xmrig | a4bcb84bbbf03d119bddc9a51e209c4eaa5b6af1a782b4c16b4b457e853f322d

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
Size

2.2MB
MD5

0c1c5d7cda9c3ef3908a023fa776e682
SHA1

85121844710f0104d2f99ded6fae1fe4e3381d3f
SHA256

a4bcb84bbbf03d119bddc9a51e209c4eaa5b6af1a782b4c16b4b457e853f322d
SHA512

01315efe54f65c6c52f2124e1a12fa8850f1634011c883180f977001966a09a4f1cc042cfafbaa8f552945149d3fec5a8d4bc7b9eefaa70894becf167703d884
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr8+PH:NABW

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral1/memory/2688-9-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2860-22-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2584-33-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/1808-51-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2528-47-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig
behavioral1/memory/3060-42-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2564-76-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/1808-75-0x0000000003460000-0x0000000003852000-memory.dmp	xmrig
behavioral1/memory/2960-105-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/764-106-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2584-104-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/1440-84-0x000000013F420000-0x000000013F812000-memory.dmp	xmrig
behavioral1/memory/588-79-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/1808-77-0x0000000003460000-0x0000000003852000-memory.dmp	xmrig
behavioral1/memory/2860-72-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/3060-1863-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/588-2667-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2688-2666-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/764-2665-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2564-2664-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2404-2663-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/1440-2738-0x000000013F420000-0x000000013F812000-memory.dmp	xmrig
behavioral1/memory/2960-2814-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2528-2779-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig
behavioral1/memory/2584-2815-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/2860-3423-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2688	nJWYtqi.exe
2860	LkATZVc.exe
2564	xmdRLXe.exe
2584	lNoREMQ.exe
3060	ZNRlcpn.exe
2528	wmtpwbe.exe
2404	XdRXQSP.exe
588	idMlMeq.exe
1440	ItsZwPb.exe
2960	uytzvOj.exe
764	ZsPymRm.exe
1028	zPFIsEf.exe
2672	HFZzCDF.exe
836	baveaJQ.exe
2588	RopDEKW.exe
932	jbFnLfR.exe
1764	IXbtWnP.exe
1940	gRhKswI.exe
1544	KYHfmuH.exe
1676	ZfBstzX.exe
1476	XBCkvEF.exe
1244	cuRMRvP.exe
1992	tuDwnXU.exe
1636	WnmbADY.exe
2228	vqCNwyn.exe
2144	fDNTDUT.exe
1356	tMoNkft.exe
2728	jOCLLRw.exe
2936	EPLeOpd.exe
2224	OaclyEu.exe
584	QpTiBrs.exe
2712	ECWwWCN.exe
2212	lYLhOGY.exe
2120	gWrtinx.exe
332	ObQAFqc.exe
700	SNifvpE.exe
1336	nEtOJve.exe
768	iMsXfdh.exe
1212	MjcnRlb.exe
908	xfLRGwf.exe
1164	SteMTKp.exe
1872	ZExHmku.exe
1744	etCWnFq.exe
1644	uugyYLS.exe
1900	bTwBKOM.exe
2112	SbYShZP.exe
1436	PCISiek.exe
2196	uzLqXIz.exe
1036	lrXIalc.exe
1692	BuzaPUv.exe
1572	nBcqRax.exe
1624	JqmUHcO.exe
2604	XMHHgRD.exe
2432	MVWjKSz.exe
548	cKcotyV.exe
2816	dotqZNZ.exe
640	adhvdUa.exe
2748	dWHshpU.exe
2272	Cmgnizo.exe
1600	jyXuEhH.exe
2852	RTFRmdN.exe
2580	PAmcfTk.exe
2448	yazXfiK.exe
2416	rhPRdQc.exe

Loads dropped DLL 64 IoCs

pid	Process
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1808-0-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/files/0x000b000000015a2d-5.dat	upx
behavioral1/memory/2688-9-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/files/0x002b000000015c2f-10.dat	upx
behavioral1/files/0x0008000000015c87-18.dat	upx
behavioral1/files/0x002a000000015c3c-21.dat	upx
behavioral1/memory/2860-22-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/2584-33-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/files/0x0007000000015cb9-37.dat	upx
behavioral1/memory/2564-23-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/memory/1808-51-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/files/0x0012000000015c52-52.dat	upx
behavioral1/memory/2404-53-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/files/0x000700000001663d-55.dat	upx
behavioral1/memory/2528-47-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/memory/1808-56-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-45.dat	upx
behavioral1/memory/3060-42-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/files/0x00050000000186a0-61.dat	upx
behavioral1/files/0x0006000000018ae8-68.dat	upx
behavioral1/memory/2564-76-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/files/0x0006000000018b33-86.dat	upx
behavioral1/files/0x0006000000018b42-99.dat	upx
behavioral1/files/0x0006000000018b15-101.dat	upx
behavioral1/memory/2960-105-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/files/0x0006000000018b6a-114.dat	upx
behavioral1/files/0x0006000000018b96-126.dat	upx
behavioral1/files/0x0006000000018d06-134.dat	upx
behavioral1/files/0x0005000000019377-163.dat	upx
behavioral1/files/0x0005000000019473-185.dat	upx
behavioral1/files/0x000500000001931b-147.dat	upx
behavioral1/files/0x0005000000019368-194.dat	upx
behavioral1/files/0x0005000000019485-189.dat	upx
behavioral1/files/0x000500000001946b-182.dat	upx
behavioral1/files/0x000500000001946f-181.dat	upx
behavioral1/files/0x0005000000019410-173.dat	upx
behavioral1/files/0x000500000001939b-165.dat	upx
behavioral1/files/0x00050000000192c9-158.dat	upx
behavioral1/files/0x0006000000018ba2-141.dat	upx
behavioral1/files/0x0006000000018b73-138.dat	upx
behavioral1/files/0x00050000000193b0-171.dat	upx
behavioral1/files/0x0006000000018b4a-122.dat	upx
behavioral1/files/0x0005000000019333-153.dat	upx
behavioral1/files/0x00050000000192f4-145.dat	upx
behavioral1/files/0x0006000000018ae2-93.dat	upx
behavioral1/files/0x0006000000018b37-91.dat	upx
behavioral1/memory/764-106-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2584-104-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/1440-84-0x000000013F420000-0x000000013F812000-memory.dmp	upx
behavioral1/memory/588-79-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/2860-72-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/3060-1863-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/588-2667-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/2688-2666-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/764-2665-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2564-2664-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/memory/2404-2663-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/1440-2738-0x000000013F420000-0x000000013F812000-memory.dmp	upx
behavioral1/memory/2960-2814-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/2528-2779-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/memory/2584-2815-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/2860-3423-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\izJWdmk.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\XjoBkhe.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\dEkCTmO.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\yiOGMoZ.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\vmAAXEs.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\OFYxSdv.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\sQvSNRm.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\aLljQjo.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\pdawgHi.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\oAhkpyW.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\hbXnykB.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\lyxVlNe.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\ToiWDVj.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\YuKAxOt.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\YXFCoiy.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\akOoFFD.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\zmXrUTK.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\ANlyUrP.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\IHvuyTN.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\BxdHaTr.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\GaAxrVP.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\DqVrIgp.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\nBwtgef.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\ZsPymRm.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\GkxgZic.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\jqqFjvR.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\ghcPEEI.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\uPFKeVJ.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\GEJetkG.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\nlVBwcH.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\HDPVLyV.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\MbsnhWp.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\OOnRWbz.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\uiWQnjK.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\IrJwObj.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\wEuUjlA.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\tGJcOCj.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\gvpjwnk.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\zBjRDrW.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\OaclyEu.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\URoPnkT.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\UKvxDqU.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\IeJBzlt.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\sRIzpTy.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\aIXEDQn.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\HDCGuOJ.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\LSZkxvf.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\NFxIMDB.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\nVWjqeO.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\xOlvpxw.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\kACxRIa.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\zNMaYzq.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\hpsjPcS.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\xfLRGwf.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\qgKgHOQ.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\tuLCGAj.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\XpRWBTm.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\xmZlODV.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\abqWLiG.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\gNlXyeO.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\ztxMdMr.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\vBOVHmI.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\dhueOAd.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
File created	C:\Windows\System\elFBsfH.exe	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2996	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
Token: SeDebugPrivilege	2996	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2996	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	29
PID 1808 wrote to memory of 2996	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	29
PID 1808 wrote to memory of 2996	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	29
PID 1808 wrote to memory of 2688	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	30
PID 1808 wrote to memory of 2688	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	30
PID 1808 wrote to memory of 2688	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	30
PID 1808 wrote to memory of 2860	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	31
PID 1808 wrote to memory of 2860	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	31
PID 1808 wrote to memory of 2860	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	31
PID 1808 wrote to memory of 2564	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	32
PID 1808 wrote to memory of 2564	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	32
PID 1808 wrote to memory of 2564	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	32
PID 1808 wrote to memory of 2584	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	33
PID 1808 wrote to memory of 2584	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	33
PID 1808 wrote to memory of 2584	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	33
PID 1808 wrote to memory of 3060	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	34
PID 1808 wrote to memory of 3060	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	34
PID 1808 wrote to memory of 3060	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	34
PID 1808 wrote to memory of 2528	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	35
PID 1808 wrote to memory of 2528	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	35
PID 1808 wrote to memory of 2528	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	35
PID 1808 wrote to memory of 2404	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	36
PID 1808 wrote to memory of 2404	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	36
PID 1808 wrote to memory of 2404	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	36
PID 1808 wrote to memory of 2960	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	37
PID 1808 wrote to memory of 2960	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	37
PID 1808 wrote to memory of 2960	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	37
PID 1808 wrote to memory of 588	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	38
PID 1808 wrote to memory of 588	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	38
PID 1808 wrote to memory of 588	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	38
PID 1808 wrote to memory of 1028	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	39
PID 1808 wrote to memory of 1028	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	39
PID 1808 wrote to memory of 1028	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	39
PID 1808 wrote to memory of 1440	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	40
PID 1808 wrote to memory of 1440	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	40
PID 1808 wrote to memory of 1440	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	40
PID 1808 wrote to memory of 836	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	41
PID 1808 wrote to memory of 836	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	41
PID 1808 wrote to memory of 836	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	41
PID 1808 wrote to memory of 764	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	42
PID 1808 wrote to memory of 764	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	42
PID 1808 wrote to memory of 764	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	42
PID 1808 wrote to memory of 2588	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	43
PID 1808 wrote to memory of 2588	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	43
PID 1808 wrote to memory of 2588	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	43
PID 1808 wrote to memory of 2672	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	44
PID 1808 wrote to memory of 2672	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	44
PID 1808 wrote to memory of 2672	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	44
PID 1808 wrote to memory of 1764	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	45
PID 1808 wrote to memory of 1764	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	45
PID 1808 wrote to memory of 1764	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	45
PID 1808 wrote to memory of 932	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	46
PID 1808 wrote to memory of 932	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	46
PID 1808 wrote to memory of 932	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	46
PID 1808 wrote to memory of 1676	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	47
PID 1808 wrote to memory of 1676	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	47
PID 1808 wrote to memory of 1676	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	47
PID 1808 wrote to memory of 1940	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	48
PID 1808 wrote to memory of 1940	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	48
PID 1808 wrote to memory of 1940	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	48
PID 1808 wrote to memory of 1476	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	49
PID 1808 wrote to memory of 1476	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	49
PID 1808 wrote to memory of 1476	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	49
PID 1808 wrote to memory of 1544	1808	0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c1c5d7cda9c3ef3908a023fa776e682_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- C:\Windows\System\nJWYtqi.exe
  C:\Windows\System\nJWYtqi.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\LkATZVc.exe
  C:\Windows\System\LkATZVc.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\xmdRLXe.exe
  C:\Windows\System\xmdRLXe.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\lNoREMQ.exe
  C:\Windows\System\lNoREMQ.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\ZNRlcpn.exe
  C:\Windows\System\ZNRlcpn.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\wmtpwbe.exe
  C:\Windows\System\wmtpwbe.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\XdRXQSP.exe
  C:\Windows\System\XdRXQSP.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\uytzvOj.exe
  C:\Windows\System\uytzvOj.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\idMlMeq.exe
  C:\Windows\System\idMlMeq.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\zPFIsEf.exe
  C:\Windows\System\zPFIsEf.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\ItsZwPb.exe
  C:\Windows\System\ItsZwPb.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\baveaJQ.exe
  C:\Windows\System\baveaJQ.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\ZsPymRm.exe
  C:\Windows\System\ZsPymRm.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\RopDEKW.exe
  C:\Windows\System\RopDEKW.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\HFZzCDF.exe
  C:\Windows\System\HFZzCDF.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\IXbtWnP.exe
  C:\Windows\System\IXbtWnP.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\jbFnLfR.exe
  C:\Windows\System\jbFnLfR.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\ZfBstzX.exe
  C:\Windows\System\ZfBstzX.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\gRhKswI.exe
  C:\Windows\System\gRhKswI.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\XBCkvEF.exe
  C:\Windows\System\XBCkvEF.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\KYHfmuH.exe
  C:\Windows\System\KYHfmuH.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\WnmbADY.exe
  C:\Windows\System\WnmbADY.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\cuRMRvP.exe
  C:\Windows\System\cuRMRvP.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\tMoNkft.exe
  C:\Windows\System\tMoNkft.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\tuDwnXU.exe
  C:\Windows\System\tuDwnXU.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\OaclyEu.exe
  C:\Windows\System\OaclyEu.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\vqCNwyn.exe
  C:\Windows\System\vqCNwyn.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\QpTiBrs.exe
  C:\Windows\System\QpTiBrs.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\fDNTDUT.exe
  C:\Windows\System\fDNTDUT.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\ECWwWCN.exe
  C:\Windows\System\ECWwWCN.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\jOCLLRw.exe
  C:\Windows\System\jOCLLRw.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\lYLhOGY.exe
  C:\Windows\System\lYLhOGY.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\EPLeOpd.exe
  C:\Windows\System\EPLeOpd.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\gWrtinx.exe
  C:\Windows\System\gWrtinx.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\ObQAFqc.exe
  C:\Windows\System\ObQAFqc.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\nEtOJve.exe
  C:\Windows\System\nEtOJve.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\SNifvpE.exe
  C:\Windows\System\SNifvpE.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\iMsXfdh.exe
  C:\Windows\System\iMsXfdh.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\MjcnRlb.exe
  C:\Windows\System\MjcnRlb.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\SteMTKp.exe
  C:\Windows\System\SteMTKp.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\xfLRGwf.exe
  C:\Windows\System\xfLRGwf.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\ZExHmku.exe
  C:\Windows\System\ZExHmku.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\etCWnFq.exe
  C:\Windows\System\etCWnFq.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\uugyYLS.exe
  C:\Windows\System\uugyYLS.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\bTwBKOM.exe
  C:\Windows\System\bTwBKOM.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\SbYShZP.exe
  C:\Windows\System\SbYShZP.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\PCISiek.exe
  C:\Windows\System\PCISiek.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\BuzaPUv.exe
  C:\Windows\System\BuzaPUv.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\uzLqXIz.exe
  C:\Windows\System\uzLqXIz.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\dWHshpU.exe
  C:\Windows\System\dWHshpU.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\lrXIalc.exe
  C:\Windows\System\lrXIalc.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\jyXuEhH.exe
  C:\Windows\System\jyXuEhH.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\nBcqRax.exe
  C:\Windows\System\nBcqRax.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\RTFRmdN.exe
  C:\Windows\System\RTFRmdN.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\JqmUHcO.exe
  C:\Windows\System\JqmUHcO.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\PAmcfTk.exe
  C:\Windows\System\PAmcfTk.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\XMHHgRD.exe
  C:\Windows\System\XMHHgRD.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\yazXfiK.exe
  C:\Windows\System\yazXfiK.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\MVWjKSz.exe
  C:\Windows\System\MVWjKSz.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\rhPRdQc.exe
  C:\Windows\System\rhPRdQc.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\cKcotyV.exe
  C:\Windows\System\cKcotyV.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\eKHAAqX.exe
  C:\Windows\System\eKHAAqX.exe
  2⤵
  PID:1672
- C:\Windows\System\dotqZNZ.exe
  C:\Windows\System\dotqZNZ.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\nPbTkyd.exe
  C:\Windows\System\nPbTkyd.exe
  2⤵
  PID:1776
- C:\Windows\System\adhvdUa.exe
  C:\Windows\System\adhvdUa.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\njTIaiK.exe
  C:\Windows\System\njTIaiK.exe
  2⤵
  PID:2160
- C:\Windows\System\Cmgnizo.exe
  C:\Windows\System\Cmgnizo.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\WDeUNVu.exe
  C:\Windows\System\WDeUNVu.exe
  2⤵
  PID:2236
- C:\Windows\System\JvkdyuR.exe
  C:\Windows\System\JvkdyuR.exe
  2⤵
  PID:1656
- C:\Windows\System\caUvMAJ.exe
  C:\Windows\System\caUvMAJ.exe
  2⤵
  PID:1932
- C:\Windows\System\QQKfHCm.exe
  C:\Windows\System\QQKfHCm.exe
  2⤵
  PID:1388
- C:\Windows\System\PcVwbOb.exe
  C:\Windows\System\PcVwbOb.exe
  2⤵
  PID:2248
- C:\Windows\System\XqwcPFO.exe
  C:\Windows\System\XqwcPFO.exe
  2⤵
  PID:1208
- C:\Windows\System\ZwkTbOD.exe
  C:\Windows\System\ZwkTbOD.exe
  2⤵
  PID:2424
- C:\Windows\System\iRADzvt.exe
  C:\Windows\System\iRADzvt.exe
  2⤵
  PID:436
- C:\Windows\System\XJkbzzE.exe
  C:\Windows\System\XJkbzzE.exe
  2⤵
  PID:1960
- C:\Windows\System\bTeNYtj.exe
  C:\Windows\System\bTeNYtj.exe
  2⤵
  PID:980
- C:\Windows\System\GelcoLD.exe
  C:\Windows\System\GelcoLD.exe
  2⤵
  PID:2292
- C:\Windows\System\HFeUdaO.exe
  C:\Windows\System\HFeUdaO.exe
  2⤵
  PID:2472
- C:\Windows\System\aIGEkyB.exe
  C:\Windows\System\aIGEkyB.exe
  2⤵
  PID:976
- C:\Windows\System\doKRfRw.exe
  C:\Windows\System\doKRfRw.exe
  2⤵
  PID:596
- C:\Windows\System\siLblSU.exe
  C:\Windows\System\siLblSU.exe
  2⤵
  PID:3040
- C:\Windows\System\TmkQIMH.exe
  C:\Windows\System\TmkQIMH.exe
  2⤵
  PID:2032
- C:\Windows\System\EtPAFOY.exe
  C:\Windows\System\EtPAFOY.exe
  2⤵
  PID:1140
- C:\Windows\System\zZDvfgL.exe
  C:\Windows\System\zZDvfgL.exe
  2⤵
  PID:2024
- C:\Windows\System\YBbsPPJ.exe
  C:\Windows\System\YBbsPPJ.exe
  2⤵
  PID:2920
- C:\Windows\System\YjpUAgg.exe
  C:\Windows\System\YjpUAgg.exe
  2⤵
  PID:3008
- C:\Windows\System\saazoZk.exe
  C:\Windows\System\saazoZk.exe
  2⤵
  PID:2700
- C:\Windows\System\GaenSLv.exe
  C:\Windows\System\GaenSLv.exe
  2⤵
  PID:2436
- C:\Windows\System\MHuRlIS.exe
  C:\Windows\System\MHuRlIS.exe
  2⤵
  PID:2308
- C:\Windows\System\UDJvPpF.exe
  C:\Windows\System\UDJvPpF.exe
  2⤵
  PID:1700
- C:\Windows\System\gCiQFNT.exe
  C:\Windows\System\gCiQFNT.exe
  2⤵
  PID:2340
- C:\Windows\System\gBGfXum.exe
  C:\Windows\System\gBGfXum.exe
  2⤵
  PID:1756
- C:\Windows\System\wBUQDAZ.exe
  C:\Windows\System\wBUQDAZ.exe
  2⤵
  PID:1584
- C:\Windows\System\RmhHNfe.exe
  C:\Windows\System\RmhHNfe.exe
  2⤵
  PID:2668
- C:\Windows\System\ZrbsOlb.exe
  C:\Windows\System\ZrbsOlb.exe
  2⤵
  PID:880
- C:\Windows\System\RWEuzIQ.exe
  C:\Windows\System\RWEuzIQ.exe
  2⤵
  PID:2780
- C:\Windows\System\EeNoghi.exe
  C:\Windows\System\EeNoghi.exe
  2⤵
  PID:1368
- C:\Windows\System\kDtTZsq.exe
  C:\Windows\System\kDtTZsq.exe
  2⤵
  PID:2864
- C:\Windows\System\OFYxSdv.exe
  C:\Windows\System\OFYxSdv.exe
  2⤵
  PID:2984
- C:\Windows\System\cWNrkKv.exe
  C:\Windows\System\cWNrkKv.exe
  2⤵
  PID:1372
- C:\Windows\System\AdZSDGu.exe
  C:\Windows\System\AdZSDGu.exe
  2⤵
  PID:2496
- C:\Windows\System\VYpoqTa.exe
  C:\Windows\System\VYpoqTa.exe
  2⤵
  PID:2460
- C:\Windows\System\vvIWUYZ.exe
  C:\Windows\System\vvIWUYZ.exe
  2⤵
  PID:1948
- C:\Windows\System\jvnCbew.exe
  C:\Windows\System\jvnCbew.exe
  2⤵
  PID:1276
- C:\Windows\System\NLMwEaA.exe
  C:\Windows\System\NLMwEaA.exe
  2⤵
  PID:2500
- C:\Windows\System\yAnAYwp.exe
  C:\Windows\System\yAnAYwp.exe
  2⤵
  PID:2452
- C:\Windows\System\PLImKra.exe
  C:\Windows\System\PLImKra.exe
  2⤵
  PID:928
- C:\Windows\System\BWJlIVk.exe
  C:\Windows\System\BWJlIVk.exe
  2⤵
  PID:2508
- C:\Windows\System\UGfcDRg.exe
  C:\Windows\System\UGfcDRg.exe
  2⤵
  PID:1084
- C:\Windows\System\bpKvFOn.exe
  C:\Windows\System\bpKvFOn.exe
  2⤵
  PID:1968
- C:\Windows\System\ReWTbSn.exe
  C:\Windows\System\ReWTbSn.exe
  2⤵
  PID:2612
- C:\Windows\System\izBtXac.exe
  C:\Windows\System\izBtXac.exe
  2⤵
  PID:2288
- C:\Windows\System\EhKIqJk.exe
  C:\Windows\System\EhKIqJk.exe
  2⤵
  PID:1720
- C:\Windows\System\whtzrGq.exe
  C:\Windows\System\whtzrGq.exe
  2⤵
  PID:828
- C:\Windows\System\TaBiKAQ.exe
  C:\Windows\System\TaBiKAQ.exe
  2⤵
  PID:1964
- C:\Windows\System\GRcWRAf.exe
  C:\Windows\System\GRcWRAf.exe
  2⤵
  PID:420
- C:\Windows\System\OIjXMeI.exe
  C:\Windows\System\OIjXMeI.exe
  2⤵
  PID:2940
- C:\Windows\System\aoVyIjx.exe
  C:\Windows\System\aoVyIjx.exe
  2⤵
  PID:3080
- C:\Windows\System\PeyDvrK.exe
  C:\Windows\System\PeyDvrK.exe
  2⤵
  PID:3096
- C:\Windows\System\IqRIAjb.exe
  C:\Windows\System\IqRIAjb.exe
  2⤵
  PID:3112
- C:\Windows\System\mRlHRSz.exe
  C:\Windows\System\mRlHRSz.exe
  2⤵
  PID:3128
- C:\Windows\System\LoXPQpa.exe
  C:\Windows\System\LoXPQpa.exe
  2⤵
  PID:3144
- C:\Windows\System\rnmZgZP.exe
  C:\Windows\System\rnmZgZP.exe
  2⤵
  PID:3160
- C:\Windows\System\QosZaSD.exe
  C:\Windows\System\QosZaSD.exe
  2⤵
  PID:3176
- C:\Windows\System\uUReaKQ.exe
  C:\Windows\System\uUReaKQ.exe
  2⤵
  PID:3192
- C:\Windows\System\rfNWnsu.exe
  C:\Windows\System\rfNWnsu.exe
  2⤵
  PID:3212
- C:\Windows\System\BdTNKoi.exe
  C:\Windows\System\BdTNKoi.exe
  2⤵
  PID:3228
- C:\Windows\System\WjXKiDX.exe
  C:\Windows\System\WjXKiDX.exe
  2⤵
  PID:3244
- C:\Windows\System\iwHgkGn.exe
  C:\Windows\System\iwHgkGn.exe
  2⤵
  PID:3260
- C:\Windows\System\TDwQeqp.exe
  C:\Windows\System\TDwQeqp.exe
  2⤵
  PID:3276
- C:\Windows\System\sjWLJTR.exe
  C:\Windows\System\sjWLJTR.exe
  2⤵
  PID:3308
- C:\Windows\System\IfjnaPu.exe
  C:\Windows\System\IfjnaPu.exe
  2⤵
  PID:3324
- C:\Windows\System\RqqurLo.exe
  C:\Windows\System\RqqurLo.exe
  2⤵
  PID:3340
- C:\Windows\System\eWLjird.exe
  C:\Windows\System\eWLjird.exe
  2⤵
  PID:3356
- C:\Windows\System\fzFXQtK.exe
  C:\Windows\System\fzFXQtK.exe
  2⤵
  PID:3376
- C:\Windows\System\pYwyxqP.exe
  C:\Windows\System\pYwyxqP.exe
  2⤵
  PID:3392
- C:\Windows\System\zmXrUTK.exe
  C:\Windows\System\zmXrUTK.exe
  2⤵
  PID:3408
- C:\Windows\System\iHukXGp.exe
  C:\Windows\System\iHukXGp.exe
  2⤵
  PID:3424
- C:\Windows\System\JjrdPKI.exe
  C:\Windows\System\JjrdPKI.exe
  2⤵
  PID:3440
- C:\Windows\System\EmmOXJa.exe
  C:\Windows\System\EmmOXJa.exe
  2⤵
  PID:3456
- C:\Windows\System\gPzMleY.exe
  C:\Windows\System\gPzMleY.exe
  2⤵
  PID:3472
- C:\Windows\System\dDxewDX.exe
  C:\Windows\System\dDxewDX.exe
  2⤵
  PID:3600
- C:\Windows\System\omVUDzq.exe
  C:\Windows\System\omVUDzq.exe
  2⤵
  PID:3620
- C:\Windows\System\PEuweHH.exe
  C:\Windows\System\PEuweHH.exe
  2⤵
  PID:3656
- C:\Windows\System\PpdYTYH.exe
  C:\Windows\System\PpdYTYH.exe
  2⤵
  PID:3672
- C:\Windows\System\dgIFqPd.exe
  C:\Windows\System\dgIFqPd.exe
  2⤵
  PID:3688
- C:\Windows\System\PgbEKlj.exe
  C:\Windows\System\PgbEKlj.exe
  2⤵
  PID:3704
- C:\Windows\System\EHzSaVJ.exe
  C:\Windows\System\EHzSaVJ.exe
  2⤵
  PID:3720
- C:\Windows\System\jhyBxka.exe
  C:\Windows\System\jhyBxka.exe
  2⤵
  PID:3736
- C:\Windows\System\GrIgHtX.exe
  C:\Windows\System\GrIgHtX.exe
  2⤵
  PID:3772
- C:\Windows\System\HwcHMKm.exe
  C:\Windows\System\HwcHMKm.exe
  2⤵
  PID:3792
- C:\Windows\System\EdkqIsf.exe
  C:\Windows\System\EdkqIsf.exe
  2⤵
  PID:3812
- C:\Windows\System\ehlcLsJ.exe
  C:\Windows\System\ehlcLsJ.exe
  2⤵
  PID:3828
- C:\Windows\System\ZFqScfF.exe
  C:\Windows\System\ZFqScfF.exe
  2⤵
  PID:3844
- C:\Windows\System\VOYRtQy.exe
  C:\Windows\System\VOYRtQy.exe
  2⤵
  PID:3860
- C:\Windows\System\hsUKiwE.exe
  C:\Windows\System\hsUKiwE.exe
  2⤵
  PID:3876
- C:\Windows\System\VkNNLKK.exe
  C:\Windows\System\VkNNLKK.exe
  2⤵
  PID:3892
- C:\Windows\System\ehWrnvC.exe
  C:\Windows\System\ehWrnvC.exe
  2⤵
  PID:3908
- C:\Windows\System\NgEugcO.exe
  C:\Windows\System\NgEugcO.exe
  2⤵
  PID:3924
- C:\Windows\System\FhzRTwr.exe
  C:\Windows\System\FhzRTwr.exe
  2⤵
  PID:3940
- C:\Windows\System\DXjELvW.exe
  C:\Windows\System\DXjELvW.exe
  2⤵
  PID:3956
- C:\Windows\System\NFnVqBG.exe
  C:\Windows\System\NFnVqBG.exe
  2⤵
  PID:3988
- C:\Windows\System\gxBAmbs.exe
  C:\Windows\System\gxBAmbs.exe
  2⤵
  PID:4004
- C:\Windows\System\kBtUinV.exe
  C:\Windows\System\kBtUinV.exe
  2⤵
  PID:4028
- C:\Windows\System\AogYpRL.exe
  C:\Windows\System\AogYpRL.exe
  2⤵
  PID:4044
- C:\Windows\System\ccgrqHx.exe
  C:\Windows\System\ccgrqHx.exe
  2⤵
  PID:4060
- C:\Windows\System\XrSGuxI.exe
  C:\Windows\System\XrSGuxI.exe
  2⤵
  PID:4076
- C:\Windows\System\CNmafVV.exe
  C:\Windows\System\CNmafVV.exe
  2⤵
  PID:4092
- C:\Windows\System\RsNbImY.exe
  C:\Windows\System\RsNbImY.exe
  2⤵
  PID:1796
- C:\Windows\System\MwBwErL.exe
  C:\Windows\System\MwBwErL.exe
  2⤵
  PID:1728
- C:\Windows\System\OmaFYxb.exe
  C:\Windows\System\OmaFYxb.exe
  2⤵
  PID:2576
- C:\Windows\System\KSvLkWi.exe
  C:\Windows\System\KSvLkWi.exe
  2⤵
  PID:3044
- C:\Windows\System\rpBbdqq.exe
  C:\Windows\System\rpBbdqq.exe
  2⤵
  PID:1616
- C:\Windows\System\ILrwrvW.exe
  C:\Windows\System\ILrwrvW.exe
  2⤵
  PID:3256
- C:\Windows\System\tCKvSnZ.exe
  C:\Windows\System\tCKvSnZ.exe
  2⤵
  PID:3292
- C:\Windows\System\AOhHuNt.exe
  C:\Windows\System\AOhHuNt.exe
  2⤵
  PID:3336
- C:\Windows\System\SmbSMRv.exe
  C:\Windows\System\SmbSMRv.exe
  2⤵
  PID:3368
- C:\Windows\System\aUjkdXP.exe
  C:\Windows\System\aUjkdXP.exe
  2⤵
  PID:1508
- C:\Windows\System\htrWfEV.exe
  C:\Windows\System\htrWfEV.exe
  2⤵
  PID:3468
- C:\Windows\System\dhBcmZW.exe
  C:\Windows\System\dhBcmZW.exe
  2⤵
  PID:2152
- C:\Windows\System\UMgMWoX.exe
  C:\Windows\System\UMgMWoX.exe
  2⤵
  PID:1076
- C:\Windows\System\oqIwoyX.exe
  C:\Windows\System\oqIwoyX.exe
  2⤵
  PID:2220
- C:\Windows\System\FdvowWb.exe
  C:\Windows\System\FdvowWb.exe
  2⤵
  PID:2412
- C:\Windows\System\DKLxpaD.exe
  C:\Windows\System\DKLxpaD.exe
  2⤵
  PID:3608
- C:\Windows\System\eeFBFdD.exe
  C:\Windows\System\eeFBFdD.exe
  2⤵
  PID:2552
- C:\Windows\System\uZviwPv.exe
  C:\Windows\System\uZviwPv.exe
  2⤵
  PID:792
- C:\Windows\System\BNvVOHP.exe
  C:\Windows\System\BNvVOHP.exe
  2⤵
  PID:3780
- C:\Windows\System\tPEpVNp.exe
  C:\Windows\System\tPEpVNp.exe
  2⤵
  PID:3852
- C:\Windows\System\NAJZkQl.exe
  C:\Windows\System\NAJZkQl.exe
  2⤵
  PID:2244
- C:\Windows\System\CGkLFMT.exe
  C:\Windows\System\CGkLFMT.exe
  2⤵
  PID:3920
- C:\Windows\System\uQsCjiu.exe
  C:\Windows\System\uQsCjiu.exe
  2⤵
  PID:1740
- C:\Windows\System\oNPCmjo.exe
  C:\Windows\System\oNPCmjo.exe
  2⤵
  PID:4000
- C:\Windows\System\SxYaZFr.exe
  C:\Windows\System\SxYaZFr.exe
  2⤵
  PID:3516
- C:\Windows\System\sBUHdYV.exe
  C:\Windows\System\sBUHdYV.exe
  2⤵
  PID:1664
- C:\Windows\System\orVeVyc.exe
  C:\Windows\System\orVeVyc.exe
  2⤵
  PID:456
- C:\Windows\System\uofQISd.exe
  C:\Windows\System\uofQISd.exe
  2⤵
  PID:3296
- C:\Windows\System\gNeMqmz.exe
  C:\Windows\System\gNeMqmz.exe
  2⤵
  PID:3464
- C:\Windows\System\OAJzARN.exe
  C:\Windows\System\OAJzARN.exe
  2⤵
  PID:2516
- C:\Windows\System\vTCrTIw.exe
  C:\Windows\System\vTCrTIw.exe
  2⤵
  PID:2888
- C:\Windows\System\RodpEgc.exe
  C:\Windows\System\RodpEgc.exe
  2⤵
  PID:3728
- C:\Windows\System\hNAhnLg.exe
  C:\Windows\System\hNAhnLg.exe
  2⤵
  PID:3024
- C:\Windows\System\nuQnxEB.exe
  C:\Windows\System\nuQnxEB.exe
  2⤵
  PID:3952
- C:\Windows\System\IwVnDiR.exe
  C:\Windows\System\IwVnDiR.exe
  2⤵
  PID:3088
- C:\Windows\System\yzCVzow.exe
  C:\Windows\System\yzCVzow.exe
  2⤵
  PID:2184
- C:\Windows\System\wLIZhyD.exe
  C:\Windows\System\wLIZhyD.exe
  2⤵
  PID:2716
- C:\Windows\System\lkkrCMF.exe
  C:\Windows\System\lkkrCMF.exe
  2⤵
  PID:4104
- C:\Windows\System\xFpzMsu.exe
  C:\Windows\System\xFpzMsu.exe
  2⤵
  PID:4120
- C:\Windows\System\YjMqpbn.exe
  C:\Windows\System\YjMqpbn.exe
  2⤵
  PID:4136
- C:\Windows\System\RGwXOFW.exe
  C:\Windows\System\RGwXOFW.exe
  2⤵
  PID:4152
- C:\Windows\System\SztPpRJ.exe
  C:\Windows\System\SztPpRJ.exe
  2⤵
  PID:4168
- C:\Windows\System\vPpcbSL.exe
  C:\Windows\System\vPpcbSL.exe
  2⤵
  PID:4184
- C:\Windows\System\VmZXymq.exe
  C:\Windows\System\VmZXymq.exe
  2⤵
  PID:4200
- C:\Windows\System\MxgqeXH.exe
  C:\Windows\System\MxgqeXH.exe
  2⤵
  PID:4216
- C:\Windows\System\pudIlXW.exe
  C:\Windows\System\pudIlXW.exe
  2⤵
  PID:4232
- C:\Windows\System\qbXxPOS.exe
  C:\Windows\System\qbXxPOS.exe
  2⤵
  PID:4248
- C:\Windows\System\DjlcOGH.exe
  C:\Windows\System\DjlcOGH.exe
  2⤵
  PID:4268
- C:\Windows\System\fEpluLK.exe
  C:\Windows\System\fEpluLK.exe
  2⤵
  PID:4288
- C:\Windows\System\ZUXryAs.exe
  C:\Windows\System\ZUXryAs.exe
  2⤵
  PID:4304
- C:\Windows\System\cBQzBtW.exe
  C:\Windows\System\cBQzBtW.exe
  2⤵
  PID:4320
- C:\Windows\System\xgrXKpF.exe
  C:\Windows\System\xgrXKpF.exe
  2⤵
  PID:4336
- C:\Windows\System\NqJVjKA.exe
  C:\Windows\System\NqJVjKA.exe
  2⤵
  PID:4352
- C:\Windows\System\UjCcQsa.exe
  C:\Windows\System\UjCcQsa.exe
  2⤵
  PID:4368
- C:\Windows\System\tdtVLZj.exe
  C:\Windows\System\tdtVLZj.exe
  2⤵
  PID:4384
- C:\Windows\System\GaAxrVP.exe
  C:\Windows\System\GaAxrVP.exe
  2⤵
  PID:4400
- C:\Windows\System\WqWDosx.exe
  C:\Windows\System\WqWDosx.exe
  2⤵
  PID:4416
- C:\Windows\System\STCVltB.exe
  C:\Windows\System\STCVltB.exe
  2⤵
  PID:4436
- C:\Windows\System\CUljqTq.exe
  C:\Windows\System\CUljqTq.exe
  2⤵
  PID:4452
- C:\Windows\System\tYCzzuW.exe
  C:\Windows\System\tYCzzuW.exe
  2⤵
  PID:4468
- C:\Windows\System\Kvuewhh.exe
  C:\Windows\System\Kvuewhh.exe
  2⤵
  PID:4484
- C:\Windows\System\YymBGsp.exe
  C:\Windows\System\YymBGsp.exe
  2⤵
  PID:4504
- C:\Windows\System\KUVkCmh.exe
  C:\Windows\System\KUVkCmh.exe
  2⤵
  PID:4520
- C:\Windows\System\Pjzvnda.exe
  C:\Windows\System\Pjzvnda.exe
  2⤵
  PID:4540
- C:\Windows\System\ERxVBBv.exe
  C:\Windows\System\ERxVBBv.exe
  2⤵
  PID:4556
- C:\Windows\System\jxHaQlv.exe
  C:\Windows\System\jxHaQlv.exe
  2⤵
  PID:4608
- C:\Windows\System\WlntCQU.exe
  C:\Windows\System\WlntCQU.exe
  2⤵
  PID:4624
- C:\Windows\System\HjOcJaY.exe
  C:\Windows\System\HjOcJaY.exe
  2⤵
  PID:4640
- C:\Windows\System\frFdbdV.exe
  C:\Windows\System\frFdbdV.exe
  2⤵
  PID:4656
- C:\Windows\System\GoDKpty.exe
  C:\Windows\System\GoDKpty.exe
  2⤵
  PID:4672
- C:\Windows\System\cczVFjt.exe
  C:\Windows\System\cczVFjt.exe
  2⤵
  PID:4688
- C:\Windows\System\fBVOdlL.exe
  C:\Windows\System\fBVOdlL.exe
  2⤵
  PID:4704
- C:\Windows\System\gTgnpcw.exe
  C:\Windows\System\gTgnpcw.exe
  2⤵
  PID:4720
- C:\Windows\System\vrWMyWT.exe
  C:\Windows\System\vrWMyWT.exe
  2⤵
  PID:4736
- C:\Windows\System\YTGGbpL.exe
  C:\Windows\System\YTGGbpL.exe
  2⤵
  PID:4752
- C:\Windows\System\nvWLNpx.exe
  C:\Windows\System\nvWLNpx.exe
  2⤵
  PID:4768
- C:\Windows\System\EYDhnPr.exe
  C:\Windows\System\EYDhnPr.exe
  2⤵
  PID:4784
- C:\Windows\System\IWwLoQz.exe
  C:\Windows\System\IWwLoQz.exe
  2⤵
  PID:4804
- C:\Windows\System\URoPnkT.exe
  C:\Windows\System\URoPnkT.exe
  2⤵
  PID:4820
- C:\Windows\System\LuCZlbg.exe
  C:\Windows\System\LuCZlbg.exe
  2⤵
  PID:4836
- C:\Windows\System\JspNbkN.exe
  C:\Windows\System\JspNbkN.exe
  2⤵
  PID:4880
- C:\Windows\System\wqRCxbH.exe
  C:\Windows\System\wqRCxbH.exe
  2⤵
  PID:4908
- C:\Windows\System\RRjlTmM.exe
  C:\Windows\System\RRjlTmM.exe
  2⤵
  PID:4928
- C:\Windows\System\RcVXCfl.exe
  C:\Windows\System\RcVXCfl.exe
  2⤵
  PID:4944
- C:\Windows\System\JrMTOuD.exe
  C:\Windows\System\JrMTOuD.exe
  2⤵
  PID:4964
- C:\Windows\System\PEdHyal.exe
  C:\Windows\System\PEdHyal.exe
  2⤵
  PID:5036
- C:\Windows\System\YwuEJXo.exe
  C:\Windows\System\YwuEJXo.exe
  2⤵
  PID:5056
- C:\Windows\System\YPSCOVz.exe
  C:\Windows\System\YPSCOVz.exe
  2⤵
  PID:5076
- C:\Windows\System\NQpCiQh.exe
  C:\Windows\System\NQpCiQh.exe
  2⤵
  PID:2916
- C:\Windows\System\hYeksKL.exe
  C:\Windows\System\hYeksKL.exe
  2⤵
  PID:2140
- C:\Windows\System\aBKKtnp.exe
  C:\Windows\System\aBKKtnp.exe
  2⤵
  PID:4680
- C:\Windows\System\Qpombxv.exe
  C:\Windows\System\Qpombxv.exe
  2⤵
  PID:4744
- C:\Windows\System\JwaKMST.exe
  C:\Windows\System\JwaKMST.exe
  2⤵
  PID:2080
- C:\Windows\System\DwLvlQm.exe
  C:\Windows\System\DwLvlQm.exe
  2⤵
  PID:4780
- C:\Windows\System\eUsWEix.exe
  C:\Windows\System\eUsWEix.exe
  2⤵
  PID:4852
- C:\Windows\System\vXKcmGu.exe
  C:\Windows\System\vXKcmGu.exe
  2⤵
  PID:3748
- C:\Windows\System\SdVCPuI.exe
  C:\Windows\System\SdVCPuI.exe
  2⤵
  PID:1060
- C:\Windows\System\rCagJSK.exe
  C:\Windows\System\rCagJSK.exe
  2⤵
  PID:2512
- C:\Windows\System\xBhNevj.exe
  C:\Windows\System\xBhNevj.exe
  2⤵
  PID:4960
- C:\Windows\System\ClvnlGl.exe
  C:\Windows\System\ClvnlGl.exe
  2⤵
  PID:2240
- C:\Windows\System\NbQxQbi.exe
  C:\Windows\System\NbQxQbi.exe
  2⤵
  PID:3168
- C:\Windows\System\elFBsfH.exe
  C:\Windows\System\elFBsfH.exe
  2⤵
  PID:3208
- C:\Windows\System\CGmsucI.exe
  C:\Windows\System\CGmsucI.exe
  2⤵
  PID:3272
- C:\Windows\System\OJwVEor.exe
  C:\Windows\System\OJwVEor.exe
  2⤵
  PID:2364
- C:\Windows\System\bYrVzFC.exe
  C:\Windows\System\bYrVzFC.exe
  2⤵
  PID:3480
- C:\Windows\System\UkSrOqQ.exe
  C:\Windows\System\UkSrOqQ.exe
  2⤵
  PID:3548
- C:\Windows\System\xEapoMr.exe
  C:\Windows\System\xEapoMr.exe
  2⤵
  PID:900
- C:\Windows\System\tLWWXFq.exe
  C:\Windows\System\tLWWXFq.exe
  2⤵
  PID:3572
- C:\Windows\System\vYVwkju.exe
  C:\Windows\System\vYVwkju.exe
  2⤵
  PID:2744
- C:\Windows\System\iMNwGXi.exe
  C:\Windows\System\iMNwGXi.exe
  2⤵
  PID:3632
- C:\Windows\System\QMHqTuR.exe
  C:\Windows\System\QMHqTuR.exe
  2⤵
  PID:3712
- C:\Windows\System\wIEHQhV.exe
  C:\Windows\System\wIEHQhV.exe
  2⤵
  PID:2368
- C:\Windows\System\UhtUOxG.exe
  C:\Windows\System\UhtUOxG.exe
  2⤵
  PID:3596
- C:\Windows\System\uIhDHhl.exe
  C:\Windows\System\uIhDHhl.exe
  2⤵
  PID:3768
- C:\Windows\System\kbDdUXr.exe
  C:\Windows\System\kbDdUXr.exe
  2⤵
  PID:3808
- C:\Windows\System\JROaXcE.exe
  C:\Windows\System\JROaXcE.exe
  2⤵
  PID:3972
- C:\Windows\System\FHDuCIm.exe
  C:\Windows\System\FHDuCIm.exe
  2⤵
  PID:4020
- C:\Windows\System\oAhkpyW.exe
  C:\Windows\System\oAhkpyW.exe
  2⤵
  PID:3184
- C:\Windows\System\YDnHgOa.exe
  C:\Windows\System\YDnHgOa.exe
  2⤵
  PID:3252
- C:\Windows\System\IrtEqzf.exe
  C:\Windows\System\IrtEqzf.exe
  2⤵
  PID:1580
- C:\Windows\System\pZZwHcL.exe
  C:\Windows\System\pZZwHcL.exe
  2⤵
  PID:472
- C:\Windows\System\uTyzKAv.exe
  C:\Windows\System\uTyzKAv.exe
  2⤵
  PID:5044
- C:\Windows\System\fuIWqgI.exe
  C:\Windows\System\fuIWqgI.exe
  2⤵
  PID:3388
- C:\Windows\System\BwThdYB.exe
  C:\Windows\System\BwThdYB.exe
  2⤵
  PID:2520
- C:\Windows\System\pEiEaGv.exe
  C:\Windows\System\pEiEaGv.exe
  2⤵
  PID:3616
- C:\Windows\System\nsPHSSO.exe
  C:\Windows\System\nsPHSSO.exe
  2⤵
  PID:3436
- C:\Windows\System\mZREfxo.exe
  C:\Windows\System\mZREfxo.exe
  2⤵
  PID:4128
- C:\Windows\System\RArInPp.exe
  C:\Windows\System\RArInPp.exe
  2⤵
  PID:4300
- C:\Windows\System\HQDIscA.exe
  C:\Windows\System\HQDIscA.exe
  2⤵
  PID:4364
- C:\Windows\System\VMmiLOW.exe
  C:\Windows\System\VMmiLOW.exe
  2⤵
  PID:4428
- C:\Windows\System\UnfOXsG.exe
  C:\Windows\System\UnfOXsG.exe
  2⤵
  PID:4492
- C:\Windows\System\ElZqYGY.exe
  C:\Windows\System\ElZqYGY.exe
  2⤵
  PID:4532
- C:\Windows\System\GcsEogs.exe
  C:\Windows\System\GcsEogs.exe
  2⤵
  PID:4568
- C:\Windows\System\akBXntP.exe
  C:\Windows\System\akBXntP.exe
  2⤵
  PID:4592
- C:\Windows\System\XLQdzqd.exe
  C:\Windows\System\XLQdzqd.exe
  2⤵
  PID:1816
- C:\Windows\System\wmKMTCy.exe
  C:\Windows\System\wmKMTCy.exe
  2⤵
  PID:4888
- C:\Windows\System\iCKdLhc.exe
  C:\Windows\System\iCKdLhc.exe
  2⤵
  PID:4904
- C:\Windows\System\MAqFkdd.exe
  C:\Windows\System\MAqFkdd.exe
  2⤵
  PID:3348
- C:\Windows\System\xYlnILy.exe
  C:\Windows\System\xYlnILy.exe
  2⤵
  PID:4088
- C:\Windows\System\BaRtRsa.exe
  C:\Windows\System\BaRtRsa.exe
  2⤵
  PID:2300
- C:\Windows\System\OGVXsnA.exe
  C:\Windows\System\OGVXsnA.exe
  2⤵
  PID:760
- C:\Windows\System\iSoNnyD.exe
  C:\Windows\System\iSoNnyD.exe
  2⤵
  PID:5016
- C:\Windows\System\aSSRUtd.exe
  C:\Windows\System\aSSRUtd.exe
  2⤵
  PID:5032
- C:\Windows\System\VIxaEcd.exe
  C:\Windows\System\VIxaEcd.exe
  2⤵
  PID:5092
- C:\Windows\System\YPhfOZz.exe
  C:\Windows\System\YPhfOZz.exe
  2⤵
  PID:5100
- C:\Windows\System\alPNofe.exe
  C:\Windows\System\alPNofe.exe
  2⤵
  PID:3492
- C:\Windows\System\uNCxsCl.exe
  C:\Windows\System\uNCxsCl.exe
  2⤵
  PID:1628
- C:\Windows\System\wuajRgD.exe
  C:\Windows\System\wuajRgD.exe
  2⤵
  PID:1924
- C:\Windows\System\aOqunaZ.exe
  C:\Windows\System\aOqunaZ.exe
  2⤵
  PID:2760
- C:\Windows\System\KstYaAo.exe
  C:\Windows\System\KstYaAo.exe
  2⤵
  PID:4180
- C:\Windows\System\ENYxNUp.exe
  C:\Windows\System\ENYxNUp.exe
  2⤵
  PID:4240
- C:\Windows\System\afUtRfp.exe
  C:\Windows\System\afUtRfp.exe
  2⤵
  PID:1424
- C:\Windows\System\PYHwSFa.exe
  C:\Windows\System\PYHwSFa.exe
  2⤵
  PID:2944
- C:\Windows\System\xILDWeU.exe
  C:\Windows\System\xILDWeU.exe
  2⤵
  PID:1668
- C:\Windows\System\VjKhcwt.exe
  C:\Windows\System\VjKhcwt.exe
  2⤵
  PID:4316
- C:\Windows\System\aBlDsPk.exe
  C:\Windows\System\aBlDsPk.exe
  2⤵
  PID:4348
- C:\Windows\System\jBTpCQM.exe
  C:\Windows\System\jBTpCQM.exe
  2⤵
  PID:4448
- C:\Windows\System\SXrMLYH.exe
  C:\Windows\System\SXrMLYH.exe
  2⤵
  PID:4480
- C:\Windows\System\hriTOHE.exe
  C:\Windows\System\hriTOHE.exe
  2⤵
  PID:2332
- C:\Windows\System\CZNzTyh.exe
  C:\Windows\System\CZNzTyh.exe
  2⤵
  PID:4620
- C:\Windows\System\POWIgIH.exe
  C:\Windows\System\POWIgIH.exe
  2⤵
  PID:1068
- C:\Windows\System\HzJzWjD.exe
  C:\Windows\System\HzJzWjD.exe
  2⤵
  PID:4816
- C:\Windows\System\gUUbFqV.exe
  C:\Windows\System\gUUbFqV.exe
  2⤵
  PID:4616
- C:\Windows\System\volSNPs.exe
  C:\Windows\System\volSNPs.exe
  2⤵
  PID:3680
- C:\Windows\System\sNyuLVB.exe
  C:\Windows\System\sNyuLVB.exe
  2⤵
  PID:4864
- C:\Windows\System\BkwSqHm.exe
  C:\Windows\System\BkwSqHm.exe
  2⤵
  PID:3420
- C:\Windows\System\bLMzKfY.exe
  C:\Windows\System\bLMzKfY.exe
  2⤵
  PID:3200
- C:\Windows\System\uSrIiBE.exe
  C:\Windows\System\uSrIiBE.exe
  2⤵
  PID:3352
- C:\Windows\System\oUHUSIu.exe
  C:\Windows\System\oUHUSIu.exe
  2⤵
  PID:4876
- C:\Windows\System\RJIepfe.exe
  C:\Windows\System\RJIepfe.exe
  2⤵
  PID:3448
- C:\Windows\System\tVqFsPM.exe
  C:\Windows\System\tVqFsPM.exe
  2⤵
  PID:1604
- C:\Windows\System\kcJTOUU.exe
  C:\Windows\System\kcJTOUU.exe
  2⤵
  PID:3764
- C:\Windows\System\cOAVdYF.exe
  C:\Windows\System\cOAVdYF.exe
  2⤵
  PID:632
- C:\Windows\System\kBEFDEq.exe
  C:\Windows\System\kBEFDEq.exe
  2⤵
  PID:3560
- C:\Windows\System\aKDZUkb.exe
  C:\Windows\System\aKDZUkb.exe
  2⤵
  PID:776
- C:\Windows\System\DgCKyJy.exe
  C:\Windows\System\DgCKyJy.exe
  2⤵
  PID:3836
- C:\Windows\System\NGldECY.exe
  C:\Windows\System\NGldECY.exe
  2⤵
  PID:3156
- C:\Windows\System\hansksi.exe
  C:\Windows\System\hansksi.exe
  2⤵
  PID:572
- C:\Windows\System\yAJAflc.exe
  C:\Windows\System\yAJAflc.exe
  2⤵
  PID:1288
- C:\Windows\System\cDyTeLK.exe
  C:\Windows\System\cDyTeLK.exe
  2⤵
  PID:4164
- C:\Windows\System\UEoPpat.exe
  C:\Windows\System\UEoPpat.exe
  2⤵
  PID:2484
- C:\Windows\System\dFqZqhD.exe
  C:\Windows\System\dFqZqhD.exe
  2⤵
  PID:2680
- C:\Windows\System\qfSGjJF.exe
  C:\Windows\System\qfSGjJF.exe
  2⤵
  PID:2876
- C:\Windows\System\gjsYpal.exe
  C:\Windows\System\gjsYpal.exe
  2⤵
  PID:4260
- C:\Windows\System\rtJjXDn.exe
  C:\Windows\System\rtJjXDn.exe
  2⤵
  PID:4580
- C:\Windows\System\GgWjsuP.exe
  C:\Windows\System\GgWjsuP.exe
  2⤵
  PID:4464
- C:\Windows\System\RgNKpao.exe
  C:\Windows\System\RgNKpao.exe
  2⤵
  PID:4432
- C:\Windows\System\gmIkhqr.exe
  C:\Windows\System\gmIkhqr.exe
  2⤵
  PID:4604
- C:\Windows\System\mxNLYQu.exe
  C:\Windows\System\mxNLYQu.exe
  2⤵
  PID:4696
- C:\Windows\System\etSqxdA.exe
  C:\Windows\System\etSqxdA.exe
  2⤵
  PID:3592
- C:\Windows\System\sQyiSbL.exe
  C:\Windows\System\sQyiSbL.exe
  2⤵
  PID:3304
- C:\Windows\System\CwBNmVY.exe
  C:\Windows\System\CwBNmVY.exe
  2⤵
  PID:1204
- C:\Windows\System\dMNuMSE.exe
  C:\Windows\System\dMNuMSE.exe
  2⤵
  PID:4796
- C:\Windows\System\KsFIrbI.exe
  C:\Windows\System\KsFIrbI.exe
  2⤵
  PID:4896
- C:\Windows\System\sgtmEdY.exe
  C:\Windows\System\sgtmEdY.exe
  2⤵
  PID:3964
- C:\Windows\System\cNBLVMe.exe
  C:\Windows\System\cNBLVMe.exe
  2⤵
  PID:5008
- C:\Windows\System\VQhrlAU.exe
  C:\Windows\System\VQhrlAU.exe
  2⤵
  PID:5084
- C:\Windows\System\EbWFJRg.exe
  C:\Windows\System\EbWFJRg.exe
  2⤵
  PID:844
- C:\Windows\System\WWqTOFC.exe
  C:\Windows\System\WWqTOFC.exe
  2⤵
  PID:696
- C:\Windows\System\HHrjJVZ.exe
  C:\Windows\System\HHrjJVZ.exe
  2⤵
  PID:5028
- C:\Windows\System\bKoSKeL.exe
  C:\Windows\System\bKoSKeL.exe
  2⤵
  PID:4040
- C:\Windows\System\peCBrDO.exe
  C:\Windows\System\peCBrDO.exe
  2⤵
  PID:2232
- C:\Windows\System\jgivIOB.exe
  C:\Windows\System\jgivIOB.exe
  2⤵
  PID:1412
- C:\Windows\System\jlXeDKB.exe
  C:\Windows\System\jlXeDKB.exe
  2⤵
  PID:4380
- C:\Windows\System\ZAaItVR.exe
  C:\Windows\System\ZAaItVR.exe
  2⤵
  PID:4976
- C:\Windows\System\VtaEKVk.exe
  C:\Windows\System\VtaEKVk.exe
  2⤵
  PID:2324
- C:\Windows\System\kARBrZe.exe
  C:\Windows\System\kARBrZe.exe
  2⤵
  PID:4312
- C:\Windows\System\ZSOrIrQ.exe
  C:\Windows\System\ZSOrIrQ.exe
  2⤵
  PID:2476
- C:\Windows\System\jXSPPGu.exe
  C:\Windows\System\jXSPPGu.exe
  2⤵
  PID:4552
- C:\Windows\System\jhxZQaA.exe
  C:\Windows\System\jhxZQaA.exe
  2⤵
  PID:3652
- C:\Windows\System\VUPlZUC.exe
  C:\Windows\System\VUPlZUC.exe
  2⤵
  PID:4920
- C:\Windows\System\oYYVJxh.exe
  C:\Windows\System\oYYVJxh.exe
  2⤵
  PID:3076
- C:\Windows\System\icGZkrw.exe
  C:\Windows\System\icGZkrw.exe
  2⤵
  PID:4848
- C:\Windows\System\issoDgQ.exe
  C:\Windows\System\issoDgQ.exe
  2⤵
  PID:3240
- C:\Windows\System\ZLPrCPN.exe
  C:\Windows\System\ZLPrCPN.exe
  2⤵
  PID:3508
- C:\Windows\System\Newlszp.exe
  C:\Windows\System\Newlszp.exe
  2⤵
  PID:3804
- C:\Windows\System\hdZQSaJ.exe
  C:\Windows\System\hdZQSaJ.exe
  2⤵
  PID:3540
- C:\Windows\System\ZdWYdib.exe
  C:\Windows\System\ZdWYdib.exe
  2⤵
  PID:3500
- C:\Windows\System\WstRHDz.exe
  C:\Windows\System\WstRHDz.exe
  2⤵
  PID:3868
- C:\Windows\System\QJDZTML.exe
  C:\Windows\System\QJDZTML.exe
  2⤵
  PID:3576
- C:\Windows\System\edHHAPp.exe
  C:\Windows\System\edHHAPp.exe
  2⤵
  PID:3628
- C:\Windows\System\beiwIKV.exe
  C:\Windows\System\beiwIKV.exe
  2⤵
  PID:3788
- C:\Windows\System\wKlTOrR.exe
  C:\Windows\System\wKlTOrR.exe
  2⤵
  PID:4100
- C:\Windows\System\TfbKsYc.exe
  C:\Windows\System\TfbKsYc.exe
  2⤵
  PID:4228
- C:\Windows\System\nxVBsJd.exe
  C:\Windows\System\nxVBsJd.exe
  2⤵
  PID:4572
- C:\Windows\System\GhdQxLq.exe
  C:\Windows\System\GhdQxLq.exe
  2⤵
  PID:4264
- C:\Windows\System\wHalcVU.exe
  C:\Windows\System\wHalcVU.exe
  2⤵
  PID:4668
- C:\Windows\System\TgXIHfK.exe
  C:\Windows\System\TgXIHfK.exe
  2⤵
  PID:4832
- C:\Windows\System\hbXnykB.exe
  C:\Windows\System\hbXnykB.exe
  2⤵
  PID:4940
- C:\Windows\System\uPLAjQi.exe
  C:\Windows\System\uPLAjQi.exe
  2⤵
  PID:1652
- C:\Windows\System\HxyNERL.exe
  C:\Windows\System\HxyNERL.exe
  2⤵
  PID:4984
- C:\Windows\System\XiFrIQS.exe
  C:\Windows\System\XiFrIQS.exe
  2⤵
  PID:4144
- C:\Windows\System\xoMGevI.exe
  C:\Windows\System\xoMGevI.exe
  2⤵
  PID:4212
- C:\Windows\System\xobThmO.exe
  C:\Windows\System\xobThmO.exe
  2⤵
  PID:4516
- C:\Windows\System\yYsmUPq.exe
  C:\Windows\System\yYsmUPq.exe
  2⤵
  PID:4548
- C:\Windows\System\oiMSjGR.exe
  C:\Windows\System\oiMSjGR.exe
  2⤵
  PID:3520
- C:\Windows\System\GbeDZuc.exe
  C:\Windows\System\GbeDZuc.exe
  2⤵
  PID:3588
- C:\Windows\System\gexJwRb.exe
  C:\Windows\System\gexJwRb.exe
  2⤵
  PID:3220
- C:\Windows\System\nBwtgef.exe
  C:\Windows\System\nBwtgef.exe
  2⤵
  PID:1432
- C:\Windows\System\DnGNXnh.exe
  C:\Windows\System\DnGNXnh.exe
  2⤵
  PID:3640
- C:\Windows\System\pprUsyZ.exe
  C:\Windows\System\pprUsyZ.exe
  2⤵
  PID:288
- C:\Windows\System\FcucDvU.exe
  C:\Windows\System\FcucDvU.exe
  2⤵
  PID:4916
- C:\Windows\System\SkOOqFm.exe
  C:\Windows\System\SkOOqFm.exe
  2⤵
  PID:2792
- C:\Windows\System\PSyuvlz.exe
  C:\Windows\System\PSyuvlz.exe
  2⤵
  PID:3224
- C:\Windows\System\ofEYURw.exe
  C:\Windows\System\ofEYURw.exe
  2⤵
  PID:2848
- C:\Windows\System\gsyGCBd.exe
  C:\Windows\System\gsyGCBd.exe
  2⤵
  PID:3404
- C:\Windows\System\ccpwboe.exe
  C:\Windows\System\ccpwboe.exe
  2⤵
  PID:4732
- C:\Windows\System\CCxAISG.exe
  C:\Windows\System\CCxAISG.exe
  2⤵
  PID:4056
- C:\Windows\System\tfShNNx.exe
  C:\Windows\System\tfShNNx.exe
  2⤵
  PID:5088
- C:\Windows\System\RSLdwDW.exe
  C:\Windows\System\RSLdwDW.exe
  2⤵
  PID:4376
- C:\Windows\System\AAVpDeD.exe
  C:\Windows\System\AAVpDeD.exe
  2⤵
  PID:2380
- C:\Windows\System\QdqmeOA.exe
  C:\Windows\System\QdqmeOA.exe
  2⤵
  PID:4500
- C:\Windows\System\MNvGVoK.exe
  C:\Windows\System\MNvGVoK.exe
  2⤵
  PID:4828
- C:\Windows\System\kBwsMFS.exe
  C:\Windows\System\kBwsMFS.exe
  2⤵
  PID:3152
- C:\Windows\System\LFTurhc.exe
  C:\Windows\System\LFTurhc.exe
  2⤵
  PID:4328
- C:\Windows\System\vPayFJj.exe
  C:\Windows\System\vPayFJj.exe
  2⤵
  PID:5068
- C:\Windows\System\rJDpLbr.exe
  C:\Windows\System\rJDpLbr.exe
  2⤵
  PID:5136
- C:\Windows\System\vNNkdCY.exe
  C:\Windows\System\vNNkdCY.exe
  2⤵
  PID:5152
- C:\Windows\System\twvSMLL.exe
  C:\Windows\System\twvSMLL.exe
  2⤵
  PID:5168
- C:\Windows\System\kdKOnSH.exe
  C:\Windows\System\kdKOnSH.exe
  2⤵
  PID:5184
- C:\Windows\System\HDCGuOJ.exe
  C:\Windows\System\HDCGuOJ.exe
  2⤵
  PID:5200
- C:\Windows\System\nVWjqeO.exe
  C:\Windows\System\nVWjqeO.exe
  2⤵
  PID:5216
- C:\Windows\System\QoYbuLf.exe
  C:\Windows\System\QoYbuLf.exe
  2⤵
  PID:5232
- C:\Windows\System\DnGGToF.exe
  C:\Windows\System\DnGGToF.exe
  2⤵
  PID:5248
- C:\Windows\System\UKvxDqU.exe
  C:\Windows\System\UKvxDqU.exe
  2⤵
  PID:5264
- C:\Windows\System\iSjrwsd.exe
  C:\Windows\System\iSjrwsd.exe
  2⤵
  PID:5280
- C:\Windows\System\cjJQwfN.exe
  C:\Windows\System\cjJQwfN.exe
  2⤵
  PID:5296
- C:\Windows\System\wiXMLYI.exe
  C:\Windows\System\wiXMLYI.exe
  2⤵
  PID:5312
- C:\Windows\System\aBNSFPb.exe
  C:\Windows\System\aBNSFPb.exe
  2⤵
  PID:5328
- C:\Windows\System\yfGudtF.exe
  C:\Windows\System\yfGudtF.exe
  2⤵
  PID:5344
- C:\Windows\System\NgULbIe.exe
  C:\Windows\System\NgULbIe.exe
  2⤵
  PID:5360
- C:\Windows\System\iXWdqfy.exe
  C:\Windows\System\iXWdqfy.exe
  2⤵
  PID:5376
- C:\Windows\System\VEQlyFN.exe
  C:\Windows\System\VEQlyFN.exe
  2⤵
  PID:5392
- C:\Windows\System\hugIiVI.exe
  C:\Windows\System\hugIiVI.exe
  2⤵
  PID:5408
- C:\Windows\System\qiiWFCg.exe
  C:\Windows\System\qiiWFCg.exe
  2⤵
  PID:5424
- C:\Windows\System\KsfVOoc.exe
  C:\Windows\System\KsfVOoc.exe
  2⤵
  PID:5440
- C:\Windows\System\qxRURdU.exe
  C:\Windows\System\qxRURdU.exe
  2⤵
  PID:5456
- C:\Windows\System\YEZFPZc.exe
  C:\Windows\System\YEZFPZc.exe
  2⤵
  PID:5472
- C:\Windows\System\hKPAtNj.exe
  C:\Windows\System\hKPAtNj.exe
  2⤵
  PID:5488
- C:\Windows\System\ZxLFyEZ.exe
  C:\Windows\System\ZxLFyEZ.exe
  2⤵
  PID:5504
- C:\Windows\System\vrciZqH.exe
  C:\Windows\System\vrciZqH.exe
  2⤵
  PID:5520
- C:\Windows\System\AUhnBRa.exe
  C:\Windows\System\AUhnBRa.exe
  2⤵
  PID:5536
- C:\Windows\System\swikWTN.exe
  C:\Windows\System\swikWTN.exe
  2⤵
  PID:5552
- C:\Windows\System\lWGmfcR.exe
  C:\Windows\System\lWGmfcR.exe
  2⤵
  PID:5568
- C:\Windows\System\oNaClHL.exe
  C:\Windows\System\oNaClHL.exe
  2⤵
  PID:5584
- C:\Windows\System\xgDBohD.exe
  C:\Windows\System\xgDBohD.exe
  2⤵
  PID:5600
- C:\Windows\System\CzgcUKS.exe
  C:\Windows\System\CzgcUKS.exe
  2⤵
  PID:5616
- C:\Windows\System\KQThNuk.exe
  C:\Windows\System\KQThNuk.exe
  2⤵
  PID:5632
- C:\Windows\System\foEMVCx.exe
  C:\Windows\System\foEMVCx.exe
  2⤵
  PID:5652
- C:\Windows\System\BRdEuZk.exe
  C:\Windows\System\BRdEuZk.exe
  2⤵
  PID:5668
- C:\Windows\System\OUnAKOf.exe
  C:\Windows\System\OUnAKOf.exe
  2⤵
  PID:5684
- C:\Windows\System\XpGoCGi.exe
  C:\Windows\System\XpGoCGi.exe
  2⤵
  PID:5700
- C:\Windows\System\TjOcVQy.exe
  C:\Windows\System\TjOcVQy.exe
  2⤵
  PID:5716
- C:\Windows\System\cdbGome.exe
  C:\Windows\System\cdbGome.exe
  2⤵
  PID:5756
- C:\Windows\System\HxUAIaR.exe
  C:\Windows\System\HxUAIaR.exe
  2⤵
  PID:5776
- C:\Windows\System\ClamlYo.exe
  C:\Windows\System\ClamlYo.exe
  2⤵
  PID:5796
- C:\Windows\System\ipRmkYl.exe
  C:\Windows\System\ipRmkYl.exe
  2⤵
  PID:5816
- C:\Windows\System\qAyKvJM.exe
  C:\Windows\System\qAyKvJM.exe
  2⤵
  PID:5832
- C:\Windows\System\FbNqDsc.exe
  C:\Windows\System\FbNqDsc.exe
  2⤵
  PID:5848
- C:\Windows\System\LykHmHh.exe
  C:\Windows\System\LykHmHh.exe
  2⤵
  PID:5876
- C:\Windows\System\yUrlpZQ.exe
  C:\Windows\System\yUrlpZQ.exe
  2⤵
  PID:5900
- C:\Windows\System\WpVGxcJ.exe
  C:\Windows\System\WpVGxcJ.exe
  2⤵
  PID:5916
- C:\Windows\System\VViwknS.exe
  C:\Windows\System\VViwknS.exe
  2⤵
  PID:5932
- C:\Windows\System\pCJxTxo.exe
  C:\Windows\System\pCJxTxo.exe
  2⤵
  PID:5952
- C:\Windows\System\BNpiFBd.exe
  C:\Windows\System\BNpiFBd.exe
  2⤵
  PID:5972
- C:\Windows\System\wsFuwwu.exe
  C:\Windows\System\wsFuwwu.exe
  2⤵
  PID:5988
- C:\Windows\System\bcdIsaN.exe
  C:\Windows\System\bcdIsaN.exe
  2⤵
  PID:6004
- C:\Windows\System\WrzvKmK.exe
  C:\Windows\System\WrzvKmK.exe
  2⤵
  PID:6020
- C:\Windows\System\adShGeE.exe
  C:\Windows\System\adShGeE.exe
  2⤵
  PID:6036
- C:\Windows\System\hDlLRPk.exe
  C:\Windows\System\hDlLRPk.exe
  2⤵
  PID:6060
- C:\Windows\System\CmxYpKl.exe
  C:\Windows\System\CmxYpKl.exe
  2⤵
  PID:6076
- C:\Windows\System\msNUivt.exe
  C:\Windows\System\msNUivt.exe
  2⤵
  PID:6092
- C:\Windows\System\HqjMUHb.exe
  C:\Windows\System\HqjMUHb.exe
  2⤵
  PID:6108
- C:\Windows\System\otEqtPL.exe
  C:\Windows\System\otEqtPL.exe
  2⤵
  PID:6128
- C:\Windows\System\awQBuec.exe
  C:\Windows\System\awQBuec.exe
  2⤵
  PID:2488
- C:\Windows\System\elVGdKf.exe
  C:\Windows\System\elVGdKf.exe
  2⤵
  PID:5148
- C:\Windows\System\MUfxyoi.exe
  C:\Windows\System\MUfxyoi.exe
  2⤵
  PID:3884
- C:\Windows\System\zhNjiSZ.exe
  C:\Windows\System\zhNjiSZ.exe
  2⤵
  PID:3584
- C:\Windows\System\NSktltX.exe
  C:\Windows\System\NSktltX.exe
  2⤵
  PID:5196
- C:\Windows\System\nZqHEiX.exe
  C:\Windows\System\nZqHEiX.exe
  2⤵
  PID:5224
- C:\Windows\System\lTuvKnF.exe
  C:\Windows\System\lTuvKnF.exe
  2⤵
  PID:5260
- C:\Windows\System\QmaqQJf.exe
  C:\Windows\System\QmaqQJf.exe
  2⤵
  PID:5320
- C:\Windows\System\MAOHEqv.exe
  C:\Windows\System\MAOHEqv.exe
  2⤵
  PID:5340
- C:\Windows\System\kPTzPrj.exe
  C:\Windows\System\kPTzPrj.exe
  2⤵
  PID:5384
- C:\Windows\System\KxEZKtG.exe
  C:\Windows\System\KxEZKtG.exe
  2⤵
  PID:5352
- C:\Windows\System\kLMZidZ.exe
  C:\Windows\System\kLMZidZ.exe
  2⤵
  PID:5464
- C:\Windows\System\WWzmFXi.exe
  C:\Windows\System\WWzmFXi.exe
  2⤵
  PID:5496
- C:\Windows\System\JGotUBG.exe
  C:\Windows\System\JGotUBG.exe
  2⤵
  PID:5516
- C:\Windows\System\QsaaSZc.exe
  C:\Windows\System\QsaaSZc.exe
  2⤵
  PID:5548
- C:\Windows\System\imoPfcb.exe
  C:\Windows\System\imoPfcb.exe
  2⤵
  PID:5576
- C:\Windows\System\tFYdfpy.exe
  C:\Windows\System\tFYdfpy.exe
  2⤵
  PID:5628
- C:\Windows\System\shrgYIN.exe
  C:\Windows\System\shrgYIN.exe
  2⤵
  PID:5612
- C:\Windows\System\FdbglPJ.exe
  C:\Windows\System\FdbglPJ.exe
  2⤵
  PID:5692
- C:\Windows\System\AQmJrXr.exe
  C:\Windows\System\AQmJrXr.exe
  2⤵
  PID:5712
- C:\Windows\System\SEImUWU.exe
  C:\Windows\System\SEImUWU.exe
  2⤵
  PID:5740
- C:\Windows\System\dfcqdUC.exe
  C:\Windows\System\dfcqdUC.exe
  2⤵
  PID:5784
- C:\Windows\System\mbuuWUG.exe
  C:\Windows\System\mbuuWUG.exe
  2⤵
  PID:5808
- C:\Windows\System\FcINOCi.exe
  C:\Windows\System\FcINOCi.exe
  2⤵
  PID:5828
- C:\Windows\System\czNSpab.exe
  C:\Windows\System\czNSpab.exe
  2⤵
  PID:6056
- C:\Windows\System\dlnYiPT.exe
  C:\Windows\System\dlnYiPT.exe
  2⤵
  PID:5888
- C:\Windows\System\VhajtYQ.exe
  C:\Windows\System\VhajtYQ.exe
  2⤵
  PID:5940
- C:\Windows\System\DGlqCDN.exe
  C:\Windows\System\DGlqCDN.exe
  2⤵
  PID:5984
- C:\Windows\System\JHfbazc.exe
  C:\Windows\System\JHfbazc.exe
  2⤵
  PID:5892
- C:\Windows\System\jnUBNyC.exe
  C:\Windows\System\jnUBNyC.exe
  2⤵
  PID:1892
- C:\Windows\System\FCQfNxs.exe
  C:\Windows\System\FCQfNxs.exe
  2⤵
  PID:5960
- C:\Windows\System\Dkxpbbm.exe
  C:\Windows\System\Dkxpbbm.exe
  2⤵
  PID:6028
- C:\Windows\System\VzaAAgw.exe
  C:\Windows\System\VzaAAgw.exe
  2⤵
  PID:6072
- C:\Windows\System\BcNtAwG.exe
  C:\Windows\System\BcNtAwG.exe
  2⤵
  PID:5180
- C:\Windows\System\DzgFyIO.exe
  C:\Windows\System\DzgFyIO.exe
  2⤵
  PID:4664
- C:\Windows\System\lljyRNC.exe
  C:\Windows\System\lljyRNC.exe
  2⤵
  PID:5160
- C:\Windows\System\EVkIrQB.exe
  C:\Windows\System\EVkIrQB.exe
  2⤵
  PID:5324
- C:\Windows\System\uISVZdh.exe
  C:\Windows\System\uISVZdh.exe
  2⤵
  PID:1928
- C:\Windows\System\PdfBDpH.exe
  C:\Windows\System\PdfBDpH.exe
  2⤵
  PID:5452
- C:\Windows\System\AdOZQgE.exe
  C:\Windows\System\AdOZQgE.exe
  2⤵
  PID:5596
- C:\Windows\System\KhuKgQj.exe
  C:\Windows\System\KhuKgQj.exe
  2⤵
  PID:5664
- C:\Windows\System\CYqyidd.exe
  C:\Windows\System\CYqyidd.exe
  2⤵
  PID:5792
- C:\Windows\System\jvgZHpk.exe
  C:\Windows\System\jvgZHpk.exe
  2⤵
  PID:5644
- C:\Windows\System\sCXwMhP.exe
  C:\Windows\System\sCXwMhP.exe
  2⤵
  PID:5436
- C:\Windows\System\DWsFxOy.exe
  C:\Windows\System\DWsFxOy.exe
  2⤵
  PID:5560
- C:\Windows\System\HkNhnaz.exe
  C:\Windows\System\HkNhnaz.exe
  2⤵
  PID:5736
- C:\Windows\System\GIbcYlY.exe
  C:\Windows\System\GIbcYlY.exe
  2⤵
  PID:6000
- C:\Windows\System\CFOHfmq.exe
  C:\Windows\System\CFOHfmq.exe
  2⤵
  PID:6116
- C:\Windows\System\JZFPGWD.exe
  C:\Windows\System\JZFPGWD.exe
  2⤵
  PID:5256
- C:\Windows\System\RDAjWTb.exe
  C:\Windows\System\RDAjWTb.exe
  2⤵
  PID:5272
- C:\Windows\System\XPmnRNt.exe
  C:\Windows\System\XPmnRNt.exe
  2⤵
  PID:5336
- C:\Windows\System\hoEDJtL.exe
  C:\Windows\System\hoEDJtL.exe
  2⤵
  PID:5868
- C:\Windows\System\lqsVrDE.exe
  C:\Windows\System\lqsVrDE.exe
  2⤵
  PID:6016
- C:\Windows\System\pHTgghg.exe
  C:\Windows\System\pHTgghg.exe
  2⤵
  PID:3136
- C:\Windows\System\lKodovv.exe
  C:\Windows\System\lKodovv.exe
  2⤵
  PID:5724
- C:\Windows\System\WhhGvFe.exe
  C:\Windows\System\WhhGvFe.exe
  2⤵
  PID:6156
- C:\Windows\System\uPGTSYs.exe
  C:\Windows\System\uPGTSYs.exe
  2⤵
  PID:6172
- C:\Windows\System\oIlranA.exe
  C:\Windows\System\oIlranA.exe
  2⤵
  PID:6188
- C:\Windows\System\ZnLeAvd.exe
  C:\Windows\System\ZnLeAvd.exe
  2⤵
  PID:6204
- C:\Windows\System\jlGElJP.exe
  C:\Windows\System\jlGElJP.exe
  2⤵
  PID:6220
- C:\Windows\System\ANlyUrP.exe
  C:\Windows\System\ANlyUrP.exe
  2⤵
  PID:6236
- C:\Windows\System\jxkMomE.exe
  C:\Windows\System\jxkMomE.exe
  2⤵
  PID:6252
- C:\Windows\System\EtBeFHb.exe
  C:\Windows\System\EtBeFHb.exe
  2⤵
  PID:6268
- C:\Windows\System\fBakELv.exe
  C:\Windows\System\fBakELv.exe
  2⤵
  PID:6284
- C:\Windows\System\JTFlofF.exe
  C:\Windows\System\JTFlofF.exe
  2⤵
  PID:6300
- C:\Windows\System\BWpElZd.exe
  C:\Windows\System\BWpElZd.exe
  2⤵
  PID:6316
- C:\Windows\System\SCWYnpP.exe
  C:\Windows\System\SCWYnpP.exe
  2⤵
  PID:6332
- C:\Windows\System\kPsuMsQ.exe
  C:\Windows\System\kPsuMsQ.exe
  2⤵
  PID:6348
- C:\Windows\System\LAHBBpl.exe
  C:\Windows\System\LAHBBpl.exe
  2⤵
  PID:6368
- C:\Windows\System\svoNqMk.exe
  C:\Windows\System\svoNqMk.exe
  2⤵
  PID:6388
- C:\Windows\System\TqyTwmd.exe
  C:\Windows\System\TqyTwmd.exe
  2⤵
  PID:6408
- C:\Windows\System\pdjzJWp.exe
  C:\Windows\System\pdjzJWp.exe
  2⤵
  PID:6424
- C:\Windows\System\gOEzkTv.exe
  C:\Windows\System\gOEzkTv.exe
  2⤵
  PID:6440
- C:\Windows\System\fORmEPW.exe
  C:\Windows\System\fORmEPW.exe
  2⤵
  PID:6456
- C:\Windows\System\LqSsuVM.exe
  C:\Windows\System\LqSsuVM.exe
  2⤵
  PID:6472
- C:\Windows\System\jzlbKpM.exe
  C:\Windows\System\jzlbKpM.exe
  2⤵
  PID:6488
- C:\Windows\System\rxzSMLE.exe
  C:\Windows\System\rxzSMLE.exe
  2⤵
  PID:6504
- C:\Windows\System\xIEYlrf.exe
  C:\Windows\System\xIEYlrf.exe
  2⤵
  PID:6520
- C:\Windows\System\QoyZKsz.exe
  C:\Windows\System\QoyZKsz.exe
  2⤵
  PID:6536
- C:\Windows\System\lHPJLbU.exe
  C:\Windows\System\lHPJLbU.exe
  2⤵
  PID:6552
- C:\Windows\System\RfZtKPn.exe
  C:\Windows\System\RfZtKPn.exe
  2⤵
  PID:6568
- C:\Windows\System\RcsjjYU.exe
  C:\Windows\System\RcsjjYU.exe
  2⤵
  PID:6584
- C:\Windows\System\JQEqVkQ.exe
  C:\Windows\System\JQEqVkQ.exe
  2⤵
  PID:6600
- C:\Windows\System\UUgEJGF.exe
  C:\Windows\System\UUgEJGF.exe
  2⤵
  PID:6616
- C:\Windows\System\fWwscoh.exe
  C:\Windows\System\fWwscoh.exe
  2⤵
  PID:6632
- C:\Windows\System\ZaFDDyy.exe
  C:\Windows\System\ZaFDDyy.exe
  2⤵
  PID:6648
- C:\Windows\System\sGZwEWm.exe
  C:\Windows\System\sGZwEWm.exe
  2⤵
  PID:6668
- C:\Windows\System\GMVETKY.exe
  C:\Windows\System\GMVETKY.exe
  2⤵
  PID:6684
- C:\Windows\System\IHmPZWv.exe
  C:\Windows\System\IHmPZWv.exe
  2⤵
  PID:6700
- C:\Windows\System\zYyAedk.exe
  C:\Windows\System\zYyAedk.exe
  2⤵
  PID:6716
- C:\Windows\System\ZUiqVId.exe
  C:\Windows\System\ZUiqVId.exe
  2⤵
  PID:6732
- C:\Windows\System\ofLjBOS.exe
  C:\Windows\System\ofLjBOS.exe
  2⤵
  PID:6748
- C:\Windows\System\sMEYIoX.exe
  C:\Windows\System\sMEYIoX.exe
  2⤵
  PID:6764
- C:\Windows\System\TboVmtn.exe
  C:\Windows\System\TboVmtn.exe
  2⤵
  PID:6784
- C:\Windows\System\qTIZHjH.exe
  C:\Windows\System\qTIZHjH.exe
  2⤵
  PID:6800
- C:\Windows\System\VMZIzMq.exe
  C:\Windows\System\VMZIzMq.exe
  2⤵
  PID:6816
- C:\Windows\System\GihUOCn.exe
  C:\Windows\System\GihUOCn.exe
  2⤵
  PID:6832
- C:\Windows\System\KElOwql.exe
  C:\Windows\System\KElOwql.exe
  2⤵
  PID:6852
- C:\Windows\System\zdQICOF.exe
  C:\Windows\System\zdQICOF.exe
  2⤵
  PID:6872
- C:\Windows\System\vFlbkxe.exe
  C:\Windows\System\vFlbkxe.exe
  2⤵
  PID:6892
- C:\Windows\System\FYRJbRe.exe
  C:\Windows\System\FYRJbRe.exe
  2⤵
  PID:6908
- C:\Windows\System\cLgYVZC.exe
  C:\Windows\System\cLgYVZC.exe
  2⤵
  PID:6924
- C:\Windows\System\KrXYIYl.exe
  C:\Windows\System\KrXYIYl.exe
  2⤵
  PID:6940
- C:\Windows\System\yfghElv.exe
  C:\Windows\System\yfghElv.exe
  2⤵
  PID:7024
- C:\Windows\System\HJzZtnU.exe
  C:\Windows\System\HJzZtnU.exe
  2⤵
  PID:7040
- C:\Windows\System\pjqSpqX.exe
  C:\Windows\System\pjqSpqX.exe
  2⤵
  PID:7060
- C:\Windows\System\JSlKAIK.exe
  C:\Windows\System\JSlKAIK.exe
  2⤵
  PID:7080
- C:\Windows\System\uWVucVI.exe
  C:\Windows\System\uWVucVI.exe
  2⤵
  PID:7096
- C:\Windows\System\mUkxHep.exe
  C:\Windows\System\mUkxHep.exe
  2⤵
  PID:7116
- C:\Windows\System\dtXMzoC.exe
  C:\Windows\System\dtXMzoC.exe
  2⤵
  PID:7132
- C:\Windows\System\ygJQVVi.exe
  C:\Windows\System\ygJQVVi.exe
  2⤵
  PID:7148
- C:\Windows\System\tDayYji.exe
  C:\Windows\System\tDayYji.exe
  2⤵
  PID:4012
- C:\Windows\System\TOnsthG.exe
  C:\Windows\System\TOnsthG.exe
  2⤵
  PID:6148
- C:\Windows\System\LQBUgSw.exe
  C:\Windows\System\LQBUgSw.exe
  2⤵
  PID:5752
- C:\Windows\System\WSUpEar.exe
  C:\Windows\System\WSUpEar.exe
  2⤵
  PID:6248
- C:\Windows\System\iuZktau.exe
  C:\Windows\System\iuZktau.exe
  2⤵
  PID:6308
- C:\Windows\System\qgKgHOQ.exe
  C:\Windows\System\qgKgHOQ.exe
  2⤵
  PID:6376
- C:\Windows\System\aEHQbFI.exe
  C:\Windows\System\aEHQbFI.exe
  2⤵
  PID:6416
- C:\Windows\System\UAvLdlY.exe
  C:\Windows\System\UAvLdlY.exe
  2⤵
  PID:5480
- C:\Windows\System\kKyYrRE.exe
  C:\Windows\System\kKyYrRE.exe
  2⤵
  PID:6548
- C:\Windows\System\fkHanvY.exe
  C:\Windows\System\fkHanvY.exe
  2⤵
  PID:6612
- C:\Windows\System\OrnYUWo.exe
  C:\Windows\System\OrnYUWo.exe
  2⤵
  PID:6696
- C:\Windows\System\yECzCaS.exe
  C:\Windows\System\yECzCaS.exe
  2⤵
  PID:6728
- C:\Windows\System\XhixkpO.exe
  C:\Windows\System\XhixkpO.exe
  2⤵
  PID:5512
- C:\Windows\System\VNWSlkA.exe
  C:\Windows\System\VNWSlkA.exe
  2⤵
  PID:6436
- C:\Windows\System\xqqxCeL.exe
  C:\Windows\System\xqqxCeL.exe
  2⤵
  PID:6656
- C:\Windows\System\hegBEnB.exe
  C:\Windows\System\hegBEnB.exe
  2⤵
  PID:5192
- C:\Windows\System\euxdNJG.exe
  C:\Windows\System\euxdNJG.exe
  2⤵
  PID:5872
- C:\Windows\System\hRNJdmW.exe
  C:\Windows\System\hRNJdmW.exe
  2⤵
  PID:6260
- C:\Windows\System\PsxksHt.exe
  C:\Windows\System\PsxksHt.exe
  2⤵
  PID:6328
- C:\Windows\System\SUDfDwZ.exe
  C:\Windows\System\SUDfDwZ.exe
  2⤵
  PID:6364
- C:\Windows\System\mVSRyoA.exe
  C:\Windows\System\mVSRyoA.exe
  2⤵
  PID:6432
- C:\Windows\System\YoeAaAO.exe
  C:\Windows\System\YoeAaAO.exe
  2⤵
  PID:6500
- C:\Windows\System\nvdiAjS.exe
  C:\Windows\System\nvdiAjS.exe
  2⤵
  PID:6596
- C:\Windows\System\UKjZjEX.exe
  C:\Windows\System\UKjZjEX.exe
  2⤵
  PID:6660
- C:\Windows\System\xKhaoDh.exe
  C:\Windows\System\xKhaoDh.exe
  2⤵
  PID:6760
- C:\Windows\System\OvlgzIU.exe
  C:\Windows\System\OvlgzIU.exe
  2⤵
  PID:6824
- C:\Windows\System\SGMDzaj.exe
  C:\Windows\System\SGMDzaj.exe
  2⤵
  PID:6888
- C:\Windows\System\hHWkCOO.exe
  C:\Windows\System\hHWkCOO.exe
  2⤵
  PID:6740
- C:\Windows\System\zToBWyg.exe
  C:\Windows\System\zToBWyg.exe
  2⤵
  PID:6848
- C:\Windows\System\QxnxSqM.exe
  C:\Windows\System\QxnxSqM.exe
  2⤵
  PID:6988
- C:\Windows\System\uNcwlmZ.exe
  C:\Windows\System\uNcwlmZ.exe
  2⤵
  PID:6964
- C:\Windows\System\AQLykRk.exe
  C:\Windows\System\AQLykRk.exe
  2⤵
  PID:7164
- C:\Windows\System\NqNdGCf.exe
  C:\Windows\System\NqNdGCf.exe
  2⤵
  PID:7004
- C:\Windows\System\JIsewXd.exe
  C:\Windows\System\JIsewXd.exe
  2⤵
  PID:7052
- C:\Windows\System\JEpbIfK.exe
  C:\Windows\System\JEpbIfK.exe
  2⤵
  PID:7160
- C:\Windows\System\SmPYQpE.exe
  C:\Windows\System\SmPYQpE.exe
  2⤵
  PID:6276
- C:\Windows\System\KsUjflR.exe
  C:\Windows\System\KsUjflR.exe
  2⤵
  PID:7124
- C:\Windows\System\DdyVZFp.exe
  C:\Windows\System\DdyVZFp.exe
  2⤵
  PID:6676
- C:\Windows\System\bBlJxWy.exe
  C:\Windows\System\bBlJxWy.exe
  2⤵
  PID:6100
- C:\Windows\System\xHBhwnI.exe
  C:\Windows\System\xHBhwnI.exe
  2⤵
  PID:6868
- C:\Windows\System\yMSFyWb.exe
  C:\Windows\System\yMSFyWb.exe
  2⤵
  PID:6484
- C:\Windows\System\BmFjAIf.exe
  C:\Windows\System\BmFjAIf.exe
  2⤵
  PID:6120
- C:\Windows\System\NXnjtWI.exe
  C:\Windows\System\NXnjtWI.exe
  2⤵
  PID:6920
- C:\Windows\System\zGVKstf.exe
  C:\Windows\System\zGVKstf.exe
  2⤵
  PID:7016
- C:\Windows\System\LgoBwaQ.exe
  C:\Windows\System\LgoBwaQ.exe
  2⤵
  PID:7092
- C:\Windows\System\vrhfMXh.exe
  C:\Windows\System\vrhfMXh.exe
  2⤵
  PID:6448
- C:\Windows\System\ZLzOgBV.exe
  C:\Windows\System\ZLzOgBV.exe
  2⤵
  PID:6544
- C:\Windows\System\WQpmSAR.exe
  C:\Windows\System\WQpmSAR.exe
  2⤵
  PID:7036
- C:\Windows\System\Qeuihkk.exe
  C:\Windows\System\Qeuihkk.exe
  2⤵
  PID:5592
- C:\Windows\System\SzuoXNn.exe
  C:\Windows\System\SzuoXNn.exe
  2⤵
  PID:6244
- C:\Windows\System\GphlNoz.exe
  C:\Windows\System\GphlNoz.exe
  2⤵
  PID:4408
- C:\Windows\System\VCXXOVJ.exe
  C:\Windows\System\VCXXOVJ.exe
  2⤵
  PID:6380
- C:\Windows\System\OACEssO.exe
  C:\Windows\System\OACEssO.exe
  2⤵
  PID:7068
- C:\Windows\System\qcWtaSW.exe
  C:\Windows\System\qcWtaSW.exe
  2⤵
  PID:4632
- C:\Windows\System\HBQoNbU.exe
  C:\Windows\System\HBQoNbU.exe
  2⤵
  PID:6724
- C:\Windows\System\ZOQNOWJ.exe
  C:\Windows\System\ZOQNOWJ.exe
  2⤵
  PID:6936
- C:\Windows\System\guKSxhE.exe
  C:\Windows\System\guKSxhE.exe
  2⤵
  PID:6976
- C:\Windows\System\yInwWbF.exe
  C:\Windows\System\yInwWbF.exe
  2⤵
  PID:7056
- C:\Windows\System\EoGMJXk.exe
  C:\Windows\System\EoGMJXk.exe
  2⤵
  PID:6292
- C:\Windows\System\YgUsubs.exe
  C:\Windows\System\YgUsubs.exe
  2⤵
  PID:6532
- C:\Windows\System\JJyAcvi.exe
  C:\Windows\System\JJyAcvi.exe
  2⤵
  PID:6756
- C:\Windows\System\pCAnwpf.exe
  C:\Windows\System\pCAnwpf.exe
  2⤵
  PID:6124
- C:\Windows\System\tWLHgzS.exe
  C:\Windows\System\tWLHgzS.exe
  2⤵
  PID:6844
- C:\Windows\System\GoEOQAa.exe
  C:\Windows\System\GoEOQAa.exe
  2⤵
  PID:6692
- C:\Windows\System\YmfLbDo.exe
  C:\Windows\System\YmfLbDo.exe
  2⤵
  PID:6956
- C:\Windows\System\jbwNXii.exe
  C:\Windows\System\jbwNXii.exe
  2⤵
  PID:6608
- C:\Windows\System\FLrwntr.exe
  C:\Windows\System\FLrwntr.exe
  2⤵
  PID:5788
- C:\Windows\System\enwzftZ.exe
  C:\Windows\System\enwzftZ.exe
  2⤵
  PID:6516
- C:\Windows\System\AGpNocB.exe
  C:\Windows\System\AGpNocB.exe
  2⤵
  PID:6880
- C:\Windows\System\uHqudEz.exe
  C:\Windows\System\uHqudEz.exe
  2⤵
  PID:6860
- C:\Windows\System\NUmLvDt.exe
  C:\Windows\System\NUmLvDt.exe
  2⤵
  PID:6996
- C:\Windows\System\aPTmDdA.exe
  C:\Windows\System\aPTmDdA.exe
  2⤵
  PID:5844
- C:\Windows\System\uNIotMl.exe
  C:\Windows\System\uNIotMl.exe
  2⤵
  PID:6200
- C:\Windows\System\RVdwwYg.exe
  C:\Windows\System\RVdwwYg.exe
  2⤵
  PID:6344
- C:\Windows\System\UnewrEn.exe
  C:\Windows\System\UnewrEn.exe
  2⤵
  PID:7156
- C:\Windows\System\sXsVLac.exe
  C:\Windows\System\sXsVLac.exe
  2⤵
  PID:6452
- C:\Windows\System\ItEmihD.exe
  C:\Windows\System\ItEmihD.exe
  2⤵
  PID:5304
- C:\Windows\System\mCwEQTT.exe
  C:\Windows\System\mCwEQTT.exe
  2⤵
  PID:6808
- C:\Windows\System\aNexLaU.exe
  C:\Windows\System\aNexLaU.exe
  2⤵
  PID:7172
- C:\Windows\System\pNHPUiH.exe
  C:\Windows\System\pNHPUiH.exe
  2⤵
  PID:7188
- C:\Windows\System\kMAnnnn.exe
  C:\Windows\System\kMAnnnn.exe
  2⤵
  PID:7204
- C:\Windows\System\LSjFXeM.exe
  C:\Windows\System\LSjFXeM.exe
  2⤵
  PID:7220
- C:\Windows\System\BvqCrEN.exe
  C:\Windows\System\BvqCrEN.exe
  2⤵
  PID:7236
- C:\Windows\System\jkXuDMj.exe
  C:\Windows\System\jkXuDMj.exe
  2⤵
  PID:7252
- C:\Windows\System\CJXUbUR.exe
  C:\Windows\System\CJXUbUR.exe
  2⤵
  PID:7268
- C:\Windows\System\BwZwqua.exe
  C:\Windows\System\BwZwqua.exe
  2⤵
  PID:7284
- C:\Windows\System\LfpsdDg.exe
  C:\Windows\System\LfpsdDg.exe
  2⤵
  PID:7300
- C:\Windows\System\YgoSkOR.exe
  C:\Windows\System\YgoSkOR.exe
  2⤵
  PID:7316
- C:\Windows\System\tDwOITU.exe
  C:\Windows\System\tDwOITU.exe
  2⤵
  PID:7332
- C:\Windows\System\ywBxqvy.exe
  C:\Windows\System\ywBxqvy.exe
  2⤵
  PID:7348
- C:\Windows\System\YTfKkpG.exe
  C:\Windows\System\YTfKkpG.exe
  2⤵
  PID:7364
- C:\Windows\System\pykjVcx.exe
  C:\Windows\System\pykjVcx.exe
  2⤵
  PID:7380
- C:\Windows\System\pKWwawQ.exe
  C:\Windows\System\pKWwawQ.exe
  2⤵
  PID:7396
- C:\Windows\System\lzAedYX.exe
  C:\Windows\System\lzAedYX.exe
  2⤵
  PID:7412
- C:\Windows\System\wRJXCWX.exe
  C:\Windows\System\wRJXCWX.exe
  2⤵
  PID:7428
- C:\Windows\System\DlJRAyc.exe
  C:\Windows\System\DlJRAyc.exe
  2⤵
  PID:7444
- C:\Windows\System\sKZPhTF.exe
  C:\Windows\System\sKZPhTF.exe
  2⤵
  PID:7460
- C:\Windows\System\cHiwOcn.exe
  C:\Windows\System\cHiwOcn.exe
  2⤵
  PID:7476
- C:\Windows\System\BKjGalT.exe
  C:\Windows\System\BKjGalT.exe
  2⤵
  PID:7492
- C:\Windows\System\yzgSzVA.exe
  C:\Windows\System\yzgSzVA.exe
  2⤵
  PID:7508
- C:\Windows\System\xSvuwCM.exe
  C:\Windows\System\xSvuwCM.exe
  2⤵
  PID:7524
- C:\Windows\System\PAPXTsb.exe
  C:\Windows\System\PAPXTsb.exe
  2⤵
  PID:7540
- C:\Windows\System\finnyin.exe
  C:\Windows\System\finnyin.exe
  2⤵
  PID:7568
- C:\Windows\System\ddloBXB.exe
  C:\Windows\System\ddloBXB.exe
  2⤵
  PID:7588
- C:\Windows\System\ZqkdrEi.exe
  C:\Windows\System\ZqkdrEi.exe
  2⤵
  PID:7604
- C:\Windows\System\YdbAnLM.exe
  C:\Windows\System\YdbAnLM.exe
  2⤵
  PID:7620
- C:\Windows\System\enMgNqy.exe
  C:\Windows\System\enMgNqy.exe
  2⤵
  PID:7668
- C:\Windows\System\iUWBzIh.exe
  C:\Windows\System\iUWBzIh.exe
  2⤵
  PID:7688
- C:\Windows\System\LjgCOHv.exe
  C:\Windows\System\LjgCOHv.exe
  2⤵
  PID:7704
- C:\Windows\System\BHvdmCS.exe
  C:\Windows\System\BHvdmCS.exe
  2⤵
  PID:7724
- C:\Windows\System\ImFalSL.exe
  C:\Windows\System\ImFalSL.exe
  2⤵
  PID:7740
- C:\Windows\System\XjXRUAW.exe
  C:\Windows\System\XjXRUAW.exe
  2⤵
  PID:7760
- C:\Windows\System\tFHaEzw.exe
  C:\Windows\System\tFHaEzw.exe
  2⤵
  PID:7776
- C:\Windows\System\nYGsABX.exe
  C:\Windows\System\nYGsABX.exe
  2⤵
  PID:7792
- C:\Windows\System\ZDmPDwH.exe
  C:\Windows\System\ZDmPDwH.exe
  2⤵
  PID:7808
- C:\Windows\System\dGUeyxK.exe
  C:\Windows\System\dGUeyxK.exe
  2⤵
  PID:7824
- C:\Windows\System\uymljfL.exe
  C:\Windows\System\uymljfL.exe
  2⤵
  PID:7840
- C:\Windows\System\TZIXmBJ.exe
  C:\Windows\System\TZIXmBJ.exe
  2⤵
  PID:7856
- C:\Windows\System\diTAwaG.exe
  C:\Windows\System\diTAwaG.exe
  2⤵
  PID:7872
- C:\Windows\System\LSZkxvf.exe
  C:\Windows\System\LSZkxvf.exe
  2⤵
  PID:7888
- C:\Windows\System\CyxygYN.exe
  C:\Windows\System\CyxygYN.exe
  2⤵
  PID:7904
- C:\Windows\System\KfKzjUb.exe
  C:\Windows\System\KfKzjUb.exe
  2⤵
  PID:7932
- C:\Windows\System\mZAwmvX.exe
  C:\Windows\System\mZAwmvX.exe
  2⤵
  PID:7948
- C:\Windows\System\dxehfcs.exe
  C:\Windows\System\dxehfcs.exe
  2⤵
  PID:7964
- C:\Windows\System\hgFjLlt.exe
  C:\Windows\System\hgFjLlt.exe
  2⤵
  PID:7980
- C:\Windows\System\jPynmaj.exe
  C:\Windows\System\jPynmaj.exe
  2⤵
  PID:7996
- C:\Windows\System\rCWnAcn.exe
  C:\Windows\System\rCWnAcn.exe
  2⤵
  PID:8012
- C:\Windows\System\BKAiVuq.exe
  C:\Windows\System\BKAiVuq.exe
  2⤵
  PID:7344
- C:\Windows\System\nSRmEme.exe
  C:\Windows\System\nSRmEme.exe
  2⤵
  PID:7488
- C:\Windows\System\IynKxXj.exe
  C:\Windows\System\IynKxXj.exe
  2⤵
  PID:7516
- C:\Windows\System\Tktmwex.exe
  C:\Windows\System\Tktmwex.exe
  2⤵
  PID:7532
- C:\Windows\System\JUHlucf.exe
  C:\Windows\System\JUHlucf.exe
  2⤵
  PID:7548
- C:\Windows\System\pqTujAB.exe
  C:\Windows\System\pqTujAB.exe
  2⤵
  PID:7576
- C:\Windows\System\aYepIOc.exe
  C:\Windows\System\aYepIOc.exe
  2⤵
  PID:7648
- C:\Windows\System\efMTmaS.exe
  C:\Windows\System\efMTmaS.exe
  2⤵
  PID:7800
- C:\Windows\System\RLHQjRm.exe
  C:\Windows\System\RLHQjRm.exe
  2⤵
  PID:7784
- C:\Windows\System\wuibsip.exe
  C:\Windows\System\wuibsip.exe
  2⤵
  PID:7696
- C:\Windows\System\hBDzpJl.exe
  C:\Windows\System\hBDzpJl.exe
  2⤵
  PID:7664
- C:\Windows\System\pUmeAyF.exe
  C:\Windows\System\pUmeAyF.exe
  2⤵
  PID:7788
- C:\Windows\System\wuteMrq.exe
  C:\Windows\System\wuteMrq.exe
  2⤵
  PID:7816
- C:\Windows\System\nZdgIXM.exe
  C:\Windows\System\nZdgIXM.exe
  2⤵
  PID:7912
- C:\Windows\System\ugGFRCl.exe
  C:\Windows\System\ugGFRCl.exe
  2⤵
  PID:7976
- C:\Windows\System\IQISEgE.exe
  C:\Windows\System\IQISEgE.exe
  2⤵
  PID:7956
- C:\Windows\System\KUzjewm.exe
  C:\Windows\System\KUzjewm.exe
  2⤵
  PID:8028
- C:\Windows\System\VocUPwX.exe
  C:\Windows\System\VocUPwX.exe
  2⤵
  PID:7296
- C:\Windows\System\HGgZYfT.exe
  C:\Windows\System\HGgZYfT.exe
  2⤵
  PID:7420
- C:\Windows\System\qfjvNAO.exe
  C:\Windows\System\qfjvNAO.exe
  2⤵
  PID:7312
- C:\Windows\System\pwqBvVa.exe
  C:\Windows\System\pwqBvVa.exe
  2⤵
  PID:7452
- C:\Windows\System\LhWzEaq.exe
  C:\Windows\System\LhWzEaq.exe
  2⤵
  PID:5924
- C:\Windows\System\tuBPOno.exe
  C:\Windows\System\tuBPOno.exe
  2⤵
  PID:7404
- C:\Windows\System\tuLCGAj.exe
  C:\Windows\System\tuLCGAj.exe
  2⤵
  PID:7436
- C:\Windows\System\FLJQGqd.exe
  C:\Windows\System\FLJQGqd.exe
  2⤵
  PID:7600
- C:\Windows\System\sdTtSCi.exe
  C:\Windows\System\sdTtSCi.exe
  2⤵
  PID:7468
- C:\Windows\System\jYzCdPU.exe
  C:\Windows\System\jYzCdPU.exe
  2⤵
  PID:7536
- C:\Windows\System\qSSjrKB.exe
  C:\Windows\System\qSSjrKB.exe
  2⤵
  PID:7616
- C:\Windows\System\HVannTd.exe
  C:\Windows\System\HVannTd.exe
  2⤵
  PID:7896
- C:\Windows\System\xAHuxHx.exe
  C:\Windows\System\xAHuxHx.exe
  2⤵
  PID:7376
- C:\Windows\System\lSZRqCB.exe
  C:\Windows\System\lSZRqCB.exe
  2⤵
  PID:7552
- C:\Windows\System\lIWnFza.exe
  C:\Windows\System\lIWnFza.exe
  2⤵
  PID:7716
- C:\Windows\System\HIfOtFj.exe
  C:\Windows\System\HIfOtFj.exe
  2⤵
  PID:7680
- C:\Windows\System\CrlMacS.exe
  C:\Windows\System\CrlMacS.exe
  2⤵
  PID:7756
- C:\Windows\System\YOztUXC.exe
  C:\Windows\System\YOztUXC.exe
  2⤵
  PID:7832
- C:\Windows\System\gNlXyeO.exe
  C:\Windows\System\gNlXyeO.exe
  2⤵
  PID:7880
- C:\Windows\System\fHRYxBV.exe
  C:\Windows\System\fHRYxBV.exe
  2⤵
  PID:8020
- C:\Windows\System\ucpltkx.exe
  C:\Windows\System\ucpltkx.exe
  2⤵
  PID:8052
- C:\Windows\System\yeGTUrf.exe
  C:\Windows\System\yeGTUrf.exe
  2⤵
  PID:8056
- C:\Windows\System\AGgBjQB.exe
  C:\Windows\System\AGgBjQB.exe
  2⤵
  PID:5864
- C:\Windows\System\pLSATrM.exe
  C:\Windows\System\pLSATrM.exe
  2⤵
  PID:7340
- C:\Windows\System\lBiqxyb.exe
  C:\Windows\System\lBiqxyb.exe
  2⤵
  PID:7712
- C:\Windows\System\RmENhXl.exe
  C:\Windows\System\RmENhXl.exe
  2⤵
  PID:8060
- C:\Windows\System\LhazXVT.exe
  C:\Windows\System\LhazXVT.exe
  2⤵
  PID:8204
- C:\Windows\System\PAKpWrA.exe
  C:\Windows\System\PAKpWrA.exe
  2⤵
  PID:8220
- C:\Windows\System\xqKrAaO.exe
  C:\Windows\System\xqKrAaO.exe
  2⤵
  PID:8236
- C:\Windows\System\EQewhEt.exe
  C:\Windows\System\EQewhEt.exe
  2⤵
  PID:8252
- C:\Windows\System\VBhbqgn.exe
  C:\Windows\System\VBhbqgn.exe
  2⤵
  PID:8268
- C:\Windows\System\uvJeGoF.exe
  C:\Windows\System\uvJeGoF.exe
  2⤵
  PID:8284
- C:\Windows\System\bVmMcyL.exe
  C:\Windows\System\bVmMcyL.exe
  2⤵
  PID:8300
- C:\Windows\System\ljwchzh.exe
  C:\Windows\System\ljwchzh.exe
  2⤵
  PID:8316
- C:\Windows\System\IJEuMci.exe
  C:\Windows\System\IJEuMci.exe
  2⤵
  PID:8332
- C:\Windows\System\zpAWpDn.exe
  C:\Windows\System\zpAWpDn.exe
  2⤵
  PID:8348
- C:\Windows\System\FHhuyDl.exe
  C:\Windows\System\FHhuyDl.exe
  2⤵
  PID:8364
- C:\Windows\System\wvCPjIa.exe
  C:\Windows\System\wvCPjIa.exe
  2⤵
  PID:8380
- C:\Windows\System\jmtnfOB.exe
  C:\Windows\System\jmtnfOB.exe
  2⤵
  PID:8396
- C:\Windows\System\dLjOGvd.exe
  C:\Windows\System\dLjOGvd.exe
  2⤵
  PID:8412
- C:\Windows\System\nLBodbP.exe
  C:\Windows\System\nLBodbP.exe
  2⤵
  PID:8428
- C:\Windows\System\YIgOAyR.exe
  C:\Windows\System\YIgOAyR.exe
  2⤵
  PID:8444
- C:\Windows\System\gkCfJmk.exe
  C:\Windows\System\gkCfJmk.exe
  2⤵
  PID:8464
- C:\Windows\System\vezbrOw.exe
  C:\Windows\System\vezbrOw.exe
  2⤵
  PID:8480
- C:\Windows\System\UxDpOBF.exe
  C:\Windows\System\UxDpOBF.exe
  2⤵
  PID:8496
- C:\Windows\System\hkTtRXm.exe
  C:\Windows\System\hkTtRXm.exe
  2⤵
  PID:8512
- C:\Windows\System\GdsjLiM.exe
  C:\Windows\System\GdsjLiM.exe
  2⤵
  PID:8528
- C:\Windows\System\QxspPPP.exe
  C:\Windows\System\QxspPPP.exe
  2⤵
  PID:8544
- C:\Windows\System\lDQcyMm.exe
  C:\Windows\System\lDQcyMm.exe
  2⤵
  PID:8560
- C:\Windows\System\PEtzHSk.exe
  C:\Windows\System\PEtzHSk.exe
  2⤵
  PID:8576
- C:\Windows\System\QlIGDbu.exe
  C:\Windows\System\QlIGDbu.exe
  2⤵
  PID:8592
- C:\Windows\System\dUlwQhu.exe
  C:\Windows\System\dUlwQhu.exe
  2⤵
  PID:8612
- C:\Windows\System\CeMfKcW.exe
  C:\Windows\System\CeMfKcW.exe
  2⤵
  PID:8628
- C:\Windows\System\hlLSZus.exe
  C:\Windows\System\hlLSZus.exe
  2⤵
  PID:8644
- C:\Windows\System\MNgjVqk.exe
  C:\Windows\System\MNgjVqk.exe
  2⤵
  PID:8660
- C:\Windows\System\ztxMdMr.exe
  C:\Windows\System\ztxMdMr.exe
  2⤵
  PID:8676
- C:\Windows\System\hrozZAY.exe
  C:\Windows\System\hrozZAY.exe
  2⤵
  PID:8692
- C:\Windows\System\jkjmxcL.exe
  C:\Windows\System\jkjmxcL.exe
  2⤵
  PID:8708
- C:\Windows\System\tayaavZ.exe
  C:\Windows\System\tayaavZ.exe
  2⤵
  PID:8724
- C:\Windows\System\iEEkoVx.exe
  C:\Windows\System\iEEkoVx.exe
  2⤵
  PID:8740
- C:\Windows\System\QTtNWiJ.exe
  C:\Windows\System\QTtNWiJ.exe
  2⤵
  PID:8756
- C:\Windows\System\qQprKHa.exe
  C:\Windows\System\qQprKHa.exe
  2⤵
  PID:8772
- C:\Windows\System\XpRWBTm.exe
  C:\Windows\System\XpRWBTm.exe
  2⤵
  PID:8796
- C:\Windows\System\howRFth.exe
  C:\Windows\System\howRFth.exe
  2⤵
  PID:8812
- C:\Windows\System\XBsXgsa.exe
  C:\Windows\System\XBsXgsa.exe
  2⤵
  PID:8828
- C:\Windows\System\ZBomodn.exe
  C:\Windows\System\ZBomodn.exe
  2⤵
  PID:8844
- C:\Windows\System\nlVBwcH.exe
  C:\Windows\System\nlVBwcH.exe
  2⤵
  PID:8860
- C:\Windows\System\BHnZefN.exe
  C:\Windows\System\BHnZefN.exe
  2⤵
  PID:8876
- C:\Windows\System\vErGtJM.exe
  C:\Windows\System\vErGtJM.exe
  2⤵
  PID:8896
- C:\Windows\System\ixWEZrl.exe
  C:\Windows\System\ixWEZrl.exe
  2⤵
  PID:8912
- C:\Windows\System\UrMETyS.exe
  C:\Windows\System\UrMETyS.exe
  2⤵
  PID:8928
- C:\Windows\System\xqsxCav.exe
  C:\Windows\System\xqsxCav.exe
  2⤵
  PID:8944
- C:\Windows\System\zZDqdIu.exe
  C:\Windows\System\zZDqdIu.exe
  2⤵
  PID:8960
- C:\Windows\System\iDMjPrf.exe
  C:\Windows\System\iDMjPrf.exe
  2⤵
  PID:8976
- C:\Windows\System\sNrPrOq.exe
  C:\Windows\System\sNrPrOq.exe
  2⤵
  PID:8992
- C:\Windows\System\qzCieop.exe
  C:\Windows\System\qzCieop.exe
  2⤵
  PID:9008
- C:\Windows\System\mxepojL.exe
  C:\Windows\System\mxepojL.exe
  2⤵
  PID:9024
- C:\Windows\System\hFcOseJ.exe
  C:\Windows\System\hFcOseJ.exe
  2⤵
  PID:9040
- C:\Windows\System\njwmRpq.exe
  C:\Windows\System\njwmRpq.exe
  2⤵
  PID:9056
- C:\Windows\System\dnNqAkg.exe
  C:\Windows\System\dnNqAkg.exe
  2⤵
  PID:9072
- C:\Windows\System\IwNqFYx.exe
  C:\Windows\System\IwNqFYx.exe
  2⤵
  PID:9088
- C:\Windows\System\yEqCaWe.exe
  C:\Windows\System\yEqCaWe.exe
  2⤵
  PID:9104
- C:\Windows\System\DsUyfKM.exe
  C:\Windows\System\DsUyfKM.exe
  2⤵
  PID:9120
- C:\Windows\System\WfkTnCT.exe
  C:\Windows\System\WfkTnCT.exe
  2⤵
  PID:9136
- C:\Windows\System\pIdkxDC.exe
  C:\Windows\System\pIdkxDC.exe
  2⤵
  PID:9152
- C:\Windows\System\VYFONBr.exe
  C:\Windows\System\VYFONBr.exe
  2⤵
  PID:9168
- C:\Windows\System\zaIXQyE.exe
  C:\Windows\System\zaIXQyE.exe
  2⤵
  PID:9184
- C:\Windows\System\JTbvYBP.exe
  C:\Windows\System\JTbvYBP.exe
  2⤵
  PID:9200
- C:\Windows\System\Qsxexnf.exe
  C:\Windows\System\Qsxexnf.exe
  2⤵
  PID:7656
- C:\Windows\System\zfkubUP.exe
  C:\Windows\System\zfkubUP.exe
  2⤵
  PID:7580
- C:\Windows\System\IrJwObj.exe
  C:\Windows\System\IrJwObj.exe
  2⤵
  PID:8084
- C:\Windows\System\iQNQEUv.exe
  C:\Windows\System\iQNQEUv.exe
  2⤵
  PID:6356
- C:\Windows\System\NInliBu.exe
  C:\Windows\System\NInliBu.exe
  2⤵
  PID:7928
- C:\Windows\System\ZGtKCWv.exe
  C:\Windows\System\ZGtKCWv.exe
  2⤵
  PID:8004
- C:\Windows\System\HqPwiYy.exe
  C:\Windows\System\HqPwiYy.exe
  2⤵
  PID:7820
- C:\Windows\System\GccNfGD.exe
  C:\Windows\System\GccNfGD.exe
  2⤵
  PID:6232
- C:\Windows\System\wSYsLPx.exe
  C:\Windows\System\wSYsLPx.exe
  2⤵
  PID:8872
- C:\Windows\System\lyxVlNe.exe
  C:\Windows\System\lyxVlNe.exe
  2⤵
  PID:6216
- C:\Windows\System\POGAdfk.exe
  C:\Windows\System\POGAdfk.exe
  2⤵
  PID:7584
- C:\Windows\System\ecThEdw.exe
  C:\Windows\System\ecThEdw.exe
  2⤵
  PID:7200
- C:\Windows\System\hIifAkj.exe
  C:\Windows\System\hIifAkj.exe
  2⤵
  PID:8228
- C:\Windows\System\cjJZzOi.exe
  C:\Windows\System\cjJZzOi.exe
  2⤵
  PID:9068
- C:\Windows\System\saJfSDp.exe
  C:\Windows\System\saJfSDp.exe
  2⤵
  PID:9048
- C:\Windows\System\PNmlBOg.exe
  C:\Windows\System\PNmlBOg.exe
  2⤵
  PID:7280
- C:\Windows\System\EFBcHhd.exe
  C:\Windows\System\EFBcHhd.exe
  2⤵
  PID:8096
- C:\Windows\System\oAopsmI.exe
  C:\Windows\System\oAopsmI.exe
  2⤵
  PID:8112
- C:\Windows\System\aANLSMk.exe
  C:\Windows\System\aANLSMk.exe
  2⤵
  PID:8340
- C:\Windows\System\TZShHFw.exe
  C:\Windows\System\TZShHFw.exe
  2⤵
  PID:7772
- C:\Windows\System\QWkMVCN.exe
  C:\Windows\System\QWkMVCN.exe
  2⤵
  PID:8144
- C:\Windows\System\vOCJyfs.exe
  C:\Windows\System\vOCJyfs.exe
  2⤵
  PID:8172
- C:\Windows\System\XzMyelW.exe
  C:\Windows\System\XzMyelW.exe
  2⤵
  PID:6712
- C:\Windows\System\GiFimso.exe
  C:\Windows\System\GiFimso.exe
  2⤵
  PID:2812
- C:\Windows\System\zCzLRaY.exe
  C:\Windows\System\zCzLRaY.exe
  2⤵
  PID:8024
- C:\Windows\System\wCCBICK.exe
  C:\Windows\System\wCCBICK.exe
  2⤵
  PID:7456
- C:\Windows\System\xbDwrLF.exe
  C:\Windows\System\xbDwrLF.exe
  2⤵
  PID:6468
- C:\Windows\System\yvNmOPi.exe
  C:\Windows\System\yvNmOPi.exe
  2⤵
  PID:8196
- C:\Windows\System\CQQZwqI.exe
  C:\Windows\System\CQQZwqI.exe
  2⤵
  PID:7232
- C:\Windows\System\gkEecWj.exe
  C:\Windows\System\gkEecWj.exe
  2⤵
  PID:8388
- C:\Windows\System\MenjrcP.exe
  C:\Windows\System\MenjrcP.exe
  2⤵
  PID:8504
- C:\Windows\System\sPWmEeD.exe
  C:\Windows\System\sPWmEeD.exe
  2⤵
  PID:8536
- C:\Windows\System\ppIOQsl.exe
  C:\Windows\System\ppIOQsl.exe
  2⤵
  PID:8836
- C:\Windows\System\mmaaxIN.exe
  C:\Windows\System\mmaaxIN.exe
  2⤵
  PID:8324
- C:\Windows\System\yNvgPPs.exe
  C:\Windows\System\yNvgPPs.exe
  2⤵
  PID:8640
- C:\Windows\System\yiOGMoZ.exe
  C:\Windows\System\yiOGMoZ.exe
  2⤵
  PID:8668
- C:\Windows\System\mEjXcmn.exe
  C:\Windows\System\mEjXcmn.exe
  2⤵
  PID:8768
- C:\Windows\System\KhhguMh.exe
  C:\Windows\System\KhhguMh.exe
  2⤵
  PID:9000
- C:\Windows\System\BOBrVjo.exe
  C:\Windows\System\BOBrVjo.exe
  2⤵
  PID:8176
- C:\Windows\System\hCRRaRW.exe
  C:\Windows\System\hCRRaRW.exe
  2⤵
  PID:8884
- C:\Windows\System\LepwHfb.exe
  C:\Windows\System\LepwHfb.exe
  2⤵
  PID:8936
- C:\Windows\System\Ufrikoz.exe
  C:\Windows\System\Ufrikoz.exe
  2⤵
  PID:8824
- C:\Windows\System\MgECsCi.exe
  C:\Windows\System\MgECsCi.exe
  2⤵
  PID:8604
- C:\Windows\System\TsbMFyV.exe
  C:\Windows\System\TsbMFyV.exe
  2⤵
  PID:9036
- C:\Windows\System\bycSdFz.exe
  C:\Windows\System\bycSdFz.exe
  2⤵
  PID:8424
- C:\Windows\System\VJQYVrI.exe
  C:\Windows\System\VJQYVrI.exe
  2⤵
  PID:8888
- C:\Windows\System\dEkCTmO.exe
  C:\Windows\System\dEkCTmO.exe
  2⤵
  PID:8752
- C:\Windows\System\IjLLPxo.exe
  C:\Windows\System\IjLLPxo.exe
  2⤵
  PID:7244
- C:\Windows\System\GyjFSRc.exe
  C:\Windows\System\GyjFSRc.exe
  2⤵
  PID:8184
- C:\Windows\System\ydjEBNW.exe
  C:\Windows\System\ydjEBNW.exe
  2⤵
  PID:8840
- C:\Windows\System\tFsEEyZ.exe
  C:\Windows\System\tFsEEyZ.exe
  2⤵
  PID:8476
- C:\Windows\System\bsQyYJi.exe
  C:\Windows\System\bsQyYJi.exe
  2⤵
  PID:8704
- C:\Windows\System\lZwvaZd.exe
  C:\Windows\System\lZwvaZd.exe
  2⤵
  PID:8152
- C:\Windows\System\weGRMik.exe
  C:\Windows\System\weGRMik.exe
  2⤵
  PID:8572
- C:\Windows\System\OZuGowO.exe
  C:\Windows\System\OZuGowO.exe
  2⤵
  PID:8456
- C:\Windows\System\bQRUJuv.exe
  C:\Windows\System\bQRUJuv.exe
  2⤵
  PID:9132
- C:\Windows\System\GQnjqvD.exe
  C:\Windows\System\GQnjqvD.exe
  2⤵
  PID:9016
- C:\Windows\System\uqAgTCy.exe
  C:\Windows\System\uqAgTCy.exe
  2⤵
  PID:7748
- C:\Windows\System\BVsbOJN.exe
  C:\Windows\System\BVsbOJN.exe
  2⤵
  PID:8276
- C:\Windows\System\OthGpgt.exe
  C:\Windows\System\OthGpgt.exe
  2⤵
  PID:8984
- C:\Windows\System\lgkoekX.exe
  C:\Windows\System\lgkoekX.exe
  2⤵
  PID:7564
- C:\Windows\System\EPQDNDl.exe
  C:\Windows\System\EPQDNDl.exe
  2⤵
  PID:8088
- C:\Windows\System\wRqxYyT.exe
  C:\Windows\System\wRqxYyT.exe
  2⤵
  PID:8164
- C:\Windows\System\BRBZyrf.exe
  C:\Windows\System\BRBZyrf.exe
  2⤵
  PID:8420
- C:\Windows\System\GthzLzl.exe
  C:\Windows\System\GthzLzl.exe
  2⤵
  PID:8972
- C:\Windows\System\vXCgNWi.exe
  C:\Windows\System\vXCgNWi.exe
  2⤵
  PID:8108
- C:\Windows\System\cXUPnld.exe
  C:\Windows\System\cXUPnld.exe
  2⤵
  PID:7632
- C:\Windows\System\CmmkyOT.exe
  C:\Windows\System\CmmkyOT.exe
  2⤵
  PID:7324
- C:\Windows\System\GJfLPKe.exe
  C:\Windows\System\GJfLPKe.exe
  2⤵
  PID:8908
- C:\Windows\System\DdNqcOU.exe
  C:\Windows\System\DdNqcOU.exe
  2⤵
  PID:8328
- C:\Windows\System\zmcEyhD.exe
  C:\Windows\System\zmcEyhD.exe
  2⤵
  PID:8296
- C:\Windows\System\JazOcgz.exe
  C:\Windows\System\JazOcgz.exe
  2⤵
  PID:7356
- C:\Windows\System\JhUiHoa.exe
  C:\Windows\System\JhUiHoa.exe
  2⤵
  PID:8700
- C:\Windows\System\fgdBdZl.exe
  C:\Windows\System\fgdBdZl.exe
  2⤵
  PID:8784
- C:\Windows\System\qXlLdBQ.exe
  C:\Windows\System\qXlLdBQ.exe
  2⤵
  PID:8344
- C:\Windows\System\uFAdTVL.exe
  C:\Windows\System\uFAdTVL.exe
  2⤵
  PID:8168
- C:\Windows\System\iXBxOHG.exe
  C:\Windows\System\iXBxOHG.exe
  2⤵
  PID:9144
- C:\Windows\System\HDBhrrV.exe
  C:\Windows\System\HDBhrrV.exe
  2⤵
  PID:8392
- C:\Windows\System\uMQscdx.exe
  C:\Windows\System\uMQscdx.exe
  2⤵
  PID:9096
- C:\Windows\System\wEBHFxD.exe
  C:\Windows\System\wEBHFxD.exe
  2⤵
  PID:1380
- C:\Windows\System\UYGqjKh.exe
  C:\Windows\System\UYGqjKh.exe
  2⤵
  PID:2808
- C:\Windows\System\hUfIDOo.exe
  C:\Windows\System\hUfIDOo.exe
  2⤵
  PID:8720
- C:\Windows\System\rxAilRD.exe
  C:\Windows\System\rxAilRD.exe
  2⤵
  PID:8404
- C:\Windows\System\FkETvth.exe
  C:\Windows\System\FkETvth.exe
  2⤵
  PID:8600
- C:\Windows\System\JmnbPQR.exe
  C:\Windows\System\JmnbPQR.exe
  2⤵
  PID:7752
- C:\Windows\System\ZKVPRSY.exe
  C:\Windows\System\ZKVPRSY.exe
  2⤵
  PID:8160
- C:\Windows\System\dczqhZN.exe
  C:\Windows\System\dczqhZN.exe
  2⤵
  PID:9080
- C:\Windows\System\oHDAMDj.exe
  C:\Windows\System\oHDAMDj.exe
  2⤵
  PID:8868
- C:\Windows\System\FSalXiR.exe
  C:\Windows\System\FSalXiR.exe
  2⤵
  PID:8652
- C:\Windows\System\WXhWFTp.exe
  C:\Windows\System\WXhWFTp.exe
  2⤵
  PID:6968
- C:\Windows\System\RbDQNZH.exe
  C:\Windows\System\RbDQNZH.exe
  2⤵
  PID:8244
- C:\Windows\System\RJQlAin.exe
  C:\Windows\System\RJQlAin.exe
  2⤵
  PID:9180
- C:\Windows\System\bVWqSdm.exe
  C:\Windows\System\bVWqSdm.exe
  2⤵
  PID:7700
- C:\Windows\System\SMyYYEg.exe
  C:\Windows\System\SMyYYEg.exe
  2⤵
  PID:7768
- C:\Windows\System\dqMzRSz.exe
  C:\Windows\System\dqMzRSz.exe
  2⤵
  PID:7636
- C:\Windows\System\abRDFTt.exe
  C:\Windows\System\abRDFTt.exe
  2⤵
  PID:8092
- C:\Windows\System\qBwmIUM.exe
  C:\Windows\System\qBwmIUM.exe
  2⤵
  PID:8588
- C:\Windows\System\mITBIRo.exe
  C:\Windows\System\mITBIRo.exe
  2⤵
  PID:8076
- C:\Windows\System\KOwAAqp.exe
  C:\Windows\System\KOwAAqp.exe
  2⤵
  PID:9228
- C:\Windows\System\rSGoApd.exe
  C:\Windows\System\rSGoApd.exe
  2⤵
  PID:9268
- C:\Windows\System\aJYhdoa.exe
  C:\Windows\System\aJYhdoa.exe
  2⤵
  PID:9284
- C:\Windows\System\tetnXoT.exe
  C:\Windows\System\tetnXoT.exe
  2⤵
  PID:9300
- C:\Windows\System\HWYkdtT.exe
  C:\Windows\System\HWYkdtT.exe
  2⤵
  PID:9316
- C:\Windows\System\kcHvxUe.exe
  C:\Windows\System\kcHvxUe.exe
  2⤵
  PID:9332
- C:\Windows\System\AZLQYpb.exe
  C:\Windows\System\AZLQYpb.exe
  2⤵
  PID:9348
- C:\Windows\System\UpUTQUY.exe
  C:\Windows\System\UpUTQUY.exe
  2⤵
  PID:9364
- C:\Windows\System\EDHUjAn.exe
  C:\Windows\System\EDHUjAn.exe
  2⤵
  PID:9380
- C:\Windows\System\rFWkzei.exe
  C:\Windows\System\rFWkzei.exe
  2⤵
  PID:9408
- C:\Windows\System\WLfdUyS.exe
  C:\Windows\System\WLfdUyS.exe
  2⤵
  PID:9428
- C:\Windows\System\VeiFaxa.exe
  C:\Windows\System\VeiFaxa.exe
  2⤵
  PID:9444
- C:\Windows\System\AVWgnfS.exe
  C:\Windows\System\AVWgnfS.exe
  2⤵
  PID:9460
- C:\Windows\System\rFCgjio.exe
  C:\Windows\System\rFCgjio.exe
  2⤵
  PID:9476
- C:\Windows\System\ArITheO.exe
  C:\Windows\System\ArITheO.exe
  2⤵
  PID:9492
- C:\Windows\System\YilFGhu.exe
  C:\Windows\System\YilFGhu.exe
  2⤵
  PID:9520
- C:\Windows\System\GzJArpH.exe
  C:\Windows\System\GzJArpH.exe
  2⤵
  PID:9536
- C:\Windows\System\VQNClsT.exe
  C:\Windows\System\VQNClsT.exe
  2⤵
  PID:9552
- C:\Windows\System\tsducDE.exe
  C:\Windows\System\tsducDE.exe
  2⤵
  PID:9572
- C:\Windows\System\AkKGqse.exe
  C:\Windows\System\AkKGqse.exe
  2⤵
  PID:9588
- C:\Windows\System\oBmauRz.exe
  C:\Windows\System\oBmauRz.exe
  2⤵
  PID:9604
- C:\Windows\System\NecvvvW.exe
  C:\Windows\System\NecvvvW.exe
  2⤵
  PID:9620
- C:\Windows\System\MYRukdz.exe
  C:\Windows\System\MYRukdz.exe
  2⤵
  PID:9640
- C:\Windows\System\raJtzQr.exe
  C:\Windows\System\raJtzQr.exe
  2⤵
  PID:9656
- C:\Windows\System\TDRGPDs.exe
  C:\Windows\System\TDRGPDs.exe
  2⤵
  PID:9672
- C:\Windows\System\gHCsOwk.exe
  C:\Windows\System\gHCsOwk.exe
  2⤵
  PID:9688
- C:\Windows\System\fPOvVda.exe
  C:\Windows\System\fPOvVda.exe
  2⤵
  PID:9704
- C:\Windows\System\mzFhmfh.exe
  C:\Windows\System\mzFhmfh.exe
  2⤵
  PID:9720
- C:\Windows\System\iTLrsvP.exe
  C:\Windows\System\iTLrsvP.exe
  2⤵
  PID:9736
- C:\Windows\System\ADIgZzj.exe
  C:\Windows\System\ADIgZzj.exe
  2⤵
  PID:9752
- C:\Windows\System\UHFjaOe.exe
  C:\Windows\System\UHFjaOe.exe
  2⤵
  PID:9768
- C:\Windows\System\EWidfyx.exe
  C:\Windows\System\EWidfyx.exe
  2⤵
  PID:9784
- C:\Windows\System\AwUwiVO.exe
  C:\Windows\System\AwUwiVO.exe
  2⤵
  PID:9800
- C:\Windows\System\wEuUjlA.exe
  C:\Windows\System\wEuUjlA.exe
  2⤵
  PID:9816
- C:\Windows\System\xNZVkUz.exe
  C:\Windows\System\xNZVkUz.exe
  2⤵
  PID:9868
- C:\Windows\System\kFmnkJv.exe
  C:\Windows\System\kFmnkJv.exe
  2⤵
  PID:9884
- C:\Windows\System\hGkZpPo.exe
  C:\Windows\System\hGkZpPo.exe
  2⤵
  PID:9904
- C:\Windows\System\gNvBsJO.exe
  C:\Windows\System\gNvBsJO.exe
  2⤵
  PID:9924
- C:\Windows\System\pkAGIsp.exe
  C:\Windows\System\pkAGIsp.exe
  2⤵
  PID:9940
- C:\Windows\System\nxHaRiM.exe
  C:\Windows\System\nxHaRiM.exe
  2⤵
  PID:9956
- C:\Windows\System\YhFBqaH.exe
  C:\Windows\System\YhFBqaH.exe
  2⤵
  PID:9972
- C:\Windows\System\VdkhZKa.exe
  C:\Windows\System\VdkhZKa.exe
  2⤵
  PID:9988
- C:\Windows\System\iWcSUXZ.exe
  C:\Windows\System\iWcSUXZ.exe
  2⤵
  PID:10004
- C:\Windows\System\PxGzyLm.exe
  C:\Windows\System\PxGzyLm.exe
  2⤵
  PID:10020
- C:\Windows\System\BudsCAa.exe
  C:\Windows\System\BudsCAa.exe
  2⤵
  PID:10040
- C:\Windows\System\VRNTXKg.exe
  C:\Windows\System\VRNTXKg.exe
  2⤵
  PID:10056
- C:\Windows\System\IsfzMZj.exe
  C:\Windows\System\IsfzMZj.exe
  2⤵
  PID:10072
- C:\Windows\System\AHoEmoN.exe
  C:\Windows\System\AHoEmoN.exe
  2⤵
  PID:10088
- C:\Windows\System\zzwvlBh.exe
  C:\Windows\System\zzwvlBh.exe
  2⤵
  PID:10104
- C:\Windows\System\wpZhben.exe
  C:\Windows\System\wpZhben.exe
  2⤵
  PID:10120
- C:\Windows\System\YANeJLr.exe
  C:\Windows\System\YANeJLr.exe
  2⤵
  PID:10136
- C:\Windows\System\RGZHWkP.exe
  C:\Windows\System\RGZHWkP.exe
  2⤵
  PID:10152
- C:\Windows\System\hwoOYCo.exe
  C:\Windows\System\hwoOYCo.exe
  2⤵
  PID:10168
- C:\Windows\System\OhJhTag.exe
  C:\Windows\System\OhJhTag.exe
  2⤵
  PID:10188
- C:\Windows\System\aWaNWeF.exe
  C:\Windows\System\aWaNWeF.exe
  2⤵
  PID:10204
- C:\Windows\System\OHTQBBc.exe
  C:\Windows\System\OHTQBBc.exe
  2⤵
  PID:10220
- C:\Windows\System\VfQOgnE.exe
  C:\Windows\System\VfQOgnE.exe
  2⤵
  PID:10236
- C:\Windows\System\eHKodCI.exe
  C:\Windows\System\eHKodCI.exe
  2⤵
  PID:7972
- C:\Windows\System\NuTwfBg.exe
  C:\Windows\System\NuTwfBg.exe
  2⤵
  PID:8780
- C:\Windows\System\pxscCuk.exe
  C:\Windows\System\pxscCuk.exe
  2⤵
  PID:8716
- C:\Windows\System\AuAPPJv.exe
  C:\Windows\System\AuAPPJv.exe
  2⤵
  PID:9240
- C:\Windows\System\HEstbjW.exe
  C:\Windows\System\HEstbjW.exe
  2⤵
  PID:9328
- C:\Windows\System\WFEFqrD.exe
  C:\Windows\System\WFEFqrD.exe
  2⤵
  PID:9388
- C:\Windows\System\hEPAUTI.exe
  C:\Windows\System\hEPAUTI.exe
  2⤵
  PID:7292
- C:\Windows\System\aDWHEEK.exe
  C:\Windows\System\aDWHEEK.exe
  2⤵
  PID:9312
- C:\Windows\System\tNNyXmu.exe
  C:\Windows\System\tNNyXmu.exe
  2⤵
  PID:9372
- C:\Windows\System\cFfjOqG.exe
  C:\Windows\System\cFfjOqG.exe
  2⤵
  PID:9224
- C:\Windows\System\AVGMWHc.exe
  C:\Windows\System\AVGMWHc.exe
  2⤵
  PID:9532
- C:\Windows\System\UZpZYbe.exe
  C:\Windows\System\UZpZYbe.exe
  2⤵
  PID:9436
- C:\Windows\System\GkxgZic.exe
  C:\Windows\System\GkxgZic.exe
  2⤵
  PID:9500
- C:\Windows\System\EFqhGPh.exe
  C:\Windows\System\EFqhGPh.exe
  2⤵
  PID:9516
- C:\Windows\System\XpLbLVt.exe
  C:\Windows\System\XpLbLVt.exe
  2⤵
  PID:9616
- C:\Windows\System\gQfVXZf.exe
  C:\Windows\System\gQfVXZf.exe
  2⤵
  PID:9452
- C:\Windows\System\URbwxUn.exe
  C:\Windows\System\URbwxUn.exe
  2⤵
  PID:9652
- C:\Windows\System\ucIxoMd.exe
  C:\Windows\System\ucIxoMd.exe
  2⤵
  PID:9712
- C:\Windows\System\YEsAWvT.exe
  C:\Windows\System\YEsAWvT.exe
  2⤵
  PID:9632
- C:\Windows\System\lUumbcs.exe
  C:\Windows\System\lUumbcs.exe
  2⤵
  PID:10052
- C:\Windows\System\GEivsoq.exe
  C:\Windows\System\GEivsoq.exe
  2⤵
  PID:10148
- C:\Windows\System\aueKppu.exe
  C:\Windows\System\aueKppu.exe
  2⤵
  PID:10132
- C:\Windows\System\kemHrZz.exe
  C:\Windows\System\kemHrZz.exe
  2⤵
  PID:10100
- C:\Windows\System\rmXiEDc.exe
  C:\Windows\System\rmXiEDc.exe
  2⤵
  PID:10228
- C:\Windows\System\JzlabAF.exe
  C:\Windows\System\JzlabAF.exe
  2⤵
  PID:8788
- C:\Windows\System\XzgxOfM.exe
  C:\Windows\System\XzgxOfM.exe
  2⤵
  PID:9292
- C:\Windows\System\uHCOlua.exe
  C:\Windows\System\uHCOlua.exe
  2⤵
  PID:8248
- C:\Windows\System\DpNGNvJ.exe
  C:\Windows\System\DpNGNvJ.exe
  2⤵
  PID:8216
- C:\Windows\System\ndxZTrD.exe
  C:\Windows\System\ndxZTrD.exe
  2⤵
  PID:9396
- C:\Windows\System\NpPyAyu.exe
  C:\Windows\System\NpPyAyu.exe
  2⤵
  PID:9648
- C:\Windows\System\NVEbEWc.exe
  C:\Windows\System\NVEbEWc.exe
  2⤵
  PID:9780
- C:\Windows\System\VmWgxRS.exe
  C:\Windows\System\VmWgxRS.exe
  2⤵
  PID:10112
- C:\Windows\System\rcxHHBr.exe
  C:\Windows\System\rcxHHBr.exe
  2⤵
  PID:9760
- C:\Windows\System\CRerVIp.exe
  C:\Windows\System\CRerVIp.exe
  2⤵
  PID:10164
- C:\Windows\System\ElFiVGx.exe
  C:\Windows\System\ElFiVGx.exe
  2⤵
  PID:6052
- C:\Windows\System\CAGlrpn.exe
  C:\Windows\System\CAGlrpn.exe
  2⤵
  PID:8104
- C:\Windows\System\OakxPTZ.exe
  C:\Windows\System\OakxPTZ.exe
  2⤵
  PID:10252
- C:\Windows\System\qzOVmpu.exe
  C:\Windows\System\qzOVmpu.exe
  2⤵
  PID:10268
- C:\Windows\System\vEKPkKZ.exe
  C:\Windows\System\vEKPkKZ.exe
  2⤵
  PID:10284
- C:\Windows\System\fCEkudN.exe
  C:\Windows\System\fCEkudN.exe
  2⤵
  PID:10300
- C:\Windows\System\XBlkUFh.exe
  C:\Windows\System\XBlkUFh.exe
  2⤵
  PID:10316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\HFZzCDF.exe

Filesize
2.2MB

MD5
e8d5011698c52681b6ca41a58858bf79

SHA1
ee670ab1a01072c5c60b7963e542b7d29e8fe671

SHA256
21d3c6a333dcd119a423354f94573bb88d6e5102c4447d55c0294eac85ffda22

SHA512
6237953810af114a5d820c3832653f1790d0bfffd0e08cfd760a716a6119de29f13584214e7d1b2ec72463bfcd1102664551ce3c4951e04b8ba7b4245083710b

Download Submit
C:\Windows\system\IXbtWnP.exe

Filesize
2.2MB

MD5
cb807610ba4cf7238e80e44d42c99274

SHA1
55f3194afcacf661e52cfbf82b45a17df26017ed

SHA256
69516e5b416cb59f28637809bbd40da32e1c9d8f0e1cef866305a9d4518e6ebb

SHA512
9db6a079892bc80efd0a0ad5fde1cb7e94fe6d4931f67dae7cd1c537c22f253fca3d6ba76e8858ebb835200f31a93e0850708e81f380f9d5c612028ecf88a559

Download Submit
C:\Windows\system\KYHfmuH.exe

Filesize
2.2MB

MD5
19ad8e293ac098853c3efe27d03fc79f

SHA1
fc15d1fa8f777040bd4855389eeab5935f99401a

SHA256
abb11ac19cd63fedbb2b11b9b96fa622ba9778143bad21798d0ed13a7377e0e3

SHA512
44d422d56c016209aff3fdd8f7f483cfa16e6cd7184a57ff0a5a9110acd8557d313230726e3b78aff0fb05face4a5aeb938b7d896b1e3dfb25946157598275c1

Download Submit
C:\Windows\system\OaclyEu.exe

Filesize
2.2MB

MD5
a589d41354c06852e2a3787a602fd78b

SHA1
cfaab542359945696c52ca9bcf8b50883d4100d3

SHA256
108cf3b2c11fe5d8b3c0fd5c89718f2b7f0a4467c2a019bae11047348d4c0082

SHA512
7267469deeddc0da18ac4c7e02d53f8c5654ae7de5c21dea8043c9f0ce29f9c99e73f3305b4c14ea265e7c42d6c9f32d8d1e5cba7c5f1f431ac9c19c487800ed

Download Submit
C:\Windows\system\WnmbADY.exe

Filesize
2.2MB

MD5
c02c25139b47e7a402b7270be5bd022e

SHA1
3c449f6d1e686bf3c09cae989a47da2477c4778e

SHA256
983113ed78698d08ec10f7ca4388339946d15c66958e03f0ac89941a579c5ab4

SHA512
3858d423ffdeeab8c164f30ef06b1ae65951921f454d4b6eb31ef228b84e8a468f2fbc2199fffe2c45a6d5fb67805e4980a7e0ede29c7e49325b386aade56a6e

Download Submit
C:\Windows\system\XBCkvEF.exe

Filesize
2.2MB

MD5
5c41747af0b5ad940365e604688e19b4

SHA1
1195cd0d52fa2bff9333079185c707b323eac18e

SHA256
62232447b7e243d096e91f7b1486ddc3a376301ea2b2fea0f3cc6ea3fc8b81f8

SHA512
c9adf3476aeb86cb9965643d778fdbd33ae651d60d265001ab28e8f4343d18f6d463ace5b05846b3248139efc40815fd0045ff685dca6edf11faf3bac75ae0b3

Download Submit
C:\Windows\system\XdRXQSP.exe

Filesize
2.2MB

MD5
c9f95e8de2aa8149db35c3876399f946

SHA1
e1f02c8b9e501accfe5a5e071368ef46d386ae5f

SHA256
1bdb099f3ccfd8f7bb5f9562b3656105ba23e7e6d62fd738e40bde8c5abdb417

SHA512
260a7973c206ac740dcd3977d01449632b85bf66318c33a8f94e656752c01bfe48de6c577202a77e17dd6a81d8f8e6f0deb6be70bd455f59de0c5298dec20e56

Download Submit
C:\Windows\system\ZNRlcpn.exe

Filesize
2.2MB

MD5
242ecaccc3fed78cd6a04edc705acf91

SHA1
bcab0837d4954e216a8ba20b632f4a41a7800b1b

SHA256
4eb25faf1fe3ae13649e158261f15b8e78c1b47e6fc60e5c87b52d1ff368b68f

SHA512
916f10f6628ae2abc519250e417848911b6f79e85a83e594f811fb226321db8386b00b732676ba4b856de5b9626d2967da00cd72ffabbbdd4dc48b04a5c28d0e

Download Submit
C:\Windows\system\ZfBstzX.exe

Filesize
2.2MB

MD5
cf3450c3bc827ae7df6283f6322953d8

SHA1
7aca6643cc73f0f574ae8385b830899394f08234

SHA256
04da238573ef7eedd6675e20310d31847e2561c029d61213a2b23fdb6ec73e36

SHA512
bfdbeb0c828dc768652a509f9654235c7fb34c224d534c502e7d5fa1a8d69a9043aea287505c65c8a790c57988b5c14da9534d6f614088fd8ebf297464e5f412

Download Submit
C:\Windows\system\baveaJQ.exe

Filesize
2.2MB

MD5
3e6c7e5a194b2006f19af0fc70b5a4fe

SHA1
37b0e4b7450e3050cab8ffc549ee5b126ac2da06

SHA256
223bcaf42f0ee8b2cd5ec1d754c4ef5220b31b2589cb6a56b37b36890a2db622

SHA512
0d92a1d56eb63195e92c6d8d4e794ee32843fff11143b87ae5c45dfea5d3d7eca6931b1cb2cb4ad76462efc7f82c69175780031e30b4317b5bd69be2a029775c

Download Submit
C:\Windows\system\cuRMRvP.exe

Filesize
2.2MB

MD5
b154ddf69c00d94d3e96d4445e0a3bdf

SHA1
f694796d27551413a9889d41378442b3e21d8fde

SHA256
ed2d9f89b897ec7b0ae5352732e690fe3bfffb32f36c47cdb565ca96ed3c22f5

SHA512
821445e8bfbc8b854a1f7e220004e5b66ff4dc6d7c55dc548f4962efa1c5f8394e068bd9b160291a3deedc22c774fc004896ecb616a0e4c8b597b39c8c902e0c

Download Submit
C:\Windows\system\fDNTDUT.exe

Filesize
2.2MB

MD5
2ec27f2aaf163516a16f778fca496ffe

SHA1
d6da46f660e3af2a11b72a5588ec8f5003edbde9

SHA256
612a883ba54e3563319fcb7f757b6241df13ebb985b10ceb6aca595f319c455c

SHA512
8d20149c9f664e9b0087f22ccfdbaa16ae83b7f9e25da76f5b787cfe8ba83f44df5a03ccd96f05f6851c6cc4b87b44cf450f25a9ac27a515808c1a28d84ed27c

Download Submit
C:\Windows\system\gRhKswI.exe

Filesize
2.2MB

MD5
38245598b5cea8dc81a58339199102a2

SHA1
e96d1643efab7510e8c1a9e7640e73599040c1be

SHA256
8cd2b581df4130dd374579116f90e0443aab30f310bf626d85bae210f282e500

SHA512
b8cddc2fa769155ceb1f773a91651e50a94e3d3351eaf2fa93909ec32074cf421e00ea27033acdecd6ff12408539ecf4de5193f130c6e2519d3bb26f24b49862

Download Submit
C:\Windows\system\jOCLLRw.exe

Filesize
2.2MB

MD5
81396a3989e4edad659c14ec99967162

SHA1
ffad5cc28e6bf44aa650b3bb1fb97ae9d764af6b

SHA256
9402a97c493ecbae9a236f83362d4ace4c205fd98f0f93ab96276836cb4912d5

SHA512
4745899b71bc878f30e0305d2061111826cf637d4f5dc6c58877ea039cb1a4f99d4c5e543647358ff9f4cfaec834a7d91a1c5e6133bddbf613c54c054611cf0f

Download Submit
C:\Windows\system\jbFnLfR.exe

Filesize
2.2MB

MD5
bd0ce0eb2eac2753a2f8d1b5c62e0360

SHA1
50bcbeff589ec4cc72204a2fd603fd3ffc7adcdd

SHA256
ab1b8986d58b31a48a4bc0d7e3110d4049772930e480451b77ee70bbddb44292

SHA512
0af0ed8d84f660b1deab31ab0babf21d514693dab3ad7e2330f2ee8bf79ce66eb1d8ab872d5933f58f4cc7ac7b110e9d1b554740d2317146df2689de2a8901c2

Download Submit
C:\Windows\system\nJWYtqi.exe

Filesize
2.2MB

MD5
9c683d9cc0fe271e9a6f3052d75bcd26

SHA1
6d132163e8eb3b61a0384e095199da6af593d3e1

SHA256
72330b55931550f0229bbef7828ed9096cbf3e21dc45167561a5b8875ff322b8

SHA512
e3dd85b971cfa14fd7edbcb8b53bbfde69b796ca2b6b65abf221d317be48e87121f1333f7171e1017b79121d33553a4d7bd9267a282cdf7680a62aa62cf708c5

Download Submit
C:\Windows\system\tuDwnXU.exe

Filesize
2.2MB

MD5
d8708979a1115c3c5897c88cccecc674

SHA1
c1f84b0225752fa17c55fc26edca733faabb6f26

SHA256
566fef2921a6df8231e1135520ce598e0b1abe92dce6464a36872e953a37dc34

SHA512
a926902c5f7edc964a04840e8ca39696621f52dc7f24f2ba104ac70a48c5cd6a162862e745a9f3c8f7f820b6a03c894524f2a9d3d8946df7e9086c44cfddb457

Download Submit
C:\Windows\system\vqCNwyn.exe

Filesize
2.2MB

MD5
a3be0e672bf8327f8235ebcdbcd933d5

SHA1
ff85594ddd9313f23f608e202c05ca212171fa8e

SHA256
513eb6ccaf98870f962ad9f0c648c02f9da72ad612abbac8763938821c63fe10

SHA512
554c0942809fe473000e0ba9c959e10f49191f863666b373577ab2ae8a12cf4f649364fdd2a575bc5e882f12f974a3d4f3be97f3e7d1a8d30b4d278005adb24d

Download Submit
C:\Windows\system\wmtpwbe.exe

Filesize
2.2MB

MD5
93175961d8ef5db78404f63bf4382263

SHA1
09327f7bfc724306afe03cab4a3af08c755561ec

SHA256
36566d90be8d2ab9565076ebc69b9c0a09f37df0dd3dc173f17f53b664cdb8ac

SHA512
c684a319903c9498ed51142aa4dff3285d3012cf6251070fa4138bad60a92227a0d4b5d71722d14d0b51ddde98d415e516cb5aed7dba8290d2bf94f316155410

Download Submit
C:\Windows\system\xmdRLXe.exe

Filesize
2.2MB

MD5
377015cb1a237ec956730f7e9c047442

SHA1
b6405c9c70694c04edc9d40c556f7f5d89e07e10

SHA256
4bb6f5445a6b35973b2c1ad5e69881872b0d00cdbb18fea050fdca1e036abcb2

SHA512
b3f4430e52a93aedd65662c70e27c0bcdaa2aa5942fdcc8781d0b4a3f8d5e2266e8e3522ddf9a9925d1dc48726d073914774fbaca7d1352aee5bd53fd65a3900

Download Submit
C:\Windows\system\zPFIsEf.exe

Filesize
2.2MB

MD5
25e1b3f45f9cbb7b1307678198319878

SHA1
09429f0d5fbd7b764c72528470ca206a9ec43966

SHA256
4301892a966953725986275cc77b89c9f6b5b279d10cf34fab4e30208013a0ec

SHA512
5a6382ec21f6a35c8635e7b9604915b59ca48b69cd859e3d6b3f59483e600190f28ddf006f4cba23d7b39f8d981ba641a444bc1cd595ffa186d242744378e21a

Download Submit
\Windows\system\ECWwWCN.exe

Filesize
2.2MB

MD5
1d3bb13f96525696ed874f9f1f76b383

SHA1
00101719480652de17ee7dba97be4e9be3ec3916

SHA256
495497c7b245e13ba17731cae8389c572eac616461ca00c13e37b639ff202244

SHA512
ddd9386be16b8a321fa6929b2fd26b7bc70af0338cc56b50dc769e30dcedd19f94ac92408895406d5eee66feb157eff097518bd0b7b3ba31859c13e248dff35a

Download Submit
\Windows\system\EPLeOpd.exe

Filesize
2.2MB

MD5
6c81e8d2ae72dc55d6a683eb5deae30e

SHA1
a78898ea615883e78358585f12a31fcfebb5e7bb

SHA256
82870922ced5b0b74d825dace3324e128a74d922acaf20ad89cdd265b44e85e1

SHA512
eb05c3ee371aa07e601d209345b19d27da472c3b7b41e1b749eedb6eb42f4a261ac46117e14116d0f390f9439f710dc2d53c5e1e9649debf1b4376b38f26da74

Download Submit
\Windows\system\ItsZwPb.exe

Filesize
2.2MB

MD5
485962d2873d8e74b20432ca0e04a1f9

SHA1
616dbcc0522894e9e6b38dc61912d3b8f1960ad4

SHA256
30997a7fde67ad40521653470a388086bd9342240282ab18614aeea1c7c73f56

SHA512
410e9709fac512df5add790551336b68171a5d6eae83835b825420d4af9c09d66732abecfe814593aa0c2d0c1bac53c3efabaa94c345c531b0e53d435efe9157

Download Submit
\Windows\system\LkATZVc.exe

Filesize
2.2MB

MD5
14eb6de9a0d1809b3562eeff2ef472ef

SHA1
7be2201ec4a8a9301cea8f1b0620c5b1756f2644

SHA256
0508c0805f2d3e65de6c6f3f02c35771bda7d0c163489f89f98b5b98de6bda0c

SHA512
d32783c48d172d4e2f9c68f20a7170ba0287dea837b202e4b410e7e139b07fb356ef20dd41726a94717ae307d1c1b5c464d6251f774101867ac9108cc8eb63f0

Download Submit
\Windows\system\QpTiBrs.exe

Filesize
2.2MB

MD5
612218241fd33b7b6b19ddc9ffdff6e1

SHA1
61eeee93d06a1d3ce8f94d7534b2acb300b9cc59

SHA256
e89e14223d24d87af32c268ee2c450377a4b013a41daaec71e1415989c4c89dd

SHA512
8331bcee4b12f862270cbb85cdf1b8ab5b4f3164afc0bcea1025ae9277b1e390a5088341b0bf4d664e893d411ffc070c06c584accb33ae5763183a189c788385

Download Submit
\Windows\system\RopDEKW.exe

Filesize
2.2MB

MD5
ca12bb6739098133ea0e33e76c899e82

SHA1
cb95c3b63c7261f0c02b125f023877d245ec1875

SHA256
57a44846a315c1f83d04be727e4a1c2c350ab3bbd64fbff144154222a4663b00

SHA512
80d619db897c91d63b670bfc44dc495e22d90fd5934a1435a4bd10966b679ff91df3ea260c25696e26c99e1d5710a9bad385df7b7443ec22bb96645112905128

Download Submit
\Windows\system\ZsPymRm.exe

Filesize
2.2MB

MD5
07d4670a47fab648b6f0339519a9e8c6

SHA1
43ec3377d462a548a86e62270f7e57135935db60

SHA256
19d9b232a6f7f37a35ffe70e809e593f515ca42156445d8c97766c59788e1304

SHA512
bdabf77d8b72ecaca0617de172c8b0a7b8531dc9c918eabece606378b6a739dc75b4d944064797ee35a95e7b252a55f35f2302a1f4e1080582902fb30414002f

Download Submit
\Windows\system\gWrtinx.exe

Filesize
2.2MB

MD5
3eef32a5fe61eb3764992c157158e478

SHA1
639e6175cd7e295e7c8b7fcc3078b37ff134bb1b

SHA256
635fd82786eeb242fb53766c88c92ff35bd413dd83f530159b1c73f9d191a0ff

SHA512
d85c6543e7ff6658589456ec0d0bfebc3c7378392721d9f89debcd01bfd6ec1c58e6475198140d4ee90568c7903be922c0e91fbb7328148e514e9905243f06c6

Download Submit
\Windows\system\idMlMeq.exe

Filesize
2.2MB

MD5
81f3c32b0190f4a7f0cbf9acfd28d301

SHA1
3e90f0b7933488dd65cc4a9352339fd4118caabc

SHA256
bf535e5e67592693d274db27ae0f163822da15df9f59363a1f6f6f6a0c199654

SHA512
4b3a8aad475fb65479ee87c3800129b6ea4b04b2b846eb1194fc24d50663057bcd75f72b4bd155eef42ed590c6a3342b9149ebacc95c4cb1ce3f5309a0309cad

Download Submit
\Windows\system\lNoREMQ.exe

Filesize
2.2MB

MD5
0458a0f113a76127607151672ad250d7

SHA1
3102d3a95f4fde8664d808e67aad1c5efeba8ca1

SHA256
a6121589a8c05ae91c5aa5c23504b428336e123f11c9b73f7d3da2d47ef4109b

SHA512
9051b1df6142e7419347781404754e973dc80b8c4e756c87d585a4587d8b11f3d1469203440eb0209c1b23d7ed7d14a0e69331c59dfdc2afdfd9159aec7cab19

Download Submit
\Windows\system\lYLhOGY.exe

Filesize
2.2MB

MD5
0252e3fababc94a7320a08c7bd8850de

SHA1
b40d53fee5b7e07ac15c6d9d1f500b44a043d8e1

SHA256
5502144ce7799a51f0e1886a23aef50ba9fdd2b395117254ec6ef99b571d2f93

SHA512
bef686c423bb599c3c993194410b1292185ce328ea7c5746a806b635f73a34d25d08824bc04f762bff20e2343ed2dfb2f4abd63a16c32b6bb4865532b8f54d97

Download Submit
\Windows\system\tMoNkft.exe

Filesize
2.2MB

MD5
79ae34cc50ad9c2a5eeb5d6eba4d4239

SHA1
6946e6687660941f8dadcef369b02eae56e54b30

SHA256
9a0efe0640edb0ca183dc8276da964bd0af088c3dc10503b5a5f224cdae6b607

SHA512
87e1d3e92487be0b38a9e389419a6ff0f094368d6913bc9bddd7284fffd93245b1f074bb1bb24fff922801dacf1daf0d5a4e71d66e10f4c97914f4600cd0de8f

Download Submit
\Windows\system\uytzvOj.exe

Filesize
2.2MB

MD5
f1412dcbea8687c59b0235e2736c0428

SHA1
cda5db7c9eea62999e9375e3a0650d422d067ee5

SHA256
e06545572e921b6acb27fb5b7ee94d1478530be7a8d64399d1be91d8544923d8

SHA512
7eb8ea1dd25c67f0679351b0f01b2cd6401d0f9e1b426b5be8395184c9bfc9f2e239650f5e261018c37a0ea552011fda7e8593b653467d82285a53dbc803a9b1

Download Submit
memory/588-79-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/588-2667-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/764-106-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/764-2665-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/1440-84-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/1440-2738-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/1808-56-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-41-0x0000000002D60000-0x0000000003152000-memory.dmp

Filesize
3.9MB

Download
memory/1808-7-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-80-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-78-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/1808-75-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/1808-102-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/1808-31-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1808-0-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/1808-95-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/1808-77-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/1808-51-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/1808-44-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/1808-32-0x0000000002D60000-0x0000000003152000-memory.dmp

Filesize
3.9MB

Download
memory/2404-53-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2404-2663-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2528-47-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2528-2779-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2564-23-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2564-76-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2564-2664-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-104-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-2815-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-33-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-2666-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-9-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-22-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-72-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-3423-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2960-2814-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2960-105-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-57-0x000000001B200000-0x000000001B4E2000-memory.dmp

Filesize
2.9MB

Download
memory/2996-58-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/3060-1863-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/3060-42-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download