xmrig | 17cac67b7b9707a84b26944b86b03ef09cc3aea1ba785668971db2b314966a86

Analysis

max time kernel
4s
max time network
27s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
Size

1.7MB
MD5

0c0948abafc64235e093f7e01cb421dd
SHA1

138e993990fb149c6cb3a40e844c3598de015d6e
SHA256

17cac67b7b9707a84b26944b86b03ef09cc3aea1ba785668971db2b314966a86
SHA512

ea4ce8feaea4fa4742d77a28a55bf3e65eab0a0dd4d79ee7370a79fe0512cd1a64980f341efb0c91e33d0d9c7636caa93e7b5ec54204c18a8f76e8fdab5267a9
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SGkMKM:NABX

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2828-222-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2500-225-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2832-234-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2480-228-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2520-226-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2488-224-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2172-32-0x000000013F970000-0x000000013FD62000-memory.dmp	xmrig
behavioral1/memory/2572-44-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
868	DePBTLm.exe
2172	XVJcpre.exe
2572	rdxEiNg.exe
2832	izTZLTi.exe
2828	XublfDO.exe
2488	oWevImg.exe
2500	NrBAqBA.exe
2520	oluKvmI.exe
2480	pdIaUmU.exe
2584	XEHiegm.exe
2768	dhGEMUW.exe
1756	sqPnHxp.exe
2928	dwZoBIf.exe
2788	VfRXbJu.exe
1924	ZzWfrQr.exe
1640	JhCfkts.exe
2772	YmZSxgE.exe
2564	WQYGpcD.exe
1424	YUSVCMV.exe
2356	YDFIxbo.exe
1160	ZXvnnCH.exe
2052	zgmLhmG.exe
1428	xolfzGc.exe
612	GvMuQBE.exe
1884	Rktoeho.exe
1432	huqgUuq.exe
848	ZnqfHhe.exe
1848	vdQWWWn.exe
1880	UGdqZcn.exe
1268	UjgzDQt.exe
1776	LcjQvPs.exe
1812	XpEpKNm.exe
788	STXsxYb.exe
2328	lNZhqjR.exe
2908	wtnBkua.exe
1060	gmBVtCq.exe
1844	VEReial.exe
2312	iWunbAV.exe
2264	JLucPBo.exe
1816	rxSWbqL.exe
796	EaufGZF.exe
1216	HjCFQHp.exe
1660	ypkAoEY.exe
448	ZbGLkuP.exe
3012	mqNmtuT.exe
888	xdMzbEO.exe
1584	vYTkSnu.exe
2388	WsDesNr.exe
2200	GaYTtKN.exe
2852	zQNXFZC.exe
2284	jFGtMfa.exe
240	hDbIoAK.exe
1664	VoxFhbY.exe
1600	mvTnPrN.exe
2608	KVNAWnB.exe
1624	dDgrvqZ.exe
3068	dMkWgdP.exe
2760	qoiQUCn.exe
2672	wyVJmIG.exe
2576	nSLPYPB.exe
3020	RkUfoMp.exe
1876	jiUncAN.exe
1348	LrlaEeX.exe
2916	lQyUZzh.exe

Loads dropped DLL 64 IoCs

pid	Process
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b000000015605-5.dat	upx
behavioral1/memory/2216-6-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/files/0x0009000000015c78-7.dat	upx
behavioral1/files/0x000b000000015cfe-30.dat	upx
behavioral1/files/0x0009000000015d07-39.dat	upx
behavioral1/files/0x0009000000015d1a-50.dat	upx
behavioral1/files/0x0006000000015f01-70.dat	upx
behavioral1/files/0x0007000000015d98-69.dat	upx
behavioral1/files/0x0006000000016be2-115.dat	upx
behavioral1/files/0x0006000000016cb6-140.dat	upx
behavioral1/files/0x0006000000016cc6-148.dat	upx
behavioral1/files/0x0006000000016d51-166.dat	upx
behavioral1/files/0x0006000000015df1-63.dat	upx
behavioral1/files/0x0006000000016448-92.dat	upx
behavioral1/memory/2828-222-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2500-225-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/memory/2832-234-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/files/0x00060000000165ae-101.dat	upx
behavioral1/files/0x0006000000016d57-169.dat	upx
behavioral1/files/0x0006000000016d1a-165.dat	upx
behavioral1/files/0x0006000000016d3e-162.dat	upx
behavioral1/files/0x0006000000016d16-153.dat	upx
behavioral1/files/0x0006000000016cbe-143.dat	upx
behavioral1/files/0x0006000000016ca5-137.dat	upx
behavioral1/files/0x0006000000016c51-129.dat	upx
behavioral1/files/0x0006000000016176-124.dat	upx
behavioral1/files/0x0006000000015f7a-122.dat	upx
behavioral1/files/0x0006000000016bfb-117.dat	upx
behavioral1/files/0x0006000000016a29-109.dat	upx
behavioral1/memory/2480-228-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2520-226-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2488-224-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/files/0x0006000000016e24-174.dat	upx
behavioral1/files/0x0006000000016c7c-136.dat	upx
behavioral1/files/0x0006000000016c04-128.dat	upx
behavioral1/files/0x0007000000015d31-59.dat	upx
behavioral1/files/0x00060000000167d5-108.dat	upx
behavioral1/files/0x000600000001650c-100.dat	upx
behavioral1/files/0x0006000000016287-90.dat	upx
behavioral1/files/0x00060000000160af-82.dat	upx
behavioral1/files/0x0007000000015cee-34.dat	upx
behavioral1/files/0x0007000000015d27-54.dat	upx
behavioral1/memory/2172-32-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/memory/2572-44-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/files/0x000f000000005578-38.dat	upx
behavioral1/memory/868-18-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/files/0x0008000000015cce-15.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VfRXbJu.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\xdMzbEO.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\MKXUGTH.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\ghfCUDM.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\axBNvNe.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\GvMuQBE.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\RkUfoMp.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\hSJSWks.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\hToIscA.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\CvkQCQL.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\UjgzDQt.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\nSLPYPB.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\HJGlmdM.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\zQNXFZC.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\UWCyfXs.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\huVjzHI.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\MueMBqh.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\izTZLTi.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\JLucPBo.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\lQyUZzh.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\kiLEpni.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\nlbEfNv.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\gwTtiRb.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\dwZoBIf.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\lNZhqjR.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\jiUncAN.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\pTxqLyM.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\wyVJmIG.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\ZYxHzrF.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\gmBVtCq.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\tjjteTA.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\UkYttpb.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\xxWmMuY.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\zYFfRSc.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\yuqPkCA.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\huqgUuq.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\STXsxYb.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\LrlaEeX.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\JWAbssc.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\BYkvbNg.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\XVJcpre.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\Rktoeho.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\dMkWgdP.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\tLQYQmI.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\zPxduue.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\YDFIxbo.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\GZooiym.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\oFJRWQp.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\atjKqix.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\rdxEiNg.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\QwzQIFI.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\oluKvmI.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\sqPnHxp.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\YmZSxgE.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\KIXcyjL.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\OIAxMRf.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\dhGEMUW.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\UgrkrVt.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\iWunbAV.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\dDgrvqZ.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\RModnEq.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\jGNJoDg.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\YUSVCMV.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
File created	C:\Windows\System\vdQWWWn.exe	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2548	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
Token: SeDebugPrivilege	2548	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2548	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	29
PID 2216 wrote to memory of 2548	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	29
PID 2216 wrote to memory of 2548	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	29
PID 2216 wrote to memory of 868	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	30
PID 2216 wrote to memory of 868	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	30
PID 2216 wrote to memory of 868	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2172	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	31
PID 2216 wrote to memory of 2172	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	31
PID 2216 wrote to memory of 2172	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	31
PID 2216 wrote to memory of 2572	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2572	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2572	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2832	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	33
PID 2216 wrote to memory of 2832	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	33
PID 2216 wrote to memory of 2832	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	33
PID 2216 wrote to memory of 2828	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	34
PID 2216 wrote to memory of 2828	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	34
PID 2216 wrote to memory of 2828	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	34
PID 2216 wrote to memory of 2500	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	35
PID 2216 wrote to memory of 2500	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	35
PID 2216 wrote to memory of 2500	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	35
PID 2216 wrote to memory of 2488	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	36
PID 2216 wrote to memory of 2488	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	36
PID 2216 wrote to memory of 2488	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	36
PID 2216 wrote to memory of 2520	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	37
PID 2216 wrote to memory of 2520	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	37
PID 2216 wrote to memory of 2520	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	37
PID 2216 wrote to memory of 2480	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	38
PID 2216 wrote to memory of 2480	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	38
PID 2216 wrote to memory of 2480	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	38
PID 2216 wrote to memory of 2584	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	39
PID 2216 wrote to memory of 2584	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	39
PID 2216 wrote to memory of 2584	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	39
PID 2216 wrote to memory of 2768	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	40
PID 2216 wrote to memory of 2768	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	40
PID 2216 wrote to memory of 2768	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	40
PID 2216 wrote to memory of 2928	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	41
PID 2216 wrote to memory of 2928	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	41
PID 2216 wrote to memory of 2928	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	41
PID 2216 wrote to memory of 1756	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	42
PID 2216 wrote to memory of 1756	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	42
PID 2216 wrote to memory of 1756	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	42
PID 2216 wrote to memory of 1424	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	43
PID 2216 wrote to memory of 1424	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	43
PID 2216 wrote to memory of 1424	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	43
PID 2216 wrote to memory of 2788	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	44
PID 2216 wrote to memory of 2788	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	44
PID 2216 wrote to memory of 2788	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	44
PID 2216 wrote to memory of 2356	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	45
PID 2216 wrote to memory of 2356	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	45
PID 2216 wrote to memory of 2356	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	45
PID 2216 wrote to memory of 1924	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	46
PID 2216 wrote to memory of 1924	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	46
PID 2216 wrote to memory of 1924	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	46
PID 2216 wrote to memory of 1884	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	47
PID 2216 wrote to memory of 1884	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	47
PID 2216 wrote to memory of 1884	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	47
PID 2216 wrote to memory of 1640	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	48
PID 2216 wrote to memory of 1640	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	48
PID 2216 wrote to memory of 1640	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	48
PID 2216 wrote to memory of 1880	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	49
PID 2216 wrote to memory of 1880	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	49
PID 2216 wrote to memory of 1880	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	49
PID 2216 wrote to memory of 2772	2216	0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c0948abafc64235e093f7e01cb421dd_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\System\DePBTLm.exe
  C:\Windows\System\DePBTLm.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\XVJcpre.exe
  C:\Windows\System\XVJcpre.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\rdxEiNg.exe
  C:\Windows\System\rdxEiNg.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\izTZLTi.exe
  C:\Windows\System\izTZLTi.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\XublfDO.exe
  C:\Windows\System\XublfDO.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\NrBAqBA.exe
  C:\Windows\System\NrBAqBA.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\oWevImg.exe
  C:\Windows\System\oWevImg.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\oluKvmI.exe
  C:\Windows\System\oluKvmI.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\pdIaUmU.exe
  C:\Windows\System\pdIaUmU.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\XEHiegm.exe
  C:\Windows\System\XEHiegm.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\dhGEMUW.exe
  C:\Windows\System\dhGEMUW.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\dwZoBIf.exe
  C:\Windows\System\dwZoBIf.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\sqPnHxp.exe
  C:\Windows\System\sqPnHxp.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\YUSVCMV.exe
  C:\Windows\System\YUSVCMV.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\VfRXbJu.exe
  C:\Windows\System\VfRXbJu.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\YDFIxbo.exe
  C:\Windows\System\YDFIxbo.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\ZzWfrQr.exe
  C:\Windows\System\ZzWfrQr.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\Rktoeho.exe
  C:\Windows\System\Rktoeho.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\JhCfkts.exe
  C:\Windows\System\JhCfkts.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\UGdqZcn.exe
  C:\Windows\System\UGdqZcn.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\YmZSxgE.exe
  C:\Windows\System\YmZSxgE.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\wtnBkua.exe
  C:\Windows\System\wtnBkua.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\WQYGpcD.exe
  C:\Windows\System\WQYGpcD.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\VEReial.exe
  C:\Windows\System\VEReial.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\ZXvnnCH.exe
  C:\Windows\System\ZXvnnCH.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\iWunbAV.exe
  C:\Windows\System\iWunbAV.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\zgmLhmG.exe
  C:\Windows\System\zgmLhmG.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\JLucPBo.exe
  C:\Windows\System\JLucPBo.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\xolfzGc.exe
  C:\Windows\System\xolfzGc.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\rxSWbqL.exe
  C:\Windows\System\rxSWbqL.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\GvMuQBE.exe
  C:\Windows\System\GvMuQBE.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\EaufGZF.exe
  C:\Windows\System\EaufGZF.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\huqgUuq.exe
  C:\Windows\System\huqgUuq.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\HjCFQHp.exe
  C:\Windows\System\HjCFQHp.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\ZnqfHhe.exe
  C:\Windows\System\ZnqfHhe.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\ypkAoEY.exe
  C:\Windows\System\ypkAoEY.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\vdQWWWn.exe
  C:\Windows\System\vdQWWWn.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\ZbGLkuP.exe
  C:\Windows\System\ZbGLkuP.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\UjgzDQt.exe
  C:\Windows\System\UjgzDQt.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\mqNmtuT.exe
  C:\Windows\System\mqNmtuT.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\LcjQvPs.exe
  C:\Windows\System\LcjQvPs.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\xdMzbEO.exe
  C:\Windows\System\xdMzbEO.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\XpEpKNm.exe
  C:\Windows\System\XpEpKNm.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\vYTkSnu.exe
  C:\Windows\System\vYTkSnu.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\STXsxYb.exe
  C:\Windows\System\STXsxYb.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\WsDesNr.exe
  C:\Windows\System\WsDesNr.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\lNZhqjR.exe
  C:\Windows\System\lNZhqjR.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\zQNXFZC.exe
  C:\Windows\System\zQNXFZC.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\gmBVtCq.exe
  C:\Windows\System\gmBVtCq.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\jFGtMfa.exe
  C:\Windows\System\jFGtMfa.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\GaYTtKN.exe
  C:\Windows\System\GaYTtKN.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\hDbIoAK.exe
  C:\Windows\System\hDbIoAK.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\VoxFhbY.exe
  C:\Windows\System\VoxFhbY.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\dDgrvqZ.exe
  C:\Windows\System\dDgrvqZ.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\mvTnPrN.exe
  C:\Windows\System\mvTnPrN.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\dMkWgdP.exe
  C:\Windows\System\dMkWgdP.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\KVNAWnB.exe
  C:\Windows\System\KVNAWnB.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\wyVJmIG.exe
  C:\Windows\System\wyVJmIG.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\qoiQUCn.exe
  C:\Windows\System\qoiQUCn.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\nSLPYPB.exe
  C:\Windows\System\nSLPYPB.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\RkUfoMp.exe
  C:\Windows\System\RkUfoMp.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\jiUncAN.exe
  C:\Windows\System\jiUncAN.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\LrlaEeX.exe
  C:\Windows\System\LrlaEeX.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\lQyUZzh.exe
  C:\Windows\System\lQyUZzh.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\KIXcyjL.exe
  C:\Windows\System\KIXcyjL.exe
  2⤵
  PID:1860
- C:\Windows\System\HrXSmdD.exe
  C:\Windows\System\HrXSmdD.exe
  2⤵
  PID:2420
- C:\Windows\System\TbsznEz.exe
  C:\Windows\System\TbsznEz.exe
  2⤵
  PID:656
- C:\Windows\System\kiLEpni.exe
  C:\Windows\System\kiLEpni.exe
  2⤵
  PID:108
- C:\Windows\System\GZooiym.exe
  C:\Windows\System\GZooiym.exe
  2⤵
  PID:1580
- C:\Windows\System\TtNoKmL.exe
  C:\Windows\System\TtNoKmL.exe
  2⤵
  PID:1116
- C:\Windows\System\MKXUGTH.exe
  C:\Windows\System\MKXUGTH.exe
  2⤵
  PID:2508
- C:\Windows\System\eEbdErz.exe
  C:\Windows\System\eEbdErz.exe
  2⤵
  PID:2532
- C:\Windows\System\siZBbMO.exe
  C:\Windows\System\siZBbMO.exe
  2⤵
  PID:1904
- C:\Windows\System\sNzrYBa.exe
  C:\Windows\System\sNzrYBa.exe
  2⤵
  PID:1108
- C:\Windows\System\hSJSWks.exe
  C:\Windows\System\hSJSWks.exe
  2⤵
  PID:1868
- C:\Windows\System\qyJNrLU.exe
  C:\Windows\System\qyJNrLU.exe
  2⤵
  PID:2176
- C:\Windows\System\tjjteTA.exe
  C:\Windows\System\tjjteTA.exe
  2⤵
  PID:2656
- C:\Windows\System\QwzQIFI.exe
  C:\Windows\System\QwzQIFI.exe
  2⤵
  PID:2736
- C:\Windows\System\dHNKkeP.exe
  C:\Windows\System\dHNKkeP.exe
  2⤵
  PID:1620
- C:\Windows\System\stwRBjA.exe
  C:\Windows\System\stwRBjA.exe
  2⤵
  PID:2688
- C:\Windows\System\oFJRWQp.exe
  C:\Windows\System\oFJRWQp.exe
  2⤵
  PID:2924
- C:\Windows\System\blCNfXR.exe
  C:\Windows\System\blCNfXR.exe
  2⤵
  PID:816
- C:\Windows\System\ZYxHzrF.exe
  C:\Windows\System\ZYxHzrF.exe
  2⤵
  PID:1240
- C:\Windows\System\HJGlmdM.exe
  C:\Windows\System\HJGlmdM.exe
  2⤵
  PID:312
- C:\Windows\System\APHzmqM.exe
  C:\Windows\System\APHzmqM.exe
  2⤵
  PID:2448
- C:\Windows\System\yuGoJGX.exe
  C:\Windows\System\yuGoJGX.exe
  2⤵
  PID:1740
- C:\Windows\System\iQNOGVh.exe
  C:\Windows\System\iQNOGVh.exe
  2⤵
  PID:2268
- C:\Windows\System\hToIscA.exe
  C:\Windows\System\hToIscA.exe
  2⤵
  PID:1560
- C:\Windows\System\UkYttpb.exe
  C:\Windows\System\UkYttpb.exe
  2⤵
  PID:1176
- C:\Windows\System\drMzneG.exe
  C:\Windows\System\drMzneG.exe
  2⤵
  PID:1056
- C:\Windows\System\KHQNQmF.exe
  C:\Windows\System\KHQNQmF.exe
  2⤵
  PID:3040
- C:\Windows\System\nlbEfNv.exe
  C:\Windows\System\nlbEfNv.exe
  2⤵
  PID:2844
- C:\Windows\System\gZbjiIn.exe
  C:\Windows\System\gZbjiIn.exe
  2⤵
  PID:2764
- C:\Windows\System\QEzIckQ.exe
  C:\Windows\System\QEzIckQ.exe
  2⤵
  PID:1768
- C:\Windows\System\ueHHGFX.exe
  C:\Windows\System\ueHHGFX.exe
  2⤵
  PID:900
- C:\Windows\System\xuiKGUg.exe
  C:\Windows\System\xuiKGUg.exe
  2⤵
  PID:2864
- C:\Windows\System\xxWmMuY.exe
  C:\Windows\System\xxWmMuY.exe
  2⤵
  PID:2984
- C:\Windows\System\UWCyfXs.exe
  C:\Windows\System\UWCyfXs.exe
  2⤵
  PID:1288
- C:\Windows\System\OSCwaSP.exe
  C:\Windows\System\OSCwaSP.exe
  2⤵
  PID:784
- C:\Windows\System\RModnEq.exe
  C:\Windows\System\RModnEq.exe
  2⤵
  PID:2628
- C:\Windows\System\JWAbssc.exe
  C:\Windows\System\JWAbssc.exe
  2⤵
  PID:2060
- C:\Windows\System\ghfCUDM.exe
  C:\Windows\System\ghfCUDM.exe
  2⤵
  PID:608
- C:\Windows\System\FBngozo.exe
  C:\Windows\System\FBngozo.exe
  2⤵
  PID:1360
- C:\Windows\System\tLQYQmI.exe
  C:\Windows\System\tLQYQmI.exe
  2⤵
  PID:1448
- C:\Windows\System\kvmYYNp.exe
  C:\Windows\System\kvmYYNp.exe
  2⤵
  PID:1352
- C:\Windows\System\gwTtiRb.exe
  C:\Windows\System\gwTtiRb.exe
  2⤵
  PID:2968
- C:\Windows\System\XZGohsx.exe
  C:\Windows\System\XZGohsx.exe
  2⤵
  PID:1764
- C:\Windows\System\axBNvNe.exe
  C:\Windows\System\axBNvNe.exe
  2⤵
  PID:2116
- C:\Windows\System\pexNqQg.exe
  C:\Windows\System\pexNqQg.exe
  2⤵
  PID:1084
- C:\Windows\System\RybtqdC.exe
  C:\Windows\System\RybtqdC.exe
  2⤵
  PID:1996
- C:\Windows\System\GZlucdx.exe
  C:\Windows\System\GZlucdx.exe
  2⤵
  PID:1752
- C:\Windows\System\qswmFdC.exe
  C:\Windows\System\qswmFdC.exe
  2⤵
  PID:1564
- C:\Windows\System\zPxduue.exe
  C:\Windows\System\zPxduue.exe
  2⤵
  PID:2664
- C:\Windows\System\ZOIdbzJ.exe
  C:\Windows\System\ZOIdbzJ.exe
  2⤵
  PID:3008
- C:\Windows\System\OqgailZ.exe
  C:\Windows\System\OqgailZ.exe
  2⤵
  PID:1960
- C:\Windows\System\pTxqLyM.exe
  C:\Windows\System\pTxqLyM.exe
  2⤵
  PID:2944
- C:\Windows\System\UgrkrVt.exe
  C:\Windows\System\UgrkrVt.exe
  2⤵
  PID:2604
- C:\Windows\System\zYFfRSc.exe
  C:\Windows\System\zYFfRSc.exe
  2⤵
  PID:2492
- C:\Windows\System\IcubDGu.exe
  C:\Windows\System\IcubDGu.exe
  2⤵
  PID:1132
- C:\Windows\System\BYkvbNg.exe
  C:\Windows\System\BYkvbNg.exe
  2⤵
  PID:3184
- C:\Windows\System\TINHSVh.exe
  C:\Windows\System\TINHSVh.exe
  2⤵
  PID:3200
- C:\Windows\System\atjKqix.exe
  C:\Windows\System\atjKqix.exe
  2⤵
  PID:3216
- C:\Windows\System\PRPLIKj.exe
  C:\Windows\System\PRPLIKj.exe
  2⤵
  PID:3236
- C:\Windows\System\yuqPkCA.exe
  C:\Windows\System\yuqPkCA.exe
  2⤵
  PID:3252
- C:\Windows\System\GigLdQj.exe
  C:\Windows\System\GigLdQj.exe
  2⤵
  PID:3276
- C:\Windows\System\OIAxMRf.exe
  C:\Windows\System\OIAxMRf.exe
  2⤵
  PID:3292
- C:\Windows\System\jGNJoDg.exe
  C:\Windows\System\jGNJoDg.exe
  2⤵
  PID:3308
- C:\Windows\System\MueMBqh.exe
  C:\Windows\System\MueMBqh.exe
  2⤵
  PID:3324
- C:\Windows\System\CvkQCQL.exe
  C:\Windows\System\CvkQCQL.exe
  2⤵
  PID:3340
- C:\Windows\System\huVjzHI.exe
  C:\Windows\System\huVjzHI.exe
  2⤵
  PID:3356
- C:\Windows\System\NrNccze.exe
  C:\Windows\System\NrNccze.exe
  2⤵
  PID:3372
- C:\Windows\System\zwvopcS.exe
  C:\Windows\System\zwvopcS.exe
  2⤵
  PID:3392
- C:\Windows\System\jNYytgY.exe
  C:\Windows\System\jNYytgY.exe
  2⤵
  PID:3408
- C:\Windows\System\uXDhvbq.exe
  C:\Windows\System\uXDhvbq.exe
  2⤵
  PID:3424
- C:\Windows\System\bJEpmlZ.exe
  C:\Windows\System\bJEpmlZ.exe
  2⤵
  PID:3440
- C:\Windows\System\HOrPdtW.exe
  C:\Windows\System\HOrPdtW.exe
  2⤵
  PID:3456
- C:\Windows\System\ozvRrEO.exe
  C:\Windows\System\ozvRrEO.exe
  2⤵
  PID:3472
- C:\Windows\System\aeppbxo.exe
  C:\Windows\System\aeppbxo.exe
  2⤵
  PID:3488
- C:\Windows\System\YCrTpXP.exe
  C:\Windows\System\YCrTpXP.exe
  2⤵
  PID:3504
- C:\Windows\System\EMjeTgg.exe
  C:\Windows\System\EMjeTgg.exe
  2⤵
  PID:3524
- C:\Windows\System\RebydUw.exe
  C:\Windows\System\RebydUw.exe
  2⤵
  PID:3540
- C:\Windows\System\tjdwtBt.exe
  C:\Windows\System\tjdwtBt.exe
  2⤵
  PID:3556
- C:\Windows\System\ObWleUw.exe
  C:\Windows\System\ObWleUw.exe
  2⤵
  PID:3572
- C:\Windows\System\yolNWOl.exe
  C:\Windows\System\yolNWOl.exe
  2⤵
  PID:3588
- C:\Windows\System\LKVjwBK.exe
  C:\Windows\System\LKVjwBK.exe
  2⤵
  PID:3608
- C:\Windows\System\uwpAINH.exe
  C:\Windows\System\uwpAINH.exe
  2⤵
  PID:3624
- C:\Windows\System\adewWTP.exe
  C:\Windows\System\adewWTP.exe
  2⤵
  PID:3640
- C:\Windows\System\yEIdekv.exe
  C:\Windows\System\yEIdekv.exe
  2⤵
  PID:3656
- C:\Windows\System\BdovcHh.exe
  C:\Windows\System\BdovcHh.exe
  2⤵
  PID:3672
- C:\Windows\System\bHHOsXf.exe
  C:\Windows\System\bHHOsXf.exe
  2⤵
  PID:3688
- C:\Windows\System\pEPyJTi.exe
  C:\Windows\System\pEPyJTi.exe
  2⤵
  PID:3704
- C:\Windows\System\SzxIVdI.exe
  C:\Windows\System\SzxIVdI.exe
  2⤵
  PID:3724
- C:\Windows\System\rZyYceK.exe
  C:\Windows\System\rZyYceK.exe
  2⤵
  PID:3740
- C:\Windows\System\WFBaXvB.exe
  C:\Windows\System\WFBaXvB.exe
  2⤵
  PID:3756
- C:\Windows\System\TKVJIqx.exe
  C:\Windows\System\TKVJIqx.exe
  2⤵
  PID:3772
- C:\Windows\System\MHsQuCy.exe
  C:\Windows\System\MHsQuCy.exe
  2⤵
  PID:3788
- C:\Windows\System\OPkWxNA.exe
  C:\Windows\System\OPkWxNA.exe
  2⤵
  PID:3804
- C:\Windows\System\BAtWQAx.exe
  C:\Windows\System\BAtWQAx.exe
  2⤵
  PID:3820
- C:\Windows\System\SUAEmzK.exe
  C:\Windows\System\SUAEmzK.exe
  2⤵
  PID:3836
- C:\Windows\System\TQBnmOo.exe
  C:\Windows\System\TQBnmOo.exe
  2⤵
  PID:3856
- C:\Windows\System\tHUYhhi.exe
  C:\Windows\System\tHUYhhi.exe
  2⤵
  PID:3872
- C:\Windows\System\HqhKGew.exe
  C:\Windows\System\HqhKGew.exe
  2⤵
  PID:3888
- C:\Windows\System\ZmCJpPl.exe
  C:\Windows\System\ZmCJpPl.exe
  2⤵
  PID:3904
- C:\Windows\System\LCRHcGv.exe
  C:\Windows\System\LCRHcGv.exe
  2⤵
  PID:3920
- C:\Windows\System\JRcKHmu.exe
  C:\Windows\System\JRcKHmu.exe
  2⤵
  PID:3936
- C:\Windows\System\aLxZWew.exe
  C:\Windows\System\aLxZWew.exe
  2⤵
  PID:3952
- C:\Windows\System\DbjagsS.exe
  C:\Windows\System\DbjagsS.exe
  2⤵
  PID:3972
- C:\Windows\System\ihRyIpa.exe
  C:\Windows\System\ihRyIpa.exe
  2⤵
  PID:3988
- C:\Windows\System\qxrkkcR.exe
  C:\Windows\System\qxrkkcR.exe
  2⤵
  PID:4004
- C:\Windows\System\CANxlul.exe
  C:\Windows\System\CANxlul.exe
  2⤵
  PID:4020
- C:\Windows\System\kgQarHE.exe
  C:\Windows\System\kgQarHE.exe
  2⤵
  PID:4036
- C:\Windows\System\CgGbDpF.exe
  C:\Windows\System\CgGbDpF.exe
  2⤵
  PID:4052
- C:\Windows\System\WudtfXH.exe
  C:\Windows\System\WudtfXH.exe
  2⤵
  PID:4068
- C:\Windows\System\YfftaPf.exe
  C:\Windows\System\YfftaPf.exe
  2⤵
  PID:908
- C:\Windows\System\fNvXgcn.exe
  C:\Windows\System\fNvXgcn.exe
  2⤵
  PID:2756
- C:\Windows\System\LuRrOAI.exe
  C:\Windows\System\LuRrOAI.exe
  2⤵
  PID:2720
- C:\Windows\System\CdFZVMl.exe
  C:\Windows\System\CdFZVMl.exe
  2⤵
  PID:3268
- C:\Windows\System\WqNfKPC.exe
  C:\Windows\System\WqNfKPC.exe
  2⤵
  PID:3400
- C:\Windows\System\hYvzDby.exe
  C:\Windows\System\hYvzDby.exe
  2⤵
  PID:3436
- C:\Windows\System\YKrEAWd.exe
  C:\Windows\System\YKrEAWd.exe
  2⤵
  PID:1120
- C:\Windows\System\wJXxlqK.exe
  C:\Windows\System\wJXxlqK.exe
  2⤵
  PID:708
- C:\Windows\System\sJCJhIG.exe
  C:\Windows\System\sJCJhIG.exe
  2⤵
  PID:3500
- C:\Windows\System\OSfQoMr.exe
  C:\Windows\System\OSfQoMr.exe
  2⤵
  PID:3596
- C:\Windows\System\EVnjioS.exe
  C:\Windows\System\EVnjioS.exe
  2⤵
  PID:3668
- C:\Windows\System\UPuahQv.exe
  C:\Windows\System\UPuahQv.exe
  2⤵
  PID:3732
- C:\Windows\System\OinGOfY.exe
  C:\Windows\System\OinGOfY.exe
  2⤵
  PID:3828
- C:\Windows\System\vEwNrKA.exe
  C:\Windows\System\vEwNrKA.exe
  2⤵
  PID:3864
- C:\Windows\System\VmKXByi.exe
  C:\Windows\System\VmKXByi.exe
  2⤵
  PID:3960
- C:\Windows\System\YpmByrC.exe
  C:\Windows\System\YpmByrC.exe
  2⤵
  PID:4028
- C:\Windows\System\dQQkfcP.exe
  C:\Windows\System\dQQkfcP.exe
  2⤵
  PID:4064
- C:\Windows\System\LVpNlGN.exe
  C:\Windows\System\LVpNlGN.exe
  2⤵
  PID:2496
- C:\Windows\System\WDgvJUe.exe
  C:\Windows\System\WDgvJUe.exe
  2⤵
  PID:2920
- C:\Windows\System\ixeBkMS.exe
  C:\Windows\System\ixeBkMS.exe
  2⤵
  PID:3096
- C:\Windows\System\lTuzAdv.exe
  C:\Windows\System\lTuzAdv.exe
  2⤵
  PID:3112
- C:\Windows\System\esizpWv.exe
  C:\Windows\System\esizpWv.exe
  2⤵
  PID:3128
- C:\Windows\System\BihwwrZ.exe
  C:\Windows\System\BihwwrZ.exe
  2⤵
  PID:3144
- C:\Windows\System\iLEjIqr.exe
  C:\Windows\System\iLEjIqr.exe
  2⤵
  PID:3352
- C:\Windows\System\sRNWqbz.exe
  C:\Windows\System\sRNWqbz.exe
  2⤵
  PID:3416
- C:\Windows\System\XtPDsdT.exe
  C:\Windows\System\XtPDsdT.exe
  2⤵
  PID:3480
- C:\Windows\System\tYuUbyL.exe
  C:\Windows\System\tYuUbyL.exe
  2⤵
  PID:3520
- C:\Windows\System\rXmpWqC.exe
  C:\Windows\System\rXmpWqC.exe
  2⤵
  PID:3584
- C:\Windows\System\vOOHbuP.exe
  C:\Windows\System\vOOHbuP.exe
  2⤵
  PID:3652
- C:\Windows\System\cfkOTNU.exe
  C:\Windows\System\cfkOTNU.exe
  2⤵
  PID:3716
- C:\Windows\System\tGVzdLr.exe
  C:\Windows\System\tGVzdLr.exe
  2⤵
  PID:3496
- C:\Windows\System\HLtxYhd.exe
  C:\Windows\System\HLtxYhd.exe
  2⤵
  PID:3752
- C:\Windows\System\GqAAoZn.exe
  C:\Windows\System\GqAAoZn.exe
  2⤵
  PID:3844
- C:\Windows\System\PPUZTMY.exe
  C:\Windows\System\PPUZTMY.exe
  2⤵
  PID:3912
- C:\Windows\System\epzfniH.exe
  C:\Windows\System\epzfniH.exe
  2⤵
  PID:3948
- C:\Windows\System\anyyUfz.exe
  C:\Windows\System\anyyUfz.exe
  2⤵
  PID:4016
- C:\Windows\System\oYIehyK.exe
  C:\Windows\System\oYIehyK.exe
  2⤵
  PID:4080
- C:\Windows\System\aEjNasK.exe
  C:\Windows\System\aEjNasK.exe
  2⤵
  PID:1772
- C:\Windows\System\OXbmEQS.exe
  C:\Windows\System\OXbmEQS.exe
  2⤵
  PID:1736
- C:\Windows\System\ghUdiQr.exe
  C:\Windows\System\ghUdiQr.exe
  2⤵
  PID:2092
- C:\Windows\System\ZXZGBeP.exe
  C:\Windows\System\ZXZGBeP.exe
  2⤵
  PID:2952
- C:\Windows\System\lnybenC.exe
  C:\Windows\System\lnybenC.exe
  2⤵
  PID:1076
- C:\Windows\System\GemgzaJ.exe
  C:\Windows\System\GemgzaJ.exe
  2⤵
  PID:3032
- C:\Windows\System\GNCYNAs.exe
  C:\Windows\System\GNCYNAs.exe
  2⤵
  PID:2600
- C:\Windows\System\JFdbfcZ.exe
  C:\Windows\System\JFdbfcZ.exe
  2⤵
  PID:2040
- C:\Windows\System\SQNcfGn.exe
  C:\Windows\System\SQNcfGn.exe
  2⤵
  PID:2432
- C:\Windows\System\JUTheSH.exe
  C:\Windows\System\JUTheSH.exe
  2⤵
  PID:1820
- C:\Windows\System\lAYYcSd.exe
  C:\Windows\System\lAYYcSd.exe
  2⤵
  PID:1840
- C:\Windows\System\CyVmBhx.exe
  C:\Windows\System\CyVmBhx.exe
  2⤵
  PID:956
- C:\Windows\System\uPBvYbw.exe
  C:\Windows\System\uPBvYbw.exe
  2⤵
  PID:648
- C:\Windows\System\kHDnRUV.exe
  C:\Windows\System\kHDnRUV.exe
  2⤵
  PID:1700
- C:\Windows\System\yFKbMBK.exe
  C:\Windows\System\yFKbMBK.exe
  2⤵
  PID:1436
- C:\Windows\System\QzTRmua.exe
  C:\Windows\System\QzTRmua.exe
  2⤵
  PID:2540
- C:\Windows\System\nIogcLF.exe
  C:\Windows\System\nIogcLF.exe
  2⤵
  PID:1728
- C:\Windows\System\SsbeUyX.exe
  C:\Windows\System\SsbeUyX.exe
  2⤵
  PID:3224
- C:\Windows\System\HWvcOwC.exe
  C:\Windows\System\HWvcOwC.exe
  2⤵
  PID:1920
- C:\Windows\System\BtYFTOr.exe
  C:\Windows\System\BtYFTOr.exe
  2⤵
  PID:4060
- C:\Windows\System\dkskdrH.exe
  C:\Windows\System\dkskdrH.exe
  2⤵
  PID:3108
- C:\Windows\System\ytJqLvh.exe
  C:\Windows\System\ytJqLvh.exe
  2⤵
  PID:3968
- C:\Windows\System\LoJRqog.exe
  C:\Windows\System\LoJRqog.exe
  2⤵
  PID:2804
- C:\Windows\System\mPlwYeg.exe
  C:\Windows\System\mPlwYeg.exe
  2⤵
  PID:3124
- C:\Windows\System\sUIXCWJ.exe
  C:\Windows\System\sUIXCWJ.exe
  2⤵
  PID:3168
- C:\Windows\System\VwrpsHk.exe
  C:\Windows\System\VwrpsHk.exe
  2⤵
  PID:3208
- C:\Windows\System\xLJjEiX.exe
  C:\Windows\System\xLJjEiX.exe
  2⤵
  PID:3288
- C:\Windows\System\bzhKkjI.exe
  C:\Windows\System\bzhKkjI.exe
  2⤵
  PID:3348
- C:\Windows\System\sEuKVJB.exe
  C:\Windows\System\sEuKVJB.exe
  2⤵
  PID:1668
- C:\Windows\System\qmKGXLu.exe
  C:\Windows\System\qmKGXLu.exe
  2⤵
  PID:3684
- C:\Windows\System\eyjaKnn.exe
  C:\Windows\System\eyjaKnn.exe
  2⤵
  PID:3880
- C:\Windows\System\xDdJKmD.exe
  C:\Windows\System\xDdJKmD.exe
  2⤵
  PID:1940
- C:\Windows\System\uAtixFT.exe
  C:\Windows\System\uAtixFT.exe
  2⤵
  PID:3928
- C:\Windows\System\UxvLWPp.exe
  C:\Windows\System\UxvLWPp.exe
  2⤵
  PID:2164
- C:\Windows\System\zAvUbGp.exe
  C:\Windows\System\zAvUbGp.exe
  2⤵
  PID:2712
- C:\Windows\System\OJJyjAm.exe
  C:\Windows\System\OJJyjAm.exe
  2⤵
  PID:4012
- C:\Windows\System\PLgJcGX.exe
  C:\Windows\System\PLgJcGX.exe
  2⤵
  PID:568
- C:\Windows\System\ZUSCSCC.exe
  C:\Windows\System\ZUSCSCC.exe
  2⤵
  PID:3516
- C:\Windows\System\OFMWBdl.exe
  C:\Windows\System\OFMWBdl.exe
  2⤵
  PID:3784
- C:\Windows\System\oZvIeMg.exe
  C:\Windows\System\oZvIeMg.exe
  2⤵
  PID:3944
- C:\Windows\System\dUbNLGS.exe
  C:\Windows\System\dUbNLGS.exe
  2⤵
  PID:2408
- C:\Windows\System\YafwFwv.exe
  C:\Windows\System\YafwFwv.exe
  2⤵
  PID:2072
- C:\Windows\System\JyoeTKW.exe
  C:\Windows\System\JyoeTKW.exe
  2⤵
  PID:1720
- C:\Windows\System\gNiEXUK.exe
  C:\Windows\System\gNiEXUK.exe
  2⤵
  PID:1828
- C:\Windows\System\PnDFQSQ.exe
  C:\Windows\System\PnDFQSQ.exe
  2⤵
  PID:576
- C:\Windows\System\ehdMcSv.exe
  C:\Windows\System\ehdMcSv.exe
  2⤵
  PID:3364
- C:\Windows\System\TrJqplb.exe
  C:\Windows\System\TrJqplb.exe
  2⤵
  PID:2796
- C:\Windows\System\zqxdCub.exe
  C:\Windows\System\zqxdCub.exe
  2⤵
  PID:3244
- C:\Windows\System\ErWOPoZ.exe
  C:\Windows\System\ErWOPoZ.exe
  2⤵
  PID:4108
- C:\Windows\System\ILUVgvj.exe
  C:\Windows\System\ILUVgvj.exe
  2⤵
  PID:4124
- C:\Windows\System\HKOGPEr.exe
  C:\Windows\System\HKOGPEr.exe
  2⤵
  PID:4144
- C:\Windows\System\vGRMIQf.exe
  C:\Windows\System\vGRMIQf.exe
  2⤵
  PID:4160
- C:\Windows\System\jbnmdiX.exe
  C:\Windows\System\jbnmdiX.exe
  2⤵
  PID:4176
- C:\Windows\System\llALZeF.exe
  C:\Windows\System\llALZeF.exe
  2⤵
  PID:4192
- C:\Windows\System\yrHajhs.exe
  C:\Windows\System\yrHajhs.exe
  2⤵
  PID:4212
- C:\Windows\System\qbDzKmq.exe
  C:\Windows\System\qbDzKmq.exe
  2⤵
  PID:4228
- C:\Windows\System\vCwMmUZ.exe
  C:\Windows\System\vCwMmUZ.exe
  2⤵
  PID:4244
- C:\Windows\System\ivdCqsV.exe
  C:\Windows\System\ivdCqsV.exe
  2⤵
  PID:4260
- C:\Windows\System\DtXPMuA.exe
  C:\Windows\System\DtXPMuA.exe
  2⤵
  PID:4276
- C:\Windows\System\XYsxNgT.exe
  C:\Windows\System\XYsxNgT.exe
  2⤵
  PID:4292
- C:\Windows\System\pqYRymc.exe
  C:\Windows\System\pqYRymc.exe
  2⤵
  PID:4308
- C:\Windows\System\ILHoPcW.exe
  C:\Windows\System\ILHoPcW.exe
  2⤵
  PID:4324
- C:\Windows\System\tskyGwD.exe
  C:\Windows\System\tskyGwD.exe
  2⤵
  PID:4344
- C:\Windows\System\QyxLLXO.exe
  C:\Windows\System\QyxLLXO.exe
  2⤵
  PID:4360
- C:\Windows\System\JoPINQm.exe
  C:\Windows\System\JoPINQm.exe
  2⤵
  PID:4376
- C:\Windows\System\eenPoSE.exe
  C:\Windows\System\eenPoSE.exe
  2⤵
  PID:4392
- C:\Windows\System\WLfugwm.exe
  C:\Windows\System\WLfugwm.exe
  2⤵
  PID:4408
- C:\Windows\System\DHIOEiF.exe
  C:\Windows\System\DHIOEiF.exe
  2⤵
  PID:4424
- C:\Windows\System\xhaRQlZ.exe
  C:\Windows\System\xhaRQlZ.exe
  2⤵
  PID:4444
- C:\Windows\System\wSSWkWj.exe
  C:\Windows\System\wSSWkWj.exe
  2⤵
  PID:4460
- C:\Windows\System\yJjkVEi.exe
  C:\Windows\System\yJjkVEi.exe
  2⤵
  PID:4476
- C:\Windows\System\fmVGrxe.exe
  C:\Windows\System\fmVGrxe.exe
  2⤵
  PID:4492
- C:\Windows\System\HXoJDFK.exe
  C:\Windows\System\HXoJDFK.exe
  2⤵
  PID:4508
- C:\Windows\System\jSDWpXc.exe
  C:\Windows\System\jSDWpXc.exe
  2⤵
  PID:4524
- C:\Windows\System\jZvEsHk.exe
  C:\Windows\System\jZvEsHk.exe
  2⤵
  PID:4540
- C:\Windows\System\zBFGBEQ.exe
  C:\Windows\System\zBFGBEQ.exe
  2⤵
  PID:4556
- C:\Windows\System\uBwRlMJ.exe
  C:\Windows\System\uBwRlMJ.exe
  2⤵
  PID:4572
- C:\Windows\System\vMEVhmY.exe
  C:\Windows\System\vMEVhmY.exe
  2⤵
  PID:4588
- C:\Windows\System\GXqTGvG.exe
  C:\Windows\System\GXqTGvG.exe
  2⤵
  PID:4604
- C:\Windows\System\jLRmllc.exe
  C:\Windows\System\jLRmllc.exe
  2⤵
  PID:4620
- C:\Windows\System\moiNoPV.exe
  C:\Windows\System\moiNoPV.exe
  2⤵
  PID:4636
- C:\Windows\System\YZLmFnz.exe
  C:\Windows\System\YZLmFnz.exe
  2⤵
  PID:4652
- C:\Windows\System\PsRYxRe.exe
  C:\Windows\System\PsRYxRe.exe
  2⤵
  PID:4668
- C:\Windows\System\MKZZpAt.exe
  C:\Windows\System\MKZZpAt.exe
  2⤵
  PID:4688
- C:\Windows\System\HYnboLX.exe
  C:\Windows\System\HYnboLX.exe
  2⤵
  PID:4704
- C:\Windows\System\PGhATCu.exe
  C:\Windows\System\PGhATCu.exe
  2⤵
  PID:4724
- C:\Windows\System\VZAyqqG.exe
  C:\Windows\System\VZAyqqG.exe
  2⤵
  PID:4744
- C:\Windows\System\IWZZHtN.exe
  C:\Windows\System\IWZZHtN.exe
  2⤵
  PID:4760
- C:\Windows\System\VdIOxYX.exe
  C:\Windows\System\VdIOxYX.exe
  2⤵
  PID:4776
- C:\Windows\System\hjNjHuB.exe
  C:\Windows\System\hjNjHuB.exe
  2⤵
  PID:4792
- C:\Windows\System\uqxYSRI.exe
  C:\Windows\System\uqxYSRI.exe
  2⤵
  PID:4808
- C:\Windows\System\WMMzsgX.exe
  C:\Windows\System\WMMzsgX.exe
  2⤵
  PID:4824
- C:\Windows\System\xLOYBAF.exe
  C:\Windows\System\xLOYBAF.exe
  2⤵
  PID:4912
- C:\Windows\System\MzicsKm.exe
  C:\Windows\System\MzicsKm.exe
  2⤵
  PID:4928
- C:\Windows\System\piKkpQl.exe
  C:\Windows\System\piKkpQl.exe
  2⤵
  PID:4948
- C:\Windows\System\aaQltZW.exe
  C:\Windows\System\aaQltZW.exe
  2⤵
  PID:4964
- C:\Windows\System\lBzlOPG.exe
  C:\Windows\System\lBzlOPG.exe
  2⤵
  PID:4980
- C:\Windows\System\jbTeXRF.exe
  C:\Windows\System\jbTeXRF.exe
  2⤵
  PID:4996
- C:\Windows\System\HxhGtCl.exe
  C:\Windows\System\HxhGtCl.exe
  2⤵
  PID:5012
- C:\Windows\System\ERgtjhW.exe
  C:\Windows\System\ERgtjhW.exe
  2⤵
  PID:5028
- C:\Windows\System\ZjvrOPW.exe
  C:\Windows\System\ZjvrOPW.exe
  2⤵
  PID:5048
- C:\Windows\System\kFzHCZr.exe
  C:\Windows\System\kFzHCZr.exe
  2⤵
  PID:5064
- C:\Windows\System\nGTbUEC.exe
  C:\Windows\System\nGTbUEC.exe
  2⤵
  PID:5080
- C:\Windows\System\hdyVKNu.exe
  C:\Windows\System\hdyVKNu.exe
  2⤵
  PID:692
- C:\Windows\System\SWqojNF.exe
  C:\Windows\System\SWqojNF.exe
  2⤵
  PID:4300
- C:\Windows\System\IlyqfAj.exe
  C:\Windows\System\IlyqfAj.exe
  2⤵
  PID:4504
- C:\Windows\System\zhFiRMX.exe
  C:\Windows\System\zhFiRMX.exe
  2⤵
  PID:3664
- C:\Windows\System\nJxQuZx.exe
  C:\Windows\System\nJxQuZx.exe
  2⤵
  PID:540
- C:\Windows\System\vpfKGEW.exe
  C:\Windows\System\vpfKGEW.exe
  2⤵
  PID:3996
- C:\Windows\System\coGYYfv.exe
  C:\Windows\System\coGYYfv.exe
  2⤵
  PID:4580
- C:\Windows\System\vgtIwfd.exe
  C:\Windows\System\vgtIwfd.exe
  2⤵
  PID:4596
- C:\Windows\System\cyUlPjY.exe
  C:\Windows\System\cyUlPjY.exe
  2⤵
  PID:4676
- C:\Windows\System\ZPqPEac.exe
  C:\Windows\System\ZPqPEac.exe
  2⤵
  PID:3120
- C:\Windows\System\XNQTOyU.exe
  C:\Windows\System\XNQTOyU.exe
  2⤵
  PID:3316
- C:\Windows\System\azkgKxE.exe
  C:\Windows\System\azkgKxE.exe
  2⤵
  PID:2800
- C:\Windows\System\mPCDDaj.exe
  C:\Windows\System\mPCDDaj.exe
  2⤵
  PID:1788
- C:\Windows\System\fuANPpL.exe
  C:\Windows\System\fuANPpL.exe
  2⤵
  PID:2472
- C:\Windows\System\QfNVWqg.exe
  C:\Windows\System\QfNVWqg.exe
  2⤵
  PID:3432
- C:\Windows\System\azMoTSu.exe
  C:\Windows\System\azMoTSu.exe
  2⤵
  PID:4120
- C:\Windows\System\vBOWxhv.exe
  C:\Windows\System\vBOWxhv.exe
  2⤵
  PID:4188
- C:\Windows\System\HeYNtWI.exe
  C:\Windows\System\HeYNtWI.exe
  2⤵
  PID:4256
- C:\Windows\System\kwGVMGu.exe
  C:\Windows\System\kwGVMGu.exe
  2⤵
  PID:4320
- C:\Windows\System\NdPrfqv.exe
  C:\Windows\System\NdPrfqv.exe
  2⤵
  PID:4388
- C:\Windows\System\YqOCUYq.exe
  C:\Windows\System\YqOCUYq.exe
  2⤵
  PID:4456
- C:\Windows\System\eIwnraW.exe
  C:\Windows\System\eIwnraW.exe
  2⤵
  PID:4516
- C:\Windows\System\JzSTcfa.exe
  C:\Windows\System\JzSTcfa.exe
  2⤵
  PID:4684
- C:\Windows\System\lMIWuJC.exe
  C:\Windows\System\lMIWuJC.exe
  2⤵
  PID:4756
- C:\Windows\System\OGyygsj.exe
  C:\Windows\System\OGyygsj.exe
  2⤵
  PID:4660
- C:\Windows\System\ZieVFEX.exe
  C:\Windows\System\ZieVFEX.exe
  2⤵
  PID:4736
- C:\Windows\System\xAMVWxY.exe
  C:\Windows\System\xAMVWxY.exe
  2⤵
  PID:4804
- C:\Windows\System\SeWxOoD.exe
  C:\Windows\System\SeWxOoD.exe
  2⤵
  PID:4832
- C:\Windows\System\BDRrhwW.exe
  C:\Windows\System\BDRrhwW.exe
  2⤵
  PID:4904
- C:\Windows\System\xYvkhMk.exe
  C:\Windows\System\xYvkhMk.exe
  2⤵
  PID:4940
- C:\Windows\System\AjJSuWi.exe
  C:\Windows\System\AjJSuWi.exe
  2⤵
  PID:1508
- C:\Windows\System\KZttPRG.exe
  C:\Windows\System\KZttPRG.exe
  2⤵
  PID:5004
- C:\Windows\System\KdfdEKY.exe
  C:\Windows\System\KdfdEKY.exe
  2⤵
  PID:4988
- C:\Windows\System\KUGinQx.exe
  C:\Windows\System\KUGinQx.exe
  2⤵
  PID:5020
- C:\Windows\System\oKEkaRg.exe
  C:\Windows\System\oKEkaRg.exe
  2⤵
  PID:892
- C:\Windows\System\ahOjTnT.exe
  C:\Windows\System\ahOjTnT.exe
  2⤵
  PID:4100
- C:\Windows\System\sPHmOwq.exe
  C:\Windows\System\sPHmOwq.exe
  2⤵
  PID:5100
- C:\Windows\System\iKAFTbp.exe
  C:\Windows\System\iKAFTbp.exe
  2⤵
  PID:5112
- C:\Windows\System\sKIztzf.exe
  C:\Windows\System\sKIztzf.exe
  2⤵
  PID:3852
- C:\Windows\System\WUXXeqg.exe
  C:\Windows\System\WUXXeqg.exe
  2⤵
  PID:1656
- C:\Windows\System\hQZSdbI.exe
  C:\Windows\System\hQZSdbI.exe
  2⤵
  PID:3464
- C:\Windows\System\kpOivPr.exe
  C:\Windows\System\kpOivPr.exe
  2⤵
  PID:1184
- C:\Windows\System\HiTKYCC.exe
  C:\Windows\System\HiTKYCC.exe
  2⤵
  PID:4168
- C:\Windows\System\lUqrsew.exe
  C:\Windows\System\lUqrsew.exe
  2⤵
  PID:4200
- C:\Windows\System\naKeCHO.exe
  C:\Windows\System\naKeCHO.exe
  2⤵
  PID:1632
- C:\Windows\System\txPnShW.exe
  C:\Windows\System\txPnShW.exe
  2⤵
  PID:4332
- C:\Windows\System\LpEGHMr.exe
  C:\Windows\System\LpEGHMr.exe
  2⤵
  PID:4340
- C:\Windows\System\CrEsZuH.exe
  C:\Windows\System\CrEsZuH.exe
  2⤵
  PID:2068
- C:\Windows\System\YoRJPRW.exe
  C:\Windows\System\YoRJPRW.exe
  2⤵
  PID:4436
- C:\Windows\System\hVPQbqy.exe
  C:\Windows\System\hVPQbqy.exe
  2⤵
  PID:4500
- C:\Windows\System\QCQPBPK.exe
  C:\Windows\System\QCQPBPK.exe
  2⤵
  PID:1988
- C:\Windows\System\xTvcPjS.exe
  C:\Windows\System\xTvcPjS.exe
  2⤵
  PID:3636
- C:\Windows\System\hTXAiDm.exe
  C:\Windows\System\hTXAiDm.exe
  2⤵
  PID:2340
- C:\Windows\System\vmTIfUt.exe
  C:\Windows\System\vmTIfUt.exe
  2⤵
  PID:3796
- C:\Windows\System\fOwVloL.exe
  C:\Windows\System\fOwVloL.exe
  2⤵
  PID:3568
- C:\Windows\System\sKSHabx.exe
  C:\Windows\System\sKSHabx.exe
  2⤵
  PID:4584
- C:\Windows\System\BuqTxQu.exe
  C:\Windows\System\BuqTxQu.exe
  2⤵
  PID:4648
- C:\Windows\System\PnLqkda.exe
  C:\Windows\System\PnLqkda.exe
  2⤵
  PID:3552
- C:\Windows\System\nNpbSGL.exe
  C:\Windows\System\nNpbSGL.exe
  2⤵
  PID:3916
- C:\Windows\System\uHvnbWF.exe
  C:\Windows\System\uHvnbWF.exe
  2⤵
  PID:2476
- C:\Windows\System\aZtQpkZ.exe
  C:\Windows\System\aZtQpkZ.exe
  2⤵
  PID:4316
- C:\Windows\System\ILbuidg.exe
  C:\Windows\System\ILbuidg.exe
  2⤵
  PID:4356
- C:\Windows\System\RXkLeXo.exe
  C:\Windows\System\RXkLeXo.exe
  2⤵
  PID:4716
- C:\Windows\System\VgLIJAW.exe
  C:\Windows\System\VgLIJAW.exe
  2⤵
  PID:4740
- C:\Windows\System\PDExbVV.exe
  C:\Windows\System\PDExbVV.exe
  2⤵
  PID:4860
- C:\Windows\System\EFTKvcq.exe
  C:\Windows\System\EFTKvcq.exe
  2⤵
  PID:4548
- C:\Windows\System\jHStHZf.exe
  C:\Windows\System\jHStHZf.exe
  2⤵
  PID:4696
- C:\Windows\System\wVNkCOp.exe
  C:\Windows\System\wVNkCOp.exe
  2⤵
  PID:4872
- C:\Windows\System\aBWJatO.exe
  C:\Windows\System\aBWJatO.exe
  2⤵
  PID:4852
- C:\Windows\System\AGzgVok.exe
  C:\Windows\System\AGzgVok.exe
  2⤵
  PID:4896
- C:\Windows\System\IymCFVb.exe
  C:\Windows\System\IymCFVb.exe
  2⤵
  PID:4720
- C:\Windows\System\Yaebozt.exe
  C:\Windows\System\Yaebozt.exe
  2⤵
  PID:4960
- C:\Windows\System\CwDRprm.exe
  C:\Windows\System\CwDRprm.exe
  2⤵
  PID:5108
- C:\Windows\System\QdEyCjN.exe
  C:\Windows\System\QdEyCjN.exe
  2⤵
  PID:3648
- C:\Windows\System\utxVLBo.exe
  C:\Windows\System\utxVLBo.exe
  2⤵
  PID:3632
- C:\Windows\System\bKkARle.exe
  C:\Windows\System\bKkARle.exe
  2⤵
  PID:3700
- C:\Windows\System\lIQSlna.exe
  C:\Windows\System\lIQSlna.exe
  2⤵
  PID:4536
- C:\Windows\System\zUaBwGx.exe
  C:\Windows\System\zUaBwGx.exe
  2⤵
  PID:4644
- C:\Windows\System\oPhOoWw.exe
  C:\Windows\System\oPhOoWw.exe
  2⤵
  PID:2088
- C:\Windows\System\CWvXchf.exe
  C:\Windows\System\CWvXchf.exe
  2⤵
  PID:3180
- C:\Windows\System\mmRPgcF.exe
  C:\Windows\System\mmRPgcF.exe
  2⤵
  PID:3816
- C:\Windows\System\mgSYwHT.exe
  C:\Windows\System\mgSYwHT.exe
  2⤵
  PID:4784
- C:\Windows\System\NUMddiS.exe
  C:\Windows\System\NUMddiS.exe
  2⤵
  PID:4788
- C:\Windows\System\abrSSGM.exe
  C:\Windows\System\abrSSGM.exe
  2⤵
  PID:4564
- C:\Windows\System\BkEdRiY.exe
  C:\Windows\System\BkEdRiY.exe
  2⤵
  PID:2568
- C:\Windows\System\XPmEGbT.exe
  C:\Windows\System\XPmEGbT.exe
  2⤵
  PID:5044
- C:\Windows\System\vJNxihM.exe
  C:\Windows\System\vJNxihM.exe
  2⤵
  PID:4116
- C:\Windows\System\wMAullM.exe
  C:\Windows\System\wMAullM.exe
  2⤵
  PID:3448
- C:\Windows\System\CbSESke.exe
  C:\Windows\System\CbSESke.exe
  2⤵
  PID:4140
- C:\Windows\System\vZcycnu.exe
  C:\Windows\System\vZcycnu.exe
  2⤵
  PID:5088
- C:\Windows\System\FiCvejE.exe
  C:\Windows\System\FiCvejE.exe
  2⤵
  PID:4472
- C:\Windows\System\cLXfQEE.exe
  C:\Windows\System\cLXfQEE.exe
  2⤵
  PID:4136
- C:\Windows\System\bneoAwr.exe
  C:\Windows\System\bneoAwr.exe
  2⤵
  PID:4272
- C:\Windows\System\tSijJRx.exe
  C:\Windows\System\tSijJRx.exe
  2⤵
  PID:4864
- C:\Windows\System\CGHVcie.exe
  C:\Windows\System\CGHVcie.exe
  2⤵
  PID:3228
- C:\Windows\System\JoYPicy.exe
  C:\Windows\System\JoYPicy.exe
  2⤵
  PID:4768
- C:\Windows\System\ASQecWk.exe
  C:\Windows\System\ASQecWk.exe
  2⤵
  PID:2168
- C:\Windows\System\PKrIjLq.exe
  C:\Windows\System\PKrIjLq.exe
  2⤵
  PID:5076
- C:\Windows\System\WnGvxpH.exe
  C:\Windows\System\WnGvxpH.exe
  2⤵
  PID:4236
- C:\Windows\System\gGrJKTk.exe
  C:\Windows\System\gGrJKTk.exe
  2⤵
  PID:4972
- C:\Windows\System\JgiUuST.exe
  C:\Windows\System\JgiUuST.exe
  2⤵
  PID:1900
- C:\Windows\System\vYcogXg.exe
  C:\Windows\System\vYcogXg.exe
  2⤵
  PID:1524
- C:\Windows\System\LbzWOEQ.exe
  C:\Windows\System\LbzWOEQ.exe
  2⤵
  PID:3468
- C:\Windows\System\bRQskbW.exe
  C:\Windows\System\bRQskbW.exe
  2⤵
  PID:3900
- C:\Windows\System\AutNROE.exe
  C:\Windows\System\AutNROE.exe
  2⤵
  PID:3176
- C:\Windows\System\oEyxnWG.exe
  C:\Windows\System\oEyxnWG.exe
  2⤵
  PID:4700
- C:\Windows\System\irlmSnj.exe
  C:\Windows\System\irlmSnj.exe
  2⤵
  PID:380
- C:\Windows\System\ZpGRsDD.exe
  C:\Windows\System\ZpGRsDD.exe
  2⤵
  PID:3800
- C:\Windows\System\WzlrZUe.exe
  C:\Windows\System\WzlrZUe.exe
  2⤵
  PID:1872
- C:\Windows\System\DAHTekA.exe
  C:\Windows\System\DAHTekA.exe
  2⤵
  PID:5132
- C:\Windows\System\ElqtLla.exe
  C:\Windows\System\ElqtLla.exe
  2⤵
  PID:5148
- C:\Windows\System\QsZTpfk.exe
  C:\Windows\System\QsZTpfk.exe
  2⤵
  PID:5168
- C:\Windows\System\ujTMecF.exe
  C:\Windows\System\ujTMecF.exe
  2⤵
  PID:5184
- C:\Windows\System\jJFNXTu.exe
  C:\Windows\System\jJFNXTu.exe
  2⤵
  PID:5200
- C:\Windows\System\QgxPsOO.exe
  C:\Windows\System\QgxPsOO.exe
  2⤵
  PID:5216
- C:\Windows\System\DdMuVBJ.exe
  C:\Windows\System\DdMuVBJ.exe
  2⤵
  PID:5232
- C:\Windows\System\tLsjKwU.exe
  C:\Windows\System\tLsjKwU.exe
  2⤵
  PID:5248
- C:\Windows\System\ckdsceg.exe
  C:\Windows\System\ckdsceg.exe
  2⤵
  PID:5264
- C:\Windows\System\VPSEOmh.exe
  C:\Windows\System\VPSEOmh.exe
  2⤵
  PID:5392
- C:\Windows\System\sSbamjt.exe
  C:\Windows\System\sSbamjt.exe
  2⤵
  PID:5408
- C:\Windows\System\CcUtNCD.exe
  C:\Windows\System\CcUtNCD.exe
  2⤵
  PID:5424
- C:\Windows\System\aUPpyGr.exe
  C:\Windows\System\aUPpyGr.exe
  2⤵
  PID:5440
- C:\Windows\System\naUzwIQ.exe
  C:\Windows\System\naUzwIQ.exe
  2⤵
  PID:5472
- C:\Windows\System\zTkqFmn.exe
  C:\Windows\System\zTkqFmn.exe
  2⤵
  PID:5488
- C:\Windows\System\gYrkCQj.exe
  C:\Windows\System\gYrkCQj.exe
  2⤵
  PID:5504
- C:\Windows\System\qDkCNhh.exe
  C:\Windows\System\qDkCNhh.exe
  2⤵
  PID:5520
- C:\Windows\System\kTbtGML.exe
  C:\Windows\System\kTbtGML.exe
  2⤵
  PID:5536
- C:\Windows\System\rltWElV.exe
  C:\Windows\System\rltWElV.exe
  2⤵
  PID:5552
- C:\Windows\System\sDtTvNN.exe
  C:\Windows\System\sDtTvNN.exe
  2⤵
  PID:5568
- C:\Windows\System\ofcmvif.exe
  C:\Windows\System\ofcmvif.exe
  2⤵
  PID:5584
- C:\Windows\System\ndTEFMO.exe
  C:\Windows\System\ndTEFMO.exe
  2⤵
  PID:5600
- C:\Windows\System\nTQNgYp.exe
  C:\Windows\System\nTQNgYp.exe
  2⤵
  PID:5616
- C:\Windows\System\OcfmJOH.exe
  C:\Windows\System\OcfmJOH.exe
  2⤵
  PID:5632
- C:\Windows\System\IDkKLlJ.exe
  C:\Windows\System\IDkKLlJ.exe
  2⤵
  PID:5652
- C:\Windows\System\GxozddA.exe
  C:\Windows\System\GxozddA.exe
  2⤵
  PID:5668
- C:\Windows\System\gGVWrZo.exe
  C:\Windows\System\gGVWrZo.exe
  2⤵
  PID:5684
- C:\Windows\System\bzYaTvl.exe
  C:\Windows\System\bzYaTvl.exe
  2⤵
  PID:5700
- C:\Windows\System\BRxpAQe.exe
  C:\Windows\System\BRxpAQe.exe
  2⤵
  PID:5716
- C:\Windows\System\FazQafH.exe
  C:\Windows\System\FazQafH.exe
  2⤵
  PID:5732
- C:\Windows\System\XKgbYex.exe
  C:\Windows\System\XKgbYex.exe
  2⤵
  PID:5748
- C:\Windows\System\QkjyBQA.exe
  C:\Windows\System\QkjyBQA.exe
  2⤵
  PID:5764
- C:\Windows\System\rWmKjEv.exe
  C:\Windows\System\rWmKjEv.exe
  2⤵
  PID:5780
- C:\Windows\System\fQxRKWN.exe
  C:\Windows\System\fQxRKWN.exe
  2⤵
  PID:5796
- C:\Windows\System\exzOTJj.exe
  C:\Windows\System\exzOTJj.exe
  2⤵
  PID:5812
- C:\Windows\System\PQXjwPs.exe
  C:\Windows\System\PQXjwPs.exe
  2⤵
  PID:5828
- C:\Windows\System\vwYOjBQ.exe
  C:\Windows\System\vwYOjBQ.exe
  2⤵
  PID:5844
- C:\Windows\System\XEPxYjm.exe
  C:\Windows\System\XEPxYjm.exe
  2⤵
  PID:5868
- C:\Windows\System\oaiYOiS.exe
  C:\Windows\System\oaiYOiS.exe
  2⤵
  PID:5884
- C:\Windows\System\rxMXNFu.exe
  C:\Windows\System\rxMXNFu.exe
  2⤵
  PID:5900
- C:\Windows\System\tNMboVo.exe
  C:\Windows\System\tNMboVo.exe
  2⤵
  PID:5916
- C:\Windows\System\cASSfKS.exe
  C:\Windows\System\cASSfKS.exe
  2⤵
  PID:5932
- C:\Windows\System\wUiMBaF.exe
  C:\Windows\System\wUiMBaF.exe
  2⤵
  PID:5952
- C:\Windows\System\smFREYl.exe
  C:\Windows\System\smFREYl.exe
  2⤵
  PID:5968
- C:\Windows\System\EqNUoSa.exe
  C:\Windows\System\EqNUoSa.exe
  2⤵
  PID:5984
- C:\Windows\System\ZjmWMVr.exe
  C:\Windows\System\ZjmWMVr.exe
  2⤵
  PID:6056
- C:\Windows\System\gmwkHTD.exe
  C:\Windows\System\gmwkHTD.exe
  2⤵
  PID:6076
- C:\Windows\System\pKQuuJy.exe
  C:\Windows\System\pKQuuJy.exe
  2⤵
  PID:6092
- C:\Windows\System\xAKPKsm.exe
  C:\Windows\System\xAKPKsm.exe
  2⤵
  PID:6108
- C:\Windows\System\GHoziFs.exe
  C:\Windows\System\GHoziFs.exe
  2⤵
  PID:6124
- C:\Windows\System\pTYtskk.exe
  C:\Windows\System\pTYtskk.exe
  2⤵
  PID:6140
- C:\Windows\System\sQlqxlA.exe
  C:\Windows\System\sQlqxlA.exe
  2⤵
  PID:5128
- C:\Windows\System\raryHBo.exe
  C:\Windows\System\raryHBo.exe
  2⤵
  PID:5224
- C:\Windows\System\cHKjjXu.exe
  C:\Windows\System\cHKjjXu.exe
  2⤵
  PID:5256
- C:\Windows\System\MEAJemS.exe
  C:\Windows\System\MEAJemS.exe
  2⤵
  PID:4172
- C:\Windows\System\XleugqL.exe
  C:\Windows\System\XleugqL.exe
  2⤵
  PID:4204
- C:\Windows\System\HEapHVe.exe
  C:\Windows\System\HEapHVe.exe
  2⤵
  PID:5140
- C:\Windows\System\tUZZeZG.exe
  C:\Windows\System\tUZZeZG.exe
  2⤵
  PID:3028
- C:\Windows\System\fVDpQRn.exe
  C:\Windows\System\fVDpQRn.exe
  2⤵
  PID:1104
- C:\Windows\System\yrDSMwS.exe
  C:\Windows\System\yrDSMwS.exe
  2⤵
  PID:5180
- C:\Windows\System\WdpSbhC.exe
  C:\Windows\System\WdpSbhC.exe
  2⤵
  PID:5276
- C:\Windows\System\VPoPSBI.exe
  C:\Windows\System\VPoPSBI.exe
  2⤵
  PID:600
- C:\Windows\System\UwGmzPL.exe
  C:\Windows\System\UwGmzPL.exe
  2⤵
  PID:1704
- C:\Windows\System\hvkKKrq.exe
  C:\Windows\System\hvkKKrq.exe
  2⤵
  PID:5316
- C:\Windows\System\dItsfdW.exe
  C:\Windows\System\dItsfdW.exe
  2⤵
  PID:5376
- C:\Windows\System\ITTYzTZ.exe
  C:\Windows\System\ITTYzTZ.exe
  2⤵
  PID:5360
- C:\Windows\System\WtsCTGf.exe
  C:\Windows\System\WtsCTGf.exe
  2⤵
  PID:5344
- C:\Windows\System\iAIBSOM.exe
  C:\Windows\System\iAIBSOM.exe
  2⤵
  PID:5384
- C:\Windows\System\bkKoWUg.exe
  C:\Windows\System\bkKoWUg.exe
  2⤵
  PID:5400
- C:\Windows\System\ECmDWWZ.exe
  C:\Windows\System\ECmDWWZ.exe
  2⤵
  PID:5448
- C:\Windows\System\uBBfOSB.exe
  C:\Windows\System\uBBfOSB.exe
  2⤵
  PID:5464
- C:\Windows\System\ASPupyN.exe
  C:\Windows\System\ASPupyN.exe
  2⤵
  PID:5512
- C:\Windows\System\qmEdupq.exe
  C:\Windows\System\qmEdupq.exe
  2⤵
  PID:5580
- C:\Windows\System\hVArYHE.exe
  C:\Windows\System\hVArYHE.exe
  2⤵
  PID:5644
- C:\Windows\System\gOFZXJz.exe
  C:\Windows\System\gOFZXJz.exe
  2⤵
  PID:5548
- C:\Windows\System\xEURMgh.exe
  C:\Windows\System\xEURMgh.exe
  2⤵
  PID:5772
- C:\Windows\System\AyyDYHJ.exe
  C:\Windows\System\AyyDYHJ.exe
  2⤵
  PID:5836
- C:\Windows\System\nTEFrvN.exe
  C:\Windows\System\nTEFrvN.exe
  2⤵
  PID:5532
- C:\Windows\System\Wsxkolb.exe
  C:\Windows\System\Wsxkolb.exe
  2⤵
  PID:5860
- C:\Windows\System\OrmQoGM.exe
  C:\Windows\System\OrmQoGM.exe
  2⤵
  PID:5560
- C:\Windows\System\sreepaF.exe
  C:\Windows\System\sreepaF.exe
  2⤵
  PID:5628
- C:\Windows\System\xNqPatf.exe
  C:\Windows\System\xNqPatf.exe
  2⤵
  PID:5696
- C:\Windows\System\dNogVBb.exe
  C:\Windows\System\dNogVBb.exe
  2⤵
  PID:5760
- C:\Windows\System\jUFYEUK.exe
  C:\Windows\System\jUFYEUK.exe
  2⤵
  PID:5792
- C:\Windows\System\nSAxPUa.exe
  C:\Windows\System\nSAxPUa.exe
  2⤵
  PID:5940
- C:\Windows\System\PbwAiZH.exe
  C:\Windows\System\PbwAiZH.exe
  2⤵
  PID:5944
- C:\Windows\System\QurFGBh.exe
  C:\Windows\System\QurFGBh.exe
  2⤵
  PID:5992
- C:\Windows\System\BbJhGcD.exe
  C:\Windows\System\BbJhGcD.exe
  2⤵
  PID:6000
- C:\Windows\System\NEzBvwl.exe
  C:\Windows\System\NEzBvwl.exe
  2⤵
  PID:6012
- C:\Windows\System\yFejtyu.exe
  C:\Windows\System\yFejtyu.exe
  2⤵
  PID:6020
- C:\Windows\System\NnEOYoe.exe
  C:\Windows\System\NnEOYoe.exe
  2⤵
  PID:6044
- C:\Windows\System\OEEHpLu.exe
  C:\Windows\System\OEEHpLu.exe
  2⤵
  PID:6100
- C:\Windows\System\EmqZOhg.exe
  C:\Windows\System\EmqZOhg.exe
  2⤵
  PID:5192
- C:\Windows\System\EuOoHqq.exe
  C:\Windows\System\EuOoHqq.exe
  2⤵
  PID:5056
- C:\Windows\System\sUbhoee.exe
  C:\Windows\System\sUbhoee.exe
  2⤵
  PID:2812
- C:\Windows\System\bDASnkV.exe
  C:\Windows\System\bDASnkV.exe
  2⤵
  PID:780
- C:\Windows\System\cjmHIAY.exe
  C:\Windows\System\cjmHIAY.exe
  2⤵
  PID:5352
- C:\Windows\System\wvzLoZv.exe
  C:\Windows\System\wvzLoZv.exe
  2⤵
  PID:5284
- C:\Windows\System\eTIJNPO.exe
  C:\Windows\System\eTIJNPO.exe
  2⤵
  PID:6048
- C:\Windows\System\KbYqoiR.exe
  C:\Windows\System\KbYqoiR.exe
  2⤵
  PID:5368
- C:\Windows\System\CBQiuhK.exe
  C:\Windows\System\CBQiuhK.exe
  2⤵
  PID:3604
- C:\Windows\System\VAPaIWM.exe
  C:\Windows\System\VAPaIWM.exe
  2⤵
  PID:5304
- C:\Windows\System\dLAIiRA.exe
  C:\Windows\System\dLAIiRA.exe
  2⤵
  PID:5436
- C:\Windows\System\YGpzuWL.exe
  C:\Windows\System\YGpzuWL.exe
  2⤵
  PID:5676
- C:\Windows\System\aqAGjtX.exe
  C:\Windows\System\aqAGjtX.exe
  2⤵
  PID:5416
- C:\Windows\System\DhzmcQW.exe
  C:\Windows\System\DhzmcQW.exe
  2⤵
  PID:5592
- C:\Windows\System\AXROkhx.exe
  C:\Windows\System\AXROkhx.exe
  2⤵
  PID:5852
- C:\Windows\System\lCHYCEu.exe
  C:\Windows\System\lCHYCEu.exe
  2⤵
  PID:5964
- C:\Windows\System\aNBKEYW.exe
  C:\Windows\System\aNBKEYW.exe
  2⤵
  PID:6040
- C:\Windows\System\ioCCwSq.exe
  C:\Windows\System\ioCCwSq.exe
  2⤵
  PID:6136
- C:\Windows\System\maXrxaX.exe
  C:\Windows\System\maXrxaX.exe
  2⤵
  PID:5332
- C:\Windows\System\vggBtoJ.exe
  C:\Windows\System\vggBtoJ.exe
  2⤵
  PID:6072
- C:\Windows\System\OFmXxQy.exe
  C:\Windows\System\OFmXxQy.exe
  2⤵
  PID:5612
- C:\Windows\System\ZtdkEcm.exe
  C:\Windows\System\ZtdkEcm.exe
  2⤵
  PID:5244
- C:\Windows\System\xZNUZjm.exe
  C:\Windows\System\xZNUZjm.exe
  2⤵
  PID:5156
- C:\Windows\System\hoVINFK.exe
  C:\Windows\System\hoVINFK.exe
  2⤵
  PID:5364
- C:\Windows\System\QcPWnvr.exe
  C:\Windows\System\QcPWnvr.exe
  2⤵
  PID:5756
- C:\Windows\System\WniLeGr.exe
  C:\Windows\System\WniLeGr.exe
  2⤵
  PID:6036
- C:\Windows\System\WYowOFF.exe
  C:\Windows\System\WYowOFF.exe
  2⤵
  PID:5892
- C:\Windows\System\EWjAIPD.exe
  C:\Windows\System\EWjAIPD.exe
  2⤵
  PID:5840
- C:\Windows\System\kNGesZI.exe
  C:\Windows\System\kNGesZI.exe
  2⤵
  PID:5976
- C:\Windows\System\IETSClJ.exe
  C:\Windows\System\IETSClJ.exe
  2⤵
  PID:5728
- C:\Windows\System\cSgISxz.exe
  C:\Windows\System\cSgISxz.exe
  2⤵
  PID:5740
- C:\Windows\System\qdteIVR.exe
  C:\Windows\System\qdteIVR.exe
  2⤵
  PID:5876
- C:\Windows\System\ODzmnHP.exe
  C:\Windows\System\ODzmnHP.exe
  2⤵
  PID:6148
- C:\Windows\System\cXEdklc.exe
  C:\Windows\System\cXEdklc.exe
  2⤵
  PID:6164
- C:\Windows\System\IJMRrfM.exe
  C:\Windows\System\IJMRrfM.exe
  2⤵
  PID:6180
- C:\Windows\System\AGJYJjU.exe
  C:\Windows\System\AGJYJjU.exe
  2⤵
  PID:6196
- C:\Windows\System\gPgCjMK.exe
  C:\Windows\System\gPgCjMK.exe
  2⤵
  PID:6212
- C:\Windows\System\iDfdjQS.exe
  C:\Windows\System\iDfdjQS.exe
  2⤵
  PID:6228
- C:\Windows\System\UtvKoju.exe
  C:\Windows\System\UtvKoju.exe
  2⤵
  PID:6244
- C:\Windows\System\QGpZaBt.exe
  C:\Windows\System\QGpZaBt.exe
  2⤵
  PID:6264
- C:\Windows\System\NMmdlRC.exe
  C:\Windows\System\NMmdlRC.exe
  2⤵
  PID:6280
- C:\Windows\System\AIZMGQf.exe
  C:\Windows\System\AIZMGQf.exe
  2⤵
  PID:6296
- C:\Windows\System\MTEHcfX.exe
  C:\Windows\System\MTEHcfX.exe
  2⤵
  PID:6312
- C:\Windows\System\slulVZy.exe
  C:\Windows\System\slulVZy.exe
  2⤵
  PID:6328
- C:\Windows\System\PfpWzqj.exe
  C:\Windows\System\PfpWzqj.exe
  2⤵
  PID:6348
- C:\Windows\System\PhUnJEk.exe
  C:\Windows\System\PhUnJEk.exe
  2⤵
  PID:6364
- C:\Windows\System\DpZevFV.exe
  C:\Windows\System\DpZevFV.exe
  2⤵
  PID:6380
- C:\Windows\System\DZYPBdA.exe
  C:\Windows\System\DZYPBdA.exe
  2⤵
  PID:6396
- C:\Windows\System\PRMImrR.exe
  C:\Windows\System\PRMImrR.exe
  2⤵
  PID:6412
- C:\Windows\System\YIpnAVR.exe
  C:\Windows\System\YIpnAVR.exe
  2⤵
  PID:6436
- C:\Windows\System\bbYtzYH.exe
  C:\Windows\System\bbYtzYH.exe
  2⤵
  PID:6452
- C:\Windows\System\JxGNZON.exe
  C:\Windows\System\JxGNZON.exe
  2⤵
  PID:6468
- C:\Windows\System\fyRuXlM.exe
  C:\Windows\System\fyRuXlM.exe
  2⤵
  PID:6484
- C:\Windows\System\VgAiWWF.exe
  C:\Windows\System\VgAiWWF.exe
  2⤵
  PID:6500
- C:\Windows\System\nabnUSt.exe
  C:\Windows\System\nabnUSt.exe
  2⤵
  PID:6516
- C:\Windows\System\YaQARvE.exe
  C:\Windows\System\YaQARvE.exe
  2⤵
  PID:6532
- C:\Windows\System\oSrWbNt.exe
  C:\Windows\System\oSrWbNt.exe
  2⤵
  PID:6548
- C:\Windows\System\jNbEIjk.exe
  C:\Windows\System\jNbEIjk.exe
  2⤵
  PID:6660
- C:\Windows\System\nzUzXKb.exe
  C:\Windows\System\nzUzXKb.exe
  2⤵
  PID:6676
- C:\Windows\System\xWhfxAK.exe
  C:\Windows\System\xWhfxAK.exe
  2⤵
  PID:6692
- C:\Windows\System\ZQDxFNY.exe
  C:\Windows\System\ZQDxFNY.exe
  2⤵
  PID:6708
- C:\Windows\System\NHvtuCO.exe
  C:\Windows\System\NHvtuCO.exe
  2⤵
  PID:6724
- C:\Windows\System\aaNusVo.exe
  C:\Windows\System\aaNusVo.exe
  2⤵
  PID:6740
- C:\Windows\System\nbLmrGb.exe
  C:\Windows\System\nbLmrGb.exe
  2⤵
  PID:6760
- C:\Windows\System\NBGVgBI.exe
  C:\Windows\System\NBGVgBI.exe
  2⤵
  PID:6776
- C:\Windows\System\PSvIBCX.exe
  C:\Windows\System\PSvIBCX.exe
  2⤵
  PID:6792
- C:\Windows\System\UDVRjpv.exe
  C:\Windows\System\UDVRjpv.exe
  2⤵
  PID:6808
- C:\Windows\System\nPVgntN.exe
  C:\Windows\System\nPVgntN.exe
  2⤵
  PID:6824
- C:\Windows\System\AAotLtA.exe
  C:\Windows\System\AAotLtA.exe
  2⤵
  PID:6840
- C:\Windows\System\voFbDLr.exe
  C:\Windows\System\voFbDLr.exe
  2⤵
  PID:6856
- C:\Windows\System\WWqdBOw.exe
  C:\Windows\System\WWqdBOw.exe
  2⤵
  PID:6872
- C:\Windows\System\UgUnYse.exe
  C:\Windows\System\UgUnYse.exe
  2⤵
  PID:6888
- C:\Windows\System\HUkJWuh.exe
  C:\Windows\System\HUkJWuh.exe
  2⤵
  PID:6908
- C:\Windows\System\fshvbTa.exe
  C:\Windows\System\fshvbTa.exe
  2⤵
  PID:6924
- C:\Windows\System\bhZTyoQ.exe
  C:\Windows\System\bhZTyoQ.exe
  2⤵
  PID:7020
- C:\Windows\System\yuqjuMC.exe
  C:\Windows\System\yuqjuMC.exe
  2⤵
  PID:7036
- C:\Windows\System\gfBBlDO.exe
  C:\Windows\System\gfBBlDO.exe
  2⤵
  PID:7052
- C:\Windows\System\YEjcKlv.exe
  C:\Windows\System\YEjcKlv.exe
  2⤵
  PID:7068
- C:\Windows\System\TuNwIBw.exe
  C:\Windows\System\TuNwIBw.exe
  2⤵
  PID:7084
- C:\Windows\System\DVEOcbw.exe
  C:\Windows\System\DVEOcbw.exe
  2⤵
  PID:7104
- C:\Windows\System\XJticbE.exe
  C:\Windows\System\XJticbE.exe
  2⤵
  PID:7120
- C:\Windows\System\uAorjYL.exe
  C:\Windows\System\uAorjYL.exe
  2⤵
  PID:7148
- C:\Windows\System\CEORQxQ.exe
  C:\Windows\System\CEORQxQ.exe
  2⤵
  PID:6024
- C:\Windows\System\CWZYXxT.exe
  C:\Windows\System\CWZYXxT.exe
  2⤵
  PID:1100
- C:\Windows\System\iKccbWB.exe
  C:\Windows\System\iKccbWB.exe
  2⤵
  PID:6176
- C:\Windows\System\BdcjTfi.exe
  C:\Windows\System\BdcjTfi.exe
  2⤵
  PID:6208
- C:\Windows\System\RDbbDDH.exe
  C:\Windows\System\RDbbDDH.exe
  2⤵
  PID:6236
- C:\Windows\System\JyQFyIY.exe
  C:\Windows\System\JyQFyIY.exe
  2⤵
  PID:5928
- C:\Windows\System\gXBJXoY.exe
  C:\Windows\System\gXBJXoY.exe
  2⤵
  PID:6088
- C:\Windows\System\ISMnUDn.exe
  C:\Windows\System\ISMnUDn.exe
  2⤵
  PID:5144
- C:\Windows\System\XCLqKki.exe
  C:\Windows\System\XCLqKki.exe
  2⤵
  PID:5924
- C:\Windows\System\SzpHKqB.exe
  C:\Windows\System\SzpHKqB.exe
  2⤵
  PID:6156
- C:\Windows\System\dNuULek.exe
  C:\Windows\System\dNuULek.exe
  2⤵
  PID:6276
- C:\Windows\System\ZdEJPJt.exe
  C:\Windows\System\ZdEJPJt.exe
  2⤵
  PID:6340
- C:\Windows\System\VRVCSHK.exe
  C:\Windows\System\VRVCSHK.exe
  2⤵
  PID:6444
- C:\Windows\System\YYyMwep.exe
  C:\Windows\System\YYyMwep.exe
  2⤵
  PID:6544
- C:\Windows\System\cvdJXGF.exe
  C:\Windows\System\cvdJXGF.exe
  2⤵
  PID:6324
- C:\Windows\System\AKJcsmn.exe
  C:\Windows\System\AKJcsmn.exe
  2⤵
  PID:6524
- C:\Windows\System\XHCaeyu.exe
  C:\Windows\System\XHCaeyu.exe
  2⤵
  PID:6252
- C:\Windows\System\kZXgORG.exe
  C:\Windows\System\kZXgORG.exe
  2⤵
  PID:6320
- C:\Windows\System\SuAEVAC.exe
  C:\Windows\System\SuAEVAC.exe
  2⤵
  PID:6432
- C:\Windows\System\SBmFTAU.exe
  C:\Windows\System\SBmFTAU.exe
  2⤵
  PID:6560
- C:\Windows\System\OxAXXJM.exe
  C:\Windows\System\OxAXXJM.exe
  2⤵
  PID:6576
- C:\Windows\System\teVsiiv.exe
  C:\Windows\System\teVsiiv.exe
  2⤵
  PID:6596
- C:\Windows\System\hWOKAVa.exe
  C:\Windows\System\hWOKAVa.exe
  2⤵
  PID:6608
- C:\Windows\System\MBZGEzU.exe
  C:\Windows\System\MBZGEzU.exe
  2⤵
  PID:6624
- C:\Windows\System\HivRKsZ.exe
  C:\Windows\System\HivRKsZ.exe
  2⤵
  PID:6672
- C:\Windows\System\vXOiAPx.exe
  C:\Windows\System\vXOiAPx.exe
  2⤵
  PID:6736
- C:\Windows\System\lEyQhtI.exe
  C:\Windows\System\lEyQhtI.exe
  2⤵
  PID:6804
- C:\Windows\System\DeXuTNG.exe
  C:\Windows\System\DeXuTNG.exe
  2⤵
  PID:6900
- C:\Windows\System\njVapeK.exe
  C:\Windows\System\njVapeK.exe
  2⤵
  PID:6936
- C:\Windows\System\qMnQZKo.exe
  C:\Windows\System\qMnQZKo.exe
  2⤵
  PID:6948
- C:\Windows\System\FWhQwDV.exe
  C:\Windows\System\FWhQwDV.exe
  2⤵
  PID:6756
- C:\Windows\System\glfZsHU.exe
  C:\Windows\System\glfZsHU.exe
  2⤵
  PID:6848
- C:\Windows\System\OcuYtSs.exe
  C:\Windows\System\OcuYtSs.exe
  2⤵
  PID:6644
- C:\Windows\System\DLITHXs.exe
  C:\Windows\System\DLITHXs.exe
  2⤵
  PID:6784
- C:\Windows\System\tEeAYqf.exe
  C:\Windows\System\tEeAYqf.exe
  2⤵
  PID:6884
- C:\Windows\System\mhNpmjH.exe
  C:\Windows\System\mhNpmjH.exe
  2⤵
  PID:6968
- C:\Windows\System\hmofJNx.exe
  C:\Windows\System\hmofJNx.exe
  2⤵
  PID:6984
- C:\Windows\System\TXvGWGX.exe
  C:\Windows\System\TXvGWGX.exe
  2⤵
  PID:2136
- C:\Windows\System\KEBeIvS.exe
  C:\Windows\System\KEBeIvS.exe
  2⤵
  PID:7032
- C:\Windows\System\bKoxZrM.exe
  C:\Windows\System\bKoxZrM.exe
  2⤵
  PID:7136
- C:\Windows\System\EiVQVba.exe
  C:\Windows\System\EiVQVba.exe
  2⤵
  PID:4880
- C:\Windows\System\EkerzKc.exe
  C:\Windows\System\EkerzKc.exe
  2⤵
  PID:5664
- C:\Windows\System\ionVprm.exe
  C:\Windows\System\ionVprm.exe
  2⤵
  PID:5300
- C:\Windows\System\JvEeOlj.exe
  C:\Windows\System\JvEeOlj.exe
  2⤵
  PID:6308
- C:\Windows\System\LejnRAt.exe
  C:\Windows\System\LejnRAt.exe
  2⤵
  PID:6508
- C:\Windows\System\CnOstxC.exe
  C:\Windows\System\CnOstxC.exe
  2⤵
  PID:6392
- C:\Windows\System\MKkzOdt.exe
  C:\Windows\System\MKkzOdt.exe
  2⤵
  PID:5312
- C:\Windows\System\ONUhDpw.exe
  C:\Windows\System\ONUhDpw.exe
  2⤵
  PID:6632
- C:\Windows\System\icSkLxC.exe
  C:\Windows\System\icSkLxC.exe
  2⤵
  PID:6904
- C:\Windows\System\mCkRVsU.exe
  C:\Windows\System\mCkRVsU.exe
  2⤵
  PID:6584
- C:\Windows\System\VhazMkI.exe
  C:\Windows\System\VhazMkI.exe
  2⤵
  PID:6616
- C:\Windows\System\cSyipyj.exe
  C:\Windows\System\cSyipyj.exe
  2⤵
  PID:6932
- C:\Windows\System\ujhyebZ.exe
  C:\Windows\System\ujhyebZ.exe
  2⤵
  PID:6920
- C:\Windows\System\nDHXkZd.exe
  C:\Windows\System\nDHXkZd.exe
  2⤵
  PID:7008
- C:\Windows\System\bFnvhiR.exe
  C:\Windows\System\bFnvhiR.exe
  2⤵
  PID:6720
- C:\Windows\System\BLjlQJH.exe
  C:\Windows\System\BLjlQJH.exe
  2⤵
  PID:6652
- C:\Windows\System\sFukSSd.exe
  C:\Windows\System\sFukSSd.exe
  2⤵
  PID:6996
- C:\Windows\System\IbRPElJ.exe
  C:\Windows\System\IbRPElJ.exe
  2⤵
  PID:7076
- C:\Windows\System\aEnCUjI.exe
  C:\Windows\System\aEnCUjI.exe
  2⤵
  PID:6476
- C:\Windows\System\XwWAMJJ.exe
  C:\Windows\System\XwWAMJJ.exe
  2⤵
  PID:6772
- C:\Windows\System\LESkbTv.exe
  C:\Windows\System\LESkbTv.exe
  2⤵
  PID:6588
- C:\Windows\System\MEQSeCK.exe
  C:\Windows\System\MEQSeCK.exe
  2⤵
  PID:6084
- C:\Windows\System\unzNNxL.exe
  C:\Windows\System\unzNNxL.exe
  2⤵
  PID:5960
- C:\Windows\System\Olznbkb.exe
  C:\Windows\System\Olznbkb.exe
  2⤵
  PID:6464
- C:\Windows\System\cQcuHHS.exe
  C:\Windows\System\cQcuHHS.exe
  2⤵
  PID:6752
- C:\Windows\System\kIDoOfQ.exe
  C:\Windows\System\kIDoOfQ.exe
  2⤵
  PID:7004
- C:\Windows\System\rifinWn.exe
  C:\Windows\System\rifinWn.exe
  2⤵
  PID:6408
- C:\Windows\System\sXLYJpX.exe
  C:\Windows\System\sXLYJpX.exe
  2⤵
  PID:7160
- C:\Windows\System\WVbzbQH.exe
  C:\Windows\System\WVbzbQH.exe
  2⤵
  PID:5500
- C:\Windows\System\slywrWM.exe
  C:\Windows\System\slywrWM.exe
  2⤵
  PID:6404
- C:\Windows\System\CAzWYpN.exe
  C:\Windows\System\CAzWYpN.exe
  2⤵
  PID:6028
- C:\Windows\System\eVPRLCb.exe
  C:\Windows\System\eVPRLCb.exe
  2⤵
  PID:6528
- C:\Windows\System\tKBGybH.exe
  C:\Windows\System\tKBGybH.exe
  2⤵
  PID:6964
- C:\Windows\System\InovKDn.exe
  C:\Windows\System\InovKDn.exe
  2⤵
  PID:6372
- C:\Windows\System\OxrKoJE.exe
  C:\Windows\System\OxrKoJE.exe
  2⤵
  PID:7092
- C:\Windows\System\FzHsEAK.exe
  C:\Windows\System\FzHsEAK.exe
  2⤵
  PID:5856
- C:\Windows\System\CtDqwLI.exe
  C:\Windows\System\CtDqwLI.exe
  2⤵
  PID:7248
- C:\Windows\System\ItXFRDm.exe
  C:\Windows\System\ItXFRDm.exe
  2⤵
  PID:7264
- C:\Windows\System\pgJvgnM.exe
  C:\Windows\System\pgJvgnM.exe
  2⤵
  PID:7280
- C:\Windows\System\ntHDudO.exe
  C:\Windows\System\ntHDudO.exe
  2⤵
  PID:7296
- C:\Windows\System\kzjaKZt.exe
  C:\Windows\System\kzjaKZt.exe
  2⤵
  PID:7312
- C:\Windows\System\vsfQVVD.exe
  C:\Windows\System\vsfQVVD.exe
  2⤵
  PID:7328
- C:\Windows\System\xEqbqed.exe
  C:\Windows\System\xEqbqed.exe
  2⤵
  PID:7344
- C:\Windows\System\YYhTQUH.exe
  C:\Windows\System\YYhTQUH.exe
  2⤵
  PID:7360
- C:\Windows\System\pdecYhJ.exe
  C:\Windows\System\pdecYhJ.exe
  2⤵
  PID:7376
- C:\Windows\System\vPztSwi.exe
  C:\Windows\System\vPztSwi.exe
  2⤵
  PID:7392
- C:\Windows\System\MFctApi.exe
  C:\Windows\System\MFctApi.exe
  2⤵
  PID:7412
- C:\Windows\System\IOKhkwZ.exe
  C:\Windows\System\IOKhkwZ.exe
  2⤵
  PID:7428
- C:\Windows\System\dXJmkQl.exe
  C:\Windows\System\dXJmkQl.exe
  2⤵
  PID:7444
- C:\Windows\System\fBUnZSP.exe
  C:\Windows\System\fBUnZSP.exe
  2⤵
  PID:7460
- C:\Windows\System\PhxLqVL.exe
  C:\Windows\System\PhxLqVL.exe
  2⤵
  PID:7476
- C:\Windows\System\xBCIYxY.exe
  C:\Windows\System\xBCIYxY.exe
  2⤵
  PID:7492
- C:\Windows\System\PNHUAZO.exe
  C:\Windows\System\PNHUAZO.exe
  2⤵
  PID:7508
- C:\Windows\System\ItpMJDy.exe
  C:\Windows\System\ItpMJDy.exe
  2⤵
  PID:7528
- C:\Windows\System\VFVCKvr.exe
  C:\Windows\System\VFVCKvr.exe
  2⤵
  PID:7548
- C:\Windows\System\FxHJqoy.exe
  C:\Windows\System\FxHJqoy.exe
  2⤵
  PID:7568
- C:\Windows\System\sCoegUP.exe
  C:\Windows\System\sCoegUP.exe
  2⤵
  PID:7588
- C:\Windows\System\OtGtIyL.exe
  C:\Windows\System\OtGtIyL.exe
  2⤵
  PID:7608
- C:\Windows\System\wTLyDAs.exe
  C:\Windows\System\wTLyDAs.exe
  2⤵
  PID:7624
- C:\Windows\System\yvtGjXO.exe
  C:\Windows\System\yvtGjXO.exe
  2⤵
  PID:7640
- C:\Windows\System\LFqvlhd.exe
  C:\Windows\System\LFqvlhd.exe
  2⤵
  PID:7656
- C:\Windows\System\sRYfHwv.exe
  C:\Windows\System\sRYfHwv.exe
  2⤵
  PID:7672
- C:\Windows\System\PoftUbo.exe
  C:\Windows\System\PoftUbo.exe
  2⤵
  PID:7688
- C:\Windows\System\DThbTIY.exe
  C:\Windows\System\DThbTIY.exe
  2⤵
  PID:7704
- C:\Windows\System\IaIPfHO.exe
  C:\Windows\System\IaIPfHO.exe
  2⤵
  PID:7720
- C:\Windows\System\EqELONt.exe
  C:\Windows\System\EqELONt.exe
  2⤵
  PID:7736
- C:\Windows\System\nfNxTKP.exe
  C:\Windows\System\nfNxTKP.exe
  2⤵
  PID:7752
- C:\Windows\System\ItrSvwU.exe
  C:\Windows\System\ItrSvwU.exe
  2⤵
  PID:7768
- C:\Windows\System\MtaZgcJ.exe
  C:\Windows\System\MtaZgcJ.exe
  2⤵
  PID:7784
- C:\Windows\System\rpIIXgK.exe
  C:\Windows\System\rpIIXgK.exe
  2⤵
  PID:7800
- C:\Windows\System\WAiMYgH.exe
  C:\Windows\System\WAiMYgH.exe
  2⤵
  PID:7816
- C:\Windows\System\SkrqiZE.exe
  C:\Windows\System\SkrqiZE.exe
  2⤵
  PID:7832
- C:\Windows\System\OXvhbsO.exe
  C:\Windows\System\OXvhbsO.exe
  2⤵
  PID:7848
- C:\Windows\System\iIgQSYH.exe
  C:\Windows\System\iIgQSYH.exe
  2⤵
  PID:7864
- C:\Windows\System\OxyaHJu.exe
  C:\Windows\System\OxyaHJu.exe
  2⤵
  PID:7880
- C:\Windows\System\TymkMMV.exe
  C:\Windows\System\TymkMMV.exe
  2⤵
  PID:7896
- C:\Windows\System\upmsaqS.exe
  C:\Windows\System\upmsaqS.exe
  2⤵
  PID:7912
- C:\Windows\System\RvBhcqU.exe
  C:\Windows\System\RvBhcqU.exe
  2⤵
  PID:7928
- C:\Windows\System\gfJTtKy.exe
  C:\Windows\System\gfJTtKy.exe
  2⤵
  PID:7944
- C:\Windows\System\IdrEwxD.exe
  C:\Windows\System\IdrEwxD.exe
  2⤵
  PID:7964
- C:\Windows\System\DDRQGYA.exe
  C:\Windows\System\DDRQGYA.exe
  2⤵
  PID:7980
- C:\Windows\System\qSacsOz.exe
  C:\Windows\System\qSacsOz.exe
  2⤵
  PID:7996
- C:\Windows\System\AtizSct.exe
  C:\Windows\System\AtizSct.exe
  2⤵
  PID:8012
- C:\Windows\System\sVYvJxc.exe
  C:\Windows\System\sVYvJxc.exe
  2⤵
  PID:8028
- C:\Windows\System\gOcLMLA.exe
  C:\Windows\System\gOcLMLA.exe
  2⤵
  PID:8044
- C:\Windows\System\WCcBNBK.exe
  C:\Windows\System\WCcBNBK.exe
  2⤵
  PID:8060
- C:\Windows\System\zDBylOr.exe
  C:\Windows\System\zDBylOr.exe
  2⤵
  PID:8076
- C:\Windows\System\HsPdKZb.exe
  C:\Windows\System\HsPdKZb.exe
  2⤵
  PID:8092
- C:\Windows\System\NhJdSRp.exe
  C:\Windows\System\NhJdSRp.exe
  2⤵
  PID:8108
- C:\Windows\System\jmqVYjU.exe
  C:\Windows\System\jmqVYjU.exe
  2⤵
  PID:8124
- C:\Windows\System\cmvAQzA.exe
  C:\Windows\System\cmvAQzA.exe
  2⤵
  PID:8140
- C:\Windows\System\lCYlwrJ.exe
  C:\Windows\System\lCYlwrJ.exe
  2⤵
  PID:8156
- C:\Windows\System\umfwGzr.exe
  C:\Windows\System\umfwGzr.exe
  2⤵
  PID:8172
- C:\Windows\System\IWvGElx.exe
  C:\Windows\System\IWvGElx.exe
  2⤵
  PID:8188
- C:\Windows\System\aLgipOw.exe
  C:\Windows\System\aLgipOw.exe
  2⤵
  PID:6572
- C:\Windows\System\oHDLZmG.exe
  C:\Windows\System\oHDLZmG.exe
  2⤵
  PID:6292
- C:\Windows\System\hnOlatN.exe
  C:\Windows\System\hnOlatN.exe
  2⤵
  PID:7128
- C:\Windows\System\yOYbRBk.exe
  C:\Windows\System\yOYbRBk.exe
  2⤵
  PID:6376
- C:\Windows\System\PYOyvSz.exe
  C:\Windows\System\PYOyvSz.exe
  2⤵
  PID:5388
- C:\Windows\System\TzmdBTF.exe
  C:\Windows\System\TzmdBTF.exe
  2⤵
  PID:6820
- C:\Windows\System\DoDSZIy.exe
  C:\Windows\System\DoDSZIy.exe
  2⤵
  PID:6272
- C:\Windows\System\esCRxDt.exe
  C:\Windows\System\esCRxDt.exe
  2⤵
  PID:6960
- C:\Windows\System\rrgPIFl.exe
  C:\Windows\System\rrgPIFl.exe
  2⤵
  PID:7184
- C:\Windows\System\nACLGCH.exe
  C:\Windows\System\nACLGCH.exe
  2⤵
  PID:7200
- C:\Windows\System\LoihmMp.exe
  C:\Windows\System\LoihmMp.exe
  2⤵
  PID:7216
- C:\Windows\System\Xebtvyn.exe
  C:\Windows\System\Xebtvyn.exe
  2⤵
  PID:7232
- C:\Windows\System\gScaMpL.exe
  C:\Windows\System\gScaMpL.exe
  2⤵
  PID:7276
- C:\Windows\System\QMuEMsg.exe
  C:\Windows\System\QMuEMsg.exe
  2⤵
  PID:7336
- C:\Windows\System\jkpmHeF.exe
  C:\Windows\System\jkpmHeF.exe
  2⤵
  PID:7400
- C:\Windows\System\EHZQOlG.exe
  C:\Windows\System\EHZQOlG.exe
  2⤵
  PID:7440
- C:\Windows\System\smCiQVg.exe
  C:\Windows\System\smCiQVg.exe
  2⤵
  PID:6240
- C:\Windows\System\guwIrzY.exe
  C:\Windows\System\guwIrzY.exe
  2⤵
  PID:7544
- C:\Windows\System\xeShDAm.exe
  C:\Windows\System\xeShDAm.exe
  2⤵
  PID:7616
- C:\Windows\System\bnXAUGd.exe
  C:\Windows\System\bnXAUGd.exe
  2⤵
  PID:7680
- C:\Windows\System\ZdwapLC.exe
  C:\Windows\System\ZdwapLC.exe
  2⤵
  PID:7700
- C:\Windows\System\ZBPJGZM.exe
  C:\Windows\System\ZBPJGZM.exe
  2⤵
  PID:7728
- C:\Windows\System\MTWeHlV.exe
  C:\Windows\System\MTWeHlV.exe
  2⤵
  PID:7792
- C:\Windows\System\AjSyNPg.exe
  C:\Windows\System\AjSyNPg.exe
  2⤵
  PID:7256
- C:\Windows\System\rZcyZuR.exe
  C:\Windows\System\rZcyZuR.exe
  2⤵
  PID:7320
- C:\Windows\System\RYzxNWn.exe
  C:\Windows\System\RYzxNWn.exe
  2⤵
  PID:7384
- C:\Windows\System\vKlzvmj.exe
  C:\Windows\System\vKlzvmj.exe
  2⤵
  PID:7484
- C:\Windows\System\YqqIPbx.exe
  C:\Windows\System\YqqIPbx.exe
  2⤵
  PID:7560
- C:\Windows\System\LNiwMkZ.exe
  C:\Windows\System\LNiwMkZ.exe
  2⤵
  PID:7744
- C:\Windows\System\oDUtnWz.exe
  C:\Windows\System\oDUtnWz.exe
  2⤵
  PID:7808
- C:\Windows\System\OkiUGrg.exe
  C:\Windows\System\OkiUGrg.exe
  2⤵
  PID:7872
- C:\Windows\System\rkdOAix.exe
  C:\Windows\System\rkdOAix.exe
  2⤵
  PID:7596
- C:\Windows\System\CBfCdQb.exe
  C:\Windows\System\CBfCdQb.exe
  2⤵
  PID:7636
- C:\Windows\System\orfZAXq.exe
  C:\Windows\System\orfZAXq.exe
  2⤵
  PID:7860
- C:\Windows\System\ZgnWibv.exe
  C:\Windows\System\ZgnWibv.exe
  2⤵
  PID:7924
- C:\Windows\System\goiQnnG.exe
  C:\Windows\System\goiQnnG.exe
  2⤵
  PID:7936
- C:\Windows\System\ATALowT.exe
  C:\Windows\System\ATALowT.exe
  2⤵
  PID:8004
- C:\Windows\System\FwlwAbH.exe
  C:\Windows\System\FwlwAbH.exe
  2⤵
  PID:8068
- C:\Windows\System\FASzqOU.exe
  C:\Windows\System\FASzqOU.exe
  2⤵
  PID:1284
- C:\Windows\System\iFBveyH.exe
  C:\Windows\System\iFBveyH.exe
  2⤵
  PID:8088
- C:\Windows\System\FYDHTkm.exe
  C:\Windows\System\FYDHTkm.exe
  2⤵
  PID:8056
- C:\Windows\System\uyPYTKX.exe
  C:\Windows\System\uyPYTKX.exe
  2⤵
  PID:8164
- C:\Windows\System\EryuPyb.exe
  C:\Windows\System\EryuPyb.exe
  2⤵
  PID:7156
- C:\Windows\System\uucbkmU.exe
  C:\Windows\System\uucbkmU.exe
  2⤵
  PID:8148
- C:\Windows\System\jBvuoHY.exe
  C:\Windows\System\jBvuoHY.exe
  2⤵
  PID:8180
- C:\Windows\System\UjpEGFc.exe
  C:\Windows\System\UjpEGFc.exe
  2⤵
  PID:6224
- C:\Windows\System\nGXKUWt.exe
  C:\Windows\System\nGXKUWt.exe
  2⤵
  PID:6972
- C:\Windows\System\pRvOYHh.exe
  C:\Windows\System\pRvOYHh.exe
  2⤵
  PID:6944
- C:\Windows\System\UbuqcxJ.exe
  C:\Windows\System\UbuqcxJ.exe
  2⤵
  PID:7272
- C:\Windows\System\aQPfFOW.exe
  C:\Windows\System\aQPfFOW.exe
  2⤵
  PID:7368
- C:\Windows\System\IewXGWf.exe
  C:\Windows\System\IewXGWf.exe
  2⤵
  PID:7408
- C:\Windows\System\Minuiyk.exe
  C:\Windows\System\Minuiyk.exe
  2⤵
  PID:7620
- C:\Windows\System\aNPYmDh.exe
  C:\Windows\System\aNPYmDh.exe
  2⤵
  PID:7500
- C:\Windows\System\Ehhlnlo.exe
  C:\Windows\System\Ehhlnlo.exe
  2⤵
  PID:7760
- C:\Windows\System\MwooLQp.exe
  C:\Windows\System\MwooLQp.exe
  2⤵
  PID:7292
- C:\Windows\System\DxDfXTE.exe
  C:\Windows\System\DxDfXTE.exe
  2⤵
  PID:7228
- C:\Windows\System\qUyqpLp.exe
  C:\Windows\System\qUyqpLp.exe
  2⤵
  PID:7524
- C:\Windows\System\LcArXkq.exe
  C:\Windows\System\LcArXkq.exe
  2⤵
  PID:7904
- C:\Windows\System\zrubBuB.exe
  C:\Windows\System\zrubBuB.exe
  2⤵
  PID:7960
- C:\Windows\System\eLyWIwg.exe
  C:\Windows\System\eLyWIwg.exe
  2⤵
  PID:7840
- C:\Windows\System\NaMvQtU.exe
  C:\Windows\System\NaMvQtU.exe
  2⤵
  PID:7972
- C:\Windows\System\DTJAycs.exe
  C:\Windows\System\DTJAycs.exe
  2⤵
  PID:7992
- C:\Windows\System\vXBxGYx.exe
  C:\Windows\System\vXBxGYx.exe
  2⤵
  PID:8120
- C:\Windows\System\OQXjGKP.exe
  C:\Windows\System\OQXjGKP.exe
  2⤵
  PID:5124
- C:\Windows\System\EropVST.exe
  C:\Windows\System\EropVST.exe
  2⤵
  PID:8024
- C:\Windows\System\HpYthsk.exe
  C:\Windows\System\HpYthsk.exe
  2⤵
  PID:7536
- C:\Windows\System\UtLiyKB.exe
  C:\Windows\System\UtLiyKB.exe
  2⤵
  PID:7388
- C:\Windows\System\IayIFFU.exe
  C:\Windows\System\IayIFFU.exe
  2⤵
  PID:8100
- C:\Windows\System\oLxhxcB.exe
  C:\Windows\System\oLxhxcB.exe
  2⤵
  PID:8052
- C:\Windows\System\vRwoVKU.exe
  C:\Windows\System\vRwoVKU.exe
  2⤵
  PID:7780
- C:\Windows\System\RWTCPuK.exe
  C:\Windows\System\RWTCPuK.exe
  2⤵
  PID:7716
- C:\Windows\System\ncQbCLw.exe
  C:\Windows\System\ncQbCLw.exe
  2⤵
  PID:7260
- C:\Windows\System\sYbFAue.exe
  C:\Windows\System\sYbFAue.exe
  2⤵
  PID:7520
- C:\Windows\System\ajGnRFj.exe
  C:\Windows\System\ajGnRFj.exe
  2⤵
  PID:8036
- C:\Windows\System\QwtXqeD.exe
  C:\Windows\System\QwtXqeD.exe
  2⤵
  PID:7224
- C:\Windows\System\ncoqeZu.exe
  C:\Windows\System\ncoqeZu.exe
  2⤵
  PID:8040
- C:\Windows\System\zsXygKM.exe
  C:\Windows\System\zsXygKM.exe
  2⤵
  PID:6260
- C:\Windows\System\zbTQxDt.exe
  C:\Windows\System\zbTQxDt.exe
  2⤵
  PID:7472
- C:\Windows\System\SfpscyU.exe
  C:\Windows\System\SfpscyU.exe
  2⤵
  PID:7064
- C:\Windows\System\nLSrmeU.exe
  C:\Windows\System\nLSrmeU.exe
  2⤵
  PID:8200
- C:\Windows\System\btPzbEr.exe
  C:\Windows\System\btPzbEr.exe
  2⤵
  PID:8216
- C:\Windows\System\lycbbLb.exe
  C:\Windows\System\lycbbLb.exe
  2⤵
  PID:8232
- C:\Windows\System\LSqLFDo.exe
  C:\Windows\System\LSqLFDo.exe
  2⤵
  PID:8248
- C:\Windows\System\bgGaVhO.exe
  C:\Windows\System\bgGaVhO.exe
  2⤵
  PID:8264
- C:\Windows\System\PBJKmnv.exe
  C:\Windows\System\PBJKmnv.exe
  2⤵
  PID:8280
- C:\Windows\System\EIooYpx.exe
  C:\Windows\System\EIooYpx.exe
  2⤵
  PID:8296
- C:\Windows\System\kFuxnvU.exe
  C:\Windows\System\kFuxnvU.exe
  2⤵
  PID:8312
- C:\Windows\System\BDuDmzs.exe
  C:\Windows\System\BDuDmzs.exe
  2⤵
  PID:8328
- C:\Windows\System\PXuarZV.exe
  C:\Windows\System\PXuarZV.exe
  2⤵
  PID:8344
- C:\Windows\System\eIZlDaX.exe
  C:\Windows\System\eIZlDaX.exe
  2⤵
  PID:8360
- C:\Windows\System\JUwqmHP.exe
  C:\Windows\System\JUwqmHP.exe
  2⤵
  PID:8376
- C:\Windows\System\nPOHcpy.exe
  C:\Windows\System\nPOHcpy.exe
  2⤵
  PID:8392
- C:\Windows\System\CemTjyF.exe
  C:\Windows\System\CemTjyF.exe
  2⤵
  PID:8408
- C:\Windows\System\kRPIMqQ.exe
  C:\Windows\System\kRPIMqQ.exe
  2⤵
  PID:8424
- C:\Windows\System\wHeWuaK.exe
  C:\Windows\System\wHeWuaK.exe
  2⤵
  PID:8440
- C:\Windows\System\dmtQdwo.exe
  C:\Windows\System\dmtQdwo.exe
  2⤵
  PID:8456
- C:\Windows\System\voSuaQk.exe
  C:\Windows\System\voSuaQk.exe
  2⤵
  PID:8472
- C:\Windows\System\kTjUjkr.exe
  C:\Windows\System\kTjUjkr.exe
  2⤵
  PID:8488
- C:\Windows\System\pDZisOp.exe
  C:\Windows\System\pDZisOp.exe
  2⤵
  PID:8504
- C:\Windows\System\UlvBnBp.exe
  C:\Windows\System\UlvBnBp.exe
  2⤵
  PID:8520
- C:\Windows\System\StENGjj.exe
  C:\Windows\System\StENGjj.exe
  2⤵
  PID:8536
- C:\Windows\System\wsjZxCv.exe
  C:\Windows\System\wsjZxCv.exe
  2⤵
  PID:8552
- C:\Windows\System\ayLqWNC.exe
  C:\Windows\System\ayLqWNC.exe
  2⤵
  PID:8568
- C:\Windows\System\sKVJsEd.exe
  C:\Windows\System\sKVJsEd.exe
  2⤵
  PID:8584
- C:\Windows\System\fBglpGa.exe
  C:\Windows\System\fBglpGa.exe
  2⤵
  PID:8600
- C:\Windows\System\lpkjjBd.exe
  C:\Windows\System\lpkjjBd.exe
  2⤵
  PID:8616
- C:\Windows\System\kVpMTwp.exe
  C:\Windows\System\kVpMTwp.exe
  2⤵
  PID:8632
- C:\Windows\System\SwSCtCx.exe
  C:\Windows\System\SwSCtCx.exe
  2⤵
  PID:8648
- C:\Windows\System\gwpqkPw.exe
  C:\Windows\System\gwpqkPw.exe
  2⤵
  PID:8664
- C:\Windows\System\AmHTFek.exe
  C:\Windows\System\AmHTFek.exe
  2⤵
  PID:8680
- C:\Windows\System\UeeNxwg.exe
  C:\Windows\System\UeeNxwg.exe
  2⤵
  PID:8696
- C:\Windows\System\fFzaQUv.exe
  C:\Windows\System\fFzaQUv.exe
  2⤵
  PID:8712
- C:\Windows\System\ZALAoYw.exe
  C:\Windows\System\ZALAoYw.exe
  2⤵
  PID:8728
- C:\Windows\System\VhtDEBc.exe
  C:\Windows\System\VhtDEBc.exe
  2⤵
  PID:8744
- C:\Windows\System\TLClTcz.exe
  C:\Windows\System\TLClTcz.exe
  2⤵
  PID:8760
- C:\Windows\System\yRtVivp.exe
  C:\Windows\System\yRtVivp.exe
  2⤵
  PID:8776
- C:\Windows\System\hEsmMvA.exe
  C:\Windows\System\hEsmMvA.exe
  2⤵
  PID:8792
- C:\Windows\System\hWliBYS.exe
  C:\Windows\System\hWliBYS.exe
  2⤵
  PID:8808
- C:\Windows\System\AeYhZrx.exe
  C:\Windows\System\AeYhZrx.exe
  2⤵
  PID:8824
- C:\Windows\System\yVkLmgS.exe
  C:\Windows\System\yVkLmgS.exe
  2⤵
  PID:8840
- C:\Windows\System\zLKpGQj.exe
  C:\Windows\System\zLKpGQj.exe
  2⤵
  PID:8864
- C:\Windows\System\UDeSyUs.exe
  C:\Windows\System\UDeSyUs.exe
  2⤵
  PID:8880
- C:\Windows\System\Aslngbq.exe
  C:\Windows\System\Aslngbq.exe
  2⤵
  PID:8896
- C:\Windows\System\xcXAbry.exe
  C:\Windows\System\xcXAbry.exe
  2⤵
  PID:8912
- C:\Windows\System\iJLeuSj.exe
  C:\Windows\System\iJLeuSj.exe
  2⤵
  PID:8928
- C:\Windows\System\kuNlVew.exe
  C:\Windows\System\kuNlVew.exe
  2⤵
  PID:8944
- C:\Windows\System\rckzpmH.exe
  C:\Windows\System\rckzpmH.exe
  2⤵
  PID:8960
- C:\Windows\System\rYuevUa.exe
  C:\Windows\System\rYuevUa.exe
  2⤵
  PID:8976
- C:\Windows\System\AdbGqKM.exe
  C:\Windows\System\AdbGqKM.exe
  2⤵
  PID:8992
- C:\Windows\System\NbuMfsx.exe
  C:\Windows\System\NbuMfsx.exe
  2⤵
  PID:9008
- C:\Windows\System\VuWmrXS.exe
  C:\Windows\System\VuWmrXS.exe
  2⤵
  PID:9024
- C:\Windows\System\iZsuIrL.exe
  C:\Windows\System\iZsuIrL.exe
  2⤵
  PID:9040
- C:\Windows\System\FKqukwi.exe
  C:\Windows\System\FKqukwi.exe
  2⤵
  PID:9056
- C:\Windows\System\xdBSfcl.exe
  C:\Windows\System\xdBSfcl.exe
  2⤵
  PID:9072
- C:\Windows\System\yRZQgna.exe
  C:\Windows\System\yRZQgna.exe
  2⤵
  PID:9088
- C:\Windows\System\puqcGnF.exe
  C:\Windows\System\puqcGnF.exe
  2⤵
  PID:9104
- C:\Windows\System\niNPdGx.exe
  C:\Windows\System\niNPdGx.exe
  2⤵
  PID:9120
- C:\Windows\System\aJAMRYT.exe
  C:\Windows\System\aJAMRYT.exe
  2⤵
  PID:9136
- C:\Windows\System\HEMHacF.exe
  C:\Windows\System\HEMHacF.exe
  2⤵
  PID:9152
- C:\Windows\System\LyLgklw.exe
  C:\Windows\System\LyLgklw.exe
  2⤵
  PID:9168
- C:\Windows\System\uNsDHZs.exe
  C:\Windows\System\uNsDHZs.exe
  2⤵
  PID:9184
- C:\Windows\System\ffaSCmo.exe
  C:\Windows\System\ffaSCmo.exe
  2⤵
  PID:9200
- C:\Windows\System\cBmvbCW.exe
  C:\Windows\System\cBmvbCW.exe
  2⤵
  PID:7424
- C:\Windows\System\IGWsCyC.exe
  C:\Windows\System\IGWsCyC.exe
  2⤵
  PID:7192
- C:\Windows\System\AhTeffr.exe
  C:\Windows\System\AhTeffr.exe
  2⤵
  PID:7712
- C:\Windows\System\xOQghdF.exe
  C:\Windows\System\xOQghdF.exe
  2⤵
  PID:7892
- C:\Windows\System\cDmAjHP.exe
  C:\Windows\System\cDmAjHP.exe
  2⤵
  PID:8224
- C:\Windows\System\zhnhsdl.exe
  C:\Windows\System\zhnhsdl.exe
  2⤵
  PID:7856
- C:\Windows\System\yITClQo.exe
  C:\Windows\System\yITClQo.exe
  2⤵
  PID:8196
- C:\Windows\System\EUgCGoD.exe
  C:\Windows\System\EUgCGoD.exe
  2⤵
  PID:8292
- C:\Windows\System\ouPgFnp.exe
  C:\Windows\System\ouPgFnp.exe
  2⤵
  PID:8340
- C:\Windows\System\WAxXbzZ.exe
  C:\Windows\System\WAxXbzZ.exe
  2⤵
  PID:8356
- C:\Windows\System\tzUMybe.exe
  C:\Windows\System\tzUMybe.exe
  2⤵
  PID:8384
- C:\Windows\System\HCEGfDP.exe
  C:\Windows\System\HCEGfDP.exe
  2⤵
  PID:8436
- C:\Windows\System\RbXQhUx.exe
  C:\Windows\System\RbXQhUx.exe
  2⤵
  PID:8500
- C:\Windows\System\OwEDXJZ.exe
  C:\Windows\System\OwEDXJZ.exe
  2⤵
  PID:8416
- C:\Windows\System\ZcXPglo.exe
  C:\Windows\System\ZcXPglo.exe
  2⤵
  PID:8480
- C:\Windows\System\OdgMJYn.exe
  C:\Windows\System\OdgMJYn.exe
  2⤵
  PID:8532
- C:\Windows\System\bdPYkDf.exe
  C:\Windows\System\bdPYkDf.exe
  2⤵
  PID:8580
- C:\Windows\System\kgstzNP.exe
  C:\Windows\System\kgstzNP.exe
  2⤵
  PID:8624
- C:\Windows\System\TJBcPkx.exe
  C:\Windows\System\TJBcPkx.exe
  2⤵
  PID:8596
- C:\Windows\System\lzsTEOU.exe
  C:\Windows\System\lzsTEOU.exe
  2⤵
  PID:8676
- C:\Windows\System\XlyGbpU.exe
  C:\Windows\System\XlyGbpU.exe
  2⤵
  PID:8704
- C:\Windows\System\laMfZhY.exe
  C:\Windows\System\laMfZhY.exe
  2⤵
  PID:8736
- C:\Windows\System\nkeLzjt.exe
  C:\Windows\System\nkeLzjt.exe
  2⤵
  PID:8788
- C:\Windows\System\dankyEx.exe
  C:\Windows\System\dankyEx.exe
  2⤵
  PID:8800
- C:\Windows\System\cJFqLar.exe
  C:\Windows\System\cJFqLar.exe
  2⤵
  PID:8832
- C:\Windows\System\zNUJnRU.exe
  C:\Windows\System\zNUJnRU.exe
  2⤵
  PID:8876
- C:\Windows\System\jVjqkxH.exe
  C:\Windows\System\jVjqkxH.exe
  2⤵
  PID:8940
- C:\Windows\System\FKyyoGi.exe
  C:\Windows\System\FKyyoGi.exe
  2⤵
  PID:8892
- C:\Windows\System\ytyKXqc.exe
  C:\Windows\System\ytyKXqc.exe
  2⤵
  PID:9000
- C:\Windows\System\KiBXoDQ.exe
  C:\Windows\System\KiBXoDQ.exe
  2⤵
  PID:8952
- C:\Windows\System\FfAfqts.exe
  C:\Windows\System\FfAfqts.exe
  2⤵
  PID:9020
- C:\Windows\System\drcxozF.exe
  C:\Windows\System\drcxozF.exe
  2⤵
  PID:9052
- C:\Windows\System\gjRwPMS.exe
  C:\Windows\System\gjRwPMS.exe
  2⤵
  PID:9080
- C:\Windows\System\TSfEBci.exe
  C:\Windows\System\TSfEBci.exe
  2⤵
  PID:9132
- C:\Windows\System\RrqAgnx.exe
  C:\Windows\System\RrqAgnx.exe
  2⤵
  PID:9144
- C:\Windows\System\vnocKet.exe
  C:\Windows\System\vnocKet.exe
  2⤵
  PID:8152
- C:\Windows\System\NqmNbUJ.exe
  C:\Windows\System\NqmNbUJ.exe
  2⤵
  PID:9212
- C:\Windows\System\EQNkEqE.exe
  C:\Windows\System\EQNkEqE.exe
  2⤵
  PID:7584
- C:\Windows\System\TkTVgRP.exe
  C:\Windows\System\TkTVgRP.exe
  2⤵
  PID:8104
- C:\Windows\System\ppdpLbc.exe
  C:\Windows\System\ppdpLbc.exe
  2⤵
  PID:8320
- C:\Windows\System\ZfWzwzs.exe
  C:\Windows\System\ZfWzwzs.exe
  2⤵
  PID:8484
- C:\Windows\System\zPBuEyh.exe
  C:\Windows\System\zPBuEyh.exe
  2⤵
  PID:8592
- C:\Windows\System\CcZmHEr.exe
  C:\Windows\System\CcZmHEr.exe
  2⤵
  PID:8720
- C:\Windows\System\VmaKLKx.exe
  C:\Windows\System\VmaKLKx.exe
  2⤵
  PID:8848
- C:\Windows\System\PKLKvcd.exe
  C:\Windows\System\PKLKvcd.exe
  2⤵
  PID:8404
- C:\Windows\System\AYNuXsE.exe
  C:\Windows\System\AYNuXsE.exe
  2⤵
  PID:8256
- C:\Windows\System\bcSSnQG.exe
  C:\Windows\System\bcSSnQG.exe
  2⤵
  PID:8432
- C:\Windows\System\wSMpQiy.exe
  C:\Windows\System\wSMpQiy.exe
  2⤵
  PID:8752
- C:\Windows\System\ksUOOqH.exe
  C:\Windows\System\ksUOOqH.exe
  2⤵
  PID:8852
- C:\Windows\System\VORsoBT.exe
  C:\Windows\System\VORsoBT.exe
  2⤵
  PID:8860
- C:\Windows\System\XkZGvRK.exe
  C:\Windows\System\XkZGvRK.exe
  2⤵
  PID:8984
- C:\Windows\System\kBxsTBV.exe
  C:\Windows\System\kBxsTBV.exe
  2⤵
  PID:9084
- C:\Windows\System\IsRhLIc.exe
  C:\Windows\System\IsRhLIc.exe
  2⤵
  PID:8988
- C:\Windows\System\EzscFWB.exe
  C:\Windows\System\EzscFWB.exe
  2⤵
  PID:8208
- C:\Windows\System\LgkKexW.exe
  C:\Windows\System\LgkKexW.exe
  2⤵
  PID:9180
- C:\Windows\System\NSirkin.exe
  C:\Windows\System\NSirkin.exe
  2⤵
  PID:9096
- C:\Windows\System\ceMFftR.exe
  C:\Windows\System\ceMFftR.exe
  2⤵
  PID:8228
- C:\Windows\System\qWGUTqK.exe
  C:\Windows\System\qWGUTqK.exe
  2⤵
  PID:8576
- C:\Windows\System\IaSWqGp.exe
  C:\Windows\System\IaSWqGp.exe
  2⤵
  PID:8784
- C:\Windows\System\OKWSoCS.exe
  C:\Windows\System\OKWSoCS.exe
  2⤵
  PID:8772
- C:\Windows\System\dHtKHWB.exe
  C:\Windows\System\dHtKHWB.exe
  2⤵
  PID:8972
- C:\Windows\System\fvWKkHS.exe
  C:\Windows\System\fvWKkHS.exe
  2⤵
  PID:8244
- C:\Windows\System\tmCcICv.exe
  C:\Windows\System\tmCcICv.exe
  2⤵
  PID:9196
- C:\Windows\System\qUlLPhT.exe
  C:\Windows\System\qUlLPhT.exe
  2⤵
  PID:9164
- C:\Windows\System\TzIDAVz.exe
  C:\Windows\System\TzIDAVz.exe
  2⤵
  PID:7208
- C:\Windows\System\XGqkPGy.exe
  C:\Windows\System\XGqkPGy.exe
  2⤵
  PID:9064
- C:\Windows\System\KfebThI.exe
  C:\Windows\System\KfebThI.exe
  2⤵
  PID:9224
- C:\Windows\System\OxptqcS.exe
  C:\Windows\System\OxptqcS.exe
  2⤵
  PID:9240
- C:\Windows\System\azIfaxT.exe
  C:\Windows\System\azIfaxT.exe
  2⤵
  PID:9256
- C:\Windows\System\khhQCCc.exe
  C:\Windows\System\khhQCCc.exe
  2⤵
  PID:9272
- C:\Windows\System\EzSDSTs.exe
  C:\Windows\System\EzSDSTs.exe
  2⤵
  PID:9288
- C:\Windows\System\vtLuFPq.exe
  C:\Windows\System\vtLuFPq.exe
  2⤵
  PID:9304
- C:\Windows\System\xXFMhQF.exe
  C:\Windows\System\xXFMhQF.exe
  2⤵
  PID:9320
- C:\Windows\System\IfYRbSL.exe
  C:\Windows\System\IfYRbSL.exe
  2⤵
  PID:9336
- C:\Windows\System\OghoVCY.exe
  C:\Windows\System\OghoVCY.exe
  2⤵
  PID:9352
- C:\Windows\System\MpwkdWR.exe
  C:\Windows\System\MpwkdWR.exe
  2⤵
  PID:9368
- C:\Windows\System\mQhcJAg.exe
  C:\Windows\System\mQhcJAg.exe
  2⤵
  PID:9384
- C:\Windows\System\BgDkpTV.exe
  C:\Windows\System\BgDkpTV.exe
  2⤵
  PID:9400
- C:\Windows\System\QoNsDue.exe
  C:\Windows\System\QoNsDue.exe
  2⤵
  PID:9416
- C:\Windows\System\uVlsiDv.exe
  C:\Windows\System\uVlsiDv.exe
  2⤵
  PID:9432
- C:\Windows\System\mLyrHqf.exe
  C:\Windows\System\mLyrHqf.exe
  2⤵
  PID:9448
- C:\Windows\System\ONigkeA.exe
  C:\Windows\System\ONigkeA.exe
  2⤵
  PID:9464
- C:\Windows\System\QzbasvH.exe
  C:\Windows\System\QzbasvH.exe
  2⤵
  PID:9480
- C:\Windows\System\uCpDbGz.exe
  C:\Windows\System\uCpDbGz.exe
  2⤵
  PID:9496
- C:\Windows\System\rbCcxQV.exe
  C:\Windows\System\rbCcxQV.exe
  2⤵
  PID:9512
- C:\Windows\System\tGyRBzW.exe
  C:\Windows\System\tGyRBzW.exe
  2⤵
  PID:9528
- C:\Windows\System\xSQLGKf.exe
  C:\Windows\System\xSQLGKf.exe
  2⤵
  PID:9544
- C:\Windows\System\oefaXOL.exe
  C:\Windows\System\oefaXOL.exe
  2⤵
  PID:9560
- C:\Windows\System\tCJynVH.exe
  C:\Windows\System\tCJynVH.exe
  2⤵
  PID:9576
- C:\Windows\System\tpOkaao.exe
  C:\Windows\System\tpOkaao.exe
  2⤵
  PID:9592
- C:\Windows\System\dBRFzTN.exe
  C:\Windows\System\dBRFzTN.exe
  2⤵
  PID:9608
- C:\Windows\System\dclisIq.exe
  C:\Windows\System\dclisIq.exe
  2⤵
  PID:9624
- C:\Windows\System\vSvCwzp.exe
  C:\Windows\System\vSvCwzp.exe
  2⤵
  PID:9640
- C:\Windows\System\GzCXcKT.exe
  C:\Windows\System\GzCXcKT.exe
  2⤵
  PID:9656
- C:\Windows\System\CGFRNUT.exe
  C:\Windows\System\CGFRNUT.exe
  2⤵
  PID:9672
- C:\Windows\System\hxJNnov.exe
  C:\Windows\System\hxJNnov.exe
  2⤵
  PID:9688
- C:\Windows\System\NDSErhP.exe
  C:\Windows\System\NDSErhP.exe
  2⤵
  PID:9704
- C:\Windows\System\RlmJpMO.exe
  C:\Windows\System\RlmJpMO.exe
  2⤵
  PID:9720
- C:\Windows\System\Lcpfotq.exe
  C:\Windows\System\Lcpfotq.exe
  2⤵
  PID:9736
- C:\Windows\System\aYgBaMG.exe
  C:\Windows\System\aYgBaMG.exe
  2⤵
  PID:9752
- C:\Windows\System\AKGfINg.exe
  C:\Windows\System\AKGfINg.exe
  2⤵
  PID:9768
- C:\Windows\System\Dadblar.exe
  C:\Windows\System\Dadblar.exe
  2⤵
  PID:9784
- C:\Windows\System\pDykCVo.exe
  C:\Windows\System\pDykCVo.exe
  2⤵
  PID:9800
- C:\Windows\System\mRXXeic.exe
  C:\Windows\System\mRXXeic.exe
  2⤵
  PID:9816
- C:\Windows\System\FPwtFCK.exe
  C:\Windows\System\FPwtFCK.exe
  2⤵
  PID:9832
- C:\Windows\System\DvhobvG.exe
  C:\Windows\System\DvhobvG.exe
  2⤵
  PID:9848
- C:\Windows\System\sGrCwYD.exe
  C:\Windows\System\sGrCwYD.exe
  2⤵
  PID:9864
- C:\Windows\System\qYmKWyF.exe
  C:\Windows\System\qYmKWyF.exe
  2⤵
  PID:9880
- C:\Windows\System\omlYSUk.exe
  C:\Windows\System\omlYSUk.exe
  2⤵
  PID:9896
- C:\Windows\System\voNxlek.exe
  C:\Windows\System\voNxlek.exe
  2⤵
  PID:9912
- C:\Windows\System\gbTzFjU.exe
  C:\Windows\System\gbTzFjU.exe
  2⤵
  PID:9928
- C:\Windows\System\BsvknDc.exe
  C:\Windows\System\BsvknDc.exe
  2⤵
  PID:9944
- C:\Windows\System\dYJhRof.exe
  C:\Windows\System\dYJhRof.exe
  2⤵
  PID:9960
- C:\Windows\System\OJjRSWc.exe
  C:\Windows\System\OJjRSWc.exe
  2⤵
  PID:9976
- C:\Windows\System\LhawExh.exe
  C:\Windows\System\LhawExh.exe
  2⤵
  PID:9992
- C:\Windows\System\faVNlfw.exe
  C:\Windows\System\faVNlfw.exe
  2⤵
  PID:10008
- C:\Windows\System\xzDmQtD.exe
  C:\Windows\System\xzDmQtD.exe
  2⤵
  PID:10024
- C:\Windows\System\HqRLIWW.exe
  C:\Windows\System\HqRLIWW.exe
  2⤵
  PID:10040
- C:\Windows\System\UCHEuwV.exe
  C:\Windows\System\UCHEuwV.exe
  2⤵
  PID:10056
- C:\Windows\System\Pchaljp.exe
  C:\Windows\System\Pchaljp.exe
  2⤵
  PID:10072
- C:\Windows\System\BYQEsIG.exe
  C:\Windows\System\BYQEsIG.exe
  2⤵
  PID:10088
- C:\Windows\System\lDWKwJJ.exe
  C:\Windows\System\lDWKwJJ.exe
  2⤵
  PID:10104
- C:\Windows\System\nrqZnma.exe
  C:\Windows\System\nrqZnma.exe
  2⤵
  PID:10120
- C:\Windows\System\GHKMQBw.exe
  C:\Windows\System\GHKMQBw.exe
  2⤵
  PID:10136
- C:\Windows\System\cjNXHrq.exe
  C:\Windows\System\cjNXHrq.exe
  2⤵
  PID:10156
- C:\Windows\System\TgneWDS.exe
  C:\Windows\System\TgneWDS.exe
  2⤵
  PID:10172
- C:\Windows\System\czxGnEm.exe
  C:\Windows\System\czxGnEm.exe
  2⤵
  PID:10196
- C:\Windows\System\nPHGsTE.exe
  C:\Windows\System\nPHGsTE.exe
  2⤵
  PID:10212
- C:\Windows\System\GtLTUFQ.exe
  C:\Windows\System\GtLTUFQ.exe
  2⤵
  PID:10228
- C:\Windows\System\pIMqbib.exe
  C:\Windows\System\pIMqbib.exe
  2⤵
  PID:8856
- C:\Windows\System\MWgPLbH.exe
  C:\Windows\System\MWgPLbH.exe
  2⤵
  PID:9116
- C:\Windows\System\vMsKduG.exe
  C:\Windows\System\vMsKduG.exe
  2⤵
  PID:9300
- C:\Windows\System\HYxJFEI.exe
  C:\Windows\System\HYxJFEI.exe
  2⤵
  PID:9232
- C:\Windows\System\gRcERhb.exe
  C:\Windows\System\gRcERhb.exe
  2⤵
  PID:9252
- C:\Windows\System\zSvBZDj.exe
  C:\Windows\System\zSvBZDj.exe
  2⤵
  PID:8908
- C:\Windows\System\YUNBTRS.exe
  C:\Windows\System\YUNBTRS.exe
  2⤵
  PID:9392
- C:\Windows\System\iHglgTZ.exe
  C:\Windows\System\iHglgTZ.exe
  2⤵
  PID:9380
- C:\Windows\System\QkBKQhi.exe
  C:\Windows\System\QkBKQhi.exe
  2⤵
  PID:9344
- C:\Windows\System\QDQDgTs.exe
  C:\Windows\System\QDQDgTs.exe
  2⤵
  PID:9284
- C:\Windows\System\lbRGuzz.exe
  C:\Windows\System\lbRGuzz.exe
  2⤵
  PID:9440
- C:\Windows\System\iuKbskF.exe
  C:\Windows\System\iuKbskF.exe
  2⤵
  PID:9504
- C:\Windows\System\wkbpAWr.exe
  C:\Windows\System\wkbpAWr.exe
  2⤵
  PID:9540
- C:\Windows\System\bJElAMj.exe
  C:\Windows\System\bJElAMj.exe
  2⤵
  PID:9524
- C:\Windows\System\oUZmXNE.exe
  C:\Windows\System\oUZmXNE.exe
  2⤵
  PID:9584
- C:\Windows\System\tBOXiXi.exe
  C:\Windows\System\tBOXiXi.exe
  2⤵
  PID:9572
- C:\Windows\System\ebrOiHW.exe
  C:\Windows\System\ebrOiHW.exe
  2⤵
  PID:9684
- C:\Windows\System\YTgBdGD.exe
  C:\Windows\System\YTgBdGD.exe
  2⤵
  PID:9716
- C:\Windows\System\nRMUVMS.exe
  C:\Windows\System\nRMUVMS.exe
  2⤵
  PID:9780
- C:\Windows\System\tIaoAyq.exe
  C:\Windows\System\tIaoAyq.exe
  2⤵
  PID:9808
- C:\Windows\System\OOBpbzG.exe
  C:\Windows\System\OOBpbzG.exe
  2⤵
  PID:9840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DePBTLm.exe

Filesize
1.7MB

MD5
900196e5523fea2b8c49d1069034495e

SHA1
722611d8862d7838f3a8df5d74e4641228edb46a

SHA256
78f8b4830f7bc3695fe9927160f9fa83a8a94006238c1e782c92ae8c2da03c91

SHA512
bf3a23d64031e6fced49553d0886a4c664d6004eda102804fa7645cee5f5d465adeae1914540392162e5fa04f3f007814f275a4ef745d46a3c91b8fd6a44cf00

Download Submit
C:\Windows\system\JhCfkts.exe

Filesize
1.7MB

MD5
860f190e09ab64fb6a242f569592c126

SHA1
7a9359def4480109d90e4eb61fcc2df944444959

SHA256
8a3133e032c7d45ed92ac7384c3041154077f1855c1fb84d82e5fba72a9ba88d

SHA512
26d6d990e08864714e85097ceee3a219c803b6e7deda8a87209ab586c5cc2b2a022c9faee6cb2deb0818f615b224f2cd4b86bc75ac9c96977f71e2f7b4430f91

Download Submit
C:\Windows\system\VfRXbJu.exe

Filesize
1.7MB

MD5
cf2b28bb41a443dedf95458877cbfc34

SHA1
5fb9c21475343cd57a9fab37e5539cf6fcf8dfea

SHA256
39807a1e41367c9ee13a2b3b45c49f2d084c30a940838d7ed86150022e73a380

SHA512
5ab94e7aa525acea778fb9c1753500beb8ee5a2d7f413f00a453838af18e98bd9bdd8b2449164adf163b35901e4fee29092d01cb42447dc370ae8234f45d290d

Download Submit
C:\Windows\system\WQYGpcD.exe

Filesize
1.7MB

MD5
f73402bdb1b69c6ebddbdd3e46005cde

SHA1
949f938a671fddbcc60abfde5ae870bb822f1dd0

SHA256
293264dee3e219ede9b7a777476f0595d7025ad8a3f5f94db7921605e3f5ff25

SHA512
014b910cbb016fa0234df672decad64c54f38c1613ff43ad78c358ee1c38f3a052ec80239fd2805980a295eb0da3d80f6c05f87ad898186644a78fa5dddc7abd

Download Submit
C:\Windows\system\XEHiegm.exe

Filesize
1.7MB

MD5
8ccf6f15c9dcecf022b1f00ff2044ab3

SHA1
37a8f032a6f766724eb73e0f4b89db554d0f19ae

SHA256
b493aeeb7dfcf32396f7d611cc6661b5a1eda830ae40ece3a86972a045fdb201

SHA512
b54d2df88a35afeb89145adac6856b4c9db1bc3c3aecce66c00925977df28cf63cad34266824512671d9e25454f8e07bbd94a7047a4a28b689cc73a57449ad51

Download Submit
C:\Windows\system\XublfDO.exe

Filesize
1.7MB

MD5
fe22cd1202b48a9ec7f11c19dc427700

SHA1
dd7dad54e114051002bcdaed2ce87dcad77222c2

SHA256
c8716355c3f5cb9c1b04a0b1c1cc8004bc61eb012ae0d4b28a3633eda357ee7a

SHA512
f2903e7c63d66cc7c94980890d430bde789bb2002edad625d8f717d43c20f072c43aa215759fe9b37957c241138f35bb7ec23d62c06f533fedbff167342b2ba9

Download Submit
C:\Windows\system\YDFIxbo.exe

Filesize
1.7MB

MD5
56185f8e86af634174ce37eb715ef762

SHA1
4aa71678c8d912b72ee16c40d8d6b7426eb8bd59

SHA256
c2a4ed522f1610b7515540daa2d9d5abdfbe58c1e0573ab36e35c145e13d7841

SHA512
5ce538f9cceb6c2f1e4676a061de4908f8b5cd22858c66a0d8ab85ee6d82b72c337026fc287410ffe686bc8568ea90daa0f10262bbaef45553681b9ec2f0846c

Download Submit
C:\Windows\system\YUSVCMV.exe

Filesize
1.7MB

MD5
97af94e1d88ba63a160c729ddba3a6cf

SHA1
4ce2c71c151c99c7300854f831222b885fc6b0b4

SHA256
47f61120792e914160c89bce6e585e6d155cefdafce2e1f166ec3bd9105ef9a4

SHA512
24ddb6882175afd68eec2c9ea3a53411d6fee445766ffa91cfd82b37b0abee3e5adf27d91c1886091541c6c1503d52c0f0f267ff12bc3308feb2ee3407321c27

Download Submit
C:\Windows\system\YmZSxgE.exe

Filesize
1.7MB

MD5
0379c74f999d448770264be8a16a34db

SHA1
e9ba1389504eb99d1299de62cdd6ca1cb0520113

SHA256
6c434a944c60b13ac2c234931e36a55203e807ef3732fa640f51630af50ebd1e

SHA512
1c38f4cf94af2deda1ca1106f1d0e7f36698acb7ef99f91044e54be07cf4502f6ccaceda700801d1a4eaec1a3e3e476127790363c8aa50b083948591b9fa7a19

Download Submit
C:\Windows\system\ZXvnnCH.exe

Filesize
1.7MB

MD5
d8d1d0f4af0a58eaeb235f0a90f1586e

SHA1
8f95afe5f7b2ec00b366cc98f15ec3b9614f042e

SHA256
312c84958c8629b13f6355574cf8b8aa127ff894b41e19aa361f27119b93f719

SHA512
23ee41f25427d9c1ed7fc80292f9b3fa3da6e6a0e80c52d46693bba8d0676e297fc3c19e0d6eed66e7fcf649bec21cf89ff21f1e52c0f37d21845e2a01903df8

Download Submit
C:\Windows\system\ZzWfrQr.exe

Filesize
1.7MB

MD5
53d1a482ecb1b23809be2f5943bc5304

SHA1
251eb1c010e50440bbdeebbec58a3aff284d2ec0

SHA256
6377bf0a2d9bb058f310e5f63c0b2e1df17029320ace7d6cca31ed7d66c23841

SHA512
295b5eb03edf703bebfbcd70ee28e2b33ca6ec22a27493ba16d58f755d2258edf9727a3d772b26d2646e2b743f05a1a7150546ac4475b2edb7bdcbfe5c2cd232

Download Submit
C:\Windows\system\dhGEMUW.exe

Filesize
1.7MB

MD5
7b6b4c0fd8777c025239fd64e63292e4

SHA1
99c34a96cda5b859ae87467371f24d059ed01319

SHA256
f3d867db3b2f9aa9acd0cabc133a4108939ba5f5238a59c418c85b9c6fb07ac1

SHA512
8cde7850c89efe4f7c6f389dc04291ff1043f342f05e9a8521057f3bb55596a8b17c19d969e6c3584389cd1579474a339ec94791a5557b3c505840ef0a54ba77

Download Submit
C:\Windows\system\huqgUuq.exe

Filesize
1.7MB

MD5
a09e68d3f325f1d439c111ec499080be

SHA1
3fc63c22f882eefa56335d7be571b9c49a5c2092

SHA256
ef9a2ed0edfa4b72369fdb86436a85ec45cb7d0ed4e160a1d7960c593a46db62

SHA512
459301e12643cd461fdfbb7069499629364ccc86e353ef647d00209c914c246caaa72714fdd7f4824dc957906c831072d7b2ff13988a0aa27e34e1946ae6fc29

Download Submit
C:\Windows\system\izTZLTi.exe

Filesize
1.7MB

MD5
c532c9b3159f8cb6a899236b0cf8664d

SHA1
ccdcc0dd8b6086cbb74022f5fbb99275b4ce3955

SHA256
386bdb5f95ab628ee329f9118de056e244d6c1a8780c0bacd77aa47ac9c1f572

SHA512
d4444079e74ace1b24ff90304ae94d6b0f83f50783b1f367ce10f2bfde4ae3399d2492aa263b44dc15ac9a4a16260c2eb6518a8b023fdf979437063b656a9be8

Download Submit
C:\Windows\system\oWevImg.exe

Filesize
1.7MB

MD5
1e5e3dfeb4093ee41985f01b1b875772

SHA1
b37d5eee3934cd33625004570be321a6513ee241

SHA256
6ae3b4e6a6e176850ff755ba140d9c961c8362a28568db88f0f03b66b6957a18

SHA512
2529703979122cfa9784157e4be2ab91b453ea5aa306e1849f3ff9e205151ead8822d53ce8dddeae0cd2d94dbdd02d5455b8b671b989c3bdef215c8aa3dec551

Download Submit
C:\Windows\system\oluKvmI.exe

Filesize
1.7MB

MD5
5cc8f7c163052c584d96875e685c1330

SHA1
c7a577cb83b2ca4169d95f2c169025219778018d

SHA256
4c3fa55bd8cbc84afcc81d1175bec5840aeeac808d61ac0d11abd921c7a3306a

SHA512
0c3f1d80f113741fda3bedc5866811c6cdff02e6d71671ebae9d4cf076fcf8fe81bf72afea045b76293c8efcdc8e8410644ecba72edaee29852428ce779b68f8

Download Submit
C:\Windows\system\pdIaUmU.exe

Filesize
1.7MB

MD5
819036f757b795926abb37dfe6f62d4b

SHA1
35ae5dc61e815aff9564879ba8128568528b6122

SHA256
57937f89f7a0bda1c032462a61b7d1b9d23c01ac660b64373460233d2a786045

SHA512
867c533adec9d60157f043d80c0b51243010d4b0ab3769dbcedb84a761c7ca868b7f9ecc28fb108f88b3f4f5d74e8a6f45949fa69a3e4514a93b662ed5a26cd0

Download Submit
C:\Windows\system\rdxEiNg.exe

Filesize
1.7MB

MD5
96b5757e204512353a3178672564f266

SHA1
9216c5dc6117c69fc7855f0f995f1f31b76e117c

SHA256
1c0ca0c8aa7419b569d562711dec6dd4c9280059da500a7eac0f001b21bd6c50

SHA512
bf3b32146859e1fdb017de70ec45746733d76374653eae4403a7fe81c90596aa6f8c8327230a327f34e50bea32df9cf119659411f72dc5cf2d6ed3fd2401f32c

Download Submit
C:\Windows\system\sqPnHxp.exe

Filesize
1.7MB

MD5
10e17f658b00c394116ba9b48cc4e9f1

SHA1
c7e485838282d3064cd099480b0a368978ebdbd3

SHA256
c2a7570095799fa2a0ebbe5c832a33ef8c7ea7df2dc924c81a0e44e6fc80eb34

SHA512
eee1e657383c22602a034464d1be32181a40d075dc38d667edea9edc6a6e24aa3502a32fcc236a3873cff5206eef1f2811d6eacca551a2366689a8eba7af96d6

Download Submit
C:\Windows\system\zgmLhmG.exe

Filesize
1.7MB

MD5
24b580815c42f4bc84ca3b469adca834

SHA1
8db0952b94c9a7c9b2322ffc8deab6ff7bdf9d70

SHA256
2a9c3030d76e624a344568cb2cbab3585abef0c08de0eb1c60229f40eb3d110d

SHA512
21f5b6d56f253e41c9630a85d9e90276bb6a95f6eff645f25eb3083df8801fe89f8edac6e653ba8a799e4a245c652fd8fc3a50f75dbe011463749c4d9e9c38f7

Download Submit
\Windows\system\EaufGZF.exe

Filesize
1.7MB

MD5
b5137229754bce9d5087d8102badbd09

SHA1
dd0696e9fc373924f38a07dad59b7c63504d4b77

SHA256
13935403261ae0ba5f24a86786c63b354b573551be75f2df9bbfb9d8879350e5

SHA512
500dafbffc60f66d832518082a660a75a1f0c1be4834970634b19f015aa73c3c2cf41c6446b148bad9bd62e0f7ea910f068a5a5074b232c3bff47a36ed6c8a0f

Download Submit
\Windows\system\GvMuQBE.exe

Filesize
1.7MB

MD5
5b7c4c2e9af62ddf60128254ffedfea9

SHA1
4b31e5c8fbcdf5a4acaaeae501b0dbe740ed99ca

SHA256
1dd5247b926a5cc4b7c687d5cdea154770fcfe018bd0ed40469287b8db6a5348

SHA512
591dad3f203969a5fd21ccccfcc8b3e16376172c5cc50ffb163572a5fd542ebadc7e794d4893dde25251f918153cf9ace7e348dae7fd7c7274705daaa3cab4b0

Download Submit
\Windows\system\HjCFQHp.exe

Filesize
1.7MB

MD5
ce6e77e0b681ede2b03b17bcd8ad3684

SHA1
a41f7110507f08ba52e536ee94a0da4715395959

SHA256
778420dfa88d604a06c0104fddc487cc37ddcb61ea3c9424cdf8826a89b46ad9

SHA512
e4440428778887d2cb264323ec0044511b60202bd9d9f9389574a337f863ce05e1bee0f5d7d64480a280a6b4880d627a3c038f93410022db61d20379cbe2872d

Download Submit
\Windows\system\JLucPBo.exe

Filesize
1.7MB

MD5
9f7689ef519feb8903c3edbaaedbbf24

SHA1
4fda3602882377c531f7ae3c45723d06bc4f5977

SHA256
fd0fa87cbabd56650fb3af606321cb6df011253b0adb47aff533ea659b124c92

SHA512
8e1987efe631233af30f77f42195e1f0671d90412962f7b99ff38fca3f911e557284a987241c9dee93e59ef16b74b68cfbfdb607e79a76a5dfc0cd985da4df2e

Download Submit
\Windows\system\NrBAqBA.exe

Filesize
1.7MB

MD5
4f85d8d0c35d7ab6f31f3ec000dc6661

SHA1
eee0bed0d79acf0b94ea37115600f2cdc53263dd

SHA256
3a7cc7875e288f06beb6afbf80064a80624034c23d033837676cdf5a14284859

SHA512
4eba1e1ce3b5fd5d4a8457a5f66e5bd762cbb4d3123e0e2a66c633008d9c21f378710a36532800994b3fb7c6228c0e555fc18eea74f8416fb01246088b7099f8

Download Submit
\Windows\system\Rktoeho.exe

Filesize
1.7MB

MD5
ef6662b0bfda8483adda0c94693529ea

SHA1
9bf5ad4f9eab1f322a6da0e400c05148701a36b0

SHA256
a0e0472349c5bfbb7b688a72751e1ec4f44ed87451a8aff4fd1df740a0eba89c

SHA512
cb8726d043b6aeabb1d09be1b69a872f18132afdd47da0159344363866a32d6a417ff5bbc7e3654a154e63f1d6d18e4ad5a5df9e263ec4b1d9b6cfbca6e1da3b

Download Submit
\Windows\system\UGdqZcn.exe

Filesize
1.7MB

MD5
b08915bb0609182b9d93fbc2ef0964cb

SHA1
3f5a1abbc175f6c5c7b6a135e1f20c423c239921

SHA256
c8f304327e20c455aeb23a724f45450e4d6af62a3f651c2a268f1cf2e222beb7

SHA512
e195459711902b4c1789a78ba113b583f8a4ef3b8c7a7e9ef40abb4adf6c7c0c8199edd9aa5094245b141f11fdc16d2734588ad55346eb262277781f47e18221

Download Submit
\Windows\system\VEReial.exe

Filesize
1.7MB

MD5
841ba27a3f1e32d8dc2e1ec1a22ff716

SHA1
40024a89adbd54969b3a0da2fb532fb427ed8450

SHA256
4716334b0965559bcae1ebb115bc93c94e58e5eaf6e08e82c6469e4e096f8c08

SHA512
08d6bea966e87dbf0bd12ec89d90abf1d90e70ef40a1c49ffdfb25f8288d7ede2be90c7ad495b19b60e6e555850ec3d3e9f5d4dcde54025ca9ba6b5aec97dabb

Download Submit
\Windows\system\XVJcpre.exe

Filesize
1.7MB

MD5
8eaa07ae0cb9ccd36e8fcadafc33f8cd

SHA1
c6dcfc35ed1860f7af553e259c9fa11c4e56d03a

SHA256
ba2b00e1a651dacb140684bf8a1e8a69aadfb6fc31bce9bd63d7b967bd5fc5d9

SHA512
d80737b41a897cc5be7cf91b987e954252373ba510665c41168cd4befef5392e273395125e7ec3312714234043ff10bbd67ed98af012683d87163e0f2974789b

Download Submit
\Windows\system\ZnqfHhe.exe

Filesize
1.7MB

MD5
540c7283693565b3091ca7ae4705f020

SHA1
1462c2b62b5987363e560144ee66afb2a57a835e

SHA256
d1aedd74af2a67d7ca35dd7737b072f290fd087c98bed76cd1486b1a43bc74a4

SHA512
fd792203dfa2b732ddb16221130ade65cb4a14793e57578bc7bb1dbca28e0619e6b7c84cc892ea6ec22dfa5e8cc87a7f0761c6e0ed59564385c43fa425566713

Download Submit
\Windows\system\dwZoBIf.exe

Filesize
1.7MB

MD5
db7456e333aa6eafbfabdc8c23fd8b46

SHA1
27079a5366ceee973e99201bda8f0f94a16098ea

SHA256
83d1fd805cee99861b0f23d27b040ce192a83e383fe281b29c40e90f1f7b67af

SHA512
a0d1cdf85bac86f0063eccb7d6a25dd6d98cdf9173d7cb045674c15a20effe7855821660d2263ab452a5b090c3e86416c9137aed23f56b4e75b8ec522fc5ebe8

Download Submit
\Windows\system\iWunbAV.exe

Filesize
1.7MB

MD5
ec27bda20407b88f336e243282b3e7f0

SHA1
aeeb34d36ed500c2aa515e92aa748fec6e92c1c9

SHA256
081e9caa6be75bfd72a4c169fc644755408833b05f86da945d34cdad8af1e450

SHA512
efdce17b799550a60fdeb2cf80a85acd73e5b6be3b3708e0bad8ced14ba195f16965bb21f3158ba03534999f14b0adb3e808f2f802adc10a65b9e62de706c9c8

Download Submit
\Windows\system\rxSWbqL.exe

Filesize
1.7MB

MD5
8ddf2d878b7a89fee6e3b9e927052455

SHA1
29db2852ca7bc30b8aea30fcb182535db432cd4f

SHA256
a088ab7b39b513e457e52a1e30c7729ff79d336ad46cfa0f8f41eabbc7ccacb6

SHA512
e7c53a55526a6fe6174423b47d1c9f3082ac640f202cb69d4bdd1ca1cd8faf68c320df2eab304697e08b903fea6343d69ada3801fdf50f76fcffe737dead3e6f

Download Submit
\Windows\system\vdQWWWn.exe

Filesize
1.7MB

MD5
e576b5b8a02bb86d9014521b8c7ae5a7

SHA1
1db70419bead0171570dc588cbcef53ef59350dd

SHA256
e1ed7264618c6e9df423f47fb8f146678cd6e6b80b8dd8aca05a39ece365a504

SHA512
8982e53a69489ef1cee6b9c3220f84b0fa79dee6818f5638415a070d873a82f34c4cbc6c0cb51ce6445fb5c219f74f56237aa1c8920d8ce24cc4084edb7a812a

Download Submit
\Windows\system\wtnBkua.exe

Filesize
1.7MB

MD5
a9860e7b021daef6ec681eca898d255f

SHA1
e766fc500a984138302cb2b96c5f69846606d25d

SHA256
d40f77370c4c5d16b2c67807f4e6c97b80af6ae4f15d76a5a10333f60bcc32a5

SHA512
6d9b9facb0278bb74e63b96bb6e88c1f47218473421080abecfc0d4c245b4060236bfe2d933141e7625c7611ac6a6ed7bdbe7cb24b33cfa96c783879150aea34

Download Submit
\Windows\system\xolfzGc.exe

Filesize
1.7MB

MD5
c36b1b01e7d8474c76da0a6d8d53f2b8

SHA1
974e11dbcb8e3f182b4b751f670c54bfbc4385b9

SHA256
58425ee9f5713c0930c3d90b7049f62f83c1675a579a0cea3d6983ebf15510c0

SHA512
0b45a7394e74000aac46d6ec44945d48d9ea350c4ab800252bd006819c965ee0dbb4c45c3658609f3569a19c6f5fd3df7e561590610aafb0ffd6774958a2aed0

Download Submit
\Windows\system\ypkAoEY.exe

Filesize
1.7MB

MD5
6af5b70a23ae4b78490de189b81905de

SHA1
14859f3ae367002b3fd6e5a97b82d886fed22641

SHA256
4cd0a9bc35a9d0f703195fc8c37791df1cd6101974e2e6b9e60f2493399f9d6f

SHA512
4761ff8d18623e648a28f2395769550925c653ba03a5b283047f98838476b6bdda6326fd09910cc873e1de76d1aa2fe4816252276545ffb3f55f287fd3eca97f

Download Submit
memory/868-18-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-32-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2216-236-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-231-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-6-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2216-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2216-221-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2216-23-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2216-229-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-220-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2216-233-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-230-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-227-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2216-235-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2480-228-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2488-224-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2500-225-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2520-226-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-304-0x000007FEF5580000-0x000007FEF5F1D000-memory.dmp

Filesize
9.6MB

Download
memory/2548-71-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2548-95-0x0000000002070000-0x0000000002078000-memory.dmp

Filesize
32KB

Download
memory/2548-46-0x0000000002DA0000-0x0000000002E20000-memory.dmp

Filesize
512KB

Download
memory/2548-216-0x000007FEF5580000-0x000007FEF5F1D000-memory.dmp

Filesize
9.6MB

Download
memory/2548-219-0x0000000002DA0000-0x0000000002E20000-memory.dmp

Filesize
512KB

Download
memory/2548-232-0x000007FEF5580000-0x000007FEF5F1D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-44-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2828-222-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-234-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download