xmrig | ed1e1fa4d52ee1388ee5f79946238eb5c884ce41ce66baf08857d65c35cfc315

Analysis

max time kernel
22s
max time network
16s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
Size

1.8MB
MD5

03f9eeaa3148691c2cd3fd75366b3fc3
SHA1

dc19754ab6746a57e956d3f670807d5a2e67f99e
SHA256

ed1e1fa4d52ee1388ee5f79946238eb5c884ce41ce66baf08857d65c35cfc315
SHA512

3b309bd0f5aaf8cf63cbfe0cc58b112561d350d609641d6cfe9bb6429e5cbc4aa339505739232a60eaa7a85344a5ee445431767bb1f4faa8197b1b7dac9cdf0f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrI5/:NAB1

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2128-35-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2604-218-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2576-217-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2572-214-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/2688-223-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2488-228-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/2676-225-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2208-27-0x000000013F660000-0x000000013FA52000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2208	cPbkass.exe
2128	RnwLPZt.exe
2572	bdBBtPT.exe
2576	fQoytls.exe
2604	nHAwNfS.exe
2688	rqCInrw.exe
2676	frVyJei.exe
2488	VWqsCAL.exe
2368	wjSMKjM.exe
2008	aNXiQxg.exe
2148	gvRXXbR.exe
2036	VHAnEbP.exe
1896	LNIRAeZ.exe
2712	EhYTrzX.exe
948	ePhQXiN.exe
1216	kXikWvJ.exe
1740	sEsXlsH.exe
2624	OiYVUDS.exe
2236	HwEtGco.exe
684	aywjYuh.exe
1640	UkCRYtX.exe
2444	mXmBBuE.exe
2336	zcVhTvo.exe
344	BypcWxj.exe
2564	XEdPVjK.exe
2076	DKuqjZe.exe
3064	nQikjyz.exe
2764	DiAvBoM.exe
1180	JLkjhxq.exe
956	ppDlOSy.exe
1552	SksKRvd.exe
960	pjFaMHu.exe
2760	klHWZuJ.exe
1680	kFJSLtr.exe
1644	PXbyjzW.exe
2620	gsehkxr.exe
708	nSeNYDT.exe
1908	RwpzArl.exe
2544	kPTYsXL.exe
1860	RvPsGso.exe
672	BzARwuB.exe
2084	pXYKdEv.exe
1616	GFCSrik.exe
700	LuynZgQ.exe
1904	MoTdZIM.exe
704	DmpEljM.exe
876	tbHwuDI.exe
2816	oYgjHBu.exe
2884	GysUkJL.exe
1596	GAwWFzA.exe
2356	EMvKxsh.exe
2640	bzbxSlD.exe
2452	lHZBGVW.exe
2804	IuSaXSu.exe
2500	PbhwWxy.exe
2912	JQFhpPm.exe
2028	VlIxMmB.exe
2748	zqzzYzY.exe
1660	zdGunJN.exe
560	LTKXTLe.exe
2420	lgjWreI.exe
2684	ewhiMvg.exe
1140	MgCyIlT.exe
2408	TEmjibf.exe

Loads dropped DLL 64 IoCs

pid	Process
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1540-0-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/files/0x00090000000141a2-6.dat	upx
behavioral1/files/0x00090000000143ec-11.dat	upx
behavioral1/files/0x00080000000146b8-40.dat	upx
behavioral1/files/0x00070000000147ea-49.dat	upx
behavioral1/files/0x00070000000149f5-54.dat	upx
behavioral1/files/0x0006000000014af6-61.dat	upx
behavioral1/files/0x0006000000014b70-70.dat	upx
behavioral1/files/0x0006000000014ef8-80.dat	upx
behavioral1/files/0x00060000000155ed-85.dat	upx
behavioral1/files/0x0006000000015b6f-115.dat	upx
behavioral1/files/0x0006000000015d07-164.dat	upx
behavioral1/files/0x0006000000015d1a-175.dat	upx
behavioral1/memory/2128-35-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/files/0x00080000000146c0-41.dat	upx
behavioral1/files/0x00090000000146a2-104.dat	upx
behavioral1/files/0x0006000000015605-99.dat	upx
behavioral1/files/0x0006000000015c78-137.dat	upx
behavioral1/files/0x0006000000015c83-134.dat	upx
behavioral1/files/0x0006000000015cb6-142.dat	upx
behavioral1/files/0x0006000000014abe-173.dat	upx
behavioral1/files/0x0006000000015d0f-169.dat	upx
behavioral1/files/0x0006000000015cfe-161.dat	upx
behavioral1/memory/2604-218-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2576-217-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/files/0x0007000000014825-155.dat	upx
behavioral1/files/0x0006000000015cee-151.dat	upx
behavioral1/files/0x0006000000015c6b-125.dat	upx
behavioral1/files/0x0006000000015c3d-117.dat	upx
behavioral1/files/0x0006000000015626-109.dat	upx
behavioral1/memory/2572-214-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/memory/2688-223-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/2488-228-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/memory/2676-225-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/files/0x00060000000155f3-88.dat	upx
behavioral1/files/0x0006000000015018-82.dat	upx
behavioral1/files/0x0006000000014de9-73.dat	upx
behavioral1/files/0x0006000000014b31-66.dat	upx
behavioral1/files/0x000f000000005578-53.dat	upx
behavioral1/memory/2208-27-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/files/0x0006000000015cf6-160.dat	upx
behavioral1/files/0x0006000000015cce-148.dat	upx
behavioral1/files/0x0006000000015c9f-140.dat	upx
behavioral1/files/0x0006000000015c52-122.dat	upx
behavioral1/files/0x0006000000015616-108.dat	upx
behavioral1/files/0x00060000000155f7-96.dat	upx
behavioral1/files/0x000b000000014667-39.dat	upx
behavioral1/files/0x00080000000144ac-19.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EpSqyyw.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\qsqGdye.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\nHAwNfS.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\sRyPhFE.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\NVJJGsB.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\xyrgdAW.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\KnAvxTJ.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\IuSaXSu.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\vwQqnoX.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\YDGnmtV.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\nSeNYDT.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\cGlmsQJ.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\UAXTikj.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\cMaXlgs.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\pmXzJNs.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\wVjaFZy.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\mRyKqBa.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\kSvEiRm.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\pulYgwf.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\VURkPRx.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\rOHyokg.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\WjPOZdv.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\lVjwaJa.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\klHWZuJ.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\ojEvogW.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\bgUwAVQ.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\qQdHHFa.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\beTraIE.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\VWqsCAL.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\zqzzYzY.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\XpZlQgY.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\mYEMpAr.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\gDjxDfy.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\fEcMHtP.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\zRMofnk.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\mGVNllH.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\tKxYAHq.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\FsezVQx.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\ARRiqvj.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\XiQBCSQ.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\xlwSMGQ.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\WGvpsYR.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\rUOlibA.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\NuMJfWf.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\BvWZTWb.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\sEsXlsH.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\LspdbiD.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\wsLBdPi.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\DAbPmwj.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\oIzUTtq.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\xxLDoYo.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\vWDyWZM.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\JQFhpPm.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\lgjWreI.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\brwXPWv.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\zWKluHZ.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\vtGXLBm.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\EolPvTC.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\tKyGshP.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\RnwLPZt.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\BAKUcqG.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\LEdrouG.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\VDcDhCn.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
File created	C:\Windows\System\WGRPZhj.exe	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2176	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeLockMemoryPrivilege	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2176	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	29
PID 1540 wrote to memory of 2176	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	29
PID 1540 wrote to memory of 2176	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	29
PID 1540 wrote to memory of 2208	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	30
PID 1540 wrote to memory of 2208	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	30
PID 1540 wrote to memory of 2208	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	30
PID 1540 wrote to memory of 2128	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	31
PID 1540 wrote to memory of 2128	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	31
PID 1540 wrote to memory of 2128	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	31
PID 1540 wrote to memory of 2572	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	32
PID 1540 wrote to memory of 2572	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	32
PID 1540 wrote to memory of 2572	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	32
PID 1540 wrote to memory of 2676	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	33
PID 1540 wrote to memory of 2676	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	33
PID 1540 wrote to memory of 2676	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	33
PID 1540 wrote to memory of 2576	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	34
PID 1540 wrote to memory of 2576	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	34
PID 1540 wrote to memory of 2576	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	34
PID 1540 wrote to memory of 2712	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	35
PID 1540 wrote to memory of 2712	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	35
PID 1540 wrote to memory of 2712	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	35
PID 1540 wrote to memory of 2604	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	36
PID 1540 wrote to memory of 2604	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	36
PID 1540 wrote to memory of 2604	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	36
PID 1540 wrote to memory of 2624	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	37
PID 1540 wrote to memory of 2624	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	37
PID 1540 wrote to memory of 2624	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	37
PID 1540 wrote to memory of 2688	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	38
PID 1540 wrote to memory of 2688	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	38
PID 1540 wrote to memory of 2688	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	38
PID 1540 wrote to memory of 2444	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	39
PID 1540 wrote to memory of 2444	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	39
PID 1540 wrote to memory of 2444	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	39
PID 1540 wrote to memory of 2488	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	40
PID 1540 wrote to memory of 2488	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	40
PID 1540 wrote to memory of 2488	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	40
PID 1540 wrote to memory of 2564	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	41
PID 1540 wrote to memory of 2564	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	41
PID 1540 wrote to memory of 2564	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	41
PID 1540 wrote to memory of 2368	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	42
PID 1540 wrote to memory of 2368	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	42
PID 1540 wrote to memory of 2368	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	42
PID 1540 wrote to memory of 3064	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	43
PID 1540 wrote to memory of 3064	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	43
PID 1540 wrote to memory of 3064	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	43
PID 1540 wrote to memory of 2008	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	44
PID 1540 wrote to memory of 2008	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	44
PID 1540 wrote to memory of 2008	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	44
PID 1540 wrote to memory of 2764	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	45
PID 1540 wrote to memory of 2764	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	45
PID 1540 wrote to memory of 2764	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	45
PID 1540 wrote to memory of 2148	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	46
PID 1540 wrote to memory of 2148	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	46
PID 1540 wrote to memory of 2148	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	46
PID 1540 wrote to memory of 1180	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	47
PID 1540 wrote to memory of 1180	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	47
PID 1540 wrote to memory of 1180	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	47
PID 1540 wrote to memory of 2036	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	48
PID 1540 wrote to memory of 2036	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	48
PID 1540 wrote to memory of 2036	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	48
PID 1540 wrote to memory of 956	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	49
PID 1540 wrote to memory of 956	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	49
PID 1540 wrote to memory of 956	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	49
PID 1540 wrote to memory of 1896	1540	03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03f9eeaa3148691c2cd3fd75366b3fc3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\System\cPbkass.exe
  C:\Windows\System\cPbkass.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\RnwLPZt.exe
  C:\Windows\System\RnwLPZt.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\bdBBtPT.exe
  C:\Windows\System\bdBBtPT.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\frVyJei.exe
  C:\Windows\System\frVyJei.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\fQoytls.exe
  C:\Windows\System\fQoytls.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\EhYTrzX.exe
  C:\Windows\System\EhYTrzX.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\nHAwNfS.exe
  C:\Windows\System\nHAwNfS.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\OiYVUDS.exe
  C:\Windows\System\OiYVUDS.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\rqCInrw.exe
  C:\Windows\System\rqCInrw.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\mXmBBuE.exe
  C:\Windows\System\mXmBBuE.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\VWqsCAL.exe
  C:\Windows\System\VWqsCAL.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\XEdPVjK.exe
  C:\Windows\System\XEdPVjK.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\wjSMKjM.exe
  C:\Windows\System\wjSMKjM.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\nQikjyz.exe
  C:\Windows\System\nQikjyz.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\aNXiQxg.exe
  C:\Windows\System\aNXiQxg.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\DiAvBoM.exe
  C:\Windows\System\DiAvBoM.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\gvRXXbR.exe
  C:\Windows\System\gvRXXbR.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\JLkjhxq.exe
  C:\Windows\System\JLkjhxq.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\VHAnEbP.exe
  C:\Windows\System\VHAnEbP.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\ppDlOSy.exe
  C:\Windows\System\ppDlOSy.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\LNIRAeZ.exe
  C:\Windows\System\LNIRAeZ.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\pjFaMHu.exe
  C:\Windows\System\pjFaMHu.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\ePhQXiN.exe
  C:\Windows\System\ePhQXiN.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\klHWZuJ.exe
  C:\Windows\System\klHWZuJ.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\kXikWvJ.exe
  C:\Windows\System\kXikWvJ.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\kFJSLtr.exe
  C:\Windows\System\kFJSLtr.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\sEsXlsH.exe
  C:\Windows\System\sEsXlsH.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\PXbyjzW.exe
  C:\Windows\System\PXbyjzW.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\HwEtGco.exe
  C:\Windows\System\HwEtGco.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\gsehkxr.exe
  C:\Windows\System\gsehkxr.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\aywjYuh.exe
  C:\Windows\System\aywjYuh.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\nSeNYDT.exe
  C:\Windows\System\nSeNYDT.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\UkCRYtX.exe
  C:\Windows\System\UkCRYtX.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\kPTYsXL.exe
  C:\Windows\System\kPTYsXL.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\zcVhTvo.exe
  C:\Windows\System\zcVhTvo.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\RvPsGso.exe
  C:\Windows\System\RvPsGso.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\BypcWxj.exe
  C:\Windows\System\BypcWxj.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\BzARwuB.exe
  C:\Windows\System\BzARwuB.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\DKuqjZe.exe
  C:\Windows\System\DKuqjZe.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\pXYKdEv.exe
  C:\Windows\System\pXYKdEv.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\SksKRvd.exe
  C:\Windows\System\SksKRvd.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\GFCSrik.exe
  C:\Windows\System\GFCSrik.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\RwpzArl.exe
  C:\Windows\System\RwpzArl.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\MoTdZIM.exe
  C:\Windows\System\MoTdZIM.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\LuynZgQ.exe
  C:\Windows\System\LuynZgQ.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\tbHwuDI.exe
  C:\Windows\System\tbHwuDI.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\DmpEljM.exe
  C:\Windows\System\DmpEljM.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\oYgjHBu.exe
  C:\Windows\System\oYgjHBu.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\GysUkJL.exe
  C:\Windows\System\GysUkJL.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\GAwWFzA.exe
  C:\Windows\System\GAwWFzA.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\EMvKxsh.exe
  C:\Windows\System\EMvKxsh.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\bzbxSlD.exe
  C:\Windows\System\bzbxSlD.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\lHZBGVW.exe
  C:\Windows\System\lHZBGVW.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\IuSaXSu.exe
  C:\Windows\System\IuSaXSu.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\PbhwWxy.exe
  C:\Windows\System\PbhwWxy.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\JQFhpPm.exe
  C:\Windows\System\JQFhpPm.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\VlIxMmB.exe
  C:\Windows\System\VlIxMmB.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\zqzzYzY.exe
  C:\Windows\System\zqzzYzY.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\zdGunJN.exe
  C:\Windows\System\zdGunJN.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\LTKXTLe.exe
  C:\Windows\System\LTKXTLe.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\lgjWreI.exe
  C:\Windows\System\lgjWreI.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\ewhiMvg.exe
  C:\Windows\System\ewhiMvg.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\MgCyIlT.exe
  C:\Windows\System\MgCyIlT.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\TEmjibf.exe
  C:\Windows\System\TEmjibf.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\BFCUIJg.exe
  C:\Windows\System\BFCUIJg.exe
  2⤵
  PID:3020
- C:\Windows\System\tdOZQlS.exe
  C:\Windows\System\tdOZQlS.exe
  2⤵
  PID:2548
- C:\Windows\System\wyGGYkD.exe
  C:\Windows\System\wyGGYkD.exe
  2⤵
  PID:2244
- C:\Windows\System\GuboUUQ.exe
  C:\Windows\System\GuboUUQ.exe
  2⤵
  PID:604
- C:\Windows\System\wVjaFZy.exe
  C:\Windows\System\wVjaFZy.exe
  2⤵
  PID:1076
- C:\Windows\System\ARRiqvj.exe
  C:\Windows\System\ARRiqvj.exe
  2⤵
  PID:2636
- C:\Windows\System\AnnKfsW.exe
  C:\Windows\System\AnnKfsW.exe
  2⤵
  PID:2096
- C:\Windows\System\UNclGMn.exe
  C:\Windows\System\UNclGMn.exe
  2⤵
  PID:3012
- C:\Windows\System\eeXjbOI.exe
  C:\Windows\System\eeXjbOI.exe
  2⤵
  PID:2456
- C:\Windows\System\NTUMVfq.exe
  C:\Windows\System\NTUMVfq.exe
  2⤵
  PID:1788
- C:\Windows\System\yrlBghL.exe
  C:\Windows\System\yrlBghL.exe
  2⤵
  PID:1868
- C:\Windows\System\xsecXDu.exe
  C:\Windows\System\xsecXDu.exe
  2⤵
  PID:1804
- C:\Windows\System\wcQMRid.exe
  C:\Windows\System\wcQMRid.exe
  2⤵
  PID:1812
- C:\Windows\System\IuIWYvL.exe
  C:\Windows\System\IuIWYvL.exe
  2⤵
  PID:1996
- C:\Windows\System\mRyKqBa.exe
  C:\Windows\System\mRyKqBa.exe
  2⤵
  PID:1744
- C:\Windows\System\wsLBdPi.exe
  C:\Windows\System\wsLBdPi.exe
  2⤵
  PID:2656
- C:\Windows\System\rqhOszE.exe
  C:\Windows\System\rqhOszE.exe
  2⤵
  PID:2324
- C:\Windows\System\EVbzZfm.exe
  C:\Windows\System\EVbzZfm.exe
  2⤵
  PID:2936
- C:\Windows\System\AxRowXL.exe
  C:\Windows\System\AxRowXL.exe
  2⤵
  PID:2312
- C:\Windows\System\wmZgmtI.exe
  C:\Windows\System\wmZgmtI.exe
  2⤵
  PID:2120
- C:\Windows\System\qMwbXvF.exe
  C:\Windows\System\qMwbXvF.exe
  2⤵
  PID:2496
- C:\Windows\System\zccRiOd.exe
  C:\Windows\System\zccRiOd.exe
  2⤵
  PID:2184
- C:\Windows\System\ewTTVrV.exe
  C:\Windows\System\ewTTVrV.exe
  2⤵
  PID:3008
- C:\Windows\System\VURkPRx.exe
  C:\Windows\System\VURkPRx.exe
  2⤵
  PID:2672
- C:\Windows\System\eVNPTaY.exe
  C:\Windows\System\eVNPTaY.exe
  2⤵
  PID:2696
- C:\Windows\System\bBaAXpV.exe
  C:\Windows\System\bBaAXpV.exe
  2⤵
  PID:2344
- C:\Windows\System\leanIIS.exe
  C:\Windows\System\leanIIS.exe
  2⤵
  PID:1580
- C:\Windows\System\pxHvdud.exe
  C:\Windows\System\pxHvdud.exe
  2⤵
  PID:1584
- C:\Windows\System\ulVOIFf.exe
  C:\Windows\System\ulVOIFf.exe
  2⤵
  PID:1272
- C:\Windows\System\kzTTFOh.exe
  C:\Windows\System\kzTTFOh.exe
  2⤵
  PID:1156
- C:\Windows\System\MfQaFqW.exe
  C:\Windows\System\MfQaFqW.exe
  2⤵
  PID:3000
- C:\Windows\System\hPuAafT.exe
  C:\Windows\System\hPuAafT.exe
  2⤵
  PID:2384
- C:\Windows\System\zWKluHZ.exe
  C:\Windows\System\zWKluHZ.exe
  2⤵
  PID:2812
- C:\Windows\System\kSvEiRm.exe
  C:\Windows\System\kSvEiRm.exe
  2⤵
  PID:2828
- C:\Windows\System\YJULHFg.exe
  C:\Windows\System\YJULHFg.exe
  2⤵
  PID:2768
- C:\Windows\System\bZnGQnZ.exe
  C:\Windows\System\bZnGQnZ.exe
  2⤵
  PID:1816
- C:\Windows\System\QOskRde.exe
  C:\Windows\System\QOskRde.exe
  2⤵
  PID:2020
- C:\Windows\System\MvvpXKv.exe
  C:\Windows\System\MvvpXKv.exe
  2⤵
  PID:2424
- C:\Windows\System\ojEvogW.exe
  C:\Windows\System\ojEvogW.exe
  2⤵
  PID:1928
- C:\Windows\System\szfXXLz.exe
  C:\Windows\System\szfXXLz.exe
  2⤵
  PID:1892
- C:\Windows\System\NCPnwEJ.exe
  C:\Windows\System\NCPnwEJ.exe
  2⤵
  PID:1988
- C:\Windows\System\TQocmOU.exe
  C:\Windows\System\TQocmOU.exe
  2⤵
  PID:1732
- C:\Windows\System\LgIzVAe.exe
  C:\Windows\System\LgIzVAe.exe
  2⤵
  PID:696
- C:\Windows\System\vWnEGaE.exe
  C:\Windows\System\vWnEGaE.exe
  2⤵
  PID:2600
- C:\Windows\System\bgUwAVQ.exe
  C:\Windows\System\bgUwAVQ.exe
  2⤵
  PID:1784
- C:\Windows\System\CdMLtug.exe
  C:\Windows\System\CdMLtug.exe
  2⤵
  PID:988
- C:\Windows\System\eShYMMg.exe
  C:\Windows\System\eShYMMg.exe
  2⤵
  PID:2916
- C:\Windows\System\CUMsaEt.exe
  C:\Windows\System\CUMsaEt.exe
  2⤵
  PID:3044
- C:\Windows\System\sRyPhFE.exe
  C:\Windows\System\sRyPhFE.exe
  2⤵
  PID:1656
- C:\Windows\System\tWuTWaL.exe
  C:\Windows\System\tWuTWaL.exe
  2⤵
  PID:1764
- C:\Windows\System\vWukuat.exe
  C:\Windows\System\vWukuat.exe
  2⤵
  PID:3016
- C:\Windows\System\VUVsWBQ.exe
  C:\Windows\System\VUVsWBQ.exe
  2⤵
  PID:2432
- C:\Windows\System\VNpqXCr.exe
  C:\Windows\System\VNpqXCr.exe
  2⤵
  PID:1196
- C:\Windows\System\WHCkyOH.exe
  C:\Windows\System\WHCkyOH.exe
  2⤵
  PID:1684
- C:\Windows\System\PqDRHUC.exe
  C:\Windows\System\PqDRHUC.exe
  2⤵
  PID:2492
- C:\Windows\System\rrRTvgN.exe
  C:\Windows\System\rrRTvgN.exe
  2⤵
  PID:488
- C:\Windows\System\MxqGaPw.exe
  C:\Windows\System\MxqGaPw.exe
  2⤵
  PID:452
- C:\Windows\System\zRMofnk.exe
  C:\Windows\System\zRMofnk.exe
  2⤵
  PID:2808
- C:\Windows\System\muEplou.exe
  C:\Windows\System\muEplou.exe
  2⤵
  PID:2024
- C:\Windows\System\dLdqXBd.exe
  C:\Windows\System\dLdqXBd.exe
  2⤵
  PID:2836
- C:\Windows\System\nliNOQK.exe
  C:\Windows\System\nliNOQK.exe
  2⤵
  PID:1504
- C:\Windows\System\LspdbiD.exe
  C:\Windows\System\LspdbiD.exe
  2⤵
  PID:2068
- C:\Windows\System\SdENJtq.exe
  C:\Windows\System\SdENJtq.exe
  2⤵
  PID:2080
- C:\Windows\System\fjfcgvU.exe
  C:\Windows\System\fjfcgvU.exe
  2⤵
  PID:1924
- C:\Windows\System\LnfkeHU.exe
  C:\Windows\System\LnfkeHU.exe
  2⤵
  PID:2192
- C:\Windows\System\JRoGjVl.exe
  C:\Windows\System\JRoGjVl.exe
  2⤵
  PID:2832
- C:\Windows\System\hjEBsge.exe
  C:\Windows\System\hjEBsge.exe
  2⤵
  PID:2732
- C:\Windows\System\uHHGDsP.exe
  C:\Windows\System\uHHGDsP.exe
  2⤵
  PID:2524
- C:\Windows\System\BMGRyoT.exe
  C:\Windows\System\BMGRyoT.exe
  2⤵
  PID:2988
- C:\Windows\System\NVJJGsB.exe
  C:\Windows\System\NVJJGsB.exe
  2⤵
  PID:3088
- C:\Windows\System\mGVNllH.exe
  C:\Windows\System\mGVNllH.exe
  2⤵
  PID:3104
- C:\Windows\System\PhkrZpO.exe
  C:\Windows\System\PhkrZpO.exe
  2⤵
  PID:3120
- C:\Windows\System\yKuuApQ.exe
  C:\Windows\System\yKuuApQ.exe
  2⤵
  PID:3136
- C:\Windows\System\rUOlibA.exe
  C:\Windows\System\rUOlibA.exe
  2⤵
  PID:3152
- C:\Windows\System\yWcJQFx.exe
  C:\Windows\System\yWcJQFx.exe
  2⤵
  PID:3168
- C:\Windows\System\RjtlyTO.exe
  C:\Windows\System\RjtlyTO.exe
  2⤵
  PID:3292
- C:\Windows\System\cSQaWJQ.exe
  C:\Windows\System\cSQaWJQ.exe
  2⤵
  PID:3340
- C:\Windows\System\XmBThJj.exe
  C:\Windows\System\XmBThJj.exe
  2⤵
  PID:3368
- C:\Windows\System\QoXexSN.exe
  C:\Windows\System\QoXexSN.exe
  2⤵
  PID:3384
- C:\Windows\System\cYztamT.exe
  C:\Windows\System\cYztamT.exe
  2⤵
  PID:3400
- C:\Windows\System\gVRFdYT.exe
  C:\Windows\System\gVRFdYT.exe
  2⤵
  PID:3416
- C:\Windows\System\vwQqnoX.exe
  C:\Windows\System\vwQqnoX.exe
  2⤵
  PID:3432
- C:\Windows\System\NsjDFPX.exe
  C:\Windows\System\NsjDFPX.exe
  2⤵
  PID:3448
- C:\Windows\System\tftsRqc.exe
  C:\Windows\System\tftsRqc.exe
  2⤵
  PID:3464
- C:\Windows\System\slAujjP.exe
  C:\Windows\System\slAujjP.exe
  2⤵
  PID:3480
- C:\Windows\System\ffqjdvI.exe
  C:\Windows\System\ffqjdvI.exe
  2⤵
  PID:3496
- C:\Windows\System\HtcCbxl.exe
  C:\Windows\System\HtcCbxl.exe
  2⤵
  PID:3512
- C:\Windows\System\DAbPmwj.exe
  C:\Windows\System\DAbPmwj.exe
  2⤵
  PID:3528
- C:\Windows\System\WTjzvGQ.exe
  C:\Windows\System\WTjzvGQ.exe
  2⤵
  PID:3544
- C:\Windows\System\xyrgdAW.exe
  C:\Windows\System\xyrgdAW.exe
  2⤵
  PID:3564
- C:\Windows\System\qRUdtXU.exe
  C:\Windows\System\qRUdtXU.exe
  2⤵
  PID:3580
- C:\Windows\System\EGtkYDk.exe
  C:\Windows\System\EGtkYDk.exe
  2⤵
  PID:3596
- C:\Windows\System\oCimMOR.exe
  C:\Windows\System\oCimMOR.exe
  2⤵
  PID:3612
- C:\Windows\System\qRWpGAQ.exe
  C:\Windows\System\qRWpGAQ.exe
  2⤵
  PID:3628
- C:\Windows\System\NuMJfWf.exe
  C:\Windows\System\NuMJfWf.exe
  2⤵
  PID:3648
- C:\Windows\System\rAvAyHK.exe
  C:\Windows\System\rAvAyHK.exe
  2⤵
  PID:3664
- C:\Windows\System\EfRZkFM.exe
  C:\Windows\System\EfRZkFM.exe
  2⤵
  PID:3680
- C:\Windows\System\Mfjmueh.exe
  C:\Windows\System\Mfjmueh.exe
  2⤵
  PID:3696
- C:\Windows\System\tcAscTC.exe
  C:\Windows\System\tcAscTC.exe
  2⤵
  PID:3712
- C:\Windows\System\fisUjLH.exe
  C:\Windows\System\fisUjLH.exe
  2⤵
  PID:3728
- C:\Windows\System\zHYeNkE.exe
  C:\Windows\System\zHYeNkE.exe
  2⤵
  PID:3744
- C:\Windows\System\kKlgmhX.exe
  C:\Windows\System\kKlgmhX.exe
  2⤵
  PID:3764
- C:\Windows\System\DEKcsEc.exe
  C:\Windows\System\DEKcsEc.exe
  2⤵
  PID:3784
- C:\Windows\System\qIFysVe.exe
  C:\Windows\System\qIFysVe.exe
  2⤵
  PID:3800
- C:\Windows\System\iLmQmGi.exe
  C:\Windows\System\iLmQmGi.exe
  2⤵
  PID:3816
- C:\Windows\System\WUCIaWi.exe
  C:\Windows\System\WUCIaWi.exe
  2⤵
  PID:3832
- C:\Windows\System\aJTyYrl.exe
  C:\Windows\System\aJTyYrl.exe
  2⤵
  PID:3848
- C:\Windows\System\YDGnmtV.exe
  C:\Windows\System\YDGnmtV.exe
  2⤵
  PID:3864
- C:\Windows\System\uDBfOhq.exe
  C:\Windows\System\uDBfOhq.exe
  2⤵
  PID:3884
- C:\Windows\System\NTEnTaA.exe
  C:\Windows\System\NTEnTaA.exe
  2⤵
  PID:3900
- C:\Windows\System\qcYwKFt.exe
  C:\Windows\System\qcYwKFt.exe
  2⤵
  PID:3916
- C:\Windows\System\gCUrGuM.exe
  C:\Windows\System\gCUrGuM.exe
  2⤵
  PID:3932
- C:\Windows\System\fDOmmrV.exe
  C:\Windows\System\fDOmmrV.exe
  2⤵
  PID:3948
- C:\Windows\System\UGZnFtE.exe
  C:\Windows\System\UGZnFtE.exe
  2⤵
  PID:3964
- C:\Windows\System\keOMpnk.exe
  C:\Windows\System\keOMpnk.exe
  2⤵
  PID:3980
- C:\Windows\System\xkDjlDa.exe
  C:\Windows\System\xkDjlDa.exe
  2⤵
  PID:3996
- C:\Windows\System\ishgOae.exe
  C:\Windows\System\ishgOae.exe
  2⤵
  PID:4036
- C:\Windows\System\cGlmsQJ.exe
  C:\Windows\System\cGlmsQJ.exe
  2⤵
  PID:4052
- C:\Windows\System\ZgfCbxD.exe
  C:\Windows\System\ZgfCbxD.exe
  2⤵
  PID:4068
- C:\Windows\System\Ivawbou.exe
  C:\Windows\System\Ivawbou.exe
  2⤵
  PID:4084
- C:\Windows\System\NszkANw.exe
  C:\Windows\System\NszkANw.exe
  2⤵
  PID:1284
- C:\Windows\System\vtGXLBm.exe
  C:\Windows\System\vtGXLBm.exe
  2⤵
  PID:2196
- C:\Windows\System\QjqSMrF.exe
  C:\Windows\System\QjqSMrF.exe
  2⤵
  PID:1052
- C:\Windows\System\eibxHsx.exe
  C:\Windows\System\eibxHsx.exe
  2⤵
  PID:1456
- C:\Windows\System\BvWZTWb.exe
  C:\Windows\System\BvWZTWb.exe
  2⤵
  PID:2132
- C:\Windows\System\tMPdJfS.exe
  C:\Windows\System\tMPdJfS.exe
  2⤵
  PID:3240
- C:\Windows\System\JgAAKCZ.exe
  C:\Windows\System\JgAAKCZ.exe
  2⤵
  PID:3260
- C:\Windows\System\PbEAqKc.exe
  C:\Windows\System\PbEAqKc.exe
  2⤵
  PID:2440
- C:\Windows\System\XQPcgGy.exe
  C:\Windows\System\XQPcgGy.exe
  2⤵
  PID:3276
- C:\Windows\System\tqTNjLr.exe
  C:\Windows\System\tqTNjLr.exe
  2⤵
  PID:3128
- C:\Windows\System\GqCPSzf.exe
  C:\Windows\System\GqCPSzf.exe
  2⤵
  PID:1932
- C:\Windows\System\owWtRkv.exe
  C:\Windows\System\owWtRkv.exe
  2⤵
  PID:2660
- C:\Windows\System\lHqKefO.exe
  C:\Windows\System\lHqKefO.exe
  2⤵
  PID:3376
- C:\Windows\System\MTEVlbO.exe
  C:\Windows\System\MTEVlbO.exe
  2⤵
  PID:3412
- C:\Windows\System\twuILEd.exe
  C:\Windows\System\twuILEd.exe
  2⤵
  PID:3504
- C:\Windows\System\xHGHbVE.exe
  C:\Windows\System\xHGHbVE.exe
  2⤵
  PID:3424
- C:\Windows\System\kdHawNt.exe
  C:\Windows\System\kdHawNt.exe
  2⤵
  PID:3572
- C:\Windows\System\dzVhReA.exe
  C:\Windows\System\dzVhReA.exe
  2⤵
  PID:3636
- C:\Windows\System\vmvOiZa.exe
  C:\Windows\System\vmvOiZa.exe
  2⤵
  PID:3708
- C:\Windows\System\rOHyokg.exe
  C:\Windows\System\rOHyokg.exe
  2⤵
  PID:3776
- C:\Windows\System\HSkKsyG.exe
  C:\Windows\System\HSkKsyG.exe
  2⤵
  PID:3840
- C:\Windows\System\vFsplUj.exe
  C:\Windows\System\vFsplUj.exe
  2⤵
  PID:3476
- C:\Windows\System\YSvSbNV.exe
  C:\Windows\System\YSvSbNV.exe
  2⤵
  PID:3940
- C:\Windows\System\UAXTikj.exe
  C:\Windows\System\UAXTikj.exe
  2⤵
  PID:4004
- C:\Windows\System\miKgGau.exe
  C:\Windows\System\miKgGau.exe
  2⤵
  PID:4024
- C:\Windows\System\pYFqjtE.exe
  C:\Windows\System\pYFqjtE.exe
  2⤵
  PID:3608
- C:\Windows\System\HwZQcKZ.exe
  C:\Windows\System\HwZQcKZ.exe
  2⤵
  PID:3456
- C:\Windows\System\sPULRgg.exe
  C:\Windows\System\sPULRgg.exe
  2⤵
  PID:4092
- C:\Windows\System\KLBwRWo.exe
  C:\Windows\System\KLBwRWo.exe
  2⤵
  PID:3492
- C:\Windows\System\RfaGWVg.exe
  C:\Windows\System\RfaGWVg.exe
  2⤵
  PID:3552
- C:\Windows\System\SVTZdsG.exe
  C:\Windows\System\SVTZdsG.exe
  2⤵
  PID:3592
- C:\Windows\System\PYTlmFH.exe
  C:\Windows\System\PYTlmFH.exe
  2⤵
  PID:3656
- C:\Windows\System\vAzuDeg.exe
  C:\Windows\System\vAzuDeg.exe
  2⤵
  PID:3724
- C:\Windows\System\KptSwSa.exe
  C:\Windows\System\KptSwSa.exe
  2⤵
  PID:3792
- C:\Windows\System\KlPBLVd.exe
  C:\Windows\System\KlPBLVd.exe
  2⤵
  PID:3856
- C:\Windows\System\leCpexd.exe
  C:\Windows\System\leCpexd.exe
  2⤵
  PID:3924
- C:\Windows\System\KpVfaNV.exe
  C:\Windows\System\KpVfaNV.exe
  2⤵
  PID:3988
- C:\Windows\System\lesqufs.exe
  C:\Windows\System\lesqufs.exe
  2⤵
  PID:4048
- C:\Windows\System\XpZlQgY.exe
  C:\Windows\System\XpZlQgY.exe
  2⤵
  PID:2156
- C:\Windows\System\NvBvsaP.exe
  C:\Windows\System\NvBvsaP.exe
  2⤵
  PID:2616
- C:\Windows\System\jUWCatU.exe
  C:\Windows\System\jUWCatU.exe
  2⤵
  PID:1628
- C:\Windows\System\DcwGnGG.exe
  C:\Windows\System\DcwGnGG.exe
  2⤵
  PID:2724
- C:\Windows\System\pXNnOsS.exe
  C:\Windows\System\pXNnOsS.exe
  2⤵
  PID:2964
- C:\Windows\System\wGBjdst.exe
  C:\Windows\System\wGBjdst.exe
  2⤵
  PID:3084
- C:\Windows\System\xFEqoao.exe
  C:\Windows\System\xFEqoao.exe
  2⤵
  PID:3176
- C:\Windows\System\mYEMpAr.exe
  C:\Windows\System\mYEMpAr.exe
  2⤵
  PID:3200
- C:\Windows\System\TTqJQSO.exe
  C:\Windows\System\TTqJQSO.exe
  2⤵
  PID:3208
- C:\Windows\System\QSdDyzv.exe
  C:\Windows\System\QSdDyzv.exe
  2⤵
  PID:3228
- C:\Windows\System\tQvOEhj.exe
  C:\Windows\System\tQvOEhj.exe
  2⤵
  PID:1776
- C:\Windows\System\ippXXhv.exe
  C:\Windows\System\ippXXhv.exe
  2⤵
  PID:620
- C:\Windows\System\QHPqZKD.exe
  C:\Windows\System\QHPqZKD.exe
  2⤵
  PID:1452
- C:\Windows\System\uboqmZG.exe
  C:\Windows\System\uboqmZG.exe
  2⤵
  PID:1652
- C:\Windows\System\ZjAAtwD.exe
  C:\Windows\System\ZjAAtwD.exe
  2⤵
  PID:540
- C:\Windows\System\iQGvtoZ.exe
  C:\Windows\System\iQGvtoZ.exe
  2⤵
  PID:3248
- C:\Windows\System\pulYgwf.exe
  C:\Windows\System\pulYgwf.exe
  2⤵
  PID:3288
- C:\Windows\System\SlBdggx.exe
  C:\Windows\System\SlBdggx.exe
  2⤵
  PID:3100
- C:\Windows\System\swluemC.exe
  C:\Windows\System\swluemC.exe
  2⤵
  PID:1736
- C:\Windows\System\WzQMtPQ.exe
  C:\Windows\System\WzQMtPQ.exe
  2⤵
  PID:3352
- C:\Windows\System\uSjypPN.exe
  C:\Windows\System\uSjypPN.exe
  2⤵
  PID:1884
- C:\Windows\System\mvzfwxQ.exe
  C:\Windows\System\mvzfwxQ.exe
  2⤵
  PID:4108
- C:\Windows\System\KpzhrAE.exe
  C:\Windows\System\KpzhrAE.exe
  2⤵
  PID:4124
- C:\Windows\System\IhfZZqr.exe
  C:\Windows\System\IhfZZqr.exe
  2⤵
  PID:4144
- C:\Windows\System\xOtDWbc.exe
  C:\Windows\System\xOtDWbc.exe
  2⤵
  PID:4160
- C:\Windows\System\BAoTwjm.exe
  C:\Windows\System\BAoTwjm.exe
  2⤵
  PID:4176
- C:\Windows\System\fOvCexA.exe
  C:\Windows\System\fOvCexA.exe
  2⤵
  PID:4192
- C:\Windows\System\SGcUJfL.exe
  C:\Windows\System\SGcUJfL.exe
  2⤵
  PID:4208
- C:\Windows\System\KtCxlEn.exe
  C:\Windows\System\KtCxlEn.exe
  2⤵
  PID:4228
- C:\Windows\System\oIzUTtq.exe
  C:\Windows\System\oIzUTtq.exe
  2⤵
  PID:4248
- C:\Windows\System\LnLYiPL.exe
  C:\Windows\System\LnLYiPL.exe
  2⤵
  PID:4264
- C:\Windows\System\KDgNzBa.exe
  C:\Windows\System\KDgNzBa.exe
  2⤵
  PID:4280
- C:\Windows\System\KyHPncN.exe
  C:\Windows\System\KyHPncN.exe
  2⤵
  PID:4296
- C:\Windows\System\XwCafpr.exe
  C:\Windows\System\XwCafpr.exe
  2⤵
  PID:4312
- C:\Windows\System\dTqZSmQ.exe
  C:\Windows\System\dTqZSmQ.exe
  2⤵
  PID:4328
- C:\Windows\System\AImDVZT.exe
  C:\Windows\System\AImDVZT.exe
  2⤵
  PID:4344
- C:\Windows\System\WGRPZhj.exe
  C:\Windows\System\WGRPZhj.exe
  2⤵
  PID:4364
- C:\Windows\System\AAknLWQ.exe
  C:\Windows\System\AAknLWQ.exe
  2⤵
  PID:4380
- C:\Windows\System\tgqufYA.exe
  C:\Windows\System\tgqufYA.exe
  2⤵
  PID:4396
- C:\Windows\System\REBgfXx.exe
  C:\Windows\System\REBgfXx.exe
  2⤵
  PID:4412
- C:\Windows\System\uBBbBgz.exe
  C:\Windows\System\uBBbBgz.exe
  2⤵
  PID:4428
- C:\Windows\System\aRPlpAJ.exe
  C:\Windows\System\aRPlpAJ.exe
  2⤵
  PID:4444
- C:\Windows\System\snYNXTn.exe
  C:\Windows\System\snYNXTn.exe
  2⤵
  PID:4464
- C:\Windows\System\eOoPBxu.exe
  C:\Windows\System\eOoPBxu.exe
  2⤵
  PID:4480
- C:\Windows\System\WqPGNTa.exe
  C:\Windows\System\WqPGNTa.exe
  2⤵
  PID:4496
- C:\Windows\System\KnAvxTJ.exe
  C:\Windows\System\KnAvxTJ.exe
  2⤵
  PID:4512
- C:\Windows\System\tKxYAHq.exe
  C:\Windows\System\tKxYAHq.exe
  2⤵
  PID:4528
- C:\Windows\System\cMaXlgs.exe
  C:\Windows\System\cMaXlgs.exe
  2⤵
  PID:4544
- C:\Windows\System\FsezVQx.exe
  C:\Windows\System\FsezVQx.exe
  2⤵
  PID:4564
- C:\Windows\System\jdYvelx.exe
  C:\Windows\System\jdYvelx.exe
  2⤵
  PID:4580
- C:\Windows\System\KPDrWSG.exe
  C:\Windows\System\KPDrWSG.exe
  2⤵
  PID:4596
- C:\Windows\System\bFaBsEL.exe
  C:\Windows\System\bFaBsEL.exe
  2⤵
  PID:4612
- C:\Windows\System\gZcrZcB.exe
  C:\Windows\System\gZcrZcB.exe
  2⤵
  PID:4628
- C:\Windows\System\QxpvXHc.exe
  C:\Windows\System\QxpvXHc.exe
  2⤵
  PID:4648
- C:\Windows\System\cWjvogH.exe
  C:\Windows\System\cWjvogH.exe
  2⤵
  PID:4664
- C:\Windows\System\EZRUAAh.exe
  C:\Windows\System\EZRUAAh.exe
  2⤵
  PID:4684
- C:\Windows\System\eHtkycX.exe
  C:\Windows\System\eHtkycX.exe
  2⤵
  PID:4700
- C:\Windows\System\AqrpJOv.exe
  C:\Windows\System\AqrpJOv.exe
  2⤵
  PID:4728
- C:\Windows\System\qjKqSYZ.exe
  C:\Windows\System\qjKqSYZ.exe
  2⤵
  PID:4744
- C:\Windows\System\gBfyBDM.exe
  C:\Windows\System\gBfyBDM.exe
  2⤵
  PID:4760
- C:\Windows\System\muSfTOk.exe
  C:\Windows\System\muSfTOk.exe
  2⤵
  PID:4776
- C:\Windows\System\AqlGLYG.exe
  C:\Windows\System\AqlGLYG.exe
  2⤵
  PID:4792
- C:\Windows\System\kBkzdUN.exe
  C:\Windows\System\kBkzdUN.exe
  2⤵
  PID:4808
- C:\Windows\System\KeQYqXs.exe
  C:\Windows\System\KeQYqXs.exe
  2⤵
  PID:4824
- C:\Windows\System\uvCYgaf.exe
  C:\Windows\System\uvCYgaf.exe
  2⤵
  PID:4840
- C:\Windows\System\yfbAfHr.exe
  C:\Windows\System\yfbAfHr.exe
  2⤵
  PID:4856
- C:\Windows\System\PPWKzKY.exe
  C:\Windows\System\PPWKzKY.exe
  2⤵
  PID:4872
- C:\Windows\System\mHuACVa.exe
  C:\Windows\System\mHuACVa.exe
  2⤵
  PID:4888
- C:\Windows\System\FPOvWjS.exe
  C:\Windows\System\FPOvWjS.exe
  2⤵
  PID:4904
- C:\Windows\System\WOoJXyQ.exe
  C:\Windows\System\WOoJXyQ.exe
  2⤵
  PID:4920
- C:\Windows\System\HElQbHA.exe
  C:\Windows\System\HElQbHA.exe
  2⤵
  PID:4936
- C:\Windows\System\xxLDoYo.exe
  C:\Windows\System\xxLDoYo.exe
  2⤵
  PID:4952
- C:\Windows\System\ZmAGHwU.exe
  C:\Windows\System\ZmAGHwU.exe
  2⤵
  PID:4968
- C:\Windows\System\hlZmRHX.exe
  C:\Windows\System\hlZmRHX.exe
  2⤵
  PID:4984
- C:\Windows\System\NLKoqVd.exe
  C:\Windows\System\NLKoqVd.exe
  2⤵
  PID:5000
- C:\Windows\System\lLpMayD.exe
  C:\Windows\System\lLpMayD.exe
  2⤵
  PID:5016
- C:\Windows\System\WPAVTQE.exe
  C:\Windows\System\WPAVTQE.exe
  2⤵
  PID:5032
- C:\Windows\System\XiQBCSQ.exe
  C:\Windows\System\XiQBCSQ.exe
  2⤵
  PID:5048
- C:\Windows\System\XkXcWPj.exe
  C:\Windows\System\XkXcWPj.exe
  2⤵
  PID:5064
- C:\Windows\System\VwYzPze.exe
  C:\Windows\System\VwYzPze.exe
  2⤵
  PID:5080
- C:\Windows\System\hjxJBYa.exe
  C:\Windows\System\hjxJBYa.exe
  2⤵
  PID:5096
- C:\Windows\System\TZWMEJU.exe
  C:\Windows\System\TZWMEJU.exe
  2⤵
  PID:5112
- C:\Windows\System\PAPReCZ.exe
  C:\Windows\System\PAPReCZ.exe
  2⤵
  PID:3808
- C:\Windows\System\EUIkYku.exe
  C:\Windows\System\EUIkYku.exe
  2⤵
  PID:3396
- C:\Windows\System\mAVDiTJ.exe
  C:\Windows\System\mAVDiTJ.exe
  2⤵
  PID:3560
- C:\Windows\System\FFejfVv.exe
  C:\Windows\System\FFejfVv.exe
  2⤵
  PID:3824
- C:\Windows\System\NSdPRyp.exe
  C:\Windows\System\NSdPRyp.exe
  2⤵
  PID:4080
- C:\Windows\System\GKzgfSa.exe
  C:\Windows\System\GKzgfSa.exe
  2⤵
  PID:1176
- C:\Windows\System\miewNJp.exe
  C:\Windows\System\miewNJp.exe
  2⤵
  PID:3192
- C:\Windows\System\VrqvfBN.exe
  C:\Windows\System\VrqvfBN.exe
  2⤵
  PID:3604
- C:\Windows\System\qQdHHFa.exe
  C:\Windows\System\qQdHHFa.exe
  2⤵
  PID:3536
- C:\Windows\System\KQPQVzm.exe
  C:\Windows\System\KQPQVzm.exe
  2⤵
  PID:3772
- C:\Windows\System\gZxXEdQ.exe
  C:\Windows\System\gZxXEdQ.exe
  2⤵
  PID:4060
- C:\Windows\System\TstoGOb.exe
  C:\Windows\System\TstoGOb.exe
  2⤵
  PID:3624
- C:\Windows\System\tjoJqbm.exe
  C:\Windows\System\tjoJqbm.exe
  2⤵
  PID:3892
- C:\Windows\System\oRQZlwv.exe
  C:\Windows\System\oRQZlwv.exe
  2⤵
  PID:2144
- C:\Windows\System\EolPvTC.exe
  C:\Windows\System\EolPvTC.exe
  2⤵
  PID:992
- C:\Windows\System\Sathlqo.exe
  C:\Windows\System\Sathlqo.exe
  2⤵
  PID:3224
- C:\Windows\System\gDjxDfy.exe
  C:\Windows\System\gDjxDfy.exe
  2⤵
  PID:3236
- C:\Windows\System\nLrGtaK.exe
  C:\Windows\System\nLrGtaK.exe
  2⤵
  PID:3096
- C:\Windows\System\WXpsGGS.exe
  C:\Windows\System\WXpsGGS.exe
  2⤵
  PID:4104
- C:\Windows\System\CrkShZF.exe
  C:\Windows\System\CrkShZF.exe
  2⤵
  PID:4168
- C:\Windows\System\pmXzJNs.exe
  C:\Windows\System\pmXzJNs.exe
  2⤵
  PID:4204
- C:\Windows\System\nBxwqDM.exe
  C:\Windows\System\nBxwqDM.exe
  2⤵
  PID:4272
- C:\Windows\System\dBfuWqa.exe
  C:\Windows\System\dBfuWqa.exe
  2⤵
  PID:4308
- C:\Windows\System\EpSqyyw.exe
  C:\Windows\System\EpSqyyw.exe
  2⤵
  PID:4376
- C:\Windows\System\dkCVzaZ.exe
  C:\Windows\System\dkCVzaZ.exe
  2⤵
  PID:4408
- C:\Windows\System\brwXPWv.exe
  C:\Windows\System\brwXPWv.exe
  2⤵
  PID:4476
- C:\Windows\System\CYIQaYM.exe
  C:\Windows\System\CYIQaYM.exe
  2⤵
  PID:4572
- C:\Windows\System\XkDlzPI.exe
  C:\Windows\System\XkDlzPI.exe
  2⤵
  PID:4636
- C:\Windows\System\UcCYuHZ.exe
  C:\Windows\System\UcCYuHZ.exe
  2⤵
  PID:4680
- C:\Windows\System\jGnhANK.exe
  C:\Windows\System\jGnhANK.exe
  2⤵
  PID:4720
- C:\Windows\System\IgXvGhq.exe
  C:\Windows\System\IgXvGhq.exe
  2⤵
  PID:1992
- C:\Windows\System\qsqGdye.exe
  C:\Windows\System\qsqGdye.exe
  2⤵
  PID:1696
- C:\Windows\System\cHiHiKL.exe
  C:\Windows\System\cHiHiKL.exe
  2⤵
  PID:4712
- C:\Windows\System\xQJOLnp.exe
  C:\Windows\System\xQJOLnp.exe
  2⤵
  PID:4216
- C:\Windows\System\JbYwcNR.exe
  C:\Windows\System\JbYwcNR.exe
  2⤵
  PID:4256
- C:\Windows\System\GLdOmTR.exe
  C:\Windows\System\GLdOmTR.exe
  2⤵
  PID:4320
- C:\Windows\System\aWZtdSt.exe
  C:\Windows\System\aWZtdSt.exe
  2⤵
  PID:3912
- C:\Windows\System\MmDrhki.exe
  C:\Windows\System\MmDrhki.exe
  2⤵
  PID:4452
- C:\Windows\System\hJFnTSi.exe
  C:\Windows\System\hJFnTSi.exe
  2⤵
  PID:4488
- C:\Windows\System\YNzrkut.exe
  C:\Windows\System\YNzrkut.exe
  2⤵
  PID:4784
- C:\Windows\System\PiIWeXz.exe
  C:\Windows\System\PiIWeXz.exe
  2⤵
  PID:4852
- C:\Windows\System\EVeVnfN.exe
  C:\Windows\System\EVeVnfN.exe
  2⤵
  PID:4692
- C:\Windows\System\BAKUcqG.exe
  C:\Windows\System\BAKUcqG.exe
  2⤵
  PID:3268
- C:\Windows\System\EoPsMwr.exe
  C:\Windows\System\EoPsMwr.exe
  2⤵
  PID:4772
- C:\Windows\System\VmrpSVu.exe
  C:\Windows\System\VmrpSVu.exe
  2⤵
  PID:4420
- C:\Windows\System\lywOVpt.exe
  C:\Windows\System\lywOVpt.exe
  2⤵
  PID:4832
- C:\Windows\System\LEdrouG.exe
  C:\Windows\System\LEdrouG.exe
  2⤵
  PID:4592
- C:\Windows\System\bYWvAwK.exe
  C:\Windows\System\bYWvAwK.exe
  2⤵
  PID:4900
- C:\Windows\System\lSFDMkh.exe
  C:\Windows\System\lSFDMkh.exe
  2⤵
  PID:4960
- C:\Windows\System\BaYQOPs.exe
  C:\Windows\System\BaYQOPs.exe
  2⤵
  PID:5024
- C:\Windows\System\xlwSMGQ.exe
  C:\Windows\System\xlwSMGQ.exe
  2⤵
  PID:1648
- C:\Windows\System\PYFEAKL.exe
  C:\Windows\System\PYFEAKL.exe
  2⤵
  PID:3704
- C:\Windows\System\EhGdBXN.exe
  C:\Windows\System\EhGdBXN.exe
  2⤵
  PID:3460
- C:\Windows\System\DRgPaJJ.exe
  C:\Windows\System\DRgPaJJ.exe
  2⤵
  PID:3144
- C:\Windows\System\toxveEQ.exe
  C:\Windows\System\toxveEQ.exe
  2⤵
  PID:3876
- C:\Windows\System\uRiIzvJ.exe
  C:\Windows\System\uRiIzvJ.exe
  2⤵
  PID:3212
- C:\Windows\System\DeYdHmw.exe
  C:\Windows\System\DeYdHmw.exe
  2⤵
  PID:4980
- C:\Windows\System\wmpbrfK.exe
  C:\Windows\System\wmpbrfK.exe
  2⤵
  PID:5012
- C:\Windows\System\HDJmrZE.exe
  C:\Windows\System\HDJmrZE.exe
  2⤵
  PID:4912
- C:\Windows\System\AISRhkj.exe
  C:\Windows\System\AISRhkj.exe
  2⤵
  PID:5044
- C:\Windows\System\WGvpsYR.exe
  C:\Windows\System\WGvpsYR.exe
  2⤵
  PID:3164
- C:\Windows\System\hMLrweg.exe
  C:\Windows\System\hMLrweg.exe
  2⤵
  PID:3112
- C:\Windows\System\uLoNOpl.exe
  C:\Windows\System\uLoNOpl.exe
  2⤵
  PID:3756
- C:\Windows\System\YaIZtMa.exe
  C:\Windows\System\YaIZtMa.exe
  2⤵
  PID:2032
- C:\Windows\System\zfHpqzI.exe
  C:\Windows\System\zfHpqzI.exe
  2⤵
  PID:2580
- C:\Windows\System\qfYuXwT.exe
  C:\Windows\System\qfYuXwT.exe
  2⤵
  PID:3220
- C:\Windows\System\jzLVOew.exe
  C:\Windows\System\jzLVOew.exe
  2⤵
  PID:1936
- C:\Windows\System\WjPOZdv.exe
  C:\Windows\System\WjPOZdv.exe
  2⤵
  PID:2720
- C:\Windows\System\VxTYhPk.exe
  C:\Windows\System\VxTYhPk.exe
  2⤵
  PID:4140
- C:\Windows\System\CTiDMmB.exe
  C:\Windows\System\CTiDMmB.exe
  2⤵
  PID:4372
- C:\Windows\System\xuCdkaw.exe
  C:\Windows\System\xuCdkaw.exe
  2⤵
  PID:4508
- C:\Windows\System\xSdaonO.exe
  C:\Windows\System\xSdaonO.exe
  2⤵
  PID:4120
- C:\Windows\System\sQOdQTs.exe
  C:\Windows\System\sQOdQTs.exe
  2⤵
  PID:4356
- C:\Windows\System\koqJGPg.exe
  C:\Windows\System\koqJGPg.exe
  2⤵
  PID:4392
- C:\Windows\System\tKyGshP.exe
  C:\Windows\System\tKyGshP.exe
  2⤵
  PID:4188
- C:\Windows\System\QwDnFhR.exe
  C:\Windows\System\QwDnFhR.exe
  2⤵
  PID:4524
- C:\Windows\System\eFGgQie.exe
  C:\Windows\System\eFGgQie.exe
  2⤵
  PID:4556
- C:\Windows\System\DqbRSEU.exe
  C:\Windows\System\DqbRSEU.exe
  2⤵
  PID:4816
- C:\Windows\System\chtivgT.exe
  C:\Windows\System\chtivgT.exe
  2⤵
  PID:4736
- C:\Windows\System\oWsnEDQ.exe
  C:\Windows\System\oWsnEDQ.exe
  2⤵
  PID:4864
- C:\Windows\System\wZTafaV.exe
  C:\Windows\System\wZTafaV.exe
  2⤵
  PID:5060
- C:\Windows\System\Jobbyis.exe
  C:\Windows\System\Jobbyis.exe
  2⤵
  PID:3408
- C:\Windows\System\JRVYZjz.exe
  C:\Windows\System\JRVYZjz.exe
  2⤵
  PID:5076
- C:\Windows\System\lVjwaJa.exe
  C:\Windows\System\lVjwaJa.exe
  2⤵
  PID:1080
- C:\Windows\System\whlOSln.exe
  C:\Windows\System\whlOSln.exe
  2⤵
  PID:4100
- C:\Windows\System\fEcMHtP.exe
  C:\Windows\System\fEcMHtP.exe
  2⤵
  PID:4540
- C:\Windows\System\BdHZvMi.exe
  C:\Windows\System\BdHZvMi.exe
  2⤵
  PID:4660
- C:\Windows\System\lOlIUvq.exe
  C:\Windows\System\lOlIUvq.exe
  2⤵
  PID:3444
- C:\Windows\System\zBwVWSo.exe
  C:\Windows\System\zBwVWSo.exe
  2⤵
  PID:4608
- C:\Windows\System\UMUgXzj.exe
  C:\Windows\System\UMUgXzj.exe
  2⤵
  PID:4992
- C:\Windows\System\FbaMlBZ.exe
  C:\Windows\System\FbaMlBZ.exe
  2⤵
  PID:5092
- C:\Windows\System\GwVyrof.exe
  C:\Windows\System\GwVyrof.exe
  2⤵
  PID:4708
- C:\Windows\System\VDcDhCn.exe
  C:\Windows\System\VDcDhCn.exe
  2⤵
  PID:4520
- C:\Windows\System\ImynrzR.exe
  C:\Windows\System\ImynrzR.exe
  2⤵
  PID:952
- C:\Windows\System\UbHUbeH.exe
  C:\Windows\System\UbHUbeH.exe
  2⤵
  PID:4028
- C:\Windows\System\gIFCVpt.exe
  C:\Windows\System\gIFCVpt.exe
  2⤵
  PID:5008
- C:\Windows\System\beTraIE.exe
  C:\Windows\System\beTraIE.exe
  2⤵
  PID:1536
- C:\Windows\System\yDThwtN.exe
  C:\Windows\System\yDThwtN.exe
  2⤵
  PID:3184
- C:\Windows\System\ZPUsohf.exe
  C:\Windows\System\ZPUsohf.exe
  2⤵
  PID:3272
- C:\Windows\System\ZMTiUIn.exe
  C:\Windows\System\ZMTiUIn.exe
  2⤵
  PID:4292
- C:\Windows\System\jvwxcui.exe
  C:\Windows\System\jvwxcui.exe
  2⤵
  PID:4588
- C:\Windows\System\vWDyWZM.exe
  C:\Windows\System\vWDyWZM.exe
  2⤵
  PID:3472
- C:\Windows\System\UnoGMIE.exe
  C:\Windows\System\UnoGMIE.exe
  2⤵
  PID:4184
- C:\Windows\System\gJobqBp.exe
  C:\Windows\System\gJobqBp.exe
  2⤵
  PID:4948
- C:\Windows\System\JRYSAfN.exe
  C:\Windows\System\JRYSAfN.exe
  2⤵
  PID:3692
- C:\Windows\System\xHatXrs.exe
  C:\Windows\System\xHatXrs.exe
  2⤵
  PID:4340
- C:\Windows\System\gPrenJa.exe
  C:\Windows\System\gPrenJa.exe
  2⤵
  PID:4752
- C:\Windows\System\CqQttxh.exe
  C:\Windows\System\CqQttxh.exe
  2⤵
  PID:4016
- C:\Windows\System\qcTxNSy.exe
  C:\Windows\System\qcTxNSy.exe
  2⤵
  PID:4352
- C:\Windows\System\lYRBEoL.exe
  C:\Windows\System\lYRBEoL.exe
  2⤵
  PID:2212
- C:\Windows\System\aBSjcbF.exe
  C:\Windows\System\aBSjcbF.exe
  2⤵
  PID:4644
- C:\Windows\System\viqwWtz.exe
  C:\Windows\System\viqwWtz.exe
  2⤵
  PID:4244
- C:\Windows\System\pnyXlrT.exe
  C:\Windows\System\pnyXlrT.exe
  2⤵
  PID:4868
- C:\Windows\System\PjnzQtZ.exe
  C:\Windows\System\PjnzQtZ.exe
  2⤵
  PID:1556
- C:\Windows\System\ksLjQYc.exe
  C:\Windows\System\ksLjQYc.exe
  2⤵
  PID:5124
- C:\Windows\System\BqRPpqr.exe
  C:\Windows\System\BqRPpqr.exe
  2⤵
  PID:5140
- C:\Windows\System\ZSEHcWq.exe
  C:\Windows\System\ZSEHcWq.exe
  2⤵
  PID:5156
- C:\Windows\System\ZYQPjEf.exe
  C:\Windows\System\ZYQPjEf.exe
  2⤵
  PID:5172
- C:\Windows\System\qdtRApQ.exe
  C:\Windows\System\qdtRApQ.exe
  2⤵
  PID:5188
- C:\Windows\System\XKnzKCj.exe
  C:\Windows\System\XKnzKCj.exe
  2⤵
  PID:5208
- C:\Windows\System\uIVTTMT.exe
  C:\Windows\System\uIVTTMT.exe
  2⤵
  PID:5224
- C:\Windows\System\KqGouUL.exe
  C:\Windows\System\KqGouUL.exe
  2⤵
  PID:5240
- C:\Windows\System\wtnVgli.exe
  C:\Windows\System\wtnVgli.exe
  2⤵
  PID:5256
- C:\Windows\System\oeYALwC.exe
  C:\Windows\System\oeYALwC.exe
  2⤵
  PID:5272
- C:\Windows\System\XuntAtW.exe
  C:\Windows\System\XuntAtW.exe
  2⤵
  PID:5288
- C:\Windows\System\CiCjNjb.exe
  C:\Windows\System\CiCjNjb.exe
  2⤵
  PID:5304
- C:\Windows\System\dmNmnYw.exe
  C:\Windows\System\dmNmnYw.exe
  2⤵
  PID:5320
- C:\Windows\System\UlfNsXH.exe
  C:\Windows\System\UlfNsXH.exe
  2⤵
  PID:5336
- C:\Windows\System\daWAWZY.exe
  C:\Windows\System\daWAWZY.exe
  2⤵
  PID:5352
- C:\Windows\System\rUeWVsP.exe
  C:\Windows\System\rUeWVsP.exe
  2⤵
  PID:5368
- C:\Windows\System\TPFpanZ.exe
  C:\Windows\System\TPFpanZ.exe
  2⤵
  PID:5388
- C:\Windows\System\orPSfzv.exe
  C:\Windows\System\orPSfzv.exe
  2⤵
  PID:5404
- C:\Windows\System\glqzubC.exe
  C:\Windows\System\glqzubC.exe
  2⤵
  PID:5420
- C:\Windows\System\XznyooZ.exe
  C:\Windows\System\XznyooZ.exe
  2⤵
  PID:5436
- C:\Windows\System\SgQyrnD.exe
  C:\Windows\System\SgQyrnD.exe
  2⤵
  PID:5452
- C:\Windows\System\lHhDGbm.exe
  C:\Windows\System\lHhDGbm.exe
  2⤵
  PID:5468
- C:\Windows\System\HUiHxlO.exe
  C:\Windows\System\HUiHxlO.exe
  2⤵
  PID:5484
- C:\Windows\System\fQmpFWR.exe
  C:\Windows\System\fQmpFWR.exe
  2⤵
  PID:5500
- C:\Windows\System\uwHISol.exe
  C:\Windows\System\uwHISol.exe
  2⤵
  PID:5516
- C:\Windows\System\PkLjwQk.exe
  C:\Windows\System\PkLjwQk.exe
  2⤵
  PID:5532
- C:\Windows\System\izYZXkK.exe
  C:\Windows\System\izYZXkK.exe
  2⤵
  PID:5552
- C:\Windows\System\UOYVjVm.exe
  C:\Windows\System\UOYVjVm.exe
  2⤵
  PID:5568
- C:\Windows\System\VQcSbRl.exe
  C:\Windows\System\VQcSbRl.exe
  2⤵
  PID:5584
- C:\Windows\System\zGArGaK.exe
  C:\Windows\System\zGArGaK.exe
  2⤵
  PID:5600
- C:\Windows\System\jWKHMlN.exe
  C:\Windows\System\jWKHMlN.exe
  2⤵
  PID:5616
- C:\Windows\System\zVprNBs.exe
  C:\Windows\System\zVprNBs.exe
  2⤵
  PID:5632
- C:\Windows\System\UUuuVOb.exe
  C:\Windows\System\UUuuVOb.exe
  2⤵
  PID:5648
- C:\Windows\System\eDBLbqF.exe
  C:\Windows\System\eDBLbqF.exe
  2⤵
  PID:5664
- C:\Windows\System\TNjEIsh.exe
  C:\Windows\System\TNjEIsh.exe
  2⤵
  PID:5680
- C:\Windows\System\hDdcRxc.exe
  C:\Windows\System\hDdcRxc.exe
  2⤵
  PID:5696
- C:\Windows\System\nzGFDzi.exe
  C:\Windows\System\nzGFDzi.exe
  2⤵
  PID:5712
- C:\Windows\System\pIwlYDH.exe
  C:\Windows\System\pIwlYDH.exe
  2⤵
  PID:5728
- C:\Windows\System\wIUhwGg.exe
  C:\Windows\System\wIUhwGg.exe
  2⤵
  PID:5744
- C:\Windows\System\YjtNkCV.exe
  C:\Windows\System\YjtNkCV.exe
  2⤵
  PID:5760
- C:\Windows\System\oDoWphM.exe
  C:\Windows\System\oDoWphM.exe
  2⤵
  PID:5776
- C:\Windows\System\yrWMgxO.exe
  C:\Windows\System\yrWMgxO.exe
  2⤵
  PID:5792
- C:\Windows\System\DvDDKsf.exe
  C:\Windows\System\DvDDKsf.exe
  2⤵
  PID:5808
- C:\Windows\System\rmQemzE.exe
  C:\Windows\System\rmQemzE.exe
  2⤵
  PID:5824
- C:\Windows\System\eeiQbtV.exe
  C:\Windows\System\eeiQbtV.exe
  2⤵
  PID:5840
- C:\Windows\System\XBzBrDk.exe
  C:\Windows\System\XBzBrDk.exe
  2⤵
  PID:5856
- C:\Windows\System\QIwaJHO.exe
  C:\Windows\System\QIwaJHO.exe
  2⤵
  PID:5872
- C:\Windows\System\HYfCuRE.exe
  C:\Windows\System\HYfCuRE.exe
  2⤵
  PID:5888
- C:\Windows\System\BLhiSEL.exe
  C:\Windows\System\BLhiSEL.exe
  2⤵
  PID:5904
- C:\Windows\System\KAhyauC.exe
  C:\Windows\System\KAhyauC.exe
  2⤵
  PID:5920
- C:\Windows\System\HhHrQKF.exe
  C:\Windows\System\HhHrQKF.exe
  2⤵
  PID:5940
- C:\Windows\System\raqlmzi.exe
  C:\Windows\System\raqlmzi.exe
  2⤵
  PID:5956
- C:\Windows\System\iraxsEU.exe
  C:\Windows\System\iraxsEU.exe
  2⤵
  PID:5972
- C:\Windows\System\baKlxjU.exe
  C:\Windows\System\baKlxjU.exe
  2⤵
  PID:5988
- C:\Windows\System\NWDGDhQ.exe
  C:\Windows\System\NWDGDhQ.exe
  2⤵
  PID:6004
- C:\Windows\System\hmmwlxa.exe
  C:\Windows\System\hmmwlxa.exe
  2⤵
  PID:6020
- C:\Windows\System\HTcDggm.exe
  C:\Windows\System\HTcDggm.exe
  2⤵
  PID:6036
- C:\Windows\System\imnDlTo.exe
  C:\Windows\System\imnDlTo.exe
  2⤵
  PID:6052
- C:\Windows\System\aPkLNqR.exe
  C:\Windows\System\aPkLNqR.exe
  2⤵
  PID:6068
- C:\Windows\System\TCCzKLN.exe
  C:\Windows\System\TCCzKLN.exe
  2⤵
  PID:6084
- C:\Windows\System\KsHHsxV.exe
  C:\Windows\System\KsHHsxV.exe
  2⤵
  PID:6100
- C:\Windows\System\PdOvOga.exe
  C:\Windows\System\PdOvOga.exe
  2⤵
  PID:6116
- C:\Windows\System\aEuINvV.exe
  C:\Windows\System\aEuINvV.exe
  2⤵
  PID:6132
- C:\Windows\System\ldTAkml.exe
  C:\Windows\System\ldTAkml.exe
  2⤵
  PID:5148
- C:\Windows\System\jDiiBBv.exe
  C:\Windows\System\jDiiBBv.exe
  2⤵
  PID:1268
- C:\Windows\System\kbMaOcs.exe
  C:\Windows\System\kbMaOcs.exe
  2⤵
  PID:5184
- C:\Windows\System\iZXUBhp.exe
  C:\Windows\System\iZXUBhp.exe
  2⤵
  PID:5220
- C:\Windows\System\qijztLh.exe
  C:\Windows\System\qijztLh.exe
  2⤵
  PID:5268
- C:\Windows\System\hRfqyTo.exe
  C:\Windows\System\hRfqyTo.exe
  2⤵
  PID:5736
- C:\Windows\System\rVZNuUL.exe
  C:\Windows\System\rVZNuUL.exe
  2⤵
  PID:5928
- C:\Windows\System\YVpNkoX.exe
  C:\Windows\System\YVpNkoX.exe
  2⤵
  PID:5180
- C:\Windows\System\sPTXaTm.exe
  C:\Windows\System\sPTXaTm.exe
  2⤵
  PID:5724
- C:\Windows\System\hnxCYUz.exe
  C:\Windows\System\hnxCYUz.exe
  2⤵
  PID:5692
- C:\Windows\System\FeQImUm.exe
  C:\Windows\System\FeQImUm.exe
  2⤵
  PID:6108
- C:\Windows\System\pGISWEm.exe
  C:\Windows\System\pGISWEm.exe
  2⤵
  PID:5344
- C:\Windows\System\irDzVZn.exe
  C:\Windows\System\irDzVZn.exe
  2⤵
  PID:2568
- C:\Windows\System\CIdzkXB.exe
  C:\Windows\System\CIdzkXB.exe
  2⤵
  PID:1952
- C:\Windows\System\swKHBRz.exe
  C:\Windows\System\swKHBRz.exe
  2⤵
  PID:5164
- C:\Windows\System\lsUMNRg.exe
  C:\Windows\System\lsUMNRg.exe
  2⤵
  PID:5444
- C:\Windows\System\zNnkgCl.exe
  C:\Windows\System\zNnkgCl.exe
  2⤵
  PID:5204
- C:\Windows\System\vIdEhIB.exe
  C:\Windows\System\vIdEhIB.exe
  2⤵
  PID:1724
- C:\Windows\System\YjhOQKY.exe
  C:\Windows\System\YjhOQKY.exe
  2⤵
  PID:2860
- C:\Windows\System\CuaBVzn.exe
  C:\Windows\System\CuaBVzn.exe
  2⤵
  PID:5576
- C:\Windows\System\aiDtQnW.exe
  C:\Windows\System\aiDtQnW.exe
  2⤵
  PID:5644
- C:\Windows\System\UulAJFH.exe
  C:\Windows\System\UulAJFH.exe
  2⤵
  PID:5624
- C:\Windows\System\oJdKCbV.exe
  C:\Windows\System\oJdKCbV.exe
  2⤵
  PID:5496
- C:\Windows\System\DfwxVhB.exe
  C:\Windows\System\DfwxVhB.exe
  2⤵
  PID:5708
- C:\Windows\System\tSTmewA.exe
  C:\Windows\System\tSTmewA.exe
  2⤵
  PID:5832
- C:\Windows\System\bycnFOV.exe
  C:\Windows\System\bycnFOV.exe
  2⤵
  PID:5868
- C:\Windows\System\jiZeCdn.exe
  C:\Windows\System\jiZeCdn.exe
  2⤵
  PID:5968
- C:\Windows\System\CnvYYKk.exe
  C:\Windows\System\CnvYYKk.exe
  2⤵
  PID:6060
- C:\Windows\System\LFHWbXo.exe
  C:\Windows\System\LFHWbXo.exe
  2⤵
  PID:6124
- C:\Windows\System\NbmpaEf.exe
  C:\Windows\System\NbmpaEf.exe
  2⤵
  PID:6140
- C:\Windows\System\JIkKhpz.exe
  C:\Windows\System\JIkKhpz.exe
  2⤵
  PID:5816
- C:\Windows\System\fSTTcee.exe
  C:\Windows\System\fSTTcee.exe
  2⤵
  PID:5312
- C:\Windows\System\FkSlZfP.exe
  C:\Windows\System\FkSlZfP.exe
  2⤵
  PID:5980
- C:\Windows\System\bhDDrhB.exe
  C:\Windows\System\bhDDrhB.exe
  2⤵
  PID:6048
- C:\Windows\System\EnBSDMc.exe
  C:\Windows\System\EnBSDMc.exe
  2⤵
  PID:5376
- C:\Windows\System\hOqbbOR.exe
  C:\Windows\System\hOqbbOR.exe
  2⤵
  PID:5384
- C:\Windows\System\wpVMmZg.exe
  C:\Windows\System\wpVMmZg.exe
  2⤵
  PID:5476
- C:\Windows\System\nlwUfon.exe
  C:\Windows\System\nlwUfon.exe
  2⤵
  PID:5460
- C:\Windows\System\RnFLJfq.exe
  C:\Windows\System\RnFLJfq.exe
  2⤵
  PID:5364
- C:\Windows\System\ynDFCxY.exe
  C:\Windows\System\ynDFCxY.exe
  2⤵
  PID:1600
- C:\Windows\System\YzfPvRW.exe
  C:\Windows\System\YzfPvRW.exe
  2⤵
  PID:5640
- C:\Windows\System\WJruDHq.exe
  C:\Windows\System\WJruDHq.exe
  2⤵
  PID:5560
- C:\Windows\System\QxFyEBv.exe
  C:\Windows\System\QxFyEBv.exe
  2⤵
  PID:5660
- C:\Windows\System\somCQhW.exe
  C:\Windows\System\somCQhW.exe
  2⤵
  PID:5580
- C:\Windows\System\TBQkorf.exe
  C:\Windows\System\TBQkorf.exe
  2⤵
  PID:5772
- C:\Windows\System\tMXBAZQ.exe
  C:\Windows\System\tMXBAZQ.exe
  2⤵
  PID:5804
- C:\Windows\System\lnnyOtE.exe
  C:\Windows\System\lnnyOtE.exe
  2⤵
  PID:6028
- C:\Windows\System\eFOasnJ.exe
  C:\Windows\System\eFOasnJ.exe
  2⤵
  PID:6032
- C:\Windows\System\wGzlGFV.exe
  C:\Windows\System\wGzlGFV.exe
  2⤵
  PID:6096
- C:\Windows\System\JRTBZzG.exe
  C:\Windows\System\JRTBZzG.exe
  2⤵
  PID:5820
- C:\Windows\System\FrYSvOV.exe
  C:\Windows\System\FrYSvOV.exe
  2⤵
  PID:5756
- C:\Windows\System\YBbbSFH.exe
  C:\Windows\System\YBbbSFH.exe
  2⤵
  PID:5916
- C:\Windows\System\EpLUaHB.exe
  C:\Windows\System\EpLUaHB.exe
  2⤵
  PID:5948
- C:\Windows\System\BWGJMpw.exe
  C:\Windows\System\BWGJMpw.exe
  2⤵
  PID:2228
- C:\Windows\System\ehgNKou.exe
  C:\Windows\System\ehgNKou.exe
  2⤵
  PID:5168
- C:\Windows\System\GCAuhPv.exe
  C:\Windows\System\GCAuhPv.exe
  2⤵
  PID:5704
- C:\Windows\System\BzbtcfL.exe
  C:\Windows\System\BzbtcfL.exe
  2⤵
  PID:2372
- C:\Windows\System\pFKpOtP.exe
  C:\Windows\System\pFKpOtP.exe
  2⤵
  PID:6080
- C:\Windows\System\veVBpqo.exe
  C:\Windows\System\veVBpqo.exe
  2⤵
  PID:6044
- C:\Windows\System\uHyLLZv.exe
  C:\Windows\System\uHyLLZv.exe
  2⤵
  PID:5688
- C:\Windows\System\zTdtlEQ.exe
  C:\Windows\System\zTdtlEQ.exe
  2⤵
  PID:6160
- C:\Windows\System\oLCyftG.exe
  C:\Windows\System\oLCyftG.exe
  2⤵
  PID:6176
- C:\Windows\System\XtzIkKJ.exe
  C:\Windows\System\XtzIkKJ.exe
  2⤵
  PID:6192
- C:\Windows\System\RkldUUI.exe
  C:\Windows\System\RkldUUI.exe
  2⤵
  PID:6208
- C:\Windows\System\jYLCVdz.exe
  C:\Windows\System\jYLCVdz.exe
  2⤵
  PID:6224
- C:\Windows\System\pIybcld.exe
  C:\Windows\System\pIybcld.exe
  2⤵
  PID:6240
- C:\Windows\System\pbuROrV.exe
  C:\Windows\System\pbuROrV.exe
  2⤵
  PID:6256
- C:\Windows\System\KRWfrvu.exe
  C:\Windows\System\KRWfrvu.exe
  2⤵
  PID:6272
- C:\Windows\System\AcUTdIl.exe
  C:\Windows\System\AcUTdIl.exe
  2⤵
  PID:6288
- C:\Windows\System\JoooEWd.exe
  C:\Windows\System\JoooEWd.exe
  2⤵
  PID:6304
- C:\Windows\System\LRgRAdF.exe
  C:\Windows\System\LRgRAdF.exe
  2⤵
  PID:6320
- C:\Windows\System\qhLYYoc.exe
  C:\Windows\System\qhLYYoc.exe
  2⤵
  PID:6336
- C:\Windows\System\amdEzBl.exe
  C:\Windows\System\amdEzBl.exe
  2⤵
  PID:6352
- C:\Windows\System\tLclYrC.exe
  C:\Windows\System\tLclYrC.exe
  2⤵
  PID:6368
- C:\Windows\System\DOegQCT.exe
  C:\Windows\System\DOegQCT.exe
  2⤵
  PID:6384
- C:\Windows\System\WQGuVbw.exe
  C:\Windows\System\WQGuVbw.exe
  2⤵
  PID:6400
- C:\Windows\System\rsvwWtn.exe
  C:\Windows\System\rsvwWtn.exe
  2⤵
  PID:6416
- C:\Windows\System\kZwLYMC.exe
  C:\Windows\System\kZwLYMC.exe
  2⤵
  PID:6432
- C:\Windows\System\UEaWHSp.exe
  C:\Windows\System\UEaWHSp.exe
  2⤵
  PID:6448
- C:\Windows\System\yEEgbNZ.exe
  C:\Windows\System\yEEgbNZ.exe
  2⤵
  PID:6464
- C:\Windows\System\UvKFYsK.exe
  C:\Windows\System\UvKFYsK.exe
  2⤵
  PID:6480
- C:\Windows\System\yCNxNcj.exe
  C:\Windows\System\yCNxNcj.exe
  2⤵
  PID:6496
- C:\Windows\System\KGWamup.exe
  C:\Windows\System\KGWamup.exe
  2⤵
  PID:6512
- C:\Windows\System\YQfEWJi.exe
  C:\Windows\System\YQfEWJi.exe
  2⤵
  PID:6528
- C:\Windows\System\mJGAoLf.exe
  C:\Windows\System\mJGAoLf.exe
  2⤵
  PID:6544
- C:\Windows\System\srRdaQr.exe
  C:\Windows\System\srRdaQr.exe
  2⤵
  PID:6560
- C:\Windows\System\HLdcIWO.exe
  C:\Windows\System\HLdcIWO.exe
  2⤵
  PID:6576
- C:\Windows\System\lkJbJGp.exe
  C:\Windows\System\lkJbJGp.exe
  2⤵
  PID:6592
- C:\Windows\System\mJsWkZy.exe
  C:\Windows\System\mJsWkZy.exe
  2⤵
  PID:6608
- C:\Windows\System\TDHBzjg.exe
  C:\Windows\System\TDHBzjg.exe
  2⤵
  PID:6624
- C:\Windows\System\VrqiAPW.exe
  C:\Windows\System\VrqiAPW.exe
  2⤵
  PID:6640
- C:\Windows\System\OEPNPyN.exe
  C:\Windows\System\OEPNPyN.exe
  2⤵
  PID:6656
- C:\Windows\System\TzSCLDI.exe
  C:\Windows\System\TzSCLDI.exe
  2⤵
  PID:6672
- C:\Windows\System\VyCtpsK.exe
  C:\Windows\System\VyCtpsK.exe
  2⤵
  PID:6688
- C:\Windows\System\KHdihXL.exe
  C:\Windows\System\KHdihXL.exe
  2⤵
  PID:6704
- C:\Windows\System\pGzwLUv.exe
  C:\Windows\System\pGzwLUv.exe
  2⤵
  PID:6720
- C:\Windows\System\KzlQvwc.exe
  C:\Windows\System\KzlQvwc.exe
  2⤵
  PID:6736
- C:\Windows\System\VuJRHre.exe
  C:\Windows\System\VuJRHre.exe
  2⤵
  PID:6752
- C:\Windows\System\MbbOvXz.exe
  C:\Windows\System\MbbOvXz.exe
  2⤵
  PID:6772
- C:\Windows\System\XYOxAbU.exe
  C:\Windows\System\XYOxAbU.exe
  2⤵
  PID:6788
- C:\Windows\System\FqbVvKa.exe
  C:\Windows\System\FqbVvKa.exe
  2⤵
  PID:6804
- C:\Windows\System\ImswyFc.exe
  C:\Windows\System\ImswyFc.exe
  2⤵
  PID:6820
- C:\Windows\System\ZzyAsdE.exe
  C:\Windows\System\ZzyAsdE.exe
  2⤵
  PID:6836
- C:\Windows\System\FEstAsN.exe
  C:\Windows\System\FEstAsN.exe
  2⤵
  PID:6860
- C:\Windows\System\jopDPvS.exe
  C:\Windows\System\jopDPvS.exe
  2⤵
  PID:6876
- C:\Windows\System\obiEHxL.exe
  C:\Windows\System\obiEHxL.exe
  2⤵
  PID:6892
- C:\Windows\System\jSfbENI.exe
  C:\Windows\System\jSfbENI.exe
  2⤵
  PID:6908
- C:\Windows\System\xaybcqr.exe
  C:\Windows\System\xaybcqr.exe
  2⤵
  PID:6924
- C:\Windows\System\RzzjCRQ.exe
  C:\Windows\System\RzzjCRQ.exe
  2⤵
  PID:6940
- C:\Windows\System\DVvCbKX.exe
  C:\Windows\System\DVvCbKX.exe
  2⤵
  PID:6956
- C:\Windows\System\SWrJbCk.exe
  C:\Windows\System\SWrJbCk.exe
  2⤵
  PID:6972
- C:\Windows\System\GpoGTow.exe
  C:\Windows\System\GpoGTow.exe
  2⤵
  PID:6988
- C:\Windows\System\cBkavse.exe
  C:\Windows\System\cBkavse.exe
  2⤵
  PID:7004
- C:\Windows\System\MsdzmQE.exe
  C:\Windows\System\MsdzmQE.exe
  2⤵
  PID:7020
- C:\Windows\System\mOLWQql.exe
  C:\Windows\System\mOLWQql.exe
  2⤵
  PID:7036
- C:\Windows\System\gaselLA.exe
  C:\Windows\System\gaselLA.exe
  2⤵
  PID:7052
- C:\Windows\System\AyosaQh.exe
  C:\Windows\System\AyosaQh.exe
  2⤵
  PID:7068
- C:\Windows\System\xJxlczk.exe
  C:\Windows\System\xJxlczk.exe
  2⤵
  PID:7084
- C:\Windows\System\pAzTwIv.exe
  C:\Windows\System\pAzTwIv.exe
  2⤵
  PID:7100
- C:\Windows\System\JytKSir.exe
  C:\Windows\System\JytKSir.exe
  2⤵
  PID:7116
- C:\Windows\System\kQFHloy.exe
  C:\Windows\System\kQFHloy.exe
  2⤵
  PID:7132
- C:\Windows\System\nAhOCOw.exe
  C:\Windows\System\nAhOCOw.exe
  2⤵
  PID:7148
- C:\Windows\System\StlPJzg.exe
  C:\Windows\System\StlPJzg.exe
  2⤵
  PID:5608
- C:\Windows\System\KpIVnrX.exe
  C:\Windows\System\KpIVnrX.exe
  2⤵
  PID:6200
- C:\Windows\System\UHKgqGP.exe
  C:\Windows\System\UHKgqGP.exe
  2⤵
  PID:5548
- C:\Windows\System\csPqOFo.exe
  C:\Windows\System\csPqOFo.exe
  2⤵
  PID:3588
- C:\Windows\System\WaQbjcC.exe
  C:\Windows\System\WaQbjcC.exe
  2⤵
  PID:6300
- C:\Windows\System\tbSOYOz.exe
  C:\Windows\System\tbSOYOz.exe
  2⤵
  PID:6392
- C:\Windows\System\IUgnEEQ.exe
  C:\Windows\System\IUgnEEQ.exe
  2⤵
  PID:5996
- C:\Windows\System\EWazEhZ.exe
  C:\Windows\System\EWazEhZ.exe
  2⤵
  PID:6460
- C:\Windows\System\keyYaTj.exe
  C:\Windows\System\keyYaTj.exe
  2⤵
  PID:6524
- C:\Windows\System\uFafjPS.exe
  C:\Windows\System\uFafjPS.exe
  2⤵
  PID:6588
- C:\Windows\System\fITIKCM.exe
  C:\Windows\System\fITIKCM.exe
  2⤵
  PID:5984
- C:\Windows\System\fKUNuuf.exe
  C:\Windows\System\fKUNuuf.exe
  2⤵
  PID:5912
- C:\Windows\System\LtPmMNu.exe
  C:\Windows\System\LtPmMNu.exe
  2⤵
  PID:5492
- C:\Windows\System\nQwezGx.exe
  C:\Windows\System\nQwezGx.exe
  2⤵
  PID:5136
- C:\Windows\System\PNIEvDO.exe
  C:\Windows\System\PNIEvDO.exe
  2⤵
  PID:6112
- C:\Windows\System\tggPTQs.exe
  C:\Windows\System\tggPTQs.exe
  2⤵
  PID:2960
- C:\Windows\System\jtDIppQ.exe
  C:\Windows\System\jtDIppQ.exe
  2⤵
  PID:6184
- C:\Windows\System\KzkweJl.exe
  C:\Windows\System\KzkweJl.exe
  2⤵
  PID:6248
- C:\Windows\System\FMxsNhb.exe
  C:\Windows\System\FMxsNhb.exe
  2⤵
  PID:6312
- C:\Windows\System\EeBgzNH.exe
  C:\Windows\System\EeBgzNH.exe
  2⤵
  PID:6376
- C:\Windows\System\PevoGft.exe
  C:\Windows\System\PevoGft.exe
  2⤵
  PID:6440
- C:\Windows\System\hEDkWnS.exe
  C:\Windows\System\hEDkWnS.exe
  2⤵
  PID:6508
- C:\Windows\System\cjtfzEh.exe
  C:\Windows\System\cjtfzEh.exe
  2⤵
  PID:6572
- C:\Windows\System\RNZcfDA.exe
  C:\Windows\System\RNZcfDA.exe
  2⤵
  PID:6604
- C:\Windows\System\BoCGqHL.exe
  C:\Windows\System\BoCGqHL.exe
  2⤵
  PID:6684
- C:\Windows\System\yvYlAHI.exe
  C:\Windows\System\yvYlAHI.exe
  2⤵
  PID:6744
- C:\Windows\System\secjwMd.exe
  C:\Windows\System\secjwMd.exe
  2⤵
  PID:6732
- C:\Windows\System\JLrzwZw.exe
  C:\Windows\System\JLrzwZw.exe
  2⤵
  PID:6768
- C:\Windows\System\ZYHjvUN.exe
  C:\Windows\System\ZYHjvUN.exe
  2⤵
  PID:6764
- C:\Windows\System\lRUiVAt.exe
  C:\Windows\System\lRUiVAt.exe
  2⤵
  PID:6816
- C:\Windows\System\LxicrWv.exe
  C:\Windows\System\LxicrWv.exe
  2⤵
  PID:6888
- C:\Windows\System\XMhpJnC.exe
  C:\Windows\System\XMhpJnC.exe
  2⤵
  PID:6948
- C:\Windows\System\ZoqGter.exe
  C:\Windows\System\ZoqGter.exe
  2⤵
  PID:7012
- C:\Windows\System\CuXMvyx.exe
  C:\Windows\System\CuXMvyx.exe
  2⤵
  PID:7048
- C:\Windows\System\tFDnfLT.exe
  C:\Windows\System\tFDnfLT.exe
  2⤵
  PID:7112
- C:\Windows\System\IfJhshe.exe
  C:\Windows\System\IfJhshe.exe
  2⤵
  PID:6168
- C:\Windows\System\jPfwnMB.exe
  C:\Windows\System\jPfwnMB.exe
  2⤵
  PID:6360
- C:\Windows\System\oJtuqHo.exe
  C:\Windows\System\oJtuqHo.exe
  2⤵
  PID:7032
- C:\Windows\System\fgYOHNl.exe
  C:\Windows\System\fgYOHNl.exe
  2⤵
  PID:6968
- C:\Windows\System\DhotwIy.exe
  C:\Windows\System\DhotwIy.exe
  2⤵
  PID:6456
- C:\Windows\System\ethxDQD.exe
  C:\Windows\System\ethxDQD.exe
  2⤵
  PID:5416
- C:\Windows\System\pUWZXne.exe
  C:\Windows\System\pUWZXne.exe
  2⤵
  PID:6216
- C:\Windows\System\nmAJDNA.exe
  C:\Windows\System\nmAJDNA.exe
  2⤵
  PID:6348
- C:\Windows\System\jZrQuQe.exe
  C:\Windows\System\jZrQuQe.exe
  2⤵
  PID:2772
- C:\Windows\System\IQDjNHo.exe
  C:\Windows\System\IQDjNHo.exe
  2⤵
  PID:7164
- C:\Windows\System\fZQqFwD.exe
  C:\Windows\System\fZQqFwD.exe
  2⤵
  PID:6296
- C:\Windows\System\Sacaecw.exe
  C:\Windows\System\Sacaecw.exe
  2⤵
  PID:7064
- C:\Windows\System\miqpAiO.exe
  C:\Windows\System\miqpAiO.exe
  2⤵
  PID:7128
- C:\Windows\System\sGbFzSh.exe
  C:\Windows\System\sGbFzSh.exe
  2⤵
  PID:6424
- C:\Windows\System\ZKjumVr.exe
  C:\Windows\System\ZKjumVr.exe
  2⤵
  PID:6696
- C:\Windows\System\EBVVXkZ.exe
  C:\Windows\System\EBVVXkZ.exe
  2⤵
  PID:1636
- C:\Windows\System\NJaXjgD.exe
  C:\Windows\System\NJaXjgD.exe
  2⤵
  PID:5720
- C:\Windows\System\nCEphKS.exe
  C:\Windows\System\nCEphKS.exe
  2⤵
  PID:6280
- C:\Windows\System\UJYSpqs.exe
  C:\Windows\System\UJYSpqs.exe
  2⤵
  PID:6540
- C:\Windows\System\QdleHzU.exe
  C:\Windows\System\QdleHzU.exe
  2⤵
  PID:6728
- C:\Windows\System\HswHAxs.exe
  C:\Windows\System\HswHAxs.exe
  2⤵
  PID:6848
- C:\Windows\System\cPoDpYF.exe
  C:\Windows\System\cPoDpYF.exe
  2⤵
  PID:6472
- C:\Windows\System\fPVaHcL.exe
  C:\Windows\System\fPVaHcL.exe
  2⤵
  PID:5332
- C:\Windows\System\YjKzhBN.exe
  C:\Windows\System\YjKzhBN.exe
  2⤵
  PID:6172
- C:\Windows\System\wqLcfOG.exe
  C:\Windows\System\wqLcfOG.exe
  2⤵
  PID:6936
- C:\Windows\System\PtfoAgW.exe
  C:\Windows\System\PtfoAgW.exe
  2⤵
  PID:7080
- C:\Windows\System\iwfuozQ.exe
  C:\Windows\System\iwfuozQ.exe
  2⤵
  PID:6332
- C:\Windows\System\DGjUXro.exe
  C:\Windows\System\DGjUXro.exe
  2⤵
  PID:7108
- C:\Windows\System\NzcVYSj.exe
  C:\Windows\System\NzcVYSj.exe
  2⤵
  PID:6616
- C:\Windows\System\ePFZwko.exe
  C:\Windows\System\ePFZwko.exe
  2⤵
  PID:6812
- C:\Windows\System\lcaGgMi.exe
  C:\Windows\System\lcaGgMi.exe
  2⤵
  PID:5264
- C:\Windows\System\nyTiItE.exe
  C:\Windows\System\nyTiItE.exe
  2⤵
  PID:6016
- C:\Windows\System\pRDSYWq.exe
  C:\Windows\System\pRDSYWq.exe
  2⤵
  PID:6344
- C:\Windows\System\hZulQgW.exe
  C:\Windows\System\hZulQgW.exe
  2⤵
  PID:7172
- C:\Windows\System\cqNjXeL.exe
  C:\Windows\System\cqNjXeL.exe
  2⤵
  PID:7188
- C:\Windows\System\EWCesWr.exe
  C:\Windows\System\EWCesWr.exe
  2⤵
  PID:7204
- C:\Windows\System\NNjIanM.exe
  C:\Windows\System\NNjIanM.exe
  2⤵
  PID:7220
- C:\Windows\System\ogBTdkd.exe
  C:\Windows\System\ogBTdkd.exe
  2⤵
  PID:7236
- C:\Windows\System\VjqmcjZ.exe
  C:\Windows\System\VjqmcjZ.exe
  2⤵
  PID:7252
- C:\Windows\System\JESEGlB.exe
  C:\Windows\System\JESEGlB.exe
  2⤵
  PID:7268
- C:\Windows\System\fwmfrQt.exe
  C:\Windows\System\fwmfrQt.exe
  2⤵
  PID:7284
- C:\Windows\System\WPvCOgK.exe
  C:\Windows\System\WPvCOgK.exe
  2⤵
  PID:7300
- C:\Windows\System\Fffsepz.exe
  C:\Windows\System\Fffsepz.exe
  2⤵
  PID:7316
- C:\Windows\System\cSHVcrt.exe
  C:\Windows\System\cSHVcrt.exe
  2⤵
  PID:7332
- C:\Windows\System\ESgWHNV.exe
  C:\Windows\System\ESgWHNV.exe
  2⤵
  PID:7348
- C:\Windows\System\pfbYGti.exe
  C:\Windows\System\pfbYGti.exe
  2⤵
  PID:7364
- C:\Windows\System\uvboAGk.exe
  C:\Windows\System\uvboAGk.exe
  2⤵
  PID:7380
- C:\Windows\System\CrqNFOk.exe
  C:\Windows\System\CrqNFOk.exe
  2⤵
  PID:7396
- C:\Windows\System\OlhlaoG.exe
  C:\Windows\System\OlhlaoG.exe
  2⤵
  PID:7412
- C:\Windows\System\uBAIESx.exe
  C:\Windows\System\uBAIESx.exe
  2⤵
  PID:7428
- C:\Windows\System\CHQQwes.exe
  C:\Windows\System\CHQQwes.exe
  2⤵
  PID:7444
- C:\Windows\System\TrgjLcH.exe
  C:\Windows\System\TrgjLcH.exe
  2⤵
  PID:7460
- C:\Windows\System\cKqhyGk.exe
  C:\Windows\System\cKqhyGk.exe
  2⤵
  PID:7476
- C:\Windows\System\WlofHZC.exe
  C:\Windows\System\WlofHZC.exe
  2⤵
  PID:7492
- C:\Windows\System\wTBZkvR.exe
  C:\Windows\System\wTBZkvR.exe
  2⤵
  PID:7508
- C:\Windows\System\UfknbzY.exe
  C:\Windows\System\UfknbzY.exe
  2⤵
  PID:7524
- C:\Windows\System\dGIpRHp.exe
  C:\Windows\System\dGIpRHp.exe
  2⤵
  PID:7540
- C:\Windows\System\fJFpERY.exe
  C:\Windows\System\fJFpERY.exe
  2⤵
  PID:7556
- C:\Windows\System\nWesQXe.exe
  C:\Windows\System\nWesQXe.exe
  2⤵
  PID:7572
- C:\Windows\System\MuYElti.exe
  C:\Windows\System\MuYElti.exe
  2⤵
  PID:7588
- C:\Windows\System\CGlneim.exe
  C:\Windows\System\CGlneim.exe
  2⤵
  PID:7604
- C:\Windows\System\OQJiGKg.exe
  C:\Windows\System\OQJiGKg.exe
  2⤵
  PID:7624
- C:\Windows\System\ZtsiRBT.exe
  C:\Windows\System\ZtsiRBT.exe
  2⤵
  PID:7640
- C:\Windows\System\lumjalo.exe
  C:\Windows\System\lumjalo.exe
  2⤵
  PID:7656
- C:\Windows\System\cDWlGTC.exe
  C:\Windows\System\cDWlGTC.exe
  2⤵
  PID:7672
- C:\Windows\System\owRBnEu.exe
  C:\Windows\System\owRBnEu.exe
  2⤵
  PID:7688
- C:\Windows\System\NKCvFrb.exe
  C:\Windows\System\NKCvFrb.exe
  2⤵
  PID:7704
- C:\Windows\System\kewiMkj.exe
  C:\Windows\System\kewiMkj.exe
  2⤵
  PID:7720
- C:\Windows\System\BYDcngh.exe
  C:\Windows\System\BYDcngh.exe
  2⤵
  PID:7736
- C:\Windows\System\trFYuZk.exe
  C:\Windows\System\trFYuZk.exe
  2⤵
  PID:7752
- C:\Windows\System\WgfrzjC.exe
  C:\Windows\System\WgfrzjC.exe
  2⤵
  PID:7772
- C:\Windows\System\TuIFfEf.exe
  C:\Windows\System\TuIFfEf.exe
  2⤵
  PID:7788
- C:\Windows\System\YQBcRAB.exe
  C:\Windows\System\YQBcRAB.exe
  2⤵
  PID:7808
- C:\Windows\System\HThcHwX.exe
  C:\Windows\System\HThcHwX.exe
  2⤵
  PID:7824
- C:\Windows\System\Bprquil.exe
  C:\Windows\System\Bprquil.exe
  2⤵
  PID:7840
- C:\Windows\System\ZlwaZwB.exe
  C:\Windows\System\ZlwaZwB.exe
  2⤵
  PID:7856
- C:\Windows\System\HTzvPXs.exe
  C:\Windows\System\HTzvPXs.exe
  2⤵
  PID:7876
- C:\Windows\System\XarweBj.exe
  C:\Windows\System\XarweBj.exe
  2⤵
  PID:7896
- C:\Windows\System\FqIjtkG.exe
  C:\Windows\System\FqIjtkG.exe
  2⤵
  PID:7912
- C:\Windows\System\JVNMhgS.exe
  C:\Windows\System\JVNMhgS.exe
  2⤵
  PID:7928
- C:\Windows\System\aMXcCQP.exe
  C:\Windows\System\aMXcCQP.exe
  2⤵
  PID:7944
- C:\Windows\System\gjuJCAe.exe
  C:\Windows\System\gjuJCAe.exe
  2⤵
  PID:7960
- C:\Windows\System\nIPTuKk.exe
  C:\Windows\System\nIPTuKk.exe
  2⤵
  PID:7976
- C:\Windows\System\PSfcDEC.exe
  C:\Windows\System\PSfcDEC.exe
  2⤵
  PID:7992
- C:\Windows\System\BBYFtFL.exe
  C:\Windows\System\BBYFtFL.exe
  2⤵
  PID:8008
- C:\Windows\System\zQEjRnK.exe
  C:\Windows\System\zQEjRnK.exe
  2⤵
  PID:8024
- C:\Windows\System\LmXlFMF.exe
  C:\Windows\System\LmXlFMF.exe
  2⤵
  PID:8040
- C:\Windows\System\jbUPcgm.exe
  C:\Windows\System\jbUPcgm.exe
  2⤵
  PID:8056
- C:\Windows\System\EfDEGyr.exe
  C:\Windows\System\EfDEGyr.exe
  2⤵
  PID:8072
- C:\Windows\System\tLjaear.exe
  C:\Windows\System\tLjaear.exe
  2⤵
  PID:8088
- C:\Windows\System\IOlDpdJ.exe
  C:\Windows\System\IOlDpdJ.exe
  2⤵
  PID:8104
- C:\Windows\System\WiCzcWQ.exe
  C:\Windows\System\WiCzcWQ.exe
  2⤵
  PID:8120
- C:\Windows\System\yogOrtE.exe
  C:\Windows\System\yogOrtE.exe
  2⤵
  PID:8136
- C:\Windows\System\xNCrnzm.exe
  C:\Windows\System\xNCrnzm.exe
  2⤵
  PID:8152
- C:\Windows\System\QPapSsD.exe
  C:\Windows\System\QPapSsD.exe
  2⤵
  PID:8168
- C:\Windows\System\nImdpuc.exe
  C:\Windows\System\nImdpuc.exe
  2⤵
  PID:8184
- C:\Windows\System\cRGzihE.exe
  C:\Windows\System\cRGzihE.exe
  2⤵
  PID:7096
- C:\Windows\System\gMtVTMk.exe
  C:\Windows\System\gMtVTMk.exe
  2⤵
  PID:6412
- C:\Windows\System\bXAoBGA.exe
  C:\Windows\System\bXAoBGA.exe
  2⤵
  PID:6568
- C:\Windows\System\JIwvCDN.exe
  C:\Windows\System\JIwvCDN.exe
  2⤵
  PID:5800
- C:\Windows\System\DelMeZS.exe
  C:\Windows\System\DelMeZS.exe
  2⤵
  PID:6152
- C:\Windows\System\ayaHhqI.exe
  C:\Windows\System\ayaHhqI.exe
  2⤵
  PID:6700
- C:\Windows\System\IzvcviP.exe
  C:\Windows\System\IzvcviP.exe
  2⤵
  PID:6852
- C:\Windows\System\DHnZGNa.exe
  C:\Windows\System\DHnZGNa.exe
  2⤵
  PID:7244
- C:\Windows\System\AsLprKA.exe
  C:\Windows\System\AsLprKA.exe
  2⤵
  PID:7280
- C:\Windows\System\VKbRVuQ.exe
  C:\Windows\System\VKbRVuQ.exe
  2⤵
  PID:7344
- C:\Windows\System\UQFXhRN.exe
  C:\Windows\System\UQFXhRN.exe
  2⤵
  PID:7408
- C:\Windows\System\FwLNqrz.exe
  C:\Windows\System\FwLNqrz.exe
  2⤵
  PID:7360
- C:\Windows\System\ftBoAEM.exe
  C:\Windows\System\ftBoAEM.exe
  2⤵
  PID:7260
- C:\Windows\System\ZEusneU.exe
  C:\Windows\System\ZEusneU.exe
  2⤵
  PID:7388
- C:\Windows\System\GQWmpaK.exe
  C:\Windows\System\GQWmpaK.exe
  2⤵
  PID:7440
- C:\Windows\System\jxdWItq.exe
  C:\Windows\System\jxdWItq.exe
  2⤵
  PID:7504
- C:\Windows\System\RAXvhIY.exe
  C:\Windows\System\RAXvhIY.exe
  2⤵
  PID:7488
- C:\Windows\System\NhqmjVm.exe
  C:\Windows\System\NhqmjVm.exe
  2⤵
  PID:7516
- C:\Windows\System\MGQdNun.exe
  C:\Windows\System\MGQdNun.exe
  2⤵
  PID:7568
- C:\Windows\System\PhZyAjg.exe
  C:\Windows\System\PhZyAjg.exe
  2⤵
  PID:7668
- C:\Windows\System\CXEAPPe.exe
  C:\Windows\System\CXEAPPe.exe
  2⤵
  PID:7652
- C:\Windows\System\EFpbDdt.exe
  C:\Windows\System\EFpbDdt.exe
  2⤵
  PID:7700
- C:\Windows\System\JQfeqbI.exe
  C:\Windows\System\JQfeqbI.exe
  2⤵
  PID:7764
- C:\Windows\System\lmmGBmr.exe
  C:\Windows\System\lmmGBmr.exe
  2⤵
  PID:7804
- C:\Windows\System\NFsTRFE.exe
  C:\Windows\System\NFsTRFE.exe
  2⤵
  PID:7868
- C:\Windows\System\xLrISdd.exe
  C:\Windows\System\xLrISdd.exe
  2⤵
  PID:7908
- C:\Windows\System\uFbnzrs.exe
  C:\Windows\System\uFbnzrs.exe
  2⤵
  PID:7684
- C:\Windows\System\hwHSUUM.exe
  C:\Windows\System\hwHSUUM.exe
  2⤵
  PID:7972
- C:\Windows\System\dOxjENN.exe
  C:\Windows\System\dOxjENN.exe
  2⤵
  PID:8036
- C:\Windows\System\taWvXnZ.exe
  C:\Windows\System\taWvXnZ.exe
  2⤵
  PID:8096
- C:\Windows\System\wiGmsvj.exe
  C:\Windows\System\wiGmsvj.exe
  2⤵
  PID:8160
- C:\Windows\System\WFxMhIl.exe
  C:\Windows\System\WFxMhIl.exe
  2⤵
  PID:7180
- C:\Windows\System\xHaqwGT.exe
  C:\Windows\System\xHaqwGT.exe
  2⤵
  PID:7820
- C:\Windows\System\lqcYAgm.exe
  C:\Windows\System\lqcYAgm.exe
  2⤵
  PID:7716
- C:\Windows\System\jLGgoIm.exe
  C:\Windows\System\jLGgoIm.exe
  2⤵
  PID:8016
- C:\Windows\System\oxUdTzN.exe
  C:\Windows\System\oxUdTzN.exe
  2⤵
  PID:8112
- C:\Windows\System\GpPxvHZ.exe
  C:\Windows\System\GpPxvHZ.exe
  2⤵
  PID:7924
- C:\Windows\System\GgYUJcW.exe
  C:\Windows\System\GgYUJcW.exe
  2⤵
  PID:8048
- C:\Windows\System\HOMzdFJ.exe
  C:\Windows\System\HOMzdFJ.exe
  2⤵
  PID:8116
- C:\Windows\System\FYCOPhq.exe
  C:\Windows\System\FYCOPhq.exe
  2⤵
  PID:8180
- C:\Windows\System\mXRArFw.exe
  C:\Windows\System\mXRArFw.exe
  2⤵
  PID:6780
- C:\Windows\System\yygvTgB.exe
  C:\Windows\System\yygvTgB.exe
  2⤵
  PID:7276
- C:\Windows\System\WIAPfEw.exe
  C:\Windows\System\WIAPfEw.exe
  2⤵
  PID:7228
- C:\Windows\System\QicZfQM.exe
  C:\Windows\System\QicZfQM.exe
  2⤵
  PID:7536
- C:\Windows\System\gpkATqZ.exe
  C:\Windows\System\gpkATqZ.exe
  2⤵
  PID:7600
- C:\Windows\System\zMsqBMS.exe
  C:\Windows\System\zMsqBMS.exe
  2⤵
  PID:7836
- C:\Windows\System\JIGieFY.exe
  C:\Windows\System\JIGieFY.exe
  2⤵
  PID:7200
- C:\Windows\System\chQPZNZ.exe
  C:\Windows\System\chQPZNZ.exe
  2⤵
  PID:7620
- C:\Windows\System\omftdgd.exe
  C:\Windows\System\omftdgd.exe
  2⤵
  PID:7356
- C:\Windows\System\wCkOjjt.exe
  C:\Windows\System\wCkOjjt.exe
  2⤵
  PID:7472
- C:\Windows\System\oZorcKl.exe
  C:\Windows\System\oZorcKl.exe
  2⤵
  PID:7696
- C:\Windows\System\akSPORK.exe
  C:\Windows\System\akSPORK.exe
  2⤵
  PID:6856
- C:\Windows\System\cDcFvMh.exe
  C:\Windows\System\cDcFvMh.exe
  2⤵
  PID:7968
- C:\Windows\System\YAishXn.exe
  C:\Windows\System\YAishXn.exe
  2⤵
  PID:8132
- C:\Windows\System\RmCNGkh.exe
  C:\Windows\System\RmCNGkh.exe
  2⤵
  PID:7748
- C:\Windows\System\LfDerMk.exe
  C:\Windows\System\LfDerMk.exe
  2⤵
  PID:8084
- C:\Windows\System\dTuEwYG.exe
  C:\Windows\System\dTuEwYG.exe
  2⤵
  PID:7060
- C:\Windows\System\POYrFQw.exe
  C:\Windows\System\POYrFQw.exe
  2⤵
  PID:7884
- C:\Windows\System\cnwcJYX.exe
  C:\Windows\System\cnwcJYX.exe
  2⤵
  PID:8148
- C:\Windows\System\ALxRBtY.exe
  C:\Windows\System\ALxRBtY.exe
  2⤵
  PID:5428
- C:\Windows\System\HSUmcPE.exe
  C:\Windows\System\HSUmcPE.exe
  2⤵
  PID:7520
- C:\Windows\System\ENXRaTr.exe
  C:\Windows\System\ENXRaTr.exe
  2⤵
  PID:7424
- C:\Windows\System\DENVTwP.exe
  C:\Windows\System\DENVTwP.exe
  2⤵
  PID:7612
- C:\Windows\System\xpjkCXW.exe
  C:\Windows\System\xpjkCXW.exe
  2⤵
  PID:7904
- C:\Windows\System\wkXHrpg.exe
  C:\Windows\System\wkXHrpg.exe
  2⤵
  PID:7500
- C:\Windows\System\yJgyTDF.exe
  C:\Windows\System\yJgyTDF.exe
  2⤵
  PID:7780
- C:\Windows\System\RENqcwF.exe
  C:\Windows\System\RENqcwF.exe
  2⤵
  PID:6984
- C:\Windows\System\RgOzSMW.exe
  C:\Windows\System\RgOzSMW.exe
  2⤵
  PID:8020
- C:\Windows\System\MrjGHmi.exe
  C:\Windows\System\MrjGHmi.exe
  2⤵
  PID:7552
- C:\Windows\System\eKuDLxI.exe
  C:\Windows\System\eKuDLxI.exe
  2⤵
  PID:7760
- C:\Windows\System\XjNzcwz.exe
  C:\Windows\System\XjNzcwz.exe
  2⤵
  PID:7988
- C:\Windows\System\cRGBdPQ.exe
  C:\Windows\System\cRGBdPQ.exe
  2⤵
  PID:7632
- C:\Windows\System\bUOfUCc.exe
  C:\Windows\System\bUOfUCc.exe
  2⤵
  PID:7404
- C:\Windows\System\TaQpNch.exe
  C:\Windows\System\TaQpNch.exe
  2⤵
  PID:8208
- C:\Windows\System\yZmeoWQ.exe
  C:\Windows\System\yZmeoWQ.exe
  2⤵
  PID:8228
- C:\Windows\System\NDMKCCY.exe
  C:\Windows\System\NDMKCCY.exe
  2⤵
  PID:8244
- C:\Windows\System\WufgjPC.exe
  C:\Windows\System\WufgjPC.exe
  2⤵
  PID:8264
- C:\Windows\System\CcjBckk.exe
  C:\Windows\System\CcjBckk.exe
  2⤵
  PID:8280
- C:\Windows\System\WSiyuxf.exe
  C:\Windows\System\WSiyuxf.exe
  2⤵
  PID:8296
- C:\Windows\System\PCknWQJ.exe
  C:\Windows\System\PCknWQJ.exe
  2⤵
  PID:8312
- C:\Windows\System\KSEIQFs.exe
  C:\Windows\System\KSEIQFs.exe
  2⤵
  PID:8328
- C:\Windows\System\XecbDun.exe
  C:\Windows\System\XecbDun.exe
  2⤵
  PID:8344
- C:\Windows\System\IbjxCrX.exe
  C:\Windows\System\IbjxCrX.exe
  2⤵
  PID:8360
- C:\Windows\System\mAibHJj.exe
  C:\Windows\System\mAibHJj.exe
  2⤵
  PID:8376
- C:\Windows\System\oKiJewv.exe
  C:\Windows\System\oKiJewv.exe
  2⤵
  PID:8392
- C:\Windows\System\MclMWlx.exe
  C:\Windows\System\MclMWlx.exe
  2⤵
  PID:8408
- C:\Windows\System\lHeOhuS.exe
  C:\Windows\System\lHeOhuS.exe
  2⤵
  PID:8424
- C:\Windows\System\whLWMrj.exe
  C:\Windows\System\whLWMrj.exe
  2⤵
  PID:8440
- C:\Windows\System\QySBelq.exe
  C:\Windows\System\QySBelq.exe
  2⤵
  PID:8456
- C:\Windows\System\CCzyGkM.exe
  C:\Windows\System\CCzyGkM.exe
  2⤵
  PID:8472
- C:\Windows\System\uzyNNtu.exe
  C:\Windows\System\uzyNNtu.exe
  2⤵
  PID:8488
- C:\Windows\System\lnjHUlA.exe
  C:\Windows\System\lnjHUlA.exe
  2⤵
  PID:8504
- C:\Windows\System\QuiJLHS.exe
  C:\Windows\System\QuiJLHS.exe
  2⤵
  PID:8520
- C:\Windows\System\WotjwCo.exe
  C:\Windows\System\WotjwCo.exe
  2⤵
  PID:8536
- C:\Windows\System\OfwbdsH.exe
  C:\Windows\System\OfwbdsH.exe
  2⤵
  PID:8552
- C:\Windows\System\tsNRbEv.exe
  C:\Windows\System\tsNRbEv.exe
  2⤵
  PID:8568
- C:\Windows\System\BJVGVyN.exe
  C:\Windows\System\BJVGVyN.exe
  2⤵
  PID:8584
- C:\Windows\System\lNcZDeY.exe
  C:\Windows\System\lNcZDeY.exe
  2⤵
  PID:8600
- C:\Windows\System\LvcmaqJ.exe
  C:\Windows\System\LvcmaqJ.exe
  2⤵
  PID:8616
- C:\Windows\System\wZuhQZJ.exe
  C:\Windows\System\wZuhQZJ.exe
  2⤵
  PID:8632
- C:\Windows\System\njUPRRl.exe
  C:\Windows\System\njUPRRl.exe
  2⤵
  PID:8648
- C:\Windows\System\AgdPUso.exe
  C:\Windows\System\AgdPUso.exe
  2⤵
  PID:8664
- C:\Windows\System\QZmSxHK.exe
  C:\Windows\System\QZmSxHK.exe
  2⤵
  PID:8692
- C:\Windows\System\UlTrKzy.exe
  C:\Windows\System\UlTrKzy.exe
  2⤵
  PID:8708
- C:\Windows\System\RUIgxzY.exe
  C:\Windows\System\RUIgxzY.exe
  2⤵
  PID:8728
- C:\Windows\System\QDbZYzp.exe
  C:\Windows\System\QDbZYzp.exe
  2⤵
  PID:8744
- C:\Windows\System\AOAsjcH.exe
  C:\Windows\System\AOAsjcH.exe
  2⤵
  PID:8764
- C:\Windows\System\SfJeSWO.exe
  C:\Windows\System\SfJeSWO.exe
  2⤵
  PID:8784
- C:\Windows\System\VYSDlUs.exe
  C:\Windows\System\VYSDlUs.exe
  2⤵
  PID:8800
- C:\Windows\System\lORcjNB.exe
  C:\Windows\System\lORcjNB.exe
  2⤵
  PID:8816
- C:\Windows\System\ouQDpus.exe
  C:\Windows\System\ouQDpus.exe
  2⤵
  PID:8832
- C:\Windows\System\UHNSSvD.exe
  C:\Windows\System\UHNSSvD.exe
  2⤵
  PID:8848
- C:\Windows\System\EjJrjei.exe
  C:\Windows\System\EjJrjei.exe
  2⤵
  PID:8864
- C:\Windows\System\QlqFnkT.exe
  C:\Windows\System\QlqFnkT.exe
  2⤵
  PID:8880
- C:\Windows\System\XGEopAP.exe
  C:\Windows\System\XGEopAP.exe
  2⤵
  PID:8896
- C:\Windows\System\lsRxeMd.exe
  C:\Windows\System\lsRxeMd.exe
  2⤵
  PID:8912
- C:\Windows\System\ZmkkaKd.exe
  C:\Windows\System\ZmkkaKd.exe
  2⤵
  PID:8928
- C:\Windows\System\nmbswYS.exe
  C:\Windows\System\nmbswYS.exe
  2⤵
  PID:8944
- C:\Windows\System\UPZcYSw.exe
  C:\Windows\System\UPZcYSw.exe
  2⤵
  PID:8960
- C:\Windows\System\pNqOhxq.exe
  C:\Windows\System\pNqOhxq.exe
  2⤵
  PID:8976
- C:\Windows\System\UGTlWyR.exe
  C:\Windows\System\UGTlWyR.exe
  2⤵
  PID:8992
- C:\Windows\System\EuOiaVj.exe
  C:\Windows\System\EuOiaVj.exe
  2⤵
  PID:9008
- C:\Windows\System\tbDwZsd.exe
  C:\Windows\System\tbDwZsd.exe
  2⤵
  PID:9024
- C:\Windows\System\yhJcFSV.exe
  C:\Windows\System\yhJcFSV.exe
  2⤵
  PID:9040
- C:\Windows\System\HJxPeIn.exe
  C:\Windows\System\HJxPeIn.exe
  2⤵
  PID:9056
- C:\Windows\System\iVmMgUS.exe
  C:\Windows\System\iVmMgUS.exe
  2⤵
  PID:9072
- C:\Windows\System\lyushPS.exe
  C:\Windows\System\lyushPS.exe
  2⤵
  PID:9088
- C:\Windows\System\BWnTiCQ.exe
  C:\Windows\System\BWnTiCQ.exe
  2⤵
  PID:9104
- C:\Windows\System\bCbjZmg.exe
  C:\Windows\System\bCbjZmg.exe
  2⤵
  PID:9120
- C:\Windows\System\snMyJdw.exe
  C:\Windows\System\snMyJdw.exe
  2⤵
  PID:9136
- C:\Windows\System\YflnWTf.exe
  C:\Windows\System\YflnWTf.exe
  2⤵
  PID:9152
- C:\Windows\System\wIGwMjB.exe
  C:\Windows\System\wIGwMjB.exe
  2⤵
  PID:9168
- C:\Windows\System\smSuqaF.exe
  C:\Windows\System\smSuqaF.exe
  2⤵
  PID:9184
- C:\Windows\System\LiMCyZE.exe
  C:\Windows\System\LiMCyZE.exe
  2⤵
  PID:9200
- C:\Windows\System\WcHgjGC.exe
  C:\Windows\System\WcHgjGC.exe
  2⤵
  PID:8220
- C:\Windows\System\qOpywZW.exe
  C:\Windows\System\qOpywZW.exe
  2⤵
  PID:6156
- C:\Windows\System\UvsxMGw.exe
  C:\Windows\System\UvsxMGw.exe
  2⤵
  PID:8216
- C:\Windows\System\RkGToQV.exe
  C:\Windows\System\RkGToQV.exe
  2⤵
  PID:7732
- C:\Windows\System\NpFEWhM.exe
  C:\Windows\System\NpFEWhM.exe
  2⤵
  PID:7484
- C:\Windows\System\VfBasAX.exe
  C:\Windows\System\VfBasAX.exe
  2⤵
  PID:8356
- C:\Windows\System\gnZJMNK.exe
  C:\Windows\System\gnZJMNK.exe
  2⤵
  PID:8384
- C:\Windows\System\JXCNcrz.exe
  C:\Windows\System\JXCNcrz.exe
  2⤵
  PID:8448
- C:\Windows\System\JNHJSQi.exe
  C:\Windows\System\JNHJSQi.exe
  2⤵
  PID:7664
- C:\Windows\System\wKwAQZA.exe
  C:\Windows\System\wKwAQZA.exe
  2⤵
  PID:8400
- C:\Windows\System\pPwhyvg.exe
  C:\Windows\System\pPwhyvg.exe
  2⤵
  PID:8336
- C:\Windows\System\QEHZmPq.exe
  C:\Windows\System\QEHZmPq.exe
  2⤵
  PID:8308
- C:\Windows\System\xLgWPlf.exe
  C:\Windows\System\xLgWPlf.exe
  2⤵
  PID:8516
- C:\Windows\System\wEzuIOx.exe
  C:\Windows\System\wEzuIOx.exe
  2⤵
  PID:8528
- C:\Windows\System\SyFtmjL.exe
  C:\Windows\System\SyFtmjL.exe
  2⤵
  PID:8576
- C:\Windows\System\abnBWnh.exe
  C:\Windows\System\abnBWnh.exe
  2⤵
  PID:8612
- C:\Windows\System\aPKoqUi.exe
  C:\Windows\System\aPKoqUi.exe
  2⤵
  PID:8592
- C:\Windows\System\VvriGYw.exe
  C:\Windows\System\VvriGYw.exe
  2⤵
  PID:8656
- C:\Windows\System\knLnZWS.exe
  C:\Windows\System\knLnZWS.exe
  2⤵
  PID:8684
- C:\Windows\System\PvaCkXH.exe
  C:\Windows\System\PvaCkXH.exe
  2⤵
  PID:8720
- C:\Windows\System\ZVAkjDd.exe
  C:\Windows\System\ZVAkjDd.exe
  2⤵
  PID:8760
- C:\Windows\System\QLfZbCT.exe
  C:\Windows\System\QLfZbCT.exe
  2⤵
  PID:8772
- C:\Windows\System\awPaovH.exe
  C:\Windows\System\awPaovH.exe
  2⤵
  PID:8796
- C:\Windows\System\YRsYIRL.exe
  C:\Windows\System\YRsYIRL.exe
  2⤵
  PID:8892
- C:\Windows\System\PKTDKSD.exe
  C:\Windows\System\PKTDKSD.exe
  2⤵
  PID:9016
- C:\Windows\System\YWNcRDf.exe
  C:\Windows\System\YWNcRDf.exe
  2⤵
  PID:9068
- C:\Windows\System\QUVnmpm.exe
  C:\Windows\System\QUVnmpm.exe
  2⤵
  PID:9128
- C:\Windows\System\QZlmSoG.exe
  C:\Windows\System\QZlmSoG.exe
  2⤵
  PID:9192
- C:\Windows\System\NavoNqP.exe
  C:\Windows\System\NavoNqP.exe
  2⤵
  PID:9176
- C:\Windows\System\bsVkLLV.exe
  C:\Windows\System\bsVkLLV.exe
  2⤵
  PID:9080
- C:\Windows\System\alDcfVY.exe
  C:\Windows\System\alDcfVY.exe
  2⤵
  PID:9212
- C:\Windows\System\sAnkzhH.exe
  C:\Windows\System\sAnkzhH.exe
  2⤵
  PID:8204
- C:\Windows\System\jefpyYP.exe
  C:\Windows\System\jefpyYP.exe
  2⤵
  PID:7816
- C:\Windows\System\NYIUliS.exe
  C:\Windows\System\NYIUliS.exe
  2⤵
  PID:8352
- C:\Windows\System\pvUzZfd.exe
  C:\Windows\System\pvUzZfd.exe
  2⤵
  PID:8368
- C:\Windows\System\DiDrtKG.exe
  C:\Windows\System\DiDrtKG.exe
  2⤵
  PID:8304
- C:\Windows\System\iZlJiLj.exe
  C:\Windows\System\iZlJiLj.exe
  2⤵
  PID:8512
- C:\Windows\System\NsCsJhd.exe
  C:\Windows\System\NsCsJhd.exe
  2⤵
  PID:8464
- C:\Windows\System\UWSTAUY.exe
  C:\Windows\System\UWSTAUY.exe
  2⤵
  PID:8672
- C:\Windows\System\naTUVmN.exe
  C:\Windows\System\naTUVmN.exe
  2⤵
  PID:8628
- C:\Windows\System\fsFJLXa.exe
  C:\Windows\System\fsFJLXa.exe
  2⤵
  PID:8776
- C:\Windows\System\bKSkrDI.exe
  C:\Windows\System\bKSkrDI.exe
  2⤵
  PID:8676
- C:\Windows\System\QgqpTmY.exe
  C:\Windows\System\QgqpTmY.exe
  2⤵
  PID:8860
- C:\Windows\System\CBZhTQm.exe
  C:\Windows\System\CBZhTQm.exe
  2⤵
  PID:8808
- C:\Windows\System\AaLiekc.exe
  C:\Windows\System\AaLiekc.exe
  2⤵
  PID:8888
- C:\Windows\System\NAPRISF.exe
  C:\Windows\System\NAPRISF.exe
  2⤵
  PID:8256
- C:\Windows\System\prgLBxY.exe
  C:\Windows\System\prgLBxY.exe
  2⤵
  PID:8272
- C:\Windows\System\oewFFRR.exe
  C:\Windows\System\oewFFRR.exe
  2⤵
  PID:8580
- C:\Windows\System\EzSqqGu.exe
  C:\Windows\System\EzSqqGu.exe
  2⤵
  PID:8736
- C:\Windows\System\furmCcB.exe
  C:\Windows\System\furmCcB.exe
  2⤵
  PID:8988
- C:\Windows\System\FvbSmON.exe
  C:\Windows\System\FvbSmON.exe
  2⤵
  PID:8372
- C:\Windows\System\rhPNosf.exe
  C:\Windows\System\rhPNosf.exe
  2⤵
  PID:8828
- C:\Windows\System\SlueqNW.exe
  C:\Windows\System\SlueqNW.exe
  2⤵
  PID:8904
- C:\Windows\System\WzCQNIU.exe
  C:\Windows\System\WzCQNIU.exe
  2⤵
  PID:9148
- C:\Windows\System\aSsoFOC.exe
  C:\Windows\System\aSsoFOC.exe
  2⤵
  PID:8740
- C:\Windows\System\IKHNDzt.exe
  C:\Windows\System\IKHNDzt.exe
  2⤵
  PID:8756
- C:\Windows\System\XOWnvmf.exe
  C:\Windows\System\XOWnvmf.exe
  2⤵
  PID:8548
- C:\Windows\System\dJpEyoL.exe
  C:\Windows\System\dJpEyoL.exe
  2⤵
  PID:8560
- C:\Windows\System\KhGOYrd.exe
  C:\Windows\System\KhGOYrd.exe
  2⤵
  PID:9096
- C:\Windows\System\QzzsrGX.exe
  C:\Windows\System\QzzsrGX.exe
  2⤵
  PID:9100
- C:\Windows\System\yCxXPlR.exe
  C:\Windows\System\yCxXPlR.exe
  2⤵
  PID:9052
- C:\Windows\System\ydNUbUd.exe
  C:\Windows\System\ydNUbUd.exe
  2⤵
  PID:8968
- C:\Windows\System\vaAAXMv.exe
  C:\Windows\System\vaAAXMv.exe
  2⤵
  PID:9228
- C:\Windows\System\REPvzII.exe
  C:\Windows\System\REPvzII.exe
  2⤵
  PID:9244
- C:\Windows\System\cMzcEBh.exe
  C:\Windows\System\cMzcEBh.exe
  2⤵
  PID:9260
- C:\Windows\System\CGstTmF.exe
  C:\Windows\System\CGstTmF.exe
  2⤵
  PID:9276
- C:\Windows\System\xOJSTHU.exe
  C:\Windows\System\xOJSTHU.exe
  2⤵
  PID:9292
- C:\Windows\System\btkRfJA.exe
  C:\Windows\System\btkRfJA.exe
  2⤵
  PID:9308
- C:\Windows\System\LpYhCDg.exe
  C:\Windows\System\LpYhCDg.exe
  2⤵
  PID:9324
- C:\Windows\System\dzGPMKN.exe
  C:\Windows\System\dzGPMKN.exe
  2⤵
  PID:9340
- C:\Windows\System\mHPSWfs.exe
  C:\Windows\System\mHPSWfs.exe
  2⤵
  PID:9356
- C:\Windows\System\sfcTLUT.exe
  C:\Windows\System\sfcTLUT.exe
  2⤵
  PID:9372
- C:\Windows\System\CNtnjWu.exe
  C:\Windows\System\CNtnjWu.exe
  2⤵
  PID:9388
- C:\Windows\System\brhKQSV.exe
  C:\Windows\System\brhKQSV.exe
  2⤵
  PID:9404
- C:\Windows\System\tsYupGr.exe
  C:\Windows\System\tsYupGr.exe
  2⤵
  PID:9420
- C:\Windows\System\xrekcpl.exe
  C:\Windows\System\xrekcpl.exe
  2⤵
  PID:9436
- C:\Windows\System\vYiuHDl.exe
  C:\Windows\System\vYiuHDl.exe
  2⤵
  PID:9452
- C:\Windows\System\xKeaVIm.exe
  C:\Windows\System\xKeaVIm.exe
  2⤵
  PID:9468
- C:\Windows\System\cxjMTkU.exe
  C:\Windows\System\cxjMTkU.exe
  2⤵
  PID:9484
- C:\Windows\System\BCgPQjc.exe
  C:\Windows\System\BCgPQjc.exe
  2⤵
  PID:9500
- C:\Windows\System\oxQyOut.exe
  C:\Windows\System\oxQyOut.exe
  2⤵
  PID:9516
- C:\Windows\System\AvlsrPR.exe
  C:\Windows\System\AvlsrPR.exe
  2⤵
  PID:9532
- C:\Windows\System\wOVgzyu.exe
  C:\Windows\System\wOVgzyu.exe
  2⤵
  PID:9548
- C:\Windows\System\GRrBJHl.exe
  C:\Windows\System\GRrBJHl.exe
  2⤵
  PID:9564
- C:\Windows\System\AHbkHPA.exe
  C:\Windows\System\AHbkHPA.exe
  2⤵
  PID:9580
- C:\Windows\System\QAKDnOK.exe
  C:\Windows\System\QAKDnOK.exe
  2⤵
  PID:9596
- C:\Windows\System\QLxpCUQ.exe
  C:\Windows\System\QLxpCUQ.exe
  2⤵
  PID:9612
- C:\Windows\System\JppFpei.exe
  C:\Windows\System\JppFpei.exe
  2⤵
  PID:9628
- C:\Windows\System\iZuIaeV.exe
  C:\Windows\System\iZuIaeV.exe
  2⤵
  PID:9644
- C:\Windows\System\AvjjabY.exe
  C:\Windows\System\AvjjabY.exe
  2⤵
  PID:9664
- C:\Windows\System\aqfDQXy.exe
  C:\Windows\System\aqfDQXy.exe
  2⤵
  PID:9680
- C:\Windows\System\YOYdpoh.exe
  C:\Windows\System\YOYdpoh.exe
  2⤵
  PID:9696
- C:\Windows\System\cqRJvyw.exe
  C:\Windows\System\cqRJvyw.exe
  2⤵
  PID:9712
- C:\Windows\System\iAZgADe.exe
  C:\Windows\System\iAZgADe.exe
  2⤵
  PID:9728
- C:\Windows\System\ssAqUKq.exe
  C:\Windows\System\ssAqUKq.exe
  2⤵
  PID:9744
- C:\Windows\System\xsYZnTs.exe
  C:\Windows\System\xsYZnTs.exe
  2⤵
  PID:9760
- C:\Windows\System\caFmpZG.exe
  C:\Windows\System\caFmpZG.exe
  2⤵
  PID:9776
- C:\Windows\System\FpUPKrS.exe
  C:\Windows\System\FpUPKrS.exe
  2⤵
  PID:9792
- C:\Windows\System\thfyRsV.exe
  C:\Windows\System\thfyRsV.exe
  2⤵
  PID:10008
- C:\Windows\System\EEPRKjt.exe
  C:\Windows\System\EEPRKjt.exe
  2⤵
  PID:10120
- C:\Windows\System\aiNGeDf.exe
  C:\Windows\System\aiNGeDf.exe
  2⤵
  PID:9240
- C:\Windows\System\AprcTLr.exe
  C:\Windows\System\AprcTLr.exe
  2⤵
  PID:9428
- C:\Windows\System\LcCCsaE.exe
  C:\Windows\System\LcCCsaE.exe
  2⤵
  PID:9460
- C:\Windows\System\XWvtNvi.exe
  C:\Windows\System\XWvtNvi.exe
  2⤵
  PID:9524
- C:\Windows\System\IXUeDix.exe
  C:\Windows\System\IXUeDix.exe
  2⤵
  PID:9352
- C:\Windows\System\ORjmKwR.exe
  C:\Windows\System\ORjmKwR.exe
  2⤵
  PID:9704
- C:\Windows\System\PLKckRd.exe
  C:\Windows\System\PLKckRd.exe
  2⤵
  PID:9768
- C:\Windows\System\owBEXSO.exe
  C:\Windows\System\owBEXSO.exe
  2⤵
  PID:10016
- C:\Windows\System\LINltjI.exe
  C:\Windows\System\LINltjI.exe
  2⤵
  PID:9936
- C:\Windows\System\ZeWAsar.exe
  C:\Windows\System\ZeWAsar.exe
  2⤵
  PID:9492
- C:\Windows\System\IVXQOXH.exe
  C:\Windows\System\IVXQOXH.exe
  2⤵
  PID:9224
- C:\Windows\System\TitwtFI.exe
  C:\Windows\System\TitwtFI.exe
  2⤵
  PID:9560
- C:\Windows\System\NKsgkdM.exe
  C:\Windows\System\NKsgkdM.exe
  2⤵
  PID:9480
- C:\Windows\System\GvqwfGB.exe
  C:\Windows\System\GvqwfGB.exe
  2⤵
  PID:9640
- C:\Windows\System\NlbCYcF.exe
  C:\Windows\System\NlbCYcF.exe
  2⤵
  PID:9956
- C:\Windows\System\SFljxEq.exe
  C:\Windows\System\SFljxEq.exe
  2⤵
  PID:9252
- C:\Windows\System\jvQcXar.exe
  C:\Windows\System\jvQcXar.exe
  2⤵
  PID:10420
- C:\Windows\System\aorgKdj.exe
  C:\Windows\System\aorgKdj.exe
  2⤵
  PID:10580
- C:\Windows\System\JmYRYTT.exe
  C:\Windows\System\JmYRYTT.exe
  2⤵
  PID:10660
- C:\Windows\System\mntETFW.exe
  C:\Windows\System\mntETFW.exe
  2⤵
  PID:10740
- C:\Windows\System\awQGDtC.exe
  C:\Windows\System\awQGDtC.exe
  2⤵
  PID:10868
- C:\Windows\System\bBVAWIR.exe
  C:\Windows\System\bBVAWIR.exe
  2⤵
  PID:10980
- C:\Windows\System\QewFuDK.exe
  C:\Windows\System\QewFuDK.exe
  2⤵
  PID:11060
- C:\Windows\System\FJYGcwF.exe
  C:\Windows\System\FJYGcwF.exe
  2⤵
  PID:11092
- C:\Windows\System\LOQDpvu.exe
  C:\Windows\System\LOQDpvu.exe
  2⤵
  PID:11112
- C:\Windows\System\GBONpUH.exe
  C:\Windows\System\GBONpUH.exe
  2⤵
  PID:11128
- C:\Windows\System\wfqNMPO.exe
  C:\Windows\System\wfqNMPO.exe
  2⤵
  PID:11144
- C:\Windows\System\Daiqmoi.exe
  C:\Windows\System\Daiqmoi.exe
  2⤵
  PID:11160
- C:\Windows\System\cSlXFQN.exe
  C:\Windows\System\cSlXFQN.exe
  2⤵
  PID:11176
- C:\Windows\System\IdNfNGx.exe
  C:\Windows\System\IdNfNGx.exe
  2⤵
  PID:11192
- C:\Windows\System\DPuDdsp.exe
  C:\Windows\System\DPuDdsp.exe
  2⤵
  PID:11208
- C:\Windows\System\fXbaWUb.exe
  C:\Windows\System\fXbaWUb.exe
  2⤵
  PID:11224
- C:\Windows\System\tUZWbWc.exe
  C:\Windows\System\tUZWbWc.exe
  2⤵
  PID:11240
- C:\Windows\System\DxTbVen.exe
  C:\Windows\System\DxTbVen.exe
  2⤵
  PID:11256
- C:\Windows\System\TaIrNqJ.exe
  C:\Windows\System\TaIrNqJ.exe
  2⤵
  PID:10284
- C:\Windows\System\uNHHXtw.exe
  C:\Windows\System\uNHHXtw.exe
  2⤵
  PID:10348
- C:\Windows\System\yADCNSh.exe
  C:\Windows\System\yADCNSh.exe
  2⤵
  PID:10412
- C:\Windows\System\JTUlaZh.exe
  C:\Windows\System\JTUlaZh.exe
  2⤵
  PID:10476
- C:\Windows\System\AzEHYcX.exe
  C:\Windows\System\AzEHYcX.exe
  2⤵
  PID:10540
- C:\Windows\System\iMEychr.exe
  C:\Windows\System\iMEychr.exe
  2⤵
  PID:9620
- C:\Windows\System\ULPAMHA.exe
  C:\Windows\System\ULPAMHA.exe
  2⤵
  PID:9416
- C:\Windows\System\pVYTfFm.exe
  C:\Windows\System\pVYTfFm.exe
  2⤵
  PID:10268
- C:\Windows\System\NCeWOMX.exe
  C:\Windows\System\NCeWOMX.exe
  2⤵
  PID:10524
- C:\Windows\System\XqJdrvj.exe
  C:\Windows\System\XqJdrvj.exe
  2⤵
  PID:10272
- C:\Windows\System\IINAfZl.exe
  C:\Windows\System\IINAfZl.exe
  2⤵
  PID:10128
- C:\Windows\System\PIoJOJh.exe
  C:\Windows\System\PIoJOJh.exe
  2⤵
  PID:10636
- C:\Windows\System\izwHrGw.exe
  C:\Windows\System\izwHrGw.exe
  2⤵
  PID:10364
- C:\Windows\System\khAAAxn.exe
  C:\Windows\System\khAAAxn.exe
  2⤵
  PID:10432
- C:\Windows\System\tHjdXhy.exe
  C:\Windows\System\tHjdXhy.exe
  2⤵
  PID:10640
- C:\Windows\System\LgCNVDi.exe
  C:\Windows\System\LgCNVDi.exe
  2⤵
  PID:10656
- C:\Windows\System\vCBfaWs.exe
  C:\Windows\System\vCBfaWs.exe
  2⤵
  PID:10704
- C:\Windows\System\skotxOy.exe
  C:\Windows\System\skotxOy.exe
  2⤵
  PID:10736
- C:\Windows\System\owYnrQK.exe
  C:\Windows\System\owYnrQK.exe
  2⤵
  PID:1572
- C:\Windows\System\CeORDhv.exe
  C:\Windows\System\CeORDhv.exe
  2⤵
  PID:10796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EhYTrzX.exe

Filesize
1.8MB

MD5
71ce262a640b030d0a54f66528b65ddb

SHA1
967fe340c45a89a249d567b670b8eb37ee1f2d57

SHA256
91446dabfd215093795121b17ba6dd8132150ac5441dcb41d74477816215c8af

SHA512
5dc0d920a97a0bca3b4691db387e3b9b0e560464b5f91a09a5d98bd983771f8e843edd3e78535fb397d6465d331d7138c2a0ed883d5316f87f9554caac061893

Download Submit
C:\Windows\system\HwEtGco.exe

Filesize
1.8MB

MD5
50e6bb05e719e22936c2d391c8a3cc21

SHA1
438449e4b2ce48b010f38ae63bc953d96485cb41

SHA256
1b30099a2db9ed0cc8f2b7a3c56843f688c386a72bbf84dc663c472c33dbeead

SHA512
14ad1a811c4e4600b5dbefcc1d488348bd3b7b905823df4d72786ad14a553309639a266b02290c9491c4d0634c95c974db81dc8c7f4fa8e7be1e0584207c4774

Download Submit
C:\Windows\system\LNIRAeZ.exe

Filesize
1.8MB

MD5
f5d8313d2caf5b29766e2e2141526c76

SHA1
017c83349b4f79faea097318d891ae9c20cbfe33

SHA256
9040093e06634c0ce8734b930d972eae532ee48ed088d4062b4701f1182f4b5c

SHA512
3b2eafe109b6d978ce42b924703a7778b408f8069da5022144b7657ce5c99627157d6742ea5604388056776b6b020838ff3dd5e3d3b5e9eb82c9c060875d7c6e

Download Submit
C:\Windows\system\RnwLPZt.exe

Filesize
1.8MB

MD5
422f80bf5adf33b8dab8c78607e7efb1

SHA1
af85126a0809630f0c3bbc004cd265db5fa3a47c

SHA256
982c4da4af6859316b20137d79f29355226fc0b962d0e13c8810f9d4c7d61482

SHA512
a95e48f4450647751f2bded0ddf789c7d32c9e0d14fc7ea150fbe3902989ab031329ad3a1d112564811bd1b7b6287df56145588ed2cdae107826c3d751e56426

Download Submit
C:\Windows\system\UkCRYtX.exe

Filesize
1.8MB

MD5
a226550aa6bf986a81a5ca06a5c78ae4

SHA1
2e788eb2088c51d77cf3903a41ae091c3b5ebbc6

SHA256
08385582d2389a14e18e207e9a0815db21ac897e2ef5b2f2533c2e4dd70f1a53

SHA512
43f4d6011bd0f83d7f3fd0083f7bf90cf12801bb9b272ee7022442822dd4cf24aa3a5e74cbf470742b4f99a7a2725feee3a5dad608eb2fafe9be77985b435b86

Download Submit
C:\Windows\system\XEdPVjK.exe

Filesize
1.8MB

MD5
cc0256ef1bff946f021d6126ef5dddbe

SHA1
8e386df3efc485b769c593074ce4ab69213e22a0

SHA256
e0ffb961feb67d49f287949b736b5c9fab829db11322083e32b6a31f624e92b3

SHA512
946d1cc6e0ae0dc2e7196432a6e2169a607a91565c82d4feef0f8c92814eeab99271f767059b62e64c0cc017b334c798e856da117561e15f868a7c3dcaeb40f1

Download Submit
C:\Windows\system\aywjYuh.exe

Filesize
1.8MB

MD5
bdc0fa9646ed2b95423a86c8ada3fa02

SHA1
44f5cbd10acf7782ae5edc104853c76fa957506d

SHA256
2f09aa45cebff58fe73e4afcf7590c236bbf5b1edf770537cdbab1096a3bb44e

SHA512
5ae8bff6d072225e8855ee30c762333210de4fe2defa4ec478258ac214478c03928956370526685096b719dcdc688cc73b3a9e8b589ca596270b61c438c8f3d2

Download Submit
C:\Windows\system\bdBBtPT.exe

Filesize
1.8MB

MD5
ef215ebb73921e25d4c51951c4096602

SHA1
a4916d31f4f163710d6492088977687c96a8d7d7

SHA256
96d24e2993a5e82411d30da616b81f266f7a7af21b3aadd8dc851aa9505e7d1b

SHA512
3e04f6a34131ee2ad25d907b0e14e07db53f5393dce6e9eca7d3f914cdc9b74148564bca3b0dc433f73df5fe85eb3a420faadfb49b6a27d4db4eefe81ef59740

Download Submit
C:\Windows\system\cPbkass.exe

Filesize
1.8MB

MD5
263f9f0daf185c4f201619b66f8e8da7

SHA1
7132b7625d215b98a51ecc630c756879938e3765

SHA256
65a5b75136bb7e44b2eaed571bb68c9c0ff3195eb0a846ecea59aaf7d9c92239

SHA512
885b002a9b01fa2c56a3553c183e7302ec4f14ec0afa7cdebc9d3d5a4f4922a0522f45b4699b0b19a8e4ce9de474fc795ca9799dea7901bf7a9e8a09fc1d6426

Download Submit
C:\Windows\system\ePhQXiN.exe

Filesize
1.8MB

MD5
a9d466df6f89d8744816994e0751be2e

SHA1
293b416fa263665acb5d6cdc475c014c5cdd6296

SHA256
61c924b744eceb8d3f8e509fc59ac881f75ce95d633203e2ece1bf048c74a1c3

SHA512
7bdafe1d4e9efac5677bde30e6060e3152741a0e1b2c8dcc8e5e280d2af75c43b0bea9e5797e3330b75e7979e31a80ad9cc38f2889c93f6d121e783fa83c8af4

Download Submit
C:\Windows\system\fQoytls.exe

Filesize
1.8MB

MD5
efb12ff065494e7b807ad5a1a31e97ea

SHA1
9d1410d2fa17935dd4006717d9a6836f2034be8c

SHA256
9d59aee800b904235b755fec1c6fbb544158d49411556b1a19c1b55a738d8972

SHA512
c539e30c290e29399a185f80812809f8db0a3b2f7d2ca8ae6185f3c84b4ed49247b9080b8d281289cb6c056504e5a2f5dfeae494e5b6fc81cd669de722daa7be

Download Submit
C:\Windows\system\frVyJei.exe

Filesize
1.8MB

MD5
d1690ca203e537086ca74058d44a0d41

SHA1
90e63b6eb09b208d3e3124301750e0b30d331de1

SHA256
801bcc1632670f3bba2a37bb6e09c3aea283d6f62aacd1307f21cc3ff3bf5659

SHA512
71b88ca988cd2a25bb1111049934cdb2bbb4ba0621b575bc6d95928a90dcf14206f1c73e7485978d926ba08650abe17aed364f70374e88dd281b7b69b87792d4

Download Submit
C:\Windows\system\gvRXXbR.exe

Filesize
1.8MB

MD5
854f31555278a916407e15367da67344

SHA1
ae0dbb2ef785dd81eef4e45cef4667fc6bafc13b

SHA256
d9ee1d76feb0a50d108539ccb3e7fb8160c703eca6152793c555396ce65dc487

SHA512
32dacef6acca5d16cd2ab5008e900c9896fd3a2bc6850ae590f692993a792a5c8cc4b7b29b0996d12db08a3e5ef9cbda4a728233678443a0da51882514c0bce7

Download Submit
C:\Windows\system\kXikWvJ.exe

Filesize
1.8MB

MD5
83a2db115f94a7234d72a3a287dfa9ce

SHA1
5d283cbb3334237840c94931caa8a82e4ccda603

SHA256
4f85b830903deb17be6bef25d542ba39858b3594fc398756412ba84ad762067e

SHA512
481716b3ad8e2ac4d9bcd730c4888ad4420a469b2d005fb7fc91495fd6c1b97d3288dde333ef338ea24b3bc75e840a5bea72b80b88c514a4b85f473c297f67da

Download Submit
C:\Windows\system\mXmBBuE.exe

Filesize
1.8MB

MD5
0520085ed7d1ef23675196b2f2daa3ea

SHA1
ff592c5890f2a40b56cdf5579619a517d731bf79

SHA256
92c9e00b5eb224ad454c7019265f76b75dbbb6c431c73eb65f873f7946b9d0e4

SHA512
f190fe5800e0dc4870fa039a25767748604a01afcb35f7640724b7067904b1d9efd03de447508fe4ea82bac983a0c26975a65c6545aa38fa2106cbb6a7bcd761

Download Submit
C:\Windows\system\nHAwNfS.exe

Filesize
1.8MB

MD5
d379019ae1cb5a3d5e3ea0e32d14351a

SHA1
3e36cc69db3cf2558c79454723ffb66ca2dcfb3d

SHA256
79fd4fd3474f30551c0b55833114b20d309501bc99408346959ff55dad64ba3f

SHA512
33586f979aa3023f93eb94bd2c86846696d78602976ae3e273b664b01741655f596b619aa10108b31deee1c829befb2c6cd9fc6fbea64d448d470f48f3ca9bbe

Download Submit
C:\Windows\system\rqCInrw.exe

Filesize
1.8MB

MD5
3882fb75174f6aa729242b2098b163d0

SHA1
819b187f64e34b25442459a476d6aa826d879c10

SHA256
132bc232f9df2feced3e8ed7df81bfb46e3c9a21cbb15ade0b1bbdd3c8375269

SHA512
d8349bc3bbf257bf064c14eacc07330b794044c83d4b818efecb06d817f5d0ea1e74341dc6ec1c93c57a061c9a32d0a5a539e14a68a67bc0b773bc09fab7123c

Download Submit
C:\Windows\system\sEsXlsH.exe

Filesize
1.8MB

MD5
ce0cffe3f1149dff0147dd529e07b431

SHA1
8b90b0fda5e840b21bee7c5145763834770ae808

SHA256
8b4d743bc72f9eab4c73d92589f5a3c8651a8ac1b4d96b4954cd8f6533382be0

SHA512
55d4e0d4e4d0ee39a3ba75a93b61809b70e2aec5df06b0567ea604bbf2394a5bc49943fa22d09a132a3e576a3220e2a1bdf80144e325b327e257387ac37ba051

Download Submit
C:\Windows\system\zcVhTvo.exe

Filesize
1.8MB

MD5
aeb4b2b15b52d756c904637addf5211a

SHA1
a720855e03dba9f223c8c3d267313a534a5b9171

SHA256
70fcdf4190fe60fcd5b9d6dc3a213b22e3535e96bbb71648fadf2e1b58ef18e4

SHA512
2e20a8b4466328f4e88634d358a2175e74a7f660cbd4bdc5978ed1f3d524d995f35225d3a5a069b31eb84320de55bae4287ba773a76f6e0fad5b441623be9837

Download Submit
\Windows\system\BypcWxj.exe

Filesize
1.8MB

MD5
8e5380622e6a8140eabeda28744d00d2

SHA1
8ad0daae2d500db78ad29372b51ad712ba335608

SHA256
4ceab23e99f29fbf2934c86d9d2064cf12c5ef5ac5362d5925f14ae01f0fa05e

SHA512
9d8cddaaf73716b4d94ab3e7426c964c0bc3782aedb3e9b01038b95912b7fcc0e7e36436f99a86c5d742acdebd21c2597f27bb652bc62a732e6d9b1abf8088b9

Download Submit
\Windows\system\BzARwuB.exe

Filesize
1.8MB

MD5
982f0ad8df848442b22e599051e1fce6

SHA1
d45e0edb737d942d8bcf8efb7ced377919c2bf27

SHA256
45b0783e7b07e93f67349e8fab0646ed2cd0a0381568665aea13ce8abcbf70a7

SHA512
4dba63131c1a0ad1b10b7d7ce713f8b6d1cdd8fa919cc64cdd7ac9a470b862fbcd831e75f61b77435979b0a47f6b76c89b280f59524db08f0c10e2b86ff8d2b6

Download Submit
\Windows\system\DKuqjZe.exe

Filesize
1.8MB

MD5
63f92cc721cec7532f867bf01eda3b3f

SHA1
d00acefd29f315b8213daba69ffe131bfaec074a

SHA256
ede28f335906cd495144b9019acd7a7fe2c25ca49fd644430c92f10bc932e06b

SHA512
7a0116c4370e8eb63885f6b220d9b5adbb5c0782ba57a0e2c2898d78b46f0b42dd1acd42475028aecc20d567ee965615cbf9305ff030040ef0d1e1f2195a930b

Download Submit
\Windows\system\DiAvBoM.exe

Filesize
1.8MB

MD5
cdab1267505a557c24e5086a7d4a8c06

SHA1
cf1f60a508da3f21f62eda5be527f6ab47583dbb

SHA256
122cf2066acae7d05dee600f24e2a440ffa2f889a0086aa17146fc558ce753c3

SHA512
186cdb526ff15dc981aa76f7aab213a1ad600ad957117ea4b58d583e7f748271541d29137d5c19917a2c25b3840b417aea3a9de1452b4ffc1694c9d57045028b

Download Submit
\Windows\system\JLkjhxq.exe

Filesize
1.8MB

MD5
85cce1911620968f5990b16d0eeb456a

SHA1
d921a6216641f3764cc76fa49e3ac683b167acd6

SHA256
4600ac6ae847034c8fbb10095bb065e382f4e49c18bb7ce664c884739e28ec1c

SHA512
d3aae818e01cbc1a4a734258569c973646ab0ea952856b476faa6f7b155ef4836c5d6fadaf1f9814fb2366bf3f4d9d7a5ceb8a7a054739ebcfdac1e88e90a69e

Download Submit
\Windows\system\OiYVUDS.exe

Filesize
1.8MB

MD5
f59e6eb56589856c9b32dda50316f4cc

SHA1
d3890ad00bf540f71ca2c610603b69ebd827e909

SHA256
0dc8673350bc04ebeb60fd0065f1c4213adf9ecec965279dec3606cd3dadf31e

SHA512
4f902204164408e3d3964526a694f6440400bef4121d2683b85bf6cd3a0148b3d754480868bcb1405af9503911fd1533df9fb86cbad95a721bbedfbe0e8e35ae

Download Submit
\Windows\system\PXbyjzW.exe

Filesize
1.8MB

MD5
c0e4e14b60b94e6c6117291d186bb54d

SHA1
3c1cf985286fa28192c5ccfaca9c3b3ad9ccadf7

SHA256
9e46ef25a3041cb7ccf1f559f8e6ff8112c627ed41711cb5a7d962c689d28f50

SHA512
e7c9d6a99b901d92c6575b3a70d4327f12a4fb017daae3c21249a6c3fc192345754578509a5d62aa2a6062321f4ff9874a08f888edb2154a3178a13da566d101

Download Submit
\Windows\system\RvPsGso.exe

Filesize
1.8MB

MD5
fa14587b9ec1b5153153ed809ecc39c3

SHA1
f44cd517a7781aee60ebca889071e8c963cb88e6

SHA256
3672f994ec2cefadf60629d1a11cd5d7cceced2277d764077c81b93c5c528ec4

SHA512
7223db9e3cdd03c1869949a5580608eef53e8381ab871d3aaeb78efc8370cd873064a39fd1c41f76616abd9da7a47629193354a72a27836f276da8669f9d95c3

Download Submit
\Windows\system\VHAnEbP.exe

Filesize
1.8MB

MD5
1e4f5b32963361547ff53f6a6b4a7f6d

SHA1
5c7982a086002058e1f45e8eacee71a98b0beb88

SHA256
04728fb4d54471bc6dc3543b2786fd8ae116f664eb962391f77828f3b7eac581

SHA512
e997e1a0638de86d176de147908bf833f12b3f5091de2f06fd45d415f443dd561bb5ef4ec8f388c20c411f7888feff61d4f80f158fc16604ab2f8e65200af3a5

Download Submit
\Windows\system\VWqsCAL.exe

Filesize
1.8MB

MD5
2309cc9d02cdca5c1e80b9a66978a245

SHA1
a0f3d51f7e55a9e22a5d37187332b295e6fae510

SHA256
5da83f09f75284bb996024abf4116f44ae231e18ceb2260fb91e4b80a2240109

SHA512
e19045bb694dd21434dfe6fd279cc875384245fb09bea5bb37d36f4f71f3889bffb9c21107cc5c3ae1e6751ae777e3396010f48042e018283827cadb9b0352f7

Download Submit
\Windows\system\aNXiQxg.exe

Filesize
1.8MB

MD5
e1ec9487af16f3ba97bbd5d8104d94a4

SHA1
348babf1ff9b9c161bc0dc12d1d3f5a7e9252fa1

SHA256
a8374bcfaf9cdbdc44295161a085744bba3271e8d747ba025f4059b8d418351f

SHA512
57518aecd11c8be6250dbedff4e8a513ea8154eec105e2ea9e07ee42e1ee8a9ec8eca71116adcbc5cd40554c18a4da45ca23f2c125ea9731c5bd9dd6c6d3b9b9

Download Submit
\Windows\system\gsehkxr.exe

Filesize
1.8MB

MD5
4985a9ed8cfb0a3bd7363d394a192722

SHA1
f49a6e86a08319d7ba5f771794349c5f4f2446cd

SHA256
1ff338216cd824dcafdf889a3788d7fbe12aa67ff72ed4626551fe449d2e5f45

SHA512
22b136f5ca6f3cd5c38feb170de8657f9f297ccfb5f1bdc202bad24828553580031188c253ecb749e035570c3b0fd68ade9b72bd2d50e8a2dfbee102a715c800

Download Submit
\Windows\system\kFJSLtr.exe

Filesize
1.8MB

MD5
ada9f129c17484d906df35662673f417

SHA1
a2fe5ab10ea04dcbb475264f0a6a4b40529ac889

SHA256
22c8966a78ca89a0a6de3610de9b34856dfa1acc59810265b82c2008ff1f7496

SHA512
03e4016de238a54b4d40521801cb593cecf8319cd14fbe630e8a7baf3226918535eb129a7f940c0867e184c1e30af6a1880cedf45f587d8b4233d2a721df8f20

Download Submit
\Windows\system\kPTYsXL.exe

Filesize
1.8MB

MD5
1f803580176d8025614b83b0f9ae23eb

SHA1
b86e3ac77a7608928bc371e1f37144b293373146

SHA256
facfea72fd6c0dedc7dfac08d4115583fa11254d601b8adb9ca95d7a335a6b01

SHA512
5592639021538f5f7b64ec9b4fe3466eb3ac014a9ee5db35999ab2c78c1ee585af617da99341ba6737d98b8d8833d0172600fca867d4be0f3a308cb14da9e207

Download Submit
\Windows\system\klHWZuJ.exe

Filesize
1.8MB

MD5
6c861d37a373cec34f6f6db3e8fe702b

SHA1
7af42a0908dd46c64da1a431280fff83dc15bdb9

SHA256
555b8d43c95eebb97d83c8fc655540e672baa064c1125781d76bf143918f684e

SHA512
cdd363b8a572e6a14886773a5ebb6c2e7f4469c12e4092a3c720a40c22b73a14943e9cb3008dbdb5cfd06c2edd72fe6ae66f0215416b623e4442665bfc485948

Download Submit
\Windows\system\nQikjyz.exe

Filesize
1.8MB

MD5
699b6aebe1db79ddd9445fe72a5ffd5a

SHA1
cd262c3e7c4a8eaf917f795502a4e930f972cbda

SHA256
f851ae62d4acc54b47c4a5a9c033bf0f43c56d7f981d143ed9b258c6cc91ae3f

SHA512
08865ecde4dd4c4105886ac3759bd63c8a39488d3120e19800741c80cb54413122bf80d2b4af4e880fbe66b474d6becf4f6037f3cb05ad0701f75a2a87eb8fae

Download Submit
\Windows\system\nSeNYDT.exe

Filesize
1.8MB

MD5
43d13b60b4b22db7ae0082a7624e0049

SHA1
81444227e3ae6a33cb71a79ad961bcc5cf83651a

SHA256
4da168cbc07f9b2b30fc43f5545e502aceaba673e0e29db79c16190fdb610943

SHA512
b9af9af29bcf0eac3300356db461253c7d474050683c70006a9f386e3cd202921219567407e14ecbb8b52ef2b14ee43cc58d84a6dee558f71078d427fab4948c

Download Submit
\Windows\system\pjFaMHu.exe

Filesize
1.8MB

MD5
e67facf82b98d811bd9d778bbd2dc9f1

SHA1
9fa311f657638fb74281a60edc5922159c876b9b

SHA256
02fd5685b452a4c6fa3647bfeb21789a11cfb009b544f96955f4ac1a110e7036

SHA512
61213ea82c85ac2b567c1e63ca7d283d2bc8095b6532c4a899d53adcc4fba0389ae0c7a6d52936dbad48f08b60d32fd42c83ea07fd10d9fc66de59c84df9f6f8

Download Submit
\Windows\system\ppDlOSy.exe

Filesize
1.8MB

MD5
4354459fc382ed77cdf3b832b3302755

SHA1
e6dd531d430a0917eee557112a4f5913456fec20

SHA256
6091d7cfc5e79b99e77f0cb34b0487ee24d1d0a0e3edb632b6602c57849d95d5

SHA512
1eaba442d48c5d171f2849139d6d008e0f96408afa41151278db9c5a6a045cf9d9f31233e7a90d07ec221025051b150a5a65ab29acbeb46e2980d3e5a07b5a9d

Download Submit
\Windows\system\wjSMKjM.exe

Filesize
1.8MB

MD5
6c444676bbf5115e0e666a00c32468ae

SHA1
2592caa9759de88660e086f76e3a344a801a7f4a

SHA256
c4e7c23bc0c167cfeaaac23308887ce74f7262f193ba566ac7301faf553b62d3

SHA512
366d2f43ab277ec9ccf6c565de999a96ff90fce56bf6ae274f8988880eaaa662de2b80c28342800ed86a3724b093422e5c38389d83e06d82d584ebc0967885e1

Download Submit
memory/1540-224-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/1540-216-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-232-0x0000000002FC0000-0x00000000033B2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-231-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-212-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/1540-215-0x0000000002FC0000-0x00000000033B2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-229-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/1540-219-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/1540-227-0x0000000002FC0000-0x00000000033B2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1540-0-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/1540-21-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/1540-222-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-35-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2176-209-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmp

Filesize
9.6MB

Download
memory/2176-211-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/2176-22-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2176-28-0x00000000023C0000-0x00000000023C8000-memory.dmp

Filesize
32KB

Download
memory/2176-230-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/2176-243-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmp

Filesize
9.6MB

Download
memory/2176-210-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/2208-27-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/2488-228-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-214-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2576-217-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-218-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2676-225-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2688-223-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download