xmrig | 81d344c090d1434d384c6de4b11b102d82b7d57981f83d54c50237ed3313e4b8

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
Size

1.7MB
MD5

3d7548c7711e7a554382f277060f1bbe
SHA1

644561d2a007575722075b181a89e7dc43d035b3
SHA256

81d344c090d1434d384c6de4b11b102d82b7d57981f83d54c50237ed3313e4b8
SHA512

dac8aa964cdaf03babc320bd05b1770bb63b688375712679d867977e57203be529915cbeac34d2ced41a7deaf74b1e1bc5409df6c575562358ad427a656d0898
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD0nN:NABd

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/2564-23-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2792-93-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2644-95-0x000000013FFE0000-0x00000001403D2000-memory.dmp	xmrig
behavioral1/memory/2600-100-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	xmrig
behavioral1/memory/2380-107-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2024-115-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2952-105-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig
behavioral1/memory/2512-98-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2868-91-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2744-88-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2632-85-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	xmrig
behavioral1/memory/2696-82-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2564-4435-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2644-4598-0x000000013FFE0000-0x00000001403D2000-memory.dmp	xmrig
behavioral1/memory/2792-4610-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2512-4612-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2744-4615-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2696-4614-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2024-4607-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2868-4601-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2600-4605-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	xmrig
behavioral1/memory/2632-4603-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	xmrig
behavioral1/memory/2952-4649-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig
behavioral1/memory/2044-8753-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2168	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2380	aUqlHWR.exe
2564	fQeWSJl.exe
2024	Lfprrpv.exe
2696	TuBeXVc.exe
2632	xvVhZGz.exe
2744	VuzcauA.exe
2868	iSgRYDg.exe
2792	HoecwYB.exe
2644	eniAXoq.exe
2512	eaKiAhY.exe
2600	gfbGTiz.exe
2952	LVqncsa.exe
2968	NgBogPM.exe
1712	sOOgSnf.exe
1756	ZDeGJEn.exe
1268	KGeCmSc.exe
1224	JsILSMA.exe
2784	ODFxSjf.exe
848	yccafpK.exe
1644	oAShWmH.exe
1716	GUWVHrR.exe
2940	dpQGXQo.exe
2228	wESccKk.exe
2852	SoRMaMg.exe
2328	zKSvzyn.exe
1028	qQyOCBg.exe
1328	MXczXyE.exe
832	IrfhsoD.exe
1796	WwnaEEi.exe
1228	inPYlIW.exe
1352	nelDgpM.exe
2748	DlbqtWY.exe
1748	ueFckQz.exe
1832	oOAIalN.exe
1688	kGFRJox.exe
2320	XiABfzU.exe
1120	cVHbdWP.exe
2908	vlXKPuD.exe
2980	FVAycUi.exe
1676	werxKSG.exe
1148	hjbExqb.exe
1508	jNDJqqp.exe
2888	XgRKNNR.exe
2876	vafPDhJ.exe
884	YHiKMWF.exe
380	FmivyfZ.exe
2288	oRfenwW.exe
1596	XsWVexq.exe
1600	cQJVNuh.exe
1932	cIWIiYu.exe
2660	eXrTmhc.exe
2688	BLAfwIu.exe
2736	gozdLjm.exe
2488	uOeKiMN.exe
2720	VVPbnvT.exe
2536	VpJSQeU.exe
2764	FSCIXaO.exe
2192	RVuBVxY.exe
2724	yOdbNQl.exe
1580	YAnadPF.exe
2196	uqmSMPu.exe
2816	pmzBtgh.exe
2384	dyAYIdl.exe
2104	rWzuyEG.exe

Loads dropped DLL 64 IoCs

pid	Process
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2044-0-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx
behavioral1/files/0x000b000000015d31-6.dat	upx
behavioral1/files/0x000a000000016176-11.dat	upx
behavioral1/files/0x00080000000167d5-25.dat	upx
behavioral1/memory/2564-23-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/files/0x000f000000005578-32.dat	upx
behavioral1/files/0x000a000000016c04-41.dat	upx
behavioral1/files/0x000a000000016c51-46.dat	upx
behavioral1/files/0x0008000000016c7c-50.dat	upx
behavioral1/files/0x0007000000016ca5-59.dat	upx
behavioral1/files/0x0007000000016cbe-66.dat	upx
behavioral1/files/0x0006000000016d16-78.dat	upx
behavioral1/memory/2792-93-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2644-95-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/memory/2600-100-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/memory/2380-107-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/files/0x0006000000016d3e-119.dat	upx
behavioral1/files/0x00140000000185e9-175.dat	upx
behavioral1/files/0x000d0000000185f4-179.dat	upx
behavioral1/files/0x00060000000174a5-171.dat	upx
behavioral1/files/0x0006000000017422-167.dat	upx
behavioral1/files/0x0006000000017407-163.dat	upx
behavioral1/files/0x0006000000017407-161.dat	upx
behavioral1/files/0x000600000001737c-156.dat	upx
behavioral1/files/0x00060000000173f2-159.dat	upx
behavioral1/files/0x00060000000173f2-157.dat	upx
behavioral1/files/0x0006000000017371-147.dat	upx
behavioral1/files/0x0006000000017374-151.dat	upx
behavioral1/files/0x0006000000017374-149.dat	upx
behavioral1/files/0x000600000001735a-143.dat	upx
behavioral1/files/0x0006000000016fed-139.dat	upx
behavioral1/files/0x0006000000016e4a-135.dat	upx
behavioral1/files/0x0006000000016e24-131.dat	upx
behavioral1/files/0x0006000000016d57-127.dat	upx
behavioral1/files/0x0006000000016d51-123.dat	upx
behavioral1/memory/2024-115-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/files/0x000900000001650c-111.dat	upx
behavioral1/files/0x0006000000016d1a-106.dat	upx
behavioral1/memory/2952-105-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/memory/2512-98-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2868-91-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/2744-88-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2632-85-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	upx
behavioral1/memory/2696-82-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/files/0x0006000000016cc6-81.dat	upx
behavioral1/files/0x0007000000016cb6-63.dat	upx
behavioral1/files/0x0007000000016cb6-60.dat	upx
behavioral1/files/0x0008000000016be2-37.dat	upx
behavioral1/files/0x0009000000016287-14.dat	upx
behavioral1/memory/2564-4435-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2644-4598-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/memory/2792-4610-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2512-4612-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2744-4615-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2696-4614-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2024-4607-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2868-4601-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/2600-4605-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/memory/2632-4603-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	upx
behavioral1/memory/2952-4649-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/memory/2044-8753-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LjmVvgV.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\KATXVGg.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\OJYnRwo.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\qsAUZhB.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\FNxmryD.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\IiwrhxI.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\YghpJNQ.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\CRnurTa.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\RJlqDci.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\GNKYYSR.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\cODigAQ.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\dlUpRPE.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\SGZYkmP.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\jsYwsiV.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\OHqTavS.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\EHXbFYj.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\jnAlmnR.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\cLTWbgj.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\YXwWdJt.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\kIoFybY.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\vlPwndh.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\WjKJgMt.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\zVmKcGu.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\WrZcvpH.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\VBoLEhh.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\BaaELoa.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\aFvvEUs.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\xkolZJu.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\ZJVMttL.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\qGPXRTs.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\xHxHpgM.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\JhGMzkz.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\PLdZGJi.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\czSOouG.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\yKDlUvH.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\YOOfuNa.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\oFQVeHM.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\JqvJUdI.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\WuareMo.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\iUUftYL.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\lOazpkp.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\GefIyMW.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\xElxVUw.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\sHToisi.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\XBgLoEG.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\fBEviuD.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\HcMIAYK.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\XVObhWK.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\qIAMfzX.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\KHUshEo.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\uNcgqKN.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\mDzrSIb.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\vrlTddG.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\AIWTWGU.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\pIPmJoY.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\ixqvzVF.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\ynJIEuN.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\dLXXKMt.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\kmVHQsv.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\NuNmWnX.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\qGWYXML.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\AgSSNOY.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\rqyEbmh.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
File created	C:\Windows\System\BbDTXMD.exe	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2168	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
Token: SeDebugPrivilege	2168	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2168	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	29
PID 2044 wrote to memory of 2168	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	29
PID 2044 wrote to memory of 2168	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	29
PID 2044 wrote to memory of 2380	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	30
PID 2044 wrote to memory of 2380	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	30
PID 2044 wrote to memory of 2380	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	30
PID 2044 wrote to memory of 2564	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	31
PID 2044 wrote to memory of 2564	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	31
PID 2044 wrote to memory of 2564	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	31
PID 2044 wrote to memory of 2024	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	32
PID 2044 wrote to memory of 2024	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	32
PID 2044 wrote to memory of 2024	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	32
PID 2044 wrote to memory of 2696	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	33
PID 2044 wrote to memory of 2696	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	33
PID 2044 wrote to memory of 2696	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	33
PID 2044 wrote to memory of 2632	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	34
PID 2044 wrote to memory of 2632	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	34
PID 2044 wrote to memory of 2632	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	34
PID 2044 wrote to memory of 2744	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	35
PID 2044 wrote to memory of 2744	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	35
PID 2044 wrote to memory of 2744	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	35
PID 2044 wrote to memory of 2868	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	36
PID 2044 wrote to memory of 2868	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	36
PID 2044 wrote to memory of 2868	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	36
PID 2044 wrote to memory of 2792	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	37
PID 2044 wrote to memory of 2792	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	37
PID 2044 wrote to memory of 2792	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	37
PID 2044 wrote to memory of 2644	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	38
PID 2044 wrote to memory of 2644	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	38
PID 2044 wrote to memory of 2644	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	38
PID 2044 wrote to memory of 2512	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	39
PID 2044 wrote to memory of 2512	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	39
PID 2044 wrote to memory of 2512	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	39
PID 2044 wrote to memory of 2600	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	40
PID 2044 wrote to memory of 2600	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	40
PID 2044 wrote to memory of 2600	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	40
PID 2044 wrote to memory of 2952	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	41
PID 2044 wrote to memory of 2952	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	41
PID 2044 wrote to memory of 2952	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	41
PID 2044 wrote to memory of 2968	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	42
PID 2044 wrote to memory of 2968	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	42
PID 2044 wrote to memory of 2968	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	42
PID 2044 wrote to memory of 1712	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	43
PID 2044 wrote to memory of 1712	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	43
PID 2044 wrote to memory of 1712	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	43
PID 2044 wrote to memory of 1756	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	44
PID 2044 wrote to memory of 1756	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	44
PID 2044 wrote to memory of 1756	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	44
PID 2044 wrote to memory of 1268	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	45
PID 2044 wrote to memory of 1268	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	45
PID 2044 wrote to memory of 1268	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	45
PID 2044 wrote to memory of 1224	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	46
PID 2044 wrote to memory of 1224	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	46
PID 2044 wrote to memory of 1224	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	46
PID 2044 wrote to memory of 2784	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	47
PID 2044 wrote to memory of 2784	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	47
PID 2044 wrote to memory of 2784	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	47
PID 2044 wrote to memory of 848	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	48
PID 2044 wrote to memory of 848	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	48
PID 2044 wrote to memory of 848	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	48
PID 2044 wrote to memory of 1644	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	49
PID 2044 wrote to memory of 1644	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	49
PID 2044 wrote to memory of 1644	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	49
PID 2044 wrote to memory of 1716	2044	3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d7548c7711e7a554382f277060f1bbe_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\System\aUqlHWR.exe
  C:\Windows\System\aUqlHWR.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\fQeWSJl.exe
  C:\Windows\System\fQeWSJl.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\Lfprrpv.exe
  C:\Windows\System\Lfprrpv.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\TuBeXVc.exe
  C:\Windows\System\TuBeXVc.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\xvVhZGz.exe
  C:\Windows\System\xvVhZGz.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\VuzcauA.exe
  C:\Windows\System\VuzcauA.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\iSgRYDg.exe
  C:\Windows\System\iSgRYDg.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\HoecwYB.exe
  C:\Windows\System\HoecwYB.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\eniAXoq.exe
  C:\Windows\System\eniAXoq.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\eaKiAhY.exe
  C:\Windows\System\eaKiAhY.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\gfbGTiz.exe
  C:\Windows\System\gfbGTiz.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\LVqncsa.exe
  C:\Windows\System\LVqncsa.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\NgBogPM.exe
  C:\Windows\System\NgBogPM.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\sOOgSnf.exe
  C:\Windows\System\sOOgSnf.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\ZDeGJEn.exe
  C:\Windows\System\ZDeGJEn.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\KGeCmSc.exe
  C:\Windows\System\KGeCmSc.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\JsILSMA.exe
  C:\Windows\System\JsILSMA.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\ODFxSjf.exe
  C:\Windows\System\ODFxSjf.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\yccafpK.exe
  C:\Windows\System\yccafpK.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\oAShWmH.exe
  C:\Windows\System\oAShWmH.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\GUWVHrR.exe
  C:\Windows\System\GUWVHrR.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\dpQGXQo.exe
  C:\Windows\System\dpQGXQo.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\wESccKk.exe
  C:\Windows\System\wESccKk.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\SoRMaMg.exe
  C:\Windows\System\SoRMaMg.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\zKSvzyn.exe
  C:\Windows\System\zKSvzyn.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\qQyOCBg.exe
  C:\Windows\System\qQyOCBg.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\MXczXyE.exe
  C:\Windows\System\MXczXyE.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\IrfhsoD.exe
  C:\Windows\System\IrfhsoD.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\WwnaEEi.exe
  C:\Windows\System\WwnaEEi.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\inPYlIW.exe
  C:\Windows\System\inPYlIW.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\nelDgpM.exe
  C:\Windows\System\nelDgpM.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\DlbqtWY.exe
  C:\Windows\System\DlbqtWY.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\ueFckQz.exe
  C:\Windows\System\ueFckQz.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\oOAIalN.exe
  C:\Windows\System\oOAIalN.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\kGFRJox.exe
  C:\Windows\System\kGFRJox.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\XiABfzU.exe
  C:\Windows\System\XiABfzU.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\cVHbdWP.exe
  C:\Windows\System\cVHbdWP.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\vlXKPuD.exe
  C:\Windows\System\vlXKPuD.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\FVAycUi.exe
  C:\Windows\System\FVAycUi.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\werxKSG.exe
  C:\Windows\System\werxKSG.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\hjbExqb.exe
  C:\Windows\System\hjbExqb.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\jNDJqqp.exe
  C:\Windows\System\jNDJqqp.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\XgRKNNR.exe
  C:\Windows\System\XgRKNNR.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\vafPDhJ.exe
  C:\Windows\System\vafPDhJ.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\YHiKMWF.exe
  C:\Windows\System\YHiKMWF.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\FmivyfZ.exe
  C:\Windows\System\FmivyfZ.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\oRfenwW.exe
  C:\Windows\System\oRfenwW.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\XsWVexq.exe
  C:\Windows\System\XsWVexq.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\cQJVNuh.exe
  C:\Windows\System\cQJVNuh.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\cIWIiYu.exe
  C:\Windows\System\cIWIiYu.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\eXrTmhc.exe
  C:\Windows\System\eXrTmhc.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\BLAfwIu.exe
  C:\Windows\System\BLAfwIu.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\gozdLjm.exe
  C:\Windows\System\gozdLjm.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\uOeKiMN.exe
  C:\Windows\System\uOeKiMN.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\VVPbnvT.exe
  C:\Windows\System\VVPbnvT.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\VpJSQeU.exe
  C:\Windows\System\VpJSQeU.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\FSCIXaO.exe
  C:\Windows\System\FSCIXaO.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\RVuBVxY.exe
  C:\Windows\System\RVuBVxY.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\yOdbNQl.exe
  C:\Windows\System\yOdbNQl.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\YAnadPF.exe
  C:\Windows\System\YAnadPF.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\uqmSMPu.exe
  C:\Windows\System\uqmSMPu.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\pmzBtgh.exe
  C:\Windows\System\pmzBtgh.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\dyAYIdl.exe
  C:\Windows\System\dyAYIdl.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\rWzuyEG.exe
  C:\Windows\System\rWzuyEG.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\GNdFaaT.exe
  C:\Windows\System\GNdFaaT.exe
  2⤵
  PID:1088
- C:\Windows\System\sUMyGfU.exe
  C:\Windows\System\sUMyGfU.exe
  2⤵
  PID:660
- C:\Windows\System\lwvjjJR.exe
  C:\Windows\System\lwvjjJR.exe
  2⤵
  PID:2240
- C:\Windows\System\nXkFDZy.exe
  C:\Windows\System\nXkFDZy.exe
  2⤵
  PID:1072
- C:\Windows\System\GwFBkop.exe
  C:\Windows\System\GwFBkop.exe
  2⤵
  PID:292
- C:\Windows\System\kJbdQTP.exe
  C:\Windows\System\kJbdQTP.exe
  2⤵
  PID:1488
- C:\Windows\System\nXNXaVV.exe
  C:\Windows\System\nXNXaVV.exe
  2⤵
  PID:2880
- C:\Windows\System\ntIDXIn.exe
  C:\Windows\System\ntIDXIn.exe
  2⤵
  PID:2900
- C:\Windows\System\PlLuFKm.exe
  C:\Windows\System\PlLuFKm.exe
  2⤵
  PID:2352
- C:\Windows\System\mEGNyiR.exe
  C:\Windows\System\mEGNyiR.exe
  2⤵
  PID:1696
- C:\Windows\System\awgxWtJ.exe
  C:\Windows\System\awgxWtJ.exe
  2⤵
  PID:1692
- C:\Windows\System\aGUYBZA.exe
  C:\Windows\System\aGUYBZA.exe
  2⤵
  PID:1952
- C:\Windows\System\WBUdtWY.exe
  C:\Windows\System\WBUdtWY.exe
  2⤵
  PID:700
- C:\Windows\System\isQHjBG.exe
  C:\Windows\System\isQHjBG.exe
  2⤵
  PID:2112
- C:\Windows\System\RuvgIxZ.exe
  C:\Windows\System\RuvgIxZ.exe
  2⤵
  PID:2760
- C:\Windows\System\pjsBbbf.exe
  C:\Windows\System\pjsBbbf.exe
  2⤵
  PID:3020
- C:\Windows\System\NnJVaRt.exe
  C:\Windows\System\NnJVaRt.exe
  2⤵
  PID:2528
- C:\Windows\System\svaKQQl.exe
  C:\Windows\System\svaKQQl.exe
  2⤵
  PID:2932
- C:\Windows\System\rviKHWC.exe
  C:\Windows\System\rviKHWC.exe
  2⤵
  PID:2260
- C:\Windows\System\EBxIpIV.exe
  C:\Windows\System\EBxIpIV.exe
  2⤵
  PID:2012
- C:\Windows\System\bQzVqDF.exe
  C:\Windows\System\bQzVqDF.exe
  2⤵
  PID:1604
- C:\Windows\System\NeziLlJ.exe
  C:\Windows\System\NeziLlJ.exe
  2⤵
  PID:2772
- C:\Windows\System\vclFYdU.exe
  C:\Windows\System\vclFYdU.exe
  2⤵
  PID:2584
- C:\Windows\System\oJJcXjR.exe
  C:\Windows\System\oJJcXjR.exe
  2⤵
  PID:2640
- C:\Windows\System\KjZNDyq.exe
  C:\Windows\System\KjZNDyq.exe
  2⤵
  PID:1232
- C:\Windows\System\QkKmPei.exe
  C:\Windows\System\QkKmPei.exe
  2⤵
  PID:2532
- C:\Windows\System\RakDBFq.exe
  C:\Windows\System\RakDBFq.exe
  2⤵
  PID:1956
- C:\Windows\System\dPwtzTo.exe
  C:\Windows\System\dPwtzTo.exe
  2⤵
  PID:1988
- C:\Windows\System\MOgceua.exe
  C:\Windows\System\MOgceua.exe
  2⤵
  PID:1472
- C:\Windows\System\GArzkXF.exe
  C:\Windows\System\GArzkXF.exe
  2⤵
  PID:948
- C:\Windows\System\QjgDQAI.exe
  C:\Windows\System\QjgDQAI.exe
  2⤵
  PID:704
- C:\Windows\System\CFzRWEh.exe
  C:\Windows\System\CFzRWEh.exe
  2⤵
  PID:2432
- C:\Windows\System\VVNXzYM.exe
  C:\Windows\System\VVNXzYM.exe
  2⤵
  PID:1108
- C:\Windows\System\JlhwznR.exe
  C:\Windows\System\JlhwznR.exe
  2⤵
  PID:1552
- C:\Windows\System\GtZtOkP.exe
  C:\Windows\System\GtZtOkP.exe
  2⤵
  PID:780
- C:\Windows\System\bxdvbCZ.exe
  C:\Windows\System\bxdvbCZ.exe
  2⤵
  PID:1808
- C:\Windows\System\UKYhaOH.exe
  C:\Windows\System\UKYhaOH.exe
  2⤵
  PID:1196
- C:\Windows\System\pSVKhuY.exe
  C:\Windows\System\pSVKhuY.exe
  2⤵
  PID:560
- C:\Windows\System\gtpUQHM.exe
  C:\Windows\System\gtpUQHM.exe
  2⤵
  PID:3048
- C:\Windows\System\VqgwzKs.exe
  C:\Windows\System\VqgwzKs.exe
  2⤵
  PID:2672
- C:\Windows\System\jZYbZOb.exe
  C:\Windows\System\jZYbZOb.exe
  2⤵
  PID:2680
- C:\Windows\System\WwABvhA.exe
  C:\Windows\System\WwABvhA.exe
  2⤵
  PID:3024
- C:\Windows\System\MrXKnCt.exe
  C:\Windows\System\MrXKnCt.exe
  2⤵
  PID:2824
- C:\Windows\System\YzxdGUH.exe
  C:\Windows\System\YzxdGUH.exe
  2⤵
  PID:2076
- C:\Windows\System\drfniBK.exe
  C:\Windows\System\drfniBK.exe
  2⤵
  PID:1524
- C:\Windows\System\xVbuJmW.exe
  C:\Windows\System\xVbuJmW.exe
  2⤵
  PID:1272
- C:\Windows\System\wSinLRq.exe
  C:\Windows\System\wSinLRq.exe
  2⤵
  PID:2064
- C:\Windows\System\dueRmbn.exe
  C:\Windows\System\dueRmbn.exe
  2⤵
  PID:2492
- C:\Windows\System\keEFROQ.exe
  C:\Windows\System\keEFROQ.exe
  2⤵
  PID:2776
- C:\Windows\System\STVxCZI.exe
  C:\Windows\System\STVxCZI.exe
  2⤵
  PID:628
- C:\Windows\System\SVsavGv.exe
  C:\Windows\System\SVsavGv.exe
  2⤵
  PID:1520
- C:\Windows\System\IqZFYyb.exe
  C:\Windows\System\IqZFYyb.exe
  2⤵
  PID:3012
- C:\Windows\System\cVGmeNE.exe
  C:\Windows\System\cVGmeNE.exe
  2⤵
  PID:1892
- C:\Windows\System\hZrAtAF.exe
  C:\Windows\System\hZrAtAF.exe
  2⤵
  PID:284
- C:\Windows\System\qRCFqMk.exe
  C:\Windows\System\qRCFqMk.exe
  2⤵
  PID:2788
- C:\Windows\System\rmjZLpk.exe
  C:\Windows\System\rmjZLpk.exe
  2⤵
  PID:2848
- C:\Windows\System\pLdSuXe.exe
  C:\Windows\System\pLdSuXe.exe
  2⤵
  PID:2944
- C:\Windows\System\bBHbFUk.exe
  C:\Windows\System\bBHbFUk.exe
  2⤵
  PID:1828
- C:\Windows\System\hvCgPhp.exe
  C:\Windows\System\hvCgPhp.exe
  2⤵
  PID:1624
- C:\Windows\System\PZvnije.exe
  C:\Windows\System\PZvnije.exe
  2⤵
  PID:2716
- C:\Windows\System\pLiHDJN.exe
  C:\Windows\System\pLiHDJN.exe
  2⤵
  PID:3004
- C:\Windows\System\DvDIyBt.exe
  C:\Windows\System\DvDIyBt.exe
  2⤵
  PID:956
- C:\Windows\System\OZpMVms.exe
  C:\Windows\System\OZpMVms.exe
  2⤵
  PID:1660
- C:\Windows\System\FTEDzll.exe
  C:\Windows\System\FTEDzll.exe
  2⤵
  PID:1032
- C:\Windows\System\MCLSVcu.exe
  C:\Windows\System\MCLSVcu.exe
  2⤵
  PID:2444
- C:\Windows\System\uaoeNlf.exe
  C:\Windows\System\uaoeNlf.exe
  2⤵
  PID:3068
- C:\Windows\System\zilTOFj.exe
  C:\Windows\System\zilTOFj.exe
  2⤵
  PID:1264
- C:\Windows\System\fYCuIfV.exe
  C:\Windows\System\fYCuIfV.exe
  2⤵
  PID:2084
- C:\Windows\System\MrbsFxf.exe
  C:\Windows\System\MrbsFxf.exe
  2⤵
  PID:2500
- C:\Windows\System\Sggkfyb.exe
  C:\Windows\System\Sggkfyb.exe
  2⤵
  PID:3008
- C:\Windows\System\zrZtBJE.exe
  C:\Windows\System\zrZtBJE.exe
  2⤵
  PID:2580
- C:\Windows\System\NVziKkh.exe
  C:\Windows\System\NVziKkh.exe
  2⤵
  PID:1908
- C:\Windows\System\rXTCLen.exe
  C:\Windows\System\rXTCLen.exe
  2⤵
  PID:3076
- C:\Windows\System\XwwWavO.exe
  C:\Windows\System\XwwWavO.exe
  2⤵
  PID:3092
- C:\Windows\System\FdWSAQf.exe
  C:\Windows\System\FdWSAQf.exe
  2⤵
  PID:3108
- C:\Windows\System\EkRbiRX.exe
  C:\Windows\System\EkRbiRX.exe
  2⤵
  PID:3128
- C:\Windows\System\gNcQMih.exe
  C:\Windows\System\gNcQMih.exe
  2⤵
  PID:3144
- C:\Windows\System\gXFnspk.exe
  C:\Windows\System\gXFnspk.exe
  2⤵
  PID:3160
- C:\Windows\System\gODgUdb.exe
  C:\Windows\System\gODgUdb.exe
  2⤵
  PID:3180
- C:\Windows\System\WixHTXO.exe
  C:\Windows\System\WixHTXO.exe
  2⤵
  PID:3196
- C:\Windows\System\BLRJSYG.exe
  C:\Windows\System\BLRJSYG.exe
  2⤵
  PID:3216
- C:\Windows\System\bRwCleP.exe
  C:\Windows\System\bRwCleP.exe
  2⤵
  PID:3232
- C:\Windows\System\QYZgeTM.exe
  C:\Windows\System\QYZgeTM.exe
  2⤵
  PID:3248
- C:\Windows\System\OGjhRhZ.exe
  C:\Windows\System\OGjhRhZ.exe
  2⤵
  PID:3264
- C:\Windows\System\dPrkPaZ.exe
  C:\Windows\System\dPrkPaZ.exe
  2⤵
  PID:3416
- C:\Windows\System\zzhWbBA.exe
  C:\Windows\System\zzhWbBA.exe
  2⤵
  PID:3432
- C:\Windows\System\ZbpvNPr.exe
  C:\Windows\System\ZbpvNPr.exe
  2⤵
  PID:3448
- C:\Windows\System\WZbzzWd.exe
  C:\Windows\System\WZbzzWd.exe
  2⤵
  PID:3464
- C:\Windows\System\HcMIAYK.exe
  C:\Windows\System\HcMIAYK.exe
  2⤵
  PID:3480
- C:\Windows\System\IBvmOXT.exe
  C:\Windows\System\IBvmOXT.exe
  2⤵
  PID:3508
- C:\Windows\System\CQuKCIv.exe
  C:\Windows\System\CQuKCIv.exe
  2⤵
  PID:3532
- C:\Windows\System\FEUrfsv.exe
  C:\Windows\System\FEUrfsv.exe
  2⤵
  PID:3552
- C:\Windows\System\zCPpvpB.exe
  C:\Windows\System\zCPpvpB.exe
  2⤵
  PID:3572
- C:\Windows\System\KyfCLBC.exe
  C:\Windows\System\KyfCLBC.exe
  2⤵
  PID:3588
- C:\Windows\System\XZSpuAF.exe
  C:\Windows\System\XZSpuAF.exe
  2⤵
  PID:3604
- C:\Windows\System\DkhvmvK.exe
  C:\Windows\System\DkhvmvK.exe
  2⤵
  PID:3624
- C:\Windows\System\rgyWvxe.exe
  C:\Windows\System\rgyWvxe.exe
  2⤵
  PID:3640
- C:\Windows\System\fGYLMeT.exe
  C:\Windows\System\fGYLMeT.exe
  2⤵
  PID:3656
- C:\Windows\System\kbHBLAB.exe
  C:\Windows\System\kbHBLAB.exe
  2⤵
  PID:3672
- C:\Windows\System\aEBmMPD.exe
  C:\Windows\System\aEBmMPD.exe
  2⤵
  PID:3688
- C:\Windows\System\omiGeqX.exe
  C:\Windows\System\omiGeqX.exe
  2⤵
  PID:3708
- C:\Windows\System\KPDvlcn.exe
  C:\Windows\System\KPDvlcn.exe
  2⤵
  PID:3724
- C:\Windows\System\RSBbaYg.exe
  C:\Windows\System\RSBbaYg.exe
  2⤵
  PID:3740
- C:\Windows\System\HJyazyJ.exe
  C:\Windows\System\HJyazyJ.exe
  2⤵
  PID:3756
- C:\Windows\System\LfkcGbJ.exe
  C:\Windows\System\LfkcGbJ.exe
  2⤵
  PID:3772
- C:\Windows\System\WtXofRv.exe
  C:\Windows\System\WtXofRv.exe
  2⤵
  PID:3792
- C:\Windows\System\xACtlDl.exe
  C:\Windows\System\xACtlDl.exe
  2⤵
  PID:3808
- C:\Windows\System\nsWhWID.exe
  C:\Windows\System\nsWhWID.exe
  2⤵
  PID:3824
- C:\Windows\System\LSCeSIG.exe
  C:\Windows\System\LSCeSIG.exe
  2⤵
  PID:3840
- C:\Windows\System\obMrsMc.exe
  C:\Windows\System\obMrsMc.exe
  2⤵
  PID:3856
- C:\Windows\System\aMchYEw.exe
  C:\Windows\System\aMchYEw.exe
  2⤵
  PID:3876
- C:\Windows\System\veHZhOA.exe
  C:\Windows\System\veHZhOA.exe
  2⤵
  PID:3892
- C:\Windows\System\XTevmEA.exe
  C:\Windows\System\XTevmEA.exe
  2⤵
  PID:3908
- C:\Windows\System\WNDxgWm.exe
  C:\Windows\System\WNDxgWm.exe
  2⤵
  PID:3924
- C:\Windows\System\UhConoq.exe
  C:\Windows\System\UhConoq.exe
  2⤵
  PID:3940
- C:\Windows\System\lqdwERa.exe
  C:\Windows\System\lqdwERa.exe
  2⤵
  PID:3956
- C:\Windows\System\MpOTnjF.exe
  C:\Windows\System\MpOTnjF.exe
  2⤵
  PID:3972
- C:\Windows\System\fErTavq.exe
  C:\Windows\System\fErTavq.exe
  2⤵
  PID:3988
- C:\Windows\System\AIWTWGU.exe
  C:\Windows\System\AIWTWGU.exe
  2⤵
  PID:4004
- C:\Windows\System\iVXoYYQ.exe
  C:\Windows\System\iVXoYYQ.exe
  2⤵
  PID:4020
- C:\Windows\System\HQoKdSP.exe
  C:\Windows\System\HQoKdSP.exe
  2⤵
  PID:4044
- C:\Windows\System\wjtTLUu.exe
  C:\Windows\System\wjtTLUu.exe
  2⤵
  PID:4060
- C:\Windows\System\wtwVKas.exe
  C:\Windows\System\wtwVKas.exe
  2⤵
  PID:4076
- C:\Windows\System\MFAOcdl.exe
  C:\Windows\System\MFAOcdl.exe
  2⤵
  PID:4092
- C:\Windows\System\UuTghQc.exe
  C:\Windows\System\UuTghQc.exe
  2⤵
  PID:768
- C:\Windows\System\LNDwInb.exe
  C:\Windows\System\LNDwInb.exe
  2⤵
  PID:412
- C:\Windows\System\dpBgTJo.exe
  C:\Windows\System\dpBgTJo.exe
  2⤵
  PID:2684
- C:\Windows\System\rveuqSk.exe
  C:\Windows\System\rveuqSk.exe
  2⤵
  PID:1948
- C:\Windows\System\NIVoRZT.exe
  C:\Windows\System\NIVoRZT.exe
  2⤵
  PID:1616
- C:\Windows\System\BaaELoa.exe
  C:\Windows\System\BaaELoa.exe
  2⤵
  PID:1960
- C:\Windows\System\FvuKQFV.exe
  C:\Windows\System\FvuKQFV.exe
  2⤵
  PID:1512
- C:\Windows\System\NdwPhfv.exe
  C:\Windows\System\NdwPhfv.exe
  2⤵
  PID:3188
- C:\Windows\System\bMKWcnw.exe
  C:\Windows\System\bMKWcnw.exe
  2⤵
  PID:1576
- C:\Windows\System\GLcHabV.exe
  C:\Windows\System\GLcHabV.exe
  2⤵
  PID:3088
- C:\Windows\System\KclhFrd.exe
  C:\Windows\System\KclhFrd.exe
  2⤵
  PID:3156
- C:\Windows\System\zycnfAi.exe
  C:\Windows\System\zycnfAi.exe
  2⤵
  PID:3260
- C:\Windows\System\lJPPPlW.exe
  C:\Windows\System\lJPPPlW.exe
  2⤵
  PID:3284
- C:\Windows\System\tqYLipj.exe
  C:\Windows\System\tqYLipj.exe
  2⤵
  PID:3280
- C:\Windows\System\MTeHlDI.exe
  C:\Windows\System\MTeHlDI.exe
  2⤵
  PID:3376
- C:\Windows\System\FxvfUKc.exe
  C:\Windows\System\FxvfUKc.exe
  2⤵
  PID:3456
- C:\Windows\System\COCjxBV.exe
  C:\Windows\System\COCjxBV.exe
  2⤵
  PID:3428
- C:\Windows\System\YONxGjn.exe
  C:\Windows\System\YONxGjn.exe
  2⤵
  PID:3492
- C:\Windows\System\CNHYVzs.exe
  C:\Windows\System\CNHYVzs.exe
  2⤵
  PID:3520
- C:\Windows\System\ubTMtIR.exe
  C:\Windows\System\ubTMtIR.exe
  2⤵
  PID:3540
- C:\Windows\System\GeKRDJW.exe
  C:\Windows\System\GeKRDJW.exe
  2⤵
  PID:3580
- C:\Windows\System\bWkldjZ.exe
  C:\Windows\System\bWkldjZ.exe
  2⤵
  PID:3620
- C:\Windows\System\uHeWDMf.exe
  C:\Windows\System\uHeWDMf.exe
  2⤵
  PID:3612
- C:\Windows\System\HAxuNPP.exe
  C:\Windows\System\HAxuNPP.exe
  2⤵
  PID:3636
- C:\Windows\System\YLnWsOA.exe
  C:\Windows\System\YLnWsOA.exe
  2⤵
  PID:3704
- C:\Windows\System\QkDQjiY.exe
  C:\Windows\System\QkDQjiY.exe
  2⤵
  PID:4012
- C:\Windows\System\lTsaXaT.exe
  C:\Windows\System\lTsaXaT.exe
  2⤵
  PID:4084
- C:\Windows\System\xQidSpl.exe
  C:\Windows\System\xQidSpl.exe
  2⤵
  PID:3748
- C:\Windows\System\DFnERcY.exe
  C:\Windows\System\DFnERcY.exe
  2⤵
  PID:3652
- C:\Windows\System\EAuUghz.exe
  C:\Windows\System\EAuUghz.exe
  2⤵
  PID:3932
- C:\Windows\System\HMBRlbR.exe
  C:\Windows\System\HMBRlbR.exe
  2⤵
  PID:3816
- C:\Windows\System\fMBzjTb.exe
  C:\Windows\System\fMBzjTb.exe
  2⤵
  PID:3884
- C:\Windows\System\XwfcSzo.exe
  C:\Windows\System\XwfcSzo.exe
  2⤵
  PID:3984
- C:\Windows\System\zIzjHQI.exe
  C:\Windows\System\zIzjHQI.exe
  2⤵
  PID:4088
- C:\Windows\System\aKAMArI.exe
  C:\Windows\System\aKAMArI.exe
  2⤵
  PID:1628
- C:\Windows\System\XJYcpeD.exe
  C:\Windows\System\XJYcpeD.exe
  2⤵
  PID:1992
- C:\Windows\System\nkWrLNS.exe
  C:\Windows\System\nkWrLNS.exe
  2⤵
  PID:3256
- C:\Windows\System\ahBlXQS.exe
  C:\Windows\System\ahBlXQS.exe
  2⤵
  PID:2484
- C:\Windows\System\beCoNwC.exe
  C:\Windows\System\beCoNwC.exe
  2⤵
  PID:1824
- C:\Windows\System\QAleqOr.exe
  C:\Windows\System\QAleqOr.exe
  2⤵
  PID:2428
- C:\Windows\System\VIeSRJy.exe
  C:\Windows\System\VIeSRJy.exe
  2⤵
  PID:3336
- C:\Windows\System\RYdsAxk.exe
  C:\Windows\System\RYdsAxk.exe
  2⤵
  PID:3348
- C:\Windows\System\ZjBXvPV.exe
  C:\Windows\System\ZjBXvPV.exe
  2⤵
  PID:3356
- C:\Windows\System\lmdnWGW.exe
  C:\Windows\System\lmdnWGW.exe
  2⤵
  PID:4068
- C:\Windows\System\HFvtEjp.exe
  C:\Windows\System\HFvtEjp.exe
  2⤵
  PID:3208
- C:\Windows\System\eEzDCsO.exe
  C:\Windows\System\eEzDCsO.exe
  2⤵
  PID:2476
- C:\Windows\System\TsvLskA.exe
  C:\Windows\System\TsvLskA.exe
  2⤵
  PID:3240
- C:\Windows\System\FKHNGzE.exe
  C:\Windows\System\FKHNGzE.exe
  2⤵
  PID:3596
- C:\Windows\System\qOfpRce.exe
  C:\Windows\System\qOfpRce.exe
  2⤵
  PID:3980
- C:\Windows\System\RSBBcrQ.exe
  C:\Windows\System\RSBBcrQ.exe
  2⤵
  PID:3716
- C:\Windows\System\zhKgNxf.exe
  C:\Windows\System\zhKgNxf.exe
  2⤵
  PID:4052
- C:\Windows\System\ytGvvhd.exe
  C:\Windows\System\ytGvvhd.exe
  2⤵
  PID:3300
- C:\Windows\System\clAifsu.exe
  C:\Windows\System\clAifsu.exe
  2⤵
  PID:3424
- C:\Windows\System\qMRMYwT.exe
  C:\Windows\System\qMRMYwT.exe
  2⤵
  PID:3680
- C:\Windows\System\GnZShBo.exe
  C:\Windows\System\GnZShBo.exe
  2⤵
  PID:3900
- C:\Windows\System\utVgQPe.exe
  C:\Windows\System\utVgQPe.exe
  2⤵
  PID:3788
- C:\Windows\System\VKnOiwW.exe
  C:\Windows\System\VKnOiwW.exe
  2⤵
  PID:3168
- C:\Windows\System\XUbgLsm.exe
  C:\Windows\System\XUbgLsm.exe
  2⤵
  PID:2364
- C:\Windows\System\awZrurg.exe
  C:\Windows\System\awZrurg.exe
  2⤵
  PID:3312
- C:\Windows\System\RSZiVow.exe
  C:\Windows\System\RSZiVow.exe
  2⤵
  PID:3136
- C:\Windows\System\kayTVDe.exe
  C:\Windows\System\kayTVDe.exe
  2⤵
  PID:3444
- C:\Windows\System\rQtUdjl.exe
  C:\Windows\System\rQtUdjl.exe
  2⤵
  PID:1052
- C:\Windows\System\kigVlnT.exe
  C:\Windows\System\kigVlnT.exe
  2⤵
  PID:3752
- C:\Windows\System\zBLeHOa.exe
  C:\Windows\System\zBLeHOa.exe
  2⤵
  PID:4072
- C:\Windows\System\QLGrCOH.exe
  C:\Windows\System\QLGrCOH.exe
  2⤵
  PID:2400
- C:\Windows\System\irflOoC.exe
  C:\Windows\System\irflOoC.exe
  2⤵
  PID:3084
- C:\Windows\System\SEoFdDR.exe
  C:\Windows\System\SEoFdDR.exe
  2⤵
  PID:2896
- C:\Windows\System\TNroQXS.exe
  C:\Windows\System\TNroQXS.exe
  2⤵
  PID:3328
- C:\Windows\System\BhHrCUa.exe
  C:\Windows\System\BhHrCUa.exe
  2⤵
  PID:4028
- C:\Windows\System\AkBCreY.exe
  C:\Windows\System\AkBCreY.exe
  2⤵
  PID:3440
- C:\Windows\System\dKwksiO.exe
  C:\Windows\System\dKwksiO.exe
  2⤵
  PID:3868
- C:\Windows\System\KnOGPlR.exe
  C:\Windows\System\KnOGPlR.exe
  2⤵
  PID:4000
- C:\Windows\System\ezzkqhh.exe
  C:\Windows\System\ezzkqhh.exe
  2⤵
  PID:3996
- C:\Windows\System\UKQfHiJ.exe
  C:\Windows\System\UKQfHiJ.exe
  2⤵
  PID:3288
- C:\Windows\System\PdlaJDH.exe
  C:\Windows\System\PdlaJDH.exe
  2⤵
  PID:3172
- C:\Windows\System\NmmoTcW.exe
  C:\Windows\System\NmmoTcW.exe
  2⤵
  PID:4036
- C:\Windows\System\qDaivGi.exe
  C:\Windows\System\qDaivGi.exe
  2⤵
  PID:3124
- C:\Windows\System\MihrbfD.exe
  C:\Windows\System\MihrbfD.exe
  2⤵
  PID:3848
- C:\Windows\System\wzQvoiV.exe
  C:\Windows\System\wzQvoiV.exe
  2⤵
  PID:672
- C:\Windows\System\sDzMPWm.exe
  C:\Windows\System\sDzMPWm.exe
  2⤵
  PID:3784
- C:\Windows\System\RGJZONE.exe
  C:\Windows\System\RGJZONE.exe
  2⤵
  PID:2592
- C:\Windows\System\DpqTYjX.exe
  C:\Windows\System\DpqTYjX.exe
  2⤵
  PID:3460
- C:\Windows\System\CRnurTa.exe
  C:\Windows\System\CRnurTa.exe
  2⤵
  PID:3768
- C:\Windows\System\IazoKRz.exe
  C:\Windows\System\IazoKRz.exe
  2⤵
  PID:3516
- C:\Windows\System\WaRnxcC.exe
  C:\Windows\System\WaRnxcC.exe
  2⤵
  PID:3176
- C:\Windows\System\ngmAzYC.exe
  C:\Windows\System\ngmAzYC.exe
  2⤵
  PID:3228
- C:\Windows\System\ktsfCWx.exe
  C:\Windows\System\ktsfCWx.exe
  2⤵
  PID:3304
- C:\Windows\System\uxbJyMW.exe
  C:\Windows\System\uxbJyMW.exe
  2⤵
  PID:2316
- C:\Windows\System\jeGzWij.exe
  C:\Windows\System\jeGzWij.exe
  2⤵
  PID:3700
- C:\Windows\System\TilXwOy.exe
  C:\Windows\System\TilXwOy.exe
  2⤵
  PID:1144
- C:\Windows\System\gLDWNwE.exe
  C:\Windows\System\gLDWNwE.exe
  2⤵
  PID:2356
- C:\Windows\System\BgqaQox.exe
  C:\Windows\System\BgqaQox.exe
  2⤵
  PID:3968
- C:\Windows\System\ZuBGEqc.exe
  C:\Windows\System\ZuBGEqc.exe
  2⤵
  PID:3584
- C:\Windows\System\kqrqpnr.exe
  C:\Windows\System\kqrqpnr.exe
  2⤵
  PID:1244
- C:\Windows\System\NVGWfat.exe
  C:\Windows\System\NVGWfat.exe
  2⤵
  PID:4112
- C:\Windows\System\ERsLcIE.exe
  C:\Windows\System\ERsLcIE.exe
  2⤵
  PID:4128
- C:\Windows\System\XEtbgyy.exe
  C:\Windows\System\XEtbgyy.exe
  2⤵
  PID:4180
- C:\Windows\System\YauIMCE.exe
  C:\Windows\System\YauIMCE.exe
  2⤵
  PID:4196
- C:\Windows\System\bkyAWPE.exe
  C:\Windows\System\bkyAWPE.exe
  2⤵
  PID:4216
- C:\Windows\System\JXiIHxH.exe
  C:\Windows\System\JXiIHxH.exe
  2⤵
  PID:4232
- C:\Windows\System\GkNxAiv.exe
  C:\Windows\System\GkNxAiv.exe
  2⤵
  PID:4248
- C:\Windows\System\SmXStng.exe
  C:\Windows\System\SmXStng.exe
  2⤵
  PID:4268
- C:\Windows\System\KYzJfBn.exe
  C:\Windows\System\KYzJfBn.exe
  2⤵
  PID:4284
- C:\Windows\System\IHQTIId.exe
  C:\Windows\System\IHQTIId.exe
  2⤵
  PID:4304
- C:\Windows\System\qhogThx.exe
  C:\Windows\System\qhogThx.exe
  2⤵
  PID:4320
- C:\Windows\System\LlvoJjP.exe
  C:\Windows\System\LlvoJjP.exe
  2⤵
  PID:4336
- C:\Windows\System\cMpIuEM.exe
  C:\Windows\System\cMpIuEM.exe
  2⤵
  PID:4376
- C:\Windows\System\QAmTfWC.exe
  C:\Windows\System\QAmTfWC.exe
  2⤵
  PID:4400
- C:\Windows\System\VbbQitC.exe
  C:\Windows\System\VbbQitC.exe
  2⤵
  PID:4416
- C:\Windows\System\bltADMQ.exe
  C:\Windows\System\bltADMQ.exe
  2⤵
  PID:4432
- C:\Windows\System\NRlJzZz.exe
  C:\Windows\System\NRlJzZz.exe
  2⤵
  PID:4448
- C:\Windows\System\OjUDTgg.exe
  C:\Windows\System\OjUDTgg.exe
  2⤵
  PID:4484
- C:\Windows\System\RlhaHEJ.exe
  C:\Windows\System\RlhaHEJ.exe
  2⤵
  PID:4500
- C:\Windows\System\dCFwlgl.exe
  C:\Windows\System\dCFwlgl.exe
  2⤵
  PID:4516
- C:\Windows\System\HzDkvgk.exe
  C:\Windows\System\HzDkvgk.exe
  2⤵
  PID:4532
- C:\Windows\System\WRChTcV.exe
  C:\Windows\System\WRChTcV.exe
  2⤵
  PID:4548
- C:\Windows\System\DidKdOq.exe
  C:\Windows\System\DidKdOq.exe
  2⤵
  PID:4568
- C:\Windows\System\WuWGslI.exe
  C:\Windows\System\WuWGslI.exe
  2⤵
  PID:4584
- C:\Windows\System\BQjuqKy.exe
  C:\Windows\System\BQjuqKy.exe
  2⤵
  PID:4604
- C:\Windows\System\oMkeuHx.exe
  C:\Windows\System\oMkeuHx.exe
  2⤵
  PID:4628
- C:\Windows\System\zOvFYeP.exe
  C:\Windows\System\zOvFYeP.exe
  2⤵
  PID:4644
- C:\Windows\System\NLKtoKz.exe
  C:\Windows\System\NLKtoKz.exe
  2⤵
  PID:4660
- C:\Windows\System\qQXTeaj.exe
  C:\Windows\System\qQXTeaj.exe
  2⤵
  PID:4676
- C:\Windows\System\dxpzvjj.exe
  C:\Windows\System\dxpzvjj.exe
  2⤵
  PID:4692
- C:\Windows\System\AjUVJbH.exe
  C:\Windows\System\AjUVJbH.exe
  2⤵
  PID:4712
- C:\Windows\System\BHeDNnz.exe
  C:\Windows\System\BHeDNnz.exe
  2⤵
  PID:4728
- C:\Windows\System\gZesukW.exe
  C:\Windows\System\gZesukW.exe
  2⤵
  PID:4744
- C:\Windows\System\KKTaGoJ.exe
  C:\Windows\System\KKTaGoJ.exe
  2⤵
  PID:4796
- C:\Windows\System\EzHptJB.exe
  C:\Windows\System\EzHptJB.exe
  2⤵
  PID:4816
- C:\Windows\System\AVawtjL.exe
  C:\Windows\System\AVawtjL.exe
  2⤵
  PID:4844
- C:\Windows\System\DYQssnd.exe
  C:\Windows\System\DYQssnd.exe
  2⤵
  PID:4860
- C:\Windows\System\DhVCVgk.exe
  C:\Windows\System\DhVCVgk.exe
  2⤵
  PID:4876
- C:\Windows\System\jvQsvkS.exe
  C:\Windows\System\jvQsvkS.exe
  2⤵
  PID:4896
- C:\Windows\System\IISvOth.exe
  C:\Windows\System\IISvOth.exe
  2⤵
  PID:4912
- C:\Windows\System\UbIyqKf.exe
  C:\Windows\System\UbIyqKf.exe
  2⤵
  PID:4928
- C:\Windows\System\lILNZZa.exe
  C:\Windows\System\lILNZZa.exe
  2⤵
  PID:4948
- C:\Windows\System\eNeQrTJ.exe
  C:\Windows\System\eNeQrTJ.exe
  2⤵
  PID:4964
- C:\Windows\System\qJDNPrC.exe
  C:\Windows\System\qJDNPrC.exe
  2⤵
  PID:4980
- C:\Windows\System\ritUmNe.exe
  C:\Windows\System\ritUmNe.exe
  2⤵
  PID:5020
- C:\Windows\System\FAislof.exe
  C:\Windows\System\FAislof.exe
  2⤵
  PID:5040
- C:\Windows\System\dShZfcx.exe
  C:\Windows\System\dShZfcx.exe
  2⤵
  PID:5060
- C:\Windows\System\TAQKsZj.exe
  C:\Windows\System\TAQKsZj.exe
  2⤵
  PID:5076
- C:\Windows\System\VpfRZpp.exe
  C:\Windows\System\VpfRZpp.exe
  2⤵
  PID:5092
- C:\Windows\System\OcgyCMK.exe
  C:\Windows\System\OcgyCMK.exe
  2⤵
  PID:5108
- C:\Windows\System\pgXTQNs.exe
  C:\Windows\System\pgXTQNs.exe
  2⤵
  PID:900
- C:\Windows\System\IIunzCy.exe
  C:\Windows\System\IIunzCy.exe
  2⤵
  PID:3324
- C:\Windows\System\tJSJJeW.exe
  C:\Windows\System\tJSJJeW.exe
  2⤵
  PID:1900
- C:\Windows\System\qooPlSZ.exe
  C:\Windows\System\qooPlSZ.exe
  2⤵
  PID:4124
- C:\Windows\System\xCoVwiN.exe
  C:\Windows\System\xCoVwiN.exe
  2⤵
  PID:4140
- C:\Windows\System\IhJmHqy.exe
  C:\Windows\System\IhJmHqy.exe
  2⤵
  PID:4144
- C:\Windows\System\DQsLVDD.exe
  C:\Windows\System\DQsLVDD.exe
  2⤵
  PID:4156
- C:\Windows\System\EKktnnf.exe
  C:\Windows\System\EKktnnf.exe
  2⤵
  PID:4164
- C:\Windows\System\LjaEUWx.exe
  C:\Windows\System\LjaEUWx.exe
  2⤵
  PID:4192
- C:\Windows\System\VnKmWMm.exe
  C:\Windows\System\VnKmWMm.exe
  2⤵
  PID:4212
- C:\Windows\System\FPFjEYv.exe
  C:\Windows\System\FPFjEYv.exe
  2⤵
  PID:4264
- C:\Windows\System\BuFrkMc.exe
  C:\Windows\System\BuFrkMc.exe
  2⤵
  PID:4296
- C:\Windows\System\GEHcKae.exe
  C:\Windows\System\GEHcKae.exe
  2⤵
  PID:4316
- C:\Windows\System\amJXwBr.exe
  C:\Windows\System\amJXwBr.exe
  2⤵
  PID:4348
- C:\Windows\System\AJxTfNS.exe
  C:\Windows\System\AJxTfNS.exe
  2⤵
  PID:4364
- C:\Windows\System\IpUshEg.exe
  C:\Windows\System\IpUshEg.exe
  2⤵
  PID:4392
- C:\Windows\System\bLUlxZE.exe
  C:\Windows\System\bLUlxZE.exe
  2⤵
  PID:4424
- C:\Windows\System\nYdfJWO.exe
  C:\Windows\System\nYdfJWO.exe
  2⤵
  PID:4444
- C:\Windows\System\yqzdtaz.exe
  C:\Windows\System\yqzdtaz.exe
  2⤵
  PID:4464
- C:\Windows\System\boEPbMH.exe
  C:\Windows\System\boEPbMH.exe
  2⤵
  PID:4560
- C:\Windows\System\QfQEiau.exe
  C:\Windows\System\QfQEiau.exe
  2⤵
  PID:4620
- C:\Windows\System\eayfNNF.exe
  C:\Windows\System\eayfNNF.exe
  2⤵
  PID:4684
- C:\Windows\System\bQqCTpg.exe
  C:\Windows\System\bQqCTpg.exe
  2⤵
  PID:4752
- C:\Windows\System\uGvByPU.exe
  C:\Windows\System\uGvByPU.exe
  2⤵
  PID:4636
- C:\Windows\System\YrkbrtX.exe
  C:\Windows\System\YrkbrtX.exe
  2⤵
  PID:4772
- C:\Windows\System\oPEwOnr.exe
  C:\Windows\System\oPEwOnr.exe
  2⤵
  PID:4788
- C:\Windows\System\dhJzpsl.exe
  C:\Windows\System\dhJzpsl.exe
  2⤵
  PID:4700
- C:\Windows\System\vNhyivP.exe
  C:\Windows\System\vNhyivP.exe
  2⤵
  PID:4668
- C:\Windows\System\aSaQttJ.exe
  C:\Windows\System\aSaQttJ.exe
  2⤵
  PID:4804
- C:\Windows\System\UUdtbEi.exe
  C:\Windows\System\UUdtbEi.exe
  2⤵
  PID:4824
- C:\Windows\System\wMpBsXR.exe
  C:\Windows\System\wMpBsXR.exe
  2⤵
  PID:4852
- C:\Windows\System\RNARMvc.exe
  C:\Windows\System\RNARMvc.exe
  2⤵
  PID:4884
- C:\Windows\System\hWtzzIM.exe
  C:\Windows\System\hWtzzIM.exe
  2⤵
  PID:4956
- C:\Windows\System\YFdQeQp.exe
  C:\Windows\System\YFdQeQp.exe
  2⤵
  PID:4996
- C:\Windows\System\pVwZBhT.exe
  C:\Windows\System\pVwZBhT.exe
  2⤵
  PID:4908
- C:\Windows\System\TXduFQQ.exe
  C:\Windows\System\TXduFQQ.exe
  2⤵
  PID:4976
- C:\Windows\System\dgCEkfr.exe
  C:\Windows\System\dgCEkfr.exe
  2⤵
  PID:5008
- C:\Windows\System\EeIPaDl.exe
  C:\Windows\System\EeIPaDl.exe
  2⤵
  PID:5032
- C:\Windows\System\oiSaKMf.exe
  C:\Windows\System\oiSaKMf.exe
  2⤵
  PID:5104
- C:\Windows\System\aIDIDlE.exe
  C:\Windows\System\aIDIDlE.exe
  2⤵
  PID:1256
- C:\Windows\System\lQXLdsT.exe
  C:\Windows\System\lQXLdsT.exe
  2⤵
  PID:5088
- C:\Windows\System\PiJDmrd.exe
  C:\Windows\System\PiJDmrd.exe
  2⤵
  PID:4160
- C:\Windows\System\NcyVTqP.exe
  C:\Windows\System\NcyVTqP.exe
  2⤵
  PID:3116
- C:\Windows\System\yHqvNvC.exe
  C:\Windows\System\yHqvNvC.exe
  2⤵
  PID:4332
- C:\Windows\System\SdGAeMt.exe
  C:\Windows\System\SdGAeMt.exe
  2⤵
  PID:2360
- C:\Windows\System\xshpnzB.exe
  C:\Windows\System\xshpnzB.exe
  2⤵
  PID:4428
- C:\Windows\System\FKCnypQ.exe
  C:\Windows\System\FKCnypQ.exe
  2⤵
  PID:4148
- C:\Windows\System\PXuIBMR.exe
  C:\Windows\System\PXuIBMR.exe
  2⤵
  PID:4360
- C:\Windows\System\xoNzjQL.exe
  C:\Windows\System\xoNzjQL.exe
  2⤵
  PID:4652
- C:\Windows\System\hsxrwYS.exe
  C:\Windows\System\hsxrwYS.exe
  2⤵
  PID:4740
- C:\Windows\System\dUbLntW.exe
  C:\Windows\System\dUbLntW.exe
  2⤵
  PID:4868
- C:\Windows\System\PqUvsKi.exe
  C:\Windows\System\PqUvsKi.exe
  2⤵
  PID:4812
- C:\Windows\System\cVlxZjU.exe
  C:\Windows\System\cVlxZjU.exe
  2⤵
  PID:5012
- C:\Windows\System\oqEjcEz.exe
  C:\Windows\System\oqEjcEz.exe
  2⤵
  PID:4612
- C:\Windows\System\xChGgHH.exe
  C:\Windows\System\xChGgHH.exe
  2⤵
  PID:4924
- C:\Windows\System\niwiEsM.exe
  C:\Windows\System\niwiEsM.exe
  2⤵
  PID:3836
- C:\Windows\System\mkeEzVK.exe
  C:\Windows\System\mkeEzVK.exe
  2⤵
  PID:4640
- C:\Windows\System\mRaMpfF.exe
  C:\Windows\System\mRaMpfF.exe
  2⤵
  PID:2468
- C:\Windows\System\VHozvlM.exe
  C:\Windows\System\VHozvlM.exe
  2⤵
  PID:4904
- C:\Windows\System\kEzSWtS.exe
  C:\Windows\System\kEzSWtS.exe
  2⤵
  PID:4760
- C:\Windows\System\fksRYFE.exe
  C:\Windows\System\fksRYFE.exe
  2⤵
  PID:4580
- C:\Windows\System\bVwIfTD.exe
  C:\Windows\System\bVwIfTD.exe
  2⤵
  PID:2368
- C:\Windows\System\KaUbyxe.exe
  C:\Windows\System\KaUbyxe.exe
  2⤵
  PID:952
- C:\Windows\System\vOYJSwP.exe
  C:\Windows\System\vOYJSwP.exe
  2⤵
  PID:4784
- C:\Windows\System\hYdbiMn.exe
  C:\Windows\System\hYdbiMn.exe
  2⤵
  PID:1112
- C:\Windows\System\JfavLSy.exe
  C:\Windows\System\JfavLSy.exe
  2⤵
  PID:2728
- C:\Windows\System\HAlpYaL.exe
  C:\Windows\System\HAlpYaL.exe
  2⤵
  PID:4764
- C:\Windows\System\cLTWbgj.exe
  C:\Windows\System\cLTWbgj.exe
  2⤵
  PID:4476
- C:\Windows\System\XaDdLNx.exe
  C:\Windows\System\XaDdLNx.exe
  2⤵
  PID:2308
- C:\Windows\System\ZIqOmQD.exe
  C:\Windows\System\ZIqOmQD.exe
  2⤵
  PID:4840
- C:\Windows\System\HCuCFtY.exe
  C:\Windows\System\HCuCFtY.exe
  2⤵
  PID:4872
- C:\Windows\System\lwJSigR.exe
  C:\Windows\System\lwJSigR.exe
  2⤵
  PID:4208
- C:\Windows\System\AGsDgCY.exe
  C:\Windows\System\AGsDgCY.exe
  2⤵
  PID:2000
- C:\Windows\System\WdjzFgj.exe
  C:\Windows\System\WdjzFgj.exe
  2⤵
  PID:4188
- C:\Windows\System\BTIBceo.exe
  C:\Windows\System\BTIBceo.exe
  2⤵
  PID:4244
- C:\Windows\System\mHRWuzX.exe
  C:\Windows\System\mHRWuzX.exe
  2⤵
  PID:4460
- C:\Windows\System\WBlsapF.exe
  C:\Windows\System\WBlsapF.exe
  2⤵
  PID:4260
- C:\Windows\System\EAJGaTH.exe
  C:\Windows\System\EAJGaTH.exe
  2⤵
  PID:4992
- C:\Windows\System\sfJvGtG.exe
  C:\Windows\System\sfJvGtG.exe
  2⤵
  PID:5016
- C:\Windows\System\muXLTJZ.exe
  C:\Windows\System\muXLTJZ.exe
  2⤵
  PID:1776
- C:\Windows\System\ZHWaozO.exe
  C:\Windows\System\ZHWaozO.exe
  2⤵
  PID:4204
- C:\Windows\System\ZnwnPwJ.exe
  C:\Windows\System\ZnwnPwJ.exe
  2⤵
  PID:1736
- C:\Windows\System\YgXHpvW.exe
  C:\Windows\System\YgXHpvW.exe
  2⤵
  PID:4172
- C:\Windows\System\KDBdOIC.exe
  C:\Windows\System\KDBdOIC.exe
  2⤵
  PID:4540
- C:\Windows\System\ATrMswf.exe
  C:\Windows\System\ATrMswf.exe
  2⤵
  PID:4152
- C:\Windows\System\SzwycEC.exe
  C:\Windows\System\SzwycEC.exe
  2⤵
  PID:4972
- C:\Windows\System\nmOKduA.exe
  C:\Windows\System\nmOKduA.exe
  2⤵
  PID:4724
- C:\Windows\System\MGGBOsB.exe
  C:\Windows\System\MGGBOsB.exe
  2⤵
  PID:5072
- C:\Windows\System\bnpAWWh.exe
  C:\Windows\System\bnpAWWh.exe
  2⤵
  PID:2208
- C:\Windows\System\jExpneR.exe
  C:\Windows\System\jExpneR.exe
  2⤵
  PID:1884
- C:\Windows\System\VCATFhr.exe
  C:\Windows\System\VCATFhr.exe
  2⤵
  PID:5128
- C:\Windows\System\IMJcdrK.exe
  C:\Windows\System\IMJcdrK.exe
  2⤵
  PID:5148
- C:\Windows\System\RxIJprS.exe
  C:\Windows\System\RxIJprS.exe
  2⤵
  PID:5164
- C:\Windows\System\qCqcFYD.exe
  C:\Windows\System\qCqcFYD.exe
  2⤵
  PID:5180
- C:\Windows\System\ACrxDAz.exe
  C:\Windows\System\ACrxDAz.exe
  2⤵
  PID:5200
- C:\Windows\System\jPcdaYn.exe
  C:\Windows\System\jPcdaYn.exe
  2⤵
  PID:5216
- C:\Windows\System\xBXnubr.exe
  C:\Windows\System\xBXnubr.exe
  2⤵
  PID:5232
- C:\Windows\System\WoIdgdZ.exe
  C:\Windows\System\WoIdgdZ.exe
  2⤵
  PID:5248
- C:\Windows\System\evFYgxz.exe
  C:\Windows\System\evFYgxz.exe
  2⤵
  PID:5288
- C:\Windows\System\UkUSnLM.exe
  C:\Windows\System\UkUSnLM.exe
  2⤵
  PID:5316
- C:\Windows\System\minqTZW.exe
  C:\Windows\System\minqTZW.exe
  2⤵
  PID:5352
- C:\Windows\System\ZAcrKpx.exe
  C:\Windows\System\ZAcrKpx.exe
  2⤵
  PID:5368
- C:\Windows\System\kHSZcil.exe
  C:\Windows\System\kHSZcil.exe
  2⤵
  PID:5384
- C:\Windows\System\GbyYKBG.exe
  C:\Windows\System\GbyYKBG.exe
  2⤵
  PID:5400
- C:\Windows\System\gwqEtXT.exe
  C:\Windows\System\gwqEtXT.exe
  2⤵
  PID:5416
- C:\Windows\System\HSwXdvp.exe
  C:\Windows\System\HSwXdvp.exe
  2⤵
  PID:5432
- C:\Windows\System\uoDYZBU.exe
  C:\Windows\System\uoDYZBU.exe
  2⤵
  PID:5448
- C:\Windows\System\zGhqFON.exe
  C:\Windows\System\zGhqFON.exe
  2⤵
  PID:5472
- C:\Windows\System\LmIcIAp.exe
  C:\Windows\System\LmIcIAp.exe
  2⤵
  PID:5488
- C:\Windows\System\pWuLEna.exe
  C:\Windows\System\pWuLEna.exe
  2⤵
  PID:5504
- C:\Windows\System\bhzosPy.exe
  C:\Windows\System\bhzosPy.exe
  2⤵
  PID:5520
- C:\Windows\System\SkJvaLr.exe
  C:\Windows\System\SkJvaLr.exe
  2⤵
  PID:5536
- C:\Windows\System\TMhLkHR.exe
  C:\Windows\System\TMhLkHR.exe
  2⤵
  PID:5556
- C:\Windows\System\cqnfMDu.exe
  C:\Windows\System\cqnfMDu.exe
  2⤵
  PID:5572
- C:\Windows\System\zUZQrlY.exe
  C:\Windows\System\zUZQrlY.exe
  2⤵
  PID:5588
- C:\Windows\System\wDuSanP.exe
  C:\Windows\System\wDuSanP.exe
  2⤵
  PID:5604
- C:\Windows\System\kjaAnQP.exe
  C:\Windows\System\kjaAnQP.exe
  2⤵
  PID:5624
- C:\Windows\System\BDouQqY.exe
  C:\Windows\System\BDouQqY.exe
  2⤵
  PID:5640
- C:\Windows\System\qLcKrkf.exe
  C:\Windows\System\qLcKrkf.exe
  2⤵
  PID:5656
- C:\Windows\System\cDJoUIo.exe
  C:\Windows\System\cDJoUIo.exe
  2⤵
  PID:5740
- C:\Windows\System\zJojxvV.exe
  C:\Windows\System\zJojxvV.exe
  2⤵
  PID:5756
- C:\Windows\System\ABYgWtG.exe
  C:\Windows\System\ABYgWtG.exe
  2⤵
  PID:5772
- C:\Windows\System\WALjRQT.exe
  C:\Windows\System\WALjRQT.exe
  2⤵
  PID:5792
- C:\Windows\System\tqnIKyG.exe
  C:\Windows\System\tqnIKyG.exe
  2⤵
  PID:5808
- C:\Windows\System\rLqfqUK.exe
  C:\Windows\System\rLqfqUK.exe
  2⤵
  PID:5824
- C:\Windows\System\vXCNJRq.exe
  C:\Windows\System\vXCNJRq.exe
  2⤵
  PID:5840
- C:\Windows\System\kNSFJcJ.exe
  C:\Windows\System\kNSFJcJ.exe
  2⤵
  PID:5856
- C:\Windows\System\OYYFiWq.exe
  C:\Windows\System\OYYFiWq.exe
  2⤵
  PID:5876
- C:\Windows\System\iKiWSIl.exe
  C:\Windows\System\iKiWSIl.exe
  2⤵
  PID:5892
- C:\Windows\System\bvhRvhX.exe
  C:\Windows\System\bvhRvhX.exe
  2⤵
  PID:5908
- C:\Windows\System\vQAiLpq.exe
  C:\Windows\System\vQAiLpq.exe
  2⤵
  PID:5932
- C:\Windows\System\gtkDoRA.exe
  C:\Windows\System\gtkDoRA.exe
  2⤵
  PID:5948
- C:\Windows\System\zyGCaXP.exe
  C:\Windows\System\zyGCaXP.exe
  2⤵
  PID:5964
- C:\Windows\System\UBZegmj.exe
  C:\Windows\System\UBZegmj.exe
  2⤵
  PID:5980
- C:\Windows\System\fZSNBfh.exe
  C:\Windows\System\fZSNBfh.exe
  2⤵
  PID:6000
- C:\Windows\System\MKldkbF.exe
  C:\Windows\System\MKldkbF.exe
  2⤵
  PID:6016
- C:\Windows\System\xvjSniV.exe
  C:\Windows\System\xvjSniV.exe
  2⤵
  PID:6032
- C:\Windows\System\ReXeEum.exe
  C:\Windows\System\ReXeEum.exe
  2⤵
  PID:6052
- C:\Windows\System\sflNAGX.exe
  C:\Windows\System\sflNAGX.exe
  2⤵
  PID:6068
- C:\Windows\System\sRqBAfd.exe
  C:\Windows\System\sRqBAfd.exe
  2⤵
  PID:6084
- C:\Windows\System\AnWhulS.exe
  C:\Windows\System\AnWhulS.exe
  2⤵
  PID:6100
- C:\Windows\System\OcHVapS.exe
  C:\Windows\System\OcHVapS.exe
  2⤵
  PID:6116
- C:\Windows\System\wYPawMq.exe
  C:\Windows\System\wYPawMq.exe
  2⤵
  PID:6136
- C:\Windows\System\DDVOqRP.exe
  C:\Windows\System\DDVOqRP.exe
  2⤵
  PID:1448
- C:\Windows\System\XGACyGY.exe
  C:\Windows\System\XGACyGY.exe
  2⤵
  PID:5160
- C:\Windows\System\JFuYxcG.exe
  C:\Windows\System\JFuYxcG.exe
  2⤵
  PID:4988
- C:\Windows\System\JWsXeKE.exe
  C:\Windows\System\JWsXeKE.exe
  2⤵
  PID:1192
- C:\Windows\System\OErinfB.exe
  C:\Windows\System\OErinfB.exe
  2⤵
  PID:5144
- C:\Windows\System\LjmVvgV.exe
  C:\Windows\System\LjmVvgV.exe
  2⤵
  PID:5244
- C:\Windows\System\AKDtRLv.exe
  C:\Windows\System\AKDtRLv.exe
  2⤵
  PID:5256
- C:\Windows\System\dboRmfE.exe
  C:\Windows\System\dboRmfE.exe
  2⤵
  PID:5276
- C:\Windows\System\wmQFKwU.exe
  C:\Windows\System\wmQFKwU.exe
  2⤵
  PID:5304
- C:\Windows\System\iyHAvSj.exe
  C:\Windows\System\iyHAvSj.exe
  2⤵
  PID:5308
- C:\Windows\System\dGJXmvg.exe
  C:\Windows\System\dGJXmvg.exe
  2⤵
  PID:5396
- C:\Windows\System\rryLlNL.exe
  C:\Windows\System\rryLlNL.exe
  2⤵
  PID:5464
- C:\Windows\System\YRXGKca.exe
  C:\Windows\System\YRXGKca.exe
  2⤵
  PID:5528
- C:\Windows\System\PfWTJTc.exe
  C:\Windows\System\PfWTJTc.exe
  2⤵
  PID:5460
- C:\Windows\System\xBpLSgs.exe
  C:\Windows\System\xBpLSgs.exe
  2⤵
  PID:5336
- C:\Windows\System\YWyzqyh.exe
  C:\Windows\System\YWyzqyh.exe
  2⤵
  PID:5512
- C:\Windows\System\HVPetrD.exe
  C:\Windows\System\HVPetrD.exe
  2⤵
  PID:5440
- C:\Windows\System\eGaurQZ.exe
  C:\Windows\System\eGaurQZ.exe
  2⤵
  PID:5584
- C:\Windows\System\yUjTnlc.exe
  C:\Windows\System\yUjTnlc.exe
  2⤵
  PID:5480
- C:\Windows\System\RttrISF.exe
  C:\Windows\System\RttrISF.exe
  2⤵
  PID:5516
- C:\Windows\System\ZbaZHWb.exe
  C:\Windows\System\ZbaZHWb.exe
  2⤵
  PID:5676
- C:\Windows\System\esDqPef.exe
  C:\Windows\System\esDqPef.exe
  2⤵
  PID:5680
- C:\Windows\System\IopDtXs.exe
  C:\Windows\System\IopDtXs.exe
  2⤵
  PID:5684
- C:\Windows\System\ZCgbpIB.exe
  C:\Windows\System\ZCgbpIB.exe
  2⤵
  PID:5720
- C:\Windows\System\snwdZXR.exe
  C:\Windows\System\snwdZXR.exe
  2⤵
  PID:5736
- C:\Windows\System\nqSwbdu.exe
  C:\Windows\System\nqSwbdu.exe
  2⤵
  PID:5780
- C:\Windows\System\RWecZsL.exe
  C:\Windows\System\RWecZsL.exe
  2⤵
  PID:5804
- C:\Windows\System\CBFsoPf.exe
  C:\Windows\System\CBFsoPf.exe
  2⤵
  PID:5872
- C:\Windows\System\RsZAHKT.exe
  C:\Windows\System\RsZAHKT.exe
  2⤵
  PID:5976
- C:\Windows\System\LoBOSJD.exe
  C:\Windows\System\LoBOSJD.exe
  2⤵
  PID:6012
- C:\Windows\System\qkEPUDP.exe
  C:\Windows\System\qkEPUDP.exe
  2⤵
  PID:6048
- C:\Windows\System\yHRBZVM.exe
  C:\Windows\System\yHRBZVM.exe
  2⤵
  PID:5820
- C:\Windows\System\opHsjsC.exe
  C:\Windows\System\opHsjsC.exe
  2⤵
  PID:4136
- C:\Windows\System\BFnrbGe.exe
  C:\Windows\System\BFnrbGe.exe
  2⤵
  PID:4856
- C:\Windows\System\FhhBhMz.exe
  C:\Windows\System\FhhBhMz.exe
  2⤵
  PID:5268
- C:\Windows\System\nkjyQbE.exe
  C:\Windows\System\nkjyQbE.exe
  2⤵
  PID:5888
- C:\Windows\System\OpcRXIA.exe
  C:\Windows\System\OpcRXIA.exe
  2⤵
  PID:5928
- C:\Windows\System\SdmAucg.exe
  C:\Windows\System\SdmAucg.exe
  2⤵
  PID:6124
- C:\Windows\System\DumIHRd.exe
  C:\Windows\System\DumIHRd.exe
  2⤵
  PID:6024
- C:\Windows\System\YWxwOdn.exe
  C:\Windows\System\YWxwOdn.exe
  2⤵
  PID:5960
- C:\Windows\System\fxdDcDl.exe
  C:\Windows\System\fxdDcDl.exe
  2⤵
  PID:5208
- C:\Windows\System\JNTdtKd.exe
  C:\Windows\System\JNTdtKd.exe
  2⤵
  PID:5260
- C:\Windows\System\KAbRVMQ.exe
  C:\Windows\System\KAbRVMQ.exe
  2⤵
  PID:5564
- C:\Windows\System\KKxoccH.exe
  C:\Windows\System\KKxoccH.exe
  2⤵
  PID:5328
- C:\Windows\System\eCTJUSt.exe
  C:\Windows\System\eCTJUSt.exe
  2⤵
  PID:5348
- C:\Windows\System\zeYihRl.exe
  C:\Windows\System\zeYihRl.exe
  2⤵
  PID:5648
- C:\Windows\System\wIOWNnh.exe
  C:\Windows\System\wIOWNnh.exe
  2⤵
  PID:5600
- C:\Windows\System\HSetmUl.exe
  C:\Windows\System\HSetmUl.exe
  2⤵
  PID:4768
- C:\Windows\System\UynjnuL.exe
  C:\Windows\System\UynjnuL.exe
  2⤵
  PID:5904
- C:\Windows\System\HakRtpf.exe
  C:\Windows\System\HakRtpf.exe
  2⤵
  PID:6096
- C:\Windows\System\pCkEgeG.exe
  C:\Windows\System\pCkEgeG.exe
  2⤵
  PID:6108
- C:\Windows\System\uFaQHFT.exe
  C:\Windows\System\uFaQHFT.exe
  2⤵
  PID:6060
- C:\Windows\System\oBGczvh.exe
  C:\Windows\System\oBGczvh.exe
  2⤵
  PID:5456
- C:\Windows\System\qWEoTSi.exe
  C:\Windows\System\qWEoTSi.exe
  2⤵
  PID:5484
- C:\Windows\System\OsphRIW.exe
  C:\Windows\System\OsphRIW.exe
  2⤵
  PID:5852
- C:\Windows\System\YPbCzBy.exe
  C:\Windows\System\YPbCzBy.exe
  2⤵
  PID:5544
- C:\Windows\System\GkpUsUn.exe
  C:\Windows\System\GkpUsUn.exe
  2⤵
  PID:5580
- C:\Windows\System\nSsAofT.exe
  C:\Windows\System\nSsAofT.exe
  2⤵
  PID:5192
- C:\Windows\System\rIjZsfr.exe
  C:\Windows\System\rIjZsfr.exe
  2⤵
  PID:6128
- C:\Windows\System\OUTVpAb.exe
  C:\Windows\System\OUTVpAb.exe
  2⤵
  PID:5176
- C:\Windows\System\CSdLzXX.exe
  C:\Windows\System\CSdLzXX.exe
  2⤵
  PID:5300
- C:\Windows\System\xBbnmsQ.exe
  C:\Windows\System\xBbnmsQ.exe
  2⤵
  PID:5376
- C:\Windows\System\dKGwpPR.exe
  C:\Windows\System\dKGwpPR.exe
  2⤵
  PID:5708
- C:\Windows\System\VWqsoMp.exe
  C:\Windows\System\VWqsoMp.exe
  2⤵
  PID:5832
- C:\Windows\System\aUobxzD.exe
  C:\Windows\System\aUobxzD.exe
  2⤵
  PID:6008
- C:\Windows\System\pyBymut.exe
  C:\Windows\System\pyBymut.exe
  2⤵
  PID:5136
- C:\Windows\System\gQwegbN.exe
  C:\Windows\System\gQwegbN.exe
  2⤵
  PID:5224
- C:\Windows\System\lEwHjXT.exe
  C:\Windows\System\lEwHjXT.exe
  2⤵
  PID:5924
- C:\Windows\System\CYSfLrs.exe
  C:\Windows\System\CYSfLrs.exe
  2⤵
  PID:5496
- C:\Windows\System\UPAYOuV.exe
  C:\Windows\System\UPAYOuV.exe
  2⤵
  PID:5700
- C:\Windows\System\KATXVGg.exe
  C:\Windows\System\KATXVGg.exe
  2⤵
  PID:5868
- C:\Windows\System\LlnLmAw.exe
  C:\Windows\System\LlnLmAw.exe
  2⤵
  PID:5732
- C:\Windows\System\eaKfiKo.exe
  C:\Windows\System\eaKfiKo.exe
  2⤵
  PID:6064
- C:\Windows\System\KzIknmI.exe
  C:\Windows\System\KzIknmI.exe
  2⤵
  PID:5764
- C:\Windows\System\ywJPJdd.exe
  C:\Windows\System\ywJPJdd.exe
  2⤵
  PID:5716
- C:\Windows\System\sooxqak.exe
  C:\Windows\System\sooxqak.exe
  2⤵
  PID:936
- C:\Windows\System\eBPLdlg.exe
  C:\Windows\System\eBPLdlg.exe
  2⤵
  PID:6044
- C:\Windows\System\nOEKmJA.exe
  C:\Windows\System\nOEKmJA.exe
  2⤵
  PID:6160
- C:\Windows\System\wDOFiFp.exe
  C:\Windows\System\wDOFiFp.exe
  2⤵
  PID:6176
- C:\Windows\System\poXZbce.exe
  C:\Windows\System\poXZbce.exe
  2⤵
  PID:6192
- C:\Windows\System\KjXsJQE.exe
  C:\Windows\System\KjXsJQE.exe
  2⤵
  PID:6208
- C:\Windows\System\cBzonEn.exe
  C:\Windows\System\cBzonEn.exe
  2⤵
  PID:6224
- C:\Windows\System\AnCfqLY.exe
  C:\Windows\System\AnCfqLY.exe
  2⤵
  PID:6240
- C:\Windows\System\TfVQIec.exe
  C:\Windows\System\TfVQIec.exe
  2⤵
  PID:6256
- C:\Windows\System\vvVIhOK.exe
  C:\Windows\System\vvVIhOK.exe
  2⤵
  PID:6272
- C:\Windows\System\AinegkV.exe
  C:\Windows\System\AinegkV.exe
  2⤵
  PID:6288
- C:\Windows\System\rKMxjpc.exe
  C:\Windows\System\rKMxjpc.exe
  2⤵
  PID:6308
- C:\Windows\System\yHkkcee.exe
  C:\Windows\System\yHkkcee.exe
  2⤵
  PID:6324
- C:\Windows\System\BHKLJHN.exe
  C:\Windows\System\BHKLJHN.exe
  2⤵
  PID:6340
- C:\Windows\System\vOMwTzO.exe
  C:\Windows\System\vOMwTzO.exe
  2⤵
  PID:6356
- C:\Windows\System\mGARpnq.exe
  C:\Windows\System\mGARpnq.exe
  2⤵
  PID:6376
- C:\Windows\System\ZJydjeU.exe
  C:\Windows\System\ZJydjeU.exe
  2⤵
  PID:6392
- C:\Windows\System\MwnOIKN.exe
  C:\Windows\System\MwnOIKN.exe
  2⤵
  PID:6408
- C:\Windows\System\dypMhxO.exe
  C:\Windows\System\dypMhxO.exe
  2⤵
  PID:6424
- C:\Windows\System\vDgPaMo.exe
  C:\Windows\System\vDgPaMo.exe
  2⤵
  PID:6440
- C:\Windows\System\pWNwgqB.exe
  C:\Windows\System\pWNwgqB.exe
  2⤵
  PID:6460
- C:\Windows\System\lCWtwKv.exe
  C:\Windows\System\lCWtwKv.exe
  2⤵
  PID:6476
- C:\Windows\System\IVSKJdD.exe
  C:\Windows\System\IVSKJdD.exe
  2⤵
  PID:6492
- C:\Windows\System\CnPIusz.exe
  C:\Windows\System\CnPIusz.exe
  2⤵
  PID:6512
- C:\Windows\System\OgJJeLq.exe
  C:\Windows\System\OgJJeLq.exe
  2⤵
  PID:6528
- C:\Windows\System\wxlbemp.exe
  C:\Windows\System\wxlbemp.exe
  2⤵
  PID:6544
- C:\Windows\System\LXShyBj.exe
  C:\Windows\System\LXShyBj.exe
  2⤵
  PID:6568
- C:\Windows\System\leKpksN.exe
  C:\Windows\System\leKpksN.exe
  2⤵
  PID:6584
- C:\Windows\System\mnjybCy.exe
  C:\Windows\System\mnjybCy.exe
  2⤵
  PID:6600
- C:\Windows\System\xHxHpgM.exe
  C:\Windows\System\xHxHpgM.exe
  2⤵
  PID:6616
- C:\Windows\System\HXxyFUI.exe
  C:\Windows\System\HXxyFUI.exe
  2⤵
  PID:6632
- C:\Windows\System\pYIvcOI.exe
  C:\Windows\System\pYIvcOI.exe
  2⤵
  PID:6652
- C:\Windows\System\pPPuzve.exe
  C:\Windows\System\pPPuzve.exe
  2⤵
  PID:6668
- C:\Windows\System\MhaOpfw.exe
  C:\Windows\System\MhaOpfw.exe
  2⤵
  PID:6684
- C:\Windows\System\kFyVcFZ.exe
  C:\Windows\System\kFyVcFZ.exe
  2⤵
  PID:6700
- C:\Windows\System\aujhxhb.exe
  C:\Windows\System\aujhxhb.exe
  2⤵
  PID:6716
- C:\Windows\System\WcYErIA.exe
  C:\Windows\System\WcYErIA.exe
  2⤵
  PID:6736
- C:\Windows\System\ccKFdxu.exe
  C:\Windows\System\ccKFdxu.exe
  2⤵
  PID:6752
- C:\Windows\System\hQLLClF.exe
  C:\Windows\System\hQLLClF.exe
  2⤵
  PID:6772
- C:\Windows\System\peaMiob.exe
  C:\Windows\System\peaMiob.exe
  2⤵
  PID:6788
- C:\Windows\System\XlTHXkZ.exe
  C:\Windows\System\XlTHXkZ.exe
  2⤵
  PID:6804
- C:\Windows\System\krSoNEp.exe
  C:\Windows\System\krSoNEp.exe
  2⤵
  PID:6824
- C:\Windows\System\fSiXbwP.exe
  C:\Windows\System\fSiXbwP.exe
  2⤵
  PID:6840
- C:\Windows\System\qdHrMOl.exe
  C:\Windows\System\qdHrMOl.exe
  2⤵
  PID:6856
- C:\Windows\System\OTRbcTm.exe
  C:\Windows\System\OTRbcTm.exe
  2⤵
  PID:6876
- C:\Windows\System\mRFxYYy.exe
  C:\Windows\System\mRFxYYy.exe
  2⤵
  PID:6892
- C:\Windows\System\xHSMwjs.exe
  C:\Windows\System\xHSMwjs.exe
  2⤵
  PID:6908
- C:\Windows\System\rmLVEpd.exe
  C:\Windows\System\rmLVEpd.exe
  2⤵
  PID:6924
- C:\Windows\System\WYfLGsY.exe
  C:\Windows\System\WYfLGsY.exe
  2⤵
  PID:6944
- C:\Windows\System\pBqUWDx.exe
  C:\Windows\System\pBqUWDx.exe
  2⤵
  PID:6960
- C:\Windows\System\gjwivVI.exe
  C:\Windows\System\gjwivVI.exe
  2⤵
  PID:6976
- C:\Windows\System\pyPZTZj.exe
  C:\Windows\System\pyPZTZj.exe
  2⤵
  PID:6992
- C:\Windows\System\ObDBXcE.exe
  C:\Windows\System\ObDBXcE.exe
  2⤵
  PID:7008
- C:\Windows\System\VmpZpjJ.exe
  C:\Windows\System\VmpZpjJ.exe
  2⤵
  PID:7024
- C:\Windows\System\hpXMldl.exe
  C:\Windows\System\hpXMldl.exe
  2⤵
  PID:7044
- C:\Windows\System\CDpNEXl.exe
  C:\Windows\System\CDpNEXl.exe
  2⤵
  PID:7060
- C:\Windows\System\naXlBWf.exe
  C:\Windows\System\naXlBWf.exe
  2⤵
  PID:7076
- C:\Windows\System\aFwvqmW.exe
  C:\Windows\System\aFwvqmW.exe
  2⤵
  PID:7092
- C:\Windows\System\YotvuHm.exe
  C:\Windows\System\YotvuHm.exe
  2⤵
  PID:7108
- C:\Windows\System\wsZswNY.exe
  C:\Windows\System\wsZswNY.exe
  2⤵
  PID:7124
- C:\Windows\System\etglFRT.exe
  C:\Windows\System\etglFRT.exe
  2⤵
  PID:7144
- C:\Windows\System\fCwpnWC.exe
  C:\Windows\System\fCwpnWC.exe
  2⤵
  PID:7160
- C:\Windows\System\nSSiSrt.exe
  C:\Windows\System\nSSiSrt.exe
  2⤵
  PID:6172
- C:\Windows\System\ROhAsGk.exe
  C:\Windows\System\ROhAsGk.exe
  2⤵
  PID:6236
- C:\Windows\System\oKaUPqP.exe
  C:\Windows\System\oKaUPqP.exe
  2⤵
  PID:6300
- C:\Windows\System\kCMyvSf.exe
  C:\Windows\System\kCMyvSf.exe
  2⤵
  PID:6364
- C:\Windows\System\CNFTPVR.exe
  C:\Windows\System\CNFTPVR.exe
  2⤵
  PID:6432
- C:\Windows\System\YXwWdJt.exe
  C:\Windows\System\YXwWdJt.exe
  2⤵
  PID:6500
- C:\Windows\System\aExmSFj.exe
  C:\Windows\System\aExmSFj.exe
  2⤵
  PID:5672
- C:\Windows\System\IlJvdIQ.exe
  C:\Windows\System\IlJvdIQ.exe
  2⤵
  PID:6540
- C:\Windows\System\DDFJGgp.exe
  C:\Windows\System\DDFJGgp.exe
  2⤵
  PID:6452
- C:\Windows\System\Fzcjufx.exe
  C:\Windows\System\Fzcjufx.exe
  2⤵
  PID:5752
- C:\Windows\System\wVlWxcN.exe
  C:\Windows\System\wVlWxcN.exe
  2⤵
  PID:6152
- C:\Windows\System\GCypDWE.exe
  C:\Windows\System\GCypDWE.exe
  2⤵
  PID:6216
- C:\Windows\System\ZhXExJh.exe
  C:\Windows\System\ZhXExJh.exe
  2⤵
  PID:6448
- C:\Windows\System\TaZnUXj.exe
  C:\Windows\System\TaZnUXj.exe
  2⤵
  PID:6284
- C:\Windows\System\kiCgWky.exe
  C:\Windows\System\kiCgWky.exe
  2⤵
  PID:6456
- C:\Windows\System\ZnDShCH.exe
  C:\Windows\System\ZnDShCH.exe
  2⤵
  PID:6608
- C:\Windows\System\wJnyTys.exe
  C:\Windows\System\wJnyTys.exe
  2⤵
  PID:6556
- C:\Windows\System\muRAVlI.exe
  C:\Windows\System\muRAVlI.exe
  2⤵
  PID:6708
- C:\Windows\System\CCrrCHT.exe
  C:\Windows\System\CCrrCHT.exe
  2⤵
  PID:6564
- C:\Windows\System\rGvmQam.exe
  C:\Windows\System\rGvmQam.exe
  2⤵
  PID:6664
- C:\Windows\System\Gcycxjv.exe
  C:\Windows\System\Gcycxjv.exe
  2⤵
  PID:6852
- C:\Windows\System\SwOGPsE.exe
  C:\Windows\System\SwOGPsE.exe
  2⤵
  PID:6888
- C:\Windows\System\gYTLnsu.exe
  C:\Windows\System\gYTLnsu.exe
  2⤵
  PID:6836
- C:\Windows\System\tzLDSHW.exe
  C:\Windows\System\tzLDSHW.exe
  2⤵
  PID:6728
- C:\Windows\System\TnrotRg.exe
  C:\Windows\System\TnrotRg.exe
  2⤵
  PID:6732
- C:\Windows\System\MeMTcVc.exe
  C:\Windows\System\MeMTcVc.exe
  2⤵
  PID:6628
- C:\Windows\System\LJzdMNC.exe
  C:\Windows\System\LJzdMNC.exe
  2⤵
  PID:6900
- C:\Windows\System\jsjlwIx.exe
  C:\Windows\System\jsjlwIx.exe
  2⤵
  PID:6920
- C:\Windows\System\GRZfvkX.exe
  C:\Windows\System\GRZfvkX.exe
  2⤵
  PID:7056
- C:\Windows\System\shXSNcl.exe
  C:\Windows\System\shXSNcl.exe
  2⤵
  PID:7120
- C:\Windows\System\xLTzDfl.exe
  C:\Windows\System\xLTzDfl.exe
  2⤵
  PID:7032
- C:\Windows\System\BdstKPl.exe
  C:\Windows\System\BdstKPl.exe
  2⤵
  PID:6204
- C:\Windows\System\aHPKrLj.exe
  C:\Windows\System\aHPKrLj.exe
  2⤵
  PID:6232
- C:\Windows\System\wwqSsSF.exe
  C:\Windows\System\wwqSsSF.exe
  2⤵
  PID:6972
- C:\Windows\System\RJlqDci.exe
  C:\Windows\System\RJlqDci.exe
  2⤵
  PID:6468
- C:\Windows\System\eFKtcku.exe
  C:\Windows\System\eFKtcku.exe
  2⤵
  PID:6404
- C:\Windows\System\JYzqnev.exe
  C:\Windows\System\JYzqnev.exe
  2⤵
  PID:6296
- C:\Windows\System\cfWouQC.exe
  C:\Windows\System\cfWouQC.exe
  2⤵
  PID:6400
- C:\Windows\System\aOPTdMy.exe
  C:\Windows\System\aOPTdMy.exe
  2⤵
  PID:6416
- C:\Windows\System\jvtBfVm.exe
  C:\Windows\System\jvtBfVm.exe
  2⤵
  PID:6348
- C:\Windows\System\ERsIqdi.exe
  C:\Windows\System\ERsIqdi.exe
  2⤵
  PID:6640
- C:\Windows\System\nWYJMdC.exe
  C:\Windows\System\nWYJMdC.exe
  2⤵
  PID:6188
- C:\Windows\System\zpZYtRZ.exe
  C:\Windows\System\zpZYtRZ.exe
  2⤵
  PID:6580
- C:\Windows\System\xXEfuyt.exe
  C:\Windows\System\xXEfuyt.exe
  2⤵
  PID:6784
- C:\Windows\System\bmfsZQS.exe
  C:\Windows\System\bmfsZQS.exe
  2⤵
  PID:6868
- C:\Windows\System\yNGVuwk.exe
  C:\Windows\System\yNGVuwk.exe
  2⤵
  PID:6936
- C:\Windows\System\cxpivZu.exe
  C:\Windows\System\cxpivZu.exe
  2⤵
  PID:6968
- C:\Windows\System\KskikRT.exe
  C:\Windows\System\KskikRT.exe
  2⤵
  PID:6644
- C:\Windows\System\IHjkzEY.exe
  C:\Windows\System\IHjkzEY.exe
  2⤵
  PID:6820
- C:\Windows\System\fMuHVGV.exe
  C:\Windows\System\fMuHVGV.exe
  2⤵
  PID:7084
- C:\Windows\System\sRsqAbo.exe
  C:\Windows\System\sRsqAbo.exe
  2⤵
  PID:7040
- C:\Windows\System\dmhADjS.exe
  C:\Windows\System\dmhADjS.exe
  2⤵
  PID:6336
- C:\Windows\System\mRQuVga.exe
  C:\Windows\System\mRQuVga.exe
  2⤵
  PID:7132
- C:\Windows\System\pANpvIh.exe
  C:\Windows\System\pANpvIh.exe
  2⤵
  PID:5728
- C:\Windows\System\klGacYu.exe
  C:\Windows\System\klGacYu.exe
  2⤵
  PID:6680
- C:\Windows\System\tznQxBd.exe
  C:\Windows\System\tznQxBd.exe
  2⤵
  PID:6596
- C:\Windows\System\EqmSDIK.exe
  C:\Windows\System\EqmSDIK.exe
  2⤵
  PID:6676
- C:\Windows\System\mVqWgaL.exe
  C:\Windows\System\mVqWgaL.exe
  2⤵
  PID:6332
- C:\Windows\System\fYfvnAN.exe
  C:\Windows\System\fYfvnAN.exe
  2⤵
  PID:6536
- C:\Windows\System\wJPdTWQ.exe
  C:\Windows\System\wJPdTWQ.exe
  2⤵
  PID:6388
- C:\Windows\System\bUXYHRN.exe
  C:\Windows\System\bUXYHRN.exe
  2⤵
  PID:6696
- C:\Windows\System\vixIacM.exe
  C:\Windows\System\vixIacM.exe
  2⤵
  PID:7036
- C:\Windows\System\pILZKeS.exe
  C:\Windows\System\pILZKeS.exe
  2⤵
  PID:7172
- C:\Windows\System\LehBlYF.exe
  C:\Windows\System\LehBlYF.exe
  2⤵
  PID:7192
- C:\Windows\System\sXJgDUR.exe
  C:\Windows\System\sXJgDUR.exe
  2⤵
  PID:7208
- C:\Windows\System\vYgdQRc.exe
  C:\Windows\System\vYgdQRc.exe
  2⤵
  PID:7224
- C:\Windows\System\WgsUmos.exe
  C:\Windows\System\WgsUmos.exe
  2⤵
  PID:7240
- C:\Windows\System\OCvhAHZ.exe
  C:\Windows\System\OCvhAHZ.exe
  2⤵
  PID:7260
- C:\Windows\System\IRmItoM.exe
  C:\Windows\System\IRmItoM.exe
  2⤵
  PID:7276
- C:\Windows\System\lQUSyJd.exe
  C:\Windows\System\lQUSyJd.exe
  2⤵
  PID:7292
- C:\Windows\System\wilyIbn.exe
  C:\Windows\System\wilyIbn.exe
  2⤵
  PID:7308
- C:\Windows\System\xQYnxZM.exe
  C:\Windows\System\xQYnxZM.exe
  2⤵
  PID:7328
- C:\Windows\System\eSNSnMS.exe
  C:\Windows\System\eSNSnMS.exe
  2⤵
  PID:7344
- C:\Windows\System\ljaVaRM.exe
  C:\Windows\System\ljaVaRM.exe
  2⤵
  PID:7364
- C:\Windows\System\QUopmcg.exe
  C:\Windows\System\QUopmcg.exe
  2⤵
  PID:7380
- C:\Windows\System\OnQaLmq.exe
  C:\Windows\System\OnQaLmq.exe
  2⤵
  PID:7396
- C:\Windows\System\kXaTDUH.exe
  C:\Windows\System\kXaTDUH.exe
  2⤵
  PID:7412
- C:\Windows\System\TFbozZt.exe
  C:\Windows\System\TFbozZt.exe
  2⤵
  PID:7432
- C:\Windows\System\KHBHfym.exe
  C:\Windows\System\KHBHfym.exe
  2⤵
  PID:7448
- C:\Windows\System\QvUeSyP.exe
  C:\Windows\System\QvUeSyP.exe
  2⤵
  PID:7464
- C:\Windows\System\ZBcvpVv.exe
  C:\Windows\System\ZBcvpVv.exe
  2⤵
  PID:7480
- C:\Windows\System\RKyQbke.exe
  C:\Windows\System\RKyQbke.exe
  2⤵
  PID:7496
- C:\Windows\System\aWzfTXj.exe
  C:\Windows\System\aWzfTXj.exe
  2⤵
  PID:7512
- C:\Windows\System\PCEKXaY.exe
  C:\Windows\System\PCEKXaY.exe
  2⤵
  PID:7528
- C:\Windows\System\liuFhTF.exe
  C:\Windows\System\liuFhTF.exe
  2⤵
  PID:7548
- C:\Windows\System\krpwPBk.exe
  C:\Windows\System\krpwPBk.exe
  2⤵
  PID:7568
- C:\Windows\System\dvDNfqW.exe
  C:\Windows\System\dvDNfqW.exe
  2⤵
  PID:7584
- C:\Windows\System\HxFLpmy.exe
  C:\Windows\System\HxFLpmy.exe
  2⤵
  PID:7600
- C:\Windows\System\kztRMUU.exe
  C:\Windows\System\kztRMUU.exe
  2⤵
  PID:7616
- C:\Windows\System\WtlsvVi.exe
  C:\Windows\System\WtlsvVi.exe
  2⤵
  PID:7632
- C:\Windows\System\jNsvyur.exe
  C:\Windows\System\jNsvyur.exe
  2⤵
  PID:7648
- C:\Windows\System\boTNlOp.exe
  C:\Windows\System\boTNlOp.exe
  2⤵
  PID:7664
- C:\Windows\System\cklOEqZ.exe
  C:\Windows\System\cklOEqZ.exe
  2⤵
  PID:7680
- C:\Windows\System\zydlzLY.exe
  C:\Windows\System\zydlzLY.exe
  2⤵
  PID:7696
- C:\Windows\System\FhcbJQE.exe
  C:\Windows\System\FhcbJQE.exe
  2⤵
  PID:7712
- C:\Windows\System\YDXjgIv.exe
  C:\Windows\System\YDXjgIv.exe
  2⤵
  PID:7728
- C:\Windows\System\dVoJjpN.exe
  C:\Windows\System\dVoJjpN.exe
  2⤵
  PID:7744
- C:\Windows\System\FYjylow.exe
  C:\Windows\System\FYjylow.exe
  2⤵
  PID:7764
- C:\Windows\System\hvSnnrv.exe
  C:\Windows\System\hvSnnrv.exe
  2⤵
  PID:7780
- C:\Windows\System\xAIjuSs.exe
  C:\Windows\System\xAIjuSs.exe
  2⤵
  PID:7796
- C:\Windows\System\Arowkaf.exe
  C:\Windows\System\Arowkaf.exe
  2⤵
  PID:7820
- C:\Windows\System\jGfmuKz.exe
  C:\Windows\System\jGfmuKz.exe
  2⤵
  PID:7836
- C:\Windows\System\OtgtrwR.exe
  C:\Windows\System\OtgtrwR.exe
  2⤵
  PID:7852
- C:\Windows\System\BZvSmgL.exe
  C:\Windows\System\BZvSmgL.exe
  2⤵
  PID:7880
- C:\Windows\System\fPTrxqv.exe
  C:\Windows\System\fPTrxqv.exe
  2⤵
  PID:7896
- C:\Windows\System\keyLqRC.exe
  C:\Windows\System\keyLqRC.exe
  2⤵
  PID:7920
- C:\Windows\System\OKilykS.exe
  C:\Windows\System\OKilykS.exe
  2⤵
  PID:7940
- C:\Windows\System\PdDxlIN.exe
  C:\Windows\System\PdDxlIN.exe
  2⤵
  PID:7956
- C:\Windows\System\KDUBPGa.exe
  C:\Windows\System\KDUBPGa.exe
  2⤵
  PID:7972
- C:\Windows\System\vWjJaWP.exe
  C:\Windows\System\vWjJaWP.exe
  2⤵
  PID:7988
- C:\Windows\System\rujJiDV.exe
  C:\Windows\System\rujJiDV.exe
  2⤵
  PID:8004
- C:\Windows\System\faLJeNy.exe
  C:\Windows\System\faLJeNy.exe
  2⤵
  PID:8024
- C:\Windows\System\cIsnwQk.exe
  C:\Windows\System\cIsnwQk.exe
  2⤵
  PID:8040
- C:\Windows\System\kmVdLUz.exe
  C:\Windows\System\kmVdLUz.exe
  2⤵
  PID:8056
- C:\Windows\System\VSISTLc.exe
  C:\Windows\System\VSISTLc.exe
  2⤵
  PID:8072
- C:\Windows\System\dBdXbbH.exe
  C:\Windows\System\dBdXbbH.exe
  2⤵
  PID:8088
- C:\Windows\System\fkTgsFN.exe
  C:\Windows\System\fkTgsFN.exe
  2⤵
  PID:8108
- C:\Windows\System\WVthGTr.exe
  C:\Windows\System\WVthGTr.exe
  2⤵
  PID:8124
- C:\Windows\System\KyyNUwF.exe
  C:\Windows\System\KyyNUwF.exe
  2⤵
  PID:8140
- C:\Windows\System\BAMcSxS.exe
  C:\Windows\System\BAMcSxS.exe
  2⤵
  PID:8156
- C:\Windows\System\tFkHrce.exe
  C:\Windows\System\tFkHrce.exe
  2⤵
  PID:8172
- C:\Windows\System\xAXzBum.exe
  C:\Windows\System\xAXzBum.exe
  2⤵
  PID:8188
- C:\Windows\System\rryTqbJ.exe
  C:\Windows\System\rryTqbJ.exe
  2⤵
  PID:7220
- C:\Windows\System\eyLbrSK.exe
  C:\Windows\System\eyLbrSK.exe
  2⤵
  PID:7284
- C:\Windows\System\UVbZkWm.exe
  C:\Windows\System\UVbZkWm.exe
  2⤵
  PID:7324
- C:\Windows\System\zSTrGcv.exe
  C:\Windows\System\zSTrGcv.exe
  2⤵
  PID:7088
- C:\Windows\System\tlDZVoc.exe
  C:\Windows\System\tlDZVoc.exe
  2⤵
  PID:5940
- C:\Windows\System\eWeGcoe.exe
  C:\Windows\System\eWeGcoe.exe
  2⤵
  PID:6884
- C:\Windows\System\OCrJvAF.exe
  C:\Windows\System\OCrJvAF.exe
  2⤵
  PID:7392
- C:\Windows\System\jCTghja.exe
  C:\Windows\System\jCTghja.exe
  2⤵
  PID:6624
- C:\Windows\System\rqtVskK.exe
  C:\Windows\System\rqtVskK.exe
  2⤵
  PID:7200
- C:\Windows\System\CXwvHgb.exe
  C:\Windows\System\CXwvHgb.exe
  2⤵
  PID:7236
- C:\Windows\System\BIvHMMV.exe
  C:\Windows\System\BIvHMMV.exe
  2⤵
  PID:7336
- C:\Windows\System\SotexCV.exe
  C:\Windows\System\SotexCV.exe
  2⤵
  PID:7408
- C:\Windows\System\fWXiFOT.exe
  C:\Windows\System\fWXiFOT.exe
  2⤵
  PID:7488
- C:\Windows\System\MWGxzNr.exe
  C:\Windows\System\MWGxzNr.exe
  2⤵
  PID:7556
- C:\Windows\System\VwXdvVv.exe
  C:\Windows\System\VwXdvVv.exe
  2⤵
  PID:7476
- C:\Windows\System\UbcsQJd.exe
  C:\Windows\System\UbcsQJd.exe
  2⤵
  PID:7540
- C:\Windows\System\mWPltyk.exe
  C:\Windows\System\mWPltyk.exe
  2⤵
  PID:7640
- C:\Windows\System\uvUdhKP.exe
  C:\Windows\System\uvUdhKP.exe
  2⤵
  PID:7740
- C:\Windows\System\KSJTJZW.exe
  C:\Windows\System\KSJTJZW.exe
  2⤵
  PID:7592
- C:\Windows\System\kpzIwPs.exe
  C:\Windows\System\kpzIwPs.exe
  2⤵
  PID:7660
- C:\Windows\System\lWxZTpJ.exe
  C:\Windows\System\lWxZTpJ.exe
  2⤵
  PID:7752
- C:\Windows\System\FLNTYld.exe
  C:\Windows\System\FLNTYld.exe
  2⤵
  PID:7792
- C:\Windows\System\TsjkRnN.exe
  C:\Windows\System\TsjkRnN.exe
  2⤵
  PID:7816
- C:\Windows\System\GODStWa.exe
  C:\Windows\System\GODStWa.exe
  2⤵
  PID:7848
- C:\Windows\System\VffTAYh.exe
  C:\Windows\System\VffTAYh.exe
  2⤵
  PID:7868
- C:\Windows\System\bsDJQyA.exe
  C:\Windows\System\bsDJQyA.exe
  2⤵
  PID:7892
- C:\Windows\System\bFxjOxh.exe
  C:\Windows\System\bFxjOxh.exe
  2⤵
  PID:8012
- C:\Windows\System\ohqxJFn.exe
  C:\Windows\System\ohqxJFn.exe
  2⤵
  PID:7948
- C:\Windows\System\RZESThu.exe
  C:\Windows\System\RZESThu.exe
  2⤵
  PID:7916
- C:\Windows\System\XyJoNcg.exe
  C:\Windows\System\XyJoNcg.exe
  2⤵
  PID:8084
- C:\Windows\System\YNZCOwj.exe
  C:\Windows\System\YNZCOwj.exe
  2⤵
  PID:7932
- C:\Windows\System\KENfaHD.exe
  C:\Windows\System\KENfaHD.exe
  2⤵
  PID:8000
- C:\Windows\System\aqwNGYN.exe
  C:\Windows\System\aqwNGYN.exe
  2⤵
  PID:8068
- C:\Windows\System\TTkgkwU.exe
  C:\Windows\System\TTkgkwU.exe
  2⤵
  PID:8132
- C:\Windows\System\VifKhFU.exe
  C:\Windows\System\VifKhFU.exe
  2⤵
  PID:8180
- C:\Windows\System\rNOMRir.exe
  C:\Windows\System\rNOMRir.exe
  2⤵
  PID:7156
- C:\Windows\System\loAuSNa.exe
  C:\Windows\System\loAuSNa.exe
  2⤵
  PID:7184
- C:\Windows\System\aOCXnvr.exe
  C:\Windows\System\aOCXnvr.exe
  2⤵
  PID:7232
- C:\Windows\System\JhGMzkz.exe
  C:\Windows\System\JhGMzkz.exe
  2⤵
  PID:7524
- C:\Windows\System\xNsUydp.exe
  C:\Windows\System\xNsUydp.exe
  2⤵
  PID:5884
- C:\Windows\System\jUbUYUK.exe
  C:\Windows\System\jUbUYUK.exe
  2⤵
  PID:7188
- C:\Windows\System\llLBnvC.exe
  C:\Windows\System\llLBnvC.exe
  2⤵
  PID:6848
- C:\Windows\System\yXYcBfd.exe
  C:\Windows\System\yXYcBfd.exe
  2⤵
  PID:7372
- C:\Windows\System\qXBiBVh.exe
  C:\Windows\System\qXBiBVh.exe
  2⤵
  PID:7444
- C:\Windows\System\TKfhfkr.exe
  C:\Windows\System\TKfhfkr.exe
  2⤵
  PID:7560
- C:\Windows\System\pjZkyFv.exe
  C:\Windows\System\pjZkyFv.exe
  2⤵
  PID:7676
- C:\Windows\System\DQkLGeE.exe
  C:\Windows\System\DQkLGeE.exe
  2⤵
  PID:7628
- C:\Windows\System\MuLSCOn.exe
  C:\Windows\System\MuLSCOn.exe
  2⤵
  PID:7772
- C:\Windows\System\zemUZRx.exe
  C:\Windows\System\zemUZRx.exe
  2⤵
  PID:7724
- C:\Windows\System\etDSrOU.exe
  C:\Windows\System\etDSrOU.exe
  2⤵
  PID:8152
- C:\Windows\System\LrdoaCs.exe
  C:\Windows\System\LrdoaCs.exe
  2⤵
  PID:8016
- C:\Windows\System\wGGIBdp.exe
  C:\Windows\System\wGGIBdp.exe
  2⤵
  PID:8100
- C:\Windows\System\KQjrymU.exe
  C:\Windows\System\KQjrymU.exe
  2⤵
  PID:7356
- C:\Windows\System\AsKFsTW.exe
  C:\Windows\System\AsKFsTW.exe
  2⤵
  PID:7508
- C:\Windows\System\YoIWQVY.exe
  C:\Windows\System\YoIWQVY.exe
  2⤵
  PID:7268
- C:\Windows\System\VNQphte.exe
  C:\Windows\System\VNQphte.exe
  2⤵
  PID:7256
- C:\Windows\System\Rfonuer.exe
  C:\Windows\System\Rfonuer.exe
  2⤵
  PID:7460
- C:\Windows\System\uOfWJTj.exe
  C:\Windows\System\uOfWJTj.exe
  2⤵
  PID:7116
- C:\Windows\System\aCfarUG.exe
  C:\Windows\System\aCfarUG.exe
  2⤵
  PID:2964
- C:\Windows\System\MEnzMxI.exe
  C:\Windows\System\MEnzMxI.exe
  2⤵
  PID:7844
- C:\Windows\System\aJkUXke.exe
  C:\Windows\System\aJkUXke.exe
  2⤵
  PID:7704
- C:\Windows\System\XWltMvF.exe
  C:\Windows\System\XWltMvF.exe
  2⤵
  PID:7864
- C:\Windows\System\CeiuqjR.exe
  C:\Windows\System\CeiuqjR.exe
  2⤵
  PID:7912
- C:\Windows\System\arrSzVj.exe
  C:\Windows\System\arrSzVj.exe
  2⤵
  PID:8064
- C:\Windows\System\licwuZb.exe
  C:\Windows\System\licwuZb.exe
  2⤵
  PID:7760
- C:\Windows\System\YyNYpOL.exe
  C:\Windows\System\YyNYpOL.exe
  2⤵
  PID:7812
- C:\Windows\System\gxIUWVg.exe
  C:\Windows\System\gxIUWVg.exe
  2⤵
  PID:7996
- C:\Windows\System\MgqJwDy.exe
  C:\Windows\System\MgqJwDy.exe
  2⤵
  PID:7908
- C:\Windows\System\ZQdzsJW.exe
  C:\Windows\System\ZQdzsJW.exe
  2⤵
  PID:7788
- C:\Windows\System\riSEbeJ.exe
  C:\Windows\System\riSEbeJ.exe
  2⤵
  PID:7300
- C:\Windows\System\QjZdChR.exe
  C:\Windows\System\QjZdChR.exe
  2⤵
  PID:8052
- C:\Windows\System\mExomSx.exe
  C:\Windows\System\mExomSx.exe
  2⤵
  PID:6472
- C:\Windows\System\STRcMye.exe
  C:\Windows\System\STRcMye.exe
  2⤵
  PID:7252
- C:\Windows\System\SfKteaN.exe
  C:\Windows\System\SfKteaN.exe
  2⤵
  PID:5360
- C:\Windows\System\sTXzPLP.exe
  C:\Windows\System\sTXzPLP.exe
  2⤵
  PID:8208
- C:\Windows\System\ovAAfrA.exe
  C:\Windows\System\ovAAfrA.exe
  2⤵
  PID:8224
- C:\Windows\System\CQfEtwT.exe
  C:\Windows\System\CQfEtwT.exe
  2⤵
  PID:8240
- C:\Windows\System\dBrHQPj.exe
  C:\Windows\System\dBrHQPj.exe
  2⤵
  PID:8256
- C:\Windows\System\hnywKOH.exe
  C:\Windows\System\hnywKOH.exe
  2⤵
  PID:8272
- C:\Windows\System\FDhkhTI.exe
  C:\Windows\System\FDhkhTI.exe
  2⤵
  PID:8288
- C:\Windows\System\ClFWLKO.exe
  C:\Windows\System\ClFWLKO.exe
  2⤵
  PID:8308
- C:\Windows\System\XApEOCo.exe
  C:\Windows\System\XApEOCo.exe
  2⤵
  PID:8324
- C:\Windows\System\yInsIdO.exe
  C:\Windows\System\yInsIdO.exe
  2⤵
  PID:8348
- C:\Windows\System\SYcHFCm.exe
  C:\Windows\System\SYcHFCm.exe
  2⤵
  PID:8372
- C:\Windows\System\hjwPBrk.exe
  C:\Windows\System\hjwPBrk.exe
  2⤵
  PID:8388
- C:\Windows\System\csFKmqI.exe
  C:\Windows\System\csFKmqI.exe
  2⤵
  PID:8404
- C:\Windows\System\WtjkUyK.exe
  C:\Windows\System\WtjkUyK.exe
  2⤵
  PID:8424
- C:\Windows\System\FukYzaQ.exe
  C:\Windows\System\FukYzaQ.exe
  2⤵
  PID:8440
- C:\Windows\System\KIjJxgM.exe
  C:\Windows\System\KIjJxgM.exe
  2⤵
  PID:8460
- C:\Windows\System\IIwXTHp.exe
  C:\Windows\System\IIwXTHp.exe
  2⤵
  PID:8476
- C:\Windows\System\grQurNP.exe
  C:\Windows\System\grQurNP.exe
  2⤵
  PID:8492
- C:\Windows\System\zhMVKqm.exe
  C:\Windows\System\zhMVKqm.exe
  2⤵
  PID:8512
- C:\Windows\System\PZraRbe.exe
  C:\Windows\System\PZraRbe.exe
  2⤵
  PID:8528
- C:\Windows\System\vMaRJHU.exe
  C:\Windows\System\vMaRJHU.exe
  2⤵
  PID:8544
- C:\Windows\System\SVrpiHX.exe
  C:\Windows\System\SVrpiHX.exe
  2⤵
  PID:8560
- C:\Windows\System\FnhKKrV.exe
  C:\Windows\System\FnhKKrV.exe
  2⤵
  PID:8576
- C:\Windows\System\PaNYeJG.exe
  C:\Windows\System\PaNYeJG.exe
  2⤵
  PID:8592
- C:\Windows\System\AYjLKaP.exe
  C:\Windows\System\AYjLKaP.exe
  2⤵
  PID:8608
- C:\Windows\System\YdigXjC.exe
  C:\Windows\System\YdigXjC.exe
  2⤵
  PID:8624
- C:\Windows\System\guXWByu.exe
  C:\Windows\System\guXWByu.exe
  2⤵
  PID:8640
- C:\Windows\System\yOoFeHg.exe
  C:\Windows\System\yOoFeHg.exe
  2⤵
  PID:8656
- C:\Windows\System\bkAzLZI.exe
  C:\Windows\System\bkAzLZI.exe
  2⤵
  PID:8680
- C:\Windows\System\yXVxwXE.exe
  C:\Windows\System\yXVxwXE.exe
  2⤵
  PID:8696
- C:\Windows\System\zpUabnr.exe
  C:\Windows\System\zpUabnr.exe
  2⤵
  PID:8720
- C:\Windows\System\EaEvujD.exe
  C:\Windows\System\EaEvujD.exe
  2⤵
  PID:8772
- C:\Windows\System\xfUGXwX.exe
  C:\Windows\System\xfUGXwX.exe
  2⤵
  PID:8792
- C:\Windows\System\eWEwuXI.exe
  C:\Windows\System\eWEwuXI.exe
  2⤵
  PID:8808
- C:\Windows\System\OCRWLYq.exe
  C:\Windows\System\OCRWLYq.exe
  2⤵
  PID:8824
- C:\Windows\System\dtHpWRs.exe
  C:\Windows\System\dtHpWRs.exe
  2⤵
  PID:8840
- C:\Windows\System\QqSTuPA.exe
  C:\Windows\System\QqSTuPA.exe
  2⤵
  PID:8856
- C:\Windows\System\cHSZeTU.exe
  C:\Windows\System\cHSZeTU.exe
  2⤵
  PID:8872
- C:\Windows\System\DGQbCVO.exe
  C:\Windows\System\DGQbCVO.exe
  2⤵
  PID:8888
- C:\Windows\System\PnPAsse.exe
  C:\Windows\System\PnPAsse.exe
  2⤵
  PID:8904
- C:\Windows\System\RDCPjEX.exe
  C:\Windows\System\RDCPjEX.exe
  2⤵
  PID:8920
- C:\Windows\System\zEZzpds.exe
  C:\Windows\System\zEZzpds.exe
  2⤵
  PID:8936
- C:\Windows\System\eoaHbLi.exe
  C:\Windows\System\eoaHbLi.exe
  2⤵
  PID:8952
- C:\Windows\System\KcUEpML.exe
  C:\Windows\System\KcUEpML.exe
  2⤵
  PID:8992
- C:\Windows\System\HCIeWmc.exe
  C:\Windows\System\HCIeWmc.exe
  2⤵
  PID:9008
- C:\Windows\System\tSFnueQ.exe
  C:\Windows\System\tSFnueQ.exe
  2⤵
  PID:9024
- C:\Windows\System\AXOawIC.exe
  C:\Windows\System\AXOawIC.exe
  2⤵
  PID:9040
- C:\Windows\System\YMfxSnv.exe
  C:\Windows\System\YMfxSnv.exe
  2⤵
  PID:9056
- C:\Windows\System\jmCPOIw.exe
  C:\Windows\System\jmCPOIw.exe
  2⤵
  PID:9072
- C:\Windows\System\cgWyDhQ.exe
  C:\Windows\System\cgWyDhQ.exe
  2⤵
  PID:9088
- C:\Windows\System\mcWdgox.exe
  C:\Windows\System\mcWdgox.exe
  2⤵
  PID:9104
- C:\Windows\System\GmAhkQE.exe
  C:\Windows\System\GmAhkQE.exe
  2⤵
  PID:9120
- C:\Windows\System\HoVcOrd.exe
  C:\Windows\System\HoVcOrd.exe
  2⤵
  PID:9136
- C:\Windows\System\oCDtYzk.exe
  C:\Windows\System\oCDtYzk.exe
  2⤵
  PID:9152
- C:\Windows\System\SPzKFSu.exe
  C:\Windows\System\SPzKFSu.exe
  2⤵
  PID:9168
- C:\Windows\System\JsSGmBy.exe
  C:\Windows\System\JsSGmBy.exe
  2⤵
  PID:9188
- C:\Windows\System\HAFYyjA.exe
  C:\Windows\System\HAFYyjA.exe
  2⤵
  PID:9212
- C:\Windows\System\rOwMxBw.exe
  C:\Windows\System\rOwMxBw.exe
  2⤵
  PID:8400
- C:\Windows\System\JYuPyHF.exe
  C:\Windows\System\JYuPyHF.exe
  2⤵
  PID:8436
- C:\Windows\System\TBpdVvc.exe
  C:\Windows\System\TBpdVvc.exe
  2⤵
  PID:8264
- C:\Windows\System\mPOwyLN.exe
  C:\Windows\System\mPOwyLN.exe
  2⤵
  PID:8304
- C:\Windows\System\rqyEbmh.exe
  C:\Windows\System\rqyEbmh.exe
  2⤵
  PID:8500
- C:\Windows\System\EvPVUfz.exe
  C:\Windows\System\EvPVUfz.exe
  2⤵
  PID:8540
- C:\Windows\System\JlijILs.exe
  C:\Windows\System\JlijILs.exe
  2⤵
  PID:8412
- C:\Windows\System\ihNBara.exe
  C:\Windows\System\ihNBara.exe
  2⤵
  PID:8636
- C:\Windows\System\BbDTXMD.exe
  C:\Windows\System\BbDTXMD.exe
  2⤵
  PID:8748
- C:\Windows\System\iTtGsMf.exe
  C:\Windows\System\iTtGsMf.exe
  2⤵
  PID:8756
- C:\Windows\System\yBApzei.exe
  C:\Windows\System\yBApzei.exe
  2⤵
  PID:8932
- C:\Windows\System\xodfbjZ.exe
  C:\Windows\System\xodfbjZ.exe
  2⤵
  PID:8864
- C:\Windows\System\ClfdXGX.exe
  C:\Windows\System\ClfdXGX.exe
  2⤵
  PID:8784
- C:\Windows\System\xvqhIIw.exe
  C:\Windows\System\xvqhIIw.exe
  2⤵
  PID:8948
- C:\Windows\System\BYfJbMV.exe
  C:\Windows\System\BYfJbMV.exe
  2⤵
  PID:8852
- C:\Windows\System\UnFCGyp.exe
  C:\Windows\System\UnFCGyp.exe
  2⤵
  PID:8944
- C:\Windows\System\abyeked.exe
  C:\Windows\System\abyeked.exe
  2⤵
  PID:8980
- C:\Windows\System\QtTZYlv.exe
  C:\Windows\System\QtTZYlv.exe
  2⤵
  PID:9016
- C:\Windows\System\BzEbdqW.exe
  C:\Windows\System\BzEbdqW.exe
  2⤵
  PID:9080
- C:\Windows\System\LMxJdlk.exe
  C:\Windows\System\LMxJdlk.exe
  2⤵
  PID:6248
- C:\Windows\System\hXNjORE.exe
  C:\Windows\System\hXNjORE.exe
  2⤵
  PID:9184
- C:\Windows\System\gTUbakE.exe
  C:\Windows\System\gTUbakE.exe
  2⤵
  PID:9144
- C:\Windows\System\GNKYYSR.exe
  C:\Windows\System\GNKYYSR.exe
  2⤵
  PID:8148
- C:\Windows\System\KrSESfR.exe
  C:\Windows\System\KrSESfR.exe
  2⤵
  PID:8248
- C:\Windows\System\nizSFwm.exe
  C:\Windows\System\nizSFwm.exe
  2⤵
  PID:8316
- C:\Windows\System\snwIeXR.exe
  C:\Windows\System\snwIeXR.exe
  2⤵
  PID:8384
- C:\Windows\System\JTPxiJl.exe
  C:\Windows\System\JTPxiJl.exe
  2⤵
  PID:8336
- C:\Windows\System\YqOMZEx.exe
  C:\Windows\System\YqOMZEx.exe
  2⤵
  PID:8396
- C:\Windows\System\QIyQBDC.exe
  C:\Windows\System\QIyQBDC.exe
  2⤵
  PID:8552
- C:\Windows\System\OqNmTlE.exe
  C:\Windows\System\OqNmTlE.exe
  2⤵
  PID:8616
- C:\Windows\System\nnxVikQ.exe
  C:\Windows\System\nnxVikQ.exe
  2⤵
  PID:8668
- C:\Windows\System\WLsJmcC.exe
  C:\Windows\System\WLsJmcC.exe
  2⤵
  PID:8728
- C:\Windows\System\moceWrM.exe
  C:\Windows\System\moceWrM.exe
  2⤵
  PID:9004
- C:\Windows\System\uKrLzSZ.exe
  C:\Windows\System\uKrLzSZ.exe
  2⤵
  PID:9200
- C:\Windows\System\DqLikNV.exe
  C:\Windows\System\DqLikNV.exe
  2⤵
  PID:8740
- C:\Windows\System\SryJnkr.exe
  C:\Windows\System\SryJnkr.exe
  2⤵
  PID:8804
- C:\Windows\System\jEDuhWW.exe
  C:\Windows\System\jEDuhWW.exe
  2⤵
  PID:8972
- C:\Windows\System\cawuOQT.exe
  C:\Windows\System\cawuOQT.exe
  2⤵
  PID:7964
- C:\Windows\System\MpsXpxt.exe
  C:\Windows\System\MpsXpxt.exe
  2⤵
  PID:8284
- C:\Windows\System\iYWORiE.exe
  C:\Windows\System\iYWORiE.exe
  2⤵
  PID:8676
- C:\Windows\System\dmctwRB.exe
  C:\Windows\System\dmctwRB.exe
  2⤵
  PID:8648
- C:\Windows\System\bkbyLvy.exe
  C:\Windows\System\bkbyLvy.exe
  2⤵
  PID:9220
- C:\Windows\System\zTdYHtl.exe
  C:\Windows\System\zTdYHtl.exe
  2⤵
  PID:9236
- C:\Windows\System\eFXrnQy.exe
  C:\Windows\System\eFXrnQy.exe
  2⤵
  PID:9256
- C:\Windows\System\RkKONIs.exe
  C:\Windows\System\RkKONIs.exe
  2⤵
  PID:9272
- C:\Windows\System\wmRhXXb.exe
  C:\Windows\System\wmRhXXb.exe
  2⤵
  PID:9288
- C:\Windows\System\dkqFIOg.exe
  C:\Windows\System\dkqFIOg.exe
  2⤵
  PID:9304
- C:\Windows\System\YcqGGnK.exe
  C:\Windows\System\YcqGGnK.exe
  2⤵
  PID:9320
- C:\Windows\System\KRhIhJJ.exe
  C:\Windows\System\KRhIhJJ.exe
  2⤵
  PID:9340
- C:\Windows\System\kzcdvqE.exe
  C:\Windows\System\kzcdvqE.exe
  2⤵
  PID:9356
- C:\Windows\System\fjTYLji.exe
  C:\Windows\System\fjTYLji.exe
  2⤵
  PID:9372
- C:\Windows\System\oReEdUo.exe
  C:\Windows\System\oReEdUo.exe
  2⤵
  PID:9396
- C:\Windows\System\COjnrUn.exe
  C:\Windows\System\COjnrUn.exe
  2⤵
  PID:9412
- C:\Windows\System\NyUsvNt.exe
  C:\Windows\System\NyUsvNt.exe
  2⤵
  PID:9496
- C:\Windows\System\dNXYOxR.exe
  C:\Windows\System\dNXYOxR.exe
  2⤵
  PID:9780
- C:\Windows\System\hXjwGor.exe
  C:\Windows\System\hXjwGor.exe
  2⤵
  PID:9796
- C:\Windows\System\FnEinxR.exe
  C:\Windows\System\FnEinxR.exe
  2⤵
  PID:9812
- C:\Windows\System\RjDOjHx.exe
  C:\Windows\System\RjDOjHx.exe
  2⤵
  PID:9828
- C:\Windows\System\eZhmRpJ.exe
  C:\Windows\System\eZhmRpJ.exe
  2⤵
  PID:9844
- C:\Windows\System\qJVDZeL.exe
  C:\Windows\System\qJVDZeL.exe
  2⤵
  PID:9860
- C:\Windows\System\KLlLsHD.exe
  C:\Windows\System\KLlLsHD.exe
  2⤵
  PID:9876
- C:\Windows\System\ZqnzwNe.exe
  C:\Windows\System\ZqnzwNe.exe
  2⤵
  PID:9892
- C:\Windows\System\UPkFfjT.exe
  C:\Windows\System\UPkFfjT.exe
  2⤵
  PID:9968
- C:\Windows\System\vMvwmrZ.exe
  C:\Windows\System\vMvwmrZ.exe
  2⤵
  PID:9984
- C:\Windows\System\gDINskW.exe
  C:\Windows\System\gDINskW.exe
  2⤵
  PID:10016
- C:\Windows\System\LLVvuSn.exe
  C:\Windows\System\LLVvuSn.exe
  2⤵
  PID:10032
- C:\Windows\System\sMWOQBJ.exe
  C:\Windows\System\sMWOQBJ.exe
  2⤵
  PID:10072
- C:\Windows\System\VDeIztX.exe
  C:\Windows\System\VDeIztX.exe
  2⤵
  PID:10104
- C:\Windows\System\vcMGrXg.exe
  C:\Windows\System\vcMGrXg.exe
  2⤵
  PID:10196
- C:\Windows\System\QJJMjfh.exe
  C:\Windows\System\QJJMjfh.exe
  2⤵
  PID:10212
- C:\Windows\System\BEOctBL.exe
  C:\Windows\System\BEOctBL.exe
  2⤵
  PID:10228
- C:\Windows\System\HdzIxtu.exe
  C:\Windows\System\HdzIxtu.exe
  2⤵
  PID:8820
- C:\Windows\System\WCblTbx.exe
  C:\Windows\System\WCblTbx.exe
  2⤵
  PID:8524
- C:\Windows\System\FJfeAFJ.exe
  C:\Windows\System\FJfeAFJ.exe
  2⤵
  PID:9232
- C:\Windows\System\nMiWHRN.exe
  C:\Windows\System\nMiWHRN.exe
  2⤵
  PID:9300
- C:\Windows\System\sOOsuZQ.exe
  C:\Windows\System\sOOsuZQ.exe
  2⤵
  PID:8344
- C:\Windows\System\oJGODzr.exe
  C:\Windows\System\oJGODzr.exe
  2⤵
  PID:8456
- C:\Windows\System\LvCHnix.exe
  C:\Windows\System\LvCHnix.exe
  2⤵
  PID:8200
- C:\Windows\System\bnJgjFn.exe
  C:\Windows\System\bnJgjFn.exe
  2⤵
  PID:9252
- C:\Windows\System\GlpDkKa.exe
  C:\Windows\System\GlpDkKa.exe
  2⤵
  PID:9352
- C:\Windows\System\UGzCdaF.exe
  C:\Windows\System\UGzCdaF.exe
  2⤵
  PID:9528
- C:\Windows\System\zwAKtDk.exe
  C:\Windows\System\zwAKtDk.exe
  2⤵
  PID:9560
- C:\Windows\System\ywBfsJR.exe
  C:\Windows\System\ywBfsJR.exe
  2⤵
  PID:9544
- C:\Windows\System\UFBqQyD.exe
  C:\Windows\System\UFBqQyD.exe
  2⤵
  PID:9580
- C:\Windows\System\ZIslzJx.exe
  C:\Windows\System\ZIslzJx.exe
  2⤵
  PID:9596
- C:\Windows\System\RLbkyMd.exe
  C:\Windows\System\RLbkyMd.exe
  2⤵
  PID:9616
- C:\Windows\System\QOtbiqv.exe
  C:\Windows\System\QOtbiqv.exe
  2⤵
  PID:9636
- C:\Windows\System\AzRsPIY.exe
  C:\Windows\System\AzRsPIY.exe
  2⤵
  PID:9652
- C:\Windows\System\hEJTcgj.exe
  C:\Windows\System\hEJTcgj.exe
  2⤵
  PID:9668
- C:\Windows\System\puiDkgj.exe
  C:\Windows\System\puiDkgj.exe
  2⤵
  PID:9684
- C:\Windows\System\QLlYZYQ.exe
  C:\Windows\System\QLlYZYQ.exe
  2⤵
  PID:9700
- C:\Windows\System\BLyoXcT.exe
  C:\Windows\System\BLyoXcT.exe
  2⤵
  PID:9756
- C:\Windows\System\vAjBaDs.exe
  C:\Windows\System\vAjBaDs.exe
  2⤵
  PID:9428
- C:\Windows\System\GekgkhR.exe
  C:\Windows\System\GekgkhR.exe
  2⤵
  PID:9464
- C:\Windows\System\JYATXNf.exe
  C:\Windows\System\JYATXNf.exe
  2⤵
  PID:9484
- C:\Windows\System\AYiVFHo.exe
  C:\Windows\System\AYiVFHo.exe
  2⤵
  PID:9824
- C:\Windows\System\evBCaZp.exe
  C:\Windows\System\evBCaZp.exe
  2⤵
  PID:9804
- C:\Windows\System\kfkTARj.exe
  C:\Windows\System\kfkTARj.exe
  2⤵
  PID:9900
- C:\Windows\System\dhLClfq.exe
  C:\Windows\System\dhLClfq.exe
  2⤵
  PID:9772
- C:\Windows\System\XtDUXCI.exe
  C:\Windows\System\XtDUXCI.exe
  2⤵
  PID:9920
- C:\Windows\System\tqmyMSi.exe
  C:\Windows\System\tqmyMSi.exe
  2⤵
  PID:9932
- C:\Windows\System\cabLpCF.exe
  C:\Windows\System\cabLpCF.exe
  2⤵
  PID:9956
- C:\Windows\System\mjsxIMl.exe
  C:\Windows\System\mjsxIMl.exe
  2⤵
  PID:9904
- C:\Windows\System\rkfNZHd.exe
  C:\Windows\System\rkfNZHd.exe
  2⤵
  PID:9992
- C:\Windows\System\nBnkDhf.exe
  C:\Windows\System\nBnkDhf.exe
  2⤵
  PID:9624
- C:\Windows\System\sXmAauH.exe
  C:\Windows\System\sXmAauH.exe
  2⤵
  PID:10088
- C:\Windows\System\ynQvzKi.exe
  C:\Windows\System\ynQvzKi.exe
  2⤵
  PID:10204
- C:\Windows\System\KcgNYIi.exe
  C:\Windows\System\KcgNYIi.exe
  2⤵
  PID:9228
- C:\Windows\System\HPbyyhg.exe
  C:\Windows\System\HPbyyhg.exe
  2⤵
  PID:10040
- C:\Windows\System\DPtTEnG.exe
  C:\Windows\System\DPtTEnG.exe
  2⤵
  PID:10060
- C:\Windows\System\HFebkFw.exe
  C:\Windows\System\HFebkFw.exe
  2⤵
  PID:10116
- C:\Windows\System\JqvJUdI.exe
  C:\Windows\System\JqvJUdI.exe
  2⤵
  PID:9364
- C:\Windows\System\bOcmSwM.exe
  C:\Windows\System\bOcmSwM.exe
  2⤵
  PID:10156
- C:\Windows\System\HtzOyRJ.exe
  C:\Windows\System\HtzOyRJ.exe
  2⤵
  PID:9408
- C:\Windows\System\QofEAWM.exe
  C:\Windows\System\QofEAWM.exe
  2⤵
  PID:9100
- C:\Windows\System\RkPXNxR.exe
  C:\Windows\System\RkPXNxR.exe
  2⤵
  PID:9296
- C:\Windows\System\dgcTrJF.exe
  C:\Windows\System\dgcTrJF.exe
  2⤵
  PID:9196
- C:\Windows\System\KECrjUl.exe
  C:\Windows\System\KECrjUl.exe
  2⤵
  PID:8604
- C:\Windows\System\JmJRAyE.exe
  C:\Windows\System\JmJRAyE.exe
  2⤵
  PID:8900
- C:\Windows\System\sTdoclX.exe
  C:\Windows\System\sTdoclX.exe
  2⤵
  PID:8780
- C:\Windows\System\USikEWO.exe
  C:\Windows\System\USikEWO.exe
  2⤵
  PID:9116
- C:\Windows\System\NoBWQqK.exe
  C:\Windows\System\NoBWQqK.exe
  2⤵
  PID:9504
- C:\Windows\System\zWISXyO.exe
  C:\Windows\System\zWISXyO.exe
  2⤵
  PID:8320
- C:\Windows\System\gvBcRDm.exe
  C:\Windows\System\gvBcRDm.exe
  2⤵
  PID:8536
- C:\Windows\System\FfNBDTG.exe
  C:\Windows\System\FfNBDTG.exe
  2⤵
  PID:8988
- C:\Windows\System\KlGBnvA.exe
  C:\Windows\System\KlGBnvA.exe
  2⤵
  PID:10160
- C:\Windows\System\GSxaMDN.exe
  C:\Windows\System\GSxaMDN.exe
  2⤵
  PID:10176
- C:\Windows\System\EKOGcDB.exe
  C:\Windows\System\EKOGcDB.exe
  2⤵
  PID:10224
- C:\Windows\System\EErMcBB.exe
  C:\Windows\System\EErMcBB.exe
  2⤵
  PID:9312
- C:\Windows\System\NPRLciJ.exe
  C:\Windows\System\NPRLciJ.exe
  2⤵
  PID:8556
- C:\Windows\System\bxpeLKe.exe
  C:\Windows\System\bxpeLKe.exe
  2⤵
  PID:9536
- C:\Windows\System\JkKKwWX.exe
  C:\Windows\System\JkKKwWX.exe
  2⤵
  PID:9576
- C:\Windows\System\jXIUpNa.exe
  C:\Windows\System\jXIUpNa.exe
  2⤵
  PID:9096
- C:\Windows\System\zASvmJm.exe
  C:\Windows\System\zASvmJm.exe
  2⤵
  PID:8340
- C:\Windows\System\FmxOiqo.exe
  C:\Windows\System\FmxOiqo.exe
  2⤵
  PID:9732
- C:\Windows\System\tbSTfqv.exe
  C:\Windows\System\tbSTfqv.exe
  2⤵
  PID:9248
- C:\Windows\System\IKyNEgI.exe
  C:\Windows\System\IKyNEgI.exe
  2⤵
  PID:9548
- C:\Windows\System\haziymz.exe
  C:\Windows\System\haziymz.exe
  2⤵
  PID:9524
- C:\Windows\System\YUGGnPY.exe
  C:\Windows\System\YUGGnPY.exe
  2⤵
  PID:9436
- C:\Windows\System\SFqqmhp.exe
  C:\Windows\System\SFqqmhp.exe
  2⤵
  PID:9820
- C:\Windows\System\arCmyUm.exe
  C:\Windows\System\arCmyUm.exe
  2⤵
  PID:9692
- C:\Windows\System\coCimvl.exe
  C:\Windows\System\coCimvl.exe
  2⤵
  PID:9424
- C:\Windows\System\AuSNLzd.exe
  C:\Windows\System\AuSNLzd.exe
  2⤵
  PID:9872
- C:\Windows\System\cxUzFrK.exe
  C:\Windows\System\cxUzFrK.exe
  2⤵
  PID:9912
- C:\Windows\System\IdRiJra.exe
  C:\Windows\System\IdRiJra.exe
  2⤵
  PID:9936
- C:\Windows\System\Klejtut.exe
  C:\Windows\System\Klejtut.exe
  2⤵
  PID:9952
- C:\Windows\System\EMpOejS.exe
  C:\Windows\System\EMpOejS.exe
  2⤵
  PID:9944
- C:\Windows\System\buEoAdX.exe
  C:\Windows\System\buEoAdX.exe
  2⤵
  PID:2188
- C:\Windows\System\dwqOmwB.exe
  C:\Windows\System\dwqOmwB.exe
  2⤵
  PID:10084
- C:\Windows\System\UcLeiSs.exe
  C:\Windows\System\UcLeiSs.exe
  2⤵
  PID:10056
- C:\Windows\System\JAToKkc.exe
  C:\Windows\System\JAToKkc.exe
  2⤵
  PID:8252
- C:\Windows\System\LinbiVT.exe
  C:\Windows\System\LinbiVT.exe
  2⤵
  PID:8752
- C:\Windows\System\yfTGjjW.exe
  C:\Windows\System\yfTGjjW.exe
  2⤵
  PID:9512
- C:\Windows\System\rZNAZxB.exe
  C:\Windows\System\rZNAZxB.exe
  2⤵
  PID:9064
- C:\Windows\System\jNFBTyG.exe
  C:\Windows\System\jNFBTyG.exe
  2⤵
  PID:10148
- C:\Windows\System\ANVGlCA.exe
  C:\Windows\System\ANVGlCA.exe
  2⤵
  PID:8916
- C:\Windows\System\KrqaqTv.exe
  C:\Windows\System\KrqaqTv.exe
  2⤵
  PID:8232
- C:\Windows\System\ZBnSGPc.exe
  C:\Windows\System\ZBnSGPc.exe
  2⤵
  PID:8688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DlbqtWY.exe

Filesize
1.7MB

MD5
ecde2e4add4fa2b14534194acf7d9aec

SHA1
8ad02ae067effe3091d28a23c05beab76b046618

SHA256
a550bec82bf180f45838350ede01d294f87bf1b1bf7fc848b382a59a370fa26f

SHA512
9c994f43043d46f53b06620d717d814321b40816750b20db6e7bcdd586e534b77ef2436426eddc9429178d59d7d6cfa738f82a27b95dc5b75b075b1a63e79e12

Download Submit
C:\Windows\system\GUWVHrR.exe

Filesize
1.7MB

MD5
a140a10623fcce498f0f698765b0dd70

SHA1
ee41be330f99d2fd3095eac1da54aaf332efb974

SHA256
93c604f784b4b2afd68b3f12d57b087f057d5580d873d9e0e43c18a239a803da

SHA512
e8ccd4d959577ba121c43518ea349c33bc9d24afc9072177c99c2c1e8d41362e19793c9c539dc1ed2db51010328968cea81217c37a5643e14242de88802e748e

Download Submit
C:\Windows\system\HoecwYB.exe

Filesize
1.7MB

MD5
c4fef761effd84fcfae7273963fabbfc

SHA1
3971478d8a002d1d5754d0c1b7a39f04bc2061a0

SHA256
626f8956ff566b0e0fee2eff98cf20882de61ea0bc2f0a474b71782272b68b11

SHA512
ce99b7de0fa2abef2324e5e0c74003dd5b5d9b0d86574138d441adc78f28ccf1b5b2b00682c2833bb655833cbfae949f6eb1f17ca97b07f591900158236128ef

Download Submit
C:\Windows\system\IrfhsoD.exe

Filesize
1.7MB

MD5
8b8d140935640d5ece4a55190973379c

SHA1
388843c487d5db529aa5feed9d1c601aed70656f

SHA256
5dec86a4d5a2ebda2254b6a9e21394acdd1357f2c1c74d093a2d6017d53548ff

SHA512
19d420b388b4be1f7327b5d770c7001112781d447416459e20210aee1a8290248f6df27aa219429fac5c3cc6d9d697100728c5cb7ae56e59104ddc26eb419288

Download Submit
C:\Windows\system\JsILSMA.exe

Filesize
1.7MB

MD5
d0de5ccdfdb107bf443bdc2518382663

SHA1
5b0728b387428b2a1d2c754d06790dae1906e855

SHA256
ff6c2e9c9e7d0b8b2ce7f9ec61cedf689c6a38c466c06cde6e0985a11c0b1661

SHA512
1ef7c3065acd7a66eadeb1ffcd1f697bead3c2e4b720479f880cd0b8d9f03638553b39ba6a9ec69f2f57ea218ee80bc606b2c21787d43bdba394ff508a70ad92

Download Submit
C:\Windows\system\KGeCmSc.exe

Filesize
1.7MB

MD5
6cab34cfc120194fb709220959d11403

SHA1
ff8fe4f931ebfbe5a243b87963c9dbcd280c5e17

SHA256
ce08102c2ec72f759fcd4f5c7d8420e71971459f59a5b4bfcd155949acde38f1

SHA512
7f8ea559977e174e12f2bb5b3ac588910f5c906fd6b75f1124a2f3a24e4842c0413c5c81147a1cea4c7f91ba52703f812a7e80c3ce5b5d5501adf9bfbbe64220

Download Submit
C:\Windows\system\LVqncsa.exe

Filesize
1.7MB

MD5
a359f2005e0400ffcc94de5d778f949b

SHA1
96c360b41bfb29c956b2081097e7772d9ba26ce0

SHA256
0e59a591d06fcff357cf2849f225105a0ddaa33cf500b9cac327ccd8da8c1e42

SHA512
d3e524958967cf3229a5669881b12f9843aaee90c080f40af9c4dde671498d91bda6c9150171767d306853e81fdf14577b9acf420d6e47d4fd7d00b83b33c4d7

Download Submit
C:\Windows\system\Lfprrpv.exe

Filesize
1.7MB

MD5
146978767a470bf60c13d5a7e673e833

SHA1
b9787eca75437a7a7ab2ded61d89bbfe995f35a5

SHA256
1d8f1cbb6ff76ee038bdfae0880fbfeef6d7222fd8ca7ff79375191cbf9c4796

SHA512
df39cfb9f0254a8a63f00aa513b20a3b8a70e2454b7d9e58f3219062d67596605166b0300fe86c238dd51a8c9739c65c87aebb29ae4482ea3c1804ccb86db668

Download Submit
C:\Windows\system\MXczXyE.exe

Filesize
1.6MB

MD5
b97dfed683c730e91a3692aa81ba5727

SHA1
b86319e4b7a0800728dc6d1d00f68be033ec73d8

SHA256
28ccfe4f58b9f2532a3ce9da930b073db742817680dcaef1997fe398d2535196

SHA512
f26a27b6690bc8dc16830865e625c338f367875af059774ea359b36847e014743fe0394a51a3fd0fb963e4fd117461eaf778c0dc3d59960e0bc5d6e4f224f784

Download Submit
C:\Windows\system\NgBogPM.exe

Filesize
1.7MB

MD5
7c6ee57b230305b001d65c98ab0c1f37

SHA1
5787d1b9fdc427fe20daf2f29987fc717569e917

SHA256
f2f68bee98343ff7983fa9ae7799695b82af36c2b37b63a2ed4c17ecf1abd631

SHA512
a29d2c6d29127a6aa6333a75ab93c7247e966ec6a2b120415d7a76b944a4a542b7278c759e7ce11302fa5affb5503d17ed5a5e452e861e894a28ef3b5ce6ffe1

Download Submit
C:\Windows\system\ODFxSjf.exe

Filesize
1.7MB

MD5
6c13b23327c1cc647156d36127254793

SHA1
0d0d6d564f2b3d948d583b6eb84fcfb183c84fac

SHA256
8d2cb5a26f255e7cefcb818d0029b866756099ee9d2eb1089691e7ce1de05675

SHA512
8bcb866660ddbf29b4a610d8d2514e9f0565d3422c0bfeb6bd29831e5f9c1837e39986c237acb6b5d25c30074e2fc82241bc16d082425a9ec983133dd3359d23

Download Submit
C:\Windows\system\SoRMaMg.exe

Filesize
1.7MB

MD5
5dd61b8c5593b183a6ed75bc044db871

SHA1
bb70bc509bef80fc02d6b0a3099451f9d5ad3334

SHA256
822a7185ac2d1c1fc978b927cfef26eab1204784e91dd6048848aa8c8e0bf53f

SHA512
60e869f2d98823f84a9cdca3cd26e52032b1950d4ad6711fb1a1796af2ed2326a432b921b785e658710518fa00d291d766260a5975da4303e151562cd41c8e84

Download Submit
C:\Windows\system\VuzcauA.exe

Filesize
1.7MB

MD5
9154e26cec4f082aef9c4ca58f612cdf

SHA1
e616abb620d4662c410e37f16c68374a8c52fa34

SHA256
1665eb90e3b7e5f96ec981d48fbdbf657ad0d7214196a43370a867476bc473a1

SHA512
01efec64109a07c1d624cdf3e9de6b59af4627071d0510ce15e5ce50cd1479a6c1ac19b700c9a6e7a863b2c512ad96203e35d9fdee3594e94d5fcf9c32b6e36a

Download Submit
C:\Windows\system\WwnaEEi.exe

Filesize
1.7MB

MD5
b357b9f48242a786709ea0169aa41b79

SHA1
7bb90d6917d9c91edc3262a39321faa61ffe312f

SHA256
f66d4fbecfe6943f6eba694fa486c8601be9eb9c31acefcf4a88375cc9badac8

SHA512
bd1b26d24a5a2813636403b32c813ab437998b233dd613d032bc4e39876e6a28889757155d236f10ffc70bf54e186a8efd9350d353073c6f0544926b96366258

Download Submit
C:\Windows\system\ZDeGJEn.exe

Filesize
1.7MB

MD5
c9ff9f1388fc3c9f92f41e2b8851059b

SHA1
2bcfc042bba5e23841e47b223714d21e16e47494

SHA256
35bb69cd8d21e772c354ba750824252bfef93954ccf10a516d4b388f31fddbfa

SHA512
aa15527fbe528490b49e676343821a619cc379e02036a0160f0691688e3497218c8640d6ae18486284540549a19388e3426b7f5d07fe72b3a99974cda1d0c851

Download Submit
C:\Windows\system\aUqlHWR.exe

Filesize
1.7MB

MD5
c15a5b8aaeb9eddae232a763ac6e48e3

SHA1
f81756932f616826df207fff0fd03d5547e5c0ba

SHA256
51fe67b251659686d54624c5e6c7d0e63249a54821a61ae0f43c1eef84762896

SHA512
4dca7f65297916e8f47bb7f6a9194d89faae4c42b15a835738da32caaeda970324c296b474538b17ba5b30972fe41b29442f2cc726d2a3f9fe19fe5c6abcce21

Download Submit
C:\Windows\system\dpQGXQo.exe

Filesize
1.7MB

MD5
87d21561948f7740ea11675d540ba0b3

SHA1
aca81c3ff92a1aef9ba6329955efd95c07f700ba

SHA256
4d516217e45003dafab65d7a254ac4883025c2850b99c044aa37e33773d1e560

SHA512
84d0fc5b891d3076ed11c18c738fc012fff7c7ae11b5c5ebdff6a9de49154f95b73285891627964ebbd47508230d783484a115c1a0879740766ad91251a93d48

Download Submit
C:\Windows\system\eaKiAhY.exe

Filesize
1.7MB

MD5
16c2fec5c629bdb92c92285b7a2d2296

SHA1
779d0c75cd705387765d2ccd5214aa9ac40a8eb0

SHA256
3e6c1a3183b2ca0f430709e6c7ffe646330f6daa41d6af8144b3eaccd176360d

SHA512
49e55e5be7109d2e03f30c0d6c4e60b1256c043f4d565611ae2d13d54bdacb90f90498305a4cbda9897edc32f8b15cb90ce1237e9be03f1e17bbebee82f3a43c

Download Submit
C:\Windows\system\eniAXoq.exe

Filesize
1.7MB

MD5
b9fefb8dc1d4c50d01b076225b6b0c00

SHA1
ccfdcccbec81c18da4146e5a84e6815d22361b98

SHA256
9c4f4bf32d3883a9a85147027cab51b0dde26642c1ec59e961627ee7a90fd4e7

SHA512
2fb83cb726feaea6344979cda75d12563f9017ef9dcac74669cc7e4c4b0e76688fa06b295053bc753c36ce5f11b298603a645b70630a3a6531de327176c39a16

Download Submit
C:\Windows\system\fQeWSJl.exe

Filesize
1.7MB

MD5
cafae8145edc12b0c0a3e93bc0bb6b63

SHA1
9b91447d25b93f89b420b52ac6442726e262ef4f

SHA256
e2fcf224e66168cdece0e40982bfa2469171022916a89be0e80ac0c27358d3d6

SHA512
2754d6f04db8c33cd41ac4b08d9ae02407cb34c1a3eb76963689f06a965316894714d04f95d4822aac8359a849d12739c62d9246d4f32edb551cea89481ea080

Download Submit
C:\Windows\system\gfbGTiz.exe

Filesize
1.7MB

MD5
b675e62ad896b421570e7a2d04ce68a0

SHA1
229a5915ef4bba4a2a99f83cf60b0d601b2e1cff

SHA256
05bd82e7dd42fa6940dce62ffdc90cb17b6f012255f38670219b4c7cef6fb31c

SHA512
09b30c4adaeae51b808f62d43a74ad3e35663a162cba2aecb82e0021d3142ab239228d91f81871a2f1235eef8c23a4e76b0d35e7a12098e329a9d831a4b16e2c

Download Submit
C:\Windows\system\iSgRYDg.exe

Filesize
1.7MB

MD5
e0a0f955b5cb84664ae7222b0377146a

SHA1
04f36bc38a2cfd65cf15f39ec7ad30e62b7f9fbc

SHA256
c7e218077c954f2325bee1ddc72a7661896d113804b9bc313bca89a82652c6fd

SHA512
9fe88f328d4ef99818470099e516c566e9ebf0ed1219832d200ec1ffd05bf7845d09259c3360771935bd963445a522d60567b521362d30ccd2cd44a92daad275

Download Submit
C:\Windows\system\inPYlIW.exe

Filesize
1.7MB

MD5
293fb4a7b25e1c626514dd08fee72611

SHA1
170f1c3a1822c0ae9a0dbe859c17f1c9cdd647f2

SHA256
34e3656bf32c28f21088b129129aa85747a16293af16f0e41c865af2dc83a61c

SHA512
9b53e2d078edaa7eb9d32fe9e0df576347c73b941eb5617e1986627bf3e67c547822538345d2a06ccd19d0bd344d78092d513da2e22cd1b3e645465a085f5410

Download Submit
C:\Windows\system\nelDgpM.exe

Filesize
1.7MB

MD5
57dde76d4237f5e8727a20bb7d083b6c

SHA1
4c0ab80c635388595d77271605f8f414e73fdcc1

SHA256
c5f332cd22c97fc71e841ecd79dcba914bb34e557f78983c627578541edd745f

SHA512
fa618bb56739cf562d96e159c0406ccb5b68bbcae6feccc1f0929e08ae15e39433e4276707f24fc89e4284dc0b787edb3b254ccc7b605badc8017e644f154e99

Download Submit
C:\Windows\system\oAShWmH.exe

Filesize
1.7MB

MD5
dc9d3dc5ac921b3a75200ba9637ed059

SHA1
c9c1b96909fd854f9a72ad3e8484b00609ecc138

SHA256
6cd7bea16f28f05cec0c6444cc92489155333348d1c75eacc2a765293127691f

SHA512
9496d62d70ffeaab8d1d98e2dd008dbe5846d74b9dd89aea125d5a252d7bab7b4fc852bf8190bc44a7b4a100e1f0e2cf1bd90632c771f414688e8525c1756d44

Download Submit
C:\Windows\system\qQyOCBg.exe

Filesize
1.7MB

MD5
a1774a661d44288b61cb42b5124767ad

SHA1
79e40d284ab325a5b30cd60e1fef1317d0577d1d

SHA256
855f0835f6f3c1c7dc50d45fda5989dcab10add37554f121e4030c439b1817e6

SHA512
e9bb6e726a7c0b5f2da5130439c447591d3fdc5d593763f3a50b79c57a69c149dbabbc71818937f0cf2240a9d5ecb53ffb9364ed6e2ea49aab3c7fc98f16ee80

Download Submit
C:\Windows\system\wESccKk.exe

Filesize
1.7MB

MD5
31cf5fdcee5ba48ca4938346a6bd8bd0

SHA1
785f5008439d0ad891c02f4774f48f824f736703

SHA256
b0d694f4bf87173dca617927c5eca4d8b05315f005f31c92bad3210b4c143554

SHA512
51a06b758c0743357194ebd2227605679b7f3556fc410e8d4a98f2e8cc2c97f95c16d4ac8dd272ed86d9b381812720db05fb9e4f15b50151a8cbc1416dc51ca3

Download Submit
C:\Windows\system\xvVhZGz.exe

Filesize
1.7MB

MD5
7652419659cee8cf4fffab51cfd6bffd

SHA1
2d98c9d6085877da146f3eb1fdb9a07e8174725f

SHA256
bc122232382a0c2087764d1a4c2b724c12a3be8ad19abc98c47e4494c431a552

SHA512
054aa6a14dd1d93c96f2d044dac0cefd2d7395f9069970338be8946ad698c3168866f00859e4ad578651ce884d92e262e88da12c06e99b86dcd941ae26368236

Download Submit
C:\Windows\system\yccafpK.exe

Filesize
1.7MB

MD5
1406c7cdd80b22773cf3f79e139874b6

SHA1
84cc212a79e346ec8ec9a942df1347193497c5a7

SHA256
f8394b1b2ad37446e16faa05d9ee25cb3988b5e88732a4411b9d66c168604634

SHA512
ba0cf5c42765fac87b91f3d225e0037e1abc02041bfa22d38da4a64fd7658f0b4cb323a4a6bc9a5597735438b95d957d5f9f8df1d7ce321d54028d170c6d0faa

Download Submit
C:\Windows\system\zKSvzyn.exe

Filesize
1.7MB

MD5
091b3d6956b5fcdca1148e48416f4d5a

SHA1
efb5dfc046d9f73115073b6cf31a566c2de42661

SHA256
e11b224ca9b9a1dae52b1ad4a3e40c3a1e51f9f10900eb4f2f417bf60259dc00

SHA512
7bf59f2f978659ff43f6ee47e8f03824e67f8e6e3911278d9f555415ccc1bedc6f72bc493eaab9a7e6745e3424f816962d91ddc146cd5aee758f7c5a942ec237

Download Submit
\Windows\system\IrfhsoD.exe

Filesize
1.2MB

MD5
6723b6af0b254116e08ead0637661cc7

SHA1
4b1d5c1d78ce0ddc08b594ab74199d18af98d628

SHA256
1a476694b9530d9307319b4d2dbb346bd30e6131d5d08d1f298a70dc578703b6

SHA512
c077cbaf30f43e386263db0584c8d7bfada04fb90f15bacb92313ac9e39b4c1ee4f5df786c19c8162f97984ef8a8ddd12ab2536258c7b23e13f700cdca079827

Download Submit
\Windows\system\MXczXyE.exe

Filesize
1.7MB

MD5
c3421a430b33da8e6790058b4298cb3d

SHA1
e2589bc4436b2064d9856be8e115d079a763a800

SHA256
96fab841ae7755801dffb506514d9f5c15face5d914128d7121308ebc393530b

SHA512
f23cc7ae9fd847b85d9f42f2c843b2929097e0faaaab6b8380f289c0ae0386da61e2633366f0945f6fa96734904e1ac8994260774e5e0583a9688f53f875813b

Download Submit
\Windows\system\TuBeXVc.exe

Filesize
1.7MB

MD5
2726f32639475a3afc6a0ebe08fc660f

SHA1
62c52e448edaae094cce08e2046ae9e16fbc3dff

SHA256
3ca5f5ee595976b1c8950e7842d35ca8fb47298f5c6e1a50c3a2da1971fea12b

SHA512
efa063633d05d1bb8c9da4744078bc3671e12cc2842171dc9f559203df21329e910e7762a2abbc261fd2add3aec2930922adc781d67b7c28b3f88611905edeaa

Download Submit
\Windows\system\gfbGTiz.exe

Filesize
1.1MB

MD5
a978c66280810bbe4171fd9248b29e22

SHA1
4af77bf15d85231e85da7adf8e27706a4f58548c

SHA256
ac6c85ac628af7426e6bd9501236d83a2eadea5db4484e86cf28455b6782228e

SHA512
528c2ea75da4e53440719ac4b504365f37103af2407f8ceacc03e90fb3dda9387ca23f9e734471fa0e1e8ab7966df8da444371708898287c00a441ff97e5e33a

Download Submit
\Windows\system\sOOgSnf.exe

Filesize
1.7MB

MD5
88d474f51587e91bd4c4b1425c28e107

SHA1
ac83b8631cdd31589c873c6308c4e9b3976a62fa

SHA256
5a23e3d623e89a5e6def843e8f335db1833e13ff2edd02fdfd88dc1642da0c69

SHA512
2e7718bdce773a55d8275a1537127168fd0454db42b196b8ce5419d158b1debc31090cfc2ef55b959d5d13fb6f0d99e54b1e9d3b897973a05c9493a17b14b0c7

Download Submit
\Windows\system\zKSvzyn.exe

Filesize
1.7MB

MD5
720388f822d9ae27372f27708f366a2c

SHA1
7c1564c8497c6e4f91eacff0a1907bfa85bde7b3

SHA256
8b26a7e35e4d08839658fe971f76493af3c6405f630409e71acf3d139e65f188

SHA512
f83c09cbbdc8c46fbf72dfd31e3fe9d82b7b456159435e4c754ba4a701eedad6e18dafc910ccdc811a9f98197da813d281dc4b9bf62b1b7bfcfaf7143f6141f9

Download Submit
memory/2024-115-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2024-4607-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-97-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2044-89-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-116-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2044-114-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2044-9004-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2044-9082-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/2044-0-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-94-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-8753-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2044-12-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2044-104-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/2044-99-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-84-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-86-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-92-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2168-54-0x00000000020D0000-0x00000000020D8000-memory.dmp

Filesize
32KB

Download
memory/2168-51-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/2168-96-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-24-0x000007FEF546E000-0x000007FEF546F000-memory.dmp

Filesize
4KB

Download
memory/2168-207-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-77-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-73-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp

Filesize
9.6MB

Download
memory/2168-70-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp

Filesize
9.6MB

Download
memory/2380-107-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2512-4612-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2512-98-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2564-4435-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2564-23-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2600-100-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-4605-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-85-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-4603-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-4598-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-95-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-4614-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2696-82-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2744-4615-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2744-88-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2792-4610-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2792-93-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-4601-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-91-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-105-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-4649-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download