xmrig | eb1beb517239b442d13a3d24389762b7253029523a17698109c9829e5a04d9fc

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 14:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
Size

2.1MB
MD5

0eb7a53ed565c38b75f97c14019d2b74
SHA1

a283ca3e19b13ee694c8dec1535e5f65caa46922
SHA256

eb1beb517239b442d13a3d24389762b7253029523a17698109c9829e5a04d9fc
SHA512

1cb7b8574070b9a0a8a7d0b941eef6cd3d424bcf475e8c3b0ad563ee2dafdc3fe7c4f19ba027c0a80429ee5e4570b0e49827bdc5651c76ee82910962b196ccd0
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr9:NAB4

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/1828-132-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2636-129-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/3024-127-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig
behavioral1/memory/2508-124-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2736-122-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig
behavioral1/memory/2632-120-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/760-118-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2500-116-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2660-112-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2724-111-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/2784-13-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2208	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2784	NdyQJae.exe
2724	czBaqrz.exe
2660	WvvIbBl.exe
2756	iAEcEvi.exe
2500	HallCFD.exe
760	zhDWNyP.exe
2632	MbNHzav.exe
2736	telFPCN.exe
2508	HoTGzeo.exe
3024	CsLeJVs.exe
2636	BCLAmLL.exe
1828	PpqUAPH.exe
2864	eUDtpSd.exe
2828	sJDMVfI.exe
2820	VXekibv.exe
3044	ENsezFl.exe
3012	ShQXrPb.exe
1716	yqhxkHW.exe
2760	hKlfHIH.exe
700	FvQlSSl.exe
1664	TcdaBJP.exe
1516	kPcJoMk.exe
1008	ZgfKASr.exe
3064	zvMXNdQ.exe
1980	ZikzVSz.exe
1820	PwzaOrs.exe
336	TtAHHTA.exe
1252	yBOMNXO.exe
1488	CXJJQBD.exe
1804	IJiCtuH.exe
588	BgNscVH.exe
1780	iASPzFa.exe
1196	BHqgoBr.exe
1068	WgedVqF.exe
2260	qNZQODP.exe
2032	XPjFzEU.exe
1776	nYlslkh.exe
1380	kyHQZyw.exe
1872	LpLSJcN.exe
2920	LCGuiWR.exe
1852	UCtzwai.exe
916	KUPEDMX.exe
632	hVmefRc.exe
1404	rnuWPze.exe
1972	LEcdEOA.exe
784	HJjvNkH.exe
2148	EkklYAo.exe
2968	lLGYqER.exe
2276	ViujSpk.exe
892	wATECxJ.exe
2056	pdPygce.exe
2124	oamQCIz.exe
2976	VBOVHBF.exe
1596	BKlzopO.exe
544	IaVzSBL.exe
2212	TDuNElc.exe
1032	gIHIOnn.exe
2472	USWGKvE.exe
1284	LlqSPbn.exe
2496	bYRaYiQ.exe
3028	stuwjHG.exe
2272	wJhKFew.exe
2060	gURQaeI.exe
1144	CSQHRHs.exe

Loads dropped DLL 64 IoCs

pid	Process
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2404-0-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/files/0x000a00000001431c-3.dat	upx
behavioral1/files/0x0036000000014502-17.dat	upx
behavioral1/files/0x001800000000558a-23.dat	upx
behavioral1/files/0x00070000000149e1-33.dat	upx
behavioral1/files/0x0008000000014b36-42.dat	upx
behavioral1/files/0x0009000000014b10-37.dat	upx
behavioral1/files/0x0006000000015c93-57.dat	upx
behavioral1/files/0x0006000000015c85-63.dat	upx
behavioral1/files/0x0006000000015cb0-72.dat	upx
behavioral1/files/0x0006000000015c9c-64.dat	upx
behavioral1/files/0x0006000000015d0c-99.dat	upx
behavioral1/files/0x0006000000015cf5-98.dat	upx
behavioral1/files/0x0006000000015cd9-96.dat	upx
behavioral1/files/0x0006000000015cbd-78.dat	upx
behavioral1/files/0x0006000000015ce3-89.dat	upx
behavioral1/files/0x0006000000015f3c-163.dat	upx
behavioral1/files/0x00060000000160cc-173.dat	upx
behavioral1/files/0x000600000001654a-193.dat	upx
behavioral1/files/0x00060000000162c9-191.dat	upx
behavioral1/files/0x0006000000016476-187.dat	upx
behavioral1/files/0x00060000000161b3-177.dat	upx
behavioral1/files/0x0006000000015fa7-168.dat	upx
behavioral1/files/0x0006000000015e09-153.dat	upx
behavioral1/files/0x0006000000015e6d-158.dat	upx
behavioral1/files/0x0006000000015d4c-148.dat	upx
behavioral1/files/0x0035000000014588-142.dat	upx
behavioral1/memory/1828-132-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2636-129-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/3024-127-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/memory/2508-124-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2736-122-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/memory/2632-120-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/760-118-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/files/0x0006000000015d44-139.dat	upx
behavioral1/memory/2500-116-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2756-114-0x000000013F590000-0x000000013F982000-memory.dmp	upx
behavioral1/memory/2660-112-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/memory/2724-111-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/files/0x0006000000015d24-107.dat	upx
behavioral1/files/0x0006000000015cce-82.dat	upx
behavioral1/files/0x0007000000015c5a-47.dat	upx
behavioral1/files/0x0006000000015c6f-51.dat	upx
behavioral1/files/0x000800000001480e-28.dat	upx
behavioral1/memory/2784-13-0x000000013FF60000-0x0000000140352000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UwhgrxA.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\PpqUAPH.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\nvRHEMj.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\cqIgZZE.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\fxTqCaU.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\DUqqywh.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\AaHlDOn.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\BolKcpz.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\uDbVGOR.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\wJhKFew.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\oyNKmbK.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\cEzXfbz.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\KjvaMpv.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\TWaxrCf.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\ggQGZOS.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\cHgtydB.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\vpwQAkd.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\aYdJVlB.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\oRrldwr.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\qcnXuEr.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\CSiEoMU.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\wdtmtBN.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\LJUYduQ.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\RNCHVRE.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\IqMosHw.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\HVHfMzq.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\VrNNbXJ.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\DROgBUv.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\WrlolTY.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\odkxNSt.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\gcCrAWS.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\mrzQpCv.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\VmdjxaX.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\NvdUtlu.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\zzLHQIS.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\JvpejKp.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\KjIDFbn.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\zEbPwjV.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\uhlClRi.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\czBaqrz.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\vUZMnpg.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\qwdrmsi.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\ArPNmZL.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\XPjFzEU.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\QaMInah.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\SaUXyVa.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\hlVzmtw.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\ujpdZOB.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\XLKDsFw.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\zsAUcSM.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\LfZMPTb.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\KwTiWEw.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\NmlHOiZ.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\jQaKUiZ.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\CCzyCmB.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\ToNsgSO.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\IiETXGv.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\yGoouuW.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\KSLFqJs.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\DfGHOqG.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\rkMsVIm.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\WbmwpFJ.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\vFXHmfp.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
File created	C:\Windows\System\jPnjyww.exe	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2208	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
Token: SeDebugPrivilege	2208	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2208	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	29
PID 2404 wrote to memory of 2208	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	29
PID 2404 wrote to memory of 2208	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	29
PID 2404 wrote to memory of 2784	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2784	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2784	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2724	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	31
PID 2404 wrote to memory of 2724	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	31
PID 2404 wrote to memory of 2724	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	31
PID 2404 wrote to memory of 2660	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	32
PID 2404 wrote to memory of 2660	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	32
PID 2404 wrote to memory of 2660	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	32
PID 2404 wrote to memory of 2756	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	33
PID 2404 wrote to memory of 2756	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	33
PID 2404 wrote to memory of 2756	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	33
PID 2404 wrote to memory of 2500	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	34
PID 2404 wrote to memory of 2500	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	34
PID 2404 wrote to memory of 2500	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	34
PID 2404 wrote to memory of 760	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	35
PID 2404 wrote to memory of 760	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	35
PID 2404 wrote to memory of 760	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	35
PID 2404 wrote to memory of 2632	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	36
PID 2404 wrote to memory of 2632	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	36
PID 2404 wrote to memory of 2632	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	36
PID 2404 wrote to memory of 2736	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	37
PID 2404 wrote to memory of 2736	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	37
PID 2404 wrote to memory of 2736	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	37
PID 2404 wrote to memory of 2508	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	38
PID 2404 wrote to memory of 2508	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	38
PID 2404 wrote to memory of 2508	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	38
PID 2404 wrote to memory of 2636	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	39
PID 2404 wrote to memory of 2636	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	39
PID 2404 wrote to memory of 2636	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	39
PID 2404 wrote to memory of 3024	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	40
PID 2404 wrote to memory of 3024	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	40
PID 2404 wrote to memory of 3024	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	40
PID 2404 wrote to memory of 1828	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	41
PID 2404 wrote to memory of 1828	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	41
PID 2404 wrote to memory of 1828	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	41
PID 2404 wrote to memory of 2864	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	42
PID 2404 wrote to memory of 2864	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	42
PID 2404 wrote to memory of 2864	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	42
PID 2404 wrote to memory of 2828	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	43
PID 2404 wrote to memory of 2828	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	43
PID 2404 wrote to memory of 2828	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	43
PID 2404 wrote to memory of 2820	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	44
PID 2404 wrote to memory of 2820	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	44
PID 2404 wrote to memory of 2820	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	44
PID 2404 wrote to memory of 3012	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	45
PID 2404 wrote to memory of 3012	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	45
PID 2404 wrote to memory of 3012	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	45
PID 2404 wrote to memory of 3044	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	46
PID 2404 wrote to memory of 3044	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	46
PID 2404 wrote to memory of 3044	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	46
PID 2404 wrote to memory of 1716	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	47
PID 2404 wrote to memory of 1716	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	47
PID 2404 wrote to memory of 1716	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	47
PID 2404 wrote to memory of 2760	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	48
PID 2404 wrote to memory of 2760	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	48
PID 2404 wrote to memory of 2760	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	48
PID 2404 wrote to memory of 700	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	49
PID 2404 wrote to memory of 700	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	49
PID 2404 wrote to memory of 700	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	49
PID 2404 wrote to memory of 1664	2404	0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0eb7a53ed565c38b75f97c14019d2b74_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\System\NdyQJae.exe
  C:\Windows\System\NdyQJae.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\czBaqrz.exe
  C:\Windows\System\czBaqrz.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\WvvIbBl.exe
  C:\Windows\System\WvvIbBl.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\iAEcEvi.exe
  C:\Windows\System\iAEcEvi.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\HallCFD.exe
  C:\Windows\System\HallCFD.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\zhDWNyP.exe
  C:\Windows\System\zhDWNyP.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\MbNHzav.exe
  C:\Windows\System\MbNHzav.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\telFPCN.exe
  C:\Windows\System\telFPCN.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\HoTGzeo.exe
  C:\Windows\System\HoTGzeo.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\BCLAmLL.exe
  C:\Windows\System\BCLAmLL.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\CsLeJVs.exe
  C:\Windows\System\CsLeJVs.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\PpqUAPH.exe
  C:\Windows\System\PpqUAPH.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\eUDtpSd.exe
  C:\Windows\System\eUDtpSd.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\sJDMVfI.exe
  C:\Windows\System\sJDMVfI.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\VXekibv.exe
  C:\Windows\System\VXekibv.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\ShQXrPb.exe
  C:\Windows\System\ShQXrPb.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\ENsezFl.exe
  C:\Windows\System\ENsezFl.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\yqhxkHW.exe
  C:\Windows\System\yqhxkHW.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\hKlfHIH.exe
  C:\Windows\System\hKlfHIH.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\FvQlSSl.exe
  C:\Windows\System\FvQlSSl.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\TcdaBJP.exe
  C:\Windows\System\TcdaBJP.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\kPcJoMk.exe
  C:\Windows\System\kPcJoMk.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\ZgfKASr.exe
  C:\Windows\System\ZgfKASr.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\zvMXNdQ.exe
  C:\Windows\System\zvMXNdQ.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\ZikzVSz.exe
  C:\Windows\System\ZikzVSz.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\PwzaOrs.exe
  C:\Windows\System\PwzaOrs.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\TtAHHTA.exe
  C:\Windows\System\TtAHHTA.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\yBOMNXO.exe
  C:\Windows\System\yBOMNXO.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\CXJJQBD.exe
  C:\Windows\System\CXJJQBD.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\BgNscVH.exe
  C:\Windows\System\BgNscVH.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\IJiCtuH.exe
  C:\Windows\System\IJiCtuH.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\iASPzFa.exe
  C:\Windows\System\iASPzFa.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\BHqgoBr.exe
  C:\Windows\System\BHqgoBr.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\qNZQODP.exe
  C:\Windows\System\qNZQODP.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\WgedVqF.exe
  C:\Windows\System\WgedVqF.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\XPjFzEU.exe
  C:\Windows\System\XPjFzEU.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\nYlslkh.exe
  C:\Windows\System\nYlslkh.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\kyHQZyw.exe
  C:\Windows\System\kyHQZyw.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\LpLSJcN.exe
  C:\Windows\System\LpLSJcN.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\LCGuiWR.exe
  C:\Windows\System\LCGuiWR.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\UCtzwai.exe
  C:\Windows\System\UCtzwai.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\KUPEDMX.exe
  C:\Windows\System\KUPEDMX.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\hVmefRc.exe
  C:\Windows\System\hVmefRc.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\rnuWPze.exe
  C:\Windows\System\rnuWPze.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\LEcdEOA.exe
  C:\Windows\System\LEcdEOA.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\HJjvNkH.exe
  C:\Windows\System\HJjvNkH.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\EkklYAo.exe
  C:\Windows\System\EkklYAo.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\lLGYqER.exe
  C:\Windows\System\lLGYqER.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\ViujSpk.exe
  C:\Windows\System\ViujSpk.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\wATECxJ.exe
  C:\Windows\System\wATECxJ.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\pdPygce.exe
  C:\Windows\System\pdPygce.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\oamQCIz.exe
  C:\Windows\System\oamQCIz.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\VBOVHBF.exe
  C:\Windows\System\VBOVHBF.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\TDuNElc.exe
  C:\Windows\System\TDuNElc.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\BKlzopO.exe
  C:\Windows\System\BKlzopO.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\gIHIOnn.exe
  C:\Windows\System\gIHIOnn.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\IaVzSBL.exe
  C:\Windows\System\IaVzSBL.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\USWGKvE.exe
  C:\Windows\System\USWGKvE.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\LlqSPbn.exe
  C:\Windows\System\LlqSPbn.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\wJhKFew.exe
  C:\Windows\System\wJhKFew.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\bYRaYiQ.exe
  C:\Windows\System\bYRaYiQ.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\gURQaeI.exe
  C:\Windows\System\gURQaeI.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\stuwjHG.exe
  C:\Windows\System\stuwjHG.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\CSQHRHs.exe
  C:\Windows\System\CSQHRHs.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\iMXIbaG.exe
  C:\Windows\System\iMXIbaG.exe
  2⤵
  PID:2536
- C:\Windows\System\ZdmETIS.exe
  C:\Windows\System\ZdmETIS.exe
  2⤵
  PID:900
- C:\Windows\System\SjbIVEb.exe
  C:\Windows\System\SjbIVEb.exe
  2⤵
  PID:1988
- C:\Windows\System\AZCRjSc.exe
  C:\Windows\System\AZCRjSc.exe
  2⤵
  PID:1440
- C:\Windows\System\rKbEDuk.exe
  C:\Windows\System\rKbEDuk.exe
  2⤵
  PID:2940
- C:\Windows\System\VRkemMg.exe
  C:\Windows\System\VRkemMg.exe
  2⤵
  PID:2564
- C:\Windows\System\iyYrfvg.exe
  C:\Windows\System\iyYrfvg.exe
  2⤵
  PID:1332
- C:\Windows\System\zPPrEie.exe
  C:\Windows\System\zPPrEie.exe
  2⤵
  PID:2296
- C:\Windows\System\nRSsmlG.exe
  C:\Windows\System\nRSsmlG.exe
  2⤵
  PID:856
- C:\Windows\System\gmvobtj.exe
  C:\Windows\System\gmvobtj.exe
  2⤵
  PID:708
- C:\Windows\System\xcCPcMR.exe
  C:\Windows\System\xcCPcMR.exe
  2⤵
  PID:848
- C:\Windows\System\SnwDKkt.exe
  C:\Windows\System\SnwDKkt.exe
  2⤵
  PID:3008
- C:\Windows\System\QaMInah.exe
  C:\Windows\System\QaMInah.exe
  2⤵
  PID:1528
- C:\Windows\System\oyNKmbK.exe
  C:\Windows\System\oyNKmbK.exe
  2⤵
  PID:276
- C:\Windows\System\hqZbWhd.exe
  C:\Windows\System\hqZbWhd.exe
  2⤵
  PID:1540
- C:\Windows\System\lPvIMhy.exe
  C:\Windows\System\lPvIMhy.exe
  2⤵
  PID:1868
- C:\Windows\System\ZBQXngX.exe
  C:\Windows\System\ZBQXngX.exe
  2⤵
  PID:1648
- C:\Windows\System\YqpDnGA.exe
  C:\Windows\System\YqpDnGA.exe
  2⤵
  PID:880
- C:\Windows\System\wkWYpXR.exe
  C:\Windows\System\wkWYpXR.exe
  2⤵
  PID:1264
- C:\Windows\System\yzLMJJJ.exe
  C:\Windows\System\yzLMJJJ.exe
  2⤵
  PID:2068
- C:\Windows\System\sGFELmG.exe
  C:\Windows\System\sGFELmG.exe
  2⤵
  PID:984
- C:\Windows\System\kQzampE.exe
  C:\Windows\System\kQzampE.exe
  2⤵
  PID:1748
- C:\Windows\System\VgZsfXQ.exe
  C:\Windows\System\VgZsfXQ.exe
  2⤵
  PID:1048
- C:\Windows\System\KTJzEGp.exe
  C:\Windows\System\KTJzEGp.exe
  2⤵
  PID:1564
- C:\Windows\System\zRPzTZg.exe
  C:\Windows\System\zRPzTZg.exe
  2⤵
  PID:2204
- C:\Windows\System\kpDrarJ.exe
  C:\Windows\System\kpDrarJ.exe
  2⤵
  PID:2012
- C:\Windows\System\gVIwtwW.exe
  C:\Windows\System\gVIwtwW.exe
  2⤵
  PID:1940
- C:\Windows\System\nhvJKAM.exe
  C:\Windows\System\nhvJKAM.exe
  2⤵
  PID:2572
- C:\Windows\System\iQJLwWm.exe
  C:\Windows\System\iQJLwWm.exe
  2⤵
  PID:1996
- C:\Windows\System\IKKLcFN.exe
  C:\Windows\System\IKKLcFN.exe
  2⤵
  PID:2928
- C:\Windows\System\tgcfqWH.exe
  C:\Windows\System\tgcfqWH.exe
  2⤵
  PID:2808
- C:\Windows\System\OsnJQYE.exe
  C:\Windows\System\OsnJQYE.exe
  2⤵
  PID:2836
- C:\Windows\System\aFGgLpm.exe
  C:\Windows\System\aFGgLpm.exe
  2⤵
  PID:2008
- C:\Windows\System\cCaThKq.exe
  C:\Windows\System\cCaThKq.exe
  2⤵
  PID:1628
- C:\Windows\System\LdGGFvX.exe
  C:\Windows\System\LdGGFvX.exe
  2⤵
  PID:2164
- C:\Windows\System\hzIlTWC.exe
  C:\Windows\System\hzIlTWC.exe
  2⤵
  PID:1568
- C:\Windows\System\jONuiAs.exe
  C:\Windows\System\jONuiAs.exe
  2⤵
  PID:852
- C:\Windows\System\nFHkHTF.exe
  C:\Windows\System\nFHkHTF.exe
  2⤵
  PID:348
- C:\Windows\System\LdvbMmU.exe
  C:\Windows\System\LdvbMmU.exe
  2⤵
  PID:2216
- C:\Windows\System\ewYkSPj.exe
  C:\Windows\System\ewYkSPj.exe
  2⤵
  PID:2372
- C:\Windows\System\HUpXmzV.exe
  C:\Windows\System\HUpXmzV.exe
  2⤵
  PID:2640
- C:\Windows\System\nvRHEMj.exe
  C:\Windows\System\nvRHEMj.exe
  2⤵
  PID:2896
- C:\Windows\System\ALIdGnk.exe
  C:\Windows\System\ALIdGnk.exe
  2⤵
  PID:1640
- C:\Windows\System\cPVGNKW.exe
  C:\Windows\System\cPVGNKW.exe
  2⤵
  PID:3060
- C:\Windows\System\iChNIux.exe
  C:\Windows\System\iChNIux.exe
  2⤵
  PID:2876
- C:\Windows\System\KXNSBaz.exe
  C:\Windows\System\KXNSBaz.exe
  2⤵
  PID:1360
- C:\Windows\System\UdOohet.exe
  C:\Windows\System\UdOohet.exe
  2⤵
  PID:2944
- C:\Windows\System\PPwDnBr.exe
  C:\Windows\System\PPwDnBr.exe
  2⤵
  PID:1056
- C:\Windows\System\LRJEukK.exe
  C:\Windows\System\LRJEukK.exe
  2⤵
  PID:1392
- C:\Windows\System\EVjqkFD.exe
  C:\Windows\System\EVjqkFD.exe
  2⤵
  PID:1944
- C:\Windows\System\CjQUQoh.exe
  C:\Windows\System\CjQUQoh.exe
  2⤵
  PID:1296
- C:\Windows\System\uhffODS.exe
  C:\Windows\System\uhffODS.exe
  2⤵
  PID:2036
- C:\Windows\System\huXBqxz.exe
  C:\Windows\System\huXBqxz.exe
  2⤵
  PID:816
- C:\Windows\System\jSsdQRc.exe
  C:\Windows\System\jSsdQRc.exe
  2⤵
  PID:292
- C:\Windows\System\DjIRqfB.exe
  C:\Windows\System\DjIRqfB.exe
  2⤵
  PID:1756
- C:\Windows\System\FJkBwKF.exe
  C:\Windows\System\FJkBwKF.exe
  2⤵
  PID:908
- C:\Windows\System\RSNRzSa.exe
  C:\Windows\System\RSNRzSa.exe
  2⤵
  PID:1304
- C:\Windows\System\QdIFOuM.exe
  C:\Windows\System\QdIFOuM.exe
  2⤵
  PID:2732
- C:\Windows\System\sLcCdPA.exe
  C:\Windows\System\sLcCdPA.exe
  2⤵
  PID:540
- C:\Windows\System\rOHcVFn.exe
  C:\Windows\System\rOHcVFn.exe
  2⤵
  PID:2140
- C:\Windows\System\cRcojll.exe
  C:\Windows\System\cRcojll.exe
  2⤵
  PID:2644
- C:\Windows\System\infJqUE.exe
  C:\Windows\System\infJqUE.exe
  2⤵
  PID:1368
- C:\Windows\System\xHPsSou.exe
  C:\Windows\System\xHPsSou.exe
  2⤵
  PID:1788
- C:\Windows\System\ZIoxLhQ.exe
  C:\Windows\System\ZIoxLhQ.exe
  2⤵
  PID:2064
- C:\Windows\System\LdGXvdJ.exe
  C:\Windows\System\LdGXvdJ.exe
  2⤵
  PID:1724
- C:\Windows\System\cGAxVvm.exe
  C:\Windows\System\cGAxVvm.exe
  2⤵
  PID:2620
- C:\Windows\System\EkuyXti.exe
  C:\Windows\System\EkuyXti.exe
  2⤵
  PID:960
- C:\Windows\System\mMepgoS.exe
  C:\Windows\System\mMepgoS.exe
  2⤵
  PID:1696
- C:\Windows\System\mfoJxBO.exe
  C:\Windows\System\mfoJxBO.exe
  2⤵
  PID:3004
- C:\Windows\System\kYXJhhI.exe
  C:\Windows\System\kYXJhhI.exe
  2⤵
  PID:868
- C:\Windows\System\kSlNhrJ.exe
  C:\Windows\System\kSlNhrJ.exe
  2⤵
  PID:1612
- C:\Windows\System\EcJVSIR.exe
  C:\Windows\System\EcJVSIR.exe
  2⤵
  PID:1520
- C:\Windows\System\PQXuggf.exe
  C:\Windows\System\PQXuggf.exe
  2⤵
  PID:1956
- C:\Windows\System\wfOqMJu.exe
  C:\Windows\System\wfOqMJu.exe
  2⤵
  PID:2612
- C:\Windows\System\CXWBAFM.exe
  C:\Windows\System\CXWBAFM.exe
  2⤵
  PID:656
- C:\Windows\System\mYHhTpf.exe
  C:\Windows\System\mYHhTpf.exe
  2⤵
  PID:1964
- C:\Windows\System\JwkkdDn.exe
  C:\Windows\System\JwkkdDn.exe
  2⤵
  PID:2720
- C:\Windows\System\GpkyOjA.exe
  C:\Windows\System\GpkyOjA.exe
  2⤵
  PID:1812
- C:\Windows\System\FfamAWe.exe
  C:\Windows\System\FfamAWe.exe
  2⤵
  PID:2596
- C:\Windows\System\vVLtJWz.exe
  C:\Windows\System\vVLtJWz.exe
  2⤵
  PID:2668
- C:\Windows\System\sWJvxDJ.exe
  C:\Windows\System\sWJvxDJ.exe
  2⤵
  PID:1992
- C:\Windows\System\JjdWfqf.exe
  C:\Windows\System\JjdWfqf.exe
  2⤵
  PID:572
- C:\Windows\System\fyunbfK.exe
  C:\Windows\System\fyunbfK.exe
  2⤵
  PID:1784
- C:\Windows\System\QNHHWZH.exe
  C:\Windows\System\QNHHWZH.exe
  2⤵
  PID:1668
- C:\Windows\System\TEoaKFL.exe
  C:\Windows\System\TEoaKFL.exe
  2⤵
  PID:820
- C:\Windows\System\kLESzCz.exe
  C:\Windows\System\kLESzCz.exe
  2⤵
  PID:2000
- C:\Windows\System\yDtcIjt.exe
  C:\Windows\System\yDtcIjt.exe
  2⤵
  PID:1052
- C:\Windows\System\dUVBQub.exe
  C:\Windows\System\dUVBQub.exe
  2⤵
  PID:2604
- C:\Windows\System\NBrePEl.exe
  C:\Windows\System\NBrePEl.exe
  2⤵
  PID:2480
- C:\Windows\System\POeZaZQ.exe
  C:\Windows\System\POeZaZQ.exe
  2⤵
  PID:1768
- C:\Windows\System\JIzjEwR.exe
  C:\Windows\System\JIzjEwR.exe
  2⤵
  PID:1860
- C:\Windows\System\BIiodBa.exe
  C:\Windows\System\BIiodBa.exe
  2⤵
  PID:576
- C:\Windows\System\ROYugVb.exe
  C:\Windows\System\ROYugVb.exe
  2⤵
  PID:2708
- C:\Windows\System\XvtVztH.exe
  C:\Windows\System\XvtVztH.exe
  2⤵
  PID:2696
- C:\Windows\System\CNreGzf.exe
  C:\Windows\System\CNreGzf.exe
  2⤵
  PID:3076
- C:\Windows\System\AMVFLlv.exe
  C:\Windows\System\AMVFLlv.exe
  2⤵
  PID:3092
- C:\Windows\System\AVkPoAF.exe
  C:\Windows\System\AVkPoAF.exe
  2⤵
  PID:3108
- C:\Windows\System\VEzcBWX.exe
  C:\Windows\System\VEzcBWX.exe
  2⤵
  PID:3128
- C:\Windows\System\zOdcGJT.exe
  C:\Windows\System\zOdcGJT.exe
  2⤵
  PID:3144
- C:\Windows\System\ExaNqZs.exe
  C:\Windows\System\ExaNqZs.exe
  2⤵
  PID:3160
- C:\Windows\System\JVApNlK.exe
  C:\Windows\System\JVApNlK.exe
  2⤵
  PID:3176
- C:\Windows\System\SSwrYdV.exe
  C:\Windows\System\SSwrYdV.exe
  2⤵
  PID:3192
- C:\Windows\System\IaoPOpP.exe
  C:\Windows\System\IaoPOpP.exe
  2⤵
  PID:3208
- C:\Windows\System\gRFXavb.exe
  C:\Windows\System\gRFXavb.exe
  2⤵
  PID:3224
- C:\Windows\System\dZzioRY.exe
  C:\Windows\System\dZzioRY.exe
  2⤵
  PID:3240
- C:\Windows\System\rqOryrE.exe
  C:\Windows\System\rqOryrE.exe
  2⤵
  PID:3256
- C:\Windows\System\RplqKfZ.exe
  C:\Windows\System\RplqKfZ.exe
  2⤵
  PID:3272
- C:\Windows\System\aYdJVlB.exe
  C:\Windows\System\aYdJVlB.exe
  2⤵
  PID:3292
- C:\Windows\System\ssdNEFH.exe
  C:\Windows\System\ssdNEFH.exe
  2⤵
  PID:3308
- C:\Windows\System\mEucIQT.exe
  C:\Windows\System\mEucIQT.exe
  2⤵
  PID:3324
- C:\Windows\System\sBtqRPm.exe
  C:\Windows\System\sBtqRPm.exe
  2⤵
  PID:3448
- C:\Windows\System\MfZTpIH.exe
  C:\Windows\System\MfZTpIH.exe
  2⤵
  PID:3464
- C:\Windows\System\uqpcJSI.exe
  C:\Windows\System\uqpcJSI.exe
  2⤵
  PID:3480
- C:\Windows\System\ydDKxKU.exe
  C:\Windows\System\ydDKxKU.exe
  2⤵
  PID:3496
- C:\Windows\System\yVFnlJS.exe
  C:\Windows\System\yVFnlJS.exe
  2⤵
  PID:3512
- C:\Windows\System\UCuxNnV.exe
  C:\Windows\System\UCuxNnV.exe
  2⤵
  PID:3528
- C:\Windows\System\TaQyFjf.exe
  C:\Windows\System\TaQyFjf.exe
  2⤵
  PID:3544
- C:\Windows\System\HcUdmOX.exe
  C:\Windows\System\HcUdmOX.exe
  2⤵
  PID:3560
- C:\Windows\System\GbNbvqL.exe
  C:\Windows\System\GbNbvqL.exe
  2⤵
  PID:3576
- C:\Windows\System\RFAUWrw.exe
  C:\Windows\System\RFAUWrw.exe
  2⤵
  PID:3596
- C:\Windows\System\xXmmfnR.exe
  C:\Windows\System\xXmmfnR.exe
  2⤵
  PID:3612
- C:\Windows\System\nMxBKvN.exe
  C:\Windows\System\nMxBKvN.exe
  2⤵
  PID:3628
- C:\Windows\System\DVxPMCW.exe
  C:\Windows\System\DVxPMCW.exe
  2⤵
  PID:3644
- C:\Windows\System\vObtXMD.exe
  C:\Windows\System\vObtXMD.exe
  2⤵
  PID:3660
- C:\Windows\System\IevsNJe.exe
  C:\Windows\System\IevsNJe.exe
  2⤵
  PID:3684
- C:\Windows\System\spvlLOj.exe
  C:\Windows\System\spvlLOj.exe
  2⤵
  PID:3700
- C:\Windows\System\LfUDHtq.exe
  C:\Windows\System\LfUDHtq.exe
  2⤵
  PID:3716
- C:\Windows\System\jmzDylW.exe
  C:\Windows\System\jmzDylW.exe
  2⤵
  PID:3732
- C:\Windows\System\pELSSdD.exe
  C:\Windows\System\pELSSdD.exe
  2⤵
  PID:3748
- C:\Windows\System\ykAKDlL.exe
  C:\Windows\System\ykAKDlL.exe
  2⤵
  PID:3764
- C:\Windows\System\hBesCla.exe
  C:\Windows\System\hBesCla.exe
  2⤵
  PID:3780
- C:\Windows\System\eawgBHI.exe
  C:\Windows\System\eawgBHI.exe
  2⤵
  PID:3796
- C:\Windows\System\fTpWIRH.exe
  C:\Windows\System\fTpWIRH.exe
  2⤵
  PID:3812
- C:\Windows\System\wIvsrvs.exe
  C:\Windows\System\wIvsrvs.exe
  2⤵
  PID:3828
- C:\Windows\System\jpbLXgm.exe
  C:\Windows\System\jpbLXgm.exe
  2⤵
  PID:3844
- C:\Windows\System\reehhsl.exe
  C:\Windows\System\reehhsl.exe
  2⤵
  PID:3860
- C:\Windows\System\ImWDJwU.exe
  C:\Windows\System\ImWDJwU.exe
  2⤵
  PID:3876
- C:\Windows\System\McZgqTG.exe
  C:\Windows\System\McZgqTG.exe
  2⤵
  PID:3892
- C:\Windows\System\jfJNMNY.exe
  C:\Windows\System\jfJNMNY.exe
  2⤵
  PID:3908
- C:\Windows\System\WToROqw.exe
  C:\Windows\System\WToROqw.exe
  2⤵
  PID:3924
- C:\Windows\System\oOURkfS.exe
  C:\Windows\System\oOURkfS.exe
  2⤵
  PID:4008
- C:\Windows\System\ITyWsbh.exe
  C:\Windows\System\ITyWsbh.exe
  2⤵
  PID:4036
- C:\Windows\System\VpgspMv.exe
  C:\Windows\System\VpgspMv.exe
  2⤵
  PID:4052
- C:\Windows\System\fvCUuEO.exe
  C:\Windows\System\fvCUuEO.exe
  2⤵
  PID:4068
- C:\Windows\System\uOAuZma.exe
  C:\Windows\System\uOAuZma.exe
  2⤵
  PID:4084
- C:\Windows\System\RrJbvls.exe
  C:\Windows\System\RrJbvls.exe
  2⤵
  PID:456
- C:\Windows\System\jAPXDOU.exe
  C:\Windows\System\jAPXDOU.exe
  2⤵
  PID:2392
- C:\Windows\System\nxNNaBa.exe
  C:\Windows\System\nxNNaBa.exe
  2⤵
  PID:640
- C:\Windows\System\FXDqabm.exe
  C:\Windows\System\FXDqabm.exe
  2⤵
  PID:2628
- C:\Windows\System\NAHiLmS.exe
  C:\Windows\System\NAHiLmS.exe
  2⤵
  PID:2120
- C:\Windows\System\LzDskYR.exe
  C:\Windows\System\LzDskYR.exe
  2⤵
  PID:2324
- C:\Windows\System\aAlUZEb.exe
  C:\Windows\System\aAlUZEb.exe
  2⤵
  PID:3140
- C:\Windows\System\ZUhVaLK.exe
  C:\Windows\System\ZUhVaLK.exe
  2⤵
  PID:3232
- C:\Windows\System\iXBcDBs.exe
  C:\Windows\System\iXBcDBs.exe
  2⤵
  PID:3304
- C:\Windows\System\IMCaHWu.exe
  C:\Windows\System\IMCaHWu.exe
  2⤵
  PID:3344
- C:\Windows\System\joqWvvv.exe
  C:\Windows\System\joqWvvv.exe
  2⤵
  PID:3360
- C:\Windows\System\ezaXBXq.exe
  C:\Windows\System\ezaXBXq.exe
  2⤵
  PID:2416
- C:\Windows\System\zyOLAdM.exe
  C:\Windows\System\zyOLAdM.exe
  2⤵
  PID:324
- C:\Windows\System\oRrldwr.exe
  C:\Windows\System\oRrldwr.exe
  2⤵
  PID:1728
- C:\Windows\System\NENqpcE.exe
  C:\Windows\System\NENqpcE.exe
  2⤵
  PID:1764
- C:\Windows\System\KPndttX.exe
  C:\Windows\System\KPndttX.exe
  2⤵
  PID:3120
- C:\Windows\System\UdoWtAG.exe
  C:\Windows\System\UdoWtAG.exe
  2⤵
  PID:3184
- C:\Windows\System\FDgXkVw.exe
  C:\Windows\System\FDgXkVw.exe
  2⤵
  PID:3248
- C:\Windows\System\gSvHgnN.exe
  C:\Windows\System\gSvHgnN.exe
  2⤵
  PID:3288
- C:\Windows\System\mXrRbVx.exe
  C:\Windows\System\mXrRbVx.exe
  2⤵
  PID:3460
- C:\Windows\System\yuvBDrF.exe
  C:\Windows\System\yuvBDrF.exe
  2⤵
  PID:3524
- C:\Windows\System\GyjWzUd.exe
  C:\Windows\System\GyjWzUd.exe
  2⤵
  PID:3588
- C:\Windows\System\ZGOPmgY.exe
  C:\Windows\System\ZGOPmgY.exe
  2⤵
  PID:3652
- C:\Windows\System\hXzYHaL.exe
  C:\Windows\System\hXzYHaL.exe
  2⤵
  PID:3728
- C:\Windows\System\aJjMEAn.exe
  C:\Windows\System\aJjMEAn.exe
  2⤵
  PID:3792
- C:\Windows\System\QXiwnKJ.exe
  C:\Windows\System\QXiwnKJ.exe
  2⤵
  PID:1100
- C:\Windows\System\RkXszJs.exe
  C:\Windows\System\RkXszJs.exe
  2⤵
  PID:3416
- C:\Windows\System\BawzVuP.exe
  C:\Windows\System\BawzVuP.exe
  2⤵
  PID:3436
- C:\Windows\System\LCohmOG.exe
  C:\Windows\System\LCohmOG.exe
  2⤵
  PID:3476
- C:\Windows\System\hfWXDVP.exe
  C:\Windows\System\hfWXDVP.exe
  2⤵
  PID:3540
- C:\Windows\System\grmonZw.exe
  C:\Windows\System\grmonZw.exe
  2⤵
  PID:3608
- C:\Windows\System\hUzeLCF.exe
  C:\Windows\System\hUzeLCF.exe
  2⤵
  PID:3680
- C:\Windows\System\XuDncux.exe
  C:\Windows\System\XuDncux.exe
  2⤵
  PID:3744
- C:\Windows\System\srFTrlF.exe
  C:\Windows\System\srFTrlF.exe
  2⤵
  PID:3808
- C:\Windows\System\fpzzePT.exe
  C:\Windows\System\fpzzePT.exe
  2⤵
  PID:3872
- C:\Windows\System\hTllBoE.exe
  C:\Windows\System\hTllBoE.exe
  2⤵
  PID:3884
- C:\Windows\System\AItMTnC.exe
  C:\Windows\System\AItMTnC.exe
  2⤵
  PID:4016
- C:\Windows\System\ekPwuhS.exe
  C:\Windows\System\ekPwuhS.exe
  2⤵
  PID:4060
- C:\Windows\System\DSkvtqY.exe
  C:\Windows\System\DSkvtqY.exe
  2⤵
  PID:3056
- C:\Windows\System\vfpaqsY.exe
  C:\Windows\System\vfpaqsY.exe
  2⤵
  PID:2444
- C:\Windows\System\MDqbsPF.exe
  C:\Windows\System\MDqbsPF.exe
  2⤵
  PID:3268
- C:\Windows\System\uLGxgTa.exe
  C:\Windows\System\uLGxgTa.exe
  2⤵
  PID:2100
- C:\Windows\System\QrsVxES.exe
  C:\Windows\System\QrsVxES.exe
  2⤵
  PID:3280
- C:\Windows\System\aEmRdPN.exe
  C:\Windows\System\aEmRdPN.exe
  2⤵
  PID:3620
- C:\Windows\System\WhVkIor.exe
  C:\Windows\System\WhVkIor.exe
  2⤵
  PID:1152
- C:\Windows\System\xaYqXeK.exe
  C:\Windows\System\xaYqXeK.exe
  2⤵
  PID:3396
- C:\Windows\System\boBWhKm.exe
  C:\Windows\System\boBWhKm.exe
  2⤵
  PID:3376
- C:\Windows\System\vGhkQOF.exe
  C:\Windows\System\vGhkQOF.exe
  2⤵
  PID:4104
- C:\Windows\System\rtxwpEG.exe
  C:\Windows\System\rtxwpEG.exe
  2⤵
  PID:4120
- C:\Windows\System\RnVMGCU.exe
  C:\Windows\System\RnVMGCU.exe
  2⤵
  PID:4136
- C:\Windows\System\aNvSEGB.exe
  C:\Windows\System\aNvSEGB.exe
  2⤵
  PID:4152
- C:\Windows\System\fUiwzss.exe
  C:\Windows\System\fUiwzss.exe
  2⤵
  PID:4168
- C:\Windows\System\EfVabxw.exe
  C:\Windows\System\EfVabxw.exe
  2⤵
  PID:4184
- C:\Windows\System\jSfgWhi.exe
  C:\Windows\System\jSfgWhi.exe
  2⤵
  PID:4200
- C:\Windows\System\tDnScDH.exe
  C:\Windows\System\tDnScDH.exe
  2⤵
  PID:4216
- C:\Windows\System\SBOScfE.exe
  C:\Windows\System\SBOScfE.exe
  2⤵
  PID:4232
- C:\Windows\System\eRYQsbD.exe
  C:\Windows\System\eRYQsbD.exe
  2⤵
  PID:4356
- C:\Windows\System\RXwVxKO.exe
  C:\Windows\System\RXwVxKO.exe
  2⤵
  PID:4372
- C:\Windows\System\fsapQYJ.exe
  C:\Windows\System\fsapQYJ.exe
  2⤵
  PID:4388
- C:\Windows\System\ylLrcBe.exe
  C:\Windows\System\ylLrcBe.exe
  2⤵
  PID:4404
- C:\Windows\System\iWFBNfm.exe
  C:\Windows\System\iWFBNfm.exe
  2⤵
  PID:4516
- C:\Windows\System\OqIBwuH.exe
  C:\Windows\System\OqIBwuH.exe
  2⤵
  PID:4540
- C:\Windows\System\ueUTJYi.exe
  C:\Windows\System\ueUTJYi.exe
  2⤵
  PID:4564
- C:\Windows\System\aUBRwtX.exe
  C:\Windows\System\aUBRwtX.exe
  2⤵
  PID:4580
- C:\Windows\System\HoQgcmr.exe
  C:\Windows\System\HoQgcmr.exe
  2⤵
  PID:4596
- C:\Windows\System\fOawujj.exe
  C:\Windows\System\fOawujj.exe
  2⤵
  PID:4616
- C:\Windows\System\eLEyxRU.exe
  C:\Windows\System\eLEyxRU.exe
  2⤵
  PID:4632
- C:\Windows\System\elKLCKa.exe
  C:\Windows\System\elKLCKa.exe
  2⤵
  PID:4648
- C:\Windows\System\afnYRXZ.exe
  C:\Windows\System\afnYRXZ.exe
  2⤵
  PID:4664
- C:\Windows\System\lRKGWdV.exe
  C:\Windows\System\lRKGWdV.exe
  2⤵
  PID:4680
- C:\Windows\System\dJtQiEM.exe
  C:\Windows\System\dJtQiEM.exe
  2⤵
  PID:4696
- C:\Windows\System\thtugnq.exe
  C:\Windows\System\thtugnq.exe
  2⤵
  PID:4712
- C:\Windows\System\XAPPFIm.exe
  C:\Windows\System\XAPPFIm.exe
  2⤵
  PID:4736
- C:\Windows\System\JMNHXGh.exe
  C:\Windows\System\JMNHXGh.exe
  2⤵
  PID:4756
- C:\Windows\System\GjgcMoA.exe
  C:\Windows\System\GjgcMoA.exe
  2⤵
  PID:4772
- C:\Windows\System\JQxkHSG.exe
  C:\Windows\System\JQxkHSG.exe
  2⤵
  PID:4788
- C:\Windows\System\YXwTUNh.exe
  C:\Windows\System\YXwTUNh.exe
  2⤵
  PID:4804
- C:\Windows\System\eWeGGtz.exe
  C:\Windows\System\eWeGGtz.exe
  2⤵
  PID:4820
- C:\Windows\System\JtCkhRG.exe
  C:\Windows\System\JtCkhRG.exe
  2⤵
  PID:4836
- C:\Windows\System\MgoazVV.exe
  C:\Windows\System\MgoazVV.exe
  2⤵
  PID:4852
- C:\Windows\System\iTYsSJK.exe
  C:\Windows\System\iTYsSJK.exe
  2⤵
  PID:4868
- C:\Windows\System\qcnXuEr.exe
  C:\Windows\System\qcnXuEr.exe
  2⤵
  PID:4884
- C:\Windows\System\MkZtMOa.exe
  C:\Windows\System\MkZtMOa.exe
  2⤵
  PID:4900
- C:\Windows\System\JSmKXLB.exe
  C:\Windows\System\JSmKXLB.exe
  2⤵
  PID:4936
- C:\Windows\System\PTIyZBN.exe
  C:\Windows\System\PTIyZBN.exe
  2⤵
  PID:4956
- C:\Windows\System\YQIJimr.exe
  C:\Windows\System\YQIJimr.exe
  2⤵
  PID:4972
- C:\Windows\System\ckjpkUz.exe
  C:\Windows\System\ckjpkUz.exe
  2⤵
  PID:4988
- C:\Windows\System\FkUuCnV.exe
  C:\Windows\System\FkUuCnV.exe
  2⤵
  PID:5004
- C:\Windows\System\cEzXfbz.exe
  C:\Windows\System\cEzXfbz.exe
  2⤵
  PID:5020
- C:\Windows\System\yZqnEOW.exe
  C:\Windows\System\yZqnEOW.exe
  2⤵
  PID:5036
- C:\Windows\System\caKllEv.exe
  C:\Windows\System\caKllEv.exe
  2⤵
  PID:5052
- C:\Windows\System\ohQerVo.exe
  C:\Windows\System\ohQerVo.exe
  2⤵
  PID:5068
- C:\Windows\System\ALAVDop.exe
  C:\Windows\System\ALAVDop.exe
  2⤵
  PID:5084
- C:\Windows\System\qTBwYDH.exe
  C:\Windows\System\qTBwYDH.exe
  2⤵
  PID:5108
- C:\Windows\System\abCWtJb.exe
  C:\Windows\System\abCWtJb.exe
  2⤵
  PID:3940
- C:\Windows\System\JtaMwNS.exe
  C:\Windows\System\JtaMwNS.exe
  2⤵
  PID:3952
- C:\Windows\System\qbyVPMt.exe
  C:\Windows\System\qbyVPMt.exe
  2⤵
  PID:3968
- C:\Windows\System\tZUlJnW.exe
  C:\Windows\System\tZUlJnW.exe
  2⤵
  PID:3988
- C:\Windows\System\HGVzuid.exe
  C:\Windows\System\HGVzuid.exe
  2⤵
  PID:4004
- C:\Windows\System\ZLiwGOf.exe
  C:\Windows\System\ZLiwGOf.exe
  2⤵
  PID:4080
- C:\Windows\System\iWleWUg.exe
  C:\Windows\System\iWleWUg.exe
  2⤵
  PID:304
- C:\Windows\System\mPPVMUI.exe
  C:\Windows\System\mPPVMUI.exe
  2⤵
  PID:2084
- C:\Windows\System\waIEAHf.exe
  C:\Windows\System\waIEAHf.exe
  2⤵
  PID:3336
- C:\Windows\System\BpBxbmC.exe
  C:\Windows\System\BpBxbmC.exe
  2⤵
  PID:3156
- C:\Windows\System\QmSlCod.exe
  C:\Windows\System\QmSlCod.exe
  2⤵
  PID:3788
- C:\Windows\System\mliMZCD.exe
  C:\Windows\System\mliMZCD.exe
  2⤵
  PID:4112
- C:\Windows\System\ZnHktsk.exe
  C:\Windows\System\ZnHktsk.exe
  2⤵
  PID:4176
- C:\Windows\System\zZonVQy.exe
  C:\Windows\System\zZonVQy.exe
  2⤵
  PID:4240
- C:\Windows\System\dbQKDjJ.exe
  C:\Windows\System\dbQKDjJ.exe
  2⤵
  PID:3604
- C:\Windows\System\TGVHezJ.exe
  C:\Windows\System\TGVHezJ.exe
  2⤵
  PID:3868
- C:\Windows\System\KjIDFbn.exe
  C:\Windows\System\KjIDFbn.exe
  2⤵
  PID:3136
- C:\Windows\System\CBVIcCj.exe
  C:\Windows\System\CBVIcCj.exe
  2⤵
  PID:4260
- C:\Windows\System\CfBvheL.exe
  C:\Windows\System\CfBvheL.exe
  2⤵
  PID:4276
- C:\Windows\System\YkfYCyc.exe
  C:\Windows\System\YkfYCyc.exe
  2⤵
  PID:4296
- C:\Windows\System\yHEcpRO.exe
  C:\Windows\System\yHEcpRO.exe
  2⤵
  PID:4312
- C:\Windows\System\GteArxU.exe
  C:\Windows\System\GteArxU.exe
  2⤵
  PID:4332
- C:\Windows\System\NzFiWLY.exe
  C:\Windows\System\NzFiWLY.exe
  2⤵
  PID:4348
- C:\Windows\System\cBZAhhi.exe
  C:\Windows\System\cBZAhhi.exe
  2⤵
  PID:3672
- C:\Windows\System\SdbQnnH.exe
  C:\Windows\System\SdbQnnH.exe
  2⤵
  PID:3904
- C:\Windows\System\knchRrY.exe
  C:\Windows\System\knchRrY.exe
  2⤵
  PID:3424
- C:\Windows\System\naCRYxL.exe
  C:\Windows\System\naCRYxL.exe
  2⤵
  PID:2152
- C:\Windows\System\DnKvLqG.exe
  C:\Windows\System\DnKvLqG.exe
  2⤵
  PID:1636
- C:\Windows\System\kbeEJqV.exe
  C:\Windows\System\kbeEJqV.exe
  2⤵
  PID:2832
- C:\Windows\System\HjmDIVl.exe
  C:\Windows\System\HjmDIVl.exe
  2⤵
  PID:4128
- C:\Windows\System\qYJrBYf.exe
  C:\Windows\System\qYJrBYf.exe
  2⤵
  PID:1984
- C:\Windows\System\ANhdKRD.exe
  C:\Windows\System\ANhdKRD.exe
  2⤵
  PID:2772
- C:\Windows\System\McmosfH.exe
  C:\Windows\System\McmosfH.exe
  2⤵
  PID:3116
- C:\Windows\System\KwTiWEw.exe
  C:\Windows\System\KwTiWEw.exe
  2⤵
  PID:3320
- C:\Windows\System\UdLzJFH.exe
  C:\Windows\System\UdLzJFH.exe
  2⤵
  PID:3696
- C:\Windows\System\VcyOfaI.exe
  C:\Windows\System\VcyOfaI.exe
  2⤵
  PID:4164
- C:\Windows\System\BzViecW.exe
  C:\Windows\System\BzViecW.exe
  2⤵
  PID:4224
- C:\Windows\System\NgUUHcQ.exe
  C:\Windows\System\NgUUHcQ.exe
  2⤵
  PID:4396
- C:\Windows\System\cEpCmkA.exe
  C:\Windows\System\cEpCmkA.exe
  2⤵
  PID:4460
- C:\Windows\System\UqHcMGp.exe
  C:\Windows\System\UqHcMGp.exe
  2⤵
  PID:2684
- C:\Windows\System\sydqAin.exe
  C:\Windows\System\sydqAin.exe
  2⤵
  PID:4496
- C:\Windows\System\RMWTtOG.exe
  C:\Windows\System\RMWTtOG.exe
  2⤵
  PID:2704
- C:\Windows\System\uxlpDkW.exe
  C:\Windows\System\uxlpDkW.exe
  2⤵
  PID:3000
- C:\Windows\System\FsXJcsd.exe
  C:\Windows\System\FsXJcsd.exe
  2⤵
  PID:2440
- C:\Windows\System\CDIRrek.exe
  C:\Windows\System\CDIRrek.exe
  2⤵
  PID:4688
- C:\Windows\System\IGzfBYf.exe
  C:\Windows\System\IGzfBYf.exe
  2⤵
  PID:4640
- C:\Windows\System\SaUXyVa.exe
  C:\Windows\System\SaUXyVa.exe
  2⤵
  PID:4536
- C:\Windows\System\NmlHOiZ.exe
  C:\Windows\System\NmlHOiZ.exe
  2⤵
  PID:4604
- C:\Windows\System\nBqDZYm.exe
  C:\Windows\System\nBqDZYm.exe
  2⤵
  PID:4672
- C:\Windows\System\QyPeRhH.exe
  C:\Windows\System\QyPeRhH.exe
  2⤵
  PID:4748
- C:\Windows\System\DhgUQDz.exe
  C:\Windows\System\DhgUQDz.exe
  2⤵
  PID:4812
- C:\Windows\System\CSiEoMU.exe
  C:\Windows\System\CSiEoMU.exe
  2⤵
  PID:4876
- C:\Windows\System\tRQCvNb.exe
  C:\Windows\System\tRQCvNb.exe
  2⤵
  PID:2792
- C:\Windows\System\nNQIHTb.exe
  C:\Windows\System\nNQIHTb.exe
  2⤵
  PID:4924
- C:\Windows\System\YfDetLY.exe
  C:\Windows\System\YfDetLY.exe
  2⤵
  PID:4980
- C:\Windows\System\TQeSMJl.exe
  C:\Windows\System\TQeSMJl.exe
  2⤵
  PID:4964
- C:\Windows\System\mOPnudz.exe
  C:\Windows\System\mOPnudz.exe
  2⤵
  PID:5100
- C:\Windows\System\RuSmLFL.exe
  C:\Windows\System\RuSmLFL.exe
  2⤵
  PID:3408
- C:\Windows\System\kLPWCgN.exe
  C:\Windows\System\kLPWCgN.exe
  2⤵
  PID:4144
- C:\Windows\System\rHWbSpY.exe
  C:\Windows\System\rHWbSpY.exe
  2⤵
  PID:2540
- C:\Windows\System\ArrmNgF.exe
  C:\Windows\System\ArrmNgF.exe
  2⤵
  PID:3920
- C:\Windows\System\GLKGiaD.exe
  C:\Windows\System\GLKGiaD.exe
  2⤵
  PID:4272
- C:\Windows\System\lRphKen.exe
  C:\Windows\System\lRphKen.exe
  2⤵
  PID:2624
- C:\Windows\System\MpNovOD.exe
  C:\Windows\System\MpNovOD.exe
  2⤵
  PID:3740
- C:\Windows\System\DMyeEvD.exe
  C:\Windows\System\DMyeEvD.exe
  2⤵
  PID:4328
- C:\Windows\System\RNbuToC.exe
  C:\Windows\System\RNbuToC.exe
  2⤵
  PID:3856
- C:\Windows\System\FPJBnpS.exe
  C:\Windows\System\FPJBnpS.exe
  2⤵
  PID:4344
- C:\Windows\System\ATYPAAU.exe
  C:\Windows\System\ATYPAAU.exe
  2⤵
  PID:3536
- C:\Windows\System\bpZPFSa.exe
  C:\Windows\System\bpZPFSa.exe
  2⤵
  PID:3760
- C:\Windows\System\bcuoXPE.exe
  C:\Windows\System\bcuoXPE.exe
  2⤵
  PID:3388
- C:\Windows\System\BLxjEBj.exe
  C:\Windows\System\BLxjEBj.exe
  2⤵
  PID:2824
- C:\Windows\System\bVFEBvx.exe
  C:\Windows\System\bVFEBvx.exe
  2⤵
  PID:4212
- C:\Windows\System\YjfGsqH.exe
  C:\Windows\System\YjfGsqH.exe
  2⤵
  PID:4196
- C:\Windows\System\EpXjqjg.exe
  C:\Windows\System\EpXjqjg.exe
  2⤵
  PID:3152
- C:\Windows\System\LNGRQgA.exe
  C:\Windows\System\LNGRQgA.exe
  2⤵
  PID:1584
- C:\Windows\System\inSxqPm.exe
  C:\Windows\System\inSxqPm.exe
  2⤵
  PID:3984
- C:\Windows\System\LMLizXv.exe
  C:\Windows\System\LMLizXv.exe
  2⤵
  PID:4456
- C:\Windows\System\bbdXdGh.exe
  C:\Windows\System\bbdXdGh.exe
  2⤵
  PID:4508
- C:\Windows\System\RkZDRxA.exe
  C:\Windows\System\RkZDRxA.exe
  2⤵
  PID:4044
- C:\Windows\System\TJAofko.exe
  C:\Windows\System\TJAofko.exe
  2⤵
  PID:3372
- C:\Windows\System\MxKtJlS.exe
  C:\Windows\System\MxKtJlS.exe
  2⤵
  PID:4532
- C:\Windows\System\qzvQOKl.exe
  C:\Windows\System\qzvQOKl.exe
  2⤵
  PID:5028
- C:\Windows\System\sNMsdJS.exe
  C:\Windows\System\sNMsdJS.exe
  2⤵
  PID:4092
- C:\Windows\System\ltCWPjq.exe
  C:\Windows\System\ltCWPjq.exe
  2⤵
  PID:4256
- C:\Windows\System\gzaMRIG.exe
  C:\Windows\System\gzaMRIG.exe
  2⤵
  PID:4484
- C:\Windows\System\DhGtXRF.exe
  C:\Windows\System\DhGtXRF.exe
  2⤵
  PID:3584
- C:\Windows\System\HyGKYdv.exe
  C:\Windows\System\HyGKYdv.exe
  2⤵
  PID:4292
- C:\Windows\System\JKkDaqN.exe
  C:\Windows\System\JKkDaqN.exe
  2⤵
  PID:2692
- C:\Windows\System\FPLvrqQ.exe
  C:\Windows\System\FPLvrqQ.exe
  2⤵
  PID:3220
- C:\Windows\System\zSjgayU.exe
  C:\Windows\System\zSjgayU.exe
  2⤵
  PID:4556
- C:\Windows\System\SnASvhw.exe
  C:\Windows\System\SnASvhw.exe
  2⤵
  PID:4552
- C:\Windows\System\LvIhVLM.exe
  C:\Windows\System\LvIhVLM.exe
  2⤵
  PID:4660
- C:\Windows\System\iQQaITu.exe
  C:\Windows\System\iQQaITu.exe
  2⤵
  PID:4624
- C:\Windows\System\mKpIBbo.exe
  C:\Windows\System\mKpIBbo.exe
  2⤵
  PID:4724
- C:\Windows\System\CIzgoMr.exe
  C:\Windows\System\CIzgoMr.exe
  2⤵
  PID:4644
- C:\Windows\System\zOwwXHH.exe
  C:\Windows\System\zOwwXHH.exe
  2⤵
  PID:4784
- C:\Windows\System\YfAyPIj.exe
  C:\Windows\System\YfAyPIj.exe
  2⤵
  PID:4896
- C:\Windows\System\HmLryIs.exe
  C:\Windows\System\HmLryIs.exe
  2⤵
  PID:4952
- C:\Windows\System\AuGjwaV.exe
  C:\Windows\System\AuGjwaV.exe
  2⤵
  PID:4948
- C:\Windows\System\CDdZcXH.exe
  C:\Windows\System\CDdZcXH.exe
  2⤵
  PID:3384
- C:\Windows\System\SdcdewT.exe
  C:\Windows\System\SdcdewT.exe
  2⤵
  PID:3944
- C:\Windows\System\nLaXZPD.exe
  C:\Windows\System\nLaXZPD.exe
  2⤵
  PID:4180
- C:\Windows\System\bzdaBqu.exe
  C:\Windows\System\bzdaBqu.exe
  2⤵
  PID:804
- C:\Windows\System\fxCVzjc.exe
  C:\Windows\System\fxCVzjc.exe
  2⤵
  PID:3980
- C:\Windows\System\hqIQSmQ.exe
  C:\Windows\System\hqIQSmQ.exe
  2⤵
  PID:3960
- C:\Windows\System\eNFzniS.exe
  C:\Windows\System\eNFzniS.exe
  2⤵
  PID:4412
- C:\Windows\System\MeDnurr.exe
  C:\Windows\System\MeDnurr.exe
  2⤵
  PID:1796
- C:\Windows\System\UwFEaEf.exe
  C:\Windows\System\UwFEaEf.exe
  2⤵
  PID:4100
- C:\Windows\System\GalBRQA.exe
  C:\Windows\System\GalBRQA.exe
  2⤵
  PID:5096
- C:\Windows\System\BfkzoYX.exe
  C:\Windows\System\BfkzoYX.exe
  2⤵
  PID:4656
- C:\Windows\System\IUCObCO.exe
  C:\Windows\System\IUCObCO.exe
  2⤵
  PID:4380
- C:\Windows\System\QfzbscE.exe
  C:\Windows\System\QfzbscE.exe
  2⤵
  PID:4588
- C:\Windows\System\ECCPqZM.exe
  C:\Windows\System\ECCPqZM.exe
  2⤵
  PID:4732
- C:\Windows\System\gDrWJRI.exe
  C:\Windows\System\gDrWJRI.exe
  2⤵
  PID:4864
- C:\Windows\System\erramsC.exe
  C:\Windows\System\erramsC.exe
  2⤵
  PID:4576
- C:\Windows\System\krYPHfW.exe
  C:\Windows\System\krYPHfW.exe
  2⤵
  PID:4908
- C:\Windows\System\HQJakUn.exe
  C:\Windows\System\HQJakUn.exe
  2⤵
  PID:4744
- C:\Windows\System\vnKfAeH.exe
  C:\Windows\System\vnKfAeH.exe
  2⤵
  PID:3404
- C:\Windows\System\utbigdj.exe
  C:\Windows\System\utbigdj.exe
  2⤵
  PID:2400
- C:\Windows\System\SWajAki.exe
  C:\Windows\System\SWajAki.exe
  2⤵
  PID:2568
- C:\Windows\System\SEPXUpC.exe
  C:\Windows\System\SEPXUpC.exe
  2⤵
  PID:4828
- C:\Windows\System\LzHemHQ.exe
  C:\Windows\System\LzHemHQ.exe
  2⤵
  PID:4284
- C:\Windows\System\nODmzTl.exe
  C:\Windows\System\nODmzTl.exe
  2⤵
  PID:5012
- C:\Windows\System\WpClBGc.exe
  C:\Windows\System\WpClBGc.exe
  2⤵
  PID:4984
- C:\Windows\System\kRWJDkD.exe
  C:\Windows\System\kRWJDkD.exe
  2⤵
  PID:4048
- C:\Windows\System\POhfJRI.exe
  C:\Windows\System\POhfJRI.exe
  2⤵
  PID:5044
- C:\Windows\System\XCwjzJe.exe
  C:\Windows\System\XCwjzJe.exe
  2⤵
  PID:4916
- C:\Windows\System\bVvrdET.exe
  C:\Windows\System\bVvrdET.exe
  2⤵
  PID:4560
- C:\Windows\System\jQaKUiZ.exe
  C:\Windows\System\jQaKUiZ.exe
  2⤵
  PID:3492
- C:\Windows\System\eeeSEQW.exe
  C:\Windows\System\eeeSEQW.exe
  2⤵
  PID:3200
- C:\Windows\System\hJzdHTI.exe
  C:\Windows\System\hJzdHTI.exe
  2⤵
  PID:3432
- C:\Windows\System\yqLnjeb.exe
  C:\Windows\System\yqLnjeb.exe
  2⤵
  PID:3948
- C:\Windows\System\zCLSmTY.exe
  C:\Windows\System\zCLSmTY.exe
  2⤵
  PID:5136
- C:\Windows\System\YhJaRmm.exe
  C:\Windows\System\YhJaRmm.exe
  2⤵
  PID:5152
- C:\Windows\System\IRcPNuQ.exe
  C:\Windows\System\IRcPNuQ.exe
  2⤵
  PID:5168
- C:\Windows\System\xlcmseL.exe
  C:\Windows\System\xlcmseL.exe
  2⤵
  PID:5184
- C:\Windows\System\mQSRhrk.exe
  C:\Windows\System\mQSRhrk.exe
  2⤵
  PID:5200
- C:\Windows\System\bAHVkpF.exe
  C:\Windows\System\bAHVkpF.exe
  2⤵
  PID:5216
- C:\Windows\System\BUVqMKE.exe
  C:\Windows\System\BUVqMKE.exe
  2⤵
  PID:5232
- C:\Windows\System\oBanwTv.exe
  C:\Windows\System\oBanwTv.exe
  2⤵
  PID:5248
- C:\Windows\System\mgBcwzg.exe
  C:\Windows\System\mgBcwzg.exe
  2⤵
  PID:5264
- C:\Windows\System\NkbXbbp.exe
  C:\Windows\System\NkbXbbp.exe
  2⤵
  PID:5280
- C:\Windows\System\dyrzxPi.exe
  C:\Windows\System\dyrzxPi.exe
  2⤵
  PID:5296
- C:\Windows\System\PtsjatG.exe
  C:\Windows\System\PtsjatG.exe
  2⤵
  PID:5312
- C:\Windows\System\UAPTqRH.exe
  C:\Windows\System\UAPTqRH.exe
  2⤵
  PID:5328
- C:\Windows\System\yLCbEHK.exe
  C:\Windows\System\yLCbEHK.exe
  2⤵
  PID:5344
- C:\Windows\System\lbcVNbW.exe
  C:\Windows\System\lbcVNbW.exe
  2⤵
  PID:5360
- C:\Windows\System\EnPVxDN.exe
  C:\Windows\System\EnPVxDN.exe
  2⤵
  PID:5376
- C:\Windows\System\iUSsQDi.exe
  C:\Windows\System\iUSsQDi.exe
  2⤵
  PID:5392
- C:\Windows\System\fqWSASj.exe
  C:\Windows\System\fqWSASj.exe
  2⤵
  PID:5420
- C:\Windows\System\RTRxJnK.exe
  C:\Windows\System\RTRxJnK.exe
  2⤵
  PID:5436
- C:\Windows\System\PFRFekk.exe
  C:\Windows\System\PFRFekk.exe
  2⤵
  PID:5452
- C:\Windows\System\nRzncDr.exe
  C:\Windows\System\nRzncDr.exe
  2⤵
  PID:5468
- C:\Windows\System\HMIxFaD.exe
  C:\Windows\System\HMIxFaD.exe
  2⤵
  PID:5484
- C:\Windows\System\QMBpsLS.exe
  C:\Windows\System\QMBpsLS.exe
  2⤵
  PID:5500
- C:\Windows\System\SQRxgLv.exe
  C:\Windows\System\SQRxgLv.exe
  2⤵
  PID:5516
- C:\Windows\System\tMcrexl.exe
  C:\Windows\System\tMcrexl.exe
  2⤵
  PID:5532
- C:\Windows\System\wxTxqgi.exe
  C:\Windows\System\wxTxqgi.exe
  2⤵
  PID:5548
- C:\Windows\System\SdnMlEn.exe
  C:\Windows\System\SdnMlEn.exe
  2⤵
  PID:5564
- C:\Windows\System\SOtbeRy.exe
  C:\Windows\System\SOtbeRy.exe
  2⤵
  PID:5580
- C:\Windows\System\zlGVgzA.exe
  C:\Windows\System\zlGVgzA.exe
  2⤵
  PID:5596
- C:\Windows\System\MjZHZLM.exe
  C:\Windows\System\MjZHZLM.exe
  2⤵
  PID:5612
- C:\Windows\System\uPEsWGo.exe
  C:\Windows\System\uPEsWGo.exe
  2⤵
  PID:5628
- C:\Windows\System\NBcFGzA.exe
  C:\Windows\System\NBcFGzA.exe
  2⤵
  PID:5644
- C:\Windows\System\LNBwkpo.exe
  C:\Windows\System\LNBwkpo.exe
  2⤵
  PID:5660
- C:\Windows\System\PKbfHVI.exe
  C:\Windows\System\PKbfHVI.exe
  2⤵
  PID:5676
- C:\Windows\System\KtuufnX.exe
  C:\Windows\System\KtuufnX.exe
  2⤵
  PID:5692
- C:\Windows\System\rZWZWQM.exe
  C:\Windows\System\rZWZWQM.exe
  2⤵
  PID:5708
- C:\Windows\System\wjGrpNW.exe
  C:\Windows\System\wjGrpNW.exe
  2⤵
  PID:5724
- C:\Windows\System\wdtmtBN.exe
  C:\Windows\System\wdtmtBN.exe
  2⤵
  PID:5740
- C:\Windows\System\VjRGdgq.exe
  C:\Windows\System\VjRGdgq.exe
  2⤵
  PID:5756
- C:\Windows\System\dZmMUXe.exe
  C:\Windows\System\dZmMUXe.exe
  2⤵
  PID:5772
- C:\Windows\System\HDAcyug.exe
  C:\Windows\System\HDAcyug.exe
  2⤵
  PID:5788
- C:\Windows\System\kRFYEBk.exe
  C:\Windows\System\kRFYEBk.exe
  2⤵
  PID:5804
- C:\Windows\System\SPNknKO.exe
  C:\Windows\System\SPNknKO.exe
  2⤵
  PID:5820
- C:\Windows\System\FrKjBVu.exe
  C:\Windows\System\FrKjBVu.exe
  2⤵
  PID:5836
- C:\Windows\System\wLNdzRL.exe
  C:\Windows\System\wLNdzRL.exe
  2⤵
  PID:5860
- C:\Windows\System\wadRPSN.exe
  C:\Windows\System\wadRPSN.exe
  2⤵
  PID:5876
- C:\Windows\System\otKYhHL.exe
  C:\Windows\System\otKYhHL.exe
  2⤵
  PID:5892
- C:\Windows\System\dVVqXAy.exe
  C:\Windows\System\dVVqXAy.exe
  2⤵
  PID:5908
- C:\Windows\System\dhodgff.exe
  C:\Windows\System\dhodgff.exe
  2⤵
  PID:5924
- C:\Windows\System\aLnrFCd.exe
  C:\Windows\System\aLnrFCd.exe
  2⤵
  PID:5944
- C:\Windows\System\cBQVeDS.exe
  C:\Windows\System\cBQVeDS.exe
  2⤵
  PID:5960
- C:\Windows\System\evAnncb.exe
  C:\Windows\System\evAnncb.exe
  2⤵
  PID:5976
- C:\Windows\System\GSXbcrh.exe
  C:\Windows\System\GSXbcrh.exe
  2⤵
  PID:5992
- C:\Windows\System\cqoEAkZ.exe
  C:\Windows\System\cqoEAkZ.exe
  2⤵
  PID:6008
- C:\Windows\System\QuKAfpi.exe
  C:\Windows\System\QuKAfpi.exe
  2⤵
  PID:6024
- C:\Windows\System\RQNPwEm.exe
  C:\Windows\System\RQNPwEm.exe
  2⤵
  PID:6040
- C:\Windows\System\FRWkgox.exe
  C:\Windows\System\FRWkgox.exe
  2⤵
  PID:6056
- C:\Windows\System\ChnxpXO.exe
  C:\Windows\System\ChnxpXO.exe
  2⤵
  PID:6072
- C:\Windows\System\KtBVcvP.exe
  C:\Windows\System\KtBVcvP.exe
  2⤵
  PID:6088
- C:\Windows\System\bgeciyS.exe
  C:\Windows\System\bgeciyS.exe
  2⤵
  PID:6104
- C:\Windows\System\VBxwRkt.exe
  C:\Windows\System\VBxwRkt.exe
  2⤵
  PID:6120
- C:\Windows\System\sVXlpzW.exe
  C:\Windows\System\sVXlpzW.exe
  2⤵
  PID:6136
- C:\Windows\System\ZCBakHd.exe
  C:\Windows\System\ZCBakHd.exe
  2⤵
  PID:5144
- C:\Windows\System\vdRkXqh.exe
  C:\Windows\System\vdRkXqh.exe
  2⤵
  PID:5148
- C:\Windows\System\dCGzqrs.exe
  C:\Windows\System\dCGzqrs.exe
  2⤵
  PID:5240
- C:\Windows\System\sqpMfay.exe
  C:\Windows\System\sqpMfay.exe
  2⤵
  PID:5304
- C:\Windows\System\bCMrYge.exe
  C:\Windows\System\bCMrYge.exe
  2⤵
  PID:5336
- C:\Windows\System\DmZAqlL.exe
  C:\Windows\System\DmZAqlL.exe
  2⤵
  PID:5400
- C:\Windows\System\bJVpXnL.exe
  C:\Windows\System\bJVpXnL.exe
  2⤵
  PID:5256
- C:\Windows\System\nsANBni.exe
  C:\Windows\System\nsANBni.exe
  2⤵
  PID:5128
- C:\Windows\System\hoZgPaG.exe
  C:\Windows\System\hoZgPaG.exe
  2⤵
  PID:5164
- C:\Windows\System\xIBBqUl.exe
  C:\Windows\System\xIBBqUl.exe
  2⤵
  PID:5228
- C:\Windows\System\dWlEMfO.exe
  C:\Windows\System\dWlEMfO.exe
  2⤵
  PID:5324
- C:\Windows\System\mGgFwyX.exe
  C:\Windows\System\mGgFwyX.exe
  2⤵
  PID:5388
- C:\Windows\System\KDvXAqT.exe
  C:\Windows\System\KDvXAqT.exe
  2⤵
  PID:5416
- C:\Windows\System\bceKNnw.exe
  C:\Windows\System\bceKNnw.exe
  2⤵
  PID:5480
- C:\Windows\System\zuoLIYl.exe
  C:\Windows\System\zuoLIYl.exe
  2⤵
  PID:5544
- C:\Windows\System\DNGaEHq.exe
  C:\Windows\System\DNGaEHq.exe
  2⤵
  PID:5608
- C:\Windows\System\UVXMmLr.exe
  C:\Windows\System\UVXMmLr.exe
  2⤵
  PID:5672
- C:\Windows\System\XEFBfpd.exe
  C:\Windows\System\XEFBfpd.exe
  2⤵
  PID:5732
- C:\Windows\System\ggQGZOS.exe
  C:\Windows\System\ggQGZOS.exe
  2⤵
  PID:5560
- C:\Windows\System\VgpFKVP.exe
  C:\Windows\System\VgpFKVP.exe
  2⤵
  PID:5768
- C:\Windows\System\UulTAWo.exe
  C:\Windows\System\UulTAWo.exe
  2⤵
  PID:5492
- C:\Windows\System\ZvfXIRD.exe
  C:\Windows\System\ZvfXIRD.exe
  2⤵
  PID:5652
- C:\Windows\System\vnDwuSw.exe
  C:\Windows\System\vnDwuSw.exe
  2⤵
  PID:5624
- C:\Windows\System\DULBqaG.exe
  C:\Windows\System\DULBqaG.exe
  2⤵
  PID:5748
- C:\Windows\System\xOWyVom.exe
  C:\Windows\System\xOWyVom.exe
  2⤵
  PID:5800
- C:\Windows\System\rEeiwdD.exe
  C:\Windows\System\rEeiwdD.exe
  2⤵
  PID:5832
- C:\Windows\System\ARhUTvh.exe
  C:\Windows\System\ARhUTvh.exe
  2⤵
  PID:5868
- C:\Windows\System\FvNYgqJ.exe
  C:\Windows\System\FvNYgqJ.exe
  2⤵
  PID:5932
- C:\Windows\System\DuoTQFL.exe
  C:\Windows\System\DuoTQFL.exe
  2⤵
  PID:5972
- C:\Windows\System\KzjsAsd.exe
  C:\Windows\System\KzjsAsd.exe
  2⤵
  PID:6036
- C:\Windows\System\NUvJgga.exe
  C:\Windows\System\NUvJgga.exe
  2⤵
  PID:5988
- C:\Windows\System\GNomvLQ.exe
  C:\Windows\System\GNomvLQ.exe
  2⤵
  PID:6100
- C:\Windows\System\TEKCivC.exe
  C:\Windows\System\TEKCivC.exe
  2⤵
  PID:5920
- C:\Windows\System\zYSTEkW.exe
  C:\Windows\System\zYSTEkW.exe
  2⤵
  PID:6052
- C:\Windows\System\pEDZtlt.exe
  C:\Windows\System\pEDZtlt.exe
  2⤵
  PID:6020
- C:\Windows\System\HZFpWhP.exe
  C:\Windows\System\HZFpWhP.exe
  2⤵
  PID:6048
- C:\Windows\System\WgZpgEk.exe
  C:\Windows\System\WgZpgEk.exe
  2⤵
  PID:6084
- C:\Windows\System\QgsAzBm.exe
  C:\Windows\System\QgsAzBm.exe
  2⤵
  PID:5368
- C:\Windows\System\ispchhP.exe
  C:\Windows\System\ispchhP.exe
  2⤵
  PID:5092
- C:\Windows\System\SKHYhFk.exe
  C:\Windows\System\SKHYhFk.exe
  2⤵
  PID:5408
- C:\Windows\System\gJGemjX.exe
  C:\Windows\System\gJGemjX.exe
  2⤵
  PID:4572
- C:\Windows\System\pFbCWzX.exe
  C:\Windows\System\pFbCWzX.exe
  2⤵
  PID:5448
- C:\Windows\System\kOwixsf.exe
  C:\Windows\System\kOwixsf.exe
  2⤵
  PID:5704
- C:\Windows\System\SjKeotG.exe
  C:\Windows\System\SjKeotG.exe
  2⤵
  PID:5432
- C:\Windows\System\KNOhxji.exe
  C:\Windows\System\KNOhxji.exe
  2⤵
  PID:5764
- C:\Windows\System\ydnxRXY.exe
  C:\Windows\System\ydnxRXY.exe
  2⤵
  PID:5592
- C:\Windows\System\yTAfFuY.exe
  C:\Windows\System\yTAfFuY.exe
  2⤵
  PID:5784
- C:\Windows\System\xTZmpHm.exe
  C:\Windows\System\xTZmpHm.exe
  2⤵
  PID:5968
- C:\Windows\System\QHBbVsm.exe
  C:\Windows\System\QHBbVsm.exe
  2⤵
  PID:5716
- C:\Windows\System\VSaDgnb.exe
  C:\Windows\System\VSaDgnb.exe
  2⤵
  PID:5904
- C:\Windows\System\sMYDjXG.exe
  C:\Windows\System\sMYDjXG.exe
  2⤵
  PID:5900
- C:\Windows\System\wWcVXIU.exe
  C:\Windows\System\wWcVXIU.exe
  2⤵
  PID:5720
- C:\Windows\System\cHUiqqE.exe
  C:\Windows\System\cHUiqqE.exe
  2⤵
  PID:5208
- C:\Windows\System\rxzCJPw.exe
  C:\Windows\System\rxzCJPw.exe
  2⤵
  PID:5620
- C:\Windows\System\vsqpHPH.exe
  C:\Windows\System\vsqpHPH.exe
  2⤵
  PID:6096
- C:\Windows\System\zrQStOC.exe
  C:\Windows\System\zrQStOC.exe
  2⤵
  PID:5588
- C:\Windows\System\sZdrZAx.exe
  C:\Windows\System\sZdrZAx.exe
  2⤵
  PID:6016
- C:\Windows\System\diwrEBG.exe
  C:\Windows\System\diwrEBG.exe
  2⤵
  PID:4944
- C:\Windows\System\PUkeAYi.exe
  C:\Windows\System\PUkeAYi.exe
  2⤵
  PID:1948
- C:\Windows\System\cAptNKi.exe
  C:\Windows\System\cAptNKi.exe
  2⤵
  PID:4368
- C:\Windows\System\CCzyCmB.exe
  C:\Windows\System\CCzyCmB.exe
  2⤵
  PID:5196
- C:\Windows\System\bsoWRFZ.exe
  C:\Windows\System\bsoWRFZ.exe
  2⤵
  PID:5224
- C:\Windows\System\eGMfisn.exe
  C:\Windows\System\eGMfisn.exe
  2⤵
  PID:6148
- C:\Windows\System\DTdUwLm.exe
  C:\Windows\System\DTdUwLm.exe
  2⤵
  PID:6164
- C:\Windows\System\HHfRiez.exe
  C:\Windows\System\HHfRiez.exe
  2⤵
  PID:6184
- C:\Windows\System\KjvaMpv.exe
  C:\Windows\System\KjvaMpv.exe
  2⤵
  PID:6200
- C:\Windows\System\bzbEYPd.exe
  C:\Windows\System\bzbEYPd.exe
  2⤵
  PID:6216
- C:\Windows\System\zLjoLFn.exe
  C:\Windows\System\zLjoLFn.exe
  2⤵
  PID:6232
- C:\Windows\System\UYxFqRX.exe
  C:\Windows\System\UYxFqRX.exe
  2⤵
  PID:6248
- C:\Windows\System\WWQVmgA.exe
  C:\Windows\System\WWQVmgA.exe
  2⤵
  PID:6264
- C:\Windows\System\KebaFEo.exe
  C:\Windows\System\KebaFEo.exe
  2⤵
  PID:6280
- C:\Windows\System\QvvNFZz.exe
  C:\Windows\System\QvvNFZz.exe
  2⤵
  PID:6296
- C:\Windows\System\PDgPYkJ.exe
  C:\Windows\System\PDgPYkJ.exe
  2⤵
  PID:6312
- C:\Windows\System\suQVRkd.exe
  C:\Windows\System\suQVRkd.exe
  2⤵
  PID:6328
- C:\Windows\System\tSOMPrP.exe
  C:\Windows\System\tSOMPrP.exe
  2⤵
  PID:6344
- C:\Windows\System\uQQzLTu.exe
  C:\Windows\System\uQQzLTu.exe
  2⤵
  PID:6360
- C:\Windows\System\wJpBSZF.exe
  C:\Windows\System\wJpBSZF.exe
  2⤵
  PID:6376
- C:\Windows\System\IBZwSMC.exe
  C:\Windows\System\IBZwSMC.exe
  2⤵
  PID:6392
- C:\Windows\System\ttloukR.exe
  C:\Windows\System\ttloukR.exe
  2⤵
  PID:6408
- C:\Windows\System\oJdHOAT.exe
  C:\Windows\System\oJdHOAT.exe
  2⤵
  PID:6424
- C:\Windows\System\RclgcZL.exe
  C:\Windows\System\RclgcZL.exe
  2⤵
  PID:6440
- C:\Windows\System\PyuDmpc.exe
  C:\Windows\System\PyuDmpc.exe
  2⤵
  PID:6460
- C:\Windows\System\TOPIFql.exe
  C:\Windows\System\TOPIFql.exe
  2⤵
  PID:6476
- C:\Windows\System\PFIxxfd.exe
  C:\Windows\System\PFIxxfd.exe
  2⤵
  PID:6496
- C:\Windows\System\vzrlRcy.exe
  C:\Windows\System\vzrlRcy.exe
  2⤵
  PID:6528
- C:\Windows\System\IGXPZue.exe
  C:\Windows\System\IGXPZue.exe
  2⤵
  PID:6544
- C:\Windows\System\GZavUDi.exe
  C:\Windows\System\GZavUDi.exe
  2⤵
  PID:6560
- C:\Windows\System\wuvMiqV.exe
  C:\Windows\System\wuvMiqV.exe
  2⤵
  PID:6576
- C:\Windows\System\cDnzCag.exe
  C:\Windows\System\cDnzCag.exe
  2⤵
  PID:6592
- C:\Windows\System\vdzUMxe.exe
  C:\Windows\System\vdzUMxe.exe
  2⤵
  PID:6608
- C:\Windows\System\MZvXedM.exe
  C:\Windows\System\MZvXedM.exe
  2⤵
  PID:6628
- C:\Windows\System\sqKEDvq.exe
  C:\Windows\System\sqKEDvq.exe
  2⤵
  PID:6644
- C:\Windows\System\lMraSKi.exe
  C:\Windows\System\lMraSKi.exe
  2⤵
  PID:6660
- C:\Windows\System\SnDZReM.exe
  C:\Windows\System\SnDZReM.exe
  2⤵
  PID:6676
- C:\Windows\System\VHMnuXC.exe
  C:\Windows\System\VHMnuXC.exe
  2⤵
  PID:6692
- C:\Windows\System\RKNwfjH.exe
  C:\Windows\System\RKNwfjH.exe
  2⤵
  PID:6712
- C:\Windows\System\KmDJqzA.exe
  C:\Windows\System\KmDJqzA.exe
  2⤵
  PID:6728
- C:\Windows\System\TrUVjcS.exe
  C:\Windows\System\TrUVjcS.exe
  2⤵
  PID:6744
- C:\Windows\System\jYqShdN.exe
  C:\Windows\System\jYqShdN.exe
  2⤵
  PID:6760
- C:\Windows\System\UJxLRnX.exe
  C:\Windows\System\UJxLRnX.exe
  2⤵
  PID:6776
- C:\Windows\System\ryJPHGZ.exe
  C:\Windows\System\ryJPHGZ.exe
  2⤵
  PID:6792
- C:\Windows\System\RlHaLiQ.exe
  C:\Windows\System\RlHaLiQ.exe
  2⤵
  PID:6808
- C:\Windows\System\fqvGlkQ.exe
  C:\Windows\System\fqvGlkQ.exe
  2⤵
  PID:6824
- C:\Windows\System\hmTJctu.exe
  C:\Windows\System\hmTJctu.exe
  2⤵
  PID:6840
- C:\Windows\System\amGUasF.exe
  C:\Windows\System\amGUasF.exe
  2⤵
  PID:6856
- C:\Windows\System\YuAgGOe.exe
  C:\Windows\System\YuAgGOe.exe
  2⤵
  PID:6872
- C:\Windows\System\DfGHOqG.exe
  C:\Windows\System\DfGHOqG.exe
  2⤵
  PID:6888
- C:\Windows\System\jdnhZje.exe
  C:\Windows\System\jdnhZje.exe
  2⤵
  PID:6904
- C:\Windows\System\iEsdSYV.exe
  C:\Windows\System\iEsdSYV.exe
  2⤵
  PID:6920
- C:\Windows\System\vZtSnka.exe
  C:\Windows\System\vZtSnka.exe
  2⤵
  PID:6936
- C:\Windows\System\vsXfgWb.exe
  C:\Windows\System\vsXfgWb.exe
  2⤵
  PID:6952
- C:\Windows\System\byybRLO.exe
  C:\Windows\System\byybRLO.exe
  2⤵
  PID:6968
- C:\Windows\System\XCTglbe.exe
  C:\Windows\System\XCTglbe.exe
  2⤵
  PID:6984
- C:\Windows\System\rsjdxQy.exe
  C:\Windows\System\rsjdxQy.exe
  2⤵
  PID:7000
- C:\Windows\System\rxLBIiq.exe
  C:\Windows\System\rxLBIiq.exe
  2⤵
  PID:7016
- C:\Windows\System\hlVzmtw.exe
  C:\Windows\System\hlVzmtw.exe
  2⤵
  PID:7032
- C:\Windows\System\bjQXJMK.exe
  C:\Windows\System\bjQXJMK.exe
  2⤵
  PID:7048
- C:\Windows\System\EukwJyU.exe
  C:\Windows\System\EukwJyU.exe
  2⤵
  PID:7064
- C:\Windows\System\EiFoYpy.exe
  C:\Windows\System\EiFoYpy.exe
  2⤵
  PID:7084
- C:\Windows\System\OedvZUi.exe
  C:\Windows\System\OedvZUi.exe
  2⤵
  PID:6304
- C:\Windows\System\bREeiae.exe
  C:\Windows\System\bREeiae.exe
  2⤵
  PID:6368
- C:\Windows\System\UZTvYVH.exe
  C:\Windows\System\UZTvYVH.exe
  2⤵
  PID:6432
- C:\Windows\System\RYnrngH.exe
  C:\Windows\System\RYnrngH.exe
  2⤵
  PID:5940
- C:\Windows\System\ADSpmYk.exe
  C:\Windows\System\ADSpmYk.exe
  2⤵
  PID:5276
- C:\Windows\System\iCHiYNq.exe
  C:\Windows\System\iCHiYNq.exe
  2⤵
  PID:5320
- C:\Windows\System\vzmiTcf.exe
  C:\Windows\System\vzmiTcf.exe
  2⤵
  PID:6224
- C:\Windows\System\uzWycTG.exe
  C:\Windows\System\uzWycTG.exe
  2⤵
  PID:6288
- C:\Windows\System\lqIVxPJ.exe
  C:\Windows\System\lqIVxPJ.exe
  2⤵
  PID:6352
- C:\Windows\System\sQQlEuK.exe
  C:\Windows\System\sQQlEuK.exe
  2⤵
  PID:6416
- C:\Windows\System\UeZVFls.exe
  C:\Windows\System\UeZVFls.exe
  2⤵
  PID:6456
- C:\Windows\System\hvlZBMp.exe
  C:\Windows\System\hvlZBMp.exe
  2⤵
  PID:6536
- C:\Windows\System\sleNeXO.exe
  C:\Windows\System\sleNeXO.exe
  2⤵
  PID:6504
- C:\Windows\System\lZJXTPw.exe
  C:\Windows\System\lZJXTPw.exe
  2⤵
  PID:6516
- C:\Windows\System\ZxUhdcU.exe
  C:\Windows\System\ZxUhdcU.exe
  2⤵
  PID:6568
- C:\Windows\System\YroMPcD.exe
  C:\Windows\System\YroMPcD.exe
  2⤵
  PID:6616
- C:\Windows\System\JzUwrrz.exe
  C:\Windows\System\JzUwrrz.exe
  2⤵
  PID:6640
- C:\Windows\System\ZjmnxUm.exe
  C:\Windows\System\ZjmnxUm.exe
  2⤵
  PID:6700
- C:\Windows\System\CJWKRlW.exe
  C:\Windows\System\CJWKRlW.exe
  2⤵
  PID:6768
- C:\Windows\System\xopXEMA.exe
  C:\Windows\System\xopXEMA.exe
  2⤵
  PID:6720
- C:\Windows\System\sCNPiCv.exe
  C:\Windows\System\sCNPiCv.exe
  2⤵
  PID:6788
- C:\Windows\System\KSMzuIC.exe
  C:\Windows\System\KSMzuIC.exe
  2⤵
  PID:6836
- C:\Windows\System\esuVlSj.exe
  C:\Windows\System\esuVlSj.exe
  2⤵
  PID:6848
- C:\Windows\System\pcCbFHS.exe
  C:\Windows\System\pcCbFHS.exe
  2⤵
  PID:6992
- C:\Windows\System\GjdbgdP.exe
  C:\Windows\System\GjdbgdP.exe
  2⤵
  PID:6928
- C:\Windows\System\CinpDBo.exe
  C:\Windows\System\CinpDBo.exe
  2⤵
  PID:6864
- C:\Windows\System\DwLRhbc.exe
  C:\Windows\System\DwLRhbc.exe
  2⤵
  PID:6884
- C:\Windows\System\LPwlAlk.exe
  C:\Windows\System\LPwlAlk.exe
  2⤵
  PID:6948
- C:\Windows\System\qSWbbrF.exe
  C:\Windows\System\qSWbbrF.exe
  2⤵
  PID:7044
- C:\Windows\System\zyTtiTU.exe
  C:\Windows\System\zyTtiTU.exe
  2⤵
  PID:7080
- C:\Windows\System\YsxvlMr.exe
  C:\Windows\System\YsxvlMr.exe
  2⤵
  PID:7124
- C:\Windows\System\gPIWreu.exe
  C:\Windows\System\gPIWreu.exe
  2⤵
  PID:7108
- C:\Windows\System\VmdjxaX.exe
  C:\Windows\System\VmdjxaX.exe
  2⤵
  PID:7140
- C:\Windows\System\edzxpPL.exe
  C:\Windows\System\edzxpPL.exe
  2⤵
  PID:6820
- C:\Windows\System\iKUEJvJ.exe
  C:\Windows\System\iKUEJvJ.exe
  2⤵
  PID:6740
- C:\Windows\System\tPUuDIO.exe
  C:\Windows\System\tPUuDIO.exe
  2⤵
  PID:6624
- C:\Windows\System\iKfpqRY.exe
  C:\Windows\System\iKfpqRY.exe
  2⤵
  PID:6524
- C:\Windows\System\QkULHLp.exe
  C:\Windows\System\QkULHLp.exe
  2⤵
  PID:6448
- C:\Windows\System\nMxloNG.exe
  C:\Windows\System\nMxloNG.exe
  2⤵
  PID:6192
- C:\Windows\System\sOUtgkg.exe
  C:\Windows\System\sOUtgkg.exe
  2⤵
  PID:7136
- C:\Windows\System\UcrtWTe.exe
  C:\Windows\System\UcrtWTe.exe
  2⤵
  PID:6508
- C:\Windows\System\cHgtydB.exe
  C:\Windows\System\cHgtydB.exe
  2⤵
  PID:6944
- C:\Windows\System\TWaxrCf.exe
  C:\Windows\System\TWaxrCf.exe
  2⤵
  PID:5272
- C:\Windows\System\arHFjOh.exe
  C:\Windows\System\arHFjOh.exe
  2⤵
  PID:6512
- C:\Windows\System\pISLiDN.exe
  C:\Windows\System\pISLiDN.exe
  2⤵
  PID:6668
- C:\Windows\System\gmUgRPq.exe
  C:\Windows\System\gmUgRPq.exe
  2⤵
  PID:6752
- C:\Windows\System\rkMsVIm.exe
  C:\Windows\System\rkMsVIm.exe
  2⤵
  PID:6868
- C:\Windows\System\WrAdWlz.exe
  C:\Windows\System\WrAdWlz.exe
  2⤵
  PID:7116
- C:\Windows\System\JDBdiWg.exe
  C:\Windows\System\JDBdiWg.exe
  2⤵
  PID:7164
- C:\Windows\System\zEbPwjV.exe
  C:\Windows\System\zEbPwjV.exe
  2⤵
  PID:6212
- C:\Windows\System\VvsjaGe.exe
  C:\Windows\System\VvsjaGe.exe
  2⤵
  PID:6916
- C:\Windows\System\leOfzQA.exe
  C:\Windows\System\leOfzQA.exe
  2⤵
  PID:6160
- C:\Windows\System\nLbCScg.exe
  C:\Windows\System\nLbCScg.exe
  2⤵
  PID:6080
- C:\Windows\System\quMAdhb.exe
  C:\Windows\System\quMAdhb.exe
  2⤵
  PID:6180
- C:\Windows\System\JTxTcWb.exe
  C:\Windows\System\JTxTcWb.exe
  2⤵
  PID:6276
- C:\Windows\System\KJBIDTn.exe
  C:\Windows\System\KJBIDTn.exe
  2⤵
  PID:7040
- C:\Windows\System\GjhHfwp.exe
  C:\Windows\System\GjhHfwp.exe
  2⤵
  PID:6980
- C:\Windows\System\tsNtFcM.exe
  C:\Windows\System\tsNtFcM.exe
  2⤵
  PID:6756
- C:\Windows\System\IaoonnT.exe
  C:\Windows\System\IaoonnT.exe
  2⤵
  PID:6196
- C:\Windows\System\PEyFQaQ.exe
  C:\Windows\System\PEyFQaQ.exe
  2⤵
  PID:6340
- C:\Windows\System\EwpzJMf.exe
  C:\Windows\System\EwpzJMf.exe
  2⤵
  PID:6996
- C:\Windows\System\YRfLXbH.exe
  C:\Windows\System\YRfLXbH.exe
  2⤵
  PID:7100
- C:\Windows\System\GUupIyM.exe
  C:\Windows\System\GUupIyM.exe
  2⤵
  PID:6388
- C:\Windows\System\XUrFxhu.exe
  C:\Windows\System\XUrFxhu.exe
  2⤵
  PID:4288
- C:\Windows\System\iTIrfLW.exe
  C:\Windows\System\iTIrfLW.exe
  2⤵
  PID:6652
- C:\Windows\System\goOTNKM.exe
  C:\Windows\System\goOTNKM.exe
  2⤵
  PID:5384
- C:\Windows\System\ujpdZOB.exe
  C:\Windows\System\ujpdZOB.exe
  2⤵
  PID:6116
- C:\Windows\System\wzxvcsT.exe
  C:\Windows\System\wzxvcsT.exe
  2⤵
  PID:4364
- C:\Windows\System\cKPfnQT.exe
  C:\Windows\System\cKPfnQT.exe
  2⤵
  PID:6880
- C:\Windows\System\qroVAsW.exe
  C:\Windows\System\qroVAsW.exe
  2⤵
  PID:6320
- C:\Windows\System\tDjZgDt.exe
  C:\Windows\System\tDjZgDt.exe
  2⤵
  PID:6492
- C:\Windows\System\MEwPiXO.exe
  C:\Windows\System\MEwPiXO.exe
  2⤵
  PID:6804
- C:\Windows\System\BMpCpPT.exe
  C:\Windows\System\BMpCpPT.exe
  2⤵
  PID:6172
- C:\Windows\System\HelmnJb.exe
  C:\Windows\System\HelmnJb.exe
  2⤵
  PID:6800
- C:\Windows\System\sxidrAS.exe
  C:\Windows\System\sxidrAS.exe
  2⤵
  PID:7184
- C:\Windows\System\tdNAlUI.exe
  C:\Windows\System\tdNAlUI.exe
  2⤵
  PID:7200
- C:\Windows\System\HGEPvqH.exe
  C:\Windows\System\HGEPvqH.exe
  2⤵
  PID:7216
- C:\Windows\System\eYaAuMc.exe
  C:\Windows\System\eYaAuMc.exe
  2⤵
  PID:7236
- C:\Windows\System\FpOsHDM.exe
  C:\Windows\System\FpOsHDM.exe
  2⤵
  PID:7252
- C:\Windows\System\hNmbqav.exe
  C:\Windows\System\hNmbqav.exe
  2⤵
  PID:7268
- C:\Windows\System\baKGQxP.exe
  C:\Windows\System\baKGQxP.exe
  2⤵
  PID:7284
- C:\Windows\System\EfkQzid.exe
  C:\Windows\System\EfkQzid.exe
  2⤵
  PID:7300
- C:\Windows\System\KjhoRdF.exe
  C:\Windows\System\KjhoRdF.exe
  2⤵
  PID:7316
- C:\Windows\System\WFdZEsY.exe
  C:\Windows\System\WFdZEsY.exe
  2⤵
  PID:7344
- C:\Windows\System\gcZYOIW.exe
  C:\Windows\System\gcZYOIW.exe
  2⤵
  PID:7360
- C:\Windows\System\dVRcJDq.exe
  C:\Windows\System\dVRcJDq.exe
  2⤵
  PID:7376
- C:\Windows\System\UKFlfok.exe
  C:\Windows\System\UKFlfok.exe
  2⤵
  PID:7588
- C:\Windows\System\MseaVcp.exe
  C:\Windows\System\MseaVcp.exe
  2⤵
  PID:7604
- C:\Windows\System\tLHvHuO.exe
  C:\Windows\System\tLHvHuO.exe
  2⤵
  PID:7620
- C:\Windows\System\hBJjicq.exe
  C:\Windows\System\hBJjicq.exe
  2⤵
  PID:7636
- C:\Windows\System\NyLEhUJ.exe
  C:\Windows\System\NyLEhUJ.exe
  2⤵
  PID:7652
- C:\Windows\System\nxuVRlD.exe
  C:\Windows\System\nxuVRlD.exe
  2⤵
  PID:7668
- C:\Windows\System\dIYJbQW.exe
  C:\Windows\System\dIYJbQW.exe
  2⤵
  PID:7684
- C:\Windows\System\oUsdlKt.exe
  C:\Windows\System\oUsdlKt.exe
  2⤵
  PID:7700
- C:\Windows\System\wbkinNF.exe
  C:\Windows\System\wbkinNF.exe
  2⤵
  PID:7716
- C:\Windows\System\cpvbaXf.exe
  C:\Windows\System\cpvbaXf.exe
  2⤵
  PID:7732
- C:\Windows\System\zdddeOs.exe
  C:\Windows\System\zdddeOs.exe
  2⤵
  PID:7748
- C:\Windows\System\DfbpgyE.exe
  C:\Windows\System\DfbpgyE.exe
  2⤵
  PID:7768
- C:\Windows\System\zacEaYf.exe
  C:\Windows\System\zacEaYf.exe
  2⤵
  PID:7784
- C:\Windows\System\iOeHciR.exe
  C:\Windows\System\iOeHciR.exe
  2⤵
  PID:7812
- C:\Windows\System\mVQTGOF.exe
  C:\Windows\System\mVQTGOF.exe
  2⤵
  PID:7828
- C:\Windows\System\TmegPcX.exe
  C:\Windows\System\TmegPcX.exe
  2⤵
  PID:7848
- C:\Windows\System\wEkPiUE.exe
  C:\Windows\System\wEkPiUE.exe
  2⤵
  PID:7864
- C:\Windows\System\BZAljfk.exe
  C:\Windows\System\BZAljfk.exe
  2⤵
  PID:7880
- C:\Windows\System\YJXVbrZ.exe
  C:\Windows\System\YJXVbrZ.exe
  2⤵
  PID:7896
- C:\Windows\System\ltRbfsf.exe
  C:\Windows\System\ltRbfsf.exe
  2⤵
  PID:7912
- C:\Windows\System\EZfBzBy.exe
  C:\Windows\System\EZfBzBy.exe
  2⤵
  PID:7932
- C:\Windows\System\hYGcITc.exe
  C:\Windows\System\hYGcITc.exe
  2⤵
  PID:7948
- C:\Windows\System\UTyrOCQ.exe
  C:\Windows\System\UTyrOCQ.exe
  2⤵
  PID:7964
- C:\Windows\System\ejfhitu.exe
  C:\Windows\System\ejfhitu.exe
  2⤵
  PID:7996
- C:\Windows\System\pujIqyw.exe
  C:\Windows\System\pujIqyw.exe
  2⤵
  PID:8012
- C:\Windows\System\koZNEss.exe
  C:\Windows\System\koZNEss.exe
  2⤵
  PID:8032
- C:\Windows\System\RXQBKuC.exe
  C:\Windows\System\RXQBKuC.exe
  2⤵
  PID:8064
- C:\Windows\System\aaqPyhm.exe
  C:\Windows\System\aaqPyhm.exe
  2⤵
  PID:8080
- C:\Windows\System\tzQYudk.exe
  C:\Windows\System\tzQYudk.exe
  2⤵
  PID:8104
- C:\Windows\System\dUXbiTL.exe
  C:\Windows\System\dUXbiTL.exe
  2⤵
  PID:8120
- C:\Windows\System\dWunEis.exe
  C:\Windows\System\dWunEis.exe
  2⤵
  PID:8140
- C:\Windows\System\bqubLWW.exe
  C:\Windows\System\bqubLWW.exe
  2⤵
  PID:8156
- C:\Windows\System\gkvWcYD.exe
  C:\Windows\System\gkvWcYD.exe
  2⤵
  PID:8172
- C:\Windows\System\ATTqjTh.exe
  C:\Windows\System\ATTqjTh.exe
  2⤵
  PID:8188
- C:\Windows\System\RLZGwZh.exe
  C:\Windows\System\RLZGwZh.exe
  2⤵
  PID:6896
- C:\Windows\System\ZvPsbUb.exe
  C:\Windows\System\ZvPsbUb.exe
  2⤵
  PID:7248
- C:\Windows\System\bkccRhe.exe
  C:\Windows\System\bkccRhe.exe
  2⤵
  PID:7384
- C:\Windows\System\AaHlDOn.exe
  C:\Windows\System\AaHlDOn.exe
  2⤵
  PID:7260
- C:\Windows\System\JgZExJm.exe
  C:\Windows\System\JgZExJm.exe
  2⤵
  PID:7368
- C:\Windows\System\lSjmrug.exe
  C:\Windows\System\lSjmrug.exe
  2⤵
  PID:7332
- C:\Windows\System\hdSZeur.exe
  C:\Windows\System\hdSZeur.exe
  2⤵
  PID:7356
- C:\Windows\System\NjSyfIR.exe
  C:\Windows\System\NjSyfIR.exe
  2⤵
  PID:7412
- C:\Windows\System\qWkDsNq.exe
  C:\Windows\System\qWkDsNq.exe
  2⤵
  PID:7428
- C:\Windows\System\IkoSsPo.exe
  C:\Windows\System\IkoSsPo.exe
  2⤵
  PID:7448
- C:\Windows\System\ziTYrdq.exe
  C:\Windows\System\ziTYrdq.exe
  2⤵
  PID:7464
- C:\Windows\System\voTablv.exe
  C:\Windows\System\voTablv.exe
  2⤵
  PID:7476
- C:\Windows\System\NFXOWFI.exe
  C:\Windows\System\NFXOWFI.exe
  2⤵
  PID:7500
- C:\Windows\System\MaTXHvj.exe
  C:\Windows\System\MaTXHvj.exe
  2⤵
  PID:7520
- C:\Windows\System\mKdnbqH.exe
  C:\Windows\System\mKdnbqH.exe
  2⤵
  PID:7508
- C:\Windows\System\FRuuxJk.exe
  C:\Windows\System\FRuuxJk.exe
  2⤵
  PID:7544
- C:\Windows\System\psQmAvq.exe
  C:\Windows\System\psQmAvq.exe
  2⤵
  PID:7556
- C:\Windows\System\xkdsXOm.exe
  C:\Windows\System\xkdsXOm.exe
  2⤵
  PID:7576
- C:\Windows\System\rMkGCxu.exe
  C:\Windows\System\rMkGCxu.exe
  2⤵
  PID:7596
- C:\Windows\System\khfKnFc.exe
  C:\Windows\System\khfKnFc.exe
  2⤵
  PID:7648
- C:\Windows\System\aYyWETd.exe
  C:\Windows\System\aYyWETd.exe
  2⤵
  PID:7712
- C:\Windows\System\kdMAYSA.exe
  C:\Windows\System\kdMAYSA.exe
  2⤵
  PID:7600
- C:\Windows\System\WvuKDTb.exe
  C:\Windows\System\WvuKDTb.exe
  2⤵
  PID:7660
- C:\Windows\System\sqDQyuo.exe
  C:\Windows\System\sqDQyuo.exe
  2⤵
  PID:7728
- C:\Windows\System\yHiDLcW.exe
  C:\Windows\System\yHiDLcW.exe
  2⤵
  PID:7780
- C:\Windows\System\XWOqJvR.exe
  C:\Windows\System\XWOqJvR.exe
  2⤵
  PID:7824
- C:\Windows\System\eGanCne.exe
  C:\Windows\System\eGanCne.exe
  2⤵
  PID:7860
- C:\Windows\System\UTfiCco.exe
  C:\Windows\System\UTfiCco.exe
  2⤵
  PID:7888
- C:\Windows\System\AXUKGzy.exe
  C:\Windows\System\AXUKGzy.exe
  2⤵
  PID:7876
- C:\Windows\System\JWjkiSK.exe
  C:\Windows\System\JWjkiSK.exe
  2⤵
  PID:7904
- C:\Windows\System\rZyAYOJ.exe
  C:\Windows\System\rZyAYOJ.exe
  2⤵
  PID:7960
- C:\Windows\System\BbRuRLy.exe
  C:\Windows\System\BbRuRLy.exe
  2⤵
  PID:8020
- C:\Windows\System\YSOtOTN.exe
  C:\Windows\System\YSOtOTN.exe
  2⤵
  PID:7988
- C:\Windows\System\OHCnlgO.exe
  C:\Windows\System\OHCnlgO.exe
  2⤵
  PID:8076
- C:\Windows\System\qUrxuuc.exe
  C:\Windows\System\qUrxuuc.exe
  2⤵
  PID:8112
- C:\Windows\System\wCWcNsZ.exe
  C:\Windows\System\wCWcNsZ.exe
  2⤵
  PID:8060
- C:\Windows\System\mFqMPkx.exe
  C:\Windows\System\mFqMPkx.exe
  2⤵
  PID:8096
- C:\Windows\System\ZzTvyQm.exe
  C:\Windows\System\ZzTvyQm.exe
  2⤵
  PID:8168
- C:\Windows\System\VBhzYfq.exe
  C:\Windows\System\VBhzYfq.exe
  2⤵
  PID:7396
- C:\Windows\System\DgIFGnP.exe
  C:\Windows\System\DgIFGnP.exe
  2⤵
  PID:7192
- C:\Windows\System\WJOqafi.exe
  C:\Windows\System\WJOqafi.exe
  2⤵
  PID:7708
- C:\Windows\System\yJLSLPr.exe
  C:\Windows\System\yJLSLPr.exe
  2⤵
  PID:7764
- C:\Windows\System\jfzpcSO.exe
  C:\Windows\System\jfzpcSO.exe
  2⤵
  PID:7796
- C:\Windows\System\swxoXJf.exe
  C:\Windows\System\swxoXJf.exe
  2⤵
  PID:7644
- C:\Windows\System\JsJjmta.exe
  C:\Windows\System\JsJjmta.exe
  2⤵
  PID:7696
- C:\Windows\System\WbmwpFJ.exe
  C:\Windows\System\WbmwpFJ.exe
  2⤵
  PID:7740
- C:\Windows\System\jCFBvnp.exe
  C:\Windows\System\jCFBvnp.exe
  2⤵
  PID:7956
- C:\Windows\System\VRYuuFJ.exe
  C:\Windows\System\VRYuuFJ.exe
  2⤵
  PID:7984
- C:\Windows\System\BUNVcLX.exe
  C:\Windows\System\BUNVcLX.exe
  2⤵
  PID:7844
- C:\Windows\System\kOxZpCu.exe
  C:\Windows\System\kOxZpCu.exe
  2⤵
  PID:6708
- C:\Windows\System\dUsPEba.exe
  C:\Windows\System\dUsPEba.exe
  2⤵
  PID:8024
- C:\Windows\System\qXLycHf.exe
  C:\Windows\System\qXLycHf.exe
  2⤵
  PID:8164
- C:\Windows\System\hPhNwGB.exe
  C:\Windows\System\hPhNwGB.exe
  2⤵
  PID:8044
- C:\Windows\System\pANQNne.exe
  C:\Windows\System\pANQNne.exe
  2⤵
  PID:7176
- C:\Windows\System\ApbMWvR.exe
  C:\Windows\System\ApbMWvR.exe
  2⤵
  PID:6784
- C:\Windows\System\tGSKqdH.exe
  C:\Windows\System\tGSKqdH.exe
  2⤵
  PID:7460
- C:\Windows\System\qRQDACb.exe
  C:\Windows\System\qRQDACb.exe
  2⤵
  PID:7484
- C:\Windows\System\cgSoRAd.exe
  C:\Windows\System\cgSoRAd.exe
  2⤵
  PID:7312
- C:\Windows\System\UIEeDaT.exe
  C:\Windows\System\UIEeDaT.exe
  2⤵
  PID:7292
- C:\Windows\System\tLWJTZQ.exe
  C:\Windows\System\tLWJTZQ.exe
  2⤵
  PID:7408
- C:\Windows\System\OEOunXd.exe
  C:\Windows\System\OEOunXd.exe
  2⤵
  PID:7584
- C:\Windows\System\dslEgbE.exe
  C:\Windows\System\dslEgbE.exe
  2⤵
  PID:7540
- C:\Windows\System\ryyhSiE.exe
  C:\Windows\System\ryyhSiE.exe
  2⤵
  PID:7980
- C:\Windows\System\twkJDJQ.exe
  C:\Windows\System\twkJDJQ.exe
  2⤵
  PID:7928
- C:\Windows\System\EgwYwvo.exe
  C:\Windows\System\EgwYwvo.exe
  2⤵
  PID:7224
- C:\Windows\System\cqIgZZE.exe
  C:\Windows\System\cqIgZZE.exe
  2⤵
  PID:7924
- C:\Windows\System\VrcFcYS.exe
  C:\Windows\System\VrcFcYS.exe
  2⤵
  PID:8052
- C:\Windows\System\BZqUEJd.exe
  C:\Windows\System\BZqUEJd.exe
  2⤵
  PID:7208
- C:\Windows\System\CoUCuYw.exe
  C:\Windows\System\CoUCuYw.exe
  2⤵
  PID:6384
- C:\Windows\System\uQtMGxx.exe
  C:\Windows\System\uQtMGxx.exe
  2⤵
  PID:7456
- C:\Windows\System\EsUJiKu.exe
  C:\Windows\System\EsUJiKu.exe
  2⤵
  PID:7336
- C:\Windows\System\xpLshQh.exe
  C:\Windows\System\xpLshQh.exe
  2⤵
  PID:8100
- C:\Windows\System\nwmhfLR.exe
  C:\Windows\System\nwmhfLR.exe
  2⤵
  PID:7800
- C:\Windows\System\GExhkjN.exe
  C:\Windows\System\GExhkjN.exe
  2⤵
  PID:7496
- C:\Windows\System\WhJUBXc.exe
  C:\Windows\System\WhJUBXc.exe
  2⤵
  PID:7856
- C:\Windows\System\EnYZSiL.exe
  C:\Windows\System\EnYZSiL.exe
  2⤵
  PID:6400
- C:\Windows\System\mlAKkpr.exe
  C:\Windows\System\mlAKkpr.exe
  2⤵
  PID:6404
- C:\Windows\System\KkwRoeG.exe
  C:\Windows\System\KkwRoeG.exe
  2⤵
  PID:7296
- C:\Windows\System\VDchxBE.exe
  C:\Windows\System\VDchxBE.exe
  2⤵
  PID:7820
- C:\Windows\System\YTQNlag.exe
  C:\Windows\System\YTQNlag.exe
  2⤵
  PID:8184
- C:\Windows\System\yaldOLk.exe
  C:\Windows\System\yaldOLk.exe
  2⤵
  PID:7516
- C:\Windows\System\aNFfnJb.exe
  C:\Windows\System\aNFfnJb.exe
  2⤵
  PID:7872
- C:\Windows\System\lwstJcD.exe
  C:\Windows\System\lwstJcD.exe
  2⤵
  PID:8040
- C:\Windows\System\tvKQAyP.exe
  C:\Windows\System\tvKQAyP.exe
  2⤵
  PID:7512
- C:\Windows\System\vFXHmfp.exe
  C:\Windows\System\vFXHmfp.exe
  2⤵
  PID:8208
- C:\Windows\System\rEkjNIb.exe
  C:\Windows\System\rEkjNIb.exe
  2⤵
  PID:8224
- C:\Windows\System\bgXvuza.exe
  C:\Windows\System\bgXvuza.exe
  2⤵
  PID:8240
- C:\Windows\System\SUvqPwQ.exe
  C:\Windows\System\SUvqPwQ.exe
  2⤵
  PID:8256
- C:\Windows\System\tyzHNuh.exe
  C:\Windows\System\tyzHNuh.exe
  2⤵
  PID:8356
- C:\Windows\System\ArzKQxH.exe
  C:\Windows\System\ArzKQxH.exe
  2⤵
  PID:8416
- C:\Windows\System\bpIYrzY.exe
  C:\Windows\System\bpIYrzY.exe
  2⤵
  PID:8432
- C:\Windows\System\SAPODpo.exe
  C:\Windows\System\SAPODpo.exe
  2⤵
  PID:8448
- C:\Windows\System\WhHxHlU.exe
  C:\Windows\System\WhHxHlU.exe
  2⤵
  PID:8464
- C:\Windows\System\NtnfmBi.exe
  C:\Windows\System\NtnfmBi.exe
  2⤵
  PID:8480
- C:\Windows\System\DrYWcIR.exe
  C:\Windows\System\DrYWcIR.exe
  2⤵
  PID:8496
- C:\Windows\System\VCZYOwI.exe
  C:\Windows\System\VCZYOwI.exe
  2⤵
  PID:8512
- C:\Windows\System\YKDLros.exe
  C:\Windows\System\YKDLros.exe
  2⤵
  PID:8528
- C:\Windows\System\HucbKfQ.exe
  C:\Windows\System\HucbKfQ.exe
  2⤵
  PID:8544
- C:\Windows\System\Nrbvbvp.exe
  C:\Windows\System\Nrbvbvp.exe
  2⤵
  PID:8560
- C:\Windows\System\WUsvkUD.exe
  C:\Windows\System\WUsvkUD.exe
  2⤵
  PID:8576
- C:\Windows\System\hrnpAep.exe
  C:\Windows\System\hrnpAep.exe
  2⤵
  PID:8592
- C:\Windows\System\rFYNuzq.exe
  C:\Windows\System\rFYNuzq.exe
  2⤵
  PID:8608
- C:\Windows\System\qVvEoxf.exe
  C:\Windows\System\qVvEoxf.exe
  2⤵
  PID:8624
- C:\Windows\System\FDmkXcj.exe
  C:\Windows\System\FDmkXcj.exe
  2⤵
  PID:8640
- C:\Windows\System\xElBVPj.exe
  C:\Windows\System\xElBVPj.exe
  2⤵
  PID:8656
- C:\Windows\System\IXqHXur.exe
  C:\Windows\System\IXqHXur.exe
  2⤵
  PID:8672
- C:\Windows\System\hYbkvTf.exe
  C:\Windows\System\hYbkvTf.exe
  2⤵
  PID:8688
- C:\Windows\System\GZqgcbc.exe
  C:\Windows\System\GZqgcbc.exe
  2⤵
  PID:8704
- C:\Windows\System\HopXkON.exe
  C:\Windows\System\HopXkON.exe
  2⤵
  PID:8720
- C:\Windows\System\uGAPGmj.exe
  C:\Windows\System\uGAPGmj.exe
  2⤵
  PID:8736
- C:\Windows\System\JaTXiSy.exe
  C:\Windows\System\JaTXiSy.exe
  2⤵
  PID:8752
- C:\Windows\System\MIrDSUH.exe
  C:\Windows\System\MIrDSUH.exe
  2⤵
  PID:8768
- C:\Windows\System\qBYbKvw.exe
  C:\Windows\System\qBYbKvw.exe
  2⤵
  PID:8784
- C:\Windows\System\iUJFsHX.exe
  C:\Windows\System\iUJFsHX.exe
  2⤵
  PID:8800
- C:\Windows\System\EjkWNHB.exe
  C:\Windows\System\EjkWNHB.exe
  2⤵
  PID:8816
- C:\Windows\System\qwdrmsi.exe
  C:\Windows\System\qwdrmsi.exe
  2⤵
  PID:8836
- C:\Windows\System\WjAMyJE.exe
  C:\Windows\System\WjAMyJE.exe
  2⤵
  PID:8852
- C:\Windows\System\cKMzXFN.exe
  C:\Windows\System\cKMzXFN.exe
  2⤵
  PID:8868
- C:\Windows\System\AblHIFe.exe
  C:\Windows\System\AblHIFe.exe
  2⤵
  PID:8884
- C:\Windows\System\EMLAtcr.exe
  C:\Windows\System\EMLAtcr.exe
  2⤵
  PID:8900
- C:\Windows\System\DFCxGXs.exe
  C:\Windows\System\DFCxGXs.exe
  2⤵
  PID:8916
- C:\Windows\System\cStSkmy.exe
  C:\Windows\System\cStSkmy.exe
  2⤵
  PID:8932
- C:\Windows\System\tunlBld.exe
  C:\Windows\System\tunlBld.exe
  2⤵
  PID:8948
- C:\Windows\System\NFDDUcu.exe
  C:\Windows\System\NFDDUcu.exe
  2⤵
  PID:8964
- C:\Windows\System\prFNapA.exe
  C:\Windows\System\prFNapA.exe
  2⤵
  PID:8980
- C:\Windows\System\gwKJUgl.exe
  C:\Windows\System\gwKJUgl.exe
  2⤵
  PID:8996
- C:\Windows\System\jPnjyww.exe
  C:\Windows\System\jPnjyww.exe
  2⤵
  PID:9016
- C:\Windows\System\dNeppFl.exe
  C:\Windows\System\dNeppFl.exe
  2⤵
  PID:9032
- C:\Windows\System\xYruqMy.exe
  C:\Windows\System\xYruqMy.exe
  2⤵
  PID:9048
- C:\Windows\System\qxhRvZH.exe
  C:\Windows\System\qxhRvZH.exe
  2⤵
  PID:9064
- C:\Windows\System\qdLTkeL.exe
  C:\Windows\System\qdLTkeL.exe
  2⤵
  PID:9080
- C:\Windows\System\vPrhUNm.exe
  C:\Windows\System\vPrhUNm.exe
  2⤵
  PID:9096
- C:\Windows\System\ofvdDVf.exe
  C:\Windows\System\ofvdDVf.exe
  2⤵
  PID:9112
- C:\Windows\System\VNIGbcx.exe
  C:\Windows\System\VNIGbcx.exe
  2⤵
  PID:9128
- C:\Windows\System\sNnfdFF.exe
  C:\Windows\System\sNnfdFF.exe
  2⤵
  PID:9144
- C:\Windows\System\MUdkkHG.exe
  C:\Windows\System\MUdkkHG.exe
  2⤵
  PID:9160
- C:\Windows\System\hwSTlKc.exe
  C:\Windows\System\hwSTlKc.exe
  2⤵
  PID:9176
- C:\Windows\System\LtOBFKd.exe
  C:\Windows\System\LtOBFKd.exe
  2⤵
  PID:9192
- C:\Windows\System\sEKZQev.exe
  C:\Windows\System\sEKZQev.exe
  2⤵
  PID:9208
- C:\Windows\System\koGSnum.exe
  C:\Windows\System\koGSnum.exe
  2⤵
  PID:8200
- C:\Windows\System\tMjTggP.exe
  C:\Windows\System\tMjTggP.exe
  2⤵
  PID:8088
- C:\Windows\System\McWJNBO.exe
  C:\Windows\System\McWJNBO.exe
  2⤵
  PID:8248
- C:\Windows\System\gCSmBgN.exe
  C:\Windows\System\gCSmBgN.exe
  2⤵
  PID:8264
- C:\Windows\System\OYxFhYW.exe
  C:\Windows\System\OYxFhYW.exe
  2⤵
  PID:8300
- C:\Windows\System\gWLHWfV.exe
  C:\Windows\System\gWLHWfV.exe
  2⤵
  PID:8316
- C:\Windows\System\lbhLYaZ.exe
  C:\Windows\System\lbhLYaZ.exe
  2⤵
  PID:8332
- C:\Windows\System\NvdUtlu.exe
  C:\Windows\System\NvdUtlu.exe
  2⤵
  PID:8348
- C:\Windows\System\afflPzJ.exe
  C:\Windows\System\afflPzJ.exe
  2⤵
  PID:8372
- C:\Windows\System\CXEgAQj.exe
  C:\Windows\System\CXEgAQj.exe
  2⤵
  PID:8388
- C:\Windows\System\TFudYmr.exe
  C:\Windows\System\TFudYmr.exe
  2⤵
  PID:8408
- C:\Windows\System\telvnbs.exe
  C:\Windows\System\telvnbs.exe
  2⤵
  PID:8428
- C:\Windows\System\vpwQAkd.exe
  C:\Windows\System\vpwQAkd.exe
  2⤵
  PID:8492
- C:\Windows\System\ZbOmmxU.exe
  C:\Windows\System\ZbOmmxU.exe
  2⤵
  PID:8556
- C:\Windows\System\EzgvIiS.exe
  C:\Windows\System\EzgvIiS.exe
  2⤵
  PID:8620
- C:\Windows\System\IRldxNI.exe
  C:\Windows\System\IRldxNI.exe
  2⤵
  PID:8684
- C:\Windows\System\JepZiGP.exe
  C:\Windows\System\JepZiGP.exe
  2⤵
  PID:8748
- C:\Windows\System\mgmGRAs.exe
  C:\Windows\System\mgmGRAs.exe
  2⤵
  PID:8776
- C:\Windows\System\xmRutIh.exe
  C:\Windows\System\xmRutIh.exe
  2⤵
  PID:8812
- C:\Windows\System\PqXgyyV.exe
  C:\Windows\System\PqXgyyV.exe
  2⤵
  PID:8572
- C:\Windows\System\kmwLbro.exe
  C:\Windows\System\kmwLbro.exe
  2⤵
  PID:8636
- C:\Windows\System\VBpczJn.exe
  C:\Windows\System\VBpczJn.exe
  2⤵
  PID:8696
- C:\Windows\System\ttcxzjk.exe
  C:\Windows\System\ttcxzjk.exe
  2⤵
  PID:8832
- C:\Windows\System\LJmKNtA.exe
  C:\Windows\System\LJmKNtA.exe
  2⤵
  PID:8508
- C:\Windows\System\gpPglwU.exe
  C:\Windows\System\gpPglwU.exe
  2⤵
  PID:8876
- C:\Windows\System\PpMzZfH.exe
  C:\Windows\System\PpMzZfH.exe
  2⤵
  PID:8864
- C:\Windows\System\mVuKZzq.exe
  C:\Windows\System\mVuKZzq.exe
  2⤵
  PID:8924
- C:\Windows\System\IPHkubo.exe
  C:\Windows\System\IPHkubo.exe
  2⤵
  PID:8944
- C:\Windows\System\NdjwEoC.exe
  C:\Windows\System\NdjwEoC.exe
  2⤵
  PID:8960
- C:\Windows\System\FguRyUT.exe
  C:\Windows\System\FguRyUT.exe
  2⤵
  PID:9012
- C:\Windows\System\QZJysPd.exe
  C:\Windows\System\QZJysPd.exe
  2⤵
  PID:9072
- C:\Windows\System\aOCgmmB.exe
  C:\Windows\System\aOCgmmB.exe
  2⤵
  PID:9056
- C:\Windows\System\SLVbpat.exe
  C:\Windows\System\SLVbpat.exe
  2⤵
  PID:9140
- C:\Windows\System\PDwNBJy.exe
  C:\Windows\System\PDwNBJy.exe
  2⤵
  PID:9204
- C:\Windows\System\PGDdhYI.exe
  C:\Windows\System\PGDdhYI.exe
  2⤵
  PID:9092
- C:\Windows\System\xczDjlP.exe
  C:\Windows\System\xczDjlP.exe
  2⤵
  PID:8216
- C:\Windows\System\djGmbyY.exe
  C:\Windows\System\djGmbyY.exe
  2⤵
  PID:9188
- C:\Windows\System\EUBRwDa.exe
  C:\Windows\System\EUBRwDa.exe
  2⤵
  PID:7472
- C:\Windows\System\WyFSLBG.exe
  C:\Windows\System\WyFSLBG.exe
  2⤵
  PID:8344
- C:\Windows\System\irtrHql.exe
  C:\Windows\System\irtrHql.exe
  2⤵
  PID:8424
- C:\Windows\System\IrFYzxM.exe
  C:\Windows\System\IrFYzxM.exe
  2⤵
  PID:8680
- C:\Windows\System\ojboAaA.exe
  C:\Windows\System\ojboAaA.exe
  2⤵
  PID:8764
- C:\Windows\System\XawsvXA.exe
  C:\Windows\System\XawsvXA.exe
  2⤵
  PID:8404
- C:\Windows\System\USQxBzy.exe
  C:\Windows\System\USQxBzy.exe
  2⤵
  PID:8296
- C:\Windows\System\mNbrAxV.exe
  C:\Windows\System\mNbrAxV.exe
  2⤵
  PID:8328
- C:\Windows\System\lnKuyzR.exe
  C:\Windows\System\lnKuyzR.exe
  2⤵
  PID:8568
- C:\Windows\System\bEkRoRw.exe
  C:\Windows\System\bEkRoRw.exe
  2⤵
  PID:8668
- C:\Windows\System\dnKFMfL.exe
  C:\Windows\System\dnKFMfL.exe
  2⤵
  PID:8848
- C:\Windows\System\rpVATXf.exe
  C:\Windows\System\rpVATXf.exe
  2⤵
  PID:8860
- C:\Windows\System\fxTqCaU.exe
  C:\Windows\System\fxTqCaU.exe
  2⤵
  PID:9008
- C:\Windows\System\zzhdSiu.exe
  C:\Windows\System\zzhdSiu.exe
  2⤵
  PID:8912
- C:\Windows\System\YxJEmXb.exe
  C:\Windows\System\YxJEmXb.exe
  2⤵
  PID:8956
- C:\Windows\System\LvyaaQE.exe
  C:\Windows\System\LvyaaQE.exe
  2⤵
  PID:8992
- C:\Windows\System\eZNmjJB.exe
  C:\Windows\System\eZNmjJB.exe
  2⤵
  PID:9136
- C:\Windows\System\Scxrnvz.exe
  C:\Windows\System\Scxrnvz.exe
  2⤵
  PID:8340
- C:\Windows\System\dTqSQWi.exe
  C:\Windows\System\dTqSQWi.exe
  2⤵
  PID:8236
- C:\Windows\System\quJeXVc.exe
  C:\Windows\System\quJeXVc.exe
  2⤵
  PID:8844
- C:\Windows\System\ybKFwoE.exe
  C:\Windows\System\ybKFwoE.exe
  2⤵
  PID:8588
- C:\Windows\System\UcliDbJ.exe
  C:\Windows\System\UcliDbJ.exe
  2⤵
  PID:8616
- C:\Windows\System\EkodTej.exe
  C:\Windows\System\EkodTej.exe
  2⤵
  PID:8632
- C:\Windows\System\hXWYvgx.exe
  C:\Windows\System\hXWYvgx.exe
  2⤵
  PID:9156
- C:\Windows\System\LxzbCIm.exe
  C:\Windows\System\LxzbCIm.exe
  2⤵
  PID:9028
- C:\Windows\System\PhjziWd.exe
  C:\Windows\System\PhjziWd.exe
  2⤵
  PID:8908
- C:\Windows\System\sQKYogl.exe
  C:\Windows\System\sQKYogl.exe
  2⤵
  PID:8312
- C:\Windows\System\KQJHGfB.exe
  C:\Windows\System\KQJHGfB.exe
  2⤵
  PID:8732
- C:\Windows\System\yoPBEAF.exe
  C:\Windows\System\yoPBEAF.exe
  2⤵
  PID:8604
- C:\Windows\System\UOuRPRN.exe
  C:\Windows\System\UOuRPRN.exe
  2⤵
  PID:8204
- C:\Windows\System\UDpqAnJ.exe
  C:\Windows\System\UDpqAnJ.exe
  2⤵
  PID:8540
- C:\Windows\System\Pylrylx.exe
  C:\Windows\System\Pylrylx.exe
  2⤵
  PID:9224
- C:\Windows\System\qQHpUAy.exe
  C:\Windows\System\qQHpUAy.exe
  2⤵
  PID:9240
- C:\Windows\System\LJUYduQ.exe
  C:\Windows\System\LJUYduQ.exe
  2⤵
  PID:9256
- C:\Windows\System\cXgtNdz.exe
  C:\Windows\System\cXgtNdz.exe
  2⤵
  PID:9272
- C:\Windows\System\URmoNoT.exe
  C:\Windows\System\URmoNoT.exe
  2⤵
  PID:9288
- C:\Windows\System\kBdTzkS.exe
  C:\Windows\System\kBdTzkS.exe
  2⤵
  PID:9304
- C:\Windows\System\DUqqywh.exe
  C:\Windows\System\DUqqywh.exe
  2⤵
  PID:9320
- C:\Windows\System\EDqDTfr.exe
  C:\Windows\System\EDqDTfr.exe
  2⤵
  PID:9336
- C:\Windows\System\avzEOqD.exe
  C:\Windows\System\avzEOqD.exe
  2⤵
  PID:9352
- C:\Windows\System\hOrFVzi.exe
  C:\Windows\System\hOrFVzi.exe
  2⤵
  PID:9368
- C:\Windows\System\yXdwApf.exe
  C:\Windows\System\yXdwApf.exe
  2⤵
  PID:9384
- C:\Windows\System\ToNsgSO.exe
  C:\Windows\System\ToNsgSO.exe
  2⤵
  PID:9400
- C:\Windows\System\JTcQlzq.exe
  C:\Windows\System\JTcQlzq.exe
  2⤵
  PID:9416
- C:\Windows\System\SzwjvCx.exe
  C:\Windows\System\SzwjvCx.exe
  2⤵
  PID:9432
- C:\Windows\System\DycXyMg.exe
  C:\Windows\System\DycXyMg.exe
  2⤵
  PID:9448
- C:\Windows\System\UwhgrxA.exe
  C:\Windows\System\UwhgrxA.exe
  2⤵
  PID:9464
- C:\Windows\System\tJenVMC.exe
  C:\Windows\System\tJenVMC.exe
  2⤵
  PID:9480
- C:\Windows\System\GqZYRDJ.exe
  C:\Windows\System\GqZYRDJ.exe
  2⤵
  PID:9496
- C:\Windows\System\TcEXIWF.exe
  C:\Windows\System\TcEXIWF.exe
  2⤵
  PID:9512
- C:\Windows\System\oIRmwWQ.exe
  C:\Windows\System\oIRmwWQ.exe
  2⤵
  PID:9528
- C:\Windows\System\zoslBBZ.exe
  C:\Windows\System\zoslBBZ.exe
  2⤵
  PID:9544
- C:\Windows\System\oXBtIJu.exe
  C:\Windows\System\oXBtIJu.exe
  2⤵
  PID:9560
- C:\Windows\System\lqmyLOe.exe
  C:\Windows\System\lqmyLOe.exe
  2⤵
  PID:9576
- C:\Windows\System\vUZMnpg.exe
  C:\Windows\System\vUZMnpg.exe
  2⤵
  PID:9592
- C:\Windows\System\kAkJWKm.exe
  C:\Windows\System\kAkJWKm.exe
  2⤵
  PID:9608
- C:\Windows\System\ePkHaUM.exe
  C:\Windows\System\ePkHaUM.exe
  2⤵
  PID:9624
- C:\Windows\System\PMwyxmx.exe
  C:\Windows\System\PMwyxmx.exe
  2⤵
  PID:9640
- C:\Windows\System\WfIFCyZ.exe
  C:\Windows\System\WfIFCyZ.exe
  2⤵
  PID:9656
- C:\Windows\System\pDierZy.exe
  C:\Windows\System\pDierZy.exe
  2⤵
  PID:9672
- C:\Windows\System\ejjTsfN.exe
  C:\Windows\System\ejjTsfN.exe
  2⤵
  PID:9688
- C:\Windows\System\FBwSzlJ.exe
  C:\Windows\System\FBwSzlJ.exe
  2⤵
  PID:9704
- C:\Windows\System\BolKcpz.exe
  C:\Windows\System\BolKcpz.exe
  2⤵
  PID:9720
- C:\Windows\System\VHYXweq.exe
  C:\Windows\System\VHYXweq.exe
  2⤵
  PID:9736
- C:\Windows\System\amwSUYL.exe
  C:\Windows\System\amwSUYL.exe
  2⤵
  PID:9752
- C:\Windows\System\dgwHahr.exe
  C:\Windows\System\dgwHahr.exe
  2⤵
  PID:9768
- C:\Windows\System\yGoouuW.exe
  C:\Windows\System\yGoouuW.exe
  2⤵
  PID:9784
- C:\Windows\System\WterGbG.exe
  C:\Windows\System\WterGbG.exe
  2⤵
  PID:9800
- C:\Windows\System\aveRDgf.exe
  C:\Windows\System\aveRDgf.exe
  2⤵
  PID:9816
- C:\Windows\System\sEytruL.exe
  C:\Windows\System\sEytruL.exe
  2⤵
  PID:9832
- C:\Windows\System\lIiqYeG.exe
  C:\Windows\System\lIiqYeG.exe
  2⤵
  PID:9848
- C:\Windows\System\ffSAEYI.exe
  C:\Windows\System\ffSAEYI.exe
  2⤵
  PID:9864
- C:\Windows\System\cUsqQwZ.exe
  C:\Windows\System\cUsqQwZ.exe
  2⤵
  PID:9880
- C:\Windows\System\pbWNobU.exe
  C:\Windows\System\pbWNobU.exe
  2⤵
  PID:9896
- C:\Windows\System\LQkirqQ.exe
  C:\Windows\System\LQkirqQ.exe
  2⤵
  PID:9912
- C:\Windows\System\wPdAYCg.exe
  C:\Windows\System\wPdAYCg.exe
  2⤵
  PID:9932
- C:\Windows\System\bMJwXRe.exe
  C:\Windows\System\bMJwXRe.exe
  2⤵
  PID:9948
- C:\Windows\System\CbZQynz.exe
  C:\Windows\System\CbZQynz.exe
  2⤵
  PID:9964
- C:\Windows\System\tylIQBr.exe
  C:\Windows\System\tylIQBr.exe
  2⤵
  PID:9980
- C:\Windows\System\bxLsdEw.exe
  C:\Windows\System\bxLsdEw.exe
  2⤵
  PID:9996
- C:\Windows\System\PFkWbbn.exe
  C:\Windows\System\PFkWbbn.exe
  2⤵
  PID:10012
- C:\Windows\System\hndCfGt.exe
  C:\Windows\System\hndCfGt.exe
  2⤵
  PID:10028
- C:\Windows\System\TeZPNnD.exe
  C:\Windows\System\TeZPNnD.exe
  2⤵
  PID:10044
- C:\Windows\System\BchHsac.exe
  C:\Windows\System\BchHsac.exe
  2⤵
  PID:10060
- C:\Windows\System\SvMvjte.exe
  C:\Windows\System\SvMvjte.exe
  2⤵
  PID:10076
- C:\Windows\System\vhcmGSZ.exe
  C:\Windows\System\vhcmGSZ.exe
  2⤵
  PID:10092
- C:\Windows\System\JGXmDul.exe
  C:\Windows\System\JGXmDul.exe
  2⤵
  PID:10108
- C:\Windows\System\iOqycfu.exe
  C:\Windows\System\iOqycfu.exe
  2⤵
  PID:10124
- C:\Windows\System\exaDJfw.exe
  C:\Windows\System\exaDJfw.exe
  2⤵
  PID:10140
- C:\Windows\System\lxPhrAs.exe
  C:\Windows\System\lxPhrAs.exe
  2⤵
  PID:10156
- C:\Windows\System\nvnLgQf.exe
  C:\Windows\System\nvnLgQf.exe
  2⤵
  PID:10172
- C:\Windows\System\wlavIss.exe
  C:\Windows\System\wlavIss.exe
  2⤵
  PID:10188
- C:\Windows\System\uwSsduE.exe
  C:\Windows\System\uwSsduE.exe
  2⤵
  PID:10204
- C:\Windows\System\jpsUxEk.exe
  C:\Windows\System\jpsUxEk.exe
  2⤵
  PID:10220
- C:\Windows\System\IPNFSzN.exe
  C:\Windows\System\IPNFSzN.exe
  2⤵
  PID:10236
- C:\Windows\System\SICxIsK.exe
  C:\Windows\System\SICxIsK.exe
  2⤵
  PID:9264
- C:\Windows\System\cxQFiYL.exe
  C:\Windows\System\cxQFiYL.exe
  2⤵
  PID:8476
- C:\Windows\System\nULDjrJ.exe
  C:\Windows\System\nULDjrJ.exe
  2⤵
  PID:9024
- C:\Windows\System\CSALiWB.exe
  C:\Windows\System\CSALiWB.exe
  2⤵
  PID:9280
- C:\Windows\System\GKuPilN.exe
  C:\Windows\System\GKuPilN.exe
  2⤵
  PID:9332
- C:\Windows\System\JDZOmWH.exe
  C:\Windows\System\JDZOmWH.exe
  2⤵
  PID:9396
- C:\Windows\System\zyXmSnc.exe
  C:\Windows\System\zyXmSnc.exe
  2⤵
  PID:9316
- C:\Windows\System\PKAtWXg.exe
  C:\Windows\System\PKAtWXg.exe
  2⤵
  PID:9380
- C:\Windows\System\sNbVwTj.exe
  C:\Windows\System\sNbVwTj.exe
  2⤵
  PID:9456
- C:\Windows\System\SwRqLik.exe
  C:\Windows\System\SwRqLik.exe
  2⤵
  PID:9476
- C:\Windows\System\TDpLZGy.exe
  C:\Windows\System\TDpLZGy.exe
  2⤵
  PID:9520
- C:\Windows\System\FbqvnAB.exe
  C:\Windows\System\FbqvnAB.exe
  2⤵
  PID:9584
- C:\Windows\System\paolZQw.exe
  C:\Windows\System\paolZQw.exe
  2⤵
  PID:9536
- C:\Windows\System\UtSmiKf.exe
  C:\Windows\System\UtSmiKf.exe
  2⤵
  PID:9616
- C:\Windows\System\VXlbScn.exe
  C:\Windows\System\VXlbScn.exe
  2⤵
  PID:9680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BCLAmLL.exe

Filesize
2.1MB

MD5
f32cb5e8a699bebd7dbc122d6354dbc8

SHA1
1c1bb05b19ceb7a0071f55f889107949e6d2bd76

SHA256
7ff16ec1a3f4734ea44cb44a2fe7d0fbe4d8c7e4659ce4b6228675d4769f4e75

SHA512
70102c200bef5f6667d14f3928707181d91ea642b11ab89e59f2cda125d6b31a3b47ae89da05ff0efaeaf66f6427bcccbca8334490aa09e62f3487f766a2a081

Download Submit
C:\Windows\system\BgNscVH.exe

Filesize
2.1MB

MD5
3fac80a344930a018d57e481c08cfb40

SHA1
7cd222d9cf26ad6f3d6957ff7efba4970ea27e34

SHA256
b3180db7efcf4761d9dacf3566ce50e665effd12eadfb780cd3503b03fc8301c

SHA512
21e39d62184f748527dcee1f71c2c4efbfd199bdc117c22a595e84754300b1264b8bf9f2923dcd804dba15767bb93c78917c14388312a283d21f3f9bec9a30d3

Download Submit
C:\Windows\system\CXJJQBD.exe

Filesize
2.1MB

MD5
56646816e991ae048118192b36ab3679

SHA1
3115598c3161858ad61cc023cb8554bc603c133a

SHA256
47bf61c37f0465f4cc2219c8b62d073791440a31aea24447bc42d8f9bb2013e0

SHA512
123ed80aa62cd0073e6bfaccf53af430bef48739359e82a66bfcbb98a04bdee0de61825e3ade4ea410b4592fe2d6c972682c7d7a322f6ebea9d0911afd483f31

Download Submit
C:\Windows\system\ENsezFl.exe

Filesize
2.1MB

MD5
e90cc25cd4cf7f41b8c775128f535c1b

SHA1
d515c2c2d76d9ce3a39b45a074623e888945f54f

SHA256
f6add45409be3c0202cfeea4cb6fe8ba8486ef1cec8ff223af1b3a143f7da798

SHA512
fc524be7303af2268ba738e3cf40c6be51bea78f9764768124f4b33f3e5ea0e0aef21868f27f5cb763141bbc32ef5f9ecc6a8e187d12f51a0b24f3173191fb89

Download Submit
C:\Windows\system\FvQlSSl.exe

Filesize
2.1MB

MD5
0326bee910f281b8f6695e0b022559b2

SHA1
e8bdcce18a8624541b139fe08a89ec43a20d52c0

SHA256
3396d39536d6ec50acda5626657363b33276828e4ad89ba9df996009faa974a6

SHA512
4351c50c454afc02afa9bfe345747e27cc8960ff20e6956813e3446b862e0fb9be66785e12ee009babf34d6cee6b31560b2c66266ae91a1ff32aada13ca4d328

Download Submit
C:\Windows\system\HallCFD.exe

Filesize
2.1MB

MD5
ee00a3cd29ce585387be221e2f7206df

SHA1
543df16d51c0a4e8f8ceec5c85ecc80dcddc8548

SHA256
e90cce82136bf68dae13aaa7cfed8c8eac79f3fed472074b8ac1fef363dc1589

SHA512
a5b185a6afa5eb75d40e1937731b8c047f65ecf1487d94e7bea24945846e6442d2c9667b1caee10ab462eee9606310901a566afb31c176f2c79c1a1e48afcf5e

Download Submit
C:\Windows\system\HoTGzeo.exe

Filesize
2.1MB

MD5
02c4c5ea320d73d83a36e4eacc7e6722

SHA1
d440ab3a30e9c205e16e7f96fc96662e8e7e3aad

SHA256
010f14de970828058cef57eea978c75917f144c2d89dd980a08434ba40e0895e

SHA512
7546db5277014d5600968a67dd0d577f35b681f07811fb09c3090106e15bf77a77474179f8b8d84f4b9eb5cbcfe0e5a34f29d33ce186de048edb2a89a1c22ba5

Download Submit
C:\Windows\system\IJiCtuH.exe

Filesize
2.1MB

MD5
5d93fdc3a6f4c3794a2f829a86a1b96c

SHA1
d39fdf495e896d7d8d90ea093040acc5a3f375ea

SHA256
6b0c5ba13ac4e0f068929c6d93f8f16d62bcde229392813ab0839499e0cf50eb

SHA512
e2d75bde40e741a72f84cf2b3e7f8508298b53d0c16fb5fd4ffda39fafe80eebd5fc74c888ae2db24d37ed9df4bc5cedeaaecc484dbce1cbbfbf22ee4319ff69

Download Submit
C:\Windows\system\MbNHzav.exe

Filesize
2.1MB

MD5
28542f3d58aad982ad271afd86357012

SHA1
a5fe9f89b0dc395a5a367f601aee5a0f582b00c9

SHA256
e4dce5794624a2b564efb3d165358e0ca44580906c8c8c0c8de709b92893b1cf

SHA512
003a37ea4d7cb8109bf145d81a8877e8205cae4fa81fa2e725e8ee08f0460cea5a86b70a0c8ce4d830c02f0c8f80250bde6ed78df92a1eb97c6ada6d4e0e1f13

Download Submit
C:\Windows\system\PwzaOrs.exe

Filesize
2.1MB

MD5
78d74f3724f151c1cfb02066399a6516

SHA1
c9e16edcce50130c6b0247984644c8fe06f513ab

SHA256
a44cf031e72bcbed41a724c9caccb318e6daa3b30c8f2ba25697339889923f6d

SHA512
28f72eeab866df7cad4dfd35378f41bfdc2d86169c267c662b41a4c57ffa1721f25d00e493df5cea1e3d7a590cfc6b80ecd5f780a22cf8ef90d17682131a78ce

Download Submit
C:\Windows\system\ShQXrPb.exe

Filesize
2.1MB

MD5
519cf5258abfcdcd1d4ca1c6e0ec53d4

SHA1
be8c7ab738e520fff0603df30c167ad069c7e8f4

SHA256
2bce9a8deb320d3e4eeaa52eac32b675cc82afa3ad07386031395dcd695acb00

SHA512
e8f39e4a8f22d5fbdacc54282f2d5544aeb882ce55602ac48da4c54498a9aad9f43a47406574b5dbeccb4e28e49b5709f4ad2a557ae3fe97d35323a01b901a61

Download Submit
C:\Windows\system\TcdaBJP.exe

Filesize
2.1MB

MD5
b82e8af26e9011cb67918f97e368fc69

SHA1
017d8fc6e81e5c7c331e67b62751e726af8eb0df

SHA256
b47f3e82b9d0089aa68639b4e73e65f64527617ea1314251f4e587f32eb7fb49

SHA512
13c1b2312e0f1c789983029fcd50b1686f312d0e87459d0837474b50da07adf7c2900933dff4aa1ef955af0a07075488199f7f335de9751c46463888788e3721

Download Submit
C:\Windows\system\TtAHHTA.exe

Filesize
2.1MB

MD5
422dd39fe168eb8dcfd70dbad57513d5

SHA1
75f255de13c82e12f7c3adb3c76ed9ba25441da1

SHA256
1c0616a77837205182d8bfb90152855eb0582d241ceb259959ceb6bf60e8b394

SHA512
bfc0232f0b73df4c689f717d61226c50d0260f14814bd26eb6167cbc0e16e5614c24cbb0802d5b240e76304209b41af8e635b5520f653237d09ff282777da352

Download Submit
C:\Windows\system\VXekibv.exe

Filesize
2.1MB

MD5
abcc7673dd8e14ef94fe8701f02eed73

SHA1
b9aa1d85a3f614e87b042f127e5e5a75b466d54c

SHA256
b0564624f2a2ed80714bd69b84b9e361fcb43d3200d84767d5821a4d98b480c8

SHA512
988156f7b84a2f4a2f3a3531dafe890cfacbe9d810fc83f5126c04cb94c7ec59a07406c19579b6e61913e1de5ab7b24d59f875c257270214bb82193aace38c27

Download Submit
C:\Windows\system\WvvIbBl.exe

Filesize
2.1MB

MD5
d11ea866c2ccbd9436073642cea695b9

SHA1
a95c79357f3e0a255d27fd019bd9cbbe14e33c41

SHA256
479f21fbf79194010559b462a3ce0ec68df6abd95bd4a4979064d4f05edc710f

SHA512
6b89a6f690c8235d43598297dcdbbf2b7c1a600fadfab2340b6c782f65b8a99f21ef5250eb412ac81f916afbb02982fb92a794f34311bd9e0a39f531e2b6d814

Download Submit
C:\Windows\system\ZgfKASr.exe

Filesize
2.1MB

MD5
cf916ad69fb1853d1cd9850505752859

SHA1
b836088abbddc99ab2fe5ffab895636f1d8fe44e

SHA256
0cd9103ec2aa6fa13e1ce7e07bbbb8b3d65806e30823a25b004e14e40af62a26

SHA512
01f7cffc5075a8249c27fbfa29b74dbeba4d29004df743cff817530438af929d42bdda66ccbf18e01c22068a6fb39d0791993f494893cfcb24065531f590788e

Download Submit
C:\Windows\system\ZikzVSz.exe

Filesize
2.1MB

MD5
6832d5f7fba93b91df46c5d8e501b835

SHA1
65545b174e1f0fc0af968651d435d171c0439cc3

SHA256
fb08a705036609bc4a16758e7910a261fa61b304b9aae9a2543fa83d8d021cb0

SHA512
fc3036571915902ecb98a81fedf9a12e7fd39cd971785b719665e4706df733ea370a955653ebd58cc2022fe46f1c2583f9f2cf7bb8cc28b8879c763ed66022e6

Download Submit
C:\Windows\system\czBaqrz.exe

Filesize
2.1MB

MD5
07b65e7968e084936baabbb0349e38f1

SHA1
c93c1ed3f5633b134d41ecf67a035342e1685892

SHA256
19a6f13e97287af0b9cca71af6d1da170da2db01baf41d36122bcff92f6bdd4c

SHA512
691456ef532317ef81659a5bfbc1c183771bb6dbbd7807f860e7ed61950815592c9947a9a1ea1fde73487bca003adea3a3978b345a49c18e1e93903846210651

Download Submit
C:\Windows\system\eUDtpSd.exe

Filesize
2.1MB

MD5
b62ed73de79c36b12daacad6f46d077c

SHA1
acb97e74d789cd2b6f432ed430afc843093e41a7

SHA256
58cafe79fdda42fd080ca538a791f63a5be303953f8e441af828f7fa0bdad4b8

SHA512
94af67c64e4320fd00603037822470ada1e52f32fe3dcf9455ca8644db7d52197ddc151fd19759d758ff4f920bb05a72b4e5762dd16d4f96ba02cc5547b2d33b

Download Submit
C:\Windows\system\iAEcEvi.exe

Filesize
2.1MB

MD5
d66fdecd3ba47b8bc88c1ab0e80c94fa

SHA1
9da36dc217ab418985a30455db22aa6fffe84d28

SHA256
bfe671257d4081b84d0a3ac85ae7358c34ada9dc7ab1d291cd9490ee5f29238c

SHA512
6a58cd12b85960affa2bee523bd565d30f5aa253ddfe294cd34c2fe5017573dca04af17203a0dc4d0a358dc14985e594b388dfdcbbe1b5cff59eba9c2f4f045c

Download Submit
C:\Windows\system\iASPzFa.exe

Filesize
2.1MB

MD5
f66cf7fd81b54a543becd0d5e9ab34a0

SHA1
c87fda7f2004a2a6ddd50eda3a50b03fb00e738a

SHA256
d81a10ad9cdcf2320b58eb850e45b965f6beacf5e58bab08da8d702e1a3c8d85

SHA512
27198ee6dc96862c3240f569374cc6ea1aaf0f26d0d0b14c7ded97f5a27e1be0a0015fd84df02e54ab79f2a5ccc077e61deaa962ec31fac9b9a140306c306a29

Download Submit
C:\Windows\system\kPcJoMk.exe

Filesize
2.1MB

MD5
7f17b77a86897679e1847ae01ab7fc03

SHA1
c1f4ccb254aef71dd984a7b1c2edbadbdbfc4364

SHA256
5e375282ad5f0c04e01c012d104b8dbf29f361a551650a70dc2c9f9265614681

SHA512
2e33f642b9c8ddbf72e027a4b0c22fd990f03c3016b2707c6ed6e929704391525465854eca9b2b8d2110bcd77864651032d2222d924ed1ab955bea4b8bbb1df7

Download Submit
C:\Windows\system\sJDMVfI.exe

Filesize
2.1MB

MD5
9173166091e330229b452e3d0b539c9a

SHA1
8eaaebbb5fff40ce13ecf47ac59f41afde6a9d0c

SHA256
3dbe5260843fedb27444e4165a685f3586e3eb0f446fc5b369b9f1adffa93d92

SHA512
02982d6c8a2641a841c95efaea06faa20beb9f6ee36c92580e1a772835753dc0045dd90ada41559868fccd94d52cfffc14dc174a205de878515c0856047241ad

Download Submit
C:\Windows\system\telFPCN.exe

Filesize
2.1MB

MD5
d487f0466d1ff549e0b558aa0423d9eb

SHA1
f66db866e55fc8da06c3e8ece4702614efe1f5c1

SHA256
3b683bbcaa834816552f54a4f1799b85e4c71776d4f49e6b3b5f32180c81b31f

SHA512
246e3803e939e5703e58ee446198bf785f234bc6b1fc4429c095b96e033b8dabd0d3b55d4c8f84d964a30e746e1a259869222041bb1dedf452a4c5644c843be3

Download Submit
C:\Windows\system\yBOMNXO.exe

Filesize
2.1MB

MD5
f77ea043d18ff700ac3fe778addf47cd

SHA1
4695c74a3bd23f6a542576bc3df2423af01f2426

SHA256
4f715dd483a8bbc7ba3204c4aaa980b779d6cb35b1cd0abbe20a96dfa42f71c6

SHA512
da09e009c6e7ab56d3c44ee39cad4ceb0a9ac66f355ffe9784e8dac5c7318926d3aa0b6eb101dac6456f177855f0e83f3f6b27071edb6a058d12e242ebeff5ca

Download Submit
C:\Windows\system\yqhxkHW.exe

Filesize
2.1MB

MD5
23e23fc01eaab3bff5369b4f9d0bc7e3

SHA1
becda9ba66e29acaf01497fd25508f0a31431fed

SHA256
c24de7746f5c7e160545cf164bb886234d31a7ac304110fd40188cd8cc4b1a50

SHA512
a37e339b58016fd9be88a40f72c5042f4cccb211a37cbf333c5c54c825f9d51ede730ae76b825ee614b0f01595173acf4565445d0e32b52067e88ad8acd7acdb

Download Submit
C:\Windows\system\zhDWNyP.exe

Filesize
2.1MB

MD5
c210090d623a53e203e387afb3ca7340

SHA1
2072459f0f875f8ff507e1badd8caf14c1db962a

SHA256
293d692d8accc2ae82e56692a7e2137141cb24b8ed10384447d0f9babe662f45

SHA512
4d82f98079fcfc896da4e8e59d302196262853a0f46653ffc671002e3ff1b4fb846c7b882f407c79bd7b242d21074d7571012b63fa36bc71e7b0e90106b9eda8

Download Submit
C:\Windows\system\zvMXNdQ.exe

Filesize
2.1MB

MD5
f7d8db446d8f47f15663fa4734cbfa32

SHA1
61700c75ba74a0cb4492ebe0432c3cb88c5e887c

SHA256
233ae6d6a672a53e786b9b8380dea9e50f7630c9ca7b993ef7c0b0b0af5a385c

SHA512
aa7a55569f9349570badbdac6d7a3eab0d00b6bead2278b882de806274cc628f0ea20da220f1499f1036942ba2a829c3e49e72f20099b38a489e4deb03a26991

Download Submit
\Windows\system\CsLeJVs.exe

Filesize
2.1MB

MD5
8b1b9105c600b0b3f5524ad283fa7767

SHA1
e6d64f0579711058116409da297983b3ee7ca8ff

SHA256
7e0c5b09b67dc3186661f5cfa52a593d13876b189044ec82337b2803df490de0

SHA512
c0b826f3b7656fd291cea9871ee3397d90ba78b45ba990e11f3fb9b50b7dd926665abb3d50c7e9aacc6cf7878aca4f0cb43e3a5d099b865c8bfddf6e969fec2b

Download Submit
\Windows\system\NdyQJae.exe

Filesize
2.1MB

MD5
6cb085b28257aaaa8fa53dfdbe7bb08e

SHA1
c1cbb41ce50e256ecdf4b1f82b9e0512040763a0

SHA256
a04a2a2e733253204a1a922fec44ed76f6c1610e1339896e9c1faa4411718eeb

SHA512
1650f3d6c78d399e90637c00c6273a4d5fd603036a0454a4e0053c5815ed32d7ce4a3c924a9b3e56f6274f1e070901405a459cc49a032718bd10cf1e30f7d953

Download Submit
\Windows\system\PpqUAPH.exe

Filesize
2.1MB

MD5
06eb86a4e57bd9b8199343b4f55802a8

SHA1
af7b86cdae52cdcb9a1ad33bf07f1cfebf971f23

SHA256
408f32a993eb0a535f258cf36933f96c671d9d5761222775330f453694cd2ebd

SHA512
6240455c1560e039447c21afff3da5bf5b0691cbdfe34861281387f60fe1d609893f82a8c576bc514a5ae511d7a279a2ef1554744010d2939fc0325f5470dd08

Download Submit
\Windows\system\hKlfHIH.exe

Filesize
2.1MB

MD5
56505183c50851f0d8406e7e39af96e7

SHA1
291406f16eda9e149c5a714b1a6a268f0469ae19

SHA256
61fb4dcc7881631e9e296ffeaf2a5be6583d7dbf19d990a48ce9b1a14ec543ed

SHA512
980426b4c8251d44609373eb8e7e5c7b7819305599b953f6d82db8676990f637dad09dc3fb53b72a6c078b9e66684e56f047eaf00463b58db14fd608bceeef8d

Download Submit
memory/760-118-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/1828-132-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2208-490-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2208-19-0x000007FEF566E000-0x000007FEF566F000-memory.dmp

Filesize
4KB

Download
memory/2208-18-0x0000000002BD0000-0x0000000002C50000-memory.dmp

Filesize
512KB

Download
memory/2208-133-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2208-110-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2208-130-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/2208-397-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/2404-123-0x00000000038A0000-0x0000000003C92000-memory.dmp

Filesize
3.9MB

Download
memory/2404-119-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2404-134-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-126-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-0-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2404-121-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2404-125-0x00000000038A0000-0x0000000003C92000-memory.dmp

Filesize
3.9MB

Download
memory/2404-131-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2404-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2404-7-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2404-117-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-113-0x00000000038A0000-0x0000000003C92000-memory.dmp

Filesize
3.9MB

Download
memory/2404-115-0x00000000038A0000-0x0000000003C92000-memory.dmp

Filesize
3.9MB

Download
memory/2404-135-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-116-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2508-124-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-120-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2636-129-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2660-112-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-111-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-122-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2756-114-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/2784-13-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/3024-127-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download