xmrig | 5df2d447337febed9b4763fc627836e58c7f252ad053946afd2a7136a6d036cd

Analysis

max time kernel
25s
max time network
20s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
Size

1.9MB
MD5

09c6d85fbf8658512caadc52a0720792
SHA1

0e014f4c7685fc4201fb4dfc002ab59bb8fd12c4
SHA256

5df2d447337febed9b4763fc627836e58c7f252ad053946afd2a7136a6d036cd
SHA512

9d6f80989fd3cbc8e5316fc969352c44c46d29293a0f34963947483aa2a29788a4422be87f87c56abba87202a3744fb9dc7a9089928d740016e29ee45a878611
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1y:NAB5

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral1/memory/2732-51-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2920-77-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2828-49-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	xmrig
behavioral1/memory/2708-46-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2660-44-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig
behavioral1/memory/2284-43-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2172	AyfJwXQ.exe
2284	oxrqjEH.exe
2660	XwqwKWM.exe
2708	lssGRhA.exe
2828	ESrbokf.exe
2732	oJhPLke.exe
2460	VwtiADB.exe
2908	MkPGykD.exe
2920	tYquPeR.exe
640	gnqBGtw.exe
2752	PvpyvTj.exe
2808	TFqFSLH.exe
2240	YVCXARb.exe
1976	XvdgaZV.exe
2180	VUSXNEl.exe
1864	kBJfyJG.exe
1072	JfCqdCm.exe
1048	SyGnLRW.exe
2132	CuiQCmV.exe
2800	peFKhzx.exe
2856	qoGfybR.exe
604	uRkgFBk.exe
592	QSAZoBH.exe
3016	ArgocJN.exe
1096	YVwMFzq.exe
448	ZlqzBJI.exe
1400	ryiBceo.exe
1604	lklwxHW.exe
1548	ktDKMxF.exe
624	LrVTHPH.exe
2344	uPGUZCa.exe
924	vJEbfwi.exe
1760	UqtzmhW.exe
332	jMwJPCB.exe
1260	xjjFnfS.exe
1596	HaqbdYN.exe
1512	oReaNfN.exe
2384	CLAofdd.exe
1612	VaaMgMm.exe
2624	sWgRynT.exe
2636	JDFzdBr.exe
2804	YVqXNLJ.exe
2816	nSjwcPr.exe
2764	kuUQDPI.exe
2380	fywcKxd.exe
2252	AjhRqdA.exe
2832	azFIpcC.exe
2664	MHMeAXq.exe
2684	DHuIYwy.exe
2360	BOiDKOk.exe
1296	BXgAXkT.exe
1452	GzAIGjy.exe
1948	RuthnNg.exe
1928	OJYJSSC.exe
1672	eCmStof.exe
2096	nvLxAxK.exe
2088	Ahnejky.exe
2260	tRgEGUB.exe
2268	pJLLixh.exe
800	tHTfeFT.exe
600	ijOBBrG.exe
2916	bVfPhpI.exe
1136	YShNFer.exe
1144	ZKWnvpJ.exe

Loads dropped DLL 64 IoCs

pid	Process
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2944-2-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/files/0x000c00000001450b-6.dat	upx
behavioral1/memory/2172-8-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/files/0x0033000000014983-17.dat	upx
behavioral1/files/0x0007000000014e5a-11.dat	upx
behavioral1/files/0x001400000000549e-27.dat	upx
behavioral1/files/0x0008000000015136-32.dat	upx
behavioral1/files/0x0007000000015362-35.dat	upx
behavioral1/files/0x00090000000155e3-55.dat	upx
behavioral1/memory/2460-56-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2732-51-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/files/0x0006000000015cca-70.dat	upx
behavioral1/memory/2908-67-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/files/0x0006000000015cec-83.dat	upx
behavioral1/files/0x0006000000016411-120.dat	upx
behavioral1/files/0x0006000000016c26-141.dat	upx
behavioral1/files/0x0006000000016cfe-169.dat	upx
behavioral1/files/0x0006000000015cdb-72.dat	upx
behavioral1/files/0x0006000000016d17-178.dat	upx
behavioral1/files/0x0006000000016d06-171.dat	upx
behavioral1/files/0x0006000000016cf5-164.dat	upx
behavioral1/files/0x0006000000016ce1-157.dat	upx
behavioral1/files/0x0006000000016cab-150.dat	upx
behavioral1/files/0x0006000000016c2e-143.dat	upx
behavioral1/files/0x0006000000016c17-136.dat	upx
behavioral1/files/0x00060000000167ef-129.dat	upx
behavioral1/files/0x0006000000016277-115.dat	upx
behavioral1/files/0x0006000000016056-108.dat	upx
behavioral1/files/0x0006000000015f1b-101.dat	upx
behavioral1/files/0x0006000000015d5d-94.dat	upx
behavioral1/files/0x0006000000015cf7-85.dat	upx
behavioral1/memory/2920-77-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/files/0x0006000000016d1f-183.dat	upx
behavioral1/files/0x0006000000016d0e-176.dat	upx
behavioral1/files/0x0006000000016ced-162.dat	upx
behavioral1/files/0x0006000000016cc9-155.dat	upx
behavioral1/files/0x0006000000016c7a-148.dat	upx
behavioral1/files/0x0006000000016a45-134.dat	upx
behavioral1/files/0x0006000000016597-127.dat	upx
behavioral1/files/0x00060000000160f8-113.dat	upx
behavioral1/files/0x0006000000015f9e-106.dat	upx
behavioral1/files/0x0006000000015d6e-99.dat	upx
behavioral1/files/0x0006000000015d06-92.dat	upx
behavioral1/files/0x0007000000015cc1-64.dat	upx
behavioral1/memory/2828-49-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/memory/2708-46-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/2660-44-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/memory/2284-43-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/files/0x0006000000016525-122.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\InuSIah.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\yXJVJiH.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\tKyvUrP.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\CLAofdd.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\rlwTwnu.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\HsOuaFE.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\yYMiRoV.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\qAArhvM.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\HqGqfgJ.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\gzEFfiX.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\laWvMmf.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\NrQLElA.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\OdnbmtO.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\miFrKld.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\nUcpILL.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\RWlTkKE.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\mCXNTLv.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\WPkxDNY.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\LvkgtzF.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\nUydgGM.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\qxFMdyq.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\YShNFer.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\gDOyggr.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\WtyyAnY.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\BicHQCW.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\jBnhRti.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\SGmAtCz.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\XiwFugt.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\TqGutYo.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\egsffqc.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\OjDMrhG.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\LnUNcVx.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\jYCgEOT.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\CiurUQC.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\ywVyCdC.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\VSBOzzg.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\wMOgbTp.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\ReiABMG.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\OXEIKBA.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\OTyROrb.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\UAtxSZB.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\blYStZO.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\Ldtgvoo.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\SKiHpTr.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\dbqpYDZ.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\VsIiOxo.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\DqWOZbd.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\CFpdBjQ.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\TzFjVuW.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\vmzEmBW.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\HReYrOs.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\YfdvtJY.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\jyxFxgc.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\zLzTnlh.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\qBGBfjZ.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\SQyWXEg.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\NKkNSJw.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\ZSJljEC.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\bsreABB.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\mktSVQV.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\SWLkwUO.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\sqvrwGL.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\AzomGSD.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
File created	C:\Windows\System\sLbytRz.exe	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3036	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
Token: SeDebugPrivilege	3036	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 3036	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	29
PID 2944 wrote to memory of 3036	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	29
PID 2944 wrote to memory of 3036	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	29
PID 2944 wrote to memory of 2172	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	30
PID 2944 wrote to memory of 2172	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	30
PID 2944 wrote to memory of 2172	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	30
PID 2944 wrote to memory of 2284	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	31
PID 2944 wrote to memory of 2284	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	31
PID 2944 wrote to memory of 2284	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	31
PID 2944 wrote to memory of 2660	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	32
PID 2944 wrote to memory of 2660	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	32
PID 2944 wrote to memory of 2660	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	32
PID 2944 wrote to memory of 2708	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	33
PID 2944 wrote to memory of 2708	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	33
PID 2944 wrote to memory of 2708	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	33
PID 2944 wrote to memory of 2828	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	34
PID 2944 wrote to memory of 2828	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	34
PID 2944 wrote to memory of 2828	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	34
PID 2944 wrote to memory of 2732	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	35
PID 2944 wrote to memory of 2732	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	35
PID 2944 wrote to memory of 2732	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	35
PID 2944 wrote to memory of 2460	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	36
PID 2944 wrote to memory of 2460	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	36
PID 2944 wrote to memory of 2460	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	36
PID 2944 wrote to memory of 2908	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	37
PID 2944 wrote to memory of 2908	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	37
PID 2944 wrote to memory of 2908	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	37
PID 2944 wrote to memory of 2920	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	38
PID 2944 wrote to memory of 2920	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	38
PID 2944 wrote to memory of 2920	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	38
PID 2944 wrote to memory of 640	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	39
PID 2944 wrote to memory of 640	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	39
PID 2944 wrote to memory of 640	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	39
PID 2944 wrote to memory of 2752	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	40
PID 2944 wrote to memory of 2752	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	40
PID 2944 wrote to memory of 2752	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	40
PID 2944 wrote to memory of 2684	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	41
PID 2944 wrote to memory of 2684	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	41
PID 2944 wrote to memory of 2684	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	41
PID 2944 wrote to memory of 2808	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	42
PID 2944 wrote to memory of 2808	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	42
PID 2944 wrote to memory of 2808	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	42
PID 2944 wrote to memory of 2360	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	43
PID 2944 wrote to memory of 2360	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	43
PID 2944 wrote to memory of 2360	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	43
PID 2944 wrote to memory of 2240	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	44
PID 2944 wrote to memory of 2240	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	44
PID 2944 wrote to memory of 2240	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	44
PID 2944 wrote to memory of 1296	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	45
PID 2944 wrote to memory of 1296	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	45
PID 2944 wrote to memory of 1296	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	45
PID 2944 wrote to memory of 1976	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	46
PID 2944 wrote to memory of 1976	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	46
PID 2944 wrote to memory of 1976	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	46
PID 2944 wrote to memory of 1452	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	47
PID 2944 wrote to memory of 1452	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	47
PID 2944 wrote to memory of 1452	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	47
PID 2944 wrote to memory of 2180	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	48
PID 2944 wrote to memory of 2180	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	48
PID 2944 wrote to memory of 2180	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	48
PID 2944 wrote to memory of 1948	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	49
PID 2944 wrote to memory of 1948	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	49
PID 2944 wrote to memory of 1948	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	49
PID 2944 wrote to memory of 1864	2944	09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09c6d85fbf8658512caadc52a0720792_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\System\AyfJwXQ.exe
  C:\Windows\System\AyfJwXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\oxrqjEH.exe
  C:\Windows\System\oxrqjEH.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\XwqwKWM.exe
  C:\Windows\System\XwqwKWM.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\lssGRhA.exe
  C:\Windows\System\lssGRhA.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\ESrbokf.exe
  C:\Windows\System\ESrbokf.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\oJhPLke.exe
  C:\Windows\System\oJhPLke.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\VwtiADB.exe
  C:\Windows\System\VwtiADB.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\MkPGykD.exe
  C:\Windows\System\MkPGykD.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\tYquPeR.exe
  C:\Windows\System\tYquPeR.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\gnqBGtw.exe
  C:\Windows\System\gnqBGtw.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\PvpyvTj.exe
  C:\Windows\System\PvpyvTj.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\DHuIYwy.exe
  C:\Windows\System\DHuIYwy.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\TFqFSLH.exe
  C:\Windows\System\TFqFSLH.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\BOiDKOk.exe
  C:\Windows\System\BOiDKOk.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\YVCXARb.exe
  C:\Windows\System\YVCXARb.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\BXgAXkT.exe
  C:\Windows\System\BXgAXkT.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\XvdgaZV.exe
  C:\Windows\System\XvdgaZV.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\GzAIGjy.exe
  C:\Windows\System\GzAIGjy.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\VUSXNEl.exe
  C:\Windows\System\VUSXNEl.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\RuthnNg.exe
  C:\Windows\System\RuthnNg.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\kBJfyJG.exe
  C:\Windows\System\kBJfyJG.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\OJYJSSC.exe
  C:\Windows\System\OJYJSSC.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\JfCqdCm.exe
  C:\Windows\System\JfCqdCm.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\eCmStof.exe
  C:\Windows\System\eCmStof.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\SyGnLRW.exe
  C:\Windows\System\SyGnLRW.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\nvLxAxK.exe
  C:\Windows\System\nvLxAxK.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\CuiQCmV.exe
  C:\Windows\System\CuiQCmV.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\Ahnejky.exe
  C:\Windows\System\Ahnejky.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\peFKhzx.exe
  C:\Windows\System\peFKhzx.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\tRgEGUB.exe
  C:\Windows\System\tRgEGUB.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\qoGfybR.exe
  C:\Windows\System\qoGfybR.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\pJLLixh.exe
  C:\Windows\System\pJLLixh.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\uRkgFBk.exe
  C:\Windows\System\uRkgFBk.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\tHTfeFT.exe
  C:\Windows\System\tHTfeFT.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\QSAZoBH.exe
  C:\Windows\System\QSAZoBH.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\ijOBBrG.exe
  C:\Windows\System\ijOBBrG.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\ArgocJN.exe
  C:\Windows\System\ArgocJN.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\bVfPhpI.exe
  C:\Windows\System\bVfPhpI.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\YVwMFzq.exe
  C:\Windows\System\YVwMFzq.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\YShNFer.exe
  C:\Windows\System\YShNFer.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\ZlqzBJI.exe
  C:\Windows\System\ZlqzBJI.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\ZKWnvpJ.exe
  C:\Windows\System\ZKWnvpJ.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\ryiBceo.exe
  C:\Windows\System\ryiBceo.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\REbEQfn.exe
  C:\Windows\System\REbEQfn.exe
  2⤵
  PID:2272
- C:\Windows\System\lklwxHW.exe
  C:\Windows\System\lklwxHW.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\OVGbdKl.exe
  C:\Windows\System\OVGbdKl.exe
  2⤵
  PID:1772
- C:\Windows\System\ktDKMxF.exe
  C:\Windows\System\ktDKMxF.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\uYyOoSi.exe
  C:\Windows\System\uYyOoSi.exe
  2⤵
  PID:1352
- C:\Windows\System\LrVTHPH.exe
  C:\Windows\System\LrVTHPH.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\WJqYuYE.exe
  C:\Windows\System\WJqYuYE.exe
  2⤵
  PID:2044
- C:\Windows\System\uPGUZCa.exe
  C:\Windows\System\uPGUZCa.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\WWGmQsd.exe
  C:\Windows\System\WWGmQsd.exe
  2⤵
  PID:1192
- C:\Windows\System\vJEbfwi.exe
  C:\Windows\System\vJEbfwi.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\DdxakLH.exe
  C:\Windows\System\DdxakLH.exe
  2⤵
  PID:1568
- C:\Windows\System\UqtzmhW.exe
  C:\Windows\System\UqtzmhW.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\SdZgFKE.exe
  C:\Windows\System\SdZgFKE.exe
  2⤵
  PID:1316
- C:\Windows\System\jMwJPCB.exe
  C:\Windows\System\jMwJPCB.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\DDbVrXi.exe
  C:\Windows\System\DDbVrXi.exe
  2⤵
  PID:1792
- C:\Windows\System\xjjFnfS.exe
  C:\Windows\System\xjjFnfS.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\TqGutYo.exe
  C:\Windows\System\TqGutYo.exe
  2⤵
  PID:1540
- C:\Windows\System\HaqbdYN.exe
  C:\Windows\System\HaqbdYN.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\MLwzBst.exe
  C:\Windows\System\MLwzBst.exe
  2⤵
  PID:904
- C:\Windows\System\oReaNfN.exe
  C:\Windows\System\oReaNfN.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\ZPXhGVv.exe
  C:\Windows\System\ZPXhGVv.exe
  2⤵
  PID:1724
- C:\Windows\System\CLAofdd.exe
  C:\Windows\System\CLAofdd.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\XnxmncP.exe
  C:\Windows\System\XnxmncP.exe
  2⤵
  PID:3020
- C:\Windows\System\VaaMgMm.exe
  C:\Windows\System\VaaMgMm.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\NIORyzJ.exe
  C:\Windows\System\NIORyzJ.exe
  2⤵
  PID:1616
- C:\Windows\System\sWgRynT.exe
  C:\Windows\System\sWgRynT.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\grvdQRk.exe
  C:\Windows\System\grvdQRk.exe
  2⤵
  PID:2300
- C:\Windows\System\JDFzdBr.exe
  C:\Windows\System\JDFzdBr.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\vNRhKIw.exe
  C:\Windows\System\vNRhKIw.exe
  2⤵
  PID:2996
- C:\Windows\System\YVqXNLJ.exe
  C:\Windows\System\YVqXNLJ.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\VFSOXZW.exe
  C:\Windows\System\VFSOXZW.exe
  2⤵
  PID:2612
- C:\Windows\System\nSjwcPr.exe
  C:\Windows\System\nSjwcPr.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\kGCvLAY.exe
  C:\Windows\System\kGCvLAY.exe
  2⤵
  PID:1276
- C:\Windows\System\kuUQDPI.exe
  C:\Windows\System\kuUQDPI.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\mnzWZOw.exe
  C:\Windows\System\mnzWZOw.exe
  2⤵
  PID:872
- C:\Windows\System\fywcKxd.exe
  C:\Windows\System\fywcKxd.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\IYGHgkY.exe
  C:\Windows\System\IYGHgkY.exe
  2⤵
  PID:1056
- C:\Windows\System\AjhRqdA.exe
  C:\Windows\System\AjhRqdA.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\GgzgrnT.exe
  C:\Windows\System\GgzgrnT.exe
  2⤵
  PID:2080
- C:\Windows\System\azFIpcC.exe
  C:\Windows\System\azFIpcC.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\fTodrNw.exe
  C:\Windows\System\fTodrNw.exe
  2⤵
  PID:2320
- C:\Windows\System\MHMeAXq.exe
  C:\Windows\System\MHMeAXq.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\NdOVFiW.exe
  C:\Windows\System\NdOVFiW.exe
  2⤵
  PID:1812
- C:\Windows\System\FNHbNUj.exe
  C:\Windows\System\FNHbNUj.exe
  2⤵
  PID:3256
- C:\Windows\System\HyOHwvJ.exe
  C:\Windows\System\HyOHwvJ.exe
  2⤵
  PID:3284
- C:\Windows\System\dfjzXnM.exe
  C:\Windows\System\dfjzXnM.exe
  2⤵
  PID:3300
- C:\Windows\System\DqWOZbd.exe
  C:\Windows\System\DqWOZbd.exe
  2⤵
  PID:3316
- C:\Windows\System\AOqlzQX.exe
  C:\Windows\System\AOqlzQX.exe
  2⤵
  PID:3332
- C:\Windows\System\lnUEldr.exe
  C:\Windows\System\lnUEldr.exe
  2⤵
  PID:3360
- C:\Windows\System\nSKDKbi.exe
  C:\Windows\System\nSKDKbi.exe
  2⤵
  PID:3384
- C:\Windows\System\JKtKwVM.exe
  C:\Windows\System\JKtKwVM.exe
  2⤵
  PID:3408
- C:\Windows\System\wQsaFTp.exe
  C:\Windows\System\wQsaFTp.exe
  2⤵
  PID:3428
- C:\Windows\System\hLOjdzI.exe
  C:\Windows\System\hLOjdzI.exe
  2⤵
  PID:3452
- C:\Windows\System\IWSVhzj.exe
  C:\Windows\System\IWSVhzj.exe
  2⤵
  PID:3468
- C:\Windows\System\laWvMmf.exe
  C:\Windows\System\laWvMmf.exe
  2⤵
  PID:3484
- C:\Windows\System\mQhkbFo.exe
  C:\Windows\System\mQhkbFo.exe
  2⤵
  PID:3508
- C:\Windows\System\egsffqc.exe
  C:\Windows\System\egsffqc.exe
  2⤵
  PID:3540
- C:\Windows\System\TqtnWzW.exe
  C:\Windows\System\TqtnWzW.exe
  2⤵
  PID:3652
- C:\Windows\System\DSmYcOw.exe
  C:\Windows\System\DSmYcOw.exe
  2⤵
  PID:3668
- C:\Windows\System\adAmBMU.exe
  C:\Windows\System\adAmBMU.exe
  2⤵
  PID:3684
- C:\Windows\System\kEEPPPP.exe
  C:\Windows\System\kEEPPPP.exe
  2⤵
  PID:3700
- C:\Windows\System\CQNEyxP.exe
  C:\Windows\System\CQNEyxP.exe
  2⤵
  PID:3716
- C:\Windows\System\pHthXds.exe
  C:\Windows\System\pHthXds.exe
  2⤵
  PID:3732
- C:\Windows\System\esYvRig.exe
  C:\Windows\System\esYvRig.exe
  2⤵
  PID:3748
- C:\Windows\System\pcnvuHp.exe
  C:\Windows\System\pcnvuHp.exe
  2⤵
  PID:3764
- C:\Windows\System\DtNJcJJ.exe
  C:\Windows\System\DtNJcJJ.exe
  2⤵
  PID:3780
- C:\Windows\System\Igeyrxo.exe
  C:\Windows\System\Igeyrxo.exe
  2⤵
  PID:3800
- C:\Windows\System\HexJfqZ.exe
  C:\Windows\System\HexJfqZ.exe
  2⤵
  PID:3816
- C:\Windows\System\ADcCQCq.exe
  C:\Windows\System\ADcCQCq.exe
  2⤵
  PID:3832
- C:\Windows\System\gDOyggr.exe
  C:\Windows\System\gDOyggr.exe
  2⤵
  PID:3848
- C:\Windows\System\sPbDtmH.exe
  C:\Windows\System\sPbDtmH.exe
  2⤵
  PID:3864
- C:\Windows\System\ZzrTKHC.exe
  C:\Windows\System\ZzrTKHC.exe
  2⤵
  PID:3880
- C:\Windows\System\kwSfZxP.exe
  C:\Windows\System\kwSfZxP.exe
  2⤵
  PID:3896
- C:\Windows\System\qmhItZO.exe
  C:\Windows\System\qmhItZO.exe
  2⤵
  PID:3912
- C:\Windows\System\uqnQMoA.exe
  C:\Windows\System\uqnQMoA.exe
  2⤵
  PID:3932
- C:\Windows\System\WroUhXm.exe
  C:\Windows\System\WroUhXm.exe
  2⤵
  PID:3948
- C:\Windows\System\UCLwzLY.exe
  C:\Windows\System\UCLwzLY.exe
  2⤵
  PID:3964
- C:\Windows\System\orzhefr.exe
  C:\Windows\System\orzhefr.exe
  2⤵
  PID:3980
- C:\Windows\System\eRBzNsb.exe
  C:\Windows\System\eRBzNsb.exe
  2⤵
  PID:4004
- C:\Windows\System\GFLwgUA.exe
  C:\Windows\System\GFLwgUA.exe
  2⤵
  PID:4020
- C:\Windows\System\yOecCAU.exe
  C:\Windows\System\yOecCAU.exe
  2⤵
  PID:4036
- C:\Windows\System\qzcLfeg.exe
  C:\Windows\System\qzcLfeg.exe
  2⤵
  PID:4060
- C:\Windows\System\vtEtSrf.exe
  C:\Windows\System\vtEtSrf.exe
  2⤵
  PID:4076
- C:\Windows\System\ucgcawv.exe
  C:\Windows\System\ucgcawv.exe
  2⤵
  PID:4092
- C:\Windows\System\gBFSqPo.exe
  C:\Windows\System\gBFSqPo.exe
  2⤵
  PID:3268
- C:\Windows\System\wESHUTF.exe
  C:\Windows\System\wESHUTF.exe
  2⤵
  PID:2740
- C:\Windows\System\LXtKgvp.exe
  C:\Windows\System\LXtKgvp.exe
  2⤵
  PID:2772
- C:\Windows\System\UdUuule.exe
  C:\Windows\System\UdUuule.exe
  2⤵
  PID:1960
- C:\Windows\System\CFpdBjQ.exe
  C:\Windows\System\CFpdBjQ.exe
  2⤵
  PID:272
- C:\Windows\System\pPhiRtU.exe
  C:\Windows\System\pPhiRtU.exe
  2⤵
  PID:1992
- C:\Windows\System\ccDPEjt.exe
  C:\Windows\System\ccDPEjt.exe
  2⤵
  PID:3396
- C:\Windows\System\NlfZFQs.exe
  C:\Windows\System\NlfZFQs.exe
  2⤵
  PID:2736
- C:\Windows\System\MPnuZfX.exe
  C:\Windows\System\MPnuZfX.exe
  2⤵
  PID:3436
- C:\Windows\System\fqkcRyY.exe
  C:\Windows\System\fqkcRyY.exe
  2⤵
  PID:3444
- C:\Windows\System\IhOubVC.exe
  C:\Windows\System\IhOubVC.exe
  2⤵
  PID:2504
- C:\Windows\System\ETMIZPs.exe
  C:\Windows\System\ETMIZPs.exe
  2⤵
  PID:3532
- C:\Windows\System\eTsjEyd.exe
  C:\Windows\System\eTsjEyd.exe
  2⤵
  PID:1032
- C:\Windows\System\XEqBwaB.exe
  C:\Windows\System\XEqBwaB.exe
  2⤵
  PID:1100
- C:\Windows\System\SHFlbbb.exe
  C:\Windows\System\SHFlbbb.exe
  2⤵
  PID:2584
- C:\Windows\System\byfNKQT.exe
  C:\Windows\System\byfNKQT.exe
  2⤵
  PID:2788
- C:\Windows\System\uGMAtXB.exe
  C:\Windows\System\uGMAtXB.exe
  2⤵
  PID:2308
- C:\Windows\System\RTHzBzG.exe
  C:\Windows\System\RTHzBzG.exe
  2⤵
  PID:2888
- C:\Windows\System\InuSIah.exe
  C:\Windows\System\InuSIah.exe
  2⤵
  PID:3660
- C:\Windows\System\VkUDxsD.exe
  C:\Windows\System\VkUDxsD.exe
  2⤵
  PID:3724
- C:\Windows\System\EQchCyT.exe
  C:\Windows\System\EQchCyT.exe
  2⤵
  PID:3788
- C:\Windows\System\SzdlJYm.exe
  C:\Windows\System\SzdlJYm.exe
  2⤵
  PID:3860
- C:\Windows\System\MGdyCzd.exe
  C:\Windows\System\MGdyCzd.exe
  2⤵
  PID:4108
- C:\Windows\System\tjNvbdT.exe
  C:\Windows\System\tjNvbdT.exe
  2⤵
  PID:4124
- C:\Windows\System\uvdPsKr.exe
  C:\Windows\System\uvdPsKr.exe
  2⤵
  PID:4140
- C:\Windows\System\UwgctHy.exe
  C:\Windows\System\UwgctHy.exe
  2⤵
  PID:4164
- C:\Windows\System\AOoVHTe.exe
  C:\Windows\System\AOoVHTe.exe
  2⤵
  PID:4180
- C:\Windows\System\xAyVJgh.exe
  C:\Windows\System\xAyVJgh.exe
  2⤵
  PID:4196
- C:\Windows\System\aNKvpbP.exe
  C:\Windows\System\aNKvpbP.exe
  2⤵
  PID:4212
- C:\Windows\System\DgVXWeX.exe
  C:\Windows\System\DgVXWeX.exe
  2⤵
  PID:4236
- C:\Windows\System\BaTUwPG.exe
  C:\Windows\System\BaTUwPG.exe
  2⤵
  PID:4468
- C:\Windows\System\KvqGHId.exe
  C:\Windows\System\KvqGHId.exe
  2⤵
  PID:4484
- C:\Windows\System\PIkWJlB.exe
  C:\Windows\System\PIkWJlB.exe
  2⤵
  PID:4500
- C:\Windows\System\KbFzcmJ.exe
  C:\Windows\System\KbFzcmJ.exe
  2⤵
  PID:4516
- C:\Windows\System\SyhSvzX.exe
  C:\Windows\System\SyhSvzX.exe
  2⤵
  PID:4536
- C:\Windows\System\HcpCLQH.exe
  C:\Windows\System\HcpCLQH.exe
  2⤵
  PID:4552
- C:\Windows\System\fMEhrDx.exe
  C:\Windows\System\fMEhrDx.exe
  2⤵
  PID:4572
- C:\Windows\System\LudpFdk.exe
  C:\Windows\System\LudpFdk.exe
  2⤵
  PID:4588
- C:\Windows\System\zPCIllb.exe
  C:\Windows\System\zPCIllb.exe
  2⤵
  PID:4604
- C:\Windows\System\UxsUcCN.exe
  C:\Windows\System\UxsUcCN.exe
  2⤵
  PID:4620
- C:\Windows\System\GXnYEoA.exe
  C:\Windows\System\GXnYEoA.exe
  2⤵
  PID:4636
- C:\Windows\System\PvqmdnC.exe
  C:\Windows\System\PvqmdnC.exe
  2⤵
  PID:4652
- C:\Windows\System\QOIqotc.exe
  C:\Windows\System\QOIqotc.exe
  2⤵
  PID:4668
- C:\Windows\System\iIgVqWy.exe
  C:\Windows\System\iIgVqWy.exe
  2⤵
  PID:4684
- C:\Windows\System\IAvmugi.exe
  C:\Windows\System\IAvmugi.exe
  2⤵
  PID:4700
- C:\Windows\System\zZEaDGV.exe
  C:\Windows\System\zZEaDGV.exe
  2⤵
  PID:4716
- C:\Windows\System\DyGuMVb.exe
  C:\Windows\System\DyGuMVb.exe
  2⤵
  PID:4732
- C:\Windows\System\uGpNgFE.exe
  C:\Windows\System\uGpNgFE.exe
  2⤵
  PID:4748
- C:\Windows\System\wkZMZFd.exe
  C:\Windows\System\wkZMZFd.exe
  2⤵
  PID:4764
- C:\Windows\System\pOkPEnn.exe
  C:\Windows\System\pOkPEnn.exe
  2⤵
  PID:4780
- C:\Windows\System\LXzRfrw.exe
  C:\Windows\System\LXzRfrw.exe
  2⤵
  PID:4800
- C:\Windows\System\JpTuINi.exe
  C:\Windows\System\JpTuINi.exe
  2⤵
  PID:4816
- C:\Windows\System\ZsTmNXP.exe
  C:\Windows\System\ZsTmNXP.exe
  2⤵
  PID:4832
- C:\Windows\System\AIqMeqj.exe
  C:\Windows\System\AIqMeqj.exe
  2⤵
  PID:4848
- C:\Windows\System\lWWbPqh.exe
  C:\Windows\System\lWWbPqh.exe
  2⤵
  PID:4864
- C:\Windows\System\UvtFqaC.exe
  C:\Windows\System\UvtFqaC.exe
  2⤵
  PID:4880
- C:\Windows\System\IAcAsAt.exe
  C:\Windows\System\IAcAsAt.exe
  2⤵
  PID:4900
- C:\Windows\System\BmHuwpM.exe
  C:\Windows\System\BmHuwpM.exe
  2⤵
  PID:4916
- C:\Windows\System\CoLjzJc.exe
  C:\Windows\System\CoLjzJc.exe
  2⤵
  PID:4932
- C:\Windows\System\JCCkWwL.exe
  C:\Windows\System\JCCkWwL.exe
  2⤵
  PID:4948
- C:\Windows\System\CCrPRNE.exe
  C:\Windows\System\CCrPRNE.exe
  2⤵
  PID:4964
- C:\Windows\System\HylWXjI.exe
  C:\Windows\System\HylWXjI.exe
  2⤵
  PID:4980
- C:\Windows\System\VIUAJEg.exe
  C:\Windows\System\VIUAJEg.exe
  2⤵
  PID:4996
- C:\Windows\System\UbOCQjc.exe
  C:\Windows\System\UbOCQjc.exe
  2⤵
  PID:5012
- C:\Windows\System\BQfqmZd.exe
  C:\Windows\System\BQfqmZd.exe
  2⤵
  PID:5028
- C:\Windows\System\CoRMUwt.exe
  C:\Windows\System\CoRMUwt.exe
  2⤵
  PID:5044
- C:\Windows\System\mcxAReY.exe
  C:\Windows\System\mcxAReY.exe
  2⤵
  PID:5060
- C:\Windows\System\uuqnXOv.exe
  C:\Windows\System\uuqnXOv.exe
  2⤵
  PID:5076
- C:\Windows\System\ywVyCdC.exe
  C:\Windows\System\ywVyCdC.exe
  2⤵
  PID:5092
- C:\Windows\System\NGJhQXy.exe
  C:\Windows\System\NGJhQXy.exe
  2⤵
  PID:5108
- C:\Windows\System\IVYzWyG.exe
  C:\Windows\System\IVYzWyG.exe
  2⤵
  PID:1716
- C:\Windows\System\lvKPDeN.exe
  C:\Windows\System\lvKPDeN.exe
  2⤵
  PID:2712
- C:\Windows\System\fvjmhCS.exe
  C:\Windows\System\fvjmhCS.exe
  2⤵
  PID:2524
- C:\Windows\System\KPvqWDp.exe
  C:\Windows\System\KPvqWDp.exe
  2⤵
  PID:1936
- C:\Windows\System\ZfEggRP.exe
  C:\Windows\System\ZfEggRP.exe
  2⤵
  PID:1484
- C:\Windows\System\kqweiOu.exe
  C:\Windows\System\kqweiOu.exe
  2⤵
  PID:2516
- C:\Windows\System\vxQHUma.exe
  C:\Windows\System\vxQHUma.exe
  2⤵
  PID:2224
- C:\Windows\System\fkvZNqQ.exe
  C:\Windows\System\fkvZNqQ.exe
  2⤵
  PID:380
- C:\Windows\System\GoQdqmt.exe
  C:\Windows\System\GoQdqmt.exe
  2⤵
  PID:1028
- C:\Windows\System\KibUZAc.exe
  C:\Windows\System\KibUZAc.exe
  2⤵
  PID:2432
- C:\Windows\System\dNcPlGE.exe
  C:\Windows\System\dNcPlGE.exe
  2⤵
  PID:536
- C:\Windows\System\mSJFiPj.exe
  C:\Windows\System\mSJFiPj.exe
  2⤵
  PID:784
- C:\Windows\System\MgHzoxo.exe
  C:\Windows\System\MgHzoxo.exe
  2⤵
  PID:2340
- C:\Windows\System\veeAILn.exe
  C:\Windows\System\veeAILn.exe
  2⤵
  PID:2348
- C:\Windows\System\uFmuzVq.exe
  C:\Windows\System\uFmuzVq.exe
  2⤵
  PID:1508
- C:\Windows\System\LMWOnlI.exe
  C:\Windows\System\LMWOnlI.exe
  2⤵
  PID:3368
- C:\Windows\System\fFFjmiP.exe
  C:\Windows\System\fFFjmiP.exe
  2⤵
  PID:820
- C:\Windows\System\NtcZnKi.exe
  C:\Windows\System\NtcZnKi.exe
  2⤵
  PID:3960
- C:\Windows\System\WTTSkxT.exe
  C:\Windows\System\WTTSkxT.exe
  2⤵
  PID:4032
- C:\Windows\System\PxgJeAm.exe
  C:\Windows\System\PxgJeAm.exe
  2⤵
  PID:3492
- C:\Windows\System\sktHMQE.exe
  C:\Windows\System\sktHMQE.exe
  2⤵
  PID:3564
- C:\Windows\System\bXRbvhp.exe
  C:\Windows\System\bXRbvhp.exe
  2⤵
  PID:4068
- C:\Windows\System\wiuKCnP.exe
  C:\Windows\System\wiuKCnP.exe
  2⤵
  PID:2168
- C:\Windows\System\aXkdAdK.exe
  C:\Windows\System\aXkdAdK.exe
  2⤵
  PID:3400
- C:\Windows\System\CmfXGyn.exe
  C:\Windows\System\CmfXGyn.exe
  2⤵
  PID:3440
- C:\Windows\System\VSBOzzg.exe
  C:\Windows\System\VSBOzzg.exe
  2⤵
  PID:2520
- C:\Windows\System\SKiHpTr.exe
  C:\Windows\System\SKiHpTr.exe
  2⤵
  PID:2164
- C:\Windows\System\IvxOcQR.exe
  C:\Windows\System\IvxOcQR.exe
  2⤵
  PID:3920
- C:\Windows\System\mMakmck.exe
  C:\Windows\System\mMakmck.exe
  2⤵
  PID:4132
- C:\Windows\System\qSAGDTq.exe
  C:\Windows\System\qSAGDTq.exe
  2⤵
  PID:4412
- C:\Windows\System\Unxoqxl.exe
  C:\Windows\System\Unxoqxl.exe
  2⤵
  PID:4264
- C:\Windows\System\uwMmgbT.exe
  C:\Windows\System\uwMmgbT.exe
  2⤵
  PID:4348
- C:\Windows\System\EYnyoOh.exe
  C:\Windows\System\EYnyoOh.exe
  2⤵
  PID:4400
- C:\Windows\System\TZdyVDd.exe
  C:\Windows\System\TZdyVDd.exe
  2⤵
  PID:4420
- C:\Windows\System\LvNDqRh.exe
  C:\Windows\System\LvNDqRh.exe
  2⤵
  PID:4436
- C:\Windows\System\ESjZCPP.exe
  C:\Windows\System\ESjZCPP.exe
  2⤵
  PID:4460
- C:\Windows\System\YXuJExJ.exe
  C:\Windows\System\YXuJExJ.exe
  2⤵
  PID:1764
- C:\Windows\System\VCEsLZp.exe
  C:\Windows\System\VCEsLZp.exe
  2⤵
  PID:2540
- C:\Windows\System\TzFjVuW.exe
  C:\Windows\System\TzFjVuW.exe
  2⤵
  PID:1708
- C:\Windows\System\lljdiEe.exe
  C:\Windows\System\lljdiEe.exe
  2⤵
  PID:2700
- C:\Windows\System\BQgrKzR.exe
  C:\Windows\System\BQgrKzR.exe
  2⤵
  PID:336
- C:\Windows\System\ymKNYKn.exe
  C:\Windows\System\ymKNYKn.exe
  2⤵
  PID:3680
- C:\Windows\System\DKNVeEA.exe
  C:\Windows\System\DKNVeEA.exe
  2⤵
  PID:3744
- C:\Windows\System\SRbzOoB.exe
  C:\Windows\System\SRbzOoB.exe
  2⤵
  PID:3840
- C:\Windows\System\AdKNCbt.exe
  C:\Windows\System\AdKNCbt.exe
  2⤵
  PID:5324
- C:\Windows\System\Dcjaemo.exe
  C:\Windows\System\Dcjaemo.exe
  2⤵
  PID:5344
- C:\Windows\System\LdNpfLv.exe
  C:\Windows\System\LdNpfLv.exe
  2⤵
  PID:5360
- C:\Windows\System\XYLWwXN.exe
  C:\Windows\System\XYLWwXN.exe
  2⤵
  PID:5376
- C:\Windows\System\VlDDvWF.exe
  C:\Windows\System\VlDDvWF.exe
  2⤵
  PID:5392
- C:\Windows\System\eqavFiZ.exe
  C:\Windows\System\eqavFiZ.exe
  2⤵
  PID:5408
- C:\Windows\System\KsTWyJX.exe
  C:\Windows\System\KsTWyJX.exe
  2⤵
  PID:5424
- C:\Windows\System\OQpgbxU.exe
  C:\Windows\System\OQpgbxU.exe
  2⤵
  PID:5444
- C:\Windows\System\hpXHgNH.exe
  C:\Windows\System\hpXHgNH.exe
  2⤵
  PID:5460
- C:\Windows\System\vYJohNP.exe
  C:\Windows\System\vYJohNP.exe
  2⤵
  PID:5504
- C:\Windows\System\hthTCUf.exe
  C:\Windows\System\hthTCUf.exe
  2⤵
  PID:5524
- C:\Windows\System\rutkyoq.exe
  C:\Windows\System\rutkyoq.exe
  2⤵
  PID:5540
- C:\Windows\System\wVWfmiJ.exe
  C:\Windows\System\wVWfmiJ.exe
  2⤵
  PID:5556
- C:\Windows\System\LCCoJzM.exe
  C:\Windows\System\LCCoJzM.exe
  2⤵
  PID:5572
- C:\Windows\System\QVIVqfc.exe
  C:\Windows\System\QVIVqfc.exe
  2⤵
  PID:5588
- C:\Windows\System\sUaVluD.exe
  C:\Windows\System\sUaVluD.exe
  2⤵
  PID:5604
- C:\Windows\System\DHUtGlA.exe
  C:\Windows\System\DHUtGlA.exe
  2⤵
  PID:5620
- C:\Windows\System\itzjpvw.exe
  C:\Windows\System\itzjpvw.exe
  2⤵
  PID:5636
- C:\Windows\System\LIGHKsc.exe
  C:\Windows\System\LIGHKsc.exe
  2⤵
  PID:5652
- C:\Windows\System\zLzTnlh.exe
  C:\Windows\System\zLzTnlh.exe
  2⤵
  PID:5668
- C:\Windows\System\JJiqqAp.exe
  C:\Windows\System\JJiqqAp.exe
  2⤵
  PID:5684
- C:\Windows\System\RYKyyNg.exe
  C:\Windows\System\RYKyyNg.exe
  2⤵
  PID:5700
- C:\Windows\System\lovNwQm.exe
  C:\Windows\System\lovNwQm.exe
  2⤵
  PID:5716
- C:\Windows\System\KTulWaq.exe
  C:\Windows\System\KTulWaq.exe
  2⤵
  PID:5732
- C:\Windows\System\gWudhMg.exe
  C:\Windows\System\gWudhMg.exe
  2⤵
  PID:5756
- C:\Windows\System\GHXPPda.exe
  C:\Windows\System\GHXPPda.exe
  2⤵
  PID:5772
- C:\Windows\System\ISUfRXh.exe
  C:\Windows\System\ISUfRXh.exe
  2⤵
  PID:5788
- C:\Windows\System\KtDXSEI.exe
  C:\Windows\System\KtDXSEI.exe
  2⤵
  PID:5804
- C:\Windows\System\bLkqAPy.exe
  C:\Windows\System\bLkqAPy.exe
  2⤵
  PID:5824
- C:\Windows\System\OqhyBZI.exe
  C:\Windows\System\OqhyBZI.exe
  2⤵
  PID:5840
- C:\Windows\System\eCopOtU.exe
  C:\Windows\System\eCopOtU.exe
  2⤵
  PID:5856
- C:\Windows\System\PxhlBdv.exe
  C:\Windows\System\PxhlBdv.exe
  2⤵
  PID:5872
- C:\Windows\System\PKYHRzA.exe
  C:\Windows\System\PKYHRzA.exe
  2⤵
  PID:5888
- C:\Windows\System\aSekEiL.exe
  C:\Windows\System\aSekEiL.exe
  2⤵
  PID:5904
- C:\Windows\System\UhUQRWH.exe
  C:\Windows\System\UhUQRWH.exe
  2⤵
  PID:5920
- C:\Windows\System\pvFppqu.exe
  C:\Windows\System\pvFppqu.exe
  2⤵
  PID:5940
- C:\Windows\System\qBGBfjZ.exe
  C:\Windows\System\qBGBfjZ.exe
  2⤵
  PID:5956
- C:\Windows\System\WbIHdal.exe
  C:\Windows\System\WbIHdal.exe
  2⤵
  PID:5972
- C:\Windows\System\xDNLrvH.exe
  C:\Windows\System\xDNLrvH.exe
  2⤵
  PID:5988
- C:\Windows\System\rlwTwnu.exe
  C:\Windows\System\rlwTwnu.exe
  2⤵
  PID:6004
- C:\Windows\System\aolnusH.exe
  C:\Windows\System\aolnusH.exe
  2⤵
  PID:6020
- C:\Windows\System\gMTsGNN.exe
  C:\Windows\System\gMTsGNN.exe
  2⤵
  PID:6040
- C:\Windows\System\NXOGOBN.exe
  C:\Windows\System\NXOGOBN.exe
  2⤵
  PID:6056
- C:\Windows\System\GwCmhYC.exe
  C:\Windows\System\GwCmhYC.exe
  2⤵
  PID:6072
- C:\Windows\System\maPniLr.exe
  C:\Windows\System\maPniLr.exe
  2⤵
  PID:6088
- C:\Windows\System\vxOfwcx.exe
  C:\Windows\System\vxOfwcx.exe
  2⤵
  PID:6104
- C:\Windows\System\oKKLdRO.exe
  C:\Windows\System\oKKLdRO.exe
  2⤵
  PID:6120
- C:\Windows\System\yzGpvvB.exe
  C:\Windows\System\yzGpvvB.exe
  2⤵
  PID:6140
- C:\Windows\System\wYWcBsb.exe
  C:\Windows\System\wYWcBsb.exe
  2⤵
  PID:3344
- C:\Windows\System\rpjtnCG.exe
  C:\Windows\System\rpjtnCG.exe
  2⤵
  PID:1584
- C:\Windows\System\EGzYKmE.exe
  C:\Windows\System\EGzYKmE.exe
  2⤵
  PID:2084
- C:\Windows\System\zbTJvZe.exe
  C:\Windows\System\zbTJvZe.exe
  2⤵
  PID:4568
- C:\Windows\System\oQegdoW.exe
  C:\Windows\System\oQegdoW.exe
  2⤵
  PID:4632
- C:\Windows\System\dVbZckM.exe
  C:\Windows\System\dVbZckM.exe
  2⤵
  PID:4724
- C:\Windows\System\VdHpMFI.exe
  C:\Windows\System\VdHpMFI.exe
  2⤵
  PID:4788
- C:\Windows\System\SQNIdgk.exe
  C:\Windows\System\SQNIdgk.exe
  2⤵
  PID:4860
- C:\Windows\System\WVfchYM.exe
  C:\Windows\System\WVfchYM.exe
  2⤵
  PID:4924
- C:\Windows\System\ulGnwcR.exe
  C:\Windows\System\ulGnwcR.exe
  2⤵
  PID:4988
- C:\Windows\System\HewExmJ.exe
  C:\Windows\System\HewExmJ.exe
  2⤵
  PID:2508
- C:\Windows\System\tHkvhcc.exe
  C:\Windows\System\tHkvhcc.exe
  2⤵
  PID:3380
- C:\Windows\System\wlnnzDh.exe
  C:\Windows\System\wlnnzDh.exe
  2⤵
  PID:3500
- C:\Windows\System\BaUOpIx.exe
  C:\Windows\System\BaUOpIx.exe
  2⤵
  PID:2000
- C:\Windows\System\XCxIfSc.exe
  C:\Windows\System\XCxIfSc.exe
  2⤵
  PID:1284
- C:\Windows\System\HYwNueb.exe
  C:\Windows\System\HYwNueb.exe
  2⤵
  PID:4356
- C:\Windows\System\IIsEKwQ.exe
  C:\Windows\System\IIsEKwQ.exe
  2⤵
  PID:4440
- C:\Windows\System\IoZKYuP.exe
  C:\Windows\System\IoZKYuP.exe
  2⤵
  PID:4524
- C:\Windows\System\BVUVfZe.exe
  C:\Windows\System\BVUVfZe.exe
  2⤵
  PID:3712
- C:\Windows\System\tiiPCMY.exe
  C:\Windows\System\tiiPCMY.exe
  2⤵
  PID:5136
- C:\Windows\System\QAtDWcY.exe
  C:\Windows\System\QAtDWcY.exe
  2⤵
  PID:5152
- C:\Windows\System\kaFRnpa.exe
  C:\Windows\System\kaFRnpa.exe
  2⤵
  PID:5168
- C:\Windows\System\utKuwhX.exe
  C:\Windows\System\utKuwhX.exe
  2⤵
  PID:5184
- C:\Windows\System\oiIqVTQ.exe
  C:\Windows\System\oiIqVTQ.exe
  2⤵
  PID:5200
- C:\Windows\System\qAThOhu.exe
  C:\Windows\System\qAThOhu.exe
  2⤵
  PID:2652
- C:\Windows\System\SQyWXEg.exe
  C:\Windows\System\SQyWXEg.exe
  2⤵
  PID:4088
- C:\Windows\System\hUEHlNd.exe
  C:\Windows\System\hUEHlNd.exe
  2⤵
  PID:704
- C:\Windows\System\sLJUFtc.exe
  C:\Windows\System\sLJUFtc.exe
  2⤵
  PID:4544
- C:\Windows\System\yvSTBKo.exe
  C:\Windows\System\yvSTBKo.exe
  2⤵
  PID:4616
- C:\Windows\System\GdbLwID.exe
  C:\Windows\System\GdbLwID.exe
  2⤵
  PID:5416
- C:\Windows\System\VXMKeEj.exe
  C:\Windows\System\VXMKeEj.exe
  2⤵
  PID:5512
- C:\Windows\System\foMKZaY.exe
  C:\Windows\System\foMKZaY.exe
  2⤵
  PID:5580
- C:\Windows\System\WEGBbTJ.exe
  C:\Windows\System\WEGBbTJ.exe
  2⤵
  PID:4940
- C:\Windows\System\EprJrsY.exe
  C:\Windows\System\EprJrsY.exe
  2⤵
  PID:5040
- C:\Windows\System\czRBbtw.exe
  C:\Windows\System\czRBbtw.exe
  2⤵
  PID:5980
- C:\Windows\System\XRpXGrG.exe
  C:\Windows\System\XRpXGrG.exe
  2⤵
  PID:6016
- C:\Windows\System\ZZhzozA.exe
  C:\Windows\System\ZZhzozA.exe
  2⤵
  PID:1536
- C:\Windows\System\WWDhcin.exe
  C:\Windows\System\WWDhcin.exe
  2⤵
  PID:2244
- C:\Windows\System\oDduISE.exe
  C:\Windows\System\oDduISE.exe
  2⤵
  PID:5708
- C:\Windows\System\JfHZNeP.exe
  C:\Windows\System\JfHZNeP.exe
  2⤵
  PID:5740
- C:\Windows\System\OTyROrb.exe
  C:\Windows\System\OTyROrb.exe
  2⤵
  PID:5816
- C:\Windows\System\iRtvMMe.exe
  C:\Windows\System\iRtvMMe.exe
  2⤵
  PID:5020
- C:\Windows\System\OLxlxyo.exe
  C:\Windows\System\OLxlxyo.exe
  2⤵
  PID:2112
- C:\Windows\System\wMOgbTp.exe
  C:\Windows\System\wMOgbTp.exe
  2⤵
  PID:4508
- C:\Windows\System\UjBvbWG.exe
  C:\Windows\System\UjBvbWG.exe
  2⤵
  PID:3692
- C:\Windows\System\ZhHSvgg.exe
  C:\Windows\System\ZhHSvgg.exe
  2⤵
  PID:5340
- C:\Windows\System\Cpbqfnx.exe
  C:\Windows\System\Cpbqfnx.exe
  2⤵
  PID:5432
- C:\Windows\System\AXiwSMW.exe
  C:\Windows\System\AXiwSMW.exe
  2⤵
  PID:5660
- C:\Windows\System\DWMNfJF.exe
  C:\Windows\System\DWMNfJF.exe
  2⤵
  PID:5932
- C:\Windows\System\EnOHooQ.exe
  C:\Windows\System\EnOHooQ.exe
  2⤵
  PID:6036
- C:\Windows\System\SNwaHon.exe
  C:\Windows\System\SNwaHon.exe
  2⤵
  PID:4824
- C:\Windows\System\yAUTLym.exe
  C:\Windows\System\yAUTLym.exe
  2⤵
  PID:4560
- C:\Windows\System\msQEzld.exe
  C:\Windows\System\msQEzld.exe
  2⤵
  PID:2696
- C:\Windows\System\eotBGPG.exe
  C:\Windows\System\eotBGPG.exe
  2⤵
  PID:2756
- C:\Windows\System\CGpbvRx.exe
  C:\Windows\System\CGpbvRx.exe
  2⤵
  PID:4084
- C:\Windows\System\mktSVQV.exe
  C:\Windows\System\mktSVQV.exe
  2⤵
  PID:3972
- C:\Windows\System\ylNXIgE.exe
  C:\Windows\System\ylNXIgE.exe
  2⤵
  PID:5492
- C:\Windows\System\KeETIwn.exe
  C:\Windows\System\KeETIwn.exe
  2⤵
  PID:5696
- C:\Windows\System\DocWgwz.exe
  C:\Windows\System\DocWgwz.exe
  2⤵
  PID:5968
- C:\Windows\System\lDvqqXc.exe
  C:\Windows\System\lDvqqXc.exe
  2⤵
  PID:2972
- C:\Windows\System\jplYIym.exe
  C:\Windows\System\jplYIym.exe
  2⤵
  PID:3460
- C:\Windows\System\OHzZcfC.exe
  C:\Windows\System\OHzZcfC.exe
  2⤵
  PID:4320
- C:\Windows\System\QHuFhWi.exe
  C:\Windows\System\QHuFhWi.exe
  2⤵
  PID:4248
- C:\Windows\System\BaAdLXM.exe
  C:\Windows\System\BaAdLXM.exe
  2⤵
  PID:3776
- C:\Windows\System\otCLkgW.exe
  C:\Windows\System\otCLkgW.exe
  2⤵
  PID:3760
- C:\Windows\System\eexmnsY.exe
  C:\Windows\System\eexmnsY.exe
  2⤵
  PID:1756
- C:\Windows\System\FRuERbW.exe
  C:\Windows\System\FRuERbW.exe
  2⤵
  PID:5768
- C:\Windows\System\zgAnKik.exe
  C:\Windows\System\zgAnKik.exe
  2⤵
  PID:2092
- C:\Windows\System\EgyjoUS.exe
  C:\Windows\System\EgyjoUS.exe
  2⤵
  PID:2536
- C:\Windows\System\rAndpIa.exe
  C:\Windows\System\rAndpIa.exe
  2⤵
  PID:4644
- C:\Windows\System\uZTCatE.exe
  C:\Windows\System\uZTCatE.exe
  2⤵
  PID:5228
- C:\Windows\System\fdpEiTb.exe
  C:\Windows\System\fdpEiTb.exe
  2⤵
  PID:5232
- C:\Windows\System\zBbpGKT.exe
  C:\Windows\System\zBbpGKT.exe
  2⤵
  PID:3944
- C:\Windows\System\SKoAiCm.exe
  C:\Windows\System\SKoAiCm.exe
  2⤵
  PID:1080
- C:\Windows\System\uMIpQgP.exe
  C:\Windows\System\uMIpQgP.exe
  2⤵
  PID:4000
- C:\Windows\System\LfZzAVw.exe
  C:\Windows\System\LfZzAVw.exe
  2⤵
  PID:2060
- C:\Windows\System\nXzpykZ.exe
  C:\Windows\System\nXzpykZ.exe
  2⤵
  PID:5148
- C:\Windows\System\RJnkVUx.exe
  C:\Windows\System\RJnkVUx.exe
  2⤵
  PID:4712
- C:\Windows\System\akTTkoS.exe
  C:\Windows\System\akTTkoS.exe
  2⤵
  PID:5160
- C:\Windows\System\RWlTkKE.exe
  C:\Windows\System\RWlTkKE.exe
  2⤵
  PID:5052
- C:\Windows\System\tMeJVXI.exe
  C:\Windows\System\tMeJVXI.exe
  2⤵
  PID:4744
- C:\Windows\System\zTKUGGr.exe
  C:\Windows\System\zTKUGGr.exe
  2⤵
  PID:1848
- C:\Windows\System\qZlKxsI.exe
  C:\Windows\System\qZlKxsI.exe
  2⤵
  PID:2040
- C:\Windows\System\UJIWoQl.exe
  C:\Windows\System\UJIWoQl.exe
  2⤵
  PID:5256
- C:\Windows\System\wPcIjvO.exe
  C:\Windows\System\wPcIjvO.exe
  2⤵
  PID:5280
- C:\Windows\System\rlRkisn.exe
  C:\Windows\System\rlRkisn.exe
  2⤵
  PID:2452
- C:\Windows\System\IMpByob.exe
  C:\Windows\System\IMpByob.exe
  2⤵
  PID:5312
- C:\Windows\System\KogxYGy.exe
  C:\Windows\System\KogxYGy.exe
  2⤵
  PID:5356
- C:\Windows\System\RoaZItH.exe
  C:\Windows\System\RoaZItH.exe
  2⤵
  PID:2680
- C:\Windows\System\wFnzNIy.exe
  C:\Windows\System\wFnzNIy.exe
  2⤵
  PID:2276
- C:\Windows\System\YGgYavW.exe
  C:\Windows\System\YGgYavW.exe
  2⤵
  PID:5612
- C:\Windows\System\ovrsAFA.exe
  C:\Windows\System\ovrsAFA.exe
  2⤵
  PID:5552
- C:\Windows\System\hAWETQX.exe
  C:\Windows\System\hAWETQX.exe
  2⤵
  PID:2512
- C:\Windows\System\oLizpMu.exe
  C:\Windows\System\oLizpMu.exe
  2⤵
  PID:5676
- C:\Windows\System\ggwZiJw.exe
  C:\Windows\System\ggwZiJw.exe
  2⤵
  PID:2904
- C:\Windows\System\dnupaDB.exe
  C:\Windows\System\dnupaDB.exe
  2⤵
  PID:2400
- C:\Windows\System\rifzcdP.exe
  C:\Windows\System\rifzcdP.exe
  2⤵
  PID:972
- C:\Windows\System\dSLyFww.exe
  C:\Windows\System\dSLyFww.exe
  2⤵
  PID:5848
- C:\Windows\System\ZJlALEc.exe
  C:\Windows\System\ZJlALEc.exe
  2⤵
  PID:5916
- C:\Windows\System\pdTLpLo.exe
  C:\Windows\System\pdTLpLo.exe
  2⤵
  PID:5852
- C:\Windows\System\mxlUdTe.exe
  C:\Windows\System\mxlUdTe.exe
  2⤵
  PID:5680
- C:\Windows\System\COtlwwI.exe
  C:\Windows\System\COtlwwI.exe
  2⤵
  PID:6116
- C:\Windows\System\CLzaYEO.exe
  C:\Windows\System\CLzaYEO.exe
  2⤵
  PID:6052
- C:\Windows\System\FWihNMS.exe
  C:\Windows\System\FWihNMS.exe
  2⤵
  PID:4756
- C:\Windows\System\WWSzbFL.exe
  C:\Windows\System\WWSzbFL.exe
  2⤵
  PID:4176
- C:\Windows\System\plbJJOQ.exe
  C:\Windows\System\plbJJOQ.exe
  2⤵
  PID:4424
- C:\Windows\System\MbUTWDG.exe
  C:\Windows\System\MbUTWDG.exe
  2⤵
  PID:2472
- C:\Windows\System\XBYUZZD.exe
  C:\Windows\System\XBYUZZD.exe
  2⤵
  PID:5500
- C:\Windows\System\FWAdFCq.exe
  C:\Windows\System\FWAdFCq.exe
  2⤵
  PID:4956
- C:\Windows\System\NoemEtm.exe
  C:\Windows\System\NoemEtm.exe
  2⤵
  PID:4808
- C:\Windows\System\AWJShdD.exe
  C:\Windows\System\AWJShdD.exe
  2⤵
  PID:5564
- C:\Windows\System\qOoVhsI.exe
  C:\Windows\System\qOoVhsI.exe
  2⤵
  PID:5868
- C:\Windows\System\GHnZYXw.exe
  C:\Windows\System\GHnZYXw.exe
  2⤵
  PID:1652
- C:\Windows\System\oDRVpOr.exe
  C:\Windows\System\oDRVpOr.exe
  2⤵
  PID:2784
- C:\Windows\System\IgNVuwf.exe
  C:\Windows\System\IgNVuwf.exe
  2⤵
  PID:1436
- C:\Windows\System\ceWQyWb.exe
  C:\Windows\System\ceWQyWb.exe
  2⤵
  PID:2136
- C:\Windows\System\tnTPFpZ.exe
  C:\Windows\System\tnTPFpZ.exe
  2⤵
  PID:4828
- C:\Windows\System\bsgxoFq.exe
  C:\Windows\System\bsgxoFq.exe
  2⤵
  PID:1808
- C:\Windows\System\mJlirvk.exe
  C:\Windows\System\mJlirvk.exe
  2⤵
  PID:3272
- C:\Windows\System\OMfpMSz.exe
  C:\Windows\System\OMfpMSz.exe
  2⤵
  PID:3636
- C:\Windows\System\UMLYWrl.exe
  C:\Windows\System\UMLYWrl.exe
  2⤵
  PID:2648
- C:\Windows\System\vzkNevW.exe
  C:\Windows\System\vzkNevW.exe
  2⤵
  PID:3812
- C:\Windows\System\ZAvLdRn.exe
  C:\Windows\System\ZAvLdRn.exe
  2⤵
  PID:5372
- C:\Windows\System\mrHtQFq.exe
  C:\Windows\System\mrHtQFq.exe
  2⤵
  PID:5220
- C:\Windows\System\QEkxcaE.exe
  C:\Windows\System\QEkxcaE.exe
  2⤵
  PID:5928
- C:\Windows\System\xFeTvbq.exe
  C:\Windows\System\xFeTvbq.exe
  2⤵
  PID:5536
- C:\Windows\System\PaZGlzU.exe
  C:\Windows\System\PaZGlzU.exe
  2⤵
  PID:3324
- C:\Windows\System\Lxzmuhb.exe
  C:\Windows\System\Lxzmuhb.exe
  2⤵
  PID:4056
- C:\Windows\System\GQtsAIL.exe
  C:\Windows\System\GQtsAIL.exe
  2⤵
  PID:4396
- C:\Windows\System\EZpbbGf.exe
  C:\Windows\System\EZpbbGf.exe
  2⤵
  PID:5180
- C:\Windows\System\ewSBtDb.exe
  C:\Windows\System\ewSBtDb.exe
  2⤵
  PID:1820
- C:\Windows\System\AfJHNfC.exe
  C:\Windows\System\AfJHNfC.exe
  2⤵
  PID:4680
- C:\Windows\System\xkKeCZK.exe
  C:\Windows\System\xkKeCZK.exe
  2⤵
  PID:5276
- C:\Windows\System\WKEmMdv.exe
  C:\Windows\System\WKEmMdv.exe
  2⤵
  PID:4612
- C:\Windows\System\oKKNMsK.exe
  C:\Windows\System\oKKNMsK.exe
  2⤵
  PID:5456
- C:\Windows\System\ReiABMG.exe
  C:\Windows\System\ReiABMG.exe
  2⤵
  PID:2704
- C:\Windows\System\SercrAI.exe
  C:\Windows\System\SercrAI.exe
  2⤵
  PID:5308
- C:\Windows\System\fcxDrcQ.exe
  C:\Windows\System\fcxDrcQ.exe
  2⤵
  PID:5748
- C:\Windows\System\CydIcLV.exe
  C:\Windows\System\CydIcLV.exe
  2⤵
  PID:4728
- C:\Windows\System\bNdyohE.exe
  C:\Windows\System\bNdyohE.exe
  2⤵
  PID:4244
- C:\Windows\System\OrEvzHw.exe
  C:\Windows\System\OrEvzHw.exe
  2⤵
  PID:4564
- C:\Windows\System\BcHOeql.exe
  C:\Windows\System\BcHOeql.exe
  2⤵
  PID:2588
- C:\Windows\System\zThblqQ.exe
  C:\Windows\System\zThblqQ.exe
  2⤵
  PID:2012
- C:\Windows\System\OUgOFzc.exe
  C:\Windows\System\OUgOFzc.exe
  2⤵
  PID:3940
- C:\Windows\System\dbqpYDZ.exe
  C:\Windows\System\dbqpYDZ.exe
  2⤵
  PID:5468
- C:\Windows\System\ILTdAWo.exe
  C:\Windows\System\ILTdAWo.exe
  2⤵
  PID:4792
- C:\Windows\System\ZMWTNRp.exe
  C:\Windows\System\ZMWTNRp.exe
  2⤵
  PID:5024
- C:\Windows\System\mOWsHPy.exe
  C:\Windows\System\mOWsHPy.exe
  2⤵
  PID:5864
- C:\Windows\System\TeUCeIb.exe
  C:\Windows\System\TeUCeIb.exe
  2⤵
  PID:6000
- C:\Windows\System\WDiUAOX.exe
  C:\Windows\System\WDiUAOX.exe
  2⤵
  PID:6136
- C:\Windows\System\UdGnsQY.exe
  C:\Windows\System\UdGnsQY.exe
  2⤵
  PID:5188
- C:\Windows\System\XZxZWHE.exe
  C:\Windows\System\XZxZWHE.exe
  2⤵
  PID:5216
- C:\Windows\System\nWccyAV.exe
  C:\Windows\System\nWccyAV.exe
  2⤵
  PID:4812
- C:\Windows\System\YwbeELq.exe
  C:\Windows\System\YwbeELq.exe
  2⤵
  PID:5664
- C:\Windows\System\IYBphHS.exe
  C:\Windows\System\IYBphHS.exe
  2⤵
  PID:5692
- C:\Windows\System\OIBBIdB.exe
  C:\Windows\System\OIBBIdB.exe
  2⤵
  PID:6100
- C:\Windows\System\EZnVSnp.exe
  C:\Windows\System\EZnVSnp.exe
  2⤵
  PID:1264
- C:\Windows\System\nZpwkRs.exe
  C:\Windows\System\nZpwkRs.exe
  2⤵
  PID:3252
- C:\Windows\System\lhaIGyy.exe
  C:\Windows\System\lhaIGyy.exe
  2⤵
  PID:3792
- C:\Windows\System\bOmYeOJ.exe
  C:\Windows\System\bOmYeOJ.exe
  2⤵
  PID:5336
- C:\Windows\System\WVDjqCe.exe
  C:\Windows\System\WVDjqCe.exe
  2⤵
  PID:5084
- C:\Windows\System\DOFNQwl.exe
  C:\Windows\System\DOFNQwl.exe
  2⤵
  PID:3280
- C:\Windows\System\yEhfAUL.exe
  C:\Windows\System\yEhfAUL.exe
  2⤵
  PID:4344
- C:\Windows\System\SWLkwUO.exe
  C:\Windows\System\SWLkwUO.exe
  2⤵
  PID:4120
- C:\Windows\System\mBauXxT.exe
  C:\Windows\System\mBauXxT.exe
  2⤵
  PID:4448
- C:\Windows\System\HfkuXMl.exe
  C:\Windows\System\HfkuXMl.exe
  2⤵
  PID:292
- C:\Windows\System\WtAYQdS.exe
  C:\Windows\System\WtAYQdS.exe
  2⤵
  PID:1804
- C:\Windows\System\xtdtDDY.exe
  C:\Windows\System\xtdtDDY.exe
  2⤵
  PID:2556
- C:\Windows\System\Lixsczh.exe
  C:\Windows\System\Lixsczh.exe
  2⤵
  PID:3276
- C:\Windows\System\VqbWvQK.exe
  C:\Windows\System\VqbWvQK.exe
  2⤵
  PID:2016
- C:\Windows\System\qzbFaJX.exe
  C:\Windows\System\qzbFaJX.exe
  2⤵
  PID:5948
- C:\Windows\System\QXSaKnm.exe
  C:\Windows\System\QXSaKnm.exe
  2⤵
  PID:1480
- C:\Windows\System\GQgwZbE.exe
  C:\Windows\System\GQgwZbE.exe
  2⤵
  PID:5520
- C:\Windows\System\prHGLvb.exe
  C:\Windows\System\prHGLvb.exe
  2⤵
  PID:5780
- C:\Windows\System\bQKAOGW.exe
  C:\Windows\System\bQKAOGW.exe
  2⤵
  PID:4012
- C:\Windows\System\LHzKHrm.exe
  C:\Windows\System\LHzKHrm.exe
  2⤵
  PID:5288
- C:\Windows\System\PzRBZIA.exe
  C:\Windows\System\PzRBZIA.exe
  2⤵
  PID:5752
- C:\Windows\System\urbRhgS.exe
  C:\Windows\System\urbRhgS.exe
  2⤵
  PID:5104
- C:\Windows\System\OsHMfWl.exe
  C:\Windows\System\OsHMfWl.exe
  2⤵
  PID:5400
- C:\Windows\System\FejXwBl.exe
  C:\Windows\System\FejXwBl.exe
  2⤵
  PID:3956
- C:\Windows\System\ldoflPA.exe
  C:\Windows\System\ldoflPA.exe
  2⤵
  PID:4844
- C:\Windows\System\chnlRiC.exe
  C:\Windows\System\chnlRiC.exe
  2⤵
  PID:5088
- C:\Windows\System\HzszLQA.exe
  C:\Windows\System\HzszLQA.exe
  2⤵
  PID:2108
- C:\Windows\System\eLHlteQ.exe
  C:\Windows\System\eLHlteQ.exe
  2⤵
  PID:4224
- C:\Windows\System\xxhBkyX.exe
  C:\Windows\System\xxhBkyX.exe
  2⤵
  PID:5144
- C:\Windows\System\qQraVCW.exe
  C:\Windows\System\qQraVCW.exe
  2⤵
  PID:5628
- C:\Windows\System\WMDBfgv.exe
  C:\Windows\System\WMDBfgv.exe
  2⤵
  PID:4192
- C:\Windows\System\plKhFSp.exe
  C:\Windows\System\plKhFSp.exe
  2⤵
  PID:5128
- C:\Windows\System\puoCTZR.exe
  C:\Windows\System\puoCTZR.exe
  2⤵
  PID:6156
- C:\Windows\System\wOeKHFi.exe
  C:\Windows\System\wOeKHFi.exe
  2⤵
  PID:6172
- C:\Windows\System\PCTSyXm.exe
  C:\Windows\System\PCTSyXm.exe
  2⤵
  PID:6188
- C:\Windows\System\qsIvDRc.exe
  C:\Windows\System\qsIvDRc.exe
  2⤵
  PID:6204
- C:\Windows\System\PlfofrJ.exe
  C:\Windows\System\PlfofrJ.exe
  2⤵
  PID:6220
- C:\Windows\System\zBRJrEr.exe
  C:\Windows\System\zBRJrEr.exe
  2⤵
  PID:6236
- C:\Windows\System\fiXPIMQ.exe
  C:\Windows\System\fiXPIMQ.exe
  2⤵
  PID:6252
- C:\Windows\System\LHxOlHF.exe
  C:\Windows\System\LHxOlHF.exe
  2⤵
  PID:6268
- C:\Windows\System\GzEeRwQ.exe
  C:\Windows\System\GzEeRwQ.exe
  2⤵
  PID:6284
- C:\Windows\System\hYNXpEP.exe
  C:\Windows\System\hYNXpEP.exe
  2⤵
  PID:6300
- C:\Windows\System\NtpXOfs.exe
  C:\Windows\System\NtpXOfs.exe
  2⤵
  PID:6316
- C:\Windows\System\TDXtnmo.exe
  C:\Windows\System\TDXtnmo.exe
  2⤵
  PID:6332
- C:\Windows\System\DhhOMCm.exe
  C:\Windows\System\DhhOMCm.exe
  2⤵
  PID:6348
- C:\Windows\System\ahFexuH.exe
  C:\Windows\System\ahFexuH.exe
  2⤵
  PID:6364
- C:\Windows\System\ucXfPgN.exe
  C:\Windows\System\ucXfPgN.exe
  2⤵
  PID:6380
- C:\Windows\System\GkEEoAK.exe
  C:\Windows\System\GkEEoAK.exe
  2⤵
  PID:6396
- C:\Windows\System\pcyeCHC.exe
  C:\Windows\System\pcyeCHC.exe
  2⤵
  PID:6412
- C:\Windows\System\NKkNSJw.exe
  C:\Windows\System\NKkNSJw.exe
  2⤵
  PID:6428
- C:\Windows\System\yQVPTDg.exe
  C:\Windows\System\yQVPTDg.exe
  2⤵
  PID:6444
- C:\Windows\System\QuHBjnH.exe
  C:\Windows\System\QuHBjnH.exe
  2⤵
  PID:6460
- C:\Windows\System\LryIsmP.exe
  C:\Windows\System\LryIsmP.exe
  2⤵
  PID:6476
- C:\Windows\System\WYXATea.exe
  C:\Windows\System\WYXATea.exe
  2⤵
  PID:6492
- C:\Windows\System\vLBILPR.exe
  C:\Windows\System\vLBILPR.exe
  2⤵
  PID:6508
- C:\Windows\System\OtONZPR.exe
  C:\Windows\System\OtONZPR.exe
  2⤵
  PID:6524
- C:\Windows\System\vclAnCj.exe
  C:\Windows\System\vclAnCj.exe
  2⤵
  PID:6540
- C:\Windows\System\YtcUIdG.exe
  C:\Windows\System\YtcUIdG.exe
  2⤵
  PID:6556
- C:\Windows\System\aDigubr.exe
  C:\Windows\System\aDigubr.exe
  2⤵
  PID:6572
- C:\Windows\System\NuTpCeY.exe
  C:\Windows\System\NuTpCeY.exe
  2⤵
  PID:6588
- C:\Windows\System\WtyyAnY.exe
  C:\Windows\System\WtyyAnY.exe
  2⤵
  PID:6604
- C:\Windows\System\qIpomia.exe
  C:\Windows\System\qIpomia.exe
  2⤵
  PID:6620
- C:\Windows\System\ImgnGoy.exe
  C:\Windows\System\ImgnGoy.exe
  2⤵
  PID:6636
- C:\Windows\System\mqSBARn.exe
  C:\Windows\System\mqSBARn.exe
  2⤵
  PID:6652
- C:\Windows\System\HdGrwkW.exe
  C:\Windows\System\HdGrwkW.exe
  2⤵
  PID:6668
- C:\Windows\System\SKyhiHE.exe
  C:\Windows\System\SKyhiHE.exe
  2⤵
  PID:6684
- C:\Windows\System\sZnFfed.exe
  C:\Windows\System\sZnFfed.exe
  2⤵
  PID:6700
- C:\Windows\System\aYrzUSk.exe
  C:\Windows\System\aYrzUSk.exe
  2⤵
  PID:6716
- C:\Windows\System\krnbvbP.exe
  C:\Windows\System\krnbvbP.exe
  2⤵
  PID:6732
- C:\Windows\System\EnyfWbn.exe
  C:\Windows\System\EnyfWbn.exe
  2⤵
  PID:6748
- C:\Windows\System\TBTHgmp.exe
  C:\Windows\System\TBTHgmp.exe
  2⤵
  PID:6764
- C:\Windows\System\wpiBEcW.exe
  C:\Windows\System\wpiBEcW.exe
  2⤵
  PID:6784
- C:\Windows\System\fAMEYJz.exe
  C:\Windows\System\fAMEYJz.exe
  2⤵
  PID:6804
- C:\Windows\System\IDUMHdV.exe
  C:\Windows\System\IDUMHdV.exe
  2⤵
  PID:6820
- C:\Windows\System\rVEVdqT.exe
  C:\Windows\System\rVEVdqT.exe
  2⤵
  PID:6844
- C:\Windows\System\pQtbwMa.exe
  C:\Windows\System\pQtbwMa.exe
  2⤵
  PID:6876
- C:\Windows\System\fobLNhL.exe
  C:\Windows\System\fobLNhL.exe
  2⤵
  PID:6916
- C:\Windows\System\fprWtKS.exe
  C:\Windows\System\fprWtKS.exe
  2⤵
  PID:6944
- C:\Windows\System\sKggwJL.exe
  C:\Windows\System\sKggwJL.exe
  2⤵
  PID:6960
- C:\Windows\System\wTazcEq.exe
  C:\Windows\System\wTazcEq.exe
  2⤵
  PID:6976
- C:\Windows\System\nSsLHaK.exe
  C:\Windows\System\nSsLHaK.exe
  2⤵
  PID:6992
- C:\Windows\System\dVxHsfg.exe
  C:\Windows\System\dVxHsfg.exe
  2⤵
  PID:7008
- C:\Windows\System\NkicIIK.exe
  C:\Windows\System\NkicIIK.exe
  2⤵
  PID:7024
- C:\Windows\System\JFcrSPf.exe
  C:\Windows\System\JFcrSPf.exe
  2⤵
  PID:7040
- C:\Windows\System\VfuHjpE.exe
  C:\Windows\System\VfuHjpE.exe
  2⤵
  PID:7060
- C:\Windows\System\iKBjxZf.exe
  C:\Windows\System\iKBjxZf.exe
  2⤵
  PID:7076
- C:\Windows\System\gKasCRv.exe
  C:\Windows\System\gKasCRv.exe
  2⤵
  PID:7092
- C:\Windows\System\QTrtWwA.exe
  C:\Windows\System\QTrtWwA.exe
  2⤵
  PID:7108
- C:\Windows\System\VzOAzmF.exe
  C:\Windows\System\VzOAzmF.exe
  2⤵
  PID:7124
- C:\Windows\System\IZQhwQp.exe
  C:\Windows\System\IZQhwQp.exe
  2⤵
  PID:7140
- C:\Windows\System\yqlqrBh.exe
  C:\Windows\System\yqlqrBh.exe
  2⤵
  PID:7156
- C:\Windows\System\mlYFEfN.exe
  C:\Windows\System\mlYFEfN.exe
  2⤵
  PID:1292
- C:\Windows\System\bTugPFn.exe
  C:\Windows\System\bTugPFn.exe
  2⤵
  PID:2572
- C:\Windows\System\HgiFwVH.exe
  C:\Windows\System\HgiFwVH.exe
  2⤵
  PID:5304
- C:\Windows\System\oPUjbMW.exe
  C:\Windows\System\oPUjbMW.exe
  2⤵
  PID:5332
- C:\Windows\System\KoItrYi.exe
  C:\Windows\System\KoItrYi.exe
  2⤵
  PID:5472
- C:\Windows\System\SdltsQO.exe
  C:\Windows\System\SdltsQO.exe
  2⤵
  PID:5912
- C:\Windows\System\XTHVNww.exe
  C:\Windows\System\XTHVNww.exe
  2⤵
  PID:6080
- C:\Windows\System\RIQsmva.exe
  C:\Windows\System\RIQsmva.exe
  2⤵
  PID:3376
- C:\Windows\System\NGdBiOs.exe
  C:\Windows\System\NGdBiOs.exe
  2⤵
  PID:6184
- C:\Windows\System\BDkrLas.exe
  C:\Windows\System\BDkrLas.exe
  2⤵
  PID:3892
- C:\Windows\System\NrQLElA.exe
  C:\Windows\System\NrQLElA.exe
  2⤵
  PID:3424
- C:\Windows\System\BzeBNaj.exe
  C:\Windows\System\BzeBNaj.exe
  2⤵
  PID:6248
- C:\Windows\System\ZFIwAXy.exe
  C:\Windows\System\ZFIwAXy.exe
  2⤵
  PID:4708
- C:\Windows\System\PqPrTxW.exe
  C:\Windows\System\PqPrTxW.exe
  2⤵
  PID:6196
- C:\Windows\System\QywEIUz.exe
  C:\Windows\System\QywEIUz.exe
  2⤵
  PID:6328
- C:\Windows\System\sqvrwGL.exe
  C:\Windows\System\sqvrwGL.exe
  2⤵
  PID:6392
- C:\Windows\System\dwODaah.exe
  C:\Windows\System\dwODaah.exe
  2⤵
  PID:6308
- C:\Windows\System\GSDXGkF.exe
  C:\Windows\System\GSDXGkF.exe
  2⤵
  PID:6344
- C:\Windows\System\kKUrvgz.exe
  C:\Windows\System\kKUrvgz.exe
  2⤵
  PID:6408
- C:\Windows\System\auOCgPZ.exe
  C:\Windows\System\auOCgPZ.exe
  2⤵
  PID:6472
- C:\Windows\System\OBGEbPh.exe
  C:\Windows\System\OBGEbPh.exe
  2⤵
  PID:6536
- C:\Windows\System\AoCqDZc.exe
  C:\Windows\System\AoCqDZc.exe
  2⤵
  PID:6596
- C:\Windows\System\xguFYOG.exe
  C:\Windows\System\xguFYOG.exe
  2⤵
  PID:6724
- C:\Windows\System\vbRhYgB.exe
  C:\Windows\System\vbRhYgB.exe
  2⤵
  PID:6728
- C:\Windows\System\SbsZcnd.exe
  C:\Windows\System\SbsZcnd.exe
  2⤵
  PID:6800
- C:\Windows\System\XEUBXVH.exe
  C:\Windows\System\XEUBXVH.exe
  2⤵
  PID:6424
- C:\Windows\System\gQNuVlR.exe
  C:\Windows\System\gQNuVlR.exe
  2⤵
  PID:6488
- C:\Windows\System\hicfITY.exe
  C:\Windows\System\hicfITY.exe
  2⤵
  PID:6552
- C:\Windows\System\chGEcio.exe
  C:\Windows\System\chGEcio.exe
  2⤵
  PID:6840
- C:\Windows\System\XCnmumS.exe
  C:\Windows\System\XCnmumS.exe
  2⤵
  PID:6896
- C:\Windows\System\DfDxCyZ.exe
  C:\Windows\System\DfDxCyZ.exe
  2⤵
  PID:6644
- C:\Windows\System\PPWjslb.exe
  C:\Windows\System\PPWjslb.exe
  2⤵
  PID:6708
- C:\Windows\System\LGiWkic.exe
  C:\Windows\System\LGiWkic.exe
  2⤵
  PID:6772
- C:\Windows\System\bGCefdg.exe
  C:\Windows\System\bGCefdg.exe
  2⤵
  PID:6816
- C:\Windows\System\uGLttgY.exe
  C:\Windows\System\uGLttgY.exe
  2⤵
  PID:6908
- C:\Windows\System\cvjWuDw.exe
  C:\Windows\System\cvjWuDw.exe
  2⤵
  PID:6932
- C:\Windows\System\UuygjoC.exe
  C:\Windows\System\UuygjoC.exe
  2⤵
  PID:6952
- C:\Windows\System\mBRmveO.exe
  C:\Windows\System\mBRmveO.exe
  2⤵
  PID:6984
- C:\Windows\System\mTHitjk.exe
  C:\Windows\System\mTHitjk.exe
  2⤵
  PID:7000
- C:\Windows\System\KSkpjCx.exe
  C:\Windows\System\KSkpjCx.exe
  2⤵
  PID:7068
- C:\Windows\System\VKxnEwu.exe
  C:\Windows\System\VKxnEwu.exe
  2⤵
  PID:7052
- C:\Windows\System\jyxFxgc.exe
  C:\Windows\System\jyxFxgc.exe
  2⤵
  PID:7116
- C:\Windows\System\CpPExSL.exe
  C:\Windows\System\CpPExSL.exe
  2⤵
  PID:7152
- C:\Windows\System\sPOEyFy.exe
  C:\Windows\System\sPOEyFy.exe
  2⤵
  PID:772
- C:\Windows\System\dyFIfEn.exe
  C:\Windows\System\dyFIfEn.exe
  2⤵
  PID:2208
- C:\Windows\System\MuYrabK.exe
  C:\Windows\System\MuYrabK.exe
  2⤵
  PID:3640
- C:\Windows\System\RfOWxoc.exe
  C:\Windows\System\RfOWxoc.exe
  2⤵
  PID:4408
- C:\Windows\System\TLYRJql.exe
  C:\Windows\System\TLYRJql.exe
  2⤵
  PID:6152
- C:\Windows\System\JaHByjm.exe
  C:\Windows\System\JaHByjm.exe
  2⤵
  PID:6216
- C:\Windows\System\hbolWrK.exe
  C:\Windows\System\hbolWrK.exe
  2⤵
  PID:6324
- C:\Windows\System\MtCQOTD.exe
  C:\Windows\System\MtCQOTD.exe
  2⤵
  PID:6404
- C:\Windows\System\qqCEUGT.exe
  C:\Windows\System\qqCEUGT.exe
  2⤵
  PID:6760
- C:\Windows\System\ZFSbCdn.exe
  C:\Windows\System\ZFSbCdn.exe
  2⤵
  PID:6584
- C:\Windows\System\MUafwvH.exe
  C:\Windows\System\MUafwvH.exe
  2⤵
  PID:6868
- C:\Windows\System\dzEpvhE.exe
  C:\Windows\System\dzEpvhE.exe
  2⤵
  PID:6164
- C:\Windows\System\ptmcBwg.exe
  C:\Windows\System\ptmcBwg.exe
  2⤵
  PID:6564
- C:\Windows\System\DqxmEUK.exe
  C:\Windows\System\DqxmEUK.exe
  2⤵
  PID:6312
- C:\Windows\System\XaSbAlS.exe
  C:\Windows\System\XaSbAlS.exe
  2⤵
  PID:6900
- C:\Windows\System\IWhBCup.exe
  C:\Windows\System\IWhBCup.exe
  2⤵
  PID:6680
- C:\Windows\System\adHFcyo.exe
  C:\Windows\System\adHFcyo.exe
  2⤵
  PID:6548
- C:\Windows\System\OzaKFvd.exe
  C:\Windows\System\OzaKFvd.exe
  2⤵
  PID:6676
- C:\Windows\System\hsgNnjS.exe
  C:\Windows\System\hsgNnjS.exe
  2⤵
  PID:6940
- C:\Windows\System\JYWWNPn.exe
  C:\Windows\System\JYWWNPn.exe
  2⤵
  PID:7048
- C:\Windows\System\EXKBApf.exe
  C:\Windows\System\EXKBApf.exe
  2⤵
  PID:3516
- C:\Windows\System\uYNutmI.exe
  C:\Windows\System\uYNutmI.exe
  2⤵
  PID:5600
- C:\Windows\System\UzmWpLg.exe
  C:\Windows\System\UzmWpLg.exe
  2⤵
  PID:6244
- C:\Windows\System\mxbfmjB.exe
  C:\Windows\System\mxbfmjB.exe
  2⤵
  PID:6928
- C:\Windows\System\fKGSWKg.exe
  C:\Windows\System\fKGSWKg.exe
  2⤵
  PID:6600
- C:\Windows\System\NNivJdA.exe
  C:\Windows\System\NNivJdA.exe
  2⤵
  PID:7136
- C:\Windows\System\vmzEmBW.exe
  C:\Windows\System\vmzEmBW.exe
  2⤵
  PID:6228
- C:\Windows\System\OMVpCFq.exe
  C:\Windows\System\OMVpCFq.exe
  2⤵
  PID:6892
- C:\Windows\System\mEMZffy.exe
  C:\Windows\System\mEMZffy.exe
  2⤵
  PID:7184
- C:\Windows\System\fMAXjhk.exe
  C:\Windows\System\fMAXjhk.exe
  2⤵
  PID:7200
- C:\Windows\System\mzIAWUY.exe
  C:\Windows\System\mzIAWUY.exe
  2⤵
  PID:7216
- C:\Windows\System\gynfwWm.exe
  C:\Windows\System\gynfwWm.exe
  2⤵
  PID:7232
- C:\Windows\System\mZpsIfO.exe
  C:\Windows\System\mZpsIfO.exe
  2⤵
  PID:7248
- C:\Windows\System\pEeowXf.exe
  C:\Windows\System\pEeowXf.exe
  2⤵
  PID:7264
- C:\Windows\System\AIDMvvL.exe
  C:\Windows\System\AIDMvvL.exe
  2⤵
  PID:7280
- C:\Windows\System\zIYrCal.exe
  C:\Windows\System\zIYrCal.exe
  2⤵
  PID:7296
- C:\Windows\System\doTKvck.exe
  C:\Windows\System\doTKvck.exe
  2⤵
  PID:7312
- C:\Windows\System\XgmVETd.exe
  C:\Windows\System\XgmVETd.exe
  2⤵
  PID:7328
- C:\Windows\System\jojCrVp.exe
  C:\Windows\System\jojCrVp.exe
  2⤵
  PID:7344
- C:\Windows\System\wanyENl.exe
  C:\Windows\System\wanyENl.exe
  2⤵
  PID:7360
- C:\Windows\System\ujTmbvk.exe
  C:\Windows\System\ujTmbvk.exe
  2⤵
  PID:7376
- C:\Windows\System\RXTPnCN.exe
  C:\Windows\System\RXTPnCN.exe
  2⤵
  PID:7392
- C:\Windows\System\HsOuaFE.exe
  C:\Windows\System\HsOuaFE.exe
  2⤵
  PID:7408
- C:\Windows\System\mGyBcAI.exe
  C:\Windows\System\mGyBcAI.exe
  2⤵
  PID:7424
- C:\Windows\System\eHwVOAv.exe
  C:\Windows\System\eHwVOAv.exe
  2⤵
  PID:7440
- C:\Windows\System\MoySreC.exe
  C:\Windows\System\MoySreC.exe
  2⤵
  PID:7456
- C:\Windows\System\dYOZznf.exe
  C:\Windows\System\dYOZznf.exe
  2⤵
  PID:7472
- C:\Windows\System\bkDbAYG.exe
  C:\Windows\System\bkDbAYG.exe
  2⤵
  PID:7488
- C:\Windows\System\HsZGWBv.exe
  C:\Windows\System\HsZGWBv.exe
  2⤵
  PID:7504
- C:\Windows\System\onpyiwx.exe
  C:\Windows\System\onpyiwx.exe
  2⤵
  PID:7520
- C:\Windows\System\HnOObsh.exe
  C:\Windows\System\HnOObsh.exe
  2⤵
  PID:7536
- C:\Windows\System\qcYuqAG.exe
  C:\Windows\System\qcYuqAG.exe
  2⤵
  PID:7552
- C:\Windows\System\ZpklvrY.exe
  C:\Windows\System\ZpklvrY.exe
  2⤵
  PID:7568
- C:\Windows\System\VKeDlYr.exe
  C:\Windows\System\VKeDlYr.exe
  2⤵
  PID:7584
- C:\Windows\System\LNuFhrm.exe
  C:\Windows\System\LNuFhrm.exe
  2⤵
  PID:7600
- C:\Windows\System\QKwMkSj.exe
  C:\Windows\System\QKwMkSj.exe
  2⤵
  PID:7616
- C:\Windows\System\oUcBooe.exe
  C:\Windows\System\oUcBooe.exe
  2⤵
  PID:7632
- C:\Windows\System\gkRiDvu.exe
  C:\Windows\System\gkRiDvu.exe
  2⤵
  PID:7648
- C:\Windows\System\SRONVWR.exe
  C:\Windows\System\SRONVWR.exe
  2⤵
  PID:7664
- C:\Windows\System\NryhPJf.exe
  C:\Windows\System\NryhPJf.exe
  2⤵
  PID:7680
- C:\Windows\System\uMELApm.exe
  C:\Windows\System\uMELApm.exe
  2⤵
  PID:7696
- C:\Windows\System\gUBITkD.exe
  C:\Windows\System\gUBITkD.exe
  2⤵
  PID:7712
- C:\Windows\System\ZGThfcL.exe
  C:\Windows\System\ZGThfcL.exe
  2⤵
  PID:7728
- C:\Windows\System\LCfnvwE.exe
  C:\Windows\System\LCfnvwE.exe
  2⤵
  PID:7744
- C:\Windows\System\yAWBGCO.exe
  C:\Windows\System\yAWBGCO.exe
  2⤵
  PID:7760
- C:\Windows\System\MUihDst.exe
  C:\Windows\System\MUihDst.exe
  2⤵
  PID:7776
- C:\Windows\System\RtlObOE.exe
  C:\Windows\System\RtlObOE.exe
  2⤵
  PID:7792
- C:\Windows\System\mmQEudK.exe
  C:\Windows\System\mmQEudK.exe
  2⤵
  PID:7808
- C:\Windows\System\aWOfJDQ.exe
  C:\Windows\System\aWOfJDQ.exe
  2⤵
  PID:7824
- C:\Windows\System\lYRXfXC.exe
  C:\Windows\System\lYRXfXC.exe
  2⤵
  PID:7840
- C:\Windows\System\dYwSoEr.exe
  C:\Windows\System\dYwSoEr.exe
  2⤵
  PID:7856
- C:\Windows\System\zEAFsMB.exe
  C:\Windows\System\zEAFsMB.exe
  2⤵
  PID:7872
- C:\Windows\System\UAtxSZB.exe
  C:\Windows\System\UAtxSZB.exe
  2⤵
  PID:7888
- C:\Windows\System\NwhdEmG.exe
  C:\Windows\System\NwhdEmG.exe
  2⤵
  PID:7904
- C:\Windows\System\RGhzmKf.exe
  C:\Windows\System\RGhzmKf.exe
  2⤵
  PID:7920
- C:\Windows\System\ulYkMkq.exe
  C:\Windows\System\ulYkMkq.exe
  2⤵
  PID:7936
- C:\Windows\System\vIISDNq.exe
  C:\Windows\System\vIISDNq.exe
  2⤵
  PID:7952
- C:\Windows\System\BCYRALl.exe
  C:\Windows\System\BCYRALl.exe
  2⤵
  PID:7968
- C:\Windows\System\ymlDOqR.exe
  C:\Windows\System\ymlDOqR.exe
  2⤵
  PID:7984
- C:\Windows\System\EXRFqCM.exe
  C:\Windows\System\EXRFqCM.exe
  2⤵
  PID:8000
- C:\Windows\System\tzIeUYo.exe
  C:\Windows\System\tzIeUYo.exe
  2⤵
  PID:8016
- C:\Windows\System\ZbxFMde.exe
  C:\Windows\System\ZbxFMde.exe
  2⤵
  PID:8032
- C:\Windows\System\tWcCiJK.exe
  C:\Windows\System\tWcCiJK.exe
  2⤵
  PID:8048
- C:\Windows\System\urVcUsk.exe
  C:\Windows\System\urVcUsk.exe
  2⤵
  PID:8064
- C:\Windows\System\QpLyAVz.exe
  C:\Windows\System\QpLyAVz.exe
  2⤵
  PID:8080
- C:\Windows\System\qNEIIbX.exe
  C:\Windows\System\qNEIIbX.exe
  2⤵
  PID:8096
- C:\Windows\System\CIJqQNO.exe
  C:\Windows\System\CIJqQNO.exe
  2⤵
  PID:8112
- C:\Windows\System\ojMrVRU.exe
  C:\Windows\System\ojMrVRU.exe
  2⤵
  PID:8128
- C:\Windows\System\NdRiflR.exe
  C:\Windows\System\NdRiflR.exe
  2⤵
  PID:8144
- C:\Windows\System\GcecPJi.exe
  C:\Windows\System\GcecPJi.exe
  2⤵
  PID:8160
- C:\Windows\System\RsqXvwQ.exe
  C:\Windows\System\RsqXvwQ.exe
  2⤵
  PID:8176
- C:\Windows\System\eBJKUoe.exe
  C:\Windows\System\eBJKUoe.exe
  2⤵
  PID:4976
- C:\Windows\System\ZGXFEag.exe
  C:\Windows\System\ZGXFEag.exe
  2⤵
  PID:7196
- C:\Windows\System\CuMuCyX.exe
  C:\Windows\System\CuMuCyX.exe
  2⤵
  PID:7260
- C:\Windows\System\YkTImLJ.exe
  C:\Windows\System\YkTImLJ.exe
  2⤵
  PID:6972
- C:\Windows\System\KvkRVmh.exe
  C:\Windows\System\KvkRVmh.exe
  2⤵
  PID:7084
- C:\Windows\System\YCCzFtc.exe
  C:\Windows\System\YCCzFtc.exe
  2⤵
  PID:6440
- C:\Windows\System\qBfDYuO.exe
  C:\Windows\System\qBfDYuO.exe
  2⤵
  PID:5480
- C:\Windows\System\lDkyULW.exe
  C:\Windows\System\lDkyULW.exe
  2⤵
  PID:6232
- C:\Windows\System\yJmeKGX.exe
  C:\Windows\System\yJmeKGX.exe
  2⤵
  PID:6456
- C:\Windows\System\xAjkBSy.exe
  C:\Windows\System\xAjkBSy.exe
  2⤵
  PID:7104
- C:\Windows\System\BAgEAmV.exe
  C:\Windows\System\BAgEAmV.exe
  2⤵
  PID:6360
- C:\Windows\System\aETUxGO.exe
  C:\Windows\System\aETUxGO.exe
  2⤵
  PID:7208
- C:\Windows\System\OXEIKBA.exe
  C:\Windows\System\OXEIKBA.exe
  2⤵
  PID:7276
- C:\Windows\System\HXcjEtK.exe
  C:\Windows\System\HXcjEtK.exe
  2⤵
  PID:7324
- C:\Windows\System\OjDMrhG.exe
  C:\Windows\System\OjDMrhG.exe
  2⤵
  PID:7416
- C:\Windows\System\ajsKLWA.exe
  C:\Windows\System\ajsKLWA.exe
  2⤵
  PID:7452
- C:\Windows\System\ezquOcw.exe
  C:\Windows\System\ezquOcw.exe
  2⤵
  PID:7516
- C:\Windows\System\XZaEYFC.exe
  C:\Windows\System\XZaEYFC.exe
  2⤵
  PID:7580
- C:\Windows\System\uBBDnyr.exe
  C:\Windows\System\uBBDnyr.exe
  2⤵
  PID:7644
- C:\Windows\System\xcPQHNB.exe
  C:\Windows\System\xcPQHNB.exe
  2⤵
  PID:7372
- C:\Windows\System\AzomGSD.exe
  C:\Windows\System\AzomGSD.exe
  2⤵
  PID:7340
- C:\Windows\System\yyHtDYA.exe
  C:\Windows\System\yyHtDYA.exe
  2⤵
  PID:7660
- C:\Windows\System\TbvHFej.exe
  C:\Windows\System\TbvHFej.exe
  2⤵
  PID:7740
- C:\Windows\System\TwPqyTv.exe
  C:\Windows\System\TwPqyTv.exe
  2⤵
  PID:7432
- C:\Windows\System\mVdIQoT.exe
  C:\Windows\System\mVdIQoT.exe
  2⤵
  PID:7528
- C:\Windows\System\mAmVhFO.exe
  C:\Windows\System\mAmVhFO.exe
  2⤵
  PID:7596
- C:\Windows\System\YCgBXzd.exe
  C:\Windows\System\YCgBXzd.exe
  2⤵
  PID:7756
- C:\Windows\System\dpUDMJc.exe
  C:\Windows\System\dpUDMJc.exe
  2⤵
  PID:7880
- C:\Windows\System\YcZWHHG.exe
  C:\Windows\System\YcZWHHG.exe
  2⤵
  PID:7896
- C:\Windows\System\xZKdLuW.exe
  C:\Windows\System\xZKdLuW.exe
  2⤵
  PID:7768
- C:\Windows\System\KQzaHJU.exe
  C:\Windows\System\KQzaHJU.exe
  2⤵
  PID:7868
- C:\Windows\System\pUMhRcz.exe
  C:\Windows\System\pUMhRcz.exe
  2⤵
  PID:7944
- C:\Windows\System\sQSYKRi.exe
  C:\Windows\System\sQSYKRi.exe
  2⤵
  PID:7992
- C:\Windows\System\vAPYtwA.exe
  C:\Windows\System\vAPYtwA.exe
  2⤵
  PID:7948
- C:\Windows\System\vZpBTKL.exe
  C:\Windows\System\vZpBTKL.exe
  2⤵
  PID:7976
- C:\Windows\System\wxEYloT.exe
  C:\Windows\System\wxEYloT.exe
  2⤵
  PID:8124
- C:\Windows\System\yQGVOXO.exe
  C:\Windows\System\yQGVOXO.exe
  2⤵
  PID:8188
- C:\Windows\System\blYStZO.exe
  C:\Windows\System\blYStZO.exe
  2⤵
  PID:6296
- C:\Windows\System\RIHdbHJ.exe
  C:\Windows\System\RIHdbHJ.exe
  2⤵
  PID:6696
- C:\Windows\System\evWHCWa.exe
  C:\Windows\System\evWHCWa.exe
  2⤵
  PID:8012
- C:\Windows\System\jNovRYg.exe
  C:\Windows\System\jNovRYg.exe
  2⤵
  PID:8072
- C:\Windows\System\qKosGOc.exe
  C:\Windows\System\qKosGOc.exe
  2⤵
  PID:8168
- C:\Windows\System\FmlLidF.exe
  C:\Windows\System\FmlLidF.exe
  2⤵
  PID:6812
- C:\Windows\System\kDoFyAd.exe
  C:\Windows\System\kDoFyAd.exe
  2⤵
  PID:8172
- C:\Windows\System\YHVxOEY.exe
  C:\Windows\System\YHVxOEY.exe
  2⤵
  PID:7484
- C:\Windows\System\eDJyCOi.exe
  C:\Windows\System\eDJyCOi.exe
  2⤵
  PID:7272
- C:\Windows\System\HxPmKOK.exe
  C:\Windows\System\HxPmKOK.exe
  2⤵
  PID:7640
- C:\Windows\System\LvhMSyS.exe
  C:\Windows\System\LvhMSyS.exe
  2⤵
  PID:7176
- C:\Windows\System\GuhLbJs.exe
  C:\Windows\System\GuhLbJs.exe
  2⤵
  PID:7500
- C:\Windows\System\wJyWttu.exe
  C:\Windows\System\wJyWttu.exe
  2⤵
  PID:7804
- C:\Windows\System\XPXEecP.exe
  C:\Windows\System\XPXEecP.exe
  2⤵
  PID:7864
- C:\Windows\System\LnUNcVx.exe
  C:\Windows\System\LnUNcVx.exe
  2⤵
  PID:7960
- C:\Windows\System\fzLzjGE.exe
  C:\Windows\System\fzLzjGE.exe
  2⤵
  PID:7816
- C:\Windows\System\TETwNxj.exe
  C:\Windows\System\TETwNxj.exe
  2⤵
  PID:8060
- C:\Windows\System\uaWzHPN.exe
  C:\Windows\System\uaWzHPN.exe
  2⤵
  PID:6836
- C:\Windows\System\VKtByRO.exe
  C:\Windows\System\VKtByRO.exe
  2⤵
  PID:7852
- C:\Windows\System\AiZvJDU.exe
  C:\Windows\System\AiZvJDU.exe
  2⤵
  PID:8044
- C:\Windows\System\BOeFBdH.exe
  C:\Windows\System\BOeFBdH.exe
  2⤵
  PID:7240
- C:\Windows\System\CfgOhlQ.exe
  C:\Windows\System\CfgOhlQ.exe
  2⤵
  PID:7384
- C:\Windows\System\bEfZKuZ.exe
  C:\Windows\System\bEfZKuZ.exe
  2⤵
  PID:7088
- C:\Windows\System\TgvLAKZ.exe
  C:\Windows\System\TgvLAKZ.exe
  2⤵
  PID:6484
- C:\Windows\System\jrOixuN.exe
  C:\Windows\System\jrOixuN.exe
  2⤵
  PID:8120
- C:\Windows\System\hwyoBNO.exe
  C:\Windows\System\hwyoBNO.exe
  2⤵
  PID:8140
- C:\Windows\System\OdnbmtO.exe
  C:\Windows\System\OdnbmtO.exe
  2⤵
  PID:7560
- C:\Windows\System\dxhTtcK.exe
  C:\Windows\System\dxhTtcK.exe
  2⤵
  PID:7912
- C:\Windows\System\WNCXcZX.exe
  C:\Windows\System\WNCXcZX.exe
  2⤵
  PID:7784
- C:\Windows\System\hHtiIQA.exe
  C:\Windows\System\hHtiIQA.exe
  2⤵
  PID:7772
- C:\Windows\System\VzVrSsA.exe
  C:\Windows\System\VzVrSsA.exe
  2⤵
  PID:7848
- C:\Windows\System\qmEWyWV.exe
  C:\Windows\System\qmEWyWV.exe
  2⤵
  PID:7180
- C:\Windows\System\ZGUjpox.exe
  C:\Windows\System\ZGUjpox.exe
  2⤵
  PID:7916
- C:\Windows\System\GszNERa.exe
  C:\Windows\System\GszNERa.exe
  2⤵
  PID:7388
- C:\Windows\System\eYbgUge.exe
  C:\Windows\System\eYbgUge.exe
  2⤵
  PID:7468
- C:\Windows\System\VmUhfXk.exe
  C:\Windows\System\VmUhfXk.exe
  2⤵
  PID:8136
- C:\Windows\System\albkAwU.exe
  C:\Windows\System\albkAwU.exe
  2⤵
  PID:7592
- C:\Windows\System\MHSbebr.exe
  C:\Windows\System\MHSbebr.exe
  2⤵
  PID:7400
- C:\Windows\System\bBiZWqk.exe
  C:\Windows\System\bBiZWqk.exe
  2⤵
  PID:7656
- C:\Windows\System\WxNVMhX.exe
  C:\Windows\System\WxNVMhX.exe
  2⤵
  PID:8196
- C:\Windows\System\vczcAgP.exe
  C:\Windows\System\vczcAgP.exe
  2⤵
  PID:8212
- C:\Windows\System\FBfkHbw.exe
  C:\Windows\System\FBfkHbw.exe
  2⤵
  PID:8228
- C:\Windows\System\GeTMXxC.exe
  C:\Windows\System\GeTMXxC.exe
  2⤵
  PID:8244
- C:\Windows\System\fMYvCaE.exe
  C:\Windows\System\fMYvCaE.exe
  2⤵
  PID:8260
- C:\Windows\System\qgQOGsi.exe
  C:\Windows\System\qgQOGsi.exe
  2⤵
  PID:8276
- C:\Windows\System\ARpFuTz.exe
  C:\Windows\System\ARpFuTz.exe
  2⤵
  PID:8292
- C:\Windows\System\rvjpDXL.exe
  C:\Windows\System\rvjpDXL.exe
  2⤵
  PID:8308
- C:\Windows\System\wbVMVAq.exe
  C:\Windows\System\wbVMVAq.exe
  2⤵
  PID:8324
- C:\Windows\System\FnGOOhR.exe
  C:\Windows\System\FnGOOhR.exe
  2⤵
  PID:8340
- C:\Windows\System\TsQaMoO.exe
  C:\Windows\System\TsQaMoO.exe
  2⤵
  PID:8356
- C:\Windows\System\DxgTUQH.exe
  C:\Windows\System\DxgTUQH.exe
  2⤵
  PID:8372
- C:\Windows\System\BicHQCW.exe
  C:\Windows\System\BicHQCW.exe
  2⤵
  PID:8388
- C:\Windows\System\ZdzQoLt.exe
  C:\Windows\System\ZdzQoLt.exe
  2⤵
  PID:8404
- C:\Windows\System\WNKwDMH.exe
  C:\Windows\System\WNKwDMH.exe
  2⤵
  PID:8420
- C:\Windows\System\ZTuzDac.exe
  C:\Windows\System\ZTuzDac.exe
  2⤵
  PID:8436
- C:\Windows\System\DTYyKoE.exe
  C:\Windows\System\DTYyKoE.exe
  2⤵
  PID:8452
- C:\Windows\System\BZhCxqi.exe
  C:\Windows\System\BZhCxqi.exe
  2⤵
  PID:8472
- C:\Windows\System\TpcFoDi.exe
  C:\Windows\System\TpcFoDi.exe
  2⤵
  PID:8488
- C:\Windows\System\QTrmbXt.exe
  C:\Windows\System\QTrmbXt.exe
  2⤵
  PID:8504
- C:\Windows\System\UYTXsaj.exe
  C:\Windows\System\UYTXsaj.exe
  2⤵
  PID:8520
- C:\Windows\System\HexHWjE.exe
  C:\Windows\System\HexHWjE.exe
  2⤵
  PID:8536
- C:\Windows\System\aaurBli.exe
  C:\Windows\System\aaurBli.exe
  2⤵
  PID:8552
- C:\Windows\System\CcbSXTQ.exe
  C:\Windows\System\CcbSXTQ.exe
  2⤵
  PID:8572
- C:\Windows\System\HvIytFM.exe
  C:\Windows\System\HvIytFM.exe
  2⤵
  PID:8588
- C:\Windows\System\hpWZVdQ.exe
  C:\Windows\System\hpWZVdQ.exe
  2⤵
  PID:8604
- C:\Windows\System\chrwSVp.exe
  C:\Windows\System\chrwSVp.exe
  2⤵
  PID:8620
- C:\Windows\System\QsNTnRy.exe
  C:\Windows\System\QsNTnRy.exe
  2⤵
  PID:8636
- C:\Windows\System\kLlDSsY.exe
  C:\Windows\System\kLlDSsY.exe
  2⤵
  PID:8652
- C:\Windows\System\oJoUjme.exe
  C:\Windows\System\oJoUjme.exe
  2⤵
  PID:8668
- C:\Windows\System\iDyyvMf.exe
  C:\Windows\System\iDyyvMf.exe
  2⤵
  PID:8684
- C:\Windows\System\sjOHPAo.exe
  C:\Windows\System\sjOHPAo.exe
  2⤵
  PID:8700
- C:\Windows\System\XxdjAIt.exe
  C:\Windows\System\XxdjAIt.exe
  2⤵
  PID:8716
- C:\Windows\System\pFCbxsX.exe
  C:\Windows\System\pFCbxsX.exe
  2⤵
  PID:8732
- C:\Windows\System\LUgNgiC.exe
  C:\Windows\System\LUgNgiC.exe
  2⤵
  PID:8748
- C:\Windows\System\cIDyZcQ.exe
  C:\Windows\System\cIDyZcQ.exe
  2⤵
  PID:8764
- C:\Windows\System\XaXjkPB.exe
  C:\Windows\System\XaXjkPB.exe
  2⤵
  PID:8780
- C:\Windows\System\GzfpXIa.exe
  C:\Windows\System\GzfpXIa.exe
  2⤵
  PID:8796
- C:\Windows\System\hDcoCTx.exe
  C:\Windows\System\hDcoCTx.exe
  2⤵
  PID:8812
- C:\Windows\System\CTWxCNa.exe
  C:\Windows\System\CTWxCNa.exe
  2⤵
  PID:8828
- C:\Windows\System\HERYYmV.exe
  C:\Windows\System\HERYYmV.exe
  2⤵
  PID:8844
- C:\Windows\System\qmmSpia.exe
  C:\Windows\System\qmmSpia.exe
  2⤵
  PID:8860
- C:\Windows\System\mFLQxxQ.exe
  C:\Windows\System\mFLQxxQ.exe
  2⤵
  PID:8884
- C:\Windows\System\GfgkVLg.exe
  C:\Windows\System\GfgkVLg.exe
  2⤵
  PID:8900
- C:\Windows\System\VtmypAv.exe
  C:\Windows\System\VtmypAv.exe
  2⤵
  PID:8916
- C:\Windows\System\ZrEgKwB.exe
  C:\Windows\System\ZrEgKwB.exe
  2⤵
  PID:8932
- C:\Windows\System\TwGxppt.exe
  C:\Windows\System\TwGxppt.exe
  2⤵
  PID:8980
- C:\Windows\System\yYMiRoV.exe
  C:\Windows\System\yYMiRoV.exe
  2⤵
  PID:8996
- C:\Windows\System\ZVGMkXS.exe
  C:\Windows\System\ZVGMkXS.exe
  2⤵
  PID:9016
- C:\Windows\System\ydbXqdN.exe
  C:\Windows\System\ydbXqdN.exe
  2⤵
  PID:9032
- C:\Windows\System\jedqLdL.exe
  C:\Windows\System\jedqLdL.exe
  2⤵
  PID:9048
- C:\Windows\System\kNggrjX.exe
  C:\Windows\System\kNggrjX.exe
  2⤵
  PID:9064
- C:\Windows\System\RkDlseV.exe
  C:\Windows\System\RkDlseV.exe
  2⤵
  PID:9080
- C:\Windows\System\cdrkxzn.exe
  C:\Windows\System\cdrkxzn.exe
  2⤵
  PID:9096
- C:\Windows\System\FobCnAZ.exe
  C:\Windows\System\FobCnAZ.exe
  2⤵
  PID:9112
- C:\Windows\System\kwHUiur.exe
  C:\Windows\System\kwHUiur.exe
  2⤵
  PID:9128
- C:\Windows\System\QWwWTSH.exe
  C:\Windows\System\QWwWTSH.exe
  2⤵
  PID:9144
- C:\Windows\System\TWXgiBh.exe
  C:\Windows\System\TWXgiBh.exe
  2⤵
  PID:9184
- C:\Windows\System\MErZgYD.exe
  C:\Windows\System\MErZgYD.exe
  2⤵
  PID:9200
- C:\Windows\System\HyOwjbs.exe
  C:\Windows\System\HyOwjbs.exe
  2⤵
  PID:7752
- C:\Windows\System\kyDazCI.exe
  C:\Windows\System\kyDazCI.exe
  2⤵
  PID:7564
- C:\Windows\System\pwJrSZU.exe
  C:\Windows\System\pwJrSZU.exe
  2⤵
  PID:8316
- C:\Windows\System\miFrKld.exe
  C:\Windows\System\miFrKld.exe
  2⤵
  PID:8352
- C:\Windows\System\HhAAwWX.exe
  C:\Windows\System\HhAAwWX.exe
  2⤵
  PID:8236
- C:\Windows\System\EaodzdM.exe
  C:\Windows\System\EaodzdM.exe
  2⤵
  PID:8412
- C:\Windows\System\sLbytRz.exe
  C:\Windows\System\sLbytRz.exe
  2⤵
  PID:7192
- C:\Windows\System\qolrolQ.exe
  C:\Windows\System\qolrolQ.exe
  2⤵
  PID:7448
- C:\Windows\System\CsmuhyQ.exe
  C:\Windows\System\CsmuhyQ.exe
  2⤵
  PID:8368
- C:\Windows\System\jBnhRti.exe
  C:\Windows\System\jBnhRti.exe
  2⤵
  PID:8272
- C:\Windows\System\IpgTYEL.exe
  C:\Windows\System\IpgTYEL.exe
  2⤵
  PID:8484
- C:\Windows\System\CATzXjV.exe
  C:\Windows\System\CATzXjV.exe
  2⤵
  PID:8532
- C:\Windows\System\UHvlTor.exe
  C:\Windows\System\UHvlTor.exe
  2⤵
  PID:8500
- C:\Windows\System\RRItoZK.exe
  C:\Windows\System\RRItoZK.exe
  2⤵
  PID:8612
- C:\Windows\System\vQWansx.exe
  C:\Windows\System\vQWansx.exe
  2⤵
  PID:8648
- C:\Windows\System\ejgkreP.exe
  C:\Windows\System\ejgkreP.exe
  2⤵
  PID:8712
- C:\Windows\System\cJfkAaj.exe
  C:\Windows\System\cJfkAaj.exe
  2⤵
  PID:8660
- C:\Windows\System\gqreXll.exe
  C:\Windows\System\gqreXll.exe
  2⤵
  PID:8632
- C:\Windows\System\CUTtfIV.exe
  C:\Windows\System\CUTtfIV.exe
  2⤵
  PID:8792
- C:\Windows\System\RsijSjP.exe
  C:\Windows\System\RsijSjP.exe
  2⤵
  PID:8760
- C:\Windows\System\bbvGFzc.exe
  C:\Windows\System\bbvGFzc.exe
  2⤵
  PID:8804
- C:\Windows\System\ETTNlNi.exe
  C:\Windows\System\ETTNlNi.exe
  2⤵
  PID:8856
- C:\Windows\System\yplDNPR.exe
  C:\Windows\System\yplDNPR.exe
  2⤵
  PID:8876
- C:\Windows\System\mkEOYhi.exe
  C:\Windows\System\mkEOYhi.exe
  2⤵
  PID:6168
- C:\Windows\System\UlHXTQV.exe
  C:\Windows\System\UlHXTQV.exe
  2⤵
  PID:8928
- C:\Windows\System\kbtjYwz.exe
  C:\Windows\System\kbtjYwz.exe
  2⤵
  PID:9136
- C:\Windows\System\FWOFrdt.exe
  C:\Windows\System\FWOFrdt.exe
  2⤵
  PID:9044
- C:\Windows\System\lTZKilF.exe
  C:\Windows\System\lTZKilF.exe
  2⤵
  PID:8976
- C:\Windows\System\Oemndju.exe
  C:\Windows\System\Oemndju.exe
  2⤵
  PID:9196
- C:\Windows\System\ucVJcCl.exe
  C:\Windows\System\ucVJcCl.exe
  2⤵
  PID:8348
- C:\Windows\System\HVxcgja.exe
  C:\Windows\System\HVxcgja.exe
  2⤵
  PID:8092
- C:\Windows\System\NdKeboz.exe
  C:\Windows\System\NdKeboz.exe
  2⤵
  PID:8512
- C:\Windows\System\pNFFOZG.exe
  C:\Windows\System\pNFFOZG.exe
  2⤵
  PID:8056
- C:\Windows\System\KVbwFNY.exe
  C:\Windows\System\KVbwFNY.exe
  2⤵
  PID:9088
- C:\Windows\System\lVMmTxw.exe
  C:\Windows\System\lVMmTxw.exe
  2⤵
  PID:8252
- C:\Windows\System\mwQnCdE.exe
  C:\Windows\System\mwQnCdE.exe
  2⤵
  PID:8992
- C:\Windows\System\jZsINUA.exe
  C:\Windows\System\jZsINUA.exe
  2⤵
  PID:9056
- C:\Windows\System\sMoPbYu.exe
  C:\Windows\System\sMoPbYu.exe
  2⤵
  PID:9120
- C:\Windows\System\zzxSFcb.exe
  C:\Windows\System\zzxSFcb.exe
  2⤵
  PID:9168
- C:\Windows\System\FwkTWSI.exe
  C:\Windows\System\FwkTWSI.exe
  2⤵
  PID:8204
- C:\Windows\System\yURsSLe.exe
  C:\Windows\System\yURsSLe.exe
  2⤵
  PID:8336
- C:\Windows\System\EfKfwXq.exe
  C:\Windows\System\EfKfwXq.exe
  2⤵
  PID:8584
- C:\Windows\System\jPvjxHg.exe
  C:\Windows\System\jPvjxHg.exe
  2⤵
  PID:8564
- C:\Windows\System\TWGhcvh.exe
  C:\Windows\System\TWGhcvh.exe
  2⤵
  PID:8644
- C:\Windows\System\YkiUgEl.exe
  C:\Windows\System\YkiUgEl.exe
  2⤵
  PID:8692
- C:\Windows\System\SGmAtCz.exe
  C:\Windows\System\SGmAtCz.exe
  2⤵
  PID:8756
- C:\Windows\System\lPnVTyT.exe
  C:\Windows\System\lPnVTyT.exe
  2⤵
  PID:8912
- C:\Windows\System\vPHTdax.exe
  C:\Windows\System\vPHTdax.exe
  2⤵
  PID:9008
- C:\Windows\System\ejTDJma.exe
  C:\Windows\System\ejTDJma.exe
  2⤵
  PID:8224
- C:\Windows\System\mLsRGGx.exe
  C:\Windows\System\mLsRGGx.exe
  2⤵
  PID:8872
- C:\Windows\System\TTOdTjk.exe
  C:\Windows\System\TTOdTjk.exe
  2⤵
  PID:9072
- C:\Windows\System\PpwZHOB.exe
  C:\Windows\System\PpwZHOB.exe
  2⤵
  PID:9024
- C:\Windows\System\PjFnkUe.exe
  C:\Windows\System\PjFnkUe.exe
  2⤵
  PID:9092
- C:\Windows\System\gFotfPB.exe
  C:\Windows\System\gFotfPB.exe
  2⤵
  PID:9180
- C:\Windows\System\cHuBhNb.exe
  C:\Windows\System\cHuBhNb.exe
  2⤵
  PID:8384
- C:\Windows\System\LVTuGBq.exe
  C:\Windows\System\LVTuGBq.exe
  2⤵
  PID:9160
- C:\Windows\System\mCXNTLv.exe
  C:\Windows\System\mCXNTLv.exe
  2⤵
  PID:8464
- C:\Windows\System\AkVzpJD.exe
  C:\Windows\System\AkVzpJD.exe
  2⤵
  PID:8776
- C:\Windows\System\GkgbbFE.exe
  C:\Windows\System\GkgbbFE.exe
  2⤵
  PID:8724
- C:\Windows\System\IQarNlh.exe
  C:\Windows\System\IQarNlh.exe
  2⤵
  PID:9012
- C:\Windows\System\piLTanI.exe
  C:\Windows\System\piLTanI.exe
  2⤵
  PID:8868
- C:\Windows\System\QgnJkhV.exe
  C:\Windows\System\QgnJkhV.exe
  2⤵
  PID:8428
- C:\Windows\System\VCrFmIw.exe
  C:\Windows\System\VCrFmIw.exe
  2⤵
  PID:9060
- C:\Windows\System\kuVIMeZ.exe
  C:\Windows\System\kuVIMeZ.exe
  2⤵
  PID:8740
- C:\Windows\System\tTLXzMh.exe
  C:\Windows\System\tTLXzMh.exe
  2⤵
  PID:8988
- C:\Windows\System\geUyFOH.exe
  C:\Windows\System\geUyFOH.exe
  2⤵
  PID:9028
- C:\Windows\System\nxulZut.exe
  C:\Windows\System\nxulZut.exe
  2⤵
  PID:9232
- C:\Windows\System\RVSEsty.exe
  C:\Windows\System\RVSEsty.exe
  2⤵
  PID:9248
- C:\Windows\System\QJmyuqQ.exe
  C:\Windows\System\QJmyuqQ.exe
  2⤵
  PID:9264
- C:\Windows\System\sAPHtRC.exe
  C:\Windows\System\sAPHtRC.exe
  2⤵
  PID:9280
- C:\Windows\System\YDstdwe.exe
  C:\Windows\System\YDstdwe.exe
  2⤵
  PID:9296
- C:\Windows\System\xlrhoWw.exe
  C:\Windows\System\xlrhoWw.exe
  2⤵
  PID:9316
- C:\Windows\System\tzLQggJ.exe
  C:\Windows\System\tzLQggJ.exe
  2⤵
  PID:9332
- C:\Windows\System\kBPsNGc.exe
  C:\Windows\System\kBPsNGc.exe
  2⤵
  PID:9348
- C:\Windows\System\PsLWWbq.exe
  C:\Windows\System\PsLWWbq.exe
  2⤵
  PID:9364
- C:\Windows\System\cohijXD.exe
  C:\Windows\System\cohijXD.exe
  2⤵
  PID:9380
- C:\Windows\System\WZxLzRY.exe
  C:\Windows\System\WZxLzRY.exe
  2⤵
  PID:9396
- C:\Windows\System\tYyIPPm.exe
  C:\Windows\System\tYyIPPm.exe
  2⤵
  PID:9412
- C:\Windows\System\OJMQegE.exe
  C:\Windows\System\OJMQegE.exe
  2⤵
  PID:9428
- C:\Windows\System\ujDMGDA.exe
  C:\Windows\System\ujDMGDA.exe
  2⤵
  PID:9444
- C:\Windows\System\QdzqlHq.exe
  C:\Windows\System\QdzqlHq.exe
  2⤵
  PID:9460
- C:\Windows\System\UeMmLmn.exe
  C:\Windows\System\UeMmLmn.exe
  2⤵
  PID:9476
- C:\Windows\System\lcCGyNi.exe
  C:\Windows\System\lcCGyNi.exe
  2⤵
  PID:9492
- C:\Windows\System\DvXrXLz.exe
  C:\Windows\System\DvXrXLz.exe
  2⤵
  PID:9508
- C:\Windows\System\jkLsski.exe
  C:\Windows\System\jkLsski.exe
  2⤵
  PID:9524
- C:\Windows\System\qSkbRCB.exe
  C:\Windows\System\qSkbRCB.exe
  2⤵
  PID:9540
- C:\Windows\System\OAydTiX.exe
  C:\Windows\System\OAydTiX.exe
  2⤵
  PID:9556
- C:\Windows\System\CsomwOv.exe
  C:\Windows\System\CsomwOv.exe
  2⤵
  PID:9572
- C:\Windows\System\sncgpjl.exe
  C:\Windows\System\sncgpjl.exe
  2⤵
  PID:9588
- C:\Windows\System\TuAAKdL.exe
  C:\Windows\System\TuAAKdL.exe
  2⤵
  PID:9604
- C:\Windows\System\ZDeuEvC.exe
  C:\Windows\System\ZDeuEvC.exe
  2⤵
  PID:9620
- C:\Windows\System\hjBJBQb.exe
  C:\Windows\System\hjBJBQb.exe
  2⤵
  PID:9636
- C:\Windows\System\cdhyzVR.exe
  C:\Windows\System\cdhyzVR.exe
  2⤵
  PID:9652
- C:\Windows\System\rLNSfDu.exe
  C:\Windows\System\rLNSfDu.exe
  2⤵
  PID:9668
- C:\Windows\System\xdirkDD.exe
  C:\Windows\System\xdirkDD.exe
  2⤵
  PID:9684
- C:\Windows\System\ktEenWd.exe
  C:\Windows\System\ktEenWd.exe
  2⤵
  PID:9700
- C:\Windows\System\fiKXguV.exe
  C:\Windows\System\fiKXguV.exe
  2⤵
  PID:9716
- C:\Windows\System\PXaZyoK.exe
  C:\Windows\System\PXaZyoK.exe
  2⤵
  PID:9732
- C:\Windows\System\oejjYDo.exe
  C:\Windows\System\oejjYDo.exe
  2⤵
  PID:9748
- C:\Windows\System\LkrArkx.exe
  C:\Windows\System\LkrArkx.exe
  2⤵
  PID:9764
- C:\Windows\System\TVNjnUV.exe
  C:\Windows\System\TVNjnUV.exe
  2⤵
  PID:9780
- C:\Windows\System\TVOLtDx.exe
  C:\Windows\System\TVOLtDx.exe
  2⤵
  PID:9796
- C:\Windows\System\WwoNUim.exe
  C:\Windows\System\WwoNUim.exe
  2⤵
  PID:9812
- C:\Windows\System\ddLMlVH.exe
  C:\Windows\System\ddLMlVH.exe
  2⤵
  PID:9828
- C:\Windows\System\EcpTkIi.exe
  C:\Windows\System\EcpTkIi.exe
  2⤵
  PID:9844
- C:\Windows\System\gjTktVF.exe
  C:\Windows\System\gjTktVF.exe
  2⤵
  PID:9860
- C:\Windows\System\loCjLqX.exe
  C:\Windows\System\loCjLqX.exe
  2⤵
  PID:9876
- C:\Windows\System\alhbQFE.exe
  C:\Windows\System\alhbQFE.exe
  2⤵
  PID:9896
- C:\Windows\System\gayqPfY.exe
  C:\Windows\System\gayqPfY.exe
  2⤵
  PID:9912
- C:\Windows\System\PmuLqZr.exe
  C:\Windows\System\PmuLqZr.exe
  2⤵
  PID:9928
- C:\Windows\System\cLFNAvf.exe
  C:\Windows\System\cLFNAvf.exe
  2⤵
  PID:9944
- C:\Windows\System\vKGVoPn.exe
  C:\Windows\System\vKGVoPn.exe
  2⤵
  PID:9960
- C:\Windows\System\PLDjgbu.exe
  C:\Windows\System\PLDjgbu.exe
  2⤵
  PID:9976
- C:\Windows\System\kJzKaRb.exe
  C:\Windows\System\kJzKaRb.exe
  2⤵
  PID:9992
- C:\Windows\System\ggPscVo.exe
  C:\Windows\System\ggPscVo.exe
  2⤵
  PID:10008
- C:\Windows\System\IxPZyOs.exe
  C:\Windows\System\IxPZyOs.exe
  2⤵
  PID:10024
- C:\Windows\System\WPkxDNY.exe
  C:\Windows\System\WPkxDNY.exe
  2⤵
  PID:10040
- C:\Windows\System\CKSYKMB.exe
  C:\Windows\System\CKSYKMB.exe
  2⤵
  PID:10056
- C:\Windows\System\jsObXvp.exe
  C:\Windows\System\jsObXvp.exe
  2⤵
  PID:10072
- C:\Windows\System\oTkmcgV.exe
  C:\Windows\System\oTkmcgV.exe
  2⤵
  PID:10088
- C:\Windows\System\vOHYssf.exe
  C:\Windows\System\vOHYssf.exe
  2⤵
  PID:10104
- C:\Windows\System\IHtWsTA.exe
  C:\Windows\System\IHtWsTA.exe
  2⤵
  PID:10120
- C:\Windows\System\xXEJIvn.exe
  C:\Windows\System\xXEJIvn.exe
  2⤵
  PID:10136
- C:\Windows\System\UIGVFcN.exe
  C:\Windows\System\UIGVFcN.exe
  2⤵
  PID:10152
- C:\Windows\System\wOfKLzy.exe
  C:\Windows\System\wOfKLzy.exe
  2⤵
  PID:10168
- C:\Windows\System\PQIuZIx.exe
  C:\Windows\System\PQIuZIx.exe
  2⤵
  PID:10184
- C:\Windows\System\reIfHoi.exe
  C:\Windows\System\reIfHoi.exe
  2⤵
  PID:10200
- C:\Windows\System\PWztgzM.exe
  C:\Windows\System\PWztgzM.exe
  2⤵
  PID:10216
- C:\Windows\System\LvkgtzF.exe
  C:\Windows\System\LvkgtzF.exe
  2⤵
  PID:10232
- C:\Windows\System\QGmkVMF.exe
  C:\Windows\System\QGmkVMF.exe
  2⤵
  PID:9244
- C:\Windows\System\nUydgGM.exe
  C:\Windows\System\nUydgGM.exe
  2⤵
  PID:8380
- C:\Windows\System\knMyoDN.exe
  C:\Windows\System\knMyoDN.exe
  2⤵
  PID:8468
- C:\Windows\System\EUCucNe.exe
  C:\Windows\System\EUCucNe.exe
  2⤵
  PID:9260
- C:\Windows\System\KfpzPUp.exe
  C:\Windows\System\KfpzPUp.exe
  2⤵
  PID:9104
- C:\Windows\System\NaiIDhh.exe
  C:\Windows\System\NaiIDhh.exe
  2⤵
  PID:9292
- C:\Windows\System\CMMtFfG.exe
  C:\Windows\System\CMMtFfG.exe
  2⤵
  PID:9340
- C:\Windows\System\pohXyER.exe
  C:\Windows\System\pohXyER.exe
  2⤵
  PID:9404
- C:\Windows\System\JxsDoFd.exe
  C:\Windows\System\JxsDoFd.exe
  2⤵
  PID:9468
- C:\Windows\System\NgGwwld.exe
  C:\Windows\System\NgGwwld.exe
  2⤵
  PID:9532
- C:\Windows\System\rrNWQiU.exe
  C:\Windows\System\rrNWQiU.exe
  2⤵
  PID:9456
- C:\Windows\System\nUugzVi.exe
  C:\Windows\System\nUugzVi.exe
  2⤵
  PID:9392
- C:\Windows\System\DFIhzXE.exe
  C:\Windows\System\DFIhzXE.exe
  2⤵
  PID:9548
- C:\Windows\System\NBSqHKi.exe
  C:\Windows\System\NBSqHKi.exe
  2⤵
  PID:9388
- C:\Windows\System\xdODdDS.exe
  C:\Windows\System\xdODdDS.exe
  2⤵
  PID:9600
- C:\Windows\System\ZAIIdch.exe
  C:\Windows\System\ZAIIdch.exe
  2⤵
  PID:9664
- C:\Windows\System\ziyDukA.exe
  C:\Windows\System\ziyDukA.exe
  2⤵
  PID:9612
- C:\Windows\System\SKokdFZ.exe
  C:\Windows\System\SKokdFZ.exe
  2⤵
  PID:9676
- C:\Windows\System\aBVEGFN.exe
  C:\Windows\System\aBVEGFN.exe
  2⤵
  PID:9644
- C:\Windows\System\xrOEoQR.exe
  C:\Windows\System\xrOEoQR.exe
  2⤵
  PID:9792
- C:\Windows\System\DOVbgqN.exe
  C:\Windows\System\DOVbgqN.exe
  2⤵
  PID:9852
- C:\Windows\System\vPFffPx.exe
  C:\Windows\System\vPFffPx.exe
  2⤵
  PID:9712
- C:\Windows\System\xuqNNrQ.exe
  C:\Windows\System\xuqNNrQ.exe
  2⤵
  PID:9840
- C:\Windows\System\MJvvqvI.exe
  C:\Windows\System\MJvvqvI.exe
  2⤵
  PID:9920
- C:\Windows\System\vpoKmXW.exe
  C:\Windows\System\vpoKmXW.exe
  2⤵
  PID:9868
- C:\Windows\System\kJxFCtl.exe
  C:\Windows\System\kJxFCtl.exe
  2⤵
  PID:9956
- C:\Windows\System\cXyBiMX.exe
  C:\Windows\System\cXyBiMX.exe
  2⤵
  PID:9984
- C:\Windows\System\pGGQNQF.exe
  C:\Windows\System\pGGQNQF.exe
  2⤵
  PID:10080
- C:\Windows\System\vHsPyIU.exe
  C:\Windows\System\vHsPyIU.exe
  2⤵
  PID:10032
- C:\Windows\System\PQsAbAm.exe
  C:\Windows\System\PQsAbAm.exe
  2⤵
  PID:10084
- C:\Windows\System\FUxVzDZ.exe
  C:\Windows\System\FUxVzDZ.exe
  2⤵
  PID:10148
- C:\Windows\System\geVKHFD.exe
  C:\Windows\System\geVKHFD.exe
  2⤵
  PID:10208
- C:\Windows\System\BFizJhQ.exe
  C:\Windows\System\BFizJhQ.exe
  2⤵
  PID:10128
- C:\Windows\System\ENtSJWl.exe
  C:\Windows\System\ENtSJWl.exe
  2⤵
  PID:10192
- C:\Windows\System\IZfijAU.exe
  C:\Windows\System\IZfijAU.exe
  2⤵
  PID:9240
- C:\Windows\System\CmhdJzz.exe
  C:\Windows\System\CmhdJzz.exe
  2⤵
  PID:9304
- C:\Windows\System\lnIFgaY.exe
  C:\Windows\System\lnIFgaY.exe
  2⤵
  PID:8820
- C:\Windows\System\hNJktdw.exe
  C:\Windows\System\hNJktdw.exe
  2⤵
  PID:9436
- C:\Windows\System\EhxbDUH.exe
  C:\Windows\System\EhxbDUH.exe
  2⤵
  PID:9568
- C:\Windows\System\OsRmVTm.exe
  C:\Windows\System\OsRmVTm.exe
  2⤵
  PID:9696
- C:\Windows\System\VeRRhcr.exe
  C:\Windows\System\VeRRhcr.exe
  2⤵
  PID:9820
- C:\Windows\System\yfkHVhv.exe
  C:\Windows\System\yfkHVhv.exe
  2⤵
  PID:9952
- C:\Windows\System\oolNSoj.exe
  C:\Windows\System\oolNSoj.exe
  2⤵
  PID:9516
- C:\Windows\System\daFWZVN.exe
  C:\Windows\System\daFWZVN.exe
  2⤵
  PID:9632
- C:\Windows\System\pQhUoXX.exe
  C:\Windows\System\pQhUoXX.exe
  2⤵
  PID:9936
- C:\Windows\System\jrwuuND.exe
  C:\Windows\System\jrwuuND.exe
  2⤵
  PID:9616
- C:\Windows\System\ZjsBXDO.exe
  C:\Windows\System\ZjsBXDO.exe
  2⤵
  PID:9288
- C:\Windows\System\veFUVSq.exe
  C:\Windows\System\veFUVSq.exe
  2⤵
  PID:10064
- C:\Windows\System\aagHoHn.exe
  C:\Windows\System\aagHoHn.exe
  2⤵
  PID:9804
- C:\Windows\System\GKqaFDR.exe
  C:\Windows\System\GKqaFDR.exe
  2⤵
  PID:10116
- C:\Windows\System\BtIuUKy.exe
  C:\Windows\System\BtIuUKy.exe
  2⤵
  PID:10228
- C:\Windows\System\vsPTKdk.exe
  C:\Windows\System\vsPTKdk.exe
  2⤵
  PID:9420
- C:\Windows\System\mdCxmre.exe
  C:\Windows\System\mdCxmre.exe
  2⤵
  PID:10096
- C:\Windows\System\SVrFijO.exe
  C:\Windows\System\SVrFijO.exe
  2⤵
  PID:9708
- C:\Windows\System\oNEQfCl.exe
  C:\Windows\System\oNEQfCl.exe
  2⤵
  PID:9276
- C:\Windows\System\RtYOLPZ.exe
  C:\Windows\System\RtYOLPZ.exe
  2⤵
  PID:9596
- C:\Windows\System\kFKCVxM.exe
  C:\Windows\System\kFKCVxM.exe
  2⤵
  PID:9888
- C:\Windows\System\OdjqhEy.exe
  C:\Windows\System\OdjqhEy.exe
  2⤵
  PID:10020
- C:\Windows\System\LwUXDFv.exe
  C:\Windows\System\LwUXDFv.exe
  2⤵
  PID:9940
- C:\Windows\System\aoWfTfh.exe
  C:\Windows\System\aoWfTfh.exe
  2⤵
  PID:9256
- C:\Windows\System\fppyunG.exe
  C:\Windows\System\fppyunG.exe
  2⤵
  PID:9740
- C:\Windows\System\hBeBPms.exe
  C:\Windows\System\hBeBPms.exe
  2⤵
  PID:9424
- C:\Windows\System\bPMpYhk.exe
  C:\Windows\System\bPMpYhk.exe
  2⤵
  PID:10196
- C:\Windows\System\cHndevF.exe
  C:\Windows\System\cHndevF.exe
  2⤵
  PID:9680
- C:\Windows\System\HFQKQsz.exe
  C:\Windows\System\HFQKQsz.exe
  2⤵
  PID:9360
- C:\Windows\System\cHSYAqD.exe
  C:\Windows\System\cHSYAqD.exe
  2⤵
  PID:8788
- C:\Windows\System\HReYrOs.exe
  C:\Windows\System\HReYrOs.exe
  2⤵
  PID:9224
- C:\Windows\System\CkBRWYg.exe
  C:\Windows\System\CkBRWYg.exe
  2⤵
  PID:10180
- C:\Windows\System\TwGTyra.exe
  C:\Windows\System\TwGTyra.exe
  2⤵
  PID:9328
- C:\Windows\System\WtJkCyG.exe
  C:\Windows\System\WtJkCyG.exe
  2⤵
  PID:10256
- C:\Windows\System\qAArhvM.exe
  C:\Windows\System\qAArhvM.exe
  2⤵
  PID:10272
- C:\Windows\System\tWtzOJE.exe
  C:\Windows\System\tWtzOJE.exe
  2⤵
  PID:10288
- C:\Windows\System\CYanxhJ.exe
  C:\Windows\System\CYanxhJ.exe
  2⤵
  PID:10304
- C:\Windows\System\BeEUnMG.exe
  C:\Windows\System\BeEUnMG.exe
  2⤵
  PID:10320
- C:\Windows\System\yZyGfiI.exe
  C:\Windows\System\yZyGfiI.exe
  2⤵
  PID:10336
- C:\Windows\System\WxbEUhp.exe
  C:\Windows\System\WxbEUhp.exe
  2⤵
  PID:10352
- C:\Windows\System\fAxeSsM.exe
  C:\Windows\System\fAxeSsM.exe
  2⤵
  PID:10368
- C:\Windows\System\VZyZDdf.exe
  C:\Windows\System\VZyZDdf.exe
  2⤵
  PID:10388
- C:\Windows\System\apHpFYq.exe
  C:\Windows\System\apHpFYq.exe
  2⤵
  PID:10404
- C:\Windows\System\iXKPvYa.exe
  C:\Windows\System\iXKPvYa.exe
  2⤵
  PID:10420
- C:\Windows\System\Ldtgvoo.exe
  C:\Windows\System\Ldtgvoo.exe
  2⤵
  PID:10436
- C:\Windows\System\OBNGwFY.exe
  C:\Windows\System\OBNGwFY.exe
  2⤵
  PID:10452
- C:\Windows\System\Nacdnlf.exe
  C:\Windows\System\Nacdnlf.exe
  2⤵
  PID:10468
- C:\Windows\System\NTgvLgd.exe
  C:\Windows\System\NTgvLgd.exe
  2⤵
  PID:10484
- C:\Windows\System\KPxasJP.exe
  C:\Windows\System\KPxasJP.exe
  2⤵
  PID:10500
- C:\Windows\System\ESgKCOR.exe
  C:\Windows\System\ESgKCOR.exe
  2⤵
  PID:10516
- C:\Windows\System\mNEGFXH.exe
  C:\Windows\System\mNEGFXH.exe
  2⤵
  PID:10532
- C:\Windows\System\IOSaEde.exe
  C:\Windows\System\IOSaEde.exe
  2⤵
  PID:10548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ArgocJN.exe

Filesize
1.9MB

MD5
463353c8a731d77a39b92a9b018f6c2c

SHA1
e045f15de76a88635ea811c815abbbb874a3ebe7

SHA256
9ad48975c4e40ec627ca9a1202610974583d099f9b891f04ebd0144a7f7fa71a

SHA512
417b665263c90b0c1847ebaae11e46ada422277147d68395d36221484b29a0e64b4cc8cdbe27fded13efcc67ee59ac53ce3ffd09ce38fcf16fc2340ef37d0f56

Download Submit
C:\Windows\system\AyfJwXQ.exe

Filesize
1.9MB

MD5
7143f6abbef7b3e4cbda8cbdf5b4a289

SHA1
3856d1faa690dd7faf6a1f4beb94e2c295377f93

SHA256
e82f108ee647063ce204a08dfbde342d3cec3246f84d2b2653a384a1e84b5b41

SHA512
091eb2ab20408a7add5ebef89b78559f65ff07c2ece64299e13d52bddc241e486be10be4d11d9ce67ba5ea73719aba9141daa4c8f9a1db7bad60007f7634aef2

Download Submit
C:\Windows\system\CuiQCmV.exe

Filesize
1.9MB

MD5
a6826029bb3bd86583631a1c5722af95

SHA1
3ef8bb7308deca722329c9f9f6ec61e21b6a950a

SHA256
df1d7af3879ad9bd71f008305cbc434c02c2dbc99b397a143064721bc46f07a1

SHA512
e5bb8c1e214071e7b601c7819037103907f9003f7acddf67f23dee83cca4c82a811fdabd897e03aba10c87c056a65f923eca76727f38e47c695bd0aff5340900

Download Submit
C:\Windows\system\ESrbokf.exe

Filesize
1.9MB

MD5
92cf5dedc5a65b4de0340fc744de148d

SHA1
67ca3c55318c8e47a7041c0005727c2645b7fec2

SHA256
3ee9b809f1d9905260907b100ee879816c6b44aa4ccb70699bb4cd5e07d37373

SHA512
e2589374442f4a2970e9c2954ea550c88a3cdf8cb060f138019c897ea8b4624115707d83c7ab6319062fd805fd20c80cb28b629c337a09327c03f97945786d9e

Download Submit
C:\Windows\system\JfCqdCm.exe

Filesize
1.9MB

MD5
54dfd278efbad1924932e62d898749dd

SHA1
bdd720766d5d7658f37eda1837683bcf69978c42

SHA256
2c7ee0e9e4a0bdccf2910a7ff5a8750a49cdb5c373e734e5be886c11de28dd49

SHA512
0d7c3e9b4f999737ff26fd2c190c6aef3c7d8d68abb1ca85a9bc6caef687b962695e6dd434788ef0bc8176de14dec9480a242771f8db2bf5b103a84d42773808

Download Submit
C:\Windows\system\MkPGykD.exe

Filesize
1.9MB

MD5
def8ce91f2ad5840feccf08dc855dca3

SHA1
2a71eaee1160a8ed1aae768ef60aa9083e7bc999

SHA256
0af9dbcc6a499e413e8bcb5f4e98369fc1bb5445f9ee23487a880aec5da7f6f1

SHA512
1fad9d5a0827735a63115aea8782ce4d125c7d9ba4c259aaee755d94824e8186f04667fa536e6892391e6123f07a16a898fb22c2cd593725280d398de561fd4b

Download Submit
C:\Windows\system\PvpyvTj.exe

Filesize
1.9MB

MD5
6a9b0f49bb12f5177f70beb61d8ba8e6

SHA1
76a2a8799a3304e50d2d6aca604aacb6eb27f2e8

SHA256
a8385d94626bda99028528b118dcf1035a52f4eb0e42d858cc8e6e52c19decb8

SHA512
00e1e2b417ef3dd95cb2ec1643074534bdf78c1662592524136cec4b16611db492da0a4525a12973973c823a99d7801feb792b9a7b82bd77206a2650b5e74871

Download Submit
C:\Windows\system\QSAZoBH.exe

Filesize
1.9MB

MD5
9a1cda1fccc6f47e1c79818cb179efe2

SHA1
a6e635cb4e3db1762898e62f67c7e66c5ba16472

SHA256
f89b4bc33126e6a753364d3fa4e811127e21aa8d0933840aea08a1050539685c

SHA512
a08049c7a4cbddce0ebecbcfcb591f0a0530f59099b0db66f29a60cde611bbe8076d1ee4c53cf4bb88818de30b6afe4b82734a37237e5546058b7eb12ea7883a

Download Submit
C:\Windows\system\SyGnLRW.exe

Filesize
1.9MB

MD5
3130bb45590e02e4a9bb930a33136bcb

SHA1
2b6b48a119987bc9e7f72dfe3966c0218a105108

SHA256
230348d8f8dfa6f01ae45dc1fc5c201eabd05c00f558f37477143adc57ae823f

SHA512
0f868a0c8ccedbda1c56cbd2038ff7280d487fe274c46e31436a6ca8c052cc4e8d317b446e0ddc16da85c759ea4dd00ff3cb1ea35e8062ed4571014561ead783

Download Submit
C:\Windows\system\TFqFSLH.exe

Filesize
1.9MB

MD5
0e4c6ed48eed9bb99a4cac3fe3a6e086

SHA1
d43875be330711b8f91eb6ef9776485edc214956

SHA256
59f25aa8ccdb5607f56b463d980652dfd9736e0b39507942d3e1fff45f4af925

SHA512
f53a56331d946952899b894851f9a8b1415a8639a65622c3eb027feb1c65368f99cffd6e33575b7af71196a8b0ec38eaa4057421190e1184eb6a07bb7f81c8d1

Download Submit
C:\Windows\system\VUSXNEl.exe

Filesize
1.9MB

MD5
a36b90ab68f17c92db80eadf276fad95

SHA1
feb78855582e4a8f4d77bfe86fd6f649062a3fdb

SHA256
99425c944c6db265d29d19316ddf14c116ad8e024b0cbd89b8a921d996879520

SHA512
b01d48221e28795d98fff709b506bc2f930dfb0424834255a9bfe9fd8ea79f847171cc3ec1dcb71b697c5b23df65278a7d765c87810aada7925257bf63b74200

Download Submit
C:\Windows\system\VwtiADB.exe

Filesize
1.9MB

MD5
c1698c57066fa118b51308e8c3b77a65

SHA1
6e568b1a07fc775b11361ef9bec89dc99a16c546

SHA256
a78e273e5d32625ba4f6bc88c170117575c9b5e7df82221eef6fdff2fbb459a7

SHA512
913976133c5bdaf241803074fe6c009f97e34f2b78360529dee14c4ef0ac6b8d6f21bc5661f83f2b7397e0a5a87a5ca363791ceb38e00293ecd2b4bfd848f837

Download Submit
C:\Windows\system\XvdgaZV.exe

Filesize
1.9MB

MD5
a18d467e81e932afb0f6c62925d1a5d4

SHA1
7118f2602a1dcae0186d7b8157cf7cb00fbd3265

SHA256
10c824cf66f45f70c2c918b29eb30a5411bf067608f018b56d59c1ff903a202a

SHA512
9d1d989b91eb2c8f086a9ba77dbbfe5c2c8669fdafc2dea4b918fe28425067adbf73bf9fe51d6e346d924f582c43fa8ff033f60d3426c605b692475da9bf8d75

Download Submit
C:\Windows\system\XwqwKWM.exe

Filesize
1.9MB

MD5
1c2f08b809cc2a965b55ae7761a0b8b7

SHA1
43210f49929380583ef9c981fa0f1a989dd5b232

SHA256
be9ca04a7e9399151c3cd909fbd6a3c1bf6be6a585fa7dcfed7ed15d1405c1b1

SHA512
ccd843839203deb81d0d5b40ce82cf66def5fd8f609cd066129efd165f0c2ce2cb864f75074844677784be650e7cbb6af18259487890d9ae57651ea6497b9d01

Download Submit
C:\Windows\system\YVCXARb.exe

Filesize
1.9MB

MD5
4a5cb5e8f599ab80060e7edb9d3d01f3

SHA1
bfca001fe1d2ca90efd82d165e4b34223419d21d

SHA256
86bc1a3a9d25694b2e29ed9c6cfa55cf77494cd4cd0c5a1e0d6d2b16fbd87b26

SHA512
100cee11fd7fb12066cd0780b34e4993b92775bd674b589922a30def4e6a6d80314bf0f4926d89fa8df39a24ce6da01aa35f75797be1f0257657e3e326fe0428

Download Submit
C:\Windows\system\YVwMFzq.exe

Filesize
1.9MB

MD5
6523b4a77817b43465646d90dd805370

SHA1
9235c0cc5f7bbc23b6612b426104461841af1a8e

SHA256
a7858d4f53356aadd677021c60d26d9e459e4d1fbb2f6e7c4892e6e36c4d6887

SHA512
d5c2b21339b0c9ca723ba69c5dc0e7d0a5873356d9186e394767afb7ada0161e02d12c45d1ade87ca0317b43634ead0c971350d8389c8530108c20aad7001a1d

Download Submit
C:\Windows\system\kBJfyJG.exe

Filesize
1.9MB

MD5
4712bd4adbf57bd55f011f930ad332e5

SHA1
8d95cbab1883f498df532b4baca661c7df29e360

SHA256
edf929feacf1e435f20ea337cad3cf49c2efb2017f02291490456158fe5805f3

SHA512
8fb3d320dc2e98287efa967f37c85e173c107b72cd5722fc154f2d7f72cd5db486d9c3c7e09aef685fd9120a7321dfc3bb10df80d76ac30e4cb232ed46582f61

Download Submit
C:\Windows\system\lssGRhA.exe

Filesize
1.9MB

MD5
3bb1cde4023a276435fbfeff6e50139f

SHA1
f0958f26166641aa93515193b52b4b5e3160ef3a

SHA256
1babd87e3597fd7416ad3691861de2196352e47eab7ce2117be09e3b4f7637ac

SHA512
94a03138074a2e33a9b2c32806aa7ad01a537e3735b29b97f04e39c4f907e5d508d5e844bf273315f0ff37091872c989d7791297468e5e8bf644e12e05c6573e

Download Submit
C:\Windows\system\oJhPLke.exe

Filesize
1.9MB

MD5
8c439a887835f3f85279d63dc237816c

SHA1
cb8be40cd04e788f82e5dbc5ed0dc0bff7ddc653

SHA256
b1aa230ec51c1d53f3d523c26fe576bddeaf564f0924a27a0a68c369ce207701

SHA512
2994f5738a907339467712fc251d2590424eb8e258a5ba48f92624e6411201bcc254a03afd6a40563498b70eb0d829d2b3857558774c7bc6d3acc24f74ba298e

Download Submit
C:\Windows\system\oxrqjEH.exe

Filesize
1.9MB

MD5
796669da27e1124cc6b611ec34fe78e7

SHA1
a91b7829d6337eac8a175b29219be63603ba4474

SHA256
bc69190ad5df3bf3302e0919e4c5738ca59c50044174357f68d1ee5f0eb11c5c

SHA512
776bc05d014cc0ae70d1e67502836c03835b858d653d1b36f0d4bb27066a23068afaf8ab01e7f4b704c1cb10bd857c6681d1b49e93e9f62bd252da08995a17d0

Download Submit
C:\Windows\system\peFKhzx.exe

Filesize
1.9MB

MD5
66c5e669d9d37d2d8918c01c3a70f396

SHA1
37e0d5abf79578275a56d91e1f6d3cc52e79048e

SHA256
6ab0a8028d89f4e73f053231a48490774bca6e8b01eab751b5591247bacf6fd9

SHA512
4a563cb6ce9d9d36d04f37f8051808c20e7bafb77959fe2923048c1855e180e1b7ae3f57220e5c6ca7d719bd10dcc05e60064a96102e33dfd6e1ce8d8f260327

Download Submit
C:\Windows\system\qoGfybR.exe

Filesize
1.9MB

MD5
4053ca4d2579d7c62c5dc646b73e44ef

SHA1
77b79c29216a701eed81f6ecc295c5ce16b396c3

SHA256
caeee52b675bbda4e7236274785c9cc5a12d5fac9407e0f744ee29fbfca52569

SHA512
881e35f482cea3cdba934f43a57236ca580e230c450cecec49ec183427b94cd11049a1d8868be0ea2e959aae926970a72aa8a2e719df4017e21f5f5f2c57442e

Download Submit
C:\Windows\system\tYquPeR.exe

Filesize
1.9MB

MD5
94b8fa2d2b38d28906557124bc6e47d5

SHA1
b8e85cc426379ffba3b6f48374de9797f70d82a5

SHA256
6ce1c6c3e42bf896b47d60daa696ec36f7dc8d8e2daa403b874c4fac7b93cedc

SHA512
5929c7e10f86e324067028460ed8cdc0764809042c4bbabea20e03ad81eb4290b764bac54cb96ead3c6aa913f5f65324b95b88f668bd0b59771c4b4badd5f92e

Download Submit
C:\Windows\system\uRkgFBk.exe

Filesize
1.9MB

MD5
55ad118acde4ab1dd9a2451aeb0743a1

SHA1
ab201d6745f4a6d471da140b6a218178eba75971

SHA256
1b779350400acb3975fb2375ff8626e415e36a94bfb4595a3b3efad13ceae8cd

SHA512
3ce550764bda46416d6b875db3321ba8c0f88a4ba1340b8079ee5ed8f7ced67fe29b986903533f9ed790289f52603ad1c6fda4a837aca7005fa1cd7d835ea200

Download Submit
\Windows\system\Ahnejky.exe

Filesize
1.9MB

MD5
0603e54c1af2d6d3114cdf3f51765953

SHA1
d8925cff42dd5ee0823b4d8af5387fad57355c1b

SHA256
19035ac1f9f90150751f997da64eaf0a082c4455ac8234ec0758a8d0e3a9645e

SHA512
f4b29619aaaa6def70858d8934ec0b7a339e86eb939cfc7d6c1e1f2d2a20d4452860727b252c36f0c1960d0d3dc7f1ee3d3c8ecadfc22e62255c570546938240

Download Submit
\Windows\system\BOiDKOk.exe

Filesize
1.9MB

MD5
522f1389a8e88cd14271ab75173f007f

SHA1
4dfe3e0928a6ca51b7d692bdd463191f7fb5c661

SHA256
c177d1855ccd3ffcf81029d1aa5a8cfbd3135dbc935a09c739da70b1a438e537

SHA512
17a73178f39e317dd740e8736b0b6d311c031d8a8ab97c88d177efd98f59b7fd838fba7c7712dcbbc6ea6ad85d9f52c5c27e2345225cc32428043e99c96db890

Download Submit
\Windows\system\BXgAXkT.exe

Filesize
1.9MB

MD5
df3c0e1982a18b8c05ea2924eb265918

SHA1
6e55e51208e996bc857c9e3ce7cee2c6006ef752

SHA256
1d75b5ee0c149040678d62a42744e395cc928135c544f901a3dbe18cd3496c4e

SHA512
6206f370a2aa62372551b70ad6f8f436fa4a4b2d5228e29d25f3ed56f15c25a5a6e6561bf3ad730bf40c3a0c905e31f8d05143b93d6a7ec3ff1dcfab0ec5424c

Download Submit
\Windows\system\DHuIYwy.exe

Filesize
1.9MB

MD5
9f5c363d66e11f0699e372839316583f

SHA1
3ef26655510cb54c6a743d9e39cfb8c17f63f2db

SHA256
99cc6cb5c54f38464c8b9fa90d5b201c5dbbbfddebd61e7302af1d584576b473

SHA512
c7faae84cf2e5469ac60ea51b502226b1466a73b180c19e9958d3e3efc2082c36f96853a56e8d50fe927e5dae4d6e8244e8b4a948aa310ce80ccfb356b19b694

Download Submit
\Windows\system\GzAIGjy.exe

Filesize
1.9MB

MD5
62557a9b24dfb22f7592667cc9b1c50b

SHA1
9834d1741b8db77045790da0f287607b520e9b1f

SHA256
95ff40923586d1ea58cc4ec676787eae3ff3e43b35caf4180acf62c19cf6debd

SHA512
94530a040fe90fc5a6f32c3db1312a6897bffad6bd288f103195561e803f5ae7c8bf18c0d1d13f10ada2e4574a78963c012d7961b21522ca3fafecb8035f8774

Download Submit
\Windows\system\OJYJSSC.exe

Filesize
1.9MB

MD5
95d256eab893c0ae1ae0fdd69b59a9cb

SHA1
d81d96d53856c4a8e09c505ae2cdeb9ba5de5f11

SHA256
cd44c31f75615a90127809fedfbd82e2212f6080a14539b192a6feae99d38d17

SHA512
f00da8a9151e822d70888720e052ea17fe0e07a068a4f057e97116284f8a310c08c4234b4dfac1f9af31eb5d74305cca870f36c24219603b9031584b4781716d

Download Submit
\Windows\system\RuthnNg.exe

Filesize
1.9MB

MD5
d03be02571e19a3af1d99ff9724e808f

SHA1
3969afe09f83642b57115f1ad4d429743b343620

SHA256
b629eed5abe841e8238a8e38b66a16f2cbd8fdddc9ad5eb2456a6b7d8121e659

SHA512
dfb6717d602797d23c02643840a8d795570f5205c4721d0ddeb23815946916ea28d64338ac7d5168aab520b8b5edaf732cf62c8a98cfa76064922eaf4e531ec9

Download Submit
\Windows\system\bVfPhpI.exe

Filesize
1.9MB

MD5
3ddcaf05177983e73fc10f91d4728103

SHA1
a65d9981eecfff43ca469c71882084a088c98a26

SHA256
e6c292616d6cf72ef1f63c5f9864dc159706b71e5586b84d69c7587fdc18a356

SHA512
f0231925690635fe5af81ca3094738251bef4471f8b189dd8d2c8fea5fb581f5511c577db759891f5528b13aa0295eda4f0173ee2f8f1768362933dee8364af2

Download Submit
\Windows\system\eCmStof.exe

Filesize
1.9MB

MD5
d5b076776b9151c60c6497607d2254c9

SHA1
548c34e5a246fe9174cdb600a1c71084733615a7

SHA256
9babc42f66596953d2a0dccf16d563767b7940cff782ec68e31b51c9dc5ec101

SHA512
ba6dcee1a4d3d8d80d7bbee979a9ccab0dc7da87403d5558878c31306cc18e0fa827332da7f832b103f5ad8d093ad4e0ff4824f57ffd17bd4b71c821927d72c6

Download Submit
\Windows\system\gnqBGtw.exe

Filesize
1.9MB

MD5
142ad694ebb6d6ae40b2f9e0218f6dfb

SHA1
96a1cb3df6ff969599d72a5395c5ac5623b77d3a

SHA256
e3ffa019ee7e2eeddaf6e63f3be1cea78f98c2f16d96898dac4b50493ca761c0

SHA512
7dc56a77dd4b32d8b5c9497fce2ee6f6beaa30fd5e1f42a63230da33e7cc8aef32358b07d0786784585d3741bcb9fecf0b779bfbea93c6928c0421b860e90416

Download Submit
\Windows\system\ijOBBrG.exe

Filesize
1.9MB

MD5
99cbf8da095bf8f4702897e3eb292ce1

SHA1
4369b2f67d893e2ffb1035e5311d4366f88a689d

SHA256
70a84ae96587a99f6f8670b811ba347bffcfaa41e8d1d0ab299f3b7f7a1e5b3c

SHA512
64284cf62b23e1bc8ec3ba860b40cf353776c30a9fe9d3db14e9ef3c3e7139eb44a5c5d2dbbacd73985f6c8b6a196a5ea0d57b08f81f1ec42d5033fadd04e5ba

Download Submit
\Windows\system\nvLxAxK.exe

Filesize
1.9MB

MD5
5e5fe1cf518db27cebbe7012a7695bfb

SHA1
2327e92c684e82cad3f256398e2432f538fda6dd

SHA256
508bab207e23b0ffa61edb9b41b58bdcca655cdd3f3913a82625a6ee8e623672

SHA512
a930957e11c0b182e4f48634846e2f203a2158ee743a9aad72d54b1ca70f6fd74d9a04df6ea6d3cc52de4b5262a94e1ce02423389c8d2575a070bbd9f44ad009

Download Submit
\Windows\system\pJLLixh.exe

Filesize
1.9MB

MD5
8a399d60906032ceee490a180ca1bfd0

SHA1
62d1e9cf804adb1fde9712bb3b0c4ff22270556e

SHA256
995a5928975889427e0b31b434b1475d002bddeb5d27bacf7c57337e53c3fd06

SHA512
270e34eeee8a5477bbe0becdf46dbb0615d5df7b6eab6172f139a7218e867b56226531137b08899a2ae2fbe91fb705ef51e5a53fc65d6993774f9cd8b7b7a95d

Download Submit
\Windows\system\tHTfeFT.exe

Filesize
1.9MB

MD5
649e8412df961945a01e1176c1cf0df3

SHA1
f6fc92064025f77bb08acd82053c808f20522e10

SHA256
cff79f2438826204867075e83f01ef6b4f320ebb8e7907ca9c7c01bc930d79ad

SHA512
3df87475a9121e46231768d2d1056b7d326a5aea725d039cedff048736c19f69749402b717d09fe46ce8df48ac29edb73c63bafb02dc6ae6981cb77040c2c654

Download Submit
\Windows\system\tRgEGUB.exe

Filesize
1.9MB

MD5
c36c018495080d344cb59295ed29762e

SHA1
7844517d5c6a8a9d891edee27dea4a772832f4b5

SHA256
b513910586949d3644e5df818c1050e405a0d8140fdeefff7bdba1ea8898d3d0

SHA512
19c48bf76c38a68e2f0d8d0809a722ffcc2f20a4172cad64a94cda684b7ecc36c6a9e2f6a771ace28aad8dd592efa191b92bc0a521790a6dd8adf1c085c65b38

Download Submit
memory/2172-8-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2284-43-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-56-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2660-44-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2708-46-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2732-51-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2828-49-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2908-67-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2920-77-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2944-75-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2944-45-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-2-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2944-50-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-61-0x0000000003680000-0x0000000003A72000-memory.dmp

Filesize
3.9MB

Download
memory/2944-16-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2944-47-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-78-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-7-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2944-66-0x0000000003680000-0x0000000003A72000-memory.dmp

Filesize
3.9MB

Download
memory/2944-59-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-60-0x0000000002C90000-0x0000000002D10000-memory.dmp

Filesize
512KB

Download
memory/3036-41-0x0000000002C90000-0x0000000002D10000-memory.dmp

Filesize
512KB

Download
memory/3036-39-0x0000000002C90000-0x0000000002D10000-memory.dmp

Filesize
512KB

Download
memory/3036-38-0x000007FEF5500000-0x000007FEF5E9D000-memory.dmp

Filesize
9.6MB

Download
memory/3036-57-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/3036-48-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/3036-575-0x000007FEF5500000-0x000007FEF5E9D000-memory.dmp

Filesize
9.6MB

Download