xmrig | caee8a238145b44823e7fd57c86c42d526304dfa14d1a357f2c572380c13dd2c

Analysis

max time kernel
32s
max time network
31s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
Size

1.9MB
MD5

09c22c40edd5615bcb33dba3ae904af8
SHA1

ec40d241623acf3b529b126c9f2d33c47adae9f1
SHA256

caee8a238145b44823e7fd57c86c42d526304dfa14d1a357f2c572380c13dd2c
SHA512

fb112189b0f57195fb7afb899a42174726e649618d7cc901e27eaeecd75bb7402465a25a34c49e1d5681f23741a1ff339cc27981ab30ad105320b2dc9d4b8eee
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Uq:NABN

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2872-233-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2576-232-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	xmrig
behavioral1/memory/2832-231-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/2104-227-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2924-223-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2764-213-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/2148-13-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2148	XNxzoNS.exe
2764	QdVCNFB.exe
2924	usBBajq.exe
2104	ZvHcoqp.exe
2832	tHEJgud.exe
2576	DviEsND.exe
2872	gsbpEyi.exe
2548	jDlURWR.exe
2208	AHvIezt.exe
3028	klVPPWH.exe
2624	KcBrTrQ.exe
2744	KOxABOJ.exe
2428	PPEmUMf.exe
2820	dhvXaHU.exe
2588	ltRYbhU.exe
2580	uDpvUDk.exe
2028	qUEsFnn.exe
2860	GegrYje.exe
2336	ARiEOUp.exe
2596	icTcrZX.exe
1748	QnfKyCq.exe
304	zjnIKmS.exe
1768	wPeMHVQ.exe
2884	wShhrRp.exe
2384	NEEJfxp.exe
320	hAPGCGS.exe
1504	PUocMEI.exe
560	ZWRxmEC.exe
2016	XFsnDWS.exe
2344	jfmMSzm.exe
1716	jQxpPpE.exe
1692	cDACLev.exe
1752	ygQgqxC.exe
2140	eZOJoHv.exe
1976	vDuAlus.exe
600	hFPUWSg.exe
1612	EmxHoRk.exe
2504	cBVjqHo.exe
2388	pYdaVqI.exe
1868	HNTNROB.exe
3060	aqEroiR.exe
1556	kyNRMxM.exe
1636	ALXcUeJ.exe
2120	bexzQxh.exe
444	QYEtrgc.exe
2200	lpylCVa.exe
1804	mTXRdXZ.exe
1600	FdvQZGq.exe
1880	cxHDnvu.exe
1276	zmAjybl.exe
848	VKPRxfM.exe
876	ObFTpuZ.exe
1520	avGOHqY.exe
1624	MuONxnT.exe
2268	RELabRd.exe
872	fGEGTGb.exe
2640	WVcJAgF.exe
2672	LQHwEPV.exe
2544	pEQplFY.exe
2196	rBOjbKv.exe
2852	tRQaPYV.exe
2756	tEDcNbb.exe
2876	QBZaVfN.exe
2360	lhjCHtc.exe

Loads dropped DLL 64 IoCs

pid	Process
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2288-2-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/files/0x000b0000000122ee-6.dat	upx
behavioral1/files/0x003700000001451d-15.dat	upx
behavioral1/files/0x0008000000014a29-39.dat	upx
behavioral1/files/0x0008000000015cc2-45.dat	upx
behavioral1/files/0x0006000000015d89-88.dat	upx
behavioral1/files/0x00070000000148af-30.dat	upx
behavioral1/files/0x0006000000016228-125.dat	upx
behavioral1/files/0x000600000001650f-131.dat	upx
behavioral1/files/0x00060000000167e8-142.dat	upx
behavioral1/files/0x0006000000016ccd-172.dat	upx
behavioral1/files/0x0006000000016d01-170.dat	upx
behavioral1/files/0x0006000000015cf5-62.dat	upx
behavioral1/files/0x0006000000015ce1-55.dat	upx
behavioral1/files/0x0006000000015f40-112.dat	upx
behavioral1/files/0x0006000000016a3a-143.dat	upx
behavioral1/files/0x0006000000016cf2-166.dat	upx
behavioral1/files/0x0006000000016ca1-159.dat	upx
behavioral1/memory/2872-233-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2576-232-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	upx
behavioral1/memory/2832-231-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/memory/2104-227-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2924-223-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/2764-213-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/files/0x0006000000016c57-150.dat	upx
behavioral1/files/0x0006000000016591-134.dat	upx
behavioral1/files/0x000600000001640f-128.dat	upx
behavioral1/files/0x0006000000016020-120.dat	upx
behavioral1/files/0x0006000000016126-117.dat	upx
behavioral1/files/0x0006000000015fbb-109.dat	upx
behavioral1/files/0x0006000000015d13-105.dat	upx
behavioral1/files/0x0006000000015cca-99.dat	upx
behavioral1/files/0x0008000000014c0b-97.dat	upx
behavioral1/files/0x0006000000015d99-89.dat	upx
behavioral1/files/0x0006000000016c5b-158.dat	upx
behavioral1/files/0x0006000000016c3a-157.dat	upx
behavioral1/files/0x0006000000015d28-127.dat	upx
behavioral1/files/0x0006000000015d02-76.dat	upx
behavioral1/files/0x0006000000015ced-75.dat	upx
behavioral1/files/0x0006000000015cd8-74.dat	upx
behavioral1/files/0x0006000000015d1e-80.dat	upx
behavioral1/files/0x000700000001475f-38.dat	upx
behavioral1/files/0x000800000001474b-26.dat	upx
behavioral1/files/0x00130000000054a8-22.dat	upx
behavioral1/memory/2148-13-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XFsnDWS.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\LAVRthV.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\NzQoDdq.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\GDPKxwQ.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\AonEfBl.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\jsQRseJ.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\PVlDuiT.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\cxHDnvu.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\JsmbjKq.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\wWSYGwx.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\ZJtxAok.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\qiNMhss.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\KbGYUGS.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\extKgfr.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\hnOIfMM.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\eZOJoHv.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\mVXgSqQ.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\UdHNQNT.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\GpCfqpr.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\KXEhahi.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\CvlDybA.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\pAymzue.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\ZalGONP.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\TDsPqPK.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\tgMUHwv.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\jsdcelj.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\RdLZfho.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\nECAzzR.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\RcBgNzr.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\joThyIO.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\vDuAlus.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\QYEtrgc.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\kyNRMxM.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\pqmTkHU.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\NpECOFJ.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\tHEJgud.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\qizykdg.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\xvYfsHj.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\ZnfQvjE.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\tEDcNbb.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\uxuEmJN.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\sEfKkXb.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\PlNfnVe.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\klVPPWH.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\BfHaonq.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\qbVdFLi.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\HolAWRD.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\aXcXRam.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\GSgWksF.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\pycarml.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\XXkBNar.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\upLAUiU.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\DYLgfYa.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\MWAYsdd.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\vgaMvgZ.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\lAuzVuv.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\icqItIZ.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\TEhkxsn.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\bodylfG.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\rewYNXw.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\RDLhPBP.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\zrAfkTv.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\JRFPwHw.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\YFPUqqD.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1256	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
Token: SeDebugPrivilege	1256	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1256	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	29
PID 2288 wrote to memory of 1256	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	29
PID 2288 wrote to memory of 1256	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	29
PID 2288 wrote to memory of 2148	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	30
PID 2288 wrote to memory of 2148	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	30
PID 2288 wrote to memory of 2148	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	30
PID 2288 wrote to memory of 2764	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	31
PID 2288 wrote to memory of 2764	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	31
PID 2288 wrote to memory of 2764	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	31
PID 2288 wrote to memory of 2924	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	32
PID 2288 wrote to memory of 2924	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	32
PID 2288 wrote to memory of 2924	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	32
PID 2288 wrote to memory of 2104	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	33
PID 2288 wrote to memory of 2104	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	33
PID 2288 wrote to memory of 2104	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	33
PID 2288 wrote to memory of 2832	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	34
PID 2288 wrote to memory of 2832	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	34
PID 2288 wrote to memory of 2832	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	34
PID 2288 wrote to memory of 2872	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	35
PID 2288 wrote to memory of 2872	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	35
PID 2288 wrote to memory of 2872	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	35
PID 2288 wrote to memory of 2576	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	36
PID 2288 wrote to memory of 2576	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	36
PID 2288 wrote to memory of 2576	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	36
PID 2288 wrote to memory of 2820	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	37
PID 2288 wrote to memory of 2820	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	37
PID 2288 wrote to memory of 2820	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	37
PID 2288 wrote to memory of 2548	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	38
PID 2288 wrote to memory of 2548	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	38
PID 2288 wrote to memory of 2548	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	38
PID 2288 wrote to memory of 2588	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	39
PID 2288 wrote to memory of 2588	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	39
PID 2288 wrote to memory of 2588	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	39
PID 2288 wrote to memory of 2208	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	40
PID 2288 wrote to memory of 2208	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	40
PID 2288 wrote to memory of 2208	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	40
PID 2288 wrote to memory of 2580	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	41
PID 2288 wrote to memory of 2580	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	41
PID 2288 wrote to memory of 2580	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	41
PID 2288 wrote to memory of 3028	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	42
PID 2288 wrote to memory of 3028	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	42
PID 2288 wrote to memory of 3028	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	42
PID 2288 wrote to memory of 2028	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	43
PID 2288 wrote to memory of 2028	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	43
PID 2288 wrote to memory of 2028	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	43
PID 2288 wrote to memory of 2624	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	44
PID 2288 wrote to memory of 2624	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	44
PID 2288 wrote to memory of 2624	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	44
PID 2288 wrote to memory of 2860	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	45
PID 2288 wrote to memory of 2860	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	45
PID 2288 wrote to memory of 2860	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	45
PID 2288 wrote to memory of 2744	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	46
PID 2288 wrote to memory of 2744	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	46
PID 2288 wrote to memory of 2744	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	46
PID 2288 wrote to memory of 304	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	47
PID 2288 wrote to memory of 304	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	47
PID 2288 wrote to memory of 304	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	47
PID 2288 wrote to memory of 2428	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	48
PID 2288 wrote to memory of 2428	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	48
PID 2288 wrote to memory of 2428	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	48
PID 2288 wrote to memory of 2016	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	49
PID 2288 wrote to memory of 2016	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	49
PID 2288 wrote to memory of 2016	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	49
PID 2288 wrote to memory of 2336	2288	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1256
- C:\Windows\System\XNxzoNS.exe
  C:\Windows\System\XNxzoNS.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\QdVCNFB.exe
  C:\Windows\System\QdVCNFB.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\usBBajq.exe
  C:\Windows\System\usBBajq.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\ZvHcoqp.exe
  C:\Windows\System\ZvHcoqp.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\tHEJgud.exe
  C:\Windows\System\tHEJgud.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\gsbpEyi.exe
  C:\Windows\System\gsbpEyi.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\DviEsND.exe
  C:\Windows\System\DviEsND.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\dhvXaHU.exe
  C:\Windows\System\dhvXaHU.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\jDlURWR.exe
  C:\Windows\System\jDlURWR.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\ltRYbhU.exe
  C:\Windows\System\ltRYbhU.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\AHvIezt.exe
  C:\Windows\System\AHvIezt.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\uDpvUDk.exe
  C:\Windows\System\uDpvUDk.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\klVPPWH.exe
  C:\Windows\System\klVPPWH.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\qUEsFnn.exe
  C:\Windows\System\qUEsFnn.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\KcBrTrQ.exe
  C:\Windows\System\KcBrTrQ.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\GegrYje.exe
  C:\Windows\System\GegrYje.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\KOxABOJ.exe
  C:\Windows\System\KOxABOJ.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\zjnIKmS.exe
  C:\Windows\System\zjnIKmS.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\PPEmUMf.exe
  C:\Windows\System\PPEmUMf.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\XFsnDWS.exe
  C:\Windows\System\XFsnDWS.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\ARiEOUp.exe
  C:\Windows\System\ARiEOUp.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\jfmMSzm.exe
  C:\Windows\System\jfmMSzm.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\icTcrZX.exe
  C:\Windows\System\icTcrZX.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\jQxpPpE.exe
  C:\Windows\System\jQxpPpE.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\QnfKyCq.exe
  C:\Windows\System\QnfKyCq.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\cDACLev.exe
  C:\Windows\System\cDACLev.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\wPeMHVQ.exe
  C:\Windows\System\wPeMHVQ.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\ygQgqxC.exe
  C:\Windows\System\ygQgqxC.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\wShhrRp.exe
  C:\Windows\System\wShhrRp.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\eZOJoHv.exe
  C:\Windows\System\eZOJoHv.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\NEEJfxp.exe
  C:\Windows\System\NEEJfxp.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\vDuAlus.exe
  C:\Windows\System\vDuAlus.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\hAPGCGS.exe
  C:\Windows\System\hAPGCGS.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\hFPUWSg.exe
  C:\Windows\System\hFPUWSg.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\PUocMEI.exe
  C:\Windows\System\PUocMEI.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\EmxHoRk.exe
  C:\Windows\System\EmxHoRk.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\ZWRxmEC.exe
  C:\Windows\System\ZWRxmEC.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\cBVjqHo.exe
  C:\Windows\System\cBVjqHo.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\pYdaVqI.exe
  C:\Windows\System\pYdaVqI.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\QYEtrgc.exe
  C:\Windows\System\QYEtrgc.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\HNTNROB.exe
  C:\Windows\System\HNTNROB.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\lpylCVa.exe
  C:\Windows\System\lpylCVa.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\aqEroiR.exe
  C:\Windows\System\aqEroiR.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\FdvQZGq.exe
  C:\Windows\System\FdvQZGq.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\kyNRMxM.exe
  C:\Windows\System\kyNRMxM.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\cxHDnvu.exe
  C:\Windows\System\cxHDnvu.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\ALXcUeJ.exe
  C:\Windows\System\ALXcUeJ.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\zmAjybl.exe
  C:\Windows\System\zmAjybl.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\bexzQxh.exe
  C:\Windows\System\bexzQxh.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\VKPRxfM.exe
  C:\Windows\System\VKPRxfM.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\mTXRdXZ.exe
  C:\Windows\System\mTXRdXZ.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\ObFTpuZ.exe
  C:\Windows\System\ObFTpuZ.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\avGOHqY.exe
  C:\Windows\System\avGOHqY.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\MuONxnT.exe
  C:\Windows\System\MuONxnT.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\RELabRd.exe
  C:\Windows\System\RELabRd.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\fGEGTGb.exe
  C:\Windows\System\fGEGTGb.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\WVcJAgF.exe
  C:\Windows\System\WVcJAgF.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\pEQplFY.exe
  C:\Windows\System\pEQplFY.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\LQHwEPV.exe
  C:\Windows\System\LQHwEPV.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\rBOjbKv.exe
  C:\Windows\System\rBOjbKv.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\tRQaPYV.exe
  C:\Windows\System\tRQaPYV.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\tEDcNbb.exe
  C:\Windows\System\tEDcNbb.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\QBZaVfN.exe
  C:\Windows\System\QBZaVfN.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\lhjCHtc.exe
  C:\Windows\System\lhjCHtc.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\ZTjKVNu.exe
  C:\Windows\System\ZTjKVNu.exe
  2⤵
  PID:2944
- C:\Windows\System\wsrpxUZ.exe
  C:\Windows\System\wsrpxUZ.exe
  2⤵
  PID:1996
- C:\Windows\System\KvyNpvB.exe
  C:\Windows\System\KvyNpvB.exe
  2⤵
  PID:1512
- C:\Windows\System\RiRLvYb.exe
  C:\Windows\System\RiRLvYb.exe
  2⤵
  PID:2328
- C:\Windows\System\BfHaonq.exe
  C:\Windows\System\BfHaonq.exe
  2⤵
  PID:2264
- C:\Windows\System\RjNRWbl.exe
  C:\Windows\System\RjNRWbl.exe
  2⤵
  PID:1400
- C:\Windows\System\wNhzXBL.exe
  C:\Windows\System\wNhzXBL.exe
  2⤵
  PID:1856
- C:\Windows\System\LAVRthV.exe
  C:\Windows\System\LAVRthV.exe
  2⤵
  PID:348
- C:\Windows\System\JRFPwHw.exe
  C:\Windows\System\JRFPwHw.exe
  2⤵
  PID:2560
- C:\Windows\System\DpWrILX.exe
  C:\Windows\System\DpWrILX.exe
  2⤵
  PID:2656
- C:\Windows\System\YYLwiuF.exe
  C:\Windows\System\YYLwiuF.exe
  2⤵
  PID:3024
- C:\Windows\System\TGqBWDy.exe
  C:\Windows\System\TGqBWDy.exe
  2⤵
  PID:308
- C:\Windows\System\qizykdg.exe
  C:\Windows\System\qizykdg.exe
  2⤵
  PID:1640
- C:\Windows\System\BiyMgMY.exe
  C:\Windows\System\BiyMgMY.exe
  2⤵
  PID:1088
- C:\Windows\System\BBVwyiY.exe
  C:\Windows\System\BBVwyiY.exe
  2⤵
  PID:992
- C:\Windows\System\uSADXVJ.exe
  C:\Windows\System\uSADXVJ.exe
  2⤵
  PID:576
- C:\Windows\System\uxuEmJN.exe
  C:\Windows\System\uxuEmJN.exe
  2⤵
  PID:1136
- C:\Windows\System\OiQDFjT.exe
  C:\Windows\System\OiQDFjT.exe
  2⤵
  PID:1720
- C:\Windows\System\IomVTxp.exe
  C:\Windows\System\IomVTxp.exe
  2⤵
  PID:2660
- C:\Windows\System\TTfVvPB.exe
  C:\Windows\System\TTfVvPB.exe
  2⤵
  PID:768
- C:\Windows\System\mALgIPj.exe
  C:\Windows\System\mALgIPj.exe
  2⤵
  PID:1356
- C:\Windows\System\FLSVPox.exe
  C:\Windows\System\FLSVPox.exe
  2⤵
  PID:1384
- C:\Windows\System\edHFxGg.exe
  C:\Windows\System\edHFxGg.exe
  2⤵
  PID:2376
- C:\Windows\System\hYSLJdl.exe
  C:\Windows\System\hYSLJdl.exe
  2⤵
  PID:2932
- C:\Windows\System\BcbIyEa.exe
  C:\Windows\System\BcbIyEa.exe
  2⤵
  PID:2992
- C:\Windows\System\iIpbgkr.exe
  C:\Windows\System\iIpbgkr.exe
  2⤵
  PID:3012
- C:\Windows\System\wxjZkAG.exe
  C:\Windows\System\wxjZkAG.exe
  2⤵
  PID:2160
- C:\Windows\System\XhfBwat.exe
  C:\Windows\System\XhfBwat.exe
  2⤵
  PID:2436
- C:\Windows\System\tubUbCW.exe
  C:\Windows\System\tubUbCW.exe
  2⤵
  PID:1544
- C:\Windows\System\QmVjixZ.exe
  C:\Windows\System\QmVjixZ.exe
  2⤵
  PID:2928
- C:\Windows\System\ViEMJst.exe
  C:\Windows\System\ViEMJst.exe
  2⤵
  PID:2152
- C:\Windows\System\IxpPapj.exe
  C:\Windows\System\IxpPapj.exe
  2⤵
  PID:2564
- C:\Windows\System\mCxXTbA.exe
  C:\Windows\System\mCxXTbA.exe
  2⤵
  PID:1680
- C:\Windows\System\dqGFLsS.exe
  C:\Windows\System\dqGFLsS.exe
  2⤵
  PID:2868
- C:\Windows\System\DFyefEu.exe
  C:\Windows\System\DFyefEu.exe
  2⤵
  PID:1648
- C:\Windows\System\bCkPHSg.exe
  C:\Windows\System\bCkPHSg.exe
  2⤵
  PID:1272
- C:\Windows\System\iaHGgDB.exe
  C:\Windows\System\iaHGgDB.exe
  2⤵
  PID:1800
- C:\Windows\System\upLAUiU.exe
  C:\Windows\System\upLAUiU.exe
  2⤵
  PID:2996
- C:\Windows\System\mVXgSqQ.exe
  C:\Windows\System\mVXgSqQ.exe
  2⤵
  PID:1540
- C:\Windows\System\ymTSzVQ.exe
  C:\Windows\System\ymTSzVQ.exe
  2⤵
  PID:1048
- C:\Windows\System\FqCYKAD.exe
  C:\Windows\System\FqCYKAD.exe
  2⤵
  PID:2740
- C:\Windows\System\dtSpNkV.exe
  C:\Windows\System\dtSpNkV.exe
  2⤵
  PID:2532
- C:\Windows\System\TDsPqPK.exe
  C:\Windows\System\TDsPqPK.exe
  2⤵
  PID:2776
- C:\Windows\System\imjmNOs.exe
  C:\Windows\System\imjmNOs.exe
  2⤵
  PID:900
- C:\Windows\System\mIEzlzQ.exe
  C:\Windows\System\mIEzlzQ.exe
  2⤵
  PID:1268
- C:\Windows\System\vqduoNC.exe
  C:\Windows\System\vqduoNC.exe
  2⤵
  PID:1528
- C:\Windows\System\xhcrvDE.exe
  C:\Windows\System\xhcrvDE.exe
  2⤵
  PID:1084
- C:\Windows\System\sFAHcCF.exe
  C:\Windows\System\sFAHcCF.exe
  2⤵
  PID:2780
- C:\Windows\System\xKfVnHK.exe
  C:\Windows\System\xKfVnHK.exe
  2⤵
  PID:2960
- C:\Windows\System\LHyHFQH.exe
  C:\Windows\System\LHyHFQH.exe
  2⤵
  PID:1744
- C:\Windows\System\SmvGxzW.exe
  C:\Windows\System\SmvGxzW.exe
  2⤵
  PID:2584
- C:\Windows\System\wSJbEdD.exe
  C:\Windows\System\wSJbEdD.exe
  2⤵
  PID:1332
- C:\Windows\System\ZGEzcGa.exe
  C:\Windows\System\ZGEzcGa.exe
  2⤵
  PID:344
- C:\Windows\System\xPfshyA.exe
  C:\Windows\System\xPfshyA.exe
  2⤵
  PID:2036
- C:\Windows\System\JsmbjKq.exe
  C:\Windows\System\JsmbjKq.exe
  2⤵
  PID:1928
- C:\Windows\System\YMjvWVv.exe
  C:\Windows\System\YMjvWVv.exe
  2⤵
  PID:588
- C:\Windows\System\YJYLNKc.exe
  C:\Windows\System\YJYLNKc.exe
  2⤵
  PID:1560
- C:\Windows\System\ACRmQEV.exe
  C:\Windows\System\ACRmQEV.exe
  2⤵
  PID:2276
- C:\Windows\System\MKcCnHP.exe
  C:\Windows\System\MKcCnHP.exe
  2⤵
  PID:2804
- C:\Windows\System\AKPsjXG.exe
  C:\Windows\System\AKPsjXG.exe
  2⤵
  PID:1444
- C:\Windows\System\eUfAjUl.exe
  C:\Windows\System\eUfAjUl.exe
  2⤵
  PID:2936
- C:\Windows\System\nQxOtmM.exe
  C:\Windows\System\nQxOtmM.exe
  2⤵
  PID:2088
- C:\Windows\System\LwJqGIU.exe
  C:\Windows\System\LwJqGIU.exe
  2⤵
  PID:936
- C:\Windows\System\orFdLOw.exe
  C:\Windows\System\orFdLOw.exe
  2⤵
  PID:1292
- C:\Windows\System\wWSYGwx.exe
  C:\Windows\System\wWSYGwx.exe
  2⤵
  PID:2964
- C:\Windows\System\nDwheej.exe
  C:\Windows\System\nDwheej.exe
  2⤵
  PID:1892
- C:\Windows\System\xbdGkvm.exe
  C:\Windows\System\xbdGkvm.exe
  2⤵
  PID:844
- C:\Windows\System\uSYQErw.exe
  C:\Windows\System\uSYQErw.exe
  2⤵
  PID:1204
- C:\Windows\System\cnBAMrK.exe
  C:\Windows\System\cnBAMrK.exe
  2⤵
  PID:1152
- C:\Windows\System\tgMUHwv.exe
  C:\Windows\System\tgMUHwv.exe
  2⤵
  PID:1864
- C:\Windows\System\NpSIZAO.exe
  C:\Windows\System\NpSIZAO.exe
  2⤵
  PID:1820
- C:\Windows\System\BxyANwT.exe
  C:\Windows\System\BxyANwT.exe
  2⤵
  PID:2908
- C:\Windows\System\YBnOvcf.exe
  C:\Windows\System\YBnOvcf.exe
  2⤵
  PID:1652
- C:\Windows\System\oORntHc.exe
  C:\Windows\System\oORntHc.exe
  2⤵
  PID:2808
- C:\Windows\System\DYLgfYa.exe
  C:\Windows\System\DYLgfYa.exe
  2⤵
  PID:1780
- C:\Windows\System\eWuvMnU.exe
  C:\Windows\System\eWuvMnU.exe
  2⤵
  PID:1920
- C:\Windows\System\gakXZuj.exe
  C:\Windows\System\gakXZuj.exe
  2⤵
  PID:1708
- C:\Windows\System\ELfqeuU.exe
  C:\Windows\System\ELfqeuU.exe
  2⤵
  PID:2408
- C:\Windows\System\AonEfBl.exe
  C:\Windows\System\AonEfBl.exe
  2⤵
  PID:3084
- C:\Windows\System\VtgbPBm.exe
  C:\Windows\System\VtgbPBm.exe
  2⤵
  PID:3100
- C:\Windows\System\MaNMZts.exe
  C:\Windows\System\MaNMZts.exe
  2⤵
  PID:3116
- C:\Windows\System\sRFQFbx.exe
  C:\Windows\System\sRFQFbx.exe
  2⤵
  PID:3132
- C:\Windows\System\MWAYsdd.exe
  C:\Windows\System\MWAYsdd.exe
  2⤵
  PID:3148
- C:\Windows\System\BLwOxcZ.exe
  C:\Windows\System\BLwOxcZ.exe
  2⤵
  PID:3200
- C:\Windows\System\vbMFGkx.exe
  C:\Windows\System\vbMFGkx.exe
  2⤵
  PID:3220
- C:\Windows\System\IyZmbBj.exe
  C:\Windows\System\IyZmbBj.exe
  2⤵
  PID:3252
- C:\Windows\System\moEGnOI.exe
  C:\Windows\System\moEGnOI.exe
  2⤵
  PID:3272
- C:\Windows\System\UQQSgHs.exe
  C:\Windows\System\UQQSgHs.exe
  2⤵
  PID:3292
- C:\Windows\System\rWmlobl.exe
  C:\Windows\System\rWmlobl.exe
  2⤵
  PID:3312
- C:\Windows\System\jWiEBcZ.exe
  C:\Windows\System\jWiEBcZ.exe
  2⤵
  PID:3332
- C:\Windows\System\GjMrxhN.exe
  C:\Windows\System\GjMrxhN.exe
  2⤵
  PID:3352
- C:\Windows\System\wUOFZvT.exe
  C:\Windows\System\wUOFZvT.exe
  2⤵
  PID:3372
- C:\Windows\System\dqoNXie.exe
  C:\Windows\System\dqoNXie.exe
  2⤵
  PID:3392
- C:\Windows\System\fZOxYwO.exe
  C:\Windows\System\fZOxYwO.exe
  2⤵
  PID:3408
- C:\Windows\System\TfkOZUt.exe
  C:\Windows\System\TfkOZUt.exe
  2⤵
  PID:3428
- C:\Windows\System\xvYfsHj.exe
  C:\Windows\System\xvYfsHj.exe
  2⤵
  PID:3452
- C:\Windows\System\fbOSSBe.exe
  C:\Windows\System\fbOSSBe.exe
  2⤵
  PID:3472
- C:\Windows\System\rexUYlT.exe
  C:\Windows\System\rexUYlT.exe
  2⤵
  PID:3488
- C:\Windows\System\JDsarmi.exe
  C:\Windows\System\JDsarmi.exe
  2⤵
  PID:3504
- C:\Windows\System\uPsenrj.exe
  C:\Windows\System\uPsenrj.exe
  2⤵
  PID:3524
- C:\Windows\System\COdhywh.exe
  C:\Windows\System\COdhywh.exe
  2⤵
  PID:3544
- C:\Windows\System\KHnNYRl.exe
  C:\Windows\System\KHnNYRl.exe
  2⤵
  PID:3572
- C:\Windows\System\UdHNQNT.exe
  C:\Windows\System\UdHNQNT.exe
  2⤵
  PID:3588
- C:\Windows\System\vgaMvgZ.exe
  C:\Windows\System\vgaMvgZ.exe
  2⤵
  PID:3604
- C:\Windows\System\IRXGmNu.exe
  C:\Windows\System\IRXGmNu.exe
  2⤵
  PID:3620
- C:\Windows\System\XShWEFb.exe
  C:\Windows\System\XShWEFb.exe
  2⤵
  PID:3636
- C:\Windows\System\LMUwSFd.exe
  C:\Windows\System\LMUwSFd.exe
  2⤵
  PID:3652
- C:\Windows\System\JqSvjed.exe
  C:\Windows\System\JqSvjed.exe
  2⤵
  PID:3668
- C:\Windows\System\njPGbnW.exe
  C:\Windows\System\njPGbnW.exe
  2⤵
  PID:3684
- C:\Windows\System\UFAonLW.exe
  C:\Windows\System\UFAonLW.exe
  2⤵
  PID:3728
- C:\Windows\System\ShmAkZm.exe
  C:\Windows\System\ShmAkZm.exe
  2⤵
  PID:3744
- C:\Windows\System\AFgsyXn.exe
  C:\Windows\System\AFgsyXn.exe
  2⤵
  PID:3772
- C:\Windows\System\ZtfeagQ.exe
  C:\Windows\System\ZtfeagQ.exe
  2⤵
  PID:3788
- C:\Windows\System\cIxyVqI.exe
  C:\Windows\System\cIxyVqI.exe
  2⤵
  PID:3804
- C:\Windows\System\hiCUaCF.exe
  C:\Windows\System\hiCUaCF.exe
  2⤵
  PID:3832
- C:\Windows\System\czvlxMI.exe
  C:\Windows\System\czvlxMI.exe
  2⤵
  PID:3848
- C:\Windows\System\LRkhgkS.exe
  C:\Windows\System\LRkhgkS.exe
  2⤵
  PID:3864
- C:\Windows\System\CrGTchc.exe
  C:\Windows\System\CrGTchc.exe
  2⤵
  PID:3880
- C:\Windows\System\ieCrZzW.exe
  C:\Windows\System\ieCrZzW.exe
  2⤵
  PID:3900
- C:\Windows\System\XePppzp.exe
  C:\Windows\System\XePppzp.exe
  2⤵
  PID:3916
- C:\Windows\System\qvtgEFj.exe
  C:\Windows\System\qvtgEFj.exe
  2⤵
  PID:3932
- C:\Windows\System\ColUQtw.exe
  C:\Windows\System\ColUQtw.exe
  2⤵
  PID:3948
- C:\Windows\System\jsdcelj.exe
  C:\Windows\System\jsdcelj.exe
  2⤵
  PID:3964
- C:\Windows\System\SkRoRwY.exe
  C:\Windows\System\SkRoRwY.exe
  2⤵
  PID:3980
- C:\Windows\System\pqmTkHU.exe
  C:\Windows\System\pqmTkHU.exe
  2⤵
  PID:3996
- C:\Windows\System\PGNDAJB.exe
  C:\Windows\System\PGNDAJB.exe
  2⤵
  PID:4012
- C:\Windows\System\LCuueyq.exe
  C:\Windows\System\LCuueyq.exe
  2⤵
  PID:4032
- C:\Windows\System\iqAOPJh.exe
  C:\Windows\System\iqAOPJh.exe
  2⤵
  PID:4048
- C:\Windows\System\fsTRlEV.exe
  C:\Windows\System\fsTRlEV.exe
  2⤵
  PID:4064
- C:\Windows\System\tdRubli.exe
  C:\Windows\System\tdRubli.exe
  2⤵
  PID:4080
- C:\Windows\System\nqJRboJ.exe
  C:\Windows\System\nqJRboJ.exe
  2⤵
  PID:2224
- C:\Windows\System\TFZAcuJ.exe
  C:\Windows\System\TFZAcuJ.exe
  2⤵
  PID:2424
- C:\Windows\System\tHHLpdH.exe
  C:\Windows\System\tHHLpdH.exe
  2⤵
  PID:2616
- C:\Windows\System\LrkajZR.exe
  C:\Windows\System\LrkajZR.exe
  2⤵
  PID:2844
- C:\Windows\System\bYxVdIp.exe
  C:\Windows\System\bYxVdIp.exe
  2⤵
  PID:1904
- C:\Windows\System\YFPUqqD.exe
  C:\Windows\System\YFPUqqD.exe
  2⤵
  PID:2352
- C:\Windows\System\nTqMICx.exe
  C:\Windows\System\nTqMICx.exe
  2⤵
  PID:3128
- C:\Windows\System\QStEuuO.exe
  C:\Windows\System\QStEuuO.exe
  2⤵
  PID:2368
- C:\Windows\System\YxvyJIO.exe
  C:\Windows\System\YxvyJIO.exe
  2⤵
  PID:3176
- C:\Windows\System\pBrXjjB.exe
  C:\Windows\System\pBrXjjB.exe
  2⤵
  PID:3192
- C:\Windows\System\QPpAjxs.exe
  C:\Windows\System\QPpAjxs.exe
  2⤵
  PID:3228
- C:\Windows\System\VppUjgs.exe
  C:\Windows\System\VppUjgs.exe
  2⤵
  PID:2732
- C:\Windows\System\YZucstQ.exe
  C:\Windows\System\YZucstQ.exe
  2⤵
  PID:2108
- C:\Windows\System\mQrdkss.exe
  C:\Windows\System\mQrdkss.exe
  2⤵
  PID:3112
- C:\Windows\System\xixbOpg.exe
  C:\Windows\System\xixbOpg.exe
  2⤵
  PID:3216
- C:\Windows\System\UkSudho.exe
  C:\Windows\System\UkSudho.exe
  2⤵
  PID:3284
- C:\Windows\System\qbVdFLi.exe
  C:\Windows\System\qbVdFLi.exe
  2⤵
  PID:3320
- C:\Windows\System\GpCfqpr.exe
  C:\Windows\System\GpCfqpr.exe
  2⤵
  PID:3304
- C:\Windows\System\GThsFrW.exe
  C:\Windows\System\GThsFrW.exe
  2⤵
  PID:2720
- C:\Windows\System\kWsGVCZ.exe
  C:\Windows\System\kWsGVCZ.exe
  2⤵
  PID:3348
- C:\Windows\System\PtTJjnU.exe
  C:\Windows\System\PtTJjnU.exe
  2⤵
  PID:2004
- C:\Windows\System\DsxfAwN.exe
  C:\Windows\System\DsxfAwN.exe
  2⤵
  PID:3416
- C:\Windows\System\WjGSBxw.exe
  C:\Windows\System\WjGSBxw.exe
  2⤵
  PID:3436
- C:\Windows\System\enevXaF.exe
  C:\Windows\System\enevXaF.exe
  2⤵
  PID:3424
- C:\Windows\System\nZRePAS.exe
  C:\Windows\System\nZRePAS.exe
  2⤵
  PID:3484
- C:\Windows\System\SlkYYEx.exe
  C:\Windows\System\SlkYYEx.exe
  2⤵
  PID:3496
- C:\Windows\System\EHpPAcn.exe
  C:\Windows\System\EHpPAcn.exe
  2⤵
  PID:3520
- C:\Windows\System\CGEVMHT.exe
  C:\Windows\System\CGEVMHT.exe
  2⤵
  PID:3556
- C:\Windows\System\ZdLnIrd.exe
  C:\Windows\System\ZdLnIrd.exe
  2⤵
  PID:3568
- C:\Windows\System\YmqXzzF.exe
  C:\Windows\System\YmqXzzF.exe
  2⤵
  PID:3600
- C:\Windows\System\dSgJpTj.exe
  C:\Windows\System\dSgJpTj.exe
  2⤵
  PID:3616
- C:\Windows\System\gDbIVzl.exe
  C:\Windows\System\gDbIVzl.exe
  2⤵
  PID:3632
- C:\Windows\System\aRJfTjc.exe
  C:\Windows\System\aRJfTjc.exe
  2⤵
  PID:3700
- C:\Windows\System\GHmcPMh.exe
  C:\Windows\System\GHmcPMh.exe
  2⤵
  PID:3716
- C:\Windows\System\RSbYhXb.exe
  C:\Windows\System\RSbYhXb.exe
  2⤵
  PID:2632
- C:\Windows\System\dfQYzUp.exe
  C:\Windows\System\dfQYzUp.exe
  2⤵
  PID:3648
- C:\Windows\System\KXEhahi.exe
  C:\Windows\System\KXEhahi.exe
  2⤵
  PID:2000
- C:\Windows\System\WKByYUM.exe
  C:\Windows\System\WKByYUM.exe
  2⤵
  PID:3760
- C:\Windows\System\EThPIjn.exe
  C:\Windows\System\EThPIjn.exe
  2⤵
  PID:3764
- C:\Windows\System\kfArUpm.exe
  C:\Windows\System\kfArUpm.exe
  2⤵
  PID:3812
- C:\Windows\System\uVEediB.exe
  C:\Windows\System\uVEediB.exe
  2⤵
  PID:2524
- C:\Windows\System\YEBnkzm.exe
  C:\Windows\System\YEBnkzm.exe
  2⤵
  PID:2248
- C:\Windows\System\KJyuplZ.exe
  C:\Windows\System\KJyuplZ.exe
  2⤵
  PID:3816
- C:\Windows\System\ILZhxVG.exe
  C:\Windows\System\ILZhxVG.exe
  2⤵
  PID:3856
- C:\Windows\System\wQOlnuA.exe
  C:\Windows\System\wQOlnuA.exe
  2⤵
  PID:3924
- C:\Windows\System\TgnCsTO.exe
  C:\Windows\System\TgnCsTO.exe
  2⤵
  PID:3960
- C:\Windows\System\BZkHmiZ.exe
  C:\Windows\System\BZkHmiZ.exe
  2⤵
  PID:4024
- C:\Windows\System\HZnCeIK.exe
  C:\Windows\System\HZnCeIK.exe
  2⤵
  PID:3840
- C:\Windows\System\HKJjvfJ.exe
  C:\Windows\System\HKJjvfJ.exe
  2⤵
  PID:1796
- C:\Windows\System\AGKHGPs.exe
  C:\Windows\System\AGKHGPs.exe
  2⤵
  PID:1296
- C:\Windows\System\HolAWRD.exe
  C:\Windows\System\HolAWRD.exe
  2⤵
  PID:2688
- C:\Windows\System\MYDwZdM.exe
  C:\Windows\System\MYDwZdM.exe
  2⤵
  PID:4108
- C:\Windows\System\LuAKToi.exe
  C:\Windows\System\LuAKToi.exe
  2⤵
  PID:4124
- C:\Windows\System\ttRklqI.exe
  C:\Windows\System\ttRklqI.exe
  2⤵
  PID:4140
- C:\Windows\System\FPosOHO.exe
  C:\Windows\System\FPosOHO.exe
  2⤵
  PID:4156
- C:\Windows\System\nllXYEs.exe
  C:\Windows\System\nllXYEs.exe
  2⤵
  PID:4172
- C:\Windows\System\hWxHuhp.exe
  C:\Windows\System\hWxHuhp.exe
  2⤵
  PID:4192
- C:\Windows\System\sIZLqNu.exe
  C:\Windows\System\sIZLqNu.exe
  2⤵
  PID:4208
- C:\Windows\System\jhBgdIP.exe
  C:\Windows\System\jhBgdIP.exe
  2⤵
  PID:4224
- C:\Windows\System\qiKLFYC.exe
  C:\Windows\System\qiKLFYC.exe
  2⤵
  PID:4240
- C:\Windows\System\LlilsEr.exe
  C:\Windows\System\LlilsEr.exe
  2⤵
  PID:4256
- C:\Windows\System\ekSzkRo.exe
  C:\Windows\System\ekSzkRo.exe
  2⤵
  PID:4276
- C:\Windows\System\IEqCKEg.exe
  C:\Windows\System\IEqCKEg.exe
  2⤵
  PID:4296
- C:\Windows\System\BZVNVnv.exe
  C:\Windows\System\BZVNVnv.exe
  2⤵
  PID:4312
- C:\Windows\System\LqkMEHS.exe
  C:\Windows\System\LqkMEHS.exe
  2⤵
  PID:4328
- C:\Windows\System\CuEYPFp.exe
  C:\Windows\System\CuEYPFp.exe
  2⤵
  PID:4344
- C:\Windows\System\NzQoDdq.exe
  C:\Windows\System\NzQoDdq.exe
  2⤵
  PID:4360
- C:\Windows\System\lAuzVuv.exe
  C:\Windows\System\lAuzVuv.exe
  2⤵
  PID:4376
- C:\Windows\System\ZJtxAok.exe
  C:\Windows\System\ZJtxAok.exe
  2⤵
  PID:4392
- C:\Windows\System\jlEibaV.exe
  C:\Windows\System\jlEibaV.exe
  2⤵
  PID:4408
- C:\Windows\System\LcPFnYa.exe
  C:\Windows\System\LcPFnYa.exe
  2⤵
  PID:4424
- C:\Windows\System\aXcXRam.exe
  C:\Windows\System\aXcXRam.exe
  2⤵
  PID:4440
- C:\Windows\System\cqCRTBz.exe
  C:\Windows\System\cqCRTBz.exe
  2⤵
  PID:4456
- C:\Windows\System\wGdXuQB.exe
  C:\Windows\System\wGdXuQB.exe
  2⤵
  PID:4476
- C:\Windows\System\qTibxHO.exe
  C:\Windows\System\qTibxHO.exe
  2⤵
  PID:4492
- C:\Windows\System\aWMJiOk.exe
  C:\Windows\System\aWMJiOk.exe
  2⤵
  PID:4508
- C:\Windows\System\YYOOPtA.exe
  C:\Windows\System\YYOOPtA.exe
  2⤵
  PID:4524
- C:\Windows\System\icqItIZ.exe
  C:\Windows\System\icqItIZ.exe
  2⤵
  PID:4540
- C:\Windows\System\QHQZOZi.exe
  C:\Windows\System\QHQZOZi.exe
  2⤵
  PID:4556
- C:\Windows\System\vjCYmlS.exe
  C:\Windows\System\vjCYmlS.exe
  2⤵
  PID:4572
- C:\Windows\System\jNuqivR.exe
  C:\Windows\System\jNuqivR.exe
  2⤵
  PID:4592
- C:\Windows\System\ZaGONmi.exe
  C:\Windows\System\ZaGONmi.exe
  2⤵
  PID:4608
- C:\Windows\System\TyJElZQ.exe
  C:\Windows\System\TyJElZQ.exe
  2⤵
  PID:4772
- C:\Windows\System\IZaFqMv.exe
  C:\Windows\System\IZaFqMv.exe
  2⤵
  PID:4796
- C:\Windows\System\JlcMhYg.exe
  C:\Windows\System\JlcMhYg.exe
  2⤵
  PID:4984
- C:\Windows\System\cglFUqz.exe
  C:\Windows\System\cglFUqz.exe
  2⤵
  PID:5000
- C:\Windows\System\FyXaggO.exe
  C:\Windows\System\FyXaggO.exe
  2⤵
  PID:5020
- C:\Windows\System\gxaSCua.exe
  C:\Windows\System\gxaSCua.exe
  2⤵
  PID:5052
- C:\Windows\System\CPFOxNM.exe
  C:\Windows\System\CPFOxNM.exe
  2⤵
  PID:5068
- C:\Windows\System\pVrPyei.exe
  C:\Windows\System\pVrPyei.exe
  2⤵
  PID:5084
- C:\Windows\System\RkuuWEF.exe
  C:\Windows\System\RkuuWEF.exe
  2⤵
  PID:5108
- C:\Windows\System\blEtzur.exe
  C:\Windows\System\blEtzur.exe
  2⤵
  PID:2736
- C:\Windows\System\DSbXOTp.exe
  C:\Windows\System\DSbXOTp.exe
  2⤵
  PID:3340
- C:\Windows\System\NpECOFJ.exe
  C:\Windows\System\NpECOFJ.exe
  2⤵
  PID:3388
- C:\Windows\System\LDXLJtr.exe
  C:\Windows\System\LDXLJtr.exe
  2⤵
  PID:3516
- C:\Windows\System\ftBBkEw.exe
  C:\Windows\System\ftBBkEw.exe
  2⤵
  PID:3876
- C:\Windows\System\dfKBbZn.exe
  C:\Windows\System\dfKBbZn.exe
  2⤵
  PID:4008
- C:\Windows\System\mFJxxhI.exe
  C:\Windows\System\mFJxxhI.exe
  2⤵
  PID:2520
- C:\Windows\System\mnollwP.exe
  C:\Windows\System\mnollwP.exe
  2⤵
  PID:1992
- C:\Windows\System\ydvDEHU.exe
  C:\Windows\System\ydvDEHU.exe
  2⤵
  PID:3184
- C:\Windows\System\lfPRehR.exe
  C:\Windows\System\lfPRehR.exe
  2⤵
  PID:3248
- C:\Windows\System\EtcOCXU.exe
  C:\Windows\System\EtcOCXU.exe
  2⤵
  PID:3664
- C:\Windows\System\xapotZN.exe
  C:\Windows\System\xapotZN.exe
  2⤵
  PID:3680
- C:\Windows\System\PQbiRXm.exe
  C:\Windows\System\PQbiRXm.exe
  2⤵
  PID:2500
- C:\Windows\System\viTuudj.exe
  C:\Windows\System\viTuudj.exe
  2⤵
  PID:3888
- C:\Windows\System\sEfKkXb.exe
  C:\Windows\System\sEfKkXb.exe
  2⤵
  PID:4020
- C:\Windows\System\QMoTXKe.exe
  C:\Windows\System\QMoTXKe.exe
  2⤵
  PID:3644
- C:\Windows\System\lvTmZDB.exe
  C:\Windows\System\lvTmZDB.exe
  2⤵
  PID:4180
- C:\Windows\System\zoDmaMl.exe
  C:\Windows\System\zoDmaMl.exe
  2⤵
  PID:4116
- C:\Windows\System\cohmEEv.exe
  C:\Windows\System\cohmEEv.exe
  2⤵
  PID:4216
- C:\Windows\System\qMvveoR.exe
  C:\Windows\System\qMvveoR.exe
  2⤵
  PID:4252
- C:\Windows\System\qGCMjzO.exe
  C:\Windows\System\qGCMjzO.exe
  2⤵
  PID:4324
- C:\Windows\System\LCUXZye.exe
  C:\Windows\System\LCUXZye.exe
  2⤵
  PID:4168
- C:\Windows\System\NkngsWI.exe
  C:\Windows\System\NkngsWI.exe
  2⤵
  PID:4356
- C:\Windows\System\qsNwsDu.exe
  C:\Windows\System\qsNwsDu.exe
  2⤵
  PID:2608
- C:\Windows\System\TEhkxsn.exe
  C:\Windows\System\TEhkxsn.exe
  2⤵
  PID:3280
- C:\Windows\System\VwzcKle.exe
  C:\Windows\System\VwzcKle.exe
  2⤵
  PID:1792
- C:\Windows\System\pDgByEJ.exe
  C:\Windows\System\pDgByEJ.exe
  2⤵
  PID:3444
- C:\Windows\System\lRMLmGk.exe
  C:\Windows\System\lRMLmGk.exe
  2⤵
  PID:3384
- C:\Windows\System\aPpAAxS.exe
  C:\Windows\System\aPpAAxS.exe
  2⤵
  PID:2840
- C:\Windows\System\KsFMzYg.exe
  C:\Windows\System\KsFMzYg.exe
  2⤵
  PID:2896
- C:\Windows\System\rbDRJaz.exe
  C:\Windows\System\rbDRJaz.exe
  2⤵
  PID:3752
- C:\Windows\System\XrPxnnt.exe
  C:\Windows\System\XrPxnnt.exe
  2⤵
  PID:3780
- C:\Windows\System\bodylfG.exe
  C:\Windows\System\bodylfG.exe
  2⤵
  PID:868
- C:\Windows\System\Effzpxp.exe
  C:\Windows\System\Effzpxp.exe
  2⤵
  PID:4536
- C:\Windows\System\RLfaNtI.exe
  C:\Windows\System\RLfaNtI.exe
  2⤵
  PID:4264
- C:\Windows\System\YKrhKcC.exe
  C:\Windows\System\YKrhKcC.exe
  2⤵
  PID:4308
- C:\Windows\System\AEhhIiZ.exe
  C:\Windows\System\AEhhIiZ.exe
  2⤵
  PID:4368
- C:\Windows\System\iezJRFY.exe
  C:\Windows\System\iezJRFY.exe
  2⤵
  PID:3008
- C:\Windows\System\cZojRYB.exe
  C:\Windows\System\cZojRYB.exe
  2⤵
  PID:4532
- C:\Windows\System\gkltBPe.exe
  C:\Windows\System\gkltBPe.exe
  2⤵
  PID:4472
- C:\Windows\System\kLKPxMc.exe
  C:\Windows\System\kLKPxMc.exe
  2⤵
  PID:4404
- C:\Windows\System\ZoHwVUT.exe
  C:\Windows\System\ZoHwVUT.exe
  2⤵
  PID:4448
- C:\Windows\System\gJwAJww.exe
  C:\Windows\System\gJwAJww.exe
  2⤵
  PID:4516
- C:\Windows\System\QWyhmlr.exe
  C:\Windows\System\QWyhmlr.exe
  2⤵
  PID:4580
- C:\Windows\System\jUGWEND.exe
  C:\Windows\System\jUGWEND.exe
  2⤵
  PID:4620
- C:\Windows\System\iYZJShR.exe
  C:\Windows\System\iYZJShR.exe
  2⤵
  PID:4636
- C:\Windows\System\kNeGTIe.exe
  C:\Windows\System\kNeGTIe.exe
  2⤵
  PID:4652
- C:\Windows\System\YAOzEiG.exe
  C:\Windows\System\YAOzEiG.exe
  2⤵
  PID:4668
- C:\Windows\System\fhJVEMD.exe
  C:\Windows\System\fhJVEMD.exe
  2⤵
  PID:4712
- C:\Windows\System\tuZYosX.exe
  C:\Windows\System\tuZYosX.exe
  2⤵
  PID:4696
- C:\Windows\System\JcRgWXi.exe
  C:\Windows\System\JcRgWXi.exe
  2⤵
  PID:4680
- C:\Windows\System\jLrDFxN.exe
  C:\Windows\System\jLrDFxN.exe
  2⤵
  PID:4384
- C:\Windows\System\EKWAIMA.exe
  C:\Windows\System\EKWAIMA.exe
  2⤵
  PID:4756
- C:\Windows\System\HbbZkVd.exe
  C:\Windows\System\HbbZkVd.exe
  2⤵
  PID:4876
- C:\Windows\System\QZAUbbc.exe
  C:\Windows\System\QZAUbbc.exe
  2⤵
  PID:4956
- C:\Windows\System\oZFERkI.exe
  C:\Windows\System\oZFERkI.exe
  2⤵
  PID:5064
- C:\Windows\System\VadvFZI.exe
  C:\Windows\System\VadvFZI.exe
  2⤵
  PID:5104
- C:\Windows\System\vmGiiVr.exe
  C:\Windows\System\vmGiiVr.exe
  2⤵
  PID:3264
- C:\Windows\System\AptMNXO.exe
  C:\Windows\System\AptMNXO.exe
  2⤵
  PID:3512
- C:\Windows\System\tveRijY.exe
  C:\Windows\System\tveRijY.exe
  2⤵
  PID:3976
- C:\Windows\System\pbGnZAp.exe
  C:\Windows\System\pbGnZAp.exe
  2⤵
  PID:2236
- C:\Windows\System\ptZjAtE.exe
  C:\Windows\System\ptZjAtE.exe
  2⤵
  PID:4072
- C:\Windows\System\grvAvPU.exe
  C:\Windows\System\grvAvPU.exe
  2⤵
  PID:2788
- C:\Windows\System\RgSqsSF.exe
  C:\Windows\System\RgSqsSF.exe
  2⤵
  PID:3720
- C:\Windows\System\PnuTQlv.exe
  C:\Windows\System\PnuTQlv.exe
  2⤵
  PID:4092
- C:\Windows\System\SdlnWDI.exe
  C:\Windows\System\SdlnWDI.exe
  2⤵
  PID:2024
- C:\Windows\System\STplCNC.exe
  C:\Windows\System\STplCNC.exe
  2⤵
  PID:3756
- C:\Windows\System\rewYNXw.exe
  C:\Windows\System\rewYNXw.exe
  2⤵
  PID:4164
- C:\Windows\System\ZuvbKzi.exe
  C:\Windows\System\ZuvbKzi.exe
  2⤵
  PID:4292
- C:\Windows\System\YtCspmo.exe
  C:\Windows\System\YtCspmo.exe
  2⤵
  PID:3080
- C:\Windows\System\oaGliKW.exe
  C:\Windows\System\oaGliKW.exe
  2⤵
  PID:4100
- C:\Windows\System\CvlDybA.exe
  C:\Windows\System\CvlDybA.exe
  2⤵
  PID:4604
- C:\Windows\System\LirlEPX.exe
  C:\Windows\System\LirlEPX.exe
  2⤵
  PID:2968
- C:\Windows\System\kooHdxb.exe
  C:\Windows\System\kooHdxb.exe
  2⤵
  PID:4588
- C:\Windows\System\gzCgcxm.exe
  C:\Windows\System\gzCgcxm.exe
  2⤵
  PID:4632
- C:\Windows\System\VIvIlWG.exe
  C:\Windows\System\VIvIlWG.exe
  2⤵
  PID:4664
- C:\Windows\System\NRKCmqt.exe
  C:\Windows\System\NRKCmqt.exe
  2⤵
  PID:4684
- C:\Windows\System\ibRWbGi.exe
  C:\Windows\System\ibRWbGi.exe
  2⤵
  PID:4744
- C:\Windows\System\pyGtavH.exe
  C:\Windows\System\pyGtavH.exe
  2⤵
  PID:4688
- C:\Windows\System\BDvGXRF.exe
  C:\Windows\System\BDvGXRF.exe
  2⤵
  PID:4724
- C:\Windows\System\XgLtJdE.exe
  C:\Windows\System\XgLtJdE.exe
  2⤵
  PID:4820
- C:\Windows\System\LKClXae.exe
  C:\Windows\System\LKClXae.exe
  2⤵
  PID:4832
- C:\Windows\System\EHAyIgC.exe
  C:\Windows\System\EHAyIgC.exe
  2⤵
  PID:4892
- C:\Windows\System\jsQRseJ.exe
  C:\Windows\System\jsQRseJ.exe
  2⤵
  PID:4900
- C:\Windows\System\GDPKxwQ.exe
  C:\Windows\System\GDPKxwQ.exe
  2⤵
  PID:4936
- C:\Windows\System\OSaAgDu.exe
  C:\Windows\System\OSaAgDu.exe
  2⤵
  PID:4952
- C:\Windows\System\ywNIKVY.exe
  C:\Windows\System\ywNIKVY.exe
  2⤵
  PID:4972
- C:\Windows\System\AfptSca.exe
  C:\Windows\System\AfptSca.exe
  2⤵
  PID:2124
- C:\Windows\System\aWxwgLK.exe
  C:\Windows\System\aWxwgLK.exe
  2⤵
  PID:5008
- C:\Windows\System\MVklFaN.exe
  C:\Windows\System\MVklFaN.exe
  2⤵
  PID:2096
- C:\Windows\System\IeKqjPn.exe
  C:\Windows\System\IeKqjPn.exe
  2⤵
  PID:4736
- C:\Windows\System\RNCmKda.exe
  C:\Windows\System\RNCmKda.exe
  2⤵
  PID:5116
- C:\Windows\System\sBAReAq.exe
  C:\Windows\System\sBAReAq.exe
  2⤵
  PID:3844
- C:\Windows\System\GSgWksF.exe
  C:\Windows\System\GSgWksF.exe
  2⤵
  PID:3364
- C:\Windows\System\vwTejkY.exe
  C:\Windows\System\vwTejkY.exe
  2⤵
  PID:5092
- C:\Windows\System\LyZcVog.exe
  C:\Windows\System\LyZcVog.exe
  2⤵
  PID:2628
- C:\Windows\System\INVMAGW.exe
  C:\Windows\System\INVMAGW.exe
  2⤵
  PID:4248
- C:\Windows\System\GjVIJnq.exe
  C:\Windows\System\GjVIJnq.exe
  2⤵
  PID:2472
- C:\Windows\System\DCdavCq.exe
  C:\Windows\System\DCdavCq.exe
  2⤵
  PID:3172
- C:\Windows\System\qiNMhss.exe
  C:\Windows\System\qiNMhss.exe
  2⤵
  PID:2892
- C:\Windows\System\NTwhTIe.exe
  C:\Windows\System\NTwhTIe.exe
  2⤵
  PID:4320
- C:\Windows\System\bCZGnAE.exe
  C:\Windows\System\bCZGnAE.exe
  2⤵
  PID:1756
- C:\Windows\System\weSYxXB.exe
  C:\Windows\System\weSYxXB.exe
  2⤵
  PID:2232
- C:\Windows\System\VYyAonU.exe
  C:\Windows\System\VYyAonU.exe
  2⤵
  PID:1788
- C:\Windows\System\ThbbVhB.exe
  C:\Windows\System\ThbbVhB.exe
  2⤵
  PID:4504
- C:\Windows\System\UheKZEl.exe
  C:\Windows\System\UheKZEl.exe
  2⤵
  PID:3712
- C:\Windows\System\IOQALkJ.exe
  C:\Windows\System\IOQALkJ.exe
  2⤵
  PID:3584
- C:\Windows\System\ZnfQvjE.exe
  C:\Windows\System\ZnfQvjE.exe
  2⤵
  PID:3828
- C:\Windows\System\jZtvniK.exe
  C:\Windows\System\jZtvniK.exe
  2⤵
  PID:3800
- C:\Windows\System\Dtsadjy.exe
  C:\Windows\System\Dtsadjy.exe
  2⤵
  PID:4600
- C:\Windows\System\pbcoGVW.exe
  C:\Windows\System\pbcoGVW.exe
  2⤵
  PID:4660
- C:\Windows\System\oVqwbgH.exe
  C:\Windows\System\oVqwbgH.exe
  2⤵
  PID:4700
- C:\Windows\System\NSQEUGp.exe
  C:\Windows\System\NSQEUGp.exe
  2⤵
  PID:572
- C:\Windows\System\nFgUYIa.exe
  C:\Windows\System\nFgUYIa.exe
  2⤵
  PID:1524
- C:\Windows\System\qjzRMkO.exe
  C:\Windows\System\qjzRMkO.exe
  2⤵
  PID:4992
- C:\Windows\System\CIhPrNX.exe
  C:\Windows\System\CIhPrNX.exe
  2⤵
  PID:4808
- C:\Windows\System\YZRhvYx.exe
  C:\Windows\System\YZRhvYx.exe
  2⤵
  PID:4388
- C:\Windows\System\RdLZfho.exe
  C:\Windows\System\RdLZfho.exe
  2⤵
  PID:3912
- C:\Windows\System\XZXmAcx.exe
  C:\Windows\System\XZXmAcx.exe
  2⤵
  PID:4964
- C:\Windows\System\DFMiKqp.exe
  C:\Windows\System\DFMiKqp.exe
  2⤵
  PID:4968
- C:\Windows\System\nECAzzR.exe
  C:\Windows\System\nECAzzR.exe
  2⤵
  PID:2516
- C:\Windows\System\OVazqiu.exe
  C:\Windows\System\OVazqiu.exe
  2⤵
  PID:5132
- C:\Windows\System\qVhIPuY.exe
  C:\Windows\System\qVhIPuY.exe
  2⤵
  PID:5148
- C:\Windows\System\xCvzyCO.exe
  C:\Windows\System\xCvzyCO.exe
  2⤵
  PID:5164
- C:\Windows\System\ARRdYZR.exe
  C:\Windows\System\ARRdYZR.exe
  2⤵
  PID:5180
- C:\Windows\System\BngVknO.exe
  C:\Windows\System\BngVknO.exe
  2⤵
  PID:5196
- C:\Windows\System\seWxqZg.exe
  C:\Windows\System\seWxqZg.exe
  2⤵
  PID:5212
- C:\Windows\System\YRNXqWT.exe
  C:\Windows\System\YRNXqWT.exe
  2⤵
  PID:5228
- C:\Windows\System\FmlRplD.exe
  C:\Windows\System\FmlRplD.exe
  2⤵
  PID:5248
- C:\Windows\System\amUBdba.exe
  C:\Windows\System\amUBdba.exe
  2⤵
  PID:5264
- C:\Windows\System\leyZGvs.exe
  C:\Windows\System\leyZGvs.exe
  2⤵
  PID:5280
- C:\Windows\System\mPHwzhM.exe
  C:\Windows\System\mPHwzhM.exe
  2⤵
  PID:5296
- C:\Windows\System\arBnebV.exe
  C:\Windows\System\arBnebV.exe
  2⤵
  PID:5312
- C:\Windows\System\cPykPYz.exe
  C:\Windows\System\cPykPYz.exe
  2⤵
  PID:5328
- C:\Windows\System\RcBgNzr.exe
  C:\Windows\System\RcBgNzr.exe
  2⤵
  PID:5344
- C:\Windows\System\xkRXLcK.exe
  C:\Windows\System\xkRXLcK.exe
  2⤵
  PID:5360
- C:\Windows\System\pAymzue.exe
  C:\Windows\System\pAymzue.exe
  2⤵
  PID:5376
- C:\Windows\System\FlSdaBF.exe
  C:\Windows\System\FlSdaBF.exe
  2⤵
  PID:5392
- C:\Windows\System\bSoSyUK.exe
  C:\Windows\System\bSoSyUK.exe
  2⤵
  PID:5408
- C:\Windows\System\TgCKzgi.exe
  C:\Windows\System\TgCKzgi.exe
  2⤵
  PID:5424
- C:\Windows\System\WGwUQkw.exe
  C:\Windows\System\WGwUQkw.exe
  2⤵
  PID:5440
- C:\Windows\System\dBQoVVL.exe
  C:\Windows\System\dBQoVVL.exe
  2⤵
  PID:5456
- C:\Windows\System\CODazEq.exe
  C:\Windows\System\CODazEq.exe
  2⤵
  PID:5472
- C:\Windows\System\omotXFJ.exe
  C:\Windows\System\omotXFJ.exe
  2⤵
  PID:5488
- C:\Windows\System\agNwyLD.exe
  C:\Windows\System\agNwyLD.exe
  2⤵
  PID:5508
- C:\Windows\System\vLzLqUH.exe
  C:\Windows\System\vLzLqUH.exe
  2⤵
  PID:5524
- C:\Windows\System\KbGYUGS.exe
  C:\Windows\System\KbGYUGS.exe
  2⤵
  PID:5540
- C:\Windows\System\ZTqzBgd.exe
  C:\Windows\System\ZTqzBgd.exe
  2⤵
  PID:5556
- C:\Windows\System\extKgfr.exe
  C:\Windows\System\extKgfr.exe
  2⤵
  PID:5572
- C:\Windows\System\bOgnzyb.exe
  C:\Windows\System\bOgnzyb.exe
  2⤵
  PID:5588
- C:\Windows\System\sdJfKMA.exe
  C:\Windows\System\sdJfKMA.exe
  2⤵
  PID:5608
- C:\Windows\System\APMLiTw.exe
  C:\Windows\System\APMLiTw.exe
  2⤵
  PID:5624
- C:\Windows\System\iyvbpnx.exe
  C:\Windows\System\iyvbpnx.exe
  2⤵
  PID:5640
- C:\Windows\System\fwTOiLY.exe
  C:\Windows\System\fwTOiLY.exe
  2⤵
  PID:5656
- C:\Windows\System\OEfQFJb.exe
  C:\Windows\System\OEfQFJb.exe
  2⤵
  PID:5672
- C:\Windows\System\qLKjHEI.exe
  C:\Windows\System\qLKjHEI.exe
  2⤵
  PID:5688
- C:\Windows\System\QDjHwOT.exe
  C:\Windows\System\QDjHwOT.exe
  2⤵
  PID:5704
- C:\Windows\System\gRolSrn.exe
  C:\Windows\System\gRolSrn.exe
  2⤵
  PID:5720
- C:\Windows\System\zGYqIud.exe
  C:\Windows\System\zGYqIud.exe
  2⤵
  PID:5736
- C:\Windows\System\htjIoUc.exe
  C:\Windows\System\htjIoUc.exe
  2⤵
  PID:5756
- C:\Windows\System\mjjuuZZ.exe
  C:\Windows\System\mjjuuZZ.exe
  2⤵
  PID:5780
- C:\Windows\System\IZxQTlu.exe
  C:\Windows\System\IZxQTlu.exe
  2⤵
  PID:5796
- C:\Windows\System\zsNfOhJ.exe
  C:\Windows\System\zsNfOhJ.exe
  2⤵
  PID:5816
- C:\Windows\System\AFstfAW.exe
  C:\Windows\System\AFstfAW.exe
  2⤵
  PID:5832
- C:\Windows\System\VygHbkv.exe
  C:\Windows\System\VygHbkv.exe
  2⤵
  PID:5848
- C:\Windows\System\zmDhReF.exe
  C:\Windows\System\zmDhReF.exe
  2⤵
  PID:5868
- C:\Windows\System\gGidLPo.exe
  C:\Windows\System\gGidLPo.exe
  2⤵
  PID:5884
- C:\Windows\System\RNGEvFD.exe
  C:\Windows\System\RNGEvFD.exe
  2⤵
  PID:5900
- C:\Windows\System\vwitfPq.exe
  C:\Windows\System\vwitfPq.exe
  2⤵
  PID:5916
- C:\Windows\System\pUDLsRi.exe
  C:\Windows\System\pUDLsRi.exe
  2⤵
  PID:5932
- C:\Windows\System\CTYdaXQ.exe
  C:\Windows\System\CTYdaXQ.exe
  2⤵
  PID:5948
- C:\Windows\System\zWdumNV.exe
  C:\Windows\System\zWdumNV.exe
  2⤵
  PID:5964
- C:\Windows\System\RDLhPBP.exe
  C:\Windows\System\RDLhPBP.exe
  2⤵
  PID:5980
- C:\Windows\System\XuykeQb.exe
  C:\Windows\System\XuykeQb.exe
  2⤵
  PID:5996
- C:\Windows\System\CWbRRNZ.exe
  C:\Windows\System\CWbRRNZ.exe
  2⤵
  PID:6012
- C:\Windows\System\iyBKswe.exe
  C:\Windows\System\iyBKswe.exe
  2⤵
  PID:6028
- C:\Windows\System\EllarFY.exe
  C:\Windows\System\EllarFY.exe
  2⤵
  PID:6044
- C:\Windows\System\hnOIfMM.exe
  C:\Windows\System\hnOIfMM.exe
  2⤵
  PID:6060
- C:\Windows\System\SzJXrmX.exe
  C:\Windows\System\SzJXrmX.exe
  2⤵
  PID:6080
- C:\Windows\System\mUAGjNV.exe
  C:\Windows\System\mUAGjNV.exe
  2⤵
  PID:6096
- C:\Windows\System\PVlDuiT.exe
  C:\Windows\System\PVlDuiT.exe
  2⤵
  PID:6112
- C:\Windows\System\ewvyCzf.exe
  C:\Windows\System\ewvyCzf.exe
  2⤵
  PID:6128
- C:\Windows\System\vcEvzyP.exe
  C:\Windows\System\vcEvzyP.exe
  2⤵
  PID:4076
- C:\Windows\System\EpYZwuc.exe
  C:\Windows\System\EpYZwuc.exe
  2⤵
  PID:4184
- C:\Windows\System\dVwULcq.exe
  C:\Windows\System\dVwULcq.exe
  2⤵
  PID:4648
- C:\Windows\System\azDjoIp.exe
  C:\Windows\System\azDjoIp.exe
  2⤵
  PID:3448
- C:\Windows\System\nSVplWL.exe
  C:\Windows\System\nSVplWL.exe
  2⤵
  PID:4720
- C:\Windows\System\OAuQdlz.exe
  C:\Windows\System\OAuQdlz.exe
  2⤵
  PID:4728
- C:\Windows\System\yUUItTv.exe
  C:\Windows\System\yUUItTv.exe
  2⤵
  PID:4856
- C:\Windows\System\ViztwGx.exe
  C:\Windows\System\ViztwGx.exe
  2⤵
  PID:5080
- C:\Windows\System\ZwZpcmZ.exe
  C:\Windows\System\ZwZpcmZ.exe
  2⤵
  PID:5176
- C:\Windows\System\ZalGONP.exe
  C:\Windows\System\ZalGONP.exe
  2⤵
  PID:5272
- C:\Windows\System\voKWPQK.exe
  C:\Windows\System\voKWPQK.exe
  2⤵
  PID:3368
- C:\Windows\System\PFRfjvB.exe
  C:\Windows\System\PFRfjvB.exe
  2⤵
  PID:3288
- C:\Windows\System\OlvPfjV.exe
  C:\Windows\System\OlvPfjV.exe
  2⤵
  PID:4500
- C:\Windows\System\zrAfkTv.exe
  C:\Windows\System\zrAfkTv.exe
  2⤵
  PID:2216
- C:\Windows\System\RVqXGaZ.exe
  C:\Windows\System\RVqXGaZ.exe
  2⤵
  PID:4828
- C:\Windows\System\wZydlJT.exe
  C:\Windows\System\wZydlJT.exe
  2⤵
  PID:5028
- C:\Windows\System\MEVPnts.exe
  C:\Windows\System\MEVPnts.exe
  2⤵
  PID:5044
- C:\Windows\System\GVhDkHf.exe
  C:\Windows\System\GVhDkHf.exe
  2⤵
  PID:5372
- C:\Windows\System\LtFOMWV.exe
  C:\Windows\System\LtFOMWV.exe
  2⤵
  PID:5036
- C:\Windows\System\RDCKmum.exe
  C:\Windows\System\RDCKmum.exe
  2⤵
  PID:5156
- C:\Windows\System\YsFZmZz.exe
  C:\Windows\System\YsFZmZz.exe
  2⤵
  PID:5192
- C:\Windows\System\FGjMQCX.exe
  C:\Windows\System\FGjMQCX.exe
  2⤵
  PID:5260
- C:\Windows\System\ifVWmQy.exe
  C:\Windows\System\ifVWmQy.exe
  2⤵
  PID:5324
- C:\Windows\System\qeKqPrC.exe
  C:\Windows\System\qeKqPrC.exe
  2⤵
  PID:5388
- C:\Windows\System\PlNfnVe.exe
  C:\Windows\System\PlNfnVe.exe
  2⤵
  PID:5452
- C:\Windows\System\GZJKHUH.exe
  C:\Windows\System\GZJKHUH.exe
  2⤵
  PID:5520
- C:\Windows\System\pycarml.exe
  C:\Windows\System\pycarml.exe
  2⤵
  PID:5584
- C:\Windows\System\HWZUIan.exe
  C:\Windows\System\HWZUIan.exe
  2⤵
  PID:5400
- C:\Windows\System\ULHrGeY.exe
  C:\Windows\System\ULHrGeY.exe
  2⤵
  PID:5468
- C:\Windows\System\rMOAMLN.exe
  C:\Windows\System\rMOAMLN.exe
  2⤵
  PID:5532
- C:\Windows\System\YipKXNY.exe
  C:\Windows\System\YipKXNY.exe
  2⤵
  PID:5596
- C:\Windows\System\EuOWGLB.exe
  C:\Windows\System\EuOWGLB.exe
  2⤵
  PID:5636
- C:\Windows\System\KdjRxMn.exe
  C:\Windows\System\KdjRxMn.exe
  2⤵
  PID:5700
- C:\Windows\System\jjrPpQo.exe
  C:\Windows\System\jjrPpQo.exe
  2⤵
  PID:5680
- C:\Windows\System\OcORVXf.exe
  C:\Windows\System\OcORVXf.exe
  2⤵
  PID:5712
- C:\Windows\System\joThyIO.exe
  C:\Windows\System\joThyIO.exe
  2⤵
  PID:5772
- C:\Windows\System\azdAINR.exe
  C:\Windows\System\azdAINR.exe
  2⤵
  PID:5788
- C:\Windows\System\fsvwEDZ.exe
  C:\Windows\System\fsvwEDZ.exe
  2⤵
  PID:5856
- C:\Windows\System\reWrbJG.exe
  C:\Windows\System\reWrbJG.exe
  2⤵
  PID:5892
- C:\Windows\System\sniZZsT.exe
  C:\Windows\System\sniZZsT.exe
  2⤵
  PID:5812
- C:\Windows\System\gzzCfft.exe
  C:\Windows\System\gzzCfft.exe
  2⤵
  PID:5992
- C:\Windows\System\VEEZYdG.exe
  C:\Windows\System\VEEZYdG.exe
  2⤵
  PID:6056
- C:\Windows\System\AojuSJA.exe
  C:\Windows\System\AojuSJA.exe
  2⤵
  PID:5876
- C:\Windows\System\aqnbkfm.exe
  C:\Windows\System\aqnbkfm.exe
  2⤵
  PID:6008
- C:\Windows\System\KLWtSyL.exe
  C:\Windows\System\KLWtSyL.exe
  2⤵
  PID:6092
- C:\Windows\System\DhNKnNT.exe
  C:\Windows\System\DhNKnNT.exe
  2⤵
  PID:5972
- C:\Windows\System\gOWKUKL.exe
  C:\Windows\System\gOWKUKL.exe
  2⤵
  PID:6120
- C:\Windows\System\ubABEyE.exe
  C:\Windows\System\ubABEyE.exe
  2⤵
  PID:2760
- C:\Windows\System\lXTRVeL.exe
  C:\Windows\System\lXTRVeL.exe
  2⤵
  PID:988
- C:\Windows\System\IyWEnah.exe
  C:\Windows\System\IyWEnah.exe
  2⤵
  PID:5240
- C:\Windows\System\USjLnFa.exe
  C:\Windows\System\USjLnFa.exe
  2⤵
  PID:3956
- C:\Windows\System\WRWwmhs.exe
  C:\Windows\System\WRWwmhs.exe
  2⤵
  PID:5340
- C:\Windows\System\vvvLGno.exe
  C:\Windows\System\vvvLGno.exe
  2⤵
  PID:5224
- C:\Windows\System\KzckArB.exe
  C:\Windows\System\KzckArB.exe
  2⤵
  PID:5172
- C:\Windows\System\JIMUAax.exe
  C:\Windows\System\JIMUAax.exe
  2⤵
  PID:2332
- C:\Windows\System\lQrbSOD.exe
  C:\Windows\System\lQrbSOD.exe
  2⤵
  PID:5384
- C:\Windows\System\MXQpmeg.exe
  C:\Windows\System\MXQpmeg.exe
  2⤵
  PID:1932
- C:\Windows\System\XXkBNar.exe
  C:\Windows\System\XXkBNar.exe
  2⤵
  PID:5516
- C:\Windows\System\YWfHdjC.exe
  C:\Windows\System\YWfHdjC.exe
  2⤵
  PID:5504
- C:\Windows\System\YPxzZoS.exe
  C:\Windows\System\YPxzZoS.exe
  2⤵
  PID:5752
- C:\Windows\System\obWLjfJ.exe
  C:\Windows\System\obWLjfJ.exe
  2⤵
  PID:5828
- C:\Windows\System\LugRZtq.exe
  C:\Windows\System\LugRZtq.exe
  2⤵
  PID:5448
- C:\Windows\System\ExnTBvP.exe
  C:\Windows\System\ExnTBvP.exe
  2⤵
  PID:5464
- C:\Windows\System\temQXzB.exe
  C:\Windows\System\temQXzB.exe
  2⤵
  PID:5808
- C:\Windows\System\IVmTZrg.exe
  C:\Windows\System\IVmTZrg.exe
  2⤵
  PID:5716
- C:\Windows\System\UVShKwB.exe
  C:\Windows\System\UVShKwB.exe
  2⤵
  PID:5804
- C:\Windows\System\rloIjGS.exe
  C:\Windows\System\rloIjGS.exe
  2⤵
  PID:5988
- C:\Windows\System\KrCmKtT.exe
  C:\Windows\System\KrCmKtT.exe
  2⤵
  PID:6068
- C:\Windows\System\GjYjsdX.exe
  C:\Windows\System\GjYjsdX.exe
  2⤵
  PID:3872
- C:\Windows\System\UHqYngI.exe
  C:\Windows\System\UHqYngI.exe
  2⤵
  PID:6104
- C:\Windows\System\mOeQCcD.exe
  C:\Windows\System\mOeQCcD.exe
  2⤵
  PID:5204
- C:\Windows\System\jcWNRsC.exe
  C:\Windows\System\jcWNRsC.exe
  2⤵
  PID:5128
- C:\Windows\System\OITkVAx.exe
  C:\Windows\System\OITkVAx.exe
  2⤵
  PID:4232
- C:\Windows\System\drUBytU.exe
  C:\Windows\System\drUBytU.exe
  2⤵
  PID:4420
- C:\Windows\System\NXpGpUp.exe
  C:\Windows\System\NXpGpUp.exe
  2⤵
  PID:5356
- C:\Windows\System\sHHgbfL.exe
  C:\Windows\System\sHHgbfL.exe
  2⤵
  PID:5732
- C:\Windows\System\qUbpFmX.exe
  C:\Windows\System\qUbpFmX.exe
  2⤵
  PID:5928
- C:\Windows\System\cMiCftT.exe
  C:\Windows\System\cMiCftT.exe
  2⤵
  PID:6088
- C:\Windows\System\LuaRPrz.exe
  C:\Windows\System\LuaRPrz.exe
  2⤵
  PID:5308
- C:\Windows\System\qbxsMsJ.exe
  C:\Windows\System\qbxsMsJ.exe
  2⤵
  PID:5696
- C:\Windows\System\TTrZoWJ.exe
  C:\Windows\System\TTrZoWJ.exe
  2⤵
  PID:5292
- C:\Windows\System\KWFcLBh.exe
  C:\Windows\System\KWFcLBh.exe
  2⤵
  PID:4880
- C:\Windows\System\GHHVwuL.exe
  C:\Windows\System\GHHVwuL.exe
  2⤵
  PID:5632
- C:\Windows\System\TXUGlKP.exe
  C:\Windows\System\TXUGlKP.exe
  2⤵
  PID:6160
- C:\Windows\System\VXOGmRi.exe
  C:\Windows\System\VXOGmRi.exe
  2⤵
  PID:6176
- C:\Windows\System\EipdnxT.exe
  C:\Windows\System\EipdnxT.exe
  2⤵
  PID:6196
- C:\Windows\System\YdHZFKR.exe
  C:\Windows\System\YdHZFKR.exe
  2⤵
  PID:6212
- C:\Windows\System\ZsrCGKu.exe
  C:\Windows\System\ZsrCGKu.exe
  2⤵
  PID:6228
- C:\Windows\System\yJpflVF.exe
  C:\Windows\System\yJpflVF.exe
  2⤵
  PID:6244
- C:\Windows\System\GMacABO.exe
  C:\Windows\System\GMacABO.exe
  2⤵
  PID:6260
- C:\Windows\System\JHZKGQb.exe
  C:\Windows\System\JHZKGQb.exe
  2⤵
  PID:6276
- C:\Windows\System\wiBdFIr.exe
  C:\Windows\System\wiBdFIr.exe
  2⤵
  PID:6300
- C:\Windows\System\XrAfbkj.exe
  C:\Windows\System\XrAfbkj.exe
  2⤵
  PID:6316
- C:\Windows\System\arLpmdk.exe
  C:\Windows\System\arLpmdk.exe
  2⤵
  PID:6332
- C:\Windows\System\EYeETUf.exe
  C:\Windows\System\EYeETUf.exe
  2⤵
  PID:6348
- C:\Windows\System\qzDTXre.exe
  C:\Windows\System\qzDTXre.exe
  2⤵
  PID:6364
- C:\Windows\System\pTWDqDd.exe
  C:\Windows\System\pTWDqDd.exe
  2⤵
  PID:6380
- C:\Windows\System\FjyAmbq.exe
  C:\Windows\System\FjyAmbq.exe
  2⤵
  PID:6396
- C:\Windows\System\UEjCwHV.exe
  C:\Windows\System\UEjCwHV.exe
  2⤵
  PID:6412
- C:\Windows\System\DjpYAKI.exe
  C:\Windows\System\DjpYAKI.exe
  2⤵
  PID:6428
- C:\Windows\System\pSiNHvd.exe
  C:\Windows\System\pSiNHvd.exe
  2⤵
  PID:6444
- C:\Windows\System\RyyAfaC.exe
  C:\Windows\System\RyyAfaC.exe
  2⤵
  PID:6460
- C:\Windows\System\hQUkqLC.exe
  C:\Windows\System\hQUkqLC.exe
  2⤵
  PID:6476
- C:\Windows\System\wGdSEzZ.exe
  C:\Windows\System\wGdSEzZ.exe
  2⤵
  PID:6492
- C:\Windows\System\aOLMZpV.exe
  C:\Windows\System\aOLMZpV.exe
  2⤵
  PID:6508
- C:\Windows\System\YAlHgty.exe
  C:\Windows\System\YAlHgty.exe
  2⤵
  PID:6524
- C:\Windows\System\bmQmQMb.exe
  C:\Windows\System\bmQmQMb.exe
  2⤵
  PID:6540
- C:\Windows\System\eoKRrWa.exe
  C:\Windows\System\eoKRrWa.exe
  2⤵
  PID:6556
- C:\Windows\System\rTugCKF.exe
  C:\Windows\System\rTugCKF.exe
  2⤵
  PID:6572
- C:\Windows\System\OwIqFVA.exe
  C:\Windows\System\OwIqFVA.exe
  2⤵
  PID:6588
- C:\Windows\System\BSVWpWU.exe
  C:\Windows\System\BSVWpWU.exe
  2⤵
  PID:6604
- C:\Windows\System\TblejoZ.exe
  C:\Windows\System\TblejoZ.exe
  2⤵
  PID:6620
- C:\Windows\System\yvOhBGy.exe
  C:\Windows\System\yvOhBGy.exe
  2⤵
  PID:6636
- C:\Windows\System\ZLeGUob.exe
  C:\Windows\System\ZLeGUob.exe
  2⤵
  PID:6652
- C:\Windows\System\RJlUfiW.exe
  C:\Windows\System\RJlUfiW.exe
  2⤵
  PID:6668
- C:\Windows\System\kdLbeOt.exe
  C:\Windows\System\kdLbeOt.exe
  2⤵
  PID:6684
- C:\Windows\System\esKeqyi.exe
  C:\Windows\System\esKeqyi.exe
  2⤵
  PID:6700
- C:\Windows\System\FuuAFmk.exe
  C:\Windows\System\FuuAFmk.exe
  2⤵
  PID:6716
- C:\Windows\System\FJxsSBt.exe
  C:\Windows\System\FJxsSBt.exe
  2⤵
  PID:6732
- C:\Windows\System\quBzYSw.exe
  C:\Windows\System\quBzYSw.exe
  2⤵
  PID:6756
- C:\Windows\System\PrfwNfD.exe
  C:\Windows\System\PrfwNfD.exe
  2⤵
  PID:6772
- C:\Windows\System\zobFCyd.exe
  C:\Windows\System\zobFCyd.exe
  2⤵
  PID:6788
- C:\Windows\System\sduvhif.exe
  C:\Windows\System\sduvhif.exe
  2⤵
  PID:6804
- C:\Windows\System\QxSeBNw.exe
  C:\Windows\System\QxSeBNw.exe
  2⤵
  PID:6820
- C:\Windows\System\xrDPDzl.exe
  C:\Windows\System\xrDPDzl.exe
  2⤵
  PID:6836
- C:\Windows\System\lmvbPqX.exe
  C:\Windows\System\lmvbPqX.exe
  2⤵
  PID:6852
- C:\Windows\System\wsezGCg.exe
  C:\Windows\System\wsezGCg.exe
  2⤵
  PID:6868
- C:\Windows\System\DsFXHyk.exe
  C:\Windows\System\DsFXHyk.exe
  2⤵
  PID:6884
- C:\Windows\System\ygbuWtU.exe
  C:\Windows\System\ygbuWtU.exe
  2⤵
  PID:6900
- C:\Windows\System\nhlSNcH.exe
  C:\Windows\System\nhlSNcH.exe
  2⤵
  PID:6916
- C:\Windows\System\zuOSpAu.exe
  C:\Windows\System\zuOSpAu.exe
  2⤵
  PID:6936
- C:\Windows\System\fxTMdTt.exe
  C:\Windows\System\fxTMdTt.exe
  2⤵
  PID:6952
- C:\Windows\System\hgOujuF.exe
  C:\Windows\System\hgOujuF.exe
  2⤵
  PID:6968
- C:\Windows\System\WRnzYHt.exe
  C:\Windows\System\WRnzYHt.exe
  2⤵
  PID:6984
- C:\Windows\System\FwYKTaM.exe
  C:\Windows\System\FwYKTaM.exe
  2⤵
  PID:7000
- C:\Windows\System\PLcDaos.exe
  C:\Windows\System\PLcDaos.exe
  2⤵
  PID:7016
- C:\Windows\System\HSqaImB.exe
  C:\Windows\System\HSqaImB.exe
  2⤵
  PID:7032
- C:\Windows\System\TNGSOga.exe
  C:\Windows\System\TNGSOga.exe
  2⤵
  PID:7048
- C:\Windows\System\sZNttHP.exe
  C:\Windows\System\sZNttHP.exe
  2⤵
  PID:7064
- C:\Windows\System\ZiAsFLw.exe
  C:\Windows\System\ZiAsFLw.exe
  2⤵
  PID:7080
- C:\Windows\System\Jfnxfbj.exe
  C:\Windows\System\Jfnxfbj.exe
  2⤵
  PID:7096
- C:\Windows\System\RARnZoZ.exe
  C:\Windows\System\RARnZoZ.exe
  2⤵
  PID:7112
- C:\Windows\System\MoXfUnT.exe
  C:\Windows\System\MoXfUnT.exe
  2⤵
  PID:7128
- C:\Windows\System\jygPkFM.exe
  C:\Windows\System\jygPkFM.exe
  2⤵
  PID:7144
- C:\Windows\System\OLfRnUC.exe
  C:\Windows\System\OLfRnUC.exe
  2⤵
  PID:7160
- C:\Windows\System\AvoHuIw.exe
  C:\Windows\System\AvoHuIw.exe
  2⤵
  PID:6184
- C:\Windows\System\lkWTjSZ.exe
  C:\Windows\System\lkWTjSZ.exe
  2⤵
  PID:6224
- C:\Windows\System\RKndWfQ.exe
  C:\Windows\System\RKndWfQ.exe
  2⤵
  PID:5860
- C:\Windows\System\EefDGej.exe
  C:\Windows\System\EefDGej.exe
  2⤵
  PID:6292
- C:\Windows\System\cAaZlHu.exe
  C:\Windows\System\cAaZlHu.exe
  2⤵
  PID:5840
- C:\Windows\System\cqoGNTK.exe
  C:\Windows\System\cqoGNTK.exe
  2⤵
  PID:6288
- C:\Windows\System\kusXScY.exe
  C:\Windows\System\kusXScY.exe
  2⤵
  PID:4548
- C:\Windows\System\JsOhyWH.exe
  C:\Windows\System\JsOhyWH.exe
  2⤵
  PID:5944
- C:\Windows\System\FfzPSkH.exe
  C:\Windows\System\FfzPSkH.exe
  2⤵
  PID:6268
- C:\Windows\System\dZjOPXE.exe
  C:\Windows\System\dZjOPXE.exe
  2⤵
  PID:6168
- C:\Windows\System\SRDpACW.exe
  C:\Windows\System\SRDpACW.exe
  2⤵
  PID:6208
- C:\Windows\System\icxMWAw.exe
  C:\Windows\System\icxMWAw.exe
  2⤵
  PID:6356
- C:\Windows\System\mweInsX.exe
  C:\Windows\System\mweInsX.exe
  2⤵
  PID:6424
- C:\Windows\System\fKqDAuj.exe
  C:\Windows\System\fKqDAuj.exe
  2⤵
  PID:6376
- C:\Windows\System\cLcFAEL.exe
  C:\Windows\System\cLcFAEL.exe
  2⤵
  PID:6440
- C:\Windows\System\NoLzinc.exe
  C:\Windows\System\NoLzinc.exe
  2⤵
  PID:6484
- C:\Windows\System\dnwprQN.exe
  C:\Windows\System\dnwprQN.exe
  2⤵
  PID:6500
- C:\Windows\System\NKtONvz.exe
  C:\Windows\System\NKtONvz.exe
  2⤵
  PID:6552
- C:\Windows\System\hkdqtbe.exe
  C:\Windows\System\hkdqtbe.exe
  2⤵
  PID:6612
- C:\Windows\System\eNKDebi.exe
  C:\Windows\System\eNKDebi.exe
  2⤵
  PID:6568
- C:\Windows\System\UTaDZaW.exe
  C:\Windows\System\UTaDZaW.exe
  2⤵
  PID:6644
- C:\Windows\System\hTCuOWw.exe
  C:\Windows\System\hTCuOWw.exe
  2⤵
  PID:6708
- C:\Windows\System\ptPocIM.exe
  C:\Windows\System\ptPocIM.exe
  2⤵
  PID:6748
- C:\Windows\System\oMVGVzU.exe
  C:\Windows\System\oMVGVzU.exe
  2⤵
  PID:6812
- C:\Windows\System\yrdypyQ.exe
  C:\Windows\System\yrdypyQ.exe
  2⤵
  PID:6876
- C:\Windows\System\uDntZwV.exe
  C:\Windows\System\uDntZwV.exe
  2⤵
  PID:6944
- C:\Windows\System\KprfhkV.exe
  C:\Windows\System\KprfhkV.exe
  2⤵
  PID:7008
- C:\Windows\System\XiyEOYG.exe
  C:\Windows\System\XiyEOYG.exe
  2⤵
  PID:6632
- C:\Windows\System\eYhRPed.exe
  C:\Windows\System\eYhRPed.exe
  2⤵
  PID:6764
- C:\Windows\System\xBzsKFi.exe
  C:\Windows\System\xBzsKFi.exe
  2⤵
  PID:7092
- C:\Windows\System\PcSkzoj.exe
  C:\Windows\System\PcSkzoj.exe
  2⤵
  PID:6800
- C:\Windows\System\UsabDKk.exe
  C:\Windows\System\UsabDKk.exe
  2⤵
  PID:6832
- C:\Windows\System\JolddRk.exe
  C:\Windows\System\JolddRk.exe
  2⤵
  PID:6928
- C:\Windows\System\jHtsksu.exe
  C:\Windows\System\jHtsksu.exe
  2⤵
  PID:6992
- C:\Windows\System\KOwmYiZ.exe
  C:\Windows\System\KOwmYiZ.exe
  2⤵
  PID:7056
- C:\Windows\System\spwuPTB.exe
  C:\Windows\System\spwuPTB.exe
  2⤵
  PID:7140
- C:\Windows\System\lbVAcYQ.exe
  C:\Windows\System\lbVAcYQ.exe
  2⤵
  PID:5824
- C:\Windows\System\PrOVojb.exe
  C:\Windows\System\PrOVojb.exe
  2⤵
  PID:4932
- C:\Windows\System\yAihmpH.exe
  C:\Windows\System\yAihmpH.exe
  2⤵
  PID:6192
- C:\Windows\System\GBfnPsW.exe
  C:\Windows\System\GBfnPsW.exe
  2⤵
  PID:6420
- C:\Windows\System\JmCDwwV.exe
  C:\Windows\System\JmCDwwV.exe
  2⤵
  PID:7124
- C:\Windows\System\ZOkbEJl.exe
  C:\Windows\System\ZOkbEJl.exe
  2⤵
  PID:6436
- C:\Windows\System\wpUvLVB.exe
  C:\Windows\System\wpUvLVB.exe
  2⤵
  PID:7152
- C:\Windows\System\hIExUcH.exe
  C:\Windows\System\hIExUcH.exe
  2⤵
  PID:6284
- C:\Windows\System\XgzIbbf.exe
  C:\Windows\System\XgzIbbf.exe
  2⤵
  PID:5420
- C:\Windows\System\ngEhuKD.exe
  C:\Windows\System\ngEhuKD.exe
  2⤵
  PID:6584
- C:\Windows\System\ATckMSN.exe
  C:\Windows\System\ATckMSN.exe
  2⤵
  PID:6520
- C:\Windows\System\UZIYlrI.exe
  C:\Windows\System\UZIYlrI.exe
  2⤵
  PID:6628
- C:\Windows\System\JJfVkuf.exe
  C:\Windows\System\JJfVkuf.exe
  2⤵
  PID:6848
- C:\Windows\System\jFpUxCB.exe
  C:\Windows\System\jFpUxCB.exe
  2⤵
  PID:7176
- C:\Windows\System\cBGWLUG.exe
  C:\Windows\System\cBGWLUG.exe
  2⤵
  PID:7192
- C:\Windows\System\JNhzgWV.exe
  C:\Windows\System\JNhzgWV.exe
  2⤵
  PID:7208
- C:\Windows\System\dxzWnCd.exe
  C:\Windows\System\dxzWnCd.exe
  2⤵
  PID:7228
- C:\Windows\System\PfKYFnT.exe
  C:\Windows\System\PfKYFnT.exe
  2⤵
  PID:7244
- C:\Windows\System\WOWyNSt.exe
  C:\Windows\System\WOWyNSt.exe
  2⤵
  PID:7260
- C:\Windows\System\SbHfWkY.exe
  C:\Windows\System\SbHfWkY.exe
  2⤵
  PID:7276
- C:\Windows\System\kWVsoMH.exe
  C:\Windows\System\kWVsoMH.exe
  2⤵
  PID:7292
- C:\Windows\System\wNegfDK.exe
  C:\Windows\System\wNegfDK.exe
  2⤵
  PID:7308
- C:\Windows\System\MwZbnEl.exe
  C:\Windows\System\MwZbnEl.exe
  2⤵
  PID:7324
- C:\Windows\System\WrGGSlY.exe
  C:\Windows\System\WrGGSlY.exe
  2⤵
  PID:7340
- C:\Windows\System\ItHYKHg.exe
  C:\Windows\System\ItHYKHg.exe
  2⤵
  PID:7372
- C:\Windows\System\PyqDWwF.exe
  C:\Windows\System\PyqDWwF.exe
  2⤵
  PID:7388
- C:\Windows\System\eZfEZQR.exe
  C:\Windows\System\eZfEZQR.exe
  2⤵
  PID:7404
- C:\Windows\System\bGcJFKu.exe
  C:\Windows\System\bGcJFKu.exe
  2⤵
  PID:7432
- C:\Windows\System\VEnyFGW.exe
  C:\Windows\System\VEnyFGW.exe
  2⤵
  PID:7448
- C:\Windows\System\CTbtcWS.exe
  C:\Windows\System\CTbtcWS.exe
  2⤵
  PID:7468
- C:\Windows\System\rqkjSMI.exe
  C:\Windows\System\rqkjSMI.exe
  2⤵
  PID:7484
- C:\Windows\System\BBbWgSB.exe
  C:\Windows\System\BBbWgSB.exe
  2⤵
  PID:7500
- C:\Windows\System\sIbJmNl.exe
  C:\Windows\System\sIbJmNl.exe
  2⤵
  PID:7516
- C:\Windows\System\AwgEFFI.exe
  C:\Windows\System\AwgEFFI.exe
  2⤵
  PID:7532
- C:\Windows\System\BDFxeXM.exe
  C:\Windows\System\BDFxeXM.exe
  2⤵
  PID:7548
- C:\Windows\System\cJtvJra.exe
  C:\Windows\System\cJtvJra.exe
  2⤵
  PID:7572
- C:\Windows\System\vbnPcyi.exe
  C:\Windows\System\vbnPcyi.exe
  2⤵
  PID:7588
- C:\Windows\System\aVLVvGN.exe
  C:\Windows\System\aVLVvGN.exe
  2⤵
  PID:7608
- C:\Windows\System\FfuISxh.exe
  C:\Windows\System\FfuISxh.exe
  2⤵
  PID:7624
- C:\Windows\System\fQayFSv.exe
  C:\Windows\System\fQayFSv.exe
  2⤵
  PID:7640
- C:\Windows\System\DfLSqHV.exe
  C:\Windows\System\DfLSqHV.exe
  2⤵
  PID:7656
- C:\Windows\System\tsafFCp.exe
  C:\Windows\System\tsafFCp.exe
  2⤵
  PID:7684
- C:\Windows\System\HgtkJgH.exe
  C:\Windows\System\HgtkJgH.exe
  2⤵
  PID:7700
- C:\Windows\System\OuSbwjq.exe
  C:\Windows\System\OuSbwjq.exe
  2⤵
  PID:7720
- C:\Windows\System\vjCIxzp.exe
  C:\Windows\System\vjCIxzp.exe
  2⤵
  PID:7736
- C:\Windows\System\QfBZFLE.exe
  C:\Windows\System\QfBZFLE.exe
  2⤵
  PID:7760
- C:\Windows\System\izevVhz.exe
  C:\Windows\System\izevVhz.exe
  2⤵
  PID:7776
- C:\Windows\System\OEOiPSw.exe
  C:\Windows\System\OEOiPSw.exe
  2⤵
  PID:7792
- C:\Windows\System\zOxJFRi.exe
  C:\Windows\System\zOxJFRi.exe
  2⤵
  PID:7808
- C:\Windows\System\oNERucI.exe
  C:\Windows\System\oNERucI.exe
  2⤵
  PID:7824
- C:\Windows\System\GLprMDB.exe
  C:\Windows\System\GLprMDB.exe
  2⤵
  PID:7844
- C:\Windows\System\KXQToZg.exe
  C:\Windows\System\KXQToZg.exe
  2⤵
  PID:7860
- C:\Windows\System\eiFynWb.exe
  C:\Windows\System\eiFynWb.exe
  2⤵
  PID:7876
- C:\Windows\System\SePrZUv.exe
  C:\Windows\System\SePrZUv.exe
  2⤵
  PID:7892
- C:\Windows\System\mDunSKI.exe
  C:\Windows\System\mDunSKI.exe
  2⤵
  PID:7916
- C:\Windows\System\yBVWvEc.exe
  C:\Windows\System\yBVWvEc.exe
  2⤵
  PID:7932
- C:\Windows\System\CvXLmHF.exe
  C:\Windows\System\CvXLmHF.exe
  2⤵
  PID:7948
- C:\Windows\System\LZtihBi.exe
  C:\Windows\System\LZtihBi.exe
  2⤵
  PID:7964
- C:\Windows\System\CQrHcKr.exe
  C:\Windows\System\CQrHcKr.exe
  2⤵
  PID:7980
- C:\Windows\System\qQoMtly.exe
  C:\Windows\System\qQoMtly.exe
  2⤵
  PID:8000
- C:\Windows\System\HNPafIC.exe
  C:\Windows\System\HNPafIC.exe
  2⤵
  PID:8016
- C:\Windows\System\FnHbpLt.exe
  C:\Windows\System\FnHbpLt.exe
  2⤵
  PID:8036
- C:\Windows\System\tikUVrl.exe
  C:\Windows\System\tikUVrl.exe
  2⤵
  PID:8056
- C:\Windows\System\ZCWPpxW.exe
  C:\Windows\System\ZCWPpxW.exe
  2⤵
  PID:8072
- C:\Windows\System\xChbCLT.exe
  C:\Windows\System\xChbCLT.exe
  2⤵
  PID:8096
- C:\Windows\System\HFDbGyO.exe
  C:\Windows\System\HFDbGyO.exe
  2⤵
  PID:8120
- C:\Windows\System\gBqUMWf.exe
  C:\Windows\System\gBqUMWf.exe
  2⤵
  PID:8136
- C:\Windows\System\mENMsFk.exe
  C:\Windows\System\mENMsFk.exe
  2⤵
  PID:8152
- C:\Windows\System\ivTuXta.exe
  C:\Windows\System\ivTuXta.exe
  2⤵
  PID:8176
- C:\Windows\System\KeXShvV.exe
  C:\Windows\System\KeXShvV.exe
  2⤵
  PID:7024
- C:\Windows\System\NzgXtim.exe
  C:\Windows\System\NzgXtim.exe
  2⤵
  PID:6340
- C:\Windows\System\PUUbVrj.exe
  C:\Windows\System\PUUbVrj.exe
  2⤵
  PID:5060
- C:\Windows\System\GJAcFbQ.exe
  C:\Windows\System\GJAcFbQ.exe
  2⤵
  PID:6844
- C:\Windows\System\gwtjclE.exe
  C:\Windows\System\gwtjclE.exe
  2⤵
  PID:7220
- C:\Windows\System\DSylyxv.exe
  C:\Windows\System\DSylyxv.exe
  2⤵
  PID:6536
- C:\Windows\System\zlUNvdI.exe
  C:\Windows\System\zlUNvdI.exe
  2⤵
  PID:6680
- C:\Windows\System\BNlAkzo.exe
  C:\Windows\System\BNlAkzo.exe
  2⤵
  PID:7040
- C:\Windows\System\snuVQYU.exe
  C:\Windows\System\snuVQYU.exe
  2⤵
  PID:6664
- C:\Windows\System\PPuqUOL.exe
  C:\Windows\System\PPuqUOL.exe
  2⤵
  PID:7108
- C:\Windows\System\FaXEEPD.exe
  C:\Windows\System\FaXEEPD.exe
  2⤵
  PID:4740
- C:\Windows\System\ViQYAex.exe
  C:\Windows\System\ViQYAex.exe
  2⤵
  PID:6456
- C:\Windows\System\nybDYmo.exe
  C:\Windows\System\nybDYmo.exe
  2⤵
  PID:6980
- C:\Windows\System\kxbRrTm.exe
  C:\Windows\System\kxbRrTm.exe
  2⤵
  PID:7172
- C:\Windows\System\tVdsCuf.exe
  C:\Windows\System\tVdsCuf.exe
  2⤵
  PID:7332
- C:\Windows\System\AAzSeLs.exe
  C:\Windows\System\AAzSeLs.exe
  2⤵
  PID:7316
- C:\Windows\System\JLGlAHP.exe
  C:\Windows\System\JLGlAHP.exe
  2⤵
  PID:7240
- C:\Windows\System\LbhBPcG.exe
  C:\Windows\System\LbhBPcG.exe
  2⤵
  PID:7256
- C:\Windows\System\aCSwyiP.exe
  C:\Windows\System\aCSwyiP.exe
  2⤵
  PID:7400
- C:\Windows\System\SBBUdWy.exe
  C:\Windows\System\SBBUdWy.exe
  2⤵
  PID:7300
- C:\Windows\System\RAakVcY.exe
  C:\Windows\System\RAakVcY.exe
  2⤵
  PID:7476
- C:\Windows\System\sDVeWtA.exe
  C:\Windows\System\sDVeWtA.exe
  2⤵
  PID:7540
- C:\Windows\System\LfDQSEt.exe
  C:\Windows\System\LfDQSEt.exe
  2⤵
  PID:7616
- C:\Windows\System\tZmXiWR.exe
  C:\Windows\System\tZmXiWR.exe
  2⤵
  PID:7692
- C:\Windows\System\OoplMOr.exe
  C:\Windows\System\OoplMOr.exe
  2⤵
  PID:7424
- C:\Windows\System\nxWQtwM.exe
  C:\Windows\System\nxWQtwM.exe
  2⤵
  PID:7804
- C:\Windows\System\ZEjeOcp.exe
  C:\Windows\System\ZEjeOcp.exe
  2⤵
  PID:7840
- C:\Windows\System\smDXFAw.exe
  C:\Windows\System\smDXFAw.exe
  2⤵
  PID:7904
- C:\Windows\System\KZxjmJU.exe
  C:\Windows\System\KZxjmJU.exe
  2⤵
  PID:7972
- C:\Windows\System\UWuIHdl.exe
  C:\Windows\System\UWuIHdl.exe
  2⤵
  PID:8048
- C:\Windows\System\cciVMZc.exe
  C:\Windows\System\cciVMZc.exe
  2⤵
  PID:8088
- C:\Windows\System\fXHwbBy.exe
  C:\Windows\System\fXHwbBy.exe
  2⤵
  PID:8132
- C:\Windows\System\gElQGdi.exe
  C:\Windows\System\gElQGdi.exe
  2⤵
  PID:6156
- C:\Windows\System\wubKTgU.exe
  C:\Windows\System\wubKTgU.exe
  2⤵
  PID:6744
- C:\Windows\System\XYixxzz.exe
  C:\Windows\System\XYixxzz.exe
  2⤵
  PID:7428
- C:\Windows\System\gtFwEFL.exe
  C:\Windows\System\gtFwEFL.exe
  2⤵
  PID:7496
- C:\Windows\System\mmVVrQE.exe
  C:\Windows\System\mmVVrQE.exe
  2⤵
  PID:7560
- C:\Windows\System\yJdQoaE.exe
  C:\Windows\System\yJdQoaE.exe
  2⤵
  PID:7604
- C:\Windows\System\TSSeOzL.exe
  C:\Windows\System\TSSeOzL.exe
  2⤵
  PID:7668
- C:\Windows\System\dnnMLNH.exe
  C:\Windows\System\dnnMLNH.exe
  2⤵
  PID:7708
- C:\Windows\System\jhnDLDJ.exe
  C:\Windows\System\jhnDLDJ.exe
  2⤵
  PID:7748
- C:\Windows\System\lchfLbs.exe
  C:\Windows\System\lchfLbs.exe
  2⤵
  PID:7992
- C:\Windows\System\FPGesGQ.exe
  C:\Windows\System\FPGesGQ.exe
  2⤵
  PID:8032
- C:\Windows\System\PXQKQhO.exe
  C:\Windows\System\PXQKQhO.exe
  2⤵
  PID:8108
- C:\Windows\System\isxxjEi.exe
  C:\Windows\System\isxxjEi.exe
  2⤵
  PID:8148
- C:\Windows\System\BfewtcA.exe
  C:\Windows\System\BfewtcA.exe
  2⤵
  PID:6896
- C:\Windows\System\WIOLGkC.exe
  C:\Windows\System\WIOLGkC.exe
  2⤵
  PID:5124
- C:\Windows\System\Nedchgg.exe
  C:\Windows\System\Nedchgg.exe
  2⤵
  PID:6864
- C:\Windows\System\LjOkkIN.exe
  C:\Windows\System\LjOkkIN.exe
  2⤵
  PID:6564
- C:\Windows\System\woOXxNP.exe
  C:\Windows\System\woOXxNP.exe
  2⤵
  PID:6696
- C:\Windows\System\rlAMZdk.exe
  C:\Windows\System\rlAMZdk.exe
  2⤵
  PID:6136
- C:\Windows\System\MgGptrp.exe
  C:\Windows\System\MgGptrp.exe
  2⤵
  PID:7352
- C:\Windows\System\cJSZoco.exe
  C:\Windows\System\cJSZoco.exe
  2⤵
  PID:7384
- C:\Windows\System\PVPMmuB.exe
  C:\Windows\System\PVPMmuB.exe
  2⤵
  PID:7648
- C:\Windows\System\WaAtQVL.exe
  C:\Windows\System\WaAtQVL.exe
  2⤵
  PID:7872
- C:\Windows\System\IrGzthO.exe
  C:\Windows\System\IrGzthO.exe
  2⤵
  PID:8012
- C:\Windows\System\xZqZQJc.exe
  C:\Windows\System\xZqZQJc.exe
  2⤵
  PID:6296
- C:\Windows\System\JDBoZsB.exe
  C:\Windows\System\JDBoZsB.exe
  2⤵
  PID:7396
- C:\Windows\System\REoKLmB.exe
  C:\Windows\System\REoKLmB.exe
  2⤵
  PID:7584
- C:\Windows\System\WkTdDth.exe
  C:\Windows\System\WkTdDth.exe
  2⤵
  PID:7836
- C:\Windows\System\mODSewP.exe
  C:\Windows\System\mODSewP.exe
  2⤵
  PID:5648
- C:\Windows\System\dYTTjNR.exe
  C:\Windows\System\dYTTjNR.exe
  2⤵
  PID:7492
- C:\Windows\System\ruNdomd.exe
  C:\Windows\System\ruNdomd.exe
  2⤵
  PID:7676
- C:\Windows\System\ypJdmLF.exe
  C:\Windows\System\ypJdmLF.exe
  2⤵
  PID:7820
- C:\Windows\System\MUvbCyG.exe
  C:\Windows\System\MUvbCyG.exe
  2⤵
  PID:7940
- C:\Windows\System\eLyzRKq.exe
  C:\Windows\System\eLyzRKq.exe
  2⤵
  PID:7928
- C:\Windows\System\QhMzfxg.exe
  C:\Windows\System\QhMzfxg.exe
  2⤵
  PID:1668
- C:\Windows\System\BLDHWAX.exe
  C:\Windows\System\BLDHWAX.exe
  2⤵
  PID:5568
- C:\Windows\System\QAuPqaS.exe
  C:\Windows\System\QAuPqaS.exe
  2⤵
  PID:7664
- C:\Windows\System\FBEgxGH.exe
  C:\Windows\System\FBEgxGH.exe
  2⤵
  PID:8028
- C:\Windows\System\uOddsTr.exe
  C:\Windows\System\uOddsTr.exe
  2⤵
  PID:8116
- C:\Windows\System\bemRRpH.exe
  C:\Windows\System\bemRRpH.exe
  2⤵
  PID:7188
- C:\Windows\System\JDpVOeX.exe
  C:\Windows\System\JDpVOeX.exe
  2⤵
  PID:6924
- C:\Windows\System\hDXOUcU.exe
  C:\Windows\System\hDXOUcU.exe
  2⤵
  PID:6728
- C:\Windows\System\LHkvObS.exe
  C:\Windows\System\LHkvObS.exe
  2⤵
  PID:6392
- C:\Windows\System\ReOYVKN.exe
  C:\Windows\System\ReOYVKN.exe
  2⤵
  PID:3232
- C:\Windows\System\WBYQMba.exe
  C:\Windows\System\WBYQMba.exe
  2⤵
  PID:6220
- C:\Windows\System\xEFiftG.exe
  C:\Windows\System\xEFiftG.exe
  2⤵
  PID:7444
- C:\Windows\System\VlBXVxW.exe
  C:\Windows\System\VlBXVxW.exe
  2⤵
  PID:7960
- C:\Windows\System\qRgqkko.exe
  C:\Windows\System\qRgqkko.exe
  2⤵
  PID:7884
- C:\Windows\System\KTHmsnF.exe
  C:\Windows\System\KTHmsnF.exe
  2⤵
  PID:7732
- C:\Windows\System\yRWSllS.exe
  C:\Windows\System\yRWSllS.exe
  2⤵
  PID:7788
- C:\Windows\System\VGAXeBX.exe
  C:\Windows\System\VGAXeBX.exe
  2⤵
  PID:8168
- C:\Windows\System\qDmmDMg.exe
  C:\Windows\System\qDmmDMg.exe
  2⤵
  PID:7768
- C:\Windows\System\OWdmIlw.exe
  C:\Windows\System\OWdmIlw.exe
  2⤵
  PID:7120
- C:\Windows\System\MibdfRA.exe
  C:\Windows\System\MibdfRA.exe
  2⤵
  PID:6692
- C:\Windows\System\JWveZaF.exe
  C:\Windows\System\JWveZaF.exe
  2⤵
  PID:7784
- C:\Windows\System\AbsFigh.exe
  C:\Windows\System\AbsFigh.exe
  2⤵
  PID:7900
- C:\Windows\System\QTRVyGn.exe
  C:\Windows\System\QTRVyGn.exe
  2⤵
  PID:7236
- C:\Windows\System\bKKFeRg.exe
  C:\Windows\System\bKKFeRg.exe
  2⤵
  PID:7464
- C:\Windows\System\MwOPMMC.exe
  C:\Windows\System\MwOPMMC.exe
  2⤵
  PID:7556
- C:\Windows\System\WHIBPzH.exe
  C:\Windows\System\WHIBPzH.exe
  2⤵
  PID:6388
- C:\Windows\System\SzknMsa.exe
  C:\Windows\System\SzknMsa.exe
  2⤵
  PID:7888
- C:\Windows\System\WEmxRVE.exe
  C:\Windows\System\WEmxRVE.exe
  2⤵
  PID:7336
- C:\Windows\System\lldFcWh.exe
  C:\Windows\System\lldFcWh.exe
  2⤵
  PID:7744
- C:\Windows\System\qqmCXXE.exe
  C:\Windows\System\qqmCXXE.exe
  2⤵
  PID:6328
- C:\Windows\System\GRhNAUG.exe
  C:\Windows\System\GRhNAUG.exe
  2⤵
  PID:8080
- C:\Windows\System\LHFDuWO.exe
  C:\Windows\System\LHFDuWO.exe
  2⤵
  PID:8084
- C:\Windows\System\NtmNtNZ.exe
  C:\Windows\System\NtmNtNZ.exe
  2⤵
  PID:8196
- C:\Windows\System\VwtotcV.exe
  C:\Windows\System\VwtotcV.exe
  2⤵
  PID:8212
- C:\Windows\System\BowjpER.exe
  C:\Windows\System\BowjpER.exe
  2⤵
  PID:8228
- C:\Windows\System\niZhiyn.exe
  C:\Windows\System\niZhiyn.exe
  2⤵
  PID:8244
- C:\Windows\System\sBIMlXI.exe
  C:\Windows\System\sBIMlXI.exe
  2⤵
  PID:8264
- C:\Windows\System\hQgSGMn.exe
  C:\Windows\System\hQgSGMn.exe
  2⤵
  PID:8284
- C:\Windows\System\mqvFQLe.exe
  C:\Windows\System\mqvFQLe.exe
  2⤵
  PID:8300
- C:\Windows\System\MQRKsNA.exe
  C:\Windows\System\MQRKsNA.exe
  2⤵
  PID:8320
- C:\Windows\System\TrmvixK.exe
  C:\Windows\System\TrmvixK.exe
  2⤵
  PID:8336
- C:\Windows\System\PqiCOFB.exe
  C:\Windows\System\PqiCOFB.exe
  2⤵
  PID:8356
- C:\Windows\System\CXuexTp.exe
  C:\Windows\System\CXuexTp.exe
  2⤵
  PID:8372
- C:\Windows\System\biXtbME.exe
  C:\Windows\System\biXtbME.exe
  2⤵
  PID:8388
- C:\Windows\System\qcgCXuN.exe
  C:\Windows\System\qcgCXuN.exe
  2⤵
  PID:8408
- C:\Windows\System\PisyIou.exe
  C:\Windows\System\PisyIou.exe
  2⤵
  PID:8424
- C:\Windows\System\dzZoVQK.exe
  C:\Windows\System\dzZoVQK.exe
  2⤵
  PID:8444
- C:\Windows\System\afMmDMl.exe
  C:\Windows\System\afMmDMl.exe
  2⤵
  PID:8460
- C:\Windows\System\fQXUYyB.exe
  C:\Windows\System\fQXUYyB.exe
  2⤵
  PID:8476
- C:\Windows\System\FnUBCMR.exe
  C:\Windows\System\FnUBCMR.exe
  2⤵
  PID:8492
- C:\Windows\System\oCzinEs.exe
  C:\Windows\System\oCzinEs.exe
  2⤵
  PID:8508
- C:\Windows\System\fSaJwlM.exe
  C:\Windows\System\fSaJwlM.exe
  2⤵
  PID:8588
- C:\Windows\System\FyhZTCR.exe
  C:\Windows\System\FyhZTCR.exe
  2⤵
  PID:8608
- C:\Windows\System\wwMpRAT.exe
  C:\Windows\System\wwMpRAT.exe
  2⤵
  PID:8624
- C:\Windows\System\cKSWane.exe
  C:\Windows\System\cKSWane.exe
  2⤵
  PID:8644
- C:\Windows\System\BnsAUZV.exe
  C:\Windows\System\BnsAUZV.exe
  2⤵
  PID:8664
- C:\Windows\System\XJJNWtN.exe
  C:\Windows\System\XJJNWtN.exe
  2⤵
  PID:8684
- C:\Windows\System\cPXGSgQ.exe
  C:\Windows\System\cPXGSgQ.exe
  2⤵
  PID:8700
- C:\Windows\System\QYiPGrx.exe
  C:\Windows\System\QYiPGrx.exe
  2⤵
  PID:8720
- C:\Windows\System\UODIzmp.exe
  C:\Windows\System\UODIzmp.exe
  2⤵
  PID:8736
- C:\Windows\System\ATGNyMj.exe
  C:\Windows\System\ATGNyMj.exe
  2⤵
  PID:8752
- C:\Windows\System\grKqyIe.exe
  C:\Windows\System\grKqyIe.exe
  2⤵
  PID:8772
- C:\Windows\System\GPdssSe.exe
  C:\Windows\System\GPdssSe.exe
  2⤵
  PID:8788
- C:\Windows\System\AWZdbTD.exe
  C:\Windows\System\AWZdbTD.exe
  2⤵
  PID:8808
- C:\Windows\System\wprUKUz.exe
  C:\Windows\System\wprUKUz.exe
  2⤵
  PID:8824
- C:\Windows\System\hEwxuJT.exe
  C:\Windows\System\hEwxuJT.exe
  2⤵
  PID:8840
- C:\Windows\System\WAPgtqS.exe
  C:\Windows\System\WAPgtqS.exe
  2⤵
  PID:8860
- C:\Windows\System\RUSkENI.exe
  C:\Windows\System\RUSkENI.exe
  2⤵
  PID:8876
- C:\Windows\System\OWYNjhu.exe
  C:\Windows\System\OWYNjhu.exe
  2⤵
  PID:8960
- C:\Windows\System\lKPfSCA.exe
  C:\Windows\System\lKPfSCA.exe
  2⤵
  PID:8980
- C:\Windows\System\HAdQqVh.exe
  C:\Windows\System\HAdQqVh.exe
  2⤵
  PID:8996
- C:\Windows\System\FKeFyOt.exe
  C:\Windows\System\FKeFyOt.exe
  2⤵
  PID:9012
- C:\Windows\System\YFyPUwe.exe
  C:\Windows\System\YFyPUwe.exe
  2⤵
  PID:9028
- C:\Windows\System\WMzUDxo.exe
  C:\Windows\System\WMzUDxo.exe
  2⤵
  PID:9044
- C:\Windows\System\nUpCYiG.exe
  C:\Windows\System\nUpCYiG.exe
  2⤵
  PID:9064
- C:\Windows\System\QTxxbdb.exe
  C:\Windows\System\QTxxbdb.exe
  2⤵
  PID:9080
- C:\Windows\System\tMrqrbA.exe
  C:\Windows\System\tMrqrbA.exe
  2⤵
  PID:9096
- C:\Windows\System\TDRgbzN.exe
  C:\Windows\System\TDRgbzN.exe
  2⤵
  PID:9112
- C:\Windows\System\cGZxzTO.exe
  C:\Windows\System\cGZxzTO.exe
  2⤵
  PID:9132
- C:\Windows\System\aBlreei.exe
  C:\Windows\System\aBlreei.exe
  2⤵
  PID:9148
- C:\Windows\System\KlPznaB.exe
  C:\Windows\System\KlPznaB.exe
  2⤵
  PID:9164
- C:\Windows\System\ajQoHwB.exe
  C:\Windows\System\ajQoHwB.exe
  2⤵
  PID:9180
- C:\Windows\System\dUcxUlD.exe
  C:\Windows\System\dUcxUlD.exe
  2⤵
  PID:9196
- C:\Windows\System\vtBhWOe.exe
  C:\Windows\System\vtBhWOe.exe
  2⤵
  PID:8208
- C:\Windows\System\zjxAbUP.exe
  C:\Windows\System\zjxAbUP.exe
  2⤵
  PID:8240
- C:\Windows\System\JUWssoL.exe
  C:\Windows\System\JUWssoL.exe
  2⤵
  PID:8104
- C:\Windows\System\ulSsXnI.exe
  C:\Windows\System\ulSsXnI.exe
  2⤵
  PID:8252
- C:\Windows\System\bFwEeuT.exe
  C:\Windows\System\bFwEeuT.exe
  2⤵
  PID:8280
- C:\Windows\System\xzlpLSZ.exe
  C:\Windows\System\xzlpLSZ.exe
  2⤵
  PID:8292
- C:\Windows\System\YpmtEVB.exe
  C:\Windows\System\YpmtEVB.exe
  2⤵
  PID:8332
- C:\Windows\System\NZsMSRB.exe
  C:\Windows\System\NZsMSRB.exe
  2⤵
  PID:8404
- C:\Windows\System\XahqPTU.exe
  C:\Windows\System\XahqPTU.exe
  2⤵
  PID:8420
- C:\Windows\System\PoVkwby.exe
  C:\Windows\System\PoVkwby.exe
  2⤵
  PID:8504
- C:\Windows\System\UqhNzGY.exe
  C:\Windows\System\UqhNzGY.exe
  2⤵
  PID:8456
- C:\Windows\System\ZcWJkfa.exe
  C:\Windows\System\ZcWJkfa.exe
  2⤵
  PID:8524
- C:\Windows\System\oHSDIhM.exe
  C:\Windows\System\oHSDIhM.exe
  2⤵
  PID:8540
- C:\Windows\System\GCRnKOl.exe
  C:\Windows\System\GCRnKOl.exe
  2⤵
  PID:8556
- C:\Windows\System\MizIMPa.exe
  C:\Windows\System\MizIMPa.exe
  2⤵
  PID:1584
- C:\Windows\System\XCjCIfU.exe
  C:\Windows\System\XCjCIfU.exe
  2⤵
  PID:8616
- C:\Windows\System\bHkEaAn.exe
  C:\Windows\System\bHkEaAn.exe
  2⤵
  PID:8660
- C:\Windows\System\vRUdUDx.exe
  C:\Windows\System\vRUdUDx.exe
  2⤵
  PID:8732
- C:\Windows\System\fZlQmaV.exe
  C:\Windows\System\fZlQmaV.exe
  2⤵
  PID:8796
- C:\Windows\System\SVflkom.exe
  C:\Windows\System\SVflkom.exe
  2⤵
  PID:8856
- C:\Windows\System\AtzBnfh.exe
  C:\Windows\System\AtzBnfh.exe
  2⤵
  PID:8672
- C:\Windows\System\vWNCwdG.exe
  C:\Windows\System\vWNCwdG.exe
  2⤵
  PID:8676
- C:\Windows\System\gbZOGQE.exe
  C:\Windows\System\gbZOGQE.exe
  2⤵
  PID:8716
- C:\Windows\System\FSKoErd.exe
  C:\Windows\System\FSKoErd.exe
  2⤵
  PID:8784
- C:\Windows\System\XloUFdy.exe
  C:\Windows\System\XloUFdy.exe
  2⤵
  PID:8848
- C:\Windows\System\CaZUusz.exe
  C:\Windows\System\CaZUusz.exe
  2⤵
  PID:8896
- C:\Windows\System\barCLyy.exe
  C:\Windows\System\barCLyy.exe
  2⤵
  PID:8904
- C:\Windows\System\TgHDBIr.exe
  C:\Windows\System\TgHDBIr.exe
  2⤵
  PID:8924
- C:\Windows\System\IYUIULr.exe
  C:\Windows\System\IYUIULr.exe
  2⤵
  PID:8936
- C:\Windows\System\ioNZHog.exe
  C:\Windows\System\ioNZHog.exe
  2⤵
  PID:8952
- C:\Windows\System\AUbNGag.exe
  C:\Windows\System\AUbNGag.exe
  2⤵
  PID:8976
- C:\Windows\System\fWoUInx.exe
  C:\Windows\System\fWoUInx.exe
  2⤵
  PID:9040
- C:\Windows\System\CXCUSxU.exe
  C:\Windows\System\CXCUSxU.exe
  2⤵
  PID:9108
- C:\Windows\System\qoMrcyx.exe
  C:\Windows\System\qoMrcyx.exe
  2⤵
  PID:9092
- C:\Windows\System\yehtMha.exe
  C:\Windows\System\yehtMha.exe
  2⤵
  PID:9088
- C:\Windows\System\NERCias.exe
  C:\Windows\System\NERCias.exe
  2⤵
  PID:8988
- C:\Windows\System\OtFstmA.exe
  C:\Windows\System\OtFstmA.exe
  2⤵
  PID:9060
- C:\Windows\System\nLaexnf.exe
  C:\Windows\System\nLaexnf.exe
  2⤵
  PID:7908
- C:\Windows\System\OpVWsDB.exe
  C:\Windows\System\OpVWsDB.exe
  2⤵
  PID:9176
- C:\Windows\System\pmSpOJF.exe
  C:\Windows\System\pmSpOJF.exe
  2⤵
  PID:8204
- C:\Windows\System\eUmqMZq.exe
  C:\Windows\System\eUmqMZq.exe
  2⤵
  PID:8276
- C:\Windows\System\uRhQCpI.exe
  C:\Windows\System\uRhQCpI.exe
  2⤵
  PID:8312
- C:\Windows\System\FQjoTiY.exe
  C:\Windows\System\FQjoTiY.exe
  2⤵
  PID:8484
- C:\Windows\System\yJtoSJe.exe
  C:\Windows\System\yJtoSJe.exe
  2⤵
  PID:8532
- C:\Windows\System\DCqndAC.exe
  C:\Windows\System\DCqndAC.exe
  2⤵
  PID:8468
- C:\Windows\System\eSaSNGj.exe
  C:\Windows\System\eSaSNGj.exe
  2⤵
  PID:8520
- C:\Windows\System\uHWyZLK.exe
  C:\Windows\System\uHWyZLK.exe
  2⤵
  PID:8552
- C:\Windows\System\fNAukHA.exe
  C:\Windows\System\fNAukHA.exe
  2⤵
  PID:8768
- C:\Windows\System\AfPhIaz.exe
  C:\Windows\System\AfPhIaz.exe
  2⤵
  PID:8572
- C:\Windows\System\mAEzArl.exe
  C:\Windows\System\mAEzArl.exe
  2⤵
  PID:8836
- C:\Windows\System\VLrZwkW.exe
  C:\Windows\System\VLrZwkW.exe
  2⤵
  PID:8708
- C:\Windows\System\VgHClHz.exe
  C:\Windows\System\VgHClHz.exe
  2⤵
  PID:8892
- C:\Windows\System\huXSPgU.exe
  C:\Windows\System\huXSPgU.exe
  2⤵
  PID:7856
- C:\Windows\System\XiqgKEd.exe
  C:\Windows\System\XiqgKEd.exe
  2⤵
  PID:9104
- C:\Windows\System\bNknhtj.exe
  C:\Windows\System\bNknhtj.exe
  2⤵
  PID:9052
- C:\Windows\System\DbBJxkj.exe
  C:\Windows\System\DbBJxkj.exe
  2⤵
  PID:8220
- C:\Windows\System\hfCcnIF.exe
  C:\Windows\System\hfCcnIF.exe
  2⤵
  PID:8500
- C:\Windows\System\mBiznOi.exe
  C:\Windows\System\mBiznOi.exe
  2⤵
  PID:8548
- C:\Windows\System\rxaSbFI.exe
  C:\Windows\System\rxaSbFI.exe
  2⤵
  PID:8632
- C:\Windows\System\qCCsIHq.exe
  C:\Windows\System\qCCsIHq.exe
  2⤵
  PID:9008
- C:\Windows\System\LDhmuzy.exe
  C:\Windows\System\LDhmuzy.exe
  2⤵
  PID:9172
- C:\Windows\System\GtdpEqF.exe
  C:\Windows\System\GtdpEqF.exe
  2⤵
  PID:9160
- C:\Windows\System\vioOCvm.exe
  C:\Windows\System\vioOCvm.exe
  2⤵
  PID:8368
- C:\Windows\System\qTCipPf.exe
  C:\Windows\System\qTCipPf.exe
  2⤵
  PID:8728
- C:\Windows\System\JECKxuC.exe
  C:\Windows\System\JECKxuC.exe
  2⤵
  PID:8932
- C:\Windows\System\KadMbmq.exe
  C:\Windows\System\KadMbmq.exe
  2⤵
  PID:8260
- C:\Windows\System\YKLcGOr.exe
  C:\Windows\System\YKLcGOr.exe
  2⤵
  PID:8656
- C:\Windows\System\lsqqHHb.exe
  C:\Windows\System\lsqqHHb.exe
  2⤵
  PID:9020
- C:\Windows\System\MmjTAQW.exe
  C:\Windows\System\MmjTAQW.exe
  2⤵
  PID:8820
- C:\Windows\System\BzIcfTq.exe
  C:\Windows\System\BzIcfTq.exe
  2⤵
  PID:8888
- C:\Windows\System\eOyVrgq.exe
  C:\Windows\System\eOyVrgq.exe
  2⤵
  PID:8748
- C:\Windows\System\zLbmBgO.exe
  C:\Windows\System\zLbmBgO.exe
  2⤵
  PID:9208
- C:\Windows\System\uwtNufq.exe
  C:\Windows\System\uwtNufq.exe
  2⤵
  PID:9128
- C:\Windows\System\dBmnOdj.exe
  C:\Windows\System\dBmnOdj.exe
  2⤵
  PID:7988
- C:\Windows\System\UuUWEIJ.exe
  C:\Windows\System\UuUWEIJ.exe
  2⤵
  PID:9024
- C:\Windows\System\oJctrnh.exe
  C:\Windows\System\oJctrnh.exe
  2⤵
  PID:8580
- C:\Windows\System\ZILqtkm.exe
  C:\Windows\System\ZILqtkm.exe
  2⤵
  PID:8568
- C:\Windows\System\trkKXMm.exe
  C:\Windows\System\trkKXMm.exe
  2⤵
  PID:9188
- C:\Windows\System\XqyHxbj.exe
  C:\Windows\System\XqyHxbj.exe
  2⤵
  PID:9228
- C:\Windows\System\LMBjoTA.exe
  C:\Windows\System\LMBjoTA.exe
  2⤵
  PID:9244
- C:\Windows\System\lADnKop.exe
  C:\Windows\System\lADnKop.exe
  2⤵
  PID:9260
- C:\Windows\System\lkdBVQe.exe
  C:\Windows\System\lkdBVQe.exe
  2⤵
  PID:9276
- C:\Windows\System\VVJPyCA.exe
  C:\Windows\System\VVJPyCA.exe
  2⤵
  PID:9420
- C:\Windows\System\XSCFuMh.exe
  C:\Windows\System\XSCFuMh.exe
  2⤵
  PID:9436
- C:\Windows\System\YFTyRlc.exe
  C:\Windows\System\YFTyRlc.exe
  2⤵
  PID:9452
- C:\Windows\System\xWrlHgL.exe
  C:\Windows\System\xWrlHgL.exe
  2⤵
  PID:9468
- C:\Windows\System\aqJgxAH.exe
  C:\Windows\System\aqJgxAH.exe
  2⤵
  PID:9560
- C:\Windows\System\WxyIDlU.exe
  C:\Windows\System\WxyIDlU.exe
  2⤵
  PID:9580
- C:\Windows\System\iMskkpl.exe
  C:\Windows\System\iMskkpl.exe
  2⤵
  PID:9644
- C:\Windows\System\IJHBLnV.exe
  C:\Windows\System\IJHBLnV.exe
  2⤵
  PID:9660
- C:\Windows\System\CuavzPn.exe
  C:\Windows\System\CuavzPn.exe
  2⤵
  PID:9676
- C:\Windows\System\djmRTdn.exe
  C:\Windows\System\djmRTdn.exe
  2⤵
  PID:9696
- C:\Windows\System\TzZNbac.exe
  C:\Windows\System\TzZNbac.exe
  2⤵
  PID:9712
- C:\Windows\System\HcvvvUJ.exe
  C:\Windows\System\HcvvvUJ.exe
  2⤵
  PID:9728
- C:\Windows\System\TjjzczH.exe
  C:\Windows\System\TjjzczH.exe
  2⤵
  PID:9752
- C:\Windows\System\MCofQwM.exe
  C:\Windows\System\MCofQwM.exe
  2⤵
  PID:9772
- C:\Windows\System\zAhjFcL.exe
  C:\Windows\System\zAhjFcL.exe
  2⤵
  PID:9788
- C:\Windows\System\vRAdkqm.exe
  C:\Windows\System\vRAdkqm.exe
  2⤵
  PID:9808
- C:\Windows\System\nwvSJgO.exe
  C:\Windows\System\nwvSJgO.exe
  2⤵
  PID:9824
- C:\Windows\System\yNBydIu.exe
  C:\Windows\System\yNBydIu.exe
  2⤵
  PID:9840
- C:\Windows\System\bObyRri.exe
  C:\Windows\System\bObyRri.exe
  2⤵
  PID:9864
- C:\Windows\System\PYnkVKP.exe
  C:\Windows\System\PYnkVKP.exe
  2⤵
  PID:9884
- C:\Windows\System\ZlASxCf.exe
  C:\Windows\System\ZlASxCf.exe
  2⤵
  PID:9900
- C:\Windows\System\ohYPDJr.exe
  C:\Windows\System\ohYPDJr.exe
  2⤵
  PID:9916
- C:\Windows\System\HDthZCl.exe
  C:\Windows\System\HDthZCl.exe
  2⤵
  PID:9932
- C:\Windows\System\kVxGOnc.exe
  C:\Windows\System\kVxGOnc.exe
  2⤵
  PID:9948
- C:\Windows\System\VGQbcnF.exe
  C:\Windows\System\VGQbcnF.exe
  2⤵
  PID:9968
- C:\Windows\System\xFzsqEB.exe
  C:\Windows\System\xFzsqEB.exe
  2⤵
  PID:9988
- C:\Windows\System\qxlcsJO.exe
  C:\Windows\System\qxlcsJO.exe
  2⤵
  PID:10008
- C:\Windows\System\HvFFVCh.exe
  C:\Windows\System\HvFFVCh.exe
  2⤵
  PID:10024
- C:\Windows\System\zbyLasA.exe
  C:\Windows\System\zbyLasA.exe
  2⤵
  PID:10040
- C:\Windows\System\HhktYSn.exe
  C:\Windows\System\HhktYSn.exe
  2⤵
  PID:10064
- C:\Windows\System\SGErgJc.exe
  C:\Windows\System\SGErgJc.exe
  2⤵
  PID:10080
- C:\Windows\System\UvyZxtn.exe
  C:\Windows\System\UvyZxtn.exe
  2⤵
  PID:10100
- C:\Windows\System\TkgNfBa.exe
  C:\Windows\System\TkgNfBa.exe
  2⤵
  PID:10116
- C:\Windows\System\AaWzzeh.exe
  C:\Windows\System\AaWzzeh.exe
  2⤵
  PID:10132
- C:\Windows\System\VpSkyXw.exe
  C:\Windows\System\VpSkyXw.exe
  2⤵
  PID:10156
- C:\Windows\System\BQnmBqZ.exe
  C:\Windows\System\BQnmBqZ.exe
  2⤵
  PID:10172
- C:\Windows\System\FzAJRBB.exe
  C:\Windows\System\FzAJRBB.exe
  2⤵
  PID:10188
- C:\Windows\System\iyxJyve.exe
  C:\Windows\System\iyxJyve.exe
  2⤵
  PID:10212
- C:\Windows\System\aCCwJFG.exe
  C:\Windows\System\aCCwJFG.exe
  2⤵
  PID:10228
- C:\Windows\System\TsHEGMj.exe
  C:\Windows\System\TsHEGMj.exe
  2⤵
  PID:9252
- C:\Windows\System\JfeFzAo.exe
  C:\Windows\System\JfeFzAo.exe
  2⤵
  PID:9296
- C:\Windows\System\FYPCngP.exe
  C:\Windows\System\FYPCngP.exe
  2⤵
  PID:9308
- C:\Windows\System\pnXZdsZ.exe
  C:\Windows\System\pnXZdsZ.exe
  2⤵
  PID:9324
- C:\Windows\System\BpvbuHK.exe
  C:\Windows\System\BpvbuHK.exe
  2⤵
  PID:9236
- C:\Windows\System\wKNGQCi.exe
  C:\Windows\System\wKNGQCi.exe
  2⤵
  PID:9340
- C:\Windows\System\TNoLuHY.exe
  C:\Windows\System\TNoLuHY.exe
  2⤵
  PID:9356
- C:\Windows\System\SAiIUUf.exe
  C:\Windows\System\SAiIUUf.exe
  2⤵
  PID:9376
- C:\Windows\System\JQizGhk.exe
  C:\Windows\System\JQizGhk.exe
  2⤵
  PID:9388
- C:\Windows\System\CkQZhLE.exe
  C:\Windows\System\CkQZhLE.exe
  2⤵
  PID:9404
- C:\Windows\System\MGWzlsX.exe
  C:\Windows\System\MGWzlsX.exe
  2⤵
  PID:9444
- C:\Windows\System\uVwxphl.exe
  C:\Windows\System\uVwxphl.exe
  2⤵
  PID:9460
- C:\Windows\System\UvnhjtY.exe
  C:\Windows\System\UvnhjtY.exe
  2⤵
  PID:8912
- C:\Windows\System\JVUQFjP.exe
  C:\Windows\System\JVUQFjP.exe
  2⤵
  PID:9500
- C:\Windows\System\PCSpdtw.exe
  C:\Windows\System\PCSpdtw.exe
  2⤵
  PID:9516
- C:\Windows\System\wXUMNVO.exe
  C:\Windows\System\wXUMNVO.exe
  2⤵
  PID:9532
- C:\Windows\System\bdawGvz.exe
  C:\Windows\System\bdawGvz.exe
  2⤵
  PID:9536
- C:\Windows\System\vuqIKgY.exe
  C:\Windows\System\vuqIKgY.exe
  2⤵
  PID:9588
- C:\Windows\System\BEBsUeN.exe
  C:\Windows\System\BEBsUeN.exe
  2⤵
  PID:9596
- C:\Windows\System\qYHVoXD.exe
  C:\Windows\System\qYHVoXD.exe
  2⤵
  PID:9620
- C:\Windows\System\EgCVuxh.exe
  C:\Windows\System\EgCVuxh.exe
  2⤵
  PID:9656
- C:\Windows\System\GwDRuuv.exe
  C:\Windows\System\GwDRuuv.exe
  2⤵
  PID:9720
- C:\Windows\System\uLzpotm.exe
  C:\Windows\System\uLzpotm.exe
  2⤵
  PID:9672
- C:\Windows\System\LpSkvmB.exe
  C:\Windows\System\LpSkvmB.exe
  2⤵
  PID:9740
- C:\Windows\System\VVvMgAW.exe
  C:\Windows\System\VVvMgAW.exe
  2⤵
  PID:9628
- C:\Windows\System\xqJszwN.exe
  C:\Windows\System\xqJszwN.exe
  2⤵
  PID:9848
- C:\Windows\System\llmsDJR.exe
  C:\Windows\System\llmsDJR.exe
  2⤵
  PID:9668
- C:\Windows\System\FLQXmso.exe
  C:\Windows\System\FLQXmso.exe
  2⤵
  PID:9764
- C:\Windows\System\GFeSGdq.exe
  C:\Windows\System\GFeSGdq.exe
  2⤵
  PID:9800
- C:\Windows\System\IToKqIF.exe
  C:\Windows\System\IToKqIF.exe
  2⤵
  PID:9768
- C:\Windows\System\KJCAOGM.exe
  C:\Windows\System\KJCAOGM.exe
  2⤵
  PID:9880
- C:\Windows\System\AQwFMXm.exe
  C:\Windows\System\AQwFMXm.exe
  2⤵
  PID:9928
- C:\Windows\System\dLHBbKS.exe
  C:\Windows\System\dLHBbKS.exe
  2⤵
  PID:9996
- C:\Windows\System\PGYBgZb.exe
  C:\Windows\System\PGYBgZb.exe
  2⤵
  PID:10036
- C:\Windows\System\lNGbcdw.exe
  C:\Windows\System\lNGbcdw.exe
  2⤵
  PID:10048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AHvIezt.exe

Filesize
1.9MB

MD5
5d16802c53ac8930a9e2b17c8180b8fa

SHA1
4a960661eb0f351862cdfcd7bdf23ad87354f8b2

SHA256
6a4c9f349aab466714472e81e2954b23b32e41bb4b4c3686ae6cfeb8f1685ed7

SHA512
2a796adfcf79f2e316fd3e87fd64fd3fd4301b5102da48fe5f65df727faa540238f470d351a67189d1d8fefaab1591c3e8e13766e087540716fa47d911a7f8aa

Download Submit
C:\Windows\system\ARiEOUp.exe

Filesize
1.9MB

MD5
9edd3a09b5ae52ba7a74ac183cb7aa79

SHA1
bc92f544bdf31cc8c49f6256315a249020db0451

SHA256
826f2b26dafafc7932a7306f9b5224792530beefe16d06527c17d50b97cf772e

SHA512
5124e509691cdbca9f3fbebf7f1aeb2d03b36b9edbcc794da50f928c8cd96511bdad562b33e2aa2d6fd165b8c53fcd9fcd7f1b499ad7b63f2667fe3070f79407

Download Submit
C:\Windows\system\DviEsND.exe

Filesize
1.9MB

MD5
f4259374853b841f2774caf7fbd9e974

SHA1
52b0cd10dd723f064179f9048efdce990a36ea41

SHA256
9242d1da4720b4ae8e439616c7ac3b394efe2993a891edfaf9a340a7ae981a31

SHA512
f2dc7ca04b96a1e09109b3cd2013dcdcf675ab2c009fe44317a268597f8d3eaf3866b2cc1661cc95e8d68b9d4824a01349c192e567c94b2fede1ebe5f32a0486

Download Submit
C:\Windows\system\GegrYje.exe

Filesize
1.9MB

MD5
9066359c3580fa6a912a4f28d0bf513f

SHA1
ca0d63b98ed57f6503fe38b110acd561b2eafb93

SHA256
d740df4a03779e959cc89863bb45797bd56d8dec0a0503572c86b59d0102e90c

SHA512
d6d125939087de53a0718b699c0ffc1e4d2f78660034a9bc6ab51524a81eeb5ff6609ef280229e9bad68621ae7af0e374c68b16fa358c9929752bacced7a3dcf

Download Submit
C:\Windows\system\KOxABOJ.exe

Filesize
1.9MB

MD5
c8ae1b8809ab74741ca1559c40fb3414

SHA1
62899979cf50ed6fc0922a81c33006c88028d0be

SHA256
eed5155b32218238699538340df90b8a4836f93eb21d86279fc63bea1fc69d6c

SHA512
cb5a73fe1122b09c74637f3c6e5787a4f80cf6bef8ed9d0105ba1d15a5e4a316855690ec90bd69d4c6615348656839a7d14f2ecedddca8ef6468cf24e0824a2d

Download Submit
C:\Windows\system\KcBrTrQ.exe

Filesize
1.9MB

MD5
f3ef2889ee8a3c167ea071d1685a15a0

SHA1
e99a457c54d4f76bfb62a6d315304a6ac3e36021

SHA256
91e0f4ee50bd0d710d011dca54fdc6d75982506710b4723a623cdfa15124ab23

SHA512
c18a15b33e368e8162be338cc7ec78e7deb97ce68dc979f76b2d380e9f76937744a34f2ae5d1f465659daec47cf160bc4360795398a5546a7af0ede69c9bbad1

Download Submit
C:\Windows\system\NEEJfxp.exe

Filesize
1.9MB

MD5
55e9f4c8b734a49eadaf00f135d00514

SHA1
864fe7f6f53ff9cc071a231babfedb3cf341a4da

SHA256
0ec69ca65005c244a2dbe0862dedddf059321cdbc3d37c10c72b8bcd4e2cb02e

SHA512
8d5a95e33116334afe6e97845a02666a738a34f9ec46741a6e891850996a360d06f8d1ede7b11cf3d783a86639e7c056b9b23d796b20ffe990548af1219d4d70

Download Submit
C:\Windows\system\PPEmUMf.exe

Filesize
1.9MB

MD5
3c8bf319154002dd9539976de2503437

SHA1
8b8639f1eb5836d50b3245475e128a314d072145

SHA256
22eae25a68061559d8c40ae35c8de4f7d22f38d62d86614939ad72fd2889e90f

SHA512
095ba49a3d1e177d1518b93cb6850dfd43001757170dc4ee35394e45501cee27ae2e4970a86bd2c01170e73e7b827536955d92395f6f12747af1d2c281961dff

Download Submit
C:\Windows\system\PUocMEI.exe

Filesize
1.9MB

MD5
7a6ecea9a3ff3b667ed7810ce0767711

SHA1
92d6db86985920d7271715d01dcda2a23e66c86e

SHA256
91fdea88c00911053c6e090f1a7d00344591bef8f565cf180efa62836ab44c36

SHA512
2352f6ea24acf409b4d6005306b04df37b48e5f847dbf11e05479cc1d4bc9cf72850ba252ca9bebef4278a2e20305d369d60f3407f9e7f0f0397f75e2609f362

Download Submit
C:\Windows\system\QnfKyCq.exe

Filesize
1.9MB

MD5
a4dac6c16a70542af32180219eb1a102

SHA1
af6f7fcd017998746298bfc42cfa05346ac1e69b

SHA256
4ab4d4775a502adbd5d316d367f4f5cdb9f3f0ef0f69fa2783563097948d65fb

SHA512
9aae245b4ba097cbdb5d03dc99badaca37cc30ea10c4849f84085f16407609d061ff8ec1b9fce9b96bcfe9803a7e77858212db1b7c577dd3097fdfb93bda1d60

Download Submit
C:\Windows\system\XNxzoNS.exe

Filesize
1.9MB

MD5
37a6d2d0dd56e54936371931c1e77c1e

SHA1
cc262e69d05305257bd6c2bc1b46f6dd6aad69e1

SHA256
f53b58101734c52605b01dae55d6213e5299482bfdffefafaeb76b1c69c8c90c

SHA512
2f725bcdd101b338b8be84bdc1036123a7b4dc2191d228379b2a8cfc3e779b29cc53b0289c86dd938218e32f60ab397874591319b4f033b915dced0a6154d00f

Download Submit
C:\Windows\system\ZvHcoqp.exe

Filesize
1.9MB

MD5
3159552a9c09e12f1df5a612ccc614e5

SHA1
e32b0b05b9375a01213e12300c0c3328f0ba1421

SHA256
9c9ffd5ae2f7b6f54e9c54f39298ce1c4ad48699f8e780e67c421064799bb09b

SHA512
aa423027761fc805330ab444aaa47ad210f968968a8b7caf4eb84b680888f009497d1f9b8c30e5d8312ed96123cab8534800a6ccff34abb2bc424ed1ace5e34a

Download Submit
C:\Windows\system\dhvXaHU.exe

Filesize
1.9MB

MD5
5164e759e8fd4f90841db2a7ec4985ff

SHA1
e3297987ddde72a046b8bfb159c063f0acabfda2

SHA256
96f47da0e66862d27f09c2fa9d469c0b7975c0af201f48f7770a1c43309667ce

SHA512
79403e7418cb3750e638168bd499674164ec32df78959f2636b016ebbb3824d655a9742a0eababf1236f2a00082b80827f4cdb55dab53fe1432905559df2a6d3

Download Submit
C:\Windows\system\hAPGCGS.exe

Filesize
1.9MB

MD5
177f7b3e5a013ca70a1d2b74a8eff953

SHA1
2f469e9415102b7f953db96c198e95677b5ea6bf

SHA256
0ab2900670c18cae2c942cfb3962aac537f5a33b619da7a8f8679da7c9d0fcab

SHA512
f5ce50b784c6c0c4136485562337ded131f8eaf63a08fbdf5ec09452ea2183033cd63bc6e28de8d29574b96803e74b54bc0ca37ad0336527825299f93dc312d2

Download Submit
C:\Windows\system\icTcrZX.exe

Filesize
1.9MB

MD5
fff68362db0fe8f1d3388d2081d0873b

SHA1
a407bb2f3708ae6093868362bb6e619711ddd13a

SHA256
81d753ea0334550d849b24f1fad62b8795f80866777e838010619e90c21c8c75

SHA512
0705070280519a9f6ca8d7485d22e1808418d150adc715b4bd4f30aaa387338414645ed6e8d766a3bc7ab16aab3e309efd37b0439882349b81973862e659317e

Download Submit
C:\Windows\system\klVPPWH.exe

Filesize
1.9MB

MD5
8f30bd438c77d175716a27f2baec3df0

SHA1
45e8a729a59a970063e5be3dab88aa49fc35fdf7

SHA256
3441783d7e301c8c5bfdd4595eb6bee5eb88923a090156766c4dfaf09ca8a824

SHA512
0f0c0fb8c611e576cef0880dbbcff299cf98f3234266b8fd5bda36312b9f9cb52ac8f64e35cd97d53a88e99a6729435804703c675e515cd2843b2a5cb1f845d8

Download Submit
C:\Windows\system\ltRYbhU.exe

Filesize
1.9MB

MD5
9a83e3ac1bf05a4cefe5a4ece896b0e3

SHA1
ca99e9015b26b627e0f7dc80398519e0415ab84a

SHA256
480bb09a8a523f2d0939523b0899eec34d16f539ffb55734f4f13634290b6083

SHA512
c582093e3db7b6381c6e0dd77d553afa35a2281c2d0e1af159f167cd07e86ed814332e6872742c125876c6a00057e0cd9506f3994aa04dd9a4f7e71be22152ad

Download Submit
C:\Windows\system\tHEJgud.exe

Filesize
1.9MB

MD5
49d9a81750e37c714ae0e0c075bce04a

SHA1
574662d3801f5ca7956bde7868305dc7ca36074b

SHA256
bf9f7eb4778ef30f4e2b321d5a01ec4e81616d9e811cc983947a180483f3eead

SHA512
5e7b21ff627314843a39453faa7f7887aeef2d45b6aaefd4309976716980164859ab24a022add653fb7391ed03a0fe950afe18caaea5e6fc10e466efafed01be

Download Submit
C:\Windows\system\usBBajq.exe

Filesize
1.9MB

MD5
6d1767603bf022e28e9105732b4600c7

SHA1
d308b282757b99a1261538916f83bf16effd43e9

SHA256
eb4360e4dbb5061f2114d9244249e98597a1d5e58f3053ce6216d8522c1f9895

SHA512
681af34dc37c0d6e643516275fcd9d7ce8ea64f7ab039de2a6586dd9b543765c65126e63fdff3c4ef4ecc3983f048b9caa7ccc182aafe5bfbce47333e57719e4

Download Submit
C:\Windows\system\wShhrRp.exe

Filesize
1.9MB

MD5
20dccd8a820ca9f7d71481ff84e93d95

SHA1
a9af860e02646c0def4b912d4457f4359b477a0e

SHA256
bede17f13f8bd115c2de61e7627adb9c1ef4df6d14c434943d18db18258356b7

SHA512
be51aea61696a7e76867f2cd4de5dffef3eda0a0aa422eea5f2e80a423399788f48aad54776e8a72022de57ae7849e5c7ae0c5f26684ab733ff889ca88184afc

Download Submit
C:\Windows\system\zjnIKmS.exe

Filesize
1.9MB

MD5
b9cf99b07f3bc53d62845dd590f349e3

SHA1
58279096c12d72a9d983ec462f1631827dc452ac

SHA256
ef42d67b254cfb8add7b6512d51923779a3b0c9b60c8af1b28d6f26ce1ca0d7f

SHA512
3ca93c0078c3b36081db374eaf1925b23abdaba03473a2a5ccb0a396a331a95391809cdb4e9aaab140bc3c2aeb0bc728694715e3d674e67ab01260881c66a375

Download Submit
\Windows\system\EmxHoRk.exe

Filesize
1.9MB

MD5
f217805fa360fdb61ab839ffdc352f1d

SHA1
46c12104e9b1be0ca67ebee42db2200186486109

SHA256
dae6a2e17b51e4cd8ecbd735014d2f9edfed20de3c3da391be66ebfa0d4af38b

SHA512
0ad7d97730e8c46c825c1503f039faef2374dd6d4f5e646b354b88f6e6da22c7afa9246f9a81d41129455043d23fa9f804ca0158bc8c172f9726d3bc17b08db4

Download Submit
\Windows\system\QdVCNFB.exe

Filesize
1.9MB

MD5
e78d9c44270b2f42a12f9b6acb28ed9a

SHA1
8806c353a783555eea814442bc851b5c1ebc133f

SHA256
5697b14a38af7e1ea8aad0f7c185a7c0b17bda06d0ba06aa1460eef5a43af617

SHA512
29c7332ca4f01277d662b9cd1d75c9360a2e8bd7f3f40a2323e5af760e4d069787395b545f573f1195520388f61cf47dc9c70065cdb5b10c8a961ce7a49e780d

Download Submit
\Windows\system\XFsnDWS.exe

Filesize
1.9MB

MD5
4d81b0a348a45c7fe68131476ea55ed1

SHA1
0e7c7e5dabbd99d294e307d9406abcbd7b40ee38

SHA256
be32ebbc2723ac8ec1e70a671e71c50ed8bfc35cb7097e2a3261528ce50983a3

SHA512
4d84fc687d454936b5efd5ac4e32fa7f548746e860a5180ee05ceb06b1c78265473883aa39327a26fed318bea6cb1db1c80c2541f1b72dfef58e7e7f4266770a

Download Submit
\Windows\system\ZWRxmEC.exe

Filesize
1.9MB

MD5
6e3fb30ae86fc98cba99680705632ac0

SHA1
5ff4b1e7edbfb5f2ee15343b33fe50de8b54b80e

SHA256
fc4affccda5bd59a47b39ec69f8ba2187368206d04d8840bb19bce20a6ebbd72

SHA512
99b841d806450315247ed0e2381d80667ea07e9d2766d94f28a8f7c24a79ead909ff8b711ba64a4a7f5c708a6319bfb14fc971f457f4d1ce42ef04b23e8274a1

Download Submit
\Windows\system\cDACLev.exe

Filesize
1.9MB

MD5
7460904ef768778202197771794b5625

SHA1
7816f4350293af6781a75d856a39d909721dbf11

SHA256
9a0987d123d28f56c04c57ca0daeb7d1489da4130190ecb39a3db693069c541a

SHA512
7f3b26108e5a07ddfcd36c8860d2b12fca75bfb947a8aadb25a07c75b78edb77ca0a61cdc9569d8413a5f083d7624f6e91cd965a4e26984056dcecff14d53acc

Download Submit
\Windows\system\eZOJoHv.exe

Filesize
1.9MB

MD5
e9d3f1babf46a24507508b7a95049a3b

SHA1
720912070bc0c87e2b626c76093eef937da43519

SHA256
e17c61f217ba03e6946c2f0c11f7f60a90ce6b87b674dac1fc8f40c6046acf82

SHA512
ac50e80384c38e60bf606a85a71a53394514086c12556cb13f1927593885e88fca4fe50fe1b9ec55d88838654dec01408adb8530c9df8f118d4f09bdf0a68104

Download Submit
\Windows\system\gsbpEyi.exe

Filesize
1.9MB

MD5
e822e76b0b937ef939d2e05f4cce0d41

SHA1
6eddaeb89401464eb19eabdc1d898d2a8144cd81

SHA256
3260cee5411f5264da057be877247e4351e3e0915f28150a7bf8fa0c1a7a34be

SHA512
ab0c607305c853b3643b0c1d589733f69fec7587d737f7bd8fe04fd8d3589d921ac39d78eb9c2c3d3de4230bff43ec1af613bb5de801d2c01448a3d94e3dd896

Download Submit
\Windows\system\hFPUWSg.exe

Filesize
1.9MB

MD5
008b7558fce2bd82d1ec57347bac3cc0

SHA1
456fb3d624cec6827518155d0f38997ff898671a

SHA256
3d3a0022ce147bc4f36b6c6ae2ce06ad699937d7c6bb66aea2a58e0148dcac6b

SHA512
92b292e8bf8883e594084f488a9368b00b24017a6001d9e512aa2b8a58a9ed6684bf2c7d12a057b004360dc53f9bdce2bc56b2d72f63d4c7cbee055761281c5d

Download Submit
\Windows\system\jDlURWR.exe

Filesize
1.9MB

MD5
432feccadc09f9693744dd14ea3fe6e9

SHA1
34452d5acb45f27f51c236e35e1ab04af1d32d18

SHA256
fc054f39b5e2e89383ed9f647beb86a2c0ff8714d61dc7bfb337250a5c7c7843

SHA512
f45fbdccd3ccf26c7c1c829055a5ed12da893c1b378c13732b895318f96c689e1da35873a9fedd4cd7f7e28ba27599755f9209db8fc7409d9c21f980aed6760c

Download Submit
\Windows\system\jQxpPpE.exe

Filesize
1.9MB

MD5
2aa809980c167f1ed5fcc7338505cc41

SHA1
d1a9483daaa47faffcdac052c08b6f144d45f899

SHA256
61c8b73c9becad016b52351082a2336cb23de88a26b187b9fc8de7e8192ba102

SHA512
fc98010c7387ce374b243133a637d940e7ef04ae708501f6a953c8af08d882a1242c50bac927c30557b35ae79a21b6cd658a004592a5bcc6683f97d3e4ea8113

Download Submit
\Windows\system\jfmMSzm.exe

Filesize
1.9MB

MD5
6a2baac7543ec1231fba57db923232a2

SHA1
da584caa20dd1b906d068667ef1a6fbe85987417

SHA256
69cf848565f17619438a2513bf4649829916372690d0205cb88e5f75956ebf00

SHA512
77eac3af3159930b432f1c0b7007d81352a9a378311977cf7ea2242a727541e7525153c777883e0ccdb30fc865840d24aaace5c8a02d7ac4ba88a5f32d518a18

Download Submit
\Windows\system\qUEsFnn.exe

Filesize
1.9MB

MD5
c5c1fb667def6ab5d5e09fd544815f2b

SHA1
c2791a2295fab38435a6d1fb22b4d6932d0d60c0

SHA256
b71488065f538d4ae605aa22ba6a0a8911d18e01cb2dbbbc1c1809dd201db421

SHA512
ff76a357daa325461066da169bc9b48160a4bf899a490c6bc893a496cd42a0867b14d99114a9d75e5805926a5858dcb19e93775ca63cc8e25c7ae144cd8a29d2

Download Submit
\Windows\system\uDpvUDk.exe

Filesize
1.9MB

MD5
ad674bd92f9ea4d19a25dcb14be34703

SHA1
6632fcaa24ced3a9f100dbeba5b67d31020eea7b

SHA256
5023b052aa55cc71da67072333df86d0ec2707d059db249755f759ebda964b4d

SHA512
ee7ec4dfa71f52865f7734e2782c56986f2a7307b9afb796531bbe92c59722ca415ecb763ead4504daddae138c6496c335feba103c4a0c7415fed9c2793c3164

Download Submit
\Windows\system\vDuAlus.exe

Filesize
1.9MB

MD5
72ed94b561ff74e50c3e4379273cfbf8

SHA1
bcef4fb65b8b9dc3240073ed801a33dd390dd6d6

SHA256
bd0e7600dd2312912342282793ff74a56a795334b8fe478f05326d0058dd6e8b

SHA512
dbb25c2a8318db47c669d98aff5ff9133afd5540c9590ad0d2b995d26ec18b9484452ce9fc1e9a79314ce85e6fb36e39d992c4c55035efe647b1d01e43757d9b

Download Submit
\Windows\system\wPeMHVQ.exe

Filesize
1.9MB

MD5
eec7f01b7a1ab7bdfafb5334f604a78a

SHA1
ce134e5a5cb76b33f70b5c55cd7847dbe5c56bb6

SHA256
b5993605f9197e162e481296eb2ac57d9e08e8aa463d04e0755470e8c34ff830

SHA512
444e40fe7b8b5ec3c6b6163e53c1e30f49b3dfa4b69e4903ca920569b8cf18e47592b4faa04fba99d64e6fb1ddf032132185a6459a29afdedfdd8b2aedf8c318

Download Submit
\Windows\system\ygQgqxC.exe

Filesize
1.9MB

MD5
1256af18f6a699afd564bc739525336b

SHA1
7d9a05e028162d38a8406c4ff21ec4cf0b08b8ea

SHA256
d314e6afdfc91d73212fd6f52ac983f9a2e6242edf80e9281136ed7a3e29d791

SHA512
91107bfff5b973d7e1b8f7dce352926c52d99ba5af0c0f7be4eab7151f0d7639d1967b8224414628e42f32d72a499ab8c7745a4e114f9e586af37edcc5bc13bf

Download Submit
memory/1256-538-0x000007FEF61D0000-0x000007FEF6B6D000-memory.dmp

Filesize
9.6MB

Download
memory/1256-208-0x000007FEF61D0000-0x000007FEF6B6D000-memory.dmp

Filesize
9.6MB

Download
memory/1256-14-0x0000000002D20000-0x0000000002DA0000-memory.dmp

Filesize
512KB

Download
memory/1256-51-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/1256-209-0x000007FEF61D0000-0x000007FEF6B6D000-memory.dmp

Filesize
9.6MB

Download
memory/1256-242-0x0000000002D20000-0x0000000002DA0000-memory.dmp

Filesize
512KB

Download
memory/1256-71-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/1256-236-0x0000000002D20000-0x0000000002DA0000-memory.dmp

Filesize
512KB

Download
memory/2104-227-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2148-13-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2288-229-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2288-241-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2288-210-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2288-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2288-8-0x0000000002E70000-0x0000000003262000-memory.dmp

Filesize
3.9MB

Download
memory/2288-234-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2288-235-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2288-214-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2288-238-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2288-2-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2288-230-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2288-224-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2288-228-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2576-232-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2764-213-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2832-231-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2872-233-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2924-223-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download