xmrig | ae88666e6d854bb575b7b2f1aab05ecbc90ab26e462cace1b5fee3614973dc83

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
Size

1.9MB
MD5

2dc27560dbe5b34d24d1950c6ddd9011
SHA1

86e5eb340d7c69b549d8fc9ae41cf72cf48fc85c
SHA256

ae88666e6d854bb575b7b2f1aab05ecbc90ab26e462cace1b5fee3614973dc83
SHA512

3a691bcc03e5cfaa98c8addb1e27957dd2e7dc257ecdff5f0b6cebd1e07e638a2462270358713933724d3b8410906592665896f3cedc90950d54e3338be38d54
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafr:NAB0

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/2620-13-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2664-194-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2612-191-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2556-189-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/1252-187-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2408-182-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/2872-180-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2484-178-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/2380-176-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/2652-174-0x000000013FB20000-0x000000013FF12000-memory.dmp	xmrig
behavioral1/memory/2528-171-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/2696-169-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2620-3883-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2528-3886-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/2484-3889-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/2652-3897-0x000000013FB20000-0x000000013FF12000-memory.dmp	xmrig
behavioral1/memory/2556-3902-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2872-3908-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/1252-3913-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2612-3919-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2408-3895-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/2380-3893-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/2664-3953-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2240-5037-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2036	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2620	xoyJKOS.exe
2664	CWpxYcs.exe
2696	FLDbqWu.exe
2528	aGzQQEk.exe
2652	JvJxTFp.exe
2380	zHxgFiQ.exe
2484	LtEHlsu.exe
2872	MnzWLKq.exe
2408	vTwJRns.exe
1252	xkdobBQ.exe
2556	wfVgolO.exe
2612	BDjrwBs.exe
2724	XKAneDJ.exe
2092	OCqWIux.exe
1652	twPgYfU.exe
1468	KCJwrSR.exe
1240	ZocKmwi.exe
1752	yKsqivh.exe
1524	XJuqknT.exe
1696	oObRefT.exe
1196	yfLjXQL.exe
2316	QEsvgPu.exe
2224	ruBUitp.exe
2864	WvpXtmz.exe
2740	PpeaiXU.exe
604	LDSNQir.exe
580	fpOBBHV.exe
2800	ufSuaMc.exe
2608	NUDIfaT.exe
2336	fIktiqw.exe
964	oiEDpUo.exe
1576	ZwfnWaa.exe
692	FAdFjyh.exe
1868	axopuyZ.exe
2264	UGJKOWR.exe
1992	vPleMVt.exe
920	NBkeuZD.exe
948	lMhsAdl.exe
888	mitzLXA.exe
1028	YTHkeSa.exe
1880	DWTXXJk.exe
1968	cgAcypG.exe
1128	vJHoOic.exe
2308	sdRJbNQ.exe
1944	pwAseQJ.exe
1724	EfbQQDp.exe
3028	KZYfKWI.exe
2020	BpVfiGt.exe
896	aZSyOnj.exe
548	fTttnOF.exe
1936	gUYZxpt.exe
2220	ocmSsIb.exe
2456	LhTjJOU.exe
1544	hYOFVPR.exe
2468	BHioLrG.exe
2508	DrkzmfT.exe
2788	DpOFXyp.exe
2400	kmIdCga.exe
2392	kGzkPxR.exe
2420	oRzWMHI.exe
2440	wUNYunG.exe
1624	TXGMIfi.exe
2232	OEVoQBe.exe
2548	ACSAlxI.exe

Loads dropped DLL 64 IoCs

pid	Process
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2240-1-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/files/0x000d000000015ccd-3.dat	upx
behavioral1/memory/2620-13-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/files/0x0034000000015d4e-14.dat	upx
behavioral1/files/0x000e0000000054ab-23.dat	upx
behavioral1/files/0x0007000000015d93-29.dat	upx
behavioral1/files/0x0008000000015d87-28.dat	upx
behavioral1/files/0x0007000000015e32-36.dat	upx
behavioral1/files/0x0009000000015f65-42.dat	upx
behavioral1/files/0x0007000000016cb0-46.dat	upx
behavioral1/files/0x0006000000016d07-57.dat	upx
behavioral1/files/0x0006000000016d20-67.dat	upx
behavioral1/files/0x0006000000016d3e-82.dat	upx
behavioral1/files/0x0006000000016d43-87.dat	upx
behavioral1/files/0x0006000000016d74-97.dat	upx
behavioral1/files/0x0006000000016d8e-102.dat	upx
behavioral1/files/0x000600000001704a-129.dat	upx
behavioral1/files/0x0006000000016dbe-126.dat	upx
behavioral1/files/0x0034000000015d56-139.dat	upx
behavioral1/files/0x000600000001708b-143.dat	upx
behavioral1/files/0x0006000000017437-157.dat	upx
behavioral1/files/0x0005000000018665-195.dat	upx
behavioral1/memory/2664-194-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2612-191-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2556-189-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/1252-187-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/files/0x0031000000018649-183.dat	upx
behavioral1/memory/2408-182-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/memory/2872-180-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/2484-178-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/memory/2380-176-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/memory/2652-174-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/memory/2528-171-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/memory/2696-169-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/files/0x0015000000018644-164.dat	upx
behavioral1/files/0x00060000000173d0-154.dat	upx
behavioral1/files/0x00060000000171df-150.dat	upx
behavioral1/files/0x0006000000016db1-136.dat	upx
behavioral1/files/0x0006000000016db9-123.dat	upx
behavioral1/files/0x0006000000016da5-113.dat	upx
behavioral1/files/0x0006000000016d9d-109.dat	upx
behavioral1/files/0x0006000000016d5f-92.dat	upx
behavioral1/files/0x0006000000016d3a-77.dat	upx
behavioral1/files/0x0006000000016d34-72.dat	upx
behavioral1/files/0x0006000000016d18-62.dat	upx
behavioral1/files/0x0006000000016cdc-51.dat	upx
behavioral1/memory/2620-3883-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/2528-3886-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/memory/2484-3889-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/memory/2652-3897-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/memory/2556-3902-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2872-3908-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/1252-3913-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2612-3919-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2408-3895-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/memory/2380-3893-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/memory/2664-3953-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2240-5037-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XYfoPLm.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\QyNXjMt.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\FLDbqWu.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\rIqYcZA.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\tBjpmeN.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\DnChbCR.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\uMbUmmD.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\wEKlzQO.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\HrHwZHP.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\yGvmKET.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\yThYvkf.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\vHFLRbx.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\lICMLhc.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\JcNZXIW.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\AbEwUVo.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\fbYeeCE.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\rnJgFXw.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\LYCNKaR.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\NVOGalm.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\SvzieVw.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\osRwyBa.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\ZWUgmeR.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\qBYrXLn.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\CpfmITP.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\tqXxCpD.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\jOTiBQY.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\EXSnySZ.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\CoOVtSH.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\BeQaTzO.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\HDtOBWm.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\SDbiDkE.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\AKZPKKf.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\FpTLEgd.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\IoMewpR.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\IEvgFVv.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\GroFYNo.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\BcrFNPR.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\nyMSXBb.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\WqPZkHL.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\QUZFDnm.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\nysPtUZ.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\DkvGdAl.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\hLEpBkY.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\vFciVSN.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\gJEgqXn.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\HESLqww.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\oNeYLUb.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\hhCVGiM.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\YTlpUMl.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\MGdYQAl.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\oURUjNP.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\kZsyONs.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\JQDYVrI.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\ylGMVQl.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\PmWSBNx.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\NuaMIcb.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\eyYJYDA.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\tgLejTs.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\eGkRhAJ.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\MDNoRYE.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\HyaxIAq.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\EeMelEU.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\HLBquwq.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
File created	C:\Windows\System\kIAtHlg.exe	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2036	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
Token: SeDebugPrivilege	2036	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2036	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	29
PID 2240 wrote to memory of 2036	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	29
PID 2240 wrote to memory of 2036	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	29
PID 2240 wrote to memory of 2620	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2620	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2620	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2664	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2664	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2664	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2696	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	32
PID 2240 wrote to memory of 2696	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	32
PID 2240 wrote to memory of 2696	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	32
PID 2240 wrote to memory of 2528	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	33
PID 2240 wrote to memory of 2528	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	33
PID 2240 wrote to memory of 2528	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	33
PID 2240 wrote to memory of 2652	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	34
PID 2240 wrote to memory of 2652	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	34
PID 2240 wrote to memory of 2652	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	34
PID 2240 wrote to memory of 2380	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	35
PID 2240 wrote to memory of 2380	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	35
PID 2240 wrote to memory of 2380	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	35
PID 2240 wrote to memory of 2484	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	36
PID 2240 wrote to memory of 2484	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	36
PID 2240 wrote to memory of 2484	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	36
PID 2240 wrote to memory of 2872	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	37
PID 2240 wrote to memory of 2872	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	37
PID 2240 wrote to memory of 2872	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	37
PID 2240 wrote to memory of 2408	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	38
PID 2240 wrote to memory of 2408	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	38
PID 2240 wrote to memory of 2408	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	38
PID 2240 wrote to memory of 1252	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	39
PID 2240 wrote to memory of 1252	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	39
PID 2240 wrote to memory of 1252	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	39
PID 2240 wrote to memory of 2556	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	40
PID 2240 wrote to memory of 2556	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	40
PID 2240 wrote to memory of 2556	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	40
PID 2240 wrote to memory of 2612	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	41
PID 2240 wrote to memory of 2612	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	41
PID 2240 wrote to memory of 2612	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	41
PID 2240 wrote to memory of 2724	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	42
PID 2240 wrote to memory of 2724	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	42
PID 2240 wrote to memory of 2724	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	42
PID 2240 wrote to memory of 2092	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	43
PID 2240 wrote to memory of 2092	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	43
PID 2240 wrote to memory of 2092	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	43
PID 2240 wrote to memory of 1652	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	44
PID 2240 wrote to memory of 1652	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	44
PID 2240 wrote to memory of 1652	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	44
PID 2240 wrote to memory of 1468	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	45
PID 2240 wrote to memory of 1468	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	45
PID 2240 wrote to memory of 1468	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	45
PID 2240 wrote to memory of 1240	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	46
PID 2240 wrote to memory of 1240	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	46
PID 2240 wrote to memory of 1240	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	46
PID 2240 wrote to memory of 1752	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	47
PID 2240 wrote to memory of 1752	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	47
PID 2240 wrote to memory of 1752	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	47
PID 2240 wrote to memory of 1524	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	48
PID 2240 wrote to memory of 1524	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	48
PID 2240 wrote to memory of 1524	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	48
PID 2240 wrote to memory of 1696	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	49
PID 2240 wrote to memory of 1696	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	49
PID 2240 wrote to memory of 1696	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	49
PID 2240 wrote to memory of 1196	2240	2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2dc27560dbe5b34d24d1950c6ddd9011_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2036
- C:\Windows\System\xoyJKOS.exe
  C:\Windows\System\xoyJKOS.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\CWpxYcs.exe
  C:\Windows\System\CWpxYcs.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\FLDbqWu.exe
  C:\Windows\System\FLDbqWu.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\aGzQQEk.exe
  C:\Windows\System\aGzQQEk.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\JvJxTFp.exe
  C:\Windows\System\JvJxTFp.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\zHxgFiQ.exe
  C:\Windows\System\zHxgFiQ.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\LtEHlsu.exe
  C:\Windows\System\LtEHlsu.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\MnzWLKq.exe
  C:\Windows\System\MnzWLKq.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\vTwJRns.exe
  C:\Windows\System\vTwJRns.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\xkdobBQ.exe
  C:\Windows\System\xkdobBQ.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\wfVgolO.exe
  C:\Windows\System\wfVgolO.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\BDjrwBs.exe
  C:\Windows\System\BDjrwBs.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\XKAneDJ.exe
  C:\Windows\System\XKAneDJ.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\OCqWIux.exe
  C:\Windows\System\OCqWIux.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\twPgYfU.exe
  C:\Windows\System\twPgYfU.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\KCJwrSR.exe
  C:\Windows\System\KCJwrSR.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\ZocKmwi.exe
  C:\Windows\System\ZocKmwi.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\yKsqivh.exe
  C:\Windows\System\yKsqivh.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\XJuqknT.exe
  C:\Windows\System\XJuqknT.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\oObRefT.exe
  C:\Windows\System\oObRefT.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\yfLjXQL.exe
  C:\Windows\System\yfLjXQL.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\WvpXtmz.exe
  C:\Windows\System\WvpXtmz.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\QEsvgPu.exe
  C:\Windows\System\QEsvgPu.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\PpeaiXU.exe
  C:\Windows\System\PpeaiXU.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\ruBUitp.exe
  C:\Windows\System\ruBUitp.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\LDSNQir.exe
  C:\Windows\System\LDSNQir.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\fpOBBHV.exe
  C:\Windows\System\fpOBBHV.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\ufSuaMc.exe
  C:\Windows\System\ufSuaMc.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\NUDIfaT.exe
  C:\Windows\System\NUDIfaT.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\fIktiqw.exe
  C:\Windows\System\fIktiqw.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\oiEDpUo.exe
  C:\Windows\System\oiEDpUo.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\FAdFjyh.exe
  C:\Windows\System\FAdFjyh.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\ZwfnWaa.exe
  C:\Windows\System\ZwfnWaa.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\axopuyZ.exe
  C:\Windows\System\axopuyZ.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\UGJKOWR.exe
  C:\Windows\System\UGJKOWR.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\vPleMVt.exe
  C:\Windows\System\vPleMVt.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\NBkeuZD.exe
  C:\Windows\System\NBkeuZD.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\lMhsAdl.exe
  C:\Windows\System\lMhsAdl.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\mitzLXA.exe
  C:\Windows\System\mitzLXA.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\YTHkeSa.exe
  C:\Windows\System\YTHkeSa.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\DWTXXJk.exe
  C:\Windows\System\DWTXXJk.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\cgAcypG.exe
  C:\Windows\System\cgAcypG.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\vJHoOic.exe
  C:\Windows\System\vJHoOic.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\sdRJbNQ.exe
  C:\Windows\System\sdRJbNQ.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\pwAseQJ.exe
  C:\Windows\System\pwAseQJ.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\EfbQQDp.exe
  C:\Windows\System\EfbQQDp.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\KZYfKWI.exe
  C:\Windows\System\KZYfKWI.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\BpVfiGt.exe
  C:\Windows\System\BpVfiGt.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\aZSyOnj.exe
  C:\Windows\System\aZSyOnj.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\fTttnOF.exe
  C:\Windows\System\fTttnOF.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\gUYZxpt.exe
  C:\Windows\System\gUYZxpt.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\ocmSsIb.exe
  C:\Windows\System\ocmSsIb.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\LhTjJOU.exe
  C:\Windows\System\LhTjJOU.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\hYOFVPR.exe
  C:\Windows\System\hYOFVPR.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\BHioLrG.exe
  C:\Windows\System\BHioLrG.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\DrkzmfT.exe
  C:\Windows\System\DrkzmfT.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\DpOFXyp.exe
  C:\Windows\System\DpOFXyp.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\kmIdCga.exe
  C:\Windows\System\kmIdCga.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\kGzkPxR.exe
  C:\Windows\System\kGzkPxR.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\oRzWMHI.exe
  C:\Windows\System\oRzWMHI.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\wUNYunG.exe
  C:\Windows\System\wUNYunG.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\TXGMIfi.exe
  C:\Windows\System\TXGMIfi.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\OEVoQBe.exe
  C:\Windows\System\OEVoQBe.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\ACSAlxI.exe
  C:\Windows\System\ACSAlxI.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\AVSKTob.exe
  C:\Windows\System\AVSKTob.exe
  2⤵
  PID:2684
- C:\Windows\System\MibLIGN.exe
  C:\Windows\System\MibLIGN.exe
  2⤵
  PID:2716
- C:\Windows\System\yThYvkf.exe
  C:\Windows\System\yThYvkf.exe
  2⤵
  PID:1620
- C:\Windows\System\kNpFiwP.exe
  C:\Windows\System\kNpFiwP.exe
  2⤵
  PID:2168
- C:\Windows\System\GYrMgdY.exe
  C:\Windows\System\GYrMgdY.exe
  2⤵
  PID:2252
- C:\Windows\System\OuMOBYC.exe
  C:\Windows\System\OuMOBYC.exe
  2⤵
  PID:1852
- C:\Windows\System\XvXAmbS.exe
  C:\Windows\System\XvXAmbS.exe
  2⤵
  PID:2100
- C:\Windows\System\fNiGAdD.exe
  C:\Windows\System\fNiGAdD.exe
  2⤵
  PID:1440
- C:\Windows\System\YmkggNy.exe
  C:\Windows\System\YmkggNy.exe
  2⤵
  PID:332
- C:\Windows\System\ZPwJglL.exe
  C:\Windows\System\ZPwJglL.exe
  2⤵
  PID:2044
- C:\Windows\System\mQXxJAM.exe
  C:\Windows\System\mQXxJAM.exe
  2⤵
  PID:2196
- C:\Windows\System\pqwrzCb.exe
  C:\Windows\System\pqwrzCb.exe
  2⤵
  PID:2552
- C:\Windows\System\hvYEuyQ.exe
  C:\Windows\System\hvYEuyQ.exe
  2⤵
  PID:608
- C:\Windows\System\npXRgHa.exe
  C:\Windows\System\npXRgHa.exe
  2⤵
  PID:2736
- C:\Windows\System\lVAJpoK.exe
  C:\Windows\System\lVAJpoK.exe
  2⤵
  PID:2572
- C:\Windows\System\jPWtamh.exe
  C:\Windows\System\jPWtamh.exe
  2⤵
  PID:668
- C:\Windows\System\ADsaORY.exe
  C:\Windows\System\ADsaORY.exe
  2⤵
  PID:1064
- C:\Windows\System\UfogscG.exe
  C:\Windows\System\UfogscG.exe
  2⤵
  PID:1792
- C:\Windows\System\VhIkxOx.exe
  C:\Windows\System\VhIkxOx.exe
  2⤵
  PID:3016
- C:\Windows\System\xYpDGzd.exe
  C:\Windows\System\xYpDGzd.exe
  2⤵
  PID:1200
- C:\Windows\System\mqBERmd.exe
  C:\Windows\System\mqBERmd.exe
  2⤵
  PID:1556
- C:\Windows\System\iYnnYee.exe
  C:\Windows\System\iYnnYee.exe
  2⤵
  PID:1612
- C:\Windows\System\eoDQRtc.exe
  C:\Windows\System\eoDQRtc.exe
  2⤵
  PID:2516
- C:\Windows\System\FVfNBEw.exe
  C:\Windows\System\FVfNBEw.exe
  2⤵
  PID:2560
- C:\Windows\System\mIpLtfp.exe
  C:\Windows\System\mIpLtfp.exe
  2⤵
  PID:404
- C:\Windows\System\TRHWMuj.exe
  C:\Windows\System\TRHWMuj.exe
  2⤵
  PID:968
- C:\Windows\System\lpiyqRE.exe
  C:\Windows\System\lpiyqRE.exe
  2⤵
  PID:1908
- C:\Windows\System\HYzipUZ.exe
  C:\Windows\System\HYzipUZ.exe
  2⤵
  PID:2236
- C:\Windows\System\KsZpwLS.exe
  C:\Windows\System\KsZpwLS.exe
  2⤵
  PID:1940
- C:\Windows\System\GOVcfmU.exe
  C:\Windows\System\GOVcfmU.exe
  2⤵
  PID:108
- C:\Windows\System\xJLfNrI.exe
  C:\Windows\System\xJLfNrI.exe
  2⤵
  PID:2928
- C:\Windows\System\MtzNXIw.exe
  C:\Windows\System\MtzNXIw.exe
  2⤵
  PID:908
- C:\Windows\System\zHDDgjM.exe
  C:\Windows\System\zHDDgjM.exe
  2⤵
  PID:1804
- C:\Windows\System\lnzkPLI.exe
  C:\Windows\System\lnzkPLI.exe
  2⤵
  PID:2212
- C:\Windows\System\qEwUhQM.exe
  C:\Windows\System\qEwUhQM.exe
  2⤵
  PID:2692
- C:\Windows\System\swDOGEt.exe
  C:\Windows\System\swDOGEt.exe
  2⤵
  PID:2936
- C:\Windows\System\BDlLemT.exe
  C:\Windows\System\BDlLemT.exe
  2⤵
  PID:2520
- C:\Windows\System\UVwRdtP.exe
  C:\Windows\System\UVwRdtP.exe
  2⤵
  PID:564
- C:\Windows\System\gTfyWmX.exe
  C:\Windows\System\gTfyWmX.exe
  2⤵
  PID:2396
- C:\Windows\System\zaEgUTR.exe
  C:\Windows\System\zaEgUTR.exe
  2⤵
  PID:3036
- C:\Windows\System\ScwMsMd.exe
  C:\Windows\System\ScwMsMd.exe
  2⤵
  PID:2580
- C:\Windows\System\efekazB.exe
  C:\Windows\System\efekazB.exe
  2⤵
  PID:2160
- C:\Windows\System\nyTwXOq.exe
  C:\Windows\System\nyTwXOq.exe
  2⤵
  PID:2248
- C:\Windows\System\JyXDwTG.exe
  C:\Windows\System\JyXDwTG.exe
  2⤵
  PID:2644
- C:\Windows\System\XzJrXKL.exe
  C:\Windows\System\XzJrXKL.exe
  2⤵
  PID:2636
- C:\Windows\System\KiSwvkN.exe
  C:\Windows\System\KiSwvkN.exe
  2⤵
  PID:2128
- C:\Windows\System\qcoAHpj.exe
  C:\Windows\System\qcoAHpj.exe
  2⤵
  PID:1488
- C:\Windows\System\hmVvNYh.exe
  C:\Windows\System\hmVvNYh.exe
  2⤵
  PID:1084
- C:\Windows\System\tNqOvOX.exe
  C:\Windows\System\tNqOvOX.exe
  2⤵
  PID:2584
- C:\Windows\System\tLVffmo.exe
  C:\Windows\System\tLVffmo.exe
  2⤵
  PID:2140
- C:\Windows\System\XiKwAHi.exe
  C:\Windows\System\XiKwAHi.exe
  2⤵
  PID:2884
- C:\Windows\System\ooFIEeD.exe
  C:\Windows\System\ooFIEeD.exe
  2⤵
  PID:1604
- C:\Windows\System\ZcQbuCK.exe
  C:\Windows\System\ZcQbuCK.exe
  2⤵
  PID:1416
- C:\Windows\System\RScRwVN.exe
  C:\Windows\System\RScRwVN.exe
  2⤵
  PID:1172
- C:\Windows\System\NDzffSw.exe
  C:\Windows\System\NDzffSw.exe
  2⤵
  PID:2772
- C:\Windows\System\KUmOeHd.exe
  C:\Windows\System\KUmOeHd.exe
  2⤵
  PID:644
- C:\Windows\System\EeMelEU.exe
  C:\Windows\System\EeMelEU.exe
  2⤵
  PID:1004
- C:\Windows\System\asZxJpa.exe
  C:\Windows\System\asZxJpa.exe
  2⤵
  PID:1432
- C:\Windows\System\teLseMQ.exe
  C:\Windows\System\teLseMQ.exe
  2⤵
  PID:3056
- C:\Windows\System\bRxEaQh.exe
  C:\Windows\System\bRxEaQh.exe
  2⤵
  PID:2284
- C:\Windows\System\FGbOxkM.exe
  C:\Windows\System\FGbOxkM.exe
  2⤵
  PID:2828
- C:\Windows\System\XRdITId.exe
  C:\Windows\System\XRdITId.exe
  2⤵
  PID:2068
- C:\Windows\System\DgskVqy.exe
  C:\Windows\System\DgskVqy.exe
  2⤵
  PID:2996
- C:\Windows\System\OpjnxYr.exe
  C:\Windows\System\OpjnxYr.exe
  2⤵
  PID:2524
- C:\Windows\System\iRrvuPJ.exe
  C:\Windows\System\iRrvuPJ.exe
  2⤵
  PID:2432
- C:\Windows\System\YtffzaL.exe
  C:\Windows\System\YtffzaL.exe
  2⤵
  PID:2348
- C:\Windows\System\UbAyMBg.exe
  C:\Windows\System\UbAyMBg.exe
  2⤵
  PID:1060
- C:\Windows\System\BzfxBMU.exe
  C:\Windows\System\BzfxBMU.exe
  2⤵
  PID:2796
- C:\Windows\System\NuaMIcb.exe
  C:\Windows\System\NuaMIcb.exe
  2⤵
  PID:2592
- C:\Windows\System\hoyDWnF.exe
  C:\Windows\System\hoyDWnF.exe
  2⤵
  PID:880
- C:\Windows\System\fDHcIyw.exe
  C:\Windows\System\fDHcIyw.exe
  2⤵
  PID:2084
- C:\Windows\System\rLUfEaU.exe
  C:\Windows\System\rLUfEaU.exe
  2⤵
  PID:2312
- C:\Windows\System\cEUbzkJ.exe
  C:\Windows\System\cEUbzkJ.exe
  2⤵
  PID:872
- C:\Windows\System\GytnTXP.exe
  C:\Windows\System\GytnTXP.exe
  2⤵
  PID:1256
- C:\Windows\System\BFTQScm.exe
  C:\Windows\System\BFTQScm.exe
  2⤵
  PID:828
- C:\Windows\System\gLgbuwV.exe
  C:\Windows\System\gLgbuwV.exe
  2⤵
  PID:2868
- C:\Windows\System\LlyTRYo.exe
  C:\Windows\System\LlyTRYo.exe
  2⤵
  PID:824
- C:\Windows\System\KsMLdYy.exe
  C:\Windows\System\KsMLdYy.exe
  2⤵
  PID:2328
- C:\Windows\System\dhciOZH.exe
  C:\Windows\System\dhciOZH.exe
  2⤵
  PID:2464
- C:\Windows\System\aAywhwl.exe
  C:\Windows\System\aAywhwl.exe
  2⤵
  PID:1756
- C:\Windows\System\jRzdgqo.exe
  C:\Windows\System\jRzdgqo.exe
  2⤵
  PID:2268
- C:\Windows\System\CxeHgXc.exe
  C:\Windows\System\CxeHgXc.exe
  2⤵
  PID:2616
- C:\Windows\System\IlzQVYk.exe
  C:\Windows\System\IlzQVYk.exe
  2⤵
  PID:1676
- C:\Windows\System\VSYYKQO.exe
  C:\Windows\System\VSYYKQO.exe
  2⤵
  PID:2728
- C:\Windows\System\QIZeFjQ.exe
  C:\Windows\System\QIZeFjQ.exe
  2⤵
  PID:488
- C:\Windows\System\abJnVzD.exe
  C:\Windows\System\abJnVzD.exe
  2⤵
  PID:560
- C:\Windows\System\womlMUQ.exe
  C:\Windows\System\womlMUQ.exe
  2⤵
  PID:2352
- C:\Windows\System\ERqODvt.exe
  C:\Windows\System\ERqODvt.exe
  2⤵
  PID:912
- C:\Windows\System\scUihFT.exe
  C:\Windows\System\scUihFT.exe
  2⤵
  PID:588
- C:\Windows\System\ErChmcv.exe
  C:\Windows\System\ErChmcv.exe
  2⤵
  PID:2460
- C:\Windows\System\QypdptD.exe
  C:\Windows\System\QypdptD.exe
  2⤵
  PID:2060
- C:\Windows\System\sIfONSR.exe
  C:\Windows\System\sIfONSR.exe
  2⤵
  PID:2744
- C:\Windows\System\MsVjRMi.exe
  C:\Windows\System\MsVjRMi.exe
  2⤵
  PID:2624
- C:\Windows\System\vzeORui.exe
  C:\Windows\System\vzeORui.exe
  2⤵
  PID:2372
- C:\Windows\System\lXbnqae.exe
  C:\Windows\System\lXbnqae.exe
  2⤵
  PID:1732
- C:\Windows\System\dsjquIX.exe
  C:\Windows\System\dsjquIX.exe
  2⤵
  PID:2064
- C:\Windows\System\xQYorhY.exe
  C:\Windows\System\xQYorhY.exe
  2⤵
  PID:336
- C:\Windows\System\VlBdkzM.exe
  C:\Windows\System\VlBdkzM.exe
  2⤵
  PID:3076
- C:\Windows\System\MnZDrYn.exe
  C:\Windows\System\MnZDrYn.exe
  2⤵
  PID:3092
- C:\Windows\System\VjhOuvQ.exe
  C:\Windows\System\VjhOuvQ.exe
  2⤵
  PID:3108
- C:\Windows\System\fBHupfm.exe
  C:\Windows\System\fBHupfm.exe
  2⤵
  PID:3124
- C:\Windows\System\KkDKmGw.exe
  C:\Windows\System\KkDKmGw.exe
  2⤵
  PID:3140
- C:\Windows\System\hfYoLaQ.exe
  C:\Windows\System\hfYoLaQ.exe
  2⤵
  PID:3216
- C:\Windows\System\zLmOmQY.exe
  C:\Windows\System\zLmOmQY.exe
  2⤵
  PID:3232
- C:\Windows\System\LhixCLP.exe
  C:\Windows\System\LhixCLP.exe
  2⤵
  PID:3248
- C:\Windows\System\dvOWyXg.exe
  C:\Windows\System\dvOWyXg.exe
  2⤵
  PID:3264
- C:\Windows\System\JQOCIgQ.exe
  C:\Windows\System\JQOCIgQ.exe
  2⤵
  PID:3280
- C:\Windows\System\mzCNeJD.exe
  C:\Windows\System\mzCNeJD.exe
  2⤵
  PID:3296
- C:\Windows\System\CQlXIbY.exe
  C:\Windows\System\CQlXIbY.exe
  2⤵
  PID:3312
- C:\Windows\System\jflgbuP.exe
  C:\Windows\System\jflgbuP.exe
  2⤵
  PID:3332
- C:\Windows\System\NNFVWZp.exe
  C:\Windows\System\NNFVWZp.exe
  2⤵
  PID:3348
- C:\Windows\System\yocxLvZ.exe
  C:\Windows\System\yocxLvZ.exe
  2⤵
  PID:3364
- C:\Windows\System\zotNJCE.exe
  C:\Windows\System\zotNJCE.exe
  2⤵
  PID:3380
- C:\Windows\System\cHcoVMY.exe
  C:\Windows\System\cHcoVMY.exe
  2⤵
  PID:3396
- C:\Windows\System\zsLheUX.exe
  C:\Windows\System\zsLheUX.exe
  2⤵
  PID:3420
- C:\Windows\System\QbcYopx.exe
  C:\Windows\System\QbcYopx.exe
  2⤵
  PID:3436
- C:\Windows\System\RfrVyAF.exe
  C:\Windows\System\RfrVyAF.exe
  2⤵
  PID:3452
- C:\Windows\System\EqKMZcf.exe
  C:\Windows\System\EqKMZcf.exe
  2⤵
  PID:3468
- C:\Windows\System\bKdmEpL.exe
  C:\Windows\System\bKdmEpL.exe
  2⤵
  PID:3484
- C:\Windows\System\BrSglyI.exe
  C:\Windows\System\BrSglyI.exe
  2⤵
  PID:3504
- C:\Windows\System\DNGSjeF.exe
  C:\Windows\System\DNGSjeF.exe
  2⤵
  PID:3520
- C:\Windows\System\qDnvvtn.exe
  C:\Windows\System\qDnvvtn.exe
  2⤵
  PID:3540
- C:\Windows\System\jjcmxWf.exe
  C:\Windows\System\jjcmxWf.exe
  2⤵
  PID:3556
- C:\Windows\System\dIYyElU.exe
  C:\Windows\System\dIYyElU.exe
  2⤵
  PID:3604
- C:\Windows\System\QJYBXLJ.exe
  C:\Windows\System\QJYBXLJ.exe
  2⤵
  PID:3624
- C:\Windows\System\Gxokblm.exe
  C:\Windows\System\Gxokblm.exe
  2⤵
  PID:3640
- C:\Windows\System\zLInywt.exe
  C:\Windows\System\zLInywt.exe
  2⤵
  PID:3656
- C:\Windows\System\WXarHtC.exe
  C:\Windows\System\WXarHtC.exe
  2⤵
  PID:3672
- C:\Windows\System\HnAzhvP.exe
  C:\Windows\System\HnAzhvP.exe
  2⤵
  PID:3688
- C:\Windows\System\oimdReA.exe
  C:\Windows\System\oimdReA.exe
  2⤵
  PID:3708
- C:\Windows\System\fsPTbht.exe
  C:\Windows\System\fsPTbht.exe
  2⤵
  PID:3724
- C:\Windows\System\xfNhBKQ.exe
  C:\Windows\System\xfNhBKQ.exe
  2⤵
  PID:3740
- C:\Windows\System\FsIuPGn.exe
  C:\Windows\System\FsIuPGn.exe
  2⤵
  PID:3756
- C:\Windows\System\vAxzcuv.exe
  C:\Windows\System\vAxzcuv.exe
  2⤵
  PID:3772
- C:\Windows\System\ReStcmf.exe
  C:\Windows\System\ReStcmf.exe
  2⤵
  PID:3788
- C:\Windows\System\gGbSnJM.exe
  C:\Windows\System\gGbSnJM.exe
  2⤵
  PID:3804
- C:\Windows\System\MQUZYMj.exe
  C:\Windows\System\MQUZYMj.exe
  2⤵
  PID:3820
- C:\Windows\System\Pukbmha.exe
  C:\Windows\System\Pukbmha.exe
  2⤵
  PID:3836
- C:\Windows\System\ZvRMZAg.exe
  C:\Windows\System\ZvRMZAg.exe
  2⤵
  PID:3904
- C:\Windows\System\aGxfHTc.exe
  C:\Windows\System\aGxfHTc.exe
  2⤵
  PID:3920
- C:\Windows\System\PAbkjsI.exe
  C:\Windows\System\PAbkjsI.exe
  2⤵
  PID:3936
- C:\Windows\System\twlhYCz.exe
  C:\Windows\System\twlhYCz.exe
  2⤵
  PID:3952
- C:\Windows\System\rgJDNzJ.exe
  C:\Windows\System\rgJDNzJ.exe
  2⤵
  PID:3968
- C:\Windows\System\iKrViNp.exe
  C:\Windows\System\iKrViNp.exe
  2⤵
  PID:3984
- C:\Windows\System\RdjxXUL.exe
  C:\Windows\System\RdjxXUL.exe
  2⤵
  PID:4016
- C:\Windows\System\akqhclN.exe
  C:\Windows\System\akqhclN.exe
  2⤵
  PID:4032
- C:\Windows\System\pCFWFAj.exe
  C:\Windows\System\pCFWFAj.exe
  2⤵
  PID:4092
- C:\Windows\System\ECvZrqm.exe
  C:\Windows\System\ECvZrqm.exe
  2⤵
  PID:1664
- C:\Windows\System\mIDORTG.exe
  C:\Windows\System\mIDORTG.exe
  2⤵
  PID:1600
- C:\Windows\System\glfOClW.exe
  C:\Windows\System\glfOClW.exe
  2⤵
  PID:2004
- C:\Windows\System\YNaVsvP.exe
  C:\Windows\System\YNaVsvP.exe
  2⤵
  PID:380
- C:\Windows\System\RuTocGG.exe
  C:\Windows\System\RuTocGG.exe
  2⤵
  PID:2204
- C:\Windows\System\tfksqYb.exe
  C:\Windows\System\tfksqYb.exe
  2⤵
  PID:3120
- C:\Windows\System\SXMGLVU.exe
  C:\Windows\System\SXMGLVU.exe
  2⤵
  PID:3176
- C:\Windows\System\RnxarEO.exe
  C:\Windows\System\RnxarEO.exe
  2⤵
  PID:3188
- C:\Windows\System\XOUZjnA.exe
  C:\Windows\System\XOUZjnA.exe
  2⤵
  PID:3204
- C:\Windows\System\cFvAdyK.exe
  C:\Windows\System\cFvAdyK.exe
  2⤵
  PID:3148
- C:\Windows\System\sSrnfHR.exe
  C:\Windows\System\sSrnfHR.exe
  2⤵
  PID:3256
- C:\Windows\System\BPyKIKi.exe
  C:\Windows\System\BPyKIKi.exe
  2⤵
  PID:3528
- C:\Windows\System\gHFyInb.exe
  C:\Windows\System\gHFyInb.exe
  2⤵
  PID:3360
- C:\Windows\System\SwlQPDS.exe
  C:\Windows\System\SwlQPDS.exe
  2⤵
  PID:3460
- C:\Windows\System\GLcwzCE.exe
  C:\Windows\System\GLcwzCE.exe
  2⤵
  PID:3536
- C:\Windows\System\cGExAsu.exe
  C:\Windows\System\cGExAsu.exe
  2⤵
  PID:3576
- C:\Windows\System\FZfiGul.exe
  C:\Windows\System\FZfiGul.exe
  2⤵
  PID:2324
- C:\Windows\System\FTEPcye.exe
  C:\Windows\System\FTEPcye.exe
  2⤵
  PID:3636
- C:\Windows\System\vZOuFEj.exe
  C:\Windows\System\vZOuFEj.exe
  2⤵
  PID:3444
- C:\Windows\System\hhxWpXb.exe
  C:\Windows\System\hhxWpXb.exe
  2⤵
  PID:3512
- C:\Windows\System\tozmXaS.exe
  C:\Windows\System\tozmXaS.exe
  2⤵
  PID:3668
- C:\Windows\System\gYwBybA.exe
  C:\Windows\System\gYwBybA.exe
  2⤵
  PID:3732
- C:\Windows\System\pXABAdw.exe
  C:\Windows\System\pXABAdw.exe
  2⤵
  PID:3800
- C:\Windows\System\TXMxTBC.exe
  C:\Windows\System\TXMxTBC.exe
  2⤵
  PID:3304
- C:\Windows\System\RlxySoh.exe
  C:\Windows\System\RlxySoh.exe
  2⤵
  PID:3616
- C:\Windows\System\LxqAnjW.exe
  C:\Windows\System\LxqAnjW.exe
  2⤵
  PID:3680
- C:\Windows\System\EfcIkNU.exe
  C:\Windows\System\EfcIkNU.exe
  2⤵
  PID:3780
- C:\Windows\System\TFFZRNY.exe
  C:\Windows\System\TFFZRNY.exe
  2⤵
  PID:3844
- C:\Windows\System\JOBYcal.exe
  C:\Windows\System\JOBYcal.exe
  2⤵
  PID:3872
- C:\Windows\System\pNNUZew.exe
  C:\Windows\System\pNNUZew.exe
  2⤵
  PID:3892
- C:\Windows\System\oEyWWiY.exe
  C:\Windows\System\oEyWWiY.exe
  2⤵
  PID:3916
- C:\Windows\System\MghgqAM.exe
  C:\Windows\System\MghgqAM.exe
  2⤵
  PID:3932
- C:\Windows\System\vIvRyBx.exe
  C:\Windows\System\vIvRyBx.exe
  2⤵
  PID:2288
- C:\Windows\System\eLwcKUL.exe
  C:\Windows\System\eLwcKUL.exe
  2⤵
  PID:2988
- C:\Windows\System\qWkcPIv.exe
  C:\Windows\System\qWkcPIv.exe
  2⤵
  PID:4008
- C:\Windows\System\RziAecs.exe
  C:\Windows\System\RziAecs.exe
  2⤵
  PID:4028
- C:\Windows\System\SegfUrv.exe
  C:\Windows\System\SegfUrv.exe
  2⤵
  PID:4052
- C:\Windows\System\eMQPHhN.exe
  C:\Windows\System\eMQPHhN.exe
  2⤵
  PID:4068
- C:\Windows\System\fzMOkfL.exe
  C:\Windows\System\fzMOkfL.exe
  2⤵
  PID:4084
- C:\Windows\System\uFkSzGW.exe
  C:\Windows\System\uFkSzGW.exe
  2⤵
  PID:4044
- C:\Windows\System\KObzkQZ.exe
  C:\Windows\System\KObzkQZ.exe
  2⤵
  PID:1708
- C:\Windows\System\owcGxlv.exe
  C:\Windows\System\owcGxlv.exe
  2⤵
  PID:328
- C:\Windows\System\UvLfZed.exe
  C:\Windows\System\UvLfZed.exe
  2⤵
  PID:3104
- C:\Windows\System\CILLBSe.exe
  C:\Windows\System\CILLBSe.exe
  2⤵
  PID:2964
- C:\Windows\System\XLflVZt.exe
  C:\Windows\System\XLflVZt.exe
  2⤵
  PID:3172
- C:\Windows\System\MFkjGIu.exe
  C:\Windows\System\MFkjGIu.exe
  2⤵
  PID:3196
- C:\Windows\System\SCLtGIG.exe
  C:\Windows\System\SCLtGIG.exe
  2⤵
  PID:3152
- C:\Windows\System\LZHJycm.exe
  C:\Windows\System\LZHJycm.exe
  2⤵
  PID:3228
- C:\Windows\System\xXLcOEq.exe
  C:\Windows\System\xXLcOEq.exe
  2⤵
  PID:3428
- C:\Windows\System\HPrBVCO.exe
  C:\Windows\System\HPrBVCO.exe
  2⤵
  PID:3356
- C:\Windows\System\oXJLUav.exe
  C:\Windows\System\oXJLUav.exe
  2⤵
  PID:3492
- C:\Windows\System\bQeVkjN.exe
  C:\Windows\System\bQeVkjN.exe
  2⤵
  PID:3572
- C:\Windows\System\CZRSKfG.exe
  C:\Windows\System\CZRSKfG.exe
  2⤵
  PID:3592
- C:\Windows\System\WTgcfMS.exe
  C:\Windows\System\WTgcfMS.exe
  2⤵
  PID:3408
- C:\Windows\System\SnlpshS.exe
  C:\Windows\System\SnlpshS.exe
  2⤵
  PID:3828
- C:\Windows\System\bCqiwye.exe
  C:\Windows\System\bCqiwye.exe
  2⤵
  PID:3700
- C:\Windows\System\XsiOZKy.exe
  C:\Windows\System\XsiOZKy.exe
  2⤵
  PID:3796
- C:\Windows\System\UTefQzE.exe
  C:\Windows\System\UTefQzE.exe
  2⤵
  PID:3912
- C:\Windows\System\HobeThq.exe
  C:\Windows\System\HobeThq.exe
  2⤵
  PID:3652
- C:\Windows\System\hdqDJmK.exe
  C:\Windows\System\hdqDJmK.exe
  2⤵
  PID:3720
- C:\Windows\System\fdzTHdh.exe
  C:\Windows\System\fdzTHdh.exe
  2⤵
  PID:3864
- C:\Windows\System\rUvTrvQ.exe
  C:\Windows\System\rUvTrvQ.exe
  2⤵
  PID:3888
- C:\Windows\System\rfITrGz.exe
  C:\Windows\System\rfITrGz.exe
  2⤵
  PID:1280
- C:\Windows\System\vEgNTYW.exe
  C:\Windows\System\vEgNTYW.exe
  2⤵
  PID:4000
- C:\Windows\System\PReBCoT.exe
  C:\Windows\System\PReBCoT.exe
  2⤵
  PID:1340
- C:\Windows\System\JoLUQsF.exe
  C:\Windows\System\JoLUQsF.exe
  2⤵
  PID:452
- C:\Windows\System\KthtZfX.exe
  C:\Windows\System\KthtZfX.exe
  2⤵
  PID:3480
- C:\Windows\System\rWBRQPv.exe
  C:\Windows\System\rWBRQPv.exe
  2⤵
  PID:3856
- C:\Windows\System\qvWYdaX.exe
  C:\Windows\System\qvWYdaX.exe
  2⤵
  PID:3848
- C:\Windows\System\CshaxfB.exe
  C:\Windows\System\CshaxfB.exe
  2⤵
  PID:2880
- C:\Windows\System\dHIIwNM.exe
  C:\Windows\System\dHIIwNM.exe
  2⤵
  PID:3184
- C:\Windows\System\SpwoZOW.exe
  C:\Windows\System\SpwoZOW.exe
  2⤵
  PID:1492
- C:\Windows\System\Wvdwhis.exe
  C:\Windows\System\Wvdwhis.exe
  2⤵
  PID:3532
- C:\Windows\System\ISDREAC.exe
  C:\Windows\System\ISDREAC.exe
  2⤵
  PID:3476
- C:\Windows\System\oURUjNP.exe
  C:\Windows\System\oURUjNP.exe
  2⤵
  PID:4060
- C:\Windows\System\faGJgHc.exe
  C:\Windows\System\faGJgHc.exe
  2⤵
  PID:3084
- C:\Windows\System\HLBquwq.exe
  C:\Windows\System\HLBquwq.exe
  2⤵
  PID:3600
- C:\Windows\System\CeGUgSS.exe
  C:\Windows\System\CeGUgSS.exe
  2⤵
  PID:3880
- C:\Windows\System\obScqPU.exe
  C:\Windows\System\obScqPU.exe
  2⤵
  PID:3588
- C:\Windows\System\FKmnJlF.exe
  C:\Windows\System\FKmnJlF.exe
  2⤵
  PID:3136
- C:\Windows\System\QBJtIaT.exe
  C:\Windows\System\QBJtIaT.exe
  2⤵
  PID:3340
- C:\Windows\System\JzPxGHF.exe
  C:\Windows\System\JzPxGHF.exe
  2⤵
  PID:3884
- C:\Windows\System\wdBWpmk.exe
  C:\Windows\System\wdBWpmk.exe
  2⤵
  PID:1584
- C:\Windows\System\EuTQwAU.exe
  C:\Windows\System\EuTQwAU.exe
  2⤵
  PID:3552
- C:\Windows\System\fVGrvYa.exe
  C:\Windows\System\fVGrvYa.exe
  2⤵
  PID:3308
- C:\Windows\System\ZXntugm.exe
  C:\Windows\System\ZXntugm.exe
  2⤵
  PID:3372
- C:\Windows\System\HJoFdPk.exe
  C:\Windows\System\HJoFdPk.exe
  2⤵
  PID:3432
- C:\Windows\System\fuvlRcQ.exe
  C:\Windows\System\fuvlRcQ.exe
  2⤵
  PID:4076
- C:\Windows\System\kbQzeMK.exe
  C:\Windows\System\kbQzeMK.exe
  2⤵
  PID:3964
- C:\Windows\System\sCeXyxc.exe
  C:\Windows\System\sCeXyxc.exe
  2⤵
  PID:3224
- C:\Windows\System\omgHCAK.exe
  C:\Windows\System\omgHCAK.exe
  2⤵
  PID:3752
- C:\Windows\System\RoSFqqO.exe
  C:\Windows\System\RoSFqqO.exe
  2⤵
  PID:4120
- C:\Windows\System\oNvWAXt.exe
  C:\Windows\System\oNvWAXt.exe
  2⤵
  PID:4140
- C:\Windows\System\KWBvBbm.exe
  C:\Windows\System\KWBvBbm.exe
  2⤵
  PID:4168
- C:\Windows\System\dZpFfqk.exe
  C:\Windows\System\dZpFfqk.exe
  2⤵
  PID:4192
- C:\Windows\System\ybioiXx.exe
  C:\Windows\System\ybioiXx.exe
  2⤵
  PID:4212
- C:\Windows\System\EUGxptf.exe
  C:\Windows\System\EUGxptf.exe
  2⤵
  PID:4232
- C:\Windows\System\UrMAcrK.exe
  C:\Windows\System\UrMAcrK.exe
  2⤵
  PID:4252
- C:\Windows\System\wzPWmQa.exe
  C:\Windows\System\wzPWmQa.exe
  2⤵
  PID:4276
- C:\Windows\System\WGkxSxo.exe
  C:\Windows\System\WGkxSxo.exe
  2⤵
  PID:4296
- C:\Windows\System\cKpjOTm.exe
  C:\Windows\System\cKpjOTm.exe
  2⤵
  PID:4336
- C:\Windows\System\AYGXkVu.exe
  C:\Windows\System\AYGXkVu.exe
  2⤵
  PID:4364
- C:\Windows\System\gTfjUYM.exe
  C:\Windows\System\gTfjUYM.exe
  2⤵
  PID:4380
- C:\Windows\System\iDCHUJi.exe
  C:\Windows\System\iDCHUJi.exe
  2⤵
  PID:4400
- C:\Windows\System\vCmIBeM.exe
  C:\Windows\System\vCmIBeM.exe
  2⤵
  PID:4420
- C:\Windows\System\MAVlBSR.exe
  C:\Windows\System\MAVlBSR.exe
  2⤵
  PID:4436
- C:\Windows\System\WZvajAq.exe
  C:\Windows\System\WZvajAq.exe
  2⤵
  PID:4460
- C:\Windows\System\UtbOtlp.exe
  C:\Windows\System\UtbOtlp.exe
  2⤵
  PID:4480
- C:\Windows\System\UrHlCsN.exe
  C:\Windows\System\UrHlCsN.exe
  2⤵
  PID:4500
- C:\Windows\System\jBVPUBH.exe
  C:\Windows\System\jBVPUBH.exe
  2⤵
  PID:4520
- C:\Windows\System\sQqqLwQ.exe
  C:\Windows\System\sQqqLwQ.exe
  2⤵
  PID:4540
- C:\Windows\System\FXNMwpv.exe
  C:\Windows\System\FXNMwpv.exe
  2⤵
  PID:4556
- C:\Windows\System\fERLEaK.exe
  C:\Windows\System\fERLEaK.exe
  2⤵
  PID:4572
- C:\Windows\System\NytiKJW.exe
  C:\Windows\System\NytiKJW.exe
  2⤵
  PID:4588
- C:\Windows\System\AAAfMrF.exe
  C:\Windows\System\AAAfMrF.exe
  2⤵
  PID:4612
- C:\Windows\System\osRwyBa.exe
  C:\Windows\System\osRwyBa.exe
  2⤵
  PID:4640
- C:\Windows\System\pNlkbIH.exe
  C:\Windows\System\pNlkbIH.exe
  2⤵
  PID:4656
- C:\Windows\System\owYRCpc.exe
  C:\Windows\System\owYRCpc.exe
  2⤵
  PID:4676
- C:\Windows\System\aMtFdLl.exe
  C:\Windows\System\aMtFdLl.exe
  2⤵
  PID:4700
- C:\Windows\System\dysiaLV.exe
  C:\Windows\System\dysiaLV.exe
  2⤵
  PID:4716
- C:\Windows\System\HZnBVuW.exe
  C:\Windows\System\HZnBVuW.exe
  2⤵
  PID:4736
- C:\Windows\System\XbHvNMk.exe
  C:\Windows\System\XbHvNMk.exe
  2⤵
  PID:4752
- C:\Windows\System\lGwfkUo.exe
  C:\Windows\System\lGwfkUo.exe
  2⤵
  PID:4772
- C:\Windows\System\CRPTyRM.exe
  C:\Windows\System\CRPTyRM.exe
  2⤵
  PID:4788
- C:\Windows\System\RYZvSvR.exe
  C:\Windows\System\RYZvSvR.exe
  2⤵
  PID:4808
- C:\Windows\System\ruLKIGi.exe
  C:\Windows\System\ruLKIGi.exe
  2⤵
  PID:4828
- C:\Windows\System\ZOMwhNd.exe
  C:\Windows\System\ZOMwhNd.exe
  2⤵
  PID:4864
- C:\Windows\System\JWCWRJa.exe
  C:\Windows\System\JWCWRJa.exe
  2⤵
  PID:4880
- C:\Windows\System\YqBNhKG.exe
  C:\Windows\System\YqBNhKG.exe
  2⤵
  PID:4896
- C:\Windows\System\ONqIORg.exe
  C:\Windows\System\ONqIORg.exe
  2⤵
  PID:4912
- C:\Windows\System\bYoosNX.exe
  C:\Windows\System\bYoosNX.exe
  2⤵
  PID:4932
- C:\Windows\System\OQdxyIK.exe
  C:\Windows\System\OQdxyIK.exe
  2⤵
  PID:4948
- C:\Windows\System\YxIBkSg.exe
  C:\Windows\System\YxIBkSg.exe
  2⤵
  PID:4968
- C:\Windows\System\lQtEcnm.exe
  C:\Windows\System\lQtEcnm.exe
  2⤵
  PID:4984
- C:\Windows\System\ZXmIYbp.exe
  C:\Windows\System\ZXmIYbp.exe
  2⤵
  PID:5024
- C:\Windows\System\VThYCWZ.exe
  C:\Windows\System\VThYCWZ.exe
  2⤵
  PID:5040
- C:\Windows\System\EPWXgpq.exe
  C:\Windows\System\EPWXgpq.exe
  2⤵
  PID:5056
- C:\Windows\System\xwxpqcG.exe
  C:\Windows\System\xwxpqcG.exe
  2⤵
  PID:5076
- C:\Windows\System\HBeBogD.exe
  C:\Windows\System\HBeBogD.exe
  2⤵
  PID:5092
- C:\Windows\System\BoCoohg.exe
  C:\Windows\System\BoCoohg.exe
  2⤵
  PID:5112
- C:\Windows\System\TvYhWEJ.exe
  C:\Windows\System\TvYhWEJ.exe
  2⤵
  PID:3568
- C:\Windows\System\dLfLOxY.exe
  C:\Windows\System\dLfLOxY.exe
  2⤵
  PID:4100
- C:\Windows\System\jjKisLQ.exe
  C:\Windows\System\jjKisLQ.exe
  2⤵
  PID:4132
- C:\Windows\System\bGNMceY.exe
  C:\Windows\System\bGNMceY.exe
  2⤵
  PID:4156
- C:\Windows\System\eYjofjk.exe
  C:\Windows\System\eYjofjk.exe
  2⤵
  PID:4184
- C:\Windows\System\SuLRKcl.exe
  C:\Windows\System\SuLRKcl.exe
  2⤵
  PID:4204
- C:\Windows\System\gAhaFBb.exe
  C:\Windows\System\gAhaFBb.exe
  2⤵
  PID:4240
- C:\Windows\System\GSNFRmf.exe
  C:\Windows\System\GSNFRmf.exe
  2⤵
  PID:4248
- C:\Windows\System\XfPeGAl.exe
  C:\Windows\System\XfPeGAl.exe
  2⤵
  PID:4292
- C:\Windows\System\cLBBopH.exe
  C:\Windows\System\cLBBopH.exe
  2⤵
  PID:4312
- C:\Windows\System\pifAqrz.exe
  C:\Windows\System\pifAqrz.exe
  2⤵
  PID:4332
- C:\Windows\System\sCQMLKX.exe
  C:\Windows\System\sCQMLKX.exe
  2⤵
  PID:4352
- C:\Windows\System\qnbfIMN.exe
  C:\Windows\System\qnbfIMN.exe
  2⤵
  PID:4388
- C:\Windows\System\PYwckSG.exe
  C:\Windows\System\PYwckSG.exe
  2⤵
  PID:4416
- C:\Windows\System\uPYClXH.exe
  C:\Windows\System\uPYClXH.exe
  2⤵
  PID:4452
- C:\Windows\System\ddnpnQh.exe
  C:\Windows\System\ddnpnQh.exe
  2⤵
  PID:4448
- C:\Windows\System\ZlAIXqy.exe
  C:\Windows\System\ZlAIXqy.exe
  2⤵
  PID:4492
- C:\Windows\System\aclJDQa.exe
  C:\Windows\System\aclJDQa.exe
  2⤵
  PID:4516
- C:\Windows\System\AzSfDUM.exe
  C:\Windows\System\AzSfDUM.exe
  2⤵
  PID:4568
- C:\Windows\System\poByuAb.exe
  C:\Windows\System\poByuAb.exe
  2⤵
  PID:4584
- C:\Windows\System\FTtFxbs.exe
  C:\Windows\System\FTtFxbs.exe
  2⤵
  PID:4604
- C:\Windows\System\XgVziBt.exe
  C:\Windows\System\XgVziBt.exe
  2⤵
  PID:4628
- C:\Windows\System\EwBZGtS.exe
  C:\Windows\System\EwBZGtS.exe
  2⤵
  PID:4672
- C:\Windows\System\KwdzuBm.exe
  C:\Windows\System\KwdzuBm.exe
  2⤵
  PID:4668
- C:\Windows\System\vmnxHOF.exe
  C:\Windows\System\vmnxHOF.exe
  2⤵
  PID:4732
- C:\Windows\System\dQpOiRZ.exe
  C:\Windows\System\dQpOiRZ.exe
  2⤵
  PID:4748
- C:\Windows\System\jIAqvDN.exe
  C:\Windows\System\jIAqvDN.exe
  2⤵
  PID:4768
- C:\Windows\System\byuxBXd.exe
  C:\Windows\System\byuxBXd.exe
  2⤵
  PID:4816
- C:\Windows\System\alhAHyW.exe
  C:\Windows\System\alhAHyW.exe
  2⤵
  PID:4840
- C:\Windows\System\zUMhFyT.exe
  C:\Windows\System\zUMhFyT.exe
  2⤵
  PID:4860
- C:\Windows\System\qNndXrZ.exe
  C:\Windows\System\qNndXrZ.exe
  2⤵
  PID:4908
- C:\Windows\System\hQfsOdX.exe
  C:\Windows\System\hQfsOdX.exe
  2⤵
  PID:4892
- C:\Windows\System\HEcKqJw.exe
  C:\Windows\System\HEcKqJw.exe
  2⤵
  PID:4928
- C:\Windows\System\yrSivjW.exe
  C:\Windows\System\yrSivjW.exe
  2⤵
  PID:5000
- C:\Windows\System\MKWAOXG.exe
  C:\Windows\System\MKWAOXG.exe
  2⤵
  PID:5020
- C:\Windows\System\veNqZxU.exe
  C:\Windows\System\veNqZxU.exe
  2⤵
  PID:5052
- C:\Windows\System\xFvywdw.exe
  C:\Windows\System\xFvywdw.exe
  2⤵
  PID:3748
- C:\Windows\System\oXBxmfa.exe
  C:\Windows\System\oXBxmfa.exe
  2⤵
  PID:5128
- C:\Windows\System\DkvGdAl.exe
  C:\Windows\System\DkvGdAl.exe
  2⤵
  PID:5144
- C:\Windows\System\rnJgFXw.exe
  C:\Windows\System\rnJgFXw.exe
  2⤵
  PID:5160
- C:\Windows\System\JlfYoYQ.exe
  C:\Windows\System\JlfYoYQ.exe
  2⤵
  PID:5180
- C:\Windows\System\RcNjCfA.exe
  C:\Windows\System\RcNjCfA.exe
  2⤵
  PID:5196
- C:\Windows\System\rCamhZd.exe
  C:\Windows\System\rCamhZd.exe
  2⤵
  PID:5216
- C:\Windows\System\hqcbXub.exe
  C:\Windows\System\hqcbXub.exe
  2⤵
  PID:5236
- C:\Windows\System\HhsjZLw.exe
  C:\Windows\System\HhsjZLw.exe
  2⤵
  PID:5252
- C:\Windows\System\yHtEsxY.exe
  C:\Windows\System\yHtEsxY.exe
  2⤵
  PID:5268
- C:\Windows\System\lKSnOgr.exe
  C:\Windows\System\lKSnOgr.exe
  2⤵
  PID:5288
- C:\Windows\System\CjQaQpR.exe
  C:\Windows\System\CjQaQpR.exe
  2⤵
  PID:5304
- C:\Windows\System\QwFlVYa.exe
  C:\Windows\System\QwFlVYa.exe
  2⤵
  PID:5324
- C:\Windows\System\CGfwKib.exe
  C:\Windows\System\CGfwKib.exe
  2⤵
  PID:5340
- C:\Windows\System\gTTyHnf.exe
  C:\Windows\System\gTTyHnf.exe
  2⤵
  PID:5360
- C:\Windows\System\tdWJxeZ.exe
  C:\Windows\System\tdWJxeZ.exe
  2⤵
  PID:5376
- C:\Windows\System\wvFNauI.exe
  C:\Windows\System\wvFNauI.exe
  2⤵
  PID:5392
- C:\Windows\System\sSqtbQu.exe
  C:\Windows\System\sSqtbQu.exe
  2⤵
  PID:5452
- C:\Windows\System\jKaSJwx.exe
  C:\Windows\System\jKaSJwx.exe
  2⤵
  PID:5564
- C:\Windows\System\zilcmJD.exe
  C:\Windows\System\zilcmJD.exe
  2⤵
  PID:5580
- C:\Windows\System\IoToCwO.exe
  C:\Windows\System\IoToCwO.exe
  2⤵
  PID:5596
- C:\Windows\System\InBtJEE.exe
  C:\Windows\System\InBtJEE.exe
  2⤵
  PID:5612
- C:\Windows\System\HwSqbki.exe
  C:\Windows\System\HwSqbki.exe
  2⤵
  PID:5628
- C:\Windows\System\laImqNx.exe
  C:\Windows\System\laImqNx.exe
  2⤵
  PID:5644
- C:\Windows\System\NNfNNpP.exe
  C:\Windows\System\NNfNNpP.exe
  2⤵
  PID:5660
- C:\Windows\System\sjSefnC.exe
  C:\Windows\System\sjSefnC.exe
  2⤵
  PID:5676
- C:\Windows\System\twUCurO.exe
  C:\Windows\System\twUCurO.exe
  2⤵
  PID:5692
- C:\Windows\System\NsKudfS.exe
  C:\Windows\System\NsKudfS.exe
  2⤵
  PID:5708
- C:\Windows\System\ZYAROzR.exe
  C:\Windows\System\ZYAROzR.exe
  2⤵
  PID:5724
- C:\Windows\System\fLAOuBJ.exe
  C:\Windows\System\fLAOuBJ.exe
  2⤵
  PID:5752
- C:\Windows\System\bXQlRVI.exe
  C:\Windows\System\bXQlRVI.exe
  2⤵
  PID:5768
- C:\Windows\System\ynXindM.exe
  C:\Windows\System\ynXindM.exe
  2⤵
  PID:5784
- C:\Windows\System\zGdmfpr.exe
  C:\Windows\System\zGdmfpr.exe
  2⤵
  PID:5800
- C:\Windows\System\EXSnySZ.exe
  C:\Windows\System\EXSnySZ.exe
  2⤵
  PID:5820
- C:\Windows\System\GFQxzYU.exe
  C:\Windows\System\GFQxzYU.exe
  2⤵
  PID:5836
- C:\Windows\System\HESLqww.exe
  C:\Windows\System\HESLqww.exe
  2⤵
  PID:5852
- C:\Windows\System\UiKyAjI.exe
  C:\Windows\System\UiKyAjI.exe
  2⤵
  PID:5868
- C:\Windows\System\WjXwXHe.exe
  C:\Windows\System\WjXwXHe.exe
  2⤵
  PID:5884
- C:\Windows\System\xVfIdpD.exe
  C:\Windows\System\xVfIdpD.exe
  2⤵
  PID:5904
- C:\Windows\System\iywEHni.exe
  C:\Windows\System\iywEHni.exe
  2⤵
  PID:5920
- C:\Windows\System\uKmMzZy.exe
  C:\Windows\System\uKmMzZy.exe
  2⤵
  PID:5940
- C:\Windows\System\fPozZNQ.exe
  C:\Windows\System\fPozZNQ.exe
  2⤵
  PID:5960
- C:\Windows\System\ovXIyra.exe
  C:\Windows\System\ovXIyra.exe
  2⤵
  PID:5976
- C:\Windows\System\BtYEuOv.exe
  C:\Windows\System\BtYEuOv.exe
  2⤵
  PID:5992
- C:\Windows\System\jVvlZZa.exe
  C:\Windows\System\jVvlZZa.exe
  2⤵
  PID:6008
- C:\Windows\System\ZypLSTI.exe
  C:\Windows\System\ZypLSTI.exe
  2⤵
  PID:6024
- C:\Windows\System\kmmGBpY.exe
  C:\Windows\System\kmmGBpY.exe
  2⤵
  PID:6040
- C:\Windows\System\uxyxIzI.exe
  C:\Windows\System\uxyxIzI.exe
  2⤵
  PID:6056
- C:\Windows\System\BVwwPse.exe
  C:\Windows\System\BVwwPse.exe
  2⤵
  PID:6088
- C:\Windows\System\nihHCac.exe
  C:\Windows\System\nihHCac.exe
  2⤵
  PID:6104
- C:\Windows\System\QnLnoDB.exe
  C:\Windows\System\QnLnoDB.exe
  2⤵
  PID:6120
- C:\Windows\System\BhXYMzW.exe
  C:\Windows\System\BhXYMzW.exe
  2⤵
  PID:6136
- C:\Windows\System\rTQFjnp.exe
  C:\Windows\System\rTQFjnp.exe
  2⤵
  PID:4548
- C:\Windows\System\RKHpZij.exe
  C:\Windows\System\RKHpZij.exe
  2⤵
  PID:4620
- C:\Windows\System\PZDPCeK.exe
  C:\Windows\System\PZDPCeK.exe
  2⤵
  PID:4760
- C:\Windows\System\VlsGIvZ.exe
  C:\Windows\System\VlsGIvZ.exe
  2⤵
  PID:4116
- C:\Windows\System\ZWUgmeR.exe
  C:\Windows\System\ZWUgmeR.exe
  2⤵
  PID:4288
- C:\Windows\System\GZmbQga.exe
  C:\Windows\System\GZmbQga.exe
  2⤵
  PID:5276
- C:\Windows\System\SHSLHrq.exe
  C:\Windows\System\SHSLHrq.exe
  2⤵
  PID:4320
- C:\Windows\System\uVLugqG.exe
  C:\Windows\System\uVLugqG.exe
  2⤵
  PID:4356
- C:\Windows\System\PxANlxM.exe
  C:\Windows\System\PxANlxM.exe
  2⤵
  PID:4536
- C:\Windows\System\kIAtHlg.exe
  C:\Windows\System\kIAtHlg.exe
  2⤵
  PID:5384
- C:\Windows\System\xpiRxFE.exe
  C:\Windows\System\xpiRxFE.exe
  2⤵
  PID:5388
- C:\Windows\System\HlgkxDy.exe
  C:\Windows\System\HlgkxDy.exe
  2⤵
  PID:5320
- C:\Windows\System\WkZwwpc.exe
  C:\Windows\System\WkZwwpc.exe
  2⤵
  PID:4528
- C:\Windows\System\ZvfyuDS.exe
  C:\Windows\System\ZvfyuDS.exe
  2⤵
  PID:4360
- C:\Windows\System\BrTJQVb.exe
  C:\Windows\System\BrTJQVb.exe
  2⤵
  PID:4304
- C:\Windows\System\qhdCRtM.exe
  C:\Windows\System\qhdCRtM.exe
  2⤵
  PID:4600
- C:\Windows\System\nmDJQSp.exe
  C:\Windows\System\nmDJQSp.exe
  2⤵
  PID:4688
- C:\Windows\System\drZszpO.exe
  C:\Windows\System\drZszpO.exe
  2⤵
  PID:4780
- C:\Windows\System\KdCFkId.exe
  C:\Windows\System\KdCFkId.exe
  2⤵
  PID:4944
- C:\Windows\System\pmfaTYK.exe
  C:\Windows\System\pmfaTYK.exe
  2⤵
  PID:5048
- C:\Windows\System\FHpZuMo.exe
  C:\Windows\System\FHpZuMo.exe
  2⤵
  PID:5156
- C:\Windows\System\GArgHLU.exe
  C:\Windows\System\GArgHLU.exe
  2⤵
  PID:356
- C:\Windows\System\oisgNRN.exe
  C:\Windows\System\oisgNRN.exe
  2⤵
  PID:5400
- C:\Windows\System\hhpBgCg.exe
  C:\Windows\System\hhpBgCg.exe
  2⤵
  PID:4152
- C:\Windows\System\owPofMf.exe
  C:\Windows\System\owPofMf.exe
  2⤵
  PID:4208
- C:\Windows\System\lpIyKCC.exe
  C:\Windows\System\lpIyKCC.exe
  2⤵
  PID:5404
- C:\Windows\System\AsveLDe.exe
  C:\Windows\System\AsveLDe.exe
  2⤵
  PID:5332
- C:\Windows\System\mgAhxVc.exe
  C:\Windows\System\mgAhxVc.exe
  2⤵
  PID:5068
- C:\Windows\System\cNIwQCL.exe
  C:\Windows\System\cNIwQCL.exe
  2⤵
  PID:5460
- C:\Windows\System\rwVczKl.exe
  C:\Windows\System\rwVczKl.exe
  2⤵
  PID:5476
- C:\Windows\System\mKhkDEI.exe
  C:\Windows\System\mKhkDEI.exe
  2⤵
  PID:5496
- C:\Windows\System\sCJWazG.exe
  C:\Windows\System\sCJWazG.exe
  2⤵
  PID:5520
- C:\Windows\System\ZLpZgNb.exe
  C:\Windows\System\ZLpZgNb.exe
  2⤵
  PID:5524
- C:\Windows\System\VgieDdZ.exe
  C:\Windows\System\VgieDdZ.exe
  2⤵
  PID:5556
- C:\Windows\System\RysRZEL.exe
  C:\Windows\System\RysRZEL.exe
  2⤵
  PID:5552
- C:\Windows\System\diZRJXV.exe
  C:\Windows\System\diZRJXV.exe
  2⤵
  PID:5620
- C:\Windows\System\yhEzTtV.exe
  C:\Windows\System\yhEzTtV.exe
  2⤵
  PID:5744
- C:\Windows\System\MiIlDgO.exe
  C:\Windows\System\MiIlDgO.exe
  2⤵
  PID:5808
- C:\Windows\System\ueKSSzu.exe
  C:\Windows\System\ueKSSzu.exe
  2⤵
  PID:5948
- C:\Windows\System\JryYUBD.exe
  C:\Windows\System\JryYUBD.exe
  2⤵
  PID:6052
- C:\Windows\System\jirWhop.exe
  C:\Windows\System\jirWhop.exe
  2⤵
  PID:5572
- C:\Windows\System\UOxNuik.exe
  C:\Windows\System\UOxNuik.exe
  2⤵
  PID:5740
- C:\Windows\System\NoUjdKs.exe
  C:\Windows\System\NoUjdKs.exe
  2⤵
  PID:6112
- C:\Windows\System\qhKVYjD.exe
  C:\Windows\System\qhKVYjD.exe
  2⤵
  PID:3200
- C:\Windows\System\geAMQTA.exe
  C:\Windows\System\geAMQTA.exe
  2⤵
  PID:5668
- C:\Windows\System\voPGpoJ.exe
  C:\Windows\System\voPGpoJ.exe
  2⤵
  PID:5036
- C:\Windows\System\YpIPTcf.exe
  C:\Windows\System\YpIPTcf.exe
  2⤵
  PID:5848
- C:\Windows\System\UNIjdrI.exe
  C:\Windows\System\UNIjdrI.exe
  2⤵
  PID:5732
- C:\Windows\System\SqbMOws.exe
  C:\Windows\System\SqbMOws.exe
  2⤵
  PID:4920
- C:\Windows\System\odyPjlL.exe
  C:\Windows\System\odyPjlL.exe
  2⤵
  PID:5012
- C:\Windows\System\mkuNEGn.exe
  C:\Windows\System\mkuNEGn.exe
  2⤵
  PID:5176
- C:\Windows\System\FnZxTCA.exe
  C:\Windows\System\FnZxTCA.exe
  2⤵
  PID:4228
- C:\Windows\System\irBDfON.exe
  C:\Windows\System\irBDfON.exe
  2⤵
  PID:1884
- C:\Windows\System\QrufpHP.exe
  C:\Windows\System\QrufpHP.exe
  2⤵
  PID:5172
- C:\Windows\System\BmLqrAW.exe
  C:\Windows\System\BmLqrAW.exe
  2⤵
  PID:4396
- C:\Windows\System\vjuTSlP.exe
  C:\Windows\System\vjuTSlP.exe
  2⤵
  PID:4856
- C:\Windows\System\uGUDjyD.exe
  C:\Windows\System\uGUDjyD.exe
  2⤵
  PID:5064
- C:\Windows\System\XmysilE.exe
  C:\Windows\System\XmysilE.exe
  2⤵
  PID:5336
- C:\Windows\System\YRsWfNk.exe
  C:\Windows\System\YRsWfNk.exe
  2⤵
  PID:5488
- C:\Windows\System\HDtOBWm.exe
  C:\Windows\System\HDtOBWm.exe
  2⤵
  PID:5244
- C:\Windows\System\ENkjRGX.exe
  C:\Windows\System\ENkjRGX.exe
  2⤵
  PID:5280
- C:\Windows\System\VsmUKtD.exe
  C:\Windows\System\VsmUKtD.exe
  2⤵
  PID:4260
- C:\Windows\System\uUORONG.exe
  C:\Windows\System\uUORONG.exe
  2⤵
  PID:5412
- C:\Windows\System\EVBordE.exe
  C:\Windows\System\EVBordE.exe
  2⤵
  PID:4532
- C:\Windows\System\JFSrSPo.exe
  C:\Windows\System\JFSrSPo.exe
  2⤵
  PID:4996
- C:\Windows\System\UKOMRgm.exe
  C:\Windows\System\UKOMRgm.exe
  2⤵
  PID:4104
- C:\Windows\System\szcJfWX.exe
  C:\Windows\System\szcJfWX.exe
  2⤵
  PID:4636
- C:\Windows\System\plksHOZ.exe
  C:\Windows\System\plksHOZ.exe
  2⤵
  PID:5688
- C:\Windows\System\TSTIvmX.exe
  C:\Windows\System\TSTIvmX.exe
  2⤵
  PID:5764
- C:\Windows\System\mLmXKoY.exe
  C:\Windows\System\mLmXKoY.exe
  2⤵
  PID:5860
- C:\Windows\System\VJmpJzt.exe
  C:\Windows\System\VJmpJzt.exe
  2⤵
  PID:5900
- C:\Windows\System\ZRIYHbU.exe
  C:\Windows\System\ZRIYHbU.exe
  2⤵
  PID:5968
- C:\Windows\System\VjhlUAv.exe
  C:\Windows\System\VjhlUAv.exe
  2⤵
  PID:6036
- C:\Windows\System\JwVjMUY.exe
  C:\Windows\System\JwVjMUY.exe
  2⤵
  PID:6064
- C:\Windows\System\rsPLiVL.exe
  C:\Windows\System\rsPLiVL.exe
  2⤵
  PID:6084
- C:\Windows\System\EddtkEL.exe
  C:\Windows\System\EddtkEL.exe
  2⤵
  PID:5780
- C:\Windows\System\mBESyCq.exe
  C:\Windows\System\mBESyCq.exe
  2⤵
  PID:5876
- C:\Windows\System\TJDXMmy.exe
  C:\Windows\System\TJDXMmy.exe
  2⤵
  PID:6096
- C:\Windows\System\fwmYAok.exe
  C:\Windows\System\fwmYAok.exe
  2⤵
  PID:4708
- C:\Windows\System\ctRFmtT.exe
  C:\Windows\System\ctRFmtT.exe
  2⤵
  PID:6128
- C:\Windows\System\iUdsfSX.exe
  C:\Windows\System\iUdsfSX.exe
  2⤵
  PID:5484
- C:\Windows\System\oMCMGAy.exe
  C:\Windows\System\oMCMGAy.exe
  2⤵
  PID:5500
- C:\Windows\System\NIfBWDl.exe
  C:\Windows\System\NIfBWDl.exe
  2⤵
  PID:4744
- C:\Windows\System\rwsWHwF.exe
  C:\Windows\System\rwsWHwF.exe
  2⤵
  PID:6100
- C:\Windows\System\PkevpZi.exe
  C:\Windows\System\PkevpZi.exe
  2⤵
  PID:5776
- C:\Windows\System\YySdsZY.exe
  C:\Windows\System\YySdsZY.exe
  2⤵
  PID:5016
- C:\Windows\System\jjWTxip.exe
  C:\Windows\System\jjWTxip.exe
  2⤵
  PID:5368
- C:\Windows\System\IYmIQPJ.exe
  C:\Windows\System\IYmIQPJ.exe
  2⤵
  PID:5652
- C:\Windows\System\KVrVkWL.exe
  C:\Windows\System\KVrVkWL.exe
  2⤵
  PID:3344
- C:\Windows\System\LCcPerQ.exe
  C:\Windows\System\LCcPerQ.exe
  2⤵
  PID:5892
- C:\Windows\System\lJyXiSk.exe
  C:\Windows\System\lJyXiSk.exe
  2⤵
  PID:4472
- C:\Windows\System\YhYfUCE.exe
  C:\Windows\System\YhYfUCE.exe
  2⤵
  PID:5204
- C:\Windows\System\XvEXfmB.exe
  C:\Windows\System\XvEXfmB.exe
  2⤵
  PID:5636
- C:\Windows\System\WbFMTzB.exe
  C:\Windows\System\WbFMTzB.exe
  2⤵
  PID:4904
- C:\Windows\System\UtnBOpO.exe
  C:\Windows\System\UtnBOpO.exe
  2⤵
  PID:5700
- C:\Windows\System\sBRxPhT.exe
  C:\Windows\System\sBRxPhT.exe
  2⤵
  PID:4848
- C:\Windows\System\rrNDRUJ.exe
  C:\Windows\System\rrNDRUJ.exe
  2⤵
  PID:6000
- C:\Windows\System\OYCHGjU.exe
  C:\Windows\System\OYCHGjU.exe
  2⤵
  PID:5548
- C:\Windows\System\lFwWqiA.exe
  C:\Windows\System\lFwWqiA.exe
  2⤵
  PID:6032
- C:\Windows\System\XbYyvzF.exe
  C:\Windows\System\XbYyvzF.exe
  2⤵
  PID:5828
- C:\Windows\System\RxZYWee.exe
  C:\Windows\System\RxZYWee.exe
  2⤵
  PID:5512
- C:\Windows\System\tSBBvUf.exe
  C:\Windows\System\tSBBvUf.exe
  2⤵
  PID:5588
- C:\Windows\System\mbURebY.exe
  C:\Windows\System\mbURebY.exe
  2⤵
  PID:5208
- C:\Windows\System\cQfWwlF.exe
  C:\Windows\System\cQfWwlF.exe
  2⤵
  PID:5760
- C:\Windows\System\HQgxqAE.exe
  C:\Windows\System\HQgxqAE.exe
  2⤵
  PID:5516
- C:\Windows\System\RjHbYDg.exe
  C:\Windows\System\RjHbYDg.exe
  2⤵
  PID:6048
- C:\Windows\System\fOOhkCo.exe
  C:\Windows\System\fOOhkCo.exe
  2⤵
  PID:6004
- C:\Windows\System\sfYrVLr.exe
  C:\Windows\System\sfYrVLr.exe
  2⤵
  PID:4712
- C:\Windows\System\bxWWeWE.exe
  C:\Windows\System\bxWWeWE.exe
  2⤵
  PID:5356
- C:\Windows\System\HGDzjot.exe
  C:\Windows\System\HGDzjot.exe
  2⤵
  PID:6152
- C:\Windows\System\dMzGvhl.exe
  C:\Windows\System\dMzGvhl.exe
  2⤵
  PID:6172
- C:\Windows\System\cRCfYPh.exe
  C:\Windows\System\cRCfYPh.exe
  2⤵
  PID:6188
- C:\Windows\System\BqyIiEf.exe
  C:\Windows\System\BqyIiEf.exe
  2⤵
  PID:6204
- C:\Windows\System\kZFpIUr.exe
  C:\Windows\System\kZFpIUr.exe
  2⤵
  PID:6220
- C:\Windows\System\MHSwiWL.exe
  C:\Windows\System\MHSwiWL.exe
  2⤵
  PID:6236
- C:\Windows\System\aQNIScb.exe
  C:\Windows\System\aQNIScb.exe
  2⤵
  PID:6252
- C:\Windows\System\abMzElG.exe
  C:\Windows\System\abMzElG.exe
  2⤵
  PID:6268
- C:\Windows\System\avmdkAl.exe
  C:\Windows\System\avmdkAl.exe
  2⤵
  PID:6284
- C:\Windows\System\tLfASCJ.exe
  C:\Windows\System\tLfASCJ.exe
  2⤵
  PID:6300
- C:\Windows\System\FEDlHst.exe
  C:\Windows\System\FEDlHst.exe
  2⤵
  PID:6316
- C:\Windows\System\ubwqQJA.exe
  C:\Windows\System\ubwqQJA.exe
  2⤵
  PID:6332
- C:\Windows\System\kpKKDdC.exe
  C:\Windows\System\kpKKDdC.exe
  2⤵
  PID:6348
- C:\Windows\System\epbYEHx.exe
  C:\Windows\System\epbYEHx.exe
  2⤵
  PID:6364
- C:\Windows\System\aNeNyHb.exe
  C:\Windows\System\aNeNyHb.exe
  2⤵
  PID:6380
- C:\Windows\System\LPfeZBa.exe
  C:\Windows\System\LPfeZBa.exe
  2⤵
  PID:6436
- C:\Windows\System\TTObRPG.exe
  C:\Windows\System\TTObRPG.exe
  2⤵
  PID:6460
- C:\Windows\System\glVGuMp.exe
  C:\Windows\System\glVGuMp.exe
  2⤵
  PID:6476
- C:\Windows\System\hHLkPoY.exe
  C:\Windows\System\hHLkPoY.exe
  2⤵
  PID:6492
- C:\Windows\System\zHTOUuk.exe
  C:\Windows\System\zHTOUuk.exe
  2⤵
  PID:6508
- C:\Windows\System\buAKLCA.exe
  C:\Windows\System\buAKLCA.exe
  2⤵
  PID:6524
- C:\Windows\System\rqroAis.exe
  C:\Windows\System\rqroAis.exe
  2⤵
  PID:6544
- C:\Windows\System\JmqXQvw.exe
  C:\Windows\System\JmqXQvw.exe
  2⤵
  PID:6560
- C:\Windows\System\IFmIcTX.exe
  C:\Windows\System\IFmIcTX.exe
  2⤵
  PID:6576
- C:\Windows\System\rVnoXQW.exe
  C:\Windows\System\rVnoXQW.exe
  2⤵
  PID:6592
- C:\Windows\System\rUOPEnb.exe
  C:\Windows\System\rUOPEnb.exe
  2⤵
  PID:6608
- C:\Windows\System\IUwJzAn.exe
  C:\Windows\System\IUwJzAn.exe
  2⤵
  PID:6624
- C:\Windows\System\vlZnZVP.exe
  C:\Windows\System\vlZnZVP.exe
  2⤵
  PID:6640
- C:\Windows\System\dSfxiDp.exe
  C:\Windows\System\dSfxiDp.exe
  2⤵
  PID:6656
- C:\Windows\System\ilSKrYp.exe
  C:\Windows\System\ilSKrYp.exe
  2⤵
  PID:6672
- C:\Windows\System\yaYjyDd.exe
  C:\Windows\System\yaYjyDd.exe
  2⤵
  PID:6688
- C:\Windows\System\BODsJPG.exe
  C:\Windows\System\BODsJPG.exe
  2⤵
  PID:6704
- C:\Windows\System\tvWHKrC.exe
  C:\Windows\System\tvWHKrC.exe
  2⤵
  PID:6720
- C:\Windows\System\fgiSIHe.exe
  C:\Windows\System\fgiSIHe.exe
  2⤵
  PID:6736
- C:\Windows\System\eglDYtD.exe
  C:\Windows\System\eglDYtD.exe
  2⤵
  PID:6752
- C:\Windows\System\VGlodNo.exe
  C:\Windows\System\VGlodNo.exe
  2⤵
  PID:6772
- C:\Windows\System\WkyFSrp.exe
  C:\Windows\System\WkyFSrp.exe
  2⤵
  PID:6788
- C:\Windows\System\GELXwgS.exe
  C:\Windows\System\GELXwgS.exe
  2⤵
  PID:6804
- C:\Windows\System\uBmUNYw.exe
  C:\Windows\System\uBmUNYw.exe
  2⤵
  PID:6820
- C:\Windows\System\DXDMJsu.exe
  C:\Windows\System\DXDMJsu.exe
  2⤵
  PID:6836
- C:\Windows\System\HlPPBJl.exe
  C:\Windows\System\HlPPBJl.exe
  2⤵
  PID:6852
- C:\Windows\System\EQErWAH.exe
  C:\Windows\System\EQErWAH.exe
  2⤵
  PID:6916
- C:\Windows\System\hnsymZY.exe
  C:\Windows\System\hnsymZY.exe
  2⤵
  PID:6936
- C:\Windows\System\gHKLVbc.exe
  C:\Windows\System\gHKLVbc.exe
  2⤵
  PID:7084
- C:\Windows\System\wKkwItX.exe
  C:\Windows\System\wKkwItX.exe
  2⤵
  PID:7116
- C:\Windows\System\PUTaRwa.exe
  C:\Windows\System\PUTaRwa.exe
  2⤵
  PID:7132
- C:\Windows\System\glrLePA.exe
  C:\Windows\System\glrLePA.exe
  2⤵
  PID:7148
- C:\Windows\System\hHfRnAB.exe
  C:\Windows\System\hHfRnAB.exe
  2⤵
  PID:7164
- C:\Windows\System\Quoulac.exe
  C:\Windows\System\Quoulac.exe
  2⤵
  PID:6244
- C:\Windows\System\RDOySKW.exe
  C:\Windows\System\RDOySKW.exe
  2⤵
  PID:6308
- C:\Windows\System\nTpvihC.exe
  C:\Windows\System\nTpvihC.exe
  2⤵
  PID:6372
- C:\Windows\System\iUGvByC.exe
  C:\Windows\System\iUGvByC.exe
  2⤵
  PID:6232
- C:\Windows\System\ajXrlis.exe
  C:\Windows\System\ajXrlis.exe
  2⤵
  PID:6296
- C:\Windows\System\eUakift.exe
  C:\Windows\System\eUakift.exe
  2⤵
  PID:6360
- C:\Windows\System\fwuUAyd.exe
  C:\Windows\System\fwuUAyd.exe
  2⤵
  PID:6400
- C:\Windows\System\oDTyODx.exe
  C:\Windows\System\oDTyODx.exe
  2⤵
  PID:6376
- C:\Windows\System\rXMPeTH.exe
  C:\Windows\System\rXMPeTH.exe
  2⤵
  PID:6428
- C:\Windows\System\WKCFbMp.exe
  C:\Windows\System\WKCFbMp.exe
  2⤵
  PID:6468
- C:\Windows\System\PUjLRhW.exe
  C:\Windows\System\PUjLRhW.exe
  2⤵
  PID:6536
- C:\Windows\System\QjjSfnQ.exe
  C:\Windows\System\QjjSfnQ.exe
  2⤵
  PID:5108
- C:\Windows\System\ZCstvhv.exe
  C:\Windows\System\ZCstvhv.exe
  2⤵
  PID:6160
- C:\Windows\System\HcfWzoJ.exe
  C:\Windows\System\HcfWzoJ.exe
  2⤵
  PID:6664
- C:\Windows\System\SmEFBmG.exe
  C:\Windows\System\SmEFBmG.exe
  2⤵
  PID:5936
- C:\Windows\System\avdcWVp.exe
  C:\Windows\System\avdcWVp.exe
  2⤵
  PID:6732
- C:\Windows\System\dwollHB.exe
  C:\Windows\System\dwollHB.exe
  2⤵
  PID:6796
- C:\Windows\System\RJToYSM.exe
  C:\Windows\System\RJToYSM.exe
  2⤵
  PID:6648
- C:\Windows\System\vHFLRbx.exe
  C:\Windows\System\vHFLRbx.exe
  2⤵
  PID:6456
- C:\Windows\System\ByLVWTr.exe
  C:\Windows\System\ByLVWTr.exe
  2⤵
  PID:6516
- C:\Windows\System\skHnLAk.exe
  C:\Windows\System\skHnLAk.exe
  2⤵
  PID:6552
- C:\Windows\System\DftVzIw.exe
  C:\Windows\System\DftVzIw.exe
  2⤵
  PID:6872
- C:\Windows\System\jnnFMwK.exe
  C:\Windows\System\jnnFMwK.exe
  2⤵
  PID:6888
- C:\Windows\System\QuAGSTS.exe
  C:\Windows\System\QuAGSTS.exe
  2⤵
  PID:6904
- C:\Windows\System\dgpYjTo.exe
  C:\Windows\System\dgpYjTo.exe
  2⤵
  PID:6588
- C:\Windows\System\kvztagS.exe
  C:\Windows\System\kvztagS.exe
  2⤵
  PID:6816
- C:\Windows\System\ewQbJca.exe
  C:\Windows\System\ewQbJca.exe
  2⤵
  PID:6712
- C:\Windows\System\TtponPl.exe
  C:\Windows\System\TtponPl.exe
  2⤵
  PID:5796
- C:\Windows\System\NynittO.exe
  C:\Windows\System\NynittO.exe
  2⤵
  PID:6848
- C:\Windows\System\pxZcAcx.exe
  C:\Windows\System\pxZcAcx.exe
  2⤵
  PID:5984
- C:\Windows\System\qUWNFOt.exe
  C:\Windows\System\qUWNFOt.exe
  2⤵
  PID:7048
- C:\Windows\System\IEvgFVv.exe
  C:\Windows\System\IEvgFVv.exe
  2⤵
  PID:7072
- C:\Windows\System\fXEonze.exe
  C:\Windows\System\fXEonze.exe
  2⤵
  PID:7100
- C:\Windows\System\tzwLGbW.exe
  C:\Windows\System\tzwLGbW.exe
  2⤵
  PID:7112
- C:\Windows\System\KsSYsDW.exe
  C:\Windows\System\KsSYsDW.exe
  2⤵
  PID:6280
- C:\Windows\System\yiiKGnU.exe
  C:\Windows\System\yiiKGnU.exe
  2⤵
  PID:6356
- C:\Windows\System\YwrkNxY.exe
  C:\Windows\System\YwrkNxY.exe
  2⤵
  PID:6412
- C:\Windows\System\SxZRsEd.exe
  C:\Windows\System\SxZRsEd.exe
  2⤵
  PID:5684
- C:\Windows\System\rUvtZTV.exe
  C:\Windows\System\rUvtZTV.exe
  2⤵
  PID:6636
- C:\Windows\System\cmejvdx.exe
  C:\Windows\System\cmejvdx.exe
  2⤵
  PID:6860
- C:\Windows\System\KwDvHel.exe
  C:\Windows\System\KwDvHel.exe
  2⤵
  PID:6868
- C:\Windows\System\YTWcQlW.exe
  C:\Windows\System\YTWcQlW.exe
  2⤵
  PID:6668
- C:\Windows\System\BlwaQaV.exe
  C:\Windows\System\BlwaQaV.exe
  2⤵
  PID:6448
- C:\Windows\System\KdLzaxb.exe
  C:\Windows\System\KdLzaxb.exe
  2⤵
  PID:6880
- C:\Windows\System\AXgvOgV.exe
  C:\Windows\System\AXgvOgV.exe
  2⤵
  PID:6604
- C:\Windows\System\SFgfbSo.exe
  C:\Windows\System\SFgfbSo.exe
  2⤵
  PID:6340
- C:\Windows\System\BDInMqT.exe
  C:\Windows\System\BDInMqT.exe
  2⤵
  PID:6784
- C:\Windows\System\HBFVVYZ.exe
  C:\Windows\System\HBFVVYZ.exe
  2⤵
  PID:6396
- C:\Windows\System\daqsTPP.exe
  C:\Windows\System\daqsTPP.exe
  2⤵
  PID:4824
- C:\Windows\System\TrmUyCz.exe
  C:\Windows\System\TrmUyCz.exe
  2⤵
  PID:6928
- C:\Windows\System\Sxppjdu.exe
  C:\Windows\System\Sxppjdu.exe
  2⤵
  PID:6620
- C:\Windows\System\mpAeKDa.exe
  C:\Windows\System\mpAeKDa.exe
  2⤵
  PID:6748
- C:\Windows\System\jnHdnjB.exe
  C:\Windows\System\jnHdnjB.exe
  2⤵
  PID:6948
- C:\Windows\System\vNFboYC.exe
  C:\Windows\System\vNFboYC.exe
  2⤵
  PID:6968
- C:\Windows\System\KwDMLtH.exe
  C:\Windows\System\KwDMLtH.exe
  2⤵
  PID:6976
- C:\Windows\System\TJFdJfl.exe
  C:\Windows\System\TJFdJfl.exe
  2⤵
  PID:7004
- C:\Windows\System\DAvrxfq.exe
  C:\Windows\System\DAvrxfq.exe
  2⤵
  PID:7032
- C:\Windows\System\NXeCxqr.exe
  C:\Windows\System\NXeCxqr.exe
  2⤵
  PID:6488
- C:\Windows\System\JoJcojR.exe
  C:\Windows\System\JoJcojR.exe
  2⤵
  PID:6964
- C:\Windows\System\ExaXoTB.exe
  C:\Windows\System\ExaXoTB.exe
  2⤵
  PID:7016
- C:\Windows\System\fIJFaoE.exe
  C:\Windows\System\fIJFaoE.exe
  2⤵
  PID:6992
- C:\Windows\System\POOHXgt.exe
  C:\Windows\System\POOHXgt.exe
  2⤵
  PID:7108
- C:\Windows\System\ofTETuI.exe
  C:\Windows\System\ofTETuI.exe
  2⤵
  PID:7064
- C:\Windows\System\ilXbsxD.exe
  C:\Windows\System\ilXbsxD.exe
  2⤵
  PID:7024
- C:\Windows\System\iKpuPzv.exe
  C:\Windows\System\iKpuPzv.exe
  2⤵
  PID:6828
- C:\Windows\System\SzVfzMc.exe
  C:\Windows\System\SzVfzMc.exe
  2⤵
  PID:6532
- C:\Windows\System\JHlQtAv.exe
  C:\Windows\System\JHlQtAv.exe
  2⤵
  PID:6924
- C:\Windows\System\SJqsYGQ.exe
  C:\Windows\System\SJqsYGQ.exe
  2⤵
  PID:6216
- C:\Windows\System\BUsTbdD.exe
  C:\Windows\System\BUsTbdD.exe
  2⤵
  PID:6504
- C:\Windows\System\onvkNmz.exe
  C:\Windows\System\onvkNmz.exe
  2⤵
  PID:6768
- C:\Windows\System\ftRAQDR.exe
  C:\Windows\System\ftRAQDR.exe
  2⤵
  PID:6148
- C:\Windows\System\FDISDhO.exe
  C:\Windows\System\FDISDhO.exe
  2⤵
  PID:6996
- C:\Windows\System\mINPXcE.exe
  C:\Windows\System\mINPXcE.exe
  2⤵
  PID:6328
- C:\Windows\System\EcYMmFP.exe
  C:\Windows\System\EcYMmFP.exe
  2⤵
  PID:6212
- C:\Windows\System\oLoQDFR.exe
  C:\Windows\System\oLoQDFR.exe
  2⤵
  PID:6616
- C:\Windows\System\SqUNQss.exe
  C:\Windows\System\SqUNQss.exe
  2⤵
  PID:6932
- C:\Windows\System\vtiyvjs.exe
  C:\Windows\System\vtiyvjs.exe
  2⤵
  PID:7092
- C:\Windows\System\EvpAAlJ.exe
  C:\Windows\System\EvpAAlJ.exe
  2⤵
  PID:5916
- C:\Windows\System\mdKqYDm.exe
  C:\Windows\System\mdKqYDm.exe
  2⤵
  PID:6276
- C:\Windows\System\IHkRiFt.exe
  C:\Windows\System\IHkRiFt.exe
  2⤵
  PID:6944
- C:\Windows\System\fTYhVYO.exe
  C:\Windows\System\fTYhVYO.exe
  2⤵
  PID:7056
- C:\Windows\System\IJbaTYS.exe
  C:\Windows\System\IJbaTYS.exe
  2⤵
  PID:7012
- C:\Windows\System\gPfPjMb.exe
  C:\Windows\System\gPfPjMb.exe
  2⤵
  PID:7096
- C:\Windows\System\nkTsRsL.exe
  C:\Windows\System\nkTsRsL.exe
  2⤵
  PID:7180
- C:\Windows\System\DmaZSIQ.exe
  C:\Windows\System\DmaZSIQ.exe
  2⤵
  PID:7196
- C:\Windows\System\TEyQfio.exe
  C:\Windows\System\TEyQfio.exe
  2⤵
  PID:7212
- C:\Windows\System\mRzwVDR.exe
  C:\Windows\System\mRzwVDR.exe
  2⤵
  PID:7228
- C:\Windows\System\RbPFKzf.exe
  C:\Windows\System\RbPFKzf.exe
  2⤵
  PID:7244
- C:\Windows\System\GlZNoty.exe
  C:\Windows\System\GlZNoty.exe
  2⤵
  PID:7260
- C:\Windows\System\bVzyfbG.exe
  C:\Windows\System\bVzyfbG.exe
  2⤵
  PID:7280
- C:\Windows\System\aOKVUdI.exe
  C:\Windows\System\aOKVUdI.exe
  2⤵
  PID:7296
- C:\Windows\System\pgRWCAG.exe
  C:\Windows\System\pgRWCAG.exe
  2⤵
  PID:7312
- C:\Windows\System\MOvHkNF.exe
  C:\Windows\System\MOvHkNF.exe
  2⤵
  PID:7328
- C:\Windows\System\FrRdYUy.exe
  C:\Windows\System\FrRdYUy.exe
  2⤵
  PID:7344
- C:\Windows\System\fQrfsMj.exe
  C:\Windows\System\fQrfsMj.exe
  2⤵
  PID:7364
- C:\Windows\System\dgnSPtO.exe
  C:\Windows\System\dgnSPtO.exe
  2⤵
  PID:7380
- C:\Windows\System\oHMjcCh.exe
  C:\Windows\System\oHMjcCh.exe
  2⤵
  PID:7396
- C:\Windows\System\thaDsXx.exe
  C:\Windows\System\thaDsXx.exe
  2⤵
  PID:7412
- C:\Windows\System\FXEsuHa.exe
  C:\Windows\System\FXEsuHa.exe
  2⤵
  PID:7492
- C:\Windows\System\Dprdmjs.exe
  C:\Windows\System\Dprdmjs.exe
  2⤵
  PID:7512
- C:\Windows\System\tgWGJxW.exe
  C:\Windows\System\tgWGJxW.exe
  2⤵
  PID:7528
- C:\Windows\System\ilQkPlm.exe
  C:\Windows\System\ilQkPlm.exe
  2⤵
  PID:7544
- C:\Windows\System\CdpvFCB.exe
  C:\Windows\System\CdpvFCB.exe
  2⤵
  PID:7560
- C:\Windows\System\vSWJeAR.exe
  C:\Windows\System\vSWJeAR.exe
  2⤵
  PID:7576
- C:\Windows\System\abJHGCg.exe
  C:\Windows\System\abJHGCg.exe
  2⤵
  PID:7600
- C:\Windows\System\EsbdRHc.exe
  C:\Windows\System\EsbdRHc.exe
  2⤵
  PID:7616
- C:\Windows\System\mRRvnBh.exe
  C:\Windows\System\mRRvnBh.exe
  2⤵
  PID:7632
- C:\Windows\System\PMjAhXv.exe
  C:\Windows\System\PMjAhXv.exe
  2⤵
  PID:7648
- C:\Windows\System\avuQCsb.exe
  C:\Windows\System\avuQCsb.exe
  2⤵
  PID:7664
- C:\Windows\System\gLrqKyK.exe
  C:\Windows\System\gLrqKyK.exe
  2⤵
  PID:7680
- C:\Windows\System\NRsoIDp.exe
  C:\Windows\System\NRsoIDp.exe
  2⤵
  PID:7700
- C:\Windows\System\YaQmKLN.exe
  C:\Windows\System\YaQmKLN.exe
  2⤵
  PID:7720
- C:\Windows\System\KtxnrOD.exe
  C:\Windows\System\KtxnrOD.exe
  2⤵
  PID:7736
- C:\Windows\System\KAKRtPB.exe
  C:\Windows\System\KAKRtPB.exe
  2⤵
  PID:7816
- C:\Windows\System\itGGsrL.exe
  C:\Windows\System\itGGsrL.exe
  2⤵
  PID:7836
- C:\Windows\System\khlSOQI.exe
  C:\Windows\System\khlSOQI.exe
  2⤵
  PID:7852
- C:\Windows\System\kEYgxEo.exe
  C:\Windows\System\kEYgxEo.exe
  2⤵
  PID:7868
- C:\Windows\System\KuBcseC.exe
  C:\Windows\System\KuBcseC.exe
  2⤵
  PID:7900
- C:\Windows\System\jHCNHCK.exe
  C:\Windows\System\jHCNHCK.exe
  2⤵
  PID:7916
- C:\Windows\System\eqvhTKV.exe
  C:\Windows\System\eqvhTKV.exe
  2⤵
  PID:7932
- C:\Windows\System\DzcBQJG.exe
  C:\Windows\System\DzcBQJG.exe
  2⤵
  PID:7948
- C:\Windows\System\RNcxAti.exe
  C:\Windows\System\RNcxAti.exe
  2⤵
  PID:7964
- C:\Windows\System\hnLysKJ.exe
  C:\Windows\System\hnLysKJ.exe
  2⤵
  PID:7980
- C:\Windows\System\ZEFhuZb.exe
  C:\Windows\System\ZEFhuZb.exe
  2⤵
  PID:8000
- C:\Windows\System\buOFGPE.exe
  C:\Windows\System\buOFGPE.exe
  2⤵
  PID:8020
- C:\Windows\System\YuPpwfw.exe
  C:\Windows\System\YuPpwfw.exe
  2⤵
  PID:8044
- C:\Windows\System\GFKmkXb.exe
  C:\Windows\System\GFKmkXb.exe
  2⤵
  PID:8072
- C:\Windows\System\SuLRWMH.exe
  C:\Windows\System\SuLRWMH.exe
  2⤵
  PID:8088
- C:\Windows\System\ZyUDrof.exe
  C:\Windows\System\ZyUDrof.exe
  2⤵
  PID:8104
- C:\Windows\System\lSgMBmV.exe
  C:\Windows\System\lSgMBmV.exe
  2⤵
  PID:8136
- C:\Windows\System\aZSCuZH.exe
  C:\Windows\System\aZSCuZH.exe
  2⤵
  PID:8184
- C:\Windows\System\DflDCyy.exe
  C:\Windows\System\DflDCyy.exe
  2⤵
  PID:7256
- C:\Windows\System\PoRiNFw.exe
  C:\Windows\System\PoRiNFw.exe
  2⤵
  PID:7208
- C:\Windows\System\DYhCUwM.exe
  C:\Windows\System\DYhCUwM.exe
  2⤵
  PID:7408
- C:\Windows\System\ggDGYUB.exe
  C:\Windows\System\ggDGYUB.exe
  2⤵
  PID:7240
- C:\Windows\System\mjGjJEV.exe
  C:\Windows\System\mjGjJEV.exe
  2⤵
  PID:7372
- C:\Windows\System\aOUEsYl.exe
  C:\Windows\System\aOUEsYl.exe
  2⤵
  PID:7420
- C:\Windows\System\SkiiuMU.exe
  C:\Windows\System\SkiiuMU.exe
  2⤵
  PID:7448
- C:\Windows\System\cUMQuiS.exe
  C:\Windows\System\cUMQuiS.exe
  2⤵
  PID:7504
- C:\Windows\System\lfflTQh.exe
  C:\Windows\System\lfflTQh.exe
  2⤵
  PID:7456
- C:\Windows\System\lpcUgSD.exe
  C:\Windows\System\lpcUgSD.exe
  2⤵
  PID:7472
- C:\Windows\System\CjGzxdG.exe
  C:\Windows\System\CjGzxdG.exe
  2⤵
  PID:7520
- C:\Windows\System\vRqIOvu.exe
  C:\Windows\System\vRqIOvu.exe
  2⤵
  PID:7556
- C:\Windows\System\NyDFkeC.exe
  C:\Windows\System\NyDFkeC.exe
  2⤵
  PID:7644
- C:\Windows\System\njxDsgK.exe
  C:\Windows\System\njxDsgK.exe
  2⤵
  PID:7708
- C:\Windows\System\DzXTKPK.exe
  C:\Windows\System\DzXTKPK.exe
  2⤵
  PID:7748
- C:\Windows\System\pDdeKJD.exe
  C:\Windows\System\pDdeKJD.exe
  2⤵
  PID:7692
- C:\Windows\System\hCphPUH.exe
  C:\Windows\System\hCphPUH.exe
  2⤵
  PID:7592
- C:\Windows\System\hXRSeZR.exe
  C:\Windows\System\hXRSeZR.exe
  2⤵
  PID:7804
- C:\Windows\System\UmOMrRt.exe
  C:\Windows\System\UmOMrRt.exe
  2⤵
  PID:7848
- C:\Windows\System\xtNAhpt.exe
  C:\Windows\System\xtNAhpt.exe
  2⤵
  PID:7860
- C:\Windows\System\abXjSTb.exe
  C:\Windows\System\abXjSTb.exe
  2⤵
  PID:7884
- C:\Windows\System\TDAYtqt.exe
  C:\Windows\System\TDAYtqt.exe
  2⤵
  PID:7924
- C:\Windows\System\YqwOVyj.exe
  C:\Windows\System\YqwOVyj.exe
  2⤵
  PID:7996
- C:\Windows\System\xToeJeY.exe
  C:\Windows\System\xToeJeY.exe
  2⤵
  PID:8080
- C:\Windows\System\cDiTEUP.exe
  C:\Windows\System\cDiTEUP.exe
  2⤵
  PID:8064
- C:\Windows\System\bsQzlre.exe
  C:\Windows\System\bsQzlre.exe
  2⤵
  PID:8132
- C:\Windows\System\uMbUmmD.exe
  C:\Windows\System\uMbUmmD.exe
  2⤵
  PID:8096
- C:\Windows\System\hcvKGlJ.exe
  C:\Windows\System\hcvKGlJ.exe
  2⤵
  PID:8156
- C:\Windows\System\sDDsWun.exe
  C:\Windows\System\sDDsWun.exe
  2⤵
  PID:6952
- C:\Windows\System\agWbUgJ.exe
  C:\Windows\System\agWbUgJ.exe
  2⤵
  PID:8176
- C:\Windows\System\oNeYLUb.exe
  C:\Windows\System\oNeYLUb.exe
  2⤵
  PID:7236
- C:\Windows\System\gJiXVQR.exe
  C:\Windows\System\gJiXVQR.exe
  2⤵
  PID:7192
- C:\Windows\System\hhCVGiM.exe
  C:\Windows\System\hhCVGiM.exe
  2⤵
  PID:7340
- C:\Windows\System\RHFTqxW.exe
  C:\Windows\System\RHFTqxW.exe
  2⤵
  PID:7436
- C:\Windows\System\UiGxdEY.exe
  C:\Windows\System\UiGxdEY.exe
  2⤵
  PID:7640
- C:\Windows\System\igyckAN.exe
  C:\Windows\System\igyckAN.exe
  2⤵
  PID:7188
- C:\Windows\System\pFRTTLv.exe
  C:\Windows\System\pFRTTLv.exe
  2⤵
  PID:7324
- C:\Windows\System\STJxtmH.exe
  C:\Windows\System\STJxtmH.exe
  2⤵
  PID:7044
- C:\Windows\System\HUntwVI.exe
  C:\Windows\System\HUntwVI.exe
  2⤵
  PID:7536
- C:\Windows\System\uwOjbZT.exe
  C:\Windows\System\uwOjbZT.exe
  2⤵
  PID:7588
- C:\Windows\System\dtOTMYI.exe
  C:\Windows\System\dtOTMYI.exe
  2⤵
  PID:7696
- C:\Windows\System\wRYRsmg.exe
  C:\Windows\System\wRYRsmg.exe
  2⤵
  PID:7660
- C:\Windows\System\iYVjUFh.exe
  C:\Windows\System\iYVjUFh.exe
  2⤵
  PID:7568
- C:\Windows\System\TjxfsGH.exe
  C:\Windows\System\TjxfsGH.exe
  2⤵
  PID:7956
- C:\Windows\System\dGLWECQ.exe
  C:\Windows\System\dGLWECQ.exe
  2⤵
  PID:7728
- C:\Windows\System\llxguHw.exe
  C:\Windows\System\llxguHw.exe
  2⤵
  PID:7780
- C:\Windows\System\YEOeiEe.exe
  C:\Windows\System\YEOeiEe.exe
  2⤵
  PID:7832
- C:\Windows\System\MIafBAi.exe
  C:\Windows\System\MIafBAi.exe
  2⤵
  PID:7768
- C:\Windows\System\HNzfavy.exe
  C:\Windows\System\HNzfavy.exe
  2⤵
  PID:7912
- C:\Windows\System\XkRDstI.exe
  C:\Windows\System\XkRDstI.exe
  2⤵
  PID:7940
- C:\Windows\System\SoTTbPf.exe
  C:\Windows\System\SoTTbPf.exe
  2⤵
  PID:8032
- C:\Windows\System\ZTwQXZR.exe
  C:\Windows\System\ZTwQXZR.exe
  2⤵
  PID:8116
- C:\Windows\System\IdYpXvg.exe
  C:\Windows\System\IdYpXvg.exe
  2⤵
  PID:8148
- C:\Windows\System\OcIpWgb.exe
  C:\Windows\System\OcIpWgb.exe
  2⤵
  PID:7388
- C:\Windows\System\wJarpJm.exe
  C:\Windows\System\wJarpJm.exe
  2⤵
  PID:7392
- C:\Windows\System\cBRjROW.exe
  C:\Windows\System\cBRjROW.exe
  2⤵
  PID:7432
- C:\Windows\System\rIqYcZA.exe
  C:\Windows\System\rIqYcZA.exe
  2⤵
  PID:8120
- C:\Windows\System\NSjxzSu.exe
  C:\Windows\System\NSjxzSu.exe
  2⤵
  PID:7844
- C:\Windows\System\yuSlgdW.exe
  C:\Windows\System\yuSlgdW.exe
  2⤵
  PID:7828
- C:\Windows\System\AvDzPXo.exe
  C:\Windows\System\AvDzPXo.exe
  2⤵
  PID:8036
- C:\Windows\System\xCPWGfp.exe
  C:\Windows\System\xCPWGfp.exe
  2⤵
  PID:7308
- C:\Windows\System\CHFmfzu.exe
  C:\Windows\System\CHFmfzu.exe
  2⤵
  PID:8208
- C:\Windows\System\sDngxRb.exe
  C:\Windows\System\sDngxRb.exe
  2⤵
  PID:8224
- C:\Windows\System\XbmXgOw.exe
  C:\Windows\System\XbmXgOw.exe
  2⤵
  PID:8240
- C:\Windows\System\dtBsDTk.exe
  C:\Windows\System\dtBsDTk.exe
  2⤵
  PID:8256
- C:\Windows\System\hemZkVQ.exe
  C:\Windows\System\hemZkVQ.exe
  2⤵
  PID:8272
- C:\Windows\System\vxOpKte.exe
  C:\Windows\System\vxOpKte.exe
  2⤵
  PID:8340
- C:\Windows\System\TrexuyF.exe
  C:\Windows\System\TrexuyF.exe
  2⤵
  PID:8360
- C:\Windows\System\utcXYIO.exe
  C:\Windows\System\utcXYIO.exe
  2⤵
  PID:8380
- C:\Windows\System\Hgpjkfu.exe
  C:\Windows\System\Hgpjkfu.exe
  2⤵
  PID:8400
- C:\Windows\System\XvdAHrz.exe
  C:\Windows\System\XvdAHrz.exe
  2⤵
  PID:8416
- C:\Windows\System\oElMCgV.exe
  C:\Windows\System\oElMCgV.exe
  2⤵
  PID:8436
- C:\Windows\System\xjsGZCl.exe
  C:\Windows\System\xjsGZCl.exe
  2⤵
  PID:8452
- C:\Windows\System\aNmsmWc.exe
  C:\Windows\System\aNmsmWc.exe
  2⤵
  PID:8468
- C:\Windows\System\BHEpBHn.exe
  C:\Windows\System\BHEpBHn.exe
  2⤵
  PID:8484
- C:\Windows\System\ZGIkLiz.exe
  C:\Windows\System\ZGIkLiz.exe
  2⤵
  PID:8500
- C:\Windows\System\FzyFDbe.exe
  C:\Windows\System\FzyFDbe.exe
  2⤵
  PID:8516
- C:\Windows\System\AnxmfrH.exe
  C:\Windows\System\AnxmfrH.exe
  2⤵
  PID:8532
- C:\Windows\System\IszYDes.exe
  C:\Windows\System\IszYDes.exe
  2⤵
  PID:8548
- C:\Windows\System\ilwdCwF.exe
  C:\Windows\System\ilwdCwF.exe
  2⤵
  PID:8564
- C:\Windows\System\xIkToyz.exe
  C:\Windows\System\xIkToyz.exe
  2⤵
  PID:8580
- C:\Windows\System\GWtzgLd.exe
  C:\Windows\System\GWtzgLd.exe
  2⤵
  PID:8596
- C:\Windows\System\vMLihDB.exe
  C:\Windows\System\vMLihDB.exe
  2⤵
  PID:8612
- C:\Windows\System\SpCtFpA.exe
  C:\Windows\System\SpCtFpA.exe
  2⤵
  PID:8628
- C:\Windows\System\dmrVYbZ.exe
  C:\Windows\System\dmrVYbZ.exe
  2⤵
  PID:8660
- C:\Windows\System\ilYYlls.exe
  C:\Windows\System\ilYYlls.exe
  2⤵
  PID:8764
- C:\Windows\System\JWISYmO.exe
  C:\Windows\System\JWISYmO.exe
  2⤵
  PID:8780
- C:\Windows\System\szZbiMD.exe
  C:\Windows\System\szZbiMD.exe
  2⤵
  PID:8796
- C:\Windows\System\pHiVtmQ.exe
  C:\Windows\System\pHiVtmQ.exe
  2⤵
  PID:8812
- C:\Windows\System\hixaShs.exe
  C:\Windows\System\hixaShs.exe
  2⤵
  PID:8828
- C:\Windows\System\FvQxcDT.exe
  C:\Windows\System\FvQxcDT.exe
  2⤵
  PID:8844
- C:\Windows\System\wxtEDND.exe
  C:\Windows\System\wxtEDND.exe
  2⤵
  PID:8860
- C:\Windows\System\rQrVOji.exe
  C:\Windows\System\rQrVOji.exe
  2⤵
  PID:8888
- C:\Windows\System\BNmYcEE.exe
  C:\Windows\System\BNmYcEE.exe
  2⤵
  PID:8904
- C:\Windows\System\mgVjrSy.exe
  C:\Windows\System\mgVjrSy.exe
  2⤵
  PID:8924
- C:\Windows\System\eydtVpJ.exe
  C:\Windows\System\eydtVpJ.exe
  2⤵
  PID:8948
- C:\Windows\System\QGQmBvE.exe
  C:\Windows\System\QGQmBvE.exe
  2⤵
  PID:8964
- C:\Windows\System\AtEQcBZ.exe
  C:\Windows\System\AtEQcBZ.exe
  2⤵
  PID:8980
- C:\Windows\System\jfSXeCy.exe
  C:\Windows\System\jfSXeCy.exe
  2⤵
  PID:8996
- C:\Windows\System\vHJeKYl.exe
  C:\Windows\System\vHJeKYl.exe
  2⤵
  PID:9016
- C:\Windows\System\XqtZlzf.exe
  C:\Windows\System\XqtZlzf.exe
  2⤵
  PID:9032
- C:\Windows\System\QIIFKzG.exe
  C:\Windows\System\QIIFKzG.exe
  2⤵
  PID:9048
- C:\Windows\System\JWDJXUi.exe
  C:\Windows\System\JWDJXUi.exe
  2⤵
  PID:9064
- C:\Windows\System\BhzHjlb.exe
  C:\Windows\System\BhzHjlb.exe
  2⤵
  PID:9080
- C:\Windows\System\bWifSQM.exe
  C:\Windows\System\bWifSQM.exe
  2⤵
  PID:9112
- C:\Windows\System\wieKTAu.exe
  C:\Windows\System\wieKTAu.exe
  2⤵
  PID:9128
- C:\Windows\System\GnBNSjE.exe
  C:\Windows\System\GnBNSjE.exe
  2⤵
  PID:9148
- C:\Windows\System\NuknngJ.exe
  C:\Windows\System\NuknngJ.exe
  2⤵
  PID:9164
- C:\Windows\System\wdmqfhl.exe
  C:\Windows\System\wdmqfhl.exe
  2⤵
  PID:9184
- C:\Windows\System\clMKYzx.exe
  C:\Windows\System\clMKYzx.exe
  2⤵
  PID:9200
- C:\Windows\System\NmOvjBV.exe
  C:\Windows\System\NmOvjBV.exe
  2⤵
  PID:7484
- C:\Windows\System\ypnEYzD.exe
  C:\Windows\System\ypnEYzD.exe
  2⤵
  PID:7288
- C:\Windows\System\bisugJQ.exe
  C:\Windows\System\bisugJQ.exe
  2⤵
  PID:7628
- C:\Windows\System\iKbiwjH.exe
  C:\Windows\System\iKbiwjH.exe
  2⤵
  PID:7764
- C:\Windows\System\baQPNvk.exe
  C:\Windows\System\baQPNvk.exe
  2⤵
  PID:7732
- C:\Windows\System\BrjcCvh.exe
  C:\Windows\System\BrjcCvh.exe
  2⤵
  PID:7352
- C:\Windows\System\JHWNDEZ.exe
  C:\Windows\System\JHWNDEZ.exe
  2⤵
  PID:7796
- C:\Windows\System\JcyekPM.exe
  C:\Windows\System\JcyekPM.exe
  2⤵
  PID:8220
- C:\Windows\System\iwthfpY.exe
  C:\Windows\System\iwthfpY.exe
  2⤵
  PID:8128
- C:\Windows\System\iKugLmO.exe
  C:\Windows\System\iKugLmO.exe
  2⤵
  PID:7172
- C:\Windows\System\WQoNxNR.exe
  C:\Windows\System\WQoNxNR.exe
  2⤵
  PID:8152
- C:\Windows\System\ewcsliC.exe
  C:\Windows\System\ewcsliC.exe
  2⤵
  PID:8292
- C:\Windows\System\AjcKLJJ.exe
  C:\Windows\System\AjcKLJJ.exe
  2⤵
  PID:8332
- C:\Windows\System\UOxtmag.exe
  C:\Windows\System\UOxtmag.exe
  2⤵
  PID:8388
- C:\Windows\System\zJHnyXt.exe
  C:\Windows\System\zJHnyXt.exe
  2⤵
  PID:8480
- C:\Windows\System\HBBaCkG.exe
  C:\Windows\System\HBBaCkG.exe
  2⤵
  PID:8544
- C:\Windows\System\Gbuvqlg.exe
  C:\Windows\System\Gbuvqlg.exe
  2⤵
  PID:8424
- C:\Windows\System\qTnTXDM.exe
  C:\Windows\System\qTnTXDM.exe
  2⤵
  PID:8604
- C:\Windows\System\tIbXLcS.exe
  C:\Windows\System\tIbXLcS.exe
  2⤵
  PID:8492
- C:\Windows\System\ZDsUZqp.exe
  C:\Windows\System\ZDsUZqp.exe
  2⤵
  PID:8644
- C:\Windows\System\QGhGKwU.exe
  C:\Windows\System\QGhGKwU.exe
  2⤵
  PID:8592
- C:\Windows\System\euEqIEi.exe
  C:\Windows\System\euEqIEi.exe
  2⤵
  PID:8640
- C:\Windows\System\FhaPRkO.exe
  C:\Windows\System\FhaPRkO.exe
  2⤵
  PID:8676
- C:\Windows\System\mfRvHEX.exe
  C:\Windows\System\mfRvHEX.exe
  2⤵
  PID:8684
- C:\Windows\System\Xlfmpqc.exe
  C:\Windows\System\Xlfmpqc.exe
  2⤵
  PID:8704
- C:\Windows\System\umucLTy.exe
  C:\Windows\System\umucLTy.exe
  2⤵
  PID:8728
- C:\Windows\System\TtTSPbd.exe
  C:\Windows\System\TtTSPbd.exe
  2⤵
  PID:8772
- C:\Windows\System\uTEdqzw.exe
  C:\Windows\System\uTEdqzw.exe
  2⤵
  PID:8840
- C:\Windows\System\VIdrHAI.exe
  C:\Windows\System\VIdrHAI.exe
  2⤵
  PID:8884
- C:\Windows\System\krAJXkz.exe
  C:\Windows\System\krAJXkz.exe
  2⤵
  PID:8792
- C:\Windows\System\IIZVPZo.exe
  C:\Windows\System\IIZVPZo.exe
  2⤵
  PID:8852
- C:\Windows\System\pgHvxkE.exe
  C:\Windows\System\pgHvxkE.exe
  2⤵
  PID:8916
- C:\Windows\System\xMMURKE.exe
  C:\Windows\System\xMMURKE.exe
  2⤵
  PID:8960
- C:\Windows\System\tZHzjmF.exe
  C:\Windows\System\tZHzjmF.exe
  2⤵
  PID:8944
- C:\Windows\System\qnuGULj.exe
  C:\Windows\System\qnuGULj.exe
  2⤵
  PID:9004
- C:\Windows\System\iAokbtL.exe
  C:\Windows\System\iAokbtL.exe
  2⤵
  PID:9044
- C:\Windows\System\DGuJfAO.exe
  C:\Windows\System\DGuJfAO.exe
  2⤵
  PID:9056
- C:\Windows\System\IOchHQY.exe
  C:\Windows\System\IOchHQY.exe
  2⤵
  PID:9096
- C:\Windows\System\QjniHEh.exe
  C:\Windows\System\QjniHEh.exe
  2⤵
  PID:9092
- C:\Windows\System\CpfmITP.exe
  C:\Windows\System\CpfmITP.exe
  2⤵
  PID:9172
- C:\Windows\System\dIZeAno.exe
  C:\Windows\System\dIZeAno.exe
  2⤵
  PID:9120
- C:\Windows\System\tZTsdDQ.exe
  C:\Windows\System\tZTsdDQ.exe
  2⤵
  PID:9192
- C:\Windows\System\fnQRKeq.exe
  C:\Windows\System\fnQRKeq.exe
  2⤵
  PID:8112
- C:\Windows\System\ddWuhjt.exe
  C:\Windows\System\ddWuhjt.exe
  2⤵
  PID:7292
- C:\Windows\System\kCCfEzo.exe
  C:\Windows\System\kCCfEzo.exe
  2⤵
  PID:8008
- C:\Windows\System\IflyLDR.exe
  C:\Windows\System\IflyLDR.exe
  2⤵
  PID:8312
- C:\Windows\System\ZQrunpr.exe
  C:\Windows\System\ZQrunpr.exe
  2⤵
  PID:8336
- C:\Windows\System\xXFYKTo.exe
  C:\Windows\System\xXFYKTo.exe
  2⤵
  PID:8392
- C:\Windows\System\UBsDocE.exe
  C:\Windows\System\UBsDocE.exe
  2⤵
  PID:8356
- C:\Windows\System\PtQgjvQ.exe
  C:\Windows\System\PtQgjvQ.exe
  2⤵
  PID:8460
- C:\Windows\System\YvnlXbE.exe
  C:\Windows\System\YvnlXbE.exe
  2⤵
  PID:8652
- C:\Windows\System\KlsoDnx.exe
  C:\Windows\System\KlsoDnx.exe
  2⤵
  PID:8696
- C:\Windows\System\DVEHSrn.exe
  C:\Windows\System\DVEHSrn.exe
  2⤵
  PID:8656
- C:\Windows\System\VPhKwKq.exe
  C:\Windows\System\VPhKwKq.exe
  2⤵
  PID:8608
- C:\Windows\System\DORzUXm.exe
  C:\Windows\System\DORzUXm.exe
  2⤵
  PID:8872
- C:\Windows\System\bFAiPgV.exe
  C:\Windows\System\bFAiPgV.exe
  2⤵
  PID:8876
- C:\Windows\System\fvgtoQW.exe
  C:\Windows\System\fvgtoQW.exe
  2⤵
  PID:8900
- C:\Windows\System\bVwPVKF.exe
  C:\Windows\System\bVwPVKF.exe
  2⤵
  PID:8824
- C:\Windows\System\XYEmzWB.exe
  C:\Windows\System\XYEmzWB.exe
  2⤵
  PID:8936
- C:\Windows\System\MxkiHDa.exe
  C:\Windows\System\MxkiHDa.exe
  2⤵
  PID:8932
- C:\Windows\System\HSjUSHb.exe
  C:\Windows\System\HSjUSHb.exe
  2⤵
  PID:9040
- C:\Windows\System\VCRGBtz.exe
  C:\Windows\System\VCRGBtz.exe
  2⤵
  PID:9140
- C:\Windows\System\zHyWIBA.exe
  C:\Windows\System\zHyWIBA.exe
  2⤵
  PID:7800
- C:\Windows\System\gjZBdGZ.exe
  C:\Windows\System\gjZBdGZ.exe
  2⤵
  PID:7060
- C:\Windows\System\dvvLZLi.exe
  C:\Windows\System\dvvLZLi.exe
  2⤵
  PID:9156
- C:\Windows\System\LFsgsqq.exe
  C:\Windows\System\LFsgsqq.exe
  2⤵
  PID:9108
- C:\Windows\System\lEXjmpH.exe
  C:\Windows\System\lEXjmpH.exe
  2⤵
  PID:7876
- C:\Windows\System\ATMEZxk.exe
  C:\Windows\System\ATMEZxk.exe
  2⤵
  PID:7500
- C:\Windows\System\llyeKxQ.exe
  C:\Windows\System\llyeKxQ.exe
  2⤵
  PID:7812
- C:\Windows\System\RogTEjM.exe
  C:\Windows\System\RogTEjM.exe
  2⤵
  PID:8308
- C:\Windows\System\GroFYNo.exe
  C:\Windows\System\GroFYNo.exe
  2⤵
  PID:8268
- C:\Windows\System\NSuEMkZ.exe
  C:\Windows\System\NSuEMkZ.exe
  2⤵
  PID:8624
- C:\Windows\System\oGEaRGp.exe
  C:\Windows\System\oGEaRGp.exe
  2⤵
  PID:7792
- C:\Windows\System\XOUMHbE.exe
  C:\Windows\System\XOUMHbE.exe
  2⤵
  PID:8956
- C:\Windows\System\GplgUXT.exe
  C:\Windows\System\GplgUXT.exe
  2⤵
  PID:9212
- C:\Windows\System\HVpntDA.exe
  C:\Windows\System\HVpntDA.exe
  2⤵
  PID:7176
- C:\Windows\System\kobRJAl.exe
  C:\Windows\System\kobRJAl.exe
  2⤵
  PID:8316
- C:\Windows\System\VmWsbfQ.exe
  C:\Windows\System\VmWsbfQ.exe
  2⤵
  PID:8264
- C:\Windows\System\desowXY.exe
  C:\Windows\System\desowXY.exe
  2⤵
  PID:9180
- C:\Windows\System\WPuJEkO.exe
  C:\Windows\System\WPuJEkO.exe
  2⤵
  PID:8556
- C:\Windows\System\LKqmbJG.exe
  C:\Windows\System\LKqmbJG.exe
  2⤵
  PID:7772
- C:\Windows\System\NpwvLKS.exe
  C:\Windows\System\NpwvLKS.exe
  2⤵
  PID:8912
- C:\Windows\System\tIYvTrR.exe
  C:\Windows\System\tIYvTrR.exe
  2⤵
  PID:8284
- C:\Windows\System\tXJemMx.exe
  C:\Windows\System\tXJemMx.exe
  2⤵
  PID:8172
- C:\Windows\System\LYCNKaR.exe
  C:\Windows\System\LYCNKaR.exe
  2⤵
  PID:8448
- C:\Windows\System\fukZZYu.exe
  C:\Windows\System\fukZZYu.exe
  2⤵
  PID:9024
- C:\Windows\System\HwkiOUz.exe
  C:\Windows\System\HwkiOUz.exe
  2⤵
  PID:7452
- C:\Windows\System\pjyxyIw.exe
  C:\Windows\System\pjyxyIw.exe
  2⤵
  PID:8836
- C:\Windows\System\StqQoWn.exe
  C:\Windows\System\StqQoWn.exe
  2⤵
  PID:9228
- C:\Windows\System\cEXvOmd.exe
  C:\Windows\System\cEXvOmd.exe
  2⤵
  PID:9244
- C:\Windows\System\RXljHXO.exe
  C:\Windows\System\RXljHXO.exe
  2⤵
  PID:9260
- C:\Windows\System\aYitScl.exe
  C:\Windows\System\aYitScl.exe
  2⤵
  PID:9280
- C:\Windows\System\imkcRrl.exe
  C:\Windows\System\imkcRrl.exe
  2⤵
  PID:9340
- C:\Windows\System\wNvsrUD.exe
  C:\Windows\System\wNvsrUD.exe
  2⤵
  PID:9356
- C:\Windows\System\eyYJYDA.exe
  C:\Windows\System\eyYJYDA.exe
  2⤵
  PID:9372
- C:\Windows\System\sxDFOEJ.exe
  C:\Windows\System\sxDFOEJ.exe
  2⤵
  PID:9388
- C:\Windows\System\YTQMsmm.exe
  C:\Windows\System\YTQMsmm.exe
  2⤵
  PID:9404
- C:\Windows\System\HdJtKKD.exe
  C:\Windows\System\HdJtKKD.exe
  2⤵
  PID:9420
- C:\Windows\System\ADeQXXX.exe
  C:\Windows\System\ADeQXXX.exe
  2⤵
  PID:9436
- C:\Windows\System\iUzszQf.exe
  C:\Windows\System\iUzszQf.exe
  2⤵
  PID:9456
- C:\Windows\System\LGkqHAv.exe
  C:\Windows\System\LGkqHAv.exe
  2⤵
  PID:9472
- C:\Windows\System\rfQqtmv.exe
  C:\Windows\System\rfQqtmv.exe
  2⤵
  PID:9488
- C:\Windows\System\SrXobGb.exe
  C:\Windows\System\SrXobGb.exe
  2⤵
  PID:9504
- C:\Windows\System\TwkdiDW.exe
  C:\Windows\System\TwkdiDW.exe
  2⤵
  PID:9520
- C:\Windows\System\AJJZKYs.exe
  C:\Windows\System\AJJZKYs.exe
  2⤵
  PID:9540
- C:\Windows\System\CKJIpCf.exe
  C:\Windows\System\CKJIpCf.exe
  2⤵
  PID:9556
- C:\Windows\System\pEImdaU.exe
  C:\Windows\System\pEImdaU.exe
  2⤵
  PID:9572
- C:\Windows\System\VQPRdqI.exe
  C:\Windows\System\VQPRdqI.exe
  2⤵
  PID:9588
- C:\Windows\System\NRnrANC.exe
  C:\Windows\System\NRnrANC.exe
  2⤵
  PID:9604
- C:\Windows\System\GBPfbTY.exe
  C:\Windows\System\GBPfbTY.exe
  2⤵
  PID:9620
- C:\Windows\System\GWgCZwf.exe
  C:\Windows\System\GWgCZwf.exe
  2⤵
  PID:9716
- C:\Windows\System\aKlVQEQ.exe
  C:\Windows\System\aKlVQEQ.exe
  2⤵
  PID:9744
- C:\Windows\System\oNQCXaH.exe
  C:\Windows\System\oNQCXaH.exe
  2⤵
  PID:9760
- C:\Windows\System\TLfGOmp.exe
  C:\Windows\System\TLfGOmp.exe
  2⤵
  PID:9776
- C:\Windows\System\xdFasZo.exe
  C:\Windows\System\xdFasZo.exe
  2⤵
  PID:9792
- C:\Windows\System\LUHUXVs.exe
  C:\Windows\System\LUHUXVs.exe
  2⤵
  PID:9808
- C:\Windows\System\QQIUuqt.exe
  C:\Windows\System\QQIUuqt.exe
  2⤵
  PID:9824
- C:\Windows\System\BMxLkIv.exe
  C:\Windows\System\BMxLkIv.exe
  2⤵
  PID:9840
- C:\Windows\System\fEVsMIC.exe
  C:\Windows\System\fEVsMIC.exe
  2⤵
  PID:9856
- C:\Windows\System\UTbJbnc.exe
  C:\Windows\System\UTbJbnc.exe
  2⤵
  PID:9872
- C:\Windows\System\LXxIlsg.exe
  C:\Windows\System\LXxIlsg.exe
  2⤵
  PID:9888
- C:\Windows\System\dbVGkXa.exe
  C:\Windows\System\dbVGkXa.exe
  2⤵
  PID:9904
- C:\Windows\System\kCpBvLB.exe
  C:\Windows\System\kCpBvLB.exe
  2⤵
  PID:9924
- C:\Windows\System\DnKKcWV.exe
  C:\Windows\System\DnKKcWV.exe
  2⤵
  PID:9944
- C:\Windows\System\xqjuWyu.exe
  C:\Windows\System\xqjuWyu.exe
  2⤵
  PID:9960
- C:\Windows\System\hmVdusy.exe
  C:\Windows\System\hmVdusy.exe
  2⤵
  PID:9976
- C:\Windows\System\hPZJhix.exe
  C:\Windows\System\hPZJhix.exe
  2⤵
  PID:9992
- C:\Windows\System\qkEryDa.exe
  C:\Windows\System\qkEryDa.exe
  2⤵
  PID:10008
- C:\Windows\System\MHTzxqS.exe
  C:\Windows\System\MHTzxqS.exe
  2⤵
  PID:10024
- C:\Windows\System\XoQwRKs.exe
  C:\Windows\System\XoQwRKs.exe
  2⤵
  PID:10044
- C:\Windows\System\rWYVfcR.exe
  C:\Windows\System\rWYVfcR.exe
  2⤵
  PID:10060
- C:\Windows\System\JnqmApX.exe
  C:\Windows\System\JnqmApX.exe
  2⤵
  PID:10076
- C:\Windows\System\tBjpmeN.exe
  C:\Windows\System\tBjpmeN.exe
  2⤵
  PID:10096
- C:\Windows\System\nOMCFuI.exe
  C:\Windows\System\nOMCFuI.exe
  2⤵
  PID:10112
- C:\Windows\System\dyzQLft.exe
  C:\Windows\System\dyzQLft.exe
  2⤵
  PID:10132
- C:\Windows\System\Dgklsob.exe
  C:\Windows\System\Dgklsob.exe
  2⤵
  PID:10148
- C:\Windows\System\oqqnpwA.exe
  C:\Windows\System\oqqnpwA.exe
  2⤵
  PID:8376
- C:\Windows\System\HAbArQg.exe
  C:\Windows\System\HAbArQg.exe
  2⤵
  PID:8280
- C:\Windows\System\EaQgjjY.exe
  C:\Windows\System\EaQgjjY.exe
  2⤵
  PID:9220
- C:\Windows\System\KFmSltk.exe
  C:\Windows\System\KFmSltk.exe
  2⤵
  PID:9104
- C:\Windows\System\KmZGyVk.exe
  C:\Windows\System\KmZGyVk.exe
  2⤵
  PID:9292
- C:\Windows\System\fjyCADN.exe
  C:\Windows\System\fjyCADN.exe
  2⤵
  PID:9308
- C:\Windows\System\BtcIXgV.exe
  C:\Windows\System\BtcIXgV.exe
  2⤵
  PID:9316
- C:\Windows\System\muyMmra.exe
  C:\Windows\System\muyMmra.exe
  2⤵
  PID:9240
- C:\Windows\System\ffJxqGD.exe
  C:\Windows\System\ffJxqGD.exe
  2⤵
  PID:9328
- C:\Windows\System\bSZfEQa.exe
  C:\Windows\System\bSZfEQa.exe
  2⤵
  PID:9060
- C:\Windows\System\HwOElBH.exe
  C:\Windows\System\HwOElBH.exe
  2⤵
  PID:9428
- C:\Windows\System\EtLsxuS.exe
  C:\Windows\System\EtLsxuS.exe
  2⤵
  PID:9348
- C:\Windows\System\CXNtZyv.exe
  C:\Windows\System\CXNtZyv.exe
  2⤵
  PID:9596
- C:\Windows\System\xDSxRuj.exe
  C:\Windows\System\xDSxRuj.exe
  2⤵
  PID:9564
- C:\Windows\System\MqKpdWb.exe
  C:\Windows\System\MqKpdWb.exe
  2⤵
  PID:9644
- C:\Windows\System\yPWtzuR.exe
  C:\Windows\System\yPWtzuR.exe
  2⤵
  PID:9448
- C:\Windows\System\QENtYzt.exe
  C:\Windows\System\QENtYzt.exe
  2⤵
  PID:9484
- C:\Windows\System\NbsSZpf.exe
  C:\Windows\System\NbsSZpf.exe
  2⤵
  PID:9584
- C:\Windows\System\txodTtH.exe
  C:\Windows\System\txodTtH.exe
  2⤵
  PID:9612
- C:\Windows\System\oXskoxd.exe
  C:\Windows\System\oXskoxd.exe
  2⤵
  PID:9660
- C:\Windows\System\xkFuXuO.exe
  C:\Windows\System\xkFuXuO.exe
  2⤵
  PID:9676
- C:\Windows\System\ZQAJyaI.exe
  C:\Windows\System\ZQAJyaI.exe
  2⤵
  PID:9696
- C:\Windows\System\TAcMqmO.exe
  C:\Windows\System\TAcMqmO.exe
  2⤵
  PID:9724
- C:\Windows\System\RUpKmaW.exe
  C:\Windows\System\RUpKmaW.exe
  2⤵
  PID:9848
- C:\Windows\System\rLVYgnS.exe
  C:\Windows\System\rLVYgnS.exe
  2⤵
  PID:9788
- C:\Windows\System\FiQrhWk.exe
  C:\Windows\System\FiQrhWk.exe
  2⤵
  PID:10156
- C:\Windows\System\jMFXdhM.exe
  C:\Windows\System\jMFXdhM.exe
  2⤵
  PID:9740
- C:\Windows\System\gHTkMrp.exe
  C:\Windows\System\gHTkMrp.exe
  2⤵
  PID:9832
- C:\Windows\System\ReXAXmk.exe
  C:\Windows\System\ReXAXmk.exe
  2⤵
  PID:10108
- C:\Windows\System\bxvIOWz.exe
  C:\Windows\System\bxvIOWz.exe
  2⤵
  PID:10040
- C:\Windows\System\zxntwtr.exe
  C:\Windows\System\zxntwtr.exe
  2⤵
  PID:9972
- C:\Windows\System\ttzunSK.exe
  C:\Windows\System\ttzunSK.exe
  2⤵
  PID:9900
- C:\Windows\System\SFiAQiO.exe
  C:\Windows\System\SFiAQiO.exe
  2⤵
  PID:9732
- C:\Windows\System\SBkoNeM.exe
  C:\Windows\System\SBkoNeM.exe
  2⤵
  PID:10004
- C:\Windows\System\ZaClgYh.exe
  C:\Windows\System\ZaClgYh.exe
  2⤵
  PID:10184
- C:\Windows\System\BdBfxah.exe
  C:\Windows\System\BdBfxah.exe
  2⤵
  PID:10200
- C:\Windows\System\juVRrtD.exe
  C:\Windows\System\juVRrtD.exe
  2⤵
  PID:9864
- C:\Windows\System\EQLdNPC.exe
  C:\Windows\System\EQLdNPC.exe
  2⤵
  PID:10228
- C:\Windows\System\urgqFbJ.exe
  C:\Windows\System\urgqFbJ.exe
  2⤵
  PID:8304
- C:\Windows\System\dZMHFpY.exe
  C:\Windows\System\dZMHFpY.exe
  2⤵
  PID:9256
- C:\Windows\System\YITRaJJ.exe
  C:\Windows\System\YITRaJJ.exe
  2⤵
  PID:8216
- C:\Windows\System\nLebNFo.exe
  C:\Windows\System\nLebNFo.exe
  2⤵
  PID:8540
- C:\Windows\System\PkABoSV.exe
  C:\Windows\System\PkABoSV.exe
  2⤵
  PID:8412
- C:\Windows\System\nCrYEPo.exe
  C:\Windows\System\nCrYEPo.exe
  2⤵
  PID:9300
- C:\Windows\System\ejGbgUf.exe
  C:\Windows\System\ejGbgUf.exe
  2⤵
  PID:9276
- C:\Windows\System\Nxuafnz.exe
  C:\Windows\System\Nxuafnz.exe
  2⤵
  PID:9528
- C:\Windows\System\GZyBtCN.exe
  C:\Windows\System\GZyBtCN.exe
  2⤵
  PID:9480
- C:\Windows\System\tqXxCpD.exe
  C:\Windows\System\tqXxCpD.exe
  2⤵
  PID:9708
- C:\Windows\System\jpGPgyN.exe
  C:\Windows\System\jpGPgyN.exe
  2⤵
  PID:9880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BDjrwBs.exe

Filesize
1.9MB

MD5
47c8e6ed569426c063b828eeba1dd445

SHA1
da95a85f40bd3db0fa9b5bad86bcb734588e19d6

SHA256
4a5ff4eac51a62de9cb9788ca0d0ee783d0c018c1c00317c6e5692c3dcf7f60a

SHA512
d06e6e6d7313d80505e08790ba01b6e63ca2d5b4c052145bfdcfbd3a29064c3924aac7e83cc8681048046e2b2c918a9ca336a79ac7298f7c827ee0caf7e9ebe7

Download Submit
C:\Windows\system\FLDbqWu.exe

Filesize
1.9MB

MD5
86df681139922cbfce2f417a28761027

SHA1
08254d83304b446c6beb6cf805e842b85e5bcd7f

SHA256
94adf082186491c6d15b80a6ed6a56428f4509fc2e3f7c2f603fecf90321614e

SHA512
aa6602497d658e302424fb6af143bf9a23bc7f83b639b1870a76804389d215c661f4786bfbd59f94d1f8f11d48737c5cfa7535fbec985b2c4c22579c4547f1a6

Download Submit
C:\Windows\system\KCJwrSR.exe

Filesize
1.9MB

MD5
1ca9fcc0dc9d7b40b5d1b38329d5a717

SHA1
115749899dbcea1d8e84dd2f31dac56011bdb221

SHA256
f05fe0ef8d9027a2daf609f58f851b9af71c5c93c181b0e2fe3bd3928b8cf480

SHA512
6a70060c0d4f8b486d27b12c51e85a6b18477f45aa19706bb04be40f38d8f59d0051449132ab3a4160052232fdc4f3cf1f65e273cd937e2ca9da812f2d0d51b8

Download Submit
C:\Windows\system\LDSNQir.exe

Filesize
1.9MB

MD5
65bd23808f3b337c5349cb2b5a991cb6

SHA1
2d7454cae258923064d6a8d4925e9072410f4f5b

SHA256
13fb509a296a486710023c4aca032fd8747b2e6b616da8412f94000f194fe53f

SHA512
bb8898b9c54473dc738539e8398428ee654ef58ebf7c65f9d8c039d5a08543c0b68763a126f80b9d9a1c7f6a1f3d5f0334a000b6b31b14a15b2a59b64e9b7342

Download Submit
C:\Windows\system\LtEHlsu.exe

Filesize
1.9MB

MD5
2f5be0feb267b7712fbd21d368768079

SHA1
83cc805a5f0103169df75eac2e19ae7c5c4beb19

SHA256
6e56b0123c12e0f339206c73a6df620fc4bc1e5d148b6968f2c190418e919d18

SHA512
3fcdb59655073a0b2a478e3cba54ecda57476c06359edc19a05632ad6be6f1f5dec71cd1ac241408ef17613d8946d915dca9b82cab97928688a471f3c1ae67ef

Download Submit
C:\Windows\system\MnzWLKq.exe

Filesize
1.9MB

MD5
3453685c1fc9410efd42bccd841ecfe7

SHA1
5a89a8bf5640aba18c88bae4be743f75bd002d4a

SHA256
0b573067056eee776e727dbf6ca770343fc97afde3135e3c601d2a1d4f91ed1a

SHA512
7257b47b00840609c4bd7b96fd4b77c605d736aac550f1cffc695ba36350214a2cfba4415be4a29ec3e374dd7e518c6abe398a0df4398b1f5fd3154e247848ae

Download Submit
C:\Windows\system\NUDIfaT.exe

Filesize
1.9MB

MD5
6e678c0729f2bef6e3cf80fe97cbae37

SHA1
3a62846d1a873d7a595adaaf966240b40ca06816

SHA256
999ad4006c084b8c786441a7f6e3f3ac41b65bd7747e15b85ebb74a200894650

SHA512
fccb891d62a39f2b1a92fc903f924b638e0633b55dc2de23124d00a21a3134c5598b047b5fb0c0bb9eed4951d01c86b95334b8a42e7215ee7a1f2789b8f06133

Download Submit
C:\Windows\system\OCqWIux.exe

Filesize
1.9MB

MD5
dfe70119e9497e49dc7acf0c64a2d03c

SHA1
8a939d9be63881d9f72027e2eb433cc188c56ace

SHA256
701dad2f334402d0877ec31e600a4d585bc50f3db061a9cbb26843da3c69f222

SHA512
e5c90c00c80904634e2422f4b315a8065c4e8a08953d2fe485bda1732409156bd9d389b0e0d24d56fb7fa1f0b1d3db53962d1b72c19551d8082afb01f56463e9

Download Submit
C:\Windows\system\QEsvgPu.exe

Filesize
1.9MB

MD5
efd9d40fcfd017e76c09834269add27d

SHA1
2c9f4620b6915b071282c9de3178f013670f7554

SHA256
41e4db3e1b4adb2d3de831bfb357ac94d2bed9cb396ba819ee82814bed280982

SHA512
9af39885e847dbe90202a196569d7741d64924b498fe06666faf90d85316223fc0de43d8850323f5c57e0ee37f3095f5754ecd43fd829c992c21364ac7e950d2

Download Submit
C:\Windows\system\WvpXtmz.exe

Filesize
1.9MB

MD5
2c862c7cebdb4f3f06a71331c1194b34

SHA1
2283e77932fe4bf5ccf8938cc33c0501c228e025

SHA256
65160c0329004b41e282bcc413382cceabcc36a67326a29f5682652ceb7d3c4d

SHA512
f9b2946cd28d7525c4d265557435b1553144de34c2853a6791a3dfd3e88986305a30519b9f9ea0011f7887bc4d65fb9a78141ea4bce45e1b661913b535fdc951

Download Submit
C:\Windows\system\XJuqknT.exe

Filesize
1.9MB

MD5
12ce033df832cd253f4862c264ad42d5

SHA1
ba281f7986be3984b4e041fcd79fb9e84b14fed9

SHA256
50764fb3a3369e04dd24d6fcb7443ead0107fdc9f9230b695ae971968263a7f0

SHA512
f973e66366faf72d13d4dd6c2a8249d18c473d0d2ba89a88db789786a5c83734720e017e63a059ba9d4b7df4e4f622807038813e4088b10c3b59c94506c46b43

Download Submit
C:\Windows\system\XKAneDJ.exe

Filesize
1.9MB

MD5
90d3bee51df10bf090a41bf8a65c3aed

SHA1
2e37eb41c2ff521f47fd07d3d84aab1185976a1f

SHA256
b1d20c9a63de8ad6d5932751f6de0ecef62a705c732456d8e3130a8e0213d0fd

SHA512
b8390f00cfacea0bd0e70f8af5075e7c5d28a1fb3a44ad3ae1ef6a617ad60938d1e7ff6e44fee86b447bec9907c0c0cf27496cc9812eea905f60fa997a697ef6

Download Submit
C:\Windows\system\ZocKmwi.exe

Filesize
1.9MB

MD5
c74985cb2148e5ceb345bd3c96dfbfe8

SHA1
fa2c392304bafa956ff1489d52bb7ece6131efeb

SHA256
f4f9c207cf1dabe2b648eb807ebb625d1acd732eeb4c57be58d20609f0bcd735

SHA512
e2fe565bb2e76f668178675f52f1a9277d380bb2faf9bfa4ab5bd335fa584ef060c20a7167c991cec65c5f3593e5e3a166f72423a41e4cf41a36690ad5b8e10c

Download Submit
C:\Windows\system\aGzQQEk.exe

Filesize
1.9MB

MD5
610e286e3bbcac629a0c99c14f88ecad

SHA1
49bf8545f77bbd60c658072dfdc6c5c6243fe2b9

SHA256
734112082f0e121e7a975faa4e2411a9bf54c0b2cfed20f2ba8c971298924b32

SHA512
548371891779052c61bd61d14732ce9f57a028f3a8005e3362619c22d768ca0697438e74b1d3c8fe4e72615dac518d285256887f3742f8fdb7a4b9bb8007f7f6

Download Submit
C:\Windows\system\fpOBBHV.exe

Filesize
1.9MB

MD5
bece3ad4eedf605e85d5d443be5c553b

SHA1
41a8100620d171f02bc5d0a217274861a64d245c

SHA256
09933dc338ab1d4e36a5f203cc87f2766371c7d619d452d5b62c2e0c0249b160

SHA512
5c550b11a37c6a334bcd96d696b158ab27ff92eaa0ae4c55c5d98eb73de51d645083d6419573d820dc1d429be4fc845eb88b52cdac70ec8cdd7d63447138a032

Download Submit
C:\Windows\system\oObRefT.exe

Filesize
1.9MB

MD5
b76091fe5f16abd51e89a5332a26cd6d

SHA1
7dd31ca5e529f5895003b1024d2e47abf5f8207f

SHA256
6481f4a3813cfacb8816b5093cc14135af19e922f9e5d006859486d8b1951bf0

SHA512
738a47a9ef9713f4c0e44ae03e523d08041f147cf8e4c77eaf0890caf5efc26397b8bd5e1dc35094c304c66cca6495418f5708779a99205650fb79e67925282a

Download Submit
C:\Windows\system\oiEDpUo.exe

Filesize
1.9MB

MD5
bf58221f4b8c6494e8de0efef84c6139

SHA1
3c3bf505fa5d20a721ff299819c68ff7ce115203

SHA256
61faecde9fdcbcc46ff49ba1205d2f4a308155de8062092482dd73e0dd7c596a

SHA512
14b2e200d87b972416477da4537fc0d38804a6f5609e08c54a80b4db3b4cb9a392deed39456b84a1a158295baaee34da3cc577a6addf39564ec0a8bc7357f324

Download Submit
C:\Windows\system\twPgYfU.exe

Filesize
1.9MB

MD5
f9434a361a97e7f92a7c0507a0606320

SHA1
00e08c1ab645b718abedec5fd029de4167583c79

SHA256
13921987798297a0a9fb8bf81a80a1129020fbbd81727bcf47172e476fe89a49

SHA512
349b6da321f03daa69f07166eb104cbdd605550c227b56858d5f41c468c63be54da01bd8f70623e0d079c9706ca5d7ba87e818e3d3d5bde0665f26b0bfafdfcc

Download Submit
C:\Windows\system\ufSuaMc.exe

Filesize
1.9MB

MD5
132b060388ab9075f5a440f19ee81fcf

SHA1
c56a2cb329cd91648ba8e272e04a4249e70e4a26

SHA256
315d37c05d1d408ad05c915f07e140f59de1272cc3b7f95e5d2fbd56e50fdedc

SHA512
dcff313884e10f9e82f09e8f2084bb005d8161fe0e185d1b3f2f2e010df552816f2a9557fbce761fa04af573915a5051ce87bb3f400595c820556c865ff6ba08

Download Submit
C:\Windows\system\vTwJRns.exe

Filesize
1.9MB

MD5
6efb185ac25352cfdb22258c372c700e

SHA1
db0a82d6f4dcf4066f778e0fea794c80799c206a

SHA256
c8d981d1fd7b69d96346db3090b63a018c977ae188074e0fadb92acacac1d9ff

SHA512
db1d86d8557f336548664487bafc227006c91021b5135d03d5574eba8385e2b3594bc4382a82f54cf06f323de9def01c563947435f84364f834d57bfa302365a

Download Submit
C:\Windows\system\wfVgolO.exe

Filesize
1.9MB

MD5
9d71d5ce0b7d85d9cd3af20d19c91268

SHA1
1f867c3ad2921fb2666e903a6775529caa2cb74d

SHA256
867a1aeef173bd5eccdfc544aba2bc9cda7a408c5ce2413d11381247c02070f5

SHA512
5de35061422ebddbbedcc3c6ca58ea9427b037e537615ee3161c493455604771e385fb9cadc6beb5ca2743a85e3102b9bbd3dce583b65e033010e3669c175021

Download Submit
C:\Windows\system\xkdobBQ.exe

Filesize
1.9MB

MD5
bd8ba88c950b32866791d0f39e27ff61

SHA1
c4442c3a956ed6869fabb2f269d295a1175e7eac

SHA256
579293ff8db4401e6cef839f109ed688090d01de41ac0faf81dda574d9b89ac2

SHA512
27516a99d6626dca49e76e59c5a04763711b358972989f04f9fc767340f7aa5bdde2a702e48778ed7aeeea6521b744fd96fc05994a0fbb8d14a6d755fb204c38

Download Submit
C:\Windows\system\yKsqivh.exe

Filesize
1.9MB

MD5
4afeefcfd3d5d1f8cdac8b3662e07ec7

SHA1
4c36d0076f49e178b49f2a5d83f77bb0497eda98

SHA256
9e51bdde36e2e954ebcc37f9935f79101aeffe664de09d8c6fa085650256928e

SHA512
ba66108e181642be4b6dde6e99db96f8bb8053f249026936d3c485f8550e110cba6454a212703f401e0ee18a4a6f3b294e0a394dc1bd1b4e632162942ddc7408

Download Submit
C:\Windows\system\yfLjXQL.exe

Filesize
1.9MB

MD5
f050b954931b1d4f18282c981d9c6241

SHA1
d9c135fcf85be25efa6722ec2662c81d0facff1b

SHA256
8e40e13436ed3bfe2293c0784cede000620aa7ef42ec35d9aff53ee88b421ca3

SHA512
fcb1bcb3299916f19c0e35854fdc8d384a4c23c2e28235ea8fc5514bbe9d28f4c4fd78828dafa5e1ba4481e3604992fb06e068948bf188b3ec84d0b970b057ca

Download Submit
C:\Windows\system\zHxgFiQ.exe

Filesize
1.9MB

MD5
84230106f1f2c228ad4b71ffe2487d63

SHA1
4cf041af4a51845d3ea5f73d2237e3ffde495015

SHA256
8a27218467263642143d29bb27c89728d6997c1523f7c368f2847940f049f5ff

SHA512
bb252d5984f84735d900a337916643a54bccce19d6e419c47f8a3fcfe854eacaddebee2cbb8aa1a9e68b4772cd4cfcd6490b69097ea9396a85c59888df04f4a3

Download Submit
\Windows\system\CWpxYcs.exe

Filesize
1.9MB

MD5
982f64a835e6f3e8d4fa3f4d288b083b

SHA1
2b9843ee012ac4acaeab75e7cea944e7b378304c

SHA256
4e33a3eb24a09b6760ea1d2e5e9ca58b503687b117b34820b7ae78d3f5434b49

SHA512
9947996f16cf8da1c10d2bccdaea8b9a11f1343ef014b3384a92b383235ca95bc3721ea0752b9f75e117ee507681f5af1e2fe89c5b1911cbed71a9e53cade889

Download Submit
\Windows\system\FAdFjyh.exe

Filesize
1.9MB

MD5
0aca911a95d4a90a20877414c675f0ec

SHA1
10a9e90c252e8bc4adf8aa6db8e356fc594a207a

SHA256
e58161f4a6da8fcd3c2dd3aec7aeb1e5d34e3b013137407571d7eee3f61beb83

SHA512
ef834b086743e8c52983a933307edaa017fe222de736e5adc46938d5b4202417405bb9bef691a28dbdc473f6e06dbb6c3d9ac6da272d033465cf323684016ecf

Download Submit
\Windows\system\JvJxTFp.exe

Filesize
1.9MB

MD5
ec6b8b1c36d052607502eb9543a728a6

SHA1
213e02e5317184710a56e4c161424f564aee6c3b

SHA256
078ba636c0e15386e176cbb7ba47530c5d33b34bdfaf38e860c6deb3cc3b9fea

SHA512
c98595bd265ab2379b001e302dda7530f6d8af1fb9ecca78519f4a6a5a76ce28308f206a25d77d141a18faee28a62dcbb37b2acb40024870f496a423dc400033

Download Submit
\Windows\system\PpeaiXU.exe

Filesize
1.9MB

MD5
0e254f1f33373411c7bc74078d8e3121

SHA1
54d57d18be3a14a54120b1f69667e9878e2092c7

SHA256
953d41564f49db87b386cbf3e7292033993fa362d2b3f16c3bcca977eae38e98

SHA512
6d626283f2483b6a343a92d6ccca9190e84142b0ae2b83cd171d0addfb63c317257b8526fe1656377d7355c98464040f71816771e810181bfd335a0ebccf29d8

Download Submit
\Windows\system\ZwfnWaa.exe

Filesize
1.9MB

MD5
9423895513043ac97d16d512f0d26c52

SHA1
ac36b2e3cd6d154dc2b57d12f28d9a64dcdc53ed

SHA256
73e37ace07457283697a84fe58f9be1dd51a058213a3c4df86a2c98f68a5df13

SHA512
5ef7336921943883fefe0073e16da5e45aef9f821150ad870ed7d610da8115ca753b00ce778050bf2987da23cef5bda93f935fa32a6e207c4bc486ae89be7f1f

Download Submit
\Windows\system\fIktiqw.exe

Filesize
1.9MB

MD5
cc5b9d4d8a61d85c8295083190c0e511

SHA1
16e4d1177c791c77af8751a70de76f2f144ca795

SHA256
70a3019c07740c2840377c29b566dda61c8db83482ceb8e5257a8dbc98e925ca

SHA512
64373b3d59a8dafc5bc9749e7f0862e2f0bfaa6b25de7d1ca631a20e75310de11360f4084ca274818543d84bdd20b4256509e468d03c7b2f1dea607d75bfd6e5

Download Submit
\Windows\system\ruBUitp.exe

Filesize
1.9MB

MD5
acb88b12e82c56324ed50342fe548e97

SHA1
a3000a366f6b1de77203eed9ccaa12ae2f242f93

SHA256
4995e198673b35f65cc83b24ab6beff59c2c2b8b6d91b513e81b0b05c7c6b437

SHA512
958e2ea98abc0b4b65b0dcf579b18710e2b492c76bc2ebf6c68d0533ff910ba036e5b316c0d50bd556b2836f2063dd4009559795a709f09b9d2b301ea9479977

Download Submit
\Windows\system\xoyJKOS.exe

Filesize
1.9MB

MD5
0d5a5c14c0034ded626ddd6b476d407e

SHA1
a0bf889a4845d0b8b0dc1ccc7af0033183e7cc07

SHA256
63ee96ff3d44f12e90d002634a8d6ca53a2846803fbff8f176d57c6cbeef6731

SHA512
e6a415e42a8e77243699957080e8bf17f9789b802bea143309dd2e1adf4601ac799fe3680431ca7d45f9a4ca1e7f43380613768ef6159064fcc9ee45c5b71e7a

Download Submit
memory/1252-3913-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/1252-187-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2036-167-0x000007FEF5890000-0x000007FEF622D000-memory.dmp

Filesize
9.6MB

Download
memory/2036-18-0x000007FEF5B4E000-0x000007FEF5B4F000-memory.dmp

Filesize
4KB

Download
memory/2036-106-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2036-17-0x0000000002880000-0x0000000002900000-memory.dmp

Filesize
512KB

Download
memory/2036-105-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2036-470-0x000007FEF5890000-0x000007FEF622D000-memory.dmp

Filesize
9.6MB

Download
memory/2036-192-0x000007FEF5890000-0x000007FEF622D000-memory.dmp

Filesize
9.6MB

Download
memory/2240-1-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-179-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-188-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2240-175-0x0000000003410000-0x0000000003802000-memory.dmp

Filesize
3.9MB

Download
memory/2240-6967-0x0000000003410000-0x0000000003802000-memory.dmp

Filesize
3.9MB

Download
memory/2240-173-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2240-6965-0x0000000003410000-0x0000000003802000-memory.dmp

Filesize
3.9MB

Download
memory/2240-170-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-6968-0x0000000003410000-0x0000000003802000-memory.dmp

Filesize
3.9MB

Download
memory/2240-168-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-177-0x0000000003410000-0x0000000003802000-memory.dmp

Filesize
3.9MB

Download
memory/2240-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2240-193-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-6851-0x0000000003410000-0x0000000003802000-memory.dmp

Filesize
3.9MB

Download
memory/2240-5037-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-190-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-181-0x0000000003410000-0x0000000003802000-memory.dmp

Filesize
3.9MB

Download
memory/2240-8-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-186-0x0000000003410000-0x0000000003802000-memory.dmp

Filesize
3.9MB

Download
memory/2380-3893-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2380-176-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2408-182-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2408-3895-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2484-178-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2484-3889-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2528-3886-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-171-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-3902-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2556-189-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2612-3919-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-191-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-13-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2620-3883-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2652-3897-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2652-174-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2664-3953-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2664-194-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2696-169-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-3908-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-180-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download