xmrig | 159c3f53b8e7a6a5da05a12bc61a8269401f651d63101b3f72e3c808d2b0f138

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
Size

2.2MB
MD5

011e096d0169c5e3f167e1656f075c19
SHA1

f420ca0bfbfee82987a70bb6a87c85d385f36db3
SHA256

159c3f53b8e7a6a5da05a12bc61a8269401f651d63101b3f72e3c808d2b0f138
SHA512

513622da99ac3fbcc49c34471d1e2f3fa5e51be53a77467ff946cc927e8b61f66510fb677111c94bf6c949d91efc034e549d1fae446451fc35058844efabcf92
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//O:NABG

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2784-9-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2384-128-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2380-126-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/2852-124-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2680-122-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2612-120-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2340-118-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2440-116-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2568-114-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/2784-1370-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2852-1375-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2440-1382-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2340-1462-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2612-1467-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2380-1468-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/2568-1471-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/2680-1474-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2384-1446-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2784	LUbVdtg.exe
2568	dKCpaCl.exe
2440	UIVKJgw.exe
2340	QZzrTIk.exe
2612	ztwFjoF.exe
2680	bXyFKUH.exe
2852	luGPQEE.exe
2380	pTAjVDu.exe
2384	IIsrecG.exe
2796	SmBpKnM.exe
1884	xDnYOhY.exe
1300	ZEKYBod.exe
1364	nFKaJNR.exe
1284	buDULaM.exe
2188	bMHbtnS.exe
2700	vSJMSgF.exe
1636	cEJDtnY.exe
1928	XWTKJqb.exe
2652	PPIJpqo.exe
2812	wzZSMif.exe
2220	gdPeFvG.exe
2280	OmJQene.exe
2588	yXNSYXz.exe
2236	rKiQtNG.exe
2256	DiNlQQw.exe
780	ylQJSSl.exe
2136	xyULqoR.exe
2952	wmIGNnC.exe
3020	rNySgdi.exe
2084	imvVYCD.exe
308	MnNkMHR.exe
1544	eCKQErh.exe
1296	MTriZjM.exe
1796	wAJQBDy.exe
1612	VuGOMfv.exe
1656	wEqwkoh.exe
2044	LDdfKin.exe
1056	mKKqewz.exe
2024	rBkysSN.exe
916	nCweDhD.exe
2984	UjUYUzV.exe
2748	oeTjvZx.exe
2108	IUBuKyN.exe
2708	pxmIcim.exe
1672	FAAQbvB.exe
1572	PQQcejR.exe
2164	LijgZCM.exe
1136	YBunOag.exe
1308	ICcYDhK.exe
2092	JatGtNA.exe
2088	oLQJGmP.exe
2152	reeztvR.exe
2180	NvnxXud.exe
876	OSTeECs.exe
2556	oywKWOa.exe
2572	XpWIQVX.exe
2104	BAdUcRs.exe
2360	KbXHmBu.exe
2468	uKgdULK.exe
2996	vJfXBHq.exe
1916	EIERlAm.exe
2312	sSPYzgZ.exe
2808	lPlyRnR.exe
1340	JDWidNW.exe

Loads dropped DLL 64 IoCs

pid	Process
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2304-1-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/files/0x000b00000001560a-5.dat	upx
behavioral1/memory/2784-9-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/files/0x0029000000015c2f-14.dat	upx
behavioral1/files/0x000f0000000006fd-21.dat	upx
behavioral1/files/0x0008000000015c7c-26.dat	upx
behavioral1/files/0x0007000000015c87-28.dat	upx
behavioral1/files/0x0010000000015c3c-35.dat	upx
behavioral1/files/0x0007000000015cb9-40.dat	upx
behavioral1/files/0x00080000000165ae-45.dat	upx
behavioral1/files/0x0005000000018698-49.dat	upx
behavioral1/files/0x00050000000186a0-55.dat	upx
behavioral1/files/0x0006000000018ae2-56.dat	upx
behavioral1/files/0x0006000000018b15-69.dat	upx
behavioral1/files/0x0006000000018b96-134.dat	upx
behavioral1/files/0x00050000000192f4-149.dat	upx
behavioral1/files/0x0005000000019333-158.dat	upx
behavioral1/files/0x000500000001931b-153.dat	upx
behavioral1/files/0x0005000000019410-182.dat	upx
behavioral1/files/0x000500000001939b-176.dat	upx
behavioral1/files/0x000500000001946b-190.dat	upx
behavioral1/files/0x00050000000193b0-173.dat	upx
behavioral1/files/0x0005000000019377-166.dat	upx
behavioral1/files/0x0005000000019368-170.dat	upx
behavioral1/files/0x0006000000018d06-137.dat	upx
behavioral1/files/0x0006000000018b4a-92.dat	upx
behavioral1/files/0x00050000000192c9-142.dat	upx
behavioral1/files/0x0006000000018b6a-86.dat	upx
behavioral1/memory/2384-128-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2380-126-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/memory/2852-124-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2680-122-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/memory/2612-120-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2340-118-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/2440-116-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2568-114-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/files/0x0006000000018b42-110.dat	upx
behavioral1/files/0x0006000000018ba2-105.dat	upx
behavioral1/files/0x0006000000018b73-104.dat	upx
behavioral1/files/0x0006000000018b37-77.dat	upx
behavioral1/files/0x0006000000018b33-73.dat	upx
behavioral1/files/0x0006000000018ae8-66.dat	upx
behavioral1/memory/2784-1370-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/2852-1375-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2440-1382-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2340-1462-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/2612-1467-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2380-1468-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/memory/2568-1471-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/memory/2680-1474-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/memory/2384-1446-0x000000013F510000-0x000000013F902000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YHtqJxu.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\IHkPLie.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\UzrPARY.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\KAhZLPX.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\tWugDfV.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\qmwUwBh.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\BTNYUWH.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\WZIrpzR.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\iVSJhqO.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\lDUpnQy.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\fhUawCA.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\YEdnEnp.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\pYoSkNA.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\ACGpuqI.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\jxiwYAd.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\XWjzQxk.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\ZMcOaoA.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\zcIfGrL.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\dNLwsOe.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\QcJSBHP.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\SZWLSqd.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\UtNUqgw.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\CNHfvii.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\eONxYsW.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\aXaVpMx.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\SIotaEx.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\NPilDHM.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\vNCkngi.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\kFekAmm.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\BKVTpyR.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\weAXuYi.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\eTMVQEi.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\GmtTPFV.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\AqfbKPA.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\UlMbqUk.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\ffFcrPs.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\WBkPfzZ.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\kROXhsG.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\njLPcaT.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\UhwtRYM.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\MtABdXV.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\AKcbjMA.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\rBulTYu.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\junHnSC.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\XJjjbEJ.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\cIzogyR.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\VDJFHyJ.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\hOcJepa.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\bRHKPpU.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\ZEKYBod.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\JodkNWQ.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\FDnxnrT.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\ymkNxjT.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\HXMFKmc.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\YfyEqvs.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\rOhyZdQ.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\YNlzEBa.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\uCnkPNj.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\KiVGKkc.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\eEEQayX.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\BLqzXEN.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\osrJQyN.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\OyHraFx.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
File created	C:\Windows\System\DikCTTq.exe	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2872	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
Token: SeDebugPrivilege	2872	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2872	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	29
PID 2304 wrote to memory of 2872	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	29
PID 2304 wrote to memory of 2872	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	29
PID 2304 wrote to memory of 2784	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	30
PID 2304 wrote to memory of 2784	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	30
PID 2304 wrote to memory of 2784	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	30
PID 2304 wrote to memory of 2568	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	31
PID 2304 wrote to memory of 2568	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	31
PID 2304 wrote to memory of 2568	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	31
PID 2304 wrote to memory of 2440	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	32
PID 2304 wrote to memory of 2440	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	32
PID 2304 wrote to memory of 2440	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	32
PID 2304 wrote to memory of 2340	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	33
PID 2304 wrote to memory of 2340	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	33
PID 2304 wrote to memory of 2340	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	33
PID 2304 wrote to memory of 2612	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	34
PID 2304 wrote to memory of 2612	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	34
PID 2304 wrote to memory of 2612	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	34
PID 2304 wrote to memory of 2680	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	35
PID 2304 wrote to memory of 2680	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	35
PID 2304 wrote to memory of 2680	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	35
PID 2304 wrote to memory of 2852	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	36
PID 2304 wrote to memory of 2852	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	36
PID 2304 wrote to memory of 2852	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	36
PID 2304 wrote to memory of 2380	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	37
PID 2304 wrote to memory of 2380	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	37
PID 2304 wrote to memory of 2380	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	37
PID 2304 wrote to memory of 2384	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	38
PID 2304 wrote to memory of 2384	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	38
PID 2304 wrote to memory of 2384	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	38
PID 2304 wrote to memory of 2796	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	39
PID 2304 wrote to memory of 2796	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	39
PID 2304 wrote to memory of 2796	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	39
PID 2304 wrote to memory of 1884	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	40
PID 2304 wrote to memory of 1884	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	40
PID 2304 wrote to memory of 1884	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	40
PID 2304 wrote to memory of 1300	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	41
PID 2304 wrote to memory of 1300	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	41
PID 2304 wrote to memory of 1300	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	41
PID 2304 wrote to memory of 1364	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	42
PID 2304 wrote to memory of 1364	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	42
PID 2304 wrote to memory of 1364	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	42
PID 2304 wrote to memory of 1284	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	43
PID 2304 wrote to memory of 1284	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	43
PID 2304 wrote to memory of 1284	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	43
PID 2304 wrote to memory of 2188	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	44
PID 2304 wrote to memory of 2188	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	44
PID 2304 wrote to memory of 2188	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	44
PID 2304 wrote to memory of 2652	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	45
PID 2304 wrote to memory of 2652	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	45
PID 2304 wrote to memory of 2652	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	45
PID 2304 wrote to memory of 2700	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	46
PID 2304 wrote to memory of 2700	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	46
PID 2304 wrote to memory of 2700	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	46
PID 2304 wrote to memory of 2812	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	47
PID 2304 wrote to memory of 2812	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	47
PID 2304 wrote to memory of 2812	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	47
PID 2304 wrote to memory of 1636	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	48
PID 2304 wrote to memory of 1636	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	48
PID 2304 wrote to memory of 1636	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	48
PID 2304 wrote to memory of 2220	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	49
PID 2304 wrote to memory of 2220	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	49
PID 2304 wrote to memory of 2220	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	49
PID 2304 wrote to memory of 1928	2304	011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\011e096d0169c5e3f167e1656f075c19_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\System\LUbVdtg.exe
  C:\Windows\System\LUbVdtg.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\dKCpaCl.exe
  C:\Windows\System\dKCpaCl.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\UIVKJgw.exe
  C:\Windows\System\UIVKJgw.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\QZzrTIk.exe
  C:\Windows\System\QZzrTIk.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\ztwFjoF.exe
  C:\Windows\System\ztwFjoF.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\bXyFKUH.exe
  C:\Windows\System\bXyFKUH.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\luGPQEE.exe
  C:\Windows\System\luGPQEE.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\pTAjVDu.exe
  C:\Windows\System\pTAjVDu.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\IIsrecG.exe
  C:\Windows\System\IIsrecG.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\SmBpKnM.exe
  C:\Windows\System\SmBpKnM.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\xDnYOhY.exe
  C:\Windows\System\xDnYOhY.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\ZEKYBod.exe
  C:\Windows\System\ZEKYBod.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\nFKaJNR.exe
  C:\Windows\System\nFKaJNR.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\buDULaM.exe
  C:\Windows\System\buDULaM.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\bMHbtnS.exe
  C:\Windows\System\bMHbtnS.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\PPIJpqo.exe
  C:\Windows\System\PPIJpqo.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\vSJMSgF.exe
  C:\Windows\System\vSJMSgF.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\wzZSMif.exe
  C:\Windows\System\wzZSMif.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\cEJDtnY.exe
  C:\Windows\System\cEJDtnY.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\gdPeFvG.exe
  C:\Windows\System\gdPeFvG.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\XWTKJqb.exe
  C:\Windows\System\XWTKJqb.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\yXNSYXz.exe
  C:\Windows\System\yXNSYXz.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\OmJQene.exe
  C:\Windows\System\OmJQene.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\rKiQtNG.exe
  C:\Windows\System\rKiQtNG.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\DiNlQQw.exe
  C:\Windows\System\DiNlQQw.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\ylQJSSl.exe
  C:\Windows\System\ylQJSSl.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\xyULqoR.exe
  C:\Windows\System\xyULqoR.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\imvVYCD.exe
  C:\Windows\System\imvVYCD.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\wmIGNnC.exe
  C:\Windows\System\wmIGNnC.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\MnNkMHR.exe
  C:\Windows\System\MnNkMHR.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\rNySgdi.exe
  C:\Windows\System\rNySgdi.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\eCKQErh.exe
  C:\Windows\System\eCKQErh.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\MTriZjM.exe
  C:\Windows\System\MTriZjM.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\wAJQBDy.exe
  C:\Windows\System\wAJQBDy.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\VuGOMfv.exe
  C:\Windows\System\VuGOMfv.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\wEqwkoh.exe
  C:\Windows\System\wEqwkoh.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\LDdfKin.exe
  C:\Windows\System\LDdfKin.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\mKKqewz.exe
  C:\Windows\System\mKKqewz.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\rBkysSN.exe
  C:\Windows\System\rBkysSN.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\nCweDhD.exe
  C:\Windows\System\nCweDhD.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\UjUYUzV.exe
  C:\Windows\System\UjUYUzV.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\oeTjvZx.exe
  C:\Windows\System\oeTjvZx.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\IUBuKyN.exe
  C:\Windows\System\IUBuKyN.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\pxmIcim.exe
  C:\Windows\System\pxmIcim.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\FAAQbvB.exe
  C:\Windows\System\FAAQbvB.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\PQQcejR.exe
  C:\Windows\System\PQQcejR.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\LijgZCM.exe
  C:\Windows\System\LijgZCM.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\YBunOag.exe
  C:\Windows\System\YBunOag.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\ICcYDhK.exe
  C:\Windows\System\ICcYDhK.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\JatGtNA.exe
  C:\Windows\System\JatGtNA.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\oLQJGmP.exe
  C:\Windows\System\oLQJGmP.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\reeztvR.exe
  C:\Windows\System\reeztvR.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\NvnxXud.exe
  C:\Windows\System\NvnxXud.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\OSTeECs.exe
  C:\Windows\System\OSTeECs.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\oywKWOa.exe
  C:\Windows\System\oywKWOa.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\XpWIQVX.exe
  C:\Windows\System\XpWIQVX.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\BAdUcRs.exe
  C:\Windows\System\BAdUcRs.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\KbXHmBu.exe
  C:\Windows\System\KbXHmBu.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\uKgdULK.exe
  C:\Windows\System\uKgdULK.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\vJfXBHq.exe
  C:\Windows\System\vJfXBHq.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\EIERlAm.exe
  C:\Windows\System\EIERlAm.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\sSPYzgZ.exe
  C:\Windows\System\sSPYzgZ.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\lPlyRnR.exe
  C:\Windows\System\lPlyRnR.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\JDWidNW.exe
  C:\Windows\System\JDWidNW.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\bxLuQIu.exe
  C:\Windows\System\bxLuQIu.exe
  2⤵
  PID:2148
- C:\Windows\System\sfvmRyL.exe
  C:\Windows\System\sfvmRyL.exe
  2⤵
  PID:372
- C:\Windows\System\uVKdbBO.exe
  C:\Windows\System\uVKdbBO.exe
  2⤵
  PID:1956
- C:\Windows\System\ktAEtYQ.exe
  C:\Windows\System\ktAEtYQ.exe
  2⤵
  PID:2656
- C:\Windows\System\lslCFhn.exe
  C:\Windows\System\lslCFhn.exe
  2⤵
  PID:2252
- C:\Windows\System\fONmxXH.exe
  C:\Windows\System\fONmxXH.exe
  2⤵
  PID:652
- C:\Windows\System\sWUnLEU.exe
  C:\Windows\System\sWUnLEU.exe
  2⤵
  PID:1100
- C:\Windows\System\GQFGsDp.exe
  C:\Windows\System\GQFGsDp.exe
  2⤵
  PID:2408
- C:\Windows\System\diwirrc.exe
  C:\Windows\System\diwirrc.exe
  2⤵
  PID:1176
- C:\Windows\System\PwlNuyH.exe
  C:\Windows\System\PwlNuyH.exe
  2⤵
  PID:956
- C:\Windows\System\mkVKOWt.exe
  C:\Windows\System\mkVKOWt.exe
  2⤵
  PID:1540
- C:\Windows\System\rBhrOsp.exe
  C:\Windows\System\rBhrOsp.exe
  2⤵
  PID:1980
- C:\Windows\System\aXaVpMx.exe
  C:\Windows\System\aXaVpMx.exe
  2⤵
  PID:1952
- C:\Windows\System\nQBGaVy.exe
  C:\Windows\System\nQBGaVy.exe
  2⤵
  PID:1620
- C:\Windows\System\oYbDLOr.exe
  C:\Windows\System\oYbDLOr.exe
  2⤵
  PID:1388
- C:\Windows\System\tZnIgGE.exe
  C:\Windows\System\tZnIgGE.exe
  2⤵
  PID:864
- C:\Windows\System\nxsmeMM.exe
  C:\Windows\System\nxsmeMM.exe
  2⤵
  PID:2832
- C:\Windows\System\MmWHkNS.exe
  C:\Windows\System\MmWHkNS.exe
  2⤵
  PID:2740
- C:\Windows\System\uplzaKB.exe
  C:\Windows\System\uplzaKB.exe
  2⤵
  PID:1996
- C:\Windows\System\SemGSSh.exe
  C:\Windows\System\SemGSSh.exe
  2⤵
  PID:1640
- C:\Windows\System\QlTmXqc.exe
  C:\Windows\System\QlTmXqc.exe
  2⤵
  PID:2144
- C:\Windows\System\fMHkPLD.exe
  C:\Windows\System\fMHkPLD.exe
  2⤵
  PID:1404
- C:\Windows\System\OCTafOH.exe
  C:\Windows\System\OCTafOH.exe
  2⤵
  PID:584
- C:\Windows\System\ZEqapIf.exe
  C:\Windows\System\ZEqapIf.exe
  2⤵
  PID:2448
- C:\Windows\System\VAaLCFO.exe
  C:\Windows\System\VAaLCFO.exe
  2⤵
  PID:2744
- C:\Windows\System\VVZadmu.exe
  C:\Windows\System\VVZadmu.exe
  2⤵
  PID:1532
- C:\Windows\System\IiIukaL.exe
  C:\Windows\System\IiIukaL.exe
  2⤵
  PID:2840
- C:\Windows\System\xyaObRB.exe
  C:\Windows\System\xyaObRB.exe
  2⤵
  PID:984
- C:\Windows\System\FVpBDKz.exe
  C:\Windows\System\FVpBDKz.exe
  2⤵
  PID:1828
- C:\Windows\System\WWrkdgs.exe
  C:\Windows\System\WWrkdgs.exe
  2⤵
  PID:336
- C:\Windows\System\BsWLHlL.exe
  C:\Windows\System\BsWLHlL.exe
  2⤵
  PID:2060
- C:\Windows\System\DcUeQup.exe
  C:\Windows\System\DcUeQup.exe
  2⤵
  PID:2976
- C:\Windows\System\mogTYik.exe
  C:\Windows\System\mogTYik.exe
  2⤵
  PID:1752
- C:\Windows\System\IvMCoUn.exe
  C:\Windows\System\IvMCoUn.exe
  2⤵
  PID:860
- C:\Windows\System\fBKXKOp.exe
  C:\Windows\System\fBKXKOp.exe
  2⤵
  PID:1684
- C:\Windows\System\jwJZedz.exe
  C:\Windows\System\jwJZedz.exe
  2⤵
  PID:2300
- C:\Windows\System\qwzXXnO.exe
  C:\Windows\System\qwzXXnO.exe
  2⤵
  PID:2956
- C:\Windows\System\dcOLMfl.exe
  C:\Windows\System\dcOLMfl.exe
  2⤵
  PID:2600
- C:\Windows\System\jLBUcqO.exe
  C:\Windows\System\jLBUcqO.exe
  2⤵
  PID:2580
- C:\Windows\System\oPXxDBK.exe
  C:\Windows\System\oPXxDBK.exe
  2⤵
  PID:1172
- C:\Windows\System\mTMuWIn.exe
  C:\Windows\System\mTMuWIn.exe
  2⤵
  PID:636
- C:\Windows\System\SnPbWce.exe
  C:\Windows\System\SnPbWce.exe
  2⤵
  PID:2028
- C:\Windows\System\DkQrlLj.exe
  C:\Windows\System\DkQrlLj.exe
  2⤵
  PID:2432
- C:\Windows\System\MfNNDVK.exe
  C:\Windows\System\MfNNDVK.exe
  2⤵
  PID:3008
- C:\Windows\System\QCndccI.exe
  C:\Windows\System\QCndccI.exe
  2⤵
  PID:3056
- C:\Windows\System\AAhlPgL.exe
  C:\Windows\System\AAhlPgL.exe
  2⤵
  PID:2848
- C:\Windows\System\bFsErJY.exe
  C:\Windows\System\bFsErJY.exe
  2⤵
  PID:1560
- C:\Windows\System\jCRdkSF.exe
  C:\Windows\System\jCRdkSF.exe
  2⤵
  PID:1724
- C:\Windows\System\LlNqHZr.exe
  C:\Windows\System\LlNqHZr.exe
  2⤵
  PID:2204
- C:\Windows\System\pVEsBaq.exe
  C:\Windows\System\pVEsBaq.exe
  2⤵
  PID:2372
- C:\Windows\System\RkfyEPs.exe
  C:\Windows\System\RkfyEPs.exe
  2⤵
  PID:804
- C:\Windows\System\QyarCUC.exe
  C:\Windows\System\QyarCUC.exe
  2⤵
  PID:2264
- C:\Windows\System\EVYMBaA.exe
  C:\Windows\System\EVYMBaA.exe
  2⤵
  PID:2696
- C:\Windows\System\hTbggvH.exe
  C:\Windows\System\hTbggvH.exe
  2⤵
  PID:816
- C:\Windows\System\xoFXsIA.exe
  C:\Windows\System\xoFXsIA.exe
  2⤵
  PID:2940
- C:\Windows\System\YHtqJxu.exe
  C:\Windows\System\YHtqJxu.exe
  2⤵
  PID:2160
- C:\Windows\System\YwtoUFD.exe
  C:\Windows\System\YwtoUFD.exe
  2⤵
  PID:3060
- C:\Windows\System\iGBjfFA.exe
  C:\Windows\System\iGBjfFA.exe
  2⤵
  PID:1156
- C:\Windows\System\bwraSEO.exe
  C:\Windows\System\bwraSEO.exe
  2⤵
  PID:592
- C:\Windows\System\ovRuKcs.exe
  C:\Windows\System\ovRuKcs.exe
  2⤵
  PID:460
- C:\Windows\System\IYTpbZB.exe
  C:\Windows\System\IYTpbZB.exe
  2⤵
  PID:524
- C:\Windows\System\aqRrpzQ.exe
  C:\Windows\System\aqRrpzQ.exe
  2⤵
  PID:2880
- C:\Windows\System\NRucIco.exe
  C:\Windows\System\NRucIco.exe
  2⤵
  PID:2604
- C:\Windows\System\RYEPEcP.exe
  C:\Windows\System\RYEPEcP.exe
  2⤵
  PID:948
- C:\Windows\System\ZJhzPwW.exe
  C:\Windows\System\ZJhzPwW.exe
  2⤵
  PID:1204
- C:\Windows\System\zSNVNdA.exe
  C:\Windows\System\zSNVNdA.exe
  2⤵
  PID:2128
- C:\Windows\System\oAtDpaz.exe
  C:\Windows\System\oAtDpaz.exe
  2⤵
  PID:2576
- C:\Windows\System\xoohjux.exe
  C:\Windows\System\xoohjux.exe
  2⤵
  PID:708
- C:\Windows\System\HAXOJiP.exe
  C:\Windows\System\HAXOJiP.exe
  2⤵
  PID:1624
- C:\Windows\System\NLxHTMv.exe
  C:\Windows\System\NLxHTMv.exe
  2⤵
  PID:2540
- C:\Windows\System\ERIndOh.exe
  C:\Windows\System\ERIndOh.exe
  2⤵
  PID:2512
- C:\Windows\System\blyyUxU.exe
  C:\Windows\System\blyyUxU.exe
  2⤵
  PID:2844
- C:\Windows\System\rDfiTjW.exe
  C:\Windows\System\rDfiTjW.exe
  2⤵
  PID:2500
- C:\Windows\System\fvlgPtN.exe
  C:\Windows\System\fvlgPtN.exe
  2⤵
  PID:1712
- C:\Windows\System\TXIOPdc.exe
  C:\Windows\System\TXIOPdc.exe
  2⤵
  PID:1104
- C:\Windows\System\DJKWTye.exe
  C:\Windows\System\DJKWTye.exe
  2⤵
  PID:1784
- C:\Windows\System\RyLvPXr.exe
  C:\Windows\System\RyLvPXr.exe
  2⤵
  PID:1912
- C:\Windows\System\VWxoVwQ.exe
  C:\Windows\System\VWxoVwQ.exe
  2⤵
  PID:1644
- C:\Windows\System\keCXZvN.exe
  C:\Windows\System\keCXZvN.exe
  2⤵
  PID:3004
- C:\Windows\System\vAyRaOL.exe
  C:\Windows\System\vAyRaOL.exe
  2⤵
  PID:2732
- C:\Windows\System\FweguBT.exe
  C:\Windows\System\FweguBT.exe
  2⤵
  PID:1312
- C:\Windows\System\IikhFMA.exe
  C:\Windows\System\IikhFMA.exe
  2⤵
  PID:2452
- C:\Windows\System\anGyQxQ.exe
  C:\Windows\System\anGyQxQ.exe
  2⤵
  PID:1472
- C:\Windows\System\OejOfrU.exe
  C:\Windows\System\OejOfrU.exe
  2⤵
  PID:1604
- C:\Windows\System\miYYAKg.exe
  C:\Windows\System\miYYAKg.exe
  2⤵
  PID:2292
- C:\Windows\System\JdbynZf.exe
  C:\Windows\System\JdbynZf.exe
  2⤵
  PID:1192
- C:\Windows\System\wdAEfqF.exe
  C:\Windows\System\wdAEfqF.exe
  2⤵
  PID:2388
- C:\Windows\System\vbPevau.exe
  C:\Windows\System\vbPevau.exe
  2⤵
  PID:704
- C:\Windows\System\RdKwkAC.exe
  C:\Windows\System\RdKwkAC.exe
  2⤵
  PID:2308
- C:\Windows\System\TaqilJa.exe
  C:\Windows\System\TaqilJa.exe
  2⤵
  PID:1556
- C:\Windows\System\XbfHYSt.exe
  C:\Windows\System\XbfHYSt.exe
  2⤵
  PID:2508
- C:\Windows\System\KGozBxn.exe
  C:\Windows\System\KGozBxn.exe
  2⤵
  PID:2228
- C:\Windows\System\NOKWaNl.exe
  C:\Windows\System\NOKWaNl.exe
  2⤵
  PID:2272
- C:\Windows\System\xXAIFKn.exe
  C:\Windows\System\xXAIFKn.exe
  2⤵
  PID:2548
- C:\Windows\System\lJFsFbB.exe
  C:\Windows\System\lJFsFbB.exe
  2⤵
  PID:2792
- C:\Windows\System\hILqewU.exe
  C:\Windows\System\hILqewU.exe
  2⤵
  PID:2268
- C:\Windows\System\XvkUiWe.exe
  C:\Windows\System\XvkUiWe.exe
  2⤵
  PID:1116
- C:\Windows\System\SWsmmQk.exe
  C:\Windows\System\SWsmmQk.exe
  2⤵
  PID:2804
- C:\Windows\System\FgvxZUV.exe
  C:\Windows\System\FgvxZUV.exe
  2⤵
  PID:580
- C:\Windows\System\fbZmMra.exe
  C:\Windows\System\fbZmMra.exe
  2⤵
  PID:468
- C:\Windows\System\aLtKmns.exe
  C:\Windows\System\aLtKmns.exe
  2⤵
  PID:2592
- C:\Windows\System\yVgkCsw.exe
  C:\Windows\System\yVgkCsw.exe
  2⤵
  PID:2012
- C:\Windows\System\MAMWUqz.exe
  C:\Windows\System\MAMWUqz.exe
  2⤵
  PID:964
- C:\Windows\System\shOjYBk.exe
  C:\Windows\System\shOjYBk.exe
  2⤵
  PID:2284
- C:\Windows\System\luiPgDF.exe
  C:\Windows\System\luiPgDF.exe
  2⤵
  PID:2964
- C:\Windows\System\wQfAuSF.exe
  C:\Windows\System\wQfAuSF.exe
  2⤵
  PID:1680
- C:\Windows\System\xRTXxyQ.exe
  C:\Windows\System\xRTXxyQ.exe
  2⤵
  PID:3080
- C:\Windows\System\UdVamtg.exe
  C:\Windows\System\UdVamtg.exe
  2⤵
  PID:3096
- C:\Windows\System\XCqbqFV.exe
  C:\Windows\System\XCqbqFV.exe
  2⤵
  PID:3116
- C:\Windows\System\jrRdLmm.exe
  C:\Windows\System\jrRdLmm.exe
  2⤵
  PID:3132
- C:\Windows\System\JvtcIyE.exe
  C:\Windows\System\JvtcIyE.exe
  2⤵
  PID:3148
- C:\Windows\System\DMMlwRe.exe
  C:\Windows\System\DMMlwRe.exe
  2⤵
  PID:3164
- C:\Windows\System\EjtwDfQ.exe
  C:\Windows\System\EjtwDfQ.exe
  2⤵
  PID:3244
- C:\Windows\System\RCMbYqT.exe
  C:\Windows\System\RCMbYqT.exe
  2⤵
  PID:3260
- C:\Windows\System\SzuyyHH.exe
  C:\Windows\System\SzuyyHH.exe
  2⤵
  PID:3280
- C:\Windows\System\qOkEqdj.exe
  C:\Windows\System\qOkEqdj.exe
  2⤵
  PID:3304
- C:\Windows\System\EAhRYNh.exe
  C:\Windows\System\EAhRYNh.exe
  2⤵
  PID:3320
- C:\Windows\System\HvoqfNp.exe
  C:\Windows\System\HvoqfNp.exe
  2⤵
  PID:3336
- C:\Windows\System\ItVXiGC.exe
  C:\Windows\System\ItVXiGC.exe
  2⤵
  PID:3352
- C:\Windows\System\qjtTgdN.exe
  C:\Windows\System\qjtTgdN.exe
  2⤵
  PID:3376
- C:\Windows\System\VuEjsym.exe
  C:\Windows\System\VuEjsym.exe
  2⤵
  PID:3392
- C:\Windows\System\KuKtSHd.exe
  C:\Windows\System\KuKtSHd.exe
  2⤵
  PID:3420
- C:\Windows\System\HDkKEUA.exe
  C:\Windows\System\HDkKEUA.exe
  2⤵
  PID:3436
- C:\Windows\System\uUjdebe.exe
  C:\Windows\System\uUjdebe.exe
  2⤵
  PID:3460
- C:\Windows\System\olKkIJL.exe
  C:\Windows\System\olKkIJL.exe
  2⤵
  PID:3480
- C:\Windows\System\SxNlkUE.exe
  C:\Windows\System\SxNlkUE.exe
  2⤵
  PID:3496
- C:\Windows\System\ACGpuqI.exe
  C:\Windows\System\ACGpuqI.exe
  2⤵
  PID:3512
- C:\Windows\System\oLvKEGf.exe
  C:\Windows\System\oLvKEGf.exe
  2⤵
  PID:3528
- C:\Windows\System\gYmRGtt.exe
  C:\Windows\System\gYmRGtt.exe
  2⤵
  PID:3548
- C:\Windows\System\hiPSTbb.exe
  C:\Windows\System\hiPSTbb.exe
  2⤵
  PID:3564
- C:\Windows\System\ycsCVRX.exe
  C:\Windows\System\ycsCVRX.exe
  2⤵
  PID:3608
- C:\Windows\System\ILGrJVO.exe
  C:\Windows\System\ILGrJVO.exe
  2⤵
  PID:3624
- C:\Windows\System\QidziSO.exe
  C:\Windows\System\QidziSO.exe
  2⤵
  PID:3640
- C:\Windows\System\doZMJRg.exe
  C:\Windows\System\doZMJRg.exe
  2⤵
  PID:3656
- C:\Windows\System\mIagTtj.exe
  C:\Windows\System\mIagTtj.exe
  2⤵
  PID:3672
- C:\Windows\System\DYbkGOd.exe
  C:\Windows\System\DYbkGOd.exe
  2⤵
  PID:3692
- C:\Windows\System\jzVNOIo.exe
  C:\Windows\System\jzVNOIo.exe
  2⤵
  PID:3724
- C:\Windows\System\TrexPDu.exe
  C:\Windows\System\TrexPDu.exe
  2⤵
  PID:3740
- C:\Windows\System\fmAxvoS.exe
  C:\Windows\System\fmAxvoS.exe
  2⤵
  PID:3768
- C:\Windows\System\ckqhjIM.exe
  C:\Windows\System\ckqhjIM.exe
  2⤵
  PID:3784
- C:\Windows\System\UmNiqZs.exe
  C:\Windows\System\UmNiqZs.exe
  2⤵
  PID:3800
- C:\Windows\System\lHgjTBz.exe
  C:\Windows\System\lHgjTBz.exe
  2⤵
  PID:3816
- C:\Windows\System\xAMMisL.exe
  C:\Windows\System\xAMMisL.exe
  2⤵
  PID:3836
- C:\Windows\System\YpqFRgJ.exe
  C:\Windows\System\YpqFRgJ.exe
  2⤵
  PID:3852
- C:\Windows\System\oeTitzT.exe
  C:\Windows\System\oeTitzT.exe
  2⤵
  PID:3868
- C:\Windows\System\fvKqxeg.exe
  C:\Windows\System\fvKqxeg.exe
  2⤵
  PID:3888
- C:\Windows\System\XWrPsKD.exe
  C:\Windows\System\XWrPsKD.exe
  2⤵
  PID:3908
- C:\Windows\System\EdHDQBD.exe
  C:\Windows\System\EdHDQBD.exe
  2⤵
  PID:3924
- C:\Windows\System\mTCBOMD.exe
  C:\Windows\System\mTCBOMD.exe
  2⤵
  PID:3940
- C:\Windows\System\pAisJMt.exe
  C:\Windows\System\pAisJMt.exe
  2⤵
  PID:3960
- C:\Windows\System\IXfWeEs.exe
  C:\Windows\System\IXfWeEs.exe
  2⤵
  PID:3976
- C:\Windows\System\IfBwSnf.exe
  C:\Windows\System\IfBwSnf.exe
  2⤵
  PID:4028
- C:\Windows\System\TlEamDJ.exe
  C:\Windows\System\TlEamDJ.exe
  2⤵
  PID:4048
- C:\Windows\System\UlMbqUk.exe
  C:\Windows\System\UlMbqUk.exe
  2⤵
  PID:4064
- C:\Windows\System\txIqayY.exe
  C:\Windows\System\txIqayY.exe
  2⤵
  PID:4080
- C:\Windows\System\RxxMDyu.exe
  C:\Windows\System\RxxMDyu.exe
  2⤵
  PID:2436
- C:\Windows\System\cfnxjHz.exe
  C:\Windows\System\cfnxjHz.exe
  2⤵
  PID:3012
- C:\Windows\System\CUkFBRf.exe
  C:\Windows\System\CUkFBRf.exe
  2⤵
  PID:564
- C:\Windows\System\GhSeTev.exe
  C:\Windows\System\GhSeTev.exe
  2⤵
  PID:672
- C:\Windows\System\SRGohNt.exe
  C:\Windows\System\SRGohNt.exe
  2⤵
  PID:1688
- C:\Windows\System\EybZxck.exe
  C:\Windows\System\EybZxck.exe
  2⤵
  PID:2620
- C:\Windows\System\lCdEoUr.exe
  C:\Windows\System\lCdEoUr.exe
  2⤵
  PID:3128
- C:\Windows\System\OwMRmhU.exe
  C:\Windows\System\OwMRmhU.exe
  2⤵
  PID:2684
- C:\Windows\System\lxtnpma.exe
  C:\Windows\System\lxtnpma.exe
  2⤵
  PID:1904
- C:\Windows\System\djHvymQ.exe
  C:\Windows\System\djHvymQ.exe
  2⤵
  PID:2672
- C:\Windows\System\ghtZkWH.exe
  C:\Windows\System\ghtZkWH.exe
  2⤵
  PID:3144
- C:\Windows\System\jxiwYAd.exe
  C:\Windows\System\jxiwYAd.exe
  2⤵
  PID:3104
- C:\Windows\System\sRmyvoU.exe
  C:\Windows\System\sRmyvoU.exe
  2⤵
  PID:3192
- C:\Windows\System\ajHlGPc.exe
  C:\Windows\System\ajHlGPc.exe
  2⤵
  PID:3228
- C:\Windows\System\OPRAoPr.exe
  C:\Windows\System\OPRAoPr.exe
  2⤵
  PID:3272
- C:\Windows\System\jXqQncA.exe
  C:\Windows\System\jXqQncA.exe
  2⤵
  PID:3344
- C:\Windows\System\XxJroSi.exe
  C:\Windows\System\XxJroSi.exe
  2⤵
  PID:3444
- C:\Windows\System\NPycPoV.exe
  C:\Windows\System\NPycPoV.exe
  2⤵
  PID:3432
- C:\Windows\System\TJbOfSZ.exe
  C:\Windows\System\TJbOfSZ.exe
  2⤵
  PID:3520
- C:\Windows\System\hkTBhow.exe
  C:\Windows\System\hkTBhow.exe
  2⤵
  PID:3560
- C:\Windows\System\tjxQSbV.exe
  C:\Windows\System\tjxQSbV.exe
  2⤵
  PID:3508
- C:\Windows\System\yZfSCqj.exe
  C:\Windows\System\yZfSCqj.exe
  2⤵
  PID:3580
- C:\Windows\System\gHxtQua.exe
  C:\Windows\System\gHxtQua.exe
  2⤵
  PID:3604
- C:\Windows\System\iPxYDqw.exe
  C:\Windows\System\iPxYDqw.exe
  2⤵
  PID:3632
- C:\Windows\System\CVNIzIx.exe
  C:\Windows\System\CVNIzIx.exe
  2⤵
  PID:3712
- C:\Windows\System\qQPAdPS.exe
  C:\Windows\System\qQPAdPS.exe
  2⤵
  PID:3752
- C:\Windows\System\lylYGMh.exe
  C:\Windows\System\lylYGMh.exe
  2⤵
  PID:3808
- C:\Windows\System\AVwzgqR.exe
  C:\Windows\System\AVwzgqR.exe
  2⤵
  PID:3848
- C:\Windows\System\bzlGQAC.exe
  C:\Windows\System\bzlGQAC.exe
  2⤵
  PID:3916
- C:\Windows\System\XkaPDwy.exe
  C:\Windows\System\XkaPDwy.exe
  2⤵
  PID:3992
- C:\Windows\System\eTdKyhV.exe
  C:\Windows\System\eTdKyhV.exe
  2⤵
  PID:3824
- C:\Windows\System\fkgUZvh.exe
  C:\Windows\System\fkgUZvh.exe
  2⤵
  PID:3932
- C:\Windows\System\pVPsaKJ.exe
  C:\Windows\System\pVPsaKJ.exe
  2⤵
  PID:3988
- C:\Windows\System\vnactpE.exe
  C:\Windows\System\vnactpE.exe
  2⤵
  PID:3756
- C:\Windows\System\MfwkCFo.exe
  C:\Windows\System\MfwkCFo.exe
  2⤵
  PID:2392
- C:\Windows\System\cCcjMJd.exe
  C:\Windows\System\cCcjMJd.exe
  2⤵
  PID:3112
- C:\Windows\System\yKPrKze.exe
  C:\Windows\System\yKPrKze.exe
  2⤵
  PID:1648
- C:\Windows\System\tSSyMTi.exe
  C:\Windows\System\tSSyMTi.exe
  2⤵
  PID:2216
- C:\Windows\System\AfmdyMR.exe
  C:\Windows\System\AfmdyMR.exe
  2⤵
  PID:3124
- C:\Windows\System\XJjjbEJ.exe
  C:\Windows\System\XJjjbEJ.exe
  2⤵
  PID:2056
- C:\Windows\System\BtacqAg.exe
  C:\Windows\System\BtacqAg.exe
  2⤵
  PID:1748
- C:\Windows\System\wYYzilw.exe
  C:\Windows\System\wYYzilw.exe
  2⤵
  PID:3256
- C:\Windows\System\WInuTsS.exe
  C:\Windows\System\WInuTsS.exe
  2⤵
  PID:3292
- C:\Windows\System\qmwUwBh.exe
  C:\Windows\System\qmwUwBh.exe
  2⤵
  PID:628
- C:\Windows\System\vQaJKzZ.exe
  C:\Windows\System\vQaJKzZ.exe
  2⤵
  PID:3300
- C:\Windows\System\RDhlmrY.exe
  C:\Windows\System\RDhlmrY.exe
  2⤵
  PID:3360
- C:\Windows\System\ucvzfjh.exe
  C:\Windows\System\ucvzfjh.exe
  2⤵
  PID:3400
- C:\Windows\System\zHsBcqr.exe
  C:\Windows\System\zHsBcqr.exe
  2⤵
  PID:3588
- C:\Windows\System\fvlEXcq.exe
  C:\Windows\System\fvlEXcq.exe
  2⤵
  PID:3700
- C:\Windows\System\WgnoLub.exe
  C:\Windows\System\WgnoLub.exe
  2⤵
  PID:3680
- C:\Windows\System\OHWpdnf.exe
  C:\Windows\System\OHWpdnf.exe
  2⤵
  PID:3668
- C:\Windows\System\nlTsKrG.exe
  C:\Windows\System\nlTsKrG.exe
  2⤵
  PID:3544
- C:\Windows\System\ELDuJil.exe
  C:\Windows\System\ELDuJil.exe
  2⤵
  PID:3540
- C:\Windows\System\KbPJkHk.exe
  C:\Windows\System\KbPJkHk.exe
  2⤵
  PID:3736
- C:\Windows\System\uRdRlHH.exe
  C:\Windows\System\uRdRlHH.exe
  2⤵
  PID:3792
- C:\Windows\System\PiRWdvn.exe
  C:\Windows\System\PiRWdvn.exe
  2⤵
  PID:3884
- C:\Windows\System\XkVDsAL.exe
  C:\Windows\System\XkVDsAL.exe
  2⤵
  PID:3948
- C:\Windows\System\DyUjJax.exe
  C:\Windows\System\DyUjJax.exe
  2⤵
  PID:3764
- C:\Windows\System\LHAXsDO.exe
  C:\Windows\System\LHAXsDO.exe
  2⤵
  PID:1716
- C:\Windows\System\xJRBmub.exe
  C:\Windows\System\xJRBmub.exe
  2⤵
  PID:1704
- C:\Windows\System\ZIQgTzo.exe
  C:\Windows\System\ZIQgTzo.exe
  2⤵
  PID:3208
- C:\Windows\System\WMhHjke.exe
  C:\Windows\System\WMhHjke.exe
  2⤵
  PID:3372
- C:\Windows\System\qwzuuhB.exe
  C:\Windows\System\qwzuuhB.exe
  2⤵
  PID:3596
- C:\Windows\System\HkRfpkr.exe
  C:\Windows\System\HkRfpkr.exe
  2⤵
  PID:3780
- C:\Windows\System\iDthhgZ.exe
  C:\Windows\System\iDthhgZ.exe
  2⤵
  PID:3984
- C:\Windows\System\AiGniPz.exe
  C:\Windows\System\AiGniPz.exe
  2⤵
  PID:3408
- C:\Windows\System\xbWdhlc.exe
  C:\Windows\System\xbWdhlc.exe
  2⤵
  PID:3880
- C:\Windows\System\hNJvQFi.exe
  C:\Windows\System\hNJvQFi.exe
  2⤵
  PID:2916
- C:\Windows\System\mmOgOmJ.exe
  C:\Windows\System\mmOgOmJ.exe
  2⤵
  PID:3488
- C:\Windows\System\YkAbvaf.exe
  C:\Windows\System\YkAbvaf.exe
  2⤵
  PID:3288
- C:\Windows\System\jQmVgrE.exe
  C:\Windows\System\jQmVgrE.exe
  2⤵
  PID:3076
- C:\Windows\System\fuCEpWB.exe
  C:\Windows\System\fuCEpWB.exe
  2⤵
  PID:1772
- C:\Windows\System\sqjhaHy.exe
  C:\Windows\System\sqjhaHy.exe
  2⤵
  PID:3416
- C:\Windows\System\XIPJUFP.exe
  C:\Windows\System\XIPJUFP.exe
  2⤵
  PID:3616
- C:\Windows\System\ktoiuWz.exe
  C:\Windows\System\ktoiuWz.exe
  2⤵
  PID:3688
- C:\Windows\System\zYXrHOn.exe
  C:\Windows\System\zYXrHOn.exe
  2⤵
  PID:1732
- C:\Windows\System\QRTwXbn.exe
  C:\Windows\System\QRTwXbn.exe
  2⤵
  PID:3648
- C:\Windows\System\MUrfDAP.exe
  C:\Windows\System\MUrfDAP.exe
  2⤵
  PID:4088
- C:\Windows\System\vDOyIrL.exe
  C:\Windows\System\vDOyIrL.exe
  2⤵
  PID:3844
- C:\Windows\System\ZzrcDaq.exe
  C:\Windows\System\ZzrcDaq.exe
  2⤵
  PID:3296
- C:\Windows\System\WNnxydI.exe
  C:\Windows\System\WNnxydI.exe
  2⤵
  PID:4044
- C:\Windows\System\cRvvBXQ.exe
  C:\Windows\System\cRvvBXQ.exe
  2⤵
  PID:4104
- C:\Windows\System\tfASjOF.exe
  C:\Windows\System\tfASjOF.exe
  2⤵
  PID:4124
- C:\Windows\System\CdgeOXF.exe
  C:\Windows\System\CdgeOXF.exe
  2⤵
  PID:4140
- C:\Windows\System\wbGxCgS.exe
  C:\Windows\System\wbGxCgS.exe
  2⤵
  PID:4156
- C:\Windows\System\qZXVtGa.exe
  C:\Windows\System\qZXVtGa.exe
  2⤵
  PID:4172
- C:\Windows\System\zSGNSUM.exe
  C:\Windows\System\zSGNSUM.exe
  2⤵
  PID:4228
- C:\Windows\System\iDxMtgU.exe
  C:\Windows\System\iDxMtgU.exe
  2⤵
  PID:4244
- C:\Windows\System\MztQrTj.exe
  C:\Windows\System\MztQrTj.exe
  2⤵
  PID:4260
- C:\Windows\System\xBhVLUA.exe
  C:\Windows\System\xBhVLUA.exe
  2⤵
  PID:4276
- C:\Windows\System\WAUHMxJ.exe
  C:\Windows\System\WAUHMxJ.exe
  2⤵
  PID:4300
- C:\Windows\System\yQicxXh.exe
  C:\Windows\System\yQicxXh.exe
  2⤵
  PID:4316
- C:\Windows\System\PReoGyB.exe
  C:\Windows\System\PReoGyB.exe
  2⤵
  PID:4336
- C:\Windows\System\zdSbGXH.exe
  C:\Windows\System\zdSbGXH.exe
  2⤵
  PID:4356
- C:\Windows\System\hJUgFqb.exe
  C:\Windows\System\hJUgFqb.exe
  2⤵
  PID:4376
- C:\Windows\System\XeyIHxN.exe
  C:\Windows\System\XeyIHxN.exe
  2⤵
  PID:4392
- C:\Windows\System\vcKXGXR.exe
  C:\Windows\System\vcKXGXR.exe
  2⤵
  PID:4408
- C:\Windows\System\KvfWtvX.exe
  C:\Windows\System\KvfWtvX.exe
  2⤵
  PID:4424
- C:\Windows\System\DEeivIB.exe
  C:\Windows\System\DEeivIB.exe
  2⤵
  PID:4440
- C:\Windows\System\KdZIdSH.exe
  C:\Windows\System\KdZIdSH.exe
  2⤵
  PID:4456
- C:\Windows\System\VGjiSTn.exe
  C:\Windows\System\VGjiSTn.exe
  2⤵
  PID:4472
- C:\Windows\System\LMIMtiD.exe
  C:\Windows\System\LMIMtiD.exe
  2⤵
  PID:4488
- C:\Windows\System\WZZLPYe.exe
  C:\Windows\System\WZZLPYe.exe
  2⤵
  PID:4504
- C:\Windows\System\IHkPLie.exe
  C:\Windows\System\IHkPLie.exe
  2⤵
  PID:4520
- C:\Windows\System\vteGDNX.exe
  C:\Windows\System\vteGDNX.exe
  2⤵
  PID:4540
- C:\Windows\System\tobByzB.exe
  C:\Windows\System\tobByzB.exe
  2⤵
  PID:4556
- C:\Windows\System\pvIvQAE.exe
  C:\Windows\System\pvIvQAE.exe
  2⤵
  PID:4572
- C:\Windows\System\zTQlxnL.exe
  C:\Windows\System\zTQlxnL.exe
  2⤵
  PID:4588
- C:\Windows\System\DgVcnXz.exe
  C:\Windows\System\DgVcnXz.exe
  2⤵
  PID:4604
- C:\Windows\System\MlEJVuv.exe
  C:\Windows\System\MlEJVuv.exe
  2⤵
  PID:4628
- C:\Windows\System\xzigqjb.exe
  C:\Windows\System\xzigqjb.exe
  2⤵
  PID:4644
- C:\Windows\System\qVMsGzL.exe
  C:\Windows\System\qVMsGzL.exe
  2⤵
  PID:4664
- C:\Windows\System\UEWsrtV.exe
  C:\Windows\System\UEWsrtV.exe
  2⤵
  PID:4680
- C:\Windows\System\UaOgGOp.exe
  C:\Windows\System\UaOgGOp.exe
  2⤵
  PID:4696
- C:\Windows\System\tWSUWib.exe
  C:\Windows\System\tWSUWib.exe
  2⤵
  PID:4712
- C:\Windows\System\bluRrSW.exe
  C:\Windows\System\bluRrSW.exe
  2⤵
  PID:4736
- C:\Windows\System\YBIqvfg.exe
  C:\Windows\System\YBIqvfg.exe
  2⤵
  PID:4760
- C:\Windows\System\wDEvnPh.exe
  C:\Windows\System\wDEvnPh.exe
  2⤵
  PID:4796
- C:\Windows\System\xBsCgrQ.exe
  C:\Windows\System\xBsCgrQ.exe
  2⤵
  PID:4812
- C:\Windows\System\njLPcaT.exe
  C:\Windows\System\njLPcaT.exe
  2⤵
  PID:4872
- C:\Windows\System\rJWIAZA.exe
  C:\Windows\System\rJWIAZA.exe
  2⤵
  PID:4892
- C:\Windows\System\jeafrfZ.exe
  C:\Windows\System\jeafrfZ.exe
  2⤵
  PID:4908
- C:\Windows\System\SIotaEx.exe
  C:\Windows\System\SIotaEx.exe
  2⤵
  PID:4924
- C:\Windows\System\DiuHleb.exe
  C:\Windows\System\DiuHleb.exe
  2⤵
  PID:4940
- C:\Windows\System\myzWCjL.exe
  C:\Windows\System\myzWCjL.exe
  2⤵
  PID:4956
- C:\Windows\System\ySUZQOH.exe
  C:\Windows\System\ySUZQOH.exe
  2⤵
  PID:4976
- C:\Windows\System\rZaoPWY.exe
  C:\Windows\System\rZaoPWY.exe
  2⤵
  PID:5000
- C:\Windows\System\kMDqOqs.exe
  C:\Windows\System\kMDqOqs.exe
  2⤵
  PID:5016
- C:\Windows\System\QMjevTp.exe
  C:\Windows\System\QMjevTp.exe
  2⤵
  PID:5032
- C:\Windows\System\bONyOjp.exe
  C:\Windows\System\bONyOjp.exe
  2⤵
  PID:5048
- C:\Windows\System\JKrSMfx.exe
  C:\Windows\System\JKrSMfx.exe
  2⤵
  PID:5064
- C:\Windows\System\aQrZqSq.exe
  C:\Windows\System\aQrZqSq.exe
  2⤵
  PID:5080
- C:\Windows\System\qWeidiU.exe
  C:\Windows\System\qWeidiU.exe
  2⤵
  PID:5096
- C:\Windows\System\dNLwsOe.exe
  C:\Windows\System\dNLwsOe.exe
  2⤵
  PID:5112
- C:\Windows\System\UyPzeoU.exe
  C:\Windows\System\UyPzeoU.exe
  2⤵
  PID:4116
- C:\Windows\System\YIRRpBi.exe
  C:\Windows\System\YIRRpBi.exe
  2⤵
  PID:3064
- C:\Windows\System\GuvGHcz.exe
  C:\Windows\System\GuvGHcz.exe
  2⤵
  PID:3236
- C:\Windows\System\lnyqImx.exe
  C:\Windows\System\lnyqImx.exe
  2⤵
  PID:4168
- C:\Windows\System\eTSUHSA.exe
  C:\Windows\System\eTSUHSA.exe
  2⤵
  PID:4188
- C:\Windows\System\tmmduKe.exe
  C:\Windows\System\tmmduKe.exe
  2⤵
  PID:4204
- C:\Windows\System\zmUQJwd.exe
  C:\Windows\System\zmUQJwd.exe
  2⤵
  PID:4220
- C:\Windows\System\ARZgsSE.exe
  C:\Windows\System\ARZgsSE.exe
  2⤵
  PID:4284
- C:\Windows\System\QcJSBHP.exe
  C:\Windows\System\QcJSBHP.exe
  2⤵
  PID:4268
- C:\Windows\System\urkaUWW.exe
  C:\Windows\System\urkaUWW.exe
  2⤵
  PID:4312
- C:\Windows\System\IYQWXgw.exe
  C:\Windows\System\IYQWXgw.exe
  2⤵
  PID:4348
- C:\Windows\System\RQIYAtp.exe
  C:\Windows\System\RQIYAtp.exe
  2⤵
  PID:4372
- C:\Windows\System\hcgvigl.exe
  C:\Windows\System\hcgvigl.exe
  2⤵
  PID:4404
- C:\Windows\System\dkQyKsX.exe
  C:\Windows\System\dkQyKsX.exe
  2⤵
  PID:4468
- C:\Windows\System\ylrbzFO.exe
  C:\Windows\System\ylrbzFO.exe
  2⤵
  PID:4500
- C:\Windows\System\wxeYjDl.exe
  C:\Windows\System\wxeYjDl.exe
  2⤵
  PID:4564
- C:\Windows\System\xSUzNqN.exe
  C:\Windows\System\xSUzNqN.exe
  2⤵
  PID:4552
- C:\Windows\System\ZJKbRdr.exe
  C:\Windows\System\ZJKbRdr.exe
  2⤵
  PID:4580
- C:\Windows\System\koTduYa.exe
  C:\Windows\System\koTduYa.exe
  2⤵
  PID:4636
- C:\Windows\System\jgItzde.exe
  C:\Windows\System\jgItzde.exe
  2⤵
  PID:4624
- C:\Windows\System\oxZBCOK.exe
  C:\Windows\System\oxZBCOK.exe
  2⤵
  PID:4676
- C:\Windows\System\JaJgWdZ.exe
  C:\Windows\System\JaJgWdZ.exe
  2⤵
  PID:4744
- C:\Windows\System\srrHqLM.exe
  C:\Windows\System\srrHqLM.exe
  2⤵
  PID:4660
- C:\Windows\System\MNBDpUw.exe
  C:\Windows\System\MNBDpUw.exe
  2⤵
  PID:4752
- C:\Windows\System\zQLFkXI.exe
  C:\Windows\System\zQLFkXI.exe
  2⤵
  PID:4808
- C:\Windows\System\aUsDPTP.exe
  C:\Windows\System\aUsDPTP.exe
  2⤵
  PID:4788
- C:\Windows\System\aXjWpUy.exe
  C:\Windows\System\aXjWpUy.exe
  2⤵
  PID:4856
- C:\Windows\System\VrAfKVl.exe
  C:\Windows\System\VrAfKVl.exe
  2⤵
  PID:4920
- C:\Windows\System\xBCxUgj.exe
  C:\Windows\System\xBCxUgj.exe
  2⤵
  PID:4904
- C:\Windows\System\xIYyejF.exe
  C:\Windows\System\xIYyejF.exe
  2⤵
  PID:4992
- C:\Windows\System\XEvsDyP.exe
  C:\Windows\System\XEvsDyP.exe
  2⤵
  PID:5060
- C:\Windows\System\bIpBPyM.exe
  C:\Windows\System\bIpBPyM.exe
  2⤵
  PID:3412
- C:\Windows\System\DsxKKbq.exe
  C:\Windows\System\DsxKKbq.exe
  2⤵
  PID:5072
- C:\Windows\System\wCdRYLl.exe
  C:\Windows\System\wCdRYLl.exe
  2⤵
  PID:2788
- C:\Windows\System\vhMzzIi.exe
  C:\Windows\System\vhMzzIi.exe
  2⤵
  PID:3332
- C:\Windows\System\UhwtRYM.exe
  C:\Windows\System\UhwtRYM.exe
  2⤵
  PID:4136
- C:\Windows\System\GtzpVYf.exe
  C:\Windows\System\GtzpVYf.exe
  2⤵
  PID:4272
- C:\Windows\System\OrjBOZn.exe
  C:\Windows\System\OrjBOZn.exe
  2⤵
  PID:4252
- C:\Windows\System\GusRGqk.exe
  C:\Windows\System\GusRGqk.exe
  2⤵
  PID:4420
- C:\Windows\System\NPilDHM.exe
  C:\Windows\System\NPilDHM.exe
  2⤵
  PID:4868
- C:\Windows\System\kecMKqb.exe
  C:\Windows\System\kecMKqb.exe
  2⤵
  PID:4536
- C:\Windows\System\JsNJOjB.exe
  C:\Windows\System\JsNJOjB.exe
  2⤵
  PID:4480
- C:\Windows\System\OFqnqLl.exe
  C:\Windows\System\OFqnqLl.exe
  2⤵
  PID:3384
- C:\Windows\System\qGBqXep.exe
  C:\Windows\System\qGBqXep.exe
  2⤵
  PID:4652
- C:\Windows\System\NIpLzXL.exe
  C:\Windows\System\NIpLzXL.exe
  2⤵
  PID:4776
- C:\Windows\System\RoDCjvK.exe
  C:\Windows\System\RoDCjvK.exe
  2⤵
  PID:4728
- C:\Windows\System\wZygTXW.exe
  C:\Windows\System\wZygTXW.exe
  2⤵
  PID:4832
- C:\Windows\System\dTJeptX.exe
  C:\Windows\System\dTJeptX.exe
  2⤵
  PID:5040
- C:\Windows\System\fVVFAOo.exe
  C:\Windows\System\fVVFAOo.exe
  2⤵
  PID:4984
- C:\Windows\System\OGSXEdN.exe
  C:\Windows\System\OGSXEdN.exe
  2⤵
  PID:5108
- C:\Windows\System\eKOoTKJ.exe
  C:\Windows\System\eKOoTKJ.exe
  2⤵
  PID:4152
- C:\Windows\System\nHiGtnr.exe
  C:\Windows\System\nHiGtnr.exe
  2⤵
  PID:4308
- C:\Windows\System\rVzsMTA.exe
  C:\Windows\System\rVzsMTA.exe
  2⤵
  PID:4364
- C:\Windows\System\jNFuTmb.exe
  C:\Windows\System\jNFuTmb.exe
  2⤵
  PID:4436
- C:\Windows\System\ClrGueU.exe
  C:\Windows\System\ClrGueU.exe
  2⤵
  PID:4464
- C:\Windows\System\tcnfNVY.exe
  C:\Windows\System\tcnfNVY.exe
  2⤵
  PID:4836
- C:\Windows\System\fTmzRNG.exe
  C:\Windows\System\fTmzRNG.exe
  2⤵
  PID:5104
- C:\Windows\System\FGlbxfY.exe
  C:\Windows\System\FGlbxfY.exe
  2⤵
  PID:4888
- C:\Windows\System\EorUgXi.exe
  C:\Windows\System\EorUgXi.exe
  2⤵
  PID:1756
- C:\Windows\System\BTNYUWH.exe
  C:\Windows\System\BTNYUWH.exe
  2⤵
  PID:4516
- C:\Windows\System\TYqXjFj.exe
  C:\Windows\System\TYqXjFj.exe
  2⤵
  PID:5092
- C:\Windows\System\weAXuYi.exe
  C:\Windows\System\weAXuYi.exe
  2⤵
  PID:4288
- C:\Windows\System\uezLJUZ.exe
  C:\Windows\System\uezLJUZ.exe
  2⤵
  PID:4900
- C:\Windows\System\YhdOZLW.exe
  C:\Windows\System\YhdOZLW.exe
  2⤵
  PID:4688
- C:\Windows\System\CSaoKND.exe
  C:\Windows\System\CSaoKND.exe
  2⤵
  PID:4388
- C:\Windows\System\sgoQXgM.exe
  C:\Windows\System\sgoQXgM.exe
  2⤵
  PID:4208
- C:\Windows\System\wynQzzh.exe
  C:\Windows\System\wynQzzh.exe
  2⤵
  PID:5012
- C:\Windows\System\PiXdNnF.exe
  C:\Windows\System\PiXdNnF.exe
  2⤵
  PID:4932
- C:\Windows\System\VdbBrLR.exe
  C:\Windows\System\VdbBrLR.exe
  2⤵
  PID:4828
- C:\Windows\System\BAMshXa.exe
  C:\Windows\System\BAMshXa.exe
  2⤵
  PID:4840
- C:\Windows\System\SdOuNoR.exe
  C:\Windows\System\SdOuNoR.exe
  2⤵
  PID:4344
- C:\Windows\System\WoSGwJs.exe
  C:\Windows\System\WoSGwJs.exe
  2⤵
  PID:4952
- C:\Windows\System\keAMQVA.exe
  C:\Windows\System\keAMQVA.exe
  2⤵
  PID:5044
- C:\Windows\System\jlVBbyy.exe
  C:\Windows\System\jlVBbyy.exe
  2⤵
  PID:5212
- C:\Windows\System\XWjzQxk.exe
  C:\Windows\System\XWjzQxk.exe
  2⤵
  PID:5236
- C:\Windows\System\bQKbVtZ.exe
  C:\Windows\System\bQKbVtZ.exe
  2⤵
  PID:5252
- C:\Windows\System\OHaURXy.exe
  C:\Windows\System\OHaURXy.exe
  2⤵
  PID:5272
- C:\Windows\System\aHvTNde.exe
  C:\Windows\System\aHvTNde.exe
  2⤵
  PID:5288
- C:\Windows\System\cLdkRgt.exe
  C:\Windows\System\cLdkRgt.exe
  2⤵
  PID:5304
- C:\Windows\System\rowilZN.exe
  C:\Windows\System\rowilZN.exe
  2⤵
  PID:5320
- C:\Windows\System\kTCTqeF.exe
  C:\Windows\System\kTCTqeF.exe
  2⤵
  PID:5348
- C:\Windows\System\pAHbyCN.exe
  C:\Windows\System\pAHbyCN.exe
  2⤵
  PID:5364
- C:\Windows\System\NUMGxaC.exe
  C:\Windows\System\NUMGxaC.exe
  2⤵
  PID:5380
- C:\Windows\System\kQsKlMu.exe
  C:\Windows\System\kQsKlMu.exe
  2⤵
  PID:5396
- C:\Windows\System\olSQIpT.exe
  C:\Windows\System\olSQIpT.exe
  2⤵
  PID:5436
- C:\Windows\System\qbMhiBK.exe
  C:\Windows\System\qbMhiBK.exe
  2⤵
  PID:5452
- C:\Windows\System\nfNErzJ.exe
  C:\Windows\System\nfNErzJ.exe
  2⤵
  PID:5468
- C:\Windows\System\kcSbDtS.exe
  C:\Windows\System\kcSbDtS.exe
  2⤵
  PID:5484
- C:\Windows\System\CRorOiI.exe
  C:\Windows\System\CRorOiI.exe
  2⤵
  PID:5500
- C:\Windows\System\dkHvUTk.exe
  C:\Windows\System\dkHvUTk.exe
  2⤵
  PID:5520
- C:\Windows\System\WdjaYPr.exe
  C:\Windows\System\WdjaYPr.exe
  2⤵
  PID:5536
- C:\Windows\System\ntypwNq.exe
  C:\Windows\System\ntypwNq.exe
  2⤵
  PID:5552
- C:\Windows\System\vYNMddJ.exe
  C:\Windows\System\vYNMddJ.exe
  2⤵
  PID:5568
- C:\Windows\System\yhzAbSH.exe
  C:\Windows\System\yhzAbSH.exe
  2⤵
  PID:5600
- C:\Windows\System\QHdTvUK.exe
  C:\Windows\System\QHdTvUK.exe
  2⤵
  PID:5616
- C:\Windows\System\VUlLgUH.exe
  C:\Windows\System\VUlLgUH.exe
  2⤵
  PID:5632
- C:\Windows\System\sgtYWac.exe
  C:\Windows\System\sgtYWac.exe
  2⤵
  PID:5648
- C:\Windows\System\MSiJnXj.exe
  C:\Windows\System\MSiJnXj.exe
  2⤵
  PID:5668
- C:\Windows\System\tkAJbLq.exe
  C:\Windows\System\tkAJbLq.exe
  2⤵
  PID:5684
- C:\Windows\System\AKorRgp.exe
  C:\Windows\System\AKorRgp.exe
  2⤵
  PID:5700
- C:\Windows\System\QShGCWn.exe
  C:\Windows\System\QShGCWn.exe
  2⤵
  PID:5716
- C:\Windows\System\CKEOmZz.exe
  C:\Windows\System\CKEOmZz.exe
  2⤵
  PID:5732
- C:\Windows\System\taIcaQT.exe
  C:\Windows\System\taIcaQT.exe
  2⤵
  PID:5752
- C:\Windows\System\gEeBSpR.exe
  C:\Windows\System\gEeBSpR.exe
  2⤵
  PID:5768
- C:\Windows\System\eTMVQEi.exe
  C:\Windows\System\eTMVQEi.exe
  2⤵
  PID:5788
- C:\Windows\System\cIzogyR.exe
  C:\Windows\System\cIzogyR.exe
  2⤵
  PID:5804
- C:\Windows\System\mohLRCt.exe
  C:\Windows\System\mohLRCt.exe
  2⤵
  PID:5824
- C:\Windows\System\bnKedEF.exe
  C:\Windows\System\bnKedEF.exe
  2⤵
  PID:5848
- C:\Windows\System\fFXOwkp.exe
  C:\Windows\System\fFXOwkp.exe
  2⤵
  PID:5872
- C:\Windows\System\EqrfeFm.exe
  C:\Windows\System\EqrfeFm.exe
  2⤵
  PID:5896
- C:\Windows\System\oCVYByS.exe
  C:\Windows\System\oCVYByS.exe
  2⤵
  PID:5912
- C:\Windows\System\nVUpzbZ.exe
  C:\Windows\System\nVUpzbZ.exe
  2⤵
  PID:5928
- C:\Windows\System\hTpWuQH.exe
  C:\Windows\System\hTpWuQH.exe
  2⤵
  PID:5992
- C:\Windows\System\NpKMHrS.exe
  C:\Windows\System\NpKMHrS.exe
  2⤵
  PID:6020
- C:\Windows\System\BqYZSUb.exe
  C:\Windows\System\BqYZSUb.exe
  2⤵
  PID:6040
- C:\Windows\System\SZWLSqd.exe
  C:\Windows\System\SZWLSqd.exe
  2⤵
  PID:6060
- C:\Windows\System\GBdepmU.exe
  C:\Windows\System\GBdepmU.exe
  2⤵
  PID:6084
- C:\Windows\System\pUTRegY.exe
  C:\Windows\System\pUTRegY.exe
  2⤵
  PID:6108
- C:\Windows\System\ttXZUjp.exe
  C:\Windows\System\ttXZUjp.exe
  2⤵
  PID:4672
- C:\Windows\System\BsrhBZH.exe
  C:\Windows\System\BsrhBZH.exe
  2⤵
  PID:5136
- C:\Windows\System\viPtygr.exe
  C:\Windows\System\viPtygr.exe
  2⤵
  PID:5152
- C:\Windows\System\iMEbdDG.exe
  C:\Windows\System\iMEbdDG.exe
  2⤵
  PID:5228
- C:\Windows\System\tQfFVJD.exe
  C:\Windows\System\tQfFVJD.exe
  2⤵
  PID:5328
- C:\Windows\System\vhBLPJa.exe
  C:\Windows\System\vhBLPJa.exe
  2⤵
  PID:5192
- C:\Windows\System\eVJwydx.exe
  C:\Windows\System\eVJwydx.exe
  2⤵
  PID:5172
- C:\Windows\System\sHopHgn.exe
  C:\Windows\System\sHopHgn.exe
  2⤵
  PID:5244
- C:\Windows\System\VDJFHyJ.exe
  C:\Windows\System\VDJFHyJ.exe
  2⤵
  PID:5312
- C:\Windows\System\oICsuFv.exe
  C:\Windows\System\oICsuFv.exe
  2⤵
  PID:5388
- C:\Windows\System\GXEHnRs.exe
  C:\Windows\System\GXEHnRs.exe
  2⤵
  PID:5416
- C:\Windows\System\IlwFndy.exe
  C:\Windows\System\IlwFndy.exe
  2⤵
  PID:5412
- C:\Windows\System\RQgSHjX.exe
  C:\Windows\System\RQgSHjX.exe
  2⤵
  PID:5420
- C:\Windows\System\YiIvIvk.exe
  C:\Windows\System\YiIvIvk.exe
  2⤵
  PID:5564
- C:\Windows\System\OhybwKL.exe
  C:\Windows\System\OhybwKL.exe
  2⤵
  PID:5448
- C:\Windows\System\OIFnzJa.exe
  C:\Windows\System\OIFnzJa.exe
  2⤵
  PID:5512
- C:\Windows\System\ZMcOaoA.exe
  C:\Windows\System\ZMcOaoA.exe
  2⤵
  PID:5624
- C:\Windows\System\RCFhYaG.exe
  C:\Windows\System\RCFhYaG.exe
  2⤵
  PID:5708
- C:\Windows\System\MtABdXV.exe
  C:\Windows\System\MtABdXV.exe
  2⤵
  PID:5780
- C:\Windows\System\UzrPARY.exe
  C:\Windows\System\UzrPARY.exe
  2⤵
  PID:5728
- C:\Windows\System\sHZxpaU.exe
  C:\Windows\System\sHZxpaU.exe
  2⤵
  PID:5764
- C:\Windows\System\ERIYUxs.exe
  C:\Windows\System\ERIYUxs.exe
  2⤵
  PID:5840
- C:\Windows\System\FSbJgrc.exe
  C:\Windows\System\FSbJgrc.exe
  2⤵
  PID:5180
- C:\Windows\System\ktMABLB.exe
  C:\Windows\System\ktMABLB.exe
  2⤵
  PID:1068
- C:\Windows\System\ZrQvebD.exe
  C:\Windows\System\ZrQvebD.exe
  2⤵
  PID:5924
- C:\Windows\System\gSFFDgq.exe
  C:\Windows\System\gSFFDgq.exe
  2⤵
  PID:5960
- C:\Windows\System\dttSUqP.exe
  C:\Windows\System\dttSUqP.exe
  2⤵
  PID:5980
- C:\Windows\System\bJhOFhZ.exe
  C:\Windows\System\bJhOFhZ.exe
  2⤵
  PID:6036
- C:\Windows\System\IPwroVS.exe
  C:\Windows\System\IPwroVS.exe
  2⤵
  PID:6124
- C:\Windows\System\mcEeMHI.exe
  C:\Windows\System\mcEeMHI.exe
  2⤵
  PID:4324
- C:\Windows\System\ZBZjZRl.exe
  C:\Windows\System\ZBZjZRl.exe
  2⤵
  PID:6048
- C:\Windows\System\JEVmOxH.exe
  C:\Windows\System\JEVmOxH.exe
  2⤵
  PID:3860
- C:\Windows\System\bosQtuE.exe
  C:\Windows\System\bosQtuE.exe
  2⤵
  PID:6000
- C:\Windows\System\sCSfRoR.exe
  C:\Windows\System\sCSfRoR.exe
  2⤵
  PID:6016
- C:\Windows\System\UGVERJW.exe
  C:\Windows\System\UGVERJW.exe
  2⤵
  PID:5344
- C:\Windows\System\gFyKbHE.exe
  C:\Windows\System\gFyKbHE.exe
  2⤵
  PID:6096
- C:\Windows\System\EKOWyHI.exe
  C:\Windows\System\EKOWyHI.exe
  2⤵
  PID:5300
- C:\Windows\System\pDpypJd.exe
  C:\Windows\System\pDpypJd.exe
  2⤵
  PID:5160
- C:\Windows\System\vHefCco.exe
  C:\Windows\System\vHefCco.exe
  2⤵
  PID:5196
- C:\Windows\System\FSLWfiK.exe
  C:\Windows\System\FSLWfiK.exe
  2⤵
  PID:5608
- C:\Windows\System\KLDVHab.exe
  C:\Windows\System\KLDVHab.exe
  2⤵
  PID:5444
- C:\Windows\System\gqHllyy.exe
  C:\Windows\System\gqHllyy.exe
  2⤵
  PID:5584
- C:\Windows\System\pOLUsXI.exe
  C:\Windows\System\pOLUsXI.exe
  2⤵
  PID:5628
- C:\Windows\System\gIsDDWU.exe
  C:\Windows\System\gIsDDWU.exe
  2⤵
  PID:5528
- C:\Windows\System\gefPzbX.exe
  C:\Windows\System\gefPzbX.exe
  2⤵
  PID:5744
- C:\Windows\System\vNCkngi.exe
  C:\Windows\System\vNCkngi.exe
  2⤵
  PID:5480
- C:\Windows\System\bqGIWaH.exe
  C:\Windows\System\bqGIWaH.exe
  2⤵
  PID:5880
- C:\Windows\System\IswjupL.exe
  C:\Windows\System\IswjupL.exe
  2⤵
  PID:5920
- C:\Windows\System\bWddBFe.exe
  C:\Windows\System\bWddBFe.exe
  2⤵
  PID:5976
- C:\Windows\System\EDstnYD.exe
  C:\Windows\System\EDstnYD.exe
  2⤵
  PID:6076
- C:\Windows\System\QFIgPBo.exe
  C:\Windows\System\QFIgPBo.exe
  2⤵
  PID:5696
- C:\Windows\System\beCJPJx.exe
  C:\Windows\System\beCJPJx.exe
  2⤵
  PID:5208
- C:\Windows\System\EzCmrqt.exe
  C:\Windows\System\EzCmrqt.exe
  2⤵
  PID:5936
- C:\Windows\System\kFekAmm.exe
  C:\Windows\System\kFekAmm.exe
  2⤵
  PID:5956
- C:\Windows\System\LKTxEmT.exe
  C:\Windows\System\LKTxEmT.exe
  2⤵
  PID:4216
- C:\Windows\System\uLSQxAs.exe
  C:\Windows\System\uLSQxAs.exe
  2⤵
  PID:5640
- C:\Windows\System\TgUOQIA.exe
  C:\Windows\System\TgUOQIA.exe
  2⤵
  PID:5664
- C:\Windows\System\yTCEtrQ.exe
  C:\Windows\System\yTCEtrQ.exe
  2⤵
  PID:5340
- C:\Windows\System\XNLiBBs.exe
  C:\Windows\System\XNLiBBs.exe
  2⤵
  PID:5168
- C:\Windows\System\kGekawl.exe
  C:\Windows\System\kGekawl.exe
  2⤵
  PID:5128
- C:\Windows\System\HlteBAW.exe
  C:\Windows\System\HlteBAW.exe
  2⤵
  PID:5184
- C:\Windows\System\OxGlUAs.exe
  C:\Windows\System\OxGlUAs.exe
  2⤵
  PID:5284
- C:\Windows\System\qghVqSw.exe
  C:\Windows\System\qghVqSw.exe
  2⤵
  PID:5424
- C:\Windows\System\dKTYbXK.exe
  C:\Windows\System\dKTYbXK.exe
  2⤵
  PID:5532
- C:\Windows\System\JrkGTwn.exe
  C:\Windows\System\JrkGTwn.exe
  2⤵
  PID:5576
- C:\Windows\System\uYrkdqi.exe
  C:\Windows\System\uYrkdqi.exe
  2⤵
  PID:5816
- C:\Windows\System\niQtHGb.exe
  C:\Windows\System\niQtHGb.exe
  2⤵
  PID:5968
- C:\Windows\System\eEEQayX.exe
  C:\Windows\System\eEEQayX.exe
  2⤵
  PID:5904
- C:\Windows\System\MqADxzZ.exe
  C:\Windows\System\MqADxzZ.exe
  2⤵
  PID:6136
- C:\Windows\System\tsWFEul.exe
  C:\Windows\System\tsWFEul.exe
  2⤵
  PID:5836
- C:\Windows\System\fuZtguJ.exe
  C:\Windows\System\fuZtguJ.exe
  2⤵
  PID:6056
- C:\Windows\System\BLqzXEN.exe
  C:\Windows\System\BLqzXEN.exe
  2⤵
  PID:5132
- C:\Windows\System\oFjKfPL.exe
  C:\Windows\System\oFjKfPL.exe
  2⤵
  PID:5188
- C:\Windows\System\qjyuDIc.exe
  C:\Windows\System\qjyuDIc.exe
  2⤵
  PID:6008
- C:\Windows\System\HBIQagM.exe
  C:\Windows\System\HBIQagM.exe
  2⤵
  PID:5592
- C:\Windows\System\EvIMoSi.exe
  C:\Windows\System\EvIMoSi.exe
  2⤵
  PID:5676
- C:\Windows\System\LOpYzAG.exe
  C:\Windows\System\LOpYzAG.exe
  2⤵
  PID:5460
- C:\Windows\System\NIyGxGC.exe
  C:\Windows\System\NIyGxGC.exe
  2⤵
  PID:5056
- C:\Windows\System\shAJwCh.exe
  C:\Windows\System\shAJwCh.exe
  2⤵
  PID:6140
- C:\Windows\System\twUuNsf.exe
  C:\Windows\System\twUuNsf.exe
  2⤵
  PID:6080
- C:\Windows\System\DZfwVSJ.exe
  C:\Windows\System\DZfwVSJ.exe
  2⤵
  PID:5740
- C:\Windows\System\GAfHszY.exe
  C:\Windows\System\GAfHszY.exe
  2⤵
  PID:4328
- C:\Windows\System\AKcbjMA.exe
  C:\Windows\System\AKcbjMA.exe
  2⤵
  PID:6152
- C:\Windows\System\YfyEqvs.exe
  C:\Windows\System\YfyEqvs.exe
  2⤵
  PID:6176
- C:\Windows\System\GHqbldl.exe
  C:\Windows\System\GHqbldl.exe
  2⤵
  PID:6192
- C:\Windows\System\QIfXJhV.exe
  C:\Windows\System\QIfXJhV.exe
  2⤵
  PID:6208
- C:\Windows\System\dciaWEC.exe
  C:\Windows\System\dciaWEC.exe
  2⤵
  PID:6224
- C:\Windows\System\AiYyQLM.exe
  C:\Windows\System\AiYyQLM.exe
  2⤵
  PID:6240
- C:\Windows\System\inAZfBz.exe
  C:\Windows\System\inAZfBz.exe
  2⤵
  PID:6256
- C:\Windows\System\ePYgtAT.exe
  C:\Windows\System\ePYgtAT.exe
  2⤵
  PID:6272
- C:\Windows\System\PstGRlL.exe
  C:\Windows\System\PstGRlL.exe
  2⤵
  PID:6288
- C:\Windows\System\SicuOUj.exe
  C:\Windows\System\SicuOUj.exe
  2⤵
  PID:6304
- C:\Windows\System\siqYnxr.exe
  C:\Windows\System\siqYnxr.exe
  2⤵
  PID:6320
- C:\Windows\System\KGhsRtJ.exe
  C:\Windows\System\KGhsRtJ.exe
  2⤵
  PID:6336
- C:\Windows\System\YkKiiKo.exe
  C:\Windows\System\YkKiiKo.exe
  2⤵
  PID:6352
- C:\Windows\System\xfpvmzZ.exe
  C:\Windows\System\xfpvmzZ.exe
  2⤵
  PID:6368
- C:\Windows\System\SqPCCJq.exe
  C:\Windows\System\SqPCCJq.exe
  2⤵
  PID:6384
- C:\Windows\System\PLpfLfI.exe
  C:\Windows\System\PLpfLfI.exe
  2⤵
  PID:6400
- C:\Windows\System\FtizBmi.exe
  C:\Windows\System\FtizBmi.exe
  2⤵
  PID:6420
- C:\Windows\System\GgCSrqm.exe
  C:\Windows\System\GgCSrqm.exe
  2⤵
  PID:6436
- C:\Windows\System\wSrNAIi.exe
  C:\Windows\System\wSrNAIi.exe
  2⤵
  PID:6460
- C:\Windows\System\jXQdWAb.exe
  C:\Windows\System\jXQdWAb.exe
  2⤵
  PID:6476
- C:\Windows\System\Vdiaebn.exe
  C:\Windows\System\Vdiaebn.exe
  2⤵
  PID:6492
- C:\Windows\System\RmLwnbi.exe
  C:\Windows\System\RmLwnbi.exe
  2⤵
  PID:6508
- C:\Windows\System\uLdYGfC.exe
  C:\Windows\System\uLdYGfC.exe
  2⤵
  PID:6524
- C:\Windows\System\dUPDRSF.exe
  C:\Windows\System\dUPDRSF.exe
  2⤵
  PID:6540
- C:\Windows\System\RgtiwkU.exe
  C:\Windows\System\RgtiwkU.exe
  2⤵
  PID:6556
- C:\Windows\System\biTzdZf.exe
  C:\Windows\System\biTzdZf.exe
  2⤵
  PID:6572
- C:\Windows\System\pbZdmpc.exe
  C:\Windows\System\pbZdmpc.exe
  2⤵
  PID:6592
- C:\Windows\System\SqQeamg.exe
  C:\Windows\System\SqQeamg.exe
  2⤵
  PID:6608
- C:\Windows\System\VSZOZOz.exe
  C:\Windows\System\VSZOZOz.exe
  2⤵
  PID:6628
- C:\Windows\System\AZGMyPU.exe
  C:\Windows\System\AZGMyPU.exe
  2⤵
  PID:6644
- C:\Windows\System\xvHoQFa.exe
  C:\Windows\System\xvHoQFa.exe
  2⤵
  PID:6660
- C:\Windows\System\iGaGdwN.exe
  C:\Windows\System\iGaGdwN.exe
  2⤵
  PID:6676
- C:\Windows\System\ZkhqMOc.exe
  C:\Windows\System\ZkhqMOc.exe
  2⤵
  PID:6692
- C:\Windows\System\FMREwyK.exe
  C:\Windows\System\FMREwyK.exe
  2⤵
  PID:6708
- C:\Windows\System\bVeORIr.exe
  C:\Windows\System\bVeORIr.exe
  2⤵
  PID:6728
- C:\Windows\System\pQYhyiv.exe
  C:\Windows\System\pQYhyiv.exe
  2⤵
  PID:6744
- C:\Windows\System\cxWAIqt.exe
  C:\Windows\System\cxWAIqt.exe
  2⤵
  PID:6760
- C:\Windows\System\QkTdgki.exe
  C:\Windows\System\QkTdgki.exe
  2⤵
  PID:6776
- C:\Windows\System\iUYvgqW.exe
  C:\Windows\System\iUYvgqW.exe
  2⤵
  PID:6792
- C:\Windows\System\UnfnKsU.exe
  C:\Windows\System\UnfnKsU.exe
  2⤵
  PID:6808
- C:\Windows\System\gVFXWuE.exe
  C:\Windows\System\gVFXWuE.exe
  2⤵
  PID:6824
- C:\Windows\System\ysTVAcr.exe
  C:\Windows\System\ysTVAcr.exe
  2⤵
  PID:6840
- C:\Windows\System\KzoHjhV.exe
  C:\Windows\System\KzoHjhV.exe
  2⤵
  PID:6860
- C:\Windows\System\IZrSwBv.exe
  C:\Windows\System\IZrSwBv.exe
  2⤵
  PID:6876
- C:\Windows\System\MfcIvUV.exe
  C:\Windows\System\MfcIvUV.exe
  2⤵
  PID:6892
- C:\Windows\System\iHLrxLI.exe
  C:\Windows\System\iHLrxLI.exe
  2⤵
  PID:6908
- C:\Windows\System\AuhIFsd.exe
  C:\Windows\System\AuhIFsd.exe
  2⤵
  PID:6924
- C:\Windows\System\aHZOgQJ.exe
  C:\Windows\System\aHZOgQJ.exe
  2⤵
  PID:6940
- C:\Windows\System\nbOTjQd.exe
  C:\Windows\System\nbOTjQd.exe
  2⤵
  PID:6960
- C:\Windows\System\uZYoeNm.exe
  C:\Windows\System\uZYoeNm.exe
  2⤵
  PID:6976
- C:\Windows\System\tYxBZjs.exe
  C:\Windows\System\tYxBZjs.exe
  2⤵
  PID:6992
- C:\Windows\System\ScPZbCC.exe
  C:\Windows\System\ScPZbCC.exe
  2⤵
  PID:7008
- C:\Windows\System\KlxWasM.exe
  C:\Windows\System\KlxWasM.exe
  2⤵
  PID:7024
- C:\Windows\System\NyXivNT.exe
  C:\Windows\System\NyXivNT.exe
  2⤵
  PID:7040
- C:\Windows\System\DxOZQjw.exe
  C:\Windows\System\DxOZQjw.exe
  2⤵
  PID:7060
- C:\Windows\System\qkoUHsC.exe
  C:\Windows\System\qkoUHsC.exe
  2⤵
  PID:7076
- C:\Windows\System\zcIfGrL.exe
  C:\Windows\System\zcIfGrL.exe
  2⤵
  PID:7092
- C:\Windows\System\bWtBjWs.exe
  C:\Windows\System\bWtBjWs.exe
  2⤵
  PID:7108
- C:\Windows\System\aHgSSKN.exe
  C:\Windows\System\aHgSSKN.exe
  2⤵
  PID:7128
- C:\Windows\System\GHETrci.exe
  C:\Windows\System\GHETrci.exe
  2⤵
  PID:7152
- C:\Windows\System\NUYrfqV.exe
  C:\Windows\System\NUYrfqV.exe
  2⤵
  PID:5264
- C:\Windows\System\SPWFKdQ.exe
  C:\Windows\System\SPWFKdQ.exe
  2⤵
  PID:5432
- C:\Windows\System\hvvQCwl.exe
  C:\Windows\System\hvvQCwl.exe
  2⤵
  PID:5336
- C:\Windows\System\VgItrSP.exe
  C:\Windows\System\VgItrSP.exe
  2⤵
  PID:6160
- C:\Windows\System\zrJwLIa.exe
  C:\Windows\System\zrJwLIa.exe
  2⤵
  PID:6188
- C:\Windows\System\IcaqasD.exe
  C:\Windows\System\IcaqasD.exe
  2⤵
  PID:6220
- C:\Windows\System\WzlBpZr.exe
  C:\Windows\System\WzlBpZr.exe
  2⤵
  PID:5596
- C:\Windows\System\toHtjDV.exe
  C:\Windows\System\toHtjDV.exe
  2⤵
  PID:6232
- C:\Windows\System\bFRzDCt.exe
  C:\Windows\System\bFRzDCt.exe
  2⤵
  PID:6264
- C:\Windows\System\yGyDSwZ.exe
  C:\Windows\System\yGyDSwZ.exe
  2⤵
  PID:6344
- C:\Windows\System\qpccrOR.exe
  C:\Windows\System\qpccrOR.exe
  2⤵
  PID:6408
- C:\Windows\System\ebCAimV.exe
  C:\Windows\System\ebCAimV.exe
  2⤵
  PID:6396
- C:\Windows\System\EdJNyXH.exe
  C:\Windows\System\EdJNyXH.exe
  2⤵
  PID:6432
- C:\Windows\System\osrJQyN.exe
  C:\Windows\System\osrJQyN.exe
  2⤵
  PID:6472
- C:\Windows\System\SnHVxDg.exe
  C:\Windows\System\SnHVxDg.exe
  2⤵
  PID:6520
- C:\Windows\System\vRikoSx.exe
  C:\Windows\System\vRikoSx.exe
  2⤵
  PID:6580
- C:\Windows\System\xteVqAj.exe
  C:\Windows\System\xteVqAj.exe
  2⤵
  PID:6620
- C:\Windows\System\HWAUZBI.exe
  C:\Windows\System\HWAUZBI.exe
  2⤵
  PID:6656
- C:\Windows\System\ZtLqoqT.exe
  C:\Windows\System\ZtLqoqT.exe
  2⤵
  PID:6500
- C:\Windows\System\HbOwIEc.exe
  C:\Windows\System\HbOwIEc.exe
  2⤵
  PID:6532
- C:\Windows\System\bxokEra.exe
  C:\Windows\System\bxokEra.exe
  2⤵
  PID:6604
- C:\Windows\System\fvDRGXz.exe
  C:\Windows\System\fvDRGXz.exe
  2⤵
  PID:6704
- C:\Windows\System\GJLpaeZ.exe
  C:\Windows\System\GJLpaeZ.exe
  2⤵
  PID:6772
- C:\Windows\System\cMYaSyn.exe
  C:\Windows\System\cMYaSyn.exe
  2⤵
  PID:6816
- C:\Windows\System\RKthpjD.exe
  C:\Windows\System\RKthpjD.exe
  2⤵
  PID:6832
- C:\Windows\System\DsJXCBX.exe
  C:\Windows\System\DsJXCBX.exe
  2⤵
  PID:6872
- C:\Windows\System\TaYeBCh.exe
  C:\Windows\System\TaYeBCh.exe
  2⤵
  PID:6904
- C:\Windows\System\XtTlNPd.exe
  C:\Windows\System\XtTlNPd.exe
  2⤵
  PID:6956
- C:\Windows\System\RgHmJgy.exe
  C:\Windows\System\RgHmJgy.exe
  2⤵
  PID:6972
- C:\Windows\System\CuXxFWx.exe
  C:\Windows\System\CuXxFWx.exe
  2⤵
  PID:6968
- C:\Windows\System\jgqftDt.exe
  C:\Windows\System\jgqftDt.exe
  2⤵
  PID:7036
- C:\Windows\System\QXmaHsG.exe
  C:\Windows\System\QXmaHsG.exe
  2⤵
  PID:6452
- C:\Windows\System\wYnYJzx.exe
  C:\Windows\System\wYnYJzx.exe
  2⤵
  PID:7072
- C:\Windows\System\aWvZRGC.exe
  C:\Windows\System\aWvZRGC.exe
  2⤵
  PID:7160
- C:\Windows\System\HqtlmIi.exe
  C:\Windows\System\HqtlmIi.exe
  2⤵
  PID:5516
- C:\Windows\System\lVqCCpM.exe
  C:\Windows\System\lVqCCpM.exe
  2⤵
  PID:6280
- C:\Windows\System\KAqRzxb.exe
  C:\Windows\System\KAqRzxb.exe
  2⤵
  PID:4724
- C:\Windows\System\KAhZLPX.exe
  C:\Windows\System\KAhZLPX.exe
  2⤵
  PID:6028
- C:\Windows\System\IWhKvKp.exe
  C:\Windows\System\IWhKvKp.exe
  2⤵
  PID:6200
- C:\Windows\System\BgyHlSW.exe
  C:\Windows\System\BgyHlSW.exe
  2⤵
  PID:6328
- C:\Windows\System\XMvXsHJ.exe
  C:\Windows\System\XMvXsHJ.exe
  2⤵
  PID:6444
- C:\Windows\System\BLePqKo.exe
  C:\Windows\System\BLePqKo.exe
  2⤵
  PID:6588
- C:\Windows\System\gMApTOi.exe
  C:\Windows\System\gMApTOi.exe
  2⤵
  PID:6456
- C:\Windows\System\bfqKXyI.exe
  C:\Windows\System\bfqKXyI.exe
  2⤵
  PID:6652
- C:\Windows\System\dyHblCH.exe
  C:\Windows\System\dyHblCH.exe
  2⤵
  PID:6752
- C:\Windows\System\wzNJPwg.exe
  C:\Windows\System\wzNJPwg.exe
  2⤵
  PID:6984
- C:\Windows\System\nkqZZDh.exe
  C:\Windows\System\nkqZZDh.exe
  2⤵
  PID:7084
- C:\Windows\System\vHhpByc.exe
  C:\Windows\System\vHhpByc.exe
  2⤵
  PID:6672
- C:\Windows\System\TINDLuK.exe
  C:\Windows\System\TINDLuK.exe
  2⤵
  PID:6768
- C:\Windows\System\FzUSmwv.exe
  C:\Windows\System\FzUSmwv.exe
  2⤵
  PID:6668
- C:\Windows\System\KFEFXLZ.exe
  C:\Windows\System\KFEFXLZ.exe
  2⤵
  PID:6380
- C:\Windows\System\uttZvYB.exe
  C:\Windows\System\uttZvYB.exe
  2⤵
  PID:5680
- C:\Windows\System\WZRfMwt.exe
  C:\Windows\System\WZRfMwt.exe
  2⤵
  PID:6416
- C:\Windows\System\ablKreJ.exe
  C:\Windows\System\ablKreJ.exe
  2⤵
  PID:7052
- C:\Windows\System\DNMjoDT.exe
  C:\Windows\System\DNMjoDT.exe
  2⤵
  PID:7144
- C:\Windows\System\jCNDPCu.exe
  C:\Windows\System\jCNDPCu.exe
  2⤵
  PID:6724
- C:\Windows\System\qTPszHt.exe
  C:\Windows\System\qTPszHt.exe
  2⤵
  PID:6600
- C:\Windows\System\FMKQWMq.exe
  C:\Windows\System\FMKQWMq.exe
  2⤵
  PID:7020
- C:\Windows\System\FiFZLfs.exe
  C:\Windows\System\FiFZLfs.exe
  2⤵
  PID:6856
- C:\Windows\System\bNlWDxU.exe
  C:\Windows\System\bNlWDxU.exe
  2⤵
  PID:6268
- C:\Windows\System\zAdQsYE.exe
  C:\Windows\System\zAdQsYE.exe
  2⤵
  PID:6868
- C:\Windows\System\CaPgDtO.exe
  C:\Windows\System\CaPgDtO.exe
  2⤵
  PID:6920
- C:\Windows\System\vviEFZJ.exe
  C:\Windows\System\vviEFZJ.exe
  2⤵
  PID:6568
- C:\Windows\System\OyHraFx.exe
  C:\Windows\System\OyHraFx.exe
  2⤵
  PID:6448
- C:\Windows\System\iqTVmoY.exe
  C:\Windows\System\iqTVmoY.exe
  2⤵
  PID:6316
- C:\Windows\System\gdqYjSq.exe
  C:\Windows\System\gdqYjSq.exe
  2⤵
  PID:6488
- C:\Windows\System\imPnYxk.exe
  C:\Windows\System\imPnYxk.exe
  2⤵
  PID:7184
- C:\Windows\System\ZYTkexy.exe
  C:\Windows\System\ZYTkexy.exe
  2⤵
  PID:7200
- C:\Windows\System\ySrqRPW.exe
  C:\Windows\System\ySrqRPW.exe
  2⤵
  PID:7216
- C:\Windows\System\fLqSnIt.exe
  C:\Windows\System\fLqSnIt.exe
  2⤵
  PID:7232
- C:\Windows\System\IRvLoal.exe
  C:\Windows\System\IRvLoal.exe
  2⤵
  PID:7248
- C:\Windows\System\FgvMfgz.exe
  C:\Windows\System\FgvMfgz.exe
  2⤵
  PID:7272
- C:\Windows\System\HSRRJZI.exe
  C:\Windows\System\HSRRJZI.exe
  2⤵
  PID:7288
- C:\Windows\System\VhnIkaC.exe
  C:\Windows\System\VhnIkaC.exe
  2⤵
  PID:7344
- C:\Windows\System\nQgdoSD.exe
  C:\Windows\System\nQgdoSD.exe
  2⤵
  PID:7364
- C:\Windows\System\kbiDaBM.exe
  C:\Windows\System\kbiDaBM.exe
  2⤵
  PID:7384
- C:\Windows\System\YeqdalE.exe
  C:\Windows\System\YeqdalE.exe
  2⤵
  PID:7408
- C:\Windows\System\NcDugqA.exe
  C:\Windows\System\NcDugqA.exe
  2⤵
  PID:7424
- C:\Windows\System\BguWGJn.exe
  C:\Windows\System\BguWGJn.exe
  2⤵
  PID:7440
- C:\Windows\System\fhUawCA.exe
  C:\Windows\System\fhUawCA.exe
  2⤵
  PID:7456
- C:\Windows\System\zapoejL.exe
  C:\Windows\System\zapoejL.exe
  2⤵
  PID:7472
- C:\Windows\System\PgxpchP.exe
  C:\Windows\System\PgxpchP.exe
  2⤵
  PID:7492
- C:\Windows\System\vGLkvnr.exe
  C:\Windows\System\vGLkvnr.exe
  2⤵
  PID:7512
- C:\Windows\System\cHScNeB.exe
  C:\Windows\System\cHScNeB.exe
  2⤵
  PID:7528
- C:\Windows\System\TejsAzI.exe
  C:\Windows\System\TejsAzI.exe
  2⤵
  PID:7544
- C:\Windows\System\dXcyKcz.exe
  C:\Windows\System\dXcyKcz.exe
  2⤵
  PID:7568
- C:\Windows\System\tjtNoqp.exe
  C:\Windows\System\tjtNoqp.exe
  2⤵
  PID:7584
- C:\Windows\System\RysxPvO.exe
  C:\Windows\System\RysxPvO.exe
  2⤵
  PID:7600
- C:\Windows\System\ySiNJxA.exe
  C:\Windows\System\ySiNJxA.exe
  2⤵
  PID:7616
- C:\Windows\System\zGiVNkg.exe
  C:\Windows\System\zGiVNkg.exe
  2⤵
  PID:7632
- C:\Windows\System\bNcGrBa.exe
  C:\Windows\System\bNcGrBa.exe
  2⤵
  PID:7648
- C:\Windows\System\neJUAMi.exe
  C:\Windows\System\neJUAMi.exe
  2⤵
  PID:7664
- C:\Windows\System\NBaEEXO.exe
  C:\Windows\System\NBaEEXO.exe
  2⤵
  PID:7680
- C:\Windows\System\hbHeibK.exe
  C:\Windows\System\hbHeibK.exe
  2⤵
  PID:7696
- C:\Windows\System\HvpakXw.exe
  C:\Windows\System\HvpakXw.exe
  2⤵
  PID:7712
- C:\Windows\System\ilOphNC.exe
  C:\Windows\System\ilOphNC.exe
  2⤵
  PID:7732
- C:\Windows\System\MmTeMSD.exe
  C:\Windows\System\MmTeMSD.exe
  2⤵
  PID:7748
- C:\Windows\System\JFnaUew.exe
  C:\Windows\System\JFnaUew.exe
  2⤵
  PID:7764
- C:\Windows\System\UtXRVDs.exe
  C:\Windows\System\UtXRVDs.exe
  2⤵
  PID:7780
- C:\Windows\System\uOBLTTw.exe
  C:\Windows\System\uOBLTTw.exe
  2⤵
  PID:7796
- C:\Windows\System\vNsDfox.exe
  C:\Windows\System\vNsDfox.exe
  2⤵
  PID:7812
- C:\Windows\System\LFFJnve.exe
  C:\Windows\System\LFFJnve.exe
  2⤵
  PID:7832
- C:\Windows\System\yeuGQOI.exe
  C:\Windows\System\yeuGQOI.exe
  2⤵
  PID:7876
- C:\Windows\System\ZBMUJZU.exe
  C:\Windows\System\ZBMUJZU.exe
  2⤵
  PID:7904
- C:\Windows\System\ECbHTdA.exe
  C:\Windows\System\ECbHTdA.exe
  2⤵
  PID:7920
- C:\Windows\System\mWhgwgo.exe
  C:\Windows\System\mWhgwgo.exe
  2⤵
  PID:7936
- C:\Windows\System\GBpxTCg.exe
  C:\Windows\System\GBpxTCg.exe
  2⤵
  PID:7956
- C:\Windows\System\zGLOHxN.exe
  C:\Windows\System\zGLOHxN.exe
  2⤵
  PID:7972
- C:\Windows\System\WQjBVkA.exe
  C:\Windows\System\WQjBVkA.exe
  2⤵
  PID:7992
- C:\Windows\System\RDvDsKT.exe
  C:\Windows\System\RDvDsKT.exe
  2⤵
  PID:8008
- C:\Windows\System\toDSKue.exe
  C:\Windows\System\toDSKue.exe
  2⤵
  PID:8028
- C:\Windows\System\oVcmwBs.exe
  C:\Windows\System\oVcmwBs.exe
  2⤵
  PID:8044
- C:\Windows\System\UIymLqp.exe
  C:\Windows\System\UIymLqp.exe
  2⤵
  PID:8060
- C:\Windows\System\FjVRXDv.exe
  C:\Windows\System\FjVRXDv.exe
  2⤵
  PID:8088
- C:\Windows\System\giqwIGE.exe
  C:\Windows\System\giqwIGE.exe
  2⤵
  PID:8104
- C:\Windows\System\tydbicG.exe
  C:\Windows\System\tydbicG.exe
  2⤵
  PID:8120
- C:\Windows\System\MJgdPfV.exe
  C:\Windows\System\MJgdPfV.exe
  2⤵
  PID:8136
- C:\Windows\System\ViPCmbB.exe
  C:\Windows\System\ViPCmbB.exe
  2⤵
  PID:8152
- C:\Windows\System\HBixcZf.exe
  C:\Windows\System\HBixcZf.exe
  2⤵
  PID:8168
- C:\Windows\System\wkYLNRQ.exe
  C:\Windows\System\wkYLNRQ.exe
  2⤵
  PID:8184
- C:\Windows\System\ohUBZnK.exe
  C:\Windows\System\ohUBZnK.exe
  2⤵
  PID:7180
- C:\Windows\System\MicSpkZ.exe
  C:\Windows\System\MicSpkZ.exe
  2⤵
  PID:7212
- C:\Windows\System\TfVhHlK.exe
  C:\Windows\System\TfVhHlK.exe
  2⤵
  PID:5784
- C:\Windows\System\GkAlOoL.exe
  C:\Windows\System\GkAlOoL.exe
  2⤵
  PID:7104
- C:\Windows\System\uayLUJk.exe
  C:\Windows\System\uayLUJk.exe
  2⤵
  PID:7196
- C:\Windows\System\UQZqqnd.exe
  C:\Windows\System\UQZqqnd.exe
  2⤵
  PID:7296
- C:\Windows\System\yeCDHpy.exe
  C:\Windows\System\yeCDHpy.exe
  2⤵
  PID:7360
- C:\Windows\System\qbPZIqS.exe
  C:\Windows\System\qbPZIqS.exe
  2⤵
  PID:7432
- C:\Windows\System\KsxLNnZ.exe
  C:\Windows\System\KsxLNnZ.exe
  2⤵
  PID:7308
- C:\Windows\System\EidnAxJ.exe
  C:\Windows\System\EidnAxJ.exe
  2⤵
  PID:7380
- C:\Windows\System\YOILURl.exe
  C:\Windows\System\YOILURl.exe
  2⤵
  PID:7340
- C:\Windows\System\nbZSoKS.exe
  C:\Windows\System\nbZSoKS.exe
  2⤵
  PID:7540
- C:\Windows\System\ZqdzUhJ.exe
  C:\Windows\System\ZqdzUhJ.exe
  2⤵
  PID:7484
- C:\Windows\System\uiWxyfu.exe
  C:\Windows\System\uiWxyfu.exe
  2⤵
  PID:7612
- C:\Windows\System\TPbNPsI.exe
  C:\Windows\System\TPbNPsI.exe
  2⤵
  PID:7676
- C:\Windows\System\cGgqwRI.exe
  C:\Windows\System\cGgqwRI.exe
  2⤵
  PID:7480
- C:\Windows\System\MNpmKKJ.exe
  C:\Windows\System\MNpmKKJ.exe
  2⤵
  PID:7624
- C:\Windows\System\evDueFz.exe
  C:\Windows\System\evDueFz.exe
  2⤵
  PID:7688
- C:\Windows\System\iQqFfxX.exe
  C:\Windows\System\iQqFfxX.exe
  2⤵
  PID:7724
- C:\Windows\System\UtxOeoL.exe
  C:\Windows\System\UtxOeoL.exe
  2⤵
  PID:7740
- C:\Windows\System\NFwcrNB.exe
  C:\Windows\System\NFwcrNB.exe
  2⤵
  PID:7804
- C:\Windows\System\vBodCOL.exe
  C:\Windows\System\vBodCOL.exe
  2⤵
  PID:7916
- C:\Windows\System\bEMwAxp.exe
  C:\Windows\System\bEMwAxp.exe
  2⤵
  PID:7756
- C:\Windows\System\rCvySBF.exe
  C:\Windows\System\rCvySBF.exe
  2⤵
  PID:7852
- C:\Windows\System\jSnXGob.exe
  C:\Windows\System\jSnXGob.exe
  2⤵
  PID:8020
- C:\Windows\System\wdoGKab.exe
  C:\Windows\System\wdoGKab.exe
  2⤵
  PID:7888
- C:\Windows\System\hLlwlzR.exe
  C:\Windows\System\hLlwlzR.exe
  2⤵
  PID:7968
- C:\Windows\System\oBVdlhW.exe
  C:\Windows\System\oBVdlhW.exe
  2⤵
  PID:8052
- C:\Windows\System\kEWRRWc.exe
  C:\Windows\System\kEWRRWc.exe
  2⤵
  PID:7928
- C:\Windows\System\SlmZrVt.exe
  C:\Windows\System\SlmZrVt.exe
  2⤵
  PID:8100
- C:\Windows\System\pdOaJmZ.exe
  C:\Windows\System\pdOaJmZ.exe
  2⤵
  PID:8160
- C:\Windows\System\xdZKKfo.exe
  C:\Windows\System\xdZKKfo.exe
  2⤵
  PID:8080
- C:\Windows\System\hFywrER.exe
  C:\Windows\System\hFywrER.exe
  2⤵
  PID:8148
- C:\Windows\System\YTlkIUZ.exe
  C:\Windows\System\YTlkIUZ.exe
  2⤵
  PID:6164
- C:\Windows\System\fJFYSnl.exe
  C:\Windows\System\fJFYSnl.exe
  2⤵
  PID:7356
- C:\Windows\System\RNiuzzH.exe
  C:\Windows\System\RNiuzzH.exe
  2⤵
  PID:7464
- C:\Windows\System\YbmYkJF.exe
  C:\Windows\System\YbmYkJF.exe
  2⤵
  PID:7268
- C:\Windows\System\vhroZDZ.exe
  C:\Windows\System\vhroZDZ.exe
  2⤵
  PID:7320
- C:\Windows\System\FKiUukL.exe
  C:\Windows\System\FKiUukL.exe
  2⤵
  PID:7564
- C:\Windows\System\IFyGKJV.exe
  C:\Windows\System\IFyGKJV.exe
  2⤵
  PID:7372
- C:\Windows\System\TPKseRi.exe
  C:\Windows\System\TPKseRi.exe
  2⤵
  PID:7708
- C:\Windows\System\pYlXufY.exe
  C:\Windows\System\pYlXufY.exe
  2⤵
  PID:7948
- C:\Windows\System\ZyzrNQZ.exe
  C:\Windows\System\ZyzrNQZ.exe
  2⤵
  PID:7792
- C:\Windows\System\ZWKfXrE.exe
  C:\Windows\System\ZWKfXrE.exe
  2⤵
  PID:8056
- C:\Windows\System\kDmrZSZ.exe
  C:\Windows\System\kDmrZSZ.exe
  2⤵
  PID:7228
- C:\Windows\System\gyaepSM.exe
  C:\Windows\System\gyaepSM.exe
  2⤵
  PID:8164
- C:\Windows\System\rxiOVSn.exe
  C:\Windows\System\rxiOVSn.exe
  2⤵
  PID:7504
- C:\Windows\System\AYTrPjE.exe
  C:\Windows\System\AYTrPjE.exe
  2⤵
  PID:6716
- C:\Windows\System\yHeqyMx.exe
  C:\Windows\System\yHeqyMx.exe
  2⤵
  PID:7448
- C:\Windows\System\aEuOCPM.exe
  C:\Windows\System\aEuOCPM.exe
  2⤵
  PID:7772
- C:\Windows\System\oUiMogK.exe
  C:\Windows\System\oUiMogK.exe
  2⤵
  PID:7336
- C:\Windows\System\FIUJTuL.exe
  C:\Windows\System\FIUJTuL.exe
  2⤵
  PID:7592
- C:\Windows\System\OESczic.exe
  C:\Windows\System\OESczic.exe
  2⤵
  PID:7840
- C:\Windows\System\CAmfCcd.exe
  C:\Windows\System\CAmfCcd.exe
  2⤵
  PID:1356
- C:\Windows\System\BXunfOr.exe
  C:\Windows\System\BXunfOr.exe
  2⤵
  PID:8004
- C:\Windows\System\OZvOhAW.exe
  C:\Windows\System\OZvOhAW.exe
  2⤵
  PID:8068
- C:\Windows\System\PwICDzb.exe
  C:\Windows\System\PwICDzb.exe
  2⤵
  PID:7820
- C:\Windows\System\btwQrqL.exe
  C:\Windows\System\btwQrqL.exe
  2⤵
  PID:8132
- C:\Windows\System\eQGxuzl.exe
  C:\Windows\System\eQGxuzl.exe
  2⤵
  PID:7884
- C:\Windows\System\NeTSICj.exe
  C:\Windows\System\NeTSICj.exe
  2⤵
  PID:8180
- C:\Windows\System\fezOTCv.exe
  C:\Windows\System\fezOTCv.exe
  2⤵
  PID:6800
- C:\Windows\System\EmpMSSR.exe
  C:\Windows\System\EmpMSSR.exe
  2⤵
  PID:7240
- C:\Windows\System\YYiLGET.exe
  C:\Windows\System\YYiLGET.exe
  2⤵
  PID:6948
- C:\Windows\System\IUgClHZ.exe
  C:\Windows\System\IUgClHZ.exe
  2⤵
  PID:7352
- C:\Windows\System\UejXJcf.exe
  C:\Windows\System\UejXJcf.exe
  2⤵
  PID:7952
- C:\Windows\System\gXVxfxN.exe
  C:\Windows\System\gXVxfxN.exe
  2⤵
  PID:7872
- C:\Windows\System\BGOWZjP.exe
  C:\Windows\System\BGOWZjP.exe
  2⤵
  PID:7520
- C:\Windows\System\HXaHpDP.exe
  C:\Windows\System\HXaHpDP.exe
  2⤵
  PID:8000
- C:\Windows\System\lYcURwK.exe
  C:\Windows\System\lYcURwK.exe
  2⤵
  PID:7984
- C:\Windows\System\yiUpZVs.exe
  C:\Windows\System\yiUpZVs.exe
  2⤵
  PID:7536
- C:\Windows\System\HAVtxvH.exe
  C:\Windows\System\HAVtxvH.exe
  2⤵
  PID:368
- C:\Windows\System\dmnJvNW.exe
  C:\Windows\System\dmnJvNW.exe
  2⤵
  PID:8200
- C:\Windows\System\fUaOowy.exe
  C:\Windows\System\fUaOowy.exe
  2⤵
  PID:8216
- C:\Windows\System\ZaPHIRM.exe
  C:\Windows\System\ZaPHIRM.exe
  2⤵
  PID:8232
- C:\Windows\System\MgGmhMp.exe
  C:\Windows\System\MgGmhMp.exe
  2⤵
  PID:8248
- C:\Windows\System\rBulTYu.exe
  C:\Windows\System\rBulTYu.exe
  2⤵
  PID:8272
- C:\Windows\System\HSQqcuy.exe
  C:\Windows\System\HSQqcuy.exe
  2⤵
  PID:8288
- C:\Windows\System\JugtjyV.exe
  C:\Windows\System\JugtjyV.exe
  2⤵
  PID:8304
- C:\Windows\System\MEuvmQU.exe
  C:\Windows\System\MEuvmQU.exe
  2⤵
  PID:8320
- C:\Windows\System\vdKyzEs.exe
  C:\Windows\System\vdKyzEs.exe
  2⤵
  PID:8336
- C:\Windows\System\jobsHjl.exe
  C:\Windows\System\jobsHjl.exe
  2⤵
  PID:8352
- C:\Windows\System\sxlsEZB.exe
  C:\Windows\System\sxlsEZB.exe
  2⤵
  PID:8368
- C:\Windows\System\WBkPfzZ.exe
  C:\Windows\System\WBkPfzZ.exe
  2⤵
  PID:8384
- C:\Windows\System\YvjKuxn.exe
  C:\Windows\System\YvjKuxn.exe
  2⤵
  PID:8400
- C:\Windows\System\pZuxpkA.exe
  C:\Windows\System\pZuxpkA.exe
  2⤵
  PID:8416
- C:\Windows\System\AaZuRCM.exe
  C:\Windows\System\AaZuRCM.exe
  2⤵
  PID:8432
- C:\Windows\System\qHhBhZB.exe
  C:\Windows\System\qHhBhZB.exe
  2⤵
  PID:8448
- C:\Windows\System\eJSJBzV.exe
  C:\Windows\System\eJSJBzV.exe
  2⤵
  PID:8464
- C:\Windows\System\wxzedpN.exe
  C:\Windows\System\wxzedpN.exe
  2⤵
  PID:8480
- C:\Windows\System\npPYRgj.exe
  C:\Windows\System\npPYRgj.exe
  2⤵
  PID:8700
- C:\Windows\System\PiuOnGl.exe
  C:\Windows\System\PiuOnGl.exe
  2⤵
  PID:8856
- C:\Windows\System\dbmytSL.exe
  C:\Windows\System\dbmytSL.exe
  2⤵
  PID:8876
- C:\Windows\System\UzGkYQI.exe
  C:\Windows\System\UzGkYQI.exe
  2⤵
  PID:8892
- C:\Windows\System\qMIaeMh.exe
  C:\Windows\System\qMIaeMh.exe
  2⤵
  PID:8908
- C:\Windows\System\URaeFYq.exe
  C:\Windows\System\URaeFYq.exe
  2⤵
  PID:8924
- C:\Windows\System\xdfeevQ.exe
  C:\Windows\System\xdfeevQ.exe
  2⤵
  PID:9012
- C:\Windows\System\hrpkOgn.exe
  C:\Windows\System\hrpkOgn.exe
  2⤵
  PID:9028
- C:\Windows\System\ngnKLVY.exe
  C:\Windows\System\ngnKLVY.exe
  2⤵
  PID:9044
- C:\Windows\System\WLiRXEA.exe
  C:\Windows\System\WLiRXEA.exe
  2⤵
  PID:9060
- C:\Windows\System\MLVpicq.exe
  C:\Windows\System\MLVpicq.exe
  2⤵
  PID:9080
- C:\Windows\System\PSiXKyT.exe
  C:\Windows\System\PSiXKyT.exe
  2⤵
  PID:9096
- C:\Windows\System\BcBFmKP.exe
  C:\Windows\System\BcBFmKP.exe
  2⤵
  PID:9112
- C:\Windows\System\AUzKUmG.exe
  C:\Windows\System\AUzKUmG.exe
  2⤵
  PID:9128
- C:\Windows\System\dqiZTou.exe
  C:\Windows\System\dqiZTou.exe
  2⤵
  PID:9148
- C:\Windows\System\GnsndGR.exe
  C:\Windows\System\GnsndGR.exe
  2⤵
  PID:9172
- C:\Windows\System\XuOJwND.exe
  C:\Windows\System\XuOJwND.exe
  2⤵
  PID:7552
- C:\Windows\System\aUmGcNA.exe
  C:\Windows\System\aUmGcNA.exe
  2⤵
  PID:7468
- C:\Windows\System\tWugDfV.exe
  C:\Windows\System\tWugDfV.exe
  2⤵
  PID:7192
- C:\Windows\System\UnRVNHE.exe
  C:\Windows\System\UnRVNHE.exe
  2⤵
  PID:8224
- C:\Windows\System\xhkWgsc.exe
  C:\Windows\System\xhkWgsc.exe
  2⤵
  PID:8348
- C:\Windows\System\QocrmID.exe
  C:\Windows\System\QocrmID.exe
  2⤵
  PID:8328
- C:\Windows\System\XnHgnQj.exe
  C:\Windows\System\XnHgnQj.exe
  2⤵
  PID:8652
- C:\Windows\System\yHPiAgO.exe
  C:\Windows\System\yHPiAgO.exe
  2⤵
  PID:8680
- C:\Windows\System\nVpHLQc.exe
  C:\Windows\System\nVpHLQc.exe
  2⤵
  PID:8684
- C:\Windows\System\JkJZUuC.exe
  C:\Windows\System\JkJZUuC.exe
  2⤵
  PID:8692
- C:\Windows\System\NhPpfbd.exe
  C:\Windows\System\NhPpfbd.exe
  2⤵
  PID:8712
- C:\Windows\System\FUvmqve.exe
  C:\Windows\System\FUvmqve.exe
  2⤵
  PID:8728
- C:\Windows\System\brNpCAZ.exe
  C:\Windows\System\brNpCAZ.exe
  2⤵
  PID:8744
- C:\Windows\System\nCsJUjo.exe
  C:\Windows\System\nCsJUjo.exe
  2⤵
  PID:8768
- C:\Windows\System\XGyvPyH.exe
  C:\Windows\System\XGyvPyH.exe
  2⤵
  PID:8792
- C:\Windows\System\fDCZeNn.exe
  C:\Windows\System\fDCZeNn.exe
  2⤵
  PID:8812
- C:\Windows\System\ffFcrPs.exe
  C:\Windows\System\ffFcrPs.exe
  2⤵
  PID:8920
- C:\Windows\System\AnmtxMd.exe
  C:\Windows\System\AnmtxMd.exe
  2⤵
  PID:9052
- C:\Windows\System\fdXtmpF.exe
  C:\Windows\System\fdXtmpF.exe
  2⤵
  PID:9092
- C:\Windows\System\ovQYpPz.exe
  C:\Windows\System\ovQYpPz.exe
  2⤵
  PID:8900
- C:\Windows\System\SzMQcVn.exe
  C:\Windows\System\SzMQcVn.exe
  2⤵
  PID:8964
- C:\Windows\System\rOhyZdQ.exe
  C:\Windows\System\rOhyZdQ.exe
  2⤵
  PID:9108
- C:\Windows\System\ERYuOoN.exe
  C:\Windows\System\ERYuOoN.exe
  2⤵
  PID:8960
- C:\Windows\System\FmlYaWO.exe
  C:\Windows\System\FmlYaWO.exe
  2⤵
  PID:8992
- C:\Windows\System\taEwSOe.exe
  C:\Windows\System\taEwSOe.exe
  2⤵
  PID:9072
- C:\Windows\System\OWAFlrz.exe
  C:\Windows\System\OWAFlrz.exe
  2⤵
  PID:8656
- C:\Windows\System\ZtLGrkr.exe
  C:\Windows\System\ZtLGrkr.exe
  2⤵
  PID:8240
- C:\Windows\System\wEfMUHI.exe
  C:\Windows\System\wEfMUHI.exe
  2⤵
  PID:7300
- C:\Windows\System\wSwzjBZ.exe
  C:\Windows\System\wSwzjBZ.exe
  2⤵
  PID:8408
- C:\Windows\System\tBbwDtd.exe
  C:\Windows\System\tBbwDtd.exe
  2⤵
  PID:8444
- C:\Windows\System\kVQmsAl.exe
  C:\Windows\System\kVQmsAl.exe
  2⤵
  PID:9180
- C:\Windows\System\qghgmtL.exe
  C:\Windows\System\qghgmtL.exe
  2⤵
  PID:9200
- C:\Windows\System\oibiAxE.exe
  C:\Windows\System\oibiAxE.exe
  2⤵
  PID:8668
- C:\Windows\System\NmQHAXI.exe
  C:\Windows\System\NmQHAXI.exe
  2⤵
  PID:2420
- C:\Windows\System\AaNMQbL.exe
  C:\Windows\System\AaNMQbL.exe
  2⤵
  PID:8504
- C:\Windows\System\ZAzznzv.exe
  C:\Windows\System\ZAzznzv.exe
  2⤵
  PID:7556
- C:\Windows\System\vgmgpLm.exe
  C:\Windows\System\vgmgpLm.exe
  2⤵
  PID:7728
- C:\Windows\System\PwodQoo.exe
  C:\Windows\System\PwodQoo.exe
  2⤵
  PID:8300
- C:\Windows\System\SZwgbni.exe
  C:\Windows\System\SZwgbni.exe
  2⤵
  PID:8264
- C:\Windows\System\AxzZHaD.exe
  C:\Windows\System\AxzZHaD.exe
  2⤵
  PID:8516
- C:\Windows\System\YJaVFeM.exe
  C:\Windows\System\YJaVFeM.exe
  2⤵
  PID:8760
- C:\Windows\System\lYOjlJz.exe
  C:\Windows\System\lYOjlJz.exe
  2⤵
  PID:7788
- C:\Windows\System\TvLxKHk.exe
  C:\Windows\System\TvLxKHk.exe
  2⤵
  PID:8788
- C:\Windows\System\sRdkKnS.exe
  C:\Windows\System\sRdkKnS.exe
  2⤵
  PID:8568
- C:\Windows\System\YNXtJsQ.exe
  C:\Windows\System\YNXtJsQ.exe
  2⤵
  PID:8624
- C:\Windows\System\WZIrpzR.exe
  C:\Windows\System\WZIrpzR.exe
  2⤵
  PID:8268
- C:\Windows\System\lMWheAX.exe
  C:\Windows\System\lMWheAX.exe
  2⤵
  PID:8740
- C:\Windows\System\LIdagwu.exe
  C:\Windows\System\LIdagwu.exe
  2⤵
  PID:8364
- C:\Windows\System\jgQtmfE.exe
  C:\Windows\System\jgQtmfE.exe
  2⤵
  PID:8500
- C:\Windows\System\wJpqoAM.exe
  C:\Windows\System\wJpqoAM.exe
  2⤵
  PID:8548
- C:\Windows\System\nQabFfC.exe
  C:\Windows\System\nQabFfC.exe
  2⤵
  PID:8836
- C:\Windows\System\ATTiZpl.exe
  C:\Windows\System\ATTiZpl.exe
  2⤵
  PID:8620
- C:\Windows\System\LvnJniJ.exe
  C:\Windows\System\LvnJniJ.exe
  2⤵
  PID:8596
- C:\Windows\System\slwidvH.exe
  C:\Windows\System\slwidvH.exe
  2⤵
  PID:8708
- C:\Windows\System\JPpLIFL.exe
  C:\Windows\System\JPpLIFL.exe
  2⤵
  PID:8844
- C:\Windows\System\HNKgQNm.exe
  C:\Windows\System\HNKgQNm.exe
  2⤵
  PID:8888
- C:\Windows\System\DXTltcL.exe
  C:\Windows\System\DXTltcL.exe
  2⤵
  PID:9020
- C:\Windows\System\BBIXlwt.exe
  C:\Windows\System\BBIXlwt.exe
  2⤵
  PID:8988
- C:\Windows\System\VZzntJQ.exe
  C:\Windows\System\VZzntJQ.exe
  2⤵
  PID:9076
- C:\Windows\System\hOXUafk.exe
  C:\Windows\System\hOXUafk.exe
  2⤵
  PID:8824
- C:\Windows\System\WEeEAAn.exe
  C:\Windows\System\WEeEAAn.exe
  2⤵
  PID:8256
- C:\Windows\System\dMuxpRa.exe
  C:\Windows\System\dMuxpRa.exe
  2⤵
  PID:8868
- C:\Windows\System\GHvOHGW.exe
  C:\Windows\System\GHvOHGW.exe
  2⤵
  PID:9164
- C:\Windows\System\EuUxngN.exe
  C:\Windows\System\EuUxngN.exe
  2⤵
  PID:8196
- C:\Windows\System\nDCeONI.exe
  C:\Windows\System\nDCeONI.exe
  2⤵
  PID:9156
- C:\Windows\System\GjXsgVe.exe
  C:\Windows\System\GjXsgVe.exe
  2⤵
  PID:9168
- C:\Windows\System\zZEFLle.exe
  C:\Windows\System\zZEFLle.exe
  2⤵
  PID:8260
- C:\Windows\System\DTRVerq.exe
  C:\Windows\System\DTRVerq.exe
  2⤵
  PID:9104
- C:\Windows\System\RZGwaJr.exe
  C:\Windows\System\RZGwaJr.exe
  2⤵
  PID:7332
- C:\Windows\System\ExZHurj.exe
  C:\Windows\System\ExZHurj.exe
  2⤵
  PID:8316
- C:\Windows\System\VcUnUdx.exe
  C:\Windows\System\VcUnUdx.exe
  2⤵
  PID:8852
- C:\Windows\System\nerSOhk.exe
  C:\Windows\System\nerSOhk.exe
  2⤵
  PID:7316
- C:\Windows\System\iFXdcut.exe
  C:\Windows\System\iFXdcut.exe
  2⤵
  PID:8800
- C:\Windows\System\udEMEDo.exe
  C:\Windows\System\udEMEDo.exe
  2⤵
  PID:8780
- C:\Windows\System\ixckaiY.exe
  C:\Windows\System\ixckaiY.exe
  2⤵
  PID:8604
- C:\Windows\System\lpsHwrz.exe
  C:\Windows\System\lpsHwrz.exe
  2⤵
  PID:9220
- C:\Windows\System\PKlyDcQ.exe
  C:\Windows\System\PKlyDcQ.exe
  2⤵
  PID:9240
- C:\Windows\System\GYVHEFz.exe
  C:\Windows\System\GYVHEFz.exe
  2⤵
  PID:9260
- C:\Windows\System\cgvfbbL.exe
  C:\Windows\System\cgvfbbL.exe
  2⤵
  PID:9284
- C:\Windows\System\RZidxoT.exe
  C:\Windows\System\RZidxoT.exe
  2⤵
  PID:9420
- C:\Windows\System\csKXTIB.exe
  C:\Windows\System\csKXTIB.exe
  2⤵
  PID:9496
- C:\Windows\System\poraHbo.exe
  C:\Windows\System\poraHbo.exe
  2⤵
  PID:9516
- C:\Windows\System\SoWkfFc.exe
  C:\Windows\System\SoWkfFc.exe
  2⤵
  PID:9536
- C:\Windows\System\eONxYsW.exe
  C:\Windows\System\eONxYsW.exe
  2⤵
  PID:9560
- C:\Windows\System\kRfiLvP.exe
  C:\Windows\System\kRfiLvP.exe
  2⤵
  PID:9584
- C:\Windows\System\MrHcXeu.exe
  C:\Windows\System\MrHcXeu.exe
  2⤵
  PID:9608
- C:\Windows\System\sbgVtsb.exe
  C:\Windows\System\sbgVtsb.exe
  2⤵
  PID:9624
- C:\Windows\System\YFhSKKV.exe
  C:\Windows\System\YFhSKKV.exe
  2⤵
  PID:9776
- C:\Windows\System\stSbXiz.exe
  C:\Windows\System\stSbXiz.exe
  2⤵
  PID:9792
- C:\Windows\System\LjGuObJ.exe
  C:\Windows\System\LjGuObJ.exe
  2⤵
  PID:9808
- C:\Windows\System\ZuuNuGU.exe
  C:\Windows\System\ZuuNuGU.exe
  2⤵
  PID:9824
- C:\Windows\System\ScymldL.exe
  C:\Windows\System\ScymldL.exe
  2⤵
  PID:9840
- C:\Windows\System\hzcbatd.exe
  C:\Windows\System\hzcbatd.exe
  2⤵
  PID:9856
- C:\Windows\System\UCfjstD.exe
  C:\Windows\System\UCfjstD.exe
  2⤵
  PID:9232
- C:\Windows\System\bBFnCai.exe
  C:\Windows\System\bBFnCai.exe
  2⤵
  PID:1492
- C:\Windows\System\OKanPbh.exe
  C:\Windows\System\OKanPbh.exe
  2⤵
  PID:9448
- C:\Windows\System\dwmOTXN.exe
  C:\Windows\System\dwmOTXN.exe
  2⤵
  PID:9464
- C:\Windows\System\RezOpod.exe
  C:\Windows\System\RezOpod.exe
  2⤵
  PID:9480
- C:\Windows\System\zKnPioN.exe
  C:\Windows\System\zKnPioN.exe
  2⤵
  PID:9524
- C:\Windows\System\isvazKB.exe
  C:\Windows\System\isvazKB.exe
  2⤵
  PID:9576
- C:\Windows\System\pmkplQT.exe
  C:\Windows\System\pmkplQT.exe
  2⤵
  PID:10332
- C:\Windows\System\nfUAKKB.exe
  C:\Windows\System\nfUAKKB.exe
  2⤵
  PID:10364
- C:\Windows\System\pmTsqFX.exe
  C:\Windows\System\pmTsqFX.exe
  2⤵
  PID:10380
- C:\Windows\System\mKCTTql.exe
  C:\Windows\System\mKCTTql.exe
  2⤵
  PID:10396
- C:\Windows\System\ZVyzWEI.exe
  C:\Windows\System\ZVyzWEI.exe
  2⤵
  PID:10412
- C:\Windows\System\ILFEBhi.exe
  C:\Windows\System\ILFEBhi.exe
  2⤵
  PID:10428
- C:\Windows\System\bDyhFqJ.exe
  C:\Windows\System\bDyhFqJ.exe
  2⤵
  PID:10748
- C:\Windows\System\TIQZkZG.exe
  C:\Windows\System\TIQZkZG.exe
  2⤵
  PID:10764
- C:\Windows\System\YNlzEBa.exe
  C:\Windows\System\YNlzEBa.exe
  2⤵
  PID:10780
- C:\Windows\System\QSCZRmu.exe
  C:\Windows\System\QSCZRmu.exe
  2⤵
  PID:10796
- C:\Windows\System\ItvIhhQ.exe
  C:\Windows\System\ItvIhhQ.exe
  2⤵
  PID:10820
- C:\Windows\System\QxfWPnF.exe
  C:\Windows\System\QxfWPnF.exe
  2⤵
  PID:10852
- C:\Windows\System\FSPTQLO.exe
  C:\Windows\System\FSPTQLO.exe
  2⤵
  PID:10868
- C:\Windows\System\hOcJepa.exe
  C:\Windows\System\hOcJepa.exe
  2⤵
  PID:10988
- C:\Windows\System\vwgwZiN.exe
  C:\Windows\System\vwgwZiN.exe
  2⤵
  PID:11028
- C:\Windows\System\rsgSnpm.exe
  C:\Windows\System\rsgSnpm.exe
  2⤵
  PID:11044
- C:\Windows\System\SEnnlsr.exe
  C:\Windows\System\SEnnlsr.exe
  2⤵
  PID:11060
- C:\Windows\System\xENDlSh.exe
  C:\Windows\System\xENDlSh.exe
  2⤵
  PID:11076
- C:\Windows\System\wNErUnJ.exe
  C:\Windows\System\wNErUnJ.exe
  2⤵
  PID:11232
- C:\Windows\System\rRugGPF.exe
  C:\Windows\System\rRugGPF.exe
  2⤵
  PID:1480
- C:\Windows\System\hZzweky.exe
  C:\Windows\System\hZzweky.exe
  2⤵
  PID:9616
- C:\Windows\System\ANuLhAU.exe
  C:\Windows\System\ANuLhAU.exe
  2⤵
  PID:9004
- C:\Windows\System\UZDuHvT.exe
  C:\Windows\System\UZDuHvT.exe
  2⤵
  PID:8640
- C:\Windows\System\jHNmPaj.exe
  C:\Windows\System\jHNmPaj.exe
  2⤵
  PID:8528
- C:\Windows\System\HJRlQNu.exe
  C:\Windows\System\HJRlQNu.exe
  2⤵
  PID:8840
- C:\Windows\System\zErMqpz.exe
  C:\Windows\System\zErMqpz.exe
  2⤵
  PID:9332
- C:\Windows\System\jKhZsDB.exe
  C:\Windows\System\jKhZsDB.exe
  2⤵
  PID:9340
- C:\Windows\System\DwPkQvB.exe
  C:\Windows\System\DwPkQvB.exe
  2⤵
  PID:9356
- C:\Windows\System\hrIQbdk.exe
  C:\Windows\System\hrIQbdk.exe
  2⤵
  PID:8380
- C:\Windows\System\KHIEhwe.exe
  C:\Windows\System\KHIEhwe.exe
  2⤵
  PID:9800
- C:\Windows\System\PqVGGAw.exe
  C:\Windows\System\PqVGGAw.exe
  2⤵
  PID:9368
- C:\Windows\System\PBODhSm.exe
  C:\Windows\System\PBODhSm.exe
  2⤵
  PID:9380
- C:\Windows\System\tzhUUBd.exe
  C:\Windows\System\tzhUUBd.exe
  2⤵
  PID:9396
- C:\Windows\System\helounV.exe
  C:\Windows\System\helounV.exe
  2⤵
  PID:10288
- C:\Windows\System\kShEjgp.exe
  C:\Windows\System\kShEjgp.exe
  2⤵
  PID:10308
- C:\Windows\System\eBFyAkC.exe
  C:\Windows\System\eBFyAkC.exe
  2⤵
  PID:9416
- C:\Windows\System\KAITZVP.exe
  C:\Windows\System\KAITZVP.exe
  2⤵
  PID:9552
- C:\Windows\System\GLTRHHd.exe
  C:\Windows\System\GLTRHHd.exe
  2⤵
  PID:9596
- C:\Windows\System\ZJhgJdv.exe
  C:\Windows\System\ZJhgJdv.exe
  2⤵
  PID:9636
- C:\Windows\System\wweVaTz.exe
  C:\Windows\System\wweVaTz.exe
  2⤵
  PID:9656
- C:\Windows\System\rDCcHju.exe
  C:\Windows\System\rDCcHju.exe
  2⤵
  PID:9676
- C:\Windows\System\DIAUItG.exe
  C:\Windows\System\DIAUItG.exe
  2⤵
  PID:9688
- C:\Windows\System\cPUUMfN.exe
  C:\Windows\System\cPUUMfN.exe
  2⤵
  PID:9704
- C:\Windows\System\seIUrZU.exe
  C:\Windows\System\seIUrZU.exe
  2⤵
  PID:9716
- C:\Windows\System\fcRXuff.exe
  C:\Windows\System\fcRXuff.exe
  2⤵
  PID:9724
- C:\Windows\System\htoWSyN.exe
  C:\Windows\System\htoWSyN.exe
  2⤵
  PID:9736
- C:\Windows\System\zlUfVqH.exe
  C:\Windows\System\zlUfVqH.exe
  2⤵
  PID:9752
- C:\Windows\System\PiSMmkM.exe
  C:\Windows\System\PiSMmkM.exe
  2⤵
  PID:9768
- C:\Windows\System\KZDnMwT.exe
  C:\Windows\System\KZDnMwT.exe
  2⤵
  PID:9832
- C:\Windows\System\bkzHdAQ.exe
  C:\Windows\System\bkzHdAQ.exe
  2⤵
  PID:9888
- C:\Windows\System\vWhqBTo.exe
  C:\Windows\System\vWhqBTo.exe
  2⤵
  PID:9908
- C:\Windows\System\ortMBTk.exe
  C:\Windows\System\ortMBTk.exe
  2⤵
  PID:9924
- C:\Windows\System\lbuaFOh.exe
  C:\Windows\System\lbuaFOh.exe
  2⤵
  PID:9936
- C:\Windows\System\byUmNqi.exe
  C:\Windows\System\byUmNqi.exe
  2⤵
  PID:9960
- C:\Windows\System\quIoMBG.exe
  C:\Windows\System\quIoMBG.exe
  2⤵
  PID:9976
- C:\Windows\System\AaqBjSy.exe
  C:\Windows\System\AaqBjSy.exe
  2⤵
  PID:9992
- C:\Windows\System\GVJNKLH.exe
  C:\Windows\System\GVJNKLH.exe
  2⤵
  PID:10012
- C:\Windows\System\iVSJhqO.exe
  C:\Windows\System\iVSJhqO.exe
  2⤵
  PID:9360
- C:\Windows\System\xzrdCOW.exe
  C:\Windows\System\xzrdCOW.exe
  2⤵
  PID:10044
- C:\Windows\System\goehFzU.exe
  C:\Windows\System\goehFzU.exe
  2⤵
  PID:10060
- C:\Windows\System\fiAGiKK.exe
  C:\Windows\System\fiAGiKK.exe
  2⤵
  PID:10076
- C:\Windows\System\QiCrLtJ.exe
  C:\Windows\System\QiCrLtJ.exe
  2⤵
  PID:10092
- C:\Windows\System\bRHKPpU.exe
  C:\Windows\System\bRHKPpU.exe
  2⤵
  PID:10108
- C:\Windows\System\oIAksNH.exe
  C:\Windows\System\oIAksNH.exe
  2⤵
  PID:10124
- C:\Windows\System\fmXovAO.exe
  C:\Windows\System\fmXovAO.exe
  2⤵
  PID:10140
- C:\Windows\System\xtHfcsO.exe
  C:\Windows\System\xtHfcsO.exe
  2⤵
  PID:10156
- C:\Windows\System\HVmWuie.exe
  C:\Windows\System\HVmWuie.exe
  2⤵
  PID:10176
- C:\Windows\System\OispSDQ.exe
  C:\Windows\System\OispSDQ.exe
  2⤵
  PID:10348
- C:\Windows\System\lskdycU.exe
  C:\Windows\System\lskdycU.exe
  2⤵
  PID:10204
- C:\Windows\System\aYFxCFN.exe
  C:\Windows\System\aYFxCFN.exe
  2⤵
  PID:10216
- C:\Windows\System\FSEdYnq.exe
  C:\Windows\System\FSEdYnq.exe
  2⤵
  PID:10236
- C:\Windows\System\iHstfZh.exe
  C:\Windows\System\iHstfZh.exe
  2⤵
  PID:8392
- C:\Windows\System\YScGkWv.exe
  C:\Windows\System\YScGkWv.exe
  2⤵
  PID:9000
- C:\Windows\System\QeHuhej.exe
  C:\Windows\System\QeHuhej.exe
  2⤵
  PID:8552
- C:\Windows\System\azMpFYQ.exe
  C:\Windows\System\azMpFYQ.exe
  2⤵
  PID:7400
- C:\Windows\System\qqqNVMM.exe
  C:\Windows\System\qqqNVMM.exe
  2⤵
  PID:3900
- C:\Windows\System\FoyJNtV.exe
  C:\Windows\System\FoyJNtV.exe
  2⤵
  PID:9472
- C:\Windows\System\OsLxSJT.exe
  C:\Windows\System\OsLxSJT.exe
  2⤵
  PID:9568
- C:\Windows\System\xTShXFM.exe
  C:\Windows\System\xTShXFM.exe
  2⤵
  PID:10344
- C:\Windows\System\ePiDnpR.exe
  C:\Windows\System\ePiDnpR.exe
  2⤵
  PID:9572
- C:\Windows\System\CWvOhQX.exe
  C:\Windows\System\CWvOhQX.exe
  2⤵
  PID:7172
- C:\Windows\System\IqhnRnQ.exe
  C:\Windows\System\IqhnRnQ.exe
  2⤵
  PID:10464
- C:\Windows\System\jZsVdQV.exe
  C:\Windows\System\jZsVdQV.exe
  2⤵
  PID:10488
- C:\Windows\System\sdZkLSt.exe
  C:\Windows\System\sdZkLSt.exe
  2⤵
  PID:8784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DiNlQQw.exe

Filesize
2.2MB

MD5
2337a78628308bd24f2f4cde043df8e8

SHA1
d5283e20630b130b96b866914a3df2cc516d172b

SHA256
f73500b43074117c6fc1b27be896c7cea4539300bc105edf966cb66a79036380

SHA512
71cd36e359b6fe5aec230a71ec8938e2d3472207275387d101ef769250d2e949ca735a5d270feb2d1f5f16854d3f283f7f4a304dc815ab6aaa3368382cd7aa57

Download Submit
C:\Windows\system\IIsrecG.exe

Filesize
2.2MB

MD5
8b24bc72820d4033e9082a08e9efae8b

SHA1
c00f10474c4ee9f7ace4aac09b1740d8893d00c0

SHA256
c023033de583ca335b17e83f1690dfaafb12765622005ba8a3004e5abb5823db

SHA512
172302a67d582c922b8236feb31dffc8e3a0de3ff4329be9e2e80f975413c8383d095ac92a75937e7a986183c18ec14c46698f5f4b768719df6ffe1c4654771c

Download Submit
C:\Windows\system\LUbVdtg.exe

Filesize
2.2MB

MD5
8d412fbed3eee6fc24b7584281b00e61

SHA1
8175d78cf94e7f860e5ee37047376867fa5041ce

SHA256
ffaa3408aaf5bb1dc0cff4c53c3586771e1ca6bca7b6c8211a749b50446ed833

SHA512
cee7e8689200aa1ff50203745002357e879cbdaa52822732b19d32130c7526d1f2182e77ac0865987cded02f1c2bdddeb951f51c490f16d58b2718da314e3b73

Download Submit
C:\Windows\system\OmJQene.exe

Filesize
2.2MB

MD5
ce8507adf8fd494efd24fc62db57fdaf

SHA1
5de566912128ad03ef2054c2ae36aee66b2c30ac

SHA256
770a4c2d58c66f93d04e00e8299e830a1dd0ab9ffdfa1a9b0202b93e918d6b66

SHA512
b78553933a93b92bf9e034a0f486b8a169698e7bb140d5ef3b094b8a08ea0c1e23a5a2408a6e517045190208c07209604a733ecded1d70d4250f9c14f102d916

Download Submit
C:\Windows\system\PPIJpqo.exe

Filesize
2.2MB

MD5
70613a33fc685325cf68e27e88a72596

SHA1
c2cba5bd32041f077e9956269614f7aafc4117c4

SHA256
142f66442af8707a5ecebba50b30457fe75a0f1750b36c62c0650b5b14f2c330

SHA512
48164b059626367428ba30b197cf15483f99f3beb1a3fa14f0227ac123412e4fe0c2c1de8333e2377feb6a47205afc51d465b0838b728645863e01488b3ba183

Download Submit
C:\Windows\system\QZzrTIk.exe

Filesize
2.2MB

MD5
cea38383c93aecc2b284fd98e83ee336

SHA1
e1b076d29f70bad72fc2ef4b0786f110cddcb4e8

SHA256
ada9d1fad88164e0b05b8664fd8965e2420faa20f6a3de40c4a8febefdeacce6

SHA512
82d8949a7f690ad9c756e9011e54744370870a36082fb93822b8bf8152bf9706e72da937cd20520808fed06e6ff99f92f12678824ba2fa0a28d3ed3516453217

Download Submit
C:\Windows\system\SmBpKnM.exe

Filesize
2.2MB

MD5
858e18e1c5bdc4ffde312df2f86d39bf

SHA1
19d2ec7ad199c78b0182347dafd6cce4ed346ee8

SHA256
3a7cdc46730667e7a244f35bd2bdc4ae090c35dec109b80c8c34cbb638d97ee6

SHA512
416e1459b0b78ebd4573ceb5332d83c6f46277ac2ee9eab512280c4813c692d1e93375d8a17499b466da7e1edbeb55ba678dd3b3968af0a91ee9422f2f402158

Download Submit
C:\Windows\system\UIVKJgw.exe

Filesize
2.2MB

MD5
66e3171f56ac7aeba8c46bf20763fba5

SHA1
feda852ce49a673f5bf02a2d62ac98aec0e1ad53

SHA256
20f7edf8953a85ce446011ad0a196900730ceb33b1bbfb9af4df405f264d0d4c

SHA512
1cd4e460003889b5ee2c9b113d1f9e1090f0ef2f0e3cd455c7351d4e73d388cf468e9df9610f959a2b1591f1989b9ef2c7a4a93110269a9c7fc08ee13ef03146

Download Submit
C:\Windows\system\XWTKJqb.exe

Filesize
2.2MB

MD5
68f2c2dfca601244845cf943e5f06cd6

SHA1
63adffd31154ceb32e9f33be01092d27af12b465

SHA256
3b98fcd6ddd053966cc251e2d4191e39c2ef28ffdd9cb210044781008817ba89

SHA512
ea9bf2b5b239fdf84bc3518989047e9531af3704d7f4a8155aa485c19e43f940c211c6aeff83d69059fcd0f2e350b33f23988ea0bafb4c29e32cc16374d19dfa

Download Submit
C:\Windows\system\ZEKYBod.exe

Filesize
2.2MB

MD5
256584d766e713984df351928d2fb1f1

SHA1
33d7eff3540ad1cf9b044019748d936028069a72

SHA256
b0713db92f9f41d1554aaf7d364a53ab91f46cecb874639c6a1948db29bc097a

SHA512
2897c758d5063c57ccd4d09805c306350ae1d5f208e8590c06180299256293e2d3b5f1248b7f276b243ca5aa76cdd83ce1d78dd9eec118b1a981cda04f18937e

Download Submit
C:\Windows\system\bMHbtnS.exe

Filesize
2.2MB

MD5
aa68b540978cce55007d83a3d7001bdb

SHA1
cc9b82c2990cebcc7748e8fcb484433f43468325

SHA256
3aa3ac84d3311761ace410dc57df49ef8440867c8440a18ced2c154807087df8

SHA512
d3d7a963a439a5173472f393380d1c1ed8c86523f3c03e39df3fb41255e0e2d324cad433bce74fa8fb24b2672e4ab35a7deddd053bc78a02f6701431fe37276b

Download Submit
C:\Windows\system\bXyFKUH.exe

Filesize
2.2MB

MD5
e7ff241f3275ecfd7b6a80d9b73ecb74

SHA1
d8c8bb319afc425af6f8237df5e22eace3b0357c

SHA256
e644cc461f15cfdc45c2352be2780542eb6479fc631b8f6b3856893c24f1a6ab

SHA512
65897d9f6ecb3549dbe6c76a971447a89909fe638421c57ea4d92bd5f76fc631636458f57bb1616327cc1171c21c264097b27aa7018ec3920fe3c45588562e86

Download Submit
C:\Windows\system\buDULaM.exe

Filesize
2.2MB

MD5
e0b9ac1eb1991f906770e9f8026d4303

SHA1
bcfb556ece5b4217f0da7d26d1c6048342bb24ed

SHA256
67617cbcaa41a1b3440700688db6e2d9cf6e48f26e9c30ceedde38c517cf986c

SHA512
62c7d26c394008bf65f0341c5a1438c61479b77cddca14974d32389a2d40d366b29995b2267ac2082e8b58e766b6d3cfd947628256945008db19f6c23e4ea1f9

Download Submit
C:\Windows\system\cEJDtnY.exe

Filesize
2.2MB

MD5
3daafd2636a1c5c6446fa894c969faf4

SHA1
41b67febc9b6fdd5293281f4bf7192e379e494be

SHA256
4a70af2e77ff2b7135c8bb0257318b7aecf6d9de6232f4ce97bdbed8f3e8e589

SHA512
26cfcde60f71d42f7f83de272a2bbe3dac019c5b0996938c6aa050cf52e1e39d32b33fa546ec9171723f97e3026e24736162ee6333881d0bb63d2b861a2fb14b

Download Submit
C:\Windows\system\eCKQErh.exe

Filesize
2.2MB

MD5
35c76bf18bee8ac5627e07498e9ffa2b

SHA1
170791b0f1e557b07a44032343f62287dc1537fe

SHA256
cfc9a0541fe0d0a7e29fdf53c38c065301e07ff4eff80aac0847611fcc3eeb6a

SHA512
2a04d51e4d6252a17479517534a57e01dcde4363d449c70d06ec162cfca4f65d2e0bed5cca244cac98adac2c6270152b5645c854080d2ffe17bf1652d066a7f2

Download Submit
C:\Windows\system\gdPeFvG.exe

Filesize
2.2MB

MD5
55446090f56de385b3b9ecbb1d4b90b3

SHA1
7c52af2c3eb6220ec148fccf7435abe02bac21c9

SHA256
934a8b9953ec46d5e30a57da75977a02bccc8507f0e1498b4961034f3397bd50

SHA512
62e174a71e93404b3d2154febbdfa2d2746ddeef5e0003511ada9801899511986970d75fe2461e448417a420eabe81fd62e061790a0a6a77aff49110f7d5b884

Download Submit
C:\Windows\system\luGPQEE.exe

Filesize
2.2MB

MD5
57f2fd6960d10bcb22e5a62b120a618f

SHA1
e0f7bf0536dab23094bc624abef13e9d146731fb

SHA256
09745d46dd0d51a436fa6fa4a024cd52b4f15b2e9fd8d28d74f9f968bc11c1b0

SHA512
82bb28b2aa4fe595be3c9efdf8c94cfeefa1e01999127c0ff2879b9b7a06fa8e9868161b4f37394657b9cb21f7eeab7e0179a932603bb97f4bcc677157cced92

Download Submit
C:\Windows\system\nFKaJNR.exe

Filesize
2.2MB

MD5
5e7b7975cd50ab720a485a76d8cb3cb1

SHA1
215cb7c0ae79cb4836599e1dcf69993083d91c31

SHA256
6b2039fc13cf31810e07a201340b03882dc959737bb472859b3a804fa29a9743

SHA512
96e65c02201f986fbbb83db95c0e79e69c1d83209d72001bf3628e44997ac9f84f158cd9cdc0e02d4c452791722f6ec3eb6b9a2bae6cfc8575dad77c5080be16

Download Submit
C:\Windows\system\pTAjVDu.exe

Filesize
2.2MB

MD5
79713b7eaf189ba30af4b5121b0b2d74

SHA1
36ad76b42186f21734957d8998fcbbf7c5fb43a1

SHA256
3bf94763fba2f8516f30b64efa127ea5ee0cb8098f6e3cf340e29df2821ec78f

SHA512
385cc27277841a42fe4280084fd179716a06b59f36e5028a5f86bbf5cc777c7956aec29ee29f40c7c52724ab5bae2440d2b9bb056c0d0277ec38c06eaab9ea1d

Download Submit
C:\Windows\system\rKiQtNG.exe

Filesize
2.2MB

MD5
86e9b739c9983cfe559cf7627b90441f

SHA1
c0e0bac2e94a5d9b92eaa5c7ca2dd2e74b1ab5b6

SHA256
929cfbdb4461b25c1e4ad90551414a4da132e1a281a77c44a4fd7ba3fb0e1aec

SHA512
1d9ec1270fdf5faac579b0999e72676a75cde1f12f85cf3c81b19b8c069d0459783bb5c7ec6b6a9d74d7410ae7e1e142cba2ff612e20c12fe1256e9c6334b038

Download Submit
C:\Windows\system\rNySgdi.exe

Filesize
2.2MB

MD5
d73b24fb9fccd9f74d98e64525f99378

SHA1
0834bb0135f5f07246c9c0116f4b09bd64d20c68

SHA256
d64fc9dd5dc4687e6649e123704241d0edd5052b3634999eaa0557ffb81561d1

SHA512
15e90f43bbe21b921a37beda48b3b5adbad91390437f65be289d0cd78efeb3aaa289d3e9965c0d42bc531bbd58327a9405e1374d1d2b803e9b183dda892428b6

Download Submit
C:\Windows\system\vSJMSgF.exe

Filesize
2.2MB

MD5
e0f8489caf28840cbe584089ee818b4c

SHA1
b9b6c201244bbd9a56008528e561ac67f88abd24

SHA256
702725873b7126f9e848261b4779e6e1f3d12842811b62554db81ae58b1033cd

SHA512
a4dd579eebc21194f6fc4c065087a13aed5d8ebaed31f8726fbdb795e46f147ce49f46f52e705ffc0981f097fe01ff02ae5d82d8cc3ce707b538890a1582dea1

Download Submit
C:\Windows\system\wmIGNnC.exe

Filesize
2.2MB

MD5
ef588518c17ad74144173a7fb407b061

SHA1
055d3bfa1aaab2d7cb4ea2ece6a58cb888e2b28d

SHA256
6afd0830fbf37c5e2955b22055a9a5384636156a8ed9598cfd98a5b86ed5c92e

SHA512
6390bbb0391f8d570b701b5a457086c7f6ff06d40974be9fcf614a551b8867d655ab4b9c09b23e36a6470fda70e65c4fe0774a8f41b3ec32176500e905be6dd0

Download Submit
C:\Windows\system\xyULqoR.exe

Filesize
2.2MB

MD5
d208c1680ae9f8726a27d9aaa97af309

SHA1
2993e079c575434ba7f52a9a471973bdf8224fa5

SHA256
7471005391e546c97efc25c8c858d4595a7937934b1c8f25e0bc5fb53fd9e8a5

SHA512
9bcfb2f191678dba2924a9b8a19d41f2c93cd61e4445275ecaec98b773b70f8d3fff5d7488c21cbcaebda9963186d8da06c54039f169505198fca6c4298f8d2f

Download Submit
C:\Windows\system\ylQJSSl.exe

Filesize
2.2MB

MD5
08091d5d75e15cd6e0b2582cb4eb8aea

SHA1
8ca30d20dc5a8219e8c7b23c9c347f3c520ae29a

SHA256
c61ab6ebca8f020d59673bbd8cac32892d5fa93b2453dbd7e1ef7180048f1613

SHA512
b02c4a3d344590d83955e7f886ebfad0959fc5f601a06453fcf08f8de0a8a3edf037d4cc6fc9ae284d104ec215cd6c15e85ec61f47439cadfcd83fe63d33da24

Download Submit
\Windows\system\MnNkMHR.exe

Filesize
2.2MB

MD5
c16b40a8c45411cb32d11cb65931fff0

SHA1
a26ff55f9340c94638f1d11984e44ea97d55f270

SHA256
1b1169467abce9858c10b12a60d1d54fd82518cf6fd53b69036e6488f7fee477

SHA512
abe105e2b01a68d4dcc9a8869c8f40bb7d63487d2d1c5b8b94d5f9162561cd861ab28b4c47c02b0ea2ded05bb2fbe00b39aa64b8dc00d6565fbf3a8fc0e508dc

Download Submit
\Windows\system\dKCpaCl.exe

Filesize
2.2MB

MD5
6c9e63eb71cbf21bfd3e101912fa3ee7

SHA1
1286f6dcf06765e1b35751a774a7ed247b0c4994

SHA256
ee3bcc506fbef19b7710004a1caa831281f0844f3503748ce88e3cc952a9f5a7

SHA512
d3abf2798fd71960442a3e44da8dbb9ca3e0ecdaaba2f57e2aff03409a56512343a7790cff4a8603328166cddcf9bee85026fe6c6b0eb73c83dc1a667f8edd82

Download Submit
\Windows\system\imvVYCD.exe

Filesize
2.2MB

MD5
bbd5505aaf83875aa866436feff72baa

SHA1
6bf1dba1ad7ef97869a8aa443c798dc3afa9b69c

SHA256
e7aa182fdfef8d042d41c4cd5dbce08b7b8a3862fdc4a3441ea3bb1716bbedd6

SHA512
b900a9e3d793d5457a8f9e275ecc04ae5758b6651e77729f96e026c181f6c3da4f586608f86bc832002b10728f0cdcd69ba961fbdf2395b1efab1738becabc85

Download Submit
\Windows\system\wzZSMif.exe

Filesize
2.2MB

MD5
23feaff0213ae6348f775cb91f2b4708

SHA1
8814e8de110162c988146d424c918985afff0da7

SHA256
ea1293b06b3dd465bec3bae02902dd70672da19ec1c0a82c7e6fd1f5aedfcecd

SHA512
cebbbf5c419f14bd8a4d79bb1bdc881d39601ae4bbf031b2dc6ad09f1b96ca1db970c6359340bbc391f9b361d7c0d0021569e75677be3854287a41240eb9e882

Download Submit
\Windows\system\xDnYOhY.exe

Filesize
2.2MB

MD5
b118f5cb62a7d64964d9f45735fc8685

SHA1
c19a34117fb568f6f8b04cbae8c89560d3a8bc4f

SHA256
94102f49f4bc836b43405b5fd17e0d92c1c3a695a3aac948e5522122c3c0be90

SHA512
3ecd96c86ca6627306ef09872eafbae692a11c708ea341a4f57cf3febd82163d62634484335a714c1de629ba5a16a2b41229ab8eb182261838a6ccc81067e570

Download Submit
\Windows\system\yXNSYXz.exe

Filesize
2.2MB

MD5
3e3c42d1b020d44fa929ff6bcdd1515d

SHA1
13a202b165e7b5c2da7aeea00b792b39e6f979ab

SHA256
a8d7c92aacfbb0a086d41ec3967bf60ba75c3820d0466042690514429d0f520e

SHA512
08b006511091dc0927ee5c4bf0ab14036c2f8ccb7ce844303c91237cddcc20ba4cb19dba95326a07cae085d0a6a4d3f1fb33a371e3689f3f67d3b6c10f43a118

Download Submit
\Windows\system\ztwFjoF.exe

Filesize
2.2MB

MD5
a8f46ee65c1f738dc1fa482f6be93d72

SHA1
e7d4e434cb91b694034cecc3a8403685fb343102

SHA256
9e6aaed13d0bbcf878424fd4e34d8316ea09e3f14f74d8bf703aa1df83a003cd

SHA512
71959502b3f0c6d6a74508023f4baab76472dcf22cfb0297a63e1d5a59a1c8019d17a13441abd81ff00e390aa078aef4f5598656571035c43eae27e1b2f204dc

Download Submit
memory/2304-115-0x0000000002BB0000-0x0000000002FA2000-memory.dmp

Filesize
3.9MB

Download
memory/2304-130-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2304-1-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2304-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2304-119-0x0000000002BB0000-0x0000000002FA2000-memory.dmp

Filesize
3.9MB

Download
memory/2304-127-0x0000000003030000-0x0000000003422000-memory.dmp

Filesize
3.9MB

Download
memory/2304-8-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2304-125-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2304-129-0x0000000003030000-0x0000000003422000-memory.dmp

Filesize
3.9MB

Download
memory/2304-123-0x0000000002BB0000-0x0000000002FA2000-memory.dmp

Filesize
3.9MB

Download
memory/2304-117-0x0000000002BB0000-0x0000000002FA2000-memory.dmp

Filesize
3.9MB

Download
memory/2304-121-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2340-118-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2340-1462-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2380-126-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-1468-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2384-1446-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2384-128-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2440-116-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2440-1382-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2568-1471-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2568-114-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2612-120-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-1467-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-1474-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2680-122-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2784-9-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2784-1370-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2852-1375-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-124-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-91-0x000007FEF5790000-0x000007FEF612D000-memory.dmp

Filesize
9.6MB

Download
memory/2872-57-0x000000001B2F0000-0x000000001B5D2000-memory.dmp

Filesize
2.9MB

Download
memory/2872-93-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/2872-112-0x000007FEF5790000-0x000007FEF612D000-memory.dmp

Filesize
9.6MB

Download
memory/2872-62-0x0000000002520000-0x0000000002528000-memory.dmp

Filesize
32KB

Download
memory/2872-165-0x000007FEF5790000-0x000007FEF612D000-memory.dmp

Filesize
9.6MB

Download
memory/2872-113-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download