xmrig | 0e15cc165d75a0ca71041a094bf10c0546981a5057910ed9a970a9b742533c26

Analysis

max time kernel
150s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
Size

1.4MB
MD5

17e586afd2375bcb595009e9d9865d43
SHA1

29560ac5b7d9a172216c9ef31ac8e8d2772f63d3
SHA256

0e15cc165d75a0ca71041a094bf10c0546981a5057910ed9a970a9b742533c26
SHA512

5ca802a8351f622794519db4d1cbcfd78d2f36c42118cf6d0c743bdc8dc12f8419b2ecf13f582227011731f916ab144241e329bf23d08e08b0e3ce64b740493b
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwj62:Lz071uv4BPMkibTIA5CJw

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

resource	yara_rule
behavioral1/memory/2440-9-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/2632-41-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2532-46-0x000000013F590000-0x000000013F982000-memory.dmp	xmrig
behavioral1/memory/2952-73-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2172-107-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/1464-106-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/1384-104-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2220-102-0x00000000033C0000-0x00000000037B2000-memory.dmp	xmrig
behavioral1/memory/2220-77-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/828-53-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2724-44-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/2628-837-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/2952-6116-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/1652-6260-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2172-6276-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3036	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2440	MlpwAjf.exe
2628	uMLDTcs.exe
2632	oUPcjcK.exe
2724	AImMczA.exe
2532	sMAQEgj.exe
828	XPjczYn.exe
2276	whdJXEZ.exe
1652	CRyBVAE.exe
2952	HTCfnyu.exe
2172	wevuwGZ.exe
1384	fdbMiJR.exe
1464	zzUjdEg.exe
2748	IbDuqyC.exe
1980	xmymloK.exe
2792	UnijxEo.exe
1700	kjTzqey.exe
1556	ntRWqKD.exe
1292	cEbbIat.exe
1316	COcZkBc.exe
1456	sEinPHu.exe
2912	rJpsbdd.exe
3052	eOZhFnp.exe
2024	vVZrPin.exe
384	NKFDtsu.exe
1172	ykkWFxy.exe
1768	orxftSp.exe
1680	ynlTIIe.exe
880	cJhzfUr.exe
448	TbTRYNC.exe
2164	MdJyhyR.exe
788	zrAuZri.exe
2356	ysOdUib.exe
1040	UICyUrF.exe
844	DUSuEUQ.exe
1536	TDMjzQf.exe
1708	UCbrreh.exe
2080	btaCfKQ.exe
1340	cHgKEzy.exe
1052	DVGyShg.exe
3000	UVcXCLq.exe
380	OYrkeCv.exe
2148	ZWNjnLI.exe
112	JdiJpDP.exe
2396	NurWIwb.exe
2376	PXMGtsf.exe
500	xwDqIBv.exe
2916	QRUTsZu.exe
1004	gxYcaem.exe
2312	GsyboSk.exe
2184	AXOvhoU.exe
1744	FVbNbCv.exe
1628	kvebMiz.exe
1752	gXgptxi.exe
2600	fnIHlnk.exe
2624	QeTtKeD.exe
2636	IONrvgP.exe
2612	kZKGKEj.exe
2472	fvjcrCv.exe
2584	SBEMuJt.exe
2528	CRQZanv.exe
2852	vARLUwe.exe
2508	MfQEkzN.exe
1424	FKkfdjF.exe
1716	bWSDdjn.exe

Loads dropped DLL 64 IoCs

pid	Process
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000f000000012334-3.dat	upx
behavioral1/memory/2220-2-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2440-9-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/files/0x0039000000012340-14.dat	upx
behavioral1/files/0x000e0000000054ab-21.dat	upx
behavioral1/memory/2628-19-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/files/0x000a00000001234a-31.dat	upx
behavioral1/files/0x000900000001234b-35.dat	upx
behavioral1/memory/2632-41-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/files/0x000900000001234c-47.dat	upx
behavioral1/memory/2532-46-0x000000013F590000-0x000000013F982000-memory.dmp	upx
behavioral1/files/0x000b000000012350-57.dat	upx
behavioral1/memory/2276-59-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/files/0x0007000000012721-69.dat	upx
behavioral1/memory/2952-73-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/files/0x0007000000012747-78.dat	upx
behavioral1/files/0x0039000000012342-82.dat	upx
behavioral1/files/0x022c000000012f11-86.dat	upx
behavioral1/files/0x0007000000013187-108.dat	upx
behavioral1/memory/2172-107-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/1464-106-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/1384-104-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/files/0x000700000001313f-97.dat	upx
behavioral1/files/0x000700000001310b-91.dat	upx
behavioral1/memory/2220-77-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/files/0x000700000001332e-119.dat	upx
behavioral1/files/0x000700000001340b-121.dat	upx
behavioral1/files/0x0007000000013413-128.dat	upx
behavioral1/files/0x0007000000013a6e-165.dat	upx
behavioral1/files/0x0007000000013acb-174.dat	upx
behavioral1/files/0x0006000000014175-181.dat	upx
behavioral1/files/0x0006000000014207-186.dat	upx
behavioral1/files/0x0006000000014246-194.dat	upx
behavioral1/files/0x000700000001342c-140.dat	upx
behavioral1/files/0x0006000000014228-191.dat	upx
behavioral1/files/0x0006000000014186-183.dat	upx
behavioral1/files/0x000600000001415f-175.dat	upx
behavioral1/files/0x0007000000013a06-170.dat	upx
behavioral1/files/0x0007000000013a84-167.dat	upx
behavioral1/files/0x0007000000013a46-157.dat	upx
behavioral1/files/0x0007000000013a3a-155.dat	upx
behavioral1/files/0x0007000000013564-154.dat	upx
behavioral1/files/0x000700000001341c-134.dat	upx
behavioral1/files/0x0007000000013420-138.dat	upx
behavioral1/files/0x000700000001322b-114.dat	upx
behavioral1/memory/1652-66-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/files/0x0008000000012700-65.dat	upx
behavioral1/memory/828-53-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/2724-44-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/2628-837-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2952-6116-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/1652-6260-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/2172-6276-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2220-9362-0x000000013F540000-0x000000013F932000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LoowvKc.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\GlkApIz.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\ieSIsKp.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\DFopdgS.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\qdFtWmy.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\xGNVWXa.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\uqCFhWs.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\YZysxpj.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\nERqgMA.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\ADBcMXV.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\MlpwAjf.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\aFBkEJs.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\uyzQGJg.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\xOIzbnM.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\wetkjsb.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\ENMNgpY.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\OoUKUUd.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\mGvBieZ.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\kpPQtwJ.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\SoZAhCn.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\yrmdUru.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\ZIsHpAO.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\pOofoGx.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\XxVIfkZ.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\bxmGvpi.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\cKdwBcf.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\rTPfVfh.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\dJbnzwl.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\xADDlDX.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\ecWIuVF.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\zLiWJwB.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\SGhWUZg.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\LWAPLrE.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\OoePAVf.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\ohSJxTk.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\LtrrIsC.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\FMFwCqM.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\IYbgvPZ.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\BNyrgaM.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\MRkUdox.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\jAXABuu.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\gNSrMjC.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\MYvQlKT.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\aCOFEjM.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\QXApySh.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\eZctZLW.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\TDAvqqk.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\uNNhDip.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\MhhuDrA.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\WacfAvl.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\KqJIFjd.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\tTsfcxW.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\JdTiWyN.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\UZwvFhW.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\lXRtuar.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\ERxPOMu.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\PTSzcSM.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\iOyxfZR.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\qhjMNVS.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\SlpNuBz.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\sdhckzy.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\UErPcqN.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\mHDsnRX.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
File created	C:\Windows\System\WGTnGtn.exe	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3036	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
Token: SeDebugPrivilege	3036	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 3036	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	29
PID 2220 wrote to memory of 3036	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	29
PID 2220 wrote to memory of 3036	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	29
PID 2220 wrote to memory of 2440	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2440	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2440	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2628	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2628	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2628	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2632	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	32
PID 2220 wrote to memory of 2632	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	32
PID 2220 wrote to memory of 2632	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	32
PID 2220 wrote to memory of 2724	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	33
PID 2220 wrote to memory of 2724	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	33
PID 2220 wrote to memory of 2724	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	33
PID 2220 wrote to memory of 2532	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	34
PID 2220 wrote to memory of 2532	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	34
PID 2220 wrote to memory of 2532	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	34
PID 2220 wrote to memory of 828	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	35
PID 2220 wrote to memory of 828	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	35
PID 2220 wrote to memory of 828	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	35
PID 2220 wrote to memory of 2276	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	36
PID 2220 wrote to memory of 2276	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	36
PID 2220 wrote to memory of 2276	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	36
PID 2220 wrote to memory of 1652	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	37
PID 2220 wrote to memory of 1652	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	37
PID 2220 wrote to memory of 1652	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	37
PID 2220 wrote to memory of 2952	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	38
PID 2220 wrote to memory of 2952	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	38
PID 2220 wrote to memory of 2952	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	38
PID 2220 wrote to memory of 2172	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	39
PID 2220 wrote to memory of 2172	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	39
PID 2220 wrote to memory of 2172	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	39
PID 2220 wrote to memory of 1384	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	40
PID 2220 wrote to memory of 1384	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	40
PID 2220 wrote to memory of 1384	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	40
PID 2220 wrote to memory of 1464	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	41
PID 2220 wrote to memory of 1464	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	41
PID 2220 wrote to memory of 1464	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	41
PID 2220 wrote to memory of 2748	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	42
PID 2220 wrote to memory of 2748	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	42
PID 2220 wrote to memory of 2748	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	42
PID 2220 wrote to memory of 1980	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	43
PID 2220 wrote to memory of 1980	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	43
PID 2220 wrote to memory of 1980	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	43
PID 2220 wrote to memory of 2792	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	44
PID 2220 wrote to memory of 2792	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	44
PID 2220 wrote to memory of 2792	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	44
PID 2220 wrote to memory of 1700	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	45
PID 2220 wrote to memory of 1700	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	45
PID 2220 wrote to memory of 1700	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	45
PID 2220 wrote to memory of 1556	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	46
PID 2220 wrote to memory of 1556	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	46
PID 2220 wrote to memory of 1556	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	46
PID 2220 wrote to memory of 1292	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	47
PID 2220 wrote to memory of 1292	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	47
PID 2220 wrote to memory of 1292	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	47
PID 2220 wrote to memory of 1316	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	48
PID 2220 wrote to memory of 1316	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	48
PID 2220 wrote to memory of 1316	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	48
PID 2220 wrote to memory of 1456	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	49
PID 2220 wrote to memory of 1456	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	49
PID 2220 wrote to memory of 1456	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	49
PID 2220 wrote to memory of 2912	2220	17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17e586afd2375bcb595009e9d9865d43_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\System\MlpwAjf.exe
  C:\Windows\System\MlpwAjf.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\uMLDTcs.exe
  C:\Windows\System\uMLDTcs.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\oUPcjcK.exe
  C:\Windows\System\oUPcjcK.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\AImMczA.exe
  C:\Windows\System\AImMczA.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\sMAQEgj.exe
  C:\Windows\System\sMAQEgj.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\XPjczYn.exe
  C:\Windows\System\XPjczYn.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\whdJXEZ.exe
  C:\Windows\System\whdJXEZ.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\CRyBVAE.exe
  C:\Windows\System\CRyBVAE.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\HTCfnyu.exe
  C:\Windows\System\HTCfnyu.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\wevuwGZ.exe
  C:\Windows\System\wevuwGZ.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\fdbMiJR.exe
  C:\Windows\System\fdbMiJR.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\zzUjdEg.exe
  C:\Windows\System\zzUjdEg.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\IbDuqyC.exe
  C:\Windows\System\IbDuqyC.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\xmymloK.exe
  C:\Windows\System\xmymloK.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\UnijxEo.exe
  C:\Windows\System\UnijxEo.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\kjTzqey.exe
  C:\Windows\System\kjTzqey.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\ntRWqKD.exe
  C:\Windows\System\ntRWqKD.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\cEbbIat.exe
  C:\Windows\System\cEbbIat.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\COcZkBc.exe
  C:\Windows\System\COcZkBc.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\sEinPHu.exe
  C:\Windows\System\sEinPHu.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\rJpsbdd.exe
  C:\Windows\System\rJpsbdd.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\eOZhFnp.exe
  C:\Windows\System\eOZhFnp.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\vVZrPin.exe
  C:\Windows\System\vVZrPin.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\orxftSp.exe
  C:\Windows\System\orxftSp.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\NKFDtsu.exe
  C:\Windows\System\NKFDtsu.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\zrAuZri.exe
  C:\Windows\System\zrAuZri.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\ykkWFxy.exe
  C:\Windows\System\ykkWFxy.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\UICyUrF.exe
  C:\Windows\System\UICyUrF.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\ynlTIIe.exe
  C:\Windows\System\ynlTIIe.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\DUSuEUQ.exe
  C:\Windows\System\DUSuEUQ.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\cJhzfUr.exe
  C:\Windows\System\cJhzfUr.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\TDMjzQf.exe
  C:\Windows\System\TDMjzQf.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\TbTRYNC.exe
  C:\Windows\System\TbTRYNC.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\UCbrreh.exe
  C:\Windows\System\UCbrreh.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\MdJyhyR.exe
  C:\Windows\System\MdJyhyR.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\btaCfKQ.exe
  C:\Windows\System\btaCfKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\ysOdUib.exe
  C:\Windows\System\ysOdUib.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\cHgKEzy.exe
  C:\Windows\System\cHgKEzy.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\DVGyShg.exe
  C:\Windows\System\DVGyShg.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\UVcXCLq.exe
  C:\Windows\System\UVcXCLq.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\OYrkeCv.exe
  C:\Windows\System\OYrkeCv.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\JdiJpDP.exe
  C:\Windows\System\JdiJpDP.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\ZWNjnLI.exe
  C:\Windows\System\ZWNjnLI.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\NurWIwb.exe
  C:\Windows\System\NurWIwb.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\PXMGtsf.exe
  C:\Windows\System\PXMGtsf.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\QRUTsZu.exe
  C:\Windows\System\QRUTsZu.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\xwDqIBv.exe
  C:\Windows\System\xwDqIBv.exe
  2⤵
  - Executes dropped EXE
  PID:500
- C:\Windows\System\gxYcaem.exe
  C:\Windows\System\gxYcaem.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\GsyboSk.exe
  C:\Windows\System\GsyboSk.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\AXOvhoU.exe
  C:\Windows\System\AXOvhoU.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\FVbNbCv.exe
  C:\Windows\System\FVbNbCv.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\kvebMiz.exe
  C:\Windows\System\kvebMiz.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\gXgptxi.exe
  C:\Windows\System\gXgptxi.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\fnIHlnk.exe
  C:\Windows\System\fnIHlnk.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\QeTtKeD.exe
  C:\Windows\System\QeTtKeD.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\kZKGKEj.exe
  C:\Windows\System\kZKGKEj.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\IONrvgP.exe
  C:\Windows\System\IONrvgP.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\fvjcrCv.exe
  C:\Windows\System\fvjcrCv.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\SBEMuJt.exe
  C:\Windows\System\SBEMuJt.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\CRQZanv.exe
  C:\Windows\System\CRQZanv.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\vARLUwe.exe
  C:\Windows\System\vARLUwe.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\MfQEkzN.exe
  C:\Windows\System\MfQEkzN.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\FKkfdjF.exe
  C:\Windows\System\FKkfdjF.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\bWSDdjn.exe
  C:\Windows\System\bWSDdjn.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\Knflasz.exe
  C:\Windows\System\Knflasz.exe
  2⤵
  PID:1972
- C:\Windows\System\nIbnNwB.exe
  C:\Windows\System\nIbnNwB.exe
  2⤵
  PID:2752
- C:\Windows\System\RlOxdyz.exe
  C:\Windows\System\RlOxdyz.exe
  2⤵
  PID:2968
- C:\Windows\System\jEtbWGc.exe
  C:\Windows\System\jEtbWGc.exe
  2⤵
  PID:2360
- C:\Windows\System\MZyuVFp.exe
  C:\Windows\System\MZyuVFp.exe
  2⤵
  PID:2732
- C:\Windows\System\apzKLOh.exe
  C:\Windows\System\apzKLOh.exe
  2⤵
  PID:2684
- C:\Windows\System\JBzUwrL.exe
  C:\Windows\System\JBzUwrL.exe
  2⤵
  PID:2256
- C:\Windows\System\tcCBSHm.exe
  C:\Windows\System\tcCBSHm.exe
  2⤵
  PID:2136
- C:\Windows\System\CljVsPw.exe
  C:\Windows\System\CljVsPw.exe
  2⤵
  PID:2904
- C:\Windows\System\dVpDlIs.exe
  C:\Windows\System\dVpDlIs.exe
  2⤵
  PID:2828
- C:\Windows\System\qWDNQIa.exe
  C:\Windows\System\qWDNQIa.exe
  2⤵
  PID:1176
- C:\Windows\System\ZemeUko.exe
  C:\Windows\System\ZemeUko.exe
  2⤵
  PID:1356
- C:\Windows\System\cDMrZwf.exe
  C:\Windows\System\cDMrZwf.exe
  2⤵
  PID:1904
- C:\Windows\System\hGEMIWy.exe
  C:\Windows\System\hGEMIWy.exe
  2⤵
  PID:1152
- C:\Windows\System\pVQZrVz.exe
  C:\Windows\System\pVQZrVz.exe
  2⤵
  PID:1224
- C:\Windows\System\CMdyVDu.exe
  C:\Windows\System\CMdyVDu.exe
  2⤵
  PID:1584
- C:\Windows\System\HDOdNJm.exe
  C:\Windows\System\HDOdNJm.exe
  2⤵
  PID:3048
- C:\Windows\System\ftiBeLp.exe
  C:\Windows\System\ftiBeLp.exe
  2⤵
  PID:1784
- C:\Windows\System\HGZvPRf.exe
  C:\Windows\System\HGZvPRf.exe
  2⤵
  PID:576
- C:\Windows\System\CRmLVOk.exe
  C:\Windows\System\CRmLVOk.exe
  2⤵
  PID:1908
- C:\Windows\System\kXmflRz.exe
  C:\Windows\System\kXmflRz.exe
  2⤵
  PID:2288
- C:\Windows\System\LzwKQvL.exe
  C:\Windows\System\LzwKQvL.exe
  2⤵
  PID:1412
- C:\Windows\System\rRjanYe.exe
  C:\Windows\System\rRjanYe.exe
  2⤵
  PID:1008
- C:\Windows\System\VYcRRRX.exe
  C:\Windows\System\VYcRRRX.exe
  2⤵
  PID:3020
- C:\Windows\System\HsqhBAt.exe
  C:\Windows\System\HsqhBAt.exe
  2⤵
  PID:1000
- C:\Windows\System\DqvRFem.exe
  C:\Windows\System\DqvRFem.exe
  2⤵
  PID:1036
- C:\Windows\System\DXQzmxw.exe
  C:\Windows\System\DXQzmxw.exe
  2⤵
  PID:2224
- C:\Windows\System\lqYeKxp.exe
  C:\Windows\System\lqYeKxp.exe
  2⤵
  PID:2944
- C:\Windows\System\AZSGLej.exe
  C:\Windows\System\AZSGLej.exe
  2⤵
  PID:1352
- C:\Windows\System\JUsEnBo.exe
  C:\Windows\System\JUsEnBo.exe
  2⤵
  PID:1604
- C:\Windows\System\aViRHzx.exe
  C:\Windows\System\aViRHzx.exe
  2⤵
  PID:2672
- C:\Windows\System\WFUGgxK.exe
  C:\Windows\System\WFUGgxK.exe
  2⤵
  PID:2896
- C:\Windows\System\iGKykbf.exe
  C:\Windows\System\iGKykbf.exe
  2⤵
  PID:2772
- C:\Windows\System\TWAAJto.exe
  C:\Windows\System\TWAAJto.exe
  2⤵
  PID:2604
- C:\Windows\System\ILmxeig.exe
  C:\Windows\System\ILmxeig.exe
  2⤵
  PID:2120
- C:\Windows\System\XxRyimZ.exe
  C:\Windows\System\XxRyimZ.exe
  2⤵
  PID:2520
- C:\Windows\System\CxzSXPO.exe
  C:\Windows\System\CxzSXPO.exe
  2⤵
  PID:2688
- C:\Windows\System\JtQAHqm.exe
  C:\Windows\System\JtQAHqm.exe
  2⤵
  PID:1608
- C:\Windows\System\MPtEXfB.exe
  C:\Windows\System\MPtEXfB.exe
  2⤵
  PID:1560
- C:\Windows\System\txIxjTe.exe
  C:\Windows\System\txIxjTe.exe
  2⤵
  PID:2020
- C:\Windows\System\BQSgIGI.exe
  C:\Windows\System\BQSgIGI.exe
  2⤵
  PID:1620
- C:\Windows\System\DAAdjZC.exe
  C:\Windows\System\DAAdjZC.exe
  2⤵
  PID:1548
- C:\Windows\System\HSvMaON.exe
  C:\Windows\System\HSvMaON.exe
  2⤵
  PID:2452
- C:\Windows\System\iWXgDPG.exe
  C:\Windows\System\iWXgDPG.exe
  2⤵
  PID:1032
- C:\Windows\System\FcmIcHG.exe
  C:\Windows\System\FcmIcHG.exe
  2⤵
  PID:2280
- C:\Windows\System\PjrwjNR.exe
  C:\Windows\System\PjrwjNR.exe
  2⤵
  PID:608
- C:\Windows\System\IFRBJkv.exe
  C:\Windows\System\IFRBJkv.exe
  2⤵
  PID:604
- C:\Windows\System\fNZNnAO.exe
  C:\Windows\System\fNZNnAO.exe
  2⤵
  PID:2500
- C:\Windows\System\DBHkpyE.exe
  C:\Windows\System\DBHkpyE.exe
  2⤵
  PID:624
- C:\Windows\System\OJbqyyT.exe
  C:\Windows\System\OJbqyyT.exe
  2⤵
  PID:1076
- C:\Windows\System\VahTaAM.exe
  C:\Windows\System\VahTaAM.exe
  2⤵
  PID:2348
- C:\Windows\System\fjdvQVZ.exe
  C:\Windows\System\fjdvQVZ.exe
  2⤵
  PID:2188
- C:\Windows\System\ZdzvZCL.exe
  C:\Windows\System\ZdzvZCL.exe
  2⤵
  PID:2176
- C:\Windows\System\REAFaUa.exe
  C:\Windows\System\REAFaUa.exe
  2⤵
  PID:1532
- C:\Windows\System\DkunKDI.exe
  C:\Windows\System\DkunKDI.exe
  2⤵
  PID:888
- C:\Windows\System\jPiRSoe.exe
  C:\Windows\System\jPiRSoe.exe
  2⤵
  PID:2208
- C:\Windows\System\SCcwHjM.exe
  C:\Windows\System\SCcwHjM.exe
  2⤵
  PID:2116
- C:\Windows\System\HYZTkNf.exe
  C:\Windows\System\HYZTkNf.exe
  2⤵
  PID:1728
- C:\Windows\System\cfnkdKf.exe
  C:\Windows\System\cfnkdKf.exe
  2⤵
  PID:1140
- C:\Windows\System\JaojsAy.exe
  C:\Windows\System\JaojsAy.exe
  2⤵
  PID:1792
- C:\Windows\System\gDzcJYt.exe
  C:\Windows\System\gDzcJYt.exe
  2⤵
  PID:108
- C:\Windows\System\mlkpSis.exe
  C:\Windows\System\mlkpSis.exe
  2⤵
  PID:2484
- C:\Windows\System\dHdeTnM.exe
  C:\Windows\System\dHdeTnM.exe
  2⤵
  PID:2476
- C:\Windows\System\ePFJMsW.exe
  C:\Windows\System\ePFJMsW.exe
  2⤵
  PID:2064
- C:\Windows\System\biqWjXF.exe
  C:\Windows\System\biqWjXF.exe
  2⤵
  PID:1840
- C:\Windows\System\VxQuuwF.exe
  C:\Windows\System\VxQuuwF.exe
  2⤵
  PID:1104
- C:\Windows\System\nYIyScg.exe
  C:\Windows\System\nYIyScg.exe
  2⤵
  PID:2344
- C:\Windows\System\EcHTsfJ.exe
  C:\Windows\System\EcHTsfJ.exe
  2⤵
  PID:2548
- C:\Windows\System\IMGfRnw.exe
  C:\Windows\System\IMGfRnw.exe
  2⤵
  PID:2892
- C:\Windows\System\gOrlQHp.exe
  C:\Windows\System\gOrlQHp.exe
  2⤵
  PID:2364
- C:\Windows\System\tegJJrj.exe
  C:\Windows\System\tegJJrj.exe
  2⤵
  PID:2908
- C:\Windows\System\YRfkLFj.exe
  C:\Windows\System\YRfkLFj.exe
  2⤵
  PID:1896
- C:\Windows\System\cHLXuzY.exe
  C:\Windows\System\cHLXuzY.exe
  2⤵
  PID:1100
- C:\Windows\System\fLROMCP.exe
  C:\Windows\System\fLROMCP.exe
  2⤵
  PID:2768
- C:\Windows\System\FpUmIfb.exe
  C:\Windows\System\FpUmIfb.exe
  2⤵
  PID:1512
- C:\Windows\System\iABTvpN.exe
  C:\Windows\System\iABTvpN.exe
  2⤵
  PID:688
- C:\Windows\System\QijrwWE.exe
  C:\Windows\System\QijrwWE.exe
  2⤵
  PID:1648
- C:\Windows\System\faJXcmX.exe
  C:\Windows\System\faJXcmX.exe
  2⤵
  PID:3028
- C:\Windows\System\hCedKtb.exe
  C:\Windows\System\hCedKtb.exe
  2⤵
  PID:2040
- C:\Windows\System\pAofPlW.exe
  C:\Windows\System\pAofPlW.exe
  2⤵
  PID:1400
- C:\Windows\System\toEGFBz.exe
  C:\Windows\System\toEGFBz.exe
  2⤵
  PID:556
- C:\Windows\System\kzPNxrx.exe
  C:\Windows\System\kzPNxrx.exe
  2⤵
  PID:2180
- C:\Windows\System\NNEvMlK.exe
  C:\Windows\System\NNEvMlK.exe
  2⤵
  PID:908
- C:\Windows\System\ndlwnbr.exe
  C:\Windows\System\ndlwnbr.exe
  2⤵
  PID:2252
- C:\Windows\System\NPgZLmr.exe
  C:\Windows\System\NPgZLmr.exe
  2⤵
  PID:2704
- C:\Windows\System\yIjQXpG.exe
  C:\Windows\System\yIjQXpG.exe
  2⤵
  PID:1660
- C:\Windows\System\VuwDTPG.exe
  C:\Windows\System\VuwDTPG.exe
  2⤵
  PID:2572
- C:\Windows\System\XWNacLM.exe
  C:\Windows\System\XWNacLM.exe
  2⤵
  PID:2592
- C:\Windows\System\IqScyqR.exe
  C:\Windows\System\IqScyqR.exe
  2⤵
  PID:1640
- C:\Windows\System\wyQcwNW.exe
  C:\Windows\System\wyQcwNW.exe
  2⤵
  PID:2456
- C:\Windows\System\ytJaWuK.exe
  C:\Windows\System\ytJaWuK.exe
  2⤵
  PID:2196
- C:\Windows\System\wtbfVVv.exe
  C:\Windows\System\wtbfVVv.exe
  2⤵
  PID:1756
- C:\Windows\System\jxcknvM.exe
  C:\Windows\System\jxcknvM.exe
  2⤵
  PID:2648
- C:\Windows\System\zMdoOfO.exe
  C:\Windows\System\zMdoOfO.exe
  2⤵
  PID:1080
- C:\Windows\System\MSKQBXl.exe
  C:\Windows\System\MSKQBXl.exe
  2⤵
  PID:2304
- C:\Windows\System\qtyMUtl.exe
  C:\Windows\System\qtyMUtl.exe
  2⤵
  PID:628
- C:\Windows\System\wFsMQfJ.exe
  C:\Windows\System\wFsMQfJ.exe
  2⤵
  PID:1120
- C:\Windows\System\MkPRlPG.exe
  C:\Windows\System\MkPRlPG.exe
  2⤵
  PID:1408
- C:\Windows\System\kfQzTyX.exe
  C:\Windows\System\kfQzTyX.exe
  2⤵
  PID:2588
- C:\Windows\System\mEQundn.exe
  C:\Windows\System\mEQundn.exe
  2⤵
  PID:2992
- C:\Windows\System\usSHAlH.exe
  C:\Windows\System\usSHAlH.exe
  2⤵
  PID:2004
- C:\Windows\System\MeEgKse.exe
  C:\Windows\System\MeEgKse.exe
  2⤵
  PID:2096
- C:\Windows\System\DFBHAjP.exe
  C:\Windows\System\DFBHAjP.exe
  2⤵
  PID:1976
- C:\Windows\System\asLNGIJ.exe
  C:\Windows\System\asLNGIJ.exe
  2⤵
  PID:2976
- C:\Windows\System\GYQKWZr.exe
  C:\Windows\System\GYQKWZr.exe
  2⤵
  PID:2140
- C:\Windows\System\ZRiEzrN.exe
  C:\Windows\System\ZRiEzrN.exe
  2⤵
  PID:1772
- C:\Windows\System\HUTQApO.exe
  C:\Windows\System\HUTQApO.exe
  2⤵
  PID:1720
- C:\Windows\System\tPrbvLW.exe
  C:\Windows\System\tPrbvLW.exe
  2⤵
  PID:676
- C:\Windows\System\AgKexbt.exe
  C:\Windows\System\AgKexbt.exe
  2⤵
  PID:1248
- C:\Windows\System\tJKafJB.exe
  C:\Windows\System\tJKafJB.exe
  2⤵
  PID:2212
- C:\Windows\System\JTWteIQ.exe
  C:\Windows\System\JTWteIQ.exe
  2⤵
  PID:1832
- C:\Windows\System\CAXqeGu.exe
  C:\Windows\System\CAXqeGu.exe
  2⤵
  PID:2824
- C:\Windows\System\mLAxssO.exe
  C:\Windows\System\mLAxssO.exe
  2⤵
  PID:2964
- C:\Windows\System\opkchdF.exe
  C:\Windows\System\opkchdF.exe
  2⤵
  PID:1992
- C:\Windows\System\NCIBGCA.exe
  C:\Windows\System\NCIBGCA.exe
  2⤵
  PID:2836
- C:\Windows\System\yQlxdPV.exe
  C:\Windows\System\yQlxdPV.exe
  2⤵
  PID:860
- C:\Windows\System\LoowvKc.exe
  C:\Windows\System\LoowvKc.exe
  2⤵
  PID:2160
- C:\Windows\System\WcbfTEe.exe
  C:\Windows\System\WcbfTEe.exe
  2⤵
  PID:3084
- C:\Windows\System\dmViTZT.exe
  C:\Windows\System\dmViTZT.exe
  2⤵
  PID:3104
- C:\Windows\System\TDHIYZt.exe
  C:\Windows\System\TDHIYZt.exe
  2⤵
  PID:3120
- C:\Windows\System\ueySUgT.exe
  C:\Windows\System\ueySUgT.exe
  2⤵
  PID:3136
- C:\Windows\System\xnwEswK.exe
  C:\Windows\System\xnwEswK.exe
  2⤵
  PID:3152
- C:\Windows\System\uEzHSex.exe
  C:\Windows\System\uEzHSex.exe
  2⤵
  PID:3168
- C:\Windows\System\IKofHHn.exe
  C:\Windows\System\IKofHHn.exe
  2⤵
  PID:3184
- C:\Windows\System\dhezhMo.exe
  C:\Windows\System\dhezhMo.exe
  2⤵
  PID:3200
- C:\Windows\System\fvbvSsd.exe
  C:\Windows\System\fvbvSsd.exe
  2⤵
  PID:3216
- C:\Windows\System\bzZFfNA.exe
  C:\Windows\System\bzZFfNA.exe
  2⤵
  PID:3232
- C:\Windows\System\zaZLUtJ.exe
  C:\Windows\System\zaZLUtJ.exe
  2⤵
  PID:3248
- C:\Windows\System\qdodSQL.exe
  C:\Windows\System\qdodSQL.exe
  2⤵
  PID:3268
- C:\Windows\System\wAHciNB.exe
  C:\Windows\System\wAHciNB.exe
  2⤵
  PID:3288
- C:\Windows\System\aKrpJqw.exe
  C:\Windows\System\aKrpJqw.exe
  2⤵
  PID:3304
- C:\Windows\System\szKIzvE.exe
  C:\Windows\System\szKIzvE.exe
  2⤵
  PID:3440
- C:\Windows\System\BycHXlJ.exe
  C:\Windows\System\BycHXlJ.exe
  2⤵
  PID:3464
- C:\Windows\System\VEvBSSK.exe
  C:\Windows\System\VEvBSSK.exe
  2⤵
  PID:3480
- C:\Windows\System\cilSvCt.exe
  C:\Windows\System\cilSvCt.exe
  2⤵
  PID:3504
- C:\Windows\System\gdWamAs.exe
  C:\Windows\System\gdWamAs.exe
  2⤵
  PID:3520
- C:\Windows\System\pBzsAdN.exe
  C:\Windows\System\pBzsAdN.exe
  2⤵
  PID:3536
- C:\Windows\System\djXJyAK.exe
  C:\Windows\System\djXJyAK.exe
  2⤵
  PID:3552
- C:\Windows\System\dyrSfav.exe
  C:\Windows\System\dyrSfav.exe
  2⤵
  PID:3568
- C:\Windows\System\xDjFHEI.exe
  C:\Windows\System\xDjFHEI.exe
  2⤵
  PID:3584
- C:\Windows\System\yiQeEYR.exe
  C:\Windows\System\yiQeEYR.exe
  2⤵
  PID:3600
- C:\Windows\System\AyibNwi.exe
  C:\Windows\System\AyibNwi.exe
  2⤵
  PID:3616
- C:\Windows\System\jUvamuF.exe
  C:\Windows\System\jUvamuF.exe
  2⤵
  PID:3632
- C:\Windows\System\khFzvLx.exe
  C:\Windows\System\khFzvLx.exe
  2⤵
  PID:3648
- C:\Windows\System\aygQdEJ.exe
  C:\Windows\System\aygQdEJ.exe
  2⤵
  PID:3704
- C:\Windows\System\ocuZXIR.exe
  C:\Windows\System\ocuZXIR.exe
  2⤵
  PID:3724
- C:\Windows\System\YyVykBM.exe
  C:\Windows\System\YyVykBM.exe
  2⤵
  PID:3740
- C:\Windows\System\XGQiSmD.exe
  C:\Windows\System\XGQiSmD.exe
  2⤵
  PID:3756
- C:\Windows\System\reoNDiU.exe
  C:\Windows\System\reoNDiU.exe
  2⤵
  PID:3772
- C:\Windows\System\IlqPzhX.exe
  C:\Windows\System\IlqPzhX.exe
  2⤵
  PID:3788
- C:\Windows\System\TOhZUBw.exe
  C:\Windows\System\TOhZUBw.exe
  2⤵
  PID:3804
- C:\Windows\System\FLgaGOt.exe
  C:\Windows\System\FLgaGOt.exe
  2⤵
  PID:3820
- C:\Windows\System\vQGIjyH.exe
  C:\Windows\System\vQGIjyH.exe
  2⤵
  PID:3836
- C:\Windows\System\GAytVNJ.exe
  C:\Windows\System\GAytVNJ.exe
  2⤵
  PID:3852
- C:\Windows\System\VNBZFWr.exe
  C:\Windows\System\VNBZFWr.exe
  2⤵
  PID:3868
- C:\Windows\System\pbsFIXP.exe
  C:\Windows\System\pbsFIXP.exe
  2⤵
  PID:3884
- C:\Windows\System\mfItbZt.exe
  C:\Windows\System\mfItbZt.exe
  2⤵
  PID:3900
- C:\Windows\System\uoWcBQq.exe
  C:\Windows\System\uoWcBQq.exe
  2⤵
  PID:3916
- C:\Windows\System\QnGdyfm.exe
  C:\Windows\System\QnGdyfm.exe
  2⤵
  PID:3932
- C:\Windows\System\Dfmhiff.exe
  C:\Windows\System\Dfmhiff.exe
  2⤵
  PID:3948
- C:\Windows\System\tvZYNJZ.exe
  C:\Windows\System\tvZYNJZ.exe
  2⤵
  PID:3964
- C:\Windows\System\tdfEwiL.exe
  C:\Windows\System\tdfEwiL.exe
  2⤵
  PID:3980
- C:\Windows\System\hVEQBax.exe
  C:\Windows\System\hVEQBax.exe
  2⤵
  PID:3996
- C:\Windows\System\DUGgYZH.exe
  C:\Windows\System\DUGgYZH.exe
  2⤵
  PID:4012
- C:\Windows\System\LkOObaV.exe
  C:\Windows\System\LkOObaV.exe
  2⤵
  PID:4036
- C:\Windows\System\OEIMCcR.exe
  C:\Windows\System\OEIMCcR.exe
  2⤵
  PID:4052
- C:\Windows\System\pwzjSNA.exe
  C:\Windows\System\pwzjSNA.exe
  2⤵
  PID:4068
- C:\Windows\System\xcjBhJk.exe
  C:\Windows\System\xcjBhJk.exe
  2⤵
  PID:4084
- C:\Windows\System\esOUgyH.exe
  C:\Windows\System\esOUgyH.exe
  2⤵
  PID:2804
- C:\Windows\System\gYbziqj.exe
  C:\Windows\System\gYbziqj.exe
  2⤵
  PID:2832
- C:\Windows\System\nsNLoxy.exe
  C:\Windows\System\nsNLoxy.exe
  2⤵
  PID:3096
- C:\Windows\System\sfrIDKQ.exe
  C:\Windows\System\sfrIDKQ.exe
  2⤵
  PID:3196
- C:\Windows\System\gNPjdzs.exe
  C:\Windows\System\gNPjdzs.exe
  2⤵
  PID:3276
- C:\Windows\System\lXxggCz.exe
  C:\Windows\System\lXxggCz.exe
  2⤵
  PID:3320
- C:\Windows\System\wRrHYDn.exe
  C:\Windows\System\wRrHYDn.exe
  2⤵
  PID:3336
- C:\Windows\System\hAXiYkt.exe
  C:\Windows\System\hAXiYkt.exe
  2⤵
  PID:3360
- C:\Windows\System\EhNwPbR.exe
  C:\Windows\System\EhNwPbR.exe
  2⤵
  PID:3372
- C:\Windows\System\ULIBuce.exe
  C:\Windows\System\ULIBuce.exe
  2⤵
  PID:3412
- C:\Windows\System\uIdKaMo.exe
  C:\Windows\System\uIdKaMo.exe
  2⤵
  PID:3472
- C:\Windows\System\nlQEWzm.exe
  C:\Windows\System\nlQEWzm.exe
  2⤵
  PID:3512
- C:\Windows\System\OpfgFzw.exe
  C:\Windows\System\OpfgFzw.exe
  2⤵
  PID:3592
- C:\Windows\System\StFXZVg.exe
  C:\Windows\System\StFXZVg.exe
  2⤵
  PID:3628
- C:\Windows\System\uRUzcCw.exe
  C:\Windows\System\uRUzcCw.exe
  2⤵
  PID:3640
- C:\Windows\System\MZnxxec.exe
  C:\Windows\System\MZnxxec.exe
  2⤵
  PID:3664
- C:\Windows\System\APoEuQI.exe
  C:\Windows\System\APoEuQI.exe
  2⤵
  PID:3680
- C:\Windows\System\XldNvom.exe
  C:\Windows\System\XldNvom.exe
  2⤵
  PID:3544
- C:\Windows\System\tfFpuKu.exe
  C:\Windows\System\tfFpuKu.exe
  2⤵
  PID:3768
- C:\Windows\System\BvUTDIt.exe
  C:\Windows\System\BvUTDIt.exe
  2⤵
  PID:3960
- C:\Windows\System\TkKaUkv.exe
  C:\Windows\System\TkKaUkv.exe
  2⤵
  PID:4028
- C:\Windows\System\ymGzhIv.exe
  C:\Windows\System\ymGzhIv.exe
  2⤵
  PID:3908
- C:\Windows\System\hIRSbxG.exe
  C:\Windows\System\hIRSbxG.exe
  2⤵
  PID:3784
- C:\Windows\System\zPQPkOr.exe
  C:\Windows\System\zPQPkOr.exe
  2⤵
  PID:3880
- C:\Windows\System\AcxVVTg.exe
  C:\Windows\System\AcxVVTg.exe
  2⤵
  PID:3972
- C:\Windows\System\vuotwmo.exe
  C:\Windows\System\vuotwmo.exe
  2⤵
  PID:4080
- C:\Windows\System\ZtrwDgM.exe
  C:\Windows\System\ZtrwDgM.exe
  2⤵
  PID:3092
- C:\Windows\System\vjPyucZ.exe
  C:\Windows\System\vjPyucZ.exe
  2⤵
  PID:3860
- C:\Windows\System\WyHywqm.exe
  C:\Windows\System\WyHywqm.exe
  2⤵
  PID:3928
- C:\Windows\System\UevaQCm.exe
  C:\Windows\System\UevaQCm.exe
  2⤵
  PID:3080
- C:\Windows\System\ZLaNuQQ.exe
  C:\Windows\System\ZLaNuQQ.exe
  2⤵
  PID:3244
- C:\Windows\System\ZmHTbnx.exe
  C:\Windows\System\ZmHTbnx.exe
  2⤵
  PID:2260
- C:\Windows\System\dbjpjwY.exe
  C:\Windows\System\dbjpjwY.exe
  2⤵
  PID:2536
- C:\Windows\System\lhWWyTs.exe
  C:\Windows\System\lhWWyTs.exe
  2⤵
  PID:4092
- C:\Windows\System\VJQtlSz.exe
  C:\Windows\System\VJQtlSz.exe
  2⤵
  PID:3212
- C:\Windows\System\WNMAsCF.exe
  C:\Windows\System\WNMAsCF.exe
  2⤵
  PID:3312
- C:\Windows\System\fxmAMKK.exe
  C:\Windows\System\fxmAMKK.exe
  2⤵
  PID:3264
- C:\Windows\System\MrvNuhn.exe
  C:\Windows\System\MrvNuhn.exe
  2⤵
  PID:3384
- C:\Windows\System\giYkmqV.exe
  C:\Windows\System\giYkmqV.exe
  2⤵
  PID:3476
- C:\Windows\System\odgzmFs.exe
  C:\Windows\System\odgzmFs.exe
  2⤵
  PID:3516
- C:\Windows\System\JYdfLNx.exe
  C:\Windows\System\JYdfLNx.exe
  2⤵
  PID:1920
- C:\Windows\System\SneIUFk.exe
  C:\Windows\System\SneIUFk.exe
  2⤵
  PID:3660
- C:\Windows\System\zkXFbxS.exe
  C:\Windows\System\zkXFbxS.exe
  2⤵
  PID:3548
- C:\Windows\System\RvnlZzF.exe
  C:\Windows\System\RvnlZzF.exe
  2⤵
  PID:3732
- C:\Windows\System\qqqplDA.exe
  C:\Windows\System\qqqplDA.exe
  2⤵
  PID:4032
- C:\Windows\System\BqMvHvy.exe
  C:\Windows\System\BqMvHvy.exe
  2⤵
  PID:3780
- C:\Windows\System\PjucGUL.exe
  C:\Windows\System\PjucGUL.exe
  2⤵
  PID:3876
- C:\Windows\System\cnotatS.exe
  C:\Windows\System\cnotatS.exe
  2⤵
  PID:4048
- C:\Windows\System\xiSWhhD.exe
  C:\Windows\System\xiSWhhD.exe
  2⤵
  PID:2016
- C:\Windows\System\sxtidwc.exe
  C:\Windows\System\sxtidwc.exe
  2⤵
  PID:836
- C:\Windows\System\YztfSvM.exe
  C:\Windows\System\YztfSvM.exe
  2⤵
  PID:3144
- C:\Windows\System\uSWZwbY.exe
  C:\Windows\System\uSWZwbY.exe
  2⤵
  PID:3132
- C:\Windows\System\qDBJtDB.exe
  C:\Windows\System\qDBJtDB.exe
  2⤵
  PID:3148
- C:\Windows\System\RAqeKTf.exe
  C:\Windows\System\RAqeKTf.exe
  2⤵
  PID:3208
- C:\Windows\System\qgWaBAZ.exe
  C:\Windows\System\qgWaBAZ.exe
  2⤵
  PID:3284
- C:\Windows\System\MTPFvsJ.exe
  C:\Windows\System\MTPFvsJ.exe
  2⤵
  PID:3380
- C:\Windows\System\gXDEuWW.exe
  C:\Windows\System\gXDEuWW.exe
  2⤵
  PID:3456
- C:\Windows\System\esEXyJc.exe
  C:\Windows\System\esEXyJc.exe
  2⤵
  PID:3676
- C:\Windows\System\WFVNbSD.exe
  C:\Windows\System\WFVNbSD.exe
  2⤵
  PID:3896
- C:\Windows\System\XUzKBol.exe
  C:\Windows\System\XUzKBol.exe
  2⤵
  PID:4064
- C:\Windows\System\VzIhdgm.exe
  C:\Windows\System\VzIhdgm.exe
  2⤵
  PID:3848
- C:\Windows\System\yaTOnel.exe
  C:\Windows\System\yaTOnel.exe
  2⤵
  PID:4044
- C:\Windows\System\FbyEVFp.exe
  C:\Windows\System\FbyEVFp.exe
  2⤵
  PID:3796
- C:\Windows\System\srUwlaz.exe
  C:\Windows\System\srUwlaz.exe
  2⤵
  PID:2668
- C:\Windows\System\ZBncXpB.exe
  C:\Windows\System\ZBncXpB.exe
  2⤵
  PID:3344
- C:\Windows\System\nhBcQkB.exe
  C:\Windows\System\nhBcQkB.exe
  2⤵
  PID:3348
- C:\Windows\System\kWEingK.exe
  C:\Windows\System\kWEingK.exe
  2⤵
  PID:3612
- C:\Windows\System\YYqhEqz.exe
  C:\Windows\System\YYqhEqz.exe
  2⤵
  PID:3688
- C:\Windows\System\gNSrMjC.exe
  C:\Windows\System\gNSrMjC.exe
  2⤵
  PID:3716
- C:\Windows\System\gZEtaNb.exe
  C:\Windows\System\gZEtaNb.exe
  2⤵
  PID:2540
- C:\Windows\System\uzUKrMr.exe
  C:\Windows\System\uzUKrMr.exe
  2⤵
  PID:3988
- C:\Windows\System\CjIRMvI.exe
  C:\Windows\System\CjIRMvI.exe
  2⤵
  PID:896
- C:\Windows\System\hnxbyRm.exe
  C:\Windows\System\hnxbyRm.exe
  2⤵
  PID:3452
- C:\Windows\System\jXxWyKL.exe
  C:\Windows\System\jXxWyKL.exe
  2⤵
  PID:3816
- C:\Windows\System\LEMukTY.exe
  C:\Windows\System\LEMukTY.exe
  2⤵
  PID:4076
- C:\Windows\System\yyawERB.exe
  C:\Windows\System\yyawERB.exe
  2⤵
  PID:3564
- C:\Windows\System\xITEtUs.exe
  C:\Windows\System\xITEtUs.exe
  2⤵
  PID:3496
- C:\Windows\System\oGbkQkY.exe
  C:\Windows\System\oGbkQkY.exe
  2⤵
  PID:4112
- C:\Windows\System\tIacaFu.exe
  C:\Windows\System\tIacaFu.exe
  2⤵
  PID:4128
- C:\Windows\System\dxUCtPn.exe
  C:\Windows\System\dxUCtPn.exe
  2⤵
  PID:4152
- C:\Windows\System\ybdhYZO.exe
  C:\Windows\System\ybdhYZO.exe
  2⤵
  PID:4184
- C:\Windows\System\xdjdcHN.exe
  C:\Windows\System\xdjdcHN.exe
  2⤵
  PID:4204
- C:\Windows\System\JIJypTj.exe
  C:\Windows\System\JIJypTj.exe
  2⤵
  PID:4252
- C:\Windows\System\YkbJPTZ.exe
  C:\Windows\System\YkbJPTZ.exe
  2⤵
  PID:4280
- C:\Windows\System\BpNTOIt.exe
  C:\Windows\System\BpNTOIt.exe
  2⤵
  PID:4300
- C:\Windows\System\vsQjmeX.exe
  C:\Windows\System\vsQjmeX.exe
  2⤵
  PID:4316
- C:\Windows\System\sdhckzy.exe
  C:\Windows\System\sdhckzy.exe
  2⤵
  PID:4336
- C:\Windows\System\henfWXF.exe
  C:\Windows\System\henfWXF.exe
  2⤵
  PID:4356
- C:\Windows\System\gvSGNRC.exe
  C:\Windows\System\gvSGNRC.exe
  2⤵
  PID:4372
- C:\Windows\System\zCfVxzH.exe
  C:\Windows\System\zCfVxzH.exe
  2⤵
  PID:4396
- C:\Windows\System\AGxiAPo.exe
  C:\Windows\System\AGxiAPo.exe
  2⤵
  PID:4416
- C:\Windows\System\YnZdiAX.exe
  C:\Windows\System\YnZdiAX.exe
  2⤵
  PID:4432
- C:\Windows\System\FMXwzoT.exe
  C:\Windows\System\FMXwzoT.exe
  2⤵
  PID:4452
- C:\Windows\System\mdusHpv.exe
  C:\Windows\System\mdusHpv.exe
  2⤵
  PID:4476
- C:\Windows\System\xcuxZXl.exe
  C:\Windows\System\xcuxZXl.exe
  2⤵
  PID:4492
- C:\Windows\System\WeOoHqq.exe
  C:\Windows\System\WeOoHqq.exe
  2⤵
  PID:4508
- C:\Windows\System\nlTTaSx.exe
  C:\Windows\System\nlTTaSx.exe
  2⤵
  PID:4532
- C:\Windows\System\MeDHdGK.exe
  C:\Windows\System\MeDHdGK.exe
  2⤵
  PID:4548
- C:\Windows\System\OrqnVJP.exe
  C:\Windows\System\OrqnVJP.exe
  2⤵
  PID:4568
- C:\Windows\System\SoZAhCn.exe
  C:\Windows\System\SoZAhCn.exe
  2⤵
  PID:4592
- C:\Windows\System\yupGOYO.exe
  C:\Windows\System\yupGOYO.exe
  2⤵
  PID:4612
- C:\Windows\System\WfjLkrt.exe
  C:\Windows\System\WfjLkrt.exe
  2⤵
  PID:4628
- C:\Windows\System\vocTDIq.exe
  C:\Windows\System\vocTDIq.exe
  2⤵
  PID:4644
- C:\Windows\System\lOIZIYX.exe
  C:\Windows\System\lOIZIYX.exe
  2⤵
  PID:4660
- C:\Windows\System\cKdwBcf.exe
  C:\Windows\System\cKdwBcf.exe
  2⤵
  PID:4676
- C:\Windows\System\UZsGMZH.exe
  C:\Windows\System\UZsGMZH.exe
  2⤵
  PID:4704
- C:\Windows\System\fdGrsxH.exe
  C:\Windows\System\fdGrsxH.exe
  2⤵
  PID:4736
- C:\Windows\System\qgheVaJ.exe
  C:\Windows\System\qgheVaJ.exe
  2⤵
  PID:4756
- C:\Windows\System\pApsmkc.exe
  C:\Windows\System\pApsmkc.exe
  2⤵
  PID:4772
- C:\Windows\System\dXCtoIO.exe
  C:\Windows\System\dXCtoIO.exe
  2⤵
  PID:4788
- C:\Windows\System\VgusEmo.exe
  C:\Windows\System\VgusEmo.exe
  2⤵
  PID:4812
- C:\Windows\System\nQCjNUH.exe
  C:\Windows\System\nQCjNUH.exe
  2⤵
  PID:4836
- C:\Windows\System\aFBkEJs.exe
  C:\Windows\System\aFBkEJs.exe
  2⤵
  PID:4856
- C:\Windows\System\TMbJcQj.exe
  C:\Windows\System\TMbJcQj.exe
  2⤵
  PID:4876
- C:\Windows\System\EPADqfB.exe
  C:\Windows\System\EPADqfB.exe
  2⤵
  PID:4892
- C:\Windows\System\tpTZodu.exe
  C:\Windows\System\tpTZodu.exe
  2⤵
  PID:4908
- C:\Windows\System\nGwEOpZ.exe
  C:\Windows\System\nGwEOpZ.exe
  2⤵
  PID:4928
- C:\Windows\System\etbNrsR.exe
  C:\Windows\System\etbNrsR.exe
  2⤵
  PID:4944
- C:\Windows\System\vhZdobd.exe
  C:\Windows\System\vhZdobd.exe
  2⤵
  PID:4960
- C:\Windows\System\ixBxqZq.exe
  C:\Windows\System\ixBxqZq.exe
  2⤵
  PID:4984
- C:\Windows\System\hyQGoUh.exe
  C:\Windows\System\hyQGoUh.exe
  2⤵
  PID:5000
- C:\Windows\System\RIbgyTJ.exe
  C:\Windows\System\RIbgyTJ.exe
  2⤵
  PID:5020
- C:\Windows\System\cAIQfCQ.exe
  C:\Windows\System\cAIQfCQ.exe
  2⤵
  PID:5036
- C:\Windows\System\ZUwmkwo.exe
  C:\Windows\System\ZUwmkwo.exe
  2⤵
  PID:5056
- C:\Windows\System\wkcPKij.exe
  C:\Windows\System\wkcPKij.exe
  2⤵
  PID:5072
- C:\Windows\System\FVyloBT.exe
  C:\Windows\System\FVyloBT.exe
  2⤵
  PID:5088
- C:\Windows\System\ZmobQMV.exe
  C:\Windows\System\ZmobQMV.exe
  2⤵
  PID:3644
- C:\Windows\System\HQzedXB.exe
  C:\Windows\System\HQzedXB.exe
  2⤵
  PID:4136
- C:\Windows\System\uNNhDip.exe
  C:\Windows\System\uNNhDip.exe
  2⤵
  PID:4104
- C:\Windows\System\LMVoMre.exe
  C:\Windows\System\LMVoMre.exe
  2⤵
  PID:4168
- C:\Windows\System\xDBctgm.exe
  C:\Windows\System\xDBctgm.exe
  2⤵
  PID:4196
- C:\Windows\System\IVVIOxw.exe
  C:\Windows\System\IVVIOxw.exe
  2⤵
  PID:4240
- C:\Windows\System\FvzSiHM.exe
  C:\Windows\System\FvzSiHM.exe
  2⤵
  PID:4248
- C:\Windows\System\OceKEfY.exe
  C:\Windows\System\OceKEfY.exe
  2⤵
  PID:4288
- C:\Windows\System\bdclumB.exe
  C:\Windows\System\bdclumB.exe
  2⤵
  PID:4324
- C:\Windows\System\SMPzPBq.exe
  C:\Windows\System\SMPzPBq.exe
  2⤵
  PID:4348
- C:\Windows\System\hidUCxI.exe
  C:\Windows\System\hidUCxI.exe
  2⤵
  PID:4368
- C:\Windows\System\MBLdxJk.exe
  C:\Windows\System\MBLdxJk.exe
  2⤵
  PID:4412
- C:\Windows\System\JmhCZNP.exe
  C:\Windows\System\JmhCZNP.exe
  2⤵
  PID:4448
- C:\Windows\System\MTUpCWK.exe
  C:\Windows\System\MTUpCWK.exe
  2⤵
  PID:4472
- C:\Windows\System\gmRffxk.exe
  C:\Windows\System\gmRffxk.exe
  2⤵
  PID:4500
- C:\Windows\System\QYduLKZ.exe
  C:\Windows\System\QYduLKZ.exe
  2⤵
  PID:4540
- C:\Windows\System\nnELFtK.exe
  C:\Windows\System\nnELFtK.exe
  2⤵
  PID:4584
- C:\Windows\System\mHuiTsF.exe
  C:\Windows\System\mHuiTsF.exe
  2⤵
  PID:4580
- C:\Windows\System\mDaaHBq.exe
  C:\Windows\System\mDaaHBq.exe
  2⤵
  PID:4672
- C:\Windows\System\ZqLRETH.exe
  C:\Windows\System\ZqLRETH.exe
  2⤵
  PID:4728
- C:\Windows\System\aTKjSjH.exe
  C:\Windows\System\aTKjSjH.exe
  2⤵
  PID:4684
- C:\Windows\System\aVKAsZj.exe
  C:\Windows\System\aVKAsZj.exe
  2⤵
  PID:4732
- C:\Windows\System\MJVUSwD.exe
  C:\Windows\System\MJVUSwD.exe
  2⤵
  PID:4764
- C:\Windows\System\sfGQzyd.exe
  C:\Windows\System\sfGQzyd.exe
  2⤵
  PID:4796
- C:\Windows\System\bCEvpnD.exe
  C:\Windows\System\bCEvpnD.exe
  2⤵
  PID:4820
- C:\Windows\System\bANqHhO.exe
  C:\Windows\System\bANqHhO.exe
  2⤵
  PID:4824
- C:\Windows\System\DOTslgq.exe
  C:\Windows\System\DOTslgq.exe
  2⤵
  PID:4848
- C:\Windows\System\gvvFoXq.exe
  C:\Windows\System\gvvFoXq.exe
  2⤵
  PID:4884
- C:\Windows\System\dutLjNr.exe
  C:\Windows\System\dutLjNr.exe
  2⤵
  PID:5032
- C:\Windows\System\UHatqaz.exe
  C:\Windows\System\UHatqaz.exe
  2⤵
  PID:5052
- C:\Windows\System\jESKmWI.exe
  C:\Windows\System\jESKmWI.exe
  2⤵
  PID:5012
- C:\Windows\System\qXcLaaN.exe
  C:\Windows\System\qXcLaaN.exe
  2⤵
  PID:5080
- C:\Windows\System\EQqaIwX.exe
  C:\Windows\System\EQqaIwX.exe
  2⤵
  PID:5108
- C:\Windows\System\MgZPyFW.exe
  C:\Windows\System\MgZPyFW.exe
  2⤵
  PID:3192
- C:\Windows\System\fIKbCOP.exe
  C:\Windows\System\fIKbCOP.exe
  2⤵
  PID:3608
- C:\Windows\System\VEKnLID.exe
  C:\Windows\System\VEKnLID.exe
  2⤵
  PID:4004
- C:\Windows\System\EWycwNr.exe
  C:\Windows\System\EWycwNr.exe
  2⤵
  PID:4192
- C:\Windows\System\xzCJDMj.exe
  C:\Windows\System\xzCJDMj.exe
  2⤵
  PID:4220
- C:\Windows\System\hJvaDyC.exe
  C:\Windows\System\hJvaDyC.exe
  2⤵
  PID:4268
- C:\Windows\System\jcDrGwl.exe
  C:\Windows\System\jcDrGwl.exe
  2⤵
  PID:4296
- C:\Windows\System\qOActkU.exe
  C:\Windows\System\qOActkU.exe
  2⤵
  PID:4380
- C:\Windows\System\WKmTNit.exe
  C:\Windows\System\WKmTNit.exe
  2⤵
  PID:4388
- C:\Windows\System\Addlfla.exe
  C:\Windows\System\Addlfla.exe
  2⤵
  PID:4424
- C:\Windows\System\vATvime.exe
  C:\Windows\System\vATvime.exe
  2⤵
  PID:4488
- C:\Windows\System\bMPnUqw.exe
  C:\Windows\System\bMPnUqw.exe
  2⤵
  PID:4528
- C:\Windows\System\dtrjuwn.exe
  C:\Windows\System\dtrjuwn.exe
  2⤵
  PID:4564
- C:\Windows\System\NdNPStz.exe
  C:\Windows\System\NdNPStz.exe
  2⤵
  PID:4636
- C:\Windows\System\rUsjquk.exe
  C:\Windows\System\rUsjquk.exe
  2⤵
  PID:4716
- C:\Windows\System\aRNpHur.exe
  C:\Windows\System\aRNpHur.exe
  2⤵
  PID:4852
- C:\Windows\System\zbRZOfy.exe
  C:\Windows\System\zbRZOfy.exe
  2⤵
  PID:4916
- C:\Windows\System\tvQgvYu.exe
  C:\Windows\System\tvQgvYu.exe
  2⤵
  PID:4952
- C:\Windows\System\mhmcRkp.exe
  C:\Windows\System\mhmcRkp.exe
  2⤵
  PID:4700
- C:\Windows\System\BJAbZYd.exe
  C:\Windows\System\BJAbZYd.exe
  2⤵
  PID:5128
- C:\Windows\System\SUbKxmv.exe
  C:\Windows\System\SUbKxmv.exe
  2⤵
  PID:5144
- C:\Windows\System\oCZzdAp.exe
  C:\Windows\System\oCZzdAp.exe
  2⤵
  PID:5160
- C:\Windows\System\JZehovW.exe
  C:\Windows\System\JZehovW.exe
  2⤵
  PID:5176
- C:\Windows\System\rWAowcI.exe
  C:\Windows\System\rWAowcI.exe
  2⤵
  PID:5192
- C:\Windows\System\ANyvwzE.exe
  C:\Windows\System\ANyvwzE.exe
  2⤵
  PID:5212
- C:\Windows\System\utMknNq.exe
  C:\Windows\System\utMknNq.exe
  2⤵
  PID:5228
- C:\Windows\System\MzwFFOO.exe
  C:\Windows\System\MzwFFOO.exe
  2⤵
  PID:5244
- C:\Windows\System\XRVnBPh.exe
  C:\Windows\System\XRVnBPh.exe
  2⤵
  PID:5260
- C:\Windows\System\zMprOnh.exe
  C:\Windows\System\zMprOnh.exe
  2⤵
  PID:5276
- C:\Windows\System\nzlMCUr.exe
  C:\Windows\System\nzlMCUr.exe
  2⤵
  PID:5292
- C:\Windows\System\bjBtSke.exe
  C:\Windows\System\bjBtSke.exe
  2⤵
  PID:5312
- C:\Windows\System\fENWsYC.exe
  C:\Windows\System\fENWsYC.exe
  2⤵
  PID:5328
- C:\Windows\System\oPUTHoH.exe
  C:\Windows\System\oPUTHoH.exe
  2⤵
  PID:5372
- C:\Windows\System\ayBTghG.exe
  C:\Windows\System\ayBTghG.exe
  2⤵
  PID:5396
- C:\Windows\System\ANOovOw.exe
  C:\Windows\System\ANOovOw.exe
  2⤵
  PID:5520
- C:\Windows\System\DhYYBoN.exe
  C:\Windows\System\DhYYBoN.exe
  2⤵
  PID:5536
- C:\Windows\System\eKgUwSH.exe
  C:\Windows\System\eKgUwSH.exe
  2⤵
  PID:5552
- C:\Windows\System\qjxIeMK.exe
  C:\Windows\System\qjxIeMK.exe
  2⤵
  PID:5568
- C:\Windows\System\iaIEGua.exe
  C:\Windows\System\iaIEGua.exe
  2⤵
  PID:5584
- C:\Windows\System\zrQuCLQ.exe
  C:\Windows\System\zrQuCLQ.exe
  2⤵
  PID:5600
- C:\Windows\System\YvYkFLU.exe
  C:\Windows\System\YvYkFLU.exe
  2⤵
  PID:5616
- C:\Windows\System\LYwyzbA.exe
  C:\Windows\System\LYwyzbA.exe
  2⤵
  PID:5632
- C:\Windows\System\JdMUDkx.exe
  C:\Windows\System\JdMUDkx.exe
  2⤵
  PID:5648
- C:\Windows\System\kqrEYYu.exe
  C:\Windows\System\kqrEYYu.exe
  2⤵
  PID:5664
- C:\Windows\System\hQWrNMU.exe
  C:\Windows\System\hQWrNMU.exe
  2⤵
  PID:5684
- C:\Windows\System\NtJEUST.exe
  C:\Windows\System\NtJEUST.exe
  2⤵
  PID:5700
- C:\Windows\System\ctHBrxM.exe
  C:\Windows\System\ctHBrxM.exe
  2⤵
  PID:5720
- C:\Windows\System\wuqngkw.exe
  C:\Windows\System\wuqngkw.exe
  2⤵
  PID:5736
- C:\Windows\System\lIyxQRb.exe
  C:\Windows\System\lIyxQRb.exe
  2⤵
  PID:5756
- C:\Windows\System\IYrsbCE.exe
  C:\Windows\System\IYrsbCE.exe
  2⤵
  PID:5776
- C:\Windows\System\IaJrLnJ.exe
  C:\Windows\System\IaJrLnJ.exe
  2⤵
  PID:5832
- C:\Windows\System\rgNyKMD.exe
  C:\Windows\System\rgNyKMD.exe
  2⤵
  PID:5852
- C:\Windows\System\fGYcRwa.exe
  C:\Windows\System\fGYcRwa.exe
  2⤵
  PID:5872
- C:\Windows\System\wLiUVQk.exe
  C:\Windows\System\wLiUVQk.exe
  2⤵
  PID:5888
- C:\Windows\System\jVULBwg.exe
  C:\Windows\System\jVULBwg.exe
  2⤵
  PID:5904
- C:\Windows\System\QQLzLSa.exe
  C:\Windows\System\QQLzLSa.exe
  2⤵
  PID:5920
- C:\Windows\System\VfgUCmH.exe
  C:\Windows\System\VfgUCmH.exe
  2⤵
  PID:5936
- C:\Windows\System\paYPGyI.exe
  C:\Windows\System\paYPGyI.exe
  2⤵
  PID:5956
- C:\Windows\System\NPELTlM.exe
  C:\Windows\System\NPELTlM.exe
  2⤵
  PID:5972
- C:\Windows\System\WEnTpYS.exe
  C:\Windows\System\WEnTpYS.exe
  2⤵
  PID:6020
- C:\Windows\System\icrbcCx.exe
  C:\Windows\System\icrbcCx.exe
  2⤵
  PID:6036
- C:\Windows\System\jSGGyAY.exe
  C:\Windows\System\jSGGyAY.exe
  2⤵
  PID:6052
- C:\Windows\System\xhrEuJJ.exe
  C:\Windows\System\xhrEuJJ.exe
  2⤵
  PID:6068
- C:\Windows\System\hhKgBMv.exe
  C:\Windows\System\hhKgBMv.exe
  2⤵
  PID:6100
- C:\Windows\System\SwjyQwV.exe
  C:\Windows\System\SwjyQwV.exe
  2⤵
  PID:6116
- C:\Windows\System\zvszjxz.exe
  C:\Windows\System\zvszjxz.exe
  2⤵
  PID:6132
- C:\Windows\System\yUeWTfc.exe
  C:\Windows\System\yUeWTfc.exe
  2⤵
  PID:5104
- C:\Windows\System\OQPYmFq.exe
  C:\Windows\System\OQPYmFq.exe
  2⤵
  PID:4228
- C:\Windows\System\bueHZsR.exe
  C:\Windows\System\bueHZsR.exe
  2⤵
  PID:5048
- C:\Windows\System\xmZWGMl.exe
  C:\Windows\System\xmZWGMl.exe
  2⤵
  PID:4688
- C:\Windows\System\jojgxiP.exe
  C:\Windows\System\jojgxiP.exe
  2⤵
  PID:4828
- C:\Windows\System\esAZbul.exe
  C:\Windows\System\esAZbul.exe
  2⤵
  PID:4920
- C:\Windows\System\wUGoIpv.exe
  C:\Windows\System\wUGoIpv.exe
  2⤵
  PID:4544
- C:\Windows\System\AHQPegf.exe
  C:\Windows\System\AHQPegf.exe
  2⤵
  PID:4620
- C:\Windows\System\eZYzjfw.exe
  C:\Windows\System\eZYzjfw.exe
  2⤵
  PID:4244
- C:\Windows\System\EGOvrXJ.exe
  C:\Windows\System\EGOvrXJ.exe
  2⤵
  PID:4120
- C:\Windows\System\nbduXfq.exe
  C:\Windows\System\nbduXfq.exe
  2⤵
  PID:4940
- C:\Windows\System\OsMMJaG.exe
  C:\Windows\System\OsMMJaG.exe
  2⤵
  PID:5340
- C:\Windows\System\bGVLUXs.exe
  C:\Windows\System\bGVLUXs.exe
  2⤵
  PID:4720
- C:\Windows\System\SOxMLoz.exe
  C:\Windows\System\SOxMLoz.exe
  2⤵
  PID:3528
- C:\Windows\System\klmtCfG.exe
  C:\Windows\System\klmtCfG.exe
  2⤵
  PID:4272
- C:\Windows\System\TurFPUn.exe
  C:\Windows\System\TurFPUn.exe
  2⤵
  PID:4992
- C:\Windows\System\vciqZkv.exe
  C:\Windows\System\vciqZkv.exe
  2⤵
  PID:5304
- C:\Windows\System\fpOjGtJ.exe
  C:\Windows\System\fpOjGtJ.exe
  2⤵
  PID:5356
- C:\Windows\System\SXINPgB.exe
  C:\Windows\System\SXINPgB.exe
  2⤵
  PID:5288
- C:\Windows\System\StLAHio.exe
  C:\Windows\System\StLAHio.exe
  2⤵
  PID:5324
- C:\Windows\System\suiWyMw.exe
  C:\Windows\System\suiWyMw.exe
  2⤵
  PID:5268
- C:\Windows\System\VHLRwcU.exe
  C:\Windows\System\VHLRwcU.exe
  2⤵
  PID:5172
- C:\Windows\System\bwoBlQg.exe
  C:\Windows\System\bwoBlQg.exe
  2⤵
  PID:5152
- C:\Windows\System\lYVcOvY.exe
  C:\Windows\System\lYVcOvY.exe
  2⤵
  PID:5468
- C:\Windows\System\nkfJCSu.exe
  C:\Windows\System\nkfJCSu.exe
  2⤵
  PID:5452
- C:\Windows\System\GfzAfMO.exe
  C:\Windows\System\GfzAfMO.exe
  2⤵
  PID:5560
- C:\Windows\System\GpqxywL.exe
  C:\Windows\System\GpqxywL.exe
  2⤵
  PID:5640
- C:\Windows\System\fUAEwGj.exe
  C:\Windows\System\fUAEwGj.exe
  2⤵
  PID:5676
- C:\Windows\System\kpvaQEj.exe
  C:\Windows\System\kpvaQEj.exe
  2⤵
  PID:5708
- C:\Windows\System\vUXXdfx.exe
  C:\Windows\System\vUXXdfx.exe
  2⤵
  PID:5656
- C:\Windows\System\UErPcqN.exe
  C:\Windows\System\UErPcqN.exe
  2⤵
  PID:5692
- C:\Windows\System\BOSeJOw.exe
  C:\Windows\System\BOSeJOw.exe
  2⤵
  PID:5728
- C:\Windows\System\pBVGpMB.exe
  C:\Windows\System\pBVGpMB.exe
  2⤵
  PID:5768
- C:\Windows\System\uOUssgM.exe
  C:\Windows\System\uOUssgM.exe
  2⤵
  PID:5800
- C:\Windows\System\DLyJzds.exe
  C:\Windows\System\DLyJzds.exe
  2⤵
  PID:5828
- C:\Windows\System\ZmxFsYP.exe
  C:\Windows\System\ZmxFsYP.exe
  2⤵
  PID:5844
- C:\Windows\System\ZNpfCsb.exe
  C:\Windows\System\ZNpfCsb.exe
  2⤵
  PID:5884
- C:\Windows\System\liMITjK.exe
  C:\Windows\System\liMITjK.exe
  2⤵
  PID:5996
- C:\Windows\System\OwyZpiC.exe
  C:\Windows\System\OwyZpiC.exe
  2⤵
  PID:5980
- C:\Windows\System\jyYVAQe.exe
  C:\Windows\System\jyYVAQe.exe
  2⤵
  PID:5860
- C:\Windows\System\SkiKvIh.exe
  C:\Windows\System\SkiKvIh.exe
  2⤵
  PID:5968
- C:\Windows\System\cYqmOeB.exe
  C:\Windows\System\cYqmOeB.exe
  2⤵
  PID:5868
- C:\Windows\System\UZnCddQ.exe
  C:\Windows\System\UZnCddQ.exe
  2⤵
  PID:6044
- C:\Windows\System\yrmdUru.exe
  C:\Windows\System\yrmdUru.exe
  2⤵
  PID:6084
- C:\Windows\System\WPcGMHE.exe
  C:\Windows\System\WPcGMHE.exe
  2⤵
  PID:6004
- C:\Windows\System\HlTwgVb.exe
  C:\Windows\System\HlTwgVb.exe
  2⤵
  PID:6012
- C:\Windows\System\wiMzfTc.exe
  C:\Windows\System\wiMzfTc.exe
  2⤵
  PID:6060
- C:\Windows\System\uJYLTOL.exe
  C:\Windows\System\uJYLTOL.exe
  2⤵
  PID:4576
- C:\Windows\System\lEZYgSn.exe
  C:\Windows\System\lEZYgSn.exe
  2⤵
  PID:5348
- C:\Windows\System\NzKhJdP.exe
  C:\Windows\System\NzKhJdP.exe
  2⤵
  PID:5380
- C:\Windows\System\TbWZryP.exe
  C:\Windows\System\TbWZryP.exe
  2⤵
  PID:5236
- C:\Windows\System\MGZHWBF.exe
  C:\Windows\System\MGZHWBF.exe
  2⤵
  PID:5168
- C:\Windows\System\oUpPDol.exe
  C:\Windows\System\oUpPDol.exe
  2⤵
  PID:4180
- C:\Windows\System\kNFpqDL.exe
  C:\Windows\System\kNFpqDL.exe
  2⤵
  PID:4332
- C:\Windows\System\BlRNIAo.exe
  C:\Windows\System\BlRNIAo.exe
  2⤵
  PID:4996
- C:\Windows\System\pRofniP.exe
  C:\Windows\System\pRofniP.exe
  2⤵
  PID:5124
- C:\Windows\System\vlIpfqG.exe
  C:\Windows\System\vlIpfqG.exe
  2⤵
  PID:4276
- C:\Windows\System\fTyOKeY.exe
  C:\Windows\System\fTyOKeY.exe
  2⤵
  PID:5140
- C:\Windows\System\XsXxFkM.exe
  C:\Windows\System\XsXxFkM.exe
  2⤵
  PID:5392
- C:\Windows\System\DmLuWLQ.exe
  C:\Windows\System\DmLuWLQ.exe
  2⤵
  PID:5404
- C:\Windows\System\nMpSzTv.exe
  C:\Windows\System\nMpSzTv.exe
  2⤵
  PID:5424
- C:\Windows\System\hHpHatY.exe
  C:\Windows\System\hHpHatY.exe
  2⤵
  PID:5484
- C:\Windows\System\JmWcIYB.exe
  C:\Windows\System\JmWcIYB.exe
  2⤵
  PID:5444
- C:\Windows\System\JZmddZt.exe
  C:\Windows\System\JZmddZt.exe
  2⤵
  PID:5432
- C:\Windows\System\rvnMCiB.exe
  C:\Windows\System\rvnMCiB.exe
  2⤵
  PID:5488
- C:\Windows\System\ZwmAelw.exe
  C:\Windows\System\ZwmAelw.exe
  2⤵
  PID:5544
- C:\Windows\System\LdCrxCk.exe
  C:\Windows\System\LdCrxCk.exe
  2⤵
  PID:5624
- C:\Windows\System\dyCZUzs.exe
  C:\Windows\System\dyCZUzs.exe
  2⤵
  PID:5784
- C:\Windows\System\BJOmILy.exe
  C:\Windows\System\BJOmILy.exe
  2⤵
  PID:5824
- C:\Windows\System\SHLsJGj.exe
  C:\Windows\System\SHLsJGj.exe
  2⤵
  PID:5944
- C:\Windows\System\Cwvcdnp.exe
  C:\Windows\System\Cwvcdnp.exe
  2⤵
  PID:6080
- C:\Windows\System\CSrHKuB.exe
  C:\Windows\System\CSrHKuB.exe
  2⤵
  PID:5096
- C:\Windows\System\OJbjONS.exe
  C:\Windows\System\OJbjONS.exe
  2⤵
  PID:5252
- C:\Windows\System\KpvGcTl.exe
  C:\Windows\System\KpvGcTl.exe
  2⤵
  PID:5592
- C:\Windows\System\sseaVle.exe
  C:\Windows\System\sseaVle.exe
  2⤵
  PID:5680
- C:\Windows\System\LEcNugt.exe
  C:\Windows\System\LEcNugt.exe
  2⤵
  PID:5320
- C:\Windows\System\nfKMzqt.exe
  C:\Windows\System\nfKMzqt.exe
  2⤵
  PID:5848
- C:\Windows\System\FrcHXsB.exe
  C:\Windows\System\FrcHXsB.exe
  2⤵
  PID:5916
- C:\Windows\System\tspVFGF.exe
  C:\Windows\System\tspVFGF.exe
  2⤵
  PID:6008
- C:\Windows\System\YBJfvHl.exe
  C:\Windows\System\YBJfvHl.exe
  2⤵
  PID:4172
- C:\Windows\System\fRcrsTp.exe
  C:\Windows\System\fRcrsTp.exe
  2⤵
  PID:5608
- C:\Windows\System\dfFBWSx.exe
  C:\Windows\System\dfFBWSx.exe
  2⤵
  PID:4140
- C:\Windows\System\NCUVpxs.exe
  C:\Windows\System\NCUVpxs.exe
  2⤵
  PID:5416
- C:\Windows\System\hubVgpP.exe
  C:\Windows\System\hubVgpP.exe
  2⤵
  PID:5796
- C:\Windows\System\pzhExXD.exe
  C:\Windows\System\pzhExXD.exe
  2⤵
  PID:5112
- C:\Windows\System\WhRTBiN.exe
  C:\Windows\System\WhRTBiN.exe
  2⤵
  PID:4780
- C:\Windows\System\jNLeQSp.exe
  C:\Windows\System\jNLeQSp.exe
  2⤵
  PID:5156
- C:\Windows\System\bkNZGMw.exe
  C:\Windows\System\bkNZGMw.exe
  2⤵
  PID:5880
- C:\Windows\System\DbTNqBm.exe
  C:\Windows\System\DbTNqBm.exe
  2⤵
  PID:5408
- C:\Windows\System\mMjpnYi.exe
  C:\Windows\System\mMjpnYi.exe
  2⤵
  PID:6016
- C:\Windows\System\pdekCwY.exe
  C:\Windows\System\pdekCwY.exe
  2⤵
  PID:5208
- C:\Windows\System\nwALFJO.exe
  C:\Windows\System\nwALFJO.exe
  2⤵
  PID:5384
- C:\Windows\System\HIdUnmF.exe
  C:\Windows\System\HIdUnmF.exe
  2⤵
  PID:5984
- C:\Windows\System\ifkpCoR.exe
  C:\Windows\System\ifkpCoR.exe
  2⤵
  PID:5240
- C:\Windows\System\WbzvTrO.exe
  C:\Windows\System\WbzvTrO.exe
  2⤵
  PID:5864
- C:\Windows\System\CXGzaBl.exe
  C:\Windows\System\CXGzaBl.exe
  2⤵
  PID:6156
- C:\Windows\System\fyxklPN.exe
  C:\Windows\System\fyxklPN.exe
  2⤵
  PID:6172
- C:\Windows\System\ZhmDFYC.exe
  C:\Windows\System\ZhmDFYC.exe
  2⤵
  PID:6188
- C:\Windows\System\CEEDSuy.exe
  C:\Windows\System\CEEDSuy.exe
  2⤵
  PID:6204
- C:\Windows\System\fKaNSVM.exe
  C:\Windows\System\fKaNSVM.exe
  2⤵
  PID:6220
- C:\Windows\System\vYukNEt.exe
  C:\Windows\System\vYukNEt.exe
  2⤵
  PID:6240
- C:\Windows\System\FkPHMQR.exe
  C:\Windows\System\FkPHMQR.exe
  2⤵
  PID:6264
- C:\Windows\System\xTCUgJv.exe
  C:\Windows\System\xTCUgJv.exe
  2⤵
  PID:6288
- C:\Windows\System\rBWRKGJ.exe
  C:\Windows\System\rBWRKGJ.exe
  2⤵
  PID:6304
- C:\Windows\System\JhNrOLU.exe
  C:\Windows\System\JhNrOLU.exe
  2⤵
  PID:6320
- C:\Windows\System\sssKaFP.exe
  C:\Windows\System\sssKaFP.exe
  2⤵
  PID:6336
- C:\Windows\System\SzgmNDB.exe
  C:\Windows\System\SzgmNDB.exe
  2⤵
  PID:6352
- C:\Windows\System\PrpxywM.exe
  C:\Windows\System\PrpxywM.exe
  2⤵
  PID:6368
- C:\Windows\System\SYVndPy.exe
  C:\Windows\System\SYVndPy.exe
  2⤵
  PID:6384
- C:\Windows\System\EQYqUFo.exe
  C:\Windows\System\EQYqUFo.exe
  2⤵
  PID:6400
- C:\Windows\System\nPQgdsl.exe
  C:\Windows\System\nPQgdsl.exe
  2⤵
  PID:6416
- C:\Windows\System\yecQEsQ.exe
  C:\Windows\System\yecQEsQ.exe
  2⤵
  PID:6432
- C:\Windows\System\yZxBAHI.exe
  C:\Windows\System\yZxBAHI.exe
  2⤵
  PID:6448
- C:\Windows\System\XZYbeSW.exe
  C:\Windows\System\XZYbeSW.exe
  2⤵
  PID:6464
- C:\Windows\System\tMMcWlN.exe
  C:\Windows\System\tMMcWlN.exe
  2⤵
  PID:6480
- C:\Windows\System\tIiBiRG.exe
  C:\Windows\System\tIiBiRG.exe
  2⤵
  PID:6496
- C:\Windows\System\hfuDySn.exe
  C:\Windows\System\hfuDySn.exe
  2⤵
  PID:6512
- C:\Windows\System\mKHvJVd.exe
  C:\Windows\System\mKHvJVd.exe
  2⤵
  PID:6532
- C:\Windows\System\VormRKU.exe
  C:\Windows\System\VormRKU.exe
  2⤵
  PID:6548
- C:\Windows\System\QJrRmDT.exe
  C:\Windows\System\QJrRmDT.exe
  2⤵
  PID:6564
- C:\Windows\System\tuBlzDg.exe
  C:\Windows\System\tuBlzDg.exe
  2⤵
  PID:6580
- C:\Windows\System\VpqhpBq.exe
  C:\Windows\System\VpqhpBq.exe
  2⤵
  PID:6596
- C:\Windows\System\zpXxAQB.exe
  C:\Windows\System\zpXxAQB.exe
  2⤵
  PID:6612
- C:\Windows\System\UxnVIxr.exe
  C:\Windows\System\UxnVIxr.exe
  2⤵
  PID:6628
- C:\Windows\System\baSwFOq.exe
  C:\Windows\System\baSwFOq.exe
  2⤵
  PID:6644
- C:\Windows\System\zQvbLpw.exe
  C:\Windows\System\zQvbLpw.exe
  2⤵
  PID:6660
- C:\Windows\System\hGbVmPQ.exe
  C:\Windows\System\hGbVmPQ.exe
  2⤵
  PID:6680
- C:\Windows\System\RUIsrjk.exe
  C:\Windows\System\RUIsrjk.exe
  2⤵
  PID:6696
- C:\Windows\System\qYLyTRF.exe
  C:\Windows\System\qYLyTRF.exe
  2⤵
  PID:6712
- C:\Windows\System\JCLqFly.exe
  C:\Windows\System\JCLqFly.exe
  2⤵
  PID:6728
- C:\Windows\System\ykKbsOR.exe
  C:\Windows\System\ykKbsOR.exe
  2⤵
  PID:6744
- C:\Windows\System\evYvBeW.exe
  C:\Windows\System\evYvBeW.exe
  2⤵
  PID:6760
- C:\Windows\System\myZZlyP.exe
  C:\Windows\System\myZZlyP.exe
  2⤵
  PID:6776
- C:\Windows\System\wNKjhgT.exe
  C:\Windows\System\wNKjhgT.exe
  2⤵
  PID:6792
- C:\Windows\System\ufRjlSC.exe
  C:\Windows\System\ufRjlSC.exe
  2⤵
  PID:6808
- C:\Windows\System\qQCMqth.exe
  C:\Windows\System\qQCMqth.exe
  2⤵
  PID:6824
- C:\Windows\System\TPsJsuD.exe
  C:\Windows\System\TPsJsuD.exe
  2⤵
  PID:6840
- C:\Windows\System\QWRBwYB.exe
  C:\Windows\System\QWRBwYB.exe
  2⤵
  PID:6860
- C:\Windows\System\nGnLgZB.exe
  C:\Windows\System\nGnLgZB.exe
  2⤵
  PID:6876
- C:\Windows\System\FTxguhP.exe
  C:\Windows\System\FTxguhP.exe
  2⤵
  PID:6892
- C:\Windows\System\lFbKGKn.exe
  C:\Windows\System\lFbKGKn.exe
  2⤵
  PID:6908
- C:\Windows\System\ykisPrd.exe
  C:\Windows\System\ykisPrd.exe
  2⤵
  PID:6924
- C:\Windows\System\nGRDqGw.exe
  C:\Windows\System\nGRDqGw.exe
  2⤵
  PID:6940
- C:\Windows\System\boTuNAo.exe
  C:\Windows\System\boTuNAo.exe
  2⤵
  PID:6960
- C:\Windows\System\ZIsHpAO.exe
  C:\Windows\System\ZIsHpAO.exe
  2⤵
  PID:6976
- C:\Windows\System\LseCcns.exe
  C:\Windows\System\LseCcns.exe
  2⤵
  PID:6992
- C:\Windows\System\GRDyEXu.exe
  C:\Windows\System\GRDyEXu.exe
  2⤵
  PID:7008
- C:\Windows\System\kNlIHLq.exe
  C:\Windows\System\kNlIHLq.exe
  2⤵
  PID:7024
- C:\Windows\System\cckoQRp.exe
  C:\Windows\System\cckoQRp.exe
  2⤵
  PID:7040
- C:\Windows\System\minaayw.exe
  C:\Windows\System\minaayw.exe
  2⤵
  PID:7056
- C:\Windows\System\XzxNGEJ.exe
  C:\Windows\System\XzxNGEJ.exe
  2⤵
  PID:7072
- C:\Windows\System\fcwDSrJ.exe
  C:\Windows\System\fcwDSrJ.exe
  2⤵
  PID:7088
- C:\Windows\System\Ahdvpct.exe
  C:\Windows\System\Ahdvpct.exe
  2⤵
  PID:7108
- C:\Windows\System\OjIZhxK.exe
  C:\Windows\System\OjIZhxK.exe
  2⤵
  PID:7124
- C:\Windows\System\iWicnxJ.exe
  C:\Windows\System\iWicnxJ.exe
  2⤵
  PID:7140
- C:\Windows\System\sFGWArC.exe
  C:\Windows\System\sFGWArC.exe
  2⤵
  PID:7156
- C:\Windows\System\AzeDbGu.exe
  C:\Windows\System\AzeDbGu.exe
  2⤵
  PID:6032
- C:\Windows\System\AOkAAqX.exe
  C:\Windows\System\AOkAAqX.exe
  2⤵
  PID:5460
- C:\Windows\System\YwcBhJu.exe
  C:\Windows\System\YwcBhJu.exe
  2⤵
  PID:4656
- C:\Windows\System\CQSwhXH.exe
  C:\Windows\System\CQSwhXH.exe
  2⤵
  PID:5204
- C:\Windows\System\GSsJkPZ.exe
  C:\Windows\System\GSsJkPZ.exe
  2⤵
  PID:4872
- C:\Windows\System\VCRdNwk.exe
  C:\Windows\System\VCRdNwk.exe
  2⤵
  PID:5436
- C:\Windows\System\YuVWutZ.exe
  C:\Windows\System\YuVWutZ.exe
  2⤵
  PID:5352
- C:\Windows\System\jxpJqFI.exe
  C:\Windows\System\jxpJqFI.exe
  2⤵
  PID:6184
- C:\Windows\System\jnzCumM.exe
  C:\Windows\System\jnzCumM.exe
  2⤵
  PID:6252
- C:\Windows\System\pftEFvl.exe
  C:\Windows\System\pftEFvl.exe
  2⤵
  PID:6164
- C:\Windows\System\IsEzSQg.exe
  C:\Windows\System\IsEzSQg.exe
  2⤵
  PID:5932
- C:\Windows\System\lUtWVDm.exe
  C:\Windows\System\lUtWVDm.exe
  2⤵
  PID:6276
- C:\Windows\System\QXmTvCo.exe
  C:\Windows\System\QXmTvCo.exe
  2⤵
  PID:6284
- C:\Windows\System\UnOOKwR.exe
  C:\Windows\System\UnOOKwR.exe
  2⤵
  PID:6280
- C:\Windows\System\bZpQiMk.exe
  C:\Windows\System\bZpQiMk.exe
  2⤵
  PID:6428
- C:\Windows\System\ZxppLeu.exe
  C:\Windows\System\ZxppLeu.exe
  2⤵
  PID:6492
- C:\Windows\System\KyBRvRF.exe
  C:\Windows\System\KyBRvRF.exe
  2⤵
  PID:6556
- C:\Windows\System\xDYNBKO.exe
  C:\Windows\System\xDYNBKO.exe
  2⤵
  PID:6316
- C:\Windows\System\IOFYSWa.exe
  C:\Windows\System\IOFYSWa.exe
  2⤵
  PID:6380
- C:\Windows\System\YjPaRsy.exe
  C:\Windows\System\YjPaRsy.exe
  2⤵
  PID:6652
- C:\Windows\System\YXEhmvh.exe
  C:\Windows\System\YXEhmvh.exe
  2⤵
  PID:6720
- C:\Windows\System\qwozNnl.exe
  C:\Windows\System\qwozNnl.exe
  2⤵
  PID:6476
- C:\Windows\System\qhFDpHR.exe
  C:\Windows\System\qhFDpHR.exe
  2⤵
  PID:6820
- C:\Windows\System\uwUbAiq.exe
  C:\Windows\System\uwUbAiq.exe
  2⤵
  PID:6544
- C:\Windows\System\XCKFyfz.exe
  C:\Windows\System\XCKFyfz.exe
  2⤵
  PID:6540
- C:\Windows\System\fcNzJiJ.exe
  C:\Windows\System\fcNzJiJ.exe
  2⤵
  PID:6856
- C:\Windows\System\ROTdgws.exe
  C:\Windows\System\ROTdgws.exe
  2⤵
  PID:6472
- C:\Windows\System\OYXzMEy.exe
  C:\Windows\System\OYXzMEy.exe
  2⤵
  PID:6504
- C:\Windows\System\IgbRNgp.exe
  C:\Windows\System\IgbRNgp.exe
  2⤵
  PID:7148
- C:\Windows\System\cZNCPwM.exe
  C:\Windows\System\cZNCPwM.exe
  2⤵
  PID:5772
- C:\Windows\System\BZOaXqQ.exe
  C:\Windows\System\BZOaXqQ.exe
  2⤵
  PID:5788
- C:\Windows\System\dhLrJna.exe
  C:\Windows\System\dhLrJna.exe
  2⤵
  PID:6260
- C:\Windows\System\mJYsPEb.exe
  C:\Windows\System\mJYsPEb.exe
  2⤵
  PID:6076
- C:\Windows\System\wVKNZXQ.exe
  C:\Windows\System\wVKNZXQ.exe
  2⤵
  PID:6672
- C:\Windows\System\aJKBjPy.exe
  C:\Windows\System\aJKBjPy.exe
  2⤵
  PID:6708
- C:\Windows\System\kzyANcN.exe
  C:\Windows\System\kzyANcN.exe
  2⤵
  PID:6804
- C:\Windows\System\RSQWToR.exe
  C:\Windows\System\RSQWToR.exe
  2⤵
  PID:6488
- C:\Windows\System\RCRIelw.exe
  C:\Windows\System\RCRIelw.exe
  2⤵
  PID:1092
- C:\Windows\System\jwllJkr.exe
  C:\Windows\System\jwllJkr.exe
  2⤵
  PID:5716
- C:\Windows\System\ALsskwZ.exe
  C:\Windows\System\ALsskwZ.exe
  2⤵
  PID:6904
- C:\Windows\System\yffhVrh.exe
  C:\Windows\System\yffhVrh.exe
  2⤵
  PID:7000
- C:\Windows\System\MohEtlU.exe
  C:\Windows\System\MohEtlU.exe
  2⤵
  PID:7132
- C:\Windows\System\tXGdwRb.exe
  C:\Windows\System\tXGdwRb.exe
  2⤵
  PID:5752
- C:\Windows\System\yHsmPvL.exe
  C:\Windows\System\yHsmPvL.exe
  2⤵
  PID:6232
- C:\Windows\System\cTRfNvx.exe
  C:\Windows\System\cTRfNvx.exe
  2⤵
  PID:6424
- C:\Windows\System\fGwmTlZ.exe
  C:\Windows\System\fGwmTlZ.exe
  2⤵
  PID:6376
- C:\Windows\System\tnnBHmp.exe
  C:\Windows\System\tnnBHmp.exe
  2⤵
  PID:6688
- C:\Windows\System\oodXgfN.exe
  C:\Windows\System\oodXgfN.exe
  2⤵
  PID:6692
- C:\Windows\System\BDjhXVc.exe
  C:\Windows\System\BDjhXVc.exe
  2⤵
  PID:6412
- C:\Windows\System\SthNZDm.exe
  C:\Windows\System\SthNZDm.exe
  2⤵
  PID:6872
- C:\Windows\System\NKjNalv.exe
  C:\Windows\System\NKjNalv.exe
  2⤵
  PID:6444
- C:\Windows\System\pHQGSrR.exe
  C:\Windows\System\pHQGSrR.exe
  2⤵
  PID:7016
- C:\Windows\System\PBSitkz.exe
  C:\Windows\System\PBSitkz.exe
  2⤵
  PID:6852
- C:\Windows\System\fmdvZkz.exe
  C:\Windows\System\fmdvZkz.exe
  2⤵
  PID:7096
- C:\Windows\System\qNmcwch.exe
  C:\Windows\System\qNmcwch.exe
  2⤵
  PID:5420
- C:\Windows\System\YaoDFqU.exe
  C:\Windows\System\YaoDFqU.exe
  2⤵
  PID:6704
- C:\Windows\System\KFOUgMr.exe
  C:\Windows\System\KFOUgMr.exe
  2⤵
  PID:5364
- C:\Windows\System\gUMaRbx.exe
  C:\Windows\System\gUMaRbx.exe
  2⤵
  PID:6752
- C:\Windows\System\oAHkmuc.exe
  C:\Windows\System\oAHkmuc.exe
  2⤵
  PID:4428
- C:\Windows\System\GnHyUMh.exe
  C:\Windows\System\GnHyUMh.exe
  2⤵
  PID:7048
- C:\Windows\System\lAUQiYc.exe
  C:\Windows\System\lAUQiYc.exe
  2⤵
  PID:6328
- C:\Windows\System\fMfkmmt.exe
  C:\Windows\System\fMfkmmt.exe
  2⤵
  PID:6312
- C:\Windows\System\JPdiIAp.exe
  C:\Windows\System\JPdiIAp.exe
  2⤵
  PID:7068
- C:\Windows\System\yRuvqGp.exe
  C:\Windows\System\yRuvqGp.exe
  2⤵
  PID:5016
- C:\Windows\System\klDLvNr.exe
  C:\Windows\System\klDLvNr.exe
  2⤵
  PID:6636
- C:\Windows\System\ARcwXjn.exe
  C:\Windows\System\ARcwXjn.exe
  2⤵
  PID:6888
- C:\Windows\System\jHQXeaz.exe
  C:\Windows\System\jHQXeaz.exe
  2⤵
  PID:7080
- C:\Windows\System\EhliwjW.exe
  C:\Windows\System\EhliwjW.exe
  2⤵
  PID:7172
- C:\Windows\System\dcvttyZ.exe
  C:\Windows\System\dcvttyZ.exe
  2⤵
  PID:7192
- C:\Windows\System\lpyLYEm.exe
  C:\Windows\System\lpyLYEm.exe
  2⤵
  PID:7208
- C:\Windows\System\dnKqPbr.exe
  C:\Windows\System\dnKqPbr.exe
  2⤵
  PID:7224
- C:\Windows\System\rpGgcqU.exe
  C:\Windows\System\rpGgcqU.exe
  2⤵
  PID:7244
- C:\Windows\System\yeXgTau.exe
  C:\Windows\System\yeXgTau.exe
  2⤵
  PID:7260
- C:\Windows\System\HZkpMhL.exe
  C:\Windows\System\HZkpMhL.exe
  2⤵
  PID:7276
- C:\Windows\System\QPvBGDd.exe
  C:\Windows\System\QPvBGDd.exe
  2⤵
  PID:7292
- C:\Windows\System\tePtghB.exe
  C:\Windows\System\tePtghB.exe
  2⤵
  PID:7308
- C:\Windows\System\HYVOzWD.exe
  C:\Windows\System\HYVOzWD.exe
  2⤵
  PID:7324
- C:\Windows\System\SMLZnfy.exe
  C:\Windows\System\SMLZnfy.exe
  2⤵
  PID:7344
- C:\Windows\System\KeVvjfR.exe
  C:\Windows\System\KeVvjfR.exe
  2⤵
  PID:7360
- C:\Windows\System\cNrrXzw.exe
  C:\Windows\System\cNrrXzw.exe
  2⤵
  PID:7376
- C:\Windows\System\AYlpFtX.exe
  C:\Windows\System\AYlpFtX.exe
  2⤵
  PID:7396
- C:\Windows\System\EjoFjeK.exe
  C:\Windows\System\EjoFjeK.exe
  2⤵
  PID:7412
- C:\Windows\System\sTPLlkC.exe
  C:\Windows\System\sTPLlkC.exe
  2⤵
  PID:7428
- C:\Windows\System\FUyIsOS.exe
  C:\Windows\System\FUyIsOS.exe
  2⤵
  PID:7448
- C:\Windows\System\urMzMjK.exe
  C:\Windows\System\urMzMjK.exe
  2⤵
  PID:7464
- C:\Windows\System\GOerEdg.exe
  C:\Windows\System\GOerEdg.exe
  2⤵
  PID:7484
- C:\Windows\System\BLOYxLH.exe
  C:\Windows\System\BLOYxLH.exe
  2⤵
  PID:7504
- C:\Windows\System\gSUzazq.exe
  C:\Windows\System\gSUzazq.exe
  2⤵
  PID:7520
- C:\Windows\System\VNzcmpB.exe
  C:\Windows\System\VNzcmpB.exe
  2⤵
  PID:7536
- C:\Windows\System\LiiLNFr.exe
  C:\Windows\System\LiiLNFr.exe
  2⤵
  PID:7556
- C:\Windows\System\iSBwayX.exe
  C:\Windows\System\iSBwayX.exe
  2⤵
  PID:7572
- C:\Windows\System\SYmHAmG.exe
  C:\Windows\System\SYmHAmG.exe
  2⤵
  PID:7588
- C:\Windows\System\YUXotyy.exe
  C:\Windows\System\YUXotyy.exe
  2⤵
  PID:7604
- C:\Windows\System\kUxHnvJ.exe
  C:\Windows\System\kUxHnvJ.exe
  2⤵
  PID:7620
- C:\Windows\System\WiGwrns.exe
  C:\Windows\System\WiGwrns.exe
  2⤵
  PID:7640
- C:\Windows\System\nECgIOd.exe
  C:\Windows\System\nECgIOd.exe
  2⤵
  PID:7656
- C:\Windows\System\DYkhlPW.exe
  C:\Windows\System\DYkhlPW.exe
  2⤵
  PID:7672
- C:\Windows\System\MLoboTf.exe
  C:\Windows\System\MLoboTf.exe
  2⤵
  PID:7688
- C:\Windows\System\zhqwzXQ.exe
  C:\Windows\System\zhqwzXQ.exe
  2⤵
  PID:7704
- C:\Windows\System\KeThwjL.exe
  C:\Windows\System\KeThwjL.exe
  2⤵
  PID:7720
- C:\Windows\System\ADDKugt.exe
  C:\Windows\System\ADDKugt.exe
  2⤵
  PID:7740
- C:\Windows\System\WQJhSxG.exe
  C:\Windows\System\WQJhSxG.exe
  2⤵
  PID:7756
- C:\Windows\System\vDskihT.exe
  C:\Windows\System\vDskihT.exe
  2⤵
  PID:7776
- C:\Windows\System\ywJMCfn.exe
  C:\Windows\System\ywJMCfn.exe
  2⤵
  PID:7792
- C:\Windows\System\MExXfyd.exe
  C:\Windows\System\MExXfyd.exe
  2⤵
  PID:7808
- C:\Windows\System\IPvCiLb.exe
  C:\Windows\System\IPvCiLb.exe
  2⤵
  PID:7828
- C:\Windows\System\exMKuQT.exe
  C:\Windows\System\exMKuQT.exe
  2⤵
  PID:7844
- C:\Windows\System\vyOYFCD.exe
  C:\Windows\System\vyOYFCD.exe
  2⤵
  PID:7860
- C:\Windows\System\CVtocBl.exe
  C:\Windows\System\CVtocBl.exe
  2⤵
  PID:7876
- C:\Windows\System\bEmGwuU.exe
  C:\Windows\System\bEmGwuU.exe
  2⤵
  PID:7892
- C:\Windows\System\mdDQnWm.exe
  C:\Windows\System\mdDQnWm.exe
  2⤵
  PID:7908
- C:\Windows\System\zUWdVYn.exe
  C:\Windows\System\zUWdVYn.exe
  2⤵
  PID:7924
- C:\Windows\System\FRzxzXS.exe
  C:\Windows\System\FRzxzXS.exe
  2⤵
  PID:7940
- C:\Windows\System\QjnQfKJ.exe
  C:\Windows\System\QjnQfKJ.exe
  2⤵
  PID:7956
- C:\Windows\System\NEWqBlZ.exe
  C:\Windows\System\NEWqBlZ.exe
  2⤵
  PID:7972
- C:\Windows\System\FOpgJxA.exe
  C:\Windows\System\FOpgJxA.exe
  2⤵
  PID:7988
- C:\Windows\System\SBJlHQX.exe
  C:\Windows\System\SBJlHQX.exe
  2⤵
  PID:8008
- C:\Windows\System\zrFGpht.exe
  C:\Windows\System\zrFGpht.exe
  2⤵
  PID:8024
- C:\Windows\System\RgdPUjB.exe
  C:\Windows\System\RgdPUjB.exe
  2⤵
  PID:8040
- C:\Windows\System\wZppGxO.exe
  C:\Windows\System\wZppGxO.exe
  2⤵
  PID:8056
- C:\Windows\System\HKkKBeI.exe
  C:\Windows\System\HKkKBeI.exe
  2⤵
  PID:8076
- C:\Windows\System\pymDfEH.exe
  C:\Windows\System\pymDfEH.exe
  2⤵
  PID:8092
- C:\Windows\System\VnUqaYg.exe
  C:\Windows\System\VnUqaYg.exe
  2⤵
  PID:8112
- C:\Windows\System\zLiWJwB.exe
  C:\Windows\System\zLiWJwB.exe
  2⤵
  PID:8128
- C:\Windows\System\vNBRqXb.exe
  C:\Windows\System\vNBRqXb.exe
  2⤵
  PID:8144
- C:\Windows\System\VskHurg.exe
  C:\Windows\System\VskHurg.exe
  2⤵
  PID:8160
- C:\Windows\System\HrwIyiK.exe
  C:\Windows\System\HrwIyiK.exe
  2⤵
  PID:8176
- C:\Windows\System\IzHsmAb.exe
  C:\Windows\System\IzHsmAb.exe
  2⤵
  PID:6364
- C:\Windows\System\LwYJwqr.exe
  C:\Windows\System\LwYJwqr.exe
  2⤵
  PID:6772
- C:\Windows\System\jFolmqY.exe
  C:\Windows\System\jFolmqY.exe
  2⤵
  PID:5512
- C:\Windows\System\GlkApIz.exe
  C:\Windows\System\GlkApIz.exe
  2⤵
  PID:7036
- C:\Windows\System\lGAmHwE.exe
  C:\Windows\System\lGAmHwE.exe
  2⤵
  PID:7232
- C:\Windows\System\hUhEppE.exe
  C:\Windows\System\hUhEppE.exe
  2⤵
  PID:7272
- C:\Windows\System\abJLBBj.exe
  C:\Windows\System\abJLBBj.exe
  2⤵
  PID:7368
- C:\Windows\System\AxjPAum.exe
  C:\Windows\System\AxjPAum.exe
  2⤵
  PID:7436
- C:\Windows\System\focpFnk.exe
  C:\Windows\System\focpFnk.exe
  2⤵
  PID:7476
- C:\Windows\System\bJboZQt.exe
  C:\Windows\System\bJboZQt.exe
  2⤵
  PID:6216
- C:\Windows\System\zEGrnsT.exe
  C:\Windows\System\zEGrnsT.exe
  2⤵
  PID:6968
- C:\Windows\System\lRcmYip.exe
  C:\Windows\System\lRcmYip.exe
  2⤵
  PID:7552
- C:\Windows\System\IFRgYqR.exe
  C:\Windows\System\IFRgYqR.exe
  2⤵
  PID:7580
- C:\Windows\System\nbpcOxZ.exe
  C:\Windows\System\nbpcOxZ.exe
  2⤵
  PID:7284
- C:\Windows\System\AyBbUqH.exe
  C:\Windows\System\AyBbUqH.exe
  2⤵
  PID:7456
- C:\Windows\System\QAtmWQA.exe
  C:\Windows\System\QAtmWQA.exe
  2⤵
  PID:6952
- C:\Windows\System\XUnIJFW.exe
  C:\Windows\System\XUnIJFW.exe
  2⤵
  PID:7188
- C:\Windows\System\gOQGwXl.exe
  C:\Windows\System\gOQGwXl.exe
  2⤵
  PID:7316
- C:\Windows\System\ZGYiFXs.exe
  C:\Windows\System\ZGYiFXs.exe
  2⤵
  PID:7392
- C:\Windows\System\OKoSPqO.exe
  C:\Windows\System\OKoSPqO.exe
  2⤵
  PID:7492
- C:\Windows\System\JBdcCCc.exe
  C:\Windows\System\JBdcCCc.exe
  2⤵
  PID:7568
- C:\Windows\System\RKClbfu.exe
  C:\Windows\System\RKClbfu.exe
  2⤵
  PID:7612
- C:\Windows\System\mGxLlSa.exe
  C:\Windows\System\mGxLlSa.exe
  2⤵
  PID:7652
- C:\Windows\System\bQnpZlC.exe
  C:\Windows\System\bQnpZlC.exe
  2⤵
  PID:7716
- C:\Windows\System\vLSWhky.exe
  C:\Windows\System\vLSWhky.exe
  2⤵
  PID:7752
- C:\Windows\System\dYWdLyQ.exe
  C:\Windows\System\dYWdLyQ.exe
  2⤵
  PID:7700
- C:\Windows\System\dcrBrmG.exe
  C:\Windows\System\dcrBrmG.exe
  2⤵
  PID:7772
- C:\Windows\System\gAgNqoi.exe
  C:\Windows\System\gAgNqoi.exe
  2⤵
  PID:7696
- C:\Windows\System\dQMAICX.exe
  C:\Windows\System\dQMAICX.exe
  2⤵
  PID:7800
- C:\Windows\System\oHROBQv.exe
  C:\Windows\System\oHROBQv.exe
  2⤵
  PID:7856
- C:\Windows\System\kUyPGmC.exe
  C:\Windows\System\kUyPGmC.exe
  2⤵
  PID:7872
- C:\Windows\System\CPALHlW.exe
  C:\Windows\System\CPALHlW.exe
  2⤵
  PID:7948
- C:\Windows\System\RhaoSlv.exe
  C:\Windows\System\RhaoSlv.exe
  2⤵
  PID:8016
- C:\Windows\System\IrdDYRq.exe
  C:\Windows\System\IrdDYRq.exe
  2⤵
  PID:8052
- C:\Windows\System\yUxvoxb.exe
  C:\Windows\System\yUxvoxb.exe
  2⤵
  PID:8064
- C:\Windows\System\YIbOCfi.exe
  C:\Windows\System\YIbOCfi.exe
  2⤵
  PID:8124
- C:\Windows\System\iWAfUvj.exe
  C:\Windows\System\iWAfUvj.exe
  2⤵
  PID:8188
- C:\Windows\System\AirtPfw.exe
  C:\Windows\System\AirtPfw.exe
  2⤵
  PID:7936
- C:\Windows\System\HIeFdqv.exe
  C:\Windows\System\HIeFdqv.exe
  2⤵
  PID:7996
- C:\Windows\System\afToHfZ.exe
  C:\Windows\System\afToHfZ.exe
  2⤵
  PID:8036
- C:\Windows\System\VcRDqSQ.exe
  C:\Windows\System\VcRDqSQ.exe
  2⤵
  PID:8072
- C:\Windows\System\shrNxLr.exe
  C:\Windows\System\shrNxLr.exe
  2⤵
  PID:8108
- C:\Windows\System\xOVdbML.exe
  C:\Windows\System\xOVdbML.exe
  2⤵
  PID:7120
- C:\Windows\System\LmAbyfT.exe
  C:\Windows\System\LmAbyfT.exe
  2⤵
  PID:7268
- C:\Windows\System\oljJroI.exe
  C:\Windows\System\oljJroI.exe
  2⤵
  PID:7472
- C:\Windows\System\wtabWLy.exe
  C:\Windows\System\wtabWLy.exe
  2⤵
  PID:7064
- C:\Windows\System\DAxGkvz.exe
  C:\Windows\System\DAxGkvz.exe
  2⤵
  PID:7404
- C:\Windows\System\RjHxzMR.exe
  C:\Windows\System\RjHxzMR.exe
  2⤵
  PID:7408
- C:\Windows\System\ahcKQyM.exe
  C:\Windows\System\ahcKQyM.exe
  2⤵
  PID:6180
- C:\Windows\System\CXWHNie.exe
  C:\Windows\System\CXWHNie.exe
  2⤵
  PID:7180
- C:\Windows\System\NRIsluu.exe
  C:\Windows\System\NRIsluu.exe
  2⤵
  PID:7532
- C:\Windows\System\MYjyeNC.exe
  C:\Windows\System\MYjyeNC.exe
  2⤵
  PID:7768
- C:\Windows\System\wdqqUch.exe
  C:\Windows\System\wdqqUch.exe
  2⤵
  PID:7840
- C:\Windows\System\pmxqIZz.exe
  C:\Windows\System\pmxqIZz.exe
  2⤵
  PID:8088
- C:\Windows\System\TWvJPzP.exe
  C:\Windows\System\TWvJPzP.exe
  2⤵
  PID:7964
- C:\Windows\System\yEsLRob.exe
  C:\Windows\System\yEsLRob.exe
  2⤵
  PID:8168
- C:\Windows\System\hDkGpIj.exe
  C:\Windows\System\hDkGpIj.exe
  2⤵
  PID:7388
- C:\Windows\System\iHOtmaK.exe
  C:\Windows\System\iHOtmaK.exe
  2⤵
  PID:7384
- C:\Windows\System\VAGdHev.exe
  C:\Windows\System\VAGdHev.exe
  2⤵
  PID:7252
- C:\Windows\System\bMqEvSv.exe
  C:\Windows\System\bMqEvSv.exe
  2⤵
  PID:7616
- C:\Windows\System\PbgkwNU.exe
  C:\Windows\System\PbgkwNU.exe
  2⤵
  PID:7664
- C:\Windows\System\OZccZjJ.exe
  C:\Windows\System\OZccZjJ.exe
  2⤵
  PID:7916
- C:\Windows\System\LtXQVxf.exe
  C:\Windows\System\LtXQVxf.exe
  2⤵
  PID:8032
- C:\Windows\System\YAXEBVc.exe
  C:\Windows\System\YAXEBVc.exe
  2⤵
  PID:8004
- C:\Windows\System\nXSYWLt.exe
  C:\Windows\System\nXSYWLt.exe
  2⤵
  PID:7084
- C:\Windows\System\ZIUMmNk.exe
  C:\Windows\System\ZIUMmNk.exe
  2⤵
  PID:7516
- C:\Windows\System\ZxQPuwv.exe
  C:\Windows\System\ZxQPuwv.exe
  2⤵
  PID:7628
- C:\Windows\System\CZzYfaK.exe
  C:\Windows\System\CZzYfaK.exe
  2⤵
  PID:7984
- C:\Windows\System\pMqDgUu.exe
  C:\Windows\System\pMqDgUu.exe
  2⤵
  PID:7340
- C:\Windows\System\ducLAJv.exe
  C:\Windows\System\ducLAJv.exe
  2⤵
  PID:7460
- C:\Windows\System\smNSFdo.exe
  C:\Windows\System\smNSFdo.exe
  2⤵
  PID:8068
- C:\Windows\System\yOryqAi.exe
  C:\Windows\System\yOryqAi.exe
  2⤵
  PID:7584
- C:\Windows\System\YFICdsX.exe
  C:\Windows\System\YFICdsX.exe
  2⤵
  PID:8104
- C:\Windows\System\DxGxLYV.exe
  C:\Windows\System\DxGxLYV.exe
  2⤵
  PID:7548
- C:\Windows\System\WHDruak.exe
  C:\Windows\System\WHDruak.exe
  2⤵
  PID:7668
- C:\Windows\System\CNnuKhZ.exe
  C:\Windows\System\CNnuKhZ.exe
  2⤵
  PID:7784
- C:\Windows\System\mAGFVxn.exe
  C:\Windows\System\mAGFVxn.exe
  2⤵
  PID:7444
- C:\Windows\System\cVMNfJD.exe
  C:\Windows\System\cVMNfJD.exe
  2⤵
  PID:7216
- C:\Windows\System\KbJsnmU.exe
  C:\Windows\System\KbJsnmU.exe
  2⤵
  PID:8208
- C:\Windows\System\NmFTkfA.exe
  C:\Windows\System\NmFTkfA.exe
  2⤵
  PID:8224
- C:\Windows\System\HMMVqbv.exe
  C:\Windows\System\HMMVqbv.exe
  2⤵
  PID:8240
- C:\Windows\System\bcIQEHe.exe
  C:\Windows\System\bcIQEHe.exe
  2⤵
  PID:8256
- C:\Windows\System\OKntQfT.exe
  C:\Windows\System\OKntQfT.exe
  2⤵
  PID:8272
- C:\Windows\System\ojaELDe.exe
  C:\Windows\System\ojaELDe.exe
  2⤵
  PID:8292
- C:\Windows\System\juodutP.exe
  C:\Windows\System\juodutP.exe
  2⤵
  PID:8308
- C:\Windows\System\RHeWuYW.exe
  C:\Windows\System\RHeWuYW.exe
  2⤵
  PID:8324
- C:\Windows\System\XkRZdsE.exe
  C:\Windows\System\XkRZdsE.exe
  2⤵
  PID:8340
- C:\Windows\System\LqTICRP.exe
  C:\Windows\System\LqTICRP.exe
  2⤵
  PID:8356
- C:\Windows\System\rxlFMJp.exe
  C:\Windows\System\rxlFMJp.exe
  2⤵
  PID:8372
- C:\Windows\System\ojiCxBp.exe
  C:\Windows\System\ojiCxBp.exe
  2⤵
  PID:8388
- C:\Windows\System\WKjcASb.exe
  C:\Windows\System\WKjcASb.exe
  2⤵
  PID:8404
- C:\Windows\System\rMZOpiN.exe
  C:\Windows\System\rMZOpiN.exe
  2⤵
  PID:8424
- C:\Windows\System\CEuqtgb.exe
  C:\Windows\System\CEuqtgb.exe
  2⤵
  PID:8444
- C:\Windows\System\REhHHBX.exe
  C:\Windows\System\REhHHBX.exe
  2⤵
  PID:8460
- C:\Windows\System\wuBeQiP.exe
  C:\Windows\System\wuBeQiP.exe
  2⤵
  PID:8476
- C:\Windows\System\AgvTcql.exe
  C:\Windows\System\AgvTcql.exe
  2⤵
  PID:8492
- C:\Windows\System\VcMfCcd.exe
  C:\Windows\System\VcMfCcd.exe
  2⤵
  PID:8508
- C:\Windows\System\SGhWUZg.exe
  C:\Windows\System\SGhWUZg.exe
  2⤵
  PID:8532
- C:\Windows\System\favEESd.exe
  C:\Windows\System\favEESd.exe
  2⤵
  PID:8548
- C:\Windows\System\XQTAfXo.exe
  C:\Windows\System\XQTAfXo.exe
  2⤵
  PID:8564
- C:\Windows\System\yJsKZWV.exe
  C:\Windows\System\yJsKZWV.exe
  2⤵
  PID:8700
- C:\Windows\System\pcRuXHa.exe
  C:\Windows\System\pcRuXHa.exe
  2⤵
  PID:8720
- C:\Windows\System\ZniEKWo.exe
  C:\Windows\System\ZniEKWo.exe
  2⤵
  PID:8736
- C:\Windows\System\ffxhKMN.exe
  C:\Windows\System\ffxhKMN.exe
  2⤵
  PID:8752
- C:\Windows\System\pidyWFV.exe
  C:\Windows\System\pidyWFV.exe
  2⤵
  PID:8768
- C:\Windows\System\ovwFgTb.exe
  C:\Windows\System\ovwFgTb.exe
  2⤵
  PID:8876
- C:\Windows\System\SVCNFLN.exe
  C:\Windows\System\SVCNFLN.exe
  2⤵
  PID:8892
- C:\Windows\System\UNBahrX.exe
  C:\Windows\System\UNBahrX.exe
  2⤵
  PID:8912
- C:\Windows\System\DosiOke.exe
  C:\Windows\System\DosiOke.exe
  2⤵
  PID:8928
- C:\Windows\System\XbhqjFW.exe
  C:\Windows\System\XbhqjFW.exe
  2⤵
  PID:8944
- C:\Windows\System\MCFBWJF.exe
  C:\Windows\System\MCFBWJF.exe
  2⤵
  PID:8960
- C:\Windows\System\ztKydpC.exe
  C:\Windows\System\ztKydpC.exe
  2⤵
  PID:8976
- C:\Windows\System\nQomPMh.exe
  C:\Windows\System\nQomPMh.exe
  2⤵
  PID:8992
- C:\Windows\System\zBlRzrv.exe
  C:\Windows\System\zBlRzrv.exe
  2⤵
  PID:9008
- C:\Windows\System\oOtlRlA.exe
  C:\Windows\System\oOtlRlA.exe
  2⤵
  PID:9028
- C:\Windows\System\BmqOqhk.exe
  C:\Windows\System\BmqOqhk.exe
  2⤵
  PID:9044
- C:\Windows\System\mQWOsFv.exe
  C:\Windows\System\mQWOsFv.exe
  2⤵
  PID:9064
- C:\Windows\System\NCcncFH.exe
  C:\Windows\System\NCcncFH.exe
  2⤵
  PID:9080
- C:\Windows\System\QrPbMFh.exe
  C:\Windows\System\QrPbMFh.exe
  2⤵
  PID:9096
- C:\Windows\System\iIqgeIr.exe
  C:\Windows\System\iIqgeIr.exe
  2⤵
  PID:9112
- C:\Windows\System\LWAPLrE.exe
  C:\Windows\System\LWAPLrE.exe
  2⤵
  PID:9128
- C:\Windows\System\YNjUoIO.exe
  C:\Windows\System\YNjUoIO.exe
  2⤵
  PID:9144
- C:\Windows\System\bWvRnSh.exe
  C:\Windows\System\bWvRnSh.exe
  2⤵
  PID:9160
- C:\Windows\System\SIWMwgd.exe
  C:\Windows\System\SIWMwgd.exe
  2⤵
  PID:9176
- C:\Windows\System\eEuyLME.exe
  C:\Windows\System\eEuyLME.exe
  2⤵
  PID:9204
- C:\Windows\System\RDoPevj.exe
  C:\Windows\System\RDoPevj.exe
  2⤵
  PID:8196
- C:\Windows\System\WkDAyqN.exe
  C:\Windows\System\WkDAyqN.exe
  2⤵
  PID:8156
- C:\Windows\System\ARxMwLU.exe
  C:\Windows\System\ARxMwLU.exe
  2⤵
  PID:7764
- C:\Windows\System\OhzfImf.exe
  C:\Windows\System\OhzfImf.exe
  2⤵
  PID:8232
- C:\Windows\System\Jbsfclr.exe
  C:\Windows\System\Jbsfclr.exe
  2⤵
  PID:8220
- C:\Windows\System\dFLWqTk.exe
  C:\Windows\System\dFLWqTk.exe
  2⤵
  PID:8320
- C:\Windows\System\OqbLLcu.exe
  C:\Windows\System\OqbLLcu.exe
  2⤵
  PID:8432
- C:\Windows\System\QpVlciP.exe
  C:\Windows\System\QpVlciP.exe
  2⤵
  PID:8440
- C:\Windows\System\XjFAJQS.exe
  C:\Windows\System\XjFAJQS.exe
  2⤵
  PID:8504
- C:\Windows\System\ajvZkuV.exe
  C:\Windows\System\ajvZkuV.exe
  2⤵
  PID:8576
- C:\Windows\System\nUbChgs.exe
  C:\Windows\System\nUbChgs.exe
  2⤵
  PID:8524
- C:\Windows\System\CQhuUlK.exe
  C:\Windows\System\CQhuUlK.exe
  2⤵
  PID:8528
- C:\Windows\System\CAZbSbX.exe
  C:\Windows\System\CAZbSbX.exe
  2⤵
  PID:8580
- C:\Windows\System\gGxMSen.exe
  C:\Windows\System\gGxMSen.exe
  2⤵
  PID:8596
- C:\Windows\System\kiPVeMY.exe
  C:\Windows\System\kiPVeMY.exe
  2⤵
  PID:8616
- C:\Windows\System\TovHGSS.exe
  C:\Windows\System\TovHGSS.exe
  2⤵
  PID:8636
- C:\Windows\System\VsfKPpl.exe
  C:\Windows\System\VsfKPpl.exe
  2⤵
  PID:8656
- C:\Windows\System\xSuYtxA.exe
  C:\Windows\System\xSuYtxA.exe
  2⤵
  PID:8672
- C:\Windows\System\UYERUZZ.exe
  C:\Windows\System\UYERUZZ.exe
  2⤵
  PID:8692
- C:\Windows\System\EGfoaBb.exe
  C:\Windows\System\EGfoaBb.exe
  2⤵
  PID:8716
- C:\Windows\System\Viezsmg.exe
  C:\Windows\System\Viezsmg.exe
  2⤵
  PID:8780
- C:\Windows\System\VSmpnBo.exe
  C:\Windows\System\VSmpnBo.exe
  2⤵
  PID:8764
- C:\Windows\System\ryNAeiZ.exe
  C:\Windows\System\ryNAeiZ.exe
  2⤵
  PID:8792
- C:\Windows\System\cAqYWZw.exe
  C:\Windows\System\cAqYWZw.exe
  2⤵
  PID:8808
- C:\Windows\System\pxzrSZm.exe
  C:\Windows\System\pxzrSZm.exe
  2⤵
  PID:8824
- C:\Windows\System\AskWPNm.exe
  C:\Windows\System\AskWPNm.exe
  2⤵
  PID:8840
- C:\Windows\System\DovgkcK.exe
  C:\Windows\System\DovgkcK.exe
  2⤵
  PID:8856
- C:\Windows\System\zKOrdiY.exe
  C:\Windows\System\zKOrdiY.exe
  2⤵
  PID:8872
- C:\Windows\System\pndUTmg.exe
  C:\Windows\System\pndUTmg.exe
  2⤵
  PID:8940
- C:\Windows\System\RsswLrR.exe
  C:\Windows\System\RsswLrR.exe
  2⤵
  PID:9000
- C:\Windows\System\eDwWvwn.exe
  C:\Windows\System\eDwWvwn.exe
  2⤵
  PID:9040
- C:\Windows\System\nhIhKJb.exe
  C:\Windows\System\nhIhKJb.exe
  2⤵
  PID:9168
- C:\Windows\System\zemcvjS.exe
  C:\Windows\System\zemcvjS.exe
  2⤵
  PID:9172
- C:\Windows\System\yDWQVRH.exe
  C:\Windows\System\yDWQVRH.exe
  2⤵
  PID:8956
- C:\Windows\System\EhpMZhG.exe
  C:\Windows\System\EhpMZhG.exe
  2⤵
  PID:9024
- C:\Windows\System\Udraxji.exe
  C:\Windows\System\Udraxji.exe
  2⤵
  PID:9120
- C:\Windows\System\kdFHxfQ.exe
  C:\Windows\System\kdFHxfQ.exe
  2⤵
  PID:9188
- C:\Windows\System\LIQSwcA.exe
  C:\Windows\System\LIQSwcA.exe
  2⤵
  PID:9200
- C:\Windows\System\lfUErjJ.exe
  C:\Windows\System\lfUErjJ.exe
  2⤵
  PID:9088
- C:\Windows\System\bEQXSnM.exe
  C:\Windows\System\bEQXSnM.exe
  2⤵
  PID:7184
- C:\Windows\System\KLYTmCl.exe
  C:\Windows\System\KLYTmCl.exe
  2⤵
  PID:8680
- C:\Windows\System\IrCKOro.exe
  C:\Windows\System\IrCKOro.exe
  2⤵
  PID:8788
- C:\Windows\System\rTPfVfh.exe
  C:\Windows\System\rTPfVfh.exe
  2⤵
  PID:8904
- C:\Windows\System\xmznDhC.exe
  C:\Windows\System\xmznDhC.exe
  2⤵
  PID:8988
- C:\Windows\System\ysVFrAj.exe
  C:\Windows\System\ysVFrAj.exe
  2⤵
  PID:9184
- C:\Windows\System\hQDDfzp.exe
  C:\Windows\System\hQDDfzp.exe
  2⤵
  PID:8300
- C:\Windows\System\qicZuqy.exe
  C:\Windows\System\qicZuqy.exe
  2⤵
  PID:8216
- C:\Windows\System\RDxYFii.exe
  C:\Windows\System\RDxYFii.exe
  2⤵
  PID:8280
- C:\Windows\System\bfCoifJ.exe
  C:\Windows\System\bfCoifJ.exe
  2⤵
  PID:8316
- C:\Windows\System\uaQjDKr.exe
  C:\Windows\System\uaQjDKr.exe
  2⤵
  PID:8412
- C:\Windows\System\njZpmfN.exe
  C:\Windows\System\njZpmfN.exe
  2⤵
  PID:8544
- C:\Windows\System\MuexXat.exe
  C:\Windows\System\MuexXat.exe
  2⤵
  PID:8584
- C:\Windows\System\CDkRZHC.exe
  C:\Windows\System\CDkRZHC.exe
  2⤵
  PID:8628
- C:\Windows\System\zkuLQOb.exe
  C:\Windows\System\zkuLQOb.exe
  2⤵
  PID:8708
- C:\Windows\System\uXjgkld.exe
  C:\Windows\System\uXjgkld.exe
  2⤵
  PID:8800
- C:\Windows\System\OoePAVf.exe
  C:\Windows\System\OoePAVf.exe
  2⤵
  PID:8864
- C:\Windows\System\VgLOSee.exe
  C:\Windows\System\VgLOSee.exe
  2⤵
  PID:9076
- C:\Windows\System\yyMcQqa.exe
  C:\Windows\System\yyMcQqa.exe
  2⤵
  PID:9056
- C:\Windows\System\hQDDQlA.exe
  C:\Windows\System\hQDDQlA.exe
  2⤵
  PID:9212
- C:\Windows\System\FIlufLZ.exe
  C:\Windows\System\FIlufLZ.exe
  2⤵
  PID:8560
- C:\Windows\System\dmwFCYH.exe
  C:\Windows\System\dmwFCYH.exe
  2⤵
  PID:8784
- C:\Windows\System\YgjpoIs.exe
  C:\Windows\System\YgjpoIs.exe
  2⤵
  PID:8612
- C:\Windows\System\iRPYjjv.exe
  C:\Windows\System\iRPYjjv.exe
  2⤵
  PID:8848
- C:\Windows\System\kAMSyGK.exe
  C:\Windows\System\kAMSyGK.exe
  2⤵
  PID:9156
- C:\Windows\System\ZjiVavx.exe
  C:\Windows\System\ZjiVavx.exe
  2⤵
  PID:8368
- C:\Windows\System\eiMMNvP.exe
  C:\Windows\System\eiMMNvP.exe
  2⤵
  PID:9140
- C:\Windows\System\WznSYvi.exe
  C:\Windows\System\WznSYvi.exe
  2⤵
  PID:8252
- C:\Windows\System\jpNBYpM.exe
  C:\Windows\System\jpNBYpM.exe
  2⤵
  PID:8832
- C:\Windows\System\MSXMjxn.exe
  C:\Windows\System\MSXMjxn.exe
  2⤵
  PID:8748
- C:\Windows\System\EtNjbQW.exe
  C:\Windows\System\EtNjbQW.exe
  2⤵
  PID:9196
- C:\Windows\System\cORlmiV.exe
  C:\Windows\System\cORlmiV.exe
  2⤵
  PID:8204
- C:\Windows\System\BjHYKul.exe
  C:\Windows\System\BjHYKul.exe
  2⤵
  PID:8760
- C:\Windows\System\QpbodMs.exe
  C:\Windows\System\QpbodMs.exe
  2⤵
  PID:8668
- C:\Windows\System\xbzHZOZ.exe
  C:\Windows\System\xbzHZOZ.exe
  2⤵
  PID:9072
- C:\Windows\System\yyrGAWk.exe
  C:\Windows\System\yyrGAWk.exe
  2⤵
  PID:8952
- C:\Windows\System\dxABNHp.exe
  C:\Windows\System\dxABNHp.exe
  2⤵
  PID:8968
- C:\Windows\System\zEUverf.exe
  C:\Windows\System\zEUverf.exe
  2⤵
  PID:8436
- C:\Windows\System\BdhOLwY.exe
  C:\Windows\System\BdhOLwY.exe
  2⤵
  PID:9224
- C:\Windows\System\HeUfJcj.exe
  C:\Windows\System\HeUfJcj.exe
  2⤵
  PID:9240
- C:\Windows\System\qPnOkVP.exe
  C:\Windows\System\qPnOkVP.exe
  2⤵
  PID:9264
- C:\Windows\System\IdEaRhW.exe
  C:\Windows\System\IdEaRhW.exe
  2⤵
  PID:9284
- C:\Windows\System\NvhEVFc.exe
  C:\Windows\System\NvhEVFc.exe
  2⤵
  PID:9300
- C:\Windows\System\eCrkwAU.exe
  C:\Windows\System\eCrkwAU.exe
  2⤵
  PID:9316
- C:\Windows\System\VrYzMLf.exe
  C:\Windows\System\VrYzMLf.exe
  2⤵
  PID:9332
- C:\Windows\System\dUpvpeQ.exe
  C:\Windows\System\dUpvpeQ.exe
  2⤵
  PID:9348
- C:\Windows\System\aOthIxC.exe
  C:\Windows\System\aOthIxC.exe
  2⤵
  PID:9364
- C:\Windows\System\GcqoAcA.exe
  C:\Windows\System\GcqoAcA.exe
  2⤵
  PID:9380
- C:\Windows\System\ApsjCQq.exe
  C:\Windows\System\ApsjCQq.exe
  2⤵
  PID:9396
- C:\Windows\System\quJieBJ.exe
  C:\Windows\System\quJieBJ.exe
  2⤵
  PID:9552
- C:\Windows\System\KesbIDr.exe
  C:\Windows\System\KesbIDr.exe
  2⤵
  PID:9568
- C:\Windows\System\UCzxGke.exe
  C:\Windows\System\UCzxGke.exe
  2⤵
  PID:9584
- C:\Windows\System\LwFURUW.exe
  C:\Windows\System\LwFURUW.exe
  2⤵
  PID:9600
- C:\Windows\System\RfvsmpE.exe
  C:\Windows\System\RfvsmpE.exe
  2⤵
  PID:9616
- C:\Windows\System\nqXxOut.exe
  C:\Windows\System\nqXxOut.exe
  2⤵
  PID:9636
- C:\Windows\System\FzAFPfl.exe
  C:\Windows\System\FzAFPfl.exe
  2⤵
  PID:9680
- C:\Windows\System\VlWVMAy.exe
  C:\Windows\System\VlWVMAy.exe
  2⤵
  PID:9712
- C:\Windows\System\pbwjqlC.exe
  C:\Windows\System\pbwjqlC.exe
  2⤵
  PID:9728
- C:\Windows\System\kedhkZX.exe
  C:\Windows\System\kedhkZX.exe
  2⤵
  PID:9744
- C:\Windows\System\cyDTEGx.exe
  C:\Windows\System\cyDTEGx.exe
  2⤵
  PID:9760
- C:\Windows\System\lwsnXWU.exe
  C:\Windows\System\lwsnXWU.exe
  2⤵
  PID:9776
- C:\Windows\System\chMcGnJ.exe
  C:\Windows\System\chMcGnJ.exe
  2⤵
  PID:9796
- C:\Windows\System\pKAJqoZ.exe
  C:\Windows\System\pKAJqoZ.exe
  2⤵
  PID:9816
- C:\Windows\System\VISYNjF.exe
  C:\Windows\System\VISYNjF.exe
  2⤵
  PID:9832
- C:\Windows\System\HkIkYDd.exe
  C:\Windows\System\HkIkYDd.exe
  2⤵
  PID:9848
- C:\Windows\System\UAxjTSD.exe
  C:\Windows\System\UAxjTSD.exe
  2⤵
  PID:9864
- C:\Windows\System\ziVPhoE.exe
  C:\Windows\System\ziVPhoE.exe
  2⤵
  PID:9880
- C:\Windows\System\NHsTEkU.exe
  C:\Windows\System\NHsTEkU.exe
  2⤵
  PID:9896
- C:\Windows\System\OwboEUu.exe
  C:\Windows\System\OwboEUu.exe
  2⤵
  PID:9912
- C:\Windows\System\SCGvvkq.exe
  C:\Windows\System\SCGvvkq.exe
  2⤵
  PID:9928
- C:\Windows\System\vnUBSGr.exe
  C:\Windows\System\vnUBSGr.exe
  2⤵
  PID:9948
- C:\Windows\System\BVEXytp.exe
  C:\Windows\System\BVEXytp.exe
  2⤵
  PID:9964
- C:\Windows\System\BzZstec.exe
  C:\Windows\System\BzZstec.exe
  2⤵
  PID:9980
- C:\Windows\System\DaEOApt.exe
  C:\Windows\System\DaEOApt.exe
  2⤵
  PID:9996
- C:\Windows\System\sIvILIB.exe
  C:\Windows\System\sIvILIB.exe
  2⤵
  PID:10020
- C:\Windows\System\WCAgBsB.exe
  C:\Windows\System\WCAgBsB.exe
  2⤵
  PID:10040
- C:\Windows\System\NyBLLQh.exe
  C:\Windows\System\NyBLLQh.exe
  2⤵
  PID:10096
- C:\Windows\System\sGCKNVK.exe
  C:\Windows\System\sGCKNVK.exe
  2⤵
  PID:10148
- C:\Windows\System\HymztdB.exe
  C:\Windows\System\HymztdB.exe
  2⤵
  PID:10164
- C:\Windows\System\UhNVhih.exe
  C:\Windows\System\UhNVhih.exe
  2⤵
  PID:10180
- C:\Windows\System\NgOURfk.exe
  C:\Windows\System\NgOURfk.exe
  2⤵
  PID:10196
- C:\Windows\System\OYlxTXl.exe
  C:\Windows\System\OYlxTXl.exe
  2⤵
  PID:10212
- C:\Windows\System\cDfQeYz.exe
  C:\Windows\System\cDfQeYz.exe
  2⤵
  PID:10228
- C:\Windows\System\WohafRj.exe
  C:\Windows\System\WohafRj.exe
  2⤵
  PID:8836
- C:\Windows\System\kXBBGSp.exe
  C:\Windows\System\kXBBGSp.exe
  2⤵
  PID:9260
- C:\Windows\System\scsgdSi.exe
  C:\Windows\System\scsgdSi.exe
  2⤵
  PID:9324
- C:\Windows\System\zymntNZ.exe
  C:\Windows\System\zymntNZ.exe
  2⤵
  PID:9388
- C:\Windows\System\WZKSsVB.exe
  C:\Windows\System\WZKSsVB.exe
  2⤵
  PID:9236
- C:\Windows\System\osFWnmt.exe
  C:\Windows\System\osFWnmt.exe
  2⤵
  PID:8604
- C:\Windows\System\GZdisLW.exe
  C:\Windows\System\GZdisLW.exe
  2⤵
  PID:8620
- C:\Windows\System\mCLbAhR.exe
  C:\Windows\System\mCLbAhR.exe
  2⤵
  PID:8336
- C:\Windows\System\vQQFcxS.exe
  C:\Windows\System\vQQFcxS.exe
  2⤵
  PID:9308
- C:\Windows\System\bTVmzwJ.exe
  C:\Windows\System\bTVmzwJ.exe
  2⤵
  PID:9372
- C:\Windows\System\JdLyCaB.exe
  C:\Windows\System\JdLyCaB.exe
  2⤵
  PID:9412
- C:\Windows\System\dFUcZEG.exe
  C:\Windows\System\dFUcZEG.exe
  2⤵
  PID:9428
- C:\Windows\System\lwcKANX.exe
  C:\Windows\System\lwcKANX.exe
  2⤵
  PID:9444
- C:\Windows\System\cUQMcVR.exe
  C:\Windows\System\cUQMcVR.exe
  2⤵
  PID:9464
- C:\Windows\System\HJzMUEa.exe
  C:\Windows\System\HJzMUEa.exe
  2⤵
  PID:9480
- C:\Windows\System\FVkERrV.exe
  C:\Windows\System\FVkERrV.exe
  2⤵
  PID:9496
- C:\Windows\System\AgCAguB.exe
  C:\Windows\System\AgCAguB.exe
  2⤵
  PID:9520
- C:\Windows\System\EEVcMsb.exe
  C:\Windows\System\EEVcMsb.exe
  2⤵
  PID:9540
- C:\Windows\System\LLWnSeo.exe
  C:\Windows\System\LLWnSeo.exe
  2⤵
  PID:9548
- C:\Windows\System\YdyRBIK.exe
  C:\Windows\System\YdyRBIK.exe
  2⤵
  PID:9608
- C:\Windows\System\aIwcCfu.exe
  C:\Windows\System\aIwcCfu.exe
  2⤵
  PID:9648
- C:\Windows\System\fWreWWG.exe
  C:\Windows\System\fWreWWG.exe
  2⤵
  PID:9664
- C:\Windows\System\ixXMeRA.exe
  C:\Windows\System\ixXMeRA.exe
  2⤵
  PID:9688
- C:\Windows\System\ZHKOwcH.exe
  C:\Windows\System\ZHKOwcH.exe
  2⤵
  PID:9624
- C:\Windows\System\WdxdFmh.exe
  C:\Windows\System\WdxdFmh.exe
  2⤵
  PID:9708
- C:\Windows\System\vSuNFVv.exe
  C:\Windows\System\vSuNFVv.exe
  2⤵
  PID:9772
- C:\Windows\System\MnHYLVx.exe
  C:\Windows\System\MnHYLVx.exe
  2⤵
  PID:9844
- C:\Windows\System\OuLnoHf.exe
  C:\Windows\System\OuLnoHf.exe
  2⤵
  PID:9908
- C:\Windows\System\KblromW.exe
  C:\Windows\System\KblromW.exe
  2⤵
  PID:9972
- C:\Windows\System\ejlPgpv.exe
  C:\Windows\System\ejlPgpv.exe
  2⤵
  PID:10016
- C:\Windows\System\PJCcQyL.exe
  C:\Windows\System\PJCcQyL.exe
  2⤵
  PID:9724
- C:\Windows\System\ZKdHTVX.exe
  C:\Windows\System\ZKdHTVX.exe
  2⤵
  PID:9784
- C:\Windows\System\xcWnJHk.exe
  C:\Windows\System\xcWnJHk.exe
  2⤵
  PID:10084
- C:\Windows\System\ohVQXVw.exe
  C:\Windows\System\ohVQXVw.exe
  2⤵
  PID:10160
- C:\Windows\System\sqaVhWa.exe
  C:\Windows\System\sqaVhWa.exe
  2⤵
  PID:10220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AImMczA.exe

Filesize
1.4MB

MD5
55297b71d31348ba8921631cd19e94c9

SHA1
d7010e24cb40e1dcb594f6136b3b8c1e6cf64a30

SHA256
7376a019ea8f659499e95c67c62c0c2beadef3cbd4051bc7fb33af55fdf8f455

SHA512
652d7127093d7c86064a7e4afb42b86fedb002de0ad2de18fc673522b89d1dd1a1e7cbd2270e5df01a28a57a6a09b4674559c6b53fe1c4195c645125ae924739

Download Submit
C:\Windows\system\COcZkBc.exe

Filesize
1.4MB

MD5
94be027ac2c645ff5ea92dbf2897a122

SHA1
ca4a20f0c89a20e46bbc6c46f62da0a278c7ad2b

SHA256
2e2058ade3471978331d95afd305ea2e829efe0aa3317480ace92091f2fec48d

SHA512
8c54f0a82dfe59940b34464bef8b40acb57545501c1659c42e1ce0776bcc39f89ae367a2f4a3d9babd62d6e35af9839f7b9d5c99a6356b5d491c532a012a66cf

Download Submit
C:\Windows\system\CRyBVAE.exe

Filesize
1.4MB

MD5
4b1e1813cbe776cf304c02871ab9283a

SHA1
ec2ecb4a530f8a79ae1885f91d42464abaf8a620

SHA256
aef5fc9844080f910e6fd53e0b790c489c1c47c3d116fa94754a50942323b6d6

SHA512
7e692902e0ed5c19d236807a1a4c4533b201ec81f3da2df078bbff8fa02c1d09587c6d9af8bd8da3c5a095f1adde81bd2223c28240d56d4d72dc9c156564a785

Download Submit
C:\Windows\system\HTCfnyu.exe

Filesize
1.4MB

MD5
871fa8203962371742f4534d274caafe

SHA1
d1de6e26ea786c57c9ec6de157f0d07844044cfc

SHA256
64be14e3b125da6a41f2bc8e5be1da860adad02fced7ce42cb8a73eaa03b6644

SHA512
68a0fe9b998d8cd952bdc1d878a46a373a576dae1831e42be4d42cf7570e064ad619db55240ca7c4a8304a5910b755b264a2792f9f27430a1ecd85be3553cb28

Download Submit
C:\Windows\system\IbDuqyC.exe

Filesize
1.4MB

MD5
3609c53f700e13099a2b4c97f3949357

SHA1
f0c42f9c24192514bceb835bde191302a8c797ce

SHA256
881ce52f3b977afb1b556985b30e37177c7ed31cb0fa5f96648be6bb4c374664

SHA512
2653ce1735378f1d3337b7ee5d37e31088956234cd3375475bcbc21e54b96f354527e41f45e480e6c1b6183320e00a73331941950d18747f11435d05a84d0dff

Download Submit
C:\Windows\system\NKFDtsu.exe

Filesize
1.4MB

MD5
bf99ec7bbea1bff270712063138bb298

SHA1
258b043d54838feece0ff4e657021496c6db0226

SHA256
ce4ee9c5bd531fa45d83a7a83922820968679bf426f6c11c811b9f691d25f914

SHA512
7543a5c11da878d6ed6a76844fd903796e2f9bb9679edd8e13f870af594454de61b2f5bf4d68b6c5a1980bc0c9aff0087c0298a93bca70af3c81fc858301fc64

Download Submit
C:\Windows\system\OrpJIfS.exe

Filesize
8B

MD5
8a9416a5ba3f4513ce86ee25fcd9ed2c

SHA1
a36f3dd1333c8cfee404b646d4c6809d7e653313

SHA256
fb7dd3a16f87fe8b7e98987069f2b605508df1550402bd2a9bfdec4856b1a59a

SHA512
c747d417c3e282ae9ec82b691c8fea9cb7d0729d1dda54d2144fa9c71dd39f2ab11cee5a6768a89cb91fd4a7ae6e579302cb4e4de8d6384014994320074580a4

Download Submit
C:\Windows\system\cJhzfUr.exe

Filesize
1.4MB

MD5
cc41a3d658c73885be23d735afd04b83

SHA1
eb079e5d43933e6e058b3531691a509d76fa2654

SHA256
23ec3592cc8e20f660c5ffd1f931108d3be6cdd552d3070813bebeed7ee62a9f

SHA512
9b090ae424e707f86fbffc2ab1f32af1f912aa678f211e2b77ce74ea801de079d84ecd76d8cf2836800dc421f6bf8136f199bd15ca0cc956341e482097325ac7

Download Submit
C:\Windows\system\fdbMiJR.exe

Filesize
1.4MB

MD5
d429e8203f568f3725e5a1306865d1ca

SHA1
2ed9877d3da514fae6cde26d1fec6ec47e22198f

SHA256
1e430fa300601946e9cfab6fd85fe8157bbba9d13f7da6740368c00780d7ce25

SHA512
8abaeedde94c255296e830f1b2fc35eff1f19853193886ffb0899872934086215ac6e5466c17ffa6de6976784569c061536410c76d7839d6bd553d7c64169b7e

Download Submit
C:\Windows\system\iQgbtZU.exe

Filesize
18B

MD5
a308bab96af0d8b0405ced0df2e422de

SHA1
d1952ddc6ffadb32bc26dbd87f63673fe488019c

SHA256
8b1e86aaa211a5c5f8f89e89db4748f4041ce6a7eadabf706546f1da8a4c933b

SHA512
febe4ebe7f32e7b2ee0bea8360d9cfbd617f1e619f185f40ee924ced488e4b9c2a3a234ad49a740a246b10397b83d94709c1498bb18d2a41eaa09bad38561ccc

Download Submit
C:\Windows\system\kjTzqey.exe

Filesize
1.4MB

MD5
9b27f44e07c7bbc6539e2eebfe883c90

SHA1
711effa7c97370eada5df56f437fc8c86c8fa31f

SHA256
311753822c106cab4506aca0932e039b3fef4ba819c05878d5c597f34af0d282

SHA512
fb7ee3fb3a0e5a51510d505c57ac86507545e4a08204f586f3b55b79d2bf635d9166c858f9bbccd73da2c4012da1829bf3e4371261400b72509cc201a194b47b

Download Submit
C:\Windows\system\ntRWqKD.exe

Filesize
1.4MB

MD5
c454c757da1720ef152a5a83f238c4d2

SHA1
b11f8717d099f51c6c365b6e77334db4be9bb7f5

SHA256
11eac84ad4e81fc268664b999c0835ac72f55968862e1ae8d0ca8992009ac697

SHA512
69734a830db7aa2347ba7d2af8821468cc122817600a7bbf305c13cf9f1bdd6c599b62ef1470cb46de54fa43d4a630ca569c0d8fd3db92e14bf4feda08ef5b00

Download Submit
C:\Windows\system\orxftSp.exe

Filesize
1.4MB

MD5
c3eee5accce96ae9ea193cef3d32fd1c

SHA1
c4b0d1d6c09b79267b264e4d42bb8f7f2fa5db35

SHA256
29c32700f77efe73fccd1a1e119860d350083e09e953829394425e72271ae57c

SHA512
01fa6ea0352d6f14fda0ff203ec0ac59a9a9d2e4fd242145acf869445e294daaa9c28eff819f9e1493da0165d18361f10121e14a8d50a8de3eae3dc02706b987

Download Submit
C:\Windows\system\rJpsbdd.exe

Filesize
1.4MB

MD5
d59aceb7dcd72ba1b32a69cd7c581816

SHA1
a685961e61d3f3c0a244a232054cb4e0ab18053b

SHA256
7039dd25e4862e358ef33a4b854405a5ad60511cf383d6c197306576166dc9b4

SHA512
28727eb5b01fc0f3dffdad05fd3db65f65369ebe30b8fa3813d3a722da3a8a04c2183c544d9bfb8ae5555f755f4299f697db1a8044ff02078b6f9cbe70c54f36

Download Submit
C:\Windows\system\sEinPHu.exe

Filesize
1.4MB

MD5
c47444bb93ac735dbe47dd084e7b3713

SHA1
66c7648c19633b299e2db67914b6b8086485e5b3

SHA256
3965047cc7781e8edd3b484bdfa8595e2754d23f8978a77aa11438037a3f447e

SHA512
e7a109045829d18903014d692874778be63f195d7d6be5e33d0db2d53fff44dea024b4fbb7c0658df87556c6149558e8835213ef400eff1f5ca5d52060ed99a6

Download Submit
C:\Windows\system\sMAQEgj.exe

Filesize
1.4MB

MD5
0d536fe71c451085b4fcc6aac72d2be4

SHA1
b34d93ff2715c55f48b7424cb48267391975a6f9

SHA256
d473b55531267ba404c0c487abbadb197d9afb8be2c788c7dd633f54d6c5cd3f

SHA512
b480fa38efe887833dbd67acb7c6ff2b645832e941bee2d6aa220455f315a3a52af54e023e6d78bfa814a7ef3036ec2e133c91ea25eefbb92b20bb1153a23f71

Download Submit
C:\Windows\system\vVZrPin.exe

Filesize
1.4MB

MD5
2ec65ca3ab1a7695bbc4fe5319745984

SHA1
21bcc31dab42698cd3cdcc3c0b4a32552eb429b4

SHA256
396d5e40a2d3307b0ae8040664a294ba450ef004ebe335a4eb694f42bf87d296

SHA512
613e684fae9ceb6697eb975cb16a99fdeb6433292b88fa3b74ef81cd6f10922e0ca79a1492bdc73e70c4e0cf847b29ca10d647cdb59d85eca2d0338a8a95cd26

Download Submit
C:\Windows\system\wevuwGZ.exe

Filesize
1.4MB

MD5
1d8ff87d3667a63aabe73149225fb834

SHA1
7316a2af4c1f81785ab17f3ee72e738f9cf6bd07

SHA256
ed47e14ea0c319707fd4ad22bf26439c10bf72d7ad8b794a21da55e6c8d431e3

SHA512
aa8e1e8650af49bdf43430d72316a80ec12fed082e06742968ecd29517ba1091036e09b48b0e532f0a717798514eda364542d9831694dee59f277dcdf76350d0

Download Submit
C:\Windows\system\whdJXEZ.exe

Filesize
1.4MB

MD5
934b28f9f1313c7aab34e78ba5dac791

SHA1
2d15d33e2ec0a2072c0a5024a5322ef75cc3d7f5

SHA256
81a658cc150a971bc74101b4fa27e6c9988e8bb54f749ece1ecf51475a96f833

SHA512
a386904f8ccc453be8bad9d1dc1a6d99fac95169db3155b49ab94ad8355e55df6ce765a47b73e69512aa8bcd7aa2e6f064af5b952eeb0ae8378b0a447d3688aa

Download Submit
C:\Windows\system\xmymloK.exe

Filesize
1.4MB

MD5
1fa5c98cea9bfcda72ea66accacebb5a

SHA1
c4c729699b8f9ad8ca39d2ec31f6c3e36541367c

SHA256
5cb76694beecfc345b1a3965b93a22f9c686924b3fcde9140e3f8b0c4f67e54b

SHA512
ac6ca2c7ce46d39f1ef5920414858b1873e4e726f331c21b79727db44548bab15c237046372f19392fe654c2ff9e539f15982fa89d0803f29d2c69d213b94be6

Download Submit
C:\Windows\system\ykkWFxy.exe

Filesize
1.4MB

MD5
d58e6fe437b9b2e7941880694f79d2e6

SHA1
0cdfce76a9e33d1b5c0e457a7d0fb92057dd1149

SHA256
877e6b6cc8ae8bd03262554dcf1532f507508bb38601a21acfc9dad1c13cc550

SHA512
edd4674884a746d833f1c603e5977eaca5d7a52262714cecbde18037253ae88ecd74dc4138d4e8c3767fbebb0636b42175d6051da743f6cea48c2dc3f42bb7bd

Download Submit
C:\Windows\system\ynlTIIe.exe

Filesize
1.4MB

MD5
c14bf9b7f233e248b6e7748148e75085

SHA1
77736546f602151c00350f33465c99b06a027cfa

SHA256
8ff59576fd2dcaa4ebd37ce9a67fdd3a609f66542b22512b95a5f7737e89c28a

SHA512
987e10740713532785442118a2f6bf029608aa702499b7ac8492d42ae404e3e9dd700c8561ff7066ee3301188057a76a8fe1fd7444c8d56a5dbd7671c4899df5

Download Submit
C:\Windows\system\zzUjdEg.exe

Filesize
1.4MB

MD5
bfa903117d1cd5354de2561c64d48f44

SHA1
4ac3d40dcd062dd0d938376f52e927738965412f

SHA256
34fbe163ca38685b5b215aa8ef37fffbffbfa5f59cdf17e3f9d310b4ef8e7b71

SHA512
b7996be5178f859085bc444d4086d9227857ef369b3b6b0cddfa63c42b9ae14d3044aba9cace49f80d882e5e51f510a3ff7612e377be634cfae1865233ff8ca2

Download Submit
\Windows\system\DUSuEUQ.exe

Filesize
1.4MB

MD5
55e07ad1a7c188f9861f5e9c5488717c

SHA1
4b4d5479536326c774f7ddf1cf3f539e1daf28ca

SHA256
ad1310fe2b1159e675741dc2d7a30e740b808577b23ed4560518adb111495a34

SHA512
7c70eb93d48331542449937ed6de08e06e643af607e79abf85d2c260bbf1d3073e4e384192d74008281bbae0b3453fa34026820982c07ae65a0019dba6a2a30f

Download Submit
\Windows\system\MdJyhyR.exe

Filesize
1.4MB

MD5
40803706f86a446012930c37ffd312f8

SHA1
e0fa4f983b1fc6b48759ce5ec64f7d839e80c9ee

SHA256
b24d51fc26e886574b389284b8fd0dedf77046f38e3dbffaddb944dda4726a14

SHA512
2f2fce871bc9bada30db5c8bfdccd035a303caf94a5acdbbf66b81f123ce804b6c60593a51769c2593fe210eb9888e2399d549e22fecaf5ed7c74cd33e363b0a

Download Submit
\Windows\system\MlpwAjf.exe

Filesize
1.4MB

MD5
c89eba7af0de7a9fe5cb1b3c702ce605

SHA1
b96125c6145dda1a8c917bd9c2d1b7e87be0f87e

SHA256
801fbd0e20f3a46fd559bae746c9784fc92608841bfa8ad1da848259cc5b7b2e

SHA512
72fec62580a55d0926cab9f82e15a8742e75e91ce211c20ec08c4d367e7c813797c9628decf38e3c9ad61141eb772476d73c4150cb13c1f6663c7f5e65668291

Download Submit
\Windows\system\TDMjzQf.exe

Filesize
1.4MB

MD5
297e84ce4e5421064c4f114027f2868d

SHA1
e537edae2e211b4c8b4503656e817a2a133995ba

SHA256
35adb121f5e8eeedd4e7abf6c1cca1338482076e3930c10acd4ca12483dd77e3

SHA512
a45f8bd937a61b3da03db6013e33a52688d64dca40302aaa435d01359efe34c1dc83dd4bde2381a8d2df151a96e84c3c0bc121e039c846dc5a0ecacdab4c6fa8

Download Submit
\Windows\system\TbTRYNC.exe

Filesize
1.4MB

MD5
ef72b21fc2abb5711ca2a051fe24ebb1

SHA1
9586be84e8805d0115d95e5805da6a3f923478d9

SHA256
b4c918c9ce56234924934d67f48e79b14de5d3832738ef64c74ff6648b6b1c19

SHA512
776694e049976d26f1b2c8e93ad1e07cfb3ab225253f0d5a3b749dc224875cec3c172c43f64366eb482a692e316bdcbaaec23b40498af4b34170d8374f9547f2

Download Submit
\Windows\system\UCbrreh.exe

Filesize
1.4MB

MD5
e79fdefd809a0754db9b00baf723dc65

SHA1
e81c1ef22e6bf915312213ad3eeb3ec07597fdba

SHA256
edbc5cd6cfd8457b8bbe408ea7386850221d9731734152fedaa30589bc9f8538

SHA512
e1b187ebb4d80c594e70febf1464546ef1d77b81f930ce496ab99710ae034d10bdf4c39d7ed104f0a01affd07ce2ef7feb2413bbc140d0c9fd9d8e2f55e90f1e

Download Submit
\Windows\system\UICyUrF.exe

Filesize
1.4MB

MD5
012926916ed47b48845e0b584cedac0f

SHA1
4243f9c403154b657c23831ca4323759c821e49f

SHA256
70bdb7d630482510df8798f71411bdd897378c270b5a3f269007877d70ae9bdb

SHA512
ee334273dba727f8c38297b3210fe594ae2e6c337b2407642d164eaf136cd8aa92199780f602484a71401e3b015e5a419861e4e3235cc2504ad641cb017d26cb

Download Submit
\Windows\system\UnijxEo.exe

Filesize
1.4MB

MD5
ae386349cc589f5b6047ec6d939f6fcb

SHA1
3c176213e5ce31509448a14975178945d6932d98

SHA256
b407695053a3c08871e50ab8e717f653d8ba72c712210428903e2f722a76f833

SHA512
03656dcb85f9f1341309e9f3e3df4faaba83f97bc291695b0d5aa5c1be33e71ced07bf3be94f5a03299bad018446ba7f31b72f3c94ee8b11c50e39324824e2ad

Download Submit
\Windows\system\XPjczYn.exe

Filesize
1.4MB

MD5
6569782c5d94e59277be7acc4776a2de

SHA1
770e42ec0af69b42871533060c1d0b8d528bf637

SHA256
f9776ddcb22a8de9a1276a66e1516de10a64b3d9501dbcd0533dede4a2481a7e

SHA512
305eab7668d61adce1d72641f4aa64010e3f11b424524c972912a68155aa33223d9942393bd5e5c4a444834f33fa21bfc756b01e5ee820ccba34290413557b83

Download Submit
\Windows\system\cEbbIat.exe

Filesize
1.4MB

MD5
cd8b07ccd48f98701fc97935dc69e476

SHA1
caa933ef8fb3a897f9d4cd5e496912a6f24400b6

SHA256
aba54c58db3a4f4d5f107e9bc82042a26a4e09336d451f9295aa26b355a6d782

SHA512
834ed159b0b8a958a345db8b31853ae192ff71dcb797ba8de44018b748f2e107ae5d9e86153088553e180b978c1c26ab133c3b46ee6502bd989d108246634752

Download Submit
\Windows\system\eOZhFnp.exe

Filesize
1.4MB

MD5
f9deb74234f0c8d5f40f477502cf9219

SHA1
2e50fb034baa87c492bd1ec0e9ab7cc6096e88fb

SHA256
6aca577232cbc78ca0db1a459b9d96966d99419bd2d32bb07d72c18444d0a443

SHA512
cdd98fb48cf3f3d876bb370b85a4b0c742bc9b61b6ab40ed254f4cf6412ee7a52ead0a503abdc456de6b2092987446ff70a7df798cbcc57477e34bfe2d5ff69c

Download Submit
\Windows\system\oUPcjcK.exe

Filesize
1.4MB

MD5
d6da93234cd39bba67d77d07fde19fbc

SHA1
ae3038b7e75b9f15ab1a1be799cc4df5188e7a8e

SHA256
ef7759ce7da8b1f775fc8f7b29f301e6e4be0d037df8e7447c642fe071b643d5

SHA512
1a42024f7d8a6a942fc205c1ea7d072724b096fe269ff69ed09b388db87d35ce50ff4a07faad3204f12c90c97d8698ed094e28406ec1374d21bd8773a8b620c1

Download Submit
\Windows\system\uMLDTcs.exe

Filesize
1.4MB

MD5
b96f0827983367c030403df71a785523

SHA1
56c1fe516f4d39f419f92f3def1c37d5da318149

SHA256
5cbe82b57066370553f042397e44a0176954d2d0f23708d74ede27b8753c35b4

SHA512
8ec2e935e3054f9e1e17c1505338dfdbe6fd6bb582d3a5b6888a1cea03fd66f201bf233db6e702d8f3d27f29bd37137bf1d3a0a7242747206cbbf87e8f4d3399

Download Submit
\Windows\system\zrAuZri.exe

Filesize
1.4MB

MD5
7fb6ff6214973b1f1b5d286355b3c0a5

SHA1
8e1ccb9922079536a931383761dfbffee4cab3a4

SHA256
86e5ad51e51d4e859ef97a3e2bd99e4e142ea54fd363be52a874747b4222b7f7

SHA512
fb3df5027803ed355d23de8cfcbc3c0693c8a23b74584629466744bb057d07c57f144349d82a8134686f15b526fdb7e7ebbb47283e50978736a396232877793b

Download Submit
memory/828-53-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/1384-104-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/1464-106-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/1652-66-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/1652-6260-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-107-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2172-6276-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2220-105-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2220-2-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-9362-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2220-9291-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2220-77-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-9254-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-0-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2220-102-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-17-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-103-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2220-45-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/2220-8807-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-7624-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-58-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2220-43-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-8-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2220-51-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-72-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-64-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2276-59-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2440-9-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2532-46-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/2628-19-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-837-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-41-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-44-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-6116-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2952-73-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/3036-26-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/3036-42-0x000007FEF53E0000-0x000007FEF5D7D000-memory.dmp

Filesize
9.6MB

Download
memory/3036-99-0x000007FEF53E0000-0x000007FEF5D7D000-memory.dmp

Filesize
9.6MB

Download
memory/3036-20-0x000007FEF569E000-0x000007FEF569F000-memory.dmp

Filesize
4KB

Download
memory/3036-40-0x000007FEF53E0000-0x000007FEF5D7D000-memory.dmp

Filesize
9.6MB

Download
memory/3036-38-0x000007FEF53E0000-0x000007FEF5D7D000-memory.dmp

Filesize
9.6MB

Download
memory/3036-36-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download