRAtm.exe
3036	Ifdenoc.exe
2500	nDpBukn.exe
1436	FxPaXyk.exe
2920	zssdSgb.exe
1524	FoVoajW.exe
2604	McsvGKl.exe
2552	zsVZpFT.exe
2592	gnopjKp.exe
2176	aZbkpyD.exe
1448	FEKuwYh.exe
328	iwzKtag.exe
1888	OlPVoTG.exe
2020	vvSDPBc.exe
1208	AAEYPSm.exe
2284	gkIqSJW.exe
320	kItFVnw.exe
1068	Xqngfzp.exe
2144	wWfcHuz.exe
2912	brYnwfX.exe
356	ioHiRBc.exe
1364	QrkOEkM.exe
928	pQOngyz.exe
2056	CWKpLSj.exe
3080	hqwoHIw.exe
2708	yddZpuw.exe
1588	Dgdjiop.exe
2348	UsJSAJH.exe

Loads dropped DLL 64 IoCs

pid	Process
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2100-0-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/files/0x000c000000013f2c-3.dat	upx
behavioral1/files/0x003500000001432f-15.dat	upx
behavioral1/memory/2672-18-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2560-17-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/files/0x0016000000005586-19.dat	upx
behavioral1/files/0x00080000000144f1-27.dat	upx
behavioral1/files/0x00070000000144f9-32.dat	upx
behavioral1/files/0x000700000001459d-34.dat	upx
behavioral1/files/0x0008000000014677-42.dat	upx
behavioral1/files/0x000600000001565a-53.dat	upx
behavioral1/files/0x0007000000015083-50.dat	upx
behavioral1/files/0x0006000000015662-64.dat	upx
behavioral1/memory/2544-71-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/files/0x0006000000015b85-87.dat	upx
behavioral1/files/0x0006000000015ca8-94.dat	upx
behavioral1/files/0x0006000000015f23-143.dat	upx
behavioral1/files/0x00060000000161ee-157.dat	upx
behavioral1/files/0x00060000000167bf-169.dat	upx
behavioral1/files/0x00060000000158d9-75.dat	upx
behavioral1/files/0x0006000000016575-166.dat	upx
behavioral1/files/0x00060000000163eb-159.dat	upx
behavioral1/files/0x0006000000016122-152.dat	upx
behavioral1/files/0x0006000000015fa6-145.dat	upx
behavioral1/memory/2492-493-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2440-491-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/memory/2468-489-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2444-486-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/files/0x0006000000015d9c-138.dat	upx
behavioral1/files/0x0006000000015d61-131.dat	upx
behavioral1/files/0x0006000000015d39-124.dat	upx
behavioral1/files/0x0006000000015d0a-117.dat	upx
behavioral1/files/0x0006000000015cee-110.dat	upx
behavioral1/files/0x0006000000015cd2-103.dat	upx
behavioral1/files/0x0006000000015cb1-96.dat	upx
behavioral1/files/0x0006000000015c9a-89.dat	upx
behavioral1/files/0x0006000000015b50-81.dat	upx
behavioral1/memory/2788-303-0x000000013F690000-0x000000013FA82000-memory.dmp	upx
behavioral1/files/0x00060000000164ec-164.dat	upx
behavioral1/files/0x0006000000016013-150.dat	upx
behavioral1/files/0x0006000000015d85-136.dat	upx
behavioral1/files/0x0006000000015d59-129.dat	upx
behavioral1/files/0x0006000000015d21-122.dat	upx
behavioral1/files/0x0006000000015cf8-115.dat	upx
behavioral1/files/0x0006000000015ce3-108.dat	upx
behavioral1/files/0x0006000000015cc5-101.dat	upx
behavioral1/files/0x0006000000015ae3-79.dat	upx
behavioral1/files/0x0008000000014700-49.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ECWlvJF.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\llmWukB.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\Fefknlc.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\DDtiHqO.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\sEGGFEU.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\wnvPZIX.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\vQTMhej.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\GqKEaVz.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\DhYDSzm.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\vzEWvoH.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\czgXKhy.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\lFUlNns.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\YLYusmW.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\EZlCfFv.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\FrQHOlT.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\HvIYYmy.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\LQYhdaY.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\ifibBvw.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\zBDAYDu.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\reVrDAA.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\ZgOolDN.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\XLRxQJN.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\uciLRfW.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\cLmoufE.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\HCJVEuY.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\FNUpjxG.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\OfazDNI.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\zjFRiVs.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\ADdPkCr.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\uGwlKKe.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\KjRTEtF.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\KnZuwqL.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\NMJCkGt.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\PLrcieO.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\wMITUox.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\JdFXZqw.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\LnMFrmg.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\soTufkm.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\hmNLTUF.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\oezPXUX.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\VcYkSIY.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\UMuEMcs.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\gcVjKQZ.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\sidJfhM.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\eNixeHX.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\PkTARQS.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\cDsWsuM.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\FoiZHzd.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\QJwDfnn.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\AAEYPSm.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\HooobmO.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\CqmyjZR.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\VvpbZWB.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\QODVjpE.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\RCEbafW.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\oZCjDDS.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\NvNTamU.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\hzpXCWK.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\DjVUFWy.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\IGUfNrC.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\osJKwbe.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\QrisgsO.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\eUAuaRZ.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
File created	C:\Windows\System\vfTYAcg.exe	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2896	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
Token: SeDebugPrivilege	2896	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2896	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	29
PID 2100 wrote to memory of 2896	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	29
PID 2100 wrote to memory of 2896	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	29
PID 2100 wrote to memory of 2560	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	30
PID 2100 wrote to memory of 2560	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	30
PID 2100 wrote to memory of 2560	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	30
PID 2100 wrote to memory of 2672	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	31
PID 2100 wrote to memory of 2672	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	31
PID 2100 wrote to memory of 2672	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	31
PID 2100 wrote to memory of 2544	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	32
PID 2100 wrote to memory of 2544	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	32
PID 2100 wrote to memory of 2544	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	32
PID 2100 wrote to memory of 2788	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	33
PID 2100 wrote to memory of 2788	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	33
PID 2100 wrote to memory of 2788	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	33
PID 2100 wrote to memory of 2444	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	34
PID 2100 wrote to memory of 2444	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	34
PID 2100 wrote to memory of 2444	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	34
PID 2100 wrote to memory of 2468	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	35
PID 2100 wrote to memory of 2468	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	35
PID 2100 wrote to memory of 2468	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	35
PID 2100 wrote to memory of 2440	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	36
PID 2100 wrote to memory of 2440	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	36
PID 2100 wrote to memory of 2440	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	36
PID 2100 wrote to memory of 2492	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	37
PID 2100 wrote to memory of 2492	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	37
PID 2100 wrote to memory of 2492	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	37
PID 2100 wrote to memory of 2864	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	38
PID 2100 wrote to memory of 2864	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	38
PID 2100 wrote to memory of 2864	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	38
PID 2100 wrote to memory of 2088	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	39
PID 2100 wrote to memory of 2088	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	39
PID 2100 wrote to memory of 2088	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	39
PID 2100 wrote to memory of 1504	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	40
PID 2100 wrote to memory of 1504	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	40
PID 2100 wrote to memory of 1504	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	40
PID 2100 wrote to memory of 1360	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	41
PID 2100 wrote to memory of 1360	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	41
PID 2100 wrote to memory of 1360	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	41
PID 2100 wrote to memory of 2408	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	42
PID 2100 wrote to memory of 2408	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	42
PID 2100 wrote to memory of 2408	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	42
PID 2100 wrote to memory of 2708	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	43
PID 2100 wrote to memory of 2708	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	43
PID 2100 wrote to memory of 2708	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	43
PID 2100 wrote to memory of 300	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	44
PID 2100 wrote to memory of 300	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	44
PID 2100 wrote to memory of 300	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	44
PID 2100 wrote to memory of 1588	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	45
PID 2100 wrote to memory of 1588	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	45
PID 2100 wrote to memory of 1588	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	45
PID 2100 wrote to memory of 1016	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	46
PID 2100 wrote to memory of 1016	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	46
PID 2100 wrote to memory of 1016	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	46
PID 2100 wrote to memory of 2348	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	47
PID 2100 wrote to memory of 2348	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	47
PID 2100 wrote to memory of 2348	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	47
PID 2100 wrote to memory of 1624	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	48
PID 2100 wrote to memory of 1624	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	48
PID 2100 wrote to memory of 1624	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	48
PID 2100 wrote to memory of 1512	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	49
PID 2100 wrote to memory of 1512	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	49
PID 2100 wrote to memory of 1512	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	49
PID 2100 wrote to memory of 1604	2100	08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08923e50e0004bba330f1f60b9bb08b1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\System\nFGWxpc.exe
  C:\Windows\System\nFGWxpc.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\XQkVRir.exe
  C:\Windows\System\XQkVRir.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\basuKvT.exe
  C:\Windows\System\basuKvT.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\DGVxCQj.exe
  C:\Windows\System\DGVxCQj.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\JAHKhqW.exe
  C:\Windows\System\JAHKhqW.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\TNKYLQz.exe
  C:\Windows\System\TNKYLQz.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\Oexfqtm.exe
  C:\Windows\System\Oexfqtm.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\ooRkffl.exe
  C:\Windows\System\ooRkffl.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\RFRSZHA.exe
  C:\Windows\System\RFRSZHA.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\NSGMkoW.exe
  C:\Windows\System\NSGMkoW.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\kSjOhcl.exe
  C:\Windows\System\kSjOhcl.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\QKLoSnF.exe
  C:\Windows\System\QKLoSnF.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\pNgxVyM.exe
  C:\Windows\System\pNgxVyM.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\yddZpuw.exe
  C:\Windows\System\yddZpuw.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\kESQObX.exe
  C:\Windows\System\kESQObX.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\Dgdjiop.exe
  C:\Windows\System\Dgdjiop.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\XtWUUdz.exe
  C:\Windows\System\XtWUUdz.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\UsJSAJH.exe
  C:\Windows\System\UsJSAJH.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\rnZiCeb.exe
  C:\Windows\System\rnZiCeb.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\AwNwUkl.exe
  C:\Windows\System\AwNwUkl.exe
  2⤵
  PID:1512
- C:\Windows\System\yzciRMs.exe
  C:\Windows\System\yzciRMs.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\csQlvxK.exe
  C:\Windows\System\csQlvxK.exe
  2⤵
  PID:860
- C:\Windows\System\wfYHLLJ.exe
  C:\Windows\System\wfYHLLJ.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\rORKsSy.exe
  C:\Windows\System\rORKsSy.exe
  2⤵
  PID:1236
- C:\Windows\System\JnafSSi.exe
  C:\Windows\System\JnafSSi.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\PsdHLbI.exe
  C:\Windows\System\PsdHLbI.exe
  2⤵
  PID:2892
- C:\Windows\System\ZZHBWxw.exe
  C:\Windows\System\ZZHBWxw.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\XauEhZm.exe
  C:\Windows\System\XauEhZm.exe
  2⤵
  PID:2736
- C:\Windows\System\NKvjcKk.exe
  C:\Windows\System\NKvjcKk.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\iMFZxPC.exe
  C:\Windows\System\iMFZxPC.exe
  2⤵
  PID:2460
- C:\Windows\System\zowCpMT.exe
  C:\Windows\System\zowCpMT.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\OMEnjEV.exe
  C:\Windows\System\OMEnjEV.exe
  2⤵
  PID:1740
- C:\Windows\System\eoHxbJd.exe
  C:\Windows\System\eoHxbJd.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\MLUmIEy.exe
  C:\Windows\System\MLUmIEy.exe
  2⤵
  PID:740
- C:\Windows\System\NyXpVSb.exe
  C:\Windows\System\NyXpVSb.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\uoKhTeM.exe
  C:\Windows\System\uoKhTeM.exe
  2⤵
  PID:948
- C:\Windows\System\mFRwFTy.exe
  C:\Windows\System\mFRwFTy.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\WnXEmtG.exe
  C:\Windows\System\WnXEmtG.exe
  2⤵
  PID:1752
- C:\Windows\System\bbRLhEE.exe
  C:\Windows\System\bbRLhEE.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\opHhZvQ.exe
  C:\Windows\System\opHhZvQ.exe
  2⤵
  PID:2024
- C:\Windows\System\hYwJKwZ.exe
  C:\Windows\System\hYwJKwZ.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\NlewTXP.exe
  C:\Windows\System\NlewTXP.exe
  2⤵
  PID:448
- C:\Windows\System\FwMwIhb.exe
  C:\Windows\System\FwMwIhb.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\hYWDPrp.exe
  C:\Windows\System\hYWDPrp.exe
  2⤵
  PID:688
- C:\Windows\System\mnZrFcw.exe
  C:\Windows\System\mnZrFcw.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\ouhdhcR.exe
  C:\Windows\System\ouhdhcR.exe
  2⤵
  PID:2796
- C:\Windows\System\ZchKIMH.exe
  C:\Windows\System\ZchKIMH.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\zQOCMWY.exe
  C:\Windows\System\zQOCMWY.exe
  2⤵
  PID:1268
- C:\Windows\System\zjFRiVs.exe
  C:\Windows\System\zjFRiVs.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\VpUboFJ.exe
  C:\Windows\System\VpUboFJ.exe
  2⤵
  PID:1284
- C:\Windows\System\HfUrzZG.exe
  C:\Windows\System\HfUrzZG.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\wqIsryv.exe
  C:\Windows\System\wqIsryv.exe
  2⤵
  PID:756
- C:\Windows\System\xagHzmQ.exe
  C:\Windows\System\xagHzmQ.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\aunkXhR.exe
  C:\Windows\System\aunkXhR.exe
  2⤵
  PID:2820
- C:\Windows\System\cVkFahW.exe
  C:\Windows\System\cVkFahW.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\vCraqvD.exe
  C:\Windows\System\vCraqvD.exe
  2⤵
  PID:2252
- C:\Windows\System\fgvjoRk.exe
  C:\Windows\System\fgvjoRk.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\JtGqoXw.exe
  C:\Windows\System\JtGqoXw.exe
  2⤵
  PID:3012
- C:\Windows\System\fYkZKGp.exe
  C:\Windows\System\fYkZKGp.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\cagJziq.exe
  C:\Windows\System\cagJziq.exe
  2⤵
  PID:1684
- C:\Windows\System\azcRAtm.exe
  C:\Windows\System\azcRAtm.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\qlikIBF.exe
  C:\Windows\System\qlikIBF.exe
  2⤵
  PID:1708
- C:\Windows\System\Ifdenoc.exe
  C:\Windows\System\Ifdenoc.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\smGuwTM.exe
  C:\Windows\System\smGuwTM.exe
  2⤵
  PID:2280
- C:\Windows\System\nDpBukn.exe
  C:\Windows\System\nDpBukn.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\zLQUfoP.exe
  C:\Windows\System\zLQUfoP.exe
  2⤵
  PID:1432
- C:\Windows\System\FxPaXyk.exe
  C:\Windows\System\FxPaXyk.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\zljHvzy.exe
  C:\Windows\System\zljHvzy.exe
  2⤵
  PID:2116
- C:\Windows\System\zssdSgb.exe
  C:\Windows\System\zssdSgb.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\uYsHmJi.exe
  C:\Windows\System\uYsHmJi.exe
  2⤵
  PID:2960
- C:\Windows\System\FoVoajW.exe
  C:\Windows\System\FoVoajW.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\cqYYbRq.exe
  C:\Windows\System\cqYYbRq.exe
  2⤵
  PID:1528
- C:\Windows\System\McsvGKl.exe
  C:\Windows\System\McsvGKl.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\BgUqusa.exe
  C:\Windows\System\BgUqusa.exe
  2⤵
  PID:2640
- C:\Windows\System\zsVZpFT.exe
  C:\Windows\System\zsVZpFT.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\ekhIhxs.exe
  C:\Windows\System\ekhIhxs.exe
  2⤵
  PID:2772
- C:\Windows\System\gnopjKp.exe
  C:\Windows\System\gnopjKp.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\QTrscpQ.exe
  C:\Windows\System\QTrscpQ.exe
  2⤵
  PID:2416
- C:\Windows\System\aZbkpyD.exe
  C:\Windows\System\aZbkpyD.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\VvpbZWB.exe
  C:\Windows\System\VvpbZWB.exe
  2⤵
  PID:1996
- C:\Windows\System\FEKuwYh.exe
  C:\Windows\System\FEKuwYh.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\rCbnVMu.exe
  C:\Windows\System\rCbnVMu.exe
  2⤵
  PID:1760
- C:\Windows\System\iwzKtag.exe
  C:\Windows\System\iwzKtag.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\IFyMSgM.exe
  C:\Windows\System\IFyMSgM.exe
  2⤵
  PID:2568
- C:\Windows\System\OlPVoTG.exe
  C:\Windows\System\OlPVoTG.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\VFQziZf.exe
  C:\Windows\System\VFQziZf.exe
  2⤵
  PID:1688
- C:\Windows\System\vvSDPBc.exe
  C:\Windows\System\vvSDPBc.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\JQWvyxN.exe
  C:\Windows\System\JQWvyxN.exe
  2⤵
  PID:776
- C:\Windows\System\AAEYPSm.exe
  C:\Windows\System\AAEYPSm.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\QfOoWfY.exe
  C:\Windows\System\QfOoWfY.exe
  2⤵
  PID:980
- C:\Windows\System\gkIqSJW.exe
  C:\Windows\System\gkIqSJW.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\UOIkgTo.exe
  C:\Windows\System\UOIkgTo.exe
  2⤵
  PID:3028
- C:\Windows\System\kItFVnw.exe
  C:\Windows\System\kItFVnw.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\rMhwMvl.exe
  C:\Windows\System\rMhwMvl.exe
  2⤵
  PID:2676
- C:\Windows\System\Xqngfzp.exe
  C:\Windows\System\Xqngfzp.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\jhdrpaj.exe
  C:\Windows\System\jhdrpaj.exe
  2⤵
  PID:3048
- C:\Windows\System\wWfcHuz.exe
  C:\Windows\System\wWfcHuz.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\EuKbfUJ.exe
  C:\Windows\System\EuKbfUJ.exe
  2⤵
  PID:2776
- C:\Windows\System\brYnwfX.exe
  C:\Windows\System\brYnwfX.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\BSMEFya.exe
  C:\Windows\System\BSMEFya.exe
  2⤵
  PID:2636
- C:\Windows\System\ioHiRBc.exe
  C:\Windows\System\ioHiRBc.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\vmHkFSn.exe
  C:\Windows\System\vmHkFSn.exe
  2⤵
  PID:1428
- C:\Windows\System\QrkOEkM.exe
  C:\Windows\System\QrkOEkM.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\LQYhdaY.exe
  C:\Windows\System\LQYhdaY.exe
  2⤵
  PID:2028
- C:\Windows\System\pQOngyz.exe
  C:\Windows\System\pQOngyz.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\AvkhoTQ.exe
  C:\Windows\System\AvkhoTQ.exe
  2⤵
  PID:1228
- C:\Windows\System\CWKpLSj.exe
  C:\Windows\System\CWKpLSj.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\UcYBAcI.exe
  C:\Windows\System\UcYBAcI.exe
  2⤵
  PID:2136
- C:\Windows\System\hqwoHIw.exe
  C:\Windows\System\hqwoHIw.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\GaePmtp.exe
  C:\Windows\System\GaePmtp.exe
  2⤵
  PID:3096
- C:\Windows\System\ynAKPoK.exe
  C:\Windows\System\ynAKPoK.exe
  2⤵
  PID:3116
- C:\Windows\System\nVGlKzd.exe
  C:\Windows\System\nVGlKzd.exe
  2⤵
  PID:3148
- C:\Windows\System\ruTQVsI.exe
  C:\Windows\System\ruTQVsI.exe
  2⤵
  PID:3164
- C:\Windows\System\QAImzOi.exe
  C:\Windows\System\QAImzOi.exe
  2⤵
  PID:3180
- C:\Windows\System\VZSkHJm.exe
  C:\Windows\System\VZSkHJm.exe
  2⤵
  PID:3196
- C:\Windows\System\Yrzbtfh.exe
  C:\Windows\System\Yrzbtfh.exe
  2⤵
  PID:3212
- C:\Windows\System\LrPappz.exe
  C:\Windows\System\LrPappz.exe
  2⤵
  PID:3228
- C:\Windows\System\OmAbJyU.exe
  C:\Windows\System\OmAbJyU.exe
  2⤵
  PID:3244
- C:\Windows\System\YeKoQKN.exe
  C:\Windows\System\YeKoQKN.exe
  2⤵
  PID:3260
- C:\Windows\System\xESUZol.exe
  C:\Windows\System\xESUZol.exe
  2⤵
  PID:3276
- C:\Windows\System\CGQmGzp.exe
  C:\Windows\System\CGQmGzp.exe
  2⤵
  PID:3292
- C:\Windows\System\nLDeRel.exe
  C:\Windows\System\nLDeRel.exe
  2⤵
  PID:3308
- C:\Windows\System\YyWdVGZ.exe
  C:\Windows\System\YyWdVGZ.exe
  2⤵
  PID:3332
- C:\Windows\System\KQBKnLk.exe
  C:\Windows\System\KQBKnLk.exe
  2⤵
  PID:3348
- C:\Windows\System\ZtRcGwt.exe
  C:\Windows\System\ZtRcGwt.exe
  2⤵
  PID:3364
- C:\Windows\System\IHJaZLM.exe
  C:\Windows\System\IHJaZLM.exe
  2⤵
  PID:3380
- C:\Windows\System\LEltxEg.exe
  C:\Windows\System\LEltxEg.exe
  2⤵
  PID:3396
- C:\Windows\System\OmEhgVj.exe
  C:\Windows\System\OmEhgVj.exe
  2⤵
  PID:3412
- C:\Windows\System\IlbhlBD.exe
  C:\Windows\System\IlbhlBD.exe
  2⤵
  PID:3428
- C:\Windows\System\GElSmdB.exe
  C:\Windows\System\GElSmdB.exe
  2⤵
  PID:3444
- C:\Windows\System\KOmMPIE.exe
  C:\Windows\System\KOmMPIE.exe
  2⤵
  PID:3460
- C:\Windows\System\lXjygXi.exe
  C:\Windows\System\lXjygXi.exe
  2⤵
  PID:3476
- C:\Windows\System\SpbaVZV.exe
  C:\Windows\System\SpbaVZV.exe
  2⤵
  PID:3492
- C:\Windows\System\mPWLeLB.exe
  C:\Windows\System\mPWLeLB.exe
  2⤵
  PID:3508
- C:\Windows\System\KRLUfLX.exe
  C:\Windows\System\KRLUfLX.exe
  2⤵
  PID:3524
- C:\Windows\System\uuTJkiF.exe
  C:\Windows\System\uuTJkiF.exe
  2⤵
  PID:3544
- C:\Windows\System\RGNjuCL.exe
  C:\Windows\System\RGNjuCL.exe
  2⤵
  PID:3564
- C:\Windows\System\NgizSYJ.exe
  C:\Windows\System\NgizSYJ.exe
  2⤵
  PID:3580
- C:\Windows\System\SYYxeSg.exe
  C:\Windows\System\SYYxeSg.exe
  2⤵
  PID:3596
- C:\Windows\System\WqnvMUg.exe
  C:\Windows\System\WqnvMUg.exe
  2⤵
  PID:3612
- C:\Windows\System\rTJPiAw.exe
  C:\Windows\System\rTJPiAw.exe
  2⤵
  PID:3628
- C:\Windows\System\LBHMGxE.exe
  C:\Windows\System\LBHMGxE.exe
  2⤵
  PID:3648
- C:\Windows\System\BILYcnI.exe
  C:\Windows\System\BILYcnI.exe
  2⤵
  PID:3664
- C:\Windows\System\cLmoufE.exe
  C:\Windows\System\cLmoufE.exe
  2⤵
  PID:3680
- C:\Windows\System\AGSBilX.exe
  C:\Windows\System\AGSBilX.exe
  2⤵
  PID:3700
- C:\Windows\System\hOxXILX.exe
  C:\Windows\System\hOxXILX.exe
  2⤵
  PID:3720
- C:\Windows\System\UyLwJMc.exe
  C:\Windows\System\UyLwJMc.exe
  2⤵
  PID:3744
- C:\Windows\System\nCqvIic.exe
  C:\Windows\System\nCqvIic.exe
  2⤵
  PID:3760
- C:\Windows\System\fNODdhX.exe
  C:\Windows\System\fNODdhX.exe
  2⤵
  PID:3776
- C:\Windows\System\ncXaArs.exe
  C:\Windows\System\ncXaArs.exe
  2⤵
  PID:3792
- C:\Windows\System\bCzIUlc.exe
  C:\Windows\System\bCzIUlc.exe
  2⤵
  PID:3808
- C:\Windows\System\vzEWvoH.exe
  C:\Windows\System\vzEWvoH.exe
  2⤵
  PID:3828
- C:\Windows\System\ovEZiKv.exe
  C:\Windows\System\ovEZiKv.exe
  2⤵
  PID:3844
- C:\Windows\System\czgXKhy.exe
  C:\Windows\System\czgXKhy.exe
  2⤵
  PID:3860
- C:\Windows\System\KcGxDAi.exe
  C:\Windows\System\KcGxDAi.exe
  2⤵
  PID:3876
- C:\Windows\System\raADCjf.exe
  C:\Windows\System\raADCjf.exe
  2⤵
  PID:3892
- C:\Windows\System\umsxUHO.exe
  C:\Windows\System\umsxUHO.exe
  2⤵
  PID:3912
- C:\Windows\System\VcYkSIY.exe
  C:\Windows\System\VcYkSIY.exe
  2⤵
  PID:3928
- C:\Windows\System\QiVnsjY.exe
  C:\Windows\System\QiVnsjY.exe
  2⤵
  PID:3944
- C:\Windows\System\XkjRYUk.exe
  C:\Windows\System\XkjRYUk.exe
  2⤵
  PID:3964
- C:\Windows\System\EbOQuDR.exe
  C:\Windows\System\EbOQuDR.exe
  2⤵
  PID:1056
- C:\Windows\System\nvlCzOH.exe
  C:\Windows\System\nvlCzOH.exe
  2⤵
  PID:2596
- C:\Windows\System\PweiMLS.exe
  C:\Windows\System\PweiMLS.exe
  2⤵
  PID:1460
- C:\Windows\System\ifibBvw.exe
  C:\Windows\System\ifibBvw.exe
  2⤵
  PID:3140
- C:\Windows\System\icSyqyc.exe
  C:\Windows\System\icSyqyc.exe
  2⤵
  PID:3236
- C:\Windows\System\ewhjYBZ.exe
  C:\Windows\System\ewhjYBZ.exe
  2⤵
  PID:3340
- C:\Windows\System\FOSgiCx.exe
  C:\Windows\System\FOSgiCx.exe
  2⤵
  PID:3532
- C:\Windows\System\lAiQfsW.exe
  C:\Windows\System\lAiQfsW.exe
  2⤵
  PID:3756
- C:\Windows\System\bkuKGZh.exe
  C:\Windows\System\bkuKGZh.exe
  2⤵
  PID:3952
- C:\Windows\System\hpmVXKc.exe
  C:\Windows\System\hpmVXKc.exe
  2⤵
  PID:1324
- C:\Windows\System\HwFhLaR.exe
  C:\Windows\System\HwFhLaR.exe
  2⤵
  PID:3252
- C:\Windows\System\ADdPkCr.exe
  C:\Windows\System\ADdPkCr.exe
  2⤵
  PID:1148
- C:\Windows\System\AOvbrsa.exe
  C:\Windows\System\AOvbrsa.exe
  2⤵
  PID:3488
- C:\Windows\System\aFhhGoN.exe
  C:\Windows\System\aFhhGoN.exe
  2⤵
  PID:2032
- C:\Windows\System\QetqVFN.exe
  C:\Windows\System\QetqVFN.exe
  2⤵
  PID:1788
- C:\Windows\System\fUjJaId.exe
  C:\Windows\System\fUjJaId.exe
  2⤵
  PID:1500
- C:\Windows\System\BoTiIVE.exe
  C:\Windows\System\BoTiIVE.exe
  2⤵
  PID:2308
- C:\Windows\System\CYFCKzb.exe
  C:\Windows\System\CYFCKzb.exe
  2⤵
  PID:2936
- C:\Windows\System\XMHfgVy.exe
  C:\Windows\System\XMHfgVy.exe
  2⤵
  PID:2380
- C:\Windows\System\JfszTJT.exe
  C:\Windows\System\JfszTJT.exe
  2⤵
  PID:2392
- C:\Windows\System\xWfOIyZ.exe
  C:\Windows\System\xWfOIyZ.exe
  2⤵
  PID:2740
- C:\Windows\System\wNBFbAA.exe
  C:\Windows\System\wNBFbAA.exe
  2⤵
  PID:1596
- C:\Windows\System\pPDrqwV.exe
  C:\Windows\System\pPDrqwV.exe
  2⤵
  PID:2480
- C:\Windows\System\yzWwbsf.exe
  C:\Windows\System\yzWwbsf.exe
  2⤵
  PID:3256
- C:\Windows\System\LDPNwqW.exe
  C:\Windows\System\LDPNwqW.exe
  2⤵
  PID:3588
- C:\Windows\System\ddtYwkk.exe
  C:\Windows\System\ddtYwkk.exe
  2⤵
  PID:3696
- C:\Windows\System\AxIPtVn.exe
  C:\Windows\System\AxIPtVn.exe
  2⤵
  PID:3840
- C:\Windows\System\KUIgwCH.exe
  C:\Windows\System\KUIgwCH.exe
  2⤵
  PID:3992
- C:\Windows\System\eoSRWGe.exe
  C:\Windows\System\eoSRWGe.exe
  2⤵
  PID:3984
- C:\Windows\System\vgPgViU.exe
  C:\Windows\System\vgPgViU.exe
  2⤵
  PID:4040
- C:\Windows\System\LcxEysh.exe
  C:\Windows\System\LcxEysh.exe
  2⤵
  PID:4052
- C:\Windows\System\IbWeqjl.exe
  C:\Windows\System\IbWeqjl.exe
  2⤵
  PID:4076
- C:\Windows\System\iFPplzo.exe
  C:\Windows\System\iFPplzo.exe
  2⤵
  PID:2612
- C:\Windows\System\WxifzlW.exe
  C:\Windows\System\WxifzlW.exe
  2⤵
  PID:2600
- C:\Windows\System\vVWtwyi.exe
  C:\Windows\System\vVWtwyi.exe
  2⤵
  PID:2344
- C:\Windows\System\cwSxVJT.exe
  C:\Windows\System\cwSxVJT.exe
  2⤵
  PID:1264
- C:\Windows\System\EIOCROz.exe
  C:\Windows\System\EIOCROz.exe
  2⤵
  PID:268
- C:\Windows\System\QZGqQKx.exe
  C:\Windows\System\QZGqQKx.exe
  2⤵
  PID:2624
- C:\Windows\System\BCBBbDU.exe
  C:\Windows\System\BCBBbDU.exe
  2⤵
  PID:3272
- C:\Windows\System\luvtyCD.exe
  C:\Windows\System\luvtyCD.exe
  2⤵
  PID:2528
- C:\Windows\System\kKVUqrJ.exe
  C:\Windows\System\kKVUqrJ.exe
  2⤵
  PID:3440
- C:\Windows\System\VNRRQrC.exe
  C:\Windows\System\VNRRQrC.exe
  2⤵
  PID:3408
- C:\Windows\System\stTkpBI.exe
  C:\Windows\System\stTkpBI.exe
  2⤵
  PID:3608
- C:\Windows\System\raPnWdr.exe
  C:\Windows\System\raPnWdr.exe
  2⤵
  PID:3644
- C:\Windows\System\eLSsvNG.exe
  C:\Windows\System\eLSsvNG.exe
  2⤵
  PID:3820
- C:\Windows\System\QGBEsTd.exe
  C:\Windows\System\QGBEsTd.exe
  2⤵
  PID:3752
- C:\Windows\System\CjmgShZ.exe
  C:\Windows\System\CjmgShZ.exe
  2⤵
  PID:3852
- C:\Windows\System\uRrIRTN.exe
  C:\Windows\System\uRrIRTN.exe
  2⤵
  PID:3960
- C:\Windows\System\JYEYVqR.exe
  C:\Windows\System\JYEYVqR.exe
  2⤵
  PID:2852
- C:\Windows\System\LTpMBNz.exe
  C:\Windows\System\LTpMBNz.exe
  2⤵
  PID:3188
- C:\Windows\System\tyzcMxv.exe
  C:\Windows\System\tyzcMxv.exe
  2⤵
  PID:2160
- C:\Windows\System\XBdbxhx.exe
  C:\Windows\System\XBdbxhx.exe
  2⤵
  PID:3224
- C:\Windows\System\DuWXDia.exe
  C:\Windows\System\DuWXDia.exe
  2⤵
  PID:3420
- C:\Windows\System\QPxlGFS.exe
  C:\Windows\System\QPxlGFS.exe
  2⤵
  PID:3456
- C:\Windows\System\tMfhMmx.exe
  C:\Windows\System\tMfhMmx.exe
  2⤵
  PID:3556
- C:\Windows\System\MOebNmg.exe
  C:\Windows\System\MOebNmg.exe
  2⤵
  PID:3552
- C:\Windows\System\OKGGeoZ.exe
  C:\Windows\System\OKGGeoZ.exe
  2⤵
  PID:3800
- C:\Windows\System\ngihgbr.exe
  C:\Windows\System\ngihgbr.exe
  2⤵
  PID:2752
- C:\Windows\System\FhUGnzm.exe
  C:\Windows\System\FhUGnzm.exe
  2⤵
  PID:2980
- C:\Windows\System\fgyLYkS.exe
  C:\Windows\System\fgyLYkS.exe
  2⤵
  PID:472
- C:\Windows\System\bSzjEHu.exe
  C:\Windows\System\bSzjEHu.exe
  2⤵
  PID:2332
- C:\Windows\System\anxwomQ.exe
  C:\Windows\System\anxwomQ.exe
  2⤵
  PID:1884
- C:\Windows\System\TBVrxgb.exe
  C:\Windows\System\TBVrxgb.exe
  2⤵
  PID:1456
- C:\Windows\System\DjZqVZD.exe
  C:\Windows\System\DjZqVZD.exe
  2⤵
  PID:2012
- C:\Windows\System\eMkwiqM.exe
  C:\Windows\System\eMkwiqM.exe
  2⤵
  PID:2132
- C:\Windows\System\GFMPVAz.exe
  C:\Windows\System\GFMPVAz.exe
  2⤵
  PID:2256
- C:\Windows\System\Azsgyaf.exe
  C:\Windows\System\Azsgyaf.exe
  2⤵
  PID:2608
- C:\Windows\System\wEWiCdX.exe
  C:\Windows\System\wEWiCdX.exe
  2⤵
  PID:3052
- C:\Windows\System\ypdJpqC.exe
  C:\Windows\System\ypdJpqC.exe
  2⤵
  PID:1608
- C:\Windows\System\TRzLPZr.exe
  C:\Windows\System\TRzLPZr.exe
  2⤵
  PID:2232
- C:\Windows\System\VYfjMhX.exe
  C:\Windows\System\VYfjMhX.exe
  2⤵
  PID:2844
- C:\Windows\System\ItEtauI.exe
  C:\Windows\System\ItEtauI.exe
  2⤵
  PID:3016
- C:\Windows\System\KiFBUtr.exe
  C:\Windows\System\KiFBUtr.exe
  2⤵
  PID:348
- C:\Windows\System\vACnopm.exe
  C:\Windows\System\vACnopm.exe
  2⤵
  PID:2192
- C:\Windows\System\fcFiEZu.exe
  C:\Windows\System\fcFiEZu.exe
  2⤵
  PID:2576
- C:\Windows\System\WBYMdtU.exe
  C:\Windows\System\WBYMdtU.exe
  2⤵
  PID:3656
- C:\Windows\System\yjiNhXM.exe
  C:\Windows\System\yjiNhXM.exe
  2⤵
  PID:3980
- C:\Windows\System\MYHKmBT.exe
  C:\Windows\System\MYHKmBT.exe
  2⤵
  PID:2356
- C:\Windows\System\bxtGLIo.exe
  C:\Windows\System\bxtGLIo.exe
  2⤵
  PID:4036
- C:\Windows\System\LItIXrQ.exe
  C:\Windows\System\LItIXrQ.exe
  2⤵
  PID:4060
- C:\Windows\System\FlnlOnt.exe
  C:\Windows\System\FlnlOnt.exe
  2⤵
  PID:4084
- C:\Windows\System\gpTZYui.exe
  C:\Windows\System\gpTZYui.exe
  2⤵
  PID:2628
- C:\Windows\System\UMuEMcs.exe
  C:\Windows\System\UMuEMcs.exe
  2⤵
  PID:2304
- C:\Windows\System\oKwTolO.exe
  C:\Windows\System\oKwTolO.exe
  2⤵
  PID:2756
- C:\Windows\System\DBEuSXZ.exe
  C:\Windows\System\DBEuSXZ.exe
  2⤵
  PID:2184
- C:\Windows\System\TXIsgTw.exe
  C:\Windows\System\TXIsgTw.exe
  2⤵
  PID:1556
- C:\Windows\System\IXuCUbG.exe
  C:\Windows\System\IXuCUbG.exe
  2⤵
  PID:3436
- C:\Windows\System\TAmrtcm.exe
  C:\Windows\System\TAmrtcm.exe
  2⤵
  PID:3540
- C:\Windows\System\SHhwVfk.exe
  C:\Windows\System\SHhwVfk.exe
  2⤵
  PID:3884
- C:\Windows\System\mxjAhlC.exe
  C:\Windows\System\mxjAhlC.exe
  2⤵
  PID:1960
- C:\Windows\System\ItLXEzr.exe
  C:\Windows\System\ItLXEzr.exe
  2⤵
  PID:3520
- C:\Windows\System\rweysZr.exe
  C:\Windows\System\rweysZr.exe
  2⤵
  PID:4104
- C:\Windows\System\UQAoXSy.exe
  C:\Windows\System\UQAoXSy.exe
  2⤵
  PID:4148
- C:\Windows\System\IMvuRWA.exe
  C:\Windows\System\IMvuRWA.exe
  2⤵
  PID:4164
- C:\Windows\System\JWKDfCP.exe
  C:\Windows\System\JWKDfCP.exe
  2⤵
  PID:4180
- C:\Windows\System\KBtFajh.exe
  C:\Windows\System\KBtFajh.exe
  2⤵
  PID:4196
- C:\Windows\System\SRKAsqx.exe
  C:\Windows\System\SRKAsqx.exe
  2⤵
  PID:4216
- C:\Windows\System\ZYQdqAO.exe
  C:\Windows\System\ZYQdqAO.exe
  2⤵
  PID:4236
- C:\Windows\System\vgPnSaC.exe
  C:\Windows\System\vgPnSaC.exe
  2⤵
  PID:4252
- C:\Windows\System\SQnkBIQ.exe
  C:\Windows\System\SQnkBIQ.exe
  2⤵
  PID:4268
- C:\Windows\System\RoJYqFr.exe
  C:\Windows\System\RoJYqFr.exe
  2⤵
  PID:4284
- C:\Windows\System\YeUuPSC.exe
  C:\Windows\System\YeUuPSC.exe
  2⤵
  PID:4300
- C:\Windows\System\JRgumkW.exe
  C:\Windows\System\JRgumkW.exe
  2⤵
  PID:4316
- C:\Windows\System\zMYjatM.exe
  C:\Windows\System\zMYjatM.exe
  2⤵
  PID:4332
- C:\Windows\System\QuvVFWE.exe
  C:\Windows\System\QuvVFWE.exe
  2⤵
  PID:4348
- C:\Windows\System\krZaPNN.exe
  C:\Windows\System\krZaPNN.exe
  2⤵
  PID:4364
- C:\Windows\System\PkTARQS.exe
  C:\Windows\System\PkTARQS.exe
  2⤵
  PID:4380
- C:\Windows\System\RSJfEDI.exe
  C:\Windows\System\RSJfEDI.exe
  2⤵
  PID:4396
- C:\Windows\System\AVEHGej.exe
  C:\Windows\System\AVEHGej.exe
  2⤵
  PID:4416
- C:\Windows\System\DOScWJq.exe
  C:\Windows\System\DOScWJq.exe
  2⤵
  PID:4432
- C:\Windows\System\YsrsYHL.exe
  C:\Windows\System\YsrsYHL.exe
  2⤵
  PID:4448
- C:\Windows\System\LfRaNCh.exe
  C:\Windows\System\LfRaNCh.exe
  2⤵
  PID:4464
- C:\Windows\System\kwUGXYB.exe
  C:\Windows\System\kwUGXYB.exe
  2⤵
  PID:4480
- C:\Windows\System\dklAbeh.exe
  C:\Windows\System\dklAbeh.exe
  2⤵
  PID:4496
- C:\Windows\System\fCUmYlA.exe
  C:\Windows\System\fCUmYlA.exe
  2⤵
  PID:4512
- C:\Windows\System\YUWEOVv.exe
  C:\Windows\System\YUWEOVv.exe
  2⤵
  PID:4528
- C:\Windows\System\ykDxjyT.exe
  C:\Windows\System\ykDxjyT.exe
  2⤵
  PID:4544
- C:\Windows\System\WlZDjxp.exe
  C:\Windows\System\WlZDjxp.exe
  2⤵
  PID:4560
- C:\Windows\System\lWmqHrO.exe
  C:\Windows\System\lWmqHrO.exe
  2⤵
  PID:4576
- C:\Windows\System\BroPUGL.exe
  C:\Windows\System\BroPUGL.exe
  2⤵
  PID:4592
- C:\Windows\System\aUzPpLf.exe
  C:\Windows\System\aUzPpLf.exe
  2⤵
  PID:4608
- C:\Windows\System\SnhMwXm.exe
  C:\Windows\System\SnhMwXm.exe
  2⤵
  PID:4624
- C:\Windows\System\vILxAAT.exe
  C:\Windows\System\vILxAAT.exe
  2⤵
  PID:4640
- C:\Windows\System\xhfDWmG.exe
  C:\Windows\System\xhfDWmG.exe
  2⤵
  PID:4656
- C:\Windows\System\QPTfOpy.exe
  C:\Windows\System\QPTfOpy.exe
  2⤵
  PID:4672
- C:\Windows\System\rVVkCUR.exe
  C:\Windows\System\rVVkCUR.exe
  2⤵
  PID:4712
- C:\Windows\System\UgUqiuD.exe
  C:\Windows\System\UgUqiuD.exe
  2⤵
  PID:4728
- C:\Windows\System\eAAYwBY.exe
  C:\Windows\System\eAAYwBY.exe
  2⤵
  PID:4744
- C:\Windows\System\ljALRZP.exe
  C:\Windows\System\ljALRZP.exe
  2⤵
  PID:4760
- C:\Windows\System\NccTlRe.exe
  C:\Windows\System\NccTlRe.exe
  2⤵
  PID:4776
- C:\Windows\System\wnvPZIX.exe
  C:\Windows\System\wnvPZIX.exe
  2⤵
  PID:4792
- C:\Windows\System\UrBdqVP.exe
  C:\Windows\System\UrBdqVP.exe
  2⤵
  PID:4820
- C:\Windows\System\iDpyddc.exe
  C:\Windows\System\iDpyddc.exe
  2⤵
  PID:4836
- C:\Windows\System\VemfBWy.exe
  C:\Windows\System\VemfBWy.exe
  2⤵
  PID:4852
- C:\Windows\System\iZSKuZR.exe
  C:\Windows\System\iZSKuZR.exe
  2⤵
  PID:4868
- C:\Windows\System\hzHEben.exe
  C:\Windows\System\hzHEben.exe
  2⤵
  PID:4884
- C:\Windows\System\vQTMhej.exe
  C:\Windows\System\vQTMhej.exe
  2⤵
  PID:4900
- C:\Windows\System\UdebuSD.exe
  C:\Windows\System\UdebuSD.exe
  2⤵
  PID:4916
- C:\Windows\System\rBZGMTu.exe
  C:\Windows\System\rBZGMTu.exe
  2⤵
  PID:4932
- C:\Windows\System\ZqeCENF.exe
  C:\Windows\System\ZqeCENF.exe
  2⤵
  PID:4952
- C:\Windows\System\sRrdpaj.exe
  C:\Windows\System\sRrdpaj.exe
  2⤵
  PID:4968
- C:\Windows\System\nSgcZWo.exe
  C:\Windows\System\nSgcZWo.exe
  2⤵
  PID:4984
- C:\Windows\System\IeMGNnI.exe
  C:\Windows\System\IeMGNnI.exe
  2⤵
  PID:5000
- C:\Windows\System\ntjhyet.exe
  C:\Windows\System\ntjhyet.exe
  2⤵
  PID:5016
- C:\Windows\System\GZMckOD.exe
  C:\Windows\System\GZMckOD.exe
  2⤵
  PID:5032
- C:\Windows\System\aAxKjxA.exe
  C:\Windows\System\aAxKjxA.exe
  2⤵
  PID:5048
- C:\Windows\System\JdFXZqw.exe
  C:\Windows\System\JdFXZqw.exe
  2⤵
  PID:5064
- C:\Windows\System\QAqINuO.exe
  C:\Windows\System\QAqINuO.exe
  2⤵
  PID:5080
- C:\Windows\System\wRRrBHo.exe
  C:\Windows\System\wRRrBHo.exe
  2⤵
  PID:5096
- C:\Windows\System\oolrtrN.exe
  C:\Windows\System\oolrtrN.exe
  2⤵
  PID:5112
- C:\Windows\System\QdwdVHU.exe
  C:\Windows\System\QdwdVHU.exe
  2⤵
  PID:3904
- C:\Windows\System\QNjvCeJ.exe
  C:\Windows\System\QNjvCeJ.exe
  2⤵
  PID:2616
- C:\Windows\System\SDdTmMG.exe
  C:\Windows\System\SDdTmMG.exe
  2⤵
  PID:3712
- C:\Windows\System\DeaDXhP.exe
  C:\Windows\System\DeaDXhP.exe
  2⤵
  PID:2792
- C:\Windows\System\MuWlTsa.exe
  C:\Windows\System\MuWlTsa.exe
  2⤵
  PID:3160
- C:\Windows\System\WnGcgxn.exe
  C:\Windows\System\WnGcgxn.exe
  2⤵
  PID:3320
- C:\Windows\System\BaSVSap.exe
  C:\Windows\System\BaSVSap.exe
  2⤵
  PID:3804
- C:\Windows\System\bceMkMh.exe
  C:\Windows\System\bceMkMh.exe
  2⤵
  PID:1408
- C:\Windows\System\osfuvlt.exe
  C:\Windows\System\osfuvlt.exe
  2⤵
  PID:2080
- C:\Windows\System\MgQOrjc.exe
  C:\Windows\System\MgQOrjc.exe
  2⤵
  PID:1244
- C:\Windows\System\UYzMrHj.exe
  C:\Windows\System\UYzMrHj.exe
  2⤵
  PID:3624
- C:\Windows\System\TPWBWuo.exe
  C:\Windows\System\TPWBWuo.exe
  2⤵
  PID:4044
- C:\Windows\System\HooobmO.exe
  C:\Windows\System\HooobmO.exe
  2⤵
  PID:2436
- C:\Windows\System\gvXfJAm.exe
  C:\Windows\System\gvXfJAm.exe
  2⤵
  PID:2540
- C:\Windows\System\fwKXKMN.exe
  C:\Windows\System\fwKXKMN.exe
  2⤵
  PID:3040
- C:\Windows\System\dyRCZDz.exe
  C:\Windows\System\dyRCZDz.exe
  2⤵
  PID:4016
- C:\Windows\System\jgLfWbB.exe
  C:\Windows\System\jgLfWbB.exe
  2⤵
  PID:1484
- C:\Windows\System\QThHonj.exe
  C:\Windows\System\QThHonj.exe
  2⤵
  PID:3176
- C:\Windows\System\CeUykpM.exe
  C:\Windows\System\CeUykpM.exe
  2⤵
  PID:4160
- C:\Windows\System\HCJVEuY.exe
  C:\Windows\System\HCJVEuY.exe
  2⤵
  PID:2172
- C:\Windows\System\cTUTcuf.exe
  C:\Windows\System\cTUTcuf.exe
  2⤵
  PID:2680
- C:\Windows\System\ttGrWBx.exe
  C:\Windows\System\ttGrWBx.exe
  2⤵
  PID:3388
- C:\Windows\System\unqLOSy.exe
  C:\Windows\System\unqLOSy.exe
  2⤵
  PID:4176
- C:\Windows\System\nOusjJJ.exe
  C:\Windows\System\nOusjJJ.exe
  2⤵
  PID:4120
- C:\Windows\System\wdEoezF.exe
  C:\Windows\System\wdEoezF.exe
  2⤵
  PID:4136
- C:\Windows\System\hjzavkY.exe
  C:\Windows\System\hjzavkY.exe
  2⤵
  PID:4212
- C:\Windows\System\QkPNIwB.exe
  C:\Windows\System\QkPNIwB.exe
  2⤵
  PID:4112
- C:\Windows\System\DDtiHqO.exe
  C:\Windows\System\DDtiHqO.exe
  2⤵
  PID:4340
- C:\Windows\System\MopGyJA.exe
  C:\Windows\System\MopGyJA.exe
  2⤵
  PID:4408
- C:\Windows\System\fGOgnih.exe
  C:\Windows\System\fGOgnih.exe
  2⤵
  PID:4276
- C:\Windows\System\hzcyFSj.exe
  C:\Windows\System\hzcyFSj.exe
  2⤵
  PID:4412
- C:\Windows\System\haIqUdx.exe
  C:\Windows\System\haIqUdx.exe
  2⤵
  PID:4568
- C:\Windows\System\qmPrWOA.exe
  C:\Windows\System\qmPrWOA.exe
  2⤵
  PID:4224
- C:\Windows\System\NRggBCk.exe
  C:\Windows\System\NRggBCk.exe
  2⤵
  PID:4600
- C:\Windows\System\zBDAYDu.exe
  C:\Windows\System\zBDAYDu.exe
  2⤵
  PID:4356
- C:\Windows\System\ZeIJdLc.exe
  C:\Windows\System\ZeIJdLc.exe
  2⤵
  PID:4424
- C:\Windows\System\IDrvGlU.exe
  C:\Windows\System\IDrvGlU.exe
  2⤵
  PID:4488
- C:\Windows\System\peDXMFG.exe
  C:\Windows\System\peDXMFG.exe
  2⤵
  PID:4520
- C:\Windows\System\lZYuKnj.exe
  C:\Windows\System\lZYuKnj.exe
  2⤵
  PID:4584
- C:\Windows\System\LCfEzhK.exe
  C:\Windows\System\LCfEzhK.exe
  2⤵
  PID:4620
- C:\Windows\System\ydudDtE.exe
  C:\Windows\System\ydudDtE.exe
  2⤵
  PID:4696
- C:\Windows\System\OqEMgYB.exe
  C:\Windows\System\OqEMgYB.exe
  2⤵
  PID:4724
- C:\Windows\System\pdDvTeL.exe
  C:\Windows\System\pdDvTeL.exe
  2⤵
  PID:4788
- C:\Windows\System\rthISFw.exe
  C:\Windows\System\rthISFw.exe
  2⤵
  PID:4704
- C:\Windows\System\QkqVOxq.exe
  C:\Windows\System\QkqVOxq.exe
  2⤵
  PID:4800
- C:\Windows\System\GqKEaVz.exe
  C:\Windows\System\GqKEaVz.exe
  2⤵
  PID:4860
- C:\Windows\System\dfWYfzr.exe
  C:\Windows\System\dfWYfzr.exe
  2⤵
  PID:4896
- C:\Windows\System\ZWZDbEq.exe
  C:\Windows\System\ZWZDbEq.exe
  2⤵
  PID:4848
- C:\Windows\System\tdYpHmc.exe
  C:\Windows\System\tdYpHmc.exe
  2⤵
  PID:2220
- C:\Windows\System\PLrcieO.exe
  C:\Windows\System\PLrcieO.exe
  2⤵
  PID:4960
- C:\Windows\System\GkgMScH.exe
  C:\Windows\System\GkgMScH.exe
  2⤵
  PID:5088
- C:\Windows\System\oqKRBbr.exe
  C:\Windows\System\oqKRBbr.exe
  2⤵
  PID:1440
- C:\Windows\System\uKOAdJU.exe
  C:\Windows\System\uKOAdJU.exe
  2⤵
  PID:3692
- C:\Windows\System\CGeYUXy.exe
  C:\Windows\System\CGeYUXy.exe
  2⤵
  PID:4912
- C:\Windows\System\mwLWabK.exe
  C:\Windows\System\mwLWabK.exe
  2⤵
  PID:2052
- C:\Windows\System\UqTvAcz.exe
  C:\Windows\System\UqTvAcz.exe
  2⤵
  PID:4092
- C:\Windows\System\nuqbugd.exe
  C:\Windows\System\nuqbugd.exe
  2⤵
  PID:5044
- C:\Windows\System\SYasHsB.exe
  C:\Windows\System\SYasHsB.exe
  2⤵
  PID:5108
- C:\Windows\System\ORdzdSh.exe
  C:\Windows\System\ORdzdSh.exe
  2⤵
  PID:3920
- C:\Windows\System\LnMFrmg.exe
  C:\Windows\System\LnMFrmg.exe
  2⤵
  PID:2168
- C:\Windows\System\qTtAPLA.exe
  C:\Windows\System\qTtAPLA.exe
  2⤵
  PID:760
- C:\Windows\System\qyPsZTu.exe
  C:\Windows\System\qyPsZTu.exe
  2⤵
  PID:2156
- C:\Windows\System\VHqaJKS.exe
  C:\Windows\System\VHqaJKS.exe
  2⤵
  PID:1928
- C:\Windows\System\uRFmygf.exe
  C:\Windows\System\uRFmygf.exe
  2⤵
  PID:2656
- C:\Windows\System\LrIEGxO.exe
  C:\Windows\System\LrIEGxO.exe
  2⤵
  PID:3136
- C:\Windows\System\osJKwbe.exe
  C:\Windows\System\osJKwbe.exe
  2⤵
  PID:2660
- C:\Windows\System\UJgyvbV.exe
  C:\Windows\System\UJgyvbV.exe
  2⤵
  PID:4116
- C:\Windows\System\LESLIlO.exe
  C:\Windows\System\LESLIlO.exe
  2⤵
  PID:4192
- C:\Windows\System\sEGGFEU.exe
  C:\Windows\System\sEGGFEU.exe
  2⤵
  PID:4508
- C:\Windows\System\CtGmTjb.exe
  C:\Windows\System\CtGmTjb.exe
  2⤵
  PID:4460
- C:\Windows\System\GgdYWCu.exe
  C:\Windows\System\GgdYWCu.exe
  2⤵
  PID:4648
- C:\Windows\System\DSoOXuP.exe
  C:\Windows\System\DSoOXuP.exe
  2⤵
  PID:4772
- C:\Windows\System\NKymkME.exe
  C:\Windows\System\NKymkME.exe
  2⤵
  PID:4876
- C:\Windows\System\BFESmJi.exe
  C:\Windows\System\BFESmJi.exe
  2⤵
  PID:3132
- C:\Windows\System\gWTABAZ.exe
  C:\Windows\System\gWTABAZ.exe
  2⤵
  PID:1124
- C:\Windows\System\lktcsMl.exe
  C:\Windows\System\lktcsMl.exe
  2⤵
  PID:4444
- C:\Windows\System\PyqnxdQ.exe
  C:\Windows\System\PyqnxdQ.exe
  2⤵
  PID:4260
- C:\Windows\System\ldWrMVZ.exe
  C:\Windows\System\ldWrMVZ.exe
  2⤵
  PID:4388
- C:\Windows\System\wCOBLya.exe
  C:\Windows\System\wCOBLya.exe
  2⤵
  PID:4828
- C:\Windows\System\rhpWuKN.exe
  C:\Windows\System\rhpWuKN.exe
  2⤵
  PID:4292
- C:\Windows\System\zWYIBnI.exe
  C:\Windows\System\zWYIBnI.exe
  2⤵
  PID:4844
- C:\Windows\System\pbfFzgk.exe
  C:\Windows\System\pbfFzgk.exe
  2⤵
  PID:3900
- C:\Windows\System\psEIeSk.exe
  C:\Windows\System\psEIeSk.exe
  2⤵
  PID:5012
- C:\Windows\System\pqCmSqp.exe
  C:\Windows\System\pqCmSqp.exe
  2⤵
  PID:3592
- C:\Windows\System\yfpsYbq.exe
  C:\Windows\System\yfpsYbq.exe
  2⤵
  PID:4064
- C:\Windows\System\XPqvLZP.exe
  C:\Windows\System\XPqvLZP.exe
  2⤵
  PID:3640
- C:\Windows\System\QLqSIJo.exe
  C:\Windows\System\QLqSIJo.exe
  2⤵
  PID:4100
- C:\Windows\System\cwhwYOb.exe
  C:\Windows\System\cwhwYOb.exe
  2⤵
  PID:3376
- C:\Windows\System\tVKtnJc.exe
  C:\Windows\System\tVKtnJc.exe
  2⤵
  PID:4404
- C:\Windows\System\qoykSRd.exe
  C:\Windows\System\qoykSRd.exe
  2⤵
  PID:3092
- C:\Windows\System\SPVQSch.exe
  C:\Windows\System\SPVQSch.exe
  2⤵
  PID:5056
- C:\Windows\System\UYqqUNe.exe
  C:\Windows\System\UYqqUNe.exe
  2⤵
  PID:4140
- C:\Windows\System\wLXBdPf.exe
  C:\Windows\System\wLXBdPf.exe
  2⤵
  PID:4472
- C:\Windows\System\sLoQcpb.exe
  C:\Windows\System\sLoQcpb.exe
  2⤵
  PID:4208
- C:\Windows\System\QrisgsO.exe
  C:\Windows\System\QrisgsO.exe
  2⤵
  PID:4244
- C:\Windows\System\KqZlgTp.exe
  C:\Windows\System\KqZlgTp.exe
  2⤵
  PID:4812
- C:\Windows\System\pSrwFWi.exe
  C:\Windows\System\pSrwFWi.exe
  2⤵
  PID:4632
- C:\Windows\System\dNcsIRV.exe
  C:\Windows\System\dNcsIRV.exe
  2⤵
  PID:4636
- C:\Windows\System\ipBJHId.exe
  C:\Windows\System\ipBJHId.exe
  2⤵
  PID:3452
- C:\Windows\System\jfQRwOx.exe
  C:\Windows\System\jfQRwOx.exe
  2⤵
  PID:4944
- C:\Windows\System\uIsSfpb.exe
  C:\Windows\System\uIsSfpb.exe
  2⤵
  PID:4456
- C:\Windows\System\yOiHBxv.exe
  C:\Windows\System\yOiHBxv.exe
  2⤵
  PID:3572
- C:\Windows\System\KEVyjns.exe
  C:\Windows\System\KEVyjns.exe
  2⤵
  PID:3344
- C:\Windows\System\citEQak.exe
  C:\Windows\System\citEQak.exe
  2⤵
  PID:1476
- C:\Windows\System\eaKJnWJ.exe
  C:\Windows\System\eaKJnWJ.exe
  2⤵
  PID:5028
- C:\Windows\System\YBgTOuQ.exe
  C:\Windows\System\YBgTOuQ.exe
  2⤵
  PID:5040
- C:\Windows\System\EvpsRIc.exe
  C:\Windows\System\EvpsRIc.exe
  2⤵
  PID:3268
- C:\Windows\System\pCqEBAk.exe
  C:\Windows\System\pCqEBAk.exe
  2⤵
  PID:5300
- C:\Windows\System\IyvNdav.exe
  C:\Windows\System\IyvNdav.exe
  2⤵
  PID:5420
- C:\Windows\System\dUuzNfk.exe
  C:\Windows\System\dUuzNfk.exe
  2⤵
  PID:5516
- C:\Windows\System\jDDNbgK.exe
  C:\Windows\System\jDDNbgK.exe
  2⤵
  PID:5532
- C:\Windows\System\foiDovK.exe
  C:\Windows\System\foiDovK.exe
  2⤵
  PID:5548
- C:\Windows\System\RdAtoJU.exe
  C:\Windows\System\RdAtoJU.exe
  2⤵
  PID:5564
- C:\Windows\System\AHPMulX.exe
  C:\Windows\System\AHPMulX.exe
  2⤵
  PID:5604
- C:\Windows\System\SwLHCUL.exe
  C:\Windows\System\SwLHCUL.exe
  2⤵
  PID:5620
- C:\Windows\System\VlnZLPR.exe
  C:\Windows\System\VlnZLPR.exe
  2⤵
  PID:5640
- C:\Windows\System\CZgIQdZ.exe
  C:\Windows\System\CZgIQdZ.exe
  2⤵
  PID:5656
- C:\Windows\System\luSqXhg.exe
  C:\Windows\System\luSqXhg.exe
  2⤵
  PID:5764
- C:\Windows\System\kQFKgfP.exe
  C:\Windows\System\kQFKgfP.exe
  2⤵
  PID:5784
- C:\Windows\System\PeodDka.exe
  C:\Windows\System\PeodDka.exe
  2⤵
  PID:5804
- C:\Windows\System\rOyvTKv.exe
  C:\Windows\System\rOyvTKv.exe
  2⤵
  PID:5824
- C:\Windows\System\oPNZZJQ.exe
  C:\Windows\System\oPNZZJQ.exe
  2⤵
  PID:5840
- C:\Windows\System\abEiWDw.exe
  C:\Windows\System\abEiWDw.exe
  2⤵
  PID:5860
- C:\Windows\System\McUGljz.exe
  C:\Windows\System\McUGljz.exe
  2⤵
  PID:5876
- C:\Windows\System\CLFkvfG.exe
  C:\Windows\System\CLFkvfG.exe
  2⤵
  PID:5892
- C:\Windows\System\OGXoGWT.exe
  C:\Windows\System\OGXoGWT.exe
  2⤵
  PID:5908
- C:\Windows\System\qiNAHMC.exe
  C:\Windows\System\qiNAHMC.exe
  2⤵
  PID:5928
- C:\Windows\System\eQQdWfm.exe
  C:\Windows\System\eQQdWfm.exe
  2⤵
  PID:5952
- C:\Windows\System\OVjjfrZ.exe
  C:\Windows\System\OVjjfrZ.exe
  2⤵
  PID:5968
- C:\Windows\System\soTufkm.exe
  C:\Windows\System\soTufkm.exe
  2⤵
  PID:5984
- C:\Windows\System\ADatruB.exe
  C:\Windows\System\ADatruB.exe
  2⤵
  PID:6000
- C:\Windows\System\IfmGdzk.exe
  C:\Windows\System\IfmGdzk.exe
  2⤵
  PID:6016
- C:\Windows\System\zTHgYzF.exe
  C:\Windows\System\zTHgYzF.exe
  2⤵
  PID:6032
- C:\Windows\System\oPPUqeh.exe
  C:\Windows\System\oPPUqeh.exe
  2⤵
  PID:6060
- C:\Windows\System\GMRmooq.exe
  C:\Windows\System\GMRmooq.exe
  2⤵
  PID:6084
- C:\Windows\System\xkBktmJ.exe
  C:\Windows\System\xkBktmJ.exe
  2⤵
  PID:6100
- C:\Windows\System\QODVjpE.exe
  C:\Windows\System\QODVjpE.exe
  2⤵
  PID:6116
- C:\Windows\System\JrlEHjy.exe
  C:\Windows\System\JrlEHjy.exe
  2⤵
  PID:6132
- C:\Windows\System\xsCxXCM.exe
  C:\Windows\System\xsCxXCM.exe
  2⤵
  PID:4832
- C:\Windows\System\PexoAwl.exe
  C:\Windows\System\PexoAwl.exe
  2⤵
  PID:4556
- C:\Windows\System\qhkYkrQ.exe
  C:\Windows\System\qhkYkrQ.exe
  2⤵
  PID:4172
- C:\Windows\System\DOzWrbs.exe
  C:\Windows\System\DOzWrbs.exe
  2⤵
  PID:5148
- C:\Windows\System\UFslhSi.exe
  C:\Windows\System\UFslhSi.exe
  2⤵
  PID:1852
- C:\Windows\System\cDsWsuM.exe
  C:\Windows\System\cDsWsuM.exe
  2⤵
  PID:5188
- C:\Windows\System\wXUqTMI.exe
  C:\Windows\System\wXUqTMI.exe
  2⤵
  PID:2068
- C:\Windows\System\SstNEoB.exe
  C:\Windows\System\SstNEoB.exe
  2⤵
  PID:2260
- C:\Windows\System\upLJJot.exe
  C:\Windows\System\upLJJot.exe
  2⤵
  PID:5220
- C:\Windows\System\borRepF.exe
  C:\Windows\System\borRepF.exe
  2⤵
  PID:5228
- C:\Windows\System\PZLrxrU.exe
  C:\Windows\System\PZLrxrU.exe
  2⤵
  PID:5328
- C:\Windows\System\fIdLYuZ.exe
  C:\Windows\System\fIdLYuZ.exe
  2⤵
  PID:5372
- C:\Windows\System\hQVfbHU.exe
  C:\Windows\System\hQVfbHU.exe
  2⤵
  PID:5272
- C:\Windows\System\ghmxAsf.exe
  C:\Windows\System\ghmxAsf.exe
  2⤵
  PID:5336
- C:\Windows\System\gIYZTXI.exe
  C:\Windows\System\gIYZTXI.exe
  2⤵
  PID:5360
- C:\Windows\System\muqYPmZ.exe
  C:\Windows\System\muqYPmZ.exe
  2⤵
  PID:5248
- C:\Windows\System\ulqcXeC.exe
  C:\Windows\System\ulqcXeC.exe
  2⤵
  PID:5264
- C:\Windows\System\hVEsHAU.exe
  C:\Windows\System\hVEsHAU.exe
  2⤵
  PID:5312
- C:\Windows\System\wjyhSZE.exe
  C:\Windows\System\wjyhSZE.exe
  2⤵
  PID:5384
- C:\Windows\System\XrlhQQX.exe
  C:\Windows\System\XrlhQQX.exe
  2⤵
  PID:5396
- C:\Windows\System\KwBdtGU.exe
  C:\Windows\System\KwBdtGU.exe
  2⤵
  PID:5416
- C:\Windows\System\RxNMxKi.exe
  C:\Windows\System\RxNMxKi.exe
  2⤵
  PID:5428
- C:\Windows\System\OUhmQXN.exe
  C:\Windows\System\OUhmQXN.exe
  2⤵
  PID:5524
- C:\Windows\System\lFUlNns.exe
  C:\Windows\System\lFUlNns.exe
  2⤵
  PID:5480
- C:\Windows\System\qoKbNmB.exe
  C:\Windows\System\qoKbNmB.exe
  2⤵
  PID:5476
- C:\Windows\System\pQcaIkQ.exe
  C:\Windows\System\pQcaIkQ.exe
  2⤵
  PID:5556
- C:\Windows\System\fuZcEQF.exe
  C:\Windows\System\fuZcEQF.exe
  2⤵
  PID:5544
- C:\Windows\System\tUPcCWY.exe
  C:\Windows\System\tUPcCWY.exe
  2⤵
  PID:5576
- C:\Windows\System\yIPcWrX.exe
  C:\Windows\System\yIPcWrX.exe
  2⤵
  PID:5612
- C:\Windows\System\HloxUkL.exe
  C:\Windows\System\HloxUkL.exe
  2⤵
  PID:5632
- C:\Windows\System\kKNESTT.exe
  C:\Windows\System\kKNESTT.exe
  2⤵
  PID:5676
- C:\Windows\System\jhFoNPR.exe
  C:\Windows\System\jhFoNPR.exe
  2⤵
  PID:5708
- C:\Windows\System\XENwfjd.exe
  C:\Windows\System\XENwfjd.exe
  2⤵
  PID:5692
- C:\Windows\System\TREFBan.exe
  C:\Windows\System\TREFBan.exe
  2⤵
  PID:5712
- C:\Windows\System\LRfXJJT.exe
  C:\Windows\System\LRfXJJT.exe
  2⤵
  PID:5680
- C:\Windows\System\OBhbgpl.exe
  C:\Windows\System\OBhbgpl.exe
  2⤵
  PID:5724
- C:\Windows\System\ixtAcxD.exe
  C:\Windows\System\ixtAcxD.exe
  2⤵
  PID:5748
- C:\Windows\System\CiinxvD.exe
  C:\Windows\System\CiinxvD.exe
  2⤵
  PID:5812
- C:\Windows\System\vfTYAcg.exe
  C:\Windows\System\vfTYAcg.exe
  2⤵
  PID:5816
- C:\Windows\System\IZXVkPC.exe
  C:\Windows\System\IZXVkPC.exe
  2⤵
  PID:5868
- C:\Windows\System\cfsfGck.exe
  C:\Windows\System\cfsfGck.exe
  2⤵
  PID:5940
- C:\Windows\System\gxxLRlO.exe
  C:\Windows\System\gxxLRlO.exe
  2⤵
  PID:5980
- C:\Windows\System\AiCaopM.exe
  C:\Windows\System\AiCaopM.exe
  2⤵
  PID:6044
- C:\Windows\System\xgXdNpX.exe
  C:\Windows\System\xgXdNpX.exe
  2⤵
  PID:6092
- C:\Windows\System\dCDsBPf.exe
  C:\Windows\System\dCDsBPf.exe
  2⤵
  PID:2692
- C:\Windows\System\PpdbpQi.exe
  C:\Windows\System\PpdbpQi.exe
  2⤵
  PID:3604
- C:\Windows\System\pAcogwR.exe
  C:\Windows\System\pAcogwR.exe
  2⤵
  PID:5200
- C:\Windows\System\XPFwBlF.exe
  C:\Windows\System\XPFwBlF.exe
  2⤵
  PID:5352
- C:\Windows\System\xBGdbpk.exe
  C:\Windows\System\xBGdbpk.exe
  2⤵
  PID:5244
- C:\Windows\System\piYptPk.exe
  C:\Windows\System\piYptPk.exe
  2⤵
  PID:5392
- C:\Windows\System\ePutZCC.exe
  C:\Windows\System\ePutZCC.exe
  2⤵
  PID:5472
- C:\Windows\System\fGxROWt.exe
  C:\Windows\System\fGxROWt.exe
  2⤵
  PID:5584
- C:\Windows\System\eSMTjxZ.exe
  C:\Windows\System\eSMTjxZ.exe
  2⤵
  PID:1308
- C:\Windows\System\IHmoiex.exe
  C:\Windows\System\IHmoiex.exe
  2⤵
  PID:5856
- C:\Windows\System\ABZTnng.exe
  C:\Windows\System\ABZTnng.exe
  2⤵
  PID:5240
- C:\Windows\System\IoalxQw.exe
  C:\Windows\System\IoalxQw.exe
  2⤵
  PID:5652
- C:\Windows\System\FoiZHzd.exe
  C:\Windows\System\FoiZHzd.exe
  2⤵
  PID:5888
- C:\Windows\System\vjTrIhp.exe
  C:\Windows\System\vjTrIhp.exe
  2⤵
  PID:5996
- C:\Windows\System\FgIJYew.exe
  C:\Windows\System\FgIJYew.exe
  2⤵
  PID:6028
- C:\Windows\System\YLYusmW.exe
  C:\Windows\System\YLYusmW.exe
  2⤵
  PID:5316
- C:\Windows\System\modWQtI.exe
  C:\Windows\System\modWQtI.exe
  2⤵
  PID:5464
- C:\Windows\System\FRQnoTQ.exe
  C:\Windows\System\FRQnoTQ.exe
  2⤵
  PID:6076
- C:\Windows\System\IxgJTbw.exe
  C:\Windows\System\IxgJTbw.exe
  2⤵
  PID:6112
- C:\Windows\System\NFWTtsB.exe
  C:\Windows\System\NFWTtsB.exe
  2⤵
  PID:5124
- C:\Windows\System\zIQVNuM.exe
  C:\Windows\System\zIQVNuM.exe
  2⤵
  PID:5776
- C:\Windows\System\VphftgT.exe
  C:\Windows\System\VphftgT.exe
  2⤵
  PID:5600
- C:\Windows\System\xoETtEr.exe
  C:\Windows\System\xoETtEr.exe
  2⤵
  PID:5740
- C:\Windows\System\fnnOOKY.exe
  C:\Windows\System\fnnOOKY.exe
  2⤵
  PID:5904
- C:\Windows\System\kZiDtHJ.exe
  C:\Windows\System\kZiDtHJ.exe
  2⤵
  PID:6040
- C:\Windows\System\utJalmL.exe
  C:\Windows\System\utJalmL.exe
  2⤵
  PID:5180
- C:\Windows\System\TPKHZOU.exe
  C:\Windows\System\TPKHZOU.exe
  2⤵
  PID:5468
- C:\Windows\System\reVrDAA.exe
  C:\Windows\System\reVrDAA.exe
  2⤵
  PID:5636
- C:\Windows\System\RCEbafW.exe
  C:\Windows\System\RCEbafW.exe
  2⤵
  PID:2836
- C:\Windows\System\xeRKsrb.exe
  C:\Windows\System\xeRKsrb.exe
  2⤵
  PID:5356
- C:\Windows\System\jQVAgKx.exe
  C:\Windows\System\jQVAgKx.exe
  2⤵
  PID:5320
- C:\Windows\System\cUyDMod.exe
  C:\Windows\System\cUyDMod.exe
  2⤵
  PID:3208
- C:\Windows\System\eiqmwUT.exe
  C:\Windows\System\eiqmwUT.exe
  2⤵
  PID:5820
- C:\Windows\System\puJNsnH.exe
  C:\Windows\System\puJNsnH.exe
  2⤵
  PID:5204
- C:\Windows\System\hKfuMWQ.exe
  C:\Windows\System\hKfuMWQ.exe
  2⤵
  PID:6012
- C:\Windows\System\mNXKKWY.exe
  C:\Windows\System\mNXKKWY.exe
  2⤵
  PID:5920
- C:\Windows\System\rKdvHxg.exe
  C:\Windows\System\rKdvHxg.exe
  2⤵
  PID:5412
- C:\Windows\System\RrCQYFF.exe
  C:\Windows\System\RrCQYFF.exe
  2⤵
  PID:5836
- C:\Windows\System\UkdUAaI.exe
  C:\Windows\System\UkdUAaI.exe
  2⤵
  PID:5716
- C:\Windows\System\PTddjZa.exe
  C:\Windows\System\PTddjZa.exe
  2⤵
  PID:5528
- C:\Windows\System\JSIHovo.exe
  C:\Windows\System\JSIHovo.exe
  2⤵
  PID:5664
- C:\Windows\System\FzsfUCD.exe
  C:\Windows\System\FzsfUCD.exe
  2⤵
  PID:6176
- C:\Windows\System\UGGLuSB.exe
  C:\Windows\System\UGGLuSB.exe
  2⤵
  PID:6192
- C:\Windows\System\ECWlvJF.exe
  C:\Windows\System\ECWlvJF.exe
  2⤵
  PID:6208
- C:\Windows\System\lKuYXhy.exe
  C:\Windows\System\lKuYXhy.exe
  2⤵
  PID:6488
- C:\Windows\System\nHiCSVS.exe
  C:\Windows\System\nHiCSVS.exe
  2⤵
  PID:6504
- C:\Windows\System\PxKXECd.exe
  C:\Windows\System\PxKXECd.exe
  2⤵
  PID:6520
- C:\Windows\System\WaCMCEH.exe
  C:\Windows\System\WaCMCEH.exe
  2⤵
  PID:6536
- C:\Windows\System\WFKhvCt.exe
  C:\Windows\System\WFKhvCt.exe
  2⤵
  PID:6552
- C:\Windows\System\XrLBova.exe
  C:\Windows\System\XrLBova.exe
  2⤵
  PID:6568
- C:\Windows\System\XRbAaSG.exe
  C:\Windows\System\XRbAaSG.exe
  2⤵
  PID:6588
- C:\Windows\System\BPvDWgB.exe
  C:\Windows\System\BPvDWgB.exe
  2⤵
  PID:6608
- C:\Windows\System\xwbAZff.exe
  C:\Windows\System\xwbAZff.exe
  2⤵
  PID:6624
- C:\Windows\System\QQXdnvQ.exe
  C:\Windows\System\QQXdnvQ.exe
  2⤵
  PID:6640
- C:\Windows\System\hmNLTUF.exe
  C:\Windows\System\hmNLTUF.exe
  2⤵
  PID:6660
- C:\Windows\System\RZWPCtr.exe
  C:\Windows\System\RZWPCtr.exe
  2⤵
  PID:6676
- C:\Windows\System\EvbGTIf.exe
  C:\Windows\System\EvbGTIf.exe
  2⤵
  PID:6692
- C:\Windows\System\rfojWIw.exe
  C:\Windows\System\rfojWIw.exe
  2⤵
  PID:6708
- C:\Windows\System\XJRwgdN.exe
  C:\Windows\System\XJRwgdN.exe
  2⤵
  PID:6724
- C:\Windows\System\pjxUzsh.exe
  C:\Windows\System\pjxUzsh.exe
  2⤵
  PID:6740
- C:\Windows\System\YRduCaK.exe
  C:\Windows\System\YRduCaK.exe
  2⤵
  PID:6756
- C:\Windows\System\gSHnOvq.exe
  C:\Windows\System\gSHnOvq.exe
  2⤵
  PID:6772
- C:\Windows\System\nrVqSsW.exe
  C:\Windows\System\nrVqSsW.exe
  2⤵
  PID:6788
- C:\Windows\System\XWcTghi.exe
  C:\Windows\System\XWcTghi.exe
  2⤵
  PID:6808
- C:\Windows\System\JgWxPKl.exe
  C:\Windows\System\JgWxPKl.exe
  2⤵
  PID:6828
- C:\Windows\System\NXouziS.exe
  C:\Windows\System\NXouziS.exe
  2⤵
  PID:6844
- C:\Windows\System\dWBwkMX.exe
  C:\Windows\System\dWBwkMX.exe
  2⤵
  PID:6860
- C:\Windows\System\llmWukB.exe
  C:\Windows\System\llmWukB.exe
  2⤵
  PID:6876
- C:\Windows\System\sNOJrRs.exe
  C:\Windows\System\sNOJrRs.exe
  2⤵
  PID:6892
- C:\Windows\System\BhAynmd.exe
  C:\Windows\System\BhAynmd.exe
  2⤵
  PID:6908
- C:\Windows\System\uxIxctl.exe
  C:\Windows\System\uxIxctl.exe
  2⤵
  PID:6924
- C:\Windows\System\Otiapnj.exe
  C:\Windows\System\Otiapnj.exe
  2⤵
  PID:6940
- C:\Windows\System\aeTlAGO.exe
  C:\Windows\System\aeTlAGO.exe
  2⤵
  PID:6960
- C:\Windows\System\fNurevs.exe
  C:\Windows\System\fNurevs.exe
  2⤵
  PID:6976
- C:\Windows\System\bwBObMM.exe
  C:\Windows\System\bwBObMM.exe
  2⤵
  PID:6992
- C:\Windows\System\bmqCfTB.exe
  C:\Windows\System\bmqCfTB.exe
  2⤵
  PID:7008
- C:\Windows\System\ATlZjFq.exe
  C:\Windows\System\ATlZjFq.exe
  2⤵
  PID:7024
- C:\Windows\System\PEpBhCE.exe
  C:\Windows\System\PEpBhCE.exe
  2⤵
  PID:7040
- C:\Windows\System\oZCjDDS.exe
  C:\Windows\System\oZCjDDS.exe
  2⤵
  PID:7056
- C:\Windows\System\iizpynR.exe
  C:\Windows\System\iizpynR.exe
  2⤵
  PID:7072
- C:\Windows\System\JKmHlmF.exe
  C:\Windows\System\JKmHlmF.exe
  2⤵
  PID:7088
- C:\Windows\System\aBJBNBY.exe
  C:\Windows\System\aBJBNBY.exe
  2⤵
  PID:7104
- C:\Windows\System\CAvZSLh.exe
  C:\Windows\System\CAvZSLh.exe
  2⤵
  PID:7120
- C:\Windows\System\ZJcJhAu.exe
  C:\Windows\System\ZJcJhAu.exe
  2⤵
  PID:7136
- C:\Windows\System\gIYlazM.exe
  C:\Windows\System\gIYlazM.exe
  2⤵
  PID:7152
- C:\Windows\System\idqgMzA.exe
  C:\Windows\System\idqgMzA.exe
  2⤵
  PID:2984
- C:\Windows\System\AZDsMwl.exe
  C:\Windows\System\AZDsMwl.exe
  2⤵
  PID:5628
- C:\Windows\System\ciqehqM.exe
  C:\Windows\System\ciqehqM.exe
  2⤵
  PID:5948
- C:\Windows\System\AvBfvKW.exe
  C:\Windows\System\AvBfvKW.exe
  2⤵
  PID:5916
- C:\Windows\System\iOVGZsH.exe
  C:\Windows\System\iOVGZsH.exe
  2⤵
  PID:5208
- C:\Windows\System\HWnRDRJ.exe
  C:\Windows\System\HWnRDRJ.exe
  2⤵
  PID:5368
- C:\Windows\System\LVQEnHp.exe
  C:\Windows\System\LVQEnHp.exe
  2⤵
  PID:1212
- C:\Windows\System\BJbUovU.exe
  C:\Windows\System\BJbUovU.exe
  2⤵
  PID:6024
- C:\Windows\System\uasOfRg.exe
  C:\Windows\System\uasOfRg.exe
  2⤵
  PID:5900
- C:\Windows\System\fvAbRtM.exe
  C:\Windows\System\fvAbRtM.exe
  2⤵
  PID:6152
- C:\Windows\System\PDxUgIE.exe
  C:\Windows\System\PDxUgIE.exe
  2⤵
  PID:6172
- C:\Windows\System\ehrcfAp.exe
  C:\Windows\System\ehrcfAp.exe
  2⤵
  PID:6244
- C:\Windows\System\vGAGUAr.exe
  C:\Windows\System\vGAGUAr.exe
  2⤵
  PID:6316
- C:\Windows\System\wwWLcbJ.exe
  C:\Windows\System\wwWLcbJ.exe
  2⤵
  PID:6380
- C:\Windows\System\OlIzKIh.exe
  C:\Windows\System\OlIzKIh.exe
  2⤵
  PID:6184
- C:\Windows\System\aXSibdG.exe
  C:\Windows\System\aXSibdG.exe
  2⤵
  PID:6368
- C:\Windows\System\NvNTamU.exe
  C:\Windows\System\NvNTamU.exe
  2⤵
  PID:6416
- C:\Windows\System\MilxISK.exe
  C:\Windows\System\MilxISK.exe
  2⤵
  PID:6232
- C:\Windows\System\UZjePSL.exe
  C:\Windows\System\UZjePSL.exe
  2⤵
  PID:6256
- C:\Windows\System\KaAkkTP.exe
  C:\Windows\System\KaAkkTP.exe
  2⤵
  PID:6268
- C:\Windows\System\YsmDUrJ.exe
  C:\Windows\System\YsmDUrJ.exe
  2⤵
  PID:6288
- C:\Windows\System\gnepjJx.exe
  C:\Windows\System\gnepjJx.exe
  2⤵
  PID:6312
- C:\Windows\System\DJLzSBa.exe
  C:\Windows\System\DJLzSBa.exe
  2⤵
  PID:6344
- C:\Windows\System\kHsmEir.exe
  C:\Windows\System\kHsmEir.exe
  2⤵
  PID:6352
- C:\Windows\System\cbwcSuH.exe
  C:\Windows\System\cbwcSuH.exe
  2⤵
  PID:6420
- C:\Windows\System\vVgFxjE.exe
  C:\Windows\System\vVgFxjE.exe
  2⤵
  PID:6440
- C:\Windows\System\gPhQCEi.exe
  C:\Windows\System\gPhQCEi.exe
  2⤵
  PID:6460
- C:\Windows\System\NsxwBwt.exe
  C:\Windows\System\NsxwBwt.exe
  2⤵
  PID:6476
- C:\Windows\System\pNgCkYa.exe
  C:\Windows\System\pNgCkYa.exe
  2⤵
  PID:6496
- C:\Windows\System\sPXQgGx.exe
  C:\Windows\System\sPXQgGx.exe
  2⤵
  PID:6548
- C:\Windows\System\XhdAhjY.exe
  C:\Windows\System\XhdAhjY.exe
  2⤵
  PID:6764
- C:\Windows\System\MrhByVe.exe
  C:\Windows\System\MrhByVe.exe
  2⤵
  PID:6988
- C:\Windows\System\lReDLwF.exe
  C:\Windows\System\lReDLwF.exe
  2⤵
  PID:6900
- C:\Windows\System\wrPizWm.exe
  C:\Windows\System\wrPizWm.exe
  2⤵
  PID:6600
- C:\Windows\System\RcOiBSO.exe
  C:\Windows\System\RcOiBSO.exe
  2⤵
  PID:6668
- C:\Windows\System\ZHyxknJ.exe
  C:\Windows\System\ZHyxknJ.exe
  2⤵
  PID:6872
- C:\Windows\System\hEpXunf.exe
  C:\Windows\System\hEpXunf.exe
  2⤵
  PID:6972
- C:\Windows\System\gCFDTmm.exe
  C:\Windows\System\gCFDTmm.exe
  2⤵
  PID:7048
- C:\Windows\System\tPniAke.exe
  C:\Windows\System\tPniAke.exe
  2⤵
  PID:7032
- C:\Windows\System\pmnShME.exe
  C:\Windows\System\pmnShME.exe
  2⤵
  PID:7068
- C:\Windows\System\PkmGQcY.exe
  C:\Windows\System\PkmGQcY.exe
  2⤵
  PID:7128
- C:\Windows\System\dNMYBuz.exe
  C:\Windows\System\dNMYBuz.exe
  2⤵
  PID:7164
- C:\Windows\System\rDzCGHG.exe
  C:\Windows\System\rDzCGHG.exe
  2⤵
  PID:5800
- C:\Windows\System\uQdXSsC.exe
  C:\Windows\System\uQdXSsC.exe
  2⤵
  PID:624
- C:\Windows\System\IhNMYhn.exe
  C:\Windows\System\IhNMYhn.exe
  2⤵
  PID:5992
- C:\Windows\System\aHdJcRG.exe
  C:\Windows\System\aHdJcRG.exe
  2⤵
  PID:5192
- C:\Windows\System\OIDBBqw.exe
  C:\Windows\System\OIDBBqw.exe
  2⤵
  PID:6168
- C:\Windows\System\OdBkTeE.exe
  C:\Windows\System\OdBkTeE.exe
  2⤵
  PID:6716
- C:\Windows\System\JNWquJj.exe
  C:\Windows\System\JNWquJj.exe
  2⤵
  PID:6784
- C:\Windows\System\ZsKvxCX.exe
  C:\Windows\System\ZsKvxCX.exe
  2⤵
  PID:6780
- C:\Windows\System\yjKSgRm.exe
  C:\Windows\System\yjKSgRm.exe
  2⤵
  PID:6564
- C:\Windows\System\FNUpjxG.exe
  C:\Windows\System\FNUpjxG.exe
  2⤵
  PID:6948
- C:\Windows\System\oqsXdQZ.exe
  C:\Windows\System\oqsXdQZ.exe
  2⤵
  PID:6736
- C:\Windows\System\HTQKTOp.exe
  C:\Windows\System\HTQKTOp.exe
  2⤵
  PID:6984
- C:\Windows\System\ayOxExo.exe
  C:\Windows\System\ayOxExo.exe
  2⤵
  PID:6596
- C:\Windows\System\NGnMqMY.exe
  C:\Windows\System\NGnMqMY.exe
  2⤵
  PID:6800
- C:\Windows\System\SzTeIGq.exe
  C:\Windows\System\SzTeIGq.exe
  2⤵
  PID:7148
- C:\Windows\System\WgJcDES.exe
  C:\Windows\System\WgJcDES.exe
  2⤵
  PID:6932
- C:\Windows\System\EtkzslQ.exe
  C:\Windows\System\EtkzslQ.exe
  2⤵
  PID:7080
- C:\Windows\System\hpkjAhB.exe
  C:\Windows\System\hpkjAhB.exe
  2⤵
  PID:6068
- C:\Windows\System\hQSMbwg.exe
  C:\Windows\System\hQSMbwg.exe
  2⤵
  PID:1652
- C:\Windows\System\mJQJpfO.exe
  C:\Windows\System\mJQJpfO.exe
  2⤵
  PID:4156
- C:\Windows\System\BKChmTD.exe
  C:\Windows\System\BKChmTD.exe
  2⤵
  PID:6376
- C:\Windows\System\CqmyjZR.exe
  C:\Windows\System\CqmyjZR.exe
  2⤵
  PID:6388
- C:\Windows\System\DrHXRVL.exe
  C:\Windows\System\DrHXRVL.exe
  2⤵
  PID:6412
- C:\Windows\System\KTkYAsZ.exe
  C:\Windows\System\KTkYAsZ.exe
  2⤵
  PID:6236
- C:\Windows\System\ndblHMV.exe
  C:\Windows\System\ndblHMV.exe
  2⤵
  PID:6284
- C:\Windows\System\XFgWeMa.exe
  C:\Windows\System\XFgWeMa.exe
  2⤵
  PID:6328
- C:\Windows\System\vpvTdXz.exe
  C:\Windows\System\vpvTdXz.exe
  2⤵
  PID:6432
- C:\Windows\System\pwzvxRn.exe
  C:\Windows\System\pwzvxRn.exe
  2⤵
  PID:6452
- C:\Windows\System\yWBapEe.exe
  C:\Windows\System\yWBapEe.exe
  2⤵
  PID:6484
- C:\Windows\System\XkRyRFb.exe
  C:\Windows\System\XkRyRFb.exe
  2⤵
  PID:6620
- C:\Windows\System\bGrHoub.exe
  C:\Windows\System\bGrHoub.exe
  2⤵
  PID:6688
- C:\Windows\System\vUotbOK.exe
  C:\Windows\System\vUotbOK.exe
  2⤵
  PID:6824
- C:\Windows\System\rFoIYcR.exe
  C:\Windows\System\rFoIYcR.exe
  2⤵
  PID:6748
- C:\Windows\System\GdVnAAh.exe
  C:\Windows\System\GdVnAAh.exe
  2⤵
  PID:7020
- C:\Windows\System\rNdSkJB.exe
  C:\Windows\System\rNdSkJB.exe
  2⤵
  PID:6372
- C:\Windows\System\YQLQvUz.exe
  C:\Windows\System\YQLQvUz.exe
  2⤵
  PID:6292
- C:\Windows\System\mCZtMSd.exe
  C:\Windows\System\mCZtMSd.exe
  2⤵
  PID:6364
- C:\Windows\System\WiTanSd.exe
  C:\Windows\System\WiTanSd.exe
  2⤵
  PID:6580
- C:\Windows\System\hzpXCWK.exe
  C:\Windows\System\hzpXCWK.exe
  2⤵
  PID:6264
- C:\Windows\System\PlKoKlv.exe
  C:\Windows\System\PlKoKlv.exe
  2⤵
  PID:6160
- C:\Windows\System\YvQLZJY.exe
  C:\Windows\System\YvQLZJY.exe
  2⤵
  PID:6956
- C:\Windows\System\vHBjSOQ.exe
  C:\Windows\System\vHBjSOQ.exe
  2⤵
  PID:7100
- C:\Windows\System\HVymrKb.exe
  C:\Windows\System\HVymrKb.exe
  2⤵
  PID:6188
- C:\Windows\System\xjwSNei.exe
  C:\Windows\System\xjwSNei.exe
  2⤵
  PID:6436
- C:\Windows\System\qhabIld.exe
  C:\Windows\System\qhabIld.exe
  2⤵
  PID:6820
- C:\Windows\System\ycZYFPp.exe
  C:\Windows\System\ycZYFPp.exe
  2⤵
  PID:6684
- C:\Windows\System\hIqMDZm.exe
  C:\Windows\System\hIqMDZm.exe
  2⤵
  PID:6164
- C:\Windows\System\PCbVAfG.exe
  C:\Windows\System\PCbVAfG.exe
  2⤵
  PID:6392
- C:\Windows\System\QAuFepF.exe
  C:\Windows\System\QAuFepF.exe
  2⤵
  PID:2968
- C:\Windows\System\ovFFkNo.exe
  C:\Windows\System\ovFFkNo.exe
  2⤵
  PID:6480
- C:\Windows\System\ZabHLqa.exe
  C:\Windows\System\ZabHLqa.exe
  2⤵
  PID:6856
- C:\Windows\System\uMSgvvI.exe
  C:\Windows\System\uMSgvvI.exe
  2⤵
  PID:6348
- C:\Windows\System\IJUDZGS.exe
  C:\Windows\System\IJUDZGS.exe
  2⤵
  PID:6920
- C:\Windows\System\FtlRGTl.exe
  C:\Windows\System\FtlRGTl.exe
  2⤵
  PID:6072
- C:\Windows\System\unKTYHH.exe
  C:\Windows\System\unKTYHH.exe
  2⤵
  PID:6836
- C:\Windows\System\muWegHm.exe
  C:\Windows\System\muWegHm.exe
  2⤵
  PID:6408
- C:\Windows\System\yaFamgV.exe
  C:\Windows\System\yaFamgV.exe
  2⤵
  PID:7172
- C:\Windows\System\GICuGhO.exe
  C:\Windows\System\GICuGhO.exe
  2⤵
  PID:7188
- C:\Windows\System\artUCCF.exe
  C:\Windows\System\artUCCF.exe
  2⤵
  PID:7204
- C:\Windows\System\HVArDVw.exe
  C:\Windows\System\HVArDVw.exe
  2⤵
  PID:7220
- C:\Windows\System\IQFBXnR.exe
  C:\Windows\System\IQFBXnR.exe
  2⤵
  PID:7236
- C:\Windows\System\nHNaQMD.exe
  C:\Windows\System\nHNaQMD.exe
  2⤵
  PID:7252
- C:\Windows\System\iIOOQZx.exe
  C:\Windows\System\iIOOQZx.exe
  2⤵
  PID:7268
- C:\Windows\System\jJEBmzK.exe
  C:\Windows\System\jJEBmzK.exe
  2⤵
  PID:7284
- C:\Windows\System\APAgXeH.exe
  C:\Windows\System\APAgXeH.exe
  2⤵
  PID:7300
- C:\Windows\System\dZFvPdq.exe
  C:\Windows\System\dZFvPdq.exe
  2⤵
  PID:7316
- C:\Windows\System\dNqfeVp.exe
  C:\Windows\System\dNqfeVp.exe
  2⤵
  PID:7332
- C:\Windows\System\VjIGvMq.exe
  C:\Windows\System\VjIGvMq.exe
  2⤵
  PID:7348
- C:\Windows\System\gcVjKQZ.exe
  C:\Windows\System\gcVjKQZ.exe
  2⤵
  PID:7364
- C:\Windows\System\dUDoDHy.exe
  C:\Windows\System\dUDoDHy.exe
  2⤵
  PID:7380
- C:\Windows\System\oGgvXiN.exe
  C:\Windows\System\oGgvXiN.exe
  2⤵
  PID:7404
- C:\Windows\System\cUxLgbr.exe
  C:\Windows\System\cUxLgbr.exe
  2⤵
  PID:7420
- C:\Windows\System\EIsvvFx.exe
  C:\Windows\System\EIsvvFx.exe
  2⤵
  PID:7440
- C:\Windows\System\wMITUox.exe
  C:\Windows\System\wMITUox.exe
  2⤵
  PID:7460
- C:\Windows\System\SeKSUDF.exe
  C:\Windows\System\SeKSUDF.exe
  2⤵
  PID:7480
- C:\Windows\System\uQieKta.exe
  C:\Windows\System\uQieKta.exe
  2⤵
  PID:7496
- C:\Windows\System\UOfiyCr.exe
  C:\Windows\System\UOfiyCr.exe
  2⤵
  PID:7512
- C:\Windows\System\LgHIBkC.exe
  C:\Windows\System\LgHIBkC.exe
  2⤵
  PID:7528
- C:\Windows\System\MCKaERD.exe
  C:\Windows\System\MCKaERD.exe
  2⤵
  PID:7544
- C:\Windows\System\XQwXEYN.exe
  C:\Windows\System\XQwXEYN.exe
  2⤵
  PID:7560
- C:\Windows\System\VDpCuws.exe
  C:\Windows\System\VDpCuws.exe
  2⤵
  PID:7576
- C:\Windows\System\bZShRcz.exe
  C:\Windows\System\bZShRcz.exe
  2⤵
  PID:7592
- C:\Windows\System\RmsvkxF.exe
  C:\Windows\System\RmsvkxF.exe
  2⤵
  PID:7608
- C:\Windows\System\XmQhHVc.exe
  C:\Windows\System\XmQhHVc.exe
  2⤵
  PID:7624
- C:\Windows\System\Qoubpxt.exe
  C:\Windows\System\Qoubpxt.exe
  2⤵
  PID:7640
- C:\Windows\System\loUHnke.exe
  C:\Windows\System\loUHnke.exe
  2⤵
  PID:7656
- C:\Windows\System\vlJYDSJ.exe
  C:\Windows\System\vlJYDSJ.exe
  2⤵
  PID:7672
- C:\Windows\System\UeNJKud.exe
  C:\Windows\System\UeNJKud.exe
  2⤵
  PID:7688
- C:\Windows\System\vznRgjr.exe
  C:\Windows\System\vznRgjr.exe
  2⤵
  PID:7704
- C:\Windows\System\ywEuclA.exe
  C:\Windows\System\ywEuclA.exe
  2⤵
  PID:7720
- C:\Windows\System\GQQXRTk.exe
  C:\Windows\System\GQQXRTk.exe
  2⤵
  PID:7736
- C:\Windows\System\JSlYiqq.exe
  C:\Windows\System\JSlYiqq.exe
  2⤵
  PID:7752
- C:\Windows\System\uzuvpFc.exe
  C:\Windows\System\uzuvpFc.exe
  2⤵
  PID:7772
- C:\Windows\System\mmeQeDO.exe
  C:\Windows\System\mmeQeDO.exe
  2⤵
  PID:7788
- C:\Windows\System\bIPbTxS.exe
  C:\Windows\System\bIPbTxS.exe
  2⤵
  PID:7804
- C:\Windows\System\vSkwXHH.exe
  C:\Windows\System\vSkwXHH.exe
  2⤵
  PID:7820
- C:\Windows\System\NHNZPaS.exe
  C:\Windows\System\NHNZPaS.exe
  2⤵
  PID:7836
- C:\Windows\System\GjHAOyw.exe
  C:\Windows\System\GjHAOyw.exe
  2⤵
  PID:7852
- C:\Windows\System\pbAzrED.exe
  C:\Windows\System\pbAzrED.exe
  2⤵
  PID:7868
- C:\Windows\System\NsvNzvd.exe
  C:\Windows\System\NsvNzvd.exe
  2⤵
  PID:7892
- C:\Windows\System\ZoUqbPX.exe
  C:\Windows\System\ZoUqbPX.exe
  2⤵
  PID:7908
- C:\Windows\System\UMuKjpx.exe
  C:\Windows\System\UMuKjpx.exe
  2⤵
  PID:7924
- C:\Windows\System\EZlCfFv.exe
  C:\Windows\System\EZlCfFv.exe
  2⤵
  PID:7940
- C:\Windows\System\RuXBmUj.exe
  C:\Windows\System\RuXBmUj.exe
  2⤵
  PID:7956
- C:\Windows\System\Frfgcdi.exe
  C:\Windows\System\Frfgcdi.exe
  2⤵
  PID:7988
- C:\Windows\System\MYCAlgg.exe
  C:\Windows\System\MYCAlgg.exe
  2⤵
  PID:8028
- C:\Windows\System\oYkSaZr.exe
  C:\Windows\System\oYkSaZr.exe
  2⤵
  PID:8044
- C:\Windows\System\USJEGTQ.exe
  C:\Windows\System\USJEGTQ.exe
  2⤵
  PID:8060
- C:\Windows\System\gRxpPbi.exe
  C:\Windows\System\gRxpPbi.exe
  2⤵
  PID:8076
- C:\Windows\System\RIRCpSL.exe
  C:\Windows\System\RIRCpSL.exe
  2⤵
  PID:8092
- C:\Windows\System\teRaCYU.exe
  C:\Windows\System\teRaCYU.exe
  2⤵
  PID:8108
- C:\Windows\System\CUnzIfK.exe
  C:\Windows\System\CUnzIfK.exe
  2⤵
  PID:8124
- C:\Windows\System\FjFqVvt.exe
  C:\Windows\System\FjFqVvt.exe
  2⤵
  PID:8140
- C:\Windows\System\PYOkiWy.exe
  C:\Windows\System\PYOkiWy.exe
  2⤵
  PID:8156
- C:\Windows\System\KVNvOJf.exe
  C:\Windows\System\KVNvOJf.exe
  2⤵
  PID:8172
- C:\Windows\System\eYTgRVt.exe
  C:\Windows\System\eYTgRVt.exe
  2⤵
  PID:8188
- C:\Windows\System\VNLkfQK.exe
  C:\Windows\System\VNLkfQK.exe
  2⤵
  PID:6336
- C:\Windows\System\zOLOnjd.exe
  C:\Windows\System\zOLOnjd.exe
  2⤵
  PID:6616
- C:\Windows\System\mKqJbCd.exe
  C:\Windows\System\mKqJbCd.exe
  2⤵
  PID:7196
- C:\Windows\System\TpxRrfV.exe
  C:\Windows\System\TpxRrfV.exe
  2⤵
  PID:7280
- C:\Windows\System\akiKITN.exe
  C:\Windows\System\akiKITN.exe
  2⤵
  PID:7292
- C:\Windows\System\HqmCyiS.exe
  C:\Windows\System\HqmCyiS.exe
  2⤵
  PID:7296
- C:\Windows\System\DxftGLF.exe
  C:\Windows\System\DxftGLF.exe
  2⤵
  PID:7356
- C:\Windows\System\TANzytH.exe
  C:\Windows\System\TANzytH.exe
  2⤵
  PID:7388
- C:\Windows\System\fqhrzKn.exe
  C:\Windows\System\fqhrzKn.exe
  2⤵
  PID:7412
- C:\Windows\System\AqNGqJP.exe
  C:\Windows\System\AqNGqJP.exe
  2⤵
  PID:7432
- C:\Windows\System\YcatdIp.exe
  C:\Windows\System\YcatdIp.exe
  2⤵
  PID:7524
- C:\Windows\System\odBfRPk.exe
  C:\Windows\System\odBfRPk.exe
  2⤵
  PID:7556
- C:\Windows\System\TCofsmA.exe
  C:\Windows\System\TCofsmA.exe
  2⤵
  PID:7648
- C:\Windows\System\ZDSmqVI.exe
  C:\Windows\System\ZDSmqVI.exe
  2⤵
  PID:7712
- C:\Windows\System\stgSGiH.exe
  C:\Windows\System\stgSGiH.exe
  2⤵
  PID:7600
- C:\Windows\System\JOhgOvv.exe
  C:\Windows\System\JOhgOvv.exe
  2⤵
  PID:7636
- C:\Windows\System\QJYXokI.exe
  C:\Windows\System\QJYXokI.exe
  2⤵
  PID:7540
- C:\Windows\System\KefQSqw.exe
  C:\Windows\System\KefQSqw.exe
  2⤵
  PID:7668
- C:\Windows\System\vYiLZqd.exe
  C:\Windows\System\vYiLZqd.exe
  2⤵
  PID:7732
- C:\Windows\System\PtchUDC.exe
  C:\Windows\System\PtchUDC.exe
  2⤵
  PID:7800
- C:\Windows\System\MYBoZFu.exe
  C:\Windows\System\MYBoZFu.exe
  2⤵
  PID:8000
- C:\Windows\System\zkavmpC.exe
  C:\Windows\System\zkavmpC.exe
  2⤵
  PID:8040
- C:\Windows\System\ChSSzjf.exe
  C:\Windows\System\ChSSzjf.exe
  2⤵
  PID:8104
- C:\Windows\System\mpOeRpk.exe
  C:\Windows\System\mpOeRpk.exe
  2⤵
  PID:7264
- C:\Windows\System\ibsFaGr.exe
  C:\Windows\System\ibsFaGr.exe
  2⤵
  PID:7392
- C:\Windows\System\vqeIXZd.exe
  C:\Windows\System\vqeIXZd.exe
  2⤵
  PID:7312
- C:\Windows\System\DLhjWLm.exe
  C:\Windows\System\DLhjWLm.exe
  2⤵
  PID:7452
- C:\Windows\System\lFcsjfu.exe
  C:\Windows\System\lFcsjfu.exe
  2⤵
  PID:8148
- C:\Windows\System\jQkVTsM.exe
  C:\Windows\System\jQkVTsM.exe
  2⤵
  PID:8180
- C:\Windows\System\SHZRfOA.exe
  C:\Windows\System\SHZRfOA.exe
  2⤵
  PID:8184
- C:\Windows\System\vXWhhKe.exe
  C:\Windows\System\vXWhhKe.exe
  2⤵
  PID:7768
- C:\Windows\System\ySrRFPD.exe
  C:\Windows\System\ySrRFPD.exe
  2⤵
  PID:7504
- C:\Windows\System\rEpImqn.exe
  C:\Windows\System\rEpImqn.exe
  2⤵
  PID:7620
- C:\Windows\System\rtEHIgQ.exe
  C:\Windows\System\rtEHIgQ.exe
  2⤵
  PID:7744
- C:\Windows\System\DhYDSzm.exe
  C:\Windows\System\DhYDSzm.exe
  2⤵
  PID:7760
- C:\Windows\System\hbWJuQG.exe
  C:\Windows\System\hbWJuQG.exe
  2⤵
  PID:7848
- C:\Windows\System\xAiFpiR.exe
  C:\Windows\System\xAiFpiR.exe
  2⤵
  PID:7888
- C:\Windows\System\pBBFaCh.exe
  C:\Windows\System\pBBFaCh.exe
  2⤵
  PID:7864
- C:\Windows\System\CyrUJZq.exe
  C:\Windows\System\CyrUJZq.exe
  2⤵
  PID:7920
- C:\Windows\System\SSWSeZd.exe
  C:\Windows\System\SSWSeZd.exe
  2⤵
  PID:7964
- C:\Windows\System\BuvSyxS.exe
  C:\Windows\System\BuvSyxS.exe
  2⤵
  PID:8100
- C:\Windows\System\AnaOamC.exe
  C:\Windows\System\AnaOamC.exe
  2⤵
  PID:7448
- C:\Windows\System\EHcxPom.exe
  C:\Windows\System\EHcxPom.exe
  2⤵
  PID:7536
- C:\Windows\System\GqFydra.exe
  C:\Windows\System\GqFydra.exe
  2⤵
  PID:8136
- C:\Windows\System\lwcmCcH.exe
  C:\Windows\System\lwcmCcH.exe
  2⤵
  PID:7728
- C:\Windows\System\qpCYJYm.exe
  C:\Windows\System\qpCYJYm.exe
  2⤵
  PID:7936
- C:\Windows\System\ZgOolDN.exe
  C:\Windows\System\ZgOolDN.exe
  2⤵
  PID:7616
- C:\Windows\System\sOZiajA.exe
  C:\Windows\System\sOZiajA.exe
  2⤵
  PID:7568
- C:\Windows\System\LkfloDo.exe
  C:\Windows\System\LkfloDo.exe
  2⤵
  PID:8016
- C:\Windows\System\sqrWiYV.exe
  C:\Windows\System\sqrWiYV.exe
  2⤵
  PID:7984
- C:\Windows\System\bcybzLW.exe
  C:\Windows\System\bcybzLW.exe
  2⤵
  PID:8008
- C:\Windows\System\EUpwrZt.exe
  C:\Windows\System\EUpwrZt.exe
  2⤵
  PID:8116
- C:\Windows\System\nTlBmWY.exe
  C:\Windows\System\nTlBmWY.exe
  2⤵
  PID:7248
- C:\Windows\System\FrQHOlT.exe
  C:\Windows\System\FrQHOlT.exe
  2⤵
  PID:8164
- C:\Windows\System\HbuGYWP.exe
  C:\Windows\System\HbuGYWP.exe
  2⤵
  PID:7980
- C:\Windows\System\xpMKqyC.exe
  C:\Windows\System\xpMKqyC.exe
  2⤵
  PID:7632
- C:\Windows\System\OzBSvdG.exe
  C:\Windows\System\OzBSvdG.exe
  2⤵
  PID:7812
- C:\Windows\System\lmLYCuC.exe
  C:\Windows\System\lmLYCuC.exe
  2⤵
  PID:8084
- C:\Windows\System\dVhDnxA.exe
  C:\Windows\System\dVhDnxA.exe
  2⤵
  PID:7228
- C:\Windows\System\tAvLeZZ.exe
  C:\Windows\System\tAvLeZZ.exe
  2⤵
  PID:6916
- C:\Windows\System\glEzkZq.exe
  C:\Windows\System\glEzkZq.exe
  2⤵
  PID:7588
- C:\Windows\System\tuDxdla.exe
  C:\Windows\System\tuDxdla.exe
  2⤵
  PID:7968
- C:\Windows\System\FQCsoop.exe
  C:\Windows\System\FQCsoop.exe
  2⤵
  PID:7832
- C:\Windows\System\gEbsLYK.exe
  C:\Windows\System\gEbsLYK.exe
  2⤵
  PID:7276
- C:\Windows\System\RDXDaBw.exe
  C:\Windows\System\RDXDaBw.exe
  2⤵
  PID:8208
- C:\Windows\System\PPwbrHF.exe
  C:\Windows\System\PPwbrHF.exe
  2⤵
  PID:8236
- C:\Windows\System\WGzuIQV.exe
  C:\Windows\System\WGzuIQV.exe
  2⤵
  PID:8256
- C:\Windows\System\UedJLmu.exe
  C:\Windows\System\UedJLmu.exe
  2⤵
  PID:8272
- C:\Windows\System\jcKWlcy.exe
  C:\Windows\System\jcKWlcy.exe
  2⤵
  PID:8288
- C:\Windows\System\sRzIgCY.exe
  C:\Windows\System\sRzIgCY.exe
  2⤵
  PID:8304
- C:\Windows\System\fjAxRVZ.exe
  C:\Windows\System\fjAxRVZ.exe
  2⤵
  PID:8320
- C:\Windows\System\ejCTUKe.exe
  C:\Windows\System\ejCTUKe.exe
  2⤵
  PID:8336
- C:\Windows\System\eFZvVvc.exe
  C:\Windows\System\eFZvVvc.exe
  2⤵
  PID:8352
- C:\Windows\System\KxQOBDv.exe
  C:\Windows\System\KxQOBDv.exe
  2⤵
  PID:8368
- C:\Windows\System\earqIKT.exe
  C:\Windows\System\earqIKT.exe
  2⤵
  PID:8384
- C:\Windows\System\hzWkeGp.exe
  C:\Windows\System\hzWkeGp.exe
  2⤵
  PID:8400
- C:\Windows\System\HoXCpny.exe
  C:\Windows\System\HoXCpny.exe
  2⤵
  PID:8416
- C:\Windows\System\sWrPncF.exe
  C:\Windows\System\sWrPncF.exe
  2⤵
  PID:8432
- C:\Windows\System\cPaNHAe.exe
  C:\Windows\System\cPaNHAe.exe
  2⤵
  PID:8448
- C:\Windows\System\XwBdFzs.exe
  C:\Windows\System\XwBdFzs.exe
  2⤵
  PID:8464
- C:\Windows\System\ZrXowoH.exe
  C:\Windows\System\ZrXowoH.exe
  2⤵
  PID:8480
- C:\Windows\System\IQqXNuW.exe
  C:\Windows\System\IQqXNuW.exe
  2⤵
  PID:8508
- C:\Windows\System\GkhFJqY.exe
  C:\Windows\System\GkhFJqY.exe
  2⤵
  PID:8528
- C:\Windows\System\lPYFCac.exe
  C:\Windows\System\lPYFCac.exe
  2⤵
  PID:8548
- C:\Windows\System\GwwiXrS.exe
  C:\Windows\System\GwwiXrS.exe
  2⤵
  PID:8564
- C:\Windows\System\uGwlKKe.exe
  C:\Windows\System\uGwlKKe.exe
  2⤵
  PID:8580
- C:\Windows\System\MrsqxsN.exe
  C:\Windows\System\MrsqxsN.exe
  2⤵
  PID:8596
- C:\Windows\System\bdpGLyO.exe
  C:\Windows\System\bdpGLyO.exe
  2⤵
  PID:8612
- C:\Windows\System\MWaDDBD.exe
  C:\Windows\System\MWaDDBD.exe
  2⤵
  PID:8632
- C:\Windows\System\YGLZZPw.exe
  C:\Windows\System\YGLZZPw.exe
  2⤵
  PID:8648
- C:\Windows\System\pxhCNAg.exe
  C:\Windows\System\pxhCNAg.exe
  2⤵
  PID:8664
- C:\Windows\System\VvUwQVH.exe
  C:\Windows\System\VvUwQVH.exe
  2⤵
  PID:8680
- C:\Windows\System\PARYHql.exe
  C:\Windows\System\PARYHql.exe
  2⤵
  PID:8696
- C:\Windows\System\QJwDfnn.exe
  C:\Windows\System\QJwDfnn.exe
  2⤵
  PID:8712
- C:\Windows\System\vwihRQU.exe
  C:\Windows\System\vwihRQU.exe
  2⤵
  PID:8728
- C:\Windows\System\ftAVrXS.exe
  C:\Windows\System\ftAVrXS.exe
  2⤵
  PID:8744
- C:\Windows\System\xkiaEjz.exe
  C:\Windows\System\xkiaEjz.exe
  2⤵
  PID:8760
- C:\Windows\System\VFysXVL.exe
  C:\Windows\System\VFysXVL.exe
  2⤵
  PID:8776
- C:\Windows\System\jibNsSt.exe
  C:\Windows\System\jibNsSt.exe
  2⤵
  PID:8792
- C:\Windows\System\agFTDVW.exe
  C:\Windows\System\agFTDVW.exe
  2⤵
  PID:8808
- C:\Windows\System\BkjSmHk.exe
  C:\Windows\System\BkjSmHk.exe
  2⤵
  PID:8824
- C:\Windows\System\PfyimZR.exe
  C:\Windows\System\PfyimZR.exe
  2⤵
  PID:8840
- C:\Windows\System\AbaBQbM.exe
  C:\Windows\System\AbaBQbM.exe
  2⤵
  PID:8856
- C:\Windows\System\lOZEzJc.exe
  C:\Windows\System\lOZEzJc.exe
  2⤵
  PID:8912
- C:\Windows\System\vRFWBsq.exe
  C:\Windows\System\vRFWBsq.exe
  2⤵
  PID:8932
- C:\Windows\System\qnEYGvb.exe
  C:\Windows\System\qnEYGvb.exe
  2⤵
  PID:8948
- C:\Windows\System\DjVUFWy.exe
  C:\Windows\System\DjVUFWy.exe
  2⤵
  PID:8984
- C:\Windows\System\dqXaEpg.exe
  C:\Windows\System\dqXaEpg.exe
  2⤵
  PID:9012
- C:\Windows\System\KvyjBwl.exe
  C:\Windows\System\KvyjBwl.exe
  2⤵
  PID:9032
- C:\Windows\System\AJKeGNS.exe
  C:\Windows\System\AJKeGNS.exe
  2⤵
  PID:9048
- C:\Windows\System\OkTZHsU.exe
  C:\Windows\System\OkTZHsU.exe
  2⤵
  PID:9072
- C:\Windows\System\FcODgIr.exe
  C:\Windows\System\FcODgIr.exe
  2⤵
  PID:9088
- C:\Windows\System\OBiCzzM.exe
  C:\Windows\System\OBiCzzM.exe
  2⤵
  PID:9104
- C:\Windows\System\ZnHZssu.exe
  C:\Windows\System\ZnHZssu.exe
  2⤵
  PID:9120
- C:\Windows\System\NsYWTIA.exe
  C:\Windows\System\NsYWTIA.exe
  2⤵
  PID:9144
- C:\Windows\System\iqblhlW.exe
  C:\Windows\System\iqblhlW.exe
  2⤵
  PID:9160
- C:\Windows\System\zCOewcv.exe
  C:\Windows\System\zCOewcv.exe
  2⤵
  PID:9176
- C:\Windows\System\ZPGMxNM.exe
  C:\Windows\System\ZPGMxNM.exe
  2⤵
  PID:9192
- C:\Windows\System\UBZZCzf.exe
  C:\Windows\System\UBZZCzf.exe
  2⤵
  PID:9212
- C:\Windows\System\AmjEfql.exe
  C:\Windows\System\AmjEfql.exe
  2⤵
  PID:7180
- C:\Windows\System\AKlIiGx.exe
  C:\Windows\System\AKlIiGx.exe
  2⤵
  PID:8224
- C:\Windows\System\nogqmjG.exe
  C:\Windows\System\nogqmjG.exe
  2⤵
  PID:8056
- C:\Windows\System\xalRtiL.exe
  C:\Windows\System\xalRtiL.exe
  2⤵
  PID:8244
- C:\Windows\System\EYAGCrr.exe
  C:\Windows\System\EYAGCrr.exe
  2⤵
  PID:8268
- C:\Windows\System\NvssGNT.exe
  C:\Windows\System\NvssGNT.exe
  2⤵
  PID:8332
- C:\Windows\System\nQkEucl.exe
  C:\Windows\System\nQkEucl.exe
  2⤵
  PID:8252
- C:\Windows\System\tqCqjSj.exe
  C:\Windows\System\tqCqjSj.exe
  2⤵
  PID:8424
- C:\Windows\System\bGGxEcL.exe
  C:\Windows\System\bGGxEcL.exe
  2⤵
  PID:8460
- C:\Windows\System\OycRYJW.exe
  C:\Windows\System\OycRYJW.exe
  2⤵
  PID:8412
- C:\Windows\System\NaMEepq.exe
  C:\Windows\System\NaMEepq.exe
  2⤵
  PID:8316
- C:\Windows\System\dvpoutf.exe
  C:\Windows\System\dvpoutf.exe
  2⤵
  PID:8472
- C:\Windows\System\hYxMKMZ.exe
  C:\Windows\System\hYxMKMZ.exe
  2⤵
  PID:8496
- C:\Windows\System\RwsHqRP.exe
  C:\Windows\System\RwsHqRP.exe
  2⤵
  PID:8572
- C:\Windows\System\sONHPJt.exe
  C:\Windows\System\sONHPJt.exe
  2⤵
  PID:8536
- C:\Windows\System\nrUqoEV.exe
  C:\Windows\System\nrUqoEV.exe
  2⤵
  PID:8672
- C:\Windows\System\FAwvqge.exe
  C:\Windows\System\FAwvqge.exe
  2⤵
  PID:8740
- C:\Windows\System\gitpRoz.exe
  C:\Windows\System\gitpRoz.exe
  2⤵
  PID:8800
- C:\Windows\System\taVOWek.exe
  C:\Windows\System\taVOWek.exe
  2⤵
  PID:8520
- C:\Windows\System\QoBRdsn.exe
  C:\Windows\System\QoBRdsn.exe
  2⤵
  PID:8624
- C:\Windows\System\NiMDAdg.exe
  C:\Windows\System\NiMDAdg.exe
  2⤵
  PID:8692
- C:\Windows\System\FxhFVyF.exe
  C:\Windows\System\FxhFVyF.exe
  2⤵
  PID:8784
- C:\Windows\System\juZplCk.exe
  C:\Windows\System\juZplCk.exe
  2⤵
  PID:8720
- C:\Windows\System\mtiQPTZ.exe
  C:\Windows\System\mtiQPTZ.exe
  2⤵
  PID:8820
- C:\Windows\System\rqberVe.exe
  C:\Windows\System\rqberVe.exe
  2⤵
  PID:8944
- C:\Windows\System\RibYZvE.exe
  C:\Windows\System\RibYZvE.exe
  2⤵
  PID:8992
- C:\Windows\System\sUHIrrV.exe
  C:\Windows\System\sUHIrrV.exe
  2⤵
  PID:9008
- C:\Windows\System\sEJNGBx.exe
  C:\Windows\System\sEJNGBx.exe
  2⤵
  PID:9084
- C:\Windows\System\mutIxEI.exe
  C:\Windows\System\mutIxEI.exe
  2⤵
  PID:9156
- C:\Windows\System\FimzVCc.exe
  C:\Windows\System\FimzVCc.exe
  2⤵
  PID:7436
- C:\Windows\System\TAzVkmh.exe
  C:\Windows\System\TAzVkmh.exe
  2⤵
  PID:8264
- C:\Windows\System\XtBFDvI.exe
  C:\Windows\System\XtBFDvI.exe
  2⤵
  PID:8408
- C:\Windows\System\qcGqtxN.exe
  C:\Windows\System\qcGqtxN.exe
  2⤵
  PID:8736
- C:\Windows\System\hhFOaMx.exe
  C:\Windows\System\hhFOaMx.exe
  2⤵
  PID:8836
- C:\Windows\System\rJstnrg.exe
  C:\Windows\System\rJstnrg.exe
  2⤵
  PID:8660
- C:\Windows\System\ugqsOsY.exe
  C:\Windows\System\ugqsOsY.exe
  2⤵
  PID:8892
- C:\Windows\System\WCVlTmh.exe
  C:\Windows\System\WCVlTmh.exe
  2⤵
  PID:8560
- C:\Windows\System\dnpjgEb.exe
  C:\Windows\System\dnpjgEb.exe
  2⤵
  PID:9100
- C:\Windows\System\pYwIAba.exe
  C:\Windows\System\pYwIAba.exe
  2⤵
  PID:8908
- C:\Windows\System\IvNEJEm.exe
  C:\Windows\System\IvNEJEm.exe
  2⤵
  PID:8924
- C:\Windows\System\NvZWQYm.exe
  C:\Windows\System\NvZWQYm.exe
  2⤵
  PID:8964
- C:\Windows\System\DBjvcXV.exe
  C:\Windows\System\DBjvcXV.exe
  2⤵
  PID:9024
- C:\Windows\System\eQTtjfL.exe
  C:\Windows\System\eQTtjfL.exe
  2⤵
  PID:9060
- C:\Windows\System\ynPQPcf.exe
  C:\Windows\System\ynPQPcf.exe
  2⤵
  PID:8880
- C:\Windows\System\nTnqScd.exe
  C:\Windows\System\nTnqScd.exe
  2⤵
  PID:9152
- C:\Windows\System\rXCGfRb.exe
  C:\Windows\System\rXCGfRb.exe
  2⤵
  PID:9168
- C:\Windows\System\ZyAhEIz.exe
  C:\Windows\System\ZyAhEIz.exe
  2⤵
  PID:8644
- C:\Windows\System\QvLyiHL.exe
  C:\Windows\System\QvLyiHL.exe
  2⤵
  PID:8620
- C:\Windows\System\aVbfDZd.exe
  C:\Windows\System\aVbfDZd.exe
  2⤵
  PID:8200
- C:\Windows\System\VqUNhzZ.exe
  C:\Windows\System\VqUNhzZ.exe
  2⤵
  PID:8864
- C:\Windows\System\TmBnSZU.exe
  C:\Windows\System\TmBnSZU.exe
  2⤵
  PID:8904
- C:\Windows\System\bpniUEM.exe
  C:\Windows\System\bpniUEM.exe
  2⤵
  PID:8884
- C:\Windows\System\XPVklDh.exe
  C:\Windows\System\XPVklDh.exe
  2⤵
  PID:9080
- C:\Windows\System\Fefknlc.exe
  C:\Windows\System\Fefknlc.exe
  2⤵
  PID:8816
- C:\Windows\System\nSKaZcp.exe
  C:\Windows\System\nSKaZcp.exe
  2⤵
  PID:8312
- C:\Windows\System\FDnalOw.exe
  C:\Windows\System\FDnalOw.exe
  2⤵
  PID:8888
- C:\Windows\System\UJOBqez.exe
  C:\Windows\System\UJOBqez.exe
  2⤵
  PID:9064
- C:\Windows\System\DKiVPhC.exe
  C:\Windows\System\DKiVPhC.exe
  2⤵
  PID:9204
- C:\Windows\System\UjiGfOY.exe
  C:\Windows\System\UjiGfOY.exe
  2⤵
  PID:8504
- C:\Windows\System\LZyfOQx.exe
  C:\Windows\System\LZyfOQx.exe
  2⤵
  PID:8392
- C:\Windows\System\nCqoGJW.exe
  C:\Windows\System\nCqoGJW.exe
  2⤵
  PID:8376
- C:\Windows\System\lYRMJLX.exe
  C:\Windows\System\lYRMJLX.exe
  2⤵
  PID:8592
- C:\Windows\System\FIhoxlk.exe
  C:\Windows\System\FIhoxlk.exe
  2⤵
  PID:9188
- C:\Windows\System\yKIBryc.exe
  C:\Windows\System\yKIBryc.exe
  2⤵
  PID:8588
- C:\Windows\System\bnLeSTY.exe
  C:\Windows\System\bnLeSTY.exe
  2⤵
  PID:9028
- C:\Windows\System\JamhdyK.exe
  C:\Windows\System\JamhdyK.exe
  2⤵
  PID:8396
- C:\Windows\System\XlHoZJe.exe
  C:\Windows\System\XlHoZJe.exe
  2⤵
  PID:8772
- C:\Windows\System\YTOiVyh.exe
  C:\Windows\System\YTOiVyh.exe
  2⤵
  PID:8456
- C:\Windows\System\KiBaTUf.exe
  C:\Windows\System\KiBaTUf.exe
  2⤵
  PID:9000
- C:\Windows\System\DIspgrt.exe
  C:\Windows\System\DIspgrt.exe
  2⤵
  PID:8220
- C:\Windows\System\otPSEtG.exe
  C:\Windows\System\otPSEtG.exe
  2⤵
  PID:8300
- C:\Windows\System\UzArUAG.exe
  C:\Windows\System\UzArUAG.exe
  2⤵
  PID:9172
- C:\Windows\System\sIMBxOi.exe
  C:\Windows\System\sIMBxOi.exe
  2⤵
  PID:8020
- C:\Windows\System\hqZYeES.exe
  C:\Windows\System\hqZYeES.exe
  2⤵
  PID:8216
- C:\Windows\System\IBjJxQY.exe
  C:\Windows\System\IBjJxQY.exe
  2⤵
  PID:8540
- C:\Windows\System\sifZSJF.exe
  C:\Windows\System\sifZSJF.exe
  2⤵
  PID:8544
- C:\Windows\System\abjdliD.exe
  C:\Windows\System\abjdliD.exe
  2⤵
  PID:9232
- C:\Windows\System\trRrasR.exe
  C:\Windows\System\trRrasR.exe
  2⤵
  PID:9248
- C:\Windows\System\TjvxzjV.exe
  C:\Windows\System\TjvxzjV.exe
  2⤵
  PID:9264
- C:\Windows\System\qvOPagr.exe
  C:\Windows\System\qvOPagr.exe
  2⤵
  PID:9280
- C:\Windows\System\DgGjMsL.exe
  C:\Windows\System\DgGjMsL.exe
  2⤵
  PID:9296
- C:\Windows\System\CXuJiEW.exe
  C:\Windows\System\CXuJiEW.exe
  2⤵
  PID:9312
- C:\Windows\System\rbtCkXC.exe
  C:\Windows\System\rbtCkXC.exe
  2⤵
  PID:9328
- C:\Windows\System\JorObJT.exe
  C:\Windows\System\JorObJT.exe
  2⤵
  PID:9344
- C:\Windows\System\pmaovKa.exe
  C:\Windows\System\pmaovKa.exe
  2⤵
  PID:9360
- C:\Windows\System\pudUhZE.exe
  C:\Windows\System\pudUhZE.exe
  2⤵
  PID:9376
- C:\Windows\System\FjgKIYX.exe
  C:\Windows\System\FjgKIYX.exe
  2⤵
  PID:9392
- C:\Windows\System\quFwHsR.exe
  C:\Windows\System\quFwHsR.exe
  2⤵
  PID:9408
- C:\Windows\System\gqQshcc.exe
  C:\Windows\System\gqQshcc.exe
  2⤵
  PID:9424
- C:\Windows\System\dGsyFdf.exe
  C:\Windows\System\dGsyFdf.exe
  2⤵
  PID:9440
- C:\Windows\System\KbEMexN.exe
  C:\Windows\System\KbEMexN.exe
  2⤵
  PID:9456
- C:\Windows\System\iSmjSDd.exe
  C:\Windows\System\iSmjSDd.exe
  2⤵
  PID:9472
- C:\Windows\System\EOmomlD.exe
  C:\Windows\System\EOmomlD.exe
  2⤵
  PID:9488
- C:\Windows\System\xMPIuJK.exe
  C:\Windows\System\xMPIuJK.exe
  2⤵
  PID:9504
- C:\Windows\System\dIyInVi.exe
  C:\Windows\System\dIyInVi.exe
  2⤵
  PID:9520
- C:\Windows\System\otplgWf.exe
  C:\Windows\System\otplgWf.exe
  2⤵
  PID:9536
- C:\Windows\System\HyOqXEN.exe
  C:\Windows\System\HyOqXEN.exe
  2⤵
  PID:9552
- C:\Windows\System\OWsUzxa.exe
  C:\Windows\System\OWsUzxa.exe
  2⤵
  PID:9568
- C:\Windows\System\gQCVcgB.exe
  C:\Windows\System\gQCVcgB.exe
  2⤵
  PID:9584
- C:\Windows\System\LgTDVwv.exe
  C:\Windows\System\LgTDVwv.exe
  2⤵
  PID:9600
- C:\Windows\System\SSbYrPr.exe
  C:\Windows\System\SSbYrPr.exe
  2⤵
  PID:9616
- C:\Windows\System\ARwqckp.exe
  C:\Windows\System\ARwqckp.exe
  2⤵
  PID:9632
- C:\Windows\System\rZxekSK.exe
  C:\Windows\System\rZxekSK.exe
  2⤵
  PID:9652
- C:\Windows\System\TqSDBBi.exe
  C:\Windows\System\TqSDBBi.exe
  2⤵
  PID:9668
- C:\Windows\System\MFLqpyn.exe
  C:\Windows\System\MFLqpyn.exe
  2⤵
  PID:9684
- C:\Windows\System\tsoJGhP.exe
  C:\Windows\System\tsoJGhP.exe
  2⤵
  PID:9700
- C:\Windows\System\ASLeaDv.exe
  C:\Windows\System\ASLeaDv.exe
  2⤵
  PID:9716
- C:\Windows\System\NqAurOY.exe
  C:\Windows\System\NqAurOY.exe
  2⤵
  PID:9732
- C:\Windows\System\vyHgfzP.exe
  C:\Windows\System\vyHgfzP.exe
  2⤵
  PID:9748
- C:\Windows\System\WmlmvAL.exe
  C:\Windows\System\WmlmvAL.exe
  2⤵
  PID:9764
- C:\Windows\System\TaeiMKQ.exe
  C:\Windows\System\TaeiMKQ.exe
  2⤵
  PID:9780
- C:\Windows\System\VTGrJbL.exe
  C:\Windows\System\VTGrJbL.exe
  2⤵
  PID:9796
- C:\Windows\System\YygRCLF.exe
  C:\Windows\System\YygRCLF.exe
  2⤵
  PID:9812
- C:\Windows\System\zUMzXMO.exe
  C:\Windows\System\zUMzXMO.exe
  2⤵
  PID:9828
- C:\Windows\System\BVMVhoO.exe
  C:\Windows\System\BVMVhoO.exe
  2⤵
  PID:9844
- C:\Windows\System\arVTlcY.exe
  C:\Windows\System\arVTlcY.exe
  2⤵
  PID:9860
- C:\Windows\System\xGskbtc.exe
  C:\Windows\System\xGskbtc.exe
  2⤵
  PID:9876
- C:\Windows\System\lEaFJHc.exe
  C:\Windows\System\lEaFJHc.exe
  2⤵
  PID:9892
- C:\Windows\System\ZEDMGkG.exe
  C:\Windows\System\ZEDMGkG.exe
  2⤵
  PID:9908
- C:\Windows\System\JaNEvpI.exe
  C:\Windows\System\JaNEvpI.exe
  2⤵
  PID:9924
- C:\Windows\System\MBgHEZc.exe
  C:\Windows\System\MBgHEZc.exe
  2⤵
  PID:9940
- C:\Windows\System\lJLWhLj.exe
  C:\Windows\System\lJLWhLj.exe
  2⤵
  PID:9956
- C:\Windows\System\kSMGwli.exe
  C:\Windows\System\kSMGwli.exe
  2⤵
  PID:9972
- C:\Windows\System\NvpSeAQ.exe
  C:\Windows\System\NvpSeAQ.exe
  2⤵
  PID:9988
- C:\Windows\System\UXaeUIw.exe
  C:\Windows\System\UXaeUIw.exe
  2⤵
  PID:10088
- C:\Windows\System\VdPpGwj.exe
  C:\Windows\System\VdPpGwj.exe
  2⤵
  PID:10104
- C:\Windows\System\UDxtrAS.exe
  C:\Windows\System\UDxtrAS.exe
  2⤵
  PID:10120
- C:\Windows\System\CmVOZia.exe
  C:\Windows\System\CmVOZia.exe
  2⤵
  PID:10136
- C:\Windows\System\xuHdadc.exe
  C:\Windows\System\xuHdadc.exe
  2⤵
  PID:10156
- C:\Windows\System\hUsfDxa.exe
  C:\Windows\System\hUsfDxa.exe
  2⤵
  PID:10172
- C:\Windows\System\luBPAAn.exe
  C:\Windows\System\luBPAAn.exe
  2⤵
  PID:10188
- C:\Windows\System\DqAwmJB.exe
  C:\Windows\System\DqAwmJB.exe
  2⤵
  PID:10204
- C:\Windows\System\UxjtCPS.exe
  C:\Windows\System\UxjtCPS.exe
  2⤵
  PID:10220
- C:\Windows\System\jLmWalc.exe
  C:\Windows\System\jLmWalc.exe
  2⤵
  PID:10236
- C:\Windows\System\hKOpMiy.exe
  C:\Windows\System\hKOpMiy.exe
  2⤵
  PID:9224
- C:\Windows\System\zEwUWTm.exe
  C:\Windows\System\zEwUWTm.exe
  2⤵
  PID:9244
- C:\Windows\System\qBXiasV.exe
  C:\Windows\System\qBXiasV.exe
  2⤵
  PID:9276
- C:\Windows\System\tTraLqg.exe
  C:\Windows\System\tTraLqg.exe
  2⤵
  PID:9324
- C:\Windows\System\tHcawMy.exe
  C:\Windows\System\tHcawMy.exe
  2⤵
  PID:9384
- C:\Windows\System\vZSfnEJ.exe
  C:\Windows\System\vZSfnEJ.exe
  2⤵
  PID:9480
- C:\Windows\System\ioEsDWg.exe
  C:\Windows\System\ioEsDWg.exe
  2⤵
  PID:9516
- C:\Windows\System\DFNIGrH.exe
  C:\Windows\System\DFNIGrH.exe
  2⤵
  PID:9548
- C:\Windows\System\jGiBeFD.exe
  C:\Windows\System\jGiBeFD.exe
  2⤵
  PID:9640
- C:\Windows\System\iKzQZFc.exe
  C:\Windows\System\iKzQZFc.exe
  2⤵
  PID:9404
- C:\Windows\System\KYuUhkQ.exe
  C:\Windows\System\KYuUhkQ.exe
  2⤵
  PID:9468
- C:\Windows\System\IGUfNrC.exe
  C:\Windows\System\IGUfNrC.exe
  2⤵
  PID:9660
- C:\Windows\System\BbInNAY.exe
  C:\Windows\System\BbInNAY.exe
  2⤵
  PID:9840
- C:\Windows\System\StCRDhx.exe
  C:\Windows\System\StCRDhx.exe
  2⤵
  PID:9904
- C:\Windows\System\xvubsDG.exe
  C:\Windows\System\xvubsDG.exe
  2⤵
  PID:9884
- C:\Windows\System\emYEdKM.exe
  C:\Windows\System\emYEdKM.exe
  2⤵
  PID:9852
- C:\Windows\System\DyvlakP.exe
  C:\Windows\System\DyvlakP.exe
  2⤵
  PID:9964
- C:\Windows\System\bmuzKxS.exe
  C:\Windows\System\bmuzKxS.exe
  2⤵
  PID:9996
- C:\Windows\System\XuAVjvL.exe
  C:\Windows\System\XuAVjvL.exe
  2⤵
  PID:10032
- C:\Windows\System\gwZnhqK.exe
  C:\Windows\System\gwZnhqK.exe
  2⤵
  PID:10020
- C:\Windows\System\BeyQnFi.exe
  C:\Windows\System\BeyQnFi.exe
  2⤵
  PID:10056
- C:\Windows\System\stLzOEz.exe
  C:\Windows\System\stLzOEz.exe
  2⤵
  PID:10068
- C:\Windows\System\hgEzpNx.exe
  C:\Windows\System\hgEzpNx.exe
  2⤵
  PID:10084
- C:\Windows\System\jwSaXWM.exe
  C:\Windows\System\jwSaXWM.exe
  2⤵
  PID:10128
- C:\Windows\System\yZCwEsa.exe
  C:\Windows\System\yZCwEsa.exe
  2⤵
  PID:10196
- C:\Windows\System\PpYSFab.exe
  C:\Windows\System\PpYSFab.exe
  2⤵
  PID:10072
- C:\Windows\System\KjRTEtF.exe
  C:\Windows\System\KjRTEtF.exe
  2⤵
  PID:10232
- C:\Windows\System\PYUrNax.exe
  C:\Windows\System\PYUrNax.exe
  2⤵
  PID:9292
- C:\Windows\System\qqMWVRq.exe
  C:\Windows\System\qqMWVRq.exe
  2⤵
  PID:10228
- C:\Windows\System\MNZlJyd.exe
  C:\Windows\System\MNZlJyd.exe
  2⤵
  PID:10144
- C:\Windows\System\KnZuwqL.exe
  C:\Windows\System\KnZuwqL.exe
  2⤵
  PID:9452
- C:\Windows\System\sidJfhM.exe
  C:\Windows\System\sidJfhM.exe
  2⤵
  PID:9580
- C:\Windows\System\cPWTYZu.exe
  C:\Windows\System\cPWTYZu.exe
  2⤵
  PID:9448
- C:\Windows\System\wsSWMbS.exe
  C:\Windows\System\wsSWMbS.exe
  2⤵
  PID:9500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DGVxCQj.exe

Filesize
1.6MB

MD5
ddc99330ef2dffcb4a73b160767ba6d2

SHA1
0f76e7d8582b9048ee7628f8549591e666f0bef6

SHA256
fdd6d322031e0c75341708f1981ade0d059c527a2c5a1cdc87a3bfaabb3c40af

SHA512
d56a1d14d13da761b7479205013aba85f9e136ef1e157ae1c41608afe78aa18ed216d0223a3a864c6d2b7d9f2347fb0994b71acab2d23853c7266533d5126131

Download Submit
C:\Windows\system\JAHKhqW.exe

Filesize
1.6MB

MD5
d268775d21aa988eb1528b9967b814e9

SHA1
fac263e963b3f3ce7b5fd782ee2d663884525b28

SHA256
c695237639cfab26547a83e986b89f9f92d4f8e267c825e47bba9d5e5b9804e0

SHA512
e45a61c217667a3af8fac580e82738470fb6f303743541731e3070feb0099a3ef4a2fbaeed3bad4a8bf2c57359ff8bc1db7f923cf54400e055af15d6b9fc4080

Download Submit
C:\Windows\system\JnafSSi.exe

Filesize
1.6MB

MD5
85f229c60e1b9a9a3598219a4c5b1899

SHA1
96903284a8ef5e93bb7a6bfde5cfc856725b22e1

SHA256
e30d4407a0cb3f0bd3a9f1b04634d7d2082e10b4706a2e1d14c50f6b7bd70eca

SHA512
2e496e7d2cf16e0cfeca19d95a619edcd6f1d7228a56ca00e7f5125a40ccf96989a4382ae72d69b80b14b92dc8cd06c48e64c7b9ee18ea00d74b6b8e979eecbf

Download Submit
C:\Windows\system\NKvjcKk.exe

Filesize
1.6MB

MD5
23bd0255254e129012bdc94be1b838da

SHA1
220296a950a9583525374f21cbf06c5cc846f235

SHA256
d00056dc4b61eeaca6b2879c02fdb87349ddfec6b2a042fceb1860d383d8f4be

SHA512
8865aaf7544cc47c0061e8977780f79397b79bb48fb5e65d10d852fd64b0e7f01e42177c63be242fefd6a77a220dcd5943d3aa200b664f8c2e717f78064cf48e

Download Submit
C:\Windows\system\NyXpVSb.exe

Filesize
1.6MB

MD5
15fbb45448e505d8e196fa752383c8cf

SHA1
81158e73e79f5ef61bfa85974d6d8e6baa023054

SHA256
4a51d2ac1220f39d2b3bd9c3fd28064b94d75d566a68a727f8819f4c42f3506d

SHA512
2552564343e79cd7e1fbe21b21bf42fcb3702b8380861f07115ee4cbf846f6eb1ca76c7b125c15bbb4e84f6720f12b6d5deaa5b167b51937a6737e756a914763

Download Submit
C:\Windows\system\QKLoSnF.exe

Filesize
1.6MB

MD5
cc05ec593172e85c0a6315e6a5d54c13

SHA1
c3a2b0a0a104e29b56a017915d62030eac6bc138

SHA256
ff406d0585cf73cb3ba4b9d7b4a1da357b7179b1180764655dc49832a9a153c2

SHA512
5955022e24e4ddc9ebe20c1ca56f0d9d3fb9b5e3adc7fb3efc0fee041bb85fec89bd4df9ecba5dd7c76db2ac12c3be40494ea3aafd17c91bcd9eddf141fe9df3

Download Submit
C:\Windows\system\XQkVRir.exe

Filesize
1.6MB

MD5
ec5f4fdae412cebcca4438773800e6b5

SHA1
90ebccc9f3426fd0d6b5b39a7de20f2103e9ab46

SHA256
c0b19b23b5879cb942507be93eb616d4c4e0363588436e885c2282f2fcf59608

SHA512
e06842b4c62e9c1522184fc33ed7646f73a519462aa303ac5a671ebfa87e8dc94ce529c767545a2673a91fe32522d3983e28edcf58a221e1e82c88d27bd089f9

Download Submit
C:\Windows\system\XtWUUdz.exe

Filesize
1.6MB

MD5
a164970b9c10abce35bceb66c2d6fd13

SHA1
41f2f9bfa9040806d0cc758f3f3f4912f29f4f4e

SHA256
dd59034a46c2c00b3dd30a905209cf276e649fba787cc077a5c818592d0ebc40

SHA512
b59ff25c83ac7073dc3c9e8be3a513d1f9ce6597b643a824de52da578d256dac5ca13c5e33d185f6d5930a43b408ef87c4e060c4d6d6ea6da8093cad4c9c7795

Download Submit
C:\Windows\system\ZZHBWxw.exe

Filesize
1.6MB

MD5
83a021336b9816fd823860c627f38858

SHA1
295bf7cf9b505bd737baab31082e73b455ed985d

SHA256
728302f8b16cb24ffe41b7e86c0aa70c19760aa2df4fa05fef04718f2a65428f

SHA512
6531820acf2cd4637c3fa40cfee734b546a0b7a2e3fae22940e43bb820a2f1c8ac27bc266134c6f2d1f0dfc756ff6a8c3c33f20e8f97f58a78de9778ff39905a

Download Submit
C:\Windows\system\eoHxbJd.exe

Filesize
1.6MB

MD5
96d935d20cbf7e0b118224745a2bfe89

SHA1
1488271e9febc046880d875ac6e5685c345748d1

SHA256
4d8305a05e8f65894560cec6fcf8bc6ba4b00361b6fcfb8702d3cafacaf72e98

SHA512
b72d8e7808bbb4b841e3d5d85aab4faf9c8993ebf3f309af4fab791f20814fb091c5569ad8a77b12fbb7d9991d9f3c8b1dd23be657c0eb6bbe2eb88c3e09b0e1

Download Submit
C:\Windows\system\kESQObX.exe

Filesize
1.6MB

MD5
4a02a6f458a6cba4871210ff72ffee50

SHA1
f40e4fa57a6b4418fed22f080b31943320907403

SHA256
35ee139f1efa1d00f76cf14ba79990f97aee1ddd0f05de28ec084e23ef957f5b

SHA512
0c733408644983b194a9d0be41a4da6dc770a12a712adfbf5b2ab47de5d7332538132a101cbfeffcda6ede5ffd9f951c8137c931823df56a614260b3c6961d8c

Download Submit
C:\Windows\system\kSjOhcl.exe

Filesize
1.6MB

MD5
f20c1960e5aa5369f888ee02e995b15f

SHA1
10ab4796a8a059ff17416367b38b3fc35b5c5009

SHA256
aa8066e39a27fd90961320cb4e8b78d428293a36ffbf0b070d17449acfb541d6

SHA512
0effebe91b8ecde241fca2f53dcb24436f631823c37da5913a713498a0f86267c3c0247cf1dfee369885ab575f5709b4e80abc045e12fb7bf7a178dbb0cf0025

Download Submit
C:\Windows\system\mFRwFTy.exe

Filesize
1.6MB

MD5
9051b58553e49dcc65b27ba49b64a954

SHA1
dcd1479aeb553b19b5f4ed929d21ef968e764438

SHA256
ec8d3292e262dd9252996dd70a2c00c65b242058d8109d979fd70c35b139cbad

SHA512
d5e6f5fb6a0c746680be391a2512dab52eb330ede239414e5a367b467066806b8bbeecacd6911577acba943c008bac93be7516f20995709ed9c17530b61ca1bb

Download Submit
C:\Windows\system\ooRkffl.exe

Filesize
1.6MB

MD5
adff5b94fa61260a403800aff6060003

SHA1
e62ae6dfd8d896c7229d3eff8e1473ce20ee2f1f

SHA256
90a160063d7aa0662529b9509d0bacf3a90b3e5c99843fec16b1268713148707

SHA512
1391ac18b272db4e9f9defb4382f4b80413b972c255f48807dfa7e9e92f6c3a8ee4820169d28a01e01ae44e4e5d98d7bd5ef09b78e0e9f38f7a5fe2cf3e2c308

Download Submit
C:\Windows\system\pNgxVyM.exe

Filesize
1.6MB

MD5
2b94e4fca742af21265d9251bbdd9307

SHA1
b17b71a44a3bca3776f3ed9a997c745b73b67c11

SHA256
0d20c2b699093e3773e62f5f3da4d08905c75f748378194989d74ff5d8f6bef9

SHA512
82bd3ad5a323d499b3ee3e2ae3b450983e982872e75193d26fc867a2db12b98d1162fbd0c08b84d1e7ee7cf390e8e5d93f1a43d5692698211c0e03f4107e7818

Download Submit
C:\Windows\system\rnZiCeb.exe

Filesize
1.6MB

MD5
af5615cc3a05f1bc82488ff059f6f750

SHA1
1c14a0d457d57f828949dddd72aaeb35906a87d2

SHA256
d79048ce839192cea27ff3f768e9713f5d79767fc245f44df6238bbb520c1aba

SHA512
dd235a82565f94a7858ddf6b550c21dd7b177396611a1b392e92fe8a06ccc48d232abeedaead045d3dfed48d72e4beeeaa5be33a89aa3d1f40210d4294ea4483

Download Submit
C:\Windows\system\wfYHLLJ.exe

Filesize
1.6MB

MD5
3d19349d30c04b79b3456867322634f6

SHA1
6fe73eb650e0c307b0c80591cb06c0b1c7036b3f

SHA256
683e6c6a0eb014fa4dc6236e15cf54bc569d5806c785443a3e37b66bb792788a

SHA512
5af2dcfb48b6e35aff64ad8dc44d206e4c94238f9cef26ecb4cba81c5f40940f8a3641c41adf5e932e0ae19807b1fdd0882d83d4f4d3c4127225a23061581083

Download Submit
C:\Windows\system\yzciRMs.exe

Filesize
1.6MB

MD5
ae368a1ed1544781f32aa55458dcb18e

SHA1
561fed070a7aac95abeb581fbffc2eebc39a2862

SHA256
164e1e24444cd59ef33e4d322fbec3ddb4972c03169b553334d7e4387dcd1f6c

SHA512
1d676cac6af5ad7c1761410b94828ff7126ab647b4706ac2134975440d1a34684e4a84c378032f32eca9c19b5cc5776600ed1115649d65421cbe319967438823

Download Submit
C:\Windows\system\zowCpMT.exe

Filesize
1.6MB

MD5
84cdd712aa4762d4016c13b01f38a9d3

SHA1
0afac46309771f259281d5226e9cc79f92c8ccc3

SHA256
265879feb874b8a458f936527b45e41abc3ade37ea895054da49b74a44b6d8c7

SHA512
ddf05ed8b53d766d57b491e93b12d22a683c1ef36652fca45616f8f44800c02c906236cc099dfc3739915feea6187206720d74e5e460c12dbd35c66242809453

Download Submit
\Windows\system\AwNwUkl.exe

Filesize
1.6MB

MD5
401534ae068c49a360f72a7c4dae62d3

SHA1
aeeb55e65414c71d26996d6d83ea914e607dbb4b

SHA256
1393741fdcbb857056fc351f06d0eddd7e3edef5d94b79425874540e7e28c813

SHA512
1c40e5f77fc96329e5dcee2f55221c9cab7ef290ac66ee0fbfff6102a77f639ba065a4c4037492c960dc235c9b8125015cb8fc2b298d52c0fff084764b38993f

Download Submit
\Windows\system\Dgdjiop.exe

Filesize
1.6MB

MD5
3b36899237139bcb15516ea127b14c77

SHA1
85d17af19ce393938cb1f17aa956be25c53fdaf5

SHA256
ae690ec1160f1bba74cd6374cc3370a703974d6810481638dc6a746fa32893bb

SHA512
1306d7bcd110f5fbc70d1f9be1cdebbfc22d525cce07d50e7ef2f2c1e4178cc5c2799955a45a6aede938cb693d17515b18a006677ce0adcdbeda4d6bb47bbf10

Download Submit
\Windows\system\MLUmIEy.exe

Filesize
1.6MB

MD5
34f232ef9f0f2b1fa90ad623f67c9aee

SHA1
5425fd85067f4e5a122bf605c67801eee5e8e6e3

SHA256
4fba4ceb65e90a676c897484e0f54e15c8d6588efff4afaf6172e02b54c0974c

SHA512
7bb07f136b793266a152a2b24e5bf439158ca1edfd17a21f04662aa12f2a0bbfe9cfc480b7491203bb225ecab5f4ecf0f24aedd08771fbbbb951495ed988962a

Download Submit
\Windows\system\NSGMkoW.exe

Filesize
1.6MB

MD5
13cf86e9d30ca0f72372f02ea7a8c055

SHA1
afc40407bbaaa3d041e77fc9b741d9309ee49eaa

SHA256
c7a84340942e1fea4ec55cb8952d9fce1cd0c3d419c7838018f06b4600c06941

SHA512
9e0f74a0f604edda72442e950c837df1df8a9238e85b8394c39445d2189fb1324124c2e5b76a7d6b8ea69435e23450141518cb5f6739b1559876bb92f0f77ac8

Download Submit
\Windows\system\OMEnjEV.exe

Filesize
1.6MB

MD5
16935a4ac12a28007584afb074a0e9b0

SHA1
415b7f6a4f66e9946b358564360f5ffeb07286de

SHA256
eec49d56ce67b831283368c702266fe9aa1dd67e47024f4d1b2d30beb1582759

SHA512
1a04ad523bb31a47cd95aa8ae418c3dab3c92b9db004992b8e2ab20c154d9a726129cd328ae782ef6728143052dd7fd8f3b8c365c1f5e53eea0ba6731fcb52c4

Download Submit
\Windows\system\Oexfqtm.exe

Filesize
1.6MB

MD5
a3532f274e8c652855c4a96a979b745d

SHA1
63524e09a37f9c21c6ea5829fd3cba76993bfd33

SHA256
b5bb105b1adac82741bad9f52a3594841d7b1260203c5530b0571c9b51bb7faf

SHA512
8210508ad1f02cb0a91fabb63eb1c62dfdd62a963a78803bda8f99e3e8036afdc7254500060537b737a4431d5face3153dbc14ca79448295c3905ee343641bca

Download Submit
\Windows\system\PsdHLbI.exe

Filesize
1.6MB

MD5
3ec3d5656910295bdcd27895775107de

SHA1
4a7bf7a01ac0fca97687bfa7ff3ad90f7c871d6b

SHA256
b43c10cefef80cab8e8a180a4996e68fbb1dfa94a53977497f621f0f893a1e4d

SHA512
718bf92fb22d1881efe13fa31b42258a496c6147a8a0898c9b3e4c99003e8af03728262297d0e6be057760c5622805700706bfa36af75f0da5c0fcd2a5d4f862

Download Submit
\Windows\system\RFRSZHA.exe

Filesize
1.6MB

MD5
cd161ad870abd79fe09710fdf8a3d49e

SHA1
4869ec4491d7cac66e87e6980812bb047b85bf6c

SHA256
dd07ab08ea2ae71104adc13f0c770b4a50b801938d5d633cbe5cd8b65745286e

SHA512
2766abba963ff7c4424dd9d16a88c2683a17fabb3cac7f29cc4e888003e3c48e02186202715b67841050af4c73527e8c5604ea99dd919636b10430c3084b6972

Download Submit
\Windows\system\TNKYLQz.exe

Filesize
1.6MB

MD5
1e2a3217654efbb8e02769ce59025f99

SHA1
009a51a7444ec2ee31a7d1cab0689fc73e66fe41

SHA256
0ead9478d5756172c92fd416f2477b4d66b3b14c4c2c54b8bc42ada4a38772ec

SHA512
cb1dd4d75d43bd859eefeb516fb6184a794370688a0952d1262053731ee62624d9f7d25dd72b9d92c74948ea2ba6884e4112469db3485bfd5a5c23a61fb209cc

Download Submit
\Windows\system\UsJSAJH.exe

Filesize
1.6MB

MD5
e10fdd7a06bce507bbd96e9d5ed38eef

SHA1
0c9ab4404dd0d3ddcb86edd1939ec96c3df88c5b

SHA256
c1f767837877a3abe4e41ef0737f08d3235acc13b513bfc91dbd561e4d0a4c35

SHA512
4da8aae0ca67616e76cff0a71775ceb73c568fc27ee46d158aa0f692f7c537a734cf8303d31c5c74df3d233056d135fca365db99ab6c86a9e37afe53e2f2a61c

Download Submit
\Windows\system\WnXEmtG.exe

Filesize
1.6MB

MD5
9d3b8c5950fec53304b1b882123d43a1

SHA1
b19f051f7c874f565e2640f63a94518f1cb43911

SHA256
b6a8ed4714802138b666f47e455681c700174ca2e17ceacf23a8c3ea5258ad75

SHA512
7c928e779d686a20bd6be6eddb31fd46da3e54154d442e03c31621d1ce22bfb563c8d57afa3f552972c79500454b490526ccc1b0dfacac81a6a64e14f1630b14

Download Submit
\Windows\system\XauEhZm.exe

Filesize
1.6MB

MD5
5743094cf6d94198ed6a651f9ec0fb69

SHA1
a028e285e90ed83872e94ce85ac3772054123039

SHA256
7b6981e3a8907d9e97e7d6b2ab1a1f943a1cbc393c311888ac8de0021c80ea53

SHA512
1912d04661da4f9bd22c440ed69eaea8620b64bab169d01ad66116c3dd415a1d2b6802af30b553ee9c4ff9414d794690c92e8234bf1d256abf151e0641ff85c4

Download Submit
\Windows\system\basuKvT.exe

Filesize
1.6MB

MD5
03e926c3995eb81c8760cb6ffdb95b9f

SHA1
12190c734d5d788a90581f29844f26019f3eacc6

SHA256
beed5e3517ef84d6d2eb3eee7416eb2186efe79101d492951b4b5eb59788f9c3

SHA512
44f820b26310328c8119ecd17482aa2f2bbba0d62c15210db6c291c536c738e28e4132ae9dcfa3e7b9d1fa27c76c94ef211550d0508fffb23e8502d2601fa3a9

Download Submit
\Windows\system\bbRLhEE.exe

Filesize
1.6MB

MD5
abb669fcee144cd4dd67c35dafe5a094

SHA1
9bc7b8b3c205075ac6632b4c463898357d7316d1

SHA256
e9cda0d26ae2a887f437038e87ae986510d865c2acfdc9bc306467f4665fafa1

SHA512
13a2b19e79bfdc7101f6beadeb8a32a76daac507de0150b4e3507e29d332aaa8c265dd0aa3016e8313df3a2827bd64e904cb1b5ca4092c9309ab401b81d3aa87

Download Submit
\Windows\system\csQlvxK.exe

Filesize
1.6MB

MD5
c9d39a061f179607d469a195c812e1b0

SHA1
1536a63e3db146e92265c6b0731482032c39f53a

SHA256
438818acb0db9837f6630fb8c2b10735a8641f2cc358f47a75cae848228771c2

SHA512
fe42cb5b2ab7dd3a474bb98b41f21e28b0c7613fd841ce75c62d29425f97d08a76acfe08a9a79f34a30e6b24332b9cd03842934bb90582c249f69068cf0baad7

Download Submit
\Windows\system\iMFZxPC.exe

Filesize
1.6MB

MD5
b5c124e5a819a90c7cfa2a986fcb4d97

SHA1
0e954163ee047a19be9c8eaf95b31e3f0ed8af41

SHA256
703d2f90764a1561fe4e857622dc7eb227472e6fc7d03d6ca702ae21df5e3ac4

SHA512
38ab209fedfaca1a565c39bb78fc9395dda306ea7025f59bad6ce2b4f1697cd48d9856b4b62fbf8cd4f5c9c22f9499e5abca0d19adafd9590ad23e9c08de6bca

Download Submit
\Windows\system\nFGWxpc.exe

Filesize
1.6MB

MD5
49484ddd3f6c3b18c40b06c78d27e777

SHA1
1cbecb78e35fe61e54e746a0ae0be54cd03720ec

SHA256
4e54c0121581c18936e1bbc9599840b48ff72f0e39e6dc3679d23790e8bcdb14

SHA512
d70444a6d2917c1cc65c08859f519e61d62806c119c343f5deecdb5a0c4e74e8a85b877958fea2d7a2e732f0cf5dc7343540f4e2b14ebddc96768f66bbde2a25

Download Submit
\Windows\system\rORKsSy.exe

Filesize
1.6MB

MD5
2fe269230c68e5e2f6f01172e9da8030

SHA1
1a212975cdf6c82368b13f9e71cb8c2012924d95

SHA256
6212c8202185748ee99d4d953150d7bf6fba619d2137b59652250e8340bd9949

SHA512
c9450d65409bf8afe7dc714af059c1fdd5db2127db2a7cb30bab131e8e774d5aebdfa3bc3ba7b5a416436dadb62e54b5fbd3c654a324553c5f83ba2da68e27db

Download Submit
\Windows\system\uoKhTeM.exe

Filesize
1.6MB

MD5
6df52facbead66059ac60b0a072a373b

SHA1
60654e6a3c00290e2d2328856c05eb8835a43662

SHA256
63ec23697293d5e5dc94cb02f20cfb723789ccd1313f4d7970eb5b33b65ae0b1

SHA512
56c1091f63c864ce7f04afd5aaedffa0487a7b64235ef7617d2af50ef1a9acc051e92982bdbaaae808c19a2ff64eee005f369eace3a0be77b23ea1728f7b4062

Download Submit
\Windows\system\yddZpuw.exe

Filesize
1.6MB

MD5
39610a6bee9fb5d14ad6f467e41d580e

SHA1
09055d5496f7ef903d90dab206a14f3931278066

SHA256
13b82edb77fb9eb92d1579d8afe07183edcfbc9d26aecef67f5af81f10e92960

SHA512
2aab0eb797d452736c21ebdea557d66d2d9b1a2e53beffd735c7f5f51be890f1bac60f31692c33ca375ea2bc9661318d6958bf234427f41393285688065055e3

Download Submit
memory/2100-494-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2100-497-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2100-487-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2100-1-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/2100-485-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2100-72-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2100-490-0x0000000003590000-0x0000000003982000-memory.dmp

Filesize
3.9MB

Download
memory/2100-16-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2100-492-0x0000000003590000-0x0000000003982000-memory.dmp

Filesize
3.9MB

Download
memory/2100-498-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2100-0-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2100-495-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2100-496-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2440-491-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/2444-486-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2468-489-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-493-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2544-71-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2560-17-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-18-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2788-303-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/2896-68-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/2896-36-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/2896-35-0x000000001B460000-0x000000001B742000-memory.dmp

Filesize
2.9MB

Download
memory/2896-524-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/2896-488-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/2896-70-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/2896-69-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/2896-65-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download