xmrig | 3eab933b82077df388e9ecce311659bc1a8c3d27c1c252db72f0350f950df2b8

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
Size

1.8MB
MD5

0d364ac7e5abe0363e6f17201f6e89e5
SHA1

1922b35dffd5574f4781699681b7b8823694017d
SHA256

3eab933b82077df388e9ecce311659bc1a8c3d27c1c252db72f0350f950df2b8
SHA512

a3b6fd1873ef5a10b17dcf68ca4bf341a3841ccfc47ce5e4ddfe5885f361fc92678fa174c2d7d2802abe78e90f10865e6e959acb6c53c101640b336d68b74867
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pOI:NABv

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2488-79-0x000000013F750000-0x000000013FB42000-memory.dmp	xmrig
behavioral1/memory/2628-78-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2516-77-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2760-76-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	xmrig
behavioral1/memory/2624-72-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2548-68-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2696-53-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/2712-48-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2516-4701-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2712-4699-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2620-4698-0x000000013FD50000-0x0000000140142000-memory.dmp	xmrig
behavioral1/memory/2624-4697-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2760-4703-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	xmrig
behavioral1/memory/2548-4702-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2872-4707-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	xmrig
behavioral1/memory/2628-4706-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2488-4708-0x000000013F750000-0x000000013FB42000-memory.dmp	xmrig
behavioral1/memory/2696-4747-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/2860-4734-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/1728-11372-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1584	nEeTdEa.exe
2620	BPBGxUM.exe
2712	dPMutMg.exe
2696	znCbCwu.exe
2624	CQaFPoB.exe
2760	PEYvfUo.exe
2516	bTIBtkU.exe
2548	HPUsSrN.exe
2628	vtuRmUq.exe
2488	HaKUHtn.exe
2872	PsOwiQY.exe
2860	GnwZenB.exe
1528	vjmgqgr.exe
800	tUSkRlF.exe
1616	wRluimr.exe
2208	SzILStC.exe
1828	mmljyGy.exe
2016	WcKRbKD.exe
2480	wDuQFUN.exe
2992	byenFOL.exe
2740	eoDNTXk.exe
1292	HBGURZF.exe
880	eJMsBdJ.exe
1964	cteVeoP.exe
2144	VSKnOIl.exe
596	jyjlDEJ.exe
740	lYisUVS.exe
580	CUByPqm.exe
588	odSCsIW.exe
656	kbZjphn.exe
1084	qyLyNyy.exe
1152	VLdeluE.exe
1932	DqFVxaL.exe
1056	tHZeOEb.exe
1628	JvKAMKN.exe
1820	AyNYYZM.exe
2476	rbkFbeB.exe
320	ivPWAWn.exe
1156	LnJmFQx.exe
1164	GYfmymD.exe
1656	JXjVxqQ.exe
2020	NGlqGde.exe
1684	RgmKPWf.exe
2996	MRlhLJA.exe
1608	PeZXaBz.exe
2052	WQGJWHp.exe
1732	vOMAAMJ.exe
2404	JDcOxsq.exe
2164	RJABJBw.exe
2432	oYwLCPd.exe
1716	HsAswGy.exe
848	QMFSzYQ.exe
2632	aTNuUom.exe
2736	XZXDsYb.exe
2172	sjNmaGG.exe
2400	WoCIodQ.exe
2692	hyNfMev.exe
2540	gBNPBiF.exe
2564	VYwCFhi.exe
2796	WDiwLrg.exe
2884	VUkjSVW.exe
2028	BSsBHMQ.exe
2720	XYnIJxy.exe
1000	QIsBYsq.exe

Loads dropped DLL 64 IoCs

pid	Process
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1728-0-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/files/0x000c0000000136fc-6.dat	upx
behavioral1/files/0x0033000000013f21-14.dat	upx
behavioral1/files/0x001400000000549e-19.dat	upx
behavioral1/files/0x00090000000141b5-23.dat	upx
behavioral1/files/0x0007000000014216-24.dat	upx
behavioral1/memory/1584-25-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/files/0x0007000000014284-30.dat	upx
behavioral1/memory/2620-33-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/memory/2488-79-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/files/0x0006000000015136-94.dat	upx
behavioral1/files/0x0006000000015b13-114.dat	upx
behavioral1/files/0x0006000000015b77-118.dat	upx
behavioral1/files/0x0006000000015bb9-122.dat	upx
behavioral1/files/0x0006000000015cca-168.dat	upx
behavioral1/files/0x0006000000015cec-176.dat	upx
behavioral1/files/0x0006000000015cb9-160.dat	upx
behavioral1/files/0x0006000000015cdb-172.dat	upx
behavioral1/files/0x0006000000015cc1-164.dat	upx
behavioral1/files/0x0006000000015cad-156.dat	upx
behavioral1/files/0x0006000000015ca5-152.dat	upx
behavioral1/files/0x0006000000015c9c-148.dat	upx
behavioral1/files/0x0006000000015c86-144.dat	upx
behavioral1/files/0x0006000000015c6d-134.dat	upx
behavioral1/files/0x0006000000015c7c-140.dat	upx
behavioral1/files/0x0006000000015c51-126.dat	upx
behavioral1/files/0x0006000000015642-110.dat	upx
behavioral1/files/0x00060000000155e3-106.dat	upx
behavioral1/files/0x00060000000153cf-102.dat	upx
behavioral1/files/0x0006000000015362-98.dat	upx
behavioral1/memory/2860-91-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/files/0x003400000001416f-88.dat	upx
behavioral1/memory/2872-85-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/memory/2628-78-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2516-77-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/2760-76-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	upx
behavioral1/memory/2624-72-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/files/0x0006000000014e5a-71.dat	upx
behavioral1/memory/2548-68-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/files/0x0007000000014319-66.dat	upx
behavioral1/files/0x0006000000015023-83.dat	upx
behavioral1/files/0x000900000001444f-59.dat	upx
behavioral1/files/0x000700000001430e-58.dat	upx
behavioral1/memory/2696-53-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/memory/2712-48-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/2516-4701-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/2712-4699-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/2620-4698-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/memory/2624-4697-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/memory/2760-4703-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	upx
behavioral1/memory/2548-4702-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2872-4707-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/memory/2628-4706-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2488-4708-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/memory/2696-4747-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/memory/2860-4734-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/1728-11372-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zSiUlNE.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\UgQCiQx.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\rNAEqUq.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\IqOXhmz.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\WIEuxcL.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\yDHJFSG.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\nVXwFom.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\lmmwhEE.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\MzsReep.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\LCJsDYp.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\ydTpVrL.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\mwCanpa.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\OdSTBhe.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\EMLUISQ.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\aWQsRZa.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\RaGEtFl.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\pCQelSE.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\QVgCBzd.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\znDRzSs.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\gkbSHax.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\WHiDCMb.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\OxmQrFg.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\qRBqcmk.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\bbZXHdN.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\tShwmCx.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\UZBIjPs.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\WItWhLJ.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\SViJBjI.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\EiEhinL.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\GzvxszV.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\YERZyUD.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\ZMPrIju.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\LvZwNIS.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\duwHAcw.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\NvGmgOI.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\RVzrvlY.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\bFZhLQL.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\eoteNri.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\qonmwlS.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\XmpojMk.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\NHuNdxC.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\SEhlqPZ.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\teoDeEg.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\jFbSwfE.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\yrCrdzv.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\EIWgmHM.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\HbmLILw.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\PJYCXTb.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\ZkRmKZZ.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\dQNOoPx.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\bYeOeZV.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\nejvVlu.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\FZwdzvK.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\JDUMPLm.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\LblJIVb.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\FZLmAZX.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\rLatBjh.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\QQPdtzl.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\oelToNd.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\KrCpwxL.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\pMIDiGl.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\jOMqcLf.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\IQpFqwk.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
File created	C:\Windows\System\MkSFwew.exe	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2240	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
Token: SeDebugPrivilege	2240	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2240	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	29
PID 1728 wrote to memory of 2240	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	29
PID 1728 wrote to memory of 2240	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	29
PID 1728 wrote to memory of 1584	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	30
PID 1728 wrote to memory of 1584	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	30
PID 1728 wrote to memory of 1584	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	30
PID 1728 wrote to memory of 2620	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	31
PID 1728 wrote to memory of 2620	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	31
PID 1728 wrote to memory of 2620	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	31
PID 1728 wrote to memory of 2712	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	32
PID 1728 wrote to memory of 2712	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	32
PID 1728 wrote to memory of 2712	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	32
PID 1728 wrote to memory of 2696	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	33
PID 1728 wrote to memory of 2696	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	33
PID 1728 wrote to memory of 2696	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	33
PID 1728 wrote to memory of 2624	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	34
PID 1728 wrote to memory of 2624	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	34
PID 1728 wrote to memory of 2624	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	34
PID 1728 wrote to memory of 2760	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	35
PID 1728 wrote to memory of 2760	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	35
PID 1728 wrote to memory of 2760	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	35
PID 1728 wrote to memory of 2516	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	36
PID 1728 wrote to memory of 2516	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	36
PID 1728 wrote to memory of 2516	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	36
PID 1728 wrote to memory of 2628	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	37
PID 1728 wrote to memory of 2628	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	37
PID 1728 wrote to memory of 2628	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	37
PID 1728 wrote to memory of 2548	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	38
PID 1728 wrote to memory of 2548	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	38
PID 1728 wrote to memory of 2548	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	38
PID 1728 wrote to memory of 2488	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	39
PID 1728 wrote to memory of 2488	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	39
PID 1728 wrote to memory of 2488	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	39
PID 1728 wrote to memory of 2872	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	40
PID 1728 wrote to memory of 2872	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	40
PID 1728 wrote to memory of 2872	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	40
PID 1728 wrote to memory of 2860	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	41
PID 1728 wrote to memory of 2860	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	41
PID 1728 wrote to memory of 2860	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	41
PID 1728 wrote to memory of 1528	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	42
PID 1728 wrote to memory of 1528	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	42
PID 1728 wrote to memory of 1528	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	42
PID 1728 wrote to memory of 800	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	43
PID 1728 wrote to memory of 800	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	43
PID 1728 wrote to memory of 800	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	43
PID 1728 wrote to memory of 1616	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	44
PID 1728 wrote to memory of 1616	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	44
PID 1728 wrote to memory of 1616	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	44
PID 1728 wrote to memory of 2208	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	45
PID 1728 wrote to memory of 2208	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	45
PID 1728 wrote to memory of 2208	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	45
PID 1728 wrote to memory of 1828	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	46
PID 1728 wrote to memory of 1828	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	46
PID 1728 wrote to memory of 1828	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	46
PID 1728 wrote to memory of 2016	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	47
PID 1728 wrote to memory of 2016	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	47
PID 1728 wrote to memory of 2016	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	47
PID 1728 wrote to memory of 2480	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	48
PID 1728 wrote to memory of 2480	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	48
PID 1728 wrote to memory of 2480	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	48
PID 1728 wrote to memory of 2992	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	49
PID 1728 wrote to memory of 2992	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	49
PID 1728 wrote to memory of 2992	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	49
PID 1728 wrote to memory of 2740	1728	0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d364ac7e5abe0363e6f17201f6e89e5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- C:\Windows\System\nEeTdEa.exe
  C:\Windows\System\nEeTdEa.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\BPBGxUM.exe
  C:\Windows\System\BPBGxUM.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\dPMutMg.exe
  C:\Windows\System\dPMutMg.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\znCbCwu.exe
  C:\Windows\System\znCbCwu.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\CQaFPoB.exe
  C:\Windows\System\CQaFPoB.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\PEYvfUo.exe
  C:\Windows\System\PEYvfUo.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\bTIBtkU.exe
  C:\Windows\System\bTIBtkU.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\vtuRmUq.exe
  C:\Windows\System\vtuRmUq.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\HPUsSrN.exe
  C:\Windows\System\HPUsSrN.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\HaKUHtn.exe
  C:\Windows\System\HaKUHtn.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\PsOwiQY.exe
  C:\Windows\System\PsOwiQY.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\GnwZenB.exe
  C:\Windows\System\GnwZenB.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\vjmgqgr.exe
  C:\Windows\System\vjmgqgr.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\tUSkRlF.exe
  C:\Windows\System\tUSkRlF.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\wRluimr.exe
  C:\Windows\System\wRluimr.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\SzILStC.exe
  C:\Windows\System\SzILStC.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\mmljyGy.exe
  C:\Windows\System\mmljyGy.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\WcKRbKD.exe
  C:\Windows\System\WcKRbKD.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\wDuQFUN.exe
  C:\Windows\System\wDuQFUN.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\byenFOL.exe
  C:\Windows\System\byenFOL.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\eoDNTXk.exe
  C:\Windows\System\eoDNTXk.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\eJMsBdJ.exe
  C:\Windows\System\eJMsBdJ.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\HBGURZF.exe
  C:\Windows\System\HBGURZF.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\cteVeoP.exe
  C:\Windows\System\cteVeoP.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\VSKnOIl.exe
  C:\Windows\System\VSKnOIl.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\jyjlDEJ.exe
  C:\Windows\System\jyjlDEJ.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\lYisUVS.exe
  C:\Windows\System\lYisUVS.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\CUByPqm.exe
  C:\Windows\System\CUByPqm.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\odSCsIW.exe
  C:\Windows\System\odSCsIW.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\kbZjphn.exe
  C:\Windows\System\kbZjphn.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\qyLyNyy.exe
  C:\Windows\System\qyLyNyy.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\VLdeluE.exe
  C:\Windows\System\VLdeluE.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\DqFVxaL.exe
  C:\Windows\System\DqFVxaL.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\tHZeOEb.exe
  C:\Windows\System\tHZeOEb.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\JvKAMKN.exe
  C:\Windows\System\JvKAMKN.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\AyNYYZM.exe
  C:\Windows\System\AyNYYZM.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\rbkFbeB.exe
  C:\Windows\System\rbkFbeB.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\ivPWAWn.exe
  C:\Windows\System\ivPWAWn.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\LnJmFQx.exe
  C:\Windows\System\LnJmFQx.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\GYfmymD.exe
  C:\Windows\System\GYfmymD.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\JXjVxqQ.exe
  C:\Windows\System\JXjVxqQ.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\NGlqGde.exe
  C:\Windows\System\NGlqGde.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\RgmKPWf.exe
  C:\Windows\System\RgmKPWf.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\MRlhLJA.exe
  C:\Windows\System\MRlhLJA.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\PeZXaBz.exe
  C:\Windows\System\PeZXaBz.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\WQGJWHp.exe
  C:\Windows\System\WQGJWHp.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\vOMAAMJ.exe
  C:\Windows\System\vOMAAMJ.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\JDcOxsq.exe
  C:\Windows\System\JDcOxsq.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\RJABJBw.exe
  C:\Windows\System\RJABJBw.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\oYwLCPd.exe
  C:\Windows\System\oYwLCPd.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\HsAswGy.exe
  C:\Windows\System\HsAswGy.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\QMFSzYQ.exe
  C:\Windows\System\QMFSzYQ.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\aTNuUom.exe
  C:\Windows\System\aTNuUom.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\XZXDsYb.exe
  C:\Windows\System\XZXDsYb.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\sjNmaGG.exe
  C:\Windows\System\sjNmaGG.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\WoCIodQ.exe
  C:\Windows\System\WoCIodQ.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\hyNfMev.exe
  C:\Windows\System\hyNfMev.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\gBNPBiF.exe
  C:\Windows\System\gBNPBiF.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\VYwCFhi.exe
  C:\Windows\System\VYwCFhi.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\WDiwLrg.exe
  C:\Windows\System\WDiwLrg.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\VUkjSVW.exe
  C:\Windows\System\VUkjSVW.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\BSsBHMQ.exe
  C:\Windows\System\BSsBHMQ.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\XYnIJxy.exe
  C:\Windows\System\XYnIJxy.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\QIsBYsq.exe
  C:\Windows\System\QIsBYsq.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\izMRwzM.exe
  C:\Windows\System\izMRwzM.exe
  2⤵
  PID:1588
- C:\Windows\System\GJSfMpC.exe
  C:\Windows\System\GJSfMpC.exe
  2⤵
  PID:864
- C:\Windows\System\SNxyVIf.exe
  C:\Windows\System\SNxyVIf.exe
  2⤵
  PID:3016
- C:\Windows\System\PVwstUH.exe
  C:\Windows\System\PVwstUH.exe
  2⤵
  PID:2648
- C:\Windows\System\UfaBVQK.exe
  C:\Windows\System\UfaBVQK.exe
  2⤵
  PID:2300
- C:\Windows\System\ZlfqfzE.exe
  C:\Windows\System\ZlfqfzE.exe
  2⤵
  PID:3008
- C:\Windows\System\BZekTJJ.exe
  C:\Windows\System\BZekTJJ.exe
  2⤵
  PID:2716
- C:\Windows\System\RiYRKuw.exe
  C:\Windows\System\RiYRKuw.exe
  2⤵
  PID:3056
- C:\Windows\System\JcYNbAO.exe
  C:\Windows\System\JcYNbAO.exe
  2⤵
  PID:2824
- C:\Windows\System\qtaKZDv.exe
  C:\Windows\System\qtaKZDv.exe
  2⤵
  PID:2288
- C:\Windows\System\AuVruAr.exe
  C:\Windows\System\AuVruAr.exe
  2⤵
  PID:2464
- C:\Windows\System\evFBxkb.exe
  C:\Windows\System\evFBxkb.exe
  2⤵
  PID:1988
- C:\Windows\System\YyGTUDM.exe
  C:\Windows\System\YyGTUDM.exe
  2⤵
  PID:500
- C:\Windows\System\IaZpjsg.exe
  C:\Windows\System\IaZpjsg.exe
  2⤵
  PID:1812
- C:\Windows\System\ikGCBvW.exe
  C:\Windows\System\ikGCBvW.exe
  2⤵
  PID:2888
- C:\Windows\System\CbuysYN.exe
  C:\Windows\System\CbuysYN.exe
  2⤵
  PID:796
- C:\Windows\System\gNxHAMF.exe
  C:\Windows\System\gNxHAMF.exe
  2⤵
  PID:1548
- C:\Windows\System\eVVDSNw.exe
  C:\Windows\System\eVVDSNw.exe
  2⤵
  PID:1872
- C:\Windows\System\amQfbvo.exe
  C:\Windows\System\amQfbvo.exe
  2⤵
  PID:2324
- C:\Windows\System\ELwFozo.exe
  C:\Windows\System\ELwFozo.exe
  2⤵
  PID:960
- C:\Windows\System\hmgFQcn.exe
  C:\Windows\System\hmgFQcn.exe
  2⤵
  PID:1996
- C:\Windows\System\HrgCwff.exe
  C:\Windows\System\HrgCwff.exe
  2⤵
  PID:2988
- C:\Windows\System\IGiLbLd.exe
  C:\Windows\System\IGiLbLd.exe
  2⤵
  PID:2968
- C:\Windows\System\dpujJra.exe
  C:\Windows\System\dpujJra.exe
  2⤵
  PID:2372
- C:\Windows\System\OxUjftZ.exe
  C:\Windows\System\OxUjftZ.exe
  2⤵
  PID:2260
- C:\Windows\System\OBzdZAh.exe
  C:\Windows\System\OBzdZAh.exe
  2⤵
  PID:108
- C:\Windows\System\FTQWloo.exe
  C:\Windows\System\FTQWloo.exe
  2⤵
  PID:1712
- C:\Windows\System\BeVKdnz.exe
  C:\Windows\System\BeVKdnz.exe
  2⤵
  PID:1212
- C:\Windows\System\TDRuxZx.exe
  C:\Windows\System\TDRuxZx.exe
  2⤵
  PID:2636
- C:\Windows\System\nbrkCZZ.exe
  C:\Windows\System\nbrkCZZ.exe
  2⤵
  PID:2536
- C:\Windows\System\eOndXjv.exe
  C:\Windows\System\eOndXjv.exe
  2⤵
  PID:3020
- C:\Windows\System\fZoJUOs.exe
  C:\Windows\System\fZoJUOs.exe
  2⤵
  PID:3004
- C:\Windows\System\eIVOAJX.exe
  C:\Windows\System\eIVOAJX.exe
  2⤵
  PID:2524
- C:\Windows\System\FlsoefU.exe
  C:\Windows\System\FlsoefU.exe
  2⤵
  PID:3064
- C:\Windows\System\eleQlbP.exe
  C:\Windows\System\eleQlbP.exe
  2⤵
  PID:2444
- C:\Windows\System\gIUuvRr.exe
  C:\Windows\System\gIUuvRr.exe
  2⤵
  PID:1368
- C:\Windows\System\KpEcxmI.exe
  C:\Windows\System\KpEcxmI.exe
  2⤵
  PID:1796
- C:\Windows\System\bDXdcmN.exe
  C:\Windows\System\bDXdcmN.exe
  2⤵
  PID:2592
- C:\Windows\System\STirdMO.exe
  C:\Windows\System\STirdMO.exe
  2⤵
  PID:2752
- C:\Windows\System\EpEkqdo.exe
  C:\Windows\System\EpEkqdo.exe
  2⤵
  PID:2132
- C:\Windows\System\nxGjIxy.exe
  C:\Windows\System\nxGjIxy.exe
  2⤵
  PID:1496
- C:\Windows\System\qweWvTj.exe
  C:\Windows\System\qweWvTj.exe
  2⤵
  PID:1980
- C:\Windows\System\rRRsiif.exe
  C:\Windows\System\rRRsiif.exe
  2⤵
  PID:2120
- C:\Windows\System\QLSGjAm.exe
  C:\Windows\System\QLSGjAm.exe
  2⤵
  PID:1560
- C:\Windows\System\nCgTpea.exe
  C:\Windows\System\nCgTpea.exe
  2⤵
  PID:1780
- C:\Windows\System\acNpOJA.exe
  C:\Windows\System\acNpOJA.exe
  2⤵
  PID:2256
- C:\Windows\System\EMrUuKu.exe
  C:\Windows\System\EMrUuKu.exe
  2⤵
  PID:2928
- C:\Windows\System\idCAVnS.exe
  C:\Windows\System\idCAVnS.exe
  2⤵
  PID:768
- C:\Windows\System\WIphrzW.exe
  C:\Windows\System\WIphrzW.exe
  2⤵
  PID:1776
- C:\Windows\System\fNxCirh.exe
  C:\Windows\System\fNxCirh.exe
  2⤵
  PID:1332
- C:\Windows\System\xEEcKnJ.exe
  C:\Windows\System\xEEcKnJ.exe
  2⤵
  PID:2344
- C:\Windows\System\wdIUyyX.exe
  C:\Windows\System\wdIUyyX.exe
  2⤵
  PID:900
- C:\Windows\System\YLGqoRu.exe
  C:\Windows\System\YLGqoRu.exe
  2⤵
  PID:2064
- C:\Windows\System\eGRdDzb.exe
  C:\Windows\System\eGRdDzb.exe
  2⤵
  PID:2156
- C:\Windows\System\aiJPKvX.exe
  C:\Windows\System\aiJPKvX.exe
  2⤵
  PID:2188
- C:\Windows\System\nRATgGT.exe
  C:\Windows\System\nRATgGT.exe
  2⤵
  PID:2072
- C:\Windows\System\XKHZzVo.exe
  C:\Windows\System\XKHZzVo.exe
  2⤵
  PID:1244
- C:\Windows\System\MmJuKGS.exe
  C:\Windows\System\MmJuKGS.exe
  2⤵
  PID:1876
- C:\Windows\System\YxijgQF.exe
  C:\Windows\System\YxijgQF.exe
  2⤵
  PID:1952
- C:\Windows\System\OmdCbLV.exe
  C:\Windows\System\OmdCbLV.exe
  2⤵
  PID:1620
- C:\Windows\System\gDdQQAg.exe
  C:\Windows\System\gDdQQAg.exe
  2⤵
  PID:2032
- C:\Windows\System\JPlNCPy.exe
  C:\Windows\System\JPlNCPy.exe
  2⤵
  PID:2116
- C:\Windows\System\eATYaGe.exe
  C:\Windows\System\eATYaGe.exe
  2⤵
  PID:2772
- C:\Windows\System\DAXAOYj.exe
  C:\Windows\System\DAXAOYj.exe
  2⤵
  PID:564
- C:\Windows\System\fxWOfbu.exe
  C:\Windows\System\fxWOfbu.exe
  2⤵
  PID:2904
- C:\Windows\System\eXrGOWL.exe
  C:\Windows\System\eXrGOWL.exe
  2⤵
  PID:2196
- C:\Windows\System\HwgnvHw.exe
  C:\Windows\System\HwgnvHw.exe
  2⤵
  PID:2792
- C:\Windows\System\NflJXNJ.exe
  C:\Windows\System\NflJXNJ.exe
  2⤵
  PID:1648
- C:\Windows\System\NMjDaXq.exe
  C:\Windows\System\NMjDaXq.exe
  2⤵
  PID:1032
- C:\Windows\System\tlkFqwU.exe
  C:\Windows\System\tlkFqwU.exe
  2⤵
  PID:2856
- C:\Windows\System\YPirFwL.exe
  C:\Windows\System\YPirFwL.exe
  2⤵
  PID:1280
- C:\Windows\System\LBngnKD.exe
  C:\Windows\System\LBngnKD.exe
  2⤵
  PID:352
- C:\Windows\System\fYmBQZM.exe
  C:\Windows\System\fYmBQZM.exe
  2⤵
  PID:1696
- C:\Windows\System\YVMFRgu.exe
  C:\Windows\System\YVMFRgu.exe
  2⤵
  PID:2460
- C:\Windows\System\gONdcwE.exe
  C:\Windows\System\gONdcwE.exe
  2⤵
  PID:1688
- C:\Windows\System\LCRBSCS.exe
  C:\Windows\System\LCRBSCS.exe
  2⤵
  PID:1772
- C:\Windows\System\AHDMbyC.exe
  C:\Windows\System\AHDMbyC.exe
  2⤵
  PID:1792
- C:\Windows\System\RfbLjFv.exe
  C:\Windows\System\RfbLjFv.exe
  2⤵
  PID:2708
- C:\Windows\System\xCSCPdF.exe
  C:\Windows\System\xCSCPdF.exe
  2⤵
  PID:1816
- C:\Windows\System\uMwrPHm.exe
  C:\Windows\System\uMwrPHm.exe
  2⤵
  PID:1328
- C:\Windows\System\roEIKzO.exe
  C:\Windows\System\roEIKzO.exe
  2⤵
  PID:2508
- C:\Windows\System\dHFsHof.exe
  C:\Windows\System\dHFsHof.exe
  2⤵
  PID:1036
- C:\Windows\System\kGPoWyu.exe
  C:\Windows\System\kGPoWyu.exe
  2⤵
  PID:3000
- C:\Windows\System\awEbfyO.exe
  C:\Windows\System\awEbfyO.exe
  2⤵
  PID:2600
- C:\Windows\System\hFCUvgR.exe
  C:\Windows\System\hFCUvgR.exe
  2⤵
  PID:2220
- C:\Windows\System\xHXgava.exe
  C:\Windows\System\xHXgava.exe
  2⤵
  PID:2920
- C:\Windows\System\PaNCUGG.exe
  C:\Windows\System\PaNCUGG.exe
  2⤵
  PID:1624
- C:\Windows\System\enjQxyF.exe
  C:\Windows\System\enjQxyF.exe
  2⤵
  PID:3084
- C:\Windows\System\MSuQsiP.exe
  C:\Windows\System\MSuQsiP.exe
  2⤵
  PID:3104
- C:\Windows\System\gJoHpcD.exe
  C:\Windows\System\gJoHpcD.exe
  2⤵
  PID:3120
- C:\Windows\System\xHjWDSt.exe
  C:\Windows\System\xHjWDSt.exe
  2⤵
  PID:3136
- C:\Windows\System\CrDKDWV.exe
  C:\Windows\System\CrDKDWV.exe
  2⤵
  PID:3152
- C:\Windows\System\mHgFHeK.exe
  C:\Windows\System\mHgFHeK.exe
  2⤵
  PID:3168
- C:\Windows\System\narGPuX.exe
  C:\Windows\System\narGPuX.exe
  2⤵
  PID:3184
- C:\Windows\System\kdsIEAN.exe
  C:\Windows\System\kdsIEAN.exe
  2⤵
  PID:3204
- C:\Windows\System\oJrKuBb.exe
  C:\Windows\System\oJrKuBb.exe
  2⤵
  PID:3220
- C:\Windows\System\hJfnvOb.exe
  C:\Windows\System\hJfnvOb.exe
  2⤵
  PID:3236
- C:\Windows\System\FgUEshA.exe
  C:\Windows\System\FgUEshA.exe
  2⤵
  PID:3252
- C:\Windows\System\iFufMgr.exe
  C:\Windows\System\iFufMgr.exe
  2⤵
  PID:3268
- C:\Windows\System\MeaDZbv.exe
  C:\Windows\System\MeaDZbv.exe
  2⤵
  PID:3284
- C:\Windows\System\FkiCUdl.exe
  C:\Windows\System\FkiCUdl.exe
  2⤵
  PID:3304
- C:\Windows\System\ZTKAnbA.exe
  C:\Windows\System\ZTKAnbA.exe
  2⤵
  PID:3320
- C:\Windows\System\aLOUhCo.exe
  C:\Windows\System\aLOUhCo.exe
  2⤵
  PID:3336
- C:\Windows\System\OYVfwzL.exe
  C:\Windows\System\OYVfwzL.exe
  2⤵
  PID:3352
- C:\Windows\System\vzYaHBV.exe
  C:\Windows\System\vzYaHBV.exe
  2⤵
  PID:3556
- C:\Windows\System\uioBFbj.exe
  C:\Windows\System\uioBFbj.exe
  2⤵
  PID:3572
- C:\Windows\System\VkxhLNN.exe
  C:\Windows\System\VkxhLNN.exe
  2⤵
  PID:3588
- C:\Windows\System\jgxozBq.exe
  C:\Windows\System\jgxozBq.exe
  2⤵
  PID:3604
- C:\Windows\System\zvElFqU.exe
  C:\Windows\System\zvElFqU.exe
  2⤵
  PID:3620
- C:\Windows\System\fraYgsM.exe
  C:\Windows\System\fraYgsM.exe
  2⤵
  PID:3636
- C:\Windows\System\Kakosxk.exe
  C:\Windows\System\Kakosxk.exe
  2⤵
  PID:3660
- C:\Windows\System\IFIPjht.exe
  C:\Windows\System\IFIPjht.exe
  2⤵
  PID:3676
- C:\Windows\System\EapSdvZ.exe
  C:\Windows\System\EapSdvZ.exe
  2⤵
  PID:3696
- C:\Windows\System\msnUfHA.exe
  C:\Windows\System\msnUfHA.exe
  2⤵
  PID:3712
- C:\Windows\System\KQhTagS.exe
  C:\Windows\System\KQhTagS.exe
  2⤵
  PID:3728
- C:\Windows\System\JguXMBj.exe
  C:\Windows\System\JguXMBj.exe
  2⤵
  PID:3744
- C:\Windows\System\FFpnZBZ.exe
  C:\Windows\System\FFpnZBZ.exe
  2⤵
  PID:3760
- C:\Windows\System\PepDNHU.exe
  C:\Windows\System\PepDNHU.exe
  2⤵
  PID:3780
- C:\Windows\System\CDQoWFw.exe
  C:\Windows\System\CDQoWFw.exe
  2⤵
  PID:3796
- C:\Windows\System\zvkphio.exe
  C:\Windows\System\zvkphio.exe
  2⤵
  PID:3852
- C:\Windows\System\KxgEuNx.exe
  C:\Windows\System\KxgEuNx.exe
  2⤵
  PID:3868
- C:\Windows\System\tVqjhGt.exe
  C:\Windows\System\tVqjhGt.exe
  2⤵
  PID:3884
- C:\Windows\System\qstClFD.exe
  C:\Windows\System\qstClFD.exe
  2⤵
  PID:3900
- C:\Windows\System\gdfAukQ.exe
  C:\Windows\System\gdfAukQ.exe
  2⤵
  PID:3916
- C:\Windows\System\boHYHeg.exe
  C:\Windows\System\boHYHeg.exe
  2⤵
  PID:3932
- C:\Windows\System\GUJINed.exe
  C:\Windows\System\GUJINed.exe
  2⤵
  PID:3948
- C:\Windows\System\zKODfJm.exe
  C:\Windows\System\zKODfJm.exe
  2⤵
  PID:3964
- C:\Windows\System\WGzwCvw.exe
  C:\Windows\System\WGzwCvw.exe
  2⤵
  PID:3980
- C:\Windows\System\VWNjpsF.exe
  C:\Windows\System\VWNjpsF.exe
  2⤵
  PID:3996
- C:\Windows\System\OfOvclO.exe
  C:\Windows\System\OfOvclO.exe
  2⤵
  PID:4012
- C:\Windows\System\bQzjONE.exe
  C:\Windows\System\bQzjONE.exe
  2⤵
  PID:4028
- C:\Windows\System\BEcycYH.exe
  C:\Windows\System\BEcycYH.exe
  2⤵
  PID:4044
- C:\Windows\System\myMbACZ.exe
  C:\Windows\System\myMbACZ.exe
  2⤵
  PID:4060
- C:\Windows\System\bAEFGVF.exe
  C:\Windows\System\bAEFGVF.exe
  2⤵
  PID:4076
- C:\Windows\System\xEpOOwR.exe
  C:\Windows\System\xEpOOwR.exe
  2⤵
  PID:4092
- C:\Windows\System\JULJJSC.exe
  C:\Windows\System\JULJJSC.exe
  2⤵
  PID:1604
- C:\Windows\System\UrUWtsH.exe
  C:\Windows\System\UrUWtsH.exe
  2⤵
  PID:2892
- C:\Windows\System\nWuamAn.exe
  C:\Windows\System\nWuamAn.exe
  2⤵
  PID:2176
- C:\Windows\System\EXttXWv.exe
  C:\Windows\System\EXttXWv.exe
  2⤵
  PID:2368
- C:\Windows\System\mowdIRZ.exe
  C:\Windows\System\mowdIRZ.exe
  2⤵
  PID:1168
- C:\Windows\System\vxBnkHQ.exe
  C:\Windows\System\vxBnkHQ.exe
  2⤵
  PID:1592
- C:\Windows\System\Uzosgfr.exe
  C:\Windows\System\Uzosgfr.exe
  2⤵
  PID:3388
- C:\Windows\System\afJmpJm.exe
  C:\Windows\System\afJmpJm.exe
  2⤵
  PID:3412
- C:\Windows\System\NmLiXpe.exe
  C:\Windows\System\NmLiXpe.exe
  2⤵
  PID:3428
- C:\Windows\System\cSZYXIz.exe
  C:\Windows\System\cSZYXIz.exe
  2⤵
  PID:3448
- C:\Windows\System\oqlmhVl.exe
  C:\Windows\System\oqlmhVl.exe
  2⤵
  PID:3484
- C:\Windows\System\JDKXfIX.exe
  C:\Windows\System\JDKXfIX.exe
  2⤵
  PID:3128
- C:\Windows\System\KPrCOFs.exe
  C:\Windows\System\KPrCOFs.exe
  2⤵
  PID:3432
- C:\Windows\System\nhRMfDh.exe
  C:\Windows\System\nhRMfDh.exe
  2⤵
  PID:2532
- C:\Windows\System\FLBTdUh.exe
  C:\Windows\System\FLBTdUh.exe
  2⤵
  PID:1976
- C:\Windows\System\vZDpSKI.exe
  C:\Windows\System\vZDpSKI.exe
  2⤵
  PID:2232
- C:\Windows\System\WVRCnDi.exe
  C:\Windows\System\WVRCnDi.exe
  2⤵
  PID:3092
- C:\Windows\System\UrWJVxd.exe
  C:\Windows\System\UrWJVxd.exe
  2⤵
  PID:3192
- C:\Windows\System\izNHCnE.exe
  C:\Windows\System\izNHCnE.exe
  2⤵
  PID:3232
- C:\Windows\System\pYagffE.exe
  C:\Windows\System\pYagffE.exe
  2⤵
  PID:3296
- C:\Windows\System\gDEuQBQ.exe
  C:\Windows\System\gDEuQBQ.exe
  2⤵
  PID:3360
- C:\Windows\System\gYIOYJu.exe
  C:\Windows\System\gYIOYJu.exe
  2⤵
  PID:3472
- C:\Windows\System\RszEDsK.exe
  C:\Windows\System\RszEDsK.exe
  2⤵
  PID:3504
- C:\Windows\System\sLtjArD.exe
  C:\Windows\System\sLtjArD.exe
  2⤵
  PID:3520
- C:\Windows\System\ZNPmxgh.exe
  C:\Windows\System\ZNPmxgh.exe
  2⤵
  PID:3536
- C:\Windows\System\jGMpRwE.exe
  C:\Windows\System\jGMpRwE.exe
  2⤵
  PID:3060
- C:\Windows\System\BMkKfiy.exe
  C:\Windows\System\BMkKfiy.exe
  2⤵
  PID:3596
- C:\Windows\System\aZokEUj.exe
  C:\Windows\System\aZokEUj.exe
  2⤵
  PID:3668
- C:\Windows\System\TSfgeOw.exe
  C:\Windows\System\TSfgeOw.exe
  2⤵
  PID:3740
- C:\Windows\System\IYDRxXu.exe
  C:\Windows\System\IYDRxXu.exe
  2⤵
  PID:3648
- C:\Windows\System\WqXkKto.exe
  C:\Windows\System\WqXkKto.exe
  2⤵
  PID:3816
- C:\Windows\System\wtphYEX.exe
  C:\Windows\System\wtphYEX.exe
  2⤵
  PID:3848
- C:\Windows\System\XQLNHwE.exe
  C:\Windows\System\XQLNHwE.exe
  2⤵
  PID:3688
- C:\Windows\System\ozthtKs.exe
  C:\Windows\System\ozthtKs.exe
  2⤵
  PID:3756
- C:\Windows\System\aCmZVPS.exe
  C:\Windows\System\aCmZVPS.exe
  2⤵
  PID:3580
- C:\Windows\System\jreElTG.exe
  C:\Windows\System\jreElTG.exe
  2⤵
  PID:2520
- C:\Windows\System\ucPeqrl.exe
  C:\Windows\System\ucPeqrl.exe
  2⤵
  PID:3880
- C:\Windows\System\KBYqORx.exe
  C:\Windows\System\KBYqORx.exe
  2⤵
  PID:3892
- C:\Windows\System\OxmQrFg.exe
  C:\Windows\System\OxmQrFg.exe
  2⤵
  PID:3940
- C:\Windows\System\CbooJFq.exe
  C:\Windows\System\CbooJFq.exe
  2⤵
  PID:3972
- C:\Windows\System\FOQezGq.exe
  C:\Windows\System\FOQezGq.exe
  2⤵
  PID:4004
- C:\Windows\System\AjwCuAo.exe
  C:\Windows\System\AjwCuAo.exe
  2⤵
  PID:4036
- C:\Windows\System\ZEaXaGB.exe
  C:\Windows\System\ZEaXaGB.exe
  2⤵
  PID:1216
- C:\Windows\System\nuWfYPO.exe
  C:\Windows\System\nuWfYPO.exe
  2⤵
  PID:3228
- C:\Windows\System\QfXxfWA.exe
  C:\Windows\System\QfXxfWA.exe
  2⤵
  PID:3568
- C:\Windows\System\lTAfJgz.exe
  C:\Windows\System\lTAfJgz.exe
  2⤵
  PID:3808
- C:\Windows\System\OSYWssN.exe
  C:\Windows\System\OSYWssN.exe
  2⤵
  PID:3792
- C:\Windows\System\HrtxZwW.exe
  C:\Windows\System\HrtxZwW.exe
  2⤵
  PID:3912
- C:\Windows\System\XWAEwlV.exe
  C:\Windows\System\XWAEwlV.exe
  2⤵
  PID:4052
- C:\Windows\System\WInyIfA.exe
  C:\Windows\System\WInyIfA.exe
  2⤵
  PID:2776
- C:\Windows\System\gVgelYH.exe
  C:\Windows\System\gVgelYH.exe
  2⤵
  PID:3396
- C:\Windows\System\TLdXcWH.exe
  C:\Windows\System\TLdXcWH.exe
  2⤵
  PID:3440
- C:\Windows\System\vGQydWb.exe
  C:\Windows\System\vGQydWb.exe
  2⤵
  PID:3456
- C:\Windows\System\BdZihTE.exe
  C:\Windows\System\BdZihTE.exe
  2⤵
  PID:3164
- C:\Windows\System\AzMYTjo.exe
  C:\Windows\System\AzMYTjo.exe
  2⤵
  PID:3468
- C:\Windows\System\VkMKXkC.exe
  C:\Windows\System\VkMKXkC.exe
  2⤵
  PID:4020
- C:\Windows\System\dFnDklP.exe
  C:\Windows\System\dFnDklP.exe
  2⤵
  PID:3132
- C:\Windows\System\JuApHeF.exe
  C:\Windows\System\JuApHeF.exe
  2⤵
  PID:3628
- C:\Windows\System\yQcGtQY.exe
  C:\Windows\System\yQcGtQY.exe
  2⤵
  PID:3832
- C:\Windows\System\LZqBUXn.exe
  C:\Windows\System\LZqBUXn.exe
  2⤵
  PID:3752
- C:\Windows\System\WEbYiLG.exe
  C:\Windows\System\WEbYiLG.exe
  2⤵
  PID:2556
- C:\Windows\System\DgimHAT.exe
  C:\Windows\System\DgimHAT.exe
  2⤵
  PID:4068
- C:\Windows\System\SHfQBkv.exe
  C:\Windows\System\SHfQBkv.exe
  2⤵
  PID:3076
- C:\Windows\System\kZHpPiI.exe
  C:\Windows\System\kZHpPiI.exe
  2⤵
  PID:3144
- C:\Windows\System\yszUNlP.exe
  C:\Windows\System\yszUNlP.exe
  2⤵
  PID:3180
- C:\Windows\System\OxzWtHf.exe
  C:\Windows\System\OxzWtHf.exe
  2⤵
  PID:3276
- C:\Windows\System\AZkelvz.exe
  C:\Windows\System\AZkelvz.exe
  2⤵
  PID:2456
- C:\Windows\System\rwCjAnF.exe
  C:\Windows\System\rwCjAnF.exe
  2⤵
  PID:3380
- C:\Windows\System\bWhdtaW.exe
  C:\Windows\System\bWhdtaW.exe
  2⤵
  PID:3328
- C:\Windows\System\nXYxHcE.exe
  C:\Windows\System\nXYxHcE.exe
  2⤵
  PID:3384
- C:\Windows\System\AnXusqb.exe
  C:\Windows\System\AnXusqb.exe
  2⤵
  PID:2676
- C:\Windows\System\dwOTyxe.exe
  C:\Windows\System\dwOTyxe.exe
  2⤵
  PID:3736
- C:\Windows\System\rNejBOx.exe
  C:\Windows\System\rNejBOx.exe
  2⤵
  PID:3988
- C:\Windows\System\HjRwMph.exe
  C:\Windows\System\HjRwMph.exe
  2⤵
  PID:2084
- C:\Windows\System\iKeHAJV.exe
  C:\Windows\System\iKeHAJV.exe
  2⤵
  PID:3100
- C:\Windows\System\GJFpRRm.exe
  C:\Windows\System\GJFpRRm.exe
  2⤵
  PID:4084
- C:\Windows\System\MGxcQmz.exe
  C:\Windows\System\MGxcQmz.exe
  2⤵
  PID:3720
- C:\Windows\System\OuALRWI.exe
  C:\Windows\System\OuALRWI.exe
  2⤵
  PID:2000
- C:\Windows\System\SedlWhF.exe
  C:\Windows\System\SedlWhF.exe
  2⤵
  PID:3708
- C:\Windows\System\CXMgXEy.exe
  C:\Windows\System\CXMgXEy.exe
  2⤵
  PID:816
- C:\Windows\System\mFzzXQq.exe
  C:\Windows\System\mFzzXQq.exe
  2⤵
  PID:4072
- C:\Windows\System\BHEdZxf.exe
  C:\Windows\System\BHEdZxf.exe
  2⤵
  PID:3116
- C:\Windows\System\ERrdiVr.exe
  C:\Windows\System\ERrdiVr.exe
  2⤵
  PID:3424
- C:\Windows\System\pOCEoLS.exe
  C:\Windows\System\pOCEoLS.exe
  2⤵
  PID:3312
- C:\Windows\System\sCAqViP.exe
  C:\Windows\System\sCAqViP.exe
  2⤵
  PID:1312
- C:\Windows\System\OaVRmsN.exe
  C:\Windows\System\OaVRmsN.exe
  2⤵
  PID:2040
- C:\Windows\System\QpwVHHu.exe
  C:\Windows\System\QpwVHHu.exe
  2⤵
  PID:3408
- C:\Windows\System\VYYHwDK.exe
  C:\Windows\System\VYYHwDK.exe
  2⤵
  PID:2800
- C:\Windows\System\OjEjROZ.exe
  C:\Windows\System\OjEjROZ.exe
  2⤵
  PID:1636
- C:\Windows\System\magejfa.exe
  C:\Windows\System\magejfa.exe
  2⤵
  PID:3956
- C:\Windows\System\EmmGcqX.exe
  C:\Windows\System\EmmGcqX.exe
  2⤵
  PID:3544
- C:\Windows\System\OnqniHB.exe
  C:\Windows\System\OnqniHB.exe
  2⤵
  PID:3564
- C:\Windows\System\DJjGXax.exe
  C:\Windows\System\DJjGXax.exe
  2⤵
  PID:2244
- C:\Windows\System\jWuWrUg.exe
  C:\Windows\System\jWuWrUg.exe
  2⤵
  PID:2812
- C:\Windows\System\zXbfdIo.exe
  C:\Windows\System\zXbfdIo.exe
  2⤵
  PID:3348
- C:\Windows\System\crmKTwS.exe
  C:\Windows\System\crmKTwS.exe
  2⤵
  PID:4108
- C:\Windows\System\cNKWQEZ.exe
  C:\Windows\System\cNKWQEZ.exe
  2⤵
  PID:4124
- C:\Windows\System\XXMffYs.exe
  C:\Windows\System\XXMffYs.exe
  2⤵
  PID:4188
- C:\Windows\System\VnxwPyH.exe
  C:\Windows\System\VnxwPyH.exe
  2⤵
  PID:4204
- C:\Windows\System\RjDRdcx.exe
  C:\Windows\System\RjDRdcx.exe
  2⤵
  PID:4220
- C:\Windows\System\sfXRlWK.exe
  C:\Windows\System\sfXRlWK.exe
  2⤵
  PID:4236
- C:\Windows\System\VIZciUY.exe
  C:\Windows\System\VIZciUY.exe
  2⤵
  PID:4256
- C:\Windows\System\Tylstup.exe
  C:\Windows\System\Tylstup.exe
  2⤵
  PID:4272
- C:\Windows\System\EnLVSKO.exe
  C:\Windows\System\EnLVSKO.exe
  2⤵
  PID:4288
- C:\Windows\System\VwLisfK.exe
  C:\Windows\System\VwLisfK.exe
  2⤵
  PID:4332
- C:\Windows\System\VcVTvfA.exe
  C:\Windows\System\VcVTvfA.exe
  2⤵
  PID:4348
- C:\Windows\System\XQhxfEF.exe
  C:\Windows\System\XQhxfEF.exe
  2⤵
  PID:4364
- C:\Windows\System\MBsJPKB.exe
  C:\Windows\System\MBsJPKB.exe
  2⤵
  PID:4380
- C:\Windows\System\EKyHdfJ.exe
  C:\Windows\System\EKyHdfJ.exe
  2⤵
  PID:4404
- C:\Windows\System\yvfBmKc.exe
  C:\Windows\System\yvfBmKc.exe
  2⤵
  PID:4420
- C:\Windows\System\iJKVVvY.exe
  C:\Windows\System\iJKVVvY.exe
  2⤵
  PID:4444
- C:\Windows\System\SLsicUk.exe
  C:\Windows\System\SLsicUk.exe
  2⤵
  PID:4460
- C:\Windows\System\nuwqUXA.exe
  C:\Windows\System\nuwqUXA.exe
  2⤵
  PID:4476
- C:\Windows\System\ddpRmNf.exe
  C:\Windows\System\ddpRmNf.exe
  2⤵
  PID:4504
- C:\Windows\System\gCurXeA.exe
  C:\Windows\System\gCurXeA.exe
  2⤵
  PID:4524
- C:\Windows\System\tsWDIWy.exe
  C:\Windows\System\tsWDIWy.exe
  2⤵
  PID:4544
- C:\Windows\System\AbDRIdK.exe
  C:\Windows\System\AbDRIdK.exe
  2⤵
  PID:4568
- C:\Windows\System\bXYmHTi.exe
  C:\Windows\System\bXYmHTi.exe
  2⤵
  PID:4588
- C:\Windows\System\BixcFNM.exe
  C:\Windows\System\BixcFNM.exe
  2⤵
  PID:4608
- C:\Windows\System\JEEyfoX.exe
  C:\Windows\System\JEEyfoX.exe
  2⤵
  PID:4628
- C:\Windows\System\kaYzQqo.exe
  C:\Windows\System\kaYzQqo.exe
  2⤵
  PID:4644
- C:\Windows\System\jhtWZuN.exe
  C:\Windows\System\jhtWZuN.exe
  2⤵
  PID:4676
- C:\Windows\System\RqInWVs.exe
  C:\Windows\System\RqInWVs.exe
  2⤵
  PID:4692
- C:\Windows\System\anWNiTM.exe
  C:\Windows\System\anWNiTM.exe
  2⤵
  PID:4708
- C:\Windows\System\VbHZfYR.exe
  C:\Windows\System\VbHZfYR.exe
  2⤵
  PID:4724
- C:\Windows\System\LANyZVr.exe
  C:\Windows\System\LANyZVr.exe
  2⤵
  PID:4740
- C:\Windows\System\qEUMnPt.exe
  C:\Windows\System\qEUMnPt.exe
  2⤵
  PID:4760
- C:\Windows\System\oMMkwsE.exe
  C:\Windows\System\oMMkwsE.exe
  2⤵
  PID:4776
- C:\Windows\System\ymfFTXi.exe
  C:\Windows\System\ymfFTXi.exe
  2⤵
  PID:4792
- C:\Windows\System\GGiPNQT.exe
  C:\Windows\System\GGiPNQT.exe
  2⤵
  PID:4808
- C:\Windows\System\mYoYZeS.exe
  C:\Windows\System\mYoYZeS.exe
  2⤵
  PID:4824
- C:\Windows\System\bjASvEC.exe
  C:\Windows\System\bjASvEC.exe
  2⤵
  PID:4844
- C:\Windows\System\tOlpVnC.exe
  C:\Windows\System\tOlpVnC.exe
  2⤵
  PID:4860
- C:\Windows\System\ajfALsO.exe
  C:\Windows\System\ajfALsO.exe
  2⤵
  PID:4876
- C:\Windows\System\lFlIIqV.exe
  C:\Windows\System\lFlIIqV.exe
  2⤵
  PID:4896
- C:\Windows\System\pjybrXc.exe
  C:\Windows\System\pjybrXc.exe
  2⤵
  PID:4912
- C:\Windows\System\SyumdSK.exe
  C:\Windows\System\SyumdSK.exe
  2⤵
  PID:4928
- C:\Windows\System\riEZVcL.exe
  C:\Windows\System\riEZVcL.exe
  2⤵
  PID:4944
- C:\Windows\System\oHcteds.exe
  C:\Windows\System\oHcteds.exe
  2⤵
  PID:4964
- C:\Windows\System\uEGQNCY.exe
  C:\Windows\System\uEGQNCY.exe
  2⤵
  PID:4980
- C:\Windows\System\DPFvuIH.exe
  C:\Windows\System\DPFvuIH.exe
  2⤵
  PID:5020
- C:\Windows\System\QAkAtXW.exe
  C:\Windows\System\QAkAtXW.exe
  2⤵
  PID:5056
- C:\Windows\System\RVMMwMm.exe
  C:\Windows\System\RVMMwMm.exe
  2⤵
  PID:5072
- C:\Windows\System\twXLojx.exe
  C:\Windows\System\twXLojx.exe
  2⤵
  PID:5092
- C:\Windows\System\eKqGgIo.exe
  C:\Windows\System\eKqGgIo.exe
  2⤵
  PID:5108
- C:\Windows\System\sKlmFWa.exe
  C:\Windows\System\sKlmFWa.exe
  2⤵
  PID:1456
- C:\Windows\System\ZddtiKC.exe
  C:\Windows\System\ZddtiKC.exe
  2⤵
  PID:3876
- C:\Windows\System\QJLLPWG.exe
  C:\Windows\System\QJLLPWG.exe
  2⤵
  PID:4140
- C:\Windows\System\KlbeaUP.exe
  C:\Windows\System\KlbeaUP.exe
  2⤵
  PID:4152
- C:\Windows\System\MpSWdJe.exe
  C:\Windows\System\MpSWdJe.exe
  2⤵
  PID:4172
- C:\Windows\System\BatnnkX.exe
  C:\Windows\System\BatnnkX.exe
  2⤵
  PID:4200
- C:\Windows\System\vZZCUwW.exe
  C:\Windows\System\vZZCUwW.exe
  2⤵
  PID:4248
- C:\Windows\System\OehHPrw.exe
  C:\Windows\System\OehHPrw.exe
  2⤵
  PID:4212
- C:\Windows\System\yMKEVHZ.exe
  C:\Windows\System\yMKEVHZ.exe
  2⤵
  PID:4300
- C:\Windows\System\XEnQnCX.exe
  C:\Windows\System\XEnQnCX.exe
  2⤵
  PID:4308
- C:\Windows\System\tpYUxdh.exe
  C:\Windows\System\tpYUxdh.exe
  2⤵
  PID:4396
- C:\Windows\System\FERPUQT.exe
  C:\Windows\System\FERPUQT.exe
  2⤵
  PID:4432
- C:\Windows\System\dodanZm.exe
  C:\Windows\System\dodanZm.exe
  2⤵
  PID:4416
- C:\Windows\System\nEmXEdI.exe
  C:\Windows\System\nEmXEdI.exe
  2⤵
  PID:4468
- C:\Windows\System\dYJMSdi.exe
  C:\Windows\System\dYJMSdi.exe
  2⤵
  PID:4484
- C:\Windows\System\MbdMDos.exe
  C:\Windows\System\MbdMDos.exe
  2⤵
  PID:4520
- C:\Windows\System\bqiuFAU.exe
  C:\Windows\System\bqiuFAU.exe
  2⤵
  PID:4624
- C:\Windows\System\ZxNtyTr.exe
  C:\Windows\System\ZxNtyTr.exe
  2⤵
  PID:4656
- C:\Windows\System\aRNAuIs.exe
  C:\Windows\System\aRNAuIs.exe
  2⤵
  PID:4672
- C:\Windows\System\vxqzPqD.exe
  C:\Windows\System\vxqzPqD.exe
  2⤵
  PID:4752
- C:\Windows\System\YkSNjFC.exe
  C:\Windows\System\YkSNjFC.exe
  2⤵
  PID:4756
- C:\Windows\System\OOioCFm.exe
  C:\Windows\System\OOioCFm.exe
  2⤵
  PID:4784
- C:\Windows\System\XOolTox.exe
  C:\Windows\System\XOolTox.exe
  2⤵
  PID:4892
- C:\Windows\System\BjMgOLx.exe
  C:\Windows\System\BjMgOLx.exe
  2⤵
  PID:4996
- C:\Windows\System\wjpTLeR.exe
  C:\Windows\System\wjpTLeR.exe
  2⤵
  PID:5012
- C:\Windows\System\ZCtltlP.exe
  C:\Windows\System\ZCtltlP.exe
  2⤵
  PID:4736
- C:\Windows\System\gNragca.exe
  C:\Windows\System\gNragca.exe
  2⤵
  PID:4840
- C:\Windows\System\abnibuH.exe
  C:\Windows\System\abnibuH.exe
  2⤵
  PID:4988
- C:\Windows\System\tYPVcDj.exe
  C:\Windows\System\tYPVcDj.exe
  2⤵
  PID:5016
- C:\Windows\System\kOWXDGj.exe
  C:\Windows\System\kOWXDGj.exe
  2⤵
  PID:5032
- C:\Windows\System\vuLPeRX.exe
  C:\Windows\System\vuLPeRX.exe
  2⤵
  PID:5064
- C:\Windows\System\yEKSCNt.exe
  C:\Windows\System\yEKSCNt.exe
  2⤵
  PID:2844
- C:\Windows\System\lGeoQNu.exe
  C:\Windows\System\lGeoQNu.exe
  2⤵
  PID:5116
- C:\Windows\System\zZpHLuY.exe
  C:\Windows\System\zZpHLuY.exe
  2⤵
  PID:4104
- C:\Windows\System\CCfYuFA.exe
  C:\Windows\System\CCfYuFA.exe
  2⤵
  PID:1508
- C:\Windows\System\qTInqyL.exe
  C:\Windows\System\qTInqyL.exe
  2⤵
  PID:1852
- C:\Windows\System\lTnwUbe.exe
  C:\Windows\System\lTnwUbe.exe
  2⤵
  PID:4116
- C:\Windows\System\zclIeYh.exe
  C:\Windows\System\zclIeYh.exe
  2⤵
  PID:4148
- C:\Windows\System\nYXZnaV.exe
  C:\Windows\System\nYXZnaV.exe
  2⤵
  PID:4216
- C:\Windows\System\uXCqdXU.exe
  C:\Windows\System\uXCqdXU.exe
  2⤵
  PID:4232
- C:\Windows\System\nbccCeG.exe
  C:\Windows\System\nbccCeG.exe
  2⤵
  PID:4324
- C:\Windows\System\kdUOuOr.exe
  C:\Windows\System\kdUOuOr.exe
  2⤵
  PID:4328
- C:\Windows\System\FGPzrnE.exe
  C:\Windows\System\FGPzrnE.exe
  2⤵
  PID:4372
- C:\Windows\System\NJiPHyJ.exe
  C:\Windows\System\NJiPHyJ.exe
  2⤵
  PID:4428
- C:\Windows\System\DZwNjBh.exe
  C:\Windows\System\DZwNjBh.exe
  2⤵
  PID:4552
- C:\Windows\System\lJAYCkc.exe
  C:\Windows\System\lJAYCkc.exe
  2⤵
  PID:4516
- C:\Windows\System\GnDsMvc.exe
  C:\Windows\System\GnDsMvc.exe
  2⤵
  PID:4576
- C:\Windows\System\vxBlLQN.exe
  C:\Windows\System\vxBlLQN.exe
  2⤵
  PID:4584
- C:\Windows\System\HjnkYWj.exe
  C:\Windows\System\HjnkYWj.exe
  2⤵
  PID:4620
- C:\Windows\System\HtYLfXP.exe
  C:\Windows\System\HtYLfXP.exe
  2⤵
  PID:4716
- C:\Windows\System\NXKhvES.exe
  C:\Windows\System\NXKhvES.exe
  2⤵
  PID:4888
- C:\Windows\System\xSrKOug.exe
  C:\Windows\System\xSrKOug.exe
  2⤵
  PID:4952
- C:\Windows\System\YAaihzw.exe
  C:\Windows\System\YAaihzw.exe
  2⤵
  PID:4852
- C:\Windows\System\xnZWfjm.exe
  C:\Windows\System\xnZWfjm.exe
  2⤵
  PID:4804
- C:\Windows\System\HCpEbim.exe
  C:\Windows\System\HCpEbim.exe
  2⤵
  PID:4908
- C:\Windows\System\MvnnDBW.exe
  C:\Windows\System\MvnnDBW.exe
  2⤵
  PID:4972
- C:\Windows\System\hWZiBkK.exe
  C:\Windows\System\hWZiBkK.exe
  2⤵
  PID:4164
- C:\Windows\System\OCmGBXK.exe
  C:\Windows\System\OCmGBXK.exe
  2⤵
  PID:3372
- C:\Windows\System\iRrGLtg.exe
  C:\Windows\System\iRrGLtg.exe
  2⤵
  PID:4120
- C:\Windows\System\UgsBHrr.exe
  C:\Windows\System\UgsBHrr.exe
  2⤵
  PID:4244
- C:\Windows\System\ubtPuAi.exe
  C:\Windows\System\ubtPuAi.exe
  2⤵
  PID:5008
- C:\Windows\System\iyyHhkn.exe
  C:\Windows\System\iyyHhkn.exe
  2⤵
  PID:4280
- C:\Windows\System\roBqEaw.exe
  C:\Windows\System\roBqEaw.exe
  2⤵
  PID:4600
- C:\Windows\System\lImKnnh.exe
  C:\Windows\System\lImKnnh.exe
  2⤵
  PID:4820
- C:\Windows\System\xgBrMga.exe
  C:\Windows\System\xgBrMga.exe
  2⤵
  PID:3464
- C:\Windows\System\OSksZqy.exe
  C:\Windows\System\OSksZqy.exe
  2⤵
  PID:4664
- C:\Windows\System\SeYsgld.exe
  C:\Windows\System\SeYsgld.exe
  2⤵
  PID:4560
- C:\Windows\System\ZiwnOHk.exe
  C:\Windows\System\ZiwnOHk.exe
  2⤵
  PID:4668
- C:\Windows\System\SZwJDWK.exe
  C:\Windows\System\SZwJDWK.exe
  2⤵
  PID:4872
- C:\Windows\System\IxAlqBz.exe
  C:\Windows\System\IxAlqBz.exe
  2⤵
  PID:4316
- C:\Windows\System\QUKCMiG.exe
  C:\Windows\System\QUKCMiG.exe
  2⤵
  PID:4168
- C:\Windows\System\idjlrTZ.exe
  C:\Windows\System\idjlrTZ.exe
  2⤵
  PID:4904
- C:\Windows\System\EenKqsk.exe
  C:\Windows\System\EenKqsk.exe
  2⤵
  PID:4196
- C:\Windows\System\uUOVvMF.exe
  C:\Windows\System\uUOVvMF.exe
  2⤵
  PID:4492
- C:\Windows\System\IdvrumQ.exe
  C:\Windows\System\IdvrumQ.exe
  2⤵
  PID:4320
- C:\Windows\System\gtJVwyt.exe
  C:\Windows\System\gtJVwyt.exe
  2⤵
  PID:4412
- C:\Windows\System\SMMbtMy.exe
  C:\Windows\System\SMMbtMy.exe
  2⤵
  PID:4956
- C:\Windows\System\cNLHyKa.exe
  C:\Windows\System\cNLHyKa.exe
  2⤵
  PID:4496
- C:\Windows\System\gAUxEXq.exe
  C:\Windows\System\gAUxEXq.exe
  2⤵
  PID:936
- C:\Windows\System\FCoYPaB.exe
  C:\Windows\System\FCoYPaB.exe
  2⤵
  PID:5044
- C:\Windows\System\twylKoF.exe
  C:\Windows\System\twylKoF.exe
  2⤵
  PID:2652
- C:\Windows\System\XwpQDwl.exe
  C:\Windows\System\XwpQDwl.exe
  2⤵
  PID:3148
- C:\Windows\System\mnrJFLc.exe
  C:\Windows\System\mnrJFLc.exe
  2⤵
  PID:4992
- C:\Windows\System\keEBljx.exe
  C:\Windows\System\keEBljx.exe
  2⤵
  PID:5136
- C:\Windows\System\GWcLNmv.exe
  C:\Windows\System\GWcLNmv.exe
  2⤵
  PID:5156
- C:\Windows\System\StScoRx.exe
  C:\Windows\System\StScoRx.exe
  2⤵
  PID:5172
- C:\Windows\System\YgYiEIm.exe
  C:\Windows\System\YgYiEIm.exe
  2⤵
  PID:5188
- C:\Windows\System\ZvtsOJy.exe
  C:\Windows\System\ZvtsOJy.exe
  2⤵
  PID:5204
- C:\Windows\System\tqMEbOa.exe
  C:\Windows\System\tqMEbOa.exe
  2⤵
  PID:5220
- C:\Windows\System\TVKKVxc.exe
  C:\Windows\System\TVKKVxc.exe
  2⤵
  PID:5240
- C:\Windows\System\EeqESpa.exe
  C:\Windows\System\EeqESpa.exe
  2⤵
  PID:5256
- C:\Windows\System\GzLVENG.exe
  C:\Windows\System\GzLVENG.exe
  2⤵
  PID:5272
- C:\Windows\System\BmsXAHA.exe
  C:\Windows\System\BmsXAHA.exe
  2⤵
  PID:5288
- C:\Windows\System\DLVecDK.exe
  C:\Windows\System\DLVecDK.exe
  2⤵
  PID:5308
- C:\Windows\System\RIgZIbH.exe
  C:\Windows\System\RIgZIbH.exe
  2⤵
  PID:5324
- C:\Windows\System\ZqLUWNm.exe
  C:\Windows\System\ZqLUWNm.exe
  2⤵
  PID:5340
- C:\Windows\System\mOVjVWS.exe
  C:\Windows\System\mOVjVWS.exe
  2⤵
  PID:5356
- C:\Windows\System\iEIYsmS.exe
  C:\Windows\System\iEIYsmS.exe
  2⤵
  PID:5372
- C:\Windows\System\WtYgZrV.exe
  C:\Windows\System\WtYgZrV.exe
  2⤵
  PID:5388
- C:\Windows\System\zGpJwXH.exe
  C:\Windows\System\zGpJwXH.exe
  2⤵
  PID:5404
- C:\Windows\System\esHYahi.exe
  C:\Windows\System\esHYahi.exe
  2⤵
  PID:5420
- C:\Windows\System\uFfIbwG.exe
  C:\Windows\System\uFfIbwG.exe
  2⤵
  PID:5440
- C:\Windows\System\GblBOcs.exe
  C:\Windows\System\GblBOcs.exe
  2⤵
  PID:5456
- C:\Windows\System\jBEHzun.exe
  C:\Windows\System\jBEHzun.exe
  2⤵
  PID:5472
- C:\Windows\System\wlKyfsH.exe
  C:\Windows\System\wlKyfsH.exe
  2⤵
  PID:5488
- C:\Windows\System\WVBwHKB.exe
  C:\Windows\System\WVBwHKB.exe
  2⤵
  PID:5504
- C:\Windows\System\AylfQJy.exe
  C:\Windows\System\AylfQJy.exe
  2⤵
  PID:5524
- C:\Windows\System\AiUlvZi.exe
  C:\Windows\System\AiUlvZi.exe
  2⤵
  PID:5540
- C:\Windows\System\ScYNMEz.exe
  C:\Windows\System\ScYNMEz.exe
  2⤵
  PID:5556
- C:\Windows\System\ZkHUfCc.exe
  C:\Windows\System\ZkHUfCc.exe
  2⤵
  PID:5572
- C:\Windows\System\accPAMp.exe
  C:\Windows\System\accPAMp.exe
  2⤵
  PID:5588
- C:\Windows\System\egTOwQa.exe
  C:\Windows\System\egTOwQa.exe
  2⤵
  PID:5604
- C:\Windows\System\qmrVDNN.exe
  C:\Windows\System\qmrVDNN.exe
  2⤵
  PID:5620
- C:\Windows\System\TCkZzUq.exe
  C:\Windows\System\TCkZzUq.exe
  2⤵
  PID:5636
- C:\Windows\System\shdhlyE.exe
  C:\Windows\System\shdhlyE.exe
  2⤵
  PID:5652
- C:\Windows\System\HhACFiq.exe
  C:\Windows\System\HhACFiq.exe
  2⤵
  PID:5668
- C:\Windows\System\GOLxkKb.exe
  C:\Windows\System\GOLxkKb.exe
  2⤵
  PID:5684
- C:\Windows\System\tkgYyNh.exe
  C:\Windows\System\tkgYyNh.exe
  2⤵
  PID:5700
- C:\Windows\System\HwmcweU.exe
  C:\Windows\System\HwmcweU.exe
  2⤵
  PID:5716
- C:\Windows\System\FqgPGfF.exe
  C:\Windows\System\FqgPGfF.exe
  2⤵
  PID:5732
- C:\Windows\System\cIhDltS.exe
  C:\Windows\System\cIhDltS.exe
  2⤵
  PID:5748
- C:\Windows\System\LZtRppW.exe
  C:\Windows\System\LZtRppW.exe
  2⤵
  PID:5772
- C:\Windows\System\CHIKyHf.exe
  C:\Windows\System\CHIKyHf.exe
  2⤵
  PID:5788
- C:\Windows\System\PsSIQvY.exe
  C:\Windows\System\PsSIQvY.exe
  2⤵
  PID:5804
- C:\Windows\System\ngmIFUR.exe
  C:\Windows\System\ngmIFUR.exe
  2⤵
  PID:5820
- C:\Windows\System\guemaKs.exe
  C:\Windows\System\guemaKs.exe
  2⤵
  PID:5836
- C:\Windows\System\OIJWIrI.exe
  C:\Windows\System\OIJWIrI.exe
  2⤵
  PID:5852
- C:\Windows\System\IDadMEs.exe
  C:\Windows\System\IDadMEs.exe
  2⤵
  PID:5868
- C:\Windows\System\wCgorIO.exe
  C:\Windows\System\wCgorIO.exe
  2⤵
  PID:5888
- C:\Windows\System\ugIsVuK.exe
  C:\Windows\System\ugIsVuK.exe
  2⤵
  PID:5904
- C:\Windows\System\lzeOGCP.exe
  C:\Windows\System\lzeOGCP.exe
  2⤵
  PID:5920
- C:\Windows\System\qDrPybR.exe
  C:\Windows\System\qDrPybR.exe
  2⤵
  PID:5936
- C:\Windows\System\DjumFuB.exe
  C:\Windows\System\DjumFuB.exe
  2⤵
  PID:5952
- C:\Windows\System\cEiAxcB.exe
  C:\Windows\System\cEiAxcB.exe
  2⤵
  PID:5968
- C:\Windows\System\qGVebNv.exe
  C:\Windows\System\qGVebNv.exe
  2⤵
  PID:5984
- C:\Windows\System\aKNJpWi.exe
  C:\Windows\System\aKNJpWi.exe
  2⤵
  PID:6000
- C:\Windows\System\APqMzOo.exe
  C:\Windows\System\APqMzOo.exe
  2⤵
  PID:6016
- C:\Windows\System\UNdXhVW.exe
  C:\Windows\System\UNdXhVW.exe
  2⤵
  PID:6036
- C:\Windows\System\mmfQZGi.exe
  C:\Windows\System\mmfQZGi.exe
  2⤵
  PID:6052
- C:\Windows\System\BygvYdo.exe
  C:\Windows\System\BygvYdo.exe
  2⤵
  PID:6068
- C:\Windows\System\fBBTQnI.exe
  C:\Windows\System\fBBTQnI.exe
  2⤵
  PID:6084
- C:\Windows\System\foPzPkY.exe
  C:\Windows\System\foPzPkY.exe
  2⤵
  PID:6100
- C:\Windows\System\gXxPOSs.exe
  C:\Windows\System\gXxPOSs.exe
  2⤵
  PID:6116
- C:\Windows\System\cvtHFgG.exe
  C:\Windows\System\cvtHFgG.exe
  2⤵
  PID:6132
- C:\Windows\System\txtdXKe.exe
  C:\Windows\System\txtdXKe.exe
  2⤵
  PID:2420
- C:\Windows\System\mwWNRxq.exe
  C:\Windows\System\mwWNRxq.exe
  2⤵
  PID:5132
- C:\Windows\System\KTawSeA.exe
  C:\Windows\System\KTawSeA.exe
  2⤵
  PID:5196
- C:\Windows\System\KTUIDCn.exe
  C:\Windows\System\KTUIDCn.exe
  2⤵
  PID:5264
- C:\Windows\System\IduwGym.exe
  C:\Windows\System\IduwGym.exe
  2⤵
  PID:5304
- C:\Windows\System\rDAQAZD.exe
  C:\Windows\System\rDAQAZD.exe
  2⤵
  PID:5368
- C:\Windows\System\ORnLQgL.exe
  C:\Windows\System\ORnLQgL.exe
  2⤵
  PID:5352
- C:\Windows\System\wECXoTO.exe
  C:\Windows\System\wECXoTO.exe
  2⤵
  PID:5284
- C:\Windows\System\HotdLII.exe
  C:\Windows\System\HotdLII.exe
  2⤵
  PID:5216
- C:\Windows\System\gxPCCMo.exe
  C:\Windows\System\gxPCCMo.exe
  2⤵
  PID:5004
- C:\Windows\System\PAupjZQ.exe
  C:\Windows\System\PAupjZQ.exe
  2⤵
  PID:5396
- C:\Windows\System\jPOUNKF.exe
  C:\Windows\System\jPOUNKF.exe
  2⤵
  PID:5464
- C:\Windows\System\EZdTOXk.exe
  C:\Windows\System\EZdTOXk.exe
  2⤵
  PID:5532
- C:\Windows\System\BjedIRO.exe
  C:\Windows\System\BjedIRO.exe
  2⤵
  PID:5628
- C:\Windows\System\tIjaOWX.exe
  C:\Windows\System\tIjaOWX.exe
  2⤵
  PID:5484
- C:\Windows\System\AeqkHVh.exe
  C:\Windows\System\AeqkHVh.exe
  2⤵
  PID:5552
- C:\Windows\System\theTqfn.exe
  C:\Windows\System\theTqfn.exe
  2⤵
  PID:5580
- C:\Windows\System\IRAIPJa.exe
  C:\Windows\System\IRAIPJa.exe
  2⤵
  PID:5516
- C:\Windows\System\KVeKqwY.exe
  C:\Windows\System\KVeKqwY.exe
  2⤵
  PID:5648
- C:\Windows\System\QMsgGmF.exe
  C:\Windows\System\QMsgGmF.exe
  2⤵
  PID:5724
- C:\Windows\System\vawmpTr.exe
  C:\Windows\System\vawmpTr.exe
  2⤵
  PID:5796
- C:\Windows\System\XFsMoVE.exe
  C:\Windows\System\XFsMoVE.exe
  2⤵
  PID:5860
- C:\Windows\System\XxRhVEf.exe
  C:\Windows\System\XxRhVEf.exe
  2⤵
  PID:5708
- C:\Windows\System\FdHWMdR.exe
  C:\Windows\System\FdHWMdR.exe
  2⤵
  PID:5900
- C:\Windows\System\iBPQQTp.exe
  C:\Windows\System\iBPQQTp.exe
  2⤵
  PID:5844
- C:\Windows\System\AfufalZ.exe
  C:\Windows\System\AfufalZ.exe
  2⤵
  PID:5880
- C:\Windows\System\WgrZMrg.exe
  C:\Windows\System\WgrZMrg.exe
  2⤵
  PID:6028
- C:\Windows\System\bWpTfZL.exe
  C:\Windows\System\bWpTfZL.exe
  2⤵
  PID:5816
- C:\Windows\System\BbBImea.exe
  C:\Windows\System\BbBImea.exe
  2⤵
  PID:6096
- C:\Windows\System\WvIMtNU.exe
  C:\Windows\System\WvIMtNU.exe
  2⤵
  PID:5916
- C:\Windows\System\TxlLsqy.exe
  C:\Windows\System\TxlLsqy.exe
  2⤵
  PID:4732
- C:\Windows\System\iVJSjDV.exe
  C:\Windows\System\iVJSjDV.exe
  2⤵
  PID:6012
- C:\Windows\System\XJRHWVm.exe
  C:\Windows\System\XJRHWVm.exe
  2⤵
  PID:6140
- C:\Windows\System\LNFNAnV.exe
  C:\Windows\System\LNFNAnV.exe
  2⤵
  PID:5336
- C:\Windows\System\ifMrpwc.exe
  C:\Windows\System\ifMrpwc.exe
  2⤵
  PID:5316
- C:\Windows\System\CPcHJzY.exe
  C:\Windows\System\CPcHJzY.exe
  2⤵
  PID:5152
- C:\Windows\System\sFbHtDu.exe
  C:\Windows\System\sFbHtDu.exe
  2⤵
  PID:5380
- C:\Windows\System\wUujtVw.exe
  C:\Windows\System\wUujtVw.exe
  2⤵
  PID:5320
- C:\Windows\System\UxClrzs.exe
  C:\Windows\System\UxClrzs.exe
  2⤵
  PID:5400
- C:\Windows\System\KmKxiZW.exe
  C:\Windows\System\KmKxiZW.exe
  2⤵
  PID:5568
- C:\Windows\System\RRMoQLu.exe
  C:\Windows\System\RRMoQLu.exe
  2⤵
  PID:5448
- C:\Windows\System\gyoOPeF.exe
  C:\Windows\System\gyoOPeF.exe
  2⤵
  PID:5452
- C:\Windows\System\JpnbvFN.exe
  C:\Windows\System\JpnbvFN.exe
  2⤵
  PID:5660
- C:\Windows\System\LPKvBVB.exe
  C:\Windows\System\LPKvBVB.exe
  2⤵
  PID:5768
- C:\Windows\System\sJLIqHX.exe
  C:\Windows\System\sJLIqHX.exe
  2⤵
  PID:5992
- C:\Windows\System\kOtBqAj.exe
  C:\Windows\System\kOtBqAj.exe
  2⤵
  PID:5876
- C:\Windows\System\PqwKvFR.exe
  C:\Windows\System\PqwKvFR.exe
  2⤵
  PID:5912
- C:\Windows\System\uvrDeKH.exe
  C:\Windows\System\uvrDeKH.exe
  2⤵
  PID:5228
- C:\Windows\System\gexeSgA.exe
  C:\Windows\System\gexeSgA.exe
  2⤵
  PID:5252
- C:\Windows\System\XjcPzUU.exe
  C:\Windows\System\XjcPzUU.exe
  2⤵
  PID:5432
- C:\Windows\System\betzGjz.exe
  C:\Windows\System\betzGjz.exe
  2⤵
  PID:6024
- C:\Windows\System\piCoBQD.exe
  C:\Windows\System\piCoBQD.exe
  2⤵
  PID:5944
- C:\Windows\System\rZNNeZy.exe
  C:\Windows\System\rZNNeZy.exe
  2⤵
  PID:6048
- C:\Windows\System\uhWqwjb.exe
  C:\Windows\System\uhWqwjb.exe
  2⤵
  PID:5236
- C:\Windows\System\ZgCKiCA.exe
  C:\Windows\System\ZgCKiCA.exe
  2⤵
  PID:5696
- C:\Windows\System\tFBrowM.exe
  C:\Windows\System\tFBrowM.exe
  2⤵
  PID:5676
- C:\Windows\System\SPpejdY.exe
  C:\Windows\System\SPpejdY.exe
  2⤵
  PID:5740
- C:\Windows\System\WjwAhyy.exe
  C:\Windows\System\WjwAhyy.exe
  2⤵
  PID:5168
- C:\Windows\System\QkTbJlH.exe
  C:\Windows\System\QkTbJlH.exe
  2⤵
  PID:2392
- C:\Windows\System\LmStYOU.exe
  C:\Windows\System\LmStYOU.exe
  2⤵
  PID:6152
- C:\Windows\System\gaxtJNV.exe
  C:\Windows\System\gaxtJNV.exe
  2⤵
  PID:6172
- C:\Windows\System\HqabJIG.exe
  C:\Windows\System\HqabJIG.exe
  2⤵
  PID:6188
- C:\Windows\System\CxwEnaR.exe
  C:\Windows\System\CxwEnaR.exe
  2⤵
  PID:6204
- C:\Windows\System\EUubQJs.exe
  C:\Windows\System\EUubQJs.exe
  2⤵
  PID:6220
- C:\Windows\System\HtrIoFF.exe
  C:\Windows\System\HtrIoFF.exe
  2⤵
  PID:6236
- C:\Windows\System\wlHoyce.exe
  C:\Windows\System\wlHoyce.exe
  2⤵
  PID:6252
- C:\Windows\System\iEiyUXi.exe
  C:\Windows\System\iEiyUXi.exe
  2⤵
  PID:6272
- C:\Windows\System\iOTbcFW.exe
  C:\Windows\System\iOTbcFW.exe
  2⤵
  PID:6292
- C:\Windows\System\iUyLftU.exe
  C:\Windows\System\iUyLftU.exe
  2⤵
  PID:6308
- C:\Windows\System\zRpgRbf.exe
  C:\Windows\System\zRpgRbf.exe
  2⤵
  PID:6324
- C:\Windows\System\mmQoDyw.exe
  C:\Windows\System\mmQoDyw.exe
  2⤵
  PID:6340
- C:\Windows\System\LPNYssw.exe
  C:\Windows\System\LPNYssw.exe
  2⤵
  PID:6356
- C:\Windows\System\rcZamSz.exe
  C:\Windows\System\rcZamSz.exe
  2⤵
  PID:6376
- C:\Windows\System\cOBRdGe.exe
  C:\Windows\System\cOBRdGe.exe
  2⤵
  PID:6392
- C:\Windows\System\OnSMYId.exe
  C:\Windows\System\OnSMYId.exe
  2⤵
  PID:6408
- C:\Windows\System\SiobNUF.exe
  C:\Windows\System\SiobNUF.exe
  2⤵
  PID:6424
- C:\Windows\System\TFsOptf.exe
  C:\Windows\System\TFsOptf.exe
  2⤵
  PID:6440
- C:\Windows\System\DGKAUMD.exe
  C:\Windows\System\DGKAUMD.exe
  2⤵
  PID:6460
- C:\Windows\System\OBygPfU.exe
  C:\Windows\System\OBygPfU.exe
  2⤵
  PID:6476
- C:\Windows\System\yvJiqbm.exe
  C:\Windows\System\yvJiqbm.exe
  2⤵
  PID:6496
- C:\Windows\System\ebLabLY.exe
  C:\Windows\System\ebLabLY.exe
  2⤵
  PID:6512
- C:\Windows\System\WaAFLXa.exe
  C:\Windows\System\WaAFLXa.exe
  2⤵
  PID:6528
- C:\Windows\System\uyZmZcJ.exe
  C:\Windows\System\uyZmZcJ.exe
  2⤵
  PID:6548
- C:\Windows\System\EBNTbSH.exe
  C:\Windows\System\EBNTbSH.exe
  2⤵
  PID:6564
- C:\Windows\System\ItxrLLM.exe
  C:\Windows\System\ItxrLLM.exe
  2⤵
  PID:6580
- C:\Windows\System\KowBlXT.exe
  C:\Windows\System\KowBlXT.exe
  2⤵
  PID:6596
- C:\Windows\System\VDcZcNX.exe
  C:\Windows\System\VDcZcNX.exe
  2⤵
  PID:6612
- C:\Windows\System\WymXuXp.exe
  C:\Windows\System\WymXuXp.exe
  2⤵
  PID:6628
- C:\Windows\System\GBfGUzA.exe
  C:\Windows\System\GBfGUzA.exe
  2⤵
  PID:6648
- C:\Windows\System\StQJuMs.exe
  C:\Windows\System\StQJuMs.exe
  2⤵
  PID:6668
- C:\Windows\System\UKhqBML.exe
  C:\Windows\System\UKhqBML.exe
  2⤵
  PID:6684
- C:\Windows\System\hygpfOZ.exe
  C:\Windows\System\hygpfOZ.exe
  2⤵
  PID:6700
- C:\Windows\System\IfGRyft.exe
  C:\Windows\System\IfGRyft.exe
  2⤵
  PID:6716
- C:\Windows\System\mJoAWdd.exe
  C:\Windows\System\mJoAWdd.exe
  2⤵
  PID:6732
- C:\Windows\System\aFAfbwA.exe
  C:\Windows\System\aFAfbwA.exe
  2⤵
  PID:6748
- C:\Windows\System\lHdkbGD.exe
  C:\Windows\System\lHdkbGD.exe
  2⤵
  PID:6764
- C:\Windows\System\VjeQtjp.exe
  C:\Windows\System\VjeQtjp.exe
  2⤵
  PID:6784
- C:\Windows\System\jpfwPKC.exe
  C:\Windows\System\jpfwPKC.exe
  2⤵
  PID:6800
- C:\Windows\System\IzsIaFk.exe
  C:\Windows\System\IzsIaFk.exe
  2⤵
  PID:6816
- C:\Windows\System\jkCYgJM.exe
  C:\Windows\System\jkCYgJM.exe
  2⤵
  PID:6832
- C:\Windows\System\BSNHEbH.exe
  C:\Windows\System\BSNHEbH.exe
  2⤵
  PID:6852
- C:\Windows\System\InGdndc.exe
  C:\Windows\System\InGdndc.exe
  2⤵
  PID:6868
- C:\Windows\System\HZlezps.exe
  C:\Windows\System\HZlezps.exe
  2⤵
  PID:6884
- C:\Windows\System\nLNEpFx.exe
  C:\Windows\System\nLNEpFx.exe
  2⤵
  PID:6900
- C:\Windows\System\guFNDuD.exe
  C:\Windows\System\guFNDuD.exe
  2⤵
  PID:6916
- C:\Windows\System\FcsabKv.exe
  C:\Windows\System\FcsabKv.exe
  2⤵
  PID:6932
- C:\Windows\System\sJtnSqZ.exe
  C:\Windows\System\sJtnSqZ.exe
  2⤵
  PID:6948
- C:\Windows\System\JWJaNHr.exe
  C:\Windows\System\JWJaNHr.exe
  2⤵
  PID:6964
- C:\Windows\System\dMqJYND.exe
  C:\Windows\System\dMqJYND.exe
  2⤵
  PID:6980
- C:\Windows\System\ChaECEC.exe
  C:\Windows\System\ChaECEC.exe
  2⤵
  PID:6996
- C:\Windows\System\psBJaYK.exe
  C:\Windows\System\psBJaYK.exe
  2⤵
  PID:7012
- C:\Windows\System\EgUyhub.exe
  C:\Windows\System\EgUyhub.exe
  2⤵
  PID:7028
- C:\Windows\System\NuNjgax.exe
  C:\Windows\System\NuNjgax.exe
  2⤵
  PID:7044
- C:\Windows\System\ubpHKCE.exe
  C:\Windows\System\ubpHKCE.exe
  2⤵
  PID:7060
- C:\Windows\System\MawCkTy.exe
  C:\Windows\System\MawCkTy.exe
  2⤵
  PID:7088
- C:\Windows\System\NRmBAzZ.exe
  C:\Windows\System\NRmBAzZ.exe
  2⤵
  PID:7112
- C:\Windows\System\olNnYUC.exe
  C:\Windows\System\olNnYUC.exe
  2⤵
  PID:7128
- C:\Windows\System\mCRYCgq.exe
  C:\Windows\System\mCRYCgq.exe
  2⤵
  PID:7144
- C:\Windows\System\HNiikPm.exe
  C:\Windows\System\HNiikPm.exe
  2⤵
  PID:7160
- C:\Windows\System\QgoXVNG.exe
  C:\Windows\System\QgoXVNG.exe
  2⤵
  PID:3344
- C:\Windows\System\hLpoLGl.exe
  C:\Windows\System\hLpoLGl.exe
  2⤵
  PID:6148
- C:\Windows\System\rCNDCic.exe
  C:\Windows\System\rCNDCic.exe
  2⤵
  PID:5760
- C:\Windows\System\CDUhrgC.exe
  C:\Windows\System\CDUhrgC.exe
  2⤵
  PID:5756
- C:\Windows\System\TtLPnko.exe
  C:\Windows\System\TtLPnko.exe
  2⤵
  PID:6064
- C:\Windows\System\dpDVcZR.exe
  C:\Windows\System\dpDVcZR.exe
  2⤵
  PID:5932
- C:\Windows\System\VAzrZFJ.exe
  C:\Windows\System\VAzrZFJ.exe
  2⤵
  PID:6232
- C:\Windows\System\KPrKwIU.exe
  C:\Windows\System\KPrKwIU.exe
  2⤵
  PID:5948
- C:\Windows\System\nfvaqJy.exe
  C:\Windows\System\nfvaqJy.exe
  2⤵
  PID:6284
- C:\Windows\System\yNXbAsH.exe
  C:\Windows\System\yNXbAsH.exe
  2⤵
  PID:5616
- C:\Windows\System\OQRhzys.exe
  C:\Windows\System\OQRhzys.exe
  2⤵
  PID:6168
- C:\Windows\System\WKadMYy.exe
  C:\Windows\System\WKadMYy.exe
  2⤵
  PID:6348
- C:\Windows\System\IBwiBmh.exe
  C:\Windows\System\IBwiBmh.exe
  2⤵
  PID:6364
- C:\Windows\System\XtREvzY.exe
  C:\Windows\System\XtREvzY.exe
  2⤵
  PID:6388
- C:\Windows\System\klhNNHX.exe
  C:\Windows\System\klhNNHX.exe
  2⤵
  PID:6452
- C:\Windows\System\cNYxmVa.exe
  C:\Windows\System\cNYxmVa.exe
  2⤵
  PID:6400
- C:\Windows\System\OqIalQB.exe
  C:\Windows\System\OqIalQB.exe
  2⤵
  PID:6556
- C:\Windows\System\wkPcFCa.exe
  C:\Windows\System\wkPcFCa.exe
  2⤵
  PID:6468
- C:\Windows\System\VdfVaAn.exe
  C:\Windows\System\VdfVaAn.exe
  2⤵
  PID:6588
- C:\Windows\System\dAklgOd.exe
  C:\Windows\System\dAklgOd.exe
  2⤵
  PID:6508
- C:\Windows\System\rnAatrd.exe
  C:\Windows\System\rnAatrd.exe
  2⤵
  PID:6656
- C:\Windows\System\JuuaKrZ.exe
  C:\Windows\System\JuuaKrZ.exe
  2⤵
  PID:6692
- C:\Windows\System\AJFDsAg.exe
  C:\Windows\System\AJFDsAg.exe
  2⤵
  PID:6724
- C:\Windows\System\qonmwlS.exe
  C:\Windows\System\qonmwlS.exe
  2⤵
  PID:6796
- C:\Windows\System\sFdKbNK.exe
  C:\Windows\System\sFdKbNK.exe
  2⤵
  PID:6864
- C:\Windows\System\tESpTvC.exe
  C:\Windows\System\tESpTvC.exe
  2⤵
  PID:6744
- C:\Windows\System\stuNOUc.exe
  C:\Windows\System\stuNOUc.exe
  2⤵
  PID:6776
- C:\Windows\System\ZoVUJvm.exe
  C:\Windows\System\ZoVUJvm.exe
  2⤵
  PID:6840
- C:\Windows\System\tadysry.exe
  C:\Windows\System\tadysry.exe
  2⤵
  PID:6880
- C:\Windows\System\sNrZqjv.exe
  C:\Windows\System\sNrZqjv.exe
  2⤵
  PID:6956
- C:\Windows\System\qrCptXS.exe
  C:\Windows\System\qrCptXS.exe
  2⤵
  PID:7020
- C:\Windows\System\JXRVeHD.exe
  C:\Windows\System\JXRVeHD.exe
  2⤵
  PID:6940
- C:\Windows\System\WvKTdgL.exe
  C:\Windows\System\WvKTdgL.exe
  2⤵
  PID:7084
- C:\Windows\System\scJswEr.exe
  C:\Windows\System\scJswEr.exe
  2⤵
  PID:7068
- C:\Windows\System\XFOpJte.exe
  C:\Windows\System\XFOpJte.exe
  2⤵
  PID:7104
- C:\Windows\System\qGBsYYK.exe
  C:\Windows\System\qGBsYYK.exe
  2⤵
  PID:7140
- C:\Windows\System\IcynSYc.exe
  C:\Windows\System\IcynSYc.exe
  2⤵
  PID:5548
- C:\Windows\System\WtUQXIa.exe
  C:\Windows\System\WtUQXIa.exe
  2⤵
  PID:6032
- C:\Windows\System\SKusTjz.exe
  C:\Windows\System\SKusTjz.exe
  2⤵
  PID:6264
- C:\Windows\System\LwNjSUD.exe
  C:\Windows\System\LwNjSUD.exe
  2⤵
  PID:6336
- C:\Windows\System\AHpbdDM.exe
  C:\Windows\System\AHpbdDM.exe
  2⤵
  PID:7156
- C:\Windows\System\JMaaLJI.exe
  C:\Windows\System\JMaaLJI.exe
  2⤵
  PID:6212
- C:\Windows\System\jipwDkd.exe
  C:\Windows\System\jipwDkd.exe
  2⤵
  PID:6200
- C:\Windows\System\BfdqIWa.exe
  C:\Windows\System\BfdqIWa.exe
  2⤵
  PID:6368
- C:\Windows\System\dsfhnkk.exe
  C:\Windows\System\dsfhnkk.exe
  2⤵
  PID:6448
- C:\Windows\System\SPzBcLH.exe
  C:\Windows\System\SPzBcLH.exe
  2⤵
  PID:6560
- C:\Windows\System\alZQNTI.exe
  C:\Windows\System\alZQNTI.exe
  2⤵
  PID:6664
- C:\Windows\System\scScmUU.exe
  C:\Windows\System\scScmUU.exe
  2⤵
  PID:6624
- C:\Windows\System\olUKJls.exe
  C:\Windows\System\olUKJls.exe
  2⤵
  PID:6636
- C:\Windows\System\ENUemLI.exe
  C:\Windows\System\ENUemLI.exe
  2⤵
  PID:6828
- C:\Windows\System\hGhTldj.exe
  C:\Windows\System\hGhTldj.exe
  2⤵
  PID:6876
- C:\Windows\System\WiJqiVA.exe
  C:\Windows\System\WiJqiVA.exe
  2⤵
  PID:6812
- C:\Windows\System\UTqVVza.exe
  C:\Windows\System\UTqVVza.exe
  2⤵
  PID:7080
- C:\Windows\System\dUJZQGy.exe
  C:\Windows\System\dUJZQGy.exe
  2⤵
  PID:6740
- C:\Windows\System\hqrbagy.exe
  C:\Windows\System\hqrbagy.exe
  2⤵
  PID:7056
- C:\Windows\System\lZitdkQ.exe
  C:\Windows\System\lZitdkQ.exe
  2⤵
  PID:7100
- C:\Windows\System\avaHfVb.exe
  C:\Windows\System\avaHfVb.exe
  2⤵
  PID:6228
- C:\Windows\System\RFDxmVv.exe
  C:\Windows\System\RFDxmVv.exe
  2⤵
  PID:6248
- C:\Windows\System\aETmHfk.exe
  C:\Windows\System\aETmHfk.exe
  2⤵
  PID:5960
- C:\Windows\System\lqorryE.exe
  C:\Windows\System\lqorryE.exe
  2⤵
  PID:5980
- C:\Windows\System\fbyyXyU.exe
  C:\Windows\System\fbyyXyU.exe
  2⤵
  PID:6544
- C:\Windows\System\MChCEZg.exe
  C:\Windows\System\MChCEZg.exe
  2⤵
  PID:6300
- C:\Windows\System\XOHzoee.exe
  C:\Windows\System\XOHzoee.exe
  2⤵
  PID:6772
- C:\Windows\System\ZBlWmGJ.exe
  C:\Windows\System\ZBlWmGJ.exe
  2⤵
  PID:6976
- C:\Windows\System\aEpuvue.exe
  C:\Windows\System\aEpuvue.exe
  2⤵
  PID:6620
- C:\Windows\System\NZJuzYD.exe
  C:\Windows\System\NZJuzYD.exe
  2⤵
  PID:7120
- C:\Windows\System\pqZgdpV.exe
  C:\Windows\System\pqZgdpV.exe
  2⤵
  PID:6792
- C:\Windows\System\gzSUnNr.exe
  C:\Windows\System\gzSUnNr.exe
  2⤵
  PID:6760
- C:\Windows\System\JPiNezB.exe
  C:\Windows\System\JPiNezB.exe
  2⤵
  PID:6436
- C:\Windows\System\Zytbotw.exe
  C:\Windows\System\Zytbotw.exe
  2⤵
  PID:7036
- C:\Windows\System\REGbuDV.exe
  C:\Windows\System\REGbuDV.exe
  2⤵
  PID:6492
- C:\Windows\System\jLLMJen.exe
  C:\Windows\System\jLLMJen.exe
  2⤵
  PID:5764
- C:\Windows\System\pbZDAcy.exe
  C:\Windows\System\pbZDAcy.exe
  2⤵
  PID:6488
- C:\Windows\System\evifAtf.exe
  C:\Windows\System\evifAtf.exe
  2⤵
  PID:6896
- C:\Windows\System\vUkMrIZ.exe
  C:\Windows\System\vUkMrIZ.exe
  2⤵
  PID:6860
- C:\Windows\System\FNPvSHO.exe
  C:\Windows\System\FNPvSHO.exe
  2⤵
  PID:6992
- C:\Windows\System\bHRdCIO.exe
  C:\Windows\System\bHRdCIO.exe
  2⤵
  PID:7180
- C:\Windows\System\cHCTowf.exe
  C:\Windows\System\cHCTowf.exe
  2⤵
  PID:7196
- C:\Windows\System\uZbZJPL.exe
  C:\Windows\System\uZbZJPL.exe
  2⤵
  PID:7212
- C:\Windows\System\jAWKlYB.exe
  C:\Windows\System\jAWKlYB.exe
  2⤵
  PID:7232
- C:\Windows\System\AXrbUMV.exe
  C:\Windows\System\AXrbUMV.exe
  2⤵
  PID:7248
- C:\Windows\System\zokRjDm.exe
  C:\Windows\System\zokRjDm.exe
  2⤵
  PID:7264
- C:\Windows\System\ZYmXgJe.exe
  C:\Windows\System\ZYmXgJe.exe
  2⤵
  PID:7280
- C:\Windows\System\rBJolcf.exe
  C:\Windows\System\rBJolcf.exe
  2⤵
  PID:7296
- C:\Windows\System\lcHFFLO.exe
  C:\Windows\System\lcHFFLO.exe
  2⤵
  PID:7312
- C:\Windows\System\nFtllMh.exe
  C:\Windows\System\nFtllMh.exe
  2⤵
  PID:7328
- C:\Windows\System\umTjkti.exe
  C:\Windows\System\umTjkti.exe
  2⤵
  PID:7344
- C:\Windows\System\CGeIVXI.exe
  C:\Windows\System\CGeIVXI.exe
  2⤵
  PID:7360
- C:\Windows\System\dUNNhex.exe
  C:\Windows\System\dUNNhex.exe
  2⤵
  PID:7376
- C:\Windows\System\FYrhroZ.exe
  C:\Windows\System\FYrhroZ.exe
  2⤵
  PID:7392
- C:\Windows\System\lhAHxtQ.exe
  C:\Windows\System\lhAHxtQ.exe
  2⤵
  PID:7408
- C:\Windows\System\wwVoDqg.exe
  C:\Windows\System\wwVoDqg.exe
  2⤵
  PID:7424
- C:\Windows\System\jxoBlVd.exe
  C:\Windows\System\jxoBlVd.exe
  2⤵
  PID:7444
- C:\Windows\System\TmSaOyt.exe
  C:\Windows\System\TmSaOyt.exe
  2⤵
  PID:7460
- C:\Windows\System\MwbGgje.exe
  C:\Windows\System\MwbGgje.exe
  2⤵
  PID:7476
- C:\Windows\System\HKxJYiE.exe
  C:\Windows\System\HKxJYiE.exe
  2⤵
  PID:7496
- C:\Windows\System\SKbQGoN.exe
  C:\Windows\System\SKbQGoN.exe
  2⤵
  PID:7512
- C:\Windows\System\gylenKP.exe
  C:\Windows\System\gylenKP.exe
  2⤵
  PID:7528
- C:\Windows\System\UqanwpO.exe
  C:\Windows\System\UqanwpO.exe
  2⤵
  PID:7544
- C:\Windows\System\LHpNVbv.exe
  C:\Windows\System\LHpNVbv.exe
  2⤵
  PID:7560
- C:\Windows\System\ISSRkEn.exe
  C:\Windows\System\ISSRkEn.exe
  2⤵
  PID:7576
- C:\Windows\System\AQGpuzG.exe
  C:\Windows\System\AQGpuzG.exe
  2⤵
  PID:7596
- C:\Windows\System\ZyvcHVF.exe
  C:\Windows\System\ZyvcHVF.exe
  2⤵
  PID:7616
- C:\Windows\System\pipDhVe.exe
  C:\Windows\System\pipDhVe.exe
  2⤵
  PID:7632
- C:\Windows\System\CDdZQAv.exe
  C:\Windows\System\CDdZQAv.exe
  2⤵
  PID:7648
- C:\Windows\System\CMQjsVg.exe
  C:\Windows\System\CMQjsVg.exe
  2⤵
  PID:7668
- C:\Windows\System\WwAuZhA.exe
  C:\Windows\System\WwAuZhA.exe
  2⤵
  PID:7684
- C:\Windows\System\OdSTBhe.exe
  C:\Windows\System\OdSTBhe.exe
  2⤵
  PID:7700
- C:\Windows\System\hIuKZBw.exe
  C:\Windows\System\hIuKZBw.exe
  2⤵
  PID:7716
- C:\Windows\System\zqOdyeZ.exe
  C:\Windows\System\zqOdyeZ.exe
  2⤵
  PID:7732
- C:\Windows\System\dyTKbKN.exe
  C:\Windows\System\dyTKbKN.exe
  2⤵
  PID:7748
- C:\Windows\System\WyqhppN.exe
  C:\Windows\System\WyqhppN.exe
  2⤵
  PID:7768
- C:\Windows\System\UgQCiQx.exe
  C:\Windows\System\UgQCiQx.exe
  2⤵
  PID:7784
- C:\Windows\System\GwDoJkC.exe
  C:\Windows\System\GwDoJkC.exe
  2⤵
  PID:7800
- C:\Windows\System\tLaCkrZ.exe
  C:\Windows\System\tLaCkrZ.exe
  2⤵
  PID:7816
- C:\Windows\System\Ukpusgm.exe
  C:\Windows\System\Ukpusgm.exe
  2⤵
  PID:7836
- C:\Windows\System\hXaVVYx.exe
  C:\Windows\System\hXaVVYx.exe
  2⤵
  PID:7852
- C:\Windows\System\JREjNfH.exe
  C:\Windows\System\JREjNfH.exe
  2⤵
  PID:7868
- C:\Windows\System\SzJLRCG.exe
  C:\Windows\System\SzJLRCG.exe
  2⤵
  PID:7888
- C:\Windows\System\ikMNTKO.exe
  C:\Windows\System\ikMNTKO.exe
  2⤵
  PID:7904
- C:\Windows\System\bTZPKEx.exe
  C:\Windows\System\bTZPKEx.exe
  2⤵
  PID:7920
- C:\Windows\System\pCEiYZO.exe
  C:\Windows\System\pCEiYZO.exe
  2⤵
  PID:7936
- C:\Windows\System\pzdjpKe.exe
  C:\Windows\System\pzdjpKe.exe
  2⤵
  PID:7952
- C:\Windows\System\GIcuIAA.exe
  C:\Windows\System\GIcuIAA.exe
  2⤵
  PID:7972
- C:\Windows\System\WwcXpPA.exe
  C:\Windows\System\WwcXpPA.exe
  2⤵
  PID:8004
- C:\Windows\System\LTWsJaZ.exe
  C:\Windows\System\LTWsJaZ.exe
  2⤵
  PID:8020
- C:\Windows\System\WRTVdZq.exe
  C:\Windows\System\WRTVdZq.exe
  2⤵
  PID:8164
- C:\Windows\System\KwCKbBQ.exe
  C:\Windows\System\KwCKbBQ.exe
  2⤵
  PID:8180
- C:\Windows\System\MWaezKM.exe
  C:\Windows\System\MWaezKM.exe
  2⤵
  PID:7176
- C:\Windows\System\kerhmyR.exe
  C:\Windows\System\kerhmyR.exe
  2⤵
  PID:7240
- C:\Windows\System\pHTXufM.exe
  C:\Windows\System\pHTXufM.exe
  2⤵
  PID:6604
- C:\Windows\System\BtEWQqM.exe
  C:\Windows\System\BtEWQqM.exe
  2⤵
  PID:6696
- C:\Windows\System\VEPPlHy.exe
  C:\Windows\System\VEPPlHy.exe
  2⤵
  PID:7352
- C:\Windows\System\ZXInKNd.exe
  C:\Windows\System\ZXInKNd.exe
  2⤵
  PID:7416
- C:\Windows\System\yYxIGSK.exe
  C:\Windows\System\yYxIGSK.exe
  2⤵
  PID:7484
- C:\Windows\System\aPfaliK.exe
  C:\Windows\System\aPfaliK.exe
  2⤵
  PID:7520
- C:\Windows\System\DMYmdHZ.exe
  C:\Windows\System\DMYmdHZ.exe
  2⤵
  PID:7324
- C:\Windows\System\xVIDbcv.exe
  C:\Windows\System\xVIDbcv.exe
  2⤵
  PID:7584
- C:\Windows\System\okfWUoJ.exe
  C:\Windows\System\okfWUoJ.exe
  2⤵
  PID:7640
- C:\Windows\System\USFCdCr.exe
  C:\Windows\System\USFCdCr.exe
  2⤵
  PID:7708
- C:\Windows\System\YHLQqXn.exe
  C:\Windows\System\YHLQqXn.exe
  2⤵
  PID:7744
- C:\Windows\System\MyXojEJ.exe
  C:\Windows\System\MyXojEJ.exe
  2⤵
  PID:7844
- C:\Windows\System\TQUuIQd.exe
  C:\Windows\System\TQUuIQd.exe
  2⤵
  PID:7884
- C:\Windows\System\UCTDkJp.exe
  C:\Windows\System\UCTDkJp.exe
  2⤵
  PID:7660
- C:\Windows\System\qBfGkWn.exe
  C:\Windows\System\qBfGkWn.exe
  2⤵
  PID:7944
- C:\Windows\System\oqcKOVO.exe
  C:\Windows\System\oqcKOVO.exe
  2⤵
  PID:7992
- C:\Windows\System\kpaQAgc.exe
  C:\Windows\System\kpaQAgc.exe
  2⤵
  PID:7692
- C:\Windows\System\JwAiXgc.exe
  C:\Windows\System\JwAiXgc.exe
  2⤵
  PID:7896
- C:\Windows\System\pwEkZwo.exe
  C:\Windows\System\pwEkZwo.exe
  2⤵
  PID:7860
- C:\Windows\System\JshyBPw.exe
  C:\Windows\System\JshyBPw.exe
  2⤵
  PID:7764
- C:\Windows\System\iSjenjN.exe
  C:\Windows\System\iSjenjN.exe
  2⤵
  PID:7728
- C:\Windows\System\pwIWpPv.exe
  C:\Windows\System\pwIWpPv.exe
  2⤵
  PID:8028
- C:\Windows\System\ToGNJam.exe
  C:\Windows\System\ToGNJam.exe
  2⤵
  PID:8056
- C:\Windows\System\esktaKM.exe
  C:\Windows\System\esktaKM.exe
  2⤵
  PID:8072
- C:\Windows\System\OimnXYv.exe
  C:\Windows\System\OimnXYv.exe
  2⤵
  PID:8080
- C:\Windows\System\Tsmqrcm.exe
  C:\Windows\System\Tsmqrcm.exe
  2⤵
  PID:8100
- C:\Windows\System\oEKYlYV.exe
  C:\Windows\System\oEKYlYV.exe
  2⤵
  PID:8112
- C:\Windows\System\vZJpgUh.exe
  C:\Windows\System\vZJpgUh.exe
  2⤵
  PID:8132
- C:\Windows\System\IlPmDZy.exe
  C:\Windows\System\IlPmDZy.exe
  2⤵
  PID:8148
- C:\Windows\System\qlEWNbm.exe
  C:\Windows\System\qlEWNbm.exe
  2⤵
  PID:7172
- C:\Windows\System\eSEYFrV.exe
  C:\Windows\System\eSEYFrV.exe
  2⤵
  PID:7224
- C:\Windows\System\tjVhulM.exe
  C:\Windows\System\tjVhulM.exe
  2⤵
  PID:8172
- C:\Windows\System\lYxzBFM.exe
  C:\Windows\System\lYxzBFM.exe
  2⤵
  PID:7260
- C:\Windows\System\cNZwvGy.exe
  C:\Windows\System\cNZwvGy.exe
  2⤵
  PID:7400
- C:\Windows\System\eLprDEH.exe
  C:\Windows\System\eLprDEH.exe
  2⤵
  PID:7468
- C:\Windows\System\CjttXig.exe
  C:\Windows\System\CjttXig.exe
  2⤵
  PID:7288
- C:\Windows\System\xNflbFc.exe
  C:\Windows\System\xNflbFc.exe
  2⤵
  PID:7452
- C:\Windows\System\MjIXbEW.exe
  C:\Windows\System\MjIXbEW.exe
  2⤵
  PID:7608
- C:\Windows\System\kEyKiUa.exe
  C:\Windows\System\kEyKiUa.exe
  2⤵
  PID:7712
- C:\Windows\System\lDlFOSs.exe
  C:\Windows\System\lDlFOSs.exe
  2⤵
  PID:7388
- C:\Windows\System\lEcnppk.exe
  C:\Windows\System\lEcnppk.exe
  2⤵
  PID:7676
- C:\Windows\System\yocyvfx.exe
  C:\Windows\System\yocyvfx.exe
  2⤵
  PID:7980
- C:\Windows\System\vqgnXyh.exe
  C:\Windows\System\vqgnXyh.exe
  2⤵
  PID:7960
- C:\Windows\System\jlJMSvi.exe
  C:\Windows\System\jlJMSvi.exe
  2⤵
  PID:7756
- C:\Windows\System\OTLJkOb.exe
  C:\Windows\System\OTLJkOb.exe
  2⤵
  PID:7628
- C:\Windows\System\BTsCDir.exe
  C:\Windows\System\BTsCDir.exe
  2⤵
  PID:1576
- C:\Windows\System\MUNMtqY.exe
  C:\Windows\System\MUNMtqY.exe
  2⤵
  PID:8104
- C:\Windows\System\BKAdvbh.exe
  C:\Windows\System\BKAdvbh.exe
  2⤵
  PID:8092
- C:\Windows\System\sIkAVlv.exe
  C:\Windows\System\sIkAVlv.exe
  2⤵
  PID:8156
- C:\Windows\System\OQmkzSm.exe
  C:\Windows\System\OQmkzSm.exe
  2⤵
  PID:8064
- C:\Windows\System\gbNYMFt.exe
  C:\Windows\System\gbNYMFt.exe
  2⤵
  PID:8188
- C:\Windows\System\crJqQer.exe
  C:\Windows\System\crJqQer.exe
  2⤵
  PID:7208
- C:\Windows\System\BnniURj.exe
  C:\Windows\System\BnniURj.exe
  2⤵
  PID:7340
- C:\Windows\System\VTaWxYZ.exe
  C:\Windows\System\VTaWxYZ.exe
  2⤵
  PID:7440
- C:\Windows\System\MjkEahK.exe
  C:\Windows\System\MjkEahK.exe
  2⤵
  PID:7384
- C:\Windows\System\MvXMhmW.exe
  C:\Windows\System\MvXMhmW.exe
  2⤵
  PID:7472
- C:\Windows\System\bKsKplq.exe
  C:\Windows\System\bKsKplq.exe
  2⤵
  PID:7556
- C:\Windows\System\rkNUqVX.exe
  C:\Windows\System\rkNUqVX.exe
  2⤵
  PID:8040
- C:\Windows\System\ndxMDUI.exe
  C:\Windows\System\ndxMDUI.exe
  2⤵
  PID:7916
- C:\Windows\System\eGIsstx.exe
  C:\Windows\System\eGIsstx.exe
  2⤵
  PID:7696
- C:\Windows\System\ejSkOCv.exe
  C:\Windows\System\ejSkOCv.exe
  2⤵
  PID:7812
- C:\Windows\System\keaDBew.exe
  C:\Windows\System\keaDBew.exe
  2⤵
  PID:7308
- C:\Windows\System\igLVgAK.exe
  C:\Windows\System\igLVgAK.exe
  2⤵
  PID:7372
- C:\Windows\System\gjjXxus.exe
  C:\Windows\System\gjjXxus.exe
  2⤵
  PID:8016
- C:\Windows\System\uetYMIG.exe
  C:\Windows\System\uetYMIG.exe
  2⤵
  PID:7336
- C:\Windows\System\RXzyrii.exe
  C:\Windows\System\RXzyrii.exe
  2⤵
  PID:7292
- C:\Windows\System\iRUSrQg.exe
  C:\Windows\System\iRUSrQg.exe
  2⤵
  PID:7796
- C:\Windows\System\EpTKpHt.exe
  C:\Windows\System\EpTKpHt.exe
  2⤵
  PID:8124
- C:\Windows\System\pzawaWH.exe
  C:\Windows\System\pzawaWH.exe
  2⤵
  PID:8160
- C:\Windows\System\zKNkhPL.exe
  C:\Windows\System\zKNkhPL.exe
  2⤵
  PID:8052
- C:\Windows\System\VGYTjUa.exe
  C:\Windows\System\VGYTjUa.exe
  2⤵
  PID:8208
- C:\Windows\System\RygSDnU.exe
  C:\Windows\System\RygSDnU.exe
  2⤵
  PID:8232
- C:\Windows\System\sWPaKkn.exe
  C:\Windows\System\sWPaKkn.exe
  2⤵
  PID:8248
- C:\Windows\System\ufzwKok.exe
  C:\Windows\System\ufzwKok.exe
  2⤵
  PID:8320
- C:\Windows\System\mHZnazk.exe
  C:\Windows\System\mHZnazk.exe
  2⤵
  PID:8336
- C:\Windows\System\YDRIzEN.exe
  C:\Windows\System\YDRIzEN.exe
  2⤵
  PID:8352
- C:\Windows\System\kaoTPrf.exe
  C:\Windows\System\kaoTPrf.exe
  2⤵
  PID:8368
- C:\Windows\System\SLTJesl.exe
  C:\Windows\System\SLTJesl.exe
  2⤵
  PID:8460
- C:\Windows\System\cYYoews.exe
  C:\Windows\System\cYYoews.exe
  2⤵
  PID:8480
- C:\Windows\System\ebGkjgv.exe
  C:\Windows\System\ebGkjgv.exe
  2⤵
  PID:8500
- C:\Windows\System\Ezyfyfp.exe
  C:\Windows\System\Ezyfyfp.exe
  2⤵
  PID:8516
- C:\Windows\System\PQPRQsc.exe
  C:\Windows\System\PQPRQsc.exe
  2⤵
  PID:8532
- C:\Windows\System\OPEwEjO.exe
  C:\Windows\System\OPEwEjO.exe
  2⤵
  PID:8548
- C:\Windows\System\GxOtjSF.exe
  C:\Windows\System\GxOtjSF.exe
  2⤵
  PID:8564
- C:\Windows\System\DuhyJXg.exe
  C:\Windows\System\DuhyJXg.exe
  2⤵
  PID:8580
- C:\Windows\System\ZYtYRAO.exe
  C:\Windows\System\ZYtYRAO.exe
  2⤵
  PID:8596
- C:\Windows\System\vRMAOlG.exe
  C:\Windows\System\vRMAOlG.exe
  2⤵
  PID:8612
- C:\Windows\System\quLEpGE.exe
  C:\Windows\System\quLEpGE.exe
  2⤵
  PID:8628
- C:\Windows\System\yYRNOjN.exe
  C:\Windows\System\yYRNOjN.exe
  2⤵
  PID:8648
- C:\Windows\System\NOznIQW.exe
  C:\Windows\System\NOznIQW.exe
  2⤵
  PID:8664
- C:\Windows\System\CuOfMoW.exe
  C:\Windows\System\CuOfMoW.exe
  2⤵
  PID:8680
- C:\Windows\System\mUNqAtA.exe
  C:\Windows\System\mUNqAtA.exe
  2⤵
  PID:8696
- C:\Windows\System\RhRPOYD.exe
  C:\Windows\System\RhRPOYD.exe
  2⤵
  PID:8712
- C:\Windows\System\njhqWcQ.exe
  C:\Windows\System\njhqWcQ.exe
  2⤵
  PID:8728
- C:\Windows\System\ysaihJL.exe
  C:\Windows\System\ysaihJL.exe
  2⤵
  PID:8744
- C:\Windows\System\snLwpmN.exe
  C:\Windows\System\snLwpmN.exe
  2⤵
  PID:8760
- C:\Windows\System\BbuVgUi.exe
  C:\Windows\System\BbuVgUi.exe
  2⤵
  PID:8776
- C:\Windows\System\AIqdaXo.exe
  C:\Windows\System\AIqdaXo.exe
  2⤵
  PID:8792
- C:\Windows\System\OPfaJij.exe
  C:\Windows\System\OPfaJij.exe
  2⤵
  PID:8812
- C:\Windows\System\fcdedoh.exe
  C:\Windows\System\fcdedoh.exe
  2⤵
  PID:8828
- C:\Windows\System\PkBCrhX.exe
  C:\Windows\System\PkBCrhX.exe
  2⤵
  PID:8844
- C:\Windows\System\uHRTAbv.exe
  C:\Windows\System\uHRTAbv.exe
  2⤵
  PID:8860
- C:\Windows\System\OPgUJHm.exe
  C:\Windows\System\OPgUJHm.exe
  2⤵
  PID:8876
- C:\Windows\System\qVVvOPl.exe
  C:\Windows\System\qVVvOPl.exe
  2⤵
  PID:8892
- C:\Windows\System\nEsurRc.exe
  C:\Windows\System\nEsurRc.exe
  2⤵
  PID:8908
- C:\Windows\System\GMynvln.exe
  C:\Windows\System\GMynvln.exe
  2⤵
  PID:8924
- C:\Windows\System\KMFcptb.exe
  C:\Windows\System\KMFcptb.exe
  2⤵
  PID:8940
- C:\Windows\System\LWZgPAa.exe
  C:\Windows\System\LWZgPAa.exe
  2⤵
  PID:8956
- C:\Windows\System\FKGApnN.exe
  C:\Windows\System\FKGApnN.exe
  2⤵
  PID:8972
- C:\Windows\System\XUlYFxC.exe
  C:\Windows\System\XUlYFxC.exe
  2⤵
  PID:8988
- C:\Windows\System\DGiEOvD.exe
  C:\Windows\System\DGiEOvD.exe
  2⤵
  PID:9004
- C:\Windows\System\zLfrsCk.exe
  C:\Windows\System\zLfrsCk.exe
  2⤵
  PID:9020
- C:\Windows\System\TCHsLpz.exe
  C:\Windows\System\TCHsLpz.exe
  2⤵
  PID:9036
- C:\Windows\System\EkzVwwx.exe
  C:\Windows\System\EkzVwwx.exe
  2⤵
  PID:9056
- C:\Windows\System\kOacfYq.exe
  C:\Windows\System\kOacfYq.exe
  2⤵
  PID:9072
- C:\Windows\System\vyNMhpG.exe
  C:\Windows\System\vyNMhpG.exe
  2⤵
  PID:9088
- C:\Windows\System\ZLuaqxc.exe
  C:\Windows\System\ZLuaqxc.exe
  2⤵
  PID:9108
- C:\Windows\System\WOuOfUx.exe
  C:\Windows\System\WOuOfUx.exe
  2⤵
  PID:9124
- C:\Windows\System\wBwMpqd.exe
  C:\Windows\System\wBwMpqd.exe
  2⤵
  PID:9140
- C:\Windows\System\MUGqiYS.exe
  C:\Windows\System\MUGqiYS.exe
  2⤵
  PID:9176
- C:\Windows\System\WzbkzwZ.exe
  C:\Windows\System\WzbkzwZ.exe
  2⤵
  PID:9192
- C:\Windows\System\PofnGBo.exe
  C:\Windows\System\PofnGBo.exe
  2⤵
  PID:9208
- C:\Windows\System\GEEtZHV.exe
  C:\Windows\System\GEEtZHV.exe
  2⤵
  PID:7932
- C:\Windows\System\FXmepIb.exe
  C:\Windows\System\FXmepIb.exe
  2⤵
  PID:8204
- C:\Windows\System\INgjvLs.exe
  C:\Windows\System\INgjvLs.exe
  2⤵
  PID:7984
- C:\Windows\System\IDZPpwl.exe
  C:\Windows\System\IDZPpwl.exe
  2⤵
  PID:8068
- C:\Windows\System\HoBSAmi.exe
  C:\Windows\System\HoBSAmi.exe
  2⤵
  PID:8044
- C:\Windows\System\dLPuzXD.exe
  C:\Windows\System\dLPuzXD.exe
  2⤵
  PID:8256
- C:\Windows\System\GtEDgwP.exe
  C:\Windows\System\GtEDgwP.exe
  2⤵
  PID:8272
- C:\Windows\System\WvfsUNk.exe
  C:\Windows\System\WvfsUNk.exe
  2⤵
  PID:8292
- C:\Windows\System\YwPogSH.exe
  C:\Windows\System\YwPogSH.exe
  2⤵
  PID:8304
- C:\Windows\System\XlvuSEz.exe
  C:\Windows\System\XlvuSEz.exe
  2⤵
  PID:8316
- C:\Windows\System\mZRhZLQ.exe
  C:\Windows\System\mZRhZLQ.exe
  2⤵
  PID:8364
- C:\Windows\System\pwCnBMT.exe
  C:\Windows\System\pwCnBMT.exe
  2⤵
  PID:8384
- C:\Windows\System\XxYbvse.exe
  C:\Windows\System\XxYbvse.exe
  2⤵
  PID:8408
- C:\Windows\System\yyLCxfN.exe
  C:\Windows\System\yyLCxfN.exe
  2⤵
  PID:8424
- C:\Windows\System\FVAvWbY.exe
  C:\Windows\System\FVAvWbY.exe
  2⤵
  PID:8440
- C:\Windows\System\smWMgJz.exe
  C:\Windows\System\smWMgJz.exe
  2⤵
  PID:8476
- C:\Windows\System\rbtihUS.exe
  C:\Windows\System\rbtihUS.exe
  2⤵
  PID:8508
- C:\Windows\System\AIHdNqI.exe
  C:\Windows\System\AIHdNqI.exe
  2⤵
  PID:8456
- C:\Windows\System\UbOUiDx.exe
  C:\Windows\System\UbOUiDx.exe
  2⤵
  PID:8524
- C:\Windows\System\yTVHgDx.exe
  C:\Windows\System\yTVHgDx.exe
  2⤵
  PID:8608
- C:\Windows\System\JIhniMA.exe
  C:\Windows\System\JIhniMA.exe
  2⤵
  PID:8672
- C:\Windows\System\GsDihdl.exe
  C:\Windows\System\GsDihdl.exe
  2⤵
  PID:8736
- C:\Windows\System\LWTbltg.exe
  C:\Windows\System\LWTbltg.exe
  2⤵
  PID:8804
- C:\Windows\System\wJurSaO.exe
  C:\Windows\System\wJurSaO.exe
  2⤵
  PID:8868
- C:\Windows\System\dyjjmiF.exe
  C:\Windows\System\dyjjmiF.exe
  2⤵
  PID:8592
- C:\Windows\System\nbLuOhx.exe
  C:\Windows\System\nbLuOhx.exe
  2⤵
  PID:8620
- C:\Windows\System\mRyCknk.exe
  C:\Windows\System\mRyCknk.exe
  2⤵
  PID:8724
- C:\Windows\System\eccnEqu.exe
  C:\Windows\System\eccnEqu.exe
  2⤵
  PID:8852
- C:\Windows\System\UfCxdUp.exe
  C:\Windows\System\UfCxdUp.exe
  2⤵
  PID:8904
- C:\Windows\System\zQQIvnE.exe
  C:\Windows\System\zQQIvnE.exe
  2⤵
  PID:8936
- C:\Windows\System\WXJWOIe.exe
  C:\Windows\System\WXJWOIe.exe
  2⤵
  PID:8952
- C:\Windows\System\fxNFfEV.exe
  C:\Windows\System\fxNFfEV.exe
  2⤵
  PID:9032
- C:\Windows\System\ZnwbUeb.exe
  C:\Windows\System\ZnwbUeb.exe
  2⤵
  PID:9100
- C:\Windows\System\YRStBVG.exe
  C:\Windows\System\YRStBVG.exe
  2⤵
  PID:8948
- C:\Windows\System\swGQRIR.exe
  C:\Windows\System\swGQRIR.exe
  2⤵
  PID:8984
- C:\Windows\System\KEBXXDL.exe
  C:\Windows\System\KEBXXDL.exe
  2⤵
  PID:9012
- C:\Windows\System\huptLXJ.exe
  C:\Windows\System\huptLXJ.exe
  2⤵
  PID:9152
- C:\Windows\System\gOvWDPr.exe
  C:\Windows\System\gOvWDPr.exe
  2⤵
  PID:9168
- C:\Windows\System\ATHtFhi.exe
  C:\Windows\System\ATHtFhi.exe
  2⤵
  PID:7968
- C:\Windows\System\NYAAksp.exe
  C:\Windows\System\NYAAksp.exe
  2⤵
  PID:9204
- C:\Windows\System\oOTJuRI.exe
  C:\Windows\System\oOTJuRI.exe
  2⤵
  PID:9200
- C:\Windows\System\gihSBll.exe
  C:\Windows\System\gihSBll.exe
  2⤵
  PID:8196
- C:\Windows\System\KhqCKrX.exe
  C:\Windows\System\KhqCKrX.exe
  2⤵
  PID:8400
- C:\Windows\System\NLmXGnc.exe
  C:\Windows\System\NLmXGnc.exe
  2⤵
  PID:8496
- C:\Windows\System\TzSUJVh.exe
  C:\Windows\System\TzSUJVh.exe
  2⤵
  PID:8488
- C:\Windows\System\oLHtfGT.exe
  C:\Windows\System\oLHtfGT.exe
  2⤵
  PID:8640
- C:\Windows\System\lSxzanu.exe
  C:\Windows\System\lSxzanu.exe
  2⤵
  PID:8416
- C:\Windows\System\qRBqcmk.exe
  C:\Windows\System\qRBqcmk.exe
  2⤵
  PID:8468
- C:\Windows\System\HYouucl.exe
  C:\Windows\System\HYouucl.exe
  2⤵
  PID:8576
- C:\Windows\System\zEmTONw.exe
  C:\Windows\System\zEmTONw.exe
  2⤵
  PID:8708
- C:\Windows\System\RNwjxpc.exe
  C:\Windows\System\RNwjxpc.exe
  2⤵
  PID:8720
- C:\Windows\System\iblhiNp.exe
  C:\Windows\System\iblhiNp.exe
  2⤵
  PID:8900
- C:\Windows\System\OobvFbT.exe
  C:\Windows\System\OobvFbT.exe
  2⤵
  PID:8840
- C:\Windows\System\BHuAtrw.exe
  C:\Windows\System\BHuAtrw.exe
  2⤵
  PID:8824
- C:\Windows\System\aJupDli.exe
  C:\Windows\System\aJupDli.exe
  2⤵
  PID:8968
- C:\Windows\System\JqdPXIz.exe
  C:\Windows\System\JqdPXIz.exe
  2⤵
  PID:9148
- C:\Windows\System\ysKPNgL.exe
  C:\Windows\System\ysKPNgL.exe
  2⤵
  PID:9084
- C:\Windows\System\KKPsTyj.exe
  C:\Windows\System\KKPsTyj.exe
  2⤵
  PID:9136
- C:\Windows\System\GdRmJSm.exe
  C:\Windows\System\GdRmJSm.exe
  2⤵
  PID:9188
- C:\Windows\System\JzhisEt.exe
  C:\Windows\System\JzhisEt.exe
  2⤵
  PID:8220
- C:\Windows\System\ZwhytST.exe
  C:\Windows\System\ZwhytST.exe
  2⤵
  PID:8268
- C:\Windows\System\yHioGLT.exe
  C:\Windows\System\yHioGLT.exe
  2⤵
  PID:8432
- C:\Windows\System\wpPzrFT.exe
  C:\Windows\System\wpPzrFT.exe
  2⤵
  PID:8244
- C:\Windows\System\OJdxolU.exe
  C:\Windows\System\OJdxolU.exe
  2⤵
  PID:8572
- C:\Windows\System\ODCjiTb.exe
  C:\Windows\System\ODCjiTb.exe
  2⤵
  PID:8704
- C:\Windows\System\kAJWjqA.exe
  C:\Windows\System\kAJWjqA.exe
  2⤵
  PID:8784
- C:\Windows\System\ENQegSe.exe
  C:\Windows\System\ENQegSe.exe
  2⤵
  PID:8688
- C:\Windows\System\JYGEKbO.exe
  C:\Windows\System\JYGEKbO.exe
  2⤵
  PID:8808
- C:\Windows\System\EdsxsDg.exe
  C:\Windows\System\EdsxsDg.exe
  2⤵
  PID:8140
- C:\Windows\System\JCpVFdM.exe
  C:\Windows\System\JCpVFdM.exe
  2⤵
  PID:8420
- C:\Windows\System\hSrEpQq.exe
  C:\Windows\System\hSrEpQq.exe
  2⤵
  PID:9160
- C:\Windows\System\JwXwqvI.exe
  C:\Windows\System\JwXwqvI.exe
  2⤵
  PID:9044
- C:\Windows\System\FbADepf.exe
  C:\Windows\System\FbADepf.exe
  2⤵
  PID:8692
- C:\Windows\System\udAFpJg.exe
  C:\Windows\System\udAFpJg.exe
  2⤵
  PID:8800
- C:\Windows\System\MeUqMGL.exe
  C:\Windows\System\MeUqMGL.exe
  2⤵
  PID:8980
- C:\Windows\System\FFdFoLl.exe
  C:\Windows\System\FFdFoLl.exe
  2⤵
  PID:8332
- C:\Windows\System\ENQMwIh.exe
  C:\Windows\System\ENQMwIh.exe
  2⤵
  PID:9080
- C:\Windows\System\NZVWgBD.exe
  C:\Windows\System\NZVWgBD.exe
  2⤵
  PID:9232
- C:\Windows\System\AVhXgdr.exe
  C:\Windows\System\AVhXgdr.exe
  2⤵
  PID:9248
- C:\Windows\System\lFZrBqV.exe
  C:\Windows\System\lFZrBqV.exe
  2⤵
  PID:9264
- C:\Windows\System\MJsmQup.exe
  C:\Windows\System\MJsmQup.exe
  2⤵
  PID:9280
- C:\Windows\System\jjGlhQu.exe
  C:\Windows\System\jjGlhQu.exe
  2⤵
  PID:9296
- C:\Windows\System\tHPZALQ.exe
  C:\Windows\System\tHPZALQ.exe
  2⤵
  PID:9312
- C:\Windows\System\IyGYtDP.exe
  C:\Windows\System\IyGYtDP.exe
  2⤵
  PID:9400
- C:\Windows\System\KlnMXMu.exe
  C:\Windows\System\KlnMXMu.exe
  2⤵
  PID:9416
- C:\Windows\System\QjPPCWT.exe
  C:\Windows\System\QjPPCWT.exe
  2⤵
  PID:9432
- C:\Windows\System\xSZKNHm.exe
  C:\Windows\System\xSZKNHm.exe
  2⤵
  PID:9448
- C:\Windows\System\hDbCBAf.exe
  C:\Windows\System\hDbCBAf.exe
  2⤵
  PID:9464
- C:\Windows\System\GrsPRHM.exe
  C:\Windows\System\GrsPRHM.exe
  2⤵
  PID:9480
- C:\Windows\System\cBZhPOI.exe
  C:\Windows\System\cBZhPOI.exe
  2⤵
  PID:9496
- C:\Windows\System\yHyVGVc.exe
  C:\Windows\System\yHyVGVc.exe
  2⤵
  PID:9512
- C:\Windows\System\dDixbGX.exe
  C:\Windows\System\dDixbGX.exe
  2⤵
  PID:9528
- C:\Windows\System\EjdcqdK.exe
  C:\Windows\System\EjdcqdK.exe
  2⤵
  PID:9544
- C:\Windows\System\txElKci.exe
  C:\Windows\System\txElKci.exe
  2⤵
  PID:9560
- C:\Windows\System\qYtActh.exe
  C:\Windows\System\qYtActh.exe
  2⤵
  PID:9576
- C:\Windows\System\dhACkzu.exe
  C:\Windows\System\dhACkzu.exe
  2⤵
  PID:9592
- C:\Windows\System\ibmufYN.exe
  C:\Windows\System\ibmufYN.exe
  2⤵
  PID:9612
- C:\Windows\System\TDPWEhq.exe
  C:\Windows\System\TDPWEhq.exe
  2⤵
  PID:9628
- C:\Windows\System\hyhlrpP.exe
  C:\Windows\System\hyhlrpP.exe
  2⤵
  PID:9644
- C:\Windows\System\aksnDiG.exe
  C:\Windows\System\aksnDiG.exe
  2⤵
  PID:9660
- C:\Windows\System\TpYjnrE.exe
  C:\Windows\System\TpYjnrE.exe
  2⤵
  PID:9676
- C:\Windows\System\iZnpVSZ.exe
  C:\Windows\System\iZnpVSZ.exe
  2⤵
  PID:9692
- C:\Windows\System\AwxMvGx.exe
  C:\Windows\System\AwxMvGx.exe
  2⤵
  PID:9712
- C:\Windows\System\QiPFrzp.exe
  C:\Windows\System\QiPFrzp.exe
  2⤵
  PID:9728
- C:\Windows\System\jsSfvxa.exe
  C:\Windows\System\jsSfvxa.exe
  2⤵
  PID:9744
- C:\Windows\System\gWanKpD.exe
  C:\Windows\System\gWanKpD.exe
  2⤵
  PID:9760
- C:\Windows\System\DimLFSw.exe
  C:\Windows\System\DimLFSw.exe
  2⤵
  PID:9776
- C:\Windows\System\aaAkrdi.exe
  C:\Windows\System\aaAkrdi.exe
  2⤵
  PID:9792
- C:\Windows\System\EoNbDqv.exe
  C:\Windows\System\EoNbDqv.exe
  2⤵
  PID:9808
- C:\Windows\System\AbcjraN.exe
  C:\Windows\System\AbcjraN.exe
  2⤵
  PID:9824
- C:\Windows\System\zYjBSBz.exe
  C:\Windows\System\zYjBSBz.exe
  2⤵
  PID:9840
- C:\Windows\System\WrlvnRn.exe
  C:\Windows\System\WrlvnRn.exe
  2⤵
  PID:9856
- C:\Windows\System\SgmrLlI.exe
  C:\Windows\System\SgmrLlI.exe
  2⤵
  PID:9872
- C:\Windows\System\qPXPqMV.exe
  C:\Windows\System\qPXPqMV.exe
  2⤵
  PID:9888
- C:\Windows\System\nXcmdBT.exe
  C:\Windows\System\nXcmdBT.exe
  2⤵
  PID:9904
- C:\Windows\System\yKLDsqc.exe
  C:\Windows\System\yKLDsqc.exe
  2⤵
  PID:9924
- C:\Windows\System\kQyztLz.exe
  C:\Windows\System\kQyztLz.exe
  2⤵
  PID:9944
- C:\Windows\System\GyjqiVt.exe
  C:\Windows\System\GyjqiVt.exe
  2⤵
  PID:9960
- C:\Windows\System\MOmVIzz.exe
  C:\Windows\System\MOmVIzz.exe
  2⤵
  PID:9976
- C:\Windows\System\NgIIMPn.exe
  C:\Windows\System\NgIIMPn.exe
  2⤵
  PID:9992
- C:\Windows\System\VhNTkyV.exe
  C:\Windows\System\VhNTkyV.exe
  2⤵
  PID:10008
- C:\Windows\System\MoBjfTT.exe
  C:\Windows\System\MoBjfTT.exe
  2⤵
  PID:10024
- C:\Windows\System\aaylWoB.exe
  C:\Windows\System\aaylWoB.exe
  2⤵
  PID:10040
- C:\Windows\System\hDCzdaW.exe
  C:\Windows\System\hDCzdaW.exe
  2⤵
  PID:10056
- C:\Windows\System\oMCaCxj.exe
  C:\Windows\System\oMCaCxj.exe
  2⤵
  PID:10076
- C:\Windows\System\xliqKHM.exe
  C:\Windows\System\xliqKHM.exe
  2⤵
  PID:10092
- C:\Windows\System\NwYEsNT.exe
  C:\Windows\System\NwYEsNT.exe
  2⤵
  PID:10108
- C:\Windows\System\qwcBvMj.exe
  C:\Windows\System\qwcBvMj.exe
  2⤵
  PID:10124
- C:\Windows\System\UIbADop.exe
  C:\Windows\System\UIbADop.exe
  2⤵
  PID:10144
- C:\Windows\System\WaIYrvr.exe
  C:\Windows\System\WaIYrvr.exe
  2⤵
  PID:10160
- C:\Windows\System\FdbRvRw.exe
  C:\Windows\System\FdbRvRw.exe
  2⤵
  PID:10176
- C:\Windows\System\gfKZqII.exe
  C:\Windows\System\gfKZqII.exe
  2⤵
  PID:10196
- C:\Windows\System\AfkKHnF.exe
  C:\Windows\System\AfkKHnF.exe
  2⤵
  PID:10216
- C:\Windows\System\VABwfJU.exe
  C:\Windows\System\VABwfJU.exe
  2⤵
  PID:10232
- C:\Windows\System\EMLUISQ.exe
  C:\Windows\System\EMLUISQ.exe
  2⤵
  PID:9240
- C:\Windows\System\RWXqCIf.exe
  C:\Windows\System\RWXqCIf.exe
  2⤵
  PID:9304
- C:\Windows\System\rdlWHiv.exe
  C:\Windows\System\rdlWHiv.exe
  2⤵
  PID:9224
- C:\Windows\System\svxNpMM.exe
  C:\Windows\System\svxNpMM.exe
  2⤵
  PID:8932
- C:\Windows\System\fuIHvhW.exe
  C:\Windows\System\fuIHvhW.exe
  2⤵
  PID:9308
- C:\Windows\System\OhLYboz.exe
  C:\Windows\System\OhLYboz.exe
  2⤵
  PID:9332
- C:\Windows\System\USqEDTa.exe
  C:\Windows\System\USqEDTa.exe
  2⤵
  PID:9348
- C:\Windows\System\KfVfCfS.exe
  C:\Windows\System\KfVfCfS.exe
  2⤵
  PID:9368
- C:\Windows\System\MmHZgSF.exe
  C:\Windows\System\MmHZgSF.exe
  2⤵
  PID:9384
- C:\Windows\System\fCRzWNh.exe
  C:\Windows\System\fCRzWNh.exe
  2⤵
  PID:9444
- C:\Windows\System\wSpdHxI.exe
  C:\Windows\System\wSpdHxI.exe
  2⤵
  PID:9508
- C:\Windows\System\KuSaOpa.exe
  C:\Windows\System\KuSaOpa.exe
  2⤵
  PID:9540
- C:\Windows\System\IfOuOZQ.exe
  C:\Windows\System\IfOuOZQ.exe
  2⤵
  PID:9396
- C:\Windows\System\IoCOyxF.exe
  C:\Windows\System\IoCOyxF.exe
  2⤵
  PID:9428
- C:\Windows\System\iTakSHH.exe
  C:\Windows\System\iTakSHH.exe
  2⤵
  PID:9520
- C:\Windows\System\fGJhmpu.exe
  C:\Windows\System\fGJhmpu.exe
  2⤵
  PID:9620
- C:\Windows\System\nDvXUvP.exe
  C:\Windows\System\nDvXUvP.exe
  2⤵
  PID:9640
- C:\Windows\System\lmIoOxC.exe
  C:\Windows\System\lmIoOxC.exe
  2⤵
  PID:9656
- C:\Windows\System\YcwjeJw.exe
  C:\Windows\System\YcwjeJw.exe
  2⤵
  PID:9736
- C:\Windows\System\ESzWiup.exe
  C:\Windows\System\ESzWiup.exe
  2⤵
  PID:9724
- C:\Windows\System\VcBdHgZ.exe
  C:\Windows\System\VcBdHgZ.exe
  2⤵
  PID:9816
- C:\Windows\System\WtLAueM.exe
  C:\Windows\System\WtLAueM.exe
  2⤵
  PID:9756
- C:\Windows\System\vwspkNS.exe
  C:\Windows\System\vwspkNS.exe
  2⤵
  PID:9800
- C:\Windows\System\hAvpIfn.exe
  C:\Windows\System\hAvpIfn.exe
  2⤵
  PID:9868
- C:\Windows\System\thakwVC.exe
  C:\Windows\System\thakwVC.exe
  2⤵
  PID:9880
- C:\Windows\System\qCrBSty.exe
  C:\Windows\System\qCrBSty.exe
  2⤵
  PID:9920
- C:\Windows\System\RWaadMn.exe
  C:\Windows\System\RWaadMn.exe
  2⤵
  PID:9972
- C:\Windows\System\oGQhVTt.exe
  C:\Windows\System\oGQhVTt.exe
  2⤵
  PID:10036
- C:\Windows\System\PfLHlby.exe
  C:\Windows\System\PfLHlby.exe
  2⤵
  PID:10100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BPBGxUM.exe

Filesize
1.8MB

MD5
7b9a2c09b813941f307874feaa624b89

SHA1
1be803acba20bb9efe9330e6d13ab0ebe9a505c5

SHA256
c70cc7ba08d2618820f0b0027cee02081ae8bd57bd8ed18683b64d772edda7b0

SHA512
d2d9748e38394cfc097835635bd92702983b78dba471acf1ef48e4bb52c767d5943c96b3deb238c2dd7bcb7b1e50c303e818be28379bed5539a3feb7a91a64fc

Download Submit
C:\Windows\system\CUByPqm.exe

Filesize
1.9MB

MD5
ce00715d0afeb78332a377939e0101dc

SHA1
ae548412a62d6af17055bfef202799bf0d7bcc23

SHA256
a7b98fd34b1baf36795a2c7816d71965d174da7e8d6a1c73a5c54b1d73f1f55d

SHA512
7373e35f4d51349777119c942d37488b70934f3dd024ac23bb4f15b56dcf13d7a168587ea0ccd249397176f29a83e64e7baf2e4d220dcca13b8e5c977a74f4e4

Download Submit
C:\Windows\system\GnwZenB.exe

Filesize
1.9MB

MD5
79b395877c78488740d9e90a2e1aada7

SHA1
0e9920315fb81475a1639ebbf2e3f9b79e4b4795

SHA256
65181f9e6feb4c2c39d858778d7c4ba5b775f601793c45e474aad8f5fcc72df7

SHA512
c665549d9cb3a4828523afaa511e726945f0f54c4d114ef620fd5bed9f6c710fbb98012aa1cd52e33f588c5fa625f2796db923df3cc3bc464dc8d65feb7737a4

Download Submit
C:\Windows\system\HBGURZF.exe

Filesize
1.9MB

MD5
4fd1d2152fe81997622435a6368b37ad

SHA1
591aad280f49f211bb856610ca6ed3a259cdfa08

SHA256
95debbee984698dd9d54467b2c4ea2bdd1c07239e35c79eadfa630c24b7f182d

SHA512
0988a05c6d99cd61a82b6fe26e4c7d15a58dba417393fc18d6a249703f4b72c9e54325dc46651cac8c743d597c036b53301bf7e20202e3fdc3bc13535ecde04c

Download Submit
C:\Windows\system\HPUsSrN.exe

Filesize
1.9MB

MD5
15979f649e365f93b538b735c730be93

SHA1
887f20fadbd2b905a088dbd68f361ecf0f11927e

SHA256
af89f213e2e06079e33a1240e1937932bd5c359553a0bef5008106f504b31e6b

SHA512
dd64ca6e980dc781bae2856daaff095b55e3a63bb7717d059895648fcd543e3f975da3a1e947dc66b9a3b5618fc418e58acd9026d127be8f537e44311a8b469d

Download Submit
C:\Windows\system\HaKUHtn.exe

Filesize
1.9MB

MD5
66abe08875706699ddafbae8bc87c777

SHA1
2d9b315c192cd5cad482d3e7b07b3a2e28f0f032

SHA256
955029c77b5b43cb8f8d8bd21676abc65cd47a55939026979686ab13a13d86a4

SHA512
2105b54d8cf0cf27d36b4c0a0db3ea783dc736d214982915bf0af2be3acc883ea078420c02ed8f5e4a3932ed3679a5a0aee151b69535b65407af0e088a0b9e08

Download Submit
C:\Windows\system\PsOwiQY.exe

Filesize
1.9MB

MD5
07f17df67ade352eea1c1653dbccfb01

SHA1
03f37a2dc88e627c2445df93b6736b292860c980

SHA256
2f515cca325bf8f0f6051fc8a6b4b0c7abcc02eab02db9cf1dc2f7c65d39a419

SHA512
c339020422b62668be21107dc51094de50e6e85260948b2aacf38c49eabd9d1884edfc7a7fd4df464b752f1f5cfa230642fcccf707fe9cebd43ed4055f096d05

Download Submit
C:\Windows\system\SzILStC.exe

Filesize
1.9MB

MD5
ad3b44ae923eb3a16d07541d8d7392ea

SHA1
25aedf4e3ce478c6848384c33d715e0620f26017

SHA256
6fae9b9874e7e28c78c99e251d832df9d5ca32de309fc66d790f35965b66f3be

SHA512
2b82779a778fb751ede4438fe21f27a4d67c7b272bc6440f0ea4f14f3e2f9f8c90c8a60dbeaf34857967ce43f1610f750c43fa00c7b90569ba0f4930529fa210

Download Submit
C:\Windows\system\VLdeluE.exe

Filesize
1.9MB

MD5
d62ef7c281b7031a4a088e8fab8b6d36

SHA1
1451eb7dca49677448444c493ddbf29f91b37263

SHA256
85b7c946494f0f9968f88ea12950769cd5f4b12e3ad6bbf5f6d589c846a3c0ff

SHA512
0c50bd9dc5ced617ae1b1270dfa07264928daa723d98c730d844b10a3e2e32951025a9edecd4f2a2c8857a701427323c7885ab3af58327bbeb061ebd70530172

Download Submit
C:\Windows\system\VSKnOIl.exe

Filesize
1.9MB

MD5
003270310fce4a2a224e9cadc7e2a55f

SHA1
adc1b7515ed896c7124c0e6f57ae8e7793488b80

SHA256
97db13cf0b7fc2b7f364ad5e40da0f7a81caacacab5180cf89f6d095a7a65c56

SHA512
51eed51e2a0d0a0635d5f8b75f48d9e80b8313d5be2043057285a006e5f93767c9a2fd2b88f96c5257a5ccc923a8a942d70cca58720389330257308c59877ba2

Download Submit
C:\Windows\system\WcKRbKD.exe

Filesize
1.9MB

MD5
d53f3bdb5187b0e25b3a7279fd981c7f

SHA1
822dd6d343483b339521fa52d2d2462b5a5bf7e6

SHA256
945a4e4969f9ef1d7472f30d3adfcb7f7df3e21b1b09bf7f71f060ebc722880b

SHA512
f32485d0f7e026e75cb131d498d36edef93581b8159cc0302ba24b3402275419275e1955598c3e3ddb93e0129c6f6c318b85a8e4d4d326bce1906d133cae20fe

Download Submit
C:\Windows\system\bTIBtkU.exe

Filesize
1.9MB

MD5
f5064a3faacd50b698d5489bc9d3f340

SHA1
5c78ef3b31737e2d4502b08366b1e66b1196517f

SHA256
5d1449bd677ccd14520da7fcf14e34251c334d3a896bbfe7c5c854d23eb3627b

SHA512
ef4bf444657fa98648386b24b0c23ee9bfc45821577ba1591004dc0473755e5c2d6ca83914494554a26dce48ed8b60648a128fc27e347072c77fd1a610c58521

Download Submit
C:\Windows\system\byenFOL.exe

Filesize
1.9MB

MD5
0bf2fe6f74678ae5d5c302367848ce57

SHA1
098e05187b85b91a652c19aaa59923aaa7660328

SHA256
99d2b467d10d023e5a82ebb81b02dcfaa0044449247193e6b39fd8a08cb494b1

SHA512
0d52631ab99981cc6e6d5f5e835555bafab47bb7ac2fa5883a0ae552c4eda368dad20a05c26461549f9d95f85c7bc1d3a4ad7f657162648733fd78b58c3a02d0

Download Submit
C:\Windows\system\cteVeoP.exe

Filesize
1.9MB

MD5
9e938060557c5be1ef96622bf7e5f4cb

SHA1
665227fcb633474e57951f656a07543651a7fa2b

SHA256
0965b988e8139cb69f01f07e6eb31edcebe4881bc50859c6ad7b49f0b06d605d

SHA512
da4e196e316e268622d59af4d7253b58388e53fd4afb0156374a4107eb09467672a7baa295057012607e74acc93f645a961758319295ba90538e6aa97c0f7d88

Download Submit
C:\Windows\system\dPMutMg.exe

Filesize
1.9MB

MD5
a13c0350dd8592d34593b645bb5b6364

SHA1
0580faa0164aeec388ace2ef93377848a21773fd

SHA256
19c9ce6b69fc00743ab6588115fb9e7aed7597bfef2ae0d880b48a9aea204654

SHA512
e821c4c6431d8adbfcab54a19564e676dc46d0728f803e8712c59e2dc680273ab8669222fcf879cd2dfe1e3d66ba9880d668c74ac5a5b3117c34bc5740bb007f

Download Submit
C:\Windows\system\eoDNTXk.exe

Filesize
1.9MB

MD5
2e839444bfed44136b4f944d3f3f0db2

SHA1
126c59eb01d7e40f1d55fdefe49b0f456c236e2b

SHA256
f8164708e7ab356fc31170265a0f34767dab8fbaf8ed86be69a941181fb8741e

SHA512
4401af9856200fafa4f2d680ecf302209753cf036dc4ef878de16f60561222ac6acf35cb669c2f30344f16c270ba1c667b7b04190530f33510b4005ea06084c1

Download Submit
C:\Windows\system\fCdZQiD.exe

Filesize
8B

MD5
7e1e9fcc71af27d4f3a70b3e20ac77b9

SHA1
09ec64762a6dbe9e03ecdb61ea5de2d274d170f0

SHA256
2f18658787aeca4d305f9fde7c9bc7343e5969bd51ec0e2c8583a2e506b9b404

SHA512
3beada4b1cd8ead153972e6e1293d504f7cea2d7323223a87897681d13a0872baba6942b9d88c8943892c0ad02e1f51ed3730edd702cc7d53ab31d006770ca91

Download Submit
C:\Windows\system\jyjlDEJ.exe

Filesize
1.9MB

MD5
e03acb9d8b5d48c6773ca03620167544

SHA1
5ef389af20b0da2697f3096135b9cb4489f25bcd

SHA256
538e65823fcf88ad1efff90909e13104fef6df11d47014237f300e5d1602d1a4

SHA512
e64f481c5a9b73ae3858fc9e43365aaef0514bcf0af38f2039ec9aa9bb2c09ba324aacfb7a7a30652852a81e6cb9c7fdad0df24be5970943bcf9a013508ab9e0

Download Submit
C:\Windows\system\kbZjphn.exe

Filesize
1.9MB

MD5
589baf48fb1b328e244bc4e669725908

SHA1
f65e06e933f4e8200e7b22f4ba5da583dd33b8c4

SHA256
33d5af4d0d211f011ecc8ecd7f71b53f5f16d381bb23605cfe55f638c5f13ea0

SHA512
2c54bf71f9b8f6df2f36e98e4433469651dea2f1fe669b72120acc4c70e00c4232f30aad8ea8174ad12f42db465efaab10ff4be5540547de4ff8dec58b33cf91

Download Submit
C:\Windows\system\lYisUVS.exe

Filesize
1.9MB

MD5
5005d1c30d7a819e5d83a1885775307d

SHA1
1c6ae6ba1a5e5597bf4fd03d0077b036bedc7d72

SHA256
7eace0b5870bd9f5d713a11aaec1c6585f8ba00ddfa915cfb905120f0a782074

SHA512
488044ac0e02eb419977632a591df4d80d17ec7afeb761d5822a7ad1bbd48effccd0d1f516c585e209bbe0f50b57b31db1b48bfaa7e94381532c7e64525d6633

Download Submit
C:\Windows\system\mmljyGy.exe

Filesize
1.9MB

MD5
5a0410907b473abebcbe2c7cb6cd7ad9

SHA1
6ca31ed8265a26a68ac1f80759f82ba30c8b9498

SHA256
c93b6a49fdcfa02980b2e8d1ca80e20280efa50c6d9b2bcc5b9dd3b057ca83f5

SHA512
b8b6e7209275b2ceb1e7a72c8e026d609b6d314dee27b703b624d7a38e04c3cc16c4e77ef148868e05d5ccc6ea5e2d7b9fc4e5af200382acf50eb56e3779a6bc

Download Submit
C:\Windows\system\nEeTdEa.exe

Filesize
1.8MB

MD5
00e0a4dccca66d9eabdea9effd3ba76e

SHA1
67e4e943657c69b5e104e97f19959791af30f2a0

SHA256
f21fecb001e6500c2a9eac3a394ae38b7b0acc0512f3343e594318ad42386202

SHA512
da5c67f5846bc9e086585af9b3edef328872d79637c8fe547c58837a7d5ca9069916bb666bbfef82a7c4a05a9819c1f676a02b5bdc0fa77ffcfc705b08b8c478

Download Submit
C:\Windows\system\odSCsIW.exe

Filesize
1.9MB

MD5
91ee4bbaf3d3eb2e974ff81ac1d7bf2e

SHA1
2c6a8a5f721a403de0b48ff1f87368e0a19baa49

SHA256
5c6bf2aa641844928ff59bc97d9fd0c5ac70013319f2bdb51acb62fe3c9ba4ca

SHA512
864c255dcf4dd9723843c039b5be90f8c01ed664da854b440d13c97293177ae3c271bce1efb717e54535ec18a92ea23e55a3b4c68ef11be8419002d8c4a901e8

Download Submit
C:\Windows\system\qyLyNyy.exe

Filesize
1.9MB

MD5
d8d4787eaeddfd4b6061171dd1ec3823

SHA1
af8d420da0da6a8c0eb5dae0ad6d125acab2cf69

SHA256
4ad62cc4f73552348c754e27bcafd07537b35639e5cb6de257d5d69cc5ae309f

SHA512
3abee26bc30cedcd280d1140ac3cfb4961eb19564270e4cc4e879bb873e92fd62e66e644c8bb6ef4c86415c29f66ceac0c51b0430a8dc66618be58898112d925

Download Submit
C:\Windows\system\tUSkRlF.exe

Filesize
1.9MB

MD5
52cfd83ac6e51151f8317c1b0ac2b972

SHA1
dd5a0d74a4f6138bde6add2f83b52d73045965c1

SHA256
2c87f208d4a0072a32a3d17615e6b2edec1ac8f15c140df7b05b0386bafedcb0

SHA512
d28ab900f3555c0bb0190f0c722df177045cd7135a04e359cf808bc31ac645061c49c4970f4e5c30c621c2555beb66a4eb669942fc76eba7d4b3bda2b6c3bee9

Download Submit
C:\Windows\system\vjmgqgr.exe

Filesize
1.9MB

MD5
bd406d59358d51c62507e2e00543317d

SHA1
cab353d8db33a60e5d6e4a542e571d26a1ece4a5

SHA256
5899c2eddd5983092e20ba557992cfc152db80716db24fa7d1708664a1cc27a1

SHA512
af7d01a6f0d8b096123e589ee9422749c63e782ba86d8e501f911e7c9bd88c2c067998ce1c03a65a94e74479378be83434de4e38bb568082b25db53fe8911922

Download Submit
C:\Windows\system\vtuRmUq.exe

Filesize
1.9MB

MD5
f1b03821f4f9c7edbd2c8eeb60fd33b3

SHA1
2860cb05579a3b8eec82d6e296906093d0cd57d8

SHA256
7773f563c92cceb6a3bc9b5c2fcffc7b63b04364bd14860d42483eb4545dc11b

SHA512
80dfb112513dc067db3cb1212dd926bdbde1b0837006013f778bf29822be14f156956ce8efbcae28e51de207fb60efc1123d9815b3ab42d004ce02cab8492973

Download Submit
C:\Windows\system\wDuQFUN.exe

Filesize
1.9MB

MD5
edbdd8cb4d237c290024d534656ad4c1

SHA1
9c9ee0d318aa93d73c1e86d2a22e81020bb31998

SHA256
337ffccaaf7061cf577a4c2e498cf1dae75c2c8a08637f288291bec79aac2d5d

SHA512
ee600e0443b187ebfa4c77dc5e8dc6b2e95b80feb11ee5a1c83794a7a7a73b12622707ec34f80c81c3a37483cc48edcd682a65fc14fcae37d84e0845ef5678a4

Download Submit
C:\Windows\system\wRluimr.exe

Filesize
1.9MB

MD5
e4d994b34134d2789e5d6eb826041032

SHA1
40a4f3ddaa42f6ce7c17a4e1b23b156c755f0a89

SHA256
01bf93c12791e20db3ee20c0524656eb6b008b63e6642573b10e744a621a9d8b

SHA512
0e3c6735950f8ab990aa937126e1563a14821567f1b70d00485f9cfd0c892efddf6f0e33e99f6908384f2d013d58fc9a654f2f2d8f650bea3471c6350e5f3edc

Download Submit
C:\Windows\system\znCbCwu.exe

Filesize
1.9MB

MD5
884ab2942668ccf9e57ae2753c541976

SHA1
95c9ce08b32c57002559f4664b4faf823871c187

SHA256
9b6c22375d11c536645ec6be187ff2b1935326dc0f917acff7a60235e6fdaf12

SHA512
04fc7eda0db8b95d1bcceff58bb07d98af1b34d4d750aa8d960ff2eb8faa763b3625af90070c3e9f11316de736bdf87f89529880a77f9fa296c30a9f6a4bb88a

Download Submit
\Windows\system\CQaFPoB.exe

Filesize
1.9MB

MD5
a4db70110d6df91829e643d4bce4f15f

SHA1
c915edd1b870659bf8b05782982283b5d1e70407

SHA256
2e598ee8b89f6895bd4f05072ed025f51e9979de75463e1813a93a017a3c8f6a

SHA512
c8d972ad470f342c4985cc3b1a6fc38439d585ed9596b59003c4c2e277a54b5e53c6e1f9b03608acc659e197406515e724d081ec44645b9d90fac50ad7b2f3fc

Download Submit
\Windows\system\PEYvfUo.exe

Filesize
1.9MB

MD5
326beb0f1046ac634e51d500e9cb22be

SHA1
872782007cc207eaf10d6d26b502d31c8a26b50f

SHA256
cb5639f738fe253360eb344c4ded0e037a0df97ba280d474d5ac98603c2087c6

SHA512
6807a0ea825e6746c6d6e0c706bbf3f6ccb1235afb6865de2fedeae5a2b3da5cae1963e49d2403dc6812d07cb8627b9ebc22682db781c0bc3c05f9916f4cc8f6

Download Submit
\Windows\system\eJMsBdJ.exe

Filesize
1.9MB

MD5
8f77465844b54eafcdbadf572f24a161

SHA1
e17c9476fa2eb4cfdba55ee3d333fced62658b90

SHA256
210d1db0cb2bc8c74a306fa4c1bb8d991cac71af2276ff2dc1eac8859fead9b2

SHA512
464b23b2d5f66660c60d4b6ed624902e62dcd9177c947b7315caa65ff3f0238298f7385e9fcded004cea77a6f45d439a9fd438c0344ab0b58b9beaae326c4785

Download Submit
memory/1584-25-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-73-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/1728-0-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-12979-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/1728-11372-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-84-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/1728-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1728-51-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-41-0x0000000002FC0000-0x00000000033B2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-75-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/1728-55-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-65-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/1728-90-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/1728-70-0x0000000002FC0000-0x00000000033B2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-7-0x0000000002FC0000-0x00000000033B2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-67-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/1728-61-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-56-0x0000000002DC0000-0x0000000002E40000-memory.dmp

Filesize
512KB

Download
memory/2240-62-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2240-64-0x0000000001E50000-0x0000000001E58000-memory.dmp

Filesize
32KB

Download
memory/2488-4708-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2488-79-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2516-4701-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2516-77-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2548-68-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2548-4702-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2620-33-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2620-4698-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2624-72-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-4697-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-78-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2628-4706-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2696-4747-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-53-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-4699-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2712-48-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2760-4703-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-76-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-4734-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2860-91-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2872-4707-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-85-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download