xmrig | 2f99a86e65b5092df7a277191e0d9d95798c11762740875e9b5b4b31d9093c66

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
Size

1.9MB
MD5

0b525a156dcc52bdcd66810e10aa6aa7
SHA1

9552c50225f61a455b410c750de1ef0a2e1a1e8d
SHA256

2f99a86e65b5092df7a277191e0d9d95798c11762740875e9b5b4b31d9093c66
SHA512

744ad1faa92a676eba17e2da599efc042c511a12e7515c4ab36a30c2b4644436b009535c2b19e2804d638a2a3d98c87507099bc20f7ed4acfaba7285e325400f
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pOu:NABX

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/1084-319-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/2272-45-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2520-83-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2508-80-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2568-79-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/2876-78-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2432-77-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2592-76-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/2460-74-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/2608-71-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/1732-63-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/1096-62-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/2608-2467-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2520-2447-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2272-2486-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/1096-2488-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/2432-2489-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2876-2512-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2508-2514-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2568-2513-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/2460-2479-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/2592-2473-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/1732-2472-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2272	ySgucTH.exe
1096	juEpDsq.exe
1732	ELdRzPn.exe
2608	RnmrbxM.exe
2460	gwtvQZv.exe
2592	vMnGKPI.exe
2432	TrTGOHO.exe
2876	SogjwBu.exe
2568	tcQkYSh.exe
2508	OeJOeSu.exe
2520	OvJrcLy.exe
1480	GihzFhr.exe
1448	YTjGGIg.exe
2320	buEXxFZ.exe
1832	pCHJjxY.exe
1940	LgHgJJN.exe
2204	cngUaJW.exe
1112	pBZdtfn.exe
800	Gcuciwm.exe
1840	CjNQwlk.exe
1928	BbDodKH.exe
1652	yxDmMIW.exe
1552	FUJOUbL.exe
1468	JyHZVyb.exe
2668	AYARQlp.exe
1668	ERUcydn.exe
2908	efjXFnO.exe
2752	eFXeawe.exe
2020	Psilbzi.exe
2648	vpepdss.exe
2336	vsbiYmR.exe
2724	JjjTcZP.exe
324	FjukvcJ.exe
1992	JttbDgq.exe
1880	mJtPcCV.exe
1756	vplPPQx.exe
1180	WisQIsz.exe
1580	FEkKuEn.exe
2240	zeXAWYw.exe
1684	LuBCKON.exe
1664	LrIyHWv.exe
612	qXGsLUa.exe
3052	bfxqLmA.exe
2836	eCjOWGC.exe
2856	nVsqxrD.exe
2760	YkYgmyr.exe
2192	TcFiFMz.exe
2996	aAFMmWO.exe
3008	cCPywRK.exe
896	VHETiUg.exe
2292	cPkDhlv.exe
1100	cYxHIet.exe
2820	vpdMwqt.exe
1632	YRCcnhD.exe
2444	VwlypbA.exe
2572	SDNnEOZ.exe
2016	pvKkQzy.exe
2344	TUsURyW.exe
2628	ucjBMOd.exe
2472	tIlhpUm.exe
2800	TjDFANT.exe
1764	HVbaLxr.exe
2488	yQeIBQN.exe
1828	BjnSkFb.exe

Loads dropped DLL 64 IoCs

pid	Process
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1084-0-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/files/0x0007000000015c2f-34.dat	upx
behavioral1/files/0x000a00000001466c-9.dat	upx
behavioral1/files/0x0006000000015e6f-43.dat	upx
behavioral1/files/0x0006000000015e41-42.dat	upx
behavioral1/files/0x0008000000015a98-41.dat	upx
behavioral1/files/0x000700000001560a-40.dat	upx
behavioral1/files/0x0006000000015e5b-39.dat	upx
behavioral1/files/0x000600000001604b-108.dat	upx
behavioral1/files/0x00060000000165ae-128.dat	upx
behavioral1/files/0x0006000000016ca9-173.dat	upx
behavioral1/files/0x0006000000016ccf-178.dat	upx
behavioral1/memory/1084-319-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/files/0x0006000000016cf0-188.dat	upx
behavioral1/files/0x0006000000016cd4-182.dat	upx
behavioral1/files/0x0006000000016c90-168.dat	upx
behavioral1/files/0x0006000000016c1a-158.dat	upx
behavioral1/files/0x0006000000016c23-163.dat	upx
behavioral1/files/0x0006000000016c10-153.dat	upx
behavioral1/files/0x0006000000016b96-148.dat	upx
behavioral1/files/0x00060000000167db-139.dat	upx
behavioral1/files/0x0006000000016b5e-142.dat	upx
behavioral1/files/0x0006000000016332-118.dat	upx
behavioral1/files/0x000600000001663d-132.dat	upx
behavioral1/files/0x0006000000016476-123.dat	upx
behavioral1/files/0x0006000000016283-113.dat	upx
behavioral1/files/0x0006000000016042-103.dat	upx
behavioral1/files/0x0007000000015ec0-98.dat	upx
behavioral1/files/0x000a000000015364-84.dat	upx
behavioral1/memory/2272-45-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-90.dat	upx
behavioral1/memory/2520-83-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2508-80-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/memory/2568-79-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/2876-78-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2432-77-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2592-76-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/2460-74-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/memory/2608-71-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/1732-63-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/memory/1096-62-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/files/0x0006000000015e7c-60.dat	upx
behavioral1/files/0x0009000000015a2d-28.dat	upx
behavioral1/files/0x00080000000155e2-21.dat	upx
behavioral1/files/0x000c000000014fe1-18.dat	upx
behavioral1/memory/2608-2467-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/2520-2447-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2272-2486-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/1096-2488-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/memory/2432-2489-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2876-2512-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2508-2514-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/memory/2568-2513-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/2460-2479-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/memory/2592-2473-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/1732-2472-0x000000013F150000-0x000000013F542000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fjIfUAG.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\FUJOUbL.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\sTgfIyW.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\WaAZVZP.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\OLQvrxb.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\hQuyrXD.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\wCWoYJf.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\huysIdy.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\JkAIZVt.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\WThtvYc.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\eRpNENM.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\denztGu.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\USexMoV.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\SXelRNt.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\KrMEWXm.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\EdGxOnm.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\pMTNPfE.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\qHYmjZW.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\ZzkAAUX.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\iJBJoPq.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\ODRNvwc.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\TzzoNFi.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\WxpMavU.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\ARETrFk.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\JdjtgPD.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\SlTZyec.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\eastNzv.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\aDTgFBX.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\IJIjCiI.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\eeELBip.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\JdWBLng.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\RwyEbLL.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\IOaxFZD.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\vylSxBS.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\RSxbOMA.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\bvyzkmg.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\TkPcBjl.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\kRCYnRy.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\czvQJGi.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\kCdmuVH.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\IwbSwkV.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\sDHlZku.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\VdamTNk.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\thzGhuB.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\uwOhGEs.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\WpfBTEP.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\OEpjWNU.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\euiQKED.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\PSgwihr.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\APxbgwS.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\CmRebvg.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\lOUHrzh.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\CyavfVG.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\gjUStLa.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\IBZjOqT.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\UILQPna.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\pxWGfgR.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\MCtQXOS.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\fZcILsq.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\AkaTPar.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\NmtVKqA.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\HurMfRq.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\zQizdRK.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
File created	C:\Windows\System\wFlUACc.exe	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2176	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
Token: SeDebugPrivilege	2176	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2176	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	29
PID 1084 wrote to memory of 2176	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	29
PID 1084 wrote to memory of 2176	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	29
PID 1084 wrote to memory of 2272	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	30
PID 1084 wrote to memory of 2272	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	30
PID 1084 wrote to memory of 2272	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	30
PID 1084 wrote to memory of 1096	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	31
PID 1084 wrote to memory of 1096	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	31
PID 1084 wrote to memory of 1096	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	31
PID 1084 wrote to memory of 1732	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	32
PID 1084 wrote to memory of 1732	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	32
PID 1084 wrote to memory of 1732	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	32
PID 1084 wrote to memory of 2432	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	33
PID 1084 wrote to memory of 2432	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	33
PID 1084 wrote to memory of 2432	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	33
PID 1084 wrote to memory of 2608	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	34
PID 1084 wrote to memory of 2608	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	34
PID 1084 wrote to memory of 2608	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	34
PID 1084 wrote to memory of 2876	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	35
PID 1084 wrote to memory of 2876	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	35
PID 1084 wrote to memory of 2876	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	35
PID 1084 wrote to memory of 2460	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	36
PID 1084 wrote to memory of 2460	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	36
PID 1084 wrote to memory of 2460	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	36
PID 1084 wrote to memory of 2568	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	37
PID 1084 wrote to memory of 2568	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	37
PID 1084 wrote to memory of 2568	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	37
PID 1084 wrote to memory of 2592	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	38
PID 1084 wrote to memory of 2592	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	38
PID 1084 wrote to memory of 2592	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	38
PID 1084 wrote to memory of 2508	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	39
PID 1084 wrote to memory of 2508	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	39
PID 1084 wrote to memory of 2508	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	39
PID 1084 wrote to memory of 2520	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	40
PID 1084 wrote to memory of 2520	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	40
PID 1084 wrote to memory of 2520	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	40
PID 1084 wrote to memory of 1448	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	41
PID 1084 wrote to memory of 1448	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	41
PID 1084 wrote to memory of 1448	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	41
PID 1084 wrote to memory of 1480	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	42
PID 1084 wrote to memory of 1480	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	42
PID 1084 wrote to memory of 1480	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	42
PID 1084 wrote to memory of 2320	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	43
PID 1084 wrote to memory of 2320	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	43
PID 1084 wrote to memory of 2320	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	43
PID 1084 wrote to memory of 1832	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	44
PID 1084 wrote to memory of 1832	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	44
PID 1084 wrote to memory of 1832	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	44
PID 1084 wrote to memory of 1940	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	45
PID 1084 wrote to memory of 1940	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	45
PID 1084 wrote to memory of 1940	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	45
PID 1084 wrote to memory of 2204	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	46
PID 1084 wrote to memory of 2204	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	46
PID 1084 wrote to memory of 2204	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	46
PID 1084 wrote to memory of 1112	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	47
PID 1084 wrote to memory of 1112	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	47
PID 1084 wrote to memory of 1112	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	47
PID 1084 wrote to memory of 800	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	48
PID 1084 wrote to memory of 800	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	48
PID 1084 wrote to memory of 800	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	48
PID 1084 wrote to memory of 1840	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	49
PID 1084 wrote to memory of 1840	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	49
PID 1084 wrote to memory of 1840	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	49
PID 1084 wrote to memory of 1928	1084	0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b525a156dcc52bdcd66810e10aa6aa7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\System\ySgucTH.exe
  C:\Windows\System\ySgucTH.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\juEpDsq.exe
  C:\Windows\System\juEpDsq.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\ELdRzPn.exe
  C:\Windows\System\ELdRzPn.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\TrTGOHO.exe
  C:\Windows\System\TrTGOHO.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\RnmrbxM.exe
  C:\Windows\System\RnmrbxM.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\SogjwBu.exe
  C:\Windows\System\SogjwBu.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\gwtvQZv.exe
  C:\Windows\System\gwtvQZv.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\tcQkYSh.exe
  C:\Windows\System\tcQkYSh.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\vMnGKPI.exe
  C:\Windows\System\vMnGKPI.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\OeJOeSu.exe
  C:\Windows\System\OeJOeSu.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\OvJrcLy.exe
  C:\Windows\System\OvJrcLy.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\YTjGGIg.exe
  C:\Windows\System\YTjGGIg.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\GihzFhr.exe
  C:\Windows\System\GihzFhr.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\buEXxFZ.exe
  C:\Windows\System\buEXxFZ.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\pCHJjxY.exe
  C:\Windows\System\pCHJjxY.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\LgHgJJN.exe
  C:\Windows\System\LgHgJJN.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\cngUaJW.exe
  C:\Windows\System\cngUaJW.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\pBZdtfn.exe
  C:\Windows\System\pBZdtfn.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\Gcuciwm.exe
  C:\Windows\System\Gcuciwm.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\CjNQwlk.exe
  C:\Windows\System\CjNQwlk.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\BbDodKH.exe
  C:\Windows\System\BbDodKH.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\yxDmMIW.exe
  C:\Windows\System\yxDmMIW.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\FUJOUbL.exe
  C:\Windows\System\FUJOUbL.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\JyHZVyb.exe
  C:\Windows\System\JyHZVyb.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\AYARQlp.exe
  C:\Windows\System\AYARQlp.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\ERUcydn.exe
  C:\Windows\System\ERUcydn.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\efjXFnO.exe
  C:\Windows\System\efjXFnO.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\eFXeawe.exe
  C:\Windows\System\eFXeawe.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\Psilbzi.exe
  C:\Windows\System\Psilbzi.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\vpepdss.exe
  C:\Windows\System\vpepdss.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\vsbiYmR.exe
  C:\Windows\System\vsbiYmR.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\JjjTcZP.exe
  C:\Windows\System\JjjTcZP.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\FjukvcJ.exe
  C:\Windows\System\FjukvcJ.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\JttbDgq.exe
  C:\Windows\System\JttbDgq.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\mJtPcCV.exe
  C:\Windows\System\mJtPcCV.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\vplPPQx.exe
  C:\Windows\System\vplPPQx.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\WisQIsz.exe
  C:\Windows\System\WisQIsz.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\FEkKuEn.exe
  C:\Windows\System\FEkKuEn.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\zeXAWYw.exe
  C:\Windows\System\zeXAWYw.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\LuBCKON.exe
  C:\Windows\System\LuBCKON.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\LrIyHWv.exe
  C:\Windows\System\LrIyHWv.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\qXGsLUa.exe
  C:\Windows\System\qXGsLUa.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\bfxqLmA.exe
  C:\Windows\System\bfxqLmA.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\eCjOWGC.exe
  C:\Windows\System\eCjOWGC.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\nVsqxrD.exe
  C:\Windows\System\nVsqxrD.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\YkYgmyr.exe
  C:\Windows\System\YkYgmyr.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\TcFiFMz.exe
  C:\Windows\System\TcFiFMz.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\aAFMmWO.exe
  C:\Windows\System\aAFMmWO.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\cCPywRK.exe
  C:\Windows\System\cCPywRK.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\VHETiUg.exe
  C:\Windows\System\VHETiUg.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\cPkDhlv.exe
  C:\Windows\System\cPkDhlv.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\cYxHIet.exe
  C:\Windows\System\cYxHIet.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\vpdMwqt.exe
  C:\Windows\System\vpdMwqt.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\VwlypbA.exe
  C:\Windows\System\VwlypbA.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\YRCcnhD.exe
  C:\Windows\System\YRCcnhD.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\SDNnEOZ.exe
  C:\Windows\System\SDNnEOZ.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\pvKkQzy.exe
  C:\Windows\System\pvKkQzy.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\ucjBMOd.exe
  C:\Windows\System\ucjBMOd.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\TUsURyW.exe
  C:\Windows\System\TUsURyW.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\tIlhpUm.exe
  C:\Windows\System\tIlhpUm.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\TjDFANT.exe
  C:\Windows\System\TjDFANT.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\HVbaLxr.exe
  C:\Windows\System\HVbaLxr.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\yQeIBQN.exe
  C:\Windows\System\yQeIBQN.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\BjnSkFb.exe
  C:\Windows\System\BjnSkFb.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\LpAHxNc.exe
  C:\Windows\System\LpAHxNc.exe
  2⤵
  PID:1944
- C:\Windows\System\xPGdyXN.exe
  C:\Windows\System\xPGdyXN.exe
  2⤵
  PID:772
- C:\Windows\System\DMVPHQs.exe
  C:\Windows\System\DMVPHQs.exe
  2⤵
  PID:544
- C:\Windows\System\dwvWSsH.exe
  C:\Windows\System\dwvWSsH.exe
  2⤵
  PID:1900
- C:\Windows\System\kRCYnRy.exe
  C:\Windows\System\kRCYnRy.exe
  2⤵
  PID:1108
- C:\Windows\System\ZqtbSzQ.exe
  C:\Windows\System\ZqtbSzQ.exe
  2⤵
  PID:2308
- C:\Windows\System\gcbuGtL.exe
  C:\Windows\System\gcbuGtL.exe
  2⤵
  PID:1440
- C:\Windows\System\SzfnxuY.exe
  C:\Windows\System\SzfnxuY.exe
  2⤵
  PID:1952
- C:\Windows\System\aNYYzbO.exe
  C:\Windows\System\aNYYzbO.exe
  2⤵
  PID:1140
- C:\Windows\System\VJZjUJP.exe
  C:\Windows\System\VJZjUJP.exe
  2⤵
  PID:2656
- C:\Windows\System\iCHVcbB.exe
  C:\Windows\System\iCHVcbB.exe
  2⤵
  PID:2640
- C:\Windows\System\ugRDIuC.exe
  C:\Windows\System\ugRDIuC.exe
  2⤵
  PID:2664
- C:\Windows\System\iMjeYPf.exe
  C:\Windows\System\iMjeYPf.exe
  2⤵
  PID:692
- C:\Windows\System\IIRfOjv.exe
  C:\Windows\System\IIRfOjv.exe
  2⤵
  PID:2832
- C:\Windows\System\JaYnPJT.exe
  C:\Windows\System\JaYnPJT.exe
  2⤵
  PID:2612
- C:\Windows\System\NtrxcqE.exe
  C:\Windows\System\NtrxcqE.exe
  2⤵
  PID:1988
- C:\Windows\System\shgULkR.exe
  C:\Windows\System\shgULkR.exe
  2⤵
  PID:2456
- C:\Windows\System\LPMPMew.exe
  C:\Windows\System\LPMPMew.exe
  2⤵
  PID:1572
- C:\Windows\System\zEcdoKO.exe
  C:\Windows\System\zEcdoKO.exe
  2⤵
  PID:3028
- C:\Windows\System\VcfVJFj.exe
  C:\Windows\System\VcfVJFj.exe
  2⤵
  PID:1040
- C:\Windows\System\vFfRAJN.exe
  C:\Windows\System\vFfRAJN.exe
  2⤵
  PID:1536
- C:\Windows\System\RFkJyPM.exe
  C:\Windows\System\RFkJyPM.exe
  2⤵
  PID:1712
- C:\Windows\System\WUEdusI.exe
  C:\Windows\System\WUEdusI.exe
  2⤵
  PID:976
- C:\Windows\System\GtfaHRP.exe
  C:\Windows\System\GtfaHRP.exe
  2⤵
  PID:2740
- C:\Windows\System\DEqHqvC.exe
  C:\Windows\System\DEqHqvC.exe
  2⤵
  PID:2992
- C:\Windows\System\zHVYgFy.exe
  C:\Windows\System\zHVYgFy.exe
  2⤵
  PID:1240
- C:\Windows\System\TTbrScj.exe
  C:\Windows\System\TTbrScj.exe
  2⤵
  PID:1540
- C:\Windows\System\UijrUUj.exe
  C:\Windows\System\UijrUUj.exe
  2⤵
  PID:2268
- C:\Windows\System\DgBWvoD.exe
  C:\Windows\System\DgBWvoD.exe
  2⤵
  PID:2124
- C:\Windows\System\EmVojRA.exe
  C:\Windows\System\EmVojRA.exe
  2⤵
  PID:2008
- C:\Windows\System\bqAvgrB.exe
  C:\Windows\System\bqAvgrB.exe
  2⤵
  PID:2080
- C:\Windows\System\OlnAOYj.exe
  C:\Windows\System\OlnAOYj.exe
  2⤵
  PID:2276
- C:\Windows\System\adZkFKX.exe
  C:\Windows\System\adZkFKX.exe
  2⤵
  PID:2496
- C:\Windows\System\UODIQku.exe
  C:\Windows\System\UODIQku.exe
  2⤵
  PID:2428
- C:\Windows\System\myoWiUG.exe
  C:\Windows\System\myoWiUG.exe
  2⤵
  PID:856
- C:\Windows\System\atEDwkN.exe
  C:\Windows\System\atEDwkN.exe
  2⤵
  PID:1496
- C:\Windows\System\RLSzwvg.exe
  C:\Windows\System\RLSzwvg.exe
  2⤵
  PID:2680
- C:\Windows\System\clYiRVZ.exe
  C:\Windows\System\clYiRVZ.exe
  2⤵
  PID:2084
- C:\Windows\System\pDqUXVF.exe
  C:\Windows\System\pDqUXVF.exe
  2⤵
  PID:1648
- C:\Windows\System\CZLxJCN.exe
  C:\Windows\System\CZLxJCN.exe
  2⤵
  PID:2052
- C:\Windows\System\klVFDsD.exe
  C:\Windows\System\klVFDsD.exe
  2⤵
  PID:676
- C:\Windows\System\AZMAVql.exe
  C:\Windows\System\AZMAVql.exe
  2⤵
  PID:1808
- C:\Windows\System\jwlrEVu.exe
  C:\Windows\System\jwlrEVu.exe
  2⤵
  PID:1212
- C:\Windows\System\CciBDaK.exe
  C:\Windows\System\CciBDaK.exe
  2⤵
  PID:2844
- C:\Windows\System\NUVPzuw.exe
  C:\Windows\System\NUVPzuw.exe
  2⤵
  PID:2964
- C:\Windows\System\HCKluaj.exe
  C:\Windows\System\HCKluaj.exe
  2⤵
  PID:2420
- C:\Windows\System\MnsjCcp.exe
  C:\Windows\System\MnsjCcp.exe
  2⤵
  PID:1836
- C:\Windows\System\vgSLCBg.exe
  C:\Windows\System\vgSLCBg.exe
  2⤵
  PID:1984
- C:\Windows\System\MTGdScF.exe
  C:\Windows\System\MTGdScF.exe
  2⤵
  PID:2880
- C:\Windows\System\sBeibMa.exe
  C:\Windows\System\sBeibMa.exe
  2⤵
  PID:2868
- C:\Windows\System\CfylJUL.exe
  C:\Windows\System\CfylJUL.exe
  2⤵
  PID:3012
- C:\Windows\System\ncyELWc.exe
  C:\Windows\System\ncyELWc.exe
  2⤵
  PID:1088
- C:\Windows\System\kFSTcDf.exe
  C:\Windows\System\kFSTcDf.exe
  2⤵
  PID:1976
- C:\Windows\System\QPdMsly.exe
  C:\Windows\System\QPdMsly.exe
  2⤵
  PID:2732
- C:\Windows\System\eifRBRC.exe
  C:\Windows\System\eifRBRC.exe
  2⤵
  PID:1960
- C:\Windows\System\lHocwzJ.exe
  C:\Windows\System\lHocwzJ.exe
  2⤵
  PID:1964
- C:\Windows\System\KktrqLJ.exe
  C:\Windows\System\KktrqLJ.exe
  2⤵
  PID:2416
- C:\Windows\System\xwqzvdf.exe
  C:\Windows\System\xwqzvdf.exe
  2⤵
  PID:1636
- C:\Windows\System\rnmLbdS.exe
  C:\Windows\System\rnmLbdS.exe
  2⤵
  PID:1776
- C:\Windows\System\qWlQjih.exe
  C:\Windows\System\qWlQjih.exe
  2⤵
  PID:2044
- C:\Windows\System\svFKSQy.exe
  C:\Windows\System\svFKSQy.exe
  2⤵
  PID:2224
- C:\Windows\System\iPKnhnM.exe
  C:\Windows\System\iPKnhnM.exe
  2⤵
  PID:1252
- C:\Windows\System\iVScuJE.exe
  C:\Windows\System\iVScuJE.exe
  2⤵
  PID:3000
- C:\Windows\System\VrFZPcC.exe
  C:\Windows\System\VrFZPcC.exe
  2⤵
  PID:1148
- C:\Windows\System\wvmTUDV.exe
  C:\Windows\System\wvmTUDV.exe
  2⤵
  PID:1512
- C:\Windows\System\KIQwtkn.exe
  C:\Windows\System\KIQwtkn.exe
  2⤵
  PID:1672
- C:\Windows\System\QpcuoXt.exe
  C:\Windows\System\QpcuoXt.exe
  2⤵
  PID:2636
- C:\Windows\System\EHMisEO.exe
  C:\Windows\System\EHMisEO.exe
  2⤵
  PID:2924
- C:\Windows\System\CvBNEHu.exe
  C:\Windows\System\CvBNEHu.exe
  2⤵
  PID:2324
- C:\Windows\System\hFQiPkV.exe
  C:\Windows\System\hFQiPkV.exe
  2⤵
  PID:1132
- C:\Windows\System\QqHIKJq.exe
  C:\Windows\System\QqHIKJq.exe
  2⤵
  PID:2600
- C:\Windows\System\fVxPrYI.exe
  C:\Windows\System\fVxPrYI.exe
  2⤵
  PID:2892
- C:\Windows\System\BvTBrfp.exe
  C:\Windows\System\BvTBrfp.exe
  2⤵
  PID:2088
- C:\Windows\System\ClEyiaJ.exe
  C:\Windows\System\ClEyiaJ.exe
  2⤵
  PID:2160
- C:\Windows\System\NZFUFBy.exe
  C:\Windows\System\NZFUFBy.exe
  2⤵
  PID:2096
- C:\Windows\System\EAlIUMR.exe
  C:\Windows\System\EAlIUMR.exe
  2⤵
  PID:1720
- C:\Windows\System\yoMPNrh.exe
  C:\Windows\System\yoMPNrh.exe
  2⤵
  PID:2492
- C:\Windows\System\JLQWuOM.exe
  C:\Windows\System\JLQWuOM.exe
  2⤵
  PID:920
- C:\Windows\System\Onqcqhi.exe
  C:\Windows\System\Onqcqhi.exe
  2⤵
  PID:1276
- C:\Windows\System\tQWfUsV.exe
  C:\Windows\System\tQWfUsV.exe
  2⤵
  PID:2564
- C:\Windows\System\kFuWOLO.exe
  C:\Windows\System\kFuWOLO.exe
  2⤵
  PID:2056
- C:\Windows\System\nNbyQbu.exe
  C:\Windows\System\nNbyQbu.exe
  2⤵
  PID:1884
- C:\Windows\System\RwyEbLL.exe
  C:\Windows\System\RwyEbLL.exe
  2⤵
  PID:1452
- C:\Windows\System\iAzihAK.exe
  C:\Windows\System\iAzihAK.exe
  2⤵
  PID:2696
- C:\Windows\System\gTzPwJq.exe
  C:\Windows\System\gTzPwJq.exe
  2⤵
  PID:2768
- C:\Windows\System\szELqJy.exe
  C:\Windows\System\szELqJy.exe
  2⤵
  PID:1544
- C:\Windows\System\rWFHPKl.exe
  C:\Windows\System\rWFHPKl.exe
  2⤵
  PID:2120
- C:\Windows\System\moevZPY.exe
  C:\Windows\System\moevZPY.exe
  2⤵
  PID:2368
- C:\Windows\System\CyavfVG.exe
  C:\Windows\System\CyavfVG.exe
  2⤵
  PID:572
- C:\Windows\System\tkmZMOD.exe
  C:\Windows\System\tkmZMOD.exe
  2⤵
  PID:1280
- C:\Windows\System\DYfxciy.exe
  C:\Windows\System\DYfxciy.exe
  2⤵
  PID:2712
- C:\Windows\System\XdcfplU.exe
  C:\Windows\System\XdcfplU.exe
  2⤵
  PID:2436
- C:\Windows\System\yATwTYn.exe
  C:\Windows\System\yATwTYn.exe
  2⤵
  PID:2296
- C:\Windows\System\hdprQND.exe
  C:\Windows\System\hdprQND.exe
  2⤵
  PID:884
- C:\Windows\System\HGnPiEQ.exe
  C:\Windows\System\HGnPiEQ.exe
  2⤵
  PID:2988
- C:\Windows\System\hDuGGpN.exe
  C:\Windows\System\hDuGGpN.exe
  2⤵
  PID:816
- C:\Windows\System\PyijuEH.exe
  C:\Windows\System\PyijuEH.exe
  2⤵
  PID:1736
- C:\Windows\System\uXNnqfo.exe
  C:\Windows\System\uXNnqfo.exe
  2⤵
  PID:3060
- C:\Windows\System\AwTmRQR.exe
  C:\Windows\System\AwTmRQR.exe
  2⤵
  PID:768
- C:\Windows\System\tfcKTVg.exe
  C:\Windows\System\tfcKTVg.exe
  2⤵
  PID:1476
- C:\Windows\System\Kjjfqcv.exe
  C:\Windows\System\Kjjfqcv.exe
  2⤵
  PID:2916
- C:\Windows\System\JfCoTby.exe
  C:\Windows\System\JfCoTby.exe
  2⤵
  PID:1896
- C:\Windows\System\guyoTbj.exe
  C:\Windows\System\guyoTbj.exe
  2⤵
  PID:2312
- C:\Windows\System\ITCqKpq.exe
  C:\Windows\System\ITCqKpq.exe
  2⤵
  PID:780
- C:\Windows\System\dIhzDmj.exe
  C:\Windows\System\dIhzDmj.exe
  2⤵
  PID:2216
- C:\Windows\System\wKotbqb.exe
  C:\Windows\System\wKotbqb.exe
  2⤵
  PID:1296
- C:\Windows\System\ZpYltyZ.exe
  C:\Windows\System\ZpYltyZ.exe
  2⤵
  PID:1948
- C:\Windows\System\AkaTPar.exe
  C:\Windows\System\AkaTPar.exe
  2⤵
  PID:2772
- C:\Windows\System\RPyANrv.exe
  C:\Windows\System\RPyANrv.exe
  2⤵
  PID:2764
- C:\Windows\System\Tziaarq.exe
  C:\Windows\System\Tziaarq.exe
  2⤵
  PID:1688
- C:\Windows\System\BbVcyMQ.exe
  C:\Windows\System\BbVcyMQ.exe
  2⤵
  PID:2360
- C:\Windows\System\nofsnLg.exe
  C:\Windows\System\nofsnLg.exe
  2⤵
  PID:1120
- C:\Windows\System\kSDLinS.exe
  C:\Windows\System\kSDLinS.exe
  2⤵
  PID:2000
- C:\Windows\System\KbFudKR.exe
  C:\Windows\System\KbFudKR.exe
  2⤵
  PID:2812
- C:\Windows\System\OnAZyCB.exe
  C:\Windows\System\OnAZyCB.exe
  2⤵
  PID:1796
- C:\Windows\System\AbJIUpS.exe
  C:\Windows\System\AbJIUpS.exe
  2⤵
  PID:1740
- C:\Windows\System\YmkMorO.exe
  C:\Windows\System\YmkMorO.exe
  2⤵
  PID:912
- C:\Windows\System\cgTxWvY.exe
  C:\Windows\System\cgTxWvY.exe
  2⤵
  PID:980
- C:\Windows\System\WJcoNVF.exe
  C:\Windows\System\WJcoNVF.exe
  2⤵
  PID:948
- C:\Windows\System\GyYilNE.exe
  C:\Windows\System\GyYilNE.exe
  2⤵
  PID:632
- C:\Windows\System\QUSNWzm.exe
  C:\Windows\System\QUSNWzm.exe
  2⤵
  PID:3080
- C:\Windows\System\ObRmTVj.exe
  C:\Windows\System\ObRmTVj.exe
  2⤵
  PID:3096
- C:\Windows\System\WCoTlvM.exe
  C:\Windows\System\WCoTlvM.exe
  2⤵
  PID:3112
- C:\Windows\System\zOzmPUv.exe
  C:\Windows\System\zOzmPUv.exe
  2⤵
  PID:3128
- C:\Windows\System\sDHlZku.exe
  C:\Windows\System\sDHlZku.exe
  2⤵
  PID:3144
- C:\Windows\System\WnTEJyK.exe
  C:\Windows\System\WnTEJyK.exe
  2⤵
  PID:3160
- C:\Windows\System\XsgQmWE.exe
  C:\Windows\System\XsgQmWE.exe
  2⤵
  PID:3176
- C:\Windows\System\vLOafoP.exe
  C:\Windows\System\vLOafoP.exe
  2⤵
  PID:3192
- C:\Windows\System\FTJhqxu.exe
  C:\Windows\System\FTJhqxu.exe
  2⤵
  PID:3208
- C:\Windows\System\VqevtkB.exe
  C:\Windows\System\VqevtkB.exe
  2⤵
  PID:3224
- C:\Windows\System\byrapct.exe
  C:\Windows\System\byrapct.exe
  2⤵
  PID:3244
- C:\Windows\System\AcnVxpu.exe
  C:\Windows\System\AcnVxpu.exe
  2⤵
  PID:3260
- C:\Windows\System\DyQEJzg.exe
  C:\Windows\System\DyQEJzg.exe
  2⤵
  PID:3276
- C:\Windows\System\GfUMGie.exe
  C:\Windows\System\GfUMGie.exe
  2⤵
  PID:3296
- C:\Windows\System\mfItVAZ.exe
  C:\Windows\System\mfItVAZ.exe
  2⤵
  PID:3312
- C:\Windows\System\qrMYRjm.exe
  C:\Windows\System\qrMYRjm.exe
  2⤵
  PID:3328
- C:\Windows\System\FIzEOTr.exe
  C:\Windows\System\FIzEOTr.exe
  2⤵
  PID:3352
- C:\Windows\System\qBeNtZx.exe
  C:\Windows\System\qBeNtZx.exe
  2⤵
  PID:3368
- C:\Windows\System\LgPUnlo.exe
  C:\Windows\System\LgPUnlo.exe
  2⤵
  PID:3384
- C:\Windows\System\UlSHvDX.exe
  C:\Windows\System\UlSHvDX.exe
  2⤵
  PID:3404
- C:\Windows\System\vTtVdKR.exe
  C:\Windows\System\vTtVdKR.exe
  2⤵
  PID:3420
- C:\Windows\System\vZQMFth.exe
  C:\Windows\System\vZQMFth.exe
  2⤵
  PID:3440
- C:\Windows\System\YvCcctE.exe
  C:\Windows\System\YvCcctE.exe
  2⤵
  PID:3464
- C:\Windows\System\sSpGlBg.exe
  C:\Windows\System\sSpGlBg.exe
  2⤵
  PID:3480
- C:\Windows\System\ZvybUKY.exe
  C:\Windows\System\ZvybUKY.exe
  2⤵
  PID:3496
- C:\Windows\System\ObFPcCq.exe
  C:\Windows\System\ObFPcCq.exe
  2⤵
  PID:3512
- C:\Windows\System\zEYkqde.exe
  C:\Windows\System\zEYkqde.exe
  2⤵
  PID:3528
- C:\Windows\System\yNshowl.exe
  C:\Windows\System\yNshowl.exe
  2⤵
  PID:3548
- C:\Windows\System\cqqTFco.exe
  C:\Windows\System\cqqTFco.exe
  2⤵
  PID:3564
- C:\Windows\System\QEpzdMc.exe
  C:\Windows\System\QEpzdMc.exe
  2⤵
  PID:3580
- C:\Windows\System\cCIofEa.exe
  C:\Windows\System\cCIofEa.exe
  2⤵
  PID:3600
- C:\Windows\System\BEhVbaQ.exe
  C:\Windows\System\BEhVbaQ.exe
  2⤵
  PID:3616
- C:\Windows\System\PiQXSDm.exe
  C:\Windows\System\PiQXSDm.exe
  2⤵
  PID:3632
- C:\Windows\System\ySXrUOy.exe
  C:\Windows\System\ySXrUOy.exe
  2⤵
  PID:3648
- C:\Windows\System\FNWnTHz.exe
  C:\Windows\System\FNWnTHz.exe
  2⤵
  PID:3664
- C:\Windows\System\zqeHdJM.exe
  C:\Windows\System\zqeHdJM.exe
  2⤵
  PID:3684
- C:\Windows\System\bcxvsmQ.exe
  C:\Windows\System\bcxvsmQ.exe
  2⤵
  PID:3704
- C:\Windows\System\jarBgKu.exe
  C:\Windows\System\jarBgKu.exe
  2⤵
  PID:3720
- C:\Windows\System\QcYyINb.exe
  C:\Windows\System\QcYyINb.exe
  2⤵
  PID:3736
- C:\Windows\System\HCEhqcM.exe
  C:\Windows\System\HCEhqcM.exe
  2⤵
  PID:3752
- C:\Windows\System\xNARViE.exe
  C:\Windows\System\xNARViE.exe
  2⤵
  PID:3768
- C:\Windows\System\XoyzQUL.exe
  C:\Windows\System\XoyzQUL.exe
  2⤵
  PID:3784
- C:\Windows\System\RJiDAGV.exe
  C:\Windows\System\RJiDAGV.exe
  2⤵
  PID:3804
- C:\Windows\System\NmtVKqA.exe
  C:\Windows\System\NmtVKqA.exe
  2⤵
  PID:3820
- C:\Windows\System\eYcpbMA.exe
  C:\Windows\System\eYcpbMA.exe
  2⤵
  PID:3836
- C:\Windows\System\xchikQf.exe
  C:\Windows\System\xchikQf.exe
  2⤵
  PID:3856
- C:\Windows\System\wkMHNNP.exe
  C:\Windows\System\wkMHNNP.exe
  2⤵
  PID:3872
- C:\Windows\System\cuQnGSJ.exe
  C:\Windows\System\cuQnGSJ.exe
  2⤵
  PID:3888
- C:\Windows\System\IOaxFZD.exe
  C:\Windows\System\IOaxFZD.exe
  2⤵
  PID:3904
- C:\Windows\System\boVjGMe.exe
  C:\Windows\System\boVjGMe.exe
  2⤵
  PID:3920
- C:\Windows\System\XGIXrhW.exe
  C:\Windows\System\XGIXrhW.exe
  2⤵
  PID:3936
- C:\Windows\System\pbVExjf.exe
  C:\Windows\System\pbVExjf.exe
  2⤵
  PID:3956
- C:\Windows\System\MOzyYLX.exe
  C:\Windows\System\MOzyYLX.exe
  2⤵
  PID:3972
- C:\Windows\System\fqXCEYB.exe
  C:\Windows\System\fqXCEYB.exe
  2⤵
  PID:3988
- C:\Windows\System\HikYRgW.exe
  C:\Windows\System\HikYRgW.exe
  2⤵
  PID:4008
- C:\Windows\System\hsoZYrq.exe
  C:\Windows\System\hsoZYrq.exe
  2⤵
  PID:4024
- C:\Windows\System\hQCkyCM.exe
  C:\Windows\System\hQCkyCM.exe
  2⤵
  PID:4040
- C:\Windows\System\DSTzEKi.exe
  C:\Windows\System\DSTzEKi.exe
  2⤵
  PID:4056
- C:\Windows\System\oIetwlt.exe
  C:\Windows\System\oIetwlt.exe
  2⤵
  PID:4072
- C:\Windows\System\xrtnchd.exe
  C:\Windows\System\xrtnchd.exe
  2⤵
  PID:3488
- C:\Windows\System\PuFGBND.exe
  C:\Windows\System\PuFGBND.exe
  2⤵
  PID:3460
- C:\Windows\System\oLbamiG.exe
  C:\Windows\System\oLbamiG.exe
  2⤵
  PID:3508
- C:\Windows\System\BCIjANo.exe
  C:\Windows\System\BCIjANo.exe
  2⤵
  PID:3576
- C:\Windows\System\SqzQSuY.exe
  C:\Windows\System\SqzQSuY.exe
  2⤵
  PID:3644
- C:\Windows\System\aFQmYrE.exe
  C:\Windows\System\aFQmYrE.exe
  2⤵
  PID:3660
- C:\Windows\System\qHrCPEY.exe
  C:\Windows\System\qHrCPEY.exe
  2⤵
  PID:3560
- C:\Windows\System\wFlUACc.exe
  C:\Windows\System\wFlUACc.exe
  2⤵
  PID:3672
- C:\Windows\System\lQqzyXh.exe
  C:\Windows\System\lQqzyXh.exe
  2⤵
  PID:3692
- C:\Windows\System\rkAkkbc.exe
  C:\Windows\System\rkAkkbc.exe
  2⤵
  PID:3728
- C:\Windows\System\yKyzchW.exe
  C:\Windows\System\yKyzchW.exe
  2⤵
  PID:3744
- C:\Windows\System\MFPjAPr.exe
  C:\Windows\System\MFPjAPr.exe
  2⤵
  PID:3816
- C:\Windows\System\UDKnXDZ.exe
  C:\Windows\System\UDKnXDZ.exe
  2⤵
  PID:2552
- C:\Windows\System\bhSvPTi.exe
  C:\Windows\System\bhSvPTi.exe
  2⤵
  PID:3900
- C:\Windows\System\Prvzmyy.exe
  C:\Windows\System\Prvzmyy.exe
  2⤵
  PID:3864
- C:\Windows\System\eklgbTO.exe
  C:\Windows\System\eklgbTO.exe
  2⤵
  PID:3944
- C:\Windows\System\crnzdaB.exe
  C:\Windows\System\crnzdaB.exe
  2⤵
  PID:3952
- C:\Windows\System\OgHJHCn.exe
  C:\Windows\System\OgHJHCn.exe
  2⤵
  PID:3932
- C:\Windows\System\znmtsLn.exe
  C:\Windows\System\znmtsLn.exe
  2⤵
  PID:4016
- C:\Windows\System\oxCRbEs.exe
  C:\Windows\System\oxCRbEs.exe
  2⤵
  PID:4052
- C:\Windows\System\vylSxBS.exe
  C:\Windows\System\vylSxBS.exe
  2⤵
  PID:4036
- C:\Windows\System\dbxjznU.exe
  C:\Windows\System\dbxjznU.exe
  2⤵
  PID:4088
- C:\Windows\System\ZEkigvn.exe
  C:\Windows\System\ZEkigvn.exe
  2⤵
  PID:2548
- C:\Windows\System\sbUOpvU.exe
  C:\Windows\System\sbUOpvU.exe
  2⤵
  PID:3124
- C:\Windows\System\MNRydVx.exe
  C:\Windows\System\MNRydVx.exe
  2⤵
  PID:3108
- C:\Windows\System\MCtQXOS.exe
  C:\Windows\System\MCtQXOS.exe
  2⤵
  PID:3152
- C:\Windows\System\ONjWjsi.exe
  C:\Windows\System\ONjWjsi.exe
  2⤵
  PID:3172
- C:\Windows\System\akQMEFF.exe
  C:\Windows\System\akQMEFF.exe
  2⤵
  PID:3220
- C:\Windows\System\KsnaLcd.exe
  C:\Windows\System\KsnaLcd.exe
  2⤵
  PID:3256
- C:\Windows\System\SEPsAJd.exe
  C:\Windows\System\SEPsAJd.exe
  2⤵
  PID:3284
- C:\Windows\System\YmbpdLY.exe
  C:\Windows\System\YmbpdLY.exe
  2⤵
  PID:1660
- C:\Windows\System\blNAuaG.exe
  C:\Windows\System\blNAuaG.exe
  2⤵
  PID:3364
- C:\Windows\System\kZLcZwb.exe
  C:\Windows\System\kZLcZwb.exe
  2⤵
  PID:3848
- C:\Windows\System\ysQXSpg.exe
  C:\Windows\System\ysQXSpg.exe
  2⤵
  PID:3336
- C:\Windows\System\wSXfLme.exe
  C:\Windows\System\wSXfLme.exe
  2⤵
  PID:3380
- C:\Windows\System\qYQclmr.exe
  C:\Windows\System\qYQclmr.exe
  2⤵
  PID:3472
- C:\Windows\System\SIYQbUJ.exe
  C:\Windows\System\SIYQbUJ.exe
  2⤵
  PID:3572
- C:\Windows\System\LxjSkOF.exe
  C:\Windows\System\LxjSkOF.exe
  2⤵
  PID:3656
- C:\Windows\System\ZsLyMsS.exe
  C:\Windows\System\ZsLyMsS.exe
  2⤵
  PID:3612
- C:\Windows\System\XnJjqeK.exe
  C:\Windows\System\XnJjqeK.exe
  2⤵
  PID:3556
- C:\Windows\System\rRnpzes.exe
  C:\Windows\System\rRnpzes.exe
  2⤵
  PID:3716
- C:\Windows\System\jheIZWb.exe
  C:\Windows\System\jheIZWb.exe
  2⤵
  PID:3852
- C:\Windows\System\CBHKavJ.exe
  C:\Windows\System\CBHKavJ.exe
  2⤵
  PID:3800
- C:\Windows\System\yMONzKq.exe
  C:\Windows\System\yMONzKq.exe
  2⤵
  PID:3928
- C:\Windows\System\zgLdiil.exe
  C:\Windows\System\zgLdiil.exe
  2⤵
  PID:3916
- C:\Windows\System\EOjrrIk.exe
  C:\Windows\System\EOjrrIk.exe
  2⤵
  PID:4048
- C:\Windows\System\yWLEXuA.exe
  C:\Windows\System\yWLEXuA.exe
  2⤵
  PID:4064
- C:\Windows\System\ZCcZQOT.exe
  C:\Windows\System\ZCcZQOT.exe
  2⤵
  PID:2624
- C:\Windows\System\RNVmTem.exe
  C:\Windows\System\RNVmTem.exe
  2⤵
  PID:3076
- C:\Windows\System\VwNwidO.exe
  C:\Windows\System\VwNwidO.exe
  2⤵
  PID:3184
- C:\Windows\System\TryXvOX.exe
  C:\Windows\System\TryXvOX.exe
  2⤵
  PID:3240
- C:\Windows\System\MzTMerk.exe
  C:\Windows\System\MzTMerk.exe
  2⤵
  PID:3304
- C:\Windows\System\XcZyAxd.exe
  C:\Windows\System\XcZyAxd.exe
  2⤵
  PID:3308
- C:\Windows\System\KakxmTW.exe
  C:\Windows\System\KakxmTW.exe
  2⤵
  PID:3544
- C:\Windows\System\FStamga.exe
  C:\Windows\System\FStamga.exe
  2⤵
  PID:3448
- C:\Windows\System\inqLdqp.exe
  C:\Windows\System\inqLdqp.exe
  2⤵
  PID:3452
- C:\Windows\System\YXQwePm.exe
  C:\Windows\System\YXQwePm.exe
  2⤵
  PID:3520
- C:\Windows\System\mKXOQsZ.exe
  C:\Windows\System\mKXOQsZ.exe
  2⤵
  PID:3812
- C:\Windows\System\UWmUFZE.exe
  C:\Windows\System\UWmUFZE.exe
  2⤵
  PID:1612
- C:\Windows\System\xWZHTkX.exe
  C:\Windows\System\xWZHTkX.exe
  2⤵
  PID:3968
- C:\Windows\System\yZwwixJ.exe
  C:\Windows\System\yZwwixJ.exe
  2⤵
  PID:380
- C:\Windows\System\bXawnVd.exe
  C:\Windows\System\bXawnVd.exe
  2⤵
  PID:3324
- C:\Windows\System\KglhTgx.exe
  C:\Windows\System\KglhTgx.exe
  2⤵
  PID:3204
- C:\Windows\System\OATOybu.exe
  C:\Windows\System\OATOybu.exe
  2⤵
  PID:3272
- C:\Windows\System\mKmNbhu.exe
  C:\Windows\System\mKmNbhu.exe
  2⤵
  PID:3412
- C:\Windows\System\IzJxDJW.exe
  C:\Windows\System\IzJxDJW.exe
  2⤵
  PID:3896
- C:\Windows\System\EYUtFBT.exe
  C:\Windows\System\EYUtFBT.exe
  2⤵
  PID:3376
- C:\Windows\System\WNRMdhm.exe
  C:\Windows\System\WNRMdhm.exe
  2⤵
  PID:3996
- C:\Windows\System\dJZEPQq.exe
  C:\Windows\System\dJZEPQq.exe
  2⤵
  PID:3504
- C:\Windows\System\hpIuGwp.exe
  C:\Windows\System\hpIuGwp.exe
  2⤵
  PID:4112
- C:\Windows\System\hbVMEdH.exe
  C:\Windows\System\hbVMEdH.exe
  2⤵
  PID:4128
- C:\Windows\System\xxOTskR.exe
  C:\Windows\System\xxOTskR.exe
  2⤵
  PID:4148
- C:\Windows\System\oEoWQyf.exe
  C:\Windows\System\oEoWQyf.exe
  2⤵
  PID:4164
- C:\Windows\System\QAWRcME.exe
  C:\Windows\System\QAWRcME.exe
  2⤵
  PID:4180
- C:\Windows\System\fiuKREv.exe
  C:\Windows\System\fiuKREv.exe
  2⤵
  PID:4196
- C:\Windows\System\JkAIZVt.exe
  C:\Windows\System\JkAIZVt.exe
  2⤵
  PID:4212
- C:\Windows\System\gAqmorA.exe
  C:\Windows\System\gAqmorA.exe
  2⤵
  PID:4228
- C:\Windows\System\yNEMDJy.exe
  C:\Windows\System\yNEMDJy.exe
  2⤵
  PID:4248
- C:\Windows\System\cRvALKA.exe
  C:\Windows\System\cRvALKA.exe
  2⤵
  PID:4264
- C:\Windows\System\bZPvVUx.exe
  C:\Windows\System\bZPvVUx.exe
  2⤵
  PID:4280
- C:\Windows\System\loNkvbQ.exe
  C:\Windows\System\loNkvbQ.exe
  2⤵
  PID:4296
- C:\Windows\System\ALeKemc.exe
  C:\Windows\System\ALeKemc.exe
  2⤵
  PID:4312
- C:\Windows\System\dlaidhP.exe
  C:\Windows\System\dlaidhP.exe
  2⤵
  PID:4328
- C:\Windows\System\OSfhvpK.exe
  C:\Windows\System\OSfhvpK.exe
  2⤵
  PID:4344
- C:\Windows\System\gxLNYGv.exe
  C:\Windows\System\gxLNYGv.exe
  2⤵
  PID:4360
- C:\Windows\System\zEEqzYd.exe
  C:\Windows\System\zEEqzYd.exe
  2⤵
  PID:4376
- C:\Windows\System\akuoEab.exe
  C:\Windows\System\akuoEab.exe
  2⤵
  PID:4392
- C:\Windows\System\PuYknbS.exe
  C:\Windows\System\PuYknbS.exe
  2⤵
  PID:4412
- C:\Windows\System\UqOLhsm.exe
  C:\Windows\System\UqOLhsm.exe
  2⤵
  PID:4428
- C:\Windows\System\fatYpld.exe
  C:\Windows\System\fatYpld.exe
  2⤵
  PID:4444
- C:\Windows\System\djiCHHG.exe
  C:\Windows\System\djiCHHG.exe
  2⤵
  PID:4460
- C:\Windows\System\RYzCexb.exe
  C:\Windows\System\RYzCexb.exe
  2⤵
  PID:4476
- C:\Windows\System\yjirhpL.exe
  C:\Windows\System\yjirhpL.exe
  2⤵
  PID:4492
- C:\Windows\System\wCCEXYa.exe
  C:\Windows\System\wCCEXYa.exe
  2⤵
  PID:4508
- C:\Windows\System\AMNfSWk.exe
  C:\Windows\System\AMNfSWk.exe
  2⤵
  PID:4532
- C:\Windows\System\VdamTNk.exe
  C:\Windows\System\VdamTNk.exe
  2⤵
  PID:4548
- C:\Windows\System\GOziJYk.exe
  C:\Windows\System\GOziJYk.exe
  2⤵
  PID:4564
- C:\Windows\System\uTvpUwF.exe
  C:\Windows\System\uTvpUwF.exe
  2⤵
  PID:4584
- C:\Windows\System\BmLjbVb.exe
  C:\Windows\System\BmLjbVb.exe
  2⤵
  PID:4604
- C:\Windows\System\VAabSoP.exe
  C:\Windows\System\VAabSoP.exe
  2⤵
  PID:4620
- C:\Windows\System\GTatPXf.exe
  C:\Windows\System\GTatPXf.exe
  2⤵
  PID:4636
- C:\Windows\System\ptQwVUU.exe
  C:\Windows\System\ptQwVUU.exe
  2⤵
  PID:4652
- C:\Windows\System\LOrmNEY.exe
  C:\Windows\System\LOrmNEY.exe
  2⤵
  PID:4668
- C:\Windows\System\SMvQemG.exe
  C:\Windows\System\SMvQemG.exe
  2⤵
  PID:4684
- C:\Windows\System\kORbAvj.exe
  C:\Windows\System\kORbAvj.exe
  2⤵
  PID:4700
- C:\Windows\System\WpfBTEP.exe
  C:\Windows\System\WpfBTEP.exe
  2⤵
  PID:4716
- C:\Windows\System\ajQTHUX.exe
  C:\Windows\System\ajQTHUX.exe
  2⤵
  PID:4732
- C:\Windows\System\YWuumPI.exe
  C:\Windows\System\YWuumPI.exe
  2⤵
  PID:4748
- C:\Windows\System\yblbkmj.exe
  C:\Windows\System\yblbkmj.exe
  2⤵
  PID:4764
- C:\Windows\System\npFsoms.exe
  C:\Windows\System\npFsoms.exe
  2⤵
  PID:4784
- C:\Windows\System\gcbSGrP.exe
  C:\Windows\System\gcbSGrP.exe
  2⤵
  PID:4808
- C:\Windows\System\fIupNtW.exe
  C:\Windows\System\fIupNtW.exe
  2⤵
  PID:4836
- C:\Windows\System\qVafCzd.exe
  C:\Windows\System\qVafCzd.exe
  2⤵
  PID:4852
- C:\Windows\System\qBNHldi.exe
  C:\Windows\System\qBNHldi.exe
  2⤵
  PID:4868
- C:\Windows\System\psFOVof.exe
  C:\Windows\System\psFOVof.exe
  2⤵
  PID:4884
- C:\Windows\System\tJdKFZw.exe
  C:\Windows\System\tJdKFZw.exe
  2⤵
  PID:4900
- C:\Windows\System\pTaOiGH.exe
  C:\Windows\System\pTaOiGH.exe
  2⤵
  PID:4916
- C:\Windows\System\SodtdKd.exe
  C:\Windows\System\SodtdKd.exe
  2⤵
  PID:4932
- C:\Windows\System\OkJiWHB.exe
  C:\Windows\System\OkJiWHB.exe
  2⤵
  PID:4948
- C:\Windows\System\BVxpsqC.exe
  C:\Windows\System\BVxpsqC.exe
  2⤵
  PID:4964
- C:\Windows\System\yKSUiYu.exe
  C:\Windows\System\yKSUiYu.exe
  2⤵
  PID:4980
- C:\Windows\System\qtXPcQV.exe
  C:\Windows\System\qtXPcQV.exe
  2⤵
  PID:4996
- C:\Windows\System\ZZjGZSm.exe
  C:\Windows\System\ZZjGZSm.exe
  2⤵
  PID:5016
- C:\Windows\System\lBbNjUI.exe
  C:\Windows\System\lBbNjUI.exe
  2⤵
  PID:5032
- C:\Windows\System\qlYrkxC.exe
  C:\Windows\System\qlYrkxC.exe
  2⤵
  PID:5048
- C:\Windows\System\pxHsYpJ.exe
  C:\Windows\System\pxHsYpJ.exe
  2⤵
  PID:5068
- C:\Windows\System\LTuEWtF.exe
  C:\Windows\System\LTuEWtF.exe
  2⤵
  PID:5084
- C:\Windows\System\qRrltzZ.exe
  C:\Windows\System\qRrltzZ.exe
  2⤵
  PID:5100
- C:\Windows\System\Buevwdc.exe
  C:\Windows\System\Buevwdc.exe
  2⤵
  PID:5116
- C:\Windows\System\owdttHW.exe
  C:\Windows\System\owdttHW.exe
  2⤵
  PID:3868
- C:\Windows\System\CQTUuos.exe
  C:\Windows\System\CQTUuos.exe
  2⤵
  PID:4140
- C:\Windows\System\rmrBSBE.exe
  C:\Windows\System\rmrBSBE.exe
  2⤵
  PID:3884
- C:\Windows\System\WRPudlR.exe
  C:\Windows\System\WRPudlR.exe
  2⤵
  PID:4124
- C:\Windows\System\dOSmeoC.exe
  C:\Windows\System\dOSmeoC.exe
  2⤵
  PID:4176
- C:\Windows\System\ivLrpIE.exe
  C:\Windows\System\ivLrpIE.exe
  2⤵
  PID:4256
- C:\Windows\System\oIuuIsQ.exe
  C:\Windows\System\oIuuIsQ.exe
  2⤵
  PID:4236
- C:\Windows\System\bueCwgQ.exe
  C:\Windows\System\bueCwgQ.exe
  2⤵
  PID:4276
- C:\Windows\System\ENjTcXp.exe
  C:\Windows\System\ENjTcXp.exe
  2⤵
  PID:4308
- C:\Windows\System\VwYApHv.exe
  C:\Windows\System\VwYApHv.exe
  2⤵
  PID:4356
- C:\Windows\System\cuaFhmb.exe
  C:\Windows\System\cuaFhmb.exe
  2⤵
  PID:4336
- C:\Windows\System\CEGSCCu.exe
  C:\Windows\System\CEGSCCu.exe
  2⤵
  PID:4424
- C:\Windows\System\aTgEFrx.exe
  C:\Windows\System\aTgEFrx.exe
  2⤵
  PID:4488
- C:\Windows\System\jrInxkb.exe
  C:\Windows\System\jrInxkb.exe
  2⤵
  PID:4404
- C:\Windows\System\KTInwIt.exe
  C:\Windows\System\KTInwIt.exe
  2⤵
  PID:4472
- C:\Windows\System\SDhskUW.exe
  C:\Windows\System\SDhskUW.exe
  2⤵
  PID:4524
- C:\Windows\System\NugoZNT.exe
  C:\Windows\System\NugoZNT.exe
  2⤵
  PID:4592
- C:\Windows\System\QVHpEvr.exe
  C:\Windows\System\QVHpEvr.exe
  2⤵
  PID:4576
- C:\Windows\System\lphjKdA.exe
  C:\Windows\System\lphjKdA.exe
  2⤵
  PID:4616
- C:\Windows\System\nHYpJEJ.exe
  C:\Windows\System\nHYpJEJ.exe
  2⤵
  PID:4664
- C:\Windows\System\gDxPuoi.exe
  C:\Windows\System\gDxPuoi.exe
  2⤵
  PID:4680
- C:\Windows\System\KQUXdrc.exe
  C:\Windows\System\KQUXdrc.exe
  2⤵
  PID:4708
- C:\Windows\System\UCMQLZl.exe
  C:\Windows\System\UCMQLZl.exe
  2⤵
  PID:4772
- C:\Windows\System\eOkMIHr.exe
  C:\Windows\System\eOkMIHr.exe
  2⤵
  PID:4816
- C:\Windows\System\YVpyDpe.exe
  C:\Windows\System\YVpyDpe.exe
  2⤵
  PID:4848
- C:\Windows\System\drIOOue.exe
  C:\Windows\System\drIOOue.exe
  2⤵
  PID:4832
- C:\Windows\System\VOEMcGo.exe
  C:\Windows\System\VOEMcGo.exe
  2⤵
  PID:4880
- C:\Windows\System\NhLxQBC.exe
  C:\Windows\System\NhLxQBC.exe
  2⤵
  PID:4912
- C:\Windows\System\zTenpXW.exe
  C:\Windows\System\zTenpXW.exe
  2⤵
  PID:4972
- C:\Windows\System\PPiLwUN.exe
  C:\Windows\System\PPiLwUN.exe
  2⤵
  PID:5012
- C:\Windows\System\rWypAqE.exe
  C:\Windows\System\rWypAqE.exe
  2⤵
  PID:4988
- C:\Windows\System\kqGPLYR.exe
  C:\Windows\System\kqGPLYR.exe
  2⤵
  PID:5028
- C:\Windows\System\lqVziZA.exe
  C:\Windows\System\lqVziZA.exe
  2⤵
  PID:5096
- C:\Windows\System\rBVBugr.exe
  C:\Windows\System\rBVBugr.exe
  2⤵
  PID:4956
- C:\Windows\System\sTRuVCD.exe
  C:\Windows\System\sTRuVCD.exe
  2⤵
  PID:5108
- C:\Windows\System\JrMSjFD.exe
  C:\Windows\System\JrMSjFD.exe
  2⤵
  PID:5112
- C:\Windows\System\CoeZMjf.exe
  C:\Windows\System\CoeZMjf.exe
  2⤵
  PID:3092
- C:\Windows\System\DAqbnab.exe
  C:\Windows\System\DAqbnab.exe
  2⤵
  PID:4208
- C:\Windows\System\hhayKtL.exe
  C:\Windows\System\hhayKtL.exe
  2⤵
  PID:4188
- C:\Windows\System\RFAbULG.exe
  C:\Windows\System\RFAbULG.exe
  2⤵
  PID:4372
- C:\Windows\System\fqQAmMR.exe
  C:\Windows\System\fqQAmMR.exe
  2⤵
  PID:4292
- C:\Windows\System\mjGiOJd.exe
  C:\Windows\System\mjGiOJd.exe
  2⤵
  PID:4408
- C:\Windows\System\GvjPjBW.exe
  C:\Windows\System\GvjPjBW.exe
  2⤵
  PID:4484
- C:\Windows\System\MdTByUr.exe
  C:\Windows\System\MdTByUr.exe
  2⤵
  PID:4572
- C:\Windows\System\TisDIBf.exe
  C:\Windows\System\TisDIBf.exe
  2⤵
  PID:4724
- C:\Windows\System\JtwhqiA.exe
  C:\Windows\System\JtwhqiA.exe
  2⤵
  PID:4744
- C:\Windows\System\IePhOVA.exe
  C:\Windows\System\IePhOVA.exe
  2⤵
  PID:4696
- C:\Windows\System\IzUDQcn.exe
  C:\Windows\System\IzUDQcn.exe
  2⤵
  PID:5008
- C:\Windows\System\iyhkISz.exe
  C:\Windows\System\iyhkISz.exe
  2⤵
  PID:3712
- C:\Windows\System\sjVZRKi.exe
  C:\Windows\System\sjVZRKi.exe
  2⤵
  PID:4272
- C:\Windows\System\ftvCrDT.exe
  C:\Windows\System\ftvCrDT.exe
  2⤵
  PID:4644
- C:\Windows\System\denztGu.exe
  C:\Windows\System\denztGu.exe
  2⤵
  PID:4740
- C:\Windows\System\GNKcDEo.exe
  C:\Windows\System\GNKcDEo.exe
  2⤵
  PID:4796
- C:\Windows\System\JuEcfTM.exe
  C:\Windows\System\JuEcfTM.exe
  2⤵
  PID:4104
- C:\Windows\System\aSnnIXE.exe
  C:\Windows\System\aSnnIXE.exe
  2⤵
  PID:3432
- C:\Windows\System\qTpuoRk.exe
  C:\Windows\System\qTpuoRk.exe
  2⤵
  PID:4368
- C:\Windows\System\tlvpRFX.exe
  C:\Windows\System\tlvpRFX.exe
  2⤵
  PID:4468
- C:\Windows\System\zHNUbvI.exe
  C:\Windows\System\zHNUbvI.exe
  2⤵
  PID:5004
- C:\Windows\System\hKHGBZd.exe
  C:\Windows\System\hKHGBZd.exe
  2⤵
  PID:4440
- C:\Windows\System\oKUMjws.exe
  C:\Windows\System\oKUMjws.exe
  2⤵
  PID:5056
- C:\Windows\System\cdDmTcC.exe
  C:\Windows\System\cdDmTcC.exe
  2⤵
  PID:4612
- C:\Windows\System\PinMPvf.exe
  C:\Windows\System\PinMPvf.exe
  2⤵
  PID:4756
- C:\Windows\System\wFkQMNh.exe
  C:\Windows\System\wFkQMNh.exe
  2⤵
  PID:4876
- C:\Windows\System\kJrfcpt.exe
  C:\Windows\System\kJrfcpt.exe
  2⤵
  PID:4160
- C:\Windows\System\KxJaArA.exe
  C:\Windows\System\KxJaArA.exe
  2⤵
  PID:4352
- C:\Windows\System\MKUqqXs.exe
  C:\Windows\System\MKUqqXs.exe
  2⤵
  PID:3596
- C:\Windows\System\xyXBYpC.exe
  C:\Windows\System\xyXBYpC.exe
  2⤵
  PID:4556
- C:\Windows\System\uBREUUy.exe
  C:\Windows\System\uBREUUy.exe
  2⤵
  PID:4844
- C:\Windows\System\lKlsEVT.exe
  C:\Windows\System\lKlsEVT.exe
  2⤵
  PID:4384
- C:\Windows\System\qHYmjZW.exe
  C:\Windows\System\qHYmjZW.exe
  2⤵
  PID:5076
- C:\Windows\System\JcyrNGU.exe
  C:\Windows\System\JcyrNGU.exe
  2⤵
  PID:4632
- C:\Windows\System\SGDkLfZ.exe
  C:\Windows\System\SGDkLfZ.exe
  2⤵
  PID:4500
- C:\Windows\System\fZrrthX.exe
  C:\Windows\System\fZrrthX.exe
  2⤵
  PID:5136
- C:\Windows\System\jlPtMKC.exe
  C:\Windows\System\jlPtMKC.exe
  2⤵
  PID:5152
- C:\Windows\System\rFPZvsh.exe
  C:\Windows\System\rFPZvsh.exe
  2⤵
  PID:5168
- C:\Windows\System\jpqvEPV.exe
  C:\Windows\System\jpqvEPV.exe
  2⤵
  PID:5184
- C:\Windows\System\qTGMdmh.exe
  C:\Windows\System\qTGMdmh.exe
  2⤵
  PID:5200
- C:\Windows\System\xQUzTwI.exe
  C:\Windows\System\xQUzTwI.exe
  2⤵
  PID:5216
- C:\Windows\System\VhOowBf.exe
  C:\Windows\System\VhOowBf.exe
  2⤵
  PID:5232
- C:\Windows\System\UsTHXFw.exe
  C:\Windows\System\UsTHXFw.exe
  2⤵
  PID:5248
- C:\Windows\System\kZVYNmD.exe
  C:\Windows\System\kZVYNmD.exe
  2⤵
  PID:5268
- C:\Windows\System\bnaIKJW.exe
  C:\Windows\System\bnaIKJW.exe
  2⤵
  PID:5288
- C:\Windows\System\FagBvNN.exe
  C:\Windows\System\FagBvNN.exe
  2⤵
  PID:5308
- C:\Windows\System\oGJziMm.exe
  C:\Windows\System\oGJziMm.exe
  2⤵
  PID:5324
- C:\Windows\System\rwIrfFa.exe
  C:\Windows\System\rwIrfFa.exe
  2⤵
  PID:5344
- C:\Windows\System\kgZDKXO.exe
  C:\Windows\System\kgZDKXO.exe
  2⤵
  PID:5360
- C:\Windows\System\JNQVrSe.exe
  C:\Windows\System\JNQVrSe.exe
  2⤵
  PID:5376
- C:\Windows\System\IsAoSSE.exe
  C:\Windows\System\IsAoSSE.exe
  2⤵
  PID:5396
- C:\Windows\System\RRtoXQA.exe
  C:\Windows\System\RRtoXQA.exe
  2⤵
  PID:5412
- C:\Windows\System\xhWwXZW.exe
  C:\Windows\System\xhWwXZW.exe
  2⤵
  PID:5432
- C:\Windows\System\hSrRoqt.exe
  C:\Windows\System\hSrRoqt.exe
  2⤵
  PID:5448
- C:\Windows\System\DYVgvOA.exe
  C:\Windows\System\DYVgvOA.exe
  2⤵
  PID:5464
- C:\Windows\System\eastNzv.exe
  C:\Windows\System\eastNzv.exe
  2⤵
  PID:5480
- C:\Windows\System\kKvcXTj.exe
  C:\Windows\System\kKvcXTj.exe
  2⤵
  PID:5496
- C:\Windows\System\DzrqeJZ.exe
  C:\Windows\System\DzrqeJZ.exe
  2⤵
  PID:5512
- C:\Windows\System\rcdHwoW.exe
  C:\Windows\System\rcdHwoW.exe
  2⤵
  PID:5528
- C:\Windows\System\DlOPhBB.exe
  C:\Windows\System\DlOPhBB.exe
  2⤵
  PID:5548
- C:\Windows\System\BCsSwzs.exe
  C:\Windows\System\BCsSwzs.exe
  2⤵
  PID:5568
- C:\Windows\System\IfeXXxW.exe
  C:\Windows\System\IfeXXxW.exe
  2⤵
  PID:5588
- C:\Windows\System\SXelRNt.exe
  C:\Windows\System\SXelRNt.exe
  2⤵
  PID:5604
- C:\Windows\System\ltGRuKx.exe
  C:\Windows\System\ltGRuKx.exe
  2⤵
  PID:5620
- C:\Windows\System\qCpxeiY.exe
  C:\Windows\System\qCpxeiY.exe
  2⤵
  PID:5636
- C:\Windows\System\WfrBTaf.exe
  C:\Windows\System\WfrBTaf.exe
  2⤵
  PID:5652
- C:\Windows\System\TimPqwE.exe
  C:\Windows\System\TimPqwE.exe
  2⤵
  PID:5668
- C:\Windows\System\znoQWOQ.exe
  C:\Windows\System\znoQWOQ.exe
  2⤵
  PID:5684
- C:\Windows\System\ugvIYLX.exe
  C:\Windows\System\ugvIYLX.exe
  2⤵
  PID:5700
- C:\Windows\System\axSqCjQ.exe
  C:\Windows\System\axSqCjQ.exe
  2⤵
  PID:5716
- C:\Windows\System\AYUtoTx.exe
  C:\Windows\System\AYUtoTx.exe
  2⤵
  PID:5736
- C:\Windows\System\fZUuiHO.exe
  C:\Windows\System\fZUuiHO.exe
  2⤵
  PID:5756
- C:\Windows\System\wLHBzPy.exe
  C:\Windows\System\wLHBzPy.exe
  2⤵
  PID:5772
- C:\Windows\System\QAYWcQO.exe
  C:\Windows\System\QAYWcQO.exe
  2⤵
  PID:5788
- C:\Windows\System\GHMCFKZ.exe
  C:\Windows\System\GHMCFKZ.exe
  2⤵
  PID:5804
- C:\Windows\System\sTgfIyW.exe
  C:\Windows\System\sTgfIyW.exe
  2⤵
  PID:5820
- C:\Windows\System\XojINke.exe
  C:\Windows\System\XojINke.exe
  2⤵
  PID:5836
- C:\Windows\System\lDghceH.exe
  C:\Windows\System\lDghceH.exe
  2⤵
  PID:5852
- C:\Windows\System\QBYBoHY.exe
  C:\Windows\System\QBYBoHY.exe
  2⤵
  PID:5868
- C:\Windows\System\LjSiPje.exe
  C:\Windows\System\LjSiPje.exe
  2⤵
  PID:5884
- C:\Windows\System\PQXLtOm.exe
  C:\Windows\System\PQXLtOm.exe
  2⤵
  PID:5900
- C:\Windows\System\FMFyErn.exe
  C:\Windows\System\FMFyErn.exe
  2⤵
  PID:5916
- C:\Windows\System\uSpwBan.exe
  C:\Windows\System\uSpwBan.exe
  2⤵
  PID:5932
- C:\Windows\System\zNKYLZt.exe
  C:\Windows\System\zNKYLZt.exe
  2⤵
  PID:5948
- C:\Windows\System\KmJgrVp.exe
  C:\Windows\System\KmJgrVp.exe
  2⤵
  PID:5964
- C:\Windows\System\RlEbvyO.exe
  C:\Windows\System\RlEbvyO.exe
  2⤵
  PID:5984
- C:\Windows\System\VTzavot.exe
  C:\Windows\System\VTzavot.exe
  2⤵
  PID:6000
- C:\Windows\System\IGsUwgV.exe
  C:\Windows\System\IGsUwgV.exe
  2⤵
  PID:6016
- C:\Windows\System\CVwqwES.exe
  C:\Windows\System\CVwqwES.exe
  2⤵
  PID:6032
- C:\Windows\System\eyntthH.exe
  C:\Windows\System\eyntthH.exe
  2⤵
  PID:6048
- C:\Windows\System\zCtXmpq.exe
  C:\Windows\System\zCtXmpq.exe
  2⤵
  PID:6064
- C:\Windows\System\oicdTpH.exe
  C:\Windows\System\oicdTpH.exe
  2⤵
  PID:6084
- C:\Windows\System\CpiuFed.exe
  C:\Windows\System\CpiuFed.exe
  2⤵
  PID:6100
- C:\Windows\System\bnhcmCz.exe
  C:\Windows\System\bnhcmCz.exe
  2⤵
  PID:6116
- C:\Windows\System\VZiHUZt.exe
  C:\Windows\System\VZiHUZt.exe
  2⤵
  PID:6132
- C:\Windows\System\KMiGKub.exe
  C:\Windows\System\KMiGKub.exe
  2⤵
  PID:5160
- C:\Windows\System\cLlPiYy.exe
  C:\Windows\System\cLlPiYy.exe
  2⤵
  PID:5164
- C:\Windows\System\CXqEmyW.exe
  C:\Windows\System\CXqEmyW.exe
  2⤵
  PID:5260
- C:\Windows\System\XZdJsyN.exe
  C:\Windows\System\XZdJsyN.exe
  2⤵
  PID:5212
- C:\Windows\System\UqrPrMs.exe
  C:\Windows\System\UqrPrMs.exe
  2⤵
  PID:5180
- C:\Windows\System\KEktmWa.exe
  C:\Windows\System\KEktmWa.exe
  2⤵
  PID:5284
- C:\Windows\System\rLwVQJe.exe
  C:\Windows\System\rLwVQJe.exe
  2⤵
  PID:5300
- C:\Windows\System\PmRKzuB.exe
  C:\Windows\System\PmRKzuB.exe
  2⤵
  PID:5428
- C:\Windows\System\CFmGFAL.exe
  C:\Windows\System\CFmGFAL.exe
  2⤵
  PID:5404
- C:\Windows\System\uirbyqr.exe
  C:\Windows\System\uirbyqr.exe
  2⤵
  PID:5472
- C:\Windows\System\hvmycBW.exe
  C:\Windows\System\hvmycBW.exe
  2⤵
  PID:5520
- C:\Windows\System\PsempCW.exe
  C:\Windows\System\PsempCW.exe
  2⤵
  PID:5560
- C:\Windows\System\iAPsatx.exe
  C:\Windows\System\iAPsatx.exe
  2⤵
  PID:5632
- C:\Windows\System\SfflWLd.exe
  C:\Windows\System\SfflWLd.exe
  2⤵
  PID:5540
- C:\Windows\System\eFWqvWH.exe
  C:\Windows\System\eFWqvWH.exe
  2⤵
  PID:5536
- C:\Windows\System\IVtVvfc.exe
  C:\Windows\System\IVtVvfc.exe
  2⤵
  PID:5664
- C:\Windows\System\iwAzLmi.exe
  C:\Windows\System\iwAzLmi.exe
  2⤵
  PID:5696
- C:\Windows\System\RtOEshf.exe
  C:\Windows\System\RtOEshf.exe
  2⤵
  PID:5764
- C:\Windows\System\ARETrFk.exe
  C:\Windows\System\ARETrFk.exe
  2⤵
  PID:5708
- C:\Windows\System\OEpjWNU.exe
  C:\Windows\System\OEpjWNU.exe
  2⤵
  PID:5800
- C:\Windows\System\bposqNM.exe
  C:\Windows\System\bposqNM.exe
  2⤵
  PID:5892
- C:\Windows\System\SxDqPtt.exe
  C:\Windows\System\SxDqPtt.exe
  2⤵
  PID:5956
- C:\Windows\System\CcnBWrN.exe
  C:\Windows\System\CcnBWrN.exe
  2⤵
  PID:5848
- C:\Windows\System\nbmlbSH.exe
  C:\Windows\System\nbmlbSH.exe
  2⤵
  PID:5944
- C:\Windows\System\WjsSUWO.exe
  C:\Windows\System\WjsSUWO.exe
  2⤵
  PID:5976
- C:\Windows\System\ZxDiWtP.exe
  C:\Windows\System\ZxDiWtP.exe
  2⤵
  PID:6056
- C:\Windows\System\NoaXcqU.exe
  C:\Windows\System\NoaXcqU.exe
  2⤵
  PID:6128
- C:\Windows\System\DAXSgYj.exe
  C:\Windows\System\DAXSgYj.exe
  2⤵
  PID:6140
- C:\Windows\System\EEzsluz.exe
  C:\Windows\System\EEzsluz.exe
  2⤵
  PID:6044
- C:\Windows\System\sYlzASb.exe
  C:\Windows\System\sYlzASb.exe
  2⤵
  PID:5224
- C:\Windows\System\dSdswvN.exe
  C:\Windows\System\dSdswvN.exe
  2⤵
  PID:5256
- C:\Windows\System\mHDpyzx.exe
  C:\Windows\System\mHDpyzx.exe
  2⤵
  PID:5368
- C:\Windows\System\oIwYLtD.exe
  C:\Windows\System\oIwYLtD.exe
  2⤵
  PID:5340
- C:\Windows\System\EUABtAb.exe
  C:\Windows\System\EUABtAb.exe
  2⤵
  PID:5460
- C:\Windows\System\lxpVBiT.exe
  C:\Windows\System\lxpVBiT.exe
  2⤵
  PID:5596
- C:\Windows\System\uWFuzhD.exe
  C:\Windows\System\uWFuzhD.exe
  2⤵
  PID:5508
- C:\Windows\System\KrMEWXm.exe
  C:\Windows\System\KrMEWXm.exe
  2⤵
  PID:5692
- C:\Windows\System\rUpqhgo.exe
  C:\Windows\System\rUpqhgo.exe
  2⤵
  PID:5356
- C:\Windows\System\WOGZRoh.exe
  C:\Windows\System\WOGZRoh.exe
  2⤵
  PID:5816
- C:\Windows\System\bXROHBh.exe
  C:\Windows\System\bXROHBh.exe
  2⤵
  PID:5580
- C:\Windows\System\wjyAimB.exe
  C:\Windows\System\wjyAimB.exe
  2⤵
  PID:5972
- C:\Windows\System\uFDOpjp.exe
  C:\Windows\System\uFDOpjp.exe
  2⤵
  PID:6024
- C:\Windows\System\uGdxnAT.exe
  C:\Windows\System\uGdxnAT.exe
  2⤵
  PID:5908
- C:\Windows\System\piuYwHG.exe
  C:\Windows\System\piuYwHG.exe
  2⤵
  PID:6012
- C:\Windows\System\tQwexUH.exe
  C:\Windows\System\tQwexUH.exe
  2⤵
  PID:6080
- C:\Windows\System\vkqhyOo.exe
  C:\Windows\System\vkqhyOo.exe
  2⤵
  PID:6008
- C:\Windows\System\IziPDoV.exe
  C:\Windows\System\IziPDoV.exe
  2⤵
  PID:5332
- C:\Windows\System\xowAUHC.exe
  C:\Windows\System\xowAUHC.exe
  2⤵
  PID:5320
- C:\Windows\System\onfXzyo.exe
  C:\Windows\System\onfXzyo.exe
  2⤵
  PID:5148
- C:\Windows\System\PqeyfvR.exe
  C:\Windows\System\PqeyfvR.exe
  2⤵
  PID:5384
- C:\Windows\System\EFKjpkJ.exe
  C:\Windows\System\EFKjpkJ.exe
  2⤵
  PID:5844
- C:\Windows\System\XPggozh.exe
  C:\Windows\System\XPggozh.exe
  2⤵
  PID:5648
- C:\Windows\System\PBZQFru.exe
  C:\Windows\System\PBZQFru.exe
  2⤵
  PID:5896
- C:\Windows\System\KveHfWy.exe
  C:\Windows\System\KveHfWy.exe
  2⤵
  PID:4924
- C:\Windows\System\SWjamnG.exe
  C:\Windows\System\SWjamnG.exe
  2⤵
  PID:5144
- C:\Windows\System\NAuhDXW.exe
  C:\Windows\System\NAuhDXW.exe
  2⤵
  PID:5372
- C:\Windows\System\YeSExDB.exe
  C:\Windows\System\YeSExDB.exe
  2⤵
  PID:5928
- C:\Windows\System\YAwZJHD.exe
  C:\Windows\System\YAwZJHD.exe
  2⤵
  PID:5876
- C:\Windows\System\FzfPBnz.exe
  C:\Windows\System\FzfPBnz.exe
  2⤵
  PID:5628
- C:\Windows\System\fdGKnyi.exe
  C:\Windows\System\fdGKnyi.exe
  2⤵
  PID:5864
- C:\Windows\System\PrbwzOk.exe
  C:\Windows\System\PrbwzOk.exe
  2⤵
  PID:4420
- C:\Windows\System\yviKPpw.exe
  C:\Windows\System\yviKPpw.exe
  2⤵
  PID:5280
- C:\Windows\System\OLBSOCc.exe
  C:\Windows\System\OLBSOCc.exe
  2⤵
  PID:6096
- C:\Windows\System\aZzgcsl.exe
  C:\Windows\System\aZzgcsl.exe
  2⤵
  PID:6160
- C:\Windows\System\wsojuLG.exe
  C:\Windows\System\wsojuLG.exe
  2⤵
  PID:6176
- C:\Windows\System\hYCZqaj.exe
  C:\Windows\System\hYCZqaj.exe
  2⤵
  PID:6192
- C:\Windows\System\oPhXwoe.exe
  C:\Windows\System\oPhXwoe.exe
  2⤵
  PID:6224
- C:\Windows\System\MSROtmF.exe
  C:\Windows\System\MSROtmF.exe
  2⤵
  PID:6240
- C:\Windows\System\czvQJGi.exe
  C:\Windows\System\czvQJGi.exe
  2⤵
  PID:6256
- C:\Windows\System\ixrUWFd.exe
  C:\Windows\System\ixrUWFd.exe
  2⤵
  PID:6308
- C:\Windows\System\LWYfYLT.exe
  C:\Windows\System\LWYfYLT.exe
  2⤵
  PID:6324
- C:\Windows\System\pbQBSHz.exe
  C:\Windows\System\pbQBSHz.exe
  2⤵
  PID:6340
- C:\Windows\System\MiTEeDC.exe
  C:\Windows\System\MiTEeDC.exe
  2⤵
  PID:6356
- C:\Windows\System\Noqpmms.exe
  C:\Windows\System\Noqpmms.exe
  2⤵
  PID:6372
- C:\Windows\System\dNTdhPz.exe
  C:\Windows\System\dNTdhPz.exe
  2⤵
  PID:6388
- C:\Windows\System\euiQKED.exe
  C:\Windows\System\euiQKED.exe
  2⤵
  PID:6404
- C:\Windows\System\OrPCLiY.exe
  C:\Windows\System\OrPCLiY.exe
  2⤵
  PID:6420
- C:\Windows\System\raVGdps.exe
  C:\Windows\System\raVGdps.exe
  2⤵
  PID:6436
- C:\Windows\System\bmACmaX.exe
  C:\Windows\System\bmACmaX.exe
  2⤵
  PID:6452
- C:\Windows\System\XNlhKzX.exe
  C:\Windows\System\XNlhKzX.exe
  2⤵
  PID:6624
- C:\Windows\System\JZCOWvO.exe
  C:\Windows\System\JZCOWvO.exe
  2⤵
  PID:6640
- C:\Windows\System\FRmqTlx.exe
  C:\Windows\System\FRmqTlx.exe
  2⤵
  PID:6656
- C:\Windows\System\thzGhuB.exe
  C:\Windows\System\thzGhuB.exe
  2⤵
  PID:6680
- C:\Windows\System\VmwOhoE.exe
  C:\Windows\System\VmwOhoE.exe
  2⤵
  PID:6696
- C:\Windows\System\BtiAzoZ.exe
  C:\Windows\System\BtiAzoZ.exe
  2⤵
  PID:6712
- C:\Windows\System\YQlrmQI.exe
  C:\Windows\System\YQlrmQI.exe
  2⤵
  PID:6768
- C:\Windows\System\TcFgLAx.exe
  C:\Windows\System\TcFgLAx.exe
  2⤵
  PID:6784
- C:\Windows\System\WSKaQHP.exe
  C:\Windows\System\WSKaQHP.exe
  2⤵
  PID:6800
- C:\Windows\System\auWuSSm.exe
  C:\Windows\System\auWuSSm.exe
  2⤵
  PID:6820
- C:\Windows\System\jQHVuhh.exe
  C:\Windows\System\jQHVuhh.exe
  2⤵
  PID:6836
- C:\Windows\System\WFeGLxJ.exe
  C:\Windows\System\WFeGLxJ.exe
  2⤵
  PID:6852
- C:\Windows\System\EqqZvNj.exe
  C:\Windows\System\EqqZvNj.exe
  2⤵
  PID:6872
- C:\Windows\System\HfYepSD.exe
  C:\Windows\System\HfYepSD.exe
  2⤵
  PID:6888
- C:\Windows\System\rpcKWGv.exe
  C:\Windows\System\rpcKWGv.exe
  2⤵
  PID:6956
- C:\Windows\System\SXtzvGb.exe
  C:\Windows\System\SXtzvGb.exe
  2⤵
  PID:6972
- C:\Windows\System\gjUStLa.exe
  C:\Windows\System\gjUStLa.exe
  2⤵
  PID:6988
- C:\Windows\System\kdLnKoh.exe
  C:\Windows\System\kdLnKoh.exe
  2⤵
  PID:7004
- C:\Windows\System\IyWNJJz.exe
  C:\Windows\System\IyWNJJz.exe
  2⤵
  PID:7024
- C:\Windows\System\zKiXsni.exe
  C:\Windows\System\zKiXsni.exe
  2⤵
  PID:7040
- C:\Windows\System\dwpwCvs.exe
  C:\Windows\System\dwpwCvs.exe
  2⤵
  PID:7056
- C:\Windows\System\ncTOSxI.exe
  C:\Windows\System\ncTOSxI.exe
  2⤵
  PID:7076
- C:\Windows\System\VSEHAGZ.exe
  C:\Windows\System\VSEHAGZ.exe
  2⤵
  PID:7092
- C:\Windows\System\GZVfNyq.exe
  C:\Windows\System\GZVfNyq.exe
  2⤵
  PID:7108
- C:\Windows\System\gCBbPSO.exe
  C:\Windows\System\gCBbPSO.exe
  2⤵
  PID:7124
- C:\Windows\System\iqihhZv.exe
  C:\Windows\System\iqihhZv.exe
  2⤵
  PID:7160
- C:\Windows\System\SMWNTQv.exe
  C:\Windows\System\SMWNTQv.exe
  2⤵
  PID:5812
- C:\Windows\System\LMNJuzJ.exe
  C:\Windows\System\LMNJuzJ.exe
  2⤵
  PID:6172
- C:\Windows\System\VvWxaJP.exe
  C:\Windows\System\VvWxaJP.exe
  2⤵
  PID:6200
- C:\Windows\System\VVqSPIJ.exe
  C:\Windows\System\VVqSPIJ.exe
  2⤵
  PID:6264
- C:\Windows\System\ARnZXBv.exe
  C:\Windows\System\ARnZXBv.exe
  2⤵
  PID:6272
- C:\Windows\System\XWtRlzk.exe
  C:\Windows\System\XWtRlzk.exe
  2⤵
  PID:6232
- C:\Windows\System\hLQURkv.exe
  C:\Windows\System\hLQURkv.exe
  2⤵
  PID:6284
- C:\Windows\System\OGOngNp.exe
  C:\Windows\System\OGOngNp.exe
  2⤵
  PID:6252
- C:\Windows\System\SdAjOOO.exe
  C:\Windows\System\SdAjOOO.exe
  2⤵
  PID:6384
- C:\Windows\System\VTfQmgs.exe
  C:\Windows\System\VTfQmgs.exe
  2⤵
  PID:6396
- C:\Windows\System\IWsAuUT.exe
  C:\Windows\System\IWsAuUT.exe
  2⤵
  PID:6472
- C:\Windows\System\KNvlQvM.exe
  C:\Windows\System\KNvlQvM.exe
  2⤵
  PID:6496
- C:\Windows\System\qztaNAr.exe
  C:\Windows\System\qztaNAr.exe
  2⤵
  PID:6540
- C:\Windows\System\kVwJdvO.exe
  C:\Windows\System\kVwJdvO.exe
  2⤵
  PID:6572
- C:\Windows\System\fFAlMjO.exe
  C:\Windows\System\fFAlMjO.exe
  2⤵
  PID:6632
- C:\Windows\System\hQqAoTw.exe
  C:\Windows\System\hQqAoTw.exe
  2⤵
  PID:6676
- C:\Windows\System\cfEAfQq.exe
  C:\Windows\System\cfEAfQq.exe
  2⤵
  PID:6596
- C:\Windows\System\AUCGvkx.exe
  C:\Windows\System\AUCGvkx.exe
  2⤵
  PID:6748
- C:\Windows\System\kXzYvGq.exe
  C:\Windows\System\kXzYvGq.exe
  2⤵
  PID:6608
- C:\Windows\System\CEGtkRH.exe
  C:\Windows\System\CEGtkRH.exe
  2⤵
  PID:6648
- C:\Windows\System\BHfePxI.exe
  C:\Windows\System\BHfePxI.exe
  2⤵
  PID:6736
- C:\Windows\System\Sxebkbg.exe
  C:\Windows\System\Sxebkbg.exe
  2⤵
  PID:6760
- C:\Windows\System\WaAZVZP.exe
  C:\Windows\System\WaAZVZP.exe
  2⤵
  PID:6724
- C:\Windows\System\WGFToIW.exe
  C:\Windows\System\WGFToIW.exe
  2⤵
  PID:6896
- C:\Windows\System\NoqEmdT.exe
  C:\Windows\System\NoqEmdT.exe
  2⤵
  PID:6916
- C:\Windows\System\OLQvrxb.exe
  C:\Windows\System\OLQvrxb.exe
  2⤵
  PID:6796
- C:\Windows\System\JMyVbpN.exe
  C:\Windows\System\JMyVbpN.exe
  2⤵
  PID:6936
- C:\Windows\System\ioSbAdd.exe
  C:\Windows\System\ioSbAdd.exe
  2⤵
  PID:7144
- C:\Windows\System\qsAqMZL.exe
  C:\Windows\System\qsAqMZL.exe
  2⤵
  PID:6980
- C:\Windows\System\YcRweZE.exe
  C:\Windows\System\YcRweZE.exe
  2⤵
  PID:7020
- C:\Windows\System\uIGJCaT.exe
  C:\Windows\System\uIGJCaT.exe
  2⤵
  PID:6812
- C:\Windows\System\WspMPmU.exe
  C:\Windows\System\WspMPmU.exe
  2⤵
  PID:6964
- C:\Windows\System\WXNEGNG.exe
  C:\Windows\System\WXNEGNG.exe
  2⤵
  PID:7032
- C:\Windows\System\LDrRuvW.exe
  C:\Windows\System\LDrRuvW.exe
  2⤵
  PID:7072
- C:\Windows\System\yJUctFM.exe
  C:\Windows\System\yJUctFM.exe
  2⤵
  PID:7136
- C:\Windows\System\NqsZxZt.exe
  C:\Windows\System\NqsZxZt.exe
  2⤵
  PID:7084
- C:\Windows\System\wCZOjYm.exe
  C:\Windows\System\wCZOjYm.exe
  2⤵
  PID:6364
- C:\Windows\System\FpFhvjM.exe
  C:\Windows\System\FpFhvjM.exe
  2⤵
  PID:6352
- C:\Windows\System\UsYGNWV.exe
  C:\Windows\System\UsYGNWV.exe
  2⤵
  PID:7152
- C:\Windows\System\WVuvTgp.exe
  C:\Windows\System\WVuvTgp.exe
  2⤵
  PID:5724
- C:\Windows\System\jRyieXA.exe
  C:\Windows\System\jRyieXA.exe
  2⤵
  PID:6288
- C:\Windows\System\JlOGOIy.exe
  C:\Windows\System\JlOGOIy.exe
  2⤵
  PID:6248
- C:\Windows\System\RSxbOMA.exe
  C:\Windows\System\RSxbOMA.exe
  2⤵
  PID:6488
- C:\Windows\System\xFACwJE.exe
  C:\Windows\System\xFACwJE.exe
  2⤵
  PID:6752
- C:\Windows\System\mYFDDcK.exe
  C:\Windows\System\mYFDDcK.exe
  2⤵
  PID:6848
- C:\Windows\System\RWEmHtg.exe
  C:\Windows\System\RWEmHtg.exe
  2⤵
  PID:7064
- C:\Windows\System\MJjdVPK.exe
  C:\Windows\System\MJjdVPK.exe
  2⤵
  PID:6780
- C:\Windows\System\zbJemaE.exe
  C:\Windows\System\zbJemaE.exe
  2⤵
  PID:7116
- C:\Windows\System\VUDSSDl.exe
  C:\Windows\System\VUDSSDl.exe
  2⤵
  PID:6508
- C:\Windows\System\GOpNnbj.exe
  C:\Windows\System\GOpNnbj.exe
  2⤵
  PID:6280
- C:\Windows\System\BCqSAWD.exe
  C:\Windows\System\BCqSAWD.exe
  2⤵
  PID:6664
- C:\Windows\System\IiFZCfs.exe
  C:\Windows\System\IiFZCfs.exe
  2⤵
  PID:6864
- C:\Windows\System\oJIVAtG.exe
  C:\Windows\System\oJIVAtG.exe
  2⤵
  PID:7016
- C:\Windows\System\IFjGBxG.exe
  C:\Windows\System\IFjGBxG.exe
  2⤵
  PID:6868
- C:\Windows\System\tkcEUtU.exe
  C:\Windows\System\tkcEUtU.exe
  2⤵
  PID:6940
- C:\Windows\System\FooAoTS.exe
  C:\Windows\System\FooAoTS.exe
  2⤵
  PID:7132
- C:\Windows\System\bdYHZnx.exe
  C:\Windows\System\bdYHZnx.exe
  2⤵
  PID:6220
- C:\Windows\System\wkGpfOO.exe
  C:\Windows\System\wkGpfOO.exe
  2⤵
  PID:6444
- C:\Windows\System\VHvdgsO.exe
  C:\Windows\System\VHvdgsO.exe
  2⤵
  PID:6348
- C:\Windows\System\DiLtked.exe
  C:\Windows\System\DiLtked.exe
  2⤵
  PID:6148
- C:\Windows\System\sypHunZ.exe
  C:\Windows\System\sypHunZ.exe
  2⤵
  PID:7220
- C:\Windows\System\XBEoBcC.exe
  C:\Windows\System\XBEoBcC.exe
  2⤵
  PID:7236
- C:\Windows\System\IZpmswU.exe
  C:\Windows\System\IZpmswU.exe
  2⤵
  PID:7252
- C:\Windows\System\ssolvbd.exe
  C:\Windows\System\ssolvbd.exe
  2⤵
  PID:7332
- C:\Windows\System\JuoQBEt.exe
  C:\Windows\System\JuoQBEt.exe
  2⤵
  PID:7352
- C:\Windows\System\qydaiIo.exe
  C:\Windows\System\qydaiIo.exe
  2⤵
  PID:7380
- C:\Windows\System\FaHxPKQ.exe
  C:\Windows\System\FaHxPKQ.exe
  2⤵
  PID:7404
- C:\Windows\System\rzZkRrZ.exe
  C:\Windows\System\rzZkRrZ.exe
  2⤵
  PID:7440
- C:\Windows\System\tZGBaTV.exe
  C:\Windows\System\tZGBaTV.exe
  2⤵
  PID:7456
- C:\Windows\System\TazZCKC.exe
  C:\Windows\System\TazZCKC.exe
  2⤵
  PID:7476
- C:\Windows\System\MPLaSEl.exe
  C:\Windows\System\MPLaSEl.exe
  2⤵
  PID:7496
- C:\Windows\System\RPmSdMK.exe
  C:\Windows\System\RPmSdMK.exe
  2⤵
  PID:7512
- C:\Windows\System\QHudiLM.exe
  C:\Windows\System\QHudiLM.exe
  2⤵
  PID:7528
- C:\Windows\System\ItDLhWU.exe
  C:\Windows\System\ItDLhWU.exe
  2⤵
  PID:7620
- C:\Windows\System\vfRvbOY.exe
  C:\Windows\System\vfRvbOY.exe
  2⤵
  PID:7640
- C:\Windows\System\vBNrbGI.exe
  C:\Windows\System\vBNrbGI.exe
  2⤵
  PID:7660
- C:\Windows\System\yIWvRZL.exe
  C:\Windows\System\yIWvRZL.exe
  2⤵
  PID:7676
- C:\Windows\System\eXyjGJV.exe
  C:\Windows\System\eXyjGJV.exe
  2⤵
  PID:7692
- C:\Windows\System\QyufCGj.exe
  C:\Windows\System\QyufCGj.exe
  2⤵
  PID:7712
- C:\Windows\System\ypkXxfn.exe
  C:\Windows\System\ypkXxfn.exe
  2⤵
  PID:7744
- C:\Windows\System\OSoVejq.exe
  C:\Windows\System\OSoVejq.exe
  2⤵
  PID:7764
- C:\Windows\System\RuBuxGM.exe
  C:\Windows\System\RuBuxGM.exe
  2⤵
  PID:7828
- C:\Windows\System\dmDtJTR.exe
  C:\Windows\System\dmDtJTR.exe
  2⤵
  PID:7864
- C:\Windows\System\HCEjVJL.exe
  C:\Windows\System\HCEjVJL.exe
  2⤵
  PID:7884
- C:\Windows\System\WRjAZcD.exe
  C:\Windows\System\WRjAZcD.exe
  2⤵
  PID:7900
- C:\Windows\System\WxgQlkI.exe
  C:\Windows\System\WxgQlkI.exe
  2⤵
  PID:7916
- C:\Windows\System\gOQAWEK.exe
  C:\Windows\System\gOQAWEK.exe
  2⤵
  PID:7932
- C:\Windows\System\kaGuRNp.exe
  C:\Windows\System\kaGuRNp.exe
  2⤵
  PID:7948
- C:\Windows\System\jNpdubb.exe
  C:\Windows\System\jNpdubb.exe
  2⤵
  PID:7968
- C:\Windows\System\SjmcWXe.exe
  C:\Windows\System\SjmcWXe.exe
  2⤵
  PID:7984
- C:\Windows\System\TxJEhsQ.exe
  C:\Windows\System\TxJEhsQ.exe
  2⤵
  PID:8000
- C:\Windows\System\PhByIXv.exe
  C:\Windows\System\PhByIXv.exe
  2⤵
  PID:8016
- C:\Windows\System\TZKgtJh.exe
  C:\Windows\System\TZKgtJh.exe
  2⤵
  PID:8036
- C:\Windows\System\pMTNPfE.exe
  C:\Windows\System\pMTNPfE.exe
  2⤵
  PID:8052
- C:\Windows\System\pxsLfrJ.exe
  C:\Windows\System\pxsLfrJ.exe
  2⤵
  PID:8068
- C:\Windows\System\cJBoCxJ.exe
  C:\Windows\System\cJBoCxJ.exe
  2⤵
  PID:8088
- C:\Windows\System\LtYdrhR.exe
  C:\Windows\System\LtYdrhR.exe
  2⤵
  PID:8128
- C:\Windows\System\UBnfRZb.exe
  C:\Windows\System\UBnfRZb.exe
  2⤵
  PID:8160
- C:\Windows\System\PnwALjk.exe
  C:\Windows\System\PnwALjk.exe
  2⤵
  PID:8176
- C:\Windows\System\TSQxXKU.exe
  C:\Windows\System\TSQxXKU.exe
  2⤵
  PID:6996
- C:\Windows\System\RdSVDmc.exe
  C:\Windows\System\RdSVDmc.exe
  2⤵
  PID:6484
- C:\Windows\System\TDTjjYA.exe
  C:\Windows\System\TDTjjYA.exe
  2⤵
  PID:5784
- C:\Windows\System\YzoMUXA.exe
  C:\Windows\System\YzoMUXA.exe
  2⤵
  PID:6952
- C:\Windows\System\DbHILhI.exe
  C:\Windows\System\DbHILhI.exe
  2⤵
  PID:6320
- C:\Windows\System\EaSSCTF.exe
  C:\Windows\System\EaSSCTF.exe
  2⤵
  PID:6468
- C:\Windows\System\AVEolJS.exe
  C:\Windows\System\AVEolJS.exe
  2⤵
  PID:6708
- C:\Windows\System\NdIYiTL.exe
  C:\Windows\System\NdIYiTL.exe
  2⤵
  PID:6168
- C:\Windows\System\AVeJuAt.exe
  C:\Windows\System\AVeJuAt.exe
  2⤵
  PID:6732
- C:\Windows\System\FneSTgF.exe
  C:\Windows\System\FneSTgF.exe
  2⤵
  PID:6620
- C:\Windows\System\UbZXOuP.exe
  C:\Windows\System\UbZXOuP.exe
  2⤵
  PID:6520
- C:\Windows\System\kEuJfNV.exe
  C:\Windows\System\kEuJfNV.exe
  2⤵
  PID:7188
- C:\Windows\System\hGdYBmX.exe
  C:\Windows\System\hGdYBmX.exe
  2⤵
  PID:7204
- C:\Windows\System\VjSTDrm.exe
  C:\Windows\System\VjSTDrm.exe
  2⤵
  PID:7216
- C:\Windows\System\QLLCXaP.exe
  C:\Windows\System\QLLCXaP.exe
  2⤵
  PID:7272
- C:\Windows\System\qtlLfaK.exe
  C:\Windows\System\qtlLfaK.exe
  2⤵
  PID:7280
- C:\Windows\System\RqlKYnP.exe
  C:\Windows\System\RqlKYnP.exe
  2⤵
  PID:7248
- C:\Windows\System\IGOjAhl.exe
  C:\Windows\System\IGOjAhl.exe
  2⤵
  PID:7312
- C:\Windows\System\ryywuIU.exe
  C:\Windows\System\ryywuIU.exe
  2⤵
  PID:7328
- C:\Windows\System\loIgseZ.exe
  C:\Windows\System\loIgseZ.exe
  2⤵
  PID:7368
- C:\Windows\System\KVnxkWa.exe
  C:\Windows\System\KVnxkWa.exe
  2⤵
  PID:7424
- C:\Windows\System\RUyyCYd.exe
  C:\Windows\System\RUyyCYd.exe
  2⤵
  PID:7464
- C:\Windows\System\MuTNSYs.exe
  C:\Windows\System\MuTNSYs.exe
  2⤵
  PID:7508
- C:\Windows\System\NhLVptv.exe
  C:\Windows\System\NhLVptv.exe
  2⤵
  PID:7552
- C:\Windows\System\NfJiFVH.exe
  C:\Windows\System\NfJiFVH.exe
  2⤵
  PID:7488
- C:\Windows\System\Pcwyblt.exe
  C:\Windows\System\Pcwyblt.exe
  2⤵
  PID:7600
- C:\Windows\System\JgOMTCu.exe
  C:\Windows\System\JgOMTCu.exe
  2⤵
  PID:7616
- C:\Windows\System\vAVDhQk.exe
  C:\Windows\System\vAVDhQk.exe
  2⤵
  PID:7684
- C:\Windows\System\fErZUeG.exe
  C:\Windows\System\fErZUeG.exe
  2⤵
  PID:7388
- C:\Windows\System\LcfxZFy.exe
  C:\Windows\System\LcfxZFy.exe
  2⤵
  PID:7524
- C:\Windows\System\MMUseXh.exe
  C:\Windows\System\MMUseXh.exe
  2⤵
  PID:7736
- C:\Windows\System\uyJNusc.exe
  C:\Windows\System\uyJNusc.exe
  2⤵
  PID:7632
- C:\Windows\System\YYzGgLu.exe
  C:\Windows\System\YYzGgLu.exe
  2⤵
  PID:7700
- C:\Windows\System\zqSTvSX.exe
  C:\Windows\System\zqSTvSX.exe
  2⤵
  PID:7776
- C:\Windows\System\QgaJRZo.exe
  C:\Windows\System\QgaJRZo.exe
  2⤵
  PID:7752
- C:\Windows\System\hKCoAep.exe
  C:\Windows\System\hKCoAep.exe
  2⤵
  PID:7804
- C:\Windows\System\YVMpMvD.exe
  C:\Windows\System\YVMpMvD.exe
  2⤵
  PID:7840
- C:\Windows\System\kafoSKQ.exe
  C:\Windows\System\kafoSKQ.exe
  2⤵
  PID:7876
- C:\Windows\System\mnIXfOS.exe
  C:\Windows\System\mnIXfOS.exe
  2⤵
  PID:7908
- C:\Windows\System\FfoZzvd.exe
  C:\Windows\System\FfoZzvd.exe
  2⤵
  PID:7928
- C:\Windows\System\XNHfrCu.exe
  C:\Windows\System\XNHfrCu.exe
  2⤵
  PID:7980
- C:\Windows\System\bcwMQTz.exe
  C:\Windows\System\bcwMQTz.exe
  2⤵
  PID:8048
- C:\Windows\System\JiiAiKM.exe
  C:\Windows\System\JiiAiKM.exe
  2⤵
  PID:7964
- C:\Windows\System\vvEtILF.exe
  C:\Windows\System\vvEtILF.exe
  2⤵
  PID:7996
- C:\Windows\System\cbQNZDJ.exe
  C:\Windows\System\cbQNZDJ.exe
  2⤵
  PID:6580
- C:\Windows\System\UmHTics.exe
  C:\Windows\System\UmHTics.exe
  2⤵
  PID:6512
- C:\Windows\System\dXTEzvg.exe
  C:\Windows\System\dXTEzvg.exe
  2⤵
  PID:7148
- C:\Windows\System\Hjktisl.exe
  C:\Windows\System\Hjktisl.exe
  2⤵
  PID:6600
- C:\Windows\System\mzKeXwB.exe
  C:\Windows\System\mzKeXwB.exe
  2⤵
  PID:6524
- C:\Windows\System\DWfNLMB.exe
  C:\Windows\System\DWfNLMB.exe
  2⤵
  PID:7048
- C:\Windows\System\jXZrxtY.exe
  C:\Windows\System\jXZrxtY.exe
  2⤵
  PID:6516
- C:\Windows\System\xPUAEKr.exe
  C:\Windows\System\xPUAEKr.exe
  2⤵
  PID:7244
- C:\Windows\System\MwiwFGL.exe
  C:\Windows\System\MwiwFGL.exe
  2⤵
  PID:6156
- C:\Windows\System\EVNuEyi.exe
  C:\Windows\System\EVNuEyi.exe
  2⤵
  PID:7184
- C:\Windows\System\lHoOmYz.exe
  C:\Windows\System\lHoOmYz.exe
  2⤵
  PID:7276
- C:\Windows\System\aIJWNcf.exe
  C:\Windows\System\aIJWNcf.exe
  2⤵
  PID:7428
- C:\Windows\System\rCkHsfF.exe
  C:\Windows\System\rCkHsfF.exe
  2⤵
  PID:6536
- C:\Windows\System\gYxwxJT.exe
  C:\Windows\System\gYxwxJT.exe
  2⤵
  PID:7540
- C:\Windows\System\bCgdquo.exe
  C:\Windows\System\bCgdquo.exe
  2⤵
  PID:7568
- C:\Windows\System\HupWYHc.exe
  C:\Windows\System\HupWYHc.exe
  2⤵
  PID:7348
- C:\Windows\System\IQXjscb.exe
  C:\Windows\System\IQXjscb.exe
  2⤵
  PID:7448
- C:\Windows\System\KECmlEX.exe
  C:\Windows\System\KECmlEX.exe
  2⤵
  PID:7580
- C:\Windows\System\bfylztx.exe
  C:\Windows\System\bfylztx.exe
  2⤵
  PID:7452
- C:\Windows\System\sTqvwdg.exe
  C:\Windows\System\sTqvwdg.exe
  2⤵
  PID:7656
- C:\Windows\System\niseCJs.exe
  C:\Windows\System\niseCJs.exe
  2⤵
  PID:7584
- C:\Windows\System\wOmvGFV.exe
  C:\Windows\System\wOmvGFV.exe
  2⤵
  PID:7772
- C:\Windows\System\abLMdZP.exe
  C:\Windows\System\abLMdZP.exe
  2⤵
  PID:7816
- C:\Windows\System\bvyzkmg.exe
  C:\Windows\System\bvyzkmg.exe
  2⤵
  PID:7892
- C:\Windows\System\kvKMtjW.exe
  C:\Windows\System\kvKMtjW.exe
  2⤵
  PID:8076
- C:\Windows\System\kDhwOtI.exe
  C:\Windows\System\kDhwOtI.exe
  2⤵
  PID:8096
- C:\Windows\System\uJSWARH.exe
  C:\Windows\System\uJSWARH.exe
  2⤵
  PID:7800
- C:\Windows\System\mVInVDC.exe
  C:\Windows\System\mVInVDC.exe
  2⤵
  PID:7872
- C:\Windows\System\VdgJoWn.exe
  C:\Windows\System\VdgJoWn.exe
  2⤵
  PID:7924
- C:\Windows\System\BcelKkW.exe
  C:\Windows\System\BcelKkW.exe
  2⤵
  PID:8148
- C:\Windows\System\LRUsfTi.exe
  C:\Windows\System\LRUsfTi.exe
  2⤵
  PID:8172
- C:\Windows\System\uHyWhhf.exe
  C:\Windows\System\uHyWhhf.exe
  2⤵
  PID:7172
- C:\Windows\System\jgQaWSV.exe
  C:\Windows\System\jgQaWSV.exe
  2⤵
  PID:6296
- C:\Windows\System\YmpadpV.exe
  C:\Windows\System\YmpadpV.exe
  2⤵
  PID:6720
- C:\Windows\System\dZRcIoc.exe
  C:\Windows\System\dZRcIoc.exe
  2⤵
  PID:6216
- C:\Windows\System\NRVXNHJ.exe
  C:\Windows\System\NRVXNHJ.exe
  2⤵
  PID:8032
- C:\Windows\System\AOQjqVg.exe
  C:\Windows\System\AOQjqVg.exe
  2⤵
  PID:7264
- C:\Windows\System\KVykKFT.exe
  C:\Windows\System\KVykKFT.exe
  2⤵
  PID:7180
- C:\Windows\System\GCnVpDB.exe
  C:\Windows\System\GCnVpDB.exe
  2⤵
  PID:7848
- C:\Windows\System\fFIAMoS.exe
  C:\Windows\System\fFIAMoS.exe
  2⤵
  PID:7472
- C:\Windows\System\bsbFLFf.exe
  C:\Windows\System\bsbFLFf.exe
  2⤵
  PID:7344
- C:\Windows\System\lWjObiu.exe
  C:\Windows\System\lWjObiu.exe
  2⤵
  PID:7576
- C:\Windows\System\ulfVCsD.exe
  C:\Windows\System\ulfVCsD.exe
  2⤵
  PID:7652
- C:\Windows\System\KxUhgrY.exe
  C:\Windows\System\KxUhgrY.exe
  2⤵
  PID:7788
- C:\Windows\System\SAEPkCv.exe
  C:\Windows\System\SAEPkCv.exe
  2⤵
  PID:7940
- C:\Windows\System\SJBUKrM.exe
  C:\Windows\System\SJBUKrM.exe
  2⤵
  PID:8024
- C:\Windows\System\sKtTsVW.exe
  C:\Windows\System\sKtTsVW.exe
  2⤵
  PID:8012
- C:\Windows\System\RMpESjq.exe
  C:\Windows\System\RMpESjq.exe
  2⤵
  PID:8064
- C:\Windows\System\menrXir.exe
  C:\Windows\System\menrXir.exe
  2⤵
  PID:8184
- C:\Windows\System\HzNXcRI.exe
  C:\Windows\System\HzNXcRI.exe
  2⤵
  PID:8108
- C:\Windows\System\ZPDLMBc.exe
  C:\Windows\System\ZPDLMBc.exe
  2⤵
  PID:6300
- C:\Windows\System\USazEmw.exe
  C:\Windows\System\USazEmw.exe
  2⤵
  PID:7268
- C:\Windows\System\QKUyvNF.exe
  C:\Windows\System\QKUyvNF.exe
  2⤵
  PID:7592
- C:\Windows\System\CeoZMIA.exe
  C:\Windows\System\CeoZMIA.exe
  2⤵
  PID:7824
- C:\Windows\System\tlGEjIp.exe
  C:\Windows\System\tlGEjIp.exe
  2⤵
  PID:7436
- C:\Windows\System\JetwiiO.exe
  C:\Windows\System\JetwiiO.exe
  2⤵
  PID:7784
- C:\Windows\System\ECwymrr.exe
  C:\Windows\System\ECwymrr.exe
  2⤵
  PID:7296
- C:\Windows\System\LBIZazm.exe
  C:\Windows\System\LBIZazm.exe
  2⤵
  PID:8168
- C:\Windows\System\TSPoTpC.exe
  C:\Windows\System\TSPoTpC.exe
  2⤵
  PID:7732
- C:\Windows\System\kchGYly.exe
  C:\Windows\System\kchGYly.exe
  2⤵
  PID:8044
- C:\Windows\System\quUrcQd.exe
  C:\Windows\System\quUrcQd.exe
  2⤵
  PID:7324
- C:\Windows\System\pWQwexy.exe
  C:\Windows\System\pWQwexy.exe
  2⤵
  PID:7412
- C:\Windows\System\xQHgone.exe
  C:\Windows\System\xQHgone.exe
  2⤵
  PID:7836
- C:\Windows\System\BhtNrGa.exe
  C:\Windows\System\BhtNrGa.exe
  2⤵
  PID:8144
- C:\Windows\System\XclXkTX.exe
  C:\Windows\System\XclXkTX.exe
  2⤵
  PID:8028
- C:\Windows\System\kxOiCfQ.exe
  C:\Windows\System\kxOiCfQ.exe
  2⤵
  PID:8204
- C:\Windows\System\PldiDCS.exe
  C:\Windows\System\PldiDCS.exe
  2⤵
  PID:8220
- C:\Windows\System\aDTgFBX.exe
  C:\Windows\System\aDTgFBX.exe
  2⤵
  PID:8236
- C:\Windows\System\FFsuZBN.exe
  C:\Windows\System\FFsuZBN.exe
  2⤵
  PID:8252
- C:\Windows\System\hQuyrXD.exe
  C:\Windows\System\hQuyrXD.exe
  2⤵
  PID:8268
- C:\Windows\System\IDjGYCH.exe
  C:\Windows\System\IDjGYCH.exe
  2⤵
  PID:8284
- C:\Windows\System\grQVfRm.exe
  C:\Windows\System\grQVfRm.exe
  2⤵
  PID:8300
- C:\Windows\System\YVruPIt.exe
  C:\Windows\System\YVruPIt.exe
  2⤵
  PID:8316
- C:\Windows\System\oGQJVkG.exe
  C:\Windows\System\oGQJVkG.exe
  2⤵
  PID:8332
- C:\Windows\System\KzCGfnV.exe
  C:\Windows\System\KzCGfnV.exe
  2⤵
  PID:8348
- C:\Windows\System\ORovvTh.exe
  C:\Windows\System\ORovvTh.exe
  2⤵
  PID:8372
- C:\Windows\System\mgOxJlO.exe
  C:\Windows\System\mgOxJlO.exe
  2⤵
  PID:8388
- C:\Windows\System\qqHsABN.exe
  C:\Windows\System\qqHsABN.exe
  2⤵
  PID:8404
- C:\Windows\System\mmufIIE.exe
  C:\Windows\System\mmufIIE.exe
  2⤵
  PID:8420
- C:\Windows\System\MArRqUo.exe
  C:\Windows\System\MArRqUo.exe
  2⤵
  PID:8436
- C:\Windows\System\DlbpIzE.exe
  C:\Windows\System\DlbpIzE.exe
  2⤵
  PID:8452
- C:\Windows\System\HurMfRq.exe
  C:\Windows\System\HurMfRq.exe
  2⤵
  PID:8468
- C:\Windows\System\NyRhXfI.exe
  C:\Windows\System\NyRhXfI.exe
  2⤵
  PID:8484
- C:\Windows\System\mlxpPPk.exe
  C:\Windows\System\mlxpPPk.exe
  2⤵
  PID:8500
- C:\Windows\System\GxnBGbG.exe
  C:\Windows\System\GxnBGbG.exe
  2⤵
  PID:8516
- C:\Windows\System\mViFcUa.exe
  C:\Windows\System\mViFcUa.exe
  2⤵
  PID:8532
- C:\Windows\System\GAQZKCi.exe
  C:\Windows\System\GAQZKCi.exe
  2⤵
  PID:8548
- C:\Windows\System\QLxXdjG.exe
  C:\Windows\System\QLxXdjG.exe
  2⤵
  PID:8564
- C:\Windows\System\yxGvOYZ.exe
  C:\Windows\System\yxGvOYZ.exe
  2⤵
  PID:8580
- C:\Windows\System\KkULTxZ.exe
  C:\Windows\System\KkULTxZ.exe
  2⤵
  PID:8596
- C:\Windows\System\mhwOgGF.exe
  C:\Windows\System\mhwOgGF.exe
  2⤵
  PID:8612
- C:\Windows\System\oEtqeKg.exe
  C:\Windows\System\oEtqeKg.exe
  2⤵
  PID:8628
- C:\Windows\System\RahOfhr.exe
  C:\Windows\System\RahOfhr.exe
  2⤵
  PID:8644
- C:\Windows\System\VvGefwI.exe
  C:\Windows\System\VvGefwI.exe
  2⤵
  PID:8664
- C:\Windows\System\rGUoDlF.exe
  C:\Windows\System\rGUoDlF.exe
  2⤵
  PID:8680
- C:\Windows\System\IHxQMfq.exe
  C:\Windows\System\IHxQMfq.exe
  2⤵
  PID:8696
- C:\Windows\System\SjXfqer.exe
  C:\Windows\System\SjXfqer.exe
  2⤵
  PID:8712
- C:\Windows\System\BColvep.exe
  C:\Windows\System\BColvep.exe
  2⤵
  PID:8732
- C:\Windows\System\FODbmgT.exe
  C:\Windows\System\FODbmgT.exe
  2⤵
  PID:8748
- C:\Windows\System\cYSeeEg.exe
  C:\Windows\System\cYSeeEg.exe
  2⤵
  PID:8764
- C:\Windows\System\NNcOdZq.exe
  C:\Windows\System\NNcOdZq.exe
  2⤵
  PID:8784
- C:\Windows\System\MTngIAp.exe
  C:\Windows\System\MTngIAp.exe
  2⤵
  PID:8800
- C:\Windows\System\VjCCSue.exe
  C:\Windows\System\VjCCSue.exe
  2⤵
  PID:8816
- C:\Windows\System\cyntZpa.exe
  C:\Windows\System\cyntZpa.exe
  2⤵
  PID:8832
- C:\Windows\System\qmJsRRr.exe
  C:\Windows\System\qmJsRRr.exe
  2⤵
  PID:8848
- C:\Windows\System\klQzKbZ.exe
  C:\Windows\System\klQzKbZ.exe
  2⤵
  PID:8864
- C:\Windows\System\PjyzHFU.exe
  C:\Windows\System\PjyzHFU.exe
  2⤵
  PID:8880
- C:\Windows\System\IYzTqpQ.exe
  C:\Windows\System\IYzTqpQ.exe
  2⤵
  PID:8904
- C:\Windows\System\muGFDNA.exe
  C:\Windows\System\muGFDNA.exe
  2⤵
  PID:8920
- C:\Windows\System\vnDJcRM.exe
  C:\Windows\System\vnDJcRM.exe
  2⤵
  PID:8936
- C:\Windows\System\LJSuDDd.exe
  C:\Windows\System\LJSuDDd.exe
  2⤵
  PID:8952
- C:\Windows\System\xTYiYsS.exe
  C:\Windows\System\xTYiYsS.exe
  2⤵
  PID:8968
- C:\Windows\System\GuSVZpQ.exe
  C:\Windows\System\GuSVZpQ.exe
  2⤵
  PID:8984
- C:\Windows\System\adeKFTk.exe
  C:\Windows\System\adeKFTk.exe
  2⤵
  PID:9000
- C:\Windows\System\YFCPpUh.exe
  C:\Windows\System\YFCPpUh.exe
  2⤵
  PID:9016
- C:\Windows\System\azkZVso.exe
  C:\Windows\System\azkZVso.exe
  2⤵
  PID:9032
- C:\Windows\System\eIVPjaW.exe
  C:\Windows\System\eIVPjaW.exe
  2⤵
  PID:9052
- C:\Windows\System\ZMsWufF.exe
  C:\Windows\System\ZMsWufF.exe
  2⤵
  PID:9068
- C:\Windows\System\PwouLLG.exe
  C:\Windows\System\PwouLLG.exe
  2⤵
  PID:9092
- C:\Windows\System\cKrdpwV.exe
  C:\Windows\System\cKrdpwV.exe
  2⤵
  PID:9108
- C:\Windows\System\IBZjOqT.exe
  C:\Windows\System\IBZjOqT.exe
  2⤵
  PID:9124
- C:\Windows\System\FMRmgjN.exe
  C:\Windows\System\FMRmgjN.exe
  2⤵
  PID:9144
- C:\Windows\System\yknSnlc.exe
  C:\Windows\System\yknSnlc.exe
  2⤵
  PID:9160
- C:\Windows\System\YgTSFrK.exe
  C:\Windows\System\YgTSFrK.exe
  2⤵
  PID:9176
- C:\Windows\System\DaVZhtB.exe
  C:\Windows\System\DaVZhtB.exe
  2⤵
  PID:9212
- C:\Windows\System\YKxXHne.exe
  C:\Windows\System\YKxXHne.exe
  2⤵
  PID:8356
- C:\Windows\System\BIqflAl.exe
  C:\Windows\System\BIqflAl.exe
  2⤵
  PID:8368
- C:\Windows\System\qymRaXE.exe
  C:\Windows\System\qymRaXE.exe
  2⤵
  PID:8512
- C:\Windows\System\aCsjSbJ.exe
  C:\Windows\System\aCsjSbJ.exe
  2⤵
  PID:8400
- C:\Windows\System\mFAfyxJ.exe
  C:\Windows\System\mFAfyxJ.exe
  2⤵
  PID:8560
- C:\Windows\System\sWXSqPW.exe
  C:\Windows\System\sWXSqPW.exe
  2⤵
  PID:8460
- C:\Windows\System\JxLXEei.exe
  C:\Windows\System\JxLXEei.exe
  2⤵
  PID:8588
- C:\Windows\System\qbdTgce.exe
  C:\Windows\System\qbdTgce.exe
  2⤵
  PID:8640
- C:\Windows\System\vdRZhPV.exe
  C:\Windows\System\vdRZhPV.exe
  2⤵
  PID:9184
- C:\Windows\System\uFKwlPa.exe
  C:\Windows\System\uFKwlPa.exe
  2⤵
  PID:8660
- C:\Windows\System\PwfnCnu.exe
  C:\Windows\System\PwfnCnu.exe
  2⤵
  PID:9100
- C:\Windows\System\gsJGEhj.exe
  C:\Windows\System\gsJGEhj.exe
  2⤵
  PID:9048
- C:\Windows\System\OjSIUML.exe
  C:\Windows\System\OjSIUML.exe
  2⤵
  PID:8572
- C:\Windows\System\KgDWkMN.exe
  C:\Windows\System\KgDWkMN.exe
  2⤵
  PID:8308
- C:\Windows\System\yknLZbL.exe
  C:\Windows\System\yknLZbL.exe
  2⤵
  PID:8492
- C:\Windows\System\rJQUGRY.exe
  C:\Windows\System\rJQUGRY.exe
  2⤵
  PID:8932
- C:\Windows\System\FBWPZZq.exe
  C:\Windows\System\FBWPZZq.exe
  2⤵
  PID:9044
- C:\Windows\System\NZlRVSv.exe
  C:\Windows\System\NZlRVSv.exe
  2⤵
  PID:8976
- C:\Windows\System\HFkGBAz.exe
  C:\Windows\System\HFkGBAz.exe
  2⤵
  PID:2288
- C:\Windows\System\YgcywHU.exe
  C:\Windows\System\YgcywHU.exe
  2⤵
  PID:7200
- C:\Windows\System\cxZEKwK.exe
  C:\Windows\System\cxZEKwK.exe
  2⤵
  PID:8528
- C:\Windows\System\mRbaLHm.exe
  C:\Windows\System\mRbaLHm.exe
  2⤵
  PID:5912
- C:\Windows\System\kWiepBr.exe
  C:\Windows\System\kWiepBr.exe
  2⤵
  PID:9220
- C:\Windows\System\UZyMeny.exe
  C:\Windows\System\UZyMeny.exe
  2⤵
  PID:9236
- C:\Windows\System\qydNcPb.exe
  C:\Windows\System\qydNcPb.exe
  2⤵
  PID:9264
- C:\Windows\System\uInUyjJ.exe
  C:\Windows\System\uInUyjJ.exe
  2⤵
  PID:9412
- C:\Windows\System\YiThjaS.exe
  C:\Windows\System\YiThjaS.exe
  2⤵
  PID:9428
- C:\Windows\System\NVUGGey.exe
  C:\Windows\System\NVUGGey.exe
  2⤵
  PID:9444
- C:\Windows\System\jxnzlwr.exe
  C:\Windows\System\jxnzlwr.exe
  2⤵
  PID:9460
- C:\Windows\System\gCdOQtx.exe
  C:\Windows\System\gCdOQtx.exe
  2⤵
  PID:9476
- C:\Windows\System\ipcgmKu.exe
  C:\Windows\System\ipcgmKu.exe
  2⤵
  PID:9492
- C:\Windows\System\gyaYvbY.exe
  C:\Windows\System\gyaYvbY.exe
  2⤵
  PID:9508
- C:\Windows\System\GIRfyMV.exe
  C:\Windows\System\GIRfyMV.exe
  2⤵
  PID:9524
- C:\Windows\System\fROKJqH.exe
  C:\Windows\System\fROKJqH.exe
  2⤵
  PID:9540
- C:\Windows\System\QycvwXX.exe
  C:\Windows\System\QycvwXX.exe
  2⤵
  PID:9560
- C:\Windows\System\apRLlDE.exe
  C:\Windows\System\apRLlDE.exe
  2⤵
  PID:9576
- C:\Windows\System\tueiSoP.exe
  C:\Windows\System\tueiSoP.exe
  2⤵
  PID:9592
- C:\Windows\System\XwVHAGY.exe
  C:\Windows\System\XwVHAGY.exe
  2⤵
  PID:9616
- C:\Windows\System\jBxUChK.exe
  C:\Windows\System\jBxUChK.exe
  2⤵
  PID:9640
- C:\Windows\System\elPJcfe.exe
  C:\Windows\System\elPJcfe.exe
  2⤵
  PID:9656
- C:\Windows\System\WauDnUD.exe
  C:\Windows\System\WauDnUD.exe
  2⤵
  PID:9680
- C:\Windows\System\SijVPtH.exe
  C:\Windows\System\SijVPtH.exe
  2⤵
  PID:9704
- C:\Windows\System\giSQSEP.exe
  C:\Windows\System\giSQSEP.exe
  2⤵
  PID:9720
- C:\Windows\System\ZOkmBoy.exe
  C:\Windows\System\ZOkmBoy.exe
  2⤵
  PID:9808
- C:\Windows\System\ykgVMix.exe
  C:\Windows\System\ykgVMix.exe
  2⤵
  PID:9848
- C:\Windows\System\yJVKdVL.exe
  C:\Windows\System\yJVKdVL.exe
  2⤵
  PID:9868
- C:\Windows\System\bcghbfE.exe
  C:\Windows\System\bcghbfE.exe
  2⤵
  PID:9888
- C:\Windows\System\kbjhnan.exe
  C:\Windows\System\kbjhnan.exe
  2⤵
  PID:9976
- C:\Windows\System\cgXBckX.exe
  C:\Windows\System\cgXBckX.exe
  2⤵
  PID:10016
- C:\Windows\System\aegDdeM.exe
  C:\Windows\System\aegDdeM.exe
  2⤵
  PID:10056
- C:\Windows\System\HDyWPKL.exe
  C:\Windows\System\HDyWPKL.exe
  2⤵
  PID:10080
- C:\Windows\System\bEyFpIA.exe
  C:\Windows\System\bEyFpIA.exe
  2⤵
  PID:10104
- C:\Windows\System\sAzySvV.exe
  C:\Windows\System\sAzySvV.exe
  2⤵
  PID:10120
- C:\Windows\System\ucJAcJr.exe
  C:\Windows\System\ucJAcJr.exe
  2⤵
  PID:10228
- C:\Windows\System\gmDmcOX.exe
  C:\Windows\System\gmDmcOX.exe
  2⤵
  PID:8796
- C:\Windows\System\DhuVXBh.exe
  C:\Windows\System\DhuVXBh.exe
  2⤵
  PID:2792
- C:\Windows\System\dwdCIil.exe
  C:\Windows\System\dwdCIil.exe
  2⤵
  PID:8704
- C:\Windows\System\WxALnuD.exe
  C:\Windows\System\WxALnuD.exe
  2⤵
  PID:8756
- C:\Windows\System\FhFnNdN.exe
  C:\Windows\System\FhFnNdN.exe
  2⤵
  PID:8448
- C:\Windows\System\JXIrdqm.exe
  C:\Windows\System\JXIrdqm.exe
  2⤵
  PID:8776
- C:\Windows\System\BPFRqwO.exe
  C:\Windows\System\BPFRqwO.exe
  2⤵
  PID:9424
- C:\Windows\System\YKimQfz.exe
  C:\Windows\System\YKimQfz.exe
  2⤵
  PID:9552
- C:\Windows\System\NiMCcBC.exe
  C:\Windows\System\NiMCcBC.exe
  2⤵
  PID:9624
- C:\Windows\System\TDaoDsM.exe
  C:\Windows\System\TDaoDsM.exe
  2⤵
  PID:9516
- C:\Windows\System\jwolKWY.exe
  C:\Windows\System\jwolKWY.exe
  2⤵
  PID:9832
- C:\Windows\System\mSLJZSH.exe
  C:\Windows\System\mSLJZSH.exe
  2⤵
  PID:9712
- C:\Windows\System\RgfDaDj.exe
  C:\Windows\System\RgfDaDj.exe
  2⤵
  PID:9880
- C:\Windows\System\mvsiSIS.exe
  C:\Windows\System\mvsiSIS.exe
  2⤵
  PID:9648
- C:\Windows\System\oJysMIs.exe
  C:\Windows\System\oJysMIs.exe
  2⤵
  PID:10064
- C:\Windows\System\csIeHeM.exe
  C:\Windows\System\csIeHeM.exe
  2⤵
  PID:8792
- C:\Windows\System\BpJQUHw.exe
  C:\Windows\System\BpJQUHw.exe
  2⤵
  PID:9864
- C:\Windows\System\lFZtYqR.exe
  C:\Windows\System\lFZtYqR.exe
  2⤵
  PID:9916
- C:\Windows\System\ejXkWzP.exe
  C:\Windows\System\ejXkWzP.exe
  2⤵
  PID:9936
- C:\Windows\System\hyntxMt.exe
  C:\Windows\System\hyntxMt.exe
  2⤵
  PID:9956
- C:\Windows\System\otyqejY.exe
  C:\Windows\System\otyqejY.exe
  2⤵
  PID:10212
- C:\Windows\System\GgiuYrF.exe
  C:\Windows\System\GgiuYrF.exe
  2⤵
  PID:10044
- C:\Windows\System\XAVdzqD.exe
  C:\Windows\System\XAVdzqD.exe
  2⤵
  PID:10092
- C:\Windows\System\xsIIOXu.exe
  C:\Windows\System\xsIIOXu.exe
  2⤵
  PID:10076
- C:\Windows\System\LedSMjp.exe
  C:\Windows\System\LedSMjp.exe
  2⤵
  PID:9748
- C:\Windows\System\aDJUMrk.exe
  C:\Windows\System\aDJUMrk.exe
  2⤵
  PID:9792
- C:\Windows\System\kvSFhte.exe
  C:\Windows\System\kvSFhte.exe
  2⤵
  PID:9436
- C:\Windows\System\CZiWUxR.exe
  C:\Windows\System\CZiWUxR.exe
  2⤵
  PID:9500
- C:\Windows\System\pnQlAqT.exe
  C:\Windows\System\pnQlAqT.exe
  2⤵
  PID:9696
- C:\Windows\System\FJveJGc.exe
  C:\Windows\System\FJveJGc.exe
  2⤵
  PID:9728
- C:\Windows\System\rASFtFd.exe
  C:\Windows\System\rASFtFd.exe
  2⤵
  PID:10144
- C:\Windows\System\VvesDqp.exe
  C:\Windows\System\VvesDqp.exe
  2⤵
  PID:9012
- C:\Windows\System\fkgTRHS.exe
  C:\Windows\System\fkgTRHS.exe
  2⤵
  PID:1008
- C:\Windows\System\kBdVDYH.exe
  C:\Windows\System\kBdVDYH.exe
  2⤵
  PID:10028
- C:\Windows\System\uhZBbOY.exe
  C:\Windows\System\uhZBbOY.exe
  2⤵
  PID:8996
- C:\Windows\System\XWofZQU.exe
  C:\Windows\System\XWofZQU.exe
  2⤵
  PID:9328
- C:\Windows\System\jekHBgv.exe
  C:\Windows\System\jekHBgv.exe
  2⤵
  PID:10220
- C:\Windows\System\xbkfEPk.exe
  C:\Windows\System\xbkfEPk.exe
  2⤵
  PID:9232
- C:\Windows\System\qOFcbcS.exe
  C:\Windows\System\qOFcbcS.exe
  2⤵
  PID:8912
- C:\Windows\System\KmqUlvH.exe
  C:\Windows\System\KmqUlvH.exe
  2⤵
  PID:8892
- C:\Windows\System\BUJFkao.exe
  C:\Windows\System\BUJFkao.exe
  2⤵
  PID:9304
- C:\Windows\System\RXqsfXM.exe
  C:\Windows\System\RXqsfXM.exe
  2⤵
  PID:8280
- C:\Windows\System\DrMGxEx.exe
  C:\Windows\System\DrMGxEx.exe
  2⤵
  PID:2068
- C:\Windows\System\diZwmsA.exe
  C:\Windows\System\diZwmsA.exe
  2⤵
  PID:8740
- C:\Windows\System\WOCoICh.exe
  C:\Windows\System\WOCoICh.exe
  2⤵
  PID:9876
- C:\Windows\System\eQwGfbq.exe
  C:\Windows\System\eQwGfbq.exe
  2⤵
  PID:8812
- C:\Windows\System\PSgwihr.exe
  C:\Windows\System\PSgwihr.exe
  2⤵
  PID:560
- C:\Windows\System\seGwTSG.exe
  C:\Windows\System\seGwTSG.exe
  2⤵
  PID:10224
- C:\Windows\System\rkWFkms.exe
  C:\Windows\System\rkWFkms.exe
  2⤵
  PID:8524
- C:\Windows\System\YtZCsTk.exe
  C:\Windows\System\YtZCsTk.exe
  2⤵
  PID:9352
- C:\Windows\System\uwOhGEs.exe
  C:\Windows\System\uwOhGEs.exe
  2⤵
  PID:9376
- C:\Windows\System\HItfSIv.exe
  C:\Windows\System\HItfSIv.exe
  2⤵
  PID:9396
- C:\Windows\System\mvNIlpO.exe
  C:\Windows\System\mvNIlpO.exe
  2⤵
  PID:8876
- C:\Windows\System\APxbgwS.exe
  C:\Windows\System\APxbgwS.exe
  2⤵
  PID:9208
- C:\Windows\System\SHkEgjH.exe
  C:\Windows\System\SHkEgjH.exe
  2⤵
  PID:10188
- C:\Windows\System\AcoSfjr.exe
  C:\Windows\System\AcoSfjr.exe
  2⤵
  PID:9608
- C:\Windows\System\yGGGSlY.exe
  C:\Windows\System\yGGGSlY.exe
  2⤵
  PID:9204
- C:\Windows\System\dxhCPxD.exe
  C:\Windows\System\dxhCPxD.exe
  2⤵
  PID:8196
- C:\Windows\System\pzUZzeJ.exe
  C:\Windows\System\pzUZzeJ.exe
  2⤵
  PID:8980
- C:\Windows\System\DSscaQD.exe
  C:\Windows\System\DSscaQD.exe
  2⤵
  PID:9172
- C:\Windows\System\NupDDXG.exe
  C:\Windows\System\NupDDXG.exe
  2⤵
  PID:8928
- C:\Windows\System\VkzNkUQ.exe
  C:\Windows\System\VkzNkUQ.exe
  2⤵
  PID:9488
- C:\Windows\System\UHYDsZw.exe
  C:\Windows\System\UHYDsZw.exe
  2⤵
  PID:9824
- C:\Windows\System\jTvjbJj.exe
  C:\Windows\System\jTvjbJj.exe
  2⤵
  PID:9612
- C:\Windows\System\YjcmZUK.exe
  C:\Windows\System\YjcmZUK.exe
  2⤵
  PID:9972
- C:\Windows\System\fTHUJdx.exe
  C:\Windows\System\fTHUJdx.exe
  2⤵
  PID:9768
- C:\Windows\System\lnEBQtm.exe
  C:\Windows\System\lnEBQtm.exe
  2⤵
  PID:9780
- C:\Windows\System\ZkmsEyn.exe
  C:\Windows\System\ZkmsEyn.exe
  2⤵
  PID:9536
- C:\Windows\System\JdOyVbU.exe
  C:\Windows\System\JdOyVbU.exe
  2⤵
  PID:10236
- C:\Windows\System\fGFCfie.exe
  C:\Windows\System\fGFCfie.exe
  2⤵
  PID:10004
- C:\Windows\System\nqxEMYE.exe
  C:\Windows\System\nqxEMYE.exe
  2⤵
  PID:10180
- C:\Windows\System\pNNiVsP.exe
  C:\Windows\System\pNNiVsP.exe
  2⤵
  PID:8396
- C:\Windows\System\mqNEqfF.exe
  C:\Windows\System\mqNEqfF.exe
  2⤵
  PID:9152
- C:\Windows\System\CsOYedE.exe
  C:\Windows\System\CsOYedE.exe
  2⤵
  PID:8724
- C:\Windows\System\rElGgMv.exe
  C:\Windows\System\rElGgMv.exe
  2⤵
  PID:9300
- C:\Windows\System\nWBvPsw.exe
  C:\Windows\System\nWBvPsw.exe
  2⤵
  PID:9296
- C:\Windows\System\rVbCvwI.exe
  C:\Windows\System\rVbCvwI.exe
  2⤵
  PID:9796
- C:\Windows\System\XuGpcoL.exe
  C:\Windows\System\XuGpcoL.exe
  2⤵
  PID:8808
- C:\Windows\System\IJIjCiI.exe
  C:\Windows\System\IJIjCiI.exe
  2⤵
  PID:8324
- C:\Windows\System\aSNsUHX.exe
  C:\Windows\System\aSNsUHX.exe
  2⤵
  PID:9912
- C:\Windows\System\ibRNUwG.exe
  C:\Windows\System\ibRNUwG.exe
  2⤵
  PID:9944
- C:\Windows\System\bzOAlVN.exe
  C:\Windows\System\bzOAlVN.exe
  2⤵
  PID:10024
- C:\Windows\System\xICOSbM.exe
  C:\Windows\System\xICOSbM.exe
  2⤵
  PID:9896
- C:\Windows\System\EMuhruD.exe
  C:\Windows\System\EMuhruD.exe
  2⤵
  PID:9968
- C:\Windows\System\nSkyuRU.exe
  C:\Windows\System\nSkyuRU.exe
  2⤵
  PID:8624
- C:\Windows\System\gjcVKlG.exe
  C:\Windows\System\gjcVKlG.exe
  2⤵
  PID:9312
- C:\Windows\System\GmCvLuX.exe
  C:\Windows\System\GmCvLuX.exe
  2⤵
  PID:2384
- C:\Windows\System\yJlWAEV.exe
  C:\Windows\System\yJlWAEV.exe
  2⤵
  PID:9360
- C:\Windows\System\otwQrbn.exe
  C:\Windows\System\otwQrbn.exe
  2⤵
  PID:9336
- C:\Windows\System\cNKZXgp.exe
  C:\Windows\System\cNKZXgp.exe
  2⤵
  PID:10200
- C:\Windows\System\YvIyXej.exe
  C:\Windows\System\YvIyXej.exe
  2⤵
  PID:9136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AYARQlp.exe

Filesize
1.9MB

MD5
36dcaafc5208fd72c3b2d8e7a38d10c5

SHA1
1af5eeba725f668190b4fa1e913ac78942562ab7

SHA256
c1d8c915c150d280722dc80a701534b498bc136351ced1d8fd126dcdf9dae535

SHA512
3e047ac20119e5f3315af64f7810b64ded61c84bd5601d92de98d154611199c30ce3a7e4ffdb9f7d8e92cfa4920f88874cc1c210a1bb3c9cbe993bac7ac2a606

Download Submit
C:\Windows\system\BbDodKH.exe

Filesize
1.9MB

MD5
a80bce5d01b00dca6099b5a02694fd71

SHA1
4f4a9b52bf119681d1da20c0424d9fbfe59c11f1

SHA256
2e7b8ec68aee0cb6513d72ccc4b794b89b5b410da4bc7905498817c2d2c419cc

SHA512
650dcb0ea58a5257338088258ca64c70a042b48c13855898f7968e2ee8adccf280b1631e84fda0b59d072102621505b26241fd413f790d6a92d66c232e42a2af

Download Submit
C:\Windows\system\CjNQwlk.exe

Filesize
1.9MB

MD5
89215adb80feb9068b6b4a32b252bd68

SHA1
2fba9ec70788497753c802a78862d6ce55f6286b

SHA256
e698dcb5610c4386bb11c7a9db95482d0c61636ba0f287b4e66e14af01187555

SHA512
6204a57055ea63754abc0b23dcf62db0409b6eeeccb7e6ff430d84e25a2e55917197df87899a4a0ce5916aa4a2e757aabb36665609091643b0a002e4fd36931c

Download Submit
C:\Windows\system\ELdRzPn.exe

Filesize
1.9MB

MD5
8d130021de92487d4925ab82cb6e13ac

SHA1
b1e1307e2baef789f0656b38e122137d5c74c8ed

SHA256
f2cbc0def9184c3c498b264df64237b5521a077c4f074b61d7fd7e963a069c72

SHA512
32e1f9102611be45aa5562ddda688f90862c96dda9d4a85fa31b9d1fa91e52095e98b375deeaab0acc5331693e7a26cb633e5e798fe6ebe8608edce396d09e1e

Download Submit
C:\Windows\system\ERUcydn.exe

Filesize
1.9MB

MD5
a19394b2ff9759d3f097ea2204642860

SHA1
9d7c2f8f8fcfea6fde0c80238ef2fc70051e0ee2

SHA256
2adb6b80e5b767d10fb524a2fd7f9880e54a7fdf55b1dee23b9817125135abe8

SHA512
e7b89b506258cbee538047e92f0c40feccd827ab071058370465aef88bda01529f87e2017b20c0ac96ca490496b975f406d8549944a1a7dedbc74a3b14107e8f

Download Submit
C:\Windows\system\FUJOUbL.exe

Filesize
1.9MB

MD5
3208235861e2af9739fc2b628572b1bf

SHA1
a707bffc28699bd703e50f5e80a4ffcacc95bf1c

SHA256
fd32111e306b6394bdea90e3a9e20b58e5ceb9881000e1656f2606b9ff679dda

SHA512
c807014f737cdc10a736f06acd348a8f0622778b523f2b506a73bd12575d7bb1e826f1fe036f64dbadc9804ee440cb71606bd427b4fde3b23406aba3315b0810

Download Submit
C:\Windows\system\Gcuciwm.exe

Filesize
1.9MB

MD5
54cfb77fa06945669520c70d1f78f373

SHA1
cce24dc0090820885d1a540e173ef29371a66388

SHA256
44d3ff6fba0bdd06c97682a7ff7424769943ce1f8fb5869179006f1ffd373c51

SHA512
63a8f8e51c092a35a99d76448f56ce73a1d374af880f0b2f1595362d2de8c62d69a050faa48c43b7bd12a61207b1e2763ac5a0455d2760b920797da9ed159510

Download Submit
C:\Windows\system\GihzFhr.exe

Filesize
1.9MB

MD5
804413a5f7444f51ffd4d792fc5bbde9

SHA1
38b6f9947b2aab639df727eb09bf1017d18e4cc0

SHA256
872a197abbd55fc090cdc7752bf6eb354d2067b5558a4b85f771359d5cfa523d

SHA512
bd8d5b6074040e18468e40db7f46f26eee84652ce7bddf662eae33fdbd1a2b808457354866deb9eb8493d401a186860c4efe4d1f7c7c064b79f0e775ab9bd5ac

Download Submit
C:\Windows\system\JjjTcZP.exe

Filesize
1.9MB

MD5
ca94883338a04ae9a94cd4ef4a446110

SHA1
b22e12aa2cb5a0a35834647349be3b35e66449e9

SHA256
f268b69573f2729a29970016b2ed1099f1cb5a91970b44e16d5e2daafba1b355

SHA512
8049223a9ab521b2ae521a9cce8983fc942d71877b0ac44c81d624bd85c153bbc40b23ac59305ded1e23ba194f0148aa3c01c59cf5be24c4bcd1600dd1bc5fa9

Download Submit
C:\Windows\system\JyHZVyb.exe

Filesize
1.9MB

MD5
212026b2cb1dadbf22a31ea8503a9dfc

SHA1
fe836aebb5f02a3cb71161b6eaa8f1337912f464

SHA256
a1959a6e95b400ac9f9cd470eca01f4f7addb6fea037ebb86b77ad503b19ffff

SHA512
d06bd1f6bd96e38d199e0ac698e0a1a1634bf4c85b2f508b0b5e2234f00fac3557120743f191c19b7ae0fe8630fe5d17cda28186bd9457969c58b104763b7ed6

Download Submit
C:\Windows\system\LgHgJJN.exe

Filesize
1.9MB

MD5
f70c98aa95f588cfa34609a7817d97b5

SHA1
8310275a9fc93998fffa9cd096dda031361e4bf7

SHA256
eb40e015d79e83997b939340c7660be9a4201e5e9a89b273ee2c57e6e3a6128d

SHA512
7a80c6f26c2bf036544cdb5b47e74862ec0f539d3facdc935825a6e12ac3f1ea41c990d32df6da885964caf0d7431210cc7d4c8b40f916e4591c8f355079ae7a

Download Submit
C:\Windows\system\OeJOeSu.exe

Filesize
1.9MB

MD5
0b947f8b26fc004af7c0b70c1445308c

SHA1
49f0105d2395a85af8c032e77472d70522dcccc6

SHA256
5b8a4202ec6aaac30b36c1268792a1641e22bfa1dc24b63ea862c1cad748f75e

SHA512
141a0ab217d99b3a39af432064d61f77f7326e7abd5112ef2f6f53e4552abf54cccaa450e9987176e9bb6c9381cc9c084c3040c214e1df3fbaf254a22547af56

Download Submit
C:\Windows\system\OvJrcLy.exe

Filesize
1.9MB

MD5
362fa65bdf8aa4816299a09169bd3eae

SHA1
0ada489236047eeebdb95326bc1d80611e510797

SHA256
9bdbbedcc453cd6e44506ee3899eca1d461676f65ba33175b41ced2dcf011b68

SHA512
5bb0dcb171d0bcbefd9b3eb4aec5938470b49a1d7c6a977346d369afb2e955007a9b72b95e67c61e4a58d3696992f4cfa4ed5996ef7778f8c8201a20b23440e5

Download Submit
C:\Windows\system\Psilbzi.exe

Filesize
1.9MB

MD5
fe4d0ba167c1f39b834bb8430928d9e5

SHA1
918fdcf0d9dab589fb474662f240bcc4f899f086

SHA256
526b6bb6c6e16b8a9efb67f4c79a73465ae483c304d34732b5bd148a86577623

SHA512
9d472269e40cdfe12453f2d29790550e356f963e43e3e13a708e0f83352f3cc5dc9485b66f9035fb7d8081f0bb569e3606408f1f923e07872f03e4ac8d89dedc

Download Submit
C:\Windows\system\RnmrbxM.exe

Filesize
1.9MB

MD5
cb66f4ce6aa79faef88f6d097b92e8af

SHA1
10034cf018e02c8081d2a514161e7ec5c1ad7252

SHA256
d373ec54a9815d6a4214c6ff549ffe81f357c0f3e8d957c8ed112abde01d043a

SHA512
e162af268fb387097d98fab9785cc38d26eccdddec80545f0f287c7698f3286aafd95276af05c43bff79e06bbddef931c36a39d5414783ab188697b94eba2a6a

Download Submit
C:\Windows\system\SogjwBu.exe

Filesize
1.9MB

MD5
b6f44fa6cf5fc7dcec6f2981e9086570

SHA1
b166ac0bd1f3cfda6d09b616cdf77fb8bdfa8a9c

SHA256
f40bc134b48bf77126d50628263f57f2eb5dbed49328e097dc6aff0a76483e46

SHA512
dbc4de1777ace7ab548ef0b644fbd3f13ab893da4b3e11981ba69c1108d07ff819250502a6cce967b77868a1d54fab1bb9d5977d5c609520697c3ace2b062049

Download Submit
C:\Windows\system\TrTGOHO.exe

Filesize
1.9MB

MD5
ffa7d81a20c00bfbde9d35c0c150f486

SHA1
12372e18015b2975f5f8def43efc24573733503f

SHA256
91cac110a29b0b7e2e2608d9081a76b4cb87997b75c61e108dcfcf358e4acc69

SHA512
132c5fb1bb8b8a32a065e92e8d4754d43fbc479df898eea67647bf882653e1c8bd2bd65998aab7e7d3b1ee9799227cbedbd31131953ce76b0062b6dc4dd87f53

Download Submit
C:\Windows\system\buEXxFZ.exe

Filesize
1.9MB

MD5
81d57526ab049c4f6c79a81e50960e14

SHA1
038b66f5864a93432b2a353e6072a9b1c91887aa

SHA256
1aa278e128905a37c77cdb43ee97007dc11e94efb7362385559171080b1f3aa6

SHA512
080aa0be85a39689cb67092fe73bcb0a3eb7a307b25c47db9e22cebd58e4d9a47542f368ba7e7c83a43e96040c61bfa4d9bb99a07c31f7c705a5e3a0d5927298

Download Submit
C:\Windows\system\cngUaJW.exe

Filesize
1.9MB

MD5
8072703d97ce78cfc938a5b718d04289

SHA1
a71a800ff0e7de151c57d155c417301a7d36e3ca

SHA256
499160ac3732a4a707998aef7e9fdcada76bdc76581d3c29f3fc516a769be03e

SHA512
be8d79fd356aa3d4cb79dd9dfddccf896968e5f37a357781da03b31abf577ab08c92d78cde8f6b1ea4fd24d4e6111570b7e16be0acc8b30ab87bd57260cedee1

Download Submit
C:\Windows\system\eFXeawe.exe

Filesize
1.9MB

MD5
5233a3da5fa998e6906bf0cf1338f9ed

SHA1
9cf1bc0bb0fc72056b17f459a58ba52391486e86

SHA256
d9ea4579c70e091e42fedc58785346237505e91864c0577d1046d6c7b663f758

SHA512
4e9cd51d905a18e7c1e224c27130c9fd0f00ea17153c098f958bb26ba326d84d8ded4fe9b0b255df3c3ec1ca514d6b8bbe04dd0be7eb15b20f47bbc290538f4e

Download Submit
C:\Windows\system\efjXFnO.exe

Filesize
1.9MB

MD5
2e0b2f64d9250463065aff5d2eeb1cfc

SHA1
99a5e309388f2ffe5703a12c0eabbcda448fc1e3

SHA256
12a2fd961b6fad0483053ab481808f5ab8537b4c29e61560aa4f462455c732db

SHA512
45418b78a6b4dbe93192a62baea5fecaef3aad8f3f5c6c11b143bc78263522008e8b8ded4c9d412d2652e2c4ab826602043a5dfdc8c04a5e7b06a6e97f1f436c

Download Submit
C:\Windows\system\gwtvQZv.exe

Filesize
1.9MB

MD5
6cd54320ce68a724ed18590e69ab33f4

SHA1
98fb93e61534c2b0e076e1508e5a976efed0f471

SHA256
aca6946b95ff511bb13a21f7e125422df0518dd9beb5e75d658992837b47b5bc

SHA512
63911c669dcfe44ee09d5d23e46b797f65c483d8f8f4e6eecbfe5940375e2f30c6c80241c5017aeaf082088cf1fca05d92707a5261323c72c9296ffaaae7636a

Download Submit
C:\Windows\system\juEpDsq.exe

Filesize
1.9MB

MD5
5dc2bcc82e7f5234e44629a1c4176390

SHA1
2328b0b7c943ac6f91c4e78ccddf63e02b197149

SHA256
db833c81293cc401fcd48beec2401e20862739743e09deef3fa1b032f98ecf58

SHA512
8c3efef138f1b381a31d6c0258c0900e232f466ccca165b322d7fdbd4d470a706d3651a895c3d286f12f8c5361327e7d6e9f057455832e959d0306f3e0ddf824

Download Submit
C:\Windows\system\pBZdtfn.exe

Filesize
1.9MB

MD5
44f5e843207740c018f27eb49e7d0b28

SHA1
921deaede9a5ca34383ad640181edb3a06e5078c

SHA256
e1a47a00d84979aa85fca2b79c23a3061de787728097f7c683043daad2976a64

SHA512
2a310b1f0be7dd071899a47de2ae3636a224c22326ee380788b032fe6077ff9b054dddd88c08e0b314aad2a03846f0313f784e790295db0216633e6ecf992047

Download Submit
C:\Windows\system\pCHJjxY.exe

Filesize
1.9MB

MD5
d44887bc2b69fd99567b5acc1aa7e114

SHA1
6ea9534379f9a61dd7486e3a1502a3d4f5a7b1a8

SHA256
708667195f2c14ef597d3f04527956ca5053674e8fad7801f95cbd91ec21bb9f

SHA512
9e904f652755c79841710147e20ccfa73e6ed15f5929e409acef20109655998b597c99e0f648f71ae35ccb45ba7e8f492e3fd9fcb87d6d2320eb447bac3bc9bf

Download Submit
C:\Windows\system\tcQkYSh.exe

Filesize
1.9MB

MD5
912bb87da5a4cc7cacd1ca5ad5bd8fee

SHA1
599daddf3f689b18b67aa42925db184a4d889a46

SHA256
078e4aa1682858ad80bb7dfb0f15dca121098d4951fddfec59b6cc86cff409de

SHA512
920391fe198363b0acb734e2f002cb3183475b48a587a1a14be9e1b17c7058ad820de3a83f2b3e1f705ac3327e1cae39347bbfd56c72845c7fb409f093544d22

Download Submit
C:\Windows\system\vMnGKPI.exe

Filesize
1.9MB

MD5
9b59e4194b0bcb314c7206573e27b431

SHA1
a019083b5e97c8ef23b4508ce84565ab52614bf0

SHA256
2b5ab4692e810e2f7ebcbffd5f68c5da750d8f959ee9cc27f316a9b709d8d79e

SHA512
794aad304bfcad9ed70960c415b74264709ca761c71788b9540b00b2734b0095903a1249e74558675b68aae389a21672cef161688fa1f8f83bd2e57bd18e4412

Download Submit
C:\Windows\system\vpepdss.exe

Filesize
1.9MB

MD5
6e0d06ab8838b7eaea9ef48c986dba4b

SHA1
d732586888e75a4adb10ddf0025d46d29605f11f

SHA256
447cda18b87db7c8d95cdea6cccb77bff542606ca4893579331c6d37edb0c307

SHA512
8155f9a700953314cb08589949ae13012e95d804f3d5958994bae770f921044b93bd07aa8ee22228f316d565314aaf95165069735be6fff4d9842aa4117e1fa7

Download Submit
C:\Windows\system\vsbiYmR.exe

Filesize
1.9MB

MD5
7e68d7f7cc35b32680c283108385304a

SHA1
115932d35661f1942a13433e9369c2c6c138ca5b

SHA256
41d30767909a43969e7675a047e73d1c710fabc05806dea548c318ef7ea8ab0b

SHA512
3937d485b71c6f5d493656f9ca0b3736eb84ff091c1c86885e4ae781c414fd96405c6fcf936034dfe9fbb28e83b323c37840ef82d5d4aa47ba27b05a71ed29f7

Download Submit
C:\Windows\system\ySgucTH.exe

Filesize
1.9MB

MD5
bc1e5757e3b5c2d1d53241ddb2f5f015

SHA1
a67633a1e2168f931fb4707a0c5b9ec69cf5f5c4

SHA256
f14d3fd407ebab6bb579461cd7c2eb05c01176bd821cdb88e1506301fd80c91e

SHA512
fbfe93919c7a5469d57d5c0e581155e4d0ff142c5e71ca84b981bebcf0916fd4c6b4d35f2e4ee4bd5b22b5430cd6b20dfd039a1f7411190cc2933104edb928d5

Download Submit
C:\Windows\system\yxDmMIW.exe

Filesize
1.9MB

MD5
1a1676b71d3d616771d5ccae44744ded

SHA1
4fd5d97a8f8c843c6f15f77ac7f166a40b118ecb

SHA256
6fec147b793c12484298b979ce567017ddc685b7ef0c15fce3c6317d514e41a3

SHA512
0244da533437c516ef092bc060eca5b18a13511ffa4df89f416373456f484b5fd037292a8f13e546a7e9f4b5571c5faefce63819c4e53879ca7acf88ebe8933d

Download Submit
\Windows\system\YTjGGIg.exe

Filesize
1.9MB

MD5
29b7cf0d84b8c19feb5ca01793be5277

SHA1
0836f1d4479b73a2a243e3f28b3248e14a3891d8

SHA256
bf65531e293d3acd2a030a5dd7f774ce5a75532e7b60fcc35c6d7e0ccc115170

SHA512
21d86794de881df34ea0a0cf7a0310396e4a1e024e9532eff2a33dbbbb68965a994cdc73b7ceb070ac02207b4505a012a0f81138cc6aa8161313b534451976d5

Download Submit
memory/1084-61-0x00000000026A0000-0x0000000002A92000-memory.dmp

Filesize
3.9MB

Download
memory/1084-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1084-319-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/1084-94-0x0000000002E40000-0x0000000003232000-memory.dmp

Filesize
3.9MB

Download
memory/1084-44-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/1084-95-0x0000000002E40000-0x0000000003232000-memory.dmp

Filesize
3.9MB

Download
memory/1084-82-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/1084-81-0x0000000002270000-0x0000000002662000-memory.dmp

Filesize
3.9MB

Download
memory/1084-33-0x0000000002270000-0x0000000002662000-memory.dmp

Filesize
3.9MB

Download
memory/1084-58-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/1084-0-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/1084-67-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/1084-70-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/1084-75-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/1084-72-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/1084-73-0x00000000026A0000-0x0000000002A92000-memory.dmp

Filesize
3.9MB

Download
memory/1096-2488-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/1096-62-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-63-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/1732-2472-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2176-254-0x000000001B2C0000-0x000000001B5A2000-memory.dmp

Filesize
2.9MB

Download
memory/2176-257-0x0000000002350000-0x0000000002358000-memory.dmp

Filesize
32KB

Download
memory/2272-2486-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2272-45-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2432-2489-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2432-77-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2460-74-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2460-2479-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2508-2514-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2508-80-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2520-2447-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-83-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-79-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-2513-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-2473-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2592-76-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2608-71-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2608-2467-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2876-78-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2876-2512-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download