xmrig | 07878ba00ef8feee015c20ce5a42d04734fc4b246d84d9f40e87060afeb7ff67

Analysis

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
Size

2.0MB
MD5

3f5bfbc57ac7d1acede83b28849ba266
SHA1

7dd7337ff06e82c7e791d7a5dc1af6bd8ba11a8a
SHA256

07878ba00ef8feee015c20ce5a42d04734fc4b246d84d9f40e87060afeb7ff67
SHA512

4a1440eafe5e50407c06d84553aa00392e021d20456319bddab6f6ec3dcb244c8767d2b907b791519251ce67672b2848e3a1266d73923399fe5cad3a587fcef2
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMQ:NAB4

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral1/memory/3064-108-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2532-104-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2676-103-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/2284-101-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/2628-100-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2780-60-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/3048-30-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/2532-5092-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2676-5093-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/3048-5094-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/2628-5096-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2284-5095-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/2780-5097-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1996	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3048	WgVCnES.exe
2780	noSzMzf.exe
3064	rGHQvYS.exe
2628	lsDaLMC.exe
2284	qHOSKWy.exe
2676	dxajNKs.exe
2532	zxbefqZ.exe
1960	lqSZHas.exe
2800	DmWQUhR.exe
2696	ahXmcbg.exe
2860	nqcAsRU.exe
2756	XRLREOx.exe
2528	LsYALUP.exe
2816	scSMgOd.exe
2552	irSpbzd.exe
2724	yoTCLtO.exe
2680	ZcEdxrg.exe
1536	fbqSXKu.exe
1256	QTgHvhP.exe
1400	oZLNSUg.exe
2044	DnHnwNH.exe
1448	AyFZBVL.exe
2368	cGQNxYZ.exe
1920	BHxJyOC.exe
2096	yzsXsqm.exe
988	DFYbtFF.exe
1492	KpCmxwF.exe
1484	mjhGaVM.exe
1716	bHnitZt.exe
1824	QHdftxf.exe
876	wuIocwT.exe
1132	pBuxalb.exe
2380	VuGWlRE.exe
2312	XeLRiek.exe
1780	fTwfcIt.exe
1968	zdlFbWn.exe
1776	hUazJOp.exe
956	jxpuben.exe
1628	FOdTDhD.exe
632	soaKIVm.exe
328	fYqHVfh.exe
1292	fUsVyXb.exe
1048	QkEFhIM.exe
752	szHHkFr.exe
1660	pvnVizG.exe
2420	WdzEsPi.exe
1600	MjamWWO.exe
2448	seTvJPh.exe
568	nuSjNKk.exe
2980	TlOHvvI.exe
2008	FFVEplv.exe
2316	rgBgMuL.exe
1388	PRrUAWr.exe
872	bMcojOF.exe
308	ZWAoVaR.exe
2204	VqofgZe.exe
1284	tsghGuX.exe
1612	AsiVzBW.exe
1720	RPLMGVS.exe
2148	tBbyIqF.exe
3068	qmVOwxQ.exe
2508	ypIBWAt.exe
2548	ndWHdQx.exe
2744	PvZZDaE.exe

Loads dropped DLL 64 IoCs

pid	Process
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2460-0-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/files/0x0006000000016ccd-81.dat	upx
behavioral1/files/0x0006000000016d01-83.dat	upx
behavioral1/files/0x0006000000016cf2-94.dat	upx
behavioral1/files/0x0006000000016ca1-93.dat	upx
behavioral1/files/0x0006000000016c57-92.dat	upx
behavioral1/files/0x0006000000016a3a-91.dat	upx
behavioral1/files/0x0008000000016591-90.dat	upx
behavioral1/files/0x0007000000015ce1-89.dat	upx
behavioral1/memory/3064-108-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2532-104-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2676-103-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/memory/2284-101-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/2628-100-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/files/0x00130000000054a8-88.dat	upx
behavioral1/files/0x0006000000016d10-85.dat	upx
behavioral1/files/0x0006000000016d19-95.dat	upx
behavioral1/memory/2780-60-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/files/0x0006000000016c3a-59.dat	upx
behavioral1/files/0x00070000000167e8-58.dat	upx
behavioral1/files/0x0007000000015ced-38.dat	upx
behavioral1/files/0x0008000000015cd8-37.dat	upx
behavioral1/files/0x0037000000015b72-31.dat	upx
behavioral1/memory/3048-30-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/files/0x0006000000016c5b-80.dat	upx
behavioral1/files/0x0008000000015ca9-23.dat	upx
behavioral1/files/0x000c000000012279-5.dat	upx
behavioral1/files/0x0006000000016d21-123.dat	upx
behavioral1/files/0x0037000000015bb5-115.dat	upx
behavioral1/files/0x0006000000016d3e-142.dat	upx
behavioral1/files/0x0006000000016d57-159.dat	upx
behavioral1/files/0x0006000000016d5f-163.dat	upx
behavioral1/files/0x0006000000016d73-167.dat	upx
behavioral1/files/0x0006000000016d7d-175.dat	upx
behavioral1/files/0x0006000000016fa9-179.dat	upx
behavioral1/files/0x0006000000016d79-171.dat	upx
behavioral1/files/0x0006000000016d4f-155.dat	upx
behavioral1/files/0x0006000000016d2d-141.dat	upx
behavioral1/files/0x0006000000016d46-146.dat	upx
behavioral1/files/0x0006000000016d36-133.dat	upx
behavioral1/memory/2532-5092-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2676-5093-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/memory/3048-5094-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/2628-5096-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/2284-5095-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/2780-5097-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xLRBgcx.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\dOQjqto.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\pnidRjy.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\SJHNmqn.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\MjkykAj.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\JPgcCGy.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\djCuONs.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\qOGFuZZ.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\zxoygOT.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\xZcHCPV.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\HavAuoL.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\bLDAIVq.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\xlcCbla.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\asqWhqc.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\WgVCnES.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\ImCLmCu.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\UJNJoAr.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\LasecyB.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\uKuFPkK.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\EfSXqJG.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\RagmUlm.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\WVhTwhz.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\koIMydS.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\pSDHRwt.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\SMcMbol.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\gFISdhs.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\PFAHIPW.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\hhhmOrN.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\XNtyblr.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\EWWQgLJ.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\FBKwjvN.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\OngFCBW.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\vZzuERy.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\xgaqGXw.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\heYjzlC.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\mcKcUhA.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\QHRYmYu.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\yFVaElM.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\bobmnee.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\TBMjKjZ.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\WPXUEBC.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\kyleiPI.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\xCjnOED.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\cwOUSdd.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\antMQYR.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\JdtCKbJ.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\wNsMLXN.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\KuGLbzJ.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\SRZJMZp.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\YtvqwWS.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\LffOgmh.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\yvBygIZ.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\LSGQTyB.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\ruQPAuq.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\ukmZUZU.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\UabRmgE.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\dNxWPiW.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\UaemWDy.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\rsAjCSZ.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\LzstaNU.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\poWOEKu.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\pZkzcBQ.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\SsRpzRv.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
File created	C:\Windows\System\qCeDgZx.exe	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1996	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
Token: SeDebugPrivilege	1996	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 1996	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	29
PID 2460 wrote to memory of 1996	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	29
PID 2460 wrote to memory of 1996	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	29
PID 2460 wrote to memory of 3048	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	30
PID 2460 wrote to memory of 3048	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	30
PID 2460 wrote to memory of 3048	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	30
PID 2460 wrote to memory of 3064	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	31
PID 2460 wrote to memory of 3064	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	31
PID 2460 wrote to memory of 3064	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2780	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	32
PID 2460 wrote to memory of 2780	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	32
PID 2460 wrote to memory of 2780	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	32
PID 2460 wrote to memory of 2860	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	33
PID 2460 wrote to memory of 2860	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	33
PID 2460 wrote to memory of 2860	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	33
PID 2460 wrote to memory of 2628	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	34
PID 2460 wrote to memory of 2628	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	34
PID 2460 wrote to memory of 2628	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	34
PID 2460 wrote to memory of 2756	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	35
PID 2460 wrote to memory of 2756	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	35
PID 2460 wrote to memory of 2756	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	35
PID 2460 wrote to memory of 2284	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	36
PID 2460 wrote to memory of 2284	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	36
PID 2460 wrote to memory of 2284	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	36
PID 2460 wrote to memory of 2528	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	37
PID 2460 wrote to memory of 2528	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	37
PID 2460 wrote to memory of 2528	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	37
PID 2460 wrote to memory of 2676	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	38
PID 2460 wrote to memory of 2676	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	38
PID 2460 wrote to memory of 2676	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	38
PID 2460 wrote to memory of 2816	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	39
PID 2460 wrote to memory of 2816	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	39
PID 2460 wrote to memory of 2816	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	39
PID 2460 wrote to memory of 2532	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	40
PID 2460 wrote to memory of 2532	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	40
PID 2460 wrote to memory of 2532	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	40
PID 2460 wrote to memory of 2552	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	41
PID 2460 wrote to memory of 2552	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	41
PID 2460 wrote to memory of 2552	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	41
PID 2460 wrote to memory of 1960	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	42
PID 2460 wrote to memory of 1960	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	42
PID 2460 wrote to memory of 1960	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	42
PID 2460 wrote to memory of 2724	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	43
PID 2460 wrote to memory of 2724	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	43
PID 2460 wrote to memory of 2724	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	43
PID 2460 wrote to memory of 2800	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	44
PID 2460 wrote to memory of 2800	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	44
PID 2460 wrote to memory of 2800	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	44
PID 2460 wrote to memory of 2680	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	45
PID 2460 wrote to memory of 2680	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	45
PID 2460 wrote to memory of 2680	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	45
PID 2460 wrote to memory of 2696	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	46
PID 2460 wrote to memory of 2696	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	46
PID 2460 wrote to memory of 2696	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	46
PID 2460 wrote to memory of 1536	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	47
PID 2460 wrote to memory of 1536	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	47
PID 2460 wrote to memory of 1536	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	47
PID 2460 wrote to memory of 1256	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	48
PID 2460 wrote to memory of 1256	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	48
PID 2460 wrote to memory of 1256	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	48
PID 2460 wrote to memory of 1448	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	49
PID 2460 wrote to memory of 1448	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	49
PID 2460 wrote to memory of 1448	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	49
PID 2460 wrote to memory of 1400	2460	3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f5bfbc57ac7d1acede83b28849ba266_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1996
- C:\Windows\System\WgVCnES.exe
  C:\Windows\System\WgVCnES.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\rGHQvYS.exe
  C:\Windows\System\rGHQvYS.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\noSzMzf.exe
  C:\Windows\System\noSzMzf.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\nqcAsRU.exe
  C:\Windows\System\nqcAsRU.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\lsDaLMC.exe
  C:\Windows\System\lsDaLMC.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\XRLREOx.exe
  C:\Windows\System\XRLREOx.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\qHOSKWy.exe
  C:\Windows\System\qHOSKWy.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\LsYALUP.exe
  C:\Windows\System\LsYALUP.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\dxajNKs.exe
  C:\Windows\System\dxajNKs.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\scSMgOd.exe
  C:\Windows\System\scSMgOd.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\zxbefqZ.exe
  C:\Windows\System\zxbefqZ.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\irSpbzd.exe
  C:\Windows\System\irSpbzd.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\lqSZHas.exe
  C:\Windows\System\lqSZHas.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\yoTCLtO.exe
  C:\Windows\System\yoTCLtO.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\DmWQUhR.exe
  C:\Windows\System\DmWQUhR.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\ZcEdxrg.exe
  C:\Windows\System\ZcEdxrg.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\ahXmcbg.exe
  C:\Windows\System\ahXmcbg.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\fbqSXKu.exe
  C:\Windows\System\fbqSXKu.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\QTgHvhP.exe
  C:\Windows\System\QTgHvhP.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\AyFZBVL.exe
  C:\Windows\System\AyFZBVL.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\oZLNSUg.exe
  C:\Windows\System\oZLNSUg.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\cGQNxYZ.exe
  C:\Windows\System\cGQNxYZ.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\DnHnwNH.exe
  C:\Windows\System\DnHnwNH.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\BHxJyOC.exe
  C:\Windows\System\BHxJyOC.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\yzsXsqm.exe
  C:\Windows\System\yzsXsqm.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\DFYbtFF.exe
  C:\Windows\System\DFYbtFF.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\KpCmxwF.exe
  C:\Windows\System\KpCmxwF.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\mjhGaVM.exe
  C:\Windows\System\mjhGaVM.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\bHnitZt.exe
  C:\Windows\System\bHnitZt.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\QHdftxf.exe
  C:\Windows\System\QHdftxf.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\wuIocwT.exe
  C:\Windows\System\wuIocwT.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\pBuxalb.exe
  C:\Windows\System\pBuxalb.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\VuGWlRE.exe
  C:\Windows\System\VuGWlRE.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\XeLRiek.exe
  C:\Windows\System\XeLRiek.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\fTwfcIt.exe
  C:\Windows\System\fTwfcIt.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\zdlFbWn.exe
  C:\Windows\System\zdlFbWn.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\hUazJOp.exe
  C:\Windows\System\hUazJOp.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\jxpuben.exe
  C:\Windows\System\jxpuben.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\FOdTDhD.exe
  C:\Windows\System\FOdTDhD.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\soaKIVm.exe
  C:\Windows\System\soaKIVm.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\fYqHVfh.exe
  C:\Windows\System\fYqHVfh.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\fUsVyXb.exe
  C:\Windows\System\fUsVyXb.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\QkEFhIM.exe
  C:\Windows\System\QkEFhIM.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\szHHkFr.exe
  C:\Windows\System\szHHkFr.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\pvnVizG.exe
  C:\Windows\System\pvnVizG.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\WdzEsPi.exe
  C:\Windows\System\WdzEsPi.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\MjamWWO.exe
  C:\Windows\System\MjamWWO.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\seTvJPh.exe
  C:\Windows\System\seTvJPh.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\nuSjNKk.exe
  C:\Windows\System\nuSjNKk.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\TlOHvvI.exe
  C:\Windows\System\TlOHvvI.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\FFVEplv.exe
  C:\Windows\System\FFVEplv.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\rgBgMuL.exe
  C:\Windows\System\rgBgMuL.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\PRrUAWr.exe
  C:\Windows\System\PRrUAWr.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\bMcojOF.exe
  C:\Windows\System\bMcojOF.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\ZWAoVaR.exe
  C:\Windows\System\ZWAoVaR.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\VqofgZe.exe
  C:\Windows\System\VqofgZe.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\tsghGuX.exe
  C:\Windows\System\tsghGuX.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\AsiVzBW.exe
  C:\Windows\System\AsiVzBW.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\RPLMGVS.exe
  C:\Windows\System\RPLMGVS.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\tBbyIqF.exe
  C:\Windows\System\tBbyIqF.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\qmVOwxQ.exe
  C:\Windows\System\qmVOwxQ.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\ypIBWAt.exe
  C:\Windows\System\ypIBWAt.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\ndWHdQx.exe
  C:\Windows\System\ndWHdQx.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\PvZZDaE.exe
  C:\Windows\System\PvZZDaE.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\UaYPyHT.exe
  C:\Windows\System\UaYPyHT.exe
  2⤵
  PID:2688
- C:\Windows\System\LntjHvE.exe
  C:\Windows\System\LntjHvE.exe
  2⤵
  PID:2644
- C:\Windows\System\vXVwxKt.exe
  C:\Windows\System\vXVwxKt.exe
  2⤵
  PID:2776
- C:\Windows\System\wesCuKB.exe
  C:\Windows\System\wesCuKB.exe
  2⤵
  PID:2620
- C:\Windows\System\gpIQRhw.exe
  C:\Windows\System\gpIQRhw.exe
  2⤵
  PID:2668
- C:\Windows\System\Nmwoqbh.exe
  C:\Windows\System\Nmwoqbh.exe
  2⤵
  PID:2516
- C:\Windows\System\ckcPzNN.exe
  C:\Windows\System\ckcPzNN.exe
  2⤵
  PID:2708
- C:\Windows\System\SIyEeqV.exe
  C:\Windows\System\SIyEeqV.exe
  2⤵
  PID:2868
- C:\Windows\System\YtUvtff.exe
  C:\Windows\System\YtUvtff.exe
  2⤵
  PID:1764
- C:\Windows\System\qnOlsHP.exe
  C:\Windows\System\qnOlsHP.exe
  2⤵
  PID:1740
- C:\Windows\System\MQQiQMY.exe
  C:\Windows\System\MQQiQMY.exe
  2⤵
  PID:2840
- C:\Windows\System\vyEcmAT.exe
  C:\Windows\System\vyEcmAT.exe
  2⤵
  PID:2424
- C:\Windows\System\dpoZzma.exe
  C:\Windows\System\dpoZzma.exe
  2⤵
  PID:1308
- C:\Windows\System\DtJAdbn.exe
  C:\Windows\System\DtJAdbn.exe
  2⤵
  PID:1248
- C:\Windows\System\rfdDRgh.exe
  C:\Windows\System\rfdDRgh.exe
  2⤵
  PID:2792
- C:\Windows\System\vGWGNPN.exe
  C:\Windows\System\vGWGNPN.exe
  2⤵
  PID:2500
- C:\Windows\System\WJgPoku.exe
  C:\Windows\System\WJgPoku.exe
  2⤵
  PID:2700
- C:\Windows\System\AitbroP.exe
  C:\Windows\System\AitbroP.exe
  2⤵
  PID:316
- C:\Windows\System\jmmMWcq.exe
  C:\Windows\System\jmmMWcq.exe
  2⤵
  PID:1800
- C:\Windows\System\JitKVnq.exe
  C:\Windows\System\JitKVnq.exe
  2⤵
  PID:2996
- C:\Windows\System\jHooSHo.exe
  C:\Windows\System\jHooSHo.exe
  2⤵
  PID:2388
- C:\Windows\System\ApzmrDf.exe
  C:\Windows\System\ApzmrDf.exe
  2⤵
  PID:2820
- C:\Windows\System\sfsmnYw.exe
  C:\Windows\System\sfsmnYw.exe
  2⤵
  PID:300
- C:\Windows\System\pWQuAjd.exe
  C:\Windows\System\pWQuAjd.exe
  2⤵
  PID:1924
- C:\Windows\System\IxlZGuT.exe
  C:\Windows\System\IxlZGuT.exe
  2⤵
  PID:1504
- C:\Windows\System\PbCPJnE.exe
  C:\Windows\System\PbCPJnE.exe
  2⤵
  PID:1980
- C:\Windows\System\RrIsmqk.exe
  C:\Windows\System\RrIsmqk.exe
  2⤵
  PID:2088
- C:\Windows\System\xJCTOdk.exe
  C:\Windows\System\xJCTOdk.exe
  2⤵
  PID:1532
- C:\Windows\System\rpOIgkK.exe
  C:\Windows\System\rpOIgkK.exe
  2⤵
  PID:2108
- C:\Windows\System\svzTNCf.exe
  C:\Windows\System\svzTNCf.exe
  2⤵
  PID:264
- C:\Windows\System\XcBHVRr.exe
  C:\Windows\System\XcBHVRr.exe
  2⤵
  PID:484
- C:\Windows\System\PdLLBrb.exe
  C:\Windows\System\PdLLBrb.exe
  2⤵
  PID:1280
- C:\Windows\System\kiEbzaF.exe
  C:\Windows\System\kiEbzaF.exe
  2⤵
  PID:2692
- C:\Windows\System\mhcCvZu.exe
  C:\Windows\System\mhcCvZu.exe
  2⤵
  PID:1180
- C:\Windows\System\qdLGFyT.exe
  C:\Windows\System\qdLGFyT.exe
  2⤵
  PID:2140
- C:\Windows\System\aXwEoiK.exe
  C:\Windows\System\aXwEoiK.exe
  2⤵
  PID:1264
- C:\Windows\System\ZKJVlwB.exe
  C:\Windows\System\ZKJVlwB.exe
  2⤵
  PID:1348
- C:\Windows\System\LkoKgSv.exe
  C:\Windows\System\LkoKgSv.exe
  2⤵
  PID:828
- C:\Windows\System\rSTetRz.exe
  C:\Windows\System\rSTetRz.exe
  2⤵
  PID:1572
- C:\Windows\System\iAjEIcF.exe
  C:\Windows\System\iAjEIcF.exe
  2⤵
  PID:1404
- C:\Windows\System\OngFCBW.exe
  C:\Windows\System\OngFCBW.exe
  2⤵
  PID:2956
- C:\Windows\System\eINOMec.exe
  C:\Windows\System\eINOMec.exe
  2⤵
  PID:1052
- C:\Windows\System\zHDUjIl.exe
  C:\Windows\System\zHDUjIl.exe
  2⤵
  PID:1148
- C:\Windows\System\JuKgYPy.exe
  C:\Windows\System\JuKgYPy.exe
  2⤵
  PID:2908
- C:\Windows\System\IJNTCbc.exe
  C:\Windows\System\IJNTCbc.exe
  2⤵
  PID:1964
- C:\Windows\System\XXOkzKB.exe
  C:\Windows\System\XXOkzKB.exe
  2⤵
  PID:3040
- C:\Windows\System\WtLlyUV.exe
  C:\Windows\System\WtLlyUV.exe
  2⤵
  PID:1184
- C:\Windows\System\nxqzMyN.exe
  C:\Windows\System\nxqzMyN.exe
  2⤵
  PID:2340
- C:\Windows\System\onWtLax.exe
  C:\Windows\System\onWtLax.exe
  2⤵
  PID:1992
- C:\Windows\System\zqJuPtF.exe
  C:\Windows\System\zqJuPtF.exe
  2⤵
  PID:1724
- C:\Windows\System\eXqazwi.exe
  C:\Windows\System\eXqazwi.exe
  2⤵
  PID:2636
- C:\Windows\System\uKUWrGS.exe
  C:\Windows\System\uKUWrGS.exe
  2⤵
  PID:2704
- C:\Windows\System\bwSKGaZ.exe
  C:\Windows\System\bwSKGaZ.exe
  2⤵
  PID:2052
- C:\Windows\System\cdtxQwS.exe
  C:\Windows\System\cdtxQwS.exe
  2⤵
  PID:2656
- C:\Windows\System\OyWCZtk.exe
  C:\Windows\System\OyWCZtk.exe
  2⤵
  PID:2496
- C:\Windows\System\IAjWnTF.exe
  C:\Windows\System\IAjWnTF.exe
  2⤵
  PID:2592
- C:\Windows\System\KaehxiV.exe
  C:\Windows\System\KaehxiV.exe
  2⤵
  PID:2900
- C:\Windows\System\RrtkFdr.exe
  C:\Windows\System\RrtkFdr.exe
  2⤵
  PID:536
- C:\Windows\System\ZCzOkNY.exe
  C:\Windows\System\ZCzOkNY.exe
  2⤵
  PID:1756
- C:\Windows\System\kuVVOCD.exe
  C:\Windows\System\kuVVOCD.exe
  2⤵
  PID:1652
- C:\Windows\System\JnMxjrd.exe
  C:\Windows\System\JnMxjrd.exe
  2⤵
  PID:1044
- C:\Windows\System\ihuErSC.exe
  C:\Windows\System\ihuErSC.exe
  2⤵
  PID:1456
- C:\Windows\System\gNtnicR.exe
  C:\Windows\System\gNtnicR.exe
  2⤵
  PID:1672
- C:\Windows\System\mbkeXqG.exe
  C:\Windows\System\mbkeXqG.exe
  2⤵
  PID:2888
- C:\Windows\System\efoMzvT.exe
  C:\Windows\System\efoMzvT.exe
  2⤵
  PID:1316
- C:\Windows\System\FVLpMOW.exe
  C:\Windows\System\FVLpMOW.exe
  2⤵
  PID:2444
- C:\Windows\System\JwoMPvE.exe
  C:\Windows\System\JwoMPvE.exe
  2⤵
  PID:1656
- C:\Windows\System\MNthdUw.exe
  C:\Windows\System\MNthdUw.exe
  2⤵
  PID:296
- C:\Windows\System\tfRhnJj.exe
  C:\Windows\System\tfRhnJj.exe
  2⤵
  PID:1304
- C:\Windows\System\GLWwiKJ.exe
  C:\Windows\System\GLWwiKJ.exe
  2⤵
  PID:2144
- C:\Windows\System\WsGwSqo.exe
  C:\Windows\System\WsGwSqo.exe
  2⤵
  PID:1616
- C:\Windows\System\DyrmiBt.exe
  C:\Windows\System\DyrmiBt.exe
  2⤵
  PID:2892
- C:\Windows\System\uUjEExd.exe
  C:\Windows\System\uUjEExd.exe
  2⤵
  PID:2032
- C:\Windows\System\jTpZccv.exe
  C:\Windows\System\jTpZccv.exe
  2⤵
  PID:1804
- C:\Windows\System\EUIdsJY.exe
  C:\Windows\System\EUIdsJY.exe
  2⤵
  PID:2060
- C:\Windows\System\HJPsYqk.exe
  C:\Windows\System\HJPsYqk.exe
  2⤵
  PID:2464
- C:\Windows\System\eOhcrFs.exe
  C:\Windows\System\eOhcrFs.exe
  2⤵
  PID:1852
- C:\Windows\System\VTNuazc.exe
  C:\Windows\System\VTNuazc.exe
  2⤵
  PID:2936
- C:\Windows\System\oHhytkf.exe
  C:\Windows\System\oHhytkf.exe
  2⤵
  PID:2812
- C:\Windows\System\gqPeFHI.exe
  C:\Windows\System\gqPeFHI.exe
  2⤵
  PID:2396
- C:\Windows\System\GIPqRjm.exe
  C:\Windows\System\GIPqRjm.exe
  2⤵
  PID:2176
- C:\Windows\System\TyuXfSQ.exe
  C:\Windows\System\TyuXfSQ.exe
  2⤵
  PID:1680
- C:\Windows\System\XnjXcPX.exe
  C:\Windows\System\XnjXcPX.exe
  2⤵
  PID:3020
- C:\Windows\System\adawruw.exe
  C:\Windows\System\adawruw.exe
  2⤵
  PID:1252
- C:\Windows\System\rcEOeNh.exe
  C:\Windows\System\rcEOeNh.exe
  2⤵
  PID:2436
- C:\Windows\System\EXfjbsX.exe
  C:\Windows\System\EXfjbsX.exe
  2⤵
  PID:3008
- C:\Windows\System\tWCSnsY.exe
  C:\Windows\System\tWCSnsY.exe
  2⤵
  PID:2212
- C:\Windows\System\WvlzDVE.exe
  C:\Windows\System\WvlzDVE.exe
  2⤵
  PID:2768
- C:\Windows\System\tfQsvbv.exe
  C:\Windows\System\tfQsvbv.exe
  2⤵
  PID:288
- C:\Windows\System\pbLRNYU.exe
  C:\Windows\System\pbLRNYU.exe
  2⤵
  PID:1576
- C:\Windows\System\abKeCzQ.exe
  C:\Windows\System\abKeCzQ.exe
  2⤵
  PID:2760
- C:\Windows\System\FmlZVuK.exe
  C:\Windows\System\FmlZVuK.exe
  2⤵
  PID:1808
- C:\Windows\System\xoUBbiU.exe
  C:\Windows\System\xoUBbiU.exe
  2⤵
  PID:880
- C:\Windows\System\ZvaTPVh.exe
  C:\Windows\System\ZvaTPVh.exe
  2⤵
  PID:2016
- C:\Windows\System\JzvQdgK.exe
  C:\Windows\System\JzvQdgK.exe
  2⤵
  PID:2296
- C:\Windows\System\vqzcDZE.exe
  C:\Windows\System\vqzcDZE.exe
  2⤵
  PID:1028
- C:\Windows\System\MVfliRM.exe
  C:\Windows\System\MVfliRM.exe
  2⤵
  PID:764
- C:\Windows\System\sSZJIMB.exe
  C:\Windows\System\sSZJIMB.exe
  2⤵
  PID:692
- C:\Windows\System\ToZXLnP.exe
  C:\Windows\System\ToZXLnP.exe
  2⤵
  PID:2904
- C:\Windows\System\IIznfUN.exe
  C:\Windows\System\IIznfUN.exe
  2⤵
  PID:2540
- C:\Windows\System\UNjhBfG.exe
  C:\Windows\System\UNjhBfG.exe
  2⤵
  PID:1328
- C:\Windows\System\PnQqbrv.exe
  C:\Windows\System\PnQqbrv.exe
  2⤵
  PID:2968
- C:\Windows\System\NbmKyXH.exe
  C:\Windows\System\NbmKyXH.exe
  2⤵
  PID:2752
- C:\Windows\System\eFYPoiK.exe
  C:\Windows\System\eFYPoiK.exe
  2⤵
  PID:1648
- C:\Windows\System\UiEgSMa.exe
  C:\Windows\System\UiEgSMa.exe
  2⤵
  PID:1564
- C:\Windows\System\AlylyRW.exe
  C:\Windows\System\AlylyRW.exe
  2⤵
  PID:2612
- C:\Windows\System\LgEOKPA.exe
  C:\Windows\System\LgEOKPA.exe
  2⤵
  PID:2308
- C:\Windows\System\qgFWKOZ.exe
  C:\Windows\System\qgFWKOZ.exe
  2⤵
  PID:1168
- C:\Windows\System\llRnBSP.exe
  C:\Windows\System\llRnBSP.exe
  2⤵
  PID:2064
- C:\Windows\System\hIGxtOI.exe
  C:\Windows\System\hIGxtOI.exe
  2⤵
  PID:1324
- C:\Windows\System\xjZsNQz.exe
  C:\Windows\System\xjZsNQz.exe
  2⤵
  PID:1792
- C:\Windows\System\BpcemQH.exe
  C:\Windows\System\BpcemQH.exe
  2⤵
  PID:900
- C:\Windows\System\qIfgIDl.exe
  C:\Windows\System\qIfgIDl.exe
  2⤵
  PID:344
- C:\Windows\System\lSuXnHA.exe
  C:\Windows\System\lSuXnHA.exe
  2⤵
  PID:3076
- C:\Windows\System\ufDbuqz.exe
  C:\Windows\System\ufDbuqz.exe
  2⤵
  PID:3092
- C:\Windows\System\APoIoUo.exe
  C:\Windows\System\APoIoUo.exe
  2⤵
  PID:3136
- C:\Windows\System\lVETUHR.exe
  C:\Windows\System\lVETUHR.exe
  2⤵
  PID:3152
- C:\Windows\System\yJojfgC.exe
  C:\Windows\System\yJojfgC.exe
  2⤵
  PID:3168
- C:\Windows\System\TJZUHal.exe
  C:\Windows\System\TJZUHal.exe
  2⤵
  PID:3184
- C:\Windows\System\ZvYItMF.exe
  C:\Windows\System\ZvYItMF.exe
  2⤵
  PID:3200
- C:\Windows\System\IctiPVL.exe
  C:\Windows\System\IctiPVL.exe
  2⤵
  PID:3216
- C:\Windows\System\Ebgengy.exe
  C:\Windows\System\Ebgengy.exe
  2⤵
  PID:3232
- C:\Windows\System\DiKjbsX.exe
  C:\Windows\System\DiKjbsX.exe
  2⤵
  PID:3248
- C:\Windows\System\wIIlFlH.exe
  C:\Windows\System\wIIlFlH.exe
  2⤵
  PID:3264
- C:\Windows\System\rZdXupk.exe
  C:\Windows\System\rZdXupk.exe
  2⤵
  PID:3280
- C:\Windows\System\DxGqORr.exe
  C:\Windows\System\DxGqORr.exe
  2⤵
  PID:3304
- C:\Windows\System\IVywYav.exe
  C:\Windows\System\IVywYav.exe
  2⤵
  PID:3320
- C:\Windows\System\bBadoWK.exe
  C:\Windows\System\bBadoWK.exe
  2⤵
  PID:3336
- C:\Windows\System\YsGqmJu.exe
  C:\Windows\System\YsGqmJu.exe
  2⤵
  PID:3352
- C:\Windows\System\GtnWBZi.exe
  C:\Windows\System\GtnWBZi.exe
  2⤵
  PID:3368
- C:\Windows\System\BaVaZtA.exe
  C:\Windows\System\BaVaZtA.exe
  2⤵
  PID:3384
- C:\Windows\System\lEDMPJG.exe
  C:\Windows\System\lEDMPJG.exe
  2⤵
  PID:3400
- C:\Windows\System\xAIwlBP.exe
  C:\Windows\System\xAIwlBP.exe
  2⤵
  PID:3416
- C:\Windows\System\UTNlfWU.exe
  C:\Windows\System\UTNlfWU.exe
  2⤵
  PID:3432
- C:\Windows\System\YNDLAMt.exe
  C:\Windows\System\YNDLAMt.exe
  2⤵
  PID:3448
- C:\Windows\System\bOnrmrC.exe
  C:\Windows\System\bOnrmrC.exe
  2⤵
  PID:3464
- C:\Windows\System\VOcFFdz.exe
  C:\Windows\System\VOcFFdz.exe
  2⤵
  PID:3480
- C:\Windows\System\pZkzcBQ.exe
  C:\Windows\System\pZkzcBQ.exe
  2⤵
  PID:3496
- C:\Windows\System\RCbmAqB.exe
  C:\Windows\System\RCbmAqB.exe
  2⤵
  PID:3512
- C:\Windows\System\YbUsfaE.exe
  C:\Windows\System\YbUsfaE.exe
  2⤵
  PID:3528
- C:\Windows\System\OluiaEI.exe
  C:\Windows\System\OluiaEI.exe
  2⤵
  PID:3544
- C:\Windows\System\aPqVNcA.exe
  C:\Windows\System\aPqVNcA.exe
  2⤵
  PID:3560
- C:\Windows\System\ZzNhOTN.exe
  C:\Windows\System\ZzNhOTN.exe
  2⤵
  PID:3576
- C:\Windows\System\nbCEWbk.exe
  C:\Windows\System\nbCEWbk.exe
  2⤵
  PID:3592
- C:\Windows\System\VfvtUTa.exe
  C:\Windows\System\VfvtUTa.exe
  2⤵
  PID:3608
- C:\Windows\System\wNXmfsP.exe
  C:\Windows\System\wNXmfsP.exe
  2⤵
  PID:3624
- C:\Windows\System\iiYZfBo.exe
  C:\Windows\System\iiYZfBo.exe
  2⤵
  PID:3640
- C:\Windows\System\ugwezGt.exe
  C:\Windows\System\ugwezGt.exe
  2⤵
  PID:3660
- C:\Windows\System\ipEGGDL.exe
  C:\Windows\System\ipEGGDL.exe
  2⤵
  PID:3676
- C:\Windows\System\vRgBNrL.exe
  C:\Windows\System\vRgBNrL.exe
  2⤵
  PID:3692
- C:\Windows\System\WxZjiuf.exe
  C:\Windows\System\WxZjiuf.exe
  2⤵
  PID:3708
- C:\Windows\System\yVKCqyU.exe
  C:\Windows\System\yVKCqyU.exe
  2⤵
  PID:3724
- C:\Windows\System\DszjJmS.exe
  C:\Windows\System\DszjJmS.exe
  2⤵
  PID:3740
- C:\Windows\System\lYHuKFh.exe
  C:\Windows\System\lYHuKFh.exe
  2⤵
  PID:3756
- C:\Windows\System\pYfqWMN.exe
  C:\Windows\System\pYfqWMN.exe
  2⤵
  PID:3776
- C:\Windows\System\SfpjemQ.exe
  C:\Windows\System\SfpjemQ.exe
  2⤵
  PID:3792
- C:\Windows\System\KVBIxwL.exe
  C:\Windows\System\KVBIxwL.exe
  2⤵
  PID:3808
- C:\Windows\System\Jzeooev.exe
  C:\Windows\System\Jzeooev.exe
  2⤵
  PID:3824
- C:\Windows\System\gMSYjlY.exe
  C:\Windows\System\gMSYjlY.exe
  2⤵
  PID:3840
- C:\Windows\System\eIfPujG.exe
  C:\Windows\System\eIfPujG.exe
  2⤵
  PID:3856
- C:\Windows\System\wAnDMOr.exe
  C:\Windows\System\wAnDMOr.exe
  2⤵
  PID:3872
- C:\Windows\System\UklIRLN.exe
  C:\Windows\System\UklIRLN.exe
  2⤵
  PID:3888
- C:\Windows\System\CdyeJUb.exe
  C:\Windows\System\CdyeJUb.exe
  2⤵
  PID:3904
- C:\Windows\System\fdsenbz.exe
  C:\Windows\System\fdsenbz.exe
  2⤵
  PID:3920
- C:\Windows\System\wOYcOZN.exe
  C:\Windows\System\wOYcOZN.exe
  2⤵
  PID:3936
- C:\Windows\System\yBOvwyF.exe
  C:\Windows\System\yBOvwyF.exe
  2⤵
  PID:3952
- C:\Windows\System\nfXfwGC.exe
  C:\Windows\System\nfXfwGC.exe
  2⤵
  PID:3968
- C:\Windows\System\VzIakgn.exe
  C:\Windows\System\VzIakgn.exe
  2⤵
  PID:3984
- C:\Windows\System\LRVrAIc.exe
  C:\Windows\System\LRVrAIc.exe
  2⤵
  PID:4000
- C:\Windows\System\rHKLRYO.exe
  C:\Windows\System\rHKLRYO.exe
  2⤵
  PID:4020
- C:\Windows\System\WXdDMeH.exe
  C:\Windows\System\WXdDMeH.exe
  2⤵
  PID:4036
- C:\Windows\System\LaKMGWu.exe
  C:\Windows\System\LaKMGWu.exe
  2⤵
  PID:4052
- C:\Windows\System\ASBSxpX.exe
  C:\Windows\System\ASBSxpX.exe
  2⤵
  PID:4068
- C:\Windows\System\SFQytIB.exe
  C:\Windows\System\SFQytIB.exe
  2⤵
  PID:4084
- C:\Windows\System\INdgdBM.exe
  C:\Windows\System\INdgdBM.exe
  2⤵
  PID:592
- C:\Windows\System\xURcddN.exe
  C:\Windows\System\xURcddN.exe
  2⤵
  PID:2856
- C:\Windows\System\YNSruyN.exe
  C:\Windows\System\YNSruyN.exe
  2⤵
  PID:3104
- C:\Windows\System\hHjbDoD.exe
  C:\Windows\System\hHjbDoD.exe
  2⤵
  PID:352
- C:\Windows\System\XhqKtYd.exe
  C:\Windows\System\XhqKtYd.exe
  2⤵
  PID:2236
- C:\Windows\System\XgpmXIs.exe
  C:\Windows\System\XgpmXIs.exe
  2⤵
  PID:3112
- C:\Windows\System\FMZGizZ.exe
  C:\Windows\System\FMZGizZ.exe
  2⤵
  PID:3128
- C:\Windows\System\sJkNJNt.exe
  C:\Windows\System\sJkNJNt.exe
  2⤵
  PID:3148
- C:\Windows\System\ostbaQO.exe
  C:\Windows\System\ostbaQO.exe
  2⤵
  PID:3212
- C:\Windows\System\foQYcRm.exe
  C:\Windows\System\foQYcRm.exe
  2⤵
  PID:3288
- C:\Windows\System\SVqEedH.exe
  C:\Windows\System\SVqEedH.exe
  2⤵
  PID:3176
- C:\Windows\System\xZxyRmy.exe
  C:\Windows\System\xZxyRmy.exe
  2⤵
  PID:3300
- C:\Windows\System\LwoCxDP.exe
  C:\Windows\System\LwoCxDP.exe
  2⤵
  PID:3312
- C:\Windows\System\xlcCbla.exe
  C:\Windows\System\xlcCbla.exe
  2⤵
  PID:3344
- C:\Windows\System\GZyHprr.exe
  C:\Windows\System\GZyHprr.exe
  2⤵
  PID:3316
- C:\Windows\System\khSCILa.exe
  C:\Windows\System\khSCILa.exe
  2⤵
  PID:3456
- C:\Windows\System\ppUddeF.exe
  C:\Windows\System\ppUddeF.exe
  2⤵
  PID:3520
- C:\Windows\System\zEzbIlj.exe
  C:\Windows\System\zEzbIlj.exe
  2⤵
  PID:3584
- C:\Windows\System\GlNMLMQ.exe
  C:\Windows\System\GlNMLMQ.exe
  2⤵
  PID:3648
- C:\Windows\System\JaCKiTi.exe
  C:\Windows\System\JaCKiTi.exe
  2⤵
  PID:3684
- C:\Windows\System\byObKip.exe
  C:\Windows\System\byObKip.exe
  2⤵
  PID:3720
- C:\Windows\System\mjKIjHo.exe
  C:\Windows\System\mjKIjHo.exe
  2⤵
  PID:3668
- C:\Windows\System\WGDfXhc.exe
  C:\Windows\System\WGDfXhc.exe
  2⤵
  PID:3732
- C:\Windows\System\CzlaLou.exe
  C:\Windows\System\CzlaLou.exe
  2⤵
  PID:3700
- C:\Windows\System\WgIaXsq.exe
  C:\Windows\System\WgIaXsq.exe
  2⤵
  PID:3568
- C:\Windows\System\cUqvxpV.exe
  C:\Windows\System\cUqvxpV.exe
  2⤵
  PID:3504
- C:\Windows\System\nVFTMab.exe
  C:\Windows\System\nVFTMab.exe
  2⤵
  PID:3788
- C:\Windows\System\eAZsgCO.exe
  C:\Windows\System\eAZsgCO.exe
  2⤵
  PID:3804
- C:\Windows\System\hBNaVTf.exe
  C:\Windows\System\hBNaVTf.exe
  2⤵
  PID:3836
- C:\Windows\System\uRFYILn.exe
  C:\Windows\System\uRFYILn.exe
  2⤵
  PID:3852
- C:\Windows\System\MdpSmHt.exe
  C:\Windows\System\MdpSmHt.exe
  2⤵
  PID:3912
- C:\Windows\System\gIAsOXz.exe
  C:\Windows\System\gIAsOXz.exe
  2⤵
  PID:3896
- C:\Windows\System\yGAmeDR.exe
  C:\Windows\System\yGAmeDR.exe
  2⤵
  PID:3948
- C:\Windows\System\oadJmvR.exe
  C:\Windows\System\oadJmvR.exe
  2⤵
  PID:4008
- C:\Windows\System\VmoUKlR.exe
  C:\Windows\System\VmoUKlR.exe
  2⤵
  PID:3996
- C:\Windows\System\LQgPzRf.exe
  C:\Windows\System\LQgPzRf.exe
  2⤵
  PID:4032
- C:\Windows\System\CnPuiHr.exe
  C:\Windows\System\CnPuiHr.exe
  2⤵
  PID:4064
- C:\Windows\System\THEFRpR.exe
  C:\Windows\System\THEFRpR.exe
  2⤵
  PID:2576
- C:\Windows\System\DAWdCtr.exe
  C:\Windows\System\DAWdCtr.exe
  2⤵
  PID:3192
- C:\Windows\System\DjjXqzi.exe
  C:\Windows\System\DjjXqzi.exe
  2⤵
  PID:3060
- C:\Windows\System\gAWArRa.exe
  C:\Windows\System\gAWArRa.exe
  2⤵
  PID:292
- C:\Windows\System\UVubxWu.exe
  C:\Windows\System\UVubxWu.exe
  2⤵
  PID:3260
- C:\Windows\System\tCQPCfs.exe
  C:\Windows\System\tCQPCfs.exe
  2⤵
  PID:3296
- C:\Windows\System\jTaCuVc.exe
  C:\Windows\System\jTaCuVc.exe
  2⤵
  PID:3424
- C:\Windows\System\mDngHhr.exe
  C:\Windows\System\mDngHhr.exe
  2⤵
  PID:3328
- C:\Windows\System\CceqNbB.exe
  C:\Windows\System\CceqNbB.exe
  2⤵
  PID:3472
- C:\Windows\System\IYRuYxE.exe
  C:\Windows\System\IYRuYxE.exe
  2⤵
  PID:3408
- C:\Windows\System\SyzyGYs.exe
  C:\Windows\System\SyzyGYs.exe
  2⤵
  PID:3716
- C:\Windows\System\nyKOHwe.exe
  C:\Windows\System\nyKOHwe.exe
  2⤵
  PID:3604
- C:\Windows\System\uhKUkRF.exe
  C:\Windows\System\uhKUkRF.exe
  2⤵
  PID:3536
- C:\Windows\System\QSAOEYB.exe
  C:\Windows\System\QSAOEYB.exe
  2⤵
  PID:3784
- C:\Windows\System\VRDwiVG.exe
  C:\Windows\System\VRDwiVG.exe
  2⤵
  PID:3928
- C:\Windows\System\EUeECFR.exe
  C:\Windows\System\EUeECFR.exe
  2⤵
  PID:3768
- C:\Windows\System\auaCOcQ.exe
  C:\Windows\System\auaCOcQ.exe
  2⤵
  PID:3980
- C:\Windows\System\vlBheOo.exe
  C:\Windows\System\vlBheOo.exe
  2⤵
  PID:4028
- C:\Windows\System\uyFNmTT.exe
  C:\Windows\System\uyFNmTT.exe
  2⤵
  PID:892
- C:\Windows\System\Oytohbc.exe
  C:\Windows\System\Oytohbc.exe
  2⤵
  PID:3088
- C:\Windows\System\lLOjMWq.exe
  C:\Windows\System\lLOjMWq.exe
  2⤵
  PID:3164
- C:\Windows\System\mXzDgqi.exe
  C:\Windows\System\mXzDgqi.exe
  2⤵
  PID:3392
- C:\Windows\System\JPNLDyC.exe
  C:\Windows\System\JPNLDyC.exe
  2⤵
  PID:3620
- C:\Windows\System\PjpCnJY.exe
  C:\Windows\System\PjpCnJY.exe
  2⤵
  PID:3752
- C:\Windows\System\YkRflkH.exe
  C:\Windows\System\YkRflkH.exe
  2⤵
  PID:3444
- C:\Windows\System\VaozJvl.exe
  C:\Windows\System\VaozJvl.exe
  2⤵
  PID:3160
- C:\Windows\System\MNmkbQa.exe
  C:\Windows\System\MNmkbQa.exe
  2⤵
  PID:3556
- C:\Windows\System\TuFlQgA.exe
  C:\Windows\System\TuFlQgA.exe
  2⤵
  PID:2132
- C:\Windows\System\rDmUHfN.exe
  C:\Windows\System\rDmUHfN.exe
  2⤵
  PID:3488
- C:\Windows\System\yRxnvTw.exe
  C:\Windows\System\yRxnvTw.exe
  2⤵
  PID:4076
- C:\Windows\System\ndehnhQ.exe
  C:\Windows\System\ndehnhQ.exe
  2⤵
  PID:3364
- C:\Windows\System\DoRkDek.exe
  C:\Windows\System\DoRkDek.exe
  2⤵
  PID:3672
- C:\Windows\System\qxbOtpM.exe
  C:\Windows\System\qxbOtpM.exe
  2⤵
  PID:3108
- C:\Windows\System\XQZwVOn.exe
  C:\Windows\System\XQZwVOn.exe
  2⤵
  PID:4100
- C:\Windows\System\SYlvwYM.exe
  C:\Windows\System\SYlvwYM.exe
  2⤵
  PID:4116
- C:\Windows\System\VGSKhpq.exe
  C:\Windows\System\VGSKhpq.exe
  2⤵
  PID:4132
- C:\Windows\System\AXIHHaw.exe
  C:\Windows\System\AXIHHaw.exe
  2⤵
  PID:4148
- C:\Windows\System\IyTWMGv.exe
  C:\Windows\System\IyTWMGv.exe
  2⤵
  PID:4164
- C:\Windows\System\gRupoxb.exe
  C:\Windows\System\gRupoxb.exe
  2⤵
  PID:4180
- C:\Windows\System\mAKIkxI.exe
  C:\Windows\System\mAKIkxI.exe
  2⤵
  PID:4196
- C:\Windows\System\RminnHt.exe
  C:\Windows\System\RminnHt.exe
  2⤵
  PID:4212
- C:\Windows\System\geezoMo.exe
  C:\Windows\System\geezoMo.exe
  2⤵
  PID:4228
- C:\Windows\System\oIEWbut.exe
  C:\Windows\System\oIEWbut.exe
  2⤵
  PID:4244
- C:\Windows\System\ykWbkPW.exe
  C:\Windows\System\ykWbkPW.exe
  2⤵
  PID:4260
- C:\Windows\System\AtzMhlR.exe
  C:\Windows\System\AtzMhlR.exe
  2⤵
  PID:4276
- C:\Windows\System\kBMcKhm.exe
  C:\Windows\System\kBMcKhm.exe
  2⤵
  PID:4292
- C:\Windows\System\RRZcXVQ.exe
  C:\Windows\System\RRZcXVQ.exe
  2⤵
  PID:4308
- C:\Windows\System\EQpCozr.exe
  C:\Windows\System\EQpCozr.exe
  2⤵
  PID:4324
- C:\Windows\System\HlWRxWt.exe
  C:\Windows\System\HlWRxWt.exe
  2⤵
  PID:4340
- C:\Windows\System\qVZrChG.exe
  C:\Windows\System\qVZrChG.exe
  2⤵
  PID:4356
- C:\Windows\System\AaOoFLf.exe
  C:\Windows\System\AaOoFLf.exe
  2⤵
  PID:4372
- C:\Windows\System\NQKNJat.exe
  C:\Windows\System\NQKNJat.exe
  2⤵
  PID:4388
- C:\Windows\System\rDsWuSs.exe
  C:\Windows\System\rDsWuSs.exe
  2⤵
  PID:4404
- C:\Windows\System\aHcNdJX.exe
  C:\Windows\System\aHcNdJX.exe
  2⤵
  PID:4420
- C:\Windows\System\BVmMdyh.exe
  C:\Windows\System\BVmMdyh.exe
  2⤵
  PID:4436
- C:\Windows\System\nCnJesK.exe
  C:\Windows\System\nCnJesK.exe
  2⤵
  PID:4452
- C:\Windows\System\zzsiESO.exe
  C:\Windows\System\zzsiESO.exe
  2⤵
  PID:4468
- C:\Windows\System\gvgNLJD.exe
  C:\Windows\System\gvgNLJD.exe
  2⤵
  PID:4484
- C:\Windows\System\CcroNrq.exe
  C:\Windows\System\CcroNrq.exe
  2⤵
  PID:4500
- C:\Windows\System\XtbjrMh.exe
  C:\Windows\System\XtbjrMh.exe
  2⤵
  PID:4516
- C:\Windows\System\jXDxrSz.exe
  C:\Windows\System\jXDxrSz.exe
  2⤵
  PID:4532
- C:\Windows\System\yICheUk.exe
  C:\Windows\System\yICheUk.exe
  2⤵
  PID:4548
- C:\Windows\System\pSzGLWY.exe
  C:\Windows\System\pSzGLWY.exe
  2⤵
  PID:4564
- C:\Windows\System\VFNZFFq.exe
  C:\Windows\System\VFNZFFq.exe
  2⤵
  PID:4580
- C:\Windows\System\kptBmFZ.exe
  C:\Windows\System\kptBmFZ.exe
  2⤵
  PID:4596
- C:\Windows\System\zNgefmH.exe
  C:\Windows\System\zNgefmH.exe
  2⤵
  PID:4612
- C:\Windows\System\nUqeIlU.exe
  C:\Windows\System\nUqeIlU.exe
  2⤵
  PID:4628
- C:\Windows\System\hiTmeif.exe
  C:\Windows\System\hiTmeif.exe
  2⤵
  PID:4644
- C:\Windows\System\Uqhrczs.exe
  C:\Windows\System\Uqhrczs.exe
  2⤵
  PID:4660
- C:\Windows\System\uiuYBBx.exe
  C:\Windows\System\uiuYBBx.exe
  2⤵
  PID:4676
- C:\Windows\System\oPVcuxf.exe
  C:\Windows\System\oPVcuxf.exe
  2⤵
  PID:4692
- C:\Windows\System\RfKiQZP.exe
  C:\Windows\System\RfKiQZP.exe
  2⤵
  PID:4708
- C:\Windows\System\uVgBORJ.exe
  C:\Windows\System\uVgBORJ.exe
  2⤵
  PID:4724
- C:\Windows\System\JsomACd.exe
  C:\Windows\System\JsomACd.exe
  2⤵
  PID:4740
- C:\Windows\System\vVGwnYc.exe
  C:\Windows\System\vVGwnYc.exe
  2⤵
  PID:4756
- C:\Windows\System\jfogVkO.exe
  C:\Windows\System\jfogVkO.exe
  2⤵
  PID:4772
- C:\Windows\System\hbPYPSa.exe
  C:\Windows\System\hbPYPSa.exe
  2⤵
  PID:4788
- C:\Windows\System\IEWRbIG.exe
  C:\Windows\System\IEWRbIG.exe
  2⤵
  PID:4804
- C:\Windows\System\RDRorvU.exe
  C:\Windows\System\RDRorvU.exe
  2⤵
  PID:4820
- C:\Windows\System\rZZZMmk.exe
  C:\Windows\System\rZZZMmk.exe
  2⤵
  PID:4836
- C:\Windows\System\JmcbDOJ.exe
  C:\Windows\System\JmcbDOJ.exe
  2⤵
  PID:4852
- C:\Windows\System\PZQVykl.exe
  C:\Windows\System\PZQVykl.exe
  2⤵
  PID:4868
- C:\Windows\System\vvUzYxb.exe
  C:\Windows\System\vvUzYxb.exe
  2⤵
  PID:4884
- C:\Windows\System\wRsSnRZ.exe
  C:\Windows\System\wRsSnRZ.exe
  2⤵
  PID:4900
- C:\Windows\System\gxATwja.exe
  C:\Windows\System\gxATwja.exe
  2⤵
  PID:4916
- C:\Windows\System\JEncnCU.exe
  C:\Windows\System\JEncnCU.exe
  2⤵
  PID:4932
- C:\Windows\System\FhPuOog.exe
  C:\Windows\System\FhPuOog.exe
  2⤵
  PID:4948
- C:\Windows\System\hhvcOvi.exe
  C:\Windows\System\hhvcOvi.exe
  2⤵
  PID:4964
- C:\Windows\System\CdYHRMv.exe
  C:\Windows\System\CdYHRMv.exe
  2⤵
  PID:4980
- C:\Windows\System\IWPTeZc.exe
  C:\Windows\System\IWPTeZc.exe
  2⤵
  PID:5000
- C:\Windows\System\etqqzRK.exe
  C:\Windows\System\etqqzRK.exe
  2⤵
  PID:5016
- C:\Windows\System\CXrWUoP.exe
  C:\Windows\System\CXrWUoP.exe
  2⤵
  PID:5032
- C:\Windows\System\jlBXScx.exe
  C:\Windows\System\jlBXScx.exe
  2⤵
  PID:5048
- C:\Windows\System\oRmompp.exe
  C:\Windows\System\oRmompp.exe
  2⤵
  PID:5064
- C:\Windows\System\gapKjad.exe
  C:\Windows\System\gapKjad.exe
  2⤵
  PID:5080
- C:\Windows\System\xxvxGnc.exe
  C:\Windows\System\xxvxGnc.exe
  2⤵
  PID:5096
- C:\Windows\System\JBuuEkr.exe
  C:\Windows\System\JBuuEkr.exe
  2⤵
  PID:5112
- C:\Windows\System\zRUxPZG.exe
  C:\Windows\System\zRUxPZG.exe
  2⤵
  PID:3964
- C:\Windows\System\QzLrOtd.exe
  C:\Windows\System\QzLrOtd.exe
  2⤵
  PID:4144
- C:\Windows\System\vokGlTx.exe
  C:\Windows\System\vokGlTx.exe
  2⤵
  PID:3772
- C:\Windows\System\fnHYCeT.exe
  C:\Windows\System\fnHYCeT.exe
  2⤵
  PID:3492
- C:\Windows\System\lfedEhC.exe
  C:\Windows\System\lfedEhC.exe
  2⤵
  PID:4204
- C:\Windows\System\OWerCGV.exe
  C:\Windows\System\OWerCGV.exe
  2⤵
  PID:4268
- C:\Windows\System\iZXpDwi.exe
  C:\Windows\System\iZXpDwi.exe
  2⤵
  PID:4332
- C:\Windows\System\hCcxhyD.exe
  C:\Windows\System\hCcxhyD.exe
  2⤵
  PID:4396
- C:\Windows\System\UypUnhi.exe
  C:\Windows\System\UypUnhi.exe
  2⤵
  PID:4428
- C:\Windows\System\xHXWlWy.exe
  C:\Windows\System\xHXWlWy.exe
  2⤵
  PID:4220
- C:\Windows\System\UDWFSma.exe
  C:\Windows\System\UDWFSma.exe
  2⤵
  PID:4284
- C:\Windows\System\MkqsSTM.exe
  C:\Windows\System\MkqsSTM.exe
  2⤵
  PID:4384
- C:\Windows\System\GlVbbYS.exe
  C:\Windows\System\GlVbbYS.exe
  2⤵
  PID:4476
- C:\Windows\System\YmSpJOX.exe
  C:\Windows\System\YmSpJOX.exe
  2⤵
  PID:4492
- C:\Windows\System\azAVizD.exe
  C:\Windows\System\azAVizD.exe
  2⤵
  PID:4508
- C:\Windows\System\IfEGNYo.exe
  C:\Windows\System\IfEGNYo.exe
  2⤵
  PID:4540
- C:\Windows\System\kGizcUh.exe
  C:\Windows\System\kGizcUh.exe
  2⤵
  PID:4576
- C:\Windows\System\uNkmdJf.exe
  C:\Windows\System\uNkmdJf.exe
  2⤵
  PID:4652
- C:\Windows\System\fnxuYRE.exe
  C:\Windows\System\fnxuYRE.exe
  2⤵
  PID:4640
- C:\Windows\System\FbSjiHc.exe
  C:\Windows\System\FbSjiHc.exe
  2⤵
  PID:4672
- C:\Windows\System\NwAEgWx.exe
  C:\Windows\System\NwAEgWx.exe
  2⤵
  PID:4704
- C:\Windows\System\OwmelOi.exe
  C:\Windows\System\OwmelOi.exe
  2⤵
  PID:4764
- C:\Windows\System\nNXmKIa.exe
  C:\Windows\System\nNXmKIa.exe
  2⤵
  PID:4784
- C:\Windows\System\YAEwlzj.exe
  C:\Windows\System\YAEwlzj.exe
  2⤵
  PID:4800
- C:\Windows\System\nzJaXfm.exe
  C:\Windows\System\nzJaXfm.exe
  2⤵
  PID:4876
- C:\Windows\System\wEvZWZT.exe
  C:\Windows\System\wEvZWZT.exe
  2⤵
  PID:4864
- C:\Windows\System\cwjgbLM.exe
  C:\Windows\System\cwjgbLM.exe
  2⤵
  PID:4912
- C:\Windows\System\gZUjgEr.exe
  C:\Windows\System\gZUjgEr.exe
  2⤵
  PID:4976
- C:\Windows\System\amtefpd.exe
  C:\Windows\System\amtefpd.exe
  2⤵
  PID:5040
- C:\Windows\System\EBVBcKC.exe
  C:\Windows\System\EBVBcKC.exe
  2⤵
  PID:4924
- C:\Windows\System\OcTjQib.exe
  C:\Windows\System\OcTjQib.exe
  2⤵
  PID:4960
- C:\Windows\System\OrCRhyA.exe
  C:\Windows\System\OrCRhyA.exe
  2⤵
  PID:5108
- C:\Windows\System\QEJKjfB.exe
  C:\Windows\System\QEJKjfB.exe
  2⤵
  PID:4080
- C:\Windows\System\IVnFBkF.exe
  C:\Windows\System\IVnFBkF.exe
  2⤵
  PID:4124
- C:\Windows\System\bYakoJs.exe
  C:\Windows\System\bYakoJs.exe
  2⤵
  PID:5056
- C:\Windows\System\atomHfs.exe
  C:\Windows\System\atomHfs.exe
  2⤵
  PID:4236
- C:\Windows\System\sjFVtKa.exe
  C:\Windows\System\sjFVtKa.exe
  2⤵
  PID:4368
- C:\Windows\System\KxGBDJQ.exe
  C:\Windows\System\KxGBDJQ.exe
  2⤵
  PID:4412
- C:\Windows\System\nJESFtU.exe
  C:\Windows\System\nJESFtU.exe
  2⤵
  PID:4192
- C:\Windows\System\rlDppNR.exe
  C:\Windows\System\rlDppNR.exe
  2⤵
  PID:4304
- C:\Windows\System\UGTpfPn.exe
  C:\Windows\System\UGTpfPn.exe
  2⤵
  PID:4444
- C:\Windows\System\skpnBJL.exe
  C:\Windows\System\skpnBJL.exe
  2⤵
  PID:4512
- C:\Windows\System\inqjaBq.exe
  C:\Windows\System\inqjaBq.exe
  2⤵
  PID:4684
- C:\Windows\System\xOovmGH.exe
  C:\Windows\System\xOovmGH.exe
  2⤵
  PID:4812
- C:\Windows\System\dmSNXpO.exe
  C:\Windows\System\dmSNXpO.exe
  2⤵
  PID:4892
- C:\Windows\System\HSjuskM.exe
  C:\Windows\System\HSjuskM.exe
  2⤵
  PID:4828
- C:\Windows\System\gHDJXKI.exe
  C:\Windows\System\gHDJXKI.exe
  2⤵
  PID:4720
- C:\Windows\System\AyJNaaI.exe
  C:\Windows\System\AyJNaaI.exe
  2⤵
  PID:4700
- C:\Windows\System\mbzsXIP.exe
  C:\Windows\System\mbzsXIP.exe
  2⤵
  PID:4908
- C:\Windows\System\vINdDBL.exe
  C:\Windows\System\vINdDBL.exe
  2⤵
  PID:4172
- C:\Windows\System\XoURglR.exe
  C:\Windows\System\XoURglR.exe
  2⤵
  PID:3800
- C:\Windows\System\UJNJoAr.exe
  C:\Windows\System\UJNJoAr.exe
  2⤵
  PID:4176
- C:\Windows\System\MWXCbgo.exe
  C:\Windows\System\MWXCbgo.exe
  2⤵
  PID:4364
- C:\Windows\System\rAdkYWn.exe
  C:\Windows\System\rAdkYWn.exe
  2⤵
  PID:5088
- C:\Windows\System\ypBcgpp.exe
  C:\Windows\System\ypBcgpp.exe
  2⤵
  PID:4448
- C:\Windows\System\ruQPAuq.exe
  C:\Windows\System\ruQPAuq.exe
  2⤵
  PID:4752
- C:\Windows\System\RxsOaKf.exe
  C:\Windows\System\RxsOaKf.exe
  2⤵
  PID:4592
- C:\Windows\System\ohTFNkt.exe
  C:\Windows\System\ohTFNkt.exe
  2⤵
  PID:4996
- C:\Windows\System\GwCAHOW.exe
  C:\Windows\System\GwCAHOW.exe
  2⤵
  PID:4768
- C:\Windows\System\JXoAlsb.exe
  C:\Windows\System\JXoAlsb.exe
  2⤵
  PID:348
- C:\Windows\System\qJctjZq.exe
  C:\Windows\System\qJctjZq.exe
  2⤵
  PID:4528
- C:\Windows\System\Gjjmsuo.exe
  C:\Windows\System\Gjjmsuo.exe
  2⤵
  PID:2632
- C:\Windows\System\ZDcMida.exe
  C:\Windows\System\ZDcMida.exe
  2⤵
  PID:4848
- C:\Windows\System\dUKGyIO.exe
  C:\Windows\System\dUKGyIO.exe
  2⤵
  PID:5128
- C:\Windows\System\JdzcaoL.exe
  C:\Windows\System\JdzcaoL.exe
  2⤵
  PID:5144
- C:\Windows\System\qimneDS.exe
  C:\Windows\System\qimneDS.exe
  2⤵
  PID:5160
- C:\Windows\System\MyrnDKv.exe
  C:\Windows\System\MyrnDKv.exe
  2⤵
  PID:5176
- C:\Windows\System\tBsASSz.exe
  C:\Windows\System\tBsASSz.exe
  2⤵
  PID:5192
- C:\Windows\System\ADdoaCc.exe
  C:\Windows\System\ADdoaCc.exe
  2⤵
  PID:5208
- C:\Windows\System\RFprtYM.exe
  C:\Windows\System\RFprtYM.exe
  2⤵
  PID:5224
- C:\Windows\System\cwOUSdd.exe
  C:\Windows\System\cwOUSdd.exe
  2⤵
  PID:5240
- C:\Windows\System\CmkPNfP.exe
  C:\Windows\System\CmkPNfP.exe
  2⤵
  PID:5256
- C:\Windows\System\iSfxzNx.exe
  C:\Windows\System\iSfxzNx.exe
  2⤵
  PID:5272
- C:\Windows\System\utToMpL.exe
  C:\Windows\System\utToMpL.exe
  2⤵
  PID:5288
- C:\Windows\System\NtQAtWR.exe
  C:\Windows\System\NtQAtWR.exe
  2⤵
  PID:5304
- C:\Windows\System\hYZWzak.exe
  C:\Windows\System\hYZWzak.exe
  2⤵
  PID:5320
- C:\Windows\System\UUTsakG.exe
  C:\Windows\System\UUTsakG.exe
  2⤵
  PID:5336
- C:\Windows\System\OkjUKIj.exe
  C:\Windows\System\OkjUKIj.exe
  2⤵
  PID:5352
- C:\Windows\System\rsGJxDo.exe
  C:\Windows\System\rsGJxDo.exe
  2⤵
  PID:5368
- C:\Windows\System\SpOwjqj.exe
  C:\Windows\System\SpOwjqj.exe
  2⤵
  PID:5384
- C:\Windows\System\DJednGa.exe
  C:\Windows\System\DJednGa.exe
  2⤵
  PID:5400
- C:\Windows\System\cUclAPn.exe
  C:\Windows\System\cUclAPn.exe
  2⤵
  PID:5416
- C:\Windows\System\eNijWuK.exe
  C:\Windows\System\eNijWuK.exe
  2⤵
  PID:5432
- C:\Windows\System\lKqvqMe.exe
  C:\Windows\System\lKqvqMe.exe
  2⤵
  PID:5448
- C:\Windows\System\EFBIiEP.exe
  C:\Windows\System\EFBIiEP.exe
  2⤵
  PID:5464
- C:\Windows\System\FUYvilD.exe
  C:\Windows\System\FUYvilD.exe
  2⤵
  PID:5480
- C:\Windows\System\RJbKPrA.exe
  C:\Windows\System\RJbKPrA.exe
  2⤵
  PID:5500
- C:\Windows\System\yVtqtdo.exe
  C:\Windows\System\yVtqtdo.exe
  2⤵
  PID:5516
- C:\Windows\System\ngOqHwr.exe
  C:\Windows\System\ngOqHwr.exe
  2⤵
  PID:5532
- C:\Windows\System\CDJLVVQ.exe
  C:\Windows\System\CDJLVVQ.exe
  2⤵
  PID:5548
- C:\Windows\System\WWMCxAi.exe
  C:\Windows\System\WWMCxAi.exe
  2⤵
  PID:5564
- C:\Windows\System\HxIMBzn.exe
  C:\Windows\System\HxIMBzn.exe
  2⤵
  PID:5580
- C:\Windows\System\mzWDzcp.exe
  C:\Windows\System\mzWDzcp.exe
  2⤵
  PID:5596
- C:\Windows\System\eRPysqK.exe
  C:\Windows\System\eRPysqK.exe
  2⤵
  PID:5612
- C:\Windows\System\RuIrPzF.exe
  C:\Windows\System\RuIrPzF.exe
  2⤵
  PID:5628
- C:\Windows\System\zdFCxOV.exe
  C:\Windows\System\zdFCxOV.exe
  2⤵
  PID:5644
- C:\Windows\System\rINJEIA.exe
  C:\Windows\System\rINJEIA.exe
  2⤵
  PID:5660
- C:\Windows\System\EKBKIaR.exe
  C:\Windows\System\EKBKIaR.exe
  2⤵
  PID:5676
- C:\Windows\System\wqyzfRf.exe
  C:\Windows\System\wqyzfRf.exe
  2⤵
  PID:5692
- C:\Windows\System\GGRjqKl.exe
  C:\Windows\System\GGRjqKl.exe
  2⤵
  PID:5708
- C:\Windows\System\TrWbIXB.exe
  C:\Windows\System\TrWbIXB.exe
  2⤵
  PID:5724
- C:\Windows\System\zFrNcQp.exe
  C:\Windows\System\zFrNcQp.exe
  2⤵
  PID:5740
- C:\Windows\System\nxVIOpN.exe
  C:\Windows\System\nxVIOpN.exe
  2⤵
  PID:5756
- C:\Windows\System\rNfKCHr.exe
  C:\Windows\System\rNfKCHr.exe
  2⤵
  PID:5772
- C:\Windows\System\pOcTCvr.exe
  C:\Windows\System\pOcTCvr.exe
  2⤵
  PID:5792
- C:\Windows\System\tKmPycW.exe
  C:\Windows\System\tKmPycW.exe
  2⤵
  PID:5808
- C:\Windows\System\loGKYUB.exe
  C:\Windows\System\loGKYUB.exe
  2⤵
  PID:5824
- C:\Windows\System\YHkFhaq.exe
  C:\Windows\System\YHkFhaq.exe
  2⤵
  PID:5840
- C:\Windows\System\xjSyJcJ.exe
  C:\Windows\System\xjSyJcJ.exe
  2⤵
  PID:5860
- C:\Windows\System\rvfjKlQ.exe
  C:\Windows\System\rvfjKlQ.exe
  2⤵
  PID:5876
- C:\Windows\System\YGVjhKh.exe
  C:\Windows\System\YGVjhKh.exe
  2⤵
  PID:5892
- C:\Windows\System\YxKDMsv.exe
  C:\Windows\System\YxKDMsv.exe
  2⤵
  PID:5908
- C:\Windows\System\TbdhjZK.exe
  C:\Windows\System\TbdhjZK.exe
  2⤵
  PID:5924
- C:\Windows\System\zBLlgDC.exe
  C:\Windows\System\zBLlgDC.exe
  2⤵
  PID:5940
- C:\Windows\System\dbxQjLR.exe
  C:\Windows\System\dbxQjLR.exe
  2⤵
  PID:5956
- C:\Windows\System\TqROQwh.exe
  C:\Windows\System\TqROQwh.exe
  2⤵
  PID:5972
- C:\Windows\System\rPIURzv.exe
  C:\Windows\System\rPIURzv.exe
  2⤵
  PID:5988
- C:\Windows\System\LdZQTTn.exe
  C:\Windows\System\LdZQTTn.exe
  2⤵
  PID:6008
- C:\Windows\System\uOLwPLZ.exe
  C:\Windows\System\uOLwPLZ.exe
  2⤵
  PID:6024
- C:\Windows\System\BjmspdE.exe
  C:\Windows\System\BjmspdE.exe
  2⤵
  PID:6040
- C:\Windows\System\JZkrSwE.exe
  C:\Windows\System\JZkrSwE.exe
  2⤵
  PID:6056
- C:\Windows\System\ugdNecv.exe
  C:\Windows\System\ugdNecv.exe
  2⤵
  PID:6072
- C:\Windows\System\ZISXEiH.exe
  C:\Windows\System\ZISXEiH.exe
  2⤵
  PID:6088
- C:\Windows\System\ZEqhUYa.exe
  C:\Windows\System\ZEqhUYa.exe
  2⤵
  PID:6104
- C:\Windows\System\FkTLyfC.exe
  C:\Windows\System\FkTLyfC.exe
  2⤵
  PID:6120
- C:\Windows\System\frQAcmU.exe
  C:\Windows\System\frQAcmU.exe
  2⤵
  PID:6136
- C:\Windows\System\rnhlBNQ.exe
  C:\Windows\System\rnhlBNQ.exe
  2⤵
  PID:5124
- C:\Windows\System\AQToGCP.exe
  C:\Windows\System\AQToGCP.exe
  2⤵
  PID:5156
- C:\Windows\System\qWoSVCk.exe
  C:\Windows\System\qWoSVCk.exe
  2⤵
  PID:4348
- C:\Windows\System\RFObPTS.exe
  C:\Windows\System\RFObPTS.exe
  2⤵
  PID:5248
- C:\Windows\System\ijXQAnw.exe
  C:\Windows\System\ijXQAnw.exe
  2⤵
  PID:5280
- C:\Windows\System\wRJjFNR.exe
  C:\Windows\System\wRJjFNR.exe
  2⤵
  PID:5204
- C:\Windows\System\GTuBaJh.exe
  C:\Windows\System\GTuBaJh.exe
  2⤵
  PID:5172
- C:\Windows\System\DVHGsVU.exe
  C:\Windows\System\DVHGsVU.exe
  2⤵
  PID:5316
- C:\Windows\System\FxhOZHd.exe
  C:\Windows\System\FxhOZHd.exe
  2⤵
  PID:5268
- C:\Windows\System\mNBGQxH.exe
  C:\Windows\System\mNBGQxH.exe
  2⤵
  PID:5380
- C:\Windows\System\atEkuZR.exe
  C:\Windows\System\atEkuZR.exe
  2⤵
  PID:5444
- C:\Windows\System\zbMVSdX.exe
  C:\Windows\System\zbMVSdX.exe
  2⤵
  PID:5364
- C:\Windows\System\LfOcTAA.exe
  C:\Windows\System\LfOcTAA.exe
  2⤵
  PID:5492
- C:\Windows\System\tOyvEAh.exe
  C:\Windows\System\tOyvEAh.exe
  2⤵
  PID:5528
- C:\Windows\System\zvnVkax.exe
  C:\Windows\System\zvnVkax.exe
  2⤵
  PID:5508
- C:\Windows\System\JIjaEUY.exe
  C:\Windows\System\JIjaEUY.exe
  2⤵
  PID:5576
- C:\Windows\System\hSXNjTR.exe
  C:\Windows\System\hSXNjTR.exe
  2⤵
  PID:5608
- C:\Windows\System\XWuCUrh.exe
  C:\Windows\System\XWuCUrh.exe
  2⤵
  PID:5672
- C:\Windows\System\GdKpFBz.exe
  C:\Windows\System\GdKpFBz.exe
  2⤵
  PID:5732
- C:\Windows\System\bKYZIkt.exe
  C:\Windows\System\bKYZIkt.exe
  2⤵
  PID:5768
- C:\Windows\System\FsAcyBX.exe
  C:\Windows\System\FsAcyBX.exe
  2⤵
  PID:5836
- C:\Windows\System\LumBmAZ.exe
  C:\Windows\System\LumBmAZ.exe
  2⤵
  PID:5688
- C:\Windows\System\QunEBMM.exe
  C:\Windows\System\QunEBMM.exe
  2⤵
  PID:5904
- C:\Windows\System\euSKLQC.exe
  C:\Windows\System\euSKLQC.exe
  2⤵
  PID:5968
- C:\Windows\System\JzRdZbz.exe
  C:\Windows\System\JzRdZbz.exe
  2⤵
  PID:5816
- C:\Windows\System\kJbqvhg.exe
  C:\Windows\System\kJbqvhg.exe
  2⤵
  PID:5856
- C:\Windows\System\arepMRQ.exe
  C:\Windows\System\arepMRQ.exe
  2⤵
  PID:5752
- C:\Windows\System\YizhDCX.exe
  C:\Windows\System\YizhDCX.exe
  2⤵
  PID:5984
- C:\Windows\System\fErhBnL.exe
  C:\Windows\System\fErhBnL.exe
  2⤵
  PID:5948
- C:\Windows\System\MmEjaBh.exe
  C:\Windows\System\MmEjaBh.exe
  2⤵
  PID:6016
- C:\Windows\System\HULlRoV.exe
  C:\Windows\System\HULlRoV.exe
  2⤵
  PID:6096
- C:\Windows\System\JkDOBKy.exe
  C:\Windows\System\JkDOBKy.exe
  2⤵
  PID:5152
- C:\Windows\System\mwjCjrE.exe
  C:\Windows\System\mwjCjrE.exe
  2⤵
  PID:5188
- C:\Windows\System\wyhwIjO.exe
  C:\Windows\System\wyhwIjO.exe
  2⤵
  PID:6084
- C:\Windows\System\BGMOMcv.exe
  C:\Windows\System\BGMOMcv.exe
  2⤵
  PID:6116
- C:\Windows\System\oaLLlIM.exe
  C:\Windows\System\oaLLlIM.exe
  2⤵
  PID:4624
- C:\Windows\System\iXbPBzO.exe
  C:\Windows\System\iXbPBzO.exe
  2⤵
  PID:5328
- C:\Windows\System\hchTSVj.exe
  C:\Windows\System\hchTSVj.exe
  2⤵
  PID:5376
- C:\Windows\System\hbvhJmw.exe
  C:\Windows\System\hbvhJmw.exe
  2⤵
  PID:5428
- C:\Windows\System\GWPbxjQ.exe
  C:\Windows\System\GWPbxjQ.exe
  2⤵
  PID:5396
- C:\Windows\System\MjWVvAY.exe
  C:\Windows\System\MjWVvAY.exe
  2⤵
  PID:5764
- C:\Windows\System\MAhQaqM.exe
  C:\Windows\System\MAhQaqM.exe
  2⤵
  PID:5964
- C:\Windows\System\cHdHWXk.exe
  C:\Windows\System\cHdHWXk.exe
  2⤵
  PID:5784
- C:\Windows\System\uAkPlBH.exe
  C:\Windows\System\uAkPlBH.exe
  2⤵
  PID:4112
- C:\Windows\System\NgTKNZv.exe
  C:\Windows\System\NgTKNZv.exe
  2⤵
  PID:5200
- C:\Windows\System\JKvJgiu.exe
  C:\Windows\System\JKvJgiu.exe
  2⤵
  PID:5624
- C:\Windows\System\NUgTSpk.exe
  C:\Windows\System\NUgTSpk.exe
  2⤵
  PID:5620
- C:\Windows\System\CuKKYaW.exe
  C:\Windows\System\CuKKYaW.exe
  2⤵
  PID:5872
- C:\Windows\System\OgZnfJY.exe
  C:\Windows\System\OgZnfJY.exe
  2⤵
  PID:5952
- C:\Windows\System\XQoNfHs.exe
  C:\Windows\System\XQoNfHs.exe
  2⤵
  PID:5296
- C:\Windows\System\KAZNUlS.exe
  C:\Windows\System\KAZNUlS.exe
  2⤵
  PID:6132
- C:\Windows\System\khGtwSU.exe
  C:\Windows\System\khGtwSU.exe
  2⤵
  PID:5476
- C:\Windows\System\ghPkAST.exe
  C:\Windows\System\ghPkAST.exe
  2⤵
  PID:5440
- C:\Windows\System\QxlKxkg.exe
  C:\Windows\System\QxlKxkg.exe
  2⤵
  PID:5512
- C:\Windows\System\SvbeKje.exe
  C:\Windows\System\SvbeKje.exe
  2⤵
  PID:5704
- C:\Windows\System\mANDGQg.exe
  C:\Windows\System\mANDGQg.exe
  2⤵
  PID:5748
- C:\Windows\System\fdHRvAW.exe
  C:\Windows\System\fdHRvAW.exe
  2⤵
  PID:4432
- C:\Windows\System\LXFiTma.exe
  C:\Windows\System\LXFiTma.exe
  2⤵
  PID:5588
- C:\Windows\System\emAnTwS.exe
  C:\Windows\System\emAnTwS.exe
  2⤵
  PID:6036
- C:\Windows\System\EDkdcKs.exe
  C:\Windows\System\EDkdcKs.exe
  2⤵
  PID:4316
- C:\Windows\System\JkjyXbk.exe
  C:\Windows\System\JkjyXbk.exe
  2⤵
  PID:5720
- C:\Windows\System\ASbngoD.exe
  C:\Windows\System\ASbngoD.exe
  2⤵
  PID:4588
- C:\Windows\System\bPvWfGx.exe
  C:\Windows\System\bPvWfGx.exe
  2⤵
  PID:5684
- C:\Windows\System\eUAVtyF.exe
  C:\Windows\System\eUAVtyF.exe
  2⤵
  PID:5424
- C:\Windows\System\zFYeoWI.exe
  C:\Windows\System\zFYeoWI.exe
  2⤵
  PID:5332
- C:\Windows\System\MLWWMWD.exe
  C:\Windows\System\MLWWMWD.exe
  2⤵
  PID:6156
- C:\Windows\System\QMdjrUC.exe
  C:\Windows\System\QMdjrUC.exe
  2⤵
  PID:6172
- C:\Windows\System\bfYwXFw.exe
  C:\Windows\System\bfYwXFw.exe
  2⤵
  PID:6188
- C:\Windows\System\oMlGWuB.exe
  C:\Windows\System\oMlGWuB.exe
  2⤵
  PID:6204
- C:\Windows\System\dmVoVcj.exe
  C:\Windows\System\dmVoVcj.exe
  2⤵
  PID:6220
- C:\Windows\System\ACMBctu.exe
  C:\Windows\System\ACMBctu.exe
  2⤵
  PID:6236
- C:\Windows\System\TbhInqN.exe
  C:\Windows\System\TbhInqN.exe
  2⤵
  PID:6252
- C:\Windows\System\gnLmkEv.exe
  C:\Windows\System\gnLmkEv.exe
  2⤵
  PID:6268
- C:\Windows\System\vZzuERy.exe
  C:\Windows\System\vZzuERy.exe
  2⤵
  PID:6284
- C:\Windows\System\kdEFeJG.exe
  C:\Windows\System\kdEFeJG.exe
  2⤵
  PID:6300
- C:\Windows\System\ldfoiSy.exe
  C:\Windows\System\ldfoiSy.exe
  2⤵
  PID:6316
- C:\Windows\System\EVtoOst.exe
  C:\Windows\System\EVtoOst.exe
  2⤵
  PID:6332
- C:\Windows\System\vqrWSOM.exe
  C:\Windows\System\vqrWSOM.exe
  2⤵
  PID:6348
- C:\Windows\System\daTOchX.exe
  C:\Windows\System\daTOchX.exe
  2⤵
  PID:6364
- C:\Windows\System\GpOqpBS.exe
  C:\Windows\System\GpOqpBS.exe
  2⤵
  PID:6380
- C:\Windows\System\umHDliI.exe
  C:\Windows\System\umHDliI.exe
  2⤵
  PID:6396
- C:\Windows\System\BvDhqBT.exe
  C:\Windows\System\BvDhqBT.exe
  2⤵
  PID:6412
- C:\Windows\System\qHYIcLK.exe
  C:\Windows\System\qHYIcLK.exe
  2⤵
  PID:6428
- C:\Windows\System\NkKJbeX.exe
  C:\Windows\System\NkKJbeX.exe
  2⤵
  PID:6444
- C:\Windows\System\zaySMxv.exe
  C:\Windows\System\zaySMxv.exe
  2⤵
  PID:6460
- C:\Windows\System\jnRKzIJ.exe
  C:\Windows\System\jnRKzIJ.exe
  2⤵
  PID:6476
- C:\Windows\System\HDeNTJc.exe
  C:\Windows\System\HDeNTJc.exe
  2⤵
  PID:6492
- C:\Windows\System\FxIZAPp.exe
  C:\Windows\System\FxIZAPp.exe
  2⤵
  PID:6508
- C:\Windows\System\vnjSauy.exe
  C:\Windows\System\vnjSauy.exe
  2⤵
  PID:6524
- C:\Windows\System\FVqZHXy.exe
  C:\Windows\System\FVqZHXy.exe
  2⤵
  PID:6540
- C:\Windows\System\qDtCMOj.exe
  C:\Windows\System\qDtCMOj.exe
  2⤵
  PID:6556
- C:\Windows\System\mtLzmNS.exe
  C:\Windows\System\mtLzmNS.exe
  2⤵
  PID:6576
- C:\Windows\System\lOjlrPv.exe
  C:\Windows\System\lOjlrPv.exe
  2⤵
  PID:6592
- C:\Windows\System\QpmZkiw.exe
  C:\Windows\System\QpmZkiw.exe
  2⤵
  PID:6608
- C:\Windows\System\nNOISuw.exe
  C:\Windows\System\nNOISuw.exe
  2⤵
  PID:6624
- C:\Windows\System\XovoJJs.exe
  C:\Windows\System\XovoJJs.exe
  2⤵
  PID:6640
- C:\Windows\System\iJOUuEw.exe
  C:\Windows\System\iJOUuEw.exe
  2⤵
  PID:6660
- C:\Windows\System\WHquJxq.exe
  C:\Windows\System\WHquJxq.exe
  2⤵
  PID:6676
- C:\Windows\System\JNGCFEk.exe
  C:\Windows\System\JNGCFEk.exe
  2⤵
  PID:6692
- C:\Windows\System\dqrIcFP.exe
  C:\Windows\System\dqrIcFP.exe
  2⤵
  PID:6708
- C:\Windows\System\QYdLkPA.exe
  C:\Windows\System\QYdLkPA.exe
  2⤵
  PID:6724
- C:\Windows\System\VQhupEe.exe
  C:\Windows\System\VQhupEe.exe
  2⤵
  PID:6740
- C:\Windows\System\HytEJLW.exe
  C:\Windows\System\HytEJLW.exe
  2⤵
  PID:6756
- C:\Windows\System\CVOQSZo.exe
  C:\Windows\System\CVOQSZo.exe
  2⤵
  PID:6772
- C:\Windows\System\gZlNULw.exe
  C:\Windows\System\gZlNULw.exe
  2⤵
  PID:6788
- C:\Windows\System\dbjyvDh.exe
  C:\Windows\System\dbjyvDh.exe
  2⤵
  PID:6804
- C:\Windows\System\JatSJLa.exe
  C:\Windows\System\JatSJLa.exe
  2⤵
  PID:6820
- C:\Windows\System\DSGIKbs.exe
  C:\Windows\System\DSGIKbs.exe
  2⤵
  PID:6836
- C:\Windows\System\kfFzrIw.exe
  C:\Windows\System\kfFzrIw.exe
  2⤵
  PID:6852
- C:\Windows\System\MWCPIKr.exe
  C:\Windows\System\MWCPIKr.exe
  2⤵
  PID:6868
- C:\Windows\System\ytfthPZ.exe
  C:\Windows\System\ytfthPZ.exe
  2⤵
  PID:6884
- C:\Windows\System\iipUtiB.exe
  C:\Windows\System\iipUtiB.exe
  2⤵
  PID:6900
- C:\Windows\System\qLRrykP.exe
  C:\Windows\System\qLRrykP.exe
  2⤵
  PID:6916
- C:\Windows\System\rLfRxgR.exe
  C:\Windows\System\rLfRxgR.exe
  2⤵
  PID:6932
- C:\Windows\System\wfBHpNH.exe
  C:\Windows\System\wfBHpNH.exe
  2⤵
  PID:6948
- C:\Windows\System\kdHeZvh.exe
  C:\Windows\System\kdHeZvh.exe
  2⤵
  PID:6964
- C:\Windows\System\PCqErrB.exe
  C:\Windows\System\PCqErrB.exe
  2⤵
  PID:6980
- C:\Windows\System\vhLstYh.exe
  C:\Windows\System\vhLstYh.exe
  2⤵
  PID:6996
- C:\Windows\System\WgzxJyj.exe
  C:\Windows\System\WgzxJyj.exe
  2⤵
  PID:7012
- C:\Windows\System\yILYRMO.exe
  C:\Windows\System\yILYRMO.exe
  2⤵
  PID:7028
- C:\Windows\System\iJaiSMs.exe
  C:\Windows\System\iJaiSMs.exe
  2⤵
  PID:7044
- C:\Windows\System\MzwElwi.exe
  C:\Windows\System\MzwElwi.exe
  2⤵
  PID:7064
- C:\Windows\System\CGqqotV.exe
  C:\Windows\System\CGqqotV.exe
  2⤵
  PID:7084
- C:\Windows\System\KBAeRSd.exe
  C:\Windows\System\KBAeRSd.exe
  2⤵
  PID:7100
- C:\Windows\System\sLdOUqY.exe
  C:\Windows\System\sLdOUqY.exe
  2⤵
  PID:7116
- C:\Windows\System\UqntDIM.exe
  C:\Windows\System\UqntDIM.exe
  2⤵
  PID:7132
- C:\Windows\System\ytAlaqg.exe
  C:\Windows\System\ytAlaqg.exe
  2⤵
  PID:7148
- C:\Windows\System\PDYdKJP.exe
  C:\Windows\System\PDYdKJP.exe
  2⤵
  PID:7164
- C:\Windows\System\uwTxoBd.exe
  C:\Windows\System\uwTxoBd.exe
  2⤵
  PID:6180
- C:\Windows\System\zFyQwvD.exe
  C:\Windows\System\zFyQwvD.exe
  2⤵
  PID:6168
- C:\Windows\System\JpsCKaa.exe
  C:\Windows\System\JpsCKaa.exe
  2⤵
  PID:5104
- C:\Windows\System\qwCaFMq.exe
  C:\Windows\System\qwCaFMq.exe
  2⤵
  PID:6232
- C:\Windows\System\eRXVXeQ.exe
  C:\Windows\System\eRXVXeQ.exe
  2⤵
  PID:6280
- C:\Windows\System\ZYNQAuX.exe
  C:\Windows\System\ZYNQAuX.exe
  2⤵
  PID:6344
- C:\Windows\System\LmHTgmR.exe
  C:\Windows\System\LmHTgmR.exe
  2⤵
  PID:6408
- C:\Windows\System\VTZUiyI.exe
  C:\Windows\System\VTZUiyI.exe
  2⤵
  PID:6292
- C:\Windows\System\lrUpbYJ.exe
  C:\Windows\System\lrUpbYJ.exe
  2⤵
  PID:6500
- C:\Windows\System\YXmKPXt.exe
  C:\Windows\System\YXmKPXt.exe
  2⤵
  PID:6568
- C:\Windows\System\AfMuRgl.exe
  C:\Windows\System\AfMuRgl.exe
  2⤵
  PID:6328
- C:\Windows\System\KjWrshU.exe
  C:\Windows\System\KjWrshU.exe
  2⤵
  PID:6392
- C:\Windows\System\WOGtINa.exe
  C:\Windows\System\WOGtINa.exe
  2⤵
  PID:6456
- C:\Windows\System\vDDcHzD.exe
  C:\Windows\System\vDDcHzD.exe
  2⤵
  PID:6636
- C:\Windows\System\gxkIxuM.exe
  C:\Windows\System\gxkIxuM.exe
  2⤵
  PID:6520
- C:\Windows\System\CUIijFO.exe
  C:\Windows\System\CUIijFO.exe
  2⤵
  PID:6620
- C:\Windows\System\hQfXwFM.exe
  C:\Windows\System\hQfXwFM.exe
  2⤵
  PID:6652
- C:\Windows\System\SsRpzRv.exe
  C:\Windows\System\SsRpzRv.exe
  2⤵
  PID:6704
- C:\Windows\System\AbCiTIW.exe
  C:\Windows\System\AbCiTIW.exe
  2⤵
  PID:6720
- C:\Windows\System\weRWfJE.exe
  C:\Windows\System\weRWfJE.exe
  2⤵
  PID:6784
- C:\Windows\System\iDCJpam.exe
  C:\Windows\System\iDCJpam.exe
  2⤵
  PID:6848
- C:\Windows\System\RmnGwsC.exe
  C:\Windows\System\RmnGwsC.exe
  2⤵
  PID:6860
- C:\Windows\System\OvuDLgH.exe
  C:\Windows\System\OvuDLgH.exe
  2⤵
  PID:6912
- C:\Windows\System\TSkVptW.exe
  C:\Windows\System\TSkVptW.exe
  2⤵
  PID:6956
- C:\Windows\System\IYcNXMv.exe
  C:\Windows\System\IYcNXMv.exe
  2⤵
  PID:6736
- C:\Windows\System\PlnahOY.exe
  C:\Windows\System\PlnahOY.exe
  2⤵
  PID:6800
- C:\Windows\System\VWTyFiW.exe
  C:\Windows\System\VWTyFiW.exe
  2⤵
  PID:6992
- C:\Windows\System\VzczEJQ.exe
  C:\Windows\System\VzczEJQ.exe
  2⤵
  PID:7004
- C:\Windows\System\vjPhLRj.exe
  C:\Windows\System\vjPhLRj.exe
  2⤵
  PID:7052
- C:\Windows\System\KqcatcP.exe
  C:\Windows\System\KqcatcP.exe
  2⤵
  PID:7096
- C:\Windows\System\ExxnIiu.exe
  C:\Windows\System\ExxnIiu.exe
  2⤵
  PID:7156
- C:\Windows\System\vhCJaki.exe
  C:\Windows\System\vhCJaki.exe
  2⤵
  PID:6200
- C:\Windows\System\XzYoSHN.exe
  C:\Windows\System\XzYoSHN.exe
  2⤵
  PID:5488
- C:\Windows\System\krwYsVd.exe
  C:\Windows\System\krwYsVd.exe
  2⤵
  PID:7080
- C:\Windows\System\uqkkibK.exe
  C:\Windows\System\uqkkibK.exe
  2⤵
  PID:6532
- C:\Windows\System\eOxONLM.exe
  C:\Windows\System\eOxONLM.exe
  2⤵
  PID:6152
- C:\Windows\System\WoIQCwN.exe
  C:\Windows\System\WoIQCwN.exe
  2⤵
  PID:6552
- C:\Windows\System\USATxXK.exe
  C:\Windows\System\USATxXK.exe
  2⤵
  PID:6216
- C:\Windows\System\yppYOen.exe
  C:\Windows\System\yppYOen.exe
  2⤵
  PID:6248
- C:\Windows\System\lVgnzXJ.exe
  C:\Windows\System\lVgnzXJ.exe
  2⤵
  PID:6880
- C:\Windows\System\ueIzdBh.exe
  C:\Windows\System\ueIzdBh.exe
  2⤵
  PID:6468
- C:\Windows\System\WuzIPSF.exe
  C:\Windows\System\WuzIPSF.exe
  2⤵
  PID:6324
- C:\Windows\System\UHkYxSl.exe
  C:\Windows\System\UHkYxSl.exe
  2⤵
  PID:6516
- C:\Windows\System\VzepBDH.exe
  C:\Windows\System\VzepBDH.exe
  2⤵
  PID:6688
- C:\Windows\System\MegUgUk.exe
  C:\Windows\System\MegUgUk.exe
  2⤵
  PID:6908
- C:\Windows\System\pAvdjtt.exe
  C:\Windows\System\pAvdjtt.exe
  2⤵
  PID:7024
- C:\Windows\System\bRzYqLG.exe
  C:\Windows\System\bRzYqLG.exe
  2⤵
  PID:5300
- C:\Windows\System\xMKsrWh.exe
  C:\Windows\System\xMKsrWh.exe
  2⤵
  PID:6360
- C:\Windows\System\wfspwvU.exe
  C:\Windows\System\wfspwvU.exe
  2⤵
  PID:6752
- C:\Windows\System\jBURYDh.exe
  C:\Windows\System\jBURYDh.exe
  2⤵
  PID:6588
- C:\Windows\System\jfRdmwK.exe
  C:\Windows\System\jfRdmwK.exe
  2⤵
  PID:6376
- C:\Windows\System\hwsjJBq.exe
  C:\Windows\System\hwsjJBq.exe
  2⤵
  PID:7172
- C:\Windows\System\qkvVJue.exe
  C:\Windows\System\qkvVJue.exe
  2⤵
  PID:7188
- C:\Windows\System\gLhdijm.exe
  C:\Windows\System\gLhdijm.exe
  2⤵
  PID:7204
- C:\Windows\System\dMsxGFk.exe
  C:\Windows\System\dMsxGFk.exe
  2⤵
  PID:7220
- C:\Windows\System\kWJUEcR.exe
  C:\Windows\System\kWJUEcR.exe
  2⤵
  PID:7236
- C:\Windows\System\wXFNJhc.exe
  C:\Windows\System\wXFNJhc.exe
  2⤵
  PID:7252
- C:\Windows\System\mnZXQcR.exe
  C:\Windows\System\mnZXQcR.exe
  2⤵
  PID:7268
- C:\Windows\System\gnsXYhS.exe
  C:\Windows\System\gnsXYhS.exe
  2⤵
  PID:7284
- C:\Windows\System\BXVQHHY.exe
  C:\Windows\System\BXVQHHY.exe
  2⤵
  PID:7300
- C:\Windows\System\QylGoPf.exe
  C:\Windows\System\QylGoPf.exe
  2⤵
  PID:7316
- C:\Windows\System\DHOZynC.exe
  C:\Windows\System\DHOZynC.exe
  2⤵
  PID:7332
- C:\Windows\System\lfCIjZB.exe
  C:\Windows\System\lfCIjZB.exe
  2⤵
  PID:7348
- C:\Windows\System\mrmbnYO.exe
  C:\Windows\System\mrmbnYO.exe
  2⤵
  PID:7364
- C:\Windows\System\WJUaPJW.exe
  C:\Windows\System\WJUaPJW.exe
  2⤵
  PID:7384
- C:\Windows\System\zMzzOaV.exe
  C:\Windows\System\zMzzOaV.exe
  2⤵
  PID:7400
- C:\Windows\System\cPHEBDS.exe
  C:\Windows\System\cPHEBDS.exe
  2⤵
  PID:7416
- C:\Windows\System\gyGkSpA.exe
  C:\Windows\System\gyGkSpA.exe
  2⤵
  PID:7436
- C:\Windows\System\gpnsmcX.exe
  C:\Windows\System\gpnsmcX.exe
  2⤵
  PID:7452
- C:\Windows\System\ztjDcRE.exe
  C:\Windows\System\ztjDcRE.exe
  2⤵
  PID:7468
- C:\Windows\System\ZsztKWL.exe
  C:\Windows\System\ZsztKWL.exe
  2⤵
  PID:7488
- C:\Windows\System\toBrNeo.exe
  C:\Windows\System\toBrNeo.exe
  2⤵
  PID:7504
- C:\Windows\System\QwpnORN.exe
  C:\Windows\System\QwpnORN.exe
  2⤵
  PID:7520
- C:\Windows\System\FqmXLvC.exe
  C:\Windows\System\FqmXLvC.exe
  2⤵
  PID:7536
- C:\Windows\System\CiSVpXU.exe
  C:\Windows\System\CiSVpXU.exe
  2⤵
  PID:7560
- C:\Windows\System\srDTBuR.exe
  C:\Windows\System\srDTBuR.exe
  2⤵
  PID:7576
- C:\Windows\System\kDPnEQl.exe
  C:\Windows\System\kDPnEQl.exe
  2⤵
  PID:7592
- C:\Windows\System\dKmRkQA.exe
  C:\Windows\System\dKmRkQA.exe
  2⤵
  PID:7612
- C:\Windows\System\TvfDxpo.exe
  C:\Windows\System\TvfDxpo.exe
  2⤵
  PID:7628
- C:\Windows\System\XRBcJgi.exe
  C:\Windows\System\XRBcJgi.exe
  2⤵
  PID:7644
- C:\Windows\System\ezVPvPV.exe
  C:\Windows\System\ezVPvPV.exe
  2⤵
  PID:7660
- C:\Windows\System\sUUNZui.exe
  C:\Windows\System\sUUNZui.exe
  2⤵
  PID:7676
- C:\Windows\System\cQWLmNX.exe
  C:\Windows\System\cQWLmNX.exe
  2⤵
  PID:7692
- C:\Windows\System\vbhEaWI.exe
  C:\Windows\System\vbhEaWI.exe
  2⤵
  PID:7708
- C:\Windows\System\mczcbao.exe
  C:\Windows\System\mczcbao.exe
  2⤵
  PID:7724
- C:\Windows\System\FfwkYrk.exe
  C:\Windows\System\FfwkYrk.exe
  2⤵
  PID:7740
- C:\Windows\System\iqUZlpa.exe
  C:\Windows\System\iqUZlpa.exe
  2⤵
  PID:7756
- C:\Windows\System\jhrVaHo.exe
  C:\Windows\System\jhrVaHo.exe
  2⤵
  PID:7772
- C:\Windows\System\iDgkIiF.exe
  C:\Windows\System\iDgkIiF.exe
  2⤵
  PID:7788
- C:\Windows\System\FEwblzV.exe
  C:\Windows\System\FEwblzV.exe
  2⤵
  PID:7804
- C:\Windows\System\GpdheWL.exe
  C:\Windows\System\GpdheWL.exe
  2⤵
  PID:7820
- C:\Windows\System\LllCMch.exe
  C:\Windows\System\LllCMch.exe
  2⤵
  PID:7836
- C:\Windows\System\tcllmcV.exe
  C:\Windows\System\tcllmcV.exe
  2⤵
  PID:7852
- C:\Windows\System\poZFbIE.exe
  C:\Windows\System\poZFbIE.exe
  2⤵
  PID:7868
- C:\Windows\System\JNqvITr.exe
  C:\Windows\System\JNqvITr.exe
  2⤵
  PID:7884
- C:\Windows\System\dAMYDza.exe
  C:\Windows\System\dAMYDza.exe
  2⤵
  PID:7900
- C:\Windows\System\vrSPdfg.exe
  C:\Windows\System\vrSPdfg.exe
  2⤵
  PID:7916
- C:\Windows\System\dvAEOnP.exe
  C:\Windows\System\dvAEOnP.exe
  2⤵
  PID:7932
- C:\Windows\System\SBEBbqu.exe
  C:\Windows\System\SBEBbqu.exe
  2⤵
  PID:7948
- C:\Windows\System\uRnFYWR.exe
  C:\Windows\System\uRnFYWR.exe
  2⤵
  PID:7964
- C:\Windows\System\MAZJyvh.exe
  C:\Windows\System\MAZJyvh.exe
  2⤵
  PID:7980
- C:\Windows\System\hlirNFE.exe
  C:\Windows\System\hlirNFE.exe
  2⤵
  PID:7996
- C:\Windows\System\MsGtVmH.exe
  C:\Windows\System\MsGtVmH.exe
  2⤵
  PID:8012
- C:\Windows\System\bflucRL.exe
  C:\Windows\System\bflucRL.exe
  2⤵
  PID:8028
- C:\Windows\System\uwOIfrg.exe
  C:\Windows\System\uwOIfrg.exe
  2⤵
  PID:8044
- C:\Windows\System\nEvDUCk.exe
  C:\Windows\System\nEvDUCk.exe
  2⤵
  PID:8060
- C:\Windows\System\CluIBpR.exe
  C:\Windows\System\CluIBpR.exe
  2⤵
  PID:8076
- C:\Windows\System\qsQHDNW.exe
  C:\Windows\System\qsQHDNW.exe
  2⤵
  PID:8092
- C:\Windows\System\MNUmTen.exe
  C:\Windows\System\MNUmTen.exe
  2⤵
  PID:8108
- C:\Windows\System\MMsVbMA.exe
  C:\Windows\System\MMsVbMA.exe
  2⤵
  PID:8124
- C:\Windows\System\wdEzVNG.exe
  C:\Windows\System\wdEzVNG.exe
  2⤵
  PID:8140
- C:\Windows\System\lcTjhda.exe
  C:\Windows\System\lcTjhda.exe
  2⤵
  PID:8156
- C:\Windows\System\IVSNLJt.exe
  C:\Windows\System\IVSNLJt.exe
  2⤵
  PID:8172
- C:\Windows\System\ibpZuzo.exe
  C:\Windows\System\ibpZuzo.exe
  2⤵
  PID:8188
- C:\Windows\System\AGPkHvt.exe
  C:\Windows\System\AGPkHvt.exe
  2⤵
  PID:7128
- C:\Windows\System\aPLdPVJ.exe
  C:\Windows\System\aPLdPVJ.exe
  2⤵
  PID:6264
- C:\Windows\System\ZBcHkeK.exe
  C:\Windows\System\ZBcHkeK.exe
  2⤵
  PID:7144
- C:\Windows\System\zbBlDqp.exe
  C:\Windows\System\zbBlDqp.exe
  2⤵
  PID:6844
- C:\Windows\System\xzmGhHM.exe
  C:\Windows\System\xzmGhHM.exe
  2⤵
  PID:6672
- C:\Windows\System\RaOTXMi.exe
  C:\Windows\System\RaOTXMi.exe
  2⤵
  PID:7180
- C:\Windows\System\bnuaxxQ.exe
  C:\Windows\System\bnuaxxQ.exe
  2⤵
  PID:7108
- C:\Windows\System\EOrKpuk.exe
  C:\Windows\System\EOrKpuk.exe
  2⤵
  PID:6928
- C:\Windows\System\YFJbNhz.exe
  C:\Windows\System\YFJbNhz.exe
  2⤵
  PID:7212
- C:\Windows\System\zxoygOT.exe
  C:\Windows\System\zxoygOT.exe
  2⤵
  PID:7260
- C:\Windows\System\kZNLpVN.exe
  C:\Windows\System\kZNLpVN.exe
  2⤵
  PID:7244
- C:\Windows\System\UbwTWtW.exe
  C:\Windows\System\UbwTWtW.exe
  2⤵
  PID:7280
- C:\Windows\System\gtVpvxy.exe
  C:\Windows\System\gtVpvxy.exe
  2⤵
  PID:7344
- C:\Windows\System\LNQwsiC.exe
  C:\Windows\System\LNQwsiC.exe
  2⤵
  PID:7424
- C:\Windows\System\BcZPHkx.exe
  C:\Windows\System\BcZPHkx.exe
  2⤵
  PID:7464
- C:\Windows\System\TSYXmfH.exe
  C:\Windows\System\TSYXmfH.exe
  2⤵
  PID:7372
- C:\Windows\System\dWRUNkk.exe
  C:\Windows\System\dWRUNkk.exe
  2⤵
  PID:7408
- C:\Windows\System\zGTwsfo.exe
  C:\Windows\System\zGTwsfo.exe
  2⤵
  PID:7476
- C:\Windows\System\aRUczgQ.exe
  C:\Windows\System\aRUczgQ.exe
  2⤵
  PID:7608
- C:\Windows\System\uvEogrK.exe
  C:\Windows\System\uvEogrK.exe
  2⤵
  PID:7604
- C:\Windows\System\MzIjrXR.exe
  C:\Windows\System\MzIjrXR.exe
  2⤵
  PID:7672
- C:\Windows\System\bTbYMhg.exe
  C:\Windows\System\bTbYMhg.exe
  2⤵
  PID:7544
- C:\Windows\System\pLUHydS.exe
  C:\Windows\System\pLUHydS.exe
  2⤵
  PID:7652
- C:\Windows\System\ekHJGYG.exe
  C:\Windows\System\ekHJGYG.exe
  2⤵
  PID:7732
- C:\Windows\System\PjoGNeF.exe
  C:\Windows\System\PjoGNeF.exe
  2⤵
  PID:7588
- C:\Windows\System\NwNTvMa.exe
  C:\Windows\System\NwNTvMa.exe
  2⤵
  PID:7620
- C:\Windows\System\KYKVqJI.exe
  C:\Windows\System\KYKVqJI.exe
  2⤵
  PID:7752
- C:\Windows\System\mHsgWcS.exe
  C:\Windows\System\mHsgWcS.exe
  2⤵
  PID:7816
- C:\Windows\System\OEvPnmb.exe
  C:\Windows\System\OEvPnmb.exe
  2⤵
  PID:7848
- C:\Windows\System\LDZArMU.exe
  C:\Windows\System\LDZArMU.exe
  2⤵
  PID:7896
- C:\Windows\System\twmNVxD.exe
  C:\Windows\System\twmNVxD.exe
  2⤵
  PID:7960
- C:\Windows\System\iMgmWdV.exe
  C:\Windows\System\iMgmWdV.exe
  2⤵
  PID:7912
- C:\Windows\System\rnOeOmF.exe
  C:\Windows\System\rnOeOmF.exe
  2⤵
  PID:7992
- C:\Windows\System\yUKejFv.exe
  C:\Windows\System\yUKejFv.exe
  2⤵
  PID:8056
- C:\Windows\System\hRmEoXq.exe
  C:\Windows\System\hRmEoXq.exe
  2⤵
  PID:8120
- C:\Windows\System\vlAFtlD.exe
  C:\Windows\System\vlAFtlD.exe
  2⤵
  PID:8184
- C:\Windows\System\qCysxHD.exe
  C:\Windows\System\qCysxHD.exe
  2⤵
  PID:6488
- C:\Windows\System\QxCPrIb.exe
  C:\Windows\System\QxCPrIb.exe
  2⤵
  PID:6924
- C:\Windows\System\PvbBaQE.exe
  C:\Windows\System\PvbBaQE.exe
  2⤵
  PID:8068
- C:\Windows\System\ofLxHpe.exe
  C:\Windows\System\ofLxHpe.exe
  2⤵
  PID:8132
- C:\Windows\System\JvhSnVF.exe
  C:\Windows\System\JvhSnVF.exe
  2⤵
  PID:6972
- C:\Windows\System\KeUvezd.exe
  C:\Windows\System\KeUvezd.exe
  2⤵
  PID:7060
- C:\Windows\System\TFEnGZr.exe
  C:\Windows\System\TFEnGZr.exe
  2⤵
  PID:7196
- C:\Windows\System\jkwnYxa.exe
  C:\Windows\System\jkwnYxa.exe
  2⤵
  PID:6564
- C:\Windows\System\egMoTez.exe
  C:\Windows\System\egMoTez.exe
  2⤵
  PID:7296
- C:\Windows\System\KhpSEhP.exe
  C:\Windows\System\KhpSEhP.exe
  2⤵
  PID:7396
- C:\Windows\System\soSVNef.exe
  C:\Windows\System\soSVNef.exe
  2⤵
  PID:7448
- C:\Windows\System\HnIIpuV.exe
  C:\Windows\System\HnIIpuV.exe
  2⤵
  PID:7512
- C:\Windows\System\Utglthe.exe
  C:\Windows\System\Utglthe.exe
  2⤵
  PID:7768
- C:\Windows\System\PrGsubN.exe
  C:\Windows\System\PrGsubN.exe
  2⤵
  PID:7892
- C:\Windows\System\KoiwYnc.exe
  C:\Windows\System\KoiwYnc.exe
  2⤵
  PID:7844
- C:\Windows\System\wyHSRCq.exe
  C:\Windows\System\wyHSRCq.exe
  2⤵
  PID:7800
- C:\Windows\System\nSHafAK.exe
  C:\Windows\System\nSHafAK.exe
  2⤵
  PID:7624
- C:\Windows\System\qDRqRHr.exe
  C:\Windows\System\qDRqRHr.exe
  2⤵
  PID:7572
- C:\Windows\System\UsjwwFX.exe
  C:\Windows\System\UsjwwFX.exe
  2⤵
  PID:7340
- C:\Windows\System\sGVvocK.exe
  C:\Windows\System\sGVvocK.exe
  2⤵
  PID:7908
- C:\Windows\System\RZbzlfa.exe
  C:\Windows\System\RZbzlfa.exe
  2⤵
  PID:8180
- C:\Windows\System\gkWiiEE.exe
  C:\Windows\System\gkWiiEE.exe
  2⤵
  PID:8104
- C:\Windows\System\QfaEMNZ.exe
  C:\Windows\System\QfaEMNZ.exe
  2⤵
  PID:7972
- C:\Windows\System\mJDzaiR.exe
  C:\Windows\System\mJDzaiR.exe
  2⤵
  PID:6452
- C:\Windows\System\hcWLeAU.exe
  C:\Windows\System\hcWLeAU.exe
  2⤵
  PID:7292
- C:\Windows\System\AVvBHsE.exe
  C:\Windows\System\AVvBHsE.exe
  2⤵
  PID:7392
- C:\Windows\System\qBbBqbo.exe
  C:\Windows\System\qBbBqbo.exe
  2⤵
  PID:7832
- C:\Windows\System\OBEbONm.exe
  C:\Windows\System\OBEbONm.exe
  2⤵
  PID:7864
- C:\Windows\System\YhwfNyS.exe
  C:\Windows\System\YhwfNyS.exe
  2⤵
  PID:7748
- C:\Windows\System\zSmLznc.exe
  C:\Windows\System\zSmLznc.exe
  2⤵
  PID:7720
- C:\Windows\System\IpLJSIh.exe
  C:\Windows\System\IpLJSIh.exe
  2⤵
  PID:7584
- C:\Windows\System\RIBbQxd.exe
  C:\Windows\System\RIBbQxd.exe
  2⤵
  PID:6796
- C:\Windows\System\ZihbWGn.exe
  C:\Windows\System\ZihbWGn.exe
  2⤵
  PID:8196
- C:\Windows\System\cPCoPDX.exe
  C:\Windows\System\cPCoPDX.exe
  2⤵
  PID:8212
- C:\Windows\System\NEvrEcm.exe
  C:\Windows\System\NEvrEcm.exe
  2⤵
  PID:8228
- C:\Windows\System\nRKGUFK.exe
  C:\Windows\System\nRKGUFK.exe
  2⤵
  PID:8248
- C:\Windows\System\KpJpCky.exe
  C:\Windows\System\KpJpCky.exe
  2⤵
  PID:8264
- C:\Windows\System\yWvVLPR.exe
  C:\Windows\System\yWvVLPR.exe
  2⤵
  PID:8280
- C:\Windows\System\kjbBxoK.exe
  C:\Windows\System\kjbBxoK.exe
  2⤵
  PID:8312
- C:\Windows\System\XLCBqXu.exe
  C:\Windows\System\XLCBqXu.exe
  2⤵
  PID:8328
- C:\Windows\System\jmamUOd.exe
  C:\Windows\System\jmamUOd.exe
  2⤵
  PID:8348
- C:\Windows\System\KBsLhAs.exe
  C:\Windows\System\KBsLhAs.exe
  2⤵
  PID:8364
- C:\Windows\System\awpibbx.exe
  C:\Windows\System\awpibbx.exe
  2⤵
  PID:8380
- C:\Windows\System\rXXrNpU.exe
  C:\Windows\System\rXXrNpU.exe
  2⤵
  PID:8396
- C:\Windows\System\ULvLMBb.exe
  C:\Windows\System\ULvLMBb.exe
  2⤵
  PID:8412
- C:\Windows\System\GXhHJbD.exe
  C:\Windows\System\GXhHJbD.exe
  2⤵
  PID:8428
- C:\Windows\System\dRCIyJJ.exe
  C:\Windows\System\dRCIyJJ.exe
  2⤵
  PID:8444
- C:\Windows\System\wShIkYF.exe
  C:\Windows\System\wShIkYF.exe
  2⤵
  PID:8460
- C:\Windows\System\ntfPilu.exe
  C:\Windows\System\ntfPilu.exe
  2⤵
  PID:8476
- C:\Windows\System\rcNQEdC.exe
  C:\Windows\System\rcNQEdC.exe
  2⤵
  PID:8492
- C:\Windows\System\konqasc.exe
  C:\Windows\System\konqasc.exe
  2⤵
  PID:8508
- C:\Windows\System\QKqTziC.exe
  C:\Windows\System\QKqTziC.exe
  2⤵
  PID:8524
- C:\Windows\System\COluBMr.exe
  C:\Windows\System\COluBMr.exe
  2⤵
  PID:8540
- C:\Windows\System\fQvYckN.exe
  C:\Windows\System\fQvYckN.exe
  2⤵
  PID:8556
- C:\Windows\System\QQuYCfO.exe
  C:\Windows\System\QQuYCfO.exe
  2⤵
  PID:8572
- C:\Windows\System\EhJeEpx.exe
  C:\Windows\System\EhJeEpx.exe
  2⤵
  PID:8588
- C:\Windows\System\FFffEIi.exe
  C:\Windows\System\FFffEIi.exe
  2⤵
  PID:8604
- C:\Windows\System\hzlnlXT.exe
  C:\Windows\System\hzlnlXT.exe
  2⤵
  PID:8620
- C:\Windows\System\qDzJUTL.exe
  C:\Windows\System\qDzJUTL.exe
  2⤵
  PID:8636
- C:\Windows\System\szeDdGT.exe
  C:\Windows\System\szeDdGT.exe
  2⤵
  PID:8652
- C:\Windows\System\UUpnhPA.exe
  C:\Windows\System\UUpnhPA.exe
  2⤵
  PID:8668
- C:\Windows\System\NckJiyR.exe
  C:\Windows\System\NckJiyR.exe
  2⤵
  PID:8684
- C:\Windows\System\gpFJCOn.exe
  C:\Windows\System\gpFJCOn.exe
  2⤵
  PID:8728
- C:\Windows\System\kqgIuwn.exe
  C:\Windows\System\kqgIuwn.exe
  2⤵
  PID:8796
- C:\Windows\System\iVufDjQ.exe
  C:\Windows\System\iVufDjQ.exe
  2⤵
  PID:8916
- C:\Windows\System\cznQZdf.exe
  C:\Windows\System\cznQZdf.exe
  2⤵
  PID:8968
- C:\Windows\System\eptYgWF.exe
  C:\Windows\System\eptYgWF.exe
  2⤵
  PID:8992
- C:\Windows\System\qCeDgZx.exe
  C:\Windows\System\qCeDgZx.exe
  2⤵
  PID:9020
- C:\Windows\System\quZGERU.exe
  C:\Windows\System\quZGERU.exe
  2⤵
  PID:9036
- C:\Windows\System\lYxsuFJ.exe
  C:\Windows\System\lYxsuFJ.exe
  2⤵
  PID:9100
- C:\Windows\System\tdRtdbf.exe
  C:\Windows\System\tdRtdbf.exe
  2⤵
  PID:9124
- C:\Windows\System\vhvgClC.exe
  C:\Windows\System\vhvgClC.exe
  2⤵
  PID:9156
- C:\Windows\System\bPfZICe.exe
  C:\Windows\System\bPfZICe.exe
  2⤵
  PID:9184
- C:\Windows\System\UoFvqLl.exe
  C:\Windows\System\UoFvqLl.exe
  2⤵
  PID:9200
- C:\Windows\System\IzZtlgA.exe
  C:\Windows\System\IzZtlgA.exe
  2⤵
  PID:6988
- C:\Windows\System\FGGtCPR.exe
  C:\Windows\System\FGGtCPR.exe
  2⤵
  PID:8008
- C:\Windows\System\JLyParX.exe
  C:\Windows\System\JLyParX.exe
  2⤵
  PID:8208
- C:\Windows\System\gyDodWA.exe
  C:\Windows\System\gyDodWA.exe
  2⤵
  PID:8276
- C:\Windows\System\BjRqMtL.exe
  C:\Windows\System\BjRqMtL.exe
  2⤵
  PID:7552
- C:\Windows\System\Bgvjhcq.exe
  C:\Windows\System\Bgvjhcq.exe
  2⤵
  PID:7688
- C:\Windows\System\SwmLnLB.exe
  C:\Windows\System\SwmLnLB.exe
  2⤵
  PID:8164
- C:\Windows\System\noIOjQz.exe
  C:\Windows\System\noIOjQz.exe
  2⤵
  PID:8256
- C:\Windows\System\BWTyiCw.exe
  C:\Windows\System\BWTyiCw.exe
  2⤵
  PID:8300
- C:\Windows\System\pfcYCzb.exe
  C:\Windows\System\pfcYCzb.exe
  2⤵
  PID:8152
- C:\Windows\System\buQUJRo.exe
  C:\Windows\System\buQUJRo.exe
  2⤵
  PID:8324
- C:\Windows\System\iAxdYdx.exe
  C:\Windows\System\iAxdYdx.exe
  2⤵
  PID:8336
- C:\Windows\System\otAvnin.exe
  C:\Windows\System\otAvnin.exe
  2⤵
  PID:8584
- C:\Windows\System\hECdqIq.exe
  C:\Windows\System\hECdqIq.exe
  2⤵
  PID:8648
- C:\Windows\System\SruDlxa.exe
  C:\Windows\System\SruDlxa.exe
  2⤵
  PID:8440
- C:\Windows\System\xgaqGXw.exe
  C:\Windows\System\xgaqGXw.exe
  2⤵
  PID:8568
- C:\Windows\System\SmnaBtI.exe
  C:\Windows\System\SmnaBtI.exe
  2⤵
  PID:8660
- C:\Windows\System\LCgcYIL.exe
  C:\Windows\System\LCgcYIL.exe
  2⤵
  PID:8600
- C:\Windows\System\WnJEGss.exe
  C:\Windows\System\WnJEGss.exe
  2⤵
  PID:8700
- C:\Windows\System\kQrOpuq.exe
  C:\Windows\System\kQrOpuq.exe
  2⤵
  PID:8752
- C:\Windows\System\ESTMVbz.exe
  C:\Windows\System\ESTMVbz.exe
  2⤵
  PID:8768
- C:\Windows\System\sDkQJne.exe
  C:\Windows\System\sDkQJne.exe
  2⤵
  PID:8784
- C:\Windows\System\ZNdJpjV.exe
  C:\Windows\System\ZNdJpjV.exe
  2⤵
  PID:8816
- C:\Windows\System\hiNsmCK.exe
  C:\Windows\System\hiNsmCK.exe
  2⤵
  PID:8724
- C:\Windows\System\BjfWoMN.exe
  C:\Windows\System\BjfWoMN.exe
  2⤵
  PID:7328
- C:\Windows\System\pbTfOOH.exe
  C:\Windows\System\pbTfOOH.exe
  2⤵
  PID:8836
- C:\Windows\System\yLYDYzx.exe
  C:\Windows\System\yLYDYzx.exe
  2⤵
  PID:8876
- C:\Windows\System\JLYcAlt.exe
  C:\Windows\System\JLYcAlt.exe
  2⤵
  PID:8860
- C:\Windows\System\UpevCWK.exe
  C:\Windows\System\UpevCWK.exe
  2⤵
  PID:8884
- C:\Windows\System\QKGEmVM.exe
  C:\Windows\System\QKGEmVM.exe
  2⤵
  PID:8988
- C:\Windows\System\eTUPwOs.exe
  C:\Windows\System\eTUPwOs.exe
  2⤵
  PID:8940
- C:\Windows\System\ESotCCf.exe
  C:\Windows\System\ESotCCf.exe
  2⤵
  PID:8964
- C:\Windows\System\AekPbJT.exe
  C:\Windows\System\AekPbJT.exe
  2⤵
  PID:9008
- C:\Windows\System\LoYExxk.exe
  C:\Windows\System\LoYExxk.exe
  2⤵
  PID:9044
- C:\Windows\System\tqfpvpf.exe
  C:\Windows\System\tqfpvpf.exe
  2⤵
  PID:9060
- C:\Windows\System\pfMfDFy.exe
  C:\Windows\System\pfMfDFy.exe
  2⤵
  PID:9076
- C:\Windows\System\PINRrwt.exe
  C:\Windows\System\PINRrwt.exe
  2⤵
  PID:9092
- C:\Windows\System\wIwWwtd.exe
  C:\Windows\System\wIwWwtd.exe
  2⤵
  PID:9164
- C:\Windows\System\OzanCtS.exe
  C:\Windows\System\OzanCtS.exe
  2⤵
  PID:9096
- C:\Windows\System\KuGLbzJ.exe
  C:\Windows\System\KuGLbzJ.exe
  2⤵
  PID:9144
- C:\Windows\System\Syggxzb.exe
  C:\Windows\System\Syggxzb.exe
  2⤵
  PID:8244
- C:\Windows\System\BLlamfd.exe
  C:\Windows\System\BLlamfd.exe
  2⤵
  PID:8036
- C:\Windows\System\mioFFWa.exe
  C:\Windows\System\mioFFWa.exe
  2⤵
  PID:7940
- C:\Windows\System\dkvKOWE.exe
  C:\Windows\System\dkvKOWE.exe
  2⤵
  PID:8088
- C:\Windows\System\qsvXAnX.exe
  C:\Windows\System\qsvXAnX.exe
  2⤵
  PID:8052
- C:\Windows\System\BUNrmMh.exe
  C:\Windows\System\BUNrmMh.exe
  2⤵
  PID:8360
- C:\Windows\System\AGFESLH.exe
  C:\Windows\System\AGFESLH.exe
  2⤵
  PID:8296
- C:\Windows\System\RNLJsBT.exe
  C:\Windows\System\RNLJsBT.exe
  2⤵
  PID:8452
- C:\Windows\System\CvvIjMH.exe
  C:\Windows\System\CvvIjMH.exe
  2⤵
  PID:8388
- C:\Windows\System\OGQmiQs.exe
  C:\Windows\System\OGQmiQs.exe
  2⤵
  PID:8580
- C:\Windows\System\mKPAsLs.exe
  C:\Windows\System\mKPAsLs.exe
  2⤵
  PID:8504
- C:\Windows\System\QUrYjYe.exe
  C:\Windows\System\QUrYjYe.exe
  2⤵
  PID:8740
- C:\Windows\System\oihGfmq.exe
  C:\Windows\System\oihGfmq.exe
  2⤵
  PID:8804
- C:\Windows\System\mHOqXyd.exe
  C:\Windows\System\mHOqXyd.exe
  2⤵
  PID:8892
- C:\Windows\System\ODLzzZL.exe
  C:\Windows\System\ODLzzZL.exe
  2⤵
  PID:8900
- C:\Windows\System\OXUjveQ.exe
  C:\Windows\System\OXUjveQ.exe
  2⤵
  PID:8980
- C:\Windows\System\jNvHebW.exe
  C:\Windows\System\jNvHebW.exe
  2⤵
  PID:8820
- C:\Windows\System\AkvCDfj.exe
  C:\Windows\System\AkvCDfj.exe
  2⤵
  PID:9016
- C:\Windows\System\euHARnB.exe
  C:\Windows\System\euHARnB.exe
  2⤵
  PID:9116
- C:\Windows\System\skuOQcP.exe
  C:\Windows\System\skuOQcP.exe
  2⤵
  PID:9196
- C:\Windows\System\vkSjuoD.exe
  C:\Windows\System\vkSjuoD.exe
  2⤵
  PID:8308
- C:\Windows\System\VMCnwFW.exe
  C:\Windows\System\VMCnwFW.exe
  2⤵
  PID:8372
- C:\Windows\System\cajrCMs.exe
  C:\Windows\System\cajrCMs.exe
  2⤵
  PID:8664
- C:\Windows\System\NsxqLkQ.exe
  C:\Windows\System\NsxqLkQ.exe
  2⤵
  PID:8792
- C:\Windows\System\OUksdnS.exe
  C:\Windows\System\OUksdnS.exe
  2⤵
  PID:8880
- C:\Windows\System\EBdWeiJ.exe
  C:\Windows\System\EBdWeiJ.exe
  2⤵
  PID:8932
- C:\Windows\System\bzoUYVu.exe
  C:\Windows\System\bzoUYVu.exe
  2⤵
  PID:9000
- C:\Windows\System\VUQZzXm.exe
  C:\Windows\System\VUQZzXm.exe
  2⤵
  PID:8424
- C:\Windows\System\vmcquhg.exe
  C:\Windows\System\vmcquhg.exe
  2⤵
  PID:8708
- C:\Windows\System\UJaTRpS.exe
  C:\Windows\System\UJaTRpS.exe
  2⤵
  PID:9056
- C:\Windows\System\plvJFYC.exe
  C:\Windows\System\plvJFYC.exe
  2⤵
  PID:8204
- C:\Windows\System\rrDEZMd.exe
  C:\Windows\System\rrDEZMd.exe
  2⤵
  PID:8404
- C:\Windows\System\XFCbAbd.exe
  C:\Windows\System\XFCbAbd.exe
  2⤵
  PID:8632
- C:\Windows\System\PIEVfMz.exe
  C:\Windows\System\PIEVfMz.exe
  2⤵
  PID:8736
- C:\Windows\System\zFzMeHY.exe
  C:\Windows\System\zFzMeHY.exe
  2⤵
  PID:8928
- C:\Windows\System\IEydPbR.exe
  C:\Windows\System\IEydPbR.exe
  2⤵
  PID:8936
- C:\Windows\System\JvgzAJA.exe
  C:\Windows\System\JvgzAJA.exe
  2⤵
  PID:8780
- C:\Windows\System\TZcsOax.exe
  C:\Windows\System\TZcsOax.exe
  2⤵
  PID:7480
- C:\Windows\System\bCyoyfM.exe
  C:\Windows\System\bCyoyfM.exe
  2⤵
  PID:8764
- C:\Windows\System\okctgVc.exe
  C:\Windows\System\okctgVc.exe
  2⤵
  PID:9140
- C:\Windows\System\tiSLguh.exe
  C:\Windows\System\tiSLguh.exe
  2⤵
  PID:8292
- C:\Windows\System\fThDwBM.exe
  C:\Windows\System\fThDwBM.exe
  2⤵
  PID:8844
- C:\Windows\System\GeUDcyT.exe
  C:\Windows\System\GeUDcyT.exe
  2⤵
  PID:3028
- C:\Windows\System\FexmZTa.exe
  C:\Windows\System\FexmZTa.exe
  2⤵
  PID:9180
- C:\Windows\System\jxUMfgw.exe
  C:\Windows\System\jxUMfgw.exe
  2⤵
  PID:8548
- C:\Windows\System\WfSvOxQ.exe
  C:\Windows\System\WfSvOxQ.exe
  2⤵
  PID:9032
- C:\Windows\System\lriTWhS.exe
  C:\Windows\System\lriTWhS.exe
  2⤵
  PID:8488
- C:\Windows\System\wuTzGpC.exe
  C:\Windows\System\wuTzGpC.exe
  2⤵
  PID:9208
- C:\Windows\System\DTeLMuB.exe
  C:\Windows\System\DTeLMuB.exe
  2⤵
  PID:9176
- C:\Windows\System\MVMIqIb.exe
  C:\Windows\System\MVMIqIb.exe
  2⤵
  PID:8952
- C:\Windows\System\FnWqxqe.exe
  C:\Windows\System\FnWqxqe.exe
  2⤵
  PID:8716
- C:\Windows\System\wwCFMxl.exe
  C:\Windows\System\wwCFMxl.exe
  2⤵
  PID:8392
- C:\Windows\System\xniCSxq.exe
  C:\Windows\System\xniCSxq.exe
  2⤵
  PID:9240
- C:\Windows\System\viabOXr.exe
  C:\Windows\System\viabOXr.exe
  2⤵
  PID:9256
- C:\Windows\System\BYOVmuy.exe
  C:\Windows\System\BYOVmuy.exe
  2⤵
  PID:9272
- C:\Windows\System\vxTCATy.exe
  C:\Windows\System\vxTCATy.exe
  2⤵
  PID:9288
- C:\Windows\System\JpGfPIZ.exe
  C:\Windows\System\JpGfPIZ.exe
  2⤵
  PID:9304
- C:\Windows\System\nNZyYun.exe
  C:\Windows\System\nNZyYun.exe
  2⤵
  PID:9320
- C:\Windows\System\lyWdvtg.exe
  C:\Windows\System\lyWdvtg.exe
  2⤵
  PID:9336
- C:\Windows\System\BXwQksr.exe
  C:\Windows\System\BXwQksr.exe
  2⤵
  PID:9352
- C:\Windows\System\aTSXGwc.exe
  C:\Windows\System\aTSXGwc.exe
  2⤵
  PID:9368
- C:\Windows\System\PjzMouG.exe
  C:\Windows\System\PjzMouG.exe
  2⤵
  PID:9384
- C:\Windows\System\FArXtfZ.exe
  C:\Windows\System\FArXtfZ.exe
  2⤵
  PID:9400
- C:\Windows\System\OiycLKN.exe
  C:\Windows\System\OiycLKN.exe
  2⤵
  PID:9416
- C:\Windows\System\BeJotar.exe
  C:\Windows\System\BeJotar.exe
  2⤵
  PID:9432
- C:\Windows\System\qgeBTsy.exe
  C:\Windows\System\qgeBTsy.exe
  2⤵
  PID:9448
- C:\Windows\System\dknSSAq.exe
  C:\Windows\System\dknSSAq.exe
  2⤵
  PID:9464
- C:\Windows\System\fYoAfFy.exe
  C:\Windows\System\fYoAfFy.exe
  2⤵
  PID:9480
- C:\Windows\System\AfxrQoM.exe
  C:\Windows\System\AfxrQoM.exe
  2⤵
  PID:9496
- C:\Windows\System\EOdyQQG.exe
  C:\Windows\System\EOdyQQG.exe
  2⤵
  PID:9512
- C:\Windows\System\vbwFWJI.exe
  C:\Windows\System\vbwFWJI.exe
  2⤵
  PID:9528
- C:\Windows\System\LgFRSDw.exe
  C:\Windows\System\LgFRSDw.exe
  2⤵
  PID:9544
- C:\Windows\System\vFyCzdx.exe
  C:\Windows\System\vFyCzdx.exe
  2⤵
  PID:9560
- C:\Windows\System\kJEICcv.exe
  C:\Windows\System\kJEICcv.exe
  2⤵
  PID:9576
- C:\Windows\System\zakDwqy.exe
  C:\Windows\System\zakDwqy.exe
  2⤵
  PID:9592
- C:\Windows\System\DIEUSLX.exe
  C:\Windows\System\DIEUSLX.exe
  2⤵
  PID:9608
- C:\Windows\System\DpzQmod.exe
  C:\Windows\System\DpzQmod.exe
  2⤵
  PID:9624
- C:\Windows\System\rDgjJIX.exe
  C:\Windows\System\rDgjJIX.exe
  2⤵
  PID:9640
- C:\Windows\System\OhdUWQy.exe
  C:\Windows\System\OhdUWQy.exe
  2⤵
  PID:9656
- C:\Windows\System\akAZkCT.exe
  C:\Windows\System\akAZkCT.exe
  2⤵
  PID:9792
- C:\Windows\System\SezvHbw.exe
  C:\Windows\System\SezvHbw.exe
  2⤵
  PID:9808
- C:\Windows\System\vaByzqp.exe
  C:\Windows\System\vaByzqp.exe
  2⤵
  PID:9828
- C:\Windows\System\TkhRrCy.exe
  C:\Windows\System\TkhRrCy.exe
  2⤵
  PID:9844
- C:\Windows\System\fdEQcMp.exe
  C:\Windows\System\fdEQcMp.exe
  2⤵
  PID:9864
- C:\Windows\System\dgcDkdq.exe
  C:\Windows\System\dgcDkdq.exe
  2⤵
  PID:9880
- C:\Windows\System\GJPNyUc.exe
  C:\Windows\System\GJPNyUc.exe
  2⤵
  PID:9896
- C:\Windows\System\yVlCHse.exe
  C:\Windows\System\yVlCHse.exe
  2⤵
  PID:9912
- C:\Windows\System\nNfIwJl.exe
  C:\Windows\System\nNfIwJl.exe
  2⤵
  PID:9928
- C:\Windows\System\yiexBsc.exe
  C:\Windows\System\yiexBsc.exe
  2⤵
  PID:9944
- C:\Windows\System\esJocCM.exe
  C:\Windows\System\esJocCM.exe
  2⤵
  PID:9960
- C:\Windows\System\zgFAlXu.exe
  C:\Windows\System\zgFAlXu.exe
  2⤵
  PID:9976
- C:\Windows\System\XxTSzBL.exe
  C:\Windows\System\XxTSzBL.exe
  2⤵
  PID:9992
- C:\Windows\System\idVunWN.exe
  C:\Windows\System\idVunWN.exe
  2⤵
  PID:10008
- C:\Windows\System\pCwxVJc.exe
  C:\Windows\System\pCwxVJc.exe
  2⤵
  PID:10024
- C:\Windows\System\QyYkULD.exe
  C:\Windows\System\QyYkULD.exe
  2⤵
  PID:10040
- C:\Windows\System\YgYoyNf.exe
  C:\Windows\System\YgYoyNf.exe
  2⤵
  PID:10056
- C:\Windows\System\wpZPiog.exe
  C:\Windows\System\wpZPiog.exe
  2⤵
  PID:10072
- C:\Windows\System\EhafljS.exe
  C:\Windows\System\EhafljS.exe
  2⤵
  PID:10088
- C:\Windows\System\hKGLeAg.exe
  C:\Windows\System\hKGLeAg.exe
  2⤵
  PID:10104
- C:\Windows\System\ubDmtHt.exe
  C:\Windows\System\ubDmtHt.exe
  2⤵
  PID:10120
- C:\Windows\System\NgYPItr.exe
  C:\Windows\System\NgYPItr.exe
  2⤵
  PID:10136
- C:\Windows\System\PTtDmPl.exe
  C:\Windows\System\PTtDmPl.exe
  2⤵
  PID:10152
- C:\Windows\System\NgMCOLo.exe
  C:\Windows\System\NgMCOLo.exe
  2⤵
  PID:10168
- C:\Windows\System\VGaqKXW.exe
  C:\Windows\System\VGaqKXW.exe
  2⤵
  PID:10184
- C:\Windows\System\dmZebbL.exe
  C:\Windows\System\dmZebbL.exe
  2⤵
  PID:10200
- C:\Windows\System\rfDqSUH.exe
  C:\Windows\System\rfDqSUH.exe
  2⤵
  PID:10216
- C:\Windows\System\vmTCVHr.exe
  C:\Windows\System\vmTCVHr.exe
  2⤵
  PID:10232
- C:\Windows\System\mLMvTNS.exe
  C:\Windows\System\mLMvTNS.exe
  2⤵
  PID:9212
- C:\Windows\System\rpSsHDB.exe
  C:\Windows\System\rpSsHDB.exe
  2⤵
  PID:8472
- C:\Windows\System\WZfNTqP.exe
  C:\Windows\System\WZfNTqP.exe
  2⤵
  PID:8712
- C:\Windows\System\tRZeKdn.exe
  C:\Windows\System\tRZeKdn.exe
  2⤵
  PID:9248
- C:\Windows\System\RkxEKjT.exe
  C:\Windows\System\RkxEKjT.exe
  2⤵
  PID:9312
- C:\Windows\System\LpcHktm.exe
  C:\Windows\System\LpcHktm.exe
  2⤵
  PID:9376
- C:\Windows\System\OTPyrgK.exe
  C:\Windows\System\OTPyrgK.exe
  2⤵
  PID:9440
- C:\Windows\System\dUMhqMw.exe
  C:\Windows\System\dUMhqMw.exe
  2⤵
  PID:9472
- C:\Windows\System\TklZBSR.exe
  C:\Windows\System\TklZBSR.exe
  2⤵
  PID:9536
- C:\Windows\System\JIPZgBA.exe
  C:\Windows\System\JIPZgBA.exe
  2⤵
  PID:9600
- C:\Windows\System\APdoCUH.exe
  C:\Windows\System\APdoCUH.exe
  2⤵
  PID:9664
- C:\Windows\System\NEqgGdf.exe
  C:\Windows\System\NEqgGdf.exe
  2⤵
  PID:9460
- C:\Windows\System\dVxBJsb.exe
  C:\Windows\System\dVxBJsb.exe
  2⤵
  PID:9652
- C:\Windows\System\pGLysxQ.exe
  C:\Windows\System\pGLysxQ.exe
  2⤵
  PID:9364
- C:\Windows\System\YBnApGW.exe
  C:\Windows\System\YBnApGW.exe
  2⤵
  PID:9456
- C:\Windows\System\eoJEPgL.exe
  C:\Windows\System\eoJEPgL.exe
  2⤵
  PID:9552
- C:\Windows\System\YqhufJA.exe
  C:\Windows\System\YqhufJA.exe
  2⤵
  PID:9668
- C:\Windows\System\YtvqwWS.exe
  C:\Windows\System\YtvqwWS.exe
  2⤵
  PID:9728
- C:\Windows\System\TvVbFCd.exe
  C:\Windows\System\TvVbFCd.exe
  2⤵
  PID:9744
- C:\Windows\System\stBwKHf.exe
  C:\Windows\System\stBwKHf.exe
  2⤵
  PID:9764
- C:\Windows\System\pzRIzkD.exe
  C:\Windows\System\pzRIzkD.exe
  2⤵
  PID:9780
- C:\Windows\System\jzprFcU.exe
  C:\Windows\System\jzprFcU.exe
  2⤵
  PID:9824
- C:\Windows\System\swMJbIv.exe
  C:\Windows\System\swMJbIv.exe
  2⤵
  PID:9804
- C:\Windows\System\KLiqudL.exe
  C:\Windows\System\KLiqudL.exe
  2⤵
  PID:9892
- C:\Windows\System\ZrrPqeH.exe
  C:\Windows\System\ZrrPqeH.exe
  2⤵
  PID:9920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BHxJyOC.exe

Filesize
2.0MB

MD5
eb74ebf1135ccea96f0d6538118af414

SHA1
65a1dcce9c40f4458effc23d8273de569192b488

SHA256
e76e197429977c8790e840a1e8557dc5c275807932fa62e58fd9f066454e7bf8

SHA512
a4061c10aaee2d71057952968fd538285640794cf41d8b428357427f6652b41b6fe0b2e2efe393e79cfc6e31dceb913d944c27ed4e210c2ed7f433718bc32b92

Download Submit
C:\Windows\system\DFYbtFF.exe

Filesize
2.0MB

MD5
528757d36cd5aee37a31f23c9209f37d

SHA1
9acc79d6c29b2d05c7a26caa36a061d4439c7c43

SHA256
993776a8b7af9d4797d77e31f98a7610b51a74f1467d252309e2d8658d48cb07

SHA512
d5d2cf626ef5c6f3c6f7a06e3b5b3635b8f6d48a1bf07865d829be6bf134466e8328b8ed84dc161bd5ede326fd4d4fd7695fed363fa74a1e3a3b57ad8b266d6c

Download Submit
C:\Windows\system\DmWQUhR.exe

Filesize
2.0MB

MD5
3620b460f9353c751f628de5e92a03fc

SHA1
e24a4a21e8bbd123d4c1435be2105985f448d8f8

SHA256
f72d47dea006d8d0f731d2a10ccda6ed9e2715c6bed9137d2ca51b0dab0cd3c8

SHA512
16e19bf49fbc041115f834fcab4e7a1624fcaec164befcbbcd3a79708d837f545d974a864918a2f90ab696a1903b669c9ed6ba86dfc4e7424f953e7078e11061

Download Submit
C:\Windows\system\DnHnwNH.exe

Filesize
2.0MB

MD5
17558c171fea72d6ab543a937f8af634

SHA1
01314d7cbf34ceda3b388c1121fc5142761a7d1f

SHA256
8b78fb244ef0a24f5ae483e301c73689a93aae8cc1e5c11485bde8b364ab914f

SHA512
2db6f10860e5bcd5fb6573f497d3a6a9839aa53a840c3b5afa13c8c82c386a8b664a0f393c8fe34032894ddd411d42f241269f3eb8134e05e57d60d98a5c96b6

Download Submit
C:\Windows\system\KpCmxwF.exe

Filesize
2.0MB

MD5
a4c0ff063ddb7496ebdcd2409a850109

SHA1
faf9658876bb55fa5a9f503c19dbae79dee8deeb

SHA256
2b657c54146bea9e907243aa730ec1c07e192096b8d81938c05374c90621ff70

SHA512
39ae00169fc4875715fed1afc646ff572d13ec0afbece4a85bb94f2e658911f21d4d61bdc74ea5b15c6238dd05cc271091d487528e8ec2b242fcc2ff911a2c35

Download Submit
C:\Windows\system\LsYALUP.exe

Filesize
2.0MB

MD5
2d151436099c8084c8fc7a3938877796

SHA1
978aeb1d8507e12a2f5516bab11031d117066d8a

SHA256
4231454ab9a9fe4c93e532a094ecacf073d747c879698dbbe889f9bf5cc3c179

SHA512
06160c3a5f2ad9625e7b0e9378276d940c13e9c6c2f19d103876f8c611749c5b8359fc9bf2f314f7ee222c1da7253665fc99b60a831a8293b19d0277abfe3294

Download Submit
C:\Windows\system\QHdftxf.exe

Filesize
2.0MB

MD5
d06a85d3b7d927e34f1aa6c918cbcd14

SHA1
7f9042ca26e0f58f33b8c5dcfc3eb03fc8281f99

SHA256
e90962ca03d9fcd9c89c9e4f7a307eba8f31e820e992b518301b2d9cca1505b9

SHA512
c1b3c88253bb522887093a18c784b519098e4cd3f2c4b1646f250ed2c094a77839c8c5655e9c4e61e6cd35c7723e102ffbd30c934c9e948b32b93db6ec1cbbe0

Download Submit
C:\Windows\system\WgVCnES.exe

Filesize
2.0MB

MD5
6f2a522cdb5e14e156e58753ec5c68db

SHA1
41a187bce042477845433e1d6af23d5513319231

SHA256
7b6da4025abce9096b87eb082df34df82095a636d26bb2da010fdfa45140f2ef

SHA512
516f2721098aa14b493e46a7563bee33a5f0feba4e54965333cae968794b1ba12564e98f6661f819c9fbd7a390a8962638d1a4cac76c422067e294b973a680c2

Download Submit
C:\Windows\system\XRLREOx.exe

Filesize
2.0MB

MD5
8b64f9c3c3acd865d68b4474274c76cf

SHA1
5683b086ef256f2fc2dbf44c54770e156be7860b

SHA256
a905c601ce1dd0bbbfd412f2f7cba74d1505cdcc55c89fcf291c27795aaf0689

SHA512
02c709e6621c22139139e12bbbc70f6c3826eca990c2157415d083e28234c88927fac709666075123071acf806f108c45f33ea693e93d5b0ffb9729e9ae7db06

Download Submit
C:\Windows\system\ZcEdxrg.exe

Filesize
2.0MB

MD5
082df386fd8381c966d7862f78293e5e

SHA1
9ac2b68b9fe0c3da10faf165ee949b1e62059304

SHA256
ee80488065d6cf4f749d301fd8a0da96a4840630a5f711a08ca49b6ce10eeab3

SHA512
2965271fd1f2a910df9fb3d3289e49890693402b8d2b72237df1bd76df4c98c7b71b183da00685924b753b68cca55fca04ed7f05d2c4c6e422181c29fae2bc03

Download Submit
C:\Windows\system\ahXmcbg.exe

Filesize
2.0MB

MD5
40f84a8fc2c96f2382a36e4abff9641a

SHA1
20381f0b9d6b9b8b7d2f2040ebc1e4a1e0802085

SHA256
ddc9464894c7b749f252dbe5e88deb9156eaa2ed3e1f5768a2a24300791a63d8

SHA512
8d49cde464133154e3f034958271f5cb47f34b385ac4fb7cf75a89254b6b81ff8ea1c458a8ff65e68207d3da61b4a90a17bb0c00a886c09af7080058847482d2

Download Submit
C:\Windows\system\bHnitZt.exe

Filesize
2.0MB

MD5
1ccfc6b41d1927b9600b15b776c79437

SHA1
5140e3da0dc3c446f696a0f4820db601be655b0d

SHA256
48a1d277280177b862abc26f72bec0e0eaba2c4996c7893ef79b50d6725786b7

SHA512
c586ff80f74ed80cbaba773673b6e174234327ba8d432d9c525a11a86bd4117d9626a2868657ccd50254e14242b6c5669fb143ffd1339351cfb3d1bcc10c6e69

Download Submit
C:\Windows\system\cGQNxYZ.exe

Filesize
2.0MB

MD5
6c319d7e88c90ba3d390e93ee0fbe827

SHA1
bd94f7178f8720396ecf188e1f40fa797ebc98f6

SHA256
71a5c1366f2e595b4043763a8c1abe23cefbe7d00754e2f8746c41550ca29611

SHA512
be3a978d7239a218b2a6dc78427a3dac0531361c8aedbd53e9c672ee748ccec37ff572e5db4e5e14a19ee3627d443de6353e6d0b69d2ec48bdf4865d23572f55

Download Submit
C:\Windows\system\dxajNKs.exe

Filesize
2.0MB

MD5
2d9ecdbed5b85aff0d7ee6b44fa3631c

SHA1
2eeb17fa2df3b0acda94b0ee7d7a0748fbda1c0f

SHA256
3d8c2a4beef51bc458a8d16539e0bb76955ff5a14423e94f2619001cfc930efa

SHA512
8c9934702fad3bc5f9a8cc5bf41c208207e0a9af0789d861aa43423398bd727573ac7a55ea4b0ec6b150d363f5fb56fe4e90d4d148b86d33c11a575e38de933d

Download Submit
C:\Windows\system\irSpbzd.exe

Filesize
2.0MB

MD5
966f58d30079c5d0f3bc819c4e68a0bf

SHA1
e410b3677f6445b6639e1c36b69df0c7a357514e

SHA256
3f1587f9ab0585c9ec96aa357de03e3ea5582937f3f9da0886e5df0d0f8c4813

SHA512
9be37b143ad45f7ce982869dac491c1580af737b70b9b0031239a6fd1031e3db41dbc7055dcfc0de09e8e79628d743df8b2bb1f8bfadf8243ae887030e1ce85d

Download Submit
C:\Windows\system\lqSZHas.exe

Filesize
2.0MB

MD5
5dbb056456d827ed9150b8f8d43575ec

SHA1
11b425fe258e0d42d56bd726651d98eb755aa1a5

SHA256
f7eb60a7732755dde549e5c3ac5153f927f03f2f42904bc5cae350e595c01bbf

SHA512
052774b6c426dcf1190303f419a12d6c1e72eb5736a254211a13a939d9fd36d8339be8e56545927ea2fe95902c73190d61b366fbd32c8f068396cd958b87cc1e

Download Submit
C:\Windows\system\lsDaLMC.exe

Filesize
2.0MB

MD5
d6716ba4554c960119e4c36c8a148222

SHA1
30e00e909cf1a0f83fc41e641328c433a8692451

SHA256
ab26012be3908b49268de2d2e159d5428e6d48b160eadd8d81fd68af8f750ce6

SHA512
6f5ab91694d1a7c005770fba0ab563dc56d353574344934404528b84a9ec317f3bbb909ddd640f61c2cf80edaa82a8c77763a4a8cdedf4532bf12a4640f658a7

Download Submit
C:\Windows\system\mjhGaVM.exe

Filesize
2.0MB

MD5
54e298f2d0733538652e252b502f5088

SHA1
b2b03346912e33b04afef73ba71330baa1b0424b

SHA256
3bbaea6d9d574c59ef05fa572823b8d841a3a57c7772168084bafb517273b11c

SHA512
4ba5d422f8eda940254a216a6937e791e7fcf3770c7bf21fb394ebcc3e0d70b313437e4b5f7b9962b68cfd3420f918dbc52c1d57119906d0402c0dd55f30d0be

Download Submit
C:\Windows\system\noSzMzf.exe

Filesize
2.0MB

MD5
771f73109da168882b0a7c1a24859f0d

SHA1
21df409eebf3a689d609752e9d6df15d76d10134

SHA256
2f3dca2d4a6be13fb183cad13a8b8035f8a4c0effcee2e1002c071c79b22da93

SHA512
01a1bee25a47809390a15e45451373ac794778231b2789c82b194f9863e86d774cb036faff9ca1d63ad95e0258b0f22a451669a37f8246794eb7a72a12f58bd3

Download Submit
C:\Windows\system\nqcAsRU.exe

Filesize
2.0MB

MD5
44a9603603454ea5d855665a7d3dd0f4

SHA1
c82b6a3b5504936581c54508b55c1a4a97fd9c53

SHA256
43459f5d2c83374f3dde98d1cb10ffb11b2f659b77ea6056ffdc8c1bbf85a2ea

SHA512
af4a09519a68d8a48684834608a80eb8700bef6d7377414a4c4928393d6b6d727ea77aeb9fc660df503f364fe4beb32f6835e6be431472a6c9a9cb3323ff37e0

Download Submit
C:\Windows\system\oZLNSUg.exe

Filesize
2.0MB

MD5
00beee370a93df7169a664f5c66af3d9

SHA1
3171b757c5117563203666d9b630db68c2b65b2b

SHA256
fc40393c9b3eac3e63e4a01035d48086bf0f47db42f592a939389f2351599a3a

SHA512
856892e8005932f1e49be79d8545076dc6f32a20911a7299c7ce0a484946c9a08f25042b67e9fb630a003ba0c00b19ff67931c22cf7f62f655a441894f9b3b57

Download Submit
C:\Windows\system\pBuxalb.exe

Filesize
2.0MB

MD5
bd965ea17769a55966f59843d5f8e4fd

SHA1
ab425a328564d575f280391ed9604ef9941c9a20

SHA256
bc7c6e050cbb79385be4fe565d00962fc764034e8cc8b72ef901374fbf9e5c8e

SHA512
0acd1604eeb38138e8d56ee0d878606168a4718271062400d27ff298800186b73d35c044b951d9d1c46ac8fe9cad7ba7eb93a0aa94b3e62cb5fb7ab1c01c9925

Download Submit
C:\Windows\system\qHOSKWy.exe

Filesize
2.0MB

MD5
eb43f7e41552d4c7d6ab98fff5c66a9a

SHA1
76d6cecb79a54c33e0cfb0676fd11796a9b6359d

SHA256
45ea723f31a3da1b87ee65b699b4cfb2f1953d7d1e93b30104ae6eaf3b836136

SHA512
102c624cf978c0b783afeaf1df0cf3024d02a0691b7590289f6b6b6efd85a981c9ed55a9d70452066fdb79a795922d1c0af89c1bf62c056ad4fe6b01f839979b

Download Submit
C:\Windows\system\rGHQvYS.exe

Filesize
2.0MB

MD5
ae469407996f4c141df555d755d0abae

SHA1
7f1fa8f606599f0efe4c3d4aa1944259b8417c64

SHA256
f8576fee23af6a16e92e57acc95d56443f0482ded7508e0b3708ce330ea96d12

SHA512
dce51d35e6de4643a5420b453686a0b8f813504200a03e69ad7aee00cc6d73f644a4e6589e87f16ad0459cb71fa84dfed75311238963cc975a1eba25dfdb8a66

Download Submit
C:\Windows\system\scSMgOd.exe

Filesize
2.0MB

MD5
847aa3436b6c01f1bd64dbc45599aa64

SHA1
a046d759ea182afe84239bf44c80c9f15e4a5154

SHA256
c70d4d638d3d4fcad27c5b1df06a68210158be21beddd159ede929f4facacff6

SHA512
60fec2f2d7f1d4cebc38261bc7d5b22e26424e3c905c8ff8ffe25e2abded6b18a7766964130c976100c9fcc258daf07c149ddedc2da79a891a222b9cee21a4a3

Download Submit
C:\Windows\system\tDknnMT.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
C:\Windows\system\wuIocwT.exe

Filesize
2.0MB

MD5
ff4f5930123b7babda80769c7f9a878a

SHA1
60a7b6ba8b2773a16df8d539639d34a6f3d8c2d6

SHA256
a3c321d87f3a34007c897c0dcf05e0b9cfd89721fbb8c9724488c4528e728c4a

SHA512
dd650e24ee3c6489ddb53f7b08cb8bb2d9ef2b43924715ee96cf0a916de34f322d46861d3f29ce8007ca7d5d0a547893751f12872372496db1f28fd8729f097c

Download Submit
C:\Windows\system\yoTCLtO.exe

Filesize
2.0MB

MD5
672c9c1d7774f9e27789a68134543204

SHA1
e2987cb5124111616de541f41a93ca7efa158839

SHA256
4f583c9382352e0a537185fbd2f2c7083e90d1728a481e67021db75e68f9dedd

SHA512
9cbd213a03871a11ad6871493319852daf3cb1e90f575685d3daacbe49d4bbb35622e3f1e6f3153ef51df629fee7cc3382420668017c11588828784187d31d74

Download Submit
C:\Windows\system\yzsXsqm.exe

Filesize
2.0MB

MD5
4e63f99c50ab3a719bb60a456ca68937

SHA1
9cf2ef02cea8e33676021772978bfd7341775196

SHA256
cf5e9e6c17276251083af28e51a09369fad605fc3cfc0015be01cc6c1c66d690

SHA512
001394dd7e0324b17ebacf8a5be753f50fa17ffc08024f4115232f082e6b8b800ff4bffdfeade30ff3f277e9762087285d8ffe6e13166724a993c9e2248a043f

Download Submit
C:\Windows\system\zxbefqZ.exe

Filesize
2.0MB

MD5
8d969911781ee0fabba69e868ec65c00

SHA1
8e7865915f64d54e52e39f5820000b6749389460

SHA256
0581cd917b309f0c0f551fe8e4cb0fb615386475200c92f9dfa1faeaebfcaa69

SHA512
6eecc3dc8364b8a30138ee93867fdfe4edd491daa76544887a70da108ff6828a32234d562680d09c612db5820b8120f72dd3674badbaa853f1992c9f7c625549

Download Submit
\Windows\system\AyFZBVL.exe

Filesize
2.0MB

MD5
716ff865eae94c32eb7234ba7025d28d

SHA1
6fba16f0abb24f0a812124ee5096b27aed73ec35

SHA256
98be7bf4a867e04fcbe636354a941809874a1c41418d50691b8c206d51153259

SHA512
a4d5fd15f75fcc474a278253cd66e5e2a14b3ca761edd7012351d8ea709e71d52169db1aea394cf3c8780df0293a90a1984eca9cb103027d6724436c285d899a

Download Submit
\Windows\system\QTgHvhP.exe

Filesize
2.0MB

MD5
3179fc8945b111e5a9ced07f4a6d16ef

SHA1
fcb3cecdffbd217e803ace4c6aaa4728e85f60e2

SHA256
47f8501ac8e7bba190b74e7bdd2a74dfea088dc44510544bd58d3ebf0a0ac28d

SHA512
046d91fac0ea1328c53e24d9f2c83350dfab54c12d5271927093266769824e6711a87ffdc8385cf7478cae9bae7ca52adb7134d12f9173eb3391f2d2f8cef703

Download Submit
\Windows\system\fbqSXKu.exe

Filesize
2.0MB

MD5
5da639f06ac2e9ed486d4d6256d562cc

SHA1
a83b80ea12c773487306fe7c88efafd8a4734a28

SHA256
7d0f99c45b30e11171fd4746a735f15d4d8271b80a92106d750ae3a9deae2ed6

SHA512
a36764d35323b1402370dba0254fd6c513d0509f485b5ab787d88f3b736116ae93ad5f9f2dc42ce4ddc06e08393a942858d89496a7642f0152c18a1320149908

Download Submit
memory/1996-395-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

Filesize
9.6MB

Download
memory/1996-62-0x000007FEF5D5E000-0x000007FEF5D5F000-memory.dmp

Filesize
4KB

Download
memory/1996-124-0x0000000002950000-0x0000000002958000-memory.dmp

Filesize
32KB

Download
memory/1996-97-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/1996-61-0x0000000002C70000-0x0000000002CF0000-memory.dmp

Filesize
512KB

Download
memory/1996-98-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

Filesize
9.6MB

Download
memory/2284-101-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2284-5095-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2460-20-0x0000000003020000-0x0000000003412000-memory.dmp

Filesize
3.9MB

Download
memory/2460-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2460-99-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2460-35-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-54-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2460-0-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2460-102-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-50-0x0000000003020000-0x0000000003412000-memory.dmp

Filesize
3.9MB

Download
memory/2460-77-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-105-0x00000000035B0000-0x00000000039A2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-106-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2460-107-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2460-109-0x0000000003020000-0x0000000003412000-memory.dmp

Filesize
3.9MB

Download
memory/2460-110-0x00000000035B0000-0x00000000039A2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-111-0x00000000035B0000-0x00000000039A2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-104-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-5092-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-100-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2628-5096-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2676-103-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-5093-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2780-60-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2780-5097-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/3048-30-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/3048-5094-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/3064-108-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download